From fa18d60b9810eddd4a654bb7ee2d1f2e2086dce1 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 1 Jul 2006 00:39:15 +0000 Subject: [PATCH 001/301] Initial 1.0.0 git-svn-id: svn://svn.code.sf.net/p/axtls/code/axTLS@2 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 135 + README | 156 + bindings/Config.in | 90 + bindings/Makefile | 63 + bindings/README | 43 + bindings/csharp/Makefile | 23 + bindings/csharp/axTLS.cs | 466 +++ bindings/generate_SWIG_interface.pl | 327 ++ bindings/generate_interface.pl | 302 ++ bindings/java/Makefile | 93 + bindings/java/SSL.java | 125 + bindings/java/SSLCTX.java | 217 + bindings/java/SSLClient.java | 66 + bindings/java/SSLReadHolder.java | 49 + bindings/java/SSLServer.java | 60 + bindings/java/SSLUtil.java | 96 + bindings/perl/Makefile | 81 + bindings/vbnet/Makefile | 23 + bindings/vbnet/axTLSvb.vb | 175 + config/.config | 107 + config/.config.old | 107 + config/.config.tmp | 11 + config/Config.in | 112 + config/Rules.mak | 220 + config/awhttpd.aip | 133 + config/awhttpd.back.aip | 128 + config/awhttpd.msi | Bin 0 -> 681472 bytes config/axtls.RES | Bin 0 -> 22748 bytes config/axtls.rc | 32 + config/config.h | 108 + config/makefile.conf | 113 + config/makefile.dotnet.conf | 53 + config/makefile.java.conf | 56 + config/makefile.post | 19 + config/scripts/config/Kconfig-language.txt | 255 ++ config/scripts/config/Makefile | 121 + config/scripts/config/a.exe | Bin 0 -> 8185 bytes config/scripts/config/conf.c | 583 +++ config/scripts/config/conf.exe | Bin 0 -> 91179 bytes config/scripts/config/confdata.c | 458 ++ config/scripts/config/expr.c | 1099 +++++ config/scripts/config/expr.h | 195 + config/scripts/config/lex.zconf.c | 3688 ++++++++++++++++ config/scripts/config/lex.zconf.c_shipped | 3688 ++++++++++++++++ config/scripts/config/lkc.h | 123 + config/scripts/config/lkc_defs.h | 40 + config/scripts/config/lkc_proto.h | 40 + .../scripts/config/lxdialog/BIG.FAT.WARNING | 4 + config/scripts/config/lxdialog/checklist.c | 372 ++ config/scripts/config/lxdialog/colors.h | 161 + config/scripts/config/lxdialog/dialog.h | 199 + config/scripts/config/lxdialog/inputbox.c | 240 ++ config/scripts/config/lxdialog/menubox.c | 438 ++ config/scripts/config/lxdialog/msgbox.c | 85 + config/scripts/config/lxdialog/textbox.c | 556 +++ config/scripts/config/lxdialog/util.c | 375 ++ config/scripts/config/lxdialog/yesno.c | 118 + config/scripts/config/mconf.c | 977 +++++ config/scripts/config/mconf.exe | Bin 0 -> 138973 bytes config/scripts/config/menu.c | 390 ++ config/scripts/config/mkconfigs | 67 + config/scripts/config/symbol.c | 809 ++++ config/scripts/config/util.c | 109 + config/scripts/config/zconf.l | 366 ++ config/scripts/config/zconf.tab.c | 2130 ++++++++++ config/scripts/config/zconf.tab.c_shipped | 2130 ++++++++++ config/scripts/config/zconf.tab.h | 125 + config/scripts/config/zconf.tab.h_shipped | 125 + config/scripts/config/zconf.y | 690 +++ config/win32config | 115 + docsrc/Makefile | 27 + docsrc/axTLS.dox | 1237 ++++++ docsrc/doco_footer.html | 3 + docsrc/images/axolotl.jpg | Bin 0 -> 3041 bytes docsrc/images/tsbasbw.gif | Bin 0 -> 2481 bytes httpd/Config.in | 141 + httpd/Makefile | 111 + httpd/awhttpd-3.0.7.tar | Bin 0 -> 194560 bytes httpd/awhttpd.patch | 1768 ++++++++ samples/Config.in | 56 + samples/Makefile | 46 + samples/c/Makefile | 67 + samples/c/axssl.c | 862 ++++ samples/csharp/Makefile | 36 + samples/csharp/axssl.cs | 744 ++++ samples/java/Makefile | 39 + samples/java/axssl.java | 760 ++++ samples/java/manifest.mf | 1 + samples/perl/Makefile | 31 + samples/perl/axssl.pl | 633 +++ samples/vbnet/Makefile | 36 + samples/vbnet/axssl.vb | 682 +++ ssl/BigIntConfig.in | 132 + ssl/Config.in | 250 ++ ssl/Makefile | 86 + ssl/aes.c | 477 +++ ssl/asn1.c | 868 ++++ ssl/bigint.c | 1508 +++++++ ssl/bigint.h | 97 + ssl/bigint_impl.h | 106 + ssl/cert.h | 37 + ssl/crypto.h | 292 ++ ssl/crypto_misc.c | 307 ++ ssl/hmac.c | 90 + ssl/loader.c | 450 ++ ssl/md5.c | 288 ++ ssl/os_port.c | 61 + ssl/os_port.h | 145 + ssl/p12.c | 431 ++ ssl/private_key.h | 30 + ssl/rc4.c | 83 + ssl/rsa.c | 337 ++ ssl/sha1.c | 244 ++ ssl/ssl.h | 416 ++ ssl/test/Makefile | 65 + ssl/test/axTLS.ca_key.pem | 15 + ssl/test/axTLS.ca_x509.cer | Bin 0 -> 483 bytes ssl/test/axTLS.ca_x509.pem | 13 + ssl/test/axTLS.device_key | Bin 0 -> 609 bytes ssl/test/axTLS.device_key.pem | 15 + ssl/test/axTLS.encrypted.p8 | Bin 0 -> 385 bytes ssl/test/axTLS.encrypted_pem.p8 | 11 + ssl/test/axTLS.key_1024 | Bin 0 -> 609 bytes ssl/test/axTLS.key_1024.pem | 15 + ssl/test/axTLS.key_2048 | Bin 0 -> 1191 bytes ssl/test/axTLS.key_2048.pem | 27 + ssl/test/axTLS.key_4096 | Bin 0 -> 2349 bytes ssl/test/axTLS.key_4096.pem | 51 + ssl/test/axTLS.key_512 | Bin 0 -> 321 bytes ssl/test/axTLS.key_512.pem | 9 + ssl/test/axTLS.key_aes128.pem | 12 + ssl/test/axTLS.key_aes256.pem | 12 + ssl/test/axTLS.noname.p12 | Bin 0 -> 1483 bytes ssl/test/axTLS.unencrypted.p8 | Bin 0 -> 347 bytes ssl/test/axTLS.unencrypted_pem.p8 | 10 + ssl/test/axTLS.withCA.p12 | Bin 0 -> 2089 bytes ssl/test/axTLS.withoutCA.p12 | Bin 0 -> 1573 bytes ssl/test/axTLS.withoutCA.ya | Bin 0 -> 1576 bytes ssl/test/axTLS.x509_1024.cer | Bin 0 -> 475 bytes ssl/test/axTLS.x509_1024.pem | 12 + ssl/test/axTLS.x509_2048.cer | Bin 0 -> 607 bytes ssl/test/axTLS.x509_2048.pem | 15 + ssl/test/axTLS.x509_4096.cer | Bin 0 -> 863 bytes ssl/test/axTLS.x509_4096.pem | 20 + ssl/test/axTLS.x509_512.cer | Bin 0 -> 406 bytes ssl/test/axTLS.x509_512.pem | 11 + ssl/test/axTLS.x509_aes128.pem | 11 + ssl/test/axTLS.x509_aes256.pem | 11 + ssl/test/axTLS.x509_bad_after.pem | 11 + ssl/test/axTLS.x509_bad_before.pem | 11 + ssl/test/axTLS.x509_device.cer | Bin 0 -> 401 bytes ssl/test/axTLS.x509_device.pem | 24 + ssl/test/deutsche_telecom.x509_ca | Bin 0 -> 670 bytes ssl/test/equifax.x509_ca | Bin 0 -> 646 bytes ssl/test/killopenssl.sh | 2 + ssl/test/make_certs.sh | 162 + ssl/test/microsoft.x509_ca | Bin 0 -> 1046 bytes ssl/test/microsoft.x509_ca.pem | 24 + ssl/test/perf_bigint.c | 218 + ssl/test/ssltest.c | 1714 ++++++++ ssl/test/test_axssl.sh | 117 + ssl/test/thawte.x509_ca | Bin 0 -> 811 bytes ssl/test/verisign.x509_ca | Bin 0 -> 668 bytes ssl/test/verisign.x509_ca.pem | 16 + ssl/test/verisign.x509_my_cert | Bin 0 -> 1095 bytes ssl/test/verisign.x509_my_cert.pem | 25 + ssl/tls1.c | 2041 +++++++++ ssl/tls1.h | 249 ++ ssl/tls1_clnt.c | 330 ++ ssl/tls1_svr.c | 435 ++ www/crypto_files/crypto_2600des.gif | Bin 0 -> 15768 bytes www/crypto_files/crypto_3ways.gif | Bin 0 -> 17993 bytes www/crypto_files/crypto_backrsa.jpg | Bin 0 -> 6750 bytes www/crypto_files/crypto_cert.gif | Bin 0 -> 17873 bytes www/crypto_files/crypto_des.gif | Bin 0 -> 7085 bytes www/crypto_files/crypto_ecc.gif | Bin 0 -> 4700 bytes www/crypto_files/crypto_sslv3.gif | Bin 0 -> 30156 bytes www/crypto_files/crypto_types.gif | Bin 0 -> 11401 bytes www/crypto_files/kerberos.gif | Bin 0 -> 20772 bytes www/favicon.ico | Bin 0 -> 22486 bytes www/index.html | 3718 +++++++++++++++++ www/test_dir/some_text.txt | 1 + www/test_dir/test_cgi.php | 6 + 183 files changed, 48114 insertions(+) create mode 100644 Makefile create mode 100644 README create mode 100644 bindings/Config.in create mode 100644 bindings/Makefile create mode 100644 bindings/README create mode 100644 bindings/csharp/Makefile create mode 100644 bindings/csharp/axTLS.cs create mode 100755 bindings/generate_SWIG_interface.pl create mode 100755 bindings/generate_interface.pl create mode 100644 bindings/java/Makefile create mode 100644 bindings/java/SSL.java create mode 100644 bindings/java/SSLCTX.java create mode 100644 bindings/java/SSLClient.java create mode 100644 bindings/java/SSLReadHolder.java create mode 100644 bindings/java/SSLServer.java create mode 100644 bindings/java/SSLUtil.java create mode 100644 bindings/perl/Makefile create mode 100644 bindings/vbnet/Makefile create mode 100644 bindings/vbnet/axTLSvb.vb create mode 100644 config/.config create mode 100644 config/.config.old create mode 100644 config/.config.tmp create mode 100644 config/Config.in create mode 100644 config/Rules.mak create mode 100755 config/awhttpd.aip create mode 100644 config/awhttpd.back.aip create mode 100755 config/awhttpd.msi create mode 100644 config/axtls.RES create mode 100644 config/axtls.rc create mode 100644 config/config.h create mode 100644 config/makefile.conf create mode 100644 config/makefile.dotnet.conf create mode 100644 config/makefile.java.conf create mode 100644 config/makefile.post create mode 100644 config/scripts/config/Kconfig-language.txt create mode 100644 config/scripts/config/Makefile create mode 100755 config/scripts/config/a.exe create mode 100644 config/scripts/config/conf.c create mode 100755 config/scripts/config/conf.exe create mode 100644 config/scripts/config/confdata.c create mode 100644 config/scripts/config/expr.c create mode 100644 config/scripts/config/expr.h create mode 100644 config/scripts/config/lex.zconf.c create mode 100644 config/scripts/config/lex.zconf.c_shipped create mode 100644 config/scripts/config/lkc.h create mode 100644 config/scripts/config/lkc_defs.h create mode 100644 config/scripts/config/lkc_proto.h create mode 100644 config/scripts/config/lxdialog/BIG.FAT.WARNING create mode 100644 config/scripts/config/lxdialog/checklist.c create mode 100644 config/scripts/config/lxdialog/colors.h create mode 100644 config/scripts/config/lxdialog/dialog.h create mode 100644 config/scripts/config/lxdialog/inputbox.c create mode 100644 config/scripts/config/lxdialog/menubox.c create mode 100644 config/scripts/config/lxdialog/msgbox.c create mode 100644 config/scripts/config/lxdialog/textbox.c create mode 100644 config/scripts/config/lxdialog/util.c create mode 100644 config/scripts/config/lxdialog/yesno.c create mode 100644 config/scripts/config/mconf.c create mode 100755 config/scripts/config/mconf.exe create mode 100644 config/scripts/config/menu.c create mode 100755 config/scripts/config/mkconfigs create mode 100644 config/scripts/config/symbol.c create mode 100644 config/scripts/config/util.c create mode 100644 config/scripts/config/zconf.l create mode 100644 config/scripts/config/zconf.tab.c create mode 100644 config/scripts/config/zconf.tab.c_shipped create mode 100644 config/scripts/config/zconf.tab.h create mode 100644 config/scripts/config/zconf.tab.h_shipped create mode 100644 config/scripts/config/zconf.y create mode 100644 config/win32config create mode 100644 docsrc/Makefile create mode 100644 docsrc/axTLS.dox create mode 100644 docsrc/doco_footer.html create mode 100644 docsrc/images/axolotl.jpg create mode 100644 docsrc/images/tsbasbw.gif create mode 100644 httpd/Config.in create mode 100644 httpd/Makefile create mode 100644 httpd/awhttpd-3.0.7.tar create mode 100644 httpd/awhttpd.patch create mode 100644 samples/Config.in create mode 100644 samples/Makefile create mode 100644 samples/c/Makefile create mode 100644 samples/c/axssl.c create mode 100644 samples/csharp/Makefile create mode 100644 samples/csharp/axssl.cs create mode 100644 samples/java/Makefile create mode 100644 samples/java/axssl.java create mode 100644 samples/java/manifest.mf create mode 100644 samples/perl/Makefile create mode 100755 samples/perl/axssl.pl create mode 100644 samples/vbnet/Makefile create mode 100644 samples/vbnet/axssl.vb create mode 100644 ssl/BigIntConfig.in create mode 100644 ssl/Config.in create mode 100644 ssl/Makefile create mode 100644 ssl/aes.c create mode 100644 ssl/asn1.c create mode 100644 ssl/bigint.c create mode 100644 ssl/bigint.h create mode 100644 ssl/bigint_impl.h create mode 100644 ssl/cert.h create mode 100644 ssl/crypto.h create mode 100644 ssl/crypto_misc.c create mode 100644 ssl/hmac.c create mode 100644 ssl/loader.c create mode 100644 ssl/md5.c create mode 100644 ssl/os_port.c create mode 100644 ssl/os_port.h create mode 100644 ssl/p12.c create mode 100644 ssl/private_key.h create mode 100644 ssl/rc4.c create mode 100644 ssl/rsa.c create mode 100644 ssl/sha1.c create mode 100644 ssl/ssl.h create mode 100644 ssl/test/Makefile create mode 100644 ssl/test/axTLS.ca_key.pem create mode 100644 ssl/test/axTLS.ca_x509.cer create mode 100644 ssl/test/axTLS.ca_x509.pem create mode 100644 ssl/test/axTLS.device_key create mode 100644 ssl/test/axTLS.device_key.pem create mode 100644 ssl/test/axTLS.encrypted.p8 create mode 100644 ssl/test/axTLS.encrypted_pem.p8 create mode 100644 ssl/test/axTLS.key_1024 create mode 100644 ssl/test/axTLS.key_1024.pem create mode 100644 ssl/test/axTLS.key_2048 create mode 100644 ssl/test/axTLS.key_2048.pem create mode 100644 ssl/test/axTLS.key_4096 create mode 100644 ssl/test/axTLS.key_4096.pem create mode 100644 ssl/test/axTLS.key_512 create mode 100644 ssl/test/axTLS.key_512.pem create mode 100644 ssl/test/axTLS.key_aes128.pem create mode 100644 ssl/test/axTLS.key_aes256.pem create mode 100644 ssl/test/axTLS.noname.p12 create mode 100644 ssl/test/axTLS.unencrypted.p8 create mode 100644 ssl/test/axTLS.unencrypted_pem.p8 create mode 100644 ssl/test/axTLS.withCA.p12 create mode 100644 ssl/test/axTLS.withoutCA.p12 create mode 100644 ssl/test/axTLS.withoutCA.ya create mode 100644 ssl/test/axTLS.x509_1024.cer create mode 100644 ssl/test/axTLS.x509_1024.pem create mode 100644 ssl/test/axTLS.x509_2048.cer create mode 100644 ssl/test/axTLS.x509_2048.pem create mode 100644 ssl/test/axTLS.x509_4096.cer create mode 100644 ssl/test/axTLS.x509_4096.pem create mode 100644 ssl/test/axTLS.x509_512.cer create mode 100644 ssl/test/axTLS.x509_512.pem create mode 100644 ssl/test/axTLS.x509_aes128.pem create mode 100644 ssl/test/axTLS.x509_aes256.pem create mode 100644 ssl/test/axTLS.x509_bad_after.pem create mode 100644 ssl/test/axTLS.x509_bad_before.pem create mode 100644 ssl/test/axTLS.x509_device.cer create mode 100644 ssl/test/axTLS.x509_device.pem create mode 100644 ssl/test/deutsche_telecom.x509_ca create mode 100644 ssl/test/equifax.x509_ca create mode 100755 ssl/test/killopenssl.sh create mode 100755 ssl/test/make_certs.sh create mode 100644 ssl/test/microsoft.x509_ca create mode 100644 ssl/test/microsoft.x509_ca.pem create mode 100644 ssl/test/perf_bigint.c create mode 100644 ssl/test/ssltest.c create mode 100755 ssl/test/test_axssl.sh create mode 100644 ssl/test/thawte.x509_ca create mode 100644 ssl/test/verisign.x509_ca create mode 100644 ssl/test/verisign.x509_ca.pem create mode 100644 ssl/test/verisign.x509_my_cert create mode 100644 ssl/test/verisign.x509_my_cert.pem create mode 100644 ssl/tls1.c create mode 100644 ssl/tls1.h create mode 100644 ssl/tls1_clnt.c create mode 100644 ssl/tls1_svr.c create mode 100644 www/crypto_files/crypto_2600des.gif create mode 100644 www/crypto_files/crypto_3ways.gif create mode 100644 www/crypto_files/crypto_backrsa.jpg create mode 100644 www/crypto_files/crypto_cert.gif create mode 100644 www/crypto_files/crypto_des.gif create mode 100644 www/crypto_files/crypto_ecc.gif create mode 100644 www/crypto_files/crypto_sslv3.gif create mode 100644 www/crypto_files/crypto_types.gif create mode 100644 www/crypto_files/kerberos.gif create mode 100644 www/favicon.ico create mode 100644 www/index.html create mode 100644 www/test_dir/some_text.txt create mode 100755 www/test_dir/test_cgi.php diff --git a/Makefile b/Makefile new file mode 100644 index 0000000000..e335b82c85 --- /dev/null +++ b/Makefile @@ -0,0 +1,135 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +-include config/.config + +ifneq ($(strip $(HAVE_DOT_CONFIG)),y) +all: menuconfig +else +all: target +endif + +target : $(TARGET) + +include config/makefile.conf + +# VERSION has to come from the command line +RELEASE=axTLS-$(VERSION) + +# standard version +target: + $(MAKE) -C ssl +ifdef CONFIG_AWHTTPD + $(MAKE) -C httpd untar_web_server + $(MAKE) -C httpd +endif +ifdef CONFIG_BINDINGS + $(MAKE) -C bindings +endif +ifdef CONFIG_SAMPLES + $(MAKE) -C samples +endif + +release: + $(MAKE) -C config/scripts/config clean + -$(MAKE) clean + -@rm config/.* config/config.h + -@rm config/*.msi config/*.back.aip + cd ../; tar cvfz $(RELEASE).tar.gz axTLS; cd -; + +docs: + $(MAKE) -C docsrc doco + +# build the Win32 demo release version +win32_demo: + -@rm -fr ../axTLS.release_test > /dev/null 2>&1 + $(MAKE) win32releaseconf + cd ../; zip $(RELEASE).zip \ + ./axTLS/awhttpd.exe \ + ./axTLS/axssl.exe \ + ./axTLS/axtls.dll \ + ./axTLS/axtls.lib \ + ./axTLS/axtls.static.lib \ + ./axTLS/axtlsj.dll \ + ./axTLS/axssl.csharp.exe \ + ./axTLS/axssl.vbnet.exe \ + ./axTLS/axtls.jar \ + ./axTLS/www/* \ + ./axTLS/www/crypto_files/*; \ + unzip -d axTLS.release_test $(RELEASE).zip; cd -; + +# tidy up things +clean:: + @cd ssl; $(MAKE) clean + @cd httpd; $(MAKE) clean + @cd samples; $(MAKE) clean + @cd docsrc; $(MAKE) clean + @cd bindings; $(MAKE) clean + +# --------------------------------------------------------------------------- +# mconf stuff +# --------------------------------------------------------------------------- + +CONFIG_CONFIG_IN = config/Config.in +CONFIG_DEFCONFIG = config/defconfig + +config/scripts/config/conf: config/scripts/config/Makefile + $(MAKE) -C config/scripts/config conf + -@if [ ! -f config/.config ] ; then \ + cp $(CONFIG_DEFCONFIG) config/.config; \ + fi + +config/scripts/config/mconf: config/scripts/config/Makefile + $(MAKE) -C config/scripts/config ncurses conf mconf + -@if [ ! -f config/.config ] ; then \ + cp $(CONFIG_DEFCONFIG) .config; \ + fi + +cleanconf: + $(MAKE) -C config/scripts/config clean + @rm -f config/.config + +menuconfig: config/scripts/config/mconf + @./config/scripts/config/mconf $(CONFIG_CONFIG_IN) + +config: config/scripts/config/conf + @./config/scripts/config/conf $(CONFIG_CONFIG_IN) + +oldconfig: config/scripts/config/conf + @./config/scripts/config/conf -o $(CONFIG_CONFIG_IN) + +default: config/scripts/config/conf + @./config/scripts/config/conf -d $(CONFIG_CONFIG_IN) > /dev/null + $(MAKE) + +randconfig: config/scripts/config/conf + @./config/scripts/config/conf -r $(CONFIG_CONFIG_IN) + +allnoconfig: config/scripts/config/conf + @./config/scripts/config/conf -n $(CONFIG_CONFIG_IN) + +allyesconfig: config/scripts/config/conf + @./config/scripts/config/conf -y $(CONFIG_CONFIG_IN) + +# The special win32 release configuration +win32releaseconf: config/scripts/config/conf + @./config/scripts/config/conf -D config/win32config $(CONFIG_CONFIG_IN) > /dev/null + $(MAKE) + + + diff --git a/README b/README new file mode 100644 index 0000000000..2d6d7b990a --- /dev/null +++ b/README @@ -0,0 +1,156 @@ +######################################################################## +# axTLS Quick-Start Guide +######################################################################## + +This is a guide to get a small SSL web-server up and running quickly. + +######################################################################## +# Introduction +######################################################################## +The axTLS project is an SSL client/server library using the TLSv1 protocol. +It is designed to be small and fast, and is suited to embedded projects. A web +server is included (called Anti-Web). + +The web server + SSL library is around 50-60kB and is configurable for +features or size. + +######################################################################## +# Compilation +######################################################################## + +All platforms require GNU make. This means on Win32 that Cygwin needs to be +installed with "make" and various developer options selected. + +Configuration now uses a tool called "mconf" which gives a nice way to +configure options (similar to what is used in BusyBox and the Linux kernel). + +You should be able to compile axTLS simply by extracting it, change into +the extracted directory and typing: + +> make + +Select your platform type, save the configuration, exit, and then +type "make" again. + +If all goes well, you should end up with an executable called "awhttpd" (or +awhttpd.exe) in this directory. + +To play with all the various axTLS options, type: + +> make menuconfig + +Save the new configuration and rebuild. + +######################################################################## +# Running it +######################################################################## + +To run it, type (as superuser): + +> awhttpd + +And then point your browser at: + +https://127.0.0.1 + +And you should see a html page with a padlock appearing on your browser. + +or type: + +http://127.0.0.1 + +to see the same page unencrypted. + +See the README in the httpd directory from more configuration information on +Anti-Web. + +Note: libaxtls.so may have to in your shared library path. + +######################################################################## +# The axssl utilities +######################################################################## + +The axssl suite of tools are the SSL test tools in the various language +bindings. They are: + +axssl - C sample +axssl.csharp - C# sample +axssl.vbnet - VB.NET sample +axtls.jar - Java sample +axssl.pl - Perl sample + +All the tools have identical command-line parameters. e.g. to run something +interesting: + +> axssl s_server -verify -CAfile ssl/test/axTLS.ca_x509 + +and + +> axssl s_client -cert ssl/test/axTLS.x509_1024 -key \ + ssl/test/axTLS.key_1024 -reconnect + +C# +== +If building under Linux or other non-Win32 platforms, Mono must be installed +and the executable is run as: + +> mono axssl.csharp.exe ... + +Java +==== +The java version is run as: + +> java -jar axtls.jar + +Perl +==== +> [perl] ./axssl.pl + +If running under Win32, be sure to use the correct version of Perl (i.e. +ActiveState's version works ok). + +######################################################################## +# Known Issues +######################################################################## + +* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile + the latest version of Perl on an AMD64 box (using FC3). + +* Java 1.4 or better is required for the Java interfaces. + +* Processes that fork can't use session resumption unless some form of IPC is + used. + +* Ensure libperl.so and libaxtls.so are in the shared library path when + running with the perl bindings. A way to do this is with: + + export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:. + +* The default Microsoft .NET SDK is v2.0.50727. Download from: + http://msdn.microsoft.com/netframework/downloads/updates/default.aspx. + +Win32 issues +============ +* Be careful about doing .NET executions on network drives - .NET complains + with security exceptions on the binary. TODO: Add a manifest file to prevent + this. + +* The test harness appears to be broken under VC8.0. Debugging shows a problem + the _close() function which is weird. + +Solaris issues +============== +* mconf doesn't work well - some manual tweaking is required for string values. + +* GNU make and GNU patch are required and need to be in $PATH. + +* To get swig's library dependencies to work (and for the C library to be + found), I needed to type: + > export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:. + +Cygwin issues +============= +* The bindings all compile but don't run under cygwin with the exception of + Perl. This is due to win32 executables being incompatible with cygwin + libraries. + diff --git a/bindings/Config.in b/bindings/Config.in new file mode 100644 index 0000000000..a268f80787 --- /dev/null +++ b/bindings/Config.in @@ -0,0 +1,90 @@ +# +# For a description of the syntax of this configuration file, +# see scripts/config/Kconfig-language.txt +# +menu "Language Bindings" + +config CONFIG_BINDINGS + bool "Create language bindings" + default n + help + axTLS supports language bindings in C#, VB.NET, Java and Perl. + + Select Y here if you want to build the various bindings. + +config CONFIG_CSHARP_BINDINGS + bool "Create C# bindings" + default n + depends on CONFIG_BINDINGS + help + Build C# bindings. + + This requires .NET to be installed on Win32 platforms and mono to be + installed on all other platforms. + +config CONFIG_VBNET_BINDINGS + bool "Create VB.NET bindings" + default n + depends on CONFIG_BINDINGS + help + Build VB.NET bindings. + + This requires the .NET to be installed and is only built under Win32 + platforms. + +menu ".Net Framework" +depends on CONFIG_CSHARP_BINDINGS || CONFIG_VBNET_BINDINGS +config CONFIG_DOT_NET_FRAMEWORK_BASE + string "Location of .NET Framework" + default "c:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727" +endmenu + +config CONFIG_JAVA_BINDINGS + bool "Create Java bindings" + default n + depends on CONFIG_BINDINGS + help + Build Java bindings. + + Current Issues (see README): + * Needs Java 1.4 or better. + * If building under Win32 it will use the Win32 JDK. + +menu "Java Home" +depends on CONFIG_JAVA_BINDINGS +config CONFIG_JAVA_HOME + string "Location of JDK" + default "c:\\Program Files\\Java\\jdk1.5.0_06" if CONFIG_PLATFORM_WIN32 || CONFIG_PLATFORM_CYGWIN + default "/usr/local/jdk142" if !CONFIG_PLATFORM_WIN32 && !CONFIG_PLATFORM_CYGWIN + depends on CONFIG_JAVA_BINDINGS + help + The location of Sun's JDK. +endmenu + +config CONFIG_PERL_BINDINGS + bool "Create Perl bindings" + default n + depends on CONFIG_BINDINGS + help + Build Perl bindings. + + Current Issues (see README): + * Doesn't work under Win32 ActiveState Perl. + * 64 bit versions don't work at present. + * libperl.so needs to be in the shared library path. + +menu "Perl Home" +depends on CONFIG_PERL_BINDINGS && CONFIG_PLATFORM_WIN32 +config CONFIG_PERL_CORE + string "Location of Perl CORE" + default "c:\\perl\\lib\\CORE" + help: + I'm testing with: + "http://www.activestate.com/Products/ActivePerl" at the moment. + +config CONFIG_PERL_LIB + string "Name of Perl Library" + default "perl58.lib" +endmenu + +endmenu diff --git a/bindings/Makefile b/bindings/Makefile new file mode 100644 index 0000000000..47b48befca --- /dev/null +++ b/bindings/Makefile @@ -0,0 +1,63 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +all: + +include ../config/.config +include ../config/makefile.conf + +ifdef CONFIG_CSHARP_BINDINGS +all: csharp/axInterface.cs +endif + +ifdef CONFIG_VBNET_BINDINGS +all: vbnet/axInterface.vb +endif + +ifdef CONFIG_JAVA_BINDINGS +all: java/axtlsj.java +endif + +ifdef CONFIG_PERL_BINDINGS +all: perl/axTLSp_wrap.c +endif + +csharp/axInterface.cs: ../ssl/ssl.h + @perl ./generate_interface.pl -csharp + +vbnet/axInterface.vb: ../ssl/ssl.h + @perl ./generate_interface.pl -vbnet + +java/axTLSj.i: ../ssl/ssl.h + @perl ./generate_SWIG_interface.pl -java + +java/axtlsj.java: java/axTLSj.i $(wildcard java/SSL*.java) + @cd java; swig -java -package axTLSj -noextern axTLSj.i; $(MAKE) + +perl/axTLSp.i: ../ssl/ssl.h + @perl ./generate_SWIG_interface.pl -perl + +perl/axTLSp_wrap.c: perl/axTLSp.i + @cd perl; swig -perl5 -noextern axTLSp.i; $(MAKE) + +clean:: + $(MAKE) -C csharp clean + $(MAKE) -C vbnet clean + $(MAKE) -C java clean + $(MAKE) -C perl clean + diff --git a/bindings/README b/bindings/README new file mode 100644 index 0000000000..8bc3109c12 --- /dev/null +++ b/bindings/README @@ -0,0 +1,43 @@ +=============================================================================== += Language Bindings = +=============================================================================== + +The tools to generate the various language bindings are done here. +SWIG 1.3.24 or better is required for creating the Java and Perl bindings. + +Perl scripts are used to parse ssl.h and automagically give the appropriate +bindings. + +At present, the four languages supported are: + +* C# +* VB.NET +* Java +* Perl + +To generate each binding run the following: + +C#: +> generate_interface.pl -csharp + +VB.NET: +> generate_interface.pl -vbnet + + +Java: +> generate_SWIG_interface.pl -java +> cd java; swig -java -package axTLSj -noextern axTLSj.i + +Perl: +> generate_SWIG_interface.pl -perl +> cd perl; swig -noextern -perl axTLSp.i + +Java and Perl both create a library each called libaxtlsj.so and libaxtlsp.so +(or axtlsj.dll and atlsp.dll on Win32 platforms). + +Note: the "-noextern" is deprecated in swig 1.3.27 and newer. The "-noextern" +option was required to get Win32 bindings to work (which is why is has probably +been deprecated). + +Each binding (except for Perl) has an extra helper interface to make life +easier. diff --git a/bindings/csharp/Makefile b/bindings/csharp/Makefile new file mode 100644 index 0000000000..d7fbdb619f --- /dev/null +++ b/bindings/csharp/Makefile @@ -0,0 +1,23 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +include ../../config/.config +include ../../config/makefile.conf + +clean:: + @rm -f axssl* axInterface.cs diff --git a/bindings/csharp/axTLS.cs b/bindings/csharp/axTLS.cs new file mode 100644 index 0000000000..4622dc5535 --- /dev/null +++ b/bindings/csharp/axTLS.cs @@ -0,0 +1,466 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * A wrapper around the unmanaged interface to give a semi-decent C# API + */ + +using System; +using System.Runtime.InteropServices; +using System.Net.Sockets; + +/** + * @defgroup csharp_api C# API. + * + * Ensure that the appropriate Dispose() methods are called when finished with + * various objects - otherwise memory leaks will result. + * @{ + */ +namespace axTLS +{ + /** + * @class SSL + * @ingroup csharp_api + * @brief A representation of an SSL connection. + */ + public class SSL + { + public IntPtr m_ssl; /**< A pointer to the real SSL type */ + + /** + * @brief Store the reference to an SSL context. + * @param ip [in] A reference to an SSL object. + */ + public SSL(IntPtr ip) + { + m_ssl = ip; + } + + /** + * @brief Free any used resources on this connection. + * + * A "Close Notify" message is sent on this connection (if possible). + * It is up to the application to close the socket. + */ + public void Dispose() + { + axtls.ssl_free(m_ssl); + } + + /** + * @brief Return the result of a handshake. + * @return SSL_OK if the handshake is complete and ok. + * @see ssl.h for the error code list. + */ + public int HandshakeStatus() + { + return axtls.ssl_handshake_status(m_ssl); + } + + /** + * @brief Return the SSL cipher id. + * @return The cipher id which is one of: + * - SSL_AES128_SHA (0x2f) + * - SSL_AES256_SHA (0x35) + * - SSL_RC4_128_SHA (0x05) + * - SSL_RC4_128_MD5 (0x04) + */ + public byte GetCipherId() + { + return axtls.ssl_get_cipher_id(m_ssl); + } + + /** + * @brief Get the session id for a handshake. + * + * This will be a 32 byte sequence and is availabile after the first + * handshaking messages are sent. + * @return The session id as a 32 byte sequence. + * @note A SSLv23 handshake may have only 16 valid bytes. + */ + public byte[] GetSessionId() + { + byte[] result = new byte[axtls.SSL_SESSION_ID_SIZE]; + IntPtr ptr = axtls.ssl_get_session_id(m_ssl); + Marshal.Copy(ptr, result, 0, axtls.SSL_SESSION_ID_SIZE); + return result; + } + + /** + * @brief Retrieve an X.509 distinguished name component. + * + * When a handshake is complete and a certificate has been exchanged, + * then the details of the remote certificate can be retrieved. + * + * This will usually be used by a client to check that the server's + * common name matches the URL. + * + * A full handshake needs to occur for this call to work. + * + * @param component [in] one of: + * - SSL_X509_CERT_COMMON_NAME + * - SSL_X509_CERT_ORGANIZATION + * - SSL_X509_CERT_ORGANIZATIONAL_NAME + * - SSL_X509_CA_CERT_COMMON_NAME + * - SSL_X509_CA_CERT_ORGANIZATION + * - SSL_X509_CA_CERT_ORGANIZATIONAL_NAME + * @return The appropriate string (or null if not defined) + */ + public string GetCertificateDN(int component) + { + return axtls.ssl_get_cert_dn(m_ssl, component); + } + } + + /** + * @class SSLUtil + * @ingroup csharp_api + * @brief Some global helper functions. + */ + public class SSLUtil + { + + /** + * @brief Return the build mode of the axTLS project. + * @return The build mode is one of: + * - SSL_BUILD_SERVER_ONLY + * - SSL_BUILD_ENABLE_VERIFICATION + * - SSL_BUILD_ENABLE_CLIENT + * - SSL_BUILD_FULL_MODE + */ + public static int BuildMode() + { + return axtls.ssl_get_config(axtls.SSL_BUILD_MODE); + } + + /** + * @brief Return the number of chained certificates that the + * client/server supports. + * @return The number of supported server certificates. + */ + public static int MaxCerts() + { + return axtls.ssl_get_config(axtls.SSL_MAX_CERT_CFG_OFFSET); + } + + /** + * @brief Return the number of CA certificates that the client/server + * supports. + * @return The number of supported CA certificates. + */ + public static int MaxCACerts() + { + return axtls.ssl_get_config(axtls.SSL_MAX_CA_CERT_CFG_OFFSET); + } + + /** + * @brief Indicate if PEM is supported. + * @return true if PEM supported. + */ + public static bool HasPEM() + { + return axtls.ssl_get_config(axtls.SSL_HAS_PEM) > 0 ? true : false; + } + + /** + * @brief Display the text string of the error. + * @param error_code [in] The integer error code. + */ + public static void DisplayError(int error_code) + { + axtls.ssl_display_error(error_code); + } + } + + /** + * @class SSLCTX + * @ingroup csharp_api + * @brief A base object for SSLServer/SSLClient. + */ + public class SSLCTX + { + /** + * @brief A reference to the real client/server context. + */ + protected IntPtr m_ctx; + + /** + * @brief Establish a new client/server context. + * + * This function is called before any client/server SSL connections are + * made. If multiple threads are used, then each thread will have its + * own SSLCTX context. Any number of connections may be made with a + * single context. + * + * Each new connection will use the this context's private key and + * certificate chain. If a different certificate chain is required, + * then a different context needs to be be used. + * + * @param options [in] Any particular options. At present the options + * supported are: + * - SSL_SERVER_VERIFY_LATER (client only): Don't stop a handshake if + * the server authentication fails. The certificate can be + * authenticated later with a call to VerifyCert(). + * - SSL_CLIENT_AUTHENTICATION (server only): Enforce client + * authentication i.e. each handshake will include a "certificate + * request" message from the server. + * - SSL_NO_DEFAULT_KEY: Don't use the default key/certificate. The + * user will load the key/certificate explicitly. + * - SSL_DISPLAY_BYTES (full mode build only): Display the byte + * sequences during the handshake. + * - SSL_DISPLAY_STATES (full mode build only): Display the state + * changes during the handshake. + * - SSL_DISPLAY_CERTS (full mode build only): Display the + * certificates that are passed during a handshake. + * - SSL_DISPLAY_RSA (full mode build only): Display the RSA key + * details that are passed during a handshake. + * @param num_sessions [in] The number of sessions to be used for + * session caching. If this value is 0, then there is no session + * caching. + * @return A client/server context. + */ + protected SSLCTX(uint options, int num_sessions) + { + m_ctx = axtls.ssl_ctx_new(options, num_sessions); + } + + /** + * @brief Remove a client/server context. + * + * Frees any used resources used by this context. Each connection will + * be sent a "Close Notify" alert (if possible). + */ + public void Dispose() + { + axtls.ssl_ctx_free(m_ctx); + } + + /** + * @brief Read the SSL data stream. + * @param ssl [in] An SSL object reference. + * @param in_data [out] After a successful read, the decrypted data + * will be here. It will be null otherwise. + * @return The number of decrypted bytes: + * - if > 0, then the handshaking is complete and we are returning the + * number of decrypted bytes. + * - SSL_OK if the handshaking stage is successful (but not yet + * complete). + * - < 0 if an error. + * @see ssl.h for the error code list. + * @note Use in_data before doing any successive ssl calls. + */ + public int Read(SSL ssl, out byte[] in_data) + { + IntPtr ptr = IntPtr.Zero; + int ret = axtls.ssl_read(ssl.m_ssl, ref ptr); + + if (ret > axtls.SSL_OK) + { + in_data = new byte[ret]; + Marshal.Copy(ptr, in_data, 0, ret); + } + else + { + in_data = null; + } + + return ret; + } + + /** + * @brief Write to the SSL data stream. + * @param ssl [in] An SSL obect reference. + * @param out_data [in] The data to be written + * @return The number of bytes sent, or if < 0 if an error. + * @see ssl.h for the error code list. + */ + public int Write(SSL ssl, byte[] out_data) + { + return axtls.ssl_write(ssl.m_ssl, out_data, out_data.Length); + } + + /** + * @brief Write to the SSL data stream. + * @param ssl [in] An SSL obect reference. + * @param out_data [in] The data to be written + * @param out_len [in] The number of bytes to be written + * @return The number of bytes sent, or if < 0 if an error. + * @see ssl.h for the error code list. + */ + public int Write(SSL ssl, byte[] out_data, int out_len) + { + return axtls.ssl_write(ssl.m_ssl, out_data, out_len); + } + + /** + * @brief Find an ssl object based on a Socket reference. + * + * Goes through the list of SSL objects maintained in a client/server + * context to look for a socket match. + * @param s [in] A reference to a Socket object. + * @return A reference to the SSL object. Returns null if the object + * could not be found. + */ + public SSL Find(Socket s) + { + int client_fd = s.Handle.ToInt32(); + return new SSL(axtls. ssl_find(m_ctx, client_fd)); + } + + /** + * @brief Authenticate a received certificate. + * + * This call is usually made by a client after a handshake is complete + * and the context is in SSL_SERVER_VERIFY_LATER mode. + * @param ssl [in] An SSL object reference. + * @return SSL_OK if the certificate is verified. + */ + public int VerifyCert(SSL ssl) + { + return axtls.ssl_verify_cert(ssl.m_ssl); + } + + /** + * @brief Force the client to perform its handshake again. + * + * For a client this involves sending another "client hello" message. + * For the server is means sending a "hello request" message. + * @param ssl [in] An SSL object reference. + * @return SSL_OK if renegotiation instantiation was ok + */ + public int Renegotiate(SSL ssl) + { + return axtls.ssl_renegotiate(ssl.m_ssl); + } + + /** + * @brief Load a file into memory that is in binary DER or ASCII PEM + * format. + * + * These are temporary objects that are used to load private keys, + * certificates etc into memory. + * @param obj_type [in] The format of the file. Can be one of: + * - SSL_OBJ_X509_CERT (no password required) + * - SSL_OBJ_X509_CACERT (no password required) + * - SSL_OBJ_RSA_KEY (AES128/AES256 PEM encryption supported) + * - SSL_OBJ_P8 (RC4-128 encrypted data supported) + * - SSL_OBJ_P12 (RC4-128 encrypted data supported) + * + * PEM files are automatically detected (if supported). + * @param filename [in] The location of a file in DER/PEM format. + * @param password [in] The password used. Can be null if not required. + * @return SSL_OK if all ok + */ + public int ObjLoad(int obj_type, string filename, string password) + { + return axtls.ssl_obj_load(m_ctx, obj_type, filename, password); + } + + /** + * @brief Transfer binary data into the object loader. + * + * These are temporary objects that are used to load private keys, + * certificates etc into memory. + * @param obj_type [in] The format of the memory data. + * @param data [in] The binary data to be loaded. + * @param len [in] The amount of data to be loaded. + * @param password [in] The password used. Can be null if not required. + * @return SSL_OK if all ok + */ + public int ObjLoad(int obj_type, byte[] data, int len, string password) + { + return axtls.ssl_obj_memory_load(m_ctx, obj_type, + data, len, password); + } + } + + /** + * @class SSLServer + * @ingroup csharp_api + * @brief The server context. + * + * All server connections are started within a server context. + */ + public class SSLServer : SSLCTX + { + /** + * @brief Start a new server context. + * + * @see SSLCTX for details. + */ + public SSLServer(uint options, int num_sessions) : + base(options, num_sessions) {} + + /** + * @brief Establish a new SSL connection to an SSL client. + * + * It is up to the application to establish the initial socket + * connection. + * + * Call Dispose() when the connection is to be removed. + * @param s [in] A reference to a Socket object. + * @return An SSL object reference. + */ + public SSL Connect(Socket s) + { + int client_fd = s.Handle.ToInt32(); + return new SSL(axtls.ssl_server_new(m_ctx, client_fd)); + } + } + + /** + * @class SSLClient + * @ingroup csharp_api + * @brief The client context. + * + * All client connections are started within a client context. + */ + public class SSLClient : SSLCTX + { + /** + * @brief Start a new client context. + * + * @see SSLCTX for details. + */ + public SSLClient(uint options, int num_sessions) : + base(options, num_sessions) {} + + /** + * @brief Establish a new SSL connection to an SSL server. + * + * It is up to the application to establish the initial socket + * connection. + * + * This is a blocking call - it will finish when the handshake is + * complete (or has failed). + * + * Call Dispose() when the connection is to be removed. + * @param s [in] A reference to a Socket object. + * @param session_id [in] A 32 byte session id for session resumption. + * This can be null if no session resumption is not required. + * @return An SSL object reference. Use SSL.handshakeStatus() to check + * if a handshake succeeded. + */ + public SSL Connect(Socket s, byte[] session_id) + { + int client_fd = s.Handle.ToInt32(); + return new SSL(axtls. ssl_client_new(m_ctx, client_fd, session_id)); + } + } +} +/** @} */ diff --git a/bindings/generate_SWIG_interface.pl b/bindings/generate_SWIG_interface.pl new file mode 100755 index 0000000000..7509e17cfe --- /dev/null +++ b/bindings/generate_SWIG_interface.pl @@ -0,0 +1,327 @@ +#!/usr/bin/perl + +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +#=============================================================== +# Transforms function signature into SWIG format +sub transformSignature +{ + foreach $item (@_) + { + $line =~ s/STDCALL //g; + $line =~ s/EXP_FUNC/extern/g; + + # make API Java more 'byte' friendly + $line =~ s/uint32_t/int/g; + $line =~ s/const uint8_t \* /const unsigned char \* /g; + if ($ARGV[0] eq "-java") + { + $line =~ s/.*ssl_read.*//g; + $line =~ s/const uint8_t \*(\w+)/const signed char $1\[\]/g; + $line =~ s/uint8_t/signed char/g; + } + else + { + $line =~ s/const uint8_t \*(\w+)/const unsigned char $1\[\]/g; + $line =~ s/uint8_t/unsigned char/g; + } + } + + return $line; +} + +# Parse input file +sub parseFile +{ + foreach $line (@_) + { + # test for a #define + if (!$skip && $line =~ m/^#define/) + { + $splitDefine = 1 if $line =~ m/\\$/; + print DATA_OUT $line; + + # check line is not split + next if $splitDefine == 1; + } + + # pick up second line of #define statement + if ($splitDefine) + { + print DATA_OUT $line; + + # check line is not split + $splitDefine = ($line =~ m/\\$/); + next; + } + + # test for function declaration + if (!$skip && $line =~ /EXP_FUNC/ && $line !~/\/\*/) + { + $line = transformSignature($line); + $splitFunctionDeclaration = $line !~ /;/; + print DATA_OUT $line; + next; + } + + if ($splitFunctionDeclaration) + { + $line = transformSignature($line); + $splitFunctionDeclaration = $line !~ /;/; + print DATA_OUT $line; + next; + } + } +} + +#=============================================================== + +# Determine which module to build from cammand-line options +use strict; +use Getopt::Std; + +my $module; +my $interfaceFile; +my $data_file; +my $skip; +my $splitLine; +my @raw_data; + +if (not defined $ARGV[0]) +{ + goto ouch; +} + +if ($ARGV[0] eq "-java") +{ + print "Generating Java interface file\n"; + $module = "axtlsj"; + $interfaceFile = "java/axTLSj.i"; +} +elsif ($ARGV[0] eq "-perl") +{ + print "Generating Perl interface file\n"; + $module = "axtlsp"; + $interfaceFile = "perl/axTLSp.i"; +} +else +{ +ouch: + die "Usage: $0 [-java | -perl]\n"; +} + +# Input file required to generate SWIG interface file. +$data_file = "../ssl/ssl.h"; + +# Open input files +open(DATA_IN, $data_file) || die("Could not open file ($data_file)!"); +@raw_data = ; + +# Open output file +open(DATA_OUT, ">$interfaceFile") || die("Cannot Open File"); + +# +# I wish I could say it was easy to generate the Perl/Java bindings, but each +# had their own set of challenges... :-(. +# +print DATA_OUT << "END"; +%module $module\n + +/* include our own header */ +%inline %{ +#include "ssl.h" +%} + +%include "typemaps.i" +/* Some SWIG magic to make the API a bit more Java friendly */ +#ifdef SWIGJAVA + +%apply long { SSL * }; +%apply long { SSLCTX * }; +%apply long { SSLObjLoader * }; + +/* allow "unsigned char []" to become "byte[]" */ +%include "arrays_java.i" + +/* convert these pointers to use long */ +%apply signed char[] {unsigned char *}; +%apply signed char[] {signed char *}; + +/* allow ssl_get_session_id() to return "byte[]" */ +%typemap(out) unsigned char * ssl_get_session_id \"if (result) jresult = SWIG_JavaArrayOutSchar(jenv, result, SSL_SESSION_ID_SIZE);\" + +/* allow ssl_client_new() to have a null session_id input */ +%typemap(in) const signed char session_id[] (jbyte *jarr) { + if (jarg3 == NULL) + { + jresult = (jint)ssl_client_new(arg1,arg2,NULL); + return jresult; + } + + if (!SWIG_JavaArrayInSchar(jenv, &jarr, &arg3, jarg3)) return 0; +} + +/* Lot's of work required for an ssl_read() due to its various custom + * requirements. + */ +%native (ssl_read) int ssl_read(SSL *ssl, jobject in_data); +%{ +JNIEXPORT jint JNICALL Java_axTLSj_axtlsjJNI_ssl_1read(JNIEnv *jenv, jclass jcls, jint jarg1, jobject jarg2) { + jint jresult = 0 ; + SSL *arg1; + unsigned char *arg2; + jbyte *jarr; + int result; + JNIEnv e = *jenv; + jclass holder_class; + jfieldID fid; + + arg1 = (SSL *)jarg1; + result = (int)ssl_read(arg1, &arg2); + + /* find the "m_buf" entry in the SSLReadHolder class */ + if (!(holder_class = e->GetObjectClass(jenv,jarg2)) || + !(fid = e->GetFieldID(jenv,holder_class, "m_buf", "[B"))) + return SSL_NOT_OK; + + if (result > SSL_OK) + { + int i; + + /* create a new byte array to hold the read data */ + jbyteArray jarray = e->NewByteArray(jenv, result); + + /* copy the bytes across to the java byte array */ + jarr = e->GetByteArrayElements(jenv, jarray, 0); + for (i = 0; i < result; i++) + jarr[i] = (jbyte)arg2[i]; + + /* clean up and set the new m_buf object */ + e->ReleaseByteArrayElements(jenv, jarray, jarr, 0); + e->SetObjectField(jenv, jarg2, fid, jarray); + } + else /* set to null */ + e->SetObjectField(jenv, jarg2, fid, NULL); + + jresult = (jint)result; + return jresult; +} +%} + +/* Big hack to get hold of a socket's file descriptor */ +%typemap (jtype) long "Object" +%typemap (jstype) long "Object" +%native (getFd) int getFd(long sock); +%{ +JNIEXPORT jint JNICALL Java_axTLSj_axtlsjJNI_getFd(JNIEnv *env, jclass jcls, jobject sock) +{ + JNIEnv e = *env; + jfieldID fid; + jobject impl; + jobject fdesc; + + /* get the SocketImpl from the Socket */ + if (!(jcls = e->GetObjectClass(env,sock)) || + !(fid = e->GetFieldID(env,jcls,"impl","Ljava/net/SocketImpl;")) || + !(impl = e->GetObjectField(env,sock,fid))) return -1; + + /* get the FileDescriptor from the SocketImpl */ + if (!(jcls = e->GetObjectClass(env,impl)) || + !(fid = e->GetFieldID(env,jcls,"fd","Ljava/io/FileDescriptor;")) || + !(fdesc = e->GetObjectField(env,impl,fid))) return -1; + + /* get the fd from the FileDescriptor */ + if (!(jcls = e->GetObjectClass(env,fdesc)) || + !(fid = e->GetFieldID(env,jcls,"fd","I"))) return -1; + + /* return the descriptor */ + return e->GetIntField(env,fdesc,fid); +} +%} + +#endif + +/* Some SWIG magic to make the API a bit more Perl friendly */ +#ifdef SWIGPERL + +/* for ssl_session_id() */ +%typemap(out) const unsigned char * { + SV *svs = newSVpv((const char *)\$1, SSL_SESSION_ID_SIZE); + \$result = newRV(svs); + sv_2mortal(\$result); + argvi++; +} + +/* for ssl_write() */ +%typemap(in) const unsigned char out_data[] { + SV* tempsv; + if (!SvROK(\$input)) + croak("Argument \$argnum is not a reference."); + tempsv = SvRV(\$input); + if (SvTYPE(tempsv) != SVt_PV) + croak("Argument \$argnum is not an string."); + \$1 = (unsigned char *)SvPV(tempsv, PL_na); +} + +/* for ssl_read() */ +%typemap(in) unsigned char **in_data (unsigned char *buf) { + \$1 = &buf; +} + +%typemap(argout) unsigned char **in_data { + if (result > SSL_OK) { + SV *svs = newSVpv(*\$1, result); + \$result = newRV(svs); + sv_2mortal(\$result); + argvi++; + } +} + +%typemap(freearg) unsigned char *in_data { + free(buf\$argnum); +} + +/* for ssl_client_new() */ +%typemap(in) const unsigned char session_id[] { + /* check for a reference */ + if (SvOK(\$input) && SvROK(\$input)) { + SV* tempsv = SvRV(\$input); + if (SvTYPE(tempsv) != SVt_PV) + croak("Argument \$argnum is not an string."); + \$1 = (unsigned char *)SvPV(tempsv, PL_na); + } + else + \$1 = NULL; +} + +#endif + +END + +# Initialise loop variables +$skip = 1; +$splitLine = 0; + +parseFile(@raw_data); + +close(DATA_IN); +close(DATA_OUT); + +#=============================================================== + diff --git a/bindings/generate_interface.pl b/bindings/generate_interface.pl new file mode 100755 index 0000000000..a063ea2cc7 --- /dev/null +++ b/bindings/generate_interface.pl @@ -0,0 +1,302 @@ +#!/usr/bin/perl -w + +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +#=============================================================== +# This application transforms ssl.h into interfaces that can be used by +# other language bindings. It is "SWIG"-like in nature in that various +# files are generated based on the axTLS API. +# +# The file produced is axInterface.? (depending on the file extension). +# +#=============================================================== + +use strict; + +my $CSHARP = 0; +my $VBNET = 1; + +my $binding; +my $skip = 0; +my $signature_ret_type; + +# Transforms function signature into an Interface format +sub transformSignature +{ + my $item; + my ($line) = @_; + + foreach $item ($line) + { + # our very basic preprocessor + if ($binding == $CSHARP) + { + $line =~ s/STDCALL //; + $line =~ s/EXP_FUNC/ [DllImport ("axtls")]\n public static extern/; + $line =~ s/uint32_t/uint/g; + $line =~ s/uint8_t \*\*/ref IntPtr /g; + $line =~ s/const uint8_t \* /IntPtr /g; + $line =~ s/const uint8_t \*/byte[] /g; # note: subtle diff + $line =~ s/uint8_t \* ?/byte[] /g; + $line =~ s/uint8_t ?/byte /g; + $line =~ s/const char \* ?/string /g; + $line =~ s/SSLCTX \* ?/IntPtr /g; + $line =~ s/SSLObjLoader \* ?/IntPtr /g; + $line =~ s/SSL \* ?/IntPtr /g; + } + elsif ($binding == $VBNET) + { + if ($line =~ /EXP_FUNC/) + { + # Procedure or function? + my $invariant = $line =~ /void /; + + my $proc = $invariant ? "Sub" : "Function"; + ($signature_ret_type) = $line =~ /EXP_FUNC (.*) STDCALL/; + $line =~ s/EXP_FUNC .* STDCALL / Public Shared $proc _\n /; + + $signature_ret_type =~ s/const uint8_t \*/As IntPtr/; + $signature_ret_type =~ s/const char \*/As String/; + $signature_ret_type =~ s/SSLCTX \*/As IntPtr/; + $signature_ret_type =~ s/SSLObjLoader \*/As IntPtr/; + $signature_ret_type =~ s/SSL \*/As IntPtr/; + $signature_ret_type =~ s/uint8_t/As Byte/; + $signature_ret_type =~ s/int/As Integer/; + $signature_ret_type =~ s/void//; + $signature_ret_type .= "\n End $proc\n\n"; + } + + $line =~ s/uint32_t (\w+)/ByVal $1 As Integer/g; + $line =~ s/int (\w+)/ByVal $1 As Integer/g; + $line =~ s/uint8_t \*\* ?(\w+)/ByRef $1 As IntPtr/g; + $line =~ s/const uint8_t \* ?(\w+)/ByVal $1() As Byte/g; + $line =~ s/uint8_t \* ?(\w+)/ByVal $1() As Byte/g; + $line =~ s/const char \* ?(\w+)/ByVal $1 As String/g; + $line =~ s/SSLCTX \* ?(\w+)/ByVal $1 As IntPtr/g; + $line =~ s/SSLObjLoader \* ?(\w+)/ByVal $1 As IntPtr/g; + $line =~ s/SSL \* ?(\w+)/ByVal $1 As IntPtr/g; + $line =~ s/void \* ?(\w+)/Byval $1 As IntPtr/g; + $line =~ s/\(void\)/()/g; + $line =~ s/void//g; + $line =~ s/;\n/ $signature_ret_type;/; + } + } + + return $line; +} + +# Parse input file +sub parseFile +{ + my (@file) = @_; + my $line; + my $splitDefine = 0; + my $splitFunctionDeclaration; + my $vb_hack = " "; + my $vb_line_hack = 0; + + $skip = 0; + + foreach $line (@file) + { + # test for a #define + if (!$skip && $line =~ m/^#define/) + { + $splitDefine = 1 if $line =~ m/\\$/; + + if ($binding == $VBNET) + { + $line =~ s/\|/Or/g; + $line =~ s/ 0x/ &H/; + } + + my ($name, $value) = $line =~ /#define (\w+) +([^\\]*)[\\]?\n/; + + if (defined $name && defined $value) + { + # C# constant translation + if ($binding == $CSHARP) + { + $line = " public const int $name = $value"; + } + # VB.NET constant translation + elsif ($binding == $VBNET) + { + $line = " Public Const $name As Integer = $value"; + } + } + + next if $line =~ /#define/; # ignore any other defines + + print DATA_OUT $line; + + # check line is not split + next if $splitDefine == 1; + print DATA_OUT ";" if $binding == $CSHARP; + print DATA_OUT "\n"; + } + + # pick up second line of #define statement + if ($splitDefine) + { + if ($line !~ /\\$/) + { + $line =~ s/$/;/ if $binding == $CSHARP; # add the ";" + } + + $line =~ s/ ?\| ?/ Or /g + if ($binding == $VBNET); + + # check line is not split + $splitDefine = ($line =~ m/\\$/); + + # ignore trailing "\" + $line =~ s/\\$// if $binding == $CSHARP; + $line =~ s/\\$/_/ if $binding == $VBNET; + print DATA_OUT $line; + next; + } + + # test for function declaration + if (!$skip && $line =~ /EXP_FUNC/ && $line !~ /\/\*/) + { + $line = transformSignature($line); + $splitFunctionDeclaration = $line !~ /;/; + $line =~ s/;// if ($binding == $VBNET); + $line =~ s/\n$/ _\n/ if ($binding == $VBNET) && + $splitFunctionDeclaration; + print DATA_OUT $line; + next; + } + + if ($splitFunctionDeclaration) + { + $line = transformSignature($line); + $splitFunctionDeclaration = $line !~ /;/; + $line =~ s/;// if ($binding == $VBNET); + $line =~ s/\n/ _\n/ if ($binding == $VBNET) && + $splitFunctionDeclaration == 1; + print DATA_OUT $line; + next; + } + } +} + +#=============================================================== + +# Determine which module to build from cammand-line options +use strict; +use Getopt::Std; + +my $binding_prefix; +my $binding_suffix; +my $data_file; +my @raw_data; + +if (not defined $ARGV[0]) +{ + goto ouch; +} + +if ($ARGV[0] eq "-csharp") +{ + print "Generating C# interface file\n"; + $binding_prefix = "csharp"; + $binding_suffix = "cs"; + $binding = $CSHARP; +} +elsif ($ARGV[0] eq "-vbnet") +{ + print "Generating VB.NET interface file\n"; + $binding_prefix = "vbnet"; + $binding_suffix = "vb"; + $binding = $VBNET; +} +else +{ +ouch: + die "Usage: $0 [-csharp | -vbnet]\n"; +} + +my $interfaceFile = "$binding_prefix/axInterface.$binding_suffix"; + +# Input file required to generate interface file. +$data_file = "../ssl/ssl.h"; + +# Open input files +open(DATA_IN, $data_file) || die("Could not open file ($data_file)!"); +@raw_data = ; + + +# Open output file +if ($binding == $CSHARP || $binding == $VBNET) +{ + open(DATA_OUT, ">$interfaceFile") || die("Cannot Open File"); +} + +# SPEC interface file header +if ($binding == $CSHARP) +{ + # generate the C#/C interface file + print DATA_OUT << "END"; +// The C# to C interface definition file for the axTLS project +// Do not modify - this file is generated + +using System; +using System.Runtime.InteropServices; + +namespace axTLS +{ + public class axtls + { +END +} +elsif ($binding == $VBNET) +{ + # generate the VB.NET/C interface file + print DATA_OUT << "END"; +' The VB.NET to C interface definition file for the axTLS project +' Do not modify - this file is generated + +Imports System +Imports System.Runtime.InteropServices + +Namespace axTLSvb + Public Class axtls +END +} + +parseFile(@raw_data); + +# finish up +if ($binding == $CSHARP) +{ + print DATA_OUT " };\n"; + print DATA_OUT "};\n"; +} +elsif ($binding == $VBNET) +{ + print DATA_OUT " End Class\nEnd Namespace\n"; +} + +close(DATA_IN); +close(DATA_OUT); + +#=============================================================== + diff --git a/bindings/java/Makefile b/bindings/java/Makefile new file mode 100644 index 0000000000..a81d8811f6 --- /dev/null +++ b/bindings/java/Makefile @@ -0,0 +1,93 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +include ../../config/.config +include ../../config/makefile.conf +include ../../config/makefile.java.conf + +all: lib jar + +JAR=../../axtls.jar + +ifdef CONFIG_PLATFORM_WIN32 +TARGET=../../axtlsj.dll +else +TARGET=../../libaxtlsj.so +endif + +lib: $(TARGET) +axTLSj_wrap.o : axTLSj_wrap.c + +JAVA_FILES= \ + axtlsjJNI.java \ + axtlsjConstants.java \ + axtlsj.java \ + SSLReadHolder.java \ + SSL.java \ + SSLUtil.java \ + SSLCTX.java \ + SSLServer.java \ + SSLClient.java + +OBJ=axTLSj_wrap.o + +AXOLOTLS_HOME=../.. +SSL_HOME=$(AXOLOTLS_HOME)/ssl +CONFIG_HOME=$(AXOLOTLS_HOME)/config +JAVA_CLASSES:=$(JAVA_FILES:%.java=classes/axTLSj/%.class) + +ifdef CONFIG_PLATFORM_WIN32 +CFLAGS += /I"$(shell cygpath -w $(SSL_HOME))" +CFLAGS += /I"$(shell cygpath -w $(CONFIG_HOME))" +LDFLAGS += axtls.lib /libpath:"../../" + +include ../../config/makefile.post + +$(TARGET) : $(OBJ) + $(LD) $(LDFLAGS) $(LDSHARED) /out:$@ $(OBJ) +else # Not Win32 + +ifdef CONFIG_PLATFORM_CYGWIN +SSL_HOME:=$(shell cygpath -u $(SSL_HOME)) +CONFIG_HOME:=$(shell cygpath -u $(CONFIG_HOME)) +endif + +CFLAGS += -I$(SSL_HOME) +CFLAGS += -I$(CONFIG_HOME) + +$(TARGET) : $(OBJ) + $(LD) $(LDFLAGS) -L ../../ $(LDSHARED) -o $@ $(OBJ) -laxtls +endif + +jar: $(OBJ) $(JAR) + +# if we are doing the samples then defer creating the jar until then +$(JAR): $(JAVA_CLASSES) +ifndef CONFIG_JAVA_SAMPLES + jar cvf $@ -C classes . +else + @if [ ! -f $(JAR) ]; then touch $(JAR); fi +endif + +classes/axTLSj/%.class : %.java + javac -d classes -classpath classes $^ + +clean:: + @rm -f $(JAR) $(TARGET) SWIG* axtls* *.i *.c + @rm -fr classes/* + diff --git a/bindings/java/SSL.java b/bindings/java/SSL.java new file mode 100644 index 0000000000..9d64206300 --- /dev/null +++ b/bindings/java/SSL.java @@ -0,0 +1,125 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/* + * A wrapper around the unmanaged interface to give a semi-decent Java API + */ + +package axTLSj; + +import java.io.*; +import java.util.*; + +/** + * @defgroup java_api Java API. + * + * Ensure that the appropriate dispose() methods are called when finished with + * various objects - otherwise memory leaks will result. + */ + +/** + * @class SSL + * @ingroup java_api + * @brief A representation of an SSL connection. + * + */ +public class SSL +{ + public int m_ssl; /**< A pointer to the real SSL type */ + + /** + * @brief Store the reference to an SSL context. + * @param ip [in] A reference to an SSL object. + */ + public SSL(int ip) + { + m_ssl = ip; + } + + /** + * @brief Free any used resources on this connection. + * + * A "Close Notify" message is sent on this connection (if possible). It + * is up to the application to close the socket. + */ + public void dispose() + { + axtlsj.ssl_free(m_ssl); + } + + /** + * @brief Return the result of a handshake. + * @return SSL_OK if the handshake is complete and ok. + * @see ssl.h for the error code list. + */ + public int handshakeStatus() + { + return axtlsj.ssl_handshake_status(m_ssl); + } + + /** + * @brief Return the SSL cipher id. + * @return The cipher id which is one of: + * - SSL_AES128_SHA (0x2f) + * - SSL_AES256_SHA (0x35) + * - SSL_RC4_128_SHA (0x05) + * - SSL_RC4_128_MD5 (0x04) + */ + public byte getCipherId() + { + return axtlsj.ssl_get_cipher_id(m_ssl); + } + + /** + * @brief Get the session id for a handshake. + * + * This will be a 32 byte sequence and is availabile after the first + * handshaking messages are sent. + * @return The session id as a 32 byte sequence. + * @note A SSLv23 handshake may have only 16 valid bytes. + */ + public byte[] getSessionId() + { + return axtlsj.ssl_get_session_id(m_ssl); + } + + /** + * @brief Retrieve an X.509 distinguished name component. + * + * When a handshake is complete and a certificate has been exchanged, + * then the details of the remote certificate can be retrieved. + * + * This will usually be used by a client to check that the server's common + * name matches the URL. + * + * A full handshake needs to occur for this call to work. + * + * @param component [in] one of: + * - SSL_X509_CERT_COMMON_NAME + * - SSL_X509_CERT_ORGANIZATION + * - SSL_X509_CERT_ORGANIZATIONAL_NAME + * - SSL_X509_CA_CERT_COMMON_NAME + * - SSL_X509_CA_CERT_ORGANIZATION + * - SSL_X509_CA_CERT_ORGANIZATIONAL_NAME + * @return The appropriate string (or null if not defined) + */ + public String getCertificateDN(int component) + { + return axtlsj.ssl_get_cert_dn(m_ssl, component); + } +} diff --git a/bindings/java/SSLCTX.java b/bindings/java/SSLCTX.java new file mode 100644 index 0000000000..dfd08ec950 --- /dev/null +++ b/bindings/java/SSLCTX.java @@ -0,0 +1,217 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/* + * A wrapper around the unmanaged interface to give a semi-decent Java API + */ + +package axTLSj; + +import java.net.*; + +/** + * @class SSLCTX + * @ingroup java_api + * @brief A base object for SSLServer/SSLClient. + */ +public class SSLCTX +{ + /** + * A reference to the real client/server context. + */ + protected int m_ctx; + + /** + * @brief Establish a new client/server context. + * + * This function is called before any client/server SSL connections are + * made. If multiple threads are used, then each thread will have its + * own SSLCTX context. Any number of connections may be made with a single + * context. + * + * Each new connection will use the this context's private key and + * certificate chain. If a different certificate chain is required, then a + * different context needs to be be used. + * + * @param options [in] Any particular options. At present the options + * supported are: + * - SSL_SERVER_VERIFY_LATER (client only): Don't stop a handshake if the + * server authentication fails. The certificate can be authenticated later + * with a call to verifyCert(). + * - SSL_CLIENT_AUTHENTICATION (server only): Enforce client authentication + * i.e. each handshake will include a "certificate request" message from + * the server. + * - SSL_NO_DEFAULT_KEY: Don't use the default key/certificate. The user + * will load the key/certificate explicitly. + * - SSL_DISPLAY_BYTES (full mode build only): Display the byte sequences + * during the handshake. + * - SSL_DISPLAY_STATES (full mode build only): Display the state changes + * during the handshake. + * - SSL_DISPLAY_CERTS (full mode build only): Display the certificates that + * are passed during a handshake. + * - SSL_DISPLAY_RSA (full mode build only): Display the RSA key details + * that are passed during a handshake. + * + * @param num_sessions [in] The number of sessions to be used for session + * caching. If this value is 0, then there is no session caching. + * + * If this option is null, then the default internal private key/ + * certificate pair is used (if CONFIG_SSL_USE_DEFAULT_KEY is set). + * + * The resources used by this object are automatically freed. + * @return A client/server context. + */ + protected SSLCTX(int options, int num_sessions) + { + m_ctx = axtlsj.ssl_ctx_new(options, num_sessions); + } + + /** + * @brief Remove a client/server context. + * + * Frees any used resources used by this context. Each connection will be + * sent a "Close Notify" alert (if possible). + */ + public void dispose() + { + axtlsj.ssl_ctx_free(m_ctx); + } + + /** + * @brief Read the SSL data stream. + * @param ssl [in] An SSL object reference. + * @param rh [out] After a successful read, the decrypted data can be + * retrieved with rh.getData(). It will be null otherwise. + * @return The number of decrypted bytes: + * - if > 0, then the handshaking is complete and we are returning the + * number of decrypted bytes. + * - SSL_OK if the handshaking stage is successful (but not yet complete). + * - < 0 if an error. + * @see ssl.h for the error code list. + * @note Use rh before doing any successive ssl calls. + */ + public int read(SSL ssl, SSLReadHolder rh) + { + return axtlsj.ssl_read(ssl.m_ssl, rh); + } + + /** + * @brief Write to the SSL data stream. + * @param ssl [in] An SSL obect reference. + * @param out_data [in] The data to be written + * @return The number of bytes sent, or if < 0 if an error. + * @see ssl.h for the error code list. + */ + public int write(SSL ssl, byte[] out_data) + { + return axtlsj.ssl_write(ssl.m_ssl, out_data, out_data.length); + } + + /** + * @brief Write to the SSL data stream. + * @param ssl [in] An SSL obect reference. + * @param out_data [in] The data to be written + * @param out_len [in] The number of bytes to be written + * @return The number of bytes sent, or if < 0 if an error. + * @see ssl.h for the error code list. + */ + public int write(SSL ssl, byte[] out_data, int out_len) + { + return axtlsj.ssl_write(ssl.m_ssl, out_data, out_len); + } + + /** + * @brief Find an ssl object based on a Socket reference. + * + * Goes through the list of SSL objects maintained in a client/server + * context to look for a socket match. + * @param s [in] A reference to a Socket object. + * @return A reference to the SSL object. Returns null if the object + * could not be found. + */ + public SSL find(Socket s) + { + int client_fd = axtlsj.getFd(s); + return new SSL(axtlsj.ssl_find(m_ctx, client_fd)); + } + + /** + * @brief Authenticate a received certificate. + * + * This call is usually made by a client after a handshake is complete + * and the context is in SSL_SERVER_VERIFY_LATER mode. + * @param ssl [in] An SSL object reference. + * @return SSL_OK if the certificate is verified. + */ + public int verifyCert(SSL ssl) + { + return axtlsj.ssl_verify_cert(ssl.m_ssl); + } + + /** + * @brief Force the client to perform its handshake again. + * + * For a client this involves sending another "client hello" message. + * For the server is means sending a "hello request" message. + * @param ssl [in] An SSL object reference. + * @return SSL_OK if renegotiation instantiation was ok + */ + public int renegotiate(SSL ssl) + { + return axtlsj.ssl_renegotiate(ssl.m_ssl); + } + + /** + * @brief Load a file into memory that is in binary DER or ASCII PEM format. + * + * These are temporary objects that are used to load private keys, + * certificates etc into memory. + * @param obj_type [in] The format of the file. Can be one of: + * - SSL_OBJ_X509_CERT (no password required) + * - SSL_OBJ_X509_CACERT (no password required) + * - SSL_OBJ_RSA_KEY (AES128/AES256 PEM encryption supported) + * - SSL_OBJ_P8 (RC4-128 encrypted data supported) + * - SSL_OBJ_P12 (RC4-128 encrypted data supported) + * + * PEM files are automatically detected (if supported). + * @param filename [in] The location of a file in DER/PEM format. + * @param password [in] The password used. Can be null if not required. + * @return SSL_OK if all ok + */ + public int objLoad(int obj_type, String filename, String password) + { + return axtlsj.ssl_obj_load(m_ctx, obj_type, filename, password); + } + + /** + * @brief Transfer binary data into the object loader. + * + * These are temporary objects that are used to load private keys, + * certificates etc into memory. + * @param obj_type [in] The format of the memory data. + * @param data [in] The binary data to be loaded. + * @param len [in] The amount of data to be loaded. + * @param password [in] The password used. Can be null if not required. + * @return SSL_OK if all ok + */ + + public int objLoad(int obj_type, byte[] data, int len, String password) + { + return axtlsj.ssl_obj_memory_load(m_ctx, obj_type, data, len, password); + } +} diff --git a/bindings/java/SSLClient.java b/bindings/java/SSLClient.java new file mode 100644 index 0000000000..ef624d60d0 --- /dev/null +++ b/bindings/java/SSLClient.java @@ -0,0 +1,66 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/* + * A wrapper around the unmanaged interface to give a semi-decent Java API + */ + +package axTLSj; + +import java.net.*; + +/** + * @class SSLClient + * @ingroup java_api + * @brief The client context. + * + * All client connections are started within a client context. + */ +public class SSLClient extends SSLCTX +{ + /** + * @brief Start a new client context. + * + * @see SSLCTX for details. + */ + public SSLClient(int options, int num_sessions) + { + super(options, num_sessions); + } + + /** + * @brief Establish a new SSL connection to an SSL server. + * + * It is up to the application to establish the initial socket connection. + * + * This is a blocking call - it will finish when the handshake is + * complete (or has failed). + * + * Call dispose() when the connection is to be removed. + * @param s [in] A reference to a Socket object. + * @param session_id [in] A 32 byte session id for session resumption. This + * can be null if no session resumption is not required. + * @return An SSL object reference. Use SSL.handshakeStatus() to check + * if a handshake succeeded. + */ + public SSL connect(Socket s, byte[] session_id) + { + int client_fd = axtlsj.getFd(s); + return new SSL(axtlsj.ssl_client_new(m_ctx, client_fd, session_id)); + } +} diff --git a/bindings/java/SSLReadHolder.java b/bindings/java/SSLReadHolder.java new file mode 100644 index 0000000000..0749ab3e85 --- /dev/null +++ b/bindings/java/SSLReadHolder.java @@ -0,0 +1,49 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/* + * A wrapper around the unmanaged interface to give a semi-decent Java API + */ + +package axTLSj; + +/** + * @class SSLReadHolder + * @ingroup java_api + * @brief A holder for data read in an SSL read. + */ +public class SSLReadHolder +{ + /** + * @brief Contruct a new read holder object. + */ + public SSLReadHolder() + { + m_buf = null; + } + + /** + * @brief Retrieve the reference to the read data. + */ + public byte[] getData() + { + return m_buf; + } + + private byte[] m_buf; +} diff --git a/bindings/java/SSLServer.java b/bindings/java/SSLServer.java new file mode 100644 index 0000000000..6f4cf00e8b --- /dev/null +++ b/bindings/java/SSLServer.java @@ -0,0 +1,60 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/* + * A wrapper around the unmanaged interface to give a semi-decent Java API + */ + +package axTLSj; + +import java.net.*; + +/** + * @class SSLServer + * @ingroup java_api + * @brief The server context. + * + * All server connections are started within a server context. + */ +public class SSLServer extends SSLCTX +{ + /** + * @brief Start a new server context. + * + * @see SSLCTX for details. + */ + public SSLServer(int options, int num_sessions) + { + super(options, num_sessions); + } + + /** + * @brief Establish a new SSL connection to an SSL client. + * + * It is up to the application to establish the initial socket connection. + * + * Call dispose() when the connection is to be removed. + * @param s [in] A reference to a Socket object. + * @return An SSL object reference. + */ + public SSL connect(Socket s) + { + int client_fd = axtlsj.getFd(s); + return new SSL(axtlsj.ssl_server_new(m_ctx, client_fd)); + } +} diff --git a/bindings/java/SSLUtil.java b/bindings/java/SSLUtil.java new file mode 100644 index 0000000000..26451b20a0 --- /dev/null +++ b/bindings/java/SSLUtil.java @@ -0,0 +1,96 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/* + * A wrapper around the unmanaged interface to give a semi-decent Java API + */ + +package axTLSj; + +import java.io.*; +import java.util.*; + +/** + * @class SSLUtil + * @ingroup java_api + * @brief Some global helper functions. + * + */ +public class SSLUtil +{ + /** + * @brief Load up the ddl/shared library + */ + static + { + System.loadLibrary("axtlsj"); + } + + /** + * @brief Return the build mode of the axTLS project. + * @return The build mode is one of: + * - SSL_BUILD_SERVER_ONLY + * - SSL_BUILD_ENABLE_VERIFICATION + * - SSL_BUILD_ENABLE_CLIENT + * - SSL_BUILD_FULL_MODE + */ + public static int buildMode() + { + return axtlsj.ssl_get_config(axtlsj.SSL_BUILD_MODE); + } + + /** + * @brief Return the number of chained certificates that the client/server + * supports. + * @return The number of supported client/server certificates. + */ + public static int maxCerts() + { + return axtlsj.ssl_get_config(axtlsj.SSL_MAX_CERT_CFG_OFFSET); + } + + /** + * @brief Return the number of CA certificates that the client/server + * supports. + * @return The number of supported CA certificates. + */ + public static int maxCACerts() + { + return axtlsj.ssl_get_config(axtlsj.SSL_MAX_CA_CERT_CFG_OFFSET); + } + + /** + * @brief Indicate if PEM is supported. + * @return true if PEM supported. + */ + public static boolean hasPEM() + { + return axtlsj.ssl_get_config(axtlsj.SSL_HAS_PEM) > 0 ? true : false; + } + + /** + * @brief Display the text string of the error. + * @param error_code [in] The integer error code. + * @see ssl.h for the error code list. + */ + public static void displayError(int error_code) + { + axtlsj.ssl_display_error(error_code); + } +} + diff --git a/bindings/perl/Makefile b/bindings/perl/Makefile new file mode 100644 index 0000000000..99b6e4d249 --- /dev/null +++ b/bindings/perl/Makefile @@ -0,0 +1,81 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +include ../../config/.config +include ../../config/makefile.conf + +all: lib + +ifdef CONFIG_PLATFORM_WIN32 +TARGET=../../axtlsp.dll +else +TARGET=../../libaxtlsp.so +endif + +ifneq ($(MAKECMDGOALS), clean) + +ifdef CONFIG_PLATFORM_WIN32 +PERL5_CORE:=$(shell cygpath -w "$(CONFIG_PERL_CORE)") +else +PERL5_CORE= $(shell perl -e 'use Config; print $$Config{archlib};')/CORE +endif + +all: test_perl + +test_perl: + @if ! [ -d "$(PERL5_CORE)" ]; then \ + echo "*** Error: Perl not installed at $(CONFIG_PERL_CORE) - go to " \ + "http://www.cpan.org/authors/id/G/GR/GRAHAMC/SiePerl-5.8.0-bin-1.0-Win32.INSTALL.exe" && exit 1; \ + fi + +endif + +lib: $(TARGET) +AXOLOTLS_HOME=../.. +SSL_HOME=$(AXOLOTLS_HOME)/ssl +CONFIG_HOME=$(AXOLOTLS_HOME)/config +OBJ:=axTLSp_wrap.o +include ../../config/makefile.post + +ifndef CONFIG_PLATFORM_WIN32 + +# +# Could have used libperl.a, but it increases the library to over 1MB, so just +# use libperl.so. But this needs to be in the shared library path for things to +# work. +# +$(TARGET) : $(OBJ) + $(LD) $(LDFLAGS) -L ../../ -L$(PERL5_CORE) $(LDSHARED) -o $@ $(OBJ) -laxtls -lperl +ifdef CONFIG_PLATFORM_CYGWIN + cd ../../; ln -sf $(notdir $@) axtlsp.dll +endif + @install axtlsp.pm ../../ + +CFLAGS += -D__USE_GNU -I$(CONFIG_HOME) -I$(SSL_HOME) -I$(PERL5_CORE) +else +CFLAGS += /I"`cygpath -w $(CONFIG_HOME)`" /I"`cygpath -w $(SSL_HOME)`" +CFLAGS += /I"$(PERL5_CORE)" +LDFLAGS += $(CONFIG_PERL_LIB) /libpath:"$(PERL5_CORE)" axtls.lib /libpath:"../../" + +$(TARGET) : $(OBJ) + $(LD) $(LDFLAGS) $(LDSHARED) /out:$@ $(OBJ) + @install axtlsp.pm ../../ +endif # WIN32 + +clean:: + @rm -f $(TARGET) axtls* *.i axTLSp* *.c .depend ../../axtlsp.pm diff --git a/bindings/vbnet/Makefile b/bindings/vbnet/Makefile new file mode 100644 index 0000000000..5c7a36d6a3 --- /dev/null +++ b/bindings/vbnet/Makefile @@ -0,0 +1,23 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +include ../../config/.config +include ../../config/makefile.conf + +clean:: + @rm -f axssl* axInterface.vb diff --git a/bindings/vbnet/axTLSvb.vb b/bindings/vbnet/axTLSvb.vb new file mode 100644 index 0000000000..7f08195258 --- /dev/null +++ b/bindings/vbnet/axTLSvb.vb @@ -0,0 +1,175 @@ +' +' Copyright(C) 2006 +' +' This program is free software you can redistribute it and/or modify +' it under the terms of the GNU General Public License as published by +' the Free Software Foundation either version 2.1 of the License, or +' (at your option As ) any later version. +' +' This program is distributed in the hope that it will be useful, +' but WITHOUT ANY WARRANTY without even the implied warranty of +' MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +' GNU Lesser General Public License for more details. +' +' You should have received a copy of the GNU General Public License +' along with this program if not, write to the Free Software +' Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +' + +' +' A wrapper around the unmanaged Integererface to give a semi-decent VB.NET API +' + +Imports System +Imports System.Runtime.InteropServices +Imports System.Net.Sockets +Imports axTLSvb + +Namespace axTLSvb + Public Class SSL + Public m_ssl As IntPtr + + Public Sub New(ByRef ip As IntPtr) + m_ssl = ip + End Sub + + Public Sub Dispose() + axtls.ssl_free(m_ssl) + End Sub + + Public Function HandshakeStatus() As Integer + Return axtls.ssl_handshake_status(m_ssl) + End Function + + Public Function GetCipherId() As Byte + Return axtls.ssl_get_cipher_id(m_ssl) + End Function + + Public Function GetSessionId() As Byte() + Dim result(axtls.SSL_SESSION_ID_SIZE) As Byte + Dim ptr As IntPtr = axtls.ssl_get_session_id(m_ssl) + Marshal.Copy(ptr, result, 0, axtls.SSL_SESSION_ID_SIZE) + Return result + End Function + + Public Function GetCertificateDN(component As Integer) As String + Return axtls.ssl_get_cert_dn(m_ssl, component) + End Function + End Class + + Public Class SSLUtil + Private dummy As Integer ' need something here + + Public Shared Function BuildMode() As Integer + Return axtls.ssl_get_config(axtls.SSL_BUILD_MODE) + End Function + + Public Shared Function MaxCerts() As Integer + Return axtls.ssl_get_config(axtls.SSL_MAX_CERT_CFG_OFFSET) + End Function + + Public Shared Function MaxCACerts() As Integer + Return axtls.ssl_get_config(axtls.SSL_MAX_CA_CERT_CFG_OFFSET) + End Function + + Public Shared Function HasPEM() As Boolean + If axtls.ssl_get_config(axtls.SSL_HAS_PEM) > 0 Then + Return True + Else + Return False + End If + End Function + + Public Shared Sub DisplayError(ByVal error_code As Integer) + axtls.ssl_display_error(error_code) + End Sub + End Class + + Public Class SSLCTX + Protected m_ctx As IntPtr + + Protected Sub New(ByVal options As Integer, _ + ByVal num_sessions As Integer) + m_ctx = axtls.ssl_ctx_new(options, num_sessions) + End Sub + + Public Sub Dispose() + axtls.ssl_ctx_free(m_ctx) + End Sub + + Public Function Read(ByVal ssl As SSL, ByRef in_data As Byte()) As Integer + Dim ptr As IntPtr = IntPtr.Zero + Dim ret as Integer = axtls.ssl_read(ssl.m_ssl, ptr) + + If ret > axtls.SSL_OK Then + ReDim in_data(ret) + Marshal.Copy(ptr, in_data, 0, ret) + Else + in_data = Nothing + End If + + Return ret + End Function + + Public Function Write(ByVal ssl As SSL, _ + ByVal data As Byte(), len As Integer) As Integer + Return axtls.ssl_write(ssl.m_ssl, data, len) + End Function + + Public Function Find(ByVal s As Socket) As SSL + Dim client_fd As Integer = s.Handle.ToInt32() + Return New SSL(axtls.ssl_find(m_ctx, client_fd)) + End Function + + Public Function VerifyCert(ByVal ssl As SSL) As Integer + Return axtls.ssl_verify_cert(ssl.m_ssl) + End Function + + Public Function Renegotiate(ByVal ssl As SSL) As Integer + Return axtls.ssl_renegotiate(ssl.m_ssl) + End Function + + Public Function ObjLoad(ByVal obj_type As Integer, _ + ByVal filename As String, _ + password As String) As Integer + Return axtls.ssl_obj_load(m_ctx, obj_type, filename, password) + End Function + + Public Function ObjLoad(ByVal obj_type As Integer, _ + ByVal data As Byte(), ByVal len As Integer, _ + password As String) As Integer + Return axtls.ssl_obj_memory_load( _ + m_ctx, obj_type, data, len, password) + End Function + End Class + + Public Class SSLServer + Inherits SSLCTX + + Public Sub New(ByVal options As Integer, _ + ByVal num_sessions As Integer) + MyBase.New(options, num_sessions) + End Sub + + Public Function Connect(ByVal s As Socket) As SSL + Dim client_fd As Integer = s.Handle.ToInt32() + Return New SSL(axtls.ssl_server_new(m_ctx, client_fd)) + End Function + End Class + + Public Class SSLClient + Inherits SSLCTX + + Public Sub New(ByVal options As Integer, _ + ByVal num_sessions As Integer) + MyBase.New(options, num_sessions) + End Sub + + Public Function Connect(ByVal s As Socket, _ + ByVal session_id As Byte()) As SSL + Dim client_fd As Integer = s.Handle.ToInt32() + Return New SSL( axtls.ssl_client_new(m_ctx, client_fd, session_id)) + End Function + + End Class +End Namespace diff --git a/config/.config b/config/.config new file mode 100644 index 0000000000..092035ebf2 --- /dev/null +++ b/config/.config @@ -0,0 +1,107 @@ +# +# Automatically generated make config: don't edit +# +HAVE_DOT_CONFIG=y +# CONFIG_PLATFORM_LINUX is not set +CONFIG_PLATFORM_CYGWIN=y +# CONFIG_PLATFORM_SOLARIS is not set +# CONFIG_PLATFORM_WIN32 is not set + +# +# General Configuration +# +# CONFIG_DEBUG is not set +# CONFIG_VISUAL_STUDIO_6_0 is not set +# CONFIG_VISUAL_STUDIO_7_0 is not set +# CONFIG_VISUAL_STUDIO_8_0 is not set +CONFIG_VISUAL_STUDIO_6_0_BASE="" +CONFIG_VISUAL_STUDIO_7_0_BASE="" +CONFIG_VISUAL_STUDIO_8_0_BASE="" +CONFIG_EXTRA_CFLAGS_OPTIONS="" +CONFIG_EXTRA_LDFLAGS_OPTIONS="" + +# +# SSL Library +# +# CONFIG_SSL_SERVER_ONLY is not set +# CONFIG_SSL_CERT_VERIFICATION is not set +# CONFIG_SSL_ENABLE_CLIENT is not set +# CONFIG_SSL_FULL_MODE is not set +CONFIG_SSL_SKELETON_MODE=y +# CONFIG_SSL_PROT_LOW is not set +# CONFIG_SSL_PROT_MEDIUM is not set +# CONFIG_SSL_PROT_HIGH is not set +# CONFIG_SSL_USE_DEFAULT_KEY is not set +CONFIG_SSL_ENABLE_V23_HANDSHAKE=y +# CONFIG_SSL_HAS_PEM is not set +# CONFIG_SSL_USE_PKCS12 is not set +CONFIG_SSL_EXPIRY_TIME=0 +CONFIG_X509_MAX_CA_CERTS=0 +CONFIG_SSL_MAX_CERTS=2 +CONFIG_USE_DEV_URANDOM=y +# CONFIG_WIN32_USE_CRYPTO_LIB is not set +# CONFIG_PERFORMANCE_TESTING is not set +# CONFIG_SSL_TEST is not set +CONFIG_AWHTTPD=y + +# +# Awhttpd Configuration +# +# CONFIG_HTTP_STATIC_BUILD is not set +CONFIG_HTTP_HAS_SSL=y +CONFIG_HTTP_HTTPS_PORT=443 +# CONFIG_STANDARD_AWHTTPD is not set +CONFIG_HTTP_WEBROOT="www" +CONFIG_HTTP_PORT=80 +# CONFIG_HTTP_USE_TIMEOUT is not set +CONFIG_HTTP_TIMEOUT=0 +CONFIG_HTTP_INITIAL_SLOTS=10 +CONFIG_HTTP_MAX_USERS=100 +CONFIG_HTTP_HAS_CGI=y +CONFIG_HTTP_CGI_EXTENSION=".php" +CONFIG_HTTP_DIRECTORIES=y +# CONFIG_HTTP_PERM_CHECK is not set +# CONFIG_HTTP_HAS_IPV6 is not set +CONFIG_HTTP_VERBOSE=y +# CONFIG_HTTP_IS_DAEMON is not set + +# +# Language Bindings +# +CONFIG_BINDINGS=y +CONFIG_CSHARP_BINDINGS=y +CONFIG_VBNET_BINDINGS=y + +# +# .Net Framework +# +CONFIG_DOT_NET_FRAMEWORK_BASE="c:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727" +CONFIG_JAVA_BINDINGS=y + +# +# Java Home +# +CONFIG_JAVA_HOME="c:\\Program Files\\Java\\jdk1.5.0_06" +# CONFIG_PERL_BINDINGS is not set +CONFIG_PERL_CORE="" +CONFIG_PERL_LIB="" + +# +# Samples +# +CONFIG_SAMPLES=y +CONFIG_C_SAMPLES=y +CONFIG_CSHARP_SAMPLES=y +CONFIG_VBNET_SAMPLES=y +CONFIG_JAVA_SAMPLES=y +# CONFIG_PERL_SAMPLES is not set +# CONFIG_BIGINT_CLASSICAL is not set +# CONFIG_BIGINT_MONTGOMERY is not set +# CONFIG_BIGINT_BARRETT is not set +# CONFIG_BIGINT_CRT is not set +# CONFIG_BIGINT_KARATSUBA is not set +MUL_KARATSUBA_THRESH=0 +SQU_KARATSUBA_THRESH=0 +# CONFIG_BIGINT_SLIDING_WINDOW is not set +# CONFIG_BIGINT_SQUARE is not set +# CONFIG_BIGINT_CHECK_ON is not set diff --git a/config/.config.old b/config/.config.old new file mode 100644 index 0000000000..092035ebf2 --- /dev/null +++ b/config/.config.old @@ -0,0 +1,107 @@ +# +# Automatically generated make config: don't edit +# +HAVE_DOT_CONFIG=y +# CONFIG_PLATFORM_LINUX is not set +CONFIG_PLATFORM_CYGWIN=y +# CONFIG_PLATFORM_SOLARIS is not set +# CONFIG_PLATFORM_WIN32 is not set + +# +# General Configuration +# +# CONFIG_DEBUG is not set +# CONFIG_VISUAL_STUDIO_6_0 is not set +# CONFIG_VISUAL_STUDIO_7_0 is not set +# CONFIG_VISUAL_STUDIO_8_0 is not set +CONFIG_VISUAL_STUDIO_6_0_BASE="" +CONFIG_VISUAL_STUDIO_7_0_BASE="" +CONFIG_VISUAL_STUDIO_8_0_BASE="" +CONFIG_EXTRA_CFLAGS_OPTIONS="" +CONFIG_EXTRA_LDFLAGS_OPTIONS="" + +# +# SSL Library +# +# CONFIG_SSL_SERVER_ONLY is not set +# CONFIG_SSL_CERT_VERIFICATION is not set +# CONFIG_SSL_ENABLE_CLIENT is not set +# CONFIG_SSL_FULL_MODE is not set +CONFIG_SSL_SKELETON_MODE=y +# CONFIG_SSL_PROT_LOW is not set +# CONFIG_SSL_PROT_MEDIUM is not set +# CONFIG_SSL_PROT_HIGH is not set +# CONFIG_SSL_USE_DEFAULT_KEY is not set +CONFIG_SSL_ENABLE_V23_HANDSHAKE=y +# CONFIG_SSL_HAS_PEM is not set +# CONFIG_SSL_USE_PKCS12 is not set +CONFIG_SSL_EXPIRY_TIME=0 +CONFIG_X509_MAX_CA_CERTS=0 +CONFIG_SSL_MAX_CERTS=2 +CONFIG_USE_DEV_URANDOM=y +# CONFIG_WIN32_USE_CRYPTO_LIB is not set +# CONFIG_PERFORMANCE_TESTING is not set +# CONFIG_SSL_TEST is not set +CONFIG_AWHTTPD=y + +# +# Awhttpd Configuration +# +# CONFIG_HTTP_STATIC_BUILD is not set +CONFIG_HTTP_HAS_SSL=y +CONFIG_HTTP_HTTPS_PORT=443 +# CONFIG_STANDARD_AWHTTPD is not set +CONFIG_HTTP_WEBROOT="www" +CONFIG_HTTP_PORT=80 +# CONFIG_HTTP_USE_TIMEOUT is not set +CONFIG_HTTP_TIMEOUT=0 +CONFIG_HTTP_INITIAL_SLOTS=10 +CONFIG_HTTP_MAX_USERS=100 +CONFIG_HTTP_HAS_CGI=y +CONFIG_HTTP_CGI_EXTENSION=".php" +CONFIG_HTTP_DIRECTORIES=y +# CONFIG_HTTP_PERM_CHECK is not set +# CONFIG_HTTP_HAS_IPV6 is not set +CONFIG_HTTP_VERBOSE=y +# CONFIG_HTTP_IS_DAEMON is not set + +# +# Language Bindings +# +CONFIG_BINDINGS=y +CONFIG_CSHARP_BINDINGS=y +CONFIG_VBNET_BINDINGS=y + +# +# .Net Framework +# +CONFIG_DOT_NET_FRAMEWORK_BASE="c:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727" +CONFIG_JAVA_BINDINGS=y + +# +# Java Home +# +CONFIG_JAVA_HOME="c:\\Program Files\\Java\\jdk1.5.0_06" +# CONFIG_PERL_BINDINGS is not set +CONFIG_PERL_CORE="" +CONFIG_PERL_LIB="" + +# +# Samples +# +CONFIG_SAMPLES=y +CONFIG_C_SAMPLES=y +CONFIG_CSHARP_SAMPLES=y +CONFIG_VBNET_SAMPLES=y +CONFIG_JAVA_SAMPLES=y +# CONFIG_PERL_SAMPLES is not set +# CONFIG_BIGINT_CLASSICAL is not set +# CONFIG_BIGINT_MONTGOMERY is not set +# CONFIG_BIGINT_BARRETT is not set +# CONFIG_BIGINT_CRT is not set +# CONFIG_BIGINT_KARATSUBA is not set +MUL_KARATSUBA_THRESH=0 +SQU_KARATSUBA_THRESH=0 +# CONFIG_BIGINT_SLIDING_WINDOW is not set +# CONFIG_BIGINT_SQUARE is not set +# CONFIG_BIGINT_CHECK_ON is not set diff --git a/config/.config.tmp b/config/.config.tmp new file mode 100644 index 0000000000..eae93ecacb --- /dev/null +++ b/config/.config.tmp @@ -0,0 +1,11 @@ +deps_config := \ + ssl/BigIntConfig.in \ + samples/Config.in \ + bindings/Config.in \ + httpd/Config.in \ + ssl/Config.in \ + config/Config.in + +.config include/config.h: $(deps_config) + +$(deps_config): diff --git a/config/Config.in b/config/Config.in new file mode 100644 index 0000000000..fea9c0a6d6 --- /dev/null +++ b/config/Config.in @@ -0,0 +1,112 @@ +# +# For a description of the syntax of this configuration file, +# see scripts/config/Kconfig-language.txt +# + +mainmenu "axTLS Configuration" + +config HAVE_DOT_CONFIG + bool + default y + +choice + prompt "Platform" + default CONFIG_PLATFORM_LINUX + +config CONFIG_PLATFORM_LINUX + bool "Linux" + +config CONFIG_PLATFORM_CYGWIN + bool "Cygwin" + +config CONFIG_PLATFORM_SOLARIS + bool "Solaris" + +config CONFIG_PLATFORM_WIN32 + bool "Win32" + +endchoice + +menu "General Configuration" + +config CONFIG_DEBUG + bool "Build axTLS with Debugging symbols" + default n + help + Say Y here if you wish to compile axTLS with debugging symbols. + This will allow you to use a debugger to examine axTLS internals. + This increases the size of the binary considerably and should only be + used when doing development. + If you are doing development and want to debug axTLS, answer Y. + + Most people should answer N. + +menu "Microsoft Compiler Options" +depends on CONFIG_PLATFORM_WIN32 + +choice + prompt "Compiler" + depends on CONFIG_PLATFORM_WIN32 + default CONFIG_VISUAL_STUDIO_8_0 + +config CONFIG_VISUAL_STUDIO_6_0 + bool "Visual Studio 6.0 (VC98)" + help + Use Microsoft's Visual Studio 6.0 platform. + +config CONFIG_VISUAL_STUDIO_7_0 + bool "Visual Studio 7.0 (2003)" + help + Use Microsoft's Visual Studio 2003 platform. + +config CONFIG_VISUAL_STUDIO_8_0 + bool "Visual Studio 8.0 (2005)" + help + Use Microsoft's Visual Studio 2005 platform. + +endchoice + +config CONFIG_VISUAL_STUDIO_6_0_BASE + string "Base" + depends on CONFIG_VISUAL_STUDIO_6_0 + default "c:\\Program Files\\Microsoft Visual Studio" + +config CONFIG_VISUAL_STUDIO_7_0_BASE + string "Base" + depends on CONFIG_VISUAL_STUDIO_7_0 + default "c:\\Program Files\\Microsoft Visual Studio .NET 2003" + +config CONFIG_VISUAL_STUDIO_8_0_BASE + string "Base" + depends on CONFIG_VISUAL_STUDIO_8_0 + default "c:\\Program Files\\Microsoft Visual Studio 8" + +endmenu + +config CONFIG_EXTRA_CFLAGS_OPTIONS + string "Any extra CFLAGS options for the compiler?" + help + Do you want to pass any extra CFLAGS options to the compiler as + you build axTLS? If so, this is the option for you... For + example, if you want to add some simple compiler switches (like + -march=i686), or check for warnings using -Werror, just those + options here. + +config CONFIG_EXTRA_LDFLAGS_OPTIONS + string "Any extra LDFLAGS options for the compiler?" + help + Do you want to pass any extra LDFLAGS options to the compiler? + +endmenu + +source ssl/Config.in +config CONFIG_AWHTTPD + bool "Enable HTTP/HTTPS Web Server" + default y + help + Build the AWHTTPD web server + +source httpd/Config.in +source bindings/Config.in +source samples/Config.in +source ssl/BigIntConfig.in diff --git a/config/Rules.mak b/config/Rules.mak new file mode 100644 index 0000000000..c0308da053 --- /dev/null +++ b/config/Rules.mak @@ -0,0 +1,220 @@ +# Rules.make for busybox +# +# Copyright (C) 1999-2005 by Erik Andersen +# +# Licensed under GPLv2, see the file LICENSE in this tarball for details. +# + +# Pull in the user's busybox configuration +ifeq ($(filter $(noconfig_targets),$(MAKECMDGOALS)),) +-include $(top_builddir)/.config +endif + +#-------------------------------------------------------- +PROG := busybox +MAJOR_VERSION :=1 +MINOR_VERSION :=1 +SUBLEVEL_VERSION:=0 +EXTRAVERSION := +VERSION :=$(MAJOR_VERSION).$(MINOR_VERSION).$(SUBLEVEL_VERSION)$(EXTRAVERSION) +BUILDTIME := $(shell TZ=UTC date -u "+%Y.%m.%d-%H:%M%z") + + +#-------------------------------------------------------- +# With a modern GNU make(1) (highly recommended, that's what all the +# developers use), all of the following configuration values can be +# overridden at the command line. For example: +# make CROSS=powerpc-linux- top_srcdir="$HOME/busybox" PREFIX=/mnt/app +#-------------------------------------------------------- + +# If you are running a cross compiler, you will want to set 'CROSS' +# to something more interesting... Target architecture is determined +# by asking the CC compiler what arch it compiles things for, so unless +# your compiler is broken, you should not need to specify TARGET_ARCH +CROSS =$(subst ",, $(strip $(CROSS_COMPILER_PREFIX))) +CC = $(CROSS)gcc +AR = $(CROSS)ar +AS = $(CROSS)as +LD = $(CROSS)ld +NM = $(CROSS)nm +STRIP = $(CROSS)strip +CPP = $(CC) -E +# MAKEFILES = $(top_builddir)/.config +RM = rm +RM_F = $(RM) -f +LN = ln +LN_S = $(LN) -s +MKDIR = mkdir +MKDIR_P = $(MKDIR) -p +MV = mv +CP = cp + + +# What OS are you compiling busybox for? This allows you to include +# OS specific things, syscall overrides, etc. +TARGET_OS=linux + +# Select the compiler needed to build binaries for your development system +HOSTCC = gcc +HOSTCFLAGS= -Wall -Wstrict-prototypes -O2 -fomit-frame-pointer + +# Ensure consistent sort order, 'gcc -print-search-dirs' behavior, etc. +LC_ALL:= C + +# If you want to add some simple compiler switches (like -march=i686), +# especially from the command line, use this instead of CFLAGS directly. +# For optimization overrides, it's better still to set OPTIMIZATION. +CFLAGS_EXTRA=$(subst ",, $(strip $(EXTRA_CFLAGS_OPTIONS))) + +# To compile vs some other alternative libc, you may need to use/adjust +# the following lines to meet your needs... +# +# If you are using Red Hat 6.x with the compatible RPMs (for developing under +# Red Hat 5.x and glibc 2.0) uncomment the following. Be sure to read about +# using the compatible RPMs (compat-*) at http://www.redhat.com ! +#LIBCDIR:=/usr/i386-glibc20-linux +# +# For other libraries, you are on your own. But these may (or may not) help... +#LDFLAGS+=-nostdlib +#LIBRARIES:=$(LIBCDIR)/lib/libc.a -lgcc +#CROSS_CFLAGS+=-nostdinc -I$(LIBCDIR)/include -I$(GCCINCDIR) -funsigned-char +#GCCINCDIR:=$(shell gcc -print-search-dirs | sed -ne "s/install: \(.*\)/\1include/gp") + +WARNINGS=-Wall -Wstrict-prototypes -Wshadow +CFLAGS=-I$(top_builddir)/include -I$(top_srcdir)/include -I$(srcdir) +ARFLAGS=cru + + +# gcc centric. Perhaps fiddle with findstring gcc,$(CC) for the rest +# get the CC MAJOR/MINOR version +CC_MAJOR:=$(shell printf "%02d" $(shell echo __GNUC__ | $(CC) -E -xc - | tail -n 1)) +CC_MINOR:=$(shell printf "%02d" $(shell echo __GNUC_MINOR__ | $(CC) -E -xc - | tail -n 1)) + +#-------------------------------------------------------- +export VERSION BUILDTIME HOSTCC HOSTCFLAGS CROSS CC AR AS LD NM STRIP CPP +ifeq ($(strip $(TARGET_ARCH)),) +TARGET_ARCH:=$(shell $(CC) -dumpmachine | sed -e s'/-.*//' \ + -e 's/i.86/i386/' \ + -e 's/sparc.*/sparc/' \ + -e 's/arm.*/arm/g' \ + -e 's/m68k.*/m68k/' \ + -e 's/ppc/powerpc/g' \ + -e 's/v850.*/v850/g' \ + -e 's/sh[234]/sh/' \ + -e 's/mips-.*/mips/' \ + -e 's/mipsel-.*/mipsel/' \ + -e 's/cris.*/cris/' \ + ) +endif + +# A nifty macro to make testing gcc features easier +check_gcc=$(shell \ + if [ "$(1)" != "" ]; then \ + if $(CC) $(1) -S -o /dev/null -xc /dev/null > /dev/null 2>&1; \ + then echo "$(1)"; else echo "$(2)"; fi \ + fi) + +# Setup some shortcuts so that silent mode is silent like it should be +ifeq ($(subst s,,$(MAKEFLAGS)),$(MAKEFLAGS)) +export MAKE_IS_SILENT=n +SECHO=@echo +else +export MAKE_IS_SILENT=y +SECHO=-@false +endif + +CFLAGS+=$(call check_gcc,-funsigned-char,) + +#-------------------------------------------------------- +# Arch specific compiler optimization stuff should go here. +# Unless you want to override the defaults, do not set anything +# for OPTIMIZATION... + +# use '-Os' optimization if available, else use -O2 +OPTIMIZATION:=$(call check_gcc,-Os,-O2) + +# Some nice architecture specific optimizations +ifeq ($(strip $(TARGET_ARCH)),arm) + OPTIMIZATION+=-fstrict-aliasing +endif +ifeq ($(strip $(TARGET_ARCH)),i386) + OPTIMIZATION+=$(call check_gcc,-march=i386,) + OPTIMIZATION+=$(call check_gcc,-mpreferred-stack-boundary=2,) + OPTIMIZATION+=$(call check_gcc,-falign-functions=0 -falign-jumps=0 -falign-loops=0,\ + -malign-functions=0 -malign-jumps=0 -malign-loops=0) +endif +OPTIMIZATIONS:=$(OPTIMIZATION) -fomit-frame-pointer + +# +#-------------------------------------------------------- +# If you're going to do a lot of builds with a non-vanilla configuration, +# it makes sense to adjust parameters above, so you can type "make" +# by itself, instead of following it by the same half-dozen overrides +# every time. The stuff below, on the other hand, is probably less +# prone to casual user adjustment. +# + +ifeq ($(strip $(CONFIG_LFS)),y) + # For large file summit support + CFLAGS+=-D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 +endif +ifeq ($(strip $(CONFIG_DMALLOC)),y) + # For testing mem leaks with dmalloc + CFLAGS+=-DDMALLOC + LIBRARIES:=-ldmalloc +else + ifeq ($(strip $(CONFIG_EFENCE)),y) + LIBRARIES:=-lefence + endif +endif +ifeq ($(strip $(CONFIG_DEBUG)),y) + CFLAGS +=$(WARNINGS) -g -D_GNU_SOURCE + LDFLAGS +=-Wl,-warn-common + STRIPCMD:=/bin/true -Not_stripping_since_we_are_debugging +else + CFLAGS+=$(WARNINGS) $(OPTIMIZATIONS) -D_GNU_SOURCE -DNDEBUG + LDFLAGS += -Wl,-warn-common + STRIPCMD:=$(STRIP) -s --remove-section=.note --remove-section=.comment +endif +ifeq ($(strip $(CONFIG_STATIC)),y) + LDFLAGS += --static +endif + +ifeq ($(strip $(CONFIG_SELINUX)),y) + LIBRARIES += -lselinux +endif + +ifeq ($(strip $(PREFIX)),) + PREFIX:=`pwd`/_install +endif + +# Additional complications due to support for pristine source dir. +# Include files in the build directory should take precedence over +# the copy in top_srcdir, both during the compilation phase and the +# shell script that finds the list of object files. +# Work in progress by . + + +OBJECTS:=$(APPLET_SOURCES:.c=.o) busybox.o usage.o applets.o +CFLAGS += $(CROSS_CFLAGS) +ifdef BB_INIT_SCRIPT + CFLAGS += -DINIT_SCRIPT='"$(BB_INIT_SCRIPT)"' +endif + +# Put user-supplied flags at the end, where they +# have a chance of winning. +CFLAGS += $(CFLAGS_EXTRA) + +#------------------------------------------------------------ +# Installation options +ifeq ($(strip $(CONFIG_INSTALL_APPLET_HARDLINKS)),y) +INSTALL_OPTS=--hardlinks +endif +ifeq ($(strip $(CONFIG_INSTALL_APPLET_SYMLINKS)),y) +INSTALL_OPTS=--symlinks +endif +ifeq ($(strip $(CONFIG_INSTALL_APPLET_DONT)),y) +INSTALL_OPTS= +endif + +.PHONY: dummy diff --git a/config/awhttpd.aip b/config/awhttpd.aip new file mode 100755 index 0000000000..3b68600ab9 --- /dev/null +++ b/config/awhttpd.aip @@ -0,0 +1,133 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/config/awhttpd.back.aip b/config/awhttpd.back.aip new file mode 100644 index 0000000000..7c754f1db4 --- /dev/null +++ b/config/awhttpd.back.aip @@ -0,0 +1,128 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/config/awhttpd.msi b/config/awhttpd.msi new file mode 100755 index 0000000000000000000000000000000000000000..278f1046685a463327df1ed30cc988e920c6fa67 GIT binary patch literal 681472 zcmeFa2Y4LS756ZuP3us{T}2%;W$3{p}V`=8Xw6^6PN?$f&@4W%md9} z9~^uMaPt3O|1Zda?}>v)xkx!Tf;B(|SPKjQYlAAvOUiydus#?FHULxsXG5?N*cfaA zHU*o3&A}F6ORyE#8Vm;8fNjBcAOf}rL%;guDd=Le@f&x$o zia;?K1xAB0U@RC1#)I8J3D_O%0rmuYfeD}#l!0>404hNh*c()X8n6%87fb~8U^18j zrh@&zG*Aobz;rMJ%mn*`1HggcAaF1^1RM%xf!QDir2WKs?npj&@*Kfa%B4TFLX!k- z;Bb%vY0wTjzw!$kO9;1DT&JnDR1SOQZBGq&1*Ai3|^{B z>dbM2q?S0&-Rf6mrGDeLEjoARs6KkH#?oEO#zw99X^ZrH)8lk!wQr zUVC*`Hdh?B=N~F|{RMFtMEH`QKPUXJaIk6%6?``Qk~b=M{AJ+>VXtofuS3vzpV;ub z_j;rJgVHxDud68hW#PMdKQsN4pl=h#!Zo4#kO`vrSpALloi)5x6?{%Nz==)0NO6NxI`?>#R?$;f;-|OdI<@CPuTz#+O zX75d0eHXb!?ih1Va3{ENbvLB@iKWCKeI+=&CFVv0hzTk>twW9_%~}GHqE-tzG+{=-&q%7 zQyrEyk!KhZBW-6X!tq--v!1cd#w#0d>r&fU_ttmobJ+JVjm`^eBB6%g*UI@4n_OGT zzpP32Et|J}$307#eaq%#u9@eo0Y4ppEWHkVbUkF~fyliBk$Ja=&yApkUEy5H_vJ{n zE8s5LRR4}fGOa<38cF*qN7}4Is+Zih7vy6z!`O?y$&N?3_#+^PMx0!%ufk zgKjV_Y$QIO%gF6&MWLUsLOU2KQ2L**E1#&ks`RVM;lH2{lKv02)4e5pMV>r<@)CJD zB>$9rT0XAgM(GrP!G-+wv*iy7<{|0ixQ3PARDR6fLrZu1nfj16F-gEZ)<2KRBurBM&*La;Uz^Cf2=4h`=s*cN#dK4{s?|;3RXA#CTMpA za!sf{sdQ|4s$!e6Z+}q@B>&w(_#>m9)eT?D|F_5ha!L7rQu*hK-*IOY5u|vF1c$tUZxzo!rsfES^tFv|`v1pA=i5p8LkTRG>Vy zoAOwDd`>deRU2=wh^HG;i8kfDrZL{yo@h$MQxeZevMJIo-r0`^72W|QlS?MdoEvYS z8&5^}iD=_UA{}Wp;U7Q*5-lAqk@*sf2_9K8R?vxXqX!zfw4$SN4h=IoM@e=Q<1d|`9O49TgkI@U3@`%3EsEF+R4C@x_C=l zGs!L~PqsEDB)KJfcO)81rpDUmmduE!(qb|();gynHYZ+^&54q-L~AV7RWiM;EuJcm zrQ;zVOZhf4(cD-bOEm`8)8ccK1^J(iP&tW7w$vs&QVn>J zO5%NcS4nxSKG7O)FR7iIOtm+3w3keuHnFxnm1vz4X)uK*38UbocvSwTDTP>jB$kRt z@S`Om$qkjN(CH#7ZIEP(^NGm@D$NnpzQ%0vM;a4pvZxEwL~Eoim7GKUOJf>qPR@zM zS{ozs?3^2Kjl`5sQsnUkabijIqS|*`e1?MZtB;#N>f?=3TMAQDg^M-grHu(?NKr-F zO*ut6(nJLJ#@u+Q>Om^rkW4kE#mYuH(%7Lg$&i_7C0nDVjV+1RN)^j^ZT#?#cxyvY zp|g=pw9Ze?i;s-N6RKL1eyQ2<);SbLgiz#bE?Lk_ov)ZUF&b2&AR+MuZIWGNu&J@> zd5JbD8tT8vt)@s^3XEdJJW1BIRmGaq@n{Y0OhU{0knU=2k1de=C1TRNM~36mnP_e% zpD5~9{2Cca#oIeltx`o2@pM_Nu~dauL5qn7Deh>gSIw0iZj5WU5(|P&Q_)CbBi1Ba zx3+Ao)2d$SV$_*RDMlg_ehGe3 ztgVfrs$9?>ZR>;6^uwSVVJcX`T&Kw`3|>)f}6X zRzIpeKx%_h?xb4O$LGf8C!noWtR7~g-3o&ePy*D8R9woCP))s1wAp}^@9lFb8i|gy zc(`VLTK&M3=f!u6>|I$ma_W@Yx{-C$O3N!pR#%o*jGQ{XE*g!_jMtZDBUY+11+&^j zd%TV`^BR$NNpGjHdlgRKNoh{D&Phkb6^u;hVI)RQG$d#YjW}-?=e8!LlAY0MH2Xvf zJNSj|XefBX3fDZZ6;Eup*%^pIBQ{ z5ow~y)4iJF6V|TEKGqE5XlYBflF74zw;zvQKo;pcf(_O~RX(QqCJj%ZeYDZPX{HUM z6?vn5ZYtR^XKqCLfOcdE6QAg$nn{(jP)pobZQDh3Pp(-t;yE>Y~Rxk^KTugxxrR{Xx^&K$$8nSW@EVh9>jUgRLt4y>w;hY@5J<1jKjsL_qo%oh4g)$0qph{uSjc+-|lE0IRx+J+#|O6H{F=@G;>sPHMn zHzkaq)QLAOUm}%CHtTjT;YWolNLMaTk#OW0kr&-9OKmqzKvitAF4iTSD#%i@s!sEY zE}Ld52~pjSB}89&8?wv=+1^b@R22E#Q(! zq)c^oV%O2y!&Y%4l{-X5>Lom!0*RM42%ilxXw&H!&SR)546~QC*z{Dyn_?Z!?GbCI z`a|+J9Z$_CPW7-Bg0XBfIxU%OuYkoVu2Y9i3IiBIv-Ik@ajF#`QV6w;RD^VOGTp8s zF5+FADjPag-V<$_NzX{6+B;&+Ii3^mNSHSZ(^f*d#A&{EfLvyxL$y#WTX#{pInaw( z#AJzo+uW|S@EOg%NI@^ko)HVRZj}IA9K9S)Z%rTth8wt)X*Rkvo)qJdwk)@ZMv&0p zq((;9xlb!sLGWyhHz6h>qtOyg`!-F9@sLh|De)kbs3~CbRg#Mjs<_h~_4$fnceF~$ z>83m^t^9~Ws|$G6RMo_D1R=?K6?17aiW%tvRFCe=2Bdw?raBrag$s#PZ32~!B1wV} zo0{OCn)}8gGQuQ)_76h@JXZlB}9{AaV#(k|Zcn zv4a+Yp{7yBXd=(frvaC?*V3!P>noa@YdcbODi}&P)-07e(GZ^&Z%MWz9ix`hP;H5;6zBPjmJ_AbLp7WU`(PJ6nak)BZj~-2l*SJHF%j7 zyp=HIQypwFRZ`QMu&)&<`z9RNyh|{F!&$l6+Mz3}%B-{vPd89v^s4vaQ7&SOLLlgjJ{HnVxX>8UnI*G{)0#ZtGAg&nuwRc6!%0%*@Lz0{kDZ{cb z(@zQ8Zdcr)AxVu@qaaJ7A{S|nH%U`WwPx90eUdgM)l3=@y#$?$sjk-7Qp^AC$Wz7# zk|%W6?F@n$av==!#?5D3)1|X9aJSh}x-E@&MsU7=xrJu+&v$q~?bvQ?rq)rfSY@ z*S|K)f4VScCK}u4s-M+&vww9ml{i8KtY)(NSF9OQ4^@egI0{2}2$}^-k|D6oD-rv$ z3KXM_kZhtpXhlj3vVaJxQUl{KA!Nr?vW2X~rSZ}>HgOmD94&2CL!F-aZwI<+T+l~s zkhMBR%t2PCVya;5Xoe8$B*Rl8 zoQrZzc)3UsR`G$`E?Nsche$9gR)$MaMzm1Ve+K=k)>cI)A|NVTqo5>4ss(D56_Pzl zDdd850u^O2PDAQyi58R;mK2qYDj8ieres{n_>w{l#*`F}Eh!vVQdCedQ;GP<~A^eCIvK|4x^#SP0Z%$T7| zWQCY;sE+0s+D$Wp)ZJ^S7Y{Uwb)o7dB_DM36q-oqugHQp}Pshzv(s7ZOceT z6t8Ajpz;}+T{1;Ht7ilZtA>%ZQ)eY8+dVfc{R;tT;mvgawww&pqw-iCG=a7Da7=qB z&?QUNS3we2DFW4>FhrV8U=*MmTJ7+Piah>F^%!&1WID6kw}`-KTrh%K}@B=Sg1}StwbVW zR`k!3zyt~d#&BpsYcF1>vQbSd=cFjpCGSk(i5AP7Ib-fJM z<5ZG^4vDB?;4DcRDTt#24b(I;95iK7r$&}C86drwa7R%>tNJIBQnb8$s+Q!+=f)f6 zl_eL@N+?QFY(;q80k$VFGrgHA0|{4)DP}0xQ|eP0AS|Z587mQX8#<<|(2i4=cmVZ@$jqngrwL|l^D5lUS#hc2yLqP}L^ zA0jg>E8dcz!%Mb~R6H}t-;R2`O$XiPoH(*9Jfm^9NWsX$kwxfKYl!A7`3a&=DTKxW zreX_4Ke|H#rbbD_3RNkiZlWwz@}iNMrswWV$<$ISJV!ch$p}hThOH_D$pm?+k!Bmj zNQIzUGU_*_1T<~}3T^yj5h#^frl;%>?3gyC{Ykf?7?XkoBo5sv zP;&x*auxfMlwozLj`%R`yBY6?JW~Ca@E1MESAq6q?lKQE2caExVA{&8!(`~1Y&HJ& zkx1#*tpZk$UJWyoww_c?ccf^l#KS}?T}ky=eaR#6+H^`;<#SDAFxU}pVMidU#!&Eq z!;w}GrYon_u0;ctwe(Y}{|w12l20~7J=(!b1YFxY(2&*eT8q@3bLkNb)1`c*-I+0q za-ljYwDJta%-o#OeZeXgKJ)kBSxA-D3v4vmOhu4g%28LUhc6DqADV>2-< zVxF36mEeN%P`YKiazK{}rj*)`FPs|drN9#)Y@ zvorDd7jTNG7E@%X9FMiwQHMw_nuZAy6!NW+sg;r8QDg*RyV1)1S=PXd@@06mrhLi> z=`oO75b}Sl3l-*odd7-EEKG<7jN?~kcA5|U9Bx-fzSs!X1XCnY%z}9a-TNzXMln;> zR$3#WzLm1=F>aFLGLg{_qwZ6|DaBu(q1K>_v5ZdjIK~qKkX0f`O4K4Ha?(GmX=-81 zZE=3!rEO$1xhx!_K8e62f!U#zlGCXlB5N_hJxAJ+;uKU15rrbQNQ{t7jntY*N?a1d z2bxP84{Tc!c+)yZ$5M|1bdy)|c1*u3F$~SdPY7;!rz26y2uMPcFMJ3|cFI>0sF{w= z2b!A9dh5oa2*{oKWPNgh8Y2CK3>XAjtCr_j0iBg8sQ#t5w3?$(w;Du1WgR}~1gc?o z?=g2yo0f@wJ(yGDWyR2R%ynXoG%ekP$l}qprS#0;ot`VHhAPYe%h)jqUqDLSGnu{SBxt(CIXV{O}}Oxy`g%3A2t$o9Gl3hUQGO-iei8oC;g znzpY{D~)F9M`a%xM{Q&KRGY^VMH9Q~cypVCHyS>B@sEoSFY zr~E3K)F3*d`m|ZnztYo?uco@wP)|0c7D~P?*zy=%e>0LcHBXlhIwVZ8)vOv(Uib*B zzha_ar_5P3GEcDg5Q@tu7}m zO8ps9AqSJ{rkgO%$c{A+rv2s3Rj{sm)TV24HAw0m{s{ ztTh;25NS|>(#NTKXvUtp6A#v(w2QvX@NJ{if^8W6l(wu#$(R#GCJa02+*$cDBS=>; zW%9FA)t+qYnW*|C%ET5iwE_1|m8k(d^w7=Jgc7uQB5;>fDivi(HA8w??AR&I7R@eQ zN28VKb#K)kV{JyjimZqeRAm{+Ak#AN5~KcxiB>d%8>rE%R(S>vbR*G9c+pUIu#5vH z4Fj2j3R)I&h`bt%t&Q|kp;tz#el2(QLsu20H-V4N>eIE!puV^n@lw5kA*mEC>aUbe z(UvKtY@ewV{jOf8V#gF(L!ZV?iov&X+J|&yBOHPANXDs_pjHQxb4Hp_qKER9R>@l4 zBr{nE^rl(roEA2cqdZpu_MQ7boqv@o-$+v+oNKm_tqj6D!xM}uI76gsfz-YTt6~{S z1^k0V$nqB$1~o?78sjIE16di|uF+@`4i#zdWW6VaiYhc(u9!}hTAUFUP6Ab@2rgQK zp{iDRR3>X$Oyvw$$iQijVR%$8GA>nG2x(zfy#zm$7Hn#~WP$k1g2c2QFEf}>3zGv0 zPOKYsX0b|^l(0lXcbj@jF*lO7Yu5hLHe|4;bi>RY$5P0Wt;ooFF|LsdJ6e_EgpsvO z^^5!))x+-aI%!FQ79*`B7mRRCe1q|BV?0`i$}`UL%myXw!nYCn=`<;~k+2#W`k<)M zy`8NDIr$RIg`0)l61u3yts_+r(p_ma2vTwpeOJutDNyZo)GKmX0MkjWvT6Nq{E9=bm-N)YQbHY zIoSGcsZDiP%3Iw}Hd?2R(f%BU7)!5Ze}QwAlN4*ZU9%`FXTq257&@%8%PkwGfRoKy z%9r{cRBOc$RIbs-!(!B`L5f8dsHw0d6j8oeLJD~f8A$8Yiw$~2Pe?^&msPa{BWAEY(K^Xi6!bwW71r19YJYdN3K+oBESWi-j=GbWYX>Tsf5Q zMmegNuuEY!WSM=hGBFc}LiQsu?0Z3*WPffP=f_x&W+1j9^Jxfl&j%PKa60_XG1EPj!x3+8kB`m>#0rzwy1X8^z=@(1!?O9*lg5) zsdQBJ)@F5lp8`|=;+D3NbrQd*tCy?_`tOc1#hbp!nuQOB+C63Utb6nDQ*>%|HDa^v@ z?4)8S9DFe==GCg=B&&-WlkFqS@`j+A=IBgREw&3Fv_KN(FUmS_X_%=r&)TY~yCytTo~p(Rb61@!)1VSs)VRbe#8G8LA4O-6J{%pt>MRUt zB%iLF?uQzw7FFP+iZTdg{>UC(2i!;noGXM#18u^gW}V`NTIL`xioZlzbtlebT}rW3 zB`a=dA(+_6bdP4^EwnXSjG6LDG|7~YI0<+VoYBn0{jZr#v}STmhzqJu$$HH*;e)1Y zr;lf9kW>-P(0pl5HukaJUY5d4HC;-t8YO=95N46t=z=A$#WJg8q_L?r-SJ2^hKaPy z=t#b0&Com=@uZe%5^|iq1%Y6kC9{^op1DG>41MgXJ)GEDa| zeXB-=3+j?rwUDt9%%XEwrekD)!4ewgJ0-5UX%QbKg{E2zrzcf=EM?RoLp&B%u$*7S zA?dHA93>tjY>IUW8oeM}RXb5)7ayr!fSy8AvYH}6nTU94 z`gOe|AXd+En(&S}-KvzP*KVGZWXbk3DNH>gm-JX~uxwzbgUt6uWdp(LEO?;+Bwx^Y z{+IJ6GUFiACcp9=hN|zT)&0~QhNO8$BHsD`++>j?dOjhV*-$mX7ZxPdM5nGdS*2Z| zf)-mn&NEB8LQGRyMst$wNR6zs&Q4dGS=TzLXEJ9xZ>ntnRNGC{0h=tTqKyZ$*E!n* zVsK8;?CX9@qFRw`VPL6$H9L?hrDQWL-ZNchLr_B&yEMf8ptB+K+X7V=cds92;TnT*&YQZ#1VsN&J1MvsXM-@9^h z<+PgeS*6S{?-40jfWlQ>Bc`L95vT?qPJ%8C75zTrKS{Qd31hPhgtZGD0#0{lT1XKD(-Jtia!FZJTZ+4Q=wpmNAz0#xKY?Y$F zv3t-^pw6pl%;{Wh??f7dUMaLrQssq~+{7_`F3arYO_lp@iaF;@_M*1Yi#6JqL6Mb$ zCfd|xDHf&bu-XRIYY{NnhOf#mQ;F1qNUF2AinPY#Xj^n4z_(by&j?^*EZuH*(yEFP z=!En@L`R%5VX>VV;Y%e|6Ada0qcdc3J3cXn+Cj>W(+`;C2!!%ro_f9_i%v>5b~Ivg&*W(J6K%LwCF zO@)qy4boOHIJj2&F&x$tB)#^uQK3w<(B`Wtd{f18A{!beM26R@Ik2c+5~u^t3d1HM zDYZS;#siIuk(Et^Cz`a{r_^g5AYHg@tnI_4T_03a5sH8~)Gnw|Cd!u3dTyVrNiu2c z&xOf?9yt+Eqpy}6GHE~u$aF5>J)&dMp*VBg(%49fh9KBzs3Y{#^eQBjZ@p5kyqD#R zCgqmUrr16u-Tl$Zc^*1l!C4yFiqNkk4g)ccU}x%7j{Y4@O3qg!D_EIoWkIb};v5RF zA$H005LNMw2x3@cimYo%A_0rW*D9ASqsW=Z35`i@kXk!4nXXB);J?x~37?Th9M&}j z;{_FhW<)s}CiaeS+5>tYVc3ya6Vf*#lBAm?2@jNc@ix|#zyZk~HM^nNbT}C0*e2Qd zPfXMlx?<;MN;0Is3$b!y4X4-pff$zt+6+-EqrA3T3W6-ti_P`=n{-Xi7^TNNV&KGV zMrRa7MGTEJTbhzG)YLlnUs3aC%fci$C@(Xnq@}+J4<33+EviFOy{60-ghrm> zHP;deQO!uVL}#g{E~wiQs7&?f_5NZxr#V?q-3r;M2uzB#CYqG0H9NaVm#eF9HU_y7 zXfcj-O%>lI4~*Ac;dD#Z)?ue=o>U;qRmC7*4^?IJwLVHE?2B@ugm6psvmKNF6*MU{ zFy*peuSxBBkXKn!$)et@p(;zs#(Hu|4Wy1_5+IpquA%nU7-bt*ErPcOl zhH^B{Mp?kXl#0p}y;V%~9x6*!{sg;EdkfwY6?Hg*s=>rcDwB90;x<1+xg{*oj9*}g z60I3%las8f(360ATpI{pwmuo!s0x_sS7={~>`SqI8ATkKa%q@bt+dT){pe%0Df3F4 zdZ2aEW(SaJeae{1YR!f?SQhx0-Ije^M!$E}^K;QLE*I zAlfcXrPxG{9jwA0mlAaFI=-R2>fw1*MgnRJqB<-?wNmZBVq~?PLDZ%@BG_Cid`3?w zCJetA)v_#DB^WlKdx4)$E~KV!$gao!nQ;wyp~{09E_?7`b<-sx|Yv$JOII(Uk@&!bcVJ~^vK_fN9QUe37*M?iYifROH5Eh#r6 zv>uFG*B~b7VbfFD*hgNfo~UO}DGG=hS+r&S3iVg0kagk{_f>tVoP(F*9PF0%@ zK?f(>S`2$ntATGs?QRJ+H|miposx1Jo!WtvmYy4E0m5m{3SssDD5ZLnRak1kt2|cH zdf>Z`YQRvD-nBSyM*}i8Mbv|hn=LH#Rp>}ioHTYcw98gNX|{G9i71?iol-1^bli4< z5nEiP8LJquxKkEgg}Az^+p)-gXmMnbRby5s9<^qiJ3>bAr_@}KD9I;S;}m2{wuqo5 zAnQKlCx`8bI#YWmMPq5SG={!OHtuD8q-Ytqv`44K8WYJfwK2I4S9F)Z;;9ZP@!T#) zRoR{mGrTv`d2;tASY=m1C=yn>VMD5rnChnHj&(I5!zG+WT z9fb;|yma8Dt2u$08;mfAUw8ge&pr@kJ^K-i%Kle7KtxX?<*BCINlk&)*W@Ns1Z#GiHsXo&=S&l5Txb+I|&ateC* zP$8+_He7%WRx95}0jijwQ?~h)o&Hym&aNm>S&aA#{Z4WJ=d~r1g;I zW8d8MeygV{4MmPhB8Phz6Jd=UYsb`-jutUU>4ZoOWy2COQMUM{F4>K@devHUmyM+! zIsHPvB-{>GU|9W5I(OYQD>j;&s1tn_sIVTRTguT;nrRA^L*a=xU2tkcgOrvu#|EBK zfvuGmk%RfKT1u9K)yg&F$}$`&am=HUT}MU^mbKv=w5XOg=**OvO>=VbG&M&=UN$AO zBZ@xSUY%-tTAmHFN!EvO0%4nNWG3J;H1lc&%5Es*b-D1yJTSAtwc=tVA4TdT*(UGf zc&|{bV`PK{lh%pM9OpREU&f7mXh-%mjdbu52n#`0AoieQmBs7G_XizyNOWc_!CDNx zrIOUksz5k7A_fblua%2f}@IAAYi8hQD;w4u{YjJCq|>t(}j8+Jtrzl z#F-!IkrTQ*mF+@mU_##TM|+Xe#w9(KcCTL_iBro;P5rBts3+Rhkpp_cDoxeI$1JZQ z<|+~sIe%`7oG!JuNYqnFmYj_y$cgcK4b9QT*kcD(n z*-B%`S5NfJVGmiZrdN9CDLv`QpRf?*b&N1U3b;87$sIn za|j2adQ4@l4hvb$R8|BVjkRQ%lgdDtlXhno2nH!qk)Zm9b2+f2{Mk2>9n$t*?V_at z+}phtQfOLMR;xdVzdCwVv9oYGIb03iM;0eliWT2%ZOm6|;s{lp*khIF*#d}GC)<&l zr7Fx-Z@u$J_B+fqbBpH4(|j2ls9ifYx5WSkAQ57+PfOlhh@mUhU#g+`e%GZnTSf2Ec2t@Vf^ zl8U$Xp9++7w{+MXlV*!XyiwJbZg_2I$o+txbNhEDUSD2i_%6hBRcgl|3)aw>VE3&9m zZnAQC;jV>6L1w5uZ{z^6(t4^9%&f@{EuD8nLzQEQ3|~>}ONro(VuH+I9s%P~QiPOX z&Yp5{o~4SaDuT?%Np`SISv6_b;^{&~@6NvjpmUv=sJ9s;1r(^T1A)_SWKiNJ=L)I) z#KDZLJ*$yu!kd2jwEuRI3YrrfV24D7Bl>N#z9Pv=l3=TcE~`G{^P^oDYHD>dkK~3r z(m-nuMu7&q*}8s|NN#$rs&4RN@g>MAl;?v!GpPCEgOYa;ut5> z+c>7EQ8DD~ERQY*;%zki(g5&W_4%Pg>18dkklNDI-M=~P$~cw5r*0|Ih{*H6Ts9?! z?96}RnQA&tNiL+i6QzENYo#GkDkGV82s@UdZ<1q@8Q6+uOJ$acooN}0r>2yx_K2*~ zV<~C*Szog!+e)Hk$*4%NdR-%-3}M~wkf_PEa?k9sxoQG+d&P&KzwuPav0LNZ!}-VY}G0N5!jA{cy`eS3}|fP z;C5z-gsjSW*GLayqOtqCK4Pg&%fo7z2f}i z2I*fa7bI9Ft#+_6*Ve2?qEiw4&~89V$*Oamd6fa65SOc+{m8~@AeWYjQ9Z>--)NSE z^_+7|8w1lX*-uk#Q2fyT;wg2MXbs1JT7ybkaA8CF=PluHiD6Bnm@F(Pt*ojlEkY_8 zUsakvs<>cO{zv!(-qsl9IMs#YOAAZOMi-2gb53wD zwxA-vw4k6Uzr12x(U_w0(oy3Jix+ivcFwA(nbyQV7h-ZY%Fn{F&6jU79F{G!-`_U3f-uvn^e>Qvk>tSqb?KW6OMQTb!b zs>*RxHa@=$SNT=t1?6Lk3&$4~R#hzG9|_b}*3GJ!Tw4eCkbf(n-wKVzq|%znb-dfB z5bJ-bhoOF%Jf+TRi{g!#R_SYXg@*LO;#o8H>itJ=wIylNlBN&YEGI7Cy&^qE(-hRNnd zVx#SPR7WFeA@!gYvNX~Nbia|CAKEOm>$+CWpyN*Z7@Cbba>8a6r80f$-qT7eDtF&g z3Pn??n44EMvNo>a4m4zD)wP{uuzs^;7`6@C<+Mq`0l`MQ%7g~1{nPR_y)_k|W520F zx{B)GJ%$XCT2)&;Wm;YN^g60;=+#)(l}_W|U|}_@Zi;bS8*i7GnM$M-LALz)hZY=T zsdTC7pxCly6Bt?cpkkNH5<*701hWP?Tq0|%iZ=Uc*+$lc!Z3^@YnD^ymV25~tEreN z8$f%Pu`&({Nqyy(47JrPJk#qqY*V2dQvVlIx7)~+X`E)raNGPdOi@hIamkrhS=NnS zAN2{`m?~6SF{x%UPbn?+K2`o{rZKSZ>KR**PB#n3V?woIZq_#$nOUiUzQLZyBFnQw zLx1Vf%z81i5Jmr&8|e@eA-M>ph!&KdaD3-u=RJP2|1*3M{~7#4=Tm2u^Mm8M`u~Vu z>U`&X<9r3}09XDqxjZ*;Z{_V={=2yEZ0>I57P+HbZ9d)|$$u*k{~z;3j{cA1_Sx

0Zl33Q+Kr9hU}AQ(Gs`*9 zbqRNdw}Ss{UhZt=PVfdgv%LG92c4ML=rwu!IUQcoOM5Ne;odwi;dOcoy+vM^ceJ;} zn}Lh{`M=pK6n|c}`d{^wjE=)u(nZ^N*=su?cR3YUqmUQ@!Ky3xBFt zbT7ltWkoBwG1a%fyy)Vhl|xT0!UeV`RAql6T@Vv#k15@@7T%#kY93dv|zi=WUR;Vcy1h zo91nv_io<%d8_h1$@@>JMo#9j4soZi5Ar_9v+qCl zJTLFOAE(RU=W5(;X5-A7nY@gb@iS{=*3PVxSvRvuW?*Km%!ZkbGV5j5&kV?HkQtQO zjaG6fSljWOp*;D&#m*$2l!w$!ekuD?H=(9Vt=BcbdS!&N^_NS1_pYd3=`YVv-a}~@ z&|W-r!A!6g>72^bck-Macn-v56weu$xA9!ZU(X-t5ArwiH}N;~ zxA3>}2m9Ol+xgr3L;M~6q5g1xXMdz0^$YwWzt|t`kM+m--u1{{Dgf!TzECY`@-b^qc%S{@VV!{`&p~{)Ya>{-*xs{+9mM{x*aW zA&edTo%~_`2!9tp-`~|QB#cr17=N6oiC+RQs%l%4!Z@aAH6?$fA((j9`+vb9`zpgp78$WJ?TB={oQ-U zd)9l-`-k_u_fPKy??vw=?_b`_-oL$9yw|+fy*Io!y|=u#y?4BKz4yHLy$`*Qy;a^P z-lyJwywAMPy)V2ky|28ly>Gm4z3;s5y&t@8FX12NH~X!m*>N7!C9cc5$L~YRPADET zRF8R2d;Pn3HODVa_ks73GJVXme()c;bLb?{x&8;&@#bB{c`?cC~9-#F!(L$RlHZ;%V96;bjas_ur29_1<>b1Pzgzm3W2c_=!I?|Xd^+>Sv1^~O z$?+cb*mE|g441e&dS`lv`)R+!@ASL;h5jP{X#W_0v46b3#9!*4Kf^!E zKgU1MzrbJNU+iD%U+!PwU+G`%U+Z7zU+>@G|H1#0f0KWUf1Cdo|4#pI{~rIZ{{8*~ z{zLvF{$u_V{*(UG{xkk_{_}oCUef=K-{zpnRzSy-}^WEfAs(C-|XM&-|pYx z-{qf@cdvh+e|p}7{=@#G{^S1N{HOfC`_KCS@VBJ>Zb^EFnsjf^b348t&RYPpI#>Dp zXMA}SH~;is@LlZsx+UMFjcjG$@T9dw2B}*14s~ECZ;^=lbgmlUI0NC+@*nHPXabP- zBUdI=U$kpwEH>)T$z)WDS-qJNou(u51eomM-{m;WeGX_kbl!mMy%p^CN3NfPaYLT=`MzyS_maN5C+gZAF>41-p_~@>$lznGr*~MQuORoRuuA`S^uY(;Ngus`^Os+>$v>yhod5NC&VY|@zxn8+2VlP>v#k4k$60#&%_g+ArAtpd9Rr-o zrNZQUfVkyaAU4Efz-JY5Oa%Gqf2~scoJ=OneZf-;3B;2r5vu> ztGoN|4alvvs1bPz$l={tIC(!%4W;^t2%(VSc{hfu9QXUL95=5IxR~{6_Z{6c0e=s2 z>-hkDr~dltp?}=aJM~)r`l{!5zjU{=>XF|$&#dZpZhWoVIqjKlXWj$dPW3I_&Q8}* z&jn|^Nxf1IL7WMsJ)kdyekbU+gdTry zyb=1-pq~eQHS{|{%gDuXpr@a69OxbBkpo_b{z2%kg?<_IY3OG{Kbq;rw?HqsdkxfQKz#(%^-%8vbrJr*4*i4BUkm**=+n^8gnl~oHPG(?eIfKaLBA#R z_IM40S|s1`Uj!E7W!q-r=g#@lhZw&+Ehbr+Jo9uNNw7Q+O#F~ ztDt`k`e&ej0Qy^?zXp2v@k?hwe+2aP(C-6%k??rvyP@xfz8m^(=(~vz)%7K+>#bDR zbEvLqs_WFLj4jV08p2Y0UH5vrEkAKwxb>`w z6ta_(Po3*){B!?Lj)2^ZxYw?KY}{l=O)_S3y!E`nXgE5(V?6sc!+f9Uo#I_Z+@*K8 z4@gqp0I&?kVGd&f2ThLStO+7;^ELapw3cNe zKz;AVcrbkL#mG$G6^zyFy|*LxKB0TIBX^^@+Z4ADj-l@(;hBrn81s0>nc@2sMxAnB z$$hOF*WAb$^iTcX_d8NP`hJ~}>g-0$^suOk0?-g&OR*I|5X?+x7z8SCnMu&eJK zU3=%d`YuwV;W3PeWlTK5E$6OM_at|cyI+s{P&a$W89_^Jkb4eyGk4P5DaO_Mp6}ZG z7)ILmKGl_bnYzz$?R|-xy{~0dp1p5!?fn;5?z_0}GxuX|_Wry3clUX9zvSBcP1oKZ zx^jOS++R_L?M+4X)(GzPsM)#qre5|QOs&`VcAmY5db#&V&)&Ow_8#Yr^L7v26<&Y$ z46pCIiPn{SchdUweGIKIe4pq^8w}s)d-kR|a(lGGwHS@B%}9M+G#2YKnj46=bO$gD z-RCg0lDlG(&+lZEj+Z)@J69OHuugTfGu9dJ?C$Id{b)3rRrG)(XmRDZ+Rv#&$FV7w{InkH?(|M8h*6g$@>N!rrIh?lE;mmhBodxv3 z3u$dfgT-)>P0E7S7@KVqg!!Zt9=&D^Q}e?T~4}u z;v!n;IrtiJhoDiu-Wi5Yc^6mo!;78#Ui#_lol06_H*}l4|ET9 zeZG!H%Y3lgpu!wsN?@*g7&$kLe2^S@HF&lok$1TZ-9_%vXtWoj-(G@-`((F*a#-$4 zSuA&#yXUzVxEHz?skh7BE8HvHtBI+O=MCt;|D-hMlbu`K+f2OgcJIaK2i%9;M~LSQ z?%&)e-KX5A-DlkA+{Mm#_eEkOX?@jwUA?{SzU#iPY*rbY*WEAN5#;6dXw<($r|x=r zo|MlM&H!&6PfAo$qRaDDa$WLk7A6O}n|d|7s%O64A*wa1V zTfy5{YW@c5-jw(a)+e#=we*2el0Hn;B* zro4xLv+>YAXnX5hmfE_q&n&g2u_0&EE;jbIw)R_|)(>lEpV=_N)b?HbZ@+reX2Z|= zXQ^_Z)+bG8zp_5tH?h&T^--H-zwDc(%Z8IR>1merHP%eU)DZro(;j$*e4=paEao;Di3&O z0*iiLzU%HjI%E~555EgZ&Ue^dKkqs8;z7@=NBlCz-aajP&u?qKT2D8VlfIsA`trM{ zSUy71=$Y1@-{J_foGV0=$+7r#KYlI0e=UC`b*tl- z(1hviyM1Ea>&o;nk#B`iUMmt5vteGS%q*?__-~&5_%B{&4D7o+<;tjE{S$r<8SB?@ zJqo?|>820<(I*`~i@CK6zhm65xwR8|xiacE`_uC~Ytx%n?E0i9FV!Ukk$z~z&R&#k z=BM7pK1|p1J8Wm)?bG_**E39G-zD;4T5BFQ`#JAF=Dshxo^`+HcQ|b8J{)H;v*?R9 zY}Vhq_4k+9i`$-Yw*CcAlgILH(K9SbQ-5|s+eqCK^mHfR;pL!mKazo^-48-Jd^_4!OjSaC~nM#pkE;$GTU37{C0G z`*8fiVe||$hfX}@vVPik^PN#o%4CBc;i$Z2{@Bpv@Pe=(VjsSG#w%>Mdhhumvf1iA zY!b3WOX)BdAhs1s`!9AC@}n-Xm20;8wQozYoedo*oMtzwOjbovkBH@6>|&v(r*=^6k3`Jl{fk; z8-{f$@!QR*qB_c@)0?HzrhWg)d`n-~m35 z3-g`W=(Og#aGW=dO<%5bC^}ZXfBQ;d*ev`muI;yd_MM|y+nymx`APj){maIG_K!Hx zHT*{ia;)4;_EW!yO|o{3>7bMqllr$Ot#xIemR@|w(rWivf2^HQ*(>XVHpzZx->eTp zVdG@oYd^!Z)}}8r<~miHERB52ZNFuGgMQaF;Ujf6P_bZjdv`c%`3%nIRdB*$!YBHp7&?n8bp zgSOGX;%W=G%h|@&K57@!FqL=s-^nQd4!Tg?5Ig!xmSPBQwM+?DeluWZ&gWhaar_`x*s-1nEiR><#>P&HJS(!Q0Ilwv4Ihg%NF{ion_8)=S=4;)_tDsoabD{%F&h1@1gsH^GD~;#HiA_$+^Y3&H0OS zr*n_7e#QBf&ne(~x1%k?# z&ezVj&iAZ0_1rbwHQlw`wcT~y_1yJ&8|V&lH*z<2H+462w{*95w{^F3w|94Nhq^nt z!`+?Tk#5v2aCdbJ-C}pNI~JGY+}+$#x6G|@_jaq@ecXxeWOu4t>rQuPxOMJK_W<`G z_YilMJKKHJiMjP|qZ`ikggeh|aa-M&*}nFQb2!hmdUm)A+#}p0-J=kDj&+Z7PjHvI zC%LD%r@5!QXSip&XSrv)=ep;+zj0T%7rU3bm$|=nf9GE1UgKWpu5_<=fA8Mt{?Yxj zirLNXt?upa9mMfY_a67J?)~nA?!)e*?&Izg?sQ64?q}V9xc_utaR24L?7rgu+kMS_ z!+ndlcii{f58RL3kKIq)|M2~p`?>q2`?dRx`>p$|`@P%kdY22h$<*n_l>#gq% z^fvG|_6B(ydK-C%yPJ5Md0Tp$ds}#0do$h5ylr^jmiLG^#2e}E;O*oM_jdMn@kV$$ zpM)mr3x8jrPWRsyEH612et- zy#u_1y#u|2yhFT0p_uJ8cyVuzH`hDNYxY{bHZSG1d-J^o-VxrB-cbxP9OqcC(m9Te zj*Gn$yrter-pSsn-f7wt-uij#=Jlx1|JOf%Ks&UC z+Dnid6=ANg9DnhrUr(7k=-TB2oLz?f@t*~lU5ADAHm6)nZNv?zO9&!>KvJuuUJ`5O36*)*I3s z@zthI>nIyvJhpgL(YXAv;Xbj~`o9o?l*ASv7iG@z}!RN<)5FROm~~#ubbzE+-~M;|qz&_;LAV z#iL5|M~^8iE*?F8^q7kB!bJ_KuD15%tfDam1srl2os(!XCQWjdiySVpaBO*Td2y*E zreHLsTspoYzpP+XL4H-~n6ZWBMLdefEz;*O994K^=sbtmqI^;iWLs`j|704w0i`>;WG+|NYz?@vvLu z80z4$U@@CWcm@F(zR za1*#0+yZU|w*hqdNB|CNQ61y}hZU)sPu;`wUhr3NAGjYp03HO=)*l8E_eXg?1|A1b zfWLt!!BgOA@OSVGcosYd{sEo`{{$}p@#7_){{k8I(P%T3El!i{|?W0 z!F%9+@B#P`d;~rQ!dE{5pMw8@&%oyZNyYgRdamE?W2`8N39C5@EPHStcQ(s^2%$PC5 z*=L`9oIUs4(C+zb1P!pCp3 z$QW6cJ_$&_yarektOW*uwZS@IT_FAS`d}c~01N^ff{nn&K>G1b!De7{um#u>Yz4Lk zgTXdnTd*C7fbGE$umji;>;#5_VPH5I0d@wvfRP{{M8U4002G2EPz*+a(O?W13&w%* zU^h?#b_aWaJ;7dJ0w@J#pd5(&Q3+&rWp7XoYQR2VUm$YHBrq9F0aL+#Kt{>6pbkt2 zGr&x+KR5s!2o3@w&l~~{1+&0x5Cip~0W^X*XaaMylAsM74pJZu z+Cc}H4`kde@=_N#0xSeaf<@pca5Tt(W5BUsF*pt!4^99}z*2A`I0>8#P64Na)4(!t zI#>?Q0B3@;z}es&a4t9xoDVJlzX2D572qOpF}MU=3N8begWrNH!0*77;3{x6xCUGc zt^+H<_2Bp525=+z1NbBO6ZkW@3ET{B0k?wN!0q5K;0|ynxC`73?g96Lzk>U~{on!c zAb1Eo3?2cGg2%w);0f?I@FaK&JPrO1o&nE-=fFR}^WdN01@Izx3H%GZ4E_yX0k4AB z!0X@*@FsW*ybay~?}GQh```ocA@~S<3|4_pz^C9p;4| zYz4LkgTXdnTd*C7fbGE$umji;>;#4a(WeXtBf!pJ7cdg!gDBV)6o5id1d72ZFdB>j zW5GBu9_$86!0uoVuqW6HOaP^z43vWkPzkEQ-k=)PfPKKeU?P|VCW9$pD%cN91GS(I zOb0W-Ot3#V02~Mo0tbUbz@cCkm3KuoRpKP68)`Q^2X%dBIJ@`Gi0o(}w0R9O61pW+e0yl$Oz^&jma69-5xC7h??gDp%d%(Tmui!p#KX?E< z2p$3tgGa!l;4$zxcmn(lJPDoxPlLaMXTY=IIq(ngJoqPg0lWxa0{;RpgMWipz^mXj z@H%({yb0a{Z-aNhyWlufW&f8}Kdo4tx)O z0Np?a+cK#2KpybH8emPZ78n3HiN{$7h~{EFus)CzF*X2$z=mKWurb&KYzj65n*-!L zXGy0U=Oe-*b7VmrJxLyg9=ays=(f$8q|P&z`kH2m;@$+DPStt4@?8K zpbkt2Gr&x+KR5s!2o3@VgG0cfU>2ASVxS&0fJP7pO<)d~3liWkFb_0?7SIZkpbZ=j zQXmc5K?j%*I>7?a1&#mt;62>t~A3~mB9gImC@;5KkO_zSoL+zIXicY}Mtz2L9lK5##H z06YjD0uO^nz@y+X@Hlt^{0%$_o&ryUzk_GMv*0=K5AZzrCwKw82wnpJ0xyGqgIB<- z;5G0%cmuo%-U4rfcfh;gJ@7vG0DK5O0w04_;1lpE_z(CDd=9<7KYyq|e zTY;^?V6Y9?7HkJ1V0$nG>;PoUyA#i$U>FzROyK@r#$6o5i-CMX7@z-TZA zj0NMsc(5BN0lR}efSjwf7nlG_K^Z6q6`&H_3-$)ppa$Fr<ZD3}FigBYj>4WJRkK@*q*=7I!}^FHQ*X3zrUjI1PR z1BZhYNP~9J0p^2FumE&{Bfvs%Bv=HF0!M=km{eO{CF98ziM8axzFmFgxh``<)NN=) z4v@2!l)$X4Um7*?>WC9Mo|nwT;%*TtUmCTm*eTs!RwJlKD~|L!VFJ#%)T`^-q&~hh zsvvM0s0A^{m9$~(M<{zatQU=*!{L3{tPyf)j`4LkuFu)|6K#`q!_n&whxR#x*IKiO zZyeFg@!3%!kYVkpNdpu?z70-k5FHK$bVePrHdf1uubUTfdMgVZ&J1)OyPy|Iac8Vc zX%ig|4|FztwHHA>$Bm}avFKrKa~#eVbkg7UB5B}1kBCCj;XFd8qI8{}(J=Z-ha(A{ zPY&*79dBq*t~ssHnUw5hjVgA2u_EA@Lubo3dlASX_&N!kf#_Ve;krTi^EiP!o=R#< z4pnp>sMnU`nEM|wp6rBri({?N8MH~($jxUJLZEtCI=2yP>;H8yLrhMNI#vi?4 zlge}cRWmGc#^ff?Ew7%PDSh4B{-Z&YF3fB^@z~B;cVFZm@sPLip!*K5c;l}how-N( zdCkMlt0~#`$`5Y)^4*W}U;Dc2=G$-n;O3WFC-1Sv;G(=k@BV7t{a%{#+~c<$zj*0o zpfHcvE}cU z6rObQ*WHh9`PG|`FBq|Ge8H<MQ>J z@}+sJ4%zRbEsi+pi*J{F@#OgK!q4Wsux#L@OaI-u)1UYh&h z1>bD*^^>0-IpWc!&kwj^;w4{~4EX$@b@uwrHkWUF&exlM`{92cePiLxkFL7oliv?5 z-~54sHSd3*;QdE#YB_k(v4Z<%JXG+)8lMkX>yiU5Xx{wD<5tFYtY7@?zO}|KgEqNt^Tun(oIj!VnR5mV`TE?4Gq>Dx=qnd* zxBK(XSubsW^(%v3UVrO`&u472&$&1M?)|q%xBcUUtv-7Do-xsP-mJOe>}jWbc-y{r z@4e0;b2k6nePXlOmnL`J=)LtGE!k=ISszb)=%nIn8s|N>=W!1X`|!C1Z?Ap+KL&Q5 zaQ3cuY?!~-+<%?C`&z||+h08Jj!Oo!;q|jldcR?0>XJEm1225~o8=d8|F=o;2}O$@e)^4Z`CZ5ER6S(>va_d^eL3sc zceeSawfx(U%rLo)G`r3*OPnz;X`8r3;zu_;RZ?evd7k{|5Umn?Y^5O$x=T=wT zwzj+36M5I1b?CRZ?s3VJcf9z%`|a}COBRj&tn9)=KD*+IW8y2$^Pm0xl6x-tJ~8^S zJ8wRwy1Mc9uF;RpA6y%Ke9`D9|FiWL`(M&Hzav)u==~#FH~RAyPp`Af{Fb6)w_3Dt z_IVShq&8Y{!5eSfS~lwG^&)R<{_u%||9(bk;*s_4dgsMcuB~2v>tSC$bj{;8JaY5E zwPro>;OBSDUhmFxkLkSZ%_qmt-f5rBj=yi#Mh~yM-kT3z?0Vg^{||Nd5G2d@h5@>5 zY_Nv?U~trr(zc_Uc9!JTy76|;3+-VuM581k6D7Av*q38u~ACD`` zMDr+&kL|<%K^(WWpuN%+mh_ zH~fPz&gjgMQITG%(?iDED+ZtW1;#f;ob@e{#6SHFW|kMcc1A{BW2~etq3EIhNe3=xJww>ih*F2yP_+W37ln-EB zpeav>=6z~qxz*fRNOdmI?ox9}0%wAw@-C#j)8<>DP9y*<&1_cXbh=$ka~70_t=>am zHxsT~nDZ#;@DK*Hx;0qAm&vI}vq{0Quhv|PJLLt?No0DZOiFQftKp4JmC|Dg6SxQn zHd2}{hv_=0^AK0Ifvu<;82z0{K5st6Ktchn8U0O4%xQs>lfpFSdYQT$KnH?7ov=sOB$R)W`gjImG*_ZL}{Nfu{Z zQ?mw|mwyf^1*8HUQviI59g@InGSmU9#|UvBNTIi7D?M~gjLCG&@h>_81r{jwgiZc1 zu%KjpxUenRC%v&K77}%Z9wk7TwrXR3QmA!5$Cvvn_kvBRM`UgM`QW@GVYCc6CN~C* zlFd_a0s+2I7r2iyXvanoc00xVR2-&a|jYO2Ag&OJz12335tP$dl`O@xY<#ce1t?M^oCfA&))zcP>kaP?B#h^^fy z2B=Tvgi>H%2!UzGnYB$}(7j_f|5S{z!#v|8yoUAtBgRO`RLWOU;VOn=K?jM22&Z4A zK#Szf3vHD?>XFI{>5HHRB;{-%su)qm|3o8>+Rp+4^X~ST=omomBqoP>ALt8+z)6rZ z{=&-78qY>AGhn0(R_XP11U`3k>n(J#RyiNJF0I|;4(jLU(ZdrMW@r@I7&z8C5t>tb zvn44NS>9cq+fXF6YPE#{TtcK#O;mqrPFheU@3eZ5)b9Ec_#Ez(8Y>EUiUNwkn{jm} zN^k;@DPh$oSq-!|PT3|o75f7-)M*{sl~g(%7(5x{@EKn=_IUvr;=%= zP)0}ULcA;O{uQ(-&m*ns&E5vDTlJl&SvPdtgyxp{DY-uA31=qcdc#&$5hm3(J594o zCvf|JbD7px1vrP^PWrd%+TBYaY>z5!PwO91Mr?{G$UJF;&fL{PW{|QH&v{Z%D;=Uw zc@-}2e4~E*Ebs^WWl`e^ciraeDKOqjcfdpa8uRaFB}njlJ$f4Z!$>G3pOG{+RYdg{ zJ)54K8~TjC@UT*RY|i@`@AP-q9R3y>_h20HdK6)NCy9C8rDLGi&K}hGv^BXKUNj(p zEMEgPe68iX!=5eDN)xM}{LeTGly}fsydq?NpkfQu7`A@8ZuQXJd=m+q=-@=)PsHlq z)q=5?3#gh*mb?;Ms8>;Ka##T;V$$4l;umjhX6XIrfj{pdW-l^F(Oq7J(I;20-qW)kS7ssgd z#!Fs|0Zc)tH6A>qm%;7?Fk(;?_!!SS1`Z8DM?(sP!J76&EAL0Ji|Jp>NHZoDMDc3H z|GnfEj_Yo8S0Z%dwyX=udw6|@i`nV36$W9|1qil;!u2u5^Ci*U;PoQeDsBY=t1RWK|6(NN5 zCwjm$MBg2E4#uOv{w*3|7#@-r)2?(E|BNMb2tNo#Y)6iBlWBE(&?ae;%Bo;gn3VJQR%lx@FjwY6e2oa2vk1Qc()REH9Ai5jaa2yOOPO24O?tfoh zN*AzwB)mvC%DQrLfi0qP>P+dwwmXj?oyJN3b_OTC0>?Gig?)GU_q<;yh=)`7ODTv4 zgmgz#;UfQV7eY_wrWEz>vVCFMRl@@p@|Y6}HYe{{i3HOa*iy7ohKk_^Y7yBlfMhZ!HIa7vFS@ZE;u*uQf@0*#D7qfAijOON>H>UG+O{bN z`4WV2ntQ;SOxwN^QquX)lSNQ0gf4!s{XKd)gAU66L~^yDHI5GDM*m@)+5TYv{JDv= zX^6p1_u{*JR9dNtH5p1PsH-$TRR144+;Jkiv@{*0P%)=^t_+G3P?z3GjkNK#csz-G zjnYGRMsx7Ae}@mV(=fWZj6WrRdlPXiz$xVy7K4<0&5Qj}$2cc{P5p2`>2mYKwvSss z{*D+GNj-z9l9(XdHDHOcIDx^tn{Et4iat&1g#m$rbyXqw8%;>kc4NEha+-i^rG>`* z?Nd*8s}_T{CTfXs@TLnl5}$^)ZnscqJm^_s9bmH%x|E(9{Uf8rKH?UfGDJz=Mig!X zr~L^}&cZYm?Mkoj>6EMm&h-f|>I8sQ--lXB&x4|29&XP^l^MNApM(50)8KL)mU?8s zN1Ny#C9eEtPVL~ST~0qGhZHlQc37Nyb&c$;Oo*L%3uDjip~|O2_+P_^#qQ;M-w^`( zegxKTc4nU#^3V$%x1QLthY&EoatOcvTf(SK{WfI@5@)xn;L7+uEuFQo zNbqB)LjrFhu4`ODOC|nZl$>jGeI4GhGAy7a9?t0xX8SFu!&f&>;r^~}q8Eb;~ z?Q0|_5x_S!1-NBM*)xAj>iORUhD&{J(jU(4y<0@||F&;-75e`xD6*Q*Es-E zqY6k&W%Xiuj8)fF;4!d$l6as=5b>EFE=2tHWlo(#?)H~3F~Y%4=bT@Lel?TQ!7gkN zeShShX=0D&Kf!ADOI&=RQTw7ADs!nKzSpBqeL6&@xr0j*AHEIHEj-En{~ z`;JIKju;BvfW2-nETQrjQJ-GG%D$JJRfE zpebtZ2)%=+ce<9oZ^5%qoRaneM5(GPHS7orVDD(u#Z;5u^hcX1>xO`#D{7#CNb!QW zu1zPXxQi6+59AQ%4#!Y7{T0Zr47Vr2*YIhSM3m0mZxX>msO~>C-?!=!5Kia@_2yLR zJH%w#gpNJMp`o$pZic`^0pI7=rlgYvzf_urrTp)T)joK=mkhscw?y>c1pw;69{XUR zwH+&uhHE^*Ay-jal68}VoQ~NHF4AR(U@`ksMctFk%UWZRX}bK=H-4BYrT{uk%y6xm z`5#9aT~%eD>%AqtMzDSSXv=varjF2#Qv&jTCbJ@tbSLQ_;F_$KAo+F3)3rAs-?R?2 zmqf>Gw6x@LH@$9HBET{q2pAAJ5Cjk;5EKwJ5DXA35F8LZ5CRY)5E2kF5U^18f1CgK zUmX_w)y?SFxz z7mzoQ50EdAACN!Lc0Bg+Zk>T_6yZ8D5mza)j`EA2<;KZ*p_(L2;VBzYtK=9t;q6GGpyTJNQS5$ww$G)}^ZZ(Pu_qPa%w2zn!u^iCc~oy-twhE`IsVJ&y>BiviLHZc+Ww;sKc8AtVtV6_9#V`z#A~9 z2b{}cN1k@KK2&iH*SY(Hde*|#u}V0=pv91!=9n|v480&#G|3cdtv2m!$Nh#-NZMEy z-F^47bfLb37SEr2js2HKN11rkRG~_X=CC8+PYndyaD)OYTrBc?9eiu`nMn^~-OOCf znNytZs!*x+OWqWoh)XG<`INw7SA@i=oj`J8EOgtwmMqUvOB<+7&!u%x(^k>k=ls3U z^J=4{+CIJ?6-8PL!TWfrDvNEVWw}3&nRb2*c7Sw>38^UX?5hJ5vDs? za~Fx!Ut3{hzVhT*H*f!K_d)_9X=K`omZT`oig6`j6cEu+5Q;2<&@v6kD#!u2JfY;G zl7VDHtK|Ylm}8P6qvvMI9nCCVlL+7cCI^rYcz7?7cn`qMRp;4~P*ihkgC?ej5|;4r zD5{xViqF=a?Oaa+8mE1CyakAsTrc=%_+GM|XF6Us@kZR)Kkf}RkFo%|DLm*47Q^un zQRWEY2p<_M_1od5jN+B*NoW%)u?})RMP zv`CKwA=Ls`L*<*`{TKEpcHw|2Du*{dS%tuXV_IQ;4#{8dSvN)gBdw=syOp?<8`vG`FgCRwbh z);6~<-gU75+_c6`^NmL_)8V~jutlivreosBxm^=cdMiifh6P(9KB8iTM;%eCRR$SN zA{NK^6OJN=P;1v@0y-ndnB&Db)*YyHsN_ppP!!8n5}x0YLVtWV0szlfeR(;rP1ZO@ zTgzMo4c`}9ct!#pD^+KQcXOX0qP{;>q5jQq`>p-ic@np&9F7Ve3HtP$EW* z3AdGPLYB7jtUZN>7PB{75L)=<01PLD**pJNS#o34D+p_X;8fTgY`=i_47kZaF$;F zh=$Shw+8obxsFT{2;az!ZF{=KHWCOwR=ZL;=zRFL>SX&RGs0lvm=#iW8TCTP_j=R} z^rEV*#mp&5sg3%?>=K-EG{aOQT_m@MAyc(?*+4%uyP`OyfAt5&FsO~{O_^=g5LU|b z#5E4wR6dI#+Ssz5YE9@5$g@?Don$j=k#0r0@#cS{W6H{S15`D@E7p0BxrJHk%#4go z*m`ba1Gu5W5RmPdqC?==dTSpVc|Pi_Rwx zha}Hrvo#-ZS4i$YO(&pJ2A6$cG z0TXHb{VXI%YFya!imp{+JLH%f4!^J^ji;bYiX2}r3~7l}*piQM-0t_j{S>d4S&$|8 z^G<2x#wcK_HdkHbd4EOCk_SdK^`Wn5lEyv`{YRR>-$K}Z_=ksVo>NrX; zwDJNl4gdj749Yt`2&sM8o*Qx{)J#&XQ;iC{%k<#CCz+zbp@VipYuT)})zvFdb6XY_ z2RDm&!9N#4L)x)+Ke%mZF7QVrGeWDxAk9^l(b&*AqZ3rr+>s)qP&={`7laP9Y%k6*6Yff5$gYmMbJOxS`d*d`ocENYZxB~bp;!hS(bo{d z(IDar>PrmJ4#1}U=0=R>$8a`?n6>Tvh1^H5a6W*jAsqnh;spW)0R;nv0EGhmFW4Lo z6af?o6a^Fw6a(~s=Kte?+X+C4KuJK!Kq)|}Kxsh#*ZhALaQ^?-{Qm@S?f-x#f&Sm- z|2Kf&{eP1GKLMV93Umf^4s-!@3H1MU{=XWkELl(NkDxuMb}O1|2JOkn07lG0GgX%( z^!%dFvu`HP4fDK@`vuF&cGW}?oZ+RBkjZP`>4RDOq^z-jV~2#?&*8(~W3`RWW<=Qot+YE+~C@)XY@ zWy)5J4$QL3vbua6hNictl3*#{9-8MNJy>qG;cvjEj?v$orhtBKi z*M3M{Yc5oQeLRs9tf@V0?Bi|KP}-}1IFuFq?ovuU@72=>?M|0wyil9`5#H%UMex5Y zn0HZ@)T_GSQ0qxh{YKF^>gJ)ox-uCY8+;NknB9?^F-zq)@gRNRGGQ7i2W+OTLpKiA?Hha#hCONTLpkLXERN8ayEzfo|-Qhvk2 z6En--)azYd);=gE98|j0Hh5rXqS^D6SMASBYV$*uz45s6_<&TUZ$H_`FSQMG=@2d? zvhX6rFJ%0QEZWJg1T@Mn)Pyfzn*57j`YIe)+2P9p$i}GBhl2R_$Ig=*2}JJ`EqaVax2G5 zuUrczmltQ!fx$z0iKmrouQrdg9^BsV^Lb0Xm~xKAYbY@oSlILIXjiu$_&*^njN=(0 zEn$M3AN@3<_>jr9 z@k`X>Xsfs4=zG&G9O0}TwGVxJhQGe(rMEA1l9qkVW$4FKOUsuQK&rIm$rv6i?+M@G zqHTk;;gZy=v@_*I|7gWzR;I37;jYVgl94Yt-)injL0@^e%r6T7B5GpEt-uV01ILJ; zT%X<56}=GJPmnQsd1v|i*jJ+7q_orpEX(OWj+%?PE@7~04_aeaCo$#ySdz9`fB$YH zB@*$Q={kE;<6-}2zIMWK7$zA;#Rq(Yn=xY1hQo?^=L`61vD%>%-lX@vh)XJZczrOH zXzvUkL0qwLI-Oic;;G3Qy>48ydmx^ zdsiyif1kwp6uoH_c*=g$X8K`fj#jU*=WXu5ZkN@-P(6P;_)ToDgQ@#Ka$}tz&IMdd zpt{t?J893Skd3U_OHq9hD0dM4mSCAyOL90h)=?YbPW07`8f}Y5=`iy9w`qH=!eA}k zW+q^1KNyl2hahg81h7NvEpB>cnebkq3Kx2_(EEZ*mml+Cjz4h!&?%8=5=gas`V-HO zsDvkaB)I4qE*((rP9{)MwPM)Ih;+2;D(5$RI~>mwtGeEoe$01w6lrcp%bVkxP-wSIa_BDf!W{m;sYI45#9m3gVIyNmW=8)Yx zZOqZulI+++Qj{&@SG98g8EoRLN3BQTr`od>_=9H7a>h_{+Sv z;z_kxD|%2?o$~cg(+?;9K7qDOAA)RGCitDvv1Pur^RFZns#l4OY7$;`8Fq$5Xz1lrz)e{qPWoU)+3wf&gRh)=Nh@J(adtc) z?1f1%Puo1YK}V^y>jx>^?!-B_b0Yn^{|f`jW{K|j^a{6dMCA>@dK38Db_Dyl2MCqX z&{v*6vz8F(QERKhKMW76;+7*ISu)kJR~Iv&#nWpJwoR@uibLUo{1j`tPn1z`A&0+* zCG~&-c{tLe*e2W+a_$005X_=+gP-_4V%PfXAe%Yx=g*$8e5r}8Jbe!ImCKbur;dBZ z!D>=Rzo+<4wF|coVQF(ose}m#>3uroI*14<^ac}KpDa6L|Ini;#H}bKy+N2g&pBrGOyL-hg z=h$DZo#X`w9jUb@#&qUjofN`4#2L?My{AmPJ)G>$ebIX+Cxji7lYd!dNSj!_HQ* zd(P!-MbWSnbet^mFd%>*Mwaxrbw7FhETKY@q2jN8$eav*L+18aedTCbBaiflr5VEf zBy}Qca%1~8MsWt6O0Yd~{(5n0>Hw4f;rV*dI%Uw5aRoR#MH(S)8iqr&EB?Y{-T+_L zsj+ZAD!4TRZfCyh)OKefAsbd)4Ra(^I*H#b;REvMS>xNBW02{?OmD}iE@v!k;J%~C zOFHnLTjPfLKYrg+!Ustd%!sAc!AXMcNUtffGYR95t|j(gcwepb<~u{d{aJy{Sj%4- z4C)$tm0AD9y8*IcWmC4XuTa~ln7M1nE{ls{i_PC=CDf6*F!N*QG)F2zZ=w!;E|d?h zPc3=^!AhO;(`KvLifK}BQCepQD?86ejLn}!|LL5wT@qjYH>g??rDLzgGj(jN?dzY) zg{bX&3sySVg}S2@{x3`r2Y{~7R?JowsI;nU1>uEqZp*;_+t#ckXX)F`@2VdX+*6C8 zXx>bDT`v711Qh!bAdPq2uc8va4rq^U+jWJ>4Z7`ynIZIWGZga3+#?yD(N~Ph>jJTd zvxmEhy6uIzvGZ^r?1J9ryNw;-g}cG-HWp$St1Ud^kU)G?=_ zKnrtmRlo3~2KDj;F@v2-9wSP-j|67H8%GF@5n%^UTL1Ybg}SQM@xRjdBx1^G^MB&x zru2DF$JkAmG_{dsdO#8g{u6wH0idTijws8LnVP^t@Jhpe_GK-%3Z_pmH>mFQ&$hwH zgg)A2rY17M#cpDpoS=Zv@+gI)cC*-eyUm1}LGU>4Q$d(9@<{D}xCP_jH~?8W*yV%U zF51mOw4bHPYw6#BvZw8?xjo*S8q5mf^;yOq^?Y};3`iMCihySlv$Jn1X^A^Nm*etIy!*vGp!e>UQvO!t)F5B|5S)%ME! zitha5`Z<37_2kNKb74K$Qh%Rop6CQ zVXyr$2h}Q2)6bhm=&4KBJu4=$rVJsTiJGI=jD^fVnwnajd;#rzwZ_g0M&7*w4!8K8 zlvQ=)0f_5=UE=GmD=kV%f;F#4t3p=8k2ZQWW8>dQEu`#O6_|N(*p=#=tj~4ow9AK^ ziZ$&RM8)dOkDNk3c0)0Xkrl@1R>O79E-S1|R%NQHYXX;;w!KzyF)mdtSWDXLy6_`g z+_X9zfIo~S6)icog=SI3R2)B<)-CxSb8>#q@z+Ml6})=YX1(ug@V`b>N1h&`z8!`4xltj-e?Df5ZG2y4=OqCfivhn<+au=xC}j zK7R_2avxo7%wD;0X4*4dd%~rAbQvIAgIY!CAUXCI z-sK5~S4b^Re55>OPEx)L+th1C5ik+^l(Do<4f4nW(vuh->1HVu1JBS%cRB4(4&nz`|{~B0hqJ)7PCAOezA`tSrJWO`V(&h80(M9JGbj}~lGLd%_ z>jV7pZz0%QMc@)Ko-{53I4EH!cAsru|iUEy9B%eQP4Do<4#%aeOni9^qcfnwC-zs za>dTV%4)ZlLH?C>@8j8Pw!*%XX>B^iAO}O-=_SJ7A4mJs2TOSd8z;qGVaO^fU~^~z zt(_pT;FZ5rs%2p&#UQzLS6k}31z{X+<}q2bwWW(!R3>09);ENE@Gvqmwk8_Qk34d+ zWmA`@Mj1j&v-|OEax`!6C58x+js(&jYJ=*qhQvDa7c_b@f@Cf6xJ7Kzl61AEHG+g% zQ8!qWSdM<63cN&T_g}GJ#v|i2amfIddHiTwgrhMz*7!e|(>xCZ*;BS~Riq}7;F0t7ibEs%wzFX(6!6CL;v!+z5r zU!iBxi=+^^4*frJ%yugi5I-ib)aYO@cnJzc+W3E>r8-BLh~Pt`pK;BE&F~Y}X*D5g zqZ9yON`h5^KUydzgsiyD@sF=!UohB|W0TZuQq}>0V32oHHqW9oU%yr26@!_sX}tG6 zfUSW8+(vI)ufLM~D+!BD;n%#$N1z}7^oj9t=9^`b{I&);ifY913F&D#=a5gBPiX6&6 zMuH_OO0(>byxevk@vD#GHa`8MoBbC`_$QuMdcTpeFT7tG?e&Mnh0C`%w*%tO;&a65BCtez!1Ne$oAobWP7ij7_^<%%s|Fnhs~C4=9N;A1;Og;Wed{Q ztBcu-y?3oSZ!brjO5VRfqcUC?^yDxSQXR}0@lw&5`WjK1MJCRJj3G-MFNbbxtZBe0&6VB?J$)J zSx_NWGiXHHSVk#T+@cN!0A!|>`9pa)W|R6X{UkGp8nPg>UGRLJBbiH?>8!W~M=cuk z{azcK;@v$4{I%G%`Vn7cw~TyCo0}90IGF?Ommw5G_UtH2==EziPq*K&C+PB%Q!b?5 z%ulhm_rp4JSv*Idh3mjoVsYjmz3E$Ntcp)Bf71EZ+~s?U$=wraMsU*_zH(t^!s(6HNwP@X=5sv1kUpXpqm$JdQ+;k3psnE z`7Q#AN2MLE;P|iBH?IYHrmtj**Y0btIE}|rQ1Q*l?EV97hB6tZsa^MSV|~&`AVAy7U-=f zhGpGTvtNE}fp4GQjsb8`| z^UyHd%F2b|A99r!AbsWP98`@MR`;NPN8y4B`bh}OQNeh%=)F+jEW4?kJ9IFS6%C2? z<`)V`22j+gud#C1AY_4s^YOk@gmUmuA2i>HuB#rd>`HIJv@R(Y0csnaARJw2M+A7? zuAqGxB=K;CZD|^0tNs4ey$A01Gn%Y5~0e+xRH&hV-d#Dmlcm@lfo4_?GzKfyWEDq`UBwzS_1wa4A`uWtOMx%~ho7tjS@ zP_S^cMroa5SUE%xi*^jzUVSG^@Cwn$&b*xfqgMti;0oSP;6~|$DzHxIBE|?(q+=1Y zrzdS*%}>2t8#Kvs&ZQiIvo^k9T-Uh}f=1P6hN&yY3?}_i6H-5ZNO_(i`03{=D6i}c z4~Yf)LhKtX~olo_A{sK#x2faxiSN>T#H>DsU_6IV}@I) zkEn2?QKx&FNR&FQQ9-IUJbg%lq}S2uU#THHTG(N8vJCYX^Q>3CX`;>`Qw@(sU3w0* zzD6!Fq%}qgUk^`!$Ftqe7~0vy!h&YtVo48q?77F8c-93*;11XOEj6@Mq-d9Hkotrs zj2y<)b_@)&Btuy7mAP|%PpHZ9Esrq)KO*vO3P5S@M* zJh*ZnbV4Wf4EFad=tjy*KP30w*!JSnedwOywa&r8$)`Kq*n}0=mtaqgRpX8}G#D_@ z)_AA4#u<)Db1&*a;b<<(jF%Jg!Oi6QRGwi8q*MVANnzvd)+3FX^xOr8Kae>E@@F6w zws#n}Gsg0YqP&GNl1j$iX~p9l|z?P*Z* zI8|5O$R1b7u}?U+!{Bl6?mq}-cVF1E-f%*Oy@cqj|t{B#SV*gp&Ga!!Q=spgA zXM0>EUmtkMfUz6*TJB|vz@%m?+y!zn$q)vt7*Or*XhV74o`=1-k+iiI3LPFv@n)uI zJR)V8*Y{F-p9&c)-Q92Hx=fUuN$lTx$sQ1Pd%@kbiPk0Jnh-W=dkN9*B{@@n4~Gq` z!y7ak9Yq}IN(H&5vOD@mUj2Zf7=DC-KsV2)W^$nq`&1FwUkOmMSKgsK6HikhI3ebY zv7QPPQ)=R{BLIxS9N|6ns1$onFs6P(oD|q`9UxYt)x-@>>R*xLM>XtrmK5nIx*bSs z!5X-hG=^}Fg@E9HKgHpGggt=5)7fo;;HqzB3kHeR@DVYClcqPP4}1>K;2mxnG?6?c<3#!5{ri)#d-FFj|HGiiMeO-{+8xQEg| z0x9ijt}>%PxrUP@cQdX4^u7W1Rr_=4c4iDH6CF(~z&~7GN00NV z&L}@R>g&(~UK7CqBS_T4PMTwDeU%{S0fzujqM(e9c*rc&&9OzHzDk8V+i7o+ENA7v zSgNWxzmFv<2J8TP8Z_4W%s7P)|T}Z0jUy#W~-U%IqzqHm3igU6kSS1*yb@Eid*0DU{?nwpQrx z&#lvChu`pyHv9_!T#Gn=$%3g2XK1~R{F0$dcz$>;drlc_TIXkj%^rV zp=BYUD3gL~A-;|He)lrU-x|`Sm6E62qdfRbbRz^^bk(18sn%6%*!5~L_{<)IxIv`T z^U(oPIeT~nZm|q`tAR*7*cNpX4OJxMlkrxQomJmJV1{#Cih=l&6JU|bAHc}GV zC~P)e+ZipU0!t3o-puw`$nD!Yz4y(ec8RATmA5{1y;i<&Z6jtYjtjA>B?Ib9SR(7) zqL&^ zaL8Y0lWp@rQ#F>Y5*P;R}tn-1hzD z8C~{YIvA^35K23a>8*B^6FpMXjZ3#{*j9cEmw-Y|xRh)E{wRXUUF)Twgu@XB9`iwq z-n`_!1kabRC`4DMwe#Kbu%aP{zfk#StUaqg=@Dx^R6v3=0roF~Xr=O$!DMWC{as8; zaKTbGO#a71ACX1F1qQn;r4&M?DlK1#>G>Q6z;HZR-BlGxF$w5~m(e(Db;3Aoh+22Lz2xBJR-C>`kh zXN=}fR_uBt2*WtdaGHpdnEVW)7V8qzE6zh%vU z{0o>bI&8`w3r?dQdtFib@kKYT9M|3bLY?@PUcyq<(zN7)ZDBcKA`&w{!a1A+FVvl5 z&V8{~gJ7Ai!qL^z1b&vcSR>iKZ_WDcuk|!u`wJ6!&_vMU_qJ1h%78aG+=vH&n=Y=f z&8#6yzj+h^BLJp>rZVKf4qsDmA&}@cNy7*n4 zB(vHPr6;b4D7!7Nl`_+@| zeXg!Df1BB~R)}z~^z9v#%izxNF=(eq%b|^bZDlDG?+#fXQP*5?1Y&?6iLrv2WlJSv zNMrAdCJ8~(`J?)Y8h1$+kg{dh(9f7_3Cf%iapu*qyB=%v&@krE?cC94Yx|D-Bf0X< zR>F=)**|lui0T|g#gIEGLS<*o9)V@kNMqYDOA(OmT?}r2h+xOL52~}YB-i-sF*Lf8 zmJ(vRP!AX1oeHNw{W-oeT^olYg|9~@Tg$lBNKoMlFr1#!q8sdBw+edP!x}croz+^O4g#T+@FMr z?>IbJOZWsDtEvtAxjj>b3Fs4*N49L?sPsnYdxQx%$l0|)a%%z_X3nD-V**;oum?Jh%1Rjh^o(t?eHXC%a#mX{bYZCs z-r?C2t3vXE_Ik9p(h!`c(E_5JsV5A8&>WK6q@sH34iuUu9mSEK5zn7%o}-(r*YPgr zvQ;&q`DX&&j5MJ(*#B~~`eH655X3tLHLowH6je4FzFKo945GL5LfXK5;{?IPil-Kw zQRYvL=ZMbnm|(!r^i3#t7U^`w$CraCwU~2!yhi1?{wQkd$I4+QIWqF^_@bXB%YMN- zD7&bEx>W9_ z=xgG@(lK?(u)iCR>xh{@>kjIGXsiMGV2KnW;cfC-OumwowE=}t{WR5_x~8?IX3fCX zxZ|80`@~_iH;4WMP;&ZNmSzO#YUSLRyyqm$33H!7Fte8E(l$z3=hG$oF6a_JlvXU* zmMhjg+FOUxdD`6;{}$33us+vyg)h^phgCKL7fWgm@E>_?-IjwC(LHE^`D ztAKbR==h~w6K$KV5Q~+K;Hni=(&{O#rK*z2xQ~Ihi5iq<74$-Zl0L1;>D$@iMic_# zt684|d9PE9Hb!S9l$W@xT%|oy@$kAU40C%9kk|TpFanqUT=DZw)|2766EDStNBN zS)mh)i=oIFuS3gq&43amw`Pd%r(Ovr{Iuh{_dsTk8+wB*JmkF{QhKMSlD3m%*x4Sj zTZ-?b{N(6O`j2pHj1XZI6c%2F!$!b>Z6m{`ow{&N5W4$KyL>PGQ2_@gIR4s1RhGwo zBW5;Jr%@!Q8A|RKqW05z=Trm|QUXZ!0kc4X&YT zLSUa=gyb?3GU_I>qPuey8+=XO5-}Bf>BGqCPH(Q3`*J>;p<7=MW;?*6x%wCIymNURuo!jqUR&AEcjES}xP&Wih`zRe6c!Rm9RfegGfBQEvip5`~E z)i?V>*ctTHI?0N)_ez|yQ-WETg4v#GOWO!X!EVp+!4}31 zP_yn^pzg&dC^v9?$Bqex(e+?vq&#UDGEoR@O^1t_V9ir0N5X+TVZe z6AZiA?!$U|6dIK;CTSqEG!?PUg0i4D(p?-#{spxFq$LfVMcN7dbz|l_$*_3d}MG9j<7>qN=rFP~VGyZ_H_D7)TZ%A!9-GkeF%BkqiBM4O?^o zmK@J|s|~#}3>(!R9ElR*=5Y@$zcnNjbO=rT3&Jn{H-c2B?pRfP0X}Q_kvCW^PYwg? z``JA2+{qNv7*6!9zd1t*H&lWJovpJob0vH{g|k0kAy?d%_VurGARvRmTxds`9cc=G-qQ?pg~NVJ0-!6l|kCHpukP&YU$N5kCrg zag;)1WUPY=L|ng6Pe3ht?Dvy-l{v3vDeB4~LwM&^x|uD0rAUQnoL8kX2RWv@pzq@) zFpTr`lvv%?*36#qylvIsSPNj@s<2*}EMy9zlAF61@LvY<|buF z%^XN?k|W@ejyg&e;!o+(;%esqj_y*25|2q%uC(aLVjPUiw}H^EcuYT=Lpw%LB740V z@?4em(<%H=GNJqx1}Ts^BBx>OA-dtm7>su|<{7$U4vvp$znVWRovFR}pHJ~i=8D&p z{M>)sEsIBO8>2Y zdkn%m-HU!!HcSa4=P}V^PHF9zowI&Tl~k}K`GFP$}Dg0Pg1s#*fzW- zj-{hHkQ>&L@md%u^hXQzQ3r=Py*sl24nw4S$&_-~w)!Ps2K^cLSHlK!v2I&#c~6+> z{{cxrw!b8v_)zbOjBU)$9dz~Mm_{yl@YRp$cz9Slr55M&xJO$T_890-m{s||Yb*Ax zZRP*ZZD~0dA>{~XNYs`?bxIno&76*y*o1&2o670NRrY=mMne27%(RT%S9waw#1w5W zmq^coc6*SCGFj=ae+CK$TR#tN{S}|X7z}`_iWk75Z!cMiw?m;uxCMzWU&j;~znEXvnF+whR({I+e2;Cud|R=j?vq!C(=;@X>))^+2xE;x&bR<-0& zRCf2`xqAp}8y=-+zGoP?GztI63pIU?#=VugF0o;#PTu}X-@`mJSvLpaOFPB3F_$!E zo7msJT026&@v5dqnq8I5J_9ku2#yWdDD?mOg3+IrV=w}imT;Py5=pC~uly^-+IykZ zm|>oNv3M0_yXf6)!O%vx{|cv4i1+Y~PDH2mBBbJli-P|%_SZ7<^*zM3SQROmrhnDy zUo-TtrTW(#{cE27Rjhy6^{+DhYm)x8vIs{9BeF5VlSwU?l8D{Xh<`r=K<12$euO5i zm1VA`pZ?3B<&$c3&a%?CztH2D-}jbBq3pzJdTJV8kXFQQM96N^y4~=$D)+(^Qcb_O zZO|Cq#I9a^4(p}W5lzDj(Eu-*^k<*5OK~7On+?e+fiRqjPYXskJ@~W*^d3 zvHONzqbJ)jp{bL6En87}jBFq6iiM+56$zK|&6k$e#1oC|b3$Q;g zwiii*Rk0VjpxuH6Uw+zYP#G<-vO4<#v+P4^68vxD!ad_WH}bpSM}>pd96+kW;?#Q; zgP4IqN*`n2tUkuCwd@;%mi$+d2te($+*?FwgsiOh;6a@w7$@Q?+KxK z0h9z(g3uZ@)jJN421%0z7Up}-J+qqx>~r<^&+mI(->YbLX72a7=YBco+~<7G=pcrr zQjR0o#}%Oh8w5Mm;00PRm(hCO;0fhy zC51qcmhQv`NKmJEtI%O8AvZ(dPHYLxq^L>;VvL#sY2e3K)66tAZw}a3 zm9+`i=qPNJwW0ziphRF?uH1!Ixe*F25vP1RlG7g`VH?SWlq%Nm8xV9T9-|=I|ehm%Imh+6Z9%5(y0Ffle9F)*van6PxkuQJwLEy9%&dZ z2`ypll{3*Ng0$4?Ji9SoTEze_eSV`=*ryj-<~Tpx_&N6Oy|`L6VrP|oq4v}3s86zj zY*MlPxLn}-Gxm8_ke^W?4G77Q^3q$$tdVY^Pp@^PoQB#BI!Tw=m21}NTGS?vo)%@c zkR@N>>djQ_!n(fs96J9kWJvP1Anr2#KHYNM_%kMASOoJd0W((o2RDB8V2jnb z&)K<&aX5IB)T)_aO@MAf7AZ2eyz^8U%FJ8wND-Pi@FfiZit+C_ewN>df(W-&Tz;Rl z)Py!}4ST7;4k6~GTnabWV?66T7EDK&x$4!zS_cCWG&&WdZ#RAn?Q$Ni`c(2qBwg-L zpbMqywdl@kEmA#lS?&`MM4#*Md3o+nqtD1{$%}G-9(|^&Y&YbFqR)@u^UU1Gqt6I- zASdPi44>oRxd|7y%C!MTIa(@Kua)EQC5x1!k}F&)7ThOvDpV#%sj<9L4H+n0I*R013d_d`?+v;7J;d-kcy@MhiK_PC z>z`>nM8BT9vZ67zM?i{6759zOOtb{^+vW9nu+r(UOxg?zhl&b>%7=JNexo)fMb}9f zmRF1&mUY3C_zYVTqweQ;_#0EX=_9}DhcTyF^*#0qI!K%Iii&>C{fLOWC~TQ?kP04I z@-ThQgXcBy_KLZ2Wxfu9^{je+xfd1IS3=uh$9w}BA3n`Xc1)m4p%}+c4izK^3}OKz zT2_e#cCo-DCrY=8)r`1EEVGMcrn==;!$h493cfc_h2#^e(oH(@)x1g*N7FUtIF!-dv7FZ#SV&MgpX7#)8D zdXLjvCIf{o*p%>E`imJ9{ zEUFqps7Vc|Y2cN9jp73z&|cD8R@B!13%a!nxwnh1ZZY`2$nT~$3@swxC-VD6{w0xr zlO#7Qii7Xw=aIM*s)mhb@vTjs4Qjh=1cQIatfwq(asW=8tnr+|}nw%^eSLFP0 zMP7ATk+y$XWG&lp6$0u1ovlY8i>Aq$UG+yq{*cJ`iu{X>#b2=XU&jI6Ed&qgME_p) zu}|QsY2VzmoK>4AvTyHWn`@td2_^KgP^t--=N9(u`qq~qC=k~gHkCSCMb~5OkI|2k zlHM@wi9DU)?o&j*k@jy3?P%!qHwQ}N(4=agK+?EH0x@#)1j2B$mM%r3MkCv>5Y2v`K^46)&P`UU*N#WZ=Xn*2J5%*mutH`AzfM5$2}j7q|&wQRiwuMe>G7hx;S zd5Ena#w*X(e}&gAZ2jkWT?M-jszdXSp~4Q^yw8Kf{;IiDsjA8KMJYE;a(9RLL*y(F zb4|v@^({CK>i3}{nHtdt5d+)I>h}w;Wgp*&LgIRv+Rb^{$6r8Q=6eK^&)ML6<}F3d zy`^l!-6rUTeQ6!8Mrw3h`~|#po`dfT`A<>kanXNLbZuor9n`R{4|z8#Y%Cvfk@*bI zYrQG2*8<|S0Lk4aoK<-9Yp6L39}lB#jQR=1;7PWAHzF%t1UB(a{XlYA#JFkHh>1YLU;rF_@lJzIokE>*vDkFf(hTx{^YmRj_?5v7U=JDvxM+N zY{Ow{4@zpGU5Mz!EyMmp$oD+yR&~si-7n&9#nyjdq)F4b_;Sg0s2n(1Gh7kamcHSD zXrx0n4~m*VWtybCp^Ft4Q+p?=#3Xbu0}sLjpHzG9e!ft%vz8Y*Tz%C>m^F35KGaI7 zo+t5rb?tuY0j|x6yIWK77eHvg$W4Hk75S}FuN()tF>&TFb{`|UYNf)6=&GmsW_%-z zK?N4@;QR2fHRP)GdX%g*gra`zE6UhNK_cu=sr!OjAy0?l#!tbVUf`H8Rk@m~w6r$( z#r^y=7$(u^IT&3Si+0ZA6R^WjC;=nYJFpQII9=%55Wd}R`AUIoV(T|tphKtrGwgm` z$L^tndH1!tSl`>IoUjWLG`V)0irQVB^BY}V9j^VA4uv*XyZ-7y8XJ)Uu0^I)2F!m8d_>B7{jGYuHJ1c zJl+zLj%d=Y^M$hx(Z5v+OCMDmjqcrzNz3I!p$5#E(Oy8SHi$0RVNP;)p%g-Tuhuc2 z%U9edCHKj8{ro)n=4Is&V#&*MzQ+$`xK8$jDx>hXWcYhC{QKdHSow*t zb%tDryuc_f9H9)N!ta-Y7#4DOk~<&_(lMp*5nRN?vnAfZe2627YGNVyCREj`eU!asp^gfI>H3>}&Vx9Upy zR(Z1EKBNFa=RWDdiaL={#r?R7wt&MHq+x_KthL}p9hZoPK6h+KR_sOKf&F`%jP)&z zt}ozIxgV2)?>BW1%mFTl+;jwWV#c6u4_poJF^;H#nJ$HfV&I$2yHH&%Ou;up%XFWK zdAd6q^K|RrZ#VpX1%JcvHxI&RH|0@ZKNLRmn_rVZb$^UM7uSG#P2y!{;y};$5=Z1iuG@d{SgFg~5t^uOM znTy!i!4het^>YJ-sy4Pe?A#I!8=Lizsacwr5u@Vj7nJ0xIT}E=MfEg++FlyQwT0aL z6dE5;mmDdULiw3X#Tb3ZkjK`OjE_*trpgCarlXHdQ^OJN0Tt`AzJ;G!caEa|Bt=nw z%md$nc9ckGg>$BjH;o(@J~49EjGm|&6F)3>cJ>=pD;3RShJ35jcS#9v-7DKk!GYw(e|;*_BNvrLhDmLdVVz)sv0x zan=PA9Ow;&W#=6_rm(RwbYbQM0>##M0Vm0G=}H|d2|w251; z2Jl~-b)$}IwTq;uCT^O6o6xG6w-G5n0y%H4@8{B=rv`45pGUz2XOQ0w<)bl*DWkP5 zlz%aHcOiBc(e6|=9G4XhL}0G7^`Afq*><-6I5lu!q%1oO0{&hYRvzU;XB$5`iUu;_ zT@+CbyhSxUY|ijz168fAoJ0;B8eL`wohb(jc{i{eG_krI?veCX`hI0IV8$3qD5{1V0ID`}BeVUdl{ z&MP1q$ZpC(M#wx&GLTOt6%jd+T1_%!dnR)6^ca_IMud2j4x&!i4&30IU8_@+L>xg0VY20xn8>-X zVr?Sgl>aPCljUYsq}wr|E*fxEMG6hr5Dl1EkxT>DXaT%YIGiVSv=XDxmz@yCJB!d4 zm(Zc=Q3<{-+W2MtvzEau2Zo$jbW`0G02RsX3dB)rkZzXH5kG`9o4Xj zFrhm13>9ra=wT(WR_c{HFr%;Hdq~Ok!i?GmE4XoAYuFH4V*Gj=5`0qYHh~n(_;7`X zbmZuC&;l1T`J-(n=+{1K3dFGHx*DY=rRa}e4Y$eDbuq=-DNh1$o3Hee`}kRpAw z%^05i5xLfh98}mt{^Zoanbb4qj>DQp!4OnCKI+A2RK!F2#z*~Bje-fVjkZ&C5y>@( z^sdV~`J<&mFilTs&1BK_J~T~qbwg7`*CB2iL@E3X2Os990_o);e_yB;%t)>w+ES@Q zI=bfGG8N@wy@G*{r0Ux}2Pf+T{!QEKy4m=WLMm^4^-5p@BovqJ^? zfZhXK4*6zSRlI@0&yt5bV;a!I^5ll$4i_TU=s3o!@U@sfQ)w9HP&%-XPhp#l9`Y#d z%2MI$JUM|ZjAa*s^+4)*$;_XjNHs*QAUae^@6a7g}+rnY3KW~pvMEz9HeAqn|yCTuWT@d+~I(sC}0S= zBSjUsI4B#e6jbZKsk1>m+-zr?U17G_eU?%S@>D1l@e@*QTs+%cn~G=Q2B}Re-aUvY z-U!*EB6Syy1q%225T?XENbbZY^Fyk2+a%3E{898gS2`f6@Zipa{2Y?jF@DJnyhn#f zwm*Vz62>>lY>_J*ek*r0dm49V2@Dl^PLqvoJ~zDN)>IRB#lnd^)8x@FEYfr6mpgkp zmniL%O$#RitCDT!--o|swpl;CWIm)e=R+a*!|z$sq#y1@6HB!&6`Z^*`d(H_L|?19 z`BUAXA^vD{8Kg@=b7W6T;4#1W6CKX1J}MNetsFamOk_ zWlO2ZDxA|7SA7@8L!Uv~)d|a8#x7j+oL>fSm-3U%xYkJBb)V7|3Fzd9&36a~BDeEN zups$IF2M3*L;H?xZ_z~upRW+k>-kB-!`9RqtCVk7TVjEhZ29ZBmb4v;w&VbOwFg^_ z51ueea?_L9wbSx-jZ>SRym2es6gK)y1%hI%`n=teCbXO2SIW0;3rtueeLQmh)%gX| z*MYT$wnmHLXhGxD_5wXbGuuWk29M1gR9zTs%&#P)psg!X&`x*xrlG92&JuLcs>^RaqJ#mx|^b9DTqfIcvt zocKmPQ4kAqIHOdZgX1JHy@VXUK!*xFe(b(Fwl5|l zm51_vUOAH-Xd74llvw!*P(E3ar7h~mv$W+|^MTtnx~P9MKI&N4=%Su*%ebgFyR=2! ziZZps(u}I_Lrc!r4jFZoYjLTEjmve)Gvj~{;Q(Q2XmP5pfmN()M=;FRZ=@oqc(qQp z{<|t-*tY9jr!ecZ;z1v2iseFp`i_D$DhYESgYP5Xi$z|q7Ku*rUSFWLa}Fvdx+2Eb zZLs0(6J3mC*(UX79ET-nMvquLsFfur({M;B9e_5^IDm#5Jtcvh6<%^77t0qdL95V` zBed-oiU$?Z0&xmI=p{Fzht6K9zyujfjJ=Z&1agYJ_@?b@wgOWyaZJ7fQ#9jnj+&8) zWwfgqLs~`#GunkVqGn`D0(P45E%dH@OzN!3p=03|slXmu!o+P0!~r>@M`J7mne*9e zrU@;xl;z1{fwiL`Wj*aUTLOh7)Gtrbu&%XnT7t+~?o;Ha+o=mdiMJwl2xk!IJ4g7r zWOJ*cXnqD%`lnMnj|tN~XGmSC2R@|zpUeT(mTai%g5UI-HpzX;+cXo6RIByEYpU~z zEAY#*&20h3L%y4U8^S5oZ^lni{|F-3X4CCLAG#VhH_a-PJ8I9*17gf=H^}DN^BKGm z0)bL!Xki~)rdI)z>htJLI{WyodTJeieeL=ATzrQs8KtE1f~L5fEnH&GDjI}>L-|U$ zL4lw=K?vLU$&j2+qNz+dt9Vl(R`GJD%JpU*8Nq$zAiKx9e7M!bG3?t1(bxO*a$uW) zYi&A6UA|9);LS#1AWdlPa=Mc@O@kIQ4p(I3wYRs*TczDIR4n9(O zEjj)UiplJHmHptLpCXEEYjWAs4Z~C+!q_e%wSaS z_9m;nF=4Tr9|`>g36!^yvS~`zH%`o7&X1^wAV3MOJ&%-N%2>R!t>_cJgnHbmG$~Wk zsD$Ai9Tnt%O*zKKdh=Fjejc!RLrt!x`j++vd`{ysLVgM8E}-w6otvj-wB~t2PbOki zAZ-O%M%6H_i|LsS-wRYkCD2)0p%PC?h!)_XzJg~^54v6mhfr9KOJdO_ki$!+-hyP= z5-ov#Yyx`pK@**(UIf!KTi88!xwa0s>ba!ayDX`;rpL@!raTdyuuZ|BGz@}L8XvPz zLXK&#r#JNVT4i_W(NroUul)@wd~{vss+EdsL-k1*YU~c(lO~*>w%J;HR}vK7Q@bxs zW`%RpHYZ^~8U%cq)@YNB?K)k)^YF&MN+ImsHAu}~{5evy+f5X+$XYQ6WlFEWwnu`! zC{o-(eee`+;8KN}^*ZhfX>$eD$4es-f$HOt1N%`bmPr1mBdQm-xkBXoomte8&n>Vm zPxp;ck-Mm>$oa_rM^V~_iNwMRiKd2ZK2?D+DjT9WrazJReyCt~yCxPw`W3zmlCO{b z3O?q=i(=|;SEJkA4l`b{*OV!9phhGaT^h+K=Li=s@RP=>Bm*N72ZSERCAI)QmxkskbHz?-8uK6P07kXLep*<~M-&BC&q&aN! zBGgxaF6e8jJq68VmN-+PG<~5nT=}IGWC{vu7wPyO_zH@vPiSX^V4n#J*f=0{K)X5? zBdnK>ybMz~U=bHvLyK)8aR|z}r(C)zzg(Q3pO<$Be?~e(CPA+Z`~yC0?On!HQ=YT6 zau~|4R&;E`0_eif;+d~q#1~|kyk-1ZprgoYC=`kmy^L%WH!-lh{0Ns9`4vYNekr!$ ziHp=&UUElN=Iq9wDhfrZT#5sE05(HBlO`{HfL}-qo+Ng3wz;MPz8hTyfy{6&HnH_3 z*!gKlb^RCh@&ODbTVDWyuc2i<3~A~7ncoRl>%7PxeRF|&>_dPFwjn~Tcup#n6|qr1 zQ7Wj&ZPD~bPvSfg%PPE5E{<&F*l@uH1KWT~PQzxLU3#|RZz%doB!Ao=okELEJ6~Fj zW+Kea-SleRxpy_ShJ^tXHV19x(p`&f<)YQ~90cddgvR9JXAdSe-DOW{Z0vJm#DE%s zV>$?{jvbea#zwLn<33mDtcx{!GM$aFhF?t^o{C{!3v6F0v_`B0fF3 zdt3tFXo5*JfzpiSkwv57nU7E->qlGEj7uP6p7bc1hRnN2^;IT80_jmySEXRh866&? z)L~G!_H?=q3&Z^6^E#@78hZPE93FAG48Ft_j$PO)p7oFmurVmNl6UH`&VVIU?YXzE zCQMNMccK&r)h9sp@DZND1dfLy+$5>cG#dP43>G?Uck*36@Kg)|7etbw5&D6E7LHaN$Q09XA1nX7stu=H`2)NAV5KSQv!S zR%nh-hFKxleEp?PpFfVIG1+F7I-hz?8z6aS%bwe!J07O$YY=|kO7=t&g*LKCvtJGa_ z_gktq{jnBpN{0&8OH|F9Drk*SlBE->6_UP>Cik$&jtZ4*C{%j>2`W?yE!NXnyqT3; zM0MT9?lG;BdC||b1{nr76UoI;a1sxBI9?MFPik^80YjrJ+~_~s?mDL{l_z9&HTuKt zuCuy)C<#SR$tZmSjzg;A%J&qJKZ$Tg>fu-l*|1xMlqw!=L%a0hK=mk*D!4-BCqcH`# zV-%+G1&Z`Flz1kw1mbs$c*gwTVzuAF_y0)NYG@Z(E^pR)PoY)u^e-3>uCB@k4z27(?c&x4=u zd*G+?KKQBL01@{?Sj|HaR zwIQ?bVloe891uQX@v;plsdE|UgfCdUNIeP1_&X%tCcP(oQX{&F^E5X(5`Rhx4nl%6&mrWY*Lj%F8aXbs+C+DMv?ux@ z&dnGh0CE@i!^q8W^?Oznk-K6w$kSupCiS!q7|#4og7z9|p{P`huQ-ISD9j$hBVTe5 z=Fd*Nje=0vy}pvn69K&!DF|qo=pQ0o5nKsK6z?2b&6QGMa`QJ>g5V~_jI<9?s6L(b;E_3$+Se3EB}>R^W1I6$)DtI= zkWKmNh8FhimJ*8J-xGFz%z5h0V<&UB!xcgMufeN9$IZm6Nyq2bE;H3iNuj$YrZ-Kj z{j{$30Pw`}wc|q{sXbtjN$qz`HFDx;OzoAmLXgq%an!MfoPfPCTL=555dp;g<6Kx* z{CWIw*elI+2?|VIRn{gY?uP*?GN|{At2Y9q_{jNs9F!=U+Vw~&jG$}&96Pi}H|U+p z0744y%HtAA!k=RYshO(luhb6ZaXVMJB9h)k(s*1mek772OsF#SC z`mZUCOU8LvME-bobbN5Lq1Glh)5yqEGnK-Ukc*+!O^Q|L2u8Sgt(Rmbx*My?eWBvP6&_4jq)eGlOXYr2 zPS?^1qHld6ARpCX#v&;{{8{wi2nCKOoM*Vn4!?~{%AN^JGsS5&mWy^6NwB)mO?{9I z{+N29b*xI}XQ@eGLupPb7n$*=MtSl9bWqDSTRfyyr_n7zWXKy|q&}AP)w3OLTUA=- z5j?5?#l96VbBla|cpzJ%t{WjWw8L$4(kvU(vdi?`45&t`eUa)Bu0sx8l>-cv;$G=_ z5r;1NmmJ#|9Ni14K@F{`1)WDi(EM`9IC{B(+J0s`$%`?bTFK9;zs`k!5UeV4ARF-=KxX%Ik}v^&_{moH)vRhv*^)5I{#(BR0tH&acanR9=4EN1a0LGss$9w zc|MW{86@JWU6fnO-5AgplcmQs#f~`c4qvf{*cHuZO4MJ_w3k)-sKaFZCk(7N6r5^9p)u5cCi#qpxcxzteNmM5#HkD>&NvB#)B8Wq>J&1and)ixp(O4VQ@TR z54aeUI2k5l?V_uA8>Wi9dKLR*O98GLIZ9l^5ssm~C>C3rX0pv~o&w^Uryf*HR^rf7 z12_=3waKEmtd07D`V$l>#Kzr>a3=iowdd0~bM5(f{x?vPsr`0^g67sPg0VP&urHRJ zG|rS0&sz%QGt1@AXhb(XcV@7GF13L+MW1lBBw4fx(mub>6n=4#_eiI`6wNx43H0TZ1xQH_s^;Q&&8E+|VL)9JICm)1 zHJFJeYjJPi4JFG74bY)dduyL9VNj$HjUyk5Sy(|CLYoV-2a!T=JA^7GE7R%8I;^(# z;uW5vqKdoTjA2NsoArLg4OlDA)=(wqORFf-VdgYxgH^bAk#j;B3xsnQp&!4gydkup zGPL?to0K3fwF*B1GVc%-#Y&4Aax-i;uTi~fcvu1t@=I$Urz(8Hemey}MqR&r6B=~v zrR!8Cs(VUHnaobIstQTc3OfRZZLk5$P8O+)r=O;Q*ANZpi~(KU+yw#GDL+V2eqdLA zFo#Uh67DnU;7fU>FL9m7Jc588O3%IUq1vP`rPEStKu;dO4wqGk?Sgnk`5ZnUbP~F4 zsW=1uQbgu0M0MwTk&|1W&a5b+YQDQKY85a#4cr|D#N4-0Y1ff@%8%-x!0kjtf0)A6 zp|hrn1qA02gmuxyDr+KA=AeAIybO!X*zi!y)o(Jn|9!fL9KH<^p|k2o{(w z4>_R5K}?K=Lgp>f~?7y&q!YMF; zspQLz5TGV8u=NNs{Qo-)aj;ua;FfYH}j_&G2Sac8z>9vL|;_2MQ6 z*FmXmWG#euO6_FdF&X*t0Ro z3F$U78(Al$t&Cru0TDA+rYC2ffI9~6tRo+d^a>y8qyy4X={VL?w$G-6+1!b<`RU(L zNqoZzie5mn*P^EQA>6hos=Xw?Ry=WV*xwWGSe)SjRuQxOg-@U2qG%TJHj;yV9qY>&8oxWFoKxBAHRhoB0nmn=v_rMx9SKpcg} z`=|(_p(SXBqU4EEK?;1=2_E8GhaFg*B34@|peP<~5ggR*STg#JXu*vdYL9MHH#|Ll zo7ytk1S>QlkF#P~u71+>ETTD(UH7YF+DC4<1O|pGaeM&9`^X3P#}-)=9(;iZbfm8l?73WOy+0b6r7SIEU zO7iZHN{x6s>DU@Opg2r#slwkJt!!JY?07T{LC|wHIt^dlijZL~l&OQ!%*=t&9LBvc zj(lgQcIv8ODw4-v6$gXYZvNxQ|7R|Ub8KTP}_n#R+Lby zf>Rz+!cxsN9Cj#{bw%Xq=q0z|U3we{&+y~EP~O_dlp9+W7sKuugr>Wh@d8{fIky1~DhAPM6L^1tVH3TJtad`OEN1=wEL3cwiO*PK;?x!_9^phSkV|>(tXjCuI+~cFB zsZqo+1q(hTroIR?lyF!Pb59|1VQwG%R#Z(xg^cOw^#DkY{Xhm+WzXcc?0Bh+QmI#Z ze57(p)F}+A97kh-#`ly#(|zRk?TV7;AzSw0?z>ZsX6tbn`Fun~HN!mM<1w6YMD^AU z@hG8G+xdg1XgdecsZO-?L=XAKPZg#xph8!MBuE<7Xi)X@GQ0ADcZA>_824aH4y;Ax zj?@Bp;F6>%D>3j$j&YwF{1gUH-?2+Ae4^++nPFZT&DSei)DMEJjW=)`!Vb(YsW6qH zrWSul6&RxQk7FJFZhiv9OS;BYx5;tpoqbHc4W@unu}aHH^Vl#?0;bF}VJ1eqwRgDQ zr}C>{Klz%vij;yU$#LzjmwZ6)qRZ=lQLE7R*@n+hx6SAa`9O;;2?s-elO-pEV{+zKP04Z8Oe~PU&O9OU`(Zf# z8cD;p+C>ZbY{;|@GeIZmUH!5dQpOcP#`(d2V!R#VT^N69q{H8dTGsvS+ZNGv68igU z+F)g~i8x}-O;(%BZ&j5*%u*qA32@ZpGZS^Uybs<(6K~_rBLuB_lrRQuz_xU-4QJt{ z#+o&Xt|1_dJ7SiNvqC=}Z`sHtq72g@z0|TIUneJM509-tV%-}0F||Srtx+@+#lYG% z1%Wu!yJ_1t0(({%l?A$`k3xl`wusWP2aceHqOslB7OFSQhK|F^fe(GKB`#y1(PeiQ z+iNT#&T>{Z7zc%5vRMTwr@kD1_+BS*_{L(L@296K3U~zggrh9l&9lh#SUt?AhF~2-*FFrVEaFz8s zdR5G{Xu2lFfSpHiok@maoH6ARwJrxAp<>RPaSty^1_E!fa|*VXw>qa_QL2wFM;0y- zZ2ew(8j!UWANH7kPcMnTg^LFspVO|-;+3BQciZ94he6L^&xq~6 zVdH{_6>4#J;p)0S9jaNP73k5f%W1(^z}?bl!FOPgvN_o+CqMCb< z%}i%c^-O1XaJtln`>(URYS`IR^Nq8+nsN375gd+4g$&GfW1$IuCBT^LA))<@T(M$4lKRGs!ZpF9dS#e38?c?%xE{37zN(n2*OwMn2hR(|Jce(Zn`u)02(r-6zJQ_d?Woo7n^RYc{hemD;pY za+9d#Q8KDD1`J+u3Xkm|e7{vrlblhc`@jp7#2aT@JMf$edL!&r z%e?7ZwI%QD(~b(F+L94qa)9a4mC94dHIGFlai}@7nu&eMFh*NeI-6)n?{2tkTPnPOL2Oh(MbRPvP3qsa*!W(+dW zy*j!2D#;CNqHS5Won!KVG#wVY6xbayT9-Oq$w58rS;;#vJu(XQFF@f)7VXrmx*86m zNtr)Q^oMyyvH-;(y3(YqD(c_P;ZH}kwq*7fEy!A#(7igECZ#DKA}7e!{{*eN7ppRq z5h#D-t)V5iF}diwee+~88=-0U!^WJ_p*wU4?PfgWH4i`VD8dz57}!#gcO7#0 zhuHdDp=0!j^E~&r zjyT#Y9kf?IU4B`wgrQdyNVpqb)>}dv_iFG{;S&0BhsM{4T<>h?oRBLF{ewaTc(+sJ zR*G&c@`KRok-yIvz8bQVGhd);@$_g{jw;_OQ&Q;h2@EAJ9{Y0Y3RKQ^4Z;|-I$U;S zCX6(wJ+!V59R;G=6nVJ}wWgx_KMd9XL4i3x2W}NUowj9MU1T2J1=B8328yn)2o|al zE$|Or&n(k58782!xqW)}1yj0wT7qw=G+7|bDzxj_ou>3nr$Yr;W=!pDjBPVoHLv{f zIIH8|{3L31Y(W(4s8REkdvNqnqvj6opv1s1adwFALHOV?)8+|3j+!>NqG|Jlnw_d? z^X8|$B^9-qpXfbB1kb#sPNB8nTaYu**4oWP@iTxC`8lj{8ND!QF9pyD<-aa{v~7il zG@XSM9W#ywbZ^ua>2+QR+KeE@!9inqV(}1?sx|H^Q-iXp5Q?emz*Y#wL(qh}PpEyp zi+R|*Oz4W_^NB!)mX4eSG89%lhFalodyTdZ!}5*iF`s-hO7yhM(VP?h*PL-tkayTj zkgXaL3zAF7%g6^QVnNEbirPP2RG{7O0DYk~I-+|W31;5>It4>1NC9rqal0v)DD~z$ zQktsH(U)B&F1KZvngTjhsdQPrcsetmtipohgceijwvn@$C%hHNF+r^*qR&p8TCL2s ziow$g*18O8_0nq5x_PLCpw~yS07AB4behANb zfM`ge=Qj4(xlQtBW@8)**DLkQGml8^ck^-DVa>f|Yk;ay=Zm+5HrEzyl6AC6Hc>q! zf@TFLW5uIUc8J1Lrx}O>f!S$mmq6~*(!R_icR##b_R4YvQ3k~(T@ zZP3~zXsxx9$$+LX?AM4j1_7 zhK{Id(Y-ti6Uqz5?BxN&s+}~@Obel#G+GJbCf%XaHfch)db_$w$I+$VKDtS#;Sz46 zo3wRwleR}UX(X_!bLx~qMXA}mVC)86A9wi%ZC`fTO5WRWf_orjy3GUgg0xWWMQe$s z`Hfq&ojUxOh}(#luEI8TQ}dE#pQ?MA%mdBtPf;5Wn^+3G%;=lI;!5J;)lH1TM;AI_ zt)7WnmkqWqE4~bw7mqsuZeC}&lOitnW7d6Gou?$D)aHy7Mr)v%cTsDg(7IExMgGvL z%NBXF9~b#_y2xL)!cV87=afrUc+E(Ptw%^ArP4%p-w9<@GUP>iwUX!P)ke0{YchF~ zUhU*Dyxu|@=wliQ(rY^5>2(hI9=*;b>*#ep@zd)9QcSNY#7(c+#6_<;B==5iU7k{z zM{cG;OUU)~x|Cc+uXmB@^y(p#=yfHTK(DKafnHaWb9dnNKJpE{t|ed6YX$j~Ue}Y4 z=yd}*La!V-K(AZKK6~3X7LWdkL~oJk zBDM4uPtyrcZ?{rx8hVTB17r=oMa=`UlHMXeK$g+lUDW=M);+f@X0(| z+8xvhh{d3wd4*NpYI{wUA$_A!)$YY9S3Yq%z%^bxLc2;mtQBqG&E)zn^a@~V`~O5=02=_|LaUyV8Szmv<149Er7}kSBcmf$JQE$+MxSqOF;3njz;ssF;H1`O?y8cnH`hN0dLsYJ3&usC+5)A|p zE=k*0Nu61!vE}*o_IomVxLHNN&TL_y#aKTPixEPFs_{WkG2{u~JK{o9VH1}`%IJw6 zhv$Om7y)=c@-zhP46F7+D#kr^!0F;1Qc52jFlGDJWS zc8ZkG2;VX3M1326)PNEGuRsWaipW(cj(!Yr3DE?gEox=pld_gTAcrP$XiE9v4x1V= z8d5fXshhrv>a$xV_fS)Da{WquDnFA#V@w*S;eNHtrulq;p3S>d)!n3?JOp&)w~DGW zuZ~5pucVl&8?OCF9<@(;bE1wqy2A6+%k(2}rmCAuBbl8f+e`H$ZIWls3dxhcf+SPD zO6D^4NEFG!24Cz6T&!6Ck4tquJt1JdRZrmPp&NBQQOi@|77A7Aa~00w&I>K5 zl&r6cccoiV&9mxNla9Ya)$?5PDnpj(w3{_J+V)_xHJ9R=qGx8yT8Tc_J#4}@0LNcs zl~!0CMGSAIuh!-*dc(dF#lG4NN>|WB<6@KeptZQjv#QizdM|pg>K^Nz{LrDI5KO*| zPT>>Q*gB&tp|y12`tK@AEHo|}n*3eV9e@=J&3puI<}QYtj+@VoF6!uDgu1aQ6)osH zp}*&{hFm?V?!%(j#SU4a43Neug7! zJ*u-85x>!1l2S)tP`wy2VR$sQ(Ad?`#kGC#(X_j?&62Bui~hb}phTd&mTH z%-5aJZbFAR{0H=`vQ4stmSpSYA@ww3l(-C7Pz$xfWTVD^Xb!AQNmqTJnNhD}0##DI zY9-c7Nu5vbj*&VGMvFnzA-7$00iTxaMeskJkHP^`9@AwN-G{^=LXETaYp6~y0$haL zq=>qAl2Vb_Y4SCr}L>|O`n_~1WziQS#o!a zdTd_SF)EYj3$1I35vMmUA0&k99RC!u@u`04bk>VGi_x6wmC zR3kY^A&wlp4G7JoOR}%JJiF8`-=|H*R9FS*Y@9%+nH7^Qi6XN&$Ii_8x=Ux~Or1J2 z6}OFJwCVXSPEYwYsz@AzVf1M-<;o%|Q>Iu$&cA<)P+9LKziRn*p|V~TDj$jpmH+T9 zLgnB7J3{5*uKz`-+{6D{LS66?v(5 zn_OIT(Q+ux+0Ly~Cni0WQt%|}sIwi2G;Sq=AN=N7n3U}lftXtiaeUYlP?TFS6^xEs zLavC`^MxI7*9Ld(3;Xy4 z#1QYv>{{5z#iMr*Wusx_xYT-Y*&1yK%pJRSC!-;{;>hg;VpIA^I!*nF^z+#P{a%zY zz~u12qBez57cy&y852^%dHlgaXY}A8Xsgag<+?WNcYw)r9_IfE+atVmMynpSiekI- zSoK^WrKJPklET<67Te`XKtd|P_hBR=aW9-xs)nRQtU)+yVC&D~JU-0UpQg^X^PHXh zhmK&180>`(OOlqEM0X0b0@j9OY{OI7q+%NnQ*PA&4~03q*~h;}eKy#tO#!1kpzb*- zQQ#%63E$v4*nA8d`w&|x~ zGF-~ffKCz7;zYC$JVF5*O!#=JFtlK=V6n%ti(;GNNXWWZoG6x>BsU{Yqi>1b zv_;}00lkm>?ipBvUC8Vn565I6PM)j1;9hN#W+KsNEMtk1K z@flqsJy&-Yp$}k{k75Ow&E%U0qvTx)If>&3-iMkzfN2N{N%WgeGaBgruaU)J@!kw1oEeX7>I{ zI-HMuZTUX!`lq+^-kaGsZ{Ez#%&z38B2BDybrX9n*2G={z5$#7jsy1s9|HCP4xj^D zfOcRh&;qPq*~EH*6tD|$ft!KDz}>)c;3V)Oa0Xbgs)@Z5SP%38*8{tOeZVcioxl;` zVc-eiTfob}Yd|Y(Re&|XW*`Naz$9=OI0`%uoTk6;rZ%zjfyKZIpbOXvTnFR;7q|uZ zC~y=w0Xzeo0bT`Kqo^a$3G@NO!1aIy+z1>7jsTwno(4`wn?y{!jWPQD{mJtH+E`f# zKr*=iz(R8JV&Ed+4!{HGqb$mI5qvY3e6#{}08Rp*2aW-EuV|VQZ{Lk{u`f(^vDNo= zu?vrOvA!3&%Ch6QzC-P*(H{zY#m*>sp10izq_^6>!Yw<<=0cw0+lpqIc3ShfvP@Uf zwq^0OZ`hXNnYQm;+QPI#&i5U?Lop4{=ayk*6-XW1^*x0o9mu9xy14d`p#KcPuykHj zbAH}rEHOOXp>*4Usawl^Weg&^Ddnddw)H2++b^d)%a?h}6~j|3*r+MG;ld7BNFr7! z6xaxN4Lk5khI7}oT~$?ud|0!xyo0em+w(hU8+&LZMf|=*yoczO36W%dsZ=t$T3xNI ziN%zmt6EUzICndgxaAv>Q9h<@U*@%R+ZO8SM^Y0G?@+231Ki5`Ij~H&WZ>!-D`)ykkf&UGcp-MnVu9_B>L0L2SpgbIzev~*tDGt`~BHknZR zQiB6Za@*#C{%&PSBpU5cqY&NtWjgpXkzP}%|3T>2@*JLeKhwSf1 zoEy|9e6mK#PbeAJK+vd4TTPzJWxYB#4{surV}y+BQ6fr8+ryPHExkwa>^xUIBk!0- z+VCgTDU~YMXI*TaB7;szP)GXdszkZ_q3>FnSyN0+^`=vxi22!7hefpleXYQv^jm7) zGEekDhxA2!MsF~jnshNT2G$y;j@__^bX8w-)$9#*I$6pF83Z(z<+Uu2j-y=)nxhuR z@+6a_CSO@2Z+dChaQrmsQGzky&nXI_eCBe}!p88TzKoKrzRtyn1+Wz_&4? zXN)ZAI+`di&pnT7+R!yTF(esNNeSRhh|}_Bz3ZaW_S_L4&1b`x!}3!y8OE5_y}UO zpXW?18%-NY+j+-@7vyNCiq-~o?M!BhzAw0{4|~u6hLy3WmRS)9o$2JEY?{1OMG=Qn zWu6~oG6p$V^#lRU3B@`+!Gx@yKi-~pWgCQ-Q{|3fm*n!YPDgUpP*~TO1Xq=$M&|nP z8U3h_9W=MyIfi6%gmielE~FbOV_z|naXHUnk{8O_r`mv_ zCTF_^&E@0-p{HqM4fQ;p4fVW+dU?$W_44xmS!st}bR|ts(|1bqN0J*-4>K>7JKogs z%=63Rv1Zhjvs)Y2N>a#o*Tx`8NB_p8OV$ac zj2k+)aYt9vBe)~y7Mf~;#%07}e!MLAvPJ|`8bgeK;YCT7_rw*-lW{_FqEfy$Fw%Q` z8tv7+K4gxxFYjb4I$&l6Pc#nb+E7P4FSS57s&ukcd3BE*yU-7HqoN}c#H-{(h>9^= zkdRl5I93F1Fhw%rm_ZiqQe8*-#mxiKN7Ly`9gW&8lNNq7h7bGp2b) z8nPgabH|d;NkKxM!9{ASkP-^j!~qLRg1C?W&W7qOa535pH@QJ zn8_oWH6i4VHNCu4uH#HE&$`+~sjoQM>2*prIMN2ymkyG8GC@2U>lrz|?hfN*w~Ps? zD-+;V`6?^*vtfSS7k&}*mSQ+x38~Nd*s9Vq9=E7h|s;8Q08!d%{j{yiyi4 z=tA@{zgXtGMmksGyH$L2BkF;wUzB|q^V+gZE>T&yR26ebnnmuwb+_#%iiV$b?KCF~ z^IqCUuT*u@WNLH=d(R5S+`yv#Bp0I!V+%1SO$`ia#cist(~@A$NIHf>F(HG|Tvl01Iob&{PIXD$-G_?OVIBC8ESDW?=28 z436{<;07=;ZB#xZQ zSdc|pnZW$6+E!J;TFIc5oadvidpJs`>fmt}m|}+`t(hj>44xvJ#1zjkvFvM$rcL*9 zB@0VC>8^MP`)hTb zzshyzvhjvf(%(KFtcq==xq9~gDA^XHdr(PaU*!gRC||RY1}9G z$AV$kwOb|M`Wf?izTP0;I?Cr@I--mlt{-5LSZ*L{Nufx3?K76Y)3z|x_MkxSb;|lENDN&E{{6I zu9&e7+(N6_7HzOVn{+qMsH?eIu@mE!%N6}8gF(!v4l5RtA}bARGIALkG}5l^*%@Ei zZiw1-uUuL7!+;#@NUsIjs;aV1tatJF%cEaIA+YvXcEQ?&`-NG=-ovFWElH`?fuWiu zEE&5s_bcFlc>Cr^jS5{reX(yHP_Ln(+1Bctyv%I^VtNJzeq5 z-93rkEBpGlTs1JbbtrlD@JMRg_R(vuz3!KH{L1w^cWGm3ooBK+WA`32Z`saX7i-_~ zLUH1T_wIY&jqhi0a`+q`6%(%!Uj!@hw|U$h8ru!`_E(~qzTJR~c0l848tId^6F7n= z)3O*gDEC4(+r>EBHj)@Fwf;GilQ&Q9pM=Bb+&p>nfyqVl=E37P-E`AD#$vI_)38yEM^j)#iHhE~0HumB6TrM|%{<%fRDL77zzf;#?P7qjwwv`I_DA!ZD zpw~4Iw(_Z*#o31* z)#yAp%~`9lzv^r{%dQb_6t4&a*vgBA}^qHlO8LiGVkH zzFz(5T!gbaRV_Q~Du?y1O`mOjEA_7Di2oXgP3}MNfrB^Q{HupPc+0Qd`s*M1joUu_ zo3|hSt>3=m&X0WbV|RW06Tfr!?|$;0BcJ-c-@o_1KlsD@|LB1~KKdu0{?lU*{@G`a zKlJdQKl0hn{l%ky`T4(k?C~#r@x+&&`0FSC=BY2A{K{9qcIt1R{`xb2_l<9U>+k>J z+2{W8`ES4Qo$vnBi{Ja_e|hO&U;ek#|Ni|SocWI*{^*q-|L1?b`jglG`wc%JXMO;l z)dTYXy8dr^|G(Y@WoG&R3;*}^b>#CMavw#ZVEi7U*JTrcEd%4G2{ffg3V3#`2vj8_Ta<)mZ*?q_KQB*45DdEvp;LKe@J6{%D>2 znsv4EC+p-FY^Z$C^3C;KGuo+bXk3qvZES4kaBpMzeOnvbxo2DB{4edOl|NP`zeVd} zpU_^X9rRlHi8}cunTnr=c*Re*R_SfYb+N6v#`pPw*;syZU#AGp!F?jZy$2ZS6j~B3=o@eg##Fs-mEneu_$mU5N zy^8K?XLG}pVd;=H$yC}emgLP9j?B(3l$?TV_`GZN8n#fTX*(9;i<#%UY0cwldU>lA zebW=0a-$<_c9!<%_BMrkN@6>av3AyN+8*!IEZyX+wYiULj@$ygyD8kUitD;7-X6W5 zID@txn4x~0v4>do3#PY<{9=od-N_QP>sYsWh;gZTfNSG?3jgKi5$<=(4eoB=HRUZ_ z_7v-dgM^jraa@}`W#oCv9+~hkw@Zl+e;%vi(}#U#Dal62<{sA==k!%roPAZ4)@xwx zK|1tDUz-PMCw%jSkIbWn&b#STln0xK;Z#y#>>YDp8C{k)QZrPlxCecuGs3#j0zQ`o z9+@*r%_FiNo>M9?WtZ>5mQe0eO_PkRtxChaxMQp2sfMKE3?-6G^cRlzjQH-;D znkxH=k!j8K1BW&q<7_`>x+eFhG|u&NQl(w{ z^1H;%!p6XLxm9j|YtA++CrZ~7#WW`0$P7mapKT#~W)xr1-0$`9u^^k}ZW7^!LfHrA zY?p6VL_qB?rNSNRw~JUC<}$fRqcmyg#l}N?5R}S$q#jFH5-IZ>3#MZv_}@qncIqsopBjq{O?DejQrXxv`)q!;N_?`n}bXSVZoRoVlptzq~_^SUsd8a(T z&bD~fE&(o$SBN(W}-R`>mQcAkWzApVxO($K&OLYFmN=NmrHq9EeARm%N8s9 zXS?Pa^ztxXc`FpYp_x5qkJ)4Pm_25X*<<#YJ!X&DWA>OmW{)?|QT<&!9jzC}*<9e& zR!Pr*z6d-AoCHn)$AP23Vc=F^5-0*Dpoeq^kOcaGPM|%ct3tXoq>F)8V17s$-R}b2 z4|oiC1ULfR1snwS0VbdWDPRED2*iM;z+#{kSO75KmGdP%4f-7LOh`|L^hw|taDPbe z4e8y$L0})?06Aa>kP7KQNPB>dKrEzfAyt4yz=Dv@4JiXoFGL*|O8Ojd5;y@I1CECD ze&8^08{h+GNcE8J29%=&;_)IGzKgN7KOClzLH%FAbV+koV@^?1Wo|=14n?{fJ1--m?71HB+v)MfHvTN z*t-(2rmk(h5|yUIYi;j+y=|Z0cL8x|tCl)7K!6~ipn_3RK@nn644@e26sMr5skJqA zz=#L|MNidgRK%#Lu})E`MCw2lF|AU;YD=|Vape8`&&T@sS^MmHuf1~4 z`OmOVE8x$9egU}u4CW260ahR%*a+wW9iRqOKnNfQIshI(OF$xM00 zD+7MfBIny=Eq}d_5I1@!tv+4cv@30rCy?;(4a zPQRsQf^H75?_0G1*e4g*$0OKhIG+L7H|HgSepb-W32DzerM)VYW%?zd-j+h#%fKrF zSiGAM-%Z#K5Viw_ZG})~fDk`W&_jg!qlC7{2=VMi0#|^&jMxg8AoSHm$gdUpoGR$q zLi!vbJx!?RQ-Hk*ktJ;B2>n?jw6{)(-y!txgpht#NPq1ahb`)C##ZmtKKGb&+(18R zd}HZPn!mC1|D?2ZItFN74d89t7n;qXD>O5)?!N>0e9_QsZaP3Sf0ID}3A*gh0lbf| zfqor&I`kXRLD2uh<_wzo&gDM^5L-(BAoO3MmC($$+CwwH^?W6O+@bY2Z)GoiPKRdC z29AMd3wT7c^IGUgX!ejv2-AY>vdHOiz&^S2yf9|=-JRw_INd4yF~Sld{E1U|kyBXj z6#mpHyx1wc#3|fN_+4v+-wF2@oWK0#U%fJE%SOeK?%Jq49Y?9gAGUU+H~uj2({rT$ z|Ly}%hbvh6;5=X4T(Sl`66Nd;K0{CYM1OLUx&PqkVKXv=Jo?c`h_4_6K2KeJ&!3|w;%td^)!tsp@rrBKA zokP|N&r?!^uvYD;pM6u6Z7UqhB?G`?2RM$$>=@5J`#MxO-YsW-1)KtI zvhzE1+!F`~#){~dGTy@Z=Tyh>nDT+IfE#QthJ5UC#V}xulVO=1kHJT3+`+YhYTz1B z30wy3Kq+7YtUw`P0yrQOFaS#dJ+Kha0cn61m=0)wNq`y{1B?VB0R<2u*Ns~OyBIY?GxV!d6Xr=I;R=w~`4>3;0-t%JDFxk6Y#6h!bpB89# zpQ03+UEi;6P@a|5i%2UGHLO>}a~juQk#k49XCv|QM&cEX#48(#S2q&RUScz)iimr$ zJ|z+Z;3Q62SBOZ}qJC4Ah4eN~SI-V&+v%RF`4sXuuitk4T13uQh@PcT3IbvYJdq-( zFMo%nUfKhmj=4cE9UXb(K8Dj+7~R+Ms}O04Df}n9-OjGqkM~GMcTZk0T>zBCD+weW@f< zX$|t#z*aS+*PBsyC0QzKNUc$$el=-PzuurjJsjHNNUt+t8})NGGFxn9DYc_rJDF^( zu4*#dtH}y*sMm~oENHhB(5O+DR!2I$4%$F!l@aw|d?6fZ&?mKuBdvxbgOT+QVYH(| zJ4Tb4bQrsyvtV2nGU%;jFxiN++AwCoW+RiOluXuAGBaRY7QhBu=*)KHvy&P9vjPT7 zCD|~(QrOE5n9*NrCHibbUtuFF`fEjB?SNXXLVq-{gO)Uy>kz4qR4P5fde}ivsz?K= z)CSnhfIdOP-bSN=LOhM6!knovKDEXO8yYbe0P{CFM=Fe08Hw=%DmHFF!^RHV>I_H= zF`*pBj`159i~#0~Gnptd(u{Iu*vm{>K&66h0F@eAYsTC_V-5`rY>td(;*4yrU`K!h z46vt(0X|{@bUOGeY|ELTVP7+RUvIR+-hjypKL+4i2D1(6usdLa-OYdn(3?w@D{4^6CLmczI>``TLj1{PX?%@=JWHSf5=|{3QM-{QbN~j`WsDR^};898-o*|cfXXQat%mSr3X`8p(IMp~#&D)sgAQY=2SM6bWKHEz)` z@jb)ch*qtpmYwf@F*`uzW!Br~md5KpZDL);2Cirad*$ET2jsJY(n23nI!ROD- zomL=joSn3DdqLrh)3$FH1O)}f&8rz-HMqtL zhL>lE7sr=euB!aNB{MTKVa-NW@XY9wC&#OIZ(qM}+OhM|$RD?8v|;nCqI=$-GACcW z%+H1YK@J=kKQL2OFnHTx+r){RcdjcuQyh6QJod_!`JoAedY*|In<2@N%U9*D>xv(+ zw6CbPHaMegdU-nc@wDX*&|e>^%=`!~bdU0lJA z4TA@5-1?G6b2g+>8W4a)-TuxyrX1T*P*9LJCiIuxPoK-OUds%HT~u9`rDv{5&Y%3v z^}c`s}7J>4fE+M67}s{9~r>!5*;FXbdT8wQ2|n^^s)EEtW3ba=^*h(r0EF$_r>v4 z&*SSR`RCfRz2iCp$(?y>^S{qi8*)>|6&bH&ypig7Cpf7Vn~YPs${DXz@|?AfPx3qx zJXZ-GS;rq4x3#-kc&^HGTdkevx7r3=l5xj6F3ET$yr!dY%vJz@d2Fq&89{<46kd zBZU)3V!RdHkTY@MFAkohMB5sr2|Ng#RNzRA_ZY!>j0Oj1G=bAttQMa8n!sf^##_w} z?qU`A3*#0crnQIzpXGVIo?SzL z<^*mFm{^!`T)7!z0?%bo)bm{(IIdcQFnF$3EAU-F!#J*~GZB1svMyxOP#;p`QjG=+^8l4-XGFH-y|ggpgCJn@5}0 zkhfT%ed`u2TC{H8%uNuMKC;bQ=hJ0vquPAYPV6p|$x>wQ?Y?N=KCDIS^Ud6v#kOgk z9u+2TEAE8EDN|A)QzpB+i`%ws+X;2HY1h`>Ju)FCp^v+-X5OmL-+VJ-(4ch9v`+2Y zv>Ex9hg+LYDLworcS`ok_M7>R{mzIHiAhOglD94#6od201UJ#ZPP)!}1JVk|?D}BN zmD?jmC3YM)?(GiIhvVb#*2W_JoMo8m(yn8kp22g1l*-#LB#s-`F)=azbSHP2xLxa! zZq>tTA3l6H;_S&C+$rU#QAr)UcI()&L+6j>^7*sf#qHV*9dhc-<#z|{=2ox#AucJY zVEhFi zeiWeCyzeVpztF)oiCwxRj5V!`9=t3ktZ&Fgk(X37X_9P~r>9;YezauBh|#J94^hI# zBJKh5JfsKMu6>B(e(inw z{@OLVa`T>bB>ZR^Dtfc?mF7IN7Ls` zqUmWVH17Ru8a-?;-7UGtHZ~fs#jO)5;}BXw~)t zTCsIEEy~_US-X$Yf>rw|Ic^87-FB8Nmv2&W)en^U*+DX_*hq^$oliOIR#BF5J)J#M zLB~&=rKNdCXzJ8_N{n4k6O%U3l*COme?cJ?p1VT3D}JV9KRuumw`*x<@oCD<*hwoE z6p?n)7Wz>4IqlhhfHK$bqih@-R&6>&A1~cb@x#_q%CxPNb*P*&4}VWv%WqSG{Wh5| zR8#8Ybu?VDfTpER78PjLbmMxoU z%^D-koH3myswdF+(}Xg z*?Iol@yeAe@R3@&4}Z~kzrw=;-wO1Orhb8gC^$TVTm!<%bzm?>goe|==l}|1I${7t z^cz5(5=RjG##;4zukc_#%RWxxFZd>Vj_--;iiY1?UZhiBzsSE6@wjEBxg8O8%2{6l4&B!jb(b$1Y#fGQ~!f~mA8C_hvEs^WMyTPwamaYyy z*rthB|EJ}D2LR6G??Eg!0DwbF?0pART-UYsfDl5cSYu?6OJX@MPWVln_)mG!?<9`> zUJ@s9oLIJF%aLr!Rz-z@p$O3gh%S2Xy_cc)-n-~cQ~?4cA%q%;rtj@@X9fm@Y{f5Y zy|@0Qt95nHJ!PN0_t|Hca}IN#cK`HxdOhkNl0OI8^m_N&^2c3|Yrh`6_27J6+2i{A zCcK^$r+>x09!~4Mug6pJx0jy_3k#T=o8xZsqgLh1){{-I&6B;?%UfH%7S@x>f^2=3 zW;l~Sh{3@@^!N8;VqyaK?%f0VjJSUNI&R#!!KG(rX1Kbnjr3x)vOJ0vKz=1|-MWRT zsVNQ~d$RlX?b}@2`T6-}-aL+$ughnb>^tKvyBV$w@1mk2Bqt{$Hzxnefjg815TBD<*;pgWES65d!Iy%D6&JOnW_OP|3+r}2o&Q9?0@kT^M z1ji%Bi?OjWjuz?oFg&hay^1T;$I#FaMn*{;mR>qAdZ zA3~v!yLE;7(9xl%o-UQ^!^GHxqcI^NfulPwFAt@qrQG=B=H?r+dU`lnl;X^INAV6uM@P}z)PzKW6%rhTjO;8F5^o9!W-N_?9q~_3SC_l(9PAMs z9E^zYaCm!o5?^g$W@d(ShUW-p0}fX`!ckY3@YdCawvK?FIvnoWI@(;GuAUB8?=11; z!i5XVW8~!IMC0Sky<1pV!ra^(7pyM8iSihas;g@_e3`tlF|Q&1WoBj~JtG6Lgu9cg z3)Qzncr?if$!K_FBy6m0p{=cpFiN|*yF=f|7#3DmIB!aP*4KkJ;i1FuBb>Cf&p=Bc zpr;U8T6)mcHil5k5JG_=bWYQF2+l%RppP@BPeCBif`J~@(WRT71_ozwp76D|w}Y#* z3q0K2;6d{0>*a&Uun1(NrK6#t9^<4>n7p$&mYA5x)wi{Czkwm`@bhS=HpT>&eZewGG(6AuV7n!K3u0l)m zCAyo?-rj-k?oRX$_F#B)h?5_Ne`{+iH;0%^o1eFUowXwj&k~=6#6ucmQ(HTv6qjRY zdKSHt_t1Om9?F{Ap)JsX_89>T4bDOPq&5U6&%)d?7#_}fgjY2JqMP6w(|~}4CIlrl zBOs*-;rU%itLQ~?3Eh>Kky+P^y5=zi2KwRTmn4@b9N_HeiS)EI)HSrDtiBbMjUA|O zyNrUWcGR~Ip?~x`M#gRs?hi0W^3&elPBInE;jcw%_gmLsRA8|g(o zD5@Dj`K1ZuRd=DLWdKbreWZh?K-!hlI|(Ui@DB-tp_w^%2gjyBRM-ex&jeVS`M}E3 z6{aRG5NNq0v!)xDAIzYvs|UI#L-3A<9bS;v#Jm5`4vt~219R4&GpS~N0vj(L&aXKIG{xle`DOupVTaLigJQZ$<&9Dq@f@fMAT(i1h z8a4`j_c3_ojv}LN4uS1=;oUKVxXu|wc0NEx?+j9^CJCd#%S_CF!AS@*hIW^75Ztg%q z`v?-Un`l1A!^J8c?gqKIcp?WEzRJXf&$FPlHwmA<6NSBR1mKUqw1Q(u37nFfVV~3s z_sq+%%NW85=N<@c`;po_15w8V1b06`>hLV``ezZ{Ig6~`Swv=CgLlCs8pkG3m|0Ky zB^`!FXGwRF9P6GW-Eao_q{mDQ3}8?C)1B-@2RXWC z(uuUXW+Ya&6J70y%&vs9UoPC7bKvEZiNL5r8k0=eT4ciLY#h!Uio~%K;c$wnhEqxl zY_bR7Qg8(q^M~MBIffLHoAlm0h-kl!)WJEFPRyckXcnp6b4c&JkDS&Sqz}+M7#xAW zOD2we;thQrl0_$9=o?>z?)i%_Bb#Y%YDBuph;*DGEJ(+Ak-bSz&q7N}8$xqQFJ#ms zHn#;~+4T^WG$Aan7Rgn$2u;aBFx_4>CocM@!OBAfGrI(6ok}FTlL&3CIM{h)BRI1L z0W?=#O9$XveigwL6NtDpg~Xm2M0MXo(!eZA#}`p_Z4No3vqaMar1i5gm_iBZlETI= zeE3@v9Q|7uv`)Cd$S?w@4$*zw4aOFZ2n!?G4)leqy9*p_tl>a9(aqHZqNHRbR5igV zI2*QJ*)VfUfth1E%t=qXM;F35Ae&?_6P~eYIB%Z{9pbq_I~GSjOU0jm6^=js%8Tqq z0TK#3kyuNz(smu9=4(iAy@9muX(aW}AaVEs(uZeIIyR5;YYWI9yN^^#r;N;?fOua! zeg`p8W%%2V?C{Z#W3lg7fjIET037>M0*<~H0ZpPOIwlu|CB>+zCEtF9W7V#M3Whp?4+)N4|>1fzRV{@behxoy)-S)5PbqY0y8PjDrWGvHvfb`0ziY z@x`BF@x}Z8uqV3|R@_XoGKd_ePg<_h+?+zr@LjqeAa`N`g*WC=dwmgAbl2RNMbXU# zPQ)m6Tgmr9){094#OvZ zb%&XG2r_fYo(_-U_PslZZ5%^<{S|m6*TBRf4LX`JF!(9~#s}kJbRZu3`yyd_I2P6? z6Jd5F0*>d?;pUP9XQxuK3k5iQA_2ZpZ7A&=Mtw|^SBBh$#aaUaFgWaIBH zp@V3sr*zHqeH4t|LdnP^nun&~8yEp6H&-O4=c2T-4Hebhq(AdeM0}~PXhBM1HNw1_ z;HX~?oqhR4OB_rsBVl3fhQX0>gw^yQrtvaj>-y*(L||nrJhNM19a{pSbv({HXTTvK z4?!ul2uLqOa8?yuV~TN%#$ey4dHC%w<8bO&CdxXlpzY=Zl80L;xH653Ycpt>UO>m4 z1;T$G^;7rJc7GmqH>XfEFowQ6vq%tCWAFRNaKYRRt}bp6rKga;*o2nWPE=JlAR~+B zp0_9beS?sdU4XoTMmXB#L+f-T3{1Td9F>TG)>u6r}Y@9Wt2l__j|GB7-K8}9bWIDF6q#^>~5tZxi!@@GBVJ>c)} z4^IzQn3!8Z$B_JH7YB+#N-%Y25;rNf85^5MZCxA5&-w@x1Rf06<1gNX?C$VWBEZ@I~W@5&xU(^J#52@U>i}2lln1!4b(ku;wRF*|#IIo4lTU{B@)Es?%A!FfkhTyU|3wW}rU-0WeX z9SFlOa$u?-1?_VI(6fxe385eM9f+j&VjMk?fqlPE#JOYfq%W#q>sAbh&>AGrT&ftF zMDg$qRMNAN^h?9QAlmx+$md!@QcfN`0!YUl3x}x%&C#4;_&QfWTQ3wgelbWd$U!CP z`0}z^Was6>+&BxL{UH}lWP6yuxg764T;%SDOAm2aa1h7!4nx!6D71~WaQ=b?`SgxB z_E9{{_7~#gcS7)=Z~0;G+oAZw>!JATucGkf9}{7rT>@_hvT3jE<*HrG^zlVgh0tnAV;LC$Cu(z&6QUuKzK|Q`W5DOE>Bp6%8 zsCamBQK~8K<>kpm~zU<6<${lw=4`#p2+nUO0U8BI;V(#Z=3zamiksJkhu;O4f{| zQ+x9EG{$d?p}V&qp>e4c4UE`eO4?dd)7(Qe4#vzfg*c(@KzC-hkw+O626$5Z|v#=Ifk<|BvGT$oibj zSYuJFs^&-z7A4K*mu4w@@v&>XYu5s?wm+<_t1Z%a%(HnxvF!D`w}@ARn7DR>%9x&9 zlFXY0nyd2?xdHcF+vk#m?~C-Dm-1~%%qJG(bL)5WbC`YbfSwDOr@VQ}WA~y=J+W?B zT3!qNx^-G^t#WZ5_aDrXZk#7r)DPi2N4jx_=KO=%8Od6rRCbmgyFR`Owgf)7v;-f< zSBac4o%L{0@-9>Vo7T72?Tc_*Tw;1qtXt+6*?eCV>zIe&o?@B#7JC9uRBQcxgm2Mu zot%e{ls^uEG=<{kxszb6Pu|^6}}l z`ub;lsejhrdXjT3kAwBNc5BZ#Jn31T_0CMJSC8%AvweNG7e00KCU-_-Y(-X8_jr{dM@USc#pnn7%cQhWdK$Y(s2pEVn+kF9rF*;ZFqp`D%ug$3Ms3LPCCIM~^7XG5y0tC5nN0$*Q0ZeRZFSp#k_Uq`6T)zjA2 zfv&y|jEv54=M~aY)41~sg$0G&d4uqX2*NiCg@uI}9vK711?=qXVNQKrbaaB1r6u$Y^tt}D1g9Yo2%s&{g-}3wTJ)q_M@xXyr%ys( zPY;HM=U`%D3TtaC*xTB2=PX=ZTo6w@?ds~{c)-qNczb)p#>Ngt>}-XhAyRV+&@ncS zlKNIO4-6wHECy!{j9{R5210ECj0|mIWfcY+hXgpeWWd!u8~y<~hz!d^V0Z@cEdcsL z9q8-oQ-6-cgG^M{RC8l?skse3{k<5U80TW+dKznICnpGqclJ(RFf=)jQ>Qdx@9c?= zt5dkX0Qd)n;P_z!?ElaNTDpF)^Q}NoavOqjx)G7vkHm^mBsE<_TFZ45wO>ca#2tkA z#^KO=9taK3LRn20O6!ME)jW!l#$I&wj*$$^a&c;Ways?p0dpG%Bqbse)GB|tOM&{AJd57qRVj37(saHHKg>+z`yl2!rSg5x9c|Y zhbEB_(*W)FXzZ)UP*l?gQQjqF*L9$>xeGmmgP5Irz|Dj3co*4DK0Sa8BulMM5969fuHKdk0}%vxx7TLDJ<1 z5H;LJSm`9n8~PF9lS#C>(YP9O=S|Ga&%@uxAJK^kXr=iyJ3E7@+-fA1)FbCoCz5O0 zkX+sjzt}u@dS$^kI0p_k889^zL0dBlwto3=$?k$<{uQ_sjv%V>7Lt1IA!YCZN+#Ie z@dKo_-9!HH9i-&f$+Lx`vjv9*JUX&mRy42XK~BYtoeMPu_Q z8J|Pi2=za754G2)VPzbH_h0kE(T_rLXi{f8IHaV&E3vyq&XK>ho3bMc}_8uU&@ z;q-wR9M~I;gCE7=_z@8_HIs1St9X3==R_R+Yb;CzafmN#MpoA_GCC%>y|~=bSrkq# zpmuT*bvGAKHaUm|1QGOul#A=dLuY21p_1lBUi5= zs=OaQ33V_sPJz~eIOu#FkJBGS!r+Tom>!OYwLvo69P>#RZsC>@+e&fsn2 zUB8d&JBw()y@aOOCDcsMqWbD>q~(_)CSHV+iY8>`Hz6mt6-nWBaJDRl@QZXDI~V~c z_h>YCbRnX$4Ka1yh_35JXjLaJCX~b4zW|OjCZX9?h%Tyyp+z>{|3e18{3Hcs&BMrQ z8$1_xXu35+w9lb$@-9rw{BTM;3>8&_Fw=8~rG*)c49>xnWX;sn2uDv?!Ph?$ zlQ$S>PBy&d2}58BV+LJkHN`PF-S=4LXc-6ES&ui86OUjC;{=J7-)VK3m>-< zvUQ83cNe+!M`rhq=zNLedPksRd>Xn2W)OUq2(3>=`0%{|?0qW?2mUOA-WN3X*12$x zDo1E}C-QnnP~16;uAwp9Ap6VK?0Sa!VP-?}qn(a$?^c-V6u{Ck9gZ%UxL}%&kAFit z+OtBk_PJt{iz^CIQdxwYLMo5+h473IPV9}uxv!F-cQ6L$PKDu|i65+7Lg1H@g2;km zWL7s}@ah;A=H|JzQR%wo-I@FFkILcB5SSYjK>t($H20@q-yfoJ{7?kO$8K=zj7wkR zzg!s~MO94;qT+IqnOlX1mQEB`*Q2qs1+|Tr(Am|EJ7lZ5wd{v0>*H+AcZsbt(!bGb z*AbaijF7lOq~z2fF{uPYWN+Ep?^-`dYX4>TBE&0uOJBR~FqT+C7bco~|qW@Ae+pk+M zR%LNkXJ_Yfe8w(zX12Gl7v0_6-1%i$(;#hsk7BlgfdN!jR#8kC&)N0V)MP|PhQiF$ z1iIQnF7`1rFrYXqgkrB`L`OxSq_~KS_fnEY6th{A4{V9-@(L8z*5Twa9f~_Hz`;`l zkDz>nkna-~lM3O<^AwAvqo|@0t(}*-c-AK*9ATm~cm<@u!Y~S+t~Ge?R~KO&+5p$| ztB7g3kHmom6!qRih<63T<1-PKkcRS_2Co0Wc(O++H3$+_!pSoe$M#2)&zFYa$^isc z-9XyFEV71Xk<&j73w`o;KX8Dtkv+wx zNB-4&s3RZn(kzhM)PZpST=+ROz+5jC_I61qEG$?TCsW*>R&--mF%*TT}WO#fc+9MX`9`WHzoFq$?Q8=?2Y{j@CHfE-P~^g zD@bbY=6(Tqqon3;?)QHcpPG=T*VF6i_4Imr{SRL6|HGC0&3^@n&C8MGzx@Pl&FS9$ za^7}c#^%OXa^(Kf_{zs8Gw^J5!tBzQ+^8&5>W9$gSUovAcOZ+0O(h(fc1| z-hZrj)KHI}6~C0wwTJh}N7O0%(2s?>!oxfXZiggD4Uf%6Qj+dOWq#mKJ zxMh=~>dU*;6&N0hTQzt}udz1r+&706R$y*W|3520S)W^_IH{`tKw7dYU+ppZyJYj_ zxo;Y8Wckl?`KoVhP}PuAhZjNTvhw`cq<+g2pU5%%(iQ~y$MTHMkH;MVc)7Z#U*twUt zX_+4zc+W}k7ei7|aMo0RWfh+{aJ0zQ*(g(k(aOeQ6IU*vhw|2E<<*rKa$@8a)xSrz zb>$d>8oW)ftr>eUOm+2j#$LAkwKZeEb47MoCmRSUjTQcHscuzz{dt}uHBfzHlaQv5w#EjkDEPk|X6l<*Z_9ADh#OLq zZ9K(I@`9gml{B_+FK=)!+}Ld72{&@zUnf~t-o2LwV#{u(hqkJ2+o__kQ)MF~Oi@Kq zeKUJ(;ww54N^&Yn{7vG-W>pnsRh2D!9Jo){EBXt6DAT*jbNuIC{|Qf##7yn8hYH;5 zHYWCp{^~#Fa8OWG+xM!nzdB7U8on{RFoySg!A^q%ZVZGT?_GNPe6;xMyB}{ zc!vnlFC~EXuLY#>B!Cond)NnZHast(R7p-k>G8GTp5d&G9M|Wdq|({1VaFE!rpK~l zGk*(X$Ced#I5Exp;zKzpAbk$L?OOO-IV5&4BsBiUYIv<*Ly4>LI;#<}evP-e8e3%1 zdg3?2TA3qM!nET{fEi6*k!;;k&G@ z5}Sn5*6OOOS~KP-@|7i0mn{Ldi@*8X1KT16wo_%tp6@XU-7JwR;bGQLRm`((0yW0; zXNmS_1-lr#RW#Iid=d6kk>0OG{e${FQodvakJ0dfLg8 z=c}myf(<@P{9G&(+B^;BO{@!QoPko1zNxKXth0i##?SeDr)Qap+evKN&g1V?JTfYoMm`oW@0-244(JnaAfd$!0T3MIg@-MELX4ntM7QGT)o&-*H7T zhj<%a5aaX`|0VI9RP$H=83#e4nZ-I;Rb}H&6-A*Jp{lY;RYgfvWwTgED~omX7QV7r zHE-o_5hu3Ml=>b|W&2K*XZEy7wPl=~%+#YU-?U&HUDis=NGM8?kZPqJ{2ed9DR_Ze zavWVod5cVC{tm&53^bpw`w|=WO_B^gUu_>Hzr!UzQ~Qi7<&-}uuAj-TqsJL!8O5c< zgqJC~BuB@lWS<7EM389Mo?P5i)vYofbTW%e#x(2z;Y%)9sxo!N- z47trK$o)=k9c9j1@=0oUvmMxjtmE%Us^za4FOskqR5tSVEb-PcnXFueOeP0tPzo5knwTM@d}gCy$r{nL2Na>&Qyi z>Ni=1&*b>Kr11HhmgeA(5C4 z)m{8;-yYcJWnj7##3^(BvI<#Eaa_XmK%^LaC&+@F=5vKRkhDlSW6DUqin~6 znFqpdrvy3PBiKFv2zIN*>NnIxRiMaPKhJ+&DkCI^?~w@cpJ%bKgoP_)u!Pvw?eSs! zVF9(W$_xA#WF&Fp9xI0O3!KK?wU3JtRbJ%NKWEKdpS`RcC{C(0*HsK|do zQ9$95a%-Sul(?#rks2T}cZu5w_!0^gRus-!A~iOXt$S(Dm&7B!s$e@8*2eRMnnctF zp}qVn*%0Q-ubFa^n01CI*uv~1XXV63Zj11h4LofH8NLYL*&uB$JiC(YUrw@kfufaSMk{G|#cEfwq+LJ2 zQMJ;yyNb1v{7Gx?mX|4{fdM9gkQ4@HN+>N%lLk5^t;;x5XF_LyWLjvUP1>YG7-mSC zOd1HKy!!Z^^F8!QUK7&xzecit_nvd_J@=e*-``_BtghlMebMIrYR1zx%(EY;r#ger z?zdRiiS)D&Ikt-UD&Ju9d(PP(7QoYrUw__~Kpt$_ww zE#vYY82<7T`_aJS%;;6cGf!5am?DEJk@=LCN!_-}&lPR7lGI|Us z2z48%VNeg8-_+AXkDJsRbS0>FOzLflVk~aHz@if9RacqRMr9iI)=cVLz<0T-KO64)Rlgl3V4^50h{Xf_S2wEZTHrd9X7Swd!sUBQ%R&Y!ut;$ZDDtqr# zuB3WTvo)`#8+weEKIZ+Ray9*i-1fSKKI45*3DaF$4eE2CB6M@VK|SDoM2XQ?P3kf4 zW6CH!IbcvHK#kLhL4$hH`^U;Pl-OZVuYj7MKiJW%Jt6bir&Pv!1s@W8OrBeLLgFV> z7vd+)IP-tl7Vn^c5zd=7-$JiXo`3Oio=v_c=K|qe?BnCI!FSg9rn(x(#oNO+e%xoF zi}tj|JIwqi9NL~djpj}XCr+{AT3^#MPHFc#IEDnT)Vt1Mmy>^i@Y(84Gj&$*cFA*U z{Ga?y&Z%)rlTCD({uJYc+tVjFKzFMrmCGd_rthmbtU-isN(wx z@CM+1dcgONlBcJ9|A8@mm=xDxpbGpOUyxSlO<%xu3w_{wM7e{4{(jm+XZts}_E5;* zI$*JwO$I!S!Xj-d{q_!&C)c zp{xL(_TTIZi!ChqR!Do+e+Npv=)YU)`i9i?ywtKqI4?;2d6$a4#7&sr*3qrNGwF6< z7v0S>9^DHJ(eDB;q=$f)(3gRi(jNl*=_|k?dJ?#cz7D*Ko(5h`e+i7zGr)0r4w#_7 z2BzrmfLZ!3a3B2ucpbgU7bWO*V3B^x&v;?xRk6o<8(5QC8uUJJ8I7gV4b%xdMtH+U-G;na$b|1Ka$j+O6t!g^({$#2dRBHQ@rBp!>s>f z*Ky^9@|^Ob^0M+hJuKmFdP2f5 z9hWdd-;^*$-XvX1ZI>`ZyCs~aq=b7ZC*gi7BXl2Y zzXQETZM~7MpiPO|c?YfNRg=}?Qd#>X<(KRAa$ljokk@N{+OkHOOajboBEzxiMybqU zB)gA;jHVyabYYZB{QrjJmmB4}A%hm{g{odI%~EEi-q02)Is0j?(4fT}C-xQizb1*6 z>a}WJqw##Dh#C)RnMS^`RHrem5h>LcG(BGAct)$&OVx@&L^QoonkyCZ4J|rFBTJ=n z5xQ$MnP29lx!@=vS7z`+a*2~YfZ`KGSjJ4GMzQ~ z`-b~3&m~7k;VhxU2`(9dKVzI5ZS7!BPsR47ViA^g2Bc$=WEzR4hl~W< z&n<1yEYxnbkrGcNVq@V%E)`CPCu3G`Gt#1{CK@wrYGtSQr?RK;S8JkhEHf~;D+j$S za&Y)En@mTBa?WIno{SC)Ju)3npkXIsiC7jRXcF2u`NmL5P9^p`xUs45NFrtoAm_kp zNj1iwgFiZ*NVLnh$;t3OqopIGW6nktet6ZS@o*-`lZ*^FbKGWT($Yy=n2`kL0h=q` z#E_SqoP^0!Xq2{;WO^(-6+h6lZ1p6xX&Q(y<2^ z)2WF_W>*U}Fi2PmcskBiw4-)>PS-Rc>aw~t(`1RUNjsa)Q#nVD%5*MiJaKbmUTZ*% ztRA^ilU0z##o{bjt52?OEI)R(YGtl8FJ#eJLUNj{Aq4%;3xiz%M6Osd)oLyl zOjl<=ohw&ORhd}S7OVP-!JEvNDpahRCUeZNmTGzlHdkv6SWq`9(=V+|(>oT^($}!m zCLO*om%a2-rBPbc`XbfETB)q*yrh>3TAd6=p2elLa(-E2^>Cx1mu8n>lUb0nA!)W$ zE;Uw~sm^T#m1;Dy(p+h+D&v)grdMlrjgxsD`OB!ewn7EStyb6t;&QYF)_BXh%F?1` zinJD$D!F35k*DNRqp1Vrry4pPKqXXNY8W{6V zxT2C@)ToxP*N;~9B1vH>*mPmET#iFa-BG96iOFn^xgu5P=IYo>3! zMjpKqTa$XVY?qEFDXT3vWYeRI^~Q!s7>QCvqgdrgNv~EG+3T_85ZZ>h1sqOjqj zaG{{p8s_dOg0`hdnfGt;N>N)*&cTn&4C{J+MJh;Wm3fqoqLr{ZSL=;frJ=9zF0M&% zKGP)DpUn7Zez82yTU;1qC@DS@uw6oW1C+Fr_oR{*C5j!m}8uL!q>Qs|4M zpu8cyM01=5I)W4G9OyFmEU$=g7Bc6BszX*DKcsD7YJsYBlzJfnJ82vsVu2w87 zc^QZPA?Q*Sy)~S@8lX!k!&pI%yx3JF^7cWyT|_<(2lxulxhc`_h*@vQv?D|pld|Pv zTh0>Xu=QA50slyf7d{UzZSY#AuKCJb966vHVJr;VNnC20!Z7$4Mb`_10~TBX;ti|Z_~r_W+3PI8Nb~VigIn?_%YC6N@>^?zmj;?1&P(}L>4pw0Jum);&$T7# z3-eM3m$KydA#WYX+HxCQOYMF925Rr)2PIz~Y4f5(pL}r=+`{dBNIZE|^s34TD4AB$ zaH|&WHJwJP7NXV>6*6=Azz=~_mEIJ>uPSNIoJP%;n7uGBt=(*uA$)h>yA{WAuBACn zeWvs&k=d#x_Zcj#g37UbxS%zpTU9HZrlVU!xv6qdn(Y#4NQ*8xTxaBKHDasHFJQ>$ z&9c3uY-8m^(lL$hp^G~-sh_Px)rTBu zA+t7Xpw-Q;-M%ceOTg(27CR*=s|?pd%T%}Oa6R@}V?a1((U4TbqOWj_S61Mtq%=En zYbk?!y3t!kYC&ebrgX=Mj{olmrrDjZ{OAMfA{oezM*q-xrPZCS^UB>JT5ZuXibrKZ zsF@2u(Nw8dru;*u0SgkgmbT`TqtZhc9Qo?z5@c);xc?Y=d$H_BNtuqw98;0rU`b_n z&C9sUpE6f*vy{!g#dR1>HfK6*N%W<&B9NY4AR3`!VT^q z4bx>!?%FgOWoQ+85?T+V)O6dD#NJaTd&&BaKU3BMyX1_{ysx$IK#!19H!T`>Oj13%mNe*e?glltes zb=}OSp;zv3dAi&oMd|8*J@~2kb-F{;4NwC7_yPZ1Zc-GrGvrcysv2^sL3Lesr&l7~ zoocAV2t6Sss0MwVAqBJtTs06-LvEGR5OHy0cc;svxn_pUS z^IxrS^J5%tzAx$K`*?1?VdoxY7-r~XU_IROe7`)P+aV7QxVn5QyQPbxU8!0j?!D zpo-{W*cS{#zANCNjsQMv7c?L=ChOF3zIUUl`XB~v8R!NEhl7^~&t$EGKD2#@3#HW# z?l&FYPzOq|l}d0Abf@m%fDgR&)9d%IKPVOEp`MGq5D37RY-)%4ac{Q@#RJ@DRHGVn zmVg@EgYu}(7wm#HfdF?PD7ks_=1$nBvKS?>nT2iM?DKYZcjBMwQWf)czw`Ksk*sUu zUOiu%s#apld~n1$EW4mrkJgp@_crfBe9d~Nah1=*c0L^P^w_c{7fR&Lf~NHq%Vp!Q z6kJ51kMgGGNBt=BJW!YM24M@IJ7fPUeCyr8eZNU`o#PhEbuPYVK7&ai2Q;P!W9rDs zq&12-f4<@V*Z;KSI6u1`?{&7PMuj&cE90oS^2KFZuS)ubQYtIcdqqwQ&1v5FJn25c zw~(My!`#HouOjJw$GI`YoQ`dxSA>35s} z`^C2Pd|%l-iSfpe7bNSPMW>vA7Q_oR`y?dKeu{nxQ1encB1`UyXgH4&4O6#-)Ri>( zC9^I|*UGO{=aAT$lI6XKWs(=|c5B;h-6dthB3naUv#5bL*1xRWuRs5XpOo>e-pQT6 zcE$h4&wm5)4*O;TNdSODOYA&tR1{a1RZTZE&`=FFii*mZGGRw2i)oBtqqYVNnZcdr zs~T2?%#Lv@9XC5;swQSn<3Os(+7z9WWX+!J#GI3C5;rq(N6w7#BQet03}AGlar40$ zoe={kd8Ew*Ll(gy)ZY85i!aTbIlFuI7j;g(y6?UF?z{KC`|(~i)c@xH|H=Qs|NsA6 z;i1;PZS8%=-SPa1zAx$XP~X?^%r4*G_bIKv+1E>P!hO%s`oX>i`h2_ZWBNQ!pXCq! zP((U6nK}K=fO*Du2IBPZ478#H=xqZlV;=|z$FyMA>o@TV+^&fj#GVMD9 zIvSJp9ViB4iDd95ys+`z0xB#1-zt8)z|P)8Z`K26ui0z%n!RSP*=zQiy=Jf3YxbJG z{(mmP>tjh190+|Tb&&W0P)F1v-sTbWJKPM(aKMo>3!!9$NCY4jAVF+EaCi&T1vG z7v=W@F2?U!ZU(;(P&R%8&=!Pxv8`-^je8L~hHY!-pbV6ayC!7Fnc#BqB$sor@i`om zh>!;%E!`0IztRmEqUn@hU5wwS8)Cdqo2|g~x^xsnY(VBt(pIxT(m(+2NLUGvDI+T% z{VsQ;AwS*CXnYe74^cwgXLQ_XktkwSiB(sL_hVIxRc{xovHC!)I!_=+Qjv6bnOK4y zr8*yC5mweig>27&mT)?z|FAc zKld`xGR{~(4_OMFi6?*&b%Y#FqYOKTL$A!9{$I z3mD)+zlxDkEBP!S7qmUDgps$Lff6KiUMFNR2;DJ-P~#*Qjio$&9~La-^9DE^*gb=T zB~u3GO%8+sg#*6_q_(g=Ai)@r(YT$rKY zU+FwcKA49s)e&HqDI>KvfJEgBOgX7U2yDeez6+3#4VCf>%Y0@L-`NUeV={695*2x% zD1{rJl{-M6B_@U}!l}Vv%CVCqLTv{?n|$^V^m_zy4Wwua*E_@jGF7HC1y-zrRr@Rg zIb-zuv47=6|3l~yAhyp^hBM)7MIr;P+S7C~xRtldi^OUiF=|JbbbCl(ju8!WVQ7;k zZ5Jy6!Fv*4p^{!bMm2?{gp>H5H9Ai$#a_}i(P24><_WSCmV1Q?Vxo*mi@hR`^E_?L zlSSvT!93kIK=<=G&fz9)k4x3S-?P-BHy9rSZdyUw6On+N2yw=B-T!fPky`o&Qzn{` z+WZuQSp|vUz^(iWAarrh%4k9?UIFcF)o~PT&F*8$eI^ficnZlO|K(_+YC9S|hXB;?Ep+f&Tz2+_AH0dZ6#*}<}}i3bcIvt8i4Zo zP$lm!hlQ;6l##4NsvNsYnm*@Rz6AcN%E?DoG`twUfS3y_{x-IaG->j3fxK>|N;Eq! zMz1tolz&GVvZzoGp-)CT_N;~Za?8XKWc80=MI_tc=d)B~^$E(A9a!aw z#pue=S&gPOY4weYpU-6EcrVGtNi{CCQ`0oP@oupn>As9~yHjI>pP_W`Or2E0zZ+d| zr^IsT4Hk-=!#(MN`9sfB`@;O-?xJxh(TGF$s{x7}3wHYfTa{>x^{o*| zK}O75xIhc^bRr(>A@kEQcXXr5AQI=2>;znPF0czndu*ynwPO1~_*O|}&GZ?+ZKB~d z3&N|L3uT!m!fVdd@R~Is-72qqdpa%h4XGucy+w?l!N(Cjzhwg-gaEiW%{pIe1OI{DdAgF5C%SRnF$@j-^3Tgz|H#}j7fxgN8Z$K==0}A;k$=|wiTty8 zX8z%t@CTl$IY_rBuI0_IV`(U!rlCd9s1isP0UonHJWBP4M}Ji6DqZ2((WQ4m{`kmD z9V!I1su`BSHpvxHPaMvm$(AdNK!c?MU+rq#9X%VD%m~ ze`P1{U_<)CltBWxf&ST3K~9-;f(l|r$d5t!735iHq!g%QK%O{3#|^#81@LQO6{Nw0 z;q?TRF$=ngOeO{)2*N6(y>Er!DHLu+#!E!W$-CfZk8=&YCvJcKvl zJop)3=$U7U?J1b5GUASLZl#<{j)@`HSc?3anP%WjNMv_-D@d}Amg*4+PFJl@2ckYP z1Qs_$e)=UmAS^56?nk)b&ch|N(#g_LT?z7gz`p%JTEyRZ%Zb;>J6r&D)^LK~jm9s} zYYy;_0aTbInF~{7YXwoE7QF*Bf(RiG+iZo<6F4njUw#UMFLWSTPX*b^(lrP@26+#- z22pNjb%DzW{ybVm%CX+U@3!D^ktVQqu;0cG%v+HPf)ONoZsI)Ccy%8;HJ{;c!4>L$ z{zarEcp=@}J)#NpLJE=YJ|2Ula>L|*K)uJ@wtY%s`F!Yrl-^c7y+vLJfd;Yk76>#I zx)`w2f!JQau^rY)TYzW|DN7&+ZC;a0|ajtoWrhne|RlJiCE$bxOYtvd%CJE7FH`!m#N4>BIa}h83*BaneOKB^RDS zD~?sxIu>nU7-@lsPcpO+O}$1+*5$*t8nPK0#a2+H_#A5UZghiiO^sYBc*PgiLdyl< z_2g5~r*^jOgNLiD<`HhH{MUC~Q`TnUM0K^&LJ=XdH#U_G&RQlP=pI|0;fT*Bp1%Y{ zKZJhJXaF^;JTL~ac~ilv?I^%Q!BzLev$@#*uUp}%)Y};OUTu{PsjjDQm$X$@tlR~a znwns7Kje?O%HQ>y3+nrKrKrXIDlY0DwDZx=#4zxC>@do;2{xiNVmH=1sGL~uD#pJe z*2oeJ==F9+&IwW`fU|T^aE&Hg$tRGlfjjJ$tk5xrlG2XdU?jM)~Y5 zaS_}Ne;P-1Dvyzm@Eh(C4~YlHYSfWXvCSi(I@)6GA1;NhMsYtmq}RPv0;MC@Jx0*eSL=k~R$?U4#}BAdF&rgk@6iF00T7&Xc3 zcl_MSN(JgBt5;pO9F9nPR(RpSln5kiJmla?8n0YkG6%x~;m0_o_v_#$TQouWD_gd5 zMyrE?$`07V#@DKmExMOB4aZkr+rz`q~)uW?@37_1tjD5|+tEwK%^E7D&UR9WRT5Ak3uQbsgsu~yt4 zonKIIl^w(FCW-TqRk1EPF0uF$%t~;tuqhgFYO35z$!U450(p>55-}Dfo!YsTg@uvg z)Z$BIUnW{HOL+Qb4ooN?B`e6Jn#Qh;WEOenyXq4jKr%mEI)} zg>%|REvhZl3;5iTBG#<*x~B)pPRH~h>2(;^4tQ>RZRD60947J-u2550@HuMbgk$(I znrOVMvpzxXd>MOuW)BHDX%MS<8TBbI_Q5%gt}BtIby$20ApSZp97noQ3)OzmW>VU- zl~d-%(Y;{k{?B~lwSbWc7+&>;^68R?v>f$R`-nv~H=!u1IRO{i3US{I`NI@k3Bxxw zj_!s5{&(w8e$onxY*>pyk&!G!abmW^xyS)DWU2$of~$SkytN|C`lx+*J4~U3?H;lq z9dXbHwTwzgY_SD#)F;#KKc>Yd_{>C3i=_jBxbx7~Ah?I6M8QM0Vs#>3CsRA_XXMpjY0)GY`9nIJ0O5F5 zemod|#{D$6%X7)mbd0cC##U(XkcXibjISZj0|WZ|2T03SZ-vmD2HRG9;DYq`%|B)X z!%~%c9eNzi39uVob4r>Q2umr=@p>gG5SE8(x4^1I^rlXEAhbto{(&jbFXdp9X-$WG zvUx)sjLK}@p(*XqAYG2W4(qt3uKCo!cVO!nx>tirMD4;76tf!@a}tczc`>-H-x&t| zxP~xi?7i=w~Y;Nvbnh?G!TJ& zG!_ddcS07?;c;oHK-vI?MGX~FOBBcF@?xK z%pl_X1|kho7U5?I^M+j)W^=z*u&rOdO(0J#z(gM^wtFfx*#>Dai)I_aOKb}fH*03t zIWs2~c1loiBg*>|$)Q4qapn3G$N>P=K_2jejLYb6RIqsz$ivGhAEX+1*K&yp%%~$?k{Uz({xUoc(I0mN zvXSCu8$9Ey2(mzDxSt$cOXFlxY$u_(X+Db#di7L(|G9Jg(@qyySlglCOTb&fnoqLiP?aICvB)2 z7@k7$q<9?%j*pkXf+AJw)iPWxZ>V_817?DZzJss$NAQTK$@2wO9)l2LC%;am$It}w z3jl(-wQ5)0>4+-@w;-}*Le}Vj|bn9mXL>2r(3O- zV(5AGga^KW9{2(Ju07_vQWuW?tvU|71lY*knCh0lpl<0Njd@hAK=MXo9>ohJXLPzp zWsXkuD0O_QW0nYHbR`j?2rT)&{5!}{W zu&r0xpl!BEtF`Z&cPFVFcZA&#Lk_7>d)j-gY9(*IehOa_ zNg2&a$|-iu8R=Z$v{a@y%F*N=uNrCZvkS>RYEqjvKE6k7SFbzI#0|!cD%Uh+P;;Jh zc4At-!mw@iAN}XrI-Tc@ zZd_4nXja35$v}qm_r2;#2=0FGd*8pld`Nd!)vKykRj*#X_v%#*l9e8@#agWVa`cQ>ZX)j!l7udZz@3(q4#mwwX+yLn%Xdk{_*l{^-XPg5XiL3W0W=t zzOvV4gUH-W;Zyi06q!+}8rKj<(rp3?ed`5e1OW>fzZxc=anhHZg*_nijtq>XPog;2 zhSkSpv=+{)HgZ=104$xbTxPNixOVDiNVyYc04e8G@hr&DFuY`wqv^b{*p2vHW`S7Lx*E%V){}$+ z)%`2X-&c~1NT)|J0&4veW=EFbqiEjvQv+_GGQG%|qF zc;lD~GY2IwSnVwI#|B#&|DWng{LQ-d{`Ykmxf>wmAZJOImMfXE*e%A4AoeL*+Wdo6 zDf?k5OOG4EO%@)ET*tZ=6wR>{~U;g!%&4W z01>LQd|5tlHDzMWG#Zl7{l0Pb<^sOEr(!^ly+>H58=|b z?Qtluya8$tLB4>49<~pP3Zg?TUxoC#vzY;{GS;o4zk#v!-?ZT0or$WJgW|Re3`316 zk&-yY09rt$zn>a1X0T=s>o4ONo3aZVa!e~M-nWb~e!uik^&of%d+MG6)>F{7ya4cb zJmu_%nXwgnX(4B*b{(`hk&$wmjJdo(0ITnonv|od^_lMv|Y5< z3?nkOWt&cm(MS|o4sz!Vq^pK*0H`reHGF{Y){V$dPBk22fuI?Put10floEu1If-+j z70F*3t&{|rqL-zVgxCkFg#|m2G*}TkaTau@V#b5_1KBZJV0q2y2a}~0sYwVOK{F_u zc|M%)Lg)=7$EH6c)nRtph(Ait02rq9DHdksvH4od!dNuJmwNk=CpuYWbb)E%f1;sj zI#MJnV0*tgcL4>YQ>kK*h>Ht`hwB>p`&`8sv+)u<1Z6#1+XFWGi+Qkg#I1fIGz~W>Y;?ywrn<|} zuP;F+s}RDy!lwQN%F3bH$PAj_^H|=O*_s_B_&u-q&0V*k3C z)$}Nuv%YlOIs&%e?BeEF8dgCeg@+dV=(}?nJQOj))oY^BWEP>PxOy8J0Isr%PM`Y? zRBKHbWBT=de_;?KzX{0Ap&%EZ_&Dluevf%BnF=*3dPu>MM5wr|ICE2AZ#UEE~@< z$mPtkosN*Q&1amvk^V*9QdBuWH!!BZgP^8OqZT#E7057CQY~zqX*}mTQ#2kmAUTiX z9Tb5Hbiwt(cK-N0wiEb?Hk~0`G(qA>r~VItJo<-xW@~l#%K}A%l&S7OV-^Q8C?4BG z)uCvDd@t*W8v0BIiX1>|V`}KXe~FyyuyrsOXnA_3It!)q?|(UrSq>`9|H9#NltJ%d zQi0j7YRznzGRq>5^3ej*EDD@&1pV1BK{h0s^9ugxIbRMReOQGYFF296<5`7eWIa$ z>r*RtJRe4nGV?}{I{FUCb4~B;hENxFn=u1>f&Q%5G$Gq+jczDqBbHJd>qc!9ddk)1=H5dh zl19!^u1?u_Nvrs?a&^RdM<8oSJK^5j3Q6s$WvKCI``w3bjocnpB78eN)rY0Z_O_m{ z0f0rd4@O-vqi_@9Jg(yl3i!n;Pc>lv@*K8zzEc`@!l2fj8YgSj&_A=zu?yvo8A8EsTG~7LFQ%Hxc!`-pQ=>vf; zhqg^HXP`VrD|bS)+l=0sjFt+c{V6`Jcsrc{mH1l`0RnZZ4=SBp4NZs0R>TBE4&YxA z+^R(T9T&)_qbHbqBA;JjvUj+bWoFQFY9Mb3%=0@f%o6Wt2;#(3(chu+96*EEfL4Gs z<8K?Me}+4t^nQReH~ZdzL^SO8o%UA%=V^>RhE7f~Ci_+U8oJ!v2CQ!?@;)xvP{*88Y>PI{WXfKTtE;|gLtduU+zUzW zCnNokielR#;q^H=mDR%QPupE5!o4+G8K1Xq0@+xQLn<8Zt83E965jTayMK)X^kOA4 z*?nrw7uc^$QJ{MXy9s|m2z%(as9ruw*BYh@R01=<@SyKe`i~faF@?la5Tz6Qjw#*N zWEblBsO(sX#nn{;Y%XG=2+B?}-4&sD=?Ea*kU!gFS!v8LeWePV>Z$^#27iU!mDM$j zJxmi5u6KOu6V#C7L`)=0P{p_=_N;8heC@>Bvr^5%Pycdg0{Oglar=lX zBJRUK=}@i@pi7PR81o<=r!FYSS1S`zomTdgg)G>T6YkQMZE+GCB<4t?$%oWailmO! zS~r$$UH}E=02+kK?*%skDpCPMYZw|Wf4&)w@BNvfk%z<&D{wm^k8RdF0FlW}MSs8c zsc!imrKH<|0^p3TueZ}iUkGt(vKfD-Gz!89MY%;vwMC| z4$-s8c(iJ(6^?J>_T@zrw`zvlL-Z32&*#a9vDJ`KdDbytn(2}yzWZA?vAz#!v0UU^ zd_x3jYyegQ`tRu6;n{#&?QBLK)6-ym9!4#+9`eyK@Y&w5-vimMp*r50!1aWg^%hst zkN=WXPO{Oo$Jlhtiz8LNZ0D|C#G#QVhbxPUq-=8f$ukZm>acz6es|56PevTJgYH9X z`Jy73BT?iosHMX62%mxVb9j0EI3xN~WrwnY2ae*2U0@L)6rxu&S-3*=#);RVE?hw> zIOQrYgz+{8lC>S`CnY=ZdE9o@{b6IllU)w7X_>OJh=&B0JRXxDw*3+Ca-ZDzCsLar zmXaU9)FGQz%ITfuD{*g7uPcFtEW*P0!)f}$k{=F+anaOgmHcQh9LDf{CE8#Zf2dra zQ1bj>cngNJOa2kVX%KEfxqsct0B@Z1tD9EpY1qic#z`W^{c8CN<&d#-d0m&el3PGn zY31<23HNgx!0&ZvvJDoUI(Kw!Dgr=1x5MfJS?NEc zNu@oI-_VUTaRG&PbEEV$spXaa%*_j=T+$v$@fSv=+u)Cfzmz9#}bOqB~K{g|H{c+N+P(dnIs9h?okjBw>;%H4C%|s_t)_yFG zb0$as&D`6aVZ`CSpEu^TAjG{hE(-Eta8 zv$@@dQ6!#2we?^xD%KHIOep=llmU&CQk8yAzLhKj>iIyOy8_~64_UNQ^&ab-yK*a| zFkZgTq$1UOmSizP%Eh4VaFO?H<1NH{7740mnOZi2H^j608IZpL9sA(?$xW6r(OAE- z(x~e8>$gD9lE%}xD<<&)3w;z<-FB9CGh!pqJY`~KC*m=6?n>a@Td%=XWR#FIIP|Ug zLth2>W%`V?!L)&ia*($KavCgugwb_eOOCEF1L5eu{+S6N?moFv6VLf*>K`EN?gX)$ z?M}S+H5&@R(+V8z$a{l|G(e1O*!A9!VTqNHdSH7QZlIh&+XO>{?MI-c-#7(>qkk*8 zDyiaGSeV8PUznO2&te#aI^HyTC{J`-hHP-%^u?=#O`gn}Hv?bv4;M{2PB49f@RLK{ zg9VsI$7ASbB$Mi-}HWqLe=`Q9s!8{k7(k<0=-zOlX);kQeUe@PXKweVnd31Kb z28Scnn$Rs10Qw*!HKcYK?0};@452MW{>D*v%H|)3~pwrbT;&rxw_T_cZ*U_J5mI387 zIxL&dgF@0f*WsxIDDsgsUD?cAV1ktuIIMPkN{h`{P~af%)8`;lDddtz(SJv=Z00?( zlf1uoHvNw2@(v}PL>&(l8h!v3nhhz#6q+lz_JmO_t0X_cTL7zFy*1=_4)`)&Lw88c zy94wNwebU0-lxh`l|k+3R^_)g&k*j^U92@mQ}1_lkBgrj+wX0F4`d=>bDNM(r##;Fl(2C=O!|Z`|vd&h~of z7Z8)&=&}3#uHIogMnYIN7&wi7GQ7xFKN()+&;F{&AN?PT3<}}f0NVYD5E={bmQk** z&%Wc>)?z(HYu@H9++rCWef zIajYMA{+=s;}8`{i^e&>JF1FXh3`KLxr~DFRUd$QyA4%tX8jvs9SxoSX3P%|P@Y2b zrCAEKNmCTcOA{+9q>&I3!Vf{R;-!3Sn)$)SCYvAD*hKhf@>0}OW24N-lvoCQ1h3sA z=YtpzgG)9i+yiQ3M9?nT&HR0}k=W;U9ID8ZkqqI$VUWy^sbVB{3?hL9Vu$Qz3FB`n zp?#Y*TlVn1iuyN74*j{T5jn$cbu6ESCOk@=AyD~FF3Tk!+(nBcS4>GFtD1|BrQ?}o%;7fZUIC4peR8Mp!@ zWnrF-<-~uYy3(Vk-?rkPboz(ZASC=!S&Yi>c=L#a9Z?ud$+4PDgjvc%|_C zE4cIbxI*VhP8d%Q{P7hPLU<7ey>KwUQ*6ei8%PZr?J1JGwc3l!u}7^vtBTtNtrM*y zVmF%OW9U9s-zU4c50jm|IfQECSs}E~2Ac7J z%PAE1elLZ1{tMSy5+VN?jMgn|&^pJL*$@}#?j*XJgD4T!8J zUi4|=X&-%VR`TqQG`dsV%MScxwaiU4ix-&@gh4``vBl_Vp9aObJFuwxKvZ=fmF~jA zExhm+iWt&}7Yh#_j}PKD&W6MEW(;kdJ9nF?`)K8O7^xWEou$NA3(s$1T`#e&e?r)* zqm?lJZQ%zmq5cv7jsy()AEb#&{JTOJz0G??8U(!14NaPd{f7=!9`c|`^EB%;u9rgS z_cjKaFQwNL@kqUD*Hht*f(>h7OtmqR^*~X0kb-z=eYi_dOOg4eks40vRSc532~`Xs`5JOF(4YYfyzv7FY}dqKrO%k*?8Rf!=a{XUG*ad5aZTru zT}Wer+~i!$S!v7|hfqH^|LsOf@u1*mx z&6e1&A-=vZYHY}8-d8yX7`;|PFVUrP9n_+Z5#QR#N`y%8Qk`4OdlMV5y}&^kIlis0V185?J}o4 z@wP>K4d*qmJ;U1_j%>DL3h2z@=@%dMRo2jRZlHwdROM=sTDzUZ$;X>)Ht)XX?1lOf zEsQw}JIYzrDXIu7%vosxZY+_b!J?_?rf?Qy=nm^tkADBWdWf-mJnp0Nl|u3C@wh&b z&Dq^Ub5>8A7o2I4QW4~906|ZN#=RCH+|TSrbhk&kqyA-!RkA~$PSHp1HoppWes_wL z317f^-e%iQwUNTw(}lHf!-zQK5wLV>;*rWgK7FW zYL#6?!L=3ksnaj^(^Rp-b2TG2KQk8M$vWJGKzQ(}Lk%DI?hU z3UC8FVQ%C`nEJEVqWo?$J2xeRq#A;STG)cew3H`yS#%qbx3-9{gd##1fBdnPe zfC@k)_o?1yD$X=FaK;9#nz*OhM}NtP&H~~;D+~MlQ;RHEa z2>%f65J@uMD{OfJ0la&03=6$GG;yDs5#rjrNY!3L+}kp8PVicWoBUK{1w}WF#{+(vhD8-dnat%QQD1dK>^e?EM$mEh zfb@*n7SdVR;nPAhFqe;r+lXaYv!ryJ{DOO6^9Opm=_&#g1i`t$ONW}KiZ2Pz;fWo6 zDwODbVX?s)XvjN^sYB&BplgtK1Msk-i1-q$7uC?)=;^;l$`7R0!CTIvTRuldj$0;r zAyV~@&)ES0lM{KcxE;ZnW0|pIEcG*B{C#oycb_AB#X}{wLUH@@r9?y4j9X^^cnTSP zUMe#BfU_YV%|^dJk7gJij|ALG?}V&MzJ+EERgK&j$;oB7JBN-3OrqC8YEoy?&(00P znMNfPrqI6EMGi%;rfTEZ=>XEBd@=FK-pM3W*uP*Jr+jLa-ty6(j4-`giLJM6Drc2O z8?rO$JNmCz2YtQt(KI+z1#M=PqIdE)_mis5<4zJ}JL$jgA9R#YfhCH zm0-?|KiBPqeW5KeY;1Z8Pn+?eBTCiE)d6X7iw#7>`MY^JbFqoSK!8`68YMf^x%jqh9Q-P4QY1G5N^}eS$CjQ zf)Y=Wu@sM z9w2;r4{o}ma|iQsUpw8r?ZPkLRg^m2KF6|dVzrTb8aL&)P*keTNE_sYW|AJci*%Y> ztG&!mK8Ni!|KZpTXYc=EInkkVpaduW(f=I8#V=1ODl2eG|HGmVu%ckj2XRWI!aQQW z^#LpWcfht>ZR~cJ;F+Pu8qyd2B843evUL>YNoC2iV1keCe*j(HU^s1tcup~L zHcn0+2(z0>Juq-a;DN4PhFD=BMVI2wxp}w6@lL3 z0v6$gNCTRl0MTwnR;|qS1$Vb;BaVLD)`}+$3In>)jvgd)EuX+aZ+`q_n=j+b;wfm z8uy5DZT31_VD{r=KIfj#%MUBp^3ek?xb_xu_@u5aNa6ZUPFmJhHjpmg4hT%TMIWa< z(mj;2qwQ^ghD19i`Z-eTAeB5>$`NnE=Dngm&XFnyf#;*VTFC=Ww@Pw4V#iR%OThI`=2*QphJZZ`{n~J_Q9p%qjQBQXTO+$kUwrXY%z)9`!vT&;mJG>_ZC=*WFD_B8RzE#w!+?cYiE|g3RF4qdATfKS1+p9j5~HLU{7*O3lv-XYiR)i=3{k;09QXvVk|`Cn{kotaccuSd_8adGjH+B#~np z5IM<3YA-ybEf{feu~w0@*hkOY&knSp`GJADQxSF@r#!{yu(`qJ4?whHyjp@NvYp|b zIFqW$49rvmf>@6{U5PlKjO3v2HpUI2agpucF^O=4V$MG^7n`$B_U70ae8byw@X+`0 zY3=S*%bikZfWsdUgZ_kB39A!Lra0u0#yV%s@Yd@8sx0IUb(Xq`Gg7e%QtpH`oOA#y zX1tC~VZO4OJngJ;ozZQ!NNG6Ic$Kt&C&K1%Xe!QOpnfs_xa#3m52r-U& zbdV1V7XvpN6TKji!{6X$SIDA-@TeGp|0w6R)%IsMVW*b;u(8;Ac1qL4Nl-q6W7}F=lHErX`To zEhn{Cv~m4vtrM6d=C5_CeqNo=Avc-N!_)2O<(ifSX~0270S7UFgQRh5#|0ZlAqRPX zI0w`h%kGcI zirE=4c88LneGB`s)^RtKywIx7PiV_r2^gv90Jl&Xm<=lj#9@=_dc_0`0Aq}DBALt* zpmW@da4{JeT1<`tyOZpL{hfVdFmN%2} zSn%J1`N)L%NM5QtlxKMhi-kD%=`}r&b6PTI`cRsgqX%;2(x2nKfp{@eEziu8>Fll@ z5Bk58`A*eJN}b9~L;74D&yXy25~p&_0DdFokgcqL$i{7Dw|fzv_vO3UNeQ#tD#}RF zAfDNVm>@qy7a}Ff>F1Ht{PnzFu&vBx+A~G6gse!$k8tisczGGjCPs*jcaryUnk2N1GlAmN+Kaa@Yc5maZ$OY; z#Cs8z{7ISmy)bu7u&rz{G@&QmG9W+>ITM{(ycZ|U=aM2q9O~i8_c-+#4k{$yL$)A< zG$t?%(&Zz(3IK}{KwZoy@v1ZFGINM78*dLbW?JM-MtCr1zDjowBhf_q#^y2<7XT#d z26?7Gi_(_%W^6zqdj9) zXUSvT<8g(B?)E0!OcIdOl9DXMsJ!+t$4IrQyg{!mhD`+?c|WXV>^7Rd9dQ4^XTBc4P$82Nz+JEe{z^XBYAdJtys%j}3MC36yx^Zw8|so-UhGAz=lm(fNbrReWzbI|>p zD~z^la|VXKt`B`Bl3yn8tgbO+Uh`h0J!jYfY!JlJ$|j|#Q{8>?y>tt7CNrxgw=BjS zPr9eX*-p+C+{ppHbqejNjX9D-Y0OF4*agpm&FwI0D_bU@VQ7<8`OO~4ZrwBnceI85 z?E&6L_Z1?oU&ON|PV&P;?0VsLVL$h<(#@`QYneD#?+o@&k?o2%FGWuc_7}=Fh$LbT z2;f`iS~T%U7aZZg0-oTL5FeNKCA`OXl2%*G+;T$LsPfoHdq@H*zT>nxdZ5EAm6&%D$i27Q>65!Mm!`FT%Qh2ythbBth!L2^}>+6gtYTJ*1O6@@U3ZIa^W1iIxMdZ<- zVWVw4TPfL*$?hwO8TWudO|B}}xHZ%IK2kolNshwf&1p)fRf$>UUUDef&D)~*a>DDd z@+Vs~mLl0NzXAnkm~a;m4k}pACL!Wz9y)3DrQspt1^CRZz~}ffe9rLTv!ocF^;>fr z*eh!pdySvTUa8aB>yD}HHRWD-?RY+QMH=cume$AEn`>PHZw>ULl^70pCxHK@z65L= zPonI^#MZ~qb2POAp6Q$=(wVw|r6zYN)$nP^vhxM@c@{p+gD9=r0VrUlKD>JeugJnP zDGghXqemoqCo3fg0J<^2+>0;`SoTe)Qo2m1L{!fD#dpFPA+V{-OMs~+#xns8? zgz$j-ZjTT~|7P60Ru1KZo)u%4A0D#SzwEH0+Lc~Sp9UuB*HiJ}x7}EmXRPC^>5tp+ z;4b~%w~|*bspXt`Cn4IdHusi0o|6|<)75QBhqC*s>B_dGJK1g3bV(b#h@d*TV9|=U zAy=|Azdz|n*5cs`o-2M%PHS4|K$Wm*QyyB7=uG- zeH1fyb~`~sO)qzVddSwV_DVd8k{sAIICaX5b-l=&{Q(u5mHE)U~)ovd*oh zi}7{_kfE(D_J`W#3juC!4OMk^M5f>GS4;4Wxb&`BK$Y&Pruit#Q875H#4mj-V6CD{ z0ovUTuxZjG)m1*)6E|7Tp}GsIQ6!Tx*+7<9V)Z%`7~@vy-Tmjq{7gis6>R(o+ia92<@%Js_&_0L$s zG4lc{L{KylbQ)IInNnAmo>D$1IBS`76|ub&chM(eH4^Gj!I`(o9O==sToD*fF#(N$ zHXM(E=rwX4t2|}d!_c5E`4YCp4(ntU!;uFR<`<_+bHit(lJE)K%a(4Zh4-0_%xVEG z$YD0lNW0NeJ&W>55E~>wQkA1TR*k3OPDp7TDHiN8%;1b=GiPF0y6TonHV}>s>!1RD zGvR%TN7LD9(bee?RoOgV%9xWpE4mY}FL1Z3Gaf_oN}HJnZ3Br#PJqykR@ur*t?>%Y z#-n5+8oNuN&e>}p0l`p$q0^Ykm zSU^Q9UTvVVYYss6vzd}!SNr0{J2wDUcwmf_SfU;fut2zL52Vz}Q;ZL>RLRkqiXhCl z=QeX=Nr`We)5$xn7_Xu5r@kmpzG}YyLP~IJ z6y`@^N9FOj$5&lhi8nDrR_fNJ`>SaCc{Z<9G|%5&Sy_c=%?bd@_z+gcY-Yya`5MZA z%L<$X{;G}K1d4F&`V#j$66bE0gGO%LbSu9sgjPcr&YU1+cxL9w{rKoD?C=l@^Y?sm zw#yDE;tHM-!BctABXplRm6OqE`>$Q<_a_a<=52OQ#Mu<6ta)qU7oIoVop0bTcuHB} zb}7B@SS#{>eML2niIMBX`xNDbOO6}44(#e4^RP3%c^1~h9)RNzPQ2n0dtB%cpLSpo zl&oilp+iXrER~r(DmwzzcS@as71S+ zB=kvL(Pa5?vZc)oje*c8AFbU7jopvAXzX6xJ|kQ9-2_m41E84!82hn2T5u!&mVNAe z>z0U_u?#YL$QD$brVKD2=J>17$6N4J`det&DD3pn&so&5Waz_Ju`tX}kG#r`nrjC> zz$GlLgbqL>#uV*FtYpDQ*Md-CJV<}`D%KgWYnyyan>NRH<0=0UBn_(1gzD3LG=u;} z-%Us($z1M6^ivqEbUNqDUDb3225?jd`wwOTUiMH8WXO6AxVX)Sfwtj+eZvEh8v($k z&R5&?tcguJu_fb`XA{U*OS!>tyVEP5CR?zDsaP1qF)WgISV@~Js{oU2|DQ0aU5a-? zgbnFIfO1t6&=I7`HR??IAuyzHuV1>gnm)?B@hyH?Xc}NQETmP_4R{Y1>8xuvFa3<5 zO803eC|}{Q(F%Za%&1KiOpz^hzggW;y7xb{r^} zTUz-l!ftb5PW!`-c%qM^9tBYULCh+jYoD?UL_;W_a?%)uW=W0;cH**)!;{Z#BiWPV z@i_v&k?sACSu}d8T!vORuBMXae+_kP;_v{*CWkAcZF0Wy$}8+H5a0xb9W9Q$=FC#B z+^79uJUga@j#D|-<`Hui%6)7M(PwRCKl-eV8}75V9V)D>(ZrC?Scey}M$yRpmW6rT ze#I94=1}T(K;Pr;Tyv#GYzaj=!Whn%3bk4y>^~&zx493kA6*#r__Pl>2fxBEX#@{`{|^2?%sh$P7mKvemhdj>lL^8ifFvDL$_CmArWC#j~nzrsCQ z1XAZV5C)C+%bAzQ3{ouW{`wDqQlWxfZzVTtVJ!j4p;Ghq(8Wh!Fb4+I@h@fI?USH# zBv)P|*8|1OtW8KF@y3qmsrc2C=1&VpHYpN=DYrj5i_OyOaOF7zECJXy# z;lU#4g6@{!+mOhYxyM6k*17KZx(lR{FE0nVR6Y))V2IsH2d^}Cb5OvV80iGOI!n;n;sdGG@N94=oG93xM68ju)=v-hM&w1R@b-hsb zCc`3xr$ZNNr4xRG%U_V^J@e$Nz;x*{C=`lRD|y|fuH}KfJd5l_|F5DMI8s7*+W>Q& zAl`)OFFXI&hS7!B&sw^HkY4~khlfY#^fvRz)s5sZ1b)A z*xS+Cmccggfq>$vjm~cQN?a?VqDZycH%xYPXH?Fz4?V1M?VrBx;bR%$` zJY*Nm&5?dg`@&$eZV2sBY&H%dF1>+@4z!?`Az+1u1Y!! zbJ6+(gO1KRhkihKm~cT97===T^1ekL8MscX+4a(?&LK@MImIeLl3cwHT}6tomuBPw78yxKz6g=6Z)cz#BkrS5w@h&)!I)bcI`!-sE-SZ-40zu@BCoPuqzNgIXv1 z=sknA0pF7HcD`*U2!@>S(QGpfQihCJ5O2)DzM_}@izPDM2MtPSXK$~rk$AjR!QH?9 zR{AXTOJH=JI@QD}%j_o7p_kxQ7NFH|&3XDqT8HP*xvL(AY?gwEjPN-GWZ1lbom5nX0gtGBh2n%@_7dRvoYxVEY*G^xp zE-19|nx^$HVR(&TP*<56Z;1^q>0S%{ zp>Z6!{grUWH%F{RMAT79bmqEW4rOloP#s+cb<|0x8s=r~57*0OC`A>j zAE92(cK%AT+^eQeU1aWN(27M)Y=0$o+UQRN9OEq5}J`B`> zUKW*?qJw%!DlRe=7FOQ5c}Sl|_@X>jxqpJBVPl%Gglc|Bzf5qefnnhE5XVg4w}T+} zep8dyJhP_xmgluXf`7i+_e&+iAEqNHkYDoPBp3texfS?$7Cr*cmT#p?621dTp~mRT zQR0EQKhb%mbew(_=Bv^>$g9Aj7Ymh1xHZMC4Z3yYdQr)JDfI)z@XK)@H0o(x02WsV zZ%Yo|mK3~gG8rRz+^57FG0eh0a9$_|C}2)eHSY_*!VKl9BHwQf>Ahq#p$L zVDNL=ZA$ROL}j`!n<*r(O~vCR&|&c6Kvhv8-5B`7pp<}$89_bK>6ky^5M|+Tac4JD z3Nq(4Btl>@mRyf4ndn8XsYhK!|8Z?bI|(ojhB~?@85J5;A&)!;*yfNvqi8KgRSL2m zFlpHRicn)ExT8%lYH>NORp?Z-=?806`hLyk-=XTWGjyi@s?bdR*bV*mcMI(=qpPo5=~4T-6pD^u zO2e^wyf(A>D7u5W1Wf{VI(W$d7>^Vo4*0ajd|A^xImFwTFZZ=6eC;&$!$Yw*7li#% zUou~t+}AEgUyp?IAo}sOp&wi<0N2LII9>tcF@T2v?!y28jR183YXOA3yH5D?ww?f! zfJwkS3Fb*Kd%)}gvlq->F#Eym2Xg?-fo3HxLo+?*pdLQ1$162Cw7`vFMz);loWzW1P}wRh0+hT7ze z*e0piCgodbo1o{rIe5Phpar05o??7wW4^-oC9S=$Xze{05jEyb@)K^WFTp2mg~kY< zcSraGPvJKEQsMgwv#i;SGpW&W>%d3`NCB7vFcV-7KpsHJ9kgwdp{|p`Oae0rOdXgy zFtuO;!MsZirW#BYm?|)pU@D{AMyw+@{9g;u2=Kri5p6S10lAK73;G@14v}_IZ6~T# zz!T=GO&Na&mKSH2G&@5(aIybcNXc)JC&$|@9^1T>zm#10!q7rGURBW%?8ZYWk7aX- zL{6P>g)i_a47rcVxUr9E{mX%wZ=i~4RKBi3|7ia_jLg^dm9IlCE#2Ur$wY8 zp>o5OC8%JV-0-G!LSi6b6jzRLuv{k?)wl=#3fu!fR%jI$b#Oyzj6%5`*LsGu1SnZf zS0y)_3&|)LXU6aI9nj+1(F91f$*5{n1;(Za^GliyDw^Dpzl4&@tR3J+NwpMEL8a4e z>noNmKNu34v5J8=IaMOmYWa)w-_<0dHuL?Q+@F-*64)qyD155mCfu&RvE~Z$;B%C5 zp=^tP8kzQ7h;biV zY&(@9z+F>6Ehx_7qaW1I*KAZ5noBHrdQMkp_Lss~tP~F#K|md8{DgY zS>UD6to`kphWV(k;gqHxbwcaE(`+dN6N_}USfp+<9_Sd_Za=i`zKM>mI;rNNp|G-c z0V}83V^9gk9>Gr+_Fq)yOu$`~b-0WZstAx@F+vr2jVc=hrpJQZPC^Sm8L!+zogJv$ zUO0wK1eiU-{=Ras?-1J1RCEUN;T>oBaoHLCbar=s(D{$fV+jZO-o8^p5BSo7kGvFZ z-{*=>&uBgPTch%5^x(H<)WTG7xMFdNF8u>|Q^A|M@BO}GzV{j7knoQ19;UN=pO%T3 z)u;0zc(ioZ5nu(lg}%8;CWjg1W5_rb7z+GAF)_9xF>EEl?NqETgIrM&%Sy_*~_i zi(%#b2jL}?BYqm6#Znc6;t!sxRGBQnF_XpBU3ye3kwy+ZYnP?DxTna39t(qGrih0( z?gD&->K?!oR?~Lk)IfU-MoFi5J{{IAxJxoiwcO~8alBUQ3KiHf5G{ke4jb^3mqOUi zUnP2ptI+HjUEx)F9dBeCCS)45>)G_TGfP#P z?falRsR}JsqbO$1qcj z!0h|p3hLXJ@)wcYo(|D!p>{m#scA`A!>zDDP^8I!UdG*l6BbJiLLjhu(?C?0#G0q_0MNBj@U8t$k=$?WuhMx}Q zmdy)CY7QTiI7w&I0vDqkRH}kPr$0vb^3|Sb2x=N|m#1_=$rKCu=6R|YQ`7J^L{HX2 z?Vv#K2;U)e4Xv=)zzPhDTKtGv^u$$)?G(6;=H%=QGz58zhy&bA3-OByaaTcW)cnOF z&Wn+_C&JB5dI2H!lU_i{?)BpRlw--~kK+PbC^I`AN4;=Mh4#SP;^k>2=|SHc;(nmL zk4NtZGCn>u!Exhh;N7_EETrk4V9+8QBZGJ&A$egNDmR;Oxuj2`HU^>!TqMj(h6af@ zk-7I`$u}hXH>l}p1G-rgu`%vRoQysZq_-B~Zlus0OXlOzb1a7*8_I$jFG1nd7#DQZ zcr2-fT(@0BMhi(Bro)vkm;6=0%Z z2AUmU*9(xe?L6gMjQz*uTbhS+%C}M+_k+<0PzSIUzzt9da4W!)Z9kQKi-`$AEc9N0 z4uIp^{uA5xzRyp-rSbkB$+uG6y^x0i z0402?0dxS#04V_1-TPC?w_+Wc;QtbUN`UqE{zURE%NZ=RBP#fzH^sw#P-p}(>8Oq=0bW@#Wk{a|Bh zf1BY9lLIkT$%1Yjuy1&)Qz0%_G^3q~caYZ)9_z5{xjjfTk)T}nQm|?;E&*WrO!$wfeE8E zsD2~#r+=IJEs!EKfUwU&0@msKWTU^hSAU4RIQ3AWiRx%Z#lFDk7xy;2%^4I1ZR$SY zG=b38_6x?|Q%`_fAg%8sUpqwHgVrd5p>+?Q0V~!jI#Q1mRWXHRgE;Goaf#XSO}Gy! zBH1{GVRqd|&(MllOom{{4Oa~=(f9ZbC;i1I_$$b!UDE#lU6Be6s(>!j{inc&(nH{$ zNu*>K9%m%DdHkH&L$ih_Y& z*jJ@o+DY`Sexuf-@Ed@Y*OG-TL6m;{hF(p>5#)s&J437q;pnSMLV_~LSRMPFP}>V= zr)byr`)h&y@6q^<&=We^CfS_JHT6&9PTNFI-58gj1L<_rNpC~Xe0_)a(&ijlT}C_~ zpMx%Kaq&Pz4B9|-(4a+CDTK<$!RR{T<3qw0Z}8O;hPwg9kyvO;U0rQ3o_nb+E>Tc4 z8H0@rVq*dm^tHWwEOmION>&xD3Zj(3d_zSQYOMtS`6vM!w3^NNC^3!^6k<(h^D%WQ zc_5}q26-3SQw_b?+E~JdBXpmYrXH!^q9#rK!L_mZ-CHR4maW-yFre}ED>q&OiF-yb z((KV>*S*vQGCISNrb{(@4r%`E$Ipg?d?FeBP)NoN+@7QF;FXI0K(>&ec=L1)lqn_O z*Dr4@j9EXb=~5w~aq;L0`6zmXz9#0U0(;wc>^D`iA{2wk#II?|fVE1k?d>EupH>p& zd#e~p7mX+yLlO9yAy)EvT!!))PX?h|=nZOICtq+UZWu6}1VL2OP)il-^w4|56c{w{ zE@0efz_J!DhRmCjVw*j3S`{0mxJnlg}BGtW?s#vVn zG*se??IhC;sRyN#86W_*(ET3|MJUkuY==mj5AFC71v-0oP(twVj%WcteaCq#(7EMM zwCo?DK$FRwfS17-LOOXB?6_@BMP^;Q= z=)V8JMew0)&e4GbSRu(3a#TL6lJU!iW+hcPsg?LBos|UPptq@5SHD`siNksWFxp|7|`O5UfhxHwAQqOZ8FN)FIh)PYQ1qOXtP>(h5&+EbPfZIzuR#Oh<{MrWX1 zci%y87*pzFo|J4hP#X{pXFVGfH|jaiCLDf)Fi)+Ic|r2NNQ^+MkNJ~iGgq|H>0|av zHmRab5_B-h<}%SHSs!yivWXLISba=~Wb>~rG$SecS%;;Je7c2ZM3iSOk_JV1@DMrh z>hgHJlW3nzvs;-G_!?L<-@zc*`&wm9vDB$errD)T@qQ_^0*k!-V8j_jRC$66@X{5T za|C&oj8B6=6SJ%`enR{S?n=DXGDpr|29_6PSrtHYTa~_j%J>uf+X9fC{dZr{(%I!} zk?rr>M|S}vHOcYrO&R|MWB>vk@7srcko#SQ01g=cn_%09@xKo7zv^q12O8-#Yj{R| z=TSUrV8JanCBhj#3rTqT>3NpQ<1}XT%eN4TPTYO!AlZ^C}?@6_6W}gjqAGexl4$){L@@W_t^+UMOFu8vlcQ zQt(~ea;2$9J;NL3Yzp=SgB#b(Y|gtuH5awzt+|8@#sRH4px@6Ww=;(iBPlYGN5n%v z+^BX2m;QV$D%@hn*_)L&n5q~vdB1~_#S*hfDM7x$l<*?2Ag{x@EtObYVC&7~xlic= z&(Z*&emb)>S-7J?L!)geUwx_Mqu#ANBfe|T%E1^3P!gN82=zUDK` zW?V6(SW}5?hB-J!9YUSC=qoTL0(IJB&`M5mL$~4Qf>8%-NkK*ur^?p9!Jmd+B^Y$6 zt@HH;U9Akb65Y;YAq?9s6ESR;bOyEI4Lkr_%8D2kOWTDFV^|7en2utYHjH6x2*d6I ziw(I|UFmNx>Fa~|J=aBI*?lo*V_A0ha4ZAH996pYW|sD9>gVDvZD8=k=0F@{#oPWq z!O?M+nx3x_J&4yQ2p#%2{KkGweJewC_^KHtcQs&~rkV zgg=M;n9aP>Y!1YRu&v)>#OeM5qo+QgrrF@T{$Nt~<;T5OHLvT|35w1vG zKCI)?8rRZYYJf`ID6C6!9cBD`00-5XKw4nX%BEIr&9<%~3h`3?Srp>_9Y`T2Qwovt z14Lr#0G5UwMkK^>&ul3vrdzwTk7v_+ygq?iFBR{9I(skL47yEj{y=&MnO;x#qG<)w z@fa7JsRyP2|ip?R%c0;Cx+wUz7#8Hevjg_Nag zVgGN04iHe%52YUReXKzvdd^GeO!ymrlK{nk)A#X4zme#_<}OM78W)=;g{P{Fq~Rd9 zMkqxEJBoKwJN?Bc6~|KFgN`lmCxzM`@NnvPI0t6dzs1k$d(YRZ^&3xwYT^XA8C43f zfY8M!fY_%RPMC@c$%3I20+$a}o6yaIISj1i|qQp-XHUl%2+5tsU zv|e#Ap>=8Z6G~M2D%r+`Y_};zP1scm_^ZUjE|u(Y+}W+dv){O~zdy8jz#`02f+dH- z9G=8_cPAq{gl!}qwZuYJ@0E^M8-0VaohYaAv8S^a%lHJ}pqx)WojnC)vMM>r#XZL| zp`T>!rPDY|xnv7T+e@!r9;1wsl0}MRAzSfSOn6qVAtc$WAfa%$5hTtmr? zCd=u?ogC_F#D-dSa6h>ptad#RF~_S8b5vEaxUr;Csm0M=g;VmuG1Ei@iNUsxr~C77 zu0`@s$^O0#Lu7wuI2u$XVobto;te_|#}R?CQ1$v$J%K^(Hy-xa;&lp|`W5sz1D*}S z$xnJKv2Z0aPTX=|Es^m{a8?HgCS;O-L9Gk|e;g=ryWuF78ON++k|G#tfQxG9G9)f)Y6*;v#~~=PM=D&D*Z1+zEZv=Sh2q1HXh(_S zuuy4k?TO6V6Wp<8Jk2j-`PKbcfeh%|IO!4su51)N9o*<~)D%9v1odiSZ|z;0A>Qnd9oYhCO0I@o326<(XC#^zb?T~X$+ z+nih}yUglY^-(n?WzEkiwKu?COF<;h|vP4G@)?OxXEWbMuxtHWN-mbt2{t3^4M4x&$)RHBN#P`Wpg2EkIikfaxCv=ITt&joaOA*7#zaq=2X}nHWrEiapc-O zoV~(chKX2tuF~bPbL--1KA_0 zXP7I=V`K(H9}0zWO*>{5?aFNxR^Gu~jqhcZR&bpf|09*hPPLYm+1#O&+%8BI zV;3zU+R0L+*!(kRrl(&WAHt;&5=Eg7?_BM4t%16A(@ah9#*6sJPW9NzTu!I0jDuwI zJT5mNQ#s^nYPEGW6sXe1O3oN;jh(Bcc3x|>jWq+NfbGh9Wa{hQuaJo3R$tpx-wd@(UJ@93Xem!i9$1#pss1V3FC7hj9RL%gN0(m==S3 zMD>Lz0Plnfu{&+p@g?FAiN-(VjY)G)pMm*Gb7zFYm_^Kiiso!qJBX`OjpWvgu*lq*DLu#A+5fJsRQm?8;aq%O{gXae@w3(-I1j@Aw01ezj-Gr2&< z0O1w_o@I?1C8Dd8$6T>Re>jg)-O)Oe(1i)3IHnVNW0>hPu1lK+zv);O2~lXdqz;7d zxh{`kt(`M@TxB-QaJ9D#h@dU4+~Hud00#`tGFQ3H@fstU9*B)3K0hND%i6QZiI ziN5SkptgVnw~Hgh;!27Z<+PJPNEVP0zS(s^?<4b?#uiWvss`!-WnFE9*s(Ysn-__T ztAYj6;=sh9rZ7){Kh}mN`6EvlYBkq>VJ6)^MhrUe3dpaZq^pqmFqFhY^T> zTBu!SV7Z+xjm{HjXU>$aBJXmwGF7FA)9^)-E1eGQdeq}RDci^clpDy=w}mf6zI zzdk~Fn}%s%OqjoL0_BqXj0|+=oz|5i^^V9wrOoOVbBq428=;JA?5<($77jQ2oZ-A& z`3T`=VK_GrrLVDjINs_AHxRZY^@#pvo-_UxE~gE8{IyU~V6Yq(aVY-jnbGBTxou9` z)-L!ix7FCoBK%5qWLxWoeghbTH51ua(a&|m{8R(l!656gK~DrMSUueTx$8v=RBq+0 z;5|`n^5LD{W4n#Fc`+fxlp?8x!8iKNIHzA2(0TOe9g3IsrwSlq9ClbY(p(x8$(o3{3}dvHd0bvs1;<+K zv~;mfZU2pyAt79VdCz2T6+6byBS zTwrmbiX3K-6>frAM=lNl$&GYek9z;Q>L$y%ru7 z_+a7~l?n_M{P2@0a5!wMpek0bgXZ@lh5*gLvBZu9-v!j4HULnYbAm z8`vm6u+T+O7O<|yYIk54f$9xEvHCst#R4QX(UA=;ibNz zg>7_9b5$eHOnU-;-{^6zhHmG!yKT&3@CfqGIw0Q8)m{v5EuZRgIwa2ByAF`Onzo53 z9(irH)lyzXRC3rVC_gQBUYg&?)C-(|=D-zu?ASL7u3bdCfXC&)uJ56U9nJ%#2AHn* zhwQLhot2*u7Gs_YkT92rDjoC4MOk2;`LfDTR+)lo%o(t2SawFNYZi!>m-9x}G4&kc zcSDtUBajLZQ9Q`hn6U3tRvvsi?X(>h4(oDEWV_+W&XH zlw*RbplQ+8D7SgbJa#t}hB2(Qm9Zji7|K(QXBCS)W+bjeml=oBP_D5KLAtnB6f#1Q z6d<4F;oV5$q9}hvTvFDCzG>bd=7_3i7KK`uBDx!Eh(k1oFhh8V7kc1DANa`R3S~@e zoN82jf;w@uMtjl4m*~cfy)@~v%dbeja@E?QXyMJotX zW6U+UEwFmIoHFECOfEO?rgq}D7!6|-X9I3@t<7PI&4!{7XB%5rx20}V9S|hNmbxvQ z>vS|68e$k`+O#@TT_aGJ$&)fnC3Qe=fGC+vc-VuTT-R8K6E8rPDl02hs<^do z_Zqi5iXL5faAVi--{hemdmg{}Fj9>4tN(#tw2w^@KiPTyBExTv_{q=n7YfT>K!6`; z)5`xe2FSv{^L?T)Ko7|!n+576BUu$XIxBtNFZS5Tg54~~tFK@ner1R}}j{f!C zza4w;{SS`+{lkyCKK|s>6Q6zl1?m1r;N(BQ{Ho{cZ%+08>vUiLnQy-v_Zx3we z9=OhHVEeya{{Qv$|6`2Bx!wPtsQ>x%v#P7JD7(j$!!w07!o%XrI(QhP@!In8Yu8bk z&13`~(n#mrY}G5p`MZU#nxXeaz}(@h*#_*PWSPUS;=RCq-^4p;95;b1j%E&U{KzvJ zt)4R6oqbbquhlja)CWhDAu7~$?#dBcd$myhCJ+iw#b!7LGKjN;K z8tvXO%)K`)+WkO;`|j!4%xlv}j{ooJ(eB5Fxi`%U*Ui1N&RtKAtdY~P&OLWJ_g$aO zJbC@O-QUg5X5P<^c5fLLe@5Q9+dIvW%@_>P?nj1&|3k^h?)NN-cE2;i{q>u(nS(cv z9Nuut$n|rNePs8!YesheYTd~AzNvQP{C%`(?)dkC+lK&qBi7`noPhD5m0=nq>}G>qGT1pj4%=OWml3vH*lY2>VXuXXS>g3M zR;;pdE6QBX3j3<;nM_=So!wn&^Q^F!gEccMZ0{A9sYM5wXkW&yT~Xn&*}x`7w2{6P z;#axd>vmYzt)O!~7+<_-Uukugdn>K0Z7Xn{llOvCqUeH?@7WoQM*I>N5LY;DYrrl+ zv~#VjT7gs1+0$o3JBRZjdSWgTZPs|~oGp9$jQ?rx>O$kFqVUP=+MhJlC63azzbQ9)>| zHHj2yU4zYoLX;qV5UUW2-?{h9X7aPP1&bK>z{k1&bM85J_RgMjnV~!Faii9rwgkH$ zS&kKs`C73=eK^W}Nk&s4Of?`!b{jhqk+^a$hXPybZ9nrsj`)hawj*sHmsGWdlM$-| z^NUzsqBGvx#bqN~`e&Yf<_0IpSOLYhT%Vqrz%zSAkFRsI(4pdbpiW zpIE7EjpD*Tamg+##uoE;cxfnS&a=h+h%8so5if1xoJ35UIh~HGhB>D$`Jkb^g6wIw z!aJf(F-v<~H@O1yq};BgNyeb^L{LRjc7)N&*&9zscJESzm$&tt8p@&~+dn6feVI7nuo10-)qKz!6R+I!nnz~ z|6J@Tkl^@o+)H&V%i;>UmZ3+8LQD4u5e*qNNh{V_ZN-!mHrk}859?gvKEc+eXGI^r z#kR*nJg@Yk;s?Q2tf#or7*ga`?W?H)5U830a%vkl2Mz8)J0$9 zLmWvXZOvetZDLBOyH|yvwE^fYz1GFHUfSxg^iJh}=c^3OYZammtY?-oef;5+!SNY& z%g{&K&a57`JFaqeehG9|ZdCfJAh;?+3%@gu`T%MB^N3!0gnW^rHbVDG>53?!zy%%K4iy4MCQ&bgRUlvVXtulX5$+J})d}udRZw zO!Y3{nG2?R+sdcld>CsJI4{@PFHQXWCAt8f4?Y5ZH~3!g0zUr(UI<!mOAyJTFCl<_*r7jSv0ly8;1SMol|S4*E-DGvw_$@ovnwIfpgoQk{?wex!8 zID*K!LfUtW%ss+;rGCHEACPel0ep1tZOI=Md4}bB?@9S-k#9`uFG+pDO05f9XIFd7 zn*zU8XpPv2UoGU8^qY?Kt4Q1DY+iGuUw5PrI?{(6={FqdK1bRmcI*(n%;27%1o(HL zJNL%x$=OQrnXE1DlYrg_ghQ~XFqW>>f3BWVBGP--ZX zF?+6SZVEqjlkL62KS2BO!5;>T=*Pk7!KX8i-*r@_YOvAPq;{uDs6O>fYRlsG7cYN5 z^#{?zUAm`B%I)~2^S{?}q8pu)GZv6b$hpt_j6Jkq(xi2O2gn0f0d9bR-@n5?1WW^y zzyvS~d<=XDoCHn)$AJ-G7#IMK0EdBo;2`h{Z~*84+JP2n-vB%bR0HL}HefTb5hwwQ z0S_>nf*inV_uSsedn12xZWw##M6UOS*eAq$Esycgf_=E;j=nfFRY@4(na-dKY`~aPB?h-uvv_ zoaf%;gvJkrLT0Mh^1u{N9uqzP)Vz5({kis^;>z0#LAu0u_hZV@Y!Fl1*NL0y>lASg zL4SJZV>DCn$&17rHkHvQPUfFL_74>>c^^!{%B`9xxwv zmUy8uOxG`!3wa>z-FYgt!}0;0=O4|$^DdvE&_!bX4?52+=JTNIoz%a9D>xzixceWT zFphh|*eQb%!%TC7TACDj<9S#YTj=c)1^4ZE1<(ZlgVAWDceX*J(E#1YL&4&?1dkOO z(}PM2320ar#2O<=5Hyqi=!#Jz;YPKf5G%000>s$HLcwA^78D4LkpOGN6vtv&+Rg&& z;#dkXuo~=xm0%wBgRsDH#9}QMd zmnP8GwPL+i^i?aUR66Xt3D~AqkjZ7(zYG-Eze=sdei$5!0hLmV=h#1E03B-pw$6y- z8bNEIeYJqj*aCV4gZ=8T9~Q^0L&#;=mqH0jl@e1m$fO$V2kmoVK#n@eqzowJ45&3! zKRm{9lsJw?s{mBW$QqzuLB(g+QlLa=nJLJi1m!1 zL;ds!HQNLRw66~RWkl#uUwsqmY(QPnM|#v(kGdKWGMNv<1dTT_15&hC;)V7iq||PN zoZ61QRjRSfMT_mwcC=qjp+Vq$Fe`+Z(Mp%SWiSdfQWwe;0e{~r9DvcifjnL{bju9AJYMlYg(eDT? z`dx=$5h`6BmepZgV(g*+4d{CYW7I(70^?Mx$9TfnXliK!4f>l!e;W`@6fG?nH|Tqe zl{$>)mR33k1mlGOX(b?)OW;$Gf`z#hJUpZzkxJ24gd8D}Va&+DMT~PKmDBBb&~I{# zEre3u^H%m7^83Dx|A$2&5YYecUA@`N%tmn6#^x^94x8U?=0qTPd*^1S3+zRr(;{0N zJQ3KKHHc2zqljX-3{$1f&TVYWs_n$$q$E3$86L;j+liB`sRWA6PutqqG}9WWK{KcH zT{Dr$*0$Q*S|}7($B3}9HD4$cjzsYg3X|;Y?W;xh1$K4?)wa!4XR{bPbNkcwcGfdy zSeu(~rIkl=zrsoXj}-E8m_TbjpC4!^vJsex?91%}C(Mm8w;pMpB;@mHU6pENyQow+ z4mL?jN)nrwWBmp@YwMXp{^%9!mQ}BaNuN36dykPDW?49CY)Xu5U_aUGvTu~E4L~yFR$q6OR=#F7A_OFCM1=+TySw&xXe{4 z5ZKxYJvJQMs8T)24_G&i-===<*{4tRrTP(9e0-))zvg$-RvqkC=^cCR+CrCxCLXU~ z$HtALYj)4toS3li&Q$59hnuSUM2{G;eEE-K8XFr|yZgj5xmWz+uU%WV*u`cnj~ALB z6zbxAXwn>MR&ZW%%8*AguRhTimwdeZ$Hqp9WXw;?<4elCPX=wC5E^y*tU@609vxn{ zXll)*$)zPa9g~r=DdNl$tp4$>F^!I^CAUW`kFP!~e5O*(5Lzdh+uJtRo~m0^E01-a z;>MmVE1i?AF`QYlWXbYd(;FSfuO2hzN8j%bsy8GhCQf)I6!N#0H=K8_ajtc)4G-TN zwtLrXPtOC+^%s{fZyY0W96#QFjN{51i=SsEY)?%{G#5{_woWRLPYILB!Xl>}*(>w( z%u3l*5xdj}J>%#|>pMF7t~$9XB_lX9GvU~2(Fr^Af+=&dJx7fimFJn4H!3$HIQYPM zpE#fCzN`Jm-@CWw2VXz;>OCbTx{Q?IEs3*6o7vh{$#R(B46GQ8@8CJ5d%PDda$h;! zcl-}d_t!eDx#7OT7*#pkYo0DQHA`(3<$8DN(lfHzAt515NJ&VkTSe(8uc>jqzP|pn z{#sx6`1GXm3-gb9&##JQGJBKjnP>@}FHYib2&}%|+%(@TIXO9K$1bV!BA+v7!esmRWgm>KsQ1D80qbU|^A=aOS+A!- zz9GTRjC(;&oESJUSz0)G?{Py!L|$=LX-$>a6?eazH&?g@O&V3>JtxULNi5#BJ!?3= zfCb}tgaif#ZZDdXmbT@a{e{6f!w*zlc6axSU#4)-hiXb==cVn|i>mEQb0?c#><=D1 z_24IFp@%b4Qi4m$rWh{8#Z6u2dKX{Vm1(0Yyh=vNc5RX7W(+sg4@8B?&+5z)rm!ey z@}yn)|B}mVU77?A4p^u>^i9#cilV~8!i?FjuP;AiuZu<}s7tM+Rtbs8J3o2aAcs}-* zm%bJULGv`5aXj9*ah;hC+$GT@yf?3yV=>D?AP~Iwm6*11_&2>t{1NGS2mf{H_{8x0 zraki4`g5@9J_3ll^3)H0ou_u^rj#pEUP*Z)bns5(qzXKxoYF!}d8LHotQ~xk!ZDov|99Pc)Ig3n!`batcNO=n7 zy~93|b3B}K6uH90QM^19CT@wKJNPM;3J`osIVN&#gj|k5zD)Ty<;+U8iHA#Ekb6qd zXXrPN!D{euQJc7^M2+>)j|hdz#7kAkN7WPzmV00vcp)D}UaC|gRGqw(VKf{s^+JEk zJWSkFf&P|CO}w1rrunNj!5h|K0Fc0}G z$Lm$}9s;IJJGVt>=`rQFVjbFqJeR_wlkX~#~KIpw@c6Ze&4oO1UJ z)byS~C;z3qm)=Lvu~ z!EU|#)%UXO1BYUt0|pK3+t(||H)w2MTY3Dp z-JgBtIcZX&Ja*{d0Rv`y-rsV-(3p|-QA0z8sdkILGCuS74-N^L9h$#-k}s|&gDiOy zhbq50;IOQ8cFFv>n@{~`1`nA#_lqxmjt2%lCw^Fdk)0;JR#Gu+m~)(yMDp~X!E@&h z2@VcCKeVriKd9df%a&>6)vK>PYtIxh=Oi;{h71}0?T{f~ezQg_Ua_<H=~$<{@m!(XI_2fdm+<`g3wY7?6585cK-&vE#=KXrUcsxE1oK{EomcP@ z&&ex%-zP8N_MJO$^Hw7qJWvH0TaQ3tK{*`MpMaVxSGcvuEAkTbCoh2}?F49&kHgIy zcX5n1SP&lx3zo&e+#gb5)+`46CNr>fNj_-Gs-e<&3vS)N2WjbLpje=T`1l+Mos|k( zHQWKBD_UwI-mXi-h^p)`B$rI4#iq2n(GH@_F-MdwMG5V_9ZKIPYXzDouJjYLf zp~3z@e-EYQyH7aKn591mV&5K{^mD$yt1lmnd-g*(ci}_syNd7ImTnGY)Bds;+}>_( zKorm&U@ZJYvE59F3<`w^Y&VCdk>No1=a&6RUBw@L!olNrj7i&yu>SwOetHR9-ZEaN zE<@h4zuyvbzG;_M6!Q&yb8{Y#Zg9!tcDTeW^KQG3cK@=)|90QJwELGWx^KSOeRIw? zx9;TeIyUy?aXWkR`*d9I|M@?>52-%<_H96U<{$j+@BjGi_W={P`y#YL-+D`$-COWt-rVR^J``A8t=FCdS9LX3cO9Hx1GPu zr?}pJowl{Lk!R1Ialm!d8~I)9bv^E$*A;Ke>t5cyulJ3GuJ!3L)fv}=q>I}{(W-q-aW2Ano>M? z@PKRk{Q2|OzIm4|zm`v>>pAr;1=W@6ec-?Wl9!i9igh}2;=~DZLa!$W4;~~(j~ycy zFJ2_g&CLYY;IG@!W12_Xo;`b(l$VzimSst4X(@;O`}cF{(W6I6Rh5C%*Vl9PJ8bDX zw_WF(g4)@k|Jy))M*VW<&K=IjM%3XDj=duzgCwZcM2*+lEa4&lM5FvaIx5-GxZ(v9diBpbz-QhBD=7!)Rb+cps0|Pp>ImDPX^~e ziT;a>h~S`HwUVTyq>%LO+ezZaP3YGZWYMBUWWIbp>O7CrH4=4%ZrE%C~}kmCEV z{hb4XCCSXa&vWndKYl)+`}=lTd+oK?e)nE$Z_and`V3qsj>)L1s+!}M=^N|wYLZ_@ zMh4Q-(-B9!ySTeietSg3kdBa!Mnpxy*2WH+nmQ2BvxlcA^o)#QX>AR2Q>)0(pP^UKST*4kuFX{eSIA+5}q)9XJafWDT&K(XYUAeD;wyZ z)`f|w6(VDk(LHhz!?&kU)7^`_l3H|(jG_E&6MX$5aK_4+c+!Nvo+infPrPVDPu~I- z<^iy>62R6z0S=C-@b<_f9x~zQlY^*`OvHrdA}lxqK7moxep~2hoP-|r731C3)*9i0 z5WLn9MK8c&^NP# z7XK8qPMyNRLnja%Aw>7s6ow|LOy_wTch)$5*c^L5bHMw*GsX$62pIX6!YZ&F0cnj0 z%kPALRwu%9`ynhDf%xoI2%E=|)Hx1u>jcU=uA#Db9F3zB=s4GdqyKcqzW0;h>5+?+ zj51^wb|I~>8->-wC_6ib+^SAgH}|8lxtB0#0)(y{?j(xD2n-Xzz|4ZXL*qmc7Bs-l zI}ui9ez3N3hpCAh_!^$bsP4kKnJJWZc0=cQ7~WH}$5X41;r-v(!&y)VBkyu}iJA~q z)Q6DLUicSWL{Q-fvRiK&&EyJkjIFHg6>Z|s17`b#2a|?4zbDmFV9D*W~;p`oX06_w(o4S!& zcox1P8F02uf{l4Rjk!o1{3;G#y)VFN{Sq8KnTPk^2*rzXmUvd-5KJvn;gQq?tMEp6 zi(BEI*$Gp@2=qKh;gd6h^wv8FZo3KJ_9?`7Od+ac2I)Oh5LJ#Ly!% zQe+l3ATqH4p56l3IeEdD#-w*_6f!akky}uT0vZ#I9c`GIn&$9RTvCJJ#B>NmxyY_= zLRM2d^4o@ynAJ$*IRS3gY4Fs~fz#1!oH>wzGv8)HV^=c1dM_HgUJJqpZ&|}RtQamS zO>ju=foH}!*ryNTsB1U0?fQ_~GzDS%3_`nRkUBJt+`ehVbW9_&XBttNm*AT}j)u`O z6lBy9zNEpx=rmy$>9Njn!iH1OBOEi)*M|e)rzg!5VT9K?G=HBv*Nus56A+eBdov4= zUDu4f<_?H!n~+q|M(t`tR8|FC19ITunhhVn3HnLl$kk(J* zU|<-5ZW%cIr7!ffNEcoFp=ay_9djp`(VS^vYDCy%L>OlPOTri*ns3t5GSS@Jitrr5 zh4eba{lBLulMNU5wrxF{Q;boy+S z1r43}^c@qZ|5E^sqi!%Vh{TEgbRY46v86Kv0@CeZf4F0SoBZwg66Ge{enLdobX$}Y_zZ}c`&=~*;9g?y5I z&BYstjV{GMU$Vz%uf$>Z+rilTK@blAEfMM;MdBE>Cnh!r1;s_EuA#Lft^Z41D^h z7<~7)IDGeUARK635)?I&t_&cX;Ysra8k-Zy9=b{Q406WiP;g}yHJ9g6Nq6;?X%t?a zL(YX8C>^+lvcXFz%&&sKbqcKcA~@8835O2Zpk`tC40T5I=RLPq;IQoARRHGC6=<9ASeZ4M1L@1p(M0;+E; zpn00wL2W1*Cf*0e(0TO=S_vOB#N|j$EQKJjh{ka<0$l1~eW(;iNM7pS3h?dc0(|)o zPncPRAtQ(8)1gsZzjXs~4Wme?I}e|fYM3~Rp>-@4`UetWye|PpdlR6yI|`-;<6v_< z31){P;cT7;54UW%x|GnokdK2$6X74-ijs~YHk?CTZ7cUCiO;)&&Iwg`u*4|ac*i+A3N$BDxkC~ZHF)~hq557&@?eiG%ErqDb&hxQwD z#Q!YnCT^qk_AF|zPN1-V6umd5ktnRfu8$AnjD;E8-8>*n6VZCH5zQ?fsI00-dM1rM zUvC8ZhafX6AG!GraJJ8b#>pt?oBAR&Itf83IS5HFL}*SW!t%}{uBIJ=vKF{RmBBx+ z8UFe0u!|^zXKESZDjI1mP!A75G1T{`(b^#w$G*&goqjs+O%h-Lu6t;fp7@D{aPlps7+-Cw~Lp>Pl8N-IwvtFKF2n-B_ zx0gFiEUckrKzxYSIM>+9i2o?Z7b=}Fg${M;2P*lG7f-aNC-S)!eQkR zgHwmX5t&tu)V3}NNw?in&ccJ_WfzlIXAxQXVQGiW5a_guS!{!2GtW#flEyJ;P+mx8kTL5O2&pmUV)(1~mZBO@3Y8o|`m zjMl!UFfu+(SZ9l4C%q9JmyCh_KFmztS+v@hY;BhSnlJq9;pFWAXJ03{2Yb=lJQP~H zGRO`{fv+e5zG+$TOsIpMpb&PEB{;5^j3cBo`)MpYnq(qbSP!qrT7<+8AePoXB_rb~ zC;e|6yMeZ=*U@p|GTE6I;o=hkYwH*s+#iovVF$``J8?!o1~y&+2#*fu*81Mwp78Va zM{t-wjEq9C=hG+}&jpyCzP)7Y&&{!rt$`K@?@eItY>G2(R-GNqrZ*O>>>EOmP1oF9JT?mNXySg1z~(y zX$`V+^I&0|iLd{f0~eZm*m`rx-n~1|-FFx6;vjz?j_4l5F@1Gt8f(D(j3uqjbDD z_ru9!gqiQ>;FFzchzu{5_(|rOt-jK~=Hz7uj{vea{T$)oZVyvi1CsR-9NrTEjgN(} zJwf{ZO%n9KNQd$M3|O8_hRYcd>}})7#*BwYR61g7$`D^!huDe+h^tyqPWH{^@d?b& z&T(>|Bi_WHu`WB~%*Yv69y2(A5vIJr9)r#{Pv#uugd;yocW z4kcoU#{E4X)xtylSnRq(IyH9n5-RFz5gH}L!GkV1vL~2yTuin=1avh6VQU$I<2o+T zKSON}4S-*CBmyI15G_hWN`4tS`g(DLbakHA=yOEx4%Io!>Sg^tH;-vr_X2b1INy)N z!V=gxrr@MTERG$g{%|UyIVA=A}NP#i2cZ zeG(V1jH0Wj58?5tWDg{ftu}y>E0<7nwiUfYBWUgELMyFfn_An@-PMI#whV&RBynA_t&`~mHRw}vx{dwL={o^ZWOX-7qmh!{oD%CTF zS$F59@5}Q4n1B1BbrEm#3k(M(*fKlM#{0YkWA1_rB|7tO>5n46IBxIP+kbc8;m7t?{yX+H{(re1?*Kl&9$$~I$A7o;`0sX>&S`CVEXT*!%IjZQ zOZ}_st)FtPQ(NH#^}Y-rM>;da?A!{ zXB${L+xuTU`!P8=xpW5L{3rpDBJHUeKa&mTowUrh0^!2#WxBS>z%1ab3a6t-PP``8VH`Nw1b zM_vez$V6#%CrauDQQ0(t;)Wh{_KcDaOmlW>LP{FdBER9xdc)76arhWBck;tayqXgZ*Uxm zvGvgWi2A;26ou8j5aymmR&6^fnmW-vFo5YhGu$|cNXbTEtO%(^RVZxjhajOG4rhe0 z)yjm<7eeUlNypcJNyM+VTjK;@0MGPJxQe=9nb-?W=RqXY+<>5S8VS8qNIo|MVf}Ro zO2$!E--k%Q3~HMP^{X*=-o(tp9D#m;h)GIB3yr7g=_y3#R3W*z4%ufrkW$@>l(HrS z#O1=JQ?hpB-On#ZDH7mx?HtWG%Rorhb&Frpi-A-Ve&L<2J@9%FmQGZ44l zLf+5~i1O-iVy_nr4V`h?$OC$&q<=P6G&W3NMmiZ37>tVYN`z%p!6Uo~j={Nb3d@IY zQUUzpv)~ykhM`>&_}WSM>f=~^`=tP3!dk@D3?R1QB6ns$*mD~R1JfuRokj7*I}i_3 z{e!nqb9oZh#Ws|XJi@$<8!DPpGWQ0 zIh2myLEd@hAHRlNaSdFJ(%@)V4DHYIu;QVaqEjvfe8Ji1H%{2Bf6{)eu=d( zG8RE&Z#=X983=;z(zj>9?p4$1=(;9t44A6FiHj{kv(u7xtDLF>c%|U zt}mc*dI8mw)2O;|9pbza#3l$)T;7Pxyhdc_v>-X67OqxB(EctBhxbLo#WMy??VX6M zXhm#o7h-CA5MJ2LgICm9h^j_VIx>OU zk!xrgxrn~uQFsN$;`oVJBqntt#Jd2Nt^tTjh=5R-hy-CQjva`DpGPsxb@PO~^PK;Y z&3lKmzQ+;WL(nol2_1bi@V`!i##cgo`cV*e{Xu}e9}1!S9re9U4m_jF5MI`S+@4_+ zbqt|%a1>W){$)P9?!i8o*^>TfrXj+&1*Tg0uyRg=vs(tvn5N{32vjHDchxDCX|W za=y_;zvj)U+X#%#=FSjU=;uT4L_Ut~5n=aVV{l}DBrc9#;rxsXKd^o|e{lqr)y;^G z&p}2`CF+|yP*hcihK^>`G@M08XBTeJT+R8i@80u|GoSAQ^E1-FkxQ2mm0X0d_yUNs ztC5skj6s@jneX@hbmwO5!(NY~L*Lah299(=$^`G#2|@ zaxbj#5ia>$=jSuAHkJZAnu<==HN84 z`zB$jN9)~B9ARwaKsK!(vNAH^9bHBCW;%}VOMuRaMCczE!p<=t`R6Vo@4_wA(i-sW zG?3HSj)=e<1US~iLN^r-_Q@zHDMJX+2oTfyJ*)_!c{Okhp>@^4EX1UBqIl#c8ZS*C zIKCYI0ZDN4up>Ey(E2R_ogEiYceWEIwz@E}HUj?u*&aJNN zMYx~_;lY)(UbxEX(CqBokIo|t%l62zY#;glzYpQoUULgebL#wkdz>tdP0e$2E6+sy z&*Rj8?eA6@x~!9V?KR1-1F&BLCbZcheUoFqn9RNx$KKel0I!ke+`;_@u&gxa4(=C# z*GhBl;C}yi-Qy|b@%8w6d_BG%U;l&G$KSYfzxgjKo%6D#@$deGvKDl2dM(6p{dP3qW%4;9S6VH(BSLtIH0~mTTf%hF^wI6{^w^qPVo<^zp`mOy7Cd$J7(#5`olsopkTEe%C%)O9( zgkbR_m}|J`Ez*xcZ&~^%^z!Y@qx&V_@Md&H5Bqp#xa6DJ|MIm%MrQeE0_5oZgJtip z=&Bp&Qds`3v|WFcdEn!n6utiyZ5{1{GE&|wqz(P^%6vrP-B+~LPx22+c@3A+`rv_l ze|(^M`z7HAT#>ah*>6x?FH3&k9s3O|-kBQr^vm*0Qfl&Q>(pddbD0=FOgE|3yfs^8?rx`cKE2M8{mhv{JWo*`h4pgE&+Slsma3Oq zYAcid<|SHdRCg>AljzY>dle*OmZz-xv!xu1@kE2C@{oAyN8S@F;#bRTXYHf-C%Jg# z*Vn0V!dG5a=d(-&minDjl3OcCC~BL|KlLfZ7__ZM)r|g)b!}a(^B+vkjOb!NsVvb{eeV7~eBxf(^UM2?+9vZP z*C&kl8e-<>%VfBgli^d#(>KYg{-0(2_6sJp*JM`k{`8}H-*!LmE6cBu`A;hU%p=Ro zvJtkDzzW@wl@ZXG{~6N}CAl5DNLiE=b}(R7+MukoahsC-HYG*Xm#C=HI#mL_bsKr> zsJn>YRZ6lOq)!UUN^6xBcfP@1=@Yo2%~dok;C%d-AnTFqTq z<-4nRYkBLqhy5=-SSwGKx0Xdk@Yd4n+MUN1$*C7r`JLAp96$LE`v^Bz`n_ePH*@4yapdzCGwfQH;mzgEmD}*h#;)gTi=bykHT^YD z|MCb&>HB4rBrVy(s#1HOOXWY1D#xY%CzopaKhiiD{UYrG#{4_Y3xF9Zr94kT z=LMz(>v`*Se!(6#^EUJUFH6|)w9aps>hXBIm$$3ZK#|w>p!)fw^71OGFS0C(+oasQ zvinJ;tvp5TR+fSKQvRj2PbqCx<55)4Qq-EKDG!fF`FQgDw;05|^1OuZ1 zWa=)ztPW+;lygekmE_cZ&Eu)?SYx(H3qPm*Diz?O?iFR@WRX2-dwJVmFISc$D#}FV zO&;%w^~;Dn%Mn@sqcoIXuiPfTbBsay#+T)_KVo@VHj>sWOl(X{O8nn4fo)OSK`&dj z%JAP{ubX(AlwVn`wwbqu{|i>-FITIrQF*zKV&AopklV7F(ntl@vG85iZR%><9zueO zU81K~w{R?cy~u*vZ+V*t41UgFVVg2NpHm_@Aqv}ga@6S_s;^R}kfoNWygtg?#xP7? z=bu?x=3I-8ojlg zpOt8|f*M031qmAM+^|S!CGIKiU|XsCsHQO)X@P{`rqIbmJmMD%_8eic*YJWEiP%KSnA_F;bCXq{96esVK!rMYZMCsy(E$72`*v3J>C`!XvOyDk$DFQat?`QF)WMo$yrQ0X+RN8b5ozl1HFwsHRD< zevZ&{I|)>Y|2rljLM{#}mA3N!A7m!x`dK>wfI~~{eSKh5)wS>b7GE5Q@31N~+0u*5g$pE7v6DKoDdZ~sEu}%)5*z4`9ReQDCYVU3PY)b*H zz9xoGpRJ-+QCdZ`I*K3oQ3XHX{nk2XCNm*g?|bk5#~EgwwbovH?Y-Apd+mMB8BX%X z78k;frrbO&Lltm_(saq7oEo!;r1MGP1-b~lLP=~if8~xXQKx26g9W3tmz&gH!jZFc z3&xTajrrqq$0xj$8+6F9*!ZG(@lnS6L}$w6Wk0}NC@QBOOvs%OujoiC*ouK?I_XTq+NXB@@I z3bfjk;PNsm5`0*HdmEla$+K(Sb8EU2d=*gDScbdJVJ_FlHFfztoWxTqnoZ zn?=U+XMypZ1Y@po0_cBD(3cp`1AT9TJ}>w?;F`9g`PA!#!SsE2rFK67`)G1yX7FIV zt|@zL*3`mu^Q{@daR$+8+)9Qja?*twGMPDj+pd|%iWX4NUu@8;(0G0vybh!xc&i~f z27^O}lo_gB-yDKGcI~;mN@emQl@Xkxh)!j=o531IuNk~4f&D#>8472X1t+D&`40j! z6}brgYg$VCZzW`A8sl}x&nymZi&Mc9#$+wV(X=2kl~M7lKF9L&i;?p#1Kpj00F<6vG!VyQSS;UDqrBY56v>1Ob`R?$>4 z-H4iw46{)VTtQ0BgkjzoO_wb2T(v;bU(QYUysn>FTv9x%WcEzDAQx$(o#Ne!KHezA zR-8{-fO|qgf5*BmlGuVxR#^skO&;+`k#R0bZhMi(68aT@uCIofi?PlE$o-1 zrIUU-DV_cn=%DoOHz9mO znPW0D#JbG+fH!64qjx(p|3{`#yqS3r(3Ew7WE4}gNLxi#KD6DK<;^mRA29!cERq>w z&U4K98^dGZSVUg7Dcd3@Wj~*86jQQELrM00$X91me;QG06zj7|{@dA|z;9=KKTAH5 zO+9&uHKbbzUSgsCmoaoPbc3HEZnTijJ`2^o%R>Em6i|rxtJvdSpCV?%qH$_2sC3}u zryO`XcRgTedfXGKyTLZf0tMurt-ilnZ_&>IY0!h!Uo5 z2UUc2<}h`yPR(QLSKLCSxLnYCm4ByGm12f)NjAWCX*%FGX)fUJq=jg^S>7(1d#;yn z2kc{bAHzo&KFRPH!;csm4FtzBoW!t*;cSMB7_Miyh2g(5+{y4MhHo)E&9G1*Sj@17 zVJpLbVW=|vDZ@W9Jk0PThL$vfmoRiPT+XnI;ddF{%J3eBzhQWg;mZuaU^vD|a0>Kz+_s zmHejE3Tom78ufv+9`RbrR74o$c2I7;EK|M?)Ox0JMS;8#)Yc2M_@62FAhI90V7Q-( zc#tWBxk^?+{WYcRwG>Kw*fG}jOOsa`rv7B|NyY?q%yf-pN>HDfI;HdkHOB0dvJ%vV z=8aNzf^wK|lB@};&U}rOm!OuKzb6$WsB6qyr7;O=llfL@Y=XMg{6lG6g1X;)hg6uL z_CRucf_m0`w{%{DdKYCA6Vz$*&!tHT>YM4mmM#!)CoJ&?>6^T0)7|~r^n7u#$kD0B z^!1>o=~P?#pmedQ)~U|)y`VPg)OXS!2lb;1hpk&A?q+JNxGnujM8$5M`Uz7{>D2v9 z#dPYo>Cb@5x=5oQO1}eC0aFTeJ}*rX(=HnB=TuRyQ%|J-O`0ltbm~z0>&Pm1>(u+{ z?@1-%S)DqW{;@PeoX{yl#>di3k!9B?YsTkT%%&wMgM68A+v6j89y#i2y=+{@ds4aB zo>X?ZxHD0fC0{9?wGUguDgLULou4sAc8aZ2G-?hgmso$P7Rj!RiE^cQO{W?_Rf)0^ zP12Wfp}bJ6F44-mGA@>@#rzo>bqlDgMCnY;W_M*wmus1SLLxXt9)`P3w5|@A2!AmF zW%2$9+<^TqaV96AET$&mmzznZ$~;oTWb;UPH^Ya{()L;sN7Im*PC5(H>Gs2<^pX6z z%)c_7_6=HT4a3)x^e2z*>^{$BJy&wAkJCr?lUk9vb%U;7;|$k|_bR!Sk4NRmy7i`H z5MG)w5>IY-w`sWaY`iohT~PeY0d&YUfD7bY=F~H^Gn~e-lwrBfr_48vVJX9MhReCM zg`pqtLgdwxna|1N1?A%Lf^zT_F+S^6a46?)7PGQG1Wxi%K!c%zSLa)S--y+c`1dgU z1#24=Z)Noxek0z?+KoB(QPzFH&t$C^uZX$X|I_fMsLS4Icwel_{)6El#^XcUqPy5%&&$w9>iaP-( z!WL#+SNiNMFHR@ZlymIMAx zS_OEGd>gWlf}BUce@FwwRT7{H*Ap_X5;756VSH{8tL1faha8qS7=-i<@k>md`HnE}tvKX+AF$-%OW;(lhdR7)LCrKPQpsR|O*VHz^tXw0ET31(J3Jt-uZn zKY7m*7t3@W&u4m`d$BxSoWeI`;7a9-18w1U-xXp*S8E{H?q4Go`&)y7uE5$*akIZG z+|s_FrOV$c7I!;4JKO!OEg^rP0~G$b0vkHRAzu)vI~cge*BS!0)VIdt3tsPU^>vBH z^+8`to2O;1Z^;@ehSc@`HeYb{4AHVN)ZPWySnIidjqrGC>Dv_Yx6|3xxQtGu2il3z z?x#QS)3ULvs~v4DZt-`F-p%5qPA0mM#DkDe6t~h}7#h8Pg-@%K7@McNE9BcCv;m+h z*Inlec@q*F5@_luSt{9R8;BYq)6}I4GO~eBqo_%?>IQF$l}AV?H<(RCql#->PJutG1@HuF>mkYOKb&#^r2; zgf89CT-o5ox29^jx7OKM*}(j|CEkk4DrZw|qjyo|a%NT3c-*zlmSYcc3*XI+J-+PP@7GIs-7UF=ynTD8Sa*C=cl#uK+yYKd;=q!QT7RpYMK zEvWGpI4jr|HC1Hw(fSlOug0yasjKl+S60M}N2rG;@=Hx!Wok*I*VE*7FKKAh`O9XN z%<(R%s)DhYcGgl&7wlO{((rW>yQ!{nnY+@3y57YYlyhNaQXvhXq0+Ua0foASw1R}4 zQ+zR8Y2>K2lA7Au%7xBauiM$+TwEECHm$4z%~VusV@hQ=EO$4a#UIT@&PvaWnPpz| zD^AXwby07dRF@{_Rr;I3B(y-83SM#mmk&RvipN^>P{3^}PuT<{*YW+(VTs7Q_ z5gca<4@oC6!H9M*a(T*9s2MW_7C&!mXrs5ocY_FYQiksm9pMe$E?-v{6LEpHL7y*9 z@VSduQm)v_OR0Blnq!ZT;Lnl(dMfNXu9CzARN%)3qqicN``gl z;uZdubsd2&>|nY?g>OxG-8x^e+TYgZ>lhXteHR&TAhG*GH#*u{f^FJnd$>B(`7~Y~ z0`9CHqz)RJ(=PwI4pHrE?_A{TrpP?2MnkwGsy9as!)%68ACbf;DwmH*FX&*?@ z+n(4JRs{nabdIw%4s<3ugX?}{Uqp?&vZKu%KsbuV*3Mc#3OeXIK-(KH>7?cZLG22mCFs-nni@CSLhEj4TU!v} zFPt6S;1t%#|D~Vl^gv4NGePH zq4lH+=>qO(^>v2yS?yZi67M2l@rJEbB z^>wU+)`|`eieY)adeO!~Mi4q))w03g-mPa7zHY#!M<~!5XlEi}JM9vQvxu*aQxgx1 z*=QfO>1w5+APH!T7j4(s^&_3m*D?*h_Lhx|bq$y6Va1*Z`PcZ{{h{vRQodR&zJ5)I zFO-ZI`!@RM$LrHYi)h6MXSw2zgaV>U(m<|oN4i=KL5?BztpqMLc z!o#|?7HsHCKy+~3jes_^(Z#R>5?F+QwFzM=M(@gmNT>4*F;j>ssXE=<+w1jS*z{4^ z#Kl57|Kfz!Ftk$7*Rp;e@M0lNaOu|YGru*V19h{V7`aPSLVu$W7rDd|QHM_@c#Wcl zDI4%wU>lC?p53veH_rPKcm8RNoO-J%+;H6%2MF;37P_C^_e z?LoN{Bh$Du#Vm2zFxT3EUX_kQW3h*%G^PpdUdv;?fqO6=Uup4l5&tZJ)`jRr9mkIc z7Pqm*36J~14b2VsE(X7m`|1(H8YJt#z#nsAg%b4cJ3`b9msO&E#s9tL^IM>mW==cX zKh+zEq8Y;x*utYrwZ7&fvVIH4Ct}hU=9#mOeL%J1`ioI-4Ip`wVsr(#UVMjV)F$S% zCdI%?mTN)TI_^U;e^v@{et3k{1Dr4XdK8FRsl6E4(wAuUk@u4Gk4=|KXRmg$Wr!OB zW*Z@?wOpjn(iWZ#!%};U3(qtOzkDjsSxxNlzMKZitz-P+O^g% zNd)o4H{9hmc3TlUGEV!GOsC1E4q{4z---m;qSrxgqTYfClMLh=HYYKt#R?=2h<>p2|BcUb7=kf!0K zEj`7WS~}gp^1hK_bve}>UIybeJ^E5;ODePJ-iuGIEE}J7YP||UxXp%;mpsgv% zf7A)u^F3_}B(EzrZiZCPO`4(9fg8AFICN8MY1}WHuk9#pE^fH5>HX#Ar*gR=tALc&DDW+w_?^ofGx7dMDQNIkk2?3*5kQwLVF%OJ7*EO%TO^ zCOaKVO@)w}T$~v?*rRc+G~{(WTUyS_Fl5?xJwB)n&FpLS+!5yf3Q6RSOx+qM*)TXB znYZWu17ixW+WGMdp}@{(CJXbfZ(rR!zVv9+{NR<|n{xk>G1q`q*#M1-5P4Z9$}9r(kWZn0DD(tNp+{AUfgfebg=W}Gk_rheG@FD0a8jC4$mYVFLXhUdNogce zSO}0tz|4SanNiC^wG?xq*8iy3XwS5C9Z&|tR7 z<~&;t*+l`O2!k|yHp+zZU{ zUq4cj#WGG38H>9ceH%J)z2h^L6_?OQ2t9oCz|lh{9xNsbEE5Hki2@0rAYT%e#oft| z!Qg92WP+D?U?s97VFH66ISIW+^0OjDgfwxY!6eD}nvFur83 zYMMe`lH@eDBYKub58f#n%qEjzQW~%{lL6ra7Z(~$BW-DLyO)V_r9TDzDqj zp7J3G^LjSZbhAK?hD0G`p=mcBm;u2gNs|m0nV@-+1wO|&&xa5|IGOYO@clG1+>fBZ z)RW8x3M+%jW{`+QR_wVI&KHyNy0gH{?YTX-=dRqIdyLe0&(F|HnWEKVK>(srv`5`E zOgEj68j1GC=lMvF-YVh_&6W^3Da~T$ptqz!jbxcRkje1D({_+>q$PYOnR@!$kGbtHS<2EO5dl{@B$v-ay!>* z#f)K7lyv3bljxVe#u!`uh#kw_4!q zxTcFYR^8mYb=bIs^nO)yJ4(dA;r&mCFZ;4#BmVuvt^GTq zeE!LfN0|5ij>mBJF8kGvJD7jhjtPA3+i@44Z{c%;zjZy;AK6Fk{ZfipmGXWm`2v2w zR3~jrG~T|)^%q0+NZKo+ay0s^_eeUK+ zK_n)cLSrH^$=Z7xF4cC^3r!xS8~evIcGDxcN9pQUZM0{3njHsw-&wjgDzA-RBlmw> zxv>WICt7!Q%8ny_WsyNSGGOjoc53idbLLCne#S`j>hGTfaT+2UKkr-iMZEM3BlG@* z^3ON@!MaQCS9+9JNdn9_b zy?{o8K;Szs)@{pSg{Gz3`z!2457855los^Yi2nN1kz)qy&WaxzbT9PRpJ7hp4`u7l zhuK+&bcSTz`5(lH3`)#X3x2rynC7q_Fn{RGoU83w(OSDb+Gx-D&h_f!jz6h~9M7vS zI}SUZ+HwSq+PY1KBasg$9G4A8tUHf5UUUqpe{;ON<;Yq5&$b){?_lJ8;vKZ^Jm`4b z@upg9w>fI9YR=qGU@w8kP*@O^BabQQS3!ThjHtAJm!7dB z9tu@6G#0^bQJC{1N27fj`dJtyvz|mrNt8_cIV7`CR*G1kHxzBof=rfm>n~wT@5&XC zJ=2DC|5Tt0)lJr2Me1J$k15UlA-P~_wB2rhm>kjX%u;Xsd`4O1T_y6C6p1OlPv7uv z?>o_u-3C|XXs-GIu7aQDPaX82k@>snu~7deyBoyB=q9`ExT3b(i_{a5*Ws1WZ{Vh# z+rNv+j;YbV>~!Q+gF5l{ez&AK?N$Rh2gUuJXY>k^USadAn(yu)BC_|)97G)gr_|bS zpveO(tAmcmwhX}11CbMC=>hA`0kVy{&oMZHe^MQC?AtPc{*|QgW8gyvEKruhKcMb+ zkdI;sm?IrMD zx#L}Ma~v-__CqFT@b6~FOO6*ak304|{!GMUT-TNvqeSd@9IQ+VvSrarkLOeRK~&M{ zIRei_$05l_-c$PBa_`e|cUZr-0YRXKl3cvWK3^?2Id1$MevXzUJpBeO7UVmMp}p{z zoo1nR>v^cZ0uw#5ry^;p>+xjsAf8K_p?{isGbOsEG}g`g2zAG9+X_$BDUp3jJ#>}D zwh-M+bOY$}SO_#ls#--ncdSjLbI_CW$h%pQ7==xt^_C~mbIgFjm_pT>RBL@~4yjtI zMD{BU>WSD?qGIYoqTR7cL@gnlnw=QS1`Wd(I70R^Sg(+#D9m0?fenFaXs)y$I4aOw zfNzUpGd|<#XLEB$_p0cafmRkb5+KEW?6+}NkO=lIxwlYggn)8t~ooCn? z6IWu+mo~&UP_Yp;%G@wOY?aE9ofS3K6S+j?g*m4oYK*ynd!tp#D$HivP{RHtWdAZX zLiQ#v%qRO-ZywU@UqA{LDQKPyQ5{o=_7F|>uZ?}wr`z8}Ja_E1zJ&d2BgfhPSKEuM zw|tUp|AHpfQXhM$FYZe9a08@lvHSbj2bwF%jekz2Y#*?3}woh9LofY-5y;1IYb=1%R zL&bJRbw_8Bqht3+wS-h3HN@@!?p+miDezOt$oZmX^eJ<;3~Wrt8b!$}V<>X;rsn<{ zNj(wG;D<9ej`3J`PMm{f0V0N>$h%TBBmB;aRr>y*(QZ~{a==mGpp9Q zzZ6QUHE%xbr~#lD4h z_b~al79-`xUf2e8TkTt^;XT#$v4fzSVncwQ*rR~Wv0d9Zfb9*jUlB&*iru@79avf) zyL}r~oVe1v!ZEAR^z?68Z~~PhCudTnn@o{` zHbSr;oFkJygC_Id7rbGdNPMNgpoh+B{af8s7aq%MKq{CRD~@u&MJq+LNs%Ty23B~n zq}fwOxRUsLwrUiv~E2gyyM3HJ4iw`Kz@d`mv(g6 z6GrprlUwul&Cb6_^@D(%k8vcyUOVkiP-h0rx z^^b9VCDvYgh4$CcH{nb5ZMsH%25wz+TF-YYFxPX)^}mQadeb}yws^OQ0V!wR`(aaL zQ!kR+dC(F$Y1s6-O5!o6$}#t5fp$fh6K(7jZ<@~V;+9h%yHG2py%n>Rp9VME0059>gRe!}+3#Vo~8l@uxH8hNvYx3n}8YlV{FYcO9r-8+A>K zy#hm8cX_5oT}7&;fur!Yn>Cg+7J=w>46KBS_96^D=-UepcxdY3;|5$Ws>a>{HOmpY zxc6Yl3A!(5ZfR20iN$JAZh8XKv<{(U(Q3i00QRV^p^G=1Y{?fAt9` zz8qEV&no)^-O?f5|LZ}luT8o==FymsE0ICkg+)G7y58u1c_rli8Oh*yEDfh0IQ$IvBF_4m?CgK!QGa=D6%Q*n4ngcoSKoui8wPu(wnf z(BH514 zD`?xYDmn7BWAoeegOGdX4@o(WJ<%<^U}7=-5v^2B&FT*O1A?w#9W?^z--FQObvhp*cDkL168rw?orj0$bOD*rbm!-{{T-O?BkOSk}kd^c>KZ`<$Ng z*(LqTY+QFtRNtkA&)WMlQcx#x71${D!aooasB550zQP`w(BGvAy-yQ?lGx6FaIAHZ zO?%3%cZVk+q=Crc6|f6y`PYAFfn_+rd>8nM7H&u`D+ym5ujAF!j-%x)@`aw|LNhUR z8~r8P^+##j_QlP-d$6Mr8xGpW&@CXx6EPzUvw07hcgWLE7m`oLUOE+D6Nl8HehTyF zV?XA368>$!C#yjh+m#TzGhS2qEY6Cmt`fDgsLxegu7t0ElA`+9&!=)9CaQm#+Gw|d zH?6^4AKN|?hP;h^Nt(;uv0?|DnA5+Ny;*;JetBBB8dfN3h?Q1rTUT}ORE!S1Y3}-l z*cElqphW}i>dNb5Tfw=e09r`{wu?{vpUR#-I;!fUjW~aloxaIfK4hdB9(xZxQNPEBA%jZYF-3W z!X+LW-^Ds32{Ih~k5%=z#_tmHJ+PzKny?PQNeVGN1=4LH8MXS1^E5dMMU6f~R15}MHhLwQ?Z=&$KR+EP4Cf*Gs;3|>ngj0^CG-zAv(Hme2$HeSL;gWlMSjYsuH6E>>! z#%gRlq&J+{SfDrZv2mZ?Fk>S}Zy2zV1&t1{B{tZ69(?YFj~PCb;dA|)2Gan1&cmk% zK1usX#C?FK94DO(x9bx38Mp=mmQ`BA|74 z!*t*8@TcaT=;$Dpkqo|n!@jjUIVs9T-nk1qYm%M%%+=WW5byL=Vq*bX zjNPw8w@<>K{;L%;oy+HuHc%}pofOE&e{xkS1WYd9RUiZ1#kcF9?YjWYe%bd4{+HqV z00-BwLDBafHvWk>KmdUrbQTDelm3?JbJ_O}PFR?lkVUqX0JW<$fv@?b9{~V8K*GPMi#r%7IukjjT*77b6X&;vSwAev$0Y~# zC7o`mCKK@ma^e8~_UoRH=C=1xb!3XxRJ6sYHGP*>p^}Z~fvzyBj7aK5aqHUvU~Ai| zdXDnW7Iw(G$2um;w~0qkUZ>wst8GfqXoP9UJS)8Y78 zsD3U+x|{p!KvL^g=|H%ro7`22Rb<)*!*h*sTW8B8(n%hX8=@7NN{p)=7yUVB&}aqh zSs}vIyI=}AUGSdql<`!xW^VNxs%a*h1S=cG2?7QBeLLt4G8o7wlU0X35p{@ai(~+N z{sJ-bVTj{X0xqH(!Laq``AyW+1S(N}gBPSnsL+%=1MHB=?txnYrn}g0r579}q>Eby zV9#AAbcO$eKT@(oco2*_jOfsZgA^e^!X)D}jQZH-5bQAY_JG3u~C z?I?vkS+R;@eKzWlNU7Y#s^ny;L|k&$V)o5avU!|>yF$> z&Q}>=)d40L9tjxh_MH0&%7xdiRseHVq&W9E9mFAEGExD)SRmW!JAxzI*oZ`5!I4H0 zoVK|se(}iUo@#o08%EFfC3;P3I13lU_h^(e8;B3>{L<1gy~eGZH&aRcFHau?|+$iynh zv4Y>*&deSd{*$e3c6|6ubZQn=+p(Nr5`zDu`~Q=o`AX~JC=-H5P;2LwYn8?FSR zDuSqz<7%iC_WwAgiWa0)Q9i2(!+mF_?%R~Q@8etfefMw&J2(Blh_~Q9fBU|Vc0fFU zCW+r#iTOm2S1S{&32MX(Z<3iO>ylY@Ui>B26P?yxwo8E3sM;JO?$jchpc{7rYmIXk}j+C%2iAyG#VoO6-_^9?WTtKa*Q`V7w@i z6{5Bx5nkfait}kUL^PneHL*YwTQ&K`dObgKXVgS`R4S@{BKRMXQ^5f?>zC}yGSx0x z(3})xW~!L{;~r+M%=n`EkyXDqFMuRzwJg>>6)Lp$Vlh>D zvv4Y@kTv;B+@$9(#t!iGg?w=IgBjK#tbBehY(1^SydunE$OwKTna@eFzgcI0kc=^W zpt>1vQPm51$W=WjJ7M8Bk~*S$=4$pDIg=LgC>ds{7`#7;87(PyC4q{`3l z^sQrQjP&C(!_@Vlex5Qm}`(HWLClf3Np6x8$5uC5}=2jJ_AyG5Ur&q z9|oFW=^4{%>?Hy)8s;-mv?hVrIbBZrP&1Q6hIreDm~R8=JFaNW{5e~pw*D+Wiz!0a z9o7whodgY5%$F8hk6J z4eBvX?U;QjOSdm&jXTaS=aQ&ZezC#ZA^6&=VpxDMuaWj z!3xGamROYefkDs$S<0JBEZJoJZcG22Xmnh)UOI(OA{6V?O3WjoskXHT&2Z@wZIeJ> zy~^B|VjM@Ssy}1w&q99WeRlAfoaizYz&Ot+wvG~q40hq{69%UB@iuN5u^(t1Rbopq z#9SEIGm1JZI2F)n$MkalKPs{9B3_oXlO_8{F2#x5`vR9WniZe`bBSWK+*XC{`9$|ROpMTBCl z7%qp|v_nIzXjDkfC^1JSO8}Y1g(piP1aPE96UT(dP{h+W(&7rzy%G_ z&D`b(&?~|&d%+2ycRtX2&uE}7jZ>f>x)K`vGx6xPaMT5i1tFGd5FALG2BA#spPgJ^ zP{rZHHeCR~z?A~9g2sFxd=CUzM31MGsnb%q;B>)Bt!nS6i=J7h=e}f6`-SX1(=$iV z4|a?fa0d#wSBz$>6(Hak46I5C`0kBdz<>Q@8sfjr*Of^v_mK*$Yo``&9E*STg^f?L zCkds7!2Otlc6sTu7nv)L?iEHx)pYL{m?*kFq$eo3tg@F$Ub^}sOJV1Zjr2VZ)Ajs- znMDiBnYen#`H9=9G~(I66I5KTbf zpd~#TYtiSwx+xWnLA-|B)5kCK(1o(Y)TTn0NByW64x%ey0f-<`TFsP1H91QEon2LQ zx@pE=`F9Z8}&%8+B|leE9?1bayK&m#;4C+W$aL)7tn`J?p2>;@Csyb2*xpSAgB)D z)9oof{ZAd(yBqM8+qz;_{Z7^=(EeDISR-PK)cj`jtvLq%RrVc`_ms#F;F2e)+9w1r zt0(ZyRxYCkIm$|M4_^Wz-^>H|CHfEeMueOQ-?M*BLqo%G-^uHwy^YQ>wv%J(Q9-?y z*YYVYVKL58(nIH9FuYMFo!}V5thSL1QWG(d&im%D_v4l7vGb*R2P~%!7T0T$@x&7=kwlKqy180p4vFAKm81}Lz7H%&N2lV&`__cWdgk+1~&w1y^>yuf?4HEDz z5#PGKTkOV6;W|6xKu3xLEjpBC0L6I2w!Jv?FR+`FhS&0fC%}SX9o)PWI15>dUUrhB z$Kd^8Er)kwU26Sp7UNlNv-qd_;y7QN%ayLwfxT!>chj;b*+DP?QD4`gKJaRfU@`>13xEU!=6ea+iRsb~ z!4!!H^Agi7@RQSb6>#ax-Hr7>b`j7Rv<9<#8Ms~;i(l?%?clVR5f0e;#B>n=q~BL! z)sN{o4h)@`Zb%1Fnc9`{GrSo40z=&CE5f6gLGL%{4Y&y9Ew@}*z+Z{FVLzFc`3ItqPe0m*B*S}8m&i?|H#FU3#O#pyH zOU1o=d{b4n0DO{@w1I{uK!7L(ssyPNu^7~r6s^*PI`T;RI02!pGgmt?qmE)Ccx_AZ zw9<4F$C*JtoN?xkuNh~?8J#-_bwo`XXaNyHQhM@DxEND*ucl;&G&os&L*neY4W z=Jz`}=j^@DeyqLs+H0-7*4py%(xkFWp$&2UQpp_#82ECr$N4+eq-h&av|;(Pikx({ zy<6U9akRcf`QM27*IE%A_dMOCyMOQN*dv4ToVraq)cCon zE}-+RAl1Es>UfxR^KKhK1#Garp(>PQxcPNvQnN)y9zkX+E9O_4$r@&6iJQM?CTPy_ zaDDRI4eGZAZhp!{$|wtMMI|17)Pz+jK$V=5V*aF(Z5I)1234PC^S!7~gW!n`)n7U~ z3|<{7y!uplb*b>`8-Uj)6<#;oM^##HtD^u9zv?~$S%wO--3rLED;1D!R6v$dse()e z7{Kcd6pFm-g z_dSs;s2Wkk^=p-hG@CXXua&=C(-d+yYRq+K6M@RQv;Dz|H|&&8YG64$+KBw$57n(3 zz{%w?IUxqWF>T%%?LeM7EsCPn8Ei-Nthv#6C2(JILQ|WD?}p^Nwl<|vhmTO5ZXk9Y zK<8FJ(a;_Iow6u}%&1d|#Eaoc(a7ldMY85dAC;IX!iZ#Jzr12%&}i0>LGdjB&ve~EH@zZuMDr$N!dF*ZvOg( z0WGtI8k#yV3V($JKpS*G*sWoZ6MSF4GuV^e;zpeAE#{AAb&jN0KON=y-R|CG>M#73rre*0K zw;K}T94h90yAUKcQkxzee2?EfIQRq{qeT^$8>6Lz$E0=XDe9K^$>0F>6qvw_@9c$OkHp(Cn3GM(I$t1}wWAF2^eX5w&w0^XPBPfe0?HqivFaEr(d?HvZ^2MTtHXuvr2V z(RlCL6{s{mb%lb!Rmm`*R^4w9XlzILVGZdoH;o2Dr+z=cVUO4eqiz5$2*2!>Y{;~B zT$5AC9~IE$j|`3k-Vv}{L-(3En^4SS%dwPqmMiU3bSMMU8oC2l(Y65E;=-76OJ%^= zTuq93mda#J3T*?=L;K&Q(=eCLjU@G5KN6Jvh{d{M`+n#Ki#C+fT4+e1$s0>CZD{cz z#bpI1Xgkf^jM#2Po5r31%$xcy`o)e{_zghIHkA`yE%Bd_CaD=YBwg)iEY&~KmxH5= zTLV;D26ant0#gj*jGkgQ>*4p3If^lEB01eLY%4H6T6)7U`dlX;FGMz1j%vd& zUXZ8)8hTm6zQ5^V($A0Tnmm1E?+U@^=m9rgrM_T0dq~IJ23BNb0y{kQbJpMU$<(uH z=SAGq`#fBqy831RC(%f%*gCbH^+Mb^inE5-o1`smJQ_8MJJ?wW?`Mamwo_aNI~3k9 z;mAXow&*UCxNquVb`IiuDK3*84sW{o+dc0@qkBe*-wi9zM&-S3s{a1c^0J`38LjIU zT&}#CRNh!u&Z|_OQrgtR6qf^~X`XRipwcdC-yABhePi8ymzI|c<-Oih$Szl2K9%>k z<%z_l?JJ=6z5B_E(53Awr1GvF{q#>REw2d5`{lzMFAS8&zJPB#r}DJV#1*!MtTVh} z>{Ig}`@Pb_!#xK=fM2GzPd%3Q+0=8uRl3E`!kg?@88+RawDi!_&y{|H`qZcXXxij% zG?kv(AC2g-WCdX8Ra_HoNr&>Vo@W7i?drHV1a16N z+vd*b9wW8!>|j4pdFAHo4^l}4nf@f)pu7@Gq4v`9E}Lnu5`wxEEUkE%+Yl-&_6SlxV9NAee*|_Q$=_Yuhl#J=jlaX9=3T*HHlbA6-+AG1q<26cQrv;X4S&xG79^EEGBoIB#17e*TvU!1!Qa(|+>r03$=BR;tCySeXNoPP%7 z|Mvb*W&n0s%BG0zJ$sc>TJ0@jp)EHwC0uX#`GF_n(H&{x0vO7uuCl;@cLQ5s6k9?I zj0(vx=q5qcpJj{9EQ+*OMwE+TKa z-R?MFU5Ip42@u0MRyY6o64WcV0zHX~Z(NSuigL9tY9=Bn5MFpiRO0VKj2tUKE&J^S zjxVbJWsk(QK%qh|*%!RxG0dpU%@-^oM)p!|RibYP2m_06lXVNtiw5JC2@ z1IQm>6o5hk+8OPs!!E77%^F^!d6$SuFKhBc--Q_VxAtQxXNWQ)>cU(xV6U%^+WmT0zL85ZavwXc>zUslc~Bn zsDJNSAl6yiP$DX6G^Z_9$ahaa~Jf)6E5knkubgcNfy z1>bKamJpMBATpnFnREq#r%sPGvB|xf+9lzK67dm9?bZZ*o>uvRF23eFr zwUsQm)~l7sp-Qw_X%iI3%6r7p*69XV+CM9zw}$3V%8p#obRV8Hh#lme@mk zgikC+?ht$S;`!rA>dW`~bG(xLK_aOi!*72#$x^K^0*1?<0>u8T!LT`KDBU~K)PN#P zHsP)HFc`#xPqP`0YlCA@pAW`*i%#xE`^`w;Ueo3q&?58upc6g5L^Z&JLGTX-f@cj4 zwhshP7#f^G!J6!@z?g<^oav;Ay(SI#-*^hX19J`xpp1Y|_2I7i$Q8mUPQqmv9s^TI%yVl?ux?`(*)k&EqGOLQtAl>FIj ztauLP+B-sy>f;jEFIHt<_DK1%m~SI8@@tY|By}rCi)pr78o}A}_(nFsGRBOQ&euPPb<7@QB-SW)&3kLl&B%FRMnDMIJtV91Nozns;UVN-8Y}OZ#0a z&J)7BWn4R0i^f!(Dczjre_X@zl`Bpwdq6BuUFD5`E)f8ga`Bl5+$GZ!SEG&6(l8k6(qj@50C&x z%)1Oo)ZmLjq6S|K5*4jp79=}$Do9Gm-%ME;`30Ph(X#^*xtDdxRTH=6%6LjMDq~}t z643oRnpfte_{tlelO-W8$tvdI9#wi|T7Ng5>IQ5wjUX%0Kbf=;y|o21!+mVjNNY2N zPbm_<9Mnf4;Lh}*tHC+^JxEEtV*^^~i7lj@fm!Qy>byk4?N?g{pnU?+d9tIefc%yW zM(r2Xjz)hzHxGuRyl^0^A?aVdC@bAy)H;!-k&@N%&4a@q!b#p1Hl}z=c*|&_W-z8q zB#31>+7y3g6B25>5Vn6B%;CCZWh^l2elZw6PE<#cQB>Sss8Wg)*3AhB=f-B zvcR19^v!`<<0b>a30t{sFnoblMJw3K*9OC{*Q#?1^Vu*MK0&L_EzGBSFg!sNOPZ;n zTcbjy?*Dpj-LFwVk~S11J2wqf8Fx(vI{t5)h7n(3)PowFjrQ(=**IRK;%&_B@l8Xf zVxOXDZid-oBgGI{V_`bZkV@QKduCuNeynWt<=}Mm@cT}yt_=YFA^kL4t&eB0KID8N z*+nA;!`BN#y6Dv3lcdG!fi{gwrmen*7#93~=Ri8Q+-nKmiMT^)4j>MX9I=#KA?eSZrux-C; zEzaacAHWBK+Z#&ZH6N2&YCf8IxIJEe9Ync9E*&q85fyQX!voddf~o$u*e5QXm(^yu zxfDayQ5|GZjZab*Y8h*`!=uZ9cK?yUkD&cAdUt!dmy%mNd@`lB7V~iw2keAVjq>sv z)HpBCQX{=e`o&p(jfcOqO({rQ%r|bsx)yl(>uspqls;eG)s79=|43|AR;#N(!xmtN zE^SfNRwe%V!9)VWwQPwM8IN}U!9haOjQfQ$o&)L7&hzs`f{7l{`Yo-Vy4?S6W{)c zZ|NSN4PTzX(j{H7&x&t>76o`dBfeF&D7$uKUrh1^FF!tywjiMH*y~=mWIw_y-X~Lt zIp}Z51GQ_cDB$PX6A5n_R4+=IhH398xpnC!br6P`N?l> zR_AnJH0fPJCd&Syk+qlcXKzay^A7Q&r4q2@pNHB`uGlPC8D4OKYM0AyLRXG3kUY@Y zf8IqS&_MD8hB`M3Z3}T|{$dx=`S*le$f4YgjwROYq6}6;Z~(pyxy<~23|dc{oAS1z zkjnyT3-R+3<@2Q>7jFBM;^zgsl(80aW$=3<>PTE3QAc8Ngw&y7ta-V#A7jlh*u4A) z`^in6Ix|dLVE)n|vnmQttTL0G&hC=G73FH1O=xurLcl78omwB-oV#0{8V&!(MN4aZ zba;{0BSDasZ#zt&#q2V02D^cankBkh3ukEs{z*Q1DRL3IwLwOb zrP6UPd>*FpV1xA&l4+LX&M6Fs98rL#54zrqV`3js+c585Om*O!i6j=F0MrTNg4^ zEW23$GP$2=tqK)o{D(cwwgPk4m-}O}i~LWa@P|h1R@({k>%?|eL zpSmyYW7NHX55;qk3^9&5x8A@9zve(|q&>^(N9v#*~C@ow+gOZezi%o1B zJIVU(r|jP;ZGt9*H)Tr3d(#e1-N#NQKWLx&dD;Q$?NYT_ zb17Lrb>RnTXQ%dJC#GSuGm{O(-lqOisNul=A{x;2BvlL@e`S7HLzZf{juYmbVBTQk|Q!8V5L z&6MP0+#zS5Q{M%)+Mt&rdJ)=BU6?{iqU;04?Z=daYHOey@86mww?S)WVIph^P}4HUFH17b3{W_Ua~%u zH-; zyL1W-%AdilvjTe}?3(O#bMHJNBSN*7P%REavpq84FLAH@Pw_1jvuE!TcS4)aX_@6& zG|@P4jMR56jitGX>h>g~BzgTgehojLtEfz=j95y~ULfxNh{t4B0TUL;e&J}8wCjBw z@1n#v9f46as)Is3zM=@+H4^_Vgf=7sRf;Q@KL03*LiQ`MQwFD7{IMlOg}Z zH@u;A7}`58iy=vnlyF;tMEv?MXmgC*?}=c6M2b+M!1)ZmbT-->pGTNxN&x8e8x%oO z-F%%U8_gPkoHI#co4bUUBvdP6l_Q=ytiZwcpqU2@ug8qhIvM zcC4?6LG_=xQDH{_EX!geJFQ6qD5Z13j!m(>1gMjgMPcEF>n>Mq$EE+19Gdf6%d zJ*lJXhm^$vY@OLkP|ns|z7vj<*Sd&7~M36&Mi=kT-$ zqDXf0@8(eUG1?$vv1qTM@ku;NfP4&i*`CJVVmtWPXi_La1#j1r`Mxe}oPt|%D=q(L z!bEBYbR5l^$_g|vn5H)75`0fi3z-YBeXT`24|t*=SM@F`SxP+O-eTnJ_g{x!1BSK? zb)mHO_{L%Tc^j1dyysPOj+Ygy;xJi>N@aA!3g5AtL;)FPxKml==BuwGlRSAl8J7UN z`Ugy)*oMg4=E%L~+U0WOWE6l%=O7tqm$L-7FSGn+H?UbesAOp)6am3ra_Limr=OsN z13t(vqXQ!##LXA%#?hSx%$Y$G{NJP(*m3}o){Zj1je|12|FB<)?R#~geVK#pvwkq7 zeQr13I8$vO8iOo^_Vp<3JDO~trS`$FJKp>Ol-Kjm=rI^58mPSi`3u7G(A0&tnSP5$ zZnN-z>?Wa07H!8C+HBZV02?+Jf^wk-g(y*kFAB;$5L$|+jJ$qmlmDcOIjPB}8-|KC z*B&L_E|-A4g~@bpNRWk zikl9bY&+1?Og1~nV%Z1KexuQ-RaAD)u-HYqK$~4fL|L}Ji3?xpXQZTBOAY#4o5PWCA; z+b6eLq+<3AcFuc7>`H>ic*PJUp8nPdVW1HJy7kmLwcEO9A%yaWa|ou*1taN10y)wr z_s*6~>(-KbcVqq1OOt|^Zz&HHU>1d`_#=5)`zv<^Be}l>ab$sX-MBAX4ET$y= z8z$8#Nz(?BelGF94ozy%LDDBNshLv#?KnvkDH2soVk4pKO|^pg3%I7Q!PC^m|Gz&C z{cCakynk^0^fgH%OUmp!n|}xNsF&!~Tyx-IIbwk|XdV)&)hF#ISc=?XmTPTv4o}kK zQ1E8cW~b=p2d_bL#b(;PNc4oC#d%T8p2gk>KSeIZ+xamPXBw00ZAdOR9AUM#z&N?u zRxJd_#ixa5hQc%df|ZE>LJ5Rb+^Khm7q9kuc;0jx)fgi70>@#i!gxT;(|9Tf81v z0wtmEa#<^v)Gw{13WS-lR`N^5^C@N~Ru0W>Dnk!ulrImAWs7YdUUscwV(qf2mVG{$ z1zluaczg~%kD6^F?%u}x|&iqGWAw)t)%-uW$q$&yV2w3TVG0Uspzj0w3Njq`~wnv2EkOnTR9cSEHt;T*O-I) z=Dq9Du;sNZrL(JT2BCSI64OjEzsN$=ps;YT%C9N~Jh5ITJaISNnqP)g@xtb(@iwoy z8gDl>`|x&s^Fq93HRs^%s%9(Ru51?YHn#aFL;uOmAK^{kyp5rOIod<>tDr!>W~OSh z{QfPdX!zq>Xe~lF;{2XuRQEhIu?9GO3b6SKu48bWf~yy<1Y9Xlzfo{m;F<{6)o=+K z?MU?}>hvk826z~88GqjhuS_A}AobEDpuc)Kk>E$O)$((wYP;tRR&8f8YWciD>+iw* z3WNYUZ!&uL+@p}uual|2nTHw4^Hg04$fzzEHD*{w7v*Ob0`p12T1rAVBl5LIG@fNq z$UZ-rMdf2`lK<_M<*s&7`%hIIblA-HVBY zV&DEaB`{RLSc62sy4G5HK9_u5VTh|7jFbEOO+WhAnS=+zKBS;qG=hMZQgQYVrNz6}`i<+MRnLSG|> ze5i!PSNT@sYeaqZ`F!~LH}!RyZw0=-sJ{NdSA?&>R9_vw9DJ=;UuXKP_!?ASC;1Hc zTBW|G10Z0Ob7`95=$s&S2fXkQIj2tog{#dB|d5p%-_Ma z9j?vl^B>^as6PKUTt4+#f~yd&8{o=R!;)91VL1Ls;sfMnea~Z;|ItP)p^@gf%d~Ez zLK8&R(OlmMH{W_px7IcUzSIXlwI$(80KMCmgzsuh@3AG}>%-UEZAti+;;Y@3gl_@9 z+H6Vq=HTl%TN1vR_?n`=rn`LxeD9t*1iqc{!WU$zK>X!ggzxop2j|qxWYoKPD&E)u zW3LykRA}3HxS&bqX>gwd*L=7R!+SB@g%Qc0X5dLX;?kcuLWei~h!H8Nm&O|Yjeb9K zxxCr-GPlstZ( zHlBeu@(Yj+YK#{1m#@S_&T7X(VmxL+vii}cmxm!(P6yVz&4nUbp~liID9#QIuu`_# z6y^Q8^AiHNQK*EzVH>8>kL#yJk*$X3XS%}==9Gmha{0eVJJL`k*QWOeM^uzkzRS^w z(~1uJ*&?9?aMO~>ih_H}t6EdN9E5mEryjl+l!bYp7gj_6%=h>c6 zZ7x55g7)W|iqOYg{Z4?ZC6H~}yc6~7&t~sphk`&`p}RDvP!cXl6pL+czDl9H#Pg5= zG{x)jH52TAic)e5$?nYIC(%$hdrzI9367MxCT!6(?5{b+9uS~3wm6Hqjoz{{Phx-5 z3R@QPR{Ru@GAQ<`tF~Fj2eXH@&xs}`4^aDR1hs)>5>Hne2w7P8|Eix~B(Ftf2@-Ny zkbrF}7bMf>pf>uofkfeA7fVH;NBbOmV33g_a!ndA49$HgHCh%kZCL{JW<@az4QWo*jK#T%u4}%RyxgvcM3r6Vi}Z)Q zevNMfP}6>k#D9XUP`Z}XmlCH@q8obhxS)u7o>~;#~U{&>a|WKcXz)rvHiI znNeS5%CV90RQnOdlam(JHyaYgrVY`$sK!684Ca9i2E;Tz5vpEN#y>hcDBh?nH*JV4 zk3GE%O8+rj55jdfT*Yub2A81MX!RP6UKDh?q<#cTVeR%4a)&|w3V5qrvzNB-aI}r8 zd@DyR;0O$MnhmFv*`RV`*1(8(Ar0ifydguc z>)hbbt3O4X3BdR!l<}tyzLUW;iLXO3r{fFgp-^pRWmV|Gbhf=JwAeU&LMZ;D>_@z8bxvz)T4SZAu~OGqnVP$F z#JlLr|Iy`Ttf;V6cZZrg}Pia3s53w>Dbm(FpQhArA&y_2e}vd4S;`9be3E zo~ZD3g}VDn-mApH!5@8I$b+nt-UjsTAOXtw z?o&y>tY}b`fZ1AE5nebVy(+ZGs5q~{%AQG9c2NHn-DnZH6tIz@h0*OFC$*yAYWTZC z;J@rfC0mK#c}CGFbrm#3*y5sqfl2uxcRnC2SAOU=GyKEYF|fr2p`ro^lnO!~3v&VU zz5u5!9)olXK1jA=ej`4(vfO+oMa}f^sn#SaD&`Z=au4WAe#hTXak13HJAQ%cu!#v| z3s|8@7Lxwkhys+{{s|u5Ns>#mqqP>d*;3E6%9L50zmg*Avqgm(H|hF*GojP4=?d96uVeGM5#PJx-cdz*@s!H=(na zh7)VX(zt<%RMqB6?@x3dLXrI9Tyb#@kYT=FBH;cCeOje?Fa>f?(L9(7n6h_1#f(aDord zK}HQ9yz^4Xx)T-QtP^K);}XaK@xw2Mg^TQ9RDEax(!xjCL`+Pp-=qMn|1iA?8iBC5;~CkOH8mDByqgKSMY zehv$MN}EPd&qsv5Or${77QprW2H^9aQFvl(RR2HZ+!QjAya5w?DBsOJc;aw3 zYYm>VcUR>-lJ#g7;+Mx~4oC|BWf>|dG;Numg{Zfy`Utxd=2n{$Yfpq9vEr$yfh*no z?+~V_1JIFzfMju}xVnRt7>oIBzaW>??$-G_fq%3YI{o#(0xiaCE$Xhva+C@bs-6*z zKudqor+7^Ugi>>rLOKSn0NQySdT(A*#5^;-#e8I36|+~OdPj2p0yj3hL*d!l3XB>7 z{?ikQ%kB3Y*!^n|shQlnw&y4(P*+ zrsIL6Y<`hxi#yB1ie{DoC;B}y46V~c^WCP+##yG#g|jqx0C1}aH5GRN{x#NMPJPLo z?E3-p8v*{LIdNsvFE#?^2-Xj`4Y9yozLaO%WXr(VMye@P_5Z$}29 z0H3!yugUBd4S|X55jUPEP%~YPQ{Nw78lM>sPKPXc-)r#s{G}AndLhM~MZ`Bh23&=S zJr3N2fpw{0w>lRHO(i4!Kky5UWkvq+t?iV;-65!P$Ase$lK&VM8+ugE@qIg%2CFGEsd@MTEK z(U-S~4d~xFt!$j;pldZ`xa_;D+7=is0zWinprIG(&$aVjI%++*28MJ=U=j~?C69uA zpoDK#UaH#WLoUl>ygF%26?FHA*js@dzrknz8LsOke9sBhWGQ$9toBAVv{?zoJklVK zAu+!_fy?!LqZuV1B-%iHMHGNhjwFDg>>Z2CIk2_sUL_f2o$YzS?1gp52=@~9Ilogq z%YC`2p#kSuE5BAbB9)iN!nLKaGClUavgDyVxOM)lI4)u6!3=xD+A+7f~Oz&wO|G=!@L8oV{m;B zm;QO=pOZfgTv`$Sbc6Vpyy02_29M;>dC!Z1hLCh}#~PT#wPLgbHAM?;Hb3ys7u;;V zRf>M2bBpKr?^EbROH3^?4y&}jtV|-hrzC{F#7b>h>bc4}WS08kH;Ro#Vs?NC?6V5Z zYL1mjCH$FBlfoREpwQnW!@y|!ensQ4AyGTFsR>c*+=VHIK!zL<9c|U86@*-U1i$G{ zW{Kh{C9T|+(r}{j&XKTC7;jb=3g(_^+ES3^DJganeGRJw@kX#TT#$RsZ<&+$D8nuG zhu2?$OOn^aPmM@=RiQJ_&7C>OcH?uuDKYw1KMYM8b_m+ zCOSHSS;qFlA9A>(8*kHuog>};44(G~MIbJx1w9BQ!fGel4BhRJ0+vMeo2Ig&i4nPDgd9o3 zy~(0VSdyzk^NkfXbW&)avV7~Pt~4fx*IGV4XHcG=Qvz5X%{E86TT{%fE{))y1>BSw z#pt6oyzUhwi%OX%r`T6WxV_>iTIiJmZg-`)+3h*BC}lzA??uzD_VArrbm6)fUDV_> z9q`n(XrsLbZ=)nOx^#^ddVUK|3s@0Q>gVMhTrnq;w-u1ST9BBXIkDmJ%^Iw)jV&lD zVM`5I>k{7zs?z&kkrs&smy^~M6E=cR2Rs9-s+3afw~@Ed626U$s%8SR8ec&=j;Qfx zgF*!=G%Ln-G`jRa7_q&LE)j*9!2g~#kZi`=xLDUHX?c!P-+bsAs_%BA^6AC;bq0yQ z3An9oK2g_*pSAc8SePZyGx^f*2FTFr^eXxBbRo#ALXV_ZERU%~>1045-yKWtRGV>* zBOS;eR7p@s46Gv}e8l%9MBti%zp)4rvVnpP#7O!dDUueY$t$2}kwF+Jo2(=oy0r14~O2pcRu)7qHj`yT;1WOF6 zVdzfHRMyPEBrgviPcC==#n)b-W%4ebg)EJpKdij}z{|az$yD>ayh(Xc@|O*nNN=YD z9ZLad+h_n@HW{8|d^_OLOH$^#4^4%$JZkUEN6z77n zrRm_o=}qa%(Q5TO16ihb$3wDW@;{Bq4%yUXfkURvCRnoo(_}} zd1MrCfp8^B{400Z`Kg<~bS-XwEn5~mK(CA7by<8T6d)fjDnVIkuj72Eyf;+d7rdIw z@OcUT)M6}3G4ieiYw28tJGt<49zXMinzb+B%dM*(>9&#QHm2rL*OvkjAx1WYo!LfjW?ty5C z^!QG%ecUTSPNDLX_v|0Y9>ZQ z&JOt4qt8a=xv~3--J#&8TzfP5z-kFO&#(o?=ad3F#CGO9Gqy#7P~LG9YK&nuJF+o& zq7uB5f_>;~7ivf!KsCo=M*Kp$AgEc0^40zvNVb@QTGG&TaG zXlU^nr0HY{JNw-Hhr^>xN)&VUVHbv-$KB9}VP~_O&!4W2uOF}lnU2;qsWr3ng6*|4 znX~ueq*h28AB7?GdRMmkr5Sq%AUh1Rp_% zg&pPL`N*B=c<#-(39e`XUg$8b`ycXQKPjtDW0t)3?z|fp9t8gQLeR=T1M0;;ncw6R z1TsJ7*F)u&EqkF6N|k#x!F0#BK!|ORi}px?J3d+N6@zJIWQyTvT^5|+_%}DO7+93;6I&hqj~X1krYBy85x4d%8se^;BG0Rb zItzjEUP=DOB!6vk^jA~{4HcE;okt<(9`b}092f1>%KsG6f8LDKuOw{GeDtbdewwwB zS7o_Vx6&wgh~f@lH~1fD5jl$SaQET87s71tPz2Z1eN8EisZB0T;{r{SOAGlnF3_TU zqm6RkJ&=3&4q+fIr2@37mD{wK>i2_nP|^U##To+Yh1kZSdAtv|X1Lyf>s7dZ2iHdY z5UxhJSm9GgLxn#(3U>~74)^15KMwaUxOc(*4BXGay%+AiaPNbAUsxBWW0ktZUbQfm zz(ya3s~0ZgA0fmEaNHSt8f!T8S!ul*g1+#ELIl8(OdAf&?h9Av^{Jg;8|;Kp7f!#@ z2jxEWCoH$;5I{QfPt@LIpPW_tBpdrA@JH$sO#E~`JiiLpUbvcE;?#YO3q-(enDt45 z-v18C8tbN}8SJZXAtm)f-3BMYUAGC;b<=x9~bCNdQ#n|0EpNT~d%+~2Y4zGUazDYpWu z>k0vSbQ&CbS}Se_u%pSuvQSMQHq$+K_+n9s%_%?X_#!YGqP->jzjee`JH811Q1Tm+ z9fgYpYlpyvdGipD2ka96?l#B@-2kmbr6Q-<(PpZ5qnR=_q0@<*nhC(wP=hyfu;bzL zQIsx_qNHIl&hr6`fYm)XpuD&)CxS+-=&t?&$3MX<0Oj|=Ff{Y+Q*q%4r1Gus5Xz}w zZ7^OPqY&mn?de!&-y%UM3%_Pt3QOqP<5^--Hn=_1@G=l=-TESU(?|h>ez(&kt-se-wf=#7p8pvM3fY^l;V}yh_#bLOqm?#iy9So1(3@xnzzX{O?ob1&dxxEM z=u4wdOOLpd;@lf{w)^3Ox^aR~5DKmjIX_B_n*$vYcJ6g2#^uzZDJcKYEC{<{c)4+S zl{s*~9L9w`0)Tg%#)%ROX7Z=5PEHgeefgBDlM|)$B+eebPlLmvysz73EHE|vp28es zah~@k0<$E3z4F{2xLV><;W^r?59c@3eU6((V=-=-+%e@Rkt{Jau5VttOJnXXu&oI? zCEh(|Fq30r1~d75% zr#M<`Qd#Ru7~|Ku`6tB+J@?W!m|MZgew`G$5##u~!y@$lE0;&VY*ZVo59fVcKB(SP32ae}-!NJb>gILf!B+u2pHu=A_l;NeK|g*$xtv;>`@VT|i&J!W~FC{b$H{q>}C!rh@{AG1tZXX5T|Ng~p&QVL2YimJXPR zZ$AT&?A(p4S(5td5F-+_M1I%cbSs{uXC+xU$V|BJe)0-l`C=JypjT32cr@J5N?QQmh3w+Oe) z#5Jk|zHXN(^M_n&wO1#CPt{3}phx_~_ zh^y%c-aokP|78+3JSAR<-=Z5_eo#pi@G0v>{9&rer4@iRLQ)uvz#NG$Qwj=9f!=uZ z1Bu^(@4RW!ATPlmz6n?FRS?u!oj{{`ph51NG?WI(oJ2GTYm4tE8*+QMW6z`4`aA6V zm%@@=Xfr>O!Ec^4AhN)G`HqaF$RcKX9i3(-0yZOm5!tzAic+GwA8StAfm@To5u~5} zWs6xT>G_fl=F${@O&9YEs2I^Ck|E zg15t>CI@bo_zfe`YO$RkcH{E4!iZ|)8n1Lnv`H}AoTAF9m=)f!n0 zmDym8eHszODIkAw>A@uy3Ar9zWZR$$*G^0>QwsU^k1GeNV8nGbV8py&`8fkQ#3Wvh zNE+}1kkJWz8eFH)XejM0uz{PT0a54 zceJzffEs!oHGQUaNC$WmHzk5VI`;Ahyn=9Ttxj``rlvRh3jo@+HGQn6EB>gX{LIQb z~-vB;=kJhLk-F*did z)r#=1;p3iE*e@e2IGzR$#wWi43LyLdHECYZ{b&yc-^9mJ7WoqIfMO(<2*|d6haC&V4mvs8Z+Gz%n&O>2*g8#%=Wh<~3IJv=}r&L-qn)CwjJI zsceZsVqMv%x?99h@C*#fU>_^%lfRzwlkTkOIX$yHgG5nx;SIXFzy!9>vGQ+egRCi-u(;MF+}1P!6` zGo3HtE0k8QmX;kATcYRn;f&v4i6N(fiQR=cQ0yu^m=)#%_mnBEarOqMprmqT3t?g7sLLdYZfGS6vPWnxQ=-BCjzwW=p7 z=mH{JU>ztEULix6_SfQcKLc|>jFO-bWrH~K?!EpJp7^El!w1@&@dH?BIu40%zE2Jl z1E17C9PcD~+Y-n&h6#+_D)s>e4A6-2RXJ$pw+)nlnO4aiC*>NmCgd^((KwiIBA zlO^b>jeJuiOwUB`V9|k zGYS;E>O{FhF+aErEEddCVIh34N@dM2K_%kX4RTsF2FH1Y)5_qsal?6)H!bQsk3Tk) zCkq_3M{*}CkMHwZ3F$clWH5?@sb@Jr8O_{uydR0n#Nzn_Q=~JI4PBSO`LNJTC{i2xL+Co~5cB zII$Pg`09R!6ju?+Yy#tb55X&t@rBBJ3Vxl~8>3A2;etj1;}$~nZoh#yU4?`pJp3_J zF+}W&r;(nV7IJUZIRZAr%99m}fg(W5gobh~y3< zJLvFGi+?;YUoSKRR|JUia7csX82OD+H=5R7^x2pppXJ?%-vy4aQQP1iGT^uJysgA_ zTcW+9jrqDnx`-kA)!(+YM0 zHQZeo9WX$|%NP;k$7Y~_Pw)#g7^kU&5znTk0827}j;iK*^%dB5Y(ker_)p@0t;Bz) z8UHuZb0htq&d2{#<@kRX{(a8(1T$YxnAr9b4sqb2Pve1mMV9+^UYIWmYooE>UL%Bx zEG!!3=4pvFP`wh>-Heg#sQXg1AE`U54c=PyM}sDi$6N+4yM?^o&h)w^K0-^_D|WB4 zKC}f*g!~>e$sHFE_oX5k0c2(+`Z=!B0e^w}*GZ#XbVUY~p#ZFc#Gh0~PyknpiWrh= zLP5YH@!xBZYMobwy@qOX6)_y5ev8kI0|HIri4P6ceCpTm@skw}6p51#2T3YSVPvdG zA`#ZTk(V2&U_y5R(8m(g|J+IBRP6h250&*%5~h2D6~Xc(2d>X6GXzJwISTklo-;WC zRKyi|HHM(2JE{$s-26s0DkzR{ehQ^>+_HDY>rn{ULD?ndydm*#sE}B4)Qq7~W6;2m zgT>GJDLN%@G}+aFBl51J6cjv$IJMtGvy;LzU<>;K9O?lBGE3rxZPnLfbfu^o!UDtcDW zjA5h~Oq&ZeI=Q1@ILb*k4M#culb&3kAYB0rL%-R#5u3STI>bJ3f)p%TGl8Upg)Wg- zV@&cGxDh&($B+gxiaR8p_HB}*=)R8Tc+jFQtcfy1$k_pl#3SVYDr2}rtb_k>I!VNi zO8km%RhrPC%t{|W1(Rllq7$wVgqbDwBYEXUsLoC4!>PfxQ3KUkgfi$@;8Q8&giZ)mxkM`0e=78&oB8V$o67wK^4Q(`b!Tx)Sa{&V3p3d^=+U`W@a9 zscAH7jMVQB{Iuy|O?@}82R+DdHsOxh+?K$E`bc0@Q;PC3vOW?#U9r3pdR7T)4R(fW z6HPzV)*lUIVUTw2w&1%>w~6qTwW%s0M5Z1@Z)_AiANt~i%<&RWLC~afvOhI_4EZ7HMuXqbN*b< zh2YIi?tXZ_X0E3{cvX`-0ng^SoYm*wtlf9j;ve;U+~As99Dag6Aslxf|L1GFsS_FD`xy8Rw0@#jCctmkZ1$Tbo-(bZa(Hv<>4)hD=OQ@tg81I%QHUib(J^fy9fn}P<% zI32tNO2W=<@JVSM?pP-R)8$@m@QNzAra}mek!$W30>(Cd2Vj2GosFC2Y4|JvVjhJL zz)QXXg+N&^Vb;vK=_Smx>IIDS3qJF7^o)fH$$acdwAbW?Y-}@ufc~~10{$Gbs z^9o#10DwbF#l3%g6xFo=zCR|LNwUc-kU)R{QG%k;77ek)O>hI*Bq|FV)@+EHzfzW=(T9c3}maa8H6-FgdW}##UgOM$G z1BXuRbdMLOsEd%*C|FmqN3qN7AFO{sb`kLvyu)PNni_NxH%N8l=;L^ng=QR;WVybL zYFjbO#BNkn=H&X*T0nZw|Dc`d+CBpxkIFAA)?SyJd#D2?ClQZmW!@oGvEf>l#iC&x z&!V=^$>hhiO?7^JlauwC8lBO`s_QMzAw#8-MqW!mN{AO=bJ`oLqAkwrhC(P2IES@N zusq^3FD(nYqGeunEd`iJ-=WJsZah4W#4KVIEZkvdL`mWfyRPPhnjVQHg>^7pz2bkY zy-s%s3L+O_fC#u*#RN-_iB~6Y94Ce{n<;T*$(uuTF~cb(gVYl-db|}}18$_q(^kS5 zJcfru6_EIxTR%iYWe6k~KSR4z(tI^-grT&b;k6jVni_EJGsXM|SvF1*nQA!Iz$X?3JCb!{l!Rzo#w$Wp> zN-nS-7l9wR@k>Y~?GW6v0)uYHvxKyVp_0A(kxe}Ggu$@a3Uh(5-@?ST@ub)VGw3w= za4mjs$s~__hrUb#M(t!DWnQ2`aV+HN!A>Sz9;9yvGSMpJ<`rN#_cUIVQOs;I^we1#G72z6h0F?A{Dddy(D9I8K>Apb z77T$#^(yRntT?-=I~*kNdm&_2nKnex{)&5-TUT%Sg!s^u$_zgy``(A+ih_ zinnlCBlN}9wVF^E^TaPO>dysQw#qF{+P-oKV$wN{hv? zt_zoG`x(9?Z*%IFQy#g}X8-e++2UYQ-AuWVwYP4`5F?Z7Cdq~9PXZ{oy)H>cgL-lB zx^+5fi5pYNvf)a~amJNd#cRg$E&nAqhr3Pken*?pmc1W!>Fl4@E|3dTsb-wqQU4JT zZ9m%E+#GkGcrv;`Nb#-QRW)$E;Vhl!sk`1lB|G{(NgOl^I-IBX?k|v4(N%-iA~Rbb3eS4GC8ezs_g@A z6FkPO2Nfg|VMmZzV5ig-COh zo5V=`mf3Y|{Z;jG#}7A5Cr^(pKXbVJBoi8`OV*VIFUO5xNv<1pWx+l-F<8b#ePkTb zBb+=os@147GFH62eMX+T_^pcN;BX8A; zM176VtQwraEcO8$=CG#b>SSfhF1aiFJ>c}Fc1q>FdRa;;4TqHSNq~9kNq|-EtnlS8 z^^hMWWBHP$)+&bb#pV;J+$sTS%2$P64{5bh)lpzAPVTBOcTG6y%P;d_ORKeP#Y}DT zsC>mtEaTI9Ms_%3x|VU4o{`0j>0&d{GO`uEbegdoGTPsj+v@V^Sh!0rP7fBb@wsb#W?iaIM7|YbfGuN!0nRad8H)XUnTKEzG_1V8A#33r!O5 z|L3Y9A9kxMylQ$OXo1k_2dso*iXm%J9fY1=j#UwXg#pj4fqx=Lfm^Js!Axq}8b95< zt3fs*hz&xf^!FE`t#9s!uXdcRYA#}dv=(XO#$2U#Ln)iEl&YR?oo&r&w=-{%H<2?f z6tCXC<%?kHU&X8AHd=kj%bI28tt$}K99M)c;8H5>ZBs)t!(xbSCJ`rPIxI)rt&o5Q z{UsLkfEI*1J(qQZMP(98f++UOy(9!rX^u`%Y@-MYl9Ihx)5uiM)lM>Cs#}m}h*6Sf z|BS04r6jHVDOe93KuchxNzT4udQz#C1oR|~^dzxvuSQQc{>)QR~N+fVD7X1kCT0Wrq)S4dx%1~1}vP=BPY(5^2n1V&-&v(g@ zVBxFs`@2An_!F=r*{xI0`3$e2Sqr=obrOQ)+Fo;HTzMa!vDLY@Fb(SZ5-6s=6`>Hz z`v8Rc59y-jWH-m%E4D`qg=ARMfVRUL2Be6kOW&?nD0CQBXdc9T%AF7w%N)y@_%CzD z1FvAD+&hb$h|nh$r&f@6SU@h!$c$Yz{@)C#0QY!+TL(I7c$IBK=I&KojOF5toc6-J z1waJkuEM;GrY+ZKWABv~+p?J^p8-8KIjtVx$S4GYI?s=vDV!%Nj$V#Bq@Cr#LiL)Xmuz*J0ewQO7lle^4RXoTA1RacV~>+ zsTti6mXjZDjco*v&XfPOJa0uu=UMR&^RQpbvujMAWy5)nV3o~BR?y#N^q1hT@3xvQ zWJVuP)6O2+q^ftMs!LMUMX9Pws_OQ|ldMEdkBgkdIfC0Rm)v9%&Kr9(pR658+@$%v zrFSL18X6Oo6pQL|la#T!sP&r@sbrxKIn~qBv@1Xx(8+H>6ag>jh2NSEU~csJShN2t$Bn!ar?INaoRRGF#V zt3`8xX}BPI$zu>%>2RyL7*6_E>8FZZfHB4nTuL=Kd;Vq^DLvUuW@G8nGz_S5yo2W$ zxJ7^pImf98StuoAgZ5w?3>M&-SLIFHhC2!=a@w;PcsAdBTnm05gQx5vTH)g)*Tw9( zXJh%g6pPj&NP<1Sdt_&~I;Wzh2;yP3oR$lCs8@X#W#qi74j~cZWkch#dz5(XEqzqJ zwG2>=oqA51$A)>5Fr|aROsxKz-s*gZ&dSvPDp-RifrF%uxk2x3Saq>L|yjB{$g z!uWKEpMvpUkIbuTctpa1|OgOCy1$Vp|mCyFS4xw*nmm_5o<#jNtbu z71XJF!&yFAZb2F2;5;B`N|OG;wBdG?HTXTc6a<&6$7p(33YHi9;!$Oz8Mth@JOUMG zcgXJtOVr_&Kz{epvv_63++uDH228Vdt14D5J5yJO;NcH4gSZGf}cm=CH4U6IeNKW!{uTXja z2y%6Kxn212a@;5Mk=zXrH+){wpC92ct?8TAyqI% z;o}Edaodr)p2&h~0(yZv^ykyG;7Rb-7%R95gVc?w9wjCA<@Lfh7LGK`OAK^L%Tm5U z+wEEE@%T)YK4uxY9M#t(UmOD-dKR!P;c-1RCRGgX)lE;?XlU= z`l)~ocv|6UTe3L@_;S?b!z*aVA~@Rfzv5ve7=`IU=Bu?hi|5rm#{si9M{G?emkRa0 zU~92Bl(pq7-J)w2vuH{KjJGd5^0ZBOrR^w&RLJwuo|m|lF@jvKo~s}?zXc=uCg}eb zwti?wJCKZvH05%72%mr{1+!Z{HxmCz^+V0tEmd{yo0wEnS*D68^Ke*QPQugH5~=o5 z&V{^bsE;b7lU+7?hwg7Fu{(6i2e?HHLP~Hh1vYOw&&aLHcYNujG>hIru@4FyQT`UY zIRT9+^Cgl>gT~6`O&4yXh^Qccc4)klFsXu6oQ7h_ABJt%`^r12BDD!!u}NONc;7c#!ek zBMH{~tL-0bFv%a7T@fvp{X7%^A?NMy^VN9H_XJ~qf)(uIVCGQ@^CbDyxz7g9-@pUB zi_DC00|Ir2G9`F_Hw{0eL5ooo-X|DZ3X5Kj7HjW}d@n04W&z2HS*~I!Pr=&X=K|E< zhpRVe?UXAaH7iv!5~N-XzbyRP7qh~OCO}G~iyI0978~Jx{VabiXAn~4lN6`t6sR;| zGJU7mEjm(^kgnW96WIW*qf%8e@ck{VH=0S)i&!NGfrVnzAgFz1R1AJw-1s9FG zQWh*tEpwAuRaAfm;YFoM?QxiP10z1hrqa1V=MSXVi{VlMf=I>IJvfuRaxP}VO^;q- zt{4KrBNb#K%vUj5FW%lN;7Ytn)aIX-i_Y2A{i$Y}zUD+Bst}Ey*0|4R<6C`9jUf|l z#KWwtP}BT+j8zz~ZWyVC9#;KKT+FJ{d}%AA#$gq5u}x%Ev_MALuQED?S&vtK0${$N zn9ZSu4WZhra`U4hI)?*ua1O)hcSatR9IWJE#1MO*(C1_1!5Y+94qxWXo2@n2pE@W& z16kBLMdO~qpBUBxYjI5~k8WHjpUgfJ?y&|-Y=vTJL=_va;1Uwt5rv0jgXiZ!Fdfle z{B$#|egZG}5r_5ME1Z(cVVFhYBIqn;iB&3Pq(U}$pB1fW7Bb?>UldV_|N1X*v@{hj zY-$?{2SU(Mjf)ow=7dcQ9bhmaKOH!GgPWzAlE*q=_+|zi>(cf(38k{I9yl4NCd&X|0M}Og~%)R2( zdn8w6gT;4GB|PQjjD0yPEEKQmv~3E`u}E-{krKBZNZfAHh}#S?+&wyS_l~d8w4= z{wkYP$x8P#NKNi%;n!Zt3KdO@;(>xp01Bc41&L?YXZUL;AO$%ynt}w2b`;5HluR0D z3oiK@;RsNmAviY2ZAgS&(O}V?QHhln8KXek%B{g-qqHC@72O%>L0>t*^`p-qF8EEv zW0mz5D0#6_x<49xI424{6&_+1i$nLo$^l{6r0RZW)ToJGvJlmyX#^n0z62MOq2a~k zZ6J5NC5G>mk;P;&T}&+h5ZSPp0KPX;Lc5WLQjyjQAZtaXVR*C(U42387xHFArSv4l z@BQ%0>Z=-{)uI#TAwa8zqLmWnw~tX2eU6yRqiB5_(Msv@;_gwAn}^Z5cobTlHpwg% zrAPH+QvG0O51slhVER+daY$Rl@FelWURau8Yh^i#Rpc7B3 zIsNB8#RWQ4Ih6VqlH1BC?-V+{D ztm2cbfrdhuy=z@B-YRY2;Ve(ELxs1qh*XAnNgXh+`19oA0+tMtPx4 zoTu`Ck)}}~7usZ-cufU*!>7vIDSqTFJBnty5S}x_EmXwN&{kR`=f&VmQJqow`*>a; zh8g8DQkuV?_ltHE<)|~?7RKuZL!rLRat%kfhuO zb4N?Ioi2u2>Ki5xagakuf<%z?hWito&U@+RQ+O@^_IeZ~FYtPWSTHZGHf$7StIe{GUMNTLG|=FH~__EAGLny{s@2-yWlk~}gz6P`qFEBJb& zK0GNebndf+Zvh!=Xy=opL}}4Dobo^kgJRWe6#Fz>VFBH) zsGV{GLcGq&LWsl$7cg{)*El{k*jB2!2F;nG4b7AW;V-+}{?woxLmZj)9>W7^#&~GQL(Whf?LgRF(a`J+4$VQk04I-`Jd72fZC?5hFt_ zMOhOJt!OV8oBO1VPX_kOd?v>_k6b^F27Ik@F{^$5^*BA5nceSTR&fn8a6qiKir0tG z@_rDFM;GY^q&-o-I#~3WL0+^i6%g|9Hk*w0zf$>$^1Fn&6$LJ=*0`mpZV}3`0ESG2 zxBOcG6h4cBH42OkUjt*621a_!GBg5@ZC6^*9bkRlf31J4Tewv$*iMzJZ>Yg1d79pa zWT@4s2eM}Sj7!xtj6l13=!WkXw`k5R^J=X8gc=P!f0WzEb9y-St6ggSI&ANUHQ2lq zw!6tm{D$@C-JZGViseb`kal%lFY(l?RCKx@;(F5HjdC#~yGW7{A$;eUjij?5>l^10 zH`y^Z>SZkoR!UQ~kOcE4Ze1Ku&h}=Xd0BgNPACtJz8JV?LzLBVt7(mzY(?csGsr=t zmg*~+_u^$!A*%*06_7Q5(`2=@7$+7$y_Q+{Zct7_`OW1ye~lRicmQN$CYo4)prLDD@|F4>~Ja`y-?6wNz-k=MDFHw8cHJICgVZ$F%Dsis>3W3^@8Ir1AO; zEpd;%3n)?3p4GUdS$I%~#OBmjLOwh{k64Me8SH(zv<%W4)@)aih%x-S+ znO|A?9^`-EN666wC%SA&`E7jsW!F$2A$SsC@;$uFtS8d>z zg}pM=37qI(sx&Y%P{l+*(_hF|HKWFZlg&AqeNz08!^bW;l5;Klns}MRhujIv^nJi< z$#07v)=4g6|AL>8{RLjrzFGG-?S#ejGO}p624%`H+T_k~kLk+NOXpc+r!h~RPs?Q`9 zvyx?*RGcmqGfJ|2kF=Eq8L&ECs%GjJTTPG}3Vz6;T~H9WWHAQ*W_p!^US_cIlf7im z+p1c>%BrI4m{sWp@g{?~ipBd6{e@NsZxJ`Mu+FIWGMkd*ag8PwjXNk-?q~?+-3`gq zUIe{uU};t@+9kDKWdb0r$;qlND|s0aI$woyYORL4%hgrQ{Uufh$X~tkd;DCn4j932 z;9jQDqTJqOR?++08S)flS_rv>38eDRkbmB-FdEJryoWrBrJ*;(x^uWM7(9^04xwhq zCetX*5Oj|zHyEf9;-4dD=gsM_kl#R?#p)l>baK$OTXJ?tweLv6AxR*T5R!y$NjM=1 z2PNTk(sxc(^MnrJc5?9pZC_r$)kYrsfRY1$?S869yASnfQ2_2>aVMdp-+^{J_EEK2 z@eD2(Y9)V{Ds&KmehpRfv+?WO@C8q_yfK%WnIPpDubJJjR95EnkFwvvH3%wAPUeg$ z^2RYmrv6=#rhi(bpKHLYrS=cFz!Z2kO~`2voRx&rlF%gy2O7&SbAiv}4Tgnc?P-Hl zb%fjgA$&C*zb!L=*~W3)(c|1KSGOt&jTFBjifBOk>phi_0?HFfCO=;!X8v}Ou>6eDQhq#qaSeCJ;~j6p z_S~VpFg>%i7h}&1c&T?0BsV=1v_Ml&BE0yo-6~{?tqgRoTo<(uNwpy^_=QEwKTs9w z`HKa+DzrM3$Q?ZyEMhw(XQ-zG0$~XBv{|$grj03~n+v`~OXya6enqo)kIvrR^L?7_ zUcT6Wt%jfHzqW=?^IzM@HEgy}C=D<=dLF|x_BDcSA%@s+tN2LIG7T_W&l2q=vj@E% zG@0}75+?bdG|m;qEu_i)TJl>UGCzk#-ASW>&#eRY7NSxxY9$x2;PX)~Fcb&R$GJd1 zJ_RoD89q00flu(cj0=1ahb`V7bnbR@hmX5)*w4`{2{kz{SMrl(S4U7dO|F9U)nr~6 z2;n#g9FIe>f<|;hM9;1`t^Xn`xo1#WjteN%eUgWJ=0!9Y{Gdn*c^mYn1OC|3Qm$bM z16Vko+3IXW4jP6UG}@6TbO)=h(7U*JXz$#~1yOyk)!B`wNmLG8HQ*$3SV7RSsjSfh z;`IR8)h%9Cg}7JnN(*!zM%!4e3#HnNT;LF%dkqQfo(E3i@$g02d9l^`I@Q)gwM3Bs zPV%540JJJQ%mr3LK?v|KFmhCR{LS3UB~f>cftm|^1GP%0)Aqv^B`5*OKvKO zHaf3RZ8Dk?>g*{)`=9YpoV^8$`Ua{dzRll^g&SDz7>J%1`Ek3lk9S65uw|IBn_llh zj%$xw1KmxoIH9L{3UO z3zK1(#G?0Ov}-upe!Gx_2m@Fb!btV>tV3@h&TeXL*>y;{K_u(B04g%U&x;yoYY%8h(dmv@-qSOg^nY z?7&fD;f|F=6$XdlF2x3cfC}Ec3mDzA5Dnjay8V1z>J}Je>r)20#IuHh_jRD@K-(d| zFGmDZ&IPn8Q=1U$mvQ1FWI(?UuXT{zn$#>X;v**v!9OTe_qAJfbvK0SEEof#r?YF< zQn#mq{1yEWhUbV^^Q5YsazuWAtJ&;2)R?kZIUQ`koY^hKv}%*&gcar@zX*+o$#47f z=J188>!R$s*kYXHQ0}~U6@*wE4*T0eU$*mNXGEDn=d62p&MNWuqVK^tO!5^Zfda+a zg9ff)P`k>q-@(sX^@733TL7oGE93WTZ`lgF-^3@u8<3t8R7IyMlwH-8U3CI_#43z~ zr8DR}?eS%jyQx<_t16t3YcVY7Y9seS7^Gu?U55uFa1|ck9Ec;yT4J&Gb*Q|HFKY;G zb;$xHVJ}-$*G{+35^T7F+Q32Qj$(H)Xku3;@X4xhfV}w<1Uz!UP$^d(X)*^w zjn2!^Rj%!F?K@2!J+mWtMt@$_EuQM~R?kdm#~7vtX1W~gqi)S}-g<~+{ti`AaXX&c zF}(FFgYElY8f*vPZxH@+`wX@M_~YSk4a5N#s4462^}mlQCR^|~Z4>@Z zo$6C$)-1z=@6WEFX+L_+xC{3J2b1a+@o93i&s3Qm=5K^Q7XDUdhlL_yn}Rn{Az_0m zP%|O_fzmmGw+DZe73#)^<#PmY9pRl|x$P&r3 z0kyD_%E`CEi=2j^=977@i?zViTm5CXw2+h*8uHpjXnNTW$v=0S!wg|4E~6r1rHvITwJAP26t-p^ghs2OEo7v3p2L zK_%T{E86~OGp%~TisnD?Y`7{a+(!QQpe}0iREDMenKo*lW@J}50_woa=+laS;))E_jOJW^a@TPDKF`l(U*Sx{?}i*00;i8*RX z1lTrlT~hMaWDpvRa+c!iP9#v#gS!bam-3=aom(BLUWQa zLwy*N+QaM4t;(x?n+sg0>rMw2ippv7yx=k>$k-+4r6b6f+9O*`awMm}SXqidkPMTi zJHoqy);~}Hj3T|^o*CRhVYq1&4B`sb;9rsD9}UE~`r{OU8>UyFY+<5$+T z6f^Y=7lb%p|1u>}ZZ5@}NMh(Kx4v~25ml96*r4+FR1Cv5SDH^d7jGJ3DGnt8uLUyj z%8o!)sYAto3m{SwF6giS%BE`RT1V zN?}J`r8|P(qunqCHzxSRV2KqVMTI74S?laLiu%a9kJP(J)&7_!6H`BgyFOcv(o0%7 z{nTj2gnei@wLz^EZqAE42n2A$46mBD4=;smqdIt6pc$Y5l*zq9J9U|h`RS$BRB8e0 z{uf5ful}3mgon$CS(76F^BWzOO5ygrqAVN#Zx(fQbWy3pK&?MG0u+{)`tO$a3M~(f zEZ}tg<|i;+(RL54qF=s`df`=3pLscm+x7yqkx^SA4}?E4QIi$smb`SnNVk!}xk>+T zb^8}))pcPYOy@Mp0V3ht#QkYrac2KS_yFSmNqbs;J}!O{$ZRf+60+O z9)mPurhzOyHM~^9GWj(1<7;mnwhwXxDLRF^_2ky!blN?@*G_6IO1s<^z8V+Ipyok< z#i3xyN!;N@cQE3IM*f(ac#AYUEt=IYBcFoCO3vxlOcaisIXMi1>yrBQQS|)BFp4n8 zOGTPxB|b~D)x}TW&jO>rfhD)@qZ_RQgLuccQnKLQZ84);TcVezglXhasAaSX#cS=_ zO^Pq*(hTKsflmy`BybHM;M0T_>u@3NIYW_S)cF9k(9(%JIv}>=9o$C6FtxpL{yyVSS^{vKlc*!fT>KlzWdddI7J9MU3w-`)*{_5~1 zV|-<$zREW_n5?JrpAzEh7h6$#seUW9E+(WR{9|m6p(pYbbuq&oHWo@L$^^PPblb#` zEde;0tqk;a?8<5ejAy)L<{MgO@1-6lF2V3v+^!9eoc7Vf!v|!V;uFRPT?5wLOtRYP z_(*IYMlUrZ^RqVXTo7{Q#EluSo?wQyD4NYJO{E}$8-Zi{ppBMtqAgZk58nH>YCI`#txjGA=f zM?+G%4OI`4WM^M6Kc&BfDdjgbEs67AP2|6mb2hKs#(%q!m6IH*%QmlksMXnv{B%oE zN?anpSWaqMlrjsGF2scMV+sAWLq38~Cls+$shhMu!p}0w<65(Y8^{k@DK0m)#>5J3#wN6CGuAF2_c4{7#2%JhwsmI7 zX#S=o2*R6FtR)8i9;7A~=*v`pt(wTc(h{F6o10u}<04C(GRt1u2P_UoJm)j| zRG&%>VCK_30vgOf`VxRA&uQbHDgk<=4cJ2L zFSG`-qzU-8O_maBdJ#Av?r^)pi4mr50#v>(WeInfbNFBJpTy&T(lm)Xe3CmV;b%j; zkW4PTi72HG?!Q}TZxa}EL~+PT=C}I`p-ovOz@s&m#cfGwnj|MRK9Dl21Ua?X*G(na z5oP>9*DjxNsT*7Nyq&fT$YpkIUnfBpzd{xIe1@8y>uBlX0L2_ML6{pe0PKGg*9g}Y zSP}Z{PAiIrAO8Y1f}B@?CTW+o0Y5zgs^Vc*O{$IONR#a2Ob9P8;_! zyGpz|MH58fEt%(5NnA;Z!vUS$^9N1yRtyh;IDSL0)I>`~b3zcisx>~*Kt~LY95f;! zI&CI>Y?x3B;h&9-2kF>&AT~B`UM1E>68V>)z+?jsj|dJAe7OoQvt)Bik>#dDXN%DR<-bWT1Lt6n85=cC0$Mm@+nNe1;6V%)A$Yub?9y#${oNem*p+BNq-=LGBO#vyL49zTS}; zcD*Bk1>fU<$~`$3a7RXRMy0Ag>XfWkF&6vhXY$vYEcySz=jE^CZ_D4v&mixIRCTm% zwbdcomYh(}{U+Siw;IjVgq16b_ZpNW2uZ+$7+2Jk(_UEIWVyS!f(yI?L9e1fa10gW z?Wec^UQPsVfS#58H$4q#LcEepE)a+LNfPfZYsOuYtWok$+Q1HBZ!sFa_B@J$qng=@G>ZCE?4hLBK{P-|80 z%d6@W?yi3%svg6$kv^I^7XxP{)J9_gS$dXn^)4%(ZYmRKfQ@Hz+Ld?=1lEvZk85}f zIyJAVm){ucA|KaRGx@1kf-_jW-pJ%36Q zj>p)K43D-Sna;a4*;ptH7NfV;jpKvGuz0=)vIO0@`C%+Iwf(s3=cr8-Gc8GFYOC8z z-l4(83W%r5e}d%gn@4U(Q;l*mm7STC5mCID?!(B`=?*!Qr0vAeXkh}1+>W1&61idd ziOJ>jVsg2hZ-K_y2l?^Razll11lX7RwY9eeEcrqka1d z{R$kqa!fB@>Mkp*S(|E%>4uIt`(#&2vvh6IIr1{9y_hpuUTYPHhIl)aF;~1c#54B4 zZTLoT?uOvQzqiRr&^zLjj6pbEL$!DpvZM(H%`5cK2tIbhhjMV`GjY_R{E2ilN{=_M z1_~KGt)}jv`5fwDpp?yNBY)Y6nu|5*cu{4oO$a$e+qz$YH?D<%QH5^M#yth*#B5 zfYy1?{VuRplhTZ~GIH|@Jj+3+Zs>t-X&K$gIW(kKz#6=2Zr~JN-#LQXhv#9~-mnL) zc%f7{$*o1I=cyepR`w%FP^Q*6emu$)@syf5KOSw0I1x>=sU6q}*iu+q4CKf3+S~uT zx}yKEF89B#OHF$nVgPY^X=z6^#%r>gdjwBXHX|Uhs?tK}17#S5i4Y#bL=RB=$sJ-c zHD|UbpvR{`y(jP(D4FK&L4gG?BjU_`@EoeI4ucAd6^N{@#Sb5Zlz3%jD-wh(4O8+o zgkC)-Z9{a@7OBD|{Kh6rTi3R1Lk50f%eMRR!1;&+&ozo`p!PQ8)U4!{t8F9rQah-fyu~p? zZ_Cj|J%m(N@^_Cl@<#O&X@{lz3|{gXRaYEig!|ZPpf#30S(<9o;a$Hrc)g=2FoSh zPF02BiyI!vBzl4x%7u3;>80;t0mVMQ2pz_<4XSX{-%qOXV|oDegubZ~?q}LCT)T;f>iz>L9*i0tzW%=r=8o5{ABO_>DzV zc*!Md$V97*oTukz{3A8tNr*yPz&8gqA^{*EV)@e8Y`KFB&z8AkXG`>2Y_?3r*%BK3 z`fLF)U5O{F={{lg^5!y6Il2&{X2U}iJ~SFG_e#L_lb7(;OvFA^S-EbD{O9Zsf~y(v zI*jv^Cc98y`zpNWbp9Jgz1lzUXV|p;39Ue5f zgZVqj2OvaM?nMAVB1xA}Rj7irL*QP71g5OEgINiU{l{jc3m{=LxqAGA1hY_lSBdW72CCfUp zTr+>asy@&4Adfc#^ABsL?-l#3|w1IdjW7SAq~Va zb|o5&|Ud3k(_+_n0GRSa9r@7qtU`)qZ{YCdjn zThHd@35*=p<=I3)6J8UGjxKMI9^JG6Z^)! zIwhsx2lyQi-zXcZ8&>*Q^<1U2b)^!IjVx2o$<9cnRJ;Pjak>q21aI@;O%@>;86r2? zqTL(7L5k`qZ880mz3&Xab>W-lM4^kGlRAJK^rhBx;}DQf>MAB`E~X<3`l;J7%EN^%Q#apkPqvm?%A| z=Ot&i@=blXO3sTgVkeCrvGuhV@f#LIR^uk{=zG|_YBxzgiFy~o16kx6YKK1?H%dD^ z6}R~tvf`*(c-|joqav(xwqS1!f7K}D$U&@mpcBs( zZX(+bqGtxE%=fj*24B*SfBuMP3#dK8p$`gNHkMIU3_##(&rx#C1^TJ#Wq*;G@pA$6 zV@`JWA+DiU@}&VVFr=eDV+_4&v?gJPD2?M==X10k-#f@d6-oc8=gsDL{fa!am8lAfkr zYMFw&(tlOOSow=M|SScZZS7t6=KB5ZQF(RK}}lfS4O3-hwx(6xewKj zd~v~`6*81Tv91GUZdC|i6u_pY@w#PaF0cekG6bCm-QHjWCfAy+UBbaeqq!y7dC=&5 z&fdapr$nr)#NgnFzsdpI+tL)ALm0ZKKw3O!%3Vxa|d6`>s z9w2`niRZO=s7R&=%X9AIp4trKz30D7*z4wI7#+~8ohHv#lI6Bw0{+}S;JO;!Y zzXl@r6bdChNyZW2_Ho;8r@-yQSpnd|Fl|7oy;=wIHo1Hs0B98Unct=`CQ|s!Ek@xW z{09KdE%mhrm!bpB(|AR#=0#K>53&$Y77Suh*c4Yn29qFHqK3e$guZMS} zU-|Vv+mZG+>pRj-SyYqLR+EWs%W58O+XPbc>(OocHMZ%3y?MAzQ%K2h0?poD*9%%> zI<&^*k8KPGjY*-6X>pVFGc{{Q*f$nv%pC~JUvJdZI4)@-Zc?nvFDYiJ>QY|SC4Msb z1Qn57mn4?7zwocLAbxpVZ{Q0vspT&1UvPo?P_wQ;6I_{P(0s~z_Um?loT(zfi?qHRnuD z3%d0E&|oyy3mLQU!Jos2QDEy)Tf#4#s9ydMvOx=?cQ^BQ1w#DicYn;^9Js_^4ig&$ zr9sd|2(m!XJIar%muoOD7=nE8xUM~-_&9yqqx=6%ALIX1^Zt1}=d9xXm;OG{Ojqjn zHP@iS&OTG9vrjhW>+@@#KG8(i?fU>9^c;YnB$8y_T1uslBMgw`<|E_jFT>*RIDAK$ z@eR6z*;@|6Om#+uhh#Ovz}(8<9l@>EoKSG9?Zp>gr29%RjI&#stm%zO3thrM@M*O4 zN!?B~r5YQ@6)qMAP`aZm)yhF+sWL{hR6C(UPX#a-Zgm6jk%SJUV+MLH<#T%M+!%=4 z3E(^It?T-loK1mHO9Osq^4Y;EnLFIZ9X8wBHcreAJKVu%lQGJdxs>qVqZ4c)y@4cj z`G5zu24Sh)z_=@dv;a3cr6Moo;w14vID`UStr(83fE*q&!HUd8k)FUfIsv`NLlb>Q zJ)~sigt(U%Id=kE#;5ofS*F>Vw#Q+a$~bhel!if>7zCv>Znq$w6t*QmUug5fiYvHn z8olx1|0POQ?YB7na=AYkNWoBZNAST+ad7fRtA9}n6yE7So~dx+waFV(Fd!2GKFw^j zDdrY~q0oM2-J5a{vAZ0#@PGOglEvK&C5zS?2a=ASqcHpaa0T}O_E3)_C2RRf^3H&~`zqPSO5-!#;i??(KkdZ1^5u3qwspF(F24N223UPQ0mt#SB7 ztf^_eP|UolDDRYA5%l??2`gM{WhUS{EYcU?9JRDeSXI z3$4M0wxGmAIS;Oq?XUd#h^T8s-8D zgA1p>GK39eS;xJ?Re2#p9)?1pNXf&(y0M-G^715-7v*<(x!6-&!;T@UbSt}}+NF|H zFsj4C4^*BcrZ4F7BYLUTts^`?A~7bwC?S@ zNX_oS0E)!b+E&Sn7TQ)xR%bT^I}}1=3b5O2lbaT$XEZjhcpD>nv!kz6!3 z)||n(PgFYVhQXddXX7y79Zyob${6NR-;K>kRQm!(FPXgl8=Q{HEWD_lSwE=d@{pfm zE)v-j)4x&}6r)jo?s^png;;O|@3jl#eb-haw`+m2{oli&;O8$zw>Va!G1@1%~!wjCOiz&w)RS9ef% zF^3OQMU?Ljhj)LMT65eM(lQo7Mu)r&ZP464L~ofKg9P$6+zqCBxY@04a)1VP=wH8} zg<*d3!|&29-r&)9aCpQQ_;I6tQr>=qO5oh&``-it^ewW6*6FhZx4IvyuZz^+HvTv{ z9;#1*>Y)?v#{_wgNBQw`2{RHr7lXxC+xL^Zu~eh z`s2{(kI={mKvV6ms((_0CP6mq;o_4~1D^;(GxptVa|vDYHf&+sA?gkKT?&Qn^pLOf zlmjFk|35)e^$;HVG^qTyAXSc6o?{>2XIB8<{w@r=hW<)^s+TOKb_5KSxGvEn6j+xw z;pCQE(YOKKNJcu+^)ih7eSg6XM{PkYUJFdqR#*@-NDzb9uF+S;r<=4@QF&QA75mNs zeM$$5*U0p^hMF4~wFgZnR2Y)3MiB>yY_sMv4DYM6_4ED&v;lj3!KUHWFLl%!2hi9ti(LyR0cp3t>F7$QhoLx3B z0OhayRr> zrR%=l0J#^<%0R+GbgDk8j#wAo2=I730^{*077Y+g=)ty8p##5}c zQmowh#NT0sD*i*lL(o`H1v&hrev>v*K|8l^Y>iA#zcLGu6Li9=ln&e#AV;`DD$r+U zuO##W)B_((?VkzR$&c`yQkfD%W$LgDuBP?TO+Oe)d;;RKg{R7)y)Xu?dCqiP9Dh%P zT7r*sqq#3vH0Lei-iWM+#-Bnd$eyatpaG59@Tv+~6qYe{k=v;)?o5Ael=`NleCkLM zRxILmD1tkTwrP50iF)FDnJJuw>P=tErMs;=rpDaXq0>K{Z!SVMK0|%}1s57AC$N!| zokaHQr7cs0f9Ru6&^;Xw`{;`_R$XmzUNclGiRhRw(&D^2?3gbVee*e^Zt8t9h+%H> z*lZjonZQ}t=D|RT`3TGjDXHAc&ge|1b&OL!V6oBr=rrU9ycI$m=@>wOe26>ASHM)dPeN0IO8Fz{vTn++vR?vlf!zrzRa>d~#iMX*& zoc{R*mHan-#&YuUNjlsrrFi~6Z@HWJnPE#!+AhfXpJ==Ct&I7rdDDg0RazK143k%y zhOg3$*0=-1{7WU8Vro`%v1ampnh0NUH|i4gBj^IbC6wo6y;8jVH@V!}YNVPy33$`i z$uiOeAnE@3Hws8JozdUl$UPe>#%q!JYJ9_4o^7%;nifdq)~4y);bwO+IeeRDscC{5 zkA`qyNpxA8EUMGmXeqwWwi0~!Hs=ps702`|}g{l7 zLBm5MqsUXMpA%9;yViCy9EEGPH3(s_lJ>G_!+PdRD;WI-zQ zb0VbB>x1hbN8tkZv)~Veeg^%gH!I74#bxZxf?rKD)YCJ)FS)>4K;gXUe4=Asx-f`8 z{n;%JnZW#Q(PullK~9U}i7k4g0*sK~tfuRP9*kp*@HOooUFVjcTx&be0MW%ULt&H9~5kjlgXNA zN0h)r+R4A}Z>CxCZia}y@179fbcn0M2u~&Y7g1?D(;h-J8*OKxEN+$pj)Cu zE{sCXI|G;atQP=x27bZ|$SLtA<*i^LI{0F;!_C3Mq2agd!*5aj&6lXViGMJY65wX4 zX$T@ZI-^dl5Nyyu8@i<)Pr3cn{5Qm~Nof=da6vM7Wx5RE2?p#7zos9yY8fwlJvWBK#5EP**q0mSE95 zqtZv7?1E|8CKs-;$5H(>o18|4rn0p_TVMDao*pyJr=gE4P+uOesn)V`Snf2p*oQW- z_6YaXKC}>d6bxb)z?hT*g{l@Z-=wwf^2uSQ_d(uggXMr<`= zY~$!MUW3Pe_P&4$^%iEiGAcUjewbtt)0OJ^p06Jo6 zgZv#)G-IxJLe@wpBwzpX`6$%8Vgc4W@E%~=wt%)b)+blBKFP*DSy@Q?1QYMz;e99k zh2XEL*gUhdvBWHXMzQxf#oq5m6^*dzX-4|$Ge}8$p>b5o9i!4gqLDuP%q)J6AahS4 z&oH*^RCr{-Ul#n`27hzmFCYGj;ICob2w|l{;z9}{X)T8=>evj>k(P3lyPTRBgz=C-0EUN$KO}h>4 zLpXb-swlmp(#JLYFK!syb|QoGj&?RYNY{T99Cd9>W+&Cg1o`K(o7{v}M3}6;pP>FF z7N?$flW|&LHw~Pl2Sz(pb?;of4TQ#XGrp_K6FPIfdAqLI6EO+5)tvYVt-?)OJ1O(9 zH~#}vZLK*F3xBB-ReI(@=pOu$gHE2hvk_8Hgb& zO+hYp#`GgC{Z3*Oa;WduW1Dq@z8XlM$T~=U%({enm(5_vG$?n|7sjC6u?HIlwa#{v zV5~M^|M>JhbF~Og6{2qPgcb)eBO;{`RdW$n`(?PC_S#oJ>G zTEXyIpAKt%$Gj;#vtWq;-Nk>_l+u_8>;9>cbw8c(+eenCL)yBJ>n*x0e0$4u@v3R7 zRlI5zQum~SAXD8;A5yaRLB6$ptjbWE9Meyt>XpyouGsN?n%>|lZgyBV#iPvB^{c2d zAfH$;4Ig-Iy>#QitMRuQQjo$Jy|5fD@kc_I%DIB_4I;ZsO86C|J)+QnHKg?2p0=l_ zt+l78?{|Il3DSz%htFDDZHujKH;t#&N|mdom zdjMbRfOecXDe#vyM7#K91ct#ofST1IE3^gqDCZQqLTfJ!!K*k4_Xr|}0*NJSEW#*i zsq%g1ExX9M*S&1GN!FN&`aOXj--z~avTem+W0kJutJJAQtvHmoS`Q-m+e8k8gbEji zsK}lf-k7J77vw{Wb4b(J4kM+(j^y64yCne}?T$~JOI&Pdv$|)6i|rQ9A}ZUF&okP6 z>Xix7a4*@Bk#l(9Lx_-BUJp4^8d}zZJy(h+B|mc6*)w*wLlBY(=ko2m0En`;4Er4? zJCF320GVwk5+I}Oz7ilixAQ_12L_h_VW)G>?IeMt+kF!#;uEkPayj-n*J!vfv9Fv+ zxHp@MdxiiOmDt(yI-KJ(Kt@Vmy7G#<|T8}MsAATe60YQ z@s0z$h6@0UBZL6PuN8~MMsSC>5ed=Pws|lx$t`1BF9vo{1PgayUtahK-Xbh@v}3=& z;-h*=K*})fuamOz<-uIX-TbLP{2t${_NeFtFW}9hY>q2K>h3SmWNQExE+lc=cat}| zB0WPZAw)QPhj_f_Vdze=r=c8>%VT$ulO-sh-mjL;=^~7Wx2?66hm}$Pgc{uRFz(Wx zBSOJv%7<~A?ji!{{53$Os6~DlH=UHcw#Qz3%H~RuHK!tR689D+iL#k^a|8}$331_7 zDqWD-@b2x)835I_wk=YMO@zXIj)}*fP6H?qxA0yttT`@#!QWnZ#_0!uz}bz9BwVmF z6g#eYU5J*iGbYMR(DD_r?T>Wc?5I8EU^^fKA{Ws{B7D0ag4ssEf^!yMum{Q`S6%tV zak%xYzh5hE<<_2au{Dc3rwjVTxD~rRJIjo&Ipi%LZC<^4x~${+X!NqRM51)_=dIuQ z+iTD9ec`a}?BtCH-3_)sT`Cb3aQlDfVJrC~L96(`<>+g4)mRg)Y=$%f*BXoI9S7vEM9Qq`+x7 zd8H5CW#YZ|AX~dpC1*!nQOT*4K#KKGRGnueb!t}~Oc&*TtEcXp)wUN!1eohHnV3vw zI=90{2H^-7*I@IRpvT&HA?MpAC^pjtky@M~{7Z_{54EDGLT9xz^T9-dnE+;#jZ0yl zi)~3%cM+y#w{yHbuiH7MUDZu?=|bG+mSLRW{Pj8&i0bC{;--eOb?fy^EX<;F35%VX zoQy(1vIe{mJ{h&@${O(+3PEv-b1u9{@MXH7B*i%~8QYeTB~t-l>6QCrjg$EZB3`%1 z9!$6K0NHzHMmfg33K;v!v8j1s4acheVqJ?-OY69Lbr+s6u1E0@iLI6sV@r2Sh~`&D zJggg)zK$fmQfDZnO$2NnyWA>g0*I@eE9oIxdh7v!%F=Ik19!&Fh|KVo4<~LB;O5x{ zp3XpJ#V|b!TQOt8>)rYS;vDem1}TGa%7>7WQNv->0e=5%pHouY2L z`u95e_ss2T7k?ep<<>e`!%IZXv0TjDSS|*71+#gPoYfBDX_9NWF;I{C1U$FFsKNLA zt1egPBpliz+!}GkZ!hfO8g}!Cms;5Ib+tX?@gnx_2XerZyL+slJ&9@4YT;Y!PMmq= zvdRSoh=u~}#bME?mXkC8$do!iwUzY`s+Bwaf>d~a)6`aoke-a4fSH+0rGRy9GM-2$ zUt<1C0;DEqPc@p#1jVgihJekQceuzgIsmN+~Q4sK14vWD9L zkCpooHf=mNWf!l$7Cl&^VMNSqgzmvFb?a-pe|+N|id}^@?>s|!%6XJm4=CGKL@s5K z$Zo*_E98HJJAYY2nu{FR2gmDpM<@nlMP%YT{dva!G?xp&aTWft*FeCpP;`y^dW*2I zbL{U##W2ZOS2kQ*E`}iVo4tj`OVRbYAXP5^KBQ7ELpc)Jb4+9++W|ERB-E*(UDQ*3f}|F33$6$=A<7U)efDlAkc0GL zf)>8ee6rPgo(r)+2gs8GwRe)8%U#&)yNs^iEZp_bP1GWH;lgYWE-*VkL~#vAVTkez zh_<&+v?T*ZyO$qliIq||0w-N<4i_!L z*TqGb(*q_-?0HgVRb3KA_Ro#DpDTe?SGjmaxp+xVfvYlv%;!_cy)_ZGZV?*@DX4m! z<8iz+en@V9fp7Sy{=KBNLt5h3>QYH%yDvb|oZ+(FN1H>$ms2Oonc)z`jxuPn-4~sH zvfV$y_b^hDqiL7Z#S9%6tM6hPbdLA3}CE zJ|VYshxCfCCKk#GmrW2=2}KUV5i^qVU5V?Z?DXDco}q$7CF}VSq&W$Xpi|5XcCd4} zrki|Kh)lT2!y#}>u=2eHXL#g%C@(>*+&;0ssTm;F{bUqL0d7*4TF$pt%H{MV=r<}U zGaG9%Qno7~_Tc68gozS%oosiDGoy)0Y9s9!5_=5#Les^jBM55<2i~$>M>0qP%p{DB zr#QwmjfKRMjx(2HPd9aEG<_!94GW4AWh* zY?~uyyO;na6EV9gsyVL85%P*XJ0b+thirZYrt5LM{*d%nq+AvyysSr}Y&RBLxPnel zAQIc6caZP;8VQzxl{;31IC4S~S4dfZQnfbiiZ?bK13GG$@Z!L{mP+ku68pxGycL?2 zs|r`GL4_Ab@K{ME;`0yhK*?rDp)}T|{1Q=gJ3EmJs`gd4_uwY?TGgp_-&B@RF5xyb z@~b#4cbL2ZYHnwSIjlXlAA(RM+0VgxEvI`IWd8wak{>0A%x3lr90%W(R(t0Bbszw z*_q#*cOgfE0av)jM3PjQ+e*lVQ$2VzX{;6{huZxyNwU89x(}C<84cZ^8IdrFl?$B7 z6690jJS(7%dpEk7kL+YV2x7(&C3dOrcu8>{!cA%zh8pgk(*i@j7Ny^}KTCFHL|djM zs^yy%vBvj1LI>wet8gK6!N@`4 z!lwM5b@MvC3xlisByvQYC@>{~!2uFiAK

8k z!p#MJOKgu;USVf*Wvs6P)L)qX6DlC%lZaAlLzxg;ZK!zjLHHlBwauYEuWg!yD!{jh zYt!SsA^Z6Y?ow_twV~8=%&ewo$YnMMX>=k zb(q-cU-#QA)(;$krh(esnk9%(Hl&c32-)omL}YvRy1L(@nV@!6DBgtPjB5&9Sj`My zxRN-bK1$~lc)?3QoWZtkIXfDHvm;0-$-XruXYQb#=d71J0ZLY@G^Q>p`VD)Orn+SemHnvCLp4%0pFC z;1d>=a*CbmP=zgjQpzgui}7>Rh9IlNxz+)b)C+~7exKS4d$8WOJ}G${=MZ+nlOpzd zz|u@meJyh8>ox^J6=x^1JykQfLsq;BBTU5Wre^?7JuaubNfj0$zD%?*`0a;L49$uv z73>KRRLuBYDeUoSJ_nEiVeT-|eOi{BWQVQ-ea*j{DDrSmuWVqM22r3$L(T(0rzqq( z)xGFrM>@*cZqSrdTCO06&>96=9zIC*h7r9lBT>3jON1k_y0}Nf z2#Qo@{*$)CA1eTB@)`r^m&i$`Kl_Y=--q*wx%=VsGY- zXYoZKS1@w#q3bS`5#wGbuXreidx5;-B^lh~mNZ*gRVDE+gA;N6)d0lCs&Be;CayM!wJa|M?Zyi1tUf2H8Ek9P@I`mYsS zUgTXAO8*Ul%frN_DndD5FBIg~Oi~b(w?dVl!W}2@;C1C$RFgQkg$c6l6Um;DL^v-x zSgGxx3*2q3qNV`iwO=ILDT%QD;ApkIs{kC5y4alI;#1-UAA7M} zc>oe9WfD1xxl2*b7w{NQ0r?{#7fd$HSD;dTe#~uH;u&*sy~*I@s}8fPPQmo1wX2Re zsC;tE646Dj3bCs{u-D?PTC#@qM7{t|zoBMmqFTu@5wRY#&Q{Bb*pNAGW?e1276(Lb4_CH2>^>gbic<$bYVl0F!6*U{hC zk)1@yfKfg&>Qhy2Rk40RcJ>ukm+))ja*BJ@}@~3Sb}K z49g!4_gXNog|v1gP+SaDsfW9mhCPSvv9(Ju6Ltp?5jog~WBoD)ID!G37le}p`3143 z%SA|wNbQ9e?1f$2><&D~#JQQU_Pq1VD#9%Vc*#3Z1aRsh^nw*oD!KJmKI_7SUuE0( z1F*MBm6v4Xlpnc-R*Nck^!!a%k%GSN9(Ek}lEI^g{Rso^5%4#*<2DiIGDd_a`2Z4) zuFb()CCW<{iKERacI?-nybT0cw#UsBW#S*e+^Yk&9&fz7>9B*nK=v%891i+bs~|ky z$t4s4FVv1bO_ZB+sRq0%)}I~5MUcYaikgTHbUEKr{w04ewOHl93zLMdCg*(57<=~2~{x<|Nvj}Y5Ntlkdm|`ZOEuq-tx-3bZV?=ZI$cUzq zbzjxj9TIIH>73!~dUM?&v6HLQNwzwN_xjXLslzh`Y#`a~a}GmjOru&T%CDWs_Ts)V z*(_%#axazo@-^7V5)^*6tK?V8Zk=u#9h&DI7Bi}I}x6c@qd%**gCwJ8G z9=$H>d^nZ)1+s>Z$@w>eoFmtu@??aRyu`Q8JLmx*^#F3K5Kzqf1Oq3sav+S4(!SA) z`bP&0xodni za^>tfHlbX!2N#JNK-54Cj0qEz;k5f_yU%6#9>_#zav-x-z9khUqua>Ul+qOCVfJUB z4FNgNY83&Al^3S`WXo*4TkFstgz!6J&kJ*of?3&BdjfC*5wZH!wYkeN9CNV!0?W`} z@O)B2g5>p0e5d0H*pt<8XG!WzuP4QNXTDlBML{lI+Eq!Be7V~#WpOOje7Nr$Rl zN=bpTvz+s-#M-be2^bpB_@{J^67y;fFxHQJEY6`m*AxU1rAdcm+ZbqHKJr=TNBmkD zi7mOdJP1p1(s4@prM(b{Ocx&ZJ^c>Sf?HDfGn$w1j3%s_njo~&X*a7PA5o#_!Ep_x&vHUR z^Cb_(4s_aaff=FY)DXUaTdX7p^Y=H?2Rx+g*U9}B{CDM(1-~N?2sZ^;_Va6gvf$4m zCoRMN@T8@i=3J4FTX#rv9`8qUwtHyKi8^1L_56kbP~JU#XwH*Bb9QX-jeH{?*|`)s zu$giocE=z&nIq5=)x4ru=MAn(DY&C^j+^oXr1m@EVj$5uf!nsh&4T|E^rvt*#CdIj zh7h2}pWQ+U!yN%llE8(@On5^J6XrhQamulOmOsW=*V-+TaM;yE#-rvJ-s(o*S^?A`&N(12f@VaTk#(UcxEX zyP=G7csS*fn-lIsK?Mn?y@MBBCnrz8u!r&S+0o#YAb61k+w5U{17JzdGp{;oyJn%9 z${w!xs&Jxhb57zUW?6IG+pc(SaRN@a-K*FM02Dh)`P#!eZzig%CHQ%MadX_B#7XQ0 zBCC9ZwY*$XARI!y=MG+mq>agQE+a)nRU^vZYQRXc!q7Ugr#90Z)aDn-NHdb|4&F0(d2 zpSxRdFW?jhg>L4S`>I;Y@A|8|Q45`)s%v{#%9T$i9K3RL>VXw7Uxo`>gKRLGxyK9L zy9fnb+yYdKQP_>=vwOJd3;6Tdo zvOD#a)w>kPH<=!Mt|^e25!}K|we1(#+C@pJ6>lCp^ zV-F^EFhO`NyvriK@~NYB4W6|?QC4YQ?7x(s6E>kqk# zj5*)|MIJuf#x-sM2tn&{ANusw6{Jcy3fM^Q{NC=9+cH-&(JgU3_U~7&@=Q5JwwmX^S|R+ z^puF24JPy{5&70XFQOPQ+rZopCg52SRRn$(Fk8Shfq4SVyI{_M=>j8u8sdYA1QQQN z1Ew5I9hkeoJO<`fFbBY#0doONz%wFh5}4Uw7J^v0pcfH?-{TQEO?=>a2sPDF))i3GC<%xW+U znA^ZS31$zNkHCBZ<~*2gFu?$e@nE9Cq=3nJo`)9@|8=9mj6emS6!QLkpEqBi;tS86 zcohi59_4kCI z-`w@t6uIltu@6H=pI`si^l|V0b4#+m@EYre`sHV?z3z_f89(d^{bJp)(;YEM!C3(j zYxf<0w&>1#&((Z)U_nLm$IG5F=68Kh-}Jon_3CMJ!k>6`KleE^dFfk@rpoJIE6Mb` zJVH0WVDGlpi4ULczJH|Q)7$R(+oW4MKgx^z^41;p;qQFAs4Vq?DA|j-Z;Z_eD*re- z{vQeNr0jgS{?aGEZT>p(=D*E#-4b_OTKcnRL#M zlE_aZUang6SXPDO=rl|BW&O6Y`^TPmeC-E?^sc*%m6@8~|F!qCbz?FL{@MKZhC5C@ zL*4r3@!%`xR{HOGMHO&l_N3bn-5?XUzVMcxXmr!Yq&r8ZE-yXv{a=4N{LzJ1zqQ`? zEOYI5&&_ZA>X!vvIQyk(@x}2sPMrCk-MqVK#M5DKPw2_Ne(C;WHHrsMw_L6MaCO(@ z&!3Fl9@swbrBU)#GwRN-->_oqQ`fwNIE5k)1mBnJVBq?&s3|0mFnaqqrr>N2y4SGeYcG;YHiV}m74yGs}T$YLVTRA^E z(IVsO=~Ds`{lQ~qQV{Q+X0E6J7feMFnYPU14tb>xk{uP*=TRsWX{wxDMY?KH-eUOZ z>yL4Y4C^atONGuvo0uepg)XrwHtG20nJ4(`X|E7PhEjux@r3dC2w_VsG@Yc-6*Gn^ zdVR5(#h~D;FwvztbW=nr^kx>?FbYHJh2(Asrlwhw6p;vdXqTCg82L7_Mk9Raj7D>D zpTb24ll-7zDh$wRAXBD{w$PB91(Q&)CZ8M#{Dd)4LX%ELlJRtS^zYgxl3R)}Z$+A= zrjjvd8;TUus;MLexJAcQgGFIWq^p)jWtmFMNs3gJHY#R*d{o+^wAoZ2_jxf1f;$1W zYFRpIjjW8UwA5S`aihHaRLjzGR%voo=?YCwRz8GKELE-ILwUkr2kqx8q_Ie~IBQw| z9K8Gn$-yU$Kg^}qpP#Ryw~OR*Fx)L7`3GQJfBwPCJ#UDcAHN_WF-f@)nYGC0q(ovr ziGM(#G$?pj$nX&|`N&bDL&uCA7j_LFYy5=piIXNPrd&HUV%qc>ku$HGH9Km~+~|2R zvBdjXD8qIzMliWx7J})61B-N4IzCRoe}bPk%B$2_t(yR^DT)o1(3d=6OxTTdz1}eR zp|b%((x}vKbW6p}_JEhtSj@#y1gUuNb|6v>?)QM+_mE(b*z=BuA%r|DHx^qH=HmZ( zF^USng9_G4E3VZnQbi#)i^@rh!wz;W!Eb%)S()HF74-9mBz*#CggIa-%mEr0oQ7iZ zN~z6y*2r1`M+EBq( zC`@cck=OjC(CPKi$We;oGM%ZEChq2nN&rt3V*o5%Y&Mk`N?8k!sx9=5EY4?MuDlNExx^HxOWnKqitn@lsQ3<02u$a(QIaUS8} z4sEGWRSVe*USu9Nlo*P!-TAo_yynlOw0zrS(tvXn>1Gqgh@0sfJ_ia3!~yuk_DieR zFQ%VgyqCDh^ z+nqJ(Y3Oh`lC6aBh=N%H`=;4sqKgUa^|Ve;Ew3c+K63-6Z!(kSbXP@4jH29~*qtGU zb?1#VRgq5b9nm{KqZtS+OqZY=uXtA4N?O?c4Z!mGuFw^G-YYF;#$0SRDk>n7u9Wu9 zA6i^*Ez@nJiOS<_1x;Wx&AZ>i+=}!>lp>Pldl62*WIYI-4yHgp4*zY|)1FVtU^K#% zZUn4o0qTPx<@e;LC;>{1r{l2xNOf8GVnaJX4+a1L#5^S~21t%HMDl%F)7)oP3p3L*3#i0qXptl>~n4OOJ} zrbYVWdT7G+Fmy_N@>pL*1`H`*zkn1axO)X8G@V6NZD2HfGBCESP#l_`qc<7}?$fd+ zwb_)*(gn0Ww~WoO7_>SZ^GkH547y0Iv!qs9)Vi7_tZ4~rOl3>8bmj75W|_Gvoi4`s zxvODp0J()Ig>Pr56Et*g_HwP3cNtFT-K=Gcy*{b*z3SDKT z5n+j46^Zx?9kjm=+!=2EG1klp));A+ zdlA(!KpK)5Ua8Npx`&#Ap>-8xeysrDKpOB`LBh=8OUsupc6e}|I5n!ZS=kEG zMN2H^3Vwcu37f7cGS(>ctOfg#i6=oxC>XYk0Y(W=eFyXFDd=w4c_5~uh%JS0MU9!Y zc$amKB8#j=Dq!qFT{qH@I#$O*TUjGRkULPTm>EC{%M>LbdqB!_i;b3BcAC-qZ(FUbKLC`gY`ztM4QZPX_>-WsVk-lxPU%}f$R-1Z+Ok? z120eAX}_b(MT+ zG2DVd>bS{Z?$d6)@!|)JXJzz*#G8-tDseebWw0EN z!N$Jf2ZoCfNv~sc5PUe_mffO3YmAO1P5#Q zV7RoTA}JHaQbzcZsh8r{z5MtMz&{c48~p;P0I^)6QmOp$nIBDQNMJ>RW@Vt1S`Zyw zpb4ZXg#u4gQqm1&8{na+>dI<(q!5A%q@+@?r0~N}s`^ur{0NxhVk_!8q4IJwq7npq zUVOHSxGl>{Tb{0>R3=258iWy<>zAr>mZ`F1W9Fo1XOnq^_Vv#&S~FmNLt9HT`8p#@ z-WPklr{c06<7Rn~K^n~H&_#?|o9v&xQyTIS2>oj@(MHJAJ!v9*>gu-D)z<-l z{I=C?ySXmZ-ya~<*x2X~Yt-mEP2F~=ZRCsuO+g*hAAqFM;OPlPWZm{UWZD9l%F4>5 z(!lD<%1xD(KJX!Hl7UvG1FuJWm$uj6kdnG6EnStdI5TU>(ropz<(d^a+T6VSf|aXQ zuUT8TZv6&bQ8CbxrDcZljm8R-x$;Jfm0_zkRoC3~m(8_XwvsXc&;+`n08p}d6VkLu z4}yChtfiJ0l>@l4dPhzwA151@52=I`qcK;qmBfwz=98h+JOQ@IT%AhgX;nGBtvU24 z`u!q3KgFN;Wx|LZ?AP!IKi?4bUO&;F{CUT}+3P3%lRtM{#ZU+MgElSupY8#o-rt{n ze0qSW_b2|7zuq43pZ@+`{qYwHKkqMZzdv1Nq29jVf4088_3rCJE;FI(>Tk9+G;X_P zyS>SAYx8Zl-*M+%ci(gGeSf|Gfd~Kg(BB_^)Tf`FKJ)n( zUv`}R>g#jgeES{O`MvY}zkc}f!o{C1b^Uz#O7}0n{?_yRRo8z!0S!FC{HY1(|91WV z*Tetc5dZ`G|33l$%*>>UiXmkX+XRhOatR%T#Q3$aok?h{#4rXWy|w&$@L+kAL^egU8R_HMsxN zdj|J^|MkKBKY3$t|G&LCxPSONzWyKd@y~4SmGcON_kq%Ruyt@ay|r)Pa_l@r$zMI> z>;Gz>_<^7J`k(6K-*|fPdhY)>{*Qd&>)+D19k2TO-|FQ*4yNA;V$q=WkChDWUlTC6 zf7*z_{X^t~`yU%E8npfs$B71o@1Zb}r|nOAz4uM$?1X{S37aUA&z?B2|2pt1>f`U- zAKNF3*l}MhZ8a(~unS-Z)?NVR= z1AY9t>|Qyo$=SW_)Hk04+QH#;=PHrB>&aeREqzKvrPPb4SO3}TmW#4?bt39rFSnPU zhgDpiXh>%7e@JGpKpV5(%~5Kkh}cJJG1-GnGn*K?nn|UoM|t-gn(#CQcj`Xgbun$q z(V6t-3ZPli^HVih?$mA+2|O4Tzh@>FXVSV#p6NA~yb}f)W%A22;m(E4q+P ze>#)on2H*jy|=9nVF+!F709<-Lj|2`g_6+tMty}o__o??qP=)gKxv^*8f&r8CMK8g zoU`-*4dQC9sDO;J4JOE{6J7H8txi>SDz#J8%lE=^18(rkb#t9P`)G^2Qg=HhinFZg zbP-!xN?SBgHSnVD@hdRs>9jJPCD*J*p8290hNkL)hBVSlKTz5H^7-8W(nR&{FM(qj zO5m7ITN#VFh8jh_(x76v8Tq(h0q#m7T&TSST8y3tCPmfu!WaEfYzrV9fo;qO5g45% z7>+=;rjn+1^Qq{d1eFNbR4U(3YovkRjib_V=Tu0Z6?^KHYj#(bdQF@I5GTcS5D9i+YjyT(_(+f;=fW%bsfSh3JTE4%KjgvGD&;wrI08*&k4^)PcwU%N1 z7O^EI(2;OU7ei?fY}D_B|A}$$M%U#kHNK~dv(wbNN-cvsgir>R_jdtBU8bNarnImjYzTYq7rid6wF{ zZfn3Ck^}{3r?KPX*xq3>8ELQ^TkbYB)85lEI8M zk{SgC8BOV`8Kad{y_9BfC&^rb>(TXAtI;ijV4^pr%!?76m}(-6nG)Cgjs6Mzr`}+# zH0o;Blg&bRm=eGO?f~9#Awyo8L2q(<6DK0JvfiNg2}h)vyj=ug7O!v~F_HCF23F)& zx4XHhd_8WxrOb=(b*P{#%$6G7JtmrW$2r7Z5*P<`sTq(4<0&sMUglk0UJQd&!X1dn zjv%-Ii5J7HUR+T*#PS|`hMu8k=oxy3o}p*x8G44Ep=anBdj7wA{DOxOyY4?sC;Dd5 zUD5SD;vni`+bu08x(fD14-W`(pH}wwr=sKL#Y9I3_~l80N6*w%=Voga8jBev78U7c zeQAxt`-D&`%aoa6WnL3KY25JWc=#=tH!m(OHfHs>;jyvvqGMu(&*<6n#zu$osSfu^ zb>66GIlB9e4w@IUU`{mr=0&gdE|kch@>@zpXNps)qsr*@Pl*;KZ>zAponl(inzgln z-4PZ4O>44DG5+Y(ieH&y*H3-1vggtAFV3fKZ@8K}W~1)Cu|<3CPQAE1*)``av7d+% z^{KF5eLWSdy57;U`seq)%Q81T^LF%>(f(VHJv=(@;}c6y>^}C&sIgtEUwG}tH(&Yr zzWb(jb+Hlp2cpfb--lKo>TJwdIO(rPm)CtVHpt|+*8l0ltbE+-*Svbyud}{6_>bX= zmbuOE9lkTYcxg<|8_b@k$4>tEsk^?o{obFhSmS0)Pu>37<_oTejvttKo}y5PAKoep z?UO7PQU6_ag>>$$dG}wp&42QfGex_)Cy&k3zU^;Y@}uU<=bkzkv?VEU%z@v>zR_~- z{-de~Hn2uLZEv46|FI84{Sy+$jNc>kzfU9*PoX&HCr^HP>W-%uPI+81ul)FwQ`7EW zz9;hTS$jLz@7+mns)ZomTsAv3?5g4mPft0V*#e}u0g6*#=N>~{zd?RLrd&k2~<|qxBouGgq%JL5f!I$7WLk9 z?sU$%11b?FBqoMa35kYvyoV&1=^D-j)uv z_TSGsc9b=LxXo61m$Lb83XGN{r3c9}ovv05D&xoCCOJ_S?)OfL8&-?f=|{TH_K6FfW&E0b~PintlN5 zbp`|hqAap|%z3}(zCSzvY0Lk&>pyMz|ED;f;C|aYyTkOQoVj*~>9c8|O&@lEHrFdo zu{%s(+ydH+uVm2AgN^`g##`Oj&bJtpv|wI6@xY%DF^ftXmirMDnCnn_V3TP ze{?^(%kQL`B~QkkDXaR~9e)PE(|c=L+ctq|S8ICy6Vso-^yBB2Wxt>)C#GjV zF+Jyr>69m?t697sXYuI&Q8YYNs+Ko@s{B2?>*+V;S1o_~P2+!`2>W;Ufxm|<_-4ZS zkc+F^8X%IeNnE;Weo?L2ov|Vm@B%ZK4qK{X7`Nh=c zSpT+O^^}IcKc_XfePMCcI>9ULjzB;Fzz^UHPyq^n1GEJ+2Y3M705-tw6?R7{;2PjE zpcqgHI1R`HDNb>UQ=H-yr#QtaPH~D;{^ftK*lZlA zMciR7hda+*<1nxD0eoNnC@Mr{$Q@4;J{7hL-wX5UV8d2zkDTWfL1S=s*UuB>YrbH-_N|dr+IieIPca)mMi*zJiNhldXCXt0?HTi*@ zB&W#*QcCL4fpiuV^;-D-u}SnH>~t82z+<7*?!JU%qme6s!?cZDxN z*Tjl>s4UVKR$C4L}I7w3p8#C76V;$HEXcv3to7K=ATSE-?-OMcQiDOavZ zUMEo`n#7Pe5>LJ$`-x27q#x1+)I}Srjn~#{*R@C5COyM!YjD-IDM6X9Od}h}4t7{= zs^w~J^q=*I=JK$rYj5@VP&{1d54IYkOjc$q=EW@YYENGwOc)`&FWeEfilNdJX}Xjo zB};RqR7p_Qk!duRwNXWtsa@1J)LgYx{Z)0<>T0ptXL`EsV{nFGC`ODi)mUsE3kIze zR86jctIyX$3R00T@)`s>8^4I#;V>M5BXJat z#xXb!?3jqB;OY2F;h1n$@D^K$7_1j64g>prBrX)w#BJgaV7p@RwrH1B$rmgaAO%Xn zQi#-78YqQH5mKZSB}GdyQk)boB|^_uO1q^D>5x<){Vd&++~fvwYgv^2Z@v|nx*EbdFpAkP|Y#lVwPNWEis>O zic|3=yhA7xlEh?ju9zzJmFLN^%2Fkk>>_t)E!LWavtg{3>QFsYFV$OZt|o&uy|tD) z)r0k+dW4Z`*jCtVS+GA3t^=3CFXBzx1)x9_j6zUf~&U6t)n(pW7Q<}1X!V1 zjnz`Lm0E@tuD`2~)BmAYH?Z-FvCY_R)6JFDH)9%wGQhu&0gr5k#8eULs(pR9kZr|8S|4f;tv zU%v($1Ua3fRh^WA^Z{k0nbo2+9+HT`iLXMc!<-r5ToCShs5Jz zuK0#DL>ec3D4mdNDNPg%HXf!-fH<13EKyd0b+eT-N zXcBl(J+%?o?2vKBjFYUYI2p%H;bwB5ap~MK?k@Knk9mLI3pc~rxQ4(4e<4tKO)%s0 zs&E@v`QM@MJ6B|k|O1-60`GLGx`BXWtTvh6l z`lK;w1AN$ryg}XuK8XiToDL(NP0o>PJBMr(M?WYt8gc`U(BKep$bv zSLoFYccY%sz%wicr+Q!Knu_^v>I(dJJ7f2r%Laz16Nc)1T%=-#d4v%nd||U|B2ioJt=04 zg|HE9FY{A-0B6OhuBAy0l=vrfhRB0R%;ia zCk`Fyq53=EJ@fQ$^fP*~ZVr}tjXs+Dfcpmg+s!iAVRnN3#ERGzR>mH%XVjW%J&3E8 zYG>eCUo}|mqYhBRA$trFUztfcaw+8QSx-)^$eL)dMj@z^MH?wmAlFV#huh8O-W0l z5PuRxdXr&LExZrWF`3LD$z(oRM%I$g$tJRs93YwGILRdiq==M2%-kk6>PcJB)|96b z?Lz$_V#4X$G?vb#i|E%7FGVzzz02mZh3reH8SKFHt<;y*li+h*v^W^K<=O`AhUNoa z)=4UlCCp7V)PCwA zwM6ZtC2JcY195scy^kKP$LWds0?6x`z?TK!_gD0Cy_peU^fSg9=1m!po@_c7!F|cy zI85@m*#xck=r;S3R*s%H9O`5UQ<}lZb>&p$~!l0#*Toe}#8D|fd!5!o>xhzfs zI}YRr^O1ZMAI;C^ckw%*3*YVd>R^f~Z%MfHO*>#q(0zHOr|(Z19p z&0|E{ZEZmv7KVVtScgGjA43wpZRK)~fLyfkC ztbsax3)F=fz%4m&Zc<#yD-}?M)q-5?O`_<5IUVDK^B?IQX!A5U~3?g zY+$x5du44E$%XL;`8?=XIrPlux0*YkvTBS$aVQZ@fxadI>(2!aUV>JjHPG`7VDBwx zJKBZzq71M@Cdz`?%|oZ*jI0=}at-qAZB!1PZ^N$G4cEdB>;W0i8*0#&U@-;GcKpC@ zfzY!M=-a@`3O*V;Pj;Q+6sI`FDNb>UQ=H-yr#QtaPH~D;{{1AlM>SWE%1<3}pPd$- zT;gtXwFSKt(xqefSN%Ib{Ly>_D7Z(}_mEuvaAWiJi@$9g)aBLg{x9_o=@jIDD=71D zV2_TSj@RzdvHj7^W1C;&a&Y0rQJr21^64IQe9Y&r?x{aF%xIk2F4A>DNxSl)ts7iy z5bC*LO^IiRxRO>^hus`?ul3N9EA&!J&jth9wS3*9!KKnsWuxqsZEF(K`D62OhyMR# z+swzO!sAAdj_NcxDtz?lPx{r24>@^!If+f#y>rLd;hQG5a`o&Ikm%}`{@n{OUXfV9$YC8*g5^?;jU5wRh&7 zYPiDj=7OTyCFQegjr_56@IUsn+Fx+`q2JWyqwdeFWn8%PM#Hlg?p#6@lL{WC6pbHY zaNl)4!c|WgGG)-M@@{zU-jNaIUo`Y6Z_+!V^ZsUiFB&%sd!mYk1+!AGcRqbT&uw|? zzJ2o_%qw`bps4qVM?a)YSWtvVJPMyOVNp1bAAEfMS9#>UX7kI)ggxB;VXmm=Y@@6H zjP1vLH>CPc9Za#;k*p*%qucYN7Y@lRocO}v)>o$Wt2k8Bv(AK3L$-MFvvP}X9cVw; zUJw)bLoa{tBOQhhEuH;^GPU5_tQs}PF8@jm&Di}O`j6V)0<5Z~iyJ?5cT0D7cXxM4 zN_WE{6=@`-yE`SML1_t*I&_BuhgOgf@Q-@$Yh1nm_x+ylJ3Q-Q@3q&=>{+wcZ>^bq z_L*4Tg5?OT9jRj>&Z<|DR`Baow^?KDO7FBaFU*tb^ad~qN;4w8Goq&~nUd?21_(Ib zB)Q`9!;DyFF>ewPY!B}|J%J?H9^x~RDUC+5=ujI7MOEy&6B+&ZzCv zyT*UqYw8QGlPRGr!g*F>A)=_E#f1MP-ou1WENexMVgb_-^TBNT&2pWdEWuuBm+_pe zy*A=wqA6zeS_Iv)%_2!U7PKyLO5=((1qYoq_8sjtgdOQYMFN2xWy%^27j9##z7ZV5 zU=hk1?eVxhY=``Q{4T4IEKcGOQ>L@#T4)&5ZZk?)90zHN(o`p}1<_ZKju z6J)|BQM#EC!?+AmMR7GPj;b)R@AdO({Zkdq(oW2sWxS9mY)= zrpcB}>iJo?+j70rW$S^itT5-p&t2EP*@$`WKqhU<>J<-Bj`bdFyeLOANktsLOdKOq zpwiA`?i?Ai*?rg|jNK64lX*>?4`{#5d(6Hf!?2f8YD$EK=(JInUuCb;`Z#mmY*{YM zup6XqEl|aQ0fu*ZzO|P*Ei0Khcu$ajKt#Hm@q{6&h`z&?f(X7z0~KZ%yW`$7^<#sS zv|S3-Fat^EjtE=_%LjqORbhFewOj=U@y6?Jt$T#KeEJ7_$G$MmU5`p<`3r5qP#@@+~o7bul1BsnAkG=LaTm<(uk5O-zhMWW; z!*`*rl1sMs|aY7wAX1Lb5S@ll%#UBswm5i%pqm4rqtP zAzsn~f|O={)h{`BxYFSo)4^D)CW7 zb?H{zf-Y^tO@&2F-_AqU)5camBEikz~`tX4- z;$ox?L!-BJfvca;gV{)`yfny(+#NL|KI=F8^VIO6Ud-Lf&+~X5%=XJ*y1K#lXtZY> zw{@kEV~prmBceg?_vf=UlWWTt?6xPlye!VP3++sroVTc7G}_9wsb$=WTf{OF8jW;& z1i3_l<_U`sO}jv#e|i&EqUH8dDq8J1sOACc-jXK`n(AEpLgB66IEiL_Dr#3vFD7#Y zZGqWGY2By!W)ad1aNa|RAwyooZ5~EpR+XX{&T&$bC(M=}ROScw%F?+)=~VcAg9e5MW0!cl8mkoRV)D-{dIuPBIT8BPblNZXb^ zggTfZQDS)0{hS}$S=W|**s{mHu_DD6p0h-Q8@0Lob#;D|6et&2*i-gXG7^nrw&3X2o`Y;{k!PUx=MvqN@(P!R;W9oN%;qRH{0qnB z-Db+uh7TMkIiG`aLekB+AFs;<6(SSrZm369Xx!@VzL?Xrr+wbww`|N>=n)_-DIL>3 zvAm{DfDOEtlb@&#ceqf&x=F0_dT*v$cY<5Eg?;^q@55oyC<~pwG=BQyr4nF74QYv| z;kX@$kksh2Q121^{Rbzew8~N!$ko&Gb6T55!J{xkBZDp+{ED5Po*`rTNXs4^o<>~2 zA~$h`%L<{DD{z!m?#S}^jQHAVcqvH>O*?`|#;bLNGzLc4-|ybZ zmE1;Ehq7g2Y1{C&CvTMt?*-Vdvb;(^&G`Oyr5kIxO@-4bvo}^9UH^Vfby=0yCz~Ma z$XD9k+9?bOW9=2fhYK<$(wdtZc5vJ8HSANlv~@q(fh(4*_4MbLc0Pjd)7q{KASR~? zC&`WH8HrztRI2P4`08?9@JU>7fYnQ~8%=w^!!eKT0QGeX8-X+?2e0xjhmB2kMIY0A4P)5yz>m7_B(F%1oB% ze!rUVB(=&}Fh95Cwj=;Iq7e)1gRqB%Jvh*0+A&Oe{sAGis-~z=%Uw3Wq~$^m=O!S3 zMIa(K90PXyc?xPHv8PU&9eerMj%!VrQ^T{2jmn^+ke$EFO9^olxSyAy;?K~Qv?eS_YJrkiDOwrIpKcz~o zr%yTkK~0&4Wh`_cePXb|oS(l#W;qQexwjthsn3>$WUZhSlew%03(iLZhuABoGn)b~OrDjusO^`l1;){3(@wB2ehie~dQLB9E!A|(|Y_^>C zT|3@~3!udIZmAGsxdwbVF%j63Q280+JS9R!!VJIeA}1{j?#0<8TADfSk|gM z-ueV;?p=+%A7Tc|Q@a8WlM zpnR;Bj`tihJRhx|*fxQZI9tXe;Q>GD6#JlOT6M{G*T(DGj8=6j*^;e6hK#^^IB#WE zhUTsEC{?n@kxJLBna*E=BjJY#3c{xMQCipW=S( zE(_4>Co0sAwXG;4VY|;+T|$oONHFu-F})1o@~j zt*^3!7w3>z<9W=_yTz?oG}0UN`uMc_HkF7UhQ;dZd{86Cv7c$G5+^1Xf4}dSpQEcH zHzcT<+?-I3r3sQ}XiO;IE-g#c2A^)BcCwLAGs}6xY3Eh@y|m#+)y$|4gP`-WA`MTl z!j(GV8cjDJ@qyup3!ZdH7XcKHEpDZnd6FjayE)cd%80&Rf*=TB8;M^;!YxRu#BN2i z!jggi1wB>BUmH*3? zb-#Vx@OF+aq%!LgG}Nqr)xEqwSd8*fqK5e;X^PAFsk5(my&Z@JH$iwhMHGNnxms+^ ztaK!N6F4D?ujRFEV8?)SZj}zx+)aNtk#bm#!ZnNTmjFmWx4(B{l`5cZaP5*aC4byN-c`?HChp>&Oyt8O zDb?g2Ct&obSEa%byy0XJ6~AJ~PS$Ik*Ea+MkfeI9Zo>Gj<5K4+6<(OMu_Zb#8Y z&_g~}d%mP-{JgSLJSK;I1JQDQDb8nDh#4@->xKawH^qB*fO{ z?)ZImU!P^cTO!LIE{XI((}=Ncj`(T`{}FyNkxz=lAq69P79*D$1pM1igP=#=JHhL} zwUX@W7VbF{g57^KW!Ip=Z1YYLbBL(0yFSP)eTQ2DV{8KYIPqPahPrW&qpPD;q`Gq|K$r)?g3VSpV z7+DZX&ttS!s-Mjq$v>=&(P&Ye>IhE=JAJLeee@Rdf=st6CfM70J>&q?2_Fr8JHHcV zXb1@dWS?`PkCsM@E`97m!V*5DheWLhH&sVswNAa(1*;cfT-HNV){Ud4Ds2u^11VY) zgkBRGGY5IU7RRZFhk=iLE|_qQ3MUbd4f&ZFUdI#l3mlvjRTnJ(sLXXPr*5VWOr+y` zSs}9<*h^7wfx-f=ggP6uE(9ylC_p5h_39Q}=iW1*px1`i{(zwEw9#|0Q$}a1)nV_a zU1vCvN1t~6;7NO|U3hc4gfD~+`%~-SR`b%mkJbIrNPAZ|HZSn}AwNgK9lHxrO&-@i zJ&}(OR*e+e#|piO#t$EhLf|7CJ|^r5deu)MM4qzt;Q{{(vW^R*^;btvbcCqejy>bM zNFy1KUp*jvLG9Gr+<$X{b%Oqa5_R2g13QpxrN<<4b=|oL`C4qaUsQqTx`B&WGzDC? z8uBnvXG64Tx5W-6VX*PR0TGBc%4z{4}~7eWjFJhN$At5w@_{#bFZcQ*7d|Ig~KmkyY4N z)yQ%2QzDR1Na_a1>2L{WBAy^S7EGe!XoppncZwT2w5S4+1^eB4Nz@&8FwVkcrGwWW z9iuXa!|n7JcXohxmZhhOOHhWw=%{UwOB^Ruf8!c(tBeHJ}&T`BZxQ*=jD zOmaTeDq3ELM{W}cDi}eCbr?b(+;&*55fRW1xXUgvEs#!_y4_x`+(fvu-JBb+eB@2t z-hDA1qiyLmy3J1sCF;)W;;(V7QwyXSyDGyf0Oxg!Q{2q z2>LU3zr8$C+T4-2PJ`v^D}5HDURFC-+SXGRw_V|_$xnGwLV$+8U^bI|s#FmrmSvdK zh~=%x&aKG+mzO|juc_(}>?im{7^+InkP&hv{yro9-pRr zKU>~}htpNM-4|U_aeW!EJ}1&*&T7GaprSoRQ?OL5d8k9rQm|C0d8kd_5aE`q(rQv1 zO}fzn_dIJsrDm!lrM?-{ZE$5<40lYj1PJlIzuBzn0yP?sRb8hO(sHBS;?ucl&V`5} zl`&K*AIwM}+OFG~09PchSt0NV6>+G@GEHgDq<}c=Ti|N+)%Xz^L6 z5!Xg1(vY?I?d8CGwpmNemM3uS;rz9a8YKN8Z8tRC)>gYD#-iCbI5Q4P^&y}>!+cp_ z-Atkgr^5jN#Hhb5uzvd`D3)IqSmC}duxcr3+Od9Lg=PLl2|Tf}^7D7^k5GzII_o)H0+(H<-+tYO%u~9P`;k z8@RenNR0`*Fw|+zBZ$oGPZhim7_(NV9=PFyEA3Bs-^+)oyy;xGFVoog{H|>5T;`>c_)1!;eaP4!l6mmE-X?bL+mTw!%Wx<0VRL#R3w8o*a(i7%SVs8=* zJhwPJ=4s8C%T~}Q`=pUePu}!VM`yG|GtvyOIX!^XRW?jqp(;^Q8gWMT!Q#Zs?DxcS zZ!vp7!mDiTKU_f8T;xsYt+bT9BD}-`5rpLL3FXj=V3+c+&;g~%k#p6|-~3e#kLHV(Y{DTPB#u{y*D)WZeb^Rb}#$$9bmD#zEcx${t9es!!bdv$r3IeEB$^RUnvZ&R#U zVz}cY2(x>H4#6jVR?gD}Rkdpu zn0|$PrVn-pZI`pEJySC&dLb2%?wfptcy{kh8*C4nEq7L1Eix{BAsvu;g?eTL_5%@u z&dW*FM2iBYZqj@cuMo~O!PcO$auYRY^_N9~(l;4bC};PQ+8M-|2{n{Ln0QQqjHY>+d08EZ&rXOtC__%U zAgXLgi(OknIln}sSc^bgMY*s<69lKX#P8m4`r7i zNIUYz2m>YN{1lCmG8sGmX(?_^#~(W3F_Y%BJIC6>wgfR z*4DB+8<(PRL9y=A6U*lc#hqS-b>dl38sROC1;J_K-49CCwI1$vX|}DT-(~9!EbZOb zny$FE<0`2kbz4ADVs)_@Jl#z{#RV1d52Z7yO;xV@0JsZZm_85Y%<`1V+*N&}!Pb?m ze$LDM*7nnV?U0UW0a9I7{HAN){HaD@&u)|qWgQ>mkmdYBy}vRA zCVZJZXv}#*Xr=Vs!Ul$&^$xu%PFv5+OxasaYq=1RdBy>_#M)xmKQHa=lRm9_U-~XiZFSgk9Rqhfr!r8L~glgBcTtb=wFTJy+!DifAaRQdCU1HJ|h? zjJmjF1}=mZ;!T4~Rn!s*%yIc1IvUUWMe>sxct1-XJ)hcs4(68s>}1Eo7I^a}KWIHDJ_c5XRd3GGG}?K!CeV|?&$LC<-^JPF^DWSM zRZUbh?i1?a>O3j_THO1UUP?(g*nm%AXwj#raYTANbADysS#>3YdiGU}J+iJc@pU;@ z_>DmVi3@Vs(vAghN_aH4)o46fre(5aFUvmAi+Vy>s^e)ufGH}n+tR>!EcuT?#UNZT zM@3>=R(&~R8M-GmPDxDx1!!6;sVz((r7a~&eO4XSQy8bzDX*=Ju-pku1Lgx;*)e(| zO-n8-I2Jk;#+EvjHfegR(W-fC&}w+ABY>Uk;5^Z$6_*vy)X&ug%RiMHfuOWR&&V1x zeIphmg_W|Uge6ea;xvLm=Aa?aCJ6lux-r!^;a*8j!AEsf%~CblGR<=9vYVtlRJAb; zN{~B99P9%|KZAUuMmoRJ>$*tb@OmByTjH|Eje3T9WE*{o^6`jBoqlYN*=+iu*8VQ3 zJodf{s7d#1!Q+NbSi$q%1!TbRsRwtnt}9aO&G7T3$A|jw-?ur_kBrj#rAF>L)LRZM zNmYc?E7R70N<(z!s7x(C*Fikv$xWsE~a+$c90w%RBZf*$~ z>f|Q6TdbH|4EI>8usnFf`Sx6>@iO)7RCv18Q}t+*rMmR9>vp*sn${6BE;!h(L(^j7zhZS8h_ahaa`Km+*~-G0!|_ z>$z5~bH(d&t8*2U6@%{E^0u`!4>axdYO6E#;uQsk-JB{@QSI$=+?{fTNvNe4c441_ zhW4r%+!gh2w5zQ@ygL{3y!3R&;yUkzYcW#m^ft^7tju3SKYELMy~=)wv#jc>a-Uhjzvkf&-Q}xQAEZ%X@hK_V8VpQ{wcZ29#%_awIkDS& zz@S(>FfcwAZx0w5n+gV|$ENN9Lt}Npz~ornJzz}iEEt#_JG%!Aj^zad6JvSzfKOtZ z!NAPe<~?9|tTz~#8tc6WjEg-719M}~_bwjAqJb}-#-i*a9Mzo9+T4&o+^U$`+jD{0;l@g4F%AE!@O<(DA9+4NRl^*dfiS2N0rD z)5zG=A0&vy_gMrzh{Oz{$JB&TpdN-ErY=EHN-aZABUh(aqgH2Dqf}>9qh;63GcFJ} zP3dz8;>UD{c_;rGPmiol%{0F6K@c^jB20=r7a~)t4W>Ks|E`h&zSD+J9vv5mwYeanHpVAeR?@G^ar=H14cH0pny98&}SQ zwbKimJ{vX`Z|rGY;ZI6?%DJaf}@-Z5S;S~oXufY zx)nOYaXaF)2k5GJ1`4O?2JRIS*~c(caf0hs(!x;&Fdeuu>V|Ckt;{KvdgFM^k^E(_ z0}BaL>WCo<(GI{vqUAY0*dk|N)1w&=cb{o^000m7$MlHlm-Gnt*Yrq1MgFhEC}q!U zQ40N)ZfCKw;v`LHvEu?Z-5g8?4OcOBac#=%$xJ=fbGJblJ?#7P*oN)0UaUS$BCe>U zKmbY9)co{diUXco?1#i{(RM*W&XsA=&$nm1pO?sJ zk@}T`vpCwT$H^LWKnMr3tmi#*Xdf3$`4{&ZEs0>6gAJKo_UM3EOwGY>y6YRfv3Wl2 zNjp8Af-`#wiK>g3cxIocNX|r`hQ3rs&8pb#on}mQ+ONgS{Kmm#GRy?VE%9p2@o8r7 z$qLN}Du1BmeFKm+Nl0=<6Xi&i1YruRy@McSQmYGd8*?ZcC3GJ@LsAp%qVl^-(_GR< zzsL711R4dngI^;DA2*t@aI=lM3&BUHa7M~SmzXb3x`jADE$*NoYJhD&Bdn=XbK({n zoX+k*YUVA6iLBCSXR3G(OVUj1*Fw^#g+~b6dJ;qr2EEoIXO*ZAt?7aDsM?)-mv@iG zyRt%pl2Y+`73T8r_ker3$Q;(c$!W@}4G9VS55O z&p_g~%`+q-$tuN=@?%?(26il1c6}hZoi?R%%sR6M=G1hy%qmHS9ax7QofT=vIrEau zpeMtp*&RY(r>k+9rBS!QuPypl~iC0nh&nZ1?n&K zD3J{^IqK@Kq$KuzHo*&uT*$_XkA>->dNCc_2eNZr0PtrZoE%3*u7a@S^!~*mSwDwoOO1%p+5s z!<%L(4=s)fjg>eRy}d)J)N8lU&u0Wxe0)*alTXY%(iKn+xYXY@AQFuaow(B5d)k)( z6UuGv?(1_8`go3Ue>$?D^+)102y*x2G?J_S9v#mXx`D7#VP;U1yAf%zSkV{Nxmc~=##sOaK)Oh*)u#(K@PiJwWxOLIe7-2 zLf!D%+DR=TG9#TyvvJ!q)ZkUg`8~Ls*-ojq_*o=#2m7*ce432lPCK|)9MPLj$in3g zwYfH*^>}();&6qLUkvNWu72)FYh9NXjTL~~+qoB>eVn%#2iYi`-F&zb@8CV1DTyHy zi$>I3=CVDN&)S>1e1UJ>l8+@|hRJPV;9>G=v=*}*FC~4==;gAYuh|E<;Y&zpe!La!vQ*<#oLR98PI;y>(y0-@dJP7Hh)faF(v z6XY7Cl=vY7Z%{Uab5MUvdW(9C$c@B@zz4<$#|OoSxb;y-P)B4(sG-z~%!)V*`4NSv zOyJ{dY#+2sg7@wg5c*OpvVlR@n3p*3A>0Tq(OVxIN(aXHhZstV$OH!aKlYEh#%+!D z54%RaB)SxS4@V`P@|31N+F}sV4N70y?Y%^U4AZDUU~^>QZo!T0hAko}U~+tkO4QaV z-f@(8izW6G!OPDQfzwGBH@uiOhw&wcJ-FAR;yveIuyBQADRdAT0N6zOx2YofcP!M@ zRQhWHM%~DHiVa)%PYmV? zqyhm5eSJ`(k4QsX-bm0^Fif6|wr(4KntS>A`Wj}9oTQ~}%?`%W(A||d6Ss+pi+QQm zWvaU=_&#!fq1qlh)E-+>PPtyXQP|^I+s;BuXH5Ap1KobNhrXc1p`e|ZNLPyDINFSg z4(rgy{0K^6Y*Gu;kaTcTX^saFH=k$v>c9>Zi|f5w~Usm8mNyCV{u$vK>UVG{4JxdaN4M7 z%&4T^{D$CDUnU-jwbxQ2xG%F!;FPO8}&Dko@!?(O!D)FM; zt-BpYd_a}g3@jG0)t`w&$2eu_-%H-Z( zL0IbY?rkpov+)ecP1Y}lajT?av zD_eRpDcxR{e6|r2=F82532jyu9#7}{)KzFuX_H{Q?z-x+82t{^Rhdm3g3Pv=$&9gm zZs+;z`6t>(nnd&wW=7qxJeCgqh=BXjX}Bk01-p$EM96vbZc{v%}Eog&t9 zyG?7eiDq$e0#;+xQcXhSEpIuo72C{3(lgdxSOI4!&-c)DEtj*rJbEXPC7*H9h4B*T zcUZzrQkf~wzUvW12w~Vzv)C^mBv%C`t4TwAVnB7lcZovY)jnv3kla86wcdaG4&?m` zm6>BLuyX9FzRGUKgS_QaqI;djPMQI8jo0*0g?#)Z?MC(!EsPhO%<{ToTUdP#a>9g06@tkdcENDqcgzklSjQ=9h>;3prwR zeu~)0Pr)f=a=XhK5g;#Tcj9^l_hnpwSKanncjGbz@o(dT_4BxB>HYN;R?S5fth+&x zydT!odsFb1f+A1T3FpY*SOSNjIxh)7<{n29RQkf3v|X1EaMzGG5GDa#(2|7+aUvH` zw=u3qQ$Z4;eO&X_-balejkl{l&gLHZ0S4Id#5p%Gkj?m_X`)?t?#bYrXHoMRZn4#D zVCJS$g4%oLwNYpJ47Xh*`;~E;u|p7_=sRl$J)kSgu5}n`SC(F8+Ze-v)_ha1HlEhx zz}~K-hk5w8HK{bJ%>ieXUwRm_4Z5wzP=~FobaXV-gC=#*Vsc3GQmD~7>$=`0(bWKZ z!G$?)a8&mASxL*RhBjvlzG0n1#%g7$`@6RE+R)TNzWL@J#R0TJ9I2U5`)Y^ckiGar z%0i$D2&YNUQ)p!CtfC=FQIN@SHs<|ShwU>OjvV{>%AtphLKG#0RNxC^s?DlaeRjta zLTOuDyY+s2O77?6B^2dmkcsyU#w*r&4sBXS=7p7P<!KIbZ<4oKm;dl{~&&kFm zv~i3N0zTGE5fhwS9P^t#C!N^1E-|yXXC7ghAiC)`I#4+(~@uN5PO}8 z*i|a1Kj40t?Bp}rcz9sHT#75z?b>{ekj=FYtvez6@VV91c{~YEY(2cCqfMy-TmYfu zBN4IQah9a~nnO&x7v#s<94f9xUb&dt1Yma6>8XgzB?ti=fxR#QbEMmj40bS1XIuw#{JY%9$#?_QB=n=L9ddP;5CiG2cPWv8HbLnUXYIcZO zqny6{;vhyyz<@PK03a3S-y+(*pBzNP(#%56*}=ln?VF!y$BruWieZP2DSt3G-_Lbw zN7q_-6n6Lo3C9(KA#J1N35V@K!c!V_%w2Q(=h%i901>U-Y_i9hoaZ_GtFJHT9|l0- zuYt!M6_hbF&mC; zOnMtk2O|qB39}$>jDvKEU%6u-ZLj3ojuW9M#^|#*cKwqUt3|$y0 zRDv0g6$mAL8v3MeU0vNoPEPJ#03G|4)IvRZb+PioWB(Ky8g%7rfaoxvbOOy`@BZs_ zcPs0$^RZWWk9bt5Eo$k_kQOPt>e1DsqKpva_ao=fPt}>iRQpi}Cv`!+G}{_cw?0s}BQjA!~!f5piAlLmB7P;geqXd8xwy+yqAszAJOn|i%`A$Hk8P$? zAh|(_W^5Zn|1m}UV4<5fJdS(y+}}>E?1{+Gax50N4zlx(cU1=SLRnZoX-HGU@^)@3 zB90;lB105ic}t8S!y%&meL4L>VT&?K(omK0)VjhA5fZkd%d%p^8#k?JGwCEo!KH)b z%!3!x2m~nPV;iG(N@>LuBQ&*E)WTwLdE~iSf4y=&xP) zG2q<$se(q9e+$sR-pG$A`EzGZSpO8Pey!t2C;8c$L)d?hu4;-fU$zefpxpf_-jy2q z`pZe=LS}B}HX?|uzw9!^&d$xw#m~Xd&G$2(?eFVsJUriyOuyLqodV%kzIg>Q4*-Cf z_KmQhzY*%dH$r##Mre882&3s6p)Y(ROqy?mq415co4yem+c!do{YE%c-w12z8=)G0 zBP_3Pgst$6P!9j1uy2GD{e?_S)C+f@!W zz#sYFOPPBBO`I&f#rOcfo_?3Hw)8MDw{-I`v2glZ?ibc~Su0y7i@$~bKK{8TcT0D7 zTW2Q|TMIERz#q83v~BBRW9jxwfuES)@7|1aL2>b{qG{b_@TK+Be_wo0u z-fp%YmSXH2fM3qOOSoA&Sz0@L*qV9#rWd;7*o31>_06-ch004c5;{&JwfWuux$wLDGnlJ!>g}Y;#yK4$}$4z(8$acqv zz2i~cMee0LdBZz-ue<*Wch?S40D!PNipKd0VE~A`Ey`U0!~3u0paA~|c=KCD|8byxZ!f<^kAE@yf1<-bZT^pF^Dj{F zC;$C7y!m&e_yg+xJIMaiUH<5jfAXC_;>+*c|DTTV^JxCb;eO-sKe+C1!RjY8|Do)k zBEoNh`X9LZ&j|1*)c$Sk`(2Rx8L0jNga1UT-{ANU0Q+6He~8atxhxhA4y^wj-f;2# z1vhtiqXYp3Fg7ocf`|CF_wg5aV6m`#;Au^z`FE}*c1O{_OhUu}=n^cp7G@r1R2)Cf zcwgVq+F$2TU**`k{*vSQTkcCLb^C+dxBAGszU@7Y@NL@jpH9&Mu+ZWDs_o0?%U#kA zU@F_1yE(f%TX~StY0#4?$*U;-_BRrc0pIsO1$>=K!F^54VZI*yrxAddxwE6o-Hp-? z_yNA`=mzy4`M)P)kbuAYd#8`D_i6+9v1d?U=`RkK*tehN{w~A)o%7{G^20rTo9glY z#8LS&1Ny&~!Tqlm!okJ=gM~nTwUCzYlhWT>h{c~Rg!4xWDf)*T+y9f1|8GW=_^X!x zpi9L6S!=x9|L`l&|Bu%G#jm*k=0X4ESHEiQZ(I9OZv6kDcK;iVe%Yh?4@USu>ywL% zjO_dD>r0DD5MOlqW#0|VyZik))O`2l|G6Fh-?u~jSO0z!#J)H7zxRsg_pROgnwdfW zBR>AQU;iJQ^na1}A^?CxOYA*cY+T26cgYpCq9~H88QX!?MsXH3jk*$FD~XPgz3=x+ zT8fe_S=%MKq?TIlGW*cOv1=EMVagkR^{YnEq(I~Rw9ZfAxDDV^p+P5rQ5bDM+#(-E zkrrxeps8)Rb`aP-Gjrd&T)s@pNv*}*ojY@8&dixJ=P`3Q+7wf&HKs4(nTkg>?=Hra z8g7m0OPIgnt(E$2XgJau-`#k=;vsus7xZg`WuJ#-*R#}y`?_2#VH;*3TfltU z%}kwYjqeDSIPn&i+0H4M+F-tpI@_qNZN6RL+dw|uk8PazhSuaRc;#ekjQ3%OG2U#a z?uJv^jIJk$D`Eog&3ZfJVswn_y;*O)K9-=_zDNAu=VA+a1bZ{Geiv8R*VxU-+Gyv) zE;i4N*&D973t0gH2g%2>(;eSaqbElLJHGFL)gzNf=xKf)d$09VTmSsI15YgehW{M? zh&=a%zqxgz5D0s7s>P7&v*ZP=cPOIy#2yw?&&!GLGX!gOZhS*oz8M} zc8FzZQ5P7K*Lb>`FU=5hi%83Kl3{2MP^3*&vUy!{0f}dDC4VD(efsho0nW~p-2$*| zO8M!UlLZ-`Nzlr(aItWJ#jtHgu<1&EI$yY&pGl|ENlt{HsT;L?HQXtIws>AJbVH&S zE9Gf0a5f%*LJO*(3#u7_-DnKetCe7XU3lpC)sa!R+U0z)SZ<-p9E8JyV5p3!Xmt8S zs3)VA$k+la88jMLHBx#~;v`#=1d+~w<&;m4rcZ{;HAZCxQ-|Roj{?e5;c}g^IaOm# znkfP)n#xb9vaM)_#Nufzl;$GkxSOo12ZDJV;!IWEi=rV)K2 zfHK323Tv5kp>#D@EC4V}3^IG000o{?E!A|$h?q<{Te?yzUjtB1je;Ap#A~u-(qyXB zDe$uj)yvIew=7ZOOhKRtmuw7Z^NK1OoZG0?++EX^8{pj(zebAe&w{tgc}ca^0D zP1aaeV}cXB(E?&=g%=pv;Cb5XXUgqR1XANwmD3HK=A4nqXaP7qY1I*n7X)6B1v=x< zEKp&jxdI0xW&5$_(I_-)>9Wk*qPL*OeNIlbmZeZjR|M5& zI3~QfCW-za*iy~dR9e<}1B4eJt{39i;gOaVb=%UJ=xPpE9BoxmwRBTefH}ND0dv&K z)8*m@Y^2gAV>1?Oh~A3T@-Qd?bX~4A=MwWo6EabvRhczdQB-{;vyi)9Sg0=mlhhZc z(6p3i$$SC_1i5g0|1byMRMznz8LbO^?zWl=CVMc0s?E6)JA@D^SKND&Pf zEAY=W=(jvxLQ%`Z0x_jqrloSU=*id(NN>@CC9^84^E4V*3M56Y)T9(FS`<{t0D(*| zX3NZMF< zxYYV}J${D%kpvQU@RgsfZt=L8V5l$75Tb2%;GB_}VOXBIB1tNxLXD)(IxU>x#&iuIj8{$mcWEq*G!)nc~>(^eqGF?5D z9!5W?`a&Hk@p_dgSI%aEl%y<6v7l441(vDBSm1y*R~jBU)v}UC>&W}IBsIW;g2{uv2C1!x z3I_r@z=fg82F)QijbVb7SwT|FEml`7mQz_UtD7eWgnRzPSnEkeI!w1&LzSYP#_PjA zqf8>SDNT5E1Kgm$Z5Xs7DMoYGx7-NWbe6~g?PPxdXG^|44bDlmdJXGLBqxIvMR3|A z4n`6gfM9ZG9q}HmaQ5JK-r+_(&H017LgE)$RhAr4IP%)SbE6sGm%B^kqePJ zTMkOP42DT|VJ79IK)VdP_(oLTmgveWo;S0tNK7L+@vxgw|$ z@($+40*DVJW2fq~4uw!^u2Q~6Qdr(1rHhshNmW4EmKTEQtoay_DSzEDA4nQhfBrf} zM0|FtSe~M?b)TKlZel>#*rq7RyrO^`T7+31MfTw=(BT?#5%GwIn%Aw!NxCXYJUvy& zF2Yc9CFG{Gs5=~~3v8=Nf^I6{NI~71e5m$RVXlDO9l!pfU(=#>QM4pYu~1EqfT&&# zY!{&aHT>;tn$%0_@mXI77_=(!yllfnLv2KFR53SQD_jL@tX#)vv9ARtNv;;;aKSRb z4B#CG86`eIsa`B%FCc1bOB~NhJb2q7@G3GO0v^4~8_*Z9hw<-Jt^(F)4X42=DdkD3 zys((7xaq|kI1wNlc?YL!hQNU1QLd0&hp9*+yHF-*3JV@UkSXC6AhL^PAY%A!guH@D zU05s<{9){lDFG?4tvo!{uh-pv1H%Q;R_jx>N^Y9G1Qr6~)>;`dU1E-jU0=1Ndu z#^IV~c%C+F1B5p$*N}oD9!+#NO4Kb;k_^-7IMM;td~r5Cj;yw5=LK42Y}=Muo%Ss& z*S?H8>#PLEoMh=TqtRS>VF7JInYjgLYl1T|kB_?aJQ1y{iV{+rVxVJqwc{PB7JHZy ztyz|0N(@X!WiAIa%8`vPgw1M;3@k5>lfa_GyY?E$cZ`xRRBMIOT;1{Nao-~~P0*62 z!D}F?%reNB3Yds_XA_(BId?TzDCVY$`6lsbbDA#jqKlH*23m_&HAWEy-3pBr?U9~^ z_3DiItTX6Tt3iWRBxz_rLe^VYWam>u<8AF_PNrqhnT#a(wI{Fz;Z0P|ohGLpzb+W) zl5T=R0mitTE0jnjZ?^_@e)@8L`bs(l<_XzT3VKqC#ArMVt!&MYLe}Yqjudc=V(=F2 zYzmT9crs$Y=(cY0s%FrHEO>O~D-j?|l0}6D|1MLQ16mL}DB6}q8;rrT3}^}#ZL^?7 zMht_nf-p^)QCMCk(ubKv+dxs_lg(92!&uE@(dxa0Hac)_DSy3&tSINTdZn;PUMpZ# zA=Q?{els}V*I|I+y#gnX=n0&}KEB&;ClA{pIOPa>oOXP^EO;f^>8WYo=X5hXzY}Ma zOIOjR1MWA@QG3w{f#i*CQ6Qf>uJ4StQyaR2%(D18*H(PB)IUisSg8&Olq;PFXLMpub(|#ecbyaB@irD(i+P0e$Ml zEueb)aogQqFZN@o-ay-K?@-Hq&c`n~fInUEK~&h^^x20$emm~S4sGMp<51Y8TZc1t zk{`q02jPRpg#MP2z;=d4(GeMuPq}Vy^e#nXcpm*v`;CbW&wID)Y_vZg-mx*Wi3`)# z*xBnt>Gu0)dwyiSwGFyGIoRHo4fz>32j8BX`x|_2zQwSaJw9OHqDS!=JB#1Gd$Wzx z`|Wu`+dA#vR&3H91qXa)T(|8+DQqWB>r;zp*iuB>?!q5_ZQR>W?}Xt~iwN1#mgG*u zNVXPQ_<7h#yRehp9X{=RgXT^hTkU3JXs7$;yWUjV#o6m8up{*e9QEzw=;f0*J>KnR z+W+4Z$~(1|C{NpuzU`=|2w;jq1m(o?L7aM!K^j@a>(8?DDwb6N_|h8~)Wg zwQA9vV7D)GB7O}Lj%!E?0V{sX5yG5Fud zTmqO<0FLf&Zf^>n>j3l59sV6t8@1Pg#@QKe4+wFb7ewZ)KA|h@!}r(gg_&c;!qoj+ z%08DF$&QY+D1a}{n22P8`(QGLkb!LBJi5*6;gDGKbA3KKiiRaQcVp4q!xzCPn5*O# zj*1{Ks~4wl%v~##E?zD#Y_ZI&CHjuNSC*wC0 zH|_Y+YXfTs@Le|UZO9KgGt%MQZHJ(h~+xP01NV}QFZT!3R zTH>p>>kmBNyYzZ&X+8GMpVkKZUcDQ@&NPG7{;BWfzP^{cvX>tJy;~R7;AeF8!rB17 zy#)2*h?n}Rm*TvX%R%IRu!HzU>|WeQ|1Plw=PofCZ9N?u8bX{ya)N6G<#xut+jPrY zaGi8unCF^d0z8dx>5Dz+w5ZSr{)D80H<@)(N1Z#{e#>hE>VHahzEmO1_fHgwogl3T}`<5;kF0S?RAmMQ)ki3iLsEZtQD)n*r0Hv z*k&>;m2z*bK{D)KEW>`)Ls1ttkYRrT&p&ov z{eA6a*q5Q;B*2{S@-L^~sJ%Z0n3uZRxA%Q?xjevR_ix_60>IqZ-@ZMxo|nQm=5N^E zw*cB%B+v6=EDFrZ3c5klp{v2TbYLoUPcwPmV zeFy!U5;tn^ivaWB!S?O_4?Lp)lkD;TXQ_?a`&WQ@r{`1A$;`}E##VNvuA8iDte+J} zKeId1&mrlza}8}fIx)W15mLe35xGZH@Y36fvyCf5ljr6sT<_*Ya-i|%t^d4tU7%v? zLX27$I^cD>=l<&e6j84{0Lk_EAhpg9#u7`b zG4xCIy?h8axEfp52V;Kj7h+ECL@@VIM@!gFl8Xuk22p;T6azB&vFEAhfAY+K#OLqM zEE}Cp|NFs$0K;Of$0K6KS-}H%z4v2%_cvbZO)vHDUh1w`(7r&@ooMR=0s8_bpuwGL zWMniA&pZ|HyvZjMeLrLeU+0rp1=XK;=Ba(LdhOZO$#XCPD?eHd(DX|U^`Vve1CyE4 zWZGA*CveeC&W0hp`@KeIGV%Uf0I~9o^G==T&&v0$F8#}arPYH=PbT~2>~f}i_9oYJ z>8S)l`KymU{uoTUI3D~fAHo|>sZjSGZz$jQE{pB%cmG$X{nYI1bk6`ay1M4-ir~K^ z&S=N}484uM2E!c6Og63!fkoMEuXpvYi!o~c*gBu=?}V?zF+84zHPJXdbOv8Ve2(Ot zo0z9o#4fwR4$Tj(=*dB6=#95lw2oUJCYH?($Q^qAA5K5> z%&v81=BfF+o!0c^^`+P7OBY7paOQn%E$&z>UDQL~jGscw59fUizLPlb9DIKTr~VMW z@5iZcc^2ij9jkYMY89#Csf|OP00aghBuX4bgzR+**%LJq9YPNJgiJOhIny|wK;+B> zXa#f_I6Y6DTkq;a)Wv!8v6acLGxJFx`$Kld8T3QXuGa6q^vb(1+ZTW&Nsk(XYmJ{Q zi~E*VI~s2;i=9iWaab%sWLWY*!eukQJlWwA@)6*;03inhguKtWHo6Osk&qAF8a#$m zvPa0AN3@Lz=?5WsMC|tdYcU`Q@hln_lZi>(lh-*kdBB`pPY3$$1^)hco+3kU`~sN! z+4rC9on87yFIB%id$Zbm>B8C{eFT>M$F<*?bP1GrcD2^u;N*t#I7X`Dg}=4&{0$@xEx20WcjbR03>9>M*E6_?0NA}^@lb~v+^Jc|3)c&j!ryY%!R zRXgM_;-!O$rGx!$@8a1@jkOCu?!lc9JcfP5Ln?WuKe5Pof>ci?Mpu_U95~na++QMk zzl;oD>f_`J@vbf=doY3v*)`O^6?@{0t6UP0^(2Uv{lKgLSKajoM^WAJ-Mh=>k{r3i zTta}L0XC8r!Gu!@Vrvix5dvHik|=3%b^b~=t$WoqqIEwyTG zqqf>!2qs!^I^(FN^%stIh$GBst&pmazVG+_*u8zXxkLYIX0myC``Pb%@B7}qAD_>@ z-4*1fkI!i1c_B@y3&SL^9s?ie@c&m@QQr~&Q2UmKj}alrU!>8J;yTUOWL~pZndrx> zdfAW5>-JzE2j(AFVKanx7`I_aV=ad^$aNT6OO8z#YG=1)2;UkW#?bX5ENRF)-dYK$sFa&SRUMt3sW(>jGxYuCl2sy4|Yb!dVqBA|( z=2w1$HR^A&SflRBVvU;5EPnO+(+lZ!QCQnq)~N8!4Yu6-hHF$9L!k+OcVt7QydKWM zv=lZ}nQ1Ak(@A}g{Y8#zW~X(mH9z=9a`jP$DKXwVVxnsWhUcf%F)g2zR<4v*9%A^2 z`s%#A5)&O0m~yOT({jFKIZv`&fS6yheEcKv{YOo7pTO`^JRo`X87U^2T2jjj2)}Tk z7PGTc)SqrLKOXn0Wo1U=zL4r`lIrBcNm5A*q>>gQh7YFKpWgSbiLO*R#_q#_WVukX z98B?H<%czgO!TEH$8aAus80TwjCLlov+utXxxw^LhiYO{%YKfO!=RMIBE)QFcS-<~ zKyAO|t-$9d`VN(2cn#jK+Us<`6!WZOU4*3k6iN9hM$8IUvukD@c*H~xsT_lR6X*Za zrd1-PRV<}71u>s8FT6SDj#d->rphs3S!-BR4W9^kkzM7*7&!lwh=HGvQp!#+_+60) ztykf9B#e}+zLb2J@3P0tcG)a1QrIlQv~#f?Q(Z+r_-4s-HT!Odh*_|J-I?eOjDf4( z7BN<@mP%fof?iz--?y_)X8GGR?Xr_qZ?P(QLKC9`OUlbQQw5fE$mj+Xd(+OQ9VNvS zG2N=_pWQoBqhK&`<8|>{qg`9JTz}n0rPdk+kE5{@parEoFMs34A6Ya#A-mf}(X4l= zq?2J~InydAT7~p9s$d!o*WvY6wtpQJ$+Xg_H4>SQ?wfApVwK=|7pCWVFS(e%F&uc_ zX-Y@eFP6PQy5=qio_9Zt_nyo=?@sdjw{$$OjkkkQqb*1JUP-OQ-;&=hg4>Y=AAC2# z?90FhA0xky5zHR1Ip1=!_XNSbn1K&|8kR!@b4zY!d-vv2ZgwJj(4#&@FhjYS`NF>w z%&`piPQeV9U`8|W!O%n1WXYpO2=1D^%;ks?OmAN1a@<2O4`;9!CMWh2%)9wE9^Y0D z7%R1c?8;F?aP=AZR#>++5zKo9ras|Rj-{kgH~S~HHwH5gf@zs#Ugu=*bArh!oY-D1 z@L>eAHek+c)A-?e^UI$I?oih2oY$n>GSZe7DmXBZIA1?gzH6E0A6cd$ z`L)#_?R@SOXB+!Y#&h~t&-vIDe#KZ?A9yxW*@(;wTm28u*|jth81T;z3@n?k4!-Zx zhu!+Yp!?-Tan0WgmcHVa!msUGr}_J@RKm%=SGG>u{S&-TE}Osi(ok;v+j`Qqc(CU` z27%}YRQ(GNfO}q#l3e*uQXYZS;b7ylt#Fod8uKF0+;8;1m zd?}@ij4^^(RS)&3-&(1}1IBF;eZ*&c!mb`(zCzjEoF7{mQ+Br0$4Z8mU#T^?^YeeW*3jOkONQ^Fwd%=QE#e&8>NJz#?ICT^pabsBUJE+Tc@J0seGZKmD03lm^0=Jtb-_E1diC-x%lLyaxG z5c*hEqVV<}E#yw*l0U_2d@{1pr7?xyHU9o}TBwPVkcO8SE+e)opqC;waq7tQWK=); zrJf9Rv|qcc&L2J;PFmB1G2;Ss(mXc5_abdqiSD|E9Oq$Z4`Zf7xE7y}p+RyyA4A6l z&S96E7tTntN_hg0bpV%Vif@Ds$vRpZEX`!`8;oB`j{5zyN{CIejvShEj*{ONODb;v0!m^ z;v9X{qYrxY10H?M(|x=z8Se-TEC>uto%>m0xjqWI7U>O0be)KvZ;ifCL{G6smtyqf zx&MwA_MLnVI?`>q`pe^_6HAh_IWGdcPD)or3e;)5)X^S3Ou18QLCspfT-00x;}N~c zNz(eiR@C}7a$JNVU@>fUZR5&eUa}iQ)3Bav7*~FT^RwGX@6sHfVIgU65F9fQ=pm(j z$Z|4r$_>pqUL~3eM+eE-1>)8hv0$Ts*sz^}=pdYLN6la=7NUsp)FJE#mSPANtyf^E zPPD`|q9uM$^eY=g+)W~GYf6jl7j2c&GD`#vkIy9e_2hW?gg#bu?MNLN^8$B1hWz;L z*bK+DK1z_kOB>{9---4>AH*5M7!&O@MmvW3x2|hrcmF6b`6m(^jR5pqSNIzvrmm3i zMxi+jMf)F9NDINRafXX3Wn^qBZER{4k2?7&+L8{*bXla88#G2Kz?mJ-;Xf+*b-BsG zGgFY!-(n=VSE*)W6@5%EqS$Nn}7oX|x?W#TKCw`Sl)6Q+n|<2uOH3{2Hh_qz@S1TC^MQzDpatzId6Q zbT1z1`HapxdftL-PI8mR53~@)>LcF16FXPsllhQ;A)5~wkqZLP)>bw)GdYG#hDaNz zgc;CjeJuEVkdJO<5%-z?yQad-tF6&&KOM#pr1BBw1)34o57cHSdK)O^c8t4I)aX-U zPV=@oyHWYvXD$g{gQ3e*-d6Yv7s@L(l;gV=#1g=RQ}r^e#r5Anz}TOKfU#4?SQZ=Z z6jC^r>$}{%y67GDs;g2TzcLKx9bx11L2U5%@jzS2P zD@wU2(~~GR7f+`Z6GP+XsrDMIO`($Ek@xP6aR;v!N@e#;We=oy^}#=T@=SEQ$}x7Y z1|`b@$ugBR!c4TAS1@DTL??u#!M(cMQ5vBlM~I#M{gdYwnI3yUH8H7WFOqUNS;`@m zEBaa6YX8@7yG`_n$}v2LA4nwr=TeNv<NCe ztY2bR(NXe3Ngjak9|VTW6~9ioYKi@-FsDaN%xX!lSZ}`yKLownnihU5e4aI?dLjEr zbP1Ots-f5VP{de0HbwGSiR3XVSHL|1J;)`M+hZnri;H7;p6_xwwXvyahd)StIyrZV zrH#2vj0^Vfbln8IPEzi{t{>j&Q18>EQj}sT{tAN1rWAE!lMoFOxK&Etk78TLSws~3 zHWz8v3UKo_?ZqnHSfv^X%kt;6ikwh@5nCJ62{2iI()Zm~x!t`w4=( z|6FsRu2pK2c6%^Meu7{ooo7xv2(C8W&VoLI*>hfICFy>GdHlSInRl3oJwq@TmD`y2 zbjlRL>?@zx-UujD1hZx4#7Yf3_wtvScK_9;W%7&3Ou1s##OXc)Lma`pHp`q0r%U&0 znEK4lF5OK8ck}Ft(*Wbc2N6jVIvF93i;OVnL^coWsOpJ^VXH6;N8 zR0SLk0Sav)eeo*ww9?k{PLnnPq4Xl9V8Iq4p{S*Rp@npaC@KfP5B>1Ly};3{SFn^L zYN0^EPel+F1(D;CbJ5BXgacK$zn!SIsX3yGtul<;{*3kV+ zA7B~>M{dst0dq0}KWv_72P>1`Ex_rAMCR9Lh%$bo0GAhmA6kQ00rTUK$n_C36s8D6 z!}Bvkh8ZyV@sT|}mH=jTe0YAiVN(y7gYl8;_jADfJp#Y4aKQtZ4~9kVAI9O3H#|JQ zOYnaRaVulY&J-efKV zoF^&#eV@gC1ek#%!oOL@`z{!v?7nWm)s6^%-#(DB5ir|FMjk)>fH7FY^E-!=X~5jD z1j^eLKMyQno=FbR?@nmIF94p-gqr7JU?7iGyvw~w8;AEG+-`9;DlNToAJk_n>*t#Q_i}dlc3%Y)HeV-5h1ldr|=oUvHdO zfI~T7Qi$^_z~QTo9=VZm#8X`X4xb}c0S@aeD_2>)CGio8Cb3Yg+a;rUhKya_O$Pl~+0ybYM{lf(1FmxpnH(M<`=E4myn0aG_6 zJii5y@f2WgOpUyr&YT9%JS{xGe@Bx7z-XpNmfs-2q)rdd?+RpO0%k-(WcfJ&Q&te3 zpC9)@08?pe$FCC$>_6F*wbMTX?j2kB`=amAVZc0Lk6dq;?UJocxP2cSGXXQAF!DNO z3}EsLBe#27A%=N~TyOsdn7tAB&4z*N0ATt%gY;%6a>jB0j8oY-eL(>Z^~)8fvU*d^ zfO5?U{~T!E(jPD%&1kou(^({+nXrzZ8Nt#WWeu3BnUUrE9ALK3{QqRZ&VmMpCWpiW z49%h;1Utfmg8+8IED%XBG_zx*z)mifA`XV;goN!2&1x6>u-yZYxQC%>a=gFL)R2gR z9p%;;BN~v9_yXiez5tp3V_$&Z=LbMv3JUBMBYmwIIJZ2(Z?dep6&1~0XYDSQ zB~}|fye_})Ml8>3G@K(h${2QH|oR*fF@<89%)YN24N~&~fNlflzF;T9uAzYJtT8x;k>J^=wGJ1ps z{v}&x2N#OhaH`3iB|j>gJCR{2*~#CRS@-bL_p&Mq4oqC-bib4|>cW9cgK*c0K@b1x zI(hG)H<#SnR(|fs?DcDJ7xrE>_i&#F8=uL(GCk8j;@v0}&++XZShZ#i7n6Ih*z~|Z z5C7-H%KAUQXQ}C>S#|QoUTL45ntW>S$=yBsTzlY+w;$QR`=6UP54v{EZ7zM@QhDG9 z(~1wiugx1j;7=!}ul}M>bcJfRX4i4IvF~5*+_UM|gbT;E#|lj&eTR=foilH8itQa& z`9D->$yw-}>p%{y)OR4ejpWKh#fV6wm!{JuC2e`q4v| zo=o5I#n}fN+V1I7WPeZNne>zOo7Z<9i>?{ht@qLY>hn(1cUw;6KL0Q7#ijGTEd$bD z{>Y>mGq(3#jRwtTo{t*HU2Oeg$2X^++BJUQtLo(PPY0eJyk&Z0{4)vrzAxGL%KWO8 z0J(6zvekMhgKxfXr8V`j=(D;D%dfusgW-(*bxt~70>d@D@ zbF57n*fTC$NtsY0pzS`q?-rp;zlXw;}ba9u@>qA_Y5&T>n+6rrcu94B7J za2;OljZZv>bUSgjRpzaUcO?+h|8kC6@0Y72W9V3#T0m2Inp*33_4b)?`o!5J&cMr? zmsoBLKGm0qN9G*VkwVj;F!9W|$Re#%wdCyAh$uzQRR7q=<9rk1-o1R=@Ap=l^{$Lom2V>F@kg!f?rG9tu*xx<`!bxn z2QFl`!{|2z@@0Z9K_7sb7}O-rmt)pj(RoC2a6)@=eeET87Mh|94zKGbjjH9%xfuuY z7938i%rbuU1T~*<87=Ow*BBhC78cV-FJ7F3{!8s|h&$QoL=d=lmcq#qc#@f8frXQU z8jU0r+H8&@)K2DNvX5OsKD01SkUp~@(61~Am1P2nZ7j?!EuCK~Bni~Sg{0HLCJ7^g z2y~QoFD2iV5zt5nKZO^=j0}jSFQ+5DghoCpz_2h5r}(J;J**TNu+Z8bKTnaxGwVi0uNI)|^&Y_!RKJo?%u_Y}K0z%Kcgw4q79-_@6SJ9+3nm6bArll zgtGU*vOhI8Kh6~`W{rn>y+%sbnTMj4T$*~Uk-Q2wx{RJClji`RiRslpr8YJD)Lx&O zIC&74rvao8JsCBSQL^nt@L!SSn4ot!7v3T&PF9qHcp197(dw>^G>sf zRy5d;_d3!*s@`dFEn2K6Z{8T6GtTSCslQ*nJ}+7{c#iSV%Dmk@tBjnxySK{dtukTz zhQwykY4SR<#QRO&CF6sVW0`6j!tDBG6Au*;iiQhV;-fqrpv2Ilz$oUcMPq?2^?IPU zkQia^DB#_URXdllOJFkAFiWRy+`fK(zu)&nD*`?M9l4t0-7%hvywAkfo?LmQS+>0h z{wt$bn#h$`f6JANs6P{Sb)&=SD~`2`ZQ>QVD|`Grx&^xK@c31}C(+>4t@S;L9&%z2 zuTh++_QKHkFbLyIe!Q#`A=2UDuEm{P^Q^9YmUR_1nKBwcig)SBV~;oeM8 zH-g-zmZptGqdSW?D_5#%>HgBF$b_Vj+n4k>JIRB_2yoa+| zm91=OT~f#Rm6BT|x+wNj5^K**UwjyUR7~}NH6e6lG_?0xh?dew@H%Q!6YYiAvtT1fo5azZ}VQ%dx%$QDuNz*nl>L{bW4H4!g zX$mU~b3NCkU-epZ96ITuG?BoT;}8#sKR=I(1afhY;>1nQUwNm`G{CC*vdFi=Ebt_3 ztR(6UX0+jjKGe@yP=u0_`{x{Vfh(R>bC2&;VtiO%sMe)CtJcBQqTamTgaKJITBVX{)hD~Y>Chj5WQB2&+A&>jIgivwAjIygIKJMC(wzFD36Jt?vh`n{hrE{x!gVdU^ zTRNN|0b|)qxGf3wYJ$g%E5l~x+l^I5{O5hu=Kfc=`*t@4C1jRcu5KsgC)4`!sqf>| zuRuI5e&+R@XR4J}Jaw?2#U6NVXzk;Y<~dG|qWK(~fKV!vQOnrSvQc_y8mN{EhMMII zl3BiN!Zwhoz|llZo4OPe)H})<2OP3?14*c<)PT~7u{uiW%fwg`DW?oYC5xi>)$QVC zyL>hl&i0dji+!nls&$_wNE*+|9*SMb0tfsT*u?q;);lQmM@B7Y67Vt!ESmqQz&^dj zjOnNZa+n7hN&tNr0}>d+({_;$zqMzuWgrC$kp1QvK=}5UvER88#Lva%gil3(y>7ie z3fl78WA1BWv(L)c>*(2ygoD04>ZA18r7tLmQ%zzKOtF0E!z;&Z6&zG6`JN@>w|S08 z+B(-HPBmH!ARQYiT`T(5nsEZ*kX5v$_KYh5dL`Z`;fhl{;W=V**u>|s)xD3^6OcHF zy0!a0+(nQc0xD+%dAgAHh~fyU1MGG?h(sUfXe3}0R|m&`Web_@%m?^YwpM(FP=9Cj za!1H;jOK;YNtcZ$ZSiGN6NZMY7@W(2{BC*Lk{yP1YlzP-@#&NnC=0Lg($kbfuf6P) z{h&=ChG_Xj4b#=)<{&8F9(t}FRHv4q#vr7TWP&0qZtl3!Q7Qf7$uSB|4H{Uhew(#w z+J{lg@8)Fh>$jNBAIUZ@Xl@0|UCnYusdv-Zxo;BAsA%>O3hU%Q2(?3ck*8%QnRIuH zhNpgAns_b_OgtCXJ7Vlb(z?k>Ha%eV^hoIH>5{1RoHu%E%$ywG1*dTC(T0XxmE^CS zXEroURTcO)W2tQ7W^9|jCsBb)p$MR5%7I~U&!zT^SYvke_EejzId|{Y!M;SVFA>Yf zwQiz`F#XNdSbfu01pJ&aMb%b&#;qGW+g$CAZjGbR9#-FG>^@FgFw)Ra%&Xe$(EDac zEbOYAFbB$!VD-6CFovmau5EG&hKAF2oJdJ?L%Zr5xXjGr0^=4A9Rd-vjXCn`YyIL8S8wE8ka`AG=L|`9@vSxzSOk*B zw2l+=1gey+1wmK3`Vt7aZj2O^0I$TICbJcpiAUbyWj)}{OT@xegTPC?75$25xq6Ay z%<|)?Tk_1(G-n~3Z7&X*ZTDfT;RHrmSz}x(DOMAS9!hg}vuVuNjJnP!j6p=Hdl;3( zs61X?Ejf7k9*cMykp>1qo+=L$w}Gck*u-t;Y4mX|_d3fx!g9|u>K5bNBPv)qp>6Tq zq+@g^E%F_@P*(57n9!_lThx2WenE7|YA&vwl4xS<481rZzs$2Do^uU%81^okLSjF6 z!L+1hf|cw*&1(Kb2>T4S=%${9huIq5(=_9tI%Ee|_C5T7Vd}GDy1*P~7{mKn-6hZ+ z?LemjH)~T>4V9u|G~)6fu4s&se$~=1Pk&RJ;NY9sL4E2a6-0M$za|v!lAUE++h^D| z(pOAr<+m%-mw`>8{6f*%KGudylZ2ZkdRBI0X$)rD{=+8*{6Hk8z(x1ENPcQnTr$5rY0=u2G zJWT?HfH0Bh(RzZMJU{^ zzD-&PPKL7}mP#?40FVJq7>JK>H zP40^;$i9R^5%(e#axf4I?{o*DaEGZIq1uRJFjBW9n-v;V<0hd{58faYu93bc)Zk?? zbca}oFREBnQCU?njFUe=E5s*{8pchaFK{QrY&Um>v_(uag5JB*uMR_c`Y_H;-|*(6 z8>o;|S%L7hP`Hiy&O%0NR~adx8S%-}gE?_w> zT6*v#LHb0oAg9X)__Cpo+!F#lSm0b47{M(>Bm9QWf^)TzB-+UU)&z#K29m@Y$XJ$p zA8R1NYD)h0)CfMfbXlA$4NF%LrdayUiiLYu>7-bF*^LEOtRbveDJ(Z5q*&SQij@{p zEFuFf`B~jqD?K!Hy|F}cS{thX-I;3prkW$w^rL`*bbYbY}%+S+Gp{E(4 zr-`Ab{Xsj<%FtZxzE6HDM{PH(r^)5LDF`yw7q2Qh-v#-+A(}%LDD{E zX*g4Pke5SP(KKw&b4c1xEbSM3?LyLSvozH84w8oP?r9p1DmIeVkEP*gJB_3zur$;K zlStY)mX-t5{UmK7ODhB_hosG9X>)m5l4UFn=hd`Fx_G(2KE})awT|U(sTHf1JH&F2!f_Fy zK7?Z>p+14*GD4l=seQYaJI$^*%c%2=`VKcd2<5IQonQ7)1q`KgmkE!~cfnXQxRjH^ zY~$P1QVgPvc2huCRJsKAWmm4EQV5E*AV_>T*=|Z6vp9L|!cQ$fIJY$TqTm}Xu3Y9K zJc$JyyGoAlEuX{i8gl;d+sRDweA%KToLe57uKa#6t7qi)b7ljd7R0luAlwq^3ihm^*i60GiT;EznS^X z{OFUCApS8V7~x-W2??fn@waBUZTP%QCfj4F)$t5feSbzz(EfNzCSj_WI`l`W!<(q$ z@lqLF*LxhvDya-kf*(b)8Y+W^_CrW^50$}Hzb#1iFsDH8k5Zs;1!@zL?WQsq5=TX{ zb}BnS)%wSrQq|PW32HoiO^t_c`r96AJU~_YG-9!UpHHACxEQqqJvn6U?kJO#B5NUw zHTC)+dV6X`+C90xsVq=YZL(fXF8MG?pU zSXxoBXmMFZ>WZ>eWy=-?K;Nd_G1XVLv;u~EhI#?m!OK@^9XeRK==K#rF90nc8$z?I&74&F9KV{Gpo6-#(bAQ&L7tV11hzi(|Uos;pQ|)WJX#) z7=Eq4+%O|;K*P+m6ny8ZtDr#5&D1&%_TzG=gx*f~OMqr(ni+d8)wk641z6;DA+~B^A>Pv@NRXDaE!v4%(3&_RzcL){`*KpS=-o<{xT3Z=T%0VFT2s z4O^gg)wbV*qtqOrM$LYyka)=f0hpoGxg@~vcIg%i)!e}zTl4L40MKMfDJ+KW8>xm1 z>i%%83xC1Ejd@0ZT;C49sw0qLYi?KDww?Vc<306AFwWKt-Vr1&ZYu66GPF_kXSe_e zz^ix)bzdI2W`J@uZ9v```=eYl)MYR?H9uV~uy{&J3VRMV-i&Ui^rF4Lt}yJM`LNEzXd%}izNcOB69wwXQH(EiRM)Gx=h^E?8p_x0av~oOC`6h zIjFRLWk#{C4X4$3*c4iS&e{(;o*jCo)FgSyEy(ls*>=sg*qRU7-fGV}0C!gdeL<`G zqV7U+@ThIqbr#pGLnn+A>1v*~Ncg^Hx}arpw4bErWJV-M1ei3DX$tt?VCl}0>_L-?LyZ~> z=tbY~H|F3_H3u)&4sfeGJCL72O+lzFeYXW|n|T-b?J%e$y&k+2xzTE?&d?ih5cN=f zoVr=QPU~kmEwI*t4$9Pz$>MPybN2W`HBiZTiIO>+gKRKZgDC-%R&&~ncHPv#+@=jS zG+|9zGag@AjOVO-($Q+;9tT=&+>?t|8~0p=RvY(>LaUAS-GTnjW7-tjwqswYOAZ}R z4ed+pigzA^-A3{&VAM#d?FVY%&6_0D$mBOFOeZYd@p& zu}@^OdVHELpKJAgSnIi3SbB$QQa^E?3U!!6$L*n7m)#St!2LAY`^L}ss%GfHn+pcJ zRMZkc(@}fWtFv6ei$a}7@Gs~a^%L}sY7Z>3HD7IOPS5xym=o%R&JNJqsXcH56rzJ4c>Uy+=MsbZuaW=C2HP`h;gc<&N*Ui8hr$YF`hG3Zk%NdMP%?_ zgJr5(0-p^Z7lm3f@rHel5e$a~g-wpBMbrn|)|{7M2pU8CWKerqN2;GJZOZ>iJpc)3 zn;JZEp;m)iJ>Zv6)YJx#(lFal5MJS8;T7iZE22YMIUUlT;FQGkQTwx<*tBzy$j!jC zgEj@c4jf(24!xGZ|MoT`+P?$kd)u)O-B67*OPbqbTMw@hb{?y5v2B7oE?{D#&e<;2 zAGEE13%**Sdad!U*1AGj3VkR|0xiFK$U4&`U_PwwPvda5&Df5L)!C#CA>&?!mS||N zxd}xJ{C{&446H(TV(*i)KC#_10%%5OH!w~ogRwVLov{-bsn&$#DFwf)$ zLz~ok+-x`!`llWBl&sImW_-9B`9P&=SDgQ>T~}_|S6kSXh`qXC6M|gTnX;{UW~KsP z2UK8DD54l5ei)mh!0?l9a(yc_R8@1R)nz!F^#iQ->bJl*a!djvTlGWrJ%PSxtW%_5 zVhL&HcI39GXp@l=(hCP8ZByR^w2gN`)64{`FFeaqipmEIdxjJ?L>=*8!#jNrv?tn4 z2a+r0=pYJYg@zn0*8HZ2qB{A3Uyg=RRneRvkOqcI=rHK-=LR#X6dC*&NL*Fi)K?&P zT78R}pBFHz?#bbT$v}(eP7Y7EgP))co7Mbj;k;=;=$;lXbf~$+Z74q#D`9sURztbz zQVV^~_gc^@FjIAFt1_-bpu4s=|P;JX z0h*F_#hQ}Znsd#emT#b+!b)rlmr$=R3w-&mGSF!)jzA*(B2ck)6@;utKV3M4bCDCs zCW4YKCp7wiwhqe?W4Z*()Rk&$o-M1bg=arO(TB+TK$jUZUeJO`+1Vsg{*{Wru8kd=Iri}?tuSB zY1h$-@QdJQA0*o?lL;I&oHd)Qze1G5Oz>nwxB_@G5(lWP=KHdjd9f#biyN)px6r;P=jM-=wPa z)#-5XSv$HHCmP$X>~uJkpRPWp-Z+|iH#vKns!~)FNO7^2LObjQ5Anf48y@qh?of*@ zSj}de3nJM@-I8%Jn;_2zI%E)5W)9?CvXZX0uB6_2E2)oOnnL1+4O7U%#bpXnpiEi5 z5Tz`KDnwbLi18K@FiAKPZrNh2j`cBTh%7!Qxx?KmNCpa$QGz6klZa73$U)q1w_WrL zTR_d#ZISb-j9jX=zL$T*QZ3h&9o_}c?yk@xe8B6XA@;_~J6Ezd-KxVV)Rld!td~UK z#bTTUu8TiHCHfL-kwR|4&Q+e~qeEC;XCxg4&&0LzG6`G_hi9PUs06yv6;n_#vKHif4>|%y4QV1qG9?b6##vaDH;-tTs7P8ccJIQVulG1fy@e>(=cUE-$iSHY%O3SALzmNd9;9UkdX3s5M(-FXgBWd zGxQq@!60o6@2rt}tDjUMuS>$Kl@27*b| zqCKIJ@j;wQn^&CY%0psS-AOTI6rRnciZe#PSASy^&v?>nDbJWO_=r6!Gm^mX^emO= z-+i3$?oQ#|$0H0pB7&|%2wtX(hd0bfFwuQyg1|gpV4f(EC~*+u7`Ug2p~o5tCYsqL zFi#YiCm~E0#!Tg83`u3C0s2qPZF53sD+Qt8AmSHX}=;P!9+7p7MQaH<|!QW zg^u@hQNETK2_~9(s=z!&V7>-n$l;b*FW&K2hORLZOf>T}f%zJNc{;-6;TheCyH92^ z^aDnM(OaJBI2CL2sd~vcV*5$g4(l-N;-LKXKIR#VpkiMuy>2<#8j(pXZ*x zgr&MHj$v5ry@%<$>v^u%v<*(V)7}zcJo#}9qtMo}IVR5yl0E`u&pT^QFrJ1uhGAN? zDJIX2h-Uz8O$X*Oo|ZUl~KQ9DEF&@8(VGs`r3$QXK&uoro!h|`0V>}O;7)GHz*B_Io zfa3`d4?n8F-yN}y@%(IJ7>#EvzI7>w=$5gtX?Bplj3f{P zy(=||KCdE9ug-h@tc&G!MLfgsJ*60>N+34kb=FO~Yn$R3hEFvIr7~mOq1>0wu~aMK z8HP_)!u5htx#4SBs{7&@hSzm&LD%I7y3Rv2KdjWH&4(Ui=tw-l5FPbVd~dUxxk6qZ zA+LD|Gacu(=joke8M-5$U`Sr4dd=%5A+LEtUh@&A0Oz%7d+B6`J{M0gB(HdLZ+YD; zG?1Fc1~rf7MK}^Pjw4Q)sNUx*;CVWuDE7~VS0XC%rcj8dUe5$FOD;wW;4SuJwH4q z&q7XbtXx&Flkxo1%rH#P_m9a_F6rZBmw!9tKE~50fnk`QkB`Z7D_5(J-ty7SjAwiT z!!SL6PKw2|h~r86Y{od<*GXU)rsq3j^7uHba?6xe0p0gXU>K(7kH+L#%#~-u$@e=L z&r=Bu!}R>SF?p77JlBn1SzfHFyU6{x)3XKO`M|oiH9*6fhN`+CTg0rla4V)BW z%+-ku!}rr=C>6mqp8W1SOZ8+T!)UUW#NKSkN^ab_a@owQ8P7+F48v=`<%0Gr6|~<9 zgjs{#c{cU&&S&T|i3Fp!miOXRe9f=qG|~@`HPo{b8j=`>f3H|%k@4@B`m1#<%EB;w z32THBt`$mHi!ks|0Hj&?C_0#_)B}5VkIzc7+H*FB! zbffU5=$=@4v8=6`uf4HjEkiFzCYb0tY!sNo0<(%R&*SetF}ql|1GOTVV4|7t5tvnh zxd~yu$NNnaEYeRMrTZ%HPY=-z!FN=2@JU(|2< zP}aMjNoE+nJbw_%bFWaI`w`|1+zy+boAeq(A5JD1(oc`~+E4!|fd6!O|4-fYo_IGg{K=R^B-YgSf<;Zr@#jXS@zWK3tNHdz@4?TwbN=EqZA%|9a4{8pjn zwuAz%4@YxF4dsUZ2P*Ou_8P@e5Vd3GSoG~DWDy|?}=-Kb|J zm}ut51m+!@KNK(ry-Svrm3x=nI$rV?WsmbB=SRsqJ*U`PzOdYjy&;(ZpC-h~s+N?E zk*@hyVb_w}APhr&m>wYgc+r&wX@DjZID*DCCJ<805a{&ywQL~JW~LhkKWT(4dEte4 zPv91C69$lFQM^reJMfY$f=^rm;vooN;do5qw?h)A;I&$QJKE0{a=7%XLH2tfUUYLa zv|aT@AQ2VZ1HJbNOQP_>&Qtghpvu!E+;eTU!nW?|E=H;0EF*({QwxA5K!~!yK6G(q zv-VF@7`7H2@=Nn^rhAX+Y$itL@U&ql^W1HS;WyvBy73YJ<^~wXibXN(lkgZu(HqPIR^DoLUY(XWJwagAJXWbu-m|g2KHAqi7nKU z*h&M*)q&DjHAY^WN9VReD|@c=C)Jmfg>3O{a~h?W2KW2w!a|YVDa@;rYvd@DG%eBk zs)3|>P#IHKn!yq(wW>!0yo`BDRohD`wpjiE)RVe@hc5ttLrdIU3vg9sen0n-a7_Za z=q+3|g*eHMDOgEz2#B!e-1qz5lLv_i8bbmmF(he7K)Y#*8*p-SxU21;qaE5=-DzjL z-JOmz3|hsNOCS+;RY0XE%E*qL2Cx|1mA9n-?|II-_vW#*owf@je)s!+-~W8i|M&j= z8#lL*PC?zcr9-kiHguyj6K>iD%1uklGbVXGL0=@~4oW1vvVs6;tLCv$TU_7X+4Q6u z(-ZSMgU+y9g0RX8PWnn?vNp%_R^xY+d0RUg+lg~^S2OM+$c+!i(Fr*X2Nw&*U6-^m z)YoAG-rGgHc4x;HRH3*okOzd3AJjq9%dKDG=GpLMYkNDce#Y{V(Mpz($vT!WiB&8i z%^H@FZUswda0hDSuwzX_O|7HWgX+4qbA7|c-i{_#q+-nLkUdUcM5-)yc{f)sOVvSs zkJ}ZD1*5d-R{$(P3Ch43)WKtt+Z~QYV?me1sLM!%vSn#lXHbedWJk;y@k%bL2Scb* z8MoQwF#}RK;0ekOmqXGplT}s_?lT&%B0Zj8ih2XFXjl$OHB_NunzG6YM2<$|EzOit ze^`!%9Wjsodz9UbMietf47nrGP}DtD#PalrPRSYZdBU;OFJgRICVb58@wfwiPioFk zjEo@XJoGKPqwFAsB36zqk3U1u>>3fD?X~)J_!$1Z00K5>%sbRiC0+Ls5S; zD0`tZ)P!N=x26#8liMrF6@w9(CDKQX8Y090Md#L-Hlt>d`s=0o{%5% z6>?}5Co1#`{N_pd^+V?tsJ2F2RGS5j0aF3Z>yi1#SrF=GC~uKP5FWHlE$=sL)0z^urbK7A3uJes4I_kYgH@qgU{FY5xgZh;r^mWYSregJ7e zmcLuvZ{HaA7mNyqBF__}k~#iQ?|nTgS#Eyz=1Zee-j>>O>!@TMKXZI|n6+g=vngc} zh%pmn&ZA~EHdnF^oZ{hxZ=ra6sB0pBZYi2SaMH*&o|f+uia@unBRiW zw?p#pSm-6@xC)3ogt$B;UtyltnBzMLwW84LL-Gygc@sMZu390`mcR39WZlhO{J>jQ zOv3Sn=(i~?Uy3bu(IU2(6?shQ`bs<^UO1LKb|~Ibth5w}E#q;2q1a-96pQB+`Abp0 zaqN(IOgwSyz`%J!yu}`u3wrk`%N3tliCL8TJmoK~@xEd!dY_Ir^P7tW<)m^mIhv)M zEgHN0VbQ0#pCis3({;q~X6oB*PrhqR>|65k(?5Jf87sPg$WxRPmyZ`6%l#NJUqD3D zHGmP~w>RiIl)O@vJyz`VQq9 zl>y25E9XDyP{3cj!19X#1thOH@QOI1oW)k;lDZti*Am+oVF-BByeVHRH^qzMHzZGx zg~Xl`3`rshC?Cog=~xAL=ncR!~b%{@_cO!=BcI9YT$_d{IUwKQ7~V%SYwh41BF zExLj#F&AaKkYy0nHm)y{q+Rn#6y;*>c+qA2b(HvGEgVX7&peUsknjbt1#IVBs72LY{>dMt0?;lt+)1l$jXRKIh`ENGOZ&Y z+`afja{Uq9Xpf0U#S^C5eFe&S20(ee3jvgq;t0vDm^8Wf6)NY{JSMhVG2~#k>CG1SujEED7(S7A1WB$fA+G4UJ$(%e8bw(lz$7=_&2k3c9V6S6Xfi*6VtKY!;+ z#QjKgk+RTqTG?tgjVnHjDH-=!6knd{K-`z7_^hTw@rCiN=D5$ganx5p_z|8th?Lnd z8)>Vtwwr5ZPgQ3L`LBBmHhzD(P*abo%CKgv-adU>!5dy;jptrv+#8gZX@A!gV9F@ z>(&l>ALV=|YlnR_>o(!vxrB(xdxyJ%2Dy?y=1mR7Ms;J|c+|3Gae> z&M_J9x5fKWbGC~6&u3HGsG|eFG2!=4i;tKNLup(yDz+C*hfRk+Jclj)+6HSMnCLs% z@EEpCbvxkec*V5eBycP8nO02Z8LXJl6`U6g)32CN zY1oZ3TjAItT_w}3n2@`ChAXCj0Nh^F|AQ5Ti>@G6-O>tzHi=tbKrlKg@wj-nUfds_ z7q2sG`Pt&NFIol;7@oO?O0n-EOq`HS^MXV_nkie+2&pt&fpOhFRA4oJVgv`W%y}q( z@2`|~KeEIduD~#2kAt%h5jHp6m;!o32VFQha-m+Pc?y|kEp%YiIsg+TL;emw%qs|q z5^ErYadx&bx)tB!Wh|L+}&*soX5gmn78hVe`zi=I7?=wI+IE@i=7ZK$c3nGntmV379$AQ)^B1 zRNoGmL)mKCP9|?H41iD0npz&Z)Yc0avqhaWPA0DfFi%ahZ-t(;{SYw6Qsrqb9cT%HHqkEhu$Lo^sa1I({xu>bZk zVE%0ydFWc$*MJ$!Q73GZ$$K9#r*o#3hj^050CSLDVV^yPJa3+Qm3uOIXd?bNV0!YV z&u>3qel(3d#N+l7U}CeU&+iL>`TN;Z%R2-A{WD;mpQE;)$>eY2n!xqRqsGf(_^FS7{q|H#pKV)QteNw%S ztJ4BSFpn;*iMh9V*tM84HxVOmB-F!0quj5ayB_DRHjeAzu72){bIH57>u+gs60X8K z1g-IP(nSo~od-;1U#Dy>8SzR6#b=WlO}v@fumFFf60=vq)b%9i#vN;8^uG1Twvb$1 z!#O)?G$mG0rAja;b=EcmGm9ZBJ}Yx_LlSPZV__2*hw=idm5C)W;#$Q+LzIAlm|kAU z3vB^*{TbhG=;MCdc?>qLlETQgs#_4WrS-Tq#*@5-8oNZwoGQ(aI&-xaXwexkDt>G@ zhrZOw#?ycb{Bb*FFCm6GiQo4q-wd%beLwaSDQ^xjx=Q>Ul-nm8vmX#YncOZ!RwV_w zcYS+n6Lv;An|s@PHw!hbf4ZKTZ7uDzdu9QRwzKSNp)78l1!D3))6=ub^6S zEg5l00?gQvWteJ3E~(;Xo3T~Kdw5~rqhpLBj3Kkg(MMl#0qtTi=U2v%5~`Q$#8ZrP zdnu@>(kf^-gO5qruYNT*tx^hpZ=ht7jj5r$5^T-A$Gmd1@0-O}c1-ktF9EBkYSSUD zo!PmF-L*<%pXKCgm4^6HWq2*FHZO03L{F8|r}d-@yRmB%-MAnIz6nmzb-9m>7gI8^}Moq@O1(RyZJkW(qS6V?CGD9S* zK>Za^txfoK@szPEVHLJO;axA+i zmnZhTU8ye_aYC1inZZ>h^X^u&8Wd`YtQsxA&A5WH6xc9-NgZ}=pxeOOV&BG#;BR=Z z{YT!&+2oEiW3psl&5ARR_FwM{UeW}G@m6ppLDubMpu=2Yj@^58NZ-w z>t(Gk98l2#-A+b2IU=Jd(fc&&)4aY_6Omy$CQb9qx9gvyI_d{P$1f?3AAGB+yGOHK z&z`C3zaCHXc`+@`jm^y|n4hF!nmW6l&YX*x9}UE4F5<86v#99T^hX1l)q0MepyFfO zYIP#8PqXUR$I8`F)ckmVPpKN~3(ejG@iR?IUYnuH z*ss-Ciw!DfI=Wv%!COv4UwP%YhBBwhpknlOkw1gO6hg0i55?TLwDW|D{yPK1q}KA> zG|AR9$%NqcW!h@Ldj8B)D*9&zhGA{&tu#9157K--)e|Idnu@~tjQ6@h zBA~esWMmkwX^p9m$n{jvQy-AsnU)@VT6zd|?it$iPhaeoRdlhDVNxaEohJD%EV;}m z(0lj2>+vfZ{PqSEPS=L+O^qEJ&|Q4^h2Gd~>TJgD)=lWHJ8^cj_Ov#(!%9Van-Kyu zw;ZWb=Fyus=tVcTZfR{MxJ|w7J*{2sPm@pfuJ7q?Y$70t+|bpzbwjuIkpRE48Fjj2 zv54%J=#q*&XGwVz;c-L)u`popQcDBDxz!3>9(A}qE~n2S(Y2WV5`5GV^2D4mzl2t3 z7**U>Jo@O5u0!9Jz)70~Xl=Pwa56w#554UFA53dAVY?^b2Z4j^qFrQe| zu|Lyy(JD`z;XZsb;CiOnH%BHD`q6#aoT<+z(8~PnoSA+16yVNJv%fw9`TQ0zZ{4A8 zQDpiq+G+aZc{BU&D!_&3{lV``)2@8$`_hY^^*?)gwgK^yad)=r&dV_vx!Yi`-A?Zt8y zy%l^_ytHEi-OuaIdIztGM-#GP$b#3jy_XjsNQ4C=-IG44j3RqE|Dgx$*x$cs$hKs} zyg)!U6Kx9sHDVYzWB^zqAZU;)$NEknSepcZ#P;G{W@LB+`N-fQ^5Ru?6+etp`N6=M zSwrTzgWFdfHKT;ReEBA_$}=Gi<=r*7b5%ZI`aVqTDlRZHGiPlQh?md%@Te36#bGm-EVFEn52W230ESqo_cP%lH*_usQ zV_>*09=d~vBJ&}4Viz(HWydab*OD9~oG`GRb3Uw8VGfpsRyOgSB~-E7hgaH4|C76? z0gI~IcFvq(W@JWZz$r*6M;TN3NpMh6ED#2SBpL=7(p1tbrTB*eW%rU{2NFC?uOGVg z-o1SeBm%bnZ@VAdNe5ox0%VrT_J&nk7fQwmGNNo^wyO^~^rkNGeBO?LcY zJ|Sa9kPMTRI635u#2@@KOx{eveis7fWBNd4X1fVOTkZvg2Wd#ELn(cm?SBN<(Z5C6BlTU%07?M<5Pdi(dS(4B_ z48}pewYo3bZ{9ty;^+wJ;e1)77w@(hxOmgAse_e|qX|rVov5M7?sOrns5IRt#jn2! z-QGZ2`eYIyqa|2$V{tlr$!Uj7-)W+lJ4wWA;s-!>NyU+nV-V+`oZ`3sv+){&z;6as zIgzzqE!^Qmy)+${9;SU?rP{f-XuJ1(dOz|c3W&R?xjNmvu%zgQR5L`#j-)IQ7R)L1 z)YJjq79bS&y)B+3*WuIT76LJO8G2V(5D3crbn?ctx*cULkPOdeNrG32B>i2G=Q9H_ zL3qRC7igLEu#D5~aI%%T@C z#1RAv`Q-M+15I*>)KY-j(;B#A@ax%c6wMmAXT}(s?$=;Bv&zXIegj`NAC&W{87b(p zIgfKYqx)tEE}J8e&NkJsI~}L9J&&_Bdl&@Hqu?8);F%O0BL&A|urcvcuynSDri+MM z;n2E`Sp$y)4cq8H><`s&)1WCE{TKBwYGL|Dhadc330#I}hZ--749_ODuq=0~$x|X1 z@Uf9I{LVwSXOIlP0yr?kuK*6r@XG-B+u%#`Nrc~$$cFq@MDVFU7lHGb%ckB++RO0N zM&Kop;aL_TEJ;a3m`n1%ob=ex1o7_il9Zrnn2XEMt(N4Hq@%>sSBX4Psl_DBh#!DC zdC}un;d5og3Kn$LmAlfWJK>6(P7??Mjyq5@rru)2J17>j$!4FH8m>MwLYT4N-~#(` zewif&+^_KBCKW@1%rxJ*v{05g7EnWC4}30T?SAk7K6GD+4?4Ekuj&XZpo(?)!QW(q zqk3j!R6AIFjAW=bv0zbvFuC;V;u2|18B4N&XY7Y7%Fr6)^?LDOO#ZtiSsaYXf7e~b z3cEy2P{=Sp63+7A5p6!*dwanDxXvRYW!X6 z*T3G*4VdZ{!`(rqgD#F@&TWDhcbufz3}AmPcwT5eRVJrPl^~r^JtWLcg2lfbajukw z;(_mI#jFUL-sSFz?y1ob5!(8G#04?=@b-PczDPca7E^u+)TB3I*fPp%)lyz-7yY_^ ziGC(^D8$d7V+!%}=f5ewAzGS1GhpKExe752J1L!|r9oPP47&mcs3bx!wPGKIeL_p$ zE5%X4%|KulT3X18bWgJ)f7nlJC#gjKFh?cAHmF2=zoxK9DeO-a_AV`bN^1uw%ostX z6A>iik4fR6uqs;G5h0GxtQKMEv}C8HHMG<~OHZkZP!4g%8WFabmey*-`EIAM7d7I1 z;qeoG__RhG{dcsTPD@uvE7n>mY$+}MMl0fbLMw9Bd$i)`Z6JS*K6C;ZY>@Tglx>Q5 zqo|MmJL}+ODQ<5N<*AA6tG;$Bsh%E}t`~Kh6mpBGU7`>O+ijr`sic$W*Y6YL(oH*m z`zL8QPO*)shkiz;b$&wz**~IQJVK@`QpvPXM0XAc5rkzEGTcsI>*KUd@I;3=IJ6AX zCxZ;gAgoM7X$YmElsqq@%lCK45)}>CFupbfmcj(K%3;C}5G~irt4GkvHwcO9_H2)9 zkpuyjq|;?X=&FgHK2@mgU3%@CzIknAq8RA zyg8^=Ud)tS-kA4*Z-iZbT6yVs#>vK`myL&L+~HmTx&P{@E0Tny5lXR*xLZuhk*p1f zR(_ID`^2wX{za0MLFsD~N-J-`BfK5;$OK_c1yIP!OwG(BqMHg5Tq!GSUe-LJ1&swX zYO{0_;&A0%Bez;rS(2aX$VtO3aQMnql@&NTQw?cSQJs#1NRATZ5<_d&t*wSopu(RU z(Q1=FQGXh4RT7F-;!YGQ>Z70?P01;;7iBNZ&&d*0us<&nrvK!q$~8MHJ3l{vao(-j zzK~jY?J`rzf@RJI$yw&?x*8JDFUOvpC0Pj^c#bSKSy>wJ=hm$JqQauwyzC+$<^mdN zEIo5JdQoMjr9zb0^_4XCm)}#81X2~T+OuxSx98kkR1gd)j5Zk7$PKG!|1AA$nl(k@ z-D<%4*BxVh$=rkKU)P7Jf4vec9+1D<4JY+$km+Bu+<|&LU_RVodaa&A?FK@4!2%Pd zRE3A{M%3<>5c*v3fhZ3X-)~X7KZL;7g-6-X9?Ek55(hrNTfGpjh~YXxt}6sBI)T7Aq|phkhiP&CR0qK(#M34H zxr%x#aNpQKsmghju3C%f9iV8~y##P?#<)GIoy8dUQ3S@gk8&3YZoXQ@+qHbYo>%av z;y>euFQ14X)cwffATO>)&DQ6tPI%lJwllt)A3$|OxGvV!YHTdv&D1Jz?J>X7EJGDL;VkO zdeafTgw7p{g3(LD^v36vwH<;ylc z7`+9U-hbTg^~&d$h3B{T#IhFo{A`%sl&FW-$?4@IdXH^>@(QKLpFw?bd?9w3rI7D& zwT*u$=iWb%8J@a)6vE%ccgLUCeHuT+ueaFQPhGEBCu?6TATvD~{~38sXgrOYRa39) zhcGAc!w^oVQ(QMhGwVOI+#b&uL=(n2K>KB(85S>HalNN~9HIx~97LiaZCxX%&@p_h+c`wrj*mWf~al(YFBqKY8FJR>&K&CV_Jj~ z9c4PE_SFYxCkyi;^l)7vqIO&}w%!uBOvB$m-MlTJ|uFteIS3bLZOfRD6ix=ed z;t;)oXD|K~j9v<&cT&0Ou3+?Rh}zD=1eY*B>yULA@ApPc_Piml$E|`@v<_PbU~I0p z4BPuR@9^x`u><^v)x!j7Ju4y}c7Bh7pIv7bB#bbk142!F?t z+baX{!=8Keef>Wn{D7T3EZ|>&@Zb0SMK7SnGz9!`!+x~9u_+LL8p40;w&yqbsK>TqC|DGc!6432( z8$XHdzI>Qa>9n@9HcNWTBv+&Mk)sdxdb)J%BD9rT7O5cSR;MK97TA_>`)nN|zZZqy z$Hb#-g6K*Ih8uj5k@sMqI?p-Qr5|*eu3#Sf^UREcEk(u}6_;mX_zyij*D^(>J-|{Y zc4z!pZv%6O5{Ju{5-Zr=6vYajXuVuVCb!R+appcSjf!;@UgHr|FCAIjJ{9+FR>qn7 zFRkugrL_;RBwi_J&jX?|>e7P)QTg08OR2r>NovwOfv(Rr2((+}TWSF#Qd1 zuG|vw24q)D^br3|GQldXL^tKiQ*!%aUAHoOfgkQ=MS7vw9q{t2SYdsi`bDY)5uO^m z3K1FXdg{P>FD>mATrEwMiDt3bfc!o6?=P^Fe2%d+HwzXGy}m@?5i9HqZMK4d?06pz>%{hmMf~?Vb&z9bCe1hS3gm3Ll5j4kWY#VYCBf-qo7W?cl`<9 zgh=q(?A%2KMI&G*b)oQ+Rv{?JcvWxsKR2O&nQ61<%uSy+KV!j-=&xb)Pr)czRfJlj z9TTb3j~!<)Mn#V|U3GO#>@}ph;s6&qzp2O1@!cO6n{tt{zG3 zN*n-G0&k?o$8Q2I>4lfI8e0*YaH&mD461Qn%5k{#duj{*H2r$u+P&P6>YhTc<#8Ob zLNqhdc0gnng@Xe0a)5J$GLJ88YOsW@)jM1TL1zWynTtmfP2<^sTZ5Gbe@exrEFn06 zNl{2`dmtu761DtE#IW@=K2Eh@`>e*+Kyz>jzSB~0sa|l(Q`1+l^e4d=&WBgq{ev{E z=olk7c$qMtc_aPKiVX;MvjAf$b6VZjBi4Rv-#nYeSpE*YJ`E2w)3`J6k!RSgpTV8I zeC!_Ol!>YOjzRNRc zY}QZU+8NHvY}3KtTJdk?Hg&TKifB0f+`CN1dW)(4fu{btr@{8IVnvJ5>R#TFEWA+F zI5bTzF6GnJ4X}<`wX&viPMX9t=FjvS&maj{v;CV!rPTJkL5Xe8Tb1Cc#J%UW_BDB( z{9nal|!iV2&z1$qZ+jw?p% zSTRaRr~_5Ru+h+JME3|nGB~z2qG2$yE&?_0y$EK^Xf4}d^(VNtsGNyi#de96U=vt5 zViRd1yaAsum!09g5>GEM#W$5ZL=i`$1(dXQ>`Fl-9c>nPJm8^`B;qzV_0_KT;l*xJ zwMu_CDMZT%Ze=9$ij-a?AnD6t+Yxb#D-DhOQ@W> ziX>8}oh39n8M(3{@O3GM-9<0&4HWhiLk^os@hU@Nl$aDp84^j~r1+Yaz*Mmqmm-y7 zJFqMvwK=p@PD^W*VvmQEB%+Z?@uZSO_A)76QIf#fCPk-G9P<$+u_{w5PAJ70_0d`_ zE0%=Iq--NiTxYIcSyOY*rY)<@BzIJ#*k)rTs$A)-MxXBH+BIuy%=X+{B-amoG3>&e z?o@pJ+$@Uzh=9{lZuLT{0&5?ydKBNn!4;Y zK4(A@UMxihxenx%X=VI-Qq$rn7)8A$wl~(bNM(1H@ROtm`8#5mZ{$0;bBfwY+&QLp zJo>LL&U$2Csl{S=ydAv;dZXXO(nuYc(kpsZIGAItB?Y~Y%=~^b?r)p=A+1I2MBYG- zOF0cyh+`e$x4r5q+_uZLnZcsXol%^JX*`0~;Sk#+bt#4QOKiuHl&;#Dt5`6$R<$6q zE|R+dPNhx#_xJKK4ha>QAEJbozIJL;f9+)Sno1FU7wpb58XwA3A&$gmq2;RuIVXve zM-E9cm7blEVSsiREXZ~WM~ z7AjCBOky>ea=CAYwHC8e426nLjkDM;xQL>eO^2=8a*ql%N)v}4MmUiu^wXaq+xz(syTEei;Ide7e=;XfFLg#W=XOp;@Snpb|O-sLl6l$s>_ z8$YW2dZixQ-0tf&Ptx1J7m@H!5Jhf=FD^>VP9-6~{Cg3ZzeT7|n|Z-CaEFA&Uh zS2Q5~)Ua?_iwJ69D zAge0xTD!3ZKTiQtxp6fZoXkcfVvK`5>HpPjOHgU+p_*mEnHR^hWeI2qJX$Vu3Zc3SW!W<3@_A&t1aK@s zMz#yGNO>JJ=O^zxB#KZyg9)YvJY$8F#)MGv4vXa6kBF4HoC%?Z&>>)gI1T{=H5fsm z{-Ak-GeY$PCd46NsO}L(DL3}6mfnqU&s!#h8VFO38GWOGIfjS_hDa!eNIZ%N@{A`` z1ei;J2*;vw$f0Dgg|^!k2P{XpIg1&g1|qhM89iU@WX2Wm;tUJ`5ACd0jVl0vLrc_M zeRNbsmVcc*LYwrYgEWvpfCf4e1SCll1cIhJouorPNGBm3F_Jb39g-LlOu8XxNWeC; zG|zT9t7rV0;~r;5_w1~?I)j75dPqW$kWu_X9TnXXhaGVkkW~@bVJ2I*>Q%k>`s=lL z<`3hMyuA9=t*Tq~>f_#9_o})?BaX{ps{$O)cse;nLcbd?IWAN3IZfg8@2RhZ8mZ2w z;w6l-r8AZD*pGM1%;zWZ5+?s%LLH!`GuRN;l%t;WnETz1&t&Tv}wcmRkyo%JNr%BpPhgtwlBYt8#Kz%3pWx&@; z6zUansl+P@5#SpLx%QyAP{A%ixEj5lR@t2h{G_;wLW>f83SxO@@V$%*%i78UTWLXo zEzA`Pk|p>~hIz2mmu#v4JSa0NHna- zUNWMIq&0mFVNR;tPyu@XgD^>x)agBfF#k5`2XMpU`$c-DL*m+1sk{I3vBKNV2O!fE zeroy#)=c496CD4Y!hZaB9rkVZEEY^SsI#+jQ*XPdK@(mvfm^J)z{92^kWCbkp*(O_ za#GPvmU;NBR&-{zZ`Xbv-1w~6<>6cJz)>|VeP?ANcnc!-0vGJ542CI4(oMCZvzP{NEZa@Em*q2))_2tVU zeW{DNFMk@;mxgG4c{xm9o{rR)W$dYu_25=TU(R5CIi2<8bk>*CSYOUyeL0==<#g7U z(<1ccDp_9|{=qh{vBZdlIzih#uU`FAG)MW#Ay>{*x#%ZAj*~mnr>CA3-1l(<9lJAq z+OAWUg%3;UDu$soyd$Jtn?v68M3gc_a+DA52wX5_yS8k~4ZqF#j$0K>tf#dxTm33A z-g$MowzTz-O@!L+VMUfXE72T#X_4LT!>B5-e z?BcS9!`1H_M30Zb<}?{$Zn!SUMl=k)!t10MjnU{qe8z1t*s$(Jn8#JnBjLX!IT3+)TUfP>F$Us7!2 z^d|`SjLQ9Q2(kA9!mQH;*)oTjU*6KiR_?n9cUt!YICYeXr;fsFI&}msCD(rV5N#%4 zW8>|18#}u^MkYp(%(ICFNh|!O3QVnE<2%BSS$TLlX2sKpFfy9J9AeQKUw)%Ih2D|I zm#VaR#e9ESUEpQtVIiT8MNaeg^Zo=^1NKongArTAhV>*ShYqs4gBsz*fY{y5j%aO{ z&Ms@$IEj+k{H@%)!<*26!!p&@wa2xK78W&BQ%!z%n3lAoje3p0h+6j;g<7=Pe{=C0 zRq^k)YsfY@{sLTSyR?%Z93J?zM&<=}V?#aO2a_0kdUglvM$zuTfNc*mh`%gO?xB~Y zxikrT1o3YYo&Kw|fEyS{fYo8p#v6mL|7Z(uoRe zALhDdG)}x!PmC~Evm=`!m;t!Gu$8a+#jlt+-jB z80*4Mb4B$qaY#+fdTwPbDP$~J&(Uae&CEUq^0l$as1-jAu+%-`;mv^kz7gA+jGjcc z2f&I_j$8m~`3E1pg&2%csL{s0p4};tj8UkW6R(&FN)>NH4OV#BS}6TEl?E#zM`n|l zYvy0uyJ##oZwroy!;Z|+BVENFH*S%Lx%$>!3ncVrhQVb;RZ_+t-7Qtbe0$9CyoA1+ zVbqNY5;=AMZ%NGf18R1>;l*D|=zAH4l-1nP)#H{6Jy7Y5n-qeP7LU85L;0r1?Y>L- zrfaLalZ&8YC#En|Pd@9VL$Y;bP(R4t0^Hy zEmI;~>kW-RM?G3TAID#n&^Ly}pIfEyuXt^duAcKy@y=T7sKWSt>t&uRw@tm&sDo+>oz9Qv1q>(VnT*M%QipZKZe6y76Lyd$X z@2+Ub93MJX=WyX;-O0H@%rBl4=Yqq}ebgo!0dW*V=AV`hZ%?cITXwbeG7V%%9#k zPG%NS=_n~Hx2-Fa)Y9UyHa{1gYx8p@{W#UFx4L^>ZJnFkz2vb4&f2YE384YFj>w>XQn`EGApx7*g$34_E6>S@C2B z9Gm3s6NEdLtS<4tlq}uMk5n!QQErX#_I@kE^{U+7hr{H32s5fuE*w8k#aQla^v}|i z=;eao=jN2y`mGE7GoV86AvjkeO!}1Q8VQ()JEo{hgrTXOG2mb~w{uEteDNdPV^gBH z<6qJLKS!8?>!p)ZB)+sG%sndJ3d|_seuOzNRoWLuqIVbC$lYs*P7lt)gNE4p?L5N$ zU4}7jbXs(JAfGvpFt^Q=`jAYnQ&E4Fb3 z7X4Gwqn8WSnuRdA>FS!>e1xe~p$DS34G8mKy88F_Glcn-3cWv||6f6vCuXbj`8dLS zGCMjwI6Z%kFu$LpKL1T1jDBu(dSAhb3}KRtLGwWvdUk}VGe)Ne`;tb4`P`_^zrP|( z(!A*Oz`Sc3!t~5jr}s|?^N0$)r$Ka$FvauL>D`Vn?enA41LHam!te{!>7^n}=7Q+- z_Mn6uggIym(%^@oXUO0lv+Y&TSFO5zQOvq*+jQ%ER-xJY062iQ6 zllu2IgfK5IldjoCqBkvz<1(_M)7yv=mLbdo*;2kp^p@nHeQJ)1#RA&k79)%^SGuMY ziC*Rkv`<|To!(LKIDjzPmC|*bNc7^+x#;>;KL8E>_jAG|9U-q>c@O$)p+vj;$}ejt z20RJA5skk@J4z3Ha>ct=(v|!AwHl8y7$^QcR;&dw4fs~~^>`7O!fZ0rm?dUYn`^7P zdrM=dyVJAU*zIoVF>Y_{!G;6biR^GF*R}shDtmW7E+azm8mze2bJSIlffb)FFMg9- zRsq6BRt1)ls4y9zRhdDwz2zpYVAbA&tCHgzo){eVTeSn3n4J#ZKgDNRqw!f*PWVgs z9YJABv5s|_s8lDu0rX6v&8i3zqSeO6W>4ETHxa-Xx1&lKJKdWb;hk}*aZ{JKsl&Y# zkekF-Jr=i{Bg^cLtUp97rC+=`CXxUW2$+Bh2y7^nIa$Sa?VI z!SR7FTNd^5^~6>E${Ak0BA9@@YDU`{yhQT#n+3f+Kisn z#>}3!d)&s1O^d`oJG~tpqAk`#jMqe$v4olfqyTqPoOONkIE@GH&l@Mft{D6N8+y+-rpdd~_q%%b z#kv|cqTx3(F*uGs+ks4MfKbKzQ+!r5{H$pBS;G&%sT{q|A7BIVUs#(TX9JO*l*tZ} z_V=He4Xh)YS?XOZbtlVvA4}cKQeR5uYQZ&&d0FdrJ2Vm~{S(W}Ka8>s<|_^)8V}y$che(hyPwBC52D z6Pi6C??V5A_~E>x198Gpp;Fi4wdHSZ@rTh^;e~45$mL19Pa%4{1jBthCav|2 ze`*~Z$F1(yVRt_9!$AJZg2SU!JR{$Q+$mqle0_Vba$ch_0b{VmcSX~0K%ae!A19)L zhtoZujZ(Rc{KqX4a`1U?_w$fvl@4fX6G~vM057y3&OGZi}YJ8M3o%&@Oj5}E)ynS z+GJW{J{LcVT{@);Q{N+xQ{NMyjlAF+;~|XBd5!Rq_f-hL>gzD2^2Ehox<7p{utNVp z`^3ZqqPqso$*9bgzBeZ#O#Hs$H5yI-%1BdlA!1|1XmEA|KNK{{9uog4d1I$?XX z4LgpV=yz(-!WzDdD`8(yx5j5ji>p0+7u#2&fjiY9PtlT;?fl@ko&{{Vaq5IQ)k@cz zgC~Wry??5&la_0|F`CIN2lb*s1#PaAt+VwkwOMi3tRJU(S?W%f`iN*OM7(^Fr{~xc z+VL~h>T08>)!pqz`~7a%a~i#!iaow)_I7~HjD+p?kii1Bqj)+cOeoQT8%F<>`q3oT zrBvK0?ppD0pOhQ#>-0m#ylADoPA6Q3KZQCSSytJS3ExWnXbK|?%aNZIk;{r8>a0EV z2#VZl%nEho? zO+k5w1ItrqoxF51@4~EiE`8+BPWlMqSe(;%KlZ0VKxleCgYWq}p3&$Op;at2^C9rO z%2JcT*5NGn^cWj8PqK0GjN%je16wzB_``n?v#JWZBL&u)9v*mQMC(h6`5dWS4f?ip z!c1XwaRNF3kw9+0tqI2#AJ6+>*11ccQt~V0v(&em! zF7VEY&bkewsf=U)&N%iwLSU4!S`!kH?QreOpL2pNt=wdcvOo zJ{phmd4Cf=>N^fpUH&)KE5?Mb;S{<1ES2+U950Wa2>@bg4f%my8>euf} zjXyyc@q;J8*SzEUp;{iD@O^#zu5u0a-gyv>=0Fh{cm_Q1ig-j?KXgoNmrHncBeZP+ zYsYHw7;0dufjHTDBN`w)0Fk9LAz-<%#h0eh8OuEJg_{9N!cR=@8gXjnO|7*Mc z=%}hYKX2YdB19*Up~jM8$__S|fPo2xG_e_(nGE^;izMxlW)@9?frMZ(;l~o7IE^|y zrhK^M_x9X9ih=BkJvMp}ZmHMNKXIBqw7DZ|$dLr5H_x^fs=Fa5JIlKD@ zoXNYN_r3Ss`@P@${eJIzpF1<0uDuyLXA7OTg~pVDH~KCR)bGf<(Dii&BL}hD^+Gr6 zq5^{!VTEaM{Df{tu|1B6PX+f^Rfn3IkB(c}=O5TUsEb%r*OyI<%C-^n0t0XK=eh78 zo=p3Jyy@UAM$-Ot%`Da_w*-VQKo94L{b+9bOPqUnQ z)&=oB>!iHn;>76~(|hwUb^`w*)W0vTfwvEi5{tzUXs)siqgF3Q?Ex{(RpCFU3jaA> z_|GMx)GJCWqY@SOu{U{D%XMVzUm#=erYxf!4Mk@4Gxt>$A8fq4omT5%u$oaU^#Srl=P~XB6$! zu8%M{cO98=bObIFCmb`e=?aY&3)WfIS(!yshcnKEeU{KMC3M18v>M!`Q~kdnz7|H0 z7#zYHucQ*jVAM*e+#Q@oQp7O)uyB%t$&TTi$qWsrMm&>6Bjg$3cKaSYasVS1==hWXlIlHq2o-MCn=x&;b;XqEGZCAun!rmOkM+ZJ#cQ?2V02iR&(zP?{$vNM4zXwQGm2_7+aH+5!lkAp+1L(XRdA(u6zNOqgxoU4Nw|roDlR{ zF@zYk7-8f>IsD6xK*Kdp8gnO53-D|6}W>?7~DO9mb-5{bYn3dWij>x z``|VkKCCvRc@IvAgvm*e1{cO%lg;YMri?ReE?~RDSU*Uy|DlT7t{-Dv-d*FMwQxCD zZvU4cE)?5rD5LV=IEv3bE$CG);^kA?s)Jv^yu6fg5@lU(bru(m_RQF9D;nOE0#10b zLb{;RSv>HX{bwJOEe|$9u7dS6>`RTTa^}<mr+jQ8$|;B5v?f$MN-G6Mg_HocKI z_0OS`lkJKJ$EIEJ*~aGZ`*SO)e5hsw1h5}es7JH zMpF*UPpv!|{-l-H_O+Epr_g4VOMX!0c6GnX?doGHx2t~?rK6(s9Z@=_@+Y5A`BUNn z_P-{-GHtvx*Tzfv%NeO8`lAc|h+#|0L2?z<#QHVs<`0yNd3URwXq>Xb!9!`76w}Vd zOHDO4HL%PWo94Kr2M;+-(r8+5DpoHNC+A3G8lw^?n)eX;mrndH+EN=?b@gPuc7hA5 zZ4mXPLw%Wv>I?9^9XRsygjN)ZWS!e$WVoVz-7NHDy})f0xGe&w3C(+4By5~A*2G7tk>?UK2aW{#?dwo)coSi17-r49 zMf6#f=-aiTZ+pd;`}eS^AuAQ*(nR!}Rj}4KE*prVTDtma6F(RGie@M5hYUt5Cb zOPI_GPrhd1oq3?b4Wj^~$p?Xa8wEXB^r<$!qZ{1kLE3`d+YiIzKKH?*d>fetU4qjIaUq}47j(BWg+|N@&9#{^x#a#{p;q?VSx$Vc~ z03*7|Rw#zHP7G~_m?9g*6xk%ENLcukj|c_%R}rZEMO?cqq)Z4YHsQE>g+qG{e)L@myUX-MN>r+siU4zjlDdE;K+zu5=wfZOPP-{+yzlQ3zsh!SZhFtnll zaU~lcW$2HsC=+I;*RNBbqN$7fT94XH5QG}}w@QwI(BuEqLdGI2a{Cyx3}(YAvA2cWiEZlawa z3yPVzMM9iYtH4YIpNO7BsR*au7URv>7W1340?bIS5c79Cn-Q$bh?t%5NiQlmt%cn$R1|c|$`0}_PRuEG^zDlj zf>_5k0GoI`0FGExDB)wu(`Zq)QB7W-P-J3}=xG8M6)j?j? ztQX81bnRKj94-f8-k_zcqgEz*ZI`$fX8PeEZXzvxUX=c)*i1MtR-w;zcTb!Mh7_6q zKz8)WjuWr{caBWv$rwD=+}_<2OrC+^swl3K1jbbLF^Xd<}^!DukKj7KmFV*gwy=78Ij~aM3)TEA?H%g}57Z0*A z$hhJ7B^~`A0u%eBGpArYxM0ySs8M~vJEGVgh?XdcxJoEL2LGV7?a{gA1|3s$O!QqD zQ4AivzZy0iVzg4xG0{EmkoqTG>L1E|@hF=+pFH&R_jL4Tg=5U=YQH7bHCw8Sa$n%< zllX-DXQs95=(`n;iItowNxn{!Ot~-kTagpK(zkW={R+p#O8&Ma`Fcq*<-VwAR`2ms zUk7#cBZB+F{GgF6sjfLvU6lKxi&>dtm)r$xRvP4fht?%?6B)FHa$oR|BwbI<*l0Mm zN6|56hmm|I!C@r)#m1RW?ccAX-&Z&$cAh3WXv8Ra9>MU}8!IawtJTpL6^@CO{CAS% zd6Hx&!SMGTOBx-Fttb%e>F5%eSjqDx$xcZ!S%Vb*iezESNB0}JsH_|lEBSkpB*Jqx=E@l zk6`}5R)uH3>$sq!bFCbcfRoCg&kKp1MVzPRS09uaj;6EfnCKQRl3JK2weV&OKfaDI zbd8QbX0U!%j){Htd`a@nlH|n%vy>@-g^GpraqQ zatyI`X#TqTI^*}xa;dImQeB0@Uq!*c{KqSuI{IlV$7HkZ@0SvC=KMgat5B+|h+tY+ zU7wb}wM0iBw{lGE%q^BA7fF%{_muJ^lbl{ssp#l`w{lEun|~-tzD1H;LNI%ol_YxzCWT?1ee(Ex9nDFn zJW`vzl4Or0*+($A^^Kl=_0VTq4gRIdF|lnfl_dKl$^I$YJXhtI*fy_}B>N@FWps^W z+e2SGvh;Nwy+Gv{?wuASJW{S)s;f+@tAb$0ng4xT^Lj)7{7~hXSjm-=5_VpQr$|I-s^ z`*d`-$}zERu9qa&Ns=1~2BUiPZgV=T_vq;DD#yf1UL{FxAd>f}bUhHCa~fE_N7@1$g0BctE?`o@wuZBD2;uRX^^*3&{BD; z+~t0+cV%sPrJKc|c#H9SPq+~UEhS%kLK85t5$NeyduK4vduK;`kUk#9_lfzj;;>iM zy8Rxn$M0QP&FHHLW0t23zi_1dVXg3Ac?`o=mAl$kQ&r)s@kZZ;A3_@8*rv8ENPH$@ z>p)j`D@%iPZCumS1`a@XPaFBG*KmYhZFQ+{rMIliO}wypqmeHvY46z33L(K3tctU* z;m_MUf`N|SK=+0=)?K7(s1!NW0*7z&RYTU+h zY#4bxABU$$^w`qA4JC!`&@?0t3wDD@`pBK6E%2+i@AhC13@@uZ7~7g)ptWOD2c8xe zSOb09x~Zp&Jws<(yK%%jxi`D<&#l3g+ks-jl^`FsIcWk2N zZ9y?~x3B5xX$ulgwl-{3U$8CE+X?psHbeIlR=W-a2R3#?uSEZ~#ImM$!{WGSo+aWs zTef)lQo(grN4UgA7P9h&B<%*^`c1gHkRSaXz+Aq;Tu)t4xyOX7YabL;0p^46nsX7Y zmp7ILty;B!Rus^XJ9f@?A;bFn;V$61OV}9L}$MlEC3|zb6SCj@z%3l=pNJICO7bNdiaC z_)P+bX79ZuaA@|vOae!a-Xug!{{x5P?kamY0DwbF)LjdBRK>kNXLqv+OUwod5P7-k ziUAP=$wC6D*;h6jl5CcQBq+kVkWE+!2_(BfYLwJv)y-jPYkkySuTr$PULVz3Z@^2% zU{Ju@s#mM%=U1Ptq7jO>RvuPz=RY%N=A1nV^XttT zg&xFfAB7&QMX#JWy87`Wq_=bCKLO|1ce|@tp2~fD#<5wqdT%{>fhg)tW7*v@`05@r zJK14MnaXA1QwM782_tHgt5+pcuc3Hb|CTYa{i3ntuNJT#oJ1!O$;9YVYlftQBa<2CzRaRURe-^Y9U2M@z)4jC z?+grBsD6%$%Szm151x@TQrP9#by#loaVA#sI#14B2XsUQbX^ z=85=M-4{2ov(O1q8sDHlB7=4hWQzsTiz@@mF$vCO#ws(5fbZxQSdQulhhE5FBx!J< zG#}1y7xi3|4>Vwqz{n)k@ufW{hlYk$#t!7eLB*1~M#{jEtg`09HAcBIImaouKG>fG zOmRb^+q#V6OOQ$-TpgV6Z%ABky@6Vt9S2xkzIg`>&*JZxcPxaz{pKC>(BFDwB%fT7 zq_FJ=+m*1RG)z%sb#B z=J+x54mh$634sIikdXTbkjLsrU)|e)Umb9U00O|MWqW;NE%I6h-*0In92@llpt=== zUca=>3JVu9y1G%m8+kiUgO@;L>J|6PHOS}`D+hKl=9oemCNy6T6l(*GA_0IdlDnxehYd+srk{TyS9txgTqdD3h~oVXm8*Ya4U* zGS{8Vbw6`G%v|(}!li4%ot7}6KMGnl1zW>S7Dt_L&Rh%J!eC-^d3^4No+`^H)io>j zxfMRu>_+KSZ%#4r-y9n1IWsAdWsU=%N1gO0g>;(xmKKYcsKsryp#Ojv%?79*ASU7H zEx^hEpa95XbDyC&Y3NCAbDsESXef4S9t7H&9_w$yIMY6Nu@3C%iOye;4nDk#0d_3cwM3bas5gky3;LG_Rsf&P<*ZsirfNSA(3z!3sT2smTTG{u zOz36dHA{+h(JY{bG%4DpNvd|~64l}v*$4yb8tIEh=`G19ok7h~ezXWRNYa}LBQ_K7 z@6JoQa{balImz+<=)~B7rA{R=0LMsRCFV3Cp!La&Y@~#-1C$Iy)kW?OB^T?}p;wV~ z1@E9_7^6OvjC$J0N=M_zx);R0(Kkf%aGz09pWG-W=0zv>8m=iZBz@2;WWje@xdLTD zAYocQAkJF3A^;$C@*Dq}pvn$Dh#;k?l9ZycP=qpQ5rXnFK4R)QlM_knIWsXjADM^N zdMs_NlOB=6G0ITL2K_5CYPcR6>lY0Z1=3)z7|3IB7qAA~scNv7F`5EXw!G7WfgzZp z5Pc!kcbtyBJOp1!K2mRv!^tK1Vsa0H+Oq8zBbiJyAnB3*Tyq?7+eyEe7~gAHh`L-; z?0MAX9!iWKoPqk>WG(V|26wm@ORq|Lb6;W6{ttjgK>u>=Gclo$4#p3gw?8M_%Qwg2 z_NURuM&f9fk5v0NYR z;4+jWO);ZL0z|J>c~s)uqbJ63XWf8mwTw>%IX@sQxw={Z(92v8Qg%7Q6hm_C2|<~6hv>9WqK^HrjHVcOP2PoN&#i4|TH>t~@ELmQ_0ti4#%H3l#LP7yynEOjtt_c{!_h zMXGvN!{>n6oW3sp8g9)ZGvbFMmq^e5s5g7zxajn4uSG8G^@|Iah|vpU{kqtG-L}`F ze=6u7Kw75shRBR&?kAjU`RS~^89>efJ*x;duKiFViXc6V@sSzY4zUDb0^ILT`lHkxWKJg-VeVm~dz} z0ABKlBvXHg^r$^&45$Okj9vtxW#4SfUnM3D3j-^0&0;i~Ie4%@Tz*yS%h@8y{(rk% zaT;(h(3=VU5VUrujR~DOK3)Bpu4kwCD{ROh)TD416X60|GS6 zs25}HUO#D;vU^Gv2WC9#DT2a<&Ir%3BCf5UWI( z)$TUP^PUp(&gc|WX^=w~T@E86W(7I)hp^m*JGmWy%_W2OlC-E7 zlNxaB?F)q40Zm3I04PaH15Bz)h|RS*$SPQ%v$ce)5Di_|=0j5bjX;|r^B15m9e?vI z8uy})MDq|t17|VoB+#810ji(KDCqz6IV6PHXdIVVC*27qSNKk5)P0j#*Fsz`GS{cf zl_turY0NcKlu?taTd}K6Bwct8KKt##uDh5FCM(yGctvvmb`Cya zycN5Si-cM*N60`G?I!G+j$GY@zlov6>^d2H)2Nd#_g=3f{SKQ3RkV?*&oWznv1b0W zgND-!GjLt*5*YP*{HsWFBWXKOM`PG0&nfq1(y`D%e8)5DH9nLYn&J$T%dOjP61${Up|#U&35A=7PgjN$i4w?RM-6s`~$pY`{y71xX6X zD`3nU3x*1gp% z4B!?EdEE4gRI)cd6nS5IFLAxqGHApsE3jUW%@{~f^Kvf=v#4R})`{I|i#)lV=D@Rm zhk3SaZBc`@d*W8)W!Z$hzE*lAD;23ho~MFs0 z&Y~_;jF@*f%!WtFlUM6!R2~O%P_8UNpASWu#Q>xk($T@RXQ73vV|L=l%<)f9&J?#5 znYX=r7LSgBHfSm%ip)THc9bM0@a#9rv|TO8H#`Gn=G}~HfXLouF2I-Eg zofHdi#MBeJu?q$bd$9{vF`gs1ciNzB=m>8LMnaZ#p)R4GU%+W;3b%whBZ6y9Fx&>~ zKVhn$hwo&xw0AUxIxOwYmerw-Nasw!h5mqAXQ;LLs?KmrTd0Z1)&x5(p)DK29kPI~ zC3S@&WHm`}2AeDp0^b=b_}VRzj%X(&VKr3`ZVHB5gR5FY0&aaFbo)BC=_x3VG5(8c zR4o~Hql%bIT9bo@-HaB;5Ibw={y<4#JB~JYIk+6~Cb57;Kt{zcu$DbD{*`$fz%g-T zeC(kZg%~j_6>14oM7xs5Fr080O@%2>Cg~A0!Lo-F=4gdU56uUKIO(%2NtK}eH!8Fy1w(0@(0oinxEH55p zrYek;HWi`lj^BM2x)RJcd`6J@hDk+%?c0-BcB!f&f0XBmQ^wt%!-d=*$qqv zNf^Yk^-OjXvv&)V-NEeL!(_i?_8w!hJ#4dPAAL8YFu;6&$9#c(gm2=j&Z?n5j) z&SbDA@*V-PGucFuK#`63dTt`S9J$`cvf0S>CU(IR)$7<*#PsaQ^(vN?Fb#D*Ce)_D>Bp9~@b^Pa3oVy7 zA$hpPvb1YM2&oITbq>p_a0JfLqDS!cq1x?ej)Xekxf4G+L(T0SA@V%Sf*TQcxHA%N zYl((C*Pw>N7hI15iDxbx15#J}`t|4; z3|R79J}O0#I7W`=s+1p##o{WfU21WcIqS>OL#n@t?aPz-HF3Q3e~i4|rqxmG)Dq-% z2K5YhpKRVkcN^*oT60_};G1ALQB{OlNo$A^hB~k^D>;JtqLc zYtzf|guRPuw{Yy?BZ3OAt$45Tn)e!~c`t&_K0s^rBMbH@kk=nGozyZmL1Q^bW0_#F zFQGb{uDR_1*FMd3QY}x?Se~e{oXgPA_^kK6Cr>MCktpk=TE0kQIagzuV6lT#XV;Uq z_Z8_7Wt~*ZQ#6(*Yb+Dw^)i~~b@x0rpuk3nvQDbyX&TE@HI@m^8nz{%{px!1uvLLr zV>s(n%UYcE^bv5@hiFUWN^?64D^F|F{3r3Fw-$=(Ir{+E6iC^6=WuS_uJ^7t|QlQ(YQU-=6i*U<^qDj%kmxRJ(XRM{ao^zm}<@vHftDK2x= za~*64-^AKBtQ~?(mycK;`1P+8JSvrXu7m9q$R`)Hb{44K>p9&kk8(S=>$wiLQz+vy zwRQ-4ox)@U|MxF`gWK7y=Q`MqO~w#w?GS{!%(k?!=(o>vJ0I$~4z@F2-Zj&Q_Mwi12=zNEl`R|Q_{eWQS3up^-SN%Q(w)dw7StqqNm1-j^)S(EPek|3y>iNGdYJ|r8xQqb z8rM;W;uw59!|A>EQXXn3jq9jG5mf#Z88Pz12aoVjbBtU^9g3jxWyZ5F@A_+qhgxIg zI_gl>s@7)uPp>)6Lp^5XI_gk9Rj3K4_srsx8aCuMiL4RGLmO%Y0`05T(#Otq;SGvM2m=6i{zTXC1F(i4 zsI7Bg0X!i~n~}s+!oC9IP6(!3(Mf~V5to+(U;mBb-vQV zxpqaI(a7omUQ!{VO`(p?aC@8l1fjx_E`>g1%NEMdut!(LulR^xSgt9X9XO_)*}Y;4H6Txx@zWd$2SXJ~b_1LY=q zllFDtkYHDeU^j+(*b8a8@i-Ib8F69ZCcH+gCKUh`cypB}f#0J{g3sID+!XAh7MjAH z8(M>1fe<90u@IEm7d!lZzt>r1XRkvGWT_2(FBK(%(`~QzS34J1R8-g%yG^AwvfZT8 zbye8Q%By@{cSWTgZ$pui8I~gfDh2%dr8c}9h5j_#70L2c)p*Lwt9^D@$t7W7cdE3Q zY)`4v<+Rth9e!__(?!+S0EGhGxKgW@+ZTJvE4}3|kHRvpFI}OCTw|0WYV6gHYPZu- zGg0NQs&Ox_thSS4gwxW# zj+UQ}(E4_u#|Q@SRvrD8=i$Jh9#!_rnhIYWT`Nqs(6I zo|j^w(BrA_E-tHZB0pP-pUvYat1S2XE9_8%QasUzSnR7@?D5r9+Le0{)^-i^Uhu!V;`P?v^RuHN`4wZYB@sU9`;m}i7$S!b$^a`bu8_bqogRW@i?8g#)3LA}26nkugY z)lIyILQ{!@x_svhTVwb5U6oa3Zjb!Zj?urk+hwmPcT~EasCg(YKF>cJ{DaLIWEpm6 zh`=tGf}u_&xdvy~m^VDThHZX+p@p$)j1!iv-sLu4NapP$vTNwh&#nO{pQ`oeXV-vp zORsA5?DkajC#>%uPa7Q?{A;8))_86-Dcs3B0qOLopC3&>IYSU;Wt`g{oU16z7+v~4 zLwaYHIN^ z?^BFq?>00ExaT~q89x^Zvxalr`R#pJKxy>h+Ewldp#z;XO)anxla$=6GebqB)$MKmZGhVpKuqFG`tFs0;zKp&3zvFi#SG`<*{_D%7KPEi> z(j;MZ+`8LScK&eUpV^N*Gv$q%>!+R0cs6|IrP?{ViLc%t^Nsoahw@*$V-aZ_v#hh@ zz9&kazxs>U=k6;gu6}Ca(savjr#}9+Ffz^lruVNEPab}US^L?cffrhHL$-a88rm>n z)cU=*8PxuFw`){GDj&FYL&S``|LeP-H=a9qp#8(+4?efqdEHNcpXzS8cnd$mb!73Z zv)BB2Y+; z-IMv~+rvJ(bI?uydia&6_x$C|rlX0o|1s{@ExX%3P2#LC+&grCV!q4W{ZJg@(;)7L}&g|My;aeH1@p0|LYc;;#jdnjs zGz-GGT^!HkI3qb;WpLvG!#0$`?YM)r4cvws&vvb7W2m><*gfu3_WM2R`#lb|_hD_> z9W?xJ^-?w4Tp7>#)tpaPnS0Uyqb~dh$h}Mf&)oH$fOG@NimuAs-vXrq1rql|c~|MD zhOKHTUR)wypCY?Ci$woC5%Sl zxRcx4Ig`7jbxrH($WSdc@8_fBE(5)^=*o|YM6|E)2JB=n8NxPtOj}Wdt5%CaX$)&` z7LAOeXk-ALr?M4eoTO_#l{^J>MV`u&2qo(aJ&&V@;QWHT+83o$_)r=*M%2jvLWWvo z=%fs>ssJ=yhSFsyR~4++|BfmUWO;xwaPBK=Ow$Q?UL zB=ut+gUf5Wt-PfhF0$KyB5b^W%y78a8nV0m7#5R8|IcCL_m&^SY_EwCY1zG`vAl(r zpYxv%8xLzw%i{)=AE)JCk#pA<*Bi-cmiO<{vA_8b=-6)d5_^&D^dw?*+=XTn z$nKx1#%_UVxKb@^z=aqCC%`o9C#*B)(^?H%bGs%FCKl~vn-*4l@*Ewp=qKCsoX_ZP z_ROUwoW_9WrePgw66M&R^ro0&K1R)88jtY~#+%vAwP+00DbHynA@F7jG$;ExwW0bG zDl3grhRRS)Pt`fUislj1bLB0fygWtoYlVclX1yoFZ1!ZEjjJ9ad)fV@k^Pz+VGpwn z70sw?yfRGF%$*V%*&6H6~+J96RUXRHxOfYJW$)o0Kv>4~vo2iDI!tgjFQ1$yLqJtJ=VBI{h zoWHQy<_XmL6_>RWN@6{@v>4x14`p$1t0mTYY-lN~H>}-^nsH)e&q7&jm&#DN4873H z2<0VJz~WOhaU3BrHwDI@o@3Y=L%#I4Xl-7n+JuG#=1-7|-WhsQ)-^evJB{I#IbQ2- zT7KGn%HuRg%Vv=4&Y@CqiaB|_--@9Mx8ZZ%TWYpYW8PA8bQ=Z?iy`gYabT(QJ>W4F zG&CRa=5}*GYRHHeycU(n@eLY@v)-kGR6!+GDF0DpJk_x0b_od>K6b7-&frB`L23)- zXKP>+52Kqnu*rv>4RE>ZSid5_lhm?x6+ReWY_EJC@}Uh_f%sneyGcEZEXpt^DO%c1 zcCqzPBf~sF(L;ToUU$O?Q_K_CgEZbH&n`4a0Upn`k#E?!=2&2T5_=kQjqDM&9%zjI zf9cpC*l)wz*n0K=A~m#bbU0e%j9~XdRyay%u4hu)5ZpRJB=P4fOb&U5!UKvsqxD+U z?xp}c467HR61p>p#iizCk`%_4bpf9}@iM1>!UrAl4h3)*jbe)tE7x8F_4CoJb7xBJ za_K*XP^z6iK-NJPp^s!J@WvexWCt}`62WLR_ou!QCXgpuB|Y1?@;U@1`+zxUQikDf z;w9Bp#4(OtQot}xPtq{Y(qpIwh1_X9#~W!>%ryt8ji=GiYq44mF-XQcb}d)0%_8lR zxiguCxYX_42xGURT@CQc#9~m^4B#8c8*nNK?*+8Vg6`tH07C`5eR`s0W00$!fokwU zYJm+HZXDxwyv7@e<6h776zbe#;% zkRgi<70J*8G8FjtN{ne~G6qyWs80)*2halb zGmy;ULHn-kfc%76K{6#Urw0^ePew6{JZwrJWHeOuT=Rqij8~l*7&oQG-qoMeldyYEOI-Vpd?CA6|S|Fpk{dZtXHT#fKPEf4I|vZ$wv&pm88=lQvX z!M?)-G|HCyMo7|MAwm*viugp$9X4`P5A|G`hH4{~IF~G5m>d_RpS0Myq@-8Q|1OHs zt5WX|{Jj0;9_mFhjk4tk=J(?dq2*@Ly~Pg}JveX43K3c$f-_RBMJvRkM+DL3GCdK!F{k=`kP?}VIA;rh)v+3`2y_)_e(ci2E^GmRu zz!)v5s3WRnis!$U(lc)L=y0?NKohd1VqWJciLqNG))+-xtJraRJE7E{AG4l9&G~XE6TVl)< zY3|8E)@D7jAbYo7fl3waQd{kP=zJ5G6;t&@^I&mqVxKA{-OT^Uq_O|%zxuEKtN-f1 z`mg@0|LVW`ul}q5`aiq4iz?ga_q@*-okOS-Kex|0kfiCjI$fgQb&iCQ^c1_$NYb=q zD7iDr05#}mbCf5Qao*@q+4#_b^n0wCdL{9wT*FGXK$Fy}kk<=>!0pr)h%K`|cSqS(B!{Uq z8A-w#6T1FOtSdcTAiFfA^U1N(AwZ9tgL^cUU5jV(HnM;Gm!w_veO0L)xQ2S}JFRk^ zFT_#fX99;f?xKSHprsPm3!SW*0y;0$9dWu*l`0oEOmtxVu|}y zStQj7I57Szx!Y6FZBMT@>=lU72d&s2o{flJu8ejvoqA5o56Hk1Hy$dEa4v`L3&?spVC3UQ93(L2u+=6sq0&cLBvrr2 zHk&F<5o=61y2SmZXB-SPg`)$y2I~1O8#-RS3EeDaW>KD_|EC%wL)K#^&;w4;t#pKj3jF>|*5i;%Odr4;^pHq0wvuct#p4kiD6X@!M6Ty7km|JK zyidL_*GW~@iR-B|R;t4*>O_!@PX_7~73SCIVeEA1dZvf}+wh2>MknWN!;dAsakT>1 zDsY_wH!ARG1)dy?!+?S?C`Vm|Ui1pQySq2urNA#M@JkB(q5{95z&jN9FADs;0za$3 z+ZFg}1 z=(`yA0J!V(p(t=0?F%Z`Tlh3AqGB3Ef6MRDoaR-haLl=(F#2KP3- z)eAQ`^)PA4;lIC#+pp2>bA=Qj1)e427J+wgwB44O#ea=EEa^l&5gSw}y(9=W{;U=~ zB$-G(YU@BX<#^EsSRAjoUyJ?1Hih0JO_@1-v9jN6*mzRJen;4|Y!)63rqL&))s~q< zI(aSacV(Y`gVy6V^%d67W??({8`bo=hijs9L<9L%mv9LBLKr8hD-3J`;`kYL(0T*j zq3VsFRNyTN{IE*NFPkM322rQ#83c*2kjMW59c2m)g}A-e(UjJIJ-9wy6rG(F(5Dy~ zOg6j@mFyPW`8wT#E2OBfCW@iYtr)i1ead+aJj>T0jg>wK@W~ZckWZ=T-VSWA+OsS? z`dgyW7)-D=W}D5>bU8B4j=Mf=se`bux1@HOa3E4E!Rw3ahf&lM8M4-xNj=-!dG`gG zzeRa9BdFxX*w_v_yfATiHu_-2=Vw@90i}Xb#88bocnncNwq>FCz9ydb#^512l@hDP z&Yy=KtbB=@3WU2OABJlXhl}mf;YzLU6UM~7#~6h%u{51P(-@kXX&Oz_5j2gWsfngW zn(Aq)qp6mr3{AVXVA@I3UufD6sY74VzLPQX>5(wz**aE8JowN=$I)E2>B8B>RQ+&Y zvg=wt5(?|-ahx45{tXkI1?xNUB_4UbJ6liAdR)513oZ@Yk;XQA3R=1Dqstd?)0T#- zj2hQnT%CbC-tKYfNvbX}S%J9pFak8b&8vm#gD9OdRHPxbd@0PaHiw+dO)Gr4bt_A2z`bSCH4VyaWXz=Vt@%4UV%S(6}rS1BF&It;j6Af)tWqh@(^h$ zNvfXfR9S6ygL^0{osEnKx*h1I(GHCrvPkTtw-^W)o+;Zr(}l=5+CFsX3a3=qU)v8P z%}C1ho>bIb@}wH!zYb4oSNTuEqYNWc(H_;#(DH-m^_I-;s!E3u1Fs3H%4!-NDo>;Z za;mZ+@eInvbXo?ayhDo&%`;Ryh>Os91NDA7kpDYmpSTCJ#>PTFk+IN8l@k_~Z=J|6 zRr`Pg{B>iIcvTp``Fe(F+s8*tr0$rb`De$AewiH%kE$KeJWMELH`FZt^N5Z(;957c`9v^-^ zzO~}(w2IfnAV(4}BW}y+#(?xQQ6zHH3rK!WE zPl%+ms6cm+C~JxB&JeC!?V9*%{0GQWr_OG(3JpMwB4(&SH8{xO4`4776i7n_CuOaT z#b6b%v8Y^TU`4duV&zxFQqi&UF9Us`$xzIJNp)aX8rKb2xeUsol4i8nku#!C|B|?q z)Yi6eIMxb7>P@*ILd@DH+z+ zcGgNpCILfipJNXElj0VfL%1@n$~nj`9J2FQcL8H=fIGQPSKb|SmNAxoM=6WYN569b zQo1x2;ZRTc@xpw(8(}LJ;&vga5Sa`e6ySzoK~5$a&(O`r>5=Zono1Am6v`LxTheteZ&3!Wuy;hyPjAb8`kD6lP|Y6>um z{{kp$q1kbenJ3N5<`pN#O=ny~EWBAj=I6O|jtG9z2$cAng~$|`a$y06iqcla!W3)& z-PY9yMR6tZU3Y-DFtDRS)SS6M;pY)6A~C0#!81DQ?u5u(-sSGYrj2tdF*}3jFi=r2* zn2*=*qo=3)*WGVt=9%kpr~mdzenWyTysKy$jX?o!3Z(iR!fNWl6%6xJ8nEf~p}g<>Dt?s7b~#fFgYx}qOuQGY9_ z5`rRxW*gURgQ8=F^=y3;9H{4{00Ly4dB`wxsxdlvwl3KvXioNv@(WnM>&q6C*S}9| z-7$Ayx(1J%=gv`}P2glt_>15xMg0-aGSUN%;`j{yq<^&3Y}EV$g8h9Acsvnx~VLUfckqPUY_H>7^+h>iiS-+2!@PPgjazTx4^_&sC;zN%1 z;_a+LkSmC?Nu9~X4;6F|Bf*aCaoH>5M1gRPup=yd|-vTKVXG$~$N9(|ABk zMPj4CnnhMi*bV_)qQgH)w+pOJWUzgS&{_gKvC9vQ+8kH^1I$di!f!x71xg%BqW6UM zVuFNm~ zF8C)j@iJ?K+Jv?U6lzz&mcUl7BFfGP2&LEWN<=}5y>NVRd8pfEQ?l3)m+43h26Zms z$6UIeGal#S*lJ!$0crNgr3LVLmgqMwhfn+vZLqe+ykgOLlVsn{YQj&MTe67ipYV~MWWP|F@ReGJ zJ}J~$YEzu*P9ecd)FZ@HcGZF@bcp5^USxJi4@YlFB}W=4Im}zn~6j~C%3^oGbktdXA)P8AC ze|EJ6B@MG|Yy&nR@By%m9Z@a&vs!VR-7}T#;PnG%OTerjivQ*Fv`h+~Zx;giNKyc; zvcb&Rnxu%z0`t&=VR-ELN41KW^f&aFV5Z;@5K5}VWaq&3a**dHj4L7S2cEx*IUN0^ z5YSDtfmiyu4fm`?8wTz7#9p>9F#C*{gyyTI;o{EmL_a&(FuQ!GU(tfE|@!e+x1fw=sdI)x!CZ4hMLW zg5zvfK4W#DX7Q9bzDKe}q&|U`5Um^z2rUuRws$?;mw)swYD=W7G;$#k?dgXb)mv4n zIGjfWu3%u0H|~CsS54RehIJN_i58N97!(LRx!HBV|w@6l!nz!BRwOSF;D3IWlig1}a8BuYc1 zG7S)9As~ne2$CioTpH?LhzK$~7eO@7Ne>&2<#L*&ZFvMZdN|WiJZs|;g0SDvJnIZf zXra%>h?L(f%qT488SMF!ldXhNt`6UE>; zpbRgmWy)*74dB427)dfGfNqli#ma&C(%-p=ZlUBh zaQVNi6D`ppEmX3))A zP|n=?hVBgYk~wly^~cRvCMcacWEM@0+&~AN$r0~*Y(A?Mn4Di1&rf7rRnpagZ21~( zCI@u+n(`WZ0z3Y>I@hf_*OeVHQ9Vj*ycEjhYX>HvWnr?V^FGaLF##=d^uNqNs&Xy- z6_oH)*@*#!?#2L_RY=s%N+orJ8T^hu!I>TU?x=A zIxVpD0*H8S&nl-sehl?NzUzXV7MLj)|Vi!(M$}jYXfK;Z642W>h)0g zPq>sK<{t-_pO+DP3T(%!*2kTpRXcAG^?EQ|fGU{} z)YEwsqb=>D-lTf+SZL&?^Va}l;lW@AO{bOf(c}RMl?lgXzB(kWTn9!y$+E(OTBn`< zMtNL*0zE8<+i%D`5>V2Tkt~!@qHPkmiu1(AjfqX2_Sa?GApbo+z6w%?Q|?KdRP-qg z^C?Xl#t%AE4ev31JH+#?E~*@%-ND^`Z{st+yZf}a_^!EQcb|9f?!H}t-F^Go-gzU8 zi)yg<@fS@kj9VJU7j@5jui>&d^nHA7nYoSjY8u9m25R0Au2(aD$28%PdOz2^*C3iW z?+sJ!3D69nX?n;narFf zj9@gpprVT{`UER=N}f^Gq(*e;o>tu8c6X#2G*X{C|~$Re|{7^{(%1B0zNO4dgc#5 zLIo^>oF~xnv`uO=`4=W}J{=bj)8M~gw6?y1%fAqE$WN>3F5QGk+G`|pT8Jhz??f9e zUSb=77`Bb_cT5^v;fAvBnrpCcfGwP9&aJCw2T9R-?5u&Ms`11*&$5NM@XKQS0Y^J3 z1v4Sqbqp7Y8}yu&_#TzW%7}HIvXb+)YRWC_c7<`xO}0l=e@Z}7v{u{7*N|OGE0^Wc zS|iw^dG^^@-De53dP?7JUE5O|17dJtz!J|t*#*5RSDahMwo9e&0@X) zCM{WV=C&EsFP0gc28H%@C~10nA%FR>OpsHK#DVx22fRr85FOy9FekYxzX5S*d5esfe0?Lf?x#Da7@0YPJ5}I=F!Nu9%3623G4$h1QJ0 zZB9JFiANfhd1Ymwag2V1I_r$2Mx4D_Ws$7j)JQavRn{}8+}YqaT7qd1YN|UseoDH~ z`vc;ywh&WBNY5Z(S1^bDj(4;mvf#O)V454tmH$SFyJs-?Y%C)*y(=h&roFS2TkLaR zXv5mz3_D?sUmIEc+>#xN-4{uBZ|WKBCCXF?;k75TuRil{{x}T&)TC*0DwbF<-HGl z6xFo=yqn!khGfGmu)!z+A_S!dG`L_{HjzM>5S7KnkWHc_;Cqn96_th=z?Oxilh91Y zt@J(H()Va9Mczj%wYE|~McB>a<`0MoAcjBMMN_0?wz@F=gztJo_p>&_ndpKxhd$u#XL(ikl#>i4@_h5xuN4u7@u~5S=VA0%$rOAtrBDNi~bRIj#)o~dP1f-f19R zeSG9zm#gnK8DsSpJ#VeFX9%pv;G3s+Eg|P7&@T>aC7XYctD6>`;DB}E7(BStYxayS zb^Dy{OMK2#OVl++HG_Ct$pkL@if8>#&!O*yb{B#CI6i1LZ)=pGzM@-;O z<-1fNS#E&wV<8{n>D)(>0W+7E+TMGDthzHYbpb93$r>g{lux%)giJ2c>Y5h8tMd)q zWz~R-wlI_6PEqnSpoQIQ^%^9vRTj*S9zeH8uOqsZQWYLl^g?e0-3V>Sc8YGH4vT>* z7uL1NoK^HE*f~omRtJbS>N-Uh(XhxIKy{4jrVv+bOtnXSP|zvdiE zxe91LXga}|;8zTyzaJ}O^_9lp$#AK(8hHBB?f8B80$crKRG>TC#V6O?>ZpV3O2>4; zh?o+J&Bzr2y*;a-W&0b`!p04?vAJ$iHA!1KXR8;XRuytUxAZqvUIegY=f@j z{us>#exM>$tB5HB0xD<8i*{pJ?F-q6F&`CT>$ZVGxTKeZrh23fN&>dMjVm4Wx?D&yNd=dcL}>GVXe$K@oslbta_t3Hi8BkvT8qNU&hrDLbVMyPt^_J)jFo~ zdKqu3yq*h`L6?!ITybz_-ipa~A+9nwr#4v`(I2Q~6hnWuN=Yvl4PW5Xl8uaxo9!KjxZQkZV->dWjUz6+* z%)%JJHwO|9L&(qoT@cFF>mWhyfewkA?pqJ?oYAH(tnqJ7ltbiM7>bC(N(>Tapy3N3 zvG_X9z{4oG{DcwE+>eMKK#E)QPb}oN>M-U z8lJ43zMB~hT}shsiDC|ilz-Eph-Xzk$@uUl;0;S`{@)t zKs=|WM2M$&Ipa%!|k?16H7i}_YNl@&4lAj><&f~Q#DZ_H1*C8e2YaUbq;wZO$ z&4Z1-gOd|d`;;%wUZs@mr<4TUg*Mf<9}Oea2S~L6Pj@wn>eON>wt_4#4Z6#5b8I=9 zGTOS`WX<%*p}bLD+C5ik1xmGUPX5T`0&e7^lFpAzdGvyO#F6tt=Xq!6`De&SCB0|J z`I25_6iwgJbZ$0(Q?Q(W167|ql`i?D@}f7WEV)LzH$eqjf*sVrB0Wjd@sjV2fs0v< z05)+LB6?7@1wadyZyj3L*z(F@g~e*R#2_uC6%~~Y{1GRljE4R_lnKw| z(BbUg;i`S{T6Sptdn&GqSuPX zfmxSYx!AgM?XzmJ0#8e`(2$~zv;49W)gwSbg@x*@JS=r33d6nXtOa;es7JLlnjxtC zSn-*5qutwHkqFa*jHW(U)E4DZ`3ivdz%r~?E^_?k<#@l6*0XngMa&5YEmUU0ns>8TGB>s9qD#;)>d2)dL99Zek!RN9tHCGvbEe76=g?TPg5j-rnN+05lz5%K!}4Cp=xDxeQY;tjdWbk|@m zQWr{_knK&=T1p;|(5okhU;N1WYqH__l>(7W)W^(f*+6{%8t(M$N@VN7+ zZO~wQMK%m9j+ztgH6XUtbQc%%bB3D|-P2E73T-|;h-6g$9cD{3!cCq!1F5!d`05L< zqlrogu#T)p(X^AU?per-H*g6X(mhQ1>)4#Xy-b%f@DSNci0Zj``g)v;Ou(Y#+-cgK zMZ24+-Nk5knc7`f8@*eg-Cfk~^0d1)?QU5X_6{aAV1g%+yzx=AVKrv?uCETN(ZhNa z#*^Gzii+PM{Z`RO`>l}3=oxPS!$)|~28E7_!Xem9EqF(elYM9jwH#)oS%|>pmmx!; zdb&J}@y-`e(R#Z46usH1-5jGgFVPz@>jk=8JqwH9iQ^2&YZhkI@rh#AOZ37BO`Wy_ zYeI|Ify1rAgfISEHsCh}p1!M%bAWj#!p>IX5wY43cVQc_)u>S*C-KzsS@=4!;_>G+ z1BH|r={+rv5{53C6^o|ul6Go%t$mD4Ig7IwzpA`=J~kmO;J%w0kpK{|Vfno1XxXA0 z7%el0kCwh0(a|yvM~naFmq!b*DM}m_<6)Xzjto;bod@hiFlrrR8lnz>gC&$CbQ&K5jdp+$-46+Gy}h^`w@%NjB2pVl?7KGxwd@@xXk{ z%7kBEEjqwaz7fhc>O@8jWt-xq4IuZY=|b64;zQYY#f$!_aw5J^6~L?@MV>6Pdyli# zx9Ivr3l{nXUe5Lv8GS|v5bFczD#_8iF-Go%Nm+RefgtZtY6iXK^qK!a0nm#k1R>S8 zmBMh>5E#T2jIMG;TIEn6Mpe~Q0O~7F=i0OI&5i$|#LDzaTou;UsGFWa#)1KHf_ID8 z`}rkxhTVGpk==}tutZIIS)1fCWg#qw0=*{j;>4%Bry6F~ATX38kz(r%wYf%WQRmAw z14(2wqdK;_2}eXOqjKRKkwY#fyzyUc=j3Zx!Yo=qEDreuToRA1Tx_gVDnhx&s+x0x z$FR{5Jt2B_8uN#A0XXh&K)F3*S<4>|v{@N!y@Y;C4sh((a%ECSVZ>UxZ1_U3iGX zjs}r4eBY_pUD(pc4>jW%tE02lMo z&~XtOsuT()5(3s&o`t5oHWh@zWHj5r&3TzwyndmZoI!%^<74%8v2%jLC694oA=%!C z1Ilp|*u|`JBxpyq0t%FDH`$$np6$5G2eXR#`#kyr@+{i(CevPWpN2e>p^uEewmnPCcMN2%XVsa z?X=|E{C19UOL6iSa)G%4m99E|1gb?j#wd*e5xMfgNrDA)^}R6(;nQQgA)#s=YgN45z*Pn!6Ro+bH zO_euC2)}@mjG_4|wF9nvP{&rIqri$7j`?U=R6S{A9x46|vu}i-qcGl~dyeYpNuY zC6O!!cmR(I%()$Ilx|M&aiJI;wiv!(=@>~3i@UZ|5=; z^JcBkqgv*P8^4N?(LNA9qO%;vA4h}S`4#z=&aDRs<{^J0Ps9e9 zLlvc$k(=}Fc7CMX_VhWk7%&^oI*wLcdD?F_)H@p2 zGIl!*mH_IK=$7pw28~JjhL(2|N8wGAV8#gzh;YXxnxJQ^KgKC@@d`BAa+;;ZE6~IB zb%w1uKusGr!1v{>jriMYxbFDSoAz{*S>CivTxn-?au$6&9v{y){1M=CoZR?{T+%1& zvVNe``Q=S3g%J(8E79s-Db3mnN%S5aGb@X;ei*$+yip#^`q$`v4c_0I<%`~b5AP>r zy%@bmR!kY0^)GlI2lsV2C$3xRVbqhw(x#P499D9PdJ=HISjt_2`)qO5_W&xP(KK5~ zMETN1Hfnl3n;-tO>&+3pD_v+5SM^fbmS1>y@x|=79Sv`zOFTZYCdiNIY1z2|vM4Lu zIM~#rV~89=pH1jhlNxahb!yBX#z$!E<2oUqpYCDlvT>cZPDhUrcj!?lSxKmYkpg@` z*pkpGQ5%4s)6y*bKBpWJv}vcyFfDW<&8}y39&33o@?4MqQRBJV)mfO2JkyC{ z5Pl)w$F;l2??Flgj*Cy!_Ithckv1K9+x7gN<*9q4(g5TbUEVt=hSL&EhkpL3&f+G& z`5eliV9*_2xB#f0mbkETA8xPE0ms6fw>4$m20emm$^g#sRo?S>4^j@JiHOJ>4eZPa zlg~iT4lY3h2s3h`Fg>T-szu2ycA===w(%bWR^x4fydylutZkQb2kNncufeC<4K3yn-SK_0h9 z7c#wvo*6Yl4W#C-@&iy#`AxL2A+rWbV56D=k5-18`~V1kw%D6lyl%FeRN=0=D-J`* zV|eq3NpC6N3x%XNE^(3XPSJJ^`uS0|ZVimPwIX2rc9*{n`SJ@$d)k*kHE4O%nYUiJ zMsw7EImd-_T4gM$dR=)f6jMO(ENaN3*gRbkW{)_o@KeNFDxd1n(QUXstw7+Wj*kIW z$c1|al1||k5||*0gV566DO%I>NpQ1fiq`BCBh4<1EyoroGjUyzZY8;Ah_c)W*n-5% zX%2M6m9d}u6~^}p_4c^6jNJ?=n-^N}Cl!A(@FyF8T==sBf7bX8qaD*jLJJyr{wbm= zMI?kN_@}_t-$=h9e#T-1(oZJL&*&R}vsBRKXy!+!H$!``rK@WU)Nm3nR0K>AH@bJxYI_pqRviC?nI;60*j$Bz2z~FZVB0>t<+&z8aU#V znYibHd=8b`iI+f22KP$()IodqG~m8%At}%iBYt84;#_ghwOwl3kB%(WS+>dzZ{bt1!&qS! z!v;g6npV@64;`B3JB807F2a~VniVc)LzvtOOkiAHuD*7mzAiTg%B@`(BZdrO11ef*3*w1SRwLfT*_B;LBVs}H`r!j0eUIRhs&>&u+t@k-?z26Th8exm%8SJYo zkdyX8?U0;Xhvb7ygMD_zAbyS@v)@CGc6ixVh*BV=L6`<%CWK4~3m_D_Y2TzkTc<#r z3~@5VR*0<-TOh{gW{AxYGY~Tn8zD9h?;EX+*1+!u2(=KlyNC2mt^uGP(iil8cs~qH z8`gK?lnfj^K}RCaokGmDV8`sq=uxB)eZ5CK5hNEp=326(d|BauEuW@NJc3KiE2SwB z>%I(NozU{kcDuaBEcW;F4)iN8-slH@@{4u%`ev^4EqlWvCrEi_@w-NyaIBmfyyh_E zH_GcPU!+HpiAR!AphJC5&pacp+fug-ybV{jTo8Y;sUIgj{jf5JAazl~MvV_Qm=&t+;B(kg1n8%jT)up}t zkqSyM1T?$hjN>MZmU_MDpXxYWagi#map5>Q1cQ0q zX@COQF|-1=JVt3ct~+D_4y4z+9wYyvM%HxFC%LrIPBD8QhYhB7FF zyFiyg@j;DV1EIG0#U}NO*TjIn=L`(UI?j9x?i%#7<8b$&5+gVC0p3l21$u;^BoZTk zn@AFQa~^G#14bkC(}B_S*T~@SD7;1y>m78?sC-9*I~=Q zyWNPodXKq$HX`bKCsmdFqV}T?)O7QAxQD1J`ZZOBn|yv4^6$V*(!z3?=7!hYnj$HxeL&)) z{6H4k;R9!bk^Qu2^#VPER-Q>8Kxg*%OXHC}6(%&8Fs5GoliHz}*(H5Eho(tSuDPXT ziv72Q(L=L@ap%=JvA<6kjcii3aqyvX1m7Jrl8Kt0qz+neBRW>0&P-^x`RxZPu{FM>a_yo&BMaS3S13M?04_x^o2~u^vimr=d^ss@ z7g-AJX*)3=P}N>QaBIq1GrOgi?nSr)LjaFI@d=;TjjV2BtLsr-*q5ua`Z*W_ztG_*>`pP*wa7a7JIvmJqT-B9)>RmaxMgeLUmOn9>&E66a}4++=h z93xoKUJm_6en+?TGmac1TaB9aay-(IO#Te@jpS z4gkLRAOb!f)AH31qazZ%H7OaW|MTN;RHmTmRBF{t?X7&0jBgR)eROVu1{;bIC1w;J-f}>@yAAHfxX3Tx2H5uDTf~q?y#Q?4J1j%hV1{36P9^qXdE}|V^wPJnSLH2! z?ZpM~Vz#^mx5i9ItaOnq$RKY)Z61~9(i>dl9-7n=xl5si;rnFN+f+s8J4Dazi_5A- zMeA+$-3XPyx`^*iAVA+Fm)^o}dSZQ>Tu)SO?%jZD*imvEd_Dm_51r728SKyX@uTI1 z#=+#@V={<(j|fd}vI}qMR65`XkD{7e{ZMN)U?~hPyg4xRX7A7&|KJTkQ|cd374Cr#2FU8*YDaRuwu6F@H{XLVmoSuLb9}sZsq7@; zn;H~WoVq;vd@^?uewZK_iE>pVora7>z_#Mzl3aC6OGxhcKj^&GMa?-o>5Llec$sQE zNwj7&q!K3JWf&|PIAW@~bCH)KCe{4tI*#$g)N*~bCAUIczphwGBJ5G5GU%_))>K>4 z7vgT|=0S-by}HKeE9mtY9$Vsb_APOPFoLC$kH%4M3@6*?sOt*75X-(>V;_gp%`ZL4=8VdCZS$v&hx}` z4ELFxcLC=Df56zbxv($E>S^dj<}zHvY<&(rCmosE&0RJK=?LGb*(GGa@YiD~Qtm@- zX3DTsqe9>Xy>JPBV}#>FpV|BaGvkh{I5Yk|D32WddMHEbL!exL*Z*Ts-t0suhxwmF znKOWbBcE1>J~x49S*#@ppHty9vKkkOWc^!efBz;!i`c2!>cxQZS314EiYM~CK6vx~ z>UKWuS3rAp{1`M;Q~4O>J>NVPzmgsZ`sVcyT-_SD>Wf@q1e~YisJoD7Q1Wx!TtALT zjS(|zO;b9qF=|{q1L$C~pqeTERK`46E+#;deot0+d1?4 zk>qm2;0KO4PKIJLe7X8fchs?Sj`FeWp{9k3!IM#3%Va<7IJvn4J`80fZya4Ych<&4 zlovAcDrejIo_<~BgEIt^I?t#i`8MebNf{u0wyV%hK2qpJM`16~d}~DG*LbXiRY8dTQX4gqq{%bHE}@ zlo{D&l+PGW1eA#hCk;(i4R|0>&1uPHloAguvrp)h`*!Ur+eOOnLq4!Y%3;_;+-b?c9_CI-IYt~os*vm^ zhpF*&+R#<^t|MA60`dcQUn&Q21YG~~@DWhx22tDgXIukH@OzUMa=4Vz)7EoVY{R4N z@JKkMOeyftx)8nR4n9l45Xy-V?(R55S~Tc zS7M%4rS(kfrPj8Db3zy9hg>O;djWjnqM@~7qyzG;XDV0+RqxCECuBIdV$`T)&8(D+vF#B(Rf zsSl{8wZFKyVx#=W^pAZ{8^v43iZyPsVh(j|_Lt(d4{Ihnooi#{kRjvdh(^8ZJn_06|JK7DpBrZEt$oit}(~>j0Lv9ZNfM8equYfY#=;&=w_bxS@A~VNn`W>IkegVFqZJpgIfRC*L?ljo4Gm+YrXy`iO>6^0uLs$<2h#i})lN z5Ue;oz)ym}Kv^zTp^1@}( zf>DghombA0_t2ClHrk&_ky0kA>sRKh1>s`lcJy%IZKEFT7>|zJ^?U3B`fNC0qhu}$ zRjkalNDEim{N&$2{?#xcbpR)(;T2$QFZSWg03vKVTA(^+QKy}gJVx@<-$!_CH~GWC zugBtSEE%%?_;(s9Sq=DeE6jc$&l1a*$D_|4RNvaEOCI@_kW3ms1^O|8-1$jVCD@8~ z8pS)%aT&5aBOO0W8XavU3o6ry5EH|0|w$|j12L5h2r!Nl%C6GN= zzAChnF#13zi{79(3~xX42HlTi_qGdpjvgV_)}1Q}<^f-vIPS%^!3uRYXk%mC>lqEMcJ1TYgK8n7!>aDqDkIF(N)& zr@6_d*Xi;+TXO=6C$AjB?WN!1}F!m04vu~DVF`^J*dhmiP0foXaN2PVj^ z%897>$e{Sxbr@KzeYl~#tFFLWy;MJ5m_YY+jHa9Gsl>M5IBzm%i5T7>K7UDogc$}U z9W#vQmm}NHkNubGhdptBT|eAj@mKW2z2By~$gT=aKfD2B27YEjD604e^}|^D-`5XQ z82+k$I8w$rh#DdIAsm44I)vR2UWTx(;=f8ij31L#taKj)X06VWvi842KU~QV=!Y}- zzp5XuUQ7D~GjDwft`9&6ul+mv;Y$7=)eqBh|5N(mNZB(X%7m~0!XgMuAuNNi62f}^ zze+!>wb54i-3DPdgoFHlk$zayJ>c zv*CvNuDH7~!mdV4gYP{MvBd(Be_DC1_6Zl6+e}R#cV@$TytRByH2v;oWco6Z)4?BE z=yZhmXY8|RzEv)=wwZ2302rtEoR^n)%syv$32rr|ImpuH=stzmZjR^$n~&>qk>&;p zQxv3s-yZ>~%UCg@%4xwPBa}Jx!l+Yb?7)h_SEss&Df%^Fo%rM(v$Y4TD)hNXM-zPp zPX;!OLb^H&+ln019u9am!gYb*uyuiN9~dUG8xBO*1+oU#1(KCBa?9*Hc;oy>1?VpR zO5MoX`1!dYn-8oJB$IC(7!=|64y+MG76|Mm)~YmDi&cv{HoyR^oj}&?9|Zh+16x5iP7trhY%+`24T5#YDHZqm(MU?v zZis#V@ExDc`?St%RH^tf8`+-p{hH)b#!d}Hcx7dBL_<#X<9vM9c#I61T_j2&$T$xA zR3_7*h{%$s&7TjQjBX0J-u&%Fa^oyS7}w9XKc3#oPh9ddo1gt9J}n_q!DY$WNo^k> zsQ}*TeWHg$6_Al1Np}+?XM|g2U^WHJp#IQz&em+I=*Jjfu_U1vCrq@^vIIKflvwSg zoig^hSO|+P@Z(N}pVEwof!U*IU{;6*X3HVzxw35ddDaC#>sG+erZw>3TWECl92%Xi zN29aNYkd1qNf9+Y+bP30hghGbNZu|01IP#Z$_xG!M01X@HK#X=7g&sjo2ALE2_Fg% z%YsEdE?(FyIf>&cKPLSuGK6;zT9Y|RO%uOfE7&{&4H^fOXPrz~8Sy`7NZ z+ACtJ6&<;MST(eCgtJp_yzboD;s~aGU2!Eg`{#CB`%}U_}Mfv z&7{$k3>rdzkaFCXGfE7Esfe)bHXpPKG=?Q>QD@e0P1-mgjzIW|Y@wYb3%s zYRhAhT~i;EU1^UIE42Y)zGBLQ21*OkECnu4fBDq!e%UU`uktMQLUKD`k3L^}G>b04!Z%mLD_QmoS2fRxOyn4A0V+Br_dt4HW9h4NKlc78qxe1+xY zE%cyEg_I<#wh@VuvM`sDG`RC1zQKe^F?99Tx@nT^v;xLIG&`ARvK>c-Zm|i7lr=q& zhkhCK*%D{nf%(PW7`FOVRLBI`>YaLO)5_KyMTbl!slW&bj2w$jxVTh#Rx&lRwwI*k zgScd6f8>W*%x8R;t}CFggwx0&u+=|+giSe~u=I1N1Q9lyB?tH9U(g7;0_PUAx7TrMKMfPiZR*EU_WiMf%X@Cl9onw_a z20Cl7r*L4tbvJe;%F&l8&xS6x99$|}eGV5W@_kP05@<{8HgfuIiuuT~bn&O;St+zV zp|M@jX2D0jP)v8net3IRme?C!KN~6;ZIy?=0j<&p?8Zk8akNz$XscYj@|9NUg;r4^ z<6fw2ejy3`l2T&0DWsj-HT;W4TemWWx(4Zm_Hh+bha8v56m)b4l6WUT-ShFd?#b{v z`4MjNRqptzOAa+Dh1%@{D)A$*EgSwF)uLP{;Go&gCF5$>UYZp0tqLP8bN1QZBf--H z+O4SQdmZFxRhSBws*pCsIY{JNWICQxa3u9h!Y&?S@rBx^%Ajv_?z;LuIQ zj-%5Bu1}*~|CN5fgBpXTe5v0fMhk3pl^$*PjO0=HlDdu|3u$a7b7^cL-=wjX+(+YN zayP~gkW_k`N|I@uMl3X*N*EeXBRU#qklt+=&m^5RP9cQGvq_l7nWSwSLYJ+s%O>y9 zqy^+%8t0LBXuOF0fyOTK8yYVqyJ%cQen#VET4!OM1fxf?If`~<%}t#rVMWR@K3Fi{gA82E4hggQqsI!ucq zDZipA>lnu@*G5A9~LQ**_*8PeQ5Jv#%P{ zl&c`g!F&(tVnAOPOCN>w>`r6a+ADGZNL1-ieITCofCkh(^>nQ!Q;wOV7w(0Z?wa$Y zUYHW!&W{fe%ba;J!tIbaYR;1e!6F8XV!biGT{t1DAc$-o=Wh**etoc~o^pQ4buj=7 z6!RGX056^IsYk|yf2B-@2Uz}bNDX26??U+Y0%nq&m*u=z$r+aOV%Yt0&z`wRu28t zGqHGbD=oR|B9{BSX|Z@boQq<5`f=Nd`6oZ|EvgC2GYnryfDbe50#h-`Uce~hKx#~< zCQ|r#l&?bXz#J7Ov0uM7F5E!5o_-_<4ugT(yJYbfZvWb_C*%rbgt7UoRS;i(JrlVc7b#W zwV4^zki~(GKJpH(%Wh1nN#Qz8zbmfo2x`)LMW6cTgXMelH z26_vcJiS?KT0jZ-bj=vH8aJB$jjk&DTV2KIY$wu>4|J6;bF8Dk!sxhx{XorpB|8Y| z%0%e02?N~)EaDehZ=uRdnjycR_x#5=RA?6&zP^j(#O+YSdC}?(Y4QJ&2KU6+&J}e$ zj%@e%t%x-gJobg(=my5tt5wc0^{)QE1mqnWoUg#IFGY{rp>Y*y2i{k$3d4-L+0gb6 zz;J!`pnD<|^!5MuQP9`_KTkpT{%@tAyD4Sb`@f!oYH%L>5(Pc@znp^Z{dx*|;6Fh@ zHx741Ydhz*bxT~e%$aj-P4<$sLW$c7T_%;hAPL)~lD$&NZmHxIspMs;WV=-Ix>WL# zFp+HiS;RAKL{W3+�mX=;GLGUIt;W};x2uPAS1)Wysf zuP3nIzYjOcrTO;$L}#gMtn8Rkd7W7w3t0ZJ@{#OJlSf2-R)Yv)@|cR12KJC&B=-7VPP;(oJByl{+%+o9__4dv9MGuX20u3D(9fR17NjI<&={p!bunlv4ul z19%dES3?hYg?F(aNq9xLONmvT+M9g0k_;t(Kub=DmK=TRZCBpDCzv?`UShxhEV?i= zcKp0wRecZlOU^w5Z64e>`W{x{qkKJ-{(HGq^zMc^ajRru zt9Rkv%;X|Fw|AYT(%WO&Xz1s99)-4%xV>0wcFV8Pv3ap4zW8DBdOTZm@Rq77hv4(J zCgpahed^Oq@$8{a-=Y~URo7isoo@38t@@uTrZ<;Zkwe(7BxKsz7oWfmq>rw4Jc_=( zoO|Irk5uV-3b|9LPzu5o`83cK@2Sw!*Ml!N!ZI)S3o+t#|g=8WmOL3GqzS(pI?4COS{)%c{Jmbd~FYJv)V7`SoZuRjJnrHqm=p748vNorX%DRfTcl zsOgN*qjng9Nmr?E7FQk7N!&5fyGO^?tfnfAW9)u-T?okq%>iOj?rY#) zGEzTAw(bLnTyJS789*}K#>Bz}-OAU5w%fLD*;}2!y-+5xWzxcUnR`iEA0rjU4s7-q zc^Fr2eGlml{7`2x|BKG@PY`|t;VgvF|Ejax1)&PUY6uF1FoYK&&^e4BwiP$UUFZ`S zpSKf@@#TVEx%mL1{N%=}PY_VRUqGl3*K#bxwL&-n;Ut7p5I%r#8p4MV+8~^PaQ0@1 zJ2w|*6w0zWU*cm!IWf}}BmAb8)ttZsu)LkZy*1s!J?QAP>`q6Sqmlg)o-mMTOs&m{ z3FR2{p&VmID91!yRW-#$hg%KWRO0@(N=Ii|g8_QkSflc6PY5@A3vuO{N1(Dx0APMh z6>dEA3kmQENBK-lPjqw&8E`wTd>Y*Pa*Up_F0%4Hx^i#p9`vL0)0gO63{aSqd&<)W z^UnTi-e(5##=_j48i(sw&GMP2nk-I`pA<$81xT{bnDeyX>8obUe?E9Q&}(7$H?oJ% zNY1@B|C>nedd`U*D;#ZQQo$ujxF~r)DU&$hr?;`yuTk>%CK5lI2@*kYsQw8ak-=?S zDjyXu#072|YMR*U=aJwwnGMcuWmR^dch2nx{eKSW7f^W@W$`z7uG8bnbm4oxg9bDZ`WZ)5lSSg)odcNx0N;LQe}5(&U2e**){4)UE=l z-TgrA1R@FTk`V6r6>h^uLyK1=@4*JnPYGVZE3)7>oT%xRgx5C}`IaVyrGnj1l333G z!vw@o7WT0F9{{o^Z|-A%dsyW!RHt9``gQQ}&9x?t>iLoC^+u>(K_?na2wknKI+56^2{&Nm1g=ap zoJcrr(&(EX4Mhrik?Q$3KNd~&=E*HRXW9Kgv=18UySYwE_YUB=(+Yg17pdLnSYT)1 z;>6ZV38z)(L0VR)@V@9hpi#a~q2p-;D_6 zgIw8^^4&nn*Nv3#i?S?rGg7^RF8~e0ashno696e8AQfB$biAablp)KEhCmwIToush zUKoZr!Bb+MM$hMd*+~K&7Mv~TzK!_Be(zzNp@p-+U9tOH<>P>GCnsNvBH2k0@+5Be z0P@l4wV&e1HCFt~;N*H~U~**u;W|F2Sz3hg3kMO6Lqy{!qH&ixPSPBmf)#SK(H!x1 z?v!A%b1nQk;;KD5AJ;X2R(pn^)nhQhQp^I(D>y(=?tq3<;;Mr%kDiv-z&twE@iE}k zS;VP>8crS5NktT)U}zoygnDHFq2A8UR=GV9gxdT=Z4$Nl%N)I%GNTA}FCtXQ5QI9H zaCQ)(A~U7~trZcYfLrL@{OCZccY)l{(*}dp&>O|4-H1;mL-0w#@}l^ZN6YCHTG2)5 z?!SXhGblPuMO2cwFN8ZZOp>_nC^9Yl3Nqm|S}_4IMxzW-QA@)az!#fed7w;&jPOv# zj{ijFdK0co9N?Pwk`gW(6we0U(TeKklJ#-{us3_lq*_HdKlX|;3K&3BiHlMu;Y z(p84$8}x(o$^4kme3(n-n{*w&#bb|>ih+aNWRRRzSs;Nc77tT(rGGB8BVf%FGQi_) zm!0jctHJ?-!@5`I0HY@w{0V_aa0d)WgtIl>-urt#uDXaSluc7n&7!^Y3<-pB|WgtUtfbS%9)+Xct zldlO+?IBJ9e*F;`OOMnU9?6{L9Vt8g%7RLVT^JEEWIW<1@vr>?eq`?DwZj0KH&=d= zSXrN1>xv2KGeX(WkDv7*sp$?{czt$vkl_ttqp>?^#F*(0#$ase4(c&Z?Fs61j1Dhj z^_8EX86gPeLX+cahy+ZGz()AanpcePQ)!}iYXBd0_3BJh6WvPhRl## zh)oD7F$wiptWj6WLoSO>7X)bPExhRfs(rib@m!s^=_g_mg5C8-UMs7+J_fHCywXSB z?5RiasBa#~+#oj}q97jUCpz8-z>Wf7#}Tj<8erKPV5vIYn`k_}d~z!uT(8rYKEaQr zS227%2oh`}lGmWvm>o>ardOA#kJo=cgFcs*;ciCSJ|4^CTDvtfT01ryu~i|C=?TQ7TmsZ zaiW1S$o=eV%jh1`WLtN&|9OD5wCqWBhJ8;M3z<;H9|^Gr_;CdMZS48UL6KzhDbxKh7vr)|Hq8yS zpt%8sXl|&D{Ndz{X=yztCZA6D5IDFvIn;qRGGr1=>n>>aX{0b#rz^&~Oht=C+X<~M zj~~Ww)-=$zk5s2QTAk)-b(;0m7eY-a+68hWRAy47GRZ?KgKdnJiB0$r#@XqwgTFZf ze{%%>W(t2j;7^L&VrxwZ^wdMc>u`j@1frctYQb$^Mb!Sej`Arbj7@d?5vB>~_3=bk z7u|8FIZ6GY6g8Yy@*{h{gxMY=dFs2-onF89Mt6Gg3G&)L@yZBv3}ldnfemyh9pb(x zOa8##EF-ngl0!s+@`E;1*Q0|bBe8#nT1o!(!+pC={+l|B-pw>`az8oOJU6 zAX(?eWgU(wgkI;&xTxX{OWsp#^>Vt!106~EoMZ_-WkMd0Mr3@c=p}lg2<;`%q6*Eq z9-&E`ESwkn)dubqa(-xR)kc0ux0DsYEV52c`MlJ-LC5Bh*+ceg?+2`f+7y{F{ym?Bsa@dt8Ic=$}W zM^Ah|qo5$N^XZVqHJAx$J?W!%Q`BTbQ-#W1N+dIIl<8n#k!1A9s`WjP2~SC(`B1;_L9reZ2k_a zL5wP-&gImc0~mPYJjgHS89}b{rHrxxuS10ggRMIk_`@QgnQAub74>-xe%oiBD}RU_ zVCFcG0$mz(z7*j4n1qidM%rMMiWv6LXy43Hj;p}ON2S}#nj~@=YR;$l9z|C0eE{Wp zlogcn0F)efS4AKA47&Sgzu(@ECsrwUA$YBUOBM;fXOV9NE?5GeTN2(6d}68MNGGtm z)H8&A4a0x%HgXp=MU0RkXUH3jRVad?D#6eVttw>zLz!?D8}-8ohgowJJ0g$aTgpH_ zER*u$2e`o8J=EzKQ@#Od^NZC;o9!l?M0s~N$7J()cGE!>Mq@T~G5cBpqul%V_Nq+5 z{HR_!jQOKZAem?ad9Io|dyL?pF}-n|ADE6t`N$Lt}Obbp&9<4^F zbZ7?bXx_~DoR>*k4KDFnWWfydq=Ao-GGO#hBX5eTN+*zrTIXRga%yBRb>GvaSw?l7 zM$=}ml{brCYs|(b_)Xg!l%1FJ>n7mQDVy|BXF<35xXUhfAGD8)u;{12d0BH?^h3>G zP>|hcoG*qM+&NP>aiP*sd2_lDD>{>76jSBRbin|LKmlv~>02E^`B)m{~-V7)-hoE-ZKvFZNo5F_2vtNpl%9iv;6B{KW4N z93aoO6Fq{J-FKATZ(iITF!F$;N5zf|Trv$9^!$vvqm>;`R$jjylGhu=j#M$wue=iPdmMD(S;| zzp&eQh|2imcI$-)#c&KiqRNX~iz?TTfGSS23w`VECgZ-Rswh7;=q90w9<)=Rs#xl{ z>XyL}(&z{}>X&9iR$$V4O8SO%pUm|s$)b{`8%T7x|6YoSzKd*WJyf+@-mx^|Pcg45Y#qoE?`}xUYNG~?%=X_QX zJLl8&F)>d0IPK&rzo)O+r`CHR{yFN}ZZm2ArChBTh{i z&8Z1>WkQ{rFmPr5ibs=D^kOo^J`=ad0B9iBE=n^CBXC1W&jrYn-*X`XCVbMMU0pDo zd}8?P$9(hECxTIzMk~{FHh&%D%$M5&VcdEXvHRqc>f+I6^CLYo|a82up00lCL^)X-_TE?!m9CDQx0kXUa7fl#ln5>lp6=SU|p(hE%0MY@i2 zq;&Zc=o@!_-<%--K((L$e9ou*-PP^V5Z%(E zK8(~UZLcHw`S1JtCtyr|4bs3i2wNcV5LQB14BGa)R7uoA*12-_g+hHwZ%8-y+hI)L2_AsNCX2=^Y>>bnA9 zUIgI*2&oX_A$-xK(|ru#2!uTlUV^X%!a4}$5FUf@AcScU?tox!`f5AgpRcq0e7Vl@ zxd*t)4S&54Jx{KC^1jtiKKrfv3Z8xX+2__j%T-i7S1~kwv9Nlz>$#_%X}tvF8`_L?tAFbugg!1bFO;kxr*l_b;3XDllS*Jx^-(B z#5nLQ5Tjn~^6zvOT#P*iF>b8e4RIXAwGcCreCU#7&F{4K#Q4dIiYK2>eTIG}^~u$% zpZn)05suWdC!bpVe*!gvlg*kw0DwbF>|F_96Lr@Aw*|xs8UZ<790UXe+os%?ZJMNQ zAQwr>9PMA(=pn0_Bj^6%+)8-Bsja_wc zAK&lIOxm=Vl7OGP>(?26{IB=ky!Za+{3kON+>H6)Jx(HGtkhW;E&|_eIgHVJaYZOM zMvTbycm+xm zdp*+yE!v95#e407i#)0Ex$OauPm6Xzx=t2?KEaD?l0x(yUb$6p0#z|?migdcg_VI8 z@J}k#dA%myBil}PXOi7MzsLzbf4I1W3k7(WAi0aWo41a`qWz_==dT*u1-bHU4%y#g z36%ExTtZs>{)p(7LDwKjq+jg?+)8=oASw_0_(G^zSA`OR56IdQ-M|KHoaXV@tG8Od z0WtYPqPqdU{=^r+Fu+aq1jR7#t*s!cNr{l?`o)y*^!o&i6zOmj0!}0oYvij3*R|Up z5PVWy`;m4FQ$4OITE#~~SpfY8ErvW3-8+e9U_F{rG&{^GK>!*_iQH(9WSzEm z?;1ZC<-v~VQbC=Tmd1t!g8t$lO!Dy{2+M1UTX8*wMVf-Uq^4SBvLT!@NhKwxG-=xG ziso0QUe%)I)z_%5ZPmKXb#2?V@6fT+^}p$S1J~uouHCxd)T3vwn|t@UB`rNeo!Pfv z{{aIB4IVOd*zjAkvNbtcojx}&-!NjN(PXw*N7?L-g3)8fjvIg5ZztUDoX8it+(J=t ziD%MeZ>i58m=X+$;i=Qg%BSCP=Zu-N7$zfSt{a1H@1JHDrAnauf{+lj6iz~WGt|}& zO{gd{@*z>a^sSZUITPXS_$97LZhX zCdYZ!wt&k$FJ?cTZE!}XqRZkoS+TorI$nEg?XI6A{pna%F?-J3d3VkK-QD;6{@w)( z@4J7|;s=&2eej`W%m47lKRx`&ibq$jTD@lNy7e12{`s-LYDQ4$V@l)N#5+b1XqM_7)T{5~ne z9#%qLBwpepdZHs5Drf4hqs$sJLufGPGC9;qpiqI4aLvN@L zD_{(4f@!dj3{{T&%b3yVd0^EZd2cC@&e(6qFxK;qpQfb;LlnNPgpu^Nj`E&Ptn#lr z#V&uRGgF=H+%W%quHo{$tcJ_CXzG?9u2){DWvWQr7ZqO+Md!lQRh(Z}&c3MfepaR$ zX^nlI!(*B1?_(R*^Wbf<gTb1t?ooue`Dz|IE^c<#+VeEw8Fq z-YpQD|LioTYFpMYzkgk9{ntOnRJ(!7*J|7A^w$}y-V8af*5+-cz3k16`}sfjett{l z428T-+OEhRgu4bQ3EJ^~h zoNgbPcy+{6KB3qzdU%nHVpqwz{=!L4+Si+Fb{d#&GAU6TE_0fA5=(N;V4o)C;oNa;B#}_6zdcNZRRykQnrrvsO|{3&lie zJ2z#tywfKsKRc3AcHlcov^GIb-k#!!>~qyT3CM}EHj?Q}DezG>dj)sRBbZ!|SK9s` zkzyCbn8kyW4I!OS7%narf{`Z?DH zL@#TlJe+uzw6%+FITIRCnx5-8$^!!1CYSQ?dVn^RG;Bt#bwp+6OUb@}Fj7-ryTfM} zX%|1FVFg5gVFCLg2FDn-G-Zs(Eoe*lpu=yX9n+k0G=(ugEeETVHOZsGLa^K_1f>lx zpG!6k_4Og~I6SV&imloUTLT*Z>ynM-AuKx`9#|8StVfJ>O^*45hpkN+Ljw=dvO~!> z(Ock~hLMLgk*;ASXR&kA4x84>*b>UM=uH&2B^%LumF-CQPM2)dn)rZh5Ypk~8mk@t zh%1;rnhI7wC)W(6sHVX8LfstDh|)M9J#LUIk6kbI7(48VdJ?8Qm8yFPuGO?WWmmr? zKYz3+IE^`@UlrDfZ(?203irU*VJ@WKD*_z-bq2r+OawBnlgk5u3aA8*0V@@{%|I3L zx0XZ7uR{D7Pz_W9E89RWpaLrCFU12Bfz1HD30naKfMY-vun5R#BVQ*XpAmg)S$;%^ znldGi%2tA=qP1LJ8Kq~HLSIeSZwp<3YRYSeYXOx=S0StbRsvRF5uj=h8ld`G$U(?~ zt`hlG2s^;9gMkuY8Soa+@*rb+UqD$Pff>L$;2`h=(CHZN zU4Uu8YTzv(<)>@-^YO@8G9hU%~4p-BG zQE#(ZY>DyN##tSSGv;f|IyiJBu9>Sb7z=EPILKf$>hm;6TQxR~N$=1na%F>gw8m(F zXGiO8c7w&70BeC+Kh~<(I`mX8db?ed7njyK1qLHH^kz+tQBQSb(3>5XzzBuq#uTU4 z3VUvW5eXCOHvy&u$?bX@v~#L0W@B8BCI}bHd;K)ZL0dMH^xtao_ z)JI5w9rc$Gn|-t`0WO2xYSfH_q2nC-#5icoNQ}c~k85D6p|?9UaVjPC>Ps8T6jrUp zjM~Mh6jy^+m~?uLE&=jfgV|uur%tK#?F4vhMuVCG>5`b^9Hr~?jnv20Tk5k}Z5A|0 zlRfWJn5hZJ*=6dpCNN?utY%WwUSPFaY#22YVw78))Bz3V#CZ+Y{P?B?g~@KwjwI(e z3aklDN%FNIU81X9Qd@ zQj1kpLga(urp5@Dm^NekXACA+le-dSikBrWf7-PDoN8&cY0~vij3LhTW@PG>RtFf} zjhZ;uL&`va{!OETVSHT8J>uA!mS{1VNQN2fuuI{$*zz=H!}z#o@rL+mMVO!-mt(`_ z=>Ie5ezERPo11E7uUAc*y_p#elZs_dwX_Qy`yQ&6P})5n&>&r8A6G4JwOZb>?ssuQ zWrtf~Xt>QtPZ=)axaj@$izuo*f{3TZC_DU8^<7M?{DdMiqw!}`jYs3rcr+f3N8{0W zG#-sdY6sQZn5s3xJ=>(8>#zj~J0Nr;?1-=r!cGXk+saf_r~43gMz{&# z4G8lQQk|<1QhRE@g{kN>Ic3i<73t+hD7`a)a5`NdA$?&d8zKE@IRl~jWcKq0#!I`&IVa(V2RZhk#8*8lf5@at#_*6)}qDY;4WwHOE|&MBYMMaf_P zp&YJSCx^2iJw`(g%br;wg&RTt;+i9CVpXQ}HvouU3Ae;auTjFSpg*ws#OjXhlhvQC zzAd)=nX9DOC`=%uj@*8PW6mR!j$~d)fAH|pV`mss&y+d8dqI9TNBe)g#wj~f_Zvi) zn@;)(UFq-4M&i}aW6r2#s?#qr)!k>Assj8(Pa)NHgpO;vq(ig};`;_Z;r3vT0@?#@ z02R;zXbv#o^h-=t4V(ZD169Btpc2>tYzLkJHUpc0jlf!9CGaq?99Rl004jhoAfV8f z026_+fDzCEgMdCjPoNvn9%urb-i^7rNv$u))-;+M>Cf0+nRHRiQV#MR$w;g3SCakD z^XL03>!EDme2TpOnvHhTURf7Wd!D7NBchLrfGn^2Yx%t*tKD&V{Zw~({KsG?_fL6k z7Rjq0r!@(EUunFu9$H5I7I+)@mez?di2k~i87NJv3DBhj zCcqo*;FZbQHSyP)*2d2^uZd?r+@dCKed(H-c(?CbMdB3?EpHo%b31l+kmF5u?d^15 zKZ>vVa^L<=yAPVPx#|^L0=+jr{_-Q9?5YXpx_{E~K1+vFbF-&Bbm&3t)lC=ndU8ef znO!S&U(RlI|Li%>X73vI&iVuA4L6kSKA7!)<=BGHEB59+w`8Mc$6b>PdJJCpL*Uq* zIXgbM@93FFemphvu~FJpC#QbA@0(uf^Jd?q>#1t@*y$%!AHTfktnSo?x4-@2)JG$x zKX^bd?0a?b)$5;F+2P|gxh;iuEyA^juj=%SC_X+o$d9V1f2Ty<7W7q1}CVWugGw%JDZ^6_tqIV7r?bYphkj^TxXjmT?)O|FZb$-P+*?6D6G>)vRy^N&wv9W8!t>0tfiou4|eG^<Vtw?U3WCw*VQp??)k;Dhc7-mq{DPqcdfc|)37f0yg6u2-m>lN+@YcG-#xZ@r>8#q zc>em7p|8x-=UlP%58;9Dr48vj<@&d}zL)uxVbS=(>wmYia?Fu+bJnlkl6k!3>1#LG z9@UN8rs~t(aN?E${Vet;_D}A9|F|Y=E06A;@#AN&bYAi4-Q&kB9=6Lm_r~_-kwW3Q z|84I)-QIH_0AdE)D3gbjT z#YzAbP;?@q;@E;%u*c4f%AELn&N+X*01qD|AR=|p-M zT|$rJByy5D8Jsno0?tN`oKwN6;q2fvarScBImb9^&MD4$&LGE;%iwP0%DFXM63?0E z!Sm+PdA>XW&yN?v3*$+6al9owDKC|m$y>uK;H~G?^7iu7ynlHJz7=1{U&vp{FXXrI zPw)r%!~7fkaXuhG2uuV4f~A6V!D>Ob;EZ5gfDlrI9AS;{jF2RnBbp~l5UmttiMES& zijIpkqAQ|5MNdTkNsPZ9pG1Pq;2H2TI0`PICQ3U7%f}U8RlDCTLG-FKM1kHdDxqXD(xAGYgp|%v$C?W*74U zbC5a0yurN7{LK7^iC`JA%vd%oCzc0GzzSq7V8ydmuu@s8SsPh$)*e;|>jZ0nHOKb? zcZB%>ds?dKH;wg@T(dj(yBg~9}3ig2^AT-Yug6}}LnMV2C(Xv?pC7~)%OxTJtt zU>Ud<)Pr7B26a9)mO4XU#%N$X|0@3`{}UfAzzeJeB!NJ1Qt(#r zMF0_EgbqS?p|?;ZoG+9JGld1ht-?m(ap5W9Md4N9T_GSshzN!?>7riIWzh}MxahIy z^{R1OEX5sxj4? z>Ol3Ra;Rcz1a%E{J+;B$>p!WtsrRX~R5*=HW7868!?f45FEnpDlU_`(qwl2eryr)D zqMxU0>5u5o=&$Jz29kkiSTO7v6oxy)hrwb982*d}j2OlWMk-?!BZraC*udD#C}Y$x zni$6!XBZb5Ba9o2dyGen*Nndz|1wONUQ8M@lDUal!Q8>TY>3rgOajZ6HOCO4C{`Y8 zJ?jAL6YD#R=_~S0_m%th`+o3+u@|wIvNy3?*caH>*nhFjIrawX^EpMFS_AEYyv4i~ zyp;xi^LP(LZT>E z)MsG**P!cHk6;B74Roh~yTRYUqXw1jG4MJ~eQ)se4=O-|)4XXhv|QSHS}{#dE2CA> zYG_JYBkhqPKTOl!(Dbx8dXj|pj9ICU{Fn#}s$x5xLaugnmB+80QkT9Yr2kM!(7TtV%9N#V``YoSm}lgyPMU| z`iF(_eeOHs+ruvAR&#fAhqw`f!f+nK{|u3<39b>Oltn~I~2b(gJ!xj1DT-)y;L!eFo&7r%r{Iu^Os7zSRhNnlChL5 zHEWcmW$9T2U(h$)SK=%4t?^a*{%XDreebVU)3Cx3!y0N@53QGWo~AKWmtk5By^-EZ zZ>M+Cdkk6c5`C0DZqV>k`WyOZ`VTssfiv(!G_d2vU@-WM^=uhuf-}vT;h?!TT)x56 z;arJ95Aj?nH`P#a%eYmBs;lHSa+|oVTot$7z(FTh&F$g#a?f)$1|EjFqg<_liV5xm z?yr4LbKe+Z^_e?ks7C+~&O;kiMKF+J!z1#@JQtoj&x;50#Jo^mxS?{#^5P9O>sRg0 z;AI;sx0IjC|Lhm5kM7!#dPPEL3y zCo`gl1<}QhIM?3Z$=un~a*m6g>s)&es)H?P=}L2$>tP=@*U8RjuA{4yrB}>zi!}&?k{Io zC8cF2i?UY<^3wRLQsS~R<5QC}vQpDiGqbWYGxJhn^0VSMW-ZQNnUSBBwJ|$;b)Ia^ z#x?8n5{fr0Ey&9$%FijXqL|XcHRZ+mJ2n)T z6qJ+}S8gq?D3a$Dm29gnT~c0}zpbpGW@}+X+1kc!YisJa?AsH&t6@Xyp0x+IZ)w|6 zaA426eX0#d+BbC^+j6F>sH&`T+qUX$)dzM|Y;COBx}$P`W6h!M4RzJcO^uCpEe&-o zE%nU}?Jcc`+IH5pw>GGDbslUv^xJ{Dy={l~9zAsUKto5z&Z7s8b#xr-I=H8+b7yz^ zf$q*@ohSAjS9hH3-g)lao|E0j&h`9$>fG@Q=T03zG|+Q=;7r$*v*#`io>mTCXc|1( zIe7l$z=ccWeS_!wk6aw+A0BMJcC~qEuxIqzAGd~EZeBhyKKjSqdpqymI(h$I_t2#) z*RGD-yfSp_`pr9kPTm;1c6WUI{{6f6?mT(;@X6GJ3zK(mJ$X1W`S8i3$+M3p?>&5? zdpgzkd}`v&t2@u8p1*qe{Nt-fAKtuv|MBsA{f94~{`&mk)vqsA{0;w~nHpu*A|OY$ zA#YWBMgch?DI+I`LY}`S1@Hp?XUd!dh|#lvF&dNu3PmXj;cjt6rW;UTD73^XSzBN= z5+57RmI9Yc5dn7NRi^txlo)TPOTFMz#cqV})z&j(H_ot@K<_jg{LH_3#fMz5jqi?bWhb zqTeUfU2}G*{I|ghb2s6vbQm+17vARDs7?A*iGMIUciN`OzM;%Hvbn0*XKPa39|@;F zx8ddz)j*(We4wJ-g409p#}s|`A9g(5>jz)ve*Hyj{%u?4U5L$$#y@7Ct?CjgXv55d zW%(~tWBs71iYr?~%7^=xT`XL?1oHgCgfrCbh@#qcPwKz|N_3A@xm~rYaKx=s{1JgS z8(&<76^ox#;>*DU;XcwwO0iMWFhIh3^@>pr!4^^d$fnO-HPq^-l7m}=n^`Lg3lnym zZ}M^l;10y|RSl3d7u&(Mp_>qlsqZj3V0Bz7wAzy6wRNdc)n%}>eMfN85C#KEGa`){ zmF8f+I} zp3u3CdDpCb#$5+-LVbNX?o0Bd-gG-) zod3Am|M>FkGKHNNS(!3sQmpegjSf!?#FFB9A7M7`KIMbBE=l%D8(@3?`slJOZym;K zlOpG+P||r)VdbJgH5LIgV}Ha5A;*X=KCAj2pH?l)w`|?3LDqq@)s7XzPGRK^i89Dr z8~C4!hd%7r{x(5n0unMV)+}sZUpoz%$ocA?hdAc*^W3q5Udh>G*MC<9_x;&@gBzJz z_mjW&H|%zZ+m;MKcXknEjyf4_YeSAaR(Mh~@^16Gen2KCdwAF={8BmFEUr40FIU0r zrqC3Q)^B@mql`E{vy=9Z&MQ5)5`Wa)A8({Ea!S$&!9z zYoXoi{fq*o3N#lK;|g>z$7ziNRgZ8^)#X$2o5}XFK~$)8)2XiOxHheo*Ln(0)?4cE znOsv4|8Ymt`F8GDKR)mCepr~jiQ_vE5%Htn@@^s6=hDY9nMz0&LI< z)V!L>T0{c`uN?GxM?AQearGwDMRxLrgPGDyC&zImXYG>#o>vAG`(_woT|8M6EK9YS zRv|?yf748rr-P9xHcYL87ChBB2o?{)XKS~gPjp2&tyA>vA9cSNpg~T{P=n$&LYaPW z{i<+kJ8>)i5a7id9cR%|XF$zqkmeeo8uC$ZDTyRNf=k|98iiVGnUG7z~+9z=t zQkb1qSxGJE#~)c#N*YsD3Xf1a!ZKzR80a&(rGqX<_>9QDzlT>)a$-y4cOsHSMo_2a zDJ%2?sJ-IKc{K{-ED6j}t3o=Z>Q1g598bV6>YBoEzuu0e-_C0MQ=Mhcu<1{?C^%+*{}^PqLcMv-<+*zwK9&&Of9vhcvCqS+ zz7!q!_Ll_!P(ZK0RvwD5swx*bO4oCQ=u+zkZe5Sb3r$mcBerQq0nm+%?vf57T7RRI zxv!*CJ+5Z9nwj-ARR+qT*Xw3$EsCxkTm+rJAPm0OT2u4<5hi`Be`9jPZ#|w+kNn7U ztJ-Pe+ou+Zpl39*-pFN$0Hzwrl;b)(JIUX zbqI5f(zvKM#q#~GV8Iv#sr@|S`c)`~hJO6~QBwSr_^KWf3BVsuxSAAbV5E;yG$_*m zA5NSVL^2zvcNUF z4I=ZqF9UHI&T7rR!vlRwKbnEu^D6e3@dO2 zlH-eW4v$Y0_9YC&7qMGDJN5tsIL9x}hp!VSAG=B%7nGLdjg}dwG z5)e@&fg{zB1j*)OUC?kj(3w)~CPpvS0^-R{o8?IN!I<@BkOC=8_KX*=UxZR2>(r=b zLd3xx=9TT{1-s2{$>;$xwlD}?u3u6n#db?!C<44yZd5Kqd6XkMm1vRk2X)iIgan$;i8asD z9WG8n<8-u%Z-@(WbdZLWw5m}L|mHpKz?lJ zj(JYqPFA~f9o6udAhc4BX#g>u2I=Y%8FB4U>iDHc~54a0%?P;TlI`H6VLs95Xd?SAxfcM za-uVal=cMLquAgrg|CpHw@l9&0cYn0sbE|QT%@7~>L8vHw3iZb?Iz%$LMDJY1$W{S z>4LW|aY>gUhmKh8(aaqe<8G;qr^L85GWK9J;rkBro*6f!wqdv|qB9OjlMvkW%5~!r zC4;LM3_|`IUW(GAGL(R3t+2R)3Bq+uwW^o1s$HLF?O@? z-@d{BDbV~02gZ5!7^XpOWxN$bNcop_vn1eb=Zi- z++F<+6FrP`46%t6D3Gl1D~I?!@H(yGBslvZkVx#G# zJ7dIRJtCrCz!yVSGp!<3$Y+*<3s!;$xv`5I>}l=9VTH(H$l>_6mJ5jOau>uA+48K* z5L*>$vj%!`65=gaby27Z2a)kW{jsY z<$=S+c5#n3w8(EkNLo>vWo+6rTE#~oLXFyZa&fs7y%lJml$g9$Bcjt+duok80VdDM z$A}w3&)Q-O2uP(8%N+J>_Cq}ejmMQ8XBQYxN#{e>n&|cT=0>~=1Ft-UwAK?lpHLq9 z@6WVM%<)X@Waa3nm2F7)X;&Ckl6l$`9z}pBNa+cZAetPKKt_73L~Yi=M%)n@G?PQPcf*B1rH2G&iY*sgN^-jQ3j{71rsU%QOCm&uQMo*HFNm7&dfXU`X zr9Rz|<>H1EIqbkcz|=5wE*bHtqAiVr5b0rQB_V`C1Y0=^^(lh-LP=2|B3h52#lVl0 zY|_CaAC!emDncFhNsgf;#hOce3y#;{gpabSQ#%EjeSU z*QM7H_j@wWbcDaU#jysItJo2gZsGjd2J>TM0A9Ohe24Frt_$#w z`o7wmbx`dJb4#E1yFB0T_H*01zj^C+LrP$aa|qNvFgdS90l}-i>J%E{c{{`#MR>o< z*R>?4`o6`7H7^v_&Zu>WNl4=^Ad`T9CB`yTkXoJbd%5vZ9qRTnogc29V+fA5>)_gmPUxHzxt00nYVtOH*`))wedN5}}44J=bd z*+l^|CFpg@zTEw;9irTmiWw$Zk!ZCewc*fk3 z{lvg)UM7;I&gl+G0J-4Si}TdoDa%Y|~wJ8-?Ufgr zJ43m`XwKkHq5~Z};7?j8HqH(A^U#v-Bo93%!d#X1JIs({Qmli@Df%ZSTLvW%BJ5OQ zLuK1Yd9uEAK%mA{kP#$__lqXfT`6vbnpg*Micn$hX>k2w9Pfa+ryBLO5)-YH#!Jwb zl(+_&Gf5M;PSU+=0J%wnjMG7}8f~i%wNdSQO<_JyA+sE^^?K5GbJhwj*8Mh721Mv! zSu3F@2cT(6Of-Siu$#Dz7B&eXk<_Tgx|;EikZ>jBW`(De)#4ECfYBoFOPU)LoAUNU zOSRYzJ?f$aj#4!%)u;tpbOjl`O^Jxno!qQNMJb`1fVzmPO*YCX&KO`zfH#AO;*^M` z8#x6Qmue1THaRqS+kXvicy;SSXE0C&N|@b%C^iE=@?e)6=6e*p*_2XNI= ztCo$?P1=AHddLC^dRMupu?(Q;G37eQyqnNjMl9Uf8S?26R0Y=VoAS~+;W}iCHv<@@ zW?_ZK=+(fUkZeYJ{Y3Cvr!70A3#4e@Cs2Rz*t503J>$h@$KdUt5%$3E4N!Qi7&CZ1 z(5k&T$vbp79)i?MZ|perG>TxA{dn|Pl@~x=p~PH}W3u&_)w$)(Ahuew=!9x98)!@Z zRP!Pq5R&6hXppyqS-xFiCMw9D0}&V%{E*scjnw7UI5z4@#g0OpQiK{y-8eC zZSDfrS_1G)J;YvyxvP46oy$T-!+rD+3p;Vi%iC8CrAJt;Jb=ZA9Uyr54Zs7_>AaE;qQ{ZlC%q1h`oe04*`Li`B>#gXLw$qFzn18*Z10 zu}yNXMiGEzIBT7oBvXY~C6Sdv$Ct8B8Ze7i@GP(ADvxRAEy z{;Asg!L@&}^TJQ;_k1!igsCNwO`}v)2-Yu-maLbRlw%#Df3$D>95hmiH356{{Z0zN zy0y{UVaO|C-dtL;IzHNCXB!dj(fjj=8qyC(QVUX>b&x5iXk_FW=Q&}Hq8Pb;)*}`j zO~QxKm?dQx%k~Zj&s1u(-&FQ#nonZrQP6ol&cpAJ;e4Wi?DC3lRi5Y%!rOXpzN&-- zhSXaPjn&#O{(Z^v%+a2rq3w+mR<)L%E^LTd$&z-n)a?nilISr+b#w3- zp&q_kaH=@H)!PohlnN?BHO_eLOevz)?Ce{Lb^NpnR!f?gl~!0q{!pE6h()K=g^;71 z>*igQz+hLLmhPC3Z@Q#|a7*M8XN+BZ?0y_~Sm%uAR=tFG`(JaxDSWEBVf>bJ9QDK?sX-k-->$iThV3; zlu||a@^0+F%NU`-zy$W`xGZq$X zt}R8BMK3UgS+z?CO<0{WN;@c8pelLj?=%gwz1Ul-^gk96)iLjQucj0dRrBdmon%xq zG=i5X@Vs~WQp;rd(Q?bUo~^+1s}=;yz%P8;8F1=;9z)zD=w(Yfr5 zeWRC0lc-I87)LgHGSGM+dGaB~SRfuL#^xyxUM7DC;xot; z%KVvBd+CIG8@|SIa;kDkdINB)7CzE$!Wbv`W6mAn1e}U^5u4J$ELKk#IR>JOSPuyN zmx{}~a6NTGqccIa$(xhrG_+PH9jwB}&kR@xsAWlYtH=L7ShrO2VG4f+w^1X{Hj!4>xcN;L4Qg8)?>&~-ZfodnoRx-N&7DB5*F$&(S7S2Ge#A8&~Nmn_+$t)%A zMJboOjZhJa@N}gx<77_eBj6>+cjQv189!#jj2J6aAV^2{XTtk;mX1rSOvoDea`iwm zfeedKJE0uwHA~ZgG7l>XclxRyzKx8SdrE3VQ;Jhc+{#!ZUri8Ge zx71EMOMnZqb8yS6{H?F3gQ!x4aWp_Gmmx%r@gOBLbt=bf6>WY{?v{zCs<=p6OH(_% z(3RVdvKoqDM&1e;tXEjK190p0m&nEhz~N19-F$Zd;wX)W@#P4sPO<$L35w@>qUknf z1bdVWrx*=3*_QRg9K``O=r85AqjKzW^Z+JO3!NSodxnA~7M*&SW4tN4Svf5(89Y^G z+3CM^V|;+kvt33ea>#iQYcjpx@uOr&us3(MblpE1lVo(M z>pSu-BSyaoOXg=@Kqz+)PcjNw3A4XQF7;Rs!P1lim1sTr{DnM5V|Nvz2Ir%&f5@5=__tx7bPy;?PfuKbem#Shyvj+UCi5=K+w)Ky+b zlB{%yWOJjNC5?7Uyi!$~=$cO|Cs%GS{VQM&?%&PUJ*hV>KmZ6uLv`7OeJ||HAJ!JGcG1W!# z0sZevKX{-F;;=CZj>}io!*6NY?ZE3Zc{VAVRHW^D2>4A+Q%L1B!fILv!2~L>H1!{j zGwMH!9t_(0RyiWO$Otqlq!2CjrxeKU&4W|0&GF^xk8*@INr#=(4;5Zf75O63M?F17CnQk5P^Px2>;D5| zwpku%)1^ObZzG+*LJ6g4!K9JdBNX!u!+x;Qwo7i17@E;9kv4=9A?L5`%-mIB)y@sCA+th-P*yZ7^q-Hks3{# zjg^p}O8LK^_}A(3`YPbxtUi1V|8JP!=Q;k5bApG?qOVIYJZKOO+WWyK|r^`KuOH|+>f9kRS>4c%=xGgB7t%<XT++N-8&KYYUh)pFE^5?{mn1y z_rTYao+qrNaYS>WE(uAxYHyt}Aw&~l0dO1^N0jj#j&~#&G6#93@|I5!^;ieT_Y@Mt z%WfzRu&-eUUWa=RE5FI=6aq`}9`-69^q%(gKYj(GscjMzj}yd&Fu-v^TxkC#d6*&~ z$_4hYBZbnGQ>lP>D`mbulv4ER@(7Y9pO%NQC6&1*?x^-sQvf(?0QRYLhXP6|1Gr(0 z{C;R*sos4%-o ztQOo3s3Uj=iKU-_C9jf=11kq@p_M^LI`m`7R|KI|(r4R0hmq%SFiYYiB7>BTX+FQTv-hVPAhEgakap^nd|{c?m_ zSY0!iVw|<_19T2q;4^x|O8kLW77Cv_Fcmuuotg+tAb}BNr^O{X$H8409q8g1V|ftG zSS)Em8rM+GwXmONiBF^`U_M`N=*wv$L+G2)fl(beU1P7LzCrz`9;s>~U{y?)nCo;s zC=l`h!K3H|;?2v!v6eqG#hWG63y$fcN&pWpR6PrZ)vu`%T zs9{;S-5j=eGl6~D*rz1j_o}+tDgYTQOnoSnPRT(0=ag`YRBNw3KLrYk3ziih9q`Z4 z@I;eSd_R>$f>2?yn6dS1fOq0)Tj4P8{j@CBT-#!y4v8HhLJ+EX3K7+Thz&qx^mB~+ z06DG*m$Yz$JuE97sO4u#WEG$SgFx~^jjX~|V8Wy-0Qs7TJOs>t3zo(FV=_;k22x1C zdZa_H@JgpQdH8-VlIPft@c^$M+6GWfQb^=i=yY6d~(ML=?3!*plR|T)>c^Q zHrj{@EWHcS6P!OT&Vrg*4^CW;6K&K&)aWvaOYnH$(s zhD3(C4nPw3Ggu@5{56REX(-Jpm_$%sKqpk%AEGf4rZg7@HI3Eeq97UwJU zmlUrEeIcf6PG+|O5uNDa;3^1u3gQ(9tvx0V`~l%hh)O$+Wa|m(Gs3;jhtP5H)F|lk zu5Ag{ZvW%{UZusDD4%l=%b>bQ{TtMHFWeqpNwO9ieTU`x9_#TRl)!bUIyTv>`wO%w zypl=~su9`5Q=LetGDo2*ZrL0ziwZM9L46#EG>o*!9I#X{g}J97R=)OD1>n~-dObLU z1Ch9v&=mA8rXd|#BPrF`g{3nm_&!Gvl>vH{-Mbk`VZ;@9xNQ&){mTub- zD*DeAy-FD+Q2%B!`N%C}|DDJ)y2VuVSXjcK4#-j^LIx&mUx#G~BU12ur z_brB__K?St$5;lKoTA5{d91>cGa9it!19Bj4Y0?CGcgsS`bA=hzBqWp%CappWX@{g zn#O65aUaJMb*&p>YlN*d0D*xRX&S-oa}a9)n_L(w*$iSjMYpK8^i2So@X$at6!Eoy zXr10;H4v5{@aieVrtz81X}CcGmc|;CtRzeW6=u2?VV#x;5~5&{C@h~n#A!y>tDz{a z!Hja5P(g^Z4wN2ol5`vL{1aH{l!;~xEHL3%X$FI3W%`7#WtP@!Ac<9?WgWcE>UhhWd8)l8lZ*%Aq$ss z%0YRNiEv`^_y>U~>FY&JoDilml&W!ZvS56lc?`*|%_w#&4S;2Dg(Y9RO)m)J+zU6V zWf6@eRk<$Kmz9V}iy`8I>b|8T20(H^xIhBA;2A)j0G>#HKM#L^NE6-yW~!Y~5H4T* zKs^?TNQC#hS>ca3*SX~~5+qz;()-Y!2ne~EHLhbn-r{4?+&#K}2@)Qw5W2}M^aLf{ zBqiQjqVOnk!E{9V02qlTW+Z2dARwD=ja~Q|8aiP&5fXN0l~E#xOA31$e~sd*C930! zZ`!-$^)J}#Z^N%HNt?n&I~c0aRRzKV-qZgi$}5G6`-3*Nlh3o;M>}1P_;-$8^l|MR46HKl;Lix z+B$0eF*Pjl0sA%7vYEg^2iv?Ea+58&*@kH)PohFXi12>WyA$9#QQ)F+A4jeS`~kD- zyzfUjgy%7Zbi&iYu=^5qT-`UBxuNcC(&$XYhaIb-#EpVv=WjEjA-;oPA*;|odl@G& zc<1*h{5e2o4@G1NFkwRMmJ?$T@Px8N73R{qYxLW+a0hlA8>@&CE9^hI4EW_b4>e=L z2FycF(GSG|J#B{m2?gpsK`qwXMT~#M05dC6`!zW{gext44L7vuNW68of5M<&FfG># z#FPeR03xY)QHqI48=<5RBus+#mE7ngyf+8Z^>B`;^I4uu1bLmUcj3q~JoZeOSPP|n zK*Vo`Nyr1gCE>Fhs3qHiyiKGRG;=)t7sonJC*8IFe3v0ChQr9Ff%t~3+{HO&0fw|0ew64MJO^y;j4gNS*BvyGiTgWf`Ur}wtj z>g5eS;PDUe&0~PYGPqHL_9pxB86-tqGL&j`Am#JWMO03g5d$|ZDKy~Ok!biDV?4w#x_MJ zGNjg;7{6Y#jd76hMsn3F>4bjuX5d38&N0(fz134|2mw>%M7O>&lG$Dtj8N8MYA}g{7z_k9g za`+lfurxbOgW7c?U29mFiB#*hJ|VA&k}|hV-qT1Xqh<`0>X{u{2_l>)v`uNq#k~%C zu966ZqMZ;*IB=0UcnOD7F&v!zWM(z>A?4FBLOzOo1wthaYbg0@5$mLwsIG!->}H-H zEsNMd3KAB+HMz?0Y5+(xqpbDBCVN?{t3p+%mN<`=7~Q7Q!pk}hXLz+`t&H-~m_(Ik zcmGN<;*aX%VMyrnWyX#RVn&0o>5-LYj9Xv7SzfmGrQrzIdiR4)jl(hb)DkE2>W|6nG* z@s|32OyCjkPAVfm+e8=%Bhs6IG^X#f#GlZRAfG{ zkl%JJWb;yXiSz|`TWCcRr5JqX>RKBYZr7EW5?mF;H}=yCn+Fft72XlKn53at-4mmY zmskwH2!@!7Tcxw0o)9@tgfjN7Vewj7<5zqe@LM?t3BqhhoUcQe4o^WPucD=-@Ch{* zQc;ipSPAi_lVdZY(1cscCPq#msySFT&m}X-Ybywq2_`#Br6%ARw@q;;Dva3G3Zfil zF(FWf2G+8rwG&)JL!tMs?z;KUY!8)^aNsCn39H2uweuus z8WP8HuZQ8!7L~g7H+x=;JQKbbj==RA#9$at>xnK}02dS>G(Z0OfPL^NmWLn56Xava znPm)w!ZBPNLN;Bc+Le=bKmFf6KA4Olg$gTZIDt6|5FjeMVOfG647s><7?u<=!Cm4h z{!1HP#5D%1(`z@dQ~6Pqpc0tW3Il;VFt_!_y8FPj!JE2hlAv{Bmw_&vy$2s^2m1sv zhhgd&pU|3uAwpl&G5PR-austfK`Cz&J^egv$-P?GCo3#=1PD(*PoApFGh6sTF3t#6 z01HnGXR;%W3rOq1)yv;)AwxhkkSzEA`P+Rr*+hu^HHz34!ODD`AcIK5#o{7t+=~yB0*H-uv;_N()>&>4Bbs!8h9}e)g)Nbl>*eLhHF><@}$D zk6BI99B+|NU-vPHbw}`K$q@}&C*ahcPY!Y*AkL>f47zwv3}Lm@y*k*UW-oPBF1um6 zd(@nVUL^UoT@X&(kzaYA-U{L7JunswJItw#RkQ+;g|9)N5?%PICGw;nC3#4bPs4@$ zyYO`p-FQKWPzwJpn4h@ZtF;~!^u9c0)D}d3SsP7EIO{?O>*Yn%VbMS}iQamHdJeIFmX(kNU@~_vuZ^Q3ql7Tf*4Asi730Wq$-SE%>;e%YaNL(bxFXDvBtgh97EdB2 zr8!-E+y_c6Qb;q(Jyetwey-0@aiJ=&qIGv8TKZBBb3*fsuzf9D7Fj^zJP^Y3^3z13 z3W_)(ZS;h3B1}Mq>wS7OvpN+Dz!}lRllcRo5wg}($lG{VkHDsT9rIMb2n>IJjlo8p zf~3o=!+b*Dfv!$*c>eU0TriWsv|2OIG)wd!M4~;Q^6BKfoJhMsK0~Qm1E?Shr2RXq zB`5+;1Td5E-S6#bDV}0!L75>-PYGX%t%XZb$P-!X^e~9H3J|AZpzdAYkjW@eQcMjS z0}M@2(XXTRumn`-vjri}3$Y@zDSn>@3rpx%S??_ zZRib$^*W8d2bd1gL_%rZ6jFtvzbeqghS%V;cFa=P+jRmHo{(9Q2lK>r>;mbo393&9 z5tUZL5Zz=jr^Dns3!umMH5^MQGVz_Mlsr)&3d%z4Z=Y0cqp`YO7JjmkY#uFfd|jIJUK?2$o3mNBBzv%0$gNbw})t6 zqt#0cFUBr{cXY3DCgs#nhxf0Pcc7;UeNRItu7e0HN5GU3Y5kJNlhL35d`$rZ-C8F? z#J}d^9$+^saPQ^e8SC_rT-w=TAt&PlYeN|hblzTAD#h6WtkiW@Sj?vYj#Mv$Dbe5V z_%4c+w-QQwIlq2R@a0|;;&ni7jAcpbLRB9LnDW!iVNT$)H+i~LAWg2#-%IFoodkk1 zxx>3|f0UwpunM>gDYn!jU8KO|pBX`sPI)bdj{sh9%|nV%x)SnCQs9G|F6w)FQ*KIm z779w9N(9eRHy=z{7)8ahh342oeViPf(pLdX=X5vEx9aB*^JfOV0J4uv3kR@`#L1S$$(kKQoLj&+2o#};oRvTFA2ad> zh{$p%Ptn|%**pDkIf4c(20;FGEnt{Pq!~nu_8-I($?V|GggT;3{V`B~BrGBC5S82% zo0ayNh{O0_6o#Kjq)SRGm!}G%6@P{;(nS-4Puh$kYfASrC~W(qqAKpgSNtzqUJmGM~{4x z!(&L|U6sK8$YpDK1|#~}8&q9Bn(;L41r2&DEtYc2h>A@SW&|QIBf=T@=ieC%*M#>E zjN$l85Z*3;MxL>ol&d#~M{pRs3`7FQ;5mjohM^x;K&198NOd;VgFuY6XofB8crFmb z9Dr&7U@B+|DeJ{xIsD{N3Prhc|Am*7pt5YFo$>aeqEh(4Di_hW@u!i5UIpsVQHmfC z^8}hY3#9`Nf%^l6XL5{rXeM!;+e0mE;C_gq3`949CUC_Nwi}Xq15{-o@}gL?8#A0N zJn3^>M+y)vGKAJMgwJk_Mg}c@-6LL$Veo;HvH@6i7{2Q+3MoAiH7mk!EWKtFqY)ZD z62icn=4?a6jFF?61et8THN9rVJ;e~JfT;iM5cVPo{9|#7Fn9n6^m!sh2t{J3xzX2$ z6RAp&hQc=L$8JFC6%64__fo**|7pW+2c0zo%tq8tX~47%0NbA~o`-j&_n> zrLHR98AF))`xzb9oH3khPWBOEe21qi$eT^H$^W+WEUK6 zDi@8USVJ*ihtQTV;b@@#R?;3dqZo9^lETmx>;TLzR2CCT1fZFhP?THDuS7u7OA5q? zaBTD)MAKZpm!9!>P5OX`Y&P$&4vVzPkm1&}jV=08~5>4p?panr}X>m74q$+3wI}s&< znC?f(J$DH`{BvDGistK5meMg0K3oWEZP!;7Ilpveu7wiNb(pynh%M$Gtz?11;gX{Q z-g8{bF-&wZ+J!I}by0B1y&?mvOLwzIf=JVp=TF`27s+UXy1$? z;aUjBz!<`M*e(l9tOg9lB3O>ee?PV;>8;@)v;O+TjU#*T_hetV<8(u`Cj5BhS~Jzi zF~z9t?GU}^7TUT+3gx{mr-dD1P^6AA>fCN7IuMFIB}yuHON}E za+QbFINa3*-_&$>`}j}B>X8{>Lw^b~jXpXoG;$a)O`zw9>Kk~V5fZy(G%aX)tr$>C zM2}_$2?)VifY7D45p1wYU;UO!L5^*~1g#&N`^Qus6!)FE&mQ*|$LRiQI5pMZprU&c zA(i~Q`jqBv-z!HI!-=y9)VLwYbW2W2Z%t3)*B>(eV_9JT*$QbDD|HzYhYGrk5 zb$WXGpU(-H(*!}Qgi`>MP+MDTWo3mxAdpC;r>Ez{#6&_u!rI!Jpr@dxryvG{fgxad zd3l0JL1Zlwg+d_&5il4GfkX%*{|W0PBq0B-0STT69fZz=j-a3*G7qVPn$W@MzyuM1 z6%wdLA$5=lD};`f&OZSE^!(cefv{S$0#H^uYdQc7hV-lzLhq}6}Y zj3!ulqELc@|12N`VgD5Az;uu>q#(uI%QcBNU?PRX-ICzUR`b zFdO_-Jp4h>b|_1=zGO60{Kdi2V14O$E;1CKL9L-|vQXtcxA{;*`BbS+p<1@u=Zcw+ zM)l6iL!Uo>ud(WhW>9aeoUeDBsxTjJtXgdH+#JeQZ>nBy^S?M)9&V~x{eprJFlsc{ zuJ=Te^H_{D*KK}HU{%l2X!*1~oc7RVWu&EkcRWww9iwJz!~Rs6-bahk*3Un_*V+!} zXtp&TEjGXSu`=4$bh3&Gt@lkpbcJFQ85tRkwYR+3B8ui*i$$Y<{+O$GSsm+W`*pH* z*Yl1^yYtUW!tSZxSvt%uSWEzy>s&31d>A$L`H$7{)z@J+bO3+>Q;DGDz{C?JC={XC z-dZT^3DixW z>QV`LE(Bn!m3SofgRKO`2u`cFOdKsq5R%$j0H9MuhTsYrI&G&2T3GeqKYG%%5JG^u zVoOp>mC(h)=S6nm3+O~`XL|OR+oPzgYHgjYqVa%qhpTc@D2Wk(#FcEO+0BpaRAt4Y zUJp*hHhx4(_A_zC!%cB!l zudSvr`R<)D2K@0migbs=weIsn#e^?4P6B9`2d@#IQR)nna~VOqv&}yyql5G zMRxpn=S&`e=3R_Q{W`oDN8<2ZPAF2liA(@_?WIGE@)Om7@^D_!&9dU>BszMHM&i^`WuK~q>rP}a-io87#({I`2WAKY*E%R*nja)Onu zd2iGb@LbG9N$2QnrR-M!{{B%r`Nk}>l>g6ZFSW;?-HvzIXe{Ti$A3Nwg-xJr8d<~I zwn(pdttJ-(mxH$ll`q@Ox|lrfZ}zB}?w=FeS#@8Wex>aq`}|zG>6pyqb;q3P8|{X_ z?@d<~`l&yh7oVVTH4wYdfpk1OgtJF9EDLJKj*pKCiR@mBhO>#%VU7f6BnR$~v60v_ zL@0R$<`wuH4BXv^!jH)(eEYR~gv|=VJ(LHnE9#=YGp>D04n@8b7ynEhR4d3VGJty& zAy3IT8uh0q_uF*?HGJ$e+KAAcNMNdy{$N5$u`&<#5!x%@UK>OGu)sRWD1kl4^Ud;w zWhfZ-HA_O}4aX7L#7o#&2p|1HUG)zX`!3$l8#y}*o6h(-=VuZZyVB@%|jY@fz zq1LQ&OKFe9uj1Y33kw-`xrT7|6W?1c7RZ}jr^=QHBn;3M@q|AgP^d@}rt)WE<$2X_ z@oDd^yeka;wM@=Bdh&ye$PU)477e3tlplI>3#l_GseN!5I9ItT%F3y%qdOHCd^yZJ zsytxA@0oQV$;P5k7_!4&k=R?wCdhQDVt4oLeM}cGYgodKx&w!^ZFVc-15r`r1k&&z}?JSH<<%mW%D8ei4PNQ7SnmvRN zs_zcz%M~S6o6_TND8U;oQTT;D*_k)xPaeB1A^ja8*Zt`Qg)}$#;VoQ=aZHcQ#OYya ztFG1gRN}A7QbT3hN?Z+r3~&mrT#JKF_(pOGj`TKz2Y#pLtw_XYky7T(14Mz0iVsW| zp~o;aW^{B~ai&-Kq9Ep1tJku%y)%_WPk z_G74UjK??OqpdC2ojSDPhJ{$&sV047G&r=PCMbMGOkSs#Vpm{?ZI~8qP$JXgiZ{BT zc{eXo@4o%+xs#Dh%aCqEp=O0sU71N=^Z4h6VrTbPQF7e}h99G_Jlr7aRnH%bRgy+k zPDU*1H114(T5;Cq_ zOeJ39F~y^YOY<_bMDa%;--zLm!81gb+i>vH@2h+Ak5XU#tkJdHPw%w(m6jYMWTnb& zi}mhNSJY^AX$(f_iB*%eE^?rhQP|fnNCbN#yv=>SpkqAaNe1 z7B^`8i+fY7Qr5_1lKk+Yc50_Q)=b(Ki8ensF()((^^joMkANfAGK;giP zKtVfK7sSEUJef*MTVs#BbMFj&e@iYV|C>{nq!ZZZkSn;#A4r@_s24w*M%~6Wzjex{ z*7*B-!@p_-3Kj80-_@>R;gLvu=9&<1*VkTyzOC$irX?S}*|!0Ym(Zm{G-oXS*%6PQ z0MqL@C;pZ){7C%h6UnDD5UJTbuVqWi4^yvn$-DaA#JK5Ft)CU9cLzq}t+P#IKdS?? ze^6TKRAGBA=VoT>(K*VEeIL7OG&p%)t3&8b^F_P#^|M5?J#wwc zRXGy7Pk!Y4)nD3&Prw(WrEM3ltgn%@o~OO9(oKjX7>@fkJZC?eed-FAK2MPeY@1%W zI-tL|ygCd_xI6IwfcHVh$hGwMX3h85nn&mI>E>J4HjSSOMgDGOT7J-3P4W5OXs??a zFExe>_X=+`JSD|hw=I>KuWnLQX*4WuFw9p(^%F@@4Uw2d3-;J@`OB^-yiPXI!%GWNoV9)m5B=dAy7fLZ zUsQnt_e~D=v+TO3t_oq|4yGd57Qa96Q(zqb?!tz|LZ5M2zWC~DbRFW)_A#PxMZ&jfj8or9^=gF7 zzFV-5(+hPVOAT42RvL|r5l)L?h|qg6pga-zlI!Yqi&*6RK;#&^{vsS5 z>U9>~6Ee-D-C%hNe$zLR0!|p?N z_y_cS`to%WWZ&h+H_q62R&mnk80$7idSJi zxWvzSB{jp999(&omKm7?rZqcw z+qp>m4E5pfY z0Z;i33W~iFgm0zd9u#<#rAj#Gb5&4rFBAe1wABxb##zBnPIFa!3Y*>+09in$zd>3H z1M@-dzlyC|9m~-mnp1tMx2Fr`VL&Xj~bdKbO&ocyhJQb%yi)S}W_U`dY zy;|vp$w72Rr8nN7Cpv{cdrH`bN^AE^-?Y-f6U4$Y1RmCcsq#wV3QKX;i>(&Q-8f66 z`h4Q?%ebw?-#haOAVHC>aM?z9s#rx$B0zyCE3L?&!GQbI%K}&`YVpg61V4tFeDwYV zqMEQ}C@fDrtLV6;?G*ml9l%A6tTe=@sj7evwN{SY^6&t1;|DD7Y(Z1BG&33S@6lBw zw*Y|-|MCLMfjo%Us`7(Sb>!3P9elcR;g3rurECd&i%Gl#_%xR$HMQ#iQ62|rLQQB> zjm!ji!iVSYEgZyCTPIhGJ)Gz82!cOcTfkiNmb8wHhYp$vl0kCe20Gt~*g$FX{@wT0 zMXc8`Nz%bk92B)2l2&zf4QXI*kH=Mu&w?wj0RbJNhDV+JU9zj|EB*1M2Vk2X^ zc*=DDw8_tu^`Z+goDWQP)z_gL!}1$lc<7(Lq@O_3(|R_)5ex3lP$P2iLLWDHHNOeL$2N7o`8Pv2leo9d)s=uJy}PvP{(v8 z-RwuUxnb&swvMLBjsd#1>VTIUbfsHAT6E|<_cA**>N^?FI|4~NPbKNj3EGY%X|4jl zkejxDcj=tH?Yx&1xXEO^{78LgimCR(bnsxd)G&luY~(uhaL;D^Q;4h}m`M;!JJK|9 z2K1e^q{RlGbtb@%y&E}}>bNQgN`*lBwE&Y2mN=>}rG2P!zwJ5km-@Ni?GzA2LpMn&v zuy%vSuPgh+kx)o!f4tYQZ{qOj5>@9ph#nZZ$(s0O2G%}o`hFTas`hmU_gSk6<+lp*@9`vYXN%H*9XB<*JfY? z4CM1j1#@f*E5lSc2qc#P!Hu0#2_CadfatG{yWmgBS3PC&gsPg)+>Ag4Cu(IFCI@M! zJdlvC zcyT0 z!&A}KT~*~GaS6#W8W;d^s+vU}uaXw@!F1PcSH3F%5G^-qK$DuhgF?q*)zCkY@IEd1 zmC?5K`|V6LH0W-VJgHBPc(ZOEopQyuv^T2f+lqQdkNk6Jq-7Q< z&ig`%*A%Mv!{Vk?$1;km+O^`SqAfIO=A+KibdHTA-oK`SB|yYRckep()9<(K?&sM7 zNZ#01p5(#vrw80+2mZMG$sgWU-mhg&0$lF<8T@-8{9EH=h^FJi+))ry$JWCfY78Sv zF6!-|@~*S}uGQ2*>KUkx|3~KW?zhg3(dy%LnWG$YFcXm1vhl;A?uhags;u)Mi9KCG z;rLJttKaR%A@Rw6^)dFzcTK^C9{9mGmlJ#RiTqBSDo6Z1|Dhk`^nD`a&QkF7$l??+ zevBI1XU#ngzQdBLjf*^{CbNv85ZHzL9sGHHCRcctC8lBY;k`#BCb_UrBUJiLP1(ul;n7nfL z@Q5Ul@bVyk5l`X!cRAQ{BMpQV`sRi!7@}i!%~y9F_4j5f?2-sj1tuR z2857n$Pg?dM#V@NraOcHgzF=Y*uX?l($F?s3$8zjV~{2@1CU+HN$i?Ais@wQq2UbR z_AnZ~9gPf8x0T*>z1=Z@k^UY^tG}mHpcKofl%c<`TY{t(cf_n?^eYUiEc!AGei&Ap zcf7`;oBffD!#$d#l$lxx1_-7zvQ^G(dYj31S7sckxq9Du+z}H>oS#^AhvR*Mt|jf- z^v5#DUg71*gNIW1Ec>&JFC50QrQh5W0+)N^l=S!9o`Q%9quDC+FA)r;Ja4fh+*Y3q z&+@s)`EGtY`uL%yKPE8zLW~Z6)iV0Oue-;~|KbQ@(keG=FcBGnz~>OgvTi9Hrm%!| z4sOBP?)o{G@utqbk0dqMkC(>e6BNnndf)#c7gVDBXu2m!K0`qI2$#4bFABGg<>1Lj zs&7vlS;+i_20kxz*KqyX`n|7EBtxMq%bY8MtCUS&5H&@i~G}HwBR?z{8y#71ko(zt5LQC;X-=c9)+lT$*clORg^G@y%O%t967JU!?T$ z!;vS{!AIC!gv;MF)y~?J*`y!x)oEve!||r&lo@K3v^*3j+L)Y;E}t@(hbN2DCy4)4 zQqOG=m@y$)@c9mw?ogcu!q|PM<%55!Kid(+9e)ZmIA3ZozFC-LepoJzFmbIJon2u3 z$VD)Z??IWwNxibv{tGY0DO+Z-wdGtcY4 zT`lBMTv2g7AvvD4j%bS2(L~*_HZA4xYjK&!rQ0@f1g~#Dvq(}u{z`dhKROcB1qqDn!ZHe~J>-|Of>Tg^AtHC!1 zN%j3EKZ4s+4Vq&$L&idPCXW%Pb2@K+T@iuj( zclM(;o?rEIoXoP+s+b#>w87)xph1ukd0-@W7~<`S^ z5)`hO#wez>B7Ow?<%zm#H*8+k#0$DxeMfVIP?qcmNCHz8v|^*5eYuO}e{=aeZ&~VE z>;eW-!TqBSKpgnND_@`CDCR3uz{QS5Jvm!`Fnk~QCBAaj8#2>_@J>KMuHCe(2Y#6C zB|Q^i+ZmTr#+4`3D|@WpG9ic+#2i)RpGxC59zn6Se#Julq%M{yXyXU7=4-AF#5p!t zu(>NX=4(AMhnMLbZFcX$bsjUu>WQiTJN(IzK2~%jqEEukGv-ARn8Qg{5W1yi(*1r} z)IFw=V3l2NyY0k{?7e*^J^tbV9nq5kf6~BN+#g)6>@tUrfj$X%tTZaz7L(Cu^XkUWd~dVYu4u6hpl23UmK)r(Ax$nHl|ECcm1 z^;$tf&n?zAhkX|I^NyT$-%-^9{*B5x7p{aN8N`YFdQ>g2BT7%nfCtcAEO zR-b&3mG()GjmS~W@N?@-snK-W;||@S0JYJ-Aj(GyBF-jXUqG4JeipUWY3jvK<(Kz6 z$@mt$muGM``~vL<-4%gct*}gKrg#P@(hPsv7_CCT__E1 zbvis7v$le`-fl%_rKgrjzU?Eifw!5=HePYYb*!a^OjHidrt;WCvN)vRKl5r#uFuvi z^77tRvD)x$D4MaUB7-g-YUF{&!`*#~CCv{EzqfwxbNBn)W`1xl6p_&3K&obCdTvn+ zl_)E7*OS*tf$P_tc&)Ppmk)GAI3~h0kIUOXTHF^nYm*OvNQX^VShuXecUYVrke6lz zDO6n~GIajSkzo&dy)elP^5otG>p%HLyPFy;UQ0;XAS@0*f@z20u>nxHPGm2awEzZg z#*Fi2uK%tx>C_tmgR;at>${WkfL#S{#`hYTKNQo6jcT`3+fI|f8vx<({@GL_LPM|} zKB>lJ+51GL4O>!uc%M0iB2h^nl5Pdz$iSopspos##G;bcrJmnMwn)Gb_37h>c_KCG zV~q3Xxu8w^hUI4yZ{t2TpPD%^ofwO;r*-4d3fd`BvrW9s+1J4?=Yc)T81T~~feN02 zSi+_!tGhs?Txw3*c*iGbb3yr+O;gE@=4Nr_4eua+FO+nnagL9o z-eyj0YBiaOtmuSsY{__6G@H)zvEWGMVd+E)69<@2ldYj3swjB^M$eOk-QS~Fa-lB1 zoiB1o?4e9vf~}j=XK^nxIu&Ye9x30m?6RywXc1tX%F|Ax6bwE+7ntH-kWQ!~wa>uJ z1rQ4QefqF`_*^+~VW!isv1$3pyhVf*iro_}b7a&x829ia-xlLqR#?gt`S>sflE0=w9`(5_9 zkeX1nvMl)UWSO5%;_=_mFQ;_Kk@vE{6);c@H zLlh>1EfQ4`Lf-yR`tV`3eH-$NR|ol44dE7s%15s00)x%QmTxNEl2JpUFGt?hMeoBy z71YH9mH+fkjv0NNvRh~W`YIOXXP(`ORV?~yo^5(?`{2<(weW|S!EkqMI%o9?L@ z?m?O{$Xxa)Xh=%3Df-g&DiP8vDE6vQ$RmAvqg;B`r07(VdsXxmfj`CaJ&NyJ6~#bO zLuJ5W2H~$BMa`vNg~Q&X--Tl1)td#Y+G~6e=aV0*t1-f5=DG(5t%GYqafd~y{ zUI1-V1ftE88rG8w8u==+q#RRQ6E_W80}q&*X5(Q{|Ll^_asBMTWlSpXJ=3tH#zKBj+?BQ2BUO93?Rf;0|_k|#S04(f3SQ<8z8Z$r+0L=cV zVFC#z4c6KXwS8EdVv*towX!iJme1}G9h)Bu3ptOoIs zi4<(BIvo097gM7snNP@1yVM*{K2UEL*Q-zP*-o7%VR#@}BcgJ+O``@qrG}Xv*@KPL zvue~sC2$W_`gn!nNJVKqK?8SLBQtiRFDlh(9f3f_hLNR_g{AU5LUkR*$Gv}K3fV?8 ztVfd50OmXph5zuZqSlrMh&>O4jS%xK)Lcv+)9%uYhczwJYvPLxubK(^mZPx5K{Fa- zXY|@Mo?xQp5yN+5`*zxa3C@fDjCu02maGb&uMC2*-+;sd( zWWxHDc3ktAGvR2%|`rv0~9=NvkL1=snxq#m_54554q#Zv##E<+a6 zS2z9dHkSc!85h?IMXobISp4)n2uuwJ&5wKnGd$ft9O)dZ?QYeeDo$TwtPFK*e7HDkAcVLUC%fL3A_$IAeY`ozvpm9^ ztwrA*;md;`I_5d%|74BG5#pvt95 zlDns0p!(Gm`Vhpl{E>h_Hj3STT3bnr>u5sk_mtY_Y3OJ?`HVi9`ZpYLv=G*eQS1nX zQK(FKy{@Q1cI&i;xxupcB#sWmn9^`oBUC(ApIiD7xZ(hTBghVK0Y7w)WevEkq} zx{<{|)nL~CZrCAw>iPDkwU`i*vRUs~4I0d>K#zetJEcdsw&$pDKmD^7Li`s>sBm%R zw~o3#cUbklM{IRA&+zf7^pD^M;omih$R4E`Hq+xv^?i>BGV-2&#%TaHwHJOf%9dWI zulAEXj)*cu30FeW2uU^o^#ljR&IM}D)0!Lm#LPvpPl>{3=z5IKt;Ykr^XS0F7D980 zKMlyeP|uW%KVYGR-R6V%Oj0yWqagZi>D$%ynxT*osbrCzhADmsfr+uVSsNQLe1BuWX2} ztVmDqpt_?f%J9U|GYw{+%omc)7Y~9>C;L{$wwHc{n>HO;oTLnwn19OnnIn8&APino z7hV-eLi`l9JZM-B=`)8yP@A7ufA_8anX%l8W#g(WZ#?B-Y@Qm7SxKp~*vDEu!LmFW zT}l;QD=M})4pwVnSZ!sPwx!MOV5bu{p(ie3{$-vwSGUmRGrP3BO8#V>Vr+HGe56k) zy0i?SMrhZ&867g1?-QA0&pyMcwx&(hKv+GbW3`<1wWR;H2%}6hoIBQr5_-qaBw-%nY#(ljuL1~WdK1eYEu+VMH zXl_(6XI)XQ6UCW7KR0^qwGjfFKdIP|~-yr8mivV%+w-*(62V+*hp1J8TNGR!-&TLUMJKcCMdk2eD?}u?*0$01VG;vL#C=|B{&QWK)n8TS zWcP+uRSquvcCKSPYs)(g$=0)M(GQ7Dh50wJUmFjJ+FGtyFy8N!DWVaKb<8Wa4BpFC z8msZuY)|ve_2O0&q?d|J?EkRuE&E2IE%rmMmP2JSsV2}{F&1i#dtTTMLn(Wf_e)1d z`?FAVKf6#|1Pze`2fFY1oOwxtVU{e7nXHUcPPT(()lPbx6Suol`p#;`6kzoES)kkQ zhax9}a^u>79b~Kn8rSaWkn`5Eb6&y^@HJjb|4wy@%ZKXKw#FYHEY>q#0JQKQ-TcqD zq(G&y&k6eVA;AYSjFc}$mp=AaR>`bX-~UKq#OI;f8(DD~zr%K&82d5axLWU!0rj`& z5qmb`rb(?bPHE>lki!{Nt~uCg?ntzkw|2O^<1%`6w6gPKZFYHr!+n_FVyZeFZg@1q z|DzPTK~2t*kEY?@A+)sDh&KZwe_&rvLJuj=9v61L2!_$Fj&{XV+4RQ62 zyX$Y6nTppocMkg({XdTHfBdC71^@B{pLnKLOAzWzV<~%;O`}OY*Qs85&9;K)OFThc z9?2!HiSK>@k50~JJz+Sfq}1+zsg8du9mhXCp-{f}{t$G+=Wx#P@|^Qa%<;g+geR`R z0GKA%3n=&c*zd{m_mmmuTyXcSmH2{`+8f4so}qBW_WUBk$89fFAE-Si81s%~U0C3(5R6Dh4s!ambzT>>nF-^qt#(_R&8+|JHc8!T3Vt z*Tv+{p$xU}2*=MNIyA^{&NFA-;IFpB)VZ zTp60Z-mCox6#Mn~r8dErORv>q*OxEdv>z+nJ)h2%Sh4SO<9h+MBaZ`0kROu`E6R{nJNcZun*m$dlSJp4$9G_7BDrJ8K z6Ma?ghA4Jeb*O&Ma9&_%bHHKv(ro-9qv>{&vH5RDISBVhw&hRr+3g=n&uhQx(W3O{ z_-|EXuP*F&N^*BAD2)Ph{3@=VR|X4hcHXu(*;EFcb^Z#R4Tv828IWqWS^H%@C)ZJU z`&of9o$+(}9pDTk`N$xlC*xN}F4x?}U{lVvNx{tS5qJ?6L`$UO)ue@@)_$D}4H?d^4^?{`=kTY`IWugo*y{c#(1nnP{s%mu{X)Hh0y($Y`t*8)!BI zkf4!To3BZH1ms9`0~XaMrH^-4d`r#VyVbtxzmAu~J?A(2hG%%!Fam$^`IpG#)o>`J zgx#eQs`{ennB-scw%GI!q%yoX_O}UHpD0l7Nmi|AH_Uokbt^JtcrY`gX|G*OWKiK& z_B319o=@M!u$!kNgx&4WwPTyx;+31$vzm)N-_`RJ#%JQ^hrD$z-|qpH-BX+o&q`uy zrIgN71q7&1Eb@}Dmv^T~Tv|(JXF5H8M8vkaxdQjQw67WxA6a?)F2<&R$wm5%DU38} z%h1=!z>y(>My8bBht`D4I*cg9(TGB={iTg5Y3$oXg$GX}j04_h52O*w$M~~`{mM^W zeO-0*Brm=Ot9e0JuUxSA7vxL^59{##>b+~sh_XmNW-%MevV z65$d55?i{#NRCV>8q<^J6<4z9CnfxfGw0PxdR`7vBAqRGFT9+#3n^`!*5$)EN}a5vP!k+wwB>lVWqBn4#3rl4c~#>Y>pN#<9k*j%r7T~X zW!}ewXx)_LW2Kc8j7>CGNf(*qVOn|TKI(9IK4XsC9EPSj<36LWYsDZXYK<(26=g}#XEV6zEx?qvEH|{^(C%h}#c|Y|&ajvZ4l06Wf9lAFBn_+U9FKa(*s&6kt9-Xva{N^tG zbCqF;ji10AgiT0-+YAf8POmYL44AoPDXY8UI|>f5$@2@aZ&uQD3ypxJ4IVei{_r~W z`8&mkjkESIGFgMS&Sn9O2%NSHspgx)}PSL;ON>i4r%PUa=DxM}4!zd(-#j zz#!VWXo?yLy$0ZWK!hP%B(arF1cDg4&XzR)PAPK}+3-g57K!;-vE` z{;?1JNQ^LeKBsEW$5gPjCNPlmxzPvq-tXrRx5SK-+FvCpK@M&?kr3_)G+9F)ws|CW zoa!iE?Kdn3n^J$fH83qMGw9D@fv7;lXyC@whg;}|k^=WPf#?RXJb+SQ9)iOFG&W)6 zuF9tVc&s-?!VNvKifx6SbLx9E%pZUNYf$zjtzukE2(cM}BE|TWHc4sn-x=sl1+M6` z|MuZF9G%mnw002M0T)Ea0LWuGVNq5XI4-BsOn9MOhsN47{wS(8;q2xT%&d<7>SaVAO z2{ex5`bR5q5PoFqm{>6YeT+ntHv<417X+cY<9(7JpgDTp*wlH)=Sc%qTOxbrnqOQ3 zAw!|DV=%dZco$w4Dr7n&uXVPA-_PT(#Sp<%zqD?@VP(5l&B;pU4`e9i-CAoZ)2`u{)jVs^1!( zUNhz>STMq1W{vQLe^u*@W4HpZ&8kIn569SIlpcKpD89Lm|B2uu1K!Q;(dPa&o3nQ> zDmU?8H`I&W*Exz2ZZW^b{wgW+DNQibDy_C@Vd2zEV;fyx~JHqdb2V6NW(x-TLN2+f|js5DgKhy6@T%>>U9lLmcM(D_M z(lQ?5_bnHv!%mJTV=!Dsq-gp3<`b9n$z;a!Le}6tMazZ$)Z>QOhgJJBFKDNQ?;FbP zc@LhBw@jDI2vt}HZy3}+9<5FleQO)*LOj(vYti|$`i`m6MOxmfld{Ysm@n_p{^26{ zPt^%zM{?9Ev*>$gj&N;x)tdEJ0nk@NG#0ECO%#Rz?=*H{eXBb5wY0+7iNoOcYof#L zFkqruK9r@~kqfKD;zFE26W_1z*kN?QRvduGk3fY#Y+omSBi>8n9zu{72)Q5m=l@6x zos-N}$*W&qmgzj}G*N4`6UY`y#48&G$JX zk=Q{KAq^W+-RY1xnmz7cEmP*zj`>2QB@6hI)z|2ae~G5=!@6ek-tC$MOuzcIPr3EyX;%!yftiJzyojUO5;^Yr?(VII_ z_bm{=tIZE#qD*0r&e%5HY5|b(qm|IPeJ@iDhMQ8dZhKHQ3e%QCZ@%BPaQ+ zAaRI`v(@9fIjD&e);%fq-I!WDq1B2n;>QgIfh*=Z5kWj_L8yZ6&9ge$hH1{LZPu;9 zZl4eYXkGQ?5e8V@NC8;wNa82?7wG`jz}LTbYt(l+q*UvhUitU|)=wR+)XZkcZq5GG zV(=sLD5}>F=aD28v{YA5VYdU+R8g;S2i!af8HoFm_VV2?u~GE-U)ikxq%f2B$3g4> zicid}vpINnz+$lxzQr1>f*=Hei#P~lUs#X7X6EF_!-~!i^~_^-$Uc!mkuF)WR&VU| zA#rO_(EfZ5CuS^no5bs{dboI8EUIr#zv`{A2wWAAMsKJlSU(7u1vw}~Dghob)}wU` zDEAzja5x|KeWB=zwL4tZtrwf&zCa+N;FNSth{g7>76}z+ee9QmXM_~#|1J`s%kHq* z>bMynWXn%Gfc7txu|NoAgbBqJTCf*-)nZsm3gyUF9^YD`ItpR4`EO2DIc^KYUT@0I z7b5PTh;uU|lQuWXkaCP{DoNRRt|<9VY6U-5QSVKeg-z)VmN!sVsRA}}vJLFpx#!t( z%iBd-$6L5u$#Z1@URaS%YBsJNQj+SsYK5JeOp#PSTS6I|hFFpA7+ZDZ=JQ}ZaeI4O zJUc(nVryPB5n-`W-15H@CxX3LU9DJgwqFcCKM7zJ<7P*rmy#*xQ217GlY48KZabOkEj}9?PKO%?1;1k&iU_NWWmnGet?*J<(%azUvX|bDy`($7He7EH_IAQcMUuGq z$nsmvwstD_xE9!iJGo*q;$ocHW3kDbr7(C&Q0%PD(ASP`YK~znCFx+Nc<0gt6UUbY z`@!eWze(&Qy*4r(&ByYKOQy1YXXy0c=-msmA&bbJRH`TWuSe9Pb|tLl3xwc4--$-=l}2yov?HNUSi_ z1s+FeL_Ks>+M;9~66A5V9pp3O~rWXPj4L99Lu! zf2{RBj4*Uw4@a`am9}&9bYPctY`7R=RbtLH*9L|!w@8L%INxKkb_fIpv*$lGx(wNaWsN4bX zwPr4d?NfW>tAPN#a5@ zC?~)-?tvfn$EsAmT9e9_g9C5>y?HW5tmLB7)JpxI6Q()5vJOS&sozJ$zOD`t&R$l1 z#&;HSO1DY2j1b-luXbyzu6iq9J>mX5acl)Y=z-URDvgq|9UC^yPh8*RKb9M6uO?N` zrt#AfxxzG2q%p-h?!5EMC8{RwTD1h!0RJs3$z`I3n*YSoLRFl@2^wQ733!x0$>9*x}UU-P`a~K2M0G;N?HZ z`0Al))7xJvy+5bs9A)sS!;~rk^4z*_N+>HY9=fJFx}F)zIllKJ z*!Qnl{>rdZE8FM(@d&^cG{icCKQBJ#j{lIPcu*k3(zJv>m)axtiB(pZP5Bd>wr~%& zLDyqppaEp+FGn?ScHCJ+EzIX(!iIBk4EL%=gS`+n!u8_w;9hR1Ba&s@yElrLuxM>RhH1s+tI7G%*sQndE zZ@NtKI%)v1^T=~)e#q90Un6YhQ>*o>|+`N34m z=%RcfV)pf?wz8Yfb5Zl}qI9GJ!{Cb9Xk(@Nb<5JK*4xUKfJ0n&5gYZNrUHITMxTf9 zeN*K%Efzn2z#QhL8e6)EY3_1YziwRE5W{1tKnsVaG4pjj`AEaHD<4 z<3#7V`4{+q9@2oeUmMDtyhQxGed6N6pGjK?iH zkl|a@S?&HK*LT<9H942qK@&7z%kzHanGCRwR{bxhJJ!>Yzbc3y_|@odv#gHZ5hVDYNS@NGjCbFuJq=4A_spP z_Q(6l2X@E)C_ft@S|XCJ#VgZexJb+5<)CbezXh;B*8Gy9n?Jj>{KuG&-iKu@sU73< zo2XC4Sm4_?ZC82k+@otWhLdz=xo<-rwidqIPGQ=wslX3w#oLCr5Z^pj!Bws3Xr`N$N-?q< z5*mm}maK=dsXs+0P}1|b{)N`xYIgD8{v^w-@4)_FYyxqMn_qpX`I0fw6xv1#^+6gfLEkeUH7ZA#nxoR;X796*1t*Qnr%7aU493*5dV^V70FwUVN_KJ7H_zFu}6JY%0H= z*Ob9p<4Ejl{Y!>75h|kc@%Oq1+i`sF{##V&$NQeT&L7X1c5*F{h3`stWzK69v3N1q zp6w@JmhcSzj_rYgFZZV}D5lf`4V>A2HGNSv zVnkLVm{C@8p*W-*`ppT}3U9GA74tAQ-M~9)A&2SaL|f%}Cb;4)|K++XKDQOtiO9)5U8MLLksU~wP;Irc=yPLPYJo}a+IgOl5P=4P?DV64F-Sd`| z(=dy)8$v+A62u^xE^I_D7Q^efX65yKoOQK&Yw?kX(^Tox@g?Sx)cma*H+%rk4Ei>X+7>6uwm zFKN-4IK$YP@0MsHL!)trnX*~4L`}o_omTqU`RDnuh9(obWNz~=b$x!%;sUZ~?-o6} zh`vubrw`9Ay>MIhD|GL3`@Z~gov3y$CQj-5O5jsBv6bMPqwlM|JAGvqL3mG|na9rE zJzEc_ai1$f3D7pLMb$`)7ltv68EwW=M$EB9Js_5N_D-lfZS(z8En|~-9Kd+%gC_e8 z%X@?B`JK$K;RHnzb%*o2xoBb&M-I^m>fORbtp)Ye_!8s&()_r`k|kb#CI=tu#%P5q zJQ_`Y)N~OCa#y=unH<(nYW-&Y>6Wq_w|LxEm?OE}dUm{clJWCN`pFkO zf%bKbHsjK1AI)28uQ*B%v-81c9KU`HJQz27Vac=#zZjJxxtkmly*Im@dYUUh#ty(8 zmw$e@jyJ!WcdA*wTJ#z>|F!(;Lw4y8T@s7y$+!F~*PDsjE6>;7daT^A2<@5Q?w8lB z-2Qm=b?xS;Meyzt_-rwxktls}V8@K#>cXP7( z_b&*J1Q92oute5Cq-jVj{sc6U&l-doE{CU;5JK6oh9#6HN93Lm%5b@cBM0v`#DW5n zf9L+L0Wh^Es!sqA2mnC;UcldbKn)*XL03smUt9Mv!pIO|Xz%^P$-^D-kY7m98iCNY z_j`;G5*84a5Rec-AfEbKyE^&2LP#SXiSi=!+&nyd9G%>s|63Qt|GNk%0JzxLIM`UY zI5;?Xc)0k46hwps1cWqXpY#2n>N@VdLQ9;S>B5_zVNUAP58ugEj^>4u&B7Cw5+`1Q+>nd#-`?$ z*6yC(zW%QRgG1k@re|iq&&@BaZ~P06cXs#o56;dnE`MJAy1u#n4=)e^0sT+>zw#pe z#|sRFLZCSR;ROP}{Eq-B6pL91n@sL0j;vZ?)&Tuc%3(y( z!G?sOEl!aweTXt=DVA6EQoyq)-+>^}_2DBMAL7)>EoQg2rR<89T^bu~ua!=z8DI5L z+ou_~w=Yw7{FcteUdi;-9^xPcaVSaQNlQM!Z~W@gKzH}h+$x3dOq*&X!*O1Q%p<=u zr6r1f#8)AXp1JbU{!!EDH0h_leo4i431KaWkbTQWn1Ct)uKtu`APLIY4c`@0@>+eF zGnRlk3A#9WTbd;%o`yJLZRv+ntt_D+R2yBS)Ik5KU#`H&;N}jTQ2dz0mq&xJ0TE+U zBL4{WCUR5e^Jk9&V|5p)&7%=El9V4% zexnzrXWG|lm2p(vlx_kY-TUVOD{eZg%eze9+GL^EW0piNUdwpPeDJVVjV&pwi^OHr zAWpUao{CJsZcNRxbw(XwxZUDBnrZAE`f8}Pm8bt;uZMeR9%@_dR2)CsKE4(oWodGn zoS}a>Dw8yXj?+HQI2x6Eugd?WfKY|24acf3*~ zM@HW-i|q>RRqb`03oH>he!GLbnQyf_mcJ`a#HFY-ntGPLnXoy*gaKH(Z@UGP&Jd>s8%*?MEDqtly4&8Ccc}&XO%1)r~j;C3nTn>Q(wy*d1Q9 z7uv@U5B6hg3V;9o!sxs2;4_6!Z7mMX83(gQJb$rHK&l2n;8$XC8iYREg1bb*l+nhYF5N7Ka5U|F|qyto@ zcD@eDr*Q7z6Rs68iLK0!?;<@`LZpdg_WG^{M+mqv^fxw!gp05GH-N#fd6eKB)vG+^ z;y*;weII&78r^y=7l#4h5`p)KshdTX_ST^FEO)5$;pteFSonsytS&lDy5V5gssEX* z;4S6AAD4aR;7#0QHd^0I#2Q^@;{}OqUpT95)NMxk)2nP(@u9EOzm-%N-;g}%ur&=? zJrxjOx+QpRu-@4r>K>5zn~Y!=Cuf%e!p4c#WH+-P>o0@89S4m&uck;hmUxxjag} z5^$ko>7Qtzfe?~rzNj&yPmo}hBDAR|srwV`w0rE8W&0U$RNo*nF&%dK(lkujS8E?( z8YI6*lOBl$hz~!SpeH2eCNFnpvdft`pmtc;{xy!5eWf;!!`sqBj~={aOwohdG>QBL z2+a<}t}cp?bIG*W7M?dRP?QM6H=TWtmEoK~If9mvKDRfA{Y>d|cvGZDL1&AwN)y@2 za1R^b1sR^iT-%H9I1Jp&s}Vm(Wfu0|G!YQ7Pk+T~sIO-gu3QVlrxhCWmjAQ2-0%GT zZ9CHj9SPZ@YT-d6?7&m9(j)36>y4{lvi~QVM0*U+Ux0UsUJw}LlX~V++{5;GTCk5X zm*`KW?EEJuP?A9DY3N2#I1^~w(M-;b;!p1 zGnR9bd~zGuQswOR;}oG~3EQWeM1xxw(jFtwDJY^x&L2F8tR9gY3qY%2Q^%#3B&pIcJQ)3!01iH>G5M9L9ci-tGo@qr zE=HBt`Q#H-|Az3JchlcP1xzjl@LO6YY~ zqSq;Tb)(_JA^XVrBJ0@%6ReZ?hXv(mJ1{_x3lluTaK)}Cm42`*bjK!LT z8x$pmj}RguoPY$|Z(^5>=oJ<7-a3Z;rkJ?wugk7mZ{8y*2JpW!Jdnnv^tRJ~+ERG) z%;WTV=`R)N-J2c?WqLf_n|wS12_zj=Se;9Uv!*~Uty%w_)-)TY9=b{a-W^+6M59?4uE z{fbG)F+ut55GtPn?KL?}pWum~CFxB8NgHOxkvB*V!4*eLH?f!A{fV(KWNT|;kFO4# z9ci^$d?$RxeRTr;cJr-qHc?@dUGaJo4rgVq4@FH+y16lCQxtGbHuCQEJ+rNb3k_>| zdzWs1WwVW0L)*ga3w~i|jlO&S3sV)$vGUESG+N!h*`~lKRd^}<3GWvk(q&b)v)Z_a zsvn(BP3G$&A#GTuE)Nh4r9jj2a$?pSBH+c3A6m9rDt6ZAy+=8jaU&?aZDhsCsxLbDjLl4Op-+?y>o&s6iKi**x6BvoFj~f31f4r-| zp1$m3_uhAiT{c-GlSL^1(0>ov>u|n3U@+BcjL@Thh$l4z$EwvK4v4Fonypa?aAznC zm$TDPC?0n8qT3{@$3p!DjAT4Zee43itvWrmTsGCZ(1;+K(_ef$CN2T}37jgc`S?A1 zx~%$Ox|$>U$qtR7U|lr{u7N@8W-8~G^(?)%7R`^2@>65C5d#C!N^y2QJfFzZuEb=_ zdx*w}LA(#UM9*f+y`GDe2J`1sG3HFQG(K5R;?3n{)Moa4oLgQ~?K?_$|A4`HtanM( z%j>!Dljqqxk_*Dv1a+7(@qJ6qeO12MLMbmxRVPv+-neKZYmn;^)Q9HJc$FU8Ah`qW?`o_1AmS4wcNPBc>-a0C%TFpYk}H5CD*HO1#K< zE4~qPtF${vm_yd)WD8Zf3LNlA4yWf4Sm}~h?H7KSk-{eVP?+JRZj-7mK@B@chQyXi zp`z~oFD(E9;f%}4`=(j7x-{}_Ns3(Mcx;@nLBps~S;As5lQFvv9UCQLn#--vh&wwg zzn=0J2t4PXJl`DZqH7s9Z>AYDO5A&x6>;j<39}Ey-Fj{vhaFT~*s|PkwYGNr5<)5} z*<27JzNG|{KkZjkZD!r|PVHBb%q$ll?0<08T6L)F5p57VD;Pc5UxB3aA7G5e`LbzF zZ(_1I-~IfQszvns2q$5EKgt!uCBMb6Duyfm)sQHxBj4$zp5;;Fb+DwCH>rIycl6R) zqHsd6gm{LFR}&U1ghGH9A5?F9aQll{vs4uIt5!T0Z6CVXWf zKOTF5cZRzrS^6lfm_*gqvg~VxzoJapvWQvL!2k3 zr`zHe)i;5jb!w8XD0z9;sf4-~+r%NaQU(F?e&UDwgMao)aU_gdL~)mn`GPzu)t~eJ z@?KEq9X-eJErS7K&zE3TacOO)6!WGt{w7}2Kaq1}o=6*^!xy7=#s|Mr-?@|;J;b?q zGaIHm^_)3i7b11BkItA)8t*4wZEMJM+yrm&lazqOZ~gWyN@prN_Sw8EvQx$)Ha9vW z5_wG7KDEgDqA~QpkoPIMug>IOw#K?v+LNM_6s>2UNPkkRrN6T1**Dhlf8EVci8iw3 z8G9X3U6Siw(PqmKu+iRDUq8>kLmkx~xS{$-vRo?aN`(#8yRKpdeLIY$h0zbe+-*jm zpWvI&y=&XI$2r^}ht#^229?@eESB%$(36{=^bz!ZI=!Uwij99Iqh0s}MaA@MO7RW; zcDsZ~!k&BTo>BYAF)2g_FB}(NZb_`gJq%nZbD%jFrNn9H^3Jh1?n->y-!6$gnRl6- zTk9p^?<=NpGN%U>a=s!>kC;P0_b68RRQe^yd_^~}1&zkr-cO8D%(ykRs=G!TO5`UN zvWwj~)1^q@un)o)L%(WR#qDa(um(1lw1gmrWc;5XRh|y4Uxd^_ev1F9ObS+OnKkLG zXlx>qNNikO`~;@{z~^o+bA9(q`U~lYqTBUGIz#z4brWkWNgjk`$6F*fd#rzf=Q8t^ z{#C9Gb3Y>;W>}0JeBqAtHx{1Up)tE9#L|+)&LfRt7iMxo9nsA8uRI{kvGFHVe!+R0 zUlu5ym+H+;)tc=IY|SvwT%Omb9VTuYfAKG?IS&e@_sY7gpnC7zEdjI}bo{3ARqD`Z zJMz=Z#$eqf>`H%6?9+=_S=lg`*%w&O|9rl-!FnO`w1I7Hv;2wF6}ZB<&s`K!sq{)H z;)=_aQmOS%vyr~g%`H>%Cd1w*hWUvDT@%w@_l4~fJQa7N#nw+kHgl3U;}5b>a+?_! zvXM$|$CqvJ#3XUvnGivmC$3ve7T}BiV61@R>Z~twetrvf1d>Wl=ju|9y(w`TWW)xZ zet&^gMJkCJ_Up_J8N`7j28cii4SY?0TP=MsyESZUa;zU{&@@ct`|SBRrxg0`jeuJB zvYY$UR3#^9v|^lJ*p|0nTqw=H@qN&zf@AL|IIlZXEDkhlMFI_CR=GH39}GyqrE->b zL;S~Z%c{+z-nV?GG>9e`4puvNNx*MPE?{SPVyM}h^P(U770nM5!!P82R7(`D^z7*u z#YtL};r)QUIAafF@jK&~HCDqYk9r@F5N}Rf3jSy4gYy>(DH(4X+j;E^p(9m z|Gle(GWU}$Aqny2R7D9%_}aFXZi~6ew-c4d92aBuR{dcJVrjzKAU-4e$)nIgZX7dr zaD9yH-IRf-o3`lnXQBJq+EBkOsu252tRi1muYKCr2Dt^rt&T!%vMFqJL&ihf{;8r{ zaiLH@={s!icGC*y$Bp^W+vG%5f%z0$f5kvG4?p<%^}*LNoY~52Kfe!(9iOSX*WTWs ziGImM|C-9z=NPo_~T(hf!k~FqY>ZFtzjfr;2XtvTHNHk5wi)N1tu(xc)w-Lqlx_Tkj^Ut&A#Ui~0}xI3I;K2+yB za+MKz4r>^R+3`(Tmw^RgZUTTSaw03f=h4Z^7uzndj6C?<+%pncfEo~{g*f40<{pGer z^R7;PE*U<(9#1l1_x$uD6}fZcuWw?7Wn1kpKC!MA)-pZs7BpW5b&b1!(IH-$ad&rH z=bv2I7dzaBZLxi0O_f_NlGMo}yxgSRk)`wrZ=5;u72kf9bg*pu@Nu}XDgf&QIO9|3 zrgq`g3uEiDpV=NB=xUtdZaOAYbE&?B@S%h=lQ-GiMRDT!-W#6UeHUvaaC0lx21j|S zCK|zwUy=^qxLw?zI5%)KNcjo;bPPmcJH1EQqs2nh?Z|V4-rq3Fp5#dGEQj%U`PdAC z1c^yFv-EGbp7xZRC=pugDa^!|FyfbeKjRE(g0|Az?Jq#i-|H1Cpk7<6Ks>kAnmJ+zDcBJ7n($Pq;mb6Ma3WK!(Wrtm6Oi@E z(W7%OMh$64TWfpAis!`FA`Y#Zs9h ziiMx73a7?f-vpi|PWx6kou`|>U|{Gmk1A-6>3abzAZ6Q0*XehE4-Y8JF+ScY7oQq| z&7CyA9bySe_yiUsQ#Saj@LiNWX2D>4T6h08V*b~Yf0uyVEw32Q(tKI2wdX&c*+=+H z^Vud1I$&8x>ss&bFxz3F2D_62vV1FNw}l!@#^_?@43F0u5-}}e1HkYx{BHgJcD5wN z+Ub?lJIc*62iTtpbVKFG7g;BlR$r=gv%=eA-+bECon-qIk_1T+vhrMM`8l@oXR1=v zqi)oR&CpYst)^p9*wb@BZM*sAsiYp*MWEJV-c;Dk44S1)n_FKd@t*8*DFBO=erj7C zx9Ib9$s^4cyIP|eeK33YcP|O?b@*A1mqA{ei#d;iIv+owwj?z^y9bxsf(rY&xQzry z1E0m!#-nhbv{|mL@C`k;7Ih{Op<%EvwoK-D6+~b^^)yqx?VZarmz0k4tg$YPqfS3A z0Elyz$@>4c={V|J>cpPSHEO%yRLLh(q?de>w^zVg?q$GI$vdyr=}L(tD-xl zoHnq$zv?WhY&DQF?R<6&k~@PV3y!5;{soldbHBB?U*^U4f8aipaqwk2tqszwEjZxL zyFj~<-n$qq_OGxd`emCKFkOz4%3i{Fa-n|348dI6@m4$b!?E(`S9Ow3G(FGn!)jB6&c3F7xurB-@b*+;sC6DIc1^^@ zz&_$lkY?S^7CqKeg*(pWS|Gbhhcw6k&i|)OfrPakxC->^zkY)F`#;;?zyIUyU;7*Q zzwy8EzcLyc8ag^U8af&R1AȼvNRa{iO! zc!lP$U)5rx=ju?b`pfF&R{xWO(cxbQ-`-!|yAj?nI$_u2x5@?+=pnB#JC^Pp9{#fA7~>CmxHw0Io*H zU%c+<`2Fj2b2vBtH%2=6*Tv@Q8xoM-9dN$O^b$lRz9!p+ezXK!(NEBVAf(9gSK%~v zX~@4;WoZ#_DJjw;;NH0DkxY!I@ThnBMjKY#-*z|N3HBT1%Lw1R1Y*^ZR|J`+qP|M z=UmtQf1Xq4)Zy!M?p2MduIg9at9$*{ch&ck1AvVm#(=n2)Xa~Fh*;T6k~POMOHz^M z){3IFA0Y#3D|7ttQ2RMl9Bm4;I<%)c3O3 z6c^%%pyopy@1~awM#iym>4^5GyNk%Sx(}vQ^P+zi=A!l=5+mZ(5P`-pwQLS>T)C{U zrm0Zcvt%vV5N-mU_?wurSkAvM?Ty-@=AT|=JwG(6T&6K#^=PLtEeOhIp^kOPYr5pK z9BX(PZH$IhH8wNbbrZ(zRgZ_Xjx!Z^Ul|O8Qe5?`9vPr*rr2N+*&Emz>DgwWW$d13 zx$tEkz#C%Eglx^olyo=$WVW-L7Q-p+*M}KH2r5QPoh7U@OClpHtSTcZ9r8XQ{`3l- z)MI&2eCH&DD1ZcyC2MUv-%8wR5K|9ks|91{vVT z?W|A@{^zyL`?{|<@sc>*9jx2FpsQa>t$BOeQ0aU=k!wV`d=AcC>6$xV*00{0c2~H( zepucnEB{w|(3VM=x^a5AGrDol=RxGn1Z(i*GW{{LQ1+eYCXhODUSov4##M^R=IW<> zCslCHK~reJ!e2wzEb?sV$eZ9N-heLkk$+e$#UV_(M(xHpA`le_?32W@iJ}%{7;iUW z;6F$tMlTWrBtPqI#TODh(pvL=kSK;LMi*d|Qf2(Ej*irvD8Op{UEF`)g8Rmbhj|=!H{0${FB81lvAI?`q zf<8JT#?z1x?^8rZDm5yl-H@2pSwz7)Ix6SI5-W!m>z^n&rkrt?TqavgqcJ+B-hP)- z7hOzeAvLbOb_Z;mC}!}$9ruPfiaD-;RSkZ{FrMm98zCrRi2_ZSaImINM3=A@!%tdi zH)gE(lyH=TCT-kVGdGY*IS1jVoH81-PCiO_MnO|9Ev(rW(WShH@Y8^`#+(7l8AS2Pao1j6F6J%JY!_Bc@E0QhGL0`=J15vP_(FY&O>Gq3}0y zxuk^jTw(@Wes_~`NARe!Max4mLkzX71H_5GjLIU7QlaSFgIBwvb%^HFV*D0 zIy3GGBh1W~L5A4+5VH@BW0)DijV6XWOJ3tr+0^XfpPu-;e_tH`}Y;D$`;W1xj^Hk0TZ?Sxetx_+>>S#^7jYB=f-|}rsz~*K7 z-pr~FeZo}exqamnnyKE%dea0^XJA^qr771}&n&8KmAIybwf=I;7?E{#{fWcR+soF* z=6#ui@Ts}@)5^)^ePcZKw4>+J?ll8{lRn!+?orOceEEHgAI1Z)O@BkQ{=Bm<&Lul5 ztB6*LIdFc(SVUg3`Z*Z{?}Fg{cexBg=NG$$xO4=}$xnv%jONZ&%l6!n#a@D~$!7B}<*9?w+`b$aqm*^!xC6$!* z*>a%dFA=OW3ao3uk~6<&2*Q#*thptAnRAFluo;)Da+#ZEYOn)NSX_$VNrRU=j%S%i z*lUrQXPK98S(sm1m_Ju|sfBx>XE-<@E&R$gNY~9T_9c87HX@NLB6&o2Od}%AQ^~c> zhHNE*{3PPw2$1&@QN$Hlq8V96<*)~gtn!SM8Vm=LhG}s|Ii7^JNJceiMzwiHwXZ~h zUZOhTqC2>vyK$n2EEO|xWWy!H$Em`nR-$Lh!l$WXW=EnIJY$y9Vy5Aux>F*yUSf7| zV)wXW4>V)pQlhJ0R4Y#+&rbAD24ip1Vi}ra?>to>+U%}1<8IsH-bPe5P8^Z3{@OPL zT1%=cXa-XZ32Jk?(xe%>x;Y0zC)l*PB2z@STZST7xw^Tod*!r40uj# z0dV(;JMy+Dx3C5Lb$#_&v9NMD0#>z{yF?h(g{H=q0RgM2$i=`~N^3883&&BQGk2Qb zYnr81sv8Jc{{&221t!6#7n#Rql}Gfrnml`|$S zEyCps-Wj}_2Z4}Fvzkcznn>nVaQ`DI58A`f#hv3+zEC51bhm&-+e39VSwpI@Jh4z0 zU{jrvE1?wdf+vxDX0;xC?_cbrAyetf%EN-kEktQu$ ztKvsUtW-+&04Td3H}B=hz7mi%H(EiRnsLKjiQ`qdcAB*U$gVH1n8&T$!p;6SmOW&h z)dOGEFqZK!lGWlBNU~Njj!?C*R@w1dxrA3)_?q26R!xtYLrood6_E#%ZjHNapkSE} zGnRj%4e*Po0hs;e#tAWB33{SVxB%u;jk=IqyGgv{;A!O^@#ON4ghayU-*EqxpbWvF z4(*6cc=QT>&d7_CiYJLEpy0{F&5WXXE77M0${{q6oYx1RB$IhJIPo-4M>P;8_Ulcg%O)Xd7F-*Yw*@;mIu2();h8m;3G7@TQ_?{ z*N55UVDZ$!;cLb4nh>XlCgSJgn>VLKHLFFnYecDQ(<<0%7i(uEapB6Vf(lwN3$5FW zmrWal&gz@JTUgqQ>S#NgcsmqUwRhIwI0KjSxHMd4ZkakRW#N((t!3 z4^UUAcDi?YY4mALM27DcY|9ZB5{SWP?R z4fc)n^#+u?fvn!&yU{Rv-gtW)$90|GRo2g{1|urHDXSocD;QI&r@g8dttvY*vg*dN zF@35w9{oULjj-5#e&>~h6IILReODS)lc$-}uUV~Qne&nT#GU<&vj65Hvxw>10%g>K z-wg>vUBbO<9@ERgQZ85AHRv4q#JKI>SNreF^C8zl;5#ZYc-k3WaqCUmvdI%>!5SDkzL4GiJz*M|sfk zbZ{WZDYX~>ohVeG==>v9Vw_qiNIe?TDj%U+NcTQ6zc8}qI#P$2lC^B1`8FDIQJhoN z5gI*eHdd0lQGzp8SVA|#LsK-T)3T`3WtG{xX4A7t+Z#+>u@TjsMC0RqG5%e)+-hQC zDtcn9a{>uTxff|->)mHKx_fP+Y?UA#iLL^*y)37_95`0i$2W!i5raygI!4p~qqA?j zxt}Pyk|a8?!K#0z-1gpQx_7kd-KYOIT}Bf^KLoPDrEQfD{y^>9H04FBkZqv)MBjKu z{{r_cGIBPgUDjRJpzy}5tlB^rG{{7@#%wTw@Hyy=2b^E@ZsiJJi&6U5Icrpp%Gwww z|CI+sggx|tU@S*F2b(bf!<$2yT?5tGM!T7|_vR{zG*1c$WtFRAt{y;JSHF1AKYbep z(hg~3k1U*bwtp;!w2d2n%FggE8OJD?Z7y2dwUjQ72c}Q;vQIj8O}fZUx?Q%MPgK9~ z4G?WE!?iB^5w7^~uk6FjX;v@#Wi3X;tb}!~#BQ#{SFa>=CF)KtS=g-={ARDHXW@ua|ySy zV>S(_*8my7HSbCP^q!Q~-p`IYn2B-+KzG@v(qraUN=7%r#unVfR+5$F?dO)W-uCw` zr3(6)IqfPs*;az^>K?B+w9h`mlm5obYMSW&CaJ!+<>>{4-5Q!*Ou2PThP?%|b%QDm z!D^6abRAE1F78@BhD?4o%^*$n28Vt#wDvwE{=WETo((~PtL&n^?0ja${)q3vc+5fc z<;G@LVHwgU_tHU|ZD%b(k?3o!K})4-#^J%`YEARlZ1&Qm_jtJMp|SPhSn#33)M3TO zp*_Qvez*3KZ_h^bwtMW<+(&tQ#sqk}^B9^)dC~Ux@ZxxUqufjX#1m!8zx#yJZ3p*i z3MY04t9trZO(k$@7GS9{| z`oZt|&HnmhD{6M?atY;TO->Ieby;{?X56f-zE4#74`9E>z2pGm)b?Oby1tFFOo(pQrOcz@BcPr z@G+wBHmq<{zWp`@{`#1STmBcvaA6i$D;2P$@V;j7zP|m*i#V6|D}i#_nC~+*(mU$$ zZJ=0Z?)2-u3-#mX3w(DC4y5z)v~;%`>(l~{7eJ5uygWfLqxSN7-JhYch2I$Vg}~#| z1ivU2h(sdOi&ur;?hVA?a$A3YRVtE5B$NxKi?}-&Nuk!N2!2&Ak;$O98>))9KbpvV zL&5m|g9&;~YNihoc3cP+`d#ZjRI%uhtm$)AM$}TJJi4f>)*DFDQyLhsk`+TP-b_>_F72o_Tpdj%2agJOAfoeNWvxtH5qwn#jbDa-fc+_1hhB|V5q}L*I zBoH`>k-v*$ks?Pw)J0-)D8qDrR;0riD;JRP)7*`RwoOD(W>2xPPO>a-M98sisy51T zZ)bs7<$11~SQWUQFGiVvjYm~hHU6g(>#2ibXR54u(RrBpMDdNB=|m8Vs{X^CG(I=L zaoD7yAPCK_sw6?)tlH_>WwX__P>j(d=#CZBE!G;rrW0#8^maa&}29Dyuy{lPFi zmII29PHJ{>TUb`bN#g#f-k)WA05nqOBuwsphccH7!%to4hg zS&B@%=5>8u`!-|>ynQ+|dw^M|(Nf2C=hqSbO&9DluVX(vcBkWj${1dN13M;<^C)F$ zr}H@DFyB4s%>6^cI3|<5NxSk2vwJl|pleMd1hK1ex;D1PZO$mS%YDtEmH+t)&)-Lw zP7LZs19xz8R#$hMy^SC1G4owWgc>PFA2e?E(0RhEs=v9oWbP;QjUOq;69A8~yme_6 z97lVMtG@cZCP#jC$VuS8GDc9Ds0597m-#4 zRSktTGu;JCLE-m9F-rB>2$jwP3|h6avt4rKpdb_cajxM%^^`GY@TB=$RKvuxW^ob| zs`$f}gS6IH<{$UEj>42h`^ECE{pI=C*yWW|-(}oI3npv)8hQ3a?>J)k^lO8U`MuEK z1(P?(s3bQ)W2=TB?T3Hw(g58M(-zSQ`g6H z3VQeC^|OwlcI@1oLxWDHCN_v zgiq}`+$56(TvX`0T}Zi8h!FxS$OsV}WLPf>J^$eRNzF+PM#tTSYJQtnH2zUe!(Jh- z>)Bfx$|P$VM6KaHA_D(5qo9qrhc}xx7&3;bobk4=_h=1XmVi_a_d+ryzFnp2n@WlC zroX_$c3bHosVLJ5raK_85${k0#)q?;=u=h#yWKe&nK3VZzh-C(Hi$K4G*=PxLo1Ke z)uh$QW|QV}PidT?x70;iQW(9CC`beN$?B(sy84XlJi7u?|MVcdFCF3VvjG_Ae0pf|{D+N2n>tZzN;Tq#Q~YLd zAN#E8h`<%IXn58?LekaIKUcfn^=Z&zt-D*5(PtG; z7?&@zaZcc`61ks7@Bn`lwAykFOGEs%l|gZi`V`+2vtJ#nIMPkBfWf5tr=}1&yNCqJ z>_5zUUh8Qv&#i-cr;bV9>lxzvgq5(`6kvVLA(?>!JVxG?(c}arrDTh)dpjzoA)SRU z7|&j4eH>-f)b>_(J$D1`cI|rSESO`vw=`UJhBMCHeX}D5v#wh$myLZw*w=aMOT!=V zO}V~@B~N8RojzVTdfU+#99p>AcliyCqvq~Y+0`yt*Bi(Duy2j{7!x{Hg1!cs$1Lf8h(x;@*t2S@8}FBWhNJG~QFb{9gJ5 z{cd@W@7i*GuVx**A6o@KuPp>WmIeJq4SM|L82rEyJ^lyhJzpOh0uT>9wIpm=lZv&S~t{wgHJ`n7xF(# zMN$RbfSS=U`q272k*eyaGyCv#e^4R_&Ak8lhS-Hl+J~)LrjOr;Q6%{4((^J7+DwW_ zP;N+`A*O++N&1uLvkU%BGe8s4D`;EU{(Dw9??sr2yMh_5@&^x)b^xx4CZFjeH?g;e zAs?0NpeEc=m{zDCHIbT?K!k@(gwOSNvZ4sLPyZL`00fbGhM;t^Xg)@3 zS)s%Lt&~rcn62oP7vdC4wbTTL3|qY9hNu*Vm{L`t{DG+40jlB!g4%?rx~rIiY`li8 zsH)FEljb1w!eGB;uNe=@4k$)Gqo11qXt+UU0$IOB1=M*HGa(pScEYsa6Ip^sHlZ6b z4J6wMAF?VUH&Y$5qXTY9mdrs&IM}vbzKPq3N^D6|7*>hflS!Bs^#ZE?T(ePDwAw1pQoS3wV&!jBvp1O{ z^donyU2LRYOfh&+217>7R7TEqyqQ3(O%+iEX}qmSj9(Z z9G0kL=!YZ;2_=ST--lN&Y9$EuptnVG3KxAU03+P5C=Sb~F5pgxiX|0aRx+uH6IzD( zK1)RM`v}g35LvQ9N|pkzjg-j1G~~i`&4dDYL!tIU0U|rS^^D+;)C82+%y%`#Nv(-Z zSH&%#8Mu%ccsIpu*-=EjQKV`G15Mo~t7F!TeTM#u{5OZ4)?Fzf#>hV*Yla`y4 z;a8TKRFxH*lhZ@OaNm;U9T(a3* zvOQdKcwBNETym;b=LO6%iY>dUEe|x!5*^NZxGj5zECaHEzZMtd2baAUHRQpY8VZvd ze%WDYZgYXz%0bP_f4h`})ij4jm4E-7a0^)pPg&`((eP^41Prc3Ev`fpDwdyR`#&!G zL9ZrYt|mgS#H$Gh(yyfOYXapoQ}tGWDOz-onqk>1nS-lY$Ze6Eva3EB7uxJrxWo1v znnSMSlLOiLcH*)0+9k!!p~V!B$y{xtBgmaULORi^iX{nlcq z`IE3OMURU}dXdO>ObZmVN?99p8`?IsH%NDUblaE;$i_$~E;mNl$H8-n8;I|b!;3Q0 zn;V@MGGlU^({57~Xq#ONtLx3(MD_Sa54^UjYwjC0s}PgL!LpSTa(`(jN3!IcoBj0j&VU%IW8kZ;!pYrlAv?U>51LgdyzN`}$N z`wmQ1@~=M~Ou3Ut={9YD(#OwjXdlq6KVeKIAcy8GO}b*bp5Mmie?RbgX&bmDc&qackK{M;cv zsDTzoRV^`m?3;SS8JWr4f$0}QayM^b*GdW5vl@~feC-l#`6vH=>~mmGz0E%O2g z{k>NhOR}7?EW!_0@9b(P3N?xshfWbd$DapYB^ut~kRzXNL*J<#Kffbin3KnNa|eo( z0rnGnffEOD%M|!ySND^!&=WZ;#qTGuku4{YLnlym$1&y>u}>$lSCjYE^#w145I6At zN5}r+rvd7xK>5=)+}Q%Ifb8!+(_OSu_hqkc(CclF~499AqjYBZD^QXu0R7@OXavvyGv23{oBt+Q}}B4l83 zX^mBWo0VHpMt+FgrKjo4t;t26g_u`t`_lPYz;UsdTp_zD_qxp~+yy__QsGH1-94)e zD>A8u!q87wBb0cdS?C0kbkTCBg8XQA;SZPs;b?4fYA%-3Xgy}nbgOp9mJrEKd_Z?B zwEkO^+4n+8Oy^c)ZMvO=olQfth!6P_jCut3oxN^bF)PE)F~OTr)`OH#@;YhBD37i2O}A00De{xM18&J~ zH~ZNw(dAEl<1|r+0=)cEI-cT%D;)XBD}8Bv^=m7->k#v^0jIOG5`>JLGuT)ehL$}p z6j|kmy$0Yujo%LAUz7FAJ!RQ(?xh1`L8Q zr)GWn7L?f1maFtwoAZz%&m}uyAlOC@Xpu`#voJ6r@-Ahwb-bd?YbtWlKQk>H8lh75>fgfhdU{Bvwknuqj@@P_L+T_SJ1jD>4 zWE+2b>JxeAncvOF)#`+!DQ(E5tlR$A(UrEsjn42LA(3=-lLHLnBnIo z?pAgqbe1PQ&ON5r+`KDE!{uw-Avdxs2lC2(+vDGTjjW*(|$9>Y`<6DbAr;4KouX~%v7n_0q5!qz?ZoM-=O-KNe~na<~N_CfkNYv1Jt z|KknnAQMgou{G%1S-XyZt{Zs6GHRWzG0(Sn(9XN@kMXq`{W&i1vbOQOfC9aX#AP{e z-v~aNqho!m=GQgf>enZ?$8-lbGQtz*adTG%%aoVbpM+kx+6}J$j(LKuJl8KJ9&e?B zDRCCB|=e^{1?LW^hst zM{5DfE-mJB6QehHN-!J_6;K}PfvSL1dF5DzvKjnk-Sy|Za?7#L@^eXpu8CovKFPNY zH6tR{Z6xQBJPfa$LBID(%i!U&r{%mG1$_Sd^&|v^Rpa8oqxW$6{giV%BSss}$u`3t zX_P}s0ktfM$9@AS1OV81Iv+ynk1PwwD`QFQ>L13Sx+)rsP5KGxbHr?_KN!?(uE|qX zBl|Bv!$I7i!Dqql{Dug+hruJzRQ&xf1O*MNigK1@Fa(QTIyh}+XE+3d(+{I9Azvzi zjMO;#gsQZXv>@bUNox7?_S`!E&ZZG>&D{^BRKR3od_31R{V) zqzbE=hzq>3cpg})rNpt|l|m;}jXYn#AMSq1*KEE>)I^0@C;~EBUGw$EHZ=%zx&MhJ z+s3%v=y~b4klEt2+8+ryOrPFtx<3)PPju9YbG6-`!;LS_w_2n#lv$6*;HzGzvy`F{ z=XTk~V!IM+C}8Rpx*lQe!4ttO#S804}QHKT)$4+7Vri4EpPkY;I8Ng!ohg%1R)=V z?F78zp5z687k>HSkE&dj8-QrOVkC}$@Io94@BFe8@k6?eB#OTMg(RAJjEgjeeXVUq z1*`<%%n{>f8BhZpXHx>>zCXSsBp?xL9f;zRziLU#3czb5Qje;VB}xae{Y+6Mc|Eky zbmk@(D`2)d)KM_UEjE+!IxWdmvW_s%(te{lPB7yMKFqdiS=GrkT?3H|D_;T1GIR?l z4l}5V#mg+6^|{OPQPJ-tPB%PX)Jeu@ZZ|-Uo!QlO?Jit)NSAv%s7#zi)pot!b=3AiKA)?AW0e6R zDQd0NYiIGW3mkaXu5MUPIzRo7R;*I>Hqr+>i!s*vd#Il>EXblZZVjA;I0&pr3qL4F zDsIJ>$9}v+-|OSvFJ_K4rHH57Qm3Y@P7AqI-A*vI;_4dz!d7pXEisbVTv$`e)?3sv z>3Uq$)A?-HF7^tm2!T6snO?OjjNwotl|NCIwRij8nscrNHy;A^ugf6Zsd3yOg5=Ha zdCM7HdpAr+AEzzIwb1eWNv(am#S z-2r}!hQ78;$wylE+bSzysqnt)x(9b$_dyAMlz1Ze^W7Rf+56m$@NR?o9;Rh}{ikq$ zW_ao|JwD&)+4QDm>V*mu?0()$RS^Xl4RXY=3{prD}#_s0;co`rEnf;Saoad=UP{Z&*PpVbnyX zVDc>3r;&TYvA&uR1|MQ16RLjPxw=q}PGS_7vVOt}h5(v_gvScXf!{x!!o}%Ge#Vsz zkg+&L$lH=&5?||V8)yPkTs%dOrM}5rG!n(3So|xjAT2o%W7e^l|E*JlQJc0 zhHuF*yUhF>oM$6im|BoM&vs^O@og1X*!drN)?+6nC%v)E0&WG!b-*nJ(_8{3M?;6w-D@Ip>GO*`m$7k5f#WJNT3d5!F=BVG1SY z>7;I#@=|$i<-<>ul0gyuLSZwN^ncF9O-1E5wmjqc;3hCIS~dSkRgCEFW1hCNN=i8P zu&A&4K#8b6Q6}^-u`JSDM>QM1+Vfwr9Y{<`E-1Y4VCiSGe2t=r5G`n}VbT0{tlBiB zGAYrlvU)A0l0RX4_eNPA$XBH3#h$tse@Itn-dyd5n_aiYt`_$aqcfGUAx0ClI#w}I z6Z})%`t1NuK(N1Q!Zda%?U&eZjZR}C8|euSOmBL}Wb&!KG8d}}p`BqSk<0<4p=R_A zE&Eaz%#oL+Ocq3j88#8TGI9y6{QOcrw<$1+RPV(W>1dHj0h|r zF|yrM57D<7e`EsUC@f7eREnEmRv*I&X3rkW5SzfC6P!qlnvUpOijg>_v#||05~Ug0 za)G8fp{ww+R3S-;t`W*+ms1LgUJJ6vsuYK>s&apdE7Olbb+ z%k8l|jGgtFed%IDtye9agAC&G1+%=_l86~|5A=>RANaX9?4CrAbi|F-a&}fWItQY# zpuap=&Yt_3k&ot1y>bL@?)yyxry{rUDs4``ht~h{cXLHZ%OB!gzZ~wNbD?-hikSI= zMkrC*Q2b+EVGr9zA;})nG*Fa-=Qnn>s~#}3TijbsG-*P#Rryr(yxeo%N^9(?s!h7i zB(8W?Dr+2z9jDWS8LC(RRzEfMpkCU4f!S~%$Ddj&yO#QM-ZxM6ZG%&P{Ppp0@Igg+ zDMaqR@e7NE`C@n(ROz^h*6`WMF1#sL>AnN@@Ex(%zD_#a4SxGxzTD67Hk0J{P{PQ6 zrcmp(6~ljBW5Bz4i}Joa-u+bH!++@{_`d1jbR8SVckuVidsoo!Wr$JWF3{iSkaBw` z>6q`Kkn!_WrRQzQqdr!E@o~Y$|8eVD;H8HVe3SI0Tz%YiWtaQ@SeW~H<{E<@2D` zf5YhK!I=Mswaw*)_A*Np^MFiUnJ_onargG63h<~!=|KuRXc#9Kw$T|LuCs-X^3m#mx z+*L8n$F|?ab|=P(&Bp-}W9Jy*6cFQ9=6^5>`5ry3l4=0 zUqkj@VhX5$B-A+t)bg`RYG~zRMnAg?(EkIbARJJMAr&t$5w9@eaX%3EDiR+f;RTP>tIZ2t{o;pT z=AA5Tg#6h=ye~sxVm}(}60RaEk39dd2fKOTTvWsdF5>4QqL2<2{7mqqq`6+dKiW3|d_z8B_05+c7$INF(bnI{FwgJ#_h zfNeKP=}nF8_LE3)&m`c8)P_xYm8w)JQ8F?Qkm(Ko#PpsqA-1d1XwA8)=wm7K59fh_ZwRCjtm99hX6#F0~pr8e9Zdo=9Pp-F2L4q$a~GogiS9M2wqdgqx^7T8xpN zIa!j@u9k3GoaJ^3^vyPSGP{8|@{B$dLjd|yMQNC6gEXTmFiYA-#tV!P3(fHIuB^3P>!)Q8 zVI{bs!os~=2Y6NCnO|C^Pr1jeA#(++_QP-X)0l|XnKLa_fH@3^tvnDjUFFj4ub)(E zKbbWn@W<6VYnwD5teog0n3Ez1E7}-MkspcBovseIwAY<|J?~Xsm?gaMH;WC9+30>l zo`kIGzykL2*dG6=>fSmZHlm6)*4NY?&}>1-3?(tBIn7uz8x5r!0~dqr72E^JDq#>&Gb zbc>0$i~7}z=Ja%+@+tS~Nx#eSBf6DHyA?0`C){XEBD*;fyXl(h^%nXK8oP}KupJ4r z-NF|A)=~A=zo`Z5>TP5C9dPvy%++Jn#YzVKDh0zH!__W_{c2=Uh5qhFclCxk!=^sN zq4Cv$y*&tvN_lp9E41b$mf`eDV*BUSP6@+VP0g7${W4F@-am$Y0fx&V`^%}TuA8bu zbB1f@nxm_l>nDbrvFc4=%`Fk*9eDq=h2flo@m`?zK63kftL8$T@ln6_(wy(cMU$fMssI; zfw_4BGD0HOy`t1XTEM$55z8nsh|jXTmb5$3nM;7sz&JI?hJc z+H1P)2Dbe>HVv1@6K5t17pnI=4jWdcUzF6eja=xg+`sO*GFcI8FIa0?c{?20R9N|R z8u^ABe_Y*gZnJXkH*y}c3SLh$6|(-Jbm2yH{gdmm$mGIH*(5A@$vfRBGJh|^%f{is zDt7K7_Ixk)ej|v^CV}51f%+hU{V-Q?FPz#Wb#5mj(j+bMAYJ<)s>3F0;wpR1Du?aN z^_NXPs!86%RsQ~gnD{{owpr1|Sh}%Esr5l=`$lG*O=bB()`Csd<3K#DNkM~M&A?5e zkVz4hUBiR@8y35An45A`Gcsed3a6WD;iF3JBf7ksdJp(f-o#C}pB>$yS!0`B-+@Ro zj@=;1&A^~qtMpL|wZ#ydLnjreGu>>g!>%{ZZt_*6cie2M;2w3^Y+&$YVA8S#^JIkI zqV3ONdC(6msR1D zF;uHn<&$HNhG`Fnv&`Hu1E&jTtBasVWtENRA5J%oR=2of*I^Dj2M@b*6t5!M_E1jG zxK__pPC#xe;9NwIY1*Td)2pY|dzjPb@3U9ZnB6&t-*JmytAVCyi2oO70Bl8YsyFRs6wZGQ#10w`Zr|7kjDv^g4Z$$$%BEexT<9NNM>xWfJ0!o#>C;@TpT zJbigXLsPk;a@(R>xuSbsLQA1lSkO(-D7z!8F9SV3**u zd(ZSZ?hM4&j4uu+6Hmuw&@D44W%$K4Cq(rEkUY<2e8LTU2j!Z)hW_HooBx|v_`_zO ztH?t&vlNh($(^C$l_AjEksXA4EvWT|o=@f%aD5-&TN{+V|Tl z#RimJ$CHc?6Ndkmt1(pb1*)Ot0nWFBQM?&w-CzCi-%~q?O3}GXP_e5l+B3$d8(7;) z3ojerc>+@5%g0~qXI``YJ3{tf*;l zgZ^!Gv=M_n-nIew?blwSp7x#NUc)ZjX|*5qjh*c{d`-hXfwkNsy`2-=oh8e`tzo=v z>)g`{lfw?3GqCM^&|U4QpE>*Qh1b0E3W<~Zd<*Cw!hHM-+nwe9JdE<4ODcR1IQ(+h(G8om?rox?EP8_T{^+XGYYom)}w(=L;c7-T{) z0z0VPJJ4`Yv1YZ?kj)qLxb+?FEF3z#~G^sIkx}q z&v*LC?z?{QU8}Fw8NKHjf9#xB@IJ2RCG|@}*#EIq z@TyYq(dKc^Lhxhw%iH$rdD;Kj!~bQz`<1f?{497;AoypZk~1#nPY?_uimaz1v2YkN zF-vk={9bJ8JdRMv83UAXFq}Xk6DkW(CYMg7H)==*B_55ZbJz?`08}XD zbNK`BFv_q02ti0h&51x5>i^&24$K$ZQ*1P94gQNe0NQFbTFjRG7k8jj_MAurt?0Tn z7wCb!x0soFt>5Dd`GrZ4c4OEdg7!;2EA7^JIEGjdNRWPKI-bI8u#}a4Z$6zZJGkptF=+k_^yvZ0xeuaFW8zD&`QywKw=W~{#%#>vr zqbv@d8>1P8QW|)|pmXeHK>JXZWgJCnlx3PFn4e&u=Tn*FSoL8gBUIR*?dQFnP?_d` zy_laCg!HAYnHO)GRU|;;SDh8b)mxYqC-zmHlT;{jsex7NPaKmgy?Bt87kpGzQ4%6# zUr>>gYhF;3vcp_lYa+u4^nS=+T+(*xQd`yqY%VVA2Y#xp7)B5-tr#b~@T;$yrt2-O zn&ntS2YIV*dS%-x#%(cD`r`>{e`&4YL; zqSb>$B>}C&WG(&GL!gnL)=`>O&Z>E|hp60fHsI=ia0e&(5e#c5g$eT7r^V^^YyZU^ zXrGmr*R1^)ci?3SdK1b!ukAv?zo;K%$h>Hrl*hkpUbN4=Y~75-zXBcBWL|Y#PT^m7 zJziyA_k5xd-1I>+X5I87D-hfcE&^$PL-78Op-ViZ%D4Y9bh){?`Jdzej{hD1{}%tt z(B;3m@Lxk0sQnkpxl=MWadokA^O+f;10hti;nf|5rm7NWY(I?HJ|r zrHX~p*?0-%ij^AW)|+F^mCLab^)Q(4%~h+7mSKsDAfVk^E4CQLC$)#YUdOk?jNow( zW1U!k$Y(;N1O}nv(0d~FtYqfhVS#=UWF!#d=0Genr@k)eUT6$gDC|j==iYn(ik%fx z?~TqTs@ACWDQksvuOpN2JO`PZLu|VTpiz_E;b}cJ9DM#pX`Qls&VB9qsD4#M^NOX?S)g-tY}3s z{Dd)yW|p(-0?$C`x=IA0<Un7G5KjN^Dm@ExOXv&MOHEJUI=^x*8%4*Ed5TFB3(GB$Rtk z*VdN}kGtJ=iU5^7uLcg#g7mzOqR+m^*iixt;97nE)R_%1^-?dMB| zY#T=R7R&9X#7oOO07mZ@di!G)=FJBoX7;-C0Bm{_O(pDftA~wGM8%9JW=x@i_6*kW1%xEf`-L8yn36^vPV;cMP43Hn!;5;T9nrmY>4Fh|{rK`a+ z7Cm~p8&tfTEjRb0RUto_;$UDk_L}A0+4~ai!)RKXa)_G9KlDP{~j&xW9bC8X0Ld}jd z0zY&|V0puZIuA!OX**TiinnocA;V@x{qlV%|>me;Z{z156vIXNpjedqo z4*dA62$z)IJ3k^9zJnhN)eDNp=zA8u|0HKpbd|@<<{Hd)OwcrVFvgB)6}#1A7V`Q> z>@X&YkDg-{jaaA!-Luy

mK#I**Rr2gh4pjS^@5K2PvkCegiF9}!SB3;#Js53%SJ z>L6M~2AwVvktWB%Hok|8{+bm+Ji}>qo<`t+F2yXLXyuIfn<|20OyK8nTxqlkUhSbo zgO+m4H`h(G3UMi|p}Y8sf&VOsaHLf;?$XAnkDQ$W96LW6fq{EP#74NX=1<59N~VV_ z38ym5zKIFIjv^7Z*GU7I#AxepGC1jyROIdV+4i=F^t)2i9@4CQT3}b1$h%Sb^7E zon6Jq=*xw%ac4cnPYRB0f7WVyk|rrH6tL<2kX@#jPq%+4;h)@;$39V{D^AV}(xMiS z@FXpfw=A32r6D_f#tq1MsG!WMkYtu7$uwWA5dTC~r9@b$?Ow>>d9+raj+|_wX->2z zw9wdo6S;|Yvqrqk)>+h217f+w3XdG))VV!&aYv@T ze}&BO`PP*b1EGV*xQ#xwS*rUb^l!`VceLBY)2_#6#^f0|?#~kV9`d4E*nRSy*nw8> z`TN@TIebG1^acPD%x++27#(!a$iH~!8#KgDqh~9eR&)leFxtmmu;GdjagJU@T&8i1 zD2^X(w__9{s|oAX%^+J1^P6#%7~+0gjiem|iUNTM5$9>45Ktje?0ugc|9ME;jzu|U zV}DyZJy><=FkI=_)Y40HSor(>O+ywH^Iwog8kyNsHRQg+f5eF(s-TEArFG=F^d^T zFEd6JP13oMV)7mi?Rl{!uCwIUm?I(#^Q+_^PkX?IS?U8cG=% z+xJb-%E;3ufAcE&d3`-6)269I+@r0l{QIbtUtO~n{yg*iY~*-}8zg75e1r2M9V?b= zLN|RsI^%M10;wG@>+t+r=(@(8seZFwv<8?Y(MDn&AN`lNfc>)fW?>%(2;1HvBv%Ir zfl9!Za(eTK*SWn$wR_%j@{qU)!}J5_bh>-4sj@>j;!C#U4fqyPD{pJR%Dow>|2YyjMd$r7c1g1IT`i7)A* z-#>H9zF}RgW`CO^|9X)C=o7yvV4%;EZkl-Dq8B#7G6Ms!e} zZN-+g%#^DwU~Azo=SblFu&+CGFbte&17&dLqi{)Lz^IEmEYx3!qTuvoB6&~Fdk&@F zBYKc&atwv`3+#;FCA2@-0wsoin!@?E3%g|(hH?po)ZK^ZoVW|j3QJLj$ma(!j|6*o z2KWqfdbJsPhC6(Ega9;kz&Q`vD3WUa;hIP8jx*-r2$~{)xkC6#`2)FvE7c=3aYCjB zjkD5Z>B%GhJOIQJBN$c!+*CasLk(j>BMY&EqoJanEUbz~BE3`jTHykBo1<7pg78J6 zC?&1_QANez7>*y2aAK_{o;WA+yCbAH}UN znK6*ZUx>t;Vc{bH;@sSXHp>7)A7!-4&W zHACe)>0FDq_Oaw=L@Wq4w-;9s7!gGTMa+wk$Hr42`7eE$yZGl>VV|S{@sqb2Zn#Kf z@u;V(wsb;KX{zNIPsS*{1+c_E<0o}%uz9*8H%^dCdy$`Kpof=FfK{n?MxmZ(X%ucK z*dH$o0^oa)>gQGw5xG_tI2I6sQ06;UMn{tBSQhAST`r1Kex#KQKM?inq`aTI+*#UR zW6fDWvizN_qA(*8z@z-rv;2jtZ0JGFPAWXhx`2fOm;$KOm8_`TuPmj)s%jS~x27G; z5D=uPjJ2#RY^jQ>s31+#U7?PH6sh*{swzgPiXSW7@X~@S&#QT>NHz;z^{U8zE-Pp& z97PCmT~+AhNn67UTliVair^GWUbQ&So9U8Hf>rn#DN_tn+JejTfK?YK;Q+lZxm#5C zgy7M*f^MkYU4T4PC(C74~>~E-e1qKRD|-mIx6X-n3RR zmGM{8^%r(jq3LM_8#zDwx>Mzw>{TT7cPVpT+Va)2R5f8AlJ$n(va0od@+tKa>HCIu zgi2NIY?*a?W!?-0P=m2{vr}L5tXESGf_K$&LPQItOuv=Zc@ZZYWyYDa;d>H`mE~Du zi$#gdchgqEs7gSGpjXFV#0a2BCAoi8vdX$ZQ+@QtYh?Xwvlkh7bk@Qb&|gNE6Z&HbKaZNGm~q*+v<6vugdBgby}k4 z+V^-$g4H`1Pn%;hJJb+54|qD|$2*#7=!WpA#>QI>gxl4QB7@&Mx4;XXe28sM(w&i_ z)*9aNdc3LDQidxwF-k90`|F{iFX>Ait;w3*f2h0irBWTVd%zhnPnkXc`Nel2GBV0K!sewci`oU0h+TC$9ksXV%4;QBKEG*cT#pv@#a?=Qc(4z-orNt1 zYH^F6+x0I2o+NziejY9mBDwZHa{u}I8%6g?&=h{KyW3~VfX}JDO~SIN5t!X=^I&*J z!gUK3DEdF)3E!@xLY#!Hv&9Mjq;D&_61EiEd=7|)gI4;~wj?i}*f z%}L6d5Tu<@;~g78VxOoQPO!|RTAS$I5DUNWAs?OGzi8Ia$ZM!FdFRdUjw&k6tQ+v@ zqpa+C*l-l|0X|%m2uGLSdQ9(C_WDIyfo&VkXsY2P$JY>NU?#h^e0slMmO1OptRu|+ zhOYRq?LhmijyY_HuP#L;Ov1RF9nS3jw$b;KJ`&0k+(W`Yx7nV2!`tvhFb`htp6Z;V z=byjDZrNE2;O4Kz)(hnKor8Xz3mc!Mi>bm#vd8+=740e}pKKDCT+oe3k(+G5`_w%d z@6p(-B3((Dqg&wZQYX~=_X4{#$+AS?GcTcMYHKrZ?Q3#nvxM&(8qu~?ptVT(F^h-c zr9e2{hB(Y7w)&W6k%T_7iJ93Y(fFpF5erBj^WwstaD~rnY=I39jvco z^w9E--L6c{o={YAgy+XB+2JP=l_iF(CT?7Ez2n4AuWxmB*<4m^|Fer_!rjCnY)d@Z z&R0*MvD~p0?puXxMT+h1eX{>1-_3jS#==lqu1@FkULe*nykYPn9)LO8?7;-l>OsrbeJoRW_@7aq|btRIXo+tPgh{)WC9Qp5^gL8D7I` z_BmFKK0Fp|zd9pPk-i_4vq^ey)~@x|(x?Zru! zM5OF!6~npDhK~6?lj{fb7fN_HN;9HtPBWSoj>;nFy9l>r4voM&998ZTp;87bOY@^fdY4RHf=un;&t z2>67!-gEU_BTJW5pyUU}&U}SFNKsv|lsxQ5#~j%kVnekaTrAJ*O&J2$+ds?WQ9u@N z$G%gyh7PIC@?}WKmx$HJ7P$xelPe+Cq0W=#j@M7=8TBY#PcF4Hpv-4`xlW&+eT%PW zudb(xniJoiXLpB}V1pOC+UG{v7x&MXi0zlC>6a+qm&Be0-L9AT+Na>{SBJ^2yk9ec zg0Bf&Pi0@!&1sb$_Js~#?bX|lAK@=K`0q80WmR7-P9RXbLp6wT|9$Mece|n(4LQnZp(nKguF?w^h%*n=bPLo2?J)-0?%z$ z_M?JN{0FuqkB_>h$xO ziV7uWktvkA)pmhfk7wvr(yi3bKeMeKtG7FyTJiM4Judf3qP6DSs@U&VvURJ+s(I(A z^@@OKGT_+uRHpSd|DK#7MC_a6$y^PQ99=B;gViL5A#vJ;^RtRp?vm`4gyxNL0Bn-q zoAS#wDDavn7h&V^VWtiDy~Uo(`+99%>Aq&`f$Lz|M+Z9$W$tQz)^ONlYjcIn{WPR8 z=vm$c0RH!JZ1Ox+Jrx>t1p>3k$aXwznZ*4$K)I)5e~m7zY5xAXPfLbGxiP~SpJ_L@{Gk6#qr9q9jFG+%(5VJm@+l%Xzra zDKEIWprj~4uA-`}(1oU^_RQv{rXk|PzQn4N(yU%@+03rd=z56Bsp}2BH2u1O+LWo(_@DnnnQCb2%W)AHdIOPWfuiI#=Hcc1o;yOxq7-~8aayrt|PxGj_;y&^6 zr_i=6M5E8xFASM4vkENtNu&z)UgEaOkxN48F4*9eJ*iMZZtq6FoVOb)uHHg9FdZyO zV8;qW!nga=RTFPZZ9{Nt4H7HS>1^TFy|ui2+2S>A!K_3T8Z2Yr<7i%%R}zAS!v3%+ zj@fchIy`}z-OZ#&Rdk${vD;{wRoMRV(4=JX>AY;nvFUM4csOSU z+r2jYmr~$30OEhdI!+^>Z!q7&{%^#(y1F_?N5}a1`2Q{7{O|bxGqLW!xd03I`Ts$z z`#=6e7{Z4dZ|53+L=r|D`Wj;ELqPf}GVxfvh%LvKXxYr7uiB z(6u+6&XY(L>Q82rpN)I!jOS!Ou&b>%xtw=L=vZHG_Wo`BAWUhy*&h+Y^Ka(^-5+CS za;BhkwY!BZq?-3kWxqeI)qi$G{pz{lRlYx%zZQ2$?s|K!-t<60?E$;J-d~>A#`;@+ zeL^Td87M-*Smqf+gOhgxkq}x86;L^-c8wqGFn5D-#@zDd@y$<&bqMz`_QJ?A*bC$+ zfn_9`)N>1akxbT)dzP3(mL`U*W6Aq5d_2vhvVu=k2LSdl&4YN!cFZCf8H&>)1vwOt zgCtcT=ApEPdO3Lvojm9;RoBcaHPsLZNJ*p0w>ruoE4NC_v>iG{%d$(PKF*e&c6Kwqu0A7)(i0+`AB1$eb@{ zfYH#mKeiB17{3)EA%4VH6?Y3a6L?4SSK2`=p)_5zw!ukN1yR(aiL`}9s*2g8qJ+k$T3ZTk-c z(W)MVkN(}c7Dq;}VAEK^NcqJ$l?FUEu4( zd=%Pf{brUw*JojxRixTrj!~z&xk~x?m}N>QY|?i5yE)~ujF}aKbz)$Gl24(+9?!G|D`hB4?lA+DplI5F-{_pmz6q z!;&YiDH4^FFN2|6C^{lni?gjzIo_k`8I-P2$wpTnF6q&-W3NnmqtQU5Udj(@rZpox zADpvZYBV>~_f;*_S?^yGPM523c~sDI5M${)!lY75Dja-z(@6D&Hm4`O&=neH!^PxK zh*YyOO@CY|ms2lJ5!*6j&eReThbhmlMnc2KFPUjaqsN(FH^;6R0)3V*HPNY#!y6## zFpOfwHGf7MB%Lg8l$bXUL{&P_&#z0GBegx?+4HOmi?7jmXoyYXJAXcISPqdVgjLr# zmsFx@VQF-rzFv`p!EJSidvqSqU#oz;rHH&jx{Ud*wO`-#A6pQ*FCSA}F3O z)U-9God6~O;*b8s2@Lm&QbA;EzI|ji2mRFY@ic~yz*Orx4nwP{(bEyNjNYP<8q20q z%ihEG4)_o@e1M)!Q!!pijIar~VxmJ2Mq||vzG*3zzg!vb)_czWN!~WiP98>UfwuXK zr+D=|1#lHrbJ>EVL16t``)PR@>{37bs8&21y0%Nt*>x`0?9HmO38Jy7qP3I_V3p_n zj78<;rg3!Lj^4Rn;QZd#D7ieuyLS&HNEp%Xn*ZE+@5a^0H%sBNRguaHc8!^;va`Cu z^O8I4Fz5aga@MXsY`UOR0BB&R?u!?cF6o}P6ZB=^?FBoq${4%P-iJ$1l6@Y;7g$oF zT^0a!tk=IadF5FLxzI>0WDSs;F56)0&{?gmUtSR`JCwO`*Jht+sFszJXuCK4gI)5R z?$~;sdhUMzybeI^+<{ei`G*g_30LUc!=8Q_;sxKvqdqy1D!h*AfbY_#JC8W0U#Gmm z_h|-*>x1^kZk3HYooMl=3e)x&*@Tzw8kn5StM08DgjY_>Zm75j?{h?*3k1&XEBQo^ z)gthx-?BlMr6c$2w7*sY#Mo(V{2who(MOIrDZAG~e0?v*c`kc~-7KWRpDXwbef!UC z6McfWwd`n>3l984xPCU+%c{E+sO59U(l@j7+gsF}_Ob=ON#6rbJp_A2189;Ry~rgI zhy8w-1|ac;3xzGmTCk*Y$d-mF_J~AfKa)Y4j1>p-qB9-Zi-e6O1v8fU zHzhXH6P3i0AShC%8FWW)%fFuu&paMxTmclJcf#S0CA7avT?Mg;c>6cH=ZFT#;zCdcRx z+ik$nN<7BwaM7$##TGnEc3H-n&dMH^#V(auPn^U~Gz$(=#a)x@J&j2GO^$ne@jD%f zGZqrNgo{U155JX+KQ0T0jflUtG(uX9LwSwg47dNe8V9A7kn5I!^BT3#mH-WkC(??4 z#7WeIbRdH#4QEfJ1ao5s4eHTE#A_}vGD^kwKxxpPstiNxvckt-|BU9O#`t@XBnVGF zN1iMa;UGxgXF@pyM?@!;j{mREBS#^h}d&fS9y*A$)wP{JEu`r!HOHB ziGP+EZdbGaXt_L|(zB)Jkd0C`r{_YJX}uRh&K!E623G zgdD6C#>!E87)0;LgXR|*;Q?p*nern<+62GQ*nCXCz04-T(^Q0`)DI^inLRS$#Drxi z_v$H=0^aAErEJ>LKTVq`-5e*`I$9Gws}?RZ#Jmjnb$^X@z-I*@P#b3dfv^r9PVx!Tnmvpi&LZY+fZ@vVy1EXjUq$ z0ujzrnLtxItX*{ejn2cmeDb6!0ii}SnWX|QF5S8oZnma!sRB2nrrA0Qlu=gg`NJD4 zCIYjwQcSc5eS|4=2GP?V-S_JlP9!g+nn6U)F_?#RDZG*7@szW?I|Q#_KXVKxU(@Iq#rs{PsQ0_M(pT67P0*==O@J_Sp6IN*Pcc zen%~D$4g{ei%dsqX2*kCN9TKO$9o4VV(UNejscxc$n%a7?@B;N=a8;U*3^5a9$pt* zXve~Nt&vyPqIc)oc<0P|S36JF&Ux1=Z}-Z1(UEt>WM+5yc=z6U_Yz{yHf_(XOwWl; z&v{hOb!E@TdJp)$2ZEsY8(;5t-Ch`TdbeJ0_4*^C%KNn4?v2FJDopu+?vG}2Wl*QmZF#@1G}>%Wb#**n z@AQMCekpW!zTThAR~k%r{~u&eg`V!u_m}(g?dcxB)w3L<)@cYREG|@t?-X2y{zx1r zJAZ$OQ|$(0s9Wy-cMzP|6EgPk*SGKA6n7vl!_#*7zC+aQM$)yM{Fm%WwI9vK6OIAF zX`D*>?JEZJ_qX>SjynNV-{-gT+8Oepe9^;1Ha#hLI{Z2Td2GLlD9g}_B<*-&hZ(N#M0NPIMew{xTRs4R=^g=8oi|7M7t)Jk)B^~Onl z`)wL2{Zz4OX@)XRYS{}8uPI3{Sw96`{yUFtcv!Nz?t0O-tgtPsh{S`aCaJrw3<(uC zueOBIGLByfsWf%BzV*x==+)<>{N@7oxE*xW=Cd6_ht0emAxpKr8{JmY(a4kPCa+GU z(TKt-Tz<7=5U@x1Ft-$*G8K;)`FHkC)3 zm-RJGc^wS|W0jLY8lxf9xa0d%u?*w*+u9F0mdY_NxGvj0Z^{i3V1vhJY95^nEc9qy zCLPz2sB5LYXn}2F{o_~r*Y0?R2ZH}uq|GJjfH}6ZJg#1k-!D6?7YQ?@-z+uyvzn{E z!$#i>P(C3YwW68~J7uHw)89_^tO>a2{K$oVyBWZC_yA1A3N$wUjRm*%M$U<`2K4_- zC%L@O8)^G1^6UEZdFL;qoAu{ixPS(&PYq%GNrOpUNcX6NZd&e5_Z$E^IJQ&Uqp-)R26+)zZI0;GN z=S~z>s)c9-m63m#?R6ncKKV!{lKr@Ab)j6H`6wTWbK3ukl1bcKuoaZhf*fsgh`U%CeZZ^?oz?7VE zbX3;eIVlH;oJyj6RM~GXxj>YhT48idwZ%E5CYqeiqI^uddk)wzKu+&4Ij)80#5F86<(zS! zbs}5JvphQG-hQ8bgH%LDT_!HG=92Ubo}d(XE}!6XnF;#&kOw12C5&A$ z6Uy?Cj}k*AN=Y*tsr*oYHAyATSuq>y{7^`QOf4xvGnbh7P=x$>#J4{>2W)>RW{N47 zwUD0ASWC{j|2X1kT%F8*Q_cKyX{88|UdTmwEE6NFP)dqiDCSWsSG2QMO_yFQm42*H z%cfydvleCFdZ;u+uGAcsUTVmAth$<@{;4#kp48r4?dV&nyDz;AT5GQH?5fniA6xEv zYpxCWtmFr+5jWvI)rHGd8Do#H3<)b&^EX(l*VC+ySwA);4_=sZ+N@4^0UI+e=`00l z*XBZ>nu^3OdEt0zhufc;>tevwwiYt$P3|ct^H=v4GEa@T;a+M=A@5bKG=e8j^ z2IthujU$$4&{Q>ah?+)x2%agI&G_b(*K@}X@--o`jFjp(2%-Q_K(N1_t^@b5 zjLqVoG|e}J)jo3g25(au%}K-4+b*OW%)J zN6k?k1;3o<-s|S$5O!NCl+x6|XICNzUft2z7_P39NqhJF@x7Cl|B^kKqb=z6@#bHK zaL64A5Tgx=-d~38d>BK0vkajT0VB4iOo`rA#?Ue^ql&Q&$)&Oq2(X;V*bL70%kR6S zrCj5NSa*^0QKn=%Kl?0DT)>H}K8Bw#E0fs}#nEy57m<$(T#ye~RNhub(TDo?EQTk0`-L_)6U30k!K-Wy!oF{=OrVo$3&@qeY%a@d8Eq69@aG1 z5NFM;R*%m3Lw9Qz_!pt&IfvuH+tH)F5RpS*$HyU49QQBysViBQx=nTkkE!MA`<(la zW3FewOknr@wBJS+y#r_>b?Tvnw=4d87(f7V>RvbiKM~n{IL8} zL#A&m8@AW%a?Mi<`sSrb9Pj$Jya%XXuh&rUe|k%tENA-H?K@BkFMaskH{pUGQTJER z|Esqo@owj){R~>~y7QRkJL2?zozel{XAE-(_6fhuWr8VZr9NHNYu}a{!H+d@{1+CC z?`!kmrH5QUFj{GOK)!S1`H>5s!wvxlCz?uXKX_p^QQ+tRea zQ!BXk^UCGxeGB#L5g_<^muWyfsnB!3I1PU6==r?y@A=qA#XiaX0>8jUzC5FX!S`QZ zVC(=0u7Gcv0c#R|uc-mA68`tg0Z1$ z%@st_=A9HKiklWRFA+$m8A$&U#DMdciR&-3XCRH|-(ra%9?c-$mA`y1e+6)Y|4wh;qVMrO~VxS3=s(r(M}7|Z41$-A{5gMF}B21f(tR% z47KzOwN48~;tJtcqJj+|RTH9;F`^QM3^Pf?FlY4V*TD&OpbB&43IjXi zgmET@3kijVrG<(2h1zgMBx*(^dqx1^aP8aB<3_?Yb|XY?!(-qg<0UcL(1h?kscJN+ zCP~9rG?>czBP;&#H0DRv;Lw&PdAGoYcX~$E2!--3tfZ$BYiguocC4I>lHjQCSJa`Vq(a_Qjrs z#UA0{-kikTgh#xjMNEf@-eW{&pF}&gMNe|YLrPIYO2xyLhYQ}ueM^s@m5iKU!Ecg` zTGF7-ONeSJjqJb)z)DX52_?{z(h`CqwZanynG-2aqq^D>OCX~|;NoFN!O^G@@hIux zvv3$+lJTtR@$)C>!GW=>TwI|)xz1Mjo;9&V(qopnl0yrU<*DN;3zF~Cl3CDW&pcC> zza?vq#z=uu>}FG{aOlNWldCOLv;aVHP^=1W@=6*|7B@v40F=Q68jhwMNdir&Q_KKV zRc$o()TstisX?Qu`VlFjtI4YAagp$WnJC*7RvcpH}8lL>9OqqZZ7P-9()@t_9oxWP@=2 zb7xf5e8wgy3pAQ|p%uVT9?yIl!IGXHEtw8&m7bQK%Lhv5y-ix#H;y@1QxgiBcx zj@`D*gB$|}bH|-profKnwY(-9ThSwWy6CRz z>ZiJIdUdax=TrKCUGCGFV~w5Lu2Fu6OuTYa9T15@s_QLCy{ zySbiIA5qpB!3A5Dh)ErM>){#OUZcr~>8_C;WD!@8nHFJ@52sv`hgGR~4ivEHsP=u# z&&y0_hDi?dNH2#;ue&HB1XOBLR&!o7(tZ|rYBV!RHG*9;TVVk-gsDBoK~kXo_0Yj@3BjRCDOo`JjzE%uj5D<83X=ic5C zE$I$%ViloofEbskHm6N*O`JB~@m2tI)DC%+S(Z<=V{7DOyH-!Zwpu>l;Jry=0l)IytyR%fQvz*#11*bE9t)up`qYej99~GBB*=gwB*`C$enFZ*I z>a4N?7*YTRxB-J&T|=AxEwEi;Yk(;LU}m#xjyt%ws!PngYX#`lwVKtvb}2M2)yOJ)8eaY(W*-uQ`@Y3e)6}ayK zh3f^=?#rbvmbmcBgzn=l=tYR`{qxoLaaj(1)w?m#2a(+m-qnu{*AC^KkyTkyS=@`Vz8cf5=!;tQ#=NV>@9#;JdV#3XUmxyMuj+eDAro8I@$1@_RJz^{!K%gBC zH9q_VJtBu&!8?_q!ZWI-J?iY;tMN4gft6%CRm{U#3}k`sGqWBE<{1mU^37_mNRAvL z)UF_!ivPwLEu+Ye`@}Zl4vzeY1W6w!q4dhejY^wpH=N9#M4A|6Y%RrY*b8g-;pleA z_V;&4Ui!dn>hf;!ZlSqsrbwPl?VlvAoV+n>;udaB5}a~rXbUHtYK)#@3(jYt=&kei z&5@|BPMg>=o4&3nU)!o_dmXRj@!y2QgZ{)l+```J!m*c}*l?S{J)4;K_G{QmMW3jq zuA21aOs9{GnSg7Nkg6sePm!x=s_aZ_J&&oYELtfqqUD~G^J+q$X#Ae4rsk>=u9^bl zEkK}c^sJgg&1nii$#+}NFVw7Nl58BAn7u3q783KO3cb%Qay8L?7gk3mQ^hpTSfn;i z%-=v&ab3?#Z$?T%P2ckP5Ja>BnP&F5GT$s~*VmWE-|3OE>cwqpe_JgbPc5NcX1_(| z{z#W}MYQT&*GY9R8%!@L!Y}LFtYB2kcxA3AbgzikYu2ZIpgb{$wo3;%qd~&Ngmul*?>NpEDK3Y1WVZddH@CO9 zD)2A{WSZuEwnj3y?KOf#w7GI^ftyBr_`TOie#O&?TtVZGOJ9MuR>F!^` ztcKaFW9F_CA?z{E?3;Y=1?DU}TjplU1m5uME?~@#M{e!Qq+LyKFK_SkWgi{MY?4-P z5JqgzeNUdyZi{$quj_2rUst)U?Fu0I z`EFnG9t~8VIPvY6AuR30>;Od&w(NW6b#6|gv38pd4ms3!(Y0pq`3@mv_t0dg;b(S# zA7&g@?mcUk|JpgL)IMa&UB~e~V7fW`F+8A+UA4>Eb%amM0`3>fo)hns`pJ}d*DOcp z95mFPr}!>40MEd5*ZpiR+ItQx;IEMRF8dJAsPZv%wnn{=rKIL2ni`!dHsm?Ekl~k_s4%MVj@UKlbUm*3x96CAZiuhv068}r z5j!*EbGLL&+q!eF2|XoUB3jtxUS}KwRLCkg`Z5`L*=jNe0E#9-N!KRXVtvt``5=Ev?uwWXE(SP z!`|LW1XP+j1(mpG%erUl-k0F}#}yN67gR^q<7WfESEIaF_qwaP#dW>}8=FvR-4Q9Z z6(@_`m+;${h~BqAsWabQlvgs-=wjzn<5y3=cdxj2wXO#nQOlxMt4vcv1jr8zQNz++ zD?gXF$lj0W-H))T=k1mEhFxPg~S>^4=((K2I-uE@gCq>z3m)>Xl?RUq|cPpYq55d<7|JND+OE#kA z4mg3;*oeFsaWS=n4*bfDz#2)@Vla^bSAUS%8-YWnQSh%&kOj6 zlDT~0zZi58Ph|_mQmGuakPl@`TZucaT&DjVwnr(j7 z+rVPbi8LF-Zm?GUxz+9Vx&1gcSNw1Jz;1loFm(sRktjU&&@XjIA0R}9AnC_aT z%KtCfGtF>0a`VzQ-gx?yHxK{Yv-J|XGHh1Y*Zbq~I!Pv1&u?t~+u{@Qj{g@JiM;?A ztni({ZxmyDK}ejhsn(jlMR@=E$j2I5IQAp^qHn&XS-_1bYJ)Jc91Eies+w|x2)f=@ z>;N<(=B&`p!w0n(uG^8+D82{yl^9_V$%0sjfbatc6oK*oezp|+AVFDF>?lcHHPk2w z?Ep(JLEj6`EX~O4*dUEL%fc+fvZ~x9!?x@ENP#sB0NO}%-wrX$#nm1$OYwh#KgkJ# zkvhx&gN=zF**sZlQV=7Mp_AnxPia<^q;FwSl4f^tn4u;7pX|wvEJNfC!r}5)SPCbc zHA0B_Szbe}#6?xhYWP`orq$S4Sj-H0>fMZ=<~#C0Q& zM*N){W$& zO+#7jp^elZQM5&0X_JXQ&yp@AA7!N|A#HXf)%{X2Rz2oTitfWcT zTg_BMVb<{ZLM8kcRGO*11)oZT)2zwWiM3!7?{LF~5NCUXp0M^ZvEABV`m$n>+UAJ_t zc1_=On??W`vTWl)Sg|kr(Ogg+LbH<1kaNK!Yr)EF#6f9v-~t**YdbauBPR9 z9zKRktjCF`)v8w5x63-lW9PuA9i*yy+t10j?QYUH=3BryaNE`_WEbZ>T1QCtw(s%A z=XR(}E!*?5$}Q=hOGN0h=*9u^XV6Z8Am?JPif_t$Vb+ZQdtnoUm-%s=wAc653+V0o zZFK7A_w!kuGr>cIbPG@74GD*&0Ay2RpLCG6Um#Z3N@wTT1DOgy6UMYpFJpr!lyN7( z)g9(@1g)aS*2;EdK`ZpFm-&*`HA-|-~YEQdG+P{PFM^D$v8#e|a-qa-%-2|B?? z#H3gfmp=D#wy4G^31dStR7eRK&Xa^#860XU#cC` z%C1RSyU{w-{{n@j5gt-bvq`xa)n#2Jo%qQ%U?2cQ(w?A;xz9tVrQsg*d+m#|Qig;v z%@tUCT@XHdUsz@c7c!wl%?0~Y=xNqr^b98pc}hG9AhaxU`Ra_ejPK@rysapw$0WtC z!WH65ouxhxk6sw?C<2G(0^V?_EU-1v?fBSOITN=g+`lXTg=kVc3@nwCk5eF-d4R+w zDjR_Z=|TmJww2-68N%V7Lvg0JZim>r2p?K*4#BWzsM`lPYE?)sXRe^MJeAvRqp%L2 z4P+*o8VW^e2sx1fn_s&v>r}WY^p)6KhCx&vJ$3#XMzGNh1EpQwCf8>c*w+hG*~-&O z6czSi)Z8;s!evZWl(yM6T3q6*i(@u-#if#>Vo=H89xW{jE;bfM*jj*+*HYF0RjZQm zHCDfG>}?QP*FKyaT00kREzj3=wtACVplzzn&Ab&> z@HATc5Uc(0p)d}cUh{{s!X50xTW)yNJGrTDopBbmvTarSf0SGcj=t~agum2QMA(ND zN@)JuhAt30FSHxwg`DTG!3h6Vy@z#PAHoMx^$%OT0g5y1e0()qldpYHQH*+T@sxfu zlSbuJ$X!rNwn?Tq=IDaS|nXO1{g zG14=b*Z_k^Ux-^jv>$0G6mF|KH+E$3R!8Y|t!wZ)O(XJ-B(33?4w z>uOz>#)NKb@lMSctKe3$ZgOk#0i=zB+VU1&97&5X#QZhzHW@G88=bVQtp`b#3Cn3w zO<*HV&!qJsriG5UD>ds*GlZVmu>`T{tJeC@%WI4L3uRKeXVQ!|)j&XuHuC|~%3JJ7 zH?v0{Ow`dpYJi6I#FtF=#nsjcgonJJjg(s$cFbXL2~%2!vIfr9_WaPc*XX#iubc9+ z3t8?o7=nGS-TY)kHb=LO#DnQX;u%!j>j0RCv)v@xF=&fb2Y2rNap=|sft*QJ0MJr4 z5P1z*ubrsvMmi0{Ct}}=zSW{u;P2;jkaSPsPVANn1-bgT{iAs@ZKzu#7gm+~Ak+FA z9S7ic>yCHzw2$~h%yYLfyU>@iP3K0q2g7RRPst-GFAi!lP_(jbl-xMEgv zsxI^!_H0>7byth^VabDqRq^tvvr3@#LQ~{xzvYL_jG*O}vAVvTzE*w$9NjeSv&z*7?qhM4ud9H+Vf0^~ z?~P(w$6ZdupYRuMWVJcCEQhUoMG#7FG&IHwI65mHB{Y4TpI8Pr~6%{yl&o3=L zSmhq5tseNP9*OfFNwB=gLqrE+eiX27%zwRzPK@Jyy&wMs?>)PbiU{r+v5*I=E)HtX zD+Mu*dcPk9b?*89OtnQnG!RvD=FH{yW&tj}vbq;*{!&*IaaNHr_f;nXsRq3MLO26L z*Xt0D`si`VhOKZ3mr58=;9NMH1PGf5j0f?BoBomvjvBPY4RoMFR}4H3@PPj__~_$+ z%hCl<^Nn)|It{Y12nPrLMf&Z1D{$(IivmP;Pa!4XkAO0@%Pvmz2yITBHR8g^M1);dD> zsmkBW8a9d^HijF#`^z!H4bV^m+@grWI&r~n4rgZyJ{h6mC-$pI4t}q5pkEE^eznwc zBP79+Siljfq4rrYi~c&Sqs74;>>oVs=;NpmqZ1zSLFF*j=1~JymOCBc8&Pv;q4xj7 z?j0Ya6SAsZhZe(ytJCrrd&U{nGlrM@>>*z$Hm_oHzG$8NY^Ik2lz5Jwa@TKS^AIZ0 zb`bYa;nY(YN%TA6r&#kfEr`)nS8_Ftr&n`RM$_zcG;RwD9QSiaYDjQhrPXPsmlp#1 zI4kNWXbBHTdA6E%PykKLqav2X^~~G?AC1#EB#IrP4$8b}TY~diGz&rEk6hKrO5I;Y z-RsOW_}1MIjlF{h3?CUZUD^CI7J?%W)J;c|-Ahu7UW~(@)y+$SP0iveLu2Zl6Pkvd z#nk!vL8O5^mAlM^iQY_5!8OZF42Ma5GvG3C%Jr!<48WzzJ}>3zdF6?f=uwDZ8R*36 zW$V84py{8=X%J>wsNkOU;>HS|uFBx4*0HW?meEu%&T%EN!%ES69H}V|sgFTHH0FNX z;<5gV5nQ;b%PC6C&&g0{f>mbvSEtFFi`r1-NsQ>p5zR5QVy-WR*~`M&4{o{FsxboZ zsQ~ZJ`mFYnPp(N^@u@C~U*Nu68wL#LgXCzX$ z(Yz}LQxC>+R||sAQL`vf-EBORuiA2-QG&N!K!S3OepKTIXG%Qk7Qrj;$>##afkwqL z2SpOJ*^#H=1m+o6&kARjnONzvDw@I*XL=%<0etR(e1VC!!MSCL@v6iupM5Iwry9B` zd7`F9ZkqDeexZuwaqeKMbZbf90;X`n#x^76-lQghltyadCBBdWZ|8aAs$q*KG-j3v z*LP9p^JwK~(I;>*wP`u#Wn@)23dP|xlcImE{|4NHi>ZWh_28HFhhr65mgNcC1hiF3 zD0`!&NCk~lYaCQfVwNpx;5A9-45#t-msAaoRq2RSt$k1}(bP0Z)e@Ri?cuX*RaR|G z)TlmGotKjwQdS*HR;#(y+)XlEmRDVY$7+clYTn%_+Ec^Um8*d{t3lmkUccA82u1e< z=6pide78sabkrI5=XviHatoK1sPPwSct{Dt3%@9 z$dhJs1^>-S(kN)x$j;X=_V}wCvzAu^6RERK-=W?R-FZb)u9(TCKFr|6SpK8GT*A6m zA@e5%Z$n>#D$!jd=L*Nix(B3*3f42X_IMm-8c;q|lex6`UARQPxFp&#kk>3m#Us%T zi=Qsd&`{F@kF3@Gd!zR^Oo0psNSCIib-cf%c)ZL)zcgO{x$K6Q;D`+GMKU&p&(^!P zVtN1M3*6NFFKH%|sZp0@CR!yR)wd#r$odi~d=+hkI`vk+`FfoDdajSmr()l>aUaBU zejVw2_p$ue@U$1|Jg*J|LQLP;rw-J&{Js&+o{DnB?=9czcvG5IH!qz;ijA2=^-f{M z4_LWe(1q6|#rtciPie(F8@WfH+V||O+mQbGkje3s8Mwibpy4ioUCCK)_Q%G0w1cF%DFPWHWY#7CC zk5pHNzG&Hwz1xi~d91IGv`&t+eIw<1cE0qF^<0njM|QClnspJ-v_(yIR8RP1v8dQi z(veThAx=yq2l7wsQ%@XxO$=4r>_Sm(Rn2T>OzlL?lKz~! zlbw2$;;H+Z@c=bWy-iPLT~EE(v^^orJxWcjUd#sOPJ?z%5pGTcA)o^g&cYx}15MAo zCCr0c&0TfQBFNCfPt3zqbs|>Gi#yK}YR@9j2CpTMr*K%EpU+}lErNfaQ|=&g<_IUY zo+rkN=#m|$K&+;|oTt&PrK@tZ7;$K(9u%62WvgCf&73FIE+73hp-jDC&OB079m*TA z%y*Uc!fzcb;*rcfVv(^d)xBth_?M$A_J(|1Pq$L-YE{FhRGWL=jBwmpdtpIx*~Mlx z^zTx#^jHx6xW)CPP8fd684c+&Ti~)@#T0EYaRW#w9PMS@?rY`De7X(BT6NV~VahR3 zb6%Lv1k?%1J?>Y^rWFvDiQEM3%JzxOi9xucrbbw~To;XuMjuPTBUrN1oK}cQ5Ybf6 zu-?v9q=B|gpuL%`vYv4LQ;>U^vYd9ZE!4)bL}|UWef>AS()J2M^3Q?cWvY-|O#W}h zbO@N+>sT8BR;HfK?XKtX`%vYL&|6#Ai++5R*&7Q074x%(Br3q56bbLsVhefVE80vfbxUNu*|`<@`~me34(Gxuz3MO_&k zxX^)m_oGWNE5o#dU~h7r{nJBDp=Lje#WFo_KX<GYl>Ef@0?r&!s+3%7^c?f%4L;>_c=KExIo~0o}}ji{Ocs4IhvEL39+7 z*z8PEZSe-p6K{Ke@)PUpNx)Gzyk257f9UbK31n0BVsQogQ%aiwA|3dAd z>Z3;8>7=a)`%hvz9(7yOBTVPtu9Wf1SQ`WOiRtmbw)LU4BO({izni_7lymHUF-YGE{BNarAP;E$?f#PYuM}S1oA~rtEG#uSV&!S zz^Z$oUvW>WMd!=qFKhRrz_-M>x13CO3j7P^#)-d`$HBAGv1#uyvu;6dg=Cm(a4KMB2#QeMpa$WaN(O6&4Z^mCfQ-6H= z*nMe!xyQJEYcaQK!}zvCX044ztk?N$=pp&|nQfc-0$Z$x>ON3Lya#vnydQlS8sKr5 zP7l?7rXoGJc1f)&(vbKr@^*bZz^>Z-*nh=%@kV?L=Im^NK)JnvBjcLa{~ZW|L1EH9 zt0x=^LncioZShDplg;J! zaCQDjK9|q0his$vR6buUoa z&U_i>_XU&1YAMaGP|f92?RJ;@>&5ltYu#?2KO`)j^jrP@P&fv)?UeiNW(U>1gpJiZ z)5%mO`yy_qG!))R2Sy!9a+f|2!ZE6kfuhIL{ z$vU~8p6{=>*UQ^kmIo*5j5hp$-`M3Ej?k(QxmIU682FZrf*gCn$XsvvF4H2-n~r#7 zXN2Jdk(fjg#F^@aV$^rgS$ZPmY)H7!U ziDFb4BuP?S>mh z6P%|ea%AY_sVWNDI2JWpc$5( z=cT_|-z$pqBeAI}iZZd0Qb062sj4D~L@BFMFF2}Veg1n86m}eRR@HW6cb5A%z+9SF z;1d2pY#gTo&@@eRebO|~OLEh;ENf<684u@n*0gRre%7?1mB8RdEqSo+)SvGRS?OGK z!lD9tCUEGxA2+n>bo;p2@homXw3OQSU~n0L{a`rS3-_UTLl#oFDwDU4&6zuS6VZ*-si(K^AGUrq3w{4@B6vUg_jH`( z*Ygf4MZovT>hRW*=j z`tK(Qh2Sqm`#|*SzkEpnA#LkDF?a|e6v_us17(6pmvo?vD1@*U z>_er9_hB{K2Jjl=!}zWW%C*x6dzb6O*;t5><2WdA5fW_py@~!5Pz+PRh=t4GY9cq4 z3)4C}M1>g;O~|s-T;#xcEAbGc&6kg`U=KxFc^#Udo3TAsBZTT+5#isKkMf*c`YKOI z;2o!Df-NifS@DqIAXSV#bO0OTi*R%~h%uzz zvl>ckU@5gWwp1jFl}nMH>w7SXNmi49*o&*JB~Jz)J){orN18bX#pz-Prx*3Zi-qHYS(OAF*jkOs1lRQoA#jCCyc!I#()j&$3L= zB7%Xq&p4$&8=vxCuA}-89p}7gPce&uk@|d~BtxK?jEGB23RpH3R5?>jw7-jn$2u93 zSeyvuT9C!y2N(6gB``1+D#RfK7tef|3l>J;B-1q!Q;{M`Rd7ycpigCT7?`sY!bmM= zgr;zQSFlGw&AFl`165C=qnIK*m)ti{@-CJVlpH%|+Pj1^y5T5P>pGV_6kT$J6E4(X zKW0l9Tq;kCFI3JuR9a>#D{Qwdd1^jpiiuJxu6ZbQkzgnkJ)5$S;LXm}GctW8Q0w`g z6=+2qrBY&@8wjUmjHFwT<@skt||*qGZ`zH6kT4o4&unS|o6u*l=0#_h0O5+~rT$-}r* zy%&2?r{dIIDF_hGBRjkahTwYF#( z#%Mk7O|dp*LK=wXTxc7O9aGIVHsDjtzr;hX-YR-f8!9!IrDMuPn6_(pC&e1L6{X9x z?q;B&mD{|Rtj6bJ!=}xDDVE!+c?GRf^!mABSV~Q=>;s_jO`lm*V>)=3vUCgcEG*1( zw%7F}Trccrm`<``VGCdhJ+7y+tBRX5U;x3LCY#^BtRk zcAmYJ6`K_O)GFPzUvn4CoGk$}OcqBCa~kA!vJ32KA7_BTK(JaHfWQ-Cb<>+rsC_DC z#xtfaL*-zll+B-TydbK3oN=jru0HHa$fDs|tMHXj(d~|q;`dry%(V~k<-M@Y1D^ep zV7qs8^0{=a<8JLnc&&`$y)h0roKJ{->96X(D+E8B&6YBg;9GSzrvLnN@B2C~g`aSQ z@Kpp==P~Hi6ZJUqRYWECJ|Bf2nFh(5!&dh()6^51C&rs2Dfh8Hi62rH_MN6$_qp{<7<&8!#PD+Wx7l=DUv?6q0AoxZR7DLirdVVH{$gBU~v z-beL*9r5?RFUA3%t9rk${CYnR5r5vx@<_MKUKR=KzG-BBKK^nE@Q4#gz3rMA?*g&L zzG(@P1x9by^FZmwAMy4A{^K!L#I_o(FCKW7h$>!0xch3bR>3*FNLa_ED8h=6ocye7^#Shr?whx$N~S2| zMG9w4z9pp2;0_Y-qr7gk>X22dW< zR;+SdgrMpkWSSTT@Diu$6XGchlkcocL>p4|5Hf-u{$nArx!%M%&=-j}#3U1EVha|5 z38oDl3jIY)e^V&_VTgTl@Q;Z^GM7XcW|V28pnb0Z2yL8$D=B>i&wBBjuaLMAZ(oU0 zOIhSVZsU+IXSs@&h=)r{z7&IhdLy}F*^`%)Q&)|zz_5mPkxkM>MU+&joY<(Dn0Mxo zd*;wPp-Anbs1wUj9j1hsOOzjiC{ejUx^*UEiNqPtSmXrwS2V*=DrQL>`!Fn{Ai_Xh z)Q1EcXvlDqA@O0-mQidFYFu(|VxeQKKVV>#yJp!?@bAKq7UD0QZmGm|iK%R=iRekV z1~x5vQP6ln<+;8nQ;{8qk+vZOfnlQR))5NRK1pN=vFtH>Ew&${0e?+?Gplzb`T8W5&ro;`h zk!h*^1G1Ma$v=)#Q&AF$1v8PrBX7wS$(d6)A#7cIGA0RA979uK=c5V=l#k|OD}+DN zq2$q1rE%+~oDgNQi6xGOB`z1GA(}-1opRL?Vs)S)MOa`tx2JiSrcwCHs+uRMeJTZM zE`_o^>Apjm78iszm$_CnxtBem5W*Rzs;LiIX}$}#`HVq{2c`+oTq5_tn20!@%tDXL z6f3h(NVGV9Cm*}B%&St>mn=9SGB>cZSh$ZY7UDO-2*KYIktz$c%I{1iQ_{No;->ix zO-(g5UQ+c03>7v~l9TfsNtK3fN<}UWULlo82+JJPa^GP!rLl6Y1#>sH;h0oP`FIIA zWqB*1c~MhkM_hk&U#jxZ%JNvMiqy)AT&hZ6%Tl^>@p#ITkD&__Vq}X`4W{viZK~Rn z%Gw*Mx|hm2pk>u^`QY(x6}tF+O(o1c5wNGBGJQok2>sGixUw1MviSu`pcSiGm$1p! zs>!jcqTRCfM7Twfx+AtK2HC2;GrG-{8c=J6#%t9n8`hCZ-91AMQ)tz-A_};v0z6a+ z_*?ZX1b44c_ajuh12+>TSQ<%Z%rI%KVfLsl!UR`ifZA4r(r&f<|U=70TrgfT5K2T3lRZk^S zPsY8Rgd3P17517ruTGgD`|61{0{!ogbvMiTK@yL=|i|aL959mqtc(N^rj)y zJUL?ZE!W4jDW9o0xuEQsQ)mD0-N7xJjy5G9((W|}A#nkx^S8P#7O5`}D1RmbiGd(0S8C>Hx0 zstZIAQqf&XT-UU<)KZTeECWOLM{Grwu6;(xeLyKKBq@Cx%@_+aeH^J6Pip@e+W;J| z2bpgEa?&Z&kjh>ZRgV~*6xNWq(yge@wiE^>BKC<@;^-Dnconx6!kyqr*m z@RgCun$=)KoP8XgL0F%^ESh9^q2miu9if<(6#|g+16(-BQ(qz|tqz znk7Tn@1a-Rs#e%B-0lO>gC9qzgEx#bcTUzTDU@DF@*Hc!YwyAu4`s1SWIHPgMb{O{ z%v2iBvsUWlIuNZmO zlsHUa!=s#%#yucOF)=EXk&oW0A~1G4*WC&?{84o1x+sr-y2XU8&Am5?HwE|nAO(e_ zFkqwfdw94jTm$;zTlj^l7eH4Sju_C}nYP0@e&9Mn64&}WXCDyZKJkeY+u40NE{Eb9 z{y8M$q;Eh_q9?I(jF`FAXeCY&A*X6POG0Ce0^aHPH&N~W{s{a_Bh^4tb_rYwrX4Ma zLpR+EC1K7=79wWIt!WU9Gp0tMFB*3+M{i10qy(9?eb^|wT4=xltN+JizoO8TPUhI2 zOZgRJuTy>Agl3u0PwAO+m%T&D`Ew3igrmIBtYWDK51?#_Smy@IDiC_mjIha(eV}5` zrygbMF>R7pr;^jJl$N+QrV1-7rBXF(QMF@L%d7lVR4rjD^W-HOxu1Y%S72#@|Rp}tU=sfDH|GU)tY%z4x)Bi_p z!0&3{rgLz^T20q#LjH2W>e?X0W+wJ>hUeN~_+k>rwr}xL<;rI1^%4{CQWe>1mE^jS z!B$erW>e)l(!f^I(`q}|ddkXb@(Es{9c7Qm?tszeK)~)u-sVXE|B*e}oyFRm<=9>R zwdwx6$WKKL8nU~&z4qft33$HBg1e!wwt8&7O!~V)M!w3DNU}e&dEd5f`Lnk+vdhN5 z3Va3m-m?3>w*7y}o&+3$xh4Bknc}lMBG~fSRYUP zJHz;(Z&inH(|cMSXLg%Mc5g@aDre4aN7m_k_GL%TBWLa{Xa1{4{!d3f23G+=XCC=S zK6PgSGgl!!S24S1F@I;V8dr&4XOY=Qu~lb@6IZDnSNSU^$b_D>IgONhM+JEY&zZZs zok#H-2L|Xn4{l!sN}u!}5WeINzg6MD$szu?&XC6sU>yO7KNxo?4xmA*qmiDwi5<{{ z^H#1TT+v1unEO!|l-EqonF;_4J0)}jxP||KWf1tMn~BsCzt^GwQmVWH$i3>D0D!X3 zWH7I;Teoh0?w(UX&#hMo*q$rqQ6Y9^%cocBa#Bl^rw^c0dasQe+rT7vJI-)g5hqAE zXCfE~=or{AfV2LTQ>OY;y4+)Q5_}$#w;RQ46cI2#=&?B2F%JuVSGnsz@s$aaT3pEThHa|=fpqo36$oEuzNxE&&fKssY#yj#V`K9eXi7e z9RwlicD}<^d}nSw59IvoR=}eo-!mn?I%2>htdC!n?*g&UI?m6tmEQy8_hne`Tbv(Y zbg=jHlUFpP^^~{rS5GT3&*XK_OzU{u513kV#|*Wv+7Zu%8~>vezrfe0+g@K^AOsQ- z359)uKo|lJpZ1#lL4PD73KLH_Fu_PD5S`sJ848(rIFO9lRkeheD@8Jc0O-vu(-%k|!3rzlvekkaHj*3J=K38z;H@y^}1e1}; z1Q8|uRCMCguh~)&?rIwQ7P0v{_MjbauE(?SY@8<5ZY{UltzIq2Q+V%o``wWU0{R|p zkH@3g1TixNpHAn~l?uJO9v!dOt3IEJ94>tS?YjGol(H&(tGD8d;U;z(Il90a!QRg0 z-aJ2`-_Or0u_fg%XxzCzP$Y0m>U?lyYkv3u=1Mx-m z#*cF?hz`v2C4bnF=UdQKND_omJu2r%a2%!-M)5qZ9EQusvMkFVcVHF8%V>nD`U`26 zBB|?QLFFeXE2u6iDqv(5q&~QQ^6xwh?Bi_=`qu~qIi;V31(MmI%=haSP zukF>h6i=PjakD)4{gpkRpfL{<|Bz&q=fP5W=H^AywC8dlMwPAc-O#fl8DO2V?`Pt# zu27fcC1{tIloYnlLBQ2*mQ~c^JXKayld@e_$Z|CQOo(_~FR!+Nz_&^n^bVcY^@9M- z;R!~lHj@Fj^-(Vx7TrbY8x{>UY@1ds*QuL!HSlg)4&9^}TMqNI>^ghV)~nlYWr=@w z{{CPm&kOnePxgcke46+Bb`e{E;6#I(Rz{Ll-w(mEUE2?{ac->odaGGGpbnc>SEq{# zSv!mqM9?@&kQkZQ{etUOKTdgv#oS9nN=7}&(5cNh$+DTjI?Zvp$vDmPLBKvM2%*b7 zD~gfDJ}*hpUFadFG}XAMm|s}ChwooqT))FI@o0VbWw@D>&Lb)J_r^tPW@4E%In)-3Y2Up5?ibzZkTcDG-50)BMf z_96&&-VPG@b>ELN^mg7)3jBQE4ev)@A1^gtxXt=1EFtmTrGNOm@4CtLz8*&92)>_Z z?RLLjm)-b%-`30YfFGx`1V7)mx4Xcf=hI#g(0D&^RQ+F&=>p(%cmD7!dthj1eNaO2 z0jSCPzsb`D;cV}`vw}1y>M;gsc_fpnWB_ra3ZM^H-lwKm?d%#fy(K{gfkK4jj9 zlCcm?%3N$VWo__~u`x}`+I%u)@2?Qm;8V;vHlCzyFcsoOOG>{sKIPuVl5?L?%6s_*G?0Z2&DF(Bqh2%VI77ojDhTj#>b#Vh;RAI3XXw=j?M>e8|VBiSB&B zm`1x4#?6PV7$2)#Oo~Uzt6(XYQkq;s?P4Ky>(Pd<%TmPpTZ;eJi8RLr7(UOlgol#8WO!H2Sy=2EE&-lXW_c?k;BZ1Kn4g*dc6qSv3l)yCIU z5^^7kEd$OqHYS%^+t~lS6BjG7hAE4I?-F@|&1I!ckUT?@s{IHn_}=gqdaqmxVRUST zs4g@{Xq)O|e5#EpF;^y(S_-vC7eOx1S4s8Qow4}0)gSd?d=Q(6%ayJm!L&A-``DZ9 z6RE9DEwoyvl8dt!kF{|N=NMrhi~Y#?1Oy$UyugqBxJG3E^8T0$rxF;QbJ4WU#THwa zhAidEo7T#L=}K);*sfK&w06FPQIErdxTDk-JaG4Gu{1LhL5OkZqYj&k=pn8LT)W=a znrpvrt=TQdw#x39CDRzg@j*Iuf@{)C5CnNdP+W|G?|6HS{e9gbTg)DeU^SB%@Sbne z)S)}7JRf#(d}O)Q;Z&W5D6Qyq%w0PG_)NK*2w-_X#;yKO>Yc-Jz!og*i*p_8PM7^! z?MLis&!dozUl`;u2w3`rlJ1eejkQ`SJW>EdK)k;{h=7s(Huu)AEu%5P);s;p%dI?5 zMsYD*IS!R<9diiEh(iz4?7A#7&dZEhuNTvpCSbK3t{H1rFZH$kB_qi5191mX-i|j} zO4SP$tA^}5Cs}25l(Y!5S6X&fS@pD5+UsN7_2j9nOwm%ls*}g{rn$<+?Sj0?bE%@# zu3SgvVs-mtS$W>Yw+h#qdJ=sy;N&`$a{UTl#XyHj}2&X$AbBDPPK{JtxS~W?!z`mRf_iIjf?goE<58j z13WhcG1gJvPW$Ad&2AEG*2$o&MFVUtP#TQjtW8_lDfBn@30Spj3mB$AGb!Kw33^Ht zajId~zM$DHC*JJ2=|Ol2z6&>T!i621;d0B(bA1|lq`n(bE}+MyN>1lmUhi`)1~nij{4RU(VNYG^?PiAR#ES>_V1=yFi<)jB>QeK#o~&cc0?%Wt46vHQpOeh! zV;L=le_X%9Q=x|7IU2^d+%D@etzhTme&BuEyyY>K9Mf-2fPM!4hihKL%h`{_=OuLe zCF{BDz(uZPJ0FPOH4410De}5{BLj|{f193WdHIgj^^|21@HxZ&+>g33ZRYtIDu88w zF|+;j&eGd|oOeIFUU`iGV*$Vre)qc(-Wy&bUw7hH+s9J+j#Cl4WxCmWiaHQ}+Xwu( zM?<0BSBO8=HTcR=1U;5Nu3@Y4HXyw4 zV3hVxP=AJx7(m4k9xvkW`D$E`>JLfc7Tsf>9^yfsr$HG-df^HjtcshX1*kn0`x?`;x4C8@oY0m;UUtd0Vpa zKB0Y+p8C{u*fF0+n;%8ZKtwM={0>+6j%@gfO-N~FKyDa?1&{!3Pv`ikP>u;Vs*x5h z1eNOH?`I-=cZPqM=s|vFf1Tdxpe7vd$uH8)!5fJkLLr@y$*-8o;&;a&UC$#SLL+A& zd679#2+y7B%MXTH{e?t^$dHW|vW_^qyzrlccCm-Hx|@#ub7O4}wM|2qHFHg*2>m*F zWh)PJX-$|BPe{%L+i*uBvoM?LK)^eS_3JnGG5x)$Wwm)?*OVj~8X^H+JYGfh&)q$K zzyrB~7=gxu6YwK}g34iCRAIC06xk~db+PWtlo1Pw3bSGXvjG{aiHWLXp;5Jw;(3I$ z37iZbo_x9yCxi))H}=GviDH|H_CA54U(qgBQLqy(%a@KG5t+0~VoNbGS~8LT$C2T8 z6GO}e^(nG*4|VexGTrV2BOWso;bPhm6Jtp!-EXp&W=Cd#BXwOOGk+7a;3Bhx6AL8_ zBdwCjkYWyu2@~lfs}3`pfm1vcGph;&^G^bU%OZn^6T43ndw>&z!Xg{BDeG+^qX{#o znG$D)6DO8LDXv6Y_#<0FO$Lh+O9L}YOA|{|5_j7o3jl?u8@ZoDjH_(XFj|Q|evvb) ziFf@G$h+IfHtVEk|48Te$QQ)SfA7Tq+{FJA&BJZQS3$Bzw z=)04sNwcWMlW3GVhnBN~D2o-GvPb}`NC=C#N~DMzi-ImoKZo+a3}=a)C!s7<$-L%& z7?NUfs0yB_U6Rh?9m(Q=C#gpyu7q<*YBCAD1<`p_v1JySb!VB93CZ!LRCFiVI47y@ zC)s`$x%=jjXck%03a;;SuA*c~$QJpsCHWE-1?Xjo{Uy0F5~+Iw-e+gU*JMRnR*E4Y zOCIjC;4jv)t0o!2Wto32$|5bwljRER&-{N?6scQO=$}<0n&p(9`KM47FjN$5Sk(|+ z)ErXOjNnwvQutMuWer-?b)MA$%Bn#vCR}KBe9OuODas|RniZ@v0WKN=C1M)O>K$kr z-DpfHXjWzYImtOkH{o#z(IvnK&3JM6)p5ce^8WL^m4rP&U_iHdW9~dAz7o zL`Vf=`Wo6>RuczmrSnPyixv$ZDf!R%>zx{OMv5=g$TxLqv#18N`pSR#MmS z9j+kruBOu~E)4a?>#8>Y6?kejM#rwEq;s|^u69aPdIc*qZ>%>Us{f@oBKR~@=v8}2 z3<(gT z209o9b(a=Dsx(I`hTCjUGcSK!FznjcY`JX=hg<*Lu9%0ox&3M|{IOf|XLqY=Jq~4e zKV5OpOY@Lj#sQq$v9SzjJC3ifRzI0C5v~S(I5(A={AURCG`aIL3 zUCRp{xA_LTV(2NLPr8|R)A*jE`yr)m?}YiS+Sne_`oz7OuR|`Ou6-uATC6_@c&WJd z|5q%oQn<#%g|mB=uzR++dDyXgUaAHaum>^E7`i0}3#ucvu-i$Md3dN9si@m>qlfBX zdda!F*|mFlwA*Q{@KC4Ig0hpatHBVu-7uv&MA$iKxJCR+bIO@}i^hyldbN*Gch*RA zj%yDmcZ&jhi%?mOEL)4z!f+OG(=U^E8hvwF$8^n!3=Db;lu0%IoeJz?ta}K`mP?ln`-@oxmw#6)bJ9AW$%U3p-ZSy)59Ll4;1nyelsI|OUz(PV%JC_ zY~S5$4?J!sf8hQ>_D$n?N$tdy2 zF3ZRsd@^QP&KyNEMWhi*TTf5o%-z+<*!ReVhRQBb&7Sngo6g9y5Kp1R%IfaOg7(aZ z&y2ZWH+k;J!`jHh$@Bo>3a4GqrR>b5&CF%g%-v)yz;P|W`zRv7E_Nd?q*l*|{U}D{ zDpBwh<|0rbTDx%gbbMPz!0-8$ppG!t;WC7B)8$QDt0UwQLTUn8U6ksfZ{@C6(;)k~1MoNQmDID*{*#uPtg8nvzu457XWXSt)Ks;pYl&{JO=1{ zRx7=B^Wx#47fv5M?f^CVfDim29*>*i*ASBTAa7lt-ecP{YrWVw)umWZTwqUBmfu+# zMAFve zahZ7xt`ZesY0kI7d1T>4Zw>QzRM2Z%kG}be&FRW-_^M9g;`E01w`=E$7Yj`(K`NM-1n-6`p&M; zmX`L8!q;FH-ew5iZ5ZB7Qg?He&uU%HwiEl-A@HVUdtD^^j&^IU?WI*kb{i|h%@bq$ zd1vDq|85*l+iz`8kpD@m{Ly=A`)d=Vd)A=Wuj$J-MSB|h zdmL70@>YA=D{pE)?8Ogv?izP0%(w>s(mVa^JyWpt9K!Dh;F*cR{Y?9r zit(GY>Get90)80ve&yu7&i8(idikZ}uc&M<@A9u4^8?R!zpn{^w|>CKUf_N258n6H zuK^wI0B}fbn((_lLGb%KR`0X9{ea-#zbKk1{`iZ6pmI`?v?CdDC*1I)Zkfj$PXrOl zAS}HhlT1X@P>ys-D3Q%15a@+AuP>O5CF9tb;$|+I$t6ff>0VJTQc5I==%@-`D4Hxp z3b7Iif6QOVq$ruu!GESukCjVX3Hex|)^4>sp9&4T<>T>%qP&8-Lvqyb^#{Y^@I`Yp z91KU}aQnh>HXileBkVbafq-ERk}xR_f3G)&kZln+x@|0 z62BcE@5l4SW|QA7AK%ye!==+`6?@Zm=hy4!E#jUZXzj78KLkSfUH}Z)*xvwHzBT>e zKU5Se!N|Ji2BB})DjD3qG7yI0M6u$A5oCO-c&7OMU~vL8oohs9j6D>@(QGT>#4%hm zV}~)^A8SUjf3n>Y?Mt ziN>)JrDc&v0GN*-Y zF1*^#lZngPo)?&_x&a8OtNIc2sH=w3evO>$7hWm7<~dnvo0cVAE1TABjY^fua^Fjv z_PtnY+m54LE8EU9s&-4gjcFLWu7?>d!y2p3h}-Uu)(-kC;K`(2-_Hx|T^}e$G($fO zL05f00{N8v(3Iv0O$j6!3Xj(`@>A z2W_(z5c7H6c{=kcX1}ZLb~k`%mp-e2VpioeOqs_sFKic@H8;5%O7gry5XZZ; zVK)2yvg3xxXP2b5?eeah6$gC3Fyi%`)VL0w|CAWM{rhDrld^L2@jCMZ1it>%?0$#1 zgVX5W-Jo~)|3Yx39UqHU1s8;rthZye98Y8^BEf&Jalj4EK17BB4j@L>2N9C&L-Cpq z5Xacb=1k(AX=8F>PSl66cpIE*#7ohT5F%!@k_kB^L{a^T?bdmGXx-9fFR}{?r7xVFf&c(YyWUO+Q)5(RXCE%=TrZnvd z2(-?n&^44Yc9wq~WSz?ndCYj-k~5aeOPTmf%y_DT`{5^0f&>&V6kx<#JAy zJA_p#WT7)bpUu>MT}ak@vR3<9o_7RNDTCk&lnQhlO5eP7+Cnq=)g2CVvonvsQ(9zNgn|@{`y$N2=uBB~rPW#@oHpIqC zs|aa7QlWjQ#l}+ab9gs*zL=`!MzSVq+v=pO9?|kjJFrr9$(p3ufwS5ejT)l{e8D%$ z2lg5?Ycz=>gv_)c@9OMw`&Fpbxk^gM`!*`|GiSK=IpkJP?EnogH<-#Ughp;E@z2IR zJGFksrP1!F&QtBMHKuR17i_aGQSA%>))qEcrbKDFaxH>SMq9iGT(>2by;*spa+fV# z*_Y8pigriKfhyqStIh`-wTuOQ)1jBYlLs&M}Ed6Ok5p)rZsOA!PwfRD3VR;$;_` z(-lq37aUhlU~O=nGLii+%&ekwjjuLqb}EN2_ycpgk9}i`QdHxHHolPvfHSuDb=ep zn!Ysmq8_HMeYxWRR2{uQ)TEU$ z#;EI9_P!+1?aN3W00}{dYZDgRY$!Xc^)zevwWe;le*5>nIL(uDYVZ}ck z?yNGdZn{~Id5P-Lf~dFE`juzNiw7s8tXk`Y@27fJX-jac?Xy1o!t!#P>-yQ6Vfp83 z`G}3?{j5^&0D1#m!a{!TE8H5b#SkV0+e)*%OdD}nI6{~7B}_?dGn!{O+82d-|un)z)vXav?5g{gXUPnUEgG%>;7@bwkc-m7)fd(T7QUn!^)TOP;#lq|DWPo%ecO$!;S#V0~6=@F~;gSj%i z^+UbQz_KJ!1`}5#A=Ob*_Fr$cgC6tmbo7UR!y;63L@{?nRp(1IRl=h9+le8Ct?r_G z8W22WEjr`}Gz+{Ja#dAPrczh28x8a;Q=x4qc2ZNJHV;BbQlWPzs~7WXI}PH63T{>7 z#0*yw!3-2L50-GJBXtjyITHtY^Cuz=`NI*SA|9e<9%4!ofHoF_z7|50;w4EDDlQ&s zWFA^H5G-3B3Va3);c^dRgbK4&4|2i`v!e)e5f7sR_kSM}5;_ZOfehz=3u6!tHZc!3 z3l9$~53e-TxB*qLf{LgMv{7&OZ+Em$P7g^hkH{E{SZfN=g^JX}j67Ee4`*S60JV%N zkBk_LWK9W8fQpJw2y``Zyu4;hE zjAH7IyP{Y9=&fkLmHDEJ+a9^T7P%SDU56R9+m4wu#Z*zHstxk$fY}yt zyB2W|756BPlSdKx$`ScSL0iH>B?IX!hao(nYANX!`QIyaBRu}|FlKKoet0pox!uFo z#51!D=*d9gV;Sm!P8p5!9)*V$jlUlCwXDG3)D@qb!QMXJ?!s?B+-9dw!lWtx*jnu|r6TSS^i zMk?ZaR3d6(!D~Xmds@(VLZC)^@H?58I3w6tddzux9CStkWk!-jMv6s7T0}-h2ewKD zC2=}iE>>y*XKK;r%$o7cy7SBi=&UBntQLu^HjAu|h%7)wRyS}w ztM@$fV2uT3Ra)UJStcTTv?6!8`+w)h>EM?BTM9!i`&T>S~YDLcac+Tc|&Ng)J zE@ke%MDC$Q?(%p>aYb(7c<$x<->O1|d&;~=iM(fvyw`}l_lmsF@x1Tzyr1>FCW=Hb z%XIL_^xu*Bkd^t(>eLL!`G_zDNK^$Vk_Bj%1sIV9Sd|4h7y0Mwxda!ve?6173NuJ8 z3&|r3DJu)9sWJw}SzakM$0>^@C5o6Wi^deGX)24jCyID4ibyXCvK|x>HXI2pi-|mo z+k^}GCyHe*isdp3K`&%Y+px{k80gwv!z_Y)BZSl^O29Tei~>to-%6lAlz^NRX0Vw> z@)M;t7o~QQ*n*LS%2c}PE2?v^1i2n5fi2!lK`|KvmKcS){>x=I`ULKNi)Ha0kY#C+6&aO(rFq-D%4zq&UDPs;(q{-&S*#ir)a}D;t+hV`j zH0vY%$NRO0e>>D8X^jnQwNcrNoL8Q@Mi8}>W=d8MTUN(Xmc@1w?4@8IsuVM&p4UHtp8QT)W%q_XDSvV+zjv#7YY`iMO>`O7y)CN| zZ}WbIsbQ?}VjVTmMk;3Ag&8Gb zNGOVW`ka_rP?7klni*w!vLlf!IidvbU62fmV-jabF-uOzUVt-rO>?xFj0ylqjTG4seK-@QWTG89yG0L}@TAhyLyttj;w0f@qwc2F{uNdCUl$P%>t&^?gE>e10 zkT&OD?TG-LP1t@U?F{%$S?38y+!l6`PY)uGPOpVlO{>- zAgi>24vGP6&VlmL{)kgzk}J1dNO#UE680<)>S$AKm_fX1cOk1r;c8dm#6~z;q)w)1ZbMstn4n&q8#m_vE)j%@a|OWiFLrRBzWc?c!fk}x%kH4D(S#v?}--a z4pi&>V5cb9NM+jW$zI$r;mJu;u0c&pjuPw1@$C8vxXIe9scC5?smiIv?E3Vt@dEGZ z_2}tMZ|O1V>0P+8sjsO+xalMB;03subGWj0>8Wd;saxx*8{FADn#7&znb)b}1MQhl z>zOa@3dHEyU*E+mZ~@u4EZvpU(9_efHNd$EgIQ4cd8*1;o5hJJ*g)XcELKhM8SXq@ zci|P>Y-_oIzr^eV+!Sfd!ejLU;`KbOPX;N<$t$Uvz2XO-!2s{13Eg_X zu^eaJmZ-fF#k(R2zT^+Tj$w^gq`g$775jVC;o?kFEFyMDYFP<>BTr}97jL~J2RpF4 zeO0{1MruvCKV^ku%x_~YT4vJ*__$X3y=s*sV1k`!p1JDXz3PUy)ytb$9J84avvKgr z-^jB$t+NSm+8m8p7M7urzt$?m+gOj;-mqR?*j^a_-kPD^+3zNpzup$C*&M9d>6_je z*xnhkS>5*8L4w~owAnrK+5IxudAy!q;-z7z-2TqEt2*x+i-O7bi`BIkADZr1b6?#XN78Kmyc64w^B9V5-{#nDXEj) zc)UL4ppC$OTuE9rfJy`G#!=7mIqs>_mawq@%_mA(d$h|l4`R`rHmp8WH>(J=GLeW^A4?)_yoG8MB68uvKybsibCzk}{xK02uU zb%{6m@;Cab%l4`YpN5s1t?sLow);keBE11rBMOWeuWt-=caSBmw! zk@|cO!N`)`H`uS2S-S}%g7Rm(R631GZSlKf>2xNe)6P=FqM2MiPsk0)hg11{pqUCD=Y<#MG$lkRflvXxpr4Yw~#`}~zgv&C|)iIwVK!Jup5nG~(G8yx`9 z>SeyS_eOug|Bay}N#XAU{rU z-E&jScLLxj#!x&UJqMPRci0yc)iqSkb3!Q~`E!*JE(>>paB-S7rARRse}-TkJ{W}2 zmA39gPz|gVL@|tv;hZoo#;?XXPf;=nEY9>3CP_7of>d$A zY%*@~Dah+WS<9Cj9bCz+>lWR{uB%2>*DLBh$)vAZj`O518kR-8s#-2hBu(_pgEFr= zCZlkV+Wq;wYPw##ESNJvr-_fMp*SN6{n&1vah1A=A82d&veL~8Wk5;m@x$dx_>PH0 z0XmPP1QeMU;Z%hW`NK3d?fGLkE7gocIH{-fvShUfwvuF4SIT8$DLxCcyeL)d)BJ?U zb<^}LY(|wLi7t)f3Iid|ie+Q6brN%p3r@pE3l?tCW~ahsgVs%S`qi%~)arw%0JIg2 zF0dVpy}(@;3_IIP$40w>uw^DK-{0(8w~lSU*R+R4bQkRGh)2^L-AZ_?9eXf#wRQ%l zkGCeRTD~zH#*`3w41%>F?G4(D(tK!nOnh8B?k+|+=1e&8=u|eNz1NpSeE`Wzl2Ww3 zbH_Ch&Cn3&{z>BX|1H3HeSwzUQTswDc7+v(#+0S@lR#RX1q6I&mfX- zg<#8*RxlHKUq>?tWnmGriJ-YG#Edf?rHEyWl-(jm)pH!FyRJ52%Tm~gR2LWSgz^_O zHvR)UHrVm^FaBG)F)5|QxW0}=Xi`%4`G|=ShM`ml@Fg*8Oh|%$7HcM`bgBS`o3a*T z05&xcg|vyzOi(tqUOK62FVQrkTXp9lhyyo?Tu@yI*;O%YGPu~-drjONrr!12Yex7> zOy*PYHgj{xls&+R&o*>1>k!q9bNoGr5T7yg(t49P<9#N0{!i|swJH3$$E@dpQeKh= z8Ta=(LwF8t0w}L>Oz;b9AlXtp3|_f3LZ^H88xt=e#&LU}qezkp7qMq0;8 zYyCsDEpw^DtmM*Mzf)=DO0*8@Oh)cIa!d+5lQAD{n=m!A9Z|VZDhLgodHk zzU0c7R!d`w$*DH#xLTvQQYF#`HKP01wOWPZXegg^R0$fj)#!!hTBd4i&9$W=x0hB7 z%Zkf|vOd{j%S3W#qYTB693Z!aNe&c6rg(FK!YM=JO!uWRYuLtx+)*v_!PTw5X~`f7 zrN^ojCadpo>F%tJ@22p=eN8FXZQDxyt;da{wZ+zlxNvhC^Ob%hL? zI!0G45#57&4vsx3J-5v;zI$8C?pr4o&*@8^drv#h z=vv*9S}ggh*#&QyH>kGmin zU|rolwIDkLt6!OmW6j*u6_{rcF~Kj!Jtu|NTwN1oNKKs?Lw9JD6vk#`kAr2QDtwlB zojy!+ax@Y&RMhrNA;RzJU_nStoQ#Kk#0GrZRxN!Gh$s?X{D>#CK;E~Y)tIo zed&CX?*GkSn_BRXp(WB|A{D1}Df3YKl=GC+5d!$IiJg6XAALNh;_F;QzU@K>`C-@qf9I?8o^N#Mwp?KQ z>@S9QsoDFX?6>nY41;%Wq~^Ik?(2%kjCbW6<1xG4DAlg+8MchaL_wigIY4d%n#o@cxR`Wi@`f(pJOQs>g_cnXJahn3ueatxJ@tH&Uzb)4- zP^ACMa=p8|`>$nS==-m~1JS?h``^g_8~<*bmRn;DMWbD=FUt+m?# z_s5HxbeD6*YV%hZeChW3{R)$B2=VIY`oqz9Vky&%^xD22a5Af%tLHkynS3c-Jl^<* zu)*spHfJKN*AqJLji z&(`+mgIJ5Y*64uOTPQ!^r7wc6i|xkLWK|p=7sKnt(P~hvRHw)8+r#53em8Ho?@Wpb zS(f(Zx0$}>st&|%z$57!e!y=g3PR&^Mz#Xe6eMT-fH$2pLS3}X<^3=(6OO;ZBMIe1 z;WN+V2a#bJ<^;jCtq_MXmh)ys7Q_c{D=s4{ql7+u=<8UfWydcW32rT7X|dRa;v`AR zd}s&pysGahu0)A#gf2*ylw|U1k{QS8%05^p(K;_7Ct182;(uava-mO^)ajm%ligk- zHmwyF%yAukOFgo4ygD_`3Ta6x3iDsr$II3AcgoI+)6v`Zf}ASOvx_raUGdZNLoF-+ z@femClsV;msFna}KU6BKn$es0H6Z%AHp^NXOQ{KB5(h$mQ|FDddBrCN z^Lbe}&nT)C#Sg1)R#%Tv6;rovTf(YjP5n1hWOqUAxNeV z_tT=h*pc&+vKp<;oT^#P^NP0H_46t!JVT$bVHoYg8g3e1!UjnJUgG9QBYeV^Qyx6Z zHp2dPJa7m5UZ#E*`d3fF9tKiv%{~O7Zu|i{hx<*yV>uj1#$xa$2COdp4UuzJ)gP@j5yBsgDg3p zw=+MzpU0cHUOq9CK?0x0qru%DP>SA%-*Yx2|Mr0BtSv{h@_s*yyYC2Ze4q&NfiO>b zuLtCUpJ*`r-(LA!6l>j}mUqGETl&zf92_4K41o_$f8j3K`>+b>yX&JSSj?_#(Kz}?P zq+xSV+)@+=b;1-S!Jm(|MiuJ|w136_c@#kIQ-{CdR{&;(oS^Gk?G*6w;9Vtw@u^KT$|2 zl{O~6TxQ~tFCc!~s>KCnjh>rFqrjdFaH^hESACoR+O41nE{q>j-+k8w{fywa& ztzjK5Z+Tm|ViLPxD(sMpqLhjo_CVA)@+>=?ZcX21{8L$-1NmvSOqQaOf`; z=bE7FNK-DvW2pe7x>;zHq|Ndc%zr^1773XZjk#jkK?qRJOiqPYzvi1+%^3YLt6DyX6F)p)d6Wl9+z z5r+F)W|R&Svw6VSR3x+##qIN@kQ-F*P8Jo!BrX|y2v!%k-@1_8k)p=)&SlaimNLuk zG7Yt~Rkp!ZGFe>Wp#qD=a8ni9Rhh&26HL`YzbSS3#cP@zTXMqDOeyBi6WFO1d=B9* z^*3L|ieRD|;A2XSOD+_fP3s#6uTY>Exu+RapUYTscJ<9PMfh9UYQph=Rp>bv+$=4r zkr_Hv5)Du)6eDcS1rIftdN>-L2lcg1-4_=hSYxn6h^_P@Brxymvrd%G1vFRJE`-$E zznNM)uW)c+ccFRDAesQ(#Z`v13q3PCc4=k2rw%35gJGGM-cHMu%DYlJC^HxxHZ+#@ zr>D9n2yQh2(swp>;)CUZG88R7cb4QR2GDuaHR!%oR#e&h&W7!S`YP~Yg4W{5>@R~s zSPc;xfCJ>Vw_%3ZhG;YCL+s7B5ssOLShuOe|5>gA2#xV!(nmx%?_=V!jfrVfM`YaZ z|Ci-@Or`Zcp+3`?+BS7e=k-3RkI1(nb0UlZYZl4?XRoYC-llBA71snR}7 zkPy0X;_9fB6*ZoRifigpPmWa(>Rf~&F)z1AILG0_Tg63}FH280OHtWa>TGrzwWMyS zc80K65?U=w^t+Ilm0U$ol&(klKH27PCqjH&uJxd|wgu`S*{+f-m%Ox=2ISZ%)KTSk zJS=n$@iMxWWv$C%-LBF z>o|3fbG{4j3Gry>QW(CI{NUHwt!U@uYmQw`n9n7n#%E#4%)LS0)|Kh1`|zpGgU=<- zt@r3lE4-;)|LOOgkC^w`F9PR;FxTU+a@o*TDauanvBJFg$@8EwKbU@CP<~Tp0Y0k%KdXW3VF48G{spZ*KW>4H z6an~aRxISsROLb7?e@o~Zc6{G2hD=W&4cKnf&pf}MBzcQW-fo*1Lf5NP&s_p)4Zi2 zon_M9ES3Ux&75XitnAL+r&wPLZ=`Q$?p=x1%vh7SPm=SJJ{tl}_$sD0RW99@H1aqgZ z*5si^Z{CvTfnjH%Ic=c|XMxJ*kp}J|j^KpyRQ+k?LKnh0g3LR!)2BhZ~icC9+#nBmFm$PZIRkgkrr(+^kY$jW09lc zF`AOPt3(Z=eL+HPT!=}|otaSj|I zza*mAIihw;qtw!a6wPBZ&m0!igSy;f(BET=D1wIEBZMgu(%wQ(ITAQH67L`rx-p^# z+9MSI#a)iYA*M$VbO0kA$6SHpu6JiaB$SE2&wU{?;_K8CQp^*4%7edLJ^qf{(O~+D zoF@*6`cg$C$glf|tS8XATf=+!gS{swtj2b+TP>$2BB{q+Q&@3V1Y%PJl2CXljr&7o zP@kg5BD}{)y~iMp1%HVL>p(}Sj{5IGCDY%hT!f}3mAkq^CrO`~(_;k(oZ~>Xr(t<` z+gJE>nuT1mI|YY%5}w&@b42xZl{uTJ zyU4re6iZ|W1J5$?G;%c5GsxcKL9udl9TU!8v!dIB>{sIkOS9!(Gb`ME7T%+1#d4P- zLIx_bXCh*=GV=BfvQ5HVjwCD))ld^bt$t^s%(myzMOa3dJ7lEh*E-1eoD;%!Vgtgd zk`wchpmFBMEPlue>V8T3SriaqlebdPkF}E?uSA}7B+e#Ud8QX4511zl7C|@`^6eKc zGP-hUhT!!VsYTEoQx*w-kPsMJFNYQ(hB|OzVPUuDK9iSlQP|2>;v#O?VN{xHZ_MeFfEmEiPe~Y=FWo>c?<7eDVZTR&`}>A<+1aA zLup>UkQu@2S;vr-1RmiE?yjiN@ue^okEZS&;z5`hH0j-{yvCt_E zA3-yt34RlvQ=NWmVBxIcChO`kxJG)6CT{_^Ci+=*8E>K>Vep`M<3Y;+znIZ_2`=Y&cLeo3hNW;I&cbvo3qQKGd_N>R0XvbolB> zj$V3p6+Sh;PP+x$pd22~qdr1u49&aaD@qSMx0q+Ion;&3b8+XgKkFypgp3AWoB_##lR)jbOf zGMi<31O~DIXxxzM-m>a8ed*rA0W4Ef|CaADbLH_RWZT2(S(fbC!T~wj>^2eQksVRalUW``1$k!0vlnGEu5y&!l?KPl&HK@@#Jfos0 z{WT1ZJ0i+6@;6!+(`7_&s?YLkNKJI)Hbg9R*szAz4dh8Ns9D08=JKH$F zYXG5GE-rf*Az(soq!)Wiwdkv}@oTWHy00U8z`eT1_p84)yF00R(sXJv*L!f3rhnLa zDoA=@ym~6VtKZS}tnWY7$I=2J`e$h!2TdfLeuP~T)RqH?Lf^=#QId0z%f{OvOMTw5@4NLS=L%NwibY){T<&+gT0b@CcG^ zRJu~u{DRl>csDwhL?BBQI?%LyUF6(#@OjqsgqGGCj5j(<#2i?Zl}t3UzH#NQMI4`H zM_iP~mbEFTHN2FxEnO5poAofvoZ@8+!>QkMKKGM{1_gn+&8{XgPJj?S1@O8LyJPoe=%Q z#T}nz@YqdLTA_uZZTKT4t7Wwn-l@&)RhjPt%@AeE8~%%JMJ$9p3j6~&+1-trP2lsQ zSc?i1P@yH}h#lb=zI8vig@pG;_nvicd1y<(W><)B@4`m*LRr<-@%ZIQWi)1Yl=sAV zW>eT#T{KtS(B*)%M#ElqUm*8HAyyPv=d_#qd~_|nm{D`8O{aNzux*rkOpj)`Ya)Jx zw|8BAmgaMkT(YkIebxwn?p<fS>dTue-w2 zS0QXT1@D8D>Qu<=DfUq0OkcbnUO2N{_Tw)YO%E?T9%@G)R{O~EO_OYv@WRUKIMIqX z;9d9Q&qg<{>TVxU#~%CJTwm(!VEbM-;GG6PEidcpNzg5J$H-mBs;zB`LFAspxSlJ? z-bj+3zuM~Cpq{V!a+*Wzs}SEQ2;Om+-pL2u$rjwPj@(He-iiOZXCk}*_wQcB;GRD8 zp1bHCbo(Cv=l(Cj0}=lNi5~EQ%{kwx#3&F_&T?~wpU zK)AoF_mOA!k?-eGfZ$1p|4CTyN!0I2JnspKZZ|n9c6hx_ezqfo8e4@iJf4Hm`6C*2 zBBTj2{kkJQ$g=Y{dnY?m)YegF?kymL6;Sp z9PNG+dF^uTfoGrE{Lk8QRog(U>i;Sr_s9^hPMolj<+6b^qOusXMb^Vp)+%eUGV?DW(`+@Tq|^Imw#{9_69h?MPaqHk1d7F- zL0}*V0*MP3Dq;U$2r8^(aQmErP#`wD>eSeLkx&Avgkg1g!{J0MDQ(YGyCacQCO+}V z5EROhL?)e0k9Ik;iBvYX2hiJ{*uP(+fYWU@}a zDEBuuGR<7Rq>ScsWJ~2nIN4>X3U@P&W{ObO4yo1Ct#ZG3PTyH1>y~}_TCF!27?AEOy?&=FpMHhJYs1iF9IAuK_KNN5sHA1zbtFg2O*u5n?6LL= z>-ea<*DEsC=aa*tsW$~951yCls4%M_ZX`FS>2kOPU`02T>ghDN1AlmP?Nt0RR5u+) zJCpk|_H4sQ-;49<{aO7w$(}aL-|I?TFYubXAzRuKjw9PXhpsHo+^|qI+xDL6N!1jJ z2`9%tv0x?N^>gq*+t*TCDARc%dSo|ni+eQPIQdt5S{PPBy1K2+bODKfrmx9P?A6N&xr`Jr(cM-2@bU*Nrsm>KCKP z;|)NTFJ;OYh}09~n50yW{J0cbS@riSVVaJUXm(`ph=fH5+X*f~78i?@UQz=7$w^vp zwODCbT;cPK7tRiqaR_twpq^Jo#JN#f_O*FVUg}c0aS=RX0(s>EeR*c$_xsS(q(GXH ziUL6Kn{iq$U|DgDRM5pqT9-UzMe3y88(HdC8gKlRM%5RCy3#HQ6OS0-HJb8^wYJNO z65f+5K)OE%eOBamF`JI^s?kcj(|*ay6wl8v>k8x}sq2txm|`bR%*@Qp%*@QpjIm>8W@ct)#+VsnW@en@{GMmtw|nNB?w)T}|Iw>!ZGdjGqw31O~lq%HX9C*ToFVCd{ z)1#F}lWS3~jf0ILS}5(zkrfZfLIqeBan^3=nY5)-SVlC_IZ*}&E`yVe11aEC1;>;h zqota=Ax;%`Hq_~Pr+??T*}=Yhwr5LLW31ZEt(T*t89I-xyJ}K9b-vX$?{|~ag5#CS zE5vcUzy8Bq?si0ll%K|>R^0zmg-VFej^F6C6qsYZazU6}pMlNuiQIB3yE$|nl22O~fQ;8?mjD+tAOdtA6J!1}p z?{VgHp&iD3?gH08a5C`_M^<>i@k!oE8S#9=Ad?o=O}EdH>s+WD_xq@(9c9tLi*Z5a z_4$i79PxYu)=rq;1n(HauLizD;>bWrU!5@d)104 z^P7;`GAOp@eJVhsBO6)gQ|@q>_4&DCIDqCqUx*PVAc}9S;?Gjy%Y3NIQi>v@oxJcd z&#neKbk2ZvOL^79A+ux@`L|HB^wf9c+N$T$HHKKyfuw5<+Ttl)-r`|V*m{MmC3DN# zL;2Q>8HY`?VinWugawRR){ngC5(rEhjSfN-WBPJ~8$(#hf3_OQWeeBP4pucS=Gw*i zKB;7X(CkBJ6zT{)nUP_Y$-_|6y$O=EJCCD0>_c|uPBql|s3sR?5Yrv_Y#C6vJGwYS z7is#gfH}Qi?Cf`#`FEFXHcc}27aqLFLoROEpURJV$;NDkHS=sfbAQ@#3PNqu6SzcGkKLgvOB}WI zvrXA%Gh~@t`0dzdn|9q|$Z@+c=J~-c1A^U%=j-CQzkpp9a;uR57Wc2kwP#o78k`!f4h zQ;pljx%LkZ6~EZcbiOXl_X{{w#kQImFfJ{O`8m|&vYVSIE-lXWIn>p*np-$7Ev3&Z2gNfJ#PWiF_j+Ji3GGG*iF<}QavB03VYWDC>sb`Un_ zBCJA9hC-0J3A4;PZoFmZv!!#7c^hKrCL8cA{cglvA|my5d54R#iOcu%Wdd&UANKHu z$xICU!mrQ!?Cs36p=q{(lBs)Ar%hu%C)edZt@|^p&i#dDHx>Tu2e^VPbH%F;+3oH} zn(3@7mm0U#vaBaE@vQ6398N9KDF>>QY#Y$8j=i`Zn`V-3Yw7HEorbMPap7+3Kgykk zEL$(VHCe`vJ)H7HUpVH&HCY#~CGJM5+b&{XT?esG&ztL4uZ9iWR(?^q3^Z$8CYL{N zz?I*x1h3xawm+Anraz`EJ>Mp3a_rl4JPmw(y(nLEyNE@19~XVSo9=I0Ox1Kc`M7qs zHs?_-efp3oyZX>p{xaV$d3%$ec6|c(vO1M+wj;@Ytpdq$Hq7zL%UR#uUQEggeCl}C zt$WF4&gpL7^=Z#eZa;futBh{@c*XHytK;)k2i*Hk_%EFZc%6uJok)D0U*tNG^*T}P zI=}jMev9cu&FTDJ)A^%^Ta>5mXcGo31Q9c(27S468Q>uz?g~fh!ewg@mhBQ0?K(j1 z!Z73U3FcWTc=n^093Q6X{IpX=b)Kv!6og7_DT>?$3*0sgUOZLP=ZPqQR+D%8- z$QVn|-HWCOl-eVk8y zHn>8TYW(JWLL5DOS~1;h-Kjx(Fkx~69%B3<(|rkMZTdMp$t`@P$-OosgK}bnW?y>L z-w*lZ2rT;WrEdvDqYY+03E6xUj%w*sd+N^|VM&|j&z5G6U+%xOWzL=!>~owKL4ZFLFB>E2J&JOQ1Io07OT;t8|nKZ7I!rijK=<4Eb9Kq-$^Ij|3#cvt<~3Th>n%( zMGdVl6s>iJPptm1x5Z7&Gr5ODPUL;fNSc{A#B!eyACrt8tL(^#Ob*}b6yK^?|0lLl z%W7Wlqn=^C(WH{Wp=r*h6tN|~{y%2yid)>1BR%t5Vuv-NEOPbRBc16zjF)U<9#-66fp0~zcuEt*9j|0f#VEE(U^yBaN$KT73L+Foxupfu~ zH4YU!4xKv=Q#<~#cl^`LIPCWL=j(AehzWS)2?YEJMEVIN{)sR06Uh1#DE1Rye@%Rg zoj}cWODY-j5#RAbDeC_Do5NeWmpqT@_=;>3hbnQVmAQ)zOI4H-J* zJOYs{s?j*oT3HBc*4r#>R=0#w8?t{JZ3%7Be8?3MYg#09M`2nEiH4)>p9Ux*98Wy>V; z6gt9|%5^G6-xJFd&)cw*UI!t098;qhS4OY|#r~0d%%oVXg58@eu7;lXVW(UmDvwv8 zipZ58n=c4s`Mg0=$=g+wabEF6Rc?j;%@MsC<(zm6Y9V&xYoL0m9r{9ux#C9F_aVe2 zVsQkIqCA0La>37~_9;b@xn+L*R81S@a357-SCm_d;O0nDJZHXcHOy(ylnckIgn})R zKzt@3F0-Ld>HR+6-BnuovnZZ^;eBv|WDhU9UFiKnR1 zu1Kh;5tb&s$lpz=V-zoJuTW}Nsy3>B9k(YRcQ8~BTdjg%O z);K-tXkbE-zWNb=Uj=d&ExBTt1ywdT+%r?rRcOD))qGe{#yTsY;z*#eL!i&Vd z8fHCncS`)YZ4Q+sYCKhV(SzX&Ay5iPc@jh_?C07KGdPS>mBIx#E~s z2I}-EQ?VhLT08}YNQNg5J@zjcm=GGsG=@~#G5%<{uxeKrhCXTt}Ig2Gdz2NZoWW=etqZk{~Kk zm~)>A_g^gCps=v{K$p_0*NL^r$FXsCVg4RT`mBp|z~% z#j6Wt3JcXn9Q{u>%282jCj^@a%%?o63Qs3nyYy$|VOtyGC)lgz@JmUZFvySF+WQ43 z_v{)MJAbG(w11me)fcY9ah6Grp82EH3=S^pyC1F{E0OK~PJb@YBs6M^vCp$ypv%8R?y!w+F+ z7`s-yZAD!!E6juHl40Ap;mRl!I_2a`A2n&3Z*&BUk4p#Di0dcuUn=O^t>N+}!Shxi z9XDURkuK;pex(1Q`FcTHZcTl2F!)^=FC@`^&&6;}V&Z|g(7eSA_0R@yf~Oan+)J7G`F-ED+V!=FoCN`H;2 zn_$?Mnph^xqh{BhLtWY=l)`jfQv>maslMXnt?rkf9W@-WucULg0;=pLuvD#H)sFjU zwaf|33uT4GMXOXIR&_sXuznY@sRt;L*eegRn zSTWvAoC#FC|Eh~TE#d5?X|6J58q<6qKI|N{bnkQM?DKg4^P|hpA1>a!&R^IbVig{8 z4IlCxAM*Vl3gRCM^B;;dYrKGeUPNZp#(JmpuNRTAu&}texU{siXlX|PFW?mbUJXXP zyu30pGCDds*4NixUtfX$o&I$a>7+Nd77=^48pQd(WaXHsRG)34baK& zaIQjkIB#F2TIaVOvSu6l_d|oey84snA;tRRv7}R$x{wIQ`L5RRwOq7sPN#hh*sPvP zu64Jk>)nR0M-**tLKizz#hR2q*dK4R{tTx}Vp2SG^}b`(Xko4QIDY=ckYaoHysK%S zVXwI21%45a;xo4Gk7bA7sJQm)n?XYKufy~FOcOLPtc?J?IHQd~qPzkfaI(6+jbJM9 zvp*qph`oOVAB|&lZ81pXei+QL8-5FLi=3Gag$2v#h!SJi--?zJVBUz91s~6fr7|eY z4Ji**f)7M?R^Cjgxi45w?9qz%!T(+Or_eZnz3KhV%aT0)xOB2LyjEI6MAS%cZ zLkz+X_BSac%BqMR@Je`}O9Y=29`vm+H##eUIR2e9NnW6yA4_5Z-9sXLhIC$0QH)5? zH=|-Nf)7c1S*lScuZN`#QN~4LJ~s!483B_br1?3_LD9J}3PHwYBMhoDWt4#p+u%eb zBuH{ZYX?O zH#CYI7#7C`0h2#45#tr<@l+yQCB?FCdm#Bf`JK9mv@Fe+DfLp=NC&$PuR$bE*8Cc! z5(XE;mFp`In5>{C8e^3@2FHtpt2+;~Qv1F#|ACJ~;oNoh5O?i>fw3CF#&#_@1N+sl zty=lq4H8Tb8*aZ}0DLk^-A&^i{zYGX$~m?JTY|sEUXtWZfLaO~CU~_&508U+a03q3 zB}0H<=&zh;m=-*K4(LcJn-X`W!dHDUJ;9NGzmgn3IAXwZnK&MjN0%QcHho5e)Al8g zp?<$lt=F2(_6nV+Dv%mVB0Nr_=LczgLcM&MZ1|`vK3V%7Zy|Gd^80T5Lcq$)<3nCL z09)|)jpWZUDR*+vEJ#CA9W%asA3_WG2t_!#Uo5l0p9uvRhb97WYBI54_oc3s`@@p1 za)`tWIq8cg4&2)I>|o6e)o{aDazgml%l`3$_l;`W{rta?*RL zz?#f7E?$>8LF@_cEe*{9e)Q$&?wDGTqVruCTIKHIN4y_8=KB~JfQaJ(9^tGJcvOW7 z2lNRA{uss4?t~nE&yWGiMjX1(!(aRV=&XzX~%>X%*BeU zh;;S-*XCB4Fw3h$vvtO>$3}vxD$^`qYm3miOw~=(Hbr9UYWd3?>W5ciNb2!~kW?lt z`e-wIhxPYizK;adQBY;tG?EyTfv1UTg7G;vRd-sbHxIA9JTMllZ5#6sA8K5pd~3a8 zJ#%$tSPe!`Xg%W(bUS=peiW!9e3+qhdL7nW->GXrJF)P>eO;EH`wRf@xB!62Or>u_ zkr}nmqLSzBm1L!IdE$5%%^R&8RPh!(fzH3IQ()00u7|v)#Ng z-PBNfU3n4;Mz;JX4Y^14#YVO7nl>F9*&vyQR?%k}p`XVA49x2id<)GBpY{H?OxQ(0 znVa^F5%Y-P@r8M_+A<=sEMFyDpG(xqqhlRy)6ug!mF0Vq9qsN6^?$NR=EDXJ; zK}~^R>VjZ3@|5&yP2g3^f!LZe&ej(>X&!Nt5)_vS2ngHKnFAx)#|MJ5pxLqs7t@Ug zl!-oxn~Lnk!=I5xzsJMsYVyU8O;la^kWFvO6R-DQsmLFf)*TA#1b-HdCq8P*Jt%I< zFTb*#3~PhEM)hH;<0%sOvj&tZs|`$JRh9&uBVm zwKNX*x3bHjLIWbEo#Z9@j(hfddF)H%rYZMQdn7c~5B{}X2yQhBGlReM@r|#Sci%BGce1BlJQ}<1D3{)kZnNv47w4?KXvhx=^^wOMr|h}$I|)=! zU}SABwzsRWXg8)IB88fXvV5JNey3rdS)F`jHgg_6Rk9N|%-&-38E!fHy>v38*ijQX z%0^aNQLQZcl7-~L>YpX6S#k^l0`R9yUW@Z$4vH5X3CQhrq^~xFp%T{klFb{z9MQ33 zdlypNkz0}`4`~IWmrFP;F^K&RJ&>upuQ`g&CvJio);nZQt(dDWQt7S@Jt8;N<*hv> zVdNWM)3w=cUj&IHpAS@DALhr}ZtBOLPh4NG8SdMIOjdHZ0p{b|IDVc#+S>__~`!QceK)>hGrVM+_S-)r-|?UoFM&^5(- zCGW7GUhnd}J_mTi*3rNxcw%38;4po`to6Vhup}hnMBYQ#7yRj|qXE~Ti2sdZAHruN z$8!_^OXciOl3lL~1D{XPKk2GG>73{qtA9QldNBET^6$A4>~Vub`M~=*%0O}PE77qs zI0_rlDG_-p&U>+<&`v=5Q5t%S5aAB(>G+We`q5TQz`aWK9v+Wt$%@a8@ zxd|j7VeO$f2zeVN_#xc+p%bx9K+>^0{POwcDPN!kKVV~_WPoBM7z(AwLL0zc9pEtM z?HC{E{FU65=m+(+D}s|3JFc5PfoJosXXkE!{ha?su04?xRRN>7<2-(LLooHZZ_5Bp z`?rw03r)Ph^$TiLTO=+X zDmvC+q#Gh8>_U{j4vLVqNV^`w$NeY<;b;Ty$mT61MjJ||7~ak;j(j^z8t7<7=NPhc zT+TrPKkrDkDqOt8D4Q%oJ83Lzx>x}mJgg`}qQYo1oY)s?LR{sTSnn8vKt%e$Fk|O9 zvjsF5W)TNOJRR;hBj|YMg=o_SPV>h2-9NaemoYwISY8V;Dbfke*0H~we>`?Z1~8*b z7NVn|^3dhPo>gPTp%SX36{57>na$27rY$7a-Qw&H#AijtcO}G0`MZ^5xfwdT5;7*` z6q3^9L>cq&NbkpLIY((XCcnc$6DN*xa3<)wkI2EKHKi!YSQP;+-Q}-TSpQ z6JWjP9o(SNFz-ZukE>ruwQ?V2V~vMRLsKlD7Rryan~3uZ+#cw5vxH35gwiu5O6RNg zhTaKP`Ih{!&%N=LCacjlq$>Rt+=R4G*kY)V#9xu+gxSR!J0OP0Z}D4b1XJMLH=il! z%y%kw5G?LW;4F9>&TALWuZYwilgumiJuwr!)xJ^EBl-Ce`Tt7D+^*030mf2UpGGu^ z_e_u#tjhuf+0YCjiOGlaCdII7XActFrwO{|Or`z4PfJEkx3}|O4D^XtOy5ZezI!LB zy$NrL{MDseSc645k~c3Zm$N@Ar>Z|2CdtVN(rnjJ<6BZXnM)?TK>*jcKv@6WOeH^# zhI|zkiVwIJLb?(GPlsDMbiUyn+0Eb3ZnQ5@kF@? zy18b15a#G4_7PG@zwpwsCX#RQ)D`l;eB{l!;-P=!;bM(J5a#7+{@(DN>D>>K!|x^d zU=>E20xG&Blpm{~L~!jTeh3MZR)|E_7IoL+Sl8MzCx0^aD5;KQc&t#~H)b4QPSq>v z6T$RZEJO;f40Yj0W39K&VGqfv#Ck0Ic%2(h!tJJ7?-E>9eO1@g^hI=-`%jMNtq*S- z0xv#Z??45-pD+$2o#kqRP4-EI-#YJT=NFgQ*Ow zw$gAn=i}(m{FKlXR3xiak9(9)36}kJAkh)rIy;P56KrRQ%&J(cDH`v5YunOGDw&|t zzW)Q6f2b|%rnPv^s5rU3IY9I&Smq>HA>q0m8>IsrO>gfztu?=xQ)~x}n(3$Ij*}b3 z{v7o))y^o#&Tq>|_I@Ti=S4fanqQ7ONyMbF$uM(&0TcRZcqJSJYFsm4JdEWP{9>)I zcl6nhy1CGL1{5sOZac}JFp&Cm^7Xad8S=C>SULIlRY}=;ZIL@>0-U|S{{m0y5i!$r z%fqOO)s|!HTh_1m?V2weke-_m$}phem=rcT(<>&XK9CgN%GXDUY|RkLD3b*|(GJd_ney9Tn< z`sDs(xPK1{a~k?1>K~2_KvNl(mjJd5U1fPDG6XouM}wEr9gO)nu4FxZ43>d@*8Q`s z#k>99W(cKhgOzNCRcu{i3d51|`rv@R)ND@=QM(t@(DL%Y;HR&{WTP8q!_UgUcS`J5 zQhwL{8d*!hAOWX2NHP7HXUa=9*7DSTc#$$qnqbx^^sLXYeQigM-EP)D6i0>#CcEXW@z|YlpA{p& zS^&>Pzi_&Xf2Hj=8WK6^1Z;Mv9n?)UFa{wNY5X+GS4-&Ku<1o0AMv4?kbRm=MJ$Gb zq0a4QVq+(3x%)kqV4#;U^QqomXPZ>STz6V{nrw6Wi6#qdH=A>48hr&}(_yS9Zd#Mv z;MH*YwcDAHhy2CZDZ_sjD4Ko0nUN>vSUn#IFOsj`Z;1svw|_K;QRB?`orN{X!vCua zCrl2G(ag`(UnVUJ=47*$ozo3J+BMX5Lsmq?%qRBqvZGq(@J+Hz(SPKo=32Y|u1R&b zf1ZaN${uE%fr$6F81Vd<5CnF|inT{kiSAoIY8jTgBsR48$$j~?(ALwEiLE2mhf(NP zcl`1?|LhaE%kpGqTZd^8N#f=6cuzfsK8$gnX{n=4x7HggYZ3##_u{2{u%(c{gY1if=Gj9~MCuHMd}oN$f31Xm$5>7< zT8=gPqg#+K+F*cjVx#2l{rgTsNj-pXFUWkrTg`A4;st}|C5(PG?pQoku)%kxXruaW zb0)|N?KhGFQD)+bF9HT9_h^8eN}$Q%7Tb#po$bcsC@U$`+IYfHpZiRI1M3viO8?%f zEz{iX=1RQkIRtn6lrAxn~n1-&-4Dg(52ymNn>u-*w&0=M6Y zj2z+J=v!a|fkAg0iF-B%3Z8+hd#_*DoL$n5pnUU>HqX%KZHD%zjdsqCf2oKEnyDRl zODw0DA7m@HK3FC-UFx$^{mM~3lBJtW25M-iQc?9DFF94eX z7~}KifOFo%1jdhXiO?4sgR$*{vGR>EI?j>oYsn<1=ZIY~9f7f|#Fwr_wUCl2#x6z zH6a#G*QO@{*YZB8{JRTg+}-?nP4r!mXPmj^Ls!hhSpP$jr(mw#4QYDRXVshUo)wjz zp!<4sfrp1)6)Q$5P9I zW==w8&MT|HXQ%QgHcqsr*XJzB7pC;fpOkR|;n!uDYry!}m8SV?$@4uuuB8kvxFrry z`SwOK1S|$$0DK1z0FB1s3xxo@3qmH>=t+>?6bM6S_jr#gvn3RTFP_GiD6=gRN3PzM zBLwV-CDEI&_9V*Wi2^WgFYmw0?MY?9yrO(RcD^c*_J_sg`1N3=BT*z@s?q!Rm1IIk zhfv}5V$n)n@;Lfp#N)*()QLX54hM6!3g)T2BW1Z$jZ9H*8ofojgY^K}LkxiwrE{IW zP~O#2qWaSLYD;q2FxFd|?KXF}Bw5NK(=Viv@5tLP7M^3qiQO@_PvmftH zW%8k2kTA@Y7$p3VQDMqkt?q1gMw6Stgg~cKqgBDc$|YMFQ^@Px+5;YbF=^?Nj`+$O^KRPJ`~T3j{>=P8{t&1Tzr8Y;DpQP zeHi4E(ma^>ieF3fiOhuOlH#w z?IU;60XE|sF~YFICnLtZdnH1{dfG!P$$q<4Ey?-%o=%Dz5}%GYZY!Ho`Y}SsuKl?! zCP+e{y}Z04y0C~i(l7go$EGhK(=xQZ zHq;QmK1IuGdO|qJDeAG>Q|@fP07Hd7b%zq{imc(jB)#6UVcbD0QV$TZznId z(IDB`ece0bj0yKe)ko2kLc6}CJ-MAmy&H>&7n^sV2M~PWqTcuDrGq!&zV6 z#ArQI+MBSsNd2OyxoA4Ja*;rKx?;`1&KY|Z6qW~N92}yFale^Lx$3+vj^pmqQ&Jw} z4BuY1Z#S*2w_w)w$6mdz_WIcR?w#(b!qOG7CZ^4;>s-Ob?Y80L^TIi#!sBkD|LQ9h z4Li8VnAayMj2n0(t~UG#?~iC&?;;hspcSZ`;nXtTQ#x_CXovqqds^pbW8y|sp!CAF z%YYDs#6KDBab2Soxzk~4n-vzbW8{l{?TaJeK~Ji1CK=JXU?S?lbQt%AMavS9N#MqP zDGwB`!2t7b;KRb8@*Q5n`ht+a5Bni9n50EV=t;4uyEB4_18FS;<|{E;9ksl!T$auk zrf6mtYD=pvC=BxHu1KO|A%o@N_34I^xyEz+cv`(1#Kr-p$-r;~x5dF(Jv0Fl3!I2* zy~pW#&d|p4sA(kOZ^BvqO%aH}SYYa3AQJe9!X{$S3vm%HzjYvs97IMeV++Y_M)G(} zY7BJZwZYSg>Ff+AbnzL`yt*&+hbkfX!0Tlocn@?_T2L8lv>1FzzvDL_y6_(x&O$Us z6~*YY@%@uSK!@HS0;NNnVLAcPE6rdAF<+mG+kjuO==5l=hkG)>ad3RjunPeg3&IAhKxM!Yv9dnsixlhRew z5qS97-?WR8>Qiz(D0+<>43cDj9@~W%;Oz=>(B}S(^~YUn)Yp$Giay7)XXhm^ko0~S znUJm_J}nwAhf)JWoCHgEQdju&=R zcH5-j($2Ts3RcwgsOfcBtdS=9@Vz!`K2w*AMs#4K7#R}(K~Ja%LuFX#k#@6)e1(L9 zKcYSnbTadBMHiyHL};Y{^4Df|N! zYPzM?o15Ara})DQT%~oMYnq$hxrURv^65@elNH>t@hEvaD>8C)ST+?|;#1Sc z&>xccZuQXq7M;V`l-kcp3SlL6U6?Ou0l^O13rfhX0E2}K|EKupHve{X93w~EL@hgT z`$RmB0*B#Y3HWJkdQ$ctYjS9Z4XARZc5i+gQ-%;p{Vqf=!6O3FR#ydq8>`9@b&I&A zd#*l;`fP`h6Bc~Q7~oh}`*0#hCfv*D3yUVmMJ1b&_;sY3iMqH{Rf24vuHI7@sWE2T z{>BwYjFpzzy<1Mq6LcWevP`D#3%wfTHzRXwfA}qen2?q4KrcQZD*3T+5s$CVwqk7) zTOW>aU^H*4I@RY$k9TSDb*}HG!-xzKHod2t$zDa=rgWX#aA|p$fk8!9EXuOkZpqJL zvFr!AiZieCJX;*K!Dgu`59|5Lu0wW>PppM~vmZ7jms1yhKI_~k7^&c*@R&&NWuOq)pUWPSJIMp*Gn&Gc<_dauXl zBx?x$B!VA@esS1kCAX}weZ3itY_lu!S|;fyZko7sww$5J+2Rg&nXPTJ$#Yye>?NI> z?d7=n_0fNw>pSba%^~V>(ypIpF zvi27%$YV44A6L(z1>+VsB|ke2DyAL#);lQChiS2?xSglx+uf3l-QK^uQIRf6Sg^zio!|xT#Oyn%?`Y z+quTtP*Ti!`myV4O$%ZScXM_pUP&h)6bQr+7fc|ZzT?I&;Uwd3AW3Wkq?tPIJIQ=m z$nd&`XuEKqnvl2wFfLv&F5tZs4^kyJfm>@SLNt0z3&vJE=22IbY$IDu7bzMK$0r`r zk!~ut7HT}+Jl;q;IX-?p-Y?F)On9X>*pxvpsc___A*=87OLz^a9%*CP8qLi8Z#>QBOm za&Jf`y=YUasWW_%Gk-i4uS!m@fE%CBVDGyMB+cnQ^B6WQIets-^c7;n1?;p(WdZ9F z`YY$YSRp=RH9iwJ-pEcQi=2KJGM*_^fe~gw8#V!4VKn;8bnByjeKo<@00GC6UVPsk zv3sPNYQeMSD9NK9e>o1z9GDH_{-1oYK72xSzWu7p7@UPaf_yo+rklC(gfXWF?t=M| z_J#Os_#>_Y>~%@Fg%e^*gru+dQp`Al*-}E(21Th6-UD9oa@`4PLSIN@*eWATw+8cb zgwkQf65LW!b;OVw3q|U{UWYR50s$fsFr@%6ED^`2fnQrlTGk>3a-uFVLrn?ku{Z;m z%4m1S!?0>R@11%8DX%y^ua=U&toK0qC(%l^0DiuqsEk2TVbOxC=1ktfTHM}Ryym9q zpi3~J60`!dbJ~%up-8J906yTo5&!`o0BCi$T@5>Z89_!J$|4g@Q5NgN;}@ImqNo|= zde2KW-7Ov?mYF^B`%@|?04C(T-UC5#Vxui$m@Rr!v!YLOfGBjyD-1;n9w zwW;yBZSbf$k0aLhL&Zw9LQ9efk9LqrZI?8KGpFNwOCnwKoP@9()J(LAO53`2lR8ge z$&aTbOl%iSpz{wdr3@_hOrZbj#P}uiRY$7cZn9KVW_fz_IOI181V=1Om@hCz1u?Y= zL=%~3c%Zw=rE$y&I9We3!#z^KC{M z*8p0M9rP?}vD5%d&-nUGuigV!Wi=r{h%cW-0nZ!sBP7{p^dA#o*MibiW36|EM6}+Ct zLzoT7mG$PAW6wo>LFj+_gYNK*e1|l%FNW&xK48m^7f8RrTAE3Tz0fPlzc4uDJ}s84 z-MfeMBhtQe?mVYwZ;l&6=}~LOTULwSn->A+#})rjfN);9SV*oYqpTeMusO9Apeh?V zREED;4zWZiUnqC2SQi^BD!x#=J(lAB!|IDr&o;68o?6#xtGHl(d}1caepljY->R`H zmHN9>y=z7#hjcYPXSG$GDL_1txKS-F7CZe~ZJlWCoIL5?T+ys_#=cimwq^~Dd!_1l zbwpodv3Hv0*Qyo|0rW(w5wp67jG$W1nm0CrC;w^({`&0x>stBLH}4C=4=2^1ch+^j zCw>ZBFHKl)cVAPshIuCX1K$?sDYCABNATW58`0p?4~swf+3Rh0t9rx{yQA8vfvb6+ zbXYq7;LLX53T&9DZU~d9JILxp!!I@6=l*FdoC+09cG^H2+(0l+*051_z@6m$h&XSo zBigABXQ2l1qV>~P`#XyE$nrXcN7HBBbP@pp2!WK*t3%8-JvU=ao;EQkYITOX0U{1vVhZ(!#7)%C(GnIkRjGRLD1UTm{RORjEm z-=x?*36^}?R5aL@mspm=&|AIMWn|EkXcKvj&`&7UE8=_U6?4#;nn{;A(br@USX0*b z5{8$#`6gR7vWR6MUbth*foQg)Xg+HowqqdjV9=VlA#8)f`m$jkI-#HkAF5vJ6(mQ6 zVW<&gXdIVgr67iCq2;hDCgZWg5cY@3PrF}g+b1@C(0Ys1Ld~FLo4OO7H7-S6!ElWj z-cwC)v@-cFaXaMqw)=s8(8;EcfsSihjC9GU!-wQ)MP{BY95HMQ2-~Q!cFlb;FDzR6l zWg5Av?-{4-Mz9;lu+11|^ot{J+}^l?yKqvY_s5`#h{ZNR^4|0+^6G-wyGYTcOtY^P z0=f?g-Z*_ie)>ujN8t))OKtk~(}#`%+dK;TUj^`@2##S5w&n=T7t;*lzHgj(BenI# z?!1KSpJ;h-8=yiQw$XV>odKGsVE*m&KW#yqsX#O-}x*8Se8b;>*@k;PKk5zEj;% zU!UdRDms_O8G^rg2*346+u6p8QS;8(=lnI?6SKu(>mUAg=;a2OyXRP6FR%$Oa2PLe z1uyUvFYpa72ppv@2>maJ;xCBvFG%VyNc%6y<}S#0FDPy=C?PMYzFtxjUeYjL(h6SE zDca(FtSq(2>DoReerzl_bXWpBM?(d=gnm*JSZ0(~79_Mo;=AHE3|ExBI#;3>qAU{D+z^rc_y^H`zas3(rd+!GbM67T!Xd+) ziv5|8y&~atD^Jy7$JLz;Ws?`VOn9lHB3$a39o`3fG0kukS-3MP5z$@yyNBynobYL< z8~w2equsEJZ)8T6A+691iZv%{g!6AuHgiZw(Z0Z3!Li^KWc+$@K{x zvkx2`)^04mhPyJN3cudGcEdj|Qt4A(H(iuUr`Jv-kS`;Kn@QfyE8UKA*>`r4f8o6g zf~!z050l}n^BB{%`Ex5!U+2Dihw?)Hd7?V^@h%dxJ!V%Vu3XW1)7F{Q)A=DbYGcDL zN;!0}0$RZ}BsqOB5p!)#EOd!D+t^?(8lI zho9}FyX)$(mg`dg*hT4F=O|xK>EQJBDYM?Ouidpz)2+SyZm|4Tuik!W?rGTncEHoM z+tM+U=k=+FlSGx!Z3^-^MKDx7-eJ7`c5cpj--vpF)5$;H={4zDW9)t`-`%4BaaPkI zAJd&b)H#&w<kZ$UeFjtD6M!GIOkWe4MAwT13 zMF5??5O9ck4dWRdK2Z1!c0v={Ji+jo9KHdSn|ywls7}jJG&#ai-w}%R7A|tS5@-x3 zLzFHFey6ZFUL5UT5{_r^_#={=ToFy?h{V&FFP`lT#7kuhh!I!i42P2zXKfWp=?Rpe zsViJH$(tO=mHwb_!*h+rm(OR|o-8%JrC4ooxxF|(jHgsil#|UW{nn5@S7AD4!EUNV zqSxzRT&MnN?n1FR0h4uSKI&|8(9;;4$ozrsV7f>#ALICe{%F3+aB7G6!CEZDjCglP z{fwaGgh;&@(1sZ%FB8}AbejZL5F=uYb>Aala?R$h2!PvqgeFm+FFYn7z`7ZHv}Soy0?RLjFuVHi(a}1f=C0p=Zmrt zw$~?<25f)y-#Z!p*g;S_5+#XFI6(wqkR89sH4-udsE1yea6>sFm2ksOSDcUln7cdN z2yPf=yhxZB1HEuT4CAdJ3Kn6E5M~i({Mhd&O89Y?*fYA3>Mq1vfgDvztI?7IiTFvz zMf;1f0*w%hl9sC|b7HgNTgp}qwZ90}XzQ4f;x%Cwx1+d{`t+jpo1Au%LRlV&WIaDa z?0Vx(CMFy8Ny8Xw`3NVi=0iiU5EXJ`nCwOAMim+bhe#NI=gxQV>T34gEgF0 z4a9etu!$~=ozWkNtyQ*3gcdE-847ipF31&eJqXV)Dk3R9eAI=3tmT;CkfIe4Hr}|PcAHhIW-{uvNG}R37+SxMvIx4kgu1ZLGAK82 zF^TJ=E2(u4e7Nhmy2EO*nf|^2fqLcLP~nM1Wa3eB+Eo(T*DC0fAC>LY??UiK1Ikp+ zJR!^Tr0Q!t9;>^N4fkxvKXnUT)qNvfk!!r67)YE-e?GWUm81MYQz<7}N}48#dQ(&N zn?F^0?nB#AX~MgLR)!_>=Fsm;-Y6=iQLleWN`LeF4=0URqOhNjv%Y&dn{ZKWq1zBK zHaj&^VN^;DF|>vDT8f1OxWFK!%IX5`e3ThG9eEQO|9CXR*!}TNf4N;382)0hQ7I`h zHSak?v9wS#MdZ8~_t?g;+~I0LvKJVnfw7;3(fn{r zNOXryES$-j1_j5&KF{>Yo|+E(v+exXFSEI>BzPF3;5$5NL&$}e$ogcPdeW206iic(5=E<0J%UF!6FddDZSOj8EI(@`82nu$C z`La+7x@jl6tq1xU9=a@f)<0N)x-jWegbWF^Js0V5Am2w5qR63`9D}05Kn%H&Iq_IJ zdGy^+xGwUl$o2)y2Sr|CP0=|I!5LKiMzXXlNu~!hBJ*ajs7pyA79VUwb{6s&MwP_U zcdnDhadQqHhF*t>y=RK)NX)!?RB(t-PSeK7(qvQLPm@z47`N4wT>1toPpjWpCOnfG zIWx$ox?EJ}nC~jWCaYA>F=}5HEqnsxNjX%n(D}|?_89s zvX_`x`_A{&#Z?~rkgMo7kIzp#ROr?mC)%+vt>4__rPo>*K|+i0)=4yP@lV;HYI$8( zIb!YGQ!32`=iU@4ws8iQyKC~UHMb}V)>t3IWx7hM#?>@-&zL(SEHBX1)pmX?D|YZl zof&bstzV8gbgG_Sd)QDUxc_Atd-Ed(j?<+3Sh_@B-DJG_GgDG2kEDXLv#PSZW3w4D zUZ^dpQrhc_OepQm(XZCQ&HGv3o@@Dl00!6EppFqBf2{kagk5kB*Dt9h7Pp;++y3rgpGs*9F=BV-(^t3uL=j*4Ln1| z^nXq}4=Q8WYL|=Y@cQ2m1++n@!lCa9(>_dKoY*Adml}y8eIE%+qseMk*=Gv>PUPq( znU;FU4t9Ir>-nAIHb-w<$O(9a$kp`{n zbUR0#q(rF6_ac=-GBHv=jn?1WBrFsBefBx6A(~{-%A*5e_LbBt`$UILOUD|Fg=5br zl0L3G6Co(qt>@&YR!fb%L@1>}@k54Y z*};}|Z?@6?L5L5|PDH$L@NDtGSCnL9Bro!U+h2^Bx$6{nx=1KC+}ShMt3Nb5PvxZa zbV*HE3lJ8eh@);9e)oW5E^&ED^vu>c+&FYtEhO_YQI}f!fcTv7hhF5zG@Ro1>EmZT zeaA-PjJEQOY;@c&ek%-G@1{vEzuTQpq7NuR8q8d#35AP3w9)Sh&n3bdT6L=qwh;_< zi$7hb(mn5p4l+xW_{k~^v7b8Rvra~OIFA^F!j;`-+qb59%dUVpK{da2_6d!u)H&-wR!WUXxHwG!csgFk$m-Xfbq7|Y}< zOy_aC>WfLSi&6TRg^9_3Mo}xIv2vlcqG2(>>#$UUytTkkTP+X`{NKOnH~_>T4YeEuN^6fG;)Xne>BB1H>p=Qs3#v=KO+ldB0K!i zaLb(frHL~68wDl3K}}>U5UILn@W;w;h(PRb8^6#FKIX(~r>0R|G}OB#qDq-FK`7`V8>Jj0fRCJu)3hC7nPvoJzhdOQS426kWoH zAmOJ>D>6SSjBHvKT^fOG)G9HmC^7oay0h?!vMpJkJZ6qE(V@bU$yrcKAyks@S7S2Z z(O|w({SKz#*kt{TIV7Y@4TD3(vq}F-p-XF$No=4){5_kE16Nx;>84P%05%CKNEw_1 z>+_8UY?|h$rgi8fR2Y>A<*d|B*$ zP_MbD5UcvH_-;Qe+pP2zbv{)q31GGb zD@*8zhJ9iS^F;~^nQy=!(t@F9|4FbAK%gozcx(Qh90&h)LMu0P86d!ym(e#B$Y@*0 z6Kd12XwtZyz&JEsFn{^Z9H)DxpUe2YBcCp->)R`itxgWaZ!F<3(FJ!5bPHUQNyTKM zT^ojcYzK79pmYfLZ0(wI#z_&~~*pGmCCsTfZ4SZ)+zQnU)9nf>JPrf zyaHxpe;vG^2Uuo5iMy$H60cXj!t8IVXLx44>fsm$AC5v_ib1~wMk}FCryTivsf0etPrMs-lUIm!vX`QYD56qSD5oa$ z0>7eym(4Up9Epv21^WHu=5g<6-0=`*UlEiC=^w|z^}DpIr5mu%pV5) zDVBITR4R=Q+9CD9Nb{Rjt;1OED@yhHhFwhfncrPweBnuzm-(nS3@>Sq^lP4(M^?!& zN}_JnQCr_@$>{14lrWiO$We^S0mE$O*ha~C8{|NeL2uND5(v}og94_{rBkzLJpyE- zWkjUcJIMza$*5RAF&2*bzjLo*$GB{z2OZCJ9Zk*tTIe#I@GD`%H}4B0PjQ&nvRO!f zI4JsEx{P8LBRNW%6*i@m|nmnH8DLe2ue!pWbXK-TDt8P3$yc<+@ za#FS@p)?tYzNtdI$#JsWRodpQRXId%_nRVqlEOp+eNW{5sRZS<0_7hJiPR2*{g z1ynQnB?egxgZbTR#lyfp92_+q;V4qOB|L8>GLkhy{lv;7Q4@vr;VX?b(qZoxO=?tC zE97|U@3?1mi4KK^Q{6dMJe=@vYFwX_*vLv8!zx10GX#!wOk8Una8vyDB3$>X z6C4`C`U;Zviz`1H%C_X>W{Rv43@TJytMS5w)R0sgtUp+jx>zv)vsw#Oy!qrqd|nx zmo%odEMwJ>aI~yzmz(@C7}Yjxj8yEem&i-B9B@}s^UL(@RBY_G)tv9>cp>SyIqjIL z<#^v!PKnj7Q%)D!2!+>(!dVL^zg|(l zqZw;B6RECYZm*F@w-OtsqkycaPdOv-sbM>QXkoRuz|CrN4G7NJ*BIcBX}1 zBf3UyR|>eIpGPlnpP`rjYOnFN4#M$TBU^asj$YawUFz~9OSnC1Jk=A71J{omFv1%s zWeH74E)wuMdd5q2S{i*tOJl)cbMXYm!zUMIPn!=yB4^P zR~YFx7TE&0K2;VU>rFhZOjY5RusTkA9BL-0P%!q)lpGi~8B84QP7LZTbz{%>9vCc5 z>mB`X*Yj?yhb?Vn;g_JiTxjc0nd*P|FxVlHg^*X-7u#4Lp1J!|nA$OVSTgFLGCIdI zeoC(gD}@CwVEp+JaJ6O7^~7`IUGbBue;0nku*>NATIXST3vtWnuX$%;+TfK<<&7le zLf8;U$+Xnq*fLueBE-aBUrVFP-DfzH6j*{4EG>8jQ(I);bA=xRCv7w>i?yR;k{oQ5q$FdOVDGcg)VlY$^?hx46 zxNqK-scX!Ua9)v`A^ME>>6$DVKN1|VAM$jSe4(3a9u(HB;nnHI9i2>n}v&!hoyLcwlR z_31;YU`6>_V^KLvPD4|rW(SLCMnC3!7;mTb(X(kaPiAegyG@F6EZP=x1w zob96}r?u7CV=gYM=ST1Zy^ zo@NeGx2L$9&>v65hmYMqpgOW2di;?)DM@9t-B=Wv!?W4md$v6IvgLeinTl=sO#;zh z&)nt1G~8b`oG#fD&1{zJjKM)LTD+xl>^8L2{2TY#Bsf6)x<$I9r52LC&UJ$T#ht6J zf0UMe?y{`^RgQw&T_%AAc+WPIPc-|3-QUc8uD&(g6)HZvc^OxR{`wV-0}=pF=mWOc zbHbnIV%U-@T9=xi=X7JO*Wrs(F z;eY#n{n#t=02Dax7uSQYv%mYse8}1c2t^tGxZ5Ob7-^oE7P#vy?*pTJe)sW3mG&hb zQaL4k0>M1E8_s;3^bQ=4%Yn)hkn%YE;cWcA!#KkI=VR;j-HWKH6$a#8-8;`S|HqPI zMAb-_a>!P2s&;U_{s+!>LqX2N+L1)Zzj@fO&mDhPhhjN`eBgG8SkH#PTIG4c==-n#dO`R??6)$zyl=LN$9_AJ89x zRp^gKjW)%ZF9m+f?u%uOw@`0(Jl{cXtl1q+X8KB`5P6vgslqT!x?n=YCwp3P)_3C$&4J%6ZQUDkLB}EzG=6Kv& z+)v2PZg;*j*)QN(hS}!!s!(n#*#QPkCdJkE6A_^5>>HjeXvrIwwQRjaqaCk(c^QT$ zePA;+YJ$5zG^xp=BSYZ&C@m)4i@Xm`0e~4jinahoL&w}%v$$rA5qzXU{Bcxt(gWCm zWQdJ`rPb96Ec)sV^81*KTIar~eWJjn6eW8RYC&Xk&|D?%r zd4s`Yg;XT@AwsdUmby_7M>Kpf65km5Bsb38&2~A)iy%%%^1j&2uAU6yTj3Z50z~w< zDD~(xIWO|@^pvEy%LUa0T4@CyCgTQ;xF|h(RX?oiXpF3sap`NV0?Sx(3=hl?abv6v zx#!3kCDEg3lFxz2whF3=<~L(~PW0i^GUqU}9oo^)r)>zFNRecS)%G(B)`R36Jnf~xE*HwTN&3A zQ&f3dyz!_)E0g=jgW;4#+gV0JqJ_$ak4c!yL5_WyilJRGI}7hb)W=G_?8q6H?znUE zrK3c!2o>|%!n(!dqROx#!^-`#r4ev2E7{Z5`;(>9cI1Ia)r^jJU)9b+<|LMP>QOD9 zU+hD(vTlF9-F5C1AkKJp;;^nK^M+*9Xx*XLWQ#)%jlw<{4 z;?-=vo^)<^nWU7}RCm&GoIAXpk6d$g_zl^Qe!HB1qW-Y&eJnfqr`eD4X!~g??PMcV zQp2q^Ua`$NB;CKw;H=Pc?Y4mx#zWl-I&9!^=!7%rxg`vf)1e!BuBF>s!d-eP{Sn@X z-V@)T|xx1^fbkwK)szrUPc^8IY6AVZG9K39_C zB|C}qS5y;$d)&=igs2SJSy=(PG{7)Y`e_v1L4=clu{XV;|G z1&e>;7(!JtJ^|9ufmTe(HiV{7r?-5C$EAth9Y-MBXB3Nw z9I`D+Nn$ib7rw}n7#On355r-dr=tBjxHlEb-}Mwo6S~OMfMiAynmFs^L9~!9dvdQ3w;eY zg9tg*ZI08BYuBP~gvSf-qq6}Bb%Bowl0JDmkws>E!qQ0+{v=;AVUFe^4U8wu>g4#n zj|h%C?ne{dBhqou3lBN!MB>V(b57Nad5wc;Z-l3l%A@uVe&dav%wOdV4Hp8Ci&N3=^=J<-p?J#utLH1Fle6bu5&J5}hQu!w6`S9)s z3Y`}Dk=Ch_V*4xw9XRxbkw|!4=mZf=;wU+Xo5et2qe92$xat}bv*NBKC0z0wYyH@1 zUH)odWUI`sIhB!Ewl_sl+msEpuJ=vBy|G??|^9b4wM?VcFv$$D&*MA}Q<;yhj{Mw2vPMPB=XTj`lrAJift}f;o`GB%Ig?fF@ z87y&-;qr!@wqDbHX@v-B$nP>0p(y*}lTX&4Hd=!2{PFsV!e_qfViC#}wd#|F{83hb z(R9*P2@{Sc&ez?Q=o?Y^lpVuOEHI~mTF1Fc1KUkH&(Qy??}x{Q?RlPF6#Tc}t2GBH z&qeDNV7JB=Tz3r~|L{oSaks|^a&J9q}O}>YTPTJ*O6-uX?9KyN` z6=9%dA*n6*sH;rZa>TZYpsyGCF3hx+mF2Cu%~E}4oTy^JDm70v+i0m8YdTSh!s^c! zU#pqwdATZy9W7y#gj;atqgNgATOts?mYX^;s9jUtz1B}&p%JL`NuM;OH&eWoxx|BL&z<=NMj?og7kxWX~RAEW4KeE&`xBuG!a*U_ntp2 zFE{XM#34>Bopw3e!EURhPF2n*^Ep;K5ZN~)TQ+jCL~cC}Cd*?utv(V~<;22q^g@_F zFMY)*e4To2J@vNy6ZFw};J2a2j<%-jZRFAxS*X*DPuayyJLgOIrSq7ogpAk}XQt52 z%gz1iwZ`eI1k3}AB%mzu!gAV41d*B)2%wHX`3+sk9RcK4;P{{3^@fj4TRziS-65WB zJB>cvh3}$CuB%wQDEVj?!QHRIy+aoVmo@1Hngkim2g?mH!3m^Q;G{uV?RjN(It_(bkY4NLXS!G<{hnYdhP_aiRUPxqUa9H@h zoGbtn<^%P~ZC?1N_6n$Ui`^mk&*#Ad2b7=ssbC)Up$j3Qyu(v9q}tWQa(hN#Po>~L zrAI8g_?0|WC~%x2yy8#b7Z4y4P7srwBhp7+Ggv3FoFm2JA#qo#2vmL%9Q`uN|3w<% zi@N1~lvE=PJRFksy3!f)dB~l};X7Q(Iyq}(gu!Pbgx4MO1qI7@mZjHWR&a-h20ZYV z5$9JZxw5$qeplKkMIrQt3d`hH{&J?Rk@&x>6+Y5BC3MksiZ_;H1v{8_?=XmIl5V98d&{47(QJ*WR z2-e=+<6XScReTeg(R+F1#EjT&SvG~Pn!_}DT-c7 zu*6BcRGL#?1cE=|_?j1#kW=`Vl%#MnuX|;XxaMfpkw}k|<`0oSPK!~O&L7@K!^7G3 z#q8Te6o0gyxJ0wL5j3^rDfdqtB{I* z_gsG05gch(*^Cx-YIn&rX4aNM@$T5<0;h=az9KK8S~-v6+wl;VzcqO*0tM1UTVFT| z^1%j^4C>$nNi!|6|0OIr1$p8Wn|%4h&?WYv&B4&rM{k6Y2%3-i)kiSJoSJ1a-@*&# z$L`mLXoK!nm$rzomg4M8pe?BASx<5Pm_gWy?uj$^v%63-%lSkL=^5 zHJM>$ufTYBoc;(=1$1yUHTD;H?W-;{D%vGlfvKqv_7_BnRRp9FJejft3^Ba5Q|!Dn zn<|sY!C&@@qR|I!+3Mjx8pClzPQaquK6=T3K&s&6jLW#@ex&NX<#kM(+v$B64BsFn z_-Pd1yK`*%7@=)p(Ox9NU)DI~V^p~nr7XhDZ`{Fv7Bv66NDB zS<^6cv}okC(yvprqk&SYmfV-WrFM@c5^La3Ev5F);X|!>KFY};$x+iIFUr`v+B;Q7|_cXR-tCX%DK|WYs4t_mntT1Nt)KqTG(&&jmp4{$&3jrL7FR>%b(}a zU|n9Y=FaGH$lx3!2nN#-wMyd6Rg>%6ON7gDRLjHf+ma$j5?)eYr65a~Qu9Y5J|NOz z_DYGXPU9-uiS||=$00x-$C9GbQCd^+H|PU^_D{c1)l-H z;O{Rb{%ao!06xP306hFZ`$iA|Q1=!1mpv9xfDZr|=>N6{?St(4c>ZmV1sJ^t01H_F zAbR@`;6c&?{%PkedBOarU#A26kIlCqVf6Cydb0rDGSDZmzP|qU>y1E0Mh2jzr3H9( zfcCXO+g=%<&ff;C1!Qz|09+aCfEGw^2iMoRfb|TmzrA9;iOUOQ?*(vy>R@?wfb2Q| zFOV|UUxAKwP!8&=qvNd}7RVOVmlqe%kpXI>Lkn~a)DB2kpnkZxK>Hx$^$t*lbuZ8{ zkhDMoKx5&`0Jz@91(Fx2pA1m@TA;CJfYbq+!`9*jSsX9>L&oyPew%p5CEEcL_r5=UL8O}!~l>`F%A?AjDzM3()c(~(J>EH z49o)!ZvxG$1Eg_~F9I6YL3Zmv1895$ASHC{0ppqWt0%%O29OUne zj08Z4Dg!VAt(g&MepXHyARlIc)&iurc;hMnj6n0%QUc8vB%`-^gXHu!caU!b5cxr64P@TLrqKHsOCVIEXA4~k1r?1B704)T2gC`QNM;sO+>6$7An0>#GO z*&dJq@^=Tw-{T6gME>gJNYK6whaOZ)@-hikDa5_3jlga?%360Y(58lo22$ zWdvv$8G+^sk`qW;R-l-%0))6gYh>gEim$h|astH`NC8g&`&T;u8wu=xPGVwWdi(tE zHsAm7ftBf)mG$^Hog*55H?T+1P%wv9p49m{>oovi;@+B{rA82mUeo zkH%S9KTL9PaU~^juzdh+yKr)FC9%9E11_lF?5wQ&Zx)~t?Ef9~@dq|GcJ@gq7G`Fy zNf$PdF$*{|Gcyk;Nij1gad2`@vT@dMaMVn)@4t=tg9`@~=Wk997Ck){D5&H&V;-ru z^!CZa3=ZnXfCU^J+<=3PmFWW;XFrF5jHL?{3lCHhGdTF0ZA1jmzfwd5s2@<3q@*M+ zsD69@J*>nX%43I=9TWo#j&+$nEvly6er zm_~kSrG)0V=#B6zczat*OJw7hUsJ2{uyMSMh5hd-FD52sL7RCGm05X(mZpY=g50zi z+X-)wIl_U+HgAa5A;T}f$u8#mhzLDqmLw=n_Wilhd5<|KSAIqDj^Wl8^P-IL32$%j zUkB>jypkazBEcGr?Fmsyad9#)%*^1){i`$lv;1@Xb2c{B)}9qIr>=fPg@`TzR=bS+0pm+l-oznz}}aw&cl4sE&rF#AIbt zQ$uc=Nn)I#;0Jd0F{|PNlU$IY3Fr!5+)}CR;UN*It|6(zcN)eQx+CGgZa+e&C05q_qx^P-wP}qie3}}Pe7byLd_fYrBUj)_H7=`coLt$Q%B^y7f_ zGb_t>(@VA!PIGpRwRJ7-GvgaUe0+Smes|XU3U|yP$8#ltM;T0R?e95%NJ&XC&M7hC z_fVUdu(oQhEoyfiT2ceq>xLU9lzWamvP8ZGc~mUNhreG)Sy=b`MX+w#Wz zmf10-H3`k#U4LO?d4XAF^CYMwF0Rz9d^*qZJ}SP#$Dl9v zNT$G$Qj>sHNup6%F5N%&2A~1G-X!ET71Y%iE6A5r!8tk23GFd)bAt*4I%(=1hU)9; z>T=D5|IgEp=oXt`Y(fjI5p8T-N{&U1{hwnoQIP!^lh_})3OTbObF+k4q5tBHwa=<5 zXrapL^1;h%mHj`RnLz(sI!Bc4?S=m@=StAN=>PT9cgD@MugWS01|}x<9|yVro)Z5_ zVE^SAQxtTFn~90(zxz!5R)_n4(naF`P5R$g@c-xZ`ZxXe=l?tXf9p>o;2)gi`p=yD z{{NX%|7$jVW5qYFeB(yo-`ojeQZLZ%8&hI&y>X@1UuOL`PyXdd5a()vIP%~8_{O&D zSRH>^^)K6ct^eg)um6fA-`MfrEcwQjZw&dyl5br2#+D8L;=4Cy42XyTF%pR5lq&x6 zMFog0-&pF6HQ)I0jW_?zm3Mdl+|U2z(SLEJk(Se6u5xmU_{)O3k#c}9S^vEyId*zun@=8bVX=Ko>GdC*)7*8hWX z2mT7gELK{e@fiK($2U%S<6bIwr@tKj#wbo+|1gS@l-ECO2~q&a4*>yQ0MoZO#ssl8 zNKQ^5fq40izu%ZSAmJYl*AfD;rxwU(AiqfwB>+-F3IDLDRszT#0g}s z_8cJMA6|_BDFLL6w{1}TC^3Q7<856)4D0pAu^>gfv4$!#Xo+W^CP@KFyUkE7phl3L;{$b&Qj<+%p_ktAg#={_0 zfRq5@;*2+e*th|t0#IBvfK>1=P96s-BVim=2P9CeMS%3i&J}O$+yP?ffq$M|{F|Zw zSKvVGcO-atc-YvWEo{7hZT+WGY&?8iP$GHTAi{-!fWReshyAbgR<4InvJ}Tgpp4%| z2#&+X#^%C?L)b+`Bo2YQ^bY%-CO&SQvN$*aI0dNC!NCQT9PDv$zzGNlC_ruE6B6Ly zC>d)Qi{h|5`K6W;6U)iV$2qxD5aHwNk>FwDQ@HSO+EZ9Cr*n8vuHS2Go0yuKSyY9{ zYk=-2jj_RGDFSHPxP4p9nw))hZ?*MJ$So~N$<+D`3?5!JLFJ1bsz#elLsV4!K73kQ zx1UTbEy+zx3}z^B*uV*K^{~%WUteCR<>n^p3#PU7^-am?=*h{+XhONT{D0zr6XL5V zPS0*p%QP2cC!gq=nvz@6)6>z>7KbNgMT!!M6XLcO2nh&COAAQ|7Cjo8l3LN*+R&5H zo;I%b*F;f@zI&&AR41GxD3aGeJbGY6MrLKpz+gkG)TyDaemF+OTc-Djsx!Qn~n!^ zeo$aAw^Vui)VQRu!kq~%t+9DUzM4X8rns2U8W=MZn4KM)Clyshgv8*aqPC%tF&>z4 z$?)|`3vqqV+S}?XD=#Hb3Q7s5M5lG5y_)}BQ0lssQUY=h;$DTnpFTgWs|MdlQ z-G6-o4v&t2-GgnQy=@H0P3{KjYWjipfk9w)ZSC*9$II(8FfhCfWMmEk87Y0h?#?l& zk4M1G&kk_&bpb4O(g8!m0zgxt0Ql)$1!S~N0we1Oz`^MWkeS^Ic)2wIetyM(g<(37 z9NiD3*46=uRn0(ndOMKTJO~7(b^;c<^*~0$ODFgh2T7Z_tU7&gU3K%+n27ceZ0*zxc zKvq&CkQg)qc-d6~fdQpJYiBo*Qq&HlgRTv!WxYUXOf6ubng_VJRsm_ft3XQMAyBn? z3)HRO0u3u?fVX`0D?1&i0+r?EW&<7VZNTN_B``ZX3oI`$ z0~Z$;!13`hu(Z7N_ug@LcNY{RufP*1UYuAE|EdENTf8i4fF!Rxz%L;OU~x+TShD

uXvAg7Jx0Np7~pDX9L(-+5lGne~y(4 z9`UcF{s;PetIGzm|N5_fKfLt~I_3-ZA7df^?`-eCm7u`i&Zd7qprXK`puoTagMvfA zLc_u%B0-0sTwLAUJv_aJid$$)H2{D^OYD7jP+V8KXVupJ zu{B#$wN+dD&;GI1rK#OF^VXIeXU5O6W*AwPJXSIwTOP@lo2G#lO?T6Yj3h)BIcI2c zY;w*yi<|@!2oORNLMV~(Z@+UJFp^O4ys3IqTe_;lz4zR6zVn^$eEFO%z5Vm{dV9US z{(16TprGa_?0nv>JpcV=*US3v25&bwuln|~@m`15o8t73D7)db+xu=bC4YPSzP7f8 zm6a8)kRSC-{mynfpP#SWS$3;?{`>Q=-jo-1wr9@_XYvOzK0c1?*RNxCb{0>bJOTNP zxO?|5?%lh`JufaUa&1|kt&7c-)lsYf@+8 zgZ&@5Q&UqMUhErN+nw`a^JDzL+O-j0ZSC#2HZ+7$f?G$liq*u?xUR6awuYUZ9U^Hi zY;IS(yU|E%Qe0e&l#~?0DU`$2-rgQoR#s4{R8T5akjv#2As4F0+(zbqb{=*UpM)a{2P*?KSfD_NMjm;odJ@a>B)n7jfD7 zGQ6pd(Wtq(g~ONe8(Z@hqF-TQA@U0fkV?3F`}tCPcf=Cnmzx#SJo<0vdYu z4+wzD)()4PopHf|=&VvgMtE2<{0JwB%mNarlve$gwWtpBt{n@Ii?J;QH2PONTm6@ zLLm`DMQg=ycXf3}oF`9;O35;>UvBpEMau+2}U10L0xx0WKv7WETphj+dy_+2I+Y# zTy%;-pidd$)r`pGE`+6YATpy1(OKPy%;`dW`4I9NMv+}ZrSTdH+eXpWJ%gyIaGd88 zUz&Ns$14c=d3k8-=to_9FB&@s(B5|q6;1tU@1MZ+>ARSkxktD!V}x)5HjnQ*y~MlzQG!MCaS_OJ$4>ROnI%W?RF82syhxrG1q zUyb2#F&F-s-EfNQLQq~G{ECL)pqYj$Uw-tq#3I@O`5suKwrl?VvZ!0k#P>_{eqQW8;ERE4t2I#iNObPe`nd2xx; zpLw;dh{`B{CZ`M~E!`;Y9zaF^6f%mtNS@Q->zt1Obt$fxmEf{bAufMk1j*M~_*O3o zU%wZLBY$v)S8NTuv%BGuHHv`3Yj7`^fSJz-PX%84c9 z4zD18@F_}q7m#n&Nh7Yr3E*YejZbE8=oW5JM%HWa3Ih9-ITUaCFar z#5|MiP9|iMG`I&ABc`wgktC~rwKot}e+w}Uvq-o)kIa!pBn>}7){Q09-d;!5ofVW! zFVUQqk$0V~!8~e6msEBRLH|$o5T4LLV&)55>jaqpNX672c9*=M(GYJ(g~2bt7oM&z z@Fbn+?-vMdRyH!4y5JpC47cE7IQr+n(JLPpNlynPSHdT@`e|Xb$t<;lgr4TTtw~6D(dg7 zp?u~ka_Ko|Y7rGg`_|i!kdjn~6YsdgU~ei;e;S3eM;Nlqz6Wlc3& zTFG}L|1X7nftc7B@+-CQ4KIL$Ezy*p3Z+F3jEz!p_WN|4`#uFqn*x}MiOyDeP+iEz zxpT=lbF>ip2b1x`m#O&SSOh%CE@`T}iC4x^!t_bcEt1W7luSORvW(K%HB{bPMeE&l zG*M}}w}h(uYbd?-2zBERP(N`8RTa$$bIyjdGzT7*Rk$Fk!P$?rIQ74?arS5&EF?j& zRQtj4axmhPvN1L`fuZ36t^{l9aM?`@Yf&;}-=x9#uY}uy6#TG18D~GI`(M-WJ<;Jj zeUs{^Lt>Z)dr=nr910P3B@ZQaJt*oOMrj}U+Sl)(a9|F(Bl9SpdW@>M71TUfL+9h4 zFz{dlEsr+PvqbZtIn+)O?&Gr_PO<||B+3V;P<`VOO0O@VbZP-5_nxA9 zfo%Na4Ghp6+UdDv;VCMnAE0Jx4&4*;2#ZR9x4$1U^Gi|N*oTJZVbY&vs3N*FH}oJU zvl*J;E_kWxVR^co=8^^nr$k(G@yGboZD?9XkkWY#scmCa#u3%ni=g5jxTMxV?vjoR zJ_YcMEJJioDEcnwhVvzLmJFY3Q;$36MgrWi60)I;^qPx?ku8b zVGRS1)(HPqw9h|9-_upJ-JeI*jTwwRT0(}l8DAeW!R3pN@bmSDHa~~_#V+*p4x*{K z0|iASdm%xH2#ZEhaRtgMI^pGB4v9DsYKIWSBxNEpyA;s{Rfs8VLTvd}q_z$~Q{M~k z#Cn94_aLld0B-U12*|BRYGW7q0v+(z)Ij)SKKTx15Pee$H+2Cjs>hI6*pDlz?Z|4M zMf1#KTz&8WL_oX06upmD(Yf#hLr)fo-gj}@$N{dQ1(=+Fhyagl2+rBV&PD}0l^tBj zpA8HML_|acf&%?uf6*D1*5o()dQuEhgZW2uxKFXo%*+B>+xm!yrr;kL44;S)qH#Dp zqod)U90w==WLOx-A)&Yhx&6b?5^wuvUxh!>%Pp!Ls>_78Wf{(VQvlhyOvD71Bd2f} zjxNmz$sI#c-#xV4dW@dO%jhDyk3LwzjXRIvq ztu1VAY~kSGNWQNFZ0)Q_*SSI@4nk6D7RGN}$MVw3R@A;7YkP;2y$E&3l^_pzgFsdSRKYEw7Uxx2FeRS(k!0D^z6e>`4g@B&Av$dw zDdhXqPS2r%_`hrR5&G{x#Ne&F6ldOscW^wMos%K>F%2o&LDZKG;j%gzE`i~QON!%s z{h*)#gocD6DmDzZw$V7FpGfjtiKV5d+p+%I8oM(eXoK{PBi?(YG$ zEDF{?l)yoi1er}FlujuylZWH<*+hD;hVX0wP9MsIjY&G`izc}FSHm-|1sNnu4HI*y zp1g-fx_6R(>9{eDzOga#xi*khQii}t(s3s7aJWP=S~7_+p9aX3ac~V!L4HLE8cE03 z*R`U!tQ;5ZitybRrSK-(!~D(dc=xAuuKcv|69m$8FjWd5QVSuoli(gAh-$alr)$$ZSJw-2mzRDU=OOp>kjf z9mA6toxFvGCr`F>Do>t1K}KE$O zq%#kf;^ZImkq}p-%ag3LSpC`j+Lb^z_=i)x8R`iSKX*8|S`)2JVR9xMl4Dx9niIeO zEfeZf1+e?E5SPSR@V=Y_ch^*kG1K6mSb&t)dZabABc-tudCk3Op!nwQ+&tD-*EqVb z5$+6sZXVdc#I1XXOf1LW&W6B7T!{$3R`@w~!Scr{h)VNXh{y9N7Kn#Z76I2w@i?#WhWawiIVK#T zNePIEPexKsKC&z7F?f9pkBC>-$wyx!cq=sKDjS!r``S8|$nOQ#FnIF@GOB9f;+YMx zBn6`Lv>sQg$);pOZk~#B-v&bh+iAc%RP&;`#CLb6#zo)?<~)1;w&=A3q>kjbrxCJ^IG<2>OY`H;z}|!p?s*d*M%PU~V>;`n_09Jk z?O&JQ-gPX(ZGD63L7i?{U1##XuG29;fxGK?=I_`Oc%xRk?<4#jJ$I@3>4onv1HUD= z&-3lyyYKM2y_J8&zQ+GA*V`Syx7XY2?e+F|J8yrtvwcqMzrCg7+w0lum-te@)ZcoO zb1g4}^|F4?pK*B8vpTz-nb@rz+rMY~`fM+J{{DULjK<9EneDy(t$r*9VP_lIceeMx zb@pRnVPX3W!1H6j3O^Pru`?D64;IkT-p-wENKH-U_UAJ*GBMEKj|UX{vNr5ILPtjj zx3`^?l+5k7M@L5^Dk_TG2WNZzV`F378I!H^7wpdF!0=-*SREHDZpNi-zn|^dHa9n+ zpY9cv72J6WOG`_5y1R2{LzEb20 zyL;dwjdjJ#8_rHnP^neicoL}?QmGU&sRD8-)k)}1#Zn@LSbQETr4rWGHn6vMfQySW zJlx#4a~6KSzDOsU4h;=)G+<{kLPA2|>go<#cDBOW8o4DE7?`<@n)Y6F-5;65AR@D+h2gWxdm&+7?^#8*swJG_*Ed{;)_t%GKAXp z2{d(2qo#8dL!&dq14~?-nx36cV+G=(t0%I{Ti_Ft4d)9%5TAF4lUp8YhGyY>xd89{ zcWZq1t`l6M+TfAWiI}Qu@F|!=eC-|Nj4UFe_aWl@9;0;VA<8G_kde{>*;lmo%`>QK z8H2X$DvH|%(AYhMk@0aXtt@kL5T9Lwh?E@URyU)n?*=sK4e+?Eg{x%|6sNRMoGHL} zhcfW-|8R!6RD*zmA^7AB<5I>LWL^_UZ+!&K&=S(e7Lj#r8QPAA(A3VMzT-L)LJMhb z{od7C>kpdEdR^zkKB&8(v4_6qW*X#9yMXuZ1tXS);} z``2Iy4dP(@RSJZE3no5JMM-%vva>R1{0L4KuLR~nX`Te}*%X}pIvM8-(qL+=g-DbI zGoy5T|JO_ikEg<3nuhecZWIkoqF`W_+lwomUP9&E8d~Sp(RP0gb#p5yzsd6B4^WoZ z3Lo2ic-quJZcvUhzt=)&6hU$uf*4H>ZV(Sl-MWdS`s)bIXoIa?4kTyOU}=~R@ySG} ze@KOcARR91Z1{VXlP)NMUu+9%My60ZzJQYPhbX)I6wQy;(f@D*T}vBiSy)2zt%t}f zuSH6_7BvlBC@SwlNog;#;@jZkR1NtL`7k+`0PlcgbPo(6p|KAsZNo@z8%12xAg*N8 z!zH2uUbH50#Z5@AYK8TsVjTOT0Q_%qP}e<)qP`gvU%QX1^ULUYxPrdLRn%R-h4kib zbdTPJ@SH7dNH@mBX;4*DgHqDR;W6O|2@N4V(23ma9(eg^k&=~*z?ew*#>UZlr@=od z8yB4NkkQeP*oJoYo7sD4NsY9J(GX(%e@tHuo6zj^Qwu zY0%I#4o77GoGv-SR&4_Z;xz{cTL{gZ5f+h%x%;!521s`{%_D?#W1uU1!rgJk*iE6*5FJ#BOFrR9Opk|Fn}Kv~3PeV!2=%WaTenVncb&^WGP`GN$%m=Z7?yToDAbOS zewPW!w_50b6^XA8XmIwgS}1>@wRb5+KvF&8>IYFaI)&=NNeoTQ;2zmuma`j~xDH2G z;vZQ);zN4jU|9htuY7p<7UHr)J`6u29UauLnfv_NCRaC9qNcG5C6)9&F${8xP?&w4 z2pgj;D9@$9##{p%`*1k>#v(i?2Zu{aG_~{~DXkQRrA_GQ8ANq+J30q@(As$w zgG0l3M7EmCW&iYZew^ieH&~vL{!QPxi^QyI#HLjur=$g$Sv8m-d&_da&-+1J_J8MI zgf6qU@yd+jR?hopKT4N3-J0Jj;c=h*m8IpyZ5Uf?t}7eQv6zbzbJdDfTUa{1>q9X?#&)wNyw?Vi*82VQRgcDEeqzxO=$>&wsm-bO%g^9uhw zzuVR2DgOMQ|2gC2ooD%X?o+;Ozizi!mBm?ugM-`g8N1k-+0n643=a=;=a+YyhOPcj zC}z8H;|3ZVnF~{RYNCw2d{DQY-nse zG}=4_N9N#?brOR7TJY7USKt!Y0l)lPNa=ct%o}T{8hwJ;kOsu37ebSfhx(QdZv3cp zvPU^Bh}Jg3JE#yQXOhY1%R@}#4Ma8FL*9)g6iqClxv2`KFvKzu|g!aX~1QJD)5_bgP_ z)+3r=gy)g}9$Sr=@>Y08lV2q$MsofTYNj8f>&`r)(i#vJo(W%nH=;u{`EThM8oY(} zt3$ANRl?rc7E&XM#Y|Ii?weHdvGNdC*^7<|ivJ(XLz7U6i}ocHOJ+b~8jHxl=IwR7 zH#djdcW$`qq?OPgX9M@`fl0Wmi95kX<88%)kOZneU67#SJz%^M>cls zkz>a`^7FqB;e4;PjcuE{{@flX`^HT3+S;>cBL3s`)W7d{tNYEA7UBc@&4hg81N)UC zrC4}CPr^H)7RuEkp%qVR!aFFpktwC7a=y&WX8%52lVAUe{o8LLRPuQezJ>6!J?26i zE2-RAv4eD{b@ zEVkfFc6|8qq(Ugz@qY5~$sKP721j?i9Xfb$#~XnX$&?}iPoR>kg)c)&?^&co=OxB` zp?JG$&w>5>bTl)P8r$%UOa)T0RQ}nX-Ji%3y3;G zIjb;x|HXE?*G+InVwG?Y&x9|aZ+zXjzy8%L)@OT=pGVuL8^r9xU4{}J*w5#g$%Q7L z?XlpC#7gPEnX4=;Rea^26;c{uuSBTabKo#vZo@mcm-m%Wp%4q@`}gq)DD^aAQ#i)A z;l2OKCx6tv{q}?3^9+PCrO?7iDCd3f-g_VaZYLtUp}_UqYGNdo3d}84Ql*eX`J)%x z>+vj90yCb%Oe!ZD(qbBmltN=3A*&EcC5#+OGm(NP8XTr zBR-)(K!2VpBf(ytfk+|{(olRQPbsnxzN5p1FDGUb3wdUI1y9L07fRS*e4bcjB4k*I zlnS2IO0swF-kqf4roQi4dhFX~97Y_DZc4rpLFS7^rV^4j?(-g=5y_#DnCCr?>6DB? zNwjtCiBy}dl~UOro|VX0Y4+Kkk3P}0-5h{1%fS=J4G$eRG~kwP$I$y#V)l27ZGIz? zDCJVNjtAb~%lq=Uq5g@_PaQP;^2Bk%{s6}-x)t8;AXCX@QiYJ~^1)u7;gLhUlc)4g zo-jDXJMjhYp#FC!4Nn}_*E@OSyO%*w+Q@_ouK$PB|GSeUsn7QO@*q#|=;0IkUm6}c zX7C)8=g?P}3-%Bg!ree9kPDT>qOX}WUL{0_f0y{@|&?bdqe6+P(u{Ryy!9Milya3q$!FEJJF23W4(Z$bX>HISL5{sjVHEL3bk{^)f$A2N7{_ZQN{ z<|2uy?v1T3a}>T|W>BKsol8t*3_2~#NfKqH4ezj2$_Ob^^944%-x5FmZnthC8MzXy zon(qYMT<-wI3MG8+)7BvAn(?fOd{*~hfOgfw`0#2d<&7-W)GVO2TDlX&zC6p z+*)n}Q}9fra&GqDO66i>-nSxSA(NKf1`!H4^vJ>-+VWiva=y#!NX}<^^5eaq=&;i> zRx|lG-l<3oltfrQu^XfBmY1{ZM3uB0795klM{F-r2&Dg_pzf@eUS(#Rp26;dLq4HE ztYRjb6C5Hm*_VSyPZ^MakmY0g+u(%0p~1^kKK<2+91&Xo&=-gF4;?>9%%FGtbKV!H z^vQ-4pt}-=039|GRB%zU$CZW0hFS`hTG7PmYJKj`y2PL2Dx?d&k_?ajGrB5 zpH6A*&~Ao$e>wVQ%8kM;rreH+Bq9ry#SSl8M_mIO3kxBMpJ3A_y~0mvUN^_@1vI?V{KcZ{lJ#^VP^~m@wfYq7#Yu5~;}e z*T0eprKE)a#5*D98MFQ`^inXlS1pv=@QnBhViei7m#@$z4y=T~{uQ6Bl7vtG1p{s* z6pMsv;nr7zEBP1Y|Lf)If8$1y>+b^Qe_$LWk$}<2l6~u4Iq|`g?Z9`~-NVY8TObG) zoMF!l*Bo-fCN-Y?_4nSZZhnkLw(oMuFSnLN_D6Nqt5>g!mz2(Bzfaz@f@jGLR2-5W zFpcSNa`K*AD^bvfnSBCyB;X!oeF-zYM9 zzN{b`7!9M}`fCfyBgvqstlbSTm!F)#q6kd9lcjrGDeO{N5X+$lXjC)c+$YgT z^RBU@42Sxn-QFj=szo_lzDH*hkIJ)mITBxmE(;Tj|@(_-&)j0dNxl)_;X z@F^Nu;O#tFtp$^(;!V3^5sQyB<;cw_VMm!8Sev7yipPiaQSE}(fbC`ySupND|Kqn; zmsc;%Zecor*gtfCn5T=6tGa5-jP7J))~HwK07~%x$0@y&i@&55|1CNG_5cxSOHVj6 zm2^k#Pzf)TtO?m9VMV@{@{k37)c9Wxa0;}urH{eRt$E==NKH=S*qO9T8e0*b*NZf{ z{O;+~;z2saadi1e$2NE#CSa;dn2*|08h{Gc zEN?emj;BJF5xjq+L||Y9q{BN(&ZXT+P02Q4LzJC0PKKL{RBs%b$Nc@zIH7PErd!%i zjTIjI;jx`J)%j3R8SPt#5J;C0h}4FaN}qUZ_up+Ul1J#aZNUQ9FpO&U@p9!AfeMsnLv|FYBcBXPERFV0sphRD&w9bqi zV%4_8x22D4p8j2NZ}8<(8NgD$2^@%GrbYdV$X#Yi6APE~%62>>H?^v}IbQp24%fZX z)3WfJPD&B=5$98aE1JmG=rQCZifiTeI!BF%{X_0Ik&C!~ z4W9d{MM?-fj8Y}8UfrCc0CgxOdoslq4bK-b-d;#ymm!Mq~w{=3SlHx3=8?ljPf#9 z&C`~>o+l#{A!`TLRBLmr8Q~!S`&>Yz`XPXR|0e!ciSCIy#pfbq?og?U^|W=FoVLED z_0D)qy(*{?TCaQZZn7^UB{rr?BM>ax_|~$T_C8fjFv574o6wA-)WYTrsL_63<1CD+ z-c<9K=GTFBaGxrc`cM%R&5Pn<6|hA*}k)OM^eE4u|3|Vb!GbFoAlnz*dbDY|KChBv>kk1&%xiqMteEK zgQL`xLDIbeMv;OrE%!XYgOaholAa~+2KDK<73Sc~s4Ma{mN!agEV*^keYFhC2%-d6 z8OT2!9e><5(k+)an@+qM9;1r0E7lm3If7H|QFCOLCt=Pf$)Kd` zRNYZZJ+NMkf^fe#ymA~zn6)Iu9wa{6cOd<1lktswvr2ruh#i8z>Qd?={2(Wot#a$3 z!xUkf_49BInOt5cf4A$!&}j7;A$!zy^$=pZ%U&~&`iY1#pYJIW7^DO1Jwn!{vGvJ* zF&c!4aOAB_u^mDAyxY#e1*s|QSSBVhj$TiV3kMR`(!q!d9nlcucd8od7Ke654-1p% z$u7lmJ{u?`xGsYyA*pnfHTf`Pqr!+VuV*QT$tNeAT{F7o%v9oj&d64|Lkv^hhoY}f z_sNZ0q}UCBWo)lxY_0+MdBp0nvB)5)8s6mrb=N+_@39jW-f5 z7jp6}tRcm`P5qlBHTZ+>p@zQ)HMtu-oK#z~DrfDP!A<5kg46k)zpXp1Afd{CMqQK4 zM7jtSAquFH6%;1%M3>HGl6U&5$5(y56XO;&A*Gy#TU?uLf*4JP%cd{*>O45!+*~?n zRy5V*B>11D8G98gFcm|(DA(HhSOLcH;*Lf3^@{YzWKg?=2m8>rk(HCvLL8-ofU0{Q zTk1nzg2<7HSxb)hxFZQl{a~1WUd=d|Dyp!}5M4Cn$PK>21;>uSt11)yjD{_X^uEIH zSqzf((<9*m2#X*jb6;HdjGlJqisiZAmy30czx)sXcEl@jiqvr6SZ4XWiFBXD%bwS@ zTEwInQ(L5S!2z#tO#hy?0=tI1|=yF9=T3GqQD-ny`doGKB z;D*^HyumAs+QElG`3Ouh4E5)L%@BNQCjiG#ssS04%zPb{5kyfBsq5d*jt6nJxf3 z%ek?YWL7^Fbni{E=vaEG(h}Us)p?asp%~*;n23f3p3p=`O;k>2>#>U#~L0E!?7^OD~dJOroyp>zNQH!1)S(ZEmQP%ZL6zLGc42F{rfEugh$?Ur~;XM4i zkD}HPhezHimwGtt>!Mj#?P?uvkpl_P&P;`n0eA?boEh1OZ$0J5oGhOu|K#Kzm9lH3 zmCS48$8+q6I!DtW?fC;q&^luh^MTtn_QVrCy}h{|7(UH1LEnSa*(nkO=&|G{EefMd z4`?VMB(`f7`|}@vVzJAfO@|ELAz25ihvuS|%)7H{Fr%iT?SOVzu_;0QLD}g@rS4Wy z(w)DQC68O`T{Ob!?Yjf#JV>1#0SQ%|(ue;-Hku_E)=r#4%`QlyYCP!(g{i)6N$B(& z@(-!TmT_zi46mrmZSvK+32N!GEp#0%PBgk4^8An|?YM(ov{Bds+TGjLIVENM5~PcI z)#PM{yi1M5VDs`^#4N6VYDKkOWC!&!FX7TsP1Y#~7Ksw2SVV0QCR*pq2I#c{gAJvF zLWf&Q0u|9Fr@b;cH4N_eAJDbI-wOXz+_U^2|K_kf9MJFHn z<88psn5r znqyHb$^fOxu_5Zrw7=fH&+VjvbP_lfR>|+aiPSW7Wf?tTS(SYATz@l=x6yb@mddOM zkxwIir0)Xh)V8kAuXde{5eMNKRpEp%+Dq&Qp=>aGo$cf&qY$*QJ-a)6wQP2}fjoF* z%1b*Xdn@2kZxG?ORc^w%y7IW^LfqYVUx~$AP#?Z%)IBe+LHi5yNcmY9kro(Xo194a zvqr)c!!>Yb?L$`+9MclV4vX9;dwrjouBw@QjKT^+5tOx(#+zJTUUf&oBiE-u;qnJo zuibATaeOlLm8p$jZxP*lfbqxBi7^<`YYxe5oQC{8yqc);28Tg+?CetL!}GUU!Kjry9zmg(&jstiT}RuWm;5s@X3Hn95{{nm z=WE*D?lt;6axlqmx0~fn(a)3R_uqc^g41b+7td$wX7l8g27U4TI{Eh&W-DMG>z{rf zy;orfTm0OWM}UvyF_imXuIk&%!K%K!)JBu<)iMuv`EeWSu;DC&Tj${cSVU2A-ILr}V+*0N;B4~YJM|K zo}XV{Tq%cjikYq^)L@2(*`#Lu)Uid)>w64=-OsbT+2bt5u0$weO&{?mf# z&(g(g?k@i6#oIdn4LiN4!&jyk)*y#*p{`0XjLk;m1?kc{5AV#QX-0k0Qs1zJkM1lrqq(uXP&ZHZvr!1@wP0i&Su@mU*{lLC z23q$aBC&09Qv3yVrC2)pDFA>&OTArdR~uKB{mxqahYHg(hP8x{cmEyjRv{IrVyUFAl8ni(pR@Nl_faJYLpnVl5=*Ea_j&Gl?6Z%h2toPSJ!;9?+9m3D z_u$aHkyzi}YhVp%UaD^1HrJ#>*$^Q$QWeNkl*kPJ+@DQs0y}&<&!~~9>}<4dTgccg79M%-UokDp1D z{=px?d;>Ac>DYqEvO%$)DF5j)Jx$9|UX74@pSqO1S$cbmRNU)S z-fJcz+W%Qrp|-*t8G1;M>`fRiS|8>i$M*feqp=%%70iT@?Lb2c`(fphZ4Uf!GS1pr zUqtpzyPra2|5l-q1H)$Q^e3JDjw$iyaU&OWbDxKpY@WY9>up5}%aw;`B(*~ksB)P< zi1`1RXTRlX@;=QuI)6(M2fl#z_s~)o!11oy{L^%%ID1g@RI=_)!a~JiRTC)9g@9QU z1qxcDAN`~`_^Sp_)hn0jDXUmImwrm+7ieEEDn=Ddq4>$Kkf4|myOEV$LTFPuGXZZHn!RK|ejp{5dQF#ME8t zxykwLMaArhI%b&JHHN`SecWMeN98mv(EVZhS&r6R4r^$y(l`gOwZ)uMy&BB>IR0Kc zQA)4!GepPk;ZYVD2@R4wd3=~8iWfDA5(YH`aDu-+PZZ4vd zl2V#_(+TU@+c8{vK=$FSSH~9Hm`=Jo4>NJHKQ|to|cIamlQ;Oy_}1b zxatp!EC&h+8t52nczq4~d{5nRkvEZ1xlvl)=}gK36^kRpAA^%}B~<{ zEi-JqRCDAk6+^>rPW#H7-x9k9M`26D5Kg{vo{u^~!aen{UN&*F`$;r!*ZQqCZA%qx z3#Tnru_*%D;lP2XKm^4wzZ=r}V74%kmHL<4QT7F~;Z|~=jYiwmocw$k1J0-j|GZyL z!fdw^ZIGDqC1jB(MhjOcba6mB1Q}`P5RY0V%PdW1keQ=pi;hpI@1gaz#SIiGPsww2 zC*Wz@qUyDa8T8-wZ_^#vQ=?Iy?p($;lKZP^!uGAcw;}**O=31xcXtFypMQf-Ux7D2 zWa;l0^l)@6FkVU_&JfCX{o^4dPL*k0$|*Hq`Cp7Y%2b@=aac1*&lCen+;T%(2cvH2F^# zh?cJk9IJ?jF+IyNCi9)a95*GLiC ze(M2r>uZF~ekY?`}HXB4$K%<i786u0DJB4Q>}VcH<= zP;#AQ^W(+!mF#V8zY7dFb%02TINQ@_+}|ldiI?SGjybHL5h)vzUglNq*NpL0p)S&J zrdN;I#wMqTNu6gY6rb`cmF>{}RPIz+HsJq$70K(?>e<=ruT4-*$XAQ&ClW<2Qv2fs zq`Pq>&68>M?nKXjNH%{wzv^wNm@(7=)vUtf2)q|FPI>TS3$k9>Ov8k)S|W#^AtLrW zo#P-P@ahfz+Onp{yxlSnmnppum++zRJtB`SLi_s?@xhfteq|@>Eu4eUI6fD ziKLKkASMwZ0hy)f`z0JgMu3ozvtk*?kUU6iIFQ#tXGBa;jwXix<^4k{3lYHf>nLLk zu426qceeCKu}!2WM(+`FDP&Q|p4nzfd!S{`5r~?U^#nWrdz2fQR-T?m(?dcILtZLF zMk&^w2Xf~?u7Ea>fmEMr6FsAyyqA8;=Dq_I@?kPxU&ELy5ZROUG(cjL)nMlfd3+vn zFF(r~L=F)0Xrj#gE9m0V&~tekv|xF!_VQfS1T;ZaJ5kP#RkR-(S&?3LuSy!!W0&5b z@LC$T^j8^?4VchH4slx*6GiUKCQ0o+E_B=|M!`M_nzem-A(NQ;mo9Bb>hLJSz4ejI~@<7c^31E2U zkj$qZVk{@rWTeSaaMijc;`-}wF4kd?seMu=HYIL?;bSuf;uXA%BRHBAckupNA_uyr z(u6%_*0|w9k6bU+Re`(oft7=vLIqURts56ui#|cUETK2yAq_0)*%#Sf)NlOa8cps} zwW%8`Yhki%#b|G$4CFnBl0HN>I{Y{%NqQ$k@BBc1*ZCE*_njD%FAu-l!9U-ByL)WR zXt%4@Nc1|n+MEQ^99}o^YlO%$fM(q4uxHH410n2&i3ZUq^)ieP)Uehm1>xUa4m%xl!91)S<+6-S09j;LTX{x1U+ zBe|l?Kj)SK_JDMfGMkDeCKIi~$aD!O)sUhf4T~6HB!a8gLPBC@p6^$9kf_;5$19tEyWJdE~R;Dza z2F&YBj&&J@NvQzo!hx-8r$#MR#>su(Ad)RA4X9q8GZsfD6MilCrAzs z3#BE4q(2wgiiDVD`NFlE<9p(K-zZ~((-^>P1h%fPIa&*~4rj@CH!pn;#tMN|`DQQC zl;eR)P7rF7_XVwy`)QIXNUh8qxzWJ0w@1Jqn7e_K;MJDsSC)4yE65!&3r}j*b89`0 zEvP1ewPitHeG-w0tcX?|Jzx`Zhwx67R)cAIAzR){v~kM7P&)VwN?IfPw1ATt%VIZU zM1dmI38~HClD8h4;_(Y5nLHRx`p|O&k$OIFaf_qqe4z@uOcLx>3D8lOz7dor?4)&7yYUQ`jmzzLsY3)PaM zqdWq=iHsbf{}?Zl8-e#RQB4}7jRoLYfRrKWemGG&B;V2#?Mx%@#i`@EU(oh?3azYW z4ryq_iKgeqt+&?l`M#4x+q9CQ=A7I1(y=n0rg|>E{v^f{_MKQF52n$R7NCClCek$P zWKmceTMHa7%M|_P=G@m)Eii1jE3V>om$`xa= zoZ-BWlI=vV<7rd#)wLo_Ng%VoIKPhMcb0mU*gu`N_qKG3C*jkzhV(u27%gkL|;=D$-$URx5DkZG4$Czl=W}2R_!Z`@6noM)_ zgW)AQs2niWx=bN(dY>5&T1bnxoRAWeX`cvIxs4xd2DJvo_pYyP$_tHNP?}}wa*>$Y za*%n(Pb1X*2(5BPD6wGom^p_h&&XyTe1VnGL(8GCNmk4nxtBCa_M=>Xj1Xd8w;%leAtHwm-f+kwF6fy6MI|Wed z-m{$7kKtQx(|_*lZ69uTEm%-5JQarxJS}T|W5N~cYwfwxk6c{Ny-9?!IaR1&L8rct z9R2O&_4d0OuTO}jH_rNE^k7N6m=j#uBnDlk4ZwHX$X!@pYn0gfYTm-IISISZo`eSe z`d3**Fur%ho?}wRjx=3bEf*22`Pw>igt7&~rs`oyshq8m9xdrSwFNFTB`@>1l%1l7p43?z3nh z@)QMb$>2czm?%}>9Uiv>O(zp+|IqS>3c(b8pYVJ6x(9Cl#q=Q8qsO)ttE7cJrTET7 ztD}&l5`KTL&Myu4u?UkioXbbkQ>Me|4_dnIdnm8+l3!V6DH(n+i*e>VhfzY^u zG{nBT}4=io=cb}@R}(H)ZuHH;CJ;z(dlxNuT{$v!YU>#-3OD;i+7zIgYq2}z#&hSqYN z7S^mb>-0XJ8T-V(9=g8nXfQOEbV~n|cYfjt0(4!;QBgG6SXI~UxvK`fmO0FJ?S^6dFk@DkB zhe~2TpDFv_=Lvn0EI0Le?@wyrv1{PB+Q8EqH15JYJqs;-=GNHV>mEd7EZ_dTG2ZLA zE*#maQR|c9tOif1cjC`^dDp%CSYLkSGW&WnC05LmYZ9J5d&rKD;vti7f8vnsdLh`c zX|I*wb%|^L^0Xfx9oG7A_$T&Z&-bCbZ0TN4P_&!*PGE-qlc(M9YfWa8MJHw~!)ft~ zb0vHKJxkAT-L8rE$5e}z(!HzV{gQR}O1VhXjh{5U8qj!Q321c>i+FlWeRKr;tKHi7 zJF0u|*t~{Oe#1`-J$z0s#qZLp{;-|js6rPgY<8R)Qcsyh<@lY`D?@{qV&InBSHsDC z8f!=k`i>bQ9{L4!r=95SRG5BgCwvOTys`JNM*Y7Lr50C~j?K#-yoD@~e;-al?vsq|4~QlMep2Syz>(^Sy$f1AhaphB4$N;& z)^NoAm6@`LB?Jd_@QSUkIqiF66@YNV`7JC6>M@}TfI(9Nn=+R|6@mYBrCS`t10#*# zmBkFni&U^))`=lBm~#jaXs#gTxB+oY-pB^!U7>6SumNtbd$1ocRY?S8t)mJfc-2q~ zSLt1zf)KF7VJ5=dRcDbEPB%4vl=Fw`35S_ZKTjG&w&zJBtg;lbkF* z%cQpxt?P)0wj+DD+9eJ1%@e(gm7VGo!Fyjv&{!&l$1Ng>!)4ypF*~x*5Xylw1CHF> zMbY4#mNT%z(m~;p2n8EFnv<&O;;_(1Ys2d8L^GJY$!^LyvI}JbkHQ2R65_Ou*mv2T zrxzl<zr(5OYb)$<>(j*uelyWc(?L;-s~}=@Uq{ zSv){FAzHShkw67yKlzZ3MD$%`<)=}mo0>b$Pq3zb*x9S$d@n$fNPaYs!Xf88SI4E* zhipi=De2r0Spim78*w@R{dZMI3G9J;lk&q*4X7~5&~!WqQC_m8Xtxqy0%1%z9{?Rd zS~#E>KFa|%am7L8Po_G1ROTp~x!OShUf5>Ad@=#g07XE$zsy8zx>^w(g%;vK$9rS! zj}^6gF_TB9W#I}uVMNfJ_^I$9D1>RKsr{jQy4+AGu*yP2#>K)Bu=PZ_ED*(FKQAhf zNLk%vX4GS+xIzT~oRh`S+G-cdH?#^+PmYs}Ib-_{ya?GF%5iFBU5*2Kx2=G}EqEnD zt=hI*Xz3Jdoq3Z4+@=A;ZDk+{ZwH7^=H=sQ@=ETLk$Er({l2B9IvEtOJX$$yn93;~ z#f8V|C%R*_s4`JX^m9r(Pm)_ur_d=zjE&CXz{Mre2(&vbSj?A~h~}z{vlfq}G_!oN znrKOW{tO-RyfEbbsUq#GjfhKeL3EMR=JdkB9eW}HM(b;kV<#q)6Yj9~3s=gON419C zy~CX)X#9x3aN{Fg%1Q`Yl*&shti{j(!^>a<2l+r(p22k~!1?59>%TJ+C(p3R(KQ4ypm#|HQO_@nghtta$aUu#JB zcUd~X0%tIO^X=)o|K7p^@!1~^#6vicr7NJuBgec``64E6D_c0tmAGYXNIX?`hXEyB zRX&DY5asdosO`XU<^$=tgZHZjHgJdJq~d#AX>o!^MQ{E+8+fQIepcZ+H1rFQ+ECe% z!-uT4oT8V9#}VaJ{n+=%N3t2rlrG+2Wr{M2WpxvEof>7{7uTzYK+{-w2S}^ zawjsv4T?edW-HN{dVo^wx@4o!%h0!4pP2r6H>aI(m$_yE*P=)B*AModMYjU0X)}B8 zCnWF5>dRI0R@ZCQ4nsQldd+nrNz3a)zYVT@A8LjA39UtsKl+r1Y za8;a);PC17!bC`-FS8~P)|BA*KH||B?;14Y9`J zTA$O=oU>y`>7c2i1~BT(!?dWM0mp5*4)l#^Q6FEdws6cde3z?+5+0_;wH1JZh~v;j zon%r&v&g2eg-(#aLo0~pdzYc?uq!c6eHV4gNOPpEX_;aXaP8H+j7pi}@){kIl@>L= z3Z72o95$46>vIk|prk(CiB3~BF|a5O17C^n=D|u-dX~0;!SeXusl~nQ(K2D7#Fdth z7-plXqJ~O$#`@%B-|Mdnfh7%hRii7^dp2cfG8tIX|ClLJv<6f(_`dg#oP$gPAbDtW)ik53)fTa*+{{T@ul=TP^Dvc&oud8-iicYw-(%hp^ELjW%WFG_p-FOCY@%9*9aU20_fyYCZP8Fj2!jfk)8!ZR@ zbp^hn8)$C>SdK+^3--v^WZ~_h@;gUnap-M)Xm!K`R0BQ|KWcU(1yPtxUu;9`Uf?O; zh!RhXZEzM4kvlY4|6pQiII~i7y=ZmWnlz6M+1D+VCK5mutC4DX6~JTT-{fGIBXLS5hX-DSJ-nQ z?Ux_Qw0v-)JCs*mN<4S*diOazjorO&lp>FBjMg@IA)>T z1`C}?(px3}pBZ@yN|YBFsnh7=EHfp4qXSb$^d!!pQR=N|5cW9;`0I!WFXtyvQdK#b z@~KODgH;S}0Ru{VvqX8?(0A`$j>rqyj79%S$Ubn+Y+o%m^vCR{CeOh@7FJp2)-jqO9>lw`#8w}lA#)jP0? z$i3TLx2Z{$d)R62YGb!Tvbv7!=pnMEWoSvh+db;Ylc*TFg?6i?HM41Ro#n;0C@on< zFjDv1{g`%0zACit4-o@PBX+|lY=K$k-)g^;b7kqj|-T zByHt~gG14H@oDeKGQsiXpu21C51e&QY(__T5cPbNK8BBwxx?LcinvCG>2m^;D+sf1 zL?OsVX|_}5(`-DDnKx+lhx5y`i`R7wojV;G)_?_EJYO^+)V}rr9+Yf;=$)Ps-=JFG zWeGV9nUS1fBshm#7$Gp{w4X!y-Jevl2Fe*ZfP1gDj}JRt_pi>ic4b@orc>Q4JyYL} zt)wRg{{+cuIy5eQ;T2AZ%Q7pnY-Ai^o@X#wPBR!$m}-tyR&2{YWIf5cuH)5O2PggP z*pnQX)Ovv>;y%lvV)$~`#oece-w6y&M=;sGG_lO0m8BzKL`660{nC4%Y`*JNG>Crb zSpw91F31?v9YdS{(N6wXI(yej{?<+|^K4rF{-8Nj2xDh5(l~rgV~XJUnymqoV-Zp; z<^|i*r#PjSwsa?fSXorUG$c7rB?ER^4kkTMf}6?Kx-}^?hrGqN!MMm4rebE8Mk*}p zv<4PRF=t?Tp`auXZgBvM*}3j*coy_9WK8;$EN*N6zxXwZi=#P#U*RrC=1 z@nz{$AjS1Mt;Uwt|CC+Ix=gudyBYK5yg<6x$Vky(cZFB_%xJb(i%ZpPYHLrcIVvF9 zpj$)pvH32M&w%=BAX2%_`dRy{GryuF8dBLJ(tshe04-F@0td<<8dV|z%A?n;s7?O$(fKg~ zIyGawsnRZnrO!pU0tBCI7Cw zTr4t}`ka{;wVZc#JZS=>0bO+Z;3LP0`*|^++>?GS^pz1(O+V>k>xpa0j89c~8_;G+c^6_0FdinPo+JIl_i?Q?U*FEGxw(s&= zg*%n*HN*XvZ_eL-{BV}+idwBHhV|tarKQ)8j+sBET>9Mt)t8)#@&fcmnkfG(@jq?% z4tvDktdC1DSLNg9p1G=bWfRa!9EJFT<8h(~atQbU0#Fnc!-tzvG=y4bl*z}+-LSGt z7CkVFD7~tvkgs*QCcfbdFLOErA}_Ot`^7GM_hVM51y2l!52X9EE$psliRs*d1zgsV z-@Nk6tI5sRWl=9_Ho|p4s{n(PRuBe9|e zzDcZF4MWCPs`h|UMC9Bl4Lvk1W{pT3;!nZxZpdnLlg|xs>xRKjXLKiGd5PuA5S}JF z>nxh(wS?H>bLH9bPF>YT{CAVd`#wAGeeJ11kQs6^A zqU%Jej+Hu97s2POGWMtC^fpU+ocO>a>F1@tCPfw(i@jm#$cEA>Hn=(;paK}Vg{llc z)RWZI9xUGjx+vLcJXzifwNcT$S(B&OpAzibFjGrjN&iLo`jb4vjV?)S&kqgVA<>q6Mw>2b~RlprZQ9)3s`1E_7^ljXceQK8Lx0aRKWR z(q>1lBn`qpl<- zV2sDA#oQOJl7z;ZbRRzuBBgM&gP^zu+7EhN7WLCmir4OKh8ow`toipWM^d1mL)gQ1 z1RWf<`|MN*ehm3^b+RLYewPJe@2 zp)5gcA2ZJpmZf8eIieH>(W91~@3VMEBnG1phl?j;x0pN~Oy>9tP*|BV>0$z){VT>X z9SoGJ)Thma!i945$J|QkdjSIx@pIoJ5R4oGM5!!gH{-l$+ET zf+BLe8>f@rlveVl@6xqkSsRcC76Onjyxpnw0rFQRo2mj~FRMOJ#1=ew#?D_nh{cMH z_je{+)n2EMRm;eeP+7K0unsb<;A#tw)%A)%y ziql9(Hy>=XoOwcDYHP`eY4jH=-NVEzMo-aVF{Ow^%Ga)kjI_h>Wsm4r?S$Z8E$kjTV(-}Lqtpd=;oyr7on})#9mFUexb_ecZstjpzc^W~hG`dqHz3cx<$J3MR z9Tz0r$AQ}u zqS%Uh5S>$BbWyAZX*w+CD`sPXsbpmwh0vKisWJK);jK!*v@ddeocB*+4nIhpKFHpS zY^FIq#Y12Ta;*PVpeidAfUhZN=p8**V6IN1bHym(pe>sFqC@h$LKPhL!k<#x{B?j!g@;QT<5^c_lYBC+NG?f+*b3+Vv z;)T#dtt>q<|I(aInw1kskAklwBfnol)%=DvWgr?RtjLkgFn%gW63=!58GIKd2xQe1 z;Yzr-p}qidVG%L3zu6Ems79KY<`dYcE@`yeYn-Z8xfl|MbyH4&11_;GjfqW=ae$nh z>Z$gXJgCz(S9IM8&AXb8=%g=)_7nlx;_my6eY%(BP{F#Sr}^b|@74RWq}xs|q)X%Z zII_*uaeUQ6@DC$}3|A=S41W>5@ja+VFm>)p zbd|f#zO-tb;WaNUhQ93bL9Gp!@?KzNWk0_QgEK(Ppn-Omeijd_f4%C<35{eCG}#@& z_&j5_;HulYqC#Y!R{wtP4Y}3V>>t!32)>_<%l^W;E2|!Y(`ogu2coZtGKT(a{-x9I z9Br+>cJC-*zJ*?VfMev5s}DL$8~^f(S!=JLON*FUeZL%sc*7szXD#`C-tp+ z1l>n=<`X-&VrJqMc1>kR3eDiHk>qe~aMzSrse_(wY~R;Sg|cv{DgMQT2*>h>dz zJgm*{{{h*2Nc|!y0DwbF&0T9#8_AOWP6Ypc)a)1 zMk6(#i%@ITk}>n^H_yq;s_I4IAs;cXem5-Ar@7DwAVV}e|yMG;Ck1voaD1Y8Qa{9Noj(>FapMT%v*WTuPX8-wLGy7XxyWcnc&+4b@ zz6D_EbWvF^m>;P*Qr|f0vfsZk;}5^Y*3S36#dhQQC*NA6=es`>$JJQwgD55hY0qS% zBHdm7DW(YA{|d#r6WKP*joG1+s5I*-+dDuT)Gc>*RZwRL|I8UXxhcH-Om2BZ@Pa7{ zF|t`~jC%zuWbSNr2{J`9*<^gqBo{4CcTX)e(aicg!eUYqb@pYC*W(NyYi=Fk-Fqp`kmGi50UjY6SMV_W%x|-&0 z)%iju0LU8P*2KfLBHiZq_iPCK;&JOs>#d*%7G8PIS=Zd;vF4Av8F|b}1CA0IY0Wkx zAyW^`K%;+P11SB<}dM+YZfK92Evgo`JWVzS4v`r2FVTpw=Y zptA$bctEw3rd+#+cVAPrQhJb3+{~P(zYqFd(7Aika=~nlgbn58%aCuDly3qBe3yaD zY~$%O3W|1(pd|dr10~HYNfEU|a+3{-y*dsg1($h4yNmmnEdQ?3gy@xObPHK~F7=inFj+-Q{#5gT( z;9zFudRtzK-au|&tK$bJpGKf}x=%8i{W2Osm71KY|a^Dck>j zcgtLnA;~cjQF=w=vfbM1GI)BjUj+gw>K01k?|GGsp)ohVC=^_5Bml;p6;d`6{(v(r zx1e6+xW=If5a+j-{kELLJ9QmOVx*PL9Y|mz1d5MrXSmMyJh)PqRpu0o7;9zHQG9Wz z*5ocFb!bnDua*p~a7}b^0rlH!L8zxP-jl{RO&%;6d1W!P^a9Y@QhJi?DAP~g%RWH< zNY@iGw=J0Ci{0s)Y-#CDvfFmIccP2T;t_Mgy^tkIZ@-?7V#KOWw(ohZL{_rOs+!dc zr7=Ru+mJQJ$x?|dB0aCpWx!CrjRNPFZM58}`*QbhoHblbf3LE`F5(&@NkMTlt%;~! zE87?pMfQ4*n_@7$oEBr^W>+SLAaGpF$o(EFPK+U(dCOXo33@NzF?+22u%uiB z3g(o?Wl<)MQVkEJ0aha7FG8BRdTr~4c`H+CuTp5i&_cz~y{EBUp(U_!>E5ayNd=WWVIuk#{dYOh$75qa)x&K@Q z4;De1`GDv{*1tyC#r$p(O=w;t<63Cpf`Bb!%`*>fQuFCXaaxz-voU#~ELNoeqOyt< zZn7pT;~?huzs}{FSumfZqx5KiJIp-7_ox|RBFPGygcnvyBh2!?JyG-2K}G%= zNWd;E(-$}s$Wqq|Er_2?y%}P#zo>N4M8PMJ$Kl;JTqy?!W{Dg>kF|=~HGwCdaa}YJ zf??KmR$uDSq(XraS23ss)}w6|!dASZ$lli?0P-a(I%s?S(e)Vlt#*p8fdW9l2?+8P z$NlVU-W!!eX2ZrruFZquJQw9f>1M5Gq+=(!Ue@2f?qJO)yYXTY7K^S+ZY!7+a=S%0 z$c^ZaFkw9&(lnR!%pA-Gp?4JcN%X%Oma|C8L&@~;$vj>TFC!YaZkKl~PtvyqokN$*nWWV>`M`Fs?y>Mf9vQu0MyKGIL9L&o6w3!zgb#~9u%;`5T{N!> z=cdX&VG;46(RlOeaDea#!~GlI$sh3iSwh{9zo@1>6nS2m@C4Lu<2n90Eam0@(K?$f zixzZ#`7USqn6+Km*O*R2-Y7?bdrl?fIP5MpQY(a?M|#ka)4`vFJk1W!>``Wuu#^`CiRN@9 za&8CUqYKGFnj!&KySv1xgsAa=!v{4=4_HdFM|}h=d&YMu_b+{b+DAgH7|Bjqp0Ol- zC0v`tXa2gr_8+>x)$i&oq`4mno{ltyP>%~@h>OapzgqIMPOCYH*gITz@{wjwu*d@J zB2gOVw{0_w@je9r@n&h9aV(F@Y7RV4(M_iq7#P*`j=)l;eB*N5Sh>-@H-AG9m|PgR^GsJV%Zb$_MN;rX=hA}@93hH6Q_lQ zKgbFD^RIM* zwrrV}ir?#~I%d^_hcK@B`D1fPXBRVBb4`qR+S`^x{pN&)$z*7!7}VoZAy#gW=%?h3 zv!W)O^q$sa+cg7~In7o?oSK85?V@{)OUt%HP!5xeF;t@Kudm@%uqri8d{V;YFOSj> zM>ffc?O6vAk9>Q0{KS~XaX_p+D;;Ya-D}ud!C9y86vYDV(E1v?b0AML^c-?-T#b3w zO3z=f^`KliIyWh%8RyN6#7?ZSEymFme7enQIVZ&| zvur$Jh#H2v?<5GEJ1G?ZFcf8;VzjX+Xaa0f6%>M7qFRx!;9eUHGcK8E%cAC;Cs_l{ z*9>4y_&2HKfCqA1S=g5^L|eB~CRHBta^9G#lo|q+50YwvGNx5l$3;HBm5oqML|va2 zi_NR$HSC4|mR4~;8Vd-LhrjDLTH*#iFk3z?+Ztf1X@=a2B?sbIXF(BvB3&ls(Cu$& z>xOY=dxo1C;0U1v@BL3+sSvX%u4zku7!jmreU|l>j zL}5Ij$N&nP6Ou`PMdD!8RH5(C6l}!9;JGh{rI#H=XV9y8DTG4iP+*zWO~2x;y{ijb zK1(VM)wx~TcJ43s!}O2lO{XS3vml(u!YR0+A@d@A?h5^zIUMKLw{kxqV?va!C5w#GYdFOT8fpQ8w>gZh zjU;!;Jd5K+C!$3(+3MfgEB5&P^P_4vCuxEd&rQ2bL1;ck;ArX2&5)~%30U;XOan+UyX#L6YKysfhE)7 zmR6$22HA1d5Q_pA;z4Sh?9&yHZM-|!Z+Ajgd|@7aW_Lv@cpbwAK6Kv_cS`MRi&ctw z3+i&a4r}8H8lzkeFr%+E<1{Sb4G?WN3KTHkTV~Yhg6L0MVWL~MB@#*`{iwAp4NFLX8F!QR9oX>x8! z4LRZK4jk-H+R1ihy`cKR)uxag)>bKUIv!pX3j~6vjG+1hr*8&r!ykdj1FCdU;a$en zrRMO|1W3Ydawgl990k)FEs%<{u*;IK;K?-^SNu|6>Y3k3S%ti6SbEyRtH=En z4EM0%l&qa}0?KryL=Uywd#nm<8Ay!2W8qY%zRBt`M05eM_R+Jvj^+h=3M!`9d0#Yh zb@h_+lEJ*+2Bw~HsCCD7vU_H-(_m{_F>5s?<#hD`>MLiw*pnIuUYd&8^gG%dc%u14 zi&FI$4tIhr)Jf0kkUSmW@Ld#j+7{oOb1k$i*F@2~=yhZ(7LzF^;Y)Z&3*hQdLBVbrdzwcpI;eGbo+JHhyLfux;bu@Ylhqswk^$^VBn{9`xuEyAIQ zQ9Pa;Jiskq#-gbyw%w9SuMuQ~i^fz>AnlOHsulWx ztxbxdxh0*x?ounwiMFOxGV5!BGgDJdV*Al9?W^H1cQf@#F9~60X=FfM9PtC{N$5`&&_?3u~+;U-OAd^=o9&rqVVZi>=<~-DG=#sf_sLZWm5v&4a1;O&4u}E^iJli6EvPt zwg$fr49+~AMvGq}t}(r+qB;Q9MYd)c4@RAe-f-Q4i>q#{~h244CLeB+r%Ae@@ zF$=FIVXe?qeSG&JKV;z!gNf^B+e(L2RXH3}%E_C^gQ8uGtju6~O+j)`DGk1iM@ztM zdDblNsFRSKFzn0Ekd>+dXm*%FIHV)#8Tqy0Ba`&>*+OW~(+_L1C-%xf>H7AV^-stMnfm1K3!jnM7^ud3>vlq z@-nu|eCBpc3Z!1?q<;E;=A^biFz#>qsh|Fmy*WM1_HR)bhd0WbNqHtK@OxPRh5(96AY${unXJO%l9WrXu*XW%-fUQ}O3 zEgVedQuB#Fb^a@y6sz%B`;p>27;`y8>RK`1bG?HCLlve(XR1%Grd!L+*0sRQ9J5TU zaP1U@0EzZTw})rVSigQ-YvMRR@*1d3=VRcK2VM(Cj_!8;<*q6?p_sFsgn`o+H>1UR z(ksThrE^+L_~F%^yAm*lc$l15tAP@7hw5d3q&P9MM)8@|xENk`RvbmjZH6!u`Qb{V zzbec^ma1kRQB$aEeOXn5LjetEI1t&{TtL+(;hkw^FIu~Hc$_;lO`@@dp6Q#3MHSLa37cq*blq5S3+Y_l{F;5(e&Zi$>m1C{2l2U+F zfm`!T>saMle?97bRpX8O##o93$C^(CDwdkEjrrhZV~$=rwvm!ASK>vnDa%etrJ)-< zSAlVW?5DY25dMYx2I(1(0H6@fu!!m0pEnFTiFA{!PyH4nQ04%&q8^yx&x)Eb$D9Id z^XXk8{5tGX@fr3bdNV+I8wg@TMaAUT`+cKp3AN22*5*0DtX-My8;G~@dFm#_`h{{W zN~oVse^5_sG?26C<>(xyP$#B7Bu%P2vJA-xT9x@y!w>~5u>Jn83?Kwf`7>%;qa@lKTnm$GMz<$4q2qOpSMA{v5 zcRKBadM{^7OC0oMP`sryBobLYPg=#oNN79R>(?JT?hHA>(FW<9*ma)m`2pdvm5G~Y z(|V4!s4Jpg!<6Qj`xo`%nB|htBYh#759y{TdxkMr}3w&9+%B^vncH8 zQ~se32cHz)iaCosHJy5K*Q6!rQqTyjEfHR0)J7l(88;KXrJ1M;>RP=vA61AWIY5t{b3n#}n#AQ>^xg#U zd`oQpVE`NM&j;g(V4^|i1}C%~Jz=4l6L41zGp zfU6!GELG_A^7`5XreZ1&6R3L-= zCO5|nOJC)&fC6=LvOAcOz>P#g3`W?wE0{gTS&6yKesMIglX?jtECkskHi<$Xptenl z(M93#Y{$wOSpc8aNxp4FNu2P6{;)B)+e1ko9IV#mc+r(N>CTtaRs%lYVC^G_XG#*P zxQ^dte+BBlj26z&@1dZ(YQe|#wFH22G(De-?3phW#lLa#?#NNwg%Q7jQP>yL4WACf zQFW+$a^zh#GCX`lyDOIPpv0ru2bOmmDBr-w!3Vj~z`sNG!I8V~bG;W+05^gcXSo3m z41s141fKwD%!B$ia>GYdfpxIPxW^iC5WZ8Zqaz={+LYx8+=IFp-foiHuB8^V}-G7T+}OkzUzOb{Ic8K#YkqY~`sp4iApnom#!obLipn zhRKe|Y8!$EW~oH9HMKnH8=sN_WIFQ53M9SOk58hNeZLY~7aDqyd1ytnmlBjJ*KU5J z7i{z}p_C5ME*E7!NmR^Os$x%XiPj1V$DfOMTtV`?5bb-C`IqYeTtKIYk7rjy$59IdmQ^rM3)?!QIl=i z?1gmS-qA$wBVI}4BTrgxCTKvU&H;XJd}Ox;kMrX4AFUT#f2+kxLZsx0Xz*(ADd?~t zHVI!~UYfDvppw{DQTSb`Y z?4ID98_Jy?L1k$%8;&_#x2MnzmZGa16thK7R3M*4zY=-fQ=d>8N>N`$1{Cuy%algr zKr2whevm{Z zIvlhgGcoUB^B_BUswk4&=pq@wfWA?qS2I!U7VO~N(aC@G_ut(uW}a*a#-o(||8Pof zcusX+Em-9u-*|u6|E;Z6e90(Ca+6+$kI4mz0|I9j#f7WgdJ3IbjQs$VZ<)|u!&+^X zSi~@t?G2>FBjs_P6c-9FrD~~>!82HeVpS&tXDn$ zjIjM3r!A>O7_zIoR!dL$c%9LY?`~Do)Iu|%de4nPz2w0g1Io8Q;-D=y_$G+zpA%Bw z;`}|&|7Y`Acc=Tzrx~G;KmW|L4f4>#_%-;m3y50G_U|9rKuYqAVQ68wbY&%J!O4)RkRT41;R) zb5kms=Q*V(X09jq&K#_Qo9v=%f7+}bokU&W#M7rXj!xvs@7bvte-RU~s^wU5H4Lv? zZ9>vy&W!JA1xbL#Ypcv104E|hZV@f$qh@*CNNDz@lrjq7bE{H)bYmVv4zR)0bC0Z9 zod~w`bbC7{g5fU;8dEuAp9z>&u^5`y_~>4?YQ1c+mtQa!kzXOrBu@dU-_y%Zt(P74 zvc4wWG!nqy7W6-C^xw8SsmsQTPars?iyzFKz4f*J+h|Kg7@Cm^8_gh>j96DWP)Jg4 zYzN{IWI%WXbmSparg031kfBQBUjE?klCzL;~sr=|*c552J?)E+M zaJBr~5E0pCtk%r8M1$3x(wHXcrTQMVXm`iv3jarA{665&y$w7G4b<-4V0WHemJ6iR zsdI*jGu_6~585F1dR-PJnKG)Vz!p|Q7Ohv;RNzI1J4pH&bm1@0+R8}G&^0_4XGQe- z2A$vO3F6N?^8a6+av&CBVqKP$QCs0~I<6Izr)CvI($i zicX`6EAw?Wm%C_lT;*5Sv(~F1<)Xtd3Jxwb#NTmThs1`U0NT`(@@QM4_N!1zo`}j? zER@R}fu46`=zxlt2-Gq}(I#G5O{L0d>bG8f+eaEUc%4$>C-1tBvDp6D?S@}Z71=`4 zmFV0_s+sT1ehS_2Wb3?wnD$v9u;&X3Q-DiPb!oSW~Ese$Dg+EGwTw6a3? zZ84e11pcfu2yZbP4SQFM%U)G%%0Jz!`PpU!S3KVFpgukduR4L_9nK?l$R(S%N&6Bw zTCi1&VFy^1s$9+!jnI&UBaPwK7zi5;x<{{<5a3YSS*gMr3wD>32%0UC4=?uu|6n6N zRNYIJmFP7sx7el zeI$G`C=O$cBz5MJP;D)oBHla4W0Vmr&sq8s7)WsCit>krOKEDHs8wlz5NXs@6uBwp zw@KmFDm*E3_gRiUI8=7Fwzj;e9Ki?({Uzjc3#Qm3pO#eBGKpbWD}3-a#NM?(!%Jdh z#b)wq_Vw3lI3E4u{BrN`L-*5Q@7?RSA3vXdlrs_FIZ2f3AS7&?0w7abK z{&Q#h`PR!9tyizf8Sydk359q4g#F&|VuWj{F=HHG>n|DDldWgZUbbGPt;aF#X3CqF z{Wi%jbOVB&@8c{6(E5Y_{{8Sjjn_;6|Je4XjS^q|B_owde3?MQ8kLAvOc9dczFXmt zTca3t-y*VQFVb9S%+ik-zLgBHL@%zd5!`tvm}22a4=E8$T%NP8&EB}*geKreZynOK^%Jg>42ehp|pr5_~i?bf0 zK3b&?`^za3H>>l?yar*B55`2!nmMv@e6as`?a%9Pi>9`+a#PjIm&2=xOiC}8x&3qV zZ_f{B7t6)g);3~;Cr}!)H_L@cKg*(!Q-)LoTwvw2=mLeqV5_@XU`qlse@3&(YU+LG zd>tQ&1^-dg5QEkj!-&Tp2ak&*9{62PhD5Q-aq%g*@#OH>%K!c^yzyi<`6&Q^LrcwF z>vkK-aX$IWbNCKpM(YK%Ac(;oprwSQNQn|D(IVH@#&+TXF(hY+n=rtFTqk+9JV%}* zfATL?UsYdb0E(d2PO?7UC4iZ}RCia`^(zR(^l@8)b(c*+^cV)@-RHkt{JEZJy2pd1 zJ=Pb30N``K9MmJBWU*qAX`O*c>jok?7-!#)a>+Pv&Tf)HGTGetr-XxPxCpGkbXUvG z@}0;7D2uyVv|dj8Cw=qy)uFs#IFFOsv;^0yh8h=5MRo)*>Eqv~ve}3j^LTfu&RRyH z{0f&u*y(tt0sf??ooC&kIXhRG#dzJ~-)dV$m5(xl^3JRCb3+~^L#&{Whcvzm@|1#u zz4HsC)74mn@~Gv9PwZN9F%Hw4y=AHetB6LE`9O*d4f+?T8ug4(s$Oxb25^S_{N1c| zRk@t29ioISt3BZXb)KJEvwq1}sq*IB9gc1oVw}jzeHVx+ti@)|jAd{WJsc7Y?6%-m!?4cM&JeX2JutXKU5MxVq!b;h>a9v;W^|<7P*OlO9QDDkro1g#H z)2(MZuKOMTu9SmjG&KLHkr3);Px)9`3*ggEmez1|=@@=!#M!~cns>Qhe86ddG}PZE zX(ZmwmB}CZYR2WW<}z4P*!((A8LCKp7HF_D|{LfjS33I7Eo2BJs$AonKs-VQ+4D z6!NyT33;3&)$u-SP0tQs#Wv1hIdC$dY)cqZuu~4|xt*jt&1_6x+R9cEbugrPdl?sG zCmM1z2N6+_O1OIV;e{<1;`Sg4hSG`2cwzn);Wdj{nhUPc{qp91B2ja)N3Up^otgZ6 zo8gq#->V~s6~eRQmp#S6?lBu~$`!_KY>M4tTArF!iQkiQXVwjtA!img2`3-**jtN% zQy-9BoUK}WCa^YPKVC2RuHMn&q4mUxSdAkH~)MLp!IQnkS`8ptlF3CPN4 zk$afieY~3|i*i#q609I7?Y(In-Ab;*m<7?RnO$n; z3XFO^hlb{KeqzYiP*bP{xcc}uJ~?Ma@Jl)+Phf>kNhiVADO-Ov_b?={j7{0%mT6;o9$%qtagy?6?O5#+c{S_3#YJ0nvz*1bqZp(kgw_Bmn0Z7)tC6F=Zd zWABdFm&M*?EgE|1L#UM->G&+?4J|pXU@*9Mu_`4KQefj0_I^%&7L^O?9npk`7I36H z{G^=vtwB{$4*D)1CgH0TB9{TI7>rOM%$9-6mhk^gx_tzoUBxCDqwH8b-L|!yqBOCI z_X#A(G28SLL-Xul=$Kt1&O6D6373(p5J#ldVB%gJB>M2koTIT8C|)(4TYe>2f_Hpr_Fxae`ZM5M8-$t7o@SKM z!V^TqYTXZXrB9~nvM1Xj1e-B%&QHq0p%x_cg#W?=-Z(ZDvMIR0_FiVC8B<13@Kp>I za@ay$SYfI!K4Ow3iv6!&pARhbtu&6|+6&5Phd@5}zz)sXlA8e;UK!*9^ZSFW zqMR*vGK?lfONQ?*nh+Adl#ZbVGh46OY^INCw8<$enLt zXb)p(Fz1+0C1t}QQa&YGF%#jc<$!{MkF>ZV94;+BJu1?V#->lp{hSH1Xtpwq4@#8= zM<$>wmrc5a3Yr0iwzY9I6pq~`hk?zkwbzy?v3gZ(*+ zm#)Jp5NbwaMLsl8>vRq#Gr10L6rM|UD%xGd9GP3*%_NGH+mLu9e$mzV5}^}uKj~Ov z!{GAh-kZ)f4VN~79sRI1&u zQt3)9=~GfFuZj70VG7uh7yKqjvcBt{eBMi1r~Uiuoi~@ir50*vVUK=d5n>SE>+5*f zf18V|caLu0ewt4{-XDGbp`Oy)A>Mw?`55n{@VdT^r~TJw<9@#z_g{bh?e}}p>z`WJ zO?tgauZP_W`iY(6v-H;Vj;H%)czleKz z5&|T8zZ@OBe0lD^YDw;%ybO0wC;i>i$$j^=B(5rnm7vSJ ze(&|s;#v6YtUlkF-<-UAHmH{0oYflB!Mxe{{ov~0=g-|Rtk*k4?+*XdZFRd{OXb@i z-$d`fsWqbZ-RWsN+Ns>04#I!9TFg%NPRsA0RNpSjt6Km)!)M{Ucf+fT`%2XM`&#+r zq!YE@w8FvdVzg7fc~h-Mt6v6XJJFAW+tKal-P<=m-i+q0YNvfa8SNdveRuNg?M?Y+ zbi4Xx(74rUpM7}Ssm!BZvwZvPc5wFjboNa&I2}x;zyCaMKEtp()%?p?kG;k4^CX=o z&s*)*HxUUD(dp#3<4UXCUimVyz-ep&XIM^il?)o);9L;@W33gF08sjF z=Oh`;?;N^`#46jRt%%Y7txDyG7J2 znrX=|%*8HSVu}Muj8s_L?%mITG{TkXA&E+A2g3MR$|g|=xBfJ?VeV21JBUhl~mbp!IDoU%p3I?_A;Ehfdqc{3QY;K9?w*zXAm$~4_$^zP zqnk(Dxyf9?P_MD$%ZYtb3>}!B8GfYTzcQ%2*y#$?*ms!4A&+$houyVXtL1%D9(wEf z77M0ZcUz8IKzuMkv1}Fxi^`KT$B0aKGEk{x$v|0NN7l_ivextq9qOOJ_EmHGb;;;ne#kM3x zIfZq4fTX9d>VE#GY(oLaV}7Nk;{qE;=?E4#H(ab6YDwRlLkTjEdnuc^WJxvEWyJ7I zPK6$Fh%(cbtJDZ?pDPs%d>)A=6%!1tMl#3%Hs-=jiUxvA_n44eK;&pK=}Mh$y>#aV zYm>Y8gemo6k5i-KmN!u%#tl8+k1vxUm;PAUOS95yg}rLE->O~K>b-tFs&+`g>0GvZ zmCjYz*4`iIOxX(+@T|l!`x)Jg>EOUtgbA@@fkv1zwhx#v+pnaODRcBFO$6-P;J}tS z_{Q!*1+**y?5{sϓq_4XoaWM>8uv7>{ROI1-Qpr9_X?=d5N4aV23W_sQV52-)O zf}^@JlZq(}Xga}H_sWrT{ZXKq$82g#Qrflv&6-bBsoZ5ibTiB+g1f?7RN*2KuCjj2 z%t}jZ(cEJOcx0}POBU>fFEq^_Dp5NQMc4p318;QB;1g`9B?+RJ9l-eN$}lQxGeDgf zK#lUx+i?2`GDJ`?4pm(KTAh)V4f!1>OpEz(R4%?`XC5HY1u9j9IGMfkhvV9Fd|igZ zC688RH}hhlb~W4JRT?4kUL}H2%mt3D3uiK)4#qH1W$tHzfE7DILQUu<@CS|5C4qit z>-gl}9zee_w`@!@ngn0@(?FbSjIKf4!qqk9`JkSIW?VB#*yu7H8P=z+Thsm;5`&;D zs@HDW0WE13!rT3&$L<}D`@FLwlfR)1&Zcp=dgqcjImPy30}P7PTL*Y%PicjEDO*59 z7@HI6Ev>5#21l=RM*t`2hB1lQzx{@~rJ>!%59T5j4&Ll36a**k@%awqcuxdAO8n>~ z8oP^bEio*e1H9Z-VfHS{hwk)9Lx=cEgp4*8DMtbWAZyE&bUw98u|%e)ICc=VxlG9zKg`EOD9 z#NNNmTkaRp{jc-))+OTbg99Tj#B8DYaui0)Yo9)qe)eH=Pyz)OVQj4jV7@ky4H(%VLg*R zQ8LMHV~xO1%>KR8_KYg1YErJ1l09|E`t_S|`Xp3sY2|^jaBXke*&~OCeZ^&ze~zc) zZ3gegnUe~+h4XRAa#Iy44I7hjaE%B{_k~HhT|Yg8pyP=o5A?e6~!zz2bf+YrkTq5Wi*<3TJnTBB6?dmwL5(G zYI6yyb@|D(VT-hooZxQDnJIs1PN^j`VDOb=d-tK~TPuH|hGaD52xePAicKWOuwY`r zMyM!b5#O<8Q;~umXG|Ab8PY335g}p`jk)N`d|dBwvh86{N_? zBbQSV=(LOv!p+$01srL*vRkfSDPQ8<^gqo9JP#A584KPCTjETebJ&gMNSbxWe>PeZ{;mpQ9QkkZB-gO7+Rx+iQ}@p zEn*Z@G9Ael(sV2?njBGIQjEltc33Kmy~;$Uhu)OycVsOZ^sIrHh^0i6E{+xNHaA$$ zp7*HbfmVl}au%N)3O5{6^+?yKKjuAzLQpac2v*F0b+P2;!DY@eyeJhSi?h8|YvZ}1 z8+1F)xMZ9n#|zr7KIrciWUlcIG3KeHslNn|9;O4Wf2u(QEE+>gF*-eCkLToo8+b@G zWx`!(STK*!1=Q4L&6ESLJ-U#(L7T0uS4Xj%cW{0Y9=wwCQu2qsd3X?C%}5a5>$-4? zmn(UAyYs4E-K*CR>6)ll_UNBiwf%anvEQJN^}|CQQa{UaKEis0WoJ$y7wyu?2fG&vDfJ-rE7ioZq7d<`S=D&l2{_#^)!^6KSN;1c<4Yvt9 zow|mft(X95b<>%hfp773N|AAe4C0?Sb5@bCxfo541sDauFqfSSSLC9cjnkR|vmqwX z9f>y@I*U}aD^d1K<_IbMsYNR3nm`3keoc4Cx-lR98#V%)D4irpe{)R$vyvmNxa4l`SJIF+$uj z^~=;y%K^mWkwyBAw0gJ8D(53fTDO=@Bgtwi=fez*9f$#K752m6>%a=oOFqwOU(VBD zkLDYTk#T?Ab5D8rLVoptU9lK*QP@o8Lkd@^?-N0u1`PWvq0CT6W)!28*d(5cbqXT8 zCr=}^h}3VA>C*mm419dur5QoT*voj`e8d!y`Q4x%ml<+&gk>cdBoMU{&IV<21%_HU zo;V)YBpf5#62+((J0BRRu~nBj!V1a_Zy7DBCcaj#WI1Lz0-}>DQuO#WtW3sHdj0Fc zYUeKk5CoWky1Fud4oc$D#6^XqO9+%G$-7gCuGwq+n@ zvd@}^lVpkYn{+w8aoTY=^YMQYptUMci3LLH3(? zgK7D-cxy8R16ZRY_wv&O$3Yj%CYE0jEt$9&>J5I$91I zgx&1HEE|E1QJg(q;@#kWNvwS+-m#L4cMKcyMLLNtwbIZEk@ux* zk)t4aNab=_O9z?n`Pl>EPlmDO41v6^yrS~#c`S)!G_P*(i3l!d(LRJDDW_2zmwT@p zyrTzc82m)NeKf8C3*X=JuDe#ADY>+6@{+Zo- zEbZ9cwzN)bIOF5#O*BDB0^7%|jTcs@n|LsR?}U%NVl3vQF11ccp=sHtvP+d`01i_a zPASj=k$fSbH{`{cr%cc6E!`y|v$KYu9KC4C`!8zc|6g3iY}^;s2N*~VD^vAWgt@#v zoo5=&l@Eu%gkzY)^rH44bC4m{a=kYFAv%UoUHNeMSKtQ5J!FL!zF6{S37ZGH8-%DF zaA0Wj++4_m%&uvqDU7%r9A7Po=7m$%J2Ji3Y@E2dFmUD8%{q4qv;%Pa3b5sSw&1lt%OMqUek%?*Lab&aia zty|~Qud<8?M%T}Cx&j_xOML#+cG*uzLlHTfgAhoV8<1`b?J*|B72Ds$hS^e$W?l;f z7{w9_lidz(|Ei5yi_rkPemdmsjCiLp6m2|}@)JuWaV{9OzN6-{9Izaavr%$nL5&>TB@q|oxhocW{Kw|TU6ICH zh6;$dDFI6YkFHEyCOS}ZrGgm?L!G_(Iv5LSd3FCT|cA)oX#ZqYN8d`Nmqw(gpxYW zpt)oxG1eXUMzjxW`N+r^@Rm52xMVkH0hdWLUeCHUO(WmDReQv|#Sj#d|F;dKFfZS9 zJzLlJBiJzVxLVw<9@x1l8Q>?V!YXPC(Jq4}TDdM8wJb6a7F!bTIXHo~BA1da88{77 zA;!?$k2Elu*E|$6E_j^GE#<@W8N3TyKcg6^r+pRn;^szSX&!>{@okzlCn>NBnnN1@M&vzge~a$X0}blT}11Iwq1;+5FrQ4l!DWei+pvH zEt$O!caSX_S_%$IUZgy$lRSsqMxU?P=m)ePPjSu0zOw1no}Pbc8K&`NoY*)!y@=A> z=)8$|XY{LvdrHGSz;OFd9q#+_q9k&YMA3`CJm9DxUUp8Wgz3}h8-g}$d2y-%H{xUvJXe4)7sVLVB3O06MYc7`pjf&pf5Va{* z=mi`7gN~5mZQ6t1qiP!^F@%LkdV%8?7(|YP>5f;b_zTP|XA8;O}#bGTyke>vm&C>*@fi~4W^FhkWI)hi?M#Wy4= zU(Ll);MaRrve2~p*i11%T!!LmAeCWFj<2kE@}ee-^P=IizzfI6m5sA>x%7y{o5a?I zv66dR<_K}NSg7+KZLZ*q5yUSzlWaw^ecP<)hWZjl z@FyONe$}@9WLj{yKt@l{fXM!fnoo=qn0->(R|~d5N&J@0c96WnfRw}Y!-J297p(e8 zmWKqC+1X&9PTcF$C%+FnIfRqoogW~bR|SDPInk~xWzE;VF#3Op-#xOzzs_p9w@r@E4&_A;^e zh(}Y8F5V@g8@Ug<)RxHNBFG(8P9LPo!4g$!UqzJsJS|al3yZ3;ntr%~cpJ}$T-c?A zT&FZ1_69E9%gt)#AzE9G+GC}(v>XmB5!u4F9pC2^*&*jfDF~yNSIZ%6sZAd>iAa6} zyUuv9xlu2%hmbjJhhzF!bX61F!V7bc`z4$BAQ= z$Dd5T;x7yB^MGE6c_C5p@^N`H>&N)NWeW^#P|eEi4n|M4%+ zc3wRDd6%yA@ubB6pO5g~8+wn!Fn)bK+uhtK{^{TTc$l81@6z{`KMdYK4+ro5(64@T z9#wbx6@Ki~cm3ys)060*pAX)DQ~6Ur{dD);cZ1Wx`<;GziYMOEmv8STTmRa>{IiDv z@#PS{hXSVJ)Hf;BAB&h`Sh#(Tz19>K#UeXA4}QmG=SH)1{V=LmoPFXI3~+T~0AR{d z#633fCnIrNC5ThQO`MR_(`i*WM7%$q%v`3Dty#D~r%}#pG|kq4)<-W$eKj`Vjka&vHVE9|{LKQ8jRJhOe2}R{A~2&? z!A{MKZ4(i5Yq+_w=L6L48Ax?wf`fT)Tg$HsUy!1OF5St8yW+Z|UcwVwN>`!F%?6H| z{p6>1r^Q4C9or!T%PH;Jq3lZ+j*5a9jKXDhw*m&UcI%_tbA7HJE1-qLgM9|;`$CD? zk}3FfM0#ltjQHSaUs3x$Afd(nL^9$B`VHl?CJFOZx`O5KF(~RpGg_%rV>SV+vqky( zu~_)vUz6}CGyXM}H(R^UultnR)Ca&B;-G5~B7i(#QliUyreZy7hI|_%hs~Yn#Oi~b z68@f*aG1JM7{Uy;m)Dl4joga(&k(bU0)A=~lQXG0250or_8iS)GX?{&jtHZB+Ony7 z@ZuHs=(697U;khTNTbXc=yn5~j5J4<}eW|<^!_3k0wmas^ zIV5z&F|yMnLQ-l^j9&(zg(NGMon`s7WONj;AD$sD!Y%(Ki1 z7^hdHo@6BAdE1SRw(P!d6Kd<=RER;I{=A!!oa z4H3h<;z(vu)OL|_rl)S;WabjR8%=2gq3H;EbD%Z|F#k>RlJmF66F6#%Pl1zbIw+3l zWe!d*7X}g1qe~J+GQ19m_mczyU(CM%dTB>L5ECk2Cs&X~90H*ObZU0Z@xl=W-!#nj ziSSKNp5x^4mw0TjDr&ZBmUAmpBU#x&04AfK#*ibzCRaQgi7$eV-%uBu)+=2^lhgn# z_w*)%K`ezD1L;6g)cp$MeTEIqSrb)H+D#wXwi#eUpI|-nTE28w!^kqt5suOXAXSgi8hZN>pb|wNa zSX(E)z?n6ED94mpvLa(;G*vMt2o1BADsBR=PX+r$897jRB^=@eW{Zj!b@tK!<_S}F z?y^z#4B5?UB4|#eA1g+^l8OXaW)eH};esr_2|8!Sd2O7S2ow&R0@C2+#qs4nA4F0J z;=Zec7OQ@4#4_=b4QY~TkG4a#;9$-la}S+l9|}Hw_!wLja<7)&`EL~sCyO3`XT`gR6(Q z)hpT7dM2}jcae}v(Q;78eAXiEbrA^E)J<0spK?nOJ&$_Nmn9t>dsM|FKl#6I3@n!n z)#n+D4LAQb1&HzaZvE|MFigDD2JwV2D7s?JkW*6ExKy;Ec zZGno;?f*qYQ#;~>pprJ`L>T^TX^K)rbepIkW+p6IQtqCy)mRIM#a+2F>9U+M=!oN| zQX#X)S=W;|nt2-t!Wum~;X2|-NTw@SS*u<=Iw3olkJ~;1#3=ai(Fd55r%CL`{7u#v z@3mlg4;T-)co&z1+s%z;Mwz>?QNveaEmf91f{D=H%Rzy(_TKmo_rBqx=h%Hm&@G8ZYS`)>;q@G)6TspyhwJJmoq{nxZ&i>*Qej4LT#|L z4P6Y|&6Zk+h9P`8Y%X16_AB$eB!=sW>zgXW${pNUyRyHrc*1#q@k3$?Z2jAz30K?P z*qf=fnAmyA9R*EEHx!opUqa34cE?O=YNC|Q>N)JIYne0a=-9XdlE@VBH zr6I4YWnseKHMt2I&0i_zxsGs-%D$ZNs1G5(@?N&Pb0NFaFSn$pwMzL@8tMvJbyWaB zzCYsOUG{&hP74n!m9P>975ujn$baZ_B@E^J(ELvS3j_Yh&sF3HI~tKCWbYs2>^pao zxL~^C8G2|S!Rztf^>xDa<}*#2=6cqH^jJeYaGnMKfzk4$>^Bwp#{Pln;}83j%zfq5 z)RyE8=3&aB8IVkfti!0-KZL3vD@Gx7$1nO#7=}ya&><|5_rZbu_lLjxyWjk3dpoRl zwzpsYC-aDExceXf<+YsEJVl6GX|Gw*T3`B>X|dTvkK1ilF+>QQ6RO zV}ihM=w7i9PT!{faajNfL$Nzh=Za1iL>j(_dQ(zVIFjztV)KCkXjuRgt&%cM)G&ro z=5#y;?8iy8=t_xEFP?=lItCV_FXZ&K5p`D%UTdHW-_9eBNCIz_w@N$`If{P-Y?+vI>4HdHUSF|n zd{HH-xXw`Z#Gt+)80-OZ8~46wy5p;vlmp7dmMV-crx+q|(%unjMKY3kM*ZeY2oD~o z6kKy0n8nHI1FZNdagGJ2ABTh@GONba!)O@;}#=T=Qcn0DwbFyj|&1BHNb! zZ-noVZQO{mLKGEnsOodN85L1LKt=zYNFae!Adw_NeYWm*>ox5mfvU3l+P$(3VAMJS^=GHd+BOCq>e&X}ZZty>`2R=hC2zn4 zZ{QI5U7{_;VcZ=wLCgjSEt`y)U^Voa9%wkjxT(UVaXRh%P$nn(3l9|PFV$NLS7zbQ z6bszMbo}%COkfILBmzA!b?Zhvb7n6>PZ=ZOTmXpdQjF-nh9#U~Uqz%EpbwZP7g-^E zj;YY9Y+}g>UB%K!?akodBexSKHRnc{-1&1wck7R+gN!t>^bGqR&UO-zQb)0|rbNON zdY@ndfX5i-%QBZVxgbhIrY^a0XW*8=VxLlKoY)~4&L}KfXKAPBzLQ_rIB@RK44$!n z(FLEA*9(iQLAl_SB4BQegNLp}fAqbv);cHe<24 zKLCyD?cj@_;eru#_{xxVs~|doAbwpkjE>JR_|svnO+h{)4@5O7++31UM%VXpbebSxV&!EeUrRI0@?k<1*HXN|VyX1i>MF`4AOsDH zx~ilE?UALcc=gz{i5USV2{j?~31~`pz+5zp4tva+CJv|!utC^B0u{s{ZHbf6@Nx-j8tbnWT=EHddsYXJO#>&)eleM(!2IF8*OFEO2)so|#r zxmsD%Gn>s+*ClX@Nb%q?#45gYas-g(*%vGV+uoYp+luuXVH5%-5NaYxu&`4odbZeV zertN*cgA@wePIDdD+GfK6HjQ4Nr}}6prxS^Y!YgTr@HF+Ea1HJ(=d3fnAHf!M?9zC z*j@(=^FW1lbV64Rcy6?dd^VU^8ST{gqwx^W#pWQhiTC(8Z4226$cLy<5*Z|!Q_yTR zCe)VP>r{19lFq06Ia@I}KdvwK*)KP`z@aTbks#W7tR(?w&@ntZT531!aA?}VY>v$i zuQJrx&dn)8PJ$_I`fj0EuQki9rhJc~Cm1!GGqF7dzD#66IN|X=qo9YJ8f+9Ry{|!K zj1Uexa>2NnVkbM7I=jFW$q$i80nu_Ww1CW4r|&J*x+8#K97^W|yHuFzZ$Y(*Uh&7U zX1irsAg`w=z__W?Y@k{wyM(<^_7%r+1(N}$7T6v?Gua5_L$@V3l}`L2;Pg+y()Y{m%JjcvN2W|t&6xye>R2?fCO`}(gdWiH|DR%G;ohn{l1Tf;f zB)9y+=jjL2`F6o5dk+;uq_Nl-6~(nnCIrch2JF`p6JJ54-Z8%xdmsY?FaX+0Y5-?PxLYFo(EMw$BLv#E+%r z@Q@FTdo@jrodYHohW#lLiMsGR@zyycx3eD8{ouQXF4=#m0^V7g3AIKT3!$0OL8n8G z;KI^yTQ3aO1tHOLq0CB_LvAtd<{}Vp*ixIhUcRfsM@%!u|iZ-9Ap(JsUV8Zu+|rQqYiUa(yzH zo*wveU@oJeQvG{7m9QHp2obkQ1@Z9|RKag^`xFUs&^~6!!LIyMP$4i%EYp=grt}|w zDfrbW7|8>+Efq~m6CZ>G6(|S0PuDEEnCe9d=aEm=+hY8M{_!;4lMS^yme$&PmINbvSa-5G*`oB{a5tkvn7`4TEB6;<~lIb@b&xvO<7PuW{^8|)aV z*il{VRd5EW&AO`8mh1+rqoMN01!XJszVa>(yHILW0d`QMD`cY8vX~L(0`JX#p+&5J zA-kI

Lw<`Sp+>+cKU7bAs7ahcd4pZPCJAio%iG$P2uTbI@PmtPC#9fpVJ(S$f9 z5-`_4>R<36f`%Ir>mW$RDl$M78H1FpM5#DFrrRc>*X<*%lOV=-Zaih|c&fQ{`oUeZWE++O`L85q4Reu{wSFwRx*Q0@=8ZoI zn;D2YDj{=c)QPfPo?qwZJAdo($M)m%DpW<=kl3&$TtTkdJ?e^27uLeV^r6NO_UEdZ zoWVxm|MOQtb2e>p0R3 zO+);hvztO2Ke5{6kH4{218bE}wzz)sSIsZ}8O5Yvj-;r@Ptjv?xk?mb%F@^8WV|Ns zvYiQ4&unswJ7)3>K-QU~O8D6=%R4k}iSYCxTNJjt{fXHr zG!&A&P>mR*uWm?;XMKu=sMjkim*g&?LLyczn{c&OQm_)0BZX_%-OhNu;lCIGq*1(|X-Le$N(t_0?g!D> z@ZW8|ns~$w%*Hoh4d5Db3UGCgf+=5DN9X4!kt2DMUU5xX?6_#k zYWpO*d2aChc$hF8k4YDPq`}t1Q`Ms=D9VKC&NC8u;lag9H*-=!d}$Gf?)s^;4(0Ko z90_qhsJ3Y6!ZYE!B)a<&*;nD%b$7?2~2N)4^1cn`920Iy3cL zV5(Dq9bhqBU`*&UtR+AEIiZIo+=(d^q=gNrfh3_T2vThEgIT!5cZDAd?Su0J*c`0& z=mT~HJT`YSA>8B6pH3bA>Q9{~{Q=LzUkjKD5?0~lq7K0(2r-CIW~{jZwG8uN3u@u| zBc{!v`06Mc?EBmdhvHFS1Hu;s1!wJfegrxrbc*;X@nD;NZ?$NS=!K;Gf2a6{CXUp1 z--4%#TFog&Jy=>`$Os-qaWs(=r`Cp^zb19BjyovNXm4B0OOe@TSI- zsBLwtO&z>bE+vgDqMShUGE2?t3K?cBuvmUAQemPL{_f-aE)^L*K0|ANqOfbK#l5yl)cp)TpD{SK3~=+m`dT$ z8{O(_1gN}2ZV%I4KJJsjv4JA+XHpC+U4JaHI7XDtxsZTD@d6S9s}r3I?hs^k4AOto zU1ABzK&U1L>=419o(`CgUMNg9{>*;&?~p>A?r@!nl-k8eA=bKMq*l6Pq}QpZaBb$p zKXy(InU{*`ot%CAzg+R6T%~<#mM^Nsf^$=BHnSH+`VhW!3G(#~h4BbS?Ogg!-kk-b z1Nzqk#d%%H7*63RfGV2>5%O5wxU)AR1@``nzMFjUFr&Hoz1h}XL%;H#563t96vej= zf1ry}X~@jMA$%`CbZ4PA{{}Y;^6JsE{o8CZyS&R)OLx6m=AqX8$TUmys93zcdP`>W zZg$W(Kiyj_3U?>%hvM~p@*-P(&SnR>`CWGMe361jG<*H!@zr4bRIXiDpG)59bN%q~ zEO`ST{qcO4y;CzNRtp=)uj#XxY<~Ku#kg_$&B@Y_@Fal@$thNCo{3K~T9Y3-72j2B z*B%86g;HX!e+L(Y=q8W^)PV{xW{wY^Y>iV?Y>QtAsDa?C-z5Fm(CA_I^XpD{HBN;v z(EY($P-z6~H)iFLSijvuh#mHL=MTR3U7VRerPQX<6(M%R?pdWamj0AX0!E2Oe6;D= zx?z^=i$!RO$rjz!kL^f%D`-Yx>@^xp9`8y-JEBUUh5J%7Vd;If?s-r_@EyO;I8CjO zzsKmi6(@F_PGEhzV@1hGY`;;CY*b3@rOMAR{Nvm^ESd)eQ?lx$w;?WPA6y)beARo24Eb(d23QxENM4gIp!ou62@Qob+q9dfPZE zyF4~viUS!Z#aYn(iEigzL0 zfls+|u{3{vf6e#KPhLx@vv7J|zV)xll~L7w>c1UdTsI#4m-^GPJG^VZ<@U1K%--lV zyhs+WbBhLC!`<_?*LNSMolf@Y&dl$)p$9~B#-Z^#mv*8yO$bu7vWz-yc0(KA(@H!bR@!@aE;&e=0Z1r|!qYB)B`@-bz*Slkv21a(G`$&kBufGZS5m z&ij7QTzq(YuV?Mox2WS*!$Gg|5)}64xnw#@chmEa$#s8ubbY+N^_Xk!^*&04Wd_vl zO{p22UcGqTY%^WWoj+%z^U7ZTwBE|XkrT>PsyOrS28-)d?W5jE*N?ixYIG91si&)#R<1Mi3qdw@Kb^c@q=s*={px#d^qPHv zy%=9zMYow$t#jTQx~0pr$8Irs|9V&IE%!RN^I7)lq&j^rzxm0x!&1Lio(%KJPHuTR zEnK&ArK;QB-n#6Ku5TOl+um$Ec?e%BACp=WuIJbE#q+e$x((99X})oFm2vM*=TEis z%X;gnUAj2&8|BvF(oLUkZ)F>q$>OD03Ch{$hs>p0sQ6biKYF!Iv*7Ck@z8rA~0Q%OA+`@M_e zTh}{DeH6-ve{664aWif7<;<$@k~)!9Qz95bqlF1S+`7 z^Sj#pg;6*j)ofwSLz zdl7Ou4ClW^@^}6(vQ*M>e-3=J3wQROAV+AY7R^zQND)*pz+gHNj-qkxPQHW`_yzM2 z)(#C?q;-vd-$x({at-v{*^2_w9_-NL$qD?qIz9i!RfOKEGW}O8tg=DA+HKxQZ=thl zRZCD{0wXW`Dgi%yhnu)3hgT{dcU0AxR7F{|e9cOp!3C8(tRYFOiJH;dIQGFsWH=NG ziKreSb8r9X{0xDIm^pSQbK&1aDaIhpN<%6sqKMr}^}NP(V0EG0E)Kg6l0Rb|T}7Wt zvG1M->PhM!nR)$p-yN#kZ3<|0p6n@*|!^30P0c-KYVAP}E!2qjL)0+*$po_p1Sf}!& zd*JL=v*oXnRXF9swxK@`y-}ZX1Or{z2j4Rl%J8xyQt4cLjqgs-H+1=^@igBVkVhUW z-4M|fD=pQPLi``ztV_Iqv8W)jUo5D~0mGg>i^ZT5y)!C2*4znowa}bRUFr7>W7^(g zxuWrAqX8;O9Z3C7Aw`2g90tVkk-i%7)M}7wh@ssoJ)Sn`m^=Jos zgF4xXrYFY1wes~Oyg|*z7zb*i+)LE`lLzQ*8sFmNZ;jBOE>8aP-qaxJfqbh}F|}ra zI@T6{L;dWp`#!epZB)~hb(pGM4XL!04mI2^+gnr*&0?T&;RvCIvnsJH(qhb)!Eq8Q zL!u-ICa#2HIx=X6Fne`AIrW%$ytUTP}N4w=K9Mx^wEl}x7k zsh*Q<)U)8M8tS0~nI!6p5HU$Tt^3xr)IMGrT*5mctwnJ$RhpndhuC3tNd-@nfOVBH zeQ4iBcosru_r6{YzphbBY;UzNHH#`uwji34DJD1iUT*iuMe+fAps*~0Wu+*}2d{0w5^Hla z_5mmBetW8(s_K{V7(95{-ByP{Vp(e zCT}){^b6dhu?o4s2m3-$jYU9E(Nhj(aw;QH7>G3GoFG2zkm4C{2`Di*dd!uuB)yw* zwDUw`LTVzs-lLZO8jVNk;BLyHp5PZWWw|BGNhg(Ji|DKJNnI%oIj}T2ZiFVn_QG9$ z=67a^mGOtQSS=Uf7FoI>;HNB+0HP5#E@VL~R59!>a1 zc^e0NxV)xX;>!>qVgT7Rw>)mQR@h$|@&y>5V!%mUq7yCcg!G}+lKi(IvS%D@AEMAa z89B@8s*;X-)2}#n1~l5kB{BoNBAC_=hKM9^u4kmQ{K7YUt?3Wz;yG)QW6B98Ttyb) z2SMx%(xNO@S}zwgM^NZS;BK~8-bf326=>uYTFgd7TVNXfwS zlc=>_f*oj|DZ`MWg!0IHZ9^#o6!B(cDSD0n;$c7)d#9#SC*!{ zZhkV>;GSaxpk~r8r>c>@rRh*03s;Ox_0G=;w5N{?a;TWS4&g0b9;CaG8gX}S5ZRSR zOZ1vHM;>lPh|rOT_VCD9PYQxF(woHodobxWsvLx3cHOn2z9w{f@_5IyL`~4Cnyl%xF3_Z$-6SYLnD8!ulNsInaNpER|o%03;z*>YbRva_-Ff^ zA6^`ue?B~j1~mJoeaV03jZqd_qujS&w=d`plYY?&=~U=b-XpZR@bl_@De=+15IE&&yNTdaL=9I#|VfHtd?_6bPfpSv?` zHG|5aif~0ogU*roNwgpG!B*>F@Da~PM=Kl##!A^aYU0*#^e^9*xwIApX&W<++iY*U zjFw8CBW*qvmxYom_QTl+Tz!Z9smn|#`}9zb-XZ(3XGJ!+ikZ3m!sWC>`%Lp;YpZJL zJ|8gG*WA$;Ti@@yku|!)@^ardEKo*lGh-Q;xVGstx9KC=euL(2f|fMDneWGVuf7>x z^F(0$$iPtNL;OlWOP2@ifdoZO@lHb?O;$91sU@_GdqpZ24Dlxx2rHSEwQ8F?sO13VtJ?s2y)@1 zvK`PdWmQhL9!;}kqrK5c{)NB*O$Qh_wg%8*al**G(iP$!m;9uua7{5nGvP9jN*YH; zopH*PA`Fh)LQznqV<06wZj{!BO!HWC=~eFjJ35BSQ6D^?JOfoy9SoTiR<5D4=@(pr zqDGbv4b#S?i6Ce1>!7P~b3<2s3v*&=m^53sQPbiFxHdIJ>q<4=sA#y3I8-)2E^Cal z416k%y*n?Ckn5TI9!osI6?<3?CmeD+sYt~PaA@?ist~&A2^5Tl8TGCAC~ltM*JB*4 z(ka=R#=ng;q(8XoPH!g`R{#x0GEC4_n)3&Swn(x;`k5G$h|6nz?VY4><=kbhs-BID z1}c&j+hY`A>ucM&^>9AGQL!&80cdnV?9V!S#{TGpJGB*3hI@8>trW@K>UK` zV+&_ZhzXQ=ZO+XPnE(!8aV3e-O5GCYaB(X=(+p-iKDX-aogFP7qRlC0=|EEI7BKhq zHF3T&7`(Bf!JX4iH7B7tAw<5LPP)ysh&$j6WJ+v(K)CXRyG4%bIv0CZFNMjs20(9` z7KS``=m)&fz=kE|!{g>NP4FZmH>{%!=%YVN)&zrQ062Ihg&y$t}1}sRm4>d zxVA!|3#Ny1h~EeG@Mo-m%JKf^swW{*2c_c7pW5r6lXsFisWh1M6fCiDWcLFu?byUI zH`ah&QK$wwAT&_c%U?$_?4uzKhnfnK){`i-*i%HgQj zy~`};CNObghAWKTtOB&`MmWQ+@{>EH#RWV?;ELYA_?06xdFm}A*dm@`Nyi(}vaA_u zo5hezP399bE5Js+jnzS!H>)BrWf~}kTK3%B4PBaa-zTuw_kYlE?b(0L*Z~kovoujbD;dCTHlGTa&}rCzZ?Zu|P6$)diP)qV~Ga((%8MHuMMR|K}c&AiNXVkAkt(u9W!`rK+6 z8I|qZQu6|k)*W>UK-^c=mvXq_|De9SGWggs@bMWJX%Py!`<+q9)-xz1`$ZuLw!U_m z4g6Q|cYSUN9Iy!-uw8WpTN$iNR=@$JashWjahi%0%p|L>hv4WqQcdRYLI5x20K=pR zFQkcC3NXY~xQw9`aJX;_lcP%T9ac?q^ z9;o+43ijv|J*-Zt7e2bKCB==~H;RP`$oMsHgIP1BZ5@122stE0iFsaznWXS=e>5^7 z2-*!wL@;5HquDiHD_<%AyPrRFqCdh2#+o|MyS$goaSOQ()!}R0GsONfik9n;m89m@ zwc}0`d_8KmtYg%C%1yj`1Tpvwm-;l_a1C5Z7Yv#}?V(7Tj8@AXt~Jg}$%g1>hXVrS zwzIqOG78lMMxx|7J(~BfP@V|!`bKX$F;?1%L%6c}h56KthVDqV59RdPELfzNduENm zpoGaYs1lA~t^=#w=&%WL+%b_Kj%WRHLr7G?{Q&Hjnl-K~5baJrd}djI?BxdkdF1GR zEObUl4eCg8VL+=5cZ2EmuDPx$F9>E@y&2@9$QaMm&{nPiM1uiNh_n%$`Y$@dBPwxn zMWKB`*cO7!I36u-!z=4NETJU;!E6kUok%LDeQKk>0|QseB%B6%m7@vS2y(NFE43Awd zpsv#HHTyV?MCY5Pe{;2IFE5dtI2O)#_-++efw(r4pA)}+YC&;JT=U81kH8cDFM0_Z z<7d~%<>~3+$)W}FvU!Nt3ST0sfHqC6fzURi1r!UVaN$J1OJ<7%x{3%zfF-0?Ahb}$ z)jRVOQ3!&q()-0?C|GgcbZ^e`UCsY-HZPPwo{>Fg>4bs}|434rv5Zy{(Q^V@USh~@ za>6KFbG+K}m2}~U=~Hi<$1ko9`9_Y0cy961vv9%+p5?47shou)-0k?j@eGpLHY8I$ zPvj;=esYE}bDSchn4NxCs7d~dF_mpAx1-1+QbYON6lD?%5k7}vXx0wN2_B^%9tP_@ zZm#rW(H=EDjBRV9E?R({aiufHpAC_ekTJ#w^ouMWvn(|i?&LD{ilIhp%^{9#dKq%8 zMFCS2VI|1JT*C?H?Q;@QG#~6&YjteZV#7!nPr+9J6=cc%e*m#A#V-9M0DwbF?OkhA z99NS4P6YpL*j z#`bK?M(l?fi>|7B^S<)t^Q1ErB!QN}WSZ1pyl;xqYq<=!QI+UL)7;~kFadk*@dZ>f ziSR1Li6FNM)?~(Gd?{iJQ>ydt4+h*PLmMw%^=o_Z0T``7F%?WDOv&^sF zoGG{@y*~>~oEg9ex|OUci&-qKgtbOHIuS%p|5b?qV1?ZrXM;Y##+j~$sFiX)bi}T% zVCoi9B)xsig^@W!_>|>3SRYG9X~aAYya1Y3_g_iVdV6;I|EkviB~=U7pWj8-`c=z{ z-qTr;|KUe__{dr#@;IFz*qi{_oc#mVxZkQI)X4Ew$=SpFxIvXi;=Iz4qpnw}0SQXl_A(wAJ}t7H9cIs?qJ9xL8Z*hYzZM zk7<80t4{snKbO$|^x!_I0RAQ+z5e_rYLGj>$)V1c+ccGvOr}?(9oBA}-+hcrozlf^ z^RR)Yp^YXx&+mTbn~%M$;a92&;%ee)=Nf*c?3q74<>d2r`wFHY`J?h%_Rl^1ztI){swEvQ+9n%2h0=TLZx#~T&{3Fn z9l6W3N;SK5B#27VtSt}en7F=N8l`CMgJS7%FYN}U&YCBvgQ1MJhr)HG&(SB*gkWSr zs$tY=853uO#pxX5M3Dr(Qh{ncY?BU0YP>8ql4fBwwzaxqjcF=Ljg_IgAuD@lb;Ylc zo5^GqHyoHSilPPIGh-pJPep4+&6+zo8wW0MzeZUnEly95(@3B{&ydxE%12t^tTvxE zo+>TBp=E$L2o%!5jbtP634z>zqaxjI@Dx{0h}Ae$ zYIQ|X^N<7{PMi4Z48=Nq!$ z`-e1d&{S|iU%GH^*30%d#`30FKgtjtSca19Mzb_UNs~=^yd;AlS`H*rOQaD9Wn{Tn z2^LT_QwvZsi|%way%HHYALZADdVJ1F>ntyQ@%Tz1M43T{r+PQe7X8wV$es+HDfJT4 zaETfM46Jqz@S2z`@8Ktib1R7u=neZQUa4^-8g3K{*Rq*86WWMxgqyO|q&Ee74beiN z1QZEj5kVTwqL6b)WW*6P0H+iK>L69ln z2g=SWMqm2V@klYVh($%5y`GlBE-#UQjHC1T0-!o$06Wfl1%ge6@!knAvY1 z@uR0P%Ew=ScXsstz3l9Z)qPtVeNo;2`W(|$6Y)fk>J zudK-837?H;mSQ@|rwB%*)Eq;H#X=F*{kx<0AKw0ri~FWPu2B*%ZKV4uFO>pZY3(f^0$Lfr-}jh-x9;`z zckkbBM6t0?+Ym33^?boOa94=sduHMIS60!xa5U>*7C$EW$V%&s2t-P-y7zC<_UX-d zHb-r@r;xhWiI+?Mdg|WY>vWR_3^z)+n_Ffc$2fmiG^y!q6W)fN1CQTi9n=ILt$ste zQj(}9=3+FHHgZ(6GnU}tPdP<~+=koAL^OV&ant!dd8rn_WD&kW|4Iw%E-$Nphq&J> zic2HD#ju+Jp*GiLbdBF-SW6w(ZC4xzT_ZK6gU!-wnf8Hs7}n=4Z9 zym-$40#H5IiqsiPQp?{2s(d2a9cB7Gk zqofd*t3W}gdhOJxs&EaMW4Zs?v%jUlXI58Sr9w&@Ec9vD#ps@;0pl3z++bI2iG9!_ zfZ_utxr3`F8XM&wVyHQ>R^`|Jl=b$?2>`JTi{LTT&JhRD(tYIShBK(*n@ypsh35V? z#Lb%8vqfcu3K0ZM!xYyOlN1PHq~&Lk@r0VI!W$0Kg>9MW zkwYABS@n8=y)by((jQ8v2!x*L-@aA=?jr4+G*aF1eXXuoXBBU(V%Hbh&OW=#)^|EA zNUa6TQF>N?-DeS6xst64u4u}#T4h?PybW|`CX#T2=x&=On<-m=FO3K@H-o?5?4oUw zgKE}?4ng}`PMuLx4sVKCG4ToJ4#t!j4&el%=8Bi@MV*>YDM`jb>9TY#%7f?L*sRr$ z#wuy$(L9>ZD6zz<9#ur?af2w0{DSwsdbYv!gc-?4wvD(M4l>)0#Die!4`%i~>zYrr zta*I-A1eq%G_TGC8p8D$7xx-iWFdAVTfd{&3I4Bq4M+t-!Du*Jh z0dRcg%IH{uLL!#jj%A?P!;<;V9iH`37i@1^LQ$U<1^0P=i*|y0?g+%;O{r%VSzdXqW4Y;RpUgV* zAML&E7tCT(t6ovM&>r##MvuuZ9rfg1zxDTFDj3_A1AuY1uC<=45+Tw>CWc3B`Hy@L z=zcx-E%$VO4bUxCrwJ*J%vT}5Jm4_CbX;adnSDC$Xe*zNcl8kMZZnYyg0-`V^P?^- zfMrszg(x)s!+do`t}FMk>i1oF#kn|k_Tz^zX_BGxsUb(>dc-oRj1|{(MmV04;UT?; z!%7m3$GIOlc<55gBSgX;{Sql&m8K`@#87l8XDYw|0%|_$9jJ^(Yi*p7!UE(897&0j>6)u)+d{UUxuG@-O{s1Osk7v2fLs%T{R-qL!nJ#iLj?Ma!vO z$nA5>ptS7uy;}jAzh4|4e|Y!yK*yv(+BVf+U7;2$I_Lu zb}Z;*pREswmB>um5#4Lq?rwJ@tIfB_j>*5V0AnAUQ~zciiVQd#zg_Nw<8VLyD6nl0VK;=H&%7rHtM@{q0Yio6c4&1Ni?46RPQ*{98BI-B0BHRcwII093nIw1~vL4`@!i;RUC-io!W zLha0#WH-?}lpDFHPNf)+Itg+Q$Ru2jfqthztj1cngj?}K>psD}_eZfB9h8=|M2%Z=N5aKDZBAn@Ic$>@ z^=lVCV(_-`Y30r(KZ3DnQqTvP4761Nv5vQhi~)AAfNmS@Sj*LMHcKDnQrTtI-Q^Zg z_YY@(L$_MUe%F>GElf?^YE_8#ocmn`TWX0u5GGJs*?I;flSlX#>RxxMqUYox$-_w2 zTojzsmZg;d=EnP$(MRpc4Y#kYg~P_yVnAio2Pzkkb9~kQx|jr7rDs!_d^`7#M3HLeAGK}6ExwA z4q7>K8_}{nu!SShq%wIN5N7aR&-gHBw1!!sG;J-JoFx~>&lqia-~lcdtr$@ij$)?z zEPIN|K?l13`Zha>ZeX0T{n&^X#Xvt~=MtFe@6nQh6Gr=kY!ao;U6H2J>ZUiENUV}? z(R-A>im2&{OMqk2BXg50d@lkTdQ9u8M9?J@6+{+Cig_I4tHTBYtD~{d(no_9JWkSd zNWH_3UO3vn?$G+=#bovy4l1Kz`*gL)d6R$J(uI3gr|9urQ5DfE=U`r1AX36i;)3Lf zcdzm|QFfoQLscPI*r2|a-p>%E`z)g9L-!Q=s(#;I#oHz|7dxrXF6*Yf0WDjT{cMGF zQz=drua_V<0(8l)J-JdWzRp5Q7cL&dqX`C#ki@FhGrc6%YG5)IEvB-93xT)pj!Ph~ zT~*5U*b!_=>>CN*RVtZz_R}maG|(3W%)aU|9#3ZRwwN(|3=vF>oz#G}ndM%SE5LLa z{9AEo5;?gViQRw(sK;utQ9WBiMfq~UKV?;pUJVjiW{c3CWM-v{!!sOY zL}6>4>vuEr8~U=97pVC$m>~GiDM-BiU?SGzzPdt7TWO-aafx1jk8025OiRFP{0X1o zZKBX!D`+{a<0?A0e8u0WQn1xaMxS3qEE`+38+D%2@I1y5ri?x4-!jNm4#FGDBQ|l@ zPoig#+L#MJD}15ESb!~QNW_&E^D!Y_wvSt_a(p$r6FN-C4DTVDD`Hi?zvwdI<_UJh zP-f-$$m%2a%W`fte|-Z{AMNZrp~Nigo)oQF)Spc3LNGsF{*wqa$4BL#Q@4!CsnNyP zpGHI)av_L8z{Fh=c@n#5+F8gzkN7-AtdK9wk`K5c(g{u4oR@#d-i>61^B&VdFeEPy zS7WDm3Ez2?GF_S}Y{s}Qd!_>%#3X3~IB^Mq@MiZC-*y%5z0#9wWsP4V-8nRFX5JB3 zvW14qaZ9ViunNzdDenDVl}i-8KV+ZbKU!V6h|84Lh;D`hSVcsWJ>4=WI^nTeG_<@Q z%1J={&tfwygXR4~K0b!$6gS*uL7xp*M+onYQQMnmHr^|3%Xb3%_}E7*n(R1;-8Gi` zp?glZsEhI3LO}CYd40KMfr9P4oWS>@f@k&(*YubY%k?y$+}vmDXWtxGy`=pB5E+tZ zWI4UPhjGgmP~0mnb7CH-sD@A|$Zdl`ajo@m{oaB|1KW-Uo5->E2l9uuG|H_VN=d7T zwHZV#BbY3P(Rc9Txodovfhnbu#+Ed)qecEnyWWjPP$&_!+&dMUP2LsxZMLpX$PMkl zD(d!x1(pc>UO$m9Z?dBy!oc#;M%qA$qQTb;oe6EUv(J67Ph}DVgt)kgyDxHpRQULA zi|Vpw&fXsf$ye?sIe(ZH=VHHuiyfg~Q33dJZScJ_K~{D1MXWvGMqf09BA3z038k8bq^9*W$~HQq_s zadho0IJsM~vZ@Tm38>z840o&bi=U8}Bipdj%>e;4X0b^VZeVB2aSf2f$RKGtvOJba z39Ypf34#)bPM~vHe>(28qCa+9*&Yi+t*+3^E$i+4*YIh}t?y2LaJ_N0Rg`sW_F`}A z#q+I`^VJpGqg3jGb5fKG;aSscx4qp8KfjA)N@E%8@7|qlpq|yX8ks(d-g=+CcpjM5 zQR&1L2;V^JRM)A-T4*h$rQ#`KvBXEMd*DVNj~lAiGa_1nhAcq;3!V1z(Itf;RHuXa znn4-#5z^MZ1rxOQlqrkgaY3ybqwa#hvM+U%^8ZcHA=?$G5d3j-=%P62Gq{llHx55! zPd@n5=%Sn)glC7K=M?mu7EGWgQ6~6a(4dQ(#l8{?x1>_-%~L$6;5ojKi#H& zKEN(`SI|26h8H#r57o}rKfF15c#MM{I@<5oRQ!^4_%y`JTi@=5$0@f zzi}+5kjlS9sq!M4r*5`>`rT>w!KNqUNf*mGltOS4BU9T{g$| zE2(>FNPj+c^`C^7wpF&o=dOl)&_NMKO5|wsb|6q${zF&T;z0DagMpN{JoU+biBBg~ zj}CY%Lrzywcs{cNm!gx*X9dzzFO}hmj&f^}g(`KNYqE%3{nS_1G|g{qb>&ZgeBRmV z9LQ_MBw(H!Wj01LdFe!esUua@-lBWC@7cVGtc*04{e%k{q6Db25$%ixQx~C z>u&<6As5MlLH78u4|3%G8w_|az5b}t$tOTQe=i%SKl>$H|6$bUjVD(J7VxvCJj_t- zK9f#0j3iofBt#=>m+xoThfcz9^slby0N(TwlO)o_hw*i;>vyXA6~lS+0l|77R7Fm= zQvVmT;@I|idc$s}84=lq0W)6`hnZTWW z-^wfu&#eF#sRe1z1TMGG&>S^KM4g4j&u~{-#15%ARUY$7|1B-rTWy=>A(_CJ?E?`hlO#1@meciWulw3OESUp_#2684##-a*`9__NY3eu2QK#*(f`RT?gUZ5*4Q5*+=S{8zLU%hj>c1WDT}XIFOq zy`lA4(mP*vEY~-IRD6q!HOJ zrya5nO^nLzzBY@bZ6Ud1{LGzpVw8m%1zM7Fv@4qZGzY zs=u!kJ%+s@sdB=-?5bgyY5KH5X7ydrwwx?t|CQ&%|InxD<)3bmz*m_Wll_AEQ z9c1`xF5EF=-gYvC?_FebFiUEtLd%_aw&dS3D>8D#qIrZoT5ry=U^IkoDe@t;q zqvK^4nAJ!TD)e3kgy&_SbF+}-HW{PpPG1d5&KBv=LB z>G1sM^@q3FZaX0XDbL58=6*>=ccHv2d|1_r-B)Ka#8~?^4AIvJti}uAg6kiVGx|5! z$Tp&PK|oCt((+4tw24P(;S*-CL5r?lw0k>VUs`;)v&~C)S1;X%-rH|}xc73WL9MI4 z`E39BqqIDKl$P!T1KMAjmYvpiXZKNRc6J^mXMel-;j^X5>9n?YAD^7g_G9F9cD5gC zWqEpJezvzCCFt3s%eDVdD_!oLCu{S1yV3bTbw-YdXLIJ-liLY^E6AyLhID0|WDq#6 z%*HX}by`s>^|M8n0v#f8yRd#&1!oFY9*^Y|0^krHQFFUEtRLR;DA~o(Bx+Cw$z#!# z<2yLP3Ph_=4jL9ir*mA$|Iz41m>R=&DNHTbOna3(bvB@e-xDS3KurVhMwe~o;#(Y> zX^%<@Crd9qV#VNAVfGckN1T_q#cQWjB00P9`*cdu#1O(e@O|(y$Jgr#oCHET;>}u) zmXLBPcbQz6@FVv}X>B(RUebAK(bTT9(sGbdsXjj;vC{THZdXV#1_GW#mY>exm)p?9 zt-e)Z)D@E{%)>m*)$CCGJn?bF*VFMG$_w!(q!2fpm_UXv)MO*yxa;=-DjxlOSe?0u zbZo{HIgtq-y_bO~m`^Wnw#Fmok87?VI@2Gr*&Nz=K45x_&2^nIEH6rD411xbm80I5 zd<4PaZ3qcCb4Yr;Ap1YbAH^Uwk2&=WRB4jG43Z#mlq+R;NLzFHKr*#|1yGUfXCx%4 zFZSf!**WHaG@g?HmnnS5JmK*zD~oBN!H0;%nSfhxA_vfdIN1`MQY}qcMWQhw3>153 zkR59P$}~F)#jY7q3UsvjHQYBs=ku&W+|C}P^B$cgah+_2Z?KRX!(!>w#eVz5T&tZ8 z9@`^fECV$AqQ#+C8wV?r4sPOgvWE=Le4OVrZ>~%4??jwAv$cK%+Tn^fo`4G*|Z`u4$`OdCP z=X8Q7G?%)|zg+vRC_VQlXh;Z>L3}DY($3$Gt_KVVcvnt^GQ9{+fYf(?;1rfxYGmPs zb5HV-<`Rn`ic}Qn)qU zSuZ_5Xje=%h`OELs<(;QED9S!mg?XZ_0CI`Dn;cG`*X>7+n_J|I-Pvnk z^~FpL6KhH{UG`Ab5C_5NIaX&F48V{+7Z*s?fm!a$*!VaM$3BZhg#a499lR3p6=rpd zkfO(gYi>*Ut8BGwnb+LMb#MLm_s=p6j&8vVW7ZO<>h$lF&wog3&2}lS>Jgj zpSH5@D`Zn_y!2U~+HfjcdnLG2>&A`Tx5(WW*70g>Z|(3Xc$yY<%bUYv9n$@x^Y_`F zULEyMgmE`KFy>MJ)HrDULt|_8gnpyuaqnyoj>H8OwNI{WjVj7;H-RnTr~Nd6a?<8Ou7<>z?kpSEF_ zCio4*VzR436Wo8*e)x66SY}D;Z47oVeGYgxygDuc(_{EIyz6>;K6xQL?S=|cXBLZ{ za0@~Y>$%IB;@8*3#gwX%+>Sd>za10oy52Oun#q3%TZazxa(siIrK291WE>lH>dg?* zWeAYF4GIrunuw>(>-`vF5i%rGim(w$2W@^8Cq;;+pgu1*5r3wqY?5E}2YmvznOcqy zV=xkY?Sjcd#dLL)11!%j4v_FP%qo=<2kMgYZqP4n$_45Ex3(ZOzQq@@944i1D%je~<#4vp3Fbto?5Qe8eycS*b zS!6HZsX!SLp=8}H)`k};VHA&jB=$nKE&`*|6>`c%Yf~i1^~Qt28eCdy(;HYQdil*@ zZ9`o+h9zg&I6ksYw3EM%b0pj2cH~U{2&13O-Y2SaF8v{irl8VJC2l@!`&~vin#Z!E z3qJcI0vK4prrG~=S202q<=)eWFc%)w9=|7Oo$epK@#T-5_AmX(+Mx@y?YJb@_-x5( zG3a>Ni(~`=FxI?CdMH}5c%4ngRCYAT(h|H@SBw{F=7(bKnMahR{+{zw_a#G(8Gd{~ z17YUUb5>VIST&7<2oOK$#3qPmgfr-Vn9?~}_6aCMZ(;)xjl-+ za3U&ecE+EzK1hCOUg-F&MaN8!SG(?fYwWdX&Qp4VW0G6hu*gSAs;7%(Cb*wLJ?j0S zgT$he$6k*KqiG&xs&uLaF&xxiPg*{S*7Dx`(kbf(qnNz~$U4mga;G9a%yr|UFiJP8 zIkfn*88bNhhw(rWWnWm?jR-AKgPm*X=U%v)F^$t|y&#@lWAgLqRQ<%FWzC1)XiYeH zeFnvQH$x_l+Q@Sz)!=2OpV06siD6k9bXlZxS}*;P?>uV7XMN4c1*g#{oLk(2 zl~P~7MzVA4$wADBd9S-i&f2;=Z?7`N_5^)L^T0wFP?=b8H2ts<$eNrhBR^P_h*rT4ap zUVZS}$mOb}v?5MRaa05A$E!M*>wczQ?W$aaM)5ovz`7^z)&7Pie8HSdtHhEPg}T7- zUY+;7?zNIAmD{at#i^uRo<7-We9~!r(v6-_%E#lh%bmt9cN)9gY3y=mnJznxU3MC~ z>@;@SS*FWwW0&2=F1w9gc5Az=Q=pvYWd@p^?I;-_JYIH_+%|5K+r~|D+qg+?Yc@&x zWVi9j-a}J<+qkiA8#mT%GCRwV*=;1V z+el`&k<4x*ncYS*yR~H2L?%3HQAqFRiYQ|;4*BsE{CESmb|PnaFl=WJuFA#HU95M9 ze09y(Y0Ei{OwLO(_qqca*@!!96jkishbQAUC0vdL-sO{Non^VZcKDj4$H7gh;mBaQ zwUG;m5K$16++*p($eeuW)E58nd3|WqO`yEH#w54cMr6TRY4p{CjVUJbHX*VmLgoQm z)kAiy-CE1q!fWxA+$K}H;*9vb#)okCM`K;!fZn5%G*L={XXpU8H#5 zYL~;D;X!R9-OM5Sgi;0gv{va2T0l5{r5ciGuu>!dHFRmdX`SV&tqMI9lG1|5BiLP7 zA4Ke5T@iXWsipHD(A3c}{=l@W#5oImhTv*G7T!fgnFGqphpix_S|qGvLQZB4q#y)B z=1jDl-@-u-8`#2W6fa+QWMg^aN1c>aO?7%FN1qo`uzEO51a*Ypk-X=c}W2^Ig^L zzj$|cWdCiaPC2nlNOpvSE4G9uH$dAKN1a^sld%d^rVLfrAbMw-{l476!m7!htsY!T zy0W*bdQ91Dv^+qYX-~TcGY*PdT3Y)ix|&>Y(!$bbK1UBNHN%%bWLv+y@i_=1(^L)} z>GVIj56^3!{M(yk#96XGHqq;DHk+;Q(uR4ARix%}tkqYT@!E54lN1HVe1Mcdhp_x6b8E;&r_|PVoYIiDKM+<;G|ZO?#^w zKd@UJtHg_s6P=tRu>>V_9E$>wYm(vu-2@2l4Qa3YiMCuivkv>6@Q6(VS;IIlZ*<^6W@~yex;fy1{p@Me6!NU}c^ygtLG92>&9J$AH*7B74x7vO!{$mGVsrV9*j&CPHka>-&F5^2Cv7IH5-m~LAJK{MhTJN8 z+K?@0P92(4C3>^oKr!yQs8q*sx$E6{GGPrI78}=uJk?Zb68#QXH`y~WbM!1$adAn9 z0(VNLCJu@^Yc5`^2I19Yi<>6*kF9FSwA4G&s!2<8cYP(7Tl$0CqQ28%&L(a>5|Gw< z#OckZJ&;luq0kT#hnX07auFf z>N56jXW=(4IxfUk^(`;mw{G#it!V^F1S9&+MvObGgz)N$mbBAmm&gVaJ5}4(8cd;D zG(V)M9aGr(K}FR}p|)yK-=RJEMBK3u-vm+sKjcH8&t>ZLohwsg0>bnm`c zxm@b6Uanohu;lb>OzHfUfLq#DCT#8y_L@GE^ng zQI< zkTY2?i}_UC`3n*Oqr+&6lI`3baI}!~? z52Ju%v=L`vvs{h;t!T_h4*u_{pdqDm!9QW=CjMPFwZ)qXji(t6rirO$h=44rlDi80 zshV8|Nf`jx9tOP`SrC)SaFO6^EN5+rTuVUiF$Yr`l^_`1UeO#=%7B2*wSR9Z--jS^s@5xNuV{2X z^&kY21fzdHRLNMOCyLw_IPB+V5Yevn+(NC_A8I@DW;Wo~MyRf@p)P3$$Z#UYhilXy zYf4R8vAd&{t*>!ymSH)_WJ2VMezj9sSTvGsQTDEs-Kb zmd5iu5m{Z*3lq>2Gk**noH6OdYqdBHxrh*sqtn zsg|^^iw0hb9&eRRw5$8h5dbZ7tvp>~^@o?Z^TSK5{qPd&KfJ`n-_1>aHpESYI*tfm>baQ1`bNG`_k!^wc2|0#`rH?Gp8G;=)fKc_d!OCl z>QiX@&c^W0Ue6_vnuZoS>S^DA8lYm8C34QYa!P#tG#$gd&V*Zm;K@RX)5*MbA0*3;Vj3qV0V%tMI0!Z#41gp5Yp2DtyI|9&37LXM*DuUwk zC++C^nhTcehNK{}2IpY{S;(L?aWfm4Y4Q6LjB#pxrD>YK10pRjS5$;`e=G>u#0{jz z-ta0w9AA<;8YHI;ns&~ulf@Vd6Crly6bJ#Cm)E<>_G*#VHAu>f1x;^2r2)NYY%vD) zmQ$_$dy@%W0|hrcDQVZeYWS)#S54}+S>Dn57I!u4$nvgFbMa-qFUxA7UMm)Q(sHfx z_9!>&m$M7&0_6%ydK?Wm znmzlLBg6378`VN0Uda2R`~<^9Tt{zBm8l2mFQoF1x2pKvxL7oKv#4L%MVk3GT~nE_ z7ghfgS4utPXTo7$Y<_%LP~oEL7M6NCmLl;01kPI-3t$ZN+3p*MOM&F~UbCbbCE>Im z_eegif*)^T<5j9Q6UIPKgndiGq5I(-$(qSH@aD_Iu#hl+``5t)fU>9ERE00T$Q${E zxp0bX;DjJzXdp)7YGPXR-bC1d>wiuiiY}tVVqmCKOVfxo`y<21%>k{vDSory>4DkV z>PL4%#|An=4op_q7lu8z)p(iib$f-dLa!8vmHQI8e0dVfb6MkaO}+P;Ih=2qO_OoX zC3Sz)|6K5#dqwqRdCulS^O}k%&BuJsH9fSz29eSi+lg?EpKG+g{fdIx=pCN^S8ng> zce?I8VNrC;&mGNX4iW%S+~1-;dtP(C%Q?|4d)o?d+IwMeXHjIUl`={Fq!)uQj(^cZ zAP*O-Kgv>(?7u@;;CUNOugqRRzSU!%@Vh< zXftH>#F7EZ^XqG)AW3xc8HK@bcNxUDE*w8atiOsL1bSbdUSBH!Bl%W&*r@cM!Qg1# z$GB8t!IOurZay8CMvl49aD;%D{$a+d!$BQ--s8KN&_Ibl?=^x>-g9oY9&a) zZ#UtCE=E&%XjB_JjqH5|KvYfC=w&Yo7GR**DvR3dF(Kg&UTL?3{{HG zAN=Y&_0IO#aPDWjMEf2OF`fBiCf@pTr#QgG=+n5vH#hye`}Kcop4#6JJ6ODZ@A1Qj z53`vjKFu1Mj-6FY zj7!k5^Y!Y0rhnQh960=Q#~Idnl6Gwuc=&!uDHtYt(0}UrIgZ`e-0^)oG<4vEplO?L zg&mv8+wlJU)7Z-oMiyFU`t*02cyH!0z5YF$y$hd`_-gk4zPI1(oH2ED%6Hd*&|n{v zP8-7w?Z^GMK2vK_yQnDxm7-g=U4G-LiEoR;%U&F5)2P+(GuwB(?UwdU+nm zEH(Xa;vV}&@X6E1K3MpS=GX2@4B(vS+NN7Ca0YhivvtVk-G@e>y=NZL@zbe&n_jLD zoc``n>t(5{tt2VFi@D!tHO%sCELOQ4%v#n^xbbGg)TKASdEIj#`Z(+!bA4pU!@*x~ znVJsiv+Q#Ao0GhC9^zKH9`_pO`}KGf+k5h6FSGjxf(@-+XeMj+Td-e!Zcc|d$ptMNp_+ZN=6T}@snL1@gI-IooX<*(?exTOQ5(Ob)0>=5;y!Ud(xAbkzK?_3 zZ{D+hXw#y9RHj6#4xaqbVO{zQE5j^3e%6uU(Y+6=e2ttG8C-71OEdO&2`iG~dr&lG14WnGV*6Pc;l^a`koAj9Hr- zcGwr4yR>7Tlj+su&BY6M9GX2Ka#Q}~H-f_pCJr#16WJuU!_Eo&E*UV{o+@G9Zk(>k z-T(7#ZMf~#=MFv2eHe7Ww5#o+z)&NN4&3=!4~}N_`u5yo;wGJrYY%u#${IP(@1<~{ z`EhgOf!Sx-YCo4R?4uU-?fWFN@%_!b^omA?P4I2^ig{>rvkaw8Z5y3vH23I5X+Q~y#V&`si>}m46O~;i|Z?`+LT=l&)-?iFX6w#}ZA zcPjO5`qjOjz4kd@w%ri_RDF%I>2&_=M+xR8jkL|Tx0-Gd+-0$F^iIo-?fV-`vxAIY}fOc6p_B_pU+aE$*!9ndHO% zxZZ@>r;XA<-A=97eB2nS(*0rYbR5?le4l)lG3cb)#pFl{lpCmatl~6LC>%G!3DF==xD9@sAcxz zq~-X>j0Gua*Ak=~I)>l@PgGNi`!qfCAe*gq`dQDuCX005vKf&J1VwX`a#LRLj~tBb zVjg1=%NYCUQin(Dyl3Cl%}VSR_T;2b(yWjz1D{A9&J|DOpYRUje>>vZFUED1yGf^S z13Ir>VLH!dPI|xT0e(+zNf%$4d2NXEr56pa=fqztxVA2HRhO%c`}7`f+q9L-xbrJK zzC~&@jY~Q6af4UO-aoS)L-jB2Hodr5H;CzQ{QHV4PdEeJ-*x-h$m83Dv>P`?zWE*W zH8}6aW*^J4JHEms{W^E-)1fiRtk7QnS?v3_zsha@=STc_Co&FfKA)ofyn$^YN1T{E z?DnCEP;Knil3tIV7EB8s5>tF5eO$C^PPS3rB3?<{qzKJsg3}E)4Jk|?^sjR27kuRH zK0Un`dw$EGJb(AkC$=7$nAJsgs!;DN5I8e_i>H-2)Gi_9vGsH|A-zF0nm4>(%Cet{yPg zp7SYEGhx^6|1R|}x!&)GbFlG&UTch7`ELs~R~?o9eWhmMXJyHtptK1ipU3%|F64ZlS{^`Hrj80e2uQy^xCJoa$ea^qvmkvcEG&d#=p7AEK@n-kX zFY8_PZ#Ey+>3v+2Z^>R*n@NukU4N{$CM?wPM z5eL^S^1Qn4?8jN39*;XQap_?H*hRZH3{O2R)X-^s()jSWm8PA$wZ7c#!TKXBhZf{I zneW;BeV)~)!C#`!TW!93Ytl^R;M1*4Q*UMtOlx-Y-pwGN2ZgWNi%Rka1|`f89%eExp3|n&{LX7GU*Ftk_`lh6mTyzN z-?yvpc*~EEx<6X8sK3qmjq|h`XZWoV<@F4E=bo49V7YYcFvFc^E_RNvd^vcjTTiEx zdoA}fX6@#kaQ(1&-(l{OVJkl#^USpQ6670mqSXkMCyBzB9F;|DZ#HQA#eD0vpXwTi zSe^9Rce>m9)u_}%+qwxFX!XbnfAGCH*KOh?O@4gIzri8zY_jt9ProjG7(35u+^5eI zk2*cO7T9^jk^Q3wx+tA}J?BkAX2Qnw$Foy*ERSTFsu*^DdF1})^;+u2-X#z1V?9=$ ziR*RCyWh#qu$IJ<1z6|WNdg>uN@B2E!F`YU{^ykmBxBLF(Rm)X# zc6zSbk`ZU^$TJ8JP5SK9z@uUBz4`z3`R46DZuzx_RGwyi*0%U@C!zZr*OEtz@2t*y zvT@~3zm_@6yjCqvXm9)d#cG?)af3!!F2B<~boF)jS?9vu-Yi-?;nm|w*`t5naJsnq z--6L5d;E5VwHy~6b(in3(S4jxP)z7Xty_18yj=HC{e7do!@7L;y39*iAzEVj0ehQ# zmVY6%4y?!vDMbuFNK%cMFX`ifBxr#$<0Lr4X-M# zS<>=b+?andtgWrLFZ0?nf~&@J-4e^++^FMruUC(5EK^E7+j9As?l(-o^jmwmfWF}$NWP@O*%Rx zhs}Mu&}L1n-q=Y|t7a{A`ccw+eY?V-sF+sKvpY0z+wxIEH^(tsyWaCEoYiyV=oX&~ zmvmaUg*9sKO`W%=*Qd=tmApO7Xuz2{*YmNY(=p<#!Q+ybO?2$mmZko6a8}wAi|13X z?R5UK>BRVOSCa-OKF=DrXvk})Qx89X&dI!PowC?+?OK=T)}Bt9{Up0|FU}mznmT&; zhr3OBu4%e3Vok@h{}=_7*cg0dTg~hgY3^FQ=;-#e$5;PraB>INJvq+P@xSyZ$?Gid zeSIDIHDcd|d+s+fj5V{F$J@A?zAnCWc+o0h3;u1-@rN_@N0<+f@m^S%5}7PYy-=_x zfAxgJ-}L7eUtZYqLQn6b)48Gj_9wMA?HoFH{+<4|+MW77){kv@{@KBe#xp*OhTiGj zaqwh^!b_)*=9=A|>fbeg>*1Bhk`_nv-i4Tb>#F)LcE)q9P96^3efII4C5F4+8m$gZ z>G)$KTA&iWZHzwn;sw*FT#&xkQeia&3LgRVC)eX)lc3KMicu zo7*q7MNznhcu_%@!lAQ#itcTdhHN=@94~nkvPie<#tkP0B?a+rqn2BTo291BYx1#U zWD}eAOTIo9HoGzUSXx%|;pU%$u8i#wV#nXHz5D1VZSDSPcSHT{VQY@Sb!n-#CQVHu3y)txwS-th_WN&fy&w+)G?&Ti!b4mku z>jcx{NvGO5gk+kA|(*!OzMHhivV%DJPHn&fV5^L5ns4?lx7RDKq8y7ai^vHRVKxWD+L-c0e>TiKJ&I9%H7K5BCN^d(n5%r`CWbMLLS zZiMUIpg5yPLxVc6S~_KiMvG9jaOQ%rv9Is>tkAlmG0~*kNwwxIXZs1+$`kFqPB@ME z#P9Iz;SrtSMloZDxNMlPwY}k6%V`6;%;~?S<=_)j_Ssvs=)~IhaloJr{G-jA9@sZ= zsO`>4#Y-%=KA#02NiRurZuZV?Z(wBNmKJl*eeK~sXH$Y%;dZm)_{WPz_Q{{zZq8k< zg)m;PbGvJs(>@o7@_FhiO@Bsz8PR6$Wu=IJGmd=ix$H8#v(9AA&gL!PKVH{QJ@oU9 zN>h`dq9r#Te@+*?h_WAgt#A-ibD;R}ldNTF8%nwzJKq1mkKFK1OLx0Bf2;K=-F~A} zUYyO>!N(qkEjt(BvvBN(4_&NRr>Iz*3cT@zx%RyzppD_AV8-~KEvFvnJnCD+xTL3D zW+oUvYU{i(`n}4L3$6DzvfuEK&;A&vGg#`tZlg6_eWL1>ZZ>;(>+Zf8_OjvEeVF*! zoYuWIg$G1j3=g~0``h}L6H~a$zV15z=K1q6uX8&#WM)3xaxP)R$@qYc|82@LYW}E8 zk=pQ9;Vp~&KLi#pI37E3d~^GLP(8goZIzT>P1-K$da>k)@4C&|QBPBrF1mH5%^Gce zx8~U|H`-X;ShC*lW|vluGaua^zs>v9i-f1&)_o1Vlp0aw$ zjLsf{9m}VE_gElOz15(d$G#7{!XqQaQ^S6YdT`+SBy7Nt&hVettZiy4_%;IXFlw!T zgwoK4`&up>A2Z`6Q~F`?BFE-?kDiL%HL(}}nd9C@MXy(7#-H5tEavFPi{HkLv_1RC zxLFgyLpz?gy-i`)^pV2BgR%(d9F&xse%<}_>Q(gQbqj|O}wX*JI~|IL|Jk%Nxwtt=iFZaTc^g7w=Z>*fZl zbj9EH?q2aW<%(1Ov^ zzVYABk=>NEFAhlPJU4S8M}6Cp_Bz_ETf6}#W)r8VYL4z=c80N(f6uC246lRJ^`75) zr?tJA{^9cO-JkdyMmsHS{V-hV{lI2fiBZm5&jb#_8xiswQ1{l zomWlR5|Mf7_M&vHSBoAm`DP`W^MTpRxlnDSyK4HibIZEkDLfT^%XHzns5y?~9&Hyi zOBr(dhG6o@!MWTAi{5KIi@m$SWN7>$rNO(#>zJ-{G*2_xlvUXCv=qU>T+I^d(T}<3zA<(q_~gT_gV+HiQ5?La%%JDpx{oI`dBBhjuqPN z%U;)XV8Q3POP@3>>0;-dlK$yn%)3GP-EK_^*|E0Sqa%Umzdks(Pc65Ivw|^(`K(Pl zn@4RwT6+4o@B6m#_7;z$+3$vKX@B8ouP?JU9yu^xJ>_vz-?c+Wzuk7$G|TR`^RVyd z-nCn@D1X(<(fScVymxPI>FJvcnm3^N)%inPq%^b3GhuNwbT14(>$rK3Ru{8~Tegnf z8s2Tne3}=r}=|&6dL5X?RJ^u4DR?|?s_MlJ1h@DLrEsvSE?XsW$_;2Ae*Gl#Do(+6s z%eEPFdACBcr^ffs5Hq*i7XLn)n%V(pXZ}{xyHo0Jfduo%3(~m9q@14KTr|<2@ zj(vLJ+=$$Q<(zYjSoIO=$qOA^{5VT-=NRP$5d$@Q6+LP1(8~Ae#&x~)y9g)kY5v7% zw72DiyG~awKMdCGcuU-MlDU})Q@zpGFDbT}4Fb9dE}LB4efFZ4@Is>>N=>z%D;tNk zX_u@#?W4m@hoT|rp%*i`BAcEq_IKIH+wt?p2V z%x0ZeO`eS{y6UjjXd-=U+wS!TBt@aIJ?-g3fgVwds+ofTakfLrgsN3Bb&g(51 zt2=eiV8z8}=v|5W@%(_hleJ&MfiB4pm2PXVT$~p+X{D3i+68B~bWE_h|NFS3xdqzW=CAVIpA`U^lSGg&12uVH2k(| z$%zS~=brbiqb{FOnKFO(b>6_8U6MOJ8j`ScmY>Gj|3-DmF#h6jz)#p?%dWNyH{H8; z+&pxoudtQ(kt2I-x<6j!`A<>Ck4wXP-aohH4)(VB*OMb&Yp(7$H|~Dis&8tuUp=rN z^|Jf)d4s;R?78J-GehpIudX+x7Z`$@5%UW6Y|~5nwmNLTUIT3H$EX33Pqu&SI5~Z( zOGNW!UJqD#Y0smQZIrMmaaw%t$L$f4Ws{%bLs#y;P;jC6c+vE8(o=4k?^1^prKetL zqWQJK4ovW&N6ta^$#q=#|1`$Mv>ZLj-(!NE%C`92&mksz|FOSq`D0wmZXxbTq8Wn5 zdHT!!GkRW$+CHy&N9`A@Hzf}=4%}xl`G(=eACunfGw)_?V)5#!j@C%EUXwgh8b1wN z(NE>u{Wlw?Ex4}B+@_jvGCcV6Chx(W=i7c9mDAN_RmM+~)DbK5pYCkDME!m9$-$=I z_om#_H#}$c^33{EXAg!%bFC8+cE9NV^dOvgH&?SbdL{jzPPQ3%`?%s_dz;>#qRhZ^ zktVv)LpqK3p7QqT_+1m59~7&%Wat6)o)p^CpecM%9_8NNe zL{cBMu%4%fb^Y{4{d{k`f`)^N#0G25ISc=7KftJ4-=M83qvi}=Y0K%WjA^|&aP9E? z>xl#UXf;{h+%0n7v^}Gn?{@W?d2qzhnXKT&@dvWfIiv3W*uHUzuR&4Vkz0Gin-ruw z&-3oH>W0^2;TX35nnnj2Nt-nJp4dQ1=^}$QD*EoA_~%`7(^`J{`g~e?{DWP|Td=vk zKY7KtJehD~Py0Qe9F-gCEDrCIG{NSSYY30e;d#Zg4D}q%uDS0^*O+y+$!Xo>wA5D2 z7s{qPl)O{ge=lk|b)b1cyvj;tlLr0o*sW}M@K z`1w=Q(Q#q8&YE#94SR5lTFqL&aor8(>`o_?*0jE^(s_~6u09+U-?aXrGkwi&Mk}>) zN=a!mW~Itf>!hrC8q=1%nRIhUlO4}b?>uya*?B~W%Ffgn^@1E9?Z(f4bht70U2@kE zjYoYPl{`!7D-7Xzb49Lv_|M`4c_M$55iAt=NW8^N9{i8O!XS>AC*aHS9mzZ^ULbccbG)HP zZzj{3>y1DlYJ{SrxZ&_>46kmSKna2}@o*RN#0ayEy$#bBii(&aC{HAZ#*!xlJOUvq zJjla|8zg`#_G9`;f&+Qp95L62ENEwA$7Zqwd@+|VX1at2(_FB_AVoy8;mQ|s{dgiV zSBP*BWsoo|K~S)Ok4oBD0vW{pXbC5f=gZ>?A#UX1SgHg%!w0BQr9}3eAetU68xq-^ zkRQqH8ten=0+L*Q2u~>B2O(M_G2%jG9!yF?@`z{y;vf#+hY7WT&>EFW%_)TySqTDt z2=)w1^L>dlk+Z)*DE5|!30Y(+6H%!mSqkWq)}JdMMUdX*mCsbvKB`pSRK!z%50;Qi ziX^KEvLfUajyNk-H6Xi;AXMxvso8-jgN4q^_L=fq^K_3gmM5 zl3-`D(Gu!$7ITDz#g(>XdDAB}CaXfqY-DknrO0uwUj7M6#wTvpKpn6cF&O1QKYOa_x}R zHkTu$Q~;JF3H=*1nlgd_*opQGT;%DPi&gLQ4Psj;k@_eAp z5T2^EJ(X!Q<~|`@Fa{B-5ILUcWG+yErXWTh7Ae%3=f|g+HS%y)5RI~N@EUT6M3&q@ zu7a_#0y!cPvjVQk3}lng{wt_MS>vg=;uK9m(QM31eIwZsgoy_e@|cT6+#s*OaMDr~ zy*aQ+=E?PGa@9jsfqah#WGK0&O#>Gn987gK$o^bGFcD}Gb#hM5_V8xnF@3tcJ+mC_ zdZ9u@--XPLi5z`tPlDbgq$-0s-dr%HDH3QssJ|%JQP}ao00>xL(zu{U0lNclCKMo( zFK>kMoX9#q1s4aVKy>l6Jt``^0-LiEa=A^vcN6WNnVfWeI}AQ7Rf- z5N^Vb?8k|B|F2`d^X?55?rak&ta6gPY{o9Aryp) zxR!x_Y@tvfwDIE$gj^fq9nx4FzBe}zUYvtDp?tC&nWpC;5j*%=@ zd5qVL_lysWLdHi%5#tl%GozUCh4Gc~jq#oFlTpHuGP>g3@jJm8gb%~RaV|a`cfu#*L-0xXaJ(DtfrsHU@Y%R4J`tDT=D0UL z1|N&}!VPg_+y?K5o8rE>03QHYN8#geH{21Qg*3?^E<{O7IUdT} zHkm?HKh$qdF;)Fwh{!&qP{9bIpa9GR@(bmRFXt0sDI@^)8m@u@(lm%)unQ;-7l8nb zk&My5*^p0K8pTt-R9Wtl68V&U5)hDI5)%^-*R*NVl*xR`KI!~VPT<3J;)=Lp zqLjH8Omob~az#WrCod!h(1JclRsbcj1R^mcTX6zKTs9xg2k5?~483xGQC=?wgv+c* zeoJj%1IMh* z^5^jVxY|8v{c(K4QBiIv>Ck080QEwNheU)v5{({UBu036cMcEO5K=jSgXk7eDv4>l zCy4@jd}8qDVaMU2*)!@z(2xd7SU`8|3`09&Vnjld6>1?7iv|3eYfrBt^*L%IgF~7r zpDR-Xnw$bh6)S5zODqgzhlquQ<%vATgG_!xu1I9$!4Bhz>1>jBP*W*@p@+Gx?RYt? z9tw8q8tfWOj7Yhp#55)tkO4m;4|i@L%o1cBvcqHt8iF3j((5XOz1j=N+Eqm6P1Lx^ zgXrNYRvZOT7a%Wq+ z2|=B_h2g}jCdM{a>7L@p==x$2e@I8hWh^Epa|j}y}{@cQi(SMed6YX zi9~@R0LKmEMi3GG5HCJgjN%kMLwR~e{S6F!xN;ODP2{r`vOK96CrlhD(ua93g>Zm; z2{gHpL+2@rPv#1}xIzJuM=<8Cz@@jypCb%bU^5`tk5&sBVGBhZeMq7dgHp);VVCTse__}b2D-Nq_jX1q zV+Ug=gMp)4@oJ2tJ5laV!sYJ;_yT+hzO3Axf}?v2zEkerg_quY@$&b6y!1YdAN$4q zFRplB!LQ(VWcPiXydUD|UWD&}`x$jFg7`BkZ4rJ$?k3^>!T*8WMfghmBCd{UV)OCU z_y+tMo`Y}1cN2L_aryf=q|-Tw&H=cOL-}Ol{UGsv9DdPVN==^1T!21~pQP?fIC_tp@kXX>BVy|SG67G8 zkc_XuFTk_>jY^Yc*5RA+ZA6J}R9Y&;7UD;V-(>hb0Wp-akGkoS2tE}8O@)LwgP#LF z_u-1q1&q>CG`59Mn#8*h|G_}m5ljNu+#UQbJ{Nz1zXI8j4Wi#;_+j{+3-=PRy{$xS zE!f#yygh{F#C;Rb!sp?u@b&mrJR3?O=+ZK4@l8oYkTmh)%fNMY4 z^f7pE40gQ>xG1GI7xY0>LEJE)O`OKhg0=jMU&gQF3mCib+xUO@J^Z{}Da7>xz_kE) z+zYL23j@))15dI}&oIdQIi88r?`Ifi8HXUY2H%b^#!tcTAzYQXOCc(Iqsy$p(VHUF zX@VB{yNAe2gI`trG~*Helz=CxDV9Rqlue=IBo+BmBz8J~IsRD2gHjY8MFs{u>6?6K zL@7r#g!~3nIwK0D%fr#|rB4K{0_6}~LkOkN48SBGLlAVFd_!dsO_WOKkeHRJvSptL zu9U~pGDs#eR!S2iFTy_)4jQHzlz%QWzbHFDDV<+1VW!2z)iA`>DFzlr;jGD{qWO_* zeu5Acl)0$+6Wu>mN{i~BD#$1LulK{H(lm9cG)e^)7;qw#U`o=`fZ-(=ro@2qAS4;0 z;F$)A?=dB%FPIWuK|tvh=Ka8MB_RA00-%#!N|+L+p`k&<^^`EIHN5FTKq*WJN|-YI zV!u#r6qy+nMZln6c*WAv(%=a%7?490fh_TWU&H~)hQf#-(pY{N;tdPKC{B$Q=qNFC z5y8L%MlUctLgN^;_{j4{31#Ed@TQ+UUaq&d99o4~WPf=;Gz=p+qBxMn$9Ls~`isTE zK4`4tLA{GSy#sl$SPGeF07qt_Hy9+5!#E}hKx9+EB2Too2%A9&5QL%tt&kPqxgiIL0`7nKiyb!KF6lVGJ0)5at&YtV1P?qLE!spR*N@AxBO#uVLdm~)T zPyxTY7_o`wy)=hBaYam0?2)`G5UPqv_)HXd7NM<5rob1ie=|iAFG^7&Sh+=WNUo1Q z(*?95pMww+!kbhkydy^lnxmvIs{kRnIu3*@R$i_7q7b9?`${UMlrKkt2>wwE=1jUy zN^2z4pUbD$@qO&Le2Hw|#r>BS#Ii)dEK7x&D32a&2H6@~b`O*@9GTJCqKpc0z|@sk zEr6X7azg6^g$Quc1T1;JzFg40H`h%NC<)@CN+?Z3Ya_&NaA_u5+8$+5o)%z-wFRb} znaa2$DcM>4S`}17Li(VLlnr}cLT)wNqFixU8=^3jrwE!Xt3^byas|RV6lzflK0u+i zOU0yi;JD?LqflDjgRm@R#Va-fwDbT<<%Do}fv9yOaGFj9jhHqaxoW7Hw;&i|SyqOc zs%26kmH0tQ_teAMqRMKlq)wn3iE6Qi^)~V>2i0PIcN!B2=ONDeEVF zBH@6`+CguomqaXU+pyLKu3x5i+N%=VZi;@NV3LxyJZW;}huW^AI}SeCNsxPa<;<({ z)=p6&t(6CsLDmN>8VzPnL;ex=k0fY!aQZalrbS$|`-0-#Pr`vgd`DVH{A@{O!; zw6s}Cb;;Qv;opePu6+9{*ED3tO23p>5$d>T`&Q61**fTg6*Z6wwacu~UM=o(-rBVV=>8L9&Ym`u$sBPlM zoYqol?a7jy$Zpc7G>cAAAW1c$N_$hpEj<*09#5fcosAGErmEEw!|k&dt zMlQe+jXQ*D3I01l80qD8f*m6U-flSzL>(>LoEFIkKt)0v*+3@bfc6M=a zVtd*;kPGzo0&(dE7UV1DLV~L!QFNHLy+E7V1&}X-@H;xO9nAqJ1qz!@aF8=_8f(Bn z)<6?Wt3Cs*EX@0u46?B7W6m+Lvz2uefx%nhUy2x zdbqbfjED3&lD?cU7h7j@Cr4K&TN`^T2XhMtR~KD-0lDeo0-JN5_5#v~MAW_!72}3^ z2XcaV-fZGY?4{U1C#h=>WtgV&! zlrog5i+0rHilC@2xql*;N+tjS5e&NJ(#Zr}*!z%6gc$5TqO*VS!*u6Og{dR?Ya!G{ zr$wNfkpm}p@odQHBHDALv~NyMr788IBXw|wG!&g@DzmlZ!}aAz0>z$Q96p?<)b|Ps zwjkatc;X;VFfffaf8_|02}l^OSRonW)C7cwI!ZKWC1gM`i(Lr13#GG_Pd zZ)D8wGr+`v)yKqS5UbCi0Rs&Bur19kER6>l4eUSAa=I?LgC$3dOptB=QCMYhvbEF3 zK*hXa^>bJ}pM9&nNM z4Aq1-@8QraoDd+7vO=Tu2@Hg>8o6z6$t6!aL*3fINm#k48ypBFXN@Ez8sIzdQI~;s zk!?9%+(7cQ1X>m#LF@$xhlqwDw{R_?g2@&}v{SBZ2OS!Nmq1n)p{K11niKs>KP@;y z87NvuK!nh%-x5s0VVrhQ_5E(u#Y`j;NxAT-RVYJxQDa9fJxmM?4aUQcwWW=d2iO8#aa8w67e|A)ib~ti>vSXF z*sd%>9JpbYJsd*x%`6uuTW8cW8&P}evIOHE%pT;XIH=Hv<H{lGhWg$dFS!;mUaswsMhD+!i2TV^Tlijr?2XWy94e+5h*${V&`J=>886>u zd5}GqJT$mFegvEfA>F(O!6s_|^2AZs?IE8)dT@{N@;yGB^M~_0$mvlMvf$kBWI94l z?xCL}JSLAc4MLOpOs0)5xqQok4@J<#fExm5Czx=!+?zNq074k)4VlPHV zfkeI0LN^dYi~>HAGRY)D$ORWm&hXM$wt6sq1WZ1RMg2J;T=))0Ao25OA`@eZ2zsT<4CrGJ zBnG%ywDt_kqatbnn_h1efkMZ^jNF^UXL5M}i_ZKb&(0K~H96u;bLk3u1x)oOYf>P9 zeiM{NRUi`%?8x>PM6mD-S%Jj5F0mJ&C+b0zBe?muw6ONNWl@pf3Brh6XA1P%# zRRQGui32CJLkZgg?36JfY2my~nTnIG--EZLSp>b(b2o1o{=kBg5Qzfw2e4vfri2z0 z4S-k|BMg-;BC|(gXpQ&)Sz&pKi*Qw7qqGEy;=o=Ee1k-`FE99@hHOU)r@3gh3Ee1~ z8Z~2O$~?cEXK@(ip$pS>kc~qeSm#q~a;P$prz2{QY+b~OY$Upu>JS6M{k>CKdVf+MhX z2;e)&4O^&Ms!F)R?%?pKFaDUm@Yx!2Mew1WI2`JQn3WN}ot%Kl3XyIZP9cL6S8&3B zO(5if+k|~X;=>`-<|Kizja^EU^mfFGnylfVCXPlQ&|%2@IMf6ax>>*vos7sI(G+tg zL*E9dgs6{&1X?6o1byT^jF4h0=pg_9=&XOyO?#uyYhm*P{1ZBwP>DP4&E$v?4B^#z z&^edwsbn=&)1Fqoo!JZEShQ@Q^y|J17SXs|ANZ_|-j9$QW9gS!9HY7^h2}!LCSn{x zxTflkDC&E}tmrY2lR>RQZXO}8LQ+%@`RNiHW z0A7MH*l~t29Np;Y)pht(7QV_9!Dx_Jp@R;UoC`+x@IhS};`06D zaI{K5oUjLn4}UBHzHSzk8Jm%V2ztsxx>Istz@>E9Pt+_rSwwujPfy&mQIpk%Gc%=t z&>lE)<9-^Rv>uqx5q42JIMpVH9oqWxRfZPRJV+LZ8g>n4I`FwnVhbR`xpev>_6OI( zhqjEW6M6s%`V$7o!az%<$`sr4vHMx}&vTrty$-S_-Yge1?=Uf@GLzGUV%E zUGhmZn89dOfsm$hi&EsH>?Ee9Hblz-1AVAC_=lP%$tx4~xj{#Y^yo%PcgsHIRHg_| zME~C08xUD6~jf_-xLd@8rMB4uLk<3X`?4ftLnN00R5FoD3X2&OUG)jc`s;r zIjp`l;-fXt*8@~E4^`1d`704^RAF$@_OE9twAx`_a~(kYlhLlO{HuVjV*5Kayt@8| zU|Q}6**`6Nb?GmK@@4Jc$nqmAm)*NYx<_mv|5H=?CQwdMe%k*^&3l{gw%lGb|4YzE z&AGbrkAnK2Gaqq}VP+%jt^6$y4|`>4%-U-~rq$$E1LQ}pv@3+_(q9M622(`LMs&3J z&VJ1P!P2X-?h%UGw7>O0AN5!0G8=KlVypSv!G*u!e`{L*8-TtlNgkUCbukMBi(;%FNkPhJ-gbWB5A)JSB3Bm;k4H}T} zm*M>igsTv)LAVa#285dsZb7&W;SPlVAl!wJ1>rt~2M``Ycm&}wgeMT5LU;z@IfNGw zUP8!(@CpLrEgPOW5ON{pL3j-zAHo|51rXjscn9Gf0BJA@w)enKdLAccT|Y!-HOOB@La$dea?bqt1}1U3Q>Y$&wUbTu+S0aS>%067)~ zZ}fL24h+l{objK(F{zRZFyg|%9RDFUhGV17rUYj1-4n z49w#9@sYgwF|c93g^S`TfPoFJJsy&mAO<#|mN+Obf*F`eZ7`7ZMGVZa#-%CBAq-5v zW@Sm5Sc~#a59*{>4RBE$U>$#11_LY9`z3@NBNT7Ca!J1^I+g*0`Rahuoc5^}G>s8+ zWnkJ>m!Nnyp^Mez30|;El@w_12UQ7K8EMRpfpz+IX-W#S%1~4{-G%{^+sc7yS^kh; zvSwgfl~JQ48d*6rHO*l$ur`%YqviU;Jp)i|RS`u>Hm90OP&K?c18ZK6A}w7V_1ME1 z@cC*P)+hRI8>mz5n?Va_glIvEj5ved^LSY20QswR-VA<}|hc$+E%3tgdehT92GM zCxx+ST9fKpDodJ@XB|t0v1v;G6J?rMxAkO2>#mMRX4W(vSc<8;8}-pmX-ebkkPsSo zQRAORG`%{N48~h3lsuR!O|ecT1d4KFS{0gR9nKnnVwqWkGEH@Coz*3bCehZ7;?1Dx zjwzF&2=*H>pxUy6;`9i!4&@#2>v?aTNepx~E0DN!2H{>|?(bIs29#lQw4$3D&%0Ha zSy6!+r2*Zl)->v9)(@1cTDyTo{6BvK-L{pYrER;8WbVg+o$N|QqH4NMqz1~>S(kIJ zoV!}*U_cukys7l2NG`rbmiRDG6zXry*1Z5klUDnb*_SM+S2Pla-hzv zf;!!IIaX>ERUxP(A81#9McttiB(-G<1M1pUsCj4jF#WF;ySEdDp2oUJ?gUBA5~5G>M(=>{hIFZ{lQ%s zpx&d}($HS-kILT{9crzPrU)3S_5VQ)0R7tR+uBs0=PDpE;GlOEFbevibTC38u_g%0 zzykd~Ws-i4nzjS$8kMRXC(=Oe_TjB6M_Q8{px?KKvixx!^kKk3?V2zRu#_eIAuRw0 zwLVGlr_Ra%4@NcBf=myVHB?`Pgn$F%3NwC! zE{0ctxF(DtP5kz$HSD)_(Sv~v`3*_vR`T2006vEP1|M`gF|A1zl!pZ_hW!o~va$7V zVgWu(e~S-VA4AK_Sp5{>;s^0KBf!TW@PU+0eyiO9ClaANuU8jD|7A3kM|^{=jVD8d0Je{cp)>7|zAUEpQppRpB$h2o`_dg;o*{^;t= z?`a0OvHf$Jk?E#Zr^SJnKfG>9>84h*Mc~H%PijV{8zaSbQk@v^^2gWmDc#g!Jps6> zqi>I}TIi+=1FM5Qp4w{%_;LEPb|dF=460)-@-VZdaUtFsd!wbKxAG^TDeB-2svs_mu}0{E%Jb3&Ak zYP9WeFxzN&GC4)_YFH@;|nF{{!Sa5cI9 zxRU9sa}_i(;482Sn5smpQ9k7*s?=8-1{PGGd{tj#z!|?@Iiqc?)2|f`dRoCW_9;@5)JB3JeeN{3$+u74YoeUnp##x(2MTgbjp`lY^rt9tbKjcL38<@W)= zQ@!=s&1jC=Rc=+lPd$ydG-z&q@zn@$Q!nG>mNYL~m1zbzsfW2uYnqR?jLI0nTGqo{ zv@OL)lX73>)d%%<6m<=`?;e3}9j{Y#q^JTV9K1c!bDgdqF)4bm2vLVCd0iK-$jDnybG`e2b%0^z+A;JP^=Sp={1VWw zPa7!XFM)bJ&90Ui77^bX*{>)NsZYWv7 zOpDY8tY_&}7pbyRKg30)nuRZYYqUaDHxj{d)EfPLj;f@BRm?us)er$!M>Pejvo-vy z8&ydLEBCcn%dDGPgH`@o{3VI1B!n~cwOsG58!4H!{`&~ZO7MR<;>ya(m@2NMtfbuP zmn{)aeg4L3ImljaT|`;AIi%vsWm^KkR_a?|OZ&IJbyrqW!<3YP0*(V=_-`peejMah zQdaw=^lkpY_uN2L;d~#iq@;u^m-D`eyJl!wQ+oeOBe0lgAqQGos77zfO7MS5HUK>+ zDZ_u6p#qP_ztjgfZ1(R{1q_G^Y?x6us6ztRdULHxllGL@C! ze{dssYlHYuMgN@_M3q&3siOvUvJVLK={_5jB~u2iLGp=Ai?l3c+Em`J^i@~i1t}{v zBvl1}CY81?6{vK?R)b$^4|A(THbqHm9Fyq}d|qV~WZFa6fmIUj@8}O~4OfO%p#@q) zHV6OzB922``EO|tHar;^t&{Q^L^WHQO0-*Ll<;@72mf;laxu!FJ)}JJzwCiB8!CY= ziHyoeo^@z{aF~^$q*S5hLTB7WW|+WZW9X@nHvf|L(0@M&w$=iE8lujM&|Wj(33))o zQ)x}pZ`8V6-L>A$r;!Xp@RFD&f;ROc&12b^+*Yu?c z2c1egO_|j}?I9&9w+2g8`dh6N)Pf`Zp#LBh9ETDPdV}X*(-pKeWvmVG(Lf0Uy_LC% zvB_U*iJ&RMww0mj;i}-uKvOVY`-|<6@JniFG=$UyUKKQ>CFlBS<$*i|#?Jtje(Lkuw z@Cct)kp|_V{)Yb0ECG0c{u9mDN!=;Ie~|K*Y)_rm5#kB;62OOc1>O$8z$Rsr*uT?q zOKlGE0;@a?2vveD{w3|np9nys@2<2q<({Z16MYJu_IGsG492>^in2P4;E>kPsJH3g z(p%YcG|JF*!Q@W`dRtQP9V*LoybYqik4)*3-Q3Q6-?k0fiY7Mj;uBdA9qX(_DO+Jluofu-Xp-UO25o)`uR z5GO$8(y8*aAOJ+aR`irgF)Ru)sue&>X)`eFIg~-=P(T;jIbbqj?-8zCIK8C{PbL$^ zFl;OA;;O+ur5?O9A(%lxo6P8n0$BPYOVhC^ilHcqFL**yT3Q-B;RQp)(L+i;;Fsiw zVhFP2E)}U%IwM$?pi&I+;^JZ|K{a#+#HBMrL&*fyILI#vE%v=YCJ^~0aUmg80-2x7 z_w@~oLl9(scJ`dmh>XxEh!f@CX8X+uy+Fhf{*t$lP#jSvpNy0Fe!!7je)bGtD73V^ zpR`zPX(=l&jfDIwXJz@)$k5`@2r`c77nkIOhMt$pFV4;m43x{4M*8|*5to)PE)EIw zBja(1FmcJ{OUV=@-;6NJ33K9R6r&Ur|6&aYOGgSQkJ*+w(qL^yukO^H3B15Kq9H2_n(#+xu?{5gCe*1$5 z5^>cIGgPLT2tE(T?<07?@V@0q)mDO{fl)*hQ&o*Jh&HxTodeMlY=-m;rY?Pt;nL?| zArOW`P=}xb0sm9sJ>dER;Rl2gzzvqCE{(#5E84j#hOQ`O;z9l>c$z54gk-R3;sL+# zO4xbY<23C3rOnu#_fl-{ODQ(*jue}GUW$!4BE`CG2WluRe2igJk7AhDQVbg@!Z0I8 z>`o@YX8?REz|RMG5x~0xtSbZ?fFB0%h5+9U;M)Q`;N80y;O7DSWPl$5@ZA6wG>KsV zj{!Ue@EE|upWx2~_zZwg1^D>@F9LXXfOmy9Xan%W0NxPby8(P#fPWA0F9H4zz@G>B zBLKf0;I{+(LV%wN@Lm8v65x#hUJCG1fR_Ti6yT)*F9rA#xF5rP6z-*Pi{N%7;NJuM zOMt%v@aF;k2*4xk+W~qZKu-l|FMu8i&_;ki6W}udJ{92S1H1^}-2vVe;B5eY7{D6> zd^dn^3-EwGIbsdH3S_;)Ag6eW~#IW}O{}SNu0Q`A?KLYUE0lpIR!7>3p1K?8uem=m90Nx$o zD={Cydk5PK@bdtEGQf`j_-+7SnS$;}GXXvW;8Ov9KEQ*frS2eD#R|FuEqSl>CBWYS z`11gN1mHnAl_=;AbOd`L%!4o)!Uzc6AXKKH!oorRYF_iIBxw&B@M~=iyO-(T)BO^>#R~Kv7t{tYP zriQ)$F2z!kldIcLz0S)auGg=jb(On{b22kOqwD48%$%HZAYW9nUcG!tWWUVJoRw9q z2vJa+6F`>Ne)$;yv;(pfa1^|z%g1WJ%+$^+C@9DZki$`0J|_0Fb{t$m)A9mxir-Lt zmX?o6(vFJ_4-X0gfSlsILJ~l(d=ilzpdBC(06-84AYVQPNwMKbekdPMQTe3sSkNCqKPRVx@}ILv{RK@E zL`LS7=l^9EReqX4P!avlS+RK}{YuJzj*ZL9)7B2Cto+L?kbc@UlwBeH&lG?lG6x0{ za{9}9l}TTDaZp?(z)zn492IntCYY5K0RI%q7r)B9OI_O9pcnuT00q(YS9~|Gps?_5 z0o=$^wN+FAL{5Kq3kr)Hy@ESOqFJC>P@I*iU7QEw9J>77!h*NbS+i#4yvqyF&dkv) zD99loDE{Bvl@ud@S44J!0WV1odim2hBpe=lxk~B3SMW@28b2p ze-0>kSDddYc{l6TECe7457*4srpjYjLGkB+Vol9}EQ#hU;G_{?k-W`Uk>vw`re<-# zymu}0G+#^S0TTAx;@73wfZ#J{rRnkX3DpfNl+Z{iAM7Fs4=CSScwT&fUPQCEnEhC-Yk@Dr%#qc}AKP{CAzlPD~dCOIFXQW#ZI z0Av&rR0sfdA{YI_uIMBu(g21X zp=36rp1*qBfK0W{$JDR`jjnb%qGWrui;F)`#0(Y+{Dhn!rZg|<9SZRa<=vMzaZfL&gQwN~c8zlbAA65i%P95iI&4p5!A*2g80s>WHprocfE)0K<|YJD7=K9ex2;E(_oT z%O#d3=!>~wVu;>q3O|T1B&$pac!!ILVUzTQJ{&Oz!|pa96EO5OLJJ6Tml;fy^@ZF( zfj5SoKjp`&4ZF-Dq@A#M`Tc*Vrx67!fe$)}i$31XdA2@k|A z6EYy#vsfB+#=vGyE473#k^;~3%Es8l@#zVcI?DNt)lXd^T^Fz+%>^PMvKjHNN3Ls}RehSja+~#f|YEw{5Q(yH{ zw|wJUS((jkr8@hT=r+LQm$i(RO%Mb9uq%(Larse zj~yG&c1dJUa+FHOWUxn|R`34`YE3E;$4e&VZfcBSF=^^Co1qg;WRGx6Wa~Kk-y!pJ zXF+BndxB$P%F6)Ik~RU|M<=phIZ8D#go6F*Ji7@N&-PDXJDTM; zPGC<+oZTP>hy%(*_G}QsKX)A=RU+FKm^E?qKS40%pTV|8vgKZYL!?Lulqc0xhD;=0 z5@eA|0A0-XUk%BQ8SF_&Yq?2K0!%YFKuIcb0WIb3`ze)1pKUrjO+3L}dKXCI8GuR^ z%0TqI^1vbIEe9$AI!hqZ%F+KHngL6K0c#Rn7ia0+M7vg_@pP&z#Lp{h^)`ba=6Opk zB`g6%N<@n7b$SSUg8HmmAQu2de_=$bB4A6c5)84E@B=JS;*uK;&#`02drpi#7kDw< zHQ`P4n^w@!PJ!Yux7;z13-w-<>i{na(^WxLMe*$S?zz_qX<9*4s)?!z)G-eYncQ-_ zA%ux`Z$>*FPwRqdIJ?KQRpTXZaudLyq!QKK7APOeIlJf1g`|Z0F^|+^PJ<=~vEQi2 zph19J?hD`_$o|N^4=>2pz9g~{?H}Yh6k%7T9N$&4?@=a963fHpzsi@!es zr%S|s0JRSACWmGOk^KoyRwEW91{5NoaLNF(+}v{?K%P|c#b1Mfd_u&2K>BT>3~-Zc z1?&Mtt|`H$RPw%58QVb+B-sXdLWX}4s_5M1P&5y%{v9ubxU)afkbCYdNOjA7^NmoP z>S#xjb&wjE$#sTI5VZ3kwrWT_#14|wJ=Y$RohcbD;9ZV=#4oVfjx5+76>NLWKCUVziwDJWsA=S1VQ@fXi1V_*`aOAW#rGTjosl3wOMWCk#UNqaayLS^9zFdBCRUC~6E|^ohZN8bSiU>0oX8IDM5A}hjR#o&=TOZ5 z4pBB7;_kWczkUsH!UCcsRK1Oug#*^z zyl`&33i#dpl)EOWbSvy7z%I_u~nN5l*K@~BmTFZue?52BU0oCrePuaLu(*25R})$e%erGvo>H!$tO=PAA)9=l`P zoPXPXc=V2(hGQchIEkQ~3%t+&4mUFA+}8^jFuM2w9nM6}XfQ)e-iPST9nkS%RbRmV zmYu;X6NPLhZ_A+)jRa#Go6Q!}PYYrJS_sCfInD(3GB2`i4zFtZldiwOVG)DDxOo`4 z1p*8kf&*?7(>l1_9B{`V(^L@+@%-yYpt7S$Myq#$Rp7G0=G^{zyjxV^yd_rhrKxeO zD21R#=;J#tsXSR(9PeHjpUR{Vi)n1!J`W@QFKAEbqEO)pxDy9A;eXEbR8$^OUyt{Q z*W(?q8q(j0A3=o1g?Vu9$Vs2rb6C|=;EJZly!gJ^t*(BZM#uRR+o5mTfq_{-Zm-85 z7YlQC+!5bbS{$ipA(KHCWg%kx2FD(- zq3}B?3&Drq4)|2bmw<6c4$P6{gkjPkF>;$XJ-LdLMB+RESC1dDFg_aEJfiBcW2k;H zY)DlTlxfbZ=g+OonGq51&c0|EiW8lX8U?{Z+EurKeMBGX>7DKo+07QlcLH|~A9vH+ z_(N#b%$c4nrZj+}kE=>!6^?{NgN9VKMQ#g2VuvME4MFITs^-c+=T&q>qNhliGcFjd zAbsINRswC9)W)-mpFOCN+spqB^1qY(A1D7KWr7}_hh^ePST;U?l8#@0 z94429`)qtlCkruH=Sj?*kdrvUiCZzKe_X=gL2FD?KsEnLO6W(=)bznuqHry%Uor-QpSxlv`X_#Y%RLy*bC}$p%|v2WF|X zwMJMH7_jseIgCMF znKczBYb_Df1rCC{QaHd%Jm@DN*TKLXEOVC8$bBI4jz`!~;L$e}SPn4`)Jbkajz; z1X&J_kBJ))KekW5{*Wj9F$oFEgPXX1P$?=#WgEpm|3lDb&`*g9OIQnpIS^KA37gHf zg|OPLzp`Csc+$d>)6<1LXh^CvJv~0pnUs_5j1fcn#`o_Z-bKa@4DO$ml$aiqE>{JA z47wpbYkXpQAGZ^&Z>ufclkHA-X2uAyQQjxHrs95`y3cUo{y8%oNFEXA9G^3xx7(RG zNr;=`2M>%lvyq}O`-jlB+^wUQY|*cX3dn0G-~{0A^MrW$Vj&*5K!}yivF?fcXK-H( zcn0^)k+u^c5^y76Bp?lt1DFj^`-XUCjfN%AdLlhBCo?J4>6V3!&B|~=0!D)~x)YD= zA^J7@MH{irzNHjaC$uKgc96NSEAc#^bTS$dW|f%lTu^vA%?;~#F-6ZE)kG! zSei3;uro1vfRkJe9uha?=q_))Hak;qEE&4G_vCpkaTtXV$&sUbyA#1;Oux}4ucHS$ z)18SP=jfEQbf;nr1#l&gC!y25FkY4cH?-3wopy9S+BvjK>n_eN4|Lhw<^3*N_+{ZS z;cte26&}%bVApY7XLeoI^@*+@bv@kmWY>^xmv)Qj7T0ZLx5?e!@AgBt-@Ao&Kezk5 z?kl>#(EZ)+d%Cx}wqwMD5syba+@n!sWaOa8(UCckpGG$6d3Dd|p5uF#_k6SGuAaT3 zvZJO&d7}!W7DO$MDveqZ^=Q2md_Y784~+7p zYx=#pGXwlb|D2!CpCp~5E=6B@@aJ`LbDaOGC)D$)1>3hV@C3>4s!Y9JnK%D&3pmZ^ob@EtdX1%9Pw2{zXOR>Jq$VIT%IZWtqn?h^MO{ig z`0YIiXeN}$aJL&S66mZZgdb&XoLB@`*1~bpRkFs`8*#ERdUC)~%}B;ZFte5$G9Q;o+T|`mgiC z!@GoAuBPGPm&f_9=+5VL@%wORGyTyjIM(!sca;IAKRUdV^xMue=o#^yO}|PX-5L2S zN-8<>SN>QtxxtVvgaJry_}g3#FOwSyB>h+Ag3 zzu!pC1Tx-8Zu(X3%%Dpg^D~nx4k#_)q;RPCE>+y@K;*mf&me?eg1L0~^ZV4p&m3C$z$**_o%eGY;B z0s$@RD4{XhV@tHInL00ltG4|U4hLiYC-y&si()T%@mVVusn_*&)>|2dgCfu zG;_aS?iW+Tj;Z$oO0@`>LX~hhLmo@ztCexhycI3LXXWLf{ZVg^mB>8^bej;ej>m>?>^->`MK}sQpPKG!S5pd zK9WR%0$p|K&v_eCYe7gMZwLN{k6-_djD#)Y<*d zXZJs&fBOIN{%17)KfaC}Il^t)bzDb|?Ay2VnWgjUz&Nshzly(id2J+)9Ki1HeLI)V zyLb8W+7P}y0EB%z8NFvuO#(*_;6euXA{JK-gd_VTf)I$rT`lqZfWhgx>Se*$MwBP&)jec0fA9wNA@6g-obZuX8qTG#2e*Ph=+6>Sns=Z#+&7n2#7yfP%sY{ z_E3k^8h_^!6QTC_B|e1OHWgRohiRde>S<~zGdqL`SS83n26O}AAxG& zG_rC1jdqHaA1CYZD+j0OmS?7x%Sa-a73VIk!EX{mv#~zP`B*p3`;BbPZ%G z(|6h~dKTfu8bAP?3x5Lu=K9`CV2^z)#J^Xg&hVH?Kf=26yUgf+Z~pUNobLqx(mr6m z1AoALN5)&`JMah0ci<10@4#=J?}*@E9M<^`{nq&o{UaoAaF_tlo*E{`t#rZj#Kw%t%!fT#t6cH=PkqXvA3qiqRI;Kv3IoMfz^6I>l|5@9DBVlIWL zmI+)xbO53OXXig>-~T-O{wEs3Jpepm$AehX4Az<~MJ?`KCC<{ASAw zFK<58{ASAwuWmlo{6?nVSNHrzrk8eP?eiO%zOMNVq$ktYHNTPZFK>RcuKA6T9`Uu$ zZ_M-;)-k_f{7!Jzy-C5CU+n$vSk?ZjZ;l=NO2+%9FY}D}uMY0ryB`RMW_sWB#f<;y;K8r< z;CD>rUt@lQxe0aS*gi8paDGGnc^%@M7W6HboWH18ad7`WOq%PEFL1ylC)L)u4eyQA zoJKNz-PggdWcoT0ScF>B|J`eI4|$`W?1Evvv9Qqkwba>isJiw6gcwmrs=Yh3{bTeK*T2wsk@S)=;@`%m{3VC^J4{w<{lMgtg zKR5TzLtApmH!NGk=jMjqu_f0P%I6!(-}ppv@gmNMY595)FBkjyd_(yqW&XKfDdVlt zP-*S+`34caxmNobY3o_-eNwR6`+T?%Xzv5TV(&8>zr9Z%{dGOxFyl>o-{-g3`%G`K z_eqas#ic}s0HeIcg3tRaPXy_eE}>UC#LP-OlLPds1LSi*#EI(QrTGmw0l+i9AUxj- z!l)~sZSWaJt$^nkXYKd1=eL|azoqTj^IP~J^7Pm3{)7pCXrI1M%>!zGL~#hw`vjJ< z>v%+=(jPxmmkDpAKVFv!Z>F!yg!iSd!-V&xr;Ss~BMM*oY9>6yDlci2iQ|WAeMA8a z6@Lf_0got*)MotgL&s||;fZ9>$9W@G6P_`AeqoKbJfcv~KezyHNssA?GU3&rg?|}O zTmkaO`Rpd(lJubxM~H>&soTM|y`;7Kpc)zyA4w ziNN^U<_DxeqKr4Kd-M5-$*$x>)SMrf@zRy)O$yfh4J^c0pC43DUwwX1Bi@HlJN*JR zf$%;5sGi;;AnW`*}SNLvWMOkB^5vz7pqkaI(RLmpMo5cl|kpOy9{Mydcg zv$(4uViHJUz7nnN2+3X%@WSQ|Z1XASbJmXH}};-;DmLJdA` z_3))XmRSV*h#64`!#9Uj23CIUtZC3i&Ec}h+A0TMJyKH*B9=PyWns}HYaY-$TzG5` z(b@0;GwMy9x(HlJ4=H?f%{=`&gAi*DFeT0bLsIG?0viY9H$b72)>52nrDqfPZf;9o zX;cnum1bVjwdT>l>=#f6@+*b-pk0H&9GY8mz`g25s3^^;Bb$T4hPLR!jFLQ!pDtSy!^GtGh zTzD7U;dV~WNkhq;nc1GOQN44rv$HaX;#57nERM2fj_K{r%0)r5vn26kz7?J+CFMxT zN>6sW)g?KPzhz3LTk0Ixc-epRCO6-bfiS9WRY1_9aZ4f(hH?F#t2K`4+z;A)($-@3~&Y`@tK8A42N9z6<$23ursYQw1y6NveDL?qqXaH@wrhWrN`8W-L7g5K?7FYj9&=XCvM{>+=#>7;uK`NOu5 zS9ISm;wHxLjcNZUIcSLTcK{`o`|0KXH1c<-?1dx6ot2@w!X)+9ySvtoKNp>NS|&PA zcaAGtcHe(-7a!OmV>B8w3VrC%wCr>zJJK;%sP0YuJNj7$vfD?gK-mSG@8d^C4MkV# z!3*?B?6BM6*xJPG)azqqZ^~YOh>VgQZkEgGR^2*=40Nm>43=3A1g2!UGs5ym;|!7H z#LPtY<(}r>v8OWrJo;=lb)THo|fsvXy-|Cr@7>agz@=QSydC}01ner$*0M) z8c?Vs=@>&LEvvP_@jtMz7`o&L>r*R-Lyc)h-N*u==F&2AAPBc37N;9H(;4c_!!S-} z&Ah|nI7(k}3(r|loK>sf*c=?Tkb&bBa$K^OduQcY>W|~1thvO@Z2tg>i~@$o8(;>x zkT6gZEYk!xj(F%iCa`=%vN6zl`X^!_uHE`DnU~2Vi7wSh&<3L6lL7v+6DLs}r$E!v z9Z(+}KLH~oK*RgMu8~H-Egq-J9d<;Z?hSXQL)_9v39O8S#O$P0pFCNwuvws7Y5uXn z91&DVqgge7Y2I7B)k6bA@ID`3)0Tiv#!E2$fo_m5yp08?9q#G3hA~}r|9MQK)%=Cl z5*CQH#`YzCOYr*=Ht`OCrq$D)vMsRPW8?oCn_b(1u=%zSZ3}!YM6mV=-0Gaj= z&CYfui_36t2PEbV?LP!A{is2C@%~~!O!5@A(`2&&-XC&5Y^+Ton+!_}lXEYIRxcCP z*S;}A>8s;{eHiSuc|*LK*Y2$c3-TOqeQyJALs*iHyp6q0yiL8$yyu~m&Ak_RFZ4RR zt-J%~HZQoK;KG873N9|Vq~Owm76tz(xU8UMfuo>RLFQV?FywV+!;_kwE+A_}G!Oe@GQxV>O{!Hj~L1>S;L1+xo2 zEBL(Ni-Io;VhVc~#ummE#uxS}yrHmfVZXx13Lh_ASy*29MB%E!)rD&cpDbKk_*CJ# z!lw(LDSWnYec^_}jfI;ED+-@0++4V&aBJc7g)bDoSXf#3QsK*m=M>d1YEaa$=-i@4 zMU9IxiZY9`id;pLi`+$?qU@raqA5kWMR`S2i>4Lj7u{Yoy=X=e-a#&!RW!S3PSM<= zf}%p~8Y(WDS2Vxqj-mxc3ybb7T2xfFXw{rJf8PG^*&e5B|9lLs z`0!Gt57B)G!uss?Cv%66{R#W?87TDvpZ&Ku=1gr~t0ss3iTqzc{$|5q?k@mx3F6S4PK3xIWC+Z58rqUSsc6MvOpN;`#kU8;Y`E0?RF%kXK|*CVJ47xCdi~>6(C7Y zZZWTRPwl|5U-|n@$i#_B4i6{T$d$>>*(*>CQ-Lh`!j)B)2(mbQi3hsLSY)l3&t+cH z2r-r-Fpy^_x-q>sM|DSXR;JS!zhQxab)U_Wm^l^M)5Mdx#Kzs^oEo2;mK_`CxB|D4 zqZ0bX4RyjCf;`6H{-*em0}?%xoXJG$mpLUdJuTT0=T4jAjC73ZGA71Y9C2hNNpmmR zSg6Q#r@;i8V3t&s$dWJR&P56s3$dwAED6A$A&mvBzhFH^uH9HxF;FLoQxenC6UV1x z>4c)GE^LdTrRu}XJ8TF}z)H@6={N!M9G``cH~387NJktDV#z6G%Myh-2EgnxF~OG4 zIP|3oi|2ZfV}di=pVEWV#Zcy{kV^O%#|=)L)91;Scv4Q(BpO79Cb7n-6uxSKVT5%d zEFER@OB2p1X<0eYLKtJxh%~jtsw8SHDa!(xvb`VoL2daeYUx^N-6Q0y8H|$VK5tN)i@LzluaTU6xZp}4E@CFkvlO7 zA`LUFa;1MMP#{e5{(w$ymOI(#A=quOjH-lKsIp}538ZamNwUL}lY|!QNy$l1pBfh9 za6v3wJ2Pe~779iIAV-65G=_fJl&hg76w_38B+k4f^i`^lz=3oVvQr&c&&IU0S7Dlt|7Ct-F0zM)+ZpG#E=_1y9yla#ESOe|dvb+h;LNncTrE0IRuX;yVo zmJ4jDnOCjZwL@jML)kN^<8EgX`XC4906Ye>=8TF>I~|ASC9`9K%BQ1_)CwVDeA6se zno*f(DO`L7a!yK0T2dORyU-({awo8>L{B2;c_<7hP$QN8pf1do6~MI;4p2?$;1+ca zpPb*IR%GjCuK+ozbyBrH$w^K!RxK$vbnO9D!G_svK_Mcs+j zT+Sr9j;s_Md}L>3InuK-C&&_1uU#_EngpI@uAKuaT+jZC_>RFinvFIyNv)Ds9|!_l zJGxM{+G{j)*oiK^%Ooy8)KU4A&qg))MCgrC2c~Ev3e0u6_70@0!L0gohd0; z2?;Z%=r}c$F(&CuEHy)d1JUcI$lAf62ktl!W#&K)r}{AEvOVabYx(q2;HviQjA`e=&)5J#Uy+HitTVzXN;iv`HV<(Psou^U1)vE zs_(!-5Px0AOrMUntWs7poC4cRomzwpQ18f)id55FG9Iu@$w~(c#yA7THajE~!`IEL zazR7!6a@nS%mS1aod;NT+|*lI&c-98}|wU?Z~HeYqKrw;b}4qm;$w_8WtE_!VGt%O)mOW|9-dP`#&b zjITvgrTq-ep~#Z5u%eli?Lg8n_EZ=QnDo@jY+43NcLK%;Ss*;nQcI!6h?B`X@{^YSM*el7fDas(40y76)O!E#@0Ip=-XO z(P#SA7_#v|6Qe7nrCOCwzf_+l%La8dhFBDiR55OtAt)mi8VxrCOV(-7!7zVkqo!xj z%_(W_tV}j4m}EGm7FbHTYpJ(WSBhaF)JD-0c8hES)H_aNq)pA*_m9rXh*MSt%OSfx z=n~ru3OU|M8Q{=iEO?{$@i_C9i6G5aE>9vBf}oWc>ELr{Q0j_~pq__mni)&#IQ%gPkj(vz#ALO#{}2&$LT6 z^wxa(jkSB`s2fKj4=0?wF>NzU__1Q&i|t#E zyAT`3keGlL2-R@Q=gz9}S?O{EKpk-%WIkL_NcXqwYNS;s#yJi88L$Pr-IhfAdNEn<=~qyx z(P-y#c z&+mf?db%=XA{})pfjIzHn;K(`X0KG6iKB!D8N{fr)o*%nX~8#L#1l0SR=s>$gQty* z#t7+afJWc!Uoes#Wv!M1pU+t|4XZn7aN{}F%LNT(b^c8n7FgMJ2(-4!S9-yrOimsk zt21l-YRXZ)?VIa>=nQaFydyIwV?0{v5Vd$C2Se7ZTvo`>Z*R=+uADv{+RX*F03JB9 z$|R~b4dVtw9Q$PUl}4MaQ8`$Y!6R1I_}^MJcx>r5MmbJB%q0fc$gtS5(=dmSa}aa< zq{(L(K}f}A5}HCNE^R>dG}>I3=J#c->k4XD7>04skjv0hrF@W3p_#T79%ebQ=H!uk zzRWIIb=KxYkrv3HxZbgHh0R!XlU+{-6>RjHUB<|cDy;Sj;~e0RD@|o=t_MRA4ZD&{ zjWxPyXh)shbhW5THLtFx$jdS_t(NU+4hjEzT4C&7GzMOC zt;*0i7@OwYFf34g>ga1!tr|-0*Csv}aQ~kw5)A<6CpY-isY)w@tv_=&T%fxOJKU^4 z?l}$oaR+K`zbAtOf5A5E58LG|SAFcA^ZyoNA6?zQ66~=H{N05;cl<4_@w*p0@v8qG z#ooM{zm?dp7x;S;`}b=9sr`a~^#3&W{#E}yi`{^A|2AQ#AomLX@$W_KC#?S4jva>n z--p<3Sle$W_8`{&`xJWXxL(FqBYZ$Zwq!rn7btzN(_eazLRzxuv+?3 z?FnIM3roo2kb@zOv?f|h?XFr<)|T52OWsya7GTfBGTWQB#n{uVX^LhqZK9T?H5Sdq zBHMD?!?t&A2W<7U=HTEp@d$QaG{WxIhr|M;A$|*Rp+c5m56BiH)C?oOAFrQ*SzFpQ zw)K|OiP{7oRqnoCkNwxAt@dCa3b7l!F7#n-!449Y6Z0m2b(M_en2%DJa(dqO7WSPi z4hb=6Uaf^`-L;0}@_kJVq?)KhogsLzTgIH#&B8kz)n}FRwCY?42)3AG}jgOi&rHN(D&5ZZQ zU5tH3on{^N#?QKHmhcYqCL1&__VSk;@asfeKws}%aB;p&Ns1coLnJF7@;?L`LD|Vfe(ukHB+CuWGqJt(wQ8qJ?X-m zX3$K-o%&G@%$;>(()QO2Llg!}exbxM`SMd2-i`*{j=1Y+NZ@hMJmjN!zPAs;e~`bg z5$gA?@-FZa7;44v0H+UX$PAk3zpL1R81mHAde2^}z3ZZ#S7zNc?1QaUu9sw0;03#hHm^hAaTyZKq5- z1KgOY-QF3XdaaM@Hp!{*-s;_kpBK9}RW3Kzn)j(orpjUB{NQzaAMwT@=NNd0z(5f6=TPWlFc?;YOsmXjZgAD*}`h6%)%0A>NI%%+T7>-U`}g z>d~`)^HJ@O@ZMhjyJyY8nBV(Du*w`KTl8 zdl?#t(O!m|VV6ma%Yfb3pwj{O?CBc9HL(=!_V8OnPUT~JB3IOr4(K(=pQ2gcn`z{v z_-+cC7kMuO(0{(Sy-e9b;^%>j#)$Xxrl^=$O+lL>3BY5yYNk~o+*@nnHUw@nP~^B| zazM8Oc%aO>c*jbb4ZY)mVW#(|u3oZc1~w(0X_UiHTj_{jrk5cHRX4SjD^Q}u^z+yO zT&vQX94MYuSTo=@0qx6tDU@UyqJOaon*o74)^Q%YFOECd3AO;>?sdG`CgT*Y70(*( z&%>XWHQs-3=0QA_rx}OS3XHt0yx4qUetbXQ{(S2$o0-mZt>tEzKb-kmX`8%804KtT zt5*%*#8C&ioAl~(gG7RnUbzZS$wHMy@t|Zvns!-!GtTdtd^hpQhiUxrCe7;f`WW_TgzN-)s`9*NHJS; zYVF|vB;-w7Q%R4qxJ=8{(%|c__0}37_Cnx{&>Cy!Yoh?Ywf@=w?M5vgp(@QK+GScF zEn3S1W-Q93LN7D0i0{Yit6izJ(HsG3)3veMZAjZni?F0l1qXL(Q?(w5xn0K1m$5~f zSDU33Xk8?~m*KyycCmI5urAPA`|>_@$=uo$&7;lHI>=lv(4w@N+5)64HfUa>P1Cw* z)3rivq&7$!sNF27o8_9MB^&7|!;V^e?F#Alb59wTY6%8bQ*DSr_ZDrLcE6US-J>nh z#zCeHeEj0euUK1arY*5OB-9G0zSPg5Y3vByB7Kcof~lET7_snR}=FuTinQYAd0~^6mt7 z%bD8%kQAE+u#pM76}Ux4?I!hY-87D&8O)t-*ydsEF;b6yQ*Tzs zE)8>cOtm+5PO%BD`s;tnk3D6U(-y+~JBW?y{U2$^K7rKsc0tV+>wDiI#u3-Qzke$s z_Yz5o`NU^=TQOkYFSZh4cm64BiQDGP*Tt}nJ6Rrhm7gCY4-(SBw|;82KMr!2UUEleV%xo3-9^DDueo(qjW$I zFUR;W=&YlUJe*I8C@gTVJ6}bUlAJzWu>dpTjK>*u!qQ(m)TrZ*(4ousrP&!6Tqxn8 zDa&`~P_}Mk9Q}C`6kd$!fME?Uxn(*=UCZbQ4o3d|B_~t8DuS)G*;8FkbJUV5EjJw_ z7bwfAM@GELj*|@C(w6eQ+abkozSQhdT`L9ce=jF2td=(uF;ds{(xa(JdzC#Wz@B%==3 z%fjT&jPGZ>vyKS$Hm32Cpxgj1WySnXtzl9h6aDY<_!aoSp}x}Yr}mzf&KhsvKvA)Y zT$YrtpGZBVq-Cp7%HgkW!~R6aWuBW#2}x8xl6)P26PjvzCilSqHLB7FuM5j}$=EBq zofFkN!Q-c*y-i5tn=GER2{`MCe8Y8EA9=in8oT6svSOo&M#!cYC5%$Yo1Yi8m}Sv1quP5TA(!#zBAi8`cZlC z0NywWc-^hGlJivBS__V@KoO}{cFS0mg8rIm17EzL$sz3opY35CODwO)!+J2Zm4rO( z+@a9{mPj%VtC4F1I8~$H5DpNQ6BRIb;Jc~v{3AEIJT#6>C}~YZ^E6)L#F=FCNE8gW z#*1crAI3aXxmE>{XNlCNAN_o1fdpuXuS4|9DB$gs(~ym++EO^`Fd->c_F3kePU=ld z92dbMjEI(^$$nm*%7JpC=&mdr7LYjs=R?SbXPR=pvD4oL8aY?%Cj zv#HTJNqYcX@IWEo!0IbP06Ab8Beb*{m3hl|4^R1RmVGaKs0VG~$7WoI8S zV9>@PcmCoiCBx_zIK0*I!Ya`6^NqJMeS9DzOXIIP>4ay&r?$PtAGfHH>8ti~+THgy*3c&rB= z6Xnw{pNDmcUo1K62C zJ>b+Aif)d9hT17TMIYkBlP5Q);D7)`@%)68oJ=`)gqNo%`0!}#Agnu&T~U)u^;)a7 z^drq@65y(?8Jc_)WQ+(r8b3_Fn7Bwok~SU37xQqB>#nJ=iy|@2^?RHjfIh!|~QU+MybcoE#j;Pj?9%Fq^A26_BWTkW{|MBV*3(0s_8s|PRy?MTY z#f(1Z`S}UPSc-W9PfkMlxrj1oh$F!#X@3-(kX6jxAjAQ%19^ZP zS5J_-Gf-lTbB*Bb!ZW}B`_h|$Gpxb5DL%_9)k<#Ak3T6b!@QFXf;wJfx(Yq;OH`Rf zcyhoq2G~Jx_%`3pHq;mPCQM{3J);|ATULuJz9mx-lgseX1bIf9Z*hP+eTKEe^A);` znVv6?k&+G$l0pRp9Ei@G&4#9?>9rgKqmE2V4m=V+u&d_LS?Zf3z9HOq>;@hnu&|H{ zWoVc@=HY-?`r({G9a0jo281E4#yXDA+^e?CgP}STJpo0^E(V=Z1`c`TJSE$WBfgo1 z>QIf}^(UqgN<&~fBKM6=KO3SzI<(v9AS${~s zxDIB0JLU4O>~>fovTL-+219BZZ9tcIu6D#&mK6WU z>XHjd)$N`z^BJCXum^YkX*Zq$@sI*c*Np=bF$f#7fEvh^=ro>O2yNz>o>=Y-7|mp^ z2EME@PMQo{-_sW!=!4@T{(Gg$&yVBz`8;QnXOB?s7=Dc7l`QM9SSU%At2odvW|Y;5jP#rk*#}ySVm$M8E zW#1Uqx(7D8Y25gzL$Pt@D0CXCE``lc5d<6~%6hMnjHZU~OeMK!B#({qIJ$J|)G6$* z+G_JZnGZfOhZFAc$u>X;!2CXDJ=})^c(QzbKm$NSz`1}%fX09(0Pcuv2Hrn^FLtPhh(5W)CwE_k-N70xmI{B~Xg5e4k? zg6fOq0$4Pa2X&7?|e7MKcPF|a==@F#()s

V)uTz!NLg=>eeCEQTNPK0~D zs3&?O^c>MjJP0=w-xAD%J3!*#JC4{@8ispK*u+h68zbaAKqL4sLg+c7iHMQ$!J?gv zXTGgPPZ<^@u7FG2bCHJpbwGI*0P2H_b3{i`gg6cU5c~!sz8>!Fh`k2)Hv&9>`l6Yb z0=EYsRQ?)>BzYe!+9Gu*B-9K3dcY(v7Xli9&ZThiZAWn}AVl)oRLYFN=J58im+1hgK9%XD@C%fyni{_y2RnFsS>+H=I!kZF(%KS%P`T(pP3 zKDg`#Ix7Iz!>>V#og{v9$T3(90}KYFB5V*`p0$4tC{vECl}_-pq}RY@$OyP;xVr%0 z1h78m!)1AH1~dauUiCqRx-<#*vjCdtD(jPSCLfL9-VN7|8e;vi9$LU<>8N9C02-)J zz6=Y6lv$puWOyT~Z`4D|h5AK4+Q_(INeADgl=7!+SkL5vvf3#9%&oDQhkMfI_pK=7 zs{vI2^272sK+5Y8_W|z7H~HHGU_OHYodGO6b)S4h0N75HT+R{2s7LBirqs1ik&pWZ zpfnn8Ht3ONAKa7Ie@M5rxDIYI0N;FqzA`Qpv@b;+Dj6|;Ab@%r1~?BuS>6t}FK zLjd^ZDEx{S-ct`KQ!ZX4z&Q`VbnGKY<3_** zz-lTXSoV`wBaFIw6@c~F7cPN)3uTuNn(S{V3zk0&zlojLH_Icj~ROwQt9pExg z^1^bcvK*Hc`a<5Xg4@Wzp**OoO#!Trh5**rc}PS3ryQx54C4q+ zJ)z9m_L)|-i*vzlHp?vQ8J9p%oxfjo}`uspK?4Uqd- zxXg1J;9>xEJ`q4&q-@zAUj!a|fga^ZePlhg1k?uw>eN30Y-2aTWgSsQOivwS+0I3d zHn@}v`Ah|kq$rWxF6he0W5DEfHGqJF^uJAnG)cJfEvrx2qC1&vCRdSeFN(w z1V9-z!jJWGAwcPs>QgCahLb+!OueS=un%I~dGJ$4Z2@#cfz7tY{vro(Gk|qN*?9oW zlXAZUE_r0zXE`|@vEI&sb~68Hd9P$bJk}juj&H0((zJ$C&&=?1AO)6@G^fL*EjIx! z`>*HVQWsbz_BP~W5`g}hfYAV^V|nbjW1WNp>Y)Wuj?@XtfV|ov75drNaSUMoGb}DX zuP)=SL>TpjIz^psh;Zt9DCkpu4UwMhv#E4B3O7Ot*jF|OGz2t89?gK?P~x5M!)4#C z(y>jme`*GxtQw${N@h0P*OT|>fPx)4GMr_g9&)5$AHu$jc~Umi!KQGV%X``Z45zhB zy(Yb2@DVJ_ay}?9U-HDXs*h)!!XZuKk{0u!T|pa*c+`K=GI1zB#uJ}1Wq!2x*dH^0 z%7|eX0_ZXwX;OyF&vY428qENtM?d4ubPCTV>$tfrZ4;EA^`i7q$%A${d){+pU2_u4 zcGyXlSCca2SVLK!1F6zwA4j(t(vWZ7Q$FV)hHbVv?%B54P8#4xouytdob8Kkk9tkH zT!ZxNUoJ)p;#?v5XS)iPeFj~A1Bp7x^pqphQ6}uunJ?St6-ZAylo#`3Uru0MQ5Wg5 zuj1UMJ={hBwq4TTJ?n|_?5CJdV*vG)X&KHuiOaGQ-)x7>gKFJh)aRfi4IoWBdb#n?Pqt3>2|R&~rK1i| zH&_o$!?_y!7M6u}8~bjC+i>3qv3}j)=tS#8!AdlVBb4o;)x=rYHC8tBA*bi2WD& zrOedKlclUDNq5iWzOqo#j%$K^t zF!uGP{!nMAYt&s6kGjNr>JZC9T$b64H`ADYre}G~cCTto`OSOUD&(OffV4&${sOqv zL(^@CdzOW5mt|)<(q}kb@~`><<)>t+U!=)DK%_iBWbNAkyb^29ozOPR6E%!m08HQcMORMA)*Jg3_Aj)H zX*bXYstU#z2No%Gy+x94#)i<0Pm;3 zC8uWpK#G(HdFD9EHbdYTOxZJx^};kAB`+ajHT*0G>wx;!4Z!sP+ObTdfhV>Bdr+`k z>tOx$fuC(~6@ap4I*xJo!X;mnJ>^B0I?@9!`vTHrUexjSaMJ430MlCK2Sa^8)d<|qK+~z z;!wWijWVSyh&vC!@-PkQ(njhGm%OzDkbm}Rlrwdb{aP^O#=2nrk`Gl5e?LM#9tDuM zE`V$RX%L^~V7+$*Fwee#%K=${g@6HoSilMZ%g1t24$A@5l`8g0C{Hl=K|Pn)&X1qwk!6r(SQd5Ie_MXOaNs<8qAORvJ4Xelxre@ z;fn#pXMW=WcLTNnh|7F40QUf<0GJnf8w#N8lL0LOw*r{H6z~CH1Rxhs4EP8@`Ah=L z2Ydp!4R8}+4&XQ-0nh_Ly=C721W;~afJ*@{0azDf0hAB(W*qCDJX{T6Jj>b$z%Z7R zZIxl?0+<)a$#(&10M=a;>YruH1PlVa3Mc{$0FWl@r37#>pc^0(K)uQU+z2Qz{EOfc zST8dHM*!3n_7}|i2Gnr`+);oF0V#lyfW`pQc^z=}3Y5U_+6nELc2xUDJD`1~eXi}) z{;6%(UejLEUeKP?)@#pb>$J7nYV8SarS_=ykhVhmhy4=!1@>n4bM2vaoBgErv-YF* zo%XF(rR~wa&_2;V)ZWov*A8lXwJ)_#wRg2Qw3oFPwawZFEz*9iJ>0%U+o(OOJ*_>Z zt->%t({a5X{_JejrJEZN`{;hqceWdNs z-qc>vDz&ZJCatGE!rsl^*?x_^gZ)Z-TYGE!$J&!x6MF-@ou9rw;|tHCyM}cR>&%4a z_p^I;?i3z=nv~uN`MY(JeR8Kx0&OEyl;ePr6mafv82(T^?Zr`GO`0e_PvqHnA)dTS ze1|A+i&Fo?#D^bvulF|b9U>J^7c=oG@%EsJBv=Jfbl?bYef}GlMF@C?DZE}UBD`?r zzu3KdH+XW0va&KUZrnKGt%QFZ?!9Hm9H@?QqO7t~M3?Or;{XiYy*pa$E*ppYaqt16 zy}8i@dziqOuG$D#sxVbN~*=I1wEUKah7< zBEfDi!T{p{qD+7R5k0O9JeGm?GVqIhz-t+xa`$d=;=~D&mzO7si;G27Rh8JbZJXG+ zbEhaTFBcUR6{57XRGdKhU9LQ_ZubeXQUTgkqO$6QaOJr`-zB`DUs75OI_1c#T$B{AgCF$EcZiD09inpQZsfaLtlL3a zM@7Z%qhcGN9CRx{rxN+@1mw9u%UdjpON!x^3Rh|w=%9Rk%S9e|a;26FZ(g}5EhB%p zM?S^Kr)*t?C`Q>!$}3T>N>N&}O_Z+NAr~rT40Hu{xVh75%6Y|;(r~tp)s=)IO@Cq4i1HaqA>u!L{l?s0HAP29=^LjhNT7vr$$e~1}jwltWu2RUX6g-nu@Xl z@&Myp&>5HL8;v?j&4YfiuJWK;fZ{xH_Byo$g8rH-A|e7A5l-uhIB2)`jQF-^&u?YA zpooZX56VkqC3J+w1zs%i%eQxxLrOV#v`$^xv)93apj)=JK`W^|3Ut3aA z^5Zi}i$(?iTKdb-7ABj$ES>(%t*Li^fA@PWa=UjgD7fRsef#z;7&yAHeC?NG3-|1qJF{=kn}UKepGnK? zJMyJlGE!GgeCoLs9e;3*Xp#HrtfmEb?AteP+>Kuq6mEWgE$NRHp%_{hM%)Zz`3vRsej@zz%v2^jWd+r&0vPX~L```HD zU-2Kse;og@+x_h1C)cD89r{B2u1^aJ_T4xxcF>^28)N6~pZUwY1k1u`g-KaOO4_!Yz zW7W_;efm5#^r@%%tbJ_a#25ZGdd}!Ew=GB!6TQ?_n=BK+Qd zpMO4k_Gce@*0?6ezZ0MR#D*2m-5NLcwn1@8ad*beADFcLSn#s-)4qu675zxBk==a~B?Ao$n)rGRRZjAfzAqN5*pcx6{K;E4V~x}K7f z^6;jNhaS4G%a)B3S9g8kz0U^@99uZo8?!C5Y-|3Mho0OP^+B(#Ylo>$;=AvTCj{TK z5)yuF#fpiWpC7*CvpI8ao!jqQ^a$G@>hso!&3#;J?n_V~DITf-Ok3U z{hI=IJ+D7@&r0mn5;$Esns}V2IsnlC&WCwyFXyAiyfSqhY<846FRuh;F9p3)HE(j2i4mM5C18F;Fy}~c%gV|zPbtUzMa`4O zA@96#>o5<(oYa^jao$sgIZs)snlrA$oThRc=Qi6gPuzw%5auqJ!*K4x`6K5qoV%1^ z?jq+eC}&9psjhM0CsocLIZxrd zw^I|$O)x*<93_wQ6TpZBubNw8epw7T6c>9%#6`tOTa5WkG2{ZkeA$b7;GDS_b8ybX z$MwbBa~xy_xh1qO6$yPIH_k=Jl>#4f1b8_gC6tw74hSemd;;d5BQPJuytKF&P~xAL zmX~9`3Ym|9yj=v$O}&tJYAWsla(?Q<{4~#)rxs%!phV4AOE70G1(X3w%0VLn^}%|{ zTL&I7j|G&_^&$-OSvjvSL0BomP-k*(3wIswImeBzK$$9pi;w^qQ6cBM#V*|E;oe&T z`C;A)C;{XZ;~v1dZyxkit{FfFipwz91#te$c`w%yDk_1KS_!@?!B-{b$#9`3Twf^0 z9GLUqQp|%n7cR#>wQp}6X2$&mJ0Lr0P6@YT+7U#)30A-~+kOlx< zD*+)IW!vf-+KKw#_v|Pt1iF%@>Z>af?Bo0jlA>IMOfQ5xUS+& z`!+c7xlMapE8_xMtK_y11UVd2n zwr!KIy1Z4}uxY(}<%DJSc<}le*X;f|F>&IgN$Hu-EV$)1*pq3kf`)_@cX=UZ?$-3p zQ|BBwp6Hy|F)Qop4x?XBN%=(|i}+6~N2TuB{8pz<@pIzFjXU0OVpdkii4#-)71lZ` zxLup%R!2waCr@@B`tkdl%0C?EbWZBnwOhxI9l9)xjxL(rI=EfiTZe!6(caF3x0F9} z|KX%blR9Q~>(;ev`07Q=9=_|Q_5<3rdA_`FpFTI=+;`v&tA3p@>1tOukGork@FUNC z@y7ba*W6^YC4RH9-=jC&_;|&Y?|hxwp@YlQy}LVn#7no08FT2pPO)o~e@jXl|J8^8 zzV-XbanUc-5tNDUEf+8*}k;h*k7I>a__y*4&IuS`1A0$2fa7?C&XvQ#HHLB z+&Xyr+y^g*@aNCFBPQXg7yr3qP`_a(CWeQnWvp8{df3v32K4XyWl)cZpzQ3ZnVmY7 zlni|HgW-u2QqwLEN?Y^xkDqV7a?`6{vW`cN+*Nwb4GI00FIn+Q3q7M1E41^*&p+D` z9}Dv8${72}cga5_kG-lD{gDyZUcPTnmwh%B8PwBotH}UIlxJTH@lPAT=-*trj4xE$Xclh;_829zx#G!A#5eL5BCtiHvJ@MH6uZWH7 z-w-cudsBS$<(G0D`=tK6*!K2kqU@nJMcMM##ex0bB9C9i?S?+}zv|3D=xK^mpv!$ zo4;Lnv!538ik}qEzx0Y&zUoEsAjXCV*1jed-n~JjjCx#5%YR0!cUoDK zDBCVdp4}%_zW1Y8^Tn^?gRC<6ziT^E9T585Hq~9 z#imzY70myYRT&Vsd7d$eS`nJp9Om;u*v}{@5d; z^2Ha#4?p}MKKke*@!4meiSNJvUVQuQw_?|4yQJ-S;J^Xsh%SDEzT`zVlTZoWij5pC z2F2bY;s*{Dj+lYMF(h6L?Ke;i866`A&>cEh3>`FBgiTDu6L2ApUfWCpb+$jC7l2n7 z;EZUEhTc~;5+8ojNc?sNX(NE!6ToJ{w!=KLl5zx2&JcK=7yLT~UT_s2@Sj09+by!Q z+<5Z;pYa;qq?sTjoI#$HSrqW`m`z@G{4;DWm^bCt5n-oO21TLn|4?kx2nv#ap^Jk< zLxY0m&A($o(84KVaaXgqsHs8G6gG;Uh-g+B539>w87V^p1^-?{h=nem7p- zp<~!JojP|3@7k^VwGllc|8ZGMN2}ItE^m89yY^RJ6%^FCNz-QMo!|U|pbIa$_>xP5 zTbN@-!*hcgk)PmTTZm?_7a9~Aa!&mQL9EVGUTO|~N|ah7&2-e2PJnTMAmPBj5Z<=Z zIs1230%s*~Rs#PM5-{yU*mLGBCO9W+1rx!HH~rOJGyacUrXx=E%M3H!>hab6CLUe$ zzBU{){{Px#-XM8xXiVFSBH{aCX+_p`B@x>SQS6_Qg|Mb&Obv&)sVS~#wOvihM zG3`J9`A_|gH{Q@ID=YP_TenKsvSo{OUw!pe{k`{g=(~39lK5s>NW;nx?@gXqPLu!I zT*{1c`R1E%q>OiihnJA|qmMnNFD)(AvA(M>S+YdG>#n=>)ho;O?QgxMfBEl!>j%F% zB+h> zk31q}L|N?Lzh9QctRM1$hr{~6kq6eg^*wv`NWRD;>(*KxmXW$aytlyDTW`OufBNyq z`YzCY8M1otp)%xKsACV5o}Ztu-;c7eZ13*ap}&SY*|ceszH;SC@N}=__4eCu*K>1o z^_-j>Jv%!`ce~vZJnkHQ@?^K}$@U;VN54J)c3H;Nt5?f%Z{ECFf9a){bk@&v&poF< z`Q(%Os#UA>C!TmhU%Pg#{_@K&>z{n`iPS}tXX-NMJNn+ed-Wafy{E4Mtp`^;ps(Mw zQGXu#vlTSUQ3u74U$)01p?Lm0eZ`6u`XdiNtlzWbZpgJrpD|;GJ~eMDc%CA8%?6Ji z5BT=Dbl2o8xRWLCuE{PL=ES*D@g{Yr9rGM6}**cyz=yT@I(HA0& zGJ4~UZIWNM9o9MalIa^ZY|x)wzg{l~?+Z&70l!#(_;Kh6boAjzAJq#BigcIDqd$cE zyB06jbEf6%v*ym#XHJKlbFy_8=zT zC!gtCUV2OaXm6GN>bpDid+vQ$pEG*_cyj4ea$L}nEb!vibEbH8@67x3*|Q(g3yW9j z^X5OT-+k8>@UT(8cj@0+x7cbzo$R&)va-#-32Nr)Rp| zGt-$FMAO~mBoH7q5|RKRA%t?y;V8$WqobU2mQYTh0Fn>_gb)HGAt8SEzYl#t)1Izz zyX-2vrZ>H`_St*w6~49Bx7Pap-@k(bA}F?6>FOD#se6#t-VwToZcx)UO!x3DrsnT6 zx9~u+-{85%&+zcD##E+lPC9B_I=NjSBewz!BC%jIfq+n!$>(jG1|00J&Kd8b|GDp|M0|stBq@m{y&4Y8aj^3teP<=IWgZX=R z+1lQEz2-$GWfPxPKtMziv8G%)`X?x=yG~SMDFIjV@wt$rIhV%1PqO*sEfZh5G;;WO zHE;b*5`Xpwm-yrVwI7d*MTF+}zcK(lZ3nyOqMF-V@P@b2sOiV{yLtY{H-?u$qfV+_TyJ@ld#eoTrIi9;h+gl`%Y2RzlM2agQW2die}fT znp!7wbe*!B>!g?6BdTVJ-i1YKOS`3CiaF=@rF56Z@tLF24JUAx9&>kb!B6@#Olx7X z^mV1y@*6iMSbnsOxmoQktEHlQfa-x!tX=)&w+>@%945WIm7v&4LW3%Zj4mZ1qgH)V zitnXT+`i1=#AoRoJe*2kRy%=~0j`u!6I^o}|LR*rv@T%LxGBE5O4{&aie{eExVTR3 zt#yjVpHn>gjEccEil;RXX6A?sF6H3IQ8+tkEC$BleBPfk7yR+mnt9Q~O}fcVI_?~o zq+=qr-V_&?F)%PhN~QEdNjKS*1DMLYF*o#Ks_LY$trKBrBq>B{PWZ=J@eViRc{LBm zWBFQl@;T+0!`1L|l1e*>*IW&0oF=CE4oNMGq+MSoe`1Y{@uw6_uhV$<1$FnHQ!&4; zHf>;4Ka|~Era`)-ws(y8f8fr6pPO(z9E{t!G>(0ya43}XmjW=EG`16B2nh@3+7%zJ zNhgMegkvr!B(JTHz@&0~Bg^p&wcr_0%th(xu*_P5;>$JmN{Ps}a>1_%C&~Qesca7X zvWU08m&#AS7pZllhP>KQ@;fzFhVEnTzen-l1FUjNEtpy(e|Cf7*)$TU6dzrD^67&A0ARSJO_6cOl*NJ zN0ORR$mHZL#>Pi%A=1>uWnVMrj%0G`;~e(Ct-5_bi%>Xm|LR%)-o{(X#|FbkY8L$W9twt?c>s)Rn$o??JWaX^4l>*_7ULRjMJ`a zwIv4+uXHZ?gfcUC7gNUsS-m&N?wVAXA)$4Ui1Gn^vKu(N%)B*!4*jKls}mjvXweY2-FT4>vR(9#M09g_e7346JN1vbv@EZ_>T|jGq)phdB?Y#HyK`vkPBqTT#bFoGH#XbfGM`>&Cp`=W6FDin#m_*9TYpAN} zCE#i`j>pq+@rWWRBcJ%fN)k)zNUCfjx%xWUog9Tn3@rMQ=17ZY9_n2 zPkVtLLQM@E_^eoahboSIT#2ts2{rYTq?ZokpWRJC_af~JPq_Z*8H1~v^sYQ*?CF~1 zeV<)lcyJ}UgxTfCg!vV+Z?8M&U7b1ad>$X|XT!t7krOTv;UTzR^v3C&_RYc9bOvc) zd3A}0I(sfGtkBstq%kx{XnZ6=aZ!?SEY}hf3C&EwD>Rc6`%_3O@1SUS9J9uDaN%`A zB`@EEYMd{t-cD8Q{3geq z`9!mOm-gY#g*5lv!kXF1nZweD{yICjx#8yOhKGlz_P!pto&Qq0?g~eaN05B+8OYRB<_Bx!w4h>hMi# zqGw%`@nToe} zCi_0iA(5@F^|!W+ zGrzG1+Lpd|=R$x7mxI0V3Gw1;s2?t;5;*s11s={BoN|rltXCF?Psg&$Azi=gIp9#j zu7AnL^^r%aLudD){~0!?&O379@+Ix*1336WE}pw<`S3@{{L}YidGCiQ{P-_Z_}TX|`1~jN zTsqZ2)HSVfktKxXcahvQBE3IH)z}=hBXjhO&vJA24lA-_7?)A@(`Qe~v(|9hHI2{r zX5r`4NnF^%_M<>T^E3Fkj6<(D%p5|~ zOUUYMCa0~Ntkzzv?Sr)Fd~<(knHQU~#TfPv)!nGSaY=IAy7Pee^lE9abH@2cX&2Q@f;)WkEk6F!oyG`h&Kx?}#$cT4d&o!nNAKs(2r;DU? zGyC=ha%gvg#<*2yfmF_(isQc0;hkw1+ltNA)%VzHB$tlu#AYW&-8Rj3{qx1R@ zle6;--5h5~``G@WVJ61MW%GJv$1*Z7@_kjFY<$K)$;t@E7%=Px_G^7>UFWJnVpDW3 zwl+}S+(ThmD;1R;lKUN7zin+jfAy`#j*-XC%bu@2-rmvI>TIKMoijDpzxr%*dtHxT zjfI{0823gV#yGL(WyJdNYsu_wG1~V+{jsU^Pj!~P|KyQmHN)b)2Wq>aCtukk4L!5{ za#PtD@-VV{W2dy2Dc=WMJzprc^|fN7zYRGVXMCIeZu2?ovUzQ(Et`6_DSMX@jDEAH zv-PF&H)4C-VkHtJ#vlB?=u^u3|8UaB)}zinw=rMJminc3@Tk8KUv@yGt$h>g0vP%uPl z8&{I`mQi0r$LK#JHiDAc^0n7>M|R(M`)^zMjY(g>FzWOlyZ-HW#yER(y}JLV>}};L z$xhiAjo$hD-*a!2XHRFpe^ZB7clP)Hk@%bP{CXMxlYalV0O7u?#CH<-P6EG^5_qL6 z?S7%ZJ^q~((zj^zx0R>ir}ZZaKU8?_r)4-Bes_H*fgKVs_Df&CzG)A&Gu=0(+4+2D z`knXoGIz#1zq3Ez`HgXJJhz__zA26Uo3H1$^E>-Hd!F{+Mr`2s2Ci>l;mh*#Fnlx? z?#ib66}E4rF)rimWB4{0?+w2XyYI)!%F1gW0DHdnvTYxJ^~e6s9vf#R!^dLf(F#5C z5iook#ACDJ^Z9xCj0lf>q_eM)#_&hz>FKdy+Zh>|HoQGCF;RGDf(-{ZuzvY2+k8yy z{uf4Uw85yKk%v*9Q7_|MX#~SZ!N6?Wg<}mXuBolD`BOMKIdM%s67}`fBB`0u$ME!bcHJ^orvX}adwh@%hl$uU@fxR{1<9#YHj`osq(4FP`hetYnh#$ zwaL)%o#^lHxA~J~W@ix`97bJZlg&59>!NVutA1RR4}gC_pfF1>;n?zXPn`i+Eoy;V=I19RK*2vPC9z;g{7*Qr!)Lgz2U>-oqk1 zEN<{IsY6ew9D7W)Y>aur=uf>C7F>#|K4S88Deaak6M z>f5Osn#Ppdg5PD?*PO~Y^O2b|yG!`xzvS_M|F<{CPMQcS86(It&ZWFbP6gZ|w{sQK z*gCnBYZTnrz})i~Q{$5C$Wx?6m#S@{>eur&e-qD(7l@0FBQrmbLCvRi*%C4;+bL-1 zrsDc2g&ji_Hun>oT}4D>88Jx}!sUcxoilUlNCv*K)dUL<45+?MaP1r!y^koEc#36a z193%VrxgAtY_ocH6-#wD#~i|Obq(N4w@{otH2!?NG&kJw)R>HqOQ5wy*g$DJp((P{ zCRE{{TtifTEzvo$OJ`Ye_08v`@W@Zz&0^2TCX&rv!VzSP?!9aC888cb&z%wOCETvz z?sKejD*x6~VPY$IpU>jmKa1qR2Py1-CyN8WiqtsHrlPu>!h$@NA7`73{^3^69?Rgk zLlzG2WwQ4J;r08?91)Ik_={Zjyq(X1pUH-LGKbuze#*vXDH&O`VR4nhJZqP>=v;as z{A7zJ;ab(gSo#(pQDyBU$gP-buEJ|RsAl*7GjrgJIL%w(BPI*e8Uu58Zj;eGMRZ=5 z?D`fQ9fawBn9K2B2uJxeTliEiJ}!lX22|s9v4W7~4jLxrXq*uSH6vex`_E`!eZlbK zZTi-Qqsf<~{mx^o)s1B3nrUe1qpZ45HoHLzQo9K9s^|2l#T?u#Y$`01{*f`#giU32 zjgu*#k(9Pk{PUXeiK`(%eUeh%MrK_n=Ps4=?vG3O{9}uJRAz-^EKq*qA=j5T7`EpfCAIHk38YRE7_KseP3I_-XGLuzMM0ip> z!O1D=Z`q86L0<5(k|!UP z(i7Z0V>x!pL`&NYo@c}Gy5xzQd}zdb5q9Fnfy3U!$ggMV;i7Hc8OAAN4fBhVZVbO7 zJpU>eE=A+wV8t&w9sdj~Zo%ca_*L`iuVlOZ!c1a(GvVpiv9!Cdn0f!5c;5TI35U1MoE7E~;v?)kqnVWEQL2Oo)C-p!yS2art-prN zZsOLId;&CnP8E|HHHe2(4PL^`1LQw&*`t^b|4}+xek{iILUum;nq1#fOG9fN6}5Vw z9>eJq(Hwp+9oH`kI4dl{^_U4)_gK7xlZmxhNUy1wN@LKVZ$`qZscXye76ldqyEj`yH9#SJ;^z>h|f-bL4z>8 zS>ub>?Y8eb?CbwdEW*fJwKO7KFJDDp`}@j%`KBF){n*y7uiCe%dOXyAWnF$n_B`x; z{;KRZwqTA5YKMV=88&63UE=52uo8P6?REc6u^|(i{dwzEeQe(v`Pgj5 zzixZ9H%U+JxBt2Ezav|t4My?5sV%?lnNeBW_g}@oE&ZGKZ@$}c6!`A;cTfUfAMpRx zBKUfFzs}qJ6I<~={QdvxT73Kbjk#m28DGDC(=#Kjp>OPKjPcuk8RslSkq(T>~vmvJFI{S#viukOE&x-i0 zh|g*}?}b z6>*6Xml$!05tkToi4m6=afuO^SZCU3#3e>tX8E<3ATBfFG9xZC;xZ#HGvYEME;HgX zBQ7)IG9xZC;xZ#HGvYEME;Zs(Yp+$0xYY7#(Y|V5IpR_yE;Zs(BQ7=KQX?+4k7Y$1Zp7h69B#znMjURPCFS>aC>e3M?cI*JwLcH##le!EMsqQWV_Bc w#-b5ydoQhx_BGYMf3THrj9b0a5~}w``ZweD+s~N)+%N3>({G#WxBu?{1G~ub82|tP literal 0 HcmV?d00001 diff --git a/config/axtls.RES b/config/axtls.RES new file mode 100644 index 0000000000000000000000000000000000000000..2929b3b679fddfb78bb58ebbccc5c0c4a9eb37d8 GIT binary patch literal 22748 zcmeHv30##&mTzG?K4*D7Jw0!hH?QA&nx&IYC+SQlopu+K7&VE;M57o{F>Z(o7gA6}*Hq&q!t=JmYaq>@9`t*@3- zr|PS({&mh#2qDIjfMH_tcY^lE#^*1vjEVB>CqMa%9~le1&cr(;3zCT#!@okf|D_TQ z{~4~Lq`^+y-QAgXXRQ1cJv}{Q?AWnFqtOTp3k%_H;BO12-8I7TdV~c@ zX7==$iXM#x(-!?lG`Jk2~{779^n&WI&i&Xvm|6ylcoW`ysCylA)(Z3=R$oCnqQ2 z=jSK-`uap|ZLR3&=nz`1R_OJ5p;oKKAjhv#ISF0QplI$N6dHXk+tUh-RwrtkJIG6) z&~*&5+#qE=D1w6YY`aew`UZu{NyYY6!kz60sr}fFmVIeOke`mf*}k?}=nc)n(9y$w zdxWl8w$(56J^iAVq-DE$wqszw9V90e+j934enEbW)k0;dVLKe(EUj=NPby2TaCg!Q zwMO#CH2d*mKN_80_;Kt(S_8*r5bB^>q1H7EZEZ8hOlocxIzxxh)piKIB#z5KYNjmw z^gS%sBlP62mZUcHiDr(kgYxPj>B(;^^QhZa?UI{K9!S(GSqM`NE(jSR4Xhw zUJEmhmt-l&O>&ZB_oIB(d^StRdK^2)ua=}CX>~%Y(+M*(J?rTyFTHRlSz1yyBuf=z zcRlBZG3QV%NzRc*FSI1JmU1L%NovYdCrQt_Ci(dp_{_le8B@M`17)qLrMyYHTCQUf z*Opq}%;%IlNk_TsNd{7ozJt#?xGuT&DF0^4UduJwOnG;3o$6}2p13yp`ul{2@-|T3 z&7?j_{ry}wls(r<2iJ2yskRSXFAx}nuynEz|0FEM*fEx3-aJcTVQI;+lAK5uDy|uo zm}Sa2vUKA5l5^$6wMFuC5t zNeRP0pKF7Sk3Nz+ZSv$Jlc!ALkMWa6cTGMrjbXC0k|E1Kt2zGCq)DS&r<$5ZMNOSN znrY{0Q%$2L%CN?C%#kURCS8&x$iXFr>1(4WPo6TRbY6WYoX1T3U`*76QKMwppdi_}3_(HchgG7YqD;rsuzc6li4#{( z7&X&3(5uzgIbrpxFXnx)XYIRR>E_HaR8|@iRtJ4CVd5AL+gr`W7#3AC>%^>Cu3oeK#*d#eb;7(o2Sb8_ z?q;tHTrz4%{b0e*ezy5k=lk8}=1Z6MF26WMZ8fKHu}g2S>#VLm6O-J;kdT>e8EYfL z!(6X^Z5etiwCQJ?-+$lRd*>(T&z}#NYwn}X>|XBE+v~M$)}&8OOsuolS|FNSa`m35@bE7mPna-jZ%x`cIN0QQ<_w1TB{@$wBi>$t>nOBH@CU| zOP78A%||zOf3)kuT;Cpt#`nw|^_j6L>USMxU-R&2QEgbie!X^m(fX1(^(7yheeJny z*|HU~{O)CQeG;N-PHd@Oyrt2xB!BBM?2=OY`ilnD%ZJd@-)+gX^Tr2gwH&5c*gP5r|ge)+O;^f+ZX2Lm$)8pKD*<0SFSXpIzSErLR|c+C zXKia7niwn>`JS+;qm|uY{`@ubqb>6n<{WCav&$+>DQRmm>z=#(;zi%t>%RK9ZSlsa zF;S+b`{GmH;|o0gGZSFVnlh(Z{OvNXyKm_lC=_ zAw#&QPA<~s7o;uxDn0veoSfQc^^KoCozML$eqG>LUyz@lpR{52aC!dy^xWi`Vd|21 zE#D0bk507CbvSeFvrk#RfBa`>{zkW8L;c1L>abZ)i_65NNlRv0FPY>#+TFct%7~qb zOgUFHE_QI3{d;>QrN!6h`OrUo{G}z6J~J`-jARVc7AT|P3F{T}hB z)4xZdKUa}I{B`@`DY1`)KRnlezxW4<{b31wUpX4fX$eiovPnSV*ilO3&*ND6+?4bb z$Nq>vjKRd1Q09>5TH-{Wr$=H}i6tfOl(0v8&mhdKg!! zG{Q_`sCmRsl8hLNu|}gMj?og|4C5#Z_U&Y$BTgb_eS)DRF47PaY1G4*Qb){VsFm2K zmN>GO7>U@17)N3oi7zF-k=RBE+pbC#O5Ez_M+$m|TeVu^S<2ju@>WSAc6Fz`EiIWQDfm@I{Oa@s$NKS}AZQrR z1`*S$Ng7g+mTipZe8_om(ve5vTvCvX-I+(ctKj}1=Bb&-Ia9DNW1UP(3~Z|BnDjy= zX&%W;ui#-n71K^kyXz@G;#yJ=$;pptlElVNT&K#N0@r|_hFF*+@v+3k@}5C&U>Qr^ zRUbeDSN5uZ?2&tH1UY~8YT zpT0E3$!A~2FMhG$tFOYHT;6{D)mK-&@yfVY-**0Bn#0@H6Jn>j{i^5wiWOGt*Ke@S z4)|&r&ztMUnaqFN@7HD1y-GF|ZSlM~uwu2b+G7^0SFeBTz2Cg`)|o>({?!^PAti_uji{fl=|npT0ilwUl&n>XLRQP@?JyXRM*zVO0|tNF7NXMU2b|Ha|UmT$hPvU~si zP4AjjEL*ztO4B?*3&;)vwPG_qg=gWU!m}K`0t!PFRT1$^XIb{4qCnY?z)Y- z6!V2)adSSK)on6iyotU2H&@+Wwfv27^7q8?zkTI=@2}6lF#OPD z(vx^(^xId)@vQqa=eH)~CQg|2tl+qbCKFiT-y-~3Up{s|e4cpr_ureJXFUz4EMMgD zLE%H5V_s0YfBqcv6Xwb?#&eA6h_eebp9Z!l9zA*_9z1v`9u7ScLqiY6&_kw~_xSN+ z@%Ry#_lRX4i%0y8$2=F{p}2DOsd15v80;(JQuc`$O{!>bJ1-iJw2RQB8nJnEuCQ93D(u#$2}i3;;k% z^*0}hBLfhHO~*xiRH2C6(J0*Q4+ww13{hH9C8ATyMJ&G^`!WxTU7>km&5~r{?2;{F z4t9y?Lsvw0*MP|H84&u@{bIXAidZ^thj4NB7tzrXqJX?d#Kw!b%xn?1S0}bRC5h0W zTJhkF$`qcS-onk@ zLljh1i_*G!VYS9q*r+_kj?hdIvaeXgrd4s=2gD|;Z6aBlBg(1|i`KT2;tuO~b#;k@ z2M>w;`%{JMR#$Q0K$b{M)Cf1%t-?;VN!VK32q#BJ5uXq%viU4IDM1*@%f#*5w?$i9 zn>cmql(=>4mbiB9n&>>$shlk@UcAUP0`ZXR#cASC6*6#beK^rveE#8AV#eGBV(j#} zV(k1GV!`aWV!ruwF-OJ=z7z{S|5ChdwL+}mO6>pbPZg4D_A}D7C#&;q#(z><=0g0$ z@MCf8#E-?pKcVh;mYqbBuZ7fQ$v$mXI*8TQ_G0V`Yx2KZ*srq|cI1DfjO{lGdz(!{ z#j^i5yqf;xr$W-aKcP=4v&k&~k0cpJlVqM3nK$zC7W2N(7-aoF6vm8_yS4IX%$`wW z#+aD+@7Nh&vTJu>P_T)~m@&@0vvk|$zTLyq%iG7-&uaaKjn+0Q+f8=%4vw3hw*12q zUal>-SnE%~m{rPLJ|Kbf3lfU`N-~ROP{@dUG zgULVs(|`Zx|1s)k#&5}A|5uYAOMXU;df`Vej{YxWOve1^FaGkcOyqR_!7z-)|6q}C zeQ2zweN~9DEHR8Hf25Rsejk2^xfUc7rKAw|NW;0Fo(N0ET>e97~kF-d^* z_*=ob@~TBg>6U%eLijW8TQVzAf+h=f*O|c;xeuY00w;#=Mc` zWm@vh^CG&tyK(yTY4DyBckbK)&y=`)`7*9txuT@+-Mgohm353kj#bvDO$~VN#Ely_ zaQ*sqr9Bx-x_R>^WZef39>6FYBQG+R?TzHg`0V+7+2_b|Qs$B*uafVwvNB|4WuZ{7 zM_pYV>S}9IUS5vsg9mZ)u1k!_6RN2ZND$#EL_|F&4lOv>fz)vJn(d&olt`%X+sLYP_&-VY-r zBm}|1!AMKdqOran-Dl3=($y=inLlxstl zt0!Oe4GlQi-i}VTTS-~P#%b8E4`^cr7Z(@oA&%+bJ$vBb?1JrHUfAYJIXl=x zMfuuF{>YQHY9p*|Y#48XwY5F$R4&+L?SxG>PO#m;`LNjxI~xaV+^`-tHr8;oXBj&Z zV@Jo$*hYT+{rwQMI}jmzf)T>?st$`lVq5}pvvbhc*no@NPvm-+?^t?zx>DZPZwIz{ zc*B0PJ+``fAR#3KC(d0&@7;T-J8=rd74>L4*N5sO%?OW(ho?sXc~ZgALB%y4%06MSULFbJ-sBAt4m5nV_8*Sj^xCJUJ6>O|F!`&kWA-jvn zR}J<$P; zPIflx8;_x~p%n)YA4kK{lPEcK3=PM6aQfV3^j^3^*$?7A*UzzI$GE1Fm3Pvb>(bVF z8aCGy9t<6T*Zrq5KtJWhrJ`*SU?%`}d>$IQYd*=nKHQQi5-ybt4yI{R-JeMEKpTu0l;%ecdr@_y4@EWYsBP&&Q_CstLDzYeHT;c8(`6$nHV#g1 z?h3_db;v9|4ByZ+c(_Ht%OeP`TLWQZy$5-<9XL6750&jFU}qJJ>A&>DKaX06nG^gF z5Z3_b&}xL}nvqz38v80wL0x(gd&|y2fAkKrI`3j{^G(Dw^wG z>nt4R?Z?__MbPE;qW;7cv~*sBq47MbT6=M@?F=egIakL|;@qW+7!=4KWD?EqXqxTVg>^8!W-^2d4dq`{>L~iFj z=nnNkQ+*AGd-||zQ!XMrDv@7y7zt^m*b^ED-<=_F;X4_cl8C(gG8C0oqLlAMQ`<2N z-WyQ9YuOcbh)&BzoURD8VMIamag-eEMOr}f!lK9z2)k!}^O1 zESjE#FW%XUS-!Gxsj8V>>JE4IAOWeQc|vBmB94?%}sE zmiu)fzvU-Sp1}1R*O6Jp@#dF8-_U~MmNsP9HzWPvF=SU9Lt?=}?2ar%@NPZABJvQO zRLVKYgYWh{IB(vMjTVVmV;PTKDK*%oYk^Ne7XnMpU}td;LJwYmj_W3;^A-}0-Nb?J z`>5y}Kxxka4s_f{PTO7RTkj#Ki|;{qFQNkTux4R69BjE3cd6mvvJ-aOcEXL{Om|mj z?oH0z!fJ{RZ;)?2!b*K*1!6Ake#&=?8 zR5rXqGU4Wz2J7|d{O+VfWxXGMAq9xZtHoZvt3efAP*{dpX$Ed$}~lz{aXq_x3t*&cwn zIIitzHG=j8Vuz16c5qJ&4hlhLMi$ZzHDOmw0er&>;1;ZdTR;xnxliv&F2(M>1zdZ1 z2-Rj|oBsjWQsy=)Emki+fKMjHWA>ylem6>xR@#R2I|e@o&{oJV|cF2L||ktT%9S?6(T9_|Q#qy;o zu-}r4wHqks&Dn6+mWAcZld6N-MkL{ z+1sQ+6!s0F^vVO&U4Do|q}nS3D7!XS{+-f>)^u((Qi`ewpuT{2V)_hZ#3@Glc$8=D)0dEU{3;Hd zxQ>F}+bFwwABG!4IDGptj^B8M+FOs%GQe?g3>CfPy}J+X*RJ3w_s6{KY8*(bL|jxk z-{TfU?rMP7s!FV-yjCxb!_ozDSU7hN+}vZ4SIF<_*$cRN=N7bwFCewy48pQ%v2{l_ zY}cj0@tZWbEKh~Ac`6*t65+a13va7*xUEV+z_uI&2kNnVR|UTdC0J>h26fU=RJ5H% zaa%9SyKbTIbUzAv`=P&b7v=r@#@~K~;~YZ+)3yC~QF87E482#;+;bi3=mhKv4nlfP zAu0|YMRiRF_s=4fQ7$#rEzqUcATF#40S;BLH7n*=_QTa95!=0k(cOCyakVFqa`+^) z^`}VPh(6eg(1I3tYYo`sor-O{bFpJ@5%%fous5d?G5LoOlv0j0oCC8(MVR*6{aC*y z50%Hy;OMnMu7?{aIn$5oOZU*yKZN7AhRFW|G+e)nqjw*m{@QhvbzQ)zTLVbTticy^ z*1*%<4MBmy$js64yx4@6);1ifX+&;5-@WiqM5*^7zn}y~C5I8GR z!IOO37GcT4T&R|(BPOI6y1Wj!dDkHPz$xS(y@J~Fx6yKY5KWYO=Z*X5x^xR3-Vs=0 z#&fts7OEP1keyryJ4^0|JBb~fo#DL28LqBwJo~!B*<~~LIv=dt5Q-#i2D-aWV{qX9 z6NvrT2(_^*lHZF6KkN+kM?m;a1VxANY#syKFY<^3vJkFIMR-mD_M|qzH?9o62^Fw% z$iP~z84JG4JGSN{BeM}93H8{wzZ)q$`&68}ifXR^roLM^cI_tG&R-_Zyog<4@$m9W z#!8F*NXcwNRZ%-U9h2c55(!O`Mmg(;hVDT`xEj&1YB)RZ!;&u(`97CoVBqdktUoj) zF~2+mJ>q`9725(_;Th-w?;sEO1^dHM6%D6ldbm0yLA7Ns>^)LoxhWE6=861Wj@9P5 zFq@H%Eo)M_UmSvOa5;8pYLUiwsk-MX%FkZGLB@xOpnEfQzP+(sRkdvrNP`uNmwx} z9otm~gzw-tE-V*&((4ghd7S%xFN)fGQF^==jU8vvdG{@w?Xk-&GxrUA>$wb&Yv0T-`SthS24hIQOCXBJ}K_#7l?3`!f1DDOw)d1Tlb z;)~!&;?0O1@DK8XtB(_9y%uYhM8bMbCVbX&y?>n!$FFkXVv&dK8#1uVQwKjEEivYP z1SjSqrLGG54>cg=;9+Ffw4$2$=JM6+c=&*KG4lR{yi5LNpybeV{tEUc7UOI4aBSI7 zim0GE1i3ZA)}jm>%!;saehI9D~*Ghw|d4QKh@8}Ec3Q>ksd3zG53aGz_c@7g6C zY^+C2VkTCu+=aDEqPfPii3Q?euZn`t_IOy??Si8x#~c%hh@=EW#U~?4mxHX5Dzu$G zgLuyXZI)VCfR9yP~rX|_#SdT99zl4F8w0Bo?`mG@ zmqkX(Mh<%9@9&eA{Ta&{)6aMqP8py7YvS)}^Z7phfBO9&MGyA_A3sRo2MPS=lfdv^ zX|yZ-siTp+4D;`Yz^KGbYg{92+)RQLk-Jn~N>jy44ll-d^yhor1K(2nq~DDs3X# z+uIcxNSlrD@NnwC{opKZFKCl+KwpC67cRm;J#sU3ocrQZsDGp`%6=m@scfj{@#TFW z_3S%na}bzI{Z0X*_Ud`xS44erF6Fit4x4P@VCTU80w{w#)YR4}b9SWpC{CR2q#eLT z1!FgGu6NV!fi}qS-xUU@t=q7E{W|#X4#n~F*Kv6Wh>DKI+LeyHQ`}13dL;bR)!3JH z6#MkNb1yuN^y+iSXu5>#mdhwRb{WTce;KRZ4~tJjpoz~%WoS+ zpK=&6Whb$lI^Xz;OVCkY7S(za@kei?u>B^Ac?X$B9lq+*0_sgKP?voQnMFrXP=6c; zo7-`syBh<%yO1G1OOL1&9S)S&pzLTD;!>;O@5%c&+kDu4l?l5gxmY|S4Zrz&FRZtT z!=BuB?ACQ)d)g_e0(y{IcMEat14un}4;d#1k=b|?aTQm2&wLsQ5qTV2Fz3}pu}5)p z--f7&C?uz+p_T8`0Ph--3Tu#IXn_7m8?tJTBCDzyk=i1JhUG&Yqo>}EdM>9-sMaOH zH?kOk)E5R6pFv=0FOm-5K*otX&~*=jzNoy%q<)aP&*HPUpet^`dh-x$*%E-w&cSeS z<@)pX;JdLEZd{XlqoQ%Jn!1C$8U$;2j~iWtov|edPcKEpe%@QBWMhkOI&7$~Tr?*I zOBco=HnX032HsU4zNpv~WKuVu+D*L}^?HVj_mSPp{(J6FXVwodmlVu-BMhtOYq09m z6s-O_jO$nneQ^P@GSb+8l=3d_49SN5`Xp>HPl5Rt$yh$0`utUySVujJd-HY30NEOL+cDZ08s>O@Pg4x#SqL+V$CP)WU4F?BFaeK$~)U5DMyIoPp< z`keX2Sn_@*R(})4_m=vTI32pU271q*K~mLeM5NX8-d_i6bL#vTq+-K7>RFa)slQ5v zw__H91B&6{u18R8Eet1mQPE8uRX1%BF5gAXt%o>v^AVZ`sAr?CNzM72$S$rxN@^wy z)lJARZsMI@D>CBivD>2@o0jEZ&2s9l_9UbEcsmlPyGp6=Kr(GgG>6)-Gp!2VQ6&iA zoM;LTA-Sv$PTLDG=i^+gSg4~7%US9OzhiRg^|$sqwTuOG9cV?}@1&jtDmJ8_v7S2lAUUq_hVE0J^W;n-+r547E~1k3 zij9H0V+kDAmtfrz9n3yX##-71T%^r_yoZ!`mBw>~tT!^8xp)qTYFm)BzmWRgLujOJ zMtMyG4!5>MCU0>v{@cd#$MPhzO8qDCA1nXt`LlW>vA_@M|9ld7e!>5HOW^tb zEa`$amYojYV@S`y-@nI@*A`<*#(NCYVYfBr{KpCM-ICvw=fk(<$+B`kGJb>PZ)1=+ zjJ~T+@te$-{s{D6r5$dEV*fm%_|tuZ{<7%m>H_^`i5XLs?>_xyk(j6f{bgy(Ogm>{ zBl^pN{<5IIEa)!_`pYVKkiNRabl$Wx@}MrX8uZnrovSTzi6`i*3;ODUzPg~VF6gTZ z`s#wdx}dMFf_LdF4EhR#zQUldFz71``U-=-!l17(=qn8R3WL7Fpsz6KD-8MygTBH_ z|MXP`eU(99WzbiddiZ3X39~_8Wzbg{^i>9Zl|f%+&{rAsRR(>PiFqSHUuDo&ns)KI zpszIOD-HTegTB(BuQcc@4f;xhzS5wtH0Uc0`bvYo(x9(2=qnBSYJ7Z{q=$o#{R~D4tWcsJm zPMbE4(T8}RxTdTj`lvr`=erW}`}*uN_e>9M{3gh?C`mb+@!M(q<{HlzO8;`*@)Y4n{D|9-ICjYf-i zSVjJ81@d1T=I%81$uIt!O`~`lJN!%j%Lgw!DLGb1|JxruDal_f^Wu||V};xc /dev/null 2>&1; then \ + echo "Mono not installed! - go " \ + "to http://www.mono-project.com/Main_Page" && exit 1; \ + fi + +endif # Linux + +endif # not 'clean' diff --git a/config/makefile.java.conf b/config/makefile.java.conf new file mode 100644 index 0000000000..1ecce11940 --- /dev/null +++ b/config/makefile.java.conf @@ -0,0 +1,56 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +ifneq ($(MAKECMDGOALS), clean) + +all: test_jdk_location + +test_jdk_location: + @if ! [ -d "$(CONFIG_JAVA_HOME)" ]; then \ + echo "*** Error: JDK path of $(CONFIG_JAVA_HOME) doesn't exist" && exit 1; \ + fi + + +ifdef CONFIG_PLATFORM_CYGWIN +CONFIG_JAVA_HOME:=$(shell cygpath -u $(CONFIG_JAVA_HOME)) +CFLAGS += -I"$(CONFIG_JAVA_HOME)/include" +CFLAGS += -I"$(CONFIG_JAVA_HOME)/include/win32" +JAVA_BIN:=$(CONFIG_JAVA_HOME)/bin +else + +ifdef CONFIG_PLATFORM_WIN32 +CONFIG_JAVA_HOME:=$(shell cygpath -w $(CONFIG_JAVA_HOME)) +CFLAGS += /I"$(CONFIG_JAVA_HOME)\include" +CFLAGS += /I"$(CONFIG_JAVA_HOME)\include\win32" +JAVA_BIN:=$(shell cygpath -u $(CONFIG_JAVA_HOME)\bin) +else # Linux +CFLAGS += -I$(CONFIG_JAVA_HOME)/include + +ifdef CONFIG_PLATFORM_SOLARIS +CFLAGS += -I$(CONFIG_JAVA_HOME)/include/solaris +else +CFLAGS += -I$(CONFIG_JAVA_HOME)/include/linux +endif + +JAVA_BIN:=$(CONFIG_JAVA_HOME)/bin +endif +endif + +PATH:=$(JAVA_BIN):$(PATH) + +endif # not 'clean' diff --git a/config/makefile.post b/config/makefile.post new file mode 100644 index 0000000000..033981c4d1 --- /dev/null +++ b/config/makefile.post @@ -0,0 +1,19 @@ + +ifneq ($(MAKECMDGOALS), clean) +ifndef CONFIG_PLATFORM_WIN32 +ifndef CONFIG_PLATFORM_SOLARIS +# do dependencies +-include .depend +all : .depend +.depend: $(wildcard *.c) + @$(CC) $(CFLAGS) -MM $^ > $@ +endif # 'not' solaris +endif # 'not' win32 + +ifdef CONFIG_PLATFORM_WIN32 +OBJ:=$(OBJ:.o=.obj) +%.obj : %.c + $(CC) $(CFLAGS) $< +endif # win32 + +endif # end of 'not' clean diff --git a/config/scripts/config/Kconfig-language.txt b/config/scripts/config/Kconfig-language.txt new file mode 100644 index 0000000000..493749b32a --- /dev/null +++ b/config/scripts/config/Kconfig-language.txt @@ -0,0 +1,255 @@ +Introduction +------------ + +The configuration database is collection of configuration options +organized in a tree structure: + + +- Code maturity level options + | +- Prompt for development and/or incomplete code/drivers + +- General setup + | +- Networking support + | +- System V IPC + | +- BSD Process Accounting + | +- Sysctl support + +- Loadable module support + | +- Enable loadable module support + | +- Set version information on all module symbols + | +- Kernel module loader + +- ... + +Every entry has its own dependencies. These dependencies are used +to determine the visible of an entry. Any child entry is only +visible if its parent entry is also visible. + +Menu entries +------------ + +Most entries define a config option, all other entries help to organize +them. A single configuration option is defined like this: + +config MODVERSIONS + bool "Set version information on all module symbols" + depends MODULES + help + Usually, modules have to be recompiled whenever you switch to a new + kernel. ... + +Every line starts with a key word and can be followed by multiple +arguments. "config" starts a new config entry. The following lines +define attributes for this config option. Attributes can be the type of +the config option, input prompt, dependencies, help text and default +values. A config option can be defined multiple times with the same +name, but every definition can have only a single input prompt and the +type must not conflict. + +Menu attributes +--------------- + +A menu entry can have a number of attributes. Not all of them are +applicable everywhere (see syntax). + +- type definition: "bool"/"tristate"/"string"/"hex"/"integer" + Every config option must have a type. There are only two basic types: + tristate and string, the other types base on these two. The type + definition optionally accepts an input prompt, so these two examples + are equivalent: + + bool "Networking support" + and + bool + prompt "Networking support" + +- input prompt: "prompt" ["if" ] + Every menu entry can have at most one prompt, which is used to display + to the user. Optionally dependencies only for this prompt can be added + with "if". + +- default value: "default" ["if" ] + A config option can have any number of default values. If multiple + default values are visible, only the first defined one is active. + Default values are not limited to the menu entry, where they are + defined, this means the default can be defined somewhere else or be + overriden by an earlier definition. + The default value is only assigned to the config symbol if no other + value was set by the user (via the input prompt above). If an input + prompt is visible the default value is presented to the user and can + be overridden by him. + Optionally dependencies only for this default value can be added with + "if". + +- dependencies: "depends on"/"requires" + This defines a dependency for this menu entry. If multiple + dependencies are defined they are connected with '&&'. Dependencies + are applied to all other options within this menu entry (which also + accept "if" expression), so these two examples are equivalent: + + bool "foo" if BAR + default y if BAR + and + depends on BAR + bool "foo" + default y + +- help text: "help" + This defines a help text. The end of the help text is determined by + the level indentation, this means it ends at the first line which has + a smaller indentation than the first line of the help text. + + +Menu dependencies +----------------- + +Dependencies define the visibility of a menu entry and can also reduce +the input range of tristate symbols. The tristate logic used in the +expressions uses one more state than normal boolean logic to express the +module state. Dependency expressions have the following syntax: + + ::= (1) + '=' (2) + '!=' (3) + '(' ')' (4) + '!' (5) + '||' (6) + '&&' (7) + +Expressions are listed in decreasing order of precedence. + +(1) Convert the symbol into an expression. Boolean and tristate symbols + are simply converted into the respective expression values. All + other symbol types result in 'n'. +(2) If the values of both symbols are equal, it returns 'y', + otherwise 'n'. +(3) If the values of both symbols are equal, it returns 'n', + otherwise 'y'. +(4) Returns the value of the expression. Used to override precedence. +(5) Returns the result of (2-/expr/). +(6) Returns the result of min(/expr/, /expr/). +(7) Returns the result of max(/expr/, /expr/). + +An expression can have a value of 'n', 'm' or 'y' (or 0, 1, 2 +respectively for calculations). A menu entry becomes visible when it's +expression evaluates to 'm' or 'y'. + +There are two type of symbols: constant and nonconstant symbols. +Nonconstant symbols are the most common ones and are defined with the +'config' statement. Nonconstant symbols consist entirely of alphanumeric +characters or underscores. +Constant symbols are only part of expressions. Constant symbols are +always surrounded by single or double quotes. Within the quote any +other character is allowed and the quotes can be escaped using '\'. + +Menu structure +-------------- + +The position of a menu entry in the tree is determined in two ways. First +it can be specified explicitely: + +menu "Network device support" + depends NET + +config NETDEVICES + ... + +endmenu + +All entries within the "menu" ... "endmenu" block become a submenu of +"Network device support". All subentries inherit the dependencies from +the menu entry, e.g. this means the dependency "NET" is added to the +dependency list of the config option NETDEVICES. + +The other way to generate the menu structure is done by analyzing the +dependencies. If a menu entry somehow depends on the previous entry, it +can be made a submenu of it. First the the previous (parent) symbol must +be part of the dependency list and then one of these two condititions +must be true: +- the child entry must become invisible, if the parent is set to 'n' +- the child entry must only be visible, if the parent is visible + +config MODULES + bool "Enable loadable module support" + +config MODVERSIONS + bool "Set version information on all module symbols" + depends MODULES + +comment "module support disabled" + depends !MODULES + +MODVERSIONS directly depends on MODULES, this means it's only visible if +MODULES is different from 'n'. The comment on the other hand is always +visible when MODULES it's visible (the (empty) dependency of MODULES is +also part of the comment dependencies). + + +Kconfig syntax +-------------- + +The configuration file describes a series of menu entries, where every +line starts with a keyword (except help texts). The following keywords +end a menu entry: +- config +- choice/endchoice +- comment +- menu/endmenu +- if/endif +- source +The first four also start the definition of a menu entry. + +config: + + "config" + + +This defines a config symbol and accepts any of above +attributes as options. + +choices: + + "choice" + + + "endchoice" + +This defines a choice group and accepts any of above attributes as +options. A choice can only be of type bool or tristate, while a boolean +choice only allows a single config entry to be selected, a tristate +choice also allows any number of config entries to be set to 'm'. This +can be used if multiple drivers for a single hardware exists and only a +single driver can be compiled/loaded into the kernel, but all drivers +can be compiled as modules. +A choice accepts another option "optional", which allows to set the +choice to 'n' and no entry needs to be selected. + +comment: + + "comment" + + +This defines a comment which is displayed to the user during the +configuration process and is also echoed to the output files. The only +possible options are dependencies. + +menu: + + "menu" +

+ + "endmenu" + +This defines a menu block, see "Menu structure" above for more +information. The only possible options are dependencies. + +if: + + "if" + + "endif" + +This defines an if block. The dependency expression is appended +to all enclosed menu entries. + +source: + + "source" + +This reads the specified configuration file. This file is always parsed. diff --git a/config/scripts/config/Makefile b/config/scripts/config/Makefile new file mode 100644 index 0000000000..739950163b --- /dev/null +++ b/config/scripts/config/Makefile @@ -0,0 +1,121 @@ +# Makefile for axTLS +# +# Copyright (C) 2002 Erik Andersen + +top_srcdir=../.. +top_builddir=../.. +srcdir=$(top_srcdir)/scripts/config +include $(top_srcdir)/Rules.mak + +all: ncurses conf mconf + +ifeq ($(shell uname),SunOS) +LIBS = -lcurses +else +LIBS = -lncurses +endif +ifeq (/usr/include/ncurses/ncurses.h, $(wildcard /usr/include/ncurses/ncurses.h)) + HOSTNCURSES += -I/usr/include/ncurses -DCURSES_LOC="" +else +ifeq (/usr/include/ncurses/curses.h, $(wildcard /usr/include/ncurses/curses.h)) + HOSTNCURSES += -I/usr/include/ncurses -DCURSES_LOC="" +else +ifeq (/usr/local/include/ncurses/ncurses.h, $(wildcard /usr/local/include/ncurses/ncurses.h)) + HOSTCFLAGS += -I/usr/local/include/ncurses -DCURSES_LOC="" +else +ifeq (/usr/local/include/ncurses/curses.h, $(wildcard /usr/local/include/ncurses/curses.h)) + HOSTCFLAGS += -I/usr/local/include/ncurses -DCURSES_LOC="" +else +ifeq (/usr/include/ncurses.h, $(wildcard /usr/include/ncurses.h)) + HOSTNCURSES += -DCURSES_LOC="" +else + HOSTNCURSES += -DCURSES_LOC="" +endif +endif +endif +endif +endif + +CONF_SRC = conf.c +MCONF_SRC = mconf.c +LXD_SRC = lxdialog/checklist.c lxdialog/menubox.c lxdialog/textbox.c \ + lxdialog/yesno.c lxdialog/inputbox.c lxdialog/util.c \ + lxdialog/msgbox.c + +SHARED_SRC = zconf.tab.c +SHARED_DEPS := $(srcdir)/lkc.h $(srcdir)/lkc_proto.h \ + lkc_defs.h $(srcdir)/expr.h zconf.tab.h +CONF_OBJS = $(patsubst %.c,%.o, $(CONF_SRC)) +MCONF_OBJS = $(patsubst %.c,%.o, $(MCONF_SRC) $(LXD_SRC)) +SHARED_OBJS = $(patsubst %.c,%.o, $(SHARED_SRC)) + +conf: $(CONF_OBJS) $(SHARED_OBJS) + $(HOSTCC) $(NATIVE_LDFLAGS) $^ -o $@ + +mconf: $(MCONF_OBJS) $(SHARED_OBJS) + $(HOSTCC) $(NATIVE_LDFLAGS) $^ -o $@ $(LIBS) + +$(CONF_OBJS): %.o : $(srcdir)/%.c $(SHARED_DEPS) + $(HOSTCC) $(HOSTCFLAGS) -I. -c $< -o $@ + +$(MCONF_OBJS): %.o : $(srcdir)/%.c $(SHARED_DEPS) + @[ -d $(@D) ] || mkdir -v $(@D) + $(HOSTCC) $(HOSTCFLAGS) $(HOSTNCURSES) -I. -c $< -o $@ + +lkc_defs.h: $(srcdir)/lkc_proto.h + @sed < $< > $@ 's/P(\([^,]*\),.*/#define \1 (\*\1_p)/' + +### +# The following requires flex/bison +# By default we use the _shipped versions, uncomment the +# following line if you are modifying the flex/bison src. +#LKC_GENPARSER := 1 + +ifdef LKC_GENPARSER + +%.tab.c %.tab.h: $(srcdir)/%.y + bison -t -d -v -b $* -p $(notdir $*) $< + +lex.%.c: $(srcdir)/%.l + flex -P$(notdir $*) -o$@ $< +else + +lex.zconf.o: lex.zconf.c $(SHARED_DEPS) + $(HOSTCC) $(HOSTCFLAGS) -I$(srcdir) -c $< -o $@ + +lex.zconf.c: $(srcdir)/lex.zconf.c_shipped + cp $< $@ + +zconf.tab.c: $(srcdir)/zconf.tab.c_shipped + cp $< $@ + +zconf.tab.h: $(srcdir)/zconf.tab.h_shipped + cp $< $@ +endif + +zconf.tab.o: zconf.tab.c lex.zconf.c $(srcdir)/confdata.c $(srcdir)/expr.c \ + $(srcdir)/symbol.c $(srcdir)/menu.c $(SHARED_DEPS) + $(HOSTCC) $(HOSTCFLAGS) -I$(srcdir) -I. -c $< -o $@ + +.PHONY: ncurses + +ncurses: + @echo "main() {}" > lxtemp.c + @if $(HOSTCC) lxtemp.c $(LIBS) ; then \ + rm -f lxtemp.c a.out; \ + else \ + rm -f lxtemp.c; \ + echo -e "\007" ;\ + echo ">> Unable to find the Ncurses libraries." ;\ + echo ">>" ;\ + echo ">> You must have Ncurses installed in order" ;\ + echo ">> to use 'make menuconfig'" ;\ + echo ;\ + exit 1 ;\ + fi + +clean: + rm -f *.o *~ ../../*~ core *.exe $(TARGETS) $(MCONF_OBJS) $(CONF_OBJS) + rm -f conf conf.exe mconf mconf.exe zconf.tab.c zconf.tab.h lex.zconf.c lkc_defs.h + rm -f ../..config.h + diff --git a/config/scripts/config/a.exe b/config/scripts/config/a.exe new file mode 100755 index 0000000000000000000000000000000000000000..57824a9867c61fb2c25b1f3b4d46d09077104d98 GIT binary patch literal 8185 zcmeHMZEPGz8J@GR;Cwha(Vzq=5?9IQL$sFdT%1%2V#)d1v~`lJ?F3X3#%tf&K73!? ztrG`=bmdZ%)g_We0f9(WDk_0ce?+1Jr~JTaew>g}BnW>(|Co;oM=_FBRH*_h$Meq2 z-t6w#PEsWS2}YisnP=Ybd1r5SeDJwh*2)+Qqt@$;&7q}Yi0Ar`GN!kD{EaQ_^$l-5 zG8YyhEfbSYXW<|m3~HaceJa(O#CYDJ6FxoA2U?LRye&E`{9S9|-$4kbF7U~C}N z%AT(LxSwrgY#I0h`*7=~P|IFnR0{yA5mnI$>u3y|><*z)D~f?926Gk@elZr6yd;2l zP*fua-Ha7TzymH_wl!lz=PU)E3?c^_PN0txWo)Etv{a(LL60asnoF6n`L1-zv`ys; zd=fEh^V1rj^CSNs{jW#hi1SWmsjc$Yfe7;N#Yh~00l%=$}1o_LW|=C|VS@?!Y%LfA>HR1+(Uo4~dBy$0*E z&Yvom+dfNMpcr}n2DOz9>@jL@-uU!o^qmFgYPGFugzF1Xb);vWEZ*TvuT-booa661 z{T*Q^*0DGQk?;f_w8KCQSpB1Cx()XH(meX-k9BOX{AIaDyNx-=Buf;1usAzAZeDY} zsCU|6nw=#&D)8s%P-Q7nJ-!+GUU+-!nLhxn#lt^E(=&gGJgLRo{tm&l_~wT(aw=td zR?mo;N6QZznCU(%nr+(<I@rQVsIq}n#rEo1CqcyF?_sV9UYzzb7;_J{n2U2$4 zdjCsbKK^DK3844I;?pGH&7S$nKkN3NYx{+x&b2w==zi(we&J}(@0}OR;HbX%DxOZ| zHV#K_Y^tMl(xUj{TRqrzv^pIbLWpl}u09*ChL91VcS9|YUoS4hwkzj<0r~9wujzT@ z4SE+k@63@im8H$ja7P=Z0J%?oy#^KDq^x(I_UWs4&IZP31LJePG1mXMH^=XGT<@qdDcwlNR|=e>1<)TXz_ww#Q5heV`e6kAEUXOEn}x9PNs7_owKcC&ddO- zx1=%|K3255Ie#MA(^IgD90!y!3qPx7>v++^IpN80wjpCBT(sQ5;n0(oeK4Pz&R7S` zTq<;8)%SPSzlBPkeu$;=IRe;A4aALDSs|^V z$I$badu0zv{Uqu|)V0>swMWuWe7*?k559uy#mChZL2yJSFnL<-*wc+6>1=h8-E=1Q zAu%I}^wH0aq(O(pP@_Wf>e=gRmo(rEB|*J|SR3VoMLux6hBQ}K0jc8m)M)aQelGo< zCWA=df=1N$Lb*wDtVuE*EBuoCgGe8(yN=;A7)i;i#}L!(80tl#9W)J38}@{bVxA=G zayL+$9yd2e zggwyJ$oYMZ98_&81Et-v*65fsC6|;`beZDw8=gOOTc`Zck3=|)0A=D0P zfB6si)k_xm_Rj7?5Q*(;LPmnf?(YPVJ#;dXk}<`8MGq88Q`%9C{ZTySNFqxL(KP=8 za#m${3*+(=ONf;xb7I&Ca`yxx<1$dd-xV}o$v5R12R|)6h+uJNdj@JGVrKAtp4n%9`>Iz^1 z`ecrAK2HB=AlHQl(vVMp%gu0!Jgy{DBas1gZHzSXoa)Lrb9Fr+PmFHFvYPnQhQ;q(VxqsrK|`(73-B*gNW4A_7$Jol6+${RM$c-fBiX>%IUQDq8ZpKnT>? zLgt+YLa6k83y`u8=_D6Ww47cbXMkv~At3GvR?6W(h(qf-351G9&H{0NktEkkO*EI9 zkl!gp+w%_~BN%FXHmC!sr1=;|{0r&aLEIn32Zx7jvuIBjD75~ux;dhYBHT84Mtm%v z&E|8)UdB^-UMN}9Xo?nHIdNXF(!2Kdar}SFPG>C%n|8j)TnUAuMVfX6f!-j1J1(VE zv5*;j@W`Rzrw%4~awu`6|1cj+3>=R0fv1LskvW+5nmG!mI30?3iF}j<{lkX`HGM7% z9?$I=Ms}v8>DRs~ z6IQX5&gYcrFmWcMb;B7#(mrHzs$@?IN9CN{GCX)IXT(5*|C4!n*N$A`P`@z2HGI-C z3toq$AqB56VOl}$SiHv4IXIRt`8-Nz%?XQ-nkDIc$r`iCSu>NK$YrgZ3>JbPSOT?# zjT_6`t+`lX6$c*oEiXmDosmwAHH|&F;bWF&^oSptv^dIgj=-c;iirsXS=uje+whLX z#oTHRs@E31?PYn=nqMk~Y{YLC!Tx WzI|%@wBR&#J>SY-4;{; literal 0 HcmV?d00001 diff --git a/config/scripts/config/conf.c b/config/scripts/config/conf.c new file mode 100644 index 0000000000..15244678e8 --- /dev/null +++ b/config/scripts/config/conf.c @@ -0,0 +1,583 @@ +/* + * Copyright (C) 2002 Roman Zippel + * Released under the terms of the GNU GPL v2.0. + */ + +#include +#include +#include +#include +#include +#include + +#define LKC_DIRECT_LINK +#include "lkc.h" + +static void conf(struct menu *menu); +static void check_conf(struct menu *menu); + +enum { + ask_all, + ask_new, + ask_silent, + set_default, + set_yes, + set_mod, + set_no, + set_random +} input_mode = ask_all; +char *defconfig_file; + +static int indent = 1; +static int valid_stdin = 1; +static int conf_cnt; +static char line[128]; +static struct menu *rootEntry; + +static char nohelp_text[] = "Sorry, no help available for this option yet.\n"; + +static void strip(char *str) +{ + char *p = str; + int l; + + while ((isspace(*p))) + p++; + l = strlen(p); + if (p != str) + memmove(str, p, l + 1); + if (!l) + return; + p = str + l - 1; + while ((isspace(*p))) + *p-- = 0; +} + +static void check_stdin(void) +{ + if (!valid_stdin && input_mode == ask_silent) { + printf("aborted!\n\n"); + printf("Console input/output is redirected. "); + printf("Run 'make oldconfig' to update configuration.\n\n"); + exit(1); + } +} + +static void conf_askvalue(struct symbol *sym, const char *def) +{ + enum symbol_type type = sym_get_type(sym); + tristate val; + + if (!sym_has_value(sym)) + printf("(NEW) "); + + line[0] = '\n'; + line[1] = 0; + + if (!sym_is_changable(sym)) { + printf("%s\n", def); + line[0] = '\n'; + line[1] = 0; + return; + } + + switch (input_mode) { + case ask_new: + case ask_silent: + if (sym_has_value(sym)) { + printf("%s\n", def); + return; + } + check_stdin(); + case ask_all: + fflush(stdout); + fgets(line, 128, stdin); + return; + case set_default: + printf("%s\n", def); + return; + default: + break; + } + + switch (type) { + case S_INT: + case S_HEX: + case S_STRING: + printf("%s\n", def); + return; + default: + ; + } + switch (input_mode) { + case set_yes: + if (sym_tristate_within_range(sym, yes)) { + line[0] = 'y'; + line[1] = '\n'; + line[2] = 0; + break; + } + case set_mod: + if (type == S_TRISTATE) { + if (sym_tristate_within_range(sym, mod)) { + line[0] = 'm'; + line[1] = '\n'; + line[2] = 0; + break; + } + } else { + if (sym_tristate_within_range(sym, yes)) { + line[0] = 'y'; + line[1] = '\n'; + line[2] = 0; + break; + } + } + case set_no: + if (sym_tristate_within_range(sym, no)) { + line[0] = 'n'; + line[1] = '\n'; + line[2] = 0; + break; + } + case set_random: + do { + val = (tristate)(random() % 3); + } while (!sym_tristate_within_range(sym, val)); + switch (val) { + case no: line[0] = 'n'; break; + case mod: line[0] = 'm'; break; + case yes: line[0] = 'y'; break; + } + line[1] = '\n'; + line[2] = 0; + break; + default: + break; + } + printf("%s", line); +} + +int conf_string(struct menu *menu) +{ + struct symbol *sym = menu->sym; + const char *def, *help; + + while (1) { + printf("%*s%s ", indent - 1, "", menu->prompt->text); + printf("(%s) ", sym->name); + def = sym_get_string_value(sym); + if (sym_get_string_value(sym)) + printf("[%s] ", def); + conf_askvalue(sym, def); + switch (line[0]) { + case '\n': + break; + case '?': + /* print help */ + if (line[1] == '\n') { + help = nohelp_text; + if (menu->sym->help) + help = menu->sym->help; + printf("\n%s\n", menu->sym->help); + def = NULL; + break; + } + default: + line[strlen(line)-1] = 0; + def = line; + } + if (def && sym_set_string_value(sym, def)) + return 0; + } +} + +static int conf_sym(struct menu *menu) +{ + struct symbol *sym = menu->sym; + int type; + tristate oldval, newval; + const char *help; + + while (1) { + printf("%*s%s ", indent - 1, "", menu->prompt->text); + if (sym->name) + printf("(%s) ", sym->name); + type = sym_get_type(sym); + putchar('['); + oldval = sym_get_tristate_value(sym); + switch (oldval) { + case no: + putchar('N'); + break; + case mod: + putchar('M'); + break; + case yes: + putchar('Y'); + break; + } + if (oldval != no && sym_tristate_within_range(sym, no)) + printf("/n"); + if (oldval != mod && sym_tristate_within_range(sym, mod)) + printf("/m"); + if (oldval != yes && sym_tristate_within_range(sym, yes)) + printf("/y"); + if (sym->help) + printf("/?"); + printf("] "); + conf_askvalue(sym, sym_get_string_value(sym)); + strip(line); + + switch (line[0]) { + case 'n': + case 'N': + newval = no; + if (!line[1] || !strcmp(&line[1], "o")) + break; + continue; + case 'm': + case 'M': + newval = mod; + if (!line[1]) + break; + continue; + case 'y': + case 'Y': + newval = yes; + if (!line[1] || !strcmp(&line[1], "es")) + break; + continue; + case 0: + newval = oldval; + break; + case '?': + goto help; + default: + continue; + } + if (sym_set_tristate_value(sym, newval)) + return 0; +help: + help = nohelp_text; + if (sym->help) + help = sym->help; + printf("\n%s\n", help); + } +} + +static int conf_choice(struct menu *menu) +{ + struct symbol *sym, *def_sym; + struct menu *child; + int type; + bool is_new; + + sym = menu->sym; + type = sym_get_type(sym); + is_new = !sym_has_value(sym); + if (sym_is_changable(sym)) { + conf_sym(menu); + sym_calc_value(sym); + switch (sym_get_tristate_value(sym)) { + case no: + return 1; + case mod: + return 0; + case yes: + break; + } + } else { + switch (sym_get_tristate_value(sym)) { + case no: + return 1; + case mod: + printf("%*s%s\n", indent - 1, "", menu_get_prompt(menu)); + return 0; + case yes: + break; + } + } + + while (1) { + int cnt, def; + + printf("%*s%s\n", indent - 1, "", menu_get_prompt(menu)); + def_sym = sym_get_choice_value(sym); + cnt = def = 0; + line[0] = '0'; + line[1] = 0; + for (child = menu->list; child; child = child->next) { + if (!menu_is_visible(child)) + continue; + if (!child->sym) { + printf("%*c %s\n", indent, '*', menu_get_prompt(child)); + continue; + } + cnt++; + if (child->sym == def_sym) { + def = cnt; + printf("%*c", indent, '>'); + } else + printf("%*c", indent, ' '); + printf(" %d. %s", cnt, menu_get_prompt(child)); + if (child->sym->name) + printf(" (%s)", child->sym->name); + if (!sym_has_value(child->sym)) + printf(" (NEW)"); + printf("\n"); + } + printf("%*schoice", indent - 1, ""); + if (cnt == 1) { + printf("[1]: 1\n"); + goto conf_childs; + } + printf("[1-%d", cnt); + if (sym->help) + printf("?"); + printf("]: "); + switch (input_mode) { + case ask_new: + case ask_silent: + if (!is_new) { + cnt = def; + printf("%d\n", cnt); + break; + } + check_stdin(); + case ask_all: + fflush(stdout); + fgets(line, 128, stdin); + strip(line); + if (line[0] == '?') { + printf("\n%s\n", menu->sym->help ? + menu->sym->help : nohelp_text); + continue; + } + if (!line[0]) + cnt = def; + else if (isdigit(line[0])) + cnt = atoi(line); + else + continue; + break; + case set_random: + def = (random() % cnt) + 1; + case set_default: + case set_yes: + case set_mod: + case set_no: + cnt = def; + printf("%d\n", cnt); + break; + } + + conf_childs: + for (child = menu->list; child; child = child->next) { + if (!child->sym || !menu_is_visible(child)) + continue; + if (!--cnt) + break; + } + if (!child) + continue; + if (line[strlen(line) - 1] == '?') { + printf("\n%s\n", child->sym->help ? + child->sym->help : nohelp_text); + continue; + } + sym_set_choice_value(sym, child->sym); + if (child->list) { + indent += 2; + conf(child->list); + indent -= 2; + } + return 1; + } +} + +static void conf(struct menu *menu) +{ + struct symbol *sym; + struct property *prop; + struct menu *child; + + if (!menu_is_visible(menu)) + return; + + sym = menu->sym; + prop = menu->prompt; + if (prop) { + const char *prompt; + + switch (prop->type) { + case P_MENU: + if (input_mode == ask_silent && rootEntry != menu) { + check_conf(menu); + return; + } + case P_COMMENT: + prompt = menu_get_prompt(menu); + if (prompt) + printf("%*c\n%*c %s\n%*c\n", + indent, '*', + indent, '*', prompt, + indent, '*'); + default: + ; + } + } + + if (!sym) + goto conf_childs; + + if (sym_is_choice(sym)) { + conf_choice(menu); + if (sym->curr.tri != mod) + return; + goto conf_childs; + } + + switch (sym->type) { + case S_INT: + case S_HEX: + case S_STRING: + conf_string(menu); + break; + default: + conf_sym(menu); + break; + } + +conf_childs: + if (sym) + indent += 2; + for (child = menu->list; child; child = child->next) + conf(child); + if (sym) + indent -= 2; +} + +static void check_conf(struct menu *menu) +{ + struct symbol *sym; + struct menu *child; + + if (!menu_is_visible(menu)) + return; + + sym = menu->sym; + if (sym) { + if (sym_is_changable(sym) && !sym_has_value(sym)) { + if (!conf_cnt++) + printf("*\n* Restart config...\n*\n"); + rootEntry = menu_get_parent_menu(menu); + conf(rootEntry); + } + if (sym_is_choice(sym) && sym_get_tristate_value(sym) != mod) + return; + } + + for (child = menu->list; child; child = child->next) + check_conf(child); +} + +int main(int ac, char **av) +{ + int i = 1; + const char *name; + struct stat tmpstat; + + if (ac > i && av[i][0] == '-') { + switch (av[i++][1]) { + case 'o': + input_mode = ask_new; + break; + case 's': + input_mode = ask_silent; + valid_stdin = isatty(0) && isatty(1) && isatty(2); + break; + case 'd': + input_mode = set_default; + break; + case 'D': + input_mode = set_default; + defconfig_file = av[i++]; + if (!defconfig_file) { + printf("%s: No default config file specified\n", + av[0]); + exit(1); + } + break; + case 'n': + input_mode = set_no; + break; + case 'm': + input_mode = set_mod; + break; + case 'y': + input_mode = set_yes; + break; + case 'r': + input_mode = set_random; + srandom(time(NULL)); + break; + case 'h': + case '?': + printf("%s [-o|-s] config\n", av[0]); + exit(0); + } + } + name = av[i]; + if (!name) { + printf("%s: configuration file missing\n", av[0]); + } + conf_parse(name); + //zconfdump(stdout); + switch (input_mode) { + case set_default: + if (!defconfig_file) + defconfig_file = conf_get_default_confname(); + if (conf_read(defconfig_file)) { + printf("***\n" + "*** Can't find default configuration \"%s\"!\n" + "***\n", defconfig_file); + exit(1); + } + break; + case ask_silent: + if (stat(".config", &tmpstat)) { + printf("***\n" + "*** You have not yet configured axTLS!\n" + "***\n" + "*** Please run some configurator (e.g. \"make oldconfig\" or\n" + "*** \"make menuconfig\" or \"make config\").\n" + "***\n"); + exit(1); + } + case ask_all: + case ask_new: + conf_read(NULL); + break; + default: + break; + } + + if (input_mode != ask_silent) { + rootEntry = &rootmenu; + conf(&rootmenu); + if (input_mode == ask_all) { + input_mode = ask_silent; + valid_stdin = 1; + } + } + do { + conf_cnt = 0; + check_conf(&rootmenu); + } while (conf_cnt); + if (conf_write(NULL)) { + fprintf(stderr, "\n*** Error during writing of the axTLS configuration.\n\n"); + return 1; + } + return 0; +} diff --git a/config/scripts/config/conf.exe b/config/scripts/config/conf.exe new file mode 100755 index 0000000000000000000000000000000000000000..43dc07c0a6c1134803ceca594cca2bc38187cbc1 GIT binary patch literal 91179 zcmeFa3wTu3)i-`78OT5ePJp0MgN!<8K)^%+2?iY!2vku~F5(rbpkfhtVFpkU6J|y@ z9!H}Ud($dKt!>q6t8{<@fj|OYTErVlwJ2)OVNek?2BggY_gnkSWHO|F{oeZjzUOf-~CmC;;y~dbk$z$^x7$L z*VxxinQ-%rdA>PwXWuk;>aD&Trp}r*JLvo2bl=?2EZ>Y-zLA%X_uV>s+Vp{4x^(tC zsK<@cw6U%Z+T(F! zHx4NzUVYOg?b0-#f@KBP!9VAs5&@T1+ELy9pZp#eoW77vtN9te$Pn9_ZUpY}&!=hE z51ckNI2HFbXqNUo{?KOam-x&07tpl&fpZn$<18^O3m;IFjz#c4IseZ{V50F!c%LWy@%|NB=?E=aA9TI? z?wv>VKaD!tr+$Ajd808(5?wApzhvUwTaPxm{iVGEnl<9bnzpT>uI;}ojHXHB!}|)1 z27SF|_8dE6gqCnu>FaZwN9MRZp|6c%zqRloO)LM_Xbko+uJOBL0hck-?=dR;)}<(j zHV1ph+~>w7C-wE?l8L;=T zI)#T9pba@ecX+e60bFYJ;POmxiF+^a|E}%_@xF(;r$t+T!hP(;)2X!ZzG5&1_Kl#w z(0JQeks_9~0b!Hy1aA54+~-WJiyjh5FVvN0Uiw$Acgo@Q~YgaBFRnv>ONo7epMd0S(C7 zZ9UAgETpkjDAkNXeyinybOTdBPD4`+0O^es;(fql?+0~AAfA)L-ZD)@5&aAq;be{; z*~F4!|9XK4g8thM#4DcKY2w6*kcYJk%%HB(Xngt27aI@t?)!4A z@bbQILp^TmeyI@L6+Y?;-adCy_-IaWQKCy5gH((|QT?bW`%&_WCiVo@RNGRG3LoyM zM`k6H$?)MkJvtAN_I#w2s%Ir$0v8(~Z4EZzwh9%mk@M3Kw&^8sy)DBG?BU^NXPqzWN_WD(b22FTTD zur}i^3iG`N?I9&V-vMar8A6ihJxAK`932ZlG&8zOk5Eb}?)Lpib%P%w5B;>Po;|f@ zIJ-$_J?cZQIob;|1^(I;H)BArj>8e2qU#pYx$`?opj-)LbTTUg}=|Iv@3At=fk zc^SIEhWn8(w62D*L>P;hHLnmBqeo85K@VK=GHSqb^hgLvkk z1y5*W0^OX_R}=y%T@4(X81uoYs_r8wHOG6RJM`$exJA3~u7_MFfDiIHwm+_$jGb2a z+hj5>I$wP_L(*3UhwJxK)!~+l^~iI$(eJ0Lfc+Q2TaTsLMBjm}CazTeu;n&A+Jv;@ z&y?u3ROc)Tp17X6*kFK(I0L^U#>RtB>CuN!1^k#J;qT}nHaqN>ll>~s8XwFF^m4!} zypp3m>%RM-xhqjM+%hXT=&mK%tI#q#VfIt&M#3U-PST>*{7;< z)Omn)-eg`0@{sWmGa8sNUS<4*8Gm4g9~ss{+$l4$r9P9R*RY!gpw> zMgue&v&M56kRxt2zHRmy*(W3wf+K&4l6^2?uLdJ7DCV`NKaR0TL&bxj%C18 zU2f?SFA&Fl#F}9R??dQFyRA#uM6lajq5vFyeMqI8jWS>}$GJInJOdQX0YrRJL2<1G((;Zl^Jb#1^4b;52cG!( zV8TwQY8S8_^OquH7D%H?4(!efF{1zwDq28v-yzN+h*AR#LkFuHY2AzF!qsf~MqG{b z;!YQWTx&3V(Mh&-HkRph_CRS9@koETwCl##8oqNfF4O8WfuRE)^{^XsEnUR z(%lViwKsD0F!~C$if_$Ycx`KW@ch;FgGOj^ei>cF@&5pBQOz)-J3_r>j9kgi8zn1XdKo>WzIE53WKxC{$n(<_wV#jEw6Yz@xjr`iD`UHOU%2_uk`)D@Nn?JR ze4|6`Mu%YfdgxIKfucXOC8iuk^AmU0>FWcowK-rUY+Vp;8Ky7As!|f(rcWR{(TFo}?-0 z6y$#Bk#cFl)h+^z;#nqtwuk6DqE4bN-hmfGSem@aVQDddD=h&Zn~Rtr&OC2yJBmU*USs z%Kf-Dv>6{(ut@UFfLq|&mP^Nwe04{3@vUG%;i`k1cMr&g48tw?3-VydL2w=)kFSRK z)$%<%pZ8Pc{@c#HpCR`Xm|qv(*B|4e4{ncB*hT&l>qIJRq02e|^rIAzTf zs09EOs368hN1<_@2?d+L00->HG_oYTxqm}O|7JW{Xf*;?Y>vzNrNY^?L~wdn|DHH8 zwPx@Ge6ef51#rFt&0D`B5c4O1y;gd^W7*v(QysN4EJeD|9%O|#7b1deBVVkSoHtV1 zS19c(GTs5wg5YSQ&~I%ZJA?dabHou32bR8XOu zWrlxwEjn!`_%Ju*G< zZUBXr8CJW=*F*p%R+7$IsfgIWI}KqGh(pa3=V|M8_%eDvj_*cl%$uz*uN8;fF)nNe2rl)wh=*FaAHFT4g2c1X?+W4q^F<<> zYy5?-{jtfe^LmlmT^E==gQEZhV>EI&(yUd6{SB9I$A*jGkHRQWu$JmXkl&`>4CX7Z_S|92MW%yRHSl&|eO!S|b2cH_7Zmv73WQd%W3;#1p;r zRXbwtZD!%}nk^Xi+#_P{N>{zUVOh<#fL2w0aNY^}sveOYp`8Gd(kKxoK7f3#HnyUN zw%WJ-3kc%7(!1K0gMSY@BPJh%L`nz@x|tUhMz@9fqCo}W&7P|hFDogQ7uSV8ZgSUw zwwBnX+ycuRuogq*JPtcc*Lm297an#vX&&g=%T4ET&|U*Hnqc z5p?wGwONbZ5 z9aMvs1iLm>`LOmO(Li7fr5IqUX^$lHYni_@7g{VO?C-#eboWb*dEQuc z4jcXxdL6Du1&f-h3Z*p@;NNyymyn;GSHp?Mi|IW6!jQKOME@*^X8@6SvUU7J|5wdH zJG>$i)4c>b%9D;eU%JsykXJ?0@MwLL8?FLdX&uL`q!3Z{b*UA6+1iJ&SXpunEM1VO zfjG5(341_OOW4%w7eg#?U`H?xxy$NTb8I;HJM=xbITFpQ^vYmsRJz4e8HkyrMe{8NN=6(s_YP@<6Q^b|x4^{1ox^J4?D3n<%dI-7D;>Gw1 zH@UG|xY5ojt3UWVV=!rD6R3l&u=08uy>)*Iwb5jJdBoTWV?m!1b7L1;DHy;%2P5z+ zTO0elXq5-W1soc%Fm}4-L7z|!#@feeV%f%^uvLb6P^;+zvm3Qw2Hpl`{N6B}Ru4F` z9cEz|HvdXMs3aQnRXyp}SJ34yD=@o|w!$x2W}yjlTERiVs6O)T3cAyb9fbIuC^)*A{6^PoW{SL_Eu&NFsG{eqo|kC@o(l zCoIiWEZxKDuF_G8C2I)%N*C(S5$>{X#w*5O)L5EuRq3m8V};vdg_oJ`s0^WnwCcHS&BQ1r}~CSr}_po>D^^w9@uy^dXYr9rCMKF4TEO% ze|+Y^pK4+BWLT(m*#fj|oLgFI^rUFf_-Fx(hOj8$SxF(-N9mq9?@0!{twDsWMW(Xt zKByJ%1W`$V5kC&pQ!Aqx*~cS0@sIU{i=T#jV=(2PcxwflL{Gg!S_!>w!Qx#;=yDP( zKIcqVStms}&ee#-L+gmr7{HQv7v?O%@*Vq3?4sndTw`nB{VRops6fe5U)9Z#n@eFc zq!4Yiwt{$^3t{$9HftIzY(7rN!88OLVTTDt|+d{g}CkOlvBNI)(Nb`@_3iVsku+J#Fxk zFg(`_B-$B^mG)ya#bc!S#aGDP4lz)%iwIJWgap#|tw_fINCbz7;5sDD0m97Az7`ji z`a2?AmaC#C740B4^qYkbpdS^RxA%`GL&uqw1rm^oaUleP+%zKxBZ436?!~720kaET z6D-Zx?%Jw)LHSla{Fn!DZU)yFH@CjeC2$w!hvIuCKH|XTZ>EnH{Otscd^|ULNx< zZky*}UU}QRPR#4mHjhV4>~3xI@|pKf(A^-G-W5q>IBnCmkg3c+hnZsj_8a8zbk^C1 zJLv*Ai-3j?wbsMdR&zizBA)<9v#tdFG7lX|gNc`qbI<+2*olzO-*-EW$h9R_>>_#7 zy~Z5pH5A%$*rs)d>vPI?>Px-oa{8*V{y`UQU<;PzV_YsZ9G?qMtK6zmq4F7a1;_GJ z+3=neOE2E#^R89o-I@0d;m+XQXSh?s=jx0j{GG^LEgEq%Qz^LtnQJ7o12cPynw~?Z zvK*b6%5r{|##zvcGm^&Htrh3&G|nEaIIluxtDiJp?t1{fGQ<hMEjVnc+n<-Syo# zdXwRxXp((Xj+!Q$S9oLY?r@Lyai7H)?S)N~v^iSh zqh}#*V>DBUu5O5VOU&UCh>Mn0l!Cs4ese!~ko7wAX74xexW0gA9|vb!T!zVFFduiy zAy+H`DsuqCjJ{jU(cD>#-iAT4X*8o~E%9)CJDd0vnh3zeea7~UR&LClWAl7PZBp}T z+WZb1c(ERwg9$7vA-rPnk?3dLg{<&Uw;p{IVz>S)3qb!9c58P(b|WTk@J`m*C)UYDBAT3iMB<6popo>8^F{4JWZGBcolw-RLer%hE2&bk{N1VqqhWmMNqv zu!O$+9O^jY1>8vaR&pTLBPYSS^!tW@1s+R^uE9VJ*F-fH3nH`dPv(Vg*VdKPhc)$c z6iWnXY&0caw6~x}{0KEt$U<4KP#nv!E2FsT@L+-CuU!knjt@fAXnph<%=8nu2&~je zo0h| zkKzSQNB2CN9IAzw(Fe)w^$ZHVe#=HBqZd>0lOYOwB^o6dWfOo^e+_uGM5dfO^lMK6 zThXK*jUooZRHHvs=X1TQ+?zE7jAx1JHo(bv?F`ieIDm;1UDyJI$ope+ghL8+>9yPk?`oN+{Z6-_oysCu;{DCk>|LyM)x@y z$f2^^N>WE$dhY8iDhd4psLKm%g(e7uaeOddPaZBO56{H+@xGe(ucYUb;Fm4fehUl* zzK{14;BPp2%wDfqaWkfU8T&J0NSSF)c{0-+!7|hAnHg#L3HM5cQ_dqwn(i#Me#>%& zQ_5G=x5Y2;Do@IJK9v0fUUwwh=Zpg0Iv!vt+lK61tOK)KzbAc@jDno zo3MU@?y+^Rte>lHCrf5P?5vm7?qk3n?{WhA+KYaMcjk+Jp0hR{@k^9Qd17VqMaWiE zbux7104j*u&BTz}W~({>tl;}FOdSZV*-|O^8Z4Z9IR)#5%t-7n98Y?%0${hwsW#kW zh_o)|eM90G>HabCib-Y7STvwP_|Tst49xXadIY0;Jq$Rq%{Ux99z&bUgm`vY*MHfRN$wpUjf+WDt}&RDh2PzN6xRj zY+wsyF2Ic~Xj%o}EH@ZEVl=GQk-+J@zaRWv7!jw-_>sG*ii?5T3H9OKhdShOl2he3 zv3>;>j9f$UV(f$(Waql(E|;c9hrn9(^{>Yt$L?+T@T}m6ca_F>%RSDgoq)o`U!C@m z!C*a3F-%8p*=OrDh{L`K_i-N#JAC-I#9y4{k2dEygV>PkH4dhm=!qjDP^d`$_cv1l z!J*Pfx)Zt!t1lYLrXebJnnnYd2Uw%Zvw}#_4nY>)j74HJBcngG?oUx>i@_MsLI^k+ zV{HctHR2l$O#ulQQiFjLvT=u%#>~-hgls%rgQ=BlZh+76Fy=L~)WUK7R2%*Z)_o#; z`3e~;a?R=jHBdb53Qc-CCp4|8n$vhKywzn?7sw3SsCFZGMjOC8Ik(RH2xuCtLSAU= z&W8&h2iu?BT?{uC9AVIao zs1|Ng^*(KsN33O9-5oc%HTlf_V=jJq6kfufLx8wELB zVYGLEA#5KS2TXvqj*lFdGRGe|&Kv69R3&DuMqH&SnCKZ`=GYQ-{uSeYYVgFc$1xSd z9-U!9~2Opazdcgnpr~e0>d^3 z^T85*{id>A%_BRy+`%0+hfDRyBPaskvXTB=eboei?uf{apr7^$NCo#a@hsbfUD$n@ z{%NfXHIE@!QA$j~n-wlaQ`G`KeLV<2JyMTc4mA^Nq<-0^(5Hea@uI%o6}B!8xAfPS zo{e&>L6@LW00R`cleK623a9F_O?E%I9pS22s6Vu+VzT~FeW&eDyMmGM#vG?bb_gJ; z^A%!0B?;Y0hZlM}1U)7d^;KDYgPeac#}#3Xzo(fKwmQ`&l%&bR~g26~r!ojnWEn9t{XpjU4AVGG*W z9y~F+!`K=uM2GRv)xkY+=4kc&nBghv|F7YxAnTJo4*aAx)_y7Q$<||NDzw;Ob~G>s zy0MjuLs%HBO*B7mffqX14;`rX<)X^pkfKAk7EeJnJU+0?iV%Tg+zLfvzr>$FhaS!I z&p?~_TPFI%UyNp^QO;<@A&V5X3-XEQ42Ev9Kc6^FiQUW(AIe+MJI+?UvHR)gL;j~b zh6X(C33|<|-PkVsyKBErM+LR&H4u06ys zEx4%m5JRreOXQ$uD>I#O+mxG!_QB;7qN$4UkCwPs2AIHz`_rbTW~q z>CI8}^eE3EaRKCYD9;@4Hgll#N>O?xmCmA7D6$zhV#%TQu(0c|JxpfwD0`(nrcGH- zRTjFNO}SmrdJ?~8g6EMOA)n1~B-JjWv`+()@fei%xjD3`@g5SMn~&p|^9RDG1v}Om zJFk@U72$>6oX~;VJ3OozvK1m@XG%8jIeK^&C}~GZE{{nHib||WowvjM6XCX+G5e@< zj^6P5ea+)yl}A8$!JXm5Zawk@B)-5O=F@EN;x;{>z!^xr^c^K7(@0MFG0u2{s*Ee;{B|6CXqupQ?k116v?LOt$x9SfQ$$7POLr8J7 zq&((vWGyPXPd#sf{sYmtaNZX%<|L2OmLB;GRB8_^@?Xfk(q09?nmW?D5>c_I#cneX zy`7V7Gz7yM=_M@$#wO~f;t1ip${&J z4nk~O!jmPp!=RLIDxsU5&`mfAkH806YmZ7ViaaRys(1ZW?r9Tx;E@M4JY!1y#wle8uklM;_08+vS8B%33bUuT! zR(c-;b?s5gBJ>a#;}OXsbTLp?{qQ<8%4o=p#~_=l-IVV`^|6I+dl5;gxhXrkb*EG? zcG@&dMJG6__NbEl?liUZ^L(;}XdVBJFg!@w2zi3%QV};~Oxd16tgryeJO$&Z#@>aE z`nA-u030hMyB{l$Ot+2Rhw`wNyodY-`=4w z@)9IBP?)q4dk*V1BQV5KG=zwr@|S~`;}PBk=O_KkTj)U4`rn~k)gOj%_Co@}{+JG_ zyHmr5I;y*(=r(nu$AOlH=GbfYdS`gwSeZjXgaL?a99S6%lbIZCMkB{SXcHi(ieSh* z8M?lPs^hRf2{@zmiwlejf4s0*IpO46=E>o2Jqx-d{f~}Ap5hlZJn`e0#IQ;^8W;?2 zngp2=RfQk5Ix<_Z1M?Bc1em+VOB}Qc20Vbf05}^7p2mbXkL43}tNRfMu^_NuFvZ>o zrsP1Ddg`m+$?WFaO|t%dP{4sQDn${c${t3^{|W&VpnS=#s!l?61VX*42H;PoLL%2{(EYzZbD|B>T5Omk1tCHYegBZKyXYjRF;xTo0Lqzs(8uz9<-g24y`O z#ni8}wlnK3E zV+91FSN;N_63Q7YQj`|sPY4n->`)KXX+3=Z;^`>Hz)sFjr#5rJEACI^eMeTw1aFNO z{(buN_14w@4*jRNSLV?FIq$!VK6^su`#H?c(73N0Ph$R+4T8dPbQ`wN8jJWx4A`P*;p$y)mRJ}z(c_DRqrUO@T zZP%i;ST{h5?&1)*;EXrAA2+oNCDPWTd&s5GIt!->QtIFH2AiGiz^-K11H>5*D*Um_ z+*Swjcbu^kPAt61V>MH#Sxs^L3#{Dj$5Hb)2$E+Uz++J=V-qvFntAref0Mms$yWoiDe2NX7ZwT|U z_=kMh4?<0fpB?~7b%LfHsMgW`JDBD3R4P6#MQ1HxpNBng&zDQM9J8!#huJ~(=mE;P zcdQDtSeO2jO_+Lpo2M_Yk8aYVjVuajvFg^cqpB>Zmu(9l&4qU^(xWv13xA6#@3*`; znrmL+)+7C3OXetd*|zdcgbH0}Ug*VxZy>T@JSoUTHw<)<6KQqK;f9{%OiblS@JX0C z%sG@3>K^_UxZjp?#H7=3gMN;15u)P*FA@*K&eI`tYJSuV2GM%h{F$(k#CAw09Y1Hl z+dZ(Y6F!RRG9NLlz0*Tk>(OhGkfl|S^3YR3;C6@{r0qqtJe*OXb19T10SI#= zgo&4=EU(9dqZ?5Tvf>6Yc*UDFaQN8blj?OhHt zUm;=70!a912R-@Nse<5L&H{kxWD;rc8fPhhPZ)!1=IIeK zgcDMOaS<;1Dg5Tep5_sL8VJ(O0p9UZ=kkquG=%G#$5GktN>PpSn3sAII~*~DeqoP8 zc?x|r2#~k{pRcl&PH#?UpP{k|qDRY^O}^y0Y9LY2ebU*7(1)Gp6*K39gV^8L*I;Eb za?ZePg8gd;+ka+kRBIplXR3ca#iH|Lqg#uTPWQ@3_ex6l3e61v6J3ja1MvnkH^IaT z^vIRWK}@M!E2i5xzg0+E3=M1TYGTlnpgTaafD$7 zQR!VxXqvLUE?~&^;VYd(s>&K^=*U*q_;xy*YieoH{DRp;W$#wm3i|$Z_BPzfdi)i} zJA6b70RlonpQ)SO%HIq2Z=KIEFbtJ4z&mWnIQa@?rJF;{Ziw^B-wS!?+cRW@DA3wia_*+-77sI?MVYTIrF~>NJ7@`*NC=Bhv0LCC%V!~&Ru(RMu z&JLBXuz*ws+_Q0)8sI(!7e<~M{Ed?xyqRb^;N+U1F%_Dx|B*tIz?~CAB>sf`0j?i= zxMhL^E;r%H6oeCr<5%#4p!E_12VKfR7z`E|@Zu|3V7g?x@I473H$g0D%!?3cYZ}m| zX4PORKrjjV`p_Q?L2qmg^I(vQKPDP)Id7EVqL&XrvUy_px4{9a_|fcWddd%l&ZY+T zQUfj4Hp&@rL(CJYf^S2+pn~uwH;SHP(XCo|izo3CM$%9RY<2{vh;&EE&glDy$`IM| zsUHcql?Y8$xc$?VkQ#A^vxLDxIQJKN!x5J?=Vb_D6gTi`PS#W=J0@PlX4QG)+@YW0 z)ixbMPbD5mDQQF+oR*mQtJquXc{8858Tv{FHeGqX$n1@k!2wFV^9P%`YHfLwIdYAUuSLqV;JN92CyFV%zi#tnu~lC2QVmAL0C!>kfz(QO$a+ zIt4cWT_Rl55eU^RpZjqtYW_75E+@h%SUwD%(3ZdQ9~B2LlfB=s@hTUTpJ^Z-ym2I6 zrc+aqi+7=oq_4b!v4|)B9O(lq=v$|OHfRotcUFxkb!JNTg{TYXiq%&=!XwA}QceRH z^F@Awq_lT+2BP;y0sbVLlTEfko?=w9PAnohA<%1px9M#~Z29eoZ6_gmrXU=i+6eYz zLL7vWh(i_&)T#;QW{8IvXnjG5*BuBsLM_aKX=ybenhC*$3TQ@+;6%2DhcmLpu0dzk z$(7PJc@4mOVxNuf9Euad&FLIGU_Y6n)*i>*h+@|Wku%l+*CLK*G9}ZCDDsT-c}UAv zWokaPBC%Tt@Ck@)`?`_@>GOiJ-m$uFT7Z~% z)PoCWj1AN4Ww-1__u%OvSubwk>EnQg$C6@ z*?i23*c)o!MmDa8u=He96@@uy*0Fxga32mrYrzhZ)!2b4m(2dCtr?3lx!M;u@dcoE;t8-04z1O^hT{ZKsI7(Wx%Vdx4yqSUyf!1z%i`^D4Z(1C6n zut2i&t?aeIMrOJT56_@8J3SG@Sr zfYR06rh6^`67X!?JB0PnX8iw0xB42pYf# z=GA^BQUkhZ!m6~a_be_-tw@&=&yB!ik3vtu%K%rhE2sk?w--f|!2-ms9l?dsV%~)l z)}bFL#g-_0C%-=f-S8bAchGH~l=vKj4pHtQ^(s676x>T2iEzuS$y!I{FW^DEH-V2< zR8?TV00pvf=2d<>#(PSBoX>t6TtW1Dw2K2^K-+h)+n{y1G%*S`P*i)7pEg6PDZ?|i z!1V05C>|gae%{6X}@x7VfGz-L7X$~OE7#37hV!Mot2-hwD1)95DV zB}47b05=dO_6IG(jKsBkP5}VaPDiZ2W;c_RvQm3*>petgju~oiMGp7(y=6Nx?ccpz z4m09a9xC2n=#cw7%)WH;1(2$WYr(?;=ZQs(P;%pkx zVmwnjUKvaHh=P4;gPkv!+6}))PYf5n6}MKua*kV2U3%%>*`7HCc)1!7C`^3lWc?CM z8I6vyKY&E}{&`!B{fUiE`Qps-|B~|gPojKt|d=jA3_sG7ntJ;qdR1n3JpP#U*0arK6fHtOxg|cnnC{zDd0Hk z5SgZYURJMquG()xgJ`R*yJ@QT@_n}Gy~d`*V}d^Mj^n1TC`(Q<8ZpWjn3FLb3V9O4 zu9-nAd58{J`p_1~&LxWyp@lY0TL~$LW79PuAK_>-(dO?CoBoz2x=rYig(G=Q7 z@a_N~6I!nT{*;QJQ}K;(AM8>Gzm*s4B9i$EVFF%ni?{uV13Q&HP#oBYDBxj0+Iu_o z-R;-^i2d)F`V-6Q5z^J}^KxK&(eJ}$S;Sw1{s#ROm=VdT8H)AI;V6p#x*@>MQ)E3f z1P%@nV@v_#))UuGRy~V(a3PdI7rcKkeR4k|zbEqHvbIRPsz=@gJ&C1?9g6g*T`;g? zHO#vnq%?Kz7u$@SX`t&CftGduATW&wBe526I`YOL&m8G5ULyzf)r?ua0fJq}nhNL@ z^dLlj2o%l1oYkP6i(r^eJcB?TW|PNw2(K@t-tNH$6w?gSH1SWG*`@KA&TTu)JG@*2z6;^6ysUjL0C6s6!Rn-c-Pqoc7@k3^ zMia55P#paX%Nc0FhI=VW$Zr6}tY#mNu*I>#5|@HEyr1kZprKS2ZPp{5fVUPMl`4uo z;-||D4spb}`gv4#G9|v3VANyH0y+xR0VBmTnWbJ-z2;Bk0s&^0qOEhCYOz*De+A)2 z>qVWRPG#7)SV>9OZl+y1Z<&m7P5?z@5IcId3_Q1`*gOmE68^wQB{0JODGS8$4_KWZ ziLevU4<78>P(|`+B^n^X#{=iUh<1pHE_GO<-}T5?)T_pvxX7-=oi!is%Kj(r zObl0jG;ALZ*8*7DP-CwmxmK6~trQvXbQB~qk~)$%8jrY1%ihiY1=YXzS6rL)Ra!-< z9zBTW>#Iidu=sKw7GKU&0o)<$has2H&j@tQ1>ms@vp5OEAuT*V!5;NzDuA{drKQ6# zXu5Y&2HZ{u9Dy1fAeI|o@=Czkli4`-c0JMn9vB5jM@n8A`HmFwk__a0M@$OwP5{_* zDPb_0D~x9F_GzlR4Jjzzg2gCbn_vNqip-^W+5#9%fLFJ$3=>Riq-Y*7OVj`X*WdAo zT+N|t5KGh?Iu*MOa-^QWPXI~i>o-a}zfBQbm_blqpVy`^MQ{ROMz@1B^cZ ze&pAkbVzOY;rA`#IqdT^Vf6dwAO$5lJ@OPmagZn8#Q{h)#Q>1K45i?KPGEyP2?eKM z{k2ROhgB#)8hs4|zP%Let`$f9hNVzR76RBfnujjdy?FoorLJk$~7)&w3qV z&{tjRlJ{xj=|}!r3bq!1f*Sg&u1-9%EWcWnuj-0lWl=Dpy)}oX1V6zGkJNerHUH)o zv1?M3}B@-EXOYwycgcQ5U$=?D00SA^)#$IO~3Ww))Q2`eh1=x4;{>0EM`jFv#+}L zC`YfwZ}5Hk$Hb%RStNw(aOXU@TtwT!CL~b&{&S$X$Y*RqKrkd0kTU}VFN9Mm+rd}1 zKeQ>jJ#?};9`pS9$78Jag-*i>-vbLemVY@n=Xo3qZo%_ZoCUgp)`R)97tvh+m z4_NR-R|{SO*=9Wr@iDZ(b1!mo3>EoyQ%vd#%fAVB=i)3GtA+~7cHjtdKLiE%<$=)9 zr+rwCI+_z4XUr=GWEX1>`X%1^i9s`1Dm@S=3ykeRn2v=R@AXMycNn1ru?E=ODu3dS z*2B=HR7z}P!BQF$`ubzIVk#w7Fx7kr{?u8&!%D6>rO@~waRPVRE)$Ed@LL1HCnEEH z4K|;=|of6Ah3^rQg_hq{hze~->fV|CVDn#aC z=lQW|=%-~n(9%L_Dc0ab1WnzMO=+%X=(9 zA~pQDt^M$fkdV!zASiHf^9A+HZBV%>Z|=4>It9N)L3>o?Oe&iEvwm#yqI)2n?&uUG zeHE&d?T{s2xL?`D5k^y0Zj>tez3%~zLX~Pg?9-6U>c6S^Mg^i(2&4q@-8kGbP8kH# zagvmLcWg=kg3F8j%XSf93IPT^D(eN!!D_KD#OvXfj@SyEk%*}!FRajs=Hnbw~WwZdx03gG8EhpZaFQq2EXV~<_rBX?gKE67@rLc zV$DxLLY(jff7+;Nqc)WKMrcQrJU>79R47c-`4B?_CmMPr$i<+5ddL*7P!(=#Z7np1(`jEt2wC{zh8xwK`w4qfH`waarw(w)_mD<1*(DLic<~F zZ0q}HNL!{((T74<|3LpP~VPKf8z{Pw>x&|j;R`hf<_JDL?yl~0bTXCu${Sx#Nr`KF? zsvda&h~TJWQ(V>^fTY=`T>8~azX!T&CHAHlZ$TCqXbLshJisF@fx^0NRxzuKd0@Q^ zwqR5j*-Jo2Uo}drxK)qvpjO3g>etjNX6aGBmCwG)0Z4p;@e_zVFl0Q_D)zw0tPD-V zGpptpEN|l7OaXr%T0p02KTZN9KA>7w;gE&>B+%5Mw*m!wjkOVzGz>=FU_@z~vHu1j zWY}-wYF*IBk?I7Dz<3GO`s*P!@y!f7)8gY3%cK%OgY2FVBDxd|PP3m@_h_$XKZ1Mf zb3dAlaX0aTwFkF&$_~OQ;PwR3OEBAtbxj?qK|2om4V@J1((JcUlf9^B8;Ov?69DJdQhBSB!j6}22;Kg zC;dtqSk``0mgmLkY^Gs?BE#ihRYamke+j(|J@j+>N2&O1?^2DBU5Rz9{5Wek#6YOSH%DKqj=&qWf1nH=TW zHnwZKiIy=8P@`Gmoz(2Yop?1f_8IvJEaqZ#nVR!ULwH?x^)XZI$PZ8&yDgUtc2o>D zYNdfjZDGKs2UYzUO2Piy(DF*3{u9J^_1W^cPowbUk@YUMrjFF z#;|7(YhA;$AL19d?gSxJoyOG&_>?JS&6(@n>6g14ulyzBU-iiTNVOiCihke1%2t1L z7#;LVz$ShvW(jC0A|SBoR57Xkc=jZDUY26QV~PIb118{!_^HpCC-^ZR-ERzI`R zRr1x(Y#hgXo_3Px-P+L`wikqXjQ5H28eeQ)F2{)01OS-f2j7J{ttSAD&ca{6;K78H zk9?M8%TNZN2|36}Nnig7vha{;d-FXSo;r&@U>pw9L5J!zI&2oFudoME-Wbe7tZ+PD zCJ4bCvztnDdV4p9eGDrN)~me3q6JL>$F5;E9n@n){r#)Qu^k*bxj>Z*eYS@#%f4FW z^M{jD@{yAm5Yt);hC;%i3mK$_q18~06#;ZR@`gXA830m5*~C5v@TV8^k`A z8@z5oDa>-N-|0Kpsl$vB2ad!qVM>UUr_Sj=e1`(gNx(!xU)A2>-u*nD5J;pKi=M+v z3)oW)cQhkK3vu#P%_t-0N?H){%l00B(=E!7_McVP1q z+m|bZdCa+Bge7S{Fz~W;JZN#8$@&nR_@LU{lflSjNLZ)$?&g?B;T&V$q>o+Kc-6y{?$wFAd`Nqow@r5&)#JyoC2r zAHK~fOU)Q_%;ki?(QuhDqH^tsjqH5%yeNzGr6(cQ=__EbuM=R&57Y_`o#A7Y@72|p zUeXQsf~oc}U(Yi?KhBF0C35po`IchWu9&+=Y@~Kdc=vv*;6xeidgI=R77$US0}z>l z)ZwQdqVt$iDq$4_YMca^<%Ew_<%V}3F<+8~zu{^yL>%UFGG+XI<3~Ao$YOq{<_0_{ zu@+OVBgX4^`ToHtjYnBQAvI$JR#J$K9dlF>H}}u55@z`=aZ}&z=5oE9F!$6~t-2n_O+k*~zprB?q!N~U zx2wLds9qt%o8E^!(*^95D;v@`baQPV&ej-WS!`2Hs!f-m{SeWRv8*6w85UGIb_l&2 zi*Dhge|9zmF!QBU#cDAMM?XRv)DIk)%S9*~UhGau$EtrgoTp0kr5_>O6p@#0Q;}!P z3#N_b9(;??^}C-1NEtc|M7eA)?z8-XzAAE#u(}gWAV~Sv-u6YW41v{+yBi-fJ(bfyVV-`M2uB<0< zZ)_C)*O^fgw*CNW^3!NWlx`t0NUg6(w=Wla*CX$MV)$8h^_=jtv>UgnT)_rMwQUta zlV6W`Rt)*2n)MWh{Z23%)|O)81ajhW z8sLEkkvtDpKh zK8>K72)Zf+|EO!zkS?bI!8t_0BR*h(zR-H`>kRUgt+k!i8m!;&(n`J;Ykysc+Iz6$ zgxct@_`T`O+ApKPdQjE=QQO-6S^H0{{UrCR($eE7R@vh4!iHME!pc>;H4BL`pfH}$ z7Gni5PAA6k#3;Y#W>)%u0~m|(s~A8!7BGTzIN+4awEF-WMR{nvQpp;=2M3Qr7!Vrw zF5RSA3}R_64p6^q?iZ>2m>2Nr7)OL${JjUbcnv_n3!z|Ahd_jF`SiEwG-ELNf(>;3 ziHH+#l^~0NMAU+K7;6D(I`@#y<%-UkZRsp0odu*b9Y87hwGfqA`4zBXWl1%)JLqKF z8Yk&uYdtf`@wL^~p8KR(f99pNSu07-LvqcqPDRd%2P?&*y=YlBm5wPYvonq2B_Ocw zR8%IlrSd$f{Hi;s)RBtnAS2j8Jmv@*h4c{$^4d&{HxT2Q3Zokr`yF)hlt@(VwkCCH zX6-(#{aH*}-H40*G+aSS9nk|B>i8Cxh~MuP$VYf-mCt%|ZXqbM-v*GwsWm#Y_Bz&% zs@m7Jt^F!%|CY6Xs%m3+*Q`#NweMo>(W?w_hm-Q zP9b*tUTN7TURt~PN5tNh*pI+g&@!ogYi8{|D6oE~YDaLf--g#{NB(K;J$6tqiNiQ8 z6VuO#X{y3BjF{$OoB&OMJhVT9u-`GEMUy;=NqqJrfuEA`bD=Eu7AW&H-lbf2s{{ z&tqgu^Hxn9T@{Xh+>@$qV%TZR+ezf@bn;fHcJa7Givi@= zltkngK_B)EWGYG66`AGY1?ezoI709maAh>vLkXq)ic7K8W~>krBw}&Pz{|Bo!Z|V08{Obtxp4nRqV&$P(g%TDp9TBYcVjO4ux(xp#Bj! ztXDuGZKNxhGeeQCY)g74N#BPU(_RE1r-mbzg-3AQg;fWts(GoZII`f3$DgqJrK~<2 zfMBZ`8TK*`5bd_Yi#egR;$7v5DOaZzxvCX&4b_Uz;JB;~pqOq2UtwXbTq*)w#7nCH z13+tS%?BH+0L1mrRwHcFLqJ0r51+rX4FEd^rXtHNpJ&kf5$T|g`hieqs|ljDmlNN$3g3{n_-cr63Gi8u67olYjNi+=qkxk$Y<4A# zSOWUKP&eL*aJK3aPY`M-WMqGVAP4eS>y=mwmvwEtR*z41cGM$HkpF`2e8t|avJLSM zwc1$6g~88LJGCx-DSzUp^^AhEQ}@oVX&OX^lM`|#z$sWS1)*oLei)y8h7*Hs+Y8N{ z#8>2Tzv2>a_)rH<^AF`Z)BI4U@FA?ogy{3}7#H7YI)nG}$^uV(Ch)ZGKLay$X9WeR zT?s%gRzCSOuA9KO?2z@w6IPfsp3a1RcQKLS1*C9X@h5;Ru{MReg{fy%8Gm42A@{_G zmN=|;RaE}Q*%O+yD3#xAL&E$`WI1ofXQIa9Xc8 zF9qJkFbjA1QL#~APmgNwpm-WP`WYndtTql%ArF84g}8v|Ej@ZODiHup`XQD!eP*S< zxw219sNB588~sd=TnHbFhkJCX^j~;BQjh4!O5x;tD4c3tv>MQ_>`vn!;k zU54K})T0AXExftE%!w6@9+^oCm;iPv3ouE>yGg)Co*CeYup+<|#rgDh8PDr_;aw*1d>6Ge}_0T^?KJfviXmt@qa{IAc_yqlcGBLu^t(n zlJS?SyZ;<$1LiFrD)%(-Km+wGyH2M5_pfwv*?~t4 zqF|pv7Lgg1gX{;1jFP~vk^F!$0lo#bV=VDgWZL{Ox;i{`M5yIY3FdT1j*=4ev;G3AHk4+RRg}>S}d}g2{Aj}L5>DN!p2(;z38LkTd)wo(F;6R&EEBwTD_B9N=5NTf+bzF0D2jI{{_3;p^sB15nfRTKzr2zn+gjkt6yO!mD{JNn`i

H4hn=B)H&Nw?zjR<_0Ww=DQaveMUNrT?6j-kOzOn3W!x zl@4a5XJ)12S?Q;<(k)r(C$iF!tn`bLZf*bbS?Oo8(w;2&?9amY)2y^R3tr1gAIX9* z%qriVRlYAP{bpABtE{w@mEM_^ekdzFPSUONSd>-%YF0Xsm7bH8-kz0yJS)8{EB$d+ zx*$s)HCg5Nwn%Ft7EZzcKQ76TJezEbufg_)UABv}vmHe1@)sAD+U(s%C_1 z_-!(J!_T|T`Aqu?JJB18SWlBTLL0Rb6XDwlCSxlAaKi(f-M zBNsm*SN9ar74MdduSPB-H3B*71@vu3)gt^TKvUHq4P#eR)zF$3c&X4zaTc>G5WtR< z#rd$aMbvWjb=Pk45CKCE>lPy5*5Kh}@S~UJtY^UTwzRjd zt4sE|z70R1cWp*--T!Vn*=JfCe91n8+S(`RlTV6{*Zq9%{?)(nv**set-o*9 zY~Rh(XU_3Woj-NP%&9+|Io)^T?76<+%`@itX3q)Em_5sP+w|Z-4zcb0t7!xPRaZ58*1XwJ?TlG-Lcz0Uhl05Hpy9dGr_Go<{RV&y^pWGs zL$iEm+&c9~(|xmNPP<|DtQ%+CbcQcD+ZUQMZEA43PvwN>PNiMICi=|NN-i07MPHxR zr{BCj^MInH&pf2A?lbRNpVqn0yv`b~)8}ckwX-hJ&YGp2b(?n9ty;g%{d|{CpBJ1u zH|U@oIB;O+en4_VXZ-n4kGBe`TyD5|_KX{*Ygd;I=rc{bb{Og1p!xcMYp~!{(fUm5 ztoei=T)+pw0b0g(4LmWRo$UObQXJ4S{|b@r*AG1P>*uSQI_r#}@5ULkrun8#zj114 zW{N?l&AwCn%scfIf_B!V!l=1((Oag4=FXUPlW)P?89`oW--!M*-8XgNgt6nZW!706 zsHB*tdFAYo@8+rVr=uqZ+1JuFrcYBS6g{#xZszo<^QQaeLQC^z--1S6MV0Ms|U

Jszh4 z=34w+oB`Vx_eW1|+m;lcUm#zbrQNFCrYRYnmD0MCgmtOA>~dP`cl{fIr8>8k3s2?O z`e>*9%g+T`g?7Gnu6CX_Oe@z0Yo%I0?JVsa+?8m3wX^X#6ZgChcJSrEi?zj9kd;oA zD%`_?eF$(5)%pYP>4Iwz=0gLuGuo+lvev7e+|#r&?Syvob>!x?Taw};b?ue`b!x`_ zXxp=9i@17f-SO>_dxiTXx$lVYLam2(yrlA-@~&Dj z?ux!kRVYi13;*iM@rJYMe^vgUs6odXbgw~|n&|EXTvPOM zP3TpFt!f(1J;OdU&4<5J@OLWyPQzac-k)(#`hD=n>;L@yj|^x7-{-%4^vEt+ zSA2V6=luTff4*N_1z7*;hQI7jcgg9F-q!;?uP1sP?~g~X>kg0K9bWe&d>5mqos27? z^QFf3g{!ybL$B@qJ$&+k(Cjv+ya!7|m+9tA_sQ43N`7CTeC=RzFruG>$%Dyr z<(qf^y-&V&Ao+cL@)3;C9Sy5&#K#6 zqV5vFwKv)RXPA^^*GQ!=I0o}x;IfnLe}+j(s_rl?a7^viGTzz1WhLAH43m;f_z@Y{ zDl_gCj0If(NVfkOCMCnPDyP=SV`^v8A#}d>X|ny#FezyZ-!?U>4faog>yu>rpJ7tc zw)U~9>NLJjfa~LA`=4P_GE5uoK#xh+Iu;{yJ_fEm$@V|Pq@=ap53+Dwm`-0LcYA>A zqh$M^VN%kHtNpvNX^bBM*TwjJnB@0=`pMUJCoj=1#rJ>y$=Akde^35BIS$wV^pme$ zhR@~r`yk0X_079uQ>om4beN z`}*W-JCpzFGx0mh+N+bVy_5XDKKa`J*WTB_S5cjLpAb+>P-6Y8f{uy=6=Hx8a0I;p z0s%r2LQqt6a!GFBN^0R$F&#TXfysc3*${ zrd_-3+jV!@eRa2em)+U_^PF>L=G-$0Y0Gwhzuk9Ep4>D4=Q;oLIcLtyz4Odv2!HO= z|KBx~i9hqhaJjJ;;$w@IiFf@Y70Se)`bR31iFbTEtQS`x5Kf5+bd~jJ4mr7#S1gjFc{|2~T_v3@hnvuD@BCglL^=&^sxU7liY7@yKCbBLQ z-}2*w%bF7qI4_&32dHQF-z*%`yT3D#xe z8-9FnSrg?LJ^l@F{gEFZT-J=9UTQaUIsXV;ule!8WsS|1j;SG8y#}sV{rKRr#^#d9 zwHD*6;QG2BA6(Xq#1+N2Fz?sF^)){}xU7k$G2>lDCHoq<{?LyPE^Ey6;a+zU6Iqvu zSN!kK1=k<=@xf(HXggXg2lhVz*UNr#I6*PopD!mWk*6BNfWTbN+LFEB~k1?-I(yv;L6^W#UWzkqYv9=!-|_ zdgu%OkqTvEpKpgeuWSjAu6IX|@5AxuLW;g);G!ZwHwl;nAE& zk3WTSJ?Yy)rXqaw^il1T;CjM8QlU&d?#Bn0HRjwY_X@Ey>*FZb=l%HLvc~4>jb$S1 zGBN1K2bVQA7a`kX_y)oCIX^zQtch}Mk6{S)p99xpetd9Qvjabx3GGLVJqE5v{rKRr zCQNDIpY`K|%Nl97Gs1Q~;x|P0r3G1+iAVhS;Ic+r z#(mysFg^mVhyD2AvL=or9(x#Ed;Iv|vL-%V9J&Ww5Bc%IWldZv!upN+5%LhY9`xgb z%bJn6O#CKrJqWG`{P^Iq#!N$dpR!6MZ5{yE{eFCKSz~h%a&rvd{ouOKj}Ic|W48r441nt% zKR&puu^Dy+sZHHI;JVw74=!s=`?$T&DDJz#b(e1kd9ETnde#~}eiyjz^y7oeny@6d zk5D&laVNO$@Z*Ea8fkgQVR*>u4shM>#|M`+I#-nPFnqUz>ob0Qa9I;_>DXN(aDE0{ zyZrdzvW6J$9wD`6zlZg^z;&A+A6(XG`_VrKz;+wBKJCW`mo+1C+-sHf)8M+*j}I^)Bl3{d&EWc!A0IFqLlbg6 zFe(#Smx-JF_~5c8=|_rxj(N9(YnvY*aCHFe6vWT|_TwDG4fO~<^6f+d>KNT=; z1y|0G4=!tp)6)LaLHejR2d=CiA6(XG>t|xqYb||d!IkmjgUg!Gdf#E#GT`d= zEA7Vzmo=t+bnn?B?libI`|-hLO*C~h{#+3gS(k}Tetd9Q6HPx-{CVcx1g=g$KDewI zDZPz%f-B|62bVQ=8WZ_)P}dZ=I{f&6Z{?sdQ^xP@XTA<_wfphGWlfm+D?tfDEE;PE z*G4}+xU7jBk3`HLiGZl=RV@lHh9dl!~kxU3mHz0|(UWxNJlSNrk7WzAT)q|Mdf+Th0rmo+1E{XtQSZ2;F*etd9Q zV{?7Ah(lXk1+FXo_~5ceTaNbm3bS7ct}Fcb;Id{k4ypS?Rn9BGwcd{pE^7|Yr7hNj z>vBInxUA8Z;pf*zXs^q`b(tR@T-Jmfqs6`s{>#9%&W{f+Yer&t)hgXOaJBmJ!DY=z zT(4PNt>9Yg#|M`+_$J><70H-W3sj}Id~jJ4$7N#QQp_vBRqw|Kmo;X( z(e~=WwcL*n_*FVIqop==%fYqGj}IE2Ch0kKDewg?MK_I1J_bNKDewI zEp@1S9pzpMt|fkaz>^Blg!cHI+Nd>M0u|A!;JVn44=!tLhPOs2-^Ji^{SkuHjF8gK!v)tx zetdwJ0%&5=jKF>oxEA>F!DY?ZxfXzHz8@c4*0|#PBb1{!m-*nT@#BNb8dv;aj9fL~ zn&-y{mo>$?kGww*T-APja9Lxf{oyEOtOnOyKR&puF}cFM0~YICaLw`KgUgyQ^~kZe znRgDj@cxw8;Id|9hGNZZa8>#7!DUTxijnuLz;&S?A6(XiY2UG0DAZBxLU2|3@xf({ zX+PRt<>-E@E)XT9<0l+-^f4csSa#gxGo6{UDle>>T|IC9#fvUYEM8i-Y7dM`@W=%_rbIzJItJgH(Z%so(!<3d| zkw-&AQ&W?(#&M2oZg%JoSv0pGf}AKj2BxJl9U?_udBn8d4BV`wGpP>I>aDI_(YU&< zaUDhFM_uDm6ty$N^eCrxf2+p^ziA&i; zWmwYCw6@M`u5GC!>LwI8+#zIbT|?axDp^Zy<8mriQw#ppHWIz&Yiw#2(~|A&sa!#@ zn<=reE8D&W{%yLuvl&nCkV`2ql_~V}dF%j6`M<$VcR_^ii42nn%x2Pajwjudd0pvz zL9<9mD0flvLsBUWI~_VIx!ALm$rXjPu`GYOQ=~hY10S3opHfAI!uF z=d-;%aA+kzBoj3h8ipGTpAsb3Y>2^AmY}HUNaaw2ysWg^5xJghcTOgtil}`-Rn2sH z*&Z*ImF3=%>k%pXm+$M|nC%+fL&ZNIQ!D-zQu47{F$r=C;z3f7Zb%;TNytr*+aUKto`Jjw`4h-rLjDdyuNEDL7miMboCcW=xd^fx(h9j8 zat)*tLa!t(KyHNWg6xJo3V9MjFD-oq@&@DpmcXN3MSs>OQtkCBFdj2f{K-jz;+1F6&T6hC>%=!KsQS9zj18@~~~5>NSGgwF>_aZ(59bDWG<*zCqJ6XYY;pbt z7tB=KEZ*q!Fo(9e;Z{AbX8!yIv|U7->t4KY(V|PRU7Dy}ym$$1bS9}^v2x|gRjXDt zG^}3T*x1!iE$+*C8ZGh#8x`46d1PB@d%}*AN)@nx54gXP0G|t7IxZ=vI>c!et zAg5o3F>}_L4pd_HoEGowbEcdzO;lBrlOnY(#xwEL;1!I#ek_N_k57u7@cc1TtQ4!n z4)KVnXa65{Vi|sqc^$lf+zF2$H{us}IsC?LwzyU76}O4U#OK6P@pBB;?v?Tu}geL+|CTeDeo1# zIVJJkEi~Vk!~mmI1`;YyhjG%WugJkKG2ip&3IzFg`acYEVkfV z?L7K01KVwQ?)GwS#|`3Y^neHdhiziJcw9Uoo)ljYUlh-Y=kYApm&JbZ6?~)dl6V zmbI;CA~(6%^V*J^JmDyZ)_u;D<0el>9%ni=&T$tlxY(WKoavMwUlADc2Y%jT1-~p4_ zJH2AYd66cIMj!R7Fk?^0F;I!mO89M{|Nr3s8+_(O=k>A0r{l<+44#kUJaP%23CQ!# zczEKt9mmoj=75YiglAU{8Qg!zdt|u`$HfZah>uW)sL0YygZ5G1W8OBD_gYnISvK+) zG@W(DWz89AZ?N}~e-`F|n=u1#=l{D9dl<*-XR${)J?h_#*j^m9nlZ((k9?Z32>U$# zKd!V-!1hVZUedN*ebV03D!wq2&7>|73k%sTsmvv`vcgIb|9R1ePqp9_wPz*7a>zW$ zYRFm@r~Rm0f&Ggi@SAyVhwG4|R23DXH-jY_`($-0&dpai+tYByn}LlZ7n%$LKoL4q zJy0)b_>^xLWYkTSRd?xiZvhqF{yHe z{(?KRxbR}1ps3sSWKRZeLtUpE&Q#O0x^Ow>BOPRbgasZ4&F@ z4xwifRR+$@nH4Dpxw4fdb+X%1J)K?I?PDn~dX1Vur6ljB$jm4}t~bAV*2ZM}mXMb( zY^a?K!%lckMq+F|l?ie8tb`bvnGi=KzIS#)JPY|&70zRG65<`m&mr@$zXEbKWGm!W z$itA6k>)vk9)ivBa}#1ZLNv*0IrLCH+u;~=L%z732df%u={lghCj zpML?)4ANc+>44k-{fppy0CE=cyaS&Zz3)T;kI20}`7~Ve5(oPdz7&I#yx`&}Om^Yu=;%`; zumc*&!d`=w5ioY1tlhp=7P@nos&K)U_oT*g7daayijRR%e()-CqH+_9A=cj2+mX6Z z8dq+1ooO>7sn44@(cE_fzrvhVQSR;C7@a>|oDiR1BITbDZ%4d2BBURSP@1vWjnzh% z;Wx3DE#98Z^*M#U9J&SGg%foNF`y)e&weF@bwD;}x05UDP7DH_2z@8S#whZT{#OYH>r`jwPDeP?r<1S4MdGYQ!nwu~3+0*Z6139*($8s5i0dKGL*9Y>JLJ?g z3DF4oCG^AiJiA58arhKU2>&ODWYb3n+8Q3aol7r8KRE1#o?V7JjxHl^Y~;|laAEE^ zs+%Z^(+6&e6jBtY)6k|=k0jVZAM)%%v2$d0&bDM%FB@y0-oi=XSt{?Zk7O+TKF88;b`@EIoFp zK)CLVB&piLc~LHKiBDeG^Qi*z;oHZYv3NI|5IcLMOu^^hZ%v3d@OgG$LNqB!;`7fT zb09ZdhxrCV`mspUZ(utXzTYPQuiU_b}XE~P5w>UT>dPlUY?oSH>a@H}RN(irl zpcBO9a%Fv%vy6KtT(roEDwS#Pqbm#1lgw;NVd=rIGZ6Vy7p^VPjAGyxtWP12L-s+Q zhr9&&8stHU?1o_dF8D-?6*FId;KdR0s}-D2v)vM-QzNcFCaU|-^l}MlGZFWjGlk?1 zd8sfH(|d4*BW5}>PGd;WI|&S1DrYq9#aMmiv(C13PoWo=9_qR!wPSO#mrmKL%;`=& zh*YihuKao+*`@b`bBe61o|v^-o*rn-sUfM}f#6gGmwXkxO5nGpRLHYU1x`SiOX*g= z<_WAdpihI6mODtRWd8(ve5IuKaGuanoH}$Ab@YlVLK*V-S4=+fx3)TWBhb(r9}wrQVTWqj1&qtU=uB z1vc^hC+iUAQdB2RjeMfT>`86y#T!$CHdKoOZLQY`*^EZ$TN@k^$(}sUju;uyt4X}~ zHn=(tJ17`FeC1D9O>!JkKMXyP5MPG84LJew?c3vJC3G_(&)<*r10>GwV&MOHALda= z8gc>T?{4(WI<-JHzh)iGH*iQ-zO(y5ShK!uadU~wkDQgxC&n|d)2 z3wSFNZd#~ImL$%|deY*=RF>lWaSN$8pUPuVLo@$OTqpCZe`uYfc`)s28k9+Ak5ss- z?sH-Yds4VD#4iTYU$Lt?@fiU3LFk-AZ6vGEg?lpUf(jEC&GMMaREj*8nZI(C3w7CC z{6?Il9{O@Zk@~!Yt8=>Vg~nlebqgtM-tc%){X(mk9>*l%b)LTYq%KTives)?T|Y3= zFA9QVle%o8SlzUAT?4+^m#_R;!gH^BWe`>Gzhp}!N`ib3)s=`uZ3*5@7h=vb>@N=Y z17j6g2wgp7J){GYgY1Od3E2Y~gggrwg1iTLA94_K2r_<2i71CmflPzUgj7QkkOs(l zNCzYb*$LSN*#p@Jc?I%1^h6QA!w-iLe$8ISg%tz3Ol{C{%&PZOSpJFS^4zPq{*@l7eZcZMG) zV4IEo?qoVc@y`gaosIwx@t+87P21BMk1mPnt}-xxTt`J(bUk z^Gb1vfzs5JcD8qA^C{w3Qrg+sgCOerJzVRE_?DNW~-g+d?2myhob>ac!1 zmZR-C#;>G!H*QD6W?+0Sn@{iXdQzLP{>h2m;eKjIs$JX{?sFj?8Xpu>{CqqYQ~V$P z+?=Gg{D9(^H9s1US+*nFP38EP@pMm8h(q+L8gMUp<4KNhrYyu$97kcXJ;QNXuYDZP=cx0)K=F=Vw)rx}(a>c70>v|u^s5xlZS2_s z{0}MK)6N;ZPVs{L1HDqtLGW0)&9VwzSP zm7=snmqnv^D>o z1|bi%VeaTC(huZRNXT|v2ho*?6dK&=sPRR2&K!#8*E}`)H`aGOcMgN2-lEH}X|5y}BXVQfn zc+_a=>&q9id6B4(*c9m8nP|`m6@}V)aJ5E|S8h|bkfk9L|qR&hdJz67^OfZ3>~f32{A;Ap`jgki^GTnc3!H zAoR+<@c4Qj$bJL)8X-pR-vKgUAP0a98p!_wav(swu4KO874ky?LfQWeHqMFB+&=`e z-$3wlL2*zaNQ~`tAUT7l0!W*I%mY$&QnaQ^fixRPE0BHz*#e~egJjAU6RSFp%9q1`XtMK=vERb3ld+ zTCWd)R9&bMtR#E9Olo_1l}4xy4^b)uIR*#KfPs7*$N>X614!F!&BM&Nz!(Y;Vm==> z&DGk5ka<7`4Wy2k4WtzaeoPn{2_BIB268Qsf%#FJPXfugQRH4ARToE*r-9&yo)PA+ z0U5$q!{Mm=KBc-eiu@SJFxrR`;{)5@Ai964w2{amLY75Sm0|uaUl~O{0ptK?<8bs| zNC;-*F!!ZEnlaOcHdg>iV5SXix+s-_TnA(b^J-{wEAg~Oc^(BaU?4988B_=k8f@PI zl31sC=nR9mYF9a!JHopE1#Fzlv<;>D8IU#u`4C9%s;JF`qhNzYM_8}ZfH>DgZ7Rve zK$Zd-G>~Q>RYrL>0O?OfnX_br3Wa694#+@fG_MDM;ODno9$EJ<0%7>ORI4bJLgW~`49IYAG*uEv z+qP(`tw5T0M3L)(4BQ???gCQ2JBmC^$bC`dIUtUKd>hE1(aY}wIbe*RVIV_`qdflz zWdD*VGT|8XjyiT^%bx}Wj|fCs^?b6a(TK-CA4qK-tknqY#Uj}BS4WXXAVV9XhzF$H z7>5NQ0(Wl09=wYXgXeJ|j)A-gWN1z_)f+&{4djPF4j8lF&wvaYE%p(Rs##Ho&gL?&p8&}j$cI1< zo)AqnVIsz%(S|1hIk+uqGYv?&aTLq}GF%?DsRc4*Ak9Dqj1ne+c! zI>9KLK-uB$=SED{;xe9F=&j!Pi4FmxJ3w@qn-x-8g6=Nbbea26Qd#CA1MKQDQ-Nif zZ5u)+m0|R9UQX;C23;O$L-ksZRA%*$RC#n>!@BOGGELX8)8<#tB`pOsJnqw zV{u_3H63UiWuxwj*vvC6=6Z{{-eO*FF(0(bT(Fo2Eam}=xf)GtmKl%7VBUz-eg2ac z^N__nWHG;GF_&A+`z+?yE#}uP<{w$ij%F^w5`jyP549b!(W1u2smOv`jPFoUONE;r zEi-k0jcijrQ`dB4o0{>ueM-z3f^yWOw@TMtkJb4Hbt;X_o21L5k?Ki0ca7BS!(q$y z3YZfX^N_{-UNKMgdnlXYku6qps>R%FG51@{doAX@7V~;*B(zz~35$7y#f*haQJMFI zEvAm;oW(q7F~4dtziKhRZk4&;Vt&?Qe$!%p(_$XBmu zJi}tf7o{do^-_zu-eTTwF|W6n3l?+1Vm@dw4_VC37IT-yjBiBDTGYH}F(0s)_gc)a zSj?|j%&%BIIBYTBX)*7!nD<%CJ1ype7V~=+^RF!CUs=pu*3pf}D~rw`yDa7>E#@aJ zX1YIygme~G$6&d|yxC&D#bUn2VxD3#JDU0Ta0WSX3}=uTdW?;HcBr1AYdW$`&4;>o zO0Xy`+H|W{{T}OHK8Cta8$;cvjiK)EkD=~~-(%e;jiK(&80zkfq3-XFq3+GP?s^R{ z{{!o2I!2dA+f*N;bJs}CUY%EPoVHoa?^?_Ui+QRKTE{8foit~FoW;D;V%}ph@3EL0 ztQnx+V*Z82Jl<-J@x^)7(D!;~nFlQ9_bq0+uu`eys;Qc$Py?yC#bO?`n1?OqL&ZGR zhpg7vVKMKwn15w4pJ;$Tl@^>NYIFjg_KJpWhR@?s~?a-)6PyPMw#wsorU|>UgVFn=R)37V}#c^IH}( zeRGC{k(FMX#XQYoPFTzdi+Q1L=iuCwvzS{g=A6ZxvzXtvnENf}mn`N37V`m%`9rHU z1}x@VEapLrdC+3+u$Tue<}QnQm&LrxVy16-kucJO`z_`-E#~(v=Jze;Dm}u39vrfm zKeU+3!`@Nn)AHiHYW7>q2Q20ei@Cp;r@G%NbGg+T!xnSSV!qR2zSCl!88Aa7K7oV& zATy7CH&xo8cS@R($ElPw*nYeFW5)#PbtIT=u-HN-G!kUX&u_45y4kAfW~6{wn5t$d z>_K&|Y_^yeTFmP$=JgiyofdPO#k|L2e#v5f$zt9Y^p0+goW*><#k}8Q-fuDQv6%ZU z<^hZOS&R8ui+PvDJYX?bTg)_$0EYcl-E1-Etacu>m={>gtrl~u#k@0MhDuc7D3HwY zM*-Q?!sY#lQ`HdI1lGq)pEQ)2B#d7LqnN80@7m*)nQr)mu4kv9MN<+%st zNsOU9(&j(6JbG+2b9st~J3s}7mf*}S^AJT>KEnbq%v??Nj1E7Q*8mK2T7aNDdNbqIMn3!CA90Y6U& z^U`DlAUcF$nGOM~TIDFmbJ9_+-9BWn_d;bOX!Y@~fj+A)|bxrjMuU=SeQ+;Z& z&Ad}}-F2$@hk`Lrc?@E1(RX|BB#U|kDaUsh=&a|_!$I^=(EW5KB80XtBh_G9jx~w= z0EoV7lgM8J(RX_!^0z?lS0&`9W_sH3m`_`nmwJGxT(3?!uU{h-Z8UBrPuU~}cuyjy z0okEO9hl{VRzj|yb(znDja~z&-0@J7ytBkL#cwa$>2ahWcY2(PsGOjLl<&ph*%Q=) zkQG4Wy)T_tD-Z`oqa#k1upJ0(NT`q=APKd$kv4ZxDpWJ9=^h{t;((@OTJ;5DIioM0 zCgyTH%Z8^LB+oYpL0^T)kAVfQsyK}N(XYnn%_+^Fddu+e7+*@N^5*r3rnyJ7Poc*48}fxK!U z&jO(Mb$A{yjYqY|2PLFjk3CL^y+&TA14$S*6+mc%8MUE$gs?fti*y&kX2{^F2hwct ztTlKjRXY&<`vlqVSs>4ZBh#bjDCr5!=otGHY+g6=x?3^Japn$1MW{ z#^Udhs@32rnT(NXjOTJfj8>frM6Q~srnFT8F-J=SkX(?88v}MuPzz5zYMKZ}3-Mfm zRQ)KAtOX&RK;AV-)e{o)TboxM$JGIy&uo(>M<+XRDHui4fIg|Q9 z_Qg}M$pt)=>O~+ljfSoI79;xTChcDVq4h{;^8t`w89e_F$Swmp`r|?r4CEvr`kP`| zo^ybFVA#wCvfe=GDXumHX#}!As4123Dj+mkWKBJOTriz^6B?MQx^IC^!r-|Mi2jB} zmghDg9fr+gKxhL99?W&@z@W|OoiD+LX07mOdJ9OifxHJ~$SCvQ0C~x<`Bxx!8pzQn z$ehELKNARTAyNh8puv0zkXHg88Z9(5`;F1k0GlE3gza+;kTxK)4G|GtKu*M`9(8gl zlL%)d=?*~*1PGh3?Lm) zhW%axgm%MLT|x*pBvj*YEs&w0UZlGk$gsh@1;~2_avhLzsorb2TpnHQzN?1PVvy-9dNbbWwQJx5T4pSemGQX=#gnJncu<=_27x)CGaa`FjdY0{1-sJ)(Swopg!V&Mm8r7L74hLb9mZiZwg6(9Y-rAk2P(GGX~q@a+-#qx3xEmC%1wnr( zoSGkPoxTo5<~ZlaF$s32d-#b`;U#nQqLv^fFD!yR>1Deso9u|RuWSb|gT8{dFmAxj zaEQsfk+Sk@V9+=o`{brc4zD_*eVjs3gVeTkwl|NQxLsvN9q{}VxbxOj^njYmUAIa$ zXBVd<9hMQE$lEu2c$p8qPe!$BCQn{o%u&L*lK1QgPPLPz$xE6-*38|DIDigJ;pf+E zG^!*$lTV&$n2rECK!P1OOpEMcvcho?DCP0PyYTU8G7%6k(T>R^PtuZ#w9$R|MaMn{ zYZl{{+128buL(SMDFXu>DzL!-B0rfj&UZs3$^%BCYA(dnrWkK>kn>|)aumUNiI9(V z$$jd7R+B$u6_vb<@?pjv0s}KRV@zi-NaS09WMbvI&IDyza$A$^K?kZ_c+VrhKMGRE zleX@qxrJ?0UFq(021C)qsy;tQq1R^N=_jlO?*^4Hlfc<(65m9fW#Ejc%7W8Nc66XyrDIKMI6ektyU-qcMv_yI zY`MURFS;3eTyDUrZ#tjenC?o$p-@19iE$HLC&Bx1h^c%O%G11bRRnK@(lc-+8jEpc zhSrs!=?LB^F(&Xzs-9s;^cvI+gps_Z6s zv-7m;IF+Hyg_i|vMXYE^oRG8urA@;TI%Pwi4Jep&o zL0|GJLKRqcg58f)W$7GGjjo`n(NpxEFxihmAHok7BjoX3#)!f0V>!Ob`8F=L=^*RM zX1CB%M^2HUgMN*$|1R^iASW_TpqiKC+Rc@u!XY46C6d^9eT8a8d80#?HW(ThRotGa z2s{weS)F(3)F>@wOtMm(imV8^G+tplPDI>Ia-W{Zi|*?NloVV_c>Fn>G2pt6Zgxs1 zX1I`SS=ZRQVl`fnxVCQH(k8sev7u>+*MN64;!cCImeZX~8M-c0N*o<@a|2A#3T{Nl zdh{(Svci&@xxA&VO)VjHrWHbn69Pove~C_fi%P3BQw z2gvN;jGxy3s>RgnADKh8nEKLBO{w(u%g|Qd{t7CDFVW=b7~LxGPm@Eyu!fWk7HH_S zEY2X2-b!~Tu>#qc%*&4DjQN@!-48Fa)Tx*;H)SwY$U(st+UX&k9dO>jRjba+7{x*F z$jMz_+~Fc3I2r>#kfSv%h821r{``0Wgsk{zGMYf${qwvf#(~A9)h-b|?pY&QP(nF= zR9Cd?k;jvFczK{_MpbK+31yMvy}fwEsIM(`yU6=8xM8e3X9hjTw9jXaHPOuGuYPcH3p-tXY2smFi>psLAF-J(5so4Hrd1P4SDz>#oxfwcoNs=I zrB=n3qd}dp<Nw zI2uMdeW(nA;Y%xLxhj#Gpr_=aE@k?~1vuSB*Hcdl>l|EB$zk4=-na#BWm8>q=Xgnga>@%kDw@00*`?x^3_O&o)}tbY zlN=p70kNR)%Ak2a9kj%*#(yu{B?&{TrMgJ&Hb{m Rw7*w%Hp9|OYt)y#{{i>HgmVA@ literal 0 HcmV?d00001 diff --git a/config/scripts/config/confdata.c b/config/scripts/config/confdata.c new file mode 100644 index 0000000000..a59e245508 --- /dev/null +++ b/config/scripts/config/confdata.c @@ -0,0 +1,458 @@ +/* + * Copyright (C) 2002 Roman Zippel + * Released under the terms of the GNU GPL v2.0. + */ + +#include +#include +#include +#include +#include +#include + +#define LKC_DIRECT_LINK +#include "lkc.h" + +const char conf_def_filename[] = "config/.config"; + +const char conf_defname[] = "config/defconfig"; + +const char *conf_confnames[] = { + "config/.config", + conf_defname, + NULL, +}; + +static char *conf_expand_value(const char *in) +{ + struct symbol *sym; + const char *src; + static char res_value[SYMBOL_MAXLENGTH]; + char *dst, name[SYMBOL_MAXLENGTH]; + + res_value[0] = 0; + dst = name; + while ((src = strchr(in, '$'))) { + strncat(res_value, in, src - in); + src++; + dst = name; + while (isalnum(*src) || *src == '_') + *dst++ = *src++; + *dst = 0; + sym = sym_lookup(name, 0); + sym_calc_value(sym); + strcat(res_value, sym_get_string_value(sym)); + in = src; + } + strcat(res_value, in); + + return res_value; +} + +char *conf_get_default_confname(void) +{ + struct stat buf; + static char fullname[PATH_MAX+1]; + char *env, *name; + + name = conf_expand_value(conf_defname); + env = getenv(SRCTREE); + if (env) { + sprintf(fullname, "%s/%s", env, name); + if (!stat(fullname, &buf)) + return fullname; + } + return name; +} + +int conf_read(const char *name) +{ + FILE *in = NULL; + char line[1024]; + char *p, *p2; + int lineno = 0; + struct symbol *sym; + struct property *prop; + struct expr *e; + int i; + + if (name) { + in = zconf_fopen(name); + } else { + const char **names = conf_confnames; + while ((name = *names++)) { + name = conf_expand_value(name); + in = zconf_fopen(name); + if (in) { + printf("#\n" + "# using defaults found in %s\n" + "#\n", name); + break; + } + } + } + + if (!in) + return 1; + + for_all_symbols(i, sym) { + sym->flags |= SYMBOL_NEW | SYMBOL_CHANGED; + sym->flags &= ~SYMBOL_VALID; + switch (sym->type) { + case S_INT: + case S_HEX: + case S_STRING: + if (sym->user.val) + free(sym->user.val); + default: + sym->user.val = NULL; + sym->user.tri = no; + } + } + + while (fgets(line, sizeof(line), in)) { + lineno++; + sym = NULL; + switch (line[0]) { + case '#': + if (line[1]!=' ') + continue; + p = strchr(line + 2, ' '); + if (!p) + continue; + *p++ = 0; + if (strncmp(p, "is not set", 10)) + continue; + sym = sym_find(line + 2); + if (!sym) { + fprintf(stderr, "%s:%d: trying to assign nonexistent symbol %s\n", name, lineno, line + 2); + break; + } + switch (sym->type) { + case S_BOOLEAN: + case S_TRISTATE: + sym->user.tri = no; + sym->flags &= ~SYMBOL_NEW; + break; + default: + ; + } + break; + + case 'A' ... 'Z': + p = strchr(line, '='); + if (!p) + continue; + *p++ = 0; + p2 = strchr(p, '\n'); + if (p2) + *p2 = 0; + sym = sym_find(line); + if (!sym) { + fprintf(stderr, "%s:%d: trying to assign nonexistent symbol %s\n", name, lineno, line); + break; + } + switch (sym->type) { + case S_TRISTATE: + if (p[0] == 'm') { + sym->user.tri = mod; + sym->flags &= ~SYMBOL_NEW; + break; + } + case S_BOOLEAN: + if (p[0] == 'y') { + sym->user.tri = yes; + sym->flags &= ~SYMBOL_NEW; + break; + } + if (p[0] == 'n') { + sym->user.tri = no; + sym->flags &= ~SYMBOL_NEW; + break; + } + break; + case S_STRING: + if (*p++ != '"') + break; + for (p2 = p; (p2 = strpbrk(p2, "\"\\")); p2++) { + if (*p2 == '"') { + *p2 = 0; + break; + } + memmove(p2, p2 + 1, strlen(p2)); + } + if (!p2) { + fprintf(stderr, "%s:%d: invalid string found\n", name, lineno); + exit(1); + } + case S_INT: + case S_HEX: + if (sym_string_valid(sym, p)) { + sym->user.val = strdup(p); + sym->flags &= ~SYMBOL_NEW; + } else { + fprintf(stderr, "%s:%d: symbol value '%s' invalid for %s\n", name, lineno, p, sym->name); + exit(1); + } + break; + default: + ; + } + break; + case '\n': + break; + default: + continue; + } + if (sym && sym_is_choice_value(sym)) { + struct symbol *cs = prop_get_symbol(sym_get_choice_prop(sym)); + switch (sym->user.tri) { + case no: + break; + case mod: + if (cs->user.tri == yes) + /* warn? */; + break; + case yes: + if (cs->user.tri != no) + /* warn? */; + cs->user.val = sym; + break; + } + cs->user.tri = E_OR(cs->user.tri, sym->user.tri); + cs->flags &= ~SYMBOL_NEW; + } + } + fclose(in); + + if (modules_sym) + sym_calc_value(modules_sym); + for_all_symbols(i, sym) { + sym_calc_value(sym); + if (sym_has_value(sym) && !sym_is_choice_value(sym)) { + if (sym->visible == no) + sym->flags |= SYMBOL_NEW; + switch (sym->type) { + case S_STRING: + case S_INT: + case S_HEX: + if (!sym_string_within_range(sym, sym->user.val)) + sym->flags |= SYMBOL_NEW; + default: + break; + } + } + if (!sym_is_choice(sym)) + continue; + prop = sym_get_choice_prop(sym); + for (e = prop->expr; e; e = e->left.expr) + if (e->right.sym->visible != no) + sym->flags |= e->right.sym->flags & SYMBOL_NEW; + } + + sym_change_count = 1; + + return 0; +} + +struct menu *next_menu(struct menu *menu) +{ + if (menu->list) return menu->list; + do { + if (menu->next) { + menu = menu->next; + break; + } + } while ((menu = menu->parent)); + + return menu; +} + +#define SYMBOL_FORCEWRITE (1<<31) + +int conf_write(const char *name) +{ + FILE *out, *out_h; + struct symbol *sym; + struct menu *menu; + const char *basename; + char dirname[128], tmpname[128], newname[128]; + int type, l; + const char *str; + + dirname[0] = 0; + if (name && name[0]) { + struct stat st; + char *slash; + + if (!stat(name, &st) && S_ISDIR(st.st_mode)) { + strcpy(dirname, name); + strcat(dirname, "/"); + basename = conf_def_filename; + } else if ((slash = strrchr(name, '/'))) { + int size = slash - name + 1; + memcpy(dirname, name, size); + dirname[size] = 0; + if (slash[1]) + basename = slash + 1; + else + basename = conf_def_filename; + } else + basename = name; + } else + basename = conf_def_filename; + + sprintf(newname, "config/%s.tmpconfig.%d", dirname, (int)getpid()); + out = fopen(newname, "w"); + if (!out) + return 1; + out_h = NULL; + if (!name) { + out_h = fopen("config/.tmpconfig.h", "w"); + if (!out_h) + return 1; + } + fprintf(out, "#\n" + "# Automatically generated make config: don't edit\n" + "#\n"); + if (out_h) { + fprintf(out_h, "/*\n" + " * Automatically generated header file: don't edit\n" + " */\n\n"); +#if 0 + "/* Version Number */\n" + "#define BB_VER \"%s\"\n" + "#define BB_BT \"%s\"\n", + getenv("VERSION"), + getenv("BUILDTIME")); + if (getenv("EXTRA_VERSION")) + fprintf(out_h, "#define BB_EXTRA_VERSION \"%s\"\n", + getenv("EXTRA_VERSION")); + fprintf(out_h, "\n"); +#endif + } + + if (!sym_change_count) + sym_clear_all_valid(); + + /* Force write of all non-duplicate symbols. */ + + /* Write out everything by default. */ + for(menu = rootmenu.list; menu; menu = next_menu(menu)) + if (menu->sym) menu->sym->flags |= SYMBOL_FORCEWRITE; + + menu = rootmenu.list; + while (menu) { + sym = menu->sym; + if (!sym) { + if (!menu_is_visible(menu)) + goto next; + str = menu_get_prompt(menu); + fprintf(out, "\n" + "#\n" + "# %s\n" + "#\n", str); + if (out_h) + fprintf(out_h, "\n" + "/*\n" + " * %s\n" + " */\n", str); + } else if (!(sym->flags & SYMBOL_CHOICE)) { + sym_calc_value(sym); + if (!(sym->flags & SYMBOL_FORCEWRITE)) + goto next; + + sym->flags &= ~SYMBOL_FORCEWRITE; + type = sym->type; + if (type == S_TRISTATE) { + sym_calc_value(modules_sym); + if (modules_sym->curr.tri == no) + type = S_BOOLEAN; + } + switch (type) { + case S_BOOLEAN: + case S_TRISTATE: + switch (sym_get_tristate_value(sym)) { + case no: + fprintf(out, "# %s is not set\n", sym->name); + if (out_h) + fprintf(out_h, "#undef %s\n", sym->name); + break; + case mod: +#if 0 + fprintf(out, "%s=m\n", sym->name); + if (out_h) + fprintf(out_h, "#define %s_MODULE 1\n", sym->name); +#endif + break; + case yes: + fprintf(out, "%s=y\n", sym->name); + if (out_h) + fprintf(out_h, "#define %s 1\n", sym->name); + break; + } + break; + case S_STRING: + // fix me + str = sym_get_string_value(sym); + fprintf(out, "%s=\"", sym->name); + if (out_h) + fprintf(out_h, "#define %s \"", sym->name); + do { + l = strcspn(str, "\"\\"); + if (l) { + fwrite(str, l, 1, out); + if (out_h) + fwrite(str, l, 1, out_h); + } + str += l; + while (*str == '\\' || *str == '"') { + fprintf(out, "\\%c", *str); + if (out_h) + fprintf(out_h, "\\%c", *str); + str++; + } + } while (*str); + fputs("\"\n", out); + if (out_h) + fputs("\"\n", out_h); + break; + case S_HEX: + str = sym_get_string_value(sym); + if (str[0] != '0' || (str[1] != 'x' && str[1] != 'X')) { + fprintf(out, "%s=%s\n", sym->name, *str ? str : "0"); + if (out_h) + fprintf(out_h, "#define %s 0x%s\n", sym->name, str); + break; + } + case S_INT: + str = sym_get_string_value(sym); + fprintf(out, "%s=%s\n", sym->name, *str ? str : "0"); + if (out_h) + fprintf(out_h, "#define %s %s\n", sym->name, str); + break; + } + } +next: + menu = next_menu(menu); + } + fclose(out); + if (out_h) { + fclose(out_h); + rename("config/.tmpconfig.h", "config/config.h"); + file_write_dep(NULL); + } + if (!name || basename != conf_def_filename) { + if (!name) + name = conf_def_filename; + sprintf(tmpname, "%s.old", name); + rename(name, tmpname); + } + sprintf(tmpname, "%s%s", dirname, basename); + if (rename(newname, tmpname)) + return 1; + + sym_change_count = 0; + + return 0; +} diff --git a/config/scripts/config/expr.c b/config/scripts/config/expr.c new file mode 100644 index 0000000000..30e4f9d69c --- /dev/null +++ b/config/scripts/config/expr.c @@ -0,0 +1,1099 @@ +/* + * Copyright (C) 2002 Roman Zippel + * Released under the terms of the GNU GPL v2.0. + */ + +#include +#include +#include + +#define LKC_DIRECT_LINK +#include "lkc.h" + +#define DEBUG_EXPR 0 + +struct expr *expr_alloc_symbol(struct symbol *sym) +{ + struct expr *e = malloc(sizeof(*e)); + memset(e, 0, sizeof(*e)); + e->type = E_SYMBOL; + e->left.sym = sym; + return e; +} + +struct expr *expr_alloc_one(enum expr_type type, struct expr *ce) +{ + struct expr *e = malloc(sizeof(*e)); + memset(e, 0, sizeof(*e)); + e->type = type; + e->left.expr = ce; + return e; +} + +struct expr *expr_alloc_two(enum expr_type type, struct expr *e1, struct expr *e2) +{ + struct expr *e = malloc(sizeof(*e)); + memset(e, 0, sizeof(*e)); + e->type = type; + e->left.expr = e1; + e->right.expr = e2; + return e; +} + +struct expr *expr_alloc_comp(enum expr_type type, struct symbol *s1, struct symbol *s2) +{ + struct expr *e = malloc(sizeof(*e)); + memset(e, 0, sizeof(*e)); + e->type = type; + e->left.sym = s1; + e->right.sym = s2; + return e; +} + +struct expr *expr_alloc_and(struct expr *e1, struct expr *e2) +{ + if (!e1) + return e2; + return e2 ? expr_alloc_two(E_AND, e1, e2) : e1; +} + +struct expr *expr_alloc_or(struct expr *e1, struct expr *e2) +{ + if (!e1) + return e2; + return e2 ? expr_alloc_two(E_OR, e1, e2) : e1; +} + +struct expr *expr_copy(struct expr *org) +{ + struct expr *e; + + if (!org) + return NULL; + + e = malloc(sizeof(*org)); + memcpy(e, org, sizeof(*org)); + switch (org->type) { + case E_SYMBOL: + e->left = org->left; + break; + case E_NOT: + e->left.expr = expr_copy(org->left.expr); + break; + case E_EQUAL: + case E_UNEQUAL: + e->left.sym = org->left.sym; + e->right.sym = org->right.sym; + break; + case E_AND: + case E_OR: + case E_CHOICE: + e->left.expr = expr_copy(org->left.expr); + e->right.expr = expr_copy(org->right.expr); + break; + default: + printf("can't copy type %d\n", e->type); + free(e); + e = NULL; + break; + } + + return e; +} + +void expr_free(struct expr *e) +{ + if (!e) + return; + + switch (e->type) { + case E_SYMBOL: + break; + case E_NOT: + expr_free(e->left.expr); + return; + case E_EQUAL: + case E_UNEQUAL: + break; + case E_OR: + case E_AND: + expr_free(e->left.expr); + expr_free(e->right.expr); + break; + default: + printf("how to free type %d?\n", e->type); + break; + } + free(e); +} + +static int trans_count; + +#define e1 (*ep1) +#define e2 (*ep2) + +static void __expr_eliminate_eq(enum expr_type type, struct expr **ep1, struct expr **ep2) +{ + if (e1->type == type) { + __expr_eliminate_eq(type, &e1->left.expr, &e2); + __expr_eliminate_eq(type, &e1->right.expr, &e2); + return; + } + if (e2->type == type) { + __expr_eliminate_eq(type, &e1, &e2->left.expr); + __expr_eliminate_eq(type, &e1, &e2->right.expr); + return; + } + if (e1->type == E_SYMBOL && e2->type == E_SYMBOL && + e1->left.sym == e2->left.sym && (e1->left.sym->flags & (SYMBOL_YES|SYMBOL_NO))) + return; + if (!expr_eq(e1, e2)) + return; + trans_count++; + expr_free(e1); expr_free(e2); + switch (type) { + case E_OR: + e1 = expr_alloc_symbol(&symbol_no); + e2 = expr_alloc_symbol(&symbol_no); + break; + case E_AND: + e1 = expr_alloc_symbol(&symbol_yes); + e2 = expr_alloc_symbol(&symbol_yes); + break; + default: + ; + } +} + +void expr_eliminate_eq(struct expr **ep1, struct expr **ep2) +{ + if (!e1 || !e2) + return; + switch (e1->type) { + case E_OR: + case E_AND: + __expr_eliminate_eq(e1->type, ep1, ep2); + default: + ; + } + if (e1->type != e2->type) switch (e2->type) { + case E_OR: + case E_AND: + __expr_eliminate_eq(e2->type, ep1, ep2); + default: + ; + } + e1 = expr_eliminate_yn(e1); + e2 = expr_eliminate_yn(e2); +} + +#undef e1 +#undef e2 + +int expr_eq(struct expr *e1, struct expr *e2) +{ + int res, old_count; + + if (e1->type != e2->type) + return 0; + switch (e1->type) { + case E_EQUAL: + case E_UNEQUAL: + return e1->left.sym == e2->left.sym && e1->right.sym == e2->right.sym; + case E_SYMBOL: + return e1->left.sym == e2->left.sym; + case E_NOT: + return expr_eq(e1->left.expr, e2->left.expr); + case E_AND: + case E_OR: + e1 = expr_copy(e1); + e2 = expr_copy(e2); + old_count = trans_count; + expr_eliminate_eq(&e1, &e2); + res = (e1->type == E_SYMBOL && e2->type == E_SYMBOL && + e1->left.sym == e2->left.sym); + expr_free(e1); + expr_free(e2); + trans_count = old_count; + return res; + case E_CHOICE: + case E_RANGE: + case E_NONE: + /* panic */; + } + + if (DEBUG_EXPR) { + expr_fprint(e1, stdout); + printf(" = "); + expr_fprint(e2, stdout); + printf(" ?\n"); + } + + return 0; +} + +struct expr *expr_eliminate_yn(struct expr *e) +{ + struct expr *tmp; + + if (e) switch (e->type) { + case E_AND: + e->left.expr = expr_eliminate_yn(e->left.expr); + e->right.expr = expr_eliminate_yn(e->right.expr); + if (e->left.expr->type == E_SYMBOL) { + if (e->left.expr->left.sym == &symbol_no) { + expr_free(e->left.expr); + expr_free(e->right.expr); + e->type = E_SYMBOL; + e->left.sym = &symbol_no; + e->right.expr = NULL; + return e; + } else if (e->left.expr->left.sym == &symbol_yes) { + free(e->left.expr); + tmp = e->right.expr; + *e = *(e->right.expr); + free(tmp); + return e; + } + } + if (e->right.expr->type == E_SYMBOL) { + if (e->right.expr->left.sym == &symbol_no) { + expr_free(e->left.expr); + expr_free(e->right.expr); + e->type = E_SYMBOL; + e->left.sym = &symbol_no; + e->right.expr = NULL; + return e; + } else if (e->right.expr->left.sym == &symbol_yes) { + free(e->right.expr); + tmp = e->left.expr; + *e = *(e->left.expr); + free(tmp); + return e; + } + } + break; + case E_OR: + e->left.expr = expr_eliminate_yn(e->left.expr); + e->right.expr = expr_eliminate_yn(e->right.expr); + if (e->left.expr->type == E_SYMBOL) { + if (e->left.expr->left.sym == &symbol_no) { + free(e->left.expr); + tmp = e->right.expr; + *e = *(e->right.expr); + free(tmp); + return e; + } else if (e->left.expr->left.sym == &symbol_yes) { + expr_free(e->left.expr); + expr_free(e->right.expr); + e->type = E_SYMBOL; + e->left.sym = &symbol_yes; + e->right.expr = NULL; + return e; + } + } + if (e->right.expr->type == E_SYMBOL) { + if (e->right.expr->left.sym == &symbol_no) { + free(e->right.expr); + tmp = e->left.expr; + *e = *(e->left.expr); + free(tmp); + return e; + } else if (e->right.expr->left.sym == &symbol_yes) { + expr_free(e->left.expr); + expr_free(e->right.expr); + e->type = E_SYMBOL; + e->left.sym = &symbol_yes; + e->right.expr = NULL; + return e; + } + } + break; + default: + ; + } + return e; +} + +/* + * bool FOO!=n => FOO + */ +struct expr *expr_trans_bool(struct expr *e) +{ + if (!e) + return NULL; + switch (e->type) { + case E_AND: + case E_OR: + case E_NOT: + e->left.expr = expr_trans_bool(e->left.expr); + e->right.expr = expr_trans_bool(e->right.expr); + break; + case E_UNEQUAL: + // FOO!=n -> FOO + if (e->left.sym->type == S_TRISTATE) { + if (e->right.sym == &symbol_no) { + e->type = E_SYMBOL; + e->right.sym = NULL; + } + } + break; + default: + ; + } + return e; +} + +/* + * e1 || e2 -> ? + */ +struct expr *expr_join_or(struct expr *e1, struct expr *e2) +{ + struct expr *tmp; + struct symbol *sym1, *sym2; + + if (expr_eq(e1, e2)) + return expr_copy(e1); + if (e1->type != E_EQUAL && e1->type != E_UNEQUAL && e1->type != E_SYMBOL && e1->type != E_NOT) + return NULL; + if (e2->type != E_EQUAL && e2->type != E_UNEQUAL && e2->type != E_SYMBOL && e2->type != E_NOT) + return NULL; + if (e1->type == E_NOT) { + tmp = e1->left.expr; + if (tmp->type != E_EQUAL && tmp->type != E_UNEQUAL && tmp->type != E_SYMBOL) + return NULL; + sym1 = tmp->left.sym; + } else + sym1 = e1->left.sym; + if (e2->type == E_NOT) { + if (e2->left.expr->type != E_SYMBOL) + return NULL; + sym2 = e2->left.expr->left.sym; + } else + sym2 = e2->left.sym; + if (sym1 != sym2) + return NULL; + if (sym1->type != S_BOOLEAN && sym1->type != S_TRISTATE) + return NULL; + if (sym1->type == S_TRISTATE) { + if (e1->type == E_EQUAL && e2->type == E_EQUAL && + ((e1->right.sym == &symbol_yes && e2->right.sym == &symbol_mod) || + (e1->right.sym == &symbol_mod && e2->right.sym == &symbol_yes))) { + // (a='y') || (a='m') -> (a!='n') + return expr_alloc_comp(E_UNEQUAL, sym1, &symbol_no); + } + if (e1->type == E_EQUAL && e2->type == E_EQUAL && + ((e1->right.sym == &symbol_yes && e2->right.sym == &symbol_no) || + (e1->right.sym == &symbol_no && e2->right.sym == &symbol_yes))) { + // (a='y') || (a='n') -> (a!='m') + return expr_alloc_comp(E_UNEQUAL, sym1, &symbol_mod); + } + if (e1->type == E_EQUAL && e2->type == E_EQUAL && + ((e1->right.sym == &symbol_mod && e2->right.sym == &symbol_no) || + (e1->right.sym == &symbol_no && e2->right.sym == &symbol_mod))) { + // (a='m') || (a='n') -> (a!='y') + return expr_alloc_comp(E_UNEQUAL, sym1, &symbol_yes); + } + } + if (sym1->type == S_BOOLEAN && sym1 == sym2) { + if ((e1->type == E_NOT && e1->left.expr->type == E_SYMBOL && e2->type == E_SYMBOL) || + (e2->type == E_NOT && e2->left.expr->type == E_SYMBOL && e1->type == E_SYMBOL)) + return expr_alloc_symbol(&symbol_yes); + } + + if (DEBUG_EXPR) { + printf("optimize ("); + expr_fprint(e1, stdout); + printf(") || ("); + expr_fprint(e2, stdout); + printf(")?\n"); + } + return NULL; +} + +struct expr *expr_join_and(struct expr *e1, struct expr *e2) +{ + struct expr *tmp; + struct symbol *sym1, *sym2; + + if (expr_eq(e1, e2)) + return expr_copy(e1); + if (e1->type != E_EQUAL && e1->type != E_UNEQUAL && e1->type != E_SYMBOL && e1->type != E_NOT) + return NULL; + if (e2->type != E_EQUAL && e2->type != E_UNEQUAL && e2->type != E_SYMBOL && e2->type != E_NOT) + return NULL; + if (e1->type == E_NOT) { + tmp = e1->left.expr; + if (tmp->type != E_EQUAL && tmp->type != E_UNEQUAL && tmp->type != E_SYMBOL) + return NULL; + sym1 = tmp->left.sym; + } else + sym1 = e1->left.sym; + if (e2->type == E_NOT) { + if (e2->left.expr->type != E_SYMBOL) + return NULL; + sym2 = e2->left.expr->left.sym; + } else + sym2 = e2->left.sym; + if (sym1 != sym2) + return NULL; + if (sym1->type != S_BOOLEAN && sym1->type != S_TRISTATE) + return NULL; + + if ((e1->type == E_SYMBOL && e2->type == E_EQUAL && e2->right.sym == &symbol_yes) || + (e2->type == E_SYMBOL && e1->type == E_EQUAL && e1->right.sym == &symbol_yes)) + // (a) && (a='y') -> (a='y') + return expr_alloc_comp(E_EQUAL, sym1, &symbol_yes); + + if ((e1->type == E_SYMBOL && e2->type == E_UNEQUAL && e2->right.sym == &symbol_no) || + (e2->type == E_SYMBOL && e1->type == E_UNEQUAL && e1->right.sym == &symbol_no)) + // (a) && (a!='n') -> (a) + return expr_alloc_symbol(sym1); + + if ((e1->type == E_SYMBOL && e2->type == E_UNEQUAL && e2->right.sym == &symbol_mod) || + (e2->type == E_SYMBOL && e1->type == E_UNEQUAL && e1->right.sym == &symbol_mod)) + // (a) && (a!='m') -> (a='y') + return expr_alloc_comp(E_EQUAL, sym1, &symbol_yes); + + if (sym1->type == S_TRISTATE) { + if (e1->type == E_EQUAL && e2->type == E_UNEQUAL) { + // (a='b') && (a!='c') -> 'b'='c' ? 'n' : a='b' + sym2 = e1->right.sym; + if ((e2->right.sym->flags & SYMBOL_CONST) && (sym2->flags & SYMBOL_CONST)) + return sym2 != e2->right.sym ? expr_alloc_comp(E_EQUAL, sym1, sym2) + : expr_alloc_symbol(&symbol_no); + } + if (e1->type == E_UNEQUAL && e2->type == E_EQUAL) { + // (a='b') && (a!='c') -> 'b'='c' ? 'n' : a='b' + sym2 = e2->right.sym; + if ((e1->right.sym->flags & SYMBOL_CONST) && (sym2->flags & SYMBOL_CONST)) + return sym2 != e1->right.sym ? expr_alloc_comp(E_EQUAL, sym1, sym2) + : expr_alloc_symbol(&symbol_no); + } + if (e1->type == E_UNEQUAL && e2->type == E_UNEQUAL && + ((e1->right.sym == &symbol_yes && e2->right.sym == &symbol_no) || + (e1->right.sym == &symbol_no && e2->right.sym == &symbol_yes))) + // (a!='y') && (a!='n') -> (a='m') + return expr_alloc_comp(E_EQUAL, sym1, &symbol_mod); + + if (e1->type == E_UNEQUAL && e2->type == E_UNEQUAL && + ((e1->right.sym == &symbol_yes && e2->right.sym == &symbol_mod) || + (e1->right.sym == &symbol_mod && e2->right.sym == &symbol_yes))) + // (a!='y') && (a!='m') -> (a='n') + return expr_alloc_comp(E_EQUAL, sym1, &symbol_no); + + if (e1->type == E_UNEQUAL && e2->type == E_UNEQUAL && + ((e1->right.sym == &symbol_mod && e2->right.sym == &symbol_no) || + (e1->right.sym == &symbol_no && e2->right.sym == &symbol_mod))) + // (a!='m') && (a!='n') -> (a='m') + return expr_alloc_comp(E_EQUAL, sym1, &symbol_yes); + + if ((e1->type == E_SYMBOL && e2->type == E_EQUAL && e2->right.sym == &symbol_mod) || + (e2->type == E_SYMBOL && e1->type == E_EQUAL && e1->right.sym == &symbol_mod) || + (e1->type == E_SYMBOL && e2->type == E_UNEQUAL && e2->right.sym == &symbol_yes) || + (e2->type == E_SYMBOL && e1->type == E_UNEQUAL && e1->right.sym == &symbol_yes)) + return NULL; + } + + if (DEBUG_EXPR) { + printf("optimize ("); + expr_fprint(e1, stdout); + printf(") && ("); + expr_fprint(e2, stdout); + printf(")?\n"); + } + return NULL; +} + +static void expr_eliminate_dups1(enum expr_type type, struct expr **ep1, struct expr **ep2) +{ +#define e1 (*ep1) +#define e2 (*ep2) + struct expr *tmp; + + if (e1->type == type) { + expr_eliminate_dups1(type, &e1->left.expr, &e2); + expr_eliminate_dups1(type, &e1->right.expr, &e2); + return; + } + if (e2->type == type) { + expr_eliminate_dups1(type, &e1, &e2->left.expr); + expr_eliminate_dups1(type, &e1, &e2->right.expr); + return; + } + if (e1 == e2) + return; + + switch (e1->type) { + case E_OR: case E_AND: + expr_eliminate_dups1(e1->type, &e1, &e1); + default: + ; + } + + switch (type) { + case E_OR: + tmp = expr_join_or(e1, e2); + if (tmp) { + expr_free(e1); expr_free(e2); + e1 = expr_alloc_symbol(&symbol_no); + e2 = tmp; + trans_count++; + } + break; + case E_AND: + tmp = expr_join_and(e1, e2); + if (tmp) { + expr_free(e1); expr_free(e2); + e1 = expr_alloc_symbol(&symbol_yes); + e2 = tmp; + trans_count++; + } + break; + default: + ; + } +#undef e1 +#undef e2 +} + +static void expr_eliminate_dups2(enum expr_type type, struct expr **ep1, struct expr **ep2) +{ +#define e1 (*ep1) +#define e2 (*ep2) + struct expr *tmp, *tmp1, *tmp2; + + if (e1->type == type) { + expr_eliminate_dups2(type, &e1->left.expr, &e2); + expr_eliminate_dups2(type, &e1->right.expr, &e2); + return; + } + if (e2->type == type) { + expr_eliminate_dups2(type, &e1, &e2->left.expr); + expr_eliminate_dups2(type, &e1, &e2->right.expr); + } + if (e1 == e2) + return; + + switch (e1->type) { + case E_OR: + expr_eliminate_dups2(e1->type, &e1, &e1); + // (FOO || BAR) && (!FOO && !BAR) -> n + tmp1 = expr_transform(expr_alloc_one(E_NOT, expr_copy(e1))); + tmp2 = expr_copy(e2); + tmp = expr_extract_eq_and(&tmp1, &tmp2); + if (expr_is_yes(tmp1)) { + expr_free(e1); + e1 = expr_alloc_symbol(&symbol_no); + trans_count++; + } + expr_free(tmp2); + expr_free(tmp1); + expr_free(tmp); + break; + case E_AND: + expr_eliminate_dups2(e1->type, &e1, &e1); + // (FOO && BAR) || (!FOO || !BAR) -> y + tmp1 = expr_transform(expr_alloc_one(E_NOT, expr_copy(e1))); + tmp2 = expr_copy(e2); + tmp = expr_extract_eq_or(&tmp1, &tmp2); + if (expr_is_no(tmp1)) { + expr_free(e1); + e1 = expr_alloc_symbol(&symbol_yes); + trans_count++; + } + expr_free(tmp2); + expr_free(tmp1); + expr_free(tmp); + break; + default: + ; + } +#undef e1 +#undef e2 +} + +struct expr *expr_eliminate_dups(struct expr *e) +{ + int oldcount; + if (!e) + return e; + + oldcount = trans_count; + while (1) { + trans_count = 0; + switch (e->type) { + case E_OR: case E_AND: + expr_eliminate_dups1(e->type, &e, &e); + expr_eliminate_dups2(e->type, &e, &e); + default: + ; + } + if (!trans_count) + break; + e = expr_eliminate_yn(e); + } + trans_count = oldcount; + return e; +} + +struct expr *expr_transform(struct expr *e) +{ + struct expr *tmp; + + if (!e) + return NULL; + switch (e->type) { + case E_EQUAL: + case E_UNEQUAL: + case E_SYMBOL: + case E_CHOICE: + break; + default: + e->left.expr = expr_transform(e->left.expr); + e->right.expr = expr_transform(e->right.expr); + } + + switch (e->type) { + case E_EQUAL: + if (e->left.sym->type != S_BOOLEAN) + break; + if (e->right.sym == &symbol_no) { + e->type = E_NOT; + e->left.expr = expr_alloc_symbol(e->left.sym); + e->right.sym = NULL; + break; + } + if (e->right.sym == &symbol_mod) { + printf("boolean symbol %s tested for 'm'? test forced to 'n'\n", e->left.sym->name); + e->type = E_SYMBOL; + e->left.sym = &symbol_no; + e->right.sym = NULL; + break; + } + if (e->right.sym == &symbol_yes) { + e->type = E_SYMBOL; + e->right.sym = NULL; + break; + } + break; + case E_UNEQUAL: + if (e->left.sym->type != S_BOOLEAN) + break; + if (e->right.sym == &symbol_no) { + e->type = E_SYMBOL; + e->right.sym = NULL; + break; + } + if (e->right.sym == &symbol_mod) { + printf("boolean symbol %s tested for 'm'? test forced to 'y'\n", e->left.sym->name); + e->type = E_SYMBOL; + e->left.sym = &symbol_yes; + e->right.sym = NULL; + break; + } + if (e->right.sym == &symbol_yes) { + e->type = E_NOT; + e->left.expr = expr_alloc_symbol(e->left.sym); + e->right.sym = NULL; + break; + } + break; + case E_NOT: + switch (e->left.expr->type) { + case E_NOT: + // !!a -> a + tmp = e->left.expr->left.expr; + free(e->left.expr); + free(e); + e = tmp; + e = expr_transform(e); + break; + case E_EQUAL: + case E_UNEQUAL: + // !a='x' -> a!='x' + tmp = e->left.expr; + free(e); + e = tmp; + e->type = e->type == E_EQUAL ? E_UNEQUAL : E_EQUAL; + break; + case E_OR: + // !(a || b) -> !a && !b + tmp = e->left.expr; + e->type = E_AND; + e->right.expr = expr_alloc_one(E_NOT, tmp->right.expr); + tmp->type = E_NOT; + tmp->right.expr = NULL; + e = expr_transform(e); + break; + case E_AND: + // !(a && b) -> !a || !b + tmp = e->left.expr; + e->type = E_OR; + e->right.expr = expr_alloc_one(E_NOT, tmp->right.expr); + tmp->type = E_NOT; + tmp->right.expr = NULL; + e = expr_transform(e); + break; + case E_SYMBOL: + if (e->left.expr->left.sym == &symbol_yes) { + // !'y' -> 'n' + tmp = e->left.expr; + free(e); + e = tmp; + e->type = E_SYMBOL; + e->left.sym = &symbol_no; + break; + } + if (e->left.expr->left.sym == &symbol_mod) { + // !'m' -> 'm' + tmp = e->left.expr; + free(e); + e = tmp; + e->type = E_SYMBOL; + e->left.sym = &symbol_mod; + break; + } + if (e->left.expr->left.sym == &symbol_no) { + // !'n' -> 'y' + tmp = e->left.expr; + free(e); + e = tmp; + e->type = E_SYMBOL; + e->left.sym = &symbol_yes; + break; + } + break; + default: + ; + } + break; + default: + ; + } + return e; +} + +int expr_contains_symbol(struct expr *dep, struct symbol *sym) +{ + if (!dep) + return 0; + + switch (dep->type) { + case E_AND: + case E_OR: + return expr_contains_symbol(dep->left.expr, sym) || + expr_contains_symbol(dep->right.expr, sym); + case E_SYMBOL: + return dep->left.sym == sym; + case E_EQUAL: + case E_UNEQUAL: + return dep->left.sym == sym || + dep->right.sym == sym; + case E_NOT: + return expr_contains_symbol(dep->left.expr, sym); + default: + ; + } + return 0; +} + +bool expr_depends_symbol(struct expr *dep, struct symbol *sym) +{ + if (!dep) + return false; + + switch (dep->type) { + case E_AND: + return expr_depends_symbol(dep->left.expr, sym) || + expr_depends_symbol(dep->right.expr, sym); + case E_SYMBOL: + return dep->left.sym == sym; + case E_EQUAL: + if (dep->left.sym == sym) { + if (dep->right.sym == &symbol_yes || dep->right.sym == &symbol_mod) + return true; + } + break; + case E_UNEQUAL: + if (dep->left.sym == sym) { + if (dep->right.sym == &symbol_no) + return true; + } + break; + default: + ; + } + return false; +} + +struct expr *expr_extract_eq_and(struct expr **ep1, struct expr **ep2) +{ + struct expr *tmp = NULL; + expr_extract_eq(E_AND, &tmp, ep1, ep2); + if (tmp) { + *ep1 = expr_eliminate_yn(*ep1); + *ep2 = expr_eliminate_yn(*ep2); + } + return tmp; +} + +struct expr *expr_extract_eq_or(struct expr **ep1, struct expr **ep2) +{ + struct expr *tmp = NULL; + expr_extract_eq(E_OR, &tmp, ep1, ep2); + if (tmp) { + *ep1 = expr_eliminate_yn(*ep1); + *ep2 = expr_eliminate_yn(*ep2); + } + return tmp; +} + +void expr_extract_eq(enum expr_type type, struct expr **ep, struct expr **ep1, struct expr **ep2) +{ +#define e1 (*ep1) +#define e2 (*ep2) + if (e1->type == type) { + expr_extract_eq(type, ep, &e1->left.expr, &e2); + expr_extract_eq(type, ep, &e1->right.expr, &e2); + return; + } + if (e2->type == type) { + expr_extract_eq(type, ep, ep1, &e2->left.expr); + expr_extract_eq(type, ep, ep1, &e2->right.expr); + return; + } + if (expr_eq(e1, e2)) { + *ep = *ep ? expr_alloc_two(type, *ep, e1) : e1; + expr_free(e2); + if (type == E_AND) { + e1 = expr_alloc_symbol(&symbol_yes); + e2 = expr_alloc_symbol(&symbol_yes); + } else if (type == E_OR) { + e1 = expr_alloc_symbol(&symbol_no); + e2 = expr_alloc_symbol(&symbol_no); + } + } +#undef e1 +#undef e2 +} + +struct expr *expr_trans_compare(struct expr *e, enum expr_type type, struct symbol *sym) +{ + struct expr *e1, *e2; + + if (!e) { + e = expr_alloc_symbol(sym); + if (type == E_UNEQUAL) + e = expr_alloc_one(E_NOT, e); + return e; + } + switch (e->type) { + case E_AND: + e1 = expr_trans_compare(e->left.expr, E_EQUAL, sym); + e2 = expr_trans_compare(e->right.expr, E_EQUAL, sym); + if (sym == &symbol_yes) + e = expr_alloc_two(E_AND, e1, e2); + if (sym == &symbol_no) + e = expr_alloc_two(E_OR, e1, e2); + if (type == E_UNEQUAL) + e = expr_alloc_one(E_NOT, e); + return e; + case E_OR: + e1 = expr_trans_compare(e->left.expr, E_EQUAL, sym); + e2 = expr_trans_compare(e->right.expr, E_EQUAL, sym); + if (sym == &symbol_yes) + e = expr_alloc_two(E_OR, e1, e2); + if (sym == &symbol_no) + e = expr_alloc_two(E_AND, e1, e2); + if (type == E_UNEQUAL) + e = expr_alloc_one(E_NOT, e); + return e; + case E_NOT: + return expr_trans_compare(e->left.expr, type == E_EQUAL ? E_UNEQUAL : E_EQUAL, sym); + case E_UNEQUAL: + case E_EQUAL: + if (type == E_EQUAL) { + if (sym == &symbol_yes) + return expr_copy(e); + if (sym == &symbol_mod) + return expr_alloc_symbol(&symbol_no); + if (sym == &symbol_no) + return expr_alloc_one(E_NOT, expr_copy(e)); + } else { + if (sym == &symbol_yes) + return expr_alloc_one(E_NOT, expr_copy(e)); + if (sym == &symbol_mod) + return expr_alloc_symbol(&symbol_yes); + if (sym == &symbol_no) + return expr_copy(e); + } + break; + case E_SYMBOL: + return expr_alloc_comp(type, e->left.sym, sym); + case E_CHOICE: + case E_RANGE: + case E_NONE: + /* panic */; + } + return NULL; +} + +tristate expr_calc_value(struct expr *e) +{ + tristate val1, val2; + const char *str1, *str2; + + if (!e) + return yes; + + switch (e->type) { + case E_SYMBOL: + sym_calc_value(e->left.sym); + return e->left.sym->curr.tri; + case E_AND: + val1 = expr_calc_value(e->left.expr); + val2 = expr_calc_value(e->right.expr); + return E_AND(val1, val2); + case E_OR: + val1 = expr_calc_value(e->left.expr); + val2 = expr_calc_value(e->right.expr); + return E_OR(val1, val2); + case E_NOT: + val1 = expr_calc_value(e->left.expr); + return E_NOT(val1); + case E_EQUAL: + sym_calc_value(e->left.sym); + sym_calc_value(e->right.sym); + str1 = sym_get_string_value(e->left.sym); + str2 = sym_get_string_value(e->right.sym); + return !strcmp(str1, str2) ? yes : no; + case E_UNEQUAL: + sym_calc_value(e->left.sym); + sym_calc_value(e->right.sym); + str1 = sym_get_string_value(e->left.sym); + str2 = sym_get_string_value(e->right.sym); + return !strcmp(str1, str2) ? no : yes; + default: + printf("expr_calc_value: %d?\n", e->type); + return no; + } +} + +int expr_compare_type(enum expr_type t1, enum expr_type t2) +{ +#if 0 + return 1; +#else + if (t1 == t2) + return 0; + switch (t1) { + case E_EQUAL: + case E_UNEQUAL: + if (t2 == E_NOT) + return 1; + case E_NOT: + if (t2 == E_AND) + return 1; + case E_AND: + if (t2 == E_OR) + return 1; + case E_OR: + if (t2 == E_CHOICE) + return 1; + case E_CHOICE: + if (t2 == 0) + return 1; + default: + return -1; + } + printf("[%dgt%d?]", t1, t2); + return 0; +#endif +} + +void expr_print(struct expr *e, void (*fn)(void *, const char *), void *data, int prevtoken) +{ + if (!e) { + fn(data, "y"); + return; + } + + if (expr_compare_type(prevtoken, e->type) > 0) + fn(data, "("); + switch (e->type) { + case E_SYMBOL: + if (e->left.sym->name) + fn(data, e->left.sym->name); + else + fn(data, ""); + break; + case E_NOT: + fn(data, "!"); + expr_print(e->left.expr, fn, data, E_NOT); + break; + case E_EQUAL: + fn(data, e->left.sym->name); + fn(data, "="); + fn(data, e->right.sym->name); + break; + case E_UNEQUAL: + fn(data, e->left.sym->name); + fn(data, "!="); + fn(data, e->right.sym->name); + break; + case E_OR: + expr_print(e->left.expr, fn, data, E_OR); + fn(data, " || "); + expr_print(e->right.expr, fn, data, E_OR); + break; + case E_AND: + expr_print(e->left.expr, fn, data, E_AND); + fn(data, " && "); + expr_print(e->right.expr, fn, data, E_AND); + break; + case E_CHOICE: + fn(data, e->right.sym->name); + if (e->left.expr) { + fn(data, " ^ "); + expr_print(e->left.expr, fn, data, E_CHOICE); + } + break; + case E_RANGE: + fn(data, "["); + fn(data, e->left.sym->name); + fn(data, " "); + fn(data, e->right.sym->name); + fn(data, "]"); + break; + default: + { + char buf[32]; + sprintf(buf, "", e->type); + fn(data, buf); + break; + } + } + if (expr_compare_type(prevtoken, e->type) > 0) + fn(data, ")"); +} + +static void expr_print_file_helper(void *data, const char *str) +{ + fwrite(str, strlen(str), 1, data); +} + +void expr_fprint(struct expr *e, FILE *out) +{ + expr_print(e, expr_print_file_helper, out, E_NONE); +} + +static void expr_print_gstr_helper(void *data, const char *str) +{ + str_append((struct gstr*)data, str); +} + +void expr_gstr_print(struct expr *e, struct gstr *gs) +{ + expr_print(e, expr_print_gstr_helper, gs, E_NONE); +} diff --git a/config/scripts/config/expr.h b/config/scripts/config/expr.h new file mode 100644 index 0000000000..7d39ff43e6 --- /dev/null +++ b/config/scripts/config/expr.h @@ -0,0 +1,195 @@ +/* + * Copyright (C) 2002 Roman Zippel + * Released under the terms of the GNU GPL v2.0. + */ + +#ifndef EXPR_H +#define EXPR_H + +#ifdef __cplusplus +extern "C" { +#endif + +#include +#ifndef __cplusplus +#include +#endif + +struct file { + struct file *next; + struct file *parent; + char *name; + int lineno; + int flags; +}; + +#define FILE_BUSY 0x0001 +#define FILE_SCANNED 0x0002 +#define FILE_PRINTED 0x0004 + +typedef enum tristate { + no, mod, yes +} tristate; + +enum expr_type { + E_NONE, E_OR, E_AND, E_NOT, E_EQUAL, E_UNEQUAL, E_CHOICE, E_SYMBOL, E_RANGE +}; + +union expr_data { + struct expr *expr; + struct symbol *sym; +}; + +struct expr { + enum expr_type type; + union expr_data left, right; +}; + +#define E_OR(dep1, dep2) (((dep1)>(dep2))?(dep1):(dep2)) +#define E_AND(dep1, dep2) (((dep1)<(dep2))?(dep1):(dep2)) +#define E_NOT(dep) (2-(dep)) + +struct expr_value { + struct expr *expr; + tristate tri; +}; + +struct symbol_value { + void *val; + tristate tri; +}; + +enum symbol_type { + S_UNKNOWN, S_BOOLEAN, S_TRISTATE, S_INT, S_HEX, S_STRING, S_OTHER +}; + +struct symbol { + struct symbol *next; + char *name; + char *help; + enum symbol_type type; + struct symbol_value curr, user; + tristate visible; + int flags; + struct property *prop; + struct expr *dep, *dep2; + struct expr_value rev_dep; +}; + +#define for_all_symbols(i, sym) for (i = 0; i < 257; i++) for (sym = symbol_hash[i]; sym; sym = sym->next) if (sym->type != S_OTHER) + +#define SYMBOL_YES 0x0001 +#define SYMBOL_MOD 0x0002 +#define SYMBOL_NO 0x0004 +#define SYMBOL_CONST 0x0007 +#define SYMBOL_CHECK 0x0008 +#define SYMBOL_CHOICE 0x0010 +#define SYMBOL_CHOICEVAL 0x0020 +#define SYMBOL_PRINTED 0x0040 +#define SYMBOL_VALID 0x0080 +#define SYMBOL_OPTIONAL 0x0100 +#define SYMBOL_WRITE 0x0200 +#define SYMBOL_CHANGED 0x0400 +#define SYMBOL_NEW 0x0800 +#define SYMBOL_AUTO 0x1000 +#define SYMBOL_CHECKED 0x2000 +#define SYMBOL_CHECK_DONE 0x4000 +#define SYMBOL_WARNED 0x8000 + +#define SYMBOL_MAXLENGTH 256 +#define SYMBOL_HASHSIZE 257 +#define SYMBOL_HASHMASK 0xff + +enum prop_type { + P_UNKNOWN, P_PROMPT, P_COMMENT, P_MENU, P_DEFAULT, P_CHOICE, P_SELECT, P_RANGE +}; + +struct property { + struct property *next; + struct symbol *sym; + enum prop_type type; + const char *text; + struct expr_value visible; + struct expr *expr; + struct menu *menu; + struct file *file; + int lineno; +}; + +#define for_all_properties(sym, st, tok) \ + for (st = sym->prop; st; st = st->next) \ + if (st->type == (tok)) +#define for_all_defaults(sym, st) for_all_properties(sym, st, P_DEFAULT) +#define for_all_choices(sym, st) for_all_properties(sym, st, P_CHOICE) +#define for_all_prompts(sym, st) \ + for (st = sym->prop; st; st = st->next) \ + if (st->text) + +struct menu { + struct menu *next; + struct menu *parent; + struct menu *list; + struct symbol *sym; + struct property *prompt; + struct expr *dep; + unsigned int flags; + //char *help; + struct file *file; + int lineno; + void *data; +}; + +#define MENU_CHANGED 0x0001 +#define MENU_ROOT 0x0002 + +#ifndef SWIG + +extern struct file *file_list; +extern struct file *current_file; +struct file *lookup_file(const char *name); + +extern struct symbol symbol_yes, symbol_no, symbol_mod; +extern struct symbol *modules_sym; +extern int cdebug; +struct expr *expr_alloc_symbol(struct symbol *sym); +struct expr *expr_alloc_one(enum expr_type type, struct expr *ce); +struct expr *expr_alloc_two(enum expr_type type, struct expr *e1, struct expr *e2); +struct expr *expr_alloc_comp(enum expr_type type, struct symbol *s1, struct symbol *s2); +struct expr *expr_alloc_and(struct expr *e1, struct expr *e2); +struct expr *expr_alloc_or(struct expr *e1, struct expr *e2); +struct expr *expr_copy(struct expr *org); +void expr_free(struct expr *e); +int expr_eq(struct expr *e1, struct expr *e2); +void expr_eliminate_eq(struct expr **ep1, struct expr **ep2); +tristate expr_calc_value(struct expr *e); +struct expr *expr_eliminate_yn(struct expr *e); +struct expr *expr_trans_bool(struct expr *e); +struct expr *expr_eliminate_dups(struct expr *e); +struct expr *expr_transform(struct expr *e); +int expr_contains_symbol(struct expr *dep, struct symbol *sym); +bool expr_depends_symbol(struct expr *dep, struct symbol *sym); +struct expr *expr_extract_eq_and(struct expr **ep1, struct expr **ep2); +struct expr *expr_extract_eq_or(struct expr **ep1, struct expr **ep2); +void expr_extract_eq(enum expr_type type, struct expr **ep, struct expr **ep1, struct expr **ep2); +struct expr *expr_trans_compare(struct expr *e, enum expr_type type, struct symbol *sym); + +void expr_fprint(struct expr *e, FILE *out); +struct gstr; /* forward */ +void expr_gstr_print(struct expr *e, struct gstr *gs); + +static inline int expr_is_yes(struct expr *e) +{ + return !e || (e->type == E_SYMBOL && e->left.sym == &symbol_yes); +} + +static inline int expr_is_no(struct expr *e) +{ + return e && (e->type == E_SYMBOL && e->left.sym == &symbol_no); +} +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* EXPR_H */ diff --git a/config/scripts/config/lex.zconf.c b/config/scripts/config/lex.zconf.c new file mode 100644 index 0000000000..b877bb6b3c --- /dev/null +++ b/config/scripts/config/lex.zconf.c @@ -0,0 +1,3688 @@ + +#line 3 "lex.zconf.c" + +#define YY_INT_ALIGNED short int + +/* A lexical scanner generated by flex */ + +#define FLEX_SCANNER +#define YY_FLEX_MAJOR_VERSION 2 +#define YY_FLEX_MINOR_VERSION 5 +#define YY_FLEX_SUBMINOR_VERSION 31 +#if YY_FLEX_SUBMINOR_VERSION > 0 +#define FLEX_BETA +#endif + +/* First, we deal with platform-specific or compiler-specific issues. */ + +/* begin standard C headers. */ +#include +#include +#include +#include + +/* end standard C headers. */ + +/* flex integer type definitions */ + +#ifndef FLEXINT_H +#define FLEXINT_H + +/* C99 systems have . Non-C99 systems may or may not. */ + +#if defined __STDC_VERSION__ && __STDC_VERSION__ >= 199901L +#include +typedef int8_t flex_int8_t; +typedef uint8_t flex_uint8_t; +typedef int16_t flex_int16_t; +typedef uint16_t flex_uint16_t; +typedef int32_t flex_int32_t; +typedef uint32_t flex_uint32_t; +#else +typedef signed char flex_int8_t; +typedef short int flex_int16_t; +typedef int flex_int32_t; +typedef unsigned char flex_uint8_t; +typedef unsigned short int flex_uint16_t; +typedef unsigned int flex_uint32_t; +#endif /* ! C99 */ + +/* Limits of integral types. */ +#ifndef INT8_MIN +#define INT8_MIN (-128) +#endif +#ifndef INT16_MIN +#define INT16_MIN (-32767-1) +#endif +#ifndef INT32_MIN +#define INT32_MIN (-2147483647-1) +#endif +#ifndef INT8_MAX +#define INT8_MAX (127) +#endif +#ifndef INT16_MAX +#define INT16_MAX (32767) +#endif +#ifndef INT32_MAX +#define INT32_MAX (2147483647) +#endif +#ifndef UINT8_MAX +#define UINT8_MAX (255U) +#endif +#ifndef UINT16_MAX +#define UINT16_MAX (65535U) +#endif +#ifndef UINT32_MAX +#define UINT32_MAX (4294967295U) +#endif + +#endif /* ! FLEXINT_H */ + +#ifdef __cplusplus + +/* The "const" storage-class-modifier is valid. */ +#define YY_USE_CONST + +#else /* ! __cplusplus */ + +#if __STDC__ + +#define YY_USE_CONST + +#endif /* __STDC__ */ +#endif /* ! __cplusplus */ + +#ifdef YY_USE_CONST +#define yyconst const +#else +#define yyconst +#endif + +/* Returned upon end-of-file. */ +#define YY_NULL 0 + +/* Promotes a possibly negative, possibly signed char to an unsigned + * integer for use as an array index. If the signed char is negative, + * we want to instead treat it as an 8-bit unsigned char, hence the + * double cast. + */ +#define YY_SC_TO_UI(c) ((unsigned int) (unsigned char) c) + +/* Enter a start condition. This macro really ought to take a parameter, + * but we do it the disgusting crufty way forced on us by the ()-less + * definition of BEGIN. + */ +#define BEGIN (yy_start) = 1 + 2 * + +/* Translate the current start state into a value that can be later handed + * to BEGIN to return to the state. The YYSTATE alias is for lex + * compatibility. + */ +#define YY_START (((yy_start) - 1) / 2) +#define YYSTATE YY_START + +/* Action number for EOF rule of a given start state. */ +#define YY_STATE_EOF(state) (YY_END_OF_BUFFER + state + 1) + +/* Special action meaning "start processing a new file". */ +#define YY_NEW_FILE zconfrestart(zconfin ) + +#define YY_END_OF_BUFFER_CHAR 0 + +/* Size of default input buffer. */ +#ifndef YY_BUF_SIZE +#define YY_BUF_SIZE 16384 +#endif + +#ifndef YY_TYPEDEF_YY_BUFFER_STATE +#define YY_TYPEDEF_YY_BUFFER_STATE +typedef struct yy_buffer_state *YY_BUFFER_STATE; +#endif + +extern int zconfleng; + +extern FILE *zconfin, *zconfout; + +#define EOB_ACT_CONTINUE_SCAN 0 +#define EOB_ACT_END_OF_FILE 1 +#define EOB_ACT_LAST_MATCH 2 + + #define YY_LESS_LINENO(n) + +/* Return all but the first "n" matched characters back to the input stream. */ +#define yyless(n) \ + do \ + { \ + /* Undo effects of setting up zconftext. */ \ + int yyless_macro_arg = (n); \ + YY_LESS_LINENO(yyless_macro_arg);\ + *yy_cp = (yy_hold_char); \ + YY_RESTORE_YY_MORE_OFFSET \ + (yy_c_buf_p) = yy_cp = yy_bp + yyless_macro_arg - YY_MORE_ADJ; \ + YY_DO_BEFORE_ACTION; /* set up zconftext again */ \ + } \ + while ( 0 ) + +#define unput(c) yyunput( c, (yytext_ptr) ) + +/* The following is because we cannot portably get our hands on size_t + * (without autoconf's help, which isn't available because we want + * flex-generated scanners to compile on their own). + */ + +#ifndef YY_TYPEDEF_YY_SIZE_T +#define YY_TYPEDEF_YY_SIZE_T +typedef unsigned int yy_size_t; +#endif + +#ifndef YY_STRUCT_YY_BUFFER_STATE +#define YY_STRUCT_YY_BUFFER_STATE +struct yy_buffer_state + { + FILE *yy_input_file; + + char *yy_ch_buf; /* input buffer */ + char *yy_buf_pos; /* current position in input buffer */ + + /* Size of input buffer in bytes, not including room for EOB + * characters. + */ + yy_size_t yy_buf_size; + + /* Number of characters read into yy_ch_buf, not including EOB + * characters. + */ + int yy_n_chars; + + /* Whether we "own" the buffer - i.e., we know we created it, + * and can realloc() it to grow it, and should free() it to + * delete it. + */ + int yy_is_our_buffer; + + /* Whether this is an "interactive" input source; if so, and + * if we're using stdio for input, then we want to use getc() + * instead of fread(), to make sure we stop fetching input after + * each newline. + */ + int yy_is_interactive; + + /* Whether we're considered to be at the beginning of a line. + * If so, '^' rules will be active on the next match, otherwise + * not. + */ + int yy_at_bol; + + int yy_bs_lineno; /**< The line count. */ + int yy_bs_column; /**< The column count. */ + + /* Whether to try to fill the input buffer when we reach the + * end of it. + */ + int yy_fill_buffer; + + int yy_buffer_status; + +#define YY_BUFFER_NEW 0 +#define YY_BUFFER_NORMAL 1 + /* When an EOF's been seen but there's still some text to process + * then we mark the buffer as YY_EOF_PENDING, to indicate that we + * shouldn't try reading from the input source any more. We might + * still have a bunch of tokens to match, though, because of + * possible backing-up. + * + * When we actually see the EOF, we change the status to "new" + * (via zconfrestart()), so that the user can continue scanning by + * just pointing zconfin at a new input file. + */ +#define YY_BUFFER_EOF_PENDING 2 + + }; +#endif /* !YY_STRUCT_YY_BUFFER_STATE */ + +/* Stack of input buffers. */ +static size_t yy_buffer_stack_top = 0; /**< index of top of stack. */ +static size_t yy_buffer_stack_max = 0; /**< capacity of stack. */ +static YY_BUFFER_STATE * yy_buffer_stack = 0; /**< Stack as an array. */ + +/* We provide macros for accessing buffer states in case in the + * future we want to put the buffer states in a more general + * "scanner state". + * + * Returns the top of the stack, or NULL. + */ +#define YY_CURRENT_BUFFER ( (yy_buffer_stack) \ + ? (yy_buffer_stack)[(yy_buffer_stack_top)] \ + : NULL) + +/* Same as previous macro, but useful when we know that the buffer stack is not + * NULL or when we need an lvalue. For internal use only. + */ +#define YY_CURRENT_BUFFER_LVALUE (yy_buffer_stack)[(yy_buffer_stack_top)] + +/* yy_hold_char holds the character lost when zconftext is formed. */ +static char yy_hold_char; +static int yy_n_chars; /* number of characters read into yy_ch_buf */ +int zconfleng; + +/* Points to current character in buffer. */ +static char *yy_c_buf_p = (char *) 0; +static int yy_init = 1; /* whether we need to initialize */ +static int yy_start = 0; /* start state number */ + +/* Flag which is used to allow zconfwrap()'s to do buffer switches + * instead of setting up a fresh zconfin. A bit of a hack ... + */ +static int yy_did_buffer_switch_on_eof; + +void zconfrestart (FILE *input_file ); +void zconf_switch_to_buffer (YY_BUFFER_STATE new_buffer ); +YY_BUFFER_STATE zconf_create_buffer (FILE *file,int size ); +void zconf_delete_buffer (YY_BUFFER_STATE b ); +void zconf_flush_buffer (YY_BUFFER_STATE b ); +void zconfpush_buffer_state (YY_BUFFER_STATE new_buffer ); +void zconfpop_buffer_state (void ); + +static void zconfensure_buffer_stack (void ); +static void zconf_load_buffer_state (void ); +static void zconf_init_buffer (YY_BUFFER_STATE b,FILE *file ); + +#define YY_FLUSH_BUFFER zconf_flush_buffer(YY_CURRENT_BUFFER ) + +YY_BUFFER_STATE zconf_scan_buffer (char *base,yy_size_t size ); +YY_BUFFER_STATE zconf_scan_string (yyconst char *yy_str ); +YY_BUFFER_STATE zconf_scan_bytes (yyconst char *bytes,int len ); + +void *zconfalloc (yy_size_t ); +void *zconfrealloc (void *,yy_size_t ); +void zconffree (void * ); + +#define yy_new_buffer zconf_create_buffer + +#define yy_set_interactive(is_interactive) \ + { \ + if ( ! YY_CURRENT_BUFFER ){ \ + zconfensure_buffer_stack (); \ + YY_CURRENT_BUFFER_LVALUE = \ + zconf_create_buffer(zconfin,YY_BUF_SIZE ); \ + } \ + YY_CURRENT_BUFFER_LVALUE->yy_is_interactive = is_interactive; \ + } + +#define yy_set_bol(at_bol) \ + { \ + if ( ! YY_CURRENT_BUFFER ){\ + zconfensure_buffer_stack (); \ + YY_CURRENT_BUFFER_LVALUE = \ + zconf_create_buffer(zconfin,YY_BUF_SIZE ); \ + } \ + YY_CURRENT_BUFFER_LVALUE->yy_at_bol = at_bol; \ + } + +#define YY_AT_BOL() (YY_CURRENT_BUFFER_LVALUE->yy_at_bol) + +/* Begin user sect3 */ + +#define zconfwrap(n) 1 +#define YY_SKIP_YYWRAP + +typedef unsigned char YY_CHAR; + +FILE *zconfin = (FILE *) 0, *zconfout = (FILE *) 0; + +typedef int yy_state_type; + +extern int zconflineno; + +int zconflineno = 1; + +extern char *zconftext; +#define yytext_ptr zconftext +static yyconst flex_int16_t yy_nxt[][38] = + { + { + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0 + }, + + { + 11, 12, 13, 14, 12, 12, 15, 12, 12, 12, + 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, + 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, + 12, 12, 12, 12, 12, 12, 12, 12 + }, + + { + 11, 12, 13, 14, 12, 12, 15, 12, 12, 12, + 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, + + 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, + 12, 12, 12, 12, 12, 12, 12, 12 + }, + + { + 11, 16, 16, 17, 16, 16, 16, 16, 16, 16, + 16, 16, 16, 18, 16, 16, 18, 18, 19, 20, + 21, 22, 18, 18, 23, 24, 18, 25, 18, 26, + 27, 18, 28, 29, 30, 18, 18, 16 + }, + + { + 11, 16, 16, 17, 16, 16, 16, 16, 16, 16, + 16, 16, 16, 18, 16, 16, 18, 18, 19, 20, + 21, 22, 18, 18, 23, 24, 18, 25, 18, 26, + 27, 18, 28, 29, 30, 18, 18, 16 + + }, + + { + 11, 31, 32, 33, 31, 31, 31, 31, 31, 31, + 31, 31, 31, 31, 31, 31, 31, 31, 31, 31, + 31, 31, 31, 31, 31, 31, 31, 31, 31, 31, + 31, 31, 31, 31, 31, 31, 31, 31 + }, + + { + 11, 31, 32, 33, 31, 31, 31, 31, 31, 31, + 31, 31, 31, 31, 31, 31, 31, 31, 31, 31, + 31, 31, 31, 31, 31, 31, 31, 31, 31, 31, + 31, 31, 31, 31, 31, 31, 31, 31 + }, + + { + 11, 34, 34, 35, 34, 36, 34, 34, 36, 34, + 34, 34, 34, 34, 34, 37, 34, 34, 34, 34, + + 34, 34, 34, 34, 34, 34, 34, 34, 34, 34, + 34, 34, 34, 34, 34, 34, 34, 34 + }, + + { + 11, 34, 34, 35, 34, 36, 34, 34, 36, 34, + 34, 34, 34, 34, 34, 37, 34, 34, 34, 34, + 34, 34, 34, 34, 34, 34, 34, 34, 34, 34, + 34, 34, 34, 34, 34, 34, 34, 34 + }, + + { + 11, 38, 38, 39, 40, 41, 42, 43, 41, 44, + 45, 46, 47, 47, 48, 49, 47, 47, 47, 47, + 47, 47, 47, 47, 47, 50, 47, 47, 47, 51, + 47, 47, 47, 47, 47, 47, 47, 52 + + }, + + { + 11, 38, 38, 39, 40, 41, 42, 43, 41, 44, + 45, 46, 47, 47, 48, 49, 47, 47, 47, 47, + 47, 47, 47, 47, 47, 50, 47, 47, 47, 51, + 47, 47, 47, 47, 47, 47, 47, 52 + }, + + { + -11, -11, -11, -11, -11, -11, -11, -11, -11, -11, + -11, -11, -11, -11, -11, -11, -11, -11, -11, -11, + -11, -11, -11, -11, -11, -11, -11, -11, -11, -11, + -11, -11, -11, -11, -11, -11, -11, -11 + }, + + { + 11, -12, -12, -12, -12, -12, -12, -12, -12, -12, + -12, -12, -12, -12, -12, -12, -12, -12, -12, -12, + + -12, -12, -12, -12, -12, -12, -12, -12, -12, -12, + -12, -12, -12, -12, -12, -12, -12, -12 + }, + + { + 11, -13, 53, 54, -13, -13, 55, -13, -13, -13, + -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, + -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, + -13, -13, -13, -13, -13, -13, -13, -13 + }, + + { + 11, -14, -14, -14, -14, -14, -14, -14, -14, -14, + -14, -14, -14, -14, -14, -14, -14, -14, -14, -14, + -14, -14, -14, -14, -14, -14, -14, -14, -14, -14, + -14, -14, -14, -14, -14, -14, -14, -14 + + }, + + { + 11, 56, 56, 57, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56 + }, + + { + 11, -16, -16, -16, -16, -16, -16, -16, -16, -16, + -16, -16, -16, -16, -16, -16, -16, -16, -16, -16, + -16, -16, -16, -16, -16, -16, -16, -16, -16, -16, + -16, -16, -16, -16, -16, -16, -16, -16 + }, + + { + 11, -17, -17, -17, -17, -17, -17, -17, -17, -17, + -17, -17, -17, -17, -17, -17, -17, -17, -17, -17, + + -17, -17, -17, -17, -17, -17, -17, -17, -17, -17, + -17, -17, -17, -17, -17, -17, -17, -17 + }, + + { + 11, -18, -18, -18, -18, -18, -18, -18, -18, -18, + -18, -18, -18, 58, -18, -18, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -18 + }, + + { + 11, -19, -19, -19, -19, -19, -19, -19, -19, -19, + -19, -19, -19, 58, -19, -19, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 59, + 58, 58, 58, 58, 58, 58, 58, -19 + + }, + + { + 11, -20, -20, -20, -20, -20, -20, -20, -20, -20, + -20, -20, -20, 58, -20, -20, 58, 58, 58, 58, + 58, 58, 58, 58, 60, 58, 58, 58, 58, 61, + 58, 58, 58, 58, 58, 58, 58, -20 + }, + + { + 11, -21, -21, -21, -21, -21, -21, -21, -21, -21, + -21, -21, -21, 58, -21, -21, 58, 58, 58, 58, + 58, 62, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -21 + }, + + { + 11, -22, -22, -22, -22, -22, -22, -22, -22, -22, + -22, -22, -22, 58, -22, -22, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 63, 58, + 58, 58, 58, 58, 58, 58, 58, -22 + }, + + { + 11, -23, -23, -23, -23, -23, -23, -23, -23, -23, + -23, -23, -23, 58, -23, -23, 58, 58, 58, 58, + 58, 64, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -23 + }, + + { + 11, -24, -24, -24, -24, -24, -24, -24, -24, -24, + -24, -24, -24, 58, -24, -24, 58, 58, 58, 58, + 58, 58, 65, 58, 58, 58, 58, 58, 66, 58, + 58, 58, 58, 58, 58, 58, 58, -24 + + }, + + { + 11, -25, -25, -25, -25, -25, -25, -25, -25, -25, + -25, -25, -25, 58, -25, -25, 58, 67, 58, 58, + 58, 68, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -25 + }, + + { + 11, -26, -26, -26, -26, -26, -26, -26, -26, -26, + -26, -26, -26, 58, -26, -26, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 69, 58, 58, 58, 58, 58, 58, -26 + }, + + { + 11, -27, -27, -27, -27, -27, -27, -27, -27, -27, + -27, -27, -27, 58, -27, -27, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 70, 58, 58, 58, 58, -27 + }, + + { + 11, -28, -28, -28, -28, -28, -28, -28, -28, -28, + -28, -28, -28, 58, -28, -28, 58, 71, 58, 58, + 58, 72, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -28 + }, + + { + 11, -29, -29, -29, -29, -29, -29, -29, -29, -29, + -29, -29, -29, 58, -29, -29, 58, 58, 58, 58, + 58, 73, 58, 58, 58, 58, 58, 58, 58, 74, + 58, 58, 58, 58, 75, 58, 58, -29 + + }, + + { + 11, -30, -30, -30, -30, -30, -30, -30, -30, -30, + -30, -30, -30, 58, -30, -30, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 76, 58, 58, 58, 58, -30 + }, + + { + 11, 77, 77, -31, 77, 77, 77, 77, 77, 77, + 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, + 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, + 77, 77, 77, 77, 77, 77, 77, 77 + }, + + { + 11, -32, 78, 79, -32, -32, -32, -32, -32, -32, + -32, -32, -32, -32, -32, -32, -32, -32, -32, -32, + + -32, -32, -32, -32, -32, -32, -32, -32, -32, -32, + -32, -32, -32, -32, -32, -32, -32, -32 + }, + + { + 11, 80, -33, -33, 80, 80, 80, 80, 80, 80, + 80, 80, 80, 80, 80, 80, 80, 80, 80, 80, + 80, 80, 80, 80, 80, 80, 80, 80, 80, 80, + 80, 80, 80, 80, 80, 80, 80, 80 + }, + + { + 11, 81, 81, 82, 81, -34, 81, 81, -34, 81, + 81, 81, 81, 81, 81, -34, 81, 81, 81, 81, + 81, 81, 81, 81, 81, 81, 81, 81, 81, 81, + 81, 81, 81, 81, 81, 81, 81, 81 + + }, + + { + 11, -35, -35, -35, -35, -35, -35, -35, -35, -35, + -35, -35, -35, -35, -35, -35, -35, -35, -35, -35, + -35, -35, -35, -35, -35, -35, -35, -35, -35, -35, + -35, -35, -35, -35, -35, -35, -35, -35 + }, + + { + 11, -36, -36, -36, -36, -36, -36, -36, -36, -36, + -36, -36, -36, -36, -36, -36, -36, -36, -36, -36, + -36, -36, -36, -36, -36, -36, -36, -36, -36, -36, + -36, -36, -36, -36, -36, -36, -36, -36 + }, + + { + 11, 83, 83, 84, 83, 83, 83, 83, 83, 83, + 83, 83, 83, 83, 83, 83, 83, 83, 83, 83, + + 83, 83, 83, 83, 83, 83, 83, 83, 83, 83, + 83, 83, 83, 83, 83, 83, 83, 83 + }, + + { + 11, -38, -38, -38, -38, -38, -38, -38, -38, -38, + -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, + -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, + -38, -38, -38, -38, -38, -38, -38, -38 + }, + + { + 11, -39, -39, -39, -39, -39, -39, -39, -39, -39, + -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, + -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, + -39, -39, -39, -39, -39, -39, -39, -39 + + }, + + { + 11, -40, -40, -40, -40, -40, -40, -40, -40, -40, + -40, -40, -40, -40, 85, -40, -40, -40, -40, -40, + -40, -40, -40, -40, -40, -40, -40, -40, -40, -40, + -40, -40, -40, -40, -40, -40, -40, -40 + }, + + { + 11, -41, -41, -41, -41, -41, -41, -41, -41, -41, + -41, -41, -41, -41, -41, -41, -41, -41, -41, -41, + -41, -41, -41, -41, -41, -41, -41, -41, -41, -41, + -41, -41, -41, -41, -41, -41, -41, -41 + }, + + { + 11, 86, 86, -42, 86, 86, 86, 86, 86, 86, + 86, 86, 86, 86, 86, 86, 86, 86, 86, 86, + + 86, 86, 86, 86, 86, 86, 86, 86, 86, 86, + 86, 86, 86, 86, 86, 86, 86, 86 + }, + + { + 11, -43, -43, -43, -43, -43, -43, 87, -43, -43, + -43, -43, -43, -43, -43, -43, -43, -43, -43, -43, + -43, -43, -43, -43, -43, -43, -43, -43, -43, -43, + -43, -43, -43, -43, -43, -43, -43, -43 + }, + + { + 11, -44, -44, -44, -44, -44, -44, -44, -44, -44, + -44, -44, -44, -44, -44, -44, -44, -44, -44, -44, + -44, -44, -44, -44, -44, -44, -44, -44, -44, -44, + -44, -44, -44, -44, -44, -44, -44, -44 + + }, + + { + 11, -45, -45, -45, -45, -45, -45, -45, -45, -45, + -45, -45, -45, -45, -45, -45, -45, -45, -45, -45, + -45, -45, -45, -45, -45, -45, -45, -45, -45, -45, + -45, -45, -45, -45, -45, -45, -45, -45 + }, + + { + 11, -46, -46, -46, -46, -46, -46, -46, -46, -46, + -46, 88, 89, 89, -46, -46, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, -46 + }, + + { + 11, -47, -47, -47, -47, -47, -47, -47, -47, -47, + -47, 89, 89, 89, -47, -47, 89, 89, 89, 89, + + 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, -47 + }, + + { + 11, -48, -48, -48, -48, -48, -48, -48, -48, -48, + -48, -48, -48, -48, -48, -48, -48, -48, -48, -48, + -48, -48, -48, -48, -48, -48, -48, -48, -48, -48, + -48, -48, -48, -48, -48, -48, -48, -48 + }, + + { + 11, -49, -49, 90, -49, -49, -49, -49, -49, -49, + -49, -49, -49, -49, -49, -49, -49, -49, -49, -49, + -49, -49, -49, -49, -49, -49, -49, -49, -49, -49, + -49, -49, -49, -49, -49, -49, -49, -49 + + }, + + { + 11, -50, -50, -50, -50, -50, -50, -50, -50, -50, + -50, 89, 89, 89, -50, -50, 89, 89, 89, 89, + 89, 89, 91, 89, 89, 89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, -50 + }, + + { + 11, -51, -51, -51, -51, -51, -51, -51, -51, -51, + -51, 89, 89, 89, -51, -51, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, 89, 92, 89, + 89, 89, 89, 89, 89, 89, 89, -51 + }, + + { + 11, -52, -52, -52, -52, -52, -52, -52, -52, -52, + -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, + + -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, + -52, -52, -52, -52, -52, -52, -52, 93 + }, + + { + 11, -53, 53, 54, -53, -53, 55, -53, -53, -53, + -53, -53, -53, -53, -53, -53, -53, -53, -53, -53, + -53, -53, -53, -53, -53, -53, -53, -53, -53, -53, + -53, -53, -53, -53, -53, -53, -53, -53 + }, + + { + 11, -54, -54, -54, -54, -54, -54, -54, -54, -54, + -54, -54, -54, -54, -54, -54, -54, -54, -54, -54, + -54, -54, -54, -54, -54, -54, -54, -54, -54, -54, + -54, -54, -54, -54, -54, -54, -54, -54 + + }, + + { + 11, 56, 56, 57, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56 + }, + + { + 11, 56, 56, 57, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56 + }, + + { + 11, -57, -57, -57, -57, -57, -57, -57, -57, -57, + -57, -57, -57, -57, -57, -57, -57, -57, -57, -57, + + -57, -57, -57, -57, -57, -57, -57, -57, -57, -57, + -57, -57, -57, -57, -57, -57, -57, -57 + }, + + { + 11, -58, -58, -58, -58, -58, -58, -58, -58, -58, + -58, -58, -58, 58, -58, -58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -58 + }, + + { + 11, -59, -59, -59, -59, -59, -59, -59, -59, -59, + -59, -59, -59, 58, -59, -59, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 94, + 58, 58, 58, 58, 58, 58, 58, -59 + + }, + + { + 11, -60, -60, -60, -60, -60, -60, -60, -60, -60, + -60, -60, -60, 58, -60, -60, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 95, + 58, 58, 58, 58, 58, 58, 58, -60 + }, + + { + 11, -61, -61, -61, -61, -61, -61, -61, -61, -61, + -61, -61, -61, 58, -61, -61, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 96, 97, 58, + 58, 58, 58, 58, 58, 58, 58, -61 + }, + + { + 11, -62, -62, -62, -62, -62, -62, -62, -62, -62, + -62, -62, -62, 58, -62, -62, 58, 58, 58, 58, + + 58, 58, 98, 58, 58, 58, 58, 58, 58, 58, + 99, 58, 58, 58, 58, 58, 58, -62 + }, + + { + 11, -63, -63, -63, -63, -63, -63, -63, -63, -63, + -63, -63, -63, 58, -63, -63, 58, 100, 58, 58, + 101, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -63 + }, + + { + 11, -64, -64, -64, -64, -64, -64, -64, -64, -64, + -64, -64, -64, 58, -64, -64, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 102, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 103, -64 + + }, + + { + 11, -65, -65, -65, -65, -65, -65, -65, -65, -65, + -65, -65, -65, 58, -65, -65, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -65 + }, + + { + 11, -66, -66, -66, -66, -66, -66, -66, -66, -66, + -66, -66, -66, 58, -66, -66, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 104, 58, 58, -66 + }, + + { + 11, -67, -67, -67, -67, -67, -67, -67, -67, -67, + -67, -67, -67, 58, -67, -67, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 105, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -67 + }, + + { + 11, -68, -68, -68, -68, -68, -68, -68, -68, -68, + -68, -68, -68, 58, -68, -68, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 106, 58, + 58, 58, 58, 58, 58, 58, 58, -68 + }, + + { + 11, -69, -69, -69, -69, -69, -69, -69, -69, -69, + -69, -69, -69, 58, -69, -69, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 107, 58, 58, -69 + + }, + + { + 11, -70, -70, -70, -70, -70, -70, -70, -70, -70, + -70, -70, -70, 58, -70, -70, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 108, + 58, 58, 58, 58, 58, 58, 58, -70 + }, + + { + 11, -71, -71, -71, -71, -71, -71, -71, -71, -71, + -71, -71, -71, 58, -71, -71, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 109, 58, + 58, 58, 58, 58, 58, 58, 58, -71 + }, + + { + 11, -72, -72, -72, -72, -72, -72, -72, -72, -72, + -72, -72, -72, 58, -72, -72, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 110, 58, 58, 58, 58, 58, -72 + }, + + { + 11, -73, -73, -73, -73, -73, -73, -73, -73, -73, + -73, -73, -73, 58, -73, -73, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 111, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -73 + }, + + { + 11, -74, -74, -74, -74, -74, -74, -74, -74, -74, + -74, -74, -74, 58, -74, -74, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 112, 58, -74 + + }, + + { + 11, -75, -75, -75, -75, -75, -75, -75, -75, -75, + -75, -75, -75, 58, -75, -75, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 113, 58, 58, 58, 58, -75 + }, + + { + 11, -76, -76, -76, -76, -76, -76, -76, -76, -76, + -76, -76, -76, 58, -76, -76, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 114, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -76 + }, + + { + 11, 77, 77, -77, 77, 77, 77, 77, 77, 77, + 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, + + 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, + 77, 77, 77, 77, 77, 77, 77, 77 + }, + + { + 11, -78, 78, 79, -78, -78, -78, -78, -78, -78, + -78, -78, -78, -78, -78, -78, -78, -78, -78, -78, + -78, -78, -78, -78, -78, -78, -78, -78, -78, -78, + -78, -78, -78, -78, -78, -78, -78, -78 + }, + + { + 11, 80, -79, -79, 80, 80, 80, 80, 80, 80, + 80, 80, 80, 80, 80, 80, 80, 80, 80, 80, + 80, 80, 80, 80, 80, 80, 80, 80, 80, 80, + 80, 80, 80, 80, 80, 80, 80, 80 + + }, + + { + 11, -80, -80, -80, -80, -80, -80, -80, -80, -80, + -80, -80, -80, -80, -80, -80, -80, -80, -80, -80, + -80, -80, -80, -80, -80, -80, -80, -80, -80, -80, + -80, -80, -80, -80, -80, -80, -80, -80 + }, + + { + 11, 81, 81, 82, 81, -81, 81, 81, -81, 81, + 81, 81, 81, 81, 81, -81, 81, 81, 81, 81, + 81, 81, 81, 81, 81, 81, 81, 81, 81, 81, + 81, 81, 81, 81, 81, 81, 81, 81 + }, + + { + 11, -82, -82, -82, -82, -82, -82, -82, -82, -82, + -82, -82, -82, -82, -82, -82, -82, -82, -82, -82, + + -82, -82, -82, -82, -82, -82, -82, -82, -82, -82, + -82, -82, -82, -82, -82, -82, -82, -82 + }, + + { + 11, -83, -83, 84, -83, -83, -83, -83, -83, -83, + -83, -83, -83, -83, -83, -83, -83, -83, -83, -83, + -83, -83, -83, -83, -83, -83, -83, -83, -83, -83, + -83, -83, -83, -83, -83, -83, -83, -83 + }, + + { + 11, -84, -84, -84, -84, -84, -84, -84, -84, -84, + -84, -84, -84, -84, -84, -84, -84, -84, -84, -84, + -84, -84, -84, -84, -84, -84, -84, -84, -84, -84, + -84, -84, -84, -84, -84, -84, -84, -84 + + }, + + { + 11, -85, -85, -85, -85, -85, -85, -85, -85, -85, + -85, -85, -85, -85, -85, -85, -85, -85, -85, -85, + -85, -85, -85, -85, -85, -85, -85, -85, -85, -85, + -85, -85, -85, -85, -85, -85, -85, -85 + }, + + { + 11, 86, 86, -86, 86, 86, 86, 86, 86, 86, + 86, 86, 86, 86, 86, 86, 86, 86, 86, 86, + 86, 86, 86, 86, 86, 86, 86, 86, 86, 86, + 86, 86, 86, 86, 86, 86, 86, 86 + }, + + { + 11, -87, -87, -87, -87, -87, -87, -87, -87, -87, + -87, -87, -87, -87, -87, -87, -87, -87, -87, -87, + + -87, -87, -87, -87, -87, -87, -87, -87, -87, -87, + -87, -87, -87, -87, -87, -87, -87, -87 + }, + + { + 11, -88, -88, -88, -88, -88, -88, -88, -88, -88, + -88, 115, 89, 89, -88, -88, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, -88 + }, + + { + 11, -89, -89, -89, -89, -89, -89, -89, -89, -89, + -89, 89, 89, 89, -89, -89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, -89 + + }, + + { + 11, -90, -90, -90, -90, -90, -90, -90, -90, -90, + -90, -90, -90, -90, -90, -90, -90, -90, -90, -90, + -90, -90, -90, -90, -90, -90, -90, -90, -90, -90, + -90, -90, -90, -90, -90, -90, -90, -90 + }, + + { + 11, -91, -91, -91, -91, -91, -91, -91, -91, -91, + -91, 89, 89, 89, -91, -91, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, -91 + }, + + { + 11, -92, -92, -92, -92, -92, -92, -92, -92, -92, + -92, 89, 89, 89, -92, -92, 89, 89, 89, 89, + + 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, -92 + }, + + { + 11, -93, -93, -93, -93, -93, -93, -93, -93, -93, + -93, -93, -93, -93, -93, -93, -93, -93, -93, -93, + -93, -93, -93, -93, -93, -93, -93, -93, -93, -93, + -93, -93, -93, -93, -93, -93, -93, -93 + }, + + { + 11, -94, -94, -94, -94, -94, -94, -94, -94, -94, + -94, -94, -94, 58, -94, -94, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 116, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -94 + + }, + + { + 11, -95, -95, -95, -95, -95, -95, -95, -95, -95, + -95, -95, -95, 58, -95, -95, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 117, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -95 + }, + + { + 11, -96, -96, -96, -96, -96, -96, -96, -96, -96, + -96, -96, -96, 58, -96, -96, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 118, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -96 + }, + + { + 11, -97, -97, -97, -97, -97, -97, -97, -97, -97, + -97, -97, -97, 58, -97, -97, 58, 58, 58, 58, + + 58, 58, 119, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -97 + }, + + { + 11, -98, -98, -98, -98, -98, -98, -98, -98, -98, + -98, -98, -98, 58, -98, -98, 120, 121, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -98 + }, + + { + 11, -99, -99, -99, -99, -99, -99, -99, -99, -99, + -99, -99, -99, 58, -99, -99, 58, 58, 58, 58, + 58, 122, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -99 + + }, + + { + 11, -100, -100, -100, -100, -100, -100, -100, -100, -100, + -100, -100, -100, 58, -100, -100, 58, 58, 123, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -100 + }, + + { + 11, -101, -101, -101, -101, -101, -101, -101, -101, -101, + -101, -101, -101, 58, -101, -101, 58, 58, 58, 124, + 58, 58, 58, 58, 58, 125, 58, 126, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -101 + }, + + { + 11, -102, -102, -102, -102, -102, -102, -102, -102, -102, + -102, -102, -102, 58, -102, -102, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 127, 58, 58, 58, 58, 58, 58, -102 + }, + + { + 11, -103, -103, -103, -103, -103, -103, -103, -103, -103, + -103, -103, -103, 58, -103, -103, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -103 + }, + + { + 11, -104, -104, -104, -104, -104, -104, -104, -104, -104, + -104, -104, -104, 58, -104, -104, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -104 + + }, + + { + 11, -105, -105, -105, -105, -105, -105, -105, -105, -105, + -105, -105, -105, 58, -105, -105, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 128, 58, + 58, 58, 58, 58, 58, 58, 58, -105 + }, + + { + 11, -106, -106, -106, -106, -106, -106, -106, -106, -106, + -106, -106, -106, 58, -106, -106, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 129, 58, -106 + }, + + { + 11, -107, -107, -107, -107, -107, -107, -107, -107, -107, + -107, -107, -107, 58, -107, -107, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 130, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -107 + }, + + { + 11, -108, -108, -108, -108, -108, -108, -108, -108, -108, + -108, -108, -108, 58, -108, -108, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 131, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -108 + }, + + { + 11, -109, -109, -109, -109, -109, -109, -109, -109, -109, + -109, -109, -109, 58, -109, -109, 58, 58, 58, 58, + 58, 58, 58, 132, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -109 + + }, + + { + 11, -110, -110, -110, -110, -110, -110, -110, -110, -110, + -110, -110, -110, 58, -110, -110, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 133, 58, -110 + }, + + { + 11, -111, -111, -111, -111, -111, -111, -111, -111, -111, + -111, -111, -111, 58, -111, -111, 58, 58, 58, 58, + 58, 134, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -111 + }, + + { + 11, -112, -112, -112, -112, -112, -112, -112, -112, -112, + -112, -112, -112, 58, -112, -112, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 135, 58, 58, 58, 58, -112 + }, + + { + 11, -113, -113, -113, -113, -113, -113, -113, -113, -113, + -113, -113, -113, 58, -113, -113, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 136, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -113 + }, + + { + 11, -114, -114, -114, -114, -114, -114, -114, -114, -114, + -114, -114, -114, 58, -114, -114, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 137, 58, 58, 58, -114 + + }, + + { + 11, -115, -115, -115, -115, -115, -115, -115, -115, -115, + -115, 89, 89, 89, -115, -115, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, -115 + }, + + { + 11, -116, -116, -116, -116, -116, -116, -116, -116, -116, + -116, -116, -116, 58, -116, -116, 58, 58, 58, 58, + 58, 138, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -116 + }, + + { + 11, -117, -117, -117, -117, -117, -117, -117, -117, -117, + -117, -117, -117, 58, -117, -117, 58, 58, 58, 139, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -117 + }, + + { + 11, -118, -118, -118, -118, -118, -118, -118, -118, -118, + -118, -118, -118, 58, -118, -118, 58, 58, 58, 58, + 58, 140, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -118 + }, + + { + 11, -119, -119, -119, -119, -119, -119, -119, -119, -119, + -119, -119, -119, 58, -119, -119, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 141, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -119 + + }, + + { + 11, -120, -120, -120, -120, -120, -120, -120, -120, -120, + -120, -120, -120, 58, -120, -120, 58, 58, 142, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 143, 58, 58, -120 + }, + + { + 11, -121, -121, -121, -121, -121, -121, -121, -121, -121, + -121, -121, -121, 58, -121, -121, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 144, 58, -121 + }, + + { + 11, -122, -122, -122, -122, -122, -122, -122, -122, -122, + -122, -122, -122, 58, -122, -122, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 145, 58, + 58, 58, 58, 58, 58, 58, 58, -122 + }, + + { + 11, -123, -123, -123, -123, -123, -123, -123, -123, -123, + -123, -123, -123, 58, -123, -123, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 146, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -123 + }, + + { + 11, -124, -124, -124, -124, -124, -124, -124, -124, -124, + -124, -124, -124, 58, -124, -124, 58, 58, 58, 58, + 58, 58, 58, 58, 147, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -124 + + }, + + { + 11, -125, -125, -125, -125, -125, -125, -125, -125, -125, + -125, -125, -125, 58, -125, -125, 58, 58, 58, 58, + 58, 58, 148, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -125 + }, + + { + 11, -126, -126, -126, -126, -126, -126, -126, -126, -126, + -126, -126, -126, 58, -126, -126, 58, 58, 58, 58, + 58, 149, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -126 + }, + + { + 11, -127, -127, -127, -127, -127, -127, -127, -127, -127, + -127, -127, -127, 58, -127, -127, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -127 + }, + + { + 11, -128, -128, -128, -128, -128, -128, -128, -128, -128, + -128, -128, -128, 58, -128, -128, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 150, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -128 + }, + + { + 11, -129, -129, -129, -129, -129, -129, -129, -129, -129, + -129, -129, -129, 58, -129, -129, 58, 58, 58, 151, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -129 + + }, + + { + 11, -130, -130, -130, -130, -130, -130, -130, -130, -130, + -130, -130, -130, 58, -130, -130, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 152, + 58, 58, 58, 58, 58, 58, 58, -130 + }, + + { + 11, -131, -131, -131, -131, -131, -131, -131, -131, -131, + -131, -131, -131, 58, -131, -131, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 153, 58, 58, 58, 58, 58, 58, -131 + }, + + { + 11, -132, -132, -132, -132, -132, -132, -132, -132, -132, + -132, -132, -132, 58, -132, -132, 58, 58, 58, 58, + + 58, 154, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -132 + }, + + { + 11, -133, -133, -133, -133, -133, -133, -133, -133, -133, + -133, -133, -133, 58, -133, -133, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 155, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -133 + }, + + { + 11, -134, -134, -134, -134, -134, -134, -134, -134, -134, + -134, -134, -134, 58, -134, -134, 58, 58, 58, 156, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -134 + + }, + + { + 11, -135, -135, -135, -135, -135, -135, -135, -135, -135, + -135, -135, -135, 58, -135, -135, 58, 58, 58, 157, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -135 + }, + + { + 11, -136, -136, -136, -136, -136, -136, -136, -136, -136, + -136, -136, -136, 58, -136, -136, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 158, 58, + 58, 58, 58, 58, 58, 58, 58, -136 + }, + + { + 11, -137, -137, -137, -137, -137, -137, -137, -137, -137, + -137, -137, -137, 58, -137, -137, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 159, 58, 58, -137 + }, + + { + 11, -138, -138, -138, -138, -138, -138, -138, -138, -138, + -138, -138, -138, 58, -138, -138, 58, 160, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -138 + }, + + { + 11, -139, -139, -139, -139, -139, -139, -139, -139, -139, + -139, -139, -139, 58, -139, -139, 58, 58, 58, 58, + 58, 161, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -139 + + }, + + { + 11, -140, -140, -140, -140, -140, -140, -140, -140, -140, + -140, -140, -140, 58, -140, -140, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 162, 58, + 58, 58, 58, 58, 58, 58, 58, -140 + }, + + { + 11, -141, -141, -141, -141, -141, -141, -141, -141, -141, + -141, -141, -141, 58, -141, -141, 58, 58, 58, 58, + 58, 58, 58, 163, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -141 + }, + + { + 11, -142, -142, -142, -142, -142, -142, -142, -142, -142, + -142, -142, -142, 58, -142, -142, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 164, + 58, 58, 58, 58, 58, 58, 58, -142 + }, + + { + 11, -143, -143, -143, -143, -143, -143, -143, -143, -143, + -143, -143, -143, 58, -143, -143, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 165, 58, 58, 58, 58, -143 + }, + + { + 11, -144, -144, -144, -144, -144, -144, -144, -144, -144, + -144, -144, -144, 58, -144, -144, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 166, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -144 + + }, + + { + 11, -145, -145, -145, -145, -145, -145, -145, -145, -145, + -145, -145, -145, 58, -145, -145, 58, 58, 58, 58, + 167, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -145 + }, + + { + 11, -146, -146, -146, -146, -146, -146, -146, -146, -146, + -146, -146, -146, 58, -146, -146, 58, 58, 58, 58, + 58, 168, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -146 + }, + + { + 11, -147, -147, -147, -147, -147, -147, -147, -147, -147, + -147, -147, -147, 58, -147, -147, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 169, + 58, 58, 58, 58, 58, 58, 58, -147 + }, + + { + 11, -148, -148, -148, -148, -148, -148, -148, -148, -148, + -148, -148, -148, 58, -148, -148, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -148 + }, + + { + 11, -149, -149, -149, -149, -149, -149, -149, -149, -149, + -149, -149, -149, 58, -149, -149, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 170, 58, + 58, 58, 58, 58, 58, 58, 58, -149 + + }, + + { + 11, -150, -150, -150, -150, -150, -150, -150, -150, -150, + -150, -150, -150, 58, -150, -150, 58, 58, 58, 58, + 58, 171, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -150 + }, + + { + 11, -151, -151, -151, -151, -151, -151, -151, -151, -151, + -151, -151, -151, 58, -151, -151, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 172, + 58, 58, 58, 58, 58, 58, 58, -151 + }, + + { + 11, -152, -152, -152, -152, -152, -152, -152, -152, -152, + -152, -152, -152, 58, -152, -152, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 173, 58, + 58, 58, 58, 58, 58, 58, 58, -152 + }, + + { + 11, -153, -153, -153, -153, -153, -153, -153, -153, -153, + -153, -153, -153, 58, -153, -153, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 174, 58, 58, -153 + }, + + { + 11, -154, -154, -154, -154, -154, -154, -154, -154, -154, + -154, -154, -154, 58, -154, -154, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -154 + + }, + + { + 11, -155, -155, -155, -155, -155, -155, -155, -155, -155, + -155, -155, -155, 58, -155, -155, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 175, 58, 58, 58, 58, -155 + }, + + { + 11, -156, -156, -156, -156, -156, -156, -156, -156, -156, + -156, -156, -156, 58, -156, -156, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 176, 58, 58, -156 + }, + + { + 11, -157, -157, -157, -157, -157, -157, -157, -157, -157, + -157, -157, -157, 58, -157, -157, 58, 58, 58, 58, + + 58, 177, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -157 + }, + + { + 11, -158, -158, -158, -158, -158, -158, -158, -158, -158, + -158, -158, -158, 58, -158, -158, 58, 58, 58, 58, + 58, 58, 58, 178, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -158 + }, + + { + 11, -159, -159, -159, -159, -159, -159, -159, -159, -159, + -159, -159, -159, 58, -159, -159, 58, 179, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -159 + + }, + + { + 11, -160, -160, -160, -160, -160, -160, -160, -160, -160, + -160, -160, -160, 58, -160, -160, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 180, 58, + 58, 58, 58, 58, 58, 58, 58, -160 + }, + + { + 11, -161, -161, -161, -161, -161, -161, -161, -161, -161, + -161, -161, -161, 58, -161, -161, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -161 + }, + + { + 11, -162, -162, -162, -162, -162, -162, -162, -162, -162, + -162, -162, -162, 58, -162, -162, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 181, 58, 58, -162 + }, + + { + 11, -163, -163, -163, -163, -163, -163, -163, -163, -163, + -163, -163, -163, 58, -163, -163, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -163 + }, + + { + 11, -164, -164, -164, -164, -164, -164, -164, -164, -164, + -164, -164, -164, 58, -164, -164, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 182, + 58, 58, 58, 58, 58, 58, 58, -164 + + }, + + { + 11, -165, -165, -165, -165, -165, -165, -165, -165, -165, + -165, -165, -165, 58, -165, -165, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 183, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -165 + }, + + { + 11, -166, -166, -166, -166, -166, -166, -166, -166, -166, + -166, -166, -166, 58, -166, -166, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 184, 58, 58, -166 + }, + + { + 11, -167, -167, -167, -167, -167, -167, -167, -167, -167, + -167, -167, -167, 58, -167, -167, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 185, 58, 58, 58, -167 + }, + + { + 11, -168, -168, -168, -168, -168, -168, -168, -168, -168, + -168, -168, -168, 58, -168, -168, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -168 + }, + + { + 11, -169, -169, -169, -169, -169, -169, -169, -169, -169, + -169, -169, -169, 58, -169, -169, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 186, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -169 + + }, + + { + 11, -170, -170, -170, -170, -170, -170, -170, -170, -170, + -170, -170, -170, 58, -170, -170, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 187, 58, -170 + }, + + { + 11, -171, -171, -171, -171, -171, -171, -171, -171, -171, + -171, -171, -171, 58, -171, -171, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 188, 58, + 58, 58, 58, 58, 58, 58, 58, -171 + }, + + { + 11, -172, -172, -172, -172, -172, -172, -172, -172, -172, + -172, -172, -172, 58, -172, -172, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 189, 58, + 58, 58, 58, 58, 58, 58, 58, -172 + }, + + { + 11, -173, -173, -173, -173, -173, -173, -173, -173, -173, + -173, -173, -173, 58, -173, -173, 58, 190, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -173 + }, + + { + 11, -174, -174, -174, -174, -174, -174, -174, -174, -174, + -174, -174, -174, 58, -174, -174, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -174 + + }, + + { + 11, -175, -175, -175, -175, -175, -175, -175, -175, -175, + -175, -175, -175, 58, -175, -175, 58, 58, 58, 58, + 58, 191, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -175 + }, + + { + 11, -176, -176, -176, -176, -176, -176, -176, -176, -176, + -176, -176, -176, 58, -176, -176, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -176 + }, + + { + 11, -177, -177, -177, -177, -177, -177, -177, -177, -177, + -177, -177, -177, 58, -177, -177, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -177 + }, + + { + 11, -178, -178, -178, -178, -178, -178, -178, -178, -178, + -178, -178, -178, 58, -178, -178, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -178 + }, + + { + 11, -179, -179, -179, -179, -179, -179, -179, -179, -179, + -179, -179, -179, 58, -179, -179, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 192, 58, 58, -179 + + }, + + { + 11, -180, -180, -180, -180, -180, -180, -180, -180, -180, + -180, -180, -180, 58, -180, -180, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -180 + }, + + { + 11, -181, -181, -181, -181, -181, -181, -181, -181, -181, + -181, -181, -181, 58, -181, -181, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -181 + }, + + { + 11, -182, -182, -182, -182, -182, -182, -182, -182, -182, + -182, -182, -182, 58, -182, -182, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 193, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -182 + }, + + { + 11, -183, -183, -183, -183, -183, -183, -183, -183, -183, + -183, -183, -183, 58, -183, -183, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 194, 58, 58, 58, -183 + }, + + { + 11, -184, -184, -184, -184, -184, -184, -184, -184, -184, + -184, -184, -184, 58, -184, -184, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -184 + + }, + + { + 11, -185, -185, -185, -185, -185, -185, -185, -185, -185, + -185, -185, -185, 58, -185, -185, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -185 + }, + + { + 11, -186, -186, -186, -186, -186, -186, -186, -186, -186, + -186, -186, -186, 58, -186, -186, 58, 58, 58, 195, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -186 + }, + + { + 11, -187, -187, -187, -187, -187, -187, -187, -187, -187, + -187, -187, -187, 58, -187, -187, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -187 + }, + + { + 11, -188, -188, -188, -188, -188, -188, -188, -188, -188, + -188, -188, -188, 58, -188, -188, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 196, 58, -188 + }, + + { + 11, -189, -189, -189, -189, -189, -189, -189, -189, -189, + -189, -189, -189, 58, -189, -189, 58, 58, 58, 58, + 58, 58, 197, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -189 + + }, + + { + 11, -190, -190, -190, -190, -190, -190, -190, -190, -190, + -190, -190, -190, 58, -190, -190, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 198, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -190 + }, + + { + 11, -191, -191, -191, -191, -191, -191, -191, -191, -191, + -191, -191, -191, 58, -191, -191, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 199, 58, 58, 58, -191 + }, + + { + 11, -192, -192, -192, -192, -192, -192, -192, -192, -192, + -192, -192, -192, 58, -192, -192, 58, 58, 58, 58, + + 58, 200, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -192 + }, + + { + 11, -193, -193, -193, -193, -193, -193, -193, -193, -193, + -193, -193, -193, 58, -193, -193, 58, 58, 58, 58, + 58, 201, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -193 + }, + + { + 11, -194, -194, -194, -194, -194, -194, -194, -194, -194, + -194, -194, -194, 58, -194, -194, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 202, 58, 58, -194 + + }, + + { + 11, -195, -195, -195, -195, -195, -195, -195, -195, -195, + -195, -195, -195, 58, -195, -195, 58, 58, 58, 58, + 58, 203, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -195 + }, + + { + 11, -196, -196, -196, -196, -196, -196, -196, -196, -196, + -196, -196, -196, 58, -196, -196, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -196 + }, + + { + 11, -197, -197, -197, -197, -197, -197, -197, -197, -197, + -197, -197, -197, 58, -197, -197, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 204, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -197 + }, + + { + 11, -198, -198, -198, -198, -198, -198, -198, -198, -198, + -198, -198, -198, 58, -198, -198, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -198 + }, + + { + 11, -199, -199, -199, -199, -199, -199, -199, -199, -199, + -199, -199, -199, 58, -199, -199, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -199 + + }, + + { + 11, -200, -200, -200, -200, -200, -200, -200, -200, -200, + -200, -200, -200, 58, -200, -200, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -200 + }, + + { + 11, -201, -201, -201, -201, -201, -201, -201, -201, -201, + -201, -201, -201, 58, -201, -201, 58, 205, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -201 + }, + + { + 11, -202, -202, -202, -202, -202, -202, -202, -202, -202, + -202, -202, -202, 58, -202, -202, 58, 206, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -202 + }, + + { + 11, -203, -203, -203, -203, -203, -203, -203, -203, -203, + -203, -203, -203, 58, -203, -203, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -203 + }, + + { + 11, -204, -204, -204, -204, -204, -204, -204, -204, -204, + -204, -204, -204, 58, -204, -204, 58, 58, 58, 58, + 58, 58, 58, 207, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -204 + + }, + + { + 11, -205, -205, -205, -205, -205, -205, -205, -205, -205, + -205, -205, -205, 58, -205, -205, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 208, 58, + 58, 58, 58, 58, 58, 58, 58, -205 + }, + + { + 11, -206, -206, -206, -206, -206, -206, -206, -206, -206, + -206, -206, -206, 58, -206, -206, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 209, 58, 58, -206 + }, + + { + 11, -207, -207, -207, -207, -207, -207, -207, -207, -207, + -207, -207, -207, 58, -207, -207, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -207 + }, + + { + 11, -208, -208, -208, -208, -208, -208, -208, -208, -208, + -208, -208, -208, 58, -208, -208, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -208 + }, + + { + 11, -209, -209, -209, -209, -209, -209, -209, -209, -209, + -209, -209, -209, 58, -209, -209, 58, 58, 58, 58, + 58, 210, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -209 + + }, + + { + 11, -210, -210, -210, -210, -210, -210, -210, -210, -210, + -210, -210, -210, 58, -210, -210, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -210 + }, + + } ; + +static yy_state_type yy_get_previous_state (void ); +static yy_state_type yy_try_NUL_trans (yy_state_type current_state ); +static int yy_get_next_buffer (void ); +static void yy_fatal_error (yyconst char msg[] ); + +/* Done after the current pattern has been matched and before the + * corresponding action - sets up zconftext. + */ +#define YY_DO_BEFORE_ACTION \ + (yytext_ptr) = yy_bp; \ + zconfleng = (size_t) (yy_cp - yy_bp); \ + (yy_hold_char) = *yy_cp; \ + *yy_cp = '\0'; \ + (yy_c_buf_p) = yy_cp; + +#define YY_NUM_RULES 64 +#define YY_END_OF_BUFFER 65 +/* This struct is not used in this scanner, + but its presence is necessary. */ +struct yy_trans_info + { + flex_int32_t yy_verify; + flex_int32_t yy_nxt; + }; +static yyconst flex_int16_t yy_accept[211] = + { 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 65, 5, 4, 3, 2, 36, 37, 35, 35, 35, + 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, + 63, 60, 62, 55, 59, 58, 57, 53, 48, 42, + 47, 51, 53, 40, 41, 50, 50, 43, 53, 50, + 50, 53, 4, 3, 2, 2, 1, 35, 35, 35, + 35, 35, 35, 35, 16, 35, 35, 35, 35, 35, + 35, 35, 35, 35, 35, 35, 63, 60, 62, 61, + 55, 54, 57, 56, 44, 51, 38, 50, 50, 52, + 45, 46, 39, 35, 35, 35, 35, 35, 35, 35, + + 35, 35, 30, 29, 35, 35, 35, 35, 35, 35, + 35, 35, 35, 35, 49, 25, 35, 35, 35, 35, + 35, 35, 35, 35, 35, 35, 15, 35, 7, 35, + 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, + 35, 35, 35, 35, 35, 35, 35, 17, 35, 35, + 35, 35, 35, 34, 35, 35, 35, 35, 35, 35, + 10, 35, 13, 35, 35, 35, 35, 33, 35, 35, + 35, 35, 35, 22, 35, 32, 9, 31, 35, 26, + 12, 35, 35, 21, 18, 35, 8, 35, 35, 35, + 35, 35, 27, 35, 35, 6, 35, 20, 19, 23, + + 35, 35, 11, 35, 35, 35, 14, 28, 35, 24 + } ; + +static yyconst flex_int32_t yy_ec[256] = + { 0, + 1, 1, 1, 1, 1, 1, 1, 1, 2, 3, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 2, 4, 5, 6, 1, 1, 7, 8, 9, + 10, 1, 1, 1, 11, 12, 12, 13, 13, 13, + 13, 13, 13, 13, 13, 13, 13, 1, 1, 1, + 14, 1, 1, 1, 13, 13, 13, 13, 13, 13, + 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, + 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, + 1, 15, 1, 1, 16, 1, 17, 18, 19, 20, + + 21, 22, 23, 24, 25, 13, 13, 26, 27, 28, + 29, 30, 31, 32, 33, 34, 35, 13, 13, 36, + 13, 13, 1, 37, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1 + } ; + +extern int zconf_flex_debug; +int zconf_flex_debug = 0; + +/* The intent behind this definition is that it'll catch + * any uses of REJECT which flex missed. + */ +#define REJECT reject_used_but_not_detected +#define yymore() yymore_used_but_not_detected +#define YY_MORE_ADJ 0 +#define YY_RESTORE_YY_MORE_OFFSET +char *zconftext; + +/* + * Copyright (C) 2002 Roman Zippel + * Released under the terms of the GNU GPL v2.0. + */ + +#include +#include +#include +#include +#include + +#define LKC_DIRECT_LINK +#include "lkc.h" + +#define START_STRSIZE 16 + +char *text; +static char *text_ptr; +static int text_size, text_asize; + +struct buffer { + struct buffer *parent; + YY_BUFFER_STATE state; +}; + +struct buffer *current_buf; + +static int last_ts, first_ts; + +static void zconf_endhelp(void); +static struct buffer *zconf_endfile(void); + +void new_string(void) +{ + text = malloc(START_STRSIZE); + text_asize = START_STRSIZE; + text_ptr = text; + text_size = 0; + *text_ptr = 0; +} + +void append_string(const char *str, int size) +{ + int new_size = text_size + size + 1; + if (new_size > text_asize) { + text = realloc(text, new_size); + text_asize = new_size; + text_ptr = text + text_size; + } + memcpy(text_ptr, str, size); + text_ptr += size; + text_size += size; + *text_ptr = 0; +} + +void alloc_string(const char *str, int size) +{ + text = malloc(size + 1); + memcpy(text, str, size); + text[size] = 0; +} + +#define INITIAL 0 +#define COMMAND 1 +#define HELP 2 +#define STRING 3 +#define PARAM 4 + +/* Special case for "unistd.h", since it is non-ANSI. We include it way + * down here because we want the user's section 1 to have been scanned first. + * The user has a chance to override it with an option. + */ +#include + +#ifndef YY_EXTRA_TYPE +#define YY_EXTRA_TYPE void * +#endif + +/* Macros after this point can all be overridden by user definitions in + * section 1. + */ + +#ifndef YY_SKIP_YYWRAP +#ifdef __cplusplus +extern "C" int zconfwrap (void ); +#else +extern int zconfwrap (void ); +#endif +#endif + + static void yyunput (int c,char *buf_ptr ); + +#ifndef yytext_ptr +static void yy_flex_strncpy (char *,yyconst char *,int ); +#endif + +#ifdef YY_NEED_STRLEN +static int yy_flex_strlen (yyconst char * ); +#endif + +#ifndef YY_NO_INPUT + +#ifdef __cplusplus +static int yyinput (void ); +#else +static int input (void ); +#endif + +#endif + +/* Amount of stuff to slurp up with each read. */ +#ifndef YY_READ_BUF_SIZE +#define YY_READ_BUF_SIZE 8192 +#endif + +/* Copy whatever the last rule matched to the standard output. */ +#ifndef ECHO +/* This used to be an fputs(), but since the string might contain NUL's, + * we now use fwrite(). + */ +#define ECHO (void) fwrite( zconftext, zconfleng, 1, zconfout ) +#endif + +/* Gets input and stuffs it into "buf". number of characters read, or YY_NULL, + * is returned in "result". + */ +#ifndef YY_INPUT +#define YY_INPUT(buf,result,max_size) \ + errno=0; \ + while ( (result = read( fileno(zconfin), (char *) buf, max_size )) < 0 ) \ + { \ + if( errno != EINTR) \ + { \ + YY_FATAL_ERROR( "input in flex scanner failed" ); \ + break; \ + } \ + errno=0; \ + clearerr(zconfin); \ + }\ +\ + +#endif + +/* No semi-colon after return; correct usage is to write "yyterminate();" - + * we don't want an extra ';' after the "return" because that will cause + * some compilers to complain about unreachable statements. + */ +#ifndef yyterminate +#define yyterminate() return YY_NULL +#endif + +/* Number of entries by which start-condition stack grows. */ +#ifndef YY_START_STACK_INCR +#define YY_START_STACK_INCR 25 +#endif + +/* Report a fatal error. */ +#ifndef YY_FATAL_ERROR +#define YY_FATAL_ERROR(msg) yy_fatal_error( msg ) +#endif + +/* end tables serialization structures and prototypes */ + +/* Default declaration of generated scanner - a define so the user can + * easily add parameters. + */ +#ifndef YY_DECL +#define YY_DECL_IS_OURS 1 + +extern int zconflex (void); + +#define YY_DECL int zconflex (void) +#endif /* !YY_DECL */ + +/* Code executed at the beginning of each rule, after zconftext and zconfleng + * have been set up. + */ +#ifndef YY_USER_ACTION +#define YY_USER_ACTION +#endif + +/* Code executed at the end of each rule. */ +#ifndef YY_BREAK +#define YY_BREAK break; +#endif + +#define YY_RULE_SETUP \ + YY_USER_ACTION + +/** The main scanner function which does all the work. + */ +YY_DECL +{ + register yy_state_type yy_current_state; + register char *yy_cp, *yy_bp; + register int yy_act; + + int str = 0; + int ts, i; + + if ( (yy_init) ) + { + (yy_init) = 0; + +#ifdef YY_USER_INIT + YY_USER_INIT; +#endif + + if ( ! (yy_start) ) + (yy_start) = 1; /* first start state */ + + if ( ! zconfin ) + zconfin = stdin; + + if ( ! zconfout ) + zconfout = stdout; + + if ( ! YY_CURRENT_BUFFER ) { + zconfensure_buffer_stack (); + YY_CURRENT_BUFFER_LVALUE = + zconf_create_buffer(zconfin,YY_BUF_SIZE ); + } + + zconf_load_buffer_state( ); + } + + while ( 1 ) /* loops until end-of-file is reached */ + { + yy_cp = (yy_c_buf_p); + + /* Support of zconftext. */ + *yy_cp = (yy_hold_char); + + /* yy_bp points to the position in yy_ch_buf of the start of + * the current run. + */ + yy_bp = yy_cp; + + yy_current_state = (yy_start); +yy_match: + while ( (yy_current_state = yy_nxt[yy_current_state][ yy_ec[YY_SC_TO_UI(*yy_cp)] ]) > 0 ) + ++yy_cp; + + yy_current_state = -yy_current_state; + +yy_find_action: + yy_act = yy_accept[yy_current_state]; + + YY_DO_BEFORE_ACTION; + +do_action: /* This label is used only to access EOF actions. */ + + switch ( yy_act ) + { /* beginning of action switch */ +case 1: +/* rule 1 can match eol */ +YY_RULE_SETUP +current_file->lineno++; + YY_BREAK +case 2: +YY_RULE_SETUP + + YY_BREAK +case 3: +/* rule 3 can match eol */ +YY_RULE_SETUP +current_file->lineno++; return T_EOL; + YY_BREAK +case 4: +YY_RULE_SETUP +{ + BEGIN(COMMAND); +} + YY_BREAK +case 5: +YY_RULE_SETUP +{ + unput(zconftext[0]); + BEGIN(COMMAND); +} + YY_BREAK + +case 6: +YY_RULE_SETUP +BEGIN(PARAM); return T_MAINMENU; + YY_BREAK +case 7: +YY_RULE_SETUP +BEGIN(PARAM); return T_MENU; + YY_BREAK +case 8: +YY_RULE_SETUP +BEGIN(PARAM); return T_ENDMENU; + YY_BREAK +case 9: +YY_RULE_SETUP +BEGIN(PARAM); return T_SOURCE; + YY_BREAK +case 10: +YY_RULE_SETUP +BEGIN(PARAM); return T_CHOICE; + YY_BREAK +case 11: +YY_RULE_SETUP +BEGIN(PARAM); return T_ENDCHOICE; + YY_BREAK +case 12: +YY_RULE_SETUP +BEGIN(PARAM); return T_COMMENT; + YY_BREAK +case 13: +YY_RULE_SETUP +BEGIN(PARAM); return T_CONFIG; + YY_BREAK +case 14: +YY_RULE_SETUP +BEGIN(PARAM); return T_MENUCONFIG; + YY_BREAK +case 15: +YY_RULE_SETUP +BEGIN(PARAM); return T_HELP; + YY_BREAK +case 16: +YY_RULE_SETUP +BEGIN(PARAM); return T_IF; + YY_BREAK +case 17: +YY_RULE_SETUP +BEGIN(PARAM); return T_ENDIF; + YY_BREAK +case 18: +YY_RULE_SETUP +BEGIN(PARAM); return T_DEPENDS; + YY_BREAK +case 19: +YY_RULE_SETUP +BEGIN(PARAM); return T_REQUIRES; + YY_BREAK +case 20: +YY_RULE_SETUP +BEGIN(PARAM); return T_OPTIONAL; + YY_BREAK +case 21: +YY_RULE_SETUP +BEGIN(PARAM); return T_DEFAULT; + YY_BREAK +case 22: +YY_RULE_SETUP +BEGIN(PARAM); return T_PROMPT; + YY_BREAK +case 23: +YY_RULE_SETUP +BEGIN(PARAM); return T_TRISTATE; + YY_BREAK +case 24: +YY_RULE_SETUP +BEGIN(PARAM); return T_DEF_TRISTATE; + YY_BREAK +case 25: +YY_RULE_SETUP +BEGIN(PARAM); return T_BOOLEAN; + YY_BREAK +case 26: +YY_RULE_SETUP +BEGIN(PARAM); return T_BOOLEAN; + YY_BREAK +case 27: +YY_RULE_SETUP +BEGIN(PARAM); return T_DEF_BOOLEAN; + YY_BREAK +case 28: +YY_RULE_SETUP +BEGIN(PARAM); return T_DEF_BOOLEAN; + YY_BREAK +case 29: +YY_RULE_SETUP +BEGIN(PARAM); return T_INT; + YY_BREAK +case 30: +YY_RULE_SETUP +BEGIN(PARAM); return T_HEX; + YY_BREAK +case 31: +YY_RULE_SETUP +BEGIN(PARAM); return T_STRING; + YY_BREAK +case 32: +YY_RULE_SETUP +BEGIN(PARAM); return T_SELECT; + YY_BREAK +case 33: +YY_RULE_SETUP +BEGIN(PARAM); return T_SELECT; + YY_BREAK +case 34: +YY_RULE_SETUP +BEGIN(PARAM); return T_RANGE; + YY_BREAK +case 35: +YY_RULE_SETUP +{ + alloc_string(zconftext, zconfleng); + zconflval.string = text; + return T_WORD; + } + YY_BREAK +case 36: +YY_RULE_SETUP + + YY_BREAK +case 37: +/* rule 37 can match eol */ +YY_RULE_SETUP +current_file->lineno++; BEGIN(INITIAL); + YY_BREAK + +case 38: +YY_RULE_SETUP +return T_AND; + YY_BREAK +case 39: +YY_RULE_SETUP +return T_OR; + YY_BREAK +case 40: +YY_RULE_SETUP +return T_OPEN_PAREN; + YY_BREAK +case 41: +YY_RULE_SETUP +return T_CLOSE_PAREN; + YY_BREAK +case 42: +YY_RULE_SETUP +return T_NOT; + YY_BREAK +case 43: +YY_RULE_SETUP +return T_EQUAL; + YY_BREAK +case 44: +YY_RULE_SETUP +return T_UNEQUAL; + YY_BREAK +case 45: +YY_RULE_SETUP +return T_IF; + YY_BREAK +case 46: +YY_RULE_SETUP +return T_ON; + YY_BREAK +case 47: +YY_RULE_SETUP +{ + str = zconftext[0]; + new_string(); + BEGIN(STRING); + } + YY_BREAK +case 48: +/* rule 48 can match eol */ +YY_RULE_SETUP +BEGIN(INITIAL); current_file->lineno++; return T_EOL; + YY_BREAK +case 49: +YY_RULE_SETUP +/* ignore */ + YY_BREAK +case 50: +YY_RULE_SETUP +{ + alloc_string(zconftext, zconfleng); + zconflval.string = text; + return T_WORD; + } + YY_BREAK +case 51: +YY_RULE_SETUP +/* comment */ + YY_BREAK +case 52: +/* rule 52 can match eol */ +YY_RULE_SETUP +current_file->lineno++; + YY_BREAK +case 53: +YY_RULE_SETUP + + YY_BREAK +case YY_STATE_EOF(PARAM): +{ + BEGIN(INITIAL); + } + YY_BREAK + +case 54: +/* rule 54 can match eol */ +*yy_cp = (yy_hold_char); /* undo effects of setting up zconftext */ +(yy_c_buf_p) = yy_cp -= 1; +YY_DO_BEFORE_ACTION; /* set up zconftext again */ +YY_RULE_SETUP +{ + append_string(zconftext, zconfleng); + zconflval.string = text; + return T_WORD_QUOTE; + } + YY_BREAK +case 55: +YY_RULE_SETUP +{ + append_string(zconftext, zconfleng); + } + YY_BREAK +case 56: +/* rule 56 can match eol */ +*yy_cp = (yy_hold_char); /* undo effects of setting up zconftext */ +(yy_c_buf_p) = yy_cp -= 1; +YY_DO_BEFORE_ACTION; /* set up zconftext again */ +YY_RULE_SETUP +{ + append_string(zconftext + 1, zconfleng - 1); + zconflval.string = text; + return T_WORD_QUOTE; + } + YY_BREAK +case 57: +YY_RULE_SETUP +{ + append_string(zconftext + 1, zconfleng - 1); + } + YY_BREAK +case 58: +YY_RULE_SETUP +{ + if (str == zconftext[0]) { + BEGIN(PARAM); + zconflval.string = text; + return T_WORD_QUOTE; + } else + append_string(zconftext, 1); + } + YY_BREAK +case 59: +/* rule 59 can match eol */ +YY_RULE_SETUP +{ + printf("%s:%d:warning: multi-line strings not supported\n", zconf_curname(), zconf_lineno()); + current_file->lineno++; + BEGIN(INITIAL); + return T_EOL; + } + YY_BREAK +case YY_STATE_EOF(STRING): +{ + BEGIN(INITIAL); + } + YY_BREAK + +case 60: +YY_RULE_SETUP +{ + ts = 0; + for (i = 0; i < zconfleng; i++) { + if (zconftext[i] == '\t') + ts = (ts & ~7) + 8; + else + ts++; + } + last_ts = ts; + if (first_ts) { + if (ts < first_ts) { + zconf_endhelp(); + return T_HELPTEXT; + } + ts -= first_ts; + while (ts > 8) { + append_string(" ", 8); + ts -= 8; + } + append_string(" ", ts); + } + } + YY_BREAK +case 61: +/* rule 61 can match eol */ +*yy_cp = (yy_hold_char); /* undo effects of setting up zconftext */ +(yy_c_buf_p) = yy_cp -= 1; +YY_DO_BEFORE_ACTION; /* set up zconftext again */ +YY_RULE_SETUP +{ + current_file->lineno++; + zconf_endhelp(); + return T_HELPTEXT; + } + YY_BREAK +case 62: +/* rule 62 can match eol */ +YY_RULE_SETUP +{ + current_file->lineno++; + append_string("\n", 1); + } + YY_BREAK +case 63: +YY_RULE_SETUP +{ + append_string(zconftext, zconfleng); + if (!first_ts) + first_ts = last_ts; + } + YY_BREAK +case YY_STATE_EOF(HELP): +{ + zconf_endhelp(); + return T_HELPTEXT; + } + YY_BREAK + +case YY_STATE_EOF(INITIAL): +case YY_STATE_EOF(COMMAND): +{ + if (current_buf) { + zconf_endfile(); + return T_EOF; + } + fclose(zconfin); + yyterminate(); +} + YY_BREAK +case 64: +YY_RULE_SETUP +YY_FATAL_ERROR( "flex scanner jammed" ); + YY_BREAK + + case YY_END_OF_BUFFER: + { + /* Amount of text matched not including the EOB char. */ + int yy_amount_of_matched_text = (int) (yy_cp - (yytext_ptr)) - 1; + + /* Undo the effects of YY_DO_BEFORE_ACTION. */ + *yy_cp = (yy_hold_char); + YY_RESTORE_YY_MORE_OFFSET + + if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_NEW ) + { + /* We're scanning a new file or input source. It's + * possible that this happened because the user + * just pointed zconfin at a new source and called + * zconflex(). If so, then we have to assure + * consistency between YY_CURRENT_BUFFER and our + * globals. Here is the right place to do so, because + * this is the first action (other than possibly a + * back-up) that will match for the new input source. + */ + (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_n_chars; + YY_CURRENT_BUFFER_LVALUE->yy_input_file = zconfin; + YY_CURRENT_BUFFER_LVALUE->yy_buffer_status = YY_BUFFER_NORMAL; + } + + /* Note that here we test for yy_c_buf_p "<=" to the position + * of the first EOB in the buffer, since yy_c_buf_p will + * already have been incremented past the NUL character + * (since all states make transitions on EOB to the + * end-of-buffer state). Contrast this with the test + * in input(). + */ + if ( (yy_c_buf_p) <= &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] ) + { /* This was really a NUL. */ + yy_state_type yy_next_state; + + (yy_c_buf_p) = (yytext_ptr) + yy_amount_of_matched_text; + + yy_current_state = yy_get_previous_state( ); + + /* Okay, we're now positioned to make the NUL + * transition. We couldn't have + * yy_get_previous_state() go ahead and do it + * for us because it doesn't know how to deal + * with the possibility of jamming (and we don't + * want to build jamming into it because then it + * will run more slowly). + */ + + yy_next_state = yy_try_NUL_trans( yy_current_state ); + + yy_bp = (yytext_ptr) + YY_MORE_ADJ; + + if ( yy_next_state ) + { + /* Consume the NUL. */ + yy_cp = ++(yy_c_buf_p); + yy_current_state = yy_next_state; + goto yy_match; + } + + else + { + yy_cp = (yy_c_buf_p); + goto yy_find_action; + } + } + + else switch ( yy_get_next_buffer( ) ) + { + case EOB_ACT_END_OF_FILE: + { + (yy_did_buffer_switch_on_eof) = 0; + + if ( zconfwrap( ) ) + { + /* Note: because we've taken care in + * yy_get_next_buffer() to have set up + * zconftext, we can now set up + * yy_c_buf_p so that if some total + * hoser (like flex itself) wants to + * call the scanner after we return the + * YY_NULL, it'll still work - another + * YY_NULL will get returned. + */ + (yy_c_buf_p) = (yytext_ptr) + YY_MORE_ADJ; + + yy_act = YY_STATE_EOF(YY_START); + goto do_action; + } + + else + { + if ( ! (yy_did_buffer_switch_on_eof) ) + YY_NEW_FILE; + } + break; + } + + case EOB_ACT_CONTINUE_SCAN: + (yy_c_buf_p) = + (yytext_ptr) + yy_amount_of_matched_text; + + yy_current_state = yy_get_previous_state( ); + + yy_cp = (yy_c_buf_p); + yy_bp = (yytext_ptr) + YY_MORE_ADJ; + goto yy_match; + + case EOB_ACT_LAST_MATCH: + (yy_c_buf_p) = + &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)]; + + yy_current_state = yy_get_previous_state( ); + + yy_cp = (yy_c_buf_p); + yy_bp = (yytext_ptr) + YY_MORE_ADJ; + goto yy_find_action; + } + break; + } + + default: + YY_FATAL_ERROR( + "fatal flex scanner internal error--no action found" ); + } /* end of action switch */ + } /* end of scanning one token */ +} /* end of zconflex */ + +/* yy_get_next_buffer - try to read in a new buffer + * + * Returns a code representing an action: + * EOB_ACT_LAST_MATCH - + * EOB_ACT_CONTINUE_SCAN - continue scanning from current position + * EOB_ACT_END_OF_FILE - end of file + */ +static int yy_get_next_buffer (void) +{ + register char *dest = YY_CURRENT_BUFFER_LVALUE->yy_ch_buf; + register char *source = (yytext_ptr); + register int number_to_move, i; + int ret_val; + + if ( (yy_c_buf_p) > &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars) + 1] ) + YY_FATAL_ERROR( + "fatal flex scanner internal error--end of buffer missed" ); + + if ( YY_CURRENT_BUFFER_LVALUE->yy_fill_buffer == 0 ) + { /* Don't try to fill the buffer, so this is an EOF. */ + if ( (yy_c_buf_p) - (yytext_ptr) - YY_MORE_ADJ == 1 ) + { + /* We matched a single character, the EOB, so + * treat this as a final EOF. + */ + return EOB_ACT_END_OF_FILE; + } + + else + { + /* We matched some text prior to the EOB, first + * process it. + */ + return EOB_ACT_LAST_MATCH; + } + } + + /* Try to read more data. */ + + /* First move last chars to start of buffer. */ + number_to_move = (int) ((yy_c_buf_p) - (yytext_ptr)) - 1; + + for ( i = 0; i < number_to_move; ++i ) + *(dest++) = *(source++); + + if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_EOF_PENDING ) + /* don't do the read, it's not guaranteed to return an EOF, + * just force an EOF + */ + YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars) = 0; + + else + { + size_t num_to_read = + YY_CURRENT_BUFFER_LVALUE->yy_buf_size - number_to_move - 1; + + while ( num_to_read <= 0 ) + { /* Not enough room in the buffer - grow it. */ + + /* just a shorter name for the current buffer */ + YY_BUFFER_STATE b = YY_CURRENT_BUFFER; + + int yy_c_buf_p_offset = + (int) ((yy_c_buf_p) - b->yy_ch_buf); + + if ( b->yy_is_our_buffer ) + { + int new_size = b->yy_buf_size * 2; + + if ( new_size <= 0 ) + b->yy_buf_size += b->yy_buf_size / 8; + else + b->yy_buf_size *= 2; + + b->yy_ch_buf = (char *) + /* Include room in for 2 EOB chars. */ + zconfrealloc((void *) b->yy_ch_buf,b->yy_buf_size + 2 ); + } + else + /* Can't grow it, we don't own it. */ + b->yy_ch_buf = 0; + + if ( ! b->yy_ch_buf ) + YY_FATAL_ERROR( + "fatal error - scanner input buffer overflow" ); + + (yy_c_buf_p) = &b->yy_ch_buf[yy_c_buf_p_offset]; + + num_to_read = YY_CURRENT_BUFFER_LVALUE->yy_buf_size - + number_to_move - 1; + + } + + if ( num_to_read > YY_READ_BUF_SIZE ) + num_to_read = YY_READ_BUF_SIZE; + + /* Read in more data. */ + YY_INPUT( (&YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]), + (yy_n_chars), num_to_read ); + + YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars); + } + + if ( (yy_n_chars) == 0 ) + { + if ( number_to_move == YY_MORE_ADJ ) + { + ret_val = EOB_ACT_END_OF_FILE; + zconfrestart(zconfin ); + } + + else + { + ret_val = EOB_ACT_LAST_MATCH; + YY_CURRENT_BUFFER_LVALUE->yy_buffer_status = + YY_BUFFER_EOF_PENDING; + } + } + + else + ret_val = EOB_ACT_CONTINUE_SCAN; + + (yy_n_chars) += number_to_move; + YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] = YY_END_OF_BUFFER_CHAR; + YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars) + 1] = YY_END_OF_BUFFER_CHAR; + + (yytext_ptr) = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[0]; + + return ret_val; +} + +/* yy_get_previous_state - get the state just before the EOB char was reached */ + + static yy_state_type yy_get_previous_state (void) +{ + register yy_state_type yy_current_state; + register char *yy_cp; + + yy_current_state = (yy_start); + + for ( yy_cp = (yytext_ptr) + YY_MORE_ADJ; yy_cp < (yy_c_buf_p); ++yy_cp ) + { + yy_current_state = yy_nxt[yy_current_state][(*yy_cp ? yy_ec[YY_SC_TO_UI(*yy_cp)] : 1)]; + } + + return yy_current_state; +} + +/* yy_try_NUL_trans - try to make a transition on the NUL character + * + * synopsis + * next_state = yy_try_NUL_trans( current_state ); + */ + static yy_state_type yy_try_NUL_trans (yy_state_type yy_current_state ) +{ + register int yy_is_jam; + + yy_current_state = yy_nxt[yy_current_state][1]; + yy_is_jam = (yy_current_state <= 0); + + return yy_is_jam ? 0 : yy_current_state; +} + + static void yyunput (int c, register char * yy_bp ) +{ + register char *yy_cp; + + yy_cp = (yy_c_buf_p); + + /* undo effects of setting up zconftext */ + *yy_cp = (yy_hold_char); + + if ( yy_cp < YY_CURRENT_BUFFER_LVALUE->yy_ch_buf + 2 ) + { /* need to shift things up to make room */ + /* +2 for EOB chars. */ + register int number_to_move = (yy_n_chars) + 2; + register char *dest = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[ + YY_CURRENT_BUFFER_LVALUE->yy_buf_size + 2]; + register char *source = + &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]; + + while ( source > YY_CURRENT_BUFFER_LVALUE->yy_ch_buf ) + *--dest = *--source; + + yy_cp += (int) (dest - source); + yy_bp += (int) (dest - source); + YY_CURRENT_BUFFER_LVALUE->yy_n_chars = + (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_buf_size; + + if ( yy_cp < YY_CURRENT_BUFFER_LVALUE->yy_ch_buf + 2 ) + YY_FATAL_ERROR( "flex scanner push-back overflow" ); + } + + *--yy_cp = (char) c; + + (yytext_ptr) = yy_bp; + (yy_hold_char) = *yy_cp; + (yy_c_buf_p) = yy_cp; +} + +#ifndef YY_NO_INPUT +#ifdef __cplusplus + static int yyinput (void) +#else + static int input (void) +#endif + +{ + int c; + + *(yy_c_buf_p) = (yy_hold_char); + + if ( *(yy_c_buf_p) == YY_END_OF_BUFFER_CHAR ) + { + /* yy_c_buf_p now points to the character we want to return. + * If this occurs *before* the EOB characters, then it's a + * valid NUL; if not, then we've hit the end of the buffer. + */ + if ( (yy_c_buf_p) < &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] ) + /* This was really a NUL. */ + *(yy_c_buf_p) = '\0'; + + else + { /* need more input */ + int offset = (yy_c_buf_p) - (yytext_ptr); + ++(yy_c_buf_p); + + switch ( yy_get_next_buffer( ) ) + { + case EOB_ACT_LAST_MATCH: + /* This happens because yy_g_n_b() + * sees that we've accumulated a + * token and flags that we need to + * try matching the token before + * proceeding. But for input(), + * there's no matching to consider. + * So convert the EOB_ACT_LAST_MATCH + * to EOB_ACT_END_OF_FILE. + */ + + /* Reset buffer status. */ + zconfrestart(zconfin ); + + /*FALLTHROUGH*/ + + case EOB_ACT_END_OF_FILE: + { + if ( zconfwrap( ) ) + return EOF; + + if ( ! (yy_did_buffer_switch_on_eof) ) + YY_NEW_FILE; +#ifdef __cplusplus + return yyinput(); +#else + return input(); +#endif + } + + case EOB_ACT_CONTINUE_SCAN: + (yy_c_buf_p) = (yytext_ptr) + offset; + break; + } + } + } + + c = *(unsigned char *) (yy_c_buf_p); /* cast for 8-bit char's */ + *(yy_c_buf_p) = '\0'; /* preserve zconftext */ + (yy_hold_char) = *++(yy_c_buf_p); + + return c; +} +#endif /* ifndef YY_NO_INPUT */ + +/** Immediately switch to a different input stream. + * @param input_file A readable stream. + * + * @note This function does not reset the start condition to @c INITIAL . + */ + void zconfrestart (FILE * input_file ) +{ + + if ( ! YY_CURRENT_BUFFER ){ + zconfensure_buffer_stack (); + YY_CURRENT_BUFFER_LVALUE = + zconf_create_buffer(zconfin,YY_BUF_SIZE ); + } + + zconf_init_buffer(YY_CURRENT_BUFFER,input_file ); + zconf_load_buffer_state( ); +} + +/** Switch to a different input buffer. + * @param new_buffer The new input buffer. + * + */ + void zconf_switch_to_buffer (YY_BUFFER_STATE new_buffer ) +{ + + /* TODO. We should be able to replace this entire function body + * with + * zconfpop_buffer_state(); + * zconfpush_buffer_state(new_buffer); + */ + zconfensure_buffer_stack (); + if ( YY_CURRENT_BUFFER == new_buffer ) + return; + + if ( YY_CURRENT_BUFFER ) + { + /* Flush out information for old buffer. */ + *(yy_c_buf_p) = (yy_hold_char); + YY_CURRENT_BUFFER_LVALUE->yy_buf_pos = (yy_c_buf_p); + YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars); + } + + YY_CURRENT_BUFFER_LVALUE = new_buffer; + zconf_load_buffer_state( ); + + /* We don't actually know whether we did this switch during + * EOF (zconfwrap()) processing, but the only time this flag + * is looked at is after zconfwrap() is called, so it's safe + * to go ahead and always set it. + */ + (yy_did_buffer_switch_on_eof) = 1; +} + +static void zconf_load_buffer_state (void) +{ + (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_n_chars; + (yytext_ptr) = (yy_c_buf_p) = YY_CURRENT_BUFFER_LVALUE->yy_buf_pos; + zconfin = YY_CURRENT_BUFFER_LVALUE->yy_input_file; + (yy_hold_char) = *(yy_c_buf_p); +} + +/** Allocate and initialize an input buffer state. + * @param file A readable stream. + * @param size The character buffer size in bytes. When in doubt, use @c YY_BUF_SIZE. + * + * @return the allocated buffer state. + */ + YY_BUFFER_STATE zconf_create_buffer (FILE * file, int size ) +{ + YY_BUFFER_STATE b; + + b = (YY_BUFFER_STATE) zconfalloc(sizeof( struct yy_buffer_state ) ); + if ( ! b ) + YY_FATAL_ERROR( "out of dynamic memory in zconf_create_buffer()" ); + + b->yy_buf_size = size; + + /* yy_ch_buf has to be 2 characters longer than the size given because + * we need to put in 2 end-of-buffer characters. + */ + b->yy_ch_buf = (char *) zconfalloc(b->yy_buf_size + 2 ); + if ( ! b->yy_ch_buf ) + YY_FATAL_ERROR( "out of dynamic memory in zconf_create_buffer()" ); + + b->yy_is_our_buffer = 1; + + zconf_init_buffer(b,file ); + + return b; +} + +/** Destroy the buffer. + * @param b a buffer created with zconf_create_buffer() + * + */ + void zconf_delete_buffer (YY_BUFFER_STATE b ) +{ + + if ( ! b ) + return; + + if ( b == YY_CURRENT_BUFFER ) /* Not sure if we should pop here. */ + YY_CURRENT_BUFFER_LVALUE = (YY_BUFFER_STATE) 0; + + if ( b->yy_is_our_buffer ) + zconffree((void *) b->yy_ch_buf ); + + zconffree((void *) b ); +} + +/* Initializes or reinitializes a buffer. + * This function is sometimes called more than once on the same buffer, + * such as during a zconfrestart() or at EOF. + */ + static void zconf_init_buffer (YY_BUFFER_STATE b, FILE * file ) + +{ + int oerrno = errno; + + zconf_flush_buffer(b ); + + b->yy_input_file = file; + b->yy_fill_buffer = 1; + + /* If b is the current buffer, then zconf_init_buffer was _probably_ + * called from zconfrestart() or through yy_get_next_buffer. + * In that case, we don't want to reset the lineno or column. + */ + if (b != YY_CURRENT_BUFFER){ + b->yy_bs_lineno = 1; + b->yy_bs_column = 0; + } + + b->yy_is_interactive = 0; + + errno = oerrno; +} + +/** Discard all buffered characters. On the next scan, YY_INPUT will be called. + * @param b the buffer state to be flushed, usually @c YY_CURRENT_BUFFER. + * + */ + void zconf_flush_buffer (YY_BUFFER_STATE b ) +{ + if ( ! b ) + return; + + b->yy_n_chars = 0; + + /* We always need two end-of-buffer characters. The first causes + * a transition to the end-of-buffer state. The second causes + * a jam in that state. + */ + b->yy_ch_buf[0] = YY_END_OF_BUFFER_CHAR; + b->yy_ch_buf[1] = YY_END_OF_BUFFER_CHAR; + + b->yy_buf_pos = &b->yy_ch_buf[0]; + + b->yy_at_bol = 1; + b->yy_buffer_status = YY_BUFFER_NEW; + + if ( b == YY_CURRENT_BUFFER ) + zconf_load_buffer_state( ); +} + +/** Pushes the new state onto the stack. The new state becomes + * the current state. This function will allocate the stack + * if necessary. + * @param new_buffer The new state. + * + */ +void zconfpush_buffer_state (YY_BUFFER_STATE new_buffer ) +{ + if (new_buffer == NULL) + return; + + zconfensure_buffer_stack(); + + /* This block is copied from zconf_switch_to_buffer. */ + if ( YY_CURRENT_BUFFER ) + { + /* Flush out information for old buffer. */ + *(yy_c_buf_p) = (yy_hold_char); + YY_CURRENT_BUFFER_LVALUE->yy_buf_pos = (yy_c_buf_p); + YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars); + } + + /* Only push if top exists. Otherwise, replace top. */ + if (YY_CURRENT_BUFFER) + (yy_buffer_stack_top)++; + YY_CURRENT_BUFFER_LVALUE = new_buffer; + + /* copied from zconf_switch_to_buffer. */ + zconf_load_buffer_state( ); + (yy_did_buffer_switch_on_eof) = 1; +} + +/** Removes and deletes the top of the stack, if present. + * The next element becomes the new top. + * + */ +void zconfpop_buffer_state (void) +{ + if (!YY_CURRENT_BUFFER) + return; + + zconf_delete_buffer(YY_CURRENT_BUFFER ); + YY_CURRENT_BUFFER_LVALUE = NULL; + if ((yy_buffer_stack_top) > 0) + --(yy_buffer_stack_top); + + if (YY_CURRENT_BUFFER) { + zconf_load_buffer_state( ); + (yy_did_buffer_switch_on_eof) = 1; + } +} + +/* Allocates the stack if it does not exist. + * Guarantees space for at least one push. + */ +static void zconfensure_buffer_stack (void) +{ + int num_to_alloc; + + if (!(yy_buffer_stack)) { + + /* First allocation is just for 2 elements, since we don't know if this + * scanner will even need a stack. We use 2 instead of 1 to avoid an + * immediate realloc on the next call. + */ + num_to_alloc = 1; + (yy_buffer_stack) = (struct yy_buffer_state**)zconfalloc + (num_to_alloc * sizeof(struct yy_buffer_state*) + ); + + memset((yy_buffer_stack), 0, num_to_alloc * sizeof(struct yy_buffer_state*)); + + (yy_buffer_stack_max) = num_to_alloc; + (yy_buffer_stack_top) = 0; + return; + } + + if ((yy_buffer_stack_top) >= ((yy_buffer_stack_max)) - 1){ + + /* Increase the buffer to prepare for a possible push. */ + int grow_size = 8 /* arbitrary grow size */; + + num_to_alloc = (yy_buffer_stack_max) + grow_size; + (yy_buffer_stack) = (struct yy_buffer_state**)zconfrealloc + ((yy_buffer_stack), + num_to_alloc * sizeof(struct yy_buffer_state*) + ); + + /* zero only the new slots.*/ + memset((yy_buffer_stack) + (yy_buffer_stack_max), 0, grow_size * sizeof(struct yy_buffer_state*)); + (yy_buffer_stack_max) = num_to_alloc; + } +} + +/** Setup the input buffer state to scan directly from a user-specified character buffer. + * @param base the character buffer + * @param size the size in bytes of the character buffer + * + * @return the newly allocated buffer state object. + */ +YY_BUFFER_STATE zconf_scan_buffer (char * base, yy_size_t size ) +{ + YY_BUFFER_STATE b; + + if ( size < 2 || + base[size-2] != YY_END_OF_BUFFER_CHAR || + base[size-1] != YY_END_OF_BUFFER_CHAR ) + /* They forgot to leave room for the EOB's. */ + return 0; + + b = (YY_BUFFER_STATE) zconfalloc(sizeof( struct yy_buffer_state ) ); + if ( ! b ) + YY_FATAL_ERROR( "out of dynamic memory in zconf_scan_buffer()" ); + + b->yy_buf_size = size - 2; /* "- 2" to take care of EOB's */ + b->yy_buf_pos = b->yy_ch_buf = base; + b->yy_is_our_buffer = 0; + b->yy_input_file = 0; + b->yy_n_chars = b->yy_buf_size; + b->yy_is_interactive = 0; + b->yy_at_bol = 1; + b->yy_fill_buffer = 0; + b->yy_buffer_status = YY_BUFFER_NEW; + + zconf_switch_to_buffer(b ); + + return b; +} + +/** Setup the input buffer state to scan a string. The next call to zconflex() will + * scan from a @e copy of @a str. + * @param str a NUL-terminated string to scan + * + * @return the newly allocated buffer state object. + * @note If you want to scan bytes that may contain NUL values, then use + * zconf_scan_bytes() instead. + */ +YY_BUFFER_STATE zconf_scan_string (yyconst char * str ) +{ + + return zconf_scan_bytes(str,strlen(str) ); +} + +/** Setup the input buffer state to scan the given bytes. The next call to zconflex() will + * scan from a @e copy of @a bytes. + * @param bytes the byte buffer to scan + * @param len the number of bytes in the buffer pointed to by @a bytes. + * + * @return the newly allocated buffer state object. + */ +YY_BUFFER_STATE zconf_scan_bytes (yyconst char * bytes, int len ) +{ + YY_BUFFER_STATE b; + char *buf; + yy_size_t n; + int i; + + /* Get memory for full buffer, including space for trailing EOB's. */ + n = len + 2; + buf = (char *) zconfalloc(n ); + if ( ! buf ) + YY_FATAL_ERROR( "out of dynamic memory in zconf_scan_bytes()" ); + + for ( i = 0; i < len; ++i ) + buf[i] = bytes[i]; + + buf[len] = buf[len+1] = YY_END_OF_BUFFER_CHAR; + + b = zconf_scan_buffer(buf,n ); + if ( ! b ) + YY_FATAL_ERROR( "bad buffer in zconf_scan_bytes()" ); + + /* It's okay to grow etc. this buffer, and we should throw it + * away when we're done. + */ + b->yy_is_our_buffer = 1; + + return b; +} + +#ifndef YY_EXIT_FAILURE +#define YY_EXIT_FAILURE 2 +#endif + +static void yy_fatal_error (yyconst char* msg ) +{ + (void) fprintf( stderr, "%s\n", msg ); + exit( YY_EXIT_FAILURE ); +} + +/* Redefine yyless() so it works in section 3 code. */ + +#undef yyless +#define yyless(n) \ + do \ + { \ + /* Undo effects of setting up zconftext. */ \ + int yyless_macro_arg = (n); \ + YY_LESS_LINENO(yyless_macro_arg);\ + zconftext[zconfleng] = (yy_hold_char); \ + (yy_c_buf_p) = zconftext + yyless_macro_arg; \ + (yy_hold_char) = *(yy_c_buf_p); \ + *(yy_c_buf_p) = '\0'; \ + zconfleng = yyless_macro_arg; \ + } \ + while ( 0 ) + +/* Accessor methods (get/set functions) to struct members. */ + +/** Get the current line number. + * + */ +int zconfget_lineno (void) +{ + + return zconflineno; +} + +/** Get the input stream. + * + */ +FILE *zconfget_in (void) +{ + return zconfin; +} + +/** Get the output stream. + * + */ +FILE *zconfget_out (void) +{ + return zconfout; +} + +/** Get the length of the current token. + * + */ +int zconfget_leng (void) +{ + return zconfleng; +} + +/** Get the current token. + * + */ + +char *zconfget_text (void) +{ + return zconftext; +} + +/** Set the current line number. + * @param line_number + * + */ +void zconfset_lineno (int line_number ) +{ + + zconflineno = line_number; +} + +/** Set the input stream. This does not discard the current + * input buffer. + * @param in_str A readable stream. + * + * @see zconf_switch_to_buffer + */ +void zconfset_in (FILE * in_str ) +{ + zconfin = in_str ; +} + +void zconfset_out (FILE * out_str ) +{ + zconfout = out_str ; +} + +int zconfget_debug (void) +{ + return zconf_flex_debug; +} + +void zconfset_debug (int bdebug ) +{ + zconf_flex_debug = bdebug ; +} + +/* zconflex_destroy is for both reentrant and non-reentrant scanners. */ +int zconflex_destroy (void) +{ + + /* Pop the buffer stack, destroying each element. */ + while(YY_CURRENT_BUFFER){ + zconf_delete_buffer(YY_CURRENT_BUFFER ); + YY_CURRENT_BUFFER_LVALUE = NULL; + zconfpop_buffer_state(); + } + + /* Destroy the stack itself. */ + zconffree((yy_buffer_stack) ); + (yy_buffer_stack) = NULL; + + return 0; +} + +/* + * Internal utility routines. + */ + +#ifndef yytext_ptr +static void yy_flex_strncpy (char* s1, yyconst char * s2, int n ) +{ + register int i; + for ( i = 0; i < n; ++i ) + s1[i] = s2[i]; +} +#endif + +#ifdef YY_NEED_STRLEN +static int yy_flex_strlen (yyconst char * s ) +{ + register int n; + for ( n = 0; s[n]; ++n ) + ; + + return n; +} +#endif + +void *zconfalloc (yy_size_t size ) +{ + return (void *) malloc( size ); +} + +void *zconfrealloc (void * ptr, yy_size_t size ) +{ + /* The cast to (char *) in the following accommodates both + * implementations that use char* generic pointers, and those + * that use void* generic pointers. It works with the latter + * because both ANSI C and C++ allow castless assignment from + * any pointer type to void*, and deal with argument conversions + * as though doing an assignment. + */ + return (void *) realloc( (char *) ptr, size ); +} + +void zconffree (void * ptr ) +{ + free( (char *) ptr ); /* see zconfrealloc() for (char *) cast */ +} + +#define YYTABLES_NAME "yytables" + +#undef YY_NEW_FILE +#undef YY_FLUSH_BUFFER +#undef yy_set_bol +#undef yy_new_buffer +#undef yy_set_interactive +#undef yytext_ptr +#undef YY_DO_BEFORE_ACTION + +#ifdef YY_DECL_IS_OURS +#undef YY_DECL_IS_OURS +#undef YY_DECL +#endif + +void zconf_starthelp(void) +{ + new_string(); + last_ts = first_ts = 0; + BEGIN(HELP); +} + +static void zconf_endhelp(void) +{ + zconflval.string = text; + BEGIN(INITIAL); +} + +/* + * Try to open specified file with following names: + * ./name + * $(srctree)/name + * The latter is used when srctree is separate from objtree + * when compiling the kernel. + * Return NULL if file is not found. + */ +FILE *zconf_fopen(const char *name) +{ + char *env, fullname[PATH_MAX+1]; + FILE *f; + + f = fopen(name, "r"); + if (!f && name[0] != '/') { + env = getenv(SRCTREE); + if (env) { + sprintf(fullname, "%s/%s", env, name); + f = fopen(fullname, "r"); + } + } + return f; +} + +void zconf_initscan(const char *name) +{ + zconfin = zconf_fopen(name); + if (!zconfin) { + printf("can't find file %s\n", name); + exit(1); + } + + current_buf = malloc(sizeof(*current_buf)); + memset(current_buf, 0, sizeof(*current_buf)); + + current_file = file_lookup(name); + current_file->lineno = 1; + current_file->flags = FILE_BUSY; +} + +void zconf_nextfile(const char *name) +{ + struct file *file = file_lookup(name); + struct buffer *buf = malloc(sizeof(*buf)); + memset(buf, 0, sizeof(*buf)); + + current_buf->state = YY_CURRENT_BUFFER; + zconfin = zconf_fopen(name); + if (!zconfin) { + printf("%s:%d: can't open file \"%s\"\n", zconf_curname(), zconf_lineno(), name); + exit(1); + } + zconf_switch_to_buffer(zconf_create_buffer(zconfin,YY_BUF_SIZE)); + buf->parent = current_buf; + current_buf = buf; + + if (file->flags & FILE_BUSY) { + printf("recursive scan (%s)?\n", name); + exit(1); + } + if (file->flags & FILE_SCANNED) { + printf("file %s already scanned?\n", name); + exit(1); + } + file->flags |= FILE_BUSY; + file->lineno = 1; + file->parent = current_file; + current_file = file; +} + +static struct buffer *zconf_endfile(void) +{ + struct buffer *parent; + + current_file->flags |= FILE_SCANNED; + current_file->flags &= ~FILE_BUSY; + current_file = current_file->parent; + + parent = current_buf->parent; + if (parent) { + fclose(zconfin); + zconf_delete_buffer(YY_CURRENT_BUFFER); + zconf_switch_to_buffer(parent->state); + } + free(current_buf); + current_buf = parent; + + return parent; +} + +int zconf_lineno(void) +{ + if (current_buf) + return current_file->lineno - 1; + else + return 0; +} + +char *zconf_curname(void) +{ + if (current_buf) + return current_file->name; + else + return ""; +} + diff --git a/config/scripts/config/lex.zconf.c_shipped b/config/scripts/config/lex.zconf.c_shipped new file mode 100644 index 0000000000..b877bb6b3c --- /dev/null +++ b/config/scripts/config/lex.zconf.c_shipped @@ -0,0 +1,3688 @@ + +#line 3 "lex.zconf.c" + +#define YY_INT_ALIGNED short int + +/* A lexical scanner generated by flex */ + +#define FLEX_SCANNER +#define YY_FLEX_MAJOR_VERSION 2 +#define YY_FLEX_MINOR_VERSION 5 +#define YY_FLEX_SUBMINOR_VERSION 31 +#if YY_FLEX_SUBMINOR_VERSION > 0 +#define FLEX_BETA +#endif + +/* First, we deal with platform-specific or compiler-specific issues. */ + +/* begin standard C headers. */ +#include +#include +#include +#include + +/* end standard C headers. */ + +/* flex integer type definitions */ + +#ifndef FLEXINT_H +#define FLEXINT_H + +/* C99 systems have . Non-C99 systems may or may not. */ + +#if defined __STDC_VERSION__ && __STDC_VERSION__ >= 199901L +#include +typedef int8_t flex_int8_t; +typedef uint8_t flex_uint8_t; +typedef int16_t flex_int16_t; +typedef uint16_t flex_uint16_t; +typedef int32_t flex_int32_t; +typedef uint32_t flex_uint32_t; +#else +typedef signed char flex_int8_t; +typedef short int flex_int16_t; +typedef int flex_int32_t; +typedef unsigned char flex_uint8_t; +typedef unsigned short int flex_uint16_t; +typedef unsigned int flex_uint32_t; +#endif /* ! C99 */ + +/* Limits of integral types. */ +#ifndef INT8_MIN +#define INT8_MIN (-128) +#endif +#ifndef INT16_MIN +#define INT16_MIN (-32767-1) +#endif +#ifndef INT32_MIN +#define INT32_MIN (-2147483647-1) +#endif +#ifndef INT8_MAX +#define INT8_MAX (127) +#endif +#ifndef INT16_MAX +#define INT16_MAX (32767) +#endif +#ifndef INT32_MAX +#define INT32_MAX (2147483647) +#endif +#ifndef UINT8_MAX +#define UINT8_MAX (255U) +#endif +#ifndef UINT16_MAX +#define UINT16_MAX (65535U) +#endif +#ifndef UINT32_MAX +#define UINT32_MAX (4294967295U) +#endif + +#endif /* ! FLEXINT_H */ + +#ifdef __cplusplus + +/* The "const" storage-class-modifier is valid. */ +#define YY_USE_CONST + +#else /* ! __cplusplus */ + +#if __STDC__ + +#define YY_USE_CONST + +#endif /* __STDC__ */ +#endif /* ! __cplusplus */ + +#ifdef YY_USE_CONST +#define yyconst const +#else +#define yyconst +#endif + +/* Returned upon end-of-file. */ +#define YY_NULL 0 + +/* Promotes a possibly negative, possibly signed char to an unsigned + * integer for use as an array index. If the signed char is negative, + * we want to instead treat it as an 8-bit unsigned char, hence the + * double cast. + */ +#define YY_SC_TO_UI(c) ((unsigned int) (unsigned char) c) + +/* Enter a start condition. This macro really ought to take a parameter, + * but we do it the disgusting crufty way forced on us by the ()-less + * definition of BEGIN. + */ +#define BEGIN (yy_start) = 1 + 2 * + +/* Translate the current start state into a value that can be later handed + * to BEGIN to return to the state. The YYSTATE alias is for lex + * compatibility. + */ +#define YY_START (((yy_start) - 1) / 2) +#define YYSTATE YY_START + +/* Action number for EOF rule of a given start state. */ +#define YY_STATE_EOF(state) (YY_END_OF_BUFFER + state + 1) + +/* Special action meaning "start processing a new file". */ +#define YY_NEW_FILE zconfrestart(zconfin ) + +#define YY_END_OF_BUFFER_CHAR 0 + +/* Size of default input buffer. */ +#ifndef YY_BUF_SIZE +#define YY_BUF_SIZE 16384 +#endif + +#ifndef YY_TYPEDEF_YY_BUFFER_STATE +#define YY_TYPEDEF_YY_BUFFER_STATE +typedef struct yy_buffer_state *YY_BUFFER_STATE; +#endif + +extern int zconfleng; + +extern FILE *zconfin, *zconfout; + +#define EOB_ACT_CONTINUE_SCAN 0 +#define EOB_ACT_END_OF_FILE 1 +#define EOB_ACT_LAST_MATCH 2 + + #define YY_LESS_LINENO(n) + +/* Return all but the first "n" matched characters back to the input stream. */ +#define yyless(n) \ + do \ + { \ + /* Undo effects of setting up zconftext. */ \ + int yyless_macro_arg = (n); \ + YY_LESS_LINENO(yyless_macro_arg);\ + *yy_cp = (yy_hold_char); \ + YY_RESTORE_YY_MORE_OFFSET \ + (yy_c_buf_p) = yy_cp = yy_bp + yyless_macro_arg - YY_MORE_ADJ; \ + YY_DO_BEFORE_ACTION; /* set up zconftext again */ \ + } \ + while ( 0 ) + +#define unput(c) yyunput( c, (yytext_ptr) ) + +/* The following is because we cannot portably get our hands on size_t + * (without autoconf's help, which isn't available because we want + * flex-generated scanners to compile on their own). + */ + +#ifndef YY_TYPEDEF_YY_SIZE_T +#define YY_TYPEDEF_YY_SIZE_T +typedef unsigned int yy_size_t; +#endif + +#ifndef YY_STRUCT_YY_BUFFER_STATE +#define YY_STRUCT_YY_BUFFER_STATE +struct yy_buffer_state + { + FILE *yy_input_file; + + char *yy_ch_buf; /* input buffer */ + char *yy_buf_pos; /* current position in input buffer */ + + /* Size of input buffer in bytes, not including room for EOB + * characters. + */ + yy_size_t yy_buf_size; + + /* Number of characters read into yy_ch_buf, not including EOB + * characters. + */ + int yy_n_chars; + + /* Whether we "own" the buffer - i.e., we know we created it, + * and can realloc() it to grow it, and should free() it to + * delete it. + */ + int yy_is_our_buffer; + + /* Whether this is an "interactive" input source; if so, and + * if we're using stdio for input, then we want to use getc() + * instead of fread(), to make sure we stop fetching input after + * each newline. + */ + int yy_is_interactive; + + /* Whether we're considered to be at the beginning of a line. + * If so, '^' rules will be active on the next match, otherwise + * not. + */ + int yy_at_bol; + + int yy_bs_lineno; /**< The line count. */ + int yy_bs_column; /**< The column count. */ + + /* Whether to try to fill the input buffer when we reach the + * end of it. + */ + int yy_fill_buffer; + + int yy_buffer_status; + +#define YY_BUFFER_NEW 0 +#define YY_BUFFER_NORMAL 1 + /* When an EOF's been seen but there's still some text to process + * then we mark the buffer as YY_EOF_PENDING, to indicate that we + * shouldn't try reading from the input source any more. We might + * still have a bunch of tokens to match, though, because of + * possible backing-up. + * + * When we actually see the EOF, we change the status to "new" + * (via zconfrestart()), so that the user can continue scanning by + * just pointing zconfin at a new input file. + */ +#define YY_BUFFER_EOF_PENDING 2 + + }; +#endif /* !YY_STRUCT_YY_BUFFER_STATE */ + +/* Stack of input buffers. */ +static size_t yy_buffer_stack_top = 0; /**< index of top of stack. */ +static size_t yy_buffer_stack_max = 0; /**< capacity of stack. */ +static YY_BUFFER_STATE * yy_buffer_stack = 0; /**< Stack as an array. */ + +/* We provide macros for accessing buffer states in case in the + * future we want to put the buffer states in a more general + * "scanner state". + * + * Returns the top of the stack, or NULL. + */ +#define YY_CURRENT_BUFFER ( (yy_buffer_stack) \ + ? (yy_buffer_stack)[(yy_buffer_stack_top)] \ + : NULL) + +/* Same as previous macro, but useful when we know that the buffer stack is not + * NULL or when we need an lvalue. For internal use only. + */ +#define YY_CURRENT_BUFFER_LVALUE (yy_buffer_stack)[(yy_buffer_stack_top)] + +/* yy_hold_char holds the character lost when zconftext is formed. */ +static char yy_hold_char; +static int yy_n_chars; /* number of characters read into yy_ch_buf */ +int zconfleng; + +/* Points to current character in buffer. */ +static char *yy_c_buf_p = (char *) 0; +static int yy_init = 1; /* whether we need to initialize */ +static int yy_start = 0; /* start state number */ + +/* Flag which is used to allow zconfwrap()'s to do buffer switches + * instead of setting up a fresh zconfin. A bit of a hack ... + */ +static int yy_did_buffer_switch_on_eof; + +void zconfrestart (FILE *input_file ); +void zconf_switch_to_buffer (YY_BUFFER_STATE new_buffer ); +YY_BUFFER_STATE zconf_create_buffer (FILE *file,int size ); +void zconf_delete_buffer (YY_BUFFER_STATE b ); +void zconf_flush_buffer (YY_BUFFER_STATE b ); +void zconfpush_buffer_state (YY_BUFFER_STATE new_buffer ); +void zconfpop_buffer_state (void ); + +static void zconfensure_buffer_stack (void ); +static void zconf_load_buffer_state (void ); +static void zconf_init_buffer (YY_BUFFER_STATE b,FILE *file ); + +#define YY_FLUSH_BUFFER zconf_flush_buffer(YY_CURRENT_BUFFER ) + +YY_BUFFER_STATE zconf_scan_buffer (char *base,yy_size_t size ); +YY_BUFFER_STATE zconf_scan_string (yyconst char *yy_str ); +YY_BUFFER_STATE zconf_scan_bytes (yyconst char *bytes,int len ); + +void *zconfalloc (yy_size_t ); +void *zconfrealloc (void *,yy_size_t ); +void zconffree (void * ); + +#define yy_new_buffer zconf_create_buffer + +#define yy_set_interactive(is_interactive) \ + { \ + if ( ! YY_CURRENT_BUFFER ){ \ + zconfensure_buffer_stack (); \ + YY_CURRENT_BUFFER_LVALUE = \ + zconf_create_buffer(zconfin,YY_BUF_SIZE ); \ + } \ + YY_CURRENT_BUFFER_LVALUE->yy_is_interactive = is_interactive; \ + } + +#define yy_set_bol(at_bol) \ + { \ + if ( ! YY_CURRENT_BUFFER ){\ + zconfensure_buffer_stack (); \ + YY_CURRENT_BUFFER_LVALUE = \ + zconf_create_buffer(zconfin,YY_BUF_SIZE ); \ + } \ + YY_CURRENT_BUFFER_LVALUE->yy_at_bol = at_bol; \ + } + +#define YY_AT_BOL() (YY_CURRENT_BUFFER_LVALUE->yy_at_bol) + +/* Begin user sect3 */ + +#define zconfwrap(n) 1 +#define YY_SKIP_YYWRAP + +typedef unsigned char YY_CHAR; + +FILE *zconfin = (FILE *) 0, *zconfout = (FILE *) 0; + +typedef int yy_state_type; + +extern int zconflineno; + +int zconflineno = 1; + +extern char *zconftext; +#define yytext_ptr zconftext +static yyconst flex_int16_t yy_nxt[][38] = + { + { + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0 + }, + + { + 11, 12, 13, 14, 12, 12, 15, 12, 12, 12, + 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, + 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, + 12, 12, 12, 12, 12, 12, 12, 12 + }, + + { + 11, 12, 13, 14, 12, 12, 15, 12, 12, 12, + 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, + + 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, + 12, 12, 12, 12, 12, 12, 12, 12 + }, + + { + 11, 16, 16, 17, 16, 16, 16, 16, 16, 16, + 16, 16, 16, 18, 16, 16, 18, 18, 19, 20, + 21, 22, 18, 18, 23, 24, 18, 25, 18, 26, + 27, 18, 28, 29, 30, 18, 18, 16 + }, + + { + 11, 16, 16, 17, 16, 16, 16, 16, 16, 16, + 16, 16, 16, 18, 16, 16, 18, 18, 19, 20, + 21, 22, 18, 18, 23, 24, 18, 25, 18, 26, + 27, 18, 28, 29, 30, 18, 18, 16 + + }, + + { + 11, 31, 32, 33, 31, 31, 31, 31, 31, 31, + 31, 31, 31, 31, 31, 31, 31, 31, 31, 31, + 31, 31, 31, 31, 31, 31, 31, 31, 31, 31, + 31, 31, 31, 31, 31, 31, 31, 31 + }, + + { + 11, 31, 32, 33, 31, 31, 31, 31, 31, 31, + 31, 31, 31, 31, 31, 31, 31, 31, 31, 31, + 31, 31, 31, 31, 31, 31, 31, 31, 31, 31, + 31, 31, 31, 31, 31, 31, 31, 31 + }, + + { + 11, 34, 34, 35, 34, 36, 34, 34, 36, 34, + 34, 34, 34, 34, 34, 37, 34, 34, 34, 34, + + 34, 34, 34, 34, 34, 34, 34, 34, 34, 34, + 34, 34, 34, 34, 34, 34, 34, 34 + }, + + { + 11, 34, 34, 35, 34, 36, 34, 34, 36, 34, + 34, 34, 34, 34, 34, 37, 34, 34, 34, 34, + 34, 34, 34, 34, 34, 34, 34, 34, 34, 34, + 34, 34, 34, 34, 34, 34, 34, 34 + }, + + { + 11, 38, 38, 39, 40, 41, 42, 43, 41, 44, + 45, 46, 47, 47, 48, 49, 47, 47, 47, 47, + 47, 47, 47, 47, 47, 50, 47, 47, 47, 51, + 47, 47, 47, 47, 47, 47, 47, 52 + + }, + + { + 11, 38, 38, 39, 40, 41, 42, 43, 41, 44, + 45, 46, 47, 47, 48, 49, 47, 47, 47, 47, + 47, 47, 47, 47, 47, 50, 47, 47, 47, 51, + 47, 47, 47, 47, 47, 47, 47, 52 + }, + + { + -11, -11, -11, -11, -11, -11, -11, -11, -11, -11, + -11, -11, -11, -11, -11, -11, -11, -11, -11, -11, + -11, -11, -11, -11, -11, -11, -11, -11, -11, -11, + -11, -11, -11, -11, -11, -11, -11, -11 + }, + + { + 11, -12, -12, -12, -12, -12, -12, -12, -12, -12, + -12, -12, -12, -12, -12, -12, -12, -12, -12, -12, + + -12, -12, -12, -12, -12, -12, -12, -12, -12, -12, + -12, -12, -12, -12, -12, -12, -12, -12 + }, + + { + 11, -13, 53, 54, -13, -13, 55, -13, -13, -13, + -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, + -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, + -13, -13, -13, -13, -13, -13, -13, -13 + }, + + { + 11, -14, -14, -14, -14, -14, -14, -14, -14, -14, + -14, -14, -14, -14, -14, -14, -14, -14, -14, -14, + -14, -14, -14, -14, -14, -14, -14, -14, -14, -14, + -14, -14, -14, -14, -14, -14, -14, -14 + + }, + + { + 11, 56, 56, 57, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56 + }, + + { + 11, -16, -16, -16, -16, -16, -16, -16, -16, -16, + -16, -16, -16, -16, -16, -16, -16, -16, -16, -16, + -16, -16, -16, -16, -16, -16, -16, -16, -16, -16, + -16, -16, -16, -16, -16, -16, -16, -16 + }, + + { + 11, -17, -17, -17, -17, -17, -17, -17, -17, -17, + -17, -17, -17, -17, -17, -17, -17, -17, -17, -17, + + -17, -17, -17, -17, -17, -17, -17, -17, -17, -17, + -17, -17, -17, -17, -17, -17, -17, -17 + }, + + { + 11, -18, -18, -18, -18, -18, -18, -18, -18, -18, + -18, -18, -18, 58, -18, -18, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -18 + }, + + { + 11, -19, -19, -19, -19, -19, -19, -19, -19, -19, + -19, -19, -19, 58, -19, -19, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 59, + 58, 58, 58, 58, 58, 58, 58, -19 + + }, + + { + 11, -20, -20, -20, -20, -20, -20, -20, -20, -20, + -20, -20, -20, 58, -20, -20, 58, 58, 58, 58, + 58, 58, 58, 58, 60, 58, 58, 58, 58, 61, + 58, 58, 58, 58, 58, 58, 58, -20 + }, + + { + 11, -21, -21, -21, -21, -21, -21, -21, -21, -21, + -21, -21, -21, 58, -21, -21, 58, 58, 58, 58, + 58, 62, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -21 + }, + + { + 11, -22, -22, -22, -22, -22, -22, -22, -22, -22, + -22, -22, -22, 58, -22, -22, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 63, 58, + 58, 58, 58, 58, 58, 58, 58, -22 + }, + + { + 11, -23, -23, -23, -23, -23, -23, -23, -23, -23, + -23, -23, -23, 58, -23, -23, 58, 58, 58, 58, + 58, 64, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -23 + }, + + { + 11, -24, -24, -24, -24, -24, -24, -24, -24, -24, + -24, -24, -24, 58, -24, -24, 58, 58, 58, 58, + 58, 58, 65, 58, 58, 58, 58, 58, 66, 58, + 58, 58, 58, 58, 58, 58, 58, -24 + + }, + + { + 11, -25, -25, -25, -25, -25, -25, -25, -25, -25, + -25, -25, -25, 58, -25, -25, 58, 67, 58, 58, + 58, 68, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -25 + }, + + { + 11, -26, -26, -26, -26, -26, -26, -26, -26, -26, + -26, -26, -26, 58, -26, -26, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 69, 58, 58, 58, 58, 58, 58, -26 + }, + + { + 11, -27, -27, -27, -27, -27, -27, -27, -27, -27, + -27, -27, -27, 58, -27, -27, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 70, 58, 58, 58, 58, -27 + }, + + { + 11, -28, -28, -28, -28, -28, -28, -28, -28, -28, + -28, -28, -28, 58, -28, -28, 58, 71, 58, 58, + 58, 72, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -28 + }, + + { + 11, -29, -29, -29, -29, -29, -29, -29, -29, -29, + -29, -29, -29, 58, -29, -29, 58, 58, 58, 58, + 58, 73, 58, 58, 58, 58, 58, 58, 58, 74, + 58, 58, 58, 58, 75, 58, 58, -29 + + }, + + { + 11, -30, -30, -30, -30, -30, -30, -30, -30, -30, + -30, -30, -30, 58, -30, -30, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 76, 58, 58, 58, 58, -30 + }, + + { + 11, 77, 77, -31, 77, 77, 77, 77, 77, 77, + 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, + 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, + 77, 77, 77, 77, 77, 77, 77, 77 + }, + + { + 11, -32, 78, 79, -32, -32, -32, -32, -32, -32, + -32, -32, -32, -32, -32, -32, -32, -32, -32, -32, + + -32, -32, -32, -32, -32, -32, -32, -32, -32, -32, + -32, -32, -32, -32, -32, -32, -32, -32 + }, + + { + 11, 80, -33, -33, 80, 80, 80, 80, 80, 80, + 80, 80, 80, 80, 80, 80, 80, 80, 80, 80, + 80, 80, 80, 80, 80, 80, 80, 80, 80, 80, + 80, 80, 80, 80, 80, 80, 80, 80 + }, + + { + 11, 81, 81, 82, 81, -34, 81, 81, -34, 81, + 81, 81, 81, 81, 81, -34, 81, 81, 81, 81, + 81, 81, 81, 81, 81, 81, 81, 81, 81, 81, + 81, 81, 81, 81, 81, 81, 81, 81 + + }, + + { + 11, -35, -35, -35, -35, -35, -35, -35, -35, -35, + -35, -35, -35, -35, -35, -35, -35, -35, -35, -35, + -35, -35, -35, -35, -35, -35, -35, -35, -35, -35, + -35, -35, -35, -35, -35, -35, -35, -35 + }, + + { + 11, -36, -36, -36, -36, -36, -36, -36, -36, -36, + -36, -36, -36, -36, -36, -36, -36, -36, -36, -36, + -36, -36, -36, -36, -36, -36, -36, -36, -36, -36, + -36, -36, -36, -36, -36, -36, -36, -36 + }, + + { + 11, 83, 83, 84, 83, 83, 83, 83, 83, 83, + 83, 83, 83, 83, 83, 83, 83, 83, 83, 83, + + 83, 83, 83, 83, 83, 83, 83, 83, 83, 83, + 83, 83, 83, 83, 83, 83, 83, 83 + }, + + { + 11, -38, -38, -38, -38, -38, -38, -38, -38, -38, + -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, + -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, + -38, -38, -38, -38, -38, -38, -38, -38 + }, + + { + 11, -39, -39, -39, -39, -39, -39, -39, -39, -39, + -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, + -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, + -39, -39, -39, -39, -39, -39, -39, -39 + + }, + + { + 11, -40, -40, -40, -40, -40, -40, -40, -40, -40, + -40, -40, -40, -40, 85, -40, -40, -40, -40, -40, + -40, -40, -40, -40, -40, -40, -40, -40, -40, -40, + -40, -40, -40, -40, -40, -40, -40, -40 + }, + + { + 11, -41, -41, -41, -41, -41, -41, -41, -41, -41, + -41, -41, -41, -41, -41, -41, -41, -41, -41, -41, + -41, -41, -41, -41, -41, -41, -41, -41, -41, -41, + -41, -41, -41, -41, -41, -41, -41, -41 + }, + + { + 11, 86, 86, -42, 86, 86, 86, 86, 86, 86, + 86, 86, 86, 86, 86, 86, 86, 86, 86, 86, + + 86, 86, 86, 86, 86, 86, 86, 86, 86, 86, + 86, 86, 86, 86, 86, 86, 86, 86 + }, + + { + 11, -43, -43, -43, -43, -43, -43, 87, -43, -43, + -43, -43, -43, -43, -43, -43, -43, -43, -43, -43, + -43, -43, -43, -43, -43, -43, -43, -43, -43, -43, + -43, -43, -43, -43, -43, -43, -43, -43 + }, + + { + 11, -44, -44, -44, -44, -44, -44, -44, -44, -44, + -44, -44, -44, -44, -44, -44, -44, -44, -44, -44, + -44, -44, -44, -44, -44, -44, -44, -44, -44, -44, + -44, -44, -44, -44, -44, -44, -44, -44 + + }, + + { + 11, -45, -45, -45, -45, -45, -45, -45, -45, -45, + -45, -45, -45, -45, -45, -45, -45, -45, -45, -45, + -45, -45, -45, -45, -45, -45, -45, -45, -45, -45, + -45, -45, -45, -45, -45, -45, -45, -45 + }, + + { + 11, -46, -46, -46, -46, -46, -46, -46, -46, -46, + -46, 88, 89, 89, -46, -46, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, -46 + }, + + { + 11, -47, -47, -47, -47, -47, -47, -47, -47, -47, + -47, 89, 89, 89, -47, -47, 89, 89, 89, 89, + + 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, -47 + }, + + { + 11, -48, -48, -48, -48, -48, -48, -48, -48, -48, + -48, -48, -48, -48, -48, -48, -48, -48, -48, -48, + -48, -48, -48, -48, -48, -48, -48, -48, -48, -48, + -48, -48, -48, -48, -48, -48, -48, -48 + }, + + { + 11, -49, -49, 90, -49, -49, -49, -49, -49, -49, + -49, -49, -49, -49, -49, -49, -49, -49, -49, -49, + -49, -49, -49, -49, -49, -49, -49, -49, -49, -49, + -49, -49, -49, -49, -49, -49, -49, -49 + + }, + + { + 11, -50, -50, -50, -50, -50, -50, -50, -50, -50, + -50, 89, 89, 89, -50, -50, 89, 89, 89, 89, + 89, 89, 91, 89, 89, 89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, -50 + }, + + { + 11, -51, -51, -51, -51, -51, -51, -51, -51, -51, + -51, 89, 89, 89, -51, -51, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, 89, 92, 89, + 89, 89, 89, 89, 89, 89, 89, -51 + }, + + { + 11, -52, -52, -52, -52, -52, -52, -52, -52, -52, + -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, + + -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, + -52, -52, -52, -52, -52, -52, -52, 93 + }, + + { + 11, -53, 53, 54, -53, -53, 55, -53, -53, -53, + -53, -53, -53, -53, -53, -53, -53, -53, -53, -53, + -53, -53, -53, -53, -53, -53, -53, -53, -53, -53, + -53, -53, -53, -53, -53, -53, -53, -53 + }, + + { + 11, -54, -54, -54, -54, -54, -54, -54, -54, -54, + -54, -54, -54, -54, -54, -54, -54, -54, -54, -54, + -54, -54, -54, -54, -54, -54, -54, -54, -54, -54, + -54, -54, -54, -54, -54, -54, -54, -54 + + }, + + { + 11, 56, 56, 57, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56 + }, + + { + 11, 56, 56, 57, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56, 56, 56, + 56, 56, 56, 56, 56, 56, 56, 56 + }, + + { + 11, -57, -57, -57, -57, -57, -57, -57, -57, -57, + -57, -57, -57, -57, -57, -57, -57, -57, -57, -57, + + -57, -57, -57, -57, -57, -57, -57, -57, -57, -57, + -57, -57, -57, -57, -57, -57, -57, -57 + }, + + { + 11, -58, -58, -58, -58, -58, -58, -58, -58, -58, + -58, -58, -58, 58, -58, -58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -58 + }, + + { + 11, -59, -59, -59, -59, -59, -59, -59, -59, -59, + -59, -59, -59, 58, -59, -59, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 94, + 58, 58, 58, 58, 58, 58, 58, -59 + + }, + + { + 11, -60, -60, -60, -60, -60, -60, -60, -60, -60, + -60, -60, -60, 58, -60, -60, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 95, + 58, 58, 58, 58, 58, 58, 58, -60 + }, + + { + 11, -61, -61, -61, -61, -61, -61, -61, -61, -61, + -61, -61, -61, 58, -61, -61, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 96, 97, 58, + 58, 58, 58, 58, 58, 58, 58, -61 + }, + + { + 11, -62, -62, -62, -62, -62, -62, -62, -62, -62, + -62, -62, -62, 58, -62, -62, 58, 58, 58, 58, + + 58, 58, 98, 58, 58, 58, 58, 58, 58, 58, + 99, 58, 58, 58, 58, 58, 58, -62 + }, + + { + 11, -63, -63, -63, -63, -63, -63, -63, -63, -63, + -63, -63, -63, 58, -63, -63, 58, 100, 58, 58, + 101, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -63 + }, + + { + 11, -64, -64, -64, -64, -64, -64, -64, -64, -64, + -64, -64, -64, 58, -64, -64, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 102, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 103, -64 + + }, + + { + 11, -65, -65, -65, -65, -65, -65, -65, -65, -65, + -65, -65, -65, 58, -65, -65, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -65 + }, + + { + 11, -66, -66, -66, -66, -66, -66, -66, -66, -66, + -66, -66, -66, 58, -66, -66, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 104, 58, 58, -66 + }, + + { + 11, -67, -67, -67, -67, -67, -67, -67, -67, -67, + -67, -67, -67, 58, -67, -67, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 105, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -67 + }, + + { + 11, -68, -68, -68, -68, -68, -68, -68, -68, -68, + -68, -68, -68, 58, -68, -68, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 106, 58, + 58, 58, 58, 58, 58, 58, 58, -68 + }, + + { + 11, -69, -69, -69, -69, -69, -69, -69, -69, -69, + -69, -69, -69, 58, -69, -69, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 107, 58, 58, -69 + + }, + + { + 11, -70, -70, -70, -70, -70, -70, -70, -70, -70, + -70, -70, -70, 58, -70, -70, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 108, + 58, 58, 58, 58, 58, 58, 58, -70 + }, + + { + 11, -71, -71, -71, -71, -71, -71, -71, -71, -71, + -71, -71, -71, 58, -71, -71, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 109, 58, + 58, 58, 58, 58, 58, 58, 58, -71 + }, + + { + 11, -72, -72, -72, -72, -72, -72, -72, -72, -72, + -72, -72, -72, 58, -72, -72, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 110, 58, 58, 58, 58, 58, -72 + }, + + { + 11, -73, -73, -73, -73, -73, -73, -73, -73, -73, + -73, -73, -73, 58, -73, -73, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 111, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -73 + }, + + { + 11, -74, -74, -74, -74, -74, -74, -74, -74, -74, + -74, -74, -74, 58, -74, -74, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 112, 58, -74 + + }, + + { + 11, -75, -75, -75, -75, -75, -75, -75, -75, -75, + -75, -75, -75, 58, -75, -75, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 113, 58, 58, 58, 58, -75 + }, + + { + 11, -76, -76, -76, -76, -76, -76, -76, -76, -76, + -76, -76, -76, 58, -76, -76, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 114, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -76 + }, + + { + 11, 77, 77, -77, 77, 77, 77, 77, 77, 77, + 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, + + 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, + 77, 77, 77, 77, 77, 77, 77, 77 + }, + + { + 11, -78, 78, 79, -78, -78, -78, -78, -78, -78, + -78, -78, -78, -78, -78, -78, -78, -78, -78, -78, + -78, -78, -78, -78, -78, -78, -78, -78, -78, -78, + -78, -78, -78, -78, -78, -78, -78, -78 + }, + + { + 11, 80, -79, -79, 80, 80, 80, 80, 80, 80, + 80, 80, 80, 80, 80, 80, 80, 80, 80, 80, + 80, 80, 80, 80, 80, 80, 80, 80, 80, 80, + 80, 80, 80, 80, 80, 80, 80, 80 + + }, + + { + 11, -80, -80, -80, -80, -80, -80, -80, -80, -80, + -80, -80, -80, -80, -80, -80, -80, -80, -80, -80, + -80, -80, -80, -80, -80, -80, -80, -80, -80, -80, + -80, -80, -80, -80, -80, -80, -80, -80 + }, + + { + 11, 81, 81, 82, 81, -81, 81, 81, -81, 81, + 81, 81, 81, 81, 81, -81, 81, 81, 81, 81, + 81, 81, 81, 81, 81, 81, 81, 81, 81, 81, + 81, 81, 81, 81, 81, 81, 81, 81 + }, + + { + 11, -82, -82, -82, -82, -82, -82, -82, -82, -82, + -82, -82, -82, -82, -82, -82, -82, -82, -82, -82, + + -82, -82, -82, -82, -82, -82, -82, -82, -82, -82, + -82, -82, -82, -82, -82, -82, -82, -82 + }, + + { + 11, -83, -83, 84, -83, -83, -83, -83, -83, -83, + -83, -83, -83, -83, -83, -83, -83, -83, -83, -83, + -83, -83, -83, -83, -83, -83, -83, -83, -83, -83, + -83, -83, -83, -83, -83, -83, -83, -83 + }, + + { + 11, -84, -84, -84, -84, -84, -84, -84, -84, -84, + -84, -84, -84, -84, -84, -84, -84, -84, -84, -84, + -84, -84, -84, -84, -84, -84, -84, -84, -84, -84, + -84, -84, -84, -84, -84, -84, -84, -84 + + }, + + { + 11, -85, -85, -85, -85, -85, -85, -85, -85, -85, + -85, -85, -85, -85, -85, -85, -85, -85, -85, -85, + -85, -85, -85, -85, -85, -85, -85, -85, -85, -85, + -85, -85, -85, -85, -85, -85, -85, -85 + }, + + { + 11, 86, 86, -86, 86, 86, 86, 86, 86, 86, + 86, 86, 86, 86, 86, 86, 86, 86, 86, 86, + 86, 86, 86, 86, 86, 86, 86, 86, 86, 86, + 86, 86, 86, 86, 86, 86, 86, 86 + }, + + { + 11, -87, -87, -87, -87, -87, -87, -87, -87, -87, + -87, -87, -87, -87, -87, -87, -87, -87, -87, -87, + + -87, -87, -87, -87, -87, -87, -87, -87, -87, -87, + -87, -87, -87, -87, -87, -87, -87, -87 + }, + + { + 11, -88, -88, -88, -88, -88, -88, -88, -88, -88, + -88, 115, 89, 89, -88, -88, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, -88 + }, + + { + 11, -89, -89, -89, -89, -89, -89, -89, -89, -89, + -89, 89, 89, 89, -89, -89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, -89 + + }, + + { + 11, -90, -90, -90, -90, -90, -90, -90, -90, -90, + -90, -90, -90, -90, -90, -90, -90, -90, -90, -90, + -90, -90, -90, -90, -90, -90, -90, -90, -90, -90, + -90, -90, -90, -90, -90, -90, -90, -90 + }, + + { + 11, -91, -91, -91, -91, -91, -91, -91, -91, -91, + -91, 89, 89, 89, -91, -91, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, -91 + }, + + { + 11, -92, -92, -92, -92, -92, -92, -92, -92, -92, + -92, 89, 89, 89, -92, -92, 89, 89, 89, 89, + + 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, -92 + }, + + { + 11, -93, -93, -93, -93, -93, -93, -93, -93, -93, + -93, -93, -93, -93, -93, -93, -93, -93, -93, -93, + -93, -93, -93, -93, -93, -93, -93, -93, -93, -93, + -93, -93, -93, -93, -93, -93, -93, -93 + }, + + { + 11, -94, -94, -94, -94, -94, -94, -94, -94, -94, + -94, -94, -94, 58, -94, -94, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 116, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -94 + + }, + + { + 11, -95, -95, -95, -95, -95, -95, -95, -95, -95, + -95, -95, -95, 58, -95, -95, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 117, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -95 + }, + + { + 11, -96, -96, -96, -96, -96, -96, -96, -96, -96, + -96, -96, -96, 58, -96, -96, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 118, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -96 + }, + + { + 11, -97, -97, -97, -97, -97, -97, -97, -97, -97, + -97, -97, -97, 58, -97, -97, 58, 58, 58, 58, + + 58, 58, 119, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -97 + }, + + { + 11, -98, -98, -98, -98, -98, -98, -98, -98, -98, + -98, -98, -98, 58, -98, -98, 120, 121, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -98 + }, + + { + 11, -99, -99, -99, -99, -99, -99, -99, -99, -99, + -99, -99, -99, 58, -99, -99, 58, 58, 58, 58, + 58, 122, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -99 + + }, + + { + 11, -100, -100, -100, -100, -100, -100, -100, -100, -100, + -100, -100, -100, 58, -100, -100, 58, 58, 123, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -100 + }, + + { + 11, -101, -101, -101, -101, -101, -101, -101, -101, -101, + -101, -101, -101, 58, -101, -101, 58, 58, 58, 124, + 58, 58, 58, 58, 58, 125, 58, 126, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -101 + }, + + { + 11, -102, -102, -102, -102, -102, -102, -102, -102, -102, + -102, -102, -102, 58, -102, -102, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 127, 58, 58, 58, 58, 58, 58, -102 + }, + + { + 11, -103, -103, -103, -103, -103, -103, -103, -103, -103, + -103, -103, -103, 58, -103, -103, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -103 + }, + + { + 11, -104, -104, -104, -104, -104, -104, -104, -104, -104, + -104, -104, -104, 58, -104, -104, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -104 + + }, + + { + 11, -105, -105, -105, -105, -105, -105, -105, -105, -105, + -105, -105, -105, 58, -105, -105, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 128, 58, + 58, 58, 58, 58, 58, 58, 58, -105 + }, + + { + 11, -106, -106, -106, -106, -106, -106, -106, -106, -106, + -106, -106, -106, 58, -106, -106, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 129, 58, -106 + }, + + { + 11, -107, -107, -107, -107, -107, -107, -107, -107, -107, + -107, -107, -107, 58, -107, -107, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 130, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -107 + }, + + { + 11, -108, -108, -108, -108, -108, -108, -108, -108, -108, + -108, -108, -108, 58, -108, -108, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 131, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -108 + }, + + { + 11, -109, -109, -109, -109, -109, -109, -109, -109, -109, + -109, -109, -109, 58, -109, -109, 58, 58, 58, 58, + 58, 58, 58, 132, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -109 + + }, + + { + 11, -110, -110, -110, -110, -110, -110, -110, -110, -110, + -110, -110, -110, 58, -110, -110, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 133, 58, -110 + }, + + { + 11, -111, -111, -111, -111, -111, -111, -111, -111, -111, + -111, -111, -111, 58, -111, -111, 58, 58, 58, 58, + 58, 134, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -111 + }, + + { + 11, -112, -112, -112, -112, -112, -112, -112, -112, -112, + -112, -112, -112, 58, -112, -112, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 135, 58, 58, 58, 58, -112 + }, + + { + 11, -113, -113, -113, -113, -113, -113, -113, -113, -113, + -113, -113, -113, 58, -113, -113, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 136, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -113 + }, + + { + 11, -114, -114, -114, -114, -114, -114, -114, -114, -114, + -114, -114, -114, 58, -114, -114, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 137, 58, 58, 58, -114 + + }, + + { + 11, -115, -115, -115, -115, -115, -115, -115, -115, -115, + -115, 89, 89, 89, -115, -115, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, + 89, 89, 89, 89, 89, 89, 89, -115 + }, + + { + 11, -116, -116, -116, -116, -116, -116, -116, -116, -116, + -116, -116, -116, 58, -116, -116, 58, 58, 58, 58, + 58, 138, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -116 + }, + + { + 11, -117, -117, -117, -117, -117, -117, -117, -117, -117, + -117, -117, -117, 58, -117, -117, 58, 58, 58, 139, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -117 + }, + + { + 11, -118, -118, -118, -118, -118, -118, -118, -118, -118, + -118, -118, -118, 58, -118, -118, 58, 58, 58, 58, + 58, 140, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -118 + }, + + { + 11, -119, -119, -119, -119, -119, -119, -119, -119, -119, + -119, -119, -119, 58, -119, -119, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 141, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -119 + + }, + + { + 11, -120, -120, -120, -120, -120, -120, -120, -120, -120, + -120, -120, -120, 58, -120, -120, 58, 58, 142, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 143, 58, 58, -120 + }, + + { + 11, -121, -121, -121, -121, -121, -121, -121, -121, -121, + -121, -121, -121, 58, -121, -121, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 144, 58, -121 + }, + + { + 11, -122, -122, -122, -122, -122, -122, -122, -122, -122, + -122, -122, -122, 58, -122, -122, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 145, 58, + 58, 58, 58, 58, 58, 58, 58, -122 + }, + + { + 11, -123, -123, -123, -123, -123, -123, -123, -123, -123, + -123, -123, -123, 58, -123, -123, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 146, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -123 + }, + + { + 11, -124, -124, -124, -124, -124, -124, -124, -124, -124, + -124, -124, -124, 58, -124, -124, 58, 58, 58, 58, + 58, 58, 58, 58, 147, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -124 + + }, + + { + 11, -125, -125, -125, -125, -125, -125, -125, -125, -125, + -125, -125, -125, 58, -125, -125, 58, 58, 58, 58, + 58, 58, 148, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -125 + }, + + { + 11, -126, -126, -126, -126, -126, -126, -126, -126, -126, + -126, -126, -126, 58, -126, -126, 58, 58, 58, 58, + 58, 149, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -126 + }, + + { + 11, -127, -127, -127, -127, -127, -127, -127, -127, -127, + -127, -127, -127, 58, -127, -127, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -127 + }, + + { + 11, -128, -128, -128, -128, -128, -128, -128, -128, -128, + -128, -128, -128, 58, -128, -128, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 150, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -128 + }, + + { + 11, -129, -129, -129, -129, -129, -129, -129, -129, -129, + -129, -129, -129, 58, -129, -129, 58, 58, 58, 151, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -129 + + }, + + { + 11, -130, -130, -130, -130, -130, -130, -130, -130, -130, + -130, -130, -130, 58, -130, -130, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 152, + 58, 58, 58, 58, 58, 58, 58, -130 + }, + + { + 11, -131, -131, -131, -131, -131, -131, -131, -131, -131, + -131, -131, -131, 58, -131, -131, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 153, 58, 58, 58, 58, 58, 58, -131 + }, + + { + 11, -132, -132, -132, -132, -132, -132, -132, -132, -132, + -132, -132, -132, 58, -132, -132, 58, 58, 58, 58, + + 58, 154, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -132 + }, + + { + 11, -133, -133, -133, -133, -133, -133, -133, -133, -133, + -133, -133, -133, 58, -133, -133, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 155, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -133 + }, + + { + 11, -134, -134, -134, -134, -134, -134, -134, -134, -134, + -134, -134, -134, 58, -134, -134, 58, 58, 58, 156, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -134 + + }, + + { + 11, -135, -135, -135, -135, -135, -135, -135, -135, -135, + -135, -135, -135, 58, -135, -135, 58, 58, 58, 157, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -135 + }, + + { + 11, -136, -136, -136, -136, -136, -136, -136, -136, -136, + -136, -136, -136, 58, -136, -136, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 158, 58, + 58, 58, 58, 58, 58, 58, 58, -136 + }, + + { + 11, -137, -137, -137, -137, -137, -137, -137, -137, -137, + -137, -137, -137, 58, -137, -137, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 159, 58, 58, -137 + }, + + { + 11, -138, -138, -138, -138, -138, -138, -138, -138, -138, + -138, -138, -138, 58, -138, -138, 58, 160, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -138 + }, + + { + 11, -139, -139, -139, -139, -139, -139, -139, -139, -139, + -139, -139, -139, 58, -139, -139, 58, 58, 58, 58, + 58, 161, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -139 + + }, + + { + 11, -140, -140, -140, -140, -140, -140, -140, -140, -140, + -140, -140, -140, 58, -140, -140, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 162, 58, + 58, 58, 58, 58, 58, 58, 58, -140 + }, + + { + 11, -141, -141, -141, -141, -141, -141, -141, -141, -141, + -141, -141, -141, 58, -141, -141, 58, 58, 58, 58, + 58, 58, 58, 163, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -141 + }, + + { + 11, -142, -142, -142, -142, -142, -142, -142, -142, -142, + -142, -142, -142, 58, -142, -142, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 164, + 58, 58, 58, 58, 58, 58, 58, -142 + }, + + { + 11, -143, -143, -143, -143, -143, -143, -143, -143, -143, + -143, -143, -143, 58, -143, -143, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 165, 58, 58, 58, 58, -143 + }, + + { + 11, -144, -144, -144, -144, -144, -144, -144, -144, -144, + -144, -144, -144, 58, -144, -144, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 166, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -144 + + }, + + { + 11, -145, -145, -145, -145, -145, -145, -145, -145, -145, + -145, -145, -145, 58, -145, -145, 58, 58, 58, 58, + 167, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -145 + }, + + { + 11, -146, -146, -146, -146, -146, -146, -146, -146, -146, + -146, -146, -146, 58, -146, -146, 58, 58, 58, 58, + 58, 168, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -146 + }, + + { + 11, -147, -147, -147, -147, -147, -147, -147, -147, -147, + -147, -147, -147, 58, -147, -147, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 169, + 58, 58, 58, 58, 58, 58, 58, -147 + }, + + { + 11, -148, -148, -148, -148, -148, -148, -148, -148, -148, + -148, -148, -148, 58, -148, -148, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -148 + }, + + { + 11, -149, -149, -149, -149, -149, -149, -149, -149, -149, + -149, -149, -149, 58, -149, -149, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 170, 58, + 58, 58, 58, 58, 58, 58, 58, -149 + + }, + + { + 11, -150, -150, -150, -150, -150, -150, -150, -150, -150, + -150, -150, -150, 58, -150, -150, 58, 58, 58, 58, + 58, 171, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -150 + }, + + { + 11, -151, -151, -151, -151, -151, -151, -151, -151, -151, + -151, -151, -151, 58, -151, -151, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 172, + 58, 58, 58, 58, 58, 58, 58, -151 + }, + + { + 11, -152, -152, -152, -152, -152, -152, -152, -152, -152, + -152, -152, -152, 58, -152, -152, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 173, 58, + 58, 58, 58, 58, 58, 58, 58, -152 + }, + + { + 11, -153, -153, -153, -153, -153, -153, -153, -153, -153, + -153, -153, -153, 58, -153, -153, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 174, 58, 58, -153 + }, + + { + 11, -154, -154, -154, -154, -154, -154, -154, -154, -154, + -154, -154, -154, 58, -154, -154, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -154 + + }, + + { + 11, -155, -155, -155, -155, -155, -155, -155, -155, -155, + -155, -155, -155, 58, -155, -155, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 175, 58, 58, 58, 58, -155 + }, + + { + 11, -156, -156, -156, -156, -156, -156, -156, -156, -156, + -156, -156, -156, 58, -156, -156, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 176, 58, 58, -156 + }, + + { + 11, -157, -157, -157, -157, -157, -157, -157, -157, -157, + -157, -157, -157, 58, -157, -157, 58, 58, 58, 58, + + 58, 177, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -157 + }, + + { + 11, -158, -158, -158, -158, -158, -158, -158, -158, -158, + -158, -158, -158, 58, -158, -158, 58, 58, 58, 58, + 58, 58, 58, 178, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -158 + }, + + { + 11, -159, -159, -159, -159, -159, -159, -159, -159, -159, + -159, -159, -159, 58, -159, -159, 58, 179, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -159 + + }, + + { + 11, -160, -160, -160, -160, -160, -160, -160, -160, -160, + -160, -160, -160, 58, -160, -160, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 180, 58, + 58, 58, 58, 58, 58, 58, 58, -160 + }, + + { + 11, -161, -161, -161, -161, -161, -161, -161, -161, -161, + -161, -161, -161, 58, -161, -161, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -161 + }, + + { + 11, -162, -162, -162, -162, -162, -162, -162, -162, -162, + -162, -162, -162, 58, -162, -162, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 181, 58, 58, -162 + }, + + { + 11, -163, -163, -163, -163, -163, -163, -163, -163, -163, + -163, -163, -163, 58, -163, -163, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -163 + }, + + { + 11, -164, -164, -164, -164, -164, -164, -164, -164, -164, + -164, -164, -164, 58, -164, -164, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 182, + 58, 58, 58, 58, 58, 58, 58, -164 + + }, + + { + 11, -165, -165, -165, -165, -165, -165, -165, -165, -165, + -165, -165, -165, 58, -165, -165, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 183, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -165 + }, + + { + 11, -166, -166, -166, -166, -166, -166, -166, -166, -166, + -166, -166, -166, 58, -166, -166, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 184, 58, 58, -166 + }, + + { + 11, -167, -167, -167, -167, -167, -167, -167, -167, -167, + -167, -167, -167, 58, -167, -167, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 185, 58, 58, 58, -167 + }, + + { + 11, -168, -168, -168, -168, -168, -168, -168, -168, -168, + -168, -168, -168, 58, -168, -168, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -168 + }, + + { + 11, -169, -169, -169, -169, -169, -169, -169, -169, -169, + -169, -169, -169, 58, -169, -169, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 186, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -169 + + }, + + { + 11, -170, -170, -170, -170, -170, -170, -170, -170, -170, + -170, -170, -170, 58, -170, -170, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 187, 58, -170 + }, + + { + 11, -171, -171, -171, -171, -171, -171, -171, -171, -171, + -171, -171, -171, 58, -171, -171, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 188, 58, + 58, 58, 58, 58, 58, 58, 58, -171 + }, + + { + 11, -172, -172, -172, -172, -172, -172, -172, -172, -172, + -172, -172, -172, 58, -172, -172, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 189, 58, + 58, 58, 58, 58, 58, 58, 58, -172 + }, + + { + 11, -173, -173, -173, -173, -173, -173, -173, -173, -173, + -173, -173, -173, 58, -173, -173, 58, 190, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -173 + }, + + { + 11, -174, -174, -174, -174, -174, -174, -174, -174, -174, + -174, -174, -174, 58, -174, -174, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -174 + + }, + + { + 11, -175, -175, -175, -175, -175, -175, -175, -175, -175, + -175, -175, -175, 58, -175, -175, 58, 58, 58, 58, + 58, 191, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -175 + }, + + { + 11, -176, -176, -176, -176, -176, -176, -176, -176, -176, + -176, -176, -176, 58, -176, -176, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -176 + }, + + { + 11, -177, -177, -177, -177, -177, -177, -177, -177, -177, + -177, -177, -177, 58, -177, -177, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -177 + }, + + { + 11, -178, -178, -178, -178, -178, -178, -178, -178, -178, + -178, -178, -178, 58, -178, -178, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -178 + }, + + { + 11, -179, -179, -179, -179, -179, -179, -179, -179, -179, + -179, -179, -179, 58, -179, -179, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 192, 58, 58, -179 + + }, + + { + 11, -180, -180, -180, -180, -180, -180, -180, -180, -180, + -180, -180, -180, 58, -180, -180, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -180 + }, + + { + 11, -181, -181, -181, -181, -181, -181, -181, -181, -181, + -181, -181, -181, 58, -181, -181, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -181 + }, + + { + 11, -182, -182, -182, -182, -182, -182, -182, -182, -182, + -182, -182, -182, 58, -182, -182, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 193, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -182 + }, + + { + 11, -183, -183, -183, -183, -183, -183, -183, -183, -183, + -183, -183, -183, 58, -183, -183, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 194, 58, 58, 58, -183 + }, + + { + 11, -184, -184, -184, -184, -184, -184, -184, -184, -184, + -184, -184, -184, 58, -184, -184, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -184 + + }, + + { + 11, -185, -185, -185, -185, -185, -185, -185, -185, -185, + -185, -185, -185, 58, -185, -185, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -185 + }, + + { + 11, -186, -186, -186, -186, -186, -186, -186, -186, -186, + -186, -186, -186, 58, -186, -186, 58, 58, 58, 195, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -186 + }, + + { + 11, -187, -187, -187, -187, -187, -187, -187, -187, -187, + -187, -187, -187, 58, -187, -187, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -187 + }, + + { + 11, -188, -188, -188, -188, -188, -188, -188, -188, -188, + -188, -188, -188, 58, -188, -188, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 196, 58, -188 + }, + + { + 11, -189, -189, -189, -189, -189, -189, -189, -189, -189, + -189, -189, -189, 58, -189, -189, 58, 58, 58, 58, + 58, 58, 197, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -189 + + }, + + { + 11, -190, -190, -190, -190, -190, -190, -190, -190, -190, + -190, -190, -190, 58, -190, -190, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 198, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -190 + }, + + { + 11, -191, -191, -191, -191, -191, -191, -191, -191, -191, + -191, -191, -191, 58, -191, -191, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 199, 58, 58, 58, -191 + }, + + { + 11, -192, -192, -192, -192, -192, -192, -192, -192, -192, + -192, -192, -192, 58, -192, -192, 58, 58, 58, 58, + + 58, 200, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -192 + }, + + { + 11, -193, -193, -193, -193, -193, -193, -193, -193, -193, + -193, -193, -193, 58, -193, -193, 58, 58, 58, 58, + 58, 201, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -193 + }, + + { + 11, -194, -194, -194, -194, -194, -194, -194, -194, -194, + -194, -194, -194, 58, -194, -194, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 202, 58, 58, -194 + + }, + + { + 11, -195, -195, -195, -195, -195, -195, -195, -195, -195, + -195, -195, -195, 58, -195, -195, 58, 58, 58, 58, + 58, 203, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -195 + }, + + { + 11, -196, -196, -196, -196, -196, -196, -196, -196, -196, + -196, -196, -196, 58, -196, -196, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -196 + }, + + { + 11, -197, -197, -197, -197, -197, -197, -197, -197, -197, + -197, -197, -197, 58, -197, -197, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 204, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -197 + }, + + { + 11, -198, -198, -198, -198, -198, -198, -198, -198, -198, + -198, -198, -198, 58, -198, -198, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -198 + }, + + { + 11, -199, -199, -199, -199, -199, -199, -199, -199, -199, + -199, -199, -199, 58, -199, -199, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -199 + + }, + + { + 11, -200, -200, -200, -200, -200, -200, -200, -200, -200, + -200, -200, -200, 58, -200, -200, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -200 + }, + + { + 11, -201, -201, -201, -201, -201, -201, -201, -201, -201, + -201, -201, -201, 58, -201, -201, 58, 205, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -201 + }, + + { + 11, -202, -202, -202, -202, -202, -202, -202, -202, -202, + -202, -202, -202, 58, -202, -202, 58, 206, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -202 + }, + + { + 11, -203, -203, -203, -203, -203, -203, -203, -203, -203, + -203, -203, -203, 58, -203, -203, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -203 + }, + + { + 11, -204, -204, -204, -204, -204, -204, -204, -204, -204, + -204, -204, -204, 58, -204, -204, 58, 58, 58, 58, + 58, 58, 58, 207, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -204 + + }, + + { + 11, -205, -205, -205, -205, -205, -205, -205, -205, -205, + -205, -205, -205, 58, -205, -205, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 208, 58, + 58, 58, 58, 58, 58, 58, 58, -205 + }, + + { + 11, -206, -206, -206, -206, -206, -206, -206, -206, -206, + -206, -206, -206, 58, -206, -206, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 209, 58, 58, -206 + }, + + { + 11, -207, -207, -207, -207, -207, -207, -207, -207, -207, + -207, -207, -207, 58, -207, -207, 58, 58, 58, 58, + + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -207 + }, + + { + 11, -208, -208, -208, -208, -208, -208, -208, -208, -208, + -208, -208, -208, 58, -208, -208, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -208 + }, + + { + 11, -209, -209, -209, -209, -209, -209, -209, -209, -209, + -209, -209, -209, 58, -209, -209, 58, 58, 58, 58, + 58, 210, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -209 + + }, + + { + 11, -210, -210, -210, -210, -210, -210, -210, -210, -210, + -210, -210, -210, 58, -210, -210, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, 58, 58, 58, + 58, 58, 58, 58, 58, 58, 58, -210 + }, + + } ; + +static yy_state_type yy_get_previous_state (void ); +static yy_state_type yy_try_NUL_trans (yy_state_type current_state ); +static int yy_get_next_buffer (void ); +static void yy_fatal_error (yyconst char msg[] ); + +/* Done after the current pattern has been matched and before the + * corresponding action - sets up zconftext. + */ +#define YY_DO_BEFORE_ACTION \ + (yytext_ptr) = yy_bp; \ + zconfleng = (size_t) (yy_cp - yy_bp); \ + (yy_hold_char) = *yy_cp; \ + *yy_cp = '\0'; \ + (yy_c_buf_p) = yy_cp; + +#define YY_NUM_RULES 64 +#define YY_END_OF_BUFFER 65 +/* This struct is not used in this scanner, + but its presence is necessary. */ +struct yy_trans_info + { + flex_int32_t yy_verify; + flex_int32_t yy_nxt; + }; +static yyconst flex_int16_t yy_accept[211] = + { 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 65, 5, 4, 3, 2, 36, 37, 35, 35, 35, + 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, + 63, 60, 62, 55, 59, 58, 57, 53, 48, 42, + 47, 51, 53, 40, 41, 50, 50, 43, 53, 50, + 50, 53, 4, 3, 2, 2, 1, 35, 35, 35, + 35, 35, 35, 35, 16, 35, 35, 35, 35, 35, + 35, 35, 35, 35, 35, 35, 63, 60, 62, 61, + 55, 54, 57, 56, 44, 51, 38, 50, 50, 52, + 45, 46, 39, 35, 35, 35, 35, 35, 35, 35, + + 35, 35, 30, 29, 35, 35, 35, 35, 35, 35, + 35, 35, 35, 35, 49, 25, 35, 35, 35, 35, + 35, 35, 35, 35, 35, 35, 15, 35, 7, 35, + 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, + 35, 35, 35, 35, 35, 35, 35, 17, 35, 35, + 35, 35, 35, 34, 35, 35, 35, 35, 35, 35, + 10, 35, 13, 35, 35, 35, 35, 33, 35, 35, + 35, 35, 35, 22, 35, 32, 9, 31, 35, 26, + 12, 35, 35, 21, 18, 35, 8, 35, 35, 35, + 35, 35, 27, 35, 35, 6, 35, 20, 19, 23, + + 35, 35, 11, 35, 35, 35, 14, 28, 35, 24 + } ; + +static yyconst flex_int32_t yy_ec[256] = + { 0, + 1, 1, 1, 1, 1, 1, 1, 1, 2, 3, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 2, 4, 5, 6, 1, 1, 7, 8, 9, + 10, 1, 1, 1, 11, 12, 12, 13, 13, 13, + 13, 13, 13, 13, 13, 13, 13, 1, 1, 1, + 14, 1, 1, 1, 13, 13, 13, 13, 13, 13, + 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, + 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, + 1, 15, 1, 1, 16, 1, 17, 18, 19, 20, + + 21, 22, 23, 24, 25, 13, 13, 26, 27, 28, + 29, 30, 31, 32, 33, 34, 35, 13, 13, 36, + 13, 13, 1, 37, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1 + } ; + +extern int zconf_flex_debug; +int zconf_flex_debug = 0; + +/* The intent behind this definition is that it'll catch + * any uses of REJECT which flex missed. + */ +#define REJECT reject_used_but_not_detected +#define yymore() yymore_used_but_not_detected +#define YY_MORE_ADJ 0 +#define YY_RESTORE_YY_MORE_OFFSET +char *zconftext; + +/* + * Copyright (C) 2002 Roman Zippel + * Released under the terms of the GNU GPL v2.0. + */ + +#include +#include +#include +#include +#include + +#define LKC_DIRECT_LINK +#include "lkc.h" + +#define START_STRSIZE 16 + +char *text; +static char *text_ptr; +static int text_size, text_asize; + +struct buffer { + struct buffer *parent; + YY_BUFFER_STATE state; +}; + +struct buffer *current_buf; + +static int last_ts, first_ts; + +static void zconf_endhelp(void); +static struct buffer *zconf_endfile(void); + +void new_string(void) +{ + text = malloc(START_STRSIZE); + text_asize = START_STRSIZE; + text_ptr = text; + text_size = 0; + *text_ptr = 0; +} + +void append_string(const char *str, int size) +{ + int new_size = text_size + size + 1; + if (new_size > text_asize) { + text = realloc(text, new_size); + text_asize = new_size; + text_ptr = text + text_size; + } + memcpy(text_ptr, str, size); + text_ptr += size; + text_size += size; + *text_ptr = 0; +} + +void alloc_string(const char *str, int size) +{ + text = malloc(size + 1); + memcpy(text, str, size); + text[size] = 0; +} + +#define INITIAL 0 +#define COMMAND 1 +#define HELP 2 +#define STRING 3 +#define PARAM 4 + +/* Special case for "unistd.h", since it is non-ANSI. We include it way + * down here because we want the user's section 1 to have been scanned first. + * The user has a chance to override it with an option. + */ +#include + +#ifndef YY_EXTRA_TYPE +#define YY_EXTRA_TYPE void * +#endif + +/* Macros after this point can all be overridden by user definitions in + * section 1. + */ + +#ifndef YY_SKIP_YYWRAP +#ifdef __cplusplus +extern "C" int zconfwrap (void ); +#else +extern int zconfwrap (void ); +#endif +#endif + + static void yyunput (int c,char *buf_ptr ); + +#ifndef yytext_ptr +static void yy_flex_strncpy (char *,yyconst char *,int ); +#endif + +#ifdef YY_NEED_STRLEN +static int yy_flex_strlen (yyconst char * ); +#endif + +#ifndef YY_NO_INPUT + +#ifdef __cplusplus +static int yyinput (void ); +#else +static int input (void ); +#endif + +#endif + +/* Amount of stuff to slurp up with each read. */ +#ifndef YY_READ_BUF_SIZE +#define YY_READ_BUF_SIZE 8192 +#endif + +/* Copy whatever the last rule matched to the standard output. */ +#ifndef ECHO +/* This used to be an fputs(), but since the string might contain NUL's, + * we now use fwrite(). + */ +#define ECHO (void) fwrite( zconftext, zconfleng, 1, zconfout ) +#endif + +/* Gets input and stuffs it into "buf". number of characters read, or YY_NULL, + * is returned in "result". + */ +#ifndef YY_INPUT +#define YY_INPUT(buf,result,max_size) \ + errno=0; \ + while ( (result = read( fileno(zconfin), (char *) buf, max_size )) < 0 ) \ + { \ + if( errno != EINTR) \ + { \ + YY_FATAL_ERROR( "input in flex scanner failed" ); \ + break; \ + } \ + errno=0; \ + clearerr(zconfin); \ + }\ +\ + +#endif + +/* No semi-colon after return; correct usage is to write "yyterminate();" - + * we don't want an extra ';' after the "return" because that will cause + * some compilers to complain about unreachable statements. + */ +#ifndef yyterminate +#define yyterminate() return YY_NULL +#endif + +/* Number of entries by which start-condition stack grows. */ +#ifndef YY_START_STACK_INCR +#define YY_START_STACK_INCR 25 +#endif + +/* Report a fatal error. */ +#ifndef YY_FATAL_ERROR +#define YY_FATAL_ERROR(msg) yy_fatal_error( msg ) +#endif + +/* end tables serialization structures and prototypes */ + +/* Default declaration of generated scanner - a define so the user can + * easily add parameters. + */ +#ifndef YY_DECL +#define YY_DECL_IS_OURS 1 + +extern int zconflex (void); + +#define YY_DECL int zconflex (void) +#endif /* !YY_DECL */ + +/* Code executed at the beginning of each rule, after zconftext and zconfleng + * have been set up. + */ +#ifndef YY_USER_ACTION +#define YY_USER_ACTION +#endif + +/* Code executed at the end of each rule. */ +#ifndef YY_BREAK +#define YY_BREAK break; +#endif + +#define YY_RULE_SETUP \ + YY_USER_ACTION + +/** The main scanner function which does all the work. + */ +YY_DECL +{ + register yy_state_type yy_current_state; + register char *yy_cp, *yy_bp; + register int yy_act; + + int str = 0; + int ts, i; + + if ( (yy_init) ) + { + (yy_init) = 0; + +#ifdef YY_USER_INIT + YY_USER_INIT; +#endif + + if ( ! (yy_start) ) + (yy_start) = 1; /* first start state */ + + if ( ! zconfin ) + zconfin = stdin; + + if ( ! zconfout ) + zconfout = stdout; + + if ( ! YY_CURRENT_BUFFER ) { + zconfensure_buffer_stack (); + YY_CURRENT_BUFFER_LVALUE = + zconf_create_buffer(zconfin,YY_BUF_SIZE ); + } + + zconf_load_buffer_state( ); + } + + while ( 1 ) /* loops until end-of-file is reached */ + { + yy_cp = (yy_c_buf_p); + + /* Support of zconftext. */ + *yy_cp = (yy_hold_char); + + /* yy_bp points to the position in yy_ch_buf of the start of + * the current run. + */ + yy_bp = yy_cp; + + yy_current_state = (yy_start); +yy_match: + while ( (yy_current_state = yy_nxt[yy_current_state][ yy_ec[YY_SC_TO_UI(*yy_cp)] ]) > 0 ) + ++yy_cp; + + yy_current_state = -yy_current_state; + +yy_find_action: + yy_act = yy_accept[yy_current_state]; + + YY_DO_BEFORE_ACTION; + +do_action: /* This label is used only to access EOF actions. */ + + switch ( yy_act ) + { /* beginning of action switch */ +case 1: +/* rule 1 can match eol */ +YY_RULE_SETUP +current_file->lineno++; + YY_BREAK +case 2: +YY_RULE_SETUP + + YY_BREAK +case 3: +/* rule 3 can match eol */ +YY_RULE_SETUP +current_file->lineno++; return T_EOL; + YY_BREAK +case 4: +YY_RULE_SETUP +{ + BEGIN(COMMAND); +} + YY_BREAK +case 5: +YY_RULE_SETUP +{ + unput(zconftext[0]); + BEGIN(COMMAND); +} + YY_BREAK + +case 6: +YY_RULE_SETUP +BEGIN(PARAM); return T_MAINMENU; + YY_BREAK +case 7: +YY_RULE_SETUP +BEGIN(PARAM); return T_MENU; + YY_BREAK +case 8: +YY_RULE_SETUP +BEGIN(PARAM); return T_ENDMENU; + YY_BREAK +case 9: +YY_RULE_SETUP +BEGIN(PARAM); return T_SOURCE; + YY_BREAK +case 10: +YY_RULE_SETUP +BEGIN(PARAM); return T_CHOICE; + YY_BREAK +case 11: +YY_RULE_SETUP +BEGIN(PARAM); return T_ENDCHOICE; + YY_BREAK +case 12: +YY_RULE_SETUP +BEGIN(PARAM); return T_COMMENT; + YY_BREAK +case 13: +YY_RULE_SETUP +BEGIN(PARAM); return T_CONFIG; + YY_BREAK +case 14: +YY_RULE_SETUP +BEGIN(PARAM); return T_MENUCONFIG; + YY_BREAK +case 15: +YY_RULE_SETUP +BEGIN(PARAM); return T_HELP; + YY_BREAK +case 16: +YY_RULE_SETUP +BEGIN(PARAM); return T_IF; + YY_BREAK +case 17: +YY_RULE_SETUP +BEGIN(PARAM); return T_ENDIF; + YY_BREAK +case 18: +YY_RULE_SETUP +BEGIN(PARAM); return T_DEPENDS; + YY_BREAK +case 19: +YY_RULE_SETUP +BEGIN(PARAM); return T_REQUIRES; + YY_BREAK +case 20: +YY_RULE_SETUP +BEGIN(PARAM); return T_OPTIONAL; + YY_BREAK +case 21: +YY_RULE_SETUP +BEGIN(PARAM); return T_DEFAULT; + YY_BREAK +case 22: +YY_RULE_SETUP +BEGIN(PARAM); return T_PROMPT; + YY_BREAK +case 23: +YY_RULE_SETUP +BEGIN(PARAM); return T_TRISTATE; + YY_BREAK +case 24: +YY_RULE_SETUP +BEGIN(PARAM); return T_DEF_TRISTATE; + YY_BREAK +case 25: +YY_RULE_SETUP +BEGIN(PARAM); return T_BOOLEAN; + YY_BREAK +case 26: +YY_RULE_SETUP +BEGIN(PARAM); return T_BOOLEAN; + YY_BREAK +case 27: +YY_RULE_SETUP +BEGIN(PARAM); return T_DEF_BOOLEAN; + YY_BREAK +case 28: +YY_RULE_SETUP +BEGIN(PARAM); return T_DEF_BOOLEAN; + YY_BREAK +case 29: +YY_RULE_SETUP +BEGIN(PARAM); return T_INT; + YY_BREAK +case 30: +YY_RULE_SETUP +BEGIN(PARAM); return T_HEX; + YY_BREAK +case 31: +YY_RULE_SETUP +BEGIN(PARAM); return T_STRING; + YY_BREAK +case 32: +YY_RULE_SETUP +BEGIN(PARAM); return T_SELECT; + YY_BREAK +case 33: +YY_RULE_SETUP +BEGIN(PARAM); return T_SELECT; + YY_BREAK +case 34: +YY_RULE_SETUP +BEGIN(PARAM); return T_RANGE; + YY_BREAK +case 35: +YY_RULE_SETUP +{ + alloc_string(zconftext, zconfleng); + zconflval.string = text; + return T_WORD; + } + YY_BREAK +case 36: +YY_RULE_SETUP + + YY_BREAK +case 37: +/* rule 37 can match eol */ +YY_RULE_SETUP +current_file->lineno++; BEGIN(INITIAL); + YY_BREAK + +case 38: +YY_RULE_SETUP +return T_AND; + YY_BREAK +case 39: +YY_RULE_SETUP +return T_OR; + YY_BREAK +case 40: +YY_RULE_SETUP +return T_OPEN_PAREN; + YY_BREAK +case 41: +YY_RULE_SETUP +return T_CLOSE_PAREN; + YY_BREAK +case 42: +YY_RULE_SETUP +return T_NOT; + YY_BREAK +case 43: +YY_RULE_SETUP +return T_EQUAL; + YY_BREAK +case 44: +YY_RULE_SETUP +return T_UNEQUAL; + YY_BREAK +case 45: +YY_RULE_SETUP +return T_IF; + YY_BREAK +case 46: +YY_RULE_SETUP +return T_ON; + YY_BREAK +case 47: +YY_RULE_SETUP +{ + str = zconftext[0]; + new_string(); + BEGIN(STRING); + } + YY_BREAK +case 48: +/* rule 48 can match eol */ +YY_RULE_SETUP +BEGIN(INITIAL); current_file->lineno++; return T_EOL; + YY_BREAK +case 49: +YY_RULE_SETUP +/* ignore */ + YY_BREAK +case 50: +YY_RULE_SETUP +{ + alloc_string(zconftext, zconfleng); + zconflval.string = text; + return T_WORD; + } + YY_BREAK +case 51: +YY_RULE_SETUP +/* comment */ + YY_BREAK +case 52: +/* rule 52 can match eol */ +YY_RULE_SETUP +current_file->lineno++; + YY_BREAK +case 53: +YY_RULE_SETUP + + YY_BREAK +case YY_STATE_EOF(PARAM): +{ + BEGIN(INITIAL); + } + YY_BREAK + +case 54: +/* rule 54 can match eol */ +*yy_cp = (yy_hold_char); /* undo effects of setting up zconftext */ +(yy_c_buf_p) = yy_cp -= 1; +YY_DO_BEFORE_ACTION; /* set up zconftext again */ +YY_RULE_SETUP +{ + append_string(zconftext, zconfleng); + zconflval.string = text; + return T_WORD_QUOTE; + } + YY_BREAK +case 55: +YY_RULE_SETUP +{ + append_string(zconftext, zconfleng); + } + YY_BREAK +case 56: +/* rule 56 can match eol */ +*yy_cp = (yy_hold_char); /* undo effects of setting up zconftext */ +(yy_c_buf_p) = yy_cp -= 1; +YY_DO_BEFORE_ACTION; /* set up zconftext again */ +YY_RULE_SETUP +{ + append_string(zconftext + 1, zconfleng - 1); + zconflval.string = text; + return T_WORD_QUOTE; + } + YY_BREAK +case 57: +YY_RULE_SETUP +{ + append_string(zconftext + 1, zconfleng - 1); + } + YY_BREAK +case 58: +YY_RULE_SETUP +{ + if (str == zconftext[0]) { + BEGIN(PARAM); + zconflval.string = text; + return T_WORD_QUOTE; + } else + append_string(zconftext, 1); + } + YY_BREAK +case 59: +/* rule 59 can match eol */ +YY_RULE_SETUP +{ + printf("%s:%d:warning: multi-line strings not supported\n", zconf_curname(), zconf_lineno()); + current_file->lineno++; + BEGIN(INITIAL); + return T_EOL; + } + YY_BREAK +case YY_STATE_EOF(STRING): +{ + BEGIN(INITIAL); + } + YY_BREAK + +case 60: +YY_RULE_SETUP +{ + ts = 0; + for (i = 0; i < zconfleng; i++) { + if (zconftext[i] == '\t') + ts = (ts & ~7) + 8; + else + ts++; + } + last_ts = ts; + if (first_ts) { + if (ts < first_ts) { + zconf_endhelp(); + return T_HELPTEXT; + } + ts -= first_ts; + while (ts > 8) { + append_string(" ", 8); + ts -= 8; + } + append_string(" ", ts); + } + } + YY_BREAK +case 61: +/* rule 61 can match eol */ +*yy_cp = (yy_hold_char); /* undo effects of setting up zconftext */ +(yy_c_buf_p) = yy_cp -= 1; +YY_DO_BEFORE_ACTION; /* set up zconftext again */ +YY_RULE_SETUP +{ + current_file->lineno++; + zconf_endhelp(); + return T_HELPTEXT; + } + YY_BREAK +case 62: +/* rule 62 can match eol */ +YY_RULE_SETUP +{ + current_file->lineno++; + append_string("\n", 1); + } + YY_BREAK +case 63: +YY_RULE_SETUP +{ + append_string(zconftext, zconfleng); + if (!first_ts) + first_ts = last_ts; + } + YY_BREAK +case YY_STATE_EOF(HELP): +{ + zconf_endhelp(); + return T_HELPTEXT; + } + YY_BREAK + +case YY_STATE_EOF(INITIAL): +case YY_STATE_EOF(COMMAND): +{ + if (current_buf) { + zconf_endfile(); + return T_EOF; + } + fclose(zconfin); + yyterminate(); +} + YY_BREAK +case 64: +YY_RULE_SETUP +YY_FATAL_ERROR( "flex scanner jammed" ); + YY_BREAK + + case YY_END_OF_BUFFER: + { + /* Amount of text matched not including the EOB char. */ + int yy_amount_of_matched_text = (int) (yy_cp - (yytext_ptr)) - 1; + + /* Undo the effects of YY_DO_BEFORE_ACTION. */ + *yy_cp = (yy_hold_char); + YY_RESTORE_YY_MORE_OFFSET + + if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_NEW ) + { + /* We're scanning a new file or input source. It's + * possible that this happened because the user + * just pointed zconfin at a new source and called + * zconflex(). If so, then we have to assure + * consistency between YY_CURRENT_BUFFER and our + * globals. Here is the right place to do so, because + * this is the first action (other than possibly a + * back-up) that will match for the new input source. + */ + (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_n_chars; + YY_CURRENT_BUFFER_LVALUE->yy_input_file = zconfin; + YY_CURRENT_BUFFER_LVALUE->yy_buffer_status = YY_BUFFER_NORMAL; + } + + /* Note that here we test for yy_c_buf_p "<=" to the position + * of the first EOB in the buffer, since yy_c_buf_p will + * already have been incremented past the NUL character + * (since all states make transitions on EOB to the + * end-of-buffer state). Contrast this with the test + * in input(). + */ + if ( (yy_c_buf_p) <= &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] ) + { /* This was really a NUL. */ + yy_state_type yy_next_state; + + (yy_c_buf_p) = (yytext_ptr) + yy_amount_of_matched_text; + + yy_current_state = yy_get_previous_state( ); + + /* Okay, we're now positioned to make the NUL + * transition. We couldn't have + * yy_get_previous_state() go ahead and do it + * for us because it doesn't know how to deal + * with the possibility of jamming (and we don't + * want to build jamming into it because then it + * will run more slowly). + */ + + yy_next_state = yy_try_NUL_trans( yy_current_state ); + + yy_bp = (yytext_ptr) + YY_MORE_ADJ; + + if ( yy_next_state ) + { + /* Consume the NUL. */ + yy_cp = ++(yy_c_buf_p); + yy_current_state = yy_next_state; + goto yy_match; + } + + else + { + yy_cp = (yy_c_buf_p); + goto yy_find_action; + } + } + + else switch ( yy_get_next_buffer( ) ) + { + case EOB_ACT_END_OF_FILE: + { + (yy_did_buffer_switch_on_eof) = 0; + + if ( zconfwrap( ) ) + { + /* Note: because we've taken care in + * yy_get_next_buffer() to have set up + * zconftext, we can now set up + * yy_c_buf_p so that if some total + * hoser (like flex itself) wants to + * call the scanner after we return the + * YY_NULL, it'll still work - another + * YY_NULL will get returned. + */ + (yy_c_buf_p) = (yytext_ptr) + YY_MORE_ADJ; + + yy_act = YY_STATE_EOF(YY_START); + goto do_action; + } + + else + { + if ( ! (yy_did_buffer_switch_on_eof) ) + YY_NEW_FILE; + } + break; + } + + case EOB_ACT_CONTINUE_SCAN: + (yy_c_buf_p) = + (yytext_ptr) + yy_amount_of_matched_text; + + yy_current_state = yy_get_previous_state( ); + + yy_cp = (yy_c_buf_p); + yy_bp = (yytext_ptr) + YY_MORE_ADJ; + goto yy_match; + + case EOB_ACT_LAST_MATCH: + (yy_c_buf_p) = + &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)]; + + yy_current_state = yy_get_previous_state( ); + + yy_cp = (yy_c_buf_p); + yy_bp = (yytext_ptr) + YY_MORE_ADJ; + goto yy_find_action; + } + break; + } + + default: + YY_FATAL_ERROR( + "fatal flex scanner internal error--no action found" ); + } /* end of action switch */ + } /* end of scanning one token */ +} /* end of zconflex */ + +/* yy_get_next_buffer - try to read in a new buffer + * + * Returns a code representing an action: + * EOB_ACT_LAST_MATCH - + * EOB_ACT_CONTINUE_SCAN - continue scanning from current position + * EOB_ACT_END_OF_FILE - end of file + */ +static int yy_get_next_buffer (void) +{ + register char *dest = YY_CURRENT_BUFFER_LVALUE->yy_ch_buf; + register char *source = (yytext_ptr); + register int number_to_move, i; + int ret_val; + + if ( (yy_c_buf_p) > &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars) + 1] ) + YY_FATAL_ERROR( + "fatal flex scanner internal error--end of buffer missed" ); + + if ( YY_CURRENT_BUFFER_LVALUE->yy_fill_buffer == 0 ) + { /* Don't try to fill the buffer, so this is an EOF. */ + if ( (yy_c_buf_p) - (yytext_ptr) - YY_MORE_ADJ == 1 ) + { + /* We matched a single character, the EOB, so + * treat this as a final EOF. + */ + return EOB_ACT_END_OF_FILE; + } + + else + { + /* We matched some text prior to the EOB, first + * process it. + */ + return EOB_ACT_LAST_MATCH; + } + } + + /* Try to read more data. */ + + /* First move last chars to start of buffer. */ + number_to_move = (int) ((yy_c_buf_p) - (yytext_ptr)) - 1; + + for ( i = 0; i < number_to_move; ++i ) + *(dest++) = *(source++); + + if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_EOF_PENDING ) + /* don't do the read, it's not guaranteed to return an EOF, + * just force an EOF + */ + YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars) = 0; + + else + { + size_t num_to_read = + YY_CURRENT_BUFFER_LVALUE->yy_buf_size - number_to_move - 1; + + while ( num_to_read <= 0 ) + { /* Not enough room in the buffer - grow it. */ + + /* just a shorter name for the current buffer */ + YY_BUFFER_STATE b = YY_CURRENT_BUFFER; + + int yy_c_buf_p_offset = + (int) ((yy_c_buf_p) - b->yy_ch_buf); + + if ( b->yy_is_our_buffer ) + { + int new_size = b->yy_buf_size * 2; + + if ( new_size <= 0 ) + b->yy_buf_size += b->yy_buf_size / 8; + else + b->yy_buf_size *= 2; + + b->yy_ch_buf = (char *) + /* Include room in for 2 EOB chars. */ + zconfrealloc((void *) b->yy_ch_buf,b->yy_buf_size + 2 ); + } + else + /* Can't grow it, we don't own it. */ + b->yy_ch_buf = 0; + + if ( ! b->yy_ch_buf ) + YY_FATAL_ERROR( + "fatal error - scanner input buffer overflow" ); + + (yy_c_buf_p) = &b->yy_ch_buf[yy_c_buf_p_offset]; + + num_to_read = YY_CURRENT_BUFFER_LVALUE->yy_buf_size - + number_to_move - 1; + + } + + if ( num_to_read > YY_READ_BUF_SIZE ) + num_to_read = YY_READ_BUF_SIZE; + + /* Read in more data. */ + YY_INPUT( (&YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]), + (yy_n_chars), num_to_read ); + + YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars); + } + + if ( (yy_n_chars) == 0 ) + { + if ( number_to_move == YY_MORE_ADJ ) + { + ret_val = EOB_ACT_END_OF_FILE; + zconfrestart(zconfin ); + } + + else + { + ret_val = EOB_ACT_LAST_MATCH; + YY_CURRENT_BUFFER_LVALUE->yy_buffer_status = + YY_BUFFER_EOF_PENDING; + } + } + + else + ret_val = EOB_ACT_CONTINUE_SCAN; + + (yy_n_chars) += number_to_move; + YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] = YY_END_OF_BUFFER_CHAR; + YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars) + 1] = YY_END_OF_BUFFER_CHAR; + + (yytext_ptr) = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[0]; + + return ret_val; +} + +/* yy_get_previous_state - get the state just before the EOB char was reached */ + + static yy_state_type yy_get_previous_state (void) +{ + register yy_state_type yy_current_state; + register char *yy_cp; + + yy_current_state = (yy_start); + + for ( yy_cp = (yytext_ptr) + YY_MORE_ADJ; yy_cp < (yy_c_buf_p); ++yy_cp ) + { + yy_current_state = yy_nxt[yy_current_state][(*yy_cp ? yy_ec[YY_SC_TO_UI(*yy_cp)] : 1)]; + } + + return yy_current_state; +} + +/* yy_try_NUL_trans - try to make a transition on the NUL character + * + * synopsis + * next_state = yy_try_NUL_trans( current_state ); + */ + static yy_state_type yy_try_NUL_trans (yy_state_type yy_current_state ) +{ + register int yy_is_jam; + + yy_current_state = yy_nxt[yy_current_state][1]; + yy_is_jam = (yy_current_state <= 0); + + return yy_is_jam ? 0 : yy_current_state; +} + + static void yyunput (int c, register char * yy_bp ) +{ + register char *yy_cp; + + yy_cp = (yy_c_buf_p); + + /* undo effects of setting up zconftext */ + *yy_cp = (yy_hold_char); + + if ( yy_cp < YY_CURRENT_BUFFER_LVALUE->yy_ch_buf + 2 ) + { /* need to shift things up to make room */ + /* +2 for EOB chars. */ + register int number_to_move = (yy_n_chars) + 2; + register char *dest = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[ + YY_CURRENT_BUFFER_LVALUE->yy_buf_size + 2]; + register char *source = + &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]; + + while ( source > YY_CURRENT_BUFFER_LVALUE->yy_ch_buf ) + *--dest = *--source; + + yy_cp += (int) (dest - source); + yy_bp += (int) (dest - source); + YY_CURRENT_BUFFER_LVALUE->yy_n_chars = + (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_buf_size; + + if ( yy_cp < YY_CURRENT_BUFFER_LVALUE->yy_ch_buf + 2 ) + YY_FATAL_ERROR( "flex scanner push-back overflow" ); + } + + *--yy_cp = (char) c; + + (yytext_ptr) = yy_bp; + (yy_hold_char) = *yy_cp; + (yy_c_buf_p) = yy_cp; +} + +#ifndef YY_NO_INPUT +#ifdef __cplusplus + static int yyinput (void) +#else + static int input (void) +#endif + +{ + int c; + + *(yy_c_buf_p) = (yy_hold_char); + + if ( *(yy_c_buf_p) == YY_END_OF_BUFFER_CHAR ) + { + /* yy_c_buf_p now points to the character we want to return. + * If this occurs *before* the EOB characters, then it's a + * valid NUL; if not, then we've hit the end of the buffer. + */ + if ( (yy_c_buf_p) < &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] ) + /* This was really a NUL. */ + *(yy_c_buf_p) = '\0'; + + else + { /* need more input */ + int offset = (yy_c_buf_p) - (yytext_ptr); + ++(yy_c_buf_p); + + switch ( yy_get_next_buffer( ) ) + { + case EOB_ACT_LAST_MATCH: + /* This happens because yy_g_n_b() + * sees that we've accumulated a + * token and flags that we need to + * try matching the token before + * proceeding. But for input(), + * there's no matching to consider. + * So convert the EOB_ACT_LAST_MATCH + * to EOB_ACT_END_OF_FILE. + */ + + /* Reset buffer status. */ + zconfrestart(zconfin ); + + /*FALLTHROUGH*/ + + case EOB_ACT_END_OF_FILE: + { + if ( zconfwrap( ) ) + return EOF; + + if ( ! (yy_did_buffer_switch_on_eof) ) + YY_NEW_FILE; +#ifdef __cplusplus + return yyinput(); +#else + return input(); +#endif + } + + case EOB_ACT_CONTINUE_SCAN: + (yy_c_buf_p) = (yytext_ptr) + offset; + break; + } + } + } + + c = *(unsigned char *) (yy_c_buf_p); /* cast for 8-bit char's */ + *(yy_c_buf_p) = '\0'; /* preserve zconftext */ + (yy_hold_char) = *++(yy_c_buf_p); + + return c; +} +#endif /* ifndef YY_NO_INPUT */ + +/** Immediately switch to a different input stream. + * @param input_file A readable stream. + * + * @note This function does not reset the start condition to @c INITIAL . + */ + void zconfrestart (FILE * input_file ) +{ + + if ( ! YY_CURRENT_BUFFER ){ + zconfensure_buffer_stack (); + YY_CURRENT_BUFFER_LVALUE = + zconf_create_buffer(zconfin,YY_BUF_SIZE ); + } + + zconf_init_buffer(YY_CURRENT_BUFFER,input_file ); + zconf_load_buffer_state( ); +} + +/** Switch to a different input buffer. + * @param new_buffer The new input buffer. + * + */ + void zconf_switch_to_buffer (YY_BUFFER_STATE new_buffer ) +{ + + /* TODO. We should be able to replace this entire function body + * with + * zconfpop_buffer_state(); + * zconfpush_buffer_state(new_buffer); + */ + zconfensure_buffer_stack (); + if ( YY_CURRENT_BUFFER == new_buffer ) + return; + + if ( YY_CURRENT_BUFFER ) + { + /* Flush out information for old buffer. */ + *(yy_c_buf_p) = (yy_hold_char); + YY_CURRENT_BUFFER_LVALUE->yy_buf_pos = (yy_c_buf_p); + YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars); + } + + YY_CURRENT_BUFFER_LVALUE = new_buffer; + zconf_load_buffer_state( ); + + /* We don't actually know whether we did this switch during + * EOF (zconfwrap()) processing, but the only time this flag + * is looked at is after zconfwrap() is called, so it's safe + * to go ahead and always set it. + */ + (yy_did_buffer_switch_on_eof) = 1; +} + +static void zconf_load_buffer_state (void) +{ + (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_n_chars; + (yytext_ptr) = (yy_c_buf_p) = YY_CURRENT_BUFFER_LVALUE->yy_buf_pos; + zconfin = YY_CURRENT_BUFFER_LVALUE->yy_input_file; + (yy_hold_char) = *(yy_c_buf_p); +} + +/** Allocate and initialize an input buffer state. + * @param file A readable stream. + * @param size The character buffer size in bytes. When in doubt, use @c YY_BUF_SIZE. + * + * @return the allocated buffer state. + */ + YY_BUFFER_STATE zconf_create_buffer (FILE * file, int size ) +{ + YY_BUFFER_STATE b; + + b = (YY_BUFFER_STATE) zconfalloc(sizeof( struct yy_buffer_state ) ); + if ( ! b ) + YY_FATAL_ERROR( "out of dynamic memory in zconf_create_buffer()" ); + + b->yy_buf_size = size; + + /* yy_ch_buf has to be 2 characters longer than the size given because + * we need to put in 2 end-of-buffer characters. + */ + b->yy_ch_buf = (char *) zconfalloc(b->yy_buf_size + 2 ); + if ( ! b->yy_ch_buf ) + YY_FATAL_ERROR( "out of dynamic memory in zconf_create_buffer()" ); + + b->yy_is_our_buffer = 1; + + zconf_init_buffer(b,file ); + + return b; +} + +/** Destroy the buffer. + * @param b a buffer created with zconf_create_buffer() + * + */ + void zconf_delete_buffer (YY_BUFFER_STATE b ) +{ + + if ( ! b ) + return; + + if ( b == YY_CURRENT_BUFFER ) /* Not sure if we should pop here. */ + YY_CURRENT_BUFFER_LVALUE = (YY_BUFFER_STATE) 0; + + if ( b->yy_is_our_buffer ) + zconffree((void *) b->yy_ch_buf ); + + zconffree((void *) b ); +} + +/* Initializes or reinitializes a buffer. + * This function is sometimes called more than once on the same buffer, + * such as during a zconfrestart() or at EOF. + */ + static void zconf_init_buffer (YY_BUFFER_STATE b, FILE * file ) + +{ + int oerrno = errno; + + zconf_flush_buffer(b ); + + b->yy_input_file = file; + b->yy_fill_buffer = 1; + + /* If b is the current buffer, then zconf_init_buffer was _probably_ + * called from zconfrestart() or through yy_get_next_buffer. + * In that case, we don't want to reset the lineno or column. + */ + if (b != YY_CURRENT_BUFFER){ + b->yy_bs_lineno = 1; + b->yy_bs_column = 0; + } + + b->yy_is_interactive = 0; + + errno = oerrno; +} + +/** Discard all buffered characters. On the next scan, YY_INPUT will be called. + * @param b the buffer state to be flushed, usually @c YY_CURRENT_BUFFER. + * + */ + void zconf_flush_buffer (YY_BUFFER_STATE b ) +{ + if ( ! b ) + return; + + b->yy_n_chars = 0; + + /* We always need two end-of-buffer characters. The first causes + * a transition to the end-of-buffer state. The second causes + * a jam in that state. + */ + b->yy_ch_buf[0] = YY_END_OF_BUFFER_CHAR; + b->yy_ch_buf[1] = YY_END_OF_BUFFER_CHAR; + + b->yy_buf_pos = &b->yy_ch_buf[0]; + + b->yy_at_bol = 1; + b->yy_buffer_status = YY_BUFFER_NEW; + + if ( b == YY_CURRENT_BUFFER ) + zconf_load_buffer_state( ); +} + +/** Pushes the new state onto the stack. The new state becomes + * the current state. This function will allocate the stack + * if necessary. + * @param new_buffer The new state. + * + */ +void zconfpush_buffer_state (YY_BUFFER_STATE new_buffer ) +{ + if (new_buffer == NULL) + return; + + zconfensure_buffer_stack(); + + /* This block is copied from zconf_switch_to_buffer. */ + if ( YY_CURRENT_BUFFER ) + { + /* Flush out information for old buffer. */ + *(yy_c_buf_p) = (yy_hold_char); + YY_CURRENT_BUFFER_LVALUE->yy_buf_pos = (yy_c_buf_p); + YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars); + } + + /* Only push if top exists. Otherwise, replace top. */ + if (YY_CURRENT_BUFFER) + (yy_buffer_stack_top)++; + YY_CURRENT_BUFFER_LVALUE = new_buffer; + + /* copied from zconf_switch_to_buffer. */ + zconf_load_buffer_state( ); + (yy_did_buffer_switch_on_eof) = 1; +} + +/** Removes and deletes the top of the stack, if present. + * The next element becomes the new top. + * + */ +void zconfpop_buffer_state (void) +{ + if (!YY_CURRENT_BUFFER) + return; + + zconf_delete_buffer(YY_CURRENT_BUFFER ); + YY_CURRENT_BUFFER_LVALUE = NULL; + if ((yy_buffer_stack_top) > 0) + --(yy_buffer_stack_top); + + if (YY_CURRENT_BUFFER) { + zconf_load_buffer_state( ); + (yy_did_buffer_switch_on_eof) = 1; + } +} + +/* Allocates the stack if it does not exist. + * Guarantees space for at least one push. + */ +static void zconfensure_buffer_stack (void) +{ + int num_to_alloc; + + if (!(yy_buffer_stack)) { + + /* First allocation is just for 2 elements, since we don't know if this + * scanner will even need a stack. We use 2 instead of 1 to avoid an + * immediate realloc on the next call. + */ + num_to_alloc = 1; + (yy_buffer_stack) = (struct yy_buffer_state**)zconfalloc + (num_to_alloc * sizeof(struct yy_buffer_state*) + ); + + memset((yy_buffer_stack), 0, num_to_alloc * sizeof(struct yy_buffer_state*)); + + (yy_buffer_stack_max) = num_to_alloc; + (yy_buffer_stack_top) = 0; + return; + } + + if ((yy_buffer_stack_top) >= ((yy_buffer_stack_max)) - 1){ + + /* Increase the buffer to prepare for a possible push. */ + int grow_size = 8 /* arbitrary grow size */; + + num_to_alloc = (yy_buffer_stack_max) + grow_size; + (yy_buffer_stack) = (struct yy_buffer_state**)zconfrealloc + ((yy_buffer_stack), + num_to_alloc * sizeof(struct yy_buffer_state*) + ); + + /* zero only the new slots.*/ + memset((yy_buffer_stack) + (yy_buffer_stack_max), 0, grow_size * sizeof(struct yy_buffer_state*)); + (yy_buffer_stack_max) = num_to_alloc; + } +} + +/** Setup the input buffer state to scan directly from a user-specified character buffer. + * @param base the character buffer + * @param size the size in bytes of the character buffer + * + * @return the newly allocated buffer state object. + */ +YY_BUFFER_STATE zconf_scan_buffer (char * base, yy_size_t size ) +{ + YY_BUFFER_STATE b; + + if ( size < 2 || + base[size-2] != YY_END_OF_BUFFER_CHAR || + base[size-1] != YY_END_OF_BUFFER_CHAR ) + /* They forgot to leave room for the EOB's. */ + return 0; + + b = (YY_BUFFER_STATE) zconfalloc(sizeof( struct yy_buffer_state ) ); + if ( ! b ) + YY_FATAL_ERROR( "out of dynamic memory in zconf_scan_buffer()" ); + + b->yy_buf_size = size - 2; /* "- 2" to take care of EOB's */ + b->yy_buf_pos = b->yy_ch_buf = base; + b->yy_is_our_buffer = 0; + b->yy_input_file = 0; + b->yy_n_chars = b->yy_buf_size; + b->yy_is_interactive = 0; + b->yy_at_bol = 1; + b->yy_fill_buffer = 0; + b->yy_buffer_status = YY_BUFFER_NEW; + + zconf_switch_to_buffer(b ); + + return b; +} + +/** Setup the input buffer state to scan a string. The next call to zconflex() will + * scan from a @e copy of @a str. + * @param str a NUL-terminated string to scan + * + * @return the newly allocated buffer state object. + * @note If you want to scan bytes that may contain NUL values, then use + * zconf_scan_bytes() instead. + */ +YY_BUFFER_STATE zconf_scan_string (yyconst char * str ) +{ + + return zconf_scan_bytes(str,strlen(str) ); +} + +/** Setup the input buffer state to scan the given bytes. The next call to zconflex() will + * scan from a @e copy of @a bytes. + * @param bytes the byte buffer to scan + * @param len the number of bytes in the buffer pointed to by @a bytes. + * + * @return the newly allocated buffer state object. + */ +YY_BUFFER_STATE zconf_scan_bytes (yyconst char * bytes, int len ) +{ + YY_BUFFER_STATE b; + char *buf; + yy_size_t n; + int i; + + /* Get memory for full buffer, including space for trailing EOB's. */ + n = len + 2; + buf = (char *) zconfalloc(n ); + if ( ! buf ) + YY_FATAL_ERROR( "out of dynamic memory in zconf_scan_bytes()" ); + + for ( i = 0; i < len; ++i ) + buf[i] = bytes[i]; + + buf[len] = buf[len+1] = YY_END_OF_BUFFER_CHAR; + + b = zconf_scan_buffer(buf,n ); + if ( ! b ) + YY_FATAL_ERROR( "bad buffer in zconf_scan_bytes()" ); + + /* It's okay to grow etc. this buffer, and we should throw it + * away when we're done. + */ + b->yy_is_our_buffer = 1; + + return b; +} + +#ifndef YY_EXIT_FAILURE +#define YY_EXIT_FAILURE 2 +#endif + +static void yy_fatal_error (yyconst char* msg ) +{ + (void) fprintf( stderr, "%s\n", msg ); + exit( YY_EXIT_FAILURE ); +} + +/* Redefine yyless() so it works in section 3 code. */ + +#undef yyless +#define yyless(n) \ + do \ + { \ + /* Undo effects of setting up zconftext. */ \ + int yyless_macro_arg = (n); \ + YY_LESS_LINENO(yyless_macro_arg);\ + zconftext[zconfleng] = (yy_hold_char); \ + (yy_c_buf_p) = zconftext + yyless_macro_arg; \ + (yy_hold_char) = *(yy_c_buf_p); \ + *(yy_c_buf_p) = '\0'; \ + zconfleng = yyless_macro_arg; \ + } \ + while ( 0 ) + +/* Accessor methods (get/set functions) to struct members. */ + +/** Get the current line number. + * + */ +int zconfget_lineno (void) +{ + + return zconflineno; +} + +/** Get the input stream. + * + */ +FILE *zconfget_in (void) +{ + return zconfin; +} + +/** Get the output stream. + * + */ +FILE *zconfget_out (void) +{ + return zconfout; +} + +/** Get the length of the current token. + * + */ +int zconfget_leng (void) +{ + return zconfleng; +} + +/** Get the current token. + * + */ + +char *zconfget_text (void) +{ + return zconftext; +} + +/** Set the current line number. + * @param line_number + * + */ +void zconfset_lineno (int line_number ) +{ + + zconflineno = line_number; +} + +/** Set the input stream. This does not discard the current + * input buffer. + * @param in_str A readable stream. + * + * @see zconf_switch_to_buffer + */ +void zconfset_in (FILE * in_str ) +{ + zconfin = in_str ; +} + +void zconfset_out (FILE * out_str ) +{ + zconfout = out_str ; +} + +int zconfget_debug (void) +{ + return zconf_flex_debug; +} + +void zconfset_debug (int bdebug ) +{ + zconf_flex_debug = bdebug ; +} + +/* zconflex_destroy is for both reentrant and non-reentrant scanners. */ +int zconflex_destroy (void) +{ + + /* Pop the buffer stack, destroying each element. */ + while(YY_CURRENT_BUFFER){ + zconf_delete_buffer(YY_CURRENT_BUFFER ); + YY_CURRENT_BUFFER_LVALUE = NULL; + zconfpop_buffer_state(); + } + + /* Destroy the stack itself. */ + zconffree((yy_buffer_stack) ); + (yy_buffer_stack) = NULL; + + return 0; +} + +/* + * Internal utility routines. + */ + +#ifndef yytext_ptr +static void yy_flex_strncpy (char* s1, yyconst char * s2, int n ) +{ + register int i; + for ( i = 0; i < n; ++i ) + s1[i] = s2[i]; +} +#endif + +#ifdef YY_NEED_STRLEN +static int yy_flex_strlen (yyconst char * s ) +{ + register int n; + for ( n = 0; s[n]; ++n ) + ; + + return n; +} +#endif + +void *zconfalloc (yy_size_t size ) +{ + return (void *) malloc( size ); +} + +void *zconfrealloc (void * ptr, yy_size_t size ) +{ + /* The cast to (char *) in the following accommodates both + * implementations that use char* generic pointers, and those + * that use void* generic pointers. It works with the latter + * because both ANSI C and C++ allow castless assignment from + * any pointer type to void*, and deal with argument conversions + * as though doing an assignment. + */ + return (void *) realloc( (char *) ptr, size ); +} + +void zconffree (void * ptr ) +{ + free( (char *) ptr ); /* see zconfrealloc() for (char *) cast */ +} + +#define YYTABLES_NAME "yytables" + +#undef YY_NEW_FILE +#undef YY_FLUSH_BUFFER +#undef yy_set_bol +#undef yy_new_buffer +#undef yy_set_interactive +#undef yytext_ptr +#undef YY_DO_BEFORE_ACTION + +#ifdef YY_DECL_IS_OURS +#undef YY_DECL_IS_OURS +#undef YY_DECL +#endif + +void zconf_starthelp(void) +{ + new_string(); + last_ts = first_ts = 0; + BEGIN(HELP); +} + +static void zconf_endhelp(void) +{ + zconflval.string = text; + BEGIN(INITIAL); +} + +/* + * Try to open specified file with following names: + * ./name + * $(srctree)/name + * The latter is used when srctree is separate from objtree + * when compiling the kernel. + * Return NULL if file is not found. + */ +FILE *zconf_fopen(const char *name) +{ + char *env, fullname[PATH_MAX+1]; + FILE *f; + + f = fopen(name, "r"); + if (!f && name[0] != '/') { + env = getenv(SRCTREE); + if (env) { + sprintf(fullname, "%s/%s", env, name); + f = fopen(fullname, "r"); + } + } + return f; +} + +void zconf_initscan(const char *name) +{ + zconfin = zconf_fopen(name); + if (!zconfin) { + printf("can't find file %s\n", name); + exit(1); + } + + current_buf = malloc(sizeof(*current_buf)); + memset(current_buf, 0, sizeof(*current_buf)); + + current_file = file_lookup(name); + current_file->lineno = 1; + current_file->flags = FILE_BUSY; +} + +void zconf_nextfile(const char *name) +{ + struct file *file = file_lookup(name); + struct buffer *buf = malloc(sizeof(*buf)); + memset(buf, 0, sizeof(*buf)); + + current_buf->state = YY_CURRENT_BUFFER; + zconfin = zconf_fopen(name); + if (!zconfin) { + printf("%s:%d: can't open file \"%s\"\n", zconf_curname(), zconf_lineno(), name); + exit(1); + } + zconf_switch_to_buffer(zconf_create_buffer(zconfin,YY_BUF_SIZE)); + buf->parent = current_buf; + current_buf = buf; + + if (file->flags & FILE_BUSY) { + printf("recursive scan (%s)?\n", name); + exit(1); + } + if (file->flags & FILE_SCANNED) { + printf("file %s already scanned?\n", name); + exit(1); + } + file->flags |= FILE_BUSY; + file->lineno = 1; + file->parent = current_file; + current_file = file; +} + +static struct buffer *zconf_endfile(void) +{ + struct buffer *parent; + + current_file->flags |= FILE_SCANNED; + current_file->flags &= ~FILE_BUSY; + current_file = current_file->parent; + + parent = current_buf->parent; + if (parent) { + fclose(zconfin); + zconf_delete_buffer(YY_CURRENT_BUFFER); + zconf_switch_to_buffer(parent->state); + } + free(current_buf); + current_buf = parent; + + return parent; +} + +int zconf_lineno(void) +{ + if (current_buf) + return current_file->lineno - 1; + else + return 0; +} + +char *zconf_curname(void) +{ + if (current_buf) + return current_file->name; + else + return ""; +} + diff --git a/config/scripts/config/lkc.h b/config/scripts/config/lkc.h new file mode 100644 index 0000000000..b8a67fc9d6 --- /dev/null +++ b/config/scripts/config/lkc.h @@ -0,0 +1,123 @@ +/* + * Copyright (C) 2002 Roman Zippel + * Released under the terms of the GNU GPL v2.0. + */ + +#ifndef LKC_H +#define LKC_H + +#include "expr.h" + +#ifdef __cplusplus +extern "C" { +#endif + +#ifdef LKC_DIRECT_LINK +#define P(name,type,arg) extern type name arg +#else +#include "lkc_defs.h" +#define P(name,type,arg) extern type (*name ## _p) arg +#endif +#include "lkc_proto.h" +#undef P + +#define SRCTREE "srctree" + +int zconfparse(void); +void zconfdump(FILE *out); + +extern int zconfdebug; +void zconf_starthelp(void); +FILE *zconf_fopen(const char *name); +void zconf_initscan(const char *name); +void zconf_nextfile(const char *name); +int zconf_lineno(void); +char *zconf_curname(void); + +/* confdata.c */ +extern const char conf_def_filename[]; +extern char conf_filename[]; + +char *conf_get_default_confname(void); + +/* kconfig_load.c */ +void kconfig_load(void); + +/* menu.c */ +void menu_init(void); +void menu_add_menu(void); +void menu_end_menu(void); +void menu_add_entry(struct symbol *sym); +void menu_end_entry(void); +void menu_add_dep(struct expr *dep); +struct property *menu_add_prop(enum prop_type type, char *prompt, struct expr *expr, struct expr *dep); +void menu_add_prompt(enum prop_type type, char *prompt, struct expr *dep); +void menu_add_expr(enum prop_type type, struct expr *expr, struct expr *dep); +void menu_add_symbol(enum prop_type type, struct symbol *sym, struct expr *dep); +void menu_finalize(struct menu *parent); +void menu_set_type(int type); + +/* util.c */ +struct file *file_lookup(const char *name); +int file_write_dep(const char *name); + +struct gstr { + size_t len; + char *s; +}; +struct gstr str_new(void); +struct gstr str_assign(const char *s); +void str_free(struct gstr *gs); +void str_append(struct gstr *gs, const char *s); +void str_printf(struct gstr *gs, const char *fmt, ...); +const char *str_get(struct gstr *gs); + +/* symbol.c */ +void sym_init(void); +void sym_clear_all_valid(void); +void sym_set_changed(struct symbol *sym); +struct symbol *sym_check_deps(struct symbol *sym); +struct property *prop_alloc(enum prop_type type, struct symbol *sym); +struct symbol *prop_get_symbol(struct property *prop); + +static inline tristate sym_get_tristate_value(struct symbol *sym) +{ + return sym->curr.tri; +} + + +static inline struct symbol *sym_get_choice_value(struct symbol *sym) +{ + return (struct symbol *)sym->curr.val; +} + +static inline bool sym_set_choice_value(struct symbol *ch, struct symbol *chval) +{ + return sym_set_tristate_value(chval, yes); +} + +static inline bool sym_is_choice(struct symbol *sym) +{ + return sym->flags & SYMBOL_CHOICE ? true : false; +} + +static inline bool sym_is_choice_value(struct symbol *sym) +{ + return sym->flags & SYMBOL_CHOICEVAL ? true : false; +} + +static inline bool sym_is_optional(struct symbol *sym) +{ + return sym->flags & SYMBOL_OPTIONAL ? true : false; +} + +static inline bool sym_has_value(struct symbol *sym) +{ + return sym->flags & SYMBOL_NEW ? false : true; +} + +#ifdef __cplusplus +} +#endif + +#endif /* LKC_H */ diff --git a/config/scripts/config/lkc_defs.h b/config/scripts/config/lkc_defs.h new file mode 100644 index 0000000000..65240dd9fc --- /dev/null +++ b/config/scripts/config/lkc_defs.h @@ -0,0 +1,40 @@ + +/* confdata.c */ +#define conf_parse (*conf_parse_p) +#define conf_read (*conf_read_p) +#define conf_write (*conf_write_p) + +/* menu.c */ +#define rootmenu (*rootmenu_p) + +#define menu_is_visible (*menu_is_visible_p) +#define menu_get_prompt (*menu_get_prompt_p) +#define menu_get_root_menu (*menu_get_root_menu_p) +#define menu_get_parent_menu (*menu_get_parent_menu_p) + +/* symbol.c */ +#define symbol_hash (*symbol_hash_p) +#define sym_change_count (*sym_change_count_p) + +#define sym_lookup (*sym_lookup_p) +#define sym_find (*sym_find_p) +#define sym_re_search (*sym_re_search_p) +#define sym_type_name (*sym_type_name_p) +#define sym_calc_value (*sym_calc_value_p) +#define sym_get_type (*sym_get_type_p) +#define sym_tristate_within_range (*sym_tristate_within_range_p) +#define sym_set_tristate_value (*sym_set_tristate_value_p) +#define sym_toggle_tristate_value (*sym_toggle_tristate_value_p) +#define sym_string_valid (*sym_string_valid_p) +#define sym_string_within_range (*sym_string_within_range_p) +#define sym_set_string_value (*sym_set_string_value_p) +#define sym_is_changable (*sym_is_changable_p) +#define sym_get_choice_prop (*sym_get_choice_prop_p) +#define sym_get_default_prop (*sym_get_default_prop_p) +#define sym_get_string_value (*sym_get_string_value_p) + +#define prop_get_type_name (*prop_get_type_name_p) + +/* expr.c */ +#define expr_compare_type (*expr_compare_type_p) +#define expr_print (*expr_print_p) diff --git a/config/scripts/config/lkc_proto.h b/config/scripts/config/lkc_proto.h new file mode 100644 index 0000000000..6dc6d0c48e --- /dev/null +++ b/config/scripts/config/lkc_proto.h @@ -0,0 +1,40 @@ + +/* confdata.c */ +P(conf_parse,void,(const char *name)); +P(conf_read,int,(const char *name)); +P(conf_write,int,(const char *name)); + +/* menu.c */ +P(rootmenu,struct menu,); + +P(menu_is_visible,bool,(struct menu *menu)); +P(menu_get_prompt,const char *,(struct menu *menu)); +P(menu_get_root_menu,struct menu *,(struct menu *menu)); +P(menu_get_parent_menu,struct menu *,(struct menu *menu)); + +/* symbol.c */ +P(symbol_hash,struct symbol *,[SYMBOL_HASHSIZE]); +P(sym_change_count,int,); + +P(sym_lookup,struct symbol *,(const char *name, int isconst)); +P(sym_find,struct symbol *,(const char *name)); +P(sym_re_search,struct symbol **,(const char *pattern)); +P(sym_type_name,const char *,(enum symbol_type type)); +P(sym_calc_value,void,(struct symbol *sym)); +P(sym_get_type,enum symbol_type,(struct symbol *sym)); +P(sym_tristate_within_range,bool,(struct symbol *sym,tristate tri)); +P(sym_set_tristate_value,bool,(struct symbol *sym,tristate tri)); +P(sym_toggle_tristate_value,tristate,(struct symbol *sym)); +P(sym_string_valid,bool,(struct symbol *sym, const char *newval)); +P(sym_string_within_range,bool,(struct symbol *sym, const char *str)); +P(sym_set_string_value,bool,(struct symbol *sym, const char *newval)); +P(sym_is_changable,bool,(struct symbol *sym)); +P(sym_get_choice_prop,struct property *,(struct symbol *sym)); +P(sym_get_default_prop,struct property *,(struct symbol *sym)); +P(sym_get_string_value,const char *,(struct symbol *sym)); + +P(prop_get_type_name,const char *,(enum prop_type type)); + +/* expr.c */ +P(expr_compare_type,int,(enum expr_type t1, enum expr_type t2)); +P(expr_print,void,(struct expr *e, void (*fn)(void *, const char *), void *data, int prevtoken)); diff --git a/config/scripts/config/lxdialog/BIG.FAT.WARNING b/config/scripts/config/lxdialog/BIG.FAT.WARNING new file mode 100644 index 0000000000..a8999d82bd --- /dev/null +++ b/config/scripts/config/lxdialog/BIG.FAT.WARNING @@ -0,0 +1,4 @@ +This is NOT the official version of dialog. This version has been +significantly modified from the original. It is for use by the Linux +kernel configuration script. Please do not bother Savio Lam with +questions about this program. diff --git a/config/scripts/config/lxdialog/checklist.c b/config/scripts/config/lxdialog/checklist.c new file mode 100644 index 0000000000..71de4a191d --- /dev/null +++ b/config/scripts/config/lxdialog/checklist.c @@ -0,0 +1,372 @@ +/* + * checklist.c -- implements the checklist box + * + * ORIGINAL AUTHOR: Savio Lam (lam836@cs.cuhk.hk) + * Stuart Herbert - S.Herbert@sheffield.ac.uk: radiolist extension + * Alessandro Rubini - rubini@ipvvis.unipv.it: merged the two + * MODIFIED FOR LINUX KERNEL CONFIG BY: William Roadcap (roadcap@cfw.com) + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include "dialog.h" + +static int list_width, check_x, item_x, checkflag; + +/* + * Print list item + */ +static void +print_item (WINDOW * win, const char *item, int status, + int choice, int selected) +{ + int i; + + /* Clear 'residue' of last item */ + wattrset (win, menubox_attr); + wmove (win, choice, 0); + for (i = 0; i < list_width; i++) + waddch (win, ' '); + + wmove (win, choice, check_x); + wattrset (win, selected ? check_selected_attr : check_attr); + if (checkflag == FLAG_CHECK) + wprintw (win, "[%c]", status ? 'X' : ' '); + else + wprintw (win, "(%c)", status ? 'X' : ' '); + + wattrset (win, selected ? tag_selected_attr : tag_attr); + mvwaddch(win, choice, item_x, item[0]); + wattrset (win, selected ? item_selected_attr : item_attr); + waddstr (win, (char *)item+1); + if (selected) { + wmove (win, choice, check_x+1); + wrefresh (win); + } +} + +/* + * Print the scroll indicators. + */ +static void +print_arrows (WINDOW * win, int choice, int item_no, int scroll, + int y, int x, int height) +{ + wmove(win, y, x); + + if (scroll > 0) { + wattrset (win, uarrow_attr); + waddch (win, ACS_UARROW); + waddstr (win, "(-)"); + } + else { + wattrset (win, menubox_attr); + waddch (win, ACS_HLINE); + waddch (win, ACS_HLINE); + waddch (win, ACS_HLINE); + waddch (win, ACS_HLINE); + } + + y = y + height + 1; + wmove(win, y, x); + + if ((height < item_no) && (scroll + choice < item_no - 1)) { + wattrset (win, darrow_attr); + waddch (win, ACS_DARROW); + waddstr (win, "(+)"); + } + else { + wattrset (win, menubox_border_attr); + waddch (win, ACS_HLINE); + waddch (win, ACS_HLINE); + waddch (win, ACS_HLINE); + waddch (win, ACS_HLINE); + } +} + +/* + * Display the termination buttons + */ +static void +print_buttons( WINDOW *dialog, int height, int width, int selected) +{ + int x = width / 2 - 11; + int y = height - 2; + + print_button (dialog, "Select", y, x, selected == 0); + print_button (dialog, " Help ", y, x + 14, selected == 1); + + wmove(dialog, y, x+1 + 14*selected); + wrefresh (dialog); +} + +/* + * Display a dialog box with a list of options that can be turned on or off + * The `flag' parameter is used to select between radiolist and checklist. + */ +int +dialog_checklist (const char *title, const char *prompt, int height, int width, + int list_height, int item_no, struct dialog_list_item ** items, + int flag) + +{ + int i, x, y, box_x, box_y; + int key = 0, button = 0, choice = 0, scroll = 0, max_choice, *status; + WINDOW *dialog, *list; + + checkflag = flag; + + /* Allocate space for storing item on/off status */ + if ((status = malloc (sizeof (int) * item_no)) == NULL) { + endwin (); + fprintf (stderr, + "\nCan't allocate memory in dialog_checklist().\n"); + exit (-1); + } + + /* Initializes status */ + for (i = 0; i < item_no; i++) { + status[i] = (items[i]->selected == 1); /* ON */ + if ((!choice && status[i]) || items[i]->selected == 2) /* SELECTED */ + choice = i + 1; + } + if (choice) + choice--; + + max_choice = MIN (list_height, item_no); + + /* center dialog box on screen */ + x = (COLS - width) / 2; + y = (LINES - height) / 2; + + draw_shadow (stdscr, y, x, height, width); + + dialog = newwin (height, width, y, x); + keypad (dialog, TRUE); + + draw_box (dialog, 0, 0, height, width, dialog_attr, border_attr); + wattrset (dialog, border_attr); + mvwaddch (dialog, height-3, 0, ACS_LTEE); + for (i = 0; i < width - 2; i++) + waddch (dialog, ACS_HLINE); + wattrset (dialog, dialog_attr); + waddch (dialog, ACS_RTEE); + + if (title != NULL && strlen(title) >= width-2 ) { + /* truncate long title -- mec */ + char * title2 = malloc(width-2+1); + memcpy( title2, title, width-2 ); + title2[width-2] = '\0'; + title = title2; + } + + if (title != NULL) { + wattrset (dialog, title_attr); + mvwaddch (dialog, 0, (width - strlen(title))/2 - 1, ' '); + waddstr (dialog, (char *)title); + waddch (dialog, ' '); + } + + wattrset (dialog, dialog_attr); + print_autowrap (dialog, prompt, width - 2, 1, 3); + + list_width = width - 6; + box_y = height - list_height - 5; + box_x = (width - list_width) / 2 - 1; + + /* create new window for the list */ + list = subwin (dialog, list_height, list_width, y+box_y+1, x+box_x+1); + + keypad (list, TRUE); + + /* draw a box around the list items */ + draw_box (dialog, box_y, box_x, list_height + 2, list_width + 2, + menubox_border_attr, menubox_attr); + + /* Find length of longest item in order to center checklist */ + check_x = 0; + for (i = 0; i < item_no; i++) + check_x = MAX (check_x, + strlen (items[i]->name) + 4); + + check_x = (list_width - check_x) / 2; + item_x = check_x + 4; + + if (choice >= list_height) { + scroll = choice - list_height + 1; + choice -= scroll; + } + + /* Print the list */ + for (i = 0; i < max_choice; i++) { + print_item (list, items[scroll + i]->name, + status[i+scroll], i, i == choice); + } + + print_arrows(dialog, choice, item_no, scroll, + box_y, box_x + check_x + 5, list_height); + + print_buttons(dialog, height, width, 0); + + wnoutrefresh (list); + wnoutrefresh (dialog); + doupdate (); + + while (key != ESC) { + key = wgetch (dialog); + + for (i = 0; i < max_choice; i++) + if (toupper(key) == toupper(items[scroll + i]->name[0])) + break; + + + if ( i < max_choice || key == KEY_UP || key == KEY_DOWN || + key == '+' || key == '-' ) { + if (key == KEY_UP || key == '-') { + if (!choice) { + if (!scroll) + continue; + /* Scroll list down */ + if (list_height > 1) { + /* De-highlight current first item */ + print_item (list, items[scroll]->name, + status[scroll], 0, FALSE); + scrollok (list, TRUE); + wscrl (list, -1); + scrollok (list, FALSE); + } + scroll--; + print_item (list, items[scroll]->name, + status[scroll], 0, TRUE); + wnoutrefresh (list); + + print_arrows(dialog, choice, item_no, scroll, + box_y, box_x + check_x + 5, list_height); + + wrefresh (dialog); + + continue; /* wait for another key press */ + } else + i = choice - 1; + } else if (key == KEY_DOWN || key == '+') { + if (choice == max_choice - 1) { + if (scroll + choice >= item_no - 1) + continue; + /* Scroll list up */ + if (list_height > 1) { + /* De-highlight current last item before scrolling up */ + print_item (list, items[scroll + max_choice - 1]->name, + status[scroll + max_choice - 1], + max_choice - 1, FALSE); + scrollok (list, TRUE); + scroll (list); + scrollok (list, FALSE); + } + scroll++; + print_item (list, items[scroll + max_choice - 1]->name, + status[scroll + max_choice - 1], + max_choice - 1, TRUE); + wnoutrefresh (list); + + print_arrows(dialog, choice, item_no, scroll, + box_y, box_x + check_x + 5, list_height); + + wrefresh (dialog); + + continue; /* wait for another key press */ + } else + i = choice + 1; + } + if (i != choice) { + /* De-highlight current item */ + print_item (list, items[scroll + choice]->name, + status[scroll + choice], choice, FALSE); + /* Highlight new item */ + choice = i; + print_item (list, items[scroll + choice]->name, + status[scroll + choice], choice, TRUE); + wnoutrefresh (list); + wrefresh (dialog); + } + continue; /* wait for another key press */ + } + switch (key) { + case 'H': + case 'h': + case '?': + for (i = 0; i < item_no; i++) + items[i]->selected = 0; + items[scroll + choice]->selected = 1; + delwin (dialog); + free (status); + return 1; + case TAB: + case KEY_LEFT: + case KEY_RIGHT: + button = ((key == KEY_LEFT ? --button : ++button) < 0) + ? 1 : (button > 1 ? 0 : button); + + print_buttons(dialog, height, width, button); + wrefresh (dialog); + break; + case 'S': + case 's': + case ' ': + case '\n': + if (!button) { + if (flag == FLAG_CHECK) { + status[scroll + choice] = !status[scroll + choice]; + wmove (list, choice, check_x); + wattrset (list, check_selected_attr); + wprintw (list, "[%c]", status[scroll + choice] ? 'X' : ' '); + } else { + if (!status[scroll + choice]) { + for (i = 0; i < item_no; i++) + status[i] = 0; + status[scroll + choice] = 1; + for (i = 0; i < max_choice; i++) + print_item (list, items[scroll + i]->name, + status[scroll + i], i, i == choice); + } + } + wnoutrefresh (list); + wrefresh (dialog); + + for (i = 0; i < item_no; i++) { + items[i]->selected = status[i]; + } + } else { + for (i = 0; i < item_no; i++) + items[i]->selected = 0; + items[scroll + choice]->selected = 1; + } + delwin (dialog); + free (status); + return button; + case 'X': + case 'x': + key = ESC; + case ESC: + break; + } + + /* Now, update everything... */ + doupdate (); + } + + + delwin (dialog); + free (status); + return -1; /* ESC pressed */ +} diff --git a/config/scripts/config/lxdialog/colors.h b/config/scripts/config/lxdialog/colors.h new file mode 100644 index 0000000000..d34dd37c6f --- /dev/null +++ b/config/scripts/config/lxdialog/colors.h @@ -0,0 +1,161 @@ +/* + * colors.h -- color attribute definitions + * + * AUTHOR: Savio Lam (lam836@cs.cuhk.hk) + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + + +/* + * Default color definitions + * + * *_FG = foreground + * *_BG = background + * *_HL = highlight? + */ +#define SCREEN_FG COLOR_CYAN +#define SCREEN_BG COLOR_BLUE +#define SCREEN_HL TRUE + +#define SHADOW_FG COLOR_BLACK +#define SHADOW_BG COLOR_BLACK +#define SHADOW_HL TRUE + +#define DIALOG_FG COLOR_BLACK +#define DIALOG_BG COLOR_WHITE +#define DIALOG_HL FALSE + +#define TITLE_FG COLOR_YELLOW +#define TITLE_BG COLOR_WHITE +#define TITLE_HL TRUE + +#define BORDER_FG COLOR_WHITE +#define BORDER_BG COLOR_WHITE +#define BORDER_HL TRUE + +#define BUTTON_ACTIVE_FG COLOR_WHITE +#define BUTTON_ACTIVE_BG COLOR_BLUE +#define BUTTON_ACTIVE_HL TRUE + +#define BUTTON_INACTIVE_FG COLOR_BLACK +#define BUTTON_INACTIVE_BG COLOR_WHITE +#define BUTTON_INACTIVE_HL FALSE + +#define BUTTON_KEY_ACTIVE_FG COLOR_WHITE +#define BUTTON_KEY_ACTIVE_BG COLOR_BLUE +#define BUTTON_KEY_ACTIVE_HL TRUE + +#define BUTTON_KEY_INACTIVE_FG COLOR_RED +#define BUTTON_KEY_INACTIVE_BG COLOR_WHITE +#define BUTTON_KEY_INACTIVE_HL FALSE + +#define BUTTON_LABEL_ACTIVE_FG COLOR_YELLOW +#define BUTTON_LABEL_ACTIVE_BG COLOR_BLUE +#define BUTTON_LABEL_ACTIVE_HL TRUE + +#define BUTTON_LABEL_INACTIVE_FG COLOR_BLACK +#define BUTTON_LABEL_INACTIVE_BG COLOR_WHITE +#define BUTTON_LABEL_INACTIVE_HL TRUE + +#define INPUTBOX_FG COLOR_BLACK +#define INPUTBOX_BG COLOR_WHITE +#define INPUTBOX_HL FALSE + +#define INPUTBOX_BORDER_FG COLOR_BLACK +#define INPUTBOX_BORDER_BG COLOR_WHITE +#define INPUTBOX_BORDER_HL FALSE + +#define SEARCHBOX_FG COLOR_BLACK +#define SEARCHBOX_BG COLOR_WHITE +#define SEARCHBOX_HL FALSE + +#define SEARCHBOX_TITLE_FG COLOR_YELLOW +#define SEARCHBOX_TITLE_BG COLOR_WHITE +#define SEARCHBOX_TITLE_HL TRUE + +#define SEARCHBOX_BORDER_FG COLOR_WHITE +#define SEARCHBOX_BORDER_BG COLOR_WHITE +#define SEARCHBOX_BORDER_HL TRUE + +#define POSITION_INDICATOR_FG COLOR_YELLOW +#define POSITION_INDICATOR_BG COLOR_WHITE +#define POSITION_INDICATOR_HL TRUE + +#define MENUBOX_FG COLOR_BLACK +#define MENUBOX_BG COLOR_WHITE +#define MENUBOX_HL FALSE + +#define MENUBOX_BORDER_FG COLOR_WHITE +#define MENUBOX_BORDER_BG COLOR_WHITE +#define MENUBOX_BORDER_HL TRUE + +#define ITEM_FG COLOR_BLACK +#define ITEM_BG COLOR_WHITE +#define ITEM_HL FALSE + +#define ITEM_SELECTED_FG COLOR_WHITE +#define ITEM_SELECTED_BG COLOR_BLUE +#define ITEM_SELECTED_HL TRUE + +#define TAG_FG COLOR_YELLOW +#define TAG_BG COLOR_WHITE +#define TAG_HL TRUE + +#define TAG_SELECTED_FG COLOR_YELLOW +#define TAG_SELECTED_BG COLOR_BLUE +#define TAG_SELECTED_HL TRUE + +#define TAG_KEY_FG COLOR_YELLOW +#define TAG_KEY_BG COLOR_WHITE +#define TAG_KEY_HL TRUE + +#define TAG_KEY_SELECTED_FG COLOR_YELLOW +#define TAG_KEY_SELECTED_BG COLOR_BLUE +#define TAG_KEY_SELECTED_HL TRUE + +#define CHECK_FG COLOR_BLACK +#define CHECK_BG COLOR_WHITE +#define CHECK_HL FALSE + +#define CHECK_SELECTED_FG COLOR_WHITE +#define CHECK_SELECTED_BG COLOR_BLUE +#define CHECK_SELECTED_HL TRUE + +#define UARROW_FG COLOR_GREEN +#define UARROW_BG COLOR_WHITE +#define UARROW_HL TRUE + +#define DARROW_FG COLOR_GREEN +#define DARROW_BG COLOR_WHITE +#define DARROW_HL TRUE + +/* End of default color definitions */ + +#define C_ATTR(x,y) ((x ? A_BOLD : 0) | COLOR_PAIR((y))) +#define COLOR_NAME_LEN 10 +#define COLOR_COUNT 8 + +/* + * Global variables + */ + +typedef struct { + char name[COLOR_NAME_LEN]; + int value; +} color_names_st; + +extern color_names_st color_names[]; +extern int color_table[][3]; diff --git a/config/scripts/config/lxdialog/dialog.h b/config/scripts/config/lxdialog/dialog.h new file mode 100644 index 0000000000..7bab3ad0e1 --- /dev/null +++ b/config/scripts/config/lxdialog/dialog.h @@ -0,0 +1,199 @@ + +/* + * dialog.h -- common declarations for all dialog modules + * + * AUTHOR: Savio Lam (lam836@cs.cuhk.hk) + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include +#include +#include +#include +#include +#include + +#ifdef CURSES_LOC +#ifdef __sun__ +#define CURS_MACROS +#endif +#include CURSES_LOC + +/* + * Colors in ncurses 1.9.9e do not work properly since foreground and + * background colors are OR'd rather than separately masked. This version + * of dialog was hacked to work with ncurses 1.9.9e, making it incompatible + * with standard curses. The simplest fix (to make this work with standard + * curses) uses the wbkgdset() function, not used in the original hack. + * Turn it off if we're building with 1.9.9e, since it just confuses things. + */ +#if defined(NCURSES_VERSION) && defined(_NEED_WRAP) && !defined(GCC_PRINTFLIKE) +#define OLD_NCURSES 1 +#undef wbkgdset +#define wbkgdset(w,p) /*nothing*/ +#else +#define OLD_NCURSES 0 +#endif + +#define TR(params) _tracef params + +#define ESC 27 +#define TAB 9 +#define MAX_LEN 2048 +#define BUF_SIZE (10*1024) +#define MIN(x,y) (x < y ? x : y) +#define MAX(x,y) (x > y ? x : y) + + +#ifndef ACS_ULCORNER +#define ACS_ULCORNER '+' +#endif +#ifndef ACS_LLCORNER +#define ACS_LLCORNER '+' +#endif +#ifndef ACS_URCORNER +#define ACS_URCORNER '+' +#endif +#ifndef ACS_LRCORNER +#define ACS_LRCORNER '+' +#endif +#ifndef ACS_HLINE +#define ACS_HLINE '-' +#endif +#ifndef ACS_VLINE +#define ACS_VLINE '|' +#endif +#ifndef ACS_LTEE +#define ACS_LTEE '+' +#endif +#ifndef ACS_RTEE +#define ACS_RTEE '+' +#endif +#ifndef ACS_UARROW +#define ACS_UARROW '^' +#endif +#ifndef ACS_DARROW +#define ACS_DARROW 'v' +#endif + +/* + * Attribute names + */ +#define screen_attr attributes[0] +#define shadow_attr attributes[1] +#define dialog_attr attributes[2] +#define title_attr attributes[3] +#define border_attr attributes[4] +#define button_active_attr attributes[5] +#define button_inactive_attr attributes[6] +#define button_key_active_attr attributes[7] +#define button_key_inactive_attr attributes[8] +#define button_label_active_attr attributes[9] +#define button_label_inactive_attr attributes[10] +#define inputbox_attr attributes[11] +#define inputbox_border_attr attributes[12] +#define searchbox_attr attributes[13] +#define searchbox_title_attr attributes[14] +#define searchbox_border_attr attributes[15] +#define position_indicator_attr attributes[16] +#define menubox_attr attributes[17] +#define menubox_border_attr attributes[18] +#define item_attr attributes[19] +#define item_selected_attr attributes[20] +#define tag_attr attributes[21] +#define tag_selected_attr attributes[22] +#define tag_key_attr attributes[23] +#define tag_key_selected_attr attributes[24] +#define check_attr attributes[25] +#define check_selected_attr attributes[26] +#define uarrow_attr attributes[27] +#define darrow_attr attributes[28] + +/* number of attributes */ +#define ATTRIBUTE_COUNT 29 + +/* + * Global variables + */ +extern bool use_colors; + +extern chtype attributes[]; +#endif + +extern const char *backtitle; + +struct dialog_list_item { + char *name; + int namelen; + char *tag; + int selected; /* Set to 1 by dialog_*() function. */ +}; + +/* + * Function prototypes + */ + +void init_dialog (void); +void end_dialog (void); +void dialog_clear (void); +#ifdef CURSES_LOC +void attr_clear (WINDOW * win, int height, int width, chtype attr); +void color_setup (void); +void print_autowrap (WINDOW * win, const char *prompt, int width, int y, int x); +void print_button (WINDOW * win, const char *label, int y, int x, int selected); +void draw_box (WINDOW * win, int y, int x, int height, int width, chtype box, + chtype border); +void draw_shadow (WINDOW * win, int y, int x, int height, int width); +#endif + +int first_alpha (const char *string, const char *exempt); +int dialog_yesno (const char *title, const char *prompt, int height, int width); +int dialog_msgbox (const char *title, const char *prompt, int height, + int width, int pause); +int dialog_textbox (const char *title, const char *file, int height, int width); +int dialog_menu (const char *title, const char *prompt, int height, int width, + int menu_height, const char *choice, int item_no, + struct dialog_list_item ** items); +int dialog_checklist (const char *title, const char *prompt, int height, + int width, int list_height, int item_no, + struct dialog_list_item ** items, int flag); +extern unsigned char dialog_input_result[]; +int dialog_inputbox (const char *title, const char *prompt, int height, + int width, const char *init); + +struct dialog_list_item *first_sel_item(int item_no, + struct dialog_list_item ** items); + +/* + * This is the base for fictitious keys, which activate + * the buttons. + * + * Mouse-generated keys are the following: + * -- the first 32 are used as numbers, in addition to '0'-'9' + * -- the lowercase are used to signal mouse-enter events (M_EVENT + 'o') + * -- uppercase chars are used to invoke the button (M_EVENT + 'O') + */ +#ifdef CURSES_LOC +#define M_EVENT (KEY_MAX+1) +#endif + + +/* + * The `flag' parameter in checklist is used to select between + * radiolist and checklist + */ +#define FLAG_CHECK 1 +#define FLAG_RADIO 0 diff --git a/config/scripts/config/lxdialog/inputbox.c b/config/scripts/config/lxdialog/inputbox.c new file mode 100644 index 0000000000..fa7bebc693 --- /dev/null +++ b/config/scripts/config/lxdialog/inputbox.c @@ -0,0 +1,240 @@ +/* + * inputbox.c -- implements the input box + * + * ORIGINAL AUTHOR: Savio Lam (lam836@cs.cuhk.hk) + * MODIFIED FOR LINUX KERNEL CONFIG BY: William Roadcap (roadcap@cfw.com) + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include "dialog.h" + +unsigned char dialog_input_result[MAX_LEN + 1]; + +/* + * Print the termination buttons + */ +static void +print_buttons(WINDOW *dialog, int height, int width, int selected) +{ + int x = width / 2 - 11; + int y = height - 2; + + print_button (dialog, " Ok ", y, x, selected==0); + print_button (dialog, " Help ", y, x + 14, selected==1); + + wmove(dialog, y, x+1+14*selected); + wrefresh(dialog); +} + +/* + * Display a dialog box for inputing a string + */ +int +dialog_inputbox (const char *title, const char *prompt, int height, int width, + const char *init) +{ + int i, x, y, box_y, box_x, box_width; + int input_x = 0, scroll = 0, key = 0, button = -1; + unsigned char *instr = dialog_input_result; + WINDOW *dialog; + + /* center dialog box on screen */ + x = (COLS - width) / 2; + y = (LINES - height) / 2; + + + draw_shadow (stdscr, y, x, height, width); + + dialog = newwin (height, width, y, x); + keypad (dialog, TRUE); + + draw_box (dialog, 0, 0, height, width, dialog_attr, border_attr); + wattrset (dialog, border_attr); + mvwaddch (dialog, height-3, 0, ACS_LTEE); + for (i = 0; i < width - 2; i++) + waddch (dialog, ACS_HLINE); + wattrset (dialog, dialog_attr); + waddch (dialog, ACS_RTEE); + + if (title != NULL && strlen(title) >= width-2 ) { + /* truncate long title -- mec */ + char * title2 = malloc(width-2+1); + memcpy( title2, title, width-2 ); + title2[width-2] = '\0'; + title = title2; + } + + if (title != NULL) { + wattrset (dialog, title_attr); + mvwaddch (dialog, 0, (width - strlen(title))/2 - 1, ' '); + waddstr (dialog, (char *)title); + waddch (dialog, ' '); + } + + wattrset (dialog, dialog_attr); + print_autowrap (dialog, prompt, width - 2, 1, 3); + + /* Draw the input field box */ + box_width = width - 6; + getyx (dialog, y, x); + box_y = y + 2; + box_x = (width - box_width) / 2; + draw_box (dialog, y + 1, box_x - 1, 3, box_width + 2, + border_attr, dialog_attr); + + print_buttons(dialog, height, width, 0); + + /* Set up the initial value */ + wmove (dialog, box_y, box_x); + wattrset (dialog, inputbox_attr); + + if (!init) + instr[0] = '\0'; + else + strcpy (instr, init); + + input_x = strlen (instr); + + if (input_x >= box_width) { + scroll = input_x - box_width + 1; + input_x = box_width - 1; + for (i = 0; i < box_width - 1; i++) + waddch (dialog, instr[scroll + i]); + } else + waddstr (dialog, instr); + + wmove (dialog, box_y, box_x + input_x); + + wrefresh (dialog); + + while (key != ESC) { + key = wgetch (dialog); + + if (button == -1) { /* Input box selected */ + switch (key) { + case TAB: + case KEY_UP: + case KEY_DOWN: + break; + case KEY_LEFT: + continue; + case KEY_RIGHT: + continue; + case KEY_BACKSPACE: + case 127: + if (input_x || scroll) { + wattrset (dialog, inputbox_attr); + if (!input_x) { + scroll = scroll < box_width - 1 ? + 0 : scroll - (box_width - 1); + wmove (dialog, box_y, box_x); + for (i = 0; i < box_width; i++) + waddch (dialog, instr[scroll + input_x + i] ? + instr[scroll + input_x + i] : ' '); + input_x = strlen (instr) - scroll; + } else + input_x--; + instr[scroll + input_x] = '\0'; + mvwaddch (dialog, box_y, input_x + box_x, ' '); + wmove (dialog, box_y, input_x + box_x); + wrefresh (dialog); + } + continue; + default: + if (key < 0x100 && isprint (key)) { + if (scroll + input_x < MAX_LEN) { + wattrset (dialog, inputbox_attr); + instr[scroll + input_x] = key; + instr[scroll + input_x + 1] = '\0'; + if (input_x == box_width - 1) { + scroll++; + wmove (dialog, box_y, box_x); + for (i = 0; i < box_width - 1; i++) + waddch (dialog, instr[scroll + i]); + } else { + wmove (dialog, box_y, input_x++ + box_x); + waddch (dialog, key); + } + wrefresh (dialog); + } else + flash (); /* Alarm user about overflow */ + continue; + } + } + } + switch (key) { + case 'O': + case 'o': + delwin (dialog); + return 0; + case 'H': + case 'h': + delwin (dialog); + return 1; + case KEY_UP: + case KEY_LEFT: + switch (button) { + case -1: + button = 1; /* Indicates "Cancel" button is selected */ + print_buttons(dialog, height, width, 1); + break; + case 0: + button = -1; /* Indicates input box is selected */ + print_buttons(dialog, height, width, 0); + wmove (dialog, box_y, box_x + input_x); + wrefresh (dialog); + break; + case 1: + button = 0; /* Indicates "OK" button is selected */ + print_buttons(dialog, height, width, 0); + break; + } + break; + case TAB: + case KEY_DOWN: + case KEY_RIGHT: + switch (button) { + case -1: + button = 0; /* Indicates "OK" button is selected */ + print_buttons(dialog, height, width, 0); + break; + case 0: + button = 1; /* Indicates "Cancel" button is selected */ + print_buttons(dialog, height, width, 1); + break; + case 1: + button = -1; /* Indicates input box is selected */ + print_buttons(dialog, height, width, 0); + wmove (dialog, box_y, box_x + input_x); + wrefresh (dialog); + break; + } + break; + case ' ': + case '\n': + delwin (dialog); + return (button == -1 ? 0 : button); + case 'X': + case 'x': + key = ESC; + case ESC: + break; + } + } + + delwin (dialog); + return -1; /* ESC pressed */ +} diff --git a/config/scripts/config/lxdialog/menubox.c b/config/scripts/config/lxdialog/menubox.c new file mode 100644 index 0000000000..873dc587b8 --- /dev/null +++ b/config/scripts/config/lxdialog/menubox.c @@ -0,0 +1,438 @@ +/* + * menubox.c -- implements the menu box + * + * ORIGINAL AUTHOR: Savio Lam (lam836@cs.cuhk.hk) + * MODIFIED FOR LINUX KERNEL CONFIG BY: William Roadcap (roadcapw@cfw.com) + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +/* + * Changes by Clifford Wolf (god@clifford.at) + * + * [ 1998-06-13 ] + * + * *) A bugfix for the Page-Down problem + * + * *) Formerly when I used Page Down and Page Up, the cursor would be set + * to the first position in the menu box. Now lxdialog is a bit + * smarter and works more like other menu systems (just have a look at + * it). + * + * *) Formerly if I selected something my scrolling would be broken because + * lxdialog is re-invoked by the Menuconfig shell script, can't + * remember the last scrolling position, and just sets it so that the + * cursor is at the bottom of the box. Now it writes the temporary file + * lxdialog.scrltmp which contains this information. The file is + * deleted by lxdialog if the user leaves a submenu or enters a new + * one, but it would be nice if Menuconfig could make another "rm -f" + * just to be sure. Just try it out - you will recognise a difference! + * + * [ 1998-06-14 ] + * + * *) Now lxdialog is crash-safe against broken "lxdialog.scrltmp" files + * and menus change their size on the fly. + * + * *) If for some reason the last scrolling position is not saved by + * lxdialog, it sets the scrolling so that the selected item is in the + * middle of the menu box, not at the bottom. + * + * 02 January 1999, Michael Elizabeth Chastain (mec@shout.net) + * Reset 'scroll' to 0 if the value from lxdialog.scrltmp is bogus. + * This fixes a bug in Menuconfig where using ' ' to descend into menus + * would leave mis-synchronized lxdialog.scrltmp files lying around, + * fscanf would read in 'scroll', and eventually that value would get used. + */ + +#include "dialog.h" + +static int menu_width, item_x; + +/* + * Print menu item + */ +static void +print_item (WINDOW * win, const char *item, int choice, int selected, int hotkey) +{ + int j; + char menu_item[menu_width+1]; + + strncpy(menu_item, item, menu_width); + menu_item[menu_width] = 0; + j = first_alpha(menu_item, "YyNnMmHh"); + + /* Clear 'residue' of last item */ + wattrset (win, menubox_attr); + wmove (win, choice, 0); +#if OLD_NCURSES + { + int i; + for (i = 0; i < menu_width; i++) + waddch (win, ' '); + } +#else + wclrtoeol(win); +#endif + wattrset (win, selected ? item_selected_attr : item_attr); + mvwaddstr (win, choice, item_x, menu_item); + if (hotkey) { + wattrset (win, selected ? tag_key_selected_attr : tag_key_attr); + mvwaddch(win, choice, item_x+j, menu_item[j]); + } + if (selected) { + wmove (win, choice, item_x+1); + wrefresh (win); + } +} + +/* + * Print the scroll indicators. + */ +static void +print_arrows (WINDOW * win, int item_no, int scroll, + int y, int x, int height) +{ + int cur_y, cur_x; + + getyx(win, cur_y, cur_x); + + wmove(win, y, x); + + if (scroll > 0) { + wattrset (win, uarrow_attr); + waddch (win, ACS_UARROW); + waddstr (win, "(-)"); + } + else { + wattrset (win, menubox_attr); + waddch (win, ACS_HLINE); + waddch (win, ACS_HLINE); + waddch (win, ACS_HLINE); + waddch (win, ACS_HLINE); + } + + y = y + height + 1; + wmove(win, y, x); + + if ((height < item_no) && (scroll + height < item_no)) { + wattrset (win, darrow_attr); + waddch (win, ACS_DARROW); + waddstr (win, "(+)"); + } + else { + wattrset (win, menubox_border_attr); + waddch (win, ACS_HLINE); + waddch (win, ACS_HLINE); + waddch (win, ACS_HLINE); + waddch (win, ACS_HLINE); + } + + wmove(win, cur_y, cur_x); +} + +/* + * Display the termination buttons. + */ +static void +print_buttons (WINDOW *win, int height, int width, int selected) +{ + int x = width / 2 - 16; + int y = height - 2; + + print_button (win, "Select", y, x, selected == 0); + print_button (win, " Exit ", y, x + 12, selected == 1); + print_button (win, " Help ", y, x + 24, selected == 2); + + wmove(win, y, x+1+12*selected); + wrefresh (win); +} + +/* + * Display a menu for choosing among a number of options + */ +int +dialog_menu (const char *title, const char *prompt, int height, int width, + int menu_height, const char *current, int item_no, + struct dialog_list_item ** items) +{ + int i, j, x, y, box_x, box_y; + int key = 0, button = 0, scroll = 0, choice = 0, first_item = 0, max_choice; + WINDOW *dialog, *menu; + FILE *f; + + max_choice = MIN (menu_height, item_no); + + /* center dialog box on screen */ + x = (COLS - width) / 2; + y = (LINES - height) / 2; + + draw_shadow (stdscr, y, x, height, width); + + dialog = newwin (height, width, y, x); + keypad (dialog, TRUE); + + draw_box (dialog, 0, 0, height, width, dialog_attr, border_attr); + wattrset (dialog, border_attr); + mvwaddch (dialog, height - 3, 0, ACS_LTEE); + for (i = 0; i < width - 2; i++) + waddch (dialog, ACS_HLINE); + wattrset (dialog, dialog_attr); + wbkgdset (dialog, dialog_attr & A_COLOR); + waddch (dialog, ACS_RTEE); + + if (title != NULL && strlen(title) >= width-2 ) { + /* truncate long title -- mec */ + char * title2 = malloc(width-2+1); + memcpy( title2, title, width-2 ); + title2[width-2] = '\0'; + title = title2; + } + + if (title != NULL) { + wattrset (dialog, title_attr); + mvwaddch (dialog, 0, (width - strlen(title))/2 - 1, ' '); + waddstr (dialog, (char *)title); + waddch (dialog, ' '); + } + + wattrset (dialog, dialog_attr); + print_autowrap (dialog, prompt, width - 2, 1, 3); + + menu_width = width - 6; + box_y = height - menu_height - 5; + box_x = (width - menu_width) / 2 - 1; + + /* create new window for the menu */ + menu = subwin (dialog, menu_height, menu_width, + y + box_y + 1, x + box_x + 1); + keypad (menu, TRUE); + + /* draw a box around the menu items */ + draw_box (dialog, box_y, box_x, menu_height + 2, menu_width + 2, + menubox_border_attr, menubox_attr); + + /* + * Find length of longest item in order to center menu. + * Set 'choice' to default item. + */ + item_x = 0; + for (i = 0; i < item_no; i++) { + item_x = MAX (item_x, MIN(menu_width, strlen (items[i]->name) + 2)); + if (strcmp(current, items[i]->tag) == 0) choice = i; + } + + item_x = (menu_width - item_x) / 2; + + /* get the scroll info from the temp file */ + if ( (f=fopen("lxdialog.scrltmp","r")) != NULL ) { + if ( (fscanf(f,"%d\n",&scroll) == 1) && (scroll <= choice) && + (scroll+max_choice > choice) && (scroll >= 0) && + (scroll+max_choice <= item_no) ) { + first_item = scroll; + choice = choice - scroll; + fclose(f); + } else { + scroll=0; + remove("lxdialog.scrltmp"); + fclose(f); + f=NULL; + } + } + if ( (choice >= max_choice) || (f==NULL && choice >= max_choice/2) ) { + if (choice >= item_no-max_choice/2) + scroll = first_item = item_no-max_choice; + else + scroll = first_item = choice - max_choice/2; + choice = choice - scroll; + } + + /* Print the menu */ + for (i=0; i < max_choice; i++) { + print_item (menu, items[first_item + i]->name, i, i == choice, + (items[first_item + i]->tag[0] != ':')); + } + + wnoutrefresh (menu); + + print_arrows(dialog, item_no, scroll, + box_y, box_x+item_x+1, menu_height); + + print_buttons (dialog, height, width, 0); + wmove (menu, choice, item_x+1); + wrefresh (menu); + + while (key != ESC) { + key = wgetch(menu); + + if (key < 256 && isalpha(key)) key = tolower(key); + + if (strchr("ynmh", key)) + i = max_choice; + else { + for (i = choice+1; i < max_choice; i++) { + j = first_alpha(items[scroll + i]->name, "YyNnMmHh"); + if (key == tolower(items[scroll + i]->name[j])) + break; + } + if (i == max_choice) + for (i = 0; i < max_choice; i++) { + j = first_alpha(items[scroll + i]->name, "YyNnMmHh"); + if (key == tolower(items[scroll + i]->name[j])) + break; + } + } + + if (i < max_choice || + key == KEY_UP || key == KEY_DOWN || + key == '-' || key == '+' || + key == KEY_PPAGE || key == KEY_NPAGE) { + + print_item (menu, items[scroll + choice]->name, choice, FALSE, + (items[scroll + choice]->tag[0] != ':')); + + if (key == KEY_UP || key == '-') { + if (choice < 2 && scroll) { + /* Scroll menu down */ + scrollok (menu, TRUE); + wscrl (menu, -1); + scrollok (menu, FALSE); + + scroll--; + + print_item (menu, items[scroll]->name, 0, FALSE, + (items[scroll]->tag[0] != ':')); + } else + choice = MAX(choice - 1, 0); + + } else if (key == KEY_DOWN || key == '+') { + + print_item (menu, items[scroll + choice]->name, choice, FALSE, + (items[scroll + choice]->tag[0] != ':')); + + if ((choice > max_choice-3) && + (scroll + max_choice < item_no) + ) { + /* Scroll menu up */ + scrollok (menu, TRUE); + scroll (menu); + scrollok (menu, FALSE); + + scroll++; + + print_item (menu, items[scroll + max_choice - 1]->name, + max_choice-1, FALSE, + (items[scroll + max_choice - 1]->tag[0] != ':')); + } else + choice = MIN(choice+1, max_choice-1); + + } else if (key == KEY_PPAGE) { + scrollok (menu, TRUE); + for (i=0; (i < max_choice); i++) { + if (scroll > 0) { + wscrl (menu, -1); + scroll--; + print_item (menu, items[scroll]->name, 0, FALSE, + (items[scroll]->tag[0] != ':')); + } else { + if (choice > 0) + choice--; + } + } + scrollok (menu, FALSE); + + } else if (key == KEY_NPAGE) { + for (i=0; (i < max_choice); i++) { + if (scroll+max_choice < item_no) { + scrollok (menu, TRUE); + scroll(menu); + scrollok (menu, FALSE); + scroll++; + print_item (menu, items[scroll + max_choice - 1]->name, + max_choice-1, FALSE, + (items[scroll + max_choice - 1]->tag[0] != ':')); + } else { + if (choice+1 < max_choice) + choice++; + } + } + + } else + choice = i; + + print_item (menu, items[scroll + choice]->name, choice, TRUE, + (items[scroll + choice]->tag[0] != ':')); + + print_arrows(dialog, item_no, scroll, + box_y, box_x+item_x+1, menu_height); + + wnoutrefresh (dialog); + wrefresh (menu); + + continue; /* wait for another key press */ + } + + switch (key) { + case KEY_LEFT: + case TAB: + case KEY_RIGHT: + button = ((key == KEY_LEFT ? --button : ++button) < 0) + ? 2 : (button > 2 ? 0 : button); + + print_buttons(dialog, height, width, button); + wrefresh (menu); + break; + case ' ': + case 's': + case 'y': + case 'n': + case 'm': + case '/': + /* save scroll info */ + if ( (f=fopen("lxdialog.scrltmp","w")) != NULL ) { + fprintf(f,"%d\n",scroll); + fclose(f); + } + delwin (dialog); + items[scroll + choice]->selected = 1; + switch (key) { + case 's': return 3; + case 'y': return 3; + case 'n': return 4; + case 'm': return 5; + case ' ': return 6; + case '/': return 7; + } + return 0; + case 'h': + case '?': + button = 2; + case '\n': + delwin (dialog); + items[scroll + choice]->selected = 1; + + remove("lxdialog.scrltmp"); + return button; + case 'e': + case 'x': + key = ESC; + case ESC: + break; + } + } + + delwin (dialog); + remove("lxdialog.scrltmp"); + return -1; /* ESC pressed */ +} diff --git a/config/scripts/config/lxdialog/msgbox.c b/config/scripts/config/lxdialog/msgbox.c new file mode 100644 index 0000000000..93692e1fbc --- /dev/null +++ b/config/scripts/config/lxdialog/msgbox.c @@ -0,0 +1,85 @@ +/* + * msgbox.c -- implements the message box and info box + * + * ORIGINAL AUTHOR: Savio Lam (lam836@cs.cuhk.hk) + * MODIFIED FOR LINUX KERNEL CONFIG BY: William Roadcap (roadcapw@cfw.com) + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include "dialog.h" + +/* + * Display a message box. Program will pause and display an "OK" button + * if the parameter 'pause' is non-zero. + */ +int +dialog_msgbox (const char *title, const char *prompt, int height, int width, + int pause) +{ + int i, x, y, key = 0; + WINDOW *dialog; + + /* center dialog box on screen */ + x = (COLS - width) / 2; + y = (LINES - height) / 2; + + draw_shadow (stdscr, y, x, height, width); + + dialog = newwin (height, width, y, x); + keypad (dialog, TRUE); + + draw_box (dialog, 0, 0, height, width, dialog_attr, border_attr); + + if (title != NULL && strlen(title) >= width-2 ) { + /* truncate long title -- mec */ + char * title2 = malloc(width-2+1); + memcpy( title2, title, width-2 ); + title2[width-2] = '\0'; + title = title2; + } + + if (title != NULL) { + wattrset (dialog, title_attr); + mvwaddch (dialog, 0, (width - strlen(title))/2 - 1, ' '); + waddstr (dialog, (char *)title); + waddch (dialog, ' '); + } + wattrset (dialog, dialog_attr); + print_autowrap (dialog, prompt, width - 2, 1, 2); + + if (pause) { + wattrset (dialog, border_attr); + mvwaddch (dialog, height - 3, 0, ACS_LTEE); + for (i = 0; i < width - 2; i++) + waddch (dialog, ACS_HLINE); + wattrset (dialog, dialog_attr); + waddch (dialog, ACS_RTEE); + + print_button (dialog, " Ok ", + height - 2, width / 2 - 4, TRUE); + + wrefresh (dialog); + while (key != ESC && key != '\n' && key != ' ' && + key != 'O' && key != 'o' && key != 'X' && key != 'x') + key = wgetch (dialog); + } else { + key = '\n'; + wrefresh (dialog); + } + + delwin (dialog); + return key == ESC ? -1 : 0; +} diff --git a/config/scripts/config/lxdialog/textbox.c b/config/scripts/config/lxdialog/textbox.c new file mode 100644 index 0000000000..a5a460b5cc --- /dev/null +++ b/config/scripts/config/lxdialog/textbox.c @@ -0,0 +1,556 @@ +/* + * textbox.c -- implements the text box + * + * ORIGINAL AUTHOR: Savio Lam (lam836@cs.cuhk.hk) + * MODIFIED FOR LINUX KERNEL CONFIG BY: William Roadcap (roadcap@cfw.com) + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include "dialog.h" + +static void back_lines (int n); +static void print_page (WINDOW * win, int height, int width); +static void print_line (WINDOW * win, int row, int width); +static char *get_line (void); +static void print_position (WINDOW * win, int height, int width); + +static int hscroll, fd, file_size, bytes_read; +static int begin_reached = 1, end_reached, page_length; +static char *buf, *page; + +/* + * Display text from a file in a dialog box. + */ +int +dialog_textbox (const char *title, const char *file, int height, int width) +{ + int i, x, y, cur_x, cur_y, fpos, key = 0; + int passed_end; + char search_term[MAX_LEN + 1]; + WINDOW *dialog, *text; + + search_term[0] = '\0'; /* no search term entered yet */ + + /* Open input file for reading */ + if ((fd = open (file, O_RDONLY)) == -1) { + endwin (); + fprintf (stderr, + "\nCan't open input file in dialog_textbox().\n"); + exit (-1); + } + /* Get file size. Actually, 'file_size' is the real file size - 1, + since it's only the last byte offset from the beginning */ + if ((file_size = lseek (fd, 0, SEEK_END)) == -1) { + endwin (); + fprintf (stderr, "\nError getting file size in dialog_textbox().\n"); + exit (-1); + } + /* Restore file pointer to beginning of file after getting file size */ + if (lseek (fd, 0, SEEK_SET) == -1) { + endwin (); + fprintf (stderr, "\nError moving file pointer in dialog_textbox().\n"); + exit (-1); + } + /* Allocate space for read buffer */ + if ((buf = malloc (BUF_SIZE + 1)) == NULL) { + endwin (); + fprintf (stderr, "\nCan't allocate memory in dialog_textbox().\n"); + exit (-1); + } + if ((bytes_read = read (fd, buf, BUF_SIZE)) == -1) { + endwin (); + fprintf (stderr, "\nError reading file in dialog_textbox().\n"); + exit (-1); + } + buf[bytes_read] = '\0'; /* mark end of valid data */ + page = buf; /* page is pointer to start of page to be displayed */ + + /* center dialog box on screen */ + x = (COLS - width) / 2; + y = (LINES - height) / 2; + + + draw_shadow (stdscr, y, x, height, width); + + dialog = newwin (height, width, y, x); + keypad (dialog, TRUE); + + /* Create window for text region, used for scrolling text */ + text = subwin (dialog, height - 4, width - 2, y + 1, x + 1); + wattrset (text, dialog_attr); + wbkgdset (text, dialog_attr & A_COLOR); + + keypad (text, TRUE); + + /* register the new window, along with its borders */ + draw_box (dialog, 0, 0, height, width, dialog_attr, border_attr); + + wattrset (dialog, border_attr); + mvwaddch (dialog, height-3, 0, ACS_LTEE); + for (i = 0; i < width - 2; i++) + waddch (dialog, ACS_HLINE); + wattrset (dialog, dialog_attr); + wbkgdset (dialog, dialog_attr & A_COLOR); + waddch (dialog, ACS_RTEE); + + if (title != NULL && strlen(title) >= width-2 ) { + /* truncate long title -- mec */ + char * title2 = malloc(width-2+1); + memcpy( title2, title, width-2 ); + title2[width-2] = '\0'; + title = title2; + } + + if (title != NULL) { + wattrset (dialog, title_attr); + mvwaddch (dialog, 0, (width - strlen(title))/2 - 1, ' '); + waddstr (dialog, (char *)title); + waddch (dialog, ' '); + } + print_button (dialog, " Exit ", height - 2, width / 2 - 4, TRUE); + wnoutrefresh (dialog); + getyx (dialog, cur_y, cur_x); /* Save cursor position */ + + /* Print first page of text */ + attr_clear (text, height - 4, width - 2, dialog_attr); + print_page (text, height - 4, width - 2); + print_position (dialog, height, width); + wmove (dialog, cur_y, cur_x); /* Restore cursor position */ + wrefresh (dialog); + + while ((key != ESC) && (key != '\n')) { + key = wgetch (dialog); + switch (key) { + case 'E': /* Exit */ + case 'e': + case 'X': + case 'x': + delwin (dialog); + free (buf); + close (fd); + return 0; + case 'g': /* First page */ + case KEY_HOME: + if (!begin_reached) { + begin_reached = 1; + /* First page not in buffer? */ + if ((fpos = lseek (fd, 0, SEEK_CUR)) == -1) { + endwin (); + fprintf (stderr, + "\nError moving file pointer in dialog_textbox().\n"); + exit (-1); + } + if (fpos > bytes_read) { /* Yes, we have to read it in */ + if (lseek (fd, 0, SEEK_SET) == -1) { + endwin (); + fprintf (stderr, "\nError moving file pointer in " + "dialog_textbox().\n"); + exit (-1); + } + if ((bytes_read = read (fd, buf, BUF_SIZE)) == -1) { + endwin (); + fprintf (stderr, + "\nError reading file in dialog_textbox().\n"); + exit (-1); + } + buf[bytes_read] = '\0'; + } + page = buf; + print_page (text, height - 4, width - 2); + print_position (dialog, height, width); + wmove (dialog, cur_y, cur_x); /* Restore cursor position */ + wrefresh (dialog); + } + break; + case 'G': /* Last page */ + case KEY_END: + + end_reached = 1; + /* Last page not in buffer? */ + if ((fpos = lseek (fd, 0, SEEK_CUR)) == -1) { + endwin (); + fprintf (stderr, + "\nError moving file pointer in dialog_textbox().\n"); + exit (-1); + } + if (fpos < file_size) { /* Yes, we have to read it in */ + if (lseek (fd, -BUF_SIZE, SEEK_END) == -1) { + endwin (); + fprintf (stderr, + "\nError moving file pointer in dialog_textbox().\n"); + exit (-1); + } + if ((bytes_read = read (fd, buf, BUF_SIZE)) == -1) { + endwin (); + fprintf (stderr, + "\nError reading file in dialog_textbox().\n"); + exit (-1); + } + buf[bytes_read] = '\0'; + } + page = buf + bytes_read; + back_lines (height - 4); + print_page (text, height - 4, width - 2); + print_position (dialog, height, width); + wmove (dialog, cur_y, cur_x); /* Restore cursor position */ + wrefresh (dialog); + break; + case 'K': /* Previous line */ + case 'k': + case KEY_UP: + if (!begin_reached) { + back_lines (page_length + 1); + + /* We don't call print_page() here but use scrolling to ensure + faster screen update. However, 'end_reached' and + 'page_length' should still be updated, and 'page' should + point to start of next page. This is done by calling + get_line() in the following 'for' loop. */ + scrollok (text, TRUE); + wscrl (text, -1); /* Scroll text region down one line */ + scrollok (text, FALSE); + page_length = 0; + passed_end = 0; + for (i = 0; i < height - 4; i++) { + if (!i) { + /* print first line of page */ + print_line (text, 0, width - 2); + wnoutrefresh (text); + } else + /* Called to update 'end_reached' and 'page' */ + get_line (); + if (!passed_end) + page_length++; + if (end_reached && !passed_end) + passed_end = 1; + } + + print_position (dialog, height, width); + wmove (dialog, cur_y, cur_x); /* Restore cursor position */ + wrefresh (dialog); + } + break; + case 'B': /* Previous page */ + case 'b': + case KEY_PPAGE: + if (begin_reached) + break; + back_lines (page_length + height - 4); + print_page (text, height - 4, width - 2); + print_position (dialog, height, width); + wmove (dialog, cur_y, cur_x); + wrefresh (dialog); + break; + case 'J': /* Next line */ + case 'j': + case KEY_DOWN: + if (!end_reached) { + begin_reached = 0; + scrollok (text, TRUE); + scroll (text); /* Scroll text region up one line */ + scrollok (text, FALSE); + print_line (text, height - 5, width - 2); + wnoutrefresh (text); + print_position (dialog, height, width); + wmove (dialog, cur_y, cur_x); /* Restore cursor position */ + wrefresh (dialog); + } + break; + case KEY_NPAGE: /* Next page */ + case ' ': + if (end_reached) + break; + + begin_reached = 0; + print_page (text, height - 4, width - 2); + print_position (dialog, height, width); + wmove (dialog, cur_y, cur_x); + wrefresh (dialog); + break; + case '0': /* Beginning of line */ + case 'H': /* Scroll left */ + case 'h': + case KEY_LEFT: + if (hscroll <= 0) + break; + + if (key == '0') + hscroll = 0; + else + hscroll--; + /* Reprint current page to scroll horizontally */ + back_lines (page_length); + print_page (text, height - 4, width - 2); + wmove (dialog, cur_y, cur_x); + wrefresh (dialog); + break; + case 'L': /* Scroll right */ + case 'l': + case KEY_RIGHT: + if (hscroll >= MAX_LEN) + break; + hscroll++; + /* Reprint current page to scroll horizontally */ + back_lines (page_length); + print_page (text, height - 4, width - 2); + wmove (dialog, cur_y, cur_x); + wrefresh (dialog); + break; + case ESC: + break; + } + } + + delwin (dialog); + free (buf); + close (fd); + return 1; /* ESC pressed */ +} + +/* + * Go back 'n' lines in text file. Called by dialog_textbox(). + * 'page' will be updated to point to the desired line in 'buf'. + */ +static void +back_lines (int n) +{ + int i, fpos; + + begin_reached = 0; + /* We have to distinguish between end_reached and !end_reached + since at end of file, the line is not ended by a '\n'. + The code inside 'if' basically does a '--page' to move one + character backward so as to skip '\n' of the previous line */ + if (!end_reached) { + /* Either beginning of buffer or beginning of file reached? */ + if (page == buf) { + if ((fpos = lseek (fd, 0, SEEK_CUR)) == -1) { + endwin (); + fprintf (stderr, "\nError moving file pointer in " + "back_lines().\n"); + exit (-1); + } + if (fpos > bytes_read) { /* Not beginning of file yet */ + /* We've reached beginning of buffer, but not beginning of + file yet, so read previous part of file into buffer. + Note that we only move backward for BUF_SIZE/2 bytes, + but not BUF_SIZE bytes to avoid re-reading again in + print_page() later */ + /* Really possible to move backward BUF_SIZE/2 bytes? */ + if (fpos < BUF_SIZE / 2 + bytes_read) { + /* No, move less then */ + if (lseek (fd, 0, SEEK_SET) == -1) { + endwin (); + fprintf (stderr, "\nError moving file pointer in " + "back_lines().\n"); + exit (-1); + } + page = buf + fpos - bytes_read; + } else { /* Move backward BUF_SIZE/2 bytes */ + if (lseek (fd, -(BUF_SIZE / 2 + bytes_read), SEEK_CUR) + == -1) { + endwin (); + fprintf (stderr, "\nError moving file pointer " + "in back_lines().\n"); + exit (-1); + } + page = buf + BUF_SIZE / 2; + } + if ((bytes_read = read (fd, buf, BUF_SIZE)) == -1) { + endwin (); + fprintf (stderr, "\nError reading file in back_lines().\n"); + exit (-1); + } + buf[bytes_read] = '\0'; + } else { /* Beginning of file reached */ + begin_reached = 1; + return; + } + } + if (*(--page) != '\n') { /* '--page' here */ + /* Something's wrong... */ + endwin (); + fprintf (stderr, "\nInternal error in back_lines().\n"); + exit (-1); + } + } + /* Go back 'n' lines */ + for (i = 0; i < n; i++) + do { + if (page == buf) { + if ((fpos = lseek (fd, 0, SEEK_CUR)) == -1) { + endwin (); + fprintf (stderr, + "\nError moving file pointer in back_lines().\n"); + exit (-1); + } + if (fpos > bytes_read) { + /* Really possible to move backward BUF_SIZE/2 bytes? */ + if (fpos < BUF_SIZE / 2 + bytes_read) { + /* No, move less then */ + if (lseek (fd, 0, SEEK_SET) == -1) { + endwin (); + fprintf (stderr, "\nError moving file pointer " + "in back_lines().\n"); + exit (-1); + } + page = buf + fpos - bytes_read; + } else { /* Move backward BUF_SIZE/2 bytes */ + if (lseek (fd, -(BUF_SIZE / 2 + bytes_read), + SEEK_CUR) == -1) { + endwin (); + fprintf (stderr, "\nError moving file pointer" + " in back_lines().\n"); + exit (-1); + } + page = buf + BUF_SIZE / 2; + } + if ((bytes_read = read (fd, buf, BUF_SIZE)) == -1) { + endwin (); + fprintf (stderr, "\nError reading file in " + "back_lines().\n"); + exit (-1); + } + buf[bytes_read] = '\0'; + } else { /* Beginning of file reached */ + begin_reached = 1; + return; + } + } + } while (*(--page) != '\n'); + page++; +} + +/* + * Print a new page of text. Called by dialog_textbox(). + */ +static void +print_page (WINDOW * win, int height, int width) +{ + int i, passed_end = 0; + + page_length = 0; + for (i = 0; i < height; i++) { + print_line (win, i, width); + if (!passed_end) + page_length++; + if (end_reached && !passed_end) + passed_end = 1; + } + wnoutrefresh (win); +} + +/* + * Print a new line of text. Called by dialog_textbox() and print_page(). + */ +static void +print_line (WINDOW * win, int row, int width) +{ + int y, x; + char *line; + + line = get_line (); + line += MIN (strlen (line), hscroll); /* Scroll horizontally */ + wmove (win, row, 0); /* move cursor to correct line */ + waddch (win, ' '); + waddnstr (win, line, MIN (strlen (line), width - 2)); + + getyx (win, y, x); + /* Clear 'residue' of previous line */ +#if OLD_NCURSES + { + int i; + for (i = 0; i < width - x; i++) + waddch (win, ' '); + } +#else + wclrtoeol(win); +#endif +} + +/* + * Return current line of text. Called by dialog_textbox() and print_line(). + * 'page' should point to start of current line before calling, and will be + * updated to point to start of next line. + */ +static char * +get_line (void) +{ + int i = 0, fpos; + static char line[MAX_LEN + 1]; + + end_reached = 0; + while (*page != '\n') { + if (*page == '\0') { + /* Either end of file or end of buffer reached */ + if ((fpos = lseek (fd, 0, SEEK_CUR)) == -1) { + endwin (); + fprintf (stderr, "\nError moving file pointer in " + "get_line().\n"); + exit (-1); + } + if (fpos < file_size) { /* Not end of file yet */ + /* We've reached end of buffer, but not end of file yet, + so read next part of file into buffer */ + if ((bytes_read = read (fd, buf, BUF_SIZE)) == -1) { + endwin (); + fprintf (stderr, "\nError reading file in get_line().\n"); + exit (-1); + } + buf[bytes_read] = '\0'; + page = buf; + } else { + if (!end_reached) + end_reached = 1; + break; + } + } else if (i < MAX_LEN) + line[i++] = *(page++); + else { + /* Truncate lines longer than MAX_LEN characters */ + if (i == MAX_LEN) + line[i++] = '\0'; + page++; + } + } + if (i <= MAX_LEN) + line[i] = '\0'; + if (!end_reached) + page++; /* move pass '\n' */ + + return line; +} + +/* + * Print current position + */ +static void +print_position (WINDOW * win, int height, int width) +{ + int fpos, percent; + + if ((fpos = lseek (fd, 0, SEEK_CUR)) == -1) { + endwin (); + fprintf (stderr, "\nError moving file pointer in print_position().\n"); + exit (-1); + } + wattrset (win, position_indicator_attr); + wbkgdset (win, position_indicator_attr & A_COLOR); + percent = !file_size ? + 100 : ((fpos - bytes_read + page - buf) * 100) / file_size; + wmove (win, height - 3, width - 9); + wprintw (win, "(%3d%%)", percent); +} diff --git a/config/scripts/config/lxdialog/util.c b/config/scripts/config/lxdialog/util.c new file mode 100644 index 0000000000..6f83951b90 --- /dev/null +++ b/config/scripts/config/lxdialog/util.c @@ -0,0 +1,375 @@ +/* + * util.c + * + * ORIGINAL AUTHOR: Savio Lam (lam836@cs.cuhk.hk) + * MODIFIED FOR LINUX KERNEL CONFIG BY: William Roadcap (roadcap@cfw.com) + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include "dialog.h" + + +/* use colors by default? */ +bool use_colors = 1; + +const char *backtitle = NULL; + +const char *dialog_result; + +/* + * Attribute values, default is for mono display + */ +chtype attributes[] = +{ + A_NORMAL, /* screen_attr */ + A_NORMAL, /* shadow_attr */ + A_NORMAL, /* dialog_attr */ + A_BOLD, /* title_attr */ + A_NORMAL, /* border_attr */ + A_REVERSE, /* button_active_attr */ + A_DIM, /* button_inactive_attr */ + A_REVERSE, /* button_key_active_attr */ + A_BOLD, /* button_key_inactive_attr */ + A_REVERSE, /* button_label_active_attr */ + A_NORMAL, /* button_label_inactive_attr */ + A_NORMAL, /* inputbox_attr */ + A_NORMAL, /* inputbox_border_attr */ + A_NORMAL, /* searchbox_attr */ + A_BOLD, /* searchbox_title_attr */ + A_NORMAL, /* searchbox_border_attr */ + A_BOLD, /* position_indicator_attr */ + A_NORMAL, /* menubox_attr */ + A_NORMAL, /* menubox_border_attr */ + A_NORMAL, /* item_attr */ + A_REVERSE, /* item_selected_attr */ + A_BOLD, /* tag_attr */ + A_REVERSE, /* tag_selected_attr */ + A_BOLD, /* tag_key_attr */ + A_REVERSE, /* tag_key_selected_attr */ + A_BOLD, /* check_attr */ + A_REVERSE, /* check_selected_attr */ + A_BOLD, /* uarrow_attr */ + A_BOLD /* darrow_attr */ +}; + + +#include "colors.h" + +/* + * Table of color values + */ +int color_table[][3] = +{ + {SCREEN_FG, SCREEN_BG, SCREEN_HL}, + {SHADOW_FG, SHADOW_BG, SHADOW_HL}, + {DIALOG_FG, DIALOG_BG, DIALOG_HL}, + {TITLE_FG, TITLE_BG, TITLE_HL}, + {BORDER_FG, BORDER_BG, BORDER_HL}, + {BUTTON_ACTIVE_FG, BUTTON_ACTIVE_BG, BUTTON_ACTIVE_HL}, + {BUTTON_INACTIVE_FG, BUTTON_INACTIVE_BG, BUTTON_INACTIVE_HL}, + {BUTTON_KEY_ACTIVE_FG, BUTTON_KEY_ACTIVE_BG, BUTTON_KEY_ACTIVE_HL}, + {BUTTON_KEY_INACTIVE_FG, BUTTON_KEY_INACTIVE_BG, BUTTON_KEY_INACTIVE_HL}, + {BUTTON_LABEL_ACTIVE_FG, BUTTON_LABEL_ACTIVE_BG, BUTTON_LABEL_ACTIVE_HL}, + {BUTTON_LABEL_INACTIVE_FG, BUTTON_LABEL_INACTIVE_BG, + BUTTON_LABEL_INACTIVE_HL}, + {INPUTBOX_FG, INPUTBOX_BG, INPUTBOX_HL}, + {INPUTBOX_BORDER_FG, INPUTBOX_BORDER_BG, INPUTBOX_BORDER_HL}, + {SEARCHBOX_FG, SEARCHBOX_BG, SEARCHBOX_HL}, + {SEARCHBOX_TITLE_FG, SEARCHBOX_TITLE_BG, SEARCHBOX_TITLE_HL}, + {SEARCHBOX_BORDER_FG, SEARCHBOX_BORDER_BG, SEARCHBOX_BORDER_HL}, + {POSITION_INDICATOR_FG, POSITION_INDICATOR_BG, POSITION_INDICATOR_HL}, + {MENUBOX_FG, MENUBOX_BG, MENUBOX_HL}, + {MENUBOX_BORDER_FG, MENUBOX_BORDER_BG, MENUBOX_BORDER_HL}, + {ITEM_FG, ITEM_BG, ITEM_HL}, + {ITEM_SELECTED_FG, ITEM_SELECTED_BG, ITEM_SELECTED_HL}, + {TAG_FG, TAG_BG, TAG_HL}, + {TAG_SELECTED_FG, TAG_SELECTED_BG, TAG_SELECTED_HL}, + {TAG_KEY_FG, TAG_KEY_BG, TAG_KEY_HL}, + {TAG_KEY_SELECTED_FG, TAG_KEY_SELECTED_BG, TAG_KEY_SELECTED_HL}, + {CHECK_FG, CHECK_BG, CHECK_HL}, + {CHECK_SELECTED_FG, CHECK_SELECTED_BG, CHECK_SELECTED_HL}, + {UARROW_FG, UARROW_BG, UARROW_HL}, + {DARROW_FG, DARROW_BG, DARROW_HL}, +}; /* color_table */ + +/* + * Set window to attribute 'attr' + */ +void +attr_clear (WINDOW * win, int height, int width, chtype attr) +{ + int i, j; + + wattrset (win, attr); + for (i = 0; i < height; i++) { + wmove (win, i, 0); + for (j = 0; j < width; j++) + waddch (win, ' '); + } + touchwin (win); +} + +void dialog_clear (void) +{ + attr_clear (stdscr, LINES, COLS, screen_attr); + /* Display background title if it exists ... - SLH */ + if (backtitle != NULL) { + int i; + + wattrset (stdscr, screen_attr); + mvwaddstr (stdscr, 0, 1, (char *)backtitle); + wmove (stdscr, 1, 1); + for (i = 1; i < COLS - 1; i++) + waddch (stdscr, ACS_HLINE); + } + wnoutrefresh (stdscr); +} + +/* + * Do some initialization for dialog + */ +void +init_dialog (void) +{ + initscr (); /* Init curses */ + keypad (stdscr, TRUE); + cbreak (); + noecho (); + + + if (use_colors) /* Set up colors */ + color_setup (); + + + dialog_clear (); +} + +/* + * Setup for color display + */ +void +color_setup (void) +{ + int i; + + if (has_colors ()) { /* Terminal supports color? */ + start_color (); + + /* Initialize color pairs */ + for (i = 0; i < ATTRIBUTE_COUNT; i++) + init_pair (i + 1, color_table[i][0], color_table[i][1]); + + /* Setup color attributes */ + for (i = 0; i < ATTRIBUTE_COUNT; i++) + attributes[i] = C_ATTR (color_table[i][2], i + 1); + } +} + +/* + * End using dialog functions. + */ +void +end_dialog (void) +{ + endwin (); +} + + +/* + * Print a string of text in a window, automatically wrap around to the + * next line if the string is too long to fit on one line. Newline + * characters '\n' are replaced by spaces. We start on a new line + * if there is no room for at least 4 nonblanks following a double-space. + */ +void +print_autowrap (WINDOW * win, const char *prompt, int width, int y, int x) +{ + int newl, cur_x, cur_y; + int i, prompt_len, room, wlen; + char tempstr[MAX_LEN + 1], *word, *sp, *sp2; + + strcpy (tempstr, prompt); + + prompt_len = strlen(tempstr); + + /* + * Remove newlines + */ + for(i=0; i room || + (newl && wlen < 4 && sp && wlen+1+strlen(sp) > room + && (!(sp2 = index(sp, ' ')) || wlen+1+(sp2-sp) > room))) { + cur_y++; + cur_x = x; + } + wmove (win, cur_y, cur_x); + waddstr (win, word); + getyx (win, cur_y, cur_x); + cur_x++; + if (sp && *sp == ' ') { + cur_x++; /* double space */ + while (*++sp == ' '); + newl = 1; + } else + newl = 0; + word = sp; + } + } +} + +/* + * Print a button + */ +void +print_button (WINDOW * win, const char *label, int y, int x, int selected) +{ + int i, temp; + + wmove (win, y, x); + wattrset (win, selected ? button_active_attr : button_inactive_attr); + waddstr (win, "<"); + temp = strspn (label, " "); + label += temp; + wattrset (win, selected ? button_label_active_attr + : button_label_inactive_attr); + for (i = 0; i < temp; i++) + waddch (win, ' '); + wattrset (win, selected ? button_key_active_attr + : button_key_inactive_attr); + waddch (win, label[0]); + wattrset (win, selected ? button_label_active_attr + : button_label_inactive_attr); + waddstr (win, (char *)label + 1); + wattrset (win, selected ? button_active_attr : button_inactive_attr); + waddstr (win, ">"); + wmove (win, y, x + temp + 1); +} + +/* + * Draw a rectangular box with line drawing characters + */ +void +draw_box (WINDOW * win, int y, int x, int height, int width, + chtype box, chtype border) +{ + int i, j; + + wattrset (win, 0); + for (i = 0; i < height; i++) { + wmove (win, y + i, x); + for (j = 0; j < width; j++) + if (!i && !j) + waddch (win, border | ACS_ULCORNER); + else if (i == height - 1 && !j) + waddch (win, border | ACS_LLCORNER); + else if (!i && j == width - 1) + waddch (win, box | ACS_URCORNER); + else if (i == height - 1 && j == width - 1) + waddch (win, box | ACS_LRCORNER); + else if (!i) + waddch (win, border | ACS_HLINE); + else if (i == height - 1) + waddch (win, box | ACS_HLINE); + else if (!j) + waddch (win, border | ACS_VLINE); + else if (j == width - 1) + waddch (win, box | ACS_VLINE); + else + waddch (win, box | ' '); + } +} + +/* + * Draw shadows along the right and bottom edge to give a more 3D look + * to the boxes + */ +void +draw_shadow (WINDOW * win, int y, int x, int height, int width) +{ + int i; + + if (has_colors ()) { /* Whether terminal supports color? */ + wattrset (win, shadow_attr); + wmove (win, y + height, x + 2); + for (i = 0; i < width; i++) + waddch (win, winch (win) & A_CHARTEXT); + for (i = y + 1; i < y + height + 1; i++) { + wmove (win, i, x + width); + waddch (win, winch (win) & A_CHARTEXT); + waddch (win, winch (win) & A_CHARTEXT); + } + wnoutrefresh (win); + } +} + +/* + * Return the position of the first alphabetic character in a string. + */ +int +first_alpha(const char *string, const char *exempt) +{ + int i, in_paren=0, c; + + for (i = 0; i < strlen(string); i++) { + c = tolower(string[i]); + + if (strchr("<[(", c)) ++in_paren; + if (strchr(">])", c) && in_paren > 0) --in_paren; + + if ((! in_paren) && isalpha(c) && + strchr(exempt, c) == 0) + return i; + } + + return 0; +} + +/* + * Get the first selected item in the dialog_list_item list. + */ +struct dialog_list_item * +first_sel_item(int item_no, struct dialog_list_item ** items) +{ + int i; + + for (i = 0; i < item_no; i++) { + if (items[i]->selected) + return items[i]; + } + + return NULL; +} diff --git a/config/scripts/config/lxdialog/yesno.c b/config/scripts/config/lxdialog/yesno.c new file mode 100644 index 0000000000..11fcc25f51 --- /dev/null +++ b/config/scripts/config/lxdialog/yesno.c @@ -0,0 +1,118 @@ +/* + * yesno.c -- implements the yes/no box + * + * ORIGINAL AUTHOR: Savio Lam (lam836@cs.cuhk.hk) + * MODIFIED FOR LINUX KERNEL CONFIG BY: William Roadcap (roadcap@cfw.com) + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include "dialog.h" + +/* + * Display termination buttons + */ +static void +print_buttons(WINDOW *dialog, int height, int width, int selected) +{ + int x = width / 2 - 10; + int y = height - 2; + + print_button (dialog, " Yes ", y, x, selected == 0); + print_button (dialog, " No ", y, x + 13, selected == 1); + + wmove(dialog, y, x+1 + 13*selected ); + wrefresh (dialog); +} + +/* + * Display a dialog box with two buttons - Yes and No + */ +int +dialog_yesno (const char *title, const char *prompt, int height, int width) +{ + int i, x, y, key = 0, button = 0; + WINDOW *dialog; + + /* center dialog box on screen */ + x = (COLS - width) / 2; + y = (LINES - height) / 2; + + draw_shadow (stdscr, y, x, height, width); + + dialog = newwin (height, width, y, x); + keypad (dialog, TRUE); + + draw_box (dialog, 0, 0, height, width, dialog_attr, border_attr); + wattrset (dialog, border_attr); + mvwaddch (dialog, height-3, 0, ACS_LTEE); + for (i = 0; i < width - 2; i++) + waddch (dialog, ACS_HLINE); + wattrset (dialog, dialog_attr); + waddch (dialog, ACS_RTEE); + + if (title != NULL && strlen(title) >= width-2 ) { + /* truncate long title -- mec */ + char * title2 = malloc(width-2+1); + memcpy( title2, title, width-2 ); + title2[width-2] = '\0'; + title = title2; + } + + if (title != NULL) { + wattrset (dialog, title_attr); + mvwaddch (dialog, 0, (width - strlen(title))/2 - 1, ' '); + waddstr (dialog, (char *)title); + waddch (dialog, ' '); + } + + wattrset (dialog, dialog_attr); + print_autowrap (dialog, prompt, width - 2, 1, 3); + + print_buttons(dialog, height, width, 0); + + while (key != ESC) { + key = wgetch (dialog); + switch (key) { + case 'Y': + case 'y': + delwin (dialog); + return 0; + case 'N': + case 'n': + delwin (dialog); + return 1; + + case TAB: + case KEY_LEFT: + case KEY_RIGHT: + button = ((key == KEY_LEFT ? --button : ++button) < 0) + ? 1 : (button > 1 ? 0 : button); + + print_buttons(dialog, height, width, button); + wrefresh (dialog); + break; + case ' ': + case '\n': + delwin (dialog); + return button; + case ESC: + break; + } + } + + delwin (dialog); + return -1; /* ESC pressed */ +} diff --git a/config/scripts/config/mconf.c b/config/scripts/config/mconf.c new file mode 100644 index 0000000000..406eb29c3b --- /dev/null +++ b/config/scripts/config/mconf.c @@ -0,0 +1,977 @@ +/* + * Copyright (C) 2002 Roman Zippel + * Released under the terms of the GNU GPL v2.0. + * + * Introduced single menu mode (show all sub-menus in one large tree). + * 2002-11-06 Petr Baudis + * + * Directly use liblxdialog library routines. + * 2002-11-14 Petr Baudis + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "lxdialog/dialog.h" + +#define LKC_DIRECT_LINK +#include "lkc.h" + +static char menu_backtitle[128]; +static const char mconf_readme[] = +"Overview\n" +"--------\n" +"Some features may be built directly into axTLS. Some features\n" +"may be completely removed altogether. There are also certain\n" +"parameters which are not really features, but must be\n" +"entered in as decimal or hexadecimal numbers or possibly text.\n" +"\n" +"Menu items beginning with [*] or [ ] represent features\n" +"configured to be built in or removed respectively.\n" +"\n" +"To change any of these features, highlight it with the cursor\n" +"keys and press to build it in or to removed it.\n" +"You may also press the to cycle\n" +"through the available options (ie. Y->N->Y).\n" +"\n" +"Some additional keyboard hints:\n" +"\n" +"Menus\n" +"----------\n" +"o Use the Up/Down arrow keys (cursor keys) to highlight the item\n" +" you wish to change or submenu wish to select and press .\n" +" Submenus are designated by \"--->\".\n" +"\n" +" Shortcut: Press the option's highlighted letter (hotkey).\n" +" Pressing a hotkey more than once will sequence\n" +" through all visible items which use that hotkey.\n" +"\n" +" You may also use the and keys to scroll\n" +" unseen options into view.\n" +"\n" +"o To exit a menu use the cursor keys to highlight the button\n" +" and press .\n" +"\n" +" Shortcut: Press or or if there is no hotkey\n" +" using those letters. You may press a single , but\n" +" there is a delayed response which you may find annoying.\n" +"\n" +" Also, the and cursor keys will cycle between and\n" +" \n" +"\n" +"\n" +"Data Entry\n" +"-----------\n" +"o Enter the requested information and press \n" +" If you are entering hexadecimal values, it is not necessary to\n" +" add the '0x' prefix to the entry.\n" +"\n" +"o For help, use the or cursor keys to highlight the help option\n" +" and press . You can try as well.\n" +"\n" +"\n" +"Text Box (Help Window)\n" +"--------\n" +"o Use the cursor keys to scroll up/down/left/right. The VI editor\n" +" keys h,j,k,l function here as do and for those\n" +" who are familiar with less and lynx.\n" +"\n" +"o Press , , or to exit.\n" +"\n" +"\n" +"Alternate Configuration Files\n" +"-----------------------------\n" +"Menuconfig supports the use of alternate configuration files for\n" +"those who, for various reasons, find it necessary to switch\n" +"between different configurations.\n" +"\n" +"At the end of the main menu you will find two options. One is\n" +"for saving the current configuration to a file of your choosing.\n" +"The other option is for loading a previously saved alternate\n" +"configuration.\n" +"\n" +"Even if you don't use alternate configuration files, but you\n" +"find during a Menuconfig session that you have completely messed\n" +"up your settings, you may use the \"Load Alternate...\" option to\n" +"restore your previously saved settings from \".config\" without\n" +"restarting Menuconfig.\n" +"\n" +"Other information\n" +"-----------------\n" +"If you use Menuconfig in an XTERM window make sure you have your\n" +"$TERM variable set to point to a xterm definition which supports color.\n" +"Otherwise, Menuconfig will look rather bad. Menuconfig will not\n" +"display correctly in a RXVT window because rxvt displays only one\n" +"intensity of color, bright.\n" +"\n" +"Menuconfig will display larger menus on screens or xterms which are\n" +"set to display more than the standard 25 row by 80 column geometry.\n" +"In order for this to work, the \"stty size\" command must be able to\n" +"display the screen's current row and column geometry. I STRONGLY\n" +"RECOMMEND that you make sure you do NOT have the shell variables\n" +"LINES and COLUMNS exported into your environment. Some distributions\n" +"export those variables via /etc/profile. Some ncurses programs can\n" +"become confused when those variables (LINES & COLUMNS) don't reflect\n" +"the true screen size.\n" +"\n" +"Optional personality available\n" +"------------------------------\n" +"If you prefer to have all of the options listed in a single\n" +"menu, rather than the default multimenu hierarchy, run the menuconfig\n" +"with MENUCONFIG_MODE environment variable set to single_menu. Example:\n" +"\n" +"make MENUCONFIG_MODE=single_menu menuconfig\n" +"\n" +" will then unroll the appropriate category, or enfold it if it\n" +"is already unrolled.\n" +"\n" +"Note that this mode can eventually be a little more CPU expensive\n" +"(especially with a larger number of unrolled categories) than the\n" +"default mode.\n", +menu_instructions[] = + "Arrow keys navigate the menu. " + " selects submenus --->. " + "Highlighted letters are hotkeys. " + "Pressing selectes a feature, while will exclude a feature. " + "Press to exit, for Help, for Search. " + "Legend: [*] feature is selected [ ] feature is excluded", +radiolist_instructions[] = + "Use the arrow keys to navigate this window or " + "press the hotkey of the item you wish to select " + "followed by the . " + "Press for additional information about this option.", +inputbox_instructions_int[] = + "Please enter a decimal value. " + "Fractions will not be accepted. " + "Use the key to move from the input field to the buttons below it.", +inputbox_instructions_hex[] = + "Please enter a hexadecimal value. " + "Use the key to move from the input field to the buttons below it.", +inputbox_instructions_string[] = + "Please enter a string value. " + "Use the key to move from the input field to the buttons below it.", +setmod_text[] = + "This feature depends on another which has been configured as a module.\n" + "As a result, this feature will be built as a module.", +nohelp_text[] = + "There is no help available for this option.\n", +load_config_text[] = + "Enter the name of the configuration file you wish to load. " + "Accept the name shown to restore the configuration you " + "last retrieved. Leave blank to abort.", +load_config_help[] = + "\n" + "For various reasons, one may wish to keep several different axTLS\n" + "configurations available on a single machine.\n" + "\n" + "If you have saved a previous configuration in a file other than the\n" + "axTLS's default, entering the name of the file here will allow you\n" + "to modify that configuration.\n" + "\n" + "If you are uncertain, then you have probably never used alternate\n" + "configuration files. You should therefor leave this blank to abort.\n", +save_config_text[] = + "Enter a filename to which this configuration should be saved " + "as an alternate. Leave blank to abort.", +save_config_help[] = + "\n" + "For various reasons, one may wish to keep different axTLS\n" + "configurations available on a single machine.\n" + "\n" + "Entering a file name here will allow you to later retrieve, modify\n" + "and use the current configuration as an alternate to whatever\n" + "configuration options you have selected at that time.\n" + "\n" + "If you are uncertain what all this means then you should probably\n" + "leave this blank.\n", +search_help[] = + "\n" + "Search for CONFIG_ symbols and display their relations.\n" + "Example: search for \"^FOO\"\n" + "Result:\n" + "-----------------------------------------------------------------\n" + "Symbol: FOO [=m]\n" + "Prompt: Foo bus is used to drive the bar HW\n" + "Defined at drivers/pci/Kconfig:47\n" + "Depends on: X86_LOCAL_APIC && X86_IO_APIC || IA64\n" + "Location:\n" + " -> Bus options (PCI, PCMCIA, EISA, MCA, ISA)\n" + " -> PCI support (PCI [=y])\n" + " -> PCI access mode ( [=y])\n" + "Selects: LIBCRC32\n" + "Selected by: BAR\n" + "-----------------------------------------------------------------\n" + "o The line 'Prompt:' shows the text used in the menu structure for\n" + " this CONFIG_ symbol\n" + "o The 'Defined at' line tell at what file / line number the symbol\n" + " is defined\n" + "o The 'Depends on:' line tell what symbols needs to be defined for\n" + " this symbol to be visible in the menu (selectable)\n" + "o The 'Location:' lines tell where in the menu structure this symbol\n" + " is located\n" + " A location followed by a [=y] indicate that this is a selectable\n" + " menu item - and current value is displayed inside brackets.\n" + "o The 'Selects:' line tell what symbol will be automatically\n" + " selected if this symbol is selected (y or m)\n" + "o The 'Selected by' line tell what symbol has selected this symbol\n" + "\n" + "Only relevant lines are shown.\n" + "\n\n" + "Search examples:\n" + "Examples: USB => find all CONFIG_ symbols containing USB\n" + " ^USB => find all CONFIG_ symbols starting with USB\n" + " USB$ => find all CONFIG_ symbols ending with USB\n" + "\n"; + +static char filename[PATH_MAX+1] = ".config"; +static int indent; +static struct termios ios_org; +static int rows = 0, cols = 0; +static struct menu *current_menu; +static int child_count; +static int single_menu_mode; + +static struct dialog_list_item *items[16384]; /* FIXME: This ought to be dynamic. */ +static int item_no; + +static void conf(struct menu *menu); +static void conf_choice(struct menu *menu); +static void conf_string(struct menu *menu); +static void conf_load(void); +static void conf_save(void); +static void show_textbox(const char *title, const char *text, int r, int c); +static void show_helptext(const char *title, const char *text); +static void show_help(struct menu *menu); +static void show_file(const char *filename, const char *title, int r, int c); + +static void init_wsize(void) +{ + struct winsize ws; + char *env; + + if (!ioctl(STDIN_FILENO, TIOCGWINSZ, &ws)) { + rows = ws.ws_row; + cols = ws.ws_col; + } + + if (!rows) { + env = getenv("LINES"); + if (env) + rows = atoi(env); + if (!rows) + rows = 24; + } + if (!cols) { + env = getenv("COLUMNS"); + if (env) + cols = atoi(env); + if (!cols) + cols = 80; + } + + if (rows < 19 || cols < 80) { + fprintf(stderr, "Your display is too small to run Menuconfig!\n"); + fprintf(stderr, "It must be at least 19 lines by 80 columns.\n"); + exit(1); + } + + rows -= 4; + cols -= 5; +} + +static void cinit(void) +{ + item_no = 0; +} + +static void cmake(void) +{ + items[item_no] = malloc(sizeof(struct dialog_list_item)); + memset(items[item_no], 0, sizeof(struct dialog_list_item)); + items[item_no]->tag = malloc(32); items[item_no]->tag[0] = 0; + items[item_no]->name = malloc(512); items[item_no]->name[0] = 0; + items[item_no]->namelen = 0; + item_no++; +} + +static int cprint_name(const char *fmt, ...) +{ + va_list ap; + int res; + + if (!item_no) + cmake(); + va_start(ap, fmt); + res = vsnprintf(items[item_no - 1]->name + items[item_no - 1]->namelen, + 512 - items[item_no - 1]->namelen, fmt, ap); + if (res > 0) + items[item_no - 1]->namelen += res; + va_end(ap); + + return res; +} + +static int cprint_tag(const char *fmt, ...) +{ + va_list ap; + int res; + + if (!item_no) + cmake(); + va_start(ap, fmt); + res = vsnprintf(items[item_no - 1]->tag, 32, fmt, ap); + va_end(ap); + + return res; +} + +static void cdone(void) +{ + int i; + + for (i = 0; i < item_no; i++) { + free(items[i]->tag); + free(items[i]->name); + free(items[i]); + } + + item_no = 0; +} + +static void get_prompt_str(struct gstr *r, struct property *prop) +{ + int i, j; + struct menu *submenu[8], *menu; + + str_printf(r, "Prompt: %s\n", prop->text); + str_printf(r, " Defined at %s:%d\n", prop->menu->file->name, + prop->menu->lineno); + if (!expr_is_yes(prop->visible.expr)) { + str_append(r, " Depends on: "); + expr_gstr_print(prop->visible.expr, r); + str_append(r, "\n"); + } + menu = prop->menu->parent; + for (i = 0; menu != &rootmenu && i < 8; menu = menu->parent) + submenu[i++] = menu; + if (i > 0) { + str_printf(r, " Location:\n"); + for (j = 4; --i >= 0; j += 2) { + menu = submenu[i]; + str_printf(r, "%*c-> %s", j, ' ', menu_get_prompt(menu)); + if (menu->sym) { + str_printf(r, " (%s [=%s])", menu->sym->name ? + menu->sym->name : "", + sym_get_string_value(menu->sym)); + } + str_append(r, "\n"); + } + } +} + +static void get_symbol_str(struct gstr *r, struct symbol *sym) +{ + bool hit; + struct property *prop; + + str_printf(r, "Symbol: %s [=%s]\n", sym->name, + sym_get_string_value(sym)); + for_all_prompts(sym, prop) + get_prompt_str(r, prop); + hit = false; + for_all_properties(sym, prop, P_SELECT) { + if (!hit) { + str_append(r, " Selects: "); + hit = true; + } else + str_printf(r, " && "); + expr_gstr_print(prop->expr, r); + } + if (hit) + str_append(r, "\n"); + if (sym->rev_dep.expr) { + str_append(r, " Selected by: "); + expr_gstr_print(sym->rev_dep.expr, r); + str_append(r, "\n"); + } + str_append(r, "\n\n"); +} + +static struct gstr get_relations_str(struct symbol **sym_arr) +{ + struct symbol *sym; + struct gstr res = str_new(); + int i; + + for (i = 0; sym_arr && (sym = sym_arr[i]); i++) + get_symbol_str(&res, sym); + if (!i) + str_append(&res, "No matches found.\n"); + return res; +} + +static void search_conf(void) +{ + struct symbol **sym_arr; + struct gstr res; + +again: + switch (dialog_inputbox("Search Configuration Parameter", + "Enter Keyword", 10, 75, + NULL)) { + case 0: + break; + case 1: + show_helptext("Search Configuration", search_help); + goto again; + default: + return; + } + + sym_arr = sym_re_search(dialog_input_result); + res = get_relations_str(sym_arr); + free(sym_arr); + show_textbox("Search Results", str_get(&res), 0, 0); + str_free(&res); +} + +static void build_conf(struct menu *menu) +{ + struct symbol *sym; + struct property *prop; + struct menu *child; + int type, tmp, doint = 2; + tristate val; + char ch; + + if (!menu_is_visible(menu)) + return; + + sym = menu->sym; + prop = menu->prompt; + if (!sym) { + if (prop && menu != current_menu) { + const char *prompt = menu_get_prompt(menu); + switch (prop->type) { + case P_MENU: + child_count++; + cmake(); + cprint_tag("m%p", menu); + + if (single_menu_mode) { + cprint_name("%s%*c%s", + menu->data ? "-->" : "++>", + indent + 1, ' ', prompt); + } else { + cprint_name(" %*c%s --->", indent + 1, ' ', prompt); + } + + if (single_menu_mode && menu->data) + goto conf_childs; + return; + default: + if (prompt) { + child_count++; + cmake(); + cprint_tag(":%p", menu); + cprint_name("---%*c%s", indent + 1, ' ', prompt); + } + } + } else + doint = 0; + goto conf_childs; + } + + cmake(); + type = sym_get_type(sym); + if (sym_is_choice(sym)) { + struct symbol *def_sym = sym_get_choice_value(sym); + struct menu *def_menu = NULL; + + child_count++; + for (child = menu->list; child; child = child->next) { + if (menu_is_visible(child) && child->sym == def_sym) + def_menu = child; + } + + val = sym_get_tristate_value(sym); + if (sym_is_changable(sym)) { + cprint_tag("t%p", menu); + switch (type) { + case S_BOOLEAN: + cprint_name("[%c]", val == no ? ' ' : '*'); + break; + case S_TRISTATE: + switch (val) { + case yes: ch = '*'; break; + case mod: ch = 'M'; break; + default: ch = ' '; break; + } + cprint_name("<%c>", ch); + break; + } + } else { + cprint_tag("%c%p", def_menu ? 't' : ':', menu); + cprint_name(" "); + } + + cprint_name("%*c%s", indent + 1, ' ', menu_get_prompt(menu)); + if (val == yes) { + if (def_menu) { + cprint_name(" (%s)", menu_get_prompt(def_menu)); + cprint_name(" --->"); + if (def_menu->list) { + indent += 2; + build_conf(def_menu); + indent -= 2; + } + } + return; + } + } else { + if (menu == current_menu) { + cprint_tag(":%p", menu); + cprint_name("---%*c%s", indent + 1, ' ', menu_get_prompt(menu)); + goto conf_childs; + } + child_count++; + val = sym_get_tristate_value(sym); + if (sym_is_choice_value(sym) && val == yes) { + cprint_tag(":%p", menu); + cprint_name(" "); + } else { + switch (type) { + case S_BOOLEAN: + cprint_tag("t%p", menu); + if (sym_is_changable(sym)) + cprint_name("[%c]", val == no ? ' ' : '*'); + else + cprint_name("---"); + break; + case S_TRISTATE: + cprint_tag("t%p", menu); + switch (val) { + case yes: ch = '*'; break; + case mod: ch = 'M'; break; + default: ch = ' '; break; + } + if (sym_is_changable(sym)) + cprint_name("<%c>", ch); + else + cprint_name("---"); + break; + default: + cprint_tag("s%p", menu); + tmp = cprint_name("(%s)", sym_get_string_value(sym)); + tmp = indent - tmp + 4; + if (tmp < 0) + tmp = 0; + cprint_name("%*c%s%s", tmp, ' ', menu_get_prompt(menu), + (sym_has_value(sym) || !sym_is_changable(sym)) ? + "" : " (NEW)"); + goto conf_childs; + } + } + cprint_name("%*c%s%s", indent + 1, ' ', menu_get_prompt(menu), + (sym_has_value(sym) || !sym_is_changable(sym)) ? + "" : " (NEW)"); + if (menu->prompt->type == P_MENU) { + cprint_name(" --->"); + return; + } + } + +conf_childs: + indent += doint; + for (child = menu->list; child; child = child->next) + build_conf(child); + indent -= doint; +} + +static void conf(struct menu *menu) +{ + struct dialog_list_item *active_item = NULL; + struct menu *submenu; + const char *prompt = menu_get_prompt(menu); + struct symbol *sym; + char active_entry[40]; + int stat, type; + + unlink("lxdialog.scrltmp"); + active_entry[0] = 0; + while (1) { + indent = 0; + child_count = 0; + current_menu = menu; + cdone(); cinit(); + build_conf(menu); + if (!child_count) + break; + if (menu == &rootmenu) { + cmake(); cprint_tag(":"); cprint_name("--- "); + cmake(); cprint_tag("L"); cprint_name("Load an Alternate Configuration File"); + cmake(); cprint_tag("S"); cprint_name("Save Configuration to an Alternate File"); + } + dialog_clear(); + stat = dialog_menu(prompt ? prompt : "Main Menu", + menu_instructions, rows, cols, rows - 10, + active_entry, item_no, items); + if (stat < 0) + return; + + if (stat == 1 || stat == 255) + break; + + active_item = first_sel_item(item_no, items); + if (!active_item) + continue; + active_item->selected = 0; + strncpy(active_entry, active_item->tag, sizeof(active_entry)); + active_entry[sizeof(active_entry)-1] = 0; + type = active_entry[0]; + if (!type) + continue; + + sym = NULL; + submenu = NULL; + if (sscanf(active_entry + 1, "%p", &submenu) == 1) + sym = submenu->sym; + + switch (stat) { + case 0: + switch (type) { + case 'm': + if (single_menu_mode) + submenu->data = (void *) (long) !submenu->data; + else + conf(submenu); + break; + case 't': + if (sym_is_choice(sym) && sym_get_tristate_value(sym) == yes) + conf_choice(submenu); + else if (submenu->prompt->type == P_MENU) + conf(submenu); + break; + case 's': + conf_string(submenu); + break; + case 'L': + conf_load(); + break; + case 'S': + conf_save(); + break; + } + break; + case 2: + if (sym) + show_help(submenu); + else + show_helptext("README", mconf_readme); + break; + case 3: + if (type == 't') { + if (sym_set_tristate_value(sym, yes)) + break; + if (sym_set_tristate_value(sym, mod)) + show_textbox(NULL, setmod_text, 6, 74); + } + break; + case 4: + if (type == 't') + sym_set_tristate_value(sym, no); + break; + case 5: + if (type == 't') + sym_set_tristate_value(sym, mod); + break; + case 6: + if (type == 't') + sym_toggle_tristate_value(sym); + else if (type == 'm') + conf(submenu); + break; + case 7: + search_conf(); + break; + } + } +} + +static void show_textbox(const char *title, const char *text, int r, int c) +{ + int fd; + + fd = creat(".help.tmp", 0777); + write(fd, text, strlen(text)); + close(fd); + show_file(".help.tmp", title, r, c); + unlink(".help.tmp"); +} + +static void show_helptext(const char *title, const char *text) +{ + show_textbox(title, text, 0, 0); +} + +static void show_help(struct menu *menu) +{ + struct gstr help = str_new(); + struct symbol *sym = menu->sym; + + if (sym->help) + { + if (sym->name) { + str_printf(&help, "%s:\n\n", sym->name); + str_append(&help, sym->help); + str_append(&help, "\n"); + } + } else { + str_append(&help, nohelp_text); + } + get_symbol_str(&help, sym); + show_helptext(menu_get_prompt(menu), str_get(&help)); + str_free(&help); +} + +static void show_file(const char *filename, const char *title, int r, int c) +{ + while (dialog_textbox(title, filename, r ? r : rows, c ? c : cols) < 0) + ; +} + +static void conf_choice(struct menu *menu) +{ + const char *prompt = menu_get_prompt(menu); + struct menu *child; + struct symbol *active; + + active = sym_get_choice_value(menu->sym); + while (1) { + current_menu = menu; + cdone(); cinit(); + for (child = menu->list; child; child = child->next) { + if (!menu_is_visible(child)) + continue; + cmake(); + cprint_tag("%p", child); + cprint_name("%s", menu_get_prompt(child)); + if (child->sym == sym_get_choice_value(menu->sym)) + items[item_no - 1]->selected = 1; /* ON */ + else if (child->sym == active) + items[item_no - 1]->selected = 2; /* SELECTED */ + else + items[item_no - 1]->selected = 0; /* OFF */ + } + + switch (dialog_checklist(prompt ? prompt : "Main Menu", + radiolist_instructions, 15, 70, 6, + item_no, items, FLAG_RADIO)) { + case 0: + if (sscanf(first_sel_item(item_no, items)->tag, "%p", &child) != 1) + break; + sym_set_tristate_value(child->sym, yes); + return; + case 1: + if (sscanf(first_sel_item(item_no, items)->tag, "%p", &child) == 1) { + show_help(child); + active = child->sym; + } else + show_help(menu); + break; + case 255: + return; + } + } +} + +static void conf_string(struct menu *menu) +{ + const char *prompt = menu_get_prompt(menu); + + while (1) { + char *heading; + + switch (sym_get_type(menu->sym)) { + case S_INT: + heading = (char *) inputbox_instructions_int; + break; + case S_HEX: + heading = (char *) inputbox_instructions_hex; + break; + case S_STRING: + heading = (char *) inputbox_instructions_string; + break; + default: + heading = "Internal mconf error!"; + /* panic? */; + } + + switch (dialog_inputbox(prompt ? prompt : "Main Menu", + heading, 10, 75, + sym_get_string_value(menu->sym))) { + case 0: + if (sym_set_string_value(menu->sym, dialog_input_result)) + return; + show_textbox(NULL, "You have made an invalid entry.", 5, 43); + break; + case 1: + show_help(menu); + break; + case 255: + return; + } + } +} + +static void conf_load(void) +{ + while (1) { + switch (dialog_inputbox(NULL, load_config_text, 11, 55, + filename)) { + case 0: + if (!dialog_input_result[0]) + return; + if (!conf_read(dialog_input_result)) + return; + show_textbox(NULL, "File does not exist!", 5, 38); + break; + case 1: + show_helptext("Load Alternate Configuration", load_config_help); + break; + case 255: + return; + } + } +} + +static void conf_save(void) +{ + while (1) { + switch (dialog_inputbox(NULL, save_config_text, 11, 55, + filename)) { + case 0: + if (!dialog_input_result[0]) + return; + if (!conf_write(dialog_input_result)) + return; + show_textbox(NULL, "Can't create file! Probably a nonexistent directory.", 5, 60); + break; + case 1: + show_helptext("Save Alternate Configuration", save_config_help); + break; + case 255: + return; + } + } +} + +static void conf_cleanup(void) +{ + tcsetattr(1, TCSAFLUSH, &ios_org); + unlink(".help.tmp"); +} + +static void winch_handler(int sig) +{ + struct winsize ws; + + if (ioctl(1, TIOCGWINSZ, &ws) == -1) { + rows = 24; + cols = 80; + } else { + rows = ws.ws_row; + cols = ws.ws_col; + } + + if (rows < 19 || cols < 80) { + end_dialog(); + fprintf(stderr, "Your display is too small to run Menuconfig!\n"); + fprintf(stderr, "It must be at least 19 lines by 80 columns.\n"); + exit(1); + } + + rows -= 4; + cols -= 5; + +} + +int main(int ac, char **av) +{ + struct symbol *sym; + char *mode; + int stat; + + conf_parse(av[1]); + conf_read(NULL); + + sym = sym_lookup("VERSION", 0); + sym_calc_value(sym); + snprintf(menu_backtitle, 128, "axTLS v%s Configuration", + sym_get_string_value(sym)); + + mode = getenv("MENUCONFIG_MODE"); + if (mode) { + if (!strcasecmp(mode, "single_menu")) + single_menu_mode = 1; + } + + tcgetattr(1, &ios_org); + atexit(conf_cleanup); + init_wsize(); + init_dialog(); + signal(SIGWINCH, winch_handler); + conf(&rootmenu); + end_dialog(); + + /* Restart dialog to act more like when lxdialog was still separate */ + init_dialog(); + do { + stat = dialog_yesno(NULL, + "Do you wish to save your new axTLS configuration?", 5, 60); + } while (stat < 0); + end_dialog(); + + if (stat == 0) { + conf_write(NULL); + printf("\n\n" + "*** End of axTLS configuration.\n" + "*** Check the top-level Makefile for additional configuration options.\n\n"); + } else + printf("\n\nYour axTLS configuration changes were NOT saved.\n\n"); + + return 0; +} diff --git a/config/scripts/config/mconf.exe b/config/scripts/config/mconf.exe new file mode 100755 index 0000000000000000000000000000000000000000..cb7ff192a8c975b01fa24084c87a38196aab270e GIT binary patch literal 138973 zcmeFa4Rlo1x&J?t3@}3Q1PwK6)Ul45Xsn4wFOi_(ovWzSSFBj|S}UzoxjIqQfW$MS zoF0Sps(rIoBW<-Wx7w?v15^kE6VTd5d_%dd)M|UCqb)_n2%7vq-@VV|1+f2nfB&`q zYyH>yvov$g-p_vC_OqY;>}T(D&e>mB7AcNIA~F8&>x)FP{OVt$`TNiRET($@BUbGn zd1}AskIY7AK7Zr|bH8$9V*U-+UvtBiUrStd<#pFxpGy4O)rlLLu1kF7y2O-o&rf{q z`Y&DmxzVFXCPUP-rbZ$&qr)QSxXY(Rz88)BU|1xwEi$5bRJ3SZE>9SYwF9HsyNzyA+w;6m?h_no-= z*7ml@6B8qu_EhvYuPy9#el@lC==SY>eP8ybnw!yQ;3RbO+Shu!V##GkH%5Z!JCVqy zj%7pt)wVBB{9;n1V_EA{$4D*iI~86kS>~UjQg2SObamnv6C+-8vK%zB`{1;9BM~q5 zWSan1%E~|X8{FFV_kIdMf?HGJ*SWzM0ZxnC`jNCBLB&GfW_|$n@mVYXRQ_1Nhp(cRsyYyLJ3w5@F#4Z>Jx7Pzn!Q{+yPD5|o|{ z9vmo`tov5(ZR6%=!me~T#4qjecDDZdSeS`i=sk1sMG%?eU68Ey%96nYcN!K;eC|<& zS1k$R*>#OZXR%-u_5Kv<=2vERdfS_vTr*z8KQ*({Nnfk0X(d?Q-_>aCi!@sOhFUf! zg(>)LMgSFlqx4>4uDFR~M+HK`PYp;ZI8JlNjd0SBgOjE!-xHdd$yl%}O~E|+XY4-UsW`b`U|Lkoq90W_W848ExQ{#CqiUT!ITAufEt5<9##pAkX;}6U+ajJls?d~X z9?f!1uxY!fvUV#r+SxQJKMQ+NN2E@27sZD+y`SFNbR~3FpQy&D_{nJSvH+f1@J* zP|Jc?_kj~5PG$-!$<61FT2C&tt}pOlEUZp^?EDdI4OZ+}!3-uD8${CfWb0b>r~6I= z##OhL;Typ*)p(sqT8)U~C{7CZs-H(9>2@c5hm3PkiT}k?x;edsyWqs#u-1?aK12=b zU4MG=u~H{f1+wv{Y{!2(=~wCbzF`rD++zv<^0L%^?(QNd{V=6&bFwn(q}z+_Wl`!@ z=*Mtf=ObwFeu#Re1i@4&zgXq-RNm3{1jwtlw9bxsTR!Yw*K@>?9XqEV9d|MtA-#5v zG*yRv$RL`NrE3!sjse4s87m;WOvsJ^S?)Lu5KH-L72Zl==al48XS=(jsZz0fUwiMy z%B)Yplt6czH9IO}TsbPayG&Zn2$4GkTctxh_J6a}6CUJ^-u4Bfpg zUhH)_>18m(Kxwpn5j1^-8m-VxLZ1OW+9`qDE!-O}pEhcnmy9r26z z?Dwzo2IGDveW&)TzqZ6lZ$&8v``eh4dSh3+>5a?|DzK@FD00P-;|}CFxZT~>>9(hg z0Bs0B`CXFtXbFRg9<=6FVmP&Sf{hq~0rdsCtEaC|R*;FxWz0-gWHveJCOIqE)d0C< zz(l{H2AgO=W7BO=yXL)8w8M00XKpd&Ld^;8+cF;yxC%3DG5}VX!~G@ZyWS&TJpuM^I70NU34AEB6`g zp>WSixD{_grUSz=v(OUVNgukeNE+m6l`(ea@H-fPrqAnX8rD{d2?AG=dDjcLP1xIb zR@l{Evi#yyxr_zRKWz%(gcwUxR&Fjh3*+5=r=)h1<}O5|Zz92X1adc&bo9r&)u^G; z>q1*eyj>z#b(`U~+`qX5(JK6Dadiu>il`&jIwx7qblK?bAoeQ{zAw{2ic=TTrXlHd z1n=C=)$2h29d*kUFw26@&r9ea*rjFR14O+VqDZqVN_4dC%Lq zdfRDefXQB*Ah=^9Ox>!H)Nkr6=&^5l&EX=3OU!EFIm_XM?PxxDI}Eb{NC2QJA_qaWdSb(9&3S zQEMvM2>tTbNjv!|wY^BtZUQ2D69bTriG7^3qBZe+Xu`zc9nO-~l(;=nrn8paeOx>D zt>3Tvv8a=Igc}o}uM|ynrW$U(NDZCzaj3ehu>_dNs!INdm}1U4YiMU}(1{(DxA52f47|H%k{RRhD z91*haO*KZ3JD0+XwQ*gURl+n+v5x}X=^DE1IlJ9pN9y(&}JzQ!_32IgBv< zjquB!#Hr;8EXS_=4wzM2(A;Ua(7qzcv|5LaR>HDeL^Z5b27ma2sSAeRY9a?1i_~tW zHs-C*{!Ah~sPGAM|0PW1W+9K;n{v`qi|K{luQ{31DUl9>VO->D!urgyTx7A%NPd*y zGY4^R<{+~uS@}4)Vg=aUa(oI!0f(np@Lj5jA2V-;6~bdGT5Lsn6BTG_IOW+h`LimL zK$kSFZ4cfhF3CLxfCkIg!D+aARB_vXP}(}}DYvK6x$91@`;wU-U_I!3!r}>1dBjOy zXHlCDnDk%Pp1)wrhKbxUBDY#yXUQ#s9IQ}E;;+;cmuCNkJL*faqwGaI+c?g)2+o;k zhgAA{q*|1opkdXtCifxy4dLU@6ch~M%pY1lHrq1sv8sVTD3p#`)va#YX+srCBP*}K zAw6xFnTN57nbn4o6vn3LQR{}z#*mNQR1ffRJtX|GW)dX$I4U%7R%{EB8vWj^WNs!P zJEtZ~QzPAlWklxF5d_m}@F#^q=dWW(`erXYkcqb7Bp;CjvorD>Hk z)2vqS&$YqAvegl&xjn=3KUnoJG_n<-4{k}?N@7v5n85oVfQAX*=)z6b;u ze(;6=WH@{Pls^YeG1lreU^`i;`g2RY!!$hvU;aDZ=#TFLb3Sn)+>A?AcxB1poHjAj zbSphD&M)%TLw_8O;H}zras`BuS>vFY0gSt*q%5mp!$oO!n!PB=I`#rHt+Nt%+nsc; z3eoLC!9fY$3RJ4@g6<1_nh;^Swt%!LnHB3V!?Ej&GKx1 zO*2Mjm9^q=T3wlm+HW+*b@ES9`yx7G52}b6$vsi9gIrI6t{*eWDEJbh+|ok%kU8+T z=YBdrlf+M|gauEzLdMUAd<7%9ld?3AjHWOQgu?iMcq!YC382@waj8-;x)htiLtBj7 zHX&Xy=oLrhM-NFT5)?8Sl-lMOn6B?{K8q%ePWs27a()HSa>Wd~I$*itJrm`*JqIir zg-_t#-F5EmR|jWJhwz^vj2>5>K+{!X#SBQz8~8oAn=yr+ZhIBTUt37Z7Eq?@Y_;GA zixb=oWI?9eXy67h!%OR=-G&na$wGXXEvL1q%+mLf+^ReJq^|C}pE5R!;pxEdG8V~K?P;Ar3tD|8D1>Xdo znk$lxfDnPx-!twqhMFxtq%LBB&!}C+F8%O4EWp9C`UQw*mS)UA3LeVhK;`4TKE$_}dE$MaqcOi;uhZzuGHCaW1( z0%tV=7zJ&IEiPigEvHB*uVcZB!Qr$av2jG$Dp>TOA(otq1UEp#zwG1M_DvmBFQX`* zU&i`@^_-S+wF>vjeWEoMb#<&$D?+0phE(E0CpJKO&IpEX-#k#8C-s}RP6`=}xI?q8!$;a>T&g5d94 zv`%IO?2s8Li>`cIf-~|53!W>Yda(a-->GJ>R+zY%}#HxdxN_w?X zJxp0CE8aM;G0pzFyD^KI$x_De(i0g!Z6Ax1$)&-6sABO`GPiKe-cAYEtE92)Uv0OT z>|k)GYCzhW`kc~R2Js`5jh~k+TX>)}OD~j0*K<`iqket!Ep1yuD%FO{1_&3Ze1Vc+ z>|Vu_Rosh*@fQzeAmF=dfQL|B-=HLzxmWS6Dn4beVzmzr->X>db8Q3D zblBgpSA)WnFq?DiUxt&=}!{c0~L^tfZUE^R8g|}Bf-gHShWX@7A_`)tuf6lN_tdnZ=EtJ3Q#Qr(t)8Gf3R^AKn* z_~uphfPAjEe%)V>h;}nROJC>#en#7`fs@Xvwug15dYtziXE7SFz{iRH z^F7Q$qO5+_aFCFjt=;J%!%CGfK8-7qS|HvCY`Jx^6-lOcP3592s&0Fc2neaYED1i- z2#UirIp>do=mJ0XU%sN!;Cc1gSXH>~vHJBl6?xsubvJE%Dw%42$ses7gIO{`cz!68 zfl?br;Bw8(%?V>C4uf`161<@UT$-M|rNkyIHW7tjuH15al zg&BVg7!tvmtY6f!xs%)ZmN^L5gfcaPAcdH*Xg8R(z;)Zz15#p=u@a}WE_jB87(^L* zRK=*8=Rp97-~pD&lqWm}!x@{bA$XYn$y^7A^Ji#0Eq&7snEZ~7%y;nRJ+p9wJam6mP-}4p1sX4^2tj^c1{@)ElL%;L85+LYUDI`eay(V zMSq>|wYPjyjQ#azLYHEGEuR#bqIUO_SC5E~-Ge-PPY)SBpO%sK`x7eu#n&_#oin@X9yA9G4rYFV33N9mj3#TAzUeAko}vbRc;sgRI}g9=oJ@0r=mNE?VQ$?O10Xaeh5T; z>Rjy#haDZ=;$P76F(q|&H7DV1m&g1mEgvImDE*Zrn*lR@{!20OzZ&j^p`IIt@a`uI zoOB#!oV!Pe@yy36WUt|_9uww!yEbXfWpeUXxVt7dv9+ zbxtYnjpTlW?|b@CdN{XR`BJ)OErLf3cQtUg!1hq>CaUU;ZSJ#s*8gK4eEz;;fX{Wh z4*7hB>)Z}h&$u6#GiRVsul&QGA&s>(bJXHrVM8>Lr3M}p!j-t0O-~lWZ#j!bgTQi>|?36kUcEMvD z;CH#sA0WLLjtDAaPfqhDm6*{JP-eP+!+K*emFj{XYpmmPFEf|e;j#+R%?PxU>mDOe zBSfQ6x@QEogd;HjNbm`0gFyHiOV)f2`D|DiZsN$XX{kSr<^6Ijfos`W@TeMKb!)VQ zB+QmZE1^&s&HD}ChD;sn?)%!E742T^yLL^EuLPSG!3l}*w!~o;Gz)U6oM=&2s_raH zGAsr!N`r3!om+#clTYy8E@Tw^(ev@o-qr8;3*)U5k8rnb56+QEFyPr3I@JBsc7?7U zR{SWuw+Xm2RvgLJAdY5b)f{#j4W@42BMqT}P?roEA*zAI2ZCz9ah=-hNZLgI>=F#_3vKTxj-FQPj};D|OqfMOz%N8yG-ynf z`4?_?*2E43h1d<+C|zdwXiE53ztej4`(}MAVw+uErZvf%$6CG>*9yRzPPi`~$<2jzWP@!d6 zw1>H~+__tEegA6zbU=o#-{(;h9J^QXg(@!Ht61%WkJj#qMD6KS4STI<$MIXrZ(ZR) zz(Lf9VcWp^-(VTC{-*?KZF*yZq$QL9O)Pj+HU9+vuc$BJHwiQH0p}b18&EJf4VD&4 zf`+|{zpCP+_bOKVVE?^})joFzLoKBD>G=Se30+hf?FjP$+rxZ-*{q@O@BphO+D=uE zm7CFs27}or!88Da@&O1?+B*4TeoC@4Y@1k6GYGE83-bojSZVfLU|Q>LLTNU|FwBB7 z!$XJUMCu813@TW-22#x?K-eo|a3poh$QRVUYsSD#{Ly@n*Acfjo6NxsGlv>y54)_` zsjW1t_DZ{IPnl(+UA40+$Mcki%M&1{m=$}~mj2Z`_@_|b2#;#g7>JF)2dyk zPvRnZ3%V<`99Xp*qPSwabPwu4uXX!>|5}4%&vpB7YO#lT?%#^s-pHa#@4dqLnBb?T zfw5D&5=x5Z%aooqbp3AEz-7s!BYj4^SkMhnaII;-=c@jGN|oD{Kc>Hf41HO@-Eq&| z&tzY38?vgW{%Y!_PFD0om-9v$FmwS3@!hC>=vuv+aye%jTR(+b;~ufudmJahP6k0k zrdNfac)A$AOw?nfvXd$^oL2SoOn%fJl+Y|xmJD94rkSiF#j0Z-Ml~}zrD{9a8(H1E z?+%Bie9k=Y1T*6?bgF{EW;JdG5F9g!MrkPXdpX&3g|c9hAO%&8_$t?5N?@AW*qXl959r`HhIZ5q!)!yB!cY~j~@!(#r7`oGKRQ(Bb=6HHMbuM6P2xH@$m$Fi}vRv*hsDxI7@4>v5+RwTq-#uIEa>@ ztlb(Mrh(9$tgOf9IISlSgCJ-4%K7CGJ^|yxbM{ydL(K?FJX+S`Pl_)dcN&Pt$7`^5>nv@Of;Y(T_K$zlAK0Ew7U^&RJSVdnjr_w{Q@sc zMMQc`l42hVkKqKCCWHWgjfo#V-Rr#l z&^Bc&IB8iEeXKY&`mw0DgA~O@3GWq8`qTdH*XW3#ozatN_YurVZ$M=dQ8|jd&*L_At=l`-N&m+PtzlnffV#a2C;dJb z&OPQlb}#vh&X~$aI+-Lbki{&+X8g)@>J09iqbLL&*7&h+gi&;83c&#y`%E7>t&ahj z!Ht$X&C(%ZcYpUXkqzozIwux(Yl0+1zp$<(Yc~hf(k!nc=Q>NxgA!zPmD_NZd?+%Y zZjIF&DrGHp)o*P`<9;xqki^qk@!OzNNkgrojg2e_ZA4o;W=4hi8D3~7Ta+9LS1Wh3 z>j*j1$J@Aed&%dF&?;2k21`7Y!h%ZrFccHq4a(;X^jv>->G-g}(mzD|wzD{`gLoz; zLf~APqFWIEA1by>D}Cl}CNomMt&45nDl=Z$8XLo4U*O!WgZie&nv<1{=hksbW8ffY!ObyD#F_?Y(Z%es1rL zPG$yop@}|yLpWIkE`!`m4oBjDArVdv=mHAypp0rNf(H45a4gh3$u$CT-yCI3LIJ(u z8dim_!94cE*(35N&OOH(mvdqk{}XZ2e>G)Ql$jGu#uvRpS#5jncS^T_uIdG5?`r;^ zkvkNPxxM6lUMiBi`nHkl#9XZ@zQsv@PUGXw{-o12U}))$VdhTyR$BBa%eZ7IR|r<; z_7sIlCv9I2O*%1vM-C(fa|er+LguGUrW{k|M@k_@5d2-n42sSv<9j3C8@W4}m)zc~ zNxG2u$^Df-%kbvb1Q(toRV@R&`Dv}dTVn^CaS^-A?gZR>oK>c`o*G}J&YH4PGjr^m zQW}kt!(N}L-;o-j2%)n1S7vg^yvCWW!Vq{~XU?DzPDl3nH1*Be0zDaa><&xssD654 z>7UYc(l>zG(tSMlWv=^kXDBCuPJ*cnG?BbqJ#@q?t@Y2N2Ht zdpm%3Os_CG6mw+mtkl5}nUQI~{V~=~m|DbnsJ)7Db5_$|kRoB@dyh{1~^7cO%s+u}x)e>T-7xlrT!oPMDMKfPJ_3mfRZ{qB)wv zaL#S!rf?{Xwn!a61iC3Vt-iPUt=37=<-+Q2C?)gKVM*jy6?9l))o=dB+n#_C zS;nOZ>-O->mXqdj_DEYd<@FuT(nZ`1iG5jdVH}qCVDv^`D4H4e_Uz{Qml&G(F(wB(3ns>%Z36>>D?lbhzhg2u4tIB-(p9}v*nuo$a1cH9yTet~@cb1mJ7_0D21k=Q= zmON1*QW-f8u`HynwB-G)r1`y{GFq#!Rxa8 z#*($H$?WDV?#?E+;Epl680Qt-|M);Q^gA>No>J3?Y}1uT({x|Q2%n&7z9U#7*c(IG zBR>Upi(tR?;TE$$Jg8%I>^bb52tu09nM^nC-8tqdrt>-N{7$(yR^!5UdhOQ5r;Thn zHn$zZ-p)z3Bb^nICGIko4wI=&oiOk`$Kul%IH^l`VuE>V(F-lRBXL6M@nJJz`n_+E z+nU=)bQ&}q)6+oN6?MBg1gFalh0dvLP-=s?hb@{?UT`sH7ohc<5R&%raFLkzV5_h(@Os%=hoj_sm#!u;} zXMb+&fu8@EE|H05nL2baaDX+)(4|1os4wtn5d1(*@3Bo+9|gQk)@W=pT7?Dh%IUI) zA^u0XSS7VmWC=R4yfW`qTyi;CfkaTFa7hzz@J+~h>)ReiC-v)ZysEY05Y5Tf^LQkA z?}R$PD-&WAdcoBy!1Z26!`2IX>$`7YryWAdb4!vSDS(tY*i=FqqLj&@45E4#J~x}X z){64{13F*B^WNU87uD{><(9BLsrirgwe9u0mv2`WogGem;dx&G;@<1xItUVIr%gZ{ z1Cm|nGIZF^{p*!BWW|$NpBiRtescZp=5@%Pa5t1F(VZLf6Y_P+N5Ur0h~YI%Z&6{_FX?7lsks?QJ6!@Df3)l^vnh3) z^*6?xt6q$D7^|x4XpKG48e802mH`6;#?u%9&2I`tENI1l(^0PrB$ znRK?*HqR?i$jrKDO0pyP8Wq88_O}a%QCHW9z)-Wf08GJwbV|YE4x&M*cAbB^==_#< z<}kYapC#w>BR2eWGR0*l=|?jwy-bVcPpB(;$f7lk1S&?9Pnr;GS#2g`Ss{)l_^v>u z4R75993sI1@@jJvdT?x-Czd zuffDQKuOgfjDPVDGv}kWvu5z`GZoR!s^?zl<@g#Cn?1e; z9rPeHWUOWTB+6{^73wb@4qrIeu=OMIRm+Y(O7`|h?29K{%j?hUTS|Ek^=**2Y}#S(@uHaLc4X8=%m(S zS$s9mUp__(2(>w6Kvk3as>$lYy=w2JmX@Iss@8kmLyu{>VACzHES~W5WuIqITX4|8MBztK{>FJEdaX%7al67^zz)39ia!IIEx}UpvaP7ec zTX6ml4YhGRfXWFh?Vyct)?O@_ao9(L(GmusAX&M)>dzhN81y;O1UHeFW|x-2W>34UOXV-vHa%GT4v4%_snq8=a?keB!<1)Gl{jSx!s?H zh})BJ(!0z>4G(Klu6&Pq=>fq+zuP2+qq8qMMLzfO^^B~Y-8wW-femiw(Zdk(j0gr?=S`S9=XPC%TWOX z!Hz!-Dn`U=71F{QxxiLhuxe_GICL2=04)5iI-nIPNfXYm2x27BQs z==;5}xv>6r4^w&`dkv zzhSNF_A+=ri!x>`SHxye2a|QYWe+7jBqo%X4U_ir0l7O+%!J`l<#Jx&(z!>Q>Jwu8 zNquL+FqLPN?=ci7C`xzkxtROLL9|}w2#Ul7Z%skqlcAOS38YcQQLz-m`4mY#k)7&X|zh>N-qgnZc_F!i>@jjdQ?SZ>D(| z%zq_|O3XBsjcj4;(5G3sQ!WOU&lNN@W_vmfjrr}{Y~Nzc4K~{|3*dIOtLVe5KBIQk zh&F11c2X+2lcip>U69^^jLtpJ!PEq87&sXR5eororpU-^){8l1^xU3*bJA-~lVvn< zduBVCKUl{be1_F-zX$l&N4R-H3c*@`(^y)7^F>X!H>suyL<+(*c}?LatC$ZI#NX2N*f3q#$PzDHdw zJYvvk){wtY5lbf%dy3|uz_Y|2Fc2X)(2Qb3%vf;f0a(9@Itx#E0WVIs>A;u=bbA8%9K zcqt~N^Z)6nDZ9qTl)MX!x-+PQGxRZY?|||okSL%GA3#IISg=23iUs@q7PY}^4;U={ zNB)C=0u$evV*%Dfa`uZOBDB?`FUDNVVwL94mLN5Hx~9znx)mTZ zPV(0i|Ck7mZ8|Q_$^U`Z4lNFM5pMor%WgBte4gEd$_1Z?rOJWhs@k8KDHV9zu^2HL z=zRpj|E!pRtISvB%PH7T1i9w5DAgw7At_vW%j1@ZCnc)!bCWb4l--a*!-J(uDHDKo zaB^ZonEehEHdNQP8*D215hY?U|Godkc>lELmo(m&4Ib~0jW)f!ukrq^!Q*|gg$u{~ z2PjqH;-Kf3{tla;HstT6PWctytRY>QBS{T@Dme!&SNeyUr-WuEXQP}XV`5g-d)^ka zsx_yK%;1je5ed#8wbseD=Flm#S^uU`CZn%F@T;)YJZAsGpr0C6c>NCnG0y%1LJfIs zWQ9ZCV2uS&s|2CLgG9%B@9lA3BDmDFG2=gM<5AK-{--kj4TKs0A;dM5@J!}y^hR(g z)~J(0N3#Nc|{QcW-8{aZ4z^> z(~9U>sa!{bYUHP62kQ-i7j}W9j=FN&SGIp@!V^4&r;AFwZaMF`o>P+)3*>RY8Ai~7 zXGZkwKl13f%vljTd@@80lE-mu^>5ss&)0VjQ*A%SZw|q@ z@aHt>cfnafn&z`;F8*04Fl2PhW}JO$gW7oTZ?-l#gkQv~ISbh;@^x+>OWp*F9_OBM zxLLQ4Qy~gkT{ex2IJ!FO8TBzpfCa6!iVJhzw7qg?xa6YVT<0> z9J$>KcT2}bzeS=BtD;l2c~>2Mwq=)H8E6TQu+^sfsH$Y~Qb9L*JxkIDOL3idv`EoT zx*kZYJS`jQm;|b21onioF@qzKSjI1whv}N%=V3h;;HTZbbM1R|oO>>TLszd8>X!co zsOR2r1~U8FEq$71oTaB3L5Ar%^CKW_{3DgZjn+KQ(ueu00^Zq_214W13)YzNlfo_H z@GvN4aY{I!r$xMaUh;2Lj~g3SEi7CuKF^}1T|q591#}Ze7}{FI(y)3Img%G`be9Sh z#!E=1@_xtrfCGZ3b0C(`VX;bQ>8lii86pWoR!cbcPK|}fjT`+3VzX;qv+x8dzV#PU zx6FN&{6@MxRqU+j7NE>Ocq#;L{(WH-J%WmbofD;Smpc%8n!o#I=YBX4pxQKan=##8}lGTKH*&fo&F%xu~`q)g+>hw3{ zyMlMc6qq`v9LSR&KhwHHW5CJ0h3^4-`vgEFHOu9{M_f^@E}%b5@Ko)+xa96qsoCJv@b92c48Gv1 z|0uZgHPXK@1ZPktfSeZE!M}5ttAG~V)KuA_RH+wuC31S;Nxk&BZx~D9fdxc9$B3Mp z&X47yPQZ$k#tpK9JWY_Jnr?bdxQCcRzvufUP#T)I=W;)^_=5GUGFcu5S~(82f%`atKw ziBzA}^v-nQX@16p1eu-I(UKlZ4Rh8`i#0+_k61&RtNtVLPtjEQMYf5`+m>mrVBKd< zO>+^q4>L3O^rzqJ-T(*ga(hat4Pq5RSgQ(_jK{#b)og&!zC;7sIxQ$S3~`Mu$3dn_7MYfBD23` zaevGDEw{hcUpxnJBS45oM-|F~ivZ?5N5kC>WtV=jBls6?Yj@Uerkk9#ch->(Z2f{+ zByv~7o!e;w17~fAB>hMzcUO3?FWO9#*m=CkXPlbc5cS?$_b1*a=)IO2-a^!$hG_hDcN!GVq>~r$!=pI~|JO;SKfUn5h1nW*uUUWZN8NR?)@6OY zy}ciHAGyBe&BgpnNPeUH!eJUs630CV+kheCcI-~ z{l@0)P`yIL?@P|+C)!@MzW!OK^-ii6HzyOJ*qFEfl!3!wwEtS>q>lsydHQ2L##5QJ z|D1-54iU#Xc?$`HyNqo%;r7asRUZT&qpSLWH_qO300?MQK^D-yCA!$WB|0^M7u?k& zdhi0Ety9KD>w}xBxE~mHa}5b6-Hl)3CBHnuTOT<0te2P4dD%F^%!1$=c~2;mLs^C% zENdmY3=7RW5ko*#0uwY+UlF|~f>RA(`gx%0NC6-7unwJSqlNn4_^IgWe^1nu(eV`3>ovVRY1rX4e z0>kBtwo)Lj%{MV9o&V}?ewn#L4hu3USrJ@I-5@r?=b2E;IA1Az>k;Lo>`O%HFFb}4 z6y_1H%V@1VC&g%OKaiW6*8iAOJo~U#cOhi4cwjT>k+3ZIFS?J)(rA|uC~MgEltsXN z%S(J0mFstiKYhbD{#5X61Vq|?X5pPRBLEYj;AtTGtA)<=Crq_Yj}GR$X)xSgeE&c^ zh8WKRQqGx)rVNenWWX3bB~T7IMfCj+`+VTq9)n^|@2_mj>Pj8d_QYOHmRsVPOI0nv zPhqnA>qZz0XHZ{6i=pF{{xW9?%&T5`d z{Z{)ZiG@@RsHeCa6U&6$1Y}1+fatAp;R)XM{kAlHE7 z;-@Ii{{?&3iwqi^yX^}+&Ff=343UiD^I)j~eoVl}TmKi_W{R}F%|9AkXKuFX=DWd_ z{WtXEl>NGMR|v&f1Mop`y1Dt8;J1eHGnqrQ#OSHO92=xZ?#E#f35^YgpVA49q!lWu zD+_)N24*JN?p~)8BwyQo^fxhv;tCLzMSpM7HKg;*TOZ=VC=g`&79Hj7Hu-JLFc?P> zzej74Vmj;9B^n2BL8H8NYIHIaralU>&rE0qprX^-FwWw`4NQh>6TUn|r3eV$5CS)a z6>IjaxQqfwLUF~XQT)kW#_{*hU%XAmo_6t1FfU!0Vo!V?h&|MIIWAN8;Q0<-6V957 zaXY6RX3ng3B;>e=;eW)K4E{hP-4k3;^b?BQKlB9~Da8-(XHLLyptBRBJyr;cQ>HaI zlOAsHVG9>pihX~*=uKCpi<05zj@vK_=HoCq#+BDI*gta~47JBG*^>Nd?33phT-N_h zBPP|q-n@fWdwjs75MRoQX4)Kdn0qGYNA8)dGbuna7fM3tjTtjc&M98i5$31VZXdbl zFA-tW14DApHZBV%v-9snRjfAjKK@v6itfVPvpI|&XABsxVDcVfU`Pf!hMkoL4-qSi zK6~+GQOtS{JZ7PK0fqpIneJbUc&?A&-f=%**pMY2k`X?^8jv9O&Il(!wr588;|%!c z?U51gQsLmd@hcQq#+h!4?64>;gkUAGTnRV~$GMzhhRjpi8l0D$rODwK7&ZAF0(mnE zXP_euh(b#JF3>B#b|Sw+Q|gyd!s?@vck5sVmE_Y$85omK3ulaaO8WC@y(x?QAPLI8UNp=q`1mQ%-ujHz=sRL>~nhS!cny}>Dv6V$?e zK}im?!d)vXqw~z$&MG~^)8DHTf)Tg`$!Ax&+Mw%SfO+dUse<#weT5f0 z7S>zqRJ$ZP5r7X`C-!yhk?+~_o)e1COp0Xh{w_xXHmBlk^Lc3>Z=3G_9*sX*^>~U+ zsr|yrk{KNg}mrV{?6MdFUP-1MIMIW1(9)9mO>M`YnuM80F>3j2GolqZk zz10b>*7?!k`xfVivId;b%D)RID_!9PA8QliXpaSFuvtJV=LA0vqCoE~Y#~@do!vy0 zb(sPBB5ho=oU;>eNT2hZGSKcZR*96q)RiJl2r@JDz*jI4 zMf448S9j}G8KvGvWGq8Q^MRr;jPl2-1I;Kj=1@PWBDL8gmwi<~?n{Q^E`I>rZ>tQb z31J;H>s9_d_xZ1Dq7V5u`w%(}ngHap2rE6)4YA-P221{E^@#Cctv8w#YZg;53IY5a zVZ8PZ?(uzUYZUc5Loj^MW=qxf)EbSj?B@Yhj~E@m*AD^8FBhHFrXfT3zhnr6E2t>p zniKfB$0^!lJh7gIvO>t^|00# zyt=*-5PoX-F^?WBzk-aypayHzjQ(vCE|@Pjs$qc?-QGGo%2$&pzWoe;tRbjno9v*> z#`(X5x9BNq*rw{}cEc77(a~k#v0bcqm)WmPLde!1!t9Jhoc%RK4UOn}&(O$!7dN1M z3pm)$j;h7GEhsIf)TknfxNVFv2X!!D@OH+^5sD0pRRiz4Ldv#T{NdFm{=`!M^YP`| zFfl*sjh#=aH}+vHa``we@obNDQ#E+J8Jx?PJ&Vp{2}Wmw>%|}T-Xy+YXw^mP_<_;& zpOn*oMKld2a=q*#f3(!@pCa1l`-h2m{xD|+iH}WuimUxhJxMgNH8v^Q?yOzX&I`#W z*S~k;!On^U)0>;N0Ay-2LYV&p`nlBG_{G8eG# ziHA+b_-B>zR*xzKDs}lfR{mM5#rle6O>cF@6d?}8&i4+k7+BKf1v2 zH*`&s(MI@!mW+bGjnRldTHVq$sY05itZP!WV0iQ3qwz(tR)rg$eqeCw)pIM z@>1``0S^?+pzr;049Z}sI5^xNYw%916kdpjsOs)W?cX&mp~9|dNm1&WR<5651PHuw zQUj*i?~zP=E`J+SDZN-D*q_3R8SdwLHQ4d{0|4_KgO>W2RTZNN_gUnJ{n;L?oDPGjf1?cGJdFmJe7yKjkfT)#}1dA7;7M%FUxJwT0 znb*9(_fy7R%qJSt$Wgm9Ms5F^DMu@oJJ^cJ}yJ8=E>(=FXqt|;s^-dA3JqhT2 z&uVOTE`oassCjtcA0K;L=sd=hF*gmNK;yxu^(ApW3K;4zrTSS#?Bnq~;s*SV?Lkez7Bp7y^b zw;w{67o;?6#$XzoeSBH~js}YoBb-twIb^FZT8PYHPW6J$_;Brts*-*hHBLF8P2# z>PC7{w{2H|P)|W@!3GR=-Mp!ry0B(DH~aKp#|4Q3OHUh?v`~Siufz5pECr{^uZ&jz zh00wr#(U2Dt({Br(aFw=;?}ZFt!1BQ@4!rd%bFh zH}(mxm`|Ox>HQ-Aib$_5G3L=(%qu-b!tI&n+%*j^uIT@JME`Q=X5ueMm^mB^4O(tN zvRN@BsW(=tMfgmqs=lnM#`tn6A=fMStaVRcW61!n+(`fyigQPElijaCC;J&lx*P0f z`Jm#1D9-<7jo`B8eFCRQ|M{2OB$7N`n~@SFKEv{QQ0Q`~8vfj#ff=hd1;W`QRCC|c zLg}5Ln(Szm+~KSkrZLlcR^O6hZ)4T=<%Wdm0;@}B#h6fUQH#wpmB<)ugm|_DG`VpS z>u$|_FHx4OM-#zFPC^qg{fYC!COWn&gmwY_?p6$EFHIR9bMI>4nZ9FZX>0u}PV0|{ zq2vihV#4|S$Z3=7UvygURVk6_;)e45n%?oYyW4tN=g0GZ8iH4Z@m&89(UH6jBKMF? zaW5_YowLtvjm%@}*k*w!cs7A_?rYp;-xGq5gy4(Z`X?A>wp5w->sE&SW#@j;ht)d>51* zU_NsNjTzp0+l%2_pWOCIxxXo37_iLY>eeeI`#_n_8RX6$S{7GX{m?QU^UEDQv}~lx z#tbbRrLs?;yVh9x{@i*K#A_~~(3-zCI6PzixfjKua!5ISdB_X_UKESq9J3!?Fsi73 zik-t7(F?Ovh2QW^V_P@J2ukZW-gF(A7rK;#w3nB->x-gWTFXAuI=iU;m3-pNvsme1 zmJ`(01pQ_m%HEzI%hu0|-S7u*3n5>UFFRsH(Pvuu1|#Ho4}?Ffghy|Mc2+6*6}<*& zi*r{AL(W;j-pg5QCBc$W%*!=i=yUP3)~(tuv_2!(pt=0B5`3)GqC@z(QMwvXx%L}# z9}4bRUFpkFR{6@#gv#GS;Y!mZI&%|tatDR0OyMvU8h>YwkXy^q>uf?Lf2SX3=>X1j zKTaKZ3UTVmB#Tq$R6?9zpm4xXde2tvz*i1(k%g&dkfR*rMF+dGBq-l*IHFJ z|6?z&8#7+lT~J-rbW!e_BD*a1FD_|~9e{gW$|f~W5|-F~pO`=01S9{6y1nVTBf7e( zwWQLYpkZfw*+wah9mdT)@L=+Fd?x6_SEGN&v(LiW^4Vn?j^fHXJ zT`!e1J7-|V_7H)W_ponUCj}MNu{Iahz8&vw|N%-iq zN@N6I_;;cojd|V}_Mr6^@)XQXHta5IDTL0};~??orX&(;(n;S7CkAdU3fImey5fDU z)rC8YgWWocqknb#$jX@6t}$jGbm@0der%b7Emd|-!TZ~WHfWW0nd&s-@d+WOxaFFN zo%Eqtm$UR#SaAFJa_TC*_sOPJD-0sP>{op2Ji2kY`XjiKmwfmp0`%7TCSJ@vLyK&K zdZbL1CSMT}HdDRCu>)RPTFk$>77RO^Qj0hFkXG((Tm+dqBU4wSNrB|_YNPCZ0$D4N z9~Z(y|6qSssrzh^`(`f(6O4mhu3#v2TK^DSdcAsE7H9(fxa9@W8J;JJLz{@1u9qvB z#Jb1H!S7s0M<2Egjbsl;6}jaIWiZ<3SZMkv@TOF5795-Y-srDuqHSc`>7cY5EHe#iVq$z>!Jmoaf!f?Ahy0F7a-Q^U)JhH5y-Cn$;p*lTEUy zYqCjKbxl@^ghG?D@;LsoSpn@9Lq>_DFs+^KevpoSB~Mo85v|`WzsfTunN!PQw50XA zBF3T8P6>}QcxM*4nNhnrALl^jK}%u>PO9J0{C?+@lcT)tp$oM!pXZ=ZS}(Wvg{PP1n!$uP5PG5|qxvP;k4tz5sut#p9m&nznM5 zeS`LAj3Eua*OF)Oy=J_@_Zl~Y?(q|`^%ke8Z>t%K-@w~4Q_p(c zSTbIBisTDtfs$oxFr8exiQ;1Nz#0}s=pZzDIhio88ThC_#L%>!{0YNj<6lkw+zvaF zG6Qj#FKc;60ekjrwCX*@%VQazPw{#@6!|^Q^@jQ+Gx`3t;V!}9^ic?CAzC&FLt&e3 z@#!a~bVT-Cb<-K9QR;atTzfgCYYdqw>@Qp_df{=is;@zYYo^Gcl@?w{{(=7SQ8L8}haR0?w(>^KMNqoru-g_;7))5E4;+KnYLu5F{ zp$}4lp_i#O+%+9W7bNBC+ko9UIXR-~N+~|nkNLFsvmRR@H^{o4L9_W{bAWS5z1K7x8MmHFR=@`=GzJ7471ClYJlT@yhaxof!2b{qIx z^1lt!ANGA);eJty4Y|X*G2Q%Ff3miwO?Yx5LSRwjjF56Cau>nBe#MGLR2+&1d~lz~cxudwbz@a1iq9lT<`RBtDW$D&OaJyz88rLJiu z=qKWCjIuFrR?yzGn0Jb1C3qL-!T2{p(-D;EN4_K6(S+;EWWpb#BCdrcXoP>+5BImK zZX0#^H^Y);D*3HSy2B1I`%#7c3HhXDtdR<`oF1wr*m{k^6WF)0P^cGyPsBSG-f7vW z06$`;Q{&Z?(*wg#MD&tDEItUfef57hcsf8rvo$o!zQ7-21qVwk&bXM|j{Q=m25fc= zzyJ)K%BAItB3Sul29>p@Lu5^Yc{{`=Q&|8LGAZ7eUQDY0zY8$$0F!@RxK~P=)#F7V z-0cPT`@;R3t0@D=m%tHfw&o$q--1bw6WC5$+dxt7WQ>dbYLnkwte>4Kt6W|xsp8rT94R>Kh6hu#h!uz~r})h8oy6NUc8 zry%M9U6YMj+ZosP6ejvAIQFiw&l@xU7bZ`pJcmSs(s1Yl3 zilg;M+>iiJ&o-EO65s@lwBN~oS4HkI=?-zF$B%W*TAhI03#qU;EyMjc4XI47|yR3@sgZ& zIzbUsf<*Kc&Wgj+TbnLVZ{?-7M>s2n@39|k<_DbtG4sP8?flRh&JRbL^Sp)mVGM%N zr^AiQ9d3N&ALY1pM11k0Xr$=@XU&WKF8eRHmlRxf(;fNO`rYx4q30{HS5#p33W!M6 z4?5_;2ZYUGjak?=hlmt~^&70SB090*geAOy=Q#}9KgGVgcYW>Fol}NKW2w!Hckwm@ zo_l3hj4qjyGUsN5A^b%{to>Z@DcT6`zmk#H;Sbjw7-K8fpGN#2_Yr@@%_a0f&BGJz z`1XrwQo$W#Hx?ZJC7PKRW!DKoXxtV>e!Gc3LC1*B&;y{&|My_@`QLgwbx*ybk&rBR z>Rrg^f9~nEWM+Rpf0R|bKg#`R#LY*Tx#q=fk3G?pd~A5r36I57CH|!`w#(kIPSdJt z7JLS`;)>*&Rgr7Gf+1iRiH|@;GYj;-C3*#ruL3gAUj_QiMkRhR){q*_`&Ls6z((jo z|5;=&hx}W7U6z09+;JnEG_RPA@L_ECv=L1kS#P&|q%bYj-13n^uBKm#gRuk5jO4Pb zcm!>5`GV-09OovIzuV~3(ktl8(hK!v>7}l*w4BUrA?>F(-_mn3I)|hLNXzA7E5>)Z zi!pF%f08;~RbQqmr?`=nL(4A1Zn9;Um~k>1mAM&1>c-l-raL9daRzNX|EO+s9w}7v zNeV{_atUSbD3F}bq|5;WrWQNjqv0Dy@ul^fK8H_B4PWMMxx}2W;81H((~g$g;%eEH zvxvMc1>L+J_QQXIQj%D`JY??ZsQjwJ^H8im&BIN`->c6xd*k=3{Li#b`WV7DFLZas z_$(S4zd7mdDt6MZaoN9~AfHSl{A>R)33u19rksCKOy7-c+Qz_{AQtUI{1cX$OC^CO zbc^x!uHnT(hmPOe2CLIzUDIsu{wTC>J030+=hMtEM2pkSUEKeSSTi3t@8^f{gKBty z@+x5bi{iGo`1B=IT6S6Te>c~n?_?SP>l!ZW%4du{EsFUg80F4gpQVP8zJ)PE>dmlg zKeHYRp}esbEu+sB6CCh0#|f8VrX!58PB+Gy+uC1uBz5%e88KWkU-t7x6&hIM*Dnc*Kj$+e0Qi= zKEM2ks5Ht|&Mo+A2BYxswq$?~l%VU?GGzUpCZn07Yi_ ztg;TCin=kT8*rEksgrVRFQzs%tp3J$lYNC^el3nL{}9AtY;9R@aWg&3jB}7pc=Z$z z6(|Tc95H8G$gKu4|B}vMlrdfuC|U_*`aCzpLq>2POU=6JaE;UXNRl$kUc@)l%nfGWb`Oh((S3wt32wg;BS6YC_l0`t%ez6f2k41_L_cT+w^XWm7=pCxiXfrhO-yInL)kvdfC-(gMvHAFoPL|w?LD{~UMBkLR z5l{Bv5s27$nZ4|SXHCqt`kIfJn`_yGlYW%zP>@2r2{Ds=OQ7u}QMNhI3ZLV2t^R2q zcu;~lwN7B1dCmQ4D>lUWCL%fW+VQ8gFwmqM_Ni7c+?Fd5CZMnbD=4;Hde1oNWrKLT zhHJNPn2q%a5%={#$RK)yNNv1v87kKXu1!^bVRb8AqHg| zFMJW9ypF-~7`nMMCjH*m-nt-`)2sODAB{^5^kAWB;BCptFfEE?5(8SacVrJ zUp9Fk=_9z~b;>((pNNqG(fg~fqB<9`owk==rrEZiS6iH7m%TlQ+qF`rY$P{dZFef( zL}xrGTmNk8Ja^adn@{gc-aif_wf?~UsMwB&Q?>e$;#1WuhwRm7-H(RbtMbeyd*Nh3 zD?8Tj7|(Lz66~LRYQ_i!&PjsgIRC0 z0rURZxglB$0}pW52xn8^X@fxcK_q|M$lAIWbBkcI|J+ zPeQixT_#JD4GHtta+mBSLPIlN0>djqpXL66JXJeTlA5OVTzj@jPj0-lHZfj5Iqqa`<=UP} z>Nc^k8n9q!T0{51V$%vc3qNi(8JU6eZFtW+aCXr9oanjr;25X6J)URLTEXD){tZ0F7!UbuTxcO2uj z?I@L}3w~38(Ov#^*0+k+=MZjNTTqfpxOwh1^cRFm)GJt&w+j@1qDWTQO$X9Oaelcm zucwZonu%SUAEVwZhF7i+(e-dO84NxUFZ|ExYh(wP{!i%tNPA@={qO4fpV8My;4NAj z2d|isFp?fm)bjz<-$@`koFg|}@j>WP9=GQ`2Wg#Q(=t^e4H+*U(d-UC8vIZ_ZN$&B z)vnG)e`dxV^%D1}fD{Hn*Jhdx z&%FV&djFXMMG=r0x+oL)7VlqocaPw~y3Bef zLnb@oH$_^f4b=78x|CD9$?Yv>ZYy^(ive?Yv*g{ai{4`Y;uvo>!j}B0vD!`b`XFL? z(--|SOL*`NA~&Be3g&HfF6h!aQ)WuEp=U}iER>kwQ!w*Y@=;OK0q$;azhdf%Nx#Ge z^sl??yW{`+(0K$hMB#%X0Zjz*-i@rE4d188;@i z3Muod5mc_gI!JY+a!BWzWqF)YQ7}?wQUWM*9m?D#h4Cc%IvgCj(grcSmPt*sAoCiX zCI2f;Nl#`RoG75im|6Hr;LPuVYPmgR=6!B**8$@84s$ZkscNCgZ#bDQZlJSI$$kv0 z?rvIWp$js3%G72qmdRy4W{@qj$V|yM4e(u*5 z%VnV=b$gfq@WVnOP0a~Y0n-NvIcYJ(D{b`hC4>Jsi{C#xzH?$y2EzT$MqQP1Rlm;3 zH1WGi0_66Ws;0*MbL08Vp&FVV$jzdjJCSrUDL_oVJa@V+?l#4Glc+5|))ot&lc`m) z8siI6##MRKX#+#;Ly1Nl`NMv7QJbr{w1nek!)IO(&{L|#uX?sFaVBHN?x zC$XlxS)4W9RalWb>DiD74MKxua2bwb`^Td+Y~ORDF{vS98fn7P$EaQU zETacEpYDe5f=|H`YVf{=rF-u9=S{N`Gronx#R@WJbaf$`Q9x!i4CNC1=`Yc0!CIpX zonp~&GOzR(E2q}48hxhDn)EhXY@zSzFW$tJ*>BLtJIGNJAQ0#ze8(SC|9Yx=U_Gb6 zu!$E2#=KpgnJ1rWd{9)YR(`&%x4KD4&bpGeEdyg+}+XC zVG8puckS*ebB?!*7=pLd;fJD4e_{e7fUtqW&py^*;YiMAd*2X%)J(W1aaEY${tOr1 z2s`H$0ZpE(Fowwgiv0oQkM;V4QVzIW!;>k56ZwPM^ux@2 zj>kcldI-Z{sfQO|t_nYDwhLc3A>?}0f-p~^(1ClPeV+d!6<{zK^zBXm7dv5|?RdN1}PZlsHksxBFHR=Hq z2+FF6a1D@!ut*?bQ(Pc~|f5p93 z+q$;*8ntdkY^~@0exEt#E+;2oE5FbG^Zwu7$>hw;GxN+d&pb2p%*;76!4p^m@3RK> zMxG&`5pQDnd#r+g246=NbUcv`&^-h-sg9>IdLG0`8tjM7jzE=gw@h|M{|K!Nnk~Qj z5p`R$Fsy;Q|6(&~CtP@!Fo4q!Q-d#B?25EJ3r3W21E1m)siwDo&jZ-3I;Ao_c?^6*4B-1k;bX8eI9juJ^-1Bh$tm~*k3w_` z>)~Dy1w~h;4!6;L5XVc0Rz%^Vf_f|J1KQg$JrC=Uw20i;IH2dj}m+8W;XS z_MVye9D6)E?`*l656nw?1K}l16eG8nq36Q8uGlsmfi=FypURr|);BnR<+=m3MI?*- zZH66f^&g0EOMi4vdX~RPuY!SBeDx zok*>ItuTZdqAm=zMqQY*nRr<&@jxcdL1N-UNtj>ca!SRKQInGel*6^i)x`51mIH5H zirl3~PT!8L=|%@Lp{!P9dq+Kcsm)KNUL0mG8P1#5gZip^PTep{Li+SiB_V{Y(A zbjJ`DbQ!1V{z~4cIaT&b1G9BOKfoS%TJSGu&h8X;lEOdI(#c~qopR2KQzmjk3@oz=Pq#vkr`P7` zDbqFB_8$+wY*pIxshfM=?6WA>GJ`vdNlrHV6|}X;`;R7P@EYnumYa#?VYYZ@Yq74h`xAW~GSueBX0gEDFNCAcJS!BdF3&~(isqkiD2>VA& zjJNOj=31!Kh;(g5p-b~nRYSrv3O1fr(37e0g`SXiA@+v8hdQ-h&XbHRdSyQx!y|HI zs}K&hvz_j+S3jAToUFJ06$GPIe2Jx}P$?E+FlcUK`gKz_;T=5{=qEwAKMuYWnfY>}bXe^Jt5Kw>^2vZCWC>QFHB{gRQS9ZcvmO~E+kFLf4J&zkXU14BgX6xUQ9&T11J&}K) zuFxXJh0YroS~ZyM;tq7eg6tl;U}5LNY5O17A7&CA<0L*8!ZVSMrS2g-XbJy1<}Iy}XY(&yp7Z1Rwp@DhI3 zGH%a~fuZjY44s3c6g&QfBD{l~cxb@5hq+HJYUR$3T?0S6J*VsE2w;-QhmS*3%<23E z{hWf8=G`$cupaCR?OOj=g>EM@9~({KB}0JL?pR(1Ia*8s_*3|-Jk8P&>S7mGrDeTm?GSrKdK~f8 z0Z+6HEhSts_!c$={Q}7Mhv39@oHZTk4=O@?!x!KU>)>o%u?1S*N$<7Dx8uBw^gw#} z$excd=n&;Q%)JyJ00rKsjC69#YgdFfDumnkBHl~DM=2^D7`>MT0?)!{=0!KsP0m*u z(N{nfSfA5%h!r7(+CGoX2Bk}*h>@{HL)Op9qs%Z@Tkt|pLG+?8lRZEt^!x$tB}00K zgz@Ra-pB+JQep5TFh9#JFBiQ_D#mZ$RU(2DJ(~b4dAej9C?KkCpyK2OpM^66q*;Gz zjDoW`BA++VlK$v6yA1qRlu=oRUn6rcrUJAJKGs_RAQFvc5}r3Hnu+KksEMPH7voIF zb8^c-M9@1O8%L?=9%iMbG|Ky_EjL&fo;4}@G(xz)kAv0{Z$m$zd{%9?+&N5#8sM2qoE?|3CF;X?~H z^aeW*m@;nBN-w(b3^*gtPT{zPs*5e%TRYxEftRZRMT2|ZvVv{^QK6lduwMbsOYm7S6lH$tC847KhdwdZOn>LErPL)lKpE>d;P%@&m(5FdYhJ^h}Xg zxkq4FLB5|^>1F-AbnxU|{HjYI|+)w+DQaI4)7*R6TMl+>+Qkqf&`ODRN%R2GN`A}uHZ9_ zJ_ylg1s~NBer@Z|wtgej2M*bUe(RvXA;Ou@p(gM^MXLzI*aD>kdkX-*3`lu*NuTbX z{%y9uUg_=oKC?NnJ&=+_2n$co%iSU`>gyS^J^_MFCo&YVZ)Oid|`TgKls_m9i_}3r9=Tl`MCKc2+<27q8DG4D-fjNo9{WD3rVu2laMeMrc=eiB$}?`>#*1OOn%hJEP)7 zp6;~|IL#1W0MUHzlyL7;iqN7itC zLbs2|qpT%-hK_64JL@cEhtjZ)3Hch-Ca%}6{~(t_jGN_S1aY`9$v zERe-ryn6OdhEsSymU~h%W`ugccBYGb0-AFksz{Mra`5%z9^Ax-t;MU6BIlt2mOgTE z)(j1QXh5kQC;0xlFRKFY;lLxkUcj1v=_!;7%kw)TTkw(s8d&JF$W7d(08Ms=n~)(O zFcFg|pA&>rCq5fbym zS5PrsPzOA$NByxQ{Ryh9XJc%m zW^8{Kf8OB9UjzmrNF;0qs$l#Jcs=+yC{hf>IZ%AClvG}vvUzqP z_N{QE5!jFb%z3oG{#vW;X-wrFVRvA$cp;(-i|-`|Zu?wMiG?YF8$vih)?NU%*6eN> zBiGp<1|7oz!pc1MYw<@Go{wm_?(MR#rIjzrJ1jbn&B@C2PfzPib2=w66d8|7%ouB6 z3`XVyk(^D-%6z!ad=N8F1|?-~j%Ma-7x1&TL2`}-vapAr^vK8P8Ns0_Uj+fc!u^^R zxPkOJs;m2gr|nE=tTyyW~KY)T*omlsEkf1MGk7-7Qo zvR<$!Fhk@E`g+IS{@4mUji;Bde^%km$n|eu0JcNr37wXQkLhL%LE^4w(4$!AkM5e0 zi|W9JD9*`$taSZ9rL(!6`E103$Tlu}_VCtHFP`HJ184rHQj+q6(oBKTSomW6htTX4+p^-Jow4hAA1BWS2)2-p{W z1lef%wqdo1E3AAwPCAG=AOrd0G}lu^$cG(ZCFm{ z6+ncJdSg{eWa|hxA+~mx{!b7PdJXw*72TV?_+Cx&uHcSn4HL2?sIWty)H-Vl!$A6Y z)O%>g5V=4+=bI{lc@byos}!it_R)0SC{>!Az3|3m&}*Y?Hp3YG;gn{9>88Y(n(t;b0<~6a-F1@6c|P zS4FRbJ90FchjF*(-pFBa;ww8aXCSvHh+dT0IMyw@nHy@yLO&iUP<6x>c?vqh&Vv*W z^tm3T7e7%v{3X*+gLS3wBP2^c4^-dby?nm14(WRZ2osMIJ+Of^g z^>nOE94?%NVB7&Jttm%f6T~jE3-PhzCUEfiX}~E!n-Cny!uFwzL2{(l7V@1uBMsZR zNCGvJqr62gC`ZXUu-&Lfvz}M&*+qKKbBVgo^!Fe!bJ1khO&u4+aosa|O|d&?1G;fd z8VMY(3EZj1741~*MN#&kx;>*(u>Uq`a*2_1HRt9|eG})gj(@?rW2hXTy7O!$-ciae z*z&vrtc+pL9@4tyAQVjc1+F`R2`7RHczbhuuxk9C#P#mj;Vwt${*wBy{$zi;UJtdk z-nJTSw zAuAap1d!}xW#4ivWai0o9KL0(_Go>O>yzBG$NT*9`5{-}zoI1SdCt3VMrM&!+dE{x zmL#HZW#Fa+SbnS)klfd?Oy2Wn?l9eLso{V}t^t_3h;Y-ydQ`@BKK#S1ChC?hK{RBk2mqZzGh>dgzIZIPNSP|nu+!vNgW0O4?sK?8q#?!%ndJ)*NC>PL&SuBa3mr| zUK$EQIg45ZsfqWIb3s<58!+^l;Dd~m?CW1fnhrUsqF4P<@btUrqqp-UOlzkZ^_YjZ zudoL(d1v4t=n6;RFhTSty>?S6POrR)VIRZFj>vO#VbOx3fY+`eHvRNxM5FQ^-o$cn z=tTbxm|=g->^9nBwk69a78O2&{$7<9n{dl)(x#g9BdLF>(*(P%}HYXEcb z=Ru@#<&X6~B1(fcHi2y{EwHR@9K^CU&uTl^sl$vBFC0m~gef6>8Jn#3!!s1{o&-cB z`1$(t(l=qZIoK0hEV>7W7OB?54ki3%**4*h~%h2 zgVpfZAAxSCKts#2Lo=v?7C^g&!t|KE`UmCPdq^ z#gey36_fyp*z<;69<+C0%Okc=ZWiJ(=YkLx#OT1lOXx!6#c{?_pE^BbXA2&PgC2?C zlQJA>rL*{#5MSbP#Z%N5JAMyZKl8ET$M$QE5@7}*9z-BnV%3Ai5cP@AQpbOW=C!Y4k)qQ)UlVx%k#fsB09K@i0&wZeS@PyqUg@U6Z)9*OkZr z+j9B;!3q3-{W$(VWIGR|+FU?)mx2G`E<(c_84}*i_;sO_@J6Cad12%9%&$-BA}D9W zktw)!QKCJ+O(IKp(R#@vhq_c3&(+P@Fz-;f1=IR}@OYlpS>1eux`;e{z5Ew&%Ih1` z58F6h4efaIGvjY8P3w5` ztMG$T@E37;udpM$nM8&D{P^3c_{d`Q!FzV#Ly4`Ja(xwg9*6ILc3bFrCeTR38yQ)1 zVPpBMuXW}j&6|yq$@Gq|G~YH(pKr6~qPu}l^D*bK2b6Iw*4)0nK2UNqYo%lF*Eya4 zLIli0F1rHHDLltcRHL?oavs|B=GDb2<(2hcKZCk$%gK4@B87m-yRCWQMpjPFL-*cv z6(&5G4a&6ip^FT7LtR6JSpFBiY2@zkW~tG_3pdW#+p%|f+X)y42LA$!$jDK@_O?+X z$Zapv?qyNw5ADJ+9pL3}Q3W{~Z;!elCs8aP|L57pwCw_1x z$eFBVDCe<5Q+7{bX+k1dEYmu>O!H8FuxR3?Odw*}A*fQLL9}ixx^;a0h_xYrnJ>92 zQj1Zz>ur=lUvL!OEKGUqfkEW-#u+Q790yp=hPR<^3d_eoqczWs*(}`V4Ez_S=Uj9* zqKrp_0V^+lA8to~kn>RIi9+h{K?IbPf2LTUI4wln(vE*FT>HoF=g=QTPP_`d+epOW z&CDd6yKxLE+BA$+9Ii05g@fJa;5FPgleECE0 z*@QBF!D5@xK?9KNAutq`<4Rv3ugl!>7tj^xx8*Z-mru`(+zUM6!Pk?j$Zc?k9vAwz zg}az>?e!7=XAabaL3(j>Zu)fQ%=&ux+{3hs@mj=pvXT8 zeO3hd!F7+4ktxBuSl!DvQ+n6l#D&$)@ieUExOPt`G%g!N5B>HNsG~vc+P=N6&>tX4Z50U1bP!dgiiY`#c zW|qVZrA7|}lE|Sq*d_QJ!B#gPPL~Rr8F>e~>)CNTAN--~ZR7hQ|YbpKNF6?=?w&nL!y#JG?c$t5v1&Ibe9>;M{Ix&Lg96l zZ0S#DN+blPaqlvndFCRs7!{wgez#mMT=^j%pwkkLCrQNxz#jcAA^|U$f=L||5tijI zKS!gPg~=CWAoFTrCr*_hiHHfU1?L}PEg+W9CCq1m&gb~#d|qZgM=&2RBH8@Y7e1GK z4s3h_Qt}*xe4Mg&5P_7n!xOXPvDJ}xE|X$C!biMV?=ZVNjzD&MAe}lpOCKx|iOxpJ zoVoP3bMYk##e+Z)`GL;mwB%eqW-cYnWfODJ4WyV2Bm)fxg_1TxMlManSVN4*YmDi5 zL|;WCw^^c7CyP`?V(NUR{&1s|dM6&yJJ1!_)zS57LUsHTk{H>cV_wHcoIhWa@{7L% z%3nbwi_*x<#MIlEx=W{CmYg~puf|7CW$J5mY7ReR|`7b_6DA`bAk6tP~c!H03Gap9m_Z$xFUqMz-GD+Q(nED+6BEQh7JMoCV zf?mUg|FPP;@iW0B9mcVVn64$JYK_T5On!_L$Wvl|`EdfpKE^y*#~jF*Hz7}}55yM_ zIh_YV`gRp%kdv|Y@inzlv;^doE2 zbikzy_?%>Xs^#b|2E4<7w{!q_ts*BNcT6>fO0*Chv#8teS5`f;)kOZ7SeLgTbz~K2 z1N)})5pP$&WftQ|)mlWdWJ)yhIjE0l0|GTCqJ@cY>GRoPP;ex}vq4p8S9B6%>3$_e zla(~qOhl}n-`m+Bz371?xKXFy3(2+8ulXwaK7D%V;$omRan3f;^v$r%A{& z))-n5E1oB-vqd3nnOEqlcBVG+}uo~{foHP2xry$C8Y~}YoOcK2j z9V#**m6}yscq|46)JdpY4ygA7N8~riAtt0ZGo(RhU6P#jke?&#G0ggWM6yy?Y-#@r zue&hm7@hPWJ1JgSu*TzjCjT4umZMV;5oAq7K=fh`5U!;t2Utq+2i+5suU0AK&GwW? zYe<*kLv&n`e#kLa3Laq*xn+Ye@O(bv3|vPt>Pf~!h{W~JxDY0_5M-x?hu>dCLx^k% znAR+x`Y0j4Rm|^1onLlxewQ=9y*bEl22tqDbZ2p4B8mc{`1m3r`58XqB;QCB4-!S1 zlZt7HDBeR;j@+$LT$GIB9-?R^itUJ`duL5bWj5|XEy;-95$^|rnUP&!ZFDp7E!FrY zCga;qe8Ye*ay?_NLd@>x81^;d$vbS(5(sgK3jIh_H_k*jK{tta8EX=F6#W~N9PnSS zSMtkYu5061J$~8QKc{mS_}?~&N9;ApHpE}`YU3s@41Q$q)TZQY=tsGTy&z%j)V=yM ziUyJ4%?WuYzydrffZ*L&KkUBdE=vb}=6%%6kvt-g`xW!DJHG74Y5tdK)-*qOaL1Qe zkqNTT$7ftT(X@eXIkF(5`!3*#?>_@G>n;)yq|p*YSFaUr}JSjnPYT2IwG7)fwLHz;lib2Wgsu7OQ8qF*VtVj zg5%a|<7ln&@cI|x0-~35y6TaL5m2NRSlTqgC3$;F^4A3?htJ98{qCotkHyD5Ig;pH zd>@(9nS&r3C(og6?ao1r^*Jvc`cyg4?iFKTu&PGbW zB9K!u5R+t_O#(6w3K#K>upx*uM9vWy&-ZmRoXuCr(uqiM(kwjqo&5AupQ1=wSg1!FvADS7qdV43B94RPQuK(Plv zID>`uhoC1C!z09i?Xb@^lZ!$hg%+nvr3Q`+mr+COI-2rVHdsC)Ws(q*u#O(UppBvx z;S>HtLn*sBi%_BY8KIZ;N{{|Ng7vF7$ww1rqUXpD@Cn}yLYy9@PlQQ6g2j}}2rtEY zx?Uv=w-;ci$of#qe&2m2+CTPqZ$+)jC*F^C+zsN{J=32@P zrIfAjq6jErZQ=EX%-b;6YafC`=!f)VZ3?GtT*7y$u+hTV84INqm&l+?z^SzG;_Ogm zM!Y?T7emN%I)kKw?Be?Z(m3Qzg;#n~@k)4qatS+X^U{N#>?-4g4{=qfe`t4Tu?jsE z{XLr}_H#a9^W8*K#GRd$wd;!`X4Hab#xN@6ACz9 zHf166QAmUX*$~O$!CS>2`QtVnFH|=t3ky6>|$I5`=!h%%xx@xVuiK{+Hikg|Yz`PatFOLJ*OK zN+v|FBrF(dpFx%HC7zaTKm%jh=Yqa()Je7j(dHRLYlg!-{|A0vm;Z#Ce_ zk67*w9|qwR-o zC4Ng+>VCkgRPY)7B)$hhz1>oYSdn*F%O`Ow2i-!~`2ZqL5!3I9tmN4Lz;J}A`1`j* z5jppuvD_V4(9Mp_^f{f5AT z(H)ztpPB#k%Oz^lCLouenP2cqvj1ZTe4qpVoCBWgfPdwHzw7Wv9RA%7|8|Ez&w)SP z;Wr$9S+L`Oajcj(Q~b73lt=9{QvydN5R4`&>Nf?tJ$8KI?I*^{@^PNXXG z0gt~s1j5C-HxJ+b55)Wc)0^U%He<75&vC>|0?mv>$}pCKF{I5&Jq76hkubH ze!$`X+>w8-1O9sle4xPN^kqBz84iED1K$#d|6>RK76&}t;cs;KpL3+YRs3=KY8~-s zIsD@s{<9taLWh61Bfn0EzrYdy4F`OP1Aei?KRC(1IP@Ne+=1bx+2~KG3BQEy0ykaU zfyemm5C2Gf86RRa#YJdXa8sd#>9@JZvaFSo0-Q2mOJqV3orjc|Ciwk-FawQT7V8AL!;IC2RQaI5+sX5j5z zB~sAPi``Pt5?#;|DJW)dKU~KG{P0%%4|VLPzyqUM&<4$XcDjlEr*3b+AU`u-x2L#Y zx2L#Y%YWRjf}GP;vJ!- z_6JChG0kGUsa&K&?{&Wk%?XDOKwY-?5g8J>3q^V+rd@2>Waj@WseH(9X##lDzw0;i zA4$Sz=1)o*AIVbEX+P=yzxg+&#@Afeu=4-rBK)t?POUic#|bgi6qOimySZD*A2oft z8O~>-J29;tpHDm7PJ`I&DWEPhL@H|L9J!J=XI=hu`Vtop$z*Zt^(sw?5I6;NFF}{MwX1=4o3A z`0u~}UvgkkeS_bq^Hv9ftzM(n+v07m^&7rsqq^A_sQ0!SZS@T`^+tWQ-&o=GHXC}h zK-^jbLDfc+uQu4|9g|s1Ppj7-Yz&Mt0*N@=8X6ms)>sj2XbdDJ5`I>!_O`BW@U~@+ zwtkrleNA4QBEQj8y(XTzwxQKq6KGsxG&Bc%Ms@q5@`YmzBPl_qm7vDg)Y9k;coDhP z+vHnKf*S+Am0p$#i5B7EHL7VF{XV0{+Zw2DXwGb@Zmn)YvR1!Ua>f8FfTX$+xGYZj zN1;3cqbcYQfVxa?Gg2Uj2Jp=fF4iBupj4$WTc;(~!i6o>HD05n zx>Zuttf^`AW(Mk8eZiIWB+RH@UER=Fy`s@;_*w!DzGlBs(BK_ooH2UpywOw77>V*o z?N`^egD6qdDOBXy*E3;x&47rq3`Iqr^nNxMl2gUmI$zwbj?gq`Ou4EybOf|rnC`NxJ;STBJv8N!U0+=T8fSHLvu_PB>e3XWgJY)*^oxp1H0Kl9Bo!}B4_!#0 zjXW=0D1tk66v?o-MqU-p@;0_iwfT?E6g^yHi|!>LM{FFU_Foki7K{H{stfnY|5=*j z(^x;53#w}ye2oqMfZs3*O6z?M5MJ?)Olajv%{;NR6fxZ@;|(dPHTzMjm|RHt7fSBJ zz=f5?rDaA*abJ?cNOcXZ7#6J7s5@9ohG}#Vq3lpfaad2dWKpimhv$l_x!=l&h7UlAm2;Lo>?S zRL!nFUPlm6X}iQbyH0q_9u*^{x0P)#aS&cz-3U~pWUOM74H(Vd8jNJstr(1b#DJkh zG959leFR6jx`uXkB;+qJwsHtXMa%%p$@{pp>$Zhphp;6NA5vesN0ZFrBdI0-x@)LG zV?tiK!4^XLp;okc8yhM9i=Z ztqY88BIC5#h8IIAMtWeEF1dcxIipsMYBcJC%}^r1cda-<&GDg|h&2bPjzaV< zS{TvW5kp%&)HKvZU3F7KV?#C6Nh&psR2|sF8rL+pYkt~NICYd!xP@zN-j1&m;;mWmk-z@8{dwq6;3in^s$Ck)svEf`+?QokHS&|aY@ zTBvRPN~5kLYL*Wg3VU-DZj=;vb#-flFX*R^=tq}~Kz70yn-XQq@T2TC^_g}TTiZ}q zhfW>pTv9H66s|a6iCe9upP^@mW+mgC);ll`OCEtXpFKXJ0xOz15M{Ck{MD=Vup^pV z?`+7*YT%$^B~1o$TkrF67#fqg2(qrVe=VsT-H5c&hn`n72(*jUEHYGB2E>=Z*69~+^a(IolxItmh&72C zU!$*ej3yQet#?!+A)+)i`h2SlG(47OMRhGiFo9HwfgU!qw!z;5odvbi8k@dB_!cZV zZINAu72cX^mbA5fb-=LVa~cZy@-=%iL9(~m-w=@bijV~zNq1XXzqh19vb3{ntZrQi zy4Y%DMvJZws*TLQq~x~pivB6nVve0Ot{Jo2_Xp5daYk{%Nd~70(9b80Lund=P0hwi zFQ%(9EX?NIrxrQt9uRE?>~8b5uF|^KFn<8_`y0OR9Y#5AV*h8&9}TG>NSmF%#F*i-}}|5eZ7Y zB_;mM^4ass7D_&)73GWP&Rd8cmp!Bmz9^8iCU5iVhE`uQSj%xkW?&#a(Aoga8m-cw zsndW4_LDK>m^)M(W4(czu`R7W_C0puW{y(mTM@hx^KX>7x)~iM*u*y7TnEvpg><4L zabhgc^bR*HYDZdq490EFywFo)iqjfIB?>!*|7?IVnZ#_d1v7F^8!20{xn}Ry7#}>~ zvYRHA15`JdB8`rdqaK>Qk`OmB&rEwvmR1IWnlVG;Tuq3pZb9X>ps&G*T!VireXSrJgN7F>o3%Jl zhcPh|?V`F7BV{eRU`g(+MTN}sA)R#QvUr4LC8B9Iycj(KL0Nji@5Cd!WCkm0CDRL$#nh!?^uBB)+XbBjb z^_tu$_R5?YVu~z`_qNwG2Emyb%aVkpCqo!$%jCvw`W3_Lgm!gG)<=&N8@bkzr zlf4Lt3bM$kHDuu_0bpfbt9ir!i_yTzkAxKzh+6`yfX*7IAPi_SQ2iL+T7$3}3}-Gf zGCLMdAUch{Ht-I8E>k5aoMWuz5W9p4OF&7pgcTTwkrrfVWdM)xU7Zde>Pl_6vTY$f=!3!A&kU@HRflGOy9U||@F)??g9QpT} ztNd>h;mF@!th5*~qqSO;e%2uxI_FDlhBYvm{?saG6pGhtYjOW-!QRilm_^6nyBo zy5qMpj#J6W6((kS^;#5-W@$%4J$mF7P%YMA9s#E%Sj1B<^f^egn%Tc0Ki^VrgcIyMERm2}cBxqwuo1%uSLk&a zMsXVjHJwTI4z(m4vDLoh@^jM#LTArbh^r0a!TL>>b9-7CmxfrU4r$UOEi{cjBuS7W z8;41@>>)o1Po^F#MX9%xEyKU2X@#$mwAI>^6*8xR zHHw<020SLyR#pPASm9tBY;lm|lc7^tyf4(uhc;bZ2avzjGFu;S=pV3o|5>CDB zjho8S*`tig(z&Ixi$@t{vlrt3+*165Ya|zom;iC?H5sFTp0lQ`S*oEiIENo-5uzg& z6k^!|3&2yYhzn(D*Y7dPXP1;NC_V86)E_4TqC$AMaC-o_?&IzuR8b5a@roItbHO%dBddu`UH7JAHNaAB znTZxkAV!sA*kR4a@x`h!5usqSWx3hw#l|nh1dY#1PLZ_<)zK_?Yzru%cm=w9;Y@a< zoo`GSbgn?pa$p{ZLCc*r!j#04G*X^W5{gGL7NE3rfwH(>SS?i#gtZNf3&u(Z2R7gj z?U z@y2B2`#t%!IxN;848?$$q-Lu8<7&_k<@=T0vnZp$#yt{Ib&Y^SDibNu4aUN(K1TWT zTNILvRK%6<2dV%<3iE5GA}Z&F$^$(#uw=sdH7DT|*UNyGYVm9nsIR;A~jS}3V=5if*E*1flhqw(@ z&cRMrK%rK|7C~Ls)YU?z7IK&`O;vYE z`)&Ns_mR)gp+)L*z);@Sm@~fomAoqEBak^TG@hyvn%E)nN}IA(HxUy%dvu`5>~L3wJ@k;p-`#mvV<9%iBQj^ zirk7h5|&r_Mp5#NV;X49%slS6v>E22WA3@!=0)3&z+NfW%h=YqsKS0-cqLmDUha=TQ>|H5B?Fhv9d)7O za{)1yz%62CtVv5_c15=DyzzE}WUX`VBj2P*1^Fk|=I4*JY3!p+SR`!@RN)mc*>n-? zSdk_3_DzpfAJi^a_}cfw57)^1t!pQ4EgL=zmf)XW=R%homknopT{qx~YJwV z6iOLqp#R2DhVI^=U|<(>6LfKz9jC^s6X7aQBh?8o z$HUF%Nfy3TmEyoQ(BZdp)3~Pq`$XWLq(%YnaKSYJ-{Xx@BV5uQt&VaDJywlZ-*pYo zLFhrQ5St47d1ykcVF~VIp+6m~4vB>fjk%6h-+|ju2diW7{2nfPAg;sJApFk|x5j;> zxclS(V0D-}LVQ^ke1OV@3#W(e^OpkXzHBPsY5R$@uk`zZ5jWo~=STMZHo%U{_vZO| z&%v-9@9c0svtV%;p;(-x2=49QCZ@+>l1cc!N%{j3hcw_&lUUw-BcEY7^ai!6P zs8GiWb+1sDO6m@0-Nnj?V*nM-C`G+0$f{CD!yW@`zz&5S274^5O>bU;n|bBK^7&u; zUmj2f4&*NjE%FdG0ROWg=luVln*)n$AijP%6xL}5Nys3yzQfS+4o9n_`v|nULFn-Z zq1QbU|8vpOj>eO*vn0iV!gY)?&}xr40457K4jisw=tqu)&4ac7(?yeSJ#GKKpIH+7 zK;asW5qyN`2FF1&7>O~RBl%dEaTufdOg1N2{u3SH6Ht!_4%gq!181_-=jMSjS?V+M zBxpaMnV*>_%YVB5Gn1u0H4l`@f;KiubTU4_oyk%kn+M8dslS;A%4DgJOn2iEhzA<) zH!~lZS?WX6-FO7jHy-NMiRMG#`oMHI9)Tprrn@kfeoD-x<9q;IJ*K25p%=_~!TUU=UJuBhp5JOYX1D(aOw4x=jyToKdVcm$Fdzc>L~NrGF)i2&DM zO?TrFh)0!LsiyZzotO_}XQ{uK?#3gKkL&f$JU9-FO5NPdD3v>(rQkj=0_duD4Bh;}J+4m%FPxhVgCS znhW!m$^YNhWT`jJd8z{czrD#)mFmytpUp}h|E|EH_B&kpVDnWg?{ z9w?Kg-Y^f8$-<)iLbXW#)AemkmU_)RP$olpdeuBoCQF?L z^NPv;-_~TQm(932J;@gj|7NZ%^^$p@OqP1lJWwV}yOVk-K4CnKknHSK1J#Y3l zIyJ+;86L)Z9=LX!2g+or-SWXbjcW=SjMyV$+`bQ8Gmc`HW~xN z6LBTF&+diyx4`wBd0@;^%wc{b`u%Ur-$1|T|Nq=%sb|dtWe%)HPrn~V7#2wdi zRqepU*jefc)7^Lkl89@CBYjPh{|VrF+;le{fp}D{r0^!COU%J`KMq{mO?TrFh#fQW zS?7XxC1Pi($4qzQ5lAAAeY+n6u18IG;}OWd(`#tG(D^8EZ8P1CMh1kx9-#PC&ucPnshG2M+vAc<*`-Hi^)wgA_|rn~V7 zBsqQD*W|#&*jcLEbT=M>#8bPuniDW~1J|!jcjFO=8wOtjhB*A!!1a*nZae~s$K98! z1=t?~t_Mwb;}OWdFc5ZbjK&9n>jBfp{mML0CO+r;rOf&Ce|uJ!?6X7rdSMrv@ znJo1S^FSFrANu(Lnh)J+9w?Kg?l5~Bzi74$Ptdlqf;?_-{}*fKLf7Y z%>!k!)NN*Oqw`~UV$S<^-v+vFHG3PKisAcCp9sAbxNb2Il*v**HQkLzAjy5F_61yf z)}Ml|n@xA)5lC-bd|%Sd+zebdneN6T5Vuqwwb}*SO~7@d>25p%NyOFWf*}sS5x8zJ z-Hk^e?RaS>9)Dl18-VM2)7^Lk5>Ng8{ouSFxUMtZjYlBFb>4ok==`n&uAi9h#v>3N z@B9R8KY)8}f?vmA>@4+T)7^LkV#joQUXX25p%al_#rb}evSW4arUK-|;0 zg4?#3gK-nbaj;ezif;QFEIZae}>#?|S9!;bMo;JVUuHy(l5G57uKLLOHF*A=F_ z@dzZ2+ zyZJ&E?#qB{quJZ&v5Mh|qt?FN8-eRm)7^Lk5~t*nKFVgtxD>d;rn~V7M8^#82M=R~ zf$I{}-FO6I=L#zKgYOdH3YqT4Bak>Q+qJO|oFU-4*mO4@fe^!GeWbRrUoP;Afop^5 zZaf09q3D`CO*F~ng@d%_Z99Q(B^&;TvGTn_wAa1y>?1hK1x`3IC1^Z z6%S)|0#^qvqINUr@erPf>#9ESFjfa}U1+)+^u~b1ac$lwCdSTE>rHp#5l9@@{#@&U zYn|zCFm3_jj^RfxG_C`#3ru(85s1chwM$xOE*AjTTGQP?0|CUDBJRJ&fqyM<{lIiL z9)ZNu_I6#HgzX2wb-w9tJOYVh_;FIoc)0C4AGppl-3@d&K!e{u|(016=KOy8IL zM#0+#T&qoYgV_Zjn0@r3z#Zpm;0l`V#v_n;x|{cdGYDJ()7^Lk633P7`e`rB0pRkR z?#3gKWDK|T!Vri1fveSYHy(k+<2qfpI`Fmv*SV&1`;VKHzFL-Hk^e@z{6l2U|06HJR?lBak>Qr|V7! z?k3=BG~JCyAWjT@`x}94mFaFg0_iL5&mB}Tc9uHFbT=M>#Bu$iSL!&7u5*B^!E`qs zfh5OI^xfsa-2hzmrn~V7Br$cO`)&s&#?DeJO?TrFNMicF-1i9HmB3YJx*Lx``bytB zybid$rn~V7q<5O+kYC2i>IJS^)7@ZK4v^%O?!I3MzFOd_G2M+vAo0}q#wdt~CAw;W zYlZ1_2;`gK(s7mo*V(4K@d%`ETn{-ob~bRG zWx5-WKzif)wF8G8<1FAh({wi;f!Hzk_3RexX9Cw5rn~V7WM4Qm>|u+}Gk|M}>25p% z**`8j#uDH<-E=n|f!HzQ&nvZ5c&2%>&fy8m_%e58wPXn&Srn~V7q%RDQ^rCJt za4j<3jYlAT;o8;<*COCrXu2DZK(LeFE0sI`g}}AIbT=M>xTkXqT>xD3O?TrFNIcbJ z`=M_>a8;V_#v_n8uKl?xfvduFHy(lP4?`SY0bKJ;cjFOAJnsHn^MGrv>25p%*&hbN zw+kod0#~`|Zaf0{Cb)E*a^RX{x*Lx`zB#Trz;&wWZae~U!}YkUbesxYvrTv75r`YE z2oR|Z_uO?TrF$i7m?VNZhY>A+QLx*L3{07yJO-c#FWNlSsN#B?_vfh6Lx z-8)@zmH=0=>25p%vD5ec++|@d2CgF0-FO5N$MLi)HF00 z0oPd5-FO5NPy0eI4#i<~jRmeTrn~V7Bsu=Rd}HLk&_2IYKVGGzrT6Q9P{zTTSp#y8 zF-DCZGj`ng2`8O=%9LqECDY4h%&e%$J!Yo`3n{p$IhQWcYZnk=9ib3=Poz|d6bt|;4sPghB2VB(%>Jms9XRCa$OQBW+Hg@JR+D?wgmrA zuUIhMdQ{C{Tp{=t&jS&XZ&`&4oH?6|?Hcd^w<|^C6W45Yr##!r{DmiY?I{yZq zrhwuRi27KZq$ml&63vRD52wOONdAD0MF%N;@}~9BsN$Yl+o^HMA)Qr8xDtcx$eR9! zI@M4IgtdG~dOS6VL`ngy{OFgM;)oT`itWcyS~Xs!9~u)G1;z-&@YI1kIS($JOQ`5n z););2(3VHF$kD2jfCaJqiexr7R{2`1ygp5LdrParx%90{pYPab%NM}J%Zk-0u*I7xw$G7r}0Vy%zR%*t=o7VYk6P1^YYL*I?g+{Rnn1Y})0;Y7lHL>~XLs z!cK;r20H_GA?#Av8rTNdHrP(s5bTw(KZd;#_BPnNVeg0C3i~+hF4&h~{|fsVZ04q7 z^*z|pu&2P5z*fMX30nud26hANRj^mX-T-?$>@Q&-fPD=1Y1kKF{|Ngo?8mTsVf$TC ztOmj!4m%9?I9LyCF>D!Z1?=gtXT!SvOfv;1XT;CPn4p%(`4|m2A7i3gfzy?~hXbUJ z#8>=0B_oJ)GCbBv6vOb2=$ZJ+|17*6)Tz$Fc@jUt=}RX%GSTnF`C@O#-4}D66>}xN zJLgXdy;9wQTzDSNTHGjo1HMFi+&Nktcl`0AtRGHn#E-+n3H+TH|4le);>jmZ;%_p4 z9?vO-Q>IMCZ(31tNl7Vx97$%)KK0a7=ggT?UOsp3ym|8~Dk>}I>)(O}j&jAksVX%k zB_$1(PyEtS(-4MVS~^TxT6%hVztmI&OCUm0(^YDkcv4c}0EScm z`#Q^o=Vi%BN^&~$!As9hOaIP*@8leRQomEOE2j59bzsFIhi09=1aXGLuB^wu<%b{nk2yy}5 zxNE^XZsS##x=w9SH>excbagY%GGM&haZDcSL3_e(}j;`tEH%cD&fkj>ZG(L7c)?gR|Naf8)ld8R`9wK4|8w%-n&8 z4joXCd(`j|Wiy7Io_p#XWA4a`3+H!s85>3n9}ylt!nk~sp;C;Px|Vy?fSg=o*s-@C z0}X6s?os8Ju7xZlL|AGJ$T4z{^46_H;vZKYvS8t&W00Fx_NtZ-$m!SLpx$TX4#*jf zJdQCY8UrRzI>nQ19AgYTbVN*{J9(1fF(zeu^702BO090v5gw{y@!#PShbERP!OfQX z|L`vb-IT@f>_Z0RX!dC>Irpfek1>W0J2o$W_=p0YE$H^U-W-P>dpO#_7(B<|+y?&t zoB1!CnUmPBe>3-Rw9Fjf8H90Us*D6Yc_$qwaa@A7bQAi3X7v@mUHK{r_lM$R%o%7G zvz4L#4jK}zrY;ZA>&+^`yBzeMV^OVX<9R{D1?Hr+B`Gu*^Znf%iawwNJ#d@+zZkA- z(O!Q7A9K3i?11Y!v|1aZS6qKL*<&&6X8ixD1-%7vZ$Cb5F|PoNDO9waV^E zEE@EgsiPCf;OU>5QUmwjwASI8l5avUYK<(gQZ_a4QodvYT7v%i(LCohj#r;G3g#zK zT8EpUkr=-VyNc8eokePQN0B-L?z=87QjfsCu%Sr(HdLhEhW!Gz4E{4 zfpaa=o&y_zy$tXjzekhuNIsE)rT;Ppd5amAlqlc*dm#7Pk_*%lY%&S$oj}>5KbQIjaF#i5k?rU zG5|zlkpteFkB)V)8}HWg1l?D7Ol_&2dk^G)J?(>OK_ z|4w|(@fu$X?jTyzf@(qcQF&dFy2-NZ@Z4lsh6P}83kFa8u7eQRiBNY+t?>D9$ak}S z=K(4NGR5APCu5Ij8Zk}$^wl5`7)CUY_|MX)*WFU2w!@CQ73GC3gPWG&KY|^4dyyIdn-2Sr+i+I9Wrx6DpbCS{ ztD5C9Bh9y|(EQI*2J}<|H>K!n1BR+8YUmVYEHmO)4JdUJ(wF?KNNt3D6!vY{0e1i= z>@wJY0RAzaC)}y+(RdEDEW=ab*5jnzI?$SU#lf^`s0Tytz{%7hHjP-=XhGfLSa!p( zs)r94MC=DqeH}zg{>oaOV53i_{_A zMQSYUd{{s1X4p(?jMs_v)eH*P8Ocfwj>YEqZ^RCPUsSwcW*OGS7L?9XC=^C=VYSi} z*@C8Q^07=Nv}0wb9dg*Utw>!Bdp+zeuy?{<0m}uOD%{jjQzbWnKwDs+qtxwB6scEX zzkoerN0Ay0dmb#qpM2l_=$Z+g&nZ|K_rmV-Y=g`A1qodD(Y>20%i5+lE>gWMm(f@#)TO; zzFDu|ve%_I-#=wdQs8(A!-1OdcsMijY;|^ijY2;TvX5m#P@k!(hld1V-kFeOT)X7O zTyQ-AZ*0KTl*mVxk0oRE?#?20=`-4n!t?8=i`2__p0K+}Ray32JpTe)0(;r>MXDW^ z@NZ(P{*Acb1mAy>f4uBkMuNPnz-}_uRTpS(7DH|Qj+cQm9;&Ero79`l=1e{qh&lKfVmvhrQpj%kiB5`yw?P_JUWx znLXy;i2F@&{wMiY_*(o!jahnRlKTvF>n?b$NVQnD7SBq{GQ0>Dd{U=t&3Y(q)Pkhq zHXU1O(aXZ#=9)E}S*X_P=9ONk9@6zGeIF0lsBU^4`YG&vu-&ka!afQ6EbQ&D4*gxp zKnsmo>a5kPn;b?-UN9|T92znI$h6jTDshN^N`fDt~pO?T?Kqx~z7` zY=iaiK$){dlCuO7IwCgZ8zEYP+-)>Mk2bh(i(?a)@@+h^*mi(D3~IDeK{iO&Ps|6B znpfIBj1#sKLx=4|8LJ!xVTPiA+Hp8e=@3YS9heZ1P$Mi`LtR2CSO*R`(Iv%jzSvrV&Wq+f6kh;9I_sE ze^8_zgMAD3SlAcea<^v!RtWoO5A;h|w|H|9o&x*o`$cLE>?yGSiUL3Ede~CfKSqjF zGi-m@l)n_Id;Y3%t+Sp^ykijlG2-0^doFAitQ}|Tdqv9pNc-Qgo;HlnH3(xKPyJ2D z`Kk3xjPoOeoesPBL(D;}@*n?6kva@EG2ZTvp{K&03d?ZAdeZGfK3>?f5@=Wi_e|Jv zusN_%;C~(V5!j!=24T;Ey#wi`xl&WGM2+=g^)n*0Rbydbn-FA2;B#a(6`L%Emho(wlWAo4B*y6ELvDo7GCpccUqE|v^ev}5)v+2 zv~Oa=_4JS^Ypl2Nu&G%(wNkO{<$A^yYYZ2JvHQhiTkQ7qi6v5T9{G6D8?W%;Rmp5@ z=(yO+qbsvg_=RTKa@C5uW|!PhRc(vD?oc#5cJDke3wmn_$*8v38*eXGy-<5;HIk8t zo)>J3gj^lvup~{{90F z-1S0gELHg%sjBm(RQ2YI@vsjN*8Os-T8?o0m;T38HR+X9Ri6;Xc&(#VudsqCy~A!^ z&^zoWOM8c1Q{6jk**U$#(pU8ko9YsFOhBm?2hBeQ&CalL(CiG`0-Bv+cYb40gq;Oj3A+S#Icy_rJ8UQHCfI9WZ-TuGwj1_I*q316h5Z~>{XSJ? zzz&AZh0TK<2U`d`3w9Cga@a=LcG!zyuY$b^_Ac0N*e79k!@dC!IV2-^;OG3-^aH^JTo+YS39>~7dMVBdxP0QM``jMu>j*j!lqS75nG2Y;l6 zKjO82|E<^md+YUks;UaRMa@3!zmJ6*m%m}@7cW@hHy-{b+&D^iNLAHP@v4IREmc*= z-GGS`lqyQ8YG`T+wtA~t03NTpRnu@6(Zp?#I z{S0njgHrdWV(|`patzyYsWod>wly?YaVe13d?JpSTHDx&Ex5qA zs;U{4fCfHup>RpMsUyHgj?)SEPYt#?p zej)1W^cdOdujxXzipsOTnsx92-Ow1nNar<+N`1wrMa04VT5&_9WUI2_#@42kXH7pY zO9^Y$rTzTPb`Dqf^V?2!eLsJU7eDQX6{nhNzqbYi<9CbpOP$^-?s}4hL7>??{I>vz6{dJY6CdfS8 zF&T$DCgZ6pxgHbzQjZCKsYj%ZwTX0Ibh?mt(CLd#vsG1dO;vS`A1#oK*`{h%pcaMJ z7ci4*M0+6JFR5Bzu%#9a3PTw;+pX|7uuEI*uUGFWOq{Tr*63@MIm9PePjA5WmDLTc z>Qiy!dST#6OIhVz(?V%so5p3T7M|%T%|0*Y1PrfBL0sP44Jyt{0qLy)jTx}>;jh)G z)Y=q(aD|or#+0_|TI~EY{ZGZ+jEX^@z8C&6rJKT7|U*V0<>EO=PnTxSvaDi-rF#rHywct5;Im0={5PeIqzk zkuuX8nCq(zHhO1aLfGgnMxxyq!~SbyJkY)D_%Y~N5mwTt9SolRe_=siGna3@{?U^( zkxCVSmN{h$=9QJ7c!C{9S^IzKmu?j{MHzS@)4k+JB*sx=c=Ky4gsq>=AuTEC7<4Mt zRtR;yG#AWcR$#dOKgC@Ekd#N2{#VhghQ#qg6qVDt9G++qGKAd)4Hd^oPNF0k6Os@` z|5i7c93Tp6H=YPE=IXu|lp;u^dml;|!8D zQeM2Ex$pJs*MIlCUBoNRO%?3?-~amS*RNl{?!W(k{%1d=#nZb)7eS+F5ly%_d=>uv z?nyl3*=3S+FEUfT6{9dhM3j-z@I>)wc@rUNhu{mI!sHKW%G&neTg@IZ0>6#Y=ka+) zt^<;t<0Bh^P@2nx=MDh10Qn@zAPr_B^B{mmfILJp_!#?`Z$HBS*|~nHM}f2hqzjhJ zztERC4@f&e(m>L9u$XI)2PkSsc$PAXsF$bfix?}DjWHfD0=>22z((Y+MqN@WGBPkL zv9ksKy*Ht5@}=;WIm9lMV{tj6l+LUy$Xi; zfGI2giB;3kfasXHVSzki6uoQ7TL zfP)UiVwt}Zi>=TyHuBR24_nM89PhB$)o6w5LBsM^Ad{FdjBmi6(|vA&O#4~RGb{bL ze+&CO+aY*p(UeP&p+N&ox>9tw2|O)_(4&`&FtqDIU%ZE8u#;!>F&ys)(sZQ=+76`l zYLSVDd9BH3?)Ykoh8zMj-QTAkEissic?LKGe(e(96FgGWXHFOyf8F z$hdGV?W%W&5=k%DTrWSNdPBy=dr_Es`PRbNNV%hrdAzq)*|sYdt{EHCQ5|86?3}ce zOHoUwFgP(JypOar14a}+Z3IY*Crnej_;U>-mm|PAUM>7pT1qj9TWX$kRUv@JX%myd z>Ad$5$kg80*-|b=t@s)GB8)+Q?3UJDOV6FLrT4j(j#rB%)uquXv|{o`+lpzdO2pkT zXYNhXQbL{wWa`a6@|QreYklM*Dit8F2GT_EW#1s4D}hwV{dk zUFM18Mb-Xwfur3GU9wV_VR-;ZE_er-s^zh$hD!>^Q>9(C+RcKH(!asUHugQ7Ol5t!TFzoE z?vPPh#We!tVjyX(`&ou~W})VWLr^=+RVw7iMFxmj?BORLUa50Ys_hWSRQd<1Q5q9- z!u%r0WY)9)Ot+4r+FuHpoX8LmT?C{OAeR7X&X!r2WN0Nk86dBRO#U2S=1o8{!~Qtk zK+F~)EiqFAX$8o8faHo+XCw0gASv9_N}|LrAk6^T10)^P-UJc_$Tx{6KpqB?bx4fe zwQ5`)%Q%Fp|1o4T*d0r1KLMl}Ag6%f2XjV-+jagk&^v*B{sKrVKrRB34N6@KBp)DG z0jUQ_0Z1C2ndtL2AT5h?a_s)0RVsc|K(FcZduj7Xg_JkXHj~2gp@GQd|8}Hv(w}$RLo$oxaRCklNq- z$Q?kk|KKAHASo=H65rSZr1g(J@^vcpK_7VtNG=#(Z6M8$vJ89guL-%^FZGOW_}D!@ zavqTO$Nf?-CuFBDb19JgCw!S}f#g2v%M4Me0I33LVUd)y>z%}Nzt8g_AdLX|G>}P) z&@6%$0LkqZ9-3hagNritV7B@mWHO%;87lQ-Ae8_)0i^bTFY_eH?D6%P^DOXSF_GxJ z07xZ3E(J0fAg>3~2=uugNPVBrTqK#Z{it3gWWa^+_>dinZ z-}Xyw0FwW%k8A?c_=%6)4kZ0wKJo!Ve(odp0?7o(7lBL$z5E>@?ZAJ20HpO{pXU)E z&5!uVlR&a|?6B9(IUClv%a@rCB>R3rV)LVl!p)Q01tG6n3Yq#HKC%)>>oY!bBan39 zha*5zO<(4ALhkU99Y8Vx@+ly#_xUnk29getZvbg;@nwDtWGb-Oqd>BoeVJ20>NOuZ zcQ(e(MjyEVNGd=s1QG?vD}hXv{8Fz2(hBCm>wsi~8TKY1wZN*IfYiU~^V|+3`l*k6 z5J+m+NA96gyM5$-AkDw^k$(X)RrZl@0m<6goIT-(KxzSU0tkMtA0<)ZNg$Jf4WDxk zWWM9eyckG27zGP~Os)52E&NG)J45l?`;9Y`}kwgSl=^y~U4$pm%X z52O(wp9fM4kOM$6fj)`a3rw8o@jKCGDMDVt(c=nIwR6;in*znk16KE zY7C|nb6YXbSH7`IS)*Hx!L(v-D&|>=nW8@$l0@3R-O3sn#e76Drxo)`#e7OJXBG24 z#T+T-1&X<$m~)ExkYb*zn6rxcsAA45=KYGfTQO%8^IpYVQOpMv^K8Z3qnP(A=9*%z zE9OJWpHC@&o~xMain*nj=O~?*E1i!h=7wV4u9%M~ooO#J^yiFXo>a_}iut5so~M}c zn?9+_t~Z*Bd7ENBte7LkoL0;&#k@-~A6LwC6mwoNw-s|uG4EH*$CYm!Q?YJJG4D{! zZN*G`?*P4sv|Q;N9q)|K#}xBI<#nqS^SraAEayw4v? zAE~P$ZFg(+70!ls_1?R+)6PA6V2ZF$*CxGV$Ihf;KCGD2APIPSRw_T7)9qwrR4V3% zVm_vHru$7nU45mq9AcSUiut%=?om3gRm>}u&TYk9M z%o$~kjAAY+o%g67#82Kri}f8+J(yL@bCu3{rSlf0b4ytxrRF(4-mP@b zD4n+|=0i$ndTuGGt8ckt&MM|vY7DMYI#-p>+f+o#DdwX}=Y@)SwPMaF=DcFADdq#p z8dJ&|^OQ9zig|}(KB|~!E1mO-xhBkAa2vBXoh+&UXe(;F*S$u1(ELszycCcX^>(rR z%rZSqY1hm$eZvxayI`n}kF4CK5gg7i#C?Sk|*lqWP4^AXiw^A+&|hoC8Z+CucZalMW|^M-(yp0h`siLYsBmRBbAL6T!nWtnpzVz_X#0UP zXnW1I9hd(dAMw?ev|YSz>1@$Zklxjzk03p_N$rC4?N%PuR?G_(b5$|#P|UNX74BKb zDaE{7je?UZYRyy3brrRuM?2^DLyCEx(s_kq?pD@FDdxIjKCE=cVy$CFTd8zT3-ePj za!b;KGmp65-D01aWqJ-tyJnW@+b#XxmFn=_-i&4`AA^iGIAg7h?`c0u~)N?k6t>v zbZ#i-`AX-KV&0~hPbxc4D(1~f=Yz`5C)H|sfzr7t%uhk2t%x;dj*z{RVxO61dJc=l zW|ryOC;i@anstJ-UB=GRd7_~py@R5UAU#{9c0u}%sQzjz=14KGRLm8{yhSljDduC! z6EccYETnDdG`t(dnc=9U^4kE?N! zQR5<`n3pT&&5C)qV$P}^hOA<4E9M2t8aZW+`N|qO#k@^1A5l8bQp`DJjl5!RDdxFK z=d5Cml+G2!oK;@8MKMn*=9Mzu-KO8^Q;K<&V&0~h_bKM8V#X_7 zI-<>L#k@l??^n!q#hg;iYZP-sF&|LOI}~$TF&|LODdkbilt&$P9wj}PQOx@l^K8Z3 zqnHmV=B#3FD&}s*oKejC6?0B8uT{)Dm7NbNJMU6<&MW4eV&1Npn~J&Sm}%g=0wb51 zrysc_a|w-ZQ#)i_Bysw5T@M+U#{2vsW4U&kJNx1ZP1W{c)%Ho%c6yB;IuW|ry}`Z% zLEEoKyIRt&a5K@gMQUdmidw`Le*Rc3CD!%Or+o(cu*{!cp9$zQbq4yd%%5JL_d%cN zR}>+q_f_dHmig1_BXy;WKB!B4Y-v?_=04?_N0nzDb)G5A>4e$7G9&{Y6r{TBdwbm2 zakV4GU+D9_%MxbZMeoUX>eII%(b>N9VJ>9&SG_~#9W>;h@)@=-olAIzs>4VF5=CBJ z_PR17t(b0nb+&6dna-9@C&TT!cmWhN!qv>Mm z|FF~^90o|wk7g&a``me?JoW??)8?OHNd zAqy3fRmf_E3@hX|h13lG6uzammXK8hC563R1`Ad5V%D25zLITCj-^-xev(WRtE2> z#4n8L1*g0-NvpV+UOP&!8#Oy8gwW@oQL23>$4*8b1~T8al#!nR*%}~^0eRq!eC5J2 zNU|C2b+r@oIY8uj36^;gklP#&{SJBn@BYj?ePa9K(v)0R5>2!arRW24tMjE6Ay#I- z638+;?=Z3!$UavWl`jI}r~8aG_+_yXKM^F>s6s|o%jR95cwuTa;$19Ligd=SQTZ;g zlzJ~p9d~unug2+Bn*7TSQwpz%rRvg;+La8c6KzAOIo3B==X-!m1vdON5Pq^q>iPnZ zovtq8`38{1=3OX}wZ>r}{QDg#_3uFLxyv|24Qczb8$jJa10FpH;b15|nq!sYI1Bk>8 zX1)u^`k?K10~t;Fi(fk&O`2Autv>fbMj{gPd>%+6(C4c_+5vJ1h^%0F?9hvVTaS`8 zg!vd`WChF2zok;c9|ECI;+ekyBEOeGf7zE6^Y0y` zFMbD^l|gJd=RCXu(6tNi_byiP+BE(x1C=uGRz^Mi+=W5xtA+X3dBQvoJgq>(mjS8$ zT-r{$E(SuMMCaE4kvk*Y(kp@dXAnv9KvrGoml^@mljt1Nd&pzMoJ5J+Ad_}7baD$2 z`mjuFUnJfPM#|lg*%6fbCm_3=|Ii#ag7=5l0uSE{nO|P!Yxs4l%XwzZFM^J0E{et= zqF1r!9`j2*j8gKOHMYjjh$qT=(eES>`F$?SL|7_6&Ag`ze@Q%g4v_s$XF^^CB%Rc5 zUo_3Xf|MS7DP$6Vj`^kV5kH?PGM7MRR$!mk1Ci%9xb_=>Gy|ENfY3faorgzZ_N13_ zXWUqh?MvCyC&(I7*EmXT4_dJWNIJ0Chk&$#x;_D<9r)n`KvJ&lWQ~1<{K~KE+f?dK zfBt#|$bScs_J4pJ3+n1VAKn`zGI2o1uAyW@VCa=z0D~nIIlilFUSR0Qrbpp-~;% zfm9qbMz=9^Ht?T&A+y`nMWsFi2xK_n;aBuWIoHcnss$Mo^7Q!`kOjd=c?`%= z*I!hs3pe&sLA%ZavLLAoSEDBNhV!4;CIZL=wO@cz{C)uOpA3+f3`#E}eMo_lOXLIp zSq_;@5a-_jWJ}QYw*Wbi=!2!zpj`vlh-4FMOgV2M|Dh}uS*J6#bOU%&LG9x}WEYgZ zbj5Wa?v=p$x`x;hcx^gWaRmI z*5_+L8iAd^2ju&2bXKL7B2Pyv;Gs95r(K`ojpBuMPzKui)D{%xT6&m|~@5bo7= z1(3Y+1Y*7c$PuSu%&91%O0X6kgv>-xY81%o0I30yJAKv@fYkAoEk<>H6v(8ji;(+( zymZiS>F0nvkC320x}yswlB6HIVJj$4L4OK=vnf*)&F(AdcM#nP$NAHXw3u zovr$JK(c`~wgE{wW~%ExAnkzXvp{AA*D?2~8ZwwZ!*LEFCvnM;FGKLWBWsOuL% z$P!5mf5wZDpXg1#eVz-1K8ef)Kq^5iGC<}yW{N))fNCxxQTawSj9{GF6f^uj5E>UTCsv9k1LiT5qL01a;bcfr%8f5NcUK@o$h|ls=7Z(wn-|nPgr8nYvrg z6Y@$RQwg)p%v1|}{tC!soeY(_0mzyF83Hm9v}*#0{EDAFVGEFhL8h6jowmHKxL4REWnP$+g*8w@^+I1a{;v0%1S0Z29Yp+>- zEhR@nMk|v)%|AxMBdkYx^%k2%D8@UHgbO}7GLFd{4n00lEtW^daIxAySS*){c++f% z%X`NIn1%xKVAFyC8*z9;ba)oYWM?{sOC_YVD)$eXtQp1iG38^%z^2PZ$`2NtGYijn ztpAomDD5LGGg2lV+t#r{KjM#N9x$F8Gr2ve_Cs~7>|)OQORb6Gb>qbnYlS_f@lhV(@8s;yVAQTC5_64HC@3QYKpiOhUb~sW@02CS3{x8?eoS2Czu~s7YUAkC02aYPxf< z*k3BIXK^ZTYp^W#ELDnz7uF-;9Re4)2XP1`P~}JgPC<*!{A?ifqU9GH?5p-mDFeZRZJSJdJC&P^Db)I@qc+SR8a9vQr}>l}F-2 zdB~P2jEqq(%cK@k1s891|UcOnd>x_0U=WxKxH zvMY!o8DCGGMZ?YE2CeB@e<9c0LUBJE_7t_zj6p-%k`HA;#>Ml=&uFF+qk($)sU14rHc) zHLv*&_c9xFOobsp*AGHtwkc&&vR3399KLI@R~dVvAutoI{>&jwjV#IESY7%~DqBKR ze_Y*!iO39YKBo7w`Nv{F+hWp^CvXNRz>{Tc#S~A-_THg!V51c+C+LfJk`KM=O*&+5 z1aV32ro1IjoQ41@YYAzba_n-|*##Es8ce%%alwJZaa&<>m7t$7Ia>dt3M86Htl&h| zl$RPo-KMQJS*p>LjpdQ-GOSI@ab>J9jz6OXy2TO4l|pgJvc7l}6HRerfnnSMMN2FL z)`nxQQlFvf)qkbPJj@QS$o1n8szbHd(B#A-lXq;f^C9OCbWu`1Ti?i>ww=TUaM zD;^)CO$3vh+S0;JO=fR*NFHHCFeL_A(rq+|aZ!qDV8QC}$cDrnVc{PC2zlad*Evyp zY}!akyg_5Wb7aKmdtFD$=xmR>vNRXJ7^!1st(4>xcY2$!rmXA53OSU(;Jh3w-t_WoGih(vNm*VOwn~`|K0CexQV>PYQIg%+!7;j0enx z9&tb~JZVfjtmtzX#~1Ts9>x&n5g7@l8Fmlflw9nE2A=sB2fCU9_A#s&m#DN6ZB{Wx zOmw7XQ8sUNs>ipE7U<2zL3)vf6@z{vDX2%fb8m613_>6rl z0)iB&Z0}98w6c#&(ft9eC+w__QI3Esj%&sP+6Vt*Zu_`^J>r`t5Vs2yGv)Zp5FQtF zS!LIFo2upUf#DL(y2;|itq{;*m?~Xe=E>rui|EOzSsa*C z_JJbPZHQjt9%v=j3DQalSm;bU3(1y(8=v+@v(#@l#-y*!qjF*sUWt2Q)vOwW5M^&j zkycQ{A7AznTFXUGna;4T + * Released under the terms of the GNU GPL v2.0. + */ + +#include +#include + +#define LKC_DIRECT_LINK +#include "lkc.h" + +struct menu rootmenu; +static struct menu **last_entry_ptr; + +struct file *file_list; +struct file *current_file; + +static void menu_warn(struct menu *menu, const char *fmt, ...) +{ + va_list ap; + va_start(ap, fmt); + fprintf(stderr, "%s:%d:warning: ", menu->file->name, menu->lineno); + vfprintf(stderr, fmt, ap); + fprintf(stderr, "\n"); + va_end(ap); +} + +static void prop_warn(struct property *prop, const char *fmt, ...) +{ + va_list ap; + va_start(ap, fmt); + fprintf(stderr, "%s:%d:warning: ", prop->file->name, prop->lineno); + vfprintf(stderr, fmt, ap); + fprintf(stderr, "\n"); + va_end(ap); +} + +void menu_init(void) +{ + current_entry = current_menu = &rootmenu; + last_entry_ptr = &rootmenu.list; +} + +void menu_add_entry(struct symbol *sym) +{ + struct menu *menu; + + menu = malloc(sizeof(*menu)); + memset(menu, 0, sizeof(*menu)); + menu->sym = sym; + menu->parent = current_menu; + menu->file = current_file; + menu->lineno = zconf_lineno(); + + *last_entry_ptr = menu; + last_entry_ptr = &menu->next; + current_entry = menu; +} + +void menu_end_entry(void) +{ +} + +void menu_add_menu(void) +{ + current_menu = current_entry; + last_entry_ptr = ¤t_entry->list; +} + +void menu_end_menu(void) +{ + last_entry_ptr = ¤t_menu->next; + current_menu = current_menu->parent; +} + +struct expr *menu_check_dep(struct expr *e) +{ + if (!e) + return e; + + switch (e->type) { + case E_NOT: + e->left.expr = menu_check_dep(e->left.expr); + break; + case E_OR: + case E_AND: + e->left.expr = menu_check_dep(e->left.expr); + e->right.expr = menu_check_dep(e->right.expr); + break; + case E_SYMBOL: + /* change 'm' into 'm' && MODULES */ + if (e->left.sym == &symbol_mod) + return expr_alloc_and(e, expr_alloc_symbol(modules_sym)); + break; + default: + break; + } + return e; +} + +void menu_add_dep(struct expr *dep) +{ + current_entry->dep = expr_alloc_and(current_entry->dep, menu_check_dep(dep)); +} + +void menu_set_type(int type) +{ + struct symbol *sym = current_entry->sym; + + if (sym->type == type) + return; + if (sym->type == S_UNKNOWN) { + sym->type = type; + return; + } + menu_warn(current_entry, "type of '%s' redefined from '%s' to '%s'\n", + sym->name ? sym->name : "", + sym_type_name(sym->type), sym_type_name(type)); +} + +struct property *menu_add_prop(enum prop_type type, char *prompt, struct expr *expr, struct expr *dep) +{ + struct property *prop = prop_alloc(type, current_entry->sym); + + prop->menu = current_entry; + prop->text = prompt; + prop->expr = expr; + prop->visible.expr = menu_check_dep(dep); + + if (prompt) { + if (current_entry->prompt) + menu_warn(current_entry, "prompt redefined\n"); + current_entry->prompt = prop; + } + + return prop; +} + +void menu_add_prompt(enum prop_type type, char *prompt, struct expr *dep) +{ + menu_add_prop(type, prompt, NULL, dep); +} + +void menu_add_expr(enum prop_type type, struct expr *expr, struct expr *dep) +{ + menu_add_prop(type, NULL, expr, dep); +} + +void menu_add_symbol(enum prop_type type, struct symbol *sym, struct expr *dep) +{ + menu_add_prop(type, NULL, expr_alloc_symbol(sym), dep); +} + +void sym_check_prop(struct symbol *sym) +{ + struct property *prop; + struct symbol *sym2; + for (prop = sym->prop; prop; prop = prop->next) { + switch (prop->type) { + case P_DEFAULT: + if ((sym->type == S_STRING || sym->type == S_INT || sym->type == S_HEX) && + prop->expr->type != E_SYMBOL) + prop_warn(prop, + "default for config symbol '%'" + " must be a single symbol", sym->name); + break; + case P_SELECT: + sym2 = prop_get_symbol(prop); + if (sym->type != S_BOOLEAN && sym->type != S_TRISTATE) + prop_warn(prop, + "config symbol '%s' uses select, but is " + "not boolean or tristate", sym->name); + else if (sym2->type == S_UNKNOWN) + prop_warn(prop, + "'select' used by config symbol '%s' " + "refer to undefined symbol '%s'", + sym->name, sym2->name); + else if (sym2->type != S_BOOLEAN && sym2->type != S_TRISTATE) + prop_warn(prop, + "'%s' has wrong type. 'select' only " + "accept arguments of boolean and " + "tristate type", sym2->name); + break; + case P_RANGE: + if (sym->type != S_INT && sym->type != S_HEX) + prop_warn(prop, "range is only allowed " + "for int or hex symbols"); + if (!sym_string_valid(sym, prop->expr->left.sym->name) || + !sym_string_valid(sym, prop->expr->right.sym->name)) + prop_warn(prop, "range is invalid"); + break; + default: + ; + } + } +} + +void menu_finalize(struct menu *parent) +{ + struct menu *menu, *last_menu; + struct symbol *sym; + struct property *prop; + struct expr *parentdep, *basedep, *dep, *dep2, **ep; + + sym = parent->sym; + if (parent->list) { + if (sym && sym_is_choice(sym)) { + /* find the first choice value and find out choice type */ + for (menu = parent->list; menu; menu = menu->next) { + if (menu->sym) { + current_entry = parent; + menu_set_type(menu->sym->type); + current_entry = menu; + menu_set_type(sym->type); + break; + } + } + parentdep = expr_alloc_symbol(sym); + } else if (parent->prompt) + parentdep = parent->prompt->visible.expr; + else + parentdep = parent->dep; + + for (menu = parent->list; menu; menu = menu->next) { + basedep = expr_transform(menu->dep); + basedep = expr_alloc_and(expr_copy(parentdep), basedep); + basedep = expr_eliminate_dups(basedep); + menu->dep = basedep; + if (menu->sym) + prop = menu->sym->prop; + else + prop = menu->prompt; + for (; prop; prop = prop->next) { + if (prop->menu != menu) + continue; + dep = expr_transform(prop->visible.expr); + dep = expr_alloc_and(expr_copy(basedep), dep); + dep = expr_eliminate_dups(dep); + if (menu->sym && menu->sym->type != S_TRISTATE) + dep = expr_trans_bool(dep); + prop->visible.expr = dep; + if (prop->type == P_SELECT) { + struct symbol *es = prop_get_symbol(prop); + es->rev_dep.expr = expr_alloc_or(es->rev_dep.expr, + expr_alloc_and(expr_alloc_symbol(menu->sym), expr_copy(dep))); + } + } + } + for (menu = parent->list; menu; menu = menu->next) + menu_finalize(menu); + } else if (sym) { + basedep = parent->prompt ? parent->prompt->visible.expr : NULL; + basedep = expr_trans_compare(basedep, E_UNEQUAL, &symbol_no); + basedep = expr_eliminate_dups(expr_transform(basedep)); + last_menu = NULL; + for (menu = parent->next; menu; menu = menu->next) { + dep = menu->prompt ? menu->prompt->visible.expr : menu->dep; + if (!expr_contains_symbol(dep, sym)) + break; + if (expr_depends_symbol(dep, sym)) + goto next; + dep = expr_trans_compare(dep, E_UNEQUAL, &symbol_no); + dep = expr_eliminate_dups(expr_transform(dep)); + dep2 = expr_copy(basedep); + expr_eliminate_eq(&dep, &dep2); + expr_free(dep); + if (!expr_is_yes(dep2)) { + expr_free(dep2); + break; + } + expr_free(dep2); + next: + menu_finalize(menu); + menu->parent = parent; + last_menu = menu; + } + if (last_menu) { + parent->list = parent->next; + parent->next = last_menu->next; + last_menu->next = NULL; + } + } + for (menu = parent->list; menu; menu = menu->next) { + if (sym && sym_is_choice(sym) && menu->sym) { + menu->sym->flags |= SYMBOL_CHOICEVAL; + if (!menu->prompt) + menu_warn(menu, "choice value must have a prompt"); + for (prop = menu->sym->prop; prop; prop = prop->next) { + if (prop->type == P_PROMPT && prop->menu != menu) { + prop_warn(prop, "choice values " + "currently only support a " + "single prompt"); + } + if (prop->type == P_DEFAULT) + prop_warn(prop, "defaults for choice " + "values not supported"); + } + current_entry = menu; + menu_set_type(sym->type); + menu_add_symbol(P_CHOICE, sym, NULL); + prop = sym_get_choice_prop(sym); + for (ep = &prop->expr; *ep; ep = &(*ep)->left.expr) + ; + *ep = expr_alloc_one(E_CHOICE, NULL); + (*ep)->right.sym = menu->sym; + } + if (menu->list && (!menu->prompt || !menu->prompt->text)) { + for (last_menu = menu->list; ; last_menu = last_menu->next) { + last_menu->parent = parent; + if (!last_menu->next) + break; + } + last_menu->next = menu->next; + menu->next = menu->list; + menu->list = NULL; + } + } + + if (sym && !(sym->flags & SYMBOL_WARNED)) { + if (sym->type == S_UNKNOWN) + menu_warn(parent, "config symbol defined " + "without type\n"); + + if (sym_is_choice(sym) && !parent->prompt) + menu_warn(parent, "choice must have a prompt\n"); + + /* Check properties connected to this symbol */ + sym_check_prop(sym); + sym->flags |= SYMBOL_WARNED; + } + + if (sym && !sym_is_optional(sym) && parent->prompt) { + sym->rev_dep.expr = expr_alloc_or(sym->rev_dep.expr, + expr_alloc_and(parent->prompt->visible.expr, + expr_alloc_symbol(&symbol_mod))); + } +} + +bool menu_is_visible(struct menu *menu) +{ + struct menu *child; + struct symbol *sym; + tristate visible; + + if (!menu->prompt) + return false; + sym = menu->sym; + if (sym) { + sym_calc_value(sym); + visible = menu->prompt->visible.tri; + } else + visible = menu->prompt->visible.tri = expr_calc_value(menu->prompt->visible.expr); + + if (visible != no) + return true; + if (!sym || sym_get_tristate_value(menu->sym) == no) + return false; + + for (child = menu->list; child; child = child->next) + if (menu_is_visible(child)) + return true; + return false; +} + +const char *menu_get_prompt(struct menu *menu) +{ + if (menu->prompt) + return menu->prompt->text; + else if (menu->sym) + return menu->sym->name; + return NULL; +} + +struct menu *menu_get_root_menu(struct menu *menu) +{ + return &rootmenu; +} + +struct menu *menu_get_parent_menu(struct menu *menu) +{ + enum prop_type type; + + for (; menu != &rootmenu; menu = menu->parent) { + type = menu->prompt ? menu->prompt->type : 0; + if (type == P_MENU) + break; + } + return menu; +} + diff --git a/config/scripts/config/mkconfigs b/config/scripts/config/mkconfigs new file mode 100755 index 0000000000..3cb7bb1754 --- /dev/null +++ b/config/scripts/config/mkconfigs @@ -0,0 +1,67 @@ +#!/bin/sh +# +# Copyright (C) 2002 Khalid Aziz +# Copyright (C) 2002 Randy Dunlap +# Copyright (C) 2002 Al Stone +# Copyright (C) 2002 Hewlett-Packard Company +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +# +# Busybox version by Matteo Croce <3297627799 at wind.it> +# +# Rules to generate bbconfig.h from .config: +# - Retain lines that begin with "CONFIG_" +# - Retain lines that begin with "# CONFIG_" +# - lines that use double-quotes must \\-escape-quote them + +if [ $# -lt 1 ] +then + config=.config +else config=$1 +fi + +echo "#ifndef _BBCONFIG_H" +echo "#define _BBCONFIG_H" +echo \ +"/* + * busybox configuration options. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or (at + * your option) any later version. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or + * NON INFRINGEMENT. See the GNU General Public License for more + * details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * + * + * + * This file is generated automatically by scripts/config/mkconfigs. + * Do not edit. + * + */" + +echo "static char const bbconfig_config[] =" +echo "\"CONFIG_BEGIN=n\\n\\" +echo "`sed 's/\"/\\\\\"/g' $config | grep "^#\? \?CONFIG_" | awk '{ print $0 "\\\\n\\\\" }' `" +echo "CONFIG_END=n\\n\";" +echo "#endif /* _BBCONFIG_H */" diff --git a/config/scripts/config/symbol.c b/config/scripts/config/symbol.c new file mode 100644 index 0000000000..ea629728ac --- /dev/null +++ b/config/scripts/config/symbol.c @@ -0,0 +1,809 @@ +/* + * Copyright (C) 2002 Roman Zippel + * Released under the terms of the GNU GPL v2.0. + */ + +#include +#include +#include +#include +#include + +#define LKC_DIRECT_LINK +#include "lkc.h" + +struct symbol symbol_yes = { + .name = "y", + .curr = { "y", yes }, + .flags = SYMBOL_YES|SYMBOL_VALID, +}, symbol_mod = { + .name = "m", + .curr = { "m", mod }, + .flags = SYMBOL_MOD|SYMBOL_VALID, +}, symbol_no = { + .name = "n", + .curr = { "n", no }, + .flags = SYMBOL_NO|SYMBOL_VALID, +}, symbol_empty = { + .name = "", + .curr = { "", no }, + .flags = SYMBOL_VALID, +}; + +int sym_change_count; +struct symbol *modules_sym; +tristate modules_val; + +void sym_add_default(struct symbol *sym, const char *def) +{ + struct property *prop = prop_alloc(P_DEFAULT, sym); + + prop->expr = expr_alloc_symbol(sym_lookup(def, 1)); +} + +void sym_init(void) +{ + struct symbol *sym; + char *p; + static bool inited = false; + + if (inited) + return; + inited = true; + + sym = sym_lookup("VERSION", 0); + sym->type = S_STRING; + sym->flags |= SYMBOL_AUTO; + p = getenv("VERSION"); + if (p) + sym_add_default(sym, p); + + sym = sym_lookup("TARGET_ARCH", 0); + sym->type = S_STRING; + sym->flags |= SYMBOL_AUTO; + p = getenv("TARGET_ARCH"); + if (p) + sym_add_default(sym, p); + +} + +enum symbol_type sym_get_type(struct symbol *sym) +{ + enum symbol_type type = sym->type; + + if (type == S_TRISTATE) { + if (sym_is_choice_value(sym) && sym->visible == yes) + type = S_BOOLEAN; + else if (modules_val == no) + type = S_BOOLEAN; + } + return type; +} + +const char *sym_type_name(enum symbol_type type) +{ + switch (type) { + case S_BOOLEAN: + return "boolean"; + case S_TRISTATE: + return "tristate"; + case S_INT: + return "integer"; + case S_HEX: + return "hex"; + case S_STRING: + return "string"; + case S_UNKNOWN: + return "unknown"; + case S_OTHER: + break; + } + return "???"; +} + +struct property *sym_get_choice_prop(struct symbol *sym) +{ + struct property *prop; + + for_all_choices(sym, prop) + return prop; + return NULL; +} + +struct property *sym_get_default_prop(struct symbol *sym) +{ + struct property *prop; + + for_all_defaults(sym, prop) { + prop->visible.tri = expr_calc_value(prop->visible.expr); + if (prop->visible.tri != no) + return prop; + } + return NULL; +} + +struct property *sym_get_range_prop(struct symbol *sym) +{ + struct property *prop; + + for_all_properties(sym, prop, P_RANGE) { + prop->visible.tri = expr_calc_value(prop->visible.expr); + if (prop->visible.tri != no) + return prop; + } + return NULL; +} + +static void sym_calc_visibility(struct symbol *sym) +{ + struct property *prop; + tristate tri; + + /* any prompt visible? */ + tri = no; + for_all_prompts(sym, prop) { + prop->visible.tri = expr_calc_value(prop->visible.expr); + tri = E_OR(tri, prop->visible.tri); + } + if (tri == mod && (sym->type != S_TRISTATE || modules_val == no)) + tri = yes; + if (sym->visible != tri) { + sym->visible = tri; + sym_set_changed(sym); + } + if (sym_is_choice_value(sym)) + return; + tri = no; + if (sym->rev_dep.expr) + tri = expr_calc_value(sym->rev_dep.expr); + if (tri == mod && sym_get_type(sym) == S_BOOLEAN) + tri = yes; + if (sym->rev_dep.tri != tri) { + sym->rev_dep.tri = tri; + sym_set_changed(sym); + } +} + +static struct symbol *sym_calc_choice(struct symbol *sym) +{ + struct symbol *def_sym; + struct property *prop; + struct expr *e; + + /* is the user choice visible? */ + def_sym = sym->user.val; + if (def_sym) { + sym_calc_visibility(def_sym); + if (def_sym->visible != no) + return def_sym; + } + + /* any of the defaults visible? */ + for_all_defaults(sym, prop) { + prop->visible.tri = expr_calc_value(prop->visible.expr); + if (prop->visible.tri == no) + continue; + def_sym = prop_get_symbol(prop); + sym_calc_visibility(def_sym); + if (def_sym->visible != no) + return def_sym; + } + + /* just get the first visible value */ + prop = sym_get_choice_prop(sym); + for (e = prop->expr; e; e = e->left.expr) { + def_sym = e->right.sym; + sym_calc_visibility(def_sym); + if (def_sym->visible != no) + return def_sym; + } + + /* no choice? reset tristate value */ + sym->curr.tri = no; + return NULL; +} + +void sym_calc_value(struct symbol *sym) +{ + struct symbol_value newval, oldval; + struct property *prop; + struct expr *e; + + if (!sym) + return; + + if (sym->flags & SYMBOL_VALID) + return; + sym->flags |= SYMBOL_VALID; + + oldval = sym->curr; + + switch (sym->type) { + case S_INT: + case S_HEX: + case S_STRING: + newval = symbol_empty.curr; + break; + case S_BOOLEAN: + case S_TRISTATE: + newval = symbol_no.curr; + break; + default: + sym->curr.val = sym->name; + sym->curr.tri = no; + return; + } + if (!sym_is_choice_value(sym)) + sym->flags &= ~SYMBOL_WRITE; + + sym_calc_visibility(sym); + + /* set default if recursively called */ + sym->curr = newval; + + switch (sym_get_type(sym)) { + case S_BOOLEAN: + case S_TRISTATE: + if (sym_is_choice_value(sym) && sym->visible == yes) { + prop = sym_get_choice_prop(sym); + newval.tri = (prop_get_symbol(prop)->curr.val == sym) ? yes : no; + } else if (E_OR(sym->visible, sym->rev_dep.tri) != no) { + sym->flags |= SYMBOL_WRITE; + if (sym_has_value(sym)) + newval.tri = sym->user.tri; + else if (!sym_is_choice(sym)) { + prop = sym_get_default_prop(sym); + if (prop) + newval.tri = expr_calc_value(prop->expr); + } + newval.tri = E_OR(E_AND(newval.tri, sym->visible), sym->rev_dep.tri); + } else if (!sym_is_choice(sym)) { + prop = sym_get_default_prop(sym); + if (prop) { + sym->flags |= SYMBOL_WRITE; + newval.tri = expr_calc_value(prop->expr); + } + } + if (newval.tri == mod && sym_get_type(sym) == S_BOOLEAN) + newval.tri = yes; + break; + case S_STRING: + case S_HEX: + case S_INT: + if (sym->visible != no) { + sym->flags |= SYMBOL_WRITE; + if (sym_has_value(sym)) { + newval.val = sym->user.val; + break; + } + } + prop = sym_get_default_prop(sym); + if (prop) { + struct symbol *ds = prop_get_symbol(prop); + if (ds) { + sym->flags |= SYMBOL_WRITE; + sym_calc_value(ds); + newval.val = ds->curr.val; + } + } + break; + default: + ; + } + + sym->curr = newval; + if (sym_is_choice(sym) && newval.tri == yes) + sym->curr.val = sym_calc_choice(sym); + + if (memcmp(&oldval, &sym->curr, sizeof(oldval))) + sym_set_changed(sym); + if (modules_sym == sym) + modules_val = modules_sym->curr.tri; + + if (sym_is_choice(sym)) { + int flags = sym->flags & (SYMBOL_CHANGED | SYMBOL_WRITE); + prop = sym_get_choice_prop(sym); + for (e = prop->expr; e; e = e->left.expr) { + e->right.sym->flags |= flags; + if (flags & SYMBOL_CHANGED) + sym_set_changed(e->right.sym); + } + } +} + +void sym_clear_all_valid(void) +{ + struct symbol *sym; + int i; + + for_all_symbols(i, sym) + sym->flags &= ~SYMBOL_VALID; + sym_change_count++; + if (modules_sym) + sym_calc_value(modules_sym); +} + +void sym_set_changed(struct symbol *sym) +{ + struct property *prop; + + sym->flags |= SYMBOL_CHANGED; + for (prop = sym->prop; prop; prop = prop->next) { + if (prop->menu) + prop->menu->flags |= MENU_CHANGED; + } +} + +void sym_set_all_changed(void) +{ + struct symbol *sym; + int i; + + for_all_symbols(i, sym) + sym_set_changed(sym); +} + +bool sym_tristate_within_range(struct symbol *sym, tristate val) +{ + int type = sym_get_type(sym); + + if (sym->visible == no) + return false; + + if (type != S_BOOLEAN && type != S_TRISTATE) + return false; + + if (type == S_BOOLEAN && val == mod) + return false; + if (sym->visible <= sym->rev_dep.tri) + return false; + if (sym_is_choice_value(sym) && sym->visible == yes) + return val == yes; + return val >= sym->rev_dep.tri && val <= sym->visible; +} + +bool sym_set_tristate_value(struct symbol *sym, tristate val) +{ + tristate oldval = sym_get_tristate_value(sym); + + if (oldval != val && !sym_tristate_within_range(sym, val)) + return false; + + if (sym->flags & SYMBOL_NEW) { + sym->flags &= ~SYMBOL_NEW; + sym_set_changed(sym); + } + if (sym_is_choice_value(sym) && val == yes) { + struct symbol *cs = prop_get_symbol(sym_get_choice_prop(sym)); + + cs->user.val = sym; + cs->flags &= ~SYMBOL_NEW; + } + + sym->user.tri = val; + if (oldval != val) { + sym_clear_all_valid(); + if (sym == modules_sym) + sym_set_all_changed(); + } + + return true; +} + +tristate sym_toggle_tristate_value(struct symbol *sym) +{ + tristate oldval, newval; + + oldval = newval = sym_get_tristate_value(sym); + do { + switch (newval) { + case no: + newval = mod; + break; + case mod: + newval = yes; + break; + case yes: + newval = no; + break; + } + if (sym_set_tristate_value(sym, newval)) + break; + } while (oldval != newval); + return newval; +} + +bool sym_string_valid(struct symbol *sym, const char *str) +{ + signed char ch; + + switch (sym->type) { + case S_STRING: + return true; + case S_INT: + ch = *str++; + if (ch == '-') + ch = *str++; + if (!isdigit(ch)) + return false; + if (ch == '0' && *str != 0) + return false; + while ((ch = *str++)) { + if (!isdigit(ch)) + return false; + } + return true; + case S_HEX: + if (str[0] == '0' && (str[1] == 'x' || str[1] == 'X')) + str += 2; + ch = *str++; + do { + if (!isxdigit(ch)) + return false; + } while ((ch = *str++)); + return true; + case S_BOOLEAN: + case S_TRISTATE: + switch (str[0]) { + case 'y': case 'Y': + case 'm': case 'M': + case 'n': case 'N': + return true; + } + return false; + default: + return false; + } +} + +bool sym_string_within_range(struct symbol *sym, const char *str) +{ + struct property *prop; + int val; + + switch (sym->type) { + case S_STRING: + return sym_string_valid(sym, str); + case S_INT: + if (!sym_string_valid(sym, str)) + return false; + prop = sym_get_range_prop(sym); + if (!prop) + return true; + val = strtol(str, NULL, 10); + return val >= strtol(prop->expr->left.sym->name, NULL, 10) && + val <= strtol(prop->expr->right.sym->name, NULL, 10); + case S_HEX: + if (!sym_string_valid(sym, str)) + return false; + prop = sym_get_range_prop(sym); + if (!prop) + return true; + val = strtol(str, NULL, 16); + return val >= strtol(prop->expr->left.sym->name, NULL, 16) && + val <= strtol(prop->expr->right.sym->name, NULL, 16); + case S_BOOLEAN: + case S_TRISTATE: + switch (str[0]) { + case 'y': case 'Y': + return sym_tristate_within_range(sym, yes); + case 'm': case 'M': + return sym_tristate_within_range(sym, mod); + case 'n': case 'N': + return sym_tristate_within_range(sym, no); + } + return false; + default: + return false; + } +} + +bool sym_set_string_value(struct symbol *sym, const char *newval) +{ + const char *oldval; + char *val; + int size; + + switch (sym->type) { + case S_BOOLEAN: + case S_TRISTATE: + switch (newval[0]) { + case 'y': case 'Y': + return sym_set_tristate_value(sym, yes); + case 'm': case 'M': + return sym_set_tristate_value(sym, mod); + case 'n': case 'N': + return sym_set_tristate_value(sym, no); + } + return false; + default: + ; + } + + if (!sym_string_within_range(sym, newval)) + return false; + + if (sym->flags & SYMBOL_NEW) { + sym->flags &= ~SYMBOL_NEW; + sym_set_changed(sym); + } + + oldval = sym->user.val; + size = strlen(newval) + 1; + if (sym->type == S_HEX && (newval[0] != '0' || (newval[1] != 'x' && newval[1] != 'X'))) { + size += 2; + sym->user.val = val = malloc(size); + *val++ = '0'; + *val++ = 'x'; + } else if (!oldval || strcmp(oldval, newval)) + sym->user.val = val = malloc(size); + else + return true; + + strcpy(val, newval); + free((void *)oldval); + sym_clear_all_valid(); + + return true; +} + +const char *sym_get_string_value(struct symbol *sym) +{ + tristate val; + + switch (sym->type) { + case S_BOOLEAN: + case S_TRISTATE: + val = sym_get_tristate_value(sym); + switch (val) { + case no: + return "n"; + case mod: + return "m"; + case yes: + return "y"; + } + break; + default: + ; + } + return (const char *)sym->curr.val; +} + +bool sym_is_changable(struct symbol *sym) +{ + return sym->visible > sym->rev_dep.tri; +} + +struct symbol *sym_lookup(const char *name, int isconst) +{ + struct symbol *symbol; + const char *ptr; + char *new_name; + int hash = 0; + + if (name) { + if (name[0] && !name[1]) { + switch (name[0]) { + case 'y': return &symbol_yes; + case 'm': return &symbol_mod; + case 'n': return &symbol_no; + } + } + for (ptr = name; *ptr; ptr++) + hash += *ptr; + hash &= 0xff; + + for (symbol = symbol_hash[hash]; symbol; symbol = symbol->next) { + if (!strcmp(symbol->name, name)) { + if ((isconst && symbol->flags & SYMBOL_CONST) || + (!isconst && !(symbol->flags & SYMBOL_CONST))) + return symbol; + } + } + new_name = strdup(name); + } else { + new_name = NULL; + hash = 256; + } + + symbol = malloc(sizeof(*symbol)); + memset(symbol, 0, sizeof(*symbol)); + symbol->name = new_name; + symbol->type = S_UNKNOWN; + symbol->flags = SYMBOL_NEW; + if (isconst) + symbol->flags |= SYMBOL_CONST; + + symbol->next = symbol_hash[hash]; + symbol_hash[hash] = symbol; + + return symbol; +} + +struct symbol *sym_find(const char *name) +{ + struct symbol *symbol = NULL; + const char *ptr; + int hash = 0; + + if (!name) + return NULL; + + if (name[0] && !name[1]) { + switch (name[0]) { + case 'y': return &symbol_yes; + case 'm': return &symbol_mod; + case 'n': return &symbol_no; + } + } + for (ptr = name; *ptr; ptr++) + hash += *ptr; + hash &= 0xff; + + for (symbol = symbol_hash[hash]; symbol; symbol = symbol->next) { + if (!strcmp(symbol->name, name) && + !(symbol->flags & SYMBOL_CONST)) + break; + } + + return symbol; +} + +struct symbol **sym_re_search(const char *pattern) +{ + struct symbol *sym, **sym_arr = NULL; + int i, cnt, size; + regex_t re; + + cnt = size = 0; + /* Skip if empty */ + if (strlen(pattern) == 0) + return NULL; + if (regcomp(&re, pattern, REG_EXTENDED|REG_NOSUB|REG_ICASE)) + return NULL; + + for_all_symbols(i, sym) { + if (sym->flags & SYMBOL_CONST || !sym->name) + continue; + if (regexec(&re, sym->name, 0, NULL, 0)) + continue; + if (cnt + 1 >= size) { + void *tmp = sym_arr; + size += 16; + sym_arr = realloc(sym_arr, size * sizeof(struct symbol *)); + if (!sym_arr) { + free(tmp); + return NULL; + } + } + sym_arr[cnt++] = sym; + } + if (sym_arr) + sym_arr[cnt] = NULL; + regfree(&re); + + return sym_arr; +} + + +struct symbol *sym_check_deps(struct symbol *sym); + +static struct symbol *sym_check_expr_deps(struct expr *e) +{ + struct symbol *sym; + + if (!e) + return NULL; + switch (e->type) { + case E_OR: + case E_AND: + sym = sym_check_expr_deps(e->left.expr); + if (sym) + return sym; + return sym_check_expr_deps(e->right.expr); + case E_NOT: + return sym_check_expr_deps(e->left.expr); + case E_EQUAL: + case E_UNEQUAL: + sym = sym_check_deps(e->left.sym); + if (sym) + return sym; + return sym_check_deps(e->right.sym); + case E_SYMBOL: + return sym_check_deps(e->left.sym); + default: + break; + } + printf("Oops! How to check %d?\n", e->type); + return NULL; +} + +struct symbol *sym_check_deps(struct symbol *sym) +{ + struct symbol *sym2; + struct property *prop; + + if (sym->flags & SYMBOL_CHECK_DONE) + return NULL; + if (sym->flags & SYMBOL_CHECK) { + printf("Warning! Found recursive dependency: %s", sym->name); + return sym; + } + + sym->flags |= (SYMBOL_CHECK | SYMBOL_CHECKED); + sym2 = sym_check_expr_deps(sym->rev_dep.expr); + if (sym2) + goto out; + + for (prop = sym->prop; prop; prop = prop->next) { + if (prop->type == P_CHOICE || prop->type == P_SELECT) + continue; + sym2 = sym_check_expr_deps(prop->visible.expr); + if (sym2) + goto out; + if (prop->type != P_DEFAULT || sym_is_choice(sym)) + continue; + sym2 = sym_check_expr_deps(prop->expr); + if (sym2) + goto out; + } +out: + if (sym2) + printf(" %s", sym->name); + sym->flags &= ~SYMBOL_CHECK; + return sym2; +} + +struct property *prop_alloc(enum prop_type type, struct symbol *sym) +{ + struct property *prop; + struct property **propp; + + prop = malloc(sizeof(*prop)); + memset(prop, 0, sizeof(*prop)); + prop->type = type; + prop->sym = sym; + prop->file = current_file; + prop->lineno = zconf_lineno(); + + /* append property to the prop list of symbol */ + if (sym) { + for (propp = &sym->prop; *propp; propp = &(*propp)->next) + ; + *propp = prop; + } + + return prop; +} + +struct symbol *prop_get_symbol(struct property *prop) +{ + if (prop->expr && (prop->expr->type == E_SYMBOL || + prop->expr->type == E_CHOICE)) + return prop->expr->left.sym; + return NULL; +} + +const char *prop_get_type_name(enum prop_type type) +{ + switch (type) { + case P_PROMPT: + return "prompt"; + case P_COMMENT: + return "comment"; + case P_MENU: + return "menu"; + case P_DEFAULT: + return "default"; + case P_CHOICE: + return "choice"; + case P_SELECT: + return "select"; + case P_RANGE: + return "range"; + case P_UNKNOWN: + break; + } + return "unknown"; +} diff --git a/config/scripts/config/util.c b/config/scripts/config/util.c new file mode 100644 index 0000000000..8fc95a2a70 --- /dev/null +++ b/config/scripts/config/util.c @@ -0,0 +1,109 @@ +/* + * Copyright (C) 2002-2005 Roman Zippel + * Copyright (C) 2002-2005 Sam Ravnborg + * + * Released under the terms of the GNU GPL v2.0. + */ + +#include +#include "lkc.h" + +/* file already present in list? If not add it */ +struct file *file_lookup(const char *name) +{ + struct file *file; + + for (file = file_list; file; file = file->next) { + if (!strcmp(name, file->name)) + return file; + } + + file = malloc(sizeof(*file)); + memset(file, 0, sizeof(*file)); + file->name = strdup(name); + file->next = file_list; + file_list = file; + return file; +} + +/* write a dependency file as used by kbuild to track dependencies */ +int file_write_dep(const char *name) +{ + struct file *file; + FILE *out; + + if (!name) + name = "config/.config.cmd"; + out = fopen("config/.config.tmp", "w"); + if (!out) + return 1; + fprintf(out, "deps_config := \\\n"); + for (file = file_list; file; file = file->next) { + if (file->next) + fprintf(out, "\t%s \\\n", file->name); + else + fprintf(out, "\t%s\n", file->name); + } + fprintf(out, "\n.config include/config.h: $(deps_config)\n\n$(deps_config):\n"); + fclose(out); + rename(".config.tmp", name); + return 0; +} + + +/* Allocate initial growable sting */ +struct gstr str_new(void) +{ + struct gstr gs; + gs.s = malloc(sizeof(char) * 64); + gs.len = 16; + strcpy(gs.s, "\0"); + return gs; +} + +/* Allocate and assign growable string */ +struct gstr str_assign(const char *s) +{ + struct gstr gs; + gs.s = strdup(s); + gs.len = strlen(s) + 1; + return gs; +} + +/* Free storage for growable string */ +void str_free(struct gstr *gs) +{ + if (gs->s) + free(gs->s); + gs->s = NULL; + gs->len = 0; +} + +/* Append to growable string */ +void str_append(struct gstr *gs, const char *s) +{ + size_t l = strlen(gs->s) + strlen(s) + 1; + if (l > gs->len) { + gs->s = realloc(gs->s, l); + gs->len = l; + } + strcat(gs->s, s); +} + +/* Append printf formatted string to growable string */ +void str_printf(struct gstr *gs, const char *fmt, ...) +{ + va_list ap; + char s[10000]; /* big enough... */ + va_start(ap, fmt); + vsnprintf(s, sizeof(s), fmt, ap); + str_append(gs, s); + va_end(ap); +} + +/* Retreive value of growable string */ +const char *str_get(struct gstr *gs) +{ + return gs->s; +} + diff --git a/config/scripts/config/zconf.l b/config/scripts/config/zconf.l new file mode 100644 index 0000000000..55517b2877 --- /dev/null +++ b/config/scripts/config/zconf.l @@ -0,0 +1,366 @@ +%option backup nostdinit noyywrap never-interactive full ecs +%option 8bit backup nodefault perf-report perf-report +%x COMMAND HELP STRING PARAM +%{ +/* + * Copyright (C) 2002 Roman Zippel + * Released under the terms of the GNU GPL v2.0. + */ + +#include +#include +#include +#include +#include + +#define LKC_DIRECT_LINK +#include "lkc.h" + +#define START_STRSIZE 16 + +char *text; +static char *text_ptr; +static int text_size, text_asize; + +struct buffer { + struct buffer *parent; + YY_BUFFER_STATE state; +}; + +struct buffer *current_buf; + +static int last_ts, first_ts; + +static void zconf_endhelp(void); +static struct buffer *zconf_endfile(void); + +void new_string(void) +{ + text = malloc(START_STRSIZE); + text_asize = START_STRSIZE; + text_ptr = text; + text_size = 0; + *text_ptr = 0; +} + +void append_string(const char *str, int size) +{ + int new_size = text_size + size + 1; + if (new_size > text_asize) { + text = realloc(text, new_size); + text_asize = new_size; + text_ptr = text + text_size; + } + memcpy(text_ptr, str, size); + text_ptr += size; + text_size += size; + *text_ptr = 0; +} + +void alloc_string(const char *str, int size) +{ + text = malloc(size + 1); + memcpy(text, str, size); + text[size] = 0; +} +%} + +ws [ \n\t] +n [A-Za-z0-9_] + +%% + int str = 0; + int ts, i; + +[ \t]*#.*\n current_file->lineno++; +[ \t]*#.* + +[ \t]*\n current_file->lineno++; return T_EOL; + +[ \t]+ { + BEGIN(COMMAND); +} + +. { + unput(yytext[0]); + BEGIN(COMMAND); +} + + +{ + "mainmenu" BEGIN(PARAM); return T_MAINMENU; + "menu" BEGIN(PARAM); return T_MENU; + "endmenu" BEGIN(PARAM); return T_ENDMENU; + "source" BEGIN(PARAM); return T_SOURCE; + "choice" BEGIN(PARAM); return T_CHOICE; + "endchoice" BEGIN(PARAM); return T_ENDCHOICE; + "comment" BEGIN(PARAM); return T_COMMENT; + "config" BEGIN(PARAM); return T_CONFIG; + "menuconfig" BEGIN(PARAM); return T_MENUCONFIG; + "help" BEGIN(PARAM); return T_HELP; + "if" BEGIN(PARAM); return T_IF; + "endif" BEGIN(PARAM); return T_ENDIF; + "depends" BEGIN(PARAM); return T_DEPENDS; + "requires" BEGIN(PARAM); return T_REQUIRES; + "optional" BEGIN(PARAM); return T_OPTIONAL; + "default" BEGIN(PARAM); return T_DEFAULT; + "prompt" BEGIN(PARAM); return T_PROMPT; + "tristate" BEGIN(PARAM); return T_TRISTATE; + "def_tristate" BEGIN(PARAM); return T_DEF_TRISTATE; + "bool" BEGIN(PARAM); return T_BOOLEAN; + "boolean" BEGIN(PARAM); return T_BOOLEAN; + "def_bool" BEGIN(PARAM); return T_DEF_BOOLEAN; + "def_boolean" BEGIN(PARAM); return T_DEF_BOOLEAN; + "int" BEGIN(PARAM); return T_INT; + "hex" BEGIN(PARAM); return T_HEX; + "string" BEGIN(PARAM); return T_STRING; + "select" BEGIN(PARAM); return T_SELECT; + "enable" BEGIN(PARAM); return T_SELECT; + "range" BEGIN(PARAM); return T_RANGE; + {n}+ { + alloc_string(yytext, yyleng); + zconflval.string = text; + return T_WORD; + } + . + \n current_file->lineno++; BEGIN(INITIAL); +} + +{ + "&&" return T_AND; + "||" return T_OR; + "(" return T_OPEN_PAREN; + ")" return T_CLOSE_PAREN; + "!" return T_NOT; + "=" return T_EQUAL; + "!=" return T_UNEQUAL; + "if" return T_IF; + "on" return T_ON; + \"|\' { + str = yytext[0]; + new_string(); + BEGIN(STRING); + } + \n BEGIN(INITIAL); current_file->lineno++; return T_EOL; + --- /* ignore */ + ({n}|[-/.])+ { + alloc_string(yytext, yyleng); + zconflval.string = text; + return T_WORD; + } + #.* /* comment */ + \\\n current_file->lineno++; + . + <> { + BEGIN(INITIAL); + } +} + +{ + [^'"\\\n]+/\n { + append_string(yytext, yyleng); + zconflval.string = text; + return T_WORD_QUOTE; + } + [^'"\\\n]+ { + append_string(yytext, yyleng); + } + \\.?/\n { + append_string(yytext + 1, yyleng - 1); + zconflval.string = text; + return T_WORD_QUOTE; + } + \\.? { + append_string(yytext + 1, yyleng - 1); + } + \'|\" { + if (str == yytext[0]) { + BEGIN(PARAM); + zconflval.string = text; + return T_WORD_QUOTE; + } else + append_string(yytext, 1); + } + \n { + printf("%s:%d:warning: multi-line strings not supported\n", zconf_curname(), zconf_lineno()); + current_file->lineno++; + BEGIN(INITIAL); + return T_EOL; + } + <> { + BEGIN(INITIAL); + } +} + +{ + [ \t]+ { + ts = 0; + for (i = 0; i < yyleng; i++) { + if (yytext[i] == '\t') + ts = (ts & ~7) + 8; + else + ts++; + } + last_ts = ts; + if (first_ts) { + if (ts < first_ts) { + zconf_endhelp(); + return T_HELPTEXT; + } + ts -= first_ts; + while (ts > 8) { + append_string(" ", 8); + ts -= 8; + } + append_string(" ", ts); + } + } + [ \t]*\n/[^ \t\n] { + current_file->lineno++; + zconf_endhelp(); + return T_HELPTEXT; + } + [ \t]*\n { + current_file->lineno++; + append_string("\n", 1); + } + [^ \t\n].* { + append_string(yytext, yyleng); + if (!first_ts) + first_ts = last_ts; + } + <> { + zconf_endhelp(); + return T_HELPTEXT; + } +} + +<> { + if (current_buf) { + zconf_endfile(); + return T_EOF; + } + fclose(yyin); + yyterminate(); +} + +%% +void zconf_starthelp(void) +{ + new_string(); + last_ts = first_ts = 0; + BEGIN(HELP); +} + +static void zconf_endhelp(void) +{ + zconflval.string = text; + BEGIN(INITIAL); +} + + +/* + * Try to open specified file with following names: + * ./name + * $(srctree)/name + * The latter is used when srctree is separate from objtree + * when compiling the kernel. + * Return NULL if file is not found. + */ +FILE *zconf_fopen(const char *name) +{ + char *env, fullname[PATH_MAX+1]; + FILE *f; + + f = fopen(name, "r"); + if (!f && name[0] != '/') { + env = getenv(SRCTREE); + if (env) { + sprintf(fullname, "%s/%s", env, name); + f = fopen(fullname, "r"); + } + } + return f; +} + +void zconf_initscan(const char *name) +{ + yyin = zconf_fopen(name); + if (!yyin) { + printf("can't find file %s\n", name); + exit(1); + } + + current_buf = malloc(sizeof(*current_buf)); + memset(current_buf, 0, sizeof(*current_buf)); + + current_file = file_lookup(name); + current_file->lineno = 1; + current_file->flags = FILE_BUSY; +} + +void zconf_nextfile(const char *name) +{ + struct file *file = file_lookup(name); + struct buffer *buf = malloc(sizeof(*buf)); + memset(buf, 0, sizeof(*buf)); + + current_buf->state = YY_CURRENT_BUFFER; + yyin = zconf_fopen(name); + if (!yyin) { + printf("%s:%d: can't open file \"%s\"\n", zconf_curname(), zconf_lineno(), name); + exit(1); + } + yy_switch_to_buffer(yy_create_buffer(yyin, YY_BUF_SIZE)); + buf->parent = current_buf; + current_buf = buf; + + if (file->flags & FILE_BUSY) { + printf("recursive scan (%s)?\n", name); + exit(1); + } + if (file->flags & FILE_SCANNED) { + printf("file %s already scanned?\n", name); + exit(1); + } + file->flags |= FILE_BUSY; + file->lineno = 1; + file->parent = current_file; + current_file = file; +} + +static struct buffer *zconf_endfile(void) +{ + struct buffer *parent; + + current_file->flags |= FILE_SCANNED; + current_file->flags &= ~FILE_BUSY; + current_file = current_file->parent; + + parent = current_buf->parent; + if (parent) { + fclose(yyin); + yy_delete_buffer(YY_CURRENT_BUFFER); + yy_switch_to_buffer(parent->state); + } + free(current_buf); + current_buf = parent; + + return parent; +} + +int zconf_lineno(void) +{ + if (current_buf) + return current_file->lineno - 1; + else + return 0; +} + +char *zconf_curname(void) +{ + if (current_buf) + return current_file->name; + else + return ""; +} diff --git a/config/scripts/config/zconf.tab.c b/config/scripts/config/zconf.tab.c new file mode 100644 index 0000000000..cc68dcb9a3 --- /dev/null +++ b/config/scripts/config/zconf.tab.c @@ -0,0 +1,2130 @@ +/* A Bison parser, made by GNU Bison 1.875a. */ + +/* Skeleton parser for Yacc-like parsing with Bison, + Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003 Free Software Foundation, Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2, or (at your option) + any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 59 Temple Place - Suite 330, + Boston, MA 02111-1307, USA. */ + +/* As a special exception, when this file is copied by Bison into a + Bison output file, you may use that output file without restriction. + This special exception was added by the Free Software Foundation + in version 1.24 of Bison. */ + +/* Written by Richard Stallman by simplifying the original so called + ``semantic'' parser. */ + +/* All symbols defined below should begin with yy or YY, to avoid + infringing on user name space. This should be done even for local + variables, as they might otherwise be expanded by user macros. + There are some unavoidable exceptions within include files to + define necessary library symbols; they are noted "INFRINGES ON + USER NAME SPACE" below. */ + +/* Identify Bison output. */ +#define YYBISON 1 + +/* Skeleton name. */ +#define YYSKELETON_NAME "yacc.c" + +/* Pure parsers. */ +#define YYPURE 0 + +/* Using locations. */ +#define YYLSP_NEEDED 0 + +/* If NAME_PREFIX is specified substitute the variables and functions + names. */ +#define yyparse zconfparse +#define yylex zconflex +#define yyerror zconferror +#define yylval zconflval +#define yychar zconfchar +#define yydebug zconfdebug +#define yynerrs zconfnerrs + + +/* Tokens. */ +#ifndef YYTOKENTYPE +# define YYTOKENTYPE + /* Put the tokens into the symbol table, so that GDB and other debuggers + know about them. */ + enum yytokentype { + T_MAINMENU = 258, + T_MENU = 259, + T_ENDMENU = 260, + T_SOURCE = 261, + T_CHOICE = 262, + T_ENDCHOICE = 263, + T_COMMENT = 264, + T_CONFIG = 265, + T_MENUCONFIG = 266, + T_HELP = 267, + T_HELPTEXT = 268, + T_IF = 269, + T_ENDIF = 270, + T_DEPENDS = 271, + T_REQUIRES = 272, + T_OPTIONAL = 273, + T_PROMPT = 274, + T_DEFAULT = 275, + T_TRISTATE = 276, + T_DEF_TRISTATE = 277, + T_BOOLEAN = 278, + T_DEF_BOOLEAN = 279, + T_STRING = 280, + T_INT = 281, + T_HEX = 282, + T_WORD = 283, + T_WORD_QUOTE = 284, + T_UNEQUAL = 285, + T_EOF = 286, + T_EOL = 287, + T_CLOSE_PAREN = 288, + T_OPEN_PAREN = 289, + T_ON = 290, + T_SELECT = 291, + T_RANGE = 292, + T_OR = 293, + T_AND = 294, + T_EQUAL = 295, + T_NOT = 296 + }; +#endif +#define T_MAINMENU 258 +#define T_MENU 259 +#define T_ENDMENU 260 +#define T_SOURCE 261 +#define T_CHOICE 262 +#define T_ENDCHOICE 263 +#define T_COMMENT 264 +#define T_CONFIG 265 +#define T_MENUCONFIG 266 +#define T_HELP 267 +#define T_HELPTEXT 268 +#define T_IF 269 +#define T_ENDIF 270 +#define T_DEPENDS 271 +#define T_REQUIRES 272 +#define T_OPTIONAL 273 +#define T_PROMPT 274 +#define T_DEFAULT 275 +#define T_TRISTATE 276 +#define T_DEF_TRISTATE 277 +#define T_BOOLEAN 278 +#define T_DEF_BOOLEAN 279 +#define T_STRING 280 +#define T_INT 281 +#define T_HEX 282 +#define T_WORD 283 +#define T_WORD_QUOTE 284 +#define T_UNEQUAL 285 +#define T_EOF 286 +#define T_EOL 287 +#define T_CLOSE_PAREN 288 +#define T_OPEN_PAREN 289 +#define T_ON 290 +#define T_SELECT 291 +#define T_RANGE 292 +#define T_OR 293 +#define T_AND 294 +#define T_EQUAL 295 +#define T_NOT 296 + + + + +/* Copy the first part of user declarations. */ + + +/* + * Copyright (C) 2002 Roman Zippel + * Released under the terms of the GNU GPL v2.0. + */ + +#include +#include +#include +#include +#include +#include + +#define printd(mask, fmt...) if (cdebug & (mask)) printf(fmt) + +#define PRINTD 0x0001 +#define DEBUG_PARSE 0x0002 + +int cdebug = PRINTD; + +extern int zconflex(void); +static void zconfprint(const char *err, ...); +static void zconferror(const char *err); +static bool zconf_endtoken(int token, int starttoken, int endtoken); + +struct symbol *symbol_hash[257]; + +static struct menu *current_menu, *current_entry; + +#define YYERROR_VERBOSE + + +/* Enabling traces. */ +#ifndef YYDEBUG +# define YYDEBUG 0 +#endif + +/* Enabling verbose error messages. */ +#ifdef YYERROR_VERBOSE +# undef YYERROR_VERBOSE +# define YYERROR_VERBOSE 1 +#else +# define YYERROR_VERBOSE 0 +#endif + +#if ! defined (YYSTYPE) && ! defined (YYSTYPE_IS_DECLARED) + +typedef union YYSTYPE { + int token; + char *string; + struct symbol *symbol; + struct expr *expr; + struct menu *menu; +} YYSTYPE; +/* Line 191 of yacc.c. */ + +# define yystype YYSTYPE /* obsolescent; will be withdrawn */ +# define YYSTYPE_IS_DECLARED 1 +# define YYSTYPE_IS_TRIVIAL 1 +#endif + + + +/* Copy the second part of user declarations. */ + + +#define LKC_DIRECT_LINK +#include "lkc.h" + + +/* Line 214 of yacc.c. */ + + +#if ! defined (yyoverflow) || YYERROR_VERBOSE + +/* The parser invokes alloca or malloc; define the necessary symbols. */ + +# if YYSTACK_USE_ALLOCA +# define YYSTACK_ALLOC alloca +# else +# ifndef YYSTACK_USE_ALLOCA +# if defined (alloca) || (defined (_ALLOCA_H) && defined (__GNUC__)) +# define YYSTACK_ALLOC alloca +# else +# ifdef __GNUC__ +# define YYSTACK_ALLOC __builtin_alloca +# endif +# endif +# endif +# endif + +# ifdef YYSTACK_ALLOC + /* Pacify GCC's `empty if-body' warning. */ +# define YYSTACK_FREE(Ptr) do { /* empty */; } while (0) +# else +# if defined (__STDC__) || defined (__cplusplus) +# include /* INFRINGES ON USER NAME SPACE */ +# define YYSIZE_T size_t +# endif +# define YYSTACK_ALLOC malloc +# define YYSTACK_FREE free +# endif +#endif /* ! defined (yyoverflow) || YYERROR_VERBOSE */ + + +#if (! defined (yyoverflow) \ + && (! defined (__cplusplus) \ + || (YYSTYPE_IS_TRIVIAL))) + +/* A type that is properly aligned for any stack member. */ +union yyalloc +{ + short yyss; + YYSTYPE yyvs; + }; + +/* The size of the maximum gap between one aligned stack and the next. */ +# define YYSTACK_GAP_MAXIMUM (sizeof (union yyalloc) - 1) + +/* The size of an array large to enough to hold all stacks, each with + N elements. */ +# define YYSTACK_BYTES(N) \ + ((N) * (sizeof (short) + sizeof (YYSTYPE)) \ + + YYSTACK_GAP_MAXIMUM) + +/* Copy COUNT objects from FROM to TO. The source and destination do + not overlap. */ +# ifndef YYCOPY +# if 1 < __GNUC__ +# define YYCOPY(To, From, Count) \ + __builtin_memcpy (To, From, (Count) * sizeof (*(From))) +# else +# define YYCOPY(To, From, Count) \ + do \ + { \ + register YYSIZE_T yyi; \ + for (yyi = 0; yyi < (Count); yyi++) \ + (To)[yyi] = (From)[yyi]; \ + } \ + while (0) +# endif +# endif + +/* Relocate STACK from its old location to the new one. The + local variables YYSIZE and YYSTACKSIZE give the old and new number of + elements in the stack, and YYPTR gives the new location of the + stack. Advance YYPTR to a properly aligned location for the next + stack. */ +# define YYSTACK_RELOCATE(Stack) \ + do \ + { \ + YYSIZE_T yynewbytes; \ + YYCOPY (&yyptr->Stack, Stack, yysize); \ + Stack = &yyptr->Stack; \ + yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \ + yyptr += yynewbytes / sizeof (*yyptr); \ + } \ + while (0) + +#endif + +#if defined (__STDC__) || defined (__cplusplus) + typedef signed char yysigned_char; +#else + typedef short yysigned_char; +#endif + +/* YYFINAL -- State number of the termination state. */ +#define YYFINAL 2 +/* YYLAST -- Last index in YYTABLE. */ +#define YYLAST 201 + +/* YYNTOKENS -- Number of terminals. */ +#define YYNTOKENS 42 +/* YYNNTS -- Number of nonterminals. */ +#define YYNNTS 41 +/* YYNRULES -- Number of rules. */ +#define YYNRULES 104 +/* YYNRULES -- Number of states. */ +#define YYNSTATES 182 + +/* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX. */ +#define YYUNDEFTOK 2 +#define YYMAXUTOK 296 + +#define YYTRANSLATE(YYX) \ + ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK) + +/* YYTRANSLATE[YYLEX] -- Bison symbol number corresponding to YYLEX. */ +static const unsigned char yytranslate[] = +{ + 0, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 1, 2, 3, 4, + 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, + 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, + 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, + 35, 36, 37, 38, 39, 40, 41 +}; + +#if YYDEBUG +/* YYPRHS[YYN] -- Index of the first RHS symbol of rule number YYN in + YYRHS. */ +static const unsigned short yyprhs[] = +{ + 0, 0, 3, 4, 7, 9, 11, 13, 17, 19, + 21, 23, 26, 28, 30, 32, 34, 36, 38, 42, + 45, 49, 52, 53, 56, 59, 62, 65, 69, 74, + 78, 83, 87, 91, 95, 100, 105, 110, 116, 119, + 122, 124, 128, 131, 132, 135, 138, 141, 144, 149, + 153, 157, 160, 165, 166, 169, 173, 175, 179, 182, + 183, 186, 189, 192, 196, 199, 201, 205, 208, 209, + 212, 215, 218, 222, 226, 228, 232, 235, 238, 241, + 242, 245, 248, 253, 257, 261, 262, 265, 267, 269, + 272, 275, 278, 280, 282, 283, 286, 288, 292, 296, + 300, 303, 307, 311, 313 +}; + +/* YYRHS -- A `-1'-separated list of the rules' RHS. */ +static const yysigned_char yyrhs[] = +{ + 43, 0, -1, -1, 43, 44, -1, 45, -1, 55, + -1, 66, -1, 3, 77, 79, -1, 5, -1, 15, + -1, 8, -1, 1, 79, -1, 61, -1, 71, -1, + 47, -1, 49, -1, 69, -1, 79, -1, 10, 28, + 32, -1, 46, 50, -1, 11, 28, 32, -1, 48, + 50, -1, -1, 50, 51, -1, 50, 75, -1, 50, + 73, -1, 50, 32, -1, 21, 76, 32, -1, 22, + 81, 80, 32, -1, 23, 76, 32, -1, 24, 81, + 80, 32, -1, 26, 76, 32, -1, 27, 76, 32, + -1, 25, 76, 32, -1, 19, 77, 80, 32, -1, + 20, 81, 80, 32, -1, 36, 28, 80, 32, -1, + 37, 82, 82, 80, 32, -1, 7, 32, -1, 52, + 56, -1, 78, -1, 53, 58, 54, -1, 53, 58, + -1, -1, 56, 57, -1, 56, 75, -1, 56, 73, + -1, 56, 32, -1, 19, 77, 80, 32, -1, 21, + 76, 32, -1, 23, 76, 32, -1, 18, 32, -1, + 20, 28, 80, 32, -1, -1, 58, 45, -1, 14, + 81, 32, -1, 78, -1, 59, 62, 60, -1, 59, + 62, -1, -1, 62, 45, -1, 62, 66, -1, 62, + 55, -1, 4, 77, 32, -1, 63, 74, -1, 78, + -1, 64, 67, 65, -1, 64, 67, -1, -1, 67, + 45, -1, 67, 66, -1, 67, 55, -1, 67, 1, + 32, -1, 6, 77, 32, -1, 68, -1, 9, 77, + 32, -1, 70, 74, -1, 12, 32, -1, 72, 13, + -1, -1, 74, 75, -1, 74, 32, -1, 16, 35, + 81, 32, -1, 16, 81, 32, -1, 17, 81, 32, + -1, -1, 77, 80, -1, 28, -1, 29, -1, 5, + 79, -1, 8, 79, -1, 15, 79, -1, 32, -1, + 31, -1, -1, 14, 81, -1, 82, -1, 82, 40, + 82, -1, 82, 30, 82, -1, 34, 81, 33, -1, + 41, 81, -1, 81, 38, 81, -1, 81, 39, 81, + -1, 28, -1, 29, -1 +}; + +/* YYRLINE[YYN] -- source line where rule number YYN was defined. */ +static const unsigned short yyrline[] = +{ + 0, 94, 94, 95, 98, 99, 100, 101, 102, 103, + 104, 105, 109, 110, 111, 112, 113, 114, 120, 128, + 134, 142, 152, 154, 155, 156, 157, 160, 166, 173, + 179, 186, 192, 198, 204, 210, 216, 222, 230, 239, + 245, 254, 255, 261, 263, 264, 265, 266, 269, 275, + 281, 287, 293, 299, 301, 306, 315, 324, 325, 331, + 333, 334, 335, 340, 347, 353, 362, 363, 369, 371, + 372, 373, 374, 377, 383, 390, 397, 404, 410, 417, + 418, 419, 422, 427, 432, 440, 442, 447, 448, 451, + 452, 453, 457, 457, 459, 460, 463, 464, 465, 466, + 467, 468, 469, 472, 473 +}; +#endif + +#if YYDEBUG || YYERROR_VERBOSE +/* YYTNME[SYMBOL-NUM] -- String name of the symbol SYMBOL-NUM. + First, the terminals, then, starting at YYNTOKENS, nonterminals. */ +static const char *const yytname[] = +{ + "$end", "error", "$undefined", "T_MAINMENU", "T_MENU", "T_ENDMENU", + "T_SOURCE", "T_CHOICE", "T_ENDCHOICE", "T_COMMENT", "T_CONFIG", + "T_MENUCONFIG", "T_HELP", "T_HELPTEXT", "T_IF", "T_ENDIF", "T_DEPENDS", + "T_REQUIRES", "T_OPTIONAL", "T_PROMPT", "T_DEFAULT", "T_TRISTATE", + "T_DEF_TRISTATE", "T_BOOLEAN", "T_DEF_BOOLEAN", "T_STRING", "T_INT", + "T_HEX", "T_WORD", "T_WORD_QUOTE", "T_UNEQUAL", "T_EOF", "T_EOL", + "T_CLOSE_PAREN", "T_OPEN_PAREN", "T_ON", "T_SELECT", "T_RANGE", "T_OR", + "T_AND", "T_EQUAL", "T_NOT", "$accept", "input", "block", + "common_block", "config_entry_start", "config_stmt", + "menuconfig_entry_start", "menuconfig_stmt", "config_option_list", + "config_option", "choice", "choice_entry", "choice_end", "choice_stmt", + "choice_option_list", "choice_option", "choice_block", "if", "if_end", + "if_stmt", "if_block", "menu", "menu_entry", "menu_end", "menu_stmt", + "menu_block", "source", "source_stmt", "comment", "comment_stmt", + "help_start", "help", "depends_list", "depends", "prompt_stmt_opt", + "prompt", "end", "nl_or_eof", "if_expr", "expr", "symbol", 0 +}; +#endif + +# ifdef YYPRINT +/* YYTOKNUM[YYLEX-NUM] -- Internal token number corresponding to + token YYLEX-NUM. */ +static const unsigned short yytoknum[] = +{ + 0, 256, 257, 258, 259, 260, 261, 262, 263, 264, + 265, 266, 267, 268, 269, 270, 271, 272, 273, 274, + 275, 276, 277, 278, 279, 280, 281, 282, 283, 284, + 285, 286, 287, 288, 289, 290, 291, 292, 293, 294, + 295, 296 +}; +# endif + +/* YYR1[YYN] -- Symbol number of symbol that rule YYN derives. */ +static const unsigned char yyr1[] = +{ + 0, 42, 43, 43, 44, 44, 44, 44, 44, 44, + 44, 44, 45, 45, 45, 45, 45, 45, 46, 47, + 48, 49, 50, 50, 50, 50, 50, 51, 51, 51, + 51, 51, 51, 51, 51, 51, 51, 51, 52, 53, + 54, 55, 55, 56, 56, 56, 56, 56, 57, 57, + 57, 57, 57, 58, 58, 59, 60, 61, 61, 62, + 62, 62, 62, 63, 64, 65, 66, 66, 67, 67, + 67, 67, 67, 68, 69, 70, 71, 72, 73, 74, + 74, 74, 75, 75, 75, 76, 76, 77, 77, 78, + 78, 78, 79, 79, 80, 80, 81, 81, 81, 81, + 81, 81, 81, 82, 82 +}; + +/* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN. */ +static const unsigned char yyr2[] = +{ + 0, 2, 0, 2, 1, 1, 1, 3, 1, 1, + 1, 2, 1, 1, 1, 1, 1, 1, 3, 2, + 3, 2, 0, 2, 2, 2, 2, 3, 4, 3, + 4, 3, 3, 3, 4, 4, 4, 5, 2, 2, + 1, 3, 2, 0, 2, 2, 2, 2, 4, 3, + 3, 2, 4, 0, 2, 3, 1, 3, 2, 0, + 2, 2, 2, 3, 2, 1, 3, 2, 0, 2, + 2, 2, 3, 3, 1, 3, 2, 2, 2, 0, + 2, 2, 4, 3, 3, 0, 2, 1, 1, 2, + 2, 2, 1, 1, 0, 2, 1, 3, 3, 3, + 2, 3, 3, 1, 1 +}; + +/* YYDEFACT[STATE-NAME] -- Default rule to reduce with in state + STATE-NUM when YYTABLE doesn't specify something else to do. Zero + means the default is an error. */ +static const unsigned char yydefact[] = +{ + 2, 0, 1, 0, 0, 0, 8, 0, 0, 10, + 0, 0, 0, 0, 9, 93, 92, 3, 4, 22, + 14, 22, 15, 43, 53, 5, 59, 12, 79, 68, + 6, 74, 16, 79, 13, 17, 11, 87, 88, 0, + 0, 0, 38, 0, 0, 0, 103, 104, 0, 0, + 0, 96, 19, 21, 39, 42, 58, 64, 0, 76, + 7, 63, 73, 75, 18, 20, 0, 100, 55, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 85, 0, + 85, 0, 85, 85, 85, 26, 0, 0, 23, 0, + 25, 24, 0, 0, 0, 85, 85, 47, 44, 46, + 45, 0, 0, 0, 54, 41, 40, 60, 62, 57, + 61, 56, 81, 80, 0, 69, 71, 66, 70, 65, + 99, 101, 102, 98, 97, 77, 0, 0, 0, 94, + 94, 0, 94, 94, 0, 94, 0, 0, 0, 94, + 0, 78, 51, 94, 94, 0, 0, 89, 90, 91, + 72, 0, 83, 84, 0, 0, 0, 27, 86, 0, + 29, 0, 33, 31, 32, 0, 94, 0, 0, 49, + 50, 82, 95, 34, 35, 28, 30, 36, 0, 48, + 52, 37 +}; + +/* YYDEFGOTO[NTERM-NUM]. */ +static const short yydefgoto[] = +{ + -1, 1, 17, 18, 19, 20, 21, 22, 52, 88, + 23, 24, 105, 25, 54, 98, 55, 26, 109, 27, + 56, 28, 29, 117, 30, 58, 31, 32, 33, 34, + 89, 90, 57, 91, 131, 132, 106, 35, 155, 50, + 51 +}; + +/* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing + STATE-NUM. */ +#define YYPACT_NINF -99 +static const short yypact[] = +{ + -99, 48, -99, 38, 46, 46, -99, 46, -29, -99, + 46, -17, -3, -11, -99, -99, -99, -99, -99, -99, + -99, -99, -99, -99, -99, -99, -99, -99, -99, -99, + -99, -99, -99, -99, -99, -99, -99, -99, -99, 38, + 12, 15, -99, 18, 51, 62, -99, -99, -11, -11, + 4, -24, 138, 138, 160, 121, 110, -4, 81, -4, + -99, -99, -99, -99, -99, -99, -19, -99, -99, -11, + -11, 70, 70, 73, 32, -11, 46, -11, 46, -11, + 46, -11, 46, 46, 46, -99, 36, 70, -99, 95, + -99, -99, 96, 46, 106, 46, 46, -99, -99, -99, + -99, 38, 38, 38, -99, -99, -99, -99, -99, -99, + -99, -99, -99, -99, 112, -99, -99, -99, -99, -99, + -99, 117, -99, -99, -99, -99, -11, 33, 65, 131, + 1, 119, 131, 1, 136, 1, 153, 154, 155, 131, + 70, -99, -99, 131, 131, 156, 157, -99, -99, -99, + -99, 101, -99, -99, -11, 158, 159, -99, -99, 161, + -99, 162, -99, -99, -99, 163, 131, 164, 165, -99, + -99, -99, 99, -99, -99, -99, -99, -99, 166, -99, + -99, -99 +}; + +/* YYPGOTO[NTERM-NUM]. */ +static const short yypgoto[] = +{ + -99, -99, -99, 111, -99, -99, -99, -99, 178, -99, + -99, -99, -99, 91, -99, -99, -99, -99, -99, -99, + -99, -99, -99, -99, 115, -99, -99, -99, -99, -99, + -99, 146, 168, 89, 27, 0, 126, -1, -98, -48, + -63 +}; + +/* YYTABLE[YYPACT[STATE-NUM]]. What to do in state STATE-NUM. If + positive, shift that token. If negative, reduce the rule which + number is the opposite. If zero, do what YYDEFACT says. + If YYTABLE_NINF, syntax error. */ +#define YYTABLE_NINF -68 +static const short yytable[] = +{ + 66, 67, 36, 42, 39, 40, 71, 41, 123, 124, + 43, 44, 74, 75, 120, 154, 72, 46, 47, 69, + 70, 121, 122, 48, 140, 45, 127, 128, 112, 130, + 49, 133, 156, 135, 158, 159, 68, 161, 60, 69, + 70, 165, 69, 70, 61, 167, 168, 62, 2, 3, + 63, 4, 5, 6, 7, 8, 9, 10, 11, 12, + 46, 47, 13, 14, 139, 152, 48, 126, 178, 15, + 16, 69, 70, 49, 37, 38, 129, 166, 151, 15, + 16, -67, 114, 64, -67, 5, 101, 7, 8, 102, + 10, 11, 12, 143, 65, 13, 103, 153, 46, 47, + 147, 148, 149, 69, 70, 125, 172, 134, 141, 136, + 137, 138, 15, 16, 5, 101, 7, 8, 102, 10, + 11, 12, 145, 146, 13, 103, 101, 7, 142, 102, + 10, 11, 12, 171, 144, 13, 103, 69, 70, 69, + 70, 15, 16, 100, 150, 154, 113, 108, 113, 116, + 73, 157, 15, 16, 74, 75, 70, 76, 77, 78, + 79, 80, 81, 82, 83, 84, 104, 107, 160, 115, + 85, 110, 73, 118, 86, 87, 74, 75, 92, 93, + 94, 95, 111, 96, 119, 162, 163, 164, 169, 170, + 173, 174, 97, 175, 176, 177, 179, 180, 181, 53, + 99, 59 +}; + +static const unsigned char yycheck[] = +{ + 48, 49, 3, 32, 4, 5, 30, 7, 71, 72, + 10, 28, 16, 17, 33, 14, 40, 28, 29, 38, + 39, 69, 70, 34, 87, 28, 74, 75, 32, 77, + 41, 79, 130, 81, 132, 133, 32, 135, 39, 38, + 39, 139, 38, 39, 32, 143, 144, 32, 0, 1, + 32, 3, 4, 5, 6, 7, 8, 9, 10, 11, + 28, 29, 14, 15, 28, 32, 34, 35, 166, 31, + 32, 38, 39, 41, 28, 29, 76, 140, 126, 31, + 32, 0, 1, 32, 3, 4, 5, 6, 7, 8, + 9, 10, 11, 93, 32, 14, 15, 32, 28, 29, + 101, 102, 103, 38, 39, 32, 154, 80, 13, 82, + 83, 84, 31, 32, 4, 5, 6, 7, 8, 9, + 10, 11, 95, 96, 14, 15, 5, 6, 32, 8, + 9, 10, 11, 32, 28, 14, 15, 38, 39, 38, + 39, 31, 32, 54, 32, 14, 57, 56, 59, 58, + 12, 32, 31, 32, 16, 17, 39, 19, 20, 21, + 22, 23, 24, 25, 26, 27, 55, 56, 32, 58, + 32, 56, 12, 58, 36, 37, 16, 17, 18, 19, + 20, 21, 56, 23, 58, 32, 32, 32, 32, 32, + 32, 32, 32, 32, 32, 32, 32, 32, 32, 21, + 54, 33 +}; + +/* YYSTOS[STATE-NUM] -- The (internal number of the) accessing + symbol of state STATE-NUM. */ +static const unsigned char yystos[] = +{ + 0, 43, 0, 1, 3, 4, 5, 6, 7, 8, + 9, 10, 11, 14, 15, 31, 32, 44, 45, 46, + 47, 48, 49, 52, 53, 55, 59, 61, 63, 64, + 66, 68, 69, 70, 71, 79, 79, 28, 29, 77, + 77, 77, 32, 77, 28, 28, 28, 29, 34, 41, + 81, 82, 50, 50, 56, 58, 62, 74, 67, 74, + 79, 32, 32, 32, 32, 32, 81, 81, 32, 38, + 39, 30, 40, 12, 16, 17, 19, 20, 21, 22, + 23, 24, 25, 26, 27, 32, 36, 37, 51, 72, + 73, 75, 18, 19, 20, 21, 23, 32, 57, 73, + 75, 5, 8, 15, 45, 54, 78, 45, 55, 60, + 66, 78, 32, 75, 1, 45, 55, 65, 66, 78, + 33, 81, 81, 82, 82, 32, 35, 81, 81, 77, + 81, 76, 77, 81, 76, 81, 76, 76, 76, 28, + 82, 13, 32, 77, 28, 76, 76, 79, 79, 79, + 32, 81, 32, 32, 14, 80, 80, 32, 80, 80, + 32, 80, 32, 32, 32, 80, 82, 80, 80, 32, + 32, 32, 81, 32, 32, 32, 32, 32, 80, 32, + 32, 32 +}; + +#if ! defined (YYSIZE_T) && defined (__SIZE_TYPE__) +# define YYSIZE_T __SIZE_TYPE__ +#endif +#if ! defined (YYSIZE_T) && defined (size_t) +# define YYSIZE_T size_t +#endif +#if ! defined (YYSIZE_T) +# if defined (__STDC__) || defined (__cplusplus) +# include /* INFRINGES ON USER NAME SPACE */ +# define YYSIZE_T size_t +# endif +#endif +#if ! defined (YYSIZE_T) +# define YYSIZE_T unsigned int +#endif + +#define yyerrok (yyerrstatus = 0) +#define yyclearin (yychar = YYEMPTY) +#define YYEMPTY (-2) +#define YYEOF 0 + +#define YYACCEPT goto yyacceptlab +#define YYABORT goto yyabortlab +#define YYERROR goto yyerrlab1 + + +/* Like YYERROR except do call yyerror. This remains here temporarily + to ease the transition to the new meaning of YYERROR, for GCC. + Once GCC version 2 has supplanted version 1, this can go. */ + +#define YYFAIL goto yyerrlab + +#define YYRECOVERING() (!!yyerrstatus) + +#define YYBACKUP(Token, Value) \ +do \ + if (yychar == YYEMPTY && yylen == 1) \ + { \ + yychar = (Token); \ + yylval = (Value); \ + yytoken = YYTRANSLATE (yychar); \ + YYPOPSTACK; \ + goto yybackup; \ + } \ + else \ + { \ + yyerror ("syntax error: cannot back up");\ + YYERROR; \ + } \ +while (0) + +#define YYTERROR 1 +#define YYERRCODE 256 + +/* YYLLOC_DEFAULT -- Compute the default location (before the actions + are run). */ + +#ifndef YYLLOC_DEFAULT +# define YYLLOC_DEFAULT(Current, Rhs, N) \ + Current.first_line = Rhs[1].first_line; \ + Current.first_column = Rhs[1].first_column; \ + Current.last_line = Rhs[N].last_line; \ + Current.last_column = Rhs[N].last_column; +#endif + +/* YYLEX -- calling `yylex' with the right arguments. */ + +#ifdef YYLEX_PARAM +# define YYLEX yylex (YYLEX_PARAM) +#else +# define YYLEX yylex () +#endif + +/* Enable debugging if requested. */ +#if YYDEBUG + +# ifndef YYFPRINTF +# include /* INFRINGES ON USER NAME SPACE */ +# define YYFPRINTF fprintf +# endif + +# define YYDPRINTF(Args) \ +do { \ + if (yydebug) \ + YYFPRINTF Args; \ +} while (0) + +# define YYDSYMPRINT(Args) \ +do { \ + if (yydebug) \ + yysymprint Args; \ +} while (0) + +# define YYDSYMPRINTF(Title, Token, Value, Location) \ +do { \ + if (yydebug) \ + { \ + YYFPRINTF (stderr, "%s ", Title); \ + yysymprint (stderr, \ + Token, Value); \ + YYFPRINTF (stderr, "\n"); \ + } \ +} while (0) + +/*------------------------------------------------------------------. +| yy_stack_print -- Print the state stack from its BOTTOM up to its | +| TOP (cinluded). | +`------------------------------------------------------------------*/ + +#if defined (__STDC__) || defined (__cplusplus) +static void +yy_stack_print (short *bottom, short *top) +#else +static void +yy_stack_print (bottom, top) + short *bottom; + short *top; +#endif +{ + YYFPRINTF (stderr, "Stack now"); + for (/* Nothing. */; bottom <= top; ++bottom) + YYFPRINTF (stderr, " %d", *bottom); + YYFPRINTF (stderr, "\n"); +} + +# define YY_STACK_PRINT(Bottom, Top) \ +do { \ + if (yydebug) \ + yy_stack_print ((Bottom), (Top)); \ +} while (0) + + +/*------------------------------------------------. +| Report that the YYRULE is going to be reduced. | +`------------------------------------------------*/ + +#if defined (__STDC__) || defined (__cplusplus) +static void +yy_reduce_print (int yyrule) +#else +static void +yy_reduce_print (yyrule) + int yyrule; +#endif +{ + int yyi; + unsigned int yylineno = yyrline[yyrule]; + YYFPRINTF (stderr, "Reducing stack by rule %d (line %u), ", + yyrule - 1, yylineno); + /* Print the symbols being reduced, and their result. */ + for (yyi = yyprhs[yyrule]; 0 <= yyrhs[yyi]; yyi++) + YYFPRINTF (stderr, "%s ", yytname [yyrhs[yyi]]); + YYFPRINTF (stderr, "-> %s\n", yytname [yyr1[yyrule]]); +} + +# define YY_REDUCE_PRINT(Rule) \ +do { \ + if (yydebug) \ + yy_reduce_print (Rule); \ +} while (0) + +/* Nonzero means print parse trace. It is left uninitialized so that + multiple parsers can coexist. */ +int yydebug; +#else /* !YYDEBUG */ +# define YYDPRINTF(Args) +# define YYDSYMPRINT(Args) +# define YYDSYMPRINTF(Title, Token, Value, Location) +# define YY_STACK_PRINT(Bottom, Top) +# define YY_REDUCE_PRINT(Rule) +#endif /* !YYDEBUG */ + + +/* YYINITDEPTH -- initial size of the parser's stacks. */ +#ifndef YYINITDEPTH +# define YYINITDEPTH 200 +#endif + +/* YYMAXDEPTH -- maximum size the stacks can grow to (effective only + if the built-in stack extension method is used). + + Do not make this value too large; the results are undefined if + SIZE_MAX < YYSTACK_BYTES (YYMAXDEPTH) + evaluated with infinite-precision integer arithmetic. */ + +#if YYMAXDEPTH == 0 +# undef YYMAXDEPTH +#endif + +#ifndef YYMAXDEPTH +# define YYMAXDEPTH 10000 +#endif + + + +#if YYERROR_VERBOSE + +# ifndef yystrlen +# if defined (__GLIBC__) && defined (_STRING_H) +# define yystrlen strlen +# else +/* Return the length of YYSTR. */ +static YYSIZE_T +# if defined (__STDC__) || defined (__cplusplus) +yystrlen (const char *yystr) +# else +yystrlen (yystr) + const char *yystr; +# endif +{ + register const char *yys = yystr; + + while (*yys++ != '\0') + continue; + + return yys - yystr - 1; +} +# endif +# endif + +# ifndef yystpcpy +# if defined (__GLIBC__) && defined (_STRING_H) && defined (_GNU_SOURCE) +# define yystpcpy stpcpy +# else +/* Copy YYSRC to YYDEST, returning the address of the terminating '\0' in + YYDEST. */ +static char * +# if defined (__STDC__) || defined (__cplusplus) +yystpcpy (char *yydest, const char *yysrc) +# else +yystpcpy (yydest, yysrc) + char *yydest; + const char *yysrc; +# endif +{ + register char *yyd = yydest; + register const char *yys = yysrc; + + while ((*yyd++ = *yys++) != '\0') + continue; + + return yyd - 1; +} +# endif +# endif + +#endif /* !YYERROR_VERBOSE */ + + + +#if YYDEBUG +/*--------------------------------. +| Print this symbol on YYOUTPUT. | +`--------------------------------*/ + +#if defined (__STDC__) || defined (__cplusplus) +static void +yysymprint (FILE *yyoutput, int yytype, YYSTYPE *yyvaluep) +#else +static void +yysymprint (yyoutput, yytype, yyvaluep) + FILE *yyoutput; + int yytype; + YYSTYPE *yyvaluep; +#endif +{ + /* Pacify ``unused variable'' warnings. */ + (void) yyvaluep; + + if (yytype < YYNTOKENS) + { + YYFPRINTF (yyoutput, "token %s (", yytname[yytype]); +# ifdef YYPRINT + YYPRINT (yyoutput, yytoknum[yytype], *yyvaluep); +# endif + } + else + YYFPRINTF (yyoutput, "nterm %s (", yytname[yytype]); + + switch (yytype) + { + default: + break; + } + YYFPRINTF (yyoutput, ")"); +} + +#endif /* ! YYDEBUG */ +/*-----------------------------------------------. +| Release the memory associated to this symbol. | +`-----------------------------------------------*/ + +#if defined (__STDC__) || defined (__cplusplus) +static void +yydestruct (int yytype, YYSTYPE *yyvaluep) +#else +static void +yydestruct (yytype, yyvaluep) + int yytype; + YYSTYPE *yyvaluep; +#endif +{ + /* Pacify ``unused variable'' warnings. */ + (void) yyvaluep; + + switch (yytype) + { + + default: + break; + } +} + + +/* Prevent warnings from -Wmissing-prototypes. */ + +#ifdef YYPARSE_PARAM +# if defined (__STDC__) || defined (__cplusplus) +int yyparse (void *YYPARSE_PARAM); +# else +int yyparse (); +# endif +#else /* ! YYPARSE_PARAM */ +#if defined (__STDC__) || defined (__cplusplus) +int yyparse (void); +#else +int yyparse (); +#endif +#endif /* ! YYPARSE_PARAM */ + + + +/* The lookahead symbol. */ +int yychar; + +/* The semantic value of the lookahead symbol. */ +YYSTYPE yylval; + +/* Number of syntax errors so far. */ +int yynerrs; + + + +/*----------. +| yyparse. | +`----------*/ + +#ifdef YYPARSE_PARAM +# if defined (__STDC__) || defined (__cplusplus) +int yyparse (void *YYPARSE_PARAM) +# else +int yyparse (YYPARSE_PARAM) + void *YYPARSE_PARAM; +# endif +#else /* ! YYPARSE_PARAM */ +#if defined (__STDC__) || defined (__cplusplus) +int +yyparse (void) +#else +int +yyparse () + +#endif +#endif +{ + + register int yystate; + register int yyn; + int yyresult; + /* Number of tokens to shift before error messages enabled. */ + int yyerrstatus; + /* Lookahead token as an internal (translated) token number. */ + int yytoken = 0; + + /* Three stacks and their tools: + `yyss': related to states, + `yyvs': related to semantic values, + `yyls': related to locations. + + Refer to the stacks thru separate pointers, to allow yyoverflow + to reallocate them elsewhere. */ + + /* The state stack. */ + short yyssa[YYINITDEPTH]; + short *yyss = yyssa; + register short *yyssp; + + /* The semantic value stack. */ + YYSTYPE yyvsa[YYINITDEPTH]; + YYSTYPE *yyvs = yyvsa; + register YYSTYPE *yyvsp; + + + +#define YYPOPSTACK (yyvsp--, yyssp--) + + YYSIZE_T yystacksize = YYINITDEPTH; + + /* The variables used to return semantic value and location from the + action routines. */ + YYSTYPE yyval; + + + /* When reducing, the number of symbols on the RHS of the reduced + rule. */ + int yylen; + + YYDPRINTF ((stderr, "Starting parse\n")); + + yystate = 0; + yyerrstatus = 0; + yynerrs = 0; + yychar = YYEMPTY; /* Cause a token to be read. */ + + /* Initialize stack pointers. + Waste one element of value and location stack + so that they stay on the same level as the state stack. + The wasted elements are never initialized. */ + + yyssp = yyss; + yyvsp = yyvs; + + goto yysetstate; + +/*------------------------------------------------------------. +| yynewstate -- Push a new state, which is found in yystate. | +`------------------------------------------------------------*/ + yynewstate: + /* In all cases, when you get here, the value and location stacks + have just been pushed. so pushing a state here evens the stacks. + */ + yyssp++; + + yysetstate: + *yyssp = yystate; + + if (yyss + yystacksize - 1 <= yyssp) + { + /* Get the current used size of the three stacks, in elements. */ + YYSIZE_T yysize = yyssp - yyss + 1; + +#ifdef yyoverflow + { + /* Give user a chance to reallocate the stack. Use copies of + these so that the &'s don't force the real ones into + memory. */ + YYSTYPE *yyvs1 = yyvs; + short *yyss1 = yyss; + + + /* Each stack pointer address is followed by the size of the + data in use in that stack, in bytes. This used to be a + conditional around just the two extra args, but that might + be undefined if yyoverflow is a macro. */ + yyoverflow ("parser stack overflow", + &yyss1, yysize * sizeof (*yyssp), + &yyvs1, yysize * sizeof (*yyvsp), + + &yystacksize); + + yyss = yyss1; + yyvs = yyvs1; + } +#else /* no yyoverflow */ +# ifndef YYSTACK_RELOCATE + goto yyoverflowlab; +# else + /* Extend the stack our own way. */ + if (YYMAXDEPTH <= yystacksize) + goto yyoverflowlab; + yystacksize *= 2; + if (YYMAXDEPTH < yystacksize) + yystacksize = YYMAXDEPTH; + + { + short *yyss1 = yyss; + union yyalloc *yyptr = + (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize)); + if (! yyptr) + goto yyoverflowlab; + YYSTACK_RELOCATE (yyss); + YYSTACK_RELOCATE (yyvs); + +# undef YYSTACK_RELOCATE + if (yyss1 != yyssa) + YYSTACK_FREE (yyss1); + } +# endif +#endif /* no yyoverflow */ + + yyssp = yyss + yysize - 1; + yyvsp = yyvs + yysize - 1; + + + YYDPRINTF ((stderr, "Stack size increased to %lu\n", + (unsigned long int) yystacksize)); + + if (yyss + yystacksize - 1 <= yyssp) + YYABORT; + } + + YYDPRINTF ((stderr, "Entering state %d\n", yystate)); + + goto yybackup; + +/*-----------. +| yybackup. | +`-----------*/ +yybackup: + +/* Do appropriate processing given the current state. */ +/* Read a lookahead token if we need one and don't already have one. */ +/* yyresume: */ + + /* First try to decide what to do without reference to lookahead token. */ + + yyn = yypact[yystate]; + if (yyn == YYPACT_NINF) + goto yydefault; + + /* Not known => get a lookahead token if don't already have one. */ + + /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol. */ + if (yychar == YYEMPTY) + { + YYDPRINTF ((stderr, "Reading a token: ")); + yychar = YYLEX; + } + + if (yychar <= YYEOF) + { + yychar = yytoken = YYEOF; + YYDPRINTF ((stderr, "Now at end of input.\n")); + } + else + { + yytoken = YYTRANSLATE (yychar); + YYDSYMPRINTF ("Next token is", yytoken, &yylval, &yylloc); + } + + /* If the proper action on seeing token YYTOKEN is to reduce or to + detect an error, take that action. */ + yyn += yytoken; + if (yyn < 0 || YYLAST < yyn || yycheck[yyn] != yytoken) + goto yydefault; + yyn = yytable[yyn]; + if (yyn <= 0) + { + if (yyn == 0 || yyn == YYTABLE_NINF) + goto yyerrlab; + yyn = -yyn; + goto yyreduce; + } + + if (yyn == YYFINAL) + YYACCEPT; + + /* Shift the lookahead token. */ + YYDPRINTF ((stderr, "Shifting token %s, ", yytname[yytoken])); + + /* Discard the token being shifted unless it is eof. */ + if (yychar != YYEOF) + yychar = YYEMPTY; + + *++yyvsp = yylval; + + + /* Count tokens shifted since error; after three, turn off error + status. */ + if (yyerrstatus) + yyerrstatus--; + + yystate = yyn; + goto yynewstate; + + +/*-----------------------------------------------------------. +| yydefault -- do the default action for the current state. | +`-----------------------------------------------------------*/ +yydefault: + yyn = yydefact[yystate]; + if (yyn == 0) + goto yyerrlab; + goto yyreduce; + + +/*-----------------------------. +| yyreduce -- Do a reduction. | +`-----------------------------*/ +yyreduce: + /* yyn is the number of a rule to reduce with. */ + yylen = yyr2[yyn]; + + /* If YYLEN is nonzero, implement the default value of the action: + `$$ = $1'. + + Otherwise, the following line sets YYVAL to garbage. + This behavior is undocumented and Bison + users should not rely upon it. Assigning to YYVAL + unconditionally makes the parser a bit smaller, and it avoids a + GCC warning that YYVAL may be used uninitialized. */ + yyval = yyvsp[1-yylen]; + + + YY_REDUCE_PRINT (yyn); + switch (yyn) + { + case 8: + + { zconfprint("unexpected 'endmenu' statement"); ;} + break; + + case 9: + + { zconfprint("unexpected 'endif' statement"); ;} + break; + + case 10: + + { zconfprint("unexpected 'endchoice' statement"); ;} + break; + + case 11: + + { zconfprint("syntax error"); yyerrok; ;} + break; + + case 18: + + { + struct symbol *sym = sym_lookup(yyvsp[-1].string, 0); + sym->flags |= SYMBOL_OPTIONAL; + menu_add_entry(sym); + printd(DEBUG_PARSE, "%s:%d:config %s\n", zconf_curname(), zconf_lineno(), yyvsp[-1].string); +;} + break; + + case 19: + + { + menu_end_entry(); + printd(DEBUG_PARSE, "%s:%d:endconfig\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 20: + + { + struct symbol *sym = sym_lookup(yyvsp[-1].string, 0); + sym->flags |= SYMBOL_OPTIONAL; + menu_add_entry(sym); + printd(DEBUG_PARSE, "%s:%d:menuconfig %s\n", zconf_curname(), zconf_lineno(), yyvsp[-1].string); +;} + break; + + case 21: + + { + if (current_entry->prompt) + current_entry->prompt->type = P_MENU; + else + zconfprint("warning: menuconfig statement without prompt"); + menu_end_entry(); + printd(DEBUG_PARSE, "%s:%d:endconfig\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 27: + + { + menu_set_type(S_TRISTATE); + printd(DEBUG_PARSE, "%s:%d:tristate\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 28: + + { + menu_add_expr(P_DEFAULT, yyvsp[-2].expr, yyvsp[-1].expr); + menu_set_type(S_TRISTATE); + printd(DEBUG_PARSE, "%s:%d:def_boolean\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 29: + + { + menu_set_type(S_BOOLEAN); + printd(DEBUG_PARSE, "%s:%d:boolean\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 30: + + { + menu_add_expr(P_DEFAULT, yyvsp[-2].expr, yyvsp[-1].expr); + menu_set_type(S_BOOLEAN); + printd(DEBUG_PARSE, "%s:%d:def_boolean\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 31: + + { + menu_set_type(S_INT); + printd(DEBUG_PARSE, "%s:%d:int\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 32: + + { + menu_set_type(S_HEX); + printd(DEBUG_PARSE, "%s:%d:hex\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 33: + + { + menu_set_type(S_STRING); + printd(DEBUG_PARSE, "%s:%d:string\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 34: + + { + menu_add_prompt(P_PROMPT, yyvsp[-2].string, yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:prompt\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 35: + + { + menu_add_expr(P_DEFAULT, yyvsp[-2].expr, yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:default\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 36: + + { + menu_add_symbol(P_SELECT, sym_lookup(yyvsp[-2].string, 0), yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:select\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 37: + + { + menu_add_expr(P_RANGE, expr_alloc_comp(E_RANGE,yyvsp[-3].symbol, yyvsp[-2].symbol), yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:range\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 38: + + { + struct symbol *sym = sym_lookup(NULL, 0); + sym->flags |= SYMBOL_CHOICE; + menu_add_entry(sym); + menu_add_expr(P_CHOICE, NULL, NULL); + printd(DEBUG_PARSE, "%s:%d:choice\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 39: + + { + menu_end_entry(); + menu_add_menu(); +;} + break; + + case 40: + + { + if (zconf_endtoken(yyvsp[0].token, T_CHOICE, T_ENDCHOICE)) { + menu_end_menu(); + printd(DEBUG_PARSE, "%s:%d:endchoice\n", zconf_curname(), zconf_lineno()); + } +;} + break; + + case 42: + + { + printf("%s:%d: missing 'endchoice' for this 'choice' statement\n", current_menu->file->name, current_menu->lineno); + zconfnerrs++; +;} + break; + + case 48: + + { + menu_add_prompt(P_PROMPT, yyvsp[-2].string, yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:prompt\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 49: + + { + menu_set_type(S_TRISTATE); + printd(DEBUG_PARSE, "%s:%d:tristate\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 50: + + { + menu_set_type(S_BOOLEAN); + printd(DEBUG_PARSE, "%s:%d:boolean\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 51: + + { + current_entry->sym->flags |= SYMBOL_OPTIONAL; + printd(DEBUG_PARSE, "%s:%d:optional\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 52: + + { + menu_add_symbol(P_DEFAULT, sym_lookup(yyvsp[-2].string, 0), yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:default\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 55: + + { + printd(DEBUG_PARSE, "%s:%d:if\n", zconf_curname(), zconf_lineno()); + menu_add_entry(NULL); + menu_add_dep(yyvsp[-1].expr); + menu_end_entry(); + menu_add_menu(); +;} + break; + + case 56: + + { + if (zconf_endtoken(yyvsp[0].token, T_IF, T_ENDIF)) { + menu_end_menu(); + printd(DEBUG_PARSE, "%s:%d:endif\n", zconf_curname(), zconf_lineno()); + } +;} + break; + + case 58: + + { + printf("%s:%d: missing 'endif' for this 'if' statement\n", current_menu->file->name, current_menu->lineno); + zconfnerrs++; +;} + break; + + case 63: + + { + menu_add_entry(NULL); + menu_add_prop(P_MENU, yyvsp[-1].string, NULL, NULL); + printd(DEBUG_PARSE, "%s:%d:menu\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 64: + + { + menu_end_entry(); + menu_add_menu(); +;} + break; + + case 65: + + { + if (zconf_endtoken(yyvsp[0].token, T_MENU, T_ENDMENU)) { + menu_end_menu(); + printd(DEBUG_PARSE, "%s:%d:endmenu\n", zconf_curname(), zconf_lineno()); + } +;} + break; + + case 67: + + { + printf("%s:%d: missing 'endmenu' for this 'menu' statement\n", current_menu->file->name, current_menu->lineno); + zconfnerrs++; +;} + break; + + case 72: + + { zconfprint("invalid menu option"); yyerrok; ;} + break; + + case 73: + + { + yyval.string = yyvsp[-1].string; + printd(DEBUG_PARSE, "%s:%d:source %s\n", zconf_curname(), zconf_lineno(), yyvsp[-1].string); +;} + break; + + case 74: + + { + zconf_nextfile(yyvsp[0].string); +;} + break; + + case 75: + + { + menu_add_entry(NULL); + menu_add_prop(P_COMMENT, yyvsp[-1].string, NULL, NULL); + printd(DEBUG_PARSE, "%s:%d:comment\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 76: + + { + menu_end_entry(); +;} + break; + + case 77: + + { + printd(DEBUG_PARSE, "%s:%d:help\n", zconf_curname(), zconf_lineno()); + zconf_starthelp(); +;} + break; + + case 78: + + { + current_entry->sym->help = yyvsp[0].string; +;} + break; + + case 82: + + { + menu_add_dep(yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:depends on\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 83: + + { + menu_add_dep(yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:depends\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 84: + + { + menu_add_dep(yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:requires\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 86: + + { + menu_add_prop(P_PROMPT, yyvsp[-1].string, NULL, yyvsp[0].expr); +;} + break; + + case 89: + + { yyval.token = T_ENDMENU; ;} + break; + + case 90: + + { yyval.token = T_ENDCHOICE; ;} + break; + + case 91: + + { yyval.token = T_ENDIF; ;} + break; + + case 94: + + { yyval.expr = NULL; ;} + break; + + case 95: + + { yyval.expr = yyvsp[0].expr; ;} + break; + + case 96: + + { yyval.expr = expr_alloc_symbol(yyvsp[0].symbol); ;} + break; + + case 97: + + { yyval.expr = expr_alloc_comp(E_EQUAL, yyvsp[-2].symbol, yyvsp[0].symbol); ;} + break; + + case 98: + + { yyval.expr = expr_alloc_comp(E_UNEQUAL, yyvsp[-2].symbol, yyvsp[0].symbol); ;} + break; + + case 99: + + { yyval.expr = yyvsp[-1].expr; ;} + break; + + case 100: + + { yyval.expr = expr_alloc_one(E_NOT, yyvsp[0].expr); ;} + break; + + case 101: + + { yyval.expr = expr_alloc_two(E_OR, yyvsp[-2].expr, yyvsp[0].expr); ;} + break; + + case 102: + + { yyval.expr = expr_alloc_two(E_AND, yyvsp[-2].expr, yyvsp[0].expr); ;} + break; + + case 103: + + { yyval.symbol = sym_lookup(yyvsp[0].string, 0); free(yyvsp[0].string); ;} + break; + + case 104: + + { yyval.symbol = sym_lookup(yyvsp[0].string, 1); free(yyvsp[0].string); ;} + break; + + + } + +/* Line 999 of yacc.c. */ + + + yyvsp -= yylen; + yyssp -= yylen; + + + YY_STACK_PRINT (yyss, yyssp); + + *++yyvsp = yyval; + + + /* Now `shift' the result of the reduction. Determine what state + that goes to, based on the state we popped back to and the rule + number reduced by. */ + + yyn = yyr1[yyn]; + + yystate = yypgoto[yyn - YYNTOKENS] + *yyssp; + if (0 <= yystate && yystate <= YYLAST && yycheck[yystate] == *yyssp) + yystate = yytable[yystate]; + else + yystate = yydefgoto[yyn - YYNTOKENS]; + + goto yynewstate; + + +/*------------------------------------. +| yyerrlab -- here on detecting error | +`------------------------------------*/ +yyerrlab: + /* If not already recovering from an error, report this error. */ + if (!yyerrstatus) + { + ++yynerrs; +#if YYERROR_VERBOSE + yyn = yypact[yystate]; + + if (YYPACT_NINF < yyn && yyn < YYLAST) + { + YYSIZE_T yysize = 0; + int yytype = YYTRANSLATE (yychar); + char *yymsg; + int yyx, yycount; + + yycount = 0; + /* Start YYX at -YYN if negative to avoid negative indexes in + YYCHECK. */ + for (yyx = yyn < 0 ? -yyn : 0; + yyx < (int) (sizeof (yytname) / sizeof (char *)); yyx++) + if (yycheck[yyx + yyn] == yyx && yyx != YYTERROR) + yysize += yystrlen (yytname[yyx]) + 15, yycount++; + yysize += yystrlen ("syntax error, unexpected ") + 1; + yysize += yystrlen (yytname[yytype]); + yymsg = (char *) YYSTACK_ALLOC (yysize); + if (yymsg != 0) + { + char *yyp = yystpcpy (yymsg, "syntax error, unexpected "); + yyp = yystpcpy (yyp, yytname[yytype]); + + if (yycount < 5) + { + yycount = 0; + for (yyx = yyn < 0 ? -yyn : 0; + yyx < (int) (sizeof (yytname) / sizeof (char *)); + yyx++) + if (yycheck[yyx + yyn] == yyx && yyx != YYTERROR) + { + const char *yyq = ! yycount ? ", expecting " : " or "; + yyp = yystpcpy (yyp, yyq); + yyp = yystpcpy (yyp, yytname[yyx]); + yycount++; + } + } + yyerror (yymsg); + YYSTACK_FREE (yymsg); + } + else + yyerror ("syntax error; also virtual memory exhausted"); + } + else +#endif /* YYERROR_VERBOSE */ + yyerror ("syntax error"); + } + + + + if (yyerrstatus == 3) + { + /* If just tried and failed to reuse lookahead token after an + error, discard it. */ + + /* Return failure if at end of input. */ + if (yychar == YYEOF) + { + /* Pop the error token. */ + YYPOPSTACK; + /* Pop the rest of the stack. */ + while (yyss < yyssp) + { + YYDSYMPRINTF ("Error: popping", yystos[*yyssp], yyvsp, yylsp); + yydestruct (yystos[*yyssp], yyvsp); + YYPOPSTACK; + } + YYABORT; + } + + YYDSYMPRINTF ("Error: discarding", yytoken, &yylval, &yylloc); + yydestruct (yytoken, &yylval); + yychar = YYEMPTY; + + } + + /* Else will try to reuse lookahead token after shifting the error + token. */ + goto yyerrlab1; + + +/*----------------------------------------------------. +| yyerrlab1 -- error raised explicitly by an action. | +`----------------------------------------------------*/ +yyerrlab1: + yyerrstatus = 3; /* Each real token shifted decrements this. */ + + for (;;) + { + yyn = yypact[yystate]; + if (yyn != YYPACT_NINF) + { + yyn += YYTERROR; + if (0 <= yyn && yyn <= YYLAST && yycheck[yyn] == YYTERROR) + { + yyn = yytable[yyn]; + if (0 < yyn) + break; + } + } + + /* Pop the current state because it cannot handle the error token. */ + if (yyssp == yyss) + YYABORT; + + YYDSYMPRINTF ("Error: popping", yystos[*yyssp], yyvsp, yylsp); + yydestruct (yystos[yystate], yyvsp); + yyvsp--; + yystate = *--yyssp; + + YY_STACK_PRINT (yyss, yyssp); + } + + if (yyn == YYFINAL) + YYACCEPT; + + YYDPRINTF ((stderr, "Shifting error token, ")); + + *++yyvsp = yylval; + + + yystate = yyn; + goto yynewstate; + + +/*-------------------------------------. +| yyacceptlab -- YYACCEPT comes here. | +`-------------------------------------*/ +yyacceptlab: + yyresult = 0; + goto yyreturn; + +/*-----------------------------------. +| yyabortlab -- YYABORT comes here. | +`-----------------------------------*/ +yyabortlab: + yyresult = 1; + goto yyreturn; + +#ifndef yyoverflow +/*----------------------------------------------. +| yyoverflowlab -- parser overflow comes here. | +`----------------------------------------------*/ +yyoverflowlab: + yyerror ("parser stack overflow"); + yyresult = 2; + /* Fall through. */ +#endif + +yyreturn: +#ifndef yyoverflow + if (yyss != yyssa) + YYSTACK_FREE (yyss); +#endif + return yyresult; +} + + + + + +void conf_parse(const char *name) +{ + struct symbol *sym; + int i; + + zconf_initscan(name); + + sym_init(); + menu_init(); + modules_sym = sym_lookup("MODULES", 0); + rootmenu.prompt = menu_add_prop(P_MENU, "axTLS Configuration", NULL, NULL); + + //zconfdebug = 1; + zconfparse(); + if (zconfnerrs) + exit(1); + menu_finalize(&rootmenu); + for_all_symbols(i, sym) { + if (!(sym->flags & SYMBOL_CHECKED) && sym_check_deps(sym)) + printf("\n"); + else + sym->flags |= SYMBOL_CHECK_DONE; + } + + sym_change_count = 1; +} + +const char *zconf_tokenname(int token) +{ + switch (token) { + case T_MENU: return "menu"; + case T_ENDMENU: return "endmenu"; + case T_CHOICE: return "choice"; + case T_ENDCHOICE: return "endchoice"; + case T_IF: return "if"; + case T_ENDIF: return "endif"; + } + return ""; +} + +static bool zconf_endtoken(int token, int starttoken, int endtoken) +{ + if (token != endtoken) { + zconfprint("unexpected '%s' within %s block", zconf_tokenname(token), zconf_tokenname(starttoken)); + zconfnerrs++; + return false; + } + if (current_menu->file != current_file) { + zconfprint("'%s' in different file than '%s'", zconf_tokenname(token), zconf_tokenname(starttoken)); + zconfprint("location of the '%s'", zconf_tokenname(starttoken)); + zconfnerrs++; + return false; + } + return true; +} + +static void zconfprint(const char *err, ...) +{ + va_list ap; + + fprintf(stderr, "%s:%d: ", zconf_curname(), zconf_lineno() + 1); + va_start(ap, err); + vfprintf(stderr, err, ap); + va_end(ap); + fprintf(stderr, "\n"); +} + +static void zconferror(const char *err) +{ + fprintf(stderr, "%s:%d: %s\n", zconf_curname(), zconf_lineno() + 1, err); +} + +void print_quoted_string(FILE *out, const char *str) +{ + const char *p; + int len; + + putc('"', out); + while ((p = strchr(str, '"'))) { + len = p - str; + if (len) + fprintf(out, "%.*s", len, str); + fputs("\\\"", out); + str = p + 1; + } + fputs(str, out); + putc('"', out); +} + +void print_symbol(FILE *out, struct menu *menu) +{ + struct symbol *sym = menu->sym; + struct property *prop; + + if (sym_is_choice(sym)) + fprintf(out, "choice\n"); + else + fprintf(out, "config %s\n", sym->name); + switch (sym->type) { + case S_BOOLEAN: + fputs(" boolean\n", out); + break; + case S_TRISTATE: + fputs(" tristate\n", out); + break; + case S_STRING: + fputs(" string\n", out); + break; + case S_INT: + fputs(" integer\n", out); + break; + case S_HEX: + fputs(" hex\n", out); + break; + default: + fputs(" ???\n", out); + break; + } + for (prop = sym->prop; prop; prop = prop->next) { + if (prop->menu != menu) + continue; + switch (prop->type) { + case P_PROMPT: + fputs(" prompt ", out); + print_quoted_string(out, prop->text); + if (!expr_is_yes(prop->visible.expr)) { + fputs(" if ", out); + expr_fprint(prop->visible.expr, out); + } + fputc('\n', out); + break; + case P_DEFAULT: + fputs( " default ", out); + expr_fprint(prop->expr, out); + if (!expr_is_yes(prop->visible.expr)) { + fputs(" if ", out); + expr_fprint(prop->visible.expr, out); + } + fputc('\n', out); + break; + case P_CHOICE: + fputs(" #choice value\n", out); + break; + default: + fprintf(out, " unknown prop %d!\n", prop->type); + break; + } + } + if (sym->help) { + int len = strlen(sym->help); + while (sym->help[--len] == '\n') + sym->help[len] = 0; + fprintf(out, " help\n%s\n", sym->help); + } + fputc('\n', out); +} + +void zconfdump(FILE *out) +{ + struct property *prop; + struct symbol *sym; + struct menu *menu; + + menu = rootmenu.list; + while (menu) { + if ((sym = menu->sym)) + print_symbol(out, menu); + else if ((prop = menu->prompt)) { + switch (prop->type) { + case P_COMMENT: + fputs("\ncomment ", out); + print_quoted_string(out, prop->text); + fputs("\n", out); + break; + case P_MENU: + fputs("\nmenu ", out); + print_quoted_string(out, prop->text); + fputs("\n", out); + break; + default: + ; + } + if (!expr_is_yes(prop->visible.expr)) { + fputs(" depends ", out); + expr_fprint(prop->visible.expr, out); + fputc('\n', out); + } + fputs("\n", out); + } + + if (menu->list) + menu = menu->list; + else if (menu->next) + menu = menu->next; + else while ((menu = menu->parent)) { + if (menu->prompt && menu->prompt->type == P_MENU) + fputs("\nendmenu\n", out); + if (menu->next) { + menu = menu->next; + break; + } + } + } +} + +#include "lex.zconf.c" +#include "util.c" +#include "confdata.c" +#include "expr.c" +#include "symbol.c" +#include "menu.c" + + diff --git a/config/scripts/config/zconf.tab.c_shipped b/config/scripts/config/zconf.tab.c_shipped new file mode 100644 index 0000000000..cc68dcb9a3 --- /dev/null +++ b/config/scripts/config/zconf.tab.c_shipped @@ -0,0 +1,2130 @@ +/* A Bison parser, made by GNU Bison 1.875a. */ + +/* Skeleton parser for Yacc-like parsing with Bison, + Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003 Free Software Foundation, Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2, or (at your option) + any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 59 Temple Place - Suite 330, + Boston, MA 02111-1307, USA. */ + +/* As a special exception, when this file is copied by Bison into a + Bison output file, you may use that output file without restriction. + This special exception was added by the Free Software Foundation + in version 1.24 of Bison. */ + +/* Written by Richard Stallman by simplifying the original so called + ``semantic'' parser. */ + +/* All symbols defined below should begin with yy or YY, to avoid + infringing on user name space. This should be done even for local + variables, as they might otherwise be expanded by user macros. + There are some unavoidable exceptions within include files to + define necessary library symbols; they are noted "INFRINGES ON + USER NAME SPACE" below. */ + +/* Identify Bison output. */ +#define YYBISON 1 + +/* Skeleton name. */ +#define YYSKELETON_NAME "yacc.c" + +/* Pure parsers. */ +#define YYPURE 0 + +/* Using locations. */ +#define YYLSP_NEEDED 0 + +/* If NAME_PREFIX is specified substitute the variables and functions + names. */ +#define yyparse zconfparse +#define yylex zconflex +#define yyerror zconferror +#define yylval zconflval +#define yychar zconfchar +#define yydebug zconfdebug +#define yynerrs zconfnerrs + + +/* Tokens. */ +#ifndef YYTOKENTYPE +# define YYTOKENTYPE + /* Put the tokens into the symbol table, so that GDB and other debuggers + know about them. */ + enum yytokentype { + T_MAINMENU = 258, + T_MENU = 259, + T_ENDMENU = 260, + T_SOURCE = 261, + T_CHOICE = 262, + T_ENDCHOICE = 263, + T_COMMENT = 264, + T_CONFIG = 265, + T_MENUCONFIG = 266, + T_HELP = 267, + T_HELPTEXT = 268, + T_IF = 269, + T_ENDIF = 270, + T_DEPENDS = 271, + T_REQUIRES = 272, + T_OPTIONAL = 273, + T_PROMPT = 274, + T_DEFAULT = 275, + T_TRISTATE = 276, + T_DEF_TRISTATE = 277, + T_BOOLEAN = 278, + T_DEF_BOOLEAN = 279, + T_STRING = 280, + T_INT = 281, + T_HEX = 282, + T_WORD = 283, + T_WORD_QUOTE = 284, + T_UNEQUAL = 285, + T_EOF = 286, + T_EOL = 287, + T_CLOSE_PAREN = 288, + T_OPEN_PAREN = 289, + T_ON = 290, + T_SELECT = 291, + T_RANGE = 292, + T_OR = 293, + T_AND = 294, + T_EQUAL = 295, + T_NOT = 296 + }; +#endif +#define T_MAINMENU 258 +#define T_MENU 259 +#define T_ENDMENU 260 +#define T_SOURCE 261 +#define T_CHOICE 262 +#define T_ENDCHOICE 263 +#define T_COMMENT 264 +#define T_CONFIG 265 +#define T_MENUCONFIG 266 +#define T_HELP 267 +#define T_HELPTEXT 268 +#define T_IF 269 +#define T_ENDIF 270 +#define T_DEPENDS 271 +#define T_REQUIRES 272 +#define T_OPTIONAL 273 +#define T_PROMPT 274 +#define T_DEFAULT 275 +#define T_TRISTATE 276 +#define T_DEF_TRISTATE 277 +#define T_BOOLEAN 278 +#define T_DEF_BOOLEAN 279 +#define T_STRING 280 +#define T_INT 281 +#define T_HEX 282 +#define T_WORD 283 +#define T_WORD_QUOTE 284 +#define T_UNEQUAL 285 +#define T_EOF 286 +#define T_EOL 287 +#define T_CLOSE_PAREN 288 +#define T_OPEN_PAREN 289 +#define T_ON 290 +#define T_SELECT 291 +#define T_RANGE 292 +#define T_OR 293 +#define T_AND 294 +#define T_EQUAL 295 +#define T_NOT 296 + + + + +/* Copy the first part of user declarations. */ + + +/* + * Copyright (C) 2002 Roman Zippel + * Released under the terms of the GNU GPL v2.0. + */ + +#include +#include +#include +#include +#include +#include + +#define printd(mask, fmt...) if (cdebug & (mask)) printf(fmt) + +#define PRINTD 0x0001 +#define DEBUG_PARSE 0x0002 + +int cdebug = PRINTD; + +extern int zconflex(void); +static void zconfprint(const char *err, ...); +static void zconferror(const char *err); +static bool zconf_endtoken(int token, int starttoken, int endtoken); + +struct symbol *symbol_hash[257]; + +static struct menu *current_menu, *current_entry; + +#define YYERROR_VERBOSE + + +/* Enabling traces. */ +#ifndef YYDEBUG +# define YYDEBUG 0 +#endif + +/* Enabling verbose error messages. */ +#ifdef YYERROR_VERBOSE +# undef YYERROR_VERBOSE +# define YYERROR_VERBOSE 1 +#else +# define YYERROR_VERBOSE 0 +#endif + +#if ! defined (YYSTYPE) && ! defined (YYSTYPE_IS_DECLARED) + +typedef union YYSTYPE { + int token; + char *string; + struct symbol *symbol; + struct expr *expr; + struct menu *menu; +} YYSTYPE; +/* Line 191 of yacc.c. */ + +# define yystype YYSTYPE /* obsolescent; will be withdrawn */ +# define YYSTYPE_IS_DECLARED 1 +# define YYSTYPE_IS_TRIVIAL 1 +#endif + + + +/* Copy the second part of user declarations. */ + + +#define LKC_DIRECT_LINK +#include "lkc.h" + + +/* Line 214 of yacc.c. */ + + +#if ! defined (yyoverflow) || YYERROR_VERBOSE + +/* The parser invokes alloca or malloc; define the necessary symbols. */ + +# if YYSTACK_USE_ALLOCA +# define YYSTACK_ALLOC alloca +# else +# ifndef YYSTACK_USE_ALLOCA +# if defined (alloca) || (defined (_ALLOCA_H) && defined (__GNUC__)) +# define YYSTACK_ALLOC alloca +# else +# ifdef __GNUC__ +# define YYSTACK_ALLOC __builtin_alloca +# endif +# endif +# endif +# endif + +# ifdef YYSTACK_ALLOC + /* Pacify GCC's `empty if-body' warning. */ +# define YYSTACK_FREE(Ptr) do { /* empty */; } while (0) +# else +# if defined (__STDC__) || defined (__cplusplus) +# include /* INFRINGES ON USER NAME SPACE */ +# define YYSIZE_T size_t +# endif +# define YYSTACK_ALLOC malloc +# define YYSTACK_FREE free +# endif +#endif /* ! defined (yyoverflow) || YYERROR_VERBOSE */ + + +#if (! defined (yyoverflow) \ + && (! defined (__cplusplus) \ + || (YYSTYPE_IS_TRIVIAL))) + +/* A type that is properly aligned for any stack member. */ +union yyalloc +{ + short yyss; + YYSTYPE yyvs; + }; + +/* The size of the maximum gap between one aligned stack and the next. */ +# define YYSTACK_GAP_MAXIMUM (sizeof (union yyalloc) - 1) + +/* The size of an array large to enough to hold all stacks, each with + N elements. */ +# define YYSTACK_BYTES(N) \ + ((N) * (sizeof (short) + sizeof (YYSTYPE)) \ + + YYSTACK_GAP_MAXIMUM) + +/* Copy COUNT objects from FROM to TO. The source and destination do + not overlap. */ +# ifndef YYCOPY +# if 1 < __GNUC__ +# define YYCOPY(To, From, Count) \ + __builtin_memcpy (To, From, (Count) * sizeof (*(From))) +# else +# define YYCOPY(To, From, Count) \ + do \ + { \ + register YYSIZE_T yyi; \ + for (yyi = 0; yyi < (Count); yyi++) \ + (To)[yyi] = (From)[yyi]; \ + } \ + while (0) +# endif +# endif + +/* Relocate STACK from its old location to the new one. The + local variables YYSIZE and YYSTACKSIZE give the old and new number of + elements in the stack, and YYPTR gives the new location of the + stack. Advance YYPTR to a properly aligned location for the next + stack. */ +# define YYSTACK_RELOCATE(Stack) \ + do \ + { \ + YYSIZE_T yynewbytes; \ + YYCOPY (&yyptr->Stack, Stack, yysize); \ + Stack = &yyptr->Stack; \ + yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \ + yyptr += yynewbytes / sizeof (*yyptr); \ + } \ + while (0) + +#endif + +#if defined (__STDC__) || defined (__cplusplus) + typedef signed char yysigned_char; +#else + typedef short yysigned_char; +#endif + +/* YYFINAL -- State number of the termination state. */ +#define YYFINAL 2 +/* YYLAST -- Last index in YYTABLE. */ +#define YYLAST 201 + +/* YYNTOKENS -- Number of terminals. */ +#define YYNTOKENS 42 +/* YYNNTS -- Number of nonterminals. */ +#define YYNNTS 41 +/* YYNRULES -- Number of rules. */ +#define YYNRULES 104 +/* YYNRULES -- Number of states. */ +#define YYNSTATES 182 + +/* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX. */ +#define YYUNDEFTOK 2 +#define YYMAXUTOK 296 + +#define YYTRANSLATE(YYX) \ + ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK) + +/* YYTRANSLATE[YYLEX] -- Bison symbol number corresponding to YYLEX. */ +static const unsigned char yytranslate[] = +{ + 0, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 1, 2, 3, 4, + 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, + 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, + 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, + 35, 36, 37, 38, 39, 40, 41 +}; + +#if YYDEBUG +/* YYPRHS[YYN] -- Index of the first RHS symbol of rule number YYN in + YYRHS. */ +static const unsigned short yyprhs[] = +{ + 0, 0, 3, 4, 7, 9, 11, 13, 17, 19, + 21, 23, 26, 28, 30, 32, 34, 36, 38, 42, + 45, 49, 52, 53, 56, 59, 62, 65, 69, 74, + 78, 83, 87, 91, 95, 100, 105, 110, 116, 119, + 122, 124, 128, 131, 132, 135, 138, 141, 144, 149, + 153, 157, 160, 165, 166, 169, 173, 175, 179, 182, + 183, 186, 189, 192, 196, 199, 201, 205, 208, 209, + 212, 215, 218, 222, 226, 228, 232, 235, 238, 241, + 242, 245, 248, 253, 257, 261, 262, 265, 267, 269, + 272, 275, 278, 280, 282, 283, 286, 288, 292, 296, + 300, 303, 307, 311, 313 +}; + +/* YYRHS -- A `-1'-separated list of the rules' RHS. */ +static const yysigned_char yyrhs[] = +{ + 43, 0, -1, -1, 43, 44, -1, 45, -1, 55, + -1, 66, -1, 3, 77, 79, -1, 5, -1, 15, + -1, 8, -1, 1, 79, -1, 61, -1, 71, -1, + 47, -1, 49, -1, 69, -1, 79, -1, 10, 28, + 32, -1, 46, 50, -1, 11, 28, 32, -1, 48, + 50, -1, -1, 50, 51, -1, 50, 75, -1, 50, + 73, -1, 50, 32, -1, 21, 76, 32, -1, 22, + 81, 80, 32, -1, 23, 76, 32, -1, 24, 81, + 80, 32, -1, 26, 76, 32, -1, 27, 76, 32, + -1, 25, 76, 32, -1, 19, 77, 80, 32, -1, + 20, 81, 80, 32, -1, 36, 28, 80, 32, -1, + 37, 82, 82, 80, 32, -1, 7, 32, -1, 52, + 56, -1, 78, -1, 53, 58, 54, -1, 53, 58, + -1, -1, 56, 57, -1, 56, 75, -1, 56, 73, + -1, 56, 32, -1, 19, 77, 80, 32, -1, 21, + 76, 32, -1, 23, 76, 32, -1, 18, 32, -1, + 20, 28, 80, 32, -1, -1, 58, 45, -1, 14, + 81, 32, -1, 78, -1, 59, 62, 60, -1, 59, + 62, -1, -1, 62, 45, -1, 62, 66, -1, 62, + 55, -1, 4, 77, 32, -1, 63, 74, -1, 78, + -1, 64, 67, 65, -1, 64, 67, -1, -1, 67, + 45, -1, 67, 66, -1, 67, 55, -1, 67, 1, + 32, -1, 6, 77, 32, -1, 68, -1, 9, 77, + 32, -1, 70, 74, -1, 12, 32, -1, 72, 13, + -1, -1, 74, 75, -1, 74, 32, -1, 16, 35, + 81, 32, -1, 16, 81, 32, -1, 17, 81, 32, + -1, -1, 77, 80, -1, 28, -1, 29, -1, 5, + 79, -1, 8, 79, -1, 15, 79, -1, 32, -1, + 31, -1, -1, 14, 81, -1, 82, -1, 82, 40, + 82, -1, 82, 30, 82, -1, 34, 81, 33, -1, + 41, 81, -1, 81, 38, 81, -1, 81, 39, 81, + -1, 28, -1, 29, -1 +}; + +/* YYRLINE[YYN] -- source line where rule number YYN was defined. */ +static const unsigned short yyrline[] = +{ + 0, 94, 94, 95, 98, 99, 100, 101, 102, 103, + 104, 105, 109, 110, 111, 112, 113, 114, 120, 128, + 134, 142, 152, 154, 155, 156, 157, 160, 166, 173, + 179, 186, 192, 198, 204, 210, 216, 222, 230, 239, + 245, 254, 255, 261, 263, 264, 265, 266, 269, 275, + 281, 287, 293, 299, 301, 306, 315, 324, 325, 331, + 333, 334, 335, 340, 347, 353, 362, 363, 369, 371, + 372, 373, 374, 377, 383, 390, 397, 404, 410, 417, + 418, 419, 422, 427, 432, 440, 442, 447, 448, 451, + 452, 453, 457, 457, 459, 460, 463, 464, 465, 466, + 467, 468, 469, 472, 473 +}; +#endif + +#if YYDEBUG || YYERROR_VERBOSE +/* YYTNME[SYMBOL-NUM] -- String name of the symbol SYMBOL-NUM. + First, the terminals, then, starting at YYNTOKENS, nonterminals. */ +static const char *const yytname[] = +{ + "$end", "error", "$undefined", "T_MAINMENU", "T_MENU", "T_ENDMENU", + "T_SOURCE", "T_CHOICE", "T_ENDCHOICE", "T_COMMENT", "T_CONFIG", + "T_MENUCONFIG", "T_HELP", "T_HELPTEXT", "T_IF", "T_ENDIF", "T_DEPENDS", + "T_REQUIRES", "T_OPTIONAL", "T_PROMPT", "T_DEFAULT", "T_TRISTATE", + "T_DEF_TRISTATE", "T_BOOLEAN", "T_DEF_BOOLEAN", "T_STRING", "T_INT", + "T_HEX", "T_WORD", "T_WORD_QUOTE", "T_UNEQUAL", "T_EOF", "T_EOL", + "T_CLOSE_PAREN", "T_OPEN_PAREN", "T_ON", "T_SELECT", "T_RANGE", "T_OR", + "T_AND", "T_EQUAL", "T_NOT", "$accept", "input", "block", + "common_block", "config_entry_start", "config_stmt", + "menuconfig_entry_start", "menuconfig_stmt", "config_option_list", + "config_option", "choice", "choice_entry", "choice_end", "choice_stmt", + "choice_option_list", "choice_option", "choice_block", "if", "if_end", + "if_stmt", "if_block", "menu", "menu_entry", "menu_end", "menu_stmt", + "menu_block", "source", "source_stmt", "comment", "comment_stmt", + "help_start", "help", "depends_list", "depends", "prompt_stmt_opt", + "prompt", "end", "nl_or_eof", "if_expr", "expr", "symbol", 0 +}; +#endif + +# ifdef YYPRINT +/* YYTOKNUM[YYLEX-NUM] -- Internal token number corresponding to + token YYLEX-NUM. */ +static const unsigned short yytoknum[] = +{ + 0, 256, 257, 258, 259, 260, 261, 262, 263, 264, + 265, 266, 267, 268, 269, 270, 271, 272, 273, 274, + 275, 276, 277, 278, 279, 280, 281, 282, 283, 284, + 285, 286, 287, 288, 289, 290, 291, 292, 293, 294, + 295, 296 +}; +# endif + +/* YYR1[YYN] -- Symbol number of symbol that rule YYN derives. */ +static const unsigned char yyr1[] = +{ + 0, 42, 43, 43, 44, 44, 44, 44, 44, 44, + 44, 44, 45, 45, 45, 45, 45, 45, 46, 47, + 48, 49, 50, 50, 50, 50, 50, 51, 51, 51, + 51, 51, 51, 51, 51, 51, 51, 51, 52, 53, + 54, 55, 55, 56, 56, 56, 56, 56, 57, 57, + 57, 57, 57, 58, 58, 59, 60, 61, 61, 62, + 62, 62, 62, 63, 64, 65, 66, 66, 67, 67, + 67, 67, 67, 68, 69, 70, 71, 72, 73, 74, + 74, 74, 75, 75, 75, 76, 76, 77, 77, 78, + 78, 78, 79, 79, 80, 80, 81, 81, 81, 81, + 81, 81, 81, 82, 82 +}; + +/* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN. */ +static const unsigned char yyr2[] = +{ + 0, 2, 0, 2, 1, 1, 1, 3, 1, 1, + 1, 2, 1, 1, 1, 1, 1, 1, 3, 2, + 3, 2, 0, 2, 2, 2, 2, 3, 4, 3, + 4, 3, 3, 3, 4, 4, 4, 5, 2, 2, + 1, 3, 2, 0, 2, 2, 2, 2, 4, 3, + 3, 2, 4, 0, 2, 3, 1, 3, 2, 0, + 2, 2, 2, 3, 2, 1, 3, 2, 0, 2, + 2, 2, 3, 3, 1, 3, 2, 2, 2, 0, + 2, 2, 4, 3, 3, 0, 2, 1, 1, 2, + 2, 2, 1, 1, 0, 2, 1, 3, 3, 3, + 2, 3, 3, 1, 1 +}; + +/* YYDEFACT[STATE-NAME] -- Default rule to reduce with in state + STATE-NUM when YYTABLE doesn't specify something else to do. Zero + means the default is an error. */ +static const unsigned char yydefact[] = +{ + 2, 0, 1, 0, 0, 0, 8, 0, 0, 10, + 0, 0, 0, 0, 9, 93, 92, 3, 4, 22, + 14, 22, 15, 43, 53, 5, 59, 12, 79, 68, + 6, 74, 16, 79, 13, 17, 11, 87, 88, 0, + 0, 0, 38, 0, 0, 0, 103, 104, 0, 0, + 0, 96, 19, 21, 39, 42, 58, 64, 0, 76, + 7, 63, 73, 75, 18, 20, 0, 100, 55, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 85, 0, + 85, 0, 85, 85, 85, 26, 0, 0, 23, 0, + 25, 24, 0, 0, 0, 85, 85, 47, 44, 46, + 45, 0, 0, 0, 54, 41, 40, 60, 62, 57, + 61, 56, 81, 80, 0, 69, 71, 66, 70, 65, + 99, 101, 102, 98, 97, 77, 0, 0, 0, 94, + 94, 0, 94, 94, 0, 94, 0, 0, 0, 94, + 0, 78, 51, 94, 94, 0, 0, 89, 90, 91, + 72, 0, 83, 84, 0, 0, 0, 27, 86, 0, + 29, 0, 33, 31, 32, 0, 94, 0, 0, 49, + 50, 82, 95, 34, 35, 28, 30, 36, 0, 48, + 52, 37 +}; + +/* YYDEFGOTO[NTERM-NUM]. */ +static const short yydefgoto[] = +{ + -1, 1, 17, 18, 19, 20, 21, 22, 52, 88, + 23, 24, 105, 25, 54, 98, 55, 26, 109, 27, + 56, 28, 29, 117, 30, 58, 31, 32, 33, 34, + 89, 90, 57, 91, 131, 132, 106, 35, 155, 50, + 51 +}; + +/* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing + STATE-NUM. */ +#define YYPACT_NINF -99 +static const short yypact[] = +{ + -99, 48, -99, 38, 46, 46, -99, 46, -29, -99, + 46, -17, -3, -11, -99, -99, -99, -99, -99, -99, + -99, -99, -99, -99, -99, -99, -99, -99, -99, -99, + -99, -99, -99, -99, -99, -99, -99, -99, -99, 38, + 12, 15, -99, 18, 51, 62, -99, -99, -11, -11, + 4, -24, 138, 138, 160, 121, 110, -4, 81, -4, + -99, -99, -99, -99, -99, -99, -19, -99, -99, -11, + -11, 70, 70, 73, 32, -11, 46, -11, 46, -11, + 46, -11, 46, 46, 46, -99, 36, 70, -99, 95, + -99, -99, 96, 46, 106, 46, 46, -99, -99, -99, + -99, 38, 38, 38, -99, -99, -99, -99, -99, -99, + -99, -99, -99, -99, 112, -99, -99, -99, -99, -99, + -99, 117, -99, -99, -99, -99, -11, 33, 65, 131, + 1, 119, 131, 1, 136, 1, 153, 154, 155, 131, + 70, -99, -99, 131, 131, 156, 157, -99, -99, -99, + -99, 101, -99, -99, -11, 158, 159, -99, -99, 161, + -99, 162, -99, -99, -99, 163, 131, 164, 165, -99, + -99, -99, 99, -99, -99, -99, -99, -99, 166, -99, + -99, -99 +}; + +/* YYPGOTO[NTERM-NUM]. */ +static const short yypgoto[] = +{ + -99, -99, -99, 111, -99, -99, -99, -99, 178, -99, + -99, -99, -99, 91, -99, -99, -99, -99, -99, -99, + -99, -99, -99, -99, 115, -99, -99, -99, -99, -99, + -99, 146, 168, 89, 27, 0, 126, -1, -98, -48, + -63 +}; + +/* YYTABLE[YYPACT[STATE-NUM]]. What to do in state STATE-NUM. If + positive, shift that token. If negative, reduce the rule which + number is the opposite. If zero, do what YYDEFACT says. + If YYTABLE_NINF, syntax error. */ +#define YYTABLE_NINF -68 +static const short yytable[] = +{ + 66, 67, 36, 42, 39, 40, 71, 41, 123, 124, + 43, 44, 74, 75, 120, 154, 72, 46, 47, 69, + 70, 121, 122, 48, 140, 45, 127, 128, 112, 130, + 49, 133, 156, 135, 158, 159, 68, 161, 60, 69, + 70, 165, 69, 70, 61, 167, 168, 62, 2, 3, + 63, 4, 5, 6, 7, 8, 9, 10, 11, 12, + 46, 47, 13, 14, 139, 152, 48, 126, 178, 15, + 16, 69, 70, 49, 37, 38, 129, 166, 151, 15, + 16, -67, 114, 64, -67, 5, 101, 7, 8, 102, + 10, 11, 12, 143, 65, 13, 103, 153, 46, 47, + 147, 148, 149, 69, 70, 125, 172, 134, 141, 136, + 137, 138, 15, 16, 5, 101, 7, 8, 102, 10, + 11, 12, 145, 146, 13, 103, 101, 7, 142, 102, + 10, 11, 12, 171, 144, 13, 103, 69, 70, 69, + 70, 15, 16, 100, 150, 154, 113, 108, 113, 116, + 73, 157, 15, 16, 74, 75, 70, 76, 77, 78, + 79, 80, 81, 82, 83, 84, 104, 107, 160, 115, + 85, 110, 73, 118, 86, 87, 74, 75, 92, 93, + 94, 95, 111, 96, 119, 162, 163, 164, 169, 170, + 173, 174, 97, 175, 176, 177, 179, 180, 181, 53, + 99, 59 +}; + +static const unsigned char yycheck[] = +{ + 48, 49, 3, 32, 4, 5, 30, 7, 71, 72, + 10, 28, 16, 17, 33, 14, 40, 28, 29, 38, + 39, 69, 70, 34, 87, 28, 74, 75, 32, 77, + 41, 79, 130, 81, 132, 133, 32, 135, 39, 38, + 39, 139, 38, 39, 32, 143, 144, 32, 0, 1, + 32, 3, 4, 5, 6, 7, 8, 9, 10, 11, + 28, 29, 14, 15, 28, 32, 34, 35, 166, 31, + 32, 38, 39, 41, 28, 29, 76, 140, 126, 31, + 32, 0, 1, 32, 3, 4, 5, 6, 7, 8, + 9, 10, 11, 93, 32, 14, 15, 32, 28, 29, + 101, 102, 103, 38, 39, 32, 154, 80, 13, 82, + 83, 84, 31, 32, 4, 5, 6, 7, 8, 9, + 10, 11, 95, 96, 14, 15, 5, 6, 32, 8, + 9, 10, 11, 32, 28, 14, 15, 38, 39, 38, + 39, 31, 32, 54, 32, 14, 57, 56, 59, 58, + 12, 32, 31, 32, 16, 17, 39, 19, 20, 21, + 22, 23, 24, 25, 26, 27, 55, 56, 32, 58, + 32, 56, 12, 58, 36, 37, 16, 17, 18, 19, + 20, 21, 56, 23, 58, 32, 32, 32, 32, 32, + 32, 32, 32, 32, 32, 32, 32, 32, 32, 21, + 54, 33 +}; + +/* YYSTOS[STATE-NUM] -- The (internal number of the) accessing + symbol of state STATE-NUM. */ +static const unsigned char yystos[] = +{ + 0, 43, 0, 1, 3, 4, 5, 6, 7, 8, + 9, 10, 11, 14, 15, 31, 32, 44, 45, 46, + 47, 48, 49, 52, 53, 55, 59, 61, 63, 64, + 66, 68, 69, 70, 71, 79, 79, 28, 29, 77, + 77, 77, 32, 77, 28, 28, 28, 29, 34, 41, + 81, 82, 50, 50, 56, 58, 62, 74, 67, 74, + 79, 32, 32, 32, 32, 32, 81, 81, 32, 38, + 39, 30, 40, 12, 16, 17, 19, 20, 21, 22, + 23, 24, 25, 26, 27, 32, 36, 37, 51, 72, + 73, 75, 18, 19, 20, 21, 23, 32, 57, 73, + 75, 5, 8, 15, 45, 54, 78, 45, 55, 60, + 66, 78, 32, 75, 1, 45, 55, 65, 66, 78, + 33, 81, 81, 82, 82, 32, 35, 81, 81, 77, + 81, 76, 77, 81, 76, 81, 76, 76, 76, 28, + 82, 13, 32, 77, 28, 76, 76, 79, 79, 79, + 32, 81, 32, 32, 14, 80, 80, 32, 80, 80, + 32, 80, 32, 32, 32, 80, 82, 80, 80, 32, + 32, 32, 81, 32, 32, 32, 32, 32, 80, 32, + 32, 32 +}; + +#if ! defined (YYSIZE_T) && defined (__SIZE_TYPE__) +# define YYSIZE_T __SIZE_TYPE__ +#endif +#if ! defined (YYSIZE_T) && defined (size_t) +# define YYSIZE_T size_t +#endif +#if ! defined (YYSIZE_T) +# if defined (__STDC__) || defined (__cplusplus) +# include /* INFRINGES ON USER NAME SPACE */ +# define YYSIZE_T size_t +# endif +#endif +#if ! defined (YYSIZE_T) +# define YYSIZE_T unsigned int +#endif + +#define yyerrok (yyerrstatus = 0) +#define yyclearin (yychar = YYEMPTY) +#define YYEMPTY (-2) +#define YYEOF 0 + +#define YYACCEPT goto yyacceptlab +#define YYABORT goto yyabortlab +#define YYERROR goto yyerrlab1 + + +/* Like YYERROR except do call yyerror. This remains here temporarily + to ease the transition to the new meaning of YYERROR, for GCC. + Once GCC version 2 has supplanted version 1, this can go. */ + +#define YYFAIL goto yyerrlab + +#define YYRECOVERING() (!!yyerrstatus) + +#define YYBACKUP(Token, Value) \ +do \ + if (yychar == YYEMPTY && yylen == 1) \ + { \ + yychar = (Token); \ + yylval = (Value); \ + yytoken = YYTRANSLATE (yychar); \ + YYPOPSTACK; \ + goto yybackup; \ + } \ + else \ + { \ + yyerror ("syntax error: cannot back up");\ + YYERROR; \ + } \ +while (0) + +#define YYTERROR 1 +#define YYERRCODE 256 + +/* YYLLOC_DEFAULT -- Compute the default location (before the actions + are run). */ + +#ifndef YYLLOC_DEFAULT +# define YYLLOC_DEFAULT(Current, Rhs, N) \ + Current.first_line = Rhs[1].first_line; \ + Current.first_column = Rhs[1].first_column; \ + Current.last_line = Rhs[N].last_line; \ + Current.last_column = Rhs[N].last_column; +#endif + +/* YYLEX -- calling `yylex' with the right arguments. */ + +#ifdef YYLEX_PARAM +# define YYLEX yylex (YYLEX_PARAM) +#else +# define YYLEX yylex () +#endif + +/* Enable debugging if requested. */ +#if YYDEBUG + +# ifndef YYFPRINTF +# include /* INFRINGES ON USER NAME SPACE */ +# define YYFPRINTF fprintf +# endif + +# define YYDPRINTF(Args) \ +do { \ + if (yydebug) \ + YYFPRINTF Args; \ +} while (0) + +# define YYDSYMPRINT(Args) \ +do { \ + if (yydebug) \ + yysymprint Args; \ +} while (0) + +# define YYDSYMPRINTF(Title, Token, Value, Location) \ +do { \ + if (yydebug) \ + { \ + YYFPRINTF (stderr, "%s ", Title); \ + yysymprint (stderr, \ + Token, Value); \ + YYFPRINTF (stderr, "\n"); \ + } \ +} while (0) + +/*------------------------------------------------------------------. +| yy_stack_print -- Print the state stack from its BOTTOM up to its | +| TOP (cinluded). | +`------------------------------------------------------------------*/ + +#if defined (__STDC__) || defined (__cplusplus) +static void +yy_stack_print (short *bottom, short *top) +#else +static void +yy_stack_print (bottom, top) + short *bottom; + short *top; +#endif +{ + YYFPRINTF (stderr, "Stack now"); + for (/* Nothing. */; bottom <= top; ++bottom) + YYFPRINTF (stderr, " %d", *bottom); + YYFPRINTF (stderr, "\n"); +} + +# define YY_STACK_PRINT(Bottom, Top) \ +do { \ + if (yydebug) \ + yy_stack_print ((Bottom), (Top)); \ +} while (0) + + +/*------------------------------------------------. +| Report that the YYRULE is going to be reduced. | +`------------------------------------------------*/ + +#if defined (__STDC__) || defined (__cplusplus) +static void +yy_reduce_print (int yyrule) +#else +static void +yy_reduce_print (yyrule) + int yyrule; +#endif +{ + int yyi; + unsigned int yylineno = yyrline[yyrule]; + YYFPRINTF (stderr, "Reducing stack by rule %d (line %u), ", + yyrule - 1, yylineno); + /* Print the symbols being reduced, and their result. */ + for (yyi = yyprhs[yyrule]; 0 <= yyrhs[yyi]; yyi++) + YYFPRINTF (stderr, "%s ", yytname [yyrhs[yyi]]); + YYFPRINTF (stderr, "-> %s\n", yytname [yyr1[yyrule]]); +} + +# define YY_REDUCE_PRINT(Rule) \ +do { \ + if (yydebug) \ + yy_reduce_print (Rule); \ +} while (0) + +/* Nonzero means print parse trace. It is left uninitialized so that + multiple parsers can coexist. */ +int yydebug; +#else /* !YYDEBUG */ +# define YYDPRINTF(Args) +# define YYDSYMPRINT(Args) +# define YYDSYMPRINTF(Title, Token, Value, Location) +# define YY_STACK_PRINT(Bottom, Top) +# define YY_REDUCE_PRINT(Rule) +#endif /* !YYDEBUG */ + + +/* YYINITDEPTH -- initial size of the parser's stacks. */ +#ifndef YYINITDEPTH +# define YYINITDEPTH 200 +#endif + +/* YYMAXDEPTH -- maximum size the stacks can grow to (effective only + if the built-in stack extension method is used). + + Do not make this value too large; the results are undefined if + SIZE_MAX < YYSTACK_BYTES (YYMAXDEPTH) + evaluated with infinite-precision integer arithmetic. */ + +#if YYMAXDEPTH == 0 +# undef YYMAXDEPTH +#endif + +#ifndef YYMAXDEPTH +# define YYMAXDEPTH 10000 +#endif + + + +#if YYERROR_VERBOSE + +# ifndef yystrlen +# if defined (__GLIBC__) && defined (_STRING_H) +# define yystrlen strlen +# else +/* Return the length of YYSTR. */ +static YYSIZE_T +# if defined (__STDC__) || defined (__cplusplus) +yystrlen (const char *yystr) +# else +yystrlen (yystr) + const char *yystr; +# endif +{ + register const char *yys = yystr; + + while (*yys++ != '\0') + continue; + + return yys - yystr - 1; +} +# endif +# endif + +# ifndef yystpcpy +# if defined (__GLIBC__) && defined (_STRING_H) && defined (_GNU_SOURCE) +# define yystpcpy stpcpy +# else +/* Copy YYSRC to YYDEST, returning the address of the terminating '\0' in + YYDEST. */ +static char * +# if defined (__STDC__) || defined (__cplusplus) +yystpcpy (char *yydest, const char *yysrc) +# else +yystpcpy (yydest, yysrc) + char *yydest; + const char *yysrc; +# endif +{ + register char *yyd = yydest; + register const char *yys = yysrc; + + while ((*yyd++ = *yys++) != '\0') + continue; + + return yyd - 1; +} +# endif +# endif + +#endif /* !YYERROR_VERBOSE */ + + + +#if YYDEBUG +/*--------------------------------. +| Print this symbol on YYOUTPUT. | +`--------------------------------*/ + +#if defined (__STDC__) || defined (__cplusplus) +static void +yysymprint (FILE *yyoutput, int yytype, YYSTYPE *yyvaluep) +#else +static void +yysymprint (yyoutput, yytype, yyvaluep) + FILE *yyoutput; + int yytype; + YYSTYPE *yyvaluep; +#endif +{ + /* Pacify ``unused variable'' warnings. */ + (void) yyvaluep; + + if (yytype < YYNTOKENS) + { + YYFPRINTF (yyoutput, "token %s (", yytname[yytype]); +# ifdef YYPRINT + YYPRINT (yyoutput, yytoknum[yytype], *yyvaluep); +# endif + } + else + YYFPRINTF (yyoutput, "nterm %s (", yytname[yytype]); + + switch (yytype) + { + default: + break; + } + YYFPRINTF (yyoutput, ")"); +} + +#endif /* ! YYDEBUG */ +/*-----------------------------------------------. +| Release the memory associated to this symbol. | +`-----------------------------------------------*/ + +#if defined (__STDC__) || defined (__cplusplus) +static void +yydestruct (int yytype, YYSTYPE *yyvaluep) +#else +static void +yydestruct (yytype, yyvaluep) + int yytype; + YYSTYPE *yyvaluep; +#endif +{ + /* Pacify ``unused variable'' warnings. */ + (void) yyvaluep; + + switch (yytype) + { + + default: + break; + } +} + + +/* Prevent warnings from -Wmissing-prototypes. */ + +#ifdef YYPARSE_PARAM +# if defined (__STDC__) || defined (__cplusplus) +int yyparse (void *YYPARSE_PARAM); +# else +int yyparse (); +# endif +#else /* ! YYPARSE_PARAM */ +#if defined (__STDC__) || defined (__cplusplus) +int yyparse (void); +#else +int yyparse (); +#endif +#endif /* ! YYPARSE_PARAM */ + + + +/* The lookahead symbol. */ +int yychar; + +/* The semantic value of the lookahead symbol. */ +YYSTYPE yylval; + +/* Number of syntax errors so far. */ +int yynerrs; + + + +/*----------. +| yyparse. | +`----------*/ + +#ifdef YYPARSE_PARAM +# if defined (__STDC__) || defined (__cplusplus) +int yyparse (void *YYPARSE_PARAM) +# else +int yyparse (YYPARSE_PARAM) + void *YYPARSE_PARAM; +# endif +#else /* ! YYPARSE_PARAM */ +#if defined (__STDC__) || defined (__cplusplus) +int +yyparse (void) +#else +int +yyparse () + +#endif +#endif +{ + + register int yystate; + register int yyn; + int yyresult; + /* Number of tokens to shift before error messages enabled. */ + int yyerrstatus; + /* Lookahead token as an internal (translated) token number. */ + int yytoken = 0; + + /* Three stacks and their tools: + `yyss': related to states, + `yyvs': related to semantic values, + `yyls': related to locations. + + Refer to the stacks thru separate pointers, to allow yyoverflow + to reallocate them elsewhere. */ + + /* The state stack. */ + short yyssa[YYINITDEPTH]; + short *yyss = yyssa; + register short *yyssp; + + /* The semantic value stack. */ + YYSTYPE yyvsa[YYINITDEPTH]; + YYSTYPE *yyvs = yyvsa; + register YYSTYPE *yyvsp; + + + +#define YYPOPSTACK (yyvsp--, yyssp--) + + YYSIZE_T yystacksize = YYINITDEPTH; + + /* The variables used to return semantic value and location from the + action routines. */ + YYSTYPE yyval; + + + /* When reducing, the number of symbols on the RHS of the reduced + rule. */ + int yylen; + + YYDPRINTF ((stderr, "Starting parse\n")); + + yystate = 0; + yyerrstatus = 0; + yynerrs = 0; + yychar = YYEMPTY; /* Cause a token to be read. */ + + /* Initialize stack pointers. + Waste one element of value and location stack + so that they stay on the same level as the state stack. + The wasted elements are never initialized. */ + + yyssp = yyss; + yyvsp = yyvs; + + goto yysetstate; + +/*------------------------------------------------------------. +| yynewstate -- Push a new state, which is found in yystate. | +`------------------------------------------------------------*/ + yynewstate: + /* In all cases, when you get here, the value and location stacks + have just been pushed. so pushing a state here evens the stacks. + */ + yyssp++; + + yysetstate: + *yyssp = yystate; + + if (yyss + yystacksize - 1 <= yyssp) + { + /* Get the current used size of the three stacks, in elements. */ + YYSIZE_T yysize = yyssp - yyss + 1; + +#ifdef yyoverflow + { + /* Give user a chance to reallocate the stack. Use copies of + these so that the &'s don't force the real ones into + memory. */ + YYSTYPE *yyvs1 = yyvs; + short *yyss1 = yyss; + + + /* Each stack pointer address is followed by the size of the + data in use in that stack, in bytes. This used to be a + conditional around just the two extra args, but that might + be undefined if yyoverflow is a macro. */ + yyoverflow ("parser stack overflow", + &yyss1, yysize * sizeof (*yyssp), + &yyvs1, yysize * sizeof (*yyvsp), + + &yystacksize); + + yyss = yyss1; + yyvs = yyvs1; + } +#else /* no yyoverflow */ +# ifndef YYSTACK_RELOCATE + goto yyoverflowlab; +# else + /* Extend the stack our own way. */ + if (YYMAXDEPTH <= yystacksize) + goto yyoverflowlab; + yystacksize *= 2; + if (YYMAXDEPTH < yystacksize) + yystacksize = YYMAXDEPTH; + + { + short *yyss1 = yyss; + union yyalloc *yyptr = + (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize)); + if (! yyptr) + goto yyoverflowlab; + YYSTACK_RELOCATE (yyss); + YYSTACK_RELOCATE (yyvs); + +# undef YYSTACK_RELOCATE + if (yyss1 != yyssa) + YYSTACK_FREE (yyss1); + } +# endif +#endif /* no yyoverflow */ + + yyssp = yyss + yysize - 1; + yyvsp = yyvs + yysize - 1; + + + YYDPRINTF ((stderr, "Stack size increased to %lu\n", + (unsigned long int) yystacksize)); + + if (yyss + yystacksize - 1 <= yyssp) + YYABORT; + } + + YYDPRINTF ((stderr, "Entering state %d\n", yystate)); + + goto yybackup; + +/*-----------. +| yybackup. | +`-----------*/ +yybackup: + +/* Do appropriate processing given the current state. */ +/* Read a lookahead token if we need one and don't already have one. */ +/* yyresume: */ + + /* First try to decide what to do without reference to lookahead token. */ + + yyn = yypact[yystate]; + if (yyn == YYPACT_NINF) + goto yydefault; + + /* Not known => get a lookahead token if don't already have one. */ + + /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol. */ + if (yychar == YYEMPTY) + { + YYDPRINTF ((stderr, "Reading a token: ")); + yychar = YYLEX; + } + + if (yychar <= YYEOF) + { + yychar = yytoken = YYEOF; + YYDPRINTF ((stderr, "Now at end of input.\n")); + } + else + { + yytoken = YYTRANSLATE (yychar); + YYDSYMPRINTF ("Next token is", yytoken, &yylval, &yylloc); + } + + /* If the proper action on seeing token YYTOKEN is to reduce or to + detect an error, take that action. */ + yyn += yytoken; + if (yyn < 0 || YYLAST < yyn || yycheck[yyn] != yytoken) + goto yydefault; + yyn = yytable[yyn]; + if (yyn <= 0) + { + if (yyn == 0 || yyn == YYTABLE_NINF) + goto yyerrlab; + yyn = -yyn; + goto yyreduce; + } + + if (yyn == YYFINAL) + YYACCEPT; + + /* Shift the lookahead token. */ + YYDPRINTF ((stderr, "Shifting token %s, ", yytname[yytoken])); + + /* Discard the token being shifted unless it is eof. */ + if (yychar != YYEOF) + yychar = YYEMPTY; + + *++yyvsp = yylval; + + + /* Count tokens shifted since error; after three, turn off error + status. */ + if (yyerrstatus) + yyerrstatus--; + + yystate = yyn; + goto yynewstate; + + +/*-----------------------------------------------------------. +| yydefault -- do the default action for the current state. | +`-----------------------------------------------------------*/ +yydefault: + yyn = yydefact[yystate]; + if (yyn == 0) + goto yyerrlab; + goto yyreduce; + + +/*-----------------------------. +| yyreduce -- Do a reduction. | +`-----------------------------*/ +yyreduce: + /* yyn is the number of a rule to reduce with. */ + yylen = yyr2[yyn]; + + /* If YYLEN is nonzero, implement the default value of the action: + `$$ = $1'. + + Otherwise, the following line sets YYVAL to garbage. + This behavior is undocumented and Bison + users should not rely upon it. Assigning to YYVAL + unconditionally makes the parser a bit smaller, and it avoids a + GCC warning that YYVAL may be used uninitialized. */ + yyval = yyvsp[1-yylen]; + + + YY_REDUCE_PRINT (yyn); + switch (yyn) + { + case 8: + + { zconfprint("unexpected 'endmenu' statement"); ;} + break; + + case 9: + + { zconfprint("unexpected 'endif' statement"); ;} + break; + + case 10: + + { zconfprint("unexpected 'endchoice' statement"); ;} + break; + + case 11: + + { zconfprint("syntax error"); yyerrok; ;} + break; + + case 18: + + { + struct symbol *sym = sym_lookup(yyvsp[-1].string, 0); + sym->flags |= SYMBOL_OPTIONAL; + menu_add_entry(sym); + printd(DEBUG_PARSE, "%s:%d:config %s\n", zconf_curname(), zconf_lineno(), yyvsp[-1].string); +;} + break; + + case 19: + + { + menu_end_entry(); + printd(DEBUG_PARSE, "%s:%d:endconfig\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 20: + + { + struct symbol *sym = sym_lookup(yyvsp[-1].string, 0); + sym->flags |= SYMBOL_OPTIONAL; + menu_add_entry(sym); + printd(DEBUG_PARSE, "%s:%d:menuconfig %s\n", zconf_curname(), zconf_lineno(), yyvsp[-1].string); +;} + break; + + case 21: + + { + if (current_entry->prompt) + current_entry->prompt->type = P_MENU; + else + zconfprint("warning: menuconfig statement without prompt"); + menu_end_entry(); + printd(DEBUG_PARSE, "%s:%d:endconfig\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 27: + + { + menu_set_type(S_TRISTATE); + printd(DEBUG_PARSE, "%s:%d:tristate\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 28: + + { + menu_add_expr(P_DEFAULT, yyvsp[-2].expr, yyvsp[-1].expr); + menu_set_type(S_TRISTATE); + printd(DEBUG_PARSE, "%s:%d:def_boolean\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 29: + + { + menu_set_type(S_BOOLEAN); + printd(DEBUG_PARSE, "%s:%d:boolean\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 30: + + { + menu_add_expr(P_DEFAULT, yyvsp[-2].expr, yyvsp[-1].expr); + menu_set_type(S_BOOLEAN); + printd(DEBUG_PARSE, "%s:%d:def_boolean\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 31: + + { + menu_set_type(S_INT); + printd(DEBUG_PARSE, "%s:%d:int\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 32: + + { + menu_set_type(S_HEX); + printd(DEBUG_PARSE, "%s:%d:hex\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 33: + + { + menu_set_type(S_STRING); + printd(DEBUG_PARSE, "%s:%d:string\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 34: + + { + menu_add_prompt(P_PROMPT, yyvsp[-2].string, yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:prompt\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 35: + + { + menu_add_expr(P_DEFAULT, yyvsp[-2].expr, yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:default\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 36: + + { + menu_add_symbol(P_SELECT, sym_lookup(yyvsp[-2].string, 0), yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:select\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 37: + + { + menu_add_expr(P_RANGE, expr_alloc_comp(E_RANGE,yyvsp[-3].symbol, yyvsp[-2].symbol), yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:range\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 38: + + { + struct symbol *sym = sym_lookup(NULL, 0); + sym->flags |= SYMBOL_CHOICE; + menu_add_entry(sym); + menu_add_expr(P_CHOICE, NULL, NULL); + printd(DEBUG_PARSE, "%s:%d:choice\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 39: + + { + menu_end_entry(); + menu_add_menu(); +;} + break; + + case 40: + + { + if (zconf_endtoken(yyvsp[0].token, T_CHOICE, T_ENDCHOICE)) { + menu_end_menu(); + printd(DEBUG_PARSE, "%s:%d:endchoice\n", zconf_curname(), zconf_lineno()); + } +;} + break; + + case 42: + + { + printf("%s:%d: missing 'endchoice' for this 'choice' statement\n", current_menu->file->name, current_menu->lineno); + zconfnerrs++; +;} + break; + + case 48: + + { + menu_add_prompt(P_PROMPT, yyvsp[-2].string, yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:prompt\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 49: + + { + menu_set_type(S_TRISTATE); + printd(DEBUG_PARSE, "%s:%d:tristate\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 50: + + { + menu_set_type(S_BOOLEAN); + printd(DEBUG_PARSE, "%s:%d:boolean\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 51: + + { + current_entry->sym->flags |= SYMBOL_OPTIONAL; + printd(DEBUG_PARSE, "%s:%d:optional\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 52: + + { + menu_add_symbol(P_DEFAULT, sym_lookup(yyvsp[-2].string, 0), yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:default\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 55: + + { + printd(DEBUG_PARSE, "%s:%d:if\n", zconf_curname(), zconf_lineno()); + menu_add_entry(NULL); + menu_add_dep(yyvsp[-1].expr); + menu_end_entry(); + menu_add_menu(); +;} + break; + + case 56: + + { + if (zconf_endtoken(yyvsp[0].token, T_IF, T_ENDIF)) { + menu_end_menu(); + printd(DEBUG_PARSE, "%s:%d:endif\n", zconf_curname(), zconf_lineno()); + } +;} + break; + + case 58: + + { + printf("%s:%d: missing 'endif' for this 'if' statement\n", current_menu->file->name, current_menu->lineno); + zconfnerrs++; +;} + break; + + case 63: + + { + menu_add_entry(NULL); + menu_add_prop(P_MENU, yyvsp[-1].string, NULL, NULL); + printd(DEBUG_PARSE, "%s:%d:menu\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 64: + + { + menu_end_entry(); + menu_add_menu(); +;} + break; + + case 65: + + { + if (zconf_endtoken(yyvsp[0].token, T_MENU, T_ENDMENU)) { + menu_end_menu(); + printd(DEBUG_PARSE, "%s:%d:endmenu\n", zconf_curname(), zconf_lineno()); + } +;} + break; + + case 67: + + { + printf("%s:%d: missing 'endmenu' for this 'menu' statement\n", current_menu->file->name, current_menu->lineno); + zconfnerrs++; +;} + break; + + case 72: + + { zconfprint("invalid menu option"); yyerrok; ;} + break; + + case 73: + + { + yyval.string = yyvsp[-1].string; + printd(DEBUG_PARSE, "%s:%d:source %s\n", zconf_curname(), zconf_lineno(), yyvsp[-1].string); +;} + break; + + case 74: + + { + zconf_nextfile(yyvsp[0].string); +;} + break; + + case 75: + + { + menu_add_entry(NULL); + menu_add_prop(P_COMMENT, yyvsp[-1].string, NULL, NULL); + printd(DEBUG_PARSE, "%s:%d:comment\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 76: + + { + menu_end_entry(); +;} + break; + + case 77: + + { + printd(DEBUG_PARSE, "%s:%d:help\n", zconf_curname(), zconf_lineno()); + zconf_starthelp(); +;} + break; + + case 78: + + { + current_entry->sym->help = yyvsp[0].string; +;} + break; + + case 82: + + { + menu_add_dep(yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:depends on\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 83: + + { + menu_add_dep(yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:depends\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 84: + + { + menu_add_dep(yyvsp[-1].expr); + printd(DEBUG_PARSE, "%s:%d:requires\n", zconf_curname(), zconf_lineno()); +;} + break; + + case 86: + + { + menu_add_prop(P_PROMPT, yyvsp[-1].string, NULL, yyvsp[0].expr); +;} + break; + + case 89: + + { yyval.token = T_ENDMENU; ;} + break; + + case 90: + + { yyval.token = T_ENDCHOICE; ;} + break; + + case 91: + + { yyval.token = T_ENDIF; ;} + break; + + case 94: + + { yyval.expr = NULL; ;} + break; + + case 95: + + { yyval.expr = yyvsp[0].expr; ;} + break; + + case 96: + + { yyval.expr = expr_alloc_symbol(yyvsp[0].symbol); ;} + break; + + case 97: + + { yyval.expr = expr_alloc_comp(E_EQUAL, yyvsp[-2].symbol, yyvsp[0].symbol); ;} + break; + + case 98: + + { yyval.expr = expr_alloc_comp(E_UNEQUAL, yyvsp[-2].symbol, yyvsp[0].symbol); ;} + break; + + case 99: + + { yyval.expr = yyvsp[-1].expr; ;} + break; + + case 100: + + { yyval.expr = expr_alloc_one(E_NOT, yyvsp[0].expr); ;} + break; + + case 101: + + { yyval.expr = expr_alloc_two(E_OR, yyvsp[-2].expr, yyvsp[0].expr); ;} + break; + + case 102: + + { yyval.expr = expr_alloc_two(E_AND, yyvsp[-2].expr, yyvsp[0].expr); ;} + break; + + case 103: + + { yyval.symbol = sym_lookup(yyvsp[0].string, 0); free(yyvsp[0].string); ;} + break; + + case 104: + + { yyval.symbol = sym_lookup(yyvsp[0].string, 1); free(yyvsp[0].string); ;} + break; + + + } + +/* Line 999 of yacc.c. */ + + + yyvsp -= yylen; + yyssp -= yylen; + + + YY_STACK_PRINT (yyss, yyssp); + + *++yyvsp = yyval; + + + /* Now `shift' the result of the reduction. Determine what state + that goes to, based on the state we popped back to and the rule + number reduced by. */ + + yyn = yyr1[yyn]; + + yystate = yypgoto[yyn - YYNTOKENS] + *yyssp; + if (0 <= yystate && yystate <= YYLAST && yycheck[yystate] == *yyssp) + yystate = yytable[yystate]; + else + yystate = yydefgoto[yyn - YYNTOKENS]; + + goto yynewstate; + + +/*------------------------------------. +| yyerrlab -- here on detecting error | +`------------------------------------*/ +yyerrlab: + /* If not already recovering from an error, report this error. */ + if (!yyerrstatus) + { + ++yynerrs; +#if YYERROR_VERBOSE + yyn = yypact[yystate]; + + if (YYPACT_NINF < yyn && yyn < YYLAST) + { + YYSIZE_T yysize = 0; + int yytype = YYTRANSLATE (yychar); + char *yymsg; + int yyx, yycount; + + yycount = 0; + /* Start YYX at -YYN if negative to avoid negative indexes in + YYCHECK. */ + for (yyx = yyn < 0 ? -yyn : 0; + yyx < (int) (sizeof (yytname) / sizeof (char *)); yyx++) + if (yycheck[yyx + yyn] == yyx && yyx != YYTERROR) + yysize += yystrlen (yytname[yyx]) + 15, yycount++; + yysize += yystrlen ("syntax error, unexpected ") + 1; + yysize += yystrlen (yytname[yytype]); + yymsg = (char *) YYSTACK_ALLOC (yysize); + if (yymsg != 0) + { + char *yyp = yystpcpy (yymsg, "syntax error, unexpected "); + yyp = yystpcpy (yyp, yytname[yytype]); + + if (yycount < 5) + { + yycount = 0; + for (yyx = yyn < 0 ? -yyn : 0; + yyx < (int) (sizeof (yytname) / sizeof (char *)); + yyx++) + if (yycheck[yyx + yyn] == yyx && yyx != YYTERROR) + { + const char *yyq = ! yycount ? ", expecting " : " or "; + yyp = yystpcpy (yyp, yyq); + yyp = yystpcpy (yyp, yytname[yyx]); + yycount++; + } + } + yyerror (yymsg); + YYSTACK_FREE (yymsg); + } + else + yyerror ("syntax error; also virtual memory exhausted"); + } + else +#endif /* YYERROR_VERBOSE */ + yyerror ("syntax error"); + } + + + + if (yyerrstatus == 3) + { + /* If just tried and failed to reuse lookahead token after an + error, discard it. */ + + /* Return failure if at end of input. */ + if (yychar == YYEOF) + { + /* Pop the error token. */ + YYPOPSTACK; + /* Pop the rest of the stack. */ + while (yyss < yyssp) + { + YYDSYMPRINTF ("Error: popping", yystos[*yyssp], yyvsp, yylsp); + yydestruct (yystos[*yyssp], yyvsp); + YYPOPSTACK; + } + YYABORT; + } + + YYDSYMPRINTF ("Error: discarding", yytoken, &yylval, &yylloc); + yydestruct (yytoken, &yylval); + yychar = YYEMPTY; + + } + + /* Else will try to reuse lookahead token after shifting the error + token. */ + goto yyerrlab1; + + +/*----------------------------------------------------. +| yyerrlab1 -- error raised explicitly by an action. | +`----------------------------------------------------*/ +yyerrlab1: + yyerrstatus = 3; /* Each real token shifted decrements this. */ + + for (;;) + { + yyn = yypact[yystate]; + if (yyn != YYPACT_NINF) + { + yyn += YYTERROR; + if (0 <= yyn && yyn <= YYLAST && yycheck[yyn] == YYTERROR) + { + yyn = yytable[yyn]; + if (0 < yyn) + break; + } + } + + /* Pop the current state because it cannot handle the error token. */ + if (yyssp == yyss) + YYABORT; + + YYDSYMPRINTF ("Error: popping", yystos[*yyssp], yyvsp, yylsp); + yydestruct (yystos[yystate], yyvsp); + yyvsp--; + yystate = *--yyssp; + + YY_STACK_PRINT (yyss, yyssp); + } + + if (yyn == YYFINAL) + YYACCEPT; + + YYDPRINTF ((stderr, "Shifting error token, ")); + + *++yyvsp = yylval; + + + yystate = yyn; + goto yynewstate; + + +/*-------------------------------------. +| yyacceptlab -- YYACCEPT comes here. | +`-------------------------------------*/ +yyacceptlab: + yyresult = 0; + goto yyreturn; + +/*-----------------------------------. +| yyabortlab -- YYABORT comes here. | +`-----------------------------------*/ +yyabortlab: + yyresult = 1; + goto yyreturn; + +#ifndef yyoverflow +/*----------------------------------------------. +| yyoverflowlab -- parser overflow comes here. | +`----------------------------------------------*/ +yyoverflowlab: + yyerror ("parser stack overflow"); + yyresult = 2; + /* Fall through. */ +#endif + +yyreturn: +#ifndef yyoverflow + if (yyss != yyssa) + YYSTACK_FREE (yyss); +#endif + return yyresult; +} + + + + + +void conf_parse(const char *name) +{ + struct symbol *sym; + int i; + + zconf_initscan(name); + + sym_init(); + menu_init(); + modules_sym = sym_lookup("MODULES", 0); + rootmenu.prompt = menu_add_prop(P_MENU, "axTLS Configuration", NULL, NULL); + + //zconfdebug = 1; + zconfparse(); + if (zconfnerrs) + exit(1); + menu_finalize(&rootmenu); + for_all_symbols(i, sym) { + if (!(sym->flags & SYMBOL_CHECKED) && sym_check_deps(sym)) + printf("\n"); + else + sym->flags |= SYMBOL_CHECK_DONE; + } + + sym_change_count = 1; +} + +const char *zconf_tokenname(int token) +{ + switch (token) { + case T_MENU: return "menu"; + case T_ENDMENU: return "endmenu"; + case T_CHOICE: return "choice"; + case T_ENDCHOICE: return "endchoice"; + case T_IF: return "if"; + case T_ENDIF: return "endif"; + } + return ""; +} + +static bool zconf_endtoken(int token, int starttoken, int endtoken) +{ + if (token != endtoken) { + zconfprint("unexpected '%s' within %s block", zconf_tokenname(token), zconf_tokenname(starttoken)); + zconfnerrs++; + return false; + } + if (current_menu->file != current_file) { + zconfprint("'%s' in different file than '%s'", zconf_tokenname(token), zconf_tokenname(starttoken)); + zconfprint("location of the '%s'", zconf_tokenname(starttoken)); + zconfnerrs++; + return false; + } + return true; +} + +static void zconfprint(const char *err, ...) +{ + va_list ap; + + fprintf(stderr, "%s:%d: ", zconf_curname(), zconf_lineno() + 1); + va_start(ap, err); + vfprintf(stderr, err, ap); + va_end(ap); + fprintf(stderr, "\n"); +} + +static void zconferror(const char *err) +{ + fprintf(stderr, "%s:%d: %s\n", zconf_curname(), zconf_lineno() + 1, err); +} + +void print_quoted_string(FILE *out, const char *str) +{ + const char *p; + int len; + + putc('"', out); + while ((p = strchr(str, '"'))) { + len = p - str; + if (len) + fprintf(out, "%.*s", len, str); + fputs("\\\"", out); + str = p + 1; + } + fputs(str, out); + putc('"', out); +} + +void print_symbol(FILE *out, struct menu *menu) +{ + struct symbol *sym = menu->sym; + struct property *prop; + + if (sym_is_choice(sym)) + fprintf(out, "choice\n"); + else + fprintf(out, "config %s\n", sym->name); + switch (sym->type) { + case S_BOOLEAN: + fputs(" boolean\n", out); + break; + case S_TRISTATE: + fputs(" tristate\n", out); + break; + case S_STRING: + fputs(" string\n", out); + break; + case S_INT: + fputs(" integer\n", out); + break; + case S_HEX: + fputs(" hex\n", out); + break; + default: + fputs(" ???\n", out); + break; + } + for (prop = sym->prop; prop; prop = prop->next) { + if (prop->menu != menu) + continue; + switch (prop->type) { + case P_PROMPT: + fputs(" prompt ", out); + print_quoted_string(out, prop->text); + if (!expr_is_yes(prop->visible.expr)) { + fputs(" if ", out); + expr_fprint(prop->visible.expr, out); + } + fputc('\n', out); + break; + case P_DEFAULT: + fputs( " default ", out); + expr_fprint(prop->expr, out); + if (!expr_is_yes(prop->visible.expr)) { + fputs(" if ", out); + expr_fprint(prop->visible.expr, out); + } + fputc('\n', out); + break; + case P_CHOICE: + fputs(" #choice value\n", out); + break; + default: + fprintf(out, " unknown prop %d!\n", prop->type); + break; + } + } + if (sym->help) { + int len = strlen(sym->help); + while (sym->help[--len] == '\n') + sym->help[len] = 0; + fprintf(out, " help\n%s\n", sym->help); + } + fputc('\n', out); +} + +void zconfdump(FILE *out) +{ + struct property *prop; + struct symbol *sym; + struct menu *menu; + + menu = rootmenu.list; + while (menu) { + if ((sym = menu->sym)) + print_symbol(out, menu); + else if ((prop = menu->prompt)) { + switch (prop->type) { + case P_COMMENT: + fputs("\ncomment ", out); + print_quoted_string(out, prop->text); + fputs("\n", out); + break; + case P_MENU: + fputs("\nmenu ", out); + print_quoted_string(out, prop->text); + fputs("\n", out); + break; + default: + ; + } + if (!expr_is_yes(prop->visible.expr)) { + fputs(" depends ", out); + expr_fprint(prop->visible.expr, out); + fputc('\n', out); + } + fputs("\n", out); + } + + if (menu->list) + menu = menu->list; + else if (menu->next) + menu = menu->next; + else while ((menu = menu->parent)) { + if (menu->prompt && menu->prompt->type == P_MENU) + fputs("\nendmenu\n", out); + if (menu->next) { + menu = menu->next; + break; + } + } + } +} + +#include "lex.zconf.c" +#include "util.c" +#include "confdata.c" +#include "expr.c" +#include "symbol.c" +#include "menu.c" + + diff --git a/config/scripts/config/zconf.tab.h b/config/scripts/config/zconf.tab.h new file mode 100644 index 0000000000..3b191ef599 --- /dev/null +++ b/config/scripts/config/zconf.tab.h @@ -0,0 +1,125 @@ +/* A Bison parser, made from zconf.y, by GNU bison 1.75. */ + +/* Skeleton parser for Yacc-like parsing with Bison, + Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002 Free Software Foundation, Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2, or (at your option) + any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 59 Temple Place - Suite 330, + Boston, MA 02111-1307, USA. */ + +/* As a special exception, when this file is copied by Bison into a + Bison output file, you may use that output file without restriction. + This special exception was added by the Free Software Foundation + in version 1.24 of Bison. */ + +#ifndef BISON_ZCONF_TAB_H +# define BISON_ZCONF_TAB_H + +/* Tokens. */ +#ifndef YYTOKENTYPE +# define YYTOKENTYPE + /* Put the tokens into the symbol table, so that GDB and other debuggers + know about them. */ + enum yytokentype { + T_MAINMENU = 258, + T_MENU = 259, + T_ENDMENU = 260, + T_SOURCE = 261, + T_CHOICE = 262, + T_ENDCHOICE = 263, + T_COMMENT = 264, + T_CONFIG = 265, + T_HELP = 266, + T_HELPTEXT = 267, + T_IF = 268, + T_ENDIF = 269, + T_DEPENDS = 270, + T_REQUIRES = 271, + T_OPTIONAL = 272, + T_PROMPT = 273, + T_DEFAULT = 274, + T_TRISTATE = 275, + T_BOOLEAN = 276, + T_INT = 277, + T_HEX = 278, + T_WORD = 279, + T_STRING = 280, + T_UNEQUAL = 281, + T_EOF = 282, + T_EOL = 283, + T_CLOSE_PAREN = 284, + T_OPEN_PAREN = 285, + T_ON = 286, + T_OR = 287, + T_AND = 288, + T_EQUAL = 289, + T_NOT = 290 + }; +#endif +#define T_MAINMENU 258 +#define T_MENU 259 +#define T_ENDMENU 260 +#define T_SOURCE 261 +#define T_CHOICE 262 +#define T_ENDCHOICE 263 +#define T_COMMENT 264 +#define T_CONFIG 265 +#define T_HELP 266 +#define T_HELPTEXT 267 +#define T_IF 268 +#define T_ENDIF 269 +#define T_DEPENDS 270 +#define T_REQUIRES 271 +#define T_OPTIONAL 272 +#define T_PROMPT 273 +#define T_DEFAULT 274 +#define T_TRISTATE 275 +#define T_BOOLEAN 276 +#define T_INT 277 +#define T_HEX 278 +#define T_WORD 279 +#define T_STRING 280 +#define T_UNEQUAL 281 +#define T_EOF 282 +#define T_EOL 283 +#define T_CLOSE_PAREN 284 +#define T_OPEN_PAREN 285 +#define T_ON 286 +#define T_OR 287 +#define T_AND 288 +#define T_EQUAL 289 +#define T_NOT 290 + + + + +#ifndef YYSTYPE +#line 33 "zconf.y" +typedef union { + int token; + char *string; + struct symbol *symbol; + struct expr *expr; + struct menu *menu; +} yystype; +/* Line 1281 of /usr/share/bison/yacc.c. */ +#line 118 "zconf.tab.h" +# define YYSTYPE yystype +#endif + +extern YYSTYPE zconflval; + + +#endif /* not BISON_ZCONF_TAB_H */ + diff --git a/config/scripts/config/zconf.tab.h_shipped b/config/scripts/config/zconf.tab.h_shipped new file mode 100644 index 0000000000..3b191ef599 --- /dev/null +++ b/config/scripts/config/zconf.tab.h_shipped @@ -0,0 +1,125 @@ +/* A Bison parser, made from zconf.y, by GNU bison 1.75. */ + +/* Skeleton parser for Yacc-like parsing with Bison, + Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002 Free Software Foundation, Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2, or (at your option) + any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 59 Temple Place - Suite 330, + Boston, MA 02111-1307, USA. */ + +/* As a special exception, when this file is copied by Bison into a + Bison output file, you may use that output file without restriction. + This special exception was added by the Free Software Foundation + in version 1.24 of Bison. */ + +#ifndef BISON_ZCONF_TAB_H +# define BISON_ZCONF_TAB_H + +/* Tokens. */ +#ifndef YYTOKENTYPE +# define YYTOKENTYPE + /* Put the tokens into the symbol table, so that GDB and other debuggers + know about them. */ + enum yytokentype { + T_MAINMENU = 258, + T_MENU = 259, + T_ENDMENU = 260, + T_SOURCE = 261, + T_CHOICE = 262, + T_ENDCHOICE = 263, + T_COMMENT = 264, + T_CONFIG = 265, + T_HELP = 266, + T_HELPTEXT = 267, + T_IF = 268, + T_ENDIF = 269, + T_DEPENDS = 270, + T_REQUIRES = 271, + T_OPTIONAL = 272, + T_PROMPT = 273, + T_DEFAULT = 274, + T_TRISTATE = 275, + T_BOOLEAN = 276, + T_INT = 277, + T_HEX = 278, + T_WORD = 279, + T_STRING = 280, + T_UNEQUAL = 281, + T_EOF = 282, + T_EOL = 283, + T_CLOSE_PAREN = 284, + T_OPEN_PAREN = 285, + T_ON = 286, + T_OR = 287, + T_AND = 288, + T_EQUAL = 289, + T_NOT = 290 + }; +#endif +#define T_MAINMENU 258 +#define T_MENU 259 +#define T_ENDMENU 260 +#define T_SOURCE 261 +#define T_CHOICE 262 +#define T_ENDCHOICE 263 +#define T_COMMENT 264 +#define T_CONFIG 265 +#define T_HELP 266 +#define T_HELPTEXT 267 +#define T_IF 268 +#define T_ENDIF 269 +#define T_DEPENDS 270 +#define T_REQUIRES 271 +#define T_OPTIONAL 272 +#define T_PROMPT 273 +#define T_DEFAULT 274 +#define T_TRISTATE 275 +#define T_BOOLEAN 276 +#define T_INT 277 +#define T_HEX 278 +#define T_WORD 279 +#define T_STRING 280 +#define T_UNEQUAL 281 +#define T_EOF 282 +#define T_EOL 283 +#define T_CLOSE_PAREN 284 +#define T_OPEN_PAREN 285 +#define T_ON 286 +#define T_OR 287 +#define T_AND 288 +#define T_EQUAL 289 +#define T_NOT 290 + + + + +#ifndef YYSTYPE +#line 33 "zconf.y" +typedef union { + int token; + char *string; + struct symbol *symbol; + struct expr *expr; + struct menu *menu; +} yystype; +/* Line 1281 of /usr/share/bison/yacc.c. */ +#line 118 "zconf.tab.h" +# define YYSTYPE yystype +#endif + +extern YYSTYPE zconflval; + + +#endif /* not BISON_ZCONF_TAB_H */ + diff --git a/config/scripts/config/zconf.y b/config/scripts/config/zconf.y new file mode 100644 index 0000000000..cf45da0b20 --- /dev/null +++ b/config/scripts/config/zconf.y @@ -0,0 +1,690 @@ +%{ +/* + * Copyright (C) 2002 Roman Zippel + * Released under the terms of the GNU GPL v2.0. + */ + +#include +#include +#include +#include +#include +#include + +#define printd(mask, fmt...) if (cdebug & (mask)) printf(fmt) + +#define PRINTD 0x0001 +#define DEBUG_PARSE 0x0002 + +int cdebug = PRINTD; + +extern int zconflex(void); +static void zconfprint(const char *err, ...); +static void zconferror(const char *err); +static bool zconf_endtoken(int token, int starttoken, int endtoken); + +struct symbol *symbol_hash[257]; + +static struct menu *current_menu, *current_entry; + +#define YYERROR_VERBOSE +%} +%expect 40 + +%union +{ + int token; + char *string; + struct symbol *symbol; + struct expr *expr; + struct menu *menu; +} + +%token T_MAINMENU +%token T_MENU +%token T_ENDMENU +%token T_SOURCE +%token T_CHOICE +%token T_ENDCHOICE +%token T_COMMENT +%token T_CONFIG +%token T_MENUCONFIG +%token T_HELP +%token T_HELPTEXT +%token T_IF +%token T_ENDIF +%token T_DEPENDS +%token T_REQUIRES +%token T_OPTIONAL +%token T_PROMPT +%token T_DEFAULT +%token T_TRISTATE +%token T_DEF_TRISTATE +%token T_BOOLEAN +%token T_DEF_BOOLEAN +%token T_STRING +%token T_INT +%token T_HEX +%token T_WORD +%token T_WORD_QUOTE +%token T_UNEQUAL +%token T_EOF +%token T_EOL +%token T_CLOSE_PAREN +%token T_OPEN_PAREN +%token T_ON +%token T_SELECT +%token T_RANGE + +%left T_OR +%left T_AND +%left T_EQUAL T_UNEQUAL +%nonassoc T_NOT + +%type prompt +%type source +%type symbol +%type expr +%type if_expr +%type end + +%{ +#define LKC_DIRECT_LINK +#include "lkc.h" +%} +%% +input: /* empty */ + | input block +; + +block: common_block + | choice_stmt + | menu_stmt + | T_MAINMENU prompt nl_or_eof + | T_ENDMENU { zconfprint("unexpected 'endmenu' statement"); } + | T_ENDIF { zconfprint("unexpected 'endif' statement"); } + | T_ENDCHOICE { zconfprint("unexpected 'endchoice' statement"); } + | error nl_or_eof { zconfprint("syntax error"); yyerrok; } +; + +common_block: + if_stmt + | comment_stmt + | config_stmt + | menuconfig_stmt + | source_stmt + | nl_or_eof +; + + +/* config/menuconfig entry */ + +config_entry_start: T_CONFIG T_WORD T_EOL +{ + struct symbol *sym = sym_lookup($2, 0); + sym->flags |= SYMBOL_OPTIONAL; + menu_add_entry(sym); + printd(DEBUG_PARSE, "%s:%d:config %s\n", zconf_curname(), zconf_lineno(), $2); +}; + +config_stmt: config_entry_start config_option_list +{ + menu_end_entry(); + printd(DEBUG_PARSE, "%s:%d:endconfig\n", zconf_curname(), zconf_lineno()); +}; + +menuconfig_entry_start: T_MENUCONFIG T_WORD T_EOL +{ + struct symbol *sym = sym_lookup($2, 0); + sym->flags |= SYMBOL_OPTIONAL; + menu_add_entry(sym); + printd(DEBUG_PARSE, "%s:%d:menuconfig %s\n", zconf_curname(), zconf_lineno(), $2); +}; + +menuconfig_stmt: menuconfig_entry_start config_option_list +{ + if (current_entry->prompt) + current_entry->prompt->type = P_MENU; + else + zconfprint("warning: menuconfig statement without prompt"); + menu_end_entry(); + printd(DEBUG_PARSE, "%s:%d:endconfig\n", zconf_curname(), zconf_lineno()); +}; + +config_option_list: + /* empty */ + | config_option_list config_option + | config_option_list depends + | config_option_list help + | config_option_list T_EOL +; + +config_option: T_TRISTATE prompt_stmt_opt T_EOL +{ + menu_set_type(S_TRISTATE); + printd(DEBUG_PARSE, "%s:%d:tristate\n", zconf_curname(), zconf_lineno()); +}; + +config_option: T_DEF_TRISTATE expr if_expr T_EOL +{ + menu_add_expr(P_DEFAULT, $2, $3); + menu_set_type(S_TRISTATE); + printd(DEBUG_PARSE, "%s:%d:def_boolean\n", zconf_curname(), zconf_lineno()); +}; + +config_option: T_BOOLEAN prompt_stmt_opt T_EOL +{ + menu_set_type(S_BOOLEAN); + printd(DEBUG_PARSE, "%s:%d:boolean\n", zconf_curname(), zconf_lineno()); +}; + +config_option: T_DEF_BOOLEAN expr if_expr T_EOL +{ + menu_add_expr(P_DEFAULT, $2, $3); + menu_set_type(S_BOOLEAN); + printd(DEBUG_PARSE, "%s:%d:def_boolean\n", zconf_curname(), zconf_lineno()); +}; + +config_option: T_INT prompt_stmt_opt T_EOL +{ + menu_set_type(S_INT); + printd(DEBUG_PARSE, "%s:%d:int\n", zconf_curname(), zconf_lineno()); +}; + +config_option: T_HEX prompt_stmt_opt T_EOL +{ + menu_set_type(S_HEX); + printd(DEBUG_PARSE, "%s:%d:hex\n", zconf_curname(), zconf_lineno()); +}; + +config_option: T_STRING prompt_stmt_opt T_EOL +{ + menu_set_type(S_STRING); + printd(DEBUG_PARSE, "%s:%d:string\n", zconf_curname(), zconf_lineno()); +}; + +config_option: T_PROMPT prompt if_expr T_EOL +{ + menu_add_prompt(P_PROMPT, $2, $3); + printd(DEBUG_PARSE, "%s:%d:prompt\n", zconf_curname(), zconf_lineno()); +}; + +config_option: T_DEFAULT expr if_expr T_EOL +{ + menu_add_expr(P_DEFAULT, $2, $3); + printd(DEBUG_PARSE, "%s:%d:default\n", zconf_curname(), zconf_lineno()); +}; + +config_option: T_SELECT T_WORD if_expr T_EOL +{ + menu_add_symbol(P_SELECT, sym_lookup($2, 0), $3); + printd(DEBUG_PARSE, "%s:%d:select\n", zconf_curname(), zconf_lineno()); +}; + +config_option: T_RANGE symbol symbol if_expr T_EOL +{ + menu_add_expr(P_RANGE, expr_alloc_comp(E_RANGE,$2, $3), $4); + printd(DEBUG_PARSE, "%s:%d:range\n", zconf_curname(), zconf_lineno()); +}; + +/* choice entry */ + +choice: T_CHOICE T_EOL +{ + struct symbol *sym = sym_lookup(NULL, 0); + sym->flags |= SYMBOL_CHOICE; + menu_add_entry(sym); + menu_add_expr(P_CHOICE, NULL, NULL); + printd(DEBUG_PARSE, "%s:%d:choice\n", zconf_curname(), zconf_lineno()); +}; + +choice_entry: choice choice_option_list +{ + menu_end_entry(); + menu_add_menu(); +}; + +choice_end: end +{ + if (zconf_endtoken($1, T_CHOICE, T_ENDCHOICE)) { + menu_end_menu(); + printd(DEBUG_PARSE, "%s:%d:endchoice\n", zconf_curname(), zconf_lineno()); + } +}; + +choice_stmt: + choice_entry choice_block choice_end + | choice_entry choice_block +{ + printf("%s:%d: missing 'endchoice' for this 'choice' statement\n", current_menu->file->name, current_menu->lineno); + zconfnerrs++; +}; + +choice_option_list: + /* empty */ + | choice_option_list choice_option + | choice_option_list depends + | choice_option_list help + | choice_option_list T_EOL +; + +choice_option: T_PROMPT prompt if_expr T_EOL +{ + menu_add_prompt(P_PROMPT, $2, $3); + printd(DEBUG_PARSE, "%s:%d:prompt\n", zconf_curname(), zconf_lineno()); +}; + +choice_option: T_TRISTATE prompt_stmt_opt T_EOL +{ + menu_set_type(S_TRISTATE); + printd(DEBUG_PARSE, "%s:%d:tristate\n", zconf_curname(), zconf_lineno()); +}; + +choice_option: T_BOOLEAN prompt_stmt_opt T_EOL +{ + menu_set_type(S_BOOLEAN); + printd(DEBUG_PARSE, "%s:%d:boolean\n", zconf_curname(), zconf_lineno()); +}; + +choice_option: T_OPTIONAL T_EOL +{ + current_entry->sym->flags |= SYMBOL_OPTIONAL; + printd(DEBUG_PARSE, "%s:%d:optional\n", zconf_curname(), zconf_lineno()); +}; + +choice_option: T_DEFAULT T_WORD if_expr T_EOL +{ + menu_add_symbol(P_DEFAULT, sym_lookup($2, 0), $3); + printd(DEBUG_PARSE, "%s:%d:default\n", zconf_curname(), zconf_lineno()); +}; + +choice_block: + /* empty */ + | choice_block common_block +; + +/* if entry */ + +if: T_IF expr T_EOL +{ + printd(DEBUG_PARSE, "%s:%d:if\n", zconf_curname(), zconf_lineno()); + menu_add_entry(NULL); + menu_add_dep($2); + menu_end_entry(); + menu_add_menu(); +}; + +if_end: end +{ + if (zconf_endtoken($1, T_IF, T_ENDIF)) { + menu_end_menu(); + printd(DEBUG_PARSE, "%s:%d:endif\n", zconf_curname(), zconf_lineno()); + } +}; + +if_stmt: + if if_block if_end + | if if_block +{ + printf("%s:%d: missing 'endif' for this 'if' statement\n", current_menu->file->name, current_menu->lineno); + zconfnerrs++; +}; + +if_block: + /* empty */ + | if_block common_block + | if_block menu_stmt + | if_block choice_stmt +; + +/* menu entry */ + +menu: T_MENU prompt T_EOL +{ + menu_add_entry(NULL); + menu_add_prop(P_MENU, $2, NULL, NULL); + printd(DEBUG_PARSE, "%s:%d:menu\n", zconf_curname(), zconf_lineno()); +}; + +menu_entry: menu depends_list +{ + menu_end_entry(); + menu_add_menu(); +}; + +menu_end: end +{ + if (zconf_endtoken($1, T_MENU, T_ENDMENU)) { + menu_end_menu(); + printd(DEBUG_PARSE, "%s:%d:endmenu\n", zconf_curname(), zconf_lineno()); + } +}; + +menu_stmt: + menu_entry menu_block menu_end + | menu_entry menu_block +{ + printf("%s:%d: missing 'endmenu' for this 'menu' statement\n", current_menu->file->name, current_menu->lineno); + zconfnerrs++; +}; + +menu_block: + /* empty */ + | menu_block common_block + | menu_block menu_stmt + | menu_block choice_stmt + | menu_block error T_EOL { zconfprint("invalid menu option"); yyerrok; } +; + +source: T_SOURCE prompt T_EOL +{ + $$ = $2; + printd(DEBUG_PARSE, "%s:%d:source %s\n", zconf_curname(), zconf_lineno(), $2); +}; + +source_stmt: source +{ + zconf_nextfile($1); +}; + +/* comment entry */ + +comment: T_COMMENT prompt T_EOL +{ + menu_add_entry(NULL); + menu_add_prop(P_COMMENT, $2, NULL, NULL); + printd(DEBUG_PARSE, "%s:%d:comment\n", zconf_curname(), zconf_lineno()); +}; + +comment_stmt: comment depends_list +{ + menu_end_entry(); +}; + +/* help option */ + +help_start: T_HELP T_EOL +{ + printd(DEBUG_PARSE, "%s:%d:help\n", zconf_curname(), zconf_lineno()); + zconf_starthelp(); +}; + +help: help_start T_HELPTEXT +{ + current_entry->sym->help = $2; +}; + +/* depends option */ + +depends_list: /* empty */ + | depends_list depends + | depends_list T_EOL +; + +depends: T_DEPENDS T_ON expr T_EOL +{ + menu_add_dep($3); + printd(DEBUG_PARSE, "%s:%d:depends on\n", zconf_curname(), zconf_lineno()); +} + | T_DEPENDS expr T_EOL +{ + menu_add_dep($2); + printd(DEBUG_PARSE, "%s:%d:depends\n", zconf_curname(), zconf_lineno()); +} + | T_REQUIRES expr T_EOL +{ + menu_add_dep($2); + printd(DEBUG_PARSE, "%s:%d:requires\n", zconf_curname(), zconf_lineno()); +}; + +/* prompt statement */ + +prompt_stmt_opt: + /* empty */ + | prompt if_expr +{ + menu_add_prop(P_PROMPT, $1, NULL, $2); +}; + +prompt: T_WORD + | T_WORD_QUOTE +; + +end: T_ENDMENU nl_or_eof { $$ = T_ENDMENU; } + | T_ENDCHOICE nl_or_eof { $$ = T_ENDCHOICE; } + | T_ENDIF nl_or_eof { $$ = T_ENDIF; } +; + +nl_or_eof: + T_EOL | T_EOF; + +if_expr: /* empty */ { $$ = NULL; } + | T_IF expr { $$ = $2; } +; + +expr: symbol { $$ = expr_alloc_symbol($1); } + | symbol T_EQUAL symbol { $$ = expr_alloc_comp(E_EQUAL, $1, $3); } + | symbol T_UNEQUAL symbol { $$ = expr_alloc_comp(E_UNEQUAL, $1, $3); } + | T_OPEN_PAREN expr T_CLOSE_PAREN { $$ = $2; } + | T_NOT expr { $$ = expr_alloc_one(E_NOT, $2); } + | expr T_OR expr { $$ = expr_alloc_two(E_OR, $1, $3); } + | expr T_AND expr { $$ = expr_alloc_two(E_AND, $1, $3); } +; + +symbol: T_WORD { $$ = sym_lookup($1, 0); free($1); } + | T_WORD_QUOTE { $$ = sym_lookup($1, 1); free($1); } +; + +%% + +void conf_parse(const char *name) +{ + struct symbol *sym; + int i; + + zconf_initscan(name); + + sym_init(); + menu_init(); + modules_sym = sym_lookup("MODULES", 0); + rootmenu.prompt = menu_add_prop(P_MENU, "axTLS Configuration", NULL, NULL); + + //zconfdebug = 1; + zconfparse(); + if (zconfnerrs) + exit(1); + menu_finalize(&rootmenu); + for_all_symbols(i, sym) { + if (!(sym->flags & SYMBOL_CHECKED) && sym_check_deps(sym)) + printf("\n"); + else + sym->flags |= SYMBOL_CHECK_DONE; + } + + sym_change_count = 1; +} + +const char *zconf_tokenname(int token) +{ + switch (token) { + case T_MENU: return "menu"; + case T_ENDMENU: return "endmenu"; + case T_CHOICE: return "choice"; + case T_ENDCHOICE: return "endchoice"; + case T_IF: return "if"; + case T_ENDIF: return "endif"; + } + return ""; +} + +static bool zconf_endtoken(int token, int starttoken, int endtoken) +{ + if (token != endtoken) { + zconfprint("unexpected '%s' within %s block", zconf_tokenname(token), zconf_tokenname(starttoken)); + zconfnerrs++; + return false; + } + if (current_menu->file != current_file) { + zconfprint("'%s' in different file than '%s'", zconf_tokenname(token), zconf_tokenname(starttoken)); + zconfprint("location of the '%s'", zconf_tokenname(starttoken)); + zconfnerrs++; + return false; + } + return true; +} + +static void zconfprint(const char *err, ...) +{ + va_list ap; + + fprintf(stderr, "%s:%d: ", zconf_curname(), zconf_lineno() + 1); + va_start(ap, err); + vfprintf(stderr, err, ap); + va_end(ap); + fprintf(stderr, "\n"); +} + +static void zconferror(const char *err) +{ + fprintf(stderr, "%s:%d: %s\n", zconf_curname(), zconf_lineno() + 1, err); +} + +void print_quoted_string(FILE *out, const char *str) +{ + const char *p; + int len; + + putc('"', out); + while ((p = strchr(str, '"'))) { + len = p - str; + if (len) + fprintf(out, "%.*s", len, str); + fputs("\\\"", out); + str = p + 1; + } + fputs(str, out); + putc('"', out); +} + +void print_symbol(FILE *out, struct menu *menu) +{ + struct symbol *sym = menu->sym; + struct property *prop; + + if (sym_is_choice(sym)) + fprintf(out, "choice\n"); + else + fprintf(out, "config %s\n", sym->name); + switch (sym->type) { + case S_BOOLEAN: + fputs(" boolean\n", out); + break; + case S_TRISTATE: + fputs(" tristate\n", out); + break; + case S_STRING: + fputs(" string\n", out); + break; + case S_INT: + fputs(" integer\n", out); + break; + case S_HEX: + fputs(" hex\n", out); + break; + default: + fputs(" ???\n", out); + break; + } + for (prop = sym->prop; prop; prop = prop->next) { + if (prop->menu != menu) + continue; + switch (prop->type) { + case P_PROMPT: + fputs(" prompt ", out); + print_quoted_string(out, prop->text); + if (!expr_is_yes(prop->visible.expr)) { + fputs(" if ", out); + expr_fprint(prop->visible.expr, out); + } + fputc('\n', out); + break; + case P_DEFAULT: + fputs( " default ", out); + expr_fprint(prop->expr, out); + if (!expr_is_yes(prop->visible.expr)) { + fputs(" if ", out); + expr_fprint(prop->visible.expr, out); + } + fputc('\n', out); + break; + case P_CHOICE: + fputs(" #choice value\n", out); + break; + default: + fprintf(out, " unknown prop %d!\n", prop->type); + break; + } + } + if (sym->help) { + int len = strlen(sym->help); + while (sym->help[--len] == '\n') + sym->help[len] = 0; + fprintf(out, " help\n%s\n", sym->help); + } + fputc('\n', out); +} + +void zconfdump(FILE *out) +{ + struct property *prop; + struct symbol *sym; + struct menu *menu; + + menu = rootmenu.list; + while (menu) { + if ((sym = menu->sym)) + print_symbol(out, menu); + else if ((prop = menu->prompt)) { + switch (prop->type) { + case P_COMMENT: + fputs("\ncomment ", out); + print_quoted_string(out, prop->text); + fputs("\n", out); + break; + case P_MENU: + fputs("\nmenu ", out); + print_quoted_string(out, prop->text); + fputs("\n", out); + break; + default: + ; + } + if (!expr_is_yes(prop->visible.expr)) { + fputs(" depends ", out); + expr_fprint(prop->visible.expr, out); + fputc('\n', out); + } + fputs("\n", out); + } + + if (menu->list) + menu = menu->list; + else if (menu->next) + menu = menu->next; + else while ((menu = menu->parent)) { + if (menu->prompt && menu->prompt->type == P_MENU) + fputs("\nendmenu\n", out); + if (menu->next) { + menu = menu->next; + break; + } + } + } +} + +#include "lex.zconf.c" +#include "util.c" +#include "confdata.c" +#include "expr.c" +#include "symbol.c" +#include "menu.c" diff --git a/config/win32config b/config/win32config new file mode 100644 index 0000000000..5740814929 --- /dev/null +++ b/config/win32config @@ -0,0 +1,115 @@ +# +# Automatically generated make config: don't edit +# +HAVE_DOT_CONFIG=y +# CONFIG_PLATFORM_LINUX is not set +# CONFIG_PLATFORM_CYGWIN is not set +# CONFIG_PLATFORM_SOLARIS is not set +CONFIG_PLATFORM_WIN32=y + +# +# General Configuration +# +# CONFIG_DEBUG is not set + +# +# Microsoft Compiler Options +# +# CONFIG_VISUAL_STUDIO_6_0 is not set +# CONFIG_VISUAL_STUDIO_7_0 is not set +CONFIG_VISUAL_STUDIO_8_0=y +CONFIG_VISUAL_STUDIO_6_0_BASE="" +CONFIG_VISUAL_STUDIO_7_0_BASE="" +CONFIG_VISUAL_STUDIO_8_0_BASE="c:\\Program Files\\Microsoft Visual Studio 8" +CONFIG_EXTRA_CFLAGS_OPTIONS="" +CONFIG_EXTRA_LDFLAGS_OPTIONS="" + +# +# SSL Library +# +# CONFIG_SSL_SERVER_ONLY is not set +# CONFIG_SSL_CERT_VERIFICATION is not set +# CONFIG_SSL_ENABLE_CLIENT is not set +CONFIG_SSL_FULL_MODE=y +# CONFIG_SSL_SKELETON_MODE is not set +# CONFIG_SSL_PROT_LOW is not set +CONFIG_SSL_PROT_MEDIUM=y +# CONFIG_SSL_PROT_HIGH is not set +CONFIG_SSL_USE_DEFAULT_KEY=y +CONFIG_SSL_ENABLE_V23_HANDSHAKE=y +CONFIG_SSL_HAS_PEM=y +CONFIG_SSL_USE_PKCS12=y +CONFIG_SSL_EXPIRY_TIME=24 +CONFIG_X509_MAX_CA_CERTS=4 +CONFIG_SSL_MAX_CERTS=2 +# CONFIG_USE_DEV_URANDOM is not set +CONFIG_WIN32_USE_CRYPTO_LIB=y +# CONFIG_PERFORMANCE_TESTING is not set +# CONFIG_SSL_TEST is not set +CONFIG_AWHTTPD=y + +# +# Awhttpd Configuration +# +# CONFIG_HTTP_STATIC_BUILD is not set +CONFIG_HTTP_HAS_SSL=y +CONFIG_HTTP_HTTPS_PORT=443 +# CONFIG_STANDARD_AWHTTPD is not set +CONFIG_HTTP_WEBROOT="www" +CONFIG_HTTP_PORT=80 +# CONFIG_HTTP_USE_TIMEOUT is not set +CONFIG_HTTP_TIMEOUT=0 +CONFIG_HTTP_INITIAL_SLOTS=10 +CONFIG_HTTP_MAX_USERS=100 +# CONFIG_HTTP_HAS_CGI is not set +CONFIG_HTTP_CGI_EXTENSION="" +# CONFIG_HTTP_DIRECTORIES is not set +# CONFIG_HTTP_PERM_CHECK is not set +# CONFIG_HTTP_HAS_IPV6 is not set +CONFIG_HTTP_VERBOSE=y +# CONFIG_HTTP_IS_DAEMON is not set + +# +# Language Bindings +# +CONFIG_BINDINGS=y +CONFIG_CSHARP_BINDINGS=y +CONFIG_VBNET_BINDINGS=y + +# +# .Net Framework +# +CONFIG_DOT_NET_FRAMEWORK_BASE="c:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727" +CONFIG_JAVA_BINDINGS=y + +# +# Java Home +# +CONFIG_JAVA_HOME="c:\\Program Files\\Java\\jdk1.5.0_06" +# CONFIG_PERL_BINDINGS is not set +CONFIG_PERL_CORE="" +CONFIG_PERL_LIB="" + +# +# Samples +# +CONFIG_SAMPLES=y +CONFIG_C_SAMPLES=y +CONFIG_CSHARP_SAMPLES=y +CONFIG_VBNET_SAMPLES=y +CONFIG_JAVA_SAMPLES=y +# CONFIG_PERL_SAMPLES is not set + +# +# BigInt Options +# +# CONFIG_BIGINT_CLASSICAL is not set +# CONFIG_BIGINT_MONTGOMERY is not set +CONFIG_BIGINT_BARRETT=y +CONFIG_BIGINT_CRT=y +# CONFIG_BIGINT_KARATSUBA is not set +MUL_KARATSUBA_THRESH=0 +SQU_KARATSUBA_THRESH=0 +CONFIG_BIGINT_SLIDING_WINDOW=y +CONFIG_BIGINT_SQUARE=y +# CONFIG_BIGINT_CHECK_ON is not set diff --git a/docsrc/Makefile b/docsrc/Makefile new file mode 100644 index 0000000000..574d5ebda9 --- /dev/null +++ b/docsrc/Makefile @@ -0,0 +1,27 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +include ../config/makefile.conf + +all: + +doco: + doxygen ./axTLS.dox + +clean:: + @-rm -fr html *~ diff --git a/docsrc/axTLS.dox b/docsrc/axTLS.dox new file mode 100644 index 0000000000..e4763d6f34 --- /dev/null +++ b/docsrc/axTLS.dox @@ -0,0 +1,1237 @@ +# Doxyfile 1.4.5 + +# This file describes the settings to be used by the documentation system +# doxygen (www.doxygen.org) for a project +# +# All text after a hash (#) is considered a comment and will be ignored +# The format is: +# TAG = value [value, ...] +# For lists items can also be appended using: +# TAG += value [value, ...] +# Values that contain spaces should be placed between quotes (" ") + +#--------------------------------------------------------------------------- +# Project related configuration options +#--------------------------------------------------------------------------- + +# The PROJECT_NAME tag is a single word (or a sequence of words surrounded +# by quotes) that should identify the project. + +PROJECT_NAME = axTLS + +# The PROJECT_NUMBER tag can be used to enter a project or revision number. +# This could be handy for archiving the generated documentation or +# if some version control system is used. + +PROJECT_NUMBER = + +# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) +# base path where the generated documentation will be put. +# If a relative path is entered, it will be relative to the location +# where doxygen was started. If left blank the current directory will be used. + +OUTPUT_DIRECTORY = + +# If the CREATE_SUBDIRS tag is set to YES, then doxygen will create +# 4096 sub-directories (in 2 levels) under the output directory of each output +# format and will distribute the generated files over these directories. +# Enabling this option can be useful when feeding doxygen a huge amount of +# source files, where putting all generated files in the same directory would +# otherwise cause performance problems for the file system. + +CREATE_SUBDIRS = NO + +# The OUTPUT_LANGUAGE tag is used to specify the language in which all +# documentation generated by doxygen is written. Doxygen will use this +# information to generate all constant output in the proper language. +# The default language is English, other supported languages are: +# Brazilian, Catalan, Chinese, Chinese-Traditional, Croatian, Czech, Danish, +# Dutch, Finnish, French, German, Greek, Hungarian, Italian, Japanese, +# Japanese-en (Japanese with English messages), Korean, Korean-en, Norwegian, +# Polish, Portuguese, Romanian, Russian, Serbian, Slovak, Slovene, Spanish, +# Swedish, and Ukrainian. + +OUTPUT_LANGUAGE = English + +# This tag can be used to specify the encoding used in the generated output. +# The encoding is not always determined by the language that is chosen, +# but also whether or not the output is meant for Windows or non-Windows users. +# In case there is a difference, setting the USE_WINDOWS_ENCODING tag to YES +# forces the Windows encoding (this is the default for the Windows binary), +# whereas setting the tag to NO uses a Unix-style encoding (the default for +# all platforms other than Windows). + +USE_WINDOWS_ENCODING = NO + +# If the BRIEF_MEMBER_DESC tag is set to YES (the default) Doxygen will +# include brief member descriptions after the members that are listed in +# the file and class documentation (similar to JavaDoc). +# Set to NO to disable this. + +BRIEF_MEMBER_DESC = YES + +# If the REPEAT_BRIEF tag is set to YES (the default) Doxygen will prepend +# the brief description of a member or function before the detailed description. +# Note: if both HIDE_UNDOC_MEMBERS and BRIEF_MEMBER_DESC are set to NO, the +# brief descriptions will be completely suppressed. + +REPEAT_BRIEF = YES + +# This tag implements a quasi-intelligent brief description abbreviator +# that is used to form the text in various listings. Each string +# in this list, if found as the leading text of the brief description, will be +# stripped from the text and the result after processing the whole list, is +# used as the annotated text. Otherwise, the brief description is used as-is. +# If left blank, the following values are used ("$name" is automatically +# replaced with the name of the entity): "The $name class" "The $name widget" +# "The $name file" "is" "provides" "specifies" "contains" +# "represents" "a" "an" "the" + +ABBREVIATE_BRIEF = + +# If the ALWAYS_DETAILED_SEC and REPEAT_BRIEF tags are both set to YES then +# Doxygen will generate a detailed section even if there is only a brief +# description. + +ALWAYS_DETAILED_SEC = NO + +# If the INLINE_INHERITED_MEMB tag is set to YES, doxygen will show all +# inherited members of a class in the documentation of that class as if those +# members were ordinary class members. Constructors, destructors and assignment +# operators of the base classes will not be shown. + +INLINE_INHERITED_MEMB = NO + +# If the FULL_PATH_NAMES tag is set to YES then Doxygen will prepend the full +# path before files name in the file list and in the header files. If set +# to NO the shortest path that makes the file name unique will be used. + +FULL_PATH_NAMES = NO + +# If the FULL_PATH_NAMES tag is set to YES then the STRIP_FROM_PATH tag +# can be used to strip a user-defined part of the path. Stripping is +# only done if one of the specified strings matches the left-hand part of +# the path. The tag can be used to show relative paths in the file list. +# If left blank the directory from which doxygen is run is used as the +# path to strip. + +STRIP_FROM_PATH = + +# The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of +# the path mentioned in the documentation of a class, which tells +# the reader which header file to include in order to use a class. +# If left blank only the name of the header file containing the class +# definition is used. Otherwise one should specify the include paths that +# are normally passed to the compiler using the -I flag. + +STRIP_FROM_INC_PATH = + +# If the SHORT_NAMES tag is set to YES, doxygen will generate much shorter +# (but less readable) file names. This can be useful is your file systems +# doesn't support long names like on DOS, Mac, or CD-ROM. + +SHORT_NAMES = NO + +# If the JAVADOC_AUTOBRIEF tag is set to YES then Doxygen +# will interpret the first line (until the first dot) of a JavaDoc-style +# comment as the brief description. If set to NO, the JavaDoc +# comments will behave just like the Qt-style comments (thus requiring an +# explicit @brief command for a brief description. + +JAVADOC_AUTOBRIEF = NO + +# The MULTILINE_CPP_IS_BRIEF tag can be set to YES to make Doxygen +# treat a multi-line C++ special comment block (i.e. a block of //! or /// +# comments) as a brief description. This used to be the default behaviour. +# The new default is to treat a multi-line C++ comment block as a detailed +# description. Set this tag to YES if you prefer the old behaviour instead. + +MULTILINE_CPP_IS_BRIEF = NO + +# If the DETAILS_AT_TOP tag is set to YES then Doxygen +# will output the detailed description near the top, like JavaDoc. +# If set to NO, the detailed description appears after the member +# documentation. + +DETAILS_AT_TOP = NO + +# If the INHERIT_DOCS tag is set to YES (the default) then an undocumented +# member inherits the documentation from any documented member that it +# re-implements. + +INHERIT_DOCS = YES + +# If the SEPARATE_MEMBER_PAGES tag is set to YES, then doxygen will produce +# a new page for each member. If set to NO, the documentation of a member will +# be part of the file/class/namespace that contains it. + +SEPARATE_MEMBER_PAGES = NO + +# The TAB_SIZE tag can be used to set the number of spaces in a tab. +# Doxygen uses this value to replace tabs by spaces in code fragments. + +TAB_SIZE = 4 + +# This tag can be used to specify a number of aliases that acts +# as commands in the documentation. An alias has the form "name=value". +# For example adding "sideeffect=\par Side Effects:\n" will allow you to +# put the command \sideeffect (or @sideeffect) in the documentation, which +# will result in a user-defined paragraph with heading "Side Effects:". +# You can put \n's in the value part of an alias to insert newlines. + +ALIASES = + +# Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C +# sources only. Doxygen will then generate output that is more tailored for C. +# For instance, some of the names that are used will be different. The list +# of all members will be omitted, etc. + +OPTIMIZE_OUTPUT_FOR_C = YES + +# Set the OPTIMIZE_OUTPUT_JAVA tag to YES if your project consists of Java +# sources only. Doxygen will then generate output that is more tailored for Java. +# For instance, namespaces will be presented as packages, qualified scopes +# will look different, etc. + +OPTIMIZE_OUTPUT_JAVA = NO + +# If you use STL classes (i.e. std::string, std::vector, etc.) but do not want to +# include (a tag file for) the STL sources as input, then you should +# set this tag to YES in order to let doxygen match functions declarations and +# definitions whose arguments contain STL classes (e.g. func(std::string); v.s. +# func(std::string) {}). This also make the inheritance and collaboration +# diagrams that involve STL classes more complete and accurate. + +BUILTIN_STL_SUPPORT = NO + +# If member grouping is used in the documentation and the DISTRIBUTE_GROUP_DOC +# tag is set to YES, then doxygen will reuse the documentation of the first +# member in the group (if any) for the other members of the group. By default +# all members of a group must be documented explicitly. + +DISTRIBUTE_GROUP_DOC = NO + +# Set the SUBGROUPING tag to YES (the default) to allow class member groups of +# the same type (for instance a group of public functions) to be put as a +# subgroup of that type (e.g. under the Public Functions section). Set it to +# NO to prevent subgrouping. Alternatively, this can be done per class using +# the \nosubgrouping command. + +SUBGROUPING = YES + +#--------------------------------------------------------------------------- +# Build related configuration options +#--------------------------------------------------------------------------- + +# If the EXTRACT_ALL tag is set to YES doxygen will assume all entities in +# documentation are documented, even if no documentation was available. +# Private class members and static file members will be hidden unless +# the EXTRACT_PRIVATE and EXTRACT_STATIC tags are set to YES + +EXTRACT_ALL = NO + +# If the EXTRACT_PRIVATE tag is set to YES all private members of a class +# will be included in the documentation. + +EXTRACT_PRIVATE = NO + +# If the EXTRACT_STATIC tag is set to YES all static members of a file +# will be included in the documentation. + +EXTRACT_STATIC = NO + +# If the EXTRACT_LOCAL_CLASSES tag is set to YES classes (and structs) +# defined locally in source files will be included in the documentation. +# If set to NO only classes defined in header files are included. + +EXTRACT_LOCAL_CLASSES = YES + +# This flag is only useful for Objective-C code. When set to YES local +# methods, which are defined in the implementation section but not in +# the interface are included in the documentation. +# If set to NO (the default) only methods in the interface are included. + +EXTRACT_LOCAL_METHODS = NO + +# If the HIDE_UNDOC_MEMBERS tag is set to YES, Doxygen will hide all +# undocumented members of documented classes, files or namespaces. +# If set to NO (the default) these members will be included in the +# various overviews, but no documentation section is generated. +# This option has no effect if EXTRACT_ALL is enabled. + +HIDE_UNDOC_MEMBERS = NO + +# If the HIDE_UNDOC_CLASSES tag is set to YES, Doxygen will hide all +# undocumented classes that are normally visible in the class hierarchy. +# If set to NO (the default) these classes will be included in the various +# overviews. This option has no effect if EXTRACT_ALL is enabled. + +HIDE_UNDOC_CLASSES = NO + +# If the HIDE_FRIEND_COMPOUNDS tag is set to YES, Doxygen will hide all +# friend (class|struct|union) declarations. +# If set to NO (the default) these declarations will be included in the +# documentation. + +HIDE_FRIEND_COMPOUNDS = NO + +# If the HIDE_IN_BODY_DOCS tag is set to YES, Doxygen will hide any +# documentation blocks found inside the body of a function. +# If set to NO (the default) these blocks will be appended to the +# function's detailed documentation block. + +HIDE_IN_BODY_DOCS = NO + +# The INTERNAL_DOCS tag determines if documentation +# that is typed after a \internal command is included. If the tag is set +# to NO (the default) then the documentation will be excluded. +# Set it to YES to include the internal documentation. + +INTERNAL_DOCS = NO + +# If the CASE_SENSE_NAMES tag is set to NO then Doxygen will only generate +# file names in lower-case letters. If set to YES upper-case letters are also +# allowed. This is useful if you have classes or files whose names only differ +# in case and if your file system supports case sensitive file names. Windows +# and Mac users are advised to set this option to NO. + +CASE_SENSE_NAMES = YES + +# If the HIDE_SCOPE_NAMES tag is set to NO (the default) then Doxygen +# will show members with their full class and namespace scopes in the +# documentation. If set to YES the scope will be hidden. + +HIDE_SCOPE_NAMES = NO + +# If the SHOW_INCLUDE_FILES tag is set to YES (the default) then Doxygen +# will put a list of the files that are included by a file in the documentation +# of that file. + +SHOW_INCLUDE_FILES = NO + +# If the INLINE_INFO tag is set to YES (the default) then a tag [inline] +# is inserted in the documentation for inline members. + +INLINE_INFO = YES + +# If the SORT_MEMBER_DOCS tag is set to YES (the default) then doxygen +# will sort the (detailed) documentation of file and class members +# alphabetically by member name. If set to NO the members will appear in +# declaration order. + +SORT_MEMBER_DOCS = NO + +# If the SORT_BRIEF_DOCS tag is set to YES then doxygen will sort the +# brief documentation of file, namespace and class members alphabetically +# by member name. If set to NO (the default) the members will appear in +# declaration order. + +SORT_BRIEF_DOCS = NO + +# If the SORT_BY_SCOPE_NAME tag is set to YES, the class list will be +# sorted by fully-qualified names, including namespaces. If set to +# NO (the default), the class list will be sorted only by class name, +# not including the namespace part. +# Note: This option is not very useful if HIDE_SCOPE_NAMES is set to YES. +# Note: This option applies only to the class list, not to the +# alphabetical list. + +SORT_BY_SCOPE_NAME = NO + +# The GENERATE_TODOLIST tag can be used to enable (YES) or +# disable (NO) the todo list. This list is created by putting \todo +# commands in the documentation. + +GENERATE_TODOLIST = YES + +# The GENERATE_TESTLIST tag can be used to enable (YES) or +# disable (NO) the test list. This list is created by putting \test +# commands in the documentation. + +GENERATE_TESTLIST = YES + +# The GENERATE_BUGLIST tag can be used to enable (YES) or +# disable (NO) the bug list. This list is created by putting \bug +# commands in the documentation. + +GENERATE_BUGLIST = YES + +# The GENERATE_DEPRECATEDLIST tag can be used to enable (YES) or +# disable (NO) the deprecated list. This list is created by putting +# \deprecated commands in the documentation. + +GENERATE_DEPRECATEDLIST= YES + +# The ENABLED_SECTIONS tag can be used to enable conditional +# documentation sections, marked by \if sectionname ... \endif. + +ENABLED_SECTIONS = + +# The MAX_INITIALIZER_LINES tag determines the maximum number of lines +# the initial value of a variable or define consists of for it to appear in +# the documentation. If the initializer consists of more lines than specified +# here it will be hidden. Use a value of 0 to hide initializers completely. +# The appearance of the initializer of individual variables and defines in the +# documentation can be controlled using \showinitializer or \hideinitializer +# command in the documentation regardless of this setting. + +MAX_INITIALIZER_LINES = 30 + +# Set the SHOW_USED_FILES tag to NO to disable the list of files generated +# at the bottom of the documentation of classes and structs. If set to YES the +# list will mention the files that were used to generate the documentation. + +SHOW_USED_FILES = NO + +# If the sources in your project are distributed over multiple directories +# then setting the SHOW_DIRECTORIES tag to YES will show the directory hierarchy +# in the documentation. The default is YES. + +SHOW_DIRECTORIES = NO + +# The FILE_VERSION_FILTER tag can be used to specify a program or script that +# doxygen should invoke to get the current version for each file (typically from the +# version control system). Doxygen will invoke the program by executing (via +# popen()) the command , where is the value of +# the FILE_VERSION_FILTER tag, and is the name of an input file +# provided by doxygen. Whatever the program writes to standard output +# is used as the file version. See the manual for examples. + +FILE_VERSION_FILTER = + +#--------------------------------------------------------------------------- +# configuration options related to warning and progress messages +#--------------------------------------------------------------------------- + +# The QUIET tag can be used to turn on/off the messages that are generated +# by doxygen. Possible values are YES and NO. If left blank NO is used. + +QUIET = NO + +# The WARNINGS tag can be used to turn on/off the warning messages that are +# generated by doxygen. Possible values are YES and NO. If left blank +# NO is used. + +WARNINGS = YES + +# If WARN_IF_UNDOCUMENTED is set to YES, then doxygen will generate warnings +# for undocumented members. If EXTRACT_ALL is set to YES then this flag will +# automatically be disabled. + +WARN_IF_UNDOCUMENTED = YES + +# If WARN_IF_DOC_ERROR is set to YES, doxygen will generate warnings for +# potential errors in the documentation, such as not documenting some +# parameters in a documented function, or documenting parameters that +# don't exist or using markup commands wrongly. + +WARN_IF_DOC_ERROR = YES + +# This WARN_NO_PARAMDOC option can be abled to get warnings for +# functions that are documented, but have no documentation for their parameters +# or return value. If set to NO (the default) doxygen will only warn about +# wrong or incomplete parameter documentation, but not about the absence of +# documentation. + +WARN_NO_PARAMDOC = NO + +# The WARN_FORMAT tag determines the format of the warning messages that +# doxygen can produce. The string should contain the $file, $line, and $text +# tags, which will be replaced by the file and line number from which the +# warning originated and the warning text. Optionally the format may contain +# $version, which will be replaced by the version of the file (if it could +# be obtained via FILE_VERSION_FILTER) + +WARN_FORMAT = "$file:$line: $text" + +# The WARN_LOGFILE tag can be used to specify a file to which warning +# and error messages should be written. If left blank the output is written +# to stderr. + +WARN_LOGFILE = + +#--------------------------------------------------------------------------- +# configuration options related to the input files +#--------------------------------------------------------------------------- + +# The INPUT tag can be used to specify the files and/or directories that contain +# documented source files. You may enter file names like "myfile.cpp" or +# directories like "/usr/src/myproject". Separate the files or directories +# with spaces. + +INPUT = ../bindings/csharp/axTLS.cs ../bindings/java/SSL.java ../bindings/java/SSLUtil.java ../bindings/java/SSLCTX.java ../bindings/java/SSLServer.java ../bindings/java/SSLClient.java ../bindings/java/SSLReadHolder.java ../ssl/ssl.h ../ssl/bigint.c ../ssl/bigint.h + +# If the value of the INPUT tag contains directories, you can use the +# FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp +# and *.h) to filter out the source-files in the directories. If left +# blank the following patterns are tested: +# *.c *.cc *.cxx *.cpp *.c++ *.java *.ii *.ixx *.ipp *.i++ *.inl *.h *.hh *.hxx +# *.hpp *.h++ *.idl *.odl *.cs *.php *.php3 *.inc *.m *.mm *.py + +FILE_PATTERNS = + +# The RECURSIVE tag can be used to turn specify whether or not subdirectories +# should be searched for input files as well. Possible values are YES and NO. +# If left blank NO is used. + +RECURSIVE = NO + +# The EXCLUDE tag can be used to specify files and/or directories that should +# excluded from the INPUT source files. This way you can easily exclude a +# subdirectory from a directory tree whose root is specified with the INPUT tag. + +EXCLUDE = + +# The EXCLUDE_SYMLINKS tag can be used select whether or not files or +# directories that are symbolic links (a Unix filesystem feature) are excluded +# from the input. + +EXCLUDE_SYMLINKS = NO + +# If the value of the INPUT tag contains directories, you can use the +# EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude +# certain files from those directories. Note that the wildcards are matched +# against the file with absolute path, so to exclude all test directories +# for example use the pattern */test/* + +EXCLUDE_PATTERNS = + +# The EXAMPLE_PATH tag can be used to specify one or more files or +# directories that contain example code fragments that are included (see +# the \include command). + +EXAMPLE_PATH = + +# If the value of the EXAMPLE_PATH tag contains directories, you can use the +# EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp +# and *.h) to filter out the source-files in the directories. If left +# blank all files are included. + +EXAMPLE_PATTERNS = + +# If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be +# searched for input files to be used with the \include or \dontinclude +# commands irrespective of the value of the RECURSIVE tag. +# Possible values are YES and NO. If left blank NO is used. + +EXAMPLE_RECURSIVE = NO + +# The IMAGE_PATH tag can be used to specify one or more files or +# directories that contain image that are included in the documentation (see +# the \image command). + +IMAGE_PATH = images + +# The INPUT_FILTER tag can be used to specify a program that doxygen should +# invoke to filter for each input file. Doxygen will invoke the filter program +# by executing (via popen()) the command , where +# is the value of the INPUT_FILTER tag, and is the name of an +# input file. Doxygen will then use the output that the filter program writes +# to standard output. If FILTER_PATTERNS is specified, this tag will be +# ignored. + +INPUT_FILTER = + +# The FILTER_PATTERNS tag can be used to specify filters on a per file pattern +# basis. Doxygen will compare the file name with each pattern and apply the +# filter if there is a match. The filters are a list of the form: +# pattern=filter (like *.cpp=my_cpp_filter). See INPUT_FILTER for further +# info on how filters are used. If FILTER_PATTERNS is empty, INPUT_FILTER +# is applied to all files. + +FILTER_PATTERNS = + +# If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using +# INPUT_FILTER) will be used to filter the input files when producing source +# files to browse (i.e. when SOURCE_BROWSER is set to YES). + +FILTER_SOURCE_FILES = NO + +#--------------------------------------------------------------------------- +# configuration options related to source browsing +#--------------------------------------------------------------------------- + +# If the SOURCE_BROWSER tag is set to YES then a list of source files will +# be generated. Documented entities will be cross-referenced with these sources. +# Note: To get rid of all source code in the generated output, make sure also +# VERBATIM_HEADERS is set to NO. + +SOURCE_BROWSER = NO + +# Setting the INLINE_SOURCES tag to YES will include the body +# of functions and classes directly in the documentation. + +INLINE_SOURCES = NO + +# Setting the STRIP_CODE_COMMENTS tag to YES (the default) will instruct +# doxygen to hide any special comment blocks from generated source code +# fragments. Normal C and C++ comments will always remain visible. + +STRIP_CODE_COMMENTS = YES + +# If the REFERENCED_BY_RELATION tag is set to YES (the default) +# then for each documented function all documented +# functions referencing it will be listed. + +REFERENCED_BY_RELATION = YES + +# If the REFERENCES_RELATION tag is set to YES (the default) +# then for each documented function all documented entities +# called/used by that function will be listed. + +REFERENCES_RELATION = YES + +# If the USE_HTAGS tag is set to YES then the references to source code +# will point to the HTML generated by the htags(1) tool instead of doxygen +# built-in source browser. The htags tool is part of GNU's global source +# tagging system (see http://www.gnu.org/software/global/global.html). You +# will need version 4.8.6 or higher. + +USE_HTAGS = NO + +# If the VERBATIM_HEADERS tag is set to YES (the default) then Doxygen +# will generate a verbatim copy of the header file for each class for +# which an include is specified. Set to NO to disable this. + +VERBATIM_HEADERS = NO + +#--------------------------------------------------------------------------- +# configuration options related to the alphabetical class index +#--------------------------------------------------------------------------- + +# If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index +# of all compounds will be generated. Enable this if the project +# contains a lot of classes, structs, unions or interfaces. + +ALPHABETICAL_INDEX = NO + +# If the alphabetical index is enabled (see ALPHABETICAL_INDEX) then +# the COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns +# in which this list will be split (can be a number in the range [1..20]) + +COLS_IN_ALPHA_INDEX = 5 + +# In case all classes in a project start with a common prefix, all +# classes will be put under the same header in the alphabetical index. +# The IGNORE_PREFIX tag can be used to specify one or more prefixes that +# should be ignored while generating the index headers. + +IGNORE_PREFIX = + +#--------------------------------------------------------------------------- +# configuration options related to the HTML output +#--------------------------------------------------------------------------- + +# If the GENERATE_HTML tag is set to YES (the default) Doxygen will +# generate HTML output. + +GENERATE_HTML = YES + +# The HTML_OUTPUT tag is used to specify where the HTML docs will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `html' will be used as the default path. + +HTML_OUTPUT = html + +# The HTML_FILE_EXTENSION tag can be used to specify the file extension for +# each generated HTML page (for example: .htm,.php,.asp). If it is left blank +# doxygen will generate files with .html extension. + +HTML_FILE_EXTENSION = .html + +# The HTML_HEADER tag can be used to specify a personal HTML header for +# each generated HTML page. If it is left blank doxygen will generate a +# standard header. + +HTML_HEADER = + +# The HTML_FOOTER tag can be used to specify a personal HTML footer for +# each generated HTML page. If it is left blank doxygen will generate a +# standard footer. + +HTML_FOOTER = doco_footer.html + +# The HTML_STYLESHEET tag can be used to specify a user-defined cascading +# style sheet that is used by each HTML page. It can be used to +# fine-tune the look of the HTML output. If the tag is left blank doxygen +# will generate a default style sheet. Note that doxygen will try to copy +# the style sheet file to the HTML output directory, so don't put your own +# stylesheet in the HTML output directory as well, or it will be erased! + +HTML_STYLESHEET = + +# If the HTML_ALIGN_MEMBERS tag is set to YES, the members of classes, +# files or namespaces will be aligned in HTML using tables. If set to +# NO a bullet list will be used. + +HTML_ALIGN_MEMBERS = YES + +# If the GENERATE_HTMLHELP tag is set to YES, additional index files +# will be generated that can be used as input for tools like the +# Microsoft HTML help workshop to generate a compressed HTML help file (.chm) +# of the generated HTML documentation. + +GENERATE_HTMLHELP = NO + +# If the GENERATE_HTMLHELP tag is set to YES, the CHM_FILE tag can +# be used to specify the file name of the resulting .chm file. You +# can add a path in front of the file if the result should not be +# written to the html output directory. + +CHM_FILE = + +# If the GENERATE_HTMLHELP tag is set to YES, the HHC_LOCATION tag can +# be used to specify the location (absolute path including file name) of +# the HTML help compiler (hhc.exe). If non-empty doxygen will try to run +# the HTML help compiler on the generated index.hhp. + +HHC_LOCATION = + +# If the GENERATE_HTMLHELP tag is set to YES, the GENERATE_CHI flag +# controls if a separate .chi index file is generated (YES) or that +# it should be included in the master .chm file (NO). + +GENERATE_CHI = NO + +# If the GENERATE_HTMLHELP tag is set to YES, the BINARY_TOC flag +# controls whether a binary table of contents is generated (YES) or a +# normal table of contents (NO) in the .chm file. + +BINARY_TOC = NO + +# The TOC_EXPAND flag can be set to YES to add extra items for group members +# to the contents of the HTML help documentation and to the tree view. + +TOC_EXPAND = YES + +# The DISABLE_INDEX tag can be used to turn on/off the condensed index at +# top of each HTML page. The value NO (the default) enables the index and +# the value YES disables it. + +DISABLE_INDEX = YES + +# This tag can be used to set the number of enum values (range [1..20]) +# that doxygen will group on one line in the generated HTML documentation. + +ENUM_VALUES_PER_LINE = 4 + +# If the GENERATE_TREEVIEW tag is set to YES, a side panel will be +# generated containing a tree-like index structure (just like the one that +# is generated for HTML Help). For this to work a browser that supports +# JavaScript, DHTML, CSS and frames is required (for instance Mozilla 1.0+, +# Netscape 6.0+, Internet explorer 5.0+, or Konqueror). Windows users are +# probably better off using the HTML help feature. + +GENERATE_TREEVIEW = YES + +# If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be +# used to set the initial width (in pixels) of the frame in which the tree +# is shown. + +TREEVIEW_WIDTH = 250 + +#--------------------------------------------------------------------------- +# configuration options related to the LaTeX output +#--------------------------------------------------------------------------- + +# If the GENERATE_LATEX tag is set to YES (the default) Doxygen will +# generate Latex output. + +GENERATE_LATEX = NO + +# The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `latex' will be used as the default path. + +LATEX_OUTPUT = latex + +# The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be +# invoked. If left blank `latex' will be used as the default command name. + +LATEX_CMD_NAME = latex + +# The MAKEINDEX_CMD_NAME tag can be used to specify the command name to +# generate index for LaTeX. If left blank `makeindex' will be used as the +# default command name. + +MAKEINDEX_CMD_NAME = makeindex + +# If the COMPACT_LATEX tag is set to YES Doxygen generates more compact +# LaTeX documents. This may be useful for small projects and may help to +# save some trees in general. + +COMPACT_LATEX = NO + +# The PAPER_TYPE tag can be used to set the paper type that is used +# by the printer. Possible values are: a4, a4wide, letter, legal and +# executive. If left blank a4wide will be used. + +PAPER_TYPE = a4wide + +# The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX +# packages that should be included in the LaTeX output. + +EXTRA_PACKAGES = + +# The LATEX_HEADER tag can be used to specify a personal LaTeX header for +# the generated latex document. The header should contain everything until +# the first chapter. If it is left blank doxygen will generate a +# standard header. Notice: only use this tag if you know what you are doing! + +LATEX_HEADER = + +# If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated +# is prepared for conversion to pdf (using ps2pdf). The pdf file will +# contain links (just like the HTML output) instead of page references +# This makes the output suitable for online browsing using a pdf viewer. + +PDF_HYPERLINKS = NO + +# If the USE_PDFLATEX tag is set to YES, pdflatex will be used instead of +# plain latex in the generated Makefile. Set this option to YES to get a +# higher quality PDF documentation. + +USE_PDFLATEX = NO + +# If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \\batchmode. +# command to the generated LaTeX files. This will instruct LaTeX to keep +# running if errors occur, instead of asking the user for help. +# This option is also used when generating formulas in HTML. + +LATEX_BATCHMODE = NO + +# If LATEX_HIDE_INDICES is set to YES then doxygen will not +# include the index chapters (such as File Index, Compound Index, etc.) +# in the output. + +LATEX_HIDE_INDICES = NO + +#--------------------------------------------------------------------------- +# configuration options related to the RTF output +#--------------------------------------------------------------------------- + +# If the GENERATE_RTF tag is set to YES Doxygen will generate RTF output +# The RTF output is optimized for Word 97 and may not look very pretty with +# other RTF readers or editors. + +GENERATE_RTF = NO + +# The RTF_OUTPUT tag is used to specify where the RTF docs will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `rtf' will be used as the default path. + +RTF_OUTPUT = rtf + +# If the COMPACT_RTF tag is set to YES Doxygen generates more compact +# RTF documents. This may be useful for small projects and may help to +# save some trees in general. + +COMPACT_RTF = NO + +# If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated +# will contain hyperlink fields. The RTF file will +# contain links (just like the HTML output) instead of page references. +# This makes the output suitable for online browsing using WORD or other +# programs which support those fields. +# Note: wordpad (write) and others do not support links. + +RTF_HYPERLINKS = NO + +# Load stylesheet definitions from file. Syntax is similar to doxygen's +# config file, i.e. a series of assignments. You only have to provide +# replacements, missing definitions are set to their default value. + +RTF_STYLESHEET_FILE = + +# Set optional variables used in the generation of an rtf document. +# Syntax is similar to doxygen's config file. + +RTF_EXTENSIONS_FILE = + +#--------------------------------------------------------------------------- +# configuration options related to the man page output +#--------------------------------------------------------------------------- + +# If the GENERATE_MAN tag is set to YES (the default) Doxygen will +# generate man pages + +GENERATE_MAN = NO + +# The MAN_OUTPUT tag is used to specify where the man pages will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `man' will be used as the default path. + +MAN_OUTPUT = man + +# The MAN_EXTENSION tag determines the extension that is added to +# the generated man pages (default is the subroutine's section .3) + +MAN_EXTENSION = .3 + +# If the MAN_LINKS tag is set to YES and Doxygen generates man output, +# then it will generate one additional man file for each entity +# documented in the real man page(s). These additional files +# only source the real man page, but without them the man command +# would be unable to find the correct page. The default is NO. + +MAN_LINKS = NO + +#--------------------------------------------------------------------------- +# configuration options related to the XML output +#--------------------------------------------------------------------------- + +# If the GENERATE_XML tag is set to YES Doxygen will +# generate an XML file that captures the structure of +# the code including all documentation. + +GENERATE_XML = NO + +# The XML_OUTPUT tag is used to specify where the XML pages will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `xml' will be used as the default path. + +XML_OUTPUT = xml + +# The XML_SCHEMA tag can be used to specify an XML schema, +# which can be used by a validating XML parser to check the +# syntax of the XML files. + +XML_SCHEMA = + +# The XML_DTD tag can be used to specify an XML DTD, +# which can be used by a validating XML parser to check the +# syntax of the XML files. + +XML_DTD = + +# If the XML_PROGRAMLISTING tag is set to YES Doxygen will +# dump the program listings (including syntax highlighting +# and cross-referencing information) to the XML output. Note that +# enabling this will significantly increase the size of the XML output. + +XML_PROGRAMLISTING = YES + +#--------------------------------------------------------------------------- +# configuration options for the AutoGen Definitions output +#--------------------------------------------------------------------------- + +# If the GENERATE_AUTOGEN_DEF tag is set to YES Doxygen will +# generate an AutoGen Definitions (see autogen.sf.net) file +# that captures the structure of the code including all +# documentation. Note that this feature is still experimental +# and incomplete at the moment. + +GENERATE_AUTOGEN_DEF = NO + +#--------------------------------------------------------------------------- +# configuration options related to the Perl module output +#--------------------------------------------------------------------------- + +# If the GENERATE_PERLMOD tag is set to YES Doxygen will +# generate a Perl module file that captures the structure of +# the code including all documentation. Note that this +# feature is still experimental and incomplete at the +# moment. + +GENERATE_PERLMOD = NO + +# If the PERLMOD_LATEX tag is set to YES Doxygen will generate +# the necessary Makefile rules, Perl scripts and LaTeX code to be able +# to generate PDF and DVI output from the Perl module output. + +PERLMOD_LATEX = NO + +# If the PERLMOD_PRETTY tag is set to YES the Perl module output will be +# nicely formatted so it can be parsed by a human reader. This is useful +# if you want to understand what is going on. On the other hand, if this +# tag is set to NO the size of the Perl module output will be much smaller +# and Perl will parse it just the same. + +PERLMOD_PRETTY = YES + +# The names of the make variables in the generated doxyrules.make file +# are prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX. +# This is useful so different doxyrules.make files included by the same +# Makefile don't overwrite each other's variables. + +PERLMOD_MAKEVAR_PREFIX = + +#--------------------------------------------------------------------------- +# Configuration options related to the preprocessor +#--------------------------------------------------------------------------- + +# If the ENABLE_PREPROCESSING tag is set to YES (the default) Doxygen will +# evaluate all C-preprocessor directives found in the sources and include +# files. + +ENABLE_PREPROCESSING = YES + +# If the MACRO_EXPANSION tag is set to YES Doxygen will expand all macro +# names in the source code. If set to NO (the default) only conditional +# compilation will be performed. Macro expansion can be done in a controlled +# way by setting EXPAND_ONLY_PREDEF to YES. + +MACRO_EXPANSION = YES + +# If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES +# then the macro expansion is limited to the macros specified with the +# PREDEFINED and EXPAND_AS_DEFINED tags. + +EXPAND_ONLY_PREDEF = YES + +# If the SEARCH_INCLUDES tag is set to YES (the default) the includes files +# in the INCLUDE_PATH (see below) will be search if a #include is found. + +SEARCH_INCLUDES = YES + +# The INCLUDE_PATH tag can be used to specify one or more directories that +# contain include files that are not input files but should be processed by +# the preprocessor. + +INCLUDE_PATH = + +# You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard +# patterns (like *.h and *.hpp) to filter out the header-files in the +# directories. If left blank, the patterns specified with FILE_PATTERNS will +# be used. + +INCLUDE_FILE_PATTERNS = + +# The PREDEFINED tag can be used to specify one or more macro names that +# are defined before the preprocessor is started (similar to the -D option of +# gcc). The argument of the tag is a list of macros of the form: name +# or name=definition (no spaces). If the definition and the = are +# omitted =1 is assumed. To prevent a macro definition from being +# undefined via #undef or recursively expanded use the := operator +# instead of the = operator. + +PREDEFINED = CONFIG_SSL_CERT_VERIFICATION CONFIG_SSL_ENABLE_CLIENT CONFIG_SSL_MAX_CLNT_SESSIONS=1 CONFIG_BIGINT_MONTGOMERY CONFIG_BIGINT_BARRETT EXP_FUNC="" STDCALL="" + +# If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then +# this tag can be used to specify a list of macro names that should be expanded. +# The macro definition that is found in the sources will be used. +# Use the PREDEFINED tag if you want to use a different macro definition. + +EXPAND_AS_DEFINED = + +# If the SKIP_FUNCTION_MACROS tag is set to YES (the default) then +# doxygen's preprocessor will remove all function-like macros that are alone +# on a line, have an all uppercase name, and do not end with a semicolon. Such +# function macros are typically used for boiler-plate code, and will confuse +# the parser if not removed. + +SKIP_FUNCTION_MACROS = YES + +#--------------------------------------------------------------------------- +# Configuration::additions related to external references +#--------------------------------------------------------------------------- + +# The TAGFILES option can be used to specify one or more tagfiles. +# Optionally an initial location of the external documentation +# can be added for each tagfile. The format of a tag file without +# this location is as follows: +# TAGFILES = file1 file2 ... +# Adding location for the tag files is done as follows: +# TAGFILES = file1=loc1 "file2 = loc2" ... +# where "loc1" and "loc2" can be relative or absolute paths or +# URLs. If a location is present for each tag, the installdox tool +# does not have to be run to correct the links. +# Note that each tag file must have a unique name +# (where the name does NOT include the path) +# If a tag file is not located in the directory in which doxygen +# is run, you must also specify the path to the tagfile here. + +TAGFILES = + +# When a file name is specified after GENERATE_TAGFILE, doxygen will create +# a tag file that is based on the input files it reads. + +GENERATE_TAGFILE = + +# If the ALLEXTERNALS tag is set to YES all external classes will be listed +# in the class index. If set to NO only the inherited external classes +# will be listed. + +ALLEXTERNALS = NO + +# If the EXTERNAL_GROUPS tag is set to YES all external groups will be listed +# in the modules index. If set to NO, only the current project's groups will +# be listed. + +EXTERNAL_GROUPS = NO + +# The PERL_PATH should be the absolute path and name of the perl script +# interpreter (i.e. the result of `which perl'). + +PERL_PATH = /usr/bin/perl + +#--------------------------------------------------------------------------- +# Configuration options related to the dot tool +#--------------------------------------------------------------------------- + +# If the CLASS_DIAGRAMS tag is set to YES (the default) Doxygen will +# generate a inheritance diagram (in HTML, RTF and LaTeX) for classes with base +# or super classes. Setting the tag to NO turns the diagrams off. Note that +# this option is superseded by the HAVE_DOT option below. This is only a +# fallback. It is recommended to install and use dot, since it yields more +# powerful graphs. + +CLASS_DIAGRAMS = YES + +# If set to YES, the inheritance and collaboration graphs will hide +# inheritance and usage relations if the target is undocumented +# or is not a class. + +HIDE_UNDOC_RELATIONS = YES + +# If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is +# available from the path. This tool is part of Graphviz, a graph visualization +# toolkit from AT&T and Lucent Bell Labs. The other options in this section +# have no effect if this option is set to NO (the default) + +HAVE_DOT = NO + +# If the CLASS_GRAPH and HAVE_DOT tags are set to YES then doxygen +# will generate a graph for each documented class showing the direct and +# indirect inheritance relations. Setting this tag to YES will force the +# the CLASS_DIAGRAMS tag to NO. + +CLASS_GRAPH = NO + +# If the COLLABORATION_GRAPH and HAVE_DOT tags are set to YES then doxygen +# will generate a graph for each documented class showing the direct and +# indirect implementation dependencies (inheritance, containment, and +# class references variables) of the class with other documented classes. + +COLLABORATION_GRAPH = NO + +# If the GROUP_GRAPHS and HAVE_DOT tags are set to YES then doxygen +# will generate a graph for groups, showing the direct groups dependencies + +GROUP_GRAPHS = NO + +# If the UML_LOOK tag is set to YES doxygen will generate inheritance and +# collaboration diagrams in a style similar to the OMG's Unified Modeling +# Language. + +UML_LOOK = NO + +# If set to YES, the inheritance and collaboration graphs will show the +# relations between templates and their instances. + +TEMPLATE_RELATIONS = NO + +# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDE_GRAPH, and HAVE_DOT +# tags are set to YES then doxygen will generate a graph for each documented +# file showing the direct and indirect include dependencies of the file with +# other documented files. + +INCLUDE_GRAPH = NO + +# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDED_BY_GRAPH, and +# HAVE_DOT tags are set to YES then doxygen will generate a graph for each +# documented header file showing the documented files that directly or +# indirectly include this file. + +INCLUDED_BY_GRAPH = NO + +# If the CALL_GRAPH and HAVE_DOT tags are set to YES then doxygen will +# generate a call dependency graph for every global function or class method. +# Note that enabling this option will significantly increase the time of a run. +# So in most cases it will be better to enable call graphs for selected +# functions only using the \callgraph command. + +CALL_GRAPH = NO + +# If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen +# will graphical hierarchy of all classes instead of a textual one. + +GRAPHICAL_HIERARCHY = NO + +# If the DIRECTORY_GRAPH, SHOW_DIRECTORIES and HAVE_DOT tags are set to YES +# then doxygen will show the dependencies a directory has on other directories +# in a graphical way. The dependency relations are determined by the #include +# relations between the files in the directories. + +DIRECTORY_GRAPH = NO + +# The DOT_IMAGE_FORMAT tag can be used to set the image format of the images +# generated by dot. Possible values are png, jpg, or gif +# If left blank png will be used. + +DOT_IMAGE_FORMAT = png + +# The tag DOT_PATH can be used to specify the path where the dot tool can be +# found. If left blank, it is assumed the dot tool can be found in the path. + +DOT_PATH = + +# The DOTFILE_DIRS tag can be used to specify one or more directories that +# contain dot files that are included in the documentation (see the +# \dotfile command). + +DOTFILE_DIRS = + +# The MAX_DOT_GRAPH_WIDTH tag can be used to set the maximum allowed width +# (in pixels) of the graphs generated by dot. If a graph becomes larger than +# this value, doxygen will try to truncate the graph, so that it fits within +# the specified constraint. Beware that most browsers cannot cope with very +# large images. + +MAX_DOT_GRAPH_WIDTH = 1024 + +# The MAX_DOT_GRAPH_HEIGHT tag can be used to set the maximum allows height +# (in pixels) of the graphs generated by dot. If a graph becomes larger than +# this value, doxygen will try to truncate the graph, so that it fits within +# the specified constraint. Beware that most browsers cannot cope with very +# large images. + +MAX_DOT_GRAPH_HEIGHT = 1024 + +# The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the +# graphs generated by dot. A depth value of 3 means that only nodes reachable +# from the root by following a path via at most 3 edges will be shown. Nodes +# that lay further from the root node will be omitted. Note that setting this +# option to 1 or 2 may greatly reduce the computation time needed for large +# code bases. Also note that a graph may be further truncated if the graph's +# image dimensions are not sufficient to fit the graph (see MAX_DOT_GRAPH_WIDTH +# and MAX_DOT_GRAPH_HEIGHT). If 0 is used for the depth value (the default), +# the graph is not depth-constrained. + +MAX_DOT_GRAPH_DEPTH = 0 + +# Set the DOT_TRANSPARENT tag to YES to generate images with a transparent +# background. This is disabled by default, which results in a white background. +# Warning: Depending on the platform used, enabling this option may lead to +# badly anti-aliased labels on the edges of a graph (i.e. they become hard to +# read). + +DOT_TRANSPARENT = NO + +# Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output +# files in one run (i.e. multiple -o and -T options on the command line). This +# makes dot run faster, but since only newer versions of dot (>1.8.10) +# support this, this feature is disabled by default. + +DOT_MULTI_TARGETS = NO + +# If the GENERATE_LEGEND tag is set to YES (the default) Doxygen will +# generate a legend page explaining the meaning of the various boxes and +# arrows in the dot generated graphs. + +GENERATE_LEGEND = YES + +# If the DOT_CLEANUP tag is set to YES (the default) Doxygen will +# remove the intermediate dot files that are used to generate +# the various graphs. + +DOT_CLEANUP = YES + +#--------------------------------------------------------------------------- +# Configuration::additions related to the search engine +#--------------------------------------------------------------------------- + +# The SEARCHENGINE tag specifies whether or not a search engine should be +# used. If set to NO the values of all tags below this one will be ignored. + +SEARCHENGINE = NO diff --git a/docsrc/doco_footer.html b/docsrc/doco_footer.html new file mode 100644 index 0000000000..84c2b81e54 --- /dev/null +++ b/docsrc/doco_footer.html @@ -0,0 +1,3 @@ +

+

+Copyright � 2006 diff --git a/docsrc/images/axolotl.jpg b/docsrc/images/axolotl.jpg new file mode 100644 index 0000000000000000000000000000000000000000..7352bbae836739e469c837a7fdb8114f786b2130 GIT binary patch literal 3041 zcmbW3cTm%58pnSjB!MU;N>O@=NRbjk3lRun2%sWhXhPVfgr;7!<++gTdge zEO0g+cDA!;+4#?Maq@@=h=~dd2n&fzqGiM-6eNU%uV~0BD63%9F=8@WI+|)aXf=!~ zh!qZJJHy7u&d#Tb6h^B4&pP=4$^`%r1oVf1e+t9|W`;mvEUfS|AOQSlc6$Gr{!7RS zFoD2eCT1`M!pwZyCiFA|m=Tb3q9|?Xd1G6cm=~8~c;X8d@oSYW+$MvYNVJ`I1S_0} z_rgWKOA?nQrKFXVRaDh5>N?l)x&%FagF8f1Gjj{eyY>!bM<-_&S07)$2mS$pL6K3> zF+V^0g_4wS4OIyEF{{j8qF-QDg(0?)ig?!QsAXoq*;06Yr(j!1% z1n6WEI12`yKEMb-3)nvbB!TBlVeo%1%vVZSkpMPR1+2MGqWR7gFczIJUnDw#SKbKt z35Mb&hWO0KGyJeTHI!NRIcFpiNog)_MsCx>3cuve& zY8_v>&G~*t+o4e7x?2ZhL>0|&)UBM;us1U2y+hqnr1zl8MlP&TeKtmuu@xzyFTbtD z5^IB{EM;G3EEpmmqXCXWW)tsNQi5e`*4;)8rcd85vLma>Z~`hhbuC-<;K-!GCL)Jh zEBdKs`V}XSz67XOgOjI5xZvM}`wGkrmbP7O4@qf@mW70RxAxL?nSpqg6F{rH(V+zU zM9oUqH*GSU1=8P5FsH)k%e%`v%Opgmb1$`hxlFVsx*(Gne`&s60CX^#buRD(cy!fq z?6)oX!6DzotoaO!ym?jfI*Z`9ATNt<^MRGTpBejEn0uX3a@0k?UfR=k;!}#J8a-_l zYnQAqQ#}w7Wjgvx=tA&otci52@7iF4ZCmTl>vRq6omFR>h`1mj@&@FdKc8HKED|SM zMlufH?L)6>f8(HW^EzHJ67AiY3`3|uBIluZaA@EwfvIt-w0T`>aDlYNwO}bt8u5jd?o?J5z}+0Ypf^v>Umdw)Bp7T;JrUnMvzb zZOxlA>YX1AXRzSoc6;S+PfG*!b-#Bl4mf(`WIk3P$!y@`mh#*FWASuji|hQ)P;;gW zG2T;z@(}-{Z7ZsN>A9r3jsTJsG4rcg>g4S#r;PZ;G_CH;QGx>_55i?%RwguO_13z+ zW_|k@&LP~Rb$2XP)hDyznX0_qa8N;BwM;!XL9;zrDz-^9hOzR%4DZcR)Nugs`?NJ) z`ek5Vqo8}i-7O6lL>Zu8*3W(XI7x>4GpJ9JEdf0oLb&Guzvkar$Q+6#c3DYor~H^)#;IDGE?``QB?^dO#pSy8^8!k*Ga`&_)QNa zd`O!9nKGw)*tOuPfQqDD*w|RUMN81N+nj!%%TIzR%cOi&$>-ANhu*)g4IW^RJZ9t? zdyO*sxmQQBAD$mtqqMtL0=c65+TcSo6Q?I{$zT1|X3m;j?Y+;&qbDFRb2ReXjbyv5 z=Evx0in1l^6>c2+ZR?|C(~C;&ZtTDTMydE?%q+56E~IgSyp&3zw^6TUVk6j)frH~&EfNuGP*;$ zePNy!P@BM|KyH1D?Ls+6J8Ng-er#uAZZxR`Xzp*)D9u^#AiCC;TK^J)_TXojbr~7r zzJ53XaB6v0adVg4SjZJMkqk01C3f9|c6g^!bJSy?wUNeDGJ8W0tp0rFd>HTL&#=W? zg2Sba=GQu6X735!iW;+VyyLo^WL5W#WAS=UX7Z!V%=d)nIspX=waeB?NroL_;V&T6 zt!D-?8x@E5ttq#9vJ+afZK9NI6E54I04sS`(->d16F~S|nFhN|DTc&{2}^ceoc}R! zuLb-pXgyDMkQiusJ5=Z)OJi;LaZeo?Z|Z1f->*4R>XawF8Fgq<>7-Xt6JfiTasm*H zwELMiamTvad2>z@@;r>b2-zDqtH~;6deu_QT9?9i_g08WSI49@db4D8jO*gE*Qo)0 zF3EPW@7pYaXKSv`#odI#O&OD2ggeKJWdn_LsHS22g5=g22W-yDJod-*G7Q)e(2 zuS{1eSM5I_kT5M+#i1ol@%o{rNd{MJ+0I$Rxu)7>qtCv2zfIZBtvPz4P6x>kkJk8B z-J&JXuVb`d*wGA<;3B+TOS--izD3pYJMiZFzd|?)a!ZP%3gtkIATQPdUnp= ztj%21s>#ysY|6z=NnA!V084S|9F2h0Uy@tw0pjfVJlx*VQb)aQ} zUQ3)CSFf=1IRJ_s$hqkb59mKI_4&c>Zsqi(i^3F+Q{Lc(5P7cD z^3w1Wivc4HCGht^u~tb6^&>m$qLxjV&m9NTPn}CUx1m#ktVOOhiD&L_^577Szxwac zw~JGr$g)>$5UXkj%QbuaJ;X{^0ui$nMi_gG{ijvO44YZFF;e-rh?P*gO4< zKVe(17IiCQB=Qkgm4nhcD;idd*ge(qQn}3$(n$;_d$y4#R^AfOs=3x^;Y8w^rT36? zDm)H9yeKmt7WNZN=WM0;7?)L70FDjXJOIvGbtc}M5qZ0C-AL5W|Tn>-g(X{+`5+quqaA0 zeJe;yqcG7a!21E+l^7#uuzDzTD1?DJG=lJKre?z_0YgBWum)r&vMBn1K~d@wkSz!lB1iz2C}aQ?8-W%|T>|6kzOH~{(BAYt}7wXaX0*FwLb>5w{=e+0tZ_b>1=H7ho@Av)uz9*rA zki|tMdU<)FD9Y#aMIsS~VQFb;GMP-NRN^>ZQ&ZE_)I<=3R;wKx z92^=N8XX2xGX;!ujB1Qfv)!w6Uc01N;e00ICKz9>p!7>VN~L69gQP(Wf(iQ@1B z$4Cs|a0{!zpD=iWk_1lTfWT24ZV8OQ;R+7{uJ1(XI}z|)-wA`)p_l+9315^XG3bb- zIsu#jupdsK7!;5gP67_(yLBZA3%g7j%b6cVOK zLaC|4h$tl3Qg2T0o{ESTB5HPU-jJM16tv zA{FDFEOC{rAdb$PesyU<-@(sjE;ewyyd~7o!eAs$syx?qz{uCoJ=#%5s|mPb=p}PZ zyWNd!#(IB}@}pEn{)Hcnnw=Bt_N9n&xdN+-Qu5`2l&>+GwePMT06Oqw=Cvey~$$G0jZ0PaAI}@>3=; zV=z(L7N^4g+yzdIwL-T0_a)yjoCa3YS>n)Wx}CLSq97Q#ypF-?kjrQxN8)7xx7jp>=FigX2R2k9M zUcz#tM@E&Gw>3VGrq|{LX*5i?GrBetzt_5UcBtoAhk5+gu}*I4nXzAOb6$^Kcii{E zJC75|N3Oc9lzK5Z(YiOs%)-1h1Usy?kzihr`1i5gD4-!`-0?imFfUsgP`uP?en7G5 z;K3|yuuzQN37gpQvTMaeM0Verfr|5eu5PxIbo1=9nRi8gt&R7?gc*~)V$$=%!1AZ} z>$~EUGaBz>rDSBvfTX=e*S*x?c1}-_Lq+c6#Cdg#2x+@X_B}~`i!UJ=R=g!#A8z&S z_nF$UkkQ;_mo-!nZ=XH7ChP3Nu46y%n(SpcJjoq0NwfR9>+HN;c?|wM+lhPT73Rr7 zOJ<48A_R(OV#zg)d4*V&P&K%c_U+u?CAhbmPuJ!=lcYuqo`NC{(E-ZZ{j*EK3D#zQ z^0DnN?yjNv%8oD!LU{QN0uP}oXdKwbs1rx-79BP{RgbWLN{_0&acNi$s(H_szfJGL zEPKwBJS*}dhfT^u0+k-P+>f3staI*MQ7m!;0)<>|+Ez9Lq|%!5WnVI5t*5^#6dtcV z!6*BDI1zo7u|nhiN}J)itfsK|k;6raC5K%IH9LIq`&n!FrZNNp;W3S@53Mhi`$k_O zTid=XsOg-;34Ff5_$G&LD)q3r80zbtV2p83nO}?)BuuO{4xXiw9k!J$Ta-df82Y%` z{!vrFZ0enTZhV=MuOscfvxy`(Mfs|jy=(dYl-*%RlvAD8!G~l)I!~zz6c!_lc8kL1 zam#8?sf&vT?-uKR-Cp%xwB!mAuzAFM?+!QTaz%>M?$!8oEEW*WVP@)5o%6$tL+1pV zUftws=D+B?d+E6Ra=0@Bbl>@{OVDoHHc@`^k=ydpd?(4=l*Z(Z=qfu8K0ZE0*4|Qv zCoKG?x`3N$wa8mco54A_#k0Ng(xc2EgL0yDm{(md|J~{5=91O#e69<&-3jQ>$m>{I zPMo&CQZU^J&soR+>?6?ZlrZM-1J~ zF36HS{Vk>b>|E=*KnwE<(@9}=1;}xg3d-$yl?IHbJ3v6k@OgOyd=wlw zm3HV0D>N}|x@@XtG_pQ#;MS9O%~Mx(hw68{T=n$*gQ;JpZ`bddy7lzq`>AVSR)cIt p#1L)vbSpEep}>k5GW>j6!!Byr>lX1FD`~oo+ucz3cs3h+{vVmAG${Z8 literal 0 HcmV?d00001 diff --git a/httpd/Config.in b/httpd/Config.in new file mode 100644 index 0000000000..6b450f2bee --- /dev/null +++ b/httpd/Config.in @@ -0,0 +1,141 @@ +# +# For a description of the syntax of this configuration file, +# see scripts/config/Kconfig-language.txt +# + +menu "Awhttpd Configuration" +depends on CONFIG_AWHTTPD + +config CONFIG_HTTP_STATIC_BUILD + bool "Static Build" + default n + help + Select y if you want awhttp to be a static build (i.e. don't use the + axtls shared library or dll). + +config CONFIG_HTTP_HAS_SSL + bool "Use SSL" + default y + help + Build the HTTP server with SSL capability + +config CONFIG_HTTP_HTTPS_PORT + int "HTTPS port" + default 443 + depends on CONFIG_HTTP_HAS_SSL + help + The port number of the HTTPS server. + + You must be a root user in order to use the default port. + +config CONFIG_STANDARD_AWHTTPD + bool "Use Standard AWHTTPD Configuration" + default n + help + Use the configuration file that awhttpd normally uses. + +config CONFIG_HTTP_WEBROOT + string "Web root location" + default "www" + depends on !CONFIG_STANDARD_AWHTTPD + help + The location of the web root. This is the directory where + index.html lives. + +config CONFIG_HTTP_PORT + int "HTTP port" + default 80 + depends on !CONFIG_STANDARD_AWHTTPD + help + The port number of the normal HTTP server. + + You must be a root user in order to use the default port. + +config CONFIG_HTTP_USE_TIMEOUT + bool "Use Timeout" + default n + depends on !CONFIG_STANDARD_AWHTTPD + help + Enable timeouts to be used. + +config CONFIG_HTTP_TIMEOUT + int "Timeout" + default 5 + depends on CONFIG_HTTP_USE_TIMEOUT + help + Set the timeout in seconds. + +config CONFIG_HTTP_INITIAL_SLOTS + int "Initial Slots" + default 10 + depends on !CONFIG_STANDARD_AWHTTPD + help + Determine the number of slots. + + This is just an initial value to allocate memory. This will go all the + way up to max usrs. + +config CONFIG_HTTP_MAX_USERS + int "Max Users" + default 100 + depends on !CONFIG_STANDARD_AWHTTPD + help + Determine the maximum number of simultaneous users at any time + +config CONFIG_HTTP_HAS_CGI + bool "Enable CGI" + default n + depends on !CONFIG_STANDARD_AWHTTPD + help + Enable the CGI capability. + +config CONFIG_HTTP_CGI_EXTENSION + string "CGI File Extension" + default ".php" + depends on CONFIG_HTTP_HAS_CGI + help + Tell awhhtp what file extension is used for CGI + +config CONFIG_HTTP_DIRECTORIES + bool "Enable Directory Listing" + default n + depends on !CONFIG_STANDARD_AWHTTPD + help + Enable directory listing. + +config CONFIG_HTTP_PERM_CHECK + bool "Permissions Check" + default n + depends on !CONFIG_STANDARD_AWHTTPD + help + Enable permissions checking on the directories before reading the + files in them. + +config CONFIG_HTTP_HAS_IPV6 + bool "Enable IPv6" + default n + depends on !CONFIG_STANDARD_AWHTTPD && !CONFIG_PLATFORM_WIN32 + help + Use IPv6 instead of IPv4. + + Does not work under Win32 + +config CONFIG_HTTP_VERBOSE + bool "Verbose Mode" + default y if CONFIG_SSL_FULL_MODE + default n if !CONFIG_SSL_FULL_MODE + depends on !CONFIG_STANDARD_AWHTTPD + help + Enable extra statements used when using awhttpd. + +config CONFIG_HTTP_IS_DAEMON + bool "Run as a daemon" + default n + depends on !CONFIG_STANDARD_AWHTTPD && !CONFIG_PLATFORM_WIN32 + help + Run awhttpd as a background process. + + Does not work under Win32 + +endmenu + diff --git a/httpd/Makefile b/httpd/Makefile new file mode 100644 index 0000000000..66e2908bd9 --- /dev/null +++ b/httpd/Makefile @@ -0,0 +1,111 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +all : web_server + +include ../config/.config +include ../config/makefile.conf + +ifndef CONFIG_PLATFORM_WIN32 + +ifdef CONFIG_PLATFORM_CYGWIN +TARGET=../awhttpd.exe +else +TARGET=../awhttpd +endif + +ifdef CONFIG_HTTP_STATIC_BUILD +LIBS=../libaxtls.a +else +LIBS=-L../ -laxtls +endif + +CFLAGS += -I../ssl + +else # win32 build +TARGET=../awhttpd.exe + +ifdef CONFIG_HTTP_STATIC_BUILD +LIBS=../axtls.static.lib ..\config\axtls.res +else +LIBS=../axtls.lib ..\config\axtls.res +endif +endif + +ifndef CONFIG_AWHTTPD +web_server: +else + +untar_web_server: awhttpd/Makefile + +awhttpd/Makefile: + tar xvf awhttpd-3.0.7.tar + cat awhttpd.patch | patch -p0 + +web_server : $(TARGET) + +OBJ= \ + cgi.o \ + conn.o \ + main.o \ + net.o \ + proc.o \ + socket.o \ + errors.o \ + misc.o \ + urldecode.o \ + mime_types.o \ + index.o \ + urlencode.o \ + permcheck.o \ + conf.o + +%.o : awhttpd/%.c ../config/.config + $(CC) -c $(CFLAGS) $< + +ifndef CONFIG_PLATFORM_WIN32 + +$(TARGET): $(OBJ) +ifdef CONFIG_HTTP_NO_SSL + $(LD) $(LDFLAGS) -o $@ $(OBJ) +endif + $(LD) $(LDFLAGS) -o $@ $(OBJ) $(LIBS) +ifndef CONFIG_DEBUG +ifndef CONFIG_PLATFORM_SOLARIS + strip --remove-section=.comment $(TARGET) +endif +endif +else # Win32 + +OBJ:=$(OBJ:.o=.obj) +%.obj : awhttpd/%.c + $(CC) $(CFLAGS) $< + +$(TARGET): $(OBJ) +ifdef CONFIG_HTTP_NO_SSL + $(LD) $(LDFLAGS) /out:$@ $(OBJ) +endif + $(LD) $(LDFLAGS) $(LIBS) /out:$@ $(OBJ) +endif + +endif # CONFIG_AWHTTPD + +clean:: + -@rm -f $(TARGET)* + -@rm -fr awhttpd + diff --git a/httpd/awhttpd-3.0.7.tar b/httpd/awhttpd-3.0.7.tar new file mode 100644 index 0000000000000000000000000000000000000000..79105fbe196f7f57ab442485351d5b69b4d87e2f GIT binary patch literal 194560 zcmeFaYkM2Vk-wd{!S(+TV>*dQnP=*d$g*}JijtU6BtueGyml__5Ezh%Kmfsk2Rqr1 z{k(qeUsd-U0FaawX*atOuf!r}daApttLxm=>BZ@2)Nii*;uHR?^7HWi{a^6U+Qa*+ z<$v``KfhR8-FWce{=>D6^#{LLU0c8RVD%Tt{ZBZi9Q1fNN(V{ui)L?pl0TgB%Wdy{ z9yU3f&KFZT`(KgkeL(e^1kiu+^{;nF?WH%_aZ(?TPJ4r4?Y|~|YPF-&_Audpqth&D^v?R7Y?LLP_HdN+ zTJ|u9@$%?s|5?%>^!}1HMoBX}&pN$+HW)4^+pXI6o%1Yd^#&)s(J1RCSG{p^nhmnW zq&>PbOpdcgIv!>Md3KfbF1ks(tIp`F+sKxa{Z5wh`YdgCYG+xJcALreolYldwJ#Y1 zqpKg*_m`8UXKdqIt)_pHm%S@SI{$o-Hb!X&fXT4Ox5M6e(6FhTW!=$mQ3F0sk2_Zj zQGzuW_S!e8?Fqp zes7>rFk2f>ZFt%ncbZ@%88W_P)Jsm=XS5y+N6WR^L6(BjFw)xopm*MGX3gY0?Tnd2 zmW;CDsNFrWF+`Bb#VHuCzez4qRua^X^iM18Hm-p9AE~W+ZL`-M4cf=!5#Z9KJ3c#R zDy&C89W_of`w$T6C^=_I+r4hGzP!fVN-eX?M%L*t=vtg9bn=cdK{>CsUu`9$tG;Hh z)q8!g1BEntO&jchB^~9x`;=+d>2*(P7wyq$bwJqwIyz(cP6%-D<94S#x{5<(QhTpA zg`?WuyR@60q}}9ow{7F5)n<=DoX%i46UsVptPkltn4xcgrgTk+U{c5?3hs-dOz)T zvf*;=b(bDT<8C_YWLJwx7!HN2ir&AG5J>+?4sFjB&|X33<5tHT=mn&J1}|}rX2Bd&8E@g+99KLa?>8{WM_#j zc4R2zK(1Bxvv>LmYD}|E@^m~nfu*&o{c7FboVH;# z?AYwAZ`?)%TkMyY`>+4Bm_#tm_OQ`o@8wvH__W2Y#l>c}e@NTOZaaejE0`?E#P^|b zPmol9qm^t7+CGLrAfr>J)G!w6B1NcgrrBAqt9{iNq{CDCs&`-tuf~G`9IG_wRSb?)OFfqLo+ul<~;lNS*w+7vDL~8S9?~b(3~}h zf2w~8Jr>nFOHKv|arh)Jgi<3E$z`AI=5q34kfQf=rtl`rjZaRT9Uxz`i$zJ&E6JbM z7){2NgGb36^BJFIa{x6pW)mW9qbH^B(qt~1n?R&5c5PF`vK?jvWNUSsy$dZgQp|ay zOBs-uo})#XvH&3pyUcLd9*LbDo%YUHffqkqwjPXrT%PQ!b|{U6si!V#ZEJuATN`y1 z1Tm0arC=UVTWAqe$SA=XwfjkWEGm!?LX1PO3`;CzIXPl*YQUfaA+*GJ_V*5s>QA?K zTonDD=Fd@G>F6Y2>Bk?l=4?a>T}AIua8y~sgp3qX3{WWFuxt9h(#`e&jaJf9dM`r^ zvY^p}e>6l6Qb<5Q;!#`Z4I3KTuXoNe8&-wf!uI^Hn)WB(MDjJ|v@sYrB)p5wl@JQFU&k0WyWr1rjr%z>2fm(xxPaby*f6n=iJL;kd7*T&_)6 zN}vDyKZt>7|0AAuUu^wP*#B$mYik?W|LgZx*YW$T<3d^6xVN$P+5Z3UAh(U>)#V4t z(vw8LJe*`EcawU*-;wT&vNXvmO^vKFqcU%SooBU#uh7#I@s-xN+mP;)%2dOk=w}V| z@-`KIsf$ETyv9%ZA-Mqi7&A_SnBn zZ04bE4{?HIsKmzb?*tKrmWYPtCIw>W-TZ=N=9w8}uJK?N^aeKfUiVzqppc%VeYDcF zak`jnM~eX@AqZRy{Mb7?Zf8iN)RacIZxW;oeV~1q!g^sgCOwKG45NT-WJ7FN=@AXg zf@X3N+!rDMJ!bC1Y{2wQjZ(XQI*=ZrUxm8>LrciiFH-zJn)bwNz+{(bDNQ^^UFgNT zNyj5JmQf(1i?lsLX&m=`Q6uEovEd{RPim&m8UNI7?;^3uiGHkSVGxyM2L2u~5{)fP z3Q2th;kkb-%*^yf{v%>K+ZBtxNy1jwmgnl+3bc|DcOFfn$fMavh#|4ziEW1tUV2EdM07W+2 ztrki@q`-y+*RA%+c)()zy3D`c8TLe0%x;if;6yP(Dtu#5myObqEfx zuQW?OZ}z%)5XB!DM{a0aKj8NrYa|yC^GcaWyYWuC<|$+_1ZN^A8#+GBM7+vpGw#|; zI#^B~Er>z1`_kp4$Ep$jrL=*k3FRiJb9hu{On^kS%Y+Ng1V0 zQ$p+ek^MiIX8(m*F&quLjsBI;F@Te>ieet;y>_$Ya_aWFOWiT^$MVB9WhmCH%(QeB z77MNc#T4M!s&c}x;Z2}StIndpdh;(h>W%BuYH9C@mg4F~u_N@pS6`c_ z8ICOHuX3x3C*rp4^2kPLv6-`+sJc(Qv_J&2*LCC>Z#I8VimO%8z^u*pl zA_Ohs>~#@;unoEF_$_+knu`oKC}+$Ol;ZnHnu8wJ65eE%HeF8M$TMo|o3+w$XM|%! z8wyJJ(Jf?P;2vn0J45Z})NQcQ=A7b(J@eWf8=LoGxjb{Biv-(2UYHx^3=b<% zF(IKzH;=>%;F!5!2}oVE1xRI>A#K7#_KDF>NCw=TNyp&8$Fxxer5F)yIMgY~e5CoTy!aFH|Vh z32Gw})V&!5h08O=ed7@i{JD>k%}!4!FXKfnGTL>;wZy34$HocZQo|m|K-oboqJO^2 zvOd8jw1#HpinV4**sjY)>t<5!(2K>(|D0*i|dum4ZpF3B0KBF=vaF=S;^iuRj!cVoTmNduB_eUTl@ZKlO_ zXbf$Z$F2f+!hhwI;j=zw&1Q{TyCwRc4I`;(0~ttx9V)^K6+)rzYd^K#Q?S^b*d$bRgphD5o$Q#a_4J8}S?4>>gr^pCQ3VJtT}~ zE?rQ3CTbW!;i-FL*)12{PA~OvrBUnDvfeqvkGwKAz3Z)%ui^6W^bR{l(LGl*fezVT z0Tzj1fnLn1$L>_yx=s4shv+ z+tPVEJ@|>3wgfvH+%%K4p`EY!qpS1=n04&8ra6tJtT+o7-i>uQ6$!m_Mr>TP=I+dkMp*)UPR?BqFd>3Q>R& zZ>FU)P7e@GM1S$Ju;*qnrLsj5{EbdNrQ{FyNVkXRYqr&7N)qaqvgVs%HExEr>CF%{ z!4Q|46_#=$t8NSCz{Z%2dPP|v(qj`UekTX157<--gy0=kSo=bx=8JN`UlJkuEDC?E z0_zp0Uxc)=H`69>aw`k(kcS6%wqI=@Z9Nl#T3^~kN(gbEnagx_kuM*UFtd>T$3mb) zCn@O&kgHm?Q1cv4q`v5VGD3%yhHx8DqPb+=m>?u4D2)|i)!9~>wpj<5y`RGc{~hky zkKRY_|KHpHjx39h4qpIo&i}*Jzoz`p)zy0>i9USz(DMJ*?tk|Gf0D(R0Q$>cCj7kE zeVx46+TA*+?6>``z!>YBlt(sJYB< zF7WWTzgx6d$#XP*#A0hiwnRpN7G`8@9QSj#A?1Ug`@c($NFhO_?RU}!UgpEG6zYu) zOwXsi;YcdPt9p{G5+hn$TH9ECh$(wmuO(Z!2Ci`HN#BrdHKy{J7QpG=wbKROEl|Z?nh%zd3nU4QRhiD!gYx5plk$l>Gdwif~tWIL)boC{|qq? z0^qw!hcrk-Q{2uNIaXGfxn_@kkM~z%0sUH9W-2c?0%TBYfu<%YRJ<9I{^6-t?&4DrTSUQstifZk7HHN);Q_TFcN?#?4EP7&c zQC&kp)Vzi49ZNd7O0Jn%@MaYHh+nyb1} z5*)ZNUD`XoWv0fL%$u7Pg2l>59{^Y2P7x6Xm9$#|jlXGlx*(eMu9!0$jLjo>t z9aIT35KveM6T}Z8TK+73sy1O$RH%{9A-;rdjk%&x3P{(JZADoT?_V2F$Vc){O1_3D zxJ|Qpfx;Zf?6B22BA-nm5A-HmKeNr0sfqHeXCg5GMGd>s3x(hFO9*ulCKfEe6l9K^gx>5^AS z+e|u|I(3ZJX0B)%lZzTrK)<>6M81ZK=e$s+DO?&?wy*3=a6_dck{INqZV^Lz7}Owq zoV|jtK`F5kKpNYbd~YYB2%9pVVAhd1h(%EBkt||247H8SEQ8{|i{DO=GoO&)$_B&5 z7f6i`BYE)_2A5MFaO&`td>lBqE${~?Hk>PhAs(bZuM#5|erpeEacQ)Njld?U#Qm(J z3)Yl0z2T!|er-XbCm8rZ$r%prbHd#7>kE*s9QPWH?W7=2g6}{$8rn<6l{zl*NV=0{ z>LPEkyu!d-Vd7yK%l+AcdSFd!kr53J>{IS?4MK!jWH$kIWt zId0Gw!!RKtFFI0BN!1^+;VRSWXy4h?WWm^5>y@?2eYAW?N<>^|%jO?Y&QN`dI6 zFT}lYsbHy@CDt8w`x&50;e@@%JF4hZ4E8oq2|q%o5zqIJG4oVB8c;) z>2c`Zv1LhkC%Haj!7H5dVuY-}8+;kE$HbX1g&4{R+u$Egj>I%$l#957xTT2~MOk1c zNdv1sj1Uxr2{{|UxD7N#wAhHQN z1f2#`dyp9{7V<67dd;aV#DrSJn|c?^wf`4%-y4);RM?}fgI9-1efL?ixwrdl`)GS_ z_b_?Bcfg-!Q7tCVwhxaEwx7P%D{J^_@7ebA?ajI#NEKKOj?fvZQXoguc9_2FF^WeA z&LGVYchRs$LTQh<6j+cVZS*RlDA*3!tQLAtJu0r{guLXUk9u;G^9^dE?;MAwqd}Xq z)eEgSP3QKV80OHP$s4{{Bp(-EW}2RcZ(<=540F)vjqgE|b2gP@a-6lBt>*}hQ$EPK zBqPKb#uVO&3HL-Zr2ukaJRoZ2m0Kg((w@ zwJ?C(hR_TYb}f^Pxx&P9(b8QuE9j!#$)ZREl537Gej;^k{w16dM$iJq2&?dcI%Js9 zH)mZam%!pG#zJ_L4wikS#kqPbo~N9jqomlN;B<7^P2Yd=iIZL3DHzb*Qy9ErMUj)g5ufCN6uK&~$XlwiT)N zo(aZBT68#;=)!USDc$NC5A01 zjW}trYE-3(-x-$m7%i{VhN$sKZI-j09YR8Kdwgc++x(DN)PGq*@>kl8F-HLq zGD0*Ki}7+~3{UzpD-keE!gPc%$Z{)SM2#kJ9)V#JjZWIuAvgvdCI8nRWn@c;0^r%2 zPR&1)YtU{kTD1?kr8 zpqcOM5~5kEe3jhNG3C`{iJJ9KuZ9Xx5ZUlBls0oT*SsgAV$)s4ZkZ=b1!~;M>pEYY ziG-`(QG3BWTx{gY@am7IpWG#t0 zO1HR{75h#MB+x7?n#S78tjM(d5;qo>a#6y;Fq_<3%>uSF=n~RE;Xcdcy@p79?U3k@ zYmnoQBrgeEEEGmSamdF<0>_iX-FSWj)zkDjos(mG2a+=wmdIfaY+sgOUpmim2$2IR zCKn0Mtx#JF;s#UWFxr%Sj(e>nV6_fmX9d$1p04TO$G`=~TQ;sm*Tlml*6o>s;)puU zOK0s$1R56BVAyxO8)Utfj3CMOLQ_IQg6i-TM5|m0-F0#@S9j$ORfw)Ig>ETk5&>GP>fk2Lc{hzQQ@dM%Rz9fW!c~gsJjVa z?1=U7Pf&AM^lP`~qRA!s9@vNM0a8^6R+}qVs*xs8);mN=!;IZ0PNNQlROx$X;27gy z{DNLLBM(s+!+V%79)MDBaEdEyTbP0VOsK+K$3?(SsYT(S!d_$lvd=-TVC@I9Y*n=Fv7634J zh}(It1O(;>6>A4nQ}-NESYQ<6|gO&727mij#5W%A_i%O)eV{mZZdjL&U+nl?^qA4 zUSdQ846DG?J>sMJx$euJ2waF`)F$g`S&Yuvrf_3ciYpuieVLToC={-!0u`8aE?l0% zJQF7WK{3iYGhb)xJ1JxX**=*q6SDKn<0NW*cbTFnu&&WPkWOHs4Dla zM8OQ?GBchfm~v@=fkJ<(Hj(dYJiE-XyCx+#$E>2|~81=DF zBL@%SW~g&<4U%i|?=$&;H9#$#UIS5ADVe8ivzm*7fvbrvkoC-iVhR)VSemk2Dn}9u zX*fo&HM5f*m6EgR<(6eSd=#B9sKi(yCtM>hhT)`k#lYBvekXr|fTzIkmo z}`HOB69fus&1<90ZfXu1Qn5lcjge6>^vNL^4oJF#*MzpU5 zPi@sQ1D_TVeJ=8qeVKC{eP{J&eCs=M5eRs2yi2zcW{eBlflkJjJbyMg=i2R15J*bOnE$qIs}@Xe>f(xl)_c5TD^m zivG#~8B`ye1yW;K&Nw;~4{V&Jf8m{G1(#OHYu;z55&O{wS4}X7dtF6`v^i>%S#`V% zjJG;}OQBq3*PGsAmPX!HEvW6HMDc%%$yc$5kZ%?E2--q{UCG+A_yQf#PiBM;o@zi3 z>7&NC%y1>)-_jtA8q7^?s}Qz_uuBp!E?p}iGy%Y9qX^y=mawIQ8!)grw&3BgP*}s* zC%#^^qc~txwRTFpU8s=zl9h+>s6EBG6H^;)4kaKH?xGSh6g5badxg#*D$?iZN-{b4 zmpsj&np(`YARyy^L6<?E~i0@73Ifa%&3<-4qc-sm_I8huQP^K%lBdQEJ%g6pis_S86TK8WH=y1 ztQ;M(RicJg%#=L@*AZG{<^qMA0z%ysvVrMPE1As@mCPGC3*rDMiGXW`t?fzvTIfz& z=UYtOyYEXE$NTr1}`M&8N=`V;~m8M2?73HNnDm zk;36L!on0JTwNHpo-DqS>MrK3nBb9Fym%s^c_U*5=}t)q5bwo$ARLlM?}MQ@Js*dI zaIqu5q`>%qv^VKFCspT!xhi z3uKDe=kcEinVOW33eC?n63pe;alxs>sXtSANGK%p@yHL_f744%p=? zq^MOiHcOPLcZHd7wPYy;rOjQ^6JjqgKk*%u1n?@M6}Bv+mAHZ#@<1sX3_^S@{Dm25 zS_Sj)DH`W7!y=@7iWnGGMDH;qC*@fUPED)*laygT);Z z#{dztGNkVqsoP(^>qVR~okr{DyS|U3A5z85ZU?cTLKNC5jgVd}$_L})HH>JKo#33vZF?il+{sZ{Vn1aSeJ$*_yq1BBc#ADH za)IKftkJ{SDz9uEvz}6|^OT(0iBfe{4$ioaN`IR2z4pl}6Bh)YQ)k(#iipm_q>MUC0v={aKh&8#$W{)N(&eE9-Bj7c%6#E-=j6m5CgArHAyVc)i?D?7NPwMwbZkCY)dSpaDRMWx-_(mFyqvy*Q}9 zO12Nbt^K3q&C9Lb+Md9_*=9V4M|FL$y_>wDOtp$es{x{rMG^-leOLwg7Ndxu+KMl%L~+aUa4 z`|uCc#jgd#{_%BP6;llm*aiQu>bsk^Q2MB}keY7t-QH`!9Wrl&0^cBzDeD8ww7Ax3kdY^HJfdF z*A}Iw`SR-M<@Uj|xS#Z(o;7qUq(DK5)WGS9*(X9ULTNuEz&`*uMaJcOSg7wHC1UwpJQ<#@s;_YW7@GJLUO>o~z zX{g(AKJ+$}?jv)k@$fq_++B3CAmxVQjzKbpt1l4FQn-S+b8or{&J?A})hvWSQ01&{ zv+_Y=`4Q9c=}3~)O}k)m%Vdx3#wQZIPTo6ohl~%=Muu?TVTo$@eW@*-PTv$m5j*Bs}iZ%-08{lx(3lj{|w;vj{s*m|V< zU>zy`V^HQ8p())8Kz<;tRE1WWK_D)d00+WMI(Wi zJhv#^#e|}ON3SDPs}mS(88_+VY_W{Nc%03unBiKPkke?M?;)nSPD6xcgSY|BQfw{1 z#O*9UJ>c&9GF=DXq{vr99Z`EdVC%OM#w>^lXG}}``6dy zgbBk+MTZ)~sS+~CaNoqtaQ3k|bnvZN_9N|#ImzooPy9EBq*z@R(y3l_(Xg@A<)4YB z)q~$HPSi%wZcdyXW9tT%sc#!esyyHF?jPdmGM zamR})*tQUlD)WOv_Q!c5#xBl*ksdRxEmoUbk+Xdqh?cz;)XphY^VV4I zn)fFnkzs?ULhcRxOI99LR+{-2+!BQ?bY~AOoMZwv{&Cy?q*R^ZC(V``_^!y!)vnCC z1T+b^50{q2$t7CxA1OL(+$+!@i207;gvr|Z1{LSACaQeVyW+EXHk<}+@l$h(hp)+0 zBKgD41rKUN8Sorcr7J*T zCU+DbE6SqTfnFdfSHenM4Th>S>p8G=_IsM#-%4LgNf?y=-o53GY# zCkST1eHakF>4&Cs7^z7G1#FWTyY`CcMB-wi)QC$6R1I@qo6e2N<&Zm$2ddhY>uf==B3@NoU%=lW0o9VAqLvw{C0ti8Nb#f5h9 zo*KI{r?&JFerjGI5_tm~Rai7$9-zA6#OlZ{M|W2hnNYbC&ZO89jK)(35$Aq33_u>p zfrS-SjwC!RdmZ)2GSn1TpuTX1@yE4S1C@r6w6g3`q7u64fk&p+;x6m&r z@$hl5{c)g(LTnw@rD1nv>Z&@rE<$n#H#(67E2Brbun00`PKzP-7>X6khDsqFSyrb8Sj)kR65W!N_e4UINok!;(-uCM zMzEYDzr$Enn<0l`Qx8;~>Ie~tQb91mmLnw0098#1(rL#Ex$7V#rV#=>kIYr@=|`Y- z(nZRM)VYp|I%ByIFPSGL&?|iK-0UVwKuaaoJ#vN{^;|+Do6R>5Uz5{JNR*A@l}OP< zZLcV^6bBs`tTnv!w04yjG4699hb1razVn>tQXewfyr{m1Q%kRM97sFS(8^@;aVYxZ zKoR}u2%qJ$bG2r23~9`gXF~fKefcy!VQJxShk`%@^_g_nu)|vz>R&FRF-dH?Mwl67nz8N%@ zkAsYl14Sqerhw)#M`9oQn3KwWKgL`#@99|ilTtxcE2zOvuq-C8WPj)1?$|LMb^ull zxJ*?So8+9`Q=qYmrzokO?FHp6gz91{kZda9nv8+oiNB+$GHf$whKPlBMk7P){+^Ro|Z9w^+ zXhNS6FgS|O#n|}WQ~GWlnta+C>~KVyN*sBKFg_C2Kb0;R^?yQvgaSxK|Cp^ox*)f7n%OCGZJX~OS83oU83N(gGsxp;S(cs($pT(k~~!m2T5@+hfG!&o#cR24IYVj?i$>$HgxVNI)xfRW7B_f^$>!eF+FW29%K|rN`g<%+?l;+mw9?{AFSJj)*+(mdc0%3^HElXV z1y&vY!cNvgXR+%8?EHlQ=l6kOsPU@D#iUY?Krjju3mLqHrs~_o@();&!o4ZoJkBYP zt}0|FQm|R)NI?To>#V!t|2#+@D}&m?bFWNM2Pyt4*YxtD>}ts!Ly%xwiMDg0o%O_h zJ6>!A9D3dxv#?-91)y^6?PI}0-;1Mwz|DUt&$@yJo@6A8z+0H!sR%{?{DGA)Gp913 zRqH;WDF{O~k@8Qr(j|0?w*J^t$83^^VK%;@XhQlwH6n0-yYsYs96%_KHlJx#I&Z7d zmM=g6;`aVWoL>4lg;|gflkMpgj6=i;Z<4V0J3NQbSW0ezYgI>>O z<%Z!f7H)l4?Eo|!n2!CLLo)&aoT*9b8n7yms_m-kd6w%{;~`}-lE+pnLxHS`4)f=3 z^V_*y%?)biY9BKdAvEbd;RvsxD&Gpe*>G{|gUBc>OlyZ?1j$?|Ir%Hn1WoJen<~_r z5=~`yT_%q;iivURk;N{Anm{_b4vY?<4>1w{)+Z2lzhXR2N=8Ka042(DJeD^0Ewj;> z>94~*^3JE@o-TDQOD;?9?$i&D?y_AfNU^OaAa|c{ALQ?e9^$UBss$n!#RJTJ@tzdo zZN=eV9=+PpqQQWnm!Ynax8QtkyQMRpM_tFso z$**z=I&sb!Vy0E|JNSg zd$6|pU`_Ww+*@0F@LB)=6l*aFb93{XlSZSq`FyAT;_#bfX^*St-pIyY+FltC2P<|t z)C%!W-5HcDk>vJe@*0;2MKlyZlv)~V%OGfAB`}Mqm7xXLbwRZ+-y3|gL>`D;NV(LZ zl4`Q_Y$v}7=hm*p&YBtbUg`FRQl~e}=cHEK*?y{t@06xX=(JXQy1lDwr@sk1q;|OX z`haBCZ=~}qH&7oq;o2a-Z^VCP+VGDLonQQ}Kz`AUVEi-Y0xi4K)gGN?Z%w@M2Vz(M zMb+h>oTc--i3?wO{^fev|Am{%ec6 zkSz5|P53p;L`^jLh1xIwJtMau{FB@%2Y%l7_dEI5;^@&Be0g-V|18jh*XocuiX+;b z%EK?j{`FJ&+8_Ol|5m;>2Px|zr<%;dYD(Su>gw7O|G6il%YQ0gzogg~q5jg@9P=$n z*NV>9m|`d36C*DSzL_O=v|ECaM^s)vmA+>Qt+KfnQ^5Sw$*=RL@B7QFzRd-vVIJTo zd$kqyZNE<=uBwf_^0gViUg$(v2?;lI1&LxHR(>j9SKhqO9}{1HOX8KPB+BP~IvVvK zt*l&JTr8h9h8N4+x49BUTmU`s_4{;KYBTxub9jyrhPLV1nWk>z^FZ~8_kR_iPkvpz zd7s~kuitl9mfPK_5v-x6_ACx^ce$6`#gvEe`4tKI?xUcNJzs`_dzd zarw<%R7$+7-u$gG3Ssya&}eQlO{TGbFWn!Q5{0Ewl=I}Tyc zCaFRcqkkWD*9>c^)w2}eA=A~+8Yp*`XdC(}>EJ=n z_FO!jb5(o08I$?Ut2&wc0pctcq7qwGo^Ktzz~&0GN6MNg3%G=?WAs=+_Oj-ev1-FeOvvtw|f<#vo7<#r4vA9jpoKeYrUx~BNu?U-JzwhZ7$ zm?qKqh-S)C17$;dx@@t?Fwwr`*}u8j!}%(HEsZo`u~G_YwPC! zefT;5EW}L=Y*g1?`}5YpGVdBP2she z-6bq%NJX0)x-lbUCFuB*&}+5VL;|D5;|4D&nS?HtBk7s0)lt9PfBmNbW!A@}r(8Dr zoazb(s4a(C&hXs1?7r-vo!3YitGub@Y3=IB4j<(?<;tZw4lZ$i({Uk%4pYCGz4i)a zw~b46>o~(vY<7YeGARV4k3_pmiPbqk%} zHn|P8osr@3s@;9@#uFN3P}JWn*Xl%8!||w`%9K!(ubB}eEu&f*aN__Le&Kc1fl55@n>_rGu4`+WZA zA4mLqK*;(3AIF?*T{_fNOUVnBCAy9$!=1z7Nf<%uC5#mH)3MeZ8io86IEl&56j5%x zBhe&ykHlw{!)^s3NC;77a4!kZ9wje_G{ohgT&Bt&EQj$uQB_=PDl1VBTtr!{$x{TZ zMxqk#i)1o;p@tojNUCpUfi1+5|MofA@r}yZ>n^;DWFBMxH0>i2IEu`bNhhr8LdZ^2 zp*qVE*@&4qthJ?zs5l|`XPK0>?r7bpFUx8^Y>1bkJTTEJFj3mZwPBo+q@e z@H?qJ%5JoJ40wqtY=$7F@BjzcwIU%kOZPItD?CZRaw$a&A_f7a+e=A35~Tc2pA&q> z2C&F&8uj`y(Nh|1uI0JM)znw#4PIP?m@ctPx(95$*PV*WMt)K^Qg>&UBiMfbOFThn z+SB!nW|DQpziYKuDr@7|4qHTr%2*UwrhBM|J=E_o`=m$?BqLDzG(}*@0YvL5kWUtY zpSJ_QoOH;uyu^sjr4GN=!rAYZXGKH5J)4z>4nn%BCJwATv6Fq|lw)^tSqTHJEczDR z8ythG1DD|vE>gCtW2l*ahJawLc}W6*vd-Z2)SqRROQy?*q~jtx&}@*EI6?Wr1J!^g zPHR$}LGfx)F)+w$JSE8z7jBY%HAq&-8CyY_>yv}I0$2AgG|-#i2?MSWg0pM8NWZ#F z{u6oCtoD*DS$T}+e_D6jRQXYGL= zA%%ldmBFv70IA9%#_R%cq*G2U>ba#)TJpAEouT~8`E6x4v+Sx>Qe^9i#IPA&Z$C>m z)*n82$gMNA=iHjWa4VZrx9$pKkqBdiUkezq$Q-~!$PePAW6S}v<2N>wKnwPO<&Wv1 z+}Z=9@Bq?EHfpR48h06pTuPy)w=HVPA3vo37|gF=KKbn`Gtf`e0Hy_d+<8;~h64mb ztC9BmY{BdIo)fdD>Q__beWyg?hLlx+g}V|spGRWIm0d^$Q6r8ho0SgW*AlR}Y zwIq;8o@`=*?mI{z542tAOfn!MOXDn)RuV!mrl`nVpc<8b5WE~d8$TQ$NEGJ_X}`)6 z786v`ms#>`rxFQ7UX2!)lIuF>bItjYItZ@{w#4uv53cS;wIlI~C6JY%T;_05nSDLbfmbRAaX?wSKqM9UbttuA1-=z;6x*|% zQ|!Z>aa!1o?~7N#IAoc&w;m;PVTH(>I9uUtqMrnZdrA`q?(pi2-S7?wbIM1lw&wlB z_r4;7{OoqoY4vC1OCYBVTU;!B7r{Ya;ae&pD&qNsFev2om69KkXw5mXiN@3CuA5`{im?g1(RZl;kw8 z+sodSDh524;-7XFYAQl#$&xQO58o`hXU^Ju&H#H4*UJBjCeiYM$4c>mTm z@c*sfUtM1(6>OFG&&I=z&-q`UU?rwOB9S(hSBsN0H~Rj9uB@v~5Tr|%Naajdo&k>@ zSy}$*Schp-WQ00ydVi>B!Du+`l_-RA*}^NtfeSv#b_|`eWh(`ex(DH0qfSu;8!}f2 z0GOXa!rt;zZg%QZprUzghge-(n3odZK1LJ!A?aG@CByjr@Gb>TFyWNno)=p{U(~gA z5^|Md5sZ5sGux_5tSu0{p;m|;0CpIb5HG`1gP;42oJukX(6bdb=`Q)f0ck|s40-hp zxAlyrhP64j8I&-qIbrHKx(=%X9%6+IFBqb4(edn-M!CS~2xRQP+@Er0a5?eEAK!aa zrZC@5P!cuNP{siin`=lowGs^~;n)j0s#6{}NuybK{Uutt;)-97lt0<8X(UC(Ds?y$ zJCvfOTrt+}@_xB?R};pO5zZ#2bjeDM&SECsEJz6y@ejo=S62P?WihseFIl5|L>!ZVfCq9a@kA&Du30@`CpGAV?5skmJg+Fm6pNMrUYig10C%`91BCDRpJi#{ z2~%Mz}S6i+`8>{tMop|oG zh#ldd#0gSj24(~2APUqKa#rhNK2#Z4*i^Qdw$WIID8)6)C<(Ps>u+W;xxn|_pC`

PpdMSHTjjE zCf_*h@8|T_+@HTj9|`V?979@D7mDV(iXOypVESeZ+^~pR%Nn;~yrMYd+xoL-2Tb4b z=JAB>eO0GJP8p80I4*>jNw4uv~yr<~%4ni|{{EX?(`N;nG8hm(TKe`@2DF($Lqp$F}ihqm7Iz0kV zj471Jc=P6s;JNwrRtHXvVL`$0``vb<*I{=&&AL6LpthSvzy+u#sb}g{0o|%P82x<` zzKg1z7LwytsXT=K^bD_NLP_EakYTma^epIBuIf04@C>f~`q9g`+q=*A-fNg;%|7_| zti+k++1f3$T1zX-<^lhb)GviKh!>gdP^-!NwQ_dle=Z|MYBf9lCuThTaz#$|mEmYC zLGs4b0L4Da-`kq_J)vU7bEQw_B2j_oe5clO1c*S(<<&$AkTU;++m#aKe=sn_6K*Bie|_|YK29$hr|;OO%R`bx;CShUR1bf^>sN{$#~nRfQ82)oY5Q5}9XLW) z+LrBG?LltmUS_x1usVKo@<}>4R&^ctqppHL=EEXRc}J^521%$W|9lpk zt7%5oCH!g#ga()R%Jb|QlF9tPEhM}A{cDoc#J9tp6jn{sLJE1+^)}Jki|h_k551Sl zf4EE!r8UUdA>m27G!+!|xP;9|nCC15rHDY7yB^9Ck*Nz)q$hsVi-isl`{hwZJET7&+EFbv(mi_d z&$u{vMfn}W>BqQ~CK`{~%cG`Rsw+!w%#x?|%|Gnyy-3#X=Z}KQnar75HC*@U%=?<2QLnR zw3-8Yy0f?Whr{jv*h=oL{;t&X_AYlR)_2}+?(K4&pDycrd$_ZAq>qc?+0~10-*8{y z+oQd=$|inmwN{h09DcRQA=j^kChONUF({gJl5AYl#GrVS0wdnhvprbj+h<%fnE%`_ z#(VVL{+8Kl#r*A&4Z0Y!Ju}baIxC5WMul;+R>H48!H1`x-jy2#3r%5i$uXR{Uxz<1 z8bw9jmlWL8*niRsWLtLLq?KThZ$`u1?lA4X=zI_#1f?x19c>0&`N*HJJlCB zzIqqp>y~?=-q32NTQJ_r!~7_7Lt0C#N*HAc18-pI_|lIg|BPYYCu)Z zbEBcqFwmb-l{4DAjV`UND>-(mT?ww9>TU?`H8`7}`F-pcUJyIhM^Hkbf!Uu`+V*ID zdo$&tYAm<6+^r)YVn3)?rw#IDfyzfY?cYKCVPw zyNU5L6l81&}`3fLOksK0yPb~yb0g#rh6BX`G z+F>9q^<^8L%H5;z5Ka^}|FHl4pLMl~E=RdU?a_TZHl<-Be8(JG6#jg#Z(~=fYWV(W z)r&%pzS(UY;iVLc%1guk@wnY-7Mjwv%PC0Ywo{nUN{TCX5NIfjp*<9f@YRug=CKo# zxgxZr0zn;GQ1w=UjHn7-+hw4jyu?O@%X&wonW_edgnsDS&~INBg*qx9+Mx1x6@n!gXkoAP|KaEJ{~v(p5BTIu3r|d!yZ;iSS)N)8fV&uu zA*&*zN)owL7JEj$dx0tP$3M8>y}*2giuYk292fc0e|=y_N4}IeGUd7`7q1=<|KU>j zf)WCKu3zEC&ij(@g=$wNz51r^KcF_gddIz8E{=_WOPO>gpJL7Z>c}-z zNzn3r4ewcWUw~5E1Eo}p(($qqdr^vvk{GYKLjV+ijI#TJazowy91$+!E!XSIiHDXl z^JP&6t*FpnMcX6=#`L;dOY{p2xd7ySu~fM_B6HY^SSzHiC?0Iu6R z<`!td_hg5nguiF;++hm!6 z%nQyp$?oeNZod49XB=m={9=99#8tMK%pGQax;9)~Wd1W!E`I3F85E5LkIbt5@pm8F z(i7Ab2FUoDVC}gAo|0n2GSNQDCb4-=O z9r&1iF`|#GeB(q2lqr&=psRvNtQuMCz?v(iM9$&J>MlKLi6ZHBGfGr~Vbq6)er0=9HKu!CzXUNpnK|3|E)asJRjQ?SA(CI-bw5cSJm9^zH9sEr8{_sN==0ITJQIRGRSLuiD zuZMGsfV<%*66npX0*%gVg+hQ_JSz{#FC_n#%)yNk4&6ITGC!=fF9p!UhJhtvj@VxF zttc*dJ?NioY*W!F3q5IOaTSxqSf7At0bqIjcR}M^;#Akqgwi^PVUf@KPEJV%AgFp) z24+`ldpF;&{@Hc_E35mq!^5@s@MjI4Zoc>?S&c(hz*R6UztqsGdhV8P+Zz~aW_Brj z%Is5Hreerolp;O`$xF+6;7v8_BTwn@h7-7DEJ_MuYv5r&!@Z1q-ctXPgjai<{X=BI zvPkKbz|`GSUH9;2NucW~DUJA{e3t3UAl+HVAq(f{BXP7)6FA>uMq$Bd6vs zDvo-9C1H;UY!Sb5a0Qp0TY;HQa;-r7v%V~IbB#?j2@AOvhV9`(AMgOP6r8MaZpbV! zuo&j=>y@iO@bC{;xBuzB%LGq?I4UzZ{}!*VRF&Y4yt!hvkd=gEtmy{Gk^Lk@vS@xysv z&3f|qYo6|;HrM1i<*(q~9*oZ2hW=;ttovW3Fo8cPd)s3gf@y8=d%=#z41WfjYbyBa z3hcxjkQ%F!G&6@?dC9=z-}%tvgE)BpzQ1blN)ymSby1!I&(^G+TNmFXb2qvnqrlc7 z0K~G&x+$oPOyp#d()Z)^eLy^jij67!7W6iKe@4*R(PAmAcUz=+-mJWbw|9pbNttV| zZwdd(u|OmGW|i{?>7e@!lLOK;ve)c+tIt4NO0b!au6wM~fmCb0GF_Awx7hDn2M2ox zkGKrdj^au&0-obVK$APa9^OG`$4Uv&fgr_Akjkhvg_{3fpyp9^rbRx(aE3+F>MuxP zEjuu@K|M7_2DJ?u#DH8+9dWA$459r6b;xIBSd*?3!SM}oqOqsrmfA?;iEVyji29lG znt%XJ|6P}Ie)N7uIYT>ls);|Eo<4?_7A@E0Q91^Luf7r<^ivE)f5~^Df3+6Owvlp> z^{hW1Ah1{-znnAsBiH4K*@Ye()`SU_l^&>#E<8Lb2Rq3cl&V`W_ttV_6eRbXJ zH+7~?C)PQVZ`ZObBAooXN#())^Lq=n{8iv_x`J7mzaCU^peLrT=@(c;vsq-R1%H#j znf&bUhPv?SEf{<-g+kmw%9JWn@V%4wz^yl##O{OnDh6hv_k$4p;5G!$K=CXjSI~SD zqGx^V$d-o#yCl%^b+b_@n3Ifo0SY;fUi^A(D#81%3b-cd+Q zEqHtZPaKIcR+cN$tH_AAk8$ticFc9te2U@bWmK3s<+C9l^pH{Y%gh;`g;`plA zzYXCf89asa(z{QD_EHb;k9kA)&q8*ooBwHimld2TgqL4_B8->2cn_5SJYt$mu9%+S z3`x0$k94j_6hqRSO>~`>iB=>I0=JQGWtPNnNUhebpiHaGLH%?KL)_&mKgGLY6P#bM z-8(takB&(c>3kM(eAiET0(q{5e<;36I{ZI^BEWnKtPs$eiI}^&Y9u}M&hnk)H@`{p zhhHHO^!SI>J2x^8(-xIvQ%dvkBBplbg2ho%<&3l`Vl7Qll~6blO>+8(!ap+ghIZ2F zhN(}>=g7H>2xL_ABFX=}Z5T6MZbKCN4Mg3JkZrQkFGCF7`bmZd>NWtLiUywJJuafcUvY{s~ah=^2%}y)qMS7qlu~}Vm(obYJG3#J{ zc`PDXiMIW0nLf6O&%h*Qqf^zGO?AJ{j zObKG7O^v9kcS)($Q~el=&PLqK5=XxRS4>4e&bx<&S`yi}UP=wAXl*vXeD*F5@;}Y%pHh?;r539vi0hasGz^wT1Dfc`*-O45=64AQS-! zi84!O38*oKzPycj(!^c-i{%6ilwq?f1;pP847m-{FEEHLA!F)`Qn;}4VHnp9IXbF? z5{I9sWO+swMJ;W{r8EwWT)B_>e=J7g;#P0GGzWvz*&Twi*Y&6^!C zC9~0W*a8PuJAjOpqU3h5Y`mwY*(+{nv4VVi^ScX*O;J)?Wx}Y&MKxd<*V>Ix9Eua^ zH~L(V!w=m4m?)p_Z=s2(VW>nT+rU#qJY%=!Nu@L1X(zLjh}wA-R7g6+>x_PL+A`!w ztt&R1yuwU6-+l!EBdgqfA^xULCZcR{x5q7@456r>>AMIH z$VR#XO^u1zgPM?vY1Nm*6#Wq=0#PyF2?_d%#)M5i!i+DA&w~YRdp_#B`P+pe;A)$C z+t#$%h8y9rC~a8TC!nBW_d%(Qq=!k zm;N*wpj4s<_wGqGT9d9<`d6>kACl~2_22GqJXqr{aL)gJuK)O9>fF!%>a+egt^du^ z_2A0nfx%fw6e0jb@Y5?<=N3Qf3?26 zy0Wsh`@`H5zEbt@Cyyob_1DohW#gXA?DFx7zogZQHGlkc@7Z?-V(rP)0BN(vyCbx! zSU;2^^tz5vGkIK3ULI^c|K^7|4Sw#4u3>n*Qh&1ic;5gX=)WrlA3z$R`3)lPv@Flk zAI<@PR$_RGKgP5rE#md%UnUl@bR^{VMO>w<-aV@$`ds&{{m|VER|g!CSys9_z?RV$ zB;wX_UimyO#A7hLjZkXKcdmS5O08cZ!lTu$aI-zMI>iTp#!7rVd|z9V=O05iV7bywhZmA9d5V5M#sy(pwOdt6zYMB^ z{aFpPAwMd%b=o|XDMCeYDwnb4xlWTO9!i9Li$sX>-;XnY8V8Vs{7v$ooIT`!<^1Qv zwa@22Z&|sI^ZK*=pO*iHtS@{$*X8!=1n3RrUrPXPbPYw%kVh>&ua|@zXMn+mw0Gfm z3Q3xVUpXXNX>g58r_|;X91+daI!UFt#1vFn`~2ugNHCK9Q@pG?lBOaQFkQR%_2!eQ zligy7(ydKZrn`)~{10BtJSb{j1ziI)OjhL+;8q&@#xmCIW>kyH$3u`@nbdBP23$Ea zrM(qED0S}j{QV^*&ZptHaUA}ud;t3>++d}uk}VAopB2@hECpK$ z#s+VegHP470_licy@nLjg%zyRgCnV=lc#R%FxM>F3$92r*sVuLvgDFdd1ts1^24y| zC_iziKkPW{PzMPoaKIg)a#wgUH9)&JLW7?VK(s%C?W~FDr{t2VViaiB^W+@O#MYNC zF=L!Qq_$1DBrpD*+FaH>bi0_F{$cTcdq*lo$z8GQ#a5eARk^-xDOdJ>=I11+@+gDXABN0dLK zYjU3F+j!8E_T%eH)${JFucGhTxO(2724D60&XS+kXj28M%K@?+cHyXx0%}UZ(UBr< zcN(9ZhIpC6P|8!qv6CsuL0x!}++?WhQ7m~Ph&zp3Ki5q=mu{t;i0E+72N~V_$Xns! z@5Pa&@sKN4LdlYb?y~2&yCyOIAq?VG6z#k(1+SU3v9Xn2x7yyd)S&Ls_De<*&9pg*F?d?aq+X5x~9{ zBtw0S=ln_XScg`EZ^>sVJj@sbnD#FW>81b3!DTnb5cRYR`tsZOd;r%%vz|+U>{mgv zb2Lx_;hXoHg}cVyYxpZc=KHO;bh)XsYzjKuGFoA4C7kQaBW2IBRyyvC+^HxeybqA< zGS%g5jNr@w{YN(7{1|5?L?t0;$u&DqpS;tdK-I@iat*=}4b=>EQ@S94F6C zoFZYJOp6CXN;US3b|M7PzN|M6kd@4;sneWQywEE*2a7k{Qut#kiPpcFhpHKI`n-6b?KO`+d)?<$xV66~u^F+KgjT^!%L3r)3odjA;+N zn{jF_q?K;0KYZ{oOr1x{?JOP{a7{VS-PPg}S`?Dx^WM>UPV%psS*+$pjMTBENqGM;{EX?8eG>NeiaSC4tM_>|^qb0zw&% z;MJ`5 zn=f~snGY4rIj&;4r^CIS`oZ>L1^WK>{uULQsMK!V#_Bzsa`VH1#W$3TSRSTty{7#D z$C>FGcFhJw%=OybFSeVD*McCi{-estghPKyZjFwsed)F zTgW$)wcq{jcZ(>utGc80_nZ~p?+xFj-5&`wJ^oA9`uDU!ULdN?6K(7$8`AbWWfEn+#8&D@ieQfI!0GYxasdZsWzO~9IEZ}0Zf6oly#w$ zD1e=%qX?D~gvnCN+gQ$2$cfr+dI19~^k#$c+fUIn$tC0*cRILY>gj-_I7XK$V0)Ty znG))nZec9K-`t#*$He_+3SCF=HmC~Ut0K^xU5MWApr6elpn{S36Fkgyw2+JEe~9~V zu@T4;D^iCB<0l_IAya&TTtL|w)_zLnT*#7am|wX*m;8M(zCp2=@nXaQulT~pq)+6u zwMtA5cQCrl8x7ixQ^C(cXQh{yOR)Cx%hB*W|B~VJn)|M?;+ji#7IHiH^7E5+OV8V9XrL?lBYyCg{z>uTFa7MK^oBq3Zzf+|_oh|u zsPfUM{Dwb@G1wn@PnB2w<%KPkFUjT7eQxy4UHsp~GKaE}aeSxANERQopdillBr>JUq;CU4lRB{kgH#*ufxeE>XHI%epY) zs~m`L>z>C@C%~B`P(x@ooKALEh^{0T%X!Tx=@U=`%@Ny|SVDeEl8}HTX z@_kyhPJDxwrZ}U=G;owkE3T6`?F~3mmMxXJe40+70~S`a<$Pg2lQcb^o^PqG=q%D) z>-3)5M#e7hscgQ|`-iu@zkkbnW4brMzwvVlAL)IW;#y+@(HSq$-|}G&FHHE9+p$?s zb+c7^o-JXJmKrymDO4NlVMNLaN2eycy*38&f_aI(C(h25%vaoqYmoU6u8SJe;j)xeR6uxqXDNBprm5OVV)Bhy<7^dN?b2U z*~+lac$jxKgB$~tLhht4)rL$9*m|?tVi+naiia!VqBL?{x~+8-Nv5A zCd2c4vs=X%<%R=SAu4E5JD%swPN(rZJcXc&2D7NE+N5nluS`6Uv#PT3BEp$TqhyRxm@C4 zhMvbZ-5DKDG$BuUvZu45t}4ud^!rmZ*Y90qgMN=NLf-0PU<{cwp{%oVJ}6mp_6IaF zD1Vm;&2Iv@a2_+T#sO3t6d1Vi;_WkPCoEO+F#bQ zh!1|Bf>>%->{S{Xg~;ArDYcl;MbzvjfZn_W_87Z}`MT80;p%A|;^^eZ$@M_Oh!pb{ z>0tTRM#n#{PlGuIOo81QP9E1&v?)`8rrV<*jjB(JbhE-WU%G(E&n)|;)5%W? zS^E>adD_I51!ffk&fno}Axs)lywu}{oyJ~#v%B}QzWX9ZBJ=jbMD?m_03!=RW#7IP zOtWluNe9KW@Akj>hU&m~bfDRPAC#(v@kI616zkNF3k(0tPYd_GHYEel7@*-d18e}| zFRgLcBBvHvVOVxa_JV5JjFOWv?syLCWJAGCIfmZppu`Ud&d5tI$*d!OerlXTI7-Cw zy!`G}eu17o#L+=kaGKtt!XQXiJf^psU&D|P2_`YiiD|x|!Am8=M>54TH08}C+ zprpx*-Pg%hyzo*ntQd~}I5(8neyaTv%_hGOoz%A4FHO@*`rj~+uT>n0!7ME~ZGPbd zmwfeAU)P)0ei!cpGgn_6W(hr$o zhLc<`v@5)IwjPZxPtK%S*h)Ol&wwk8ri2vfnT7tRta+Yk5_+x8#+YIO=~nlvdF!#z z<>CjkG&rx<5Qby<_<+`$v+d%(Q~`I}hL(!;zL&R$EG;g6cf1KXO5)7f2H8hOcAV!Y zH{@NruTqHIx^f~^jPPrvjm&dJ;<1CfLK=t!#tc+pt5lf4 z8I91_{^lEq#jdMg%CnrvMd^QEJiZZ-jU#p!Qq0POW<|L~M@1!ld3~Hdhq#8N$?@w~ zUor54MUvcVh%2v3ySys03*UET$_rvpiH{oom2?Sn68E%~DiNhH$t*M?&0}P!)q^kL z>NYyjkmK8jJptr{SNl#v5C4SAZ9>io^3GgIw3UV$B;kxkLRL|InP7Qtqlp~yyfdRg zqv4#WCdi7eZ=kE`0Zfw?Z31!S8Dh?N-lOy6{X5qxUfX#-<(c&D%y^iRnT|A68f!>d zRt{moT*P;^C#*imv!0Gir;SF|=b!EsvKPjpI@#!B16>^*E08J~&DIiVM&e4y48p;= zRfYS;yhTJ!wCQJ`|+>3RZixE^Mjl_`@K9@9M#g!&Jwc>sd?JgZez7$Bo z=JS%s4O7wJlzfom#@Zu7?mQ~(SbtdJwz=TTOVY%}*uwpbN#<=E^?^F;Tq2kh9?4lM zRk-4&N@q=ab=NB6l-_#%E6}4t&9)L##|5jcq08Wzf;1=7#-n;w9BkB3i<6D|%a1m$ z*xAOA=In7IC=PWOo)tk*;*h2OQzOoq zeXIGF#H{3^)#O+cQpy!_8Rev5B_poPqd2~)Y-CYP9j}IWI@PtRtpS}H$t%JS! z-w2eg5>F1dj^H1W=dZZ0 zkkWP!B4>z-Yi5@oSPJFKse?&sDoBgPfuzdeoli14 z5Wcl}w0H1b^3$(}f1g_{pNSwH9|}f?$P@h^Z`^nOdzg2O}Uth?<-kL-iwDW~Be z7uMleH^baP^B5QvshyRjA*+((^BlGEnvHf1G1;M{>hci~2#gl~nuI%NWc{>H#$Esr z=fg1f=8(_IHwPTO@N@qXpn&*>b z$~+}wq%wpO$rLhY%rVbI(V(Kp+(2EGN>bOXiHZmz3YCzAN|O2iU3;H%9Hs8?+~@hd z|Mz`-?yc;-_8Puxt?xWcMHtDBwbrhv!sag;@Iwn%5^4Z*SJK(C!$cNwlVr3DvaN$1 z@+5{8k_B^EhqX0;2D`2_#0Vb=r)%V|r=*rhT!21#DebZGv6kcs2q1nG$B<-Q2R=ny zvczH^$mE?$liXa;h%`hO{Ys^}e?)g7Y6XK5J|>PAag`3c4xK$%V{W3T;jE||=MPlT*gz`g=lQwxzXQj);O;-=|aOc zQdu49Ysyk+Uy`SZa+m%uv`FyCD}&WD~H2 zOg+Fhx+7BzM$R$$9NA|uVvmG%WHi`f1(p=Bk8Fbky}$`?1?`6u$w~;)v*7|g!kR>$ zjoRA`)U>wnV9E(Bs@M__3dcioCM;zT#PVbP*S})Kn=rpkSOKT708&F`CR+VLvT&SZ zo)kZdXfZD5P~{qOb_JYc01X;0-5~1$g^ifp;wOm=Xd6xBg~C;nw6vFobA*hsAoT6{ zs|lJYRs@(Kc~DIJ0;>fH#jc{H*+8JkuiycBNjMh9ZAoNV0u#HS`il$MP)Qd2TtQlc zxZ=s;AFzNlnbZY9*XWFfg%gK3E!x#XY9s(6&iA;2k_NiM{sh_#S}@8R3wKvg6FTCB zLvdvjvR42d11?HaNllBmW7Ae(>WN#mwYOmemnu!7`H_h@^%+&d1ltkUL+$z>T3GF!zL@AnJc>bNm2$O6v$rA%Q$f-0_!ucQ) zz8wnKY(N;qCxbslAV5F(fY5Lv;WL?r0|+Q{1^XXJ=yoJqWM8G3Ejn2fxvB9kDKLdM z2()+taQqbxVfcte&#Lf)K7g-^j!iytO@_DIE!J)oUGdi6tg zZ#QQu%k>LQJemeN+DO8MoM#|O>niDPGSyeo(lyo9hVWh`6;qTj6^Xu-8Q>ZN>@y(0 zNR9z*Etpj&?+3mk__d)n0%I@Q6zbM|_nNXtxDjijho8)D$0n`6Fgu#VidI5dIn5Ga zcIf;<<^ufS{A;trV227M{{(gjjAfb18OqJhSQvWT+r|2B}RXamtR z#S}Py;+Xy88#%?5qM`&Gf5Md`tIH(F=bQ{3ikb`~HuzqA{{?oK@N-X8#E#ZlQLvq$ zd$3k?l7f)}XB=?>&JYxZFR*I`A7IKk>LsMMg@0fpP@5z0{IWUL5!M|=h6KzLjfh4 z@%P|G&rseD@T{`5h5vacQ5ApUpIgBMp8m5dz^?c|x&maB{QE1Iz~w(*0R;L_C_VcfP^M79dGnM`ZDWbp= z*j9li+X>aB8gpfsoP!Gw4MNIe2*E zh*ZaM2uwou0z|3>K)-~U;E+oS=4*y%9FpkKmlUHBt-S=*j=(vb2|qOacg$PaNK}Me z$P9Dvz}z6oZp@-0;MD=H-BdmW|3HMMXgf|Yuo#j_ECZz_Fbq&{6ypIPRtzKk7$=3; z3Ys=Zwf={VwrTIcd!o>Hd=*&9c?o>!igA%`j4agyq}@tr>kQc++f+Q>ux+!F-xFIXe+ zL8sbxzUvKKHy{-+0EgW0XT6d01!G;}yeDNV;UKAkr??E6o%F>#zcAwk1^x&oI0rrH zP?EQR*4v!&1?~z&IZd#i>;-x6DD#@MK65u`JL-b)JA!pd^9}q?4vx@g_>#Y zjZ}FF!_VaSP=wFXz0lR&CM+r>N`#!IL~V^<*2$w}bN)+p7N@YPQm?^xYeDM(Fd^G4 z)NFP_f+czc`gC&C0EVC_E5=(=t}TAR{yrRml%m?|u8=Sryi1X(of8Y3p-8xtx#1@V zTC3r$_P9EGg5@2ecC1J!u88DfWr2!AnNLb(k3w^-pe`^}W(4naI|mfv3w@y41)M1R ztc>?q8L`K5>rv2E%+WKqGx1kgB^~)bTrY&WUDyYWKUI~5<$pST?gm6!&EBM7BN()_ja4>NkhWVi&HQ5g}TCrU~MB&fx z1Zw>&EJ3S)qH-J*EI{6TGKWMCYoj?8KrRucB}bgM?BobXAmfk9R@N$f4N;W#dJY;!>NGZ z9VP13VP(Nqjdut-G4lBVyErEx8W|!dD9UI@o}vMH8h?IQ0o4AK$aP4XFezpS?GKHq z3^|=abINtY$T05bh3GIk%$U*fR~PQ5RG41^*d@@z!XFf0C3J;c@lYUF5Aton2o24Y zD8*Ir91Ccxpdtcx|A5}2uRxuL@>k&hoT!%Yr|CAj=B^$nbetL!jphfxWA<%$jll$n z#114V5ZxgL9*Xcl1OpbP0Dpi2carpmlzn9O3hN1YFD%}Tf*x?1;y}>md(tSHX zk_xO-0mw=2VeSOMi_j zj{*d0Fb%{BW5j(To(6UivXMZUO>*2X9(#*b+1>-$bwO|ka|E7g9)eCFHU<@Rc6KMh zF(MIpkun~HD#((@haD=kBs*E+!D^IKjkW?2 z-tX8uF#40Qx{wG)6L$)=MpdyqK@da|1x=&{dNoxP4IDf&oP80Wr4JeOA+x=%GjTHt z5l}(_0@x;@jYgXUJ;PiC@GFiUPQV}k4L<JYdNG>k3fETa1kY$)7z zm?C6`fZRG0A<9%Bkg*SS31pK4x?&T33J~##6$G&f^$D;EAU*xSSX0LTn{q7WmS8iY z0VrNwh8CCzxszEHY_I z@8$z8b0svMG2%Ra~Gfi`Hacm4(2T&O# zkRAXb|G-@#-U|!z0zuJOyCtSPVRn6$d*= zCxk*~@Dv1;d+~?o6cb;jKB@Tb{`9OO|0pc3>d&3lKRmBfp4eY+H0^mr*PDE;C!qq$ z$(`I5M+5lYA&HIxT`Z#ny0X}AQn*K=vlAW~IMEb4CvZ@(At}e2qJzPF6@jThkRd;V zY>m`wf}{e<;ihRq<0$?sCh-SBe+O3LL}r4!M+N+N*PzmQAWfoFRD!yYw+vOYpLnv> z%E`vf7M?j+8ar(@C%Fk~qGHH)R+e}>&L4a+$-%TgJm2RI>8^fwIw{5GBy`62Lt9=4 zXD1uJ$?*B15qR!{J2^Ly8z4RyvOy2PRE@L-emG#W^KuZTgSAzJk>6|_GU_bBkfV^=NBAzB5c@lf8Xy-@?Da)9~5>e1T& z34sr-7rfQ?ctid&By@rR`iDXh@;3cZG@ith|K;WX1K)D$b_l{F^68|VFHw-PPuQ8I9K`=M{w);$4?H;Q-{S%DYyS@sDRD^=@c$H% z5R(#<6qOW({J#>SBLDUO{Es+*{MY~E$M|2+0b1^v?5ly2@=oEKF|`K>d=F|mH(@)c zA3Gu6GjJ`PaQZ-<|Cra;+||V#x`4R+NsWJ;#UFUEPUXXjCmF(YLy*G~vL3mTCMQus z6p!+TC`Y5MBI1Ts^d3+r_9YPn6iQo)Y=YDyk|L5=sw7TLb1yqb2xmpDLE3Z#nG>is zjBZJ>CW18e11$lr-WHYV1%(tADGK-=>Kj7V7@UGQIFo?pTjHdN!m;2k2{f1*O&5N} z{alNSttY_r;BEW+>0V3PnJjj7+I5==B^<9c7$~XudDBCU=8;Pn) zJ2#oCZQChDws}t#I)->Bq;arvvIgg23_=u*9w_v|_t(|b&PfV%B35>;rs!7$H1rXs z(IlI(Cf;H+7QF@u8G6JxAgKC6w8L_}0U5v@aqzdmBq2?KiyJRx2C)9`Mkn&~aZhv) zx)xBdVqnKOR%{T8E|E&Tah48E5M*myzyDpYXie1kVRQ>kq0o>EuhM2yHLXp$QfL_J zf`!1gDupdw0AB{x85vs?9#2o>nehkX{(M*%l^5mi!h_Z)pg$P|e85}TIbrkpL14xv z^o!}?{1ZRc41kZ@C1_O@NS#c%?7a9U!F*xc(Z9*ThWKMLEND+8Yzv&e)reF3R}b7D zoVOog^grm_O~$(vAi}Kyz1Y-%B%eQX-pPj!-{Z*;#sCa{6V~XOV|WkAkNEY0obKr6 zp`4fGn~dL6c@Y7WcY%uQ5SAogY?NjQztref1J(ze3kQRYN6FVgfVczXCDR?cAhtpE zZ4o#TWbHi}6OkQ@g!$1T$vMHSyezC7K!xiDiN0(gktkX_7%EU@Tk}0odDV)jY3^!= z*`uh&XE7m^0SsgNv7WF};gA6V=Iabd0^w6A&25Tivq=~I8v^h3c7UUviVlVts3#wA z1UeAV33+|!4x3t=JK8~3GI=6-U9xCPupb~$$m;@T2hshIqZLawM*As(DSQY4AWkG+ z48W9+;Zq=FuAt4=oUylkf00nT(t9oqQuVN;{%SE(xC2wAD9k$hVBp0Tv!q)n9;xS8$*$H zq5PU92F~xX4MH{K{;9zH?y^nnK8{VWI02kgqY2O)2^z$LA5d&aWu=W8TeY`P&(NRj zh1@SX$Uh-*=&;jX2C1oT1Dqk0a%8HzAVoPWRPqAz{oyhIZTQ)3z*jOg0ATC>-Z7?J zHPksQeBvBXw+S|%OytOqaEe58Or(A|`ceo4lUhu1!vEH3q0WJJ;(z;C{0K~%bAVGD z3>p4MgsJ}@4nmRtsV>C-1{J^`$p2yzQkeWNBC$?V3fdz1|G)8{|Dm(=e_sBl26jvc zIFp70SMXUpMB=g%t-uJOg4pi55uS<-sdV zSRkbY&w3sJGkTAH$avoZ>_gB9k*`VLnPa{|_;=Pn`wkkdC5npt@Uarj$D4olF*KU^ zm^>Tk3Na%{VT}c7AT|r>tk-yX5d{_Suo~b(h)|{10t~wpZyPE$o}Abo76dE|ZZ$wM zGe2@^1OFXj9r3r9QYo zpc)Lg^AT|kc%vg{G$_+Vjz2=|KIMnsQyv2j9|jJ}Qx|z|61aO#bdOu>$(#}OFEr>X z7!^9JAN~`E;QuE5hgD+~4OvdHT;0eb3SR;P`~>*HeuT2CzZ zDNs}j>71abcn)&VY=d(ZvS>m|Qb57hpy(#YZXlEeBDOhly>xK4fLxVGfX5SnPnZCx zT*$P%X#Zhi`@ZCc65;BV`V3Y+23Z(x6dW;Q8E^g=S3jVz0mGGi^&B*tM zgjIoAg{=@#DNSl=IX6&vI6wk4;As#QM|B1;hdUAANSG@(H3AC$~eijGXKflHP+dWpY^0KaqJ<9&@fmdGnzNoGg$}St6i) z3eAF1fncICdR{Hel%|3CR1JJ4 z8i;r)iBh$~h}4nD=_8O&JLj4;Yed9$f%`sC`w7AaO6IllL~&V4YB8!K6AM5Ylop8Y zvCx*8LPQVKAHe$`N#Fm%)YtzB^!h)33<~{s1eavtf75J{{J%~T>iUX6kzcU&)BKHI zp&y|C;!;wQ>qOUK^1rx*2+)7Yf75&>b&FMzClU#eJ=SK@i|>BOV`0OZ_+h`#-t|KkIDuDq+y| z3zKZYE;r!@tb@{f;&t$L*n*XYxC4tqAVQnTS>At06OX#VSSv{R4Bz3=3rKeYK7lw_ z03sb&^j+OCX3HBD#;|Y&mdnx{-141(-GB~2&;;hh+yP7cjyJJ&c197bLPTYA5^e%P zIs`0^7WfQQPLJxIPrDGL?!c4`Fdj;oEreor;X6CvN+_S>Qm5_2TQma{$UD&lG#Tbl zS=g2eAt9*ciz_wo5;aa%9>DThc|jUIi0`$4$|O322q|YUV4?y#b{6gqpg{oR<3wp37!Pe8u(Eqd z&JK`>AN(UMfTe|PAsdOv*n$X021XTPRnk{h(*j>fd0|_y%LyYK2|>)D3WAD$;_yF; z<3*rAoubTHXp@kB$kiFdeCQLK4wO4`0oD}t1_{%q?g|_x-9Qt?%Bp0#OGm@raC$f6}U0k>pjVe35U1uN!*2ydWgm=O*e z^4w?}62+$K4!mfcZBS`wK{rsK;l&up7ZI3giVYNTc$fhl@qs^nphuJ04ZFkC4_Bct zt?gLhKN@5(3IBt6(N@UC)`jN%Kk?5$!2e=W>(&uO)~%Bek(82@09pX}U-ZBEpZ*ER z|8XCH|J_Nh!swzqV3Yv1pOsb4*3HpDfmO~8>4X(*El8e7rwxkYZK~Ul{ECo=o3pDN z_{5~|s!&}tWRRR4E|5Ah_$>jyo2$9Pa()<{4dU0a9J1%5|r#$l} zKLgV(l<)#1CQo@od4d`!qW%EIIf5M=FtepRmNy7X#O&-O&q+DjoC+}HCPZIAvFHf3 z*eTJpsD>Z14r4<=8#y~C2!STLLHLWj8;Z(B=?mq(0LePITgh|EDdN{3X0NCKouV&r z|1G>BrKgGZ7`EV|JjXslS6B`l7Z8Sp4gqWMQX3%omvb#AA3h8x-Zyy6!Eg#|VYEN^ zQgG@o1t)z;UJF0x)T8rH-3K>vKf`J(PRxPa6GW0vxeno<^kix00U0Y0Vv-ZaSBOJ$ zO4xf(z>*Am?+Mt`d_i*GgIo;BQ`$&AtyZ8~_Cy;cCyY)B`UmYf#NdLUN&-r4VLP!8 z69xufY8%uJ{h+GqXp@LCKfJ;lz!`>Vpabg#wgE10w9=`6VBb+l0Ce{AHZ;}AX*+1 zoSYK}2?ZGfiwntF1Pq!w6@G-U4mG`nQE#kIs^h88p4H{9{vp2v|a`NVsTM5AQ1>N zIMDxe)lC5-@Nl}Dn&zhIHB1ZXn7C7{7IYB^M1q=%lCD>xT)s`Bsb03?h)G`J=gT$K z-1F(xn9qg=oeT;(6hd^Nn?G&4u8Q-#)ES4orZJu>+PyvBtuvh0SjKo|=+lj=s>Gu) z>fF&=hx=>3Hg|dNW9sPkv({>`zt-D1?etJKu%)z3zd^n2?m$@TT@2fW|pqhH!EWne-aeC^G} zn6;Y2>;St%_W}2=LbsRuWIem181I=C^L#FAJ3m|g?ZH^%T$g6K#owe3xu;v!=q^00 zY|ox{G*|!XbrQiio;zD~{sP_1-#c56Efn4@CnLcX(cXKz#i*>Aus@XDkjKK}Zl7Bw zb1^pyA=XMN(mm(HjjdiX8SC=ZA6PZ`Ue-@>dlO-iZFo1aWp?PdC+_u01(p#SJ3JyA zrpXtSnFb7|?$A=(vSqPIkois(ww?ud>0-?3mLDhu=yaHRG#nWVNZ=CEe4ev8BjAgT z;tR1jiw^}I$+uqyj(>@m8>Vx2AUu?HqmDZ7gSs0e<*tzfn)A|?7tKEARr~(nQYnG; z<0JYpf@^1d>K6_iTvs%lq`7DQg00WCKREY=A@)MWBF@J$jvP8+N_BhJTZ~@aD%f-a8Y{k)`dXdFyZ8wgj5?8sUJ4AE=epV>E z&hmi=!U4Zqk%Ax6sl4gvNb$VOck%d1gDf@WOM8NkithWMpLfgg#ZX38Q9)M2k>^i3 zQ-!Ri=>Da3MPEkxmL!TAmUnv$*PdES z$DDS0v5HzjPqoD2rP0aP4sGfjmQs7(n7VWID&4b$5LS8*t%ZjNO%`x#RzKim**ENX zJ7agY`W%6Ka|8`6eQuUGL-|t`QBt|Fy~Nn34V^^y%yuxw>LWkrABI3%`6} z%`l126<|1XXwzaweztMH)}tFYZd}l+$i+plVIvgf8BJ4av?Uxb)K;nPQ&o?O%9zIf z<%?>|xNU1mR)xH0*K^y)D5aV2NrIio%GMFDNu^@*a}V=|2MN-o u*Q7dQ$Dv zR$1XnvpN*ZiSmE=ncaAvAjeUDsxiadF zW30P99`;&KH)7fXYVCKxW z{=VX-0f`ra$F>obDlYWPoNic>z(v#vqc2wOJab$7IMF&aTgK=zYnYc8m%Zc*1_oum zn$BhJ-(Gt*xt67MjM^TH6K7b(wT+u&!&5SHAZ$`){X&+})Z2@cC%NFN{)>@s>h z-DjjZaFniItyU0oB(hynMMta2@%H$)>R27(G!E-yycRJ*TN|%IxC<=(74tTde8VZ~}YPi7hMQj>&S~*ynKW z;e~YlbZLuoXU}>$2z0r9&e@`#Q=WQsbDdL5e=&peHIuI3t-DJ%=x2I8j@6R3{Pem! zG24(}Y`wE^=zU+MTK*LQ#Jy74yQF1Sk37ox%m1p23p^mMk;v0}1jCFODB10S;TDiitq6&)o;t_l$h zvL01<*YXoY7(}+;uLzDisa{f|%6!dmnz$^Fyl{GLjIeL(Qkwt^n=C#8{ULvUVa4&0 z4-HwG%hb9X1m>&nUvGcg>Xk-!y7H=wdaFh41yU=Pn_I*g#Hve0s`AfgyxUhX@?L-C zaH%4jS=`1|yBI^qQnoi=J^f_%3&Q6@p_@)O z4SjpFw9oH69LIC2OjyuV!KTOfmPh{e8xnzgW36}V$7<{#d`K)4GZA9==2COPC}4az zueZQcK#l8F(77{eqocy&p_vI;-7tQ*S| zmu7Ci`}R?VrI|xxZvQw?lkpbu%F|jG?+Fl&F)NoROOoop21{#}Bqk`>eSYlT^~zWw zw4pISJV{hYQ|-}}+K^U1h3WqO7izYLDa*;Y76%OXE?cB}Cz}7%@Jb)sJ0bp-uP*j8 zsjbS6m0A+^C|Yyb#q4-CKLXb&jhdTP*Z18o=V#V0$R6?S7?&>7p}Ws^Pk@=;^0eff zIeK?pUN`#&b_}mPd5b2-EKcFz^(fXmH$r>W3yQ)!VKd>gl8IBREFNrWcHQXZ+uu#QZUj;|P7gW=ii z<56)nK25#vcRt`eomMBt3<%|jcmIQhDLzA;;p?rgE;wA7|53T1#-PBbKWdGJM~bXx zMZWiRf!!a%IS$a@kZ8DN*E+N4+k+!~(Z>`%KlJS>Dyni&W`6B0#+ei3Faa25S?(l_##|D>_^j1Ya4;*ig5#&AuWVD3EXx*%3LqnlD zO}sxq{^}3-j%E;JZmG32_m&+@J9^+ahsy380fv^6eTLU~&Y!nCfA-KO zozLwpW7hf^F$~5G<%tTTvKleRk8{6Qtt=Cj5YHk3QT!->_T)!76QLJebJQOZ%{o%+ zl-DM3>DWsT+{txsksWqey5-Qrg>Q~zRmj+mkJ7=d@0wjS9N1NV%{0%azx#GezS0@O0D5o-63cH;TPu_7zhluGV9WB51gGo?o(;vS(zffaKk?J zqA&i}fr|2ZkGj{#X}z7JuDq--uChE)uE8qqOTmadGv8>BlZgP6ynNOL?ZD6J7gzXw zd+k49dYa|++&%4)t&tYf1KRrQivpVmjhLn!wPwwhcYE#K zk>S^`S7XPM9j{q^v^PImlweyaJ9u+P-=oS3mdfbh$`5xV=IZU@{W8#{Y@V`zmf=X} zYSP^%^WE8dv!Cu3le%H823 zVc(J7*+!eAy-S{r@g)20y`8?JFDEr5=p_9sJ^oMcn4`V=O~-RT9Sb!6)P5sVT9iP? zdc9cMs9$d8eY^K_B1DXH{03K$+E07PZrN9{sE_5%!er~N=Z%R{SB(0<@?A{KC6&%9 z+ZwuOm-NuL*1+E_ADun8ysja0wY_A)-qq|;=DWu1Zx_wIs9iJ~ zJbjk&bwZHPsdGuP?m1U9(g67srgZ7=PK%OE;EvQ=lsH^K8XtRiUSWHQ-;mwKrf(M& z*IT%rj@>cOL}*6FR-VW6Q!O0?oa4C<>9QYZkA)$2Xe)LHpLTiQX`1&TWQIfhY2FG$ z!CTzw)fbcf+v6^#q}P^kv5U_=vtjY?8ePdObFItcNFyvf#{T`as{w7l>+T$EnZA-; zCu}ay@#8t_o4GceJiI+8{D!|vhiB2?ld~Qg`-gJ#l8uI+{^}F{Cw(a27b`4@=Rq^h0YwYG3AIPjJ8aZ`vY)F4;DVLs{T;j8m zHz(%Y63VC#(@~jsEHXdKyU#P=+db=e>m$d1QpIo{q)W@QlYh~YF}0QHejDe_qx|Mx@#*8T0XYDUZdnv-!xF3q^P*CDYZjX+CJM= zo-y)XPtWl5~MhrMy*t3YAvzJ)2$P@#6G&Gams1$oq6s`6TSFz zI^F@dV>e}4NN;zsOUz-Qt9n}cqC&bewavLmQ{~e~m*!5B_;%$@b+(N1@?4>sJLWU0 z>}mMirm+2>!L&QmVvRX(!dW;wKgi4S`GttG875qh4>Bsn^(G?^Od*Z;G?b(3$<# zT1kfd^THpB&D&10eU}Jy`Q?c%gRQd2usxWYPb)@;6KZ3n!Q$?bqgvjeWXyYLWZ z%nEPsE*S9C9yb(P5PXJpnn*`Noyu|(Uhea&r6Nq?)msKG&9|;-d%G-hMkUGM)}ANv zYZOOTm7dVnC4Q=n)-t?lrlfPZjnH&iH(y;ZRvm=@eQZj0=grSEZ%AwGuic^TJ(gKo zcg@(lGcEQ*&T!9WKK3=`9L(Xs?VUZ#uu#zFm2;rQUFq3XhD=IV5528EuF2ui(9r&ZWhF%Q9bwr}Z6rmvgSFhqz_FyTPWy)uws7IoIB67d!Lm8^b+{zmI%= zbCU1Uwx?-PWnxj)Ytrp*XIV$z;abDOcMq7xtHy(0A1KNQALZOc5OJ(r-`7#m54!DH z;U$~51iI82^k(c{BUgD}l%;CL%R6M1FmWkcszV^yG%F-<5w>;x!(wN`eO+fsG zPTla3eb>FioUZ)tKw@V3R^{s!^O;msLY^;5NZr`2rJBkTkS1o|er1{23oh=okz}W$ z%d#K3<|hY!o3mwP=yp*-YvhY-IqmORPO%agW<~gMrfefhU)Pq%b`Bv4tys=Lnsxil ziS0`t5SLthrF>n|OkqSk<ZHgmsS$OoqxWjwQK$$TUfdvhXnLdU@&8T5Z|3ljo1g_zYgstGasjX4Td% z$)yk8dXM*CHue8~-}&kD7&R~HRusHDm$%aI`o$tePf_Few0^_7POjB}`aoay2Cz$( zwYa0CV-%M~_LbVtkF7Z0u5AR#=xCaT_W0-6=~B+K)OgM6zSu1sc{Lqm{*t$Eu6)eD zQuUC|Nlc1gJ|%TtVan1u0ovEL?S12vXEG99rhmnF{dNCglXWe|{c@X5(lLtk#n)c0 zR2criFk9hm)y0&Gdg78Ldpc5kJ4CdH#%`=@mhLPwU12XZGm9Zo_S5})3ZtFNLT2!V z)m0eIU*MLmqO4kJ^rW*O!0VhVmH<0z58x3;%ufuV2hr7!-m zsh>VxKWY(cwbJRiOT#JstIhfAEn?2F6cmj6cV`1h|6n@)NmW~0yWE&_$t-+P3e?Y8YiG-Tei*mo;@6YvY#bYcRe~9V^mktQ{p}l#y8MCUh&Ntt&+ccI=@jLy z&8Vk)T)Q_)-D~LWTrK9iPkHuc`L?&kws?0mU1=z9bnNstxP0nai33O3j3W12cAl!? zFE{pI(o4_QHueu3T)Dfby{YNKmx10w zU!BXNeUEs?UF%I&Y!Ch|?^LGwn=PY*l_bv>nm#L7=&m0Zv%ej#5-C4& z)hU*1cMe;-m)B{eUjmJGhbmvE_u1ac6xjjcftO8A65`gJH-Z?7^GO{QTUL0#&E!cw zt?1m`L+WT}+7zkTvg_7|FV_P7y-H^t3uh6(pjFV*Xm3-IoV4z9V!>}BT<5OTvikV8 zm}a#f5wBdfd@x!qF!LvbC67Of8#TeM1NtaD4ZJ-?_tm;Lc|Gho(titoGP z*TNm~wDCfxB*?VB_VtEmRNcN*ZCM`pINdIbFV)gMLPbblI=a(!&5Gsjc6UpTpPb91 zz5Z?S{z&8eZ{Ox>zx1p+r@z}L-7#Yt$7W_fIgyXoY*M`K+Yb2;yr}dP3OuOHFSXfL z@Fe4LsrWS+2^%+dH3zm#e^7E-Kz8q^*Mu9^_ZHu)vwCvjVZ5dZe~z~8xuX_mPnGG! zUa&hKC%NR&F2R9u_Z$KFjKdEWCI^l+*d(taT6{b8ShC(&Hs^AD&6czCj9SH_rQRnk zmvu-CV&-y)?>;h?9?UYs>`~n{GG!( zzP&<$T?bpn#~waCPGlxt*?DdFiSsPu-$mZ_Fv%ux3yBk>0?w3K%|9@B_j;7iu0c5V_XK4(#u%Y{_?A zN|^aRp?bVv<>+|Es3pSR`IMEaRv(y?@oKKpV!=QbMORDN_qbp?eHwE@%MNA z7o3)^Xv=1pCG&1<`ijI_MLjw;-uBwd`u?N#ro$!mT7iLW>Ss^d-F8g8fA8L0Y5v2P*SM4jEhRX}`IKEuWslr)KKs#yd6SaWxs0xQQ_^7DN{2=jop=w~UP-C3;T&(guZogThzyoJNQG zBS=giBaX1IX<4_Oi-pDF)7`MyqpiIc=AK{|W4p0a!zbYB3wxO)TdzgsLKsv;cl+_d=dI!AZ&`4G}j#Nxk~SXGcv`>c-dC3`mKrS#6@@Iw@1t~SJ*Q_PmHjKYj^BnCzdvBKFORI*W)m+{;HtO>Wl|5g? zu2wlW`L)6X-O|`cZAeloF)D0s%&rKHlYrut&Mwq(p-UuG$?pKwA5+WXdSDC zV~^!p<=&Hg`r~guhaFrI&qK0gza(Pp_wbJFbPsm+Z)2^M^0NNwfpT(O`$hEaT3^pu zd?0rh<07JUX4olf*YZ~3AyAq*e?bR$=>NgfTH!`KM zC1tJQheXXNP|8Yag}+N^8S}7rcqYRA^=q?7>2j`30oywVbB%YFFZ+xajiU*3d%_yxh1zDw}>Z^l93glK!PJR}Hg2oYHR| zes}(;k<{=$`ZEtIMC6{jEK?l)Tz3CT@PgktPq|-hb0DTNFp^4)kL%FIk%&4fkvW~l zPKQ-0SghHnDNA>VS<|ssX_U1Lz3ET@HIe5rgRD#P@@1yJj+Sn^a}BIFg|~Wj)n(9a zSDh!iaP6t#p1j_m98&dW`Pfqh>T6n>VCv?*WL>}3IZk7V}S&3iv+x0Ow_jzOBjJiR;TLuee&Tbh}T-W=&(1f1jw5Uaiqi6H_Y~T>j^hw8*u_YS) z{_SJl!0ziK+4TYL_h!Cm4orz-c`kXq^-_wdclS!Cmp0c5@{`pom^MX)s<4op)1}i4 zj~+bey0OV1x~_{*92qLIT}AnAP)-)<;`2n?`4nFOq1ZmIvi2tlj^~qo`O@}8gsN`d zY`N&24&TZQDb28XcXxQ}OLa@h#^^LiSGC>fbPH*2mRu^esC^Od-rfXLMTI_j!2i>!`rXlI7UW%Z z9ei_GXs5YZqod98iw0NkUsevz*k`ch7+Y3mt}g44Pg3TEnp<|4SkG$iILjrT;xh87 zZ{TI$7R8~e_XEvkHPZCkLa#$@!2;J!VbeIcPD*Wmd*fuB?34Do*^1Be?fR~sJ)2oo zRr1lr@@Vv-xaqeXjfzHFy{^=ii)~U}HeDI6Dg7Sn(!^_4F^97%IL>dlE6u~qF^^e2 z@sx@;w=(_m4s{hKhvni~#6899>&;7e*5$i*)tz;G@g{L*$H+!z5sh<4ayC3OzqKL2 zeQs&d*k~`0?pj9vF!OEcC-d@#hlZ@(JT*V`3h%sBo18q*4En@M#g(FS**!d0?kgAN zQrT_kkfB*qSC?^V+e1S^X3^v%2Z_Y&%Tia0hMRr+zMR!(b}s6xuxn~!w`^7MSuy9t z$?6&~!66~EE!@!ao&dX{1?5KZdepuUb|wk_p4^#8ZJpQ`t}c5 z+I4msEhIbZ8m@PpnoEx+7F#}H5+AM=(&IgTTq=SzBjqR^i{S&UX*p>rDfn-kF}_`k1fa!MTqkH+NUob-8lDetSov>kHV_TW!1cxKyajY|13Awem)c8-jRjkQwl)kx!JxfEJBP642$xM&( zy3H9e+|1humS(dhMn09=`1P-~N$e|_5%}f&)k1~W-Y=bIbo+n&`a)RP=qgGKAp^~MGROGY&E3Al=$u%5<=MLx zSuaeQk~(W1pW5r`>DhZfLfpF22_%$KZTU?h#cWR{%h?&3&Uy8BDAY@Tx^K}_w6eT1 za9B1W#fx+Hj1bYWN=0vz*np0_z;7>FnBr&BGbxUJt6n+&?Ock??mdc4~rXCKY13t2C`DC$tSl=H~D2%hAJ#Y^7Ok0;n9Dk;l! zeU?)dlVZ9qzL;Rb&ye`cUP{aIRaR^M*U+!kK1YL2zMjj>uAbl_n<%m`@@s(KqqIu- z{%42uoG+?zg6S`|==0t?$okx+yf&JC zeC9uOrIu@Z#bJeaJ&#s51?b1}&pU0vAf$17cF(s5dPS;+f}A4Xb{t-i0 zsYgeqC2-}mX$ShWe<}^|sCtkh-%et?0v;HvXUlyYDH^MNo?R9+*P4#C^l;+-Pmfo- z6c!TM#rGGNUlct?H+z3wh-P#CG|qNXP+YkRVSn6-arr9!MTF#OF>@DN%N8blo~IzN z&&jzoGB4;nVNXT4VflEZ#Knq!j^!*8L9yXXK|(~c1v%U@0ir{1XuST}quCd_2} zP{u|GS!Q9Zx0=&p2&4xd!-A0~vsLdae+#?&*0uArwLORV$odG;6`Ios+#Ja~H$(a& z!s&(vF4KuFV&kMMiInY;wjXGUnN!f{Kv?7`G2X=!+mzKZmSlMJ4na+6`brmq?8P#G zFMZyb+rmp4rxjn`*|&S~u_NzY4ZIr{+qZ_VN;V#lXazub5-b0DXr)0Ik^1V^!V+v?5=!b=G$l#edMT*Nt0B>9j9J~ zg-?=->T}!5oO4?%PP{&Q{9#aR;pflhTb5-G-%JnCK6aF|bNY@8+Pw*K=>_fyjBBzp z2NXxlns@uMWJH7~?U2$8?N}e(z+2sRNOSJeQhw&7?2PV}zHNtC_n*3!?+S*UnLW$O zGgA0!-+LB%M(WDcXN>eD1E-YwSdSD$xSnNjxzpV}ljQvr^cj|~WG!5$S#%H0>@e{# zaC8vh;(VIQx8rKj>)Q?=gs`=T*pHUq{N&%JIxM8Mk8!zvxsu z%^)(!9$=6Sp+BW2?Gnt}p~E&L=Hm{UCT?tQbsEGVZqScTwMnm2dmb^Bdi>ku)`3uIm+`QTD+2|BB+8NlhT;ZiEVwRu(#Qz3Ypco)yZvI?N?oe0 zYgA4=eXLRyKeH=vurFnHZ5Qi2(aL1G&d(`h4r7Vy!Q1Sn*uE>(^N35gcn_^fd>SjY zROrd)-&M!F>e(@9Ob;u4JJAC;-X$j-2AiL2WVDb1YS~WM&5oU49Bo`lfQanyr!mhHsoukU9M56r~dq2IY)!5RHbjRt<-c~!78_zk{ zZoJN%PJHf(GdEfl&aF5@x9d!Tt#kVdvzbpBABR|rTrwl{a>Ovq$>J2-K&MJr=@1-b zyWr_2LY2=)BepH7K}_3Op6_p9*b+o1YF50dbQ&kShjdWwX&6>mIzgtezG% z@G{FkaHRF5i1F|HEW#f04i@$1&pmonFE=-rXY1+bHRASl<-!@p4ZCyR98DR!l11vU z30_QUmn+(5VX0ZV?*x&VL%K&iC9b;3qJ~S@__)aSw|e|a&Zc#HAFMu~bMJ8-cYpkG zbswLy3!1XGoVK5dI`cj>!nZR1RCc4XJ;z<{h@*R6ciyZb@}+f@6%T|X&kCU#X??BM zA9fuu7yJDl-7GmvgE@muO+rsxkAgnk`_i70m);r`3d2Q#&-07PzEWy6C%wB$j;X3Mo410=gHt(RHzOgdY~!umT@p!=mv+|W z5BKQln`EEg$wMTTC&&$U=o^c=m$1byzEx*1qusXSjDALLxk%P^?iDLmt-7;Sr|rX& zv*{DhC(c)&4& z-1^+HAm2FoRi7=`;>`$}&!_p^$(c)+V#|G<;Py7mat^ zEBAI}_gx6Jm4#i7fO%(}Chc^lKtiZ$EkmF~0m`dw=tL!PL9gkfF5=aR18 zf-#xkX%S9*Nu;gM^!U4LU-a402et5(#=5M9+l@Dl2-Ez(WXaZan2 zw|acPC%Iv`N7ldY%9UEqRp8Sw=x`*9X+z<=z_Buu#8mo^8xDTBowCi)R`4eHNwzed zXI&*LwY_w0Y>jmdcY2wao%-uHsP{pG8Ov4|FT2{{5_3dSib_=Oe-sqN7mYKE4Hllg)f)8`j*fc-P-SlDE z#-QgpiH5g|XFWVkce3=L;^NX-#FF6RtwaV7f)?}iML~3Tjx(0ohG;0WZ)4Qh9A`Uk zk#&z%GLz~#DH3x$%SnY*H{4edV$Otm^H({vi@us^R=j@tR`;tj2-jCEs@T}N;r=oX zgAD|Q6NIm;-di($r0dfvo+G*3-fWi0iSXbjDi#~)zcSB1Gn<#4&EojB=|%@QnYZ0H zUNEoEOTTM1D;@I^_X@(aYQFkSEoe@&AZ`IdQ%o$yAm^nG)-dSr9bh{za^!AD6C_;&P-AJ z;}=sk_kiE*Q1DZk70bgc7TQQ1dY;peWh1zI{((N55RG zxu98Z_@I2&Z}m&}%X;lR*|YV@y52^GS3#H9 z2XBeqKX8_L!AsXG8<;+Pj36kxlsE9~EuXWV$5JJT;1jeuoOuy_GhvUlW-5WzC9tTN@r)|t=A_>`pD$crdf0lh^Y0QS>mkW~1XV`F7pQZF_6G z-oN2uVHPaS^K^f5dVQ9>2xtjnQ&YJ*d`{@*eApc?dM^zW^x)pFbBnt%NBmvaDJ9;U zvDt=^8-k|EZU~zu9edY9$rLu}6 zA3qKEj`z$SBQ-bA@c8g@F?*aqUhmn1LPaB=Us~vad#A|I02nmQg@UWK5y zPjhI>>n-wqQmgN|d9xqqjGn6=qwgM~_#8mGQ#z%jLAs?S1nKVX4(X7tL${=K zNjLZa(%mVYhi(qvet&#_ag03}a_@bwHP@WiO5kSm+?h9`Y8Y#D)xh=+-U{{=OEPT+ znF+L#q{|Erlo4kH33uRvJ2K$+m!&|qQmc{p9GRCoA@on#ZeJpM*GyoE!<>^~Ow$c? z;k*-$v1ib$lyLy*5={QqPn?2iGJ_Qx_Y6r94635F1yeU7lyXoG>s#0(8NzD{{dnOf z>=l*rN8m`njV?GskEM)bkgyJw=@tE@cxZ-?g0S)*8JGkgn`1@K-r}@YqCR zWYl#Lo#-$KeW4&S6D&U^4gyP>jtyU2Ol}sO9=#2VSHj&9`*4G~{OX;ayqD@w{ z_^y!#7401{0&i5f<_5zLvl3{w^3ch#r;g>$a0zi_MlM^bppcjAc>@lR5Qs8SgpH%w z#D2kR=Cy0F#|_<9w1m**aBw>CUV9(?>E57(Jq)$HY-8E+I;Moh@08`e5xwhkVF<7} z8f8!TAkSz$ztY63B)&T%)i$>4SQu5vYPSg6d4oa2wTwK*l852Q_m5t`v30&g6GIpT z%-rlW-vx8)sF4CkA~_jBz$~YUD{+Fvm6w8eAsmj|Z?6FmJ~i$5>>vKKNdH8N0e)|+ zs{&Q2Y5flMadX4|yMSDx1Q;4d60`<%=@Sb|J%n`6`WePQHRxlfaDj@^F>wE&9F%Fe z76oI}VJAvSZ%NVorZw{yM*Q9jr+FL#8boK>Hf8<>CU~h;@fAnOe87<+~6?k z*pTSx!pLaUm3a4iBXI|81Sw)EaXkb**o0~2D>LeE@fa>9ZZ16JZ<2DuIdkq66Rkr{ z3)cbK8n4}LS4>(4@_Ta|b|M4*Z;tr|sR#GB%Z0;P@9fSrDjka|ApF1XvsoIXsY9KU zps)GYlW#Drz*ei11@W);WBKRZq+?C6Zu9T@a48mo@g)Zk^^xKz=2RJ3S!nl8d|;JP zf^aQJ_iIAi!s2}}@Pjv5Q7$eXpg5LZbNjblxTsN*j4lb;t59$7`B@kl=aFX4OCpI6 z#APaVDjk{v9CijPYdcK~=kJgaGa8LyB?m@zrjG&5Q_Rsh1tWjIbgD5qwP-ML=}^oe zg+T{a$WDX5?PmafR^2;^5bPjS{zOdB13E`!!TWr|e%&u&pgH&j_ykTBaF!3)GQhz+ zO*vYT10BiYP=^#(BZxo}`}!BB6R!L|^A<`yJWC`Y*zWzeu!9UNBy=1y?ubL4eUmLu zW4^|3J7lmoyMoZnbvzw$ZqhAGn!X$^O02Qa+2*Uh-ac^<-55LSWn$A#2C?|~M8+eB zF&j6Y1CmVenC>2(NRTW~Unc=RF1|H&E0*zSN2IRtn7TzVNFs+zGQ=V*mKr1u=Pv$e zKbgyw9*M3U+NaJTNt2*G3Dclf9c0WPm}=xzNG_uc>|_i7csA1gR-X`{KEx?s5^4S( zS)~Mm!EkahLJ&G;*``&4-^C`c>MqC}t(e!QsqNjZ49T!8hEQaLA=qdz`=kQ)1&9R~ zGeK_rx1Dme<$awETQ=>6-4M6Qu7B+(f^iWlj2V=jP?&8KZW6Zm%Gv31lU>pQ_-lp! zM$=>5Tj%4x(rPoYWxgC7x}Y)aC5Eld92NqYP$s!B)!*wFV55*TNOa}#()TGU2y)9# zpEOL5jY*r#q%>KMb~HP6oUd-?*(-v_6!*HjN7*}_|GRo!>#)1(C)o)Hla4QZ-TE=` z8C1BvO%v~sr&ah%x8~6ChdA}PJwk{5C^osaK;tzy=y=TX8(mmSm4+mTcgiIRhs2z_ zB;x)n7(`w`brq?*kR~oVu762QZRPoDfwUw^hw>wlk(+e?Y%Jm;z!>!KsYpa`@brVd zNe-eYdMlPUDmNo17JsreCI`k^UuR|;h*?rmhZIML%8cF^rw;Xy_86`f%vvZgR+;g+ z0LxjWhi1fE2IfICEo_NmZy69|UAgK6!o7I^=M?9Af!QNfaQhzeaF9W-;b<_`z;Na# z?cifLfzRO2lIZpCrar{BXL4<&p{Id+FUB;Cd*9JgEoF-3B)!_~Cl1r5#5&rh1;K^y z%}9*i!*8X2@hST(*}kL3z-b3B?kfsfk9pM{H}{#^v}#zZRA16Y{;8lEDe=u3J}AlN zn|p_#e28z)I9erIa=*yU(Ok+WnTX)OjmAKmquuVhS3+cT^-2jFTFMilR;?YrKB5nG z>)rp4HbL~MTso#`n_5B&3z(djI;`SjW9!J^Ae<-*UM7F6&FFD9nKEi=|5}nP-&jz~ z4s{QsOvIKlpOIozDT|8VvHqWT;uyZ>CcT?oc=HqJUi3n|ayk(q!P?q+t7Gx|b3y7y z@{IrXb*62AK*L+UOW038&LqZv@5i{%5705j^SK#vU*)}dzJ0#WaFdzP4-&Fxox-BQ z1vLjjsoQfOdH07u8UYY~sE1(Lg`Wh8QIIXF~Ppt@+{-uKsp1;*|f;E9Y% zDOqkP)*3wj=Vu`hS}Z4mGlCh?1qoHun#r4Ip)@FHD6?f|j2$f{5-3g>LsZ<8GaeiK zGNEv=zA7*Vqj9v)aCK;K5Tg|Zq9$hoHrN|wX@G_N6%jd#rPU1Bp0}clNXU(a%X!Uf zjH@U`>?SwYuzvz50HHoYxIX0LN=oYb6||XCHI@U;$DK132Ax{o1&8=xZX542*QHw1PGweanOVXyOW_{2 zXR-{y8-km`S--~C-eoW{jJ13RU63$ZdP=XT_I?k_G@@Ub&>!ozf9KYh69V21GTBJ5 z4r@b2tRt`vUbFATg+JuNqou8Zv&&4!`_PLx$e09D+mFS;hAWI!CB)aef2Fk`6z{zdHb_CKjPUa5U+0ND+Q1=m9e@&w8-U3!s z2DJN;fl|g07_4(0^ZmPlAhg721#FsM_hk@_WUgQ8ORoH1`FwEZPPk&%u+t)QIDG#5 z_hGZ^ynXZKDm|g=BBY6zY8M@RN=)g*qxb2?w)TquaECylG|@?IQoojLnWh zd<}Aj;|8n1PjYwo&!QS*TjNwCusk^SmgoKm61B{KG_FJP#a{x0oWE4=NPLMDzhSAf zBSbm8n?gO*9u+6oMjHeBN}U9+iw_DTng$fa_;4qL?3ICvD75BZ<4ju^+E?l~bmsEMbTF;C0r7$TRZJDpzNcJ&-&d7wwB~%=ypaxWTeleg+34$;gJ>aI`f6WSLAlMC?Tsb5d>dtdCk!C zvIoNwdkMbpw3 zepq5Wxd$Lg8irZ|ggR0fXbVS+G3XwQ(s+PBErqF{&M7O!x=)C5_RA@ja8jH2U2iPT z7Cxxgaf^ZqiKdX*l1KPe>Q#y~BOl&%pW676g}ZgcJN5#33mzv4k&vqvyWc7x&xae- zt8o#re74R4+S1;C1O=5vd4fI^!XamVN(52&jtz*rd9pSU^5lc|(<4d5vvoi?suR2j z8kT+*@MB16Xwz7|SDyX9-6S}y#>VtNJZTkd>hdL$*YQw1{l6E$tW)lWh95yFS~j~H z6!|wULMW{=MEI-t?h~QwwI-DbTkjwI#!trg?*w`YqdAfQKj5FiVUDVs`G57CKh>vC z1adoBQ7fC!;cy<#T|tRTDjft6qv{Z3gl!*II}zaX{Ij#5w)W7|d<&x9o`gI(J6j*C z(0{F%HrnfT8;P#azIgq7BB`)l?iH{FA4+@8)^XZUwWyRS(hp36H@jb4KLn?Mod=Pl zVmY0<>mM2PnpyOJAJSUoH9c*GMj1CKrvC2{wx6`^VkA>X=qDSF^3VsIorj5!V+>WK zKY*Oh)_iW~wV-6A*Wx0hG5eDp7nMc^x6PlU4JUVrMeet%yem|e$i>P zK|AQJ0`UZHhtPZxlE!H#e8(aYVFF&nM-37OXbS?~Yp#rPAk6Gj^WR|A1RXpjcqvn2 zZ_M5hwM6jug2C@3b#p6HkeLa<>lS)q`GKpY;NQcFK*=sywEXbX_Pco?7`sNUb|lYN#TD6 z%{WO|3K{-zOr5sj%fz3g{g;r*eb>g*+SNgux?+@sqacxpjR5bCR!?- za#4{^iubF~M>+O@lyV`1mkOQfG&PtzptF_g#ZW78`9#ZIDysmRa`BYdgvL+I6{$ol z?iqgyiHf!g3|pAl+eI|kWCuP=52fbwznn4XdkoyOi{9&-wOM5L9-WIEFF`h6uLc)) zJoWDW(R|sCX0_W~>wbL-e7lEFV|`v?m|O|GG$kJbLP^(ayKU%jl`(~j1dZ-=G`Im& zFXG{ScjMVTE_)hg&v%6A(id=V|3+*1o&TEt7$z8T(`zhTy;ZPip@jrHHQ*cfETp&S zfl$PN7J&S||L4!~lSQ%1)5bOnB@T4(Ls-i4_|MT0SIhDDh@e;;jbh_EEYr!xK{>lG zz&|xPG9@7{2CICz^ctOnQ*_65=GoE_V*XQY@5OJ@Y6mHT!}?j;x)C z5PGN_k(C<4^%OgU%Oc3As~3?bW7S>uGh%T{o}{I*&#D{8Girw{$WaJ4`V zfy1nxUXS0rMp03b^EZJ)$Oi0gAYO20`%5@f;5Pp`BHAzkL7=Fv1KT4RSqwWbIUvzX zkax1h!FQ*@$%uTY{v_zt)~9dkYwf&Ru5wiz`!8c;25Lmm1_pDuM3)-tylsr^{sd*_ z{qa5@ufy6du>&zd;qBId1dfEZD22AHd7ppK*9*reiM*h2IxQ|h; z`$R#kQrQyZ94JW~9n97r>*6xQK?Pt_@7{b+U^Cn$SlS#6KV$6mS))WT14EDU26x)c zQGJpnDnr18u%Nvlr41_woIIR+So4Fv_3S-7qqk-3$y{)nDvd%0M(e0OvA|LjkHA21 zt7PGyiQgunl9pqi_eTEtT!%r0He;1ddusEmEew7!nwu$Q1ub9xs$QtTFK2Af{W9tG zHM5{rg;B?w0$!jM2oWrs7XkJt#NhcA9X+7_AtM>dR{FLZ@1Dz-4U}U=LfJeJRqfxa zI*tFe^SjPhAl;qaN)TV;{Gcc`e=jgaB=2&w{e#l&hBHCzaX0_G)6M=MzJ}8RS76n@ z!!zLE>Ezk2$=UgWT$a**Mrd{Dy_(a-9&ai|@m5QwBvY*<|LuOHIz;An@$-jf z(Nv{6U(eHVZNS~Em63n-vdxJjRG^t)P&KTZ_!kxuQk8bQUD7;QP`mHNgrSsDNd2hQ-s;Ua32IOp~f4S}MZs07QGi3^g zI$^-khTZv-Mvzx$&(1#UjvK6RsJEOf^s-7iZ5Q_GDoITdI19_X!|C+mbq-}YI)!IvjaIRCcCl{B@USCLXexm%q^8+~xbOG@ia|M({k zyNXvZDtB+HSZBi#5IM))zU>-MtX3C@Qhis6FxhYvNDALv)WUxB_s?vi6y1qMqVT7i zaLc#;?i%6=m>2(|5rj8SNw?4r$ld$)U0i%*uX(#=52$w-!n~($w<&t}J@IaCWN&m6 zR^vtP^>UfV2@2_x;4pd~pcM7od==0RP8-Yh8;|1~BPD5;t{EY~rF-oqsrIYKgEa7R zMXTe}@9YE^^+ZdOGthq_-yjJ>?+3)PtMlh`H)TqB_Z8X6){BPG(z`PUC8gU~hvrq6 zN)78c4t!}G1POm{Z)0aF5OY(vZgpu2t^$Dzi@!=LP^oyNiQM$Q_P~x*j8!YH+bYI44@i{e%i~rvL zRWu=TkW&HGI=Qv&GA!5pZ1)@y0cTmR-ZGzKuNapQceYf&TX05R|j!C0)ncX6ax5g`Ll@CT@+l1O0hVO>KGX|mrVbu zqBLhCoIDj0X~e2lE5>iUi?&amaw)-XGO3L4&lx&$`^G3&C?g(Zd0q=;q8<}k-7{iV z@$owaJw1oFooauRK9i?T@3v{N2?UpYWrn&JLp$`}K}rRcw8#Uz{l2d;kdTo0KDAlN z%jE*e#cNN!CkdRPnfqCp(Bk3J?CFcI{5+>HX1(41>u~4?Gc!7KeqnX@4xdVoVFk zy9KF~uS-LiI)1H2O!+SRnPz@>)-t=#Zy8iY{2U7zJLI^sIS7mv-rbvldVb zRyN@qMJcK}KO;^rG-P<3j+7DC36`T$0;Vwz5M zxEj0Y_1NayT}yR`mzN%^2zN^O03m+t*AaoyG>U*jlb)U(l{%InvxVyC^OhRdt{%J} z4V;4U7V62}?4jaABFQrz!hg*NKBiZ*b-HF2=g2=Sy$pU@G!$BQv>FpV6oGmVNv9jo z3;#Dr=%VrzjE33Jj{GBH?KfJ`*O8CujhY{SErOSX0eR4*7!sCQ0`*I6$o{5d7VY_* z2fVmeK*RdPw}E{cjbtq@@3Rj0y!Ws3y{epv2fo*|S^Q`WUwAPJ_Y z(YF_$vuRnh%^yW-x@dM_b)0mDG?0B)qr0xbj`v9B9 zfk!b7(f_rXG1_s6de3b*%Qz>mAmx(xb}0LH z-_rByAT&yb(=5vI(DC+E+w_C%pZASKV4$#QTIurc;o;$(!?4qLnn7z-*$mq%S`ZNn6u>qx@)G3F-r7u@~SHb!cVI^ zBf4$kO)Mmdi%gZk{g}5W_Ed#WcFJES89sC=%omqyF=g|7!&I_!_*%OvY-LwWDUQ7G zw4_lvI4Hwv_IG$VaMSe*kMM34_t7qbUS(nOmvWq7EXzuz4SPg*4~9{qZdu8oW$4M5 zveGCPbL2+*i865nUDyqLb3~@Wer)!_Dh(DQq5)NiGUPX7UclWl zkU=tDy*raUY2J&~!PaLwk})Ped|ov0TI<-%RZ@WffI7u20e4~)lQ>TKfA{xC{A|7= zvfqCD0P_VvAzZPx_FkMICo+1v-G9i)=7u`$5q~0qp%X^x0n@j~#8`A3ZB=0F; z38YT?UTgJi#xmhQX)}}5`>$)Bo=O6{PHJlQVjp+!yP$kMuqHR{Q4aUCp29_1YO<8U zkEvA)M0s8t<2~(db^m07T$N(veE3?^J=-lL$l399Ci+Obhdov&6^;6zgD7Uu)NYT+0>l6y>0aJAp3*N zJu#GuA3cv1m6sm+TPYdw_UQ`{`vlUCneIv4gcI3b_pkRh4!+~1cj_ISO?C$pN_x%q zzOT2et1U{gaaJxYRwBM^Ttx^|r?NyK!qed2DPj*B_jx|sk7Dbv&35O12FQiokJs$& z7lk{EHQ}7wQw4v~0OCoxyKe=Lm9i6bW2W;lpc=K8aD~%LDU00YVP)`-RH~G}^TlM# z#<2#oecay|`-<)R+ffe26$cGAqV<}Km(2J5!d~A^Ar=x{VuvT}z9L9mrp@g{fp^^b z8$!GkxPNP3^VtI|8{8I4pxL2nB0?f4O%al_!Q@C6x5Qj>#AnwN}1j}rtGGU z)^@#I?QM3Ka*MKw!|{}9KCf7$vu--|5U1CEqPbXpAEcOv^!n-u`VUAc;&o2~=(b+X zAx^uqueRqHUMi`hyNy1GG(YFiCdC4G5(1=T;OQda_-f^o#Wp<-Uhg+r>|rnAqiLBu z7IuI>M}F^lzT$D_u^Dx}MtfCw7;#dQ3&1K+KOY=qM7=pP)(dNyAQv(Kkb_aS9%0t# zpkM0DuP^}rMeZC#YcQ~s`4lI|SfcPjO(EQ5`UHh3-{<9040i4{UdV`6|8})!^mvsn z&*W8&GU-)Jb>t&mdoW1OJDJXE`1|}~fYSfsC!G>&!Op|w5QW&&k{QzT$+A178b>XY zj#FoUBGMt7*TDIaZ`N~&7B>vYD?Tk1CEShdxpq;=>3mEln#lLs0)NzGGyLs4e+-Ys z50E84e0JMUv1{sfEhmdef-+5_DNGk8wSBzbbh7nbv2_S42@O5)zYY0>MDD(;dSd9m z6X)H|Bu-c*wEhDIYsp=02F$$f#^!&_Gv)sgGgNX)GFQg9H&72uJ^DMOC8_akzEl>j zzWb?G>3@f2WL#9e(7x(1`FX`!+svH|-n?PVU`~?B^GDF@H zCvPe8)jxI^<^6H1M{SINi!^uDEwcqtE6w*!&M@+@sp~lj00{}ZOi29^k?(saVCIm$ z9K>BWzt8UV_Lw9~Y0zvv{qkRoj@>pAThhp`&h*(7;N$Elk(n|=l0f`<6AH{6jeP$j z$d&mFPe6^hk8bo*U8zOsii})^f#NzLcOa;tYVBdtq|Csul;Lb#aOjyc{QJ<|;b#f7 z(PAN-_RB$aDYJAt(I|(rOZ=qR>&-#WMYv`MMgd6KXGp$cDp#2SN%(8W^h3TM)aNMt zb~KHpe9;yGpqG3(2t4YXmKk`2st7!;=Zik0N&3{?1@2H9K(`kJXRbHA&ze-eUsd_z zK}Z;b5^@5b1g!F_`@c#jB}P~0Znw3EQdV_{SbBC1r7jx1y^ONs^-56+U61V~h$(w3 zFj~ya^`&>JA<&TDhh3TDmvb1K$;!xJ8hOppCJ5`&)vKi3`C^H@T$tD`VBX&&z24ea zQ2VnxC}#0!l*~8dYszSX2&~nlR3t&z^ooUqB+cZICEGL2bq|itAhNc@-I!I+&I3$y^yuWc z@qL;g-HV?7n`J&WH&Q{002OM~Zz`Sgv{clT8{!3P#t+0I)S6^kpHX7 z4-RuK2FW&l6eK4O=R#g@JH$rhE@ur^ksPM_{&>4M`8H^=Bjo8>MG*E1NI$nKfpEB+ zt^ckLjC`4zxSI*&wY#0S*#j;|HS+>5uk)RhRD|&Q`@>@b?naGjL?4VH78QW=Dg+jQ zUC*g$SF5f-ilKI#gT~f+mZs-w36G9}v3^@7Mh-;fl`&G4RAQ(Y+YRnTGlaeBr7;&_ z2}6`(ul~@JKQ2*>zfve4PDEl3#@!Sp^{kKl?5pP^BEum6A@wOv8I%=4Zf;vPo}L~L zTId;a`>J{PZ$e3(giq@}FYD$OFW;nm-8k>^gFSX$C(;qSeL(NI2l@!ZE?w_#bogu{ z08c2DYarBjI+t!^rhwR8S(eMkk()!choa(B;yQg6aDJV?D)i|Lhj8vhtm9FuW`aj& zWU#y5Vsz4}`!SA>_rqZOQlY@-fz7t#ih%?HdZ@cP{$Gx%uDp1>T>9-^kX%sp#rNDl zl&=>*hRRCmtS7`@(>C7>pMoz^l-0I<1kc-qzLk{^sMXcSJD`d)Fp-WA*6n4Ybg1!8 zh8;ZLKCPc^(+>*S?Bft$3~z0fiQbk2wQ8+X_pPR-k7wBc2;nO|4z@?tS>3n3DP!!;6Mv`> zbhDdF{baS6a+BRFb7*(`qe1r8u_|6Jl3_mvDOOg93bw&zjW=dP=ow1Y_M$TBTVYYOxCu z_KL;u6h|x5CfK6e6rCds9ZT0x<{>D zoIe1`1c+UBcsqDN4Rw6dv)yi|b>5PH15f-w&+gcMRN8Ug&fUU-0u_UWp|Q0`76YoZ z26H(4ZPh%l4elJ$TKJCXphJ?7&1bKBw(UpzYAv>;#B=o5T^*p~R>9^FwtBb|f@b~o zo_~j8axEz{&CTBRux?kAY1@>W7mhLtP%KVoYAM?s4Hj$x6U)vKJXN`R`JeW>!GOCR z%1sf@pUCsu0xg@aF|)`3vAHQr`BO0^eiucgzA}Z~PO__h&xuy0Psf=?MgP4yHtGkD z9MFYbQ$h~xr$Ld~@B1i*{=PnY-{U~p{N^e9>Uc9q$qZH%+uGY##?+QoyxjA>bi?*q z&Lc+aPt?9?C!aqrem`j63k{VBeBHw!g`M2@1RjSInVQj2>p6AXmP>Y-&{M&5eU<3OO`9sgHJ!PgM0?01ki)PPTf8MTr_~O_O0~ii9 z7A47+qY66a#LqAzX!rAv&1b`oc~h$VPr2F!WD)rfe;5!WB79whf&Z#%;FDUi%gBrd z-fZ!443aUsdX%LQ`MIbE5=Nz~)XeqR&s@0QDKGb|%_a)h!dETPtz5JNz`d`pXoPI~ zo$m5)Yd9^l0!P0*R$H8qs6w{7{h$Us!sbm2^0+s*9j>Dvc8_>cB?|mRh{L%N9vR^p z|6X^_`#z>>v9&+^`#tU4S04KL^Je$yiCw%PvmGxVbnS7z*6?tz4G~GgdAwg+)#PluvKl3L6K1?}s$8 z7fz^qj%#1;td#oAKh~n>n%9MSAsN|RhDK&NRG;2HB>$_OeEz3Dcmk6a@0VD-Z0pTU zX~@Xvr^9q0hYHu#F^LwzFufQ)vM_>tp^vEvQ{B9Eu^ANhtj@u1fRd_0_*=<==lX z|Ep^Tw5nGE_eRKpd*ZK3Km+*@$x`6s)sORzNs+zg;c!a+?keQ(M~^ygS#g)PpEv-2 z#87KXyR$bKV#(ff^RFabUvS#q7Xd}B+iUQMGT=aH(`P(Y>-0Toqj>5cPKI3fzgp~6 z)avD@^fW$|dx=hTC0{Az%OTo`)Oy*m3E9GEC-9}i2GjqXRVvg4p{I?0XK9Eb-Q905 zlST(;&01_e^I7uW81#$*S5Tiwhv(~71XS$)N#c1WV$Q#*NVN>4wv8+tRJ~8(}1X0{0N7y*=(sF zg>PhEgldwj^F}AZN356Lzfi-aMW-1aGP0{mjY_o5Yh}^nUswSbp;c%QBKzNsnDA6g z*?4#@>z=FmfK8Z2312FqjhV6e6p!3xS5?dZL{FM*KsP;uM?M6&uiTRZh1MWtPbZQ%Q{Q&#KMP9Pu*-)X z+UGN`5fldDr<>U`y1$vU)R;PrGKgTk&k9VNS|!P=KQeg0N%Jd}>e0n)ssHZ*SzQVUM??YDGLjSlYnN{U0~lKVJER>lvIIXM3nM#^)Gw(T0jYr;lhBh{mw#H7 zf=aKy%&*6!kMMIRU>`Meyw@(T?B1@}+gB~@W@KoAO#=s+JZ9Av_yp^iAOe~A`;Mb| zt-uFJewJr8vgq{X5cxB7vj_GEPlZIM;XOjF8u0s$SR6gm%jeK%$9cr%%Hu)~jI+Jk zqpjz!_I?20Y<93b%{?Bi$zxmY5vjCNA0 z<_^=^!m)z5m31n>PDmMtE(NmqxL|eTL66)z$i%={KapCskWGV|yZ!Y^ZBM&Jj5(oH zs_Ua3kb*ORd(Gw0_RdS}w;hnCPD%fieeQN)_bJGu_8@h{{`a^Wb@*R5Y`Ms!$Lj=v zyCtRCZZ1Jin?7pQtOI4Y<9B`c-S^N+&FW^KbG3+>awa`|i7vM9lT7n33aQ1;<0vSZ zUMn-#N&vW?3pvJf)I9UzJMqICV7QeB7@8&OuwkA2uuseY)rvV*4i!?$Q-l_##g;IZ z?X_Z4#%j>&?7n#3x_%`tYVzECHt_2IC5_$6%;J4J*6XC#MhWB(Zbiw}53#H5&Uu;- zU21p5%ETL`wOm=6>^SlizI3G|=BljQTf z?236E$KNAzwec4+HuBbiO%_?mlSqwdSPqJxD86qw#qqn4Ab>=1es5fid_1A_b2s1a z-}cRInph<#Mg;BU0`tYCLMocvQnqRIAfsxXqDD)+g$lLhxQHC(Rl>H5SB%>3yC$@W ze3JEp*c6E-&)3__CW=ETaqvzr zcQ0XKIC{b~60$Kv0T@}gpAioOZbw`}9RxN(;Yetc{~bC7=jt3424-2pQ6>)?Wk9uL zeKfF45Rk_mUqD$|AorLHCkh<@sO6p|Cx+eablv|)q*jx*cU)TznVKLeBPkY4uT;e= z$-I72Uterqt?x4=v}qBy{5rU=P6`h)?;A)RVSw!!*_8l9CIdwT5C`C)1Bk^)Y}sXp zp5f}3hwn3%t<%A51B|&j=qK=02iHX%Z?0ZBr3jK+`2iz-R;UZl ztqV$!$DT5l#kzhHyq&5*Kk1-~TrLOnxb&U+_#oh*;wCS*cV>33!vO_atr~qH>?ieO z$*h=^8a)KUg&w0kG~W2X>7@Gm_@*qex61@47*L$8x2o#Gf5oIACT=^dBx1|w!`kYc zRV_)@VmjgfyUKd7Iicr}ti~X}VS8+d1=1s8(9U3Kl7{UAUMJv<{;SzY_lsFdoq2I& zk8U()sZL1bHQn#r|E`>Yh}A%FZWBvp!?v7}M@Lz0znT}pr=&rPNzWlHg-t;6NmO3v ze;o46mQ_LJ7h7pY=sciU{S!Dir6B+CRjSa*`(Z!ZN%U@*c0IGWVxEuBq4R#@*-*cy z8&XV&9hN~%l^)fl9@!>E;Y>7zeS;br^w^6%oh_cgh$w8#rkY#6&-F^kQ}yY1Xz;OjetK{ftPfbI{ZBa39d=2=b0{F5d`3s5=i^F=?+E3 z`_YeE@=w|@`%mtNU#p>&D5jx`VJl?PfmJQ6t;Z`uwYtt6uwKr%E2y<;>EOOh?cCSaKE5u&Z>( z9BbziU6B(sBWF_#y~Bc@{IKEDGLM#z!nKiR4CStzc?fwe-hU&~`4m0cFodsI64~gA^NCw^Hmd zHZL)cd?sk&dI7Kgq7~Yi#>hE0lb{3nQ2QdS3d)`UD~7yH!`z-B+-d5^ll+&VqPGWG zdvY>lQN|$;m-NnKbtRCdmp9*Hz{BHZZygSY z4m4y7{tqHQ!@m%#(Dr?hL3DcqBgmcXgl-xb*xa79YEfh|q~PX-Sme^vD?NWH3DvB6 zPfiKtC28AB{6#P{DRw(IGO&QI{xPuox`sas@K9z`kifZ0)FOn!b$Mgl%Jqy-g<= z`CTi$$Dn$LH=IxiQ5JoyBr@>s4Mqa4AUlji?gsPOZ*<{1dIG4)i8CM5`|O)Ak3EuS zKBk7HWb-<7!UjpRA&>}gzj4#k-u0wWx4AriDyCkS?_M;4)7i$lO_Tm)`7$p(Jw?FH z^g+Ilr8(>cpdw`P+&vMeqEcQU_a5Lh|`t_zR5dwX08JdJNHU>&Ig z?*yje>ZRZB>SeybHlxPDaX?zY#X#}RppN3&kEW9NN;M$Y$MhM80G%Omf$j5OVo@uj z&_5Z5mA6m(*=CHwyGxmDX3_e1q~|Enq?RTAhPV? zqo3SK@Om__6{ar={~Mz0a@-C^a$KtWnO-`ZCM5sz=bH*;gXIr zA%gg_stBr9gAo|1muL!5B{?bqc{!}3zemrfux21O_iT3d@cf$oaWOUL^dmH2(f9nI zTkL*&fGh}Jp|Az3`*pl_GrHRd84eCq{e1#VwXour(?`tB2Hbb4F@#CHh`6gbJyx6D zdQQ(W{-$fP_9P^S=iMg&9$_LAGIy*@oiKcQrD2l`CnYsPq83R&(ZO1 z)}fWeB`AZDzV3TX1U1za@$6s<10dZWAKBG(Kdo-Q?4P!|dEg)OKW2ZKREFzk=VGcR zpDC7K+43}@RE~vk-i@$@8sE&-*>x4Ry=Xag+*Y=%acP#jhSAa%<+ol!@?ZZjOo~DE z_3~2ZY-Ma9e;gJKa=dd5G*f0(>9~PSP9usD9c&O92i`8VAL8yf_+M#?!(~6*T6S#f zGsSenQQ0Y}*nT?q1-1^w?Ncmu5M0By z1mw>`VN6b?<|tj%usK8*11DD!OdR6yxv|oP&7EwyvvceKVmsd~p+{OWCisGE0$wSM?>5^R{4Q#R^z|GG*ky*lZL^s8 zZTN(rrW%wPWm>1X%cD{KRraSmZqeNE(h@Ko7Ub061!0=jt3RDuiHbOF2>V^}hld!P zAJUz(;BUIXd>Ro;f#L2viAUWp?msfgQq>%odH|muUqg=-Z^#62`^;V70sKRr-~KCG z#!i8OEB0K}ZwIjF1Pb9^5KTz;M&2s4)9&oagDV>^@4(#6oaf%3?ZcnT`cR~nvo)Pu z=AyF%iQPyHGkdg7Fn_!^6Ag_g+^MuX_I2bnh#n`NDxMe**9AfPE13V?7CbukEp{r% z;o*d?AUsJ50d?gX1d5zx_rpvytD47jHjyj-{@A>hO&;5M1dSiHG#WDy~+c;XxV%13&)LC!*s1r2V@}-h>FPdSelk$=E9~?UIoDBh8FT*M17xp?eo89HE18R zj*Hd%{@Wm@TyylVB}2vhqM^Tsx&7Kg@=6vu{1)v~Y+Izy;2@X~j7~*?5Q$@jeG5hi z5{kr?8gebdM%cpd1%p6`R99!~h}L3BCQDp@aNN-KqyWZ}6sWl`nZ+MtYX9|9P^dL& ziqdKksyuE&Ex&s`=% zow4Rson*&L#{G#1au7B8~gw^?5>nZl)@aELtKX#ghC1(HtcOv!(FTkETkpxe+kV zzM=CkGECqrU_ha_r2psbHCv(YJ@YaJdo1&=vGAw7I$VwlXXzm(YX4d%kz0w+^ZL6x|SE^i&QOvfJ0Y`=cD3%1<CB7pcus znm7T5?P0MppfxmeIM%v7Z1Ab}OS}mMk2oTe`CCN2C-Y3iWM4tah^Yp-^Ej%Bt>1bU znZB#FsQ}XeN#u{Vzc6GCqrGGWrL+IkeRn2hPoKv8XNz7F5I|hr-Bz6D^oLW}HnMGS zOs(>}1Y*lbHax+vF5%_LFMq4bln@VzPaH44qP#&){N?xFK`$+0Xge1~L_FT#pum&;H4jeyZFM{h zN8s!tQ2^8OUN6;;bgYXgae%Y@`uqUW0lIM&3>ab+h4Cwf6Ul4Fk?X?qUL(eIWi^WlB3d>{hbC~tDU-EJwcH&O^odd6C3 zDk=KgepN5c*C=tI<=R-i)SO5V&&&JxF|dU;F;E_3K&}w}OY41xrXBASldq%6(9F5`3OezT&F`QngOuIigj7*8IHK$$Q9oj!khtC9YjfQyr&R=EcG&QL@mv&} z#F*SEE|D*{^kkhTmNtnaz(+dDImcC!o|*auoT8RS7a`T0*u)^UR(Lf=fgoUs@g`K!8ACw9&qcjy@7Y%QbYoZqV=xfaI!}=kb^yYxE={O`4 z@X6TV6esI6Mr=cA5MO}?s_ zLeN(Tv;i(9z}B;^nvSkdNJwaBB&`Dx$OCGUe+FHMLYESCp=qIlV}1Fggu0M&{Lu^@4wD zmTuGLkZmZ&zNrgetDD6_IcfvNV*%3O)uDqUYIPTfLEEy4Tbl0y~?x+bIh9mnlGNn zgSZ{M2jtEBm~*XIAOlaM~nclqLc5e_Ph z|MrW0Wyi?(b|p$VB~UidUq>{wUN2TOE~{sxW3stnhXEproaiH5k@ToYEXbLRI^pw@ z)96hhEJ!R2w#ej?deP-C_JqO2*3DvFB-_Dj#;(gSW(-Y;D^X^w0Qx$RCoToJr~hHX zC;T4VX#qu0(_4|15+WzXe0crM90z+OP0W9=#!O^oMJen*J@Xion{Am_oTeHI3W9fm ziQ^@jEIgk~j|P?;o_88Mq)niP?pinX{x|mALKQP=jvLJbOXjy-g0(3e`qvl39Q^5{ zC<8CaX=wefXF4hcUF;kjIO4dR$`hr&vM2sRz;zNqGW7Gq#EUYcJ(%;H@0#orSIJDs z=>lhjKDtwX^^@svq-MoLvc!Nbn&6!LYu_A=A!=s3>F8Od0ZSih>}V}k@Pcg|&8dDF zLQ#9VH>tnWP@&y0@{+Csd;uR|1#ih$aK9Ia*Q23|tO&`QGDSuO(QhNA)W7JRKmI-}=0k7G*?FS1`Z zO8ymT^H_G9yV5eKy^VV7jYmV7^BVb6c5T}06a&w@Z@UIQuc&Toi|`g3O0rtqS3pGb z%()X5eN>_3;)8PZU{!C@MtfCFw|NwQbjf znPRfa>FM~F&t5-OzebU^Tl~@P4?pwa4u*my{lY5CBM87CqlS ziWGn=+1D&@ym1fA&nIT}}0D6i>c7;28N*v1L+C zPA9VSl$P4(Xy1bH8xmkc770%_s`wn6F*-Ax;xz7ZfqL(|S!v?X3~Z4`%(BZYYWu)8 zM@~;vsBoB5>MvNIkM7qjl6IyB(Yo$Z^!}IA%bp=7roMkR0G*?RAok|Z&J;O1)a`k_ zgoLnqVfY1C>1#6;o2gFO)8I1V(cNIIU)^CRhqEe!wb4wIh@Ezpf0eZi+MFl<#BcV?6cu5|fBkPzqiEsj~C zZqDi95q8@ufl*IW3ohcNj+9-G1rHuQ2*alum+QJb-i9 zE>{C89jaUaZzr(?X*JPztm+`k)bFU4DzT%<+Xj-?*novC6C9Nbi!%Tp2}_HZ}9$owd&c$9m#OY51neC(KL%nQ2Lz#fAn1XmiK?ZLlXPIQmTnXL6kjA^ED}9 zA@kTUskuA`wiSqlVJdfc`af%I$t&b_p|RcP@#p>5q?xv3IvS}oja=>j?*(80n-dqS ze5y3LQp>ffNs)+nl z7AUutzWb}q<$oWVHd6%}$h_VqV6IULve)M0Yq1JNnDO-&Y-N+!(acyM2vqx)6poEK zH@Dt&LeS`df8O4|S*)!Y2xMjYliBrW#k?Cx44XFpV`-qHW1`7d_eO%QS*UBz(Gg_| zCM*$9Kx0LpQa@_BChT!0EtIS2+&)$6xA@(4a@^QbsTbRz>V+1n_k*idYdd49_6dx8 zhja2u3a2ZLry!@JT(jt?e6}lfWLNCpAk`eZURWjsp+ac7%ueD)%th};*wUL9Lv*-9 z7VusnP2*GVpr1Kw^#aRlkG29G5^?;P*kM~ubMA&54!Z_iYLSZyP(E+faUo#s8#y_A z{6p3*;IM-|wTOGa96u}3__*Hn;_XGniE;D>Gn;HzA%n-S;_yH@<%YLJfZin;{GHi*3r0qmv7)2dKix)rRJ2 z^T;5pOf?F8=!6J$%uw>eA>{ukHnYcuKx)17cG_XYonGAVJwUN`n$6`qJMyUw%(+xj znwF78-4z@kw&1bnE6$I*hj52t+gXmiwt^QVk`n}QvC8cUaJ>cv+OlHsEQ|YF^goOK zOI?{=n&PKnUUo^eR=#bYTx672|FKkT+}}{~?6hP@WMXptPH(`}p>-qlqhg9SgOHV( z3FETc({|3YV7aDbo_h6dkM~J@voIawO!|mvg3dRvi69}$tULGq89u;g&LGKMunDcE z*|Lj{61ZzsG2W7Ro8jK<{pa?4e8u$xF*Bv*_22zkQnoL53l?^j48JGOw>f;Ru8$VD zGZZtFfs2-wkK_wmjEUVk|MD&hW;mteoG*{zuk?#c=-N!pgY+6CIa$bt!k^| zW?zht-&*!cG_M_jQ)js5;Z=$OB`sA3m#SSLKv_>?D0te5 zk(=T~?&L1a5QEh!pX+nk+Q0fAD#^oKaY(5%b2rfrelDwd(uM=ad#awBCZ;?lsY- zQzkhQZl@gm~O54%BRB=w$I%2Gg)p0hhBxo z)wTIaH?2Ne%)3Y->+LBTubGsOH?ya0-1WDKF_+!gOI}jGkbGl`&pGDz)QN1x`j;H7 zdD(mI8Ny_yUJ{`+%W~}IS}@Awp?~tTfY|vB4+RB^RsQPCr034TN68HS#&mWR!`CYp zeaVT;Dq}ffVj1I3`+JOqyaesf;0j1`279RLkm(!W{&yN>-)0Z5pDD?CoJI=rd*a?D zglW{4bjyXXZ`_qmPB<0x#0hej%w_6n)~CA0icm~0HfRTzLouKX*m*AxD9aBCkb`mUH9-9rpr&9ZvW^;{qC-{H|cg|<>8Wl z+0cmADnBOkT}YmtRef6rcr_XbID9UjE}5K^DoG8C67|^{m}tla<7SyF&aPWdN|TC# zPP2La*S;rfPscTp949o?QA1{FgW2YO(5zpx<;989EXTxH$;mNcLJ`vVd*FQ1c(f6K z>+JJxS2Fm#h|k3bN|@DVhI5i2d$fC zD*o*1ohZFreEtlzwiwg$Aa=+^*zDpNWsMmC`HsGh3>Y&crXB31lJCWukK>ZEk8tQV z97OTF`FYk2B0g`^4=cUb?$^Nn^1ROd z4ADc=r60?F>wJ^{TDQ~w{FlLB(~$z)b&3AJxkCl=+&AL|3@#c}HRc1{hyP^XG9&b#h`Gtkrm~ zMx{OSSS(6n#P73AI~@^YGQ~*ab9My`P}Z8^7gQvVn5S)?Wr+RlvNWb9w>fS6@Qp8H z`SQ=8yzbJ9n9I%`nL&;7M&9u|kKj>Kz|~pP=53DW^#WP854Tl4%6FuJT^Ep=Jc>oe zjwA^h&h%oUR1V#^7Ykldz<$eU3f{GHXW%q4Fj9*nR>5y2Gj z@Fxm{=Lx7OpmepD0dwJN;>M_46vqg;gby3kC(${)y{VILcBM%CknE z>>r$Dx7jYZaI}ZLuD3N^qMEU7SegoIV7?Qo()xP=(8Ts3%+C!IJrLi=g8fUYg*CXqBkw5wDGrji<%Q#wW zH%YYgTt?q&b=q-|;8ad}0q%ogeXhhIJ$_ z?U2FFS+V1{Q&c9_9Eo`70JX65*2H9f1l{D%8QafJ`|mW_^&5N-Gb%Wxf;Gw8&mLSH z+MgB^3KeU!-^=I<&X{+F!DR_3vNTE&hIr^Cp;0cvXG?3&<1=b(NI8PI9@L3NYR%XP zKP_g8{Ja5h0F=4$q1f*_W6gG@RZ!BjOtsuM1o1PX*Z*<47<3CsNGS=OYb;dK$6?Wg z%wih*qaS^Ym1C~P;TTp5jgl|@*r-uc`X6Rb$GI{E8H?2PfA5or89sc-N5@lZ#s#8aIi{EE7JXbU_4Q&U@F|-~=u!=rR#s==@A3B>*SNP5i z-ikNGrNo%1zjP6#k>yUT$Cd#bH0uRCaBu`dKVo26zhqT1eQpXbQRidYRF5(Z51 z&!0^w0d3i0{o+NEY>|bd_J+1G={j=qzPo|j+Z55~I~ihTI0YCS>wBY;BWSZrrQ3dU z{4D%d^oieKu#oKY-|E;kL>LPrk%W1zPS;8Ru!s~WpZuN`gYcl``-zLS6P?m8{#O8Q0##ml9{t;NdQX*Um z8sWBqR8^=KhRYKX2TlJgY8oi8E)x|o3TXxM-jpm07+k1x`|#o)vj|? zGw_%jxx@PB9;ZDii(o&2TGVr9mcv@feDzgHFA__Tt?uJ={_4|?P`CpeVRK3$@ zqUj?i;-;pmO``7uU8-fb?4PR)Z%#yHL%+VHlTFRc6!!YNcek50OtZVuA)FqZ8XyM36aMqa5UU%E0OAVu`JdOFQ`+|qmqQ0{MY6>{0;-!yfsQ;d8w818=IrY`t3OhR0@(DJg4>KHRxb*YLICX<>5$wj;-{^Y z4%=xeuDA~@t7qp_i^$|;?h>2|@tOt1arAlr>1kGwQXtFdhJe~xnkx|2a?;%!>2WN^ zDJUufaEZHEm--ui?jCErPxyLFzD_RGXG=Ky z^}B^~dBPe4LX&0VLDAq@S=&!J@K6jvm&H1=9A8bV3Pj)gETP@Z+DQEseI9c?*HzE2 zc(lS^7mUcZrPII8f7XuYX{7OfThP-hX$lF1B5gEg`CLz#)q$x4VwdeV3;N}w)AJOH z=G;-W@f#a!qGz44FTSkbZuBS@GUhRHLMxM+jjhfPWUyd@5<7nB`DZ@qsRFSYM}nlVh=&5cSdb0 zVNT@MfNotWq;v*M;1PNJoA{nop>W~xQH9=Njb@-Z#sq84EmE4ZuiM7#4PGDb*RP;E z{GWveF(fT9ar^mS7hcpX=6}UMo)0}%F%UvAakX7(JRCwd!W#QKZQg2!KXc_uXuzVx zZzBX1i%f-zJWky39r%6g7zlaj-xEcvH&_u-Q1($-y#}JV@E-p9AB>Ws4>X;mdtS=M z(9(!FH|dr9lxRv*s?f8aJ{)nQ=@$p47TLdL`m`&58`+k#nz4l$FWT;4g|NP9v8`(K zI6VBp3PWphSZjaFs`+qrHJ8t68+TsQtenBOu=3JFKe1@pslt1Da9cj3p-#U{r=J#Z z6myJ}enZ0~;6Vcej}=qFh$+G3=`oRbsN$!+10mO=z4k^tdWpPgaCo}rIT^yF9P$Et zEaN7nKPOD%fPspFcD2gM zg}^$DTz43G0_=(&44&OKYRuekAYrp9krJuAGe#^fg6~cSY-ec$!~RQ5YKZ|?4H*Yg zcOJm0y}_6B-s7c)m!n0fj>ri12va*L5yCj6|0qqCYydcNQy9(|_4w)DQRZ9Ue^Fgs z%sF53_&&M=Hm1RcpR1nAsq7!NBI<1*@R0bmnQwelR{5`x#NNCQrvnfb8T`-p?2XjI ze&CvLabwm#A*Z2$nPqQY$TR4+s(9zZ?xJ_^H?dJ0aQN@vm*JV>jFT1OjYDIT`UhF)4q3KD04tK5kgKzYzq|0f3sG zltcgDB-k{St+{d?9XX-` zw}+mWNAmNP>iO>3r0}25U#!@kt z7MHyJ;=S^x=2=UyXHU@N3u5A-fN@*p>9C)88bSq;e|>L^trKna7#}rw_%l6ViOq=L z;W3VqE2 zwCr-%;rp;@DtDW$LMXM|;qdIg?9`u}o9k6L6m3PG00rW%f^f+6&i3*A_Y%rLv0%+1 zpOM9s?+olUTelTSbA&xh)he_PR79|EPL>5No&wWYwc^z$f1%t6A8K$pVN0pxf=(y) zMdBB6lbW0SB}hocs!7dy6_fML4$rf>cCxav$Wlm2Q0z{$Ass0$1pGfL!mv;T#F`Ez z37SqfQ$*5Vq2qQtf8N&OA#F5_suU2husoV`_t#C!;P;1vvkOlWnJ5>m<$6OwDMLN% zaon@wphyJ-*x>&ERt}cd@o!B5QX%@?PWdzHvABqSjuf zD4T1|S2nYldw+VGDd;lhHs`5+(zKiHE^ghzN)mtw+xhIGY;L$dF_u-qoZaa~Q#>Rf z6v3=AvG?Db6szwY(`z{zAi(b%-+^XRVzcd{rE2<^PMzb@tliHASg>=OXo*`nFZxIe zxC?Bs+NbW=B@!#oT&eU)3aqncFryWkH!;UuFr`5qjWH11Rwv4Q7jx!A)UO0(PDyMo z-xgUkZnec{(`k5k7QKL?TM}AT@Y@UYvnQJ}@!0kKO)>B_E7!E6D4nLN*Zi_wq}*^n ze9VGDb)ob@ku^cQZ!G7b_Qfq?MI}eT=holvs?6Z|05W6SC$*^Z9ZCTnmu{?fpTmk% z0Sn3gzv9DbMiQXZ_?D4pteE4I^HVcbk(B<`zf#Fo4^t4HwEJ&-P&A>SGLMd3)a+LB3u5-pVBJ)a1I4!a$_L=^Da1 z38?|<;G|9+0e0eKWNxGk-XD|-Q47_+Aiu7o)ujJAA00RN^>!3`NM5BTs6ChmwXDuo z=sNt{VlLa3M}i{+c`STxDqH?X8MNWI)2Vk|n4h2D+arfy{3=rSZoq51{rkJtV)Wo} z-^p2U##&yis<=a0K>O!+NBv@LB`RepVfTw^j?)gYNgcYsH&?#bL^+)DQDF`LGT*7_ zlzC@mb>Flp?JU=W%Er6Pvr7Fr6_s`(C)`Q%?>%2*TiZPqb$*=s{|Ucfh~)&Yq_2(U zqrbMcCLhsbVq%XM>RZkyB=-e(lae{aoNp)Q9sIwBc@xMg7GjD0&8_@c_A{B|RM13u zEz~7smu9}^&= z();|D$`q7R0h83YWhXOy$GH!qMI)yFyuAD_m)4Sd2Bgbp4qrU}wTR>Tp>Z&<&7bKu zyBRA?SX=@p7j^RK>AU1n2v?GMo8GY1t6qI{%v+)fApH0AwI27!{o9}0?`fabzJlfK z9;HG6EU=ux`=`*jUgMKXPK)R7t2vMBD}s1k7R>RNlGn63eCbM#@G7Uo?8=kg;gr+m zpKqh`iQ&xqth#*OF+7~ULVeZJ|1ClbX*_J>li7uT8$l78h0YhKI|55`OaA~rp~XzYcw*;Y3O^qjwx$>LcMcp0Km0q) z|Is?-^5<7WS68Bm37*JVSu^u{q|RaNl{6l2GL90L+4a_KuTd5up^u{frW7xZ8!`U7 z{CBvr|C`z7%F-1@hyK61%@McC!^LG0BJPrp6{S$9p;CMP=Iy}1AcJiAWKR*3LV*8v z%WALw-0>a?aB`>F2U->Li8q%IkHC?VyfG)5Aki^K`y1gk7PHfy*%%;`;u+2Y#LnOA)rSy{a#0IO^|Deslrq~zI29L=TyvRj|yyIK9()O!=;ENh=2ZEb2IsR+oR9!JT2p@4zZ8 zqkE<;{85HpnUJU7$@%WR&koNA=9ne)6#xnxra|C1TXd920pAzpIaJ}e#-rp^-!oeRSl5s#uoCc_yE>b7qyE-_>MCQWC9{ z&xZ&+zpea4|655RE_zaS>-Nj6+(Q*yJS`^X45N9aKjv+dwtPLBiVf*h*7ee%DnRSN z89AaY>oZVAfFG8GkLT3R3c`^gP0OhvQfs5zQg7x&g#M{5%|w#zUJ6#e<&kmj zB9El8n9LUO-5yMKb+;8>Goc2|PgeDXoPrwQ#@T|VBp`Auh_ry(vPeacM{AciNl{Rb4JX2Ce>(|Z@X&8{XoeXMZ(%@ zyxku>O1|rhHoN88@}_b&X@g8xLPUDzwb!7iGG*Rl{SJtmJ%kr*{<3`OBbHry^zO@g z%ky0p5kpV<`rk+j7_1*ev0e-vzG-mrD&G8pTBmHFOZ`(DPp zBaR2K#;fZHIRP9=&rr0^e^bFTMT^oX^Njh>B%Be5DS(cjf=?0-7=`V9L_)8&kAf%7 z)1uq;ejw$<8Ysp*1E7LE*@@2VCut@*n42Jq1VVEj)H@J2#g z!I5x7trO#WaxQhJEaK-PmvSrW<%f(gv5_*Ck!R2>6q6lInppIVJ4O~Y(_gx4P`d4JI}>0*s517 zzMb9A`%0}@xGyYLA1=o8V66Bqb)XY`;Cep_jrjFaAop7e|g$;+@SlzckQ01k~t8F z=NelX!(}Q2eRSQVH^Lh~VMLDm(DB-TB_TXS6kAA;&eZJoc2rg^ns;8V1$wyAP5_DO zZ`IPNjkf#j=fkqg`+q|3gpP5w>vfov(_E*#?8 z(mROE(q@)j4IKjlK}ABw54#?yf+;(R4bco={hQx#WUnT#b|%63n)?>Auz2;oVg zU%&=qm(4V8dR9<7Zg|&OkA~2iF!*j3={ni$&Wl z0|NvQXASzYuj`jnfpzF)rDoZJC2xAPSG|zt8*u%$y1M$}>}>Eu&-P^eWPJQaA~WlU z515>jrP4`A!B*;f2S7?PQm=w%bhV@|MQppE3UuY=JZp>caLmR>zoy7 z>`P2jW|)-0(S|_*SoE0xHt%5!A3-TlRxc4~ZXG}oijihIOpeg+{Zn+)z8m`9*ZOLR zr2p&J*yva*J2rSkx8r?7?wum32Qe1kWUIqzyTS7XS;zh6i|5lGywmx%7R@p%6J7)g zabR)ZbQm_gbAmL>rED7#Olpa0$nl6N2Y6xI^`_FL<8YG2<;;o@1{(!p_G~@(`Q4pt46wc6jBwYk9B_fBZ5eFENnwD}Pkcuh<2F{?9?vnSA8~P*hWt>#$ zBLM!32#5t}QH7z7#Onf`oL%H<=v_JpSSL%DdvN;W4e%u_4`)F-)(GhrKnj=#Nc?(b zNF6pjm_J6W{i0Ci(V?^J4PiM@as5CR>j{Gy-GY3iWCaz)RCfF zMEWvK4x}P;zHlTr z_OW>mXmmey$FJA?rt|m*hl(wC((+rp@%Fzf4&h5%9!#ErDb9z(iEA?~(!bX?iL)xA z%n#r7^QC^B{+s0|W7n&*9LpTbriDpJZFm}n3C390HytL}p|}*V>-@9xCu+glxW-q59bGPp5^gcQ`!_X{NN(Q95n z5UC+d;165i9o(~%*b%b}8R#UH!1*ptSA}C-wH6Hf!`8Q>$m<{WR02^=vEu@I4te1F(}(L~Xp z8X|b`wHRQXwNMg7a2Vt#wxA&jBP4}0(+-p7+4i18umldZVoU%6fLv@OZUr^fzG`gJh=>R` zw)uXw2?7%75(8;N8Mbw877S@Q3Cx$M^z`(D;Ktd|$$f>5NQc-gZpR(-T(4UQt3}Su zijBy2`)RB`8>YB@vu$UrlqtYcUa#he7`O=9BxAeHx%Z6LzE(Vbz@Ohp&8^>@p%!bSFF29ZlXx&`dV)%5< zoLRM=hI8mfTo|Q8EY{)1%66#bv8JDsj++*p(?|bWNF}%NCMr?o=f&e`F>gkCdPFyL zgx!2|;q5==*a4;~1S1l?Nx^zuZ9R$L&PORTL$OO-iLC!(3GkiaB$oK{Fi3(FQ&a^O zxjF4iBsEOJ5k7i)1^8FTzmOo}b>v}G9Q?L!AD|$NyAzEojh7WS?X4qh5(x=GdWj6j zB)9v}Q&54AL%@!HLqs##3P}}6PlbgmHK|JS1SuVMMBHiT#qD`^Gfwn>VRcNc%Bt!P zPDEXjj1Rn&jba%37V zQ&1Kl=wTQ_6nt=3A7X*#b`4H$2QnJd$-+!=gXQWLpQeVfNU6oRg%rS;tPj0TAkA1D zsIqGnsI-_aQpq(;3KWtLekrf>i5%0aiqh6qis^kXxg}iV@8k2`=;M_p4;|*ideEGH zPQ5OEH!f2Cc3PX`#vhZIg(^22y&sKf#XV>HyV<(c&f6m7yATmpZDlX#4l(hU0VHUP*C|%BBE>`S|)$w?Ttyl&O|^puQXo zL1|<&xbDL9y*>lV-BQ_G;oK=~r&Nsl>liJ>1Q*=d0A3mj$v-rz$%2BH;? zP-??@(Sb>oi6+6?$yd?pC*@2ij-sl7_Mw{;IuIL%0i=(J#v_lQjv)nj@}Hpqu#|z@ zwc30t5hA)dMRL?=0B4~g?*gphCFyG`bTUh~LdI4%;?r#*d{IwE5AP|mdFFnFeGzF3#pUAmzE0?keER!q zFrUowW93LJhTIQZFx^?|34S9&WsxCL{XarZGjI~Z4lM>)qCEnMeMr9g`-%x0hx5b z@Ov&Mk;MWdKx(JU zu_X9{@)xZtRuy@12VkWO90;@aCL7&ML?}I!Yk7 z43YrKAPXVIR1{+bVi*!RVg7_=grY5P{Gtk-g(#ZS){uWvsTqNBKl3FY#G* zfM&BpF^RK0Mut34HLY@lf+DT)OSNm3rFBFtuT8yBTD_WWXu^&v|0RV<%-iL?@)ag9 z?OCorKIS-SNX9j_zQ@ul;@hJ4-g->R=LEWMX2<524_F+WQ)>G^U)$<7Q)6(=uXP-> zUefv>Rm+quOi_n!7=Tz)XVZtga-tC_6z^^@?%G7XlVBK ztMxtz5`7}Iq0uUnVk{`ERcfltrJcWPt+F-gpnH|2o>FIvA9b-5tl3fR@SNrGa8dj} zKfT}8AsG02S~4{|d8Bx0@!|5RI>_6=-`CZ(E{P-6E{tT0ZH{%@8CgU`zbH&8(LDjb zRxo))-o#lJE=NIXnR*4IqgyPztNI?*2@kQvRm(QyDnhiGx}#QMyiwzrRGNUQVG3iI z2Bsq<_aFo;C@)|vNQksfB*HgF3{4W`GQ(65EysuM`AwZsNfaJ92zVdB?AR8IJ zCXpFP-I+x)w{U(v`D%ojQw5O0NDRi5gbX7D4blG!sJ)o739HUlwn*06*K4PxH;hoc9!bw+G`9e~=!$o-XJx3(W zXaTS|R#7%$3zkaaO}8%@mZB@FNdDAqe%vsY6y7wImhQ4#9sBTv=ag=~?u*_xCUk$a z3eJg$YdCpV(da||KIE>hezci=IEk0-c3&b2OfWr+`d(OUy8YQx2q%{ysVhs;IAHb&$&S%K`Z{umumlC03UcBgeOMw}UY7;Ix3E>iRYgM> z`WAs8oInE!Wr9@0Yz$>VilFD^0oqRBrPL232mC^~(lkyIN;4g#DNvmd!-#ME{TJsGgTiUGeQs%78P08#_lK3b; zwTxOFxTQoZkL-n1bXpYV*0fXPd*jhAH~6*~Hz_F3*pRgy8ykIMjMhMiOK2y@Isf+BZ5h8Ut{8Qj>HAAuknvotFi6#nwbyZ9O>Er-Wh%N9L8(Ee>`3D zyjd}7qjj<9V}?`KSq>(=c)Fd9UHh{6%4Y2I%~9=Fo41KiAnh_%?EKfnvS9znyS}I% zZB``P{*!|PN*YS9;gaI99RBgc1F!vhEh?uGl<_c?aJD|SbpZe_HLW<^PfmwT7>)Re z;mO1EQbUfHya=rpp_X?i1@Ix#&F?w~h(-+sf)NA(MHrraP6(_;OiE<+%K>pa^Atm( z-Vw-#2pt4*2IPb7mzo7sVqp1w9k~Ex+O)Ovfsg=Mzf%~Ws4o={;2>y|(byh~I5f?p zpD==<3#V9$O?ttoQc=?f%c05NO~S5up3p2^p}ZDQN(iuwPFl^cz}MOCSkq$hQgmuKHz zVyKx%284=uFnLw$JLo;0$5O<{j3s@;>co#3wK7NTGBj9=m?`6TSO)Dd8>+IpX9raG zTV$eF^2Ko}l}lnKeIy`GWWPAud278ZJO~{%zr=0cRSk4$8>N2+9RQ|GP;S!*_qg4Z+8*^mwlH@|XXO+Ir2p1P}o0 zWE8q1@)!vyL|W;bVALJLZr$z7AOOv9sM+^>MW;&M=sG`~YaLn>Hq?naLgA9pjF*Zu z%WX^;;gs;*sFQvJu@q&2u!0BRxb27lyZTt2wu|Ib=4f-BAE5Dj`~DNTe80KOqV>!AbXPr+-ac&$wr45Ry!znHzt}j> z9p0yQ!MRBDPNL3NU(4yLT<&64CNH(k+;j1@%2cWaT&|C5!IYln-Pu#YFB1c-`W4&C z{3`{2g2SS;{l7S#9jE9`@e9|0)=QVywPEQM*NL%W?WRxXK|#owuNX9@oM3iKC_$L7 z;NT4;-*)}5Giva>IM?pFPm)1V}UDbDGXH&TBmhx5yWvV2k82D^l z8aye~t3%|F+a!bdeNHYdvb@Jy0|L6cf;380ZvGyfoUF3P<8t41ZEHYC0Z};EOj4&Hj$9B!zZj%6+MXTYyA<7F+7UE`bt5p+>yz!7sxcS?xGHc`+Zz&A{;i2nZ^W+!5i<3C=g-~ z=dsa4b;?Pv+zt+Yqu>9_-?uVamTS%&OnwVzpy@C4dFpQL5V8Be_P#1AuAu9((ctbu zg9UeYcM`0T;L^CeLuj1f4Z(v4CqP4h;0ci65Zpb4;O=wt&6>6Tm-**q9%ijcKeXNI z>f5`k>Yj7zoV{CwI?hwgYh+F_3$CH-Vf*}WV|{~+*=5h(PXo0^tsV!2jyW~WAPTJ} z`-j`Y_4QWI-Bf1;?gnfE?ExO;KMS1?i$cri1*^9+9lk5@;KiX4RYovH7~)%6G72gQ z+lxK3FDLzJni4SfAw1jC11~b|nli6kJCBC;I@fRZK;;RF*1?(F1G-L2xj2G{Jh%oAg8zIvE+vgG=2NWu;xUok zcpDvkpk1-?8J~OfHcT7aJS@d359t-5M$QKDd!%f19P%V2ie%(8T+Z(7j|DH4i11)& zBE2}{)NaVivZ!AZV({_i<U+h3F5C(WO=~ZKzd7ciQUh-}{ zA${XUV$78Oz`HJ71gHx=$3+T^(T+mS!=jW!mQ`)i+aHn6$wG%v0HcPsi42!w6InEs zS;mg1e0caCj3~{8*p4Qs1rkkhqg3X`344@z?WF9?owuF?Pop0^mUVs&)pRw-CyOBi zoB(JF=}*YDESZOF&2-!KeM@R`#y+`?H;Dr3?s|rr^}Ogv4D?)F&Nrb-uMY(<4|hE> zjw)WFDvRQvTSPVZNctXkhuaFdenPL%P6Be!M9OPeeXrg#Ehd|P)dGiAyjERaCN*~J zc^&$sw%F`T8h_e2Yb+<B;QiRHN9Vg8jmDkP zeGXqon2hIwQ-Fj-j*#o)HGH;qwW(tA<3JWKr7#}5Y(@K>KJL;})_$#+?T8^#M{xE0 zTtUyUQPvF$zh?%y$?H(F)zVBe$*a$sg3c>TE^rXTuvXPWd)K|q$}hVb)2>4+npH7D z5}xw4aF3gIV12pw_blC~4tTtgxLP9AuQKu6NvJmDyMji_MMMlx2M!lSV(tPZJHq0* zT$yw=B;0&)WV%*gdf8)CyLqHz>(#~)UTlV(E5E0M;cj({Bx8qZ(FLFzGZR|8NZ6+3 zdI>>(OTq)j!=FH&C`c47CpmKK`77IkgRL{exfvA)_65*nfJB8J$E+H~yQT>P@z6)OzFF|H_v{a@ zkl$$xH6^B*wK+d4d)-Tp%4;&ba>*NQx!!!S+l<172P`w;S)H!UJ-@p$JHKqfq|+m6 z-99}7${Ws7k|;%aL%dLBkv&X&t#^j`#)LQ7RtPsKIW;qVp*KT-5XjHk*%7!HKpwg% z6zshh2V+fy+UWWIA$!w;qssL#+7i7xa;D0trmC8jzrOysva*@U@y25#mYLniu0`%s zpuVauQhydKeMrf6*rmB-@=np#&&0%kASI(T_64NpBO&eAPf;Q2ez30yMdP$3F+@G# zh6+gC+qBULYZkIO9}C|t#h?@M;^J{Uqr&`2_9kp33{e{upFD$^>VU#~x0|W-Le`wb zoQDSa5zV2HFRCt#i;h5E;P@=(xuPQ_CjmZsre>%GyB*UxI2P=D9VOw-(l^{ipAjI5cKSDYJzjlS{Vt1S8q*>IP? zYg3SAf@kZnL;gnaPR`TosYWNOm&;xnwb`Bcy0il9GB>BAd3AVAGv~um7omY$DUD;I zY(nB+)+?C1uCvAjt6+048L0vvs|{_dMeb6EIP)Y#r}po^I&QDc0VL@Udmjw~Ufo2i>o z+Z=({q!@(=s@#(*#>Pi#Ui9Mg$a};PS5^OR=IogO^j~;|{r8A|&x=QlNqXnXvgQ#@ zc@_kuc}s|l8nb>79;faZghhmzqeU{wX*Zp;hFKKFvH-Mk3nZaBv8LD_N{1k>bXAa zmBjU$Z`Z{LgAVdJ3Fd6j24RxK-BOut{)|cy8OP4b;h~sIyYqZ3bN_VZ>S7-jp^lTf z1Z$#K_Pk7Tvk?>QO?m9Yj{B1=@C}bRJLZlFv z5^yLXbz@%vQ2G4y&dXm}DVZMCErZ6ePBUN#B!A-(bJ4BgZFHk#LAI$F-iFdxYmo_M ze`0j3xjZ~rWWMTfcY6x&|C+K~-VMk9(8%HjG+!iPa$Z)0) zZ9lJVZ6=69evNm3+0vCK5!mcS)w1NgF{w-BoBfj?B`XHoqSA)GHnzMxa{m{Dp8J;9 zj73G3it6me-R-2$e#cSZs$A0jcSZu)`}M+TO)+Pf*HX#ExJqthVVtE{L6Rff{KF~- zOziPJfB4Ml8O@ymzkq`F`{57*S>>#6_~`a{xtbMf3KJWQYRxVSO}va)#phy`9;P@3lii3k}%4y7eeDcs7t8xxBYiVE~XLh~dfvS$aSat7s~(s{&k)&O(oJ z$Dj@ABcw}S+zTDlwJHmUeIHC9KaM4{g`wJ`Zmx&{9mY36LQL;AzaJ)wA^N;D<#_{$ zYpk^HVvl6Q&!%U6j#hx~8BAJSmVW@0%}4u<5z@>RCNIh0Hn#EEUgjlb%=~*{KtSGY zu(uhFmJTgF(z&Z^b*prtHAuhWd<_Y=A23!=6RBvfGp{ffXAH{-(@r63vpng_5t?fI z-eLt~3x(f|`lOHE8}65wws`sz&cK?pd%DfVO~Ua4eGZ4WJ>GsG$J&Y=j#TSj8((Yb zIvFWd%lusGpfB-#$)yqDbgm>?Fl6kL4<6Ya&Qvsd7tD^aIc^xY&n%iGWU3c$XbNwdYc%_z& zl+7;Em%y5hGH47!k_B@>UfH51jP+pm(|*VH{E)*|fVWy=EcEDZ^(ehGy9m>{{@PZ--{ceHL~FtH!c&AlE0{ZR0px_o zH_WyO;l#ive~Y7~IId0`mnA@tx8r&WlnBx}y&&wy$15Gy7A`)Z zF-bXt?xga3M-@mB>OF37jREbHgT*WAxuY-xYlQDlp#rCS*1=b<=n{ z(tzdVC<1e$AqYU^nN!9m$TDLmD~j_hJO!QycbIMT zW6|vR)VfJ6FDmuS?iXfvhI4G8ezb8+%m=bE%7s(x&MlFQdPHe9pR`S1358WtQGnCm za3YNxGC7Gk^AAT}mtp*l9C;%dunfQ8);9O(cy`pfn=W8m6MBDA7joM#ghL~!UMQ=- zcL!8v-ltdqqxIdeIZR=SxT_@-K50*)p`kk4=mD6a*(LYCg*qPxqG`Tks*<~Q9KQ{H zI)B%js#0^9p{A+Ng4tIBPRn<+WYi<86xLSx!FqOgr$>ajXgLDO%%CCHTyzFSDLKk& z0>oAvnW>68JV4%IM#uT@sv|&T1x&=_x05hYlOwn%%qudjL=*c~duQuSmwVshN`Or9 za&s*7NDA0N8A>WB2z&fwHIQ%8&NR@^3U>$&5})~F$KlL2DJ~$wBOorCUgT13OG$IkNLK|xf89f=LDb~po1)rghmsu1YH`k#V>J|f#`>4GB zsy@sai>ICd1R{`AtPas+OGF?zZ`XE?g6_@*0HNgoiRH;NJ)*o`soK&(Bc>I$+LWb z&FXAaVwPW5jg-Ua>Zgtm9ze4Y!6C(sVbh|E*j=4wlm~APD(Ei=m2~F+6C_y+PB`eU zzxxwpT0S3+bQc;t*6~XGOq~%!pl=YwLEv12JzG;%cQgZt|4xlc0L3F-Wum$+bW4XW z#fCODdPGQWaSD5))${e_bWntn-wYYGnazu`7_bsB9@@~tZSPEyv8QvDwn{hoW~y)J z*?`n-%DU0vLi2+h&BL#h2rEUyJ^#ZSAm{18dv+{GiY5%*2aYIJGwYp=KI@Kwl2=jl zrp5T7^Qu&+W*VHendFc5zX`&7UZi+CXShn67gA+P$R6AfR?MUDJ{vm0eBL z$Hfm?qW&Cv@6OzL7t_9Rk0{>0iV+yMf-1?xTYuxDPmcvpJU$~sT&-J)?MDC&5yVH0 zF#?_cmV~b$v8-ImYuWqi=_)jbHK_mBFPf+OUH`M4(wZ_rjn9SwS*2oQP`s>q89W@# z%yfCU8VWf0d$F;5Mm6Nk8qx+1hCJrwdk=u$_f#<(3#pX8U?ho=F00#9~Q!SK(%;JK;fTR=U$mrlElpDu3k0; ze}+mgZVZzM3_i(uec6w1Eo{j2h%s0&|ZhhEFti;&OGMRay zkC~m17bO$*fZU9aH>H&Hg2Q~P@dBWrft;eLo%SgoZq(Zh-NaY~TP*JH!Ow2kdFUnKeA$!eqYEWFskBDscqS*ZWQc1jg!;;vHf@stQW6DW1%r+WdNDxoM21>ru=Ou zdSbB4avK{!nq?QTpc`DwXZv_MDwfG*Y_}F&tw*BBni%mIl2-<-)|N+xe70HV;(0bq z_T#^NIL0DAC@^!11+7VA1IDXdmSf>$o>68*JcwAWpchFip+w8iQBvlVKi=_e8&S)s9`&} zRAmOIBcFP&4OFskeD^6y>bM(;dfd_{RxvsXP@qoKv(1OWja*vnV`Sue-E|3UYkZhR znyS9C0%bbRyw(xY-`x2{EHn|;=j3}?NYWJhFz(A|C2qz@O@0pZ=KOLdH47R`ay@WM zkHmM!05AO5R#!|O)h1?^HJCg_+7orrk1ffqoep`(Sq<7+*k8E{$GyLZg}W1>C!-?2 z#(Im%`M6sbdQr8T=RH%i`t&$>T#sU>h;zQMqtWv8tE*%efk>Zq()~|RK6?%tYhp*f zXx;S6^GPko9?qs z2fYPNaS081W=_-l2!J?QoZtFhmG11h)iamdD=wGiruqGYl*HviWp3sRBkj7U-;a0Y zRm9jh$_a^BT~7;+dIW%VG*SDTf4b7Mvwu3S@O!rBAV!c_=FqzYv;pt-HV}}RVMv4s zWKMO}=^OCozE}S39k#Kz_t|KV(n{Vu-$BqEOX%Ci#?6@?S@yUYp?hu7VDbn+%bx2~ zo)>tCYa@=W`Ebd;lATb1nVnppjY+J}oJsu_C~UdsYpv&jT0{*ofN=_*e1hH~_~Z2Ax$SX3)Ce7rUNTdgMg8)Z@tz zR~t8RZ;43)mFPK)D_A5un^*8T*r=@*%<2sH%Fen3qTfj7`u3GYgQMHSp{dD+bExJC z0_$I)7{Ik#%D(4q&q{unGU8&hGtwZ3Z;oURl-53lF*1E80KXYv@I;h{{3e>Me1=Q& zcqr6$vi5X;b=?`9TY}*f<-RQA2G~yz8!LfQS6R=MY)2S|jG8^Zy>e~!-)pe(XHjn( zJ)*gpGNTR{+~51;iF!wuYso`KEvSxTp;D86{$Ot2&5?=yeEr;Iot2)zOa6OtHn5g&7i<<8xqM>W-BSnLFUqQK_gKkW^K0n<1exctDRFJ`l@*~ct<#rwsM_#2n={Oy(ZK7;bxwYJsPo1K(LNw84>r*bl5am9B(2hr?&-uWnb zYqa*833AO(@p?=qEl9ZyCEy<%Fwt-gnNc8r#m#l#Q$!dHgPCa(d4opv!9O6aU?Ez1Ew>XKjq|Xtr!Voe5$`%_S+c7Jl>H~g3_s8M>G;H~(}wi39#a9v zq*?LRJ(suANXdNz*8b2L(*Al78^`-?aFN~RuU|q{fCN+otifV0XyW4 zM7(LfeNj9V)GbwN0r|7b&by}|-PERm0S#zl?C8jX^Im{T2dBgosUHDrqPDR^htu-8XfnXe^F#1YsRS#k&V^Atc4Q`}#6bP59QZg!>4 zyO9i2vrlwp9OTgQY@*62&aar?p(3LXXu0PK=E$c%rw*~WyWDrV9}avxSanDvT(Fk7 zew-&YJ$`t)9zES2iga#WUfz+kfHbfZD^xcCOZ&=w$I-(^qFA(T!U8R56ZXTlwiR;L z|E^lsxCZo9d+B1|EM8cU;|@?tZMf%P1}?-p?1hD^vdbOuVjKh>TKKg_T{+R#m~mxaK#zGnM$<{5s(tzqcAA+i~b^6n`z)fQ>k+?2K;yrb6Afa7uR|_M5u2A=-dj<&>_niac}2Hb+q&+5@W+i2GQ#kuIWB2B{b zsv#DbE@hT)3T!gp7W(lW#B*$=0~O1uNTXz*>{C6hvH#7s)a~9YgBVUaf>IY?Vtt<9 z8fLEv0=8glIbmPj;n~ebAkjq67kh1*pX_!$n6zj1_YhLztn!#x;|y5x7+5jJ3>xNu zoL`l+H=UOPd1X5@y!`%oz!6c6DX>leXZRK|KsU5V<-2rS{KmKAGFzQbGCLkTy!%Qr z_`+85sR{CwAkcd1lBk25$2YBob`4zo4f7J-AtmP zrf3K<3&{UI2v(WQI$?88)Z4qO{+U7A{5UkN-__(@RjNCf%Nuojcht6%khpQ4{0 zrh=~?n0`_~J$$b+J5OOA6$~W|Lz60&9@>D{d9rGdpUM9lb;!nU(+3Z206&r5M2Qi- zykg>`@)%&JjqZ-PaX9nGAWMVse(}%W-RA!-B)DKWiSdv*o@zfDRZG#WVu&dr((Z@F z(M7Ay3Mi4XePeBm$c-zSKijPnzxWB%hepEN6udr~nzi^G#OY{~Q;;F2SlDOB;1?6m zsyO*~ez#{#Ye{490lwj(j^^Q|JzTo}Va=-GzT|sRTov)&os8Kky5~-A!)*dQNm6v) zX+eH!`iC5@q@T5=<%tS2?8mm9!w+%EQQjKfRPch+Lgbh4RjJKZaUNm?jh?N$Lay^C zKiCil(<}KY0I4K8+bq}^ek^-}G8!a0hJly@|fp@bGxkpbtTQE_G2PT^%fozIzMxGg2x(7FEuY#@t7IL^8 zUVneTrlhl8=qI(d+E_6j0xj?lfWZilRbyL9(8(|OuKDE%#@m=Re37?`J5*;EPxmW; zD`WP1Z^FLUkX51}W)jjjih}x+lj=?RUiaYf+fp^NmCj;GlUTS5PvcDcir;48)5Gd? zl|JsJR~0uu%?jlrQ_bxDKB2bi>~eeP)AUj3YGL0dqz|R2r?7A_Vi-|H2(a7BC3%WlwZP4_WDeKd$}?>L+2$~ zKCUe}f_>w(jK;hVGxBV6qfb2a9-tzA_%XyKCePxw{>}9+6E{e@oCUoh!kGD5n{7|n zzLAk?K;92?h?lYMTs+mo+U@vlOXmgG(_PmTJX>S1=w&sS>&y9M({$6B$lMlj*oV9|lDl9-Dzkvb=o{wW-UvT3hlG~=ioKQ+Nk(uJt}45#9D!~4F^RiB zbLUN{73_hKGYDum*PjV=hJmrj>&k#$xbby#mt)Kp$c9?>`0gPA`wGzW0jkzrlZIts zipB0D7qgg)B-#{$+*Rz3aH!2bKP*E+JPZu7|NHEBf8$4HIM5!V~Ib={qIPkr#- z->D9Ks(0$+n_=a<$z^~hTJ5zNR-wH0GR8}&XkaU#+1m?&EH5O`y=P8THxAf_^)@JD ztb0u^d1XUtGQOYUzpJQt-3WRC8ERHij9T@Xw=uh)%v7`;*<#ml5D3Hai_cp2Xz3|P z#uFV$a1Gtt_!fHIM-y^6WX5US_A_&meUX`&x$evFN{+hwzWu!eVP=V04%o=KbY!7h zt}T!!D3NLAtkN4H*w_Dy>+YR+v1! zyM-QHBRyo$2uBtzPH$gb7|PI6=D>KL79dWOo`UnQUKPo^+4g2i1FsSQs+#cqsbbluO+i ze!m*o*j{HYSZZ>of1fq~5)&AxyA{HTtW!I-jfkt1uO6kP*h+g}6P|0uw2+I60M{Fr zeFl{rjXWF83a`lqo0jEZ{nnP*ITzy{v(?}$U^y86`r4M9&3Q*{Cz&L}nU&-$t^A-l zZ-~pJ$?lS8fIo|V=hMl_Md*_l-#&ljOmDLuQG02s%n5?9=f&?2?TcY`1^%~t&SF0G zGd_jpMV=Zt&!pRGd-&ZmQivEz>JN&Y-3ewL?Aw8OdUm$@8;-pIb5ysJ_EjpPI2KRD zmCqIr`LkxTs^~+gp4xS3HY#IN_LkBD4Gd6_hb*O(>!AkVcT1UhO#no2o-&$kiLjvv zIGs156H~*a`=nw7`w#}=-W+RUo+T+-v0R_NX~<1csT$yZS+gage-z5u&kypr+4x3J zPaoxT3+W$n6!TrVA8`#i$XTt{e3g^1*xJ`8^?5tPxASgU0x1H#_8eTW9q7|(o>f8` zF@>~v^F;;w*H#jM5Tlc$wU^h83Nx@>bgNoJ!HeVu7ksRH?0n1t)H3r|O!@A4x|q6J zgq#Hp99wjGnIvBDwv$1~I3u>(%CLa6BEY{beZkJ=EC@|!O*CW)Q%??$lN~zy-fU12 ze0Q~aGh~)QhINj09tzZTTe!7CD$oU|yVjwEJuF1n3n|F%89a`oMDM2pto+=}gB)%F zZp7rU*Ym6S#=fVOQ;Ld8u~2k~z!Za60bji?H~Sc01bgGm{d$d5tx(R}wVNIwz@+8* zF-I^HE@;wz{$>6wQN($=^5T_Luyuea5)f(`b`2a5OIQakhu)NFHX`4O)-|%Q%eL=O zzt|6VKD#_zZVHh=aL=$YGV@#UXMm~_(4&kS{`P@&8!h0VpDZ}mIWKlD(=|0X9bI1& zXPPjv4;_xzIK#fm8lC+7nPWz0m5PN+Bgl9WkzCB> zwcmnMD&rKSIQW_y9r*cpZ=pmP_an=`?%58~h|FB3sc<=B1y_oj1b)U^@BuBe(;|zH z$^gJv$o>4JI+4&*{qwd5$+x56E0`y0v?U}AhmyK$XTj0;&yu|h_2yOMTM+GDYxVr_ zEA{Lc%_)h%%YKy&Jp7O5hOCK`U^T|rdS?ivMvwBj&WkX;@`8{%i7RB8*F=@d-D0kkS-;WXx&BX)^jtzN!6UPj{G# zx0_mN({#~8l0$1f+U# zWQFG9gD4^)C_z z?aLCmHtz5ZqW0n1k#bC#wOCPg<++SjmHJsg4)wcb<#SOi_M!{5f1u881i|uyL+~E$jGW4e0#VL%gh9PU?7ML%+ zy(Jn$9?Z>L7o0?I-jZA7gnX}Wt2RDtxdP%^xS?dj6u+n_?~m>d-?Umr`r|%4KKcb1 z2`AQ9H%)t}F#>}=E;7=Y8D0qn5{=*0bz||p3&E*I$o21uZ1+8M;%iSl8+^E`6FvHZ zLnD@{qf%WohgQG+j^WnTQ4K_%Y6xI0pW499^l}tRME*0`>Y?{OA?Ff{yg9-iQG7P*g z@#Qdoe5Pe>P^Mqj@Ldh;IxyKy@;s5scKFyHw0f6!mb>boFJTs<(v*lkfnz{s8nDvp zyXtww!klM)YOGu3EVM>z7e6mE7||VXRc8#zSBf03$6z{9`h@t{V&2h7HBh;l(fRT z-*||rRjJmNDtGgrlab>?m01+XMsq~c(8EhQri^r1%LaSGKZ11|{eLXAy1LHQALY1G zeg-#Q-0s(n!fz_@tfv<-LgakN8(o z4-pFSva7bB(QtQZkm$<`v=j7-yT>{p6-`R~;d}|@OacCT)?t*4KN%G-}<<1^Ibaqy_1-hULKBto@=TALNk0$O6<=CK@_@B4VO z%lYOqC-m+ie@sfK!ES(e^96K<>}f)BYva287xn#f7{h0)p8K!?E#UxuT)7D?!fBk| z_hxkm3!ki(9qTL>ozaGKr3wbL=9V=il3vHz!elLSCN5K>y}@kk>5btCZW$P>b<+qR zghi2Ob|NA`)-zX~EvNIguf%H?2ap);YeG)HR{=tNHzxxJ6~-((?y*XAxb(}ashyo$ z#0ST#k+6RtjKr{ak7aC9~pXv1(={IkuPBrbS8p| zM$d3bnRCb|tkxtN5rL2n|E^M}Uu zbNFU;G!OMPd&2n5d|_jpw`oNJ2aAivDQ)_@vX}Y`3HXJIs#>fSkSTkG$iXC>BBj?R zF_@g4ewP*HPD@QHY~Rs1zlg?}TJ{64>^B#4NOO7036$0-&rmMDTq7TJ!v9+bpw# zdZQK@Awz@G{fpb-J-(H>&sq?2JTfx-FK`>6!UXb8Q7;US9#avHiO}?DXT*2a zpLA?8`Sk%U>$j;g_3Z@o$ughS)#d{wwT#^M^P={nyVSFmSy= z-5AJwhSfuQskF%bedDZDKlh=@2OS;3N{O_DZ)gM@9{V29!f}Wm=Hz{M+b~q;Q23A^d8 z{^DnZl9hIgz?jhF6|54kHr{Up^@)ID6n$5{hB#y>ZAaZ{T{}+tXEbuuGqlDCsi?>l zu%NGZFq!V%&OiQ9mQs}<(?x|EI45^nTl~^vP4}e7lt=6_qRxD|Dbu0Z(QK09#1BZD zQaBDXi}@~{G%h~vjfy>sjwak^|EyK4^fcf(_H+bjxfr(l+<#||PA?l}af>i)23AN? zv+GS5TW#xB9NX&rr#>x;L~7@TbZ*r2>kCnjw}ZqRCKj+$RmM7Fri7xCc!B=9>HL88 zNd7SnX$)@P9zJLcJlqj_grDs1KIsCXPkl9GTT zBM2BnmzzgaOVf~HFC4ujxw|*#97cj@Y%xX0NH|QtxQt{2qMA^sJTyp5_}W*hb-T{B zQ-zEpD*7~BMuhh*Yp%Q+#PKyzgZBDK_z#3$3~4mYb|&i3`{|*~=ydHc{vklbWQObN zPY*K#F5*4SV2_3?0v@#z6p!|&p$-;ytj9d7^E*NR9_X$fE0~oQd6^Q_O&&4L5b~yS z`t*lQ`Sk6@b8xNU)Svx*v4EdMk%-J;)}!Cx3p!7a(esV3&Nj&IW;t9ty!UHbLfqHF zp3y2V)>gYE^7`B+kUs?-NdW6d8ZHhmogZbOd-YVhQi_A1KjkJLDa?DvUv#VnTsd#u z`_wZZ|8#jn4T>rHHFB{(X3&J@8(+<1Q2OQSP;7{^?K7;5qFeMCvZlnrxn31m7NVw%tjP#j5$BVFYbcs`cSg-_##PCN=ES#r|y4KDBdc zuU5pg5!@)GrYu{d3*2|Yx1H}K=nv=*h2c@JnIiX94wFZ$^s%GqRz(icfK}^^4EX#qCKUTiXjz3{$Z_3MKkPc8E|8@YT6 z>)$?o_as_dl=jHq7q^w&ia>f69aY!ycq<|1qwEIi4pYyPe3-u2-?x}!nycQ{f({^C z{OJxyT9rB*?(B<}0I_}z?YjM)%ctoYt;-xMfGQ=#R{9Z)Pwvq#?6|txdIkir?w+Am zrW=J#3{bTMT>Ms9UM|hgx7ti3I1BFe54f)XsC#U(7Qd?nMM1Q|(qoa|@0@G*ou4ed z!=*Y!vo{J{&Wh`>N*Oh?JfW8zY$%bQ>tiU=t845RA|sVVMgT+~9@t@r8+ zh~=h-Ct|MMtpGdrtJo&okxl@oAvy>Z5}*$mUBYu+tf#ApWV9{HcOa?)341y zca?NDb~GFz3IsZ=58$f2Pi}M$bE0D>GT-}-hZ%PPSxKu>hiR%t$47vq`Fkqk(a};Y z-G%VRr+&Wyuoe&JJMMn*B)qr923i$le;)Jb6GVzzIvN#_J~%r0>d*en;_J|6`BhEW z4;aVykH^y+bEyNL9N_Y;lwLm6nBhb3kE-~4oS#>fc+PD3&xC$ewYLc$RFo9vw%S0K zdWbHVx61!R6AEwP5wD(Npds^`VOXW)k4%4u|14QJ)AA(^9xW83uyL3|gG|TXvSC=2 zB?mi*zH+)Gzq}DEobk8+Pr@|jSEdh3p3GzU&Xmf}7Fq$`!mF#RyJ=R<;&41Hd>fgy z1acvtKQJ~hw=92H#%b>m=iO$3>5O5N>L;@rf>EvczAXoOMuP0WIgdA`nF0L?GPDg( z$LqxUrZ=H?SB9nXr379+%}M3ra-3*l2(}!rdyCON@dP!47>BPaj$Y*ppX^On4Z&2W zjGooIK80x2@aFD&YLXYfzf?f$;lOjcdw=Xlrrqz47qH!+&ndS5{)n)jgtp#Hz&YoHro+HgDSw^OWp~(Pl>dRnUG6)7l5MLt60P{90xl73^y0);8L^YBBlUnm0VQ`veBy<6YM zs!f9*MuhYo1cv4S_0?){)!+$D&Q}Dm{9L0+;IemdqLisH+hO;5=X2LD_D7Eo>7IGJimI|K;G373o5g)c z9}6>~Famp|Dt;p%qxWoQxE09PElZ%0vgn0+W^y{~BmvGW1t6R$I8Rr&5IUj^HPq5mKXRVIeif4qfcw$V$DwL z3w${{@YJ8y6=>{1>*nF=U}NRQiGhLfwe6f9|Hdn_=mth1pXoL4}pIO{6pX$0{;;BhrmAs{vq%Wfqw}6L*O3*{}A|x oz&`~3A@C1@e+c|T;2#425cr3{KLq|E@DG812>e6fe}lmP03`SL<^TWy literal 0 HcmV?d00001 diff --git a/httpd/awhttpd.patch b/httpd/awhttpd.patch new file mode 100644 index 0000000000..932c0583ec --- /dev/null +++ b/httpd/awhttpd.patch @@ -0,0 +1,1768 @@ +diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h +--- awhttpd/aw3.h 2005-01-23 13:17:14.000000000 +1000 ++++ axTLS/httpd/awhttpd/aw3.h 2006-06-28 20:38:44.921875000 +1000 +@@ -7,17 +7,16 @@ + */ + + +-#include +-#include +-#include +-#include +-#include ++#include "os_port.h" ++#include "ssl.h" + + + + #define BACKLOG 15 + #define VERSION "3.0.7" ++#ifdef CONFIG_HTTP_HAS_IPV6 + #define HAVE_IPV6 ++#endif + + #define MAXFILEPATH 1024 + #define MAXIPLEN 45 +@@ -26,6 +25,7 @@ + #define BLOCKSIZE 4096 + + #define INITIAL_CONNECTION_SLOTS 10 ++#define CONFIG_HTTP_DEFAULT_SSL_OPTIONS 0 + + #define STATE_WANT_TO_READ_HEAD 1 + #define STATE_WANT_TO_SEND_HEAD 2 +@@ -37,7 +37,6 @@ + #define TYPE_HEAD 1 + #define TYPE_POST 2 + +- + struct connstruct { + struct connstruct *next; + +@@ -46,29 +45,46 @@ + + int networkdesc; + int filedesc; ++ ++#if defined(CONFIG_HTTP_DIRECTORIES) || defined(CONFIG_STANDARD_AWHTTPD) ++#ifdef WIN32 ++ HANDLE dirp; ++ WIN32_FIND_DATA file_data; ++#else + DIR *dirp; ++#endif ++#endif + ++#if defined(CONFIG_STANDARD_AWHTTPD) || defined(CONFIG_HTTP_USE_TIMEOUT) + int timeout; ++#endif + + char ip[MAXIPLEN]; + + char actualfile[MAXREQUESTLENGTH]; + char filereq[MAXREQUESTLENGTH]; ++#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) + char cgiargs[MAXREQUESTLENGTH]; + char cgiscriptinfo[MAXREQUESTLENGTH]; + char cgipathinfo[MAXREQUESTLENGTH]; ++#endif + char virtualhostreq[MAXREQUESTLENGTH]; + + int numbytes; + long offset; + char databuf[BLOCKSIZE]; + ++ int is_ssl; + }; + + + struct serverstruct { + struct serverstruct *next; + int sd; ++ int is_ssl; ++#ifdef CONFIG_HTTP_HAS_SSL ++ SSLCTX *ssl_ctx; ++#endif + }; + + +@@ -111,13 +127,20 @@ + + + // Useful macros ++#ifdef CONFIG_STANDARD_AWHTTPD + #define istimedout(tp,ct) ((ct) > (tp)->timeout) + #define updatetimeout(tp,ct) ((tp)->timeout = (ct)+usertimeout) ++#elif CONFIG_HTTP_USE_TIMEOUT ++#define istimedout(tp,ct) ((ct) > (tp)->timeout) ++#define updatetimeout(tp,ct) ((tp)->timeout = (ct)+CONFIG_HTTP_TIMEOUT) ++#else ++#define updatetimeout(tp,ct) /* empty macro */ ++#endif + + + + // conn.c prototypes +-void addconnection(int sd, char *ip); ++void addconnection(int sd, char *ip, int is_ssl); + void removeconnection(struct connstruct *cn); + + +@@ -129,16 +152,17 @@ + void procsendhead(struct connstruct *cn); + void procreadfile(struct connstruct *cn); + void procsendfile(struct connstruct *cn); ++int special_write(struct connstruct *cn, const uint8_t *buf, size_t count); + + + // net.c prototypes + void addtoservers(int sd); +-void selectloop(); ++void selectloop(void); + + + // socket.c prototypes + int pollsocket(int sd, long ustimeout); +-void handlenewconnection(int listenfd); ++void handlenewconnection(int listenfd, int is_ssl); + int openlistener(int port); + int openlistener6(int port); + +@@ -150,9 +174,9 @@ + + + // misc.c prototypes +-void nada(); +-void die(); +-void reaper(); ++void nada(int sigtype); ++void die(int sigtype); ++void reaper(int sigtype); + void stripcrlf(char *p); + char *my_strncpy(char *dest, const char *src, size_t n); + #ifndef __HAVE_ARCH_STRNLEN +@@ -166,12 +190,12 @@ + void buildactualfile(struct connstruct *cn); + int issockwriteable(int sd); + int isdir(char *name); +-void status(); ++void status(void); + int trycgi_withpathinfo(struct connstruct *cn); + + + // mime_types.c prototypes +-char *getmimetype(char *fn); ++const char *getmimetype(char *fn); + + + // urldecode.c prototypes +@@ -188,7 +212,7 @@ + + + // conf.c prototypes +-void defaultconfvals(); ++void defaultconfvals(void); + void procconf(char *filename); + + +@@ -202,4 +226,4 @@ + + + // main.c prototypes +-void initlists(); ++void initlists(void); +diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c +--- awhttpd/cgi.c 2005-06-04 14:09:52.000000000 +1000 ++++ axTLS/httpd/awhttpd/cgi.c 2006-06-28 20:38:44.921875000 +1000 +@@ -7,29 +7,33 @@ + */ + + +-#include + #include + #include +-#include ++#include + + #include "aw3.h" + + + ++#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) + void addcgiext(char *tp) { + + struct cgiextstruct *ex; + + ex = (struct cgiextstruct *) malloc(sizeof(struct cgiextstruct)); + if (ex == NULL) { ++#ifdef CONFIG_HTTP_VERBOSE + fprintf(stderr, "Serious memory error...\n"); +- exit(0); ++#endif ++ exit(1); + } + + ex->ext = strdup(tp); + if (ex->ext == NULL) { ++#ifdef CONFIG_HTTP_VERBOSE + fprintf(stderr, "Serious memory error...\n"); +- exit(0); ++#endif ++ exit(1); + } + + ex->next = cgiexts; +@@ -43,7 +47,7 @@ + + void gensysenv(struct connstruct *cn) { + +- #ifndef LIMITEDCGI ++#if !defined (LIMITEDCGI) && !defined(WIN32) + + char buf[1024]; + +@@ -54,7 +58,9 @@ + + setenv("AW_VERSION", VERSION, 1); + ++#ifdef CONFIG_STANDARD_AWHTTPD + setenv("AW_QUOTE", quote, 1); ++#endif + + /* Commented this out because (and this is ridiculous) PHP + doesn't seem to work with this variable specified +@@ -70,30 +76,39 @@ + + setenv("QUERY_STRING", cn->cgiargs, 1); + +- return; +- +- #endif +- ++#endif + } + + + + void proccgi(struct connstruct *cn, int has_pathinfo) { + +- int tpipe[2], fv; +- char *myargs[3]; ++ int tpipe[2]; ++ char *myargs[5]; + char buf[MAXREQUESTLENGTH]; ++#ifdef WIN32 ++ int tmp_stdout; ++#else ++ int fv; ++#endif + ++#ifdef CONFIG_STANDARD_AWHTTPD + snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s (%s)\n%s", + VERSION, + quote, (cn->reqtype == TYPE_HEAD) ? "\n" : ""); +- write(cn->networkdesc, buf, strlen(buf)); ++#else ++ snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s\n%s", ++ VERSION, ++ (cn->reqtype == TYPE_HEAD) ? "\n" : ""); ++#endif ++ special_write(cn, buf, strlen(buf)); + + if (cn->reqtype == TYPE_HEAD) { + removeconnection(cn); + return; + } + ++#ifndef WIN32 + if (pipe(tpipe) == -1) { + removeconnection(cn); + return; +@@ -108,7 +123,8 @@ + return; + } + +- if (fv != 0) { ++ if (fv != 0) ++ { + // Close the write descriptor + close(tpipe[1]); + cn->filedesc = tpipe[0]; +@@ -132,19 +148,64 @@ + close(tpipe[1]); + + myargs[0] = cn->actualfile; +- myargs[1] = strdup(cn->cgiargs); ++ myargs[1] = cn->cgiargs; + myargs[2] = NULL; + +- if (!has_pathinfo) +- { +- my_strncpy(cn->cgipathinfo, "/", MAXREQUESTLENGTH); +- my_strncpy(cn->cgiscriptinfo, cn->filereq, MAXREQUESTLENGTH); +- } ++ if (!has_pathinfo) { ++ my_strncpy(cn->cgipathinfo, "/", MAXREQUESTLENGTH); ++ my_strncpy(cn->cgiscriptinfo, cn->filereq, MAXREQUESTLENGTH); ++ } + + gensysenv(cn); + + execv(cn->actualfile, myargs); ++#else /* WIN32 */ ++ if (_pipe(tpipe, 4096, O_BINARY| O_NOINHERIT) == -1) { ++ removeconnection(cn); ++ return; ++ } ++ ++ myargs[0] = "sh"; ++ myargs[1] = "-c"; ++ myargs[2] = cn->actualfile; ++ myargs[3] = cn->cgiargs; ++ myargs[4] = NULL; ++ ++ /* convert all the forward slashes to back slashes */ ++ { ++ char *t = myargs[2]; ++ while ((t = strchr(t, '\\'))) ++ { ++ *t++ = '/'; ++ } ++ } + +- exit(0); ++ tmp_stdout = _dup(_fileno(stdout)); ++ _dup2(tpipe[1], _fileno(stdout)); ++ close(tpipe[1]); + ++ /* change to suit execution method */ ++ if (spawnl(P_NOWAIT, "c:\\Program Files\\cygwin\\bin\\sh.exe", ++ myargs[0], myargs[1], myargs[2], myargs[3], myargs[4]) == -1) { ++ removeconnection(cn); ++ return; ++ } ++ ++ _dup2(tmp_stdout, _fileno(stdout)); ++ close(tmp_stdout); ++ cn->filedesc = tpipe[0]; ++ cn->state = STATE_WANT_TO_READ_FILE; ++ ++ for (;;) ++ { ++ procreadfile(cn); ++ ++ if (cn->filedesc == -1) ++ break; ++ ++ procsendfile(cn); ++ usleep(200000); /* don't know why this delay makes it work (yet) */ ++ } ++#endif + } ++#endif /* CONFIG_HTTP_HAS_CGI */ +diff -Naur awhttpd/conf.c axTLS/httpd/awhttpd/conf.c +--- awhttpd/conf.c 2005-06-04 14:09:52.000000000 +1000 ++++ axTLS/httpd/awhttpd/conf.c 2006-06-28 20:38:44.921875000 +1000 +@@ -10,11 +10,7 @@ + #include + #include + #include +-#include +-#include + #include +-#include +- + #include "aw3.h" + + +@@ -23,21 +19,29 @@ + + int usevirtualhosts; + char *webroot; ++int initialslots; ++int maxusers; ++ ++#ifdef CONFIG_STANDARD_AWHTTPD ++ + int allowdirectorylisting; + int allowcgi; + int permcheck; +-int maxusers; + int usertimeout; +-int initialslots; + char *quote; + ++#endif /* CONFIG_STANDARD_AWHTTPD */ ++ ++ + int numusers; + + + + void defaultconfvals() { + ++#ifdef CONFIG_STANDARD_AWHTTPD + usevirtualhosts = 0; ++ maxusers = 500; + allowdirectorylisting = 0; + allowcgi = 0; + permcheck = 0; +@@ -45,6 +49,13 @@ + usertimeout = 5; + initialslots = 10; + quote = "Fear and loathing on the WWW"; ++#else ++ maxusers = 500; ++ initialslots = CONFIG_HTTP_INITIAL_SLOTS; ++ maxusers = CONFIG_HTTP_MAX_USERS; ++ usevirtualhosts = 1; ++#endif ++ + + // Not really conf stuff: + numusers = 0; +@@ -54,6 +65,7 @@ + } + + ++#ifdef CONFIG_STANDARD_AWHTTPD + void procconf(char *filename) { + + FILE *fp; +@@ -210,11 +222,11 @@ + err++; + } else { + if (setgid(bl->pw_gid) != 0) { +- fprintf(stderr, "WARN: Unable to drop GID to %d\n", bl->pw_gid); ++ fprintf(stderr, "WARN: Unable to drop GID to %ld\n", bl->pw_gid); + warn++; + } + if (setuid(bl->pw_uid) != 0) { +- fprintf(stderr, "WARN: Unable to drop UID to %d\n", bl->pw_uid); ++ fprintf(stderr, "WARN: Unable to drop UID to %ld\n", bl->pw_uid); + warn++; + } + } +@@ -263,3 +275,4 @@ + return; + + } ++#endif /* CONFIG_STANDARD_AWHTTPD */ +diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c +--- awhttpd/conn.c 2004-12-07 16:11:02.000000000 +1000 ++++ axTLS/httpd/awhttpd/conn.c 2006-06-28 20:38:44.921875000 +1000 +@@ -9,15 +9,11 @@ + + #include + #include +-#include +-#include + #include +- + #include "aw3.h" + + +- +-void addconnection(int sd, char *ip) { ++void addconnection(int sd, char *ip, int is_ssl) { + struct connstruct *tp; + + // Get ourselves a connstruct +@@ -39,12 +35,21 @@ + usedconns = tp; + + tp->networkdesc = sd; ++#ifdef CONFIG_HTTP_HAS_SSL ++ if (is_ssl) ++ ssl_server_new(servers->ssl_ctx, sd); ++#endif + tp->filedesc = -1; ++#if defined(CONFIG_STANDARD_AWHTTPD) || defined(CONFIG_HTTP_HAS_DIRECTORIES) + tp->dirp = NULL; ++#endif ++ tp->is_ssl = is_ssl; + + *(tp->actualfile) = '\0'; + *(tp->filereq) = '\0'; ++#if defined(CONFIG_STANDARD_AWHTTPD) || defined(CONFIG_HTTP_HAS_CGI) + *(tp->cgiargs) = '\0'; ++#endif + *(tp->virtualhostreq) = '\0'; + + tp->state = STATE_WANT_TO_READ_HEAD; +@@ -57,7 +62,6 @@ + numusers++; + + updatetimeout(tp, time(NULL)); +- + return; + + } +@@ -95,10 +99,22 @@ + freeconns = cn; + + // Close it all down +- if (cn->networkdesc != -1) close(cn->networkdesc); ++ if (cn->networkdesc != -1) { ++#ifdef CONFIG_HTTP_HAS_SSL ++ if (cn->is_ssl) { ++ ssl_free(ssl_find(servers->ssl_ctx, cn->networkdesc)); ++ } ++#endif ++ SOCKET_CLOSE(cn->networkdesc); ++ } + if (cn->filedesc != -1) close(cn->filedesc); ++#if defined(CONFIG_STANDARD_AWHTTPD) || defined(CONFIG_HTTP_HAS_DIRECTORIES) ++#ifdef WIN32 ++ if (cn->dirp != NULL) FindClose(cn->dirp); ++#else + if (cn->dirp != NULL) closedir(cn->dirp); +- ++#endif ++#endif + numusers--; + + return; +diff -Naur awhttpd/errors.c axTLS/httpd/awhttpd/errors.c +--- awhttpd/errors.c 2005-01-23 06:49:29.000000000 +1000 ++++ axTLS/httpd/awhttpd/errors.c 2006-06-28 20:38:44.937500000 +1000 +@@ -8,7 +8,6 @@ + + + #include +-#include + #include + + #include "aw3.h" +@@ -20,7 +19,7 @@ + + snprintf(buf, sizeof(buf), "HTTP/1.1 301 Moved Permanently\nLocation: %s/\n\n\n\n301 Moved Permanently\n\n

Moved Permanently

\nThe document has moved here.

\n

\n\n", cn->filereq, cn->filereq); + +- write(cn->networkdesc, buf, strlen(buf)); ++ special_write(cn, buf, strlen(buf)); + + return; + +@@ -34,7 +33,7 @@ + + snprintf(buf, sizeof(buf), "HTTP/1.0 404 Not Found\nContent-Type: text/html\n\n\n404 Not Found

It ain't there my friend. (404 Not Found)

\n

Anti-Web HTTPD - Take back some simplicity.\n\n"); + +- write(cn->networkdesc, buf, strlen(buf)); ++ special_write(cn, buf, strlen(buf)); + + return; + +@@ -42,6 +41,7 @@ + + + ++/* TODO: this really needs to use the connstruct object */ + void send505(int sd, char *reason) { + + char buf[1024]; +diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c +--- awhttpd/index.c 2005-06-04 14:09:52.000000000 +1000 ++++ axTLS/httpd/awhttpd/index.c 2006-06-28 20:38:44.937500000 +1000 +@@ -11,7 +11,6 @@ + #include + #include + #include +-#include + #include + + #include "aw3.h" +@@ -52,7 +51,13 @@ + tp = indexlist; + + while(tp != NULL) { +- snprintf(tbuf, sizeof(tbuf), "%s%s", cn->actualfile, tp->name); ++ sprintf(tbuf, "%s%s%s", cn->actualfile, ++#ifdef WIN32 ++ "\\", ++#else ++ "/", ++#endif ++ tp->name); + + if (stat(tbuf, stp) != -1) { + my_strncpy(cn->actualfile, tbuf, MAXREQUESTLENGTH); +diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c +--- awhttpd/main.c 2005-06-04 14:09:52.000000000 +1000 ++++ axTLS/httpd/awhttpd/main.c 2006-06-28 20:38:44.937500000 +1000 +@@ -11,7 +11,6 @@ + #include + #include + #include +-#include + #include + + #include "aw3.h" +@@ -21,10 +20,40 @@ + struct serverstruct *servers; + struct connstruct *usedconns; + struct connstruct *freeconns; ++#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) + struct cgiextstruct *cgiexts; ++#endif + struct indexstruct *indexlist; + ++/* clean up memory for valgrind */ ++static void sigint_cleanup(int sig) ++{ ++ struct serverstruct *sp; ++ struct connstruct *tp; ++ int i; ++ ++ while(servers != NULL) { ++#ifdef CONFIG_HTTP_HAS_SSL ++ if (servers->is_ssl) ++ ssl_ctx_free(servers->ssl_ctx); ++#endif ++ sp = servers->next; ++ free(servers); ++ servers = sp; ++ } ++ free(indexlist->name); ++ free(indexlist); ++ for(i=0; i< INITIAL_CONNECTION_SLOTS; i++) { ++ if (freeconns == NULL) ++ break; ++ ++ tp = freeconns->next; ++ free(freeconns); ++ freeconns = tp; ++ } + ++ exit(0); ++} + + void initlists() { + int i; +@@ -33,15 +62,19 @@ + servers = NULL; + usedconns = NULL; + freeconns = NULL; ++#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) + cgiexts = NULL; ++#endif + indexlist = NULL; + + for(i=0; inext = tp; +@@ -49,6 +82,7 @@ + } + + ++#ifdef CONFIG_STANDARD_AWHTTPD + void usage(char *cmline) { + fprintf(stderr, "Anti-Web V%s (C) 2001-2004 by Hardcore Software and others\n\n", VERSION); + +@@ -65,76 +99,138 @@ + + exit(1); + } ++#endif + + + int main(int argc, char *argv[]) { + ++#ifdef CONFIG_STANDARD_AWHTTPD + char buf[MAXREQUESTLENGTH]; +- int pid, tp; +- ++#endif ++ int tp; ++#if defined(CONFIG_HTTP_IS_DAEMON) || defined(CONFIG_STANDARD_AWHTTPD) ++ int pid; ++#endif ++ ++#ifdef WIN32 ++ WORD wVersionRequested = MAKEWORD(2,2); ++ WSADATA wsaData; ++ WSAStartup(wVersionRequested,&wsaData); ++#endif ++ + initlists(); + ++#ifdef CONFIG_STANDARD_AWHTTPD + if (argc != 2 && argc != 3) usage(argv[0]); + + webroot = strdup(argv[1]); ++#else ++ webroot = CONFIG_HTTP_WEBROOT; ++#endif + + tp = strlen(webroot); + if (webroot[tp-1] == '/') webroot[tp-1] = '\0'; + + if (isdir(webroot) == 0) { ++#ifdef CONFIG_HTTP_VERBOSE + fprintf(stderr, "'%s' is not a directory\n", webroot); ++#endif + exit(1); + } + + defaultconfvals(); + ++#ifdef CONFIG_STANDARD_AWHTTPD + if (argc == 2) { + snprintf(buf, sizeof(buf), "%s/awhttpd.conf", webroot); + procconf(buf); + } else { + if ((tp=openlistener(atoi(argv[2]))) == -1) { ++#ifdef CONFIG_HTTP_VERBOSE + fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", atoi(argv[2])); ++#endif + exit(1); + } ++ } ++#else /* not command line */ ++ if ((tp=openlistener(CONFIG_HTTP_PORT)) == -1) { ++#ifdef CONFIG_HTTP_VERBOSE ++ fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", ++ CONFIG_HTTP_PORT); ++#endif ++ exit(1); ++ } ++#endif /* CONFIG_STANDARD_AWHTTPD */ + + addindex("index.html"); + addtoservers(tp); +- setgid(32767); +- setuid(32767); +- } + ++#ifndef WIN32 ++ if (getuid() == 0) ++ { ++ setgid(32767); ++ setuid(32767); ++ } ++#endif ++ ++#ifdef CONFIG_HTTP_HAS_SSL ++ if ((tp=openlistener(CONFIG_HTTP_HTTPS_PORT)) == -1) { ++#ifdef CONFIG_HTTP_VERBOSE ++ fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", ++ CONFIG_HTTP_HTTPS_PORT); ++#endif ++ exit(1); ++ } ++ ++ addtoservers(tp); ++ servers->ssl_ctx = ssl_ctx_new(CONFIG_HTTP_DEFAULT_SSL_OPTIONS, ++ SSL_DEFAULT_SVR_SESS); ++ servers->is_ssl = 1; ++#endif /* CONFIG_HTTP_HAS_SSL */ ++ ++#if defined (CONFIG_STANDARD_AWHTTPD) + if (permcheck == 1) procpermcheck(webroot); ++#elif defined(CONFIG_HTTP_PERM_CHECK) ++ procpermcheck(webroot); ++#endif ++#if defined(CONFIG_HTTP_HAS_CGI) ++ addcgiext(CONFIG_HTTP_CGI_EXTENSION); ++#endif ++#if defined(CONFIG_HTTP_VERBOSE) ++ printf("awhttpd: listening on ports http:%d and https:%d\n", ++ CONFIG_HTTP_PORT, CONFIG_HTTP_HTTPS_PORT); ++ TTY_FLUSH(); ++#endif + ++#if defined(CONFIG_HTTP_IS_DAEMON) || defined(CONFIG_STANDARD_AWHTTPD) + pid = fork(); + + if(pid > 0) { + status(); + exit(0); + } else if(pid == -1) { ++#ifdef CONFIG_HTTP_VERBOSE + fprintf(stderr,"Anti-Web: Sorry, fork failed... Tough dice.\n"); ++#endif + exit(1); + } + + setsid(); ++#endif + + /* SIGNALS */ +- signal(SIGINT, die); +- signal(SIGQUIT, die); ++ signal(SIGINT, sigint_cleanup); + signal(SIGTERM, die); ++#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) ++#ifndef WIN32 + signal(SIGCHLD, reaper); +- +- #ifndef SOLARIS +- signal(SIGPIPE, nada); +- #endif +- +- #ifdef SOLARIS +- act.sa_handler = nada; +- sigemptyset(&act.sa_mask); +- act.sa_flags = SA_RESTART; +- +- sigaction(SIGPIPE,&act,NULL); +- #endif +- ++#endif ++#endif ++#ifndef WIN32 ++ signal(SIGQUIT, die); ++ signal(SIGPIPE, SIG_IGN); ++#endif ++ + selectloop(); + + return 0; +diff -Naur awhttpd/mime_types.c axTLS/httpd/awhttpd/mime_types.c +--- awhttpd/mime_types.c 2004-01-26 01:08:47.000000000 +1000 ++++ axTLS/httpd/awhttpd/mime_types.c 2006-06-28 20:38:44.937500000 +1000 +@@ -21,13 +21,14 @@ + + + #include ++#include "os_port.h" + + + char mime_default[] = "text/plain"; + + struct { +- char *ext; +- char *type; ++ const char *ext; ++ const char *type; + } mime_table[] = { + + // Fundamentals +@@ -161,7 +162,7 @@ + }; + + +-char *getmimetype(char *name) { ++const char *getmimetype(char *name) { + int namelen, extlen, i; + + namelen = strlen(name); +@@ -178,3 +179,4 @@ + return mime_default; + + } ++ +diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c +--- awhttpd/misc.c 2005-01-23 12:59:09.000000000 +1000 ++++ axTLS/httpd/awhttpd/misc.c 2006-06-28 20:38:44.937500000 +1000 +@@ -7,33 +7,33 @@ + */ + + +-#include + #include + #include + #include +-#include ++#include + #include + #include +-#include +-#include +-#include + + #include "aw3.h" + + + + +-void nada() { } ++void nada(int sigtype) { } + + +-void die() { ++void die(int sigtype) { + exit(0); + } + + +-void reaper() { ++#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) ++#ifndef WIN32 ++void reaper(int sigtype) { + wait3(NULL,WNOHANG,NULL); + } ++#endif ++#endif + + + void stripcrlf(char *p) { +@@ -77,6 +77,7 @@ + #endif + + ++#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) + int iscgi(char *fn) { + + struct cgiextstruct *tp; +@@ -97,6 +98,7 @@ + return 0; + + } ++#endif + + + +@@ -235,6 +237,7 @@ + + void buildactualfile(struct connstruct *cn) { + ++#if 0 + char tpbuf[MAXREQUESTLENGTH]; + + if (usevirtualhosts) { +@@ -253,6 +256,26 @@ + webroot, + cn->virtualhostreq, + cn->filereq); ++#endif ++ snprintf(cn->actualfile, MAXREQUESTLENGTH, "%s%s", ++ webroot, ++ cn->filereq); ++ ++ /* Add directory slash if not there */ ++ if (isdir(cn->actualfile) && ++ cn->actualfile[strlen(cn->actualfile)-1] != '/') ++ strcat(cn->actualfile, "/"); ++ ++#ifdef WIN32 ++ /* convert all the forward slashes to back slashes */ ++ { ++ char *t = cn->actualfile; ++ while ((t = strchr(t, '/'))) ++ { ++ *t++ = '\\'; ++ } ++ } ++#endif + + return; + +@@ -279,7 +302,7 @@ + + int isdir(char *tpbuf) { + +- static struct stat st; ++ struct stat st; + + if (stat(tpbuf, &st) == -1) return 0; + +@@ -292,6 +315,7 @@ + + // FIXME: Arg! This function is horrible! Rewrite it + void status() { ++#if defined(CONFIG_STANDARD_AWHTTPD) + + int i; + +@@ -300,14 +324,16 @@ + fprintf(stdout," [*************************************************]\n"); + fprintf(stdout," [ DIRECTORY {%s}",webroot); + if(strlen(webroot)<35) +- for(i=1;i<=35-strlen(webroot);i++) fprintf(stdout," "); ++ for(i=1;i<=35-(int)strlen(webroot);i++) fprintf(stdout," "); + fprintf(stdout,"]\n"); + fprintf(stdout," [*************************************************]\n"); + ++#endif + } + + + ++#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) + /* This function was originally written by Nicolas Benoit + but I've rewritten some parts of it to work under + as many possible AW configurations as possible. +@@ -329,7 +355,8 @@ + while (fr_rs[i] != NULL) { + snprintf(tpfile, sizeof(tpfile), "%s/%s%s", webroot, cn->virtualhostreq, fr_str); + +- if (iscgi(tpfile) && access(tpfile, X_OK) == 0 && isdir(tpfile) == 0) { ++ //if (iscgi(tpfile) && access(tpfile, X_OK) == 0 && isdir(tpfile) == 0) { ++ if (iscgi(tpfile) && isdir(tpfile) == 0) { + /* We've found our CGI file! */ + my_strncpy(cn->actualfile, tpfile, MAXREQUESTLENGTH); + my_strncpy(cn->cgiscriptinfo, fr_str, MAXREQUESTLENGTH); +@@ -349,3 +376,4 @@ + *(cn->cgipathinfo) = '\0'; + return -1; + } ++#endif +diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c +--- awhttpd/net.c 2005-06-04 14:09:52.000000000 +1000 ++++ axTLS/httpd/awhttpd/net.c 2006-06-28 20:38:44.937500000 +1000 +@@ -8,9 +8,7 @@ + + + #include +-#include + #include +-#include + #include + #include + #include +@@ -23,9 +21,11 @@ + void addtoservers(int sd) { + struct serverstruct *tp; + +- tp = (struct serverstruct *) malloc(sizeof(struct serverstruct)); ++ tp = (struct serverstruct *) calloc(1, sizeof(struct serverstruct)); + if (tp == NULL) { ++#ifdef CONFIG_HTTP_VERBOSE + fprintf(stderr, "Serious memory error...\n"); ++#endif + exit(1); + } + +@@ -44,7 +44,9 @@ + struct connstruct *tp, *to; + struct serverstruct *sp; + int rnum, wnum, active; ++#if defined(CONFIG_STANDARD_AWHTTPD) || defined(CONFIG_HTTP_USE_TIMEOUT) + int currtime; ++#endif + + while(1) { // MAIN SELECT LOOP + FD_ZERO(&rfds); +@@ -61,15 +63,19 @@ + + // Add the established sockets + tp = usedconns; ++#if defined(CONFIG_STANDARD_AWHTTPD) || defined(CONFIG_HTTP_USE_TIMEOUT) + currtime = time(NULL); ++#endif + while(tp != NULL) { + ++#if defined(CONFIG_STANDARD_AWHTTPD) || defined(CONFIG_HTTP_USE_TIMEOUT) + if (istimedout(tp, currtime)) { + to = tp; + tp = tp->next; + removeconnection(to); + continue; + } ++#endif + + if (tp->state == STATE_WANT_TO_READ_HEAD) { + FD_SET(tp->networkdesc, &rfds); +@@ -87,10 +93,12 @@ + FD_SET(tp->networkdesc, &wfds); + if (tp->networkdesc > wnum) wnum = tp->networkdesc; + } ++#if defined(CONFIG_HTTP_DIRECTORIES) || defined(CONFIG_STANDARD_AWHTTPD) + if (tp->state == STATE_DOING_DIR) { + FD_SET(tp->networkdesc, &wfds); + if (tp->networkdesc > wnum) wnum = tp->networkdesc; + } ++#endif + tp = tp->next; + } + +@@ -104,7 +112,7 @@ + sp = servers; + while(active > 0 && sp != NULL) { + if (FD_ISSET(sp->sd, &rfds)) { +- handlenewconnection(sp->sd); ++ handlenewconnection(sp->sd, sp->is_ssl); + active--; + } + sp = sp->next; +@@ -112,7 +120,9 @@ + + // Handle the established sockets + tp = usedconns; ++#if defined(CONFIG_STANDARD_AWHTTPD) || defined(CONFIG_HTTP_USE_TIMEOUT) + currtime = time(NULL); ++#endif + while(active > 0 && tp != NULL) { + to = tp; + tp = tp->next; +@@ -141,12 +151,14 @@ + active--; + procsendfile(to); + } ++#if defined(CONFIG_HTTP_DIRECTORIES) || defined(CONFIG_STANDARD_AWHTTPD) + if (to->state == STATE_DOING_DIR) + if (FD_ISSET(to->networkdesc, &wfds)) { + updatetimeout(to, currtime); + active--; + procdodir(to); + } ++#endif + } + + +diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c +--- awhttpd/permcheck.c 2005-01-23 06:49:29.000000000 +1000 ++++ axTLS/httpd/awhttpd/permcheck.c 2006-06-28 20:38:44.937500000 +1000 +@@ -7,21 +7,23 @@ + */ + + +-#include + #include ++#include ++#include + + #include "aw3.h" + ++#if defined(CONFIG_HTTP_PERM_CHECK) || defined (CONFIG_STANDARD_AWHTTPD) + void procpermcheck(char *pathtocheck) { +- ++ char thepath[MAXREQUESTLENGTH]; ++#ifndef WIN32 + DIR *tpdir; + struct dirent *dp; +- char thepath[MAXREQUESTLENGTH]; + + tpdir=opendir(pathtocheck); + + if (tpdir==NULL) { +- printf("WARNING: UID (%d) is unable to read %s\n", getuid(), pathtocheck); ++ printf("WARNING: UID (%d) is unable to read %s\n", (int)getuid(), pathtocheck); + return; + } + +@@ -38,14 +40,56 @@ + } + + if (access(thepath, R_OK) != 0) +- printf("WARNING: UID (%d) is unable to read %s\n", getuid(), thepath); ++ printf("WARNING: UID (%d) is unable to read %s\n", (int)getuid(), thepath); + if (access(thepath, W_OK) == 0) +- printf("SECURITY: UID (%d) is ABLE TO WRITE TO %s\n", getuid(), thepath); ++ printf("SECURITY: UID (%d) is ABLE TO WRITE TO %s\n", (int)getuid(), thepath); + + } + + closedir(tpdir); ++#else /* Win32 */ ++ HANDLE tpdir; ++ WIN32_FIND_DATA file_data; ++ struct stat st; ++ char buf2[1024]; ++ ++ strcpy(buf2, pathtocheck); ++ strcat(buf2, "\\*"); ++ tpdir = FindFirstFile(buf2, &file_data); ++ ++ if (tpdir == INVALID_HANDLE_VALUE) { ++ printf("WARNING: unable to read %s\n", buf2); ++ TTY_FLUSH(); ++ return; ++ } ++ ++ while (FindNextFile(tpdir, &file_data)) { ++ ++ if (strcmp(file_data.cFileName, "..")==0) continue; ++ if (strcmp(file_data.cFileName, ".")==0) continue; ++ ++ snprintf(thepath, sizeof(thepath), "%s\\%s", ++ pathtocheck, file_data.cFileName); + +- return; ++ if (isdir(thepath)) { ++ procpermcheck(thepath); ++ continue; ++ } ++ ++ if (stat(thepath, &st) >= 0) { ++ if ((st.st_mode & _S_IREAD) == 0) { ++ printf("WARNING: unable to read %s\n", thepath); ++ TTY_FLUSH(); ++ } ++ ++ if (st.st_mode & _S_IWRITE) { ++ printf("SECURITY: ABLE TO WRITE TO %s\n", thepath); ++ TTY_FLUSH(); ++ } ++ } ++ } + ++ FindClose(tpdir); ++#endif + } ++#endif /* CONFIG_HTTP_PERM_CHECK */ +diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c +--- awhttpd/proc.c 2005-01-23 10:59:41.000000000 +1000 ++++ axTLS/httpd/awhttpd/proc.c 2006-06-28 20:47:25.109375000 +1000 +@@ -13,14 +13,12 @@ + #include + #include + #include +-#include + #include + #include + + #include "aw3.h" + +- +- ++static int special_read(struct connstruct *cn, void *buf, size_t count); + + // Returns 1 if elems should continue being read, 0 otherwise + int procheadelem(struct connstruct *cn, char *buf) { +@@ -53,7 +51,9 @@ + + my_strncpy(cn->filereq, segs[0], MAXREQUESTLENGTH); + ++#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) + if (segs[1] != NULL) my_strncpy(cn->cgiargs, segs[1], MAXREQUESTLENGTH); ++#endif + + } else if (strcmp(words[0], "Host:")==0) { + +@@ -85,19 +85,22 @@ + + return 1; + +-} +- + ++} + ++#if defined(CONFIG_HTTP_DIRECTORIES) || defined(CONFIG_STANDARD_AWHTTPD) + void procdirlisting(struct connstruct *cn) { + + char buf[MAXREQUESTLENGTH]; ++ char actualfile[1024]; + ++#ifndef CONFIG_HTTP_DIRECTORIES + if (allowdirectorylisting == 0) { + send404(cn); + removeconnection(cn); + return; + } ++#endif + + if (cn->reqtype == TYPE_HEAD) { + snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n"); +@@ -107,7 +110,17 @@ + return; + } + +- cn->dirp = opendir(cn->actualfile); ++ strcpy(actualfile, cn->actualfile); ++#ifdef WIN32 ++ strcat(actualfile, "*"); ++ cn->dirp = FindFirstFile(actualfile, &cn->file_data); ++ if (cn->dirp == INVALID_HANDLE_VALUE) { ++ send404(cn); ++ removeconnection(cn); ++ return; ++ } ++#else ++ cn->dirp = opendir(actualfile); + if (cn->dirp == NULL) { + send404(cn); + removeconnection(cn); +@@ -116,12 +129,13 @@ + + // Get rid of the "." + readdir(cn->dirp); ++#endif + + // If the browser doesn't specify a virtual host, the client will + // see "http://default/thedir/" instead of "http://thehost.com/thedir/" + // Consider this punishment for using such an old browser. + snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n\nDirectory Listing\n

Directory listing of http://%s%s


\n", cn->virtualhostreq, cn->filereq); +- write(cn->networkdesc, buf, strlen(buf)); ++ special_write(cn, buf, strlen(buf)); + + cn->state = STATE_DOING_DIR; + +@@ -134,36 +148,48 @@ + + void procdodir(struct connstruct *cn) { + ++#ifndef WIN32 + struct dirent *dp; ++#endif + char buf[MAXREQUESTLENGTH]; +- char encbuf[sizeof(dp->d_name)*3+1]; ++ char encbuf[1024]; + int putslash; ++ char *file; + + do { + +- if ((dp = readdir(cn->dirp)) == NULL) { ++#ifdef WIN32 ++ if (!FindNextFile(cn->dirp, &cn->file_data)) { ++#else ++ if ((dp = readdir(cn->dirp)) == NULL) { ++#endif + snprintf(buf, sizeof(buf), "

End of Anti-Web directory listing.\n"); +- write(cn->networkdesc, buf, strlen(buf)); ++ special_write(cn, buf, strlen(buf)); + removeconnection(cn); + return; + } + ++#ifdef WIN32 ++ file = cn->file_data.cFileName; ++#else ++ file = dp->d_name; ++#endif + if (cn->filereq[0] == '/' && cn->filereq[1] == '\0' && +- strcmp(dp->d_name, "..") == 0) continue; ++ strcmp(file, "..") == 0) continue; + +- snprintf(buf, sizeof(buf), "%s%s", cn->actualfile, dp->d_name); ++ snprintf(buf, sizeof(buf), "%s%s", cn->actualfile, file); + putslash = isdir(buf); + +- urlencode(dp->d_name, encbuf); ++ urlencode(file, encbuf); + snprintf(buf, sizeof(buf), "%s%s
\n", +- encbuf, putslash ? "/" : "", dp->d_name, putslash ? "/" : ""); +- write(cn->networkdesc, buf, strlen(buf)); ++ encbuf, putslash ? "/" : "", file, putslash ? "/" : ""); ++ special_write(cn, buf, strlen(buf)); + + } while (issockwriteable(cn->networkdesc)); + + return; + } +- ++#endif + + + +@@ -172,9 +198,10 @@ + char buf[MAXREQUESTLENGTH*4], *tp, *next; + int rv; + +- rv = read(cn->networkdesc, buf, sizeof(buf)-1); +- if (rv == 0 || rv == -1) { +- removeconnection(cn); ++ rv = special_read(cn, buf, sizeof(buf)-1); ++ if (rv <= 0) { ++ if (rv < 0) ++ removeconnection(cn); + return; + } + +@@ -217,36 +244,97 @@ + void procsendhead(struct connstruct *cn) { + + char buf[1024]; ++ char actualfile[1024]; + struct stat stbuf; + +- if (stat(cn->actualfile, &stbuf) == -1) { ++ strcpy(actualfile, cn->actualfile); ++ ++#ifdef WIN32 ++ /* stat() under win32 can't deal with trail slash */ ++ if (actualfile[strlen(actualfile)-1] == '\\') ++ actualfile[strlen(actualfile)-1] = 0; ++#endif ++ ++ if (stat(actualfile, &stbuf) == -1) { ++#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) ++#ifndef CONFIG_HTTP_HAS_CGI + if (allowcgi != 0) { ++#endif + if (trycgi_withpathinfo(cn) == 0) { // We Try To Find A CGI + proccgi(cn,1); + return; + } ++#ifndef CONFIG_HTTP_HAS_CGI + } ++#endif ++#endif + + send404(cn); + removeconnection(cn); + return; + } + ++#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) + if (iscgi(cn->actualfile)) { ++#ifndef WIN32 + // Set up CGI script +- if (allowcgi == 0 || +- access(cn->actualfile, X_OK) != 0 || +- isdir(cn->actualfile)) { ++ if ( ++#ifndef CONFIG_HTTP_HAS_CGI ++ allowcgi == 0 || ++#endif ++ (stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) { ++ send404(cn); ++ removeconnection(cn); ++ return; ++ } ++#endif ++ ++ proccgi(cn,0); ++ return; ++ } ++#endif ++ ++ if ((stbuf.st_mode & S_IFMT) == S_IFDIR) { ++ if (cn->filereq[strlen(cn->filereq)-1] != '/') { ++ send301(cn); ++ removeconnection(cn); ++ return; ++ } ++ ++ // Check to see if this dir has an index file ++ if (procindex(cn, &stbuf) == 0) { ++#if defined(CONFIG_HTTP_DIRECTORIES) || defined(CONFIG_STANDARD_AWHTTPD) ++ // If not, we do a directory listing of it ++ procdirlisting(cn); ++#else + send404(cn); + removeconnection(cn); ++#endif + return; + } + +- proccgi(cn,0); +- return; +- } ++#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) ++ // If the index is a CGI file, handle it like any other CGI ++ if (iscgi(cn->actualfile)) { ++ // Set up CGI script ++#ifndef CONFIG_HTTP_HAS_CGI ++ if (allowcgi == 0 || ++ (stbuf.st_mode & S_IEXEC) == 0 != 0 || isdir(cn->actualfile)) { ++#else ++ if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) { ++#endif ++ send404(cn); ++ removeconnection(cn); ++ return; ++ } + ++ proccgi(cn,0); ++ return; ++ } ++#endif ++ // If the index isn't a CGI, we continue on with the index file + ++ } + if ((stbuf.st_mode & S_IFMT) == S_IFDIR) { + if (cn->filereq[strlen(cn->filereq)-1] != '/') { + send301(cn); +@@ -256,16 +344,24 @@ + + // Check to see if this dir has an index file + if (procindex(cn, &stbuf) == 0) { ++#if defined(CONFIG_HTTP_DIRECTORIES) || defined(CONFIG_STANDARD_AWHTTPD) + // If not, we do a directory listing of it + procdirlisting(cn); ++#endif + return; + } + ++#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) + // If the index is a CGI file, handle it like any other CGI + if (iscgi(cn->actualfile)) { + // Set up CGI script +- if (allowcgi == 0 || +- access(cn->actualfile, X_OK) != 0 || ++ if ( ++#ifdef CONFIG_HTTP_HAS_CGI ++ (stbuf.st_mode & S_IEXEC) == 0 || ++#else ++ allowcgi == 0 || ++ (stbuf.st_mode & S_IEXEC) == 0 || ++#endif + isdir(cn->actualfile)) { + send404(cn); + removeconnection(cn); +@@ -275,6 +371,7 @@ + proccgi(cn,0); + return; + } ++#endif + // If the index isn't a CGI, we continue on with the index file + + } +@@ -282,6 +379,7 @@ + if (cn->offset == -1 || cn->offset >= stbuf.st_size) { + cn->offset = -1; + ++#if defined (CONFIG_STANDARD_AWHTTPD) + snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s (%s)\nContent-Type: %s\nContent-Length: %ld\nLast-Modified: %s\n", + VERSION, + quote, +@@ -299,15 +397,41 @@ + (long) stbuf.st_size - cn->offset, + ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end + } ++#else ++#ifdef CONFIG_HTTP_VERBOSE ++ printf("awhttpd: %s send %s\n", ++ cn->is_ssl ? "https" : "http", cn->actualfile); ++ TTY_FLUSH(); ++#endif ++ snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s\nContent-Type: %s\nContent-Length: %ld\nLast-Modified: %s\n", ++ VERSION, ++ getmimetype(cn->actualfile), ++ (long) stbuf.st_size, ++ ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end ++ } else { ++ snprintf(buf, sizeof(buf), "HTTP/1.1 206 OK\nServer: Anti-Web V%s\nContent-Type: %s\nContent-Range: %ld-%ld/%ld\nContent-Length: %ld\nLast-Modified: %s\n", ++ VERSION, ++ getmimetype(cn->actualfile), ++ cn->offset, ++ (long) stbuf.st_size-1, ++ (long) stbuf.st_size, ++ (long) stbuf.st_size - cn->offset, ++ ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end ++ } ++#endif /* CONFIG_HTTP_USE_QUOTE */ + +- write(cn->networkdesc, buf, strlen(buf)); ++ special_write(cn, buf, strlen(buf)); + + if (cn->reqtype == TYPE_HEAD) { + removeconnection(cn); + return; + } else { ++ int flags = O_RDONLY; ++#ifdef WIN32 ++ flags |= O_BINARY; ++#endif + +- cn->filedesc = open(cn->actualfile, O_RDONLY); ++ cn->filedesc = open(cn->actualfile, flags); + if (cn->filedesc == -1) { + send404(cn); + removeconnection(cn); +@@ -318,7 +442,23 @@ + lseek(cn->filedesc, cn->offset, SEEK_SET); + } + ++#ifdef WIN32 ++ for (;;) ++ { ++ procreadfile(cn); ++ if (cn->filedesc == -1) ++ { ++ break; ++ } ++ ++ do ++ { ++ procsendfile(cn); ++ } while (cn->state != STATE_WANT_TO_READ_FILE); ++ } ++#else + cn->state = STATE_WANT_TO_READ_FILE; ++#endif + return; + } + +@@ -328,13 +468,13 @@ + + void procreadfile(struct connstruct *cn) { + +- int rv; +- +- rv = read(cn->filedesc, cn->databuf, BLOCKSIZE); ++ int rv = read(cn->filedesc, cn->databuf, BLOCKSIZE); + + if (rv == 0 || rv == -1) { +- removeconnection(cn); +- return; ++ close(cn->filedesc); ++ cn->filedesc = -1; ++ removeconnection(cn); ++ return; + } + + cn->numbytes = rv; +@@ -347,11 +487,9 @@ + + void procsendfile(struct connstruct *cn) { + +- int rv; ++ int rv = special_write(cn, cn->databuf, cn->numbytes); + +- rv = write(cn->networkdesc, cn->databuf, cn->numbytes); +- +- if (rv == -1) ++ if (rv < 0) + removeconnection(cn); + else if (rv == cn->numbytes) + cn->state = STATE_WANT_TO_READ_FILE; +@@ -361,7 +499,47 @@ + memmove(cn->databuf, cn->databuf + rv, cn->numbytes - rv); + cn->numbytes -= rv; + } ++} + +- return; ++int special_write(struct connstruct *cn, ++ const uint8_t *buf, size_t count) ++{ ++ int res; ++ ++#ifdef CONFIG_HTTP_HAS_SSL ++ if (cn->is_ssl) ++ { ++ SSL *ssl = ssl_find(servers->ssl_ctx, cn->networkdesc); ++ if (ssl) ++ { ++ res = ssl_write(ssl, (unsigned char *)buf, count); ++ } ++ else ++ return -1; ++ } ++ else ++#endif ++ res = SOCKET_WRITE(cn->networkdesc, buf, count); ++ ++ return res; ++} ++ ++static int special_read(struct connstruct *cn, void *buf, size_t count) ++{ ++ int res; ++ ++#ifdef CONFIG_HTTP_HAS_SSL ++ if (cn->is_ssl) ++ { ++ SSL *ssl = ssl_find(servers->ssl_ctx, cn->networkdesc); ++ unsigned char *read_buf; ++ ++ if ((res = ssl_read(ssl, &read_buf)) > SSL_OK) ++ memcpy(buf, read_buf, res > (int)count ? count : res); ++ } ++ else ++#endif ++ res = SOCKET_READ(cn->networkdesc, buf, count); + ++ return res; + } +diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c +--- awhttpd/socket.c 2004-04-25 13:03:05.000000000 +1000 ++++ axTLS/httpd/awhttpd/socket.c 2006-06-28 20:38:44.953125000 +1000 +@@ -8,19 +8,11 @@ + + + #include +-#include +-#include + #include +-#include +-#include +-#include +-#include + #include +-#include + #include + + +- + #include "aw3.h" + + +@@ -62,7 +54,7 @@ + + #ifdef HAVE_IPV6 + +-void handlenewconnection(int listenfd) { ++void handlenewconnection(int listenfd, int is_ssl) { + + struct sockaddr_in6 their_addr; + int tp = sizeof(their_addr); +@@ -82,7 +74,7 @@ + *ipbuf = '\0'; + } + +- if (checkmaxusers(connfd)) addconnection(connfd, ipbuf); ++ if (checkmaxusers(connfd)) addconnection(connfd, ipbuf, is_ssl); + + return; + +@@ -90,19 +82,18 @@ + + #else + +-void handlenewconnection(int listenfd) { ++void handlenewconnection(int listenfd, int is_ssl) { + + struct sockaddr_in their_addr; + int tp = sizeof(struct sockaddr_in); + int connfd; +- char ipbuf[100]; + + connfd = accept(listenfd, (struct sockaddr *)&their_addr, &tp); + + if (connfd == -1) return; + + if (checkmaxusers(connfd)) +- addconnection(connfd, inet_ntoa(their_addr.sin_addr)); ++ addconnection(connfd, inet_ntoa(their_addr.sin_addr), is_ssl); + + return; + } +@@ -113,8 +104,12 @@ + + + int openlistener(int port) { +- +- int tp=0,sd; ++ int sd; ++#ifdef WIN32 ++ char tp=1; ++#else ++ int tp=1; ++#endif + struct sockaddr_in my_addr; + + if ((sd = socket(AF_INET, SOCK_STREAM, 0)) == -1) return -1; +@@ -125,7 +120,7 @@ + setsockopt(sd, SOL_SOCKET, SO_REUSEADDR, &tp, sizeof(tp)); + + my_addr.sin_family = AF_INET; // host byte order +- my_addr.sin_port = htons(port); // short, network byte order ++ my_addr.sin_port = htons((short)port); // short, network byte order + my_addr.sin_addr.s_addr = INADDR_ANY; // automatically fill with my IP + + memset(&(my_addr.sin_zero), 0, 8); // zero the rest of the struct +diff -Naur awhttpd/urlencode.c axTLS/httpd/awhttpd/urlencode.c +--- awhttpd/urlencode.c 2004-05-14 10:53:47.000000000 +1000 ++++ axTLS/httpd/awhttpd/urlencode.c 2006-06-28 20:38:44.953125000 +1000 +@@ -13,7 +13,7 @@ + + #include + #include +- ++#include + #include "aw3.h" + + +@@ -37,7 +37,7 @@ + (*p > 'Z' && *p < '_') || + (*p > '_' && *p < 'a') || + (*p > 'z' && *p < 0xA1)) { +- sprintf(tp, "%%%02X", *p); ++ sprintf((char *)tp, "%%%02X", *p); + tp += 3; + } else { + *tp = *p; diff --git a/samples/Config.in b/samples/Config.in new file mode 100644 index 0000000000..a17f252f9d --- /dev/null +++ b/samples/Config.in @@ -0,0 +1,56 @@ +# +# For a description of the syntax of this configuration file, +# see scripts/config/Kconfig-language.txt +# +menu "Samples" + +config CONFIG_SAMPLES + bool "Create Samples" + default y + help + axTLS contains various sample code. + + Select Y here if you want to build the various samples. + +config CONFIG_C_SAMPLES + bool "axssl - C version" + default y + depends on CONFIG_SAMPLES + help + Build the "C" version of axssl. The features enabled are very + dependent on the build mode ('full' mode will give all features). + +config CONFIG_CSHARP_SAMPLES + bool "axssl - C# version" + default y + depends on CONFIG_SAMPLES && CONFIG_CSHARP_BINDINGS + help + Build the "C#" version of axssl. The features enabled are very + dependent on the build mode ('full' mode will give all features). + +config CONFIG_VBNET_SAMPLES + bool "axssl - VB.NET version" + default y + depends on CONFIG_SAMPLES && CONFIG_VBNET_BINDINGS + help + Build the "VB.NET" version of axssl. The features enabled are very + dependent on the build mode ('full' mode will give all features). + +config CONFIG_JAVA_SAMPLES + bool "axssl - Java version" + default y + depends on CONFIG_SAMPLES && CONFIG_JAVA_BINDINGS + help + Build the "Java" version of axssl. The features enabled are very + dependent on the build mode ('full' mode will give all features). + +config CONFIG_PERL_SAMPLES + bool "axssl - Perl version" + default y + depends on CONFIG_SAMPLES && CONFIG_PERL_BINDINGS + help + Build the "Perl" version of axssl. The features enabled are very + dependent on the build mode ('full' mode will give all features). + +endmenu + diff --git a/samples/Makefile b/samples/Makefile new file mode 100644 index 0000000000..4a7acd7861 --- /dev/null +++ b/samples/Makefile @@ -0,0 +1,46 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +all: + +include ../config/.config +include ../config/makefile.conf + +all: +ifdef CONFIG_C_SAMPLES + $(MAKE) -C c +endif +ifdef CONFIG_CSHARP_SAMPLES + $(MAKE) -C csharp +endif +ifdef CONFIG_VBNET_SAMPLES + $(MAKE) -C vbnet +endif +ifdef CONFIG_JAVA_SAMPLES + $(MAKE) -C java +endif +ifdef CONFIG_PERL_SAMPLES + $(MAKE) -C perl +endif + +clean:: + $(MAKE) -C c clean + $(MAKE) -C csharp clean + $(MAKE) -C vbnet clean + $(MAKE) -C java clean + $(MAKE) -C perl clean diff --git a/samples/c/Makefile b/samples/c/Makefile new file mode 100644 index 0000000000..656b8cb6cd --- /dev/null +++ b/samples/c/Makefile @@ -0,0 +1,67 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +all : sample + +include ../../config/.config +include ../../config/makefile.conf + +ifndef CONFIG_PLATFORM_WIN32 + +ifdef CONFIG_PLATFORM_CYGWIN +TARGET=../../axssl.exe +else +TARGET=../../axssl +endif # cygwin + +LIBS=../../libaxtls.a +CFLAGS += -I../../ssl -I../../config +else +TARGET=../../axssl.exe +LIBS=../../axtls.lib +CFLAGS += /I"..\..\ssl" /I"..\..\config" +endif + +ifndef CONFIG_C_SAMPLES +sample: + +else +sample : $(TARGET) +OBJ= axssl.o +include ../../config/makefile.post + +ifndef CONFIG_PLATFORM_WIN32 + +$(TARGET): $(OBJ) $(LIBS) + $(LD) $(LDFLAGS) -o $@ $^ +ifndef CONFIG_DEBUG +ifndef CONFIG_PLATFORM_SOLARIS + strip --remove-section=.comment $(TARGET) +endif # SOLARIS +endif # CONFIG_DEBUG +else # Win32 + +$(TARGET): $(OBJ) $(LIBS) + $(LD) $(LDFLAGS) ..\..\config\axtls.res /out:$@ $^ +endif + +endif # CONFIG_C_SAMPLES + +clean:: + -@rm -f ../../axssl* + diff --git a/samples/c/axssl.c b/samples/c/axssl.c new file mode 100644 index 0000000000..955340ca82 --- /dev/null +++ b/samples/c/axssl.c @@ -0,0 +1,862 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file axssl.c + * + * Demonstrate the use of the axTLS library in C with a set of + * command-line parameters similar to openssl. In fact, openssl clients + * should be able to communicate with axTLS servers and visa-versa. + * + * This code has various bits enabled depending on the configuration. To enable + * the most interesting version, compile with the 'full mode' enabled. + * + * To see what options you have, run the following: + * > axssl s_server -? + * > axssl s_client -? + * + * The axtls shared library must be in the same directory or be found + * by the OS. + */ +#include +#include +#include +#include "ssl.h" + +/* define standard input */ +#ifndef STDIN_FILENO +#define STDIN_FILENO 0 +#endif + +static void do_server(int argc, char *argv[]); +static void print_options(char *option); +static void print_server_options(char *option); +static void do_client(int argc, char *argv[]); +static void print_client_options(char *option); +static void display_cipher(SSL *ssl); +static void display_session_id(SSL *ssl); + +/** + * Main entry point. Doesn't do much except works out whether we are a client + * or a server. + */ +int main(int argc, char *argv[]) +{ +#ifdef WIN32 + WSADATA wsaData; + WORD wVersionRequested = MAKEWORD(2, 2); + WSAStartup(wVersionRequested, &wsaData); +#elif !defined(SOLARIS) + signal(SIGPIPE, SIG_IGN); /* ignore pipe errors */ +#endif + + if (argc < 2 || ( + strcmp(argv[1], "s_server") && strcmp(argv[1], "s_client"))) + { + print_options(argc > 1 ? argv[1] : ""); + } + + strcmp(argv[1], "s_server") ? + do_client(argc, argv) : do_server(argc, argv); + return 0; +} + +/** + * Implement the SSL server logic. + */ +static void do_server(int argc, char *argv[]) +{ + int i = 2; + uint16_t port = 4433; + uint32_t options = SSL_DISPLAY_CERTS; + int client_fd; + SSLCTX *ssl_ctx; + int server_fd, client_len, res = 0; +#ifndef CONFIG_SSL_SKELETON_MODE + char *private_key_file = NULL; + const char *password = NULL; + char **cert; + int cert_index = 0; + int cert_size = ssl_get_config(SSL_MAX_CERT_CFG_OFFSET); +#endif +#ifdef WIN32 + char yes = 1; +#else + int yes = 1; +#endif + struct sockaddr_in serv_addr; + struct sockaddr_in client_addr; + int quiet = 0; +#ifdef CONFIG_SSL_CERT_VERIFICATION + int ca_cert_index = 0; + int ca_cert_size = ssl_get_config(SSL_MAX_CA_CERT_CFG_OFFSET); + char **ca_cert = (char **)calloc(1, sizeof(char *)*ca_cert_size); +#endif + fd_set read_set; + +#ifndef CONFIG_SSL_SKELETON_MODE + cert = (char **)calloc(1, sizeof(char *)*cert_size); +#endif + + while (i < argc) + { + if (strcmp(argv[i], "-accept") == 0) + { + if (i >= argc-1) + { + print_server_options(argv[i]); + } + + port = atoi(argv[++i]); + } +#ifndef CONFIG_SSL_SKELETON_MODE + else if (strcmp(argv[i], "-cert") == 0) + { + if (i >= argc-1 || cert_index >= cert_size) + { + print_server_options(argv[i]); + } + + cert[cert_index++] = argv[++i]; + } + else if (strcmp(argv[i], "-key") == 0) + { + if (i >= argc-1) + { + print_server_options(argv[i]); + } + + private_key_file = argv[++i]; + options |= SSL_NO_DEFAULT_KEY; + } + else if (strcmp(argv[i], "-pass") == 0) + { + if (i >= argc-1) + { + print_server_options(argv[i]); + } + + password = argv[++i]; + } +#endif + else if (strcmp(argv[i], "-quiet") == 0) + { + quiet = 1; + options &= ~SSL_DISPLAY_CERTS; + } +#ifdef CONFIG_SSL_CERT_VERIFICATION + else if (strcmp(argv[i], "-verify") == 0) + { + options |= SSL_CLIENT_AUTHENTICATION; + } + else if (strcmp(argv[i], "-CAfile") == 0) + { + if (i >= argc-1 || ca_cert_index >= ca_cert_size) + { + print_server_options(argv[i]); + } + + ca_cert[ca_cert_index++] = argv[++i]; + } +#endif +#ifdef CONFIG_SSL_FULL_MODE + else if (strcmp(argv[i], "-debug") == 0) + { + options |= SSL_DISPLAY_BYTES; + } + else if (strcmp(argv[i], "-state") == 0) + { + options |= SSL_DISPLAY_STATES; + } + else if (strcmp(argv[i], "-show-rsa") == 0) + { + options |= SSL_DISPLAY_RSA; + } +#endif + else /* don't know what this is */ + { + print_server_options(argv[i]); + } + + i++; + } + + /* Create socket for incoming connections */ + if ((server_fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) + { + perror("socket"); + return; + } + + setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes)); + + /* Construct local address structure */ + memset(&serv_addr, 0, sizeof(serv_addr)); /* Zero out structure */ + serv_addr.sin_family = AF_INET; /* Internet address family */ + serv_addr.sin_addr.s_addr = htonl(INADDR_ANY); /* Any incoming interface */ + serv_addr.sin_port = htons(port); /* Local port */ + + /* Bind to the local address */ + if (bind(server_fd, (struct sockaddr *) &serv_addr, sizeof(serv_addr)) < 0) + { + perror("bind"); + exit(1); + } + + if (listen(server_fd, 5) < 0) + { + perror("listen"); + exit(1); + } + + client_len = sizeof(client_addr); + + /************************************************************************* + * This is where the interesting stuff happens. Up until now we've + * just been setting up sockets etc. Now we do the SSL handshake. + *************************************************************************/ + if ((ssl_ctx = ssl_ctx_new(options, SSL_DEFAULT_SVR_SESS)) == NULL) + { + fprintf(stderr, "Error: Server context is invalid\n"); + exit(1); + } + +#ifndef CONFIG_SSL_SKELETON_MODE + if (private_key_file) + { + int obj_type = SSL_OBJ_RSA_KEY; + + /* auto-detect the key type from the file extension */ + if (strstr(private_key_file, ".p8")) + obj_type = SSL_OBJ_PKCS8; + else if (strstr(private_key_file, ".p12")) + obj_type = SSL_OBJ_PKCS12; + + if (ssl_obj_load(ssl_ctx, obj_type, private_key_file, password)) + { + fprintf(stderr, "Error: Private key '%s' is undefined.\n", + private_key_file); + exit(1); + } + } + + for (i = 0; i < cert_index; i++) + { + if (ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CERT, cert[i], NULL)) + { + printf("Certificate '%s' is undefined.\n", cert[i]); + exit(1); + } + } +#endif + +#ifdef CONFIG_SSL_CERT_VERIFICATION + for (i = 0; i < ca_cert_index; i++) + { + if (ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CACERT, ca_cert[i], NULL)) + { + printf("Certificate '%s' is undefined.\n", ca_cert[i]); + exit(1); + } + } + + free(ca_cert); +#endif +#ifndef CONFIG_SSL_SKELETON_MODE + free(cert); +#endif + + for (;;) + { + SSL *ssl; + int reconnected = 0; + + if (!quiet) + { + printf("ACCEPT\n"); + TTY_FLUSH(); + } + + if ((client_fd = accept(server_fd, + (struct sockaddr *)&client_addr, &client_len)) < 0) + { + res = 1; + break; + } + + ssl = ssl_server_new(ssl_ctx, client_fd); + + /* now read (and display) whatever the client sends us */ + for (;;) + { + /* allow parallel reading of client and standard input */ + FD_ZERO(&read_set); + FD_SET(client_fd, &read_set); + +#ifndef WIN32 + /* win32 doesn't like mixing up stdin and sockets */ + if (isatty(STDIN_FILENO))/* but only if we are in an active shell */ + { + FD_SET(STDIN_FILENO, &read_set); + } + + if ((res = select(client_fd+1, &read_set, NULL, NULL, NULL)) > 0) + { + uint8_t buf[1024]; + + /* read standard input? */ + if (FD_ISSET(STDIN_FILENO, &read_set)) + { + if (fgets((char *)buf, sizeof(buf), stdin) == NULL) + { + res = SSL_ERROR_CONN_LOST; + } + else + { + /* small hack to check renegotiation */ + if (buf[0] == 'r' && (buf[1] == '\n' || buf[1] == '\r')) + { + res = ssl_renegotiate(ssl); + } + else /* write our ramblings to the client */ + { + res = ssl_write(ssl, buf, strlen((char *)buf)+1); + } + } + } + else /* a socket read */ +#endif + { + /* keep reading until we get something interesting */ + uint8_t *read_buf; + + if ((res = ssl_read(ssl, &read_buf)) == SSL_OK) + { + /* are we in the middle of doing a handshake? */ + if (ssl_handshake_status(ssl) != SSL_OK) + { + reconnected = 0; + } + else if (!reconnected) + { + /* we are connected/reconnected */ + if (!quiet) + { + display_session_id(ssl); + display_cipher(ssl); + } + + reconnected = 1; + } + } + + if (res > 0) /* display our interesting output */ + { + printf("%s", read_buf); + TTY_FLUSH(); + } + else if (res < 0 && !quiet) + { + ssl_display_error(res); + } + } +#ifndef WIN32 + } +#endif + + if (res < SSL_OK) + { + if (!quiet) + { + printf("CONNECTION CLOSED\n"); + TTY_FLUSH(); + } + + break; + } + } + + /* client was disconnected or the handshake failed. */ + ssl_free(ssl); + SOCKET_CLOSE(client_fd); + } + + ssl_ctx_free(ssl_ctx); +} + +/** + * Implement the SSL client logic. + */ +static void do_client(int argc, char *argv[]) +{ +#ifdef CONFIG_SSL_ENABLE_CLIENT + int res, i = 2; + uint16_t port = 4433; + uint32_t options = SSL_SERVER_VERIFY_LATER|SSL_DISPLAY_CERTS; + int client_fd; + char *private_key_file = NULL; + struct sockaddr_in client_addr; + struct hostent *hostent; + int reconnect = 0; + uint32_t sin_addr; + SSLCTX *ssl_ctx; + SSL *ssl = NULL; + int quiet = 0; + int cert_index = 0, ca_cert_index = 0; + int cert_size, ca_cert_size; + char **ca_cert, **cert; + uint8_t session_id[SSL_SESSION_ID_SIZE]; + fd_set read_set; + const char *password = NULL; + + FD_ZERO(&read_set); + sin_addr = inet_addr("127.0.0.1"); + cert_size = ssl_get_config(SSL_MAX_CERT_CFG_OFFSET); + ca_cert_size = ssl_get_config(SSL_MAX_CA_CERT_CFG_OFFSET); + ca_cert = (char **)calloc(1, sizeof(char *)*ca_cert_size); + cert = (char **)calloc(1, sizeof(char *)*cert_size); + + while (i < argc) + { + if (strcmp(argv[i], "-connect") == 0) + { + char *host, *ptr; + + if (i >= argc-1) + { + print_client_options(argv[i]); + } + + host = argv[++i]; + if ((ptr = strchr(host, ':')) == NULL) + { + print_client_options(argv[i]); + } + + *ptr++ = 0; + port = atoi(ptr); + hostent = gethostbyname(host); + + if (hostent == NULL) + { + print_client_options(argv[i]); + } + + sin_addr = *((uint32_t **)hostent->h_addr_list)[0]; + } + else if (strcmp(argv[i], "-cert") == 0) + { + if (i >= argc-1 || cert_index >= cert_size) + { + print_client_options(argv[i]); + } + + cert[cert_index++] = argv[++i]; + } + else if (strcmp(argv[i], "-key") == 0) + { + if (i >= argc-1) + { + print_client_options(argv[i]); + } + + private_key_file = argv[++i]; + options |= SSL_NO_DEFAULT_KEY; + } + else if (strcmp(argv[i], "-CAfile") == 0) + { + if (i >= argc-1 || ca_cert_index >= ca_cert_size) + { + print_client_options(argv[i]); + } + + ca_cert[ca_cert_index++] = argv[++i]; + } + else if (strcmp(argv[i], "-verify") == 0) + { + options &= ~SSL_SERVER_VERIFY_LATER; + } + else if (strcmp(argv[i], "-reconnect") == 0) + { + reconnect = 4; + } + else if (strcmp(argv[i], "-quiet") == 0) + { + quiet = 1; + options &= ~SSL_DISPLAY_CERTS; + } + else if (strcmp(argv[i], "-pass") == 0) + { + if (i >= argc-1) + { + print_client_options(argv[i]); + } + + password = argv[++i]; + } +#ifdef CONFIG_SSL_FULL_MODE + else if (strcmp(argv[i], "-debug") == 0) + { + options |= SSL_DISPLAY_BYTES; + } + else if (strcmp(argv[i], "-state") == 0) + { + options |= SSL_DISPLAY_STATES; + } + else if (strcmp(argv[i], "-show-rsa") == 0) + { + options |= SSL_DISPLAY_RSA; + } +#endif + else /* don't know what this is */ + { + print_client_options(argv[i]); + } + + i++; + } + + client_fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); + memset(&client_addr, 0, sizeof(client_addr)); + client_addr.sin_family = AF_INET; + client_addr.sin_port = htons(port); + client_addr.sin_addr.s_addr = sin_addr; + + if (connect(client_fd, (struct sockaddr *)&client_addr, + sizeof(client_addr)) < 0) + { + perror("connect"); + exit(1); + } + + if (!quiet) + { + printf("CONNECTED\n"); + TTY_FLUSH(); + } + + /************************************************************************* + * This is where the interesting stuff happens. Up until now we've + * just been setting up sockets etc. Now we do the SSL handshake. + *************************************************************************/ + if ((ssl_ctx = ssl_ctx_new(options, SSL_DEFAULT_CLNT_SESS)) == NULL) + { + fprintf(stderr, "Error: Client context is invalid\n"); + exit(1); + } + + if (private_key_file) + { + int obj_type = SSL_OBJ_RSA_KEY; + + /* auto-detect the key type from the file extension */ + if (strstr(private_key_file, ".p8")) + obj_type = SSL_OBJ_PKCS8; + else if (strstr(private_key_file, ".p12")) + obj_type = SSL_OBJ_PKCS12; + + if (ssl_obj_load(ssl_ctx, obj_type, private_key_file, password)) + { + fprintf(stderr, "Error: Private key '%s' is undefined.\n", + private_key_file); + exit(1); + } + } + + for (i = 0; i < cert_index; i++) + { + if (ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CERT, cert[i], NULL)) + { + printf("Certificate '%s' is undefined.\n", cert[i]); + exit(1); + } + } + + for (i = 0; i < ca_cert_index; i++) + { + if (ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CACERT, ca_cert[i], NULL)) + { + printf("Certificate '%s' is undefined.\n", ca_cert[i]); + exit(1); + } + } + + free(cert); + free(ca_cert); + + /* Try session resumption? */ + if (reconnect) + { + while (reconnect--) + { + ssl = ssl_client_new(ssl_ctx, client_fd, session_id); + if ((res = ssl_handshake_status(ssl)) != SSL_OK) + { + if (!quiet) + { + ssl_display_error(res); + } + + ssl_free(ssl); + exit(1); + } + + display_session_id(ssl); + memcpy(session_id, ssl_get_session_id(ssl), SSL_SESSION_ID_SIZE); + + if (reconnect) + { + ssl_free(ssl); + SOCKET_CLOSE(client_fd); + + client_fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); + connect(client_fd, (struct sockaddr *)&client_addr, + sizeof(client_addr)); + } + } + } + else + { + ssl = ssl_client_new(ssl_ctx, client_fd, NULL); + } + + /* check the return status */ + if ((res = ssl_handshake_status(ssl)) != SSL_OK) + { + if (!quiet) + { + ssl_display_error(res); + } + + exit(1); + } + + if (!quiet) + { + const char *common_name = ssl_get_cert_dn(ssl, + SSL_X509_CERT_COMMON_NAME); + if (common_name) + { + printf("Common Name:\t\t%s\n", common_name); + } + + display_session_id(ssl); + display_cipher(ssl); + } + + for (;;) + { + uint8_t buf[1024]; + res = SSL_OK; + + /* allow parallel reading of server and standard input */ + FD_SET(client_fd, &read_set); +#ifndef WIN32 + /* win32 doesn't like mixing up stdin and sockets */ + FD_SET(STDIN_FILENO, &read_set); + + if ((res = select(client_fd+1, &read_set, NULL, NULL, NULL)) > 0) + { + /* read standard input? */ + if (FD_ISSET(STDIN_FILENO, &read_set)) +#endif + { + if (fgets((char *)buf, sizeof(buf), stdin) == NULL) + { + /* bomb out of here */ + ssl_free(ssl); + break; + } + else + { + /* small hack to check renegotiation */ + if (buf[0] == 'R' && (buf[1] == '\n' || buf[1] == '\r')) + { + res = ssl_renegotiate(ssl); + } + else + { + res = ssl_write(ssl, buf, strlen((char *)buf)+1); + } + } + } +#ifndef WIN32 + else /* a socket read */ + { + uint8_t *read_buf; + + res = ssl_read(ssl, &read_buf); + + if (res > 0) /* display our interesting output */ + { + printf("%s", read_buf); + TTY_FLUSH(); + } + } + } +#endif + + if (res < 0) + { + if (!quiet) + { + ssl_display_error(res); + } + + break; /* get outta here */ + } + } + + ssl_ctx_free(ssl_ctx); + SOCKET_CLOSE(client_fd); +#else + print_client_options(argv[1]); +#endif +} + +/** + * We've had some sort of command-line error. Print out the basic options. + */ +static void print_options(char *option) +{ + printf("axssl: Error: '%s' is an invalid command.\n", option); + printf("usage: axssl [s_server|s_client] [args ...]\n"); + exit(1); +} + +/** + * We've had some sort of command-line error. Print out the server options. + */ +static void print_server_options(char *option) +{ +#ifndef CONFIG_SSL_SKELETON_MODE + int cert_size = ssl_get_config(SSL_MAX_CERT_CFG_OFFSET); +#endif +#ifdef CONFIG_SSL_CERT_VERIFICATION + int ca_cert_size = ssl_get_config(SSL_MAX_CA_CERT_CFG_OFFSET); +#endif + + printf("unknown option %s\n", option); + printf("usage: s_server [args ...]\n"); + printf(" -accept arg\t- port to accept on (default is 4433)\n"); +#ifndef CONFIG_SSL_SKELETON_MODE + printf(" -cert arg\t- certificate file to add (in addition to default)" + " to chain -\n" + "\t\t Can repeat up to %d times\n", cert_size); + printf(" -key arg\t- Private key file to use\n"); + printf(" -pass\t\t- private key file pass phrase source\n"); +#endif + printf(" -quiet\t\t- No server output\n"); +#ifdef CONFIG_SSL_CERT_VERIFICATION + printf(" -verify\t- turn on peer certificate verification\n"); + printf(" -CAfile arg\t- Certificate authority\n"); + printf("\t\t Can repeat up to %d times\n", ca_cert_size); +#endif +#ifdef CONFIG_SSL_FULL_MODE + printf(" -debug\t\t- Print more output\n"); + printf(" -state\t\t- Show state messages\n"); + printf(" -show-rsa\t- Show RSA state\n"); +#endif + exit(1); +} + +/** + * We've had some sort of command-line error. Print out the client options. + */ +static void print_client_options(char *option) +{ +#ifdef CONFIG_SSL_ENABLE_CLIENT + int cert_size = ssl_get_config(SSL_MAX_CERT_CFG_OFFSET); + int ca_cert_size = ssl_get_config(SSL_MAX_CA_CERT_CFG_OFFSET); +#endif + + printf("unknown option %s\n", option); +#ifdef CONFIG_SSL_ENABLE_CLIENT + printf("usage: s_client [args ...]\n"); + printf(" -connect host:port - who to connect to (default " + "is localhost:4433)\n"); + printf(" -verify\t- turn on peer certificate verification\n"); + printf(" -cert arg\t- certificate file to use\n"); + printf("\t\t Can repeat up to %d times\n", cert_size); + printf(" -key arg\t- Private key file to use\n"); + printf(" -CAfile arg\t- Certificate authority\n"); + printf("\t\t Can repeat up to %d times\n", ca_cert_size); + printf(" -quiet\t\t- No client output\n"); + printf(" -reconnect\t- Drop and re-make the connection " + "with the same Session-ID\n"); + printf(" -pass\t\t- private key file pass phrase source\n"); +#ifdef CONFIG_SSL_FULL_MODE + printf(" -debug\t\t- Print more output\n"); + printf(" -state\t\t- Show state messages\n"); + printf(" -show-rsa\t- Show RSA state\n"); +#endif +#else + printf("Change configuration to allow this feature\n"); +#endif + exit(1); +} + +/** + * Display what cipher we are using + */ +static void display_cipher(SSL *ssl) +{ + printf("CIPHER is "); + switch (ssl_get_cipher_id(ssl)) + { + case SSL_AES128_SHA: + printf("AES128-SHA"); + break; + + case SSL_AES256_SHA: + printf("AES256-SHA"); + break; + + case SSL_RC4_128_SHA: + printf("RC4-SHA"); + break; + + case SSL_RC4_128_MD5: + printf("RC4-MD5"); + break; + + default: + printf("Unknown - %d", ssl_get_cipher_id(ssl)); + break; + } + + printf("\n"); + TTY_FLUSH(); +} + +/** + * Display what session id we have. + */ +static void display_session_id(SSL *ssl) +{ + int i; + const uint8_t *session_id = ssl_get_session_id(ssl); + + printf("-----BEGIN SSL SESSION PARAMETERS-----\n"); + for (i = 0; i < SSL_SESSION_ID_SIZE; i++) + { + printf("%02x", session_id[i]); + } + printf("\n-----END SSL SESSION PARAMETERS-----\n"); + TTY_FLUSH(); +} diff --git a/samples/csharp/Makefile b/samples/csharp/Makefile new file mode 100644 index 0000000000..8e299fd749 --- /dev/null +++ b/samples/csharp/Makefile @@ -0,0 +1,36 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +include ../../config/.config +include ../../config/makefile.conf +include ../../config/makefile.dotnet.conf + +all : sample +TARGET=../../axssl.csharp.exe +sample : $(TARGET) + +$(TARGET): ../../bindings/csharp/axTLS.cs ../../bindings/csharp/axInterface.cs axssl.cs +ifdef GO_DOT_NET + csc.exe /nologo /t:exe /out:"`cygpath -w $@`" $(foreach file, $^, "`cygpath -w $(file)`") +else # use mono to build + mcs -out:$@ $^ + +endif # ARCH + +clean:: + -@rm -f $(TARGET) diff --git a/samples/csharp/axssl.cs b/samples/csharp/axssl.cs new file mode 100644 index 0000000000..ca8281d654 --- /dev/null +++ b/samples/csharp/axssl.cs @@ -0,0 +1,744 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * axssl.cs + * + * Demonstrate the use of the axTLS library in C# with a set of + * command-line parameters similar to openssl. In fact, openssl clients + * should be able to communicate with axTLS servers and visa-versa. + * + * This code has various bits enabled depending on the configuration. To enable + * the most interesting version, compile with the 'full mode' enabled. + * + * To see what options you have, run the following: + * > axssl.csharp.exe s_server -? + * > axssl.csharp.exe s_client -? + * + * The axtls shared library must be in the same directory or be found + * by the OS. + */ + +using System; +using System.Net; +using System.Net.Sockets; +using axTLS; + +public class axssl +{ + /* + * Main() + */ + public static void Main(string[] args) + { + axssl runner = new axssl(); + + if (args.Length < 1 || (args[0] != "s_server" && args[0] != "s_client")) + { + runner.print_options(args.Length > 0 ? args[0] : ""); + } + + int build_mode = SSLUtil.BuildMode(); + + if (args[0] == "s_server") + { + runner.do_server(build_mode, args); + } + else + { + runner.do_client(build_mode, args); + } + } + + /* + * do_server() + */ + private void do_server(int build_mode, string[] args) + { + int i = 1; + int port = 4433; + uint options = axtls.SSL_DISPLAY_CERTS; + bool quiet = false; + string password = null; + string private_key_file = null; + + /* organise the cert/ca_cert lists */ + int cert_size = SSLUtil.MaxCerts(); + int ca_cert_size = SSLUtil.MaxCACerts(); + string[] cert = new string[cert_size]; + string[] ca_cert = new string[ca_cert_size]; + int cert_index = 0; + int ca_cert_index = 0; + + while (i < args.Length) + { + if (args[i] == "-accept") + { + if (i >= args.Length-1) + { + print_server_options(build_mode, args[i]); + } + + port = Int32.Parse(args[++i]); + } + else if (args[i] == "-quiet") + { + quiet = true; + options &= ~(uint)axtls.SSL_DISPLAY_CERTS; + } + else if (build_mode >= axtls.SSL_BUILD_SERVER_ONLY) + { + if (args[i] == "-cert") + { + if (i >= args.Length-1 || cert_index >= cert_size) + { + print_server_options(build_mode, args[i]); + } + + cert[cert_index++] = args[++i]; + } + else if (args[i] == "-key") + { + if (i >= args.Length-1) + { + print_server_options(build_mode, args[i]); + } + + private_key_file = args[++i]; + options |= axtls.SSL_NO_DEFAULT_KEY; + } + else if (args[i] == "-pass") + { + if (i >= args.Length-1) + { + print_server_options(build_mode, args[i]); + } + + password = args[++i]; + } + else if (build_mode >= axtls.SSL_BUILD_ENABLE_VERIFICATION) + { + if (args[i] == "-verify") + { + options |= axtls.SSL_CLIENT_AUTHENTICATION; + } + else if (args[i] == "-CAfile") + { + if (i >= args.Length-1 || ca_cert_index >= ca_cert_size) + { + print_server_options(build_mode, args[i]); + } + + ca_cert[ca_cert_index++] = args[++i]; + } + else if (build_mode == axtls.SSL_BUILD_FULL_MODE) + { + if (args[i] == "-debug") + { + options |= axtls.SSL_DISPLAY_BYTES; + } + else if (args[i] == "-state") + { + options |= axtls.SSL_DISPLAY_STATES; + } + else if (args[i] == "-show-rsa") + { + options |= axtls.SSL_DISPLAY_RSA; + } + else + print_server_options(build_mode, args[i]); + } + else + print_server_options(build_mode, args[i]); + } + else + print_server_options(build_mode, args[i]); + } + else + print_server_options(build_mode, args[i]); + + i++; + } + + /* Create socket for incoming connections */ + IPEndPoint ep = new IPEndPoint(IPAddress.Any, port); + TcpListener server_sock = new TcpListener(ep); + server_sock.Start(); + + /********************************************************************** + * This is where the interesting stuff happens. Up until now we've + * just been setting up sockets etc. Now we do the SSL handshake. + **********************************************************************/ + SSLServer ssl_ctx = new SSLServer( + options, axtls.SSL_DEFAULT_SVR_SESS); + + if (ssl_ctx == null) + { + Console.Error.WriteLine("Error: Server context is invalid"); + Environment.Exit(1); + } + + if (private_key_file != null) + { + int obj_type = axtls.SSL_OBJ_RSA_KEY; + + if (private_key_file.EndsWith(".p8")) + obj_type = axtls.SSL_OBJ_PKCS8; + else if (private_key_file.EndsWith(".p12")) + obj_type = axtls.SSL_OBJ_PKCS12; + + if (ssl_ctx.ObjLoad(obj_type, + private_key_file, password) != axtls.SSL_OK) + { + Console.Error.WriteLine("Private key '" + private_key_file + + "' is undefined."); + Environment.Exit(1); + } + } + + for (i = 0; i < cert_index; i++) + { + if (ssl_ctx.ObjLoad(axtls.SSL_OBJ_X509_CERT, + cert[i], null) != axtls.SSL_OK) + { + Console.WriteLine("Certificate '" + cert[i] + + "' is undefined."); + Environment.Exit(1); + } + } + + for (i = 0; i < ca_cert_index; i++) + { + if (ssl_ctx.ObjLoad(axtls.SSL_OBJ_X509_CACERT, + ca_cert[i], null) != axtls.SSL_OK) + { + Console.WriteLine("Certificate '" + cert[i] + + "' is undefined."); + Environment.Exit(1); + } + } + + byte[] buf = null; + int res; + + for (;;) + { + if (!quiet) + { + Console.WriteLine("ACCEPT"); + } + + Socket client_sock = server_sock.AcceptSocket(); + + SSL ssl = ssl_ctx.Connect(client_sock); + + /* do the actual SSL handshake */ + while ((res = ssl_ctx.Read(ssl, out buf)) == axtls.SSL_OK) + { + /* check when the connection has been established */ + if (ssl.HandshakeStatus() == axtls.SSL_OK) + break; + + /* could do something else here */ + } + + if (res == axtls.SSL_OK) /* connection established and ok */ + { + if (!quiet) + { + display_session_id(ssl); + display_cipher(ssl); + } + + /* now read (and display) whatever the client sends us */ + for (;;) + { + /* keep reading until we get something interesting */ + while ((res = ssl_ctx.Read(ssl, out buf)) == axtls.SSL_OK) + { + /* could do something else here */ + } + + if (res < axtls.SSL_OK) + { + if (!quiet) + { + Console.WriteLine("CONNECTION CLOSED"); + } + + break; + } + + /* convert to string */ + char[] str = new char[res]; + for (i = 0; i < res; i++) + { + str[i] = (char)buf[i]; + } + + Console.Write(str); + } + } + else if (!quiet) + { + SSLUtil.DisplayError(res); + } + + /* client was disconnected or the handshake failed. */ + ssl.Dispose(); + client_sock.Close(); + } + + /* ssl_ctx.Dispose(); */ + } + + /* + * do_client() + */ + private void do_client(int build_mode, string[] args) + { + if (build_mode < axtls.SSL_BUILD_ENABLE_CLIENT) + { + print_client_options(build_mode, args[1]); + } + + int i = 1, res; + int port = 4433; + bool quiet = false; + string password = null; + int reconnect = 0; + string private_key_file = null; + string hostname = "127.0.0.1"; + + /* organise the cert/ca_cert lists */ + int cert_index = 0; + int ca_cert_index = 0; + int cert_size = SSLUtil.MaxCerts(); + int ca_cert_size = SSLUtil.MaxCACerts(); + string[] cert = new string[cert_size]; + string[] ca_cert = new string[ca_cert_size]; + + uint options = axtls.SSL_SERVER_VERIFY_LATER|axtls.SSL_DISPLAY_CERTS; + byte[] session_id = null; + + while (i < args.Length) + { + if (args[i] == "-connect") + { + string host_port; + + if (i >= args.Length-1) + { + print_client_options(build_mode, args[i]); + } + + host_port = args[++i]; + int index_colon; + + if ((index_colon = host_port.IndexOf(':')) < 0) + print_client_options(build_mode, args[i]); + + hostname = new string(host_port.ToCharArray(), + 0, index_colon); + port = Int32.Parse(new String(host_port.ToCharArray(), + index_colon+1, host_port.Length-index_colon-1)); + } + else if (args[i] == "-cert") + { + if (i >= args.Length-1 || cert_index >= cert_size) + { + print_client_options(build_mode, args[i]); + } + + cert[cert_index++] = args[++i]; + } + else if (args[i] == "-key") + { + if (i >= args.Length-1) + { + print_client_options(build_mode, args[i]); + } + + private_key_file = args[++i]; + options |= axtls.SSL_NO_DEFAULT_KEY; + } + else if (args[i] == "-CAfile") + { + if (i >= args.Length-1 || ca_cert_index >= ca_cert_size) + { + print_client_options(build_mode, args[i]); + } + + ca_cert[ca_cert_index++] = args[++i]; + } + else if (args[i] == "-verify") + { + options &= ~(uint)axtls.SSL_SERVER_VERIFY_LATER; + } + else if (args[i] == "-reconnect") + { + reconnect = 4; + } + else if (args[i] == "-quiet") + { + quiet = true; + options &= ~(uint)axtls.SSL_DISPLAY_CERTS; + } + else if (args[i] == "-pass") + { + if (i >= args.Length-1) + { + print_client_options(build_mode, args[i]); + } + + password = args[++i]; + } + else if (build_mode == axtls.SSL_BUILD_FULL_MODE) + { + if (args[i] == "-debug") + { + options |= axtls.SSL_DISPLAY_BYTES; + } + else if (args[i] == "-state") + { + options |= axtls.SSL_DISPLAY_STATES; + } + else if (args[i] == "-show-rsa") + { + options |= axtls.SSL_DISPLAY_RSA; + } + else + print_client_options(build_mode, args[i]); + } + else /* don't know what this is */ + print_client_options(build_mode, args[i]); + + i++; + } + + // IPHostEntry hostInfo = Dns.Resolve(hostname); + IPHostEntry hostInfo = Dns.GetHostEntry(hostname); + IPAddress[] addresses = hostInfo.AddressList; + IPEndPoint ep = new IPEndPoint(addresses[0], port); + Socket client_sock = new Socket(AddressFamily.InterNetwork, + SocketType.Stream, ProtocolType.Tcp); + client_sock.Connect(ep); + + if (!client_sock.Connected) + { + Console.WriteLine("could not connect"); + Environment.Exit(1); + } + + if (!quiet) + { + Console.WriteLine("CONNECTED"); + } + + /********************************************************************** + * This is where the interesting stuff happens. Up until now we've + * just been setting up sockets etc. Now we do the SSL handshake. + **********************************************************************/ + SSLClient ssl_ctx = new SSLClient(options, + axtls.SSL_DEFAULT_CLNT_SESS); + + if (ssl_ctx == null) + { + Console.Error.WriteLine("Error: Client context is invalid"); + Environment.Exit(1); + } + + if (private_key_file != null) + { + int obj_type = axtls.SSL_OBJ_RSA_KEY; + + if (private_key_file.EndsWith(".p8")) + obj_type = axtls.SSL_OBJ_PKCS8; + else if (private_key_file.EndsWith(".p12")) + obj_type = axtls.SSL_OBJ_PKCS12; + + if (ssl_ctx.ObjLoad(obj_type, + private_key_file, password) != axtls.SSL_OK) + { + Console.Error.WriteLine("Private key '" + private_key_file + + "' is undefined."); + Environment.Exit(1); + } + } + + for (i = 0; i < cert_index; i++) + { + if (ssl_ctx.ObjLoad(axtls.SSL_OBJ_X509_CERT, + cert[i], null) != axtls.SSL_OK) + { + Console.WriteLine("Certificate '" + cert[i] + + "' is undefined."); + Environment.Exit(1); + } + } + + for (i = 0; i < ca_cert_index; i++) + { + if (ssl_ctx.ObjLoad(axtls.SSL_OBJ_X509_CACERT, + ca_cert[i], null) != axtls.SSL_OK) + { + Console.WriteLine("Certificate '" + cert[i] + + "' is undefined."); + Environment.Exit(1); + } + } + + SSL ssl = new SSL(new IntPtr(0)); /* keep compiler happy */ + + /* Try session resumption? */ + if (reconnect > 0) + { + while (reconnect-- > 0) + { + ssl = ssl_ctx.Connect(client_sock, session_id); + + if ((res = ssl.HandshakeStatus()) != axtls.SSL_OK) + { + if (!quiet) + { + SSLUtil.DisplayError(res); + } + + ssl.Dispose(); + Environment.Exit(1); + } + + display_session_id(ssl); + session_id = ssl.GetSessionId(); + + if (reconnect > 0) + { + ssl.Dispose(); + client_sock.Close(); + + /* and reconnect */ + client_sock = new Socket(AddressFamily.InterNetwork, + SocketType.Stream, ProtocolType.Tcp); + client_sock.Connect(ep); + } + } + } + else + { + ssl = ssl_ctx.Connect(client_sock, null); + } + + /* check the return status */ + if ((res = ssl.HandshakeStatus()) != axtls.SSL_OK) + { + if (!quiet) + { + SSLUtil.DisplayError(res); + } + + Environment.Exit(1); + } + + if (!quiet) + { + string common_name = + ssl.GetCertificateDN(axtls.SSL_X509_CERT_COMMON_NAME); + + if (common_name != null) + { + Console.WriteLine("Common Name:\t\t" + common_name); + } + + display_session_id(ssl); + display_cipher(ssl); + } + + for (;;) + { + string user_input = Console.ReadLine(); + + if (user_input == null) + break; + + byte[] buf = new byte[user_input.Length+2]; + buf[buf.Length-2] = (byte)'\n'; /* add the carriage return */ + buf[buf.Length-1] = 0; /* null terminate */ + + for (i = 0; i < buf.Length-2; i++) + { + buf[i] = (byte)user_input[i]; + } + + if ((res = ssl_ctx.Write(ssl, buf, buf.Length)) < axtls.SSL_OK) + { + if (!quiet) + { + SSLUtil.DisplayError(res); + } + + break; + } + } + + ssl_ctx.Dispose(); + } + + /** + * We've had some sort of command-line error. Print out the basic options. + */ + private void print_options(string option) + { + Console.WriteLine("axssl: Error: '" + option + + "' is an invalid command."); + Console.WriteLine("usage: axssl.cs.exe [s_server|s_client] [args ...]"); + Environment.Exit(1); + } + + /** + * We've had some sort of command-line error. Print out the server options. + */ + private void print_server_options(int build_mode, string option) + { + int cert_size = SSLUtil.MaxCerts(); + int ca_cert_size = SSLUtil.MaxCACerts(); + + Console.WriteLine("unknown option " + option); + Console.WriteLine("usage: s_server [args ...]"); + Console.WriteLine(" -accept arg\t- port to accept on (default " + + "is 4433)"); + Console.WriteLine(" -quiet\t\t- No server output"); + + if (build_mode >= axtls.SSL_BUILD_SERVER_ONLY) + { + Console.WriteLine(" -cert arg\t- certificate file to add (in " + + "addition to default) to chain -"); + Console.WriteLine("\t\t Can repeat up to " + cert_size + " times"); + Console.WriteLine(" -key arg\t- Private key file to use"); + Console.WriteLine(" -pass\t\t- private key file pass phrase source"); + } + + if (build_mode >= axtls.SSL_BUILD_ENABLE_VERIFICATION) + { + Console.WriteLine(" -verify\t- turn on peer certificate " + + "verification"); + Console.WriteLine(" -CAfile arg\t- Certificate authority."); + Console.WriteLine("\t\t Can repeat up to " + + ca_cert_size + "times"); + } + + if (build_mode == axtls.SSL_BUILD_FULL_MODE) + { + Console.WriteLine(" -debug\t\t- Print more output"); + Console.WriteLine(" -state\t\t- Show state messages"); + Console.WriteLine(" -show-rsa\t- Show RSA state"); + } + + Environment.Exit(1); + } + + /** + * We've had some sort of command-line error. Print out the client options. + */ + private void print_client_options(int build_mode, string option) + { + int cert_size = SSLUtil.MaxCerts(); + int ca_cert_size = SSLUtil.MaxCACerts(); + + Console.WriteLine("unknown option " + option); + + if (build_mode >= axtls.SSL_BUILD_ENABLE_CLIENT) + { + Console.WriteLine("usage: s_client [args ...]"); + Console.WriteLine(" -connect host:port - who to connect to " + + "(default is localhost:4433)"); + Console.WriteLine(" -verify\t- turn on peer certificate " + + "verification"); + Console.WriteLine(" -cert arg\t- certificate file to use"); + Console.WriteLine("\t\t Can repeat up to %d times", cert_size); + Console.WriteLine(" -key arg\t- Private key file to use"); + Console.WriteLine(" -CAfile arg\t- Certificate authority."); + Console.WriteLine("\t\t Can repeat up to " + ca_cert_size + + " times"); + Console.WriteLine(" -quiet\t\t- No client output"); + Console.WriteLine(" -pass\t\t- private key file pass " + + "phrase source"); + Console.WriteLine(" -reconnect\t- Drop and re-make the " + + "connection with the same Session-ID"); + + if (build_mode == axtls.SSL_BUILD_FULL_MODE) + { + Console.WriteLine(" -debug\t\t- Print more output"); + Console.WriteLine(" -state\t\t- Show state messages"); + Console.WriteLine(" -show-rsa\t- Show RSA state"); + } + } + else + { + Console.WriteLine("Change configuration to allow this feature"); + } + + Environment.Exit(1); + } + + /** + * Display what cipher we are using + */ + private void display_cipher(SSL ssl) + { + Console.Write("CIPHER is "); + + switch (ssl.GetCipherId()) + { + case axtls.SSL_AES128_SHA: + Console.WriteLine("AES128-SHA"); + break; + + case axtls.SSL_AES256_SHA: + Console.WriteLine("AES256-SHA"); + break; + + case axtls.SSL_RC4_128_SHA: + Console.WriteLine("RC4-SHA"); + break; + + case axtls.SSL_RC4_128_MD5: + Console.WriteLine("RC4-MD5"); + break; + + default: + Console.WriteLine("Unknown - " + ssl.GetCipherId()); + break; + } + } + + /** + * Display what session id we have. + */ + private void display_session_id(SSL ssl) + { + byte[] session_id = ssl.GetSessionId(); + + Console.WriteLine("-----BEGIN SSL SESSION PARAMETERS-----"); + foreach (byte b in session_id) + { + Console.Write("{0:x02}", b); + } + + Console.WriteLine("\n-----END SSL SESSION PARAMETERS-----"); + } +} diff --git a/samples/java/Makefile b/samples/java/Makefile new file mode 100644 index 0000000000..0bedf52218 --- /dev/null +++ b/samples/java/Makefile @@ -0,0 +1,39 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +include ../../config/.config +include ../../config/makefile.conf +include ../../config/makefile.java.conf + +all : sample +JAR=../../axtls.jar +CLASSES=../../bindings/java/classes +sample : $(JAR) + +$(JAR) : $(CLASSES)/axssl.class $(wildcard $(CLASSES)/axTLSj/*.class) + jar mcvf manifest.mf $@ -C $(CLASSES) . + +JAVA_FILES= axssl.java +JAVA_CLASSES:=$(JAVA_FILES:%.java=$(CLASSES)/axTLSj/%.class) + +$(CLASSES)/%.class : %.java + javac -d $(CLASSES) -classpath $(CLASSES) $^ + +clean:: + -@rm -f $(TARGET) + diff --git a/samples/java/axssl.java b/samples/java/axssl.java new file mode 100644 index 0000000000..b193725ef0 --- /dev/null +++ b/samples/java/axssl.java @@ -0,0 +1,760 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/* + * axssl.java + * + * Demonstrate the use of the axTLS library in Java with a set of + * command-line parameters similar to openssl. In fact, openssl clients + * should be able to communicate with axTLS servers and visa-versa. * + * This code has various bits enabled depending on the configuration. To enable + * the most interesting version, compile with the 'full mode' enabled. + * + * To see what options you have, run the following: + * > java -jar axtls.jar s_server -? + * > java -jar axtls.jar s_client -? + * + * The axtls/axtlsj shared libraries must be in the same directory or be found + * by the OS. + */ + +import java.io.*; +import java.util.*; +import java.net.*; +import axTLSj.*; + +public class axssl +{ + /* + * Main() + */ + public static void main(String[] args) + { + axssl runner = new axssl(); + + try + { + if (args.length < 1 || + (!args[0].equals("s_server") && + !args[0].equals("s_client"))) + { + runner.print_options(args.length > 0 ? args[0] : ""); + } + + int build_mode = SSLUtil.buildMode(); + + if (args[0].equals("s_server")) + { + runner.do_server(build_mode, args); + } + else + { + runner.do_client(build_mode, args); + } + } + catch (Exception e) + { + System.out.println(e); + } + } + + /* + * do_server() + */ + private void do_server(int build_mode, String[] args) + throws Exception + { + int i = 1; + int port = 4433; + int options = axtlsj.SSL_DISPLAY_CERTS; + boolean quiet = false; + String password = null; + String private_key_file = null; + + /* organise the cert/ca_cert lists */ + int cert_size = SSLUtil.maxCerts(); + int ca_cert_size = SSLUtil.maxCACerts(); + String[] cert = new String[cert_size]; + String[] ca_cert = new String[ca_cert_size]; + int cert_index = 0; + int ca_cert_index = 0; + + while (i < args.length) + { + if (args[i].equals("-accept")) + { + if (i >= args.length-1) + { + print_server_options(build_mode, args[i]); + } + + port = Integer.parseInt(args[++i]); + } + else if (args[i].equals("-quiet")) + { + quiet = true; + options &= ~(int)axtlsj.SSL_DISPLAY_CERTS; + } + else if (build_mode >= axtlsj.SSL_BUILD_SERVER_ONLY) + { + if (args[i].equals("-cert")) + { + if (i >= args.length-1 || cert_index >= cert_size) + { + print_server_options(build_mode, args[i]); + } + + cert[cert_index++] = args[++i]; + } + else if (args[i].equals("-key")) + { + if (i >= args.length-1) + { + print_server_options(build_mode, args[i]); + } + + private_key_file = args[++i]; + options |= axtlsj.SSL_NO_DEFAULT_KEY; + } + else if (args[i].equals("-pass")) + { + if (i >= args.length-1) + { + print_server_options(build_mode, args[i]); + } + + password = args[++i]; + } + else if (build_mode >= axtlsj.SSL_BUILD_ENABLE_VERIFICATION) + { + if (args[i].equals("-verify")) + { + options |= axtlsj.SSL_CLIENT_AUTHENTICATION; + } + else if (args[i].equals("-CAfile")) + { + if (i >= args.length-1 || ca_cert_index >= ca_cert_size) + { + print_server_options(build_mode, args[i]); + } + + ca_cert[ca_cert_index++] = args[++i]; + } + else if (build_mode == axtlsj.SSL_BUILD_FULL_MODE) + { + if (args[i].equals("-debug")) + { + options |= axtlsj.SSL_DISPLAY_BYTES; + } + else if (args[i].equals("-state")) + { + options |= axtlsj.SSL_DISPLAY_STATES; + } + else if (args[i].equals("-show-rsa")) + { + options |= axtlsj.SSL_DISPLAY_RSA; + } + else + print_server_options(build_mode, args[i]); + } + else + print_server_options(build_mode, args[i]); + } + else + print_server_options(build_mode, args[i]); + } + else + print_server_options(build_mode, args[i]); + + i++; + } + + /* Create socket for incoming connections */ + ServerSocket server_sock = new ServerSocket(port); + + /********************************************************************** + * This is where the interesting stuff happens. Up until now we've + * just been setting up sockets etc. Now we do the SSL handshake. + **********************************************************************/ + SSLServer ssl_ctx = new SSLServer(options, + axtlsj.SSL_DEFAULT_SVR_SESS); + + if (ssl_ctx == null) + { + throw new Exception("Error: Server context is invalid"); + } + + if (private_key_file != null) + { + int obj_type = axtlsj.SSL_OBJ_RSA_KEY; + + if (private_key_file.endsWith(".p8")) + obj_type = axtlsj.SSL_OBJ_PKCS8; + else if (private_key_file.endsWith(".p12")) + obj_type = axtlsj.SSL_OBJ_PKCS12; + + if (ssl_ctx.objLoad(obj_type, + private_key_file, password) != axtlsj.SSL_OK) + { + throw new Exception("Error: Private key '" + private_key_file + + "' is undefined."); + } + } + + for (i = 0; i < cert_index; i++) + { + if (ssl_ctx.objLoad(axtlsj.SSL_OBJ_X509_CERT, + cert[i], null) != axtlsj.SSL_OK) + { + throw new Exception("Certificate '" + cert[i] + + "' is undefined."); + } + } + + for (i = 0; i < ca_cert_index; i++) + { + if (ssl_ctx.objLoad(axtlsj.SSL_OBJ_X509_CACERT, + ca_cert[i], null) != axtlsj.SSL_OK) + { + throw new Exception("Certificate '" + ca_cert[i] + + "' is undefined."); + } + } + + int res; + SSLReadHolder rh = new SSLReadHolder(); + + for (;;) + { + if (!quiet) + { + System.out.println("ACCEPT"); + } + + Socket client_sock = server_sock.accept(); + + SSL ssl = ssl_ctx.connect(client_sock); + + while ((res = ssl_ctx.read(ssl, rh)) == axtlsj.SSL_OK) + { + /* check when the connection has been established */ + if (ssl.handshakeStatus() == axtlsj.SSL_OK) + break; + + /* could do something else here */ + } + + if (res == axtlsj.SSL_OK) /* connection established and ok */ + { + if (!quiet) + { + display_session_id(ssl); + display_cipher(ssl); + } + + /* now read (and display) whatever the client sends us */ + for (;;) + { + /* keep reading until we get something interesting */ + while ((res = ssl_ctx.read(ssl, rh)) == axtlsj.SSL_OK) + { + /* could do something else here */ + } + + if (res < axtlsj.SSL_OK) + { + if (!quiet) + { + System.out.println("CONNECTION CLOSED"); + } + + break; + } + + /* convert to String */ + byte[] buf = rh.getData(); + char[] str = new char[res]; + + for (i = 0; i < res; i++) + { + str[i] = (char)buf[i]; + } + + System.out.print(str); + } + } + else if (!quiet) + { + SSLUtil.displayError(res); + } + + /* client was disconnected or the handshake failed. */ + ssl.dispose(); + client_sock.close(); + } + + /* ssl_ctx.dispose(); */ + } + + /* + * do_client() + */ + private void do_client(int build_mode, String[] args) + throws Exception + { + if (build_mode < axtlsj.SSL_BUILD_ENABLE_CLIENT) + { + print_client_options(build_mode, args[1]); + } + + int i = 1, res; + int port = 4433; + boolean quiet = false; + String password = null; + int reconnect = 0; + String private_key_file = null; + String hostname = "127.0.0.1"; + + /* organise the cert/ca_cert lists */ + int cert_index = 0; + int ca_cert_index = 0; + int cert_size = SSLUtil.maxCerts(); + int ca_cert_size = SSLUtil.maxCACerts(); + String[] cert = new String[cert_size]; + String[] ca_cert = new String[ca_cert_size]; + + int options = axtlsj.SSL_SERVER_VERIFY_LATER|axtlsj.SSL_DISPLAY_CERTS; + byte[] session_id = null; + + while (i < args.length) + { + if (args[i].equals("-connect")) + { + String host_port; + + if (i >= args.length-1) + { + print_client_options(build_mode, args[i]); + } + + host_port = args[++i]; + int index_colon; + + if ((index_colon = host_port.indexOf(':')) < 0) + print_client_options(build_mode, args[i]); + + hostname = new String(host_port.toCharArray(), + 0, index_colon); + port = Integer.parseInt(new String(host_port.toCharArray(), + index_colon+1, host_port.length()-index_colon-1)); + } + else if (args[i].equals("-cert")) + { + if (i >= args.length-1 || cert_index >= cert_size) + { + print_client_options(build_mode, args[i]); + } + + cert[cert_index++] = args[++i]; + } + else if (args[i].equals("-CAfile")) + { + if (i >= args.length-1 || ca_cert_index >= ca_cert_size) + { + print_client_options(build_mode, args[i]); + } + + ca_cert[ca_cert_index++] = args[++i]; + } + else if (args[i].equals("-key")) + { + if (i >= args.length-1) + { + print_client_options(build_mode, args[i]); + } + + private_key_file = args[++i]; + options |= axtlsj.SSL_NO_DEFAULT_KEY; + } + else if (args[i].equals("-verify")) + { + options &= ~(int)axtlsj.SSL_SERVER_VERIFY_LATER; + } + else if (args[i].equals("-reconnect")) + { + reconnect = 4; + } + else if (args[i].equals("-quiet")) + { + quiet = true; + options &= ~(int)axtlsj.SSL_DISPLAY_CERTS; + } + else if (args[i].equals("-pass")) + { + if (i >= args.length-1) + { + print_server_options(build_mode, args[i]); + } + + password = args[++i]; + } + else if (build_mode == axtlsj.SSL_BUILD_FULL_MODE) + { + if (args[i].equals("-debug")) + { + options |= axtlsj.SSL_DISPLAY_BYTES; + } + else if (args[i].equals("-state")) + { + options |= axtlsj.SSL_DISPLAY_STATES; + } + else if (args[i].equals("-show-rsa")) + { + options |= axtlsj.SSL_DISPLAY_RSA; + } + else + print_client_options(build_mode, args[i]); + } + else /* don't know what this is */ + print_client_options(build_mode, args[i]); + + i++; + } + + Socket client_sock = new Socket(hostname, port); + + if (!client_sock.isConnected()) + { + System.out.println("could not connect"); + throw new Exception(); + } + + if (!quiet) + { + System.out.println("CONNECTED"); + } + + /********************************************************************** + * This is where the interesting stuff happens. Up until now we've + * just been setting up sockets etc. Now we do the SSL handshake. + **********************************************************************/ + SSLClient ssl_ctx = new SSLClient(options, + axtlsj.SSL_DEFAULT_CLNT_SESS); + + if (ssl_ctx == null) + { + throw new Exception("Error: Client context is invalid"); + } + + if (private_key_file != null) + { + int obj_type = axtlsj.SSL_OBJ_RSA_KEY; + + if (private_key_file.endsWith(".p8")) + obj_type = axtlsj.SSL_OBJ_PKCS8; + else if (private_key_file.endsWith(".p12")) + obj_type = axtlsj.SSL_OBJ_PKCS12; + + if (ssl_ctx.objLoad(obj_type, + private_key_file, password) != axtlsj.SSL_OK) + { + throw new Exception("Error: Private key '" + private_key_file + + "' is undefined."); + } + } + + for (i = 0; i < cert_index; i++) + { + if (ssl_ctx.objLoad(axtlsj.SSL_OBJ_X509_CERT, + cert[i], null) != axtlsj.SSL_OK) + { + throw new Exception("Certificate '" + cert[i] + + "' is undefined."); + } + } + + for (i = 0; i < ca_cert_index; i++) + { + if (ssl_ctx.objLoad(axtlsj.SSL_OBJ_X509_CACERT, + ca_cert[i], null) != axtlsj.SSL_OK) + { + throw new Exception("Certificate '" + ca_cert[i] + + "' is undefined."); + } + } + + SSL ssl = null; + + /* Try session resumption? */ + if (reconnect > 0) + { + while (reconnect-- > 0) + { + ssl = ssl_ctx.connect(client_sock, session_id); + + if ((res = ssl.handshakeStatus()) != axtlsj.SSL_OK) + { + if (!quiet) + { + SSLUtil.displayError(res); + } + + ssl.dispose(); + throw new Exception(); + } + + display_session_id(ssl); + session_id = ssl.getSessionId(); + + if (reconnect > 0) + { + ssl.dispose(); + client_sock.close(); + + /* and reconnect */ + client_sock = new Socket(hostname, port); + } + } + } + else + { + ssl = ssl_ctx.connect(client_sock, null); + } + + /* check the return status */ + if ((res = ssl.handshakeStatus()) != axtlsj.SSL_OK) + { + if (!quiet) + { + SSLUtil.displayError(res); + } + + throw new Exception(); + } + + if (!quiet) + { + String common_name = + ssl.getCertificateDN(axtlsj.SSL_X509_CERT_COMMON_NAME); + + if (common_name != null) + { + System.out.println("Common Name:\t\t" + common_name); + } + + display_session_id(ssl); + display_cipher(ssl); + } + + BufferedReader in = new BufferedReader( + new InputStreamReader(System.in)); + + for (;;) + { + String user_input = in.readLine(); + + if (user_input == null) + break; + + byte[] buf = new byte[user_input.length()+2]; + buf[buf.length-2] = (byte)'\n'; /* add the carriage return */ + buf[buf.length-1] = 0; /* null terminate */ + + for (i = 0; i < buf.length-2; i++) + { + buf[i] = (byte)user_input.charAt(i); + } + + if ((res = ssl_ctx.write(ssl, buf)) < axtlsj.SSL_OK) + { + if (!quiet) + { + SSLUtil.displayError(res); + } + + break; + } + } + + ssl_ctx.dispose(); + } + + /** + * We've had some sort of command-line error. Print out the basic options. + */ + private void print_options(String option) + { + System.out.println("axssl: Error: '" + option + + "' is an invalid command."); + System.out.println("usage: axtlsj.jar [s_server|s_client] " + + "[args ...]"); + System.exit(1); + } + + /** + * We've had some sort of command-line error. Print out the server options. + */ + private void print_server_options(int build_mode, String option) + { + int cert_size = SSLUtil.maxCerts(); + int ca_cert_size = SSLUtil.maxCACerts(); + + System.out.println("unknown option " + option); + System.out.println("usage: s_server [args ...]"); + System.out.println(" -accept arg\t- port to accept on (default " + + "is 4433)"); + System.out.println(" -quiet\t\t- No server output"); + + if (build_mode >= axtlsj.SSL_BUILD_SERVER_ONLY) + { + System.out.println(" -cert arg\t- certificate file to add (in " + + "addition to default) to chain -"); + System.out.println("\t\t Can repeat up to " + cert_size + " times"); + System.out.println(" -key arg\t- Private key file to use"); + System.out.println(" -pass\t\t- private key file pass phrase source"); + } + + if (build_mode >= axtlsj.SSL_BUILD_ENABLE_VERIFICATION) + { + System.out.println(" -verify\t- turn on peer certificate " + + "verification"); + System.out.println(" -CAfile arg\t- Certificate authority. "); + System.out.println("\t\t Can repeat up to " + + ca_cert_size + " times"); + } + + if (build_mode == axtlsj.SSL_BUILD_FULL_MODE) + { + System.out.println(" -debug\t\t- Print more output"); + System.out.println(" -state\t\t- Show state messages"); + System.out.println(" -show-rsa\t- Show RSA state"); + } + + System.exit(1); + } + + /** + * We've had some sort of command-line error. Print out the client options. + */ + private void print_client_options(int build_mode, String option) + { + int cert_size = SSLUtil.maxCerts(); + int ca_cert_size = SSLUtil.maxCACerts(); + + System.out.println("unknown option " + option); + + if (build_mode >= axtlsj.SSL_BUILD_ENABLE_CLIENT) + { + System.out.println("usage: s_client [args ...]"); + System.out.println(" -connect host:port - who to connect to " + + "(default is localhost:4433)"); + System.out.println(" -verify\t- turn on peer certificate " + + "verification"); + System.out.println(" -cert arg\t- certificate file to use"); + System.out.println(" -key arg\t- Private key file to use"); + System.out.println("\t\t Can repeat up to " + cert_size + + " times"); + System.out.println(" -CAfile arg\t- Certificate authority."); + System.out.println("\t\t Can repeat up to " + ca_cert_size + + " times"); + System.out.println(" -quiet\t\t- No client output"); + System.out.println(" -pass\t\t- private key file pass " + + "phrase source"); + System.out.println(" -reconnect\t- Drop and re-make the " + + "connection with the same Session-ID"); + + if (build_mode == axtlsj.SSL_BUILD_FULL_MODE) + { + System.out.println(" -debug\t\t- Print more output"); + System.out.println(" -state\t\t- Show state messages"); + System.out.println(" -show-rsa\t- Show RSA state"); + } + } + else + { + System.out.println("Change configuration to allow this feature"); + } + + System.exit(1); + } + + /** + * Display what cipher we are using + */ + private void display_cipher(SSL ssl) + { + System.out.print("CIPHER is "); + + byte ciph_id = ssl.getCipherId(); + + if (ciph_id == axtlsj.SSL_AES128_SHA) + { + System.out.println("AES128-SHA"); + } + else if (ciph_id == axtlsj.SSL_AES256_SHA) + { + System.out.println("AES256-SHA"); + } + else if (ciph_id == axtlsj.SSL_RC4_128_SHA) + { + System.out.println("RC4-SHA"); + } + else if (ciph_id == axtlsj.SSL_RC4_128_MD5) + { + System.out.println("RC4-MD5"); + } + else + { + System.out.println("Unknown - " + ssl.getCipherId()); + } + } + + public char toHexChar(int i) + { + if ((0 <= i) && (i <= 9 )) + return (char)('0' + i); + else + return (char)('a' + (i-10)); + } + + public void bytesToHex(byte[] data) + { + StringBuffer buf = new StringBuffer(); + for (int i = 0; i < data.length; i++ ) + { + buf.append(toHexChar((data[i]>>>4)&0x0F)); + buf.append(toHexChar(data[i]&0x0F)); + } + + System.out.println(buf); + } + + + /** + * Display what session id we have. + */ + private void display_session_id(SSL ssl) + { + byte[] session_id = ssl.getSessionId(); + int i; + + System.out.println("-----BEGIN SSL SESSION PARAMETERS-----"); + bytesToHex(session_id); + System.out.println("-----END SSL SESSION PARAMETERS-----"); + } +} diff --git a/samples/java/manifest.mf b/samples/java/manifest.mf new file mode 100644 index 0000000000..b906ed29ed --- /dev/null +++ b/samples/java/manifest.mf @@ -0,0 +1 @@ +Main-Class: axssl diff --git a/samples/perl/Makefile b/samples/perl/Makefile new file mode 100644 index 0000000000..da910f9b76 --- /dev/null +++ b/samples/perl/Makefile @@ -0,0 +1,31 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +include ../../config/.config +include ../../config/makefile.conf + +all: samples +TARGET=../../axssl.pl +samples: $(TARGET) + +$(TARGET): axssl.pl + @cd ../../; ln -sf samples/perl/axssl.pl axssl.pl + +clean:: + -@rm -f $(TARGET) + diff --git a/samples/perl/axssl.pl b/samples/perl/axssl.pl new file mode 100755 index 0000000000..ce0266b02b --- /dev/null +++ b/samples/perl/axssl.pl @@ -0,0 +1,633 @@ +#!/usr/bin/perl -w +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2.1 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Lesser General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +# +# axssl.pl +# +# Demonstrate the use of the axTLS library in Perl with a set of +# command-line parameters similar to openssl. In fact, openssl clients +# should be able to communicate with axTLS servers and visa-versa. +# +# This code has various bits enabled depending on the configuration. To enable +# the most interesting version, compile with the 'full mode' enabled. +# +# To see what options you have, run the following: +# > [perl] axssl s_server -? +# > [perl] axssl s_client -? +# +# The axtls/axtlsp shared libraries must be in the same directory or be found +# by the OS. axtlsp.pm must be in this directory or be in @INC. +# +# Under Win32, ActivePerl was used (see +# http://www.activestate.com/Products/ActivePerl/?mp=1) +# +use axtlsp; +use IO::Socket; + +# To get access to Win32 file descriptor stuff +my $is_win32 = 0; + +if ($^O eq "MSWin32") +{ + eval("use Win32API::File 0.08 qw( :ALL )"); + $is_win32 = 1; +} + +use strict; + +# +# Win32 has some problems with socket handles +# +sub get_native_sock +{ + my ($sock) = @_; + return $is_win32 ? FdGetOsFHandle($sock) : $sock; +} + +# +# Main entry point. Doesn't do much except works out whether we are a client +# or a server. +# +print_options($#ARGV > -1 ? $ARGV[0] : "") + if ($#ARGV < 0 || ($ARGV[0] ne "s_server" && $ARGV[0] ne "s_client")); + + +# Cygwin/Win32 issue - flush our output continuously +select STDOUT; +local $|=1; + +my $build_mode = axtlsp::ssl_get_config($axtlsp::SSL_BUILD_MODE); +$ARGV[0] eq "s_server" ? do_server($build_mode) : do_client($build_mode); + +# +# Implement the SSL server logic. +# +sub do_server +{ + my ($build_mode) = @_; + my $i = 1; + my $port = 4433; + my $options = $axtlsp::SSL_DISPLAY_CERTS; + my $quiet = 0; + my $password = undef; + my $private_key_file = undef; + my $cert_size = axtlsp::ssl_get_config($axtlsp::SSL_MAX_CERT_CFG_OFFSET); + my $ca_cert_size = axtlsp::ssl_get_config( + $axtlsp::SSL_MAX_CA_CERT_CFG_OFFSET); + my @cert; + my @ca_cert; + + while ($i <= $#ARGV) + { + if ($ARGV[$i] eq "-accept") + { + print_server_options($build_mode, $ARGV[$i]) if $i >= $#ARGV; + $port = $ARGV[++$i]; + } + elsif ($ARGV[$i] eq "-quiet") + { + $quiet = 1; + $options &= ~$axtlsp::SSL_DISPLAY_CERTS; + } + elsif ($build_mode >= $axtlsp::SSL_BUILD_SERVER_ONLY) + { + if ($ARGV[$i] eq "-cert") + { + print_server_options($build_mode, $ARGV[$i]) + if $i >= $#ARGV || $#cert >= $cert_size-1; + + push @cert, $ARGV[++$i]; + } + elsif ($ARGV[$i] eq "-key") + { + print_server_options($build_mode, $ARGV[$i]) if $i >= $#ARGV; + $private_key_file = $ARGV[++$i]; + $options |= $axtlsp::SSL_NO_DEFAULT_KEY; + } + elsif ($ARGV[$i] eq "-pass") + { + print_server_options($build_mode, $ARGV[$i]) if $i >= $#ARGV; + $password = $ARGV[++$i]; + } + elsif ($build_mode >= $axtlsp::SSL_BUILD_ENABLE_VERIFICATION) + { + if ($ARGV[$i] eq "-verify") + { + $options |= $axtlsp::SSL_CLIENT_AUTHENTICATION; + } + elsif ($ARGV[$i] eq "-CAfile") + { + print_server_options($build_mode, $ARGV[$i]) + if $i >= $#ARGV || $#ca_cert >= $ca_cert_size-1; + push @ca_cert, $ARGV[++$i]; + } + elsif ($build_mode == $axtlsp::SSL_BUILD_FULL_MODE) + { + if ($ARGV[$i] eq "-debug") + { + $options |= $axtlsp::SSL_DISPLAY_BYTES; + } + elsif ($ARGV[$i] eq "-state") + { + $options |= $axtlsp::SSL_DISPLAY_STATES; + } + elsif ($ARGV[$i] eq "-show-rsa") + { + $options |= $axtlsp::SSL_DISPLAY_RSA; + } + else + { + print_server_options($build_mode, $ARGV[$i]); + } + } + else + { + print_server_options($build_mode, $ARGV[$i]); + } + } + else + { + print_server_options($build_mode, $ARGV[$i]); + } + } + else + { + print_server_options($build_mode, $ARGV[$i]); + } + + $i++; + } + + # Create socket for incoming connections + my $server_sock = IO::Socket::INET->new(Proto => 'tcp', + LocalPort => $port, + Listen => 1, + Reuse => 1) or die $!; + + ########################################################################### + # This is where the interesting stuff happens. Up until now we've + # just been setting up sockets etc. Now we do the SSL handshake. + ########################################################################### + my $ssl_ctx = axtlsp::ssl_ctx_new($options, $axtlsp::SSL_DEFAULT_SVR_SESS); + die "Error: Server context is invalid" if not defined $ssl_ctx; + + if (defined $private_key_file) + { + my $obj_type = $axtlsp::SSL_OBJ_RSA_KEY; + + $obj_type = $axtlsp::SSL_OBJ_PKCS8 if $private_key_file =~ /.p8$/; + $obj_type = $axtlsp::SSL_OBJ_PKCS12 if $private_key_file =~ /.p12$/; + + die "Private key '$private_key_file' is undefined." if + axtlsp::ssl_obj_load($ssl_ctx, $obj_type, + $private_key_file, $password); + } + + foreach (@cert) + { + die "Certificate '$_' is undefined." + if axtlsp::ssl_obj_load($ssl_ctx, $axtlsp::SSL_OBJ_X509_CERT, + $_, undef) != $axtlsp::SSL_OK; + } + + foreach (@ca_cert) + { + die "Certificate '$_' is undefined." + if axtlsp::ssl_obj_load($ssl_ctx, $axtlsp::SSL_OBJ_X509_CACERT, + $_, undef) != $axtlsp::SSL_OK; + } + + for (;;) + { + printf("ACCEPT\n") if not $quiet; + my $client_sock = $server_sock->accept; + my $native_sock = get_native_sock($client_sock->fileno); + + # This doesn't work in Win32 - need to get file descriptor from socket. + my $ssl = axtlsp::ssl_server_new($ssl_ctx, $native_sock); + + # do the actual SSL handshake + my $res; + my $buf; + + while (1) + { + ($res, $buf) = axtlsp::ssl_read($ssl, undef); + last if $res != $axtlsp::SSL_OK; + + # check when the connection has been established + last if axtlsp::ssl_handshake_status($ssl) == $axtlsp::SSL_OK; + + # could do something else here + } + + if ($res == $axtlsp::SSL_OK) # connection established and ok + { + if (!$quiet) + { + display_session_id($ssl); + display_cipher($ssl); + } + + # now read (and display) whatever the client sends us + for (;;) + { + # keep reading until we get something interesting + while (1) + { + ($res, $buf) = axtlsp::ssl_read($ssl, undef); + last if $res != $axtlsp::SSL_OK; + + # could do something else here + } + + if ($res < $axtlsp::SSL_OK) + { + printf("CONNECTION CLOSED\n") if not $quiet; + last; + } + + printf($$buf); + } + } + elsif (!$quiet) + { + axtlsp::ssl_display_error($res); + } + + # client was disconnected or the handshake failed. + axtlsp::ssl_free($ssl); + $client_sock->close; + } + + axtlsp::ssl_ctx_free($ssl_ctx); +} + +# +# Implement the SSL client logic. +# +sub do_client +{ + my ($build_mode) = @_; + my $i = 1; + my $port = 4433; + my $options = $axtlsp::SSL_SERVER_VERIFY_LATER|$axtlsp::SSL_DISPLAY_CERTS; + my $private_key_file = undef; + my $reconnect = 0; + my $quiet = 0; + my $password = undef; + my @session_id; + my $host = "127.0.0.1"; + my @cert; + my @ca_cert; + my $cert_size = axtlsp::ssl_get_config( + $axtlsp::SSL_MAX_CERT_CFG_OFFSET); + my $ca_cert_size = axtlsp::ssl_get_config( + $axtlsp::SSL_MAX_CA_CERT_CFG_OFFSET); + + while ($i <= $#ARGV) + { + if ($ARGV[$i] eq "-connect") + { + print_client_options($build_mode, $ARGV[$i]) if $i >= $#ARGV; + ($host, $port) = split(':', $ARGV[++$i]); + } + elsif ($ARGV[$i] eq "-cert") + { + print_client_options($build_mode, $ARGV[$i]) + if $i >= $#ARGV || $#cert >= $cert_size-1; + + push @cert, $ARGV[++$i]; + } + elsif ($ARGV[$i] eq "-key") + { + print_client_options($build_mode, $ARGV[$i]) if $i >= $#ARGV; + $private_key_file = $ARGV[++$i]; + $options |= $axtlsp::SSL_NO_DEFAULT_KEY; + } + elsif ($ARGV[$i] eq "-CAfile") + { + print_client_options($build_mode, $ARGV[$i]) + if $i >= $#ARGV || $#ca_cert >= $ca_cert_size-1; + + push @ca_cert, $ARGV[++$i]; + } + elsif ($ARGV[$i] eq "-verify") + { + $options &= ~$axtlsp::SSL_SERVER_VERIFY_LATER; + } + elsif ($ARGV[$i] eq "-reconnect") + { + $reconnect = 4; + } + elsif ($ARGV[$i] eq "-quiet") + { + $quiet = 1; + $options &= ~$axtlsp::SSL_DISPLAY_CERTS; + } + elsif ($ARGV[$i] eq "-pass") + { + print_server_options($build_mode, $ARGV[$i]) if $i >= $#ARGV; + $password = $ARGV[++$i]; + } + elsif ($build_mode == $axtlsp::SSL_BUILD_FULL_MODE) + { + if ($ARGV[$i] eq "-debug") + { + $options |= $axtlsp::SSL_DISPLAY_BYTES; + } + elsif ($ARGV[$i] eq "-state") + { + $options |= $axtlsp::SSL_DISPLAY_STATES; + } + elsif ($ARGV[$i] eq "-show-rsa") + { + $options |= $axtlsp::SSL_DISPLAY_RSA; + } + else # don't know what this is + { + print_client_options($build_mode, $ARGV[$i]); + } + } + else # don't know what this is + { + print_client_options($build_mode, $ARGV[$i]); + } + + $i++; + } + + my $client_sock = new IO::Socket::INET ( + PeerAddr => $host, PeerPort => $port, Proto => 'tcp') + || die ("no socket: $!"); + my $ssl; + my $res; + my $native_sock = get_native_sock($client_sock->fileno); + + printf("CONNECTED\n") if not $quiet; + + ########################################################################### + # This is where the interesting stuff happens. Up until now we've + # just been setting up sockets etc. Now we do the SSL handshake. + ########################################################################### + my $ssl_ctx = axtlsp::ssl_ctx_new($options, $axtlsp::SSL_DEFAULT_CLNT_SESS); + die "Error: Client context is invalid" if not defined $ssl_ctx; + + if (defined $private_key_file) + { + my $obj_type = $axtlsp::SSL_OBJ_RSA_KEY; + + $obj_type = $axtlsp::SSL_OBJ_PKCS8 if $private_key_file =~ /.p8$/; + $obj_type = $axtlsp::SSL_OBJ_PKCS12 if $private_key_file =~ /.p12$/; + + die "Private key '$private_key_file' is undefined." if + axtlsp::ssl_obj_load($ssl_ctx, $obj_type, + $private_key_file, $password); + } + + foreach (@cert) + { + die "Certificate '$_' is undefined." + if axtlsp::ssl_obj_load($ssl_ctx, $axtlsp::SSL_OBJ_X509_CERT, + $_, undef) != $axtlsp::SSL_OK; + } + + foreach (@ca_cert) + { + die "Certificate '$_' is undefined." + if axtlsp::ssl_obj_load($ssl_ctx, $axtlsp::SSL_OBJ_X509_CACERT, + $_, undef) != $axtlsp::SSL_OK; + } + + # Try session resumption? + if ($reconnect) + { + my $session_id = undef; + while ($reconnect--) + { + $ssl = axtlsp::ssl_client_new($ssl_ctx, $native_sock, $session_id); + + $res = axtlsp::ssl_handshake_status($ssl); + if ($res != $axtlsp::SSL_OK) + { + if (!$quiet) + { + axtlsp::ssl_display_error($res); + } + + axtlsp::ssl_free($ssl); + exit 1; + } + + display_session_id($ssl); + $session_id = axtlsp::ssl_get_session_id($ssl); + + if ($reconnect) + { + axtlsp::ssl_free($ssl); + $client_sock->close; + $client_sock = new IO::Socket::INET ( + PeerAddr => $host, PeerPort => $port, Proto => 'tcp') + || die ("no socket: $!"); + + } + } + } + else + { + $ssl = axtlsp::ssl_client_new($ssl_ctx, $native_sock, undef); + } + + # check the return status + $res = axtlsp::ssl_handshake_status($ssl); + if ($res != $axtlsp::SSL_OK) + { + if (!$quiet) + { + axtlsp::ssl_display_error($res); + } + + exit 1; + } + + if (!$quiet) + { + my $common_name = axtlsp::ssl_get_cert_dn($ssl, + $axtlsp::SSL_X509_CERT_COMMON_NAME); + + printf("Common Name:\t\t%s\n", $common_name) if defined $common_name; + display_session_id($ssl); + display_cipher($ssl); + } + + while () + { + my $cstring = pack("a*x", $_); # add null terminator + $res = axtlsp::ssl_write($ssl, \$cstring, length($cstring)); + if ($res < $axtlsp::SSL_OK) + { + axtlsp::ssl_display_error($res) if not $quiet; + last; + } + } + + axtlsp::ssl_ctx_free($ssl_ctx); + $client_sock->close; +} + +# +# We've had some sort of command-line error. Print out the basic options. +# +sub print_options +{ + my ($option) = @_; + printf("axssl: Error: '%s' is an invalid command.\n", $option); + printf("usage: axssl [s_server|s_client] [args ...]\n"); + exit 1; +} + +# +# We've had some sort of command-line error. Print out the server options. +# +sub print_server_options +{ + my ($build_mode, $option) = @_; + my $cert_size = axtlsp::ssl_get_config($axtlsp::SSL_MAX_CERT_CFG_OFFSET); + my $ca_cert_size = axtlsp::ssl_get_config( + $axtlsp::SSL_MAX_CA_CERT_CFG_OFFSET); + + printf("unknown option %s\n", $option); + printf("usage: s_server [args ...]\n"); + printf(" -accept arg\t- port to accept on (default is 4433)\n"); + printf(" -quiet\t\t- No server output\n"); + + if ($build_mode >= $axtlsp::SSL_BUILD_SERVER_ONLY) + { + printf(" -cert arg\t- certificate file to add (in addition to default)". + " to chain -\n". + "\t\t default DER format. Can repeat up to %d times\n", $cert_size); + printf(" -key arg\t- Private key file to use - default DER format\n"); + printf(" -pass\t\t- private key file pass phrase source\n"); + } + + if ($build_mode >= $axtlsp::SSL_BUILD_ENABLE_VERIFICATION) + { + printf(" -verify\t- turn on peer certificate verification\n"); + printf(" -CAfile arg\t- Certificate authority - default DER format\n"); + printf("\t\t Can repeat up to %d times\n", $ca_cert_size); + } + + if ($build_mode == $axtlsp::SSL_BUILD_FULL_MODE) + { + printf(" -debug\t\t- Print more output\n"); + printf(" -state\t\t- Show state messages\n"); + printf(" -show-rsa\t- Show RSA state\n"); + } + + exit 1; +} + +# +# We've had some sort of command-line error. Print out the client options. +# +sub print_client_options +{ + my ($build_mode, $option) = @_; + my $cert_size = axtlsp::ssl_get_config($axtlsp::SSL_MAX_CERT_CFG_OFFSET); + my $ca_cert_size = axtlsp::ssl_get_config( + $axtlsp::SSL_MAX_CA_CERT_CFG_OFFSET); + + printf("unknown option %s\n", $option); + + if ($build_mode >= $axtlsp::SSL_BUILD_ENABLE_CLIENT) + { + printf("usage: s_client [args ...]\n"); + printf(" -connect host:port - who to connect to (default ". + "is localhost:4433)\n"); + printf(" -verify\t- turn on peer certificate verification\n"); + printf(" -cert arg\t- certificate file to use - default DER format\n"); + printf(" -key arg\t- Private key file to use - default DER format\n"); + printf("\t\t Can repeat up to %d times\n", $cert_size); + printf(" -CAfile arg\t- Certificate authority - default DER format\n"); + printf("\t\t Can repeat up to %d times\n", $ca_cert_size); + printf(" -quiet\t\t- No client output\n"); + printf(" -pass\t\t- private key file pass phrase source\n"); + printf(" -reconnect\t- Drop and re-make the connection ". + "with the same Session-ID\n"); + + if ($build_mode == $axtlsp::SSL_BUILD_FULL_MODE) + { + printf(" -debug\t\t- Print more output\n"); + printf(" -state\t\t- Show state messages\n"); + printf(" -show-rsa\t- Show RSA state\n"); + } + } + else + { + printf("Change configuration to allow this feature\n"); + } + + exit 1; +} + +# +# Display what cipher we are using +# +sub display_cipher +{ + my ($ssl) = @_; + printf("CIPHER is "); + my $cipher_id = axtlsp::ssl_get_cipher_id($ssl); + + if ($cipher_id == $axtlsp::SSL_AES128_SHA) + { + printf("AES128-SHA"); + } + elsif ($cipher_id == $axtlsp::SSL_AES256_SHA) + { + printf("AES256-SHA"); + } + elsif ($axtlsp::SSL_RC4_128_SHA) + { + printf("RC4-SHA"); + } + elsif ($axtlsp::SSL_RC4_128_MD5) + { + printf("RC4-MD5"); + } + else + { + printf("Unknown - %d", $cipher_id); + } + + printf("\n"); +} + +# +# Display what session id we have. +# +sub display_session_id +{ + my ($ssl) = @_; + my $session_id = axtlsp::ssl_get_session_id($ssl); + + printf("-----BEGIN SSL SESSION PARAMETERS-----\n"); + printf(unpack("H*", $$session_id)); + printf("\n-----END SSL SESSION PARAMETERS-----\n"); +} diff --git a/samples/vbnet/Makefile b/samples/vbnet/Makefile new file mode 100644 index 0000000000..dab5f9599c --- /dev/null +++ b/samples/vbnet/Makefile @@ -0,0 +1,36 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +include ../../config/.config +include ../../config/makefile.conf +include ../../config/makefile.dotnet.conf + +# only build on Win32 platforms +ifdef GO_DOT_NET +all : sample +TARGET=../../axssl.vbnet.exe +sample : $(TARGET) + +$(TARGET): ../../bindings/vbnet/axTLSvb.vb ../../bindings/vbnet/axInterface.vb axssl.vb + vbc.exe /r:"`cygpath -w "$(CONFIG_DOT_NET_FRAMEWORK_BASE)/System.dll"`" /nologo /t:exe /out:"`cygpath -w $@`" $(foreach file, $^, "`cygpath -w $(file)`") + +endif # ARCH + +clean:: + -@rm -f $(TARGET) + diff --git a/samples/vbnet/axssl.vb b/samples/vbnet/axssl.vb new file mode 100644 index 0000000000..4eb210a3f9 --- /dev/null +++ b/samples/vbnet/axssl.vb @@ -0,0 +1,682 @@ +' +' Copyright(C) 2006 +' +' This program is free software you can redistribute it and/or modify +' it under the terms of the GNU General Public License as published by +' the Free Software Foundation either version 2.1 of the License, or +' (at your option) any later version. +' +' This program is distributed in the hope that it will be useful, +' but WITHOUT ANY WARRANTY without even the implied warranty of +' MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +' GNU Lesser General Public License for more details. +' +' You should have received a copy of the GNU General Public License +' along with this program if not, write to the Free Software +' Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +' + +' +' @file axssl.vb +' +' Demonstrate the use of the axTLS library in VB.NET with a set of +' command-line parameters similar to openssl. In fact, openssl clients +' should be able to communicate with axTLS servers and visa-versa. +' +' This code has various bits enabled depending on the configuration. To enable +' the most interesting version, compile with the 'full mode' enabled. +' +' To see what options you have, run the following: +' > axssl.vbnet.exe s_server -? +' > axssl.vbnet.exe s_client -? +' +' The axtls shared library must be in the same directory or be found +' by the OS. +' + +Imports System +Imports System.Net +Imports System.Net.Sockets +Imports Microsoft.VisualBasic +Imports axTLSvb + +Public Class axssl + ' + ' do_server() + ' + Public Sub do_server(ByVal build_mode As Integer, _ + ByVal args() As String) + Dim i As Integer = 1 + Dim port As Integer = 4433 + Dim options As Integer = axtls.SSL_DISPLAY_CERTS + Dim quiet As Boolean = False + Dim password As String = Nothing + Dim private_key_file As String = Nothing + + ' organise the cert/ca_cert lists + Dim cert_size As Integer = SSLUtil.MaxCerts() + Dim ca_cert_size As Integer = SSLUtil.MaxCACerts() + Dim cert(cert_size) As String + Dim ca_cert(ca_cert_size) As String + Dim cert_index As Integer = 0 + Dim ca_cert_index As Integer = 0 + + While i < args.Length + If args(i) = "-accept" Then + If i >= args.Length-1 + print_server_options(build_mode, args(i)) + End If + + i += 1 + port = Int32.Parse(args(i)) + ElseIf args(i) = "-quiet" + quiet = True + options = options And Not axtls.SSL_DISPLAY_CERTS + ElseIf build_mode >= axtls.SSL_BUILD_SERVER_ONLY + If args(i) = "-cert" + If i >= args.Length-1 Or cert_index >= cert_size + print_server_options(build_mode, args(i)) + End If + + i += 1 + cert(cert_index) = args(i) + cert_index += 1 + ElseIf args(i) = "-key" + If i >= args.Length-1 + print_server_options(build_mode, args(i)) + End If + + i += 1 + private_key_file = args(i) + options = options Or axtls.SSL_NO_DEFAULT_KEY + ElseIf args(i) = "-pass" + If i >= args.Length-1 + print_server_options(build_mode, args(i)) + End If + + i += 1 + password = args(i) + ElseIf build_mode >= axtls.SSL_BUILD_ENABLE_VERIFICATION + If args(i) = "-verify" Then + options = options Or axtls.SSL_CLIENT_AUTHENTICATION + ElseIf args(i) = "-CAfile" + If i >= args.Length-1 Or ca_cert_index >= ca_cert_size Then + print_server_options(build_mode, args(i)) + End If + + i += 1 + ca_cert(ca_cert_index) = args(i) + ca_cert_index += 1 + ElseIf build_mode = axtls.SSL_BUILD_FULL_MODE + If args(i) = "-debug" Then + options = options Or axtls.SSL_DISPLAY_BYTES + ElseIf args(i) = "-state" + options = options Or axtls.SSL_DISPLAY_STATES + ElseIf args(i) = "-show-rsa" + options = options Or axtls.SSL_DISPLAY_RSA + Else + print_server_options(build_mode, args(i)) + End If + Else + print_server_options(build_mode, args(i)) + End If + Else + print_server_options(build_mode, args(i)) + End If + End If + + i += 1 + End While + + ' Create socket for incoming connections + Dim ep As IPEndPoint = New IPEndPoint(IPAddress.Any, port) + Dim server_sock As TcpListener = New TcpListener(ep) + server_sock.Start() + + '********************************************************************* + ' This is where the interesting stuff happens. Up until now we've + ' just been setting up sockets etc. Now we do the SSL handshake. + '*********************************************************************/ + Dim ssl_ctx As SSLServer = New SSLServer(options, _ + axtls.SSL_DEFAULT_SVR_SESS) + + If ssl_ctx Is Nothing Then + Console.Error.WriteLine("Error: Server context is invalid") + Environment.Exit(1) + End If + + If private_key_file <> Nothing Then + Dim obj_type As Integer = axtls.SSL_OBJ_RSA_KEY + + If private_key_file.EndsWith(".p8") Then + obj_type = axtls.SSL_OBJ_PKCS8 + Else If (private_key_file.EndsWith(".p12")) + obj_type = axtls.SSL_OBJ_PKCS12 + End If + + If ssl_ctx.ObjLoad(obj_type, private_key_file, _ + password) <> axtls.SSL_OK Then + Console.Error.WriteLine("Error: Private key '" & _ + private_key_file & "' is undefined.") + Environment.Exit(1) + End If + End If + + For i = 0 To cert_index-1 + If ssl_ctx.ObjLoad(axtls.SSL_OBJ_X509_CERT, _ + cert(i), Nothing) <> axtls.SSL_OK Then + Console.WriteLine("Certificate '" & cert(i) & _ + "' is undefined.") + Environment.Exit(1) + End If + Next + + For i = 0 To ca_cert_index-1 + If ssl_ctx.ObjLoad(axtls.SSL_OBJ_X509_CACERT, _ + ca_cert(i), Nothing) <> axtls.SSL_OK Then + Console.WriteLine("Certificate '" & ca_cert(i) & _ + "' is undefined.") + Environment.Exit(1) + End If + Next + + Dim buf As Byte() = Nothing + Dim res As Integer + Dim ssl As SSL + + While 1 + If Not quiet Then + Console.WriteLine("ACCEPT") + End If + + Dim client_sock As Socket = server_sock.AcceptSocket() + + ssl = ssl_ctx.Connect(client_sock) + + ' do the actual SSL handshake + While 1 + res = ssl_ctx.Read(ssl, buf) + If res <> axtls.SSL_OK Then + Exit While + End If + + ' check when the connection has been established + If ssl.HandshakeStatus() = axtls.SSL_OK + Exit While + End If + + ' could do something else here + End While + + If res = axtls.SSL_OK Then ' connection established and ok + If Not quiet + display_session_id(ssl) + display_cipher(ssl) + End If + + ' now read (and display) whatever the client sends us + While 1 + ' keep reading until we get something interesting + While 1 + res = ssl_ctx.Read(ssl, buf) + If res <> axtls.SSL_OK Then + Exit While + End If + + ' could do something else here + End While + + If res < axtls.SSL_OK + If Not quiet + Console.WriteLine("CONNECTION CLOSED") + End If + + Exit While + End If + + ' convert to String + Dim str(res) As Char + For i = 0 To res-1 + str(i) = Chr(buf(i)) + Next + + Console.Write(str) + End While + ElseIf Not quiet + SSLUtil.DisplayError(res) + End If + + ' client was disconnected or the handshake failed. */ + ssl.Dispose() + client_sock.Close() + End While + + ssl_ctx.Dispose() + End Sub + + ' + ' do_client() + ' + Public Sub do_client(ByVal build_mode As Integer, _ + ByVal args() As String) + + If build_mode < axtls.SSL_BUILD_ENABLE_CLIENT Then + print_client_options(build_mode, args(1)) + End If + + Dim i As Integer = 1 + Dim res As Integer + Dim port As Integer = 4433 + Dim quiet As Boolean = False + Dim password As String = Nothing + Dim reconnect As Integer = 0 + Dim private_key_file As String = Nothing + Dim hostname As String = "127.0.0.1" + + ' organise the cert/ca_cert lists + Dim ssl As SSL = Nothing + Dim cert_size As Integer = SSLUtil.MaxCerts() + Dim ca_cert_size As Integer = SSLUtil.MaxCACerts() + Dim cert(cert_size) As String + Dim ca_cert(ca_cert_size) As String + Dim cert_index As Integer = 0 + Dim ca_cert_index As Integer = 0 + + Dim options As Integer = _ + axtls.SSL_SERVER_VERIFY_LATER Or axtls.SSL_DISPLAY_CERTS + Dim session_id As Byte() = Nothing + + While i < args.Length + If args(i) = "-connect" Then + Dim host_port As String + + If i >= args.Length-1 + print_client_options(build_mode, args(i)) + End If + + i += 1 + host_port = args(i) + + Dim index_colon As Integer = host_port.IndexOf(":"C) + If index_colon < 0 Then + print_client_options(build_mode, args(i)) + End If + + hostname = New String(host_port.ToCharArray(), _ + 0, index_colon) + port = Int32.Parse(New String(host_port.ToCharArray(), _ + index_colon+1, host_port.Length-index_colon-1)) + ElseIf args(i) = "-cert" + If i >= args.Length-1 Or cert_index >= cert_size Then + print_client_options(build_mode, args(i)) + End If + + i += 1 + cert(cert_index) = args(i) + cert_index += 1 + ElseIf args(i) = "-key" + If i >= args.Length-1 + print_client_options(build_mode, args(i)) + End If + + i += 1 + private_key_file = args(i) + options = options Or axtls.SSL_NO_DEFAULT_KEY + ElseIf args(i) = "-CAfile" + If i >= args.Length-1 Or ca_cert_index >= ca_cert_size + print_client_options(build_mode, args(i)) + End If + + i += 1 + ca_cert(ca_cert_index) = args(i) + ca_cert_index += 1 + ElseIf args(i) = "-verify" + options = options And Not axtls.SSL_SERVER_VERIFY_LATER + ElseIf args(i) = "-reconnect" + reconnect = 4 + ElseIf args(i) = "-quiet" + quiet = True + options = options And Not axtls.SSL_DISPLAY_CERTS + ElseIf args(i) = "-pass" + If i >= args.Length-1 + print_client_options(build_mode, args(i)) + End If + + i += 1 + password = args(i) + ElseIf build_mode = axtls.SSL_BUILD_FULL_MODE + If args(i) = "-debug" Then + options = options Or axtls.SSL_DISPLAY_BYTES + ElseIf args(i) = "-state" + options = options Or axtls.SSL_DISPLAY_STATES + ElseIf args(i) = "-show-rsa" + options = options Or axtls.SSL_DISPLAY_RSA + Else + print_client_options(build_mode, args(i)) + End If + Else ' don't know what this is + print_client_options(build_mode, args(i)) + End If + + i += 1 + End While + + 'Dim hostInfo As IPHostEntry = Dns.Resolve(hostname) + Dim hostInfo As IPHostEntry = Dns.GetHostEntry(hostname) + Dim addresses As IPAddress() = hostInfo.AddressList + Dim ep As IPEndPoint = New IPEndPoint(addresses(0), port) + Dim client_sock As Socket = New Socket(AddressFamily.InterNetwork, _ + SocketType.Stream, ProtocolType.Tcp) + client_sock.Connect(ep) + + If Not client_sock.Connected Then + Console.WriteLine("could not connect") + Environment.Exit(1) + End If + + If Not quiet Then + Console.WriteLine("CONNECTED") + End If + + '********************************************************************* + ' This is where the interesting stuff happens. Up until now we've + ' just been setting up sockets etc. Now we do the SSL handshake. + '*********************************************************************/ + Dim ssl_ctx As SSLClient = New SSLClient(options, _ + axtls.SSL_DEFAULT_CLNT_SESS) + + If ssl_ctx Is Nothing Then + Console.Error.WriteLine("Error: Client context is invalid") + Environment.Exit(1) + End If + + If private_key_file <> Nothing Then + Dim obj_type As Integer = axtls.SSL_OBJ_RSA_KEY + + If private_key_file.EndsWith(".p8") Then + obj_type = axtls.SSL_OBJ_PKCS8 + Else If (private_key_file.EndsWith(".p12")) + obj_type = axtls.SSL_OBJ_PKCS12 + End If + + If ssl_ctx.ObjLoad(obj_type, private_key_file, _ + password) <> axtls.SSL_OK Then + Console.Error.WriteLine("Error: Private key '" & _ + private_key_file & "' is undefined.") + Environment.Exit(1) + End If + End If + + For i = 0 To cert_index-1 + If ssl_ctx.ObjLoad(axtls.SSL_OBJ_X509_CERT, _ + cert(i), Nothing) <> axtls.SSL_OK Then + Console.WriteLine("Certificate '" & cert(i) & _ + "' is undefined.") + Environment.Exit(1) + End If + Next + + For i = 0 To ca_cert_index-1 + If ssl_ctx.ObjLoad(axtls.SSL_OBJ_X509_CACERT, _ + ca_cert(i), Nothing) <> axtls.SSL_OK Then + Console.WriteLine("Certificate '" & ca_cert(i) & _ + "' is undefined.") + Environment.Exit(1) + End If + Next + + ' Try session resumption? + If reconnect > 0 Then + While reconnect > 0 + reconnect -= 1 + ssl = ssl_ctx.Connect(client_sock, session_id) + + res = ssl.HandshakeStatus() + If res <> axtls.SSL_OK Then + If Not quiet Then + SSLUtil.DisplayError(res) + End If + + ssl.Dispose() + Environment.Exit(1) + End If + + display_session_id(ssl) + session_id = ssl.GetSessionId() + + If reconnect > 0 Then + ssl.Dispose() + client_sock.Close() + + ' and reconnect + client_sock = New Socket(AddressFamily.InterNetwork, _ + SocketType.Stream, ProtocolType.Tcp) + client_sock.Connect(ep) + End If + End While + Else + ssl = ssl_ctx.Connect(client_sock, Nothing) + End If + + ' check the return status + res = ssl.HandshakeStatus() + If res <> axtls.SSL_OK Then + If Not quiet Then + SSLUtil.DisplayError(res) + End If + + Environment.Exit(1) + End If + + If Not quiet Then + Dim common_name As String = _ + ssl.GetCertificateDN(axtls.SSL_X509_CERT_COMMON_NAME) + + If common_name <> Nothing + Console.WriteLine("Common Name:" & _ + ControlChars.Tab & ControlChars.Tab & common_name) + End If + + display_session_id(ssl) + display_cipher(ssl) + End If + + While (1) + Dim user_input As String = Console.ReadLine() + + If user_input = Nothing Then + Exit While + End If + + Dim buf(user_input.Length+1) As Byte + buf(buf.Length-2) = Asc(ControlChars.Lf) ' add the carriage return + buf(buf.Length-1) = 0 ' null terminate + + For i = 0 To user_input.Length-1 + buf(i) = Asc(user_input.Chars(i)) + Next + + res = ssl_ctx.Write(ssl, buf, buf.Length) + If res < axtls.SSL_OK Then + If Not quiet Then + SSLUtil.DisplayError(res) + End If + + Exit While + End If + End While + + ssl_ctx.Dispose() + End Sub + + ' + ' Display what cipher we are using + ' + Private Sub display_cipher(ByVal ssl As SSL) + Console.Write("CIPHER is ") + + Select ssl.GetCipherId() + Case axtls.SSL_AES128_SHA + Console.WriteLine("AES128-SHA") + + Case axtls.SSL_AES256_SHA + Console.WriteLine("AES256-SHA") + + Case axtls.SSL_RC4_128_SHA + Console.WriteLine("RC4-SHA") + + Case axtls.SSL_RC4_128_MD5 + Console.WriteLine("RC4-MD5") + + Case Else + Console.WriteLine("Unknown - " & ssl.GetCipherId()) + End Select + End Sub + + ' + ' Display what session id we have. + ' + Private Sub display_session_id(ByVal ssl As SSL) + Dim session_id As Byte() = ssl.GetSessionId() + + Console.WriteLine("-----BEGIN SSL SESSION PARAMETERS-----") + Dim b As Byte + For Each b In session_id + Console.Write("{0:x02}", b) + Next + + Console.WriteLine() + Console.WriteLine("-----END SSL SESSION PARAMETERS-----") + End Sub + + ' + ' We've had some sort of command-line error. Print out the basic options. + ' + Public Sub print_options(ByVal options As String) + Console.WriteLine("axssl: Error: '" & options & _ + "' is an invalid command.") + Console.WriteLine("usage: axssl.vb.exe [s_server|s_client] [args ...]") + Environment.Exit(1) + End Sub + + ' + ' We've had some sort of command-line error. Print out the server options. + ' + Private Sub print_server_options(ByVal build_mode As Integer, _ + ByVal options As String) + Dim cert_size As Integer = SSLUtil.MaxCerts() + Dim ca_cert_size As Integer = SSLUtil.MaxCACerts() + + Console.WriteLine("unknown option " & options) + Console.WriteLine("usage: s_server [args ...]") + Console.WriteLine(" -accept arg" & ControlChars.Tab & _ + "- port to accept on (default is 4433)") + Console.WriteLine(" -quiet" & ControlChars.Tab & ControlChars.Tab & _ + "- No server output") + If build_mode >= axtls.SSL_BUILD_SERVER_ONLY + Console.WriteLine(" -cert arg" & ControlChars.Tab & _ + "- certificate file to add (in addition to default) to chain -") + Console.WriteLine(ControlChars.Tab & ControlChars.Tab & _ + " Can repeat up to " & cert_size & " times") + Console.WriteLine(" -key arg" & ControlChars.Tab & _ + "- Private key file to use") + Console.WriteLine(" -pass" & ControlChars.Tab & ControlChars.Tab & _ + "- private key file pass phrase source") + End If + + If build_mode >= axtls.SSL_BUILD_ENABLE_VERIFICATION + Console.WriteLine(" -verify" & ControlChars.Tab & _ + "- turn on peer certificate verification") + Console.WriteLine(" -CAfile arg" & ControlChars.Tab & _ + "- Certificate authority") + Console.WriteLine(ControlChars.Tab & ControlChars.Tab & _ + " Can repeat up to " & ca_cert_size & " times") + End If + + If build_mode = axtls.SSL_BUILD_FULL_MODE + Console.WriteLine(" -debug" & _ + ControlChars.Tab & ControlChars.Tab & _ + "- Print more output") + Console.WriteLine(" -state" & _ + ControlChars.Tab & ControlChars.Tab & _ + "- Show state messages") + Console.WriteLine(" -show-rsa" & _ + ControlChars.Tab & "- Show RSA state") + End If + + Environment.Exit(1) + End Sub + + ' + ' We've had some sort of command-line error. Print out the client options. + ' + Private Sub print_client_options(ByVal build_mode As Integer, _ + ByVal options As String) + Dim cert_size As Integer = SSLUtil.MaxCerts() + Dim ca_cert_size As Integer = SSLUtil.MaxCACerts() + + Console.WriteLine("unknown option " & options) + + If build_mode >= axtls.SSL_BUILD_ENABLE_CLIENT Then + Console.WriteLine("usage: s_client [args ...]") + Console.WriteLine(" -connect host:port - who to connect to " & _ + "(default is localhost:4433)") + Console.WriteLine(" -verify" & ControlChars.Tab & _ + "- turn on peer certificate verification") + Console.WriteLine(" -cert arg" & ControlChars.Tab & _ + "- certificate file to use") + Console.WriteLine(ControlChars.Tab & ControlChars.Tab & _ + " Can repeat up to " & cert_size & " times") + Console.WriteLine(" -key arg" & ControlChars.Tab & _ + "- Private key file to use") + Console.WriteLine(" -CAfile arg" & ControlChars.Tab & _ + "- Certificate authority") + Console.WriteLine(ControlChars.Tab & ControlChars.Tab & _ + " Can repeat up to " & ca_cert_size & " times") + Console.WriteLine(" -quiet" & _ + ControlChars.Tab & ControlChars.Tab & "- No client output") + Console.WriteLine(" -pass" & ControlChars.Tab & _ + ControlChars.Tab & _ + "- private key file pass phrase source") + Console.WriteLine(" -reconnect" & ControlChars.Tab & _ + "- Drop and re-make the " & _ + "connection with the same Session-ID") + + If build_mode = axtls.SSL_BUILD_FULL_MODE Then + Console.WriteLine(" -debug" & _ + ControlChars.Tab & ControlChars.Tab & _ + "- Print more output") + Console.WriteLine(" -state" & _ + ControlChars.Tab & ControlChars.Tab & _ + "- Show state messages") + Console.WriteLine(" -show-rsa" & ControlChars.Tab & _ + "- Show RSA state") + End If + Else + Console.WriteLine("Change configuration to allow this feature") + End If + + Environment.Exit(1) + End Sub + +End Class + +Public Module MyMain + Function Main(ByVal args() As String) As Integer + Dim runner As axssl = New axssl() + + If args.Length < 1 + runner.print_options("") + ElseIf args(0) <> "s_server" And args(0) <> "s_client" + runner.print_options(args(0)) + End If + + Dim build_mode As Integer = SSLUtil.BuildMode() + + If args(0) = "s_server" Then + runner.do_server(build_mode, args) + Else + runner.do_client(build_mode, args) + End If + End Function +End Module diff --git a/ssl/BigIntConfig.in b/ssl/BigIntConfig.in new file mode 100644 index 0000000000..04c7438c07 --- /dev/null +++ b/ssl/BigIntConfig.in @@ -0,0 +1,132 @@ +# +# For a description of the syntax of this configuration file, +# see scripts/config/Kconfig-language.txt +# + +menu "BigInt Options" + depends on !CONFIG_SSL_SKELETON_MODE + +choice + prompt "Reduction Algorithm" + default CONFIG_BIGINT_BARRETT + +config CONFIG_BIGINT_CLASSICAL + bool "Classical" + help + Classical uses standard division. It has no limitations and is + theoretically the slowest due to the divisions used. For this particular + implementation it is surprisingly quite fast. + +config CONFIG_BIGINT_MONTGOMERY + bool "Montgomery" + help + Montgomery uses simple addition and multiplication to achieve its + performance. In this implementation it is slower than classical, + and it has the limitation that 0 <= x, y < m, and so is not used + when CRT is active. + + This option will not be normally selected. + +config CONFIG_BIGINT_BARRETT + bool "Barrett" + help + Barrett performs expensive precomputation before reduction and partial + multiplies for computational speed. It can't be used with some of the + calculations when CRT is used, and so defaults to classical when this + occurs. + + It is about 40% faster than Classical/Montgomery with the expense of + about 2kB, and so this option is normally selected. + +endchoice + +config CONFIG_BIGINT_CRT + bool "Chinese Remainder Theorem (CRT)" + default y + help + Allow the Chinese Remainder Theorem (CRT) to be used. + + Uses a number of extra coefficients from the private key to improve the + performance of a decryption. This feature is one of the most + significant performance improvements (it reduces a decryption time by + over 3 times). + + This option should be selected. + +config CONFIG_BIGINT_KARATSUBA + bool "Karatsuba Multiplication" + default n + help + Allow Karasuba multiplication to be used. + + Uses 3 multiplications (plus a number of additions/subtractions) + instead of 4. Multiplications are O(N^2) but addition/subtraction + is O(N) hence for large numbers is beneficial. For this project, the + effect was only useful for 4096 bit keys. As these aren't likely to + be used, the feature is disabled by default. + + It costs about 2kB to enable it. + +config MUL_KARATSUBA_THRESH + int "Karatsuba Multiplication Theshold" + default 20 + depends on CONFIG_BIGINT_KARATSUBA + help + The minimum number of components needed before Karasuba muliplication + is used. + + This is very dependent on the speed/implementation of bi_add()/ + bi_subtract(). There is a bit of trial and error here and will be + at a different point for different architectures. + +config SQU_KARATSUBA_THRESH + int "Karatsuba Square Threshold" + default 40 + depends on CONFIG_BIGINT_KARATSUBA && CONFIG_BIGINT_SQUARE + help + The minimum number of components needed before Karatsuba squaring + is used. + + This is very dependent on the speed/implementation of bi_add()/ + bi_subtract(). There is a bit of trial and error here and will be + at a different point for different architectures. + +config CONFIG_BIGINT_SLIDING_WINDOW + bool "Sliding Window Exponentiation" + default y + help + Allow Sliding-Window Exponentiation to be used. + + Potentially processes more than 1 bit at a time when doing + exponentiation. The sliding-window technique reduces the number of + precomputations compared to other precomputed techniques. + + It results in a considerable performance improvement with it enabled + (it halves the decryption time) and so should be selected. + +config CONFIG_BIGINT_SQUARE + bool "Square Algorithm" + default y + help + Allow squaring to be used instead of a multiplication. + + Squaring is theoretically 50% faster than a standard multiply + (but is actually about 25% faster). + + It gives a 20% speed improvement and so should be selected. + +config CONFIG_BIGINT_CHECK_ON + bool "BigInt Integrity Checking" + default n if !CONFIG_DEBUG + default y if CONFIG_DEBUG + help + This is used when developing bigint algorithms. It performs a sanity + check on all operations at the expense of speed. + + This option is only selected when developing and should normally be + turned off. + +endmenu + + + diff --git a/ssl/Config.in b/ssl/Config.in new file mode 100644 index 0000000000..ff3aba5975 --- /dev/null +++ b/ssl/Config.in @@ -0,0 +1,250 @@ +# +# For a description of the syntax of this configuration file, +# see scripts/config/Kconfig-language.txt +# + +menu "SSL Library" + +choice + prompt "Mode" + default CONFIG_SSL_FULL_MODE + +config CONFIG_SSL_SERVER_ONLY + bool "Server only - no verification" + help + Enable server functionality (no client functionality). + This mode still supports sessions and chaining (which can be turned + off in configuration). + + The axssl sample runs with the minimum of features. + + This is the most space efficient of the modes with the library + about 45kB in size. Use this mode if you are doing standard SSL server + work. + +config CONFIG_SSL_CERT_VERIFICATION + bool "Server only - with verification" + help + Enable server functionality with client authentication (no client + functionality). + + The axssl sample runs with the "-verify" and "-CAfile" options. + + This mode produces a library about 49kB in size. Use this mode if you + have an SSL server which requires client authentication (which is + uncommon in browser applications). + +config CONFIG_SSL_ENABLE_CLIENT + bool "Client/Server enabled" + help + Enable client/server functionality (including peer authentication). + + The axssl sample runs with the "s_client" option enabled. + + This mode produces a library about 51kB in size. Use this mode if you + require axTLS to use SSL client functionality (the SSL server code + is always enabled). + +config CONFIG_SSL_FULL_MODE + bool "Client/Server enabled with diagnostics" + help + Enable client/server functionality including diagnostics. Most of the + extra size in this mode is due to the storage of various strings that + are used. + + The axssl sample has 3 more options, "-debug", "-state" and "-show-rsa" + + This mode produces a library about 58kB in size. It is suggested that + this mode is used only during development. + + It is the default to demonstrate the features of axTLS. + +config CONFIG_SSL_SKELETON_MODE + bool "Skeleton mode - the smallest server mode" + help + This is an experiment to build the smallest library at the expense of + features and speed. + + * Server mode only. + * The AES cipher is disabled. + * No session resumption. + * No external keys/certificates are supported. + * The bigint library has most of the performance features disabled. + * Some other features/API calls may not work. + + This mode produces a library about 37kB in size. The main + disadvantage of this mode is speed - it may be several times slower + than the other build modes. + +endchoice + +choice + prompt "Protocol Preference" + depends on !CONFIG_SSL_SKELETON_MODE + default CONFIG_SSL_PROT_MEDIUM + +config CONFIG_SSL_PROT_LOW + bool "Low" + help + Chooses the cipher in the order of RC4-SHA, AES128-SHA, AES256-SHA. + + This will use the fastest cipher(s) but at the expense of security. + +config CONFIG_SSL_PROT_MEDIUM + bool "Medium" + help + Chooses the cipher in the order of AES128-SHA, AES256-SHA, RC4-SHA. + + This mode is a balance between speed and security and is the default. + +config CONFIG_SSL_PROT_HIGH + bool "High" + help + Chooses the cipher in the order of AES256-SHA, AES128-SHA, RC4-SHA. + + This will use the strongest cipher(s) at the cost of speed. + +endchoice + +config CONFIG_SSL_USE_DEFAULT_KEY + bool "Enable default key" + depends on !CONFIG_SSL_SKELETON_MODE + default y + help + Some applications will not require the default private key/certificate + that is built in. This is one way to save on a couple of kB's if an + external private key/certificate is used. + + The advantage of a built-in private key/certificate is that no file + system is required for access. + + However this private key/certificate can never be changed (without a + code update). + + This mode is enabled by default. Disable this mode if the + built-in key/certificate is not used. + +config CONFIG_SSL_ENABLE_V23_HANDSHAKE + bool "Enable v23 Handshake" + default y + help + Some browsers use the v23 handshake client hello message + (an SSL2 format message which all SSL servers can understand). + It may be used if SSL2 is enabled in the browser. + + Since this feature takes a kB or so, this feature may be disabled - at + the risk of making it incompatible with some browsers (IE6 is ok, + Firefox/Opera may be a problem - see Mozilla bug report 148876). + + Disable if backwards compatibility is not an issue (i.e. the client is + always using TLS1.0) + +config CONFIG_SSL_HAS_PEM + bool "Enable PEM" + default n if !CONFIG_SSL_FULL_MODE + default y if CONFIG_SSL_FULL_MODE + depends on !CONFIG_SSL_SKELETON_MODE + help + Enable the use of PEM format for certificates and private keys. + + PEM is not normally needed - PEM files can be converted into DER files + quite easily. However they have the convenience of allowing multiple + certificates/keys in the same file. + + This feature will add a couple of kB to the library. + + Disable if PEM is not used (which will be in most cases). + +config CONFIG_SSL_USE_PKCS12 + bool "Use PKCS8/PKCS12" + default n if !CONFIG_SSL_FULL_MODE + default y if CONFIG_SSL_FULL_MODE + depends on !CONFIG_SSL_SERVER_ONLY && !CONFIG_SSL_SKELETON_MODE + help + PKCS12 certificates combine private keys and certificates together in + one file. + + PKCS8 private keys are also suppported (as it is a subset of PKCS12). + + The decryption of these certificates uses RC4-128 (and these + certificates must be encrypted using this cipher). The actual + algorithm is "PBE-SHA1-RC4-128". + + Disable if PKCS12 is not used (which will be in most cases). + +config CONFIG_SSL_EXPIRY_TIME + int "Session expiry time (in hours)" + depends on !CONFIG_SSL_SKELETON_MODE + default 24 + help + The time (in hours) before a session expires. + + A longer time means that the expensive parts of a handshake don't + need to be run when a client reconnects later. + + The default is 1 day. + +config CONFIG_X509_MAX_CA_CERTS + int "Maximum number of certificate authorites" + default 4 + depends on !CONFIG_SSL_SERVER_ONLY && !CONFIG_SSL_SKELETON_MODE + help + Determines the number of CA's allowed. + + Increase this figure if more trusted sites are allowed. Each + certificate adds about 300 bytes (when added). + + The default is to allow four certification authorities. + +config CONFIG_SSL_MAX_CERTS + int "Maximum number of chained certificates" + default 2 + help + Determines the number of certificates used in a certificate + chain. The chain length must be at least 1. + + Increase this figure if more certificates are to be added to the + chain. Each certificate adds about 300 bytes (when added). + + The default is to allow one certificate + 1 certificate in the chain + (which may be the certificate authority certificate). + +config CONFIG_USE_DEV_URANDOM + bool "Use /dev/urandom" + default y + depends on !CONFIG_PLATFORM_WIN32 + help + Use /dev/urandom. Otherwise a custom RNG is used. + + This will be the default on most Linux systems. + +config CONFIG_WIN32_USE_CRYPTO_LIB + bool "Use Win32 Crypto Library" + default y if !CONFIG_VISUAL_STUDIO_6_0 + default n if CONFIG_VISUAL_STUDIO_6_0 + depends on CONFIG_PLATFORM_WIN32 + help + Microsoft produce a Crypto API which requires the Platform SDK to be + installed. It's used for the RNG. + + This will be the default on most Win32 systems. If using Visual Studio + 6.0, then the SDK containing the crypto libraries must be used. + +config CONFIG_PERFORMANCE_TESTING + bool "Build the bigint performance test tool" + default n + help + Used for performance testing of bigint. + + This is a testing tool and is normally disabled. + +config CONFIG_SSL_TEST + bool "Build the SSL testing tool" + default n + depends on CONFIG_SSL_FULL_MODE + help + Used for sanity checking the SSL handshaking. + + This is a testing tool and is normally disabled. + +endmenu diff --git a/ssl/Makefile b/ssl/Makefile new file mode 100644 index 0000000000..2b0b6aa65f --- /dev/null +++ b/ssl/Makefile @@ -0,0 +1,86 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +include ../config/.config +include ../config/makefile.conf + +all: libs +ifdef CONFIG_PERFORMANCE_TESTING + $(MAKE) -C test +else +ifdef CONFIG_SSL_TEST + $(MAKE) -C test +endif +endif + +ifndef CONFIG_PLATFORM_WIN32 +TARGET1=../libaxtls.a +TARGET2=../libaxtls.so +else +TARGET1=../axtls.lib +TARGET2=../axtls.dll +STATIC_LIB=../axtls.static.lib +endif + +libs: $(TARGET1) $(TARGET2) + +OBJ=\ + aes.o \ + asn1.o \ + bigint.o \ + crypto_misc.o \ + hmac.o \ + loader.o \ + md5.o \ + p12.o \ + rsa.o \ + rc4.o \ + sha1.o \ + tls1.o \ + tls1_svr.o \ + tls1_clnt.o + +ifdef CONFIG_PLATFORM_WIN32 +OBJ+=os_port.o +endif + +include ../config/makefile.post + +ifndef CONFIG_PLATFORM_WIN32 + +$(TARGET1) : $(OBJ) + $(AR) -r $@ $(OBJ) + +$(TARGET2) : $(OBJ) + $(LD) $(LDFLAGS) $(LDSHARED) -o $@ $(OBJ) + +else # Win32 + +$(TARGET1) : $(OBJ) + $(AR) /out:$@ $(OBJ) + +$(TARGET2) : $(OBJ) + cp $(TARGET1) $(STATIC_LIB) + $(LD) $(LDFLAGS) $(LDSHARED) /out:$@ $(OBJ) + +endif + +clean:: + $(MAKE) -C test clean + -@rm -f *.pch ../*.so ../*.a ../*.dll ../*.lib ../*.exp ../*.pdb ../*.ilk + diff --git a/ssl/aes.c b/ssl/aes.c new file mode 100644 index 0000000000..7c41c753fe --- /dev/null +++ b/ssl/aes.c @@ -0,0 +1,477 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file aes.c + * + * AES implementation - this is a small code version. There are much faster + * versions around but they are much larger in size (i.e. they use large + * submix tables). + */ + +#include +#include "crypto.h" + +/* all commented out in skeleton mode */ +#ifndef CONFIG_SSL_SKELETON_MODE + +#define rot1(x) (((x) << 24) | ((x) >> 8)) +#define rot2(x) (((x) << 16) | ((x) >> 16)) +#define rot3(x) (((x) << 8) | ((x) >> 24)) + +/* This cute trick does 4 'mul by two' at once. Stolen from + * Dr B. R. Gladman but I'm sure the u-(u>>7) is + * a standard graphics trick + * The key to this is that we need to xor with 0x1b if the top bit is set. + * a 1xxx xxxx 0xxx 0xxx First we mask the 7bit, + * b 1000 0000 0000 0000 then we shift right by 7 puting the 7bit in 0bit, + * c 0000 0001 0000 0000 we then subtract (c) from (b) + * d 0111 1111 0000 0000 and now we and with our mask + * e 0001 1011 0000 0000 + */ +#define mt 0x80808080 +#define ml 0x7f7f7f7f +#define mh 0xfefefefe +#define mm 0x1b1b1b1b +#define mul2(x,t) ((t)=((x)&mt), \ + ((((x)+(x))&mh)^(((t)-((t)>>7))&mm))) + +#define inv_mix_col(x,f2,f4,f8,f9) (\ + (f2)=mul2(x,f2), \ + (f4)=mul2(f2,f4), \ + (f8)=mul2(f4,f8), \ + (f9)=(x)^(f8), \ + (f8)=((f2)^(f4)^(f8)), \ + (f2)^=(f9), \ + (f4)^=(f9), \ + (f8)^=rot3(f2), \ + (f8)^=rot2(f4), \ + (f8)^rot1(f9)) + +/* some macros to do endian independent byte extraction */ +#define n2l(c,l) l=ntohl(*c); c++ +#define l2n(l,c) *c++=htonl(l) + +/* + * AES S-box + */ +static const uint8_t aes_sbox[256] = +{ + 0x63,0x7C,0x77,0x7B,0xF2,0x6B,0x6F,0xC5, + 0x30,0x01,0x67,0x2B,0xFE,0xD7,0xAB,0x76, + 0xCA,0x82,0xC9,0x7D,0xFA,0x59,0x47,0xF0, + 0xAD,0xD4,0xA2,0xAF,0x9C,0xA4,0x72,0xC0, + 0xB7,0xFD,0x93,0x26,0x36,0x3F,0xF7,0xCC, + 0x34,0xA5,0xE5,0xF1,0x71,0xD8,0x31,0x15, + 0x04,0xC7,0x23,0xC3,0x18,0x96,0x05,0x9A, + 0x07,0x12,0x80,0xE2,0xEB,0x27,0xB2,0x75, + 0x09,0x83,0x2C,0x1A,0x1B,0x6E,0x5A,0xA0, + 0x52,0x3B,0xD6,0xB3,0x29,0xE3,0x2F,0x84, + 0x53,0xD1,0x00,0xED,0x20,0xFC,0xB1,0x5B, + 0x6A,0xCB,0xBE,0x39,0x4A,0x4C,0x58,0xCF, + 0xD0,0xEF,0xAA,0xFB,0x43,0x4D,0x33,0x85, + 0x45,0xF9,0x02,0x7F,0x50,0x3C,0x9F,0xA8, + 0x51,0xA3,0x40,0x8F,0x92,0x9D,0x38,0xF5, + 0xBC,0xB6,0xDA,0x21,0x10,0xFF,0xF3,0xD2, + 0xCD,0x0C,0x13,0xEC,0x5F,0x97,0x44,0x17, + 0xC4,0xA7,0x7E,0x3D,0x64,0x5D,0x19,0x73, + 0x60,0x81,0x4F,0xDC,0x22,0x2A,0x90,0x88, + 0x46,0xEE,0xB8,0x14,0xDE,0x5E,0x0B,0xDB, + 0xE0,0x32,0x3A,0x0A,0x49,0x06,0x24,0x5C, + 0xC2,0xD3,0xAC,0x62,0x91,0x95,0xE4,0x79, + 0xE7,0xC8,0x37,0x6D,0x8D,0xD5,0x4E,0xA9, + 0x6C,0x56,0xF4,0xEA,0x65,0x7A,0xAE,0x08, + 0xBA,0x78,0x25,0x2E,0x1C,0xA6,0xB4,0xC6, + 0xE8,0xDD,0x74,0x1F,0x4B,0xBD,0x8B,0x8A, + 0x70,0x3E,0xB5,0x66,0x48,0x03,0xF6,0x0E, + 0x61,0x35,0x57,0xB9,0x86,0xC1,0x1D,0x9E, + 0xE1,0xF8,0x98,0x11,0x69,0xD9,0x8E,0x94, + 0x9B,0x1E,0x87,0xE9,0xCE,0x55,0x28,0xDF, + 0x8C,0xA1,0x89,0x0D,0xBF,0xE6,0x42,0x68, + 0x41,0x99,0x2D,0x0F,0xB0,0x54,0xBB,0x16, +}; + +/* + * AES is-box + */ +static const uint8_t aes_isbox[256] = +{ + 0x52,0x09,0x6a,0xd5,0x30,0x36,0xa5,0x38, + 0xbf,0x40,0xa3,0x9e,0x81,0xf3,0xd7,0xfb, + 0x7c,0xe3,0x39,0x82,0x9b,0x2f,0xff,0x87, + 0x34,0x8e,0x43,0x44,0xc4,0xde,0xe9,0xcb, + 0x54,0x7b,0x94,0x32,0xa6,0xc2,0x23,0x3d, + 0xee,0x4c,0x95,0x0b,0x42,0xfa,0xc3,0x4e, + 0x08,0x2e,0xa1,0x66,0x28,0xd9,0x24,0xb2, + 0x76,0x5b,0xa2,0x49,0x6d,0x8b,0xd1,0x25, + 0x72,0xf8,0xf6,0x64,0x86,0x68,0x98,0x16, + 0xd4,0xa4,0x5c,0xcc,0x5d,0x65,0xb6,0x92, + 0x6c,0x70,0x48,0x50,0xfd,0xed,0xb9,0xda, + 0x5e,0x15,0x46,0x57,0xa7,0x8d,0x9d,0x84, + 0x90,0xd8,0xab,0x00,0x8c,0xbc,0xd3,0x0a, + 0xf7,0xe4,0x58,0x05,0xb8,0xb3,0x45,0x06, + 0xd0,0x2c,0x1e,0x8f,0xca,0x3f,0x0f,0x02, + 0xc1,0xaf,0xbd,0x03,0x01,0x13,0x8a,0x6b, + 0x3a,0x91,0x11,0x41,0x4f,0x67,0xdc,0xea, + 0x97,0xf2,0xcf,0xce,0xf0,0xb4,0xe6,0x73, + 0x96,0xac,0x74,0x22,0xe7,0xad,0x35,0x85, + 0xe2,0xf9,0x37,0xe8,0x1c,0x75,0xdf,0x6e, + 0x47,0xf1,0x1a,0x71,0x1d,0x29,0xc5,0x89, + 0x6f,0xb7,0x62,0x0e,0xaa,0x18,0xbe,0x1b, + 0xfc,0x56,0x3e,0x4b,0xc6,0xd2,0x79,0x20, + 0x9a,0xdb,0xc0,0xfe,0x78,0xcd,0x5a,0xf4, + 0x1f,0xdd,0xa8,0x33,0x88,0x07,0xc7,0x31, + 0xb1,0x12,0x10,0x59,0x27,0x80,0xec,0x5f, + 0x60,0x51,0x7f,0xa9,0x19,0xb5,0x4a,0x0d, + 0x2d,0xe5,0x7a,0x9f,0x93,0xc9,0x9c,0xef, + 0xa0,0xe0,0x3b,0x4d,0xae,0x2a,0xf5,0xb0, + 0xc8,0xeb,0xbb,0x3c,0x83,0x53,0x99,0x61, + 0x17,0x2b,0x04,0x7e,0xba,0x77,0xd6,0x26, + 0xe1,0x69,0x14,0x63,0x55,0x21,0x0c,0x7d +}; + +static const unsigned char Rcon[30]= +{ + 0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80, + 0x1b,0x36,0x6c,0xd8,0xab,0x4d,0x9a,0x2f, + 0x5e,0xbc,0x63,0xc6,0x97,0x35,0x6a,0xd4, + 0xb3,0x7d,0xfa,0xef,0xc5,0x91, +}; + +/* ----- static functions ----- */ +static void AES_encrypt(const AES_CTX *ctx, uint32_t *data); +static void AES_decrypt(const AES_CTX *ctx, uint32_t *data); + +/* Perform doubling in Galois Field GF(2^8) using the irreducible polynomial + x^8+x^4+x^3+x+1 */ +static unsigned char AES_xtime(uint32_t x) +{ + return x = (x&0x80) ? (x<<1)^0x1b : x<<1; +} + +/** + * Set up AES with the key/iv and cipher size. + */ +void AES_set_key(AES_CTX *ctx, const uint8_t *key, + const uint8_t *iv, AES_MODE mode) +{ + int i, ii; + uint32_t *W, tmp, tmp2; + const unsigned char *ip; + int words; + + switch (mode) + { + case AES_MODE_128: + i = 10; + words = 4; + break; + + case AES_MODE_256: + i = 14; + words = 8; + break; + + default: /* fail silently */ + return; + } + + ctx->rounds = i; + ctx->key_size = words; + W = ctx->ks; + for (i=0; irounds+1); + for (i = words; i> 8)&0xff]<<16; + tmp2|=(uint32_t)aes_sbox[(tmp>>16)&0xff]<<24; + tmp2|=(uint32_t)aes_sbox[(tmp>>24) ]; + tmp=tmp2^(((unsigned int)*ip)<<24); + ip++; + } + if ((words == 8) && ((i % words) == 4)) + { + tmp2 =(uint32_t)aes_sbox[(tmp )&0xff] ; + tmp2|=(uint32_t)aes_sbox[(tmp>> 8)&0xff]<< 8; + tmp2|=(uint32_t)aes_sbox[(tmp>>16)&0xff]<<16; + tmp2|=(uint32_t)aes_sbox[(tmp>>24) ]<<24; + tmp=tmp2; + } + + W[i]=W[i-words]^tmp; + } + + /* copy the iv across */ + memcpy(ctx->iv, iv, 16); +} + +/** + * Change a key for decryption. + */ +void AES_convert_key(AES_CTX *ctx) +{ + int i; + uint32_t *k,w,t1,t2,t3,t4; + + k = ctx->ks; + k += 4; + for (i=ctx->rounds*4; i>4; i--) + { + w= *k; + w = inv_mix_col(w,t1,t2,t3,t4); + *k++ =w; + } +} + +/** + * Encrypt a byte sequence (with a block size 16) using the AES cipher. + */ +void AES_cbc_encrypt(AES_CTX *ctx, const uint8_t *msg, uint8_t *out, int length) +{ + uint32_t tin0, tin1, tin2, tin3; + uint32_t tout0, tout1, tout2, tout3; + uint32_t tin[4]; + uint32_t *iv = (uint32_t *)ctx->iv; + uint32_t *msg_32 = (uint32_t *)msg; + uint32_t *out_32 = (uint32_t *)out; + + n2l(iv, tout0); + n2l(iv, tout1); + n2l(iv, tout2); + n2l(iv, tout3); + iv -= 4; + + for (length -= 16; length >= 0; length -= 16) + { + n2l(msg_32, tin0); + n2l(msg_32, tin1); + n2l(msg_32, tin2); + n2l(msg_32, tin3); + tin[0] = tin0^tout0; + tin[1] = tin1^tout1; + tin[2] = tin2^tout2; + tin[3] = tin3^tout3; + + AES_encrypt(ctx, tin); + + tout0 = tin[0]; + l2n(tout0, out_32); + tout1 = tin[1]; + l2n(tout1, out_32); + tout2 = tin[2]; + l2n(tout2, out_32); + tout3 = tin[3]; + l2n(tout3, out_32); + } + + l2n(tout0, iv); + l2n(tout1, iv); + l2n(tout2, iv); + l2n(tout3, iv); +} + +/** + * Decrypt a byte sequence (with a block size 16) using the AES cipher. + */ +void AES_cbc_decrypt(AES_CTX *ctx, const uint8_t *msg, uint8_t *out, int length) +{ + uint32_t tin0, tin1, tin2, tin3; + uint32_t xor0,xor1,xor2,xor3; + uint32_t tout0,tout1,tout2,tout3; + uint32_t data[4]; + uint32_t *iv = (uint32_t *)ctx->iv; + uint32_t *msg_32 = (uint32_t *)msg; + uint32_t *out_32 = (uint32_t *)out; + + n2l(iv ,xor0); + n2l(iv, xor1); + n2l(iv, xor2); + n2l(iv, xor3); + iv -= 4; + + for (length-=16; length >= 0; length -= 16) + { + n2l(msg_32, tin0); + n2l(msg_32, tin1); + n2l(msg_32, tin2); + n2l(msg_32, tin3); + + data[0] = tin0; + data[1] = tin1; + data[2] = tin2; + data[3] = tin3; + + AES_decrypt(ctx, data); + + tout0 = data[0]^xor0; + tout1 = data[1]^xor1; + tout2 = data[2]^xor2; + tout3 = data[3]^xor3; + + xor0 = tin0; + xor1 = tin1; + xor2 = tin2; + xor3 = tin3; + + l2n(tout0, out_32); + l2n(tout1, out_32); + l2n(tout2, out_32); + l2n(tout3, out_32); + } + + l2n(xor0, iv); + l2n(xor1, iv); + l2n(xor2, iv); + l2n(xor3, iv); +} + +/** + * Encrypt a single block (16 bytes) of data + */ +static void AES_encrypt(const AES_CTX *ctx, uint32_t *data) +{ + /* To make this code smaller, generate the sbox entries on the fly. + * This will have a really heavy effect upon performance. + */ + uint32_t tmp[4]; + uint32_t tmp1, old_a0, a0, a1, a2, a3, row; + int curr_rnd; + int rounds = ctx->rounds; + const uint32_t *k = ctx->ks; + + /* Pre-round key addition */ + for (row = 0; row < 4; row++) + { + data[row] ^= *(k++); + } + + /* Encrypt one block. */ + for (curr_rnd = 0; curr_rnd < rounds; curr_rnd++) + { + /* Perform ByteSub and ShiftRow operations together */ + for (row = 0; row < 4; row++) + { + a0 = (uint32_t)aes_sbox[(data[row%4]>>24)&0xFF]; + a1 = (uint32_t)aes_sbox[(data[(row+1)%4]>>16)&0xFF]; + a2 = (uint32_t)aes_sbox[(data[(row+2)%4]>>8)&0xFF]; + a3 = (uint32_t)aes_sbox[(data[(row+3)%4])&0xFF]; + + /* Perform MixColumn iff not last round */ + if (curr_rnd < (rounds - 1)) + { + tmp1 = a0 ^ a1 ^ a2 ^ a3; + old_a0 = a0; + + a0 ^= tmp1 ^ AES_xtime(a0 ^ a1); + a1 ^= tmp1 ^ AES_xtime(a1 ^ a2); + a2 ^= tmp1 ^ AES_xtime(a2 ^ a3); + a3 ^= tmp1 ^ AES_xtime(a3 ^ old_a0); + + } + + tmp[row] = ((a0 << 24) | (a1 << 16) | (a2 << 8) | a3); + } + + /* KeyAddition - note that it is vital that this loop is separate from + the MixColumn operation, which must be atomic...*/ + for (row = 0; row < 4; row++) + { + data[row] = tmp[row] ^ *(k++); + } + } +} + +/** + * Decrypt a single block (16 bytes) of data + */ +static void AES_decrypt(const AES_CTX *ctx, uint32_t *data) +{ + uint32_t tmp[4]; + uint32_t xt0,xt1,xt2,xt3,xt4,xt5,xt6; + uint32_t a0, a1, a2, a3, row; + int curr_rnd; + int rounds = ctx->rounds; + uint32_t *k = (uint32_t*)ctx->ks + ((rounds+1)*4); + + /* pre-round key addition */ + for (row=4; row > 0;row--) + { + data[row-1] ^= *(--k); + } + + /* Decrypt one block */ + for (curr_rnd=0; curr_rnd < rounds; curr_rnd++) + { + /* Perform ByteSub and ShiftRow operations together */ + for (row = 4; row > 0; row--) + { + a0 = aes_isbox[(data[(row+3)%4]>>24)&0xFF]; + a1 = aes_isbox[(data[(row+2)%4]>>16)&0xFF]; + a2 = aes_isbox[(data[(row+1)%4]>>8)&0xFF]; + a3 = aes_isbox[(data[row%4])&0xFF]; + + /* Perform MixColumn iff not last round */ + if (curr_rnd<(rounds-1)) + { + /* The MDS cofefficients (0x09, 0x0B, 0x0D, 0x0E) + are quite large compared to encryption; this + operation slows decryption down noticeably. */ + xt0 = AES_xtime(a0^a1); + xt1 = AES_xtime(a1^a2); + xt2 = AES_xtime(a2^a3); + xt3 = AES_xtime(a3^a0); + xt4 = AES_xtime(xt0^xt1); + xt5 = AES_xtime(xt1^xt2); + xt6 = AES_xtime(xt4^xt5); + + xt0 ^= a1^a2^a3^xt4^xt6; + xt1 ^= a0^a2^a3^xt5^xt6; + xt2 ^= a0^a1^a3^xt4^xt6; + xt3 ^= a0^a1^a2^xt5^xt6; + tmp[row-1] = ((xt0<<24)|(xt1<<16)|(xt2<<8)|xt3); + } + else + tmp[row-1] = ((a0<<24)|(a1<<16)|(a2<<8)|a3); + } + + for (row = 4; row > 0; row--) + { + data[row-1] = tmp[row-1] ^ *(--k); + } + } +} + +#endif + diff --git a/ssl/asn1.c b/ssl/asn1.c new file mode 100644 index 0000000000..fa44dfbe63 --- /dev/null +++ b/ssl/asn1.c @@ -0,0 +1,868 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file asn1.c + * + * Some primitive asn methods for extraction rsa modulus information. It also + * is used for retrieving information from X.509 certificates. + */ + +#include +#include +#include +#include +#include "crypto.h" + +#define SIG_OID_PREFIX_SIZE 8 + +#define SIG_TYPE_MD2 0x02 +#define SIG_TYPE_MD5 0x04 +#define SIG_TYPE_SHA1 0x05 + +/* Must be an RSA algorithm with either SHA1 or MD5 for verifying to work */ +static const uint8_t sig_oid_prefix[SIG_OID_PREFIX_SIZE] = +{ + 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01 +}; + +/* CN, O, OU */ +static uint8_t g_dn_types[] = { 3, 10, 11 }; + +static int get_asn1_length(const uint8_t *buf, int *offset) +{ + int len, i; + + if (!(buf[*offset] & 0x80)) /* short form */ + { + len = buf[(*offset)++]; + } + else /* long form */ + { + int length_bytes = buf[(*offset)++]&0x7f; + len = 0; + for (i = 0; i < length_bytes; i++) + { + len <<= 8; + len += buf[(*offset)++]; + } + } + + return len; +} + +/** + * Skip the ASN1.1 object type and its length. Get ready to read the object's + * data. + */ +int asn1_next_obj(const uint8_t *buf, int *offset, int obj_type) +{ + if (buf[*offset] != obj_type) + return X509_NOT_OK; + (*offset)++; + return get_asn1_length(buf, offset); +} + +/** + * Skip over an ASN.1 object type completely. Get ready to read the next + * object. + */ +int asn1_skip_obj(const uint8_t *buf, int *offset, int obj_type) +{ + int len; + + if (buf[*offset] != obj_type) + return X509_NOT_OK; + (*offset)++; + len = get_asn1_length(buf, offset); + *offset += len; + return 0; +} + +/** + * Read an integer value for ASN.1 data + * Note: This function allocates memory which must be freed by the user. + */ +int asn1_get_int(const uint8_t *buf, int *offset, uint8_t **object) +{ + int len; + + if ((len = asn1_next_obj(buf, offset, ASN1_INTEGER)) < 0) + goto end_int_array; + + *object = (uint8_t *)malloc(len); + memcpy(*object, &buf[*offset], len); + *offset += len; + +end_int_array: + return len; +} + +/** + * Get all the RSA private key specifics from an ASN.1 encoded file + */ +int asn1_get_private_key(const uint8_t *buf, int len, RSA_CTX **rsa_ctx) +{ + int offset = 7; + uint8_t *modulus, *priv_exp, *pub_exp; + int mod_len, priv_len, pub_len; +#ifdef CONFIG_BIGINT_CRT + uint8_t *p, *q, *dP, *dQ, *qInv; + int p_len, q_len, dP_len, dQ_len, qInv_len; +#endif + + /* not in der format */ + if (buf[0] != ASN1_SEQUENCE) /* basic sanity check */ + { +#ifdef CONFIG_SSL_FULL_MODE + printf("Error: This is not a valid ASN.1 file\n"); +#endif + return X509_INVALID_PRIV_KEY; + } + + /* initialise the RNG */ + RNG_initialize(buf, len); + + mod_len = asn1_get_int(buf, &offset, &modulus); + pub_len = asn1_get_int(buf, &offset, &pub_exp); + priv_len = asn1_get_int(buf, &offset, &priv_exp); + + if (mod_len <= 0 || pub_len <= 0 || priv_len <= 0) + return X509_INVALID_PRIV_KEY; + +#ifdef CONFIG_BIGINT_CRT + p_len = asn1_get_int(buf, &offset, &p); + q_len = asn1_get_int(buf, &offset, &q); + dP_len = asn1_get_int(buf, &offset, &dP); + dQ_len = asn1_get_int(buf, &offset, &dQ); + qInv_len = asn1_get_int(buf, &offset, &qInv); + + if (p_len <= 0 || q_len <= 0 || dP_len <= 0 || + dQ_len <= 0 || qInv_len <= 0) + return X509_INVALID_PRIV_KEY; + + RSA_priv_key_new(rsa_ctx, + modulus, mod_len, pub_exp, pub_len, priv_exp, priv_len, + p, p_len, q, p_len, dP, dP_len, dQ, dQ_len, qInv, qInv_len); + + free(p); + free(q); + free(dP); + free(dQ); + free(qInv); +#else + RSA_priv_key_new(rsa_ctx, + modulus, mod_len, pub_exp, pub_len, priv_exp, priv_len); +#endif + + free(modulus); + free(priv_exp); + free(pub_exp); + return X509_OK; +} + +/** + * Get the time of a certificate. Ignore hours/minutes/seconds. + */ +static int asn1_get_utc_time(const uint8_t *buf, int *offset, time_t *t) +{ + int ret = X509_NOT_OK, len, t_offset; + struct tm tm; + + if (buf[(*offset)++] != ASN1_UTC_TIME) + goto end_utc_time; + len = get_asn1_length(buf, offset); + t_offset = *offset; + + memset(&tm, 0, sizeof(struct tm)); + tm.tm_year = (buf[t_offset] - '0')*10 + (buf[t_offset+1] - '0'); + if (tm.tm_year <= 50) /* 1951-2050 thing */ + { + tm.tm_year += 100; + } + + tm.tm_mon = (buf[t_offset+2] - '0')*10 + (buf[t_offset+3] - '0') - 1; + tm.tm_mday = (buf[t_offset+4] - '0')*10 + (buf[t_offset+5] - '0'); + *t = mktime(&tm); + *offset += len; + ret = X509_OK; + +end_utc_time: + return ret; +} + +/** + * Get the version type of a certificate (which we don't actually care about) + */ +static int asn1_version(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) +{ + int ret = X509_NOT_OK; + + (*offset) += 2; /* get past explicit tag */ + if (asn1_skip_obj(cert, offset, ASN1_INTEGER)) + goto end_version; + + ret = X509_OK; +end_version: + return ret; +} + +/** + * Retrieve the notbefore and notafter certificate times. + */ +static int asn1_validity(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) +{ + return (asn1_next_obj(cert, offset, ASN1_SEQUENCE) < 0 || + asn1_get_utc_time(cert, offset, &x509_ctx->not_before) || + asn1_get_utc_time(cert, offset, &x509_ctx->not_after)); +} + +/** + * Get the components of a distinguished name + */ +static int asn1_get_oid_x520(const uint8_t *buf, int *offset) +{ + int dn_type = 0; + int len; + + if ((len = asn1_next_obj(buf, offset, ASN1_OID)) < 0) + goto end_oid; + + /* expect a sequence of 2.5.4.[x] where x is a one of distinguished name + components we are interested in. */ + if (len == 3 && buf[(*offset)++] == 0x55 && buf[(*offset)++] == 0x04) + dn_type = buf[(*offset)++]; + else + { + *offset += len; /* skip over it */ + } + +end_oid: + return dn_type; +} + +/** + * Obtain an ASN.1 printable string type. + */ +static int asn1_get_printable_str(const uint8_t *buf, + int *offset, char **str) +{ + int len = X509_NOT_OK; + + /* some certs have this awful crud in them for some reason */ + if (buf[*offset] != ASN1_PRINTABLE_STR && + buf[*offset] != ASN1_TELETEX_STR && + buf[*offset] != ASN1_IA5_STR) + goto end_pnt_str; + + (*offset)++; + len = get_asn1_length(buf, offset); + *str = (char *)malloc(len+1); /* allow for null */ + memcpy(*str, &buf[*offset], len); + (*str)[len] = 0; /* null terminate */ + *offset += len; +end_pnt_str: + return len; +} + +/** + * Get the subject name (or the issuer) of a certificate. + */ +static int asn1_name(const uint8_t *cert, int *offset, char *dn[]) +{ + int ret = X509_NOT_OK; + int dn_type; + char *tmp = NULL; + + if (asn1_next_obj(cert, offset, ASN1_SEQUENCE) < 0) + goto end_name; + + while (asn1_next_obj(cert, offset, ASN1_SET) >= 0) + { + int i, found = 0; + + if (asn1_next_obj(cert, offset, ASN1_SEQUENCE) < 0 || + (dn_type = asn1_get_oid_x520(cert, offset)) < 0) + goto end_name; + + if (asn1_get_printable_str(cert, offset, &tmp) < 0) + { + free(tmp); + goto end_name; + } + + /* find the distinguished named type */ + for (i = 0; i < X509_NUM_DN_TYPES; i++) + { + if (dn_type == g_dn_types[i]) + { + if (dn[i] == NULL) + { + dn[i] = tmp; + found = 1; + break; + } + } + } + + if (found == 0) /* not found so get rid of it */ + { + free(tmp); + } + } + + ret = X509_OK; +end_name: + return ret; +} + +/** + * Read the modulus and public exponent of a certificate. + */ +static int asn1_public_key(const uint8_t *cert, int *offset, + X509_CTX *x509_ctx) +{ + int ret = X509_NOT_OK, mod_len, pub_len; + uint8_t *modulus, *pub_exp; + + if (asn1_next_obj(cert, offset, ASN1_SEQUENCE) < 0 || + asn1_skip_obj(cert, offset, ASN1_SEQUENCE) || + asn1_next_obj(cert, offset, ASN1_BIT_STRING) < 0) + goto end_pub_key; + + (*offset)++; + + if (asn1_next_obj(cert, offset, ASN1_SEQUENCE) < 0) + goto end_pub_key; + + mod_len = asn1_get_int(cert, offset, &modulus); + pub_len = asn1_get_int(cert, offset, &pub_exp); + + RSA_pub_key_new(&x509_ctx->rsa_ctx, + modulus, mod_len, pub_exp, pub_len); + + free(modulus); + free(pub_exp); + ret = X509_OK; + +end_pub_key: + return ret; +} + +#ifdef CONFIG_SSL_CERT_VERIFICATION +/** + * Read the signature of the certificate. + */ +static int asn1_signature(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) +{ + int ret = X509_NOT_OK; + + if (cert[(*offset)++] != ASN1_BIT_STRING) + goto end_sig; + + x509_ctx->sig_len = get_asn1_length(cert, offset); + x509_ctx->signature = (uint8_t *)malloc(x509_ctx->sig_len); + memcpy(x509_ctx->signature, &cert[*offset], x509_ctx->sig_len); + *offset += x509_ctx->sig_len; + ret = X509_OK; + +end_sig: + return ret; +} + +/* + * Compare 2 distinguished name components for equality + * @return 0 if a match + */ +static int asn1_compare_dn_comp(const char *dn1, const char *dn2) +{ + int ret = 1; + + if ((dn1 && dn2 == NULL) || (dn1 == NULL && dn2)) goto err_no_match; + + ret = (dn1 && dn2) ? strcmp(dn1, dn2) : 0; + +err_no_match: + return ret; +} + +/** + * Clean up all of the CA certificates. + */ +void remove_ca_certs(CA_CERT_CTX *ca_cert_ctx) +{ + int i = 0; + + while (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) + { + x509_free(ca_cert_ctx->cert[i]); + ca_cert_ctx->cert[i++] = NULL; + } + + free(ca_cert_ctx); +} + +/* + * Compare 2 distinguished names for equality + * @return 0 if a match + */ +static int asn1_compare_dn(char * const dn1[], char * const dn2[]) +{ + int i; + + for (i = 0; i < X509_NUM_DN_TYPES; i++) + { + if (asn1_compare_dn_comp(dn1[i], dn2[i])) + { + return 1; + } + } + + return 0; /* all good */ +} + +/** + * Retrieve the signature from a certificate. + */ +const uint8_t *x509_get_signature(const uint8_t *asn1_sig, int *len) +{ + int offset = 0; + const uint8_t *ptr = NULL; + + if (asn1_next_obj(asn1_sig, &offset, ASN1_SEQUENCE) < 0 || + asn1_skip_obj(asn1_sig, &offset, ASN1_SEQUENCE)) + goto end_get_sig; + + if (asn1_sig[offset++] != ASN1_OCTET_STRING) + goto end_get_sig; + *len = get_asn1_length(asn1_sig, &offset); + ptr = &asn1_sig[offset]; /* all ok */ + +end_get_sig: + return ptr; +} + +#endif + +/** + * Read the signature type of the certificate. We only support RSA-MD5 and + * RSA-SHA1 signature types. + */ +static int asn1_signature_type(const uint8_t *cert, + int *offset, X509_CTX *x509_ctx) +{ + int ret = X509_NOT_OK, len; + + if (cert[(*offset)++] != ASN1_OID) + goto end_check_sig; + + len = get_asn1_length(cert, offset); + + if (memcmp(sig_oid_prefix, &cert[*offset], SIG_OID_PREFIX_SIZE)) + goto end_check_sig; /* unrecognised cert type */ + + x509_ctx->sig_type = cert[*offset + SIG_OID_PREFIX_SIZE]; + + *offset += len; + if (asn1_skip_obj(cert, offset, ASN1_NULL)) + goto end_check_sig; + ret = X509_OK; + +end_check_sig: + return ret; +} + +/** + * Construct a new x509 object. + * @return 0 if ok. < 0 if there was a problem. + */ +int x509_new(const uint8_t *cert, int *len, X509_CTX **ctx) +{ + int begin_tbs, end_tbs; + int ret = X509_NOT_OK, offset = 0, cert_size = 0; + X509_CTX *x509_ctx; + BI_CTX *bi_ctx; + + *ctx = (X509_CTX *)calloc(1, sizeof(X509_CTX)); + x509_ctx = *ctx; + + /* get the certificate size */ + asn1_skip_obj(cert, &cert_size, ASN1_SEQUENCE); + + if (asn1_next_obj(cert, &offset, ASN1_SEQUENCE) < 0) + goto end_cert; + + begin_tbs = offset; /* start of the tbs */ + end_tbs = begin_tbs; /* work out the end of the tbs */ + asn1_skip_obj(cert, &end_tbs, ASN1_SEQUENCE); + + if (asn1_next_obj(cert, &offset, ASN1_SEQUENCE) < 0) + goto end_cert; + + if (cert[offset] == ASN1_EXPLICIT_TAG) /* optional version */ + { + if (asn1_version(cert, &offset, x509_ctx)) + goto end_cert; + } + + if (asn1_skip_obj(cert, &offset, ASN1_INTEGER) || /* serial number */ + asn1_next_obj(cert, &offset, ASN1_SEQUENCE) < 0) + goto end_cert; + + /* make sure the signature is ok */ + if (asn1_signature_type(cert, &offset, x509_ctx)) + { + ret = X509_VFY_ERROR_UNSUPPORTED_DIGEST; + goto end_cert; + } + + if (asn1_name(cert, &offset, x509_ctx->ca_cert_dn) || + asn1_validity(cert, &offset, x509_ctx) || + asn1_name(cert, &offset, x509_ctx->cert_dn) || + asn1_public_key(cert, &offset, x509_ctx)) + goto end_cert; + + bi_ctx = x509_ctx->rsa_ctx->bi_ctx; + +#ifdef CONFIG_SSL_CERT_VERIFICATION /* only care if doing verification */ + /* use the appropriate signature algorithm (either SHA1 or MD5) */ + if (x509_ctx->sig_type == SIG_TYPE_MD5) + { + MD5_CTX md5_ctx; + uint8_t md5_dgst[MD5_SIZE]; + MD5Init(&md5_ctx); + MD5Update(&md5_ctx, &cert[begin_tbs], end_tbs-begin_tbs); + MD5Final(&md5_ctx, md5_dgst); + x509_ctx->digest = bi_import(bi_ctx, md5_dgst, MD5_SIZE); + } + else if (x509_ctx->sig_type == SIG_TYPE_SHA1) + { + SHA1_CTX sha_ctx; + uint8_t sha_dgst[SHA1_SIZE]; + SHA1Init(&sha_ctx); + SHA1Update(&sha_ctx, &cert[begin_tbs], end_tbs-begin_tbs); + SHA1Final(&sha_ctx, sha_dgst); + x509_ctx->digest = bi_import(bi_ctx, sha_dgst, SHA1_SIZE); + } + + offset = end_tbs; /* skip the v3 data */ + if (asn1_skip_obj(cert, &offset, ASN1_SEQUENCE) || + asn1_signature(cert, &offset, x509_ctx)) + goto end_cert; +#endif + + if (len) + { + *len = cert_size; + } + + ret = X509_OK; +end_cert: + +#ifdef CONFIG_SSL_FULL_MODE + if (ret) + { + printf("Error: Invalid X509 ASN.1 file\n"); + } +#endif + + return ret; +} + +/** + * Free an X.509 object's resources. + */ +void x509_free(X509_CTX *x509_ctx) +{ + X509_CTX *next; + int i; + + if (x509_ctx == NULL) /* if already null, then don't bother */ + return; + + for (i = 0; i < X509_NUM_DN_TYPES; i++) + { + free(x509_ctx->ca_cert_dn[i]); + free(x509_ctx->cert_dn[i]); + } + + free(x509_ctx->signature); + +#ifdef CONFIG_SSL_CERT_VERIFICATION + if (x509_ctx->digest) + { + bi_free(x509_ctx->rsa_ctx->bi_ctx, x509_ctx->digest); + } +#endif + + RSA_free(x509_ctx->rsa_ctx); + + next = x509_ctx->next; + free(x509_ctx); + x509_free(next); /* clear the chain */ +} + +#ifdef CONFIG_SSL_CERT_VERIFICATION +/** + * Do some basic checks on the certificate chain. + * + * Certificate verification consists of a number of checks: + * - A root certificate exists in the certificate store. + * - The date of the certificate is after the start date. + * - The date of the certificate is before the finish date. + * - The certificate chain is valid. + * - That the certificate(s) are not self-signed. + * - The signature of the certificate is valid. + */ +int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) +{ + int ret = X509_OK, i = 0; + bigint *cert_sig; + X509_CTX *next_cert = NULL; + BI_CTX *ctx; + bigint *mod, *expn; + struct timeval tv; + int match_ca_cert = 0; + + if (cert == NULL || ca_cert_ctx == NULL) + { + ret = X509_VFY_ERROR_NO_TRUSTED_CERT; + goto end_verify; + } + + /* last cert in the chain - look for a trusted cert */ + if (cert->next == NULL) + { + while (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) + { + if (asn1_compare_dn(cert->ca_cert_dn, + ca_cert_ctx->cert[i]->cert_dn) == 0) + { + match_ca_cert = 1; + break; + } + + i++; + } + + if (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) + { + next_cert = ca_cert_ctx->cert[i]; + } + else /* trusted cert not found */ + { + ret = X509_VFY_ERROR_NO_TRUSTED_CERT; + goto end_verify; + } + } + else + { + next_cert = cert->next; + } + + gettimeofday(&tv, NULL); + + /* check the not before date */ + if (tv.tv_sec < cert->not_before) + { + ret = X509_VFY_ERROR_NOT_YET_VALID; + goto end_verify; + } + + /* check the not after date */ + if (tv.tv_sec > cert->not_after) + { + ret = X509_VFY_ERROR_EXPIRED; + goto end_verify; + } + + /* check the chain integrity */ + if (asn1_compare_dn(cert->ca_cert_dn, next_cert->cert_dn)) + { + ret = X509_VFY_ERROR_INVALID_CHAIN; + goto end_verify; + } + + /* check for self-signing */ + if (!match_ca_cert && asn1_compare_dn(cert->ca_cert_dn, cert->cert_dn) == 0) + { + ret = X509_VFY_ERROR_SELF_SIGNED; + goto end_verify; + } + + /* check the signature */ + ctx = cert->rsa_ctx->bi_ctx; + mod = next_cert->rsa_ctx->m; + expn = next_cert->rsa_ctx->e; + cert_sig = RSA_sign_verify(ctx, cert->signature, cert->sig_len, + bi_clone(ctx, mod), bi_clone(ctx, expn)); + + if (cert_sig) + { + ret = cert->digest ? /* check the signature */ + bi_compare(cert_sig, cert->digest) : + X509_VFY_ERROR_UNSUPPORTED_DIGEST; + bi_free(ctx, cert_sig); + + if (ret) + goto end_verify; + } + else + { + ret = X509_VFY_ERROR_BAD_SIGNATURE; + goto end_verify; + } + + /* go down the certificate chain using recursion. */ + if (ret == 0 && cert->next) + { + ret = x509_verify(ca_cert_ctx, next_cert); + } + +end_verify: + return ret; +} +#endif + +#if defined (CONFIG_SSL_FULL_MODE) +/** + * Used for diagnostics. + */ +void x509_print(CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) +{ + if (cert == NULL) + return; + + printf("---------------- CERT DEBUG ----------------\n"); + printf("* CA Cert Distinguished Name\n"); + if (cert->ca_cert_dn[X509_COMMON_NAME]) + { + printf("Common Name (CN):\t%s\n", cert->ca_cert_dn[X509_COMMON_NAME]); + } + + if (cert->ca_cert_dn[X509_ORGANIZATION]) + { + printf("Organization (O):\t%s\n", cert->ca_cert_dn[X509_ORGANIZATION]); + } + + if (cert->ca_cert_dn[X509_ORGANIZATIONAL_TYPE]) + { + printf("Organizational Unit (OU): %s\n", + cert->ca_cert_dn[X509_ORGANIZATIONAL_TYPE]); + } + + printf("* Cert Distinguished Name\n"); + if (cert->cert_dn[X509_COMMON_NAME]) + { + printf("Common Name (CN):\t%s\n", cert->cert_dn[X509_COMMON_NAME]); + } + + if (cert->cert_dn[X509_ORGANIZATION]) + { + printf("Organization (O):\t%s\n", cert->cert_dn[X509_ORGANIZATION]); + } + + if (cert->cert_dn[X509_ORGANIZATIONAL_TYPE]) + { + printf("Organizational Unit (OU): %s\n", + cert->cert_dn[X509_ORGANIZATIONAL_TYPE]); + } + + printf("Not Before:\t\t%s", ctime(&cert->not_before)); + printf("Not After:\t\t%s", ctime(&cert->not_after)); + printf("RSA bitsize:\t\t%d\n", cert->rsa_ctx->num_octets*8); + printf("Sig Type:\t\t"); + switch (cert->sig_type) + { + case SIG_TYPE_MD5: + printf("MD5\n"); + break; + case SIG_TYPE_SHA1: + printf("SHA1\n"); + break; + case SIG_TYPE_MD2: + printf("MD2\n"); + break; + default: + printf("Unrecognized: %d\n", cert->sig_type); + break; + } + + printf("Verify:\t\t\t"); + + if (ca_cert_ctx) + { + x509_display_error(x509_verify(ca_cert_ctx, cert)); + } + + printf("\n"); +#if 0 + print_blob("Signature", cert->signature, cert->sig_len); + bi_print("Modulus", cert->rsa_ctx->m); + bi_print("Pub Exp", cert->rsa_ctx->e); +#endif + + if (ca_cert_ctx) + { + x509_print(ca_cert_ctx, cert->next); + } +} + +void x509_display_error(int error) +{ + switch (error) + { + case X509_NOT_OK: + printf("X509 not ok"); + break; + + case X509_VFY_ERROR_NO_TRUSTED_CERT: + printf("No trusted cert is available"); + break; + + case X509_VFY_ERROR_BAD_SIGNATURE: + printf("Bad signature"); + break; + + case X509_VFY_ERROR_NOT_YET_VALID: + printf("Cert is not yet valid"); + break; + + case X509_VFY_ERROR_EXPIRED: + printf("Cert has expired"); + break; + + case X509_VFY_ERROR_SELF_SIGNED: + printf("Cert is self-signed"); + break; + + case X509_VFY_ERROR_INVALID_CHAIN: + printf("Chain is invalid (check order of certs)"); + break; + + case X509_VFY_ERROR_UNSUPPORTED_DIGEST: + printf("Unsupported digest"); + break; + + case X509_INVALID_PRIV_KEY: + printf("Invalid private key"); + break; + } +} +#endif /* CONFIG_SSL_FULL_MODE */ + diff --git a/ssl/bigint.c b/ssl/bigint.c new file mode 100644 index 0000000000..9702dc4fcc --- /dev/null +++ b/ssl/bigint.c @@ -0,0 +1,1508 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @defgroup bigint_api Big Integer API + * @brief The bigint implementation as used by the axTLS project. + * + * The bigint library is for RSA encryption/decryption as well as signing. + * This code tries to minimise use of malloc/free by maintaining a small + * cache. A bigint context may maintain state by being made "permanent". + * It be be later released with a bi_depermanent() and bi_free() call. + * + * It supports the following reduction techniques: + * - Classical + * - Barrett + * - Montgomery + * + * It also implements the following: + * - Karatsuba multiplication + * - Squaring + * - Sliding window exponentiation + * - Chinese Remainder Theorem (implemented in rsa.c). + * + * All the algorithms used are pretty standard, and designed for different + * data bus sizes. Negative numbers are not dealt with at all, so a subtraction + * may need to be tested for negativity. + * + * This library steals some ideas from Jef Poskanzer + * + * and GMP . It gets most of its implementation + * detail from "The Handbook of Applied Cryptography" + * + * @{ + */ + +#include +#include +#include +#include +#include +#include "bigint.h" +#include "crypto.h" + +static bigint *bi_int_multiply(BI_CTX *ctx, bigint *bi, comp i); +static bigint *bi_int_divide(BI_CTX *ctx, bigint *biR, comp denom); +static bigint *alloc(BI_CTX *ctx, int size); +static bigint *trim(bigint *bi); +static void more_comps(bigint *bi, int n); +#if defined(CONFIG_BIGINT_KARATSUBA) || defined(CONFIG_BIGINT_BARRETT) || \ + defined(CONFIG_BIGINT_MONTGOMERY) +static bigint *comp_right_shift(bigint *biR, int num_shifts); +static bigint *comp_left_shift(bigint *biR, int num_shifts); +#endif + +#ifdef CONFIG_BIGINT_CHECK_ON +static void check(const bigint *bi); +#endif + +/** + * @brief Start a new bigint context. + * @return A bigint context. + */ +BI_CTX *bi_initialize(void) +{ + BI_CTX *ctx = (BI_CTX *)calloc(1, sizeof(BI_CTX)); + + ctx->active_list = NULL; + ctx->active_count = 0; + ctx->free_list = NULL; + ctx->free_count = 0; + ctx->mod_offset = 0; +#ifdef CONFIG_BIGINT_MONTGOMERY + ctx->use_classical = 0; +#endif + + /* the radix */ + ctx->bi_radix = alloc(ctx, 2); + ctx->bi_radix->comps[0] = 0; + ctx->bi_radix->comps[1] = 1; + bi_permanent(ctx->bi_radix); + + return ctx; +} + +/** + * @brief Close the bigint context and free any resources. + * + * Free up any used memory - a check is done if all objects were not + * properly freed. + * @param ctx [in] The bigint session context. + */ +void bi_terminate(BI_CTX *ctx) +{ + bigint *p, *pn; + + bi_depermanent(ctx->bi_radix); + bi_free(ctx, ctx->bi_radix); + + if (ctx->active_count != 0) + { +#ifdef CONFIG_SSL_FULL_MODE + printf("bi_terminate: there were %d un-freed bigints\n", + ctx->active_count); +#endif + abort(); + } + + for (p = ctx->free_list; p != NULL; p = pn) + { + pn = p->next; + free(p->comps); + free(p); + } + + free(ctx); +} + +/** + * @brief Increment the number of references to this object. + * It does not do a full copy. + * @param bi [in] The bigint to copy. + * @return A referent to the same bigint. + */ +bigint *bi_copy(bigint *bi) +{ + check(bi); + if (bi->refs != PERMANENT) + bi->refs++; + return bi; +} + +/** + * @brief Simply make a bigint object "unfreeable" if bi_free() is called on it. + * + * For this object to be freed, bi_depermanent() must be called. + * @param bi [in] The bigint to be made permanent. + */ +void bi_permanent(bigint *bi) +{ + check(bi); + if (bi->refs != 1) + { +#ifdef CONFIG_SSL_FULL_MODE + printf("bi_permanent: refs was not 1\n"); +#endif + abort(); + } + + bi->refs = PERMANENT; +} + +/** + * @brief Take a permanent object and make it elligible for freedom. + * @param bi [in] The bigint to be made back to temporary. + */ +void bi_depermanent(bigint *bi) +{ + check(bi); + if (bi->refs != PERMANENT) + { +#ifdef CONFIG_SSL_FULL_MODE + printf("bi_depermanent: bigint was not permanent\n"); +#endif + abort(); + } + + bi->refs = 1; +} + +/** + * @brief Free a bigint object so it can be used again. + * + * The memory itself it not actually freed, just tagged as being available + * @param ctx [in] The bigint session context. + * @param bi [in] The bigint to be freed. + */ +void bi_free(BI_CTX *ctx, bigint *bi) +{ + check(bi); + if (bi->refs == PERMANENT) + { + return; + } + + if (--bi->refs > 0) + { + return; + } + + bi->next = ctx->free_list; + ctx->free_list = bi; + ctx->free_count++; + + if (--ctx->active_count < 0) + { +#ifdef CONFIG_SSL_FULL_MODE + printf("bi_free: active_count went negative " + "- double-freed bigint?\n"); +#endif + abort(); + } +} + +/** + * @brief Convert an (unsigned) integer into a bigint. + * @param ctx [in] The bigint session context. + * @param i [in] The (unsigned) integer to be converted. + * + */ +bigint *int_to_bi(BI_CTX *ctx, comp i) +{ + bigint *biR = alloc(ctx, 1); + biR->comps[0] = i; + return biR; +} + +/** + * @brief Do a full copy of the bigint object. + * @param ctx [in] The bigint session context. + * @param bi [in] The bigint object to be copied. + */ +bigint *bi_clone(BI_CTX *ctx, const bigint *bi) +{ + bigint *biR = alloc(ctx, bi->size); + check(bi); + memcpy(biR->comps, bi->comps, bi->size*COMP_BYTE_SIZE); + return biR; +} + +/** + * @brief Perform an additon operation between two bigints. + * @param ctx [in] The bigint session context. + * @param bia [in] A bigint. + * @param bib [in] Another bigint. + * @return The result of the addition. + */ +bigint *bi_add(BI_CTX *ctx, bigint *bia, bigint *bib) +{ + int n; + comp carry = 0; + comp *pa, *pb; + + check(bia); + check(bib); + + n = max(bia->size, bib->size); + more_comps(bia, n+1); + more_comps(bib, n); + pa = bia->comps; + pb = bib->comps; + + do + { + comp sl, rl, cy1; + sl = *pa + *pb++; + rl = sl + carry; + cy1 = sl < *pa; + carry = cy1 | (rl < sl); + *pa++ = rl; + } while (--n != 0); + + *pa = carry; /* do overflow */ + bi_free(ctx, bib); + return trim(bia); +} + +/** + * @brief Perform a subtraction operation between two bigints. + * @param ctx [in] The bigint session context. + * @param bia [in] A bigint. + * @param bib [in] Another bigint. + * @param is_negative [out] If defined, indicates that the result was negative. + * is_negative may be NULL. + * @return The result of the subtraction. The result is always positive. + */ +bigint *bi_subtract(BI_CTX *ctx, + bigint *bia, bigint *bib, int *is_negative) +{ + int n = bia->size; + comp *pa, *pb, carry = 0; + + check(bia); + check(bib); + + more_comps(bib, n); + pa = bia->comps; + pb = bib->comps; + + do + { + comp sl, rl, cy1; + sl = *pa - *pb++; + rl = sl - carry; + cy1 = sl > *pa; + carry = cy1 | (rl > sl); + *pa++ = rl; + } while (--n != 0); + + if (is_negative) /* indicate a negative result */ + { + *is_negative = carry; + } + + bi_free(ctx, trim(bib)); /* put bib back to the way it was */ + return trim(bia); +} + +/** + * Perform a multiply between a bigint an an (unsigned) integer + */ +static bigint *bi_int_multiply(BI_CTX *ctx, bigint *bia, comp b) +{ + int j = 0, n = bia->size; + bigint *biR = alloc(ctx, n + 1); + comp carry = 0; + comp *r = biR->comps; + comp *a = bia->comps; + + check(bia); + + /* clear things to start with */ + memset(r, 0, ((n+1)*COMP_BYTE_SIZE)); + + do + { + long_comp tmp = *r + (long_comp)a[j]*b + carry; + *r++ = (comp)tmp; /* downsize */ + carry = (comp)(tmp >> COMP_BIT_SIZE); + } while (++j < n); + + *r = carry; + bi_free(ctx, bia); + return trim(biR); +} + +/** + * @brief Does both division and modulo calculations. + * + * Used extensively when doing classical reduction. + * @param ctx [in] The bigint session context. + * @param u [in] A bigint which is the numerator. + * @param v [in] Either the denominator or the modulus depending on the mode. + * @param is_mod [n] Determines if this is a normal division (0) or a reduction + * (1). + * @return The result of the division/reduction. + */ +bigint *bi_divide(BI_CTX *ctx, bigint *u, bigint *v, int is_mod) +{ + int n = v->size, m = u->size-n; + int j = 0, orig_u_size = u->size; + uint8_t mod_offset = ctx->mod_offset; + comp d; + bigint *quotient, *tmp_u; + comp q_dash; + + check(u); + check(v); + + /* if doing reduction and we are < mod, then return mod */ + if (is_mod && bi_compare(v, u) > 0) + { + bi_free(ctx, v); + return u; + } + + quotient = alloc(ctx, m+1); + tmp_u = alloc(ctx, n+1); + v = trim(v); /* make sure we have no leading 0's */ + d = (comp)((long_comp)COMP_RADIX/(V1+1)); + + /* clear things to start with */ + memset(quotient->comps, 0, ((quotient->size)*COMP_BYTE_SIZE)); + + /* normalise */ + if (d > 1) + { + u = bi_int_multiply(ctx, u, d); + + if (is_mod) + { + v = ctx->bi_normalised_mod[mod_offset]; + } + else + { + v = bi_int_multiply(ctx, v, d); + } + } + + if (orig_u_size == u->size) /* new digit position u0 */ + { + more_comps(u, orig_u_size + 1); + } + + do + { + /* get a temporary short version of u */ + memcpy(tmp_u->comps, &u->comps[u->size-n-1-j], (n+1)*COMP_BYTE_SIZE); + + /* calculate q' */ + if (U(0) == V1) + { + q_dash = COMP_RADIX-1; + } + else + { + q_dash = (comp)(((long_comp)U(0)*COMP_RADIX + U(1))/V1); + } + + if (v->size > 1 && V2) + { + /* we are implementing the following + if (V2*q_dash > (((U(0)*COMP_RADIX + U(1) - + q_dash*V1)*COMP_RADIX) + U(2))) ... */ + comp inner = (comp)((long_comp)COMP_RADIX*U(0) + U(1) - + (long_comp)q_dash*V1); + if ((long_comp)V2*q_dash > (long_comp)inner*COMP_RADIX + U(2)) + { + q_dash--; + } + } + + /* multiply and subtract */ + if (q_dash) + { + int is_negative; + tmp_u = bi_subtract(ctx, tmp_u, + bi_int_multiply(ctx, bi_copy(v), q_dash), &is_negative); + more_comps(tmp_u, n+1); + + Q(j) = q_dash; + + /* add back */ + if (is_negative) + { + Q(j)--; + tmp_u = bi_add(ctx, tmp_u, bi_copy(v)); + /* lop off the carry */ + tmp_u->size--; + v->size--; + } + } + else + { + Q(j) = 0; + } + + /* copy back to u */ + memcpy(&u->comps[u->size-n-1-j], tmp_u->comps, (n+1)*COMP_BYTE_SIZE); + } while (++j <= m); + + bi_free(ctx, tmp_u); + bi_free(ctx, v); + + if (is_mod) /* get the remainder */ + { + bi_free(ctx, quotient); + return bi_int_divide(ctx, trim(u), d); + } + else /* get the quotient */ + { + bi_free(ctx, u); + return trim(quotient); + } +} + +/** + * Perform an integer divide on a bigint. + */ +static bigint *bi_int_divide(BI_CTX *ctx, bigint *biR, comp denom) +{ + int i = biR->size - 1; + long_comp r = 0; + + check(biR); + + do + { + r = (r<comps[i]; + biR->comps[i] = (comp)(r / denom); + r %= denom; + } while (--i != 0); + + return trim(biR); +} + +#ifdef CONFIG_BIGINT_MONTGOMERY +/** + * There is a need for the value of integer N' such that B^-1(B-1)-N^-1N'=1, + * where B^-1(B-1) mod N=1. Actually, only the least significant part of + * N' is needed, hence the definition N0'=N' mod b. We reproduce below the + * simple algorithm from an article by Dusse and Kaliski to efficiently + * find N0' from N0 and b */ +static comp modular_inverse(bigint *bim) +{ + int i; + comp t = 1; + comp two_2_i_minus_1 = 2; /* 2^(i-1) */ + long_comp two_2_i = 4; /* 2^i */ + comp N = bim->comps[0]; + + for (i = 2; i <= COMP_BIT_SIZE; i++) + { + if ((long_comp)N*t%two_2_i >= two_2_i_minus_1) + { + t += two_2_i_minus_1; + } + + two_2_i_minus_1 <<= 1; + two_2_i <<= 1; + } + + return (comp)(COMP_RADIX-t); +} +#endif + +#if defined(CONFIG_BIGINT_KARATSUBA) || defined(CONFIG_BIGINT_BARRETT) || \ + defined(CONFIG_BIGINT_MONTGOMERY) +/** + * Take each component and shift down (in terms of components) + */ +static bigint *comp_right_shift(bigint *biR, int num_shifts) +{ + int i = biR->size-num_shifts; + comp *x = biR->comps; + comp *y = &biR->comps[num_shifts]; + + check(biR); + + if (i <= 0) /* have we completely right shifted? */ + { + biR->comps[0] = 0; /* return 0 */ + biR->size = 1; + return biR; + } + + do + { + *x++ = *y++; + } while (--i > 0); + + biR->size -= num_shifts; + return biR; +} + +/** + * Take each component and shift it up (in terms of components) + */ +static bigint *comp_left_shift(bigint *biR, int num_shifts) +{ + int i = biR->size-1; + comp *x, *y; + + check(biR); + + if (num_shifts <= 0) + { + return biR; + } + + more_comps(biR, biR->size + num_shifts); + + x = &biR->comps[i+num_shifts]; + y = &biR->comps[i]; + + do + { + *x-- = *y--; + } while (i--); + + memset(biR->comps, 0, num_shifts*COMP_BYTE_SIZE); /* zero LS comps */ + return biR; +} +#endif + +/** + * @brief Allow a binary sequence to be imported as a bigint. + * @param ctx [in] The bigint session context. + * @param data [in] The data to be converted. + * @param size [in] The number of bytes of data. + * @return A bigint representing this data. + */ +bigint *bi_import(BI_CTX *ctx, const uint8_t *data, int size) +{ + bigint *biR = alloc(ctx, (size+COMP_BYTE_SIZE-1)/COMP_BYTE_SIZE); + int i, j = 0, offset = 0; + + memset(biR->comps, 0, biR->size*COMP_BYTE_SIZE); + + for (i = size-1; i >= 0; i--) + { + biR->comps[offset] += data[i] << (j*8); + + if (++j == COMP_BYTE_SIZE) + { + j = 0; + offset ++; + } + } + + return trim(biR); +} + +#ifdef CONFIG_SSL_FULL_MODE +/** + * @brief The testharness uses this code to import text hex-streams and + * convert them into bigints. + * @param ctx [in] The bigint session context. + * @param data [in] A string consisting of hex characters. The characters must + * be in upper case. + * @return A bigint representing this data. + */ +bigint *bi_str_import(BI_CTX *ctx, const char *data) +{ + int size = strlen(data); + bigint *biR = alloc(ctx, (size+COMP_NUM_NIBBLES-1)/COMP_NUM_NIBBLES); + int i, j = 0, offset = 0; + memset(biR->comps, 0, biR->size*COMP_BYTE_SIZE); + + for (i = size-1; i >= 0; i--) + { + int num = (data[i] <= '9') ? (data[i] - '0') : (data[i] - 'A' + 10); + biR->comps[offset] += num << (j*4); + + if (++j == COMP_NUM_NIBBLES) + { + j = 0; + offset ++; + } + } + + return biR; +} + +void bi_print(const char *label, bigint *x) +{ + int i, j; + + if (x == NULL) + { + printf("%s: (null)\n", label); + return; + } + + printf("%s: (size %d)\n", label, x->size); + for (i = x->size-1; i >= 0; i--) + { + for (j = COMP_NUM_NIBBLES-1; j >= 0; j--) + { + comp mask = 0x0f << (j*4); + comp num = (x->comps[i] & mask) >> (j*4); + putc((num <= 9) ? (num + '0') : (num + 'A' - 10), stdout); + } + } + + printf("\n"); +} +#endif + +/** + * @brief Take a bigint and convert it into a byte sequence. + * + * This is useful after a decrypt operation. + * @param ctx [in] The bigint session context. + * @param x [in] The bigint to be converted. + * @param data [out] The converted data as a byte stream. + * @param size [in] The maximum size of the byte stream. Unused bytes will be + * zeroed. + */ +void bi_export(BI_CTX *ctx, bigint *x, uint8_t *data, int size) +{ + int i, j, k = size-1; + + check(x); + memset(data, 0, size); /* ensure all leading 0's are cleared */ + + for (i = 0; i < x->size; i++) + { + for (j = 0; j < COMP_BYTE_SIZE; j++) + { + comp mask = 0xff << (j*8); + int num = (x->comps[i] & mask) >> (j*8); + data[k--] = num; + + if (k < 0) + { + break; + } + } + } + + bi_free(ctx, x); +} + +/** + * @brief Pre-calculate some of the expensive steps in reduction. + * + * This function should only be called once (normally when a session starts). + * When the session is over, bi_free_mod() should be called. bi_mod_power() + * relies on this function being called. + * @param ctx [in] The bigint session context. + * @param bim [in] The bigint modulus that will be used. + * @param mod_offset [in] There are three moduluii that can be stored - the + * standard modulus, and it's two primes p and q. This offset refers to which + * modulus we are referring to. + * @see bi_free_mod(), bi_mod_power(). + */ +void bi_set_mod(BI_CTX *ctx, bigint *bim, int mod_offset) +{ + int k = bim->size; + comp d = (comp)((long_comp)COMP_RADIX/(bim->comps[k-1]+1)); +#ifdef CONFIG_BIGINT_MONTGOMERY + bigint *R, *R2; +#endif + + ctx->bi_mod[mod_offset] = bim; + bi_permanent(ctx->bi_mod[mod_offset]); + ctx->bi_normalised_mod[mod_offset] = bi_int_multiply(ctx, bim, d); + bi_permanent(ctx->bi_normalised_mod[mod_offset]); + +#if defined(CONFIG_BIGINT_MONTGOMERY) + /* set montgomery variables */ + R = comp_left_shift(bi_clone(ctx, ctx->bi_radix), k-1); /* R */ + R2 = comp_left_shift(bi_clone(ctx, ctx->bi_radix), k*2-1); /* R^2 */ + ctx->bi_RR_mod_m[mod_offset] = bi_mod(ctx, R2); /* R^2 mod m */ + ctx->bi_R_mod_m[mod_offset] = bi_mod(ctx, R); /* R mod m */ + + bi_permanent(ctx->bi_RR_mod_m[mod_offset]); + bi_permanent(ctx->bi_R_mod_m[mod_offset]); + + ctx->N0_dash[mod_offset] = modular_inverse(ctx->bi_mod[mod_offset]); +#elif defined (CONFIG_BIGINT_BARRETT) + ctx->bi_mu[mod_offset] = + bi_divide(ctx, comp_left_shift( + bi_clone(ctx, ctx->bi_radix), k*2-1), ctx->bi_mod[mod_offset], 0); + bi_permanent(ctx->bi_mu[mod_offset]); +#endif +} + +/** + * @brief Used when cleaning various bigints at the end of a session. + * @param ctx [in] The bigint session context. + * @param mod_offset [in] The offset to use. + * @see bi_set_mod(). + */ +void bi_free_mod(BI_CTX *ctx, int mod_offset) +{ + bi_depermanent(ctx->bi_mod[mod_offset]); + bi_free(ctx, ctx->bi_mod[mod_offset]); +#if defined (CONFIG_BIGINT_MONTGOMERY) + bi_depermanent(ctx->bi_RR_mod_m[mod_offset]); + bi_depermanent(ctx->bi_R_mod_m[mod_offset]); + bi_free(ctx, ctx->bi_RR_mod_m[mod_offset]); + bi_free(ctx, ctx->bi_R_mod_m[mod_offset]); +#elif defined(CONFIG_BIGINT_BARRETT) + bi_depermanent(ctx->bi_mu[mod_offset]); + bi_free(ctx, ctx->bi_mu[mod_offset]); +#endif + bi_depermanent(ctx->bi_normalised_mod[mod_offset]); + bi_free(ctx, ctx->bi_normalised_mod[mod_offset]); +} + +/** + * Perform a standard multiplication between two bigints. + */ +static bigint *regular_multiply(BI_CTX *ctx, bigint *bia, bigint *bib) +{ + int i, j, i_plus_j, n = bia->size, t = bib->size; + bigint *biR = alloc(ctx, n + t); + comp *sr = biR->comps; + comp *sa = bia->comps; + comp *sb = bib->comps; + + check(bia); + check(bib); + + /* clear things to start with */ + memset(biR->comps, 0, ((n+t)*COMP_BYTE_SIZE)); + i = 0; + + do + { + comp carry = 0; + comp b = *sb++; + i_plus_j = i; + j = 0; + + do + { + long_comp tmp = sr[i_plus_j] + (long_comp)sa[j]*b + carry; + sr[i_plus_j++] = (comp)tmp; /* downsize */ + carry = (comp)(tmp >> COMP_BIT_SIZE); + } while (++j < n); + + sr[i_plus_j] = carry; + } while (++i < t); + + bi_free(ctx, bia); + bi_free(ctx, bib); + return trim(biR); +} + +#ifdef CONFIG_BIGINT_KARATSUBA +/* + * Karatsuba improves on regular multiplication due to only 3 multiplications + * being done instead of 4. The additional additions/subtractions are O(N) + * rather than O(N^2) and so for big numbers it saves on a few operations + */ +static bigint *karatsuba(BI_CTX *ctx, bigint *bia, bigint *bib, int is_square) +{ + bigint *x0, *x1; + bigint *p0, *p1, *p2; + int m; + + if (is_square) + { + m = (bia->size + 1)/2; + } + else + { + m = (max(bia->size, bib->size) + 1)/2; + } + + x0 = bi_clone(ctx, bia); + x0->size = m; + x1 = bi_clone(ctx, bia); + comp_right_shift(x1, m); + bi_free(ctx, bia); + + /* work out the 3 partial products */ + if (is_square) + { + p0 = bi_square(ctx, bi_copy(x0)); + p2 = bi_square(ctx, bi_copy(x1)); + p1 = bi_square(ctx, bi_add(ctx, x0, x1)); + } + else /* normal multiply */ + { + bigint *y0, *y1; + y0 = bi_clone(ctx, bib); + y0->size = m; + y1 = bi_clone(ctx, bib); + comp_right_shift(y1, m); + bi_free(ctx, bib); + + p0 = bi_multiply(ctx, bi_copy(x0), bi_copy(y0)); + p2 = bi_multiply(ctx, bi_copy(x1), bi_copy(y1)); + p1 = bi_multiply(ctx, bi_add(ctx, x0, x1), bi_add(ctx, y0, y1)); + } + + p1 = bi_subtract(ctx, + bi_subtract(ctx, p1, bi_copy(p2), NULL), bi_copy(p0), NULL); + + comp_left_shift(p1, m); + comp_left_shift(p2, 2*m); + return bi_add(ctx, p1, bi_add(ctx, p0, p2)); +} +#endif + +/** + * @brief Perform a multiplication operation between two bigints. + * @param ctx [in] The bigint session context. + * @param bia [in] A bigint. + * @param bib [in] Another bigint. + * @return The result of the multiplication. + */ +bigint *bi_multiply(BI_CTX *ctx, bigint *bia, bigint *bib) +{ + check(bia); + check(bib); + +#ifdef CONFIG_BIGINT_KARATSUBA + if (min(bia->size, bib->size) < MUL_KARATSUBA_THRESH) + { + return regular_multiply(ctx, bia, bib); + } + + return karatsuba(ctx, bia, bib, 0); +#else + return regular_multiply(ctx, bia, bib); +#endif +} + +#ifdef CONFIG_BIGINT_SQUARE +/* + * Perform the actual square operion. It takes into account overflow + */ +static bigint *regular_square(BI_CTX *ctx, bigint *bi) +{ + int t = bi->size; + int i = 0, j; + bigint *biR = alloc(ctx, t*2); + comp *w = biR->comps; + comp *x = bi->comps; + comp carry; + + memset(w, 0, biR->size*COMP_BYTE_SIZE); + + do + { + long_comp tmp = w[2*i] + (long_comp)x[i]*x[i]; + comp u = 0; + w[2*i] = (comp)tmp; + carry = (comp)(tmp >> COMP_BIT_SIZE); + + for (j = i+1; j < t; j++) + { + long_comp xx = (long_comp)x[i]*x[j]; + long_comp blob = (long_comp)w[i+j]+carry; + + if (u) /* previous overflow */ + { + blob += COMP_RADIX; + } + + u = 0; + if (xx & COMP_BIG_MSB) /* check for overflow */ + { + u = 1; + } + + tmp = 2*xx + blob; + w[i+j] = (comp)tmp; + carry = (comp)(tmp >> COMP_BIT_SIZE); + } + + w[i+t] += carry; + if (u) + { + w[i+t+1] = 1; /* add carry */ + } + } while (++i < t); + + bi_free(ctx, bi); + return trim(biR); +} + +/** + * @brief Perform a square operation on a bigint. + * @param ctx [in] The bigint session context. + * @param bia [in] A bigint. + * @return The result of the multiplication. + */ +bigint *bi_square(BI_CTX *ctx, bigint *bia) +{ + check(bia); + +#ifdef CONFIG_BIGINT_KARATSUBA + if (bia->size < SQU_KARATSUBA_THRESH) + { + return regular_square(ctx, bia); + } + + return karatsuba(ctx, bia, NULL, 1); +#else + return regular_square(ctx, bia); +#endif +} +#endif + +/** + * @brief Compare two bigints. + * @param bia [in] A bigint. + * @param bib [in] Another bigint. + * @return -1 if smaller, 1 if larger and 0 if equal. + */ +int bi_compare(bigint *bia, bigint *bib) +{ + int r, i; + + check(bia); + check(bib); + + if (bia->size > bib->size) + r = 1; + else if (bia->size < bib->size) + r = -1; + else + { + comp *a = bia->comps; + comp *b = bib->comps; + + /* Same number of components. Compare starting from the high end + * and working down. */ + r = 0; + i = bia->size - 1; + + do + { + if (a[i] > b[i]) + { + r = 1; + break; + } + else if (a[i] < b[i]) + { + r = -1; + break; + } + } while (--i >= 0); + } + + return r; +} + +/** + * Allocate and zero more components. Does not consume bi. + */ +static void more_comps(bigint *bi, int n) +{ + if (n > bi->max_comps) + { + bi->max_comps = max(bi->max_comps * 2, n); + bi->comps = (comp*)realloc(bi->comps, bi->max_comps * COMP_BYTE_SIZE); + } + + if (n > bi->size) + { + memset(&bi->comps[bi->size], 0, (n-bi->size)*COMP_BYTE_SIZE); + } + + bi->size = n; +} + +/* + * Make a new empty bigint. It may just use an old one if one is available. + * Otherwise get one of the heap. + */ +static bigint *alloc(BI_CTX *ctx, int size) +{ + bigint *biR; + + /* Can we recycle an old bigint? */ + if (ctx->free_list != NULL) + { + biR = ctx->free_list; + ctx->free_list = biR->next; + ctx->free_count--; + if (biR->refs != 0) + { +#ifdef CONFIG_SSL_FULL_MODE + printf("alloc: refs was not 0\n"); +#endif + abort(); + } + + more_comps(biR, size); + } + else + { + /* No free bigints available - create a new one. */ + biR = (bigint *)malloc(sizeof(bigint)); + biR->comps = (comp*) malloc(size * COMP_BYTE_SIZE); + biR->max_comps = size; /* give some space to spare */ + } + + biR->size = size; + biR->refs = 1; + biR->next = NULL; + ctx->active_count++; + return biR; +} + +/* + * Work out the highest '1' bit in an exponent. Used when doing sliding-window + * exponentiation. + */ +static int find_max_exp_index(bigint *biexp) +{ + int i = COMP_BIT_SIZE-1; + comp shift = COMP_RADIX/2; + comp test = biexp->comps[biexp->size-1]; /* assume no leading zeroes */ + + check(biexp); + + do + { + if (test & shift) + { + return i+(biexp->size-1)*COMP_BIT_SIZE; + } + + shift >>= 1; + } while (--i != 0); + + return -1; /* error - must have been a leading 0 */ +} + +/* + * Is a particular bit is an exponent 1 or 0? Used when doing sliding-window + * exponentiation. + */ +static int exp_bit_is_one(bigint *biexp, int offset) +{ + comp test = biexp->comps[offset / COMP_BIT_SIZE]; + int num_shifts = offset % COMP_BIT_SIZE; + comp shift = 1; + int i; + + check(biexp); + + for (i = 0; i < num_shifts; i++) + { + shift <<= 1; + } + + return test & shift; +} + +#ifdef CONFIG_BIGINT_CHECK_ON +/* + * Perform a sanity check on bi. + */ +static void check(const bigint *bi) +{ + if (bi->refs <= 0) + { + printf("check: zero or negative refs in bigint\n"); + abort(); + } + + if (bi->next != NULL) + { + printf("check: attempt to use a bigint from " + "the free list\n"); + abort(); + } +} +#endif + +/* + * Delete any leading 0's (and allow for 0). + */ +static bigint *trim(bigint *bi) +{ + check(bi); + + while (bi->comps[bi->size-1] == 0 && bi->size > 1) + { + bi->size--; + } + + return bi; +} + +#if defined(CONFIG_BIGINT_MONTGOMERY) +/** + * @brief Perform a single montgomery reduction. + * @param ctx [in] The bigint session context. + * @param bixy [in] A bigint. + * @return The result of the montgomery reduction. + */ +bigint *bi_mont(BI_CTX *ctx, bigint *bixy) +{ + int i = 0, n; + uint8_t mod_offset = ctx->mod_offset; + bigint *bim = ctx->bi_mod[mod_offset]; + comp mod_inv = ctx->N0_dash[mod_offset]; + + check(bixy); + + if (ctx->use_classical) /* just use classical instead */ + { + return bi_mod(ctx, bixy); + } + + n = bim->size; + + do + { + bixy = bi_add(ctx, bixy, comp_left_shift( + bi_int_multiply(ctx, bim, bixy->comps[i]*mod_inv), i)); + } while (++i < n); + + comp_right_shift(bixy, n); + + if (bi_compare(bixy, bim) >= 0) + { + bixy = bi_subtract(ctx, bixy, bim, NULL); + } + + return bixy; +} + +#elif defined(CONFIG_BIGINT_BARRETT) +/* + * Stomp on the most significant components to give the illusion of a "mod base + * radix" operation + */ +static bigint *comp_mod(bigint *bi, int mod) +{ + check(bi); + + if (bi->size > mod) + { + bi->size = mod; + } + + return bi; +} + +/* + * Barrett reduction has no need for some parts of the product, so ignore bits + * of the multiply. This routine gives Barrett its big performance + * improvements over classical/Montgomery reduction methods. + */ +static bigint *partial_multiply(BI_CTX *ctx, bigint *bia, bigint *bib, + int inner_partial, int outer_partial) +{ + int i = 0, j, n = bia->size, t = bib->size; + bigint *biR; + comp carry; + comp *sr, *sa, *sb; + + check(bia); + check(bib); + + biR = alloc(ctx, n + t); + sa = bia->comps; + sb = bib->comps; + sr = biR->comps; + + if (inner_partial) + { + memset(sr, 0, inner_partial*COMP_BYTE_SIZE); + } + else /* outer partial */ + { + if (n < outer_partial || t < outer_partial) /* should we bother? */ + { + bi_free(ctx, bia); + bi_free(ctx, bib); + biR->comps[0] = 0; /* return 0 */ + biR->size = 1; + return biR; + } + + memset(&sr[outer_partial], 0, (n+t-outer_partial)*COMP_BYTE_SIZE); + } + + do + { + comp *a = sa; + comp b = *sb++; + long_comp tmp; + int i_plus_j = i; + carry = 0; + j = n; + + if (outer_partial && i_plus_j < outer_partial) + { + i_plus_j = outer_partial; + a = &sa[outer_partial-i]; + j = n-(outer_partial-i); + } + + do + { + if (inner_partial && i_plus_j >= inner_partial) + { + break; + } + + tmp = sr[i_plus_j] + ((long_comp)*a++)*b + carry; + sr[i_plus_j++] = (comp)tmp; /* downsize */ + carry = (comp)(tmp >> COMP_BIT_SIZE); + } while (--j != 0); + + sr[i_plus_j] = carry; + } while (++i < t); + + bi_free(ctx, bia); + bi_free(ctx, bib); + return trim(biR); +} + +/** + * @brief Perform a single barrett reduction. + * @param ctx [in] The bigint session context. + * @param bi [in] A bigint. + * @return The result of the barrett reduction. + */ +bigint *bi_barrett(BI_CTX *ctx, bigint *bi) +{ + bigint *q1, *q2, *q3, *r1, *r2, *r; + uint8_t mod_offset = ctx->mod_offset; + bigint *bim = ctx->bi_mod[mod_offset]; + int k = bim->size; + + check(bi); + check(bim); + + /* use classical method instead - Barrett cannot help here */ + if (bi->size > k*2) + { + return bi_mod(ctx, bi); + } + + q1 = comp_right_shift(bi_clone(ctx, bi), k-1); + + /* do outer partial multiply */ + q2 = partial_multiply(ctx, q1, ctx->bi_mu[mod_offset], 0, k-1); + q3 = comp_right_shift(q2, k+1); + r1 = comp_mod(bi, k+1); + + /* do inner partial multiply */ + r2 = comp_mod(partial_multiply(ctx, q3, bim, k+1, 0), k+1); + r = bi_subtract(ctx, r1, r2, NULL); + + /* if (r >= m) r = r - m; */ + if (bi_compare(r, bim) >= 0) + { + r = bi_subtract(ctx, r, bim, NULL); + } + + return r; +} +#endif /* CONFIG_BIGINT_BARRETT */ + +#ifdef CONFIG_BIGINT_SLIDING_WINDOW +/* + * Work out g1, g3, g5, g7... etc for the sliding-window algorithm + */ +static void precompute_slide_window(BI_CTX *ctx, int window, bigint *g1) +{ + int k = 1; + int i; + bigint *g2; + + for (i = 0; i < window-1; i++) /* compute 2^(window-1) */ + { + k <<= 1; + } + + ctx->g = (bigint **)malloc(k*sizeof(bigint *)); + ctx->g[0] = bi_clone(ctx, g1); + bi_permanent(ctx->g[0]); + g2 = bi_residue(ctx, bi_square(ctx, ctx->g[0])); /* g^2 */ + + for (i = 1; i < k; i++) + { + ctx->g[i] = bi_residue(ctx, bi_multiply(ctx, ctx->g[i-1], + bi_copy(g2))); + bi_permanent(ctx->g[i]); + } + + bi_free(ctx, g2); + ctx->window = k; +} +#endif + +/** + * @brief Perform a modular exponentiation. + * + * This function requires bi_set_mod() to have been called previously. This is + * one of the optimisations used for performance. + * @param ctx [in] The bigint session context. + * @param bi [in] The bigint on which to perform the mod power operation. + * @param biexp [in] The bigint exponent. + * @see bi_set_mod(). + */ +bigint *bi_mod_power(BI_CTX *ctx, bigint *bi, bigint *biexp) +{ + int i = find_max_exp_index(biexp), j, window_size = 1; + bigint *biR = int_to_bi(ctx, 1); + +#if defined(CONFIG_BIGINT_MONTGOMERY) + uint8_t mod_offset = ctx->mod_offset; + if (!ctx->use_classical) + { + /* preconvert */ + bi = bi_residue(ctx, + bi_multiply(ctx, bi, ctx->bi_RR_mod_m[mod_offset])); /* x' */ + bi_free(ctx, biR); + biR = ctx->bi_R_mod_m[mod_offset]; + } +#endif + + check(bi); + check(biexp); + +#ifdef CONFIG_BIGINT_SLIDING_WINDOW + for (j = i; j > 32; j /= 5) /* work out an optimum size */ + { + window_size++; + } + + /* work out the slide constants */ + precompute_slide_window(ctx, window_size, bi); +#else /* just one constant */ + ctx->g = (bigint **)malloc(sizeof(bigint *)); + ctx->g[0] = bi_clone(ctx, bi); + ctx->window = 1; + bi_permanent(ctx->g[0]); +#endif + + /* if sliding-window is off, then only one bit will be done at a time and + * will reduce to standard left-to-right exponentiation */ + do + { + if (exp_bit_is_one(biexp, i)) + { + int l = i-window_size+1; + int part_exp = 0; + + if (l < 0) /* LSB of exponent will always be 1 */ + { + l = 0; + } + else + { + while (exp_bit_is_one(biexp, l) == 0) + { + l++; /* go back up */ + } + } + + /* build up the section of the exponent */ + for (j = i; j >= l; j--) + { + biR = bi_residue(ctx, bi_square(ctx, biR)); + if (exp_bit_is_one(biexp, j)) + part_exp++; + + if (j != l) + part_exp <<= 1; + } + + part_exp = (part_exp-1)/2; /* adjust for array */ + biR = bi_residue(ctx, + bi_multiply(ctx, biR, ctx->g[part_exp])); + i = l-1; + } + else /* square it */ + { + biR = bi_residue(ctx, bi_square(ctx, biR)); + i--; + } + } while (i >= 0); + + /* cleanup */ + for (i = 0; i < ctx->window; i++) + { + bi_depermanent(ctx->g[i]); + bi_free(ctx, ctx->g[i]); + } + + free(ctx->g); + bi_free(ctx, bi); + bi_free(ctx, biexp); +#if defined CONFIG_BIGINT_MONTGOMERY + return ctx->use_classical ? biR : bi_mont(ctx, biR); /* convert back */ +#else /* CONFIG_BIGINT_CLASSICAL or CONFIG_BIGINT_BARRETT */ + return biR; +#endif +} + +#ifdef CONFIG_SSL_CERT_VERIFICATION +/** + * @brief Perform a modular exponentiation using a temporary modulus. + * + * We need this function to check the signatures of certificates. The modulus + * of this function is temporary as it's just used for authentication. + * @param ctx [in] The bigint session context. + * @param bi [in] The bigint to perform the exp/mod. + * @param bim [in] The temporary modulus. + * @param biexp [in] The bigint exponent. + * @see bi_set_mod(). + */ +bigint *bi_mod_power2(BI_CTX *ctx, bigint *bi, bigint *bim, bigint *biexp) +{ + bigint *biR, *tmp_biR; + + /* Set up a temporary bigint context and transfer what we need between + * them. We need to do this since we want to keep the original modulus + * which is already in this context. This operation is only called when + * doing peer verification, and so is not expensive :-) */ + BI_CTX *tmp_ctx = bi_initialize(); + bi_set_mod(tmp_ctx, bi_clone(tmp_ctx, bim), BIGINT_M_OFFSET); + tmp_biR = bi_mod_power(tmp_ctx, + bi_clone(tmp_ctx, bi), + bi_clone(tmp_ctx, biexp)); + biR = bi_clone(ctx, tmp_biR); + bi_free(tmp_ctx, tmp_biR); + bi_free_mod(tmp_ctx, BIGINT_M_OFFSET); + bi_terminate(tmp_ctx); + + bi_free(ctx, bi); + bi_free(ctx, bim); + bi_free(ctx, biexp); + return biR; +} +#endif +/** @} */ diff --git a/ssl/bigint.h b/ssl/bigint.h new file mode 100644 index 0000000000..c98b3837d0 --- /dev/null +++ b/ssl/bigint.h @@ -0,0 +1,97 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#ifndef BIGINT_HEADER +#define BIGINT_HEADER + +#include "config.h" + +/* enable features based on a 'super-set' capbaility. */ +#if defined(CONFIG_SSL_FULL_MODE) +#define CONFIG_SSL_ENABLE_CLIENT +#define CONFIG_SSL_CERT_VERIFICATION +#elif defined(CONFIG_SSL_ENABLE_CLIENT) +#define CONFIG_SSL_CERT_VERIFICATION +#endif + +#if !defined(CONFIG_BIGINT_MONTGOMERY) || !defined(CONFIG_BIGINT_BARRETT) +#define CONFIG_BIGINT_CLASSICAL 1 +#endif + +#include "os_port.h" +#include "bigint_impl.h" + +#ifndef CONFIG_BIGINT_CHECK_ON +#define check(A) /**< disappears in normal production mode */ +#endif +BI_CTX *bi_initialize(void); +void bi_terminate(BI_CTX *ctx); +void bi_permanent(bigint *bi); +void bi_depermanent(bigint *bi); +void bi_free(BI_CTX *ctx, bigint *bi); +bigint *bi_copy(bigint *bi); +bigint *bi_clone(BI_CTX *ctx, const bigint *bi); +void bi_export(BI_CTX *ctx, bigint *bi, uint8_t *data, int size); +bigint *bi_import(BI_CTX *ctx, const uint8_t *data, int len); +bigint *int_to_bi(BI_CTX *ctx, comp i); + +/* the functions that actually do something interesting */ +bigint *bi_add(BI_CTX *ctx, bigint *bia, bigint *bib); +bigint *bi_subtract(BI_CTX *ctx, bigint *bia, + bigint *bib, int *is_negative); +bigint *bi_divide(BI_CTX *ctx, bigint *bia, bigint *bim, int is_mod); +bigint *bi_multiply(BI_CTX *ctx, bigint *bia, bigint *bib); +bigint *bi_mod_power(BI_CTX *ctx, bigint *bi, bigint *biexp); +bigint *bi_mod_power2(BI_CTX *ctx, bigint *bi, bigint *bim, bigint *biexp); +int bi_compare(bigint *bia, bigint *bib); +void bi_set_mod(BI_CTX *ctx, bigint *bim, int mod_offset); +void bi_free_mod(BI_CTX *ctx, int mod_offset); + +#ifdef CONFIG_SSL_FULL_MODE +void bi_print(const char *label, bigint *bi); +bigint *bi_str_import(BI_CTX *ctx, const char *data); +#endif + +/** + * @def bi_mod + * Find the residue of B. bi_set_mod() must be called before hand. + */ +#define bi_mod(A, B) bi_divide(A, B, ctx->bi_mod[ctx->mod_offset], 1) + +/** + * bi_residue() is technically the same as bi_mod(), but it uses the + * appropriate reduction technique (which is bi_mod() when doing classical + * reduction). + */ +#if defined(CONFIG_BIGINT_CLASSICAL) +#define bi_residue(A, B) bi_mod(A, B) +#elif defined(CONFIG_BIGINT_BARRETT) +#define bi_residue(A, B) bi_barrett(A, B) +bigint *bi_barrett(BI_CTX *ctx, bigint *bi); +#else /* CONFIG_BIGINT_MONTGOMERY */ +#define bi_residue(A, B) bi_mont(A, B) +bigint *bi_mont(BI_CTX *ctx, bigint *bixy); +#endif + +#ifdef CONFIG_BIGINT_SQUARE +bigint *bi_square(BI_CTX *ctx, bigint *bi); +#else +#define bi_square(A, B) bi_multiply(A, bi_copy(B), B) +#endif + +#endif diff --git a/ssl/bigint_impl.h b/ssl/bigint_impl.h new file mode 100644 index 0000000000..1897fec16d --- /dev/null +++ b/ssl/bigint_impl.h @@ -0,0 +1,106 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#ifndef BIGINT_IMPL_HEADER +#define BIGINT_IMPL_HEADER + +/* Maintain a number of precomputed variables when doing reduction */ +#define BIGINT_M_OFFSET 0 /**< Normal modulo offset. */ +#ifdef CONFIG_BIGINT_CRT +#define BIGINT_P_OFFSET 1 /**< p modulo offset. */ +#define BIGINT_Q_OFFSET 2 /**< q module offset. */ +#define BIGINT_NUM_MODS 3 /**< The number of modulus constants used. */ +#else +#define BIGINT_NUM_MODS 1 +#endif + +/* Architecture specific functions for big ints */ +#ifdef WIN32 +#define COMP_RADIX 4294967296i64 +#define COMP_BIG_MSB 0x8000000000000000i64 +#else +#define COMP_RADIX 4294967296ULL /**< Max component + 1 */ +#define COMP_BIG_MSB 0x8000000000000000ULL /**< (Max dbl comp + 1)/ 2 */ +#endif +#define COMP_BIT_SIZE 32 /**< Number of bits in a component. */ +#define COMP_BYTE_SIZE 4 /**< Number of bytes in a component. */ +#define COMP_NUM_NIBBLES 8 /**< Used For diagnostics only. */ + +typedef uint32_t comp; /**< A single precision component. */ +typedef uint64_t long_comp; /**< A double precision component. */ +typedef int64_t slong_comp; /**< A signed double precision component. */ + +/** + * @struct _bigint + * @brief A big integer basic object + */ +struct _bigint +{ + struct _bigint* next; /**< The next bigint in the cache. */ + short size; /**< The number of components in this bigint. */ + short max_comps; /**< The heapsize allocated for this bigint */ + int refs; /**< An internal reference count. */ + comp* comps; /**< A ptr to the actual component data */ +}; + +typedef struct _bigint bigint; /**< An alias for _bigint */ + +/** + * Maintains the state of the cache, and a number of variables used in + * reduction. + */ +typedef struct /**< A big integer "session" context. */ +{ + bigint *active_list; /**< Bigints currently used. */ + bigint *free_list; /**< Bigints not used. */ + bigint *bi_radix; /**< The radix used. */ + bigint *bi_mod[BIGINT_NUM_MODS]; /**< modulus */ + +#if defined(CONFIG_BIGINT_MONTGOMERY) + bigint *bi_RR_mod_m[BIGINT_NUM_MODS]; /**< R^2 mod m */ + bigint *bi_R_mod_m[BIGINT_NUM_MODS]; /**< R mod m */ + comp N0_dash[BIGINT_NUM_MODS]; +#elif defined(CONFIG_BIGINT_BARRETT) + bigint *bi_mu[BIGINT_NUM_MODS]; /**< Storage for mu */ +#endif + bigint *bi_normalised_mod[BIGINT_NUM_MODS]; /**< Normalised mod storage. */ + bigint **g; /**< Used by sliding-window. */ + int window; /**< The size of the sliding window */ + + int active_count; /**< Number of active bigints. */ + int free_count; /**< Number of free bigints. */ + +#ifdef CONFIG_BIGINT_MONTGOMERY + uint8_t use_classical; /**< Use classical reduction. */ +#endif + uint8_t mod_offset; /**< The mod offset we are using */ +} BI_CTX; + +#ifndef WIN32 +#define max(a,b) ((a)>(b)?(a):(b)) /**< Find the maximum of 2 numbers. */ +#define min(a,b) ((a)<(b)?(a):(b)) /**< Find the minimum of 2 numbers. */ +#endif + +#define PERMANENT 0x7FFF55AA /**< A magic number for permanents. */ + +#define V1 v->comps[v->size-1] /**< v1 for division */ +#define V2 v->comps[v->size-2] /**< v2 for division */ +#define U(j) tmp_u->comps[tmp_u->size-j-1] /**< uj for division */ +#define Q(j) quotient->comps[quotient->size-j-1] /**< qj for division */ + +#endif diff --git a/ssl/cert.h b/ssl/cert.h new file mode 100644 index 0000000000..21697abaa6 --- /dev/null +++ b/ssl/cert.h @@ -0,0 +1,37 @@ +unsigned char default_certificate[] = { + 0x30, 0x82, 0x01, 0x92, 0x30, 0x81, 0xfc, 0x02, 0x09, 0x00, 0xf1, 0xc3, + 0x87, 0xc0, 0xd4, 0xf4, 0x57, 0xc2, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, + 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x34, 0x31, + 0x32, 0x30, 0x30, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x29, 0x61, 0x78, + 0x54, 0x4c, 0x53, 0x20, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x20, + 0x44, 0x6f, 0x64, 0x67, 0x79, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, + 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, + 0x69, 0x74, 0x79, 0x30, 0x1e, 0x17, 0x0d, 0x30, 0x36, 0x30, 0x36, 0x30, + 0x37, 0x31, 0x31, 0x34, 0x34, 0x33, 0x32, 0x5a, 0x17, 0x0d, 0x33, 0x33, + 0x31, 0x30, 0x32, 0x33, 0x31, 0x31, 0x34, 0x34, 0x33, 0x32, 0x5a, 0x30, + 0x2c, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0d, + 0x61, 0x78, 0x54, 0x4c, 0x53, 0x20, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, + 0x74, 0x31, 0x12, 0x30, 0x10, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x09, + 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x30, 0x5c, 0x30, + 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, + 0x05, 0x00, 0x03, 0x4b, 0x00, 0x30, 0x48, 0x02, 0x41, 0x00, 0xd1, 0x3b, + 0x30, 0x5f, 0xa9, 0x01, 0x42, 0x3d, 0x86, 0x6d, 0x72, 0xbe, 0x40, 0x6e, + 0x51, 0xc1, 0x49, 0x7f, 0x57, 0x75, 0xa1, 0x2d, 0x36, 0xe5, 0xc1, 0x3d, + 0x0f, 0x20, 0x1a, 0xd1, 0x23, 0x6d, 0xfa, 0x74, 0xd2, 0x3e, 0x23, 0xb0, + 0x70, 0xfc, 0xa0, 0x6a, 0xde, 0xec, 0x41, 0x88, 0x84, 0xfe, 0x54, 0x15, + 0x6b, 0x61, 0xc5, 0x16, 0x62, 0xb8, 0x93, 0x41, 0xf1, 0x4f, 0x3d, 0xff, + 0x2e, 0xbd, 0x02, 0x03, 0x01, 0x00, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, + 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x81, + 0x81, 0x00, 0x0a, 0x45, 0x3e, 0x8b, 0xc0, 0x5a, 0xf5, 0xc5, 0xe7, 0x49, + 0x6f, 0x8a, 0xab, 0xbe, 0x30, 0x7e, 0x13, 0x05, 0x7f, 0xd2, 0x9e, 0x13, + 0x34, 0xd5, 0xd4, 0x4b, 0xd4, 0xb7, 0xd2, 0xb3, 0x12, 0x16, 0xf4, 0x5a, + 0xaf, 0xb5, 0x71, 0xbc, 0xb3, 0xf5, 0x96, 0x96, 0x23, 0xf4, 0xf4, 0x75, + 0x24, 0x64, 0x99, 0x30, 0x6f, 0xc1, 0xea, 0x14, 0x78, 0xca, 0xe9, 0x85, + 0x46, 0x3c, 0x1e, 0x97, 0xd1, 0x4f, 0x80, 0xd7, 0x16, 0x09, 0x6e, 0x03, + 0x5c, 0x05, 0xaa, 0xcf, 0x75, 0x10, 0x17, 0xba, 0x19, 0xb4, 0x92, 0xfa, + 0x2b, 0xe5, 0xc9, 0xa5, 0x0d, 0x20, 0xc0, 0x2f, 0x8d, 0xc5, 0xcf, 0x91, + 0x44, 0x63, 0x4b, 0x32, 0x52, 0xbb, 0x74, 0xb8, 0xaa, 0x16, 0x1f, 0xd5, + 0xa9, 0x92, 0xde, 0x8f, 0x95, 0xf2, 0xf7, 0x73, 0x34, 0x27, 0x26, 0x41, + 0x88, 0xb5, 0x7c, 0xf0, 0xff, 0x9c, 0xd3, 0xc8, 0x1d, 0xec +}; +unsigned int default_certificate_len = 406; diff --git a/ssl/crypto.h b/ssl/crypto.h new file mode 100644 index 0000000000..df25e64029 --- /dev/null +++ b/ssl/crypto.h @@ -0,0 +1,292 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file crypto.h + */ + +#ifndef HEADER_CRYPTO_H +#define HEADER_CRYPTO_H + +#ifdef __cplusplus +extern "C" { +#endif + +#include "bigint.h" + +/************************************************************************** + * AES declarations + **************************************************************************/ + +#define AES_MAXROUNDS 14 + +typedef struct aes_key_st +{ + uint16_t rounds; + uint16_t key_size; + uint32_t ks[(AES_MAXROUNDS+1)*8]; + uint8_t iv[16]; +} AES_CTX; + +typedef enum +{ + AES_MODE_128, + AES_MODE_256 +} AES_MODE; + +void AES_set_key(AES_CTX *ctx, const uint8_t *key, + const uint8_t *iv, AES_MODE mode); +void AES_cbc_encrypt(AES_CTX *ctx, const uint8_t *msg, + uint8_t *out, int length); +void AES_cbc_decrypt(AES_CTX *ks, const uint8_t *in, uint8_t *out, int length); +void AES_convert_key(AES_CTX *ctx); + +/************************************************************************** + * RC4 declarations + **************************************************************************/ + +typedef struct +{ + int x, y, m[256]; +} RC4_CTX; + +void RC4_setup(RC4_CTX *s, const uint8_t *key, int length); +void RC4_crypt(RC4_CTX *s, const uint8_t *msg, uint8_t *data, int length); + +/************************************************************************** + * SHA1 declarations + **************************************************************************/ + +#define SHA1_SIZE 20 + +/* + * This structure will hold context information for the SHA-1 + * hashing operation + */ +typedef struct +{ + uint32_t Intermediate_Hash[SHA1_SIZE/4]; /* Message Digest */ + uint32_t Length_Low; /* Message length in bits */ + uint32_t Length_High; /* Message length in bits */ + uint16_t Message_Block_Index; /* Index into message block array */ + uint8_t Message_Block[64]; /* 512-bit message blocks */ +} SHA1_CTX; + +void SHA1Init(SHA1_CTX *); +void SHA1Update(SHA1_CTX *, const uint8_t * msg, int len); +void SHA1Final(SHA1_CTX *, uint8_t *digest); + +/************************************************************************** + * MD5 declarations + **************************************************************************/ + +/* MD5 context. */ + +#define MD5_SIZE 16 + +typedef struct +{ + uint32_t state[4]; /* state (ABCD) */ + uint32_t count[2]; /* number of bits, modulo 2^64 (lsb first) */ + uint8_t buffer[64]; /* input buffer */ +} MD5_CTX; + +void MD5Init(MD5_CTX *); +void MD5Update(MD5_CTX *, const uint8_t *msg, int len); +void MD5Final(MD5_CTX *, uint8_t *digest); + +/************************************************************************** + * HMAC declarations + **************************************************************************/ +void hmac_md5(const uint8_t *msg, int length, const uint8_t *key, + int key_len, uint8_t *digest); +void hmac_sha1(const uint8_t *msg, int length, const uint8_t *key, + int key_len, uint8_t *digest); + +/************************************************************************** + * RNG declarations + **************************************************************************/ +void RNG_initialize(const uint8_t *seed_buf, int size); +void RNG_terminate(void); +void get_random(int num_rand_bytes, uint8_t *rand_data); +void get_random_NZ(int num_rand_bytes, uint8_t *rand_data); + +/************************************************************************** + * RSA declarations + **************************************************************************/ + +typedef struct +{ + bigint *m; /* modulus */ + bigint *e; /* public exponent */ + bigint *d; /* private exponent */ +#ifdef CONFIG_BIGINT_CRT + bigint *p; /* p as in m = pq */ + bigint *q; /* q as in m = pq */ + bigint *dP; /* d mod (p-1) */ + bigint *dQ; /* d mod (q-1) */ + bigint *qInv; /* q^-1 mod p */ +#endif + int num_octets; + bigint *sig_m; /* signature modulus */ + BI_CTX *bi_ctx; +} RSA_CTX; + +void RSA_priv_key_new(RSA_CTX **rsa_ctx, + const uint8_t *modulus, int mod_len, + const uint8_t *pub_exp, int pub_len, + const uint8_t *priv_exp, int priv_len +#ifdef CONFIG_BIGINT_CRT + , const uint8_t *p, int p_len, + const uint8_t *q, int q_len, + const uint8_t *dP, int dP_len, + const uint8_t *dQ, int dQ_len, + const uint8_t *qInv, int qInv_len +#endif + ); +void RSA_pub_key_new(RSA_CTX **rsa_ctx, + const uint8_t *modulus, int mod_len, + const uint8_t *pub_exp, int pub_len); +void RSA_free(RSA_CTX *ctx); +int RSA_decrypt(RSA_CTX *ctx, const uint8_t *in_data, uint8_t *out_data, + int is_decryption); +bigint *RSA_private(RSA_CTX *c, bigint *bi_msg); +#ifdef CONFIG_SSL_CERT_VERIFICATION +bigint *RSA_raw_sign_verify(RSA_CTX *c, bigint *bi_msg); +bigint *RSA_sign_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, + bigint *modulus, bigint *pub_exp); +bigint *RSA_public(RSA_CTX *c, bigint *bi_msg); +int RSA_encrypt(RSA_CTX *ctx, const uint8_t *in_data, uint16_t in_len, + uint8_t *out_data, int is_signing); +void RSA_print(const RSA_CTX *ctx); +#endif + +/************************************************************************** + * ASN1 declarations + **************************************************************************/ +#define X509_OK 0 +#define X509_NOT_OK -1 +#define X509_VFY_ERROR_NO_TRUSTED_CERT -2 +#define X509_VFY_ERROR_BAD_SIGNATURE -3 +#define X509_VFY_ERROR_NOT_YET_VALID -4 +#define X509_VFY_ERROR_EXPIRED -5 +#define X509_VFY_ERROR_SELF_SIGNED -6 +#define X509_VFY_ERROR_INVALID_CHAIN -7 +#define X509_VFY_ERROR_UNSUPPORTED_DIGEST -8 +#define X509_INVALID_PRIV_KEY -9 + +/* + * The Distinguished Name + */ +#define X509_NUM_DN_TYPES 3 +#define X509_COMMON_NAME 0 +#define X509_ORGANIZATION 1 +#define X509_ORGANIZATIONAL_TYPE 2 + +#define ASN1_INTEGER 0x02 +#define ASN1_BIT_STRING 0x03 +#define ASN1_OCTET_STRING 0x04 +#define ASN1_NULL 0x05 +#define ASN1_OID 0x06 +#define ASN1_PRINTABLE_STR 0x13 +#define ASN1_TELETEX_STR 0x14 +#define ASN1_IA5_STR 0x16 +#define ASN1_UTC_TIME 0x17 +#define ASN1_SEQUENCE 0x30 +#define ASN1_SET 0x31 +#define ASN1_IMPLICIT_TAG 0x80 +#define ASN1_EXPLICIT_TAG 0xa0 + +#define SALT_SIZE 8 + +struct _x509_ctx +{ + char *ca_cert_dn[X509_NUM_DN_TYPES]; + char *cert_dn[X509_NUM_DN_TYPES]; +#if defined(_WIN32_WCE) + long not_before; + long not_after; +#else + time_t not_before; + time_t not_after; +#endif + uint8_t *signature; + uint16_t sig_len; + uint8_t sig_type; + RSA_CTX *rsa_ctx; + bigint *digest; + struct _x509_ctx *next; +}; + +typedef struct _x509_ctx X509_CTX; + +#ifdef CONFIG_SSL_CERT_VERIFICATION +typedef struct +{ + X509_CTX *cert[CONFIG_X509_MAX_CA_CERTS]; +} CA_CERT_CTX; +#endif + +int asn1_get_private_key(const uint8_t *buf, int len, RSA_CTX **rsa_ctx); +int asn1_next_obj(const uint8_t *buf, int *offset, int obj_type); +int asn1_skip_obj(const uint8_t *buf, int *offset, int obj_type); +int asn1_get_int(const uint8_t *buf, int *offset, uint8_t **object); +int x509_new(const uint8_t *cert, int *len, X509_CTX **ctx); +void x509_free(X509_CTX *x509_ctx); +#ifdef CONFIG_SSL_CERT_VERIFICATION +int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert); +const uint8_t *x509_get_signature(const uint8_t *asn1_signature, int *len); +#endif +#ifdef CONFIG_SSL_FULL_MODE +void x509_print(CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert); +void x509_display_error(int error); +#endif + +/************************************************************************** + * MISC declarations + **************************************************************************/ + +extern const char * const unsupported_str; + +typedef void (*crypt_func)(void *, const uint8_t *, uint8_t *, int); +typedef void (*hmac_func)(const uint8_t *msg, int length, const uint8_t *key, + int key_len, uint8_t *digest); + +typedef struct +{ + uint8_t *data; + int max_len; + int index; +} BUF_MEM; + +BUF_MEM buf_new(void); +void buf_grow(BUF_MEM *bm, int len); +void buf_free(BUF_MEM *bm); +int get_file(const char *filename, uint8_t **buf); + +#if defined(CONFIG_SSL_FULL_MODE) || defined(WIN32) || defined(CONFIG_DEBUG) +void print_blob(const char *format, const uint8_t *data, int size, ...); +#else + #define print_blob(...) +#endif + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/ssl/crypto_misc.c b/ssl/crypto_misc.c new file mode 100644 index 0000000000..b98181f025 --- /dev/null +++ b/ssl/crypto_misc.c @@ -0,0 +1,307 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file misc.c + * + * Some misc. routines to help things out + */ + +#include +#include +#include +#include +#include "crypto.h" +#ifdef CONFIG_WIN32_USE_CRYPTO_LIB +#include "wincrypt.h" +#endif + +#ifndef WIN32 +static int rng_fd = -1; +#elif defined(CONFIG_WIN32_USE_CRYPTO_LIB) +static HCRYPTPROV gCryptProv; +#endif + +#if (!defined(CONFIG_USE_DEV_URANDOM) && !defined(CONFIG_WIN32_USE_CRYPTO_LIB)) +static uint64_t rng_num; +#endif + +static int rng_ref_count; +const char * const unsupported_str = "Error: feature not supported\n"; + +/** + * Allocate a new memory buffer + */ +BUF_MEM buf_new() +{ + BUF_MEM bm; + bm.data = (uint8_t *)malloc(2048); /* should be enough to start with */ + bm.max_len = 2048; + bm.index = 0; + return bm; +} + +/** + * Grow a buffer if necessary + */ +void buf_grow(BUF_MEM *bm, int len) +{ + if (len <= bm->max_len) + { + return; + } + + bm->data = (uint8_t *)realloc(bm->data, len+1024); /* just to be sure */ + bm->max_len = len+1024; +} + +/** + * Free a buffer + */ +void buf_free(BUF_MEM *bm) +{ + free(bm->data); + bm->data = NULL; +} + +#ifndef CONFIG_SSL_SKELETON_MODE +/** + * Retrieve a file and put it into memory + * @return The size of the file, or -1 on failure. + */ +int get_file(const char *filename, uint8_t **buf) +{ + int total_bytes = 0; + int bytes_read = 0; + int filesize; + FILE *stream = fopen(filename, "rb"); + + if (stream == NULL) + { + return -1; + } + + /* Win CE doesn't support stat() */ + fseek(stream, 0, SEEK_END); + filesize = ftell(stream); + *buf = (uint8_t *)malloc(filesize); + fseek(stream, 0, SEEK_SET); + + do + { + bytes_read = fread(*buf+total_bytes, 1, filesize-total_bytes, stream); + total_bytes += bytes_read; + } while (total_bytes < filesize && bytes_read > 0); + + fclose(stream); + return filesize; +} +#endif + +/** + * Initialise the Random Number Generator engine. + * - On Win32 use the platform SDK's crypto engine. + * - On Linux use /dev/urandom + * - If none of these work then use a custom RNG. + */ +void RNG_initialize(const uint8_t *seed_buf, int size) +{ + if (rng_ref_count == 0) + { +#if !defined(WIN32) && defined(CONFIG_USE_DEV_URANDOM) + if ((rng_fd = open("/dev/urandom", O_RDONLY)) < 0) + { + printf(unsupported_str); + exit(1); + } +#elif defined(WIN32) && defined(CONFIG_WIN32_USE_CRYPTO_LIB) + if (!CryptAcquireContext(&gCryptProv, + NULL, NULL, PROV_RSA_FULL, 0)) + { + printf("%s CryptoLib %x", unsupported_str, GetLastError()); + exit(1); + } +#else + /* help seed with the user's private key - this is a number that + should be hard to find, due to the fact that it relies on knowing + the private key */ + int i; + + for (i = 0; i < size/(int)sizeof(uint64_t); i++) + { + rng_num ^= *((uint64_t *)&seed_buf[i*sizeof(uint64_t)]); + } + + srand((long)seed_buf); /* use the stack ptr as another rnd seed */ +#endif + } + + rng_ref_count++; +} + +/** + * Terminate the RNG engine. + */ +void RNG_terminate(void) +{ + if (--rng_ref_count == 0) + { +#ifndef WIN32 + close(rng_fd); +#elif defined(CONFIG_WIN32_USE_CRYPTO_LIB) + CryptReleaseContext(gCryptProv, 0); +#endif + } +} + +/** + * Set a series of bytes with a random number. Individual bytes can be 0 + */ +void get_random(int num_rand_bytes, uint8_t *rand_data) +{ +#if !defined(WIN32) && defined(CONFIG_USE_DEV_URANDOM) + /* use the Linux default */ + read(rng_fd, rand_data, num_rand_bytes); /* read from /dev/urandom */ +#elif defined(WIN32) && defined(CONFIG_WIN32_USE_CRYPTO_LIB) + /* use Microsoft Crypto Libraries */ + CryptGenRandom(gCryptProv, num_rand_bytes, rand_data); +#else /* nothing else to use, so use a custom RNG */ + /* The method we use when we've got nothing better. Use RC4, time + and a couple of random seeds to generate a random sequence */ + RC4_CTX rng_ctx; + struct timeval tv; + uint64_t big_num1, big_num2; + + gettimeofday(&tv, NULL); /* yes I know we shouldn't do this */ + + /* all numbers by themselves are pretty simple, but combined should + * be a challenge */ + big_num1 = (uint64_t)tv.tv_sec*(tv.tv_usec+1); + big_num2 = (uint64_t)rand()*big_num1; + big_num1 ^= rng_num; + + memcpy(rand_data, &big_num1, sizeof(uint64_t)); + if (num_rand_bytes > sizeof(uint64_t)) + { + memcpy(&rand_data[8], &big_num2, sizeof(uint64_t)); + } + + if (num_rand_bytes > 16) + { + /* clear rest of data */ + memset(&rand_data[16], 0, num_rand_bytes-16); + } + + RC4_setup(&rng_ctx, rand_data, 16); /* use as a key */ + RC4_crypt(&rng_ctx, rand_data, rand_data, num_rand_bytes); + + /* use last 8 bytes for next time */ + memcpy(&rng_num, &rand_data[num_rand_bytes-8], sizeof(uint64_t)); +#endif +} + +/** + * Set a series of bytes with a random number. Individual bytes are not zero. + */ +void get_random_NZ(int num_rand_bytes, uint8_t *rand_data) +{ + int i; + get_random(num_rand_bytes, rand_data); + + for (i = 0; i < num_rand_bytes; i++) + { + while (rand_data[i] == 0) /* can't be 0 */ + { + rand_data[i] = (uint8_t)(rand()); + } + } +} + +/** + * Some useful diagnostic routines + */ +#if defined(CONFIG_SSL_FULL_MODE) || defined(CONFIG_DEBUG) +int hex_finish; +int hex_index; + +static void print_hex_init(int finish) +{ + hex_finish = finish; + hex_index = 0; +} + +static void print_hex(uint8_t hex) +{ + static int column; + + if (hex_index == 0) + { + column = 0; + } + + printf("%02x ", hex); + if (++column == 8) + { + printf(": "); + } + else if (column >= 16) + { + printf("\n"); + column = 0; + } + + if (++hex_index >= hex_finish && column > 0) + { + printf("\n"); + } +} + +/** + * Spit out a blob of data for diagnostics. The data is is a nice column format + * for easy reading. + * + * @param format [in] The string (with possible embedded format characters) + * @param size [in] The number of numbers to print + * @param data [in] The start of data to use + * @param ... [in] Any additional arguments + */ +void print_blob(const char *format, + const uint8_t *data, int size, ...) +{ + int i; + char tmp[80]; + va_list(ap); + + va_start(ap, size); + sprintf(tmp, "%s\n", format); + vprintf(tmp, ap); + print_hex_init(size); + for (i = 0; i < size; i++) + { + print_hex(data[i]); + } + + va_end(ap); + TTY_FLUSH(); +} +#elif defined(WIN32) +/* VC6.0 doesn't handle variadic macros */ +void print_blob(const char *format, const unsigned char *data, + int size, ...) {} +#endif + diff --git a/ssl/hmac.c b/ssl/hmac.c new file mode 100644 index 0000000000..289892a48f --- /dev/null +++ b/ssl/hmac.c @@ -0,0 +1,90 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file hmac.c + * + * HMAC implementation - This code was originally taken from RFC2104 + */ + +#include +#include "crypto.h" + +/** + * Perform HMAC-MD5 + */ +void hmac_md5(const uint8_t *msg, int length, const uint8_t *key, + int key_len, uint8_t *digest) +{ + MD5_CTX context; + uint8_t k_ipad[64]; + uint8_t k_opad[64]; + int i; + + memset(k_ipad, 0, sizeof k_ipad); + memset(k_opad, 0, sizeof k_opad); + memcpy(k_ipad, key, key_len); + memcpy(k_opad, key, key_len); + + for (i = 0; i < 64; i++) + { + k_ipad[i] ^= 0x36; + k_opad[i] ^= 0x5c; + } + + MD5Init(&context); + MD5Update(&context, k_ipad, 64); + MD5Update(&context, msg, length); + MD5Final(&context, digest); + MD5Init(&context); + MD5Update(&context, k_opad, 64); + MD5Update(&context, digest, MD5_SIZE); + MD5Final(&context, digest); +} + +/** + * Perform HMAC-SHA1 + */ +void hmac_sha1(const uint8_t *msg, int length, const uint8_t *key, + int key_len, uint8_t *digest) +{ + SHA1_CTX context; + uint8_t k_ipad[64]; + uint8_t k_opad[64]; + int i; + + memset(k_ipad, 0, sizeof k_ipad); + memset(k_opad, 0, sizeof k_opad); + memcpy(k_ipad, key, key_len); + memcpy(k_opad, key, key_len); + + for (i = 0; i < 64; i++) + { + k_ipad[i] ^= 0x36; + k_opad[i] ^= 0x5c; + } + + SHA1Init(&context); + SHA1Update(&context, k_ipad, 64); + SHA1Update(&context, msg, length); + SHA1Final(&context, digest); + SHA1Init(&context); + SHA1Update(&context, k_opad, 64); + SHA1Update(&context, digest, SHA1_SIZE); + SHA1Final(&context, digest); +} diff --git a/ssl/loader.c b/ssl/loader.c new file mode 100644 index 0000000000..5f43d4982c --- /dev/null +++ b/ssl/loader.c @@ -0,0 +1,450 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * Load certificates/keys into memory. These can be in many different formats. + * PEM support and other formats can be processed here. + * + * The PEM private keys may be optionally encrypted with AES128 or AES256. + * The encrypted PEM keys were generated with something like: + * + * openssl genrsa -aes128 -passout pass:abcd -out axTLS.key_aes128.pem 512 + */ + +#include +#include +#include + +#include "ssl.h" + +static int do_obj(SSLCTX *ssl_ctx, int obj_type, + SSLObjLoader *ssl_obj, const char *password); +#ifdef CONFIG_SSL_HAS_PEM +static int ssl_obj_PEM_load(SSLCTX *ssl_ctx, int obj_type, + SSLObjLoader *ssl_obj, const char *password); +#endif + +/* + * Load a file into memory that is in binary DER (or ascii PEM) format. + */ +EXP_FUNC int STDCALL ssl_obj_load(SSLCTX *ssl_ctx, int obj_type, + const char *filename, const char *password) +{ +#ifndef CONFIG_SSL_SKELETON_MODE + static const char * const begin = "-----BEGIN"; + int ret = SSL_OK; + SSLObjLoader *ssl_obj = NULL; + + if (filename == NULL) + { + ret = SSL_ERROR_INVALID_KEY; + goto error; + } + + ssl_obj = (SSLObjLoader *)calloc(1, sizeof(SSLObjLoader)); + ssl_obj->len = get_file(filename, &ssl_obj->buf); + + if (ssl_obj->len <= 0) + { + ret = SSL_ERROR_INVALID_KEY; + goto error; + } + + /* is the file a PEM file? */ + if (strncmp(ssl_obj->buf, begin, strlen(begin)) == 0) + { +#ifdef CONFIG_SSL_HAS_PEM + ret = ssl_obj_PEM_load(ssl_ctx, obj_type, ssl_obj, password); +#else + printf(unsupported_str); + ret = SSL_ERROR_NOT_SUPPORTED; +#endif + } + else + { + ret = do_obj(ssl_ctx, obj_type, ssl_obj, password); + } + +error: + ssl_obj_free(ssl_obj); + return ret; +#else + printf(unsupported_str); + return SSL_ERROR_NOT_SUPPORTED; +#endif /* CONFIG_SSL_SKELETON_MODE */ +} + +/* + * Transfer binary data into the object loader. + */ +EXP_FUNC int STDCALL ssl_obj_memory_load(SSLCTX *ssl_ctx, int mem_type, + const uint8_t *data, int len, const char *password) +{ + int ret; + + SSLObjLoader *ssl_obj = (SSLObjLoader *)calloc(1, sizeof(SSLObjLoader)); + ssl_obj->buf = (uint8_t *)malloc(len); + memcpy(ssl_obj->buf, data, len); + ssl_obj->len = len; + ret = do_obj(ssl_ctx, mem_type, ssl_obj, password); + ssl_obj_free(ssl_obj); + return ret; +} + +/* + * Actually work out what we are doing + */ +static int do_obj(SSLCTX *ssl_ctx, int obj_type, + SSLObjLoader *ssl_obj, const char *password) +{ + int ret = SSL_OK; + + switch (obj_type) + { + case SSL_OBJ_RSA_KEY: + ret = add_private_key(ssl_ctx, ssl_obj); + break; + + case SSL_OBJ_X509_CERT: + ret = add_cert(ssl_ctx, ssl_obj->buf, ssl_obj->len); + break; + +#ifdef CONFIG_SSL_CERT_VERIFICATION + case SSL_OBJ_X509_CACERT: + ret = add_cert_auth(ssl_ctx, ssl_obj->buf, ssl_obj->len); + break; +#endif + +#ifdef CONFIG_SSL_USE_PKCS12 + case SSL_OBJ_PKCS8: + ret = pkcs8_decode(ssl_ctx, ssl_obj, password); + break; + + case SSL_OBJ_PKCS12: + ret = pkcs12_decode(ssl_ctx, ssl_obj, password); + break; +#endif + default: + printf(unsupported_str); + ret = SSL_ERROR_NOT_SUPPORTED; + break; + } + + return ret; +} + +/* + * Release things. + */ +void ssl_obj_free(SSLObjLoader *ssl_obj) +{ + free(ssl_obj->buf); + free(ssl_obj); +} + +/** + * Support for PEM encoded keys/certificates. + */ +#ifdef CONFIG_SSL_HAS_PEM + +#define NUM_PEM_TYPES 3 +#define IV_SIZE 16 +#define IS_RSA_PRIVATE_KEY 0 +#define IS_ENCRYPTED_PRIVATE_KEY 1 +#define IS_CERTIFICATE 2 + +/* base64 to binary lookup table */ +static const uint8_t map[128] = +{ + 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, + 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, + 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, + 255, 255, 255, 255, 255, 255, 255, 62, 255, 255, 255, 63, + 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 255, 255, + 255, 254, 255, 255, 255, 0, 1, 2, 3, 4, 5, 6, + 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, + 19, 20, 21, 22, 23, 24, 25, 255, 255, 255, 255, 255, + 255, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, + 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, + 49, 50, 51, 255, 255, 255, 255, 255 +}; + +static const char * const begins[NUM_PEM_TYPES] = +{ + "-----BEGIN RSA PRIVATE KEY-----", + "-----BEGIN ENCRYPTED PRIVATE KEY-----", + "-----BEGIN CERTIFICATE-----", +}; + +static const char * const ends[NUM_PEM_TYPES] = +{ + "-----END RSA PRIVATE KEY-----", + "-----END ENCRYPTED PRIVATE KEY-----", + "-----END CERTIFICATE-----", +}; + +static const char * const aes_str[2] = +{ + "DEK-Info: AES-128-CBC,", + "DEK-Info: AES-256-CBC," +}; + +static int base64_decode(const uint8_t *in, int len, + uint8_t *out, int *outlen) +{ + int g, t, x, y, z; + uint8_t c; + int ret = -1; + + g = 3; + for (x = y = z = t = 0; x < len; x++) + { + if ((c = map[in[x]&0x7F]) == 0xff) + continue; + + if (c == 254) /* this is the end... */ + { + c = 0; + + if (--g < 0) + goto error; + } + else if (g != 3) /* only allow = at end */ + goto error; + + t = (t<<6) | c; + + if (++y == 4) + { + out[z++] = (uint8_t)((t>>16)&255); + + if (g > 1) + { + out[z++] = (uint8_t)((t>>8)&255); + } + + if (g > 2) + { + out[z++] = (uint8_t)(t&255); + } + + y = t = 0; + } + } + + if (y != 0) + goto error; + + *outlen = z; + ret = 0; + +error: +#ifdef CONFIG_SSL_FULL_MODE + if (ret < 0) + { + printf("Error: Invalid base64 file\n"); + } +#endif + return ret; +} + +/** + * Take a base64 blob of data and decrypt it (using AES) into its + * proper ASN.1 form. + */ +static int pem_decrypt(const uint8_t *where, const uint8_t *end, + const char *password, SSLObjLoader *ssl_obj) +{ + int ret = -1; + int is_aes_256 = 0; + uint8_t *start = NULL; + uint8_t iv[IV_SIZE]; + int i, pem_size; + MD5_CTX md5_ctx; + AES_CTX aes_ctx; + uint8_t key[32]; /* AES256 size */ + + if (password == NULL) + { +#ifdef CONFIG_SSL_FULL_MODE + printf("Error: need a password for this PEM file\n"); +#endif + goto error; + } + + if ((start = (uint8_t *)strstr( + (const char *)where, aes_str[0]))) /* AES128? */ + { + start += strlen(aes_str[0]); + } + else if ((start = (uint8_t *)strstr( + (const char *)where, aes_str[1]))) /* AES256? */ + { + is_aes_256 = 1; + start += strlen(aes_str[1]); + } + else + { +#ifdef CONFIG_SSL_FULL_MODE + printf("Error: Unsupported password cipher\n"); +#endif + goto error; + } + + /* convert from hex to binary - assumes uppercase hex */ + for (i = 0; i < IV_SIZE; i++) + { + uint8_t c = *start++ - '0'; + iv[i] = (c > 9 ? c + '0' - 'A' + 10 : c) << 4; + c = *start++ - '0'; + iv[i] +=(c > 9 ? c + '0' - 'A' + 10 : c); + } + + while (*start == '\r' || *start == '\n') + start++; + + /* turn base64 into binary */ + pem_size = (int)(end-start); + if (base64_decode(start, pem_size, ssl_obj->buf, &ssl_obj->len) != 0) + goto error; + + /* work out the key */ + MD5Init(&md5_ctx); + MD5Update(&md5_ctx, (const uint8_t *)password, strlen(password)); + MD5Update(&md5_ctx, iv, SALT_SIZE); + MD5Final(&md5_ctx, key); + + if (is_aes_256) + { + MD5Init(&md5_ctx); + MD5Update(&md5_ctx, key, MD5_SIZE); + MD5Update(&md5_ctx, (const uint8_t *)password, strlen(password)); + MD5Update(&md5_ctx, iv, SALT_SIZE); + MD5Final(&md5_ctx, &key[MD5_SIZE]); + } + + /* decrypt using the key/iv */ + AES_set_key(&aes_ctx, key, iv, is_aes_256 ? AES_MODE_256 : AES_MODE_128); + AES_convert_key(&aes_ctx); + AES_cbc_decrypt(&aes_ctx, ssl_obj->buf, ssl_obj->buf, ssl_obj->len); + ret = 0; + +error: + return ret; +} + +/** + * Take a base64 blob of data and turn it into its proper ASN.1 form. + */ +static int new_pem_obj(SSLCTX *ssl_ctx, int is_cacert, uint8_t *where, + int remain, const char *password) +{ + int ret = SSL_OK; + SSLObjLoader *ssl_obj = NULL; + int i, pem_size, obj_type; + uint8_t *start = NULL, *end = NULL; + + for (i = 0; i < NUM_PEM_TYPES; i++) + { + if ((start = (uint8_t *)strstr((const char *)where, begins[i])) && + (end = (uint8_t *)strstr((const char *)where, ends[i]))) + { + remain -= (int)(end-start); + start += strlen(begins[i]); + pem_size = (int)(end-start); + ssl_obj = (SSLObjLoader *)calloc(1, sizeof(SSLObjLoader)); + + /* 4/3 bigger than what we need but so what */ + ssl_obj->buf = (uint8_t *)calloc(1, pem_size); + + if (i == IS_RSA_PRIVATE_KEY && + strstr((const char *)start, "Proc-Type:") && + strstr((const char *)start, "4,ENCRYPTED")) + { + /* check for encrypted PEM file */ + if ((pem_size = pem_decrypt(start, end, password, ssl_obj)) < 0) + goto error; + } + else if (base64_decode(start, pem_size, + ssl_obj->buf, &ssl_obj->len) != 0) + goto error; + + switch (i) + { + case IS_RSA_PRIVATE_KEY: + obj_type = SSL_OBJ_RSA_KEY; + break; + + case IS_ENCRYPTED_PRIVATE_KEY: + obj_type = SSL_OBJ_PKCS8; + break; + + case IS_CERTIFICATE: + obj_type = is_cacert ? + SSL_OBJ_X509_CACERT : SSL_OBJ_X509_CERT; + break; + } + + /* In a format we can now understand - so process it */ + if ((ret = do_obj(ssl_ctx, obj_type, ssl_obj, password))) + { + ssl_obj_free(ssl_obj); + goto error; + } + + end += strlen(ends[i]); + remain -= strlen(ends[i]); + while (remain > 0 && (*end == '\r' || *end == '\n')) + { + end++; + remain--; + } + + ssl_obj_free(ssl_obj); + break; + } + } + + if (i == NUM_PEM_TYPES) + goto error; + + /* more PEM stuff to process? */ + if (remain) + ret = new_pem_obj(ssl_ctx, is_cacert, end, remain, password); + +error: + return ret; +} + +/* + * Load a file into memory that is in ASCII PEM format. + */ +static int ssl_obj_PEM_load(SSLCTX *ssl_ctx, int obj_type, + SSLObjLoader *ssl_obj, const char *password) +{ + uint8_t *start; + + /* add a null terminator */ + ssl_obj->len++; + ssl_obj->buf = (uint8_t *)realloc(ssl_obj->buf, ssl_obj->len); + ssl_obj->buf[ssl_obj->len-1] = 0; + start = ssl_obj->buf; + return new_pem_obj(ssl_ctx, obj_type == SSL_OBJ_X509_CACERT, + start, ssl_obj->len, password); +} +#endif /* CONFIG_SSL_HAS_PEM */ diff --git a/ssl/md5.c b/ssl/md5.c new file mode 100644 index 0000000000..95adab8648 --- /dev/null +++ b/ssl/md5.c @@ -0,0 +1,288 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file md5.c + * + * This file implements the MD5 algorithm as defined in RFC1321 + */ + +#include +#include "crypto.h" + +/* Constants for MD5Transform routine. + */ +#define S11 7 +#define S12 12 +#define S13 17 +#define S14 22 +#define S21 5 +#define S22 9 +#define S23 14 +#define S24 20 +#define S31 4 +#define S32 11 +#define S33 16 +#define S34 23 +#define S41 6 +#define S42 10 +#define S43 15 +#define S44 21 + +/* ----- static functions ----- */ +static void MD5Transform(uint32_t state[4], const uint8_t block[64]); +static void Encode(uint8_t *output, uint32_t *input, uint32_t len); +static void Decode(uint32_t *output, const uint8_t *input, uint32_t len); + +static uint8_t PADDING[64] = { + 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 +}; + +/* F, G, H and I are basic MD5 functions. + */ +#define F(x, y, z) (((x) & (y)) | ((~x) & (z))) +#define G(x, y, z) (((x) & (z)) | ((y) & (~z))) +#define H(x, y, z) ((x) ^ (y) ^ (z)) +#define I(x, y, z) ((y) ^ ((x) | (~z))) + +/* ROTATE_LEFT rotates x left n bits. + */ +#define ROTATE_LEFT(x, n) (((x) << (n)) | ((x) >> (32-(n)))) + +/* FF, GG, HH, and II transformations for rounds 1, 2, 3, and 4. + Rotation is separate from addition to prevent recomputation. + */ +#define FF(a, b, c, d, x, s, ac) { \ + (a) += F ((b), (c), (d)) + (x) + (uint32_t)(ac); \ + (a) = ROTATE_LEFT ((a), (s)); \ + (a) += (b); \ + } +#define GG(a, b, c, d, x, s, ac) { \ + (a) += G ((b), (c), (d)) + (x) + (uint32_t)(ac); \ + (a) = ROTATE_LEFT ((a), (s)); \ + (a) += (b); \ + } +#define HH(a, b, c, d, x, s, ac) { \ + (a) += H ((b), (c), (d)) + (x) + (uint32_t)(ac); \ + (a) = ROTATE_LEFT ((a), (s)); \ + (a) += (b); \ + } +#define II(a, b, c, d, x, s, ac) { \ + (a) += I ((b), (c), (d)) + (x) + (uint32_t)(ac); \ + (a) = ROTATE_LEFT ((a), (s)); \ + (a) += (b); \ + } + +/** + * MD5 initialization - begins an MD5 operation, writing a new ctx. + */ +void MD5Init(MD5_CTX *ctx) +{ + ctx->count[0] = ctx->count[1] = 0; + + /* Load magic initialization constants. + */ + ctx->state[0] = 0x67452301; + ctx->state[1] = 0xefcdab89; + ctx->state[2] = 0x98badcfe; + ctx->state[3] = 0x10325476; +} + +/** + * Accepts an array of octets as the next portion of the message. + */ +void MD5Update(MD5_CTX *ctx, const uint8_t * msg, int len) +{ + uint32_t x; + int i, partLen; + + /* Compute number of bytes mod 64 */ + x = (uint32_t)((ctx->count[0] >> 3) & 0x3F); + + /* Update number of bits */ + if ((ctx->count[0] += ((uint32_t)len << 3)) + < ((uint32_t)len << 3)) + ctx->count[1]++; + ctx->count[1] += ((uint32_t)len >> 29); + + partLen = 64 - x; + + /* Transform as many times as possible. */ + if (len >= partLen) + { + memcpy(&ctx->buffer[x], msg, partLen); + MD5Transform(ctx->state, ctx->buffer); + + for (i = partLen; i + 63 < len; i += 64) + MD5Transform(ctx->state, &msg[i]); + + x = 0; + } + else + i = 0; + + /* Buffer remaining input */ + memcpy(&ctx->buffer[x], &msg[i], len-i); +} + +/** + * Return the 128-bit message digest into the user's array + */ +void MD5Final(MD5_CTX *ctx, uint8_t *digest) +{ + uint8_t bits[8]; + uint32_t x, padLen; + + /* Save number of bits */ + Encode(bits, ctx->count, 8); + + /* Pad out to 56 mod 64. + */ + x = (uint32_t)((ctx->count[0] >> 3) & 0x3f); + padLen = (x < 56) ? (56 - x) : (120 - x); + MD5Update(ctx, PADDING, padLen); + + /* Append length (before padding) */ + MD5Update(ctx, bits, 8); + + /* Store state in digest */ + Encode(digest, ctx->state, MD5_SIZE); +} + +/** + * MD5 basic transformation. Transforms state based on block. + */ +static void MD5Transform(uint32_t state[4], const uint8_t block[64]) +{ + uint32_t a = state[0], b = state[1], c = state[2], d = state[3], x[MD5_SIZE]; + + Decode(x, block, 64); + + /* Round 1 */ + FF (a, b, c, d, x[ 0], S11, 0xd76aa478); /* 1 */ + FF (d, a, b, c, x[ 1], S12, 0xe8c7b756); /* 2 */ + FF (c, d, a, b, x[ 2], S13, 0x242070db); /* 3 */ + FF (b, c, d, a, x[ 3], S14, 0xc1bdceee); /* 4 */ + FF (a, b, c, d, x[ 4], S11, 0xf57c0faf); /* 5 */ + FF (d, a, b, c, x[ 5], S12, 0x4787c62a); /* 6 */ + FF (c, d, a, b, x[ 6], S13, 0xa8304613); /* 7 */ + FF (b, c, d, a, x[ 7], S14, 0xfd469501); /* 8 */ + FF (a, b, c, d, x[ 8], S11, 0x698098d8); /* 9 */ + FF (d, a, b, c, x[ 9], S12, 0x8b44f7af); /* 10 */ + FF (c, d, a, b, x[10], S13, 0xffff5bb1); /* 11 */ + FF (b, c, d, a, x[11], S14, 0x895cd7be); /* 12 */ + FF (a, b, c, d, x[12], S11, 0x6b901122); /* 13 */ + FF (d, a, b, c, x[13], S12, 0xfd987193); /* 14 */ + FF (c, d, a, b, x[14], S13, 0xa679438e); /* 15 */ + FF (b, c, d, a, x[15], S14, 0x49b40821); /* 16 */ + + /* Round 2 */ + GG (a, b, c, d, x[ 1], S21, 0xf61e2562); /* 17 */ + GG (d, a, b, c, x[ 6], S22, 0xc040b340); /* 18 */ + GG (c, d, a, b, x[11], S23, 0x265e5a51); /* 19 */ + GG (b, c, d, a, x[ 0], S24, 0xe9b6c7aa); /* 20 */ + GG (a, b, c, d, x[ 5], S21, 0xd62f105d); /* 21 */ + GG (d, a, b, c, x[10], S22, 0x2441453); /* 22 */ + GG (c, d, a, b, x[15], S23, 0xd8a1e681); /* 23 */ + GG (b, c, d, a, x[ 4], S24, 0xe7d3fbc8); /* 24 */ + GG (a, b, c, d, x[ 9], S21, 0x21e1cde6); /* 25 */ + GG (d, a, b, c, x[14], S22, 0xc33707d6); /* 26 */ + GG (c, d, a, b, x[ 3], S23, 0xf4d50d87); /* 27 */ + GG (b, c, d, a, x[ 8], S24, 0x455a14ed); /* 28 */ + GG (a, b, c, d, x[13], S21, 0xa9e3e905); /* 29 */ + GG (d, a, b, c, x[ 2], S22, 0xfcefa3f8); /* 30 */ + GG (c, d, a, b, x[ 7], S23, 0x676f02d9); /* 31 */ + GG (b, c, d, a, x[12], S24, 0x8d2a4c8a); /* 32 */ + + /* Round 3 */ + HH (a, b, c, d, x[ 5], S31, 0xfffa3942); /* 33 */ + HH (d, a, b, c, x[ 8], S32, 0x8771f681); /* 34 */ + HH (c, d, a, b, x[11], S33, 0x6d9d6122); /* 35 */ + HH (b, c, d, a, x[14], S34, 0xfde5380c); /* 36 */ + HH (a, b, c, d, x[ 1], S31, 0xa4beea44); /* 37 */ + HH (d, a, b, c, x[ 4], S32, 0x4bdecfa9); /* 38 */ + HH (c, d, a, b, x[ 7], S33, 0xf6bb4b60); /* 39 */ + HH (b, c, d, a, x[10], S34, 0xbebfbc70); /* 40 */ + HH (a, b, c, d, x[13], S31, 0x289b7ec6); /* 41 */ + HH (d, a, b, c, x[ 0], S32, 0xeaa127fa); /* 42 */ + HH (c, d, a, b, x[ 3], S33, 0xd4ef3085); /* 43 */ + HH (b, c, d, a, x[ 6], S34, 0x4881d05); /* 44 */ + HH (a, b, c, d, x[ 9], S31, 0xd9d4d039); /* 45 */ + HH (d, a, b, c, x[12], S32, 0xe6db99e5); /* 46 */ + HH (c, d, a, b, x[15], S33, 0x1fa27cf8); /* 47 */ + HH (b, c, d, a, x[ 2], S34, 0xc4ac5665); /* 48 */ + + /* Round 4 */ + II (a, b, c, d, x[ 0], S41, 0xf4292244); /* 49 */ + II (d, a, b, c, x[ 7], S42, 0x432aff97); /* 50 */ + II (c, d, a, b, x[14], S43, 0xab9423a7); /* 51 */ + II (b, c, d, a, x[ 5], S44, 0xfc93a039); /* 52 */ + II (a, b, c, d, x[12], S41, 0x655b59c3); /* 53 */ + II (d, a, b, c, x[ 3], S42, 0x8f0ccc92); /* 54 */ + II (c, d, a, b, x[10], S43, 0xffeff47d); /* 55 */ + II (b, c, d, a, x[ 1], S44, 0x85845dd1); /* 56 */ + II (a, b, c, d, x[ 8], S41, 0x6fa87e4f); /* 57 */ + II (d, a, b, c, x[15], S42, 0xfe2ce6e0); /* 58 */ + II (c, d, a, b, x[ 6], S43, 0xa3014314); /* 59 */ + II (b, c, d, a, x[13], S44, 0x4e0811a1); /* 60 */ + II (a, b, c, d, x[ 4], S41, 0xf7537e82); /* 61 */ + II (d, a, b, c, x[11], S42, 0xbd3af235); /* 62 */ + II (c, d, a, b, x[ 2], S43, 0x2ad7d2bb); /* 63 */ + II (b, c, d, a, x[ 9], S44, 0xeb86d391); /* 64 */ + + state[0] += a; + state[1] += b; + state[2] += c; + state[3] += d; + + /* Zeroize sensitive information. + */ + memset(x, 0, sizeof(x)); +} + +/** + * Encodes input (uint32_t) into output (uint8_t). Assumes len is + * a multiple of 4. + */ +static void Encode(uint8_t *output, uint32_t *input, uint32_t len) +{ + uint32_t i, j; + + for (i = 0, j = 0; j < len; i++, j += 4) + { + output[j] = (uint8_t)(input[i] & 0xff); + output[j+1] = (uint8_t)((input[i] >> 8) & 0xff); + output[j+2] = (uint8_t)((input[i] >> 16) & 0xff); + output[j+3] = (uint8_t)((input[i] >> 24) & 0xff); + } +} + +/** + * Decodes input (uint8_t) into output (uint32_t). Assumes len is + * a multiple of 4. + */ +static void Decode(uint32_t *output, const uint8_t *input, uint32_t len) +{ + uint32_t i, j; + + for (i = 0, j = 0; j < len; i++, j += 4) + output[i] = ((uint32_t)input[j]) | (((uint32_t)input[j+1]) << 8) | + (((uint32_t)input[j+2]) << 16) | (((uint32_t)input[j+3]) << 24); +} diff --git a/ssl/os_port.c b/ssl/os_port.c new file mode 100644 index 0000000000..b278c4a291 --- /dev/null +++ b/ssl/os_port.c @@ -0,0 +1,61 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file os_port.c + * + * OS specific functions. + */ +#ifdef WIN32 + +#include +#include "os_port.h" + +/** + * gettimeofday() not in Win32 + */ +EXP_FUNC void gettimeofday(struct timeval* t, void* timezone) +{ +#if defined(_WIN32_WCE) + t->tv_sec = time(NULL); + t->tv_usec = 0; /* 1sec precision only */ +#else + struct _timeb timebuffer; + _ftime(&timebuffer); + t->tv_sec = (long)timebuffer.time; + t->tv_usec = 1000 * timebuffer.millitm; /* 1ms precision */ +#endif +} + +/** + * strcasecmp() not in Win32 + */ +EXP_FUNC int strcasecmp(const char *s1, const char *s2) +{ + while (tolower(*s1) == tolower(*s2++)) + { + if (*s1++ == '\0') + { + return 0; + } + } + + return *(unsigned char *)s1 - *(unsigned char *)(s2 - 1); +} + +#endif diff --git a/ssl/os_port.h b/ssl/os_port.h new file mode 100644 index 0000000000..73f4d9be28 --- /dev/null +++ b/ssl/os_port.h @@ -0,0 +1,145 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file os_port.h + * + * Some stuff to minimise the differences between windows and linux/unix + */ + +#ifndef HEADER_OS_PORT_H +#define HEADER_OS_PORT_H + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(WIN32) || defined(CYGWIN) +#define STDCALL __stdcall +#define EXP_FUNC __declspec(dllexport) +#else +#define STDCALL +#define EXP_FUNC +#endif + +#if defined(_WIN32_WCE) +#undef WIN32 +#define WIN32 +#endif + +#ifdef WIN32 + +/* Windows CE stuff */ +#if defined(_WIN32_WCE) +#include +#define abort() exit(1) +#else +#include +#include +#include +#include +#endif /* _WIN32_WCE */ + +#include +#undef getpid +#undef open +#undef close +#undef sleep +#undef gettimeofday +#undef dup2 +#undef unlink + +#define SOCKET_READ(A,B,C) recv(A,B,C,0) +#define SOCKET_WRITE(A,B,C) send(A,B,C,0) +#define SOCKET_CLOSE(A) closesocket(A) +#define srandom(A) srand(A) +#define random() rand() +#define getpid() _getpid() +#define snprintf _snprintf +#define open(A,B) _open(A,B) +#define dup2(A,B) _dup2(A,B) +#define unlink(A) _unlink(A) +#define close(A) _close(A) +#define read(A,B,C) _read(A,B,C) +#define write(A,B,C) _write(A,B,C) +#define sleep(A) Sleep(A*1000) +#define usleep(A) Sleep(A/1000) +#define lseek(A,B,C) _lseek(A,B,C) +#define strdup(A) _strdup(A) + +/* This fix gets around a problem where a win32 application on a cygwin xterm + doesn't display regular output (until a certain buffer limit) - but it works + fine under a normal DOS window. This is a hack to get around the issue - + see http://www.khngai.com/emacs/tty.php */ +#define TTY_FLUSH() if (!_isatty(_fileno(stdout))) fflush(stdout); + +/* + * automatically build some library dependencies. + */ +#pragma comment(lib, "WS2_32.lib") + +#ifdef CONFIG_WIN32_USE_CRYPTO_LIB +#pragma comment(lib, "AdvAPI32.lib") +#endif + +#define uint8_t unsigned char +#define uint16_t unsigned short +#ifndef INT16 +typedef signed short INT16; +#endif + +#define int16_t INT16 +#define uint32_t UINT32 +#define uint64_t UINT64 +#define int64_t INT64 + +extern EXP_FUNC void gettimeofday(struct timeval* t,void* timezone); +extern EXP_FUNC int strcasecmp(const char *s1, const char *s2); + +#else /* Not Win32 */ + +#ifdef SOLARIS +#include +#else +#include +#endif /* Not Solaris */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define SOCKET_READ(A,B,C) read(A,B,C) +#define SOCKET_WRITE(A,B,C) write(A,B,C) +#define SOCKET_CLOSE(A) close(A) +#define TTY_FLUSH() + +#endif /* Not Win32 */ + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/ssl/p12.c b/ssl/p12.c new file mode 100644 index 0000000000..ec84b8b14d --- /dev/null +++ b/ssl/p12.c @@ -0,0 +1,431 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * Process PKCS#8/PKCS#12 keys. + * + * The decoding of a PKCS#12 key is fairly specific - this code was tested on a + * key generated with: + * + * openssl pkcs12 -export -in axTLS.x509_1024.pem -inkey axTLS.key_1024.pem + * -keypbe PBE-SHA1-RC4-128 -certpbe PBE-SHA1-RC4-128 + * -name "p12_withoutCA" -out axTLS.withoutCA.p12 -password pass:abcd + * + * or with a certificate chain: + * + * openssl pkcs12 -export -in axTLS.x509_1024.pem -inkey axTLS.key_1024.pem + * -certfile axTLS.ca_x509.pem -keypbe PBE-SHA1-RC4-128 -certpbe + * PBE-SHA1-RC4-128 -name "p12_withCA" -out axTLS.withCA.p12 -password pass:abcd + * + * Note that the PBE has to be specified with PBE-SHA1-RC4-128. The + * private/public keys/certs have to use RSA encryption. Both the integrity + * and privacy passwords are the same. + * + * The PKCS#8 files were generated with something like: + * + * PEM format: + * openssl pkcs8 -in axTLS.key_512.pem -passout pass:abcd -topk8 -v1 + * PBE-SHA1-RC4-128 -out axTLS.encrypted_pem.p8 + * + * DER format: + * openssl pkcs8 -in axTLS.key_512.pem -passout pass:abcd -topk8 -outform DER + * -v1 PBE-SHA1-RC4-128 -out axTLS.encrypted.p8 + */ + +#include +#include +#include + +#include "ssl.h" + +/* all commented out if not used */ +#ifdef CONFIG_SSL_USE_PKCS12 + +#define BLOCK_SIZE 64 + +static int p8_decrypt(const char *password, const uint8_t *salt, int iter, + uint8_t *priv_key, int priv_key_len); +static int p8_add_key(SSLCTX *ssl_ctx, uint8_t *priv_key); +static int get_pbe_params(uint8_t *buf, int *offset, + const uint8_t **salt, int *iterations); + +/* + * Take a raw pkcs8 block and then decrypt it and turn it into a normal key. + */ +int pkcs8_decode(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password) +{ + uint8_t *buf = ssl_obj->buf; + int len, offset = 0; + int iterations; + int ret = SSL_NOT_OK; + uint8_t *version = NULL; + const uint8_t *salt; + uint8_t *priv_key; + + if (asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0) + { +#ifdef CONFIG_SSL_FULL_MODE + printf("Error: Invalid p8 ASN.1 file\n"); +#endif + goto error; + } + + /* unencrypted key? */ + if (asn1_get_int(buf, &offset, &version) > 0 && *version == 0) + { + ret = p8_add_key(ssl_ctx, buf); + goto error; + } + + if (get_pbe_params(buf, &offset, &salt, &iterations) < 0) + goto error; + + if ((len = asn1_next_obj(buf, &offset, ASN1_OCTET_STRING)) < 0) + goto error; + + priv_key = &buf[offset]; + + p8_decrypt(password, salt, iterations, priv_key, len); + ret = p8_add_key(ssl_ctx, priv_key); + +error: + free(version); + return ret; +} + +/* + * Take the unencrypted pkcs8 and turn it into a private key + */ +static int p8_add_key(SSLCTX *ssl_ctx, uint8_t *priv_key) +{ + uint8_t *buf = priv_key; + int len, offset = 0; + int ret = SSL_NOT_OK; + + /* Skip the preamble and go straight to the private key. + We only support rsaEncryption (1.2.840.113549.1.1.1) */ + if (asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0 || + asn1_skip_obj(buf, &offset, ASN1_INTEGER) < 0 || + asn1_skip_obj(buf, &offset, ASN1_SEQUENCE) < 0 || + (len = asn1_next_obj(buf, &offset, ASN1_OCTET_STRING)) < 0) + goto error; + + ret = asn1_get_private_key(&buf[offset], len, &ssl_ctx->rsa_ctx); + +error: + return ret; +} + +/* + * Decrypt a pkcs8 block. + */ +static int p8_decrypt(const char *password, const uint8_t *salt, int iter, + uint8_t *priv_key, int priv_key_len) +{ + uint8_t p[BLOCK_SIZE*2]; + uint8_t d[BLOCK_SIZE]; + uint8_t Ai[SHA1_SIZE]; + SHA1_CTX sha_ctx; + RC4_CTX rc4_ctx; + uint8_t *uni_pass = NULL; + int i; + int uni_pass_len = 0; + int id = 1; /* key id */ + + if (password == NULL) + { + password = ""; + } + + uni_pass = (uint8_t *)malloc((strlen(password)+1)*2); + + /* modify the password into a unicode version */ + for (i = 0; i < (int)strlen(password); i++) + { + uni_pass[uni_pass_len++] = 0; + uni_pass[uni_pass_len++] = password[i]; + } + + uni_pass[uni_pass_len++] = 0; /* null terminate */ + uni_pass[uni_pass_len++] = 0; + + for (i = 0; i < BLOCK_SIZE; i++) + { + p[i] = salt[i % SALT_SIZE]; + p[BLOCK_SIZE+i] = uni_pass[i % uni_pass_len]; + d[i] = id; + } + + /* get the key - no IV since we are using RC4 */ + SHA1Init(&sha_ctx); + SHA1Update(&sha_ctx, d, sizeof(d)); + SHA1Update(&sha_ctx, p, sizeof(p)); + SHA1Final(&sha_ctx, Ai); + + for (i = 1; i < iter; i++) + { + SHA1Init(&sha_ctx); + SHA1Update(&sha_ctx, Ai, SHA1_SIZE); + SHA1Final(&sha_ctx, Ai); + } + + /* do the decryption */ + RC4_setup(&rc4_ctx, Ai, 16); + RC4_crypt(&rc4_ctx, priv_key, priv_key, priv_key_len); + free(uni_pass); + return 0; +} + +/* + * Take a raw pkcs12 block and the decrypt it and turn it into a certificates + * and keys. + */ +int pkcs12_decode(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password) +{ + uint8_t *buf = ssl_obj->buf; + int all_ok = 0, len, iterations, key_offset, offset = 0; + int all_certs = 0; + uint8_t *version = NULL, *cert, *mac; + SHA1_CTX sha_ctx; + char sha[SHA1_SIZE]; + const uint8_t *salt; + int ret; + static const uint8_t pkcs_data[] = /* pkc7 data */ + { 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x01 }; + static const uint8_t pkcs_encrypted[] = /* pkc7 encrypted */ + { 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x06 }; + static const uint8_t pkcs8_key_bag[] = /* 1.2.840.113549.1.12.10.1.2 */ + { 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x0c, 0x0a, 0x01, 0x02 }; + + if (asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0) + { +#ifdef CONFIG_SSL_FULL_MODE + printf("Error: Invalid p12 ASN.1 file\n"); +#endif + goto error; + } + + if (asn1_get_int(buf, &offset, &version) < 0 || *version != 3) + goto error; + + /* work out the MAC of this bit */ + key_offset = offset; + asn1_skip_obj(buf, &key_offset, ASN1_SEQUENCE); + SHA1Init(&sha_ctx); + SHA1Update(&sha_ctx, &buf[offset], key_offset-offset); + SHA1Final(&sha_ctx, sha); + + /* remove all the boring pcks7 bits */ + if (asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0 || + (len = asn1_next_obj(buf, &offset, ASN1_OID)) < 0 || + len != sizeof(pkcs_data) || + memcmp(&buf[offset], pkcs_data, sizeof(pkcs_data))) + goto error; + + offset += len; + + if (asn1_next_obj(buf, &offset, ASN1_EXPLICIT_TAG) < 0 || + asn1_next_obj(buf, &offset, ASN1_OCTET_STRING) < 0 || + asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0 || + asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0 || + (len = asn1_next_obj(buf, &offset, ASN1_OID)) < 0 || + (len != sizeof(pkcs_encrypted) || + memcmp(&buf[offset], pkcs_encrypted, sizeof(pkcs_encrypted)))) + goto error; + + offset += len; + + if (asn1_next_obj(buf, &offset, ASN1_EXPLICIT_TAG) < 0 || + asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0 || + asn1_skip_obj(buf, &offset, ASN1_INTEGER) < 0 || + asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0 || + (len = asn1_next_obj(buf, &offset, ASN1_OID)) < 0 || + len != sizeof(pkcs_data) || + memcmp(&buf[offset], pkcs_data, sizeof(pkcs_data))) + goto error; + + offset += len; + + /* work out the salt for the certificate */ + if (get_pbe_params(buf, &offset, &salt, &iterations) < 0 || + (len = asn1_next_obj(buf, &offset, ASN1_IMPLICIT_TAG)) < 0) + goto error; + + /* decrypt the certificate */ + cert = &buf[offset]; + if ((ret = p8_decrypt(password, salt, iterations, cert, len)) < 0) + goto error; + + offset += len; + + /* load the certificate */ + key_offset = 0; + all_certs = asn1_next_obj(cert, &key_offset, ASN1_SEQUENCE); + + /* keep going until all certs are loaded */ + while (key_offset < all_certs) + { + int cert_offset = key_offset; + + asn1_skip_obj(cert, &cert_offset, ASN1_SEQUENCE); + + if (asn1_next_obj(cert, &key_offset, ASN1_SEQUENCE) < 0 || + asn1_skip_obj(cert, &key_offset, ASN1_OID) < 0 || + asn1_next_obj(cert, &key_offset, ASN1_EXPLICIT_TAG) < 0 || + asn1_next_obj(cert, &key_offset, ASN1_SEQUENCE) < 0 || + asn1_skip_obj(cert, &key_offset, ASN1_OID) < 0 || + asn1_next_obj(cert, &key_offset, ASN1_EXPLICIT_TAG) < 0 || + (len = asn1_next_obj(cert, &key_offset, ASN1_OCTET_STRING)) < 0) + goto error; + + if ((ret = add_cert(ssl_ctx, &cert[key_offset], len)) < 0) + goto error; + + key_offset = cert_offset; + } + + if (asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0 || + (len = asn1_next_obj(buf, &offset, ASN1_OID)) < 0 || + len != sizeof(pkcs_data) || + memcmp(&buf[offset], pkcs_data, sizeof(pkcs_data))) + goto error; + + offset += len; + + if (asn1_next_obj(buf, &offset, ASN1_EXPLICIT_TAG) < 0 || + asn1_next_obj(buf, &offset, ASN1_OCTET_STRING) < 0 || + asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0 || + asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0 || + (len = asn1_next_obj(buf, &offset, ASN1_OID)) < 0 || + (len != sizeof(pkcs8_key_bag)) || + memcmp(&buf[offset], pkcs8_key_bag, sizeof(pkcs8_key_bag))) + goto error; + + offset += len; + + /* work out the salt for the private key */ + if (asn1_next_obj(buf, &offset, ASN1_EXPLICIT_TAG) < 0 || + asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0 || + get_pbe_params(buf, &offset, &salt, &iterations) < 0 || + (len = asn1_next_obj(buf, &offset, ASN1_OCTET_STRING)) < 0) + goto error; + + /* decrypt the private key */ + cert = &buf[offset]; + if ((ret = p8_decrypt(password, salt, iterations, cert, len)) < 0) + goto error; + + offset += len; + + /* load the private key */ + if ((ret = p8_add_key(ssl_ctx, cert)) < 0) + goto error; + + /* miss out on friendly name, local key id etc */ + if (asn1_skip_obj(buf, &offset, ASN1_SET) < 0) + goto error; + + /* work out the MAC */ + if (asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0 || + asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0 || + asn1_skip_obj(buf, &offset, ASN1_SEQUENCE) < 0 || + (len = asn1_next_obj(buf, &offset, ASN1_OCTET_STRING)) < 0 || + len != SHA1_SIZE) + goto error; + + mac = &buf[offset]; + offset += len; + + /* get the salt */ + if ((len = asn1_next_obj(buf, &offset, ASN1_OCTET_STRING)) < 0 || + len != 8) + goto error; + salt = &buf[offset]; + + /* work out what the mac should be */ + if ((ret = p8_decrypt(password, salt, iterations, mac, SHA1_SIZE)) < 0) + goto error; + + /* TODO: actually memcmp the MAC - there is something wrong at the moment */ + /* print_blob("MAC orig", sha, SHA1_SIZE); */ + /* print_blob("MAC calc", mac, SHA1_SIZE); */ + + all_ok = 1; + +error: + free(version); + return all_ok ? SSL_OK : SSL_ERROR_NOT_SUPPORTED; +} + +/* + * Retrieve the salt/iteration details from a PBE block. + */ +static int get_pbe_params(uint8_t *buf, int *offset, + const uint8_t **salt, int *iterations) +{ + static const uint8_t pbeSH1RC4[] = /* pbeWithSHAAnd128BitRC4 */ + { 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x0c, 0x01, 0x01 }; + + int i, len, ret = SSL_NOT_OK; + uint8_t *iter = NULL; + + /* Get the PBE type */ + if (asn1_next_obj(buf, offset, ASN1_SEQUENCE) < 0 || + (len = asn1_next_obj(buf, offset, ASN1_OID)) < 0) + goto error; + + /* we expect pbeWithSHAAnd128BitRC4 (1.2.840.113549.1.12.1.1) + which is the only agorithm we support */ + if (len != sizeof(pbeSH1RC4) || + memcmp(&buf[*offset], pbeSH1RC4, sizeof(pbeSH1RC4))) + { +#ifdef CONFIG_SSL_FULL_MODE + printf("Error: pkcs8/pkcs12 must use \"PBE-SHA1-RC4-128\"\n"); +#endif + ret = SSL_ERROR_NOT_SUPPORTED; + goto error; + } + + *offset += len; + + if (asn1_next_obj(buf, offset, ASN1_SEQUENCE) < 0 || + (len = asn1_next_obj(buf, offset, ASN1_OCTET_STRING)) < 0 || + len != 8) + goto error; + + *salt = &buf[*offset]; + *offset += len; + + if ((len = asn1_get_int(buf, offset, &iter)) < 0) + goto error; + + *iterations = 0; + for (i = 0; i < len; i++) + { + (*iterations) <<= 8; + (*iterations) += iter[i]; + } + + free(iter); + ret = SSL_OK; /* got here - we are ok */ + +error: + return ret; +} + +#endif diff --git a/ssl/private_key.h b/ssl/private_key.h new file mode 100644 index 0000000000..180d5722db --- /dev/null +++ b/ssl/private_key.h @@ -0,0 +1,30 @@ +unsigned char default_private_key[] = { + 0x30, 0x82, 0x01, 0x3d, 0x02, 0x01, 0x00, 0x02, 0x41, 0x00, 0xd1, 0x3b, + 0x30, 0x5f, 0xa9, 0x01, 0x42, 0x3d, 0x86, 0x6d, 0x72, 0xbe, 0x40, 0x6e, + 0x51, 0xc1, 0x49, 0x7f, 0x57, 0x75, 0xa1, 0x2d, 0x36, 0xe5, 0xc1, 0x3d, + 0x0f, 0x20, 0x1a, 0xd1, 0x23, 0x6d, 0xfa, 0x74, 0xd2, 0x3e, 0x23, 0xb0, + 0x70, 0xfc, 0xa0, 0x6a, 0xde, 0xec, 0x41, 0x88, 0x84, 0xfe, 0x54, 0x15, + 0x6b, 0x61, 0xc5, 0x16, 0x62, 0xb8, 0x93, 0x41, 0xf1, 0x4f, 0x3d, 0xff, + 0x2e, 0xbd, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02, 0x41, 0x00, 0x91, 0x79, + 0xc4, 0xed, 0x8e, 0x35, 0xa8, 0xd7, 0xdc, 0x62, 0xb6, 0xf8, 0x1f, 0x16, + 0x55, 0x53, 0xbe, 0x05, 0x83, 0x4a, 0xef, 0x50, 0xdf, 0xad, 0xa9, 0xc9, + 0x09, 0x7e, 0x3a, 0x07, 0x15, 0xc8, 0xfd, 0x16, 0xbb, 0xc0, 0xe4, 0x98, + 0xd1, 0x45, 0x99, 0x60, 0x75, 0x6c, 0x64, 0x65, 0x89, 0xc7, 0x1e, 0x35, + 0xa2, 0xcd, 0x14, 0x05, 0x38, 0x39, 0x15, 0x1a, 0xb8, 0x0f, 0x05, 0x96, + 0x01, 0x01, 0x02, 0x21, 0x00, 0xe8, 0xeb, 0xd7, 0xa8, 0xdf, 0xd8, 0x90, + 0xaa, 0x3c, 0x21, 0xa4, 0x04, 0x31, 0x6a, 0xd3, 0x21, 0xd8, 0x25, 0x98, + 0x4f, 0xb8, 0x28, 0x93, 0x2b, 0xb9, 0xe9, 0x5f, 0xb9, 0xa3, 0x65, 0x77, + 0x7d, 0x02, 0x21, 0x00, 0xe5, 0xf6, 0x6f, 0xeb, 0x50, 0xc4, 0x3b, 0x01, + 0xc3, 0x42, 0x7d, 0x50, 0x33, 0x7a, 0x09, 0xdc, 0x08, 0xe5, 0x76, 0xf3, + 0xbd, 0xea, 0x0f, 0xe5, 0xf1, 0xd3, 0x3d, 0x2f, 0x63, 0xe2, 0xb8, 0x41, + 0x02, 0x21, 0x00, 0xdd, 0xcf, 0xb2, 0xe9, 0x9c, 0x7a, 0x75, 0x91, 0xd8, + 0x7f, 0xc4, 0xdd, 0x45, 0x5e, 0x50, 0xc0, 0x3b, 0x41, 0xda, 0x21, 0x98, + 0xe3, 0xf2, 0xfb, 0x42, 0x29, 0xaf, 0xc2, 0x6e, 0x8b, 0x73, 0x55, 0x02, + 0x21, 0x00, 0xc3, 0x5d, 0x6a, 0xd5, 0xb2, 0x87, 0x13, 0x4e, 0x3b, 0x11, + 0x78, 0x9e, 0xb3, 0x2c, 0xe1, 0xc5, 0x72, 0x35, 0x67, 0xaa, 0x49, 0x54, + 0xd9, 0x6e, 0xd3, 0xd4, 0x4f, 0x2d, 0xbc, 0xa1, 0x37, 0x41, 0x02, 0x21, + 0x00, 0xc4, 0x69, 0x08, 0x53, 0x3b, 0x32, 0xb4, 0xb6, 0x6b, 0x1b, 0x9c, + 0xf3, 0xf1, 0xf3, 0x1a, 0x4a, 0x96, 0xff, 0x70, 0x25, 0x20, 0x1a, 0x9d, + 0x65, 0xb8, 0xa5, 0x8f, 0x9c, 0xc7, 0x77, 0x64, 0x74 +}; +unsigned int default_private_key_len = 321; diff --git a/ssl/rc4.c b/ssl/rc4.c new file mode 100644 index 0000000000..a9ce82ccbb --- /dev/null +++ b/ssl/rc4.c @@ -0,0 +1,83 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file rc4.c + * + * An implementation of the RC4/ARC4 algorithm + * + * Originally written by Christophe Devine + */ + +#include +#include "crypto.h" + +/** + * Get ready for an encrypt/decrypt operation + */ +void RC4_setup(RC4_CTX *ctx, const uint8_t *key, int length) +{ + int i, j = 0, k = 0, *m, a; + + ctx->x = 0; + ctx->y = 0; + m = ctx->m; + + for (i = 0; i < 256; i++) + { + m[i] = i; + } + + for (i = 0; i < 256; i++) + { + a = m[i]; + j = (uint8_t)(j + a + key[k]); + m[i] = m[j]; m[j] = a; + + if (++k >= length) + { + k = 0; + } + } +} + +/** + * Perform the encrypt/decrypt operation (can use it for either since + * this is a stream cipher). + */ +void RC4_crypt(RC4_CTX *ctx, const uint8_t *msg, uint8_t *out, int length) +{ + int i, x, y, *m, a, b; + out = (uint8_t *)msg; + + x = ctx->x; + y = ctx->y; + m = ctx->m; + + for (i = 0; i < length; i++) + { + x =(uint8_t)(x + 1); a = m[x]; + y =(uint8_t)(y + a); + m[x] = b = m[y]; + m[y] = a; + out[i] ^= m[(uint8_t)(a + b)]; + } + + ctx->x = x; + ctx->y = y; +} diff --git a/ssl/rsa.c b/ssl/rsa.c new file mode 100644 index 0000000000..c6fe654cbf --- /dev/null +++ b/ssl/rsa.c @@ -0,0 +1,337 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file rsa.c + * + * Implements the RSA public encryption algorithm. Uses the bigint library to + * perform its calculations. + */ + +#include +#include +#include +#include +#include "crypto.h" + +#ifdef CONFIG_BIGINT_CRT +static bigint *bi_crt(RSA_CTX *rsa, bigint *bi); +#endif + +void RSA_priv_key_new(RSA_CTX **ctx, + const uint8_t *modulus, int mod_len, + const uint8_t *pub_exp, int pub_len, + const uint8_t *priv_exp, int priv_len +#if CONFIG_BIGINT_CRT + , const uint8_t *p, int p_len, + const uint8_t *q, int q_len, + const uint8_t *dP, int dP_len, + const uint8_t *dQ, int dQ_len, + const uint8_t *qInv, int qInv_len +#endif + ) +{ + RSA_CTX *rsa_ctx; + BI_CTX *bi_ctx; + RSA_pub_key_new(ctx, modulus, mod_len, pub_exp, pub_len); + rsa_ctx = *ctx; + bi_ctx = rsa_ctx->bi_ctx; + rsa_ctx->d = bi_import(bi_ctx, priv_exp, priv_len); + bi_permanent(rsa_ctx->d); + +#ifdef CONFIG_BIGINT_CRT + rsa_ctx->p = bi_import(bi_ctx, p, p_len); + rsa_ctx->q = bi_import(bi_ctx, q, q_len); + rsa_ctx->dP = bi_import(bi_ctx, dP, dP_len); + rsa_ctx->dQ = bi_import(bi_ctx, dQ, dQ_len); + rsa_ctx->qInv = bi_import(bi_ctx, qInv, qInv_len); + bi_permanent(rsa_ctx->dP); + bi_permanent(rsa_ctx->dQ); + bi_permanent(rsa_ctx->qInv); + bi_set_mod(bi_ctx, rsa_ctx->p, BIGINT_P_OFFSET); + bi_set_mod(bi_ctx, rsa_ctx->q, BIGINT_Q_OFFSET); +#endif +} + +/** + */ +void RSA_pub_key_new(RSA_CTX **ctx, + const uint8_t *modulus, int mod_len, + const uint8_t *pub_exp, int pub_len) +{ + RSA_CTX *rsa_ctx; + BI_CTX *bi_ctx = bi_initialize(); + *ctx = (RSA_CTX *)calloc(1, sizeof(RSA_CTX)); /* reset to all 0 */ + rsa_ctx = *ctx; + rsa_ctx->bi_ctx = bi_ctx; + rsa_ctx->num_octets = (mod_len & 0xFFF0); + rsa_ctx->m = bi_import(bi_ctx, modulus, mod_len); + bi_set_mod(bi_ctx, rsa_ctx->m, BIGINT_M_OFFSET); + rsa_ctx->e = bi_import(bi_ctx, pub_exp, pub_len); + bi_permanent(rsa_ctx->e); +} + +/** + * Free up any RSA context resources. + */ +void RSA_free(RSA_CTX *rsa_ctx) +{ + BI_CTX *bi_ctx; + if (rsa_ctx == NULL) /* deal with ptrs that are null */ + return; + + bi_ctx = rsa_ctx->bi_ctx; + + bi_depermanent(rsa_ctx->e); + bi_free(bi_ctx, rsa_ctx->e); + bi_free_mod(rsa_ctx->bi_ctx, BIGINT_M_OFFSET); + + if (rsa_ctx->d) + { + bi_depermanent(rsa_ctx->d); + bi_free(bi_ctx, rsa_ctx->d); +#ifdef CONFIG_BIGINT_CRT + bi_depermanent(rsa_ctx->dP); + bi_depermanent(rsa_ctx->dQ); + bi_depermanent(rsa_ctx->qInv); + bi_free(bi_ctx, rsa_ctx->dP); + bi_free(bi_ctx, rsa_ctx->dQ); + bi_free(bi_ctx, rsa_ctx->qInv); + bi_free_mod(rsa_ctx->bi_ctx, BIGINT_P_OFFSET); + bi_free_mod(rsa_ctx->bi_ctx, BIGINT_Q_OFFSET); +#endif + } + + bi_terminate(bi_ctx); + free(rsa_ctx); +} + +/** + * @fn int RSA_decrypt(RSA_CTX *ctx, const uint8_t *in_data, uint8_t *out_data) + * @brief Use PKCS1.5 for decryption/verification. + * @param ctx [in] The context + * @param in_data [in] The data to encrypt (must be < modulus size-11) + * @param out_data [out] The encrypted data. + * @param is_decryption [in] Decryption or verify operation. + * @return The number of bytes that were originally encrypted. -1 on error. + * @see http://www.rsasecurity.com/rsalabs/node.asp?id=2125 + */ +int RSA_decrypt(RSA_CTX *ctx, const uint8_t *in_data, uint8_t *out_data, + int is_decryption) +{ + int byte_size = ctx->num_octets; + uint8_t *block; + int i, size; + bigint *decrypted_bi, *dat_bi; + + memset(out_data, 0, byte_size); /* initialise */ + + /* decrypt */ + dat_bi = bi_import(ctx->bi_ctx, in_data, byte_size); +#ifdef CONFIG_SSL_CERT_VERIFICATION + decrypted_bi = is_decryption ? /* decrypt or verify? */ + RSA_private(ctx, dat_bi) : RSA_public(ctx, dat_bi); +#else /* always a decryption */ + decrypted_bi = RSA_private(ctx, dat_bi); +#endif + + /* convert to a normal block */ + block = (uint8_t *)malloc(byte_size); + bi_export(ctx->bi_ctx, decrypted_bi, block, byte_size); + + i = 10; /* start at the first possible non-padded byte */ + +#ifdef CONFIG_SSL_CERT_VERIFICATION + if (is_decryption == 0) /* PKCS1.5 signing pads with "0xff"s */ + { + while (block[i++] == 0xff && i < byte_size); + if (block[i-2] != 0xff) + { + i = byte_size; /*ensure size is 0 */ + } + } + else /* PKCS1.5 encryption padding is random */ +#endif + { + while (block[i++] && i < byte_size); + } + size = byte_size - i; + + /* get only the bit we want */ + if (size > 0) + { + memcpy(out_data, &block[i], size); + } + + free(block); + return size ? size : -1; +} + +/** + * @fn bigint *RSA_private(RSA_CTX *c, bigint *bi_msg) + * Performs m = c^d mod n + */ +bigint *RSA_private(RSA_CTX *c, bigint *bi_msg) +{ +#ifdef CONFIG_BIGINT_CRT + return bi_crt(c, bi_msg); +#else + BI_CTX *ctx = c->bi_ctx; + ctx->mod_offset = BIGINT_M_OFFSET; + return bi_mod_power(ctx, bi_msg, c->d); +#endif +} + +#ifdef CONFIG_BIGINT_CRT +/** + * Use the Chinese Remainder Theorem to quickly perform RSA decrypts. + * This should really be in bigint.c (and was at one stage), but needs + * access to the RSA_CTX context... + */ +static bigint *bi_crt(RSA_CTX *rsa, bigint *bi) +{ + BI_CTX *ctx = rsa->bi_ctx; + bigint *m1, *m2, *h; + + /* Montgomery has a condition the 0 < x, y < m and these products violate + * that condition. So disable Montgomery when using CRT */ +#if defined(CONFIG_BIGINT_MONTGOMERY) + ctx->use_classical = 1; +#endif + ctx->mod_offset = BIGINT_P_OFFSET; + m1 = bi_mod_power(ctx, bi_copy(bi), rsa->dP); + + ctx->mod_offset = BIGINT_Q_OFFSET; + m2 = bi_mod_power(ctx, bi, rsa->dQ); + + h = bi_subtract(ctx, bi_add(ctx, m1, rsa->p), bi_copy(m2), NULL); + h = bi_multiply(ctx, h, rsa->qInv); + ctx->mod_offset = BIGINT_P_OFFSET; + h = bi_residue(ctx, h); +#if defined(CONFIG_BIGINT_MONTGOMERY) + ctx->use_classical = 0; /* reset for any further operation */ +#endif + return bi_add(ctx, m2, bi_multiply(ctx, rsa->q, h)); +} +#endif + +#ifdef CONFIG_SSL_FULL_MODE +/** + * Used for diagnostics. + */ +void RSA_print(const RSA_CTX *rsa_ctx) +{ + if (rsa_ctx == NULL) + return; + + printf("----------------- RSA DEBUG ----------------\n"); + printf("Size:\t%d\n", rsa_ctx->num_octets); + bi_print("Modulus", rsa_ctx->m); + bi_print("Public Key", rsa_ctx->e); + bi_print("Private Key", rsa_ctx->d); +} +#endif + +#ifdef CONFIG_SSL_CERT_VERIFICATION +/** + * Performs c = m^e mod n + */ +bigint *RSA_public(RSA_CTX *c, bigint *bi_msg) +{ + c->bi_ctx->mod_offset = BIGINT_M_OFFSET; + return bi_mod_power(c->bi_ctx, bi_msg, c->e); +} + +/** + * Use PKCS1.5 for encryption/signing. + * see http://www.rsasecurity.com/rsalabs/node.asp?id=2125 + */ +int RSA_encrypt(RSA_CTX *ctx, const uint8_t *in_data, uint16_t in_len, + uint8_t *out_data, int is_signing) +{ + int byte_size = ctx->num_octets; + int num_pads_needed = byte_size-in_len-3; + bigint *dat_bi, *encrypt_bi; + + /* note: in_len+11 must be > byte_size */ + out_data[0] = 0; /* ensure encryption block is < modulus */ + + if (is_signing) + { + out_data[1] = 1; /* PKCS1.5 signing pads with "0xff"'s */ + memset(&out_data[2], 0xff, num_pads_needed); + } + else /* randomize the encryption padding with non-zero bytes */ + { + out_data[1] = 2; + get_random_NZ(num_pads_needed, &out_data[2]); + } + + out_data[2+num_pads_needed] = 0; + memcpy(&out_data[3+num_pads_needed], in_data, in_len); + + /* now encrypt it */ + dat_bi = bi_import(ctx->bi_ctx, out_data, byte_size); + encrypt_bi = is_signing ? RSA_private(ctx, dat_bi) : + RSA_public(ctx, dat_bi); + bi_export(ctx->bi_ctx, encrypt_bi, out_data, byte_size); + return byte_size; +} + +/** + * Take a signature and decrypt it. + */ +bigint *RSA_sign_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, + bigint *modulus, bigint *pub_exp) +{ + uint8_t *block = (uint8_t *)malloc(sig_len); + int i, size; + bigint *decrypted_bi, *dat_bi; + bigint *bir = NULL; + + /* decrypt */ + dat_bi = bi_import(ctx, sig, sig_len); + ctx->mod_offset = BIGINT_M_OFFSET; + + /* convert to a normal block */ + decrypted_bi = bi_mod_power2(ctx, dat_bi, modulus, pub_exp); + + bi_export(ctx, decrypted_bi, block, sig_len); + ctx->mod_offset = BIGINT_M_OFFSET; + + i = 10; /* start at the first possible non-padded byte */ + while (block[i++] && i < sig_len); + size = sig_len - i; + + /* get only the bit we want */ + if (size > 0) + { + int len; + const uint8_t *sig_ptr = x509_get_signature(&block[i], &len); + + if (sig_ptr) + { + bir = bi_import(ctx, sig_ptr, len); + } + } + + free(block); + return bir; +} + +#endif /* CONFIG_SSL_CERT_VERIFICATION */ diff --git a/ssl/sha1.c b/ssl/sha1.c new file mode 100644 index 0000000000..e1d259c6eb --- /dev/null +++ b/ssl/sha1.c @@ -0,0 +1,244 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file sha1.c + * + * SHA1 implementation - as defined in FIPS PUB 180-1 published April 17, 1995. + * This code was originally taken from RFC3174 + */ + +#include +#include "crypto.h" + +/* + * Define the SHA1 circular left shift macro + */ +#define SHA1CircularShift(bits,word) \ + (((word) << (bits)) | ((word) >> (32-(bits)))) + +/* ----- static functions ----- */ +static void SHA1PadMessage(SHA1_CTX *ctx); +static void SHA1ProcessMessageBlock(SHA1_CTX *ctx); + +/** + * Initialize the SHA1 context + */ +void SHA1Init(SHA1_CTX *ctx) +{ + ctx->Length_Low = 0; + ctx->Length_High = 0; + ctx->Message_Block_Index = 0; + ctx->Intermediate_Hash[0] = 0x67452301; + ctx->Intermediate_Hash[1] = 0xEFCDAB89; + ctx->Intermediate_Hash[2] = 0x98BADCFE; + ctx->Intermediate_Hash[3] = 0x10325476; + ctx->Intermediate_Hash[4] = 0xC3D2E1F0; +} + +/** + * Accepts an array of octets as the next portion of the message. + */ +void SHA1Update(SHA1_CTX *ctx, const uint8_t *msg, int len) +{ + while (len--) + { + ctx->Message_Block[ctx->Message_Block_Index++] = (*msg & 0xFF); + + ctx->Length_Low += 8; + if (ctx->Length_Low == 0) + { + ctx->Length_High++; + } + + if (ctx->Message_Block_Index == 64) + { + SHA1ProcessMessageBlock(ctx); + } + + msg++; + } +} + +/** + * Return the 160-bit message digest into the user's array + */ +void SHA1Final(SHA1_CTX *ctx, uint8_t *digest) +{ + int i; + + SHA1PadMessage(ctx); + memset(ctx->Message_Block, 0, 64); + ctx->Length_Low = 0; /* and clear length */ + ctx->Length_High = 0; + + for (i = 0; i < SHA1_SIZE; i++) + { + digest[i] = ctx->Intermediate_Hash[i>>2] >> 8 * ( 3 - ( i & 0x03 ) ); + } +} + +/** + * Process the next 512 bits of the message stored in the array. + */ +static void SHA1ProcessMessageBlock(SHA1_CTX *ctx) +{ + const uint32_t K[] = { /* Constants defined in SHA-1 */ + 0x5A827999, + 0x6ED9EBA1, + 0x8F1BBCDC, + 0xCA62C1D6 + }; + int t; /* Loop counter */ + uint32_t temp; /* Temporary word value */ + uint32_t W[80]; /* Word sequence */ + uint32_t A, B, C, D, E; /* Word buffers */ + + /* + * Initialize the first 16 words in the array W + */ + for (t = 0; t < 16; t++) + { + W[t] = ctx->Message_Block[t * 4] << 24; + W[t] |= ctx->Message_Block[t * 4 + 1] << 16; + W[t] |= ctx->Message_Block[t * 4 + 2] << 8; + W[t] |= ctx->Message_Block[t * 4 + 3]; + } + + for (t = 16; t < 80; t++) + { + W[t] = SHA1CircularShift(1,W[t-3] ^ W[t-8] ^ W[t-14] ^ W[t-16]); + } + + A = ctx->Intermediate_Hash[0]; + B = ctx->Intermediate_Hash[1]; + C = ctx->Intermediate_Hash[2]; + D = ctx->Intermediate_Hash[3]; + E = ctx->Intermediate_Hash[4]; + + for (t = 0; t < 20; t++) + { + temp = SHA1CircularShift(5,A) + + ((B & C) | ((~B) & D)) + E + W[t] + K[0]; + E = D; + D = C; + C = SHA1CircularShift(30,B); + + B = A; + A = temp; + } + + for (t = 20; t < 40; t++) + { + temp = SHA1CircularShift(5,A) + (B ^ C ^ D) + E + W[t] + K[1]; + E = D; + D = C; + C = SHA1CircularShift(30,B); + B = A; + A = temp; + } + + for (t = 40; t < 60; t++) + { + temp = SHA1CircularShift(5,A) + + ((B & C) | (B & D) | (C & D)) + E + W[t] + K[2]; + E = D; + D = C; + C = SHA1CircularShift(30,B); + B = A; + A = temp; + } + + for (t = 60; t < 80; t++) + { + temp = SHA1CircularShift(5,A) + (B ^ C ^ D) + E + W[t] + K[3]; + E = D; + D = C; + C = SHA1CircularShift(30,B); + B = A; + A = temp; + } + + ctx->Intermediate_Hash[0] += A; + ctx->Intermediate_Hash[1] += B; + ctx->Intermediate_Hash[2] += C; + ctx->Intermediate_Hash[3] += D; + ctx->Intermediate_Hash[4] += E; + + ctx->Message_Block_Index = 0; +} + +/* + * According to the standard, the message must be padded to an even + * 512 bits. The first padding bit must be a '1'. The last 64 + * bits represent the length of the original message. All bits in + * between should be 0. This function will pad the message + * according to those rules by filling the Message_Block array + * accordingly. It will also call the ProcessMessageBlock function + * provided appropriately. When it returns, it can be assumed that + * the message digest has been computed. + * + * @param ctx [in, out] The SHA1 context + */ +static void SHA1PadMessage(SHA1_CTX *ctx) +{ + /* + * Check to see if the current message block is too small to hold + * the initial padding bits and length. If so, we will pad the + * block, process it, and then continue padding into a second + * block. + */ + if (ctx->Message_Block_Index > 55) + { + ctx->Message_Block[ctx->Message_Block_Index++] = 0x80; + while(ctx->Message_Block_Index < 64) + { + ctx->Message_Block[ctx->Message_Block_Index++] = 0; + } + + SHA1ProcessMessageBlock(ctx); + + while (ctx->Message_Block_Index < 56) + { + ctx->Message_Block[ctx->Message_Block_Index++] = 0; + } + } + else + { + ctx->Message_Block[ctx->Message_Block_Index++] = 0x80; + while(ctx->Message_Block_Index < 56) + { + + ctx->Message_Block[ctx->Message_Block_Index++] = 0; + } + } + + /* + * Store the message length as the last 8 octets + */ + ctx->Message_Block[56] = ctx->Length_High >> 24; + ctx->Message_Block[57] = ctx->Length_High >> 16; + ctx->Message_Block[58] = ctx->Length_High >> 8; + ctx->Message_Block[59] = ctx->Length_High; + ctx->Message_Block[60] = ctx->Length_Low >> 24; + ctx->Message_Block[61] = ctx->Length_Low >> 16; + ctx->Message_Block[62] = ctx->Length_Low >> 8; + ctx->Message_Block[63] = ctx->Length_Low; + + SHA1ProcessMessageBlock(ctx); +} diff --git a/ssl/ssl.h b/ssl/ssl.h new file mode 100644 index 0000000000..687104e629 --- /dev/null +++ b/ssl/ssl.h @@ -0,0 +1,416 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @mainpage axTLS API + * + * @image html axolotl.jpg + * + * The axTLS library has features such as: + * - The TLSv1 SSL client/server protocol + * - No requirement to use any openssl libraries. + * - A choice between AES block (128/256 bit) and RC4 (128 bit) stream ciphers. + * - RSA encryption/decryption with variable sized keys (up to 4096 bits). + * - Certificate chaining and peer authentication. + * - Session resumption, session renegotiation. + * - ASN.1, X.509, PKCS#8, PKCS#12 keys/certificates with DER/PEM encoding. + * - Highly configurable compile time options. + * - Portable across many platforms (written in ANSI C), and has language + * bindings in C, C#, VB.NET, Java and Perl. + * - A very small footprint for a HTTPS server (around 50-60kB in 'server-only' + * mode). + * - No dependencies on sockets - can use serial connections for example. + * - A very simple API - ~ 20 functions/methods. + * + * A list of these functions/methods are described below. + * + * @ref c_api + * + * @ref bigint_api + * + * @ref csharp_api + * + * @ref java_api + */ +#ifndef HEADER_SSL_H +#define HEADER_SSL_H + +#ifdef __cplusplus +extern "C" { +#endif + +#include +#include "crypto.h" + +/* need to predefine before ssl_lib.h gets to it */ +#define SSL_SESSION_ID_SIZE 32 + +#include "tls1.h" + +/* The optional parameters that can be given to the client/server SSL engine */ +#define SSL_CLIENT_AUTHENTICATION 0x00010000 +#define SSL_SERVER_VERIFY_LATER 0x00020000 +#define SSL_NO_DEFAULT_KEY 0x00040000 +#define SSL_DISPLAY_STATES 0x00080000 +#define SSL_DISPLAY_BYTES 0x00100000 +#define SSL_DISPLAY_CERTS 0x00200000 +#define SSL_DISPLAY_RSA 0x00400000 + +/* errors that can be generated */ +#define SSL_OK 0 +#define SSL_NOT_OK -1 +#define SSL_ERROR_DEAD -2 +#define SSL_ERROR_CONN_LOST -256 +#define SSL_ERROR_SOCK_SETUP_FAILURE -258 +#define SSL_ERROR_INVALID_HANDSHAKE -260 +#define SSL_ERROR_INVALID_PROT_MSG -261 +#define SSL_ERROR_INVALID_HMAC -262 +#define SSL_ERROR_INVALID_VERSION -263 +#define SSL_ERROR_INVALID_SESSION -265 +#define SSL_ERROR_NO_CIPHER -266 +#define SSL_ERROR_BAD_CERTIFICATE -268 +#define SSL_ERROR_INVALID_KEY -269 +#define SSL_ERROR_FINISHED_INVALID -271 +#define SSL_ERROR_NO_CERT_DEFINED -272 +#define SSL_ERROR_NOT_SUPPORTED -274 +#define SSL_X509_OFFSET -512 +#define SSL_X509_ERROR(A) (SSL_X509_OFFSET+A) + +/* these are all the alerts that are recognized */ +#define SSL_ALERT_CLOSE_NOTIFY 0 +#define SSL_ALERT_UNEXPECTED_MESSAGE 10 +#define SSL_ALERT_BAD_RECORD_MAC 20 +#define SSL_ALERT_HANDSHAKE_FAILURE 40 +#define SSL_ALERT_BAD_CERTIFICATE 42 +#define SSL_ALERT_ILLEGAL_PARAMETER 47 +#define SSL_ALERT_DECODE_ERROR 50 +#define SSL_ALERT_DECRYPT_ERROR 51 +#define SSL_ALERT_INVALID_VERSION 70 + +/* The ciphers that are supported */ +#define SSL_AES128_SHA 0x2f +#define SSL_AES256_SHA 0x35 +#define SSL_RC4_128_SHA 0x05 +#define SSL_RC4_128_MD5 0x04 + +/* build mode ids' */ +#define SSL_BUILD_SKELETON_MODE 0x01 +#define SSL_BUILD_SERVER_ONLY 0x02 +#define SSL_BUILD_ENABLE_VERIFICATION 0x03 +#define SSL_BUILD_ENABLE_CLIENT 0x04 +#define SSL_BUILD_FULL_MODE 0x05 + +/* offsets to retrieve configuration information */ +#define SSL_BUILD_MODE 0 +#define SSL_MAX_CERT_CFG_OFFSET 1 +#define SSL_MAX_CA_CERT_CFG_OFFSET 2 +#define SSL_HAS_PEM 3 + +/* default session sizes */ +#define SSL_DEFAULT_SVR_SESS 5 +#define SSL_DEFAULT_CLNT_SESS 1 + +/* X.509/X.520 distinguished name types */ +#define SSL_X509_CERT_COMMON_NAME 0 +#define SSL_X509_CERT_ORGANIZATION 1 +#define SSL_X509_CERT_ORGANIZATIONAL_NAME 2 +#define SSL_X509_CA_CERT_COMMON_NAME 3 +#define SSL_X509_CA_CERT_ORGANIZATION 4 +#define SSL_X509_CA_CERT_ORGANIZATIONAL_NAME 5 + +/* SSL object loader types */ +#define SSL_OBJ_X509_CERT 1 +#define SSL_OBJ_X509_CACERT 2 +#define SSL_OBJ_RSA_KEY 3 +#define SSL_OBJ_PKCS8 4 +#define SSL_OBJ_PKCS12 5 + +/** + * @defgroup c_api Standard C API + * @brief The standard interface in C. + * @{ + */ + +/** + * @brief Establish a new client/server context. + * + * This function is called before any client/server SSL connections are made. + * If multiple threads are used, then each thread will have its own SSLCTX + * context. Any number of connections may be made with a single + * context. + * + * Each new connection will use the this context's private key and + * certificate chain. If a different certificate chain is required, then a + * different context needs to be be used. + * + * @param options [in] Any particular options. At present the options + * supported are: + * - SSL_SERVER_VERIFY_LATER (client only): Don't stop a handshake if the server + * authentication fails. The certificate can be authenticated later with a + * call to ssl_verify_cert(). + * - SSL_CLIENT_AUTHENTICATION (server only): Enforce client authentication + * i.e. each handshake will include a "certificate request" message from the + * server. Only availabile if verification has been enabled. + * - SSL_NO_DEFAULT_KEY: Don't use the default key/certificate. The user will + * load the key/certificate explicitly. + * - SSL_DISPLAY_BYTES (full mode build only): Display the byte sequences + * during the handshake. + * - SSL_DISPLAY_STATES (full mode build only): Display the state changes + * during the handshake. + * - SSL_DISPLAY_CERTS (full mode build only): Display the certificates that + * are passed during a handshake. + * - SSL_DISPLAY_RSA (full mode build only): Display the RSA key details that + * are passed during a handshake. + * + * @param num_sessions [in] The number of sessions to be used for session + * caching. If this value is 0, then there is no session caching. This option + * is not used in skeleton mode. + * @return A client/server context. + */ +EXP_FUNC SSLCTX * STDCALL ssl_ctx_new(uint32_t options, int num_sessions); + +/** + * @brief Remove a client/server context. + * + * Frees any used resources used by this context. Each connection will be + * sent a "Close Notify" alert (if possible). + * @param ssl_ctx [in] The client/server context. + */ +EXP_FUNC void STDCALL ssl_ctx_free(SSLCTX *ssl_ctx); + +/** + * @brief (server only) Establish a new SSL connection to an SSL client. + * + * It is up to the application to establish the logical connection (whether it + * is a socket, serial connection etc). + * @param ssl_ctx [in] The server context. + * @param client_fd [in] The client's file descriptor. + * @return An SSL object reference. + */ +EXP_FUNC SSL * STDCALL ssl_server_new(SSLCTX *ssl_ctx, int client_fd); + +/** + * @brief (client only) Establish a new SSL connection to an SSL server. + * + * It is up to the application to establish the initial logical connection + * (whether it is a socket, serial connection etc). + * + * This is a blocking call - it will finish when the handshake is complete (or + * has failed). + * @param ssl_ctx [in] The client context. + * @param client_fd [in] The client's file descriptor. + * @param session_id [in] A 32 byte session id for session resumption. This + * can be null if no session resumption is being used or required. This option + * is not used in skeleton mode. + * @return An SSL object reference. Use ssl_handshake_status() to check + * if a handshake succeeded. + */ +EXP_FUNC SSL * STDCALL ssl_client_new(SSLCTX *ssl_ctx, int client_fd, const uint8_t *session_id); + +/** + * @brief Free any used resources on this connection. + + * A "Close Notify" message is sent on this connection (if possible). It is up + * to the application to close the socket or file descriptor. + * @param ssl [in] The ssl object reference. + */ +EXP_FUNC void STDCALL ssl_free(SSL *ssl); + +/** + * @brief Read the SSL data stream. + * @param ssl [in] An SSL object reference. + * @param in_data [out] If the read was successful, a pointer to the read + * buffer will be here. Do NOT ever free this memory as this buffer is used in + * sucessive calls. If the call was unsuccessful, this value will be null. + * @return The number of decrypted bytes: + * - if > 0, then the handshaking is complete and we are returning the number + * of decrypted bytes. + * - SSL_OK if the handshaking stage is successful (but not yet complete). + * - < 0 if an error. + * @see ssl.h for the error code list. + * @note Use in_data before doing any successive ssl calls. + */ +EXP_FUNC int STDCALL ssl_read(SSL *ssl, uint8_t **in_data); + +/** + * @brief Write to the SSL data stream. + * @param ssl [in] An SSL obect reference. + * @param out_data [in] The data to be written + * @param out_len [in] The number of bytes to be written. + * @return The number of bytes sent, or if < 0 if an error. + * @see ssl.h for the error code list. + */ +EXP_FUNC int STDCALL ssl_write(SSL *ssl, const uint8_t *out_data, int out_len); + +/** + * @brief Find an ssl object based on a file descriptor. + * + * Goes through the list of SSL objects maintained in a client/server context + * to look for a file descriptor match. + * @param ssl_ctx [in] The client/server context. + * @param client_fd [in] The file descriptor. + * @return A reference to the SSL object. Returns null if the object could not + * be found. + */ +EXP_FUNC SSL * STDCALL ssl_find(SSLCTX *ssl_ctx, int client_fd); + +/** + * @brief Get the session id for a handshake. + * + * This will be a 32 byte sequence and is availabile after the first + * handshaking messages are sent. + * @param ssl [in] An SSL object reference. + * @return The session id as a 32 byte sequence. + * @note A SSLv23 handshake may have only 16 valid bytes. + */ +EXP_FUNC const uint8_t * STDCALL ssl_get_session_id(SSL *ssl); + +/** + * @brief Return the cipher id (in the SSL form). + * @param ssl [in] An SSL object reference. + * @return The cipher id. This will be one of the following: + * - SSL_AES128_SHA (0x2f) + * - SSL_AES256_SHA (0x35) + * - SSL_RC4_128_SHA (0x05) + * - SSL_RC4_128_MD5 (0x04) + */ +EXP_FUNC uint8_t STDCALL ssl_get_cipher_id(SSL *ssl); + +/** + * @brief Return the status of the handshake. + * @param ssl [in] An SSL object reference. + * @return SSL_OK if the handshake is complete and ok. + * @see ssl.h for the error code list. + */ +EXP_FUNC int STDCALL ssl_handshake_status(SSL *ssl); + +/** + * @brief Retrieve various parameters about the TLS engine. + * @param offset [in] The configuration offset. It will be one of the following: + * - SSL_BUILD_MODE The build mode. This will be one of the following: + * - SSL_BUILD_SERVER_ONLY (basic server mode) + * - SSL_BUILD_ENABLE_VERIFICATION (server can do client authentication) + * - SSL_BUILD_ENABLE_CLIENT (client/server capabilties) + * - SSL_BUILD_FULL_MODE (client/server with diagnostics) + * - SSL_BUILD_SKELETON_MODE (skeleton mode) + * - SSL_MAX_CERT_CFG_OFFSET The maximum number of certificates allowed. + * - SSL_MAX_CA_CERT_CFG_OFFSET The maximum number of CA certificates allowed. + * - SSL_HAS_PEM 1 if supported + * @return The value of the requested parameter. + */ +EXP_FUNC int STDCALL ssl_get_config(int offset); + +/** + * @brief Display why the handshake failed. + * + * This call is only useful in a 'full mode' build. The output is to stdout. + * @param error_code [in] An error code. + * @see ssl.h for the error code list. + */ +EXP_FUNC void STDCALL ssl_display_error(int error_code); + +/** + * @brief Authenticate a received certificate. + * + * This call is usually made by a client after a handshake is complete and the + * context is in SSL_SERVER_VERIFY_LATER mode. + * @param ssl [in] An SSL object reference. + * @return SSL_OK if the certificate is verified. + */ +EXP_FUNC int STDCALL ssl_verify_cert(SSL *ssl); + +/** + * @brief Retrieve an X.509 distinguished name component. + * + * When a handshake is complete and a certificate has been exchanged, then the + * details of the remote certificate can be retrieved. + * + * This will usually be used by a client to check that the server's common + * name matches the URL. + * + * A full handshake needs to occur for this call to work properly. + * + * @param ssl [in] An SSL object reference. + * @param component [in] one of: + * - SSL_X509_CERT_COMMON_NAME + * - SSL_X509_CERT_ORGANIZATION + * - SSL_X509_CERT_ORGANIZATIONAL_NAME + * - SSL_X509_CA_CERT_COMMON_NAME + * - SSL_X509_CA_CERT_ORGANIZATION + * - SSL_X509_CA_CERT_ORGANIZATIONAL_NAME + * @return The appropriate string (or null if not defined) + * @note Verification mode must be enabled. + */ +EXP_FUNC const char * STDCALL ssl_get_cert_dn(SSL *ssl, int component); + +/** + * @brief Force the client to perform its handshake again. + * + * For a client this involves sending another "client hello" message. + * For the server is means sending a "hello request" message. + * + * This is a blocking call on the client (until the handshake completes). + * + * @param ssl [in] An SSL object reference. + * @return SSL_OK if renegotiation instantiation was ok + */ +EXP_FUNC int STDCALL ssl_renegotiate(SSL *ssl); + +/** + * @brief Process a file that is in binary DER or ASCII PEM format. + * + * These are temporary objects that are used to load private keys, + * certificates etc into memory. + * @param ssl_ctx [in] The client/server context. + * @param obj_type [in] The format of the file. Can be one of: + * - SSL_OBJ_X509_CERT (no password required) + * - SSL_OBJ_X509_CACERT (no password required) + * - SSL_OBJ_RSA_KEY (AES128/AES256 PEM encryption supported) + * - SSL_OBJ_PKCS8 (RC4-128 encrypted data supported) + * - SSL_OBJ_PKCS12 (RC4-128 encrypted data supported) + * + * PEM files are automatically detected (if supported). + * @param filename [in] The location of a file in DER/PEM format. + * @param password [in] The password used. Can be null if not required. + * @return SSL_OK if all ok + * @note Not available in skeleton mode. + */ +EXP_FUNC int STDCALL ssl_obj_load(SSLCTX *ssl_ctx, int obj_type, const char *filename, const char *password); + +/** + * @brief Process binary data. + * + * These are temporary objects that are used to load private keys, + * certificates etc into memory. + * @param ssl_ctx [in] The client/server context. + * @param obj_type [in] The format of the memory data. + * @param data [in] The binary data to be loaded. + * @param len [in] The amount of data to be loaded. + * @param password [in] The password used. Can be null if not required. + * @return SSL_OK if all ok + * @see ssl_obj_load for more details on obj_type. + */ +EXP_FUNC int STDCALL ssl_obj_memory_load(SSLCTX *ssl_ctx, int obj_type, const uint8_t *data, int len, const char *password); + +/** @} */ + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/ssl/test/Makefile b/ssl/test/Makefile new file mode 100644 index 0000000000..ddf3526b95 --- /dev/null +++ b/ssl/test/Makefile @@ -0,0 +1,65 @@ +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +all: + +include ../../config/.config +include ../../config/makefile.conf + +ifdef CONFIG_PERFORMANCE_TESTING +all: performance +endif + +ifdef CONFIG_SSL_TEST +all: ssltesting +endif + +ifndef CONFIG_PLATFORM_WIN32 +performance: ../../perf_bigint +ssltesting: ../../ssltest +LIBS=../../libaxtls.a +CFLAGS += -I../../ssl -I../../config + +../../perf_bigint: perf_bigint.o $(LIBS) + $(CC) $(LDFLAGS) -o $@ $^ + +../../ssltest: ssltest.o $(LIBS) + $(CC) $(LDFLAGS) -o $@ -lpthread $^ +else +performance: ../../perf_bigint.exe +ssltesting: ../../ssltest.exe +CFLAGS += /I".." /I"../../config" + +%.obj : %.c + $(CC) $(CFLAGS) $< + +OBJLIST=..\aes.obj ..\asn1.obj ..\bigint.obj ..\crypto_misc.obj ..\hmac.obj \ + ..\md5.obj ..\loader.obj ..\p12.obj ..\os_port.obj ..\rc4.obj \ + ..\rsa.obj ..\sha1.obj ..\tls1.obj ..\tls1_clnt.obj ..\tls1_svr.obj + +../../perf_bigint.exe: perf_bigint.obj $(OBJLIST) + $(LD) $(LDFLAGS) /out:$@ $^ + +../../ssltest.exe: ssltest.obj $(OBJLIST) + $(LD) $(LDFLAGS) /out:$@ $^ +endif + +clean:: + -@rm -f ../../perf_bigint* ../../ssltest* + +include ../../config/makefile.post diff --git a/ssl/test/axTLS.ca_key.pem b/ssl/test/axTLS.ca_key.pem new file mode 100644 index 0000000000..7c8ac8af28 --- /dev/null +++ b/ssl/test/axTLS.ca_key.pem @@ -0,0 +1,15 @@ +-----BEGIN RSA PRIVATE KEY----- +MIICWwIBAAKBgQCnZdk20fYWh8O6kDTt0AuJWyp0YIrb7W1UNNMPXI5wA4J59IVj +Nmk5wocm9+Hqzbg7rORAN/mHPBhzLAjhnm1HODs36hW15DtbDkkH4wCM/Tsyv79m +n0xq1V6peK3t9vi2D4p/IRjHkYR2jm+BeknopijhY0kHHfpGTHa2DnVirwIDAQAB +AoGAd4Ia5SxYiBU9A0BYyT8yPUm8sYELIaAL4YYk+F6Xwhh/Whnb8MyzquzaGFP4 +Ee30jYYNHlvX5VheDDtvy8OTN5FgKNNdzvW15iA4Hxje04ZI7W87G7OIxm7aYRid +sG4XqZBtsOdj33IRd9hgozywGJ2qRqS6nn2KxRv1w07RniECQQDZAlKxijdn+vQ7 +8/8mXzC+FwQtzeTUCuLrBJcos9I/591ABoxYkWcYLxpFqgCEVwb1qfPBJkL07JPt +Fu6CTnBFAkEAxXmUBs47x5QM99qyBO5UwW0Ksrm/WD4guaaxzQShMt/HzgJl613z +/x4FtxiQJHAr6r2K0t5xTJx89LVKuouYYwJAImue6DAvJ5wDfzrtXo28snn+HLHK +uONdKL/apgcXszE4w74GJsoxWwGlniUf3d3b6b1iP2GtPyIDOJjpjduZLQJAE4jS +VtYB3d1MZxxQLeKxqayyuTlcr0r+C79sqT5C//hZGIzuLhlOMLd0k0cvwxsBjSgQ +2ok8pfp49fAVI1z5xwJAVmJgLc/mSti5A2q3c8HW8qvMJEDPWbpb7p8pg4ePtpa8 +EE3TO4O4J2H+k40C397km4yZXdkNQsiT1zVljJZpiw== +-----END RSA PRIVATE KEY----- diff --git a/ssl/test/axTLS.ca_x509.cer b/ssl/test/axTLS.ca_x509.cer new file mode 100644 index 0000000000000000000000000000000000000000..9c9936b8e98d0b7475e522377e64ee5cb7d9858c GIT binary patch literal 483 zcmXqLV!UtA#OT4q$uKvs*kYO0(kKI7HcqWJkGAi;jEtmp zDoN&tJf@_eyO<6*KV zyX-GFpR#RyrAh0Vm>C%uk(~z&JZ7M~WVst|nJiE@P*UHyEW+SG%xvc~wa?bgyU%&o z__O9cjynut$9A5`TwES67IMd>m+OQ}^u4t{;lgJg9l!sr3OSV*OvR3NHYY8-f#GI I<)^zO0PSqO5dZ)H literal 0 HcmV?d00001 diff --git a/ssl/test/axTLS.ca_x509.pem b/ssl/test/axTLS.ca_x509.pem new file mode 100644 index 0000000000..86f659710c --- /dev/null +++ b/ssl/test/axTLS.ca_x509.pem @@ -0,0 +1,13 @@ +-----BEGIN CERTIFICATE----- +MIIB3zCCAUgCCQCdbnM4pjqlWjANBgkqhkiG9w0BAQUFADA0MTIwMAYDVQQKEylh +eFRMUyBQcm9qZWN0IERvZGd5IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0wNjA2 +MDcxMTQ0MzJaFw0zMzEwMjMxMTQ0MzJaMDQxMjAwBgNVBAoTKWF4VExTIFByb2pl +Y3QgRG9kZ3kgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUA +A4GNADCBiQKBgQCnZdk20fYWh8O6kDTt0AuJWyp0YIrb7W1UNNMPXI5wA4J59IVj +Nmk5wocm9+Hqzbg7rORAN/mHPBhzLAjhnm1HODs36hW15DtbDkkH4wCM/Tsyv79m +n0xq1V6peK3t9vi2D4p/IRjHkYR2jm+BeknopijhY0kHHfpGTHa2DnVirwIDAQAB +MA0GCSqGSIb3DQEBBQUAA4GBAB0LgNo0oCcwIie5plgwwFybQ8x95q6e3wndM/Mp +3gjcAFbGuchpo3dfFlTcRI0KyERb3q1MVxPM4sff9nT7EdHVyK9s8/ITkP2dcTKc +flbcTEfJVIeM8L2P5F41Hvn9GuGcMW8EmsC06gdbp1LLnqsdrXdMNBsAUBXfgPrU ++UcZ +-----END CERTIFICATE----- diff --git a/ssl/test/axTLS.device_key b/ssl/test/axTLS.device_key new file mode 100644 index 0000000000000000000000000000000000000000..4e981d143e1383828b8a76e18c57e0b0f59b202f GIT binary patch literal 609 zcmV-n0-pUaf&yIv0RRGlfdJGZ4h<43zjh$NmAe*gFd;CkIEWYaUz#Bpms2~d;TZ=+ zk`Pe_4BeOCv@NwmC65?N)gXrn?#|TyB9lU`OINiLyb68LKj!YuC$?l`)u2L1ZuNgc z=Sux+ln*4$Nfhl{gttWP`YNkiPpo0p0h3)_$nwg2s|lRS$t9_kyc+@o0RRC4fq?*^ zL=H=j!{3Frp6Ni0WB0Agp#h-CLCM~qOnu)|K)UjF%r+-Ic-(fn!L=2LAE_OnV2@ezYPqfv?7EVw ztnGa>p_(hpRr+n(N$Ooc;-Ug;rmFgzfA1^_2-*k;^0%11vl#+G0M`^95MJ-`(OR-i zBA|9yFh78sA*+l|0wMujX*I%@o4%O>ok-BGDtQP3_l0oh2@5c16ixpA!QhEf#zLZF zQvyK%tS>_pbrT+q^2G&mI(6scS|AxC&V>TLsLms2K>j$f{xgTlW2bz`iWbV^SZp~M zSQa|OOK(li0kpVqV}#k^0zZ3z5inI#a)-o>oxVh6us#Gh)Z2ij5G5&LpFzr;@!ous zU+nPW;~#)v8B_>M%wA;5u?2*padHnE!MbMQTY+(0Wgg|0 v3cKQF;e2bA5N6M*E~R!7Tl|5&J97n<934}R7|5Rx8jwm@UwAr_9k^bwbVnG3 literal 0 HcmV?d00001 diff --git a/ssl/test/axTLS.device_key.pem b/ssl/test/axTLS.device_key.pem new file mode 100644 index 0000000000..2bcf5e37b3 --- /dev/null +++ b/ssl/test/axTLS.device_key.pem @@ -0,0 +1,15 @@ +-----BEGIN RSA PRIVATE KEY----- +MIICXQIBAAKBgQDUIg4NEiu/diDAlbsWbTAhMKw4iBf2X5ohGJdTO6vhGQdEkhBR +Bgzdl9+0LbVDJY8YStUghwnuztT+IpNCrUtXtRK8Cn3QP+buzSe2ZGPVoEJIbvV/ +QudK/WuUDyTNSRTtW4S3RO36KqtbT6xh1QGTXV3I8sp7qwmcysklqZW8GwIDAQAB +AoGBAKBEDkuPw9+Ftp7pQIxj963LoQGgyEHJ3p9Mfd9TQLrydsw2cf9Uy9mKiWcN +9VkCgkZ/Gt/VRgrW1pIduxXv6O+8S14An+2mTayy3Ga1N6MulD7OHQP9kqR4j8TT +xaYPR/1skjhQ+Y0Uw4NEa3OkQp6lAUEp1aVX/mTfIZBguaUxAkEA/H543Ha6wbUV +iB+pHaBgj1nzarmuEey6kqqs7X0zoZory1X6bdpJ6l0/4qICa6aq+pt/7ywJCNoI +CPK3mL2zGQJBANcUHRBe7/HRWrJNIqB2WDA/gJshq4xOAiIBXWk1wpabvpkCnUjQ +rip5CAL3hXDnCQswZxRN/v7B4IlSxkKiY1MCQQCsL0MUdRMejfLFBXI6defjWiAZ +I86FAr6oziNnQP44sf4zh8pjp3zIihbK4lhsORhYFjrES29NzgG0uHBjhNnhAj97 +gBEwVVNyh8SMnb5EZbA+BDjU24CmECUpYZ9Bypzx3nyTX+zw4uMfgGAZVAhLzF5l +DmYiQqcpoipMsDsoCBcCQQCxBYSicXIPG8G6ZuFbgXFcZR7llgq74mbhfGuVEGbP +qS6ldhJb/IG9O3MFlRwdU44YyJ8QGpBKWF94OpIduF6w +-----END RSA PRIVATE KEY----- diff --git a/ssl/test/axTLS.encrypted.p8 b/ssl/test/axTLS.encrypted.p8 new file mode 100644 index 0000000000000000000000000000000000000000..8b0a7eb4117de421cfb917de7f03055fdfe2c28f GIT binary patch literal 385 zcmV-{0e=24f&qOn90m$1hDe6@4FL=R0Wb~(2zv&jLbrq;i2?!$00e>oTecB0S5Ch{ zHl7H=qA4HIOB;)ah$8h!;8it(u3j>D`liQs0*+k*%XW@PAMoO|ZVtaORrZR~IdUoh zNf*1NZ0jCJOsIuor2OuhY5SBS)gmT$Plt&Ub|ujkSvY}HF3T6ZV$+;=Cj1_ zqiV0Xy#~l}wq>xTcs~vcY@+sZ^yo(jDeDIm8}2%S8s3H&bnWkZz@9kPK8*&28D$i9 z3|2M?_7i99)`(fX3rvXr@m91pnk>4N^QQR5XPP=(qj)V!5qKV+KU4NR01UFqcL=0O z)N0{uLA$ f>0oNt1g(0Zzb?&!uhc`Lu&kDME*dK^i&ZfFoN%%v literal 0 HcmV?d00001 diff --git a/ssl/test/axTLS.encrypted_pem.p8 b/ssl/test/axTLS.encrypted_pem.p8 new file mode 100644 index 0000000000..19ca3c5eae --- /dev/null +++ b/ssl/test/axTLS.encrypted_pem.p8 @@ -0,0 +1,11 @@ +-----BEGIN ENCRYPTED PRIVATE KEY----- +MIIBfTAcBgoqhkiG9w0BDAEBMA4ECN+YmhCv0ILdAgIIAASCAVu0QEfMkp0xUsNq +0Ek4Nsa/uxcs8N/2P7Ae7qCakkvsdRvvPPH0y+wuj5NgrG6WpPeeEx9fI2oNNTfC +pwncH0Xm99ofVrgMX6XC45LDZtzXNSZd4TdBP6xvlYXbuGegp5GPJ8emzscHCFhC +JfPHemRAcB7DhiWukPosuSUr5R8OluEMJrQLHuQtlDAvMjLEI98lSchPxF8LKCk3 +SS2uCcmc+4WiR0nHG9BOaGi38+PytHAnbfo1mfVSQzLfgLicMAVGysfQ9QOgpQOO +ygYfM/s7Duwbl0rshyXVJP+7BpYJnPtHvO4BTiizU7ZEr4WBiEnnANDrupSdsxeH ++cxZo70YJVdoPdgMd2ke6EIkUhp7HughFg+okldlEtJA4muKeEzwAxZu0TqxOtZ8 +UYRS4Ygk+rN7Y0qTKSYwSkrFBwUDkpctYjRUOeAZ/mYMKWmMn1ejAb5Is7bjEIxl +tw== +-----END ENCRYPTED PRIVATE KEY----- diff --git a/ssl/test/axTLS.key_1024 b/ssl/test/axTLS.key_1024 new file mode 100644 index 0000000000000000000000000000000000000000..5b6ba1d037b002b0d62c9903a3582daac05f77e2 GIT binary patch literal 609 zcmV-n0-pUaf&yIv0RRGlfdJUxzZKro+(m=R>yKlNL=U?*N-L4NhtAFS(rd;edexK>+Roc*l5!1eeSb!19#biHMZR!!od?jgH`Kb>w%687GkutJnIO6oO#nY%JBk00O>_vE*8v_P(ZeM zyg1-iXi(EHbBv5C4uMLFyUg%pG)A8XeImB`MyyvOj2`RL1x=`fYG?MQv8#^3@9%x^ z!va7r##ufX=mK*A@81nDOXwG=jKS!Mks0{(q_+)5_cTxgUJ9@&6s`anfHIu5fuH0; zf)t=Vi;POuOB0>6lS0gAIAV!eeFdnK&`0|5X50)hbn0KrYIAk0gtB;cu1_*7~DLp$s41j1L{dy$8u z>Q{6SrHuFJ5=4!AZ6f&-rB0VNk}EF%GnIau0>!zBGX8BCm(}Gomw{5otF4q+j_!p^p1sm3^l)5OV-`8fG^47KzM3=dOYqWQN}Mx08R?P zYG(QI^V0Ya2D(mOHZ6n3J@*&>6Q$zUudW;ASZ zQzH5(Vi)P&Q`Izs^HP*fY*{R7YiqEtv!@=|O8tlwC^M*Cwj0|J48 z0LvBOMMw2v^dO~mza7xFv4n50Qe?_on9muo``SJVw9twDxz;$tm3C(+A5JQ?3KbZA zjJgHmx*IBX4Ilw`JwQ-@w86>Eta4z4TXD9^xK10mFm*b9*FGd6pGoDEYM0?EA=1$? zAh{7-VIk);QUektIB7B1=h0D7V+h(3j{<>!Ay@B-IXxJRi!d!JY9)Q_y>BYaL$g&; zytn>PR~(ZYzYOl@OGA*<38Cgn$53>6_^#wDST1{Xw-R%AJ5f%kWK&JFV-I!P2AUax z?0^i4+Xou6@fpn6>Md z0)c=X@A}4A#y*Q%XsE;Fq)6I8SgLZZ^7^m458-?+{^(mFM#e>F-0j)c{*7c|js3Dusa$NJOJF%*s<_@CX`P5&9Zxl{ zJ26krm{pSK35pUk>#y4J{_H2XK9P;o*ErV#fq*qDV<*E0RC9D5w-*D^YaVVcH?W@L z7s;4%??z;ZXmnf~khf-nE#R3RkTMy4Ep0;5M@#wpmeJ?wh-{#-F%}3)vYB3 ztJJUoqYbWSsq{2`FhC1&(maox?BB8At*_qHegN_Cm(UerlhGFqSp+Cz&}#6X`{ z2H3(|N2wGExlD97fXsOeCn^W`4Pn++s+M#D>;O(~wfl~y;qgj?b^u`WqW``cC|ig? z96y!M7XS2>*B=ru_+Qy_9la*KLK^5a-5uR~wh=@#U7Tn=6AH}gihl`NTe>q(s6__@ z%!kaMhJ)^ct&_f>W0CD_-U+Y4I0SM3pkvJ2 zC5#@2b&4ibCx^XoK}a?;7P^WLB95^r%-L{Z^TI${%`T)LB-5txgX;UR9*9tfG zp0JoMr}gZ3&ElIoiQP({zW|?|Q29=N}D%WseeY63jXE#yASA&jVGam|+W!jT0{up!{AH7z;XMwF|1&oLlT zIf-10|5X50)heo0Ic&e?J7A6sOJ1oEf|dfVdPFl7nV#Utbk!IcE+x| zwzL2mzN#?8R)=NF$soY8eCHCB3H|LyF9zTm1EmhU@HP^xA!jo7)<0XT9bP4MXZ}Tg z9vpLn130B*c(tPYd~`tvpU+SK#>$+(${mFip2Fs^tL+p5xrw4e0R9cryNig*Qm99AT2>K`J_ZtV`sYF+WVfz|JC5a< z32|_d#wA0pmA>Jqt>Mq+?{md{55I*UK^tnI4QyYb3M%J`W?RySWV>v6a0W~ptFc#8 z2+k-`_?PuZljI(Z0ycu)f%7=#+3so6_4~q}&izudsVk7dFnzrcH(x^A=H{OU7it9{ zgYY)1WTAuDc>i}P!P>*jVZ-o?Z5mw5N5SWmc^m+(>O|VI_8zn(F&6&QuB}9w1$fl; zoTz0hq;ReN$wnV{J0^Im88if^GkC^Y=)-Cng#lZ*eux-L-x(rbUK01LbXkwx0H)&siZdBsGY zPMq(uI&?)?UC^J;$pV4_0RaDqB(do1D>>Gq+(e`t>wW2jmbau)pXl!~H>zdxJy}70 zFQJ@~IHF5WD^efq<~`Y-ZapdE=Lvf^%`bxIV>8_ zpi17`dW!em{S$qPsQ zzinB>N&dd23n`lgx*LKC_VcD7mz0m(-cw6)yAq_15GEpUr!x{xm4s%+;_{m6IW3%P zUSyYXejLf2KjE=QU6-!scDoFt6`f&l+0&(85wU;4{*%q6qPV8GmC(8`8*ZrUuiq8z;aBT#Uur zDKGrMBOFWEVn`AV4MGdUv>t%IN_x}+7WbM=`KGAls{0t4O86`nN}ZmdaAZh%0M=q= z(+Zh=EN$fYA?`prE2p~xf&l+H9=lOdxG5_)MY;GlVN!q)iERlQWT;`HHkO%rFj6$8Eo2%|Sb z{rF3nAU+bOCGW7&gx08o=COjKnG9OXBv*(*XA_7DIoHpF9f_YHl z6Rf__Wk*KocnrQNJq$tmKXqr5#tV-L-)jzV4sP&t6|KgmadNx7o=1RY_L`XR=my%F zxJ*{_68OcU5|vB!271W?f&l>lq7j)r+-H%^f<*}JSZVtPV&|7V_uzNj4B0wPZU%(I z!-#xJMnItAM}A*#OO?#rh~@QEQ+PsjlRKVqeTyM#dxk0l02_r9_ zBsL~(g-PWYbR%PVYD*$Dua&VxhCu}x`T7lBNtJ2|fQF1p@+xlc!^9lFEq)(oD{-AG zMv3>^$8)&&Cqm9W>bB2ITLy^6lMzc_-U;tIQITU0U)4vV zu^PNP`(&Igf`#YYx+c>R;XC3`YZg5g(tGs#J^3oGTnXfccDQZ1E2^{1-{SxQU()Tj Tbx&XXcZMQG44N=;lHrQ{Y;S%h literal 0 HcmV?d00001 diff --git a/ssl/test/axTLS.key_4096.pem b/ssl/test/axTLS.key_4096.pem new file mode 100644 index 0000000000..9929467f45 --- /dev/null +++ b/ssl/test/axTLS.key_4096.pem @@ -0,0 +1,51 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIJKQIBAAKCAgEA/Ce0mV0qytAwDPrjXRBlUh2gdKs2thDw3N18owXVrSUFq9Sw +AaMNrmep9DR9MEALcdMm3GCEJ7sOOiEQcqTz25di36WJDe+jo1z5nD2XZsPIsp9+ +k51Vz+W3B4vsXJAgzV+XZbmv9L0598VEwkpeI3Uc9et8ZhGvDPoHZyBQG1KAj6h3 +AKZ1+NthrhajxlrndQZ5Du/R5DSUQOBcCHHdzZgihdfF97Yn/kp1mele1ElZMlqg +BtpDi1TEQJ9XBtjCW0epFAm5THQ3gMx5DCcqB/cNYdZWqpZ0AuwATm61+46m4fFK +g3YAYPOi/74aKFuIQBw/lc8W//SV1x8SL/hf2XIdvSa9QhroNN0d3Xu2EUQzXZxo +PRMKzOqKfwlZW7ozT6hFBwPMh8yfhoPugq2TvqBjke1s3gmvwTgEcf+gY97qXiZC +X5bh/ehmnZ7vIblYFUD2yMlsKaXGJYweh3WKJlQnh71wQUg2Mxa6ig8ijrEozNlw +YfPCQFrNLqQfJOwdx90dy7hpUyUn1wo39p6wmC6n9ex4zeKbO4ndSp+/AJ+d5Qp8 +zoMzwneYV9LBQG8ry4uwzDkSWKb/WghsEbQ9O3sGIuI13SlT/B64v3bLb5AHagI8 +zS3kPsshjKhkcc2W9MKRBU2wIeCsNS052kaUq3rPMSBROrALmLk3en/Dq48CAwEA +AQKCAgEArPMy7So5Cqjm/FAtGI0BYeRORReWTCSsgGEudsauu7a0ABq+qjDDVodl +y8kgwLJ85xKUCf3tRy8G4BoDpQ688DYSrCFnMvbWP1urHV4ldWf+RX4eHHODAzil +ZHi1ovt8dEEHn89P/8a2dtqIgdbuYNWYCpj9Vyjz7yujXjmMmGDrKx26meiS7CDV +C8odhRSewuawq+0UArmJokIA/g3Tu4uIylKoR3JaVhGOPgYSc/rnQiFkt66HO47l +mQlxcJHGJUOulb7hqK3hz+bvc8V9D7+FH0EbaqANbF+hCirniWZb0odku2x5cAZM +G6uxV1MIzihR+Jf1R5PkHowCNoLegfM45tnuadP1+8Kezv1SsqkrkMEwfb0QN19C +2+bmnwYXagUgg/A2q2Shg9h4/3cpwdrDzGHD8IttGlzLR8HnlHkcAK3qRNqy9h60 +JDEW/tOurUSZBXjU9ZyoZSukcK3+yUjCDWS92wMOBlUQGh4/HCOOizahe6lhn2nT ++jkBvl38c+7GBKR0VyCisFi++FukMBbyU/hNNFByZxOj0b/+YVYI0qwM5oDzLhJH +69/VhxMx0xVt9/kOOO3yhdGjKCZztPZZm5mg2OzzXmf4im+hPSg0/OrdXrVNk4v/ +w7ouUQHSa3+rAAu8BJFF2rTWA7rjecVEnk6c77I6dEVYXdCfz8kCggEBAP+IJLHo +7Cs51qPcRKQc633phJa3pFGf6O8xN6pl8z1ZQX0voZyROKJLTytSH+zmPdmggUeg +7CRoV8BKY49YiOxO2Kx8BPfftItS9yvA3O9ztcdzQa72nYusMWwvj0yFU8DbYfnx +yYw59F/1pdPKFN83Sj4MJAOb4nAxBP1GiZvsPAgcTpf/197NLNHwUDdk/TXDtTLa +lx4uTn/SJDQuvsCCLBKyx7FdN5NPRN2kIKUWZLd7HRu2EhcSlATwf4TUPZz7atKN +2FD0svErpPOAspNPtnNj3RgeunGVqS2oi/XueuveNNCYLkcV8/UaZm85LBrPoEre +23qK9/ZN0SD534sCggEBAPyd+nD71pScrM0TI4Lc3jMNUKeZj3sT5rlhlkWlARhQ +WPEWYYg5vs3zDiRpG4Xy3n9ey+M6Tuw+/XpcJZxhrLYFOqparxXPP4qc+3EvtzpF +OskLR/2/bVnESf6+pQspmwW6G4IJ9vOmIJeUj9zeU0txuxKkjhAmInCnMxJOlYRm +xeLymuo5LZxrXmSXcX4cyZ0/4bF2L3IE5vH7ffdWXWYzW9wP7M4sFp+0iKjHuhC1 +gB6Qg0Mp0TVNUt0ZEelFLEJdA2lbbZ5yHhNXuhOxW/l3ASSe9tjTpy7yBSwBOpFG +l7QGISfJVEFfjyn7yWBYj5LDGnitlP4TtN8zyy6cJI0CggEAPRwY8ncqq7e8Thmq +TLkh1E3ZSJYIdQDSGwnhLx4MirpiwAZ5FtFgAugRueF9AxGY7wfEgxXIA3j0q2be +4nQg4qqEhNNv+LuGGN+xfsQz0gwRB+7XYXlW+gUnGKFTGtCz0+ZjSvv44FEn0R8V +Fk44qZ02YxpSLo7EG2KNt+h7lk9rl+D1JsKnpH/a3SYkeOrs50OzfMLr6urWGRlv +UQ9wzOcUlTAuM4uAc/k8FelfaTuuwHZv4qWrM9tcjMXbKS/8wCMcS9hiSBINDUIL +w7QegL5KetQCFveaTPmmqOWq+xiaSvgsF0qdnqBwZEh5ANZiZtMKmX0sbeT4Ie5A +OiunuwKCAQBlSlrvDqu9rwzCtdfZUwJtaftbGIGlkhdDYdPFXSIRQ7ZGBPlai/zr +y3dyNgrpLLb2T2ZlWC3pIGC2vVf/WlLMMVCSmgX2MsGBrOxNOBq57KRjlHhrUGRi +SAh7cqnuzeHw6+y3uZMhow0Semks4KB5ccLW+NBVvVS14vThdE0TZ7oVA74GCKM3 +Qv34S5kgPh7BRKoUZBUmHL0VbgfWMvUEU7eTh3cmPBteMh9RvbPnmz8iAkP/nDbc +roJ5UOITrL7QZUdG6XgMvik9DEH6P3Vnk8YLjwnfaw5wDm7wdBWtxqZxcru8nkeA +ZvaamPDoBtqauExW8xL4xaISlUv1BnrJAoIBAQCiEZk93GeRzYJFCO1YafsGYueX +Pffgd9wM2TpObgaEw8OIfEpGQKDiR35fb0uVzNyI5fVU5D5tP0b3LfvtQXV12ryQ +sVTA5YJcb8mRuUGy/AkjL54kNiZthUnlGHQjY3lqSyI1r5WxRIZBBRn5+g1eSZVq +CYCGjEryKm7vw8Qcvy1+H2crcZ0rRyLTcfFCr1ZXlyEZu48ScOtxcIDHc7j4J0LO +Peq2z0tbBojGkxFLX94J7zpRkWMPX9VHorEavDv7ZJwtgoXn3Lom0xHhO+JQaxY9 +FtJ79Ps9+SquXAnkhna4bbkrqrPM3+MAAV/S7bd1T1/8d4YiRQyaMHGS4Yr8 +-----END RSA PRIVATE KEY----- diff --git a/ssl/test/axTLS.key_512 b/ssl/test/axTLS.key_512 new file mode 100644 index 0000000000000000000000000000000000000000..7ae50f23bdc90e48f165aff330220508a99699f5 GIT binary patch literal 321 zcmV-H0lxk)f&o1O0RRF)0MR=zU#S5?J%(*^zCdnK!AXBtb)hXb<-t7_Lcx{!|rfVZ|0=xRXKgPd)!Gy#fOP009C)0Fimb?T$65*W6;Z_#YNk zQ@#a*O7BqLt*OZgemVyg$o&?(z~q?GMVVlAY-DAL#~wAJ%@hSVITaeX4+WM10RkZa z=2Ex*d>@xxG0k=x#?fIqh)t}0wDn9_HXM@#5)1QLVZv(dI{VJ z<#zME>JR1d(>*U^;{HF#AygqJ2JGkYa5*N@$(u= Tmj7@iAR3)zxTTMr$9H6O@syE# literal 0 HcmV?d00001 diff --git a/ssl/test/axTLS.key_512.pem b/ssl/test/axTLS.key_512.pem new file mode 100644 index 0000000000..1e2fb41f87 --- /dev/null +++ b/ssl/test/axTLS.key_512.pem @@ -0,0 +1,9 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIBPQIBAAJBANE7MF+pAUI9hm1yvkBuUcFJf1d1oS025cE9DyAa0SNt+nTSPiOw +cPygat7sQYiE/lQVa2HFFmK4k0HxTz3/Lr0CAwEAAQJBAJF5xO2ONajX3GK2+B8W +VVO+BYNK71DfranJCX46BxXI/Ra7wOSY0UWZYHVsZGWJxx41os0UBTg5FRq4DwWW +AQECIQDo69eo39iQqjwhpAQxatMh2CWYT7gokyu56V+5o2V3fQIhAOX2b+tQxDsB +w0J9UDN6CdwI5XbzveoP5fHTPS9j4rhBAiEA3c+y6Zx6dZHYf8TdRV5QwDtB2iGY +4/L7Qimvwm6Lc1UCIQDDXWrVsocTTjsReJ6zLOHFcjVnqklU2W7T1E8tvKE3QQIh +AMRpCFM7MrS2axuc8/HzGkqW/3AlIBqdZbilj5zHd2R0 +-----END RSA PRIVATE KEY----- diff --git a/ssl/test/axTLS.key_aes128.pem b/ssl/test/axTLS.key_aes128.pem new file mode 100644 index 0000000000..8961bd9a59 --- /dev/null +++ b/ssl/test/axTLS.key_aes128.pem @@ -0,0 +1,12 @@ +-----BEGIN RSA PRIVATE KEY----- +Proc-Type: 4,ENCRYPTED +DEK-Info: AES-128-CBC,B3A0D2BCEF4DE916D0BBA30A6885251B + +v8y74AGReaPLmDt6O8wir6hX1Ze8K4fVNkrLqfDMdW5E7jBXKO8riCMNmSjQ9fyh +eTicej93+8krcIvSXKW18TdO+EWezQevgnLrAZQWaNPH2j4B+K5gm701uiiKFKVa +1zngAOByePYlN6z4JLbiCyJRhxSo5zCaUYkKC2eGh8mlE64QmokPSCAj0wcCDzGh +hdhBg1vm0GmaQwIDVn+8zMfahscXVMtBmyQf5YP4PQW2nqOt7aZHjBNdg9qnBpGw +b6YuY7eZ4FgQvYcsNCi34NroJb9pkTrrF2F9Meb6+3So7jtMFG/YaJdCuXtf01g/ +Qm+XA5pJUtIUr/hLQjhkaOVUtXv/k0o/MR4k5CbAmboLt6YHf5V8+01vk0bvv5dI +70pVdXMmx26xDZOGmjYzd93PWc+75jak3GN2fbWryQs= +-----END RSA PRIVATE KEY----- diff --git a/ssl/test/axTLS.key_aes256.pem b/ssl/test/axTLS.key_aes256.pem new file mode 100644 index 0000000000..7671a302fb --- /dev/null +++ b/ssl/test/axTLS.key_aes256.pem @@ -0,0 +1,12 @@ +-----BEGIN RSA PRIVATE KEY----- +Proc-Type: 4,ENCRYPTED +DEK-Info: AES-256-CBC,F076229CDC2BCB3B8722E3865855B45C + +WFV9QWzr4tNmD+1OeQ7BceQg5LVQHp20Jo1Ax29lq8JTPzeObhtaU2MUHlcPKHUS +vK4FyQxJ25CyMubbnaZqCCz9pNbseFuJ1tob9UqRmXkZ8HV3snRjJRbcctD+V9x+ +Ymi1GreXoDQtMp0FtMiFjPvIYciBQnaRv2ChMAnGXNbZXCxWWA9E5S3a+yWzo+gd +wEcowL+SUac1PEDGHokhKn7nctvI9cC4hE6JmKM1sD68/U3rRPXMGqmC7umqyT5P +gjWBb1uu0iRjFC9eQUsaKPxey5Be710GFlyf/Ff/tep7RhkryIWEPvIzYCBf6rhk +3pysFgTjfiUuBYUNumjXr/q5hgdtb75788XUDxKwAoUx+m8gi0nJg35CN2nmQ054 +VJxcZlNv0wqnJ+GTTZeN6fiAhTpVtHsqHQomRSfaBiw= +-----END RSA PRIVATE KEY----- diff --git a/ssl/test/axTLS.noname.p12 b/ssl/test/axTLS.noname.p12 new file mode 100644 index 0000000000000000000000000000000000000000..9d27999fa053e524fa4ca893c2d13ce9ed49bb7c GIT binary patch literal 1483 zcmXqLVm;2p$ZXKW+RMhN)#lOmotKfFaX}Mn9ZM5y6;Qa$poyspA;q?!i76W>l+MJ+ z0HhKSGK>Z?Y+O(ico-QC_*gicZ@+tPGI5?Z6B7qRLlcv+>xsu7BXuG}7WFyS3yN1O zJiB%z_haDaFJk>AMt=^4KDj&FlSO0x2df3KgsbB{=vL6^R#b?e&OS-QcS zGCN$J5|-cmTV%e54S!)2?UI zWu*`8Kl-TagceQVV7aLOe%rD0rav=xK9;Py<7Mxpy7}0RueYwx?_+3MS>c%f$vi$Y z>qPY0e-jNE!}i!EIz_nZJDZx%Fa4AynB5}RZoGR%m9)iXor?9S-~7oa}kp z&%|qA>g?W->CVE3V>Q*gZY|2(~y2WNWEVzf?I z<(U-KKKn^n)b)LfN?Z=|E{NH6jr(|qli}4W=1uv^j~B=u=E~*SW5W}$okLAO`S{IP zm&N{b_Df#*e&uoyfd~wEuSU-w(_`~mv6zJ zXND(%Y3vJ98Uv=jrz}lO4}rpWf%qmHH!Q_*F){%q7Xk(6VkShcPs!1(#%Z>ogb37L z{j#quvpMaUTGqUyQ-7E)zkJ$hUr<88Ndd{X+aJDG=s(t#T=rr1MYoSPrQV;Yy}z+m zy?`~c?A~9^kPHi*)!q-?Fa37Dv_6naZgJ(Ox~e3WYP$wqCBy$MnR+L9v^ugY2xd#-gtrp&?V z%1b_dxY9+VRUwb~ASsUAx z{&$<{bAPTu(cML_!?$=aJkI&ra-Px8)p5DT#2>Fzt$sAlbPs*aYTIDLJE^z&&fe?l z^Sk%Vzox!;X90tFQ`-xh6V7XQZrpS%wK>%Iy6xiU|AVYWX5_w_yT7M+A7@N?Xa9pO zC+yntHF^4$pPv6HK!{B^ccmIv%Zd0HP5-EE{lWK-zxlMywZ@@flle{ob(fXKCWfJZ z_vby)@(Da^SW$QG_ddtyKiO82(qFgbfBiarGH zyBpJ1of*Za&nY)6zS(c*82^(q&7^aotL?qtXSb}Jpn6Gv1;=%GfA;Bu!uO$&LNQUoK`?>=Jpus$0zm-LJ1}3V0YW{7 zZF0UqZc)KWe^+&(EjH!BJr5un(Iaj8bkaT}uyFjKYToQYh=l%B6>DL|7Gk)QLGe#L z|1P}(0|5X50zm+gdBp9GHK^CzVz&4n7FAQe1%pcOP~WYo$q9Zs2NlTu7Q4XYn9)U< zV0CO{Wr@cgHKNTF1vohs8n_PymH`0*Apq#>*Qnpvkg7Z(qy#Z)(;?U;m`}JUlPkID zU%8`YcYOjO0Oj^?>rliy0mDLlP&0Z7+z91%^S$a1{HF-OsY=oO*SU z*nh;`MP5+AJ3-nZnB(&MLMgApZi{nO0wDmyU24^`hZ9aa5qO@nEaAm+HD{_xRM~FR t)K4wEp*KMSAppc_2va*Uw6<#-ob&PX8cLS`a3vrbon^SCkDSMMWONLcmL~uJ literal 0 HcmV?d00001 diff --git a/ssl/test/axTLS.unencrypted_pem.p8 b/ssl/test/axTLS.unencrypted_pem.p8 new file mode 100644 index 0000000000..e07375a848 --- /dev/null +++ b/ssl/test/axTLS.unencrypted_pem.p8 @@ -0,0 +1,10 @@ +-----BEGIN PRIVATE KEY----- +MIIBVwIBADANBgkqhkiG9w0BAQEFAASCAUEwggE9AgEAAkEA0TswX6kBQj2GbXK+ +QG5RwUl/V3WhLTblwT0PIBrRI236dNI+I7Bw/KBq3uxBiIT+VBVrYcUWYriTQfFP +Pf8uvQIDAQABAkEAkXnE7Y41qNfcYrb4HxZVU74Fg0rvUN+tqckJfjoHFcj9FrvA +5JjRRZlgdWxkZYnHHjWizRQFODkVGrgPBZYBAQIhAOjr16jf2JCqPCGkBDFq0yHY +JZhPuCiTK7npX7mjZXd9AiEA5fZv61DEOwHDQn1QM3oJ3AjldvO96g/l8dM9L2Pi +uEECIQDdz7LpnHp1kdh/xN1FXlDAO0HaIZjj8vtCKa/CbotzVQIhAMNdatWyhxNO +OxF4nrMs4cVyNWeqSVTZbtPUTy28oTdBAiEAxGkIUzsytLZrG5zz8fMaSpb/cCUg +Gp1luKWPnMd3ZHQ= +-----END PRIVATE KEY----- diff --git a/ssl/test/axTLS.withCA.p12 b/ssl/test/axTLS.withCA.p12 new file mode 100644 index 0000000000000000000000000000000000000000..ae029dee0fd45e90460d0eacd15f9be1882756ea GIT binary patch literal 2089 zcmZXUc{J3G8pmh(F~%Ok8&kYBg)D;*2FVg;ghXY@z7*Bimm!Rd?1M5&G+}5ak!8F_ zUL~QSNLh=qC5Eh7vS05x_ulR~_mAg%pY#1b=lSbaa*^%q)Nk&KD<${~X$Bs$!?=aX(DX0b)` z2=?1scbxjAy)u@r^s~g4M|A&HpVVc(WGVgvy{ikEfZFkPEVjjJr^EF8KrD`+uRA1g zxA*y2re}A&5n``vH!1gLMon>80@oAn!BCe`J5Om7!JOHvY0haYo0>t2ZHWFv)gCwC zcHV-}4cAM&Biz&hD-yA&@oQG74hLy%SFU#=+jVtu(uIS_TQ#f3c@C?6i}42hDFampl%liFBWzzf&J5c(=<%^P?;lZI3p1Tu!DplU zM4rNsQuFrc3#-z1@qd+dl9MV4j%g2~-kl!f*tk(>xkQmBR(tPOebymRY#7>NILs^G zFd-|{;yzg(q7!s)AB_98U&M**RwaoN8`WRQk2%$o_`8gBYUQ z>bS?Db1c-A-gmLeY}Ob?-;`}5!ofJtZS#IT860`^oOnbUrpyHd)iXTzc}Xntnd_EA zzU5U9JWN7Dz-4^pns>eM`I0*SCMnzRuH}%O#6|~pMIl&Wfp@gn^DiZ-!c)6CxQYd) zJzRNAA*1aW$MR0a5w!1vE6WIu=xKqx@7iUvpuMMs?kTPnQE%qQsw%behcY@}vw**a z`foo$)*9kjLz9hUoP?ua1DZUDNPw}ee-$X+4*&5eOHBzATjgjS_UgHl-aJqGr={t~ zYP=pu70=og;9j?fi#@8a{zI!-#dZ+&97Xd$&R6z4v+AAQY_#P33i_0F5*2yVfg%t) z)_nArmLs4ZQR5YVHQ7*}S#SyVn-<_%!7>aQ8Hs*0VQ%t)J|~ zYM9nX7;4R-{w|0$=MJHW5-(c4O~%Dbulq%Bh;Hx)GamO2{@G~$sth9yaULz2oIPXT z*t$vbEzQ*7lpg)IE#F_XlK&DPd@_c%yi{D8JaGDnF6iLnVfoM?n#C;?0V?%BXrd6H z`~U&Uvu^|Y1LEfU52$#-5DEeE1Vw=4|3AO()}EQTmcLW}55E8c1n=|Zf<}W~uH4Uo z9{nEovqoI>)r^n1_hv@)AJ%vEGgA*~_PT3j&lA-c@fq-U_6%f2mPey71uU%KCBI%+J9&Aro_ z4B*w4n26|vcZcX8WE&_U0XIty?`^rvdtAi@Fvsm3>>P4m&}3uLbn;s5sM`=7JqPui zS-mGzw#%6jhKm(xmU1~$5cQrmU6oQZ#>yC1FgAuU7n|qQG0mBRX7WF+kR-PoWkF*G zVix7BqulQN2=t*;OR02T=~bpiO{+|*TjoSY-+EVCvq$Ws9yukLrI|yP?b$NA9TaX( zmbgo4-r8v49N~hEIpNWB_$2(I=#r?vK^#tNN~s`2UnH##Vi#= z28)5ZrRXj+K7Q=MqC{}ba_eQ8>4@qxCdKNYjPd0UVU7lN5u5{4j0>Enr6=OGdfOFV z>N9e~d`$HD0NLT=7J8*SA!dGDkUWFi#F{?9Y8wC8TceHzQzwxlwzkp*b1v>aNi7NU zm2IUX6$AY*UB|5NmMy1GMaFk9OR z2C*z%H2Xs#Oysq(Q-;Fo{qQzK5D)pTIX)d&`0O7%Z@aDrz)WltjghNu3G$S60F?&5 zkQBF9=)*zbx2k7asM)2?BaI8GmP?=+iOW@e;q>b=$=Su$@b>}_0*>HTII*M%RV?c0 ze+vyis45PKsn({9F;DsLUM9rLJHdV3VQKW!DCF-WF;&UK;vgJI6{H4o0fm9Cfr3H4 z`k0G5y$e$Zjfb?Mzm60 zsjiZwDdM^^5@TPYX|cPNopg21y|;VL{o_5)InVQ)_pjdr!DvMgfrMb8PiU-q%HfnH zF@!Lp3>NA`!9x5^y90v3@}Cj93iD+9nZxp(!m{a{!^3zqnH?H3?JvYK&a%YB09 zJ2xN64qd9L{rE_p$ONMps@`pG@6EKNnLn~iR>6LRDy*IxtM>K<((D-bE7=NFnBwZm zVDTkVmMC}syBOh=Jkx0xrI)=3*Ky}{1WKVFJzh8-1K9d~&$_HC({W0Pt@N_i9?)3x-Cqr3T zePAM(ichfVdaPV7n;Cu0cwFN=i_M+Czg!NZ=B0Lz{jy3Y3K9F+L*^p zHpP`Lof=}%FOqs{X_La@CG5ckFU13_MfOQ*`js^lXj{zgSo8 zpvvyhZz0}5*o2+_@ZA>_+oOj88U4s=;$?^F*ci`49CnGbkk*(B?PcZZ=S>SPk@3ok zHW3DNLRD|`myKc0^uUeAjmqung+^{+3d{tGYU^W{TUf3p?UXw03Irn+{{v(hjFd#d zNc^Ua+dMQ{XehcPNg=u$tZMZsW9R|};@aWS!k*BfVEX;Lt; zHwbaQChOXxWnQcvd&tJ}o4rk5=geN#4DcKsZ(P$Uf9(}#!!S$J_s?VzH-9;@1v}xc zUqgD9c3ha#A1AHv?NVY#m96HANF?^*G&yWD{q2GmcMsfa{LNbS^SV5igD{Z&Dx$B& z?{%8u%3LI7ASp-pTao)4cVMLNg%y+2csd-s?%}d4`+cXH&-CM4bxkl%+;P(h+vu6r z{vMBIBfcqkqD@*{Zdrmeo#r1MQq`(-v;A?#&AeL7!TDihKUhUbdC^4Ug3s4ohYm*6 zy6b@c=5^0()bcf`szv4@9yKC zxN5m4Qj4KC&t`J`pr#;YGsh~~RY{EiFS$GKk*s2u`sy`QPFeMd5AuLp>V=#eYf|a! zMt>T)w&M~9LewX345k?d$7SS;>X02`zQ1_yaA;27pcoS{8KQa?2@dfFVp=DbyxP$Z zy@ShpXm-Z>TlR?dt0i{L`d<&*&dZT?TKZ%|ZsxQQxEgWP_tr8b4IRflERA)mm&3ZA zqw}F{Ls$bchIiGF()LDiRUGD;5|77bcQ;p!2twN}XQGY1@j!dS6xXL#YfY1tITuQ7 zT?4)x-`W{_OS-hKMK@rylf^LPET?D**hk-8FA{YOZQJ*C$2##>vAjy(joiHwm*>m* z^mewy#f3g$JhJN>vzJZ@4z@L3lCV1#cs^7{gOAia>glIaaGf-=M%rY981iUt!j5GNkddL?9_B$N^yh3D5?-046{KB7q=)0Yq)8 z7hnz?fJl%cghdN!;E|xL5P%|3Be^CIZ5L9{tv0y}@`==V{HJadhB5C~zBA{V$Bz~K E1>TCewg3PC literal 0 HcmV?d00001 diff --git a/ssl/test/axTLS.withoutCA.ya b/ssl/test/axTLS.withoutCA.ya new file mode 100644 index 0000000000000000000000000000000000000000..9e1bd632a2f3b9e584064412f92364fb120cfe70 GIT binary patch literal 1576 zcmY+@c|6k%90%~QKFm2}9Vo{<5szN4=XrXbKfbT;>-G75U*EspUmOLd0tN}-DA12E;k~pYG`<)} z5L8TojzB2T!R@#gM*-jbHG&mWz>Mwa8W;p@xAb2V5Kayz^7jQ%5DbTa2)PYU5o{IT zWr4v$Kq3X~iH*)GB%Pgim!ERFOj$QSunT!1Ud2@Hc2dQxKLZhqBuT-h6@^?~_f#Wp zE4O-^ajUJ*?=w(N|HP(t4J;~F1q;`TrIX^0z3*F{fUO1Vs_6P*?9Awvc^Hkn4R^WM zp+uZ$#+agM)Kc!^j8RsQ@~*O}sL+Je5OW8=^fsmT(z`xjcQ0!pJ7Wv~vL1fBW88MFENX! zTHA(;&e6FBA|lFJ(ACwsCVl@^etkfR$g=SW-psrMC3Qx7D z4Kwq7e5+Msl_z$8OglI0b8iN;)3H>l-;~^skn@H+*hTk^ltp>u)p}_?DKC0$e{$T# z+HmvFY<>|*smJi!{bAyYNuqgh4BfDLj_d*U%>Kznh z3Fc`d-z~zQ8w3%J1YYWpYfE$J(_-gqfIpkb7H z*>)q4gN~+pg)hns3(+}z7DwM_a&KYkXo)wgaMHU*C&kJzU+--$w@J0wkb#iniVmU4 zwmO-|k;Q92q;)ZaK|C5Z*m*CtEgr_3qQt_N?s!Hz`_dv0Eo-I3jy3BpU5IKd$HVz* zy>cHvhCR`e5ETz$2SC5Xe2ToAJCFbVZ2v4j!o+FeOI_%J+w0<8S%LQZb#EsJ9#rV3 z{SMJn<95baDG=`kk1Z<|U`bV$f@`a>s=exE@2q_AD$v0@V4WMZNR1fQ!DUOt=6kM9=rif^`B}X6mVi5d6V&+Vv|#? z&CPlw{&++2#%pXBWNi3bV_9sHY-hf_{5ZntvpI`7)JNWMh9F6opZ4cA*mwMS)z;IJ z6);Nt;<(FG(MIL?NVqKTX85=%20BhInebK;6nzqw2p>K&J&|YMMAGJANg?t z-_+K#6h_EHThXAd0!?cBb&Fex-)WdJ#S?&0RAGv0#J_}wLmBQ0mqKhOmUelk1UPleJ17 z9P1ShrXjWbLss2bRio{E0ciYV_Jkv<{%|fr<&0}vd2caL*l~4E{IV!K!SkYyD+4XR=#?O${%KQv z)@q9zR1WHXn`eA{`c&mH%rlnTbgR-h%0s2XN}YmL&0V3Nkd!~`3!L7-C;$Ke literal 0 HcmV?d00001 diff --git a/ssl/test/axTLS.x509_1024.cer b/ssl/test/axTLS.x509_1024.cer new file mode 100644 index 0000000000000000000000000000000000000000..fc92d056429c92b14fdc609505a5528a38ddd3da GIT binary patch literal 475 zcmXqLV!Uq9#OT1p$?)-T`++N8!VeqpvT6)$}FigkQ3)MFatt!Lqii2 zW1}c>USnfJ10!Q7*FeWm%s>QUDldwuhC&7cAaQ14PD3MeJp&*#G-#ZU>?%f92Ij_I z27|^t7JSY6*W$;@+`i|$?C)O$;UTG zreV3rM3+B8n;$-Z?C-Lx=WvPT3!e*Dd{h#*I85z1z_p#p(y(l}<|sS2Nm9q#MI#?}#GK1|G;Nj9n?r9a zx*tqPn=Ep8#%g2J%eAqATyu5`M7USYn40q6C$>rQ=PUlWS*MNEQ%>babX_=L_GM?X j$6)$}FigkQ3)MFatt!Lqii2 zW1}c>USnfJ10!Q7*FeWm%s>QUDldwuhC&7cAaQ14PD3MeJp&*#1iDZO*;$ON49rc8 z{0u;GE~X|%MutNR_TT<>zJSeT^Za|gwm0>UnA?6&&rWT6+_6ixVL4aXImM&>R`J}R!t z+jA&U_kPRFCBl9a^}ihQSF@EY+r99L$0v8O9WpZ)@!zhFOWnlzWtp*8&m^W2_0?9l zw)n8tFa2|oB|f!S?S*U#tJV9Eu!NU)c8mVMWhyc4la_L1xyOI0f}@sf*H3S3R=#}F zSLVfo6y=MD+>iH`Cet R9GogVhX2<0z0YoW4gkCo^O*nu literal 0 HcmV?d00001 diff --git a/ssl/test/axTLS.x509_2048.pem b/ssl/test/axTLS.x509_2048.pem new file mode 100644 index 0000000000..1ed0141afb --- /dev/null +++ b/ssl/test/axTLS.x509_2048.pem @@ -0,0 +1,15 @@ +-----BEGIN CERTIFICATE----- +MIICWzCCAcQCCQDxw4fA1PRXxDANBgkqhkiG9w0BAQQFADA0MTIwMAYDVQQKEylh +eFRMUyBQcm9qZWN0IERvZGd5IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0wNjA2 +MDcxMTQ0MzJaFw0zMzEwMjMxMTQ0MzJaMCwxFjAUBgNVBAoTDWF4VExTIFByb2pl +Y3QxEjAQBgNVBAMTCTEyNy4wLjAuMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC +AQoCggEBAMKgv9v6z3AGRLOf3o092S/ENz33Z2tlguOIuh2Apwp2ziHFvul7m9iF +xsEcEARcvpkRPVo6ifJLjhJErenvvMAIS3WoO1lyenMaGoNddLeRRB0snRn7xRcl +DYzCYS3fhJmkE06RL/TCTyY9GXa7odRI8kcWuByZog/be15lsgn0pjNKjJICdCer +Otq0TAV/pfzRBF9lcyboHWQFOu9UVmDp3LsV/9o1GJbyKiNZd0j/GnDFOQbXy7GD +I9PJTRzo4GQj0cJHY7JelORKiIsymcoMNRTboFRAx5y9jAGF8Ks196Rq/+9gYsvi +eE0h+pbdLLbM0uZvAYqzIGK9hRR7Ja0CAwEAATANBgkqhkiG9w0BAQQFAAOBgQA8 +L1Zz9K6M/PQCYWrfnTjbPKY2rTB1OvSV0Uwy5KKPQRS1+oK9dx4K0miX+1ZvI1bo +f7/1aFXOsW3dpTwYUSjJvTMjSwNUPKiB/q/xwA1mzsbIZsbnhIITU95mOJ3xFhgc +YFdJ4saL7pppTzfOxZ+h9jWbDwgJJAwx/q+O72uE5w== +-----END CERTIFICATE----- diff --git a/ssl/test/axTLS.x509_4096.cer b/ssl/test/axTLS.x509_4096.cer new file mode 100644 index 0000000000000000000000000000000000000000..40bbe94fdd8d5fc57dd7463e4e9530b9d661e7c6 GIT binary patch literal 863 zcmXqLVvaUwVmiXa$?)-T`++N8!jBs8vT6)$}FigkQ3)MFatt!Lqii2 zW1}c>USnfJ10!Q7*FeWm%s>QUDldwuhC&7cAaQ14PD3MeJp&*#1iDZO*;$ON49rbT z{0u;GE~X|XMutD?TV}>;ow{Ja^XqY}Kx&Zef|Au{+XOz`xm&ZC_3Bzx*40-wFfQg@ zm%j3gNv(kccj0BVI|(i7yZNjX1&Wq@zCAtZ{?bm~_lpMDeGtww(0oyI-?vNu6 z^TXM09Ex^dDZ;tar^LMBOeK%H7W;SJ#A{)zrj;HmnoStPqxZLgEm3zNIDcdNGvx){gK$*>jXI`gWlo-;Cf zm$Cl}S9azz?Puni3$k++BCg c{uLH|{+cssT4etA3m$>ump}GawD^_-0G~{BVE_OC literal 0 HcmV?d00001 diff --git a/ssl/test/axTLS.x509_4096.pem b/ssl/test/axTLS.x509_4096.pem new file mode 100644 index 0000000000..b7aed1caba --- /dev/null +++ b/ssl/test/axTLS.x509_4096.pem @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDWzCCAsQCCQDxw4fA1PRXxTANBgkqhkiG9w0BAQQFADA0MTIwMAYDVQQKEylh +eFRMUyBQcm9qZWN0IERvZGd5IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0wNjA2 +MDcxMTQ0MzJaFw0zMzEwMjMxMTQ0MzJaMCwxFjAUBgNVBAoTDWF4VExTIFByb2pl +Y3QxEjAQBgNVBAMTCTEyNy4wLjAuMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC +AgoCggIBAPwntJldKsrQMAz6410QZVIdoHSrNrYQ8NzdfKMF1a0lBavUsAGjDa5n +qfQ0fTBAC3HTJtxghCe7DjohEHKk89uXYt+liQ3vo6Nc+Zw9l2bDyLKffpOdVc/l +tweL7FyQIM1fl2W5r/S9OffFRMJKXiN1HPXrfGYRrwz6B2cgUBtSgI+odwCmdfjb +Ya4Wo8Za53UGeQ7v0eQ0lEDgXAhx3c2YIoXXxfe2J/5KdZnpXtRJWTJaoAbaQ4tU +xECfVwbYwltHqRQJuUx0N4DMeQwnKgf3DWHWVqqWdALsAE5utfuOpuHxSoN2AGDz +ov++GihbiEAcP5XPFv/0ldcfEi/4X9lyHb0mvUIa6DTdHd17thFEM12caD0TCszq +in8JWVu6M0+oRQcDzIfMn4aD7oKtk76gY5HtbN4Jr8E4BHH/oGPe6l4mQl+W4f3o +Zp2e7yG5WBVA9sjJbCmlxiWMHod1iiZUJ4e9cEFINjMWuooPIo6xKMzZcGHzwkBa +zS6kHyTsHcfdHcu4aVMlJ9cKN/aesJgup/XseM3imzuJ3UqfvwCfneUKfM6DM8J3 +mFfSwUBvK8uLsMw5Elim/1oIbBG0PTt7BiLiNd0pU/weuL92y2+QB2oCPM0t5D7L +IYyoZHHNlvTCkQVNsCHgrDUtOdpGlKt6zzEgUTqwC5i5N3p/w6uPAgMBAAEwDQYJ +KoZIhvcNAQEEBQADgYEAcrCtPXmZyPX01uNMh2X1VkgmUn/zLemierou7WD/h7xL +dOl4eeKjFBqIiC19382m1DK4h1F8MceqaMgTueCJpLM7A2cwN3ta8/pGP2yEVhdp +h10PkdRPF/AU8JmxnFaADsc6+6xWbbrdNv5xcvP1bJKWWW+30EhRF9PxjXiETXc= +-----END CERTIFICATE----- diff --git a/ssl/test/axTLS.x509_512.cer b/ssl/test/axTLS.x509_512.cer new file mode 100644 index 0000000000000000000000000000000000000000..48c6e13aa0af5678668c7d4a3245a3304030f01e GIT binary patch literal 406 zcmXqLVw_~q_=ky;;p5@<16RI;A2Q%&R#QM#fOCfsUb=fe6G@UKCReg$x8h;>^OFhDPRk20&Zk9;ChBUA P9b0QY{GW6AgzOst>~fQg literal 0 HcmV?d00001 diff --git a/ssl/test/axTLS.x509_512.pem b/ssl/test/axTLS.x509_512.pem new file mode 100644 index 0000000000..8191e489f3 --- /dev/null +++ b/ssl/test/axTLS.x509_512.pem @@ -0,0 +1,11 @@ +-----BEGIN CERTIFICATE----- +MIIBkjCB/AIJAPHDh8DU9FfCMA0GCSqGSIb3DQEBBQUAMDQxMjAwBgNVBAoTKWF4 +VExTIFByb2plY3QgRG9kZ3kgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTA2MDYw +NzExNDQzMloXDTMzMTAyMzExNDQzMlowLDEWMBQGA1UEChMNYXhUTFMgUHJvamVj +dDESMBAGA1UEAxMJMTI3LjAuMC4xMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANE7 +MF+pAUI9hm1yvkBuUcFJf1d1oS025cE9DyAa0SNt+nTSPiOwcPygat7sQYiE/lQV +a2HFFmK4k0HxTz3/Lr0CAwEAATANBgkqhkiG9w0BAQUFAAOBgQAKRT6LwFr1xedJ +b4qrvjB+EwV/0p4TNNXUS9S30rMSFvRar7VxvLP1lpYj9PR1JGSZMG/B6hR4yumF +Rjwel9FPgNcWCW4DXAWqz3UQF7oZtJL6K+XJpQ0gwC+Nxc+RRGNLMlK7dLiqFh/V +qZLej5Xy93M0JyZBiLV88P+c08gd7A== +-----END CERTIFICATE----- diff --git a/ssl/test/axTLS.x509_aes128.pem b/ssl/test/axTLS.x509_aes128.pem new file mode 100644 index 0000000000..9a75fe960e --- /dev/null +++ b/ssl/test/axTLS.x509_aes128.pem @@ -0,0 +1,11 @@ +-----BEGIN CERTIFICATE----- +MIIBkjCB/AIJAPHDh8DU9FfHMA0GCSqGSIb3DQEBBQUAMDQxMjAwBgNVBAoTKWF4 +VExTIFByb2plY3QgRG9kZ3kgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTA2MDYw +NzExNDQzMloXDTMzMTAyMzExNDQzMlowLDEWMBQGA1UEChMNYXhUTFMgUHJvamVj +dDESMBAGA1UEAxMJMTI3LjAuMC4xMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMDo +g6K2iXFftW+Qk+rrzkMGWrtfY6YSxPstPRrI7akluUEoyWGITXbK6L3QfERrf2eu +CnWyciQiHVRoHC0EgZUCAwEAATANBgkqhkiG9w0BAQUFAAOBgQBT6YhR8x/bBteK +lr8E0l4mATOnYlsmge+z/SFYs4bDBofqlwQCVJXNSBA4ZsEjgP9qIWTu/85QrVGq +LrkewSM6Oeh95LGnE+uhJVtIX++O+Hsex3H1UL067dCG99XmDhqbEU9AI6YSZu2p +cjoSowFELtOoG667+id9QObfV3EQoQ== +-----END CERTIFICATE----- diff --git a/ssl/test/axTLS.x509_aes256.pem b/ssl/test/axTLS.x509_aes256.pem new file mode 100644 index 0000000000..4f3074e011 --- /dev/null +++ b/ssl/test/axTLS.x509_aes256.pem @@ -0,0 +1,11 @@ +-----BEGIN CERTIFICATE----- +MIIBkjCB/AIJAPHDh8DU9FfIMA0GCSqGSIb3DQEBBQUAMDQxMjAwBgNVBAoTKWF4 +VExTIFByb2plY3QgRG9kZ3kgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTA2MDYw +NzExNDQzMloXDTMzMTAyMzExNDQzMlowLDEWMBQGA1UEChMNYXhUTFMgUHJvamVj +dDESMBAGA1UEAxMJMTI3LjAuMC4xMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANAW +9PdXa5u4gWi5VB5p/eQmOtteRq9/54JkiEs8cVNrTQgZsjjU1LGedE3JwBqZ1EIW +HGPjcGg5dVxFjkn7RekCAwEAATANBgkqhkiG9w0BAQUFAAOBgQBmJMt0Crdd/BPn +EdmzsVXou0zTizTC8wyUPMVpg/KzzP7fhZux/ZIrH9/RVcJd9y+B2/mXc3C+K99+ +TXQoYKsLGArfDPzmpy1wPrdEcB1A9gkWDl1Uq6xRyvrVm3gX8NTITRuGKL9njgWx +2SrApIBtOOUOinYtfH3745cVVl5HOA== +-----END CERTIFICATE----- diff --git a/ssl/test/axTLS.x509_bad_after.pem b/ssl/test/axTLS.x509_bad_after.pem new file mode 100644 index 0000000000..79eb9ccd68 --- /dev/null +++ b/ssl/test/axTLS.x509_bad_after.pem @@ -0,0 +1,11 @@ +-----BEGIN CERTIFICATE----- +MIIBkjCB/AIJAPHDh8DU9FfKMA0GCSqGSIb3DQEBBQUAMDQxMjAwBgNVBAoTKWF4 +VExTIFByb2plY3QgRG9kZ3kgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTA2MDYw +NzExNDQzMloXDTA1MDYwNzExNDQzMlowLDEWMBQGA1UEChMNYXhUTFMgUHJvamVj +dDESMBAGA1UEAxMJMTI3LjAuMC4xMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANE7 +MF+pAUI9hm1yvkBuUcFJf1d1oS025cE9DyAa0SNt+nTSPiOwcPygat7sQYiE/lQV +a2HFFmK4k0HxTz3/Lr0CAwEAATANBgkqhkiG9w0BAQUFAAOBgQCmPSs9EceViMZD +ZTXDZpQWJFcXaeInrXWgYWyVgnHBY/eSuqNCxkV/ehv/Wc5pWBGnrX+4cSvQ+TpQ +FdZegeOjvgipjtJb/0TJCcvgcdHTntEM0h7VXjfbsJXAHwJPFzWIKxV4jeFXnaaw +W+YHrj9GQ8PnFmapPuh4h/y6LyHAcg== +-----END CERTIFICATE----- diff --git a/ssl/test/axTLS.x509_bad_before.pem b/ssl/test/axTLS.x509_bad_before.pem new file mode 100644 index 0000000000..fe72b541b2 --- /dev/null +++ b/ssl/test/axTLS.x509_bad_before.pem @@ -0,0 +1,11 @@ +-----BEGIN CERTIFICATE----- +MIIBkjCB/AIJAPHDh8DU9FfJMA0GCSqGSIb3DQEBBQUAMDQxMjAwBgNVBAoTKWF4 +VExTIFByb2plY3QgRG9kZ3kgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTI0MTIz +MTE0MDAwMFoXDTI1MTIzMTE0MDAwMFowLDEWMBQGA1UEChMNYXhUTFMgUHJvamVj +dDESMBAGA1UEAxMJMTI3LjAuMC4xMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANE7 +MF+pAUI9hm1yvkBuUcFJf1d1oS025cE9DyAa0SNt+nTSPiOwcPygat7sQYiE/lQV +a2HFFmK4k0HxTz3/Lr0CAwEAATANBgkqhkiG9w0BAQUFAAOBgQApbldYefE8A0ez +SYvAuCtYxx/2KHwBRD/cR0q7widl9WGjVC/dsnbFo109vHEr3FP1HVYSI0aweiaK +XZmpUyJ9DprbbWQqaLuDnqIH8X7kfiMuO7/LGQc812iDJI2Akxp9cIlPBFBD8GVx ++0EphzSodDDlLD8bPqLaWTE+8Ydtjw== +-----END CERTIFICATE----- diff --git a/ssl/test/axTLS.x509_device.cer b/ssl/test/axTLS.x509_device.cer new file mode 100644 index 0000000000000000000000000000000000000000..c966743c9ca724ecb81928d0f6ad7e62b29eab92 GIT binary patch literal 401 zcmXqLV(c|&Vl-#sWcYZv{lJwk;l~Vk**LY@JlekVGBUEVG8pI>iW!KoF^95n3G*ga zg!lw21Qg|Gr6!jc3KRT4UNq841mzkKu(<3zzhh@4Gm39jE$nid5w(?4UCMT zTmx-GO#^j^X$mN&DY>WhSR8IHwksWTs^%CzhldG|oqM3?nN8b7L=qL1QOVVA zB|csu?fqp62d3^8%Qa9mSYy#4{w;o%qQvxI>(vh>*4W)IqNC%Ho9fI z%iCXCtE2tbBwl5l92p#KgRSnTe5!iBZLXmyJ`a&7xk*W}qnv{YLwX`%aH?TA`G&V6Xh!W>D1apmyO)Y`kfpAje zeB^LpWMyD(>}4=$>||7N?y$<5%!OzF zERzTg``9Ao-X*XBQfdA{s)V1MQHyO zWy#)aHLqswC)*oOrXGIdcj#m4Y98-5?oH8;9tM=&_?EauBId2}0<I-~KIoDw&uW z85kEk890CgUzU$Wj73Dm@KODoQ$kaJe=JbA?W-YN=#+TOfFBt2vcfDJ25gLs|CtzB z4fsF;{6G#13o!QCki7_udS;;C=E@5EntVbwMZq<0PCjey;-LEFE80^xr_VBLt0)o^ z{eRuHSc9>xWA4OP_pWJj^Vlt(S>nKR=8eFEls^UAc3BFke~M!W*vfs)>;B68FPk|v z8vb08JMyN$t<~qA>juWD7Hh=jyLr9SJ-zpI>PD-l%e+~<`HcU|RG(;Raeo+<;^qYa DuXy4z literal 0 HcmV?d00001 diff --git a/ssl/test/equifax.x509_ca b/ssl/test/equifax.x509_ca new file mode 100644 index 0000000000000000000000000000000000000000..79b0a3f98764a07fdf6cae1a80eebf704d1f8796 GIT binary patch literal 646 zcmXqLVrnvIVtl=TnTe5!iIK&CmyJ`a&7A-4f18*?ZNn=n&ou%V2B z6o|tmEbLlXnwgeZp%9#!Tw0W>;F*`KXQ*bN0+MAGmPM0Ibt)~+%u6jUR&aLIH8hYD z=e4vnFf%eVFfjmvC~;mR10*hOENz^R>^DYM2Ij_I27|^_GV!Yaq78vdHv|ahSG);D}~qW z>v(UKw>nj0}v6(+pA!1lc$f+B_KBemDWcpM{x;f!%-~7^bqq zjEw(TSPhtglz}`*K$%6tK&(N;tHLNq@OGq_S={}DB4!R*?lnFO4P-$I_*lePuuG#x zF*DHrrO_*9GYdX@8Rm2L=SrUgyt6)^NzHtwT6QLK`?Zk6vS(+mk-WR5_38uLKS>J9 zTf8GuKR)_7Rnh+ImAVKy_x2FGh=p6X{?K|~_ ca_cert.conf << EOF +[ req ] +distinguished_name = req_distinguished_name +prompt = no + +[ req_distinguished_name ] + O = $PROJECT_NAME Dodgy Certificate Authority +EOF + +cat > certs.conf << EOF +[ req ] +distinguished_name = req_distinguished_name +prompt = no + +[ req_distinguished_name ] + O = $PROJECT_NAME + CN = 127.0.0.1 +EOF + +cat > device_cert.conf << EOF +[ req ] +distinguished_name = req_distinguished_name +prompt = no + +[ req_distinguished_name ] + O = $PROJECT_NAME Device Certificate +EOF + +# private key generation +openssl genrsa -out axTLS.ca_key.pem 1024 +openssl genrsa -out axTLS.key_512.pem 512 +openssl genrsa -out axTLS.key_1024.pem 1024 +openssl genrsa -out axTLS.key_2048.pem 2048 +openssl genrsa -out axTLS.key_4096.pem 4096 +openssl genrsa -out axTLS.device_key.pem 1024 +openssl genrsa -aes128 -passout pass:abcd -out axTLS.key_aes128.pem 512 +openssl genrsa -aes256 -passout pass:abcd -out axTLS.key_aes256.pem 512 + +# convert private keys into DER format +openssl rsa -in axTLS.key_512.pem -out axTLS.key_512 -outform DER +openssl rsa -in axTLS.key_1024.pem -out axTLS.key_1024 -outform DER +openssl rsa -in axTLS.key_2048.pem -out axTLS.key_2048 -outform DER +openssl rsa -in axTLS.key_4096.pem -out axTLS.key_4096 -outform DER +openssl rsa -in axTLS.device_key.pem -out axTLS.device_key -outform DER + +# cert requests +openssl req -out axTLS.ca_x509.req -key axTLS.ca_key.pem -new \ + -config ./ca_cert.conf +openssl req -out axTLS.x509_512.req -key axTLS.key_512.pem -new \ + -config ./certs.conf +openssl req -out axTLS.x509_1024.req -key axTLS.key_1024.pem -new \ + -config ./certs.conf +openssl req -out axTLS.x509_2048.req -key axTLS.key_2048.pem -new \ + -config ./certs.conf +openssl req -out axTLS.x509_4096.req -key axTLS.key_4096.pem -new \ + -config ./certs.conf +openssl req -out axTLS.x509_device.req -key axTLS.device_key.pem -new \ + -config ./device_cert.conf +openssl req -out axTLS.x509_aes128.req -key axTLS.key_aes128.pem \ + -new -config ./certs.conf -passin pass:abcd +openssl req -out axTLS.x509_aes256.req -key axTLS.key_aes256.pem \ + -new -config ./certs.conf -passin pass:abcd + +# generate the actual certs. +openssl x509 -req -in axTLS.ca_x509.req -out axTLS.ca_x509.pem \ + -sha1 -days 10000 -signkey axTLS.ca_key.pem +openssl x509 -req -in axTLS.x509_512.req -out axTLS.x509_512.pem \ + -sha1 -CAcreateserial -days 10000 \ + -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem +openssl x509 -req -in axTLS.x509_1024.req -out axTLS.x509_1024.pem \ + -sha1 -CAcreateserial -days 10000 \ + -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem +openssl x509 -req -in axTLS.x509_2048.req -out axTLS.x509_2048.pem \ + -md5 -CAcreateserial -days 10000 \ + -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem +openssl x509 -req -in axTLS.x509_4096.req -out axTLS.x509_4096.pem \ + -md5 -CAcreateserial -days 10000 \ + -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem +openssl x509 -req -in axTLS.x509_device.req -out axTLS.x509_device.pem \ + -sha1 -CAcreateserial -days 10000 \ + -CA axTLS.x509_512.pem -CAkey axTLS.key_512.pem +openssl x509 -req -in axTLS.x509_aes128.req \ + -out axTLS.x509_aes128.pem \ + -sha1 -CAcreateserial -days 10000 \ + -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem +openssl x509 -req -in axTLS.x509_aes256.req \ + -out axTLS.x509_aes256.pem \ + -sha1 -CAcreateserial -days 10000 \ + -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem + +# note: must be root to do this +DATE_NOW=`date` +if date -s "Jan 1 2025"; then +openssl x509 -req -in axTLS.x509_512.req -out axTLS.x509_bad_before.pem \ + -sha1 -CAcreateserial -days 365 \ + -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem +date -s "$DATE_NOW" +touch axTLS.x509_bad_before.pem +fi +openssl x509 -req -in axTLS.x509_512.req -out axTLS.x509_bad_after.pem \ + -sha1 -CAcreateserial -days -365 \ + -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem + +# some cleanup +rm axTLS*.req +rm axTLS.srl +rm *.conf + +# need this for the client tests +openssl x509 -in axTLS.ca_x509.pem -outform DER -out axTLS.ca_x509.cer +openssl x509 -in axTLS.x509_512.pem -outform DER -out axTLS.x509_512.cer +openssl x509 -in axTLS.x509_1024.pem -outform DER -out axTLS.x509_1024.cer +openssl x509 -in axTLS.x509_2048.pem -outform DER -out axTLS.x509_2048.cer +openssl x509 -in axTLS.x509_4096.pem -outform DER -out axTLS.x509_4096.cer +openssl x509 -in axTLS.x509_device.pem -outform DER -out axTLS.x509_device.cer + +# generate pkcs8 files (use RC4-128 for encryption) +openssl pkcs8 -in axTLS.key_512.pem -passout pass:abcd -topk8 -v1 PBE-SHA1-RC4-128 -out axTLS.encrypted_pem.p8 +openssl pkcs8 -in axTLS.key_512.pem -passout pass:abcd -topk8 -outform DER -v1 PBE-SHA1-RC4-128 -out axTLS.encrypted.p8 +openssl pkcs8 -in axTLS.key_512.pem -nocrypt -topk8 -out axTLS.unencrypted_pem.p8 +openssl pkcs8 -in axTLS.key_512.pem -nocrypt -topk8 -outform DER -out axTLS.unencrypted.p8 + +# generate pkcs12 files (use RC4-128 for encryption) +openssl pkcs12 -export -in axTLS.x509_1024.pem -inkey axTLS.key_1024.pem -certfile axTLS.ca_x509.pem -keypbe PBE-SHA1-RC4-128 -certpbe PBE-SHA1-RC4-128 -name "p12_with_CA" -out axTLS.withCA.p12 -password pass:abcd +openssl pkcs12 -export -in axTLS.x509_1024.pem -inkey axTLS.key_1024.pem -keypbe PBE-SHA1-RC4-128 -certpbe PBE-SHA1-RC4-128 -name "p12_without_CA" -out axTLS.withoutCA.p12 -password pass:abcd +openssl pkcs12 -export -in axTLS.x509_1024.pem -inkey axTLS.key_1024.pem -keypbe PBE-SHA1-RC4-128 -certpbe PBE-SHA1-RC4-128 -out axTLS.noname.p12 -password pass:abcd + +# PEM certificate chain +cat axTLS.ca_x509.pem >> axTLS.x509_device.pem + +# set default key/cert for use in the server +xxd -i axTLS.x509_512.cer | sed -e \ + "s/axTLS_x509_512_cer/default_certificate/" > ../../ssl/cert.h +xxd -i axTLS.key_512 | sed -e \ + "s/axTLS_key_512/default_private_key/" > ../../ssl/private_key.h diff --git a/ssl/test/microsoft.x509_ca b/ssl/test/microsoft.x509_ca new file mode 100644 index 0000000000000000000000000000000000000000..b90803452b6cd92749d3e34c60420fd20e5b1c4f GIT binary patch literal 1046 zcmXqLVi7WEV*0g!nTe5!iJ##hL${4hhu}rKZ^>`&I~ee?acZ@Bw0-AgWMpAwFeot8 zHqc~a4rSpMR&vfSs4U7%&nQvQNY+#^w6ru=@Xbsv$}i4OD^YOHFDlS8lrxZlC>BMP z$uCMQ$;{6)R5XwW$ukQ}AmoGc^Gg&QOG`5Hi!w_p4dldmEzJ!K4Gj#;4S*m@oY%;} z(8$;j${hd~H8Cn72MZ%B19KB2KZ8LNBNtN>BO}8~ro9IXo>_nLlh&9&y&}%w)uNTX zs_{SmP4!v4{omY03U)Pti)JtCPcX{9=#*0VZcW+AkXxT#&uNqCpWl+U`Dk`klJYfK zn|u6>lU__avR^lC)~pP*nHQ{d_Va9wP&?@MoXgH)n$AiM%N1`to1GrF@b8|L6PmcD zsb*n!o!TfGUH;@z+EkjRPZ-kzwi!?gPD_ zr%RZ=-NC4Gqg?QFOoGw;dEBS%SSNP$pR{_W_~}FVWSy-G+)pIE|8xC}wRO}=vyjYx zD!KM2&#bz~T65R1*LJ=@LDuenLjDq&2mV}eek>TJ;QuPAdi^TN6WZpgy8BWW3U#US zColdUBJ)%6pZD?vZDNP*#d?OS@s7n znRPvI6k1`LC7pHK^x+j5mM1G*Sx!V5Tjcr5@Fs2NTGVs-YKXntS((sf1-FH)+9#LJ IUw&x;05YnPSO5S3 literal 0 HcmV?d00001 diff --git a/ssl/test/microsoft.x509_ca.pem b/ssl/test/microsoft.x509_ca.pem new file mode 100644 index 0000000000..478e60b070 --- /dev/null +++ b/ssl/test/microsoft.x509_ca.pem @@ -0,0 +1,24 @@ +-----BEGIN CERTIFICATE----- +MIIEEjCCAvqgAwIBAgIPAMEAizw8iBHRPvZj7N9AMA0GCSqGSIb3DQEBBAUAMHAx +KzApBgNVBAsTIkNvcHlyaWdodCAoYykgMTk5NyBNaWNyb3NvZnQgQ29ycC4xHjAc +BgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEhMB8GA1UEAxMYTWljcm9zb2Z0 +IFJvb3QgQXV0aG9yaXR5MB4XDTk3MDExMDA3MDAwMFoXDTIwMTIzMTA3MDAwMFow +cDErMCkGA1UECxMiQ29weXJpZ2h0IChjKSAxOTk3IE1pY3Jvc29mdCBDb3JwLjEe +MBwGA1UECxMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSEwHwYDVQQDExhNaWNyb3Nv +ZnQgUm9vdCBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB +AQCpAr3BcOY78k4bKJ+XeF4w6qKpjSVf+P6VTKO3/p2iID58UaKboo9gMmvRQmR5 +7qx2yVTa8uuchhyPn4Rms8VremIj1h083g8BkuiWxL8tZpqaaCaZ0Dosvwy1WCbB +RucKPjiWLKkoOajsSYNC44QPu5psVWGsgnyhYC13TOmZtGQ7mlAcMQgkFJ+p55Er +GOY9mGMUYFgFZZ8dN1KH96fvlALGG9O/VUWziYC/OuxUlE6u/ad6bXROrxjMlgko +IQBXkGBpN7tLEgc8Vv9b+6RmCgim0oFWV++2O14WgXcE2va+roCV/rDNf9anGnJc +PMq88AijIjCzBoXJsyB3E4XfAgMBAAGjgagwgaUwgaIGA1UdAQSBmjCBl4AQW9Bw +72lyniNRfhSyTY7/y6FyMHAxKzApBgNVBAsTIkNvcHlyaWdodCAoYykgMTk5NyBN +aWNyb3NvZnQgQ29ycC4xHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEh +MB8GA1UEAxMYTWljcm9zb2Z0IFJvb3QgQXV0aG9yaXR5gg8AwQCLPDyIEdE+9mPs +30AwDQYJKoZIhvcNAQEEBQADggEBAJXoC8CN85cYNe24ASTYdxHzXGAyn54Lyz4F +kYiPyTrmIfLwV5MstaBHyGLv/NfMOztaqTZUaf4kbT/JzKreBXzdMY09nxBwarv+ +Ek8YacD80EPjEVogT+pie6+qGcgrNyUtvmWhEoolD2Oj91Qc+SHJ1hXzUqxuQzIH +/YIX+OVnbA1R9r3xUse958Qw/CAxCYgdlSkaTdUdAqXxgOADtFv0sd3IV+5lScdS +VLa0AygS/5DW8AiPfriXxas3LOR65Kh343agANBqP8HSNorgQRKoNWobats14dQc +BOSoRQTIWjM4bk0cDWK3CqKM09VUP0bNHFWmcNsSOoeTdZ+n0qA= +-----END CERTIFICATE----- diff --git a/ssl/test/perf_bigint.c b/ssl/test/perf_bigint.c new file mode 100644 index 0000000000..116a1ba013 --- /dev/null +++ b/ssl/test/perf_bigint.c @@ -0,0 +1,218 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file perf_bigint.c + * + * Some performance testing of bigint. + */ + +#include +#include +#include +#include "ssl.h" + +/************************************************************************** + * BIGINT tests + * + **************************************************************************/ + +int main(int argc, char *argv[]) +{ +#ifdef CONFIG_SSL_CERT_VERIFICATION + RSA_CTX *rsa_ctx; + BI_CTX *ctx; + bigint *bi_data, *bi_res; + int diff, res = 1; + struct timeval tv_old, tv_new; + const char *plaintext; + uint8_t compare[MAX_KEY_BYTE_SIZE]; + int i, max_biggie = 10; /* really crank performance */ + int len; + uint8_t *buf; + + /** + * 512 bit key + */ + plaintext = /* 64 byte number */ + "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^"; + + len = get_file("ssl/test/axTLS.key_512", &buf); + asn1_get_private_key(buf, len, &rsa_ctx); + ctx = rsa_ctx->bi_ctx; + bi_data = bi_import(ctx, (uint8_t *)plaintext, strlen(plaintext)); + bi_res = RSA_public(rsa_ctx, bi_data); + bi_data = bi_res; /* reuse again */ + + gettimeofday(&tv_old, NULL); + for (i = 0; i < max_biggie; i++) + { + bi_res = RSA_private(rsa_ctx, bi_copy(bi_data)); + if (i < max_biggie-1) + { + bi_free(ctx, bi_res); + } + } + + gettimeofday(&tv_new, NULL); + bi_free(ctx, bi_data); + + diff = (tv_new.tv_sec-tv_old.tv_sec)*1000 + + (tv_new.tv_usec-tv_old.tv_usec)/1000; + printf("512 bit decrypt time: %dms\n", diff/max_biggie); + TTY_FLUSH(); + bi_export(ctx, bi_res, compare, 64); + RSA_free(rsa_ctx); + free(buf); + if (memcmp(plaintext, compare, 64) != 0) + goto end; + + /** + * 1024 bit key + */ + plaintext = /* 128 byte number */ + "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^" + "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^"; + + len = get_file("ssl/test/axTLS.key_1024", &buf); + asn1_get_private_key(buf, len, &rsa_ctx); + ctx = rsa_ctx->bi_ctx; + bi_data = bi_import(ctx, (uint8_t *)plaintext, strlen(plaintext)); + bi_res = RSA_public(rsa_ctx, bi_data); + bi_data = bi_res; /* reuse again */ + + gettimeofday(&tv_old, NULL); + for (i = 0; i < max_biggie; i++) + { + bi_res = RSA_private(rsa_ctx, bi_copy(bi_data)); + if (i < max_biggie-1) + { + bi_free(ctx, bi_res); + } + } + + gettimeofday(&tv_new, NULL); + bi_free(ctx, bi_data); + + diff = (tv_new.tv_sec-tv_old.tv_sec)*1000 + + (tv_new.tv_usec-tv_old.tv_usec)/1000; + printf("1024 bit decrypt time: %dms\n", diff/max_biggie); + TTY_FLUSH(); + bi_export(ctx, bi_res, compare, 128); + RSA_free(rsa_ctx); + free(buf); + if (memcmp(plaintext, compare, 128) != 0) + goto end; + + /** + * 2048 bit key + */ + plaintext = /* 256 byte number */ + "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^" + "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^" + "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^" + "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^"; + + len = get_file("ssl/test/axTLS.key_2048", &buf); + asn1_get_private_key(buf, len, &rsa_ctx); + ctx = rsa_ctx->bi_ctx; + bi_data = bi_import(ctx, (uint8_t *)plaintext, strlen(plaintext)); + bi_res = RSA_public(rsa_ctx, bi_data); + bi_data = bi_res; /* reuse again */ + + gettimeofday(&tv_old, NULL); + for (i = 0; i < max_biggie; i++) + { + bi_res = RSA_private(rsa_ctx, bi_copy(bi_data)); + if (i < max_biggie-1) + { + bi_free(ctx, bi_res); + } + } + gettimeofday(&tv_new, NULL); + bi_free(ctx, bi_data); + + diff = (tv_new.tv_sec-tv_old.tv_sec)*1000 + + (tv_new.tv_usec-tv_old.tv_usec)/1000; + printf("2048 bit decrypt time: %dms\n", diff/max_biggie); + TTY_FLUSH(); + bi_export(ctx, bi_res, compare, 256); + RSA_free(rsa_ctx); + free(buf); + if (memcmp(plaintext, compare, 256) != 0) + goto end; + + /** + * 4096 bit key + */ + plaintext = /* 512 byte number */ + "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^" + "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^" + "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^" + "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^" + "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^" + "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^" + "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^" + "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^"; + + len = get_file("ssl/test/axTLS.key_4096", &buf); + asn1_get_private_key(buf, len, &rsa_ctx); + ctx = rsa_ctx->bi_ctx; + bi_data = bi_import(ctx, (uint8_t *)plaintext, strlen(plaintext)); + gettimeofday(&tv_old, NULL); + bi_res = RSA_public(rsa_ctx, bi_data); + gettimeofday(&tv_new, NULL); + diff = (tv_new.tv_sec-tv_old.tv_sec)*1000 + + (tv_new.tv_usec-tv_old.tv_usec)/1000; + printf("4096 bit encrypt time: %dms\n", diff); + TTY_FLUSH(); + bi_data = bi_res; /* reuse again */ + + gettimeofday(&tv_old, NULL); + for (i = 0; i < max_biggie; i++) + { + bi_res = RSA_private(rsa_ctx, bi_copy(bi_data)); + if (i < max_biggie-1) + { + bi_free(ctx, bi_res); + } + } + + gettimeofday(&tv_new, NULL); + bi_free(ctx, bi_data); + + diff = (tv_new.tv_sec-tv_old.tv_sec)*1000 + + (tv_new.tv_usec-tv_old.tv_usec)/1000; + printf("4096 bit decrypt time: %dms\n", diff/max_biggie); + TTY_FLUSH(); + bi_export(ctx, bi_res, compare, 512); + RSA_free(rsa_ctx); + free(buf); + if (memcmp(plaintext, compare, 512) != 0) + goto end; + + /* done */ + printf("Bigint performance testing complete\n"); + res = 0; + +end: + return res; +#else + return 0; +#endif +} diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c new file mode 100644 index 0000000000..7c547ef222 --- /dev/null +++ b/ssl/test/ssltest.c @@ -0,0 +1,1714 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/* + * ssltest.c + * + * The testing of the crypto and ssl stuff goes here. Keeps the individual code + * modules from being uncluttered with test code. + * + * This is test code - I make no apologies for the quality! + */ + +#include +#include +#include +#include +#include +#include +#include + +#ifndef WIN32 +#include +#endif + +#include "ssl.h" + +#define DEFAULT_CERT "ssl/test/axTLS.x509_512.cer" +#define DEFAULT_KEY "ssl/test/axTLS.key_512" +//#define DEFAULT_SVR_OPTION SSL_DISPLAY_BYTES|SSL_DISPLAY_STATES +#define DEFAULT_SVR_OPTION 0 +#define DEFAULT_CLNT_OPTION 0 +//#define DEFAULT_CLNT_OPTION SSL_DISPLAY_BYTES|SSL_DISPLAY_STATES + +static int g_port = 19001; + +/************************************************************************** + * AES tests + * + * Run through a couple of the RFC3602 tests to verify that AES is correct. + **************************************************************************/ +#define TEST1_SIZE 16 +#define TEST2_SIZE 32 + +static int AES_test(BI_CTX *bi_ctx) +{ + AES_CTX aes_key; + int res = 1; + uint8_t key[TEST1_SIZE]; + uint8_t iv[TEST1_SIZE]; + + { + /* + Case #1: Encrypting 16 bytes (1 block) using AES-CBC + Key : 0x06a9214036b8a15b512e03d534120006 + IV : 0x3dafba429d9eb430b422da802c9fac41 + Plaintext : "Single block msg" + Ciphertext: 0xe353779c1079aeb82708942dbe77181a + + */ + char *in_str = "Single block msg"; + uint8_t ct[TEST1_SIZE]; + uint8_t enc_data[TEST1_SIZE]; + uint8_t dec_data[TEST1_SIZE]; + + bigint *key_bi = bi_str_import( + bi_ctx, "06A9214036B8A15B512E03D534120006"); + bigint *iv_bi = bi_str_import( + bi_ctx, "3DAFBA429D9EB430B422DA802C9FAC41"); + bigint *ct_bi = bi_str_import( + bi_ctx, "E353779C1079AEB82708942DBE77181A"); + bi_export(bi_ctx, key_bi, key, TEST1_SIZE); + bi_export(bi_ctx, iv_bi, iv, TEST1_SIZE); + bi_export(bi_ctx, ct_bi, ct, TEST1_SIZE); + + AES_set_key(&aes_key, key, iv, AES_MODE_128); + AES_cbc_encrypt(&aes_key, (const uint8_t *)in_str, + enc_data, sizeof(enc_data)); + if (memcmp(enc_data, ct, sizeof(ct))) + { + fprintf(stderr, "Error: AES ENCRYPT #1 failed\n"); + goto end; + } + + AES_set_key(&aes_key, key, iv, AES_MODE_128); + AES_convert_key(&aes_key); + AES_cbc_decrypt(&aes_key, enc_data, dec_data, sizeof(enc_data)); + + if (memcmp(dec_data, in_str, sizeof(dec_data))) + { + fprintf(stderr, "Error: AES DECRYPT #1 failed\n"); + goto end; + } + } + + { + /* + Case #2: Encrypting 32 bytes (2 blocks) using AES-CBC + Key : 0xc286696d887c9aa0611bbb3e2025a45a + IV : 0x562e17996d093d28ddb3ba695a2e6f58 + Plaintext : 0x000102030405060708090a0b0c0d0e0f + 101112131415161718191a1b1c1d1e1f + Ciphertext: 0xd296cd94c2cccf8a3a863028b5e1dc0a + 7586602d253cfff91b8266bea6d61ab1 + */ + uint8_t in_data[TEST2_SIZE]; + uint8_t ct[TEST2_SIZE]; + uint8_t enc_data[TEST2_SIZE]; + uint8_t dec_data[TEST2_SIZE]; + + bigint *in_bi = bi_str_import(bi_ctx, + "000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F"); + bigint *key_bi = bi_str_import( + bi_ctx, "C286696D887C9AA0611BBB3E2025A45A"); + bigint *iv_bi = bi_str_import( + bi_ctx, "562E17996D093D28DDB3BA695A2E6F58"); + bigint *ct_bi = bi_str_import(bi_ctx, + "D296CD94C2CCCF8A3A863028B5E1DC0A7586602D253CFFF91B8266BEA6D61AB1"); + bi_export(bi_ctx, in_bi, in_data, TEST2_SIZE); + bi_export(bi_ctx, key_bi, key, TEST1_SIZE); + bi_export(bi_ctx, iv_bi, iv, TEST1_SIZE); + bi_export(bi_ctx, ct_bi, ct, TEST2_SIZE); + + AES_set_key(&aes_key, key, iv, AES_MODE_128); + AES_cbc_encrypt(&aes_key, (const uint8_t *)in_data, + enc_data, sizeof(enc_data)); + + if (memcmp(enc_data, ct, sizeof(ct))) + { + fprintf(stderr, "Error: ENCRYPT #2 failed\n"); + goto end; + } + + AES_set_key(&aes_key, key, iv, AES_MODE_128); + AES_convert_key(&aes_key); + AES_cbc_decrypt(&aes_key, enc_data, dec_data, sizeof(enc_data)); + if (memcmp(dec_data, in_data, sizeof(dec_data))) + { + fprintf(stderr, "Error: DECRYPT #2 failed\n"); + goto end; + } + } + + res = 0; + printf("All AES tests passed\n"); + +end: + return res; +} + +/************************************************************************** + * RC4 tests + * + * ARC4 tests vectors from OpenSSL (crypto/rc4/rc4test.c) + **************************************************************************/ +static const uint8_t keys[7][30]= +{ + {8,0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef}, + {8,0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef}, + {8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}, + {4,0xef,0x01,0x23,0x45}, + {8,0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef}, + {4,0xef,0x01,0x23,0x45}, +}; + +static const uint8_t data_len[7]={8,8,8,20,28,10}; +static uint8_t data[7][30]= +{ + {0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef,0xff}, + {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xff}, + {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xff}, + {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, + 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, + 0x00,0x00,0x00,0x00,0xff}, + {0x12,0x34,0x56,0x78,0x9A,0xBC,0xDE,0xF0, + 0x12,0x34,0x56,0x78,0x9A,0xBC,0xDE,0xF0, + 0x12,0x34,0x56,0x78,0x9A,0xBC,0xDE,0xF0, + 0x12,0x34,0x56,0x78,0xff}, + {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xff}, + {0}, +}; + +static const uint8_t output[7][30]= +{ + {0x75,0xb7,0x87,0x80,0x99,0xe0,0xc5,0x96,0x00}, + {0x74,0x94,0xc2,0xe7,0x10,0x4b,0x08,0x79,0x00}, + {0xde,0x18,0x89,0x41,0xa3,0x37,0x5d,0x3a,0x00}, + {0xd6,0xa1,0x41,0xa7,0xec,0x3c,0x38,0xdf, + 0xbd,0x61,0x5a,0x11,0x62,0xe1,0xc7,0xba, + 0x36,0xb6,0x78,0x58,0x00}, + {0x66,0xa0,0x94,0x9f,0x8a,0xf7,0xd6,0x89, + 0x1f,0x7f,0x83,0x2b,0xa8,0x33,0xc0,0x0c, + 0x89,0x2e,0xbe,0x30,0x14,0x3c,0xe2,0x87, + 0x40,0x01,0x1e,0xcf,0x00}, + {0xd6,0xa1,0x41,0xa7,0xec,0x3c,0x38,0xdf,0xbd,0x61,0x00}, + {0}, +}; + +static int RC4_test(BI_CTX *bi_ctx) +{ + int i, res = 1; + RC4_CTX s; + + for (i = 0; i < 6; i++) + { + RC4_setup(&s, &keys[i][1], keys[i][0]); + RC4_crypt(&s, data[i], data[i], data_len[i]); + + if (memcmp(data[i], output[i], data_len[i])) + { + fprintf(stderr, "Error: RC4 CRYPT #%d failed\n", i); + goto end; + } + } + + res = 0; + printf("All RC4 tests passed\n"); + +end: + return res; +} + +/************************************************************************** + * SHA1 tests + * + * Run through a couple of the RFC3174 tests to verify that SHA1 is correct. + **************************************************************************/ +static int SHA1_test(BI_CTX *bi_ctx) +{ + SHA1_CTX ctx; + uint8_t ct[SHA1_SIZE]; + uint8_t digest[SHA1_SIZE]; + int res = 1; + + { + const char *in_str = "abc"; + bigint *ct_bi = bi_str_import(bi_ctx, + "A9993E364706816ABA3E25717850C26C9CD0D89D"); + bi_export(bi_ctx, ct_bi, ct, SHA1_SIZE); + + SHA1Init(&ctx); + SHA1Update(&ctx, (const uint8_t *)in_str, strlen(in_str)); + SHA1Final(&ctx, digest); + + if (memcmp(digest, ct, sizeof(ct))) + { + fprintf(stderr, "Error: SHA1 #1 failed\n"); + goto end; + } + } + + { + const char *in_str = + "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"; + bigint *ct_bi = bi_str_import(bi_ctx, + "84983E441C3BD26EBAAE4AA1F95129E5E54670F1"); + bi_export(bi_ctx, ct_bi, ct, SHA1_SIZE); + + SHA1Init(&ctx); + SHA1Update(&ctx, (const uint8_t *)in_str, strlen(in_str)); + SHA1Final(&ctx, digest); + + if (memcmp(digest, ct, sizeof(ct))) + { + fprintf(stderr, "Error: SHA1 #2 failed\n"); + goto end; + } + } + + res = 0; + printf("All SHA1 tests passed\n"); + +end: + return res; +} + +/************************************************************************** + * MD5 tests + * + * Run through a couple of the RFC1321 tests to verify that MD5 is correct. + **************************************************************************/ +static int MD5_test(BI_CTX *bi_ctx) +{ + MD5_CTX ctx; + uint8_t ct[MD5_SIZE]; + uint8_t digest[MD5_SIZE]; + int res = 1; + + { + const char *in_str = "abc"; + bigint *ct_bi = bi_str_import(bi_ctx, + "900150983CD24FB0D6963F7D28E17F72"); + bi_export(bi_ctx, ct_bi, ct, MD5_SIZE); + + MD5Init(&ctx); + MD5Update(&ctx, (const uint8_t *)in_str, strlen(in_str)); + MD5Final(&ctx, digest); + + if (memcmp(digest, ct, sizeof(ct))) + { + fprintf(stderr, "Error: MD5 #1 failed\n"); + goto end; + } + } + + { + const char *in_str = + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; + bigint *ct_bi = bi_str_import( + bi_ctx, "D174AB98D277D9F5A5611C2C9F419D9F"); + bi_export(bi_ctx, ct_bi, ct, MD5_SIZE); + + MD5Init(&ctx); + MD5Update(&ctx, (const uint8_t *)in_str, strlen(in_str)); + MD5Final(&ctx, digest); + + if (memcmp(digest, ct, sizeof(ct))) + { + fprintf(stderr, "Error: MD5 #2 failed\n"); + goto end; + } + } + res = 0; + printf("All MD5 tests passed\n"); + +end: + return res; +} + +/************************************************************************** + * HMAC tests + * + * Run through a couple of the RFC2202 tests to verify that HMAC is correct. + **************************************************************************/ +static int HMAC_test(BI_CTX *bi_ctx) +{ + uint8_t key[SHA1_SIZE]; + uint8_t ct[SHA1_SIZE]; + uint8_t dgst[SHA1_SIZE]; + int res = 1; + const char *key_str; + + const char *data_str = "Hi There"; + bigint *key_bi = bi_str_import(bi_ctx, "0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B"); + bigint *ct_bi = bi_str_import(bi_ctx, "9294727A3638BB1C13F48EF8158BFC9D"); + bi_export(bi_ctx, key_bi, key, MD5_SIZE); + bi_export(bi_ctx, ct_bi, ct, MD5_SIZE); + hmac_md5((const uint8_t *)data_str, 8, key, MD5_SIZE, dgst); + if (memcmp(dgst, ct, MD5_SIZE)) + { + printf("HMAC MD5 #1 failed\n"); + goto end; + } + + data_str = "what do ya want for nothing?"; + key_str = "Jefe"; + ct_bi = bi_str_import(bi_ctx, "750C783E6AB0B503EAA86E310A5DB738"); + bi_export(bi_ctx, ct_bi, ct, MD5_SIZE); + hmac_md5((const uint8_t *)data_str, 28, (const uint8_t *)key_str, 4, dgst); + if (memcmp(dgst, ct, MD5_SIZE)) + { + printf("HMAC MD5 #2 failed\n"); + goto end; + } + + data_str = "Hi There"; + key_bi = bi_str_import(bi_ctx, "0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B"); + bi_export(bi_ctx, key_bi, key, SHA1_SIZE); + ct_bi = bi_str_import(bi_ctx, "B617318655057264E28BC0B6FB378C8EF146BE00"); + bi_export(bi_ctx, ct_bi, ct, SHA1_SIZE); + + hmac_sha1((const uint8_t *)data_str, 8, + (const uint8_t *)key, SHA1_SIZE, dgst); + if (memcmp(dgst, ct, SHA1_SIZE)) + { + printf("HMAC SHA1 #1 failed\n"); + goto end; + } + + data_str = "what do ya want for nothing?"; + key_str = "Jefe"; + ct_bi = bi_str_import(bi_ctx, "EFFCDF6AE5EB2FA2D27416D5F184DF9C259A7C79"); + bi_export(bi_ctx, ct_bi, ct, SHA1_SIZE); + + hmac_sha1((const uint8_t *)data_str, 28, (const uint8_t *)key_str, 5, dgst); + if (memcmp(dgst, ct, SHA1_SIZE)) + { + printf("HMAC SHA1 failed\n"); + exit(1); + } + + res = 0; + printf("All HMAC tests passed\n"); + +end: + return res; +} + +/************************************************************************** + * BIGINT tests + * + **************************************************************************/ +static int BIGINT_test(BI_CTX *ctx) +{ + int res = 1; + bigint *bi_data, *bi_exp, *bi_res; + const char *expnt, *plaintext, *mod; + uint8_t compare[MAX_KEY_BYTE_SIZE]; + + /** + * 512 bit key + */ + plaintext = /* 64 byte number */ + "01aaaaaaaaaabbbbbbbbbbbbbbbccccccccccccccdddddddddddddeeeeeeeeee"; + + mod = "C30773C8ABE09FCC279EE0E5343370DE" + "8B2FFDB6059271E3005A7CEEF0D35E0A" + "1F9915D95E63560836CC2EB2C289270D" + "BCAE8CAF6F5E907FC2759EE220071E1B"; + + expnt = "A1E556CD1738E10DF539E35101334E97" + "BE8D391C57A5C89A7AD9A2EA2ACA1B3D" + "F3140F5091CC535CBAA47CEC4159EE1F" + "B6A3661AFF1AB758426EAB158452A9B9"; + + bi_data = bi_import(ctx, (uint8_t *)plaintext, strlen(plaintext)); + bi_exp = int_to_bi(ctx, 0x10001); + bi_set_mod(ctx, bi_str_import(ctx, mod), 0); + bi_res = bi_mod_power(ctx, bi_data, bi_exp); + + bi_data = bi_res; /* resuse again - see if we get the original */ + + bi_exp = bi_str_import(ctx, expnt); + bi_res = bi_mod_power(ctx, bi_data, bi_exp); + bi_free_mod(ctx, 0); + + bi_export(ctx, bi_res, compare, 64); + if (memcmp(plaintext, compare, 64) != 0) + goto end; + + printf("All BIGINT tests passed\n"); + res = 0; + +end: + return res; +} + +/************************************************************************** + * RSA tests + * + * Use the results from openssl to verify PKCS1 etc + **************************************************************************/ +static int RSA_test(void) +{ + int res = 1; + const char *plaintext = /* 128 byte hex number */ + "1aaaaaaaaaabbbbbbbbbbbbbbbccccccccccccccdddddddddddddeeeeeeeeee2" + "1aaaaaaaaaabbbbbbbbbbbbbbbccccccccccccccdddddddddddddeeeeeeeee2\012"; + uint8_t enc_data[128], dec_data[128]; + RSA_CTX *rsa_ctx; + BI_CTX *bi_ctx; + bigint *plaintext_bi; + bigint *enc_data_bi, *dec_data_bi; + uint8_t enc_data2[128], dec_data2[128]; + int size; + int len; + uint8_t *buf; + + /* extract the private key elements */ + len = get_file("ssl/test/axTLS.key_1024", &buf); + if (asn1_get_private_key(buf, len, &rsa_ctx) < 0) + { + goto end; + } + + free(buf); + bi_ctx = rsa_ctx->bi_ctx; + plaintext_bi = bi_import(bi_ctx, + (const uint8_t *)plaintext, strlen(plaintext)); + + /* basic rsa encrypt */ + enc_data_bi = RSA_public(rsa_ctx, plaintext_bi); + bi_export(bi_ctx, bi_copy(enc_data_bi), enc_data, sizeof(enc_data)); + + /* basic rsa decrypt */ + dec_data_bi = RSA_private(rsa_ctx, enc_data_bi); + bi_export(bi_ctx, dec_data_bi, dec_data, sizeof(dec_data)); + + if (memcmp(dec_data, plaintext, strlen(plaintext))) + { + fprintf(stderr, "Error: DECRYPT #1 failed\n"); + goto end; + } + + RSA_encrypt(rsa_ctx, (const uint8_t *)"abc", 3, enc_data2, 0); + size = RSA_decrypt(rsa_ctx, enc_data2, dec_data2, 1); + if (memcmp("abc", dec_data2, 3)) + { + fprintf(stderr, "Error: ENCRYPT/DECRYPT #2 failed\n"); + goto end; + } + + RSA_free(rsa_ctx); + res = 0; + printf("All RSA tests passed\n"); + +end: + return res; +} + +/************************************************************************** + * Cert Testing + * + **************************************************************************/ +static int cert_tests(void) +{ + int res = -1, len; + X509_CTX *x509_ctx; + SSLCTX *ssl_ctx; + uint8_t *buf; + + /* check a bunch of 3rd party certificates */ + ssl_ctx = ssl_ctx_new(0, 0); + len = get_file("ssl/test/microsoft.x509_ca", &buf); + if ((res = add_cert_auth(ssl_ctx, buf, len)) < 0) + { + printf("Cert #1\n"); + ssl_display_error(res); + goto bad_cert; + } + + ssl_ctx_free(ssl_ctx); + free(buf); + + ssl_ctx = ssl_ctx_new(0, 0); + len = get_file("ssl/test/thawte.x509_ca", &buf); + if ((res = add_cert_auth(ssl_ctx, buf, len)) < 0) + { + printf("Cert #2\n"); + ssl_display_error(res); + goto bad_cert; + } + + ssl_ctx_free(ssl_ctx); + free(buf); + + ssl_ctx = ssl_ctx_new(0, 0); + len = get_file("ssl/test/deutsche_telecom.x509_ca", &buf); + if ((res = add_cert_auth(ssl_ctx, buf, len)) < 0) + { + printf("Cert #3\n"); + ssl_display_error(res); + goto bad_cert; + } + + ssl_ctx_free(ssl_ctx); + free(buf); + + ssl_ctx = ssl_ctx_new(0, 0); + len = get_file("ssl/test/equifax.x509_ca", &buf); + if ((res = add_cert_auth(ssl_ctx, buf, len)) < 0) + { + printf("Cert #4\n"); + ssl_display_error(res); + goto bad_cert; + } + + ssl_ctx_free(ssl_ctx); + free(buf); + + /* Verisign use MD2 which is not supported */ + ssl_ctx = ssl_ctx_new(0, 0); + len = get_file("ssl/test/verisign.x509_ca", &buf); + if ((res = add_cert_auth(ssl_ctx, buf, len)) != + X509_VFY_ERROR_UNSUPPORTED_DIGEST) + { + printf("Cert #5\n"); + ssl_display_error(res); + goto bad_cert; + } + + ssl_ctx_free(ssl_ctx); + free(buf); + + if (get_file("ssl/test/verisign.x509_my_cert", &buf) < 0 || + x509_new(buf, &len, &x509_ctx)) + { + printf("Cert #6\n"); + ssl_display_error(res); + goto bad_cert; + } + + x509_free(x509_ctx); + free(buf); + res = 0; /* all ok */ + printf("All Certificate tests passed\n"); + +bad_cert: + return res; +} + +/** + * init a server socket. + */ +static int server_socket_init(int *port) +{ + struct sockaddr_in serv_addr; + int server_fd; + char yes = 1; + + /* Create socket for incoming connections */ + if ((server_fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) + { + return -1; + } + + setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes)); + +go_again: + /* Construct local address structure */ + memset(&serv_addr, 0, sizeof(serv_addr)); /* Zero out structure */ + serv_addr.sin_family = AF_INET; /* Internet address family */ + serv_addr.sin_addr.s_addr = htonl(INADDR_ANY); /* Any incoming interface */ + serv_addr.sin_port = htons(*port); /* Local port */ + + /* Bind to the local address */ + if (bind(server_fd, (struct sockaddr *) &serv_addr, sizeof(serv_addr)) < 0) + { + (*port)++; + goto go_again; + } + /* Mark the socket so it will listen for incoming connections */ + if (listen(server_fd, 3000) < 0) + { + return -1; + } + + return server_fd; +} + +/** + * init a client socket. + */ +static int client_socket_init(uint16_t port) +{ + struct sockaddr_in address; + int client_fd; + + address.sin_family = AF_INET; + address.sin_port = htons(port); + address.sin_addr.s_addr = inet_addr("127.0.0.1"); + client_fd = socket(AF_INET, SOCK_STREAM, 0); + if (connect(client_fd, (struct sockaddr *)&address, sizeof(address)) < 0) + { + perror("socket"); + close(client_fd); + client_fd = -1; + } + + return client_fd; +} + +/************************************************************************** + * SSL Server Testing + * + **************************************************************************/ +typedef struct +{ + /* not used as yet */ + int dummy; +} SVR_CTX; + +typedef struct +{ + const char *testname; + const char *openssl_option; +} client_t; + +static void do_client(client_t *clnt) +{ + char openssl_buf[2048]; + + /* make sure the main thread goes first */ + sleep(0); + + /* show the session ids in the reconnect test */ + if (strcmp(clnt->testname, "Session Reuse") == 0) + { + sprintf(openssl_buf, "echo \"hello client\" | openssl s_client " + "-connect localhost:%d %s 2>&1 | grep \"Session-ID:\"", + g_port, clnt->openssl_option); + } + else + { + sprintf(openssl_buf, "echo \"hello client\" | openssl s_client " +#ifdef WIN32 + "-connect localhost:%d -quiet %s", +#else + "-connect localhost:%d -quiet %s > /dev/null 2>&1", +#endif + g_port, clnt->openssl_option); + } + + system(openssl_buf); +} + +static int SSL_server_test( + SVR_CTX *svr_test_ctx, + const char *testname, + const char *openssl_option, + const char *device_cert, + const char *product_cert, + const char *private_key, + const char *ca_cert, + const char *password, + int axolotls_option) +{ + int server_fd, ret = 0; + SSLCTX *ssl_ctx = NULL; + struct sockaddr_in client_addr; + uint8_t *read_buf; + int clnt_len = sizeof(client_addr); + client_t client_data; +#ifndef WIN32 + pthread_t thread; +#endif + g_port++; + + client_data.testname = testname; + client_data.openssl_option = openssl_option; + + if ((server_fd = server_socket_init(&g_port)) < 0) + goto error; + + if (private_key) + { + axolotls_option |= SSL_NO_DEFAULT_KEY; + } + + if ((ssl_ctx = ssl_ctx_new(axolotls_option, SSL_DEFAULT_SVR_SESS)) == NULL) + { + ret = SSL_ERROR_INVALID_KEY; + goto error; + } + + if (private_key) + { + int obj_type = SSL_OBJ_RSA_KEY; + + if (strstr(private_key, ".p8")) + obj_type = SSL_OBJ_PKCS8; + else if (strstr(private_key, ".p12")) + obj_type = SSL_OBJ_PKCS12; + + if (ssl_obj_load(ssl_ctx, obj_type, private_key, password)) + { + ret = SSL_ERROR_INVALID_KEY; + goto error; + } + } + + if (device_cert) /* test chaining */ + { + if ((ret = ssl_obj_load(ssl_ctx, + SSL_OBJ_X509_CERT, device_cert, NULL)) != SSL_OK) + goto error; + } + + if (product_cert) /* test chaining */ + { + if ((ret = ssl_obj_load(ssl_ctx, + SSL_OBJ_X509_CERT, product_cert, NULL)) != SSL_OK) + goto error; + } + + if (ca_cert) /* test adding certificate authorities */ + { + if ((ret = ssl_obj_load(ssl_ctx, + SSL_OBJ_X509_CACERT, ca_cert, NULL)) != SSL_OK) + goto error; + } + +#ifndef WIN32 + pthread_create(&thread, NULL, + (void *(*)(void *))do_client, (void *)&client_data); + pthread_detach(thread); +#else + CreateThread(NULL, 1024, (LPTHREAD_START_ROUTINE)do_client, + (LPVOID)&client_data, 0, NULL); +#endif + + for (;;) + { + int client_fd, size = 0; + SSL *ssl; + + /* Wait for a client to connect */ + if ((client_fd = accept(server_fd, + (struct sockaddr *) &client_addr, &clnt_len)) < 0) + { + ret = SSL_ERROR_SOCK_SETUP_FAILURE; + goto error; + } + + /* we are ready to go */ + ssl = ssl_server_new(ssl_ctx, client_fd); + while ((size = ssl_read(ssl, &read_buf)) == SSL_OK); + close(client_fd); + + if (size < SSL_OK) /* got some alert or something nasty */ + { + ret = size; + + if (ret == SSL_ERROR_CONN_LOST) + { + ret = SSL_OK; + continue; + } + + break; /* we've got a problem */ + } + else /* looks more promising */ + { + if (strstr("hello client", read_buf) == NULL) + { + printf("SSL server test \"%s\" passed\n", testname); + TTY_FLUSH(); + ret = 0; + break; + } + } + + ssl_free(ssl); + } + + close(server_fd); + +error: + ssl_ctx_free(ssl_ctx); + return ret; +} + +int SSL_server_tests(void) +{ + int ret = -1; + struct stat stat_buf; + SVR_CTX svr_test_ctx; + memset(&svr_test_ctx, 0, sizeof(SVR_CTX)); + + printf("### starting server tests\n"); + + /* Go through the algorithms */ + + /* + * TLS1 client hello + */ + if ((ret = SSL_server_test(NULL, "TLSv1", "-cipher RC4-SHA -tls1", + NULL, NULL, NULL, NULL, NULL, DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * AES128-SHA + */ + if ((ret = SSL_server_test(NULL, "AES256-SHA", "-cipher AES128-SHA", + DEFAULT_CERT, NULL, DEFAULT_KEY, NULL, NULL, + DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * AES256-SHA + */ + if ((ret = SSL_server_test(NULL, "AES256-SHA", "-cipher AES128-SHA", + DEFAULT_CERT, NULL, DEFAULT_KEY, NULL, NULL, + DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * RC4-SHA + */ + if ((ret = SSL_server_test(NULL, "RC4-SHA", "-cipher RC4-SHA", + DEFAULT_CERT, NULL, DEFAULT_KEY, NULL, NULL, + DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * RC4-MD5 + */ + if ((ret = SSL_server_test(NULL, "RC4-MD5", "-cipher RC4-MD5", + DEFAULT_CERT, NULL, DEFAULT_KEY, NULL, NULL, + DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * Session Reuse + * all the session id's should match for session resumption. + */ + if ((ret = SSL_server_test(NULL, "Session Reuse", + "-cipher RC4-SHA -reconnect", + DEFAULT_CERT, NULL, DEFAULT_KEY, NULL, NULL, + DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * 512 bit RSA key + */ + if ((ret = SSL_server_test(NULL, "512 bit key", "-cipher RC4-SHA", + "ssl/test/axTLS.x509_512.cer", NULL, + "ssl/test/axTLS.key_512", + NULL, NULL, DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * 1024 bit RSA key (check certificate chaining) + */ + if ((ret = SSL_server_test(NULL, "1024 bit key", + "-cipher RC4-SHA", + "ssl/test/axTLS.x509_device.cer", + "ssl/test/axTLS.x509_512.cer", + "ssl/test/axTLS.device_key", + NULL, NULL, DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * 2048 bit RSA key + */ + if ((ret = SSL_server_test(NULL, "2048 bit key", + "-cipher RC4-SHA", + "ssl/test/axTLS.x509_2048.cer", NULL, + "ssl/test/axTLS.key_2048", + NULL, NULL, DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * 4096 bit RSA key + */ + if ((ret = SSL_server_test(NULL, "4096 bit key", + "-cipher RC4-SHA", + "ssl/test/axTLS.x509_4096.cer", NULL, + "ssl/test/axTLS.key_4096", + NULL, NULL, DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * Client Verification + */ + if ((ret = SSL_server_test(NULL, "Client Verification", + "-cipher RC4-SHA -tls1 " + "-cert ssl/test/axTLS.x509_2048.pem " + "-key ssl/test/axTLS.key_2048.pem ", + NULL, NULL, NULL, + "ssl/test/axTLS.ca_x509.cer", NULL, + DEFAULT_SVR_OPTION|SSL_CLIENT_AUTHENTICATION))) + goto cleanup; + + /* this test should fail */ + if (stat("ssl/test/axTLS.x509_bad_before.pem", &stat_buf) >= 0) + { + if ((ret = SSL_server_test(NULL, "Bad Before Cert", + "-cipher RC4-SHA -tls1 " + "-cert ssl/test/axTLS.x509_bad_before.pem " + "-key ssl/test/axTLS.key_512.pem ", + NULL, NULL, NULL, + "ssl/test/axTLS.ca_x509.cer", NULL, + DEFAULT_SVR_OPTION|SSL_CLIENT_AUTHENTICATION)) != + SSL_X509_ERROR(X509_VFY_ERROR_NOT_YET_VALID)) + goto cleanup; + + printf("SSL server test \"%s\" passed\n", "Bad Before Cert"); + TTY_FLUSH(); + ret = 0; /* is ok */ + } + + /* this test should fail */ + if ((ret = SSL_server_test(NULL, "Bad After Cert", + "-cipher RC4-SHA -tls1 " + "-cert ssl/test/axTLS.x509_bad_after.pem " + "-key ssl/test/axTLS.key_512.pem ", + NULL, NULL, NULL, + "ssl/test/axTLS.ca_x509.cer", NULL, + DEFAULT_SVR_OPTION|SSL_CLIENT_AUTHENTICATION)) != + SSL_X509_ERROR(X509_VFY_ERROR_EXPIRED)) + goto cleanup; + + printf("SSL server test \"%s\" passed\n", "Bad After Cert"); + TTY_FLUSH(); + + /* this test should fail */ + if ((ret = SSL_server_test(NULL, "Bogus cert", "-cipher RC4-SHA", + "ssl/test/axTLS.x509_crud.cer", NULL, + "ssl/test/axTLS.key_512", NULL, + NULL, DEFAULT_SVR_OPTION)) != SSL_ERROR_INVALID_KEY) + goto cleanup; + + printf("SSL server test \"%s\" passed\n", "Bogus cert"); + TTY_FLUSH(); + + /* this test should fail */ + if ((ret = SSL_server_test(NULL, "Bogus private key", + "-cipher RC4-SHA", + "ssl/test/axTLS.x509_device.cer", NULL, + "ssl/test/axTLS.crud", NULL, + NULL, DEFAULT_SVR_OPTION)) != SSL_ERROR_INVALID_KEY) + goto cleanup; + + printf("SSL server test \"%s\" passed\n", "Bogus private key"); + TTY_FLUSH(); + + /* + * Key in PEM format + */ + if ((ret = SSL_server_test(NULL, "Key in PEM format", + "-cipher RC4-SHA", + "ssl/test/axTLS.x509_512.cer", NULL, + "ssl/test/axTLS.key_512.pem", NULL, + NULL, DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * Cert in PEM format + */ + if ((ret = SSL_server_test(NULL, "Cert in PEM format", + "-cipher RC4-SHA", + "ssl/test/axTLS.x509_512.pem", NULL, + "ssl/test/axTLS.key_512.pem", NULL, + NULL, DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * Cert chain in PEM format + */ + if ((ret = SSL_server_test(NULL, "Cert chain in PEM format", + "-cipher RC4-SHA", + "ssl/test/axTLS.x509_device.pem", + NULL, "ssl/test/axTLS.device_key.pem", + NULL, NULL, DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * AES128 Encrypted key + */ + if ((ret = SSL_server_test(NULL, "AES128 encrypted key", + "-cipher RC4-SHA", + "ssl/test/axTLS.x509_aes128.pem", NULL, + "ssl/test/axTLS.key_aes128.pem", + NULL, "abcd", DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * AES256 Encrypted key + */ + if ((ret = SSL_server_test(NULL, "AES256 encrypted key", + "-cipher RC4-SHA", + "ssl/test/axTLS.x509_aes256.pem", NULL, + "ssl/test/axTLS.key_aes256.pem", + NULL, "abcd", DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * AES128 Encrypted invalid key + */ + if ((ret = SSL_server_test(NULL, "AES128 encrypted invalid key", + "-cipher RC4-SHA", + "ssl/test/axTLS.x509_aes128.pem", NULL, + "ssl/test/axTLS.key_aes128.pem", + NULL, "xyz", DEFAULT_SVR_OPTION)) != SSL_ERROR_INVALID_KEY) + goto cleanup; + + printf("SSL server test \"%s\" passed\n", "AES128 encrypted invalid key"); + TTY_FLUSH(); + + /* + * PKCS 8 key (encrypted) + */ + if ((ret = SSL_server_test(NULL, "pkcs 8 encrypted", "-cipher RC4-SHA", + DEFAULT_CERT, NULL, "ssl/test/axTLS.encrypted.p8", NULL, "abcd", + DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * PKCS 8 key (unencrypted) + */ + if ((ret = SSL_server_test(NULL, "pkcs 8 unencrypted", "-cipher RC4-SHA", + DEFAULT_CERT, NULL, "ssl/test/axTLS.unencrypted.p8", NULL, NULL, + DEFAULT_SVR_OPTION))) + goto cleanup; + + /* + * PKCS 12 key/certificate + */ + if ((ret = SSL_server_test(NULL, "pkcs 12 no CA", "-cipher RC4-SHA", + DEFAULT_CERT, NULL, "ssl/test/axTLS.withoutCA.p12", + NULL, "abcd", DEFAULT_SVR_OPTION))) + goto cleanup; + + if ((ret = SSL_server_test(NULL, "pkcs 12 with CA", "-cipher RC4-SHA", + NULL, NULL, "ssl/test/axTLS.withCA.p12", + NULL, "abcd", DEFAULT_SVR_OPTION))) + goto cleanup; + + ret = 0; + +cleanup: + if (ret) + fprintf(stderr, "Error: A server test failed\n"); + return ret; +} + +/************************************************************************** + * SSL Client Testing + * + **************************************************************************/ +typedef struct +{ + uint8_t session_id[SSL_SESSION_ID_SIZE]; +#ifndef WIN32 + pthread_t server_thread; +#endif + int start_server; + int stop_server; + int do_reneg; +} CLNT_SESSION_RESUME_CTX; + +typedef struct +{ + const char *testname; + const char *openssl_option; +} server_t; + +static void do_server(server_t *svr) +{ + char openssl_buf[2048]; +#ifndef WIN32 + pthread_setcanceltype(PTHREAD_CANCEL_ASYNCHRONOUS, NULL); +#endif + sprintf(openssl_buf, "openssl s_server -tls1 " + "-accept %d -quiet %s ", g_port, svr->openssl_option); + system(openssl_buf); +} + +static int SSL_client_test( + const char *test, + SSLCTX **ssl_ctx, + const char *openssl_option, + CLNT_SESSION_RESUME_CTX *sess_resume, + uint32_t client_options, + const char *private_key, + const char *password, + const char *cert) +{ + server_t server_data; + SSL *ssl = NULL; + int client_fd = -1; + uint8_t *session_id = NULL; + int ret = 1; +#ifndef WIN32 + pthread_t thread; +#endif + + if (sess_resume == NULL || sess_resume->start_server) + { + g_port++; + server_data.openssl_option = openssl_option; + +#ifndef WIN32 + pthread_create(&thread, NULL, + (void *(*)(void *))do_server, (void *)&server_data); + pthread_detach(thread); +#else + CreateThread(NULL, 1024, (LPTHREAD_START_ROUTINE)do_server, + (LPVOID)&server_data, 0, NULL); +#endif + } + + usleep(200000); /* allow server to start */ + + if (*ssl_ctx == NULL) + { + if (private_key) + { + client_options |= SSL_NO_DEFAULT_KEY; + } + + if ((*ssl_ctx = ssl_ctx_new( + client_options, SSL_DEFAULT_CLNT_SESS)) == NULL) + { + ret = SSL_ERROR_INVALID_KEY; + goto client_test_exit; + } + + if (private_key) + { + int obj_type = SSL_OBJ_RSA_KEY; + + if (strstr(private_key, ".p8")) + obj_type = SSL_OBJ_PKCS8; + else if (strstr(private_key, ".p12")) + obj_type = SSL_OBJ_PKCS12; + + if (ssl_obj_load(*ssl_ctx, obj_type, private_key, password)) + { + ret = SSL_ERROR_INVALID_KEY; + goto client_test_exit; + } + } + + if (cert) + { + if ((ret = ssl_obj_load(*ssl_ctx, + SSL_OBJ_X509_CERT, cert, NULL)) != SSL_OK) + { + printf("could not add cert %s (%d)\n", cert, ret); + TTY_FLUSH(); + goto client_test_exit; + } + } + } + + if (sess_resume && !sess_resume->start_server) + { + session_id = sess_resume->session_id; + } + + if ((client_fd = client_socket_init(g_port)) < 0) + { + printf("could not start socket on %d\n", g_port); + TTY_FLUSH(); + goto client_test_exit; + } + + if (ssl_obj_load(*ssl_ctx, SSL_OBJ_X509_CACERT, + "ssl/test/axTLS.ca_x509.cer", NULL)) + { + printf("could not add cert auth\n"); + TTY_FLUSH(); + goto client_test_exit; + } + + ssl = ssl_client_new(*ssl_ctx, client_fd, session_id); + + /* check the return status */ + if ((ret = ssl_handshake_status(ssl))) + goto client_test_exit; + + /* renegotiate client */ + if (sess_resume && sess_resume->do_reneg) + { + if (ssl_renegotiate(ssl) < 0) + goto client_test_exit; + } + + if (sess_resume) + { + memcpy(sess_resume->session_id, + ssl_get_session_id(ssl), SSL_SESSION_ID_SIZE); + } + + if (IS_SET_SSL_FLAG(SSL_SERVER_VERIFY_LATER) && + (ret = ssl_verify_cert(ssl))) + { + goto client_test_exit; + } + + ssl_write(ssl, (uint8_t *)"hello world\n", 13); + if (sess_resume) + { + const uint8_t *sess_id = ssl_get_session_id(ssl); + int i; + + printf(" Session-ID: "); + for (i = 0; i < SSL_SESSION_ID_SIZE; i++) + { + printf("%02X", sess_id[i]); + } + printf("\n"); + TTY_FLUSH(); + } + + ret = 0; + +client_test_exit: + ssl_free(ssl); + close(client_fd); + usleep(200000); /* allow openssl to say something */ + + if (sess_resume) + { + if (sess_resume->stop_server) + { + ssl_ctx_free(*ssl_ctx); + *ssl_ctx = NULL; +#ifndef WIN32 + pthread_cancel(sess_resume->server_thread); +#endif + } + else if (sess_resume->start_server) + { +#ifndef WIN32 + sess_resume->server_thread = thread; +#endif + } + } + else + { + ssl_ctx_free(*ssl_ctx); + *ssl_ctx = NULL; +#ifndef WIN32 + pthread_cancel(thread); +#endif + } + + if (ret == 0) + { + printf("SSL client test \"%s\" passed\n", test); + TTY_FLUSH(); + } + + return ret; +} + +int SSL_client_tests(void) +{ + int ret = -1; + SSLCTX *ssl_ctx = NULL; + CLNT_SESSION_RESUME_CTX sess_resume; + memset(&sess_resume, 0, sizeof(CLNT_SESSION_RESUME_CTX)); + + sess_resume.start_server = 1; + printf("### starting client tests\n"); + + if ((ret = SSL_client_test("512 bit key", + &ssl_ctx, + "-cert ssl/test/axTLS.x509_512.pem " + "-key ssl/test/axTLS.key_512.pem", &sess_resume, + DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) + goto cleanup; + + /* all the session id's should match for session resumption */ + sess_resume.start_server = 0; + if ((ret = SSL_client_test("Client session resumption #1", + &ssl_ctx, NULL, &sess_resume, + DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) + goto cleanup; + + sess_resume.do_reneg = 1; + if ((ret = SSL_client_test("Client renegotiation", + &ssl_ctx, NULL, &sess_resume, + DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) + goto cleanup; + sess_resume.do_reneg = 0; + + sess_resume.stop_server = 1; + if ((ret = SSL_client_test("Client session resumption #2", + &ssl_ctx, NULL, &sess_resume, + DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) + goto cleanup; + + if ((ret = SSL_client_test("1024 bit key", + &ssl_ctx, + "-cert ssl/test/axTLS.x509_1024.pem " + "-key ssl/test/axTLS.key_1024.pem", NULL, + DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) + goto cleanup; + + if ((ret = SSL_client_test("2048 bit key", + &ssl_ctx, + "-cert ssl/test/axTLS.x509_2048.pem " + "-key ssl/test/axTLS.key_2048.pem", NULL, + DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) + goto cleanup; + + if ((ret = SSL_client_test("4096 bit key", + &ssl_ctx, + "-cert ssl/test/axTLS.x509_4096.pem " + "-key ssl/test/axTLS.key_4096.pem", NULL, + DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) + goto cleanup; + + if ((ret = SSL_client_test("Server cert chaining", + &ssl_ctx, + "-cert ssl/test/axTLS.x509_device.pem " + "-key ssl/test/axTLS.device_key.pem " + "-CAfile ssl/test/axTLS.x509_512.pem", NULL, + DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) + goto cleanup; + + /* Check the server can verify the client */ + if ((ret = SSL_client_test("Client peer authentication", + &ssl_ctx, + "-cert ssl/test/axTLS.x509_2048.pem " + "-key ssl/test/axTLS.key_2048.pem " + "-CAfile ssl/test/axTLS.ca_x509.pem " + "-verify 1 ", NULL, DEFAULT_CLNT_OPTION, + "ssl/test/axTLS.key_1024", NULL, + "ssl/test/axTLS.x509_1024.cer"))) + goto cleanup; + + /* Should get an "ERROR" from openssl (as the handshake fails as soon as + * the certificate verification fails) */ + if ((ret = SSL_client_test("Expired cert (verify now) should fail!", + &ssl_ctx, + "-cert ssl/test/axTLS.x509_bad_after.pem " + "-key ssl/test/axTLS.key_512.pem", NULL, + DEFAULT_CLNT_OPTION, NULL, NULL, NULL)) != + SSL_X509_ERROR(X509_VFY_ERROR_EXPIRED)) + { + printf("*** Error: %d\n", ret); + goto cleanup; + } + + printf("SSL client test \"Expired cert (verify now)\" passed\n"); + ret = 0; + + /* There is no "ERROR" from openssl */ + if ((ret = SSL_client_test("Expired cert (verify later) should fail!", + &ssl_ctx, + "-cert ssl/test/axTLS.x509_bad_after.pem " + "-key ssl/test/axTLS.key_512.pem", NULL, + DEFAULT_CLNT_OPTION|SSL_SERVER_VERIFY_LATER, NULL, + NULL, NULL)) != SSL_X509_ERROR(X509_VFY_ERROR_EXPIRED)) + { + printf("*** Error: %d\n", ret); + goto cleanup; + } + + printf("SSL client test \"Expired cert (verify later)\" passed\n"); + + ret = 0; + +cleanup: + if (ret) + fprintf(stderr, "Error: A client test failed\n"); + + return ret; +} + +#if 0 +/************************************************************************** + * Multi-Threading Tests + * + **************************************************************************/ +#define NUM_THREADS 1 +#define NUM_THREADS_STR "1" + +static SSL *my_ssls[NUM_THREADS*3]; /* enough for all client fds */ + +typedef struct +{ + SSLCTX *ssl_ctx; + int port; + int thread_id; +} multi_t; + +int do_connect(multi_t *multi_data) +{ + int res = 1, client_fd, i; + SSL *ssl = NULL; + char tmp[5]; + + /* make sure other threads work before this one */ + if (multi_data->thread_id == NUM_THREADS) + { + sleep(2); /* sets the maximum time this test will run */ + } + + if ((client_fd = client_socket_init(multi_data->port)) < 0) + goto client_test_exit; + sleep(0); + + ssl = ssl_client_new(multi_data->ssl_ctx, client_fd, NULL); + + if ((res = ssl_handshake_status(ssl))) + goto client_test_exit; + + sprintf(tmp, "%d\n", multi_data->thread_id); + for (i = 0; i < 100; i++) + { + ssl_write(ssl, (uint8_t *)tmp, strlen(tmp)+1); + } + + res = 0; +client_test_exit: + ssl_free(ssl); + close(client_fd); + free(multi_data); + return 0; +} + +int multi_thread_test(void) +{ + int server_fd; + SSLCTX *ssl_server_ctx = NULL; + uint8_t buf[1024]; + pthread_t threads[NUM_THREADS]; + int i, res = 1; + struct sockaddr_in client_addr; + int clnt_len = sizeof(client_addr); + fd_set read_set; + int max_fd; + int death_total = 0; + SSLCTX *ssl_client_ctx = ssl_ctx_new(DEFAULT_CLNT_OPTION, + SSL_DEFAULT_CLNT_SESS, NULL); + + printf("Do multi-threading test (takes a minute)\n"); + + FD_ZERO(&read_set); + + if ((server_fd = server_socket_init(&g_port)) < 0) + goto error; + + FD_SET(server_fd, &read_set); + max_fd = server_fd; + + ssl_server_ctx = ssl_ctx_new(DEFAULT_SVR_OPTION|SSL_SERVER_VERIFY_LATER, + SSL_DEFAULT_SVR_SESS, NULL); + + for (i = 0; i < NUM_THREADS; i++) + { + multi_t *multi_data = (multi_t *)malloc(sizeof(multi_t)); + multi_data->ssl_ctx = ssl_server_ctx; + multi_data->port = g_port; + multi_data->thread_id = i+1; + if (pthread_create(&threads[i], NULL, + (void *(*)(void *))do_connect, (void *)multi_data) < 0) + goto error; + } + + sleep(1); + + for (;;) + { + fd_set rdfs = read_set; + int n; + + if ((n = select(max_fd+1, &rdfs, NULL, NULL, 0)) > 0) + { + while (n) + { + /* check for server */ + if (FD_ISSET(server_fd, &rdfs)) + { + int client_fd = accept(server_fd, + (struct sockaddr *)&client_addr, &clnt_len); + + if (client_fd < 0) + goto error; + + if (client_fd > max_fd) /* set max fd */ + { + max_fd = client_fd; + } + + my_ssls[client_fd] = ssl_server_new( + ssl_server_ctx, client_fd); + FD_SET(client_fd, &read_set); + + if (--n == 0) + continue; + } + + i = server_fd; + + while (++i <= max_fd && n) + { + if (FD_ISSET(i, &rdfs)) + { + SSL *ssl; + ssl = my_ssls[i]; + res = ssl_read(ssl, &read_buf); + n--; + + /* kill the client */ + if (res != SSL_OK) + { + if (res == SSL_ERROR_CONN_LOST) + { + ssl_free(ssl); + my_ssls[i] = NULL; + close(i); + FD_CLR(i, &read_set); + death_total++; + } + else if (res > 0) + { + if (strcmp(NUM_THREADS_STR "\n", + (const char *)buf) == 0) + { + sleep(1); /* allow rest of data */ + goto all_ok; + } + } + else /* some problem */ + { + printf("Got some problem %d\n", res); + goto error; + } + } /* if */ + } /* if */ + } /* for */ + } + } + } + +all_ok: + printf("Multi-thread test passed (%d)\n", death_total); + res = 0; +error: + ssl_ctx_free(ssl_server_ctx); + ssl_ctx_free(ssl_client_ctx); + close(server_fd); + return res; +} +#endif + +/************************************************************************** + * main() + * + **************************************************************************/ +int main(int argc, char *argv[]) +{ + int ret = 1; + BI_CTX *bi_ctx; + int fd; + +#ifdef WIN32 + WSADATA wsaData; + WORD wVersionRequested = MAKEWORD(2, 2); + WSAStartup(wVersionRequested, &wsaData); + fd = _open("test_result.txt", O_WRONLY|O_TEMPORARY|O_CREAT, _S_IWRITE); + dup2(fd, 2); /* write stderr to this file */ +#else + fd = open("/dev/null", O_WRONLY); /* write stderr to /dev/null */ + signal(SIGPIPE, SIG_IGN); /* ignore pipe errors */ + dup2(fd, 2); +#endif + + bi_ctx = bi_initialize(); + + if (AES_test(bi_ctx)) + goto cleanup; + TTY_FLUSH(); + + if (RC4_test(bi_ctx)) + goto cleanup; + TTY_FLUSH(); + + if (MD5_test(bi_ctx)) + goto cleanup; + TTY_FLUSH(); + + if (SHA1_test(bi_ctx)) + goto cleanup; + TTY_FLUSH(); + + if (HMAC_test(bi_ctx)) + goto cleanup; + TTY_FLUSH(); + + if (BIGINT_test(bi_ctx)) + goto cleanup; + TTY_FLUSH(); + + bi_terminate(bi_ctx); + + if (RSA_test()) + goto cleanup; + TTY_FLUSH(); + + if (cert_tests()) + goto cleanup; + TTY_FLUSH(); + + system("sh ssl/test/killopenssl.sh"); + + if (SSL_client_tests()) + goto cleanup; + + system("sh ssl/test/killopenssl.sh"); + + if (SSL_server_tests()) + goto cleanup; + + system("sh ssl/test/killopenssl.sh"); + +#if 0 + if (multi_thread_test()) + goto cleanup; + +#endif + + ret = 0; /* all ok */ +cleanup: + + if (ret) + { + fprintf(stderr, "Error: Some tests failed!\n"); + } + + close(fd); + return ret; +} diff --git a/ssl/test/test_axssl.sh b/ssl/test/test_axssl.sh new file mode 100755 index 0000000000..4a22985fde --- /dev/null +++ b/ssl/test/test_axssl.sh @@ -0,0 +1,117 @@ +#!/bin/sh + +# +# Copyright(C) 2006 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +# +# Test the various axssl bindings +# + +if [ `uname -s` == "Linux" ]; then +# JAVA_BIN=/usr/local/jdk142/bin + JAVA_BIN=/usr/lib/java/bin + KILL_AXSSL="killall axssl" + KILL_CSHARP="killall mono" + KILL_PERL="killall /usr/bin/perl" + RUN_CSHARP="mono" + KILL_JAVA="killall $JAVA_BIN/java" +else + JAVA_BIN="/cygdrive/c/Program Files/Java/jdk1.5.0_06/bin" + KILL_AXSSL="kill %1" + KILL_CSHARP="kill %1" + KILL_PERL="kill %1" + KILL_JAVA="kill %1" +fi + +SERVER_ARGS="s_server -accept 15001 -verify -CAfile ./ssl/test/axTLS.ca_x509.cer" +CLIENT_ARGS="s_client -reconnect -connect localhost:15001 -verify -CAfile ./ssl/test/axTLS.ca_x509.cer -key ./ssl/test/axTLS.key_1024 -cert ./ssl/test/axTLS.x509_1024.cer" + +# check pem arguments +SERVER_PEM_ARGS="s_server -accept 15001 -pass abcd -key ./ssl/test/axTLS.key_aes128.pem -cert ./ssl/test/axTLS.x509_aes128.pem" +CLIENT_PEM_ARGS="s_client -connect localhost:15001 -CAfile ./ssl/test/axTLS.ca_x509.pem -key ./ssl/test/axTLS.key_1024.pem -cert ./ssl/test/axTLS.x509_1024.pem" + +export LD_LIBRARY_PATH=.:`perl -e 'use Config; print $Config{archlib};'`/CORE + +if [ -x ./axssl ]; then +echo "############################# C SAMPLE ###########################" +./axssl $SERVER_ARGS & +echo "C Test passed" | ./axssl $CLIENT_ARGS +$KILL_AXSSL +sleep 1 + +./axssl $SERVER_PEM_ARGS & +echo "C Test passed" | ./axssl $CLIENT_PEM_ARGS +$KILL_AXSSL +sleep 1 +fi + +if [ -f ./axtls.jar ]; then +echo "########################## JAVA SAMPLE ###########################" +"$JAVA_BIN/java" -jar ./axtls.jar $SERVER_ARGS & +echo "Java Test passed" | "$JAVA_BIN/java" -jar ./axtls.jar $CLIENT_ARGS +$KILL_JAVA +sleep 1 + +"$JAVA_BIN/java" -jar ./axtls.jar $SERVER_PEM_ARGS & +echo "Java Test passed" | "$JAVA_BIN/java" -jar ./axtls.jar $CLIENT_PEM_ARGS +$KILL_JAVA +sleep 1 +fi + +if [ -x ./axssl.csharp.exe ]; then +echo "############################ C# SAMPLE ###########################" +$RUN_CSHARP ./axssl.csharp.exe $SERVER_ARGS & +echo "C# Test passed" | $RUN_CSHARP ./axssl.csharp.exe $CLIENT_ARGS +sleep 1 +$KILL_CSHARP +sleep 1 + +$RUN_CSHARP ./axssl.csharp.exe $SERVER_PEM_ARGS & +echo "C# Test passed" | $RUN_CSHARP ./axssl.csharp.exe $CLIENT_PEM_ARGS +sleep 1 +$KILL_CSHARP +sleep 1 +fi + +if [ -x ./axssl.vbnet.exe ]; then +echo "######################## VB.NET SAMPLE ###########################" +./axssl.vbnet $SERVER_ARGS & +sleep 1 +echo "VB.NET Test passed" | ./axssl.vbnet.exe $CLIENT_ARGS +kill %1 +sleep 1 + +./axssl.vbnet $SERVER_PEM_ARGS & +sleep 1 +echo "VB.NET Test passed" | ./axssl.vbnet.exe $CLIENT_PEM_ARGS +kill %1 +sleep 1 +fi + +if [ -f ./axssl.pl ]; then +echo "########################## PERL SAMPLE ###########################" +./axssl.pl $SERVER_ARGS & +echo "Perl Test passed" | ./axssl.pl $CLIENT_ARGS +$KILL_PERL +sleep 1 + +./axssl.pl $SERVER_PEM_ARGS & +echo "Perl Test passed" | ./axssl.pl $CLIENT_PEM_ARGS +$KILL_PERL +sleep 1 +fi diff --git a/ssl/test/thawte.x509_ca b/ssl/test/thawte.x509_ca new file mode 100644 index 0000000000000000000000000000000000000000..59b1059f84086fa580dc1001303c4db4e070e572 GIT binary patch literal 811 zcmXqLVpcb3Vw$jknTe5!iILHOmyJ`a&71aK>;=YaCsSi1!zDAbtnTZF zqUYUebWG~Ec<0FydhNn{8R@BF?(Zc$Os#^xXlJqYTkF3Hd%V7_cb@q7d0SFTnS9@$ z=3Jy0cw_d3^b5OqC$WhXUzvP*x)#Hn7(bppzeI!nd~(UVCFqsMF<)Qz@y}IOZN=N% zf+J3JvhHmb+)-@5ioN%XlkanfxiaQV%!~|-i-ipY4fugEEGx{&_@9N=wue#B(wSB};{CmAjN`|kTB z=H&c*ca+=jgU1BrKYDG@a65VUh*RyJU#lbYu5J(P5PZC(RWiHDX9`CKd5-@#z5p&(TMr~SNx>{S1)iXw~p883_fotvm7>@WOHLUXNt;H*b_ z|IQe^xO{Hv`^QNljGg@tW>o80?|dhoUHjsH8z1xKWBTV_tO(!D#LURRi0nLIbTb3p zWwp-Y-R7SHR;@y@?^|{x`0o6ab&@xk`Ta5fEloQwoG`H15dW%Sy}DTBd%Xlc@q%Y{ zucp0BS^d~*aFB_*;n@8JsUPeY%RtAH{ z9z$*ePB!LH7B*p~&|pJx15pr%OPDV#wJ0+>?aaMVZA(iFv7pk_O@+AubVt#ESf!{1BgDg@B^`tkmQZ zLs0`^kQBEFkD-B)i9%9li9&X2rJZKq+vngJKw%B24vwDh#|p1}Oj&s-uBD8&^V`2V>h0S4MVG149FSHV$nz zVA5n~ViZ#b8D9)EA5X{|$b!sLWf3zFf$3ysgtM3oOkiwAMivbNH3JnG-+-}A0_yzy zjW}s*wZ@|vRs?EpDB*h}q z|Map{+nV0K?8E09vaWbY=u}JU8K^@10Q5pmetJHN9r|U(U@?$MsF{)(m>{%MIgMNe zF3gcp;g*^HXwj|JH%sakW^XY%?K}Ip+slNyvt8M1?Uz`5cz$g&-`l2-@0b62`(fXd z*3a*ARU9g<^p4fEd +#include +#include +#include +#include "ssl.h" + +/* Don't import the default key/certificate if not used */ +#if defined(CONFIG_SSL_USE_DEFAULT_KEY) || defined(CONFIG_SSL_SKELETON_MODE) +#include "cert.h" +#include "private_key.h" +#endif + +/* The session expiry time */ +#define SSL_EXPIRY_TIME (CONFIG_SSL_EXPIRY_TIME*3600) + +static const uint8_t g_hello_request[] = { HS_HELLO_REQUEST, 0, 0, 0 }; +static const uint8_t g_chg_cipher_spec_pkt[] = { 1 }; +static const char * server_finished = "server finished"; +static const char * client_finished = "client finished"; + +static int do_handshake(SSL *ssl, uint8_t *buf, int read_len); +static void set_key_block(SSL *ssl, int is_write); +static int verify_digest(SSL *ssl, int mode, const uint8_t *buf, int read_len); +static void *crypt_new(SSL *ssl, uint8_t *key, uint8_t *iv, int is_decrypt); +static int send_raw_packet(SSL *ssl, uint8_t protocol); + +/** + * The server will pick the cipher based on the order that the order that the + * ciphers are listed. This order is defined at compile time. + */ +#ifdef CONFIG_SSL_SKELETON_MODE +const uint8_t ssl_prot_prefs[NUM_PROTOCOLS] = +{ SSL_RC4_128_SHA }; +#else +static void session_free(SSL_SESS *ssl_sessions[], int sess_index); + +const uint8_t ssl_prot_prefs[NUM_PROTOCOLS] = +#ifdef CONFIG_SSL_PROT_LOW /* low security, fast speed */ +{ SSL_RC4_128_SHA, SSL_AES128_SHA, SSL_AES256_SHA, SSL_RC4_128_MD5 }; +#elif CONFIG_SSL_PROT_MEDIUM /* medium security, medium speed */ +{ SSL_AES128_SHA, SSL_AES256_SHA, SSL_RC4_128_SHA, SSL_RC4_128_MD5 }; +#else /* CONFIG_SSL_PROT_HIGH */ /* high security, low speed */ +{ SSL_AES256_SHA, SSL_AES128_SHA, SSL_RC4_128_SHA, SSL_RC4_128_MD5 }; +#endif +#endif /* CONFIG_SSL_SKELETON_MODE */ + +/** + * The cipher map containing all the essentials for each cipher. + */ +#ifdef CONFIG_SSL_SKELETON_MODE +static const cipher_info_t cipher_info[NUM_PROTOCOLS] = +{ + { /* RC4-SHA */ + SSL_RC4_128_SHA, /* RC4-SHA */ + 16, /* key size */ + 0, /* iv size */ + 2*(SHA1_SIZE+16), /* key block size */ + 0, /* no padding */ + SHA1_SIZE, /* digest size */ + hmac_sha1, /* hmac algorithm */ + (crypt_func)RC4_crypt, /* encrypt */ + (crypt_func)RC4_crypt /* decrypt */ + }, +}; +#else +static const cipher_info_t cipher_info[NUM_PROTOCOLS] = +{ + { /* AES128-SHA */ + SSL_AES128_SHA, /* AES128-SHA */ + 16, /* key size */ + 16, /* iv size */ + 2*(SHA1_SIZE+16+16), /* key block size */ + 16, /* block padding size */ + SHA1_SIZE, /* digest size */ + hmac_sha1, /* hmac algorithm */ + (crypt_func)AES_cbc_encrypt, /* encrypt */ + (crypt_func)AES_cbc_decrypt /* decrypt */ + }, + { /* AES256-SHA */ + SSL_AES256_SHA, /* AES256-SHA */ + 32, /* key size */ + 16, /* iv size */ + 2*(SHA1_SIZE+32+16), /* key block size */ + 16, /* block padding size */ + SHA1_SIZE, /* digest size */ + hmac_sha1, /* hmac algorithm */ + (crypt_func)AES_cbc_encrypt, /* encrypt */ + (crypt_func)AES_cbc_decrypt /* decrypt */ + }, + { /* RC4-SHA */ + SSL_RC4_128_SHA, /* RC4-SHA */ + 16, /* key size */ + 0, /* iv size */ + 2*(SHA1_SIZE+16), /* key block size */ + 0, /* no padding */ + SHA1_SIZE, /* digest size */ + hmac_sha1, /* hmac algorithm */ + (crypt_func)RC4_crypt, /* encrypt */ + (crypt_func)RC4_crypt /* decrypt */ + }, + /* + * This protocol is from SSLv2 days and is unlikely to be used - but was + * useful for testing different possible digest algorithms. + */ + { /* RC4-MD5 */ + SSL_RC4_128_MD5, /* RC4-MD5 */ + 16, /* key size */ + 0, /* iv size */ + 2*(MD5_SIZE+16), /* key block size */ + 0, /* no padding */ + MD5_SIZE, /* digest size */ + hmac_md5, /* hmac algorithm */ + (crypt_func)RC4_crypt, /* encrypt */ + (crypt_func)RC4_crypt /* decrypt */ + }, +}; +#endif + +static void prf(const uint8_t *sec, int sec_len, uint8_t *seed, int seed_len, + uint8_t *out, int olen); +static const cipher_info_t *get_cipher_info(uint8_t cipher); +static void increment_read_sequence(SSL *ssl); +static void increment_write_sequence(SSL *ssl); +static void add_hmac_digest(SSL *ssl, int snd, + const uint8_t *buf, int buf_len, uint8_t *hmac_buf); + +/* win32 VC6.0 doesn't have variadic macros */ +#if defined(WIN32) && !defined(CONFIG_SSL_FULL_MODE) +void DISPLAY_BYTES(SSL *ssl, const char *format, + const uint8_t *data, int size, ...) {} +#endif + +/** + * Establish a new client/server context. + */ +EXP_FUNC SSLCTX *STDCALL ssl_ctx_new(uint32_t options, int num_sessions) +{ + SSLCTX *ssl_ctx = (SSLCTX *)calloc(1, sizeof (SSLCTX)); + ssl_ctx->options = options; +#ifndef CONFIG_SSL_SKELETON_MODE + ssl_ctx->num_sessions = num_sessions; +#endif + +#if defined(CONFIG_SSL_USE_DEFAULT_KEY) || defined(CONFIG_SSL_SKELETON_MODE) + if (~options & SSL_NO_DEFAULT_KEY) + { + ssl_obj_memory_load(ssl_ctx, SSL_OBJ_RSA_KEY, default_private_key, + default_private_key_len, NULL); + ssl_obj_memory_load(ssl_ctx, SSL_OBJ_X509_CERT, + default_certificate, default_certificate_len, NULL); + } +#endif + +#ifndef CONFIG_SSL_SKELETON_MODE + if (num_sessions) + { + ssl_ctx->ssl_sessions = (SSL_SESS **) + calloc(1, num_sessions*sizeof(SSL_SESS *)); + } +#endif + +#ifdef CONFIG_SSL_CERT_VERIFICATION + ssl_ctx->ca_cert_ctx = (CA_CERT_CTX *)calloc(1, sizeof(CA_CERT_CTX)); +#endif + + return ssl_ctx; +} + +/* + * Remove a client/server context. + */ +EXP_FUNC void STDCALL ssl_ctx_free(SSLCTX *ssl_ctx) +{ + SSL *ssl; + int i; + + if (ssl_ctx == NULL) + return; + + ssl = ssl_ctx->sess_head; + + /* clear out all the ssl entries */ + while (ssl) + { + SSL *next = ssl->next; + ssl_free(ssl); + ssl = next; + } + +#ifndef CONFIG_SSL_SKELETON_MODE + /* clear out all the sessions */ + for (i = 0; i < ssl_ctx->num_sessions; i++) + { + session_free(ssl_ctx->ssl_sessions, i); + } + + free(ssl_ctx->ssl_sessions); +#endif + + i = 0; + while (i < CONFIG_SSL_MAX_CERTS && ssl_ctx->certs[i].buf) + { + free(ssl_ctx->certs[i].buf); + ssl_ctx->certs[i++].buf = NULL; + } + +#ifdef CONFIG_SSL_CERT_VERIFICATION + remove_ca_certs(ssl_ctx->ca_cert_ctx); +#endif + ssl_ctx->chain_length = 0; + RSA_free(ssl_ctx->rsa_ctx); + RNG_terminate(); + free(ssl_ctx); +} + +/* + * Free any used resources used by this connection. + */ +EXP_FUNC void STDCALL ssl_free(SSL *ssl) +{ + SSLCTX *ssl_ctx; + + if (ssl == NULL) /* just ignore null pointers */ + return; + + /* spec says we must notify when we are dying */ + send_alert(ssl, SSL_ALERT_CLOSE_NOTIFY); + + ssl_ctx = ssl->ssl_ctx; + + /* adjust the server SSL list */ + if (ssl->prev) + { + ssl->prev->next = ssl->next; + } + else + { + ssl_ctx->sess_head = ssl->next; + } + + if (ssl->next) + { + ssl->next->prev = ssl->prev; + } + else + { + ssl_ctx->sess_tail = ssl->prev; + } + + /* may already be free - but be sure */ + free(ssl->all_pkts); + free(ssl->final_finish_mac); + free(ssl->key_block); + free(ssl->encrypt_ctx); + free(ssl->decrypt_ctx); + free(ssl->master_secret); + buf_free(&ssl->bm_buf); +#ifdef CONFIG_SSL_CERT_VERIFICATION + x509_free(ssl->x509_ctx); +#endif + + free(ssl); +} + +/* + * Read the SSL connection and send any alerts for various errors. + */ +EXP_FUNC int STDCALL ssl_read(SSL *ssl, uint8_t **in_data) +{ + int ret = basic_read(ssl, in_data); + + /* check for return code so we can send an alert */ + if (ret < SSL_OK) + { + if (ret != SSL_ERROR_CONN_LOST) + { + send_alert(ssl, ret); +#ifndef CONFIG_SSL_SKELETON_MODE + /* something nasty happened, so get rid of this session */ + kill_ssl_session(ssl->ssl_ctx->ssl_sessions, ssl); +#endif + } + } + + return ret; +} + +/* + * Write application data to the client + */ +EXP_FUNC int STDCALL ssl_write(SSL *ssl, const uint8_t *out_data, int out_len) +{ + + int ret = send_packet(ssl, PT_APP_PROTOCOL_DATA, out_data, out_len); + + /* make sure there is no problem with overflow due to padding etc */ + if (ret > out_len) + { + ret = out_len; + } + + return ret; +} + +/** + * Add a certificate to the certificate chain. + */ +int add_cert(SSLCTX *ssl_ctx, const uint8_t *buf, int len) +{ + int ret = SSL_ERROR_NO_CERT_DEFINED, i = 0; + SSL_CERT *ssl_cert; + X509_CTX *cert = NULL; + int offset; + + while (ssl_ctx->certs[i].buf && i < CONFIG_SSL_MAX_CERTS) + i++; + + if (i == CONFIG_SSL_MAX_CERTS) /* too many certs */ + { +#ifdef CONFIG_SSL_FULL_MODE + printf("Error: maximum number of certs added - change of " + "compile-time configuration required\n"); +#endif + goto error; + } + + if ((ret = x509_new(buf, &offset, &cert))) + goto error; + + ssl_cert = &ssl_ctx->certs[i]; + ssl_cert->size = len; + ssl_cert->buf = (uint8_t *)malloc(len); + memcpy(ssl_cert->buf, buf, len); + ssl_ctx->chain_length++; + len -= offset; + ret = SSL_OK; /* ok so far */ + + /* recurse? */ + if (len > 0) + { + ret = add_cert(ssl_ctx, &buf[offset], len); + } + +error: + x509_free(cert); /* don't need anymore */ + return ret; +} + +#ifdef CONFIG_SSL_CERT_VERIFICATION +/** + * Add a certificate authority. + */ +int add_cert_auth(SSLCTX *ssl_ctx, const uint8_t *buf, int len) +{ + int ret = SSL_ERROR_NO_CERT_DEFINED; + int i = 0; + int offset; + X509_CTX *cert = NULL; + CA_CERT_CTX *ca_cert_ctx = ssl_ctx->ca_cert_ctx; + + while (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) + i++; + + if (i > CONFIG_X509_MAX_CA_CERTS) + { +#ifdef CONFIG_SSL_FULL_MODE + printf("Error: maximum number of CA certs added - change of " + "compile-time configuration required\n"); +#endif + goto error; + } + + if ((ret = x509_new(buf, &offset, &ca_cert_ctx->cert[i]))) + goto error; + + /* make sure the cert is valid */ + cert = ca_cert_ctx->cert[i]; + if ((ret = x509_verify(ca_cert_ctx, cert))) + { + x509_free(cert); /* get rid of it */ + ca_cert_ctx->cert[i] = NULL; + goto error; + } + + len -= offset; + ret = SSL_OK; /* ok so far */ + + /* recurse? */ + if (len > 0) + { + ret = add_cert_auth(ssl_ctx, &buf[offset], len); + } + +error: + return ret; +} + +/* + * Retrieve an X.509 distinguished name component + */ +EXP_FUNC const char * STDCALL ssl_get_cert_dn(SSL *ssl, int component) +{ + if (ssl->x509_ctx == NULL) + return NULL; + + switch (component) + { + case SSL_X509_CERT_COMMON_NAME: + return ssl->x509_ctx->cert_dn[X509_COMMON_NAME]; + + case SSL_X509_CERT_ORGANIZATION: + return ssl->x509_ctx->cert_dn[X509_ORGANIZATION]; + + case SSL_X509_CERT_ORGANIZATIONAL_NAME: + return ssl->x509_ctx->cert_dn[X509_ORGANIZATIONAL_TYPE]; + + case SSL_X509_CA_CERT_COMMON_NAME: + return ssl->x509_ctx->ca_cert_dn[X509_COMMON_NAME]; + + case SSL_X509_CA_CERT_ORGANIZATION: + return ssl->x509_ctx->ca_cert_dn[X509_ORGANIZATION]; + + case SSL_X509_CA_CERT_ORGANIZATIONAL_NAME: + return ssl->x509_ctx->ca_cert_dn[X509_ORGANIZATIONAL_TYPE]; + + default: + return NULL; + } +} + +#endif + +/* + * Find an ssl object based on the client's file descriptor. + */ +EXP_FUNC SSL * STDCALL ssl_find(SSLCTX *ssl_ctx, int client_fd) +{ + SSL *ssl = ssl_ctx->sess_head; + + /* search through all the ssl entries */ + while (ssl) + { + if (ssl->client_fd == client_fd) + return ssl; + + ssl = ssl->next; + } + + return NULL; +} + +/* + * Force the client to perform its handshake again. + */ +EXP_FUNC int STDCALL ssl_renegotiate(SSL *ssl) +{ + int ret = SSL_OK; + +#ifdef CONFIG_SSL_ENABLE_CLIENT + if (IS_SET_SSL_FLAG(SSL_IS_CLIENT)) + { + ret = do_client_connect(ssl); + } + else +#endif + { + send_packet(ssl, PT_HANDSHAKE_PROTOCOL, + g_hello_request, sizeof(g_hello_request)); + SET_SSL_FLAG(SSL_NEED_RECORD); + } + + return ret; +} + +/** + * @brief Get what we need for key info. + * @param cipher [in] The cipher information we are after + * @param key_size [out] The key size for the cipher + * @param iv_size [out] The iv size for the cipher + * @return The amount of key information we need. + */ +static const cipher_info_t *get_cipher_info(uint8_t cipher) +{ + int i; + + for (i = 0; i < NUM_PROTOCOLS; i++) + { + if (cipher_info[i].cipher == cipher) + { + return &cipher_info[i]; + } + } + + return NULL; /* error */ +} + +/* + * Get a new ssl context for a new connection. + */ +SSL *ssl_new(SSLCTX *ssl_ctx, int client_fd) +{ + SSL *ssl = (SSL *)calloc(1, sizeof(SSL)); + ssl->ssl_ctx = ssl_ctx; + ssl->need_bytes = SSL_RECORD_SIZE; /* need a record */ + ssl->bm_buf = buf_new(); + ssl->client_fd = client_fd; + ssl->flag = SSL_NEED_RECORD; + ssl->certs = ssl_ctx->certs; + ssl->chain_length = ssl_ctx->chain_length; +#ifdef CONFIG_ENABLE_VERIFICATION + ssl->ca_cert_ctx = ssl_ctx->ca_cert_ctx; +#endif + + /* a bit hacky but saves a few bytes of memory */ + ssl->flag |= ssl_ctx->options; + + /* build up a linked list, so we can remove it all later */ + if (ssl_ctx->sess_head == NULL) + { + ssl_ctx->sess_head = ssl; + ssl_ctx->sess_tail = ssl; + } + else + { + ssl->prev = ssl_ctx->sess_tail; + ssl_ctx->sess_tail->next = ssl; + ssl_ctx->sess_tail = ssl; + } + + return ssl; +} + +/* + * Add a private key to a context. + */ +int add_private_key(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj) +{ + int ret = SSL_OK; + + /* get the private key details */ + if (asn1_get_private_key(ssl_obj->buf, ssl_obj->len, &ssl_ctx->rsa_ctx)) + { + ret = SSL_ERROR_INVALID_KEY; + goto error; + } + +error: + return ret; +} + +/** + * Increment the read sequence number (as a 64 bit endian indepenent #) + */ +static void increment_read_sequence(SSL *ssl) +{ + int i; + + for (i = 7; i >= 0; i--) + { + if (++ssl->read_sequence[i]) + break; + } +} + +/** + * Increment the read sequence number (as a 64 bit endian indepenent #) + */ +static void increment_write_sequence(SSL *ssl) +{ + int i; + + for (i = 7; i >= 0; i--) + { + if (++ssl->write_sequence[i]) + break; + } +} +/** + * Work out the HMAC digest in a packet. + */ +static void add_hmac_digest(SSL *ssl, int mode, + const uint8_t *buf, int buf_len, uint8_t *hmac_buf) +{ + int hmac_len = buf_len + 8 + SSL_RECORD_SIZE; + uint8_t *t_buf = (uint8_t *)malloc(hmac_len); + uint8_t *t_ptr = t_buf; + + memcpy(t_buf, (mode == SSL_SERVER_WRITE || mode == SSL_CLIENT_WRITE) ? + ssl->write_sequence : ssl->read_sequence, 8); + t_buf += 8; + + memcpy(t_buf, ssl->record_buf, SSL_RECORD_SIZE); + t_buf += SSL_RECORD_SIZE; + + memcpy(t_buf, buf, buf_len); + + ssl->cipher_info->hmac(t_ptr, hmac_len, + (mode == SSL_SERVER_WRITE || mode == SSL_CLIENT_READ) ? + ssl->server_mac : ssl->client_mac, + ssl->cipher_info->digest_size, hmac_buf); + +#if 0 + print_blob("record", ssl->record_buf, SSL_RECORD_SIZE); + print_blob("buf", buf, buf_len); + if (mode == SSL_SERVER_WRITE || mode == SSL_CLIENT_WRITE) + { + print_blob("write seq", ssl->write_sequence, 8); + } + else + { + print_blob("read seq", ssl->read_sequence, 8); + } + + if (mode == SSL_SERVER_WRITE || mode == SSL_CLIENT_READ) + { + print_blob("server mac", + ssl->server_mac, ssl->cipher_info->digest_size); + } + else + { + print_blob("client mac", + ssl->client_mac, ssl->cipher_info->digest_size); + } + print_blob("hmac", hmac_buf, SHA1_SIZE); +#endif + + free(t_ptr); +} + +/** + * Verify that the digest of a packet is correct. + */ +static int verify_digest(SSL *ssl, int mode, const uint8_t *buf, int read_len) +{ + unsigned char hmac_buf[SHA1_SIZE]; + int hmac_offset; + + if (ssl->cipher_info->padding_size) + { + hmac_offset = read_len-buf[read_len-1]-ssl->cipher_info->digest_size-1; + } + else + { + hmac_offset = read_len - ssl->cipher_info->digest_size; + } + + /* sanity check the offset */ + if (hmac_offset < 0) + { + return SSL_ERROR_INVALID_HMAC; + } + + ssl->record_buf[3] = hmac_offset >> 8; /* insert size */ + ssl->record_buf[4] = hmac_offset & 0xff; + + add_hmac_digest(ssl, mode, buf, hmac_offset, hmac_buf); + + if (memcmp(hmac_buf, &buf[hmac_offset], ssl->cipher_info->digest_size)) + { + return SSL_ERROR_INVALID_HMAC; + } + + return hmac_offset; +} + +/** + * Add a packet to the end of our sent and received packets, so that we may use + * it to calculate the hash at the end. + */ +void add_packet(SSL *ssl, const uint8_t *pkt, int len) +{ + int new_len = ssl->all_pkts_len + len; + ssl->all_pkts = (uint8_t *)realloc(ssl->all_pkts, new_len); + memcpy(&ssl->all_pkts[ssl->all_pkts_len], pkt, len); + ssl->all_pkts_len = new_len; +} + +/** + * Work out the MD5 PRF. + */ +static void p_hash_md5(const uint8_t *sec, int sec_len, + uint8_t *seed, int seed_len, uint8_t *out, int olen) +{ + uint8_t a1[128]; + + /* A(1) */ + hmac_md5(seed, seed_len, sec, sec_len, a1); + memcpy(&a1[MD5_SIZE], seed, seed_len); + hmac_md5(a1, MD5_SIZE+seed_len, sec, sec_len, out); + + while (olen > MD5_SIZE) + { + uint8_t a2[MD5_SIZE]; + out += MD5_SIZE; + olen -= MD5_SIZE; + + /* A(N) */ + hmac_md5(a1, MD5_SIZE, sec, sec_len, a2); + memcpy(a1, a2, MD5_SIZE); + + /* work out the actual hash */ + hmac_md5(a1, MD5_SIZE+seed_len, sec, sec_len, out); + } +} + +/** + * Work out the SHA1 PRF. + */ +static void p_hash_sha1(const uint8_t *sec, int sec_len, + uint8_t *seed, int seed_len, uint8_t *out, int olen) +{ + uint8_t a1[128]; + + /* A(1) */ + hmac_sha1(seed, seed_len, sec, sec_len, a1); + memcpy(&a1[SHA1_SIZE], seed, seed_len); + hmac_sha1(a1, SHA1_SIZE+seed_len, sec, sec_len, out); + + while (olen > SHA1_SIZE) + { + uint8_t a2[SHA1_SIZE]; + out += SHA1_SIZE; + olen -= SHA1_SIZE; + + /* A(N) */ + hmac_sha1(a1, SHA1_SIZE, sec, sec_len, a2); + memcpy(a1, a2, SHA1_SIZE); + + /* work out the actual hash */ + hmac_sha1(a1, SHA1_SIZE+seed_len, sec, sec_len, out); + } +} + +/** + * Work out the PRF. + */ +static void prf(const uint8_t *sec, int sec_len, uint8_t *seed, int seed_len, + uint8_t *out, int olen) +{ + int len, i; + const uint8_t *S1, *S2; + uint8_t xbuf[256]; /* needs to be > the amount of key data */ + uint8_t ybuf[256]; /* needs to be > the amount of key data */ + + len = sec_len/2; + S1 = sec; + S2 = &sec[len]; + len += (sec_len&1); /* add for odd, make longer */ + + p_hash_md5(S1, len, seed, seed_len, xbuf, olen); + p_hash_sha1(S2, len, seed, seed_len, ybuf, olen); + + for (i=0; i < olen; i++) + out[i] = xbuf[i] ^ ybuf[i]; +} + +/** + * Generate a master secret based on the client/server random data and the + * premaster secret. + */ +void generate_master_secret(SSL *ssl, const uint8_t *premaster_secret) +{ + uint8_t buf[128]; /* needs to be > 13+32+32 in size */ + strcpy((char *)buf, "master secret"); + memcpy(&buf[13], ssl->client_random, SSL_RANDOM_SIZE); + memcpy(&buf[45], ssl->server_random, SSL_RANDOM_SIZE); + ssl->master_secret = (uint8_t *)malloc(SSL_SECRET_SIZE); + prf(premaster_secret, SSL_SECRET_SIZE, buf, 77, ssl->master_secret, + SSL_SECRET_SIZE); +} + +/** + * Generate a 'random' blob of data used for the generation of keys. + */ +static void generate_key_block(uint8_t *client_random, uint8_t *server_random, + uint8_t *master_secret, uint8_t *key_block, int key_block_size) +{ + uint8_t buf[128]; + strcpy((char *)buf, "key expansion"); + memcpy(&buf[13], server_random, SSL_RANDOM_SIZE); + memcpy(&buf[45], client_random, SSL_RANDOM_SIZE); + prf(master_secret, SSL_SECRET_SIZE, buf, 77, key_block, key_block_size); +} + +/** + * Calculate the digest used in the finished message. This function also + * doubles up as a certificate verify function. + */ +void finished_digest(SSL *ssl, const char *label, uint8_t *digest) +{ + unsigned char mac_buf[128]; + unsigned char *q = mac_buf; + MD5_CTX md5_ctx; + SHA1_CTX sha1_ctx; + + if (label) + { + strcpy((char *)q, label); + q += strlen(label); + } + + MD5Init(&md5_ctx); + MD5Update(&md5_ctx, ssl->all_pkts, ssl->all_pkts_len); + MD5Final(&md5_ctx, q); + q += MD5_SIZE; + + SHA1Init(&sha1_ctx); + SHA1Update(&sha1_ctx, ssl->all_pkts, ssl->all_pkts_len); + SHA1Final(&sha1_ctx, q); + q += SHA1_SIZE; + + if (label) + { + prf(ssl->master_secret, SSL_SECRET_SIZE, mac_buf, (int)(q-mac_buf), + digest, SSL_FINISHED_HASH_SIZE); + } + else /* for use in a certificate verify */ + { + memcpy(digest, mac_buf, MD5_SIZE + SHA1_SIZE); + } +#if 0 + printf("label: %s\n", label); + print_blob("master secret", ssl->master_secret, 48); + print_blob("mac_buf", mac_buf, q-mac_buf); + print_blob("finished digest", digest, SSL_FINISHED_HASH_SIZE); +#endif +} + +/** + * Retrieve (and initialise) the context of a cipher. + */ +static void *crypt_new(SSL *ssl, uint8_t *key, uint8_t *iv, int is_decrypt) +{ + switch (ssl->cipher) + { +#ifndef CONFIG_SSL_SKELETON_MODE + case SSL_AES128_SHA: + { + AES_CTX *aes_ctx = (AES_CTX *)malloc(sizeof(AES_CTX)); + AES_set_key(aes_ctx, key, iv, AES_MODE_128); + + if (is_decrypt) + { + AES_convert_key(aes_ctx); + } + + return (void *)aes_ctx; + } + + case SSL_AES256_SHA: + { + AES_CTX *aes_ctx = (AES_CTX *)malloc(sizeof(AES_CTX)); + AES_set_key(aes_ctx, key, iv, AES_MODE_256); + + if (is_decrypt) + { + AES_convert_key(aes_ctx); + } + + return (void *)aes_ctx; + } + break; + + case SSL_RC4_128_MD5: +#endif + case SSL_RC4_128_SHA: + { + RC4_CTX *rc4_ctx = (RC4_CTX *)malloc(sizeof(RC4_CTX)); + RC4_setup(rc4_ctx, key, 16); + return (void *)rc4_ctx; + } + break; + } + + return NULL; /* its all gone wrong */ +} + +/** + * Send a packet over the socket. + */ +static int send_raw_packet(SSL *ssl, uint8_t protocol) +{ + uint8_t rec_buf[SSL_RECORD_SIZE]; + int ret; + + rec_buf[0] = protocol; + rec_buf[1] = 0x03; /* version = 3.1 (TLS) */ + rec_buf[2] = 0x01; + rec_buf[3] = ssl->bm_buf.index >> 8; + rec_buf[4] = ssl->bm_buf.index & 0xff; + + DISPLAY_BYTES(ssl, "sending %d bytes", rec_buf, 5, 5); + DISPLAY_BYTES(ssl, "sending %d bytes", ssl->bm_buf.data, + ssl->bm_buf.index, ssl->bm_buf.index); + + /* 2 system calls, but what the hell it makes life a lot simpler */ + ret = SOCKET_WRITE(ssl->client_fd, rec_buf, SSL_RECORD_SIZE); + + if (ret > 0) + { + ret = SOCKET_WRITE(ssl->client_fd, ssl->bm_buf.data, ssl->bm_buf.index); + } + + SET_SSL_FLAG(SSL_NEED_RECORD); /* reset for next time */ + ssl->bm_buf.index = 0; + + if (ret < 0) + { + ret = SSL_ERROR_CONN_LOST; + } + else if (protocol != PT_APP_PROTOCOL_DATA) + { + /* always return SSL_OK during handshake */ + return ret = SSL_OK; + } + + return ret; +} + +/** + * Send an encrypted packet with padding bytes if necessary. + */ +int send_packet(SSL *ssl, uint8_t protocol, const uint8_t *in, int length) +{ + int msg_length = length; + ssl->bm_buf.index = msg_length; + buf_grow(&ssl->bm_buf, msg_length+32); + + /* if our state is bad, don't bother */ + if (ssl->hs_status == SSL_ERROR_DEAD) + { + return SSL_ERROR_CONN_LOST; + } + + if (in) /* has the buffer already been initialised? */ + { + memcpy(ssl->bm_buf.data, in, length); + } + + if (IS_SET_SSL_FLAG(SSL_TX_ENCRYPTED)) + { + int mode = IS_SET_SSL_FLAG(SSL_IS_CLIENT) ? + SSL_CLIENT_WRITE : SSL_SERVER_WRITE; + ssl->record_buf[0] = protocol; + ssl->record_buf[3] = length >> 8; + ssl->record_buf[4] = length & 0xff; + + if (protocol == PT_HANDSHAKE_PROTOCOL) + { + DISPLAY_STATE(ssl, 1, ssl->bm_buf.data[0], 0); + + if (ssl->bm_buf.data[0] != HS_HELLO_REQUEST) + { + add_packet(ssl, ssl->bm_buf.data, ssl->bm_buf.index); + } + } + + /* add the packet digest */ + msg_length += ssl->cipher_info->digest_size; + ssl->bm_buf.index = msg_length; + + add_hmac_digest(ssl, mode, ssl->bm_buf.data, length, + &ssl->bm_buf.data[length]); + + /* add padding? */ + if (ssl->cipher_info->padding_size) + { + int last_blk_size = msg_length%ssl->cipher_info->padding_size; + int pad_bytes = ssl->cipher_info->padding_size - last_blk_size; + + /* ensure we always have at least 1 padding byte */ + if (pad_bytes == 0) + { + pad_bytes += ssl->cipher_info->padding_size; + } + + memset(&ssl->bm_buf.data[msg_length], pad_bytes-1, pad_bytes); + msg_length += pad_bytes; + ssl->bm_buf.index = msg_length; + } + + DISPLAY_BYTES(ssl, "unencrypted write", ssl->bm_buf.data, msg_length); + increment_write_sequence(ssl); + + /* now encrypt the packet */ + ssl->cipher_info->encrypt(ssl->encrypt_ctx, ssl->bm_buf.data, + ssl->bm_buf.data, msg_length); + } + else if (protocol == PT_HANDSHAKE_PROTOCOL) + { + DISPLAY_STATE(ssl, 1, ssl->bm_buf.data[0], 0); + + if (ssl->bm_buf.data[0] != HS_HELLO_REQUEST) + { + add_packet(ssl, ssl->bm_buf.data, ssl->bm_buf.index); + } + } + + return send_raw_packet(ssl, protocol); +} + +/** + * Work out the cipher keys we are going to use for this session based on the + * master secret. + */ +static void set_key_block(SSL *ssl, int is_write) +{ + const cipher_info_t *ciph_info = get_cipher_info(ssl->cipher); + uint8_t *q; + uint8_t client_key[32], server_key[32]; /* big enough for AES256 */ + uint8_t client_iv[16], server_iv[16]; /* big enough for AES128/256 */ + int is_client = IS_SET_SSL_FLAG(SSL_IS_CLIENT); + int key_block_existed = 1; + + /* only do once in a handshake */ + if (ssl->key_block == NULL) + { + ssl->key_block = (uint8_t *)malloc(ciph_info->key_block_size); + +#if 0 + print_blob("client", ssl->client_random, 32); + print_blob("server", ssl->server_random, 32); + print_blob("master", ssl->master_secret, SSL_SECRET_SIZE); +#endif + generate_key_block(ssl->client_random, ssl->server_random, + ssl->master_secret, ssl->key_block, ciph_info->key_block_size); +#if 0 + print_blob("keyblock", ssl->key_block, ciph_info->key_block_size); +#endif + key_block_existed = 0; + } + + q = ssl->key_block; + + if ((is_client && is_write) || (!is_client && !is_write)) + { + memcpy(ssl->client_mac, q, ciph_info->digest_size); + } + + q += ciph_info->digest_size; + + if ((!is_client && is_write) || (is_client && !is_write)) + { + memcpy(ssl->server_mac, q, ciph_info->digest_size); + } + + q += ciph_info->digest_size; + memcpy(client_key, q, ciph_info->key_size); + q += ciph_info->key_size; + memcpy(server_key, q, ciph_info->key_size); + q += ciph_info->key_size; + +#ifndef CONFIG_SSL_SKELETON_MODE /* RC4 has no IV */ + if (ciph_info->iv_size) + { + memcpy(client_iv, q, ciph_info->iv_size); + q += ciph_info->iv_size; + memcpy(server_iv, q, ciph_info->iv_size); + q += ciph_info->iv_size; + } +#endif + + free(is_write ? ssl->encrypt_ctx : ssl->decrypt_ctx); + + if (ssl->final_finish_mac == NULL) + { + ssl->final_finish_mac = (uint8_t *)malloc(SSL_FINISHED_HASH_SIZE); + } + + /* now initialise the ciphers */ + if (is_client) + { + finished_digest(ssl, server_finished, ssl->final_finish_mac); + + if (is_write) + ssl->encrypt_ctx = crypt_new(ssl, client_key, client_iv, 0); + else + ssl->decrypt_ctx = crypt_new(ssl, server_key, server_iv, 1); + } + else + { + finished_digest(ssl, client_finished, ssl->final_finish_mac); + + if (is_write) + ssl->encrypt_ctx = crypt_new(ssl, server_key, server_iv, 0); + else + ssl->decrypt_ctx = crypt_new(ssl, client_key, client_iv, 1); + } + + ssl->cipher_info = ciph_info; + + /* clean up if possible */ + if (key_block_existed) + { + free(ssl->key_block); + ssl->key_block = NULL; + } +} + +/** + * Read the SSL connection. + */ +int basic_read(SSL *ssl, uint8_t **in_data) +{ + int ret = SSL_OK, version = -1; + int read_len, is_record; + uint8_t *buf = ssl->bm_buf.data; + int is_client = IS_SET_SSL_FLAG(SSL_IS_CLIENT); + + read_len = SOCKET_READ(ssl->client_fd, &buf[ssl->bm_buf.index], + ssl->need_bytes-ssl->got_bytes); + + /* connection has gone, so die */ + if (read_len <= 0) + { + ret = SSL_ERROR_CONN_LOST; + ssl->hs_status = SSL_ERROR_DEAD; /* make sure it stays dead */ + goto error; + } + + DISPLAY_BYTES(ssl, "received %d bytes", + &ssl->bm_buf.data[ssl->bm_buf.index], read_len, read_len); + + ssl->got_bytes += read_len; + ssl->bm_buf.index += read_len; + + /* haven't quite got what we want, so try again later */ + if (ssl->got_bytes < ssl->need_bytes) + { + return SSL_OK; + } + + ssl->got_bytes = 0; + + if (IS_SET_SSL_FLAG(SSL_NEED_RECORD)) + { + /* check for sslv2 "client hello" TODO: this shouldn't be here. */ + if (buf[0] & 0x80 && buf[2] == 1 && buf[3] == 0x03) + { +#ifdef CONFIG_SSL_ENABLE_V23_HANDSHAKE + DISPLAY_BYTES(ssl, "ssl2 record", buf, 5); + add_packet(ssl, &buf[2], 3); + ret = process_sslv23_client_hello(ssl); +#else + printf("Error: no SSLv23 handshaking allowed\n"); + TTY_FLUSH(); + ret = SSL_ERROR_NOT_SUPPORTED; +#endif + goto error; /* not an error - just get out of here */ + } + + version = (buf[1] << 4) + buf[2]; + ssl->need_bytes = (buf[3] << 8) + buf[4]; + + /* should be 3.1 (TLSv1) */ + if (version != 0x31) + { + /* if we are talking to a client that talks v3.2, then we'll wear + * it - we'll respond in v3.1 mode anyway. */ + if (version < 0x31 || !IS_SET_SSL_FLAG(SSL_IS_CLIENT)) + { + ret = SSL_ERROR_INVALID_VERSION; + ssl_display_error(ret); + goto error; + } + } + + CLR_SSL_FLAG(SSL_NEED_RECORD); + memcpy(ssl->record_buf, buf, 3); /* store for hmac */ + is_record = 1; + } + else + { + SET_SSL_FLAG(SSL_NEED_RECORD); + ssl->need_bytes = SSL_RECORD_SIZE; + is_record = 0; + } + + if (is_record) + { + ssl->record_type = buf[0]; + } + else if (IS_SET_SSL_FLAG(SSL_RX_ENCRYPTED)) + { + ssl->cipher_info->decrypt(ssl->decrypt_ctx, buf, buf, read_len); + read_len = verify_digest(ssl, + is_client ? SSL_CLIENT_READ : SSL_SERVER_READ, buf, read_len); + + /* does the hmac work? */ + if (read_len < 0) + { + ret = read_len; + goto error; + } + + DISPLAY_BYTES(ssl, "decrypted", buf, read_len); + increment_read_sequence(ssl); + } + + /* The main part of the SSL packet */ + if (!is_record) + { + switch (ssl->record_type) + { + case PT_HANDSHAKE_PROTOCOL: + ret = do_handshake(ssl, buf, read_len); + break; + + case PT_CHANGE_CIPHER_SPEC: + if (ssl->next_state != HS_FINISHED) + { + ret = SSL_ERROR_INVALID_HANDSHAKE; + goto error; + } + + SET_SSL_FLAG(SSL_RX_ENCRYPTED); + set_key_block(ssl, 0); + memset(ssl->read_sequence, 0, 8); + break; + + case PT_APP_PROTOCOL_DATA: + *in_data = ssl->bm_buf.data; /* point to the work buffer */ + (*in_data)[read_len] = 0; /* null terminate just in case */ + ret = read_len; + break; + + case PT_ALERT_PROTOCOL: + /* return the alert # with alert bit set */ + ret = -buf[1]; + DISPLAY_ALERT(ssl, buf[1]); + break; + + default: + ret = SSL_ERROR_INVALID_PROT_MSG; + break; + } + } + +error: + ssl->bm_buf.index = 0; /* reset to go again */ + + if (ret < SSL_OK && in_data) /* if all wrong, then clear this buffer ptr */ + { + *in_data = NULL; + } + + return ret; +} + +/** + * Do some basic checking of data and then perform the appropriate handshaking. + */ +static int do_handshake(SSL *ssl, uint8_t *buf, int read_len) +{ + int hs_len = (buf[2]<<8) + buf[3]; + uint8_t handshake_type = buf[0]; + int ret = SSL_OK; + int is_client = IS_SET_SSL_FLAG(SSL_IS_CLIENT); + + /* some integrity checking on the handshake */ + PARANOIA_CHECK(read_len-SSL_HS_HDR_SIZE, hs_len); + + if (handshake_type != ssl->next_state) + { + /* handle a special case on the client */ + if (!is_client || handshake_type != HS_CERT_REQ || + ssl->next_state != HS_SERVER_HELLO_DONE) + { + ret = SSL_ERROR_INVALID_HANDSHAKE; + goto error; + } + } + + hs_len += SSL_HS_HDR_SIZE; /* adjust for when adding packets */ + ssl->bm_buf.index = hs_len; /* store the size and check later */ + DISPLAY_STATE(ssl, 0, handshake_type, 0); + + if (handshake_type != HS_CERT_VERIFY && + handshake_type != HS_HELLO_REQUEST) + { + add_packet(ssl, buf, hs_len); + } + +#if defined(CONFIG_SSL_ENABLE_CLIENT) + ret = is_client ? + do_clnt_handshake(ssl, handshake_type, buf, hs_len) : + do_svr_handshake(ssl, handshake_type, buf, hs_len); +#else + ret = do_svr_handshake(ssl, handshake_type, buf, hs_len); +#endif + + /* just use recursion to get the rest */ + if (hs_len < read_len && ret == SSL_OK) + { + ret = do_handshake(ssl, &buf[hs_len], read_len-hs_len); + } + +error: + return ret; +} + +/** + * Sends the change cipher spec message. We have just read a finished message + * from the client. + */ +int send_change_cipher_spec(SSL *ssl) +{ + int ret = send_packet(ssl, PT_CHANGE_CIPHER_SPEC, + g_chg_cipher_spec_pkt, sizeof(g_chg_cipher_spec_pkt)); + SET_SSL_FLAG(SSL_TX_ENCRYPTED); + set_key_block(ssl, 1); + memset(ssl->write_sequence, 0, 8); + return ret; +} + +/** + * Send a "finished" message + */ +int send_finished(SSL *ssl) +{ + uint8_t *buf = ssl->bm_buf.data; + + buf[0] = HS_FINISHED; + buf[1] = 0; + buf[2] = 0; + buf[3] = SSL_FINISHED_HASH_SIZE; + + /* now add the finished digest mac (12 bytes) */ + finished_digest(ssl, + IS_SET_SSL_FLAG(SSL_IS_CLIENT) ? + client_finished : server_finished, &buf[4]); + +#ifndef CONFIG_SSL_SKELETON_MODE + /* store in the session cache */ + if (!IS_SET_SSL_FLAG(SSL_SESSION_RESUME) && ssl->ssl_ctx->num_sessions) + { + memcpy(ssl->session->master_secret, + ssl->master_secret, SSL_SECRET_SIZE); + } +#endif + + return send_packet(ssl, PT_HANDSHAKE_PROTOCOL, + NULL, SSL_FINISHED_HASH_SIZE+4); +} + +/** + * Send an alert message. + * Return 1 if the alert was an "error". + */ +int send_alert(SSL *ssl, int error_code) +{ + int alert_num = 0; + int is_warning = 0; + uint8_t buf[2]; + + /* Don't bother we're already dead */ + if (ssl->hs_status == SSL_ERROR_DEAD) + { + return SSL_ERROR_CONN_LOST; + } + +#ifdef CONFIG_SSL_FULL_MODE + if (IS_SET_SSL_FLAG(SSL_DISPLAY_STATES)) + { + ssl_display_error(error_code); + } +#endif + + switch (error_code) + { + case SSL_ALERT_CLOSE_NOTIFY: + is_warning = 1; + alert_num = SSL_ALERT_CLOSE_NOTIFY; + break; + + case SSL_ERROR_CONN_LOST: /* don't send alert just yet */ + is_warning = 1; + break; + + case SSL_ERROR_INVALID_HANDSHAKE: + case SSL_ERROR_INVALID_PROT_MSG: + alert_num = SSL_ALERT_HANDSHAKE_FAILURE; + break; + + case SSL_ERROR_INVALID_HMAC: + case SSL_ERROR_FINISHED_INVALID: + alert_num = SSL_ALERT_BAD_RECORD_MAC; + break; + + case SSL_ERROR_INVALID_VERSION: + alert_num = SSL_ALERT_INVALID_VERSION; + break; + + case SSL_ERROR_INVALID_SESSION: + case SSL_ERROR_NO_CIPHER: + case SSL_ERROR_INVALID_KEY: + alert_num = SSL_ALERT_ILLEGAL_PARAMETER; + break; + + case SSL_ERROR_BAD_CERTIFICATE: + alert_num = SSL_ALERT_BAD_CERTIFICATE; + break; + + default: + /* a catch-all for any badly verified certificates */ + alert_num = (error_code <= SSL_X509_OFFSET) ? + SSL_ALERT_BAD_CERTIFICATE : SSL_ALERT_UNEXPECTED_MESSAGE; + break; + } + + buf[0] = is_warning ? 1 : 2; + buf[1] = alert_num; + + send_packet(ssl, PT_ALERT_PROTOCOL, buf, sizeof(buf)); + DISPLAY_ALERT(ssl, alert_num); + return is_warning ? 0 : 1; +} + +/** + * Process a client finished message. + */ +int process_finished(SSL *ssl, int hs_len) +{ + uint8_t *buf = ssl->bm_buf.data; + int ret = SSL_OK; + int is_client = IS_SET_SSL_FLAG(SSL_IS_CLIENT); + int resume = IS_SET_SSL_FLAG(SSL_SESSION_RESUME); + + PARANOIA_CHECK(ssl->bm_buf.index, SSL_FINISHED_HASH_SIZE+4); + + /* check that we all work before we continue */ + if (memcmp(ssl->final_finish_mac, &buf[4], SSL_FINISHED_HASH_SIZE)) + { + return SSL_ERROR_FINISHED_INVALID; + } + + if ((!is_client && !resume) || (is_client && resume)) + { + if ((ret = send_change_cipher_spec(ssl)) == SSL_OK) + { + ret = send_finished(ssl); + } + } + + /* Don't need this stuff anymore */ + free(ssl->all_pkts); + ssl->all_pkts = NULL; + ssl->all_pkts_len = 0; + + free(ssl->master_secret); + ssl->master_secret = NULL; + + free(ssl->final_finish_mac); + ssl->final_finish_mac = NULL; + + /* if we ever renegotiate */ + ssl->next_state = is_client ? HS_HELLO_REQUEST : HS_CLIENT_HELLO; + ssl->hs_status = ret; /* set the final handshake status */ + +error: + return ret; +} + +/** + * Send a certificate. + */ +int send_certificate(SSL *ssl) +{ + int i = 0; + uint8_t *buf = ssl->bm_buf.data; + int offset = 7; + int chain_length; + + buf[0] = HS_CERTIFICATE; + buf[1] = 0; + buf[4] = 0; + buf[7] = 0; + + while (i < ssl->chain_length) + { + SSL_CERT *cert = &ssl->certs[i]; + buf[offset++] = 0; + buf[offset++] = cert->size >> 8; /* cert 1 length */ + buf[offset++] = cert->size & 0xff; + buf_grow(&ssl->bm_buf, offset + cert->size); + memcpy(&buf[offset], cert->buf, cert->size); + offset += cert->size; + i++; + } + + chain_length = offset - 7; + buf[5] = chain_length >> 8; /* cert chain length */ + buf[6] = chain_length & 0xff; + chain_length += 3; + buf[2] = chain_length >> 8; /* handshake length */ + buf[3] = chain_length & 0xff; + + ssl->bm_buf.index = offset; + return send_packet(ssl, PT_HANDSHAKE_PROTOCOL, NULL, offset); +} + +#ifndef CONFIG_SSL_SKELETON_MODE /* no session resumption in this mode */ +/** + * Find if an existing session has the same session id. If so, use the + * master secret from this session for session resumption. + */ +SSL_SESS *ssl_session_update(int max_sessions, + SSL_SESS *ssl_sessions[], SSL *ssl, + const uint8_t *session_id) +{ + time_t tm = time(NULL); + time_t oldest_sess_time = tm; + SSL_SESS *oldest_sess = NULL; + int i; + + /* no sessions? Then bail */ + if (max_sessions == 0) + { + return NULL; + } + + if (session_id) + { + for (i = 0; i < max_sessions; i++) + { + if (ssl_sessions[i]) + { + /* kill off any expired sessions */ + if (tm > ssl_sessions[i]->conn_time + SSL_EXPIRY_TIME) + { + session_free(ssl_sessions, i); + continue; + } + + /* if the session id matches, it must still be less than + the expiry time */ + if (memcmp(ssl_sessions[i]->session_id, session_id, + SSL_SESSION_ID_SIZE) == 0) + { + ssl->master_secret = (uint8_t *)malloc(SSL_SECRET_SIZE); + ssl->session_index = i; + memcpy(ssl->master_secret, + ssl_sessions[i]->master_secret, SSL_SECRET_SIZE); + SET_SSL_FLAG(SSL_SESSION_RESUME); + return ssl_sessions[i]; /* a session was found */ + } + } + } + } + + /* If we've got here, no matching session was found - so create one */ + for (i = 0; i < max_sessions; i++) + { + if (ssl_sessions[i] == NULL) + { + /* perfect, this will do */ + ssl_sessions[i] = (SSL_SESS *)calloc(1, sizeof(SSL_SESS)); + ssl_sessions[i]->conn_time = tm; + ssl->session_index = i; + return ssl_sessions[i]; /* return the session object */ + } + else if (ssl_sessions[i]->conn_time < oldest_sess_time) + { + /* find the oldest session */ + oldest_sess_time = ssl_sessions[i]->conn_time; + oldest_sess = ssl_sessions[i]; + ssl->session_index = i; + } + } + + /* ok, we've used up all of our sessions. So blow the oldest session away */ + oldest_sess->conn_time = tm; + memset(oldest_sess->session_id, 0, sizeof(SSL_SESSION_ID_SIZE)); + memset(oldest_sess->master_secret, 0, sizeof(SSL_SECRET_SIZE)); + return oldest_sess; +} + +/** + * Free an existing session. + */ +static void session_free(SSL_SESS *ssl_sessions[], int sess_index) +{ + if (ssl_sessions[sess_index]) + { + free(ssl_sessions[sess_index]); + ssl_sessions[sess_index] = NULL; + } +} + +/** + * This ssl object doesn't want this session anymore. + */ +void kill_ssl_session(SSL_SESS **ssl_sessions, SSL *ssl) +{ + if (ssl->ssl_ctx->num_sessions) + { + session_free(ssl_sessions, ssl->session_index); + ssl->session = NULL; + } +} +#endif /* CONFIG_SSL_SKELETON_MODE */ + +/* + * Get the session id for a handshake. This will be a 32 byte sequence. + */ +EXP_FUNC const uint8_t * STDCALL ssl_get_session_id(SSL *ssl) +{ + return ssl->session_id; +} + +/* + * Return the cipher id (in the SSL form). + */ +EXP_FUNC uint8_t STDCALL ssl_get_cipher_id(SSL *ssl) +{ + return ssl->cipher; +} + +/* + * Return the status of the handshake. + */ +EXP_FUNC int STDCALL ssl_handshake_status(SSL *ssl) +{ + return ssl->hs_status; +} + +/* + * Retrieve various parameters about the SSL engine. + */ +EXP_FUNC int STDCALL ssl_get_config(int offset) +{ + switch (offset) + { + /* return the appropriate build mode */ + case SSL_BUILD_MODE: +#if defined(CONFIG_SSL_FULL_MODE) + return SSL_BUILD_FULL_MODE; +#elif defined(CONFIG_SSL_ENABLE_CLIENT) + return SSL_BUILD_ENABLE_CLIENT; +#elif defined(CONFIG_ENABLE_VERIFICATION) + return SSL_BUILD_ENABLE_VERIFICATION; +#elif defined(CONFIG_SSL_SERVER_ONLY ) + return SSL_BUILD_SERVER_ONLY; +#else + return SSL_BUILD_SKELETON_MODE; +#endif + + case SSL_MAX_CERT_CFG_OFFSET: + return CONFIG_SSL_MAX_CERTS; + +#ifdef CONFIG_SSL_CERT_VERIFICATION + case SSL_MAX_CA_CERT_CFG_OFFSET: + return CONFIG_X509_MAX_CA_CERTS; +#endif +#ifdef CONFIG_SSL_HAS_PEM + case SSL_HAS_PEM: + return 1; +#endif + default: + return 0; + } +} + +#ifdef CONFIG_SSL_CERT_VERIFICATION +/** + * Authenticate a received certificate. + */ +EXP_FUNC int STDCALL ssl_verify_cert(SSL *ssl) +{ + int ret = x509_verify(ssl->ssl_ctx->ca_cert_ctx, ssl->x509_ctx); + + if (ret) /* modify into an SSL error type */ + { + ret = SSL_X509_ERROR(ret); + } + + return ret; +} + +/** + * Process a certificate message. + */ +int process_certificate(SSL *ssl, X509_CTX **x509_ctx) +{ + int ret = SSL_OK; + int pkt_size = ssl->bm_buf.index; + int cert_size, offset = 5; + int total_cert_size = (ssl->bm_buf.data[offset]<<8) + + ssl->bm_buf.data[offset+1]; + int is_client = IS_SET_SSL_FLAG(SSL_IS_CLIENT); + X509_CTX **chain = x509_ctx; + offset += 2; + + PARANOIA_CHECK(total_cert_size, offset); + + while (offset < total_cert_size) + { + offset++; /* skip empty char */ + cert_size = (ssl->bm_buf.data[offset]<<8) + ssl->bm_buf.data[offset+1]; + offset += 2; + + if (x509_new(&ssl->bm_buf.data[offset], NULL, chain)) + { + ret = SSL_ERROR_BAD_CERTIFICATE; + goto error; + } + + chain = &((*chain)->next); + offset += cert_size; + } + + PARANOIA_CHECK(pkt_size, offset); + + /* if we are client we can do the verify now or later */ + if (is_client && !IS_SET_SSL_FLAG(SSL_SERVER_VERIFY_LATER)) + { + ret = ssl_verify_cert(ssl); + } + + DISPLAY_CERT(ssl, "process_certificate", *x509_ctx); + ssl->next_state = is_client ? HS_SERVER_HELLO_DONE : HS_CLIENT_KEY_XCHG; +error: + return ret; +} + +#endif /* CONFIG_SSL_CERT_VERIFICATION */ + +/** + * Debugging routine to display SSL handshaking stuff. + */ +#ifdef CONFIG_SSL_FULL_MODE +/** + * Debugging routine to display SSL states. + */ +void DISPLAY_STATE(SSL *ssl, int is_send, uint8_t state, int not_ok) +{ + const char *str; + + if (!IS_SET_SSL_FLAG(SSL_DISPLAY_STATES)) + return; + + printf(not_ok ? "Error - invalid State:\t" : "State:\t"); + printf(is_send ? "sending " : "receiving "); + + switch (state) + { + case HS_HELLO_REQUEST: + str = "Hello Request (0)"; + break; + + case HS_CLIENT_HELLO: + str = "Client Hello (1)"; + break; + + case HS_SERVER_HELLO: + str = "Server Hello (2)"; + break; + + case HS_CERTIFICATE: + str = "Certificate (11)"; + break; + + case HS_SERVER_KEY_XCHG: + str = "Certificate Request (12)"; + break; + + case HS_CERT_REQ: + str = "Certificate Request (13)"; + break; + + case HS_SERVER_HELLO_DONE: + str = "Server Hello Done (14)"; + break; + + case HS_CERT_VERIFY: + str = "Certificate Verify (15)"; + break; + + case HS_CLIENT_KEY_XCHG: + str = "Client Key Exchange (16)"; + break; + + case HS_FINISHED: + str = "Finished (16)"; + break; + + default: + str = "Error (Unknown)"; + + break; + } + + printf("%s\n", str); + TTY_FLUSH(); +} + +/** + * Debugging routine to display X509 certificates. + */ +void DISPLAY_CERT(SSL *ssl, const char *label, const X509_CTX *x509_ctx) +{ + if (!IS_SET_SSL_FLAG(SSL_DISPLAY_CERTS)) + return; + + x509_print(ssl->ssl_ctx->ca_cert_ctx, x509_ctx); + TTY_FLUSH(); +} + +/** + * Debugging routine to display RSA objects + */ +void DISPLAY_RSA(SSL *ssl, const char *label, const RSA_CTX *rsa_ctx) +{ + if (!IS_SET_SSL_FLAG(SSL_DISPLAY_RSA)) + return; + + RSA_print(rsa_ctx); + TTY_FLUSH(); +} + +/** + * Debugging routine to display SSL handshaking bytes. + */ +void DISPLAY_BYTES(SSL *ssl, const char *format, + const uint8_t *data, int size, ...) +{ + va_list(ap); + + if (!IS_SET_SSL_FLAG(SSL_DISPLAY_BYTES)) + return; + + va_start(ap, size); + print_blob(format, data, size, va_arg(ap, char *)); + va_end(ap); + TTY_FLUSH(); +} + +/** + * Debugging routine to display SSL handshaking errors. + */ +EXP_FUNC void STDCALL ssl_display_error(int error_code) +{ + if (error_code == SSL_OK) + return; + + printf("Error: "); + + /* X509 error? */ + if (error_code < SSL_X509_OFFSET) + { + x509_display_error(error_code - SSL_X509_OFFSET); + printf("\n"); + return; + } + + /* SSL alert error code */ + if (error_code > SSL_ERROR_CONN_LOST) + { + printf("SSL error %d\n", -error_code); + return; + } + + switch (error_code) + { + case SSL_ERROR_DEAD: + printf("connection dead"); + break; + + case SSL_ERROR_INVALID_HANDSHAKE: + printf("invalid handshake"); + break; + + case SSL_ERROR_INVALID_PROT_MSG: + printf("invalid protocol message"); + break; + + case SSL_ERROR_INVALID_HMAC: + printf("invalid mac"); + break; + + case SSL_ERROR_INVALID_VERSION: + printf("invalid version"); + break; + + case SSL_ERROR_INVALID_SESSION: + printf("invalid session"); + break; + + case SSL_ERROR_NO_CIPHER: + printf("no cipher"); + break; + + case SSL_ERROR_CONN_LOST: + printf("connection lost"); + break; + + case SSL_ERROR_BAD_CERTIFICATE: + printf("bad certificate"); + break; + + case SSL_ERROR_INVALID_KEY: + printf("invalid key"); + break; + + case SSL_ERROR_FINISHED_INVALID: + printf("finished invalid"); + break; + + case SSL_ERROR_NO_CERT_DEFINED: + printf("no certificate defined"); + break; + + case SSL_ERROR_NOT_SUPPORTED: + printf("Option not supported"); + break; + + default: + printf("undefined as yet - %d", error_code); + break; + } + + printf("\n"); + TTY_FLUSH(); +} + +/** + * Debugging routine to display alerts. + */ +void DISPLAY_ALERT(SSL *ssl, int alert) +{ + if (!IS_SET_SSL_FLAG(SSL_DISPLAY_STATES)) + return; + + printf("Alert: "); + + switch (alert) + { + case SSL_ALERT_CLOSE_NOTIFY: + printf("close notify"); + break; + + case SSL_ALERT_INVALID_VERSION: + printf("invalid version"); + break; + + case SSL_ALERT_BAD_CERTIFICATE: + printf("bad certificate"); + break; + + case SSL_ALERT_UNEXPECTED_MESSAGE: + printf("unexpected message"); + break; + + case SSL_ALERT_BAD_RECORD_MAC: + printf("bad record mac"); + break; + + case SSL_ALERT_HANDSHAKE_FAILURE: + printf("handshake failure"); + break; + + case SSL_ALERT_ILLEGAL_PARAMETER: + printf("illegal parameter"); + break; + + case SSL_ALERT_DECODE_ERROR: + printf("decode error"); + break; + + case SSL_ALERT_DECRYPT_ERROR: + printf("decrypt error"); + break; + + default: + printf("alert - (unknown %d)", alert); + break; + } + + printf("\n"); + TTY_FLUSH(); +} + +#endif /* CONFIG_SSL_FULL_MODE */ + +/** + * Enable the various language bindings to work regardless of the + * configuration - they just return an error statement and a bad return code. + */ +#if !defined(CONFIG_SSL_FULL_MODE) +EXP_FUNC void STDCALL ssl_display_error(int error_code) {} +#endif + +#ifdef CONFIG_BINDINGS +#if !defined(CONFIG_SSL_ENABLE_CLIENT) +EXP_FUNC SSL * STDCALL ssl_client_new(SSLCTX *ssl_ctx, + int client_fd, const uint8_t *session_id) +{ + printf(unsupported_str); + return NULL; +} +#endif + +#if !defined(CONFIG_SSL_CERT_VERIFICATION) +EXP_FUNC int STDCALL ssl_verify_cert(SSL *ssl) +{ + printf(unsupported_str); + return -1; +} + +EXP_FUNC const char * STDCALL ssl_get_cert_dn(SSL *ssl, int component) +{ + printf(unsupported_str); + return NULL; +} + +#endif /* CONFIG_SSL_CERT_VERIFICATION */ + +#endif /* CONFIG_BINDINGS */ + diff --git a/ssl/tls1.h b/ssl/tls1.h new file mode 100644 index 0000000000..be8cc1f957 --- /dev/null +++ b/ssl/tls1.h @@ -0,0 +1,249 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file tls1.h + * + * @brief The definitions for the TLS library. + */ +#ifndef HEADER_SSL_LIB_H +#define HEADER_SSL_LIB_H + +#ifdef __cplusplus +extern "C" { +#endif + +#define SSL_RANDOM_SIZE 32 +#define SSL_SECRET_SIZE 48 +#define SSL_FINISHED_HASH_SIZE 12 +#define SSL_RECORD_SIZE 5 +#define SSL_SERVER_READ 0 +#define SSL_SERVER_WRITE 1 +#define SSL_CLIENT_READ 2 +#define SSL_CLIENT_WRITE 3 +#define SSL_HS_HDR_SIZE 4 + +/* the flags we use while establishing a connection */ +#define SSL_NEED_RECORD 0x0001 +#define SSL_TX_ENCRYPTED 0x0002 +#define SSL_RX_ENCRYPTED 0x0004 +#define SSL_SESSION_RESUME 0x0008 +#define SSL_IS_CLIENT 0x0010 +#define SSL_HAS_CERT_REQ 0x0020 + +/* some macros to muck around with flag bits */ +#define SET_SSL_FLAG(A) (ssl->flag |= A) +#define CLR_SSL_FLAG(A) (ssl->flag &= ~A) +#define IS_SET_SSL_FLAG(A) (ssl->flag & A) + +#define MAX_KEY_BYTE_SIZE 512 /* for a 4096 bit key */ + +#ifdef CONFIG_SSL_SKELETON_MODE +#define NUM_PROTOCOLS 1 +#else +#define NUM_PROTOCOLS 4 +#endif + +#define PARANOIA_CHECK(A, B) if (A < B) { \ + ret = SSL_ERROR_INVALID_HANDSHAKE; goto error; } + +/* protocol types */ +enum +{ + PT_CHANGE_CIPHER_SPEC = 20, + PT_ALERT_PROTOCOL, + PT_HANDSHAKE_PROTOCOL, + PT_APP_PROTOCOL_DATA +}; + +/* handshaking types */ +enum +{ + HS_HELLO_REQUEST, + HS_CLIENT_HELLO, + HS_SERVER_HELLO, + HS_CERTIFICATE = 11, + HS_SERVER_KEY_XCHG, + HS_CERT_REQ, + HS_SERVER_HELLO_DONE, + HS_CERT_VERIFY, + HS_CLIENT_KEY_XCHG, + HS_FINISHED = 20 +}; + +typedef struct +{ + uint8_t cipher; + uint8_t key_size; + uint8_t iv_size; + uint8_t key_block_size; + uint8_t padding_size; + uint8_t digest_size; + hmac_func hmac; + crypt_func encrypt; + crypt_func decrypt; +} cipher_info_t; + +struct _SSLObjLoader +{ + uint8_t *buf; + int len; +}; + +typedef struct _SSLObjLoader SSLObjLoader; + +typedef struct +{ + time_t conn_time; + uint8_t session_id[SSL_SESSION_ID_SIZE]; + uint8_t master_secret[SSL_SECRET_SIZE]; +} SSL_SESS; + +typedef struct +{ + uint8_t *buf; + int size; +} SSL_CERT; + +struct _SSL +{ + uint32_t flag; + uint16_t need_bytes; + uint16_t got_bytes; + uint8_t record_type; + uint8_t chain_length; + uint8_t cipher; + int16_t next_state; + int16_t hs_status; + uint8_t *all_pkts; + int all_pkts_len; + int client_fd; + const cipher_info_t *cipher_info; + uint8_t *final_finish_mac; + uint8_t *key_block; + void *encrypt_ctx; + void *decrypt_ctx; + BUF_MEM bm_buf; + struct _SSL *next; /* doubly linked list */ + struct _SSL *prev; + SSL_CERT *certs; + struct _SSLCTX *ssl_ctx; /* back reference to a clnt/svr ctx */ +#ifndef CONFIG_SSL_SKELETON_MODE + uint16_t session_index; + SSL_SESS *session; +#endif +#ifdef CONFIG_SSL_CERT_VERIFICATION + X509_CTX *x509_ctx; +#endif + + uint8_t session_id[SSL_SESSION_ID_SIZE]; + uint8_t client_mac[SHA1_SIZE]; /* for HMAC verification */ + uint8_t server_mac[SHA1_SIZE]; /* for HMAC verification */ + uint8_t client_random[SSL_RANDOM_SIZE]; /* client's random sequence */ + uint8_t server_random[SSL_RANDOM_SIZE]; /* server's random sequence */ + uint8_t *master_secret; + uint8_t read_sequence[8]; /* 64 bit sequence number */ + uint8_t write_sequence[8]; /* 64 bit sequence number */ + uint8_t record_buf[SSL_RECORD_SIZE]; /* storage for hmac calls later */ +}; + +typedef struct _SSL SSL; + +struct _SSLCTX +{ + uint32_t options; + uint8_t chain_length; + RSA_CTX *rsa_ctx; +#ifdef CONFIG_SSL_CERT_VERIFICATION + CA_CERT_CTX *ca_cert_ctx; +#endif + SSL *sess_head; + SSL *sess_tail; + SSL_CERT certs[CONFIG_SSL_MAX_CERTS]; +#ifndef CONFIG_SSL_SKELETON_MODE + uint16_t num_sessions; + SSL_SESS **ssl_sessions; +#endif +}; + +typedef struct _SSLCTX SSLCTX; + +extern const uint8_t ssl_prot_prefs[NUM_PROTOCOLS]; + +SSL *ssl_new(SSLCTX *ssl_ctx, int client_fd); +int send_packet(SSL *ssl, uint8_t protocol, + const uint8_t *in, int length); +int do_svr_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len); +int do_clnt_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len); +int process_finished(SSL *ssl, int hs_len); +int process_sslv23_client_hello(SSL *ssl); +int send_alert(SSL *ssl, int error_code); +int send_finished(SSL *ssl); +int send_certificate(SSL *ssl); +int basic_read(SSL *ssl, uint8_t **in_data); +int send_change_cipher_spec(SSL *ssl); +void finished_digest(SSL *ssl, const char *label, uint8_t *digest); +void generate_master_secret(SSL *ssl, const uint8_t *premaster_secret); +void add_packet(SSL *ssl, const uint8_t *pkt, int len); +int add_cert(SSLCTX *ssl_ctx, const uint8_t *buf, int len); +int add_private_key(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj); +void ssl_obj_free(SSLObjLoader *ssl_obj); +int pkcs8_decode(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password); +int pkcs12_decode(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password); +#ifdef CONFIG_SSL_CERT_VERIFICATION +int add_cert_auth(SSLCTX *ssl_ctx, const uint8_t *buf, int len); +void remove_ca_certs(CA_CERT_CTX *ca_cert_ctx); +#endif +#ifdef CONFIG_SSL_ENABLE_CLIENT +int do_client_connect(SSL *ssl); +#endif + +#ifdef CONFIG_SSL_FULL_MODE +void DISPLAY_STATE(SSL *ssl, int is_send, uint8_t state, int not_ok); +void DISPLAY_BYTES(SSL *ssl, const char *format, + const uint8_t *data, int size, ...); +void DISPLAY_CERT(SSL *ssl, const char *label, const X509_CTX *x509_ctx); +void DISPLAY_RSA(SSL *ssl, const char *label, const RSA_CTX *rsa_ctx); +void DISPLAY_ALERT(SSL *ssl, int alert); +#else +#define DISPLAY_STATE(A,B,C,D) +#define DISPLAY_CERT(A,B,C) +#define DISPLAY_RSA(A,B,C) +#define DISPLAY_ALERT(A, B) +#ifdef WIN32 +void DISPLAY_BYTES(SSL *ssl, const char *format,/* win32 has no variadic macros */ + const uint8_t *data, int size, ...); +#else +#define DISPLAY_BYTES(A,B,C,D,...) +#endif +#endif + +#ifdef CONFIG_SSL_CERT_VERIFICATION +int process_certificate(SSL *ssl, X509_CTX **x509_ctx); +#endif + +SSL_SESS *ssl_session_update(int max_sessions, + SSL_SESS *ssl_sessions[], SSL *ssl, + const uint8_t *session_id); +void kill_ssl_session(SSL_SESS **ssl_sessions, SSL *ssl); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c new file mode 100644 index 0000000000..7043876429 --- /dev/null +++ b/ssl/tls1_clnt.c @@ -0,0 +1,330 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#include +#include +#include +#include + +#include "ssl.h" + +#ifdef CONFIG_SSL_ENABLE_CLIENT /* all commented out if no client */ + +static int send_client_hello(SSL *ssl); +static int process_server_hello(SSL *ssl); +static int process_server_hello_done(SSL *ssl); +static int send_client_key_xchg(SSL *ssl); +static int process_cert_req(SSL *ssl); +static int send_cert_verify(SSL *ssl); + +/* + * Establish a new SSL connection to an SSL server. + */ +EXP_FUNC SSL * STDCALL ssl_client_new(SSLCTX *ssl_ctx, int client_fd, const uint8_t *session_id) +{ + int ret; + SSL *ssl = ssl_new(ssl_ctx, client_fd); + + if (session_id && ssl_ctx->num_sessions) + { + memcpy(ssl->session_id, session_id, SSL_SESSION_ID_SIZE); + SET_SSL_FLAG(SSL_SESSION_RESUME); /* just flag for later */ + } + + SET_SSL_FLAG(SSL_IS_CLIENT); + ret = do_client_connect(ssl); + return ssl; +} + +/* + * Process the handshake record. + */ +int do_clnt_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len) +{ + int ret = SSL_OK; + + /* To get here the state must be valid */ + switch (handshake_type) + { + case HS_SERVER_HELLO: + ret = process_server_hello(ssl); + break; + + case HS_CERTIFICATE: + ret = process_certificate(ssl, &ssl->x509_ctx); + break; + + case HS_SERVER_HELLO_DONE: + if ((ret = process_server_hello_done(ssl)) == SSL_OK) + { + if (IS_SET_SSL_FLAG(SSL_HAS_CERT_REQ)) + { + if ((ret = send_certificate(ssl)) == SSL_OK && + (ret = send_client_key_xchg(ssl)) == SSL_OK) + { + ret = send_cert_verify(ssl); + } + } + else + { + ret = send_client_key_xchg(ssl); + } + + if (ret == SSL_OK && + (ret = send_change_cipher_spec(ssl)) == SSL_OK) + { + ret = send_finished(ssl); + } + } + break; + + case HS_CERT_REQ: + ret = process_cert_req(ssl); + break; + + case HS_FINISHED: + ret = process_finished(ssl, hs_len); + break; + + case HS_HELLO_REQUEST: + ret = do_client_connect(ssl); + break; + } + + return ret; +} + +/* + * Do the handshaking from the beginning. + */ +int do_client_connect(SSL *ssl) +{ + int ret = SSL_OK; + + send_client_hello(ssl); /* send the client hello */ + ssl->bm_buf.index = 0; + ssl->next_state = HS_SERVER_HELLO; + ssl->hs_status = SSL_NOT_OK; /* not connected */ + + /* sit in a loop until it all looks good */ + while (ssl->hs_status != SSL_OK) + { + ret = basic_read(ssl, NULL); + + if (ret < SSL_OK) + { + if (ret != SSL_ERROR_CONN_LOST) + { + /* let the server know we are dying and why */ + if (send_alert(ssl, ret)) + { + /* something nasty happened, so get rid of it */ + kill_ssl_session(ssl->ssl_ctx->ssl_sessions, ssl); + } + } + + break; + } + } + + ssl->hs_status = ret; /* connected? */ + return ret; +} + +/* + * Send the initial client hello. + */ +static int send_client_hello(SSL *ssl) +{ + uint8_t *buf = ssl->bm_buf.data; + time_t tm = time(NULL); + uint8_t *tm_ptr = &buf[6]; /* time will go here */ + int i, offset; + + buf[0] = HS_CLIENT_HELLO; + buf[1] = 0; + buf[2] = 0; + /* byte 3 is calculated later */ + buf[4] = 0x03; + buf[5] = 0x01; + + /* client random value - spec says that 1st 4 bytes are big endian time */ + *tm_ptr++ = (uint8_t)(((long)tm & 0xff000000) >> 24); + *tm_ptr++ = (uint8_t)(((long)tm & 0x00ff0000) >> 16); + *tm_ptr++ = (uint8_t)(((long)tm & 0x0000ff00) >> 8); + *tm_ptr++ = (uint8_t)(((long)tm & 0x000000ff)); + get_random(SSL_RANDOM_SIZE-4, &buf[10]); + memcpy(ssl->client_random, &buf[6], SSL_RANDOM_SIZE); + offset = 6 + SSL_RANDOM_SIZE; + + /* give session resumption a go */ + if (IS_SET_SSL_FLAG(SSL_SESSION_RESUME)) /* set initially bu user */ + { + buf[offset++] = SSL_SESSION_ID_SIZE; + memcpy(&buf[offset], ssl->session_id, SSL_SESSION_ID_SIZE); + offset += SSL_SESSION_ID_SIZE; + CLR_SSL_FLAG(SSL_SESSION_RESUME); /* clear so we can set later */ + } + else + { + /* no session id - because no session resumption just yet */ + buf[offset++] = 0; + } + + buf[offset++] = 0; /* number of ciphers */ + buf[offset++] = NUM_PROTOCOLS*2; /* number of ciphers */ + + /* put all our supported protocols in our request */ + for (i = 0; i < NUM_PROTOCOLS; i++) + { + buf[offset++] = 0; /* cipher we are using */ + buf[offset++] = ssl_prot_prefs[i]; + } + + buf[offset++] = 1; /* no compression */ + buf[offset++] = 0; + buf[3] = offset - 4; /* handshake size */ + + return send_packet(ssl, PT_HANDSHAKE_PROTOCOL, NULL, offset); +} + +/* + * Process the server hello. + */ +static int process_server_hello(SSL *ssl) +{ + uint8_t *buf = ssl->bm_buf.data; + int pkt_size = ssl->bm_buf.index; + int offset; + int ret = SSL_OK; + int num_sessions = ssl->ssl_ctx->num_sessions; + + /* check that we are talking to a TLSv1 server */ + if (buf[4] != 0x03 || buf[5] != 0x01) + { + return SSL_ERROR_INVALID_VERSION; + } + + /* get the server random value */ + memcpy(ssl->server_random, &buf[6], SSL_RANDOM_SIZE); + offset = 7 + SSL_RANDOM_SIZE; /* skip of session id size */ + + if (num_sessions) + { + ssl->session = ssl_session_update(num_sessions, + ssl->ssl_ctx->ssl_sessions, ssl, &buf[offset]); + memcpy(ssl->session->session_id, &buf[offset], SSL_SESSION_ID_SIZE); + } + + memcpy(ssl->session_id, &buf[offset], SSL_SESSION_ID_SIZE); + offset += SSL_SESSION_ID_SIZE; + + /* get the real cipher we are using */ + ssl->cipher = buf[++offset]; + ssl->next_state = IS_SET_SSL_FLAG(SSL_SESSION_RESUME) ? + HS_FINISHED : HS_CERTIFICATE; + + PARANOIA_CHECK(pkt_size, offset); + +error: + return ret; +} + +/** + * Process the server hello done message. + */ +static int process_server_hello_done(SSL *ssl) +{ + ssl->next_state = HS_FINISHED; + return SSL_OK; +} + +/* + * Send a client key exchange message. + */ +static int send_client_key_xchg(SSL *ssl) +{ + uint8_t *buf = ssl->bm_buf.data; + uint8_t premaster_secret[SSL_SECRET_SIZE]; + int enc_secret_size = -1; + + buf[0] = HS_CLIENT_KEY_XCHG; + buf[1] = 0; + + premaster_secret[0] = 0x03; /* encode the version number */ + premaster_secret[1] = 0x01; + get_random(SSL_SECRET_SIZE-2, &premaster_secret[2]); + DISPLAY_RSA(ssl, "send_client_key_xchg", ssl->x509_ctx->rsa_ctx); + enc_secret_size = RSA_encrypt(ssl->x509_ctx->rsa_ctx, premaster_secret, + SSL_SECRET_SIZE, &buf[6], 0); + buf[2] = (enc_secret_size + 2) >> 8; + buf[3] = (enc_secret_size + 2) & 0xff; + buf[4] = enc_secret_size >> 8; + buf[5] = enc_secret_size & 0xff; + + generate_master_secret(ssl, premaster_secret); + return send_packet(ssl, PT_HANDSHAKE_PROTOCOL, NULL, enc_secret_size+6); +} + +/* + * Process the certificate request. + */ +static int process_cert_req(SSL *ssl) +{ + /* don't do any processing - we will send back an RSA certificate anyway */ + ssl->next_state = HS_SERVER_HELLO_DONE; + SET_SSL_FLAG(SSL_HAS_CERT_REQ); + return SSL_OK; +} + +/* + * Send a certificate verify message. + */ +static int send_cert_verify(SSL *ssl) +{ + uint8_t *buf = ssl->bm_buf.data; + uint8_t dgst[MD5_SIZE+SHA1_SIZE]; + RSA_CTX *rsa_ctx = ssl->ssl_ctx->rsa_ctx; + int n, ret; + + DISPLAY_RSA(ssl, "send_cert_verify", rsa_ctx); + + buf[0] = HS_CERT_VERIFY; + buf[1] = 0; + + finished_digest(ssl, NULL, dgst); /* calculate the digest */ + n = RSA_encrypt(rsa_ctx, dgst, sizeof(dgst), &buf[6], 1); + + if (n == 0) + { + ret = SSL_ERROR_INVALID_KEY; + goto error; + } + + buf[4] = n >> 8; /* add the RSA size (not officially documented) */ + buf[5] = n & 0xff; + n += 2; + buf[2] = n >> 8; + buf[3] = n & 0xff; + ret = send_packet(ssl, PT_HANDSHAKE_PROTOCOL, NULL, n+4); + +error: + return ret; +} + +#endif /* CONFIG_SSL_ENABLE_CLIENT */ diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c new file mode 100644 index 0000000000..ff0eb62a52 --- /dev/null +++ b/ssl/tls1_svr.c @@ -0,0 +1,435 @@ +/* + * Copyright(C) 2006 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#include +#include +#include + +#include "ssl.h" + +static const uint8_t g_hello_done[] = { HS_SERVER_HELLO_DONE, 0, 0, 0 }; + +static int process_client_hello(SSL *ssl); +static int send_server_hello_sequence(SSL *ssl); +static int send_server_hello(SSL *ssl); +static int send_server_hello_done(SSL *ssl); +static int process_client_key_xchg(SSL *ssl); +#ifdef CONFIG_SSL_CERT_VERIFICATION +static int send_certificate_request(SSL *ssl); +static int process_cert_verify(SSL *ssl); +#endif + +/* + * Establish a new SSL connection to an SSL client. + */ +EXP_FUNC SSL * STDCALL ssl_server_new(SSLCTX *ssl_ctx, int client_fd) +{ + SSL *ssl = ssl_new(ssl_ctx, client_fd); + ssl->next_state = HS_CLIENT_HELLO; + ssl->hs_status = SSL_NOT_OK; /* not connected */ + return ssl; +} + +/* + * Process the handshake record. + */ +int do_svr_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len) +{ + int ret = SSL_OK; + ssl->hs_status = SSL_NOT_OK; /* not connected */ + + /* To get here the state must be valid */ + switch (handshake_type) + { + case HS_CLIENT_HELLO: + if ((ret = process_client_hello(ssl)) == SSL_OK) + { + ret = send_server_hello_sequence(ssl); + } + break; + +#ifdef CONFIG_SSL_CERT_VERIFICATION + case HS_CERTIFICATE:/* the client sends its cert */ + ret = process_certificate(ssl, &ssl->x509_ctx); + + if (ret == SSL_OK) /* verify the cert */ + { + int cert_res; + cert_res = x509_verify( + ssl->ssl_ctx->ca_cert_ctx, ssl->x509_ctx); + ret = (cert_res == 0) ? SSL_OK : SSL_X509_ERROR(cert_res); + } + break; + + case HS_CERT_VERIFY: + ret = process_cert_verify(ssl); + add_packet(ssl, buf, hs_len); /* needs to be done after */ + break; +#endif + case HS_CLIENT_KEY_XCHG: + ret = process_client_key_xchg(ssl); + break; + + case HS_FINISHED: + ret = process_finished(ssl, hs_len); + break; + } + + return ret; +} + +/* + * Process a client hello message. + */ +static int process_client_hello(SSL *ssl) +{ + uint8_t *buf = ssl->bm_buf.data; + int pkt_size = ssl->bm_buf.index; + int i, j, cs_len, id_len, offset = 6 + SSL_RANDOM_SIZE; + int ret = SSL_OK; + + memcpy(ssl->client_random, &buf[6], SSL_RANDOM_SIZE); + + /* process the session id */ + id_len = buf[offset++]; + if (id_len > SSL_SESSION_ID_SIZE) + { + return SSL_ERROR_INVALID_SESSION; + } + +#ifndef CONFIG_SSL_SKELETON_MODE + ssl->session = ssl_session_update(ssl->ssl_ctx->num_sessions, + ssl->ssl_ctx->ssl_sessions, ssl, id_len ? &buf[offset] : NULL); +#endif + + offset += id_len; + cs_len = (buf[offset]<<8) + buf[offset+1]; + offset += 3; /* add 1 due to all cipher suites being 8 bit */ + + PARANOIA_CHECK(pkt_size, offset); + + /* work out what cipher suite we are going to use */ + for (j = 0; j < NUM_PROTOCOLS; j++) + { + for (i = 0; i < cs_len; i += 2) + { + if (ssl_prot_prefs[j] == buf[offset+i]) /* got a match? */ + { + ssl->cipher = ssl_prot_prefs[j]; + goto do_state; + } + } + } + + /* ouch! protocol is not supported */ + ret = SSL_ERROR_NO_CIPHER; + +do_state: +error: + return ret; +} + +#ifdef CONFIG_SSL_ENABLE_V23_HANDSHAKE +/* + * Some browsers use a hybrid SSLv2 "client hello" + */ +int process_sslv23_client_hello(SSL *ssl) +{ + uint8_t *buf = ssl->bm_buf.data; + int bytes_needed = ((buf[0] & 0x7f) << 8) + buf[1]; + int version = (buf[3] << 4) + buf[4]; + int ret = SSL_OK; + + /* we have already read 3 extra bytes so far */ + int read_len = SOCKET_READ(ssl->client_fd, buf, bytes_needed-3); + int cs_len = buf[1]; + int id_len = buf[3]; + int ch_len = buf[5]; + int i, j, offset = 8; /* start at first cipher */ + int random_offset = 0; + + DISPLAY_BYTES(ssl, "received %d bytes", buf, read_len, read_len); + + /* must be 3.1 (TLSv1) */ + if (version != 0x31) + { + return SSL_ERROR_INVALID_VERSION; + } + + add_packet(ssl, buf, read_len); + + /* connection has gone, so die */ + if (bytes_needed < 0) + { + return SSL_ERROR_CONN_LOST; + } + + /* now work out what cipher suite we are going to use */ + for (j = 0; j < NUM_PROTOCOLS; j++) + { + for (i = 0; i < cs_len; i += 3) + { + if (ssl_prot_prefs[j] == buf[offset+i]) + { + ssl->cipher = ssl_prot_prefs[j]; + goto server_hello; + } + } + } + + /* ouch! protocol is not supported */ + ret = SSL_ERROR_NO_CIPHER; + goto error; + +server_hello: + /* get the session id */ + offset += cs_len - 2; /* we've gone 2 bytes past the end */ +#ifndef CONFIG_SSL_SKELETON_MODE + ssl->session = ssl_session_update(ssl->ssl_ctx->num_sessions, + ssl->ssl_ctx->ssl_sessions, ssl, id_len ? &buf[offset] : NULL); +#endif + + /* get the client random data */ + offset += id_len; + + /* random can be anywhere between 16 and 32 bytes long - so it is padded + * with 0's to the left */ + if (ch_len == 0x10) + { + random_offset += 0x10; + } + + memcpy(&ssl->client_random[random_offset], &buf[offset], ch_len); + ret = send_server_hello_sequence(ssl); + +error: + return ret; +} +#endif + +/* + * Send the entire server hello sequence + */ +static int send_server_hello_sequence(SSL *ssl) +{ + int ret; + + if ((ret = send_server_hello(ssl)) == SSL_OK) + { +#ifndef CONFIG_SSL_SKELETON_MODE + /* resume handshake? */ + if (IS_SET_SSL_FLAG(SSL_SESSION_RESUME)) + { + if ((ret = send_change_cipher_spec(ssl)) == SSL_OK) + { + ret = send_finished(ssl); + ssl->next_state = HS_FINISHED; + } + } + else +#endif + if ((ret = send_certificate(ssl)) == SSL_OK) + { +#ifdef CONFIG_SSL_CERT_VERIFICATION + /* ask the client for its certificate */ + if (IS_SET_SSL_FLAG(SSL_CLIENT_AUTHENTICATION)) + { + if ((ret = send_certificate_request(ssl)) == SSL_OK) + { + ret = send_server_hello_done(ssl); + ssl->next_state = HS_CERTIFICATE; + } + } + else +#endif + { + ret = send_server_hello_done(ssl); + ssl->next_state = HS_CLIENT_KEY_XCHG; + } + } + } + + return ret; +} + +/* + * Send a server hello message. + */ +static int send_server_hello(SSL *ssl) +{ + uint8_t *buf = ssl->bm_buf.data; + int offset = 0; + + buf[0] = HS_SERVER_HELLO; + buf[1] = 0; + buf[2] = 0; + /* byte 3 is calculated later */ + buf[4] = 0x03; + buf[5] = 0x01; + + /* server random value */ + get_random(SSL_RANDOM_SIZE, &buf[6]); + memcpy(ssl->server_random, &buf[6], SSL_RANDOM_SIZE); + offset = 6 + SSL_RANDOM_SIZE; + + /* send a session id - and put it into the cache */ + buf[offset++] = SSL_SESSION_ID_SIZE; + +#ifndef CONFIG_SSL_SKELETON_MODE + if (IS_SET_SSL_FLAG(SSL_SESSION_RESUME)) + { + /* retrieve id from session cache */ + memcpy(&buf[offset], ssl->session->session_id, + SSL_SESSION_ID_SIZE); + memcpy(ssl->session_id, ssl->session->session_id, SSL_SESSION_ID_SIZE); + } + else /* generate our own session id */ +#endif + { + get_random(SSL_SESSION_ID_SIZE, &buf[offset]); + memcpy(ssl->session_id, &buf[offset], SSL_SESSION_ID_SIZE); + +#ifndef CONFIG_SSL_SKELETON_MODE + /* store id in session cache */ + if (ssl->ssl_ctx->num_sessions) + { + memcpy(ssl->session->session_id, + ssl->session_id, SSL_SESSION_ID_SIZE); + } +#endif + } + + offset += SSL_SESSION_ID_SIZE; + + buf[offset++] = 0; /* cipher we are using */ + buf[offset++] = ssl->cipher; + buf[offset++] = 0; /* no compression */ + buf[3] = offset - 4; /* handshake size */ + return send_packet(ssl, PT_HANDSHAKE_PROTOCOL, NULL, offset); +} + +/* + * Send the server hello done message. + */ +static int send_server_hello_done(SSL *ssl) +{ + return send_packet(ssl, PT_HANDSHAKE_PROTOCOL, + g_hello_done, sizeof(g_hello_done)); +} + +/* + * Pull apart a client key exchange message. Decrypt the pre-master key (using + * our RSA private key) and then work out the master key. Initialise the + * ciphers. + */ +static int process_client_key_xchg(SSL *ssl) +{ + uint8_t *buf = ssl->bm_buf.data; + int pkt_size = ssl->bm_buf.index; + int premaster_size, secret_length = (buf[2] << 8) + buf[3]; + uint8_t premaster_secret[MAX_KEY_BYTE_SIZE]; + RSA_CTX *rsa_ctx = ssl->ssl_ctx->rsa_ctx; + int offset = 4; + int ret = SSL_OK; + + DISPLAY_RSA(ssl, "process_client_key_xchg", rsa_ctx); + + /* is there an extra size field? */ + if ((secret_length - 2) == rsa_ctx->num_octets) + { + offset += 2; + } + + PARANOIA_CHECK(pkt_size, rsa_ctx->num_octets+offset); + premaster_size = RSA_decrypt(rsa_ctx, &buf[offset], premaster_secret, 1); + + if (premaster_size != SSL_SECRET_SIZE || + premaster_secret[0] != 0x03 || /* check version is 3.1 (TLS) */ + premaster_secret[1] != 0x01) + { + /* guard against a Bleichenbacher attack */ + memset(premaster_secret, 0, SSL_SECRET_SIZE); + /* and continue - will die eventually when checking the mac */ + } + +#if 0 + print_blob("pre-master", premaster_secret, SSL_SECRET_SIZE); +#endif + + generate_master_secret(ssl, premaster_secret); + +#ifdef CONFIG_SSL_CERT_VERIFICATION + ssl->next_state = IS_SET_SSL_FLAG(SSL_CLIENT_AUTHENTICATION) ? + HS_CERT_VERIFY : HS_FINISHED; +#else + ssl->next_state = HS_FINISHED; +#endif +error: + return ret; +} + +#ifdef CONFIG_SSL_CERT_VERIFICATION +static const uint8_t g_cert_request[] = { HS_CERT_REQ, 0, 0, 4, 1, 0, 0, 0 }; + +/* + * Send the certificate request message. + */ +static int send_certificate_request(SSL *ssl) +{ + return send_packet(ssl, PT_HANDSHAKE_PROTOCOL, + g_cert_request, sizeof(g_cert_request)); +} + +/* + * Ensure the client has the private key by first decrypting the packet and + * then checking the packet digests. + */ +static int process_cert_verify(SSL *ssl) +{ + uint8_t *buf = ssl->bm_buf.data; + int pkt_size = ssl->bm_buf.index; + uint8_t dgst_buf[MAX_KEY_BYTE_SIZE]; + uint8_t dgst[MD5_SIZE+SHA1_SIZE]; + X509_CTX *x509_ctx = ssl->x509_ctx; + int ret = SSL_OK; + int n; + + PARANOIA_CHECK(pkt_size, x509_ctx->rsa_ctx->num_octets+6); + + DISPLAY_RSA(ssl, "process_cert_verify", x509_ctx->rsa_ctx); + n = RSA_decrypt(x509_ctx->rsa_ctx, &buf[6], dgst_buf, 0); + + if (n != SHA1_SIZE + MD5_SIZE) + { + ret = SSL_ERROR_INVALID_KEY; + goto end_cert_vfy; + } + + finished_digest(ssl, NULL, dgst); /* calculate the digest */ + if (memcmp(dgst_buf, dgst, MD5_SIZE + SHA1_SIZE)) + { + ret = SSL_ERROR_INVALID_KEY; + } + +end_cert_vfy: + ssl->next_state = HS_FINISHED; +error: + return ret; +} + +#endif diff --git a/www/crypto_files/crypto_2600des.gif b/www/crypto_files/crypto_2600des.gif new file mode 100644 index 0000000000000000000000000000000000000000..10610c126672508362a8a2b4e97fff49f4d2bf21 GIT binary patch literal 15768 zcmWk#cUV)&*S`0rlS&JrCZP!uAXMojp-V9o5roxHL`2kpsGz7fjiMl-s352TQBhep zA}aRKgQ6P{U0iVuf{Lysc662B=Qn@MKQqtFb7sza=A8GOiHHjK@y+N4HUTey|8FRO zLPSzYI2s9IO~f(`Q6{EnnvtHV8Ntj5#WY1(8xxooL?%_=+(O^N($tcwZ*6H{ZDnf5 zz!)=$7SSY`5 z%L?=M2n+BC3-k-;EOO>Kdxf(tLp;5synI6aeU=7zCj|O(ox?*t!$bYUqXQx${jw8+ zB7#ErOGA8Pm-;4!`X)#FB_{@^C;FzP1cZe|#e^=6SsEJ`p0O+@D={oOH8eUgI&Ni5 z-16|O)YzQZ_=LEmtmTREX^9ETQBHbvob9wGbSJ-As{C`Ff%4PD=8swIe$%B zQdUw{PI^w^s+fZG{PfJk-!gLYGlTQj1s3K6tjkKy&r8Y9%w3MQ zyiq7EN|EhIlx*23E8SdIQYtPIOG?Z4l$Py)3wMb3R!UaNB%Ak2i>mf)sh4hT*t@l= zcK6XkNeAjnS`KYJwr_V^UD2^a+m0$qI@))hIlcRG*NzHl`QE*idn=FCmF;P$+EZ8F z+E8_3UwutwQ)5FzO>=!sb8~G|eS34uiMIVU?Jf0+1D(g4PaHm0bENIWky9s59;-id zX8);Ur_Y=@-F5s>SLgoo?Z?h{p6)z%=&bV0h4cHbUOjZ-{OPORzhAt1_WIR}XHWEX zpY6NcHFV|bK>sCq|MkZH3!VMfF7#a=n7G-0t+(SwU$45q>GrLr;r{N?+kf0sH;)aT zn;8A$uZR2px_9Bx!}G%fL$_~@j13LnyEFFS&*{74xBr@$c=YJ6hYy}Ue*AQ1>iYCw z_ntnUoPPZDpXn?AOh0`5R69F!^ZCr=>sJq+%{+hg^7)5X|Ga$xUM1_89gdFE=Ja`78dgPJ zv{I@50j%vkW?6kpx?sWmi22LVClWr~UuL){XhERHjTgqW**9o1K9-ZFMxEwpjpp@I zo4BTmQkOj$HGiaD`qV~nvQPq{`YE9znUQZdqZha16HiUQ)Wb#o=5Xgl%jWy0UVnkK zc@;15sHtKA6IL=m_1or`*-2a|TQsyMLZxnF-wj z`98(EEhCFMIUi6YgNYRtcn;@jIZ4Jo7ULrLN6yj9Py<$YRu2bb8EzEci*EeXRpnMW z%Rjy+yvcj@mMy6V4R^Ba0i>nHwTgN$$JVsJZFmgC=`T?;LN+94LzTw9tUYOZ6@zR^ zdtG?OFb>BS!UR(?(7_&=$KK1Xsd1WD(SCIe2cgtqifXlCh&2ub!bY46m#aO ztq4i8V28PFo2n3*osW#?qD+A?@g@tS_b7b}PYnk}^Qnuq-<|SzwELxi4{G{Oi}QDk zO-fZfOeTFz-a?MeAGdm+3@-d8GGj61S>xnVEl)ooCOs5ymE!*aL341C^%J`I`4?!w zzTV;l>3U}^j!r_D{I=P+<%kMh!(OPQ zm#M9zWtQne@C^<5r|7YZ&%Zocm^9D|ot$J4?RvA_9i8s`#i0;&+U4if(?vb}E2r=L zt_Z*R=lQ#SaoIIL1GXNJjf(xzOTIpb(pP^GnW}Z(^@~aP zI0e#6(Mw+Y1HiC_{R}0Ouy#~T2j0v23)Dc2|Ex>!UlvF;U`U^&Zad`RKz$tzo%(O; zNr2)uc;xM-KmOxDsg%8Gxf|iDQYq`AN}N;4DR7@V@m*E97@5DeIB#LD-|{;jo7$Oa z&>#q7WuNm-oy;_U$q0AeZe!{xJZANZjiDm>&Tp$?^vYDczX;5-Ogj!*42M!a$T2&q zZIpa|2n{R3xK>S9qv}DDyr1>f;`mn2TVs%|@WNe71G#|~CiwBMm}dh1tXv5HS`C_% zPFIBsvuSe*bg+V_pQl)Csi%*RRw|&PS(RnriecnJ^}cKA_89AJqMNOw4mUzn=s6*# zpVLN>>iVO;ey`rqI72F_2xAd4FxC!S^LY-2o#`g7U5;O4#z)u^GO#x7Z;$OzcQ9-p zmV38P6LJLzGmX65t*DpOv0P#`t|$-cV4jK2T@c}*XRxuQc2m$Z3!g`a{ENirb~pTI zf%ayg+~(k{)w({+5l*>lm58{WkDzN5XzOh4g{|s7lh-;KyGkUyu&&pnive}L-wJbo z2i}ApSdz8ixJ#`p56I<8F%C?$UL=fJU_f4zA(pRuFfO)BVv*U?WO^=_)>dXnkoHni zte=}SXr!H6zvA;$poRT&S!F?n-ckWg=07EVl$j_WFjKsSzFxX`D-L&56UzLdEtgYy zidq_tJYu4%dj1b??H*o3X8qyr#gOCXxU1{h z-8uI!E)Rw-s}`JXObEs;4q@wh?WJ5S=H+wT6ZNobI0KHE=%;tEL3f=S$r-D_O(`S1 zHp+=Rda{h)9S9E`XQDNqM(n=?aiGW#pFZ$QXDwdUf^h)y$)r8GNQJQaAi%PPD&YOO zD}nLh7?xnolgL_i!jV<)?_!4ngqWngvt5hKqJ|@WZ>u?_*r+3f4KvaXslwgjMdh3NlY8}c2SE6Mf|fX z3QnS`@~4d2_(*a^dw^bU>d^WN0D3e6&EdckmawI13KvKm#-sZZLCwk6pu>v(j~5p1 zSs-!&JYBvW6S;f?303;!zkd=bac-5lBqt9BP3GRN-Gmef^b$XZ&~7M~mtQ}JN=y?a_IRCP zdAniJK|@mpwvU0|5{8xOR!Rl<^8y5hf^32HWI~Li4Am*eT4~v5p1O8Qkmq5&`ml|7 zBX1nVI-JcxYf-}t{7wMZB*$Ii5V|zwG7Y9vh`+4EEQD&IMOs7<#oguH#^-A-Z%jkU zTKCDXsOvB`Oy#qo!1wBKZhe>keUJ6l42Y!!#r*OM2~Kn&Vyh69oa5ZLIjOVG)%v_O z^@x;j)YjB zi`G^&xxI@VRiuH)DrlE7;5@^lUky>^fap{5R*`Y$W-vQ(qst7mmf_y8*)QuO5NNlB zEQG>g^lAnwI@xz`F6s{%%2x;xH5=jXyqh944O_GBneTjx-|zjv`U{|i0Aj%wHaM%C zr%<=3#94q`&ByMZvm0SAxP~bZetcxG!Yxz_F6Luda@6fHz*2!uWp65akeu!j_{KIl zV-P&iVSGsCG{GUqQw3(1 z3c4{3I>U-Crd#T9bP7;=IynLdqgqtZHB`8<1}SG)^(RMc*a9A%-sm%i{BIVst{%5d zzFY?2&am+}Rp{0kNV^$RI**dIfkkqZi%^)E1?*7Z%Cwjk1)*P#Xv#njYcamU^$#|i zN1X7z*cWc&7kFmo#Cln<)fN*gF_>PK#`@As*Mj3CnLj_CxLKLM>f*_T=u;;L`%adc zCI3^>4BrE-G{HH>NjcBl%RT_HO3d~PD`W!f9-w`iPySblN?5yLv4;2&AU|iEwkV0b zVu~-KpyhJBmwIs%7xRQooRFWnvXnR@hyu5gbvja01IgBtBtL;R(OGmpWj^M$<{77N zTAbeLy-Dj<-iAhAvPZb_^DgNl<0;5gfk!Go%pC?(8ED5fm|a@LhyyCu9l=tdDHUz+ zyQ6Dfbu@d#dLVZvu2xt!v5Df8q~4tAP>&Jd8_0pwlFB`)W| zRh;@P7;)@7Fr$W?7^r{B+H#nvU>zby96{+v`N$U_mmSa&$SR(VO3|Lzq(?x3eOyZP_-E9YlAov6uouXs|Fc|Xr*23_!+atDV`#QNXP%uQnr{2TkI zJMZ$Dm{<3FO#t~ipIGMkps0m#ki!CF6^hour(3Z^D`p{Wny+ z5@Tw=$gIf3a5rcacgcXFZ?;=x)a*w2*kkzPxvBM6>G8JC#fb$D+pHY81*UyBznB}G zaWmUeAbH+v`@D70&%N8e`ENT2iV-U|QQU5_GYgwVAW6xp5veS$nW0{bVtQ@AY_+nk zy}9C~>V?R}2D1${4K^GA@+hQN9K5Fjtkx3W!NgNq%>6Y0MS<)4j?sfrkND(EDo{)z zeI5Zh9O64RAwXgF)L;0&M~0+UBigweu3g8N;02DB{R-S#q{DPDP~J2|o`QLR3FPsy z+cJSD{Yt0An+tA){@_ANQ~Z`Kpy8JXkSX5Z8OBH{sFe3WA|EFOLP~_tkK3qIoRo8N zy(mE`q(A~Von485qg_N z=BL@LwafspWd#^_Ah+$(A~z1kheIjV5%1=kMTl60WN4)D;T_Hs|Qp2Xd3M>nximNta=E?fv)BfKv~4Q(K)N=FK8&K@)!dZBtSTo9Dt z+rQt!(gWYevs%U>7Q}EJHH-(D!%r*__Hy$&1N686Z>g|O_=(FGLKI4@nId{vy4R{u zcylcfsKk{qP*!~B7mb*|1ccQ}iyF{6R)Kq{BJ^?y{>Ka#D=}ZnaS2*M3LiTlC)5jV ztW=@f_~#Gwp?9j#$yx}n(zIwX+m-gWMTV{-q4BUO>*>w01uBxGJv=D|Vzr3%YoH5# zP>vjzK(VSnXtCEldK$E{QeswUt0q2xF>-LMY_Y(**)qWrr$ImBH`R-F7PdkX4gQP{ zbAyk>D4OI-%u)@ujDg)NMB{sSZxk?y*$Yay_CL4lgo6`~hucsfYhvRoRm;yQR`>vInIEfOYzBfD zDd$w^`{CY8x}wPn@X)bXoC0}5skc#J`)UFo|Fo=b3qdYN?*fqb`@tQOd!s}9b5-M^ zB4;ZdMXwbK)&OX2#p^Xjk6RC66_{|orl)sHmkPT(^Z~otaCB`<5ACs;7PS-Uwo8u5 z<6s9>xE*Z#C})9io?YdcgA7+l$8WE~aiCJ=VjBMiONVhfTGIOL?CyT#76m#H9^q*4 zLlnG}f5gCn(ZxY(D_`nW2bWDq-^zfcf~S*i-b@7Y#Md>ZUqAgGUA^BXEJ1~SkzI3o z1j$pZ>iN9rep}C;z3!>Q%!M}4`5WqegK5{f3mF=St2%U@kKZGw{xxQ?vC`0%U2O~? z^K_uO5cikj%^g2)bOO>v2O63AI`dDIhp4O(Tm3!#)V& z!aH!}3dhCJ-5kLA%2C_+$Wt2pc`g2E_m|UINxS_5M?fSM+1RKgPG}lmIimjf;mT|U zMn3^h8p0+r0UnI=QvHDSX_1`{) zG3QzrKkXaFRa-Ii;}vcoo}28RsS}E2c*}$z?b|~3AJwFoe2X>hh2W~I71 zxo0X<5*+upSs)#Ies(CqUL@MBD7#4u&R8d)<1X9SMbm>5Vcmjb5;nn#6z%RMmg0=t z&sZ+bc1z&S`kNsm0mwuvG*a!>q?czIgv9d|AhDm2TbCQgxmO~{lon@O33ePbEs(zPwl zW&lnSSQe?WA!+6%sA_{NZ6E=JO?{cyX z*W{Q!^^OW;pG}|1X0&x#SIu*fHD;$(2*!jWL{GHmb*%#Npfd>(Zm5xBl%?AZMf$UnoC5Xu&81NLKS&oL7~KM|OK4Ut_*LC6~cuM$KoN3nm@fNLBRd znevru>w$aK$dPuk=LCg^yV~I!axwNrQdYfJsd7?}9*W)JJw*w4DH=RL=&lLUyBubk zxhuo2zNIqbcm+OXzRx5?Da@$ZF!AkpO&b6G4Cyjqy9&-H3-{HetzPE)Q;Bh2pPTk_IIWn(54!}8e6f*S4H?NFTy7mOx0^j0ur+*Xj7AOsENl!J7O zVIQ~Dbga7){8WJDp6^mr+G|C)$-Kz5XE^^Zu!BNqkby&J80%F*O~ExXZ?mHRk!J>Z z%Y@B30fakC(Ub?!IM5_N7n+U5acqT*2 zFgJmSm;hMGgs9+#6gD$2duEftI`^osg58s|isU%==Eip97JI*540SlxEAC!If33)* z9YC5C4={)n!18rLO_T!w(gi7q02oE>7-Ouha_Q)w@P&Izf) zewLYz!uVC#K3tpznp1NY|Dx%PI&}zoiaxeUKF1OFU#u|h5<+`+K(E8a_Cs4- z(Wj48Q%?{t?dyxb$#;!dlfOfTwg380JJKXYWL@<>_6fhp>XK((f>jI$pQ8nl0gNh$ zGGH&N#W1sBQV<&kud(suxmNlI{&3)tf(6O8?<#U8R$~8_aZk^)m+UR%8WvGx4lx;e z5o-|UHy9GfVi4~x?<-d-Bo-WxQyiU$pu2EIol+k~ZftCU8pFkbs-{r2$hb;3U}yy5 z!{JqUSkOYPNUP{0WTKphvF)d!m2Ph5xnsMP&t;CK8Mt_Ce^#{|bkz2ewyF`9U-($7 zcF>?wC&4$sxCKw0fZQwyVY-~d@VXh;Z5%gS{(J2I)^L%bLeO%129mH@QH#8%YByuw znJ=Ve?NnIpJ47MvY@9*M=TOu+Er<&h;oX&g(C3wZ?wIN~T~a|ucQH^{OvDzffX6Hn zK6FJg@l7c*S0U;zDtKXli5nH(T<)3 z_m_uKApByl0V`fD4!M*>hUbqm_Jo!Dg&G;kdk{8Otr$%yb0k;DHT@xvuPac66+kydOA&U2rI^OLx+oCWu-shnO06#>hek)38L% zMU1`?GfDw$3yDWLq?2vQXvJ+&_g{P`K#iI9>J>)827d2l_x0QR;x8Ke^wv4zy$hL@ zo^KXt5qAfVJJ^g}VC-Q9$uGv_gmDIz1Bk}Ln?J*w%U)HddNtg-?`K<{Q@E(j3TdzB zHN{=~?^wg-Ll;Yz`_!I!CXl(X933)CXOQc=epkQ#v{8IMp)(eDHa}0_KKAsPs=S8O znz!b$UZJm(4pbq3)Egw7$bGi|V)vi235H@3<7`;pj&u}d1%d#-i?oh=@?TJkwW;7; z!Ds)1vYBnu1cgp|^XgN525^%e^?}uU6(Idla?3^l?4y&O1pl$^ddhK{^>f7$_zXbbpvSxr0mdgtf%OaD#(Z{h36%+3#g(1Tu8Z`wAodf~&+ zvLCv4`%0|6R=wMC@cP@6Prmo9e=;92e)&Dlbz!=N_!%|w*Q*tqwhc!AGgbE2_2;#- zC93+Hk&0pekIYT~yJqt8^U%SY!{#@&y1@UMgQj=f`14-C@Ud%ikFEmJpl4179y}OL zJNC-(*Mvpa`h$@|VALk~X~m6i%>kPA!S6Q*5ar-cIsCtm0e3v$+6v%*>u-{(0=^*v ze_jpvaW(Lr?eX{pMW6B)mv24!}y-hXSW_k9)%?!{8S-q`NZ#{WF}g9r7Rj9E4o-<{K2Gv-4Am9XhaJ1?a^$usIb3@*%%m zc9G0BktJvV%_j|3^;%t&}o1wpftfPoo*ll(rl`X&Y@wdln53Q1-g zLiitqW5dP@$yI#ov;v{~?r#@$BfS0QH-Gr$%+2WqVEA2sxQ+fk;-qA~ye?sBd7es4 z)JV6}FxI(n>LjMH0zyn8N+Qdh*|6U)GEj%8V%a780CrmRj(J((?TFniH{75A*6V?Y zR|C5KA-@vPRC$T*vyY8MSkkbdgQ$3lM+pVI9H33v`bg7L)JTxk88qw>5L(o`sWi}V zf=98f>&UNt9yMTM1YooPS{Had1P(g{e6y+e>my9701auuyI%*5n8Q}_L0dzBti6>Y z)ioR3zF&uqqnyDtLVhZUNAoyP9MNifjrpyLH4nJN04z1aUnNb8EK4dj#}q4_{Xh#h z*pPzEjznkj%L3%!jegF8ZNbGaHU>Jw;hs9su0xWfhOn&?E(OWOBD^{zfqX;^8;RBc zTrDz)eSoWy1~8D3N+?n-wby}u46$L$%}!hHhU`n^0Q03dd=nObIMxzbIIQa#ErvJp4BM?6?3cF+R1*AHM)7TS#j zw`p^u!^iGE`!`z8dD*s66Zh!YokoA!3?4*Ia@vaSe6t}PWCbH>_gm>IyJLF^v z{&3^Iy1ad~e5)MueOA>@j2@JAqg%{8GFB`7oL(CqU_>dp`OV^#X@%ILN3^5zI;Qt- zNx(R=_}-GJSO(>H`X|+VQ{pe)$dTa`x(;M1j$kr)@6&J(2#GtZdZ}{g_TRs+*hx8O zbI>pnFjh-b)Zl>$c-6dYl@^)YA4Kxyj0uk%bHo^%PFvJxP^;jx8%K;hdAdM2FI{A=s03xPCvIOukX}n4i z-}YWp)r6cB-v8r>gV?$Pa?(nI;S=_D;sur#nZc3y){E~yvmW}p?f#p}SRYADEKH<8 z&36vAq{Ti*OseN15EYVqHKO+AA!}biPm5TilbGrtGMnehmjo6gVl>jQNhva|I@ZC6 zsFu8MuIds?S-C#B=9gHS16jT)K|;{(WyF`+tA@oOS>PRfJ>bf*)z(ary&&z@XZmvo zN2*R-&2(f$ns`M%SerNQ;2^eekb24W0>c`uul&-K^x(r!uHnVGDJZINm=?Ovejb^P zElU%iQk5V=3;eQkK`ODI4)RbST<0MUpBJpV5C~XreFTKa#dbJ|%R#xxP2wD+q%nY= zh=_E^;JmLi)Ga{o-J}5=cPeo2uu}zj`@pZ~M9hagRr;Z|=M4e;yCM;fBQqCvy(Ng% zmx1ZI;gMsKt)C-sJ&TbHM@6&^CaT%CmV@*G;}~c^C@xii&Y4GLs`lP)fZnCw_n#Nz zd_)AZMDt#0(&Qs;E*R+`U8rcp`v44`%wJne%sqwHfw2^{0g0F`lBPtW1rAbHBT68b z`TLxfZ1zt0%^>?J!b{U{@6c8n53+nftsiN}zX)e}WuvabwqHD$f}L+gm^(QA5t6{t z&a#!ye#u@Rc{!EXx@Zoy{A_#lI5KrkwuaV8)=KvLMCI3`{C>c$^O9(^LCL~LQ5vn2 z%0|XiTyi>FONg8_it<_ABMXM5%VA_u4lyPr&L9UBsXBI42iiDayAlF?oe)j$JY>(P z)yglG?yc%>0)LyAxoSH*4vQRVFGku6f>?M(1{?n~8b9VFn5v)`vV)S6Q4M3|E(jc|; z@0T*~qPx7vr)dhQlNz$tfv3Mebsx;N(m~j7VwP?lLI9a)hkC|=)wh>j?FZZ)jv@fO z7tszeO!q9clNw;3SYX9J+|Ihj=64Q)tuEJQ9_0c5|&b$p?BWSbeowJSq5l-gMoZ z)k};Jo=*^GrJ%#q2nuLrdJ(dlL}UPHLwBTq4@lREE=OM;)Bv$G$&RHkY2MZAT%zAn z5XA;c;t`n_SMYVR<#JSv7HM!o8Ustyv}GBMwV<1kwePW04_;$>IOmtbM)Qyrw;9Ps z6{)^L=YjtF`DPtzFVDyCRnUce<*+vFpeVa|5m9p}bnzhOmMuR5o-A58cfe7p4Grv?!QZOL-!t!^ub2X;H3Ae*`OJb%Su`h0QCfRd=ts^UPYU)e zYpfzVAQQ^XNdU+NWUg{U_ItoY4r!X|AJQBdjqbC+{j=*}gu@oS9f{Vy6^z2Y58TgS z=8v8V@+CV!`U{f&GK67z1~zvH_sGxd=$!eGFWE^THXmydX^hRsjB(mp_dA@w(?%m+ z0i%0JR)+L4yurkk>c2lrB${lESo&UY=mZz5Pl>OYhaHr}a}G6^=035C+vbL@>YY8& zcn>Sed6RxFx+g@gM(-^!Cn!t(DN8m(`cf={H2$-H&ezH|D=! zyaRu}w`HHA`BYlt+C)A2`YSCz(w;4AL@uq!&195^96;)0E0bSbSvn0*`9;w>YPn?Uko?$Em`+=m5NZxRTagNdsF zx=Nh=xVDNxlXuicGEbhH7nL{4a_lgfg0d3=^p6Bfy;FRT*ea>|H?dCS;R7TtvmDZd zn9Q-`Y`#BI6_=@*Hk@U<3~6GAMwu2Xx%9^8%8Mb*@*#HPQ2|JAge-vyDhm#+t$Qlb zcl2FZ`Z8>Txo_c&x+xL!#-!CcTvJ-`e!3SEZ0RSIYqSzGN1{u*O0Iy)$bj*yQ9~O%n6~O^h+)EFf$}QcO&9=KP1S zTb0P<=B`2Q7ZH+V;VvKGPxpZ&miytm4zFyFjp8`^r zBFFH4GXWAKx82#bGOTr}hKq{bsXYoBw66gmvtlJzFJ>L3F*|m-aylg;gCboSaOGJN zf#n$%u{cu^UqMglQ6Z@-vPEGCcZJ(C<79`$)8N|3T0kON#|XpFJSS-8@^IhRx)hhnK_^T3;1(u&Unx@rqAfU` z=~lDDq30r_93zuw|zVh_1fe4qD16A5a(%pspMb zZgX&Hj}5#3pe42fOi6FdQSpXSB0(hHpu^ZCs`~vL7r!*6)r$QwNsCNk&@BS6!rp5OSr*;{0R>(|w+nn=IUQUBY^Pz{=9gR6TO$A1zG89a@f)y|lrKO;NLNh;X+?;VYG?QSrIc67D?!3@luo&fl_$~* zru30_3uI?vl5Y++g)Dh`eoqQTfwrNDY*`!xwXg3m(np1>JM-r}C4{NBQwzmqnPs!J zA|!Gle`7-HimcaRbr>2<@)bOKxAa3DvXO&X{j1#b$1F8EV|)!u#iQ#LU|i?5h~>9& zap4IfS1h>Q?ctxhUfGSjsdjR~2*IM{MJ=g-gr;(^cgyTOxvX<6`*U%*->b1IeWZIx z%sR-vjR8`#ZwKT1RfawpQd9s(zR@>cZ(AmdF|R`1D0s2sM#Pfe*?Fs}|& zZ!DrMgJu#$m&hemfWYD$wHYNH{mnfDkcDos^YNc&I75SS3JD_l7Vv+*w zKc}R02~c(n5SOIjQG11l-CuF{rBK=^vPKy_TYum7#(r#K>x;_<3`7jadg1@e?)wZh zV%|JV%3|0s-^zm+jaZbu4n}u%A9#3f5R93j*qGZOYUTxczCLzN7pHqJjPMcSoZ2sgnJju;KyFp`A{Jpszbd-Q-LMMBRJQc>5oL9#05p(k z5lG)&y#ptB`e*!|^c!?Cx8h#C1V$gOlp!%H?xk$?;g)FoVdTQ8{dclJ!%xaRB*KIB z=9B>z;~dHq8A~iL1p8mh>Kz~4#w7P}Kc~CX;)>5FEL_#=qX$tg8QoHHSsCWC&iU?x z4WQqy;sNIdCO%jJ5{rDYSna~43|kxHX8lmtA3_OPAX*ld(w?k6jtO?)?wuIv1qlqy z#wif%$*drka-`NmVp!N@f*#f}>~a7n-FObJ4A47TbnE!BC{}1j-$ha2C$8$9=?cO% ztt^<+M$S`Oty1DMfRT+k1Msar;3h~nwq^9;24 zuB!N?c8FF#uR_B*Ft8&-S|r&Ee)*M_{V_!T$RtzZt~9@oJ(1*CA=-rGH5sxNak6(f zCkH5(BY!d7%l>P*Tv|pW0!*^=!rWY3s16l}WFn^G2_@cIS%49bn8EM2^vri9HL8#s zd&fBqFj!ahhpi<=gg-sRkMlSI9xIwfkQ8EpLFV!LMx;HVbzC72F|D9Um|C4j70|zB7Y*fBQM)%SfJfW`Bb|)Ko{%*Bm3Ec0`=`?X zIBJ->c*WV*Yp&)dy5IPdT$URVINn=EEtQklY6kH#vRa8LE~Mv&Lyz{qaa42tQB-Fw2p6U;551|(~ml-t~&vW${z-EVsh;}%^mq!nPUVZB| zS+Gc3Y|OJZGIr`@I8F6AQzG19s`aeMeilA6cIRGFBouh0ujk>Fq$4Dk=F$=Xt-zjY zsvz)}>nj1Y1J{VMY;7c0-&SN&3ReyQmQw?=YX&j^o#JEg*vFtJSDbel!Z2V$Bv(+( z`6ZcQH^TF=#HoGqZu;IN85iG;vIKa$lt6MVF}Bo9R6K(7Y`)HFM&`n4#VTYmhay+J zh8r$bw=`ZL+Nb`C!t`p13HoMSMHFb}vjXkeYg(nJ-vbl6>&e}K*+mX1J>0(us~;J^ z8!4i0%y_mOmE1G1Qn$Lt2L?SwKH3n!7%`dZuN$b3O?V0GnP7&h1$SjvgZA9f{hz{o)m(I$9_{4nHQX@@<(?}3dz&%XahQ{x`s{URm`we|fjItWd^xl}-qp%Qyws}vD!RBXv= z%*!M)Rb10CaOG@y+Pn=`ry@jxCO@7N1~~ZQYD~Kd2Y}!O&3-qSoE-afa1c`wg>Qt> zDMRRPPGZ|F%*22Zh4*VU^fmB(55P<@i8qDJx&hlCy-q)R>FqrGb|YJwn5I;1z5}_- z!SDBvy4-(gqK45$u}}|(J_RImIKK!DU;aIMyND9gj)!kEX2r+`USI${Kq1bcCDfF1 zO=3Xmg3rpt4la`-y5q?;RNEb|+?z5QO4EW2N*^s!WL&JjIEH6`jXV(6`}>yr$&}yf z@AGYr+{Mguc7H1G*f7Ea%i?TRzgXC)(SfbsRk+YzBcFqXMgv9_y);@HcMr!%3p3}% zW+&*F82EpkW^a06OTIy!RCL-7pkzyeRT3f~Vot%vv&<4tFmNh_^qL#2>i54E;u4w} zIVPfZlk_W&f=Ch5RzygT{^zqea843Dk8o3fc-uqvqYz8SV@-;TUW4`n5PLvuKcR&@ z4d`R3P$;aCJ^OPoY~v4*PHX;E3~nRn{mp_7zl`lHB&EQ=wgL!VCvf~|h+IoY>l zqCYmMpF-m_=fkEnu&9NZmLjs8f=!G>%TL@Y>{b!FRmlS?{Oev;1(zvS;}|f&sypMY zBHpV0Q;phj4vZ+~{&Rh%VfOIADe%``{Y_1DDQFQXG7$9HPKr#7#FlEtNNBS^#7FiyG-`Fh5j}j zusW~`;fzJtD0_z^xm%ke9R5B5&P#s_0Bx%lL}9C7j02Yn)Z5QeED6pFu?W^8b0I)<2ZZ?&46f4D%norm9i;WbeUNq}hZ8b@s7IOmEf7 zw+bH&HJj^T0P4>JWC5CYnFD+N`J8C_BlVxN775v`$uTD98uA@^RR5aKxTCD>aB(Cp zQ$(8=8Ch_Qw_p~v^Nf5>#orx@SO*h?y+$zrI%#B04@`FWd#8$GDebrY)V5NfPWCRd zerx!j->MS>f7lyj42N&9KRoi^*q|(TqI*v)?d|A%?17Zr{V5&gw=9ISqKwM{aN#p< z9J*|IJ3o>AyRHX+!HlTRCrz5Q|M z$(wW_(?SQP?RoS1SW1pMO>SXdIjDAw5m!&8Ot91DL$@o579u9->PE8$Bva*Owv@3g zNtZj>_RrYzxPNC}zNKz5TDWm^h2PNes)VoIy0oOHRP*q%fQJ9h>P*WAOL8NVHSf#d VKa;_*v3Cet7OVb7tn8JGaip1L590DD8 z0>H*qRaK$UXgC~>L?WG?okvGU=Veq;nMlgFs_ekmxKp9071fA>t75|H(oEV1R!U0EI-M(EkPs zv+_^zKVxAC7!nR$i=2$b``c>aI-e?I~||I2{?3+ zyDJpNqMW8!ozoLZC1ktMSDpJK7A_Y-r&N>o^E0PLiNVjB{DChBv;H)t+Jd34;_vnr ze%2O_WFi9z=#}e=#&Q)ua~by66^|F9a+TASzm-gu>eSjU_J1p#u0(f5(7&oLo2|7T zFEJdbFQ0F4UhhwT)ljk6;(5NeIM7hJ{2c=(WKe0WTI~uW<2D*>tX}^S$MPyerKx6f zAX&(6X|Snwdn8LPl0mh(Zg;#$qts}q`P=??bXn+69{h3<3<>9uL-^VNWU6G7x?RW2qI>-N{p_rO*7y+F2 zGgZv8L6nqd`^zKCenB_1000(5A&ij$5swyNFhrs|D}k^VoU1|P+SaSVRF*|1!30Iy zCaU=8ED#RB9M2(8?nN@C3ANHWLv>=q>`W7Y%a(gqSPVc;zGsbsPd7WCsC1Dtz;+b8oQ) zh5}t>W`mBv2c%eD6+ecM=m3y-l8w~c*aC+Z5;ZrX*&W2#Chawm(q~x zPwSXT7PrsUe63B})x4txb+SAg{+b8oqH=L+$J1!3tWUU))Ww2Ir!kMW*zK#o3CYKG zK;k6^v(2MWsl&U4_3$17NsFihF=e^lTI4^sz z;4_Yc1g5<|y4lVO<-6U<`{H=JTNLQ`!3I{e;<{Ev$bCK;{wxEvk+@y)XS!4^;l|)= zA>Z9eH>K0vc3ULWAIJ8`(Os!P&?v^Vo+YSd_7E{C+4pb+MM5VZVPxf)mZ)Z6pw1o)K~y$T=#S1pRy3Ha zKMPWw*Fkx&TNO$MK}L#;f1~uNLNE#U;T?v^K4BONzw65UbzMhEHGC4GLuB}ff4rS; zZ&X3PEDKf&>E?H=ilP+CF^SiSW6N;I- zl9sh}@z3?gf+ca}g^69F1YFHwBX~;n3R%X1CM+@w$ztMHv5vF3x%Atd{kXfIKBMPz zWDTy9o)_@P_0i^W2V3>YmBb5DcrvnZf9N%;*$I`khf)0~k}-)G`yws8h4Z0FMJE{J z;Xk&4ME#Uh+dJ@{DO(p|;dqHsANTgX7~mOt*{8?noVF*)$}E=~u*FvLsk@97!FZu) ze*f!pR0j`BP~6QcOLkkcl)7d4_F0i9wi*d@e>Oxlc2u9nJJ_rxm`Ipd55Fy`1vEqr zg0%sq45Zb`r$MZWht%pmAuh@HD#gksYym_NO-FD~rpROEaSgt@0{o!@x!=&S_N;MF zvgl2TXVY+*&YE}R&$vKBw^RxY!y2S|HbRBX>gcoaPru6wwO`Vd;i>Saf)ep$nk-Sl zYY7Fo&o=3u2-=-*g+smx7c#By!E>Y)-C*i)4f^q6ox_uoQ~6^4a++=*_IH^BwjLvRSCTVPi2YrckEP);`O;yhJ_<<=GEC7A46kp1q zb%3TM%>6)2R;`g}o?{NxPL9wjknXa_ADUCWpB1ik+>Erc(UETISFg)eEwQOC((7p) z`Bs;2>-ZsDrgKlbG#tmt0sN}m>Oax4$KhpTA@ivEt+ARVdnbKHWra2#G506DhX#gE znZ|P{;xd}DtBknS&a@L-4d{mwql(Qi`$_0bXwb{;l&BDJ0jx523hf9OP%QCQV%*MjER z*HDj5Sgl2W{vW6G+$c?5(cg7$Q1=W8GylMz;|cZhDX8MNFCuDsebjy;$I14~`NM)m zX$3Xv8f9x-`b|R8$Zu7TefcVH8^=gK2wy8c-Pipgk%MWy+!8If%e`%$^V%e`3yt0r zd>h%|>*8MfI zg=cYWGsq>pmtRP13n=Hm>4)FOG=|!wQ>y&^v*uYo2!RMY``=fs;NX);eB&GyZ`D*= zfrOTIzkMwmvEH*r6)T}m3vW!FzuOXz9R<;$Y(M>x(k>+yt0Ad51wJ;IRStDt%>0_JL2E5DJUx6>uW!A*7k#Pw zxm{y0z2&Fc$e-PVAxh}M?(1jITUOQ+{0V&SPr}q%*C?IbzuN&0Ow~~4auUBSYJGNH zr&_jN{&?Reg+74XG@iFUyMFu0V2A8=*s=_Xd5s6zZpHW3fn(75P+`mY2a{_gjq^$O zhZH^H5c;E@HRq{PgPM-uXJ?7h-YpYLS9^31##aa4arb+kU+}+3>)03mS+AUqt`s|y zO)=cKHm$G875=;N)%Xi)Iniyp-ammJ-BxQsWkHDLMT&E^H(fHPcs3HO>vcQwD^I1V~KzBf88u zJ)bYh`6Xy+;3xaYPno=-3fy-O-1r=rEh0yb_b~(dHof|dy(RKP;jpJXLUF*(8E3g^m`g*zDsBX#(S)xk>Wz*cj(bFTLWCN=VSr-f!c4UHb|Cm^ zv@Sl41+I`$$P13kx6H{}2s0z;-JlxnK(~g_SF>)aDG^zT(Ww%qAv<5jMUn+lfEJ2Q zVG`>8mcC}xJog+_-FP;h!YL}|U($oW_|K*+UdMxX?QYzoIbOsgsc0rRTz9BkdEJxB zlah$CeeN_Os&v03-niE7rqs{I-v`gwXojb_xu;JQDdaMF&5EVrQG%o7sLGq{g=W%< zS-&zwp8RdA_tV9!$ z_o_1~j%`OuJ`nuzBaCVL zvk6jxH#gZQWFS)I3>E?jcD)=*nrLpXH@tf}`7UvSw^A`rbDWBjBy6)eODMSJaseSU z6+(FEexXYd zKxSl*InoR`PD4GJN;Mr(K6nctMDZ=oG4II&dC+BF1S-PbRBRE@jtG`6=oPZY@y^Hd z^bt^B=v7v&0v=_tKaQ&mY^anT1&z9K|GlLGa#vN$R6z%_EXBYC164Upm7$NTNx5ku zUxCs{PCRehdtp-uP1e7z2Lhy#jOwmHwy&Hw)!@G-kkdEtCz#@* zj+$VmZyJO}y<-3_G?0~)@%#xiH z#!znh@4&`Drp7>hb}9fM`GP5in<|dBNog%V%eF~+o+_oZX-}XDq~5gW(&YcRIft7r zjR27D-JCfhid@93ZOlnwfzqzmbSG`rq%L+ zknZO`<-kB|%WA6yX`8P=+r(GesZ!RN0m`|SwuZ5`KH8QFulH-Tg&X@#C|c*8uk9+e z?F?sa-jCZ)Bx%nGTMi|uue`sL>9xUn0`SfVsm zG87$^b0fhC_&EZ^hyc+HHjJJEdQMvjKpp2?9b^l%PZj_&CtwsDu7rXpV1dFaUHT}n zcv_c86^_UtPy^n@2#3?0fPKCK{0M3B((OiN zF<9s^@&U+Ib|2HB&HfZQ9W{qSo2VPF8# z#sU=pIEaUI2~+7ATGa`AGdtQ2EJ*0n^1nP@|y#TC&{mn!%k46W+OASsK41F*dtXbg8?;Nz*9~>#8#vcVUB8H|6hPM`e z(8blfo<}UuH7?x^B?5s|CqQ{L&bH6Uby<%%5&|yljddAt|1@y2K+%2%qyr4zq>cVI z0BM{6jlT{4;id*X8?_Y}q08zgNFV#{1ExCxwsKb-KHN1PtBggNj8T=3arzF+VS$LM z5|`RiR$pqeDgYhk$5Y?&YXguL7W{3ngekg-g?>C32$YEf<3*1v`VJe%fi+h~>Bv7a;(PW~+!G*e=QgBd`eECPqaVba!NNNyA&b29Qgz1irH z0?j++@krc!5h;NI+bvH2_JK&mO_M!+`fiZ|eGes#n~7+fiCUbAxu1!npN)Sun_xIg z3cv+1&!n6JUK~zmI1IDJf%V#6xZJk{4^f~Ofl)Lr3~{rCk0GWfvo(gpVxtg}^kRcY zRfTO7#cgx9Q*!_V8X4qdt>MBX53W;r>3z^psmIuSyQ(9$d^XV^((SM?#XI;iZs7&N zr0?p&$fEsNy5chw*p3%&WWO{SwdCguQN+wI3{fu8BURm^(uHkSd1;=ZM>Zb;wuhE? z50^8d!H24IO^>Qu$|+8xpPe6mQnOyJpr_G;LH){?^i@_n?N@z=Aa9T>$8D7OuVvTX z26Jz$blg)@VSyRZtGHQfWrJ(ByimSqFZ!bopq#mirx7d%h$+{;D!ru z1N$ZUqiOl7VQbx$=iVzer>kk6+9x8*+e$C<#3dw$sbK)HP5Bh^X!&tY4@`a4Y-w5! z0DkR22~edZYa>S)Eo*yzB6>(p_@J|C@_F;CKg8#Loh-gbhIr*8-`3vYnt1vmS@Xij z)2(9pP?{U1vrTyo9Wl=g>SxmPdhWk(Vi#XZo-$)vWJzgV*pOa-BiAv z0KScpVR*yQLFN#Uv28;rgA&VtkqHm|`EuLVVjDfamvjoO=G*^zwEe4nZK&cXMfxzq z5X1<`YFgX3tUi450aMhz7tfX=CwFupiqq?`e?WY^TX6(Eo>oQ7by4m8vOBi$KbGB! zQDTpM;5+aDpM3rVzBfjk92%X#M~*PVyDXU}zV|p%RWV^ll%&Q{Ri1m8R(e9^Ib>+1zvnH6puelebqrkqLUP(jW+f|99y7EK&HsO#5n za~|ii_TS&rZ^T=yPOH-V^IEWV+oKa_DkcSEIUPJbZk7R0@MKWOD#Ozme}^squ~oZO zGP{6*ZvVTlzI`!vTX8I+w_Hsx221q&Gx~8@A#3BE%tbfJZToZ4T#~z)%8S_%vR-5I zzRWv=+Pjc9ZbN?oTCn>Ary;`1KL7#b3Nira5rcdf4BHt%2*h&}hp%D7pHS1(T_aXs z#Lzz@H2@$xUdFSjX2_?It_B9vgIa^AHMUezMI4s8Q#7`R0St5x5E{)LRE|P4gF>q2 zu6hBIQrsH5iq$O9DmUs$)!NstFl_U~p`F@Kz~vgsQ23gZ3jz>Mq^2vLnszsmZZAz* zQ*w4kI^7c!Nt_*{JA?6SAS?0ProGYh&#&;aWI_FjyvDt0y62X|>CZks5CJZBMxM|; za5*F3B|1~(hTlWz^|?c#Ar8wg2Bvr&W8Bw&9hQEn?2YmcJ{P5>x^dm2ea!7gXLx(j z`$J?9&hu#@FOqs%X3h8t? z;r&l47s8R8)sX@%kcge?5;~@hPbGp~ZiisX1|L#6s$g4dxs|ZbpR*-Wh<+)F-e)HW z7G|2?lD(2~`sJ#&(L6{@AYAyL(BKP7-$N)T(c&*v<R53R!4GUR(uQ?54Qp_6I zeOEW%8pXdl`n{MC93jT(rTZdfCN<`sip~Gaz$&3|=vw`Dm@i+gNmvVx*MqfFc>5_K zgRLXKS%KQ+_3pfE#jg#|W#5~<_}X5*eczTP8jJFd-f+v}=grhjxCJx1oSC0OXm^9w ziM^~Fw_}_;YpdURImzW-c_T^=zj^KZem|l)t$zND`t$?+^OVt#;NP4M8`4yry4KMl zo{l=Z(${ZnB)(S%k#HKvDozOD_*~XOaT7K^b!pFT&f&kk+w5Xd^WjV%^teZY-|nBj z8(prTHTkvP?)?Ez0t>&MzfD@|o+?$t_o%SK{aTb%9(7}v{PW1y=O<8y%sY%L2p&3U z{7qkF`&sN?lbgfuj34jmd4SMM!rUeODEZ`O_`cU)?(nNt?Z!n_e4qQ}Na{oQOUYgU ziFcCR>*$EL-|wUOK3@FET9mpLJ%<4m@$Oy$z?OWVr5|r`<+ERsQ;8mlICC`Z(@*#P z7GFB;4w&qMyT)O_*AA~u`t}WW;@=9hZjH#i#FHh`DEd#cX%vCu!xWz9nMCa|5<nJAJplyEJwy_jut@OgrA{xosEpzQj&>+I&v(Dn%8 zg)R9+aVf(lV&jPVk4jcF;Whj=|JB&jwB#BM)<@RL+TWTd3w0)v|7%n4_fj7E3w$Cb zCv2_IF4x@IDV{kH*ob9_NvlFh zUZCdd)AoooCQG}&85-f}YxhL!7S-llpSIz{8M+aXmXcH?8QMc)O4Xt_Re!}1)3%Zn zFk03>mBeit#%!5L@Ybb1p*CGL&&7395xwSKmp5rzP70YnP{{(01UtIrOB(KJPd88Z zIC^|*G2D9)2#IU6e5{PtKQqdQNE8)0YRIAzsWdB(T~?WWi~HI_tUtk2kBVDMjUIAr z)yVpQj|cRZST@k0dmIiY@OuNoM2Zd)X`e9@MEbAm~g+(^xn6}pSZ$d5ay`2J@-;huq*HN*lry|AyHIx zc&oYcX0il+9}t)4Ze8J#KNxCRqZE~9;TE1eU`+Al^Ve|*)IH1_R+GR1o`yv};MD{wyyuu2dEdDol{r%W#5p z1p`*X$PzL*AIEL~8N!hXv~zENmqB6yVRS(>uTPxDyiaYHtGp3=`M|u*yb7j)gK*1E z+I14K1azDr@_$V_k)qTtJrgH@2;oulW%0o3rT5%qyGMP);-ORMpSf}N?NtKGcKPSO z7s+niP5JJXV2VhvR~8Vk0pBwz>gend3Zk+12g@sh0Mes@P*%*OkJ!}^3HAHo_e5&p27<9=-u~Vnv131(bLax3!MLu z@W_LoqmY|z!(P008O+(Cei!-AeVf4P7X-V%45eajEh`z02P+HoO)>#Q@^699ksohA zF)rewLbg^olxB*bf4rT3ew0f|q*PYqdvLtSM=SB)-@xxDw8+8F&;Q6_Au7l_?q|2Z zxc?GjC*+#{aw9=y*gQ!j&II;RkTg^{yd;3ERp{A)P=!Sc^1DkL*+wPN2A0B2rr{h5 zWo6CQf7X;*Nv=Q!1A6I;E;$uRNmhAx+HM6RIyw1nMRHlBTX(o!x3Uzi zVnVl~raa&-U$#sBbF;iCP^!NOaF9y$yGvemp+0RS*qV>ZFh8HEEg)_-P55eTDNq7Q!1^2m@8DUs*V zea;2)0YHMDKMRBUlcM^_001UW%mASTqY6van({8JMLtjdp0I<)hyPeoS#<6z0Sp9i z2GZ;NED9QEH18vi15yG2&_-pjn{*hWrTn1(yLnWlyks^JAI(BzELmTzc}%w^;WzVF z)NuoS2`V9F11&0*{^QEniNPJ%U@ePEEkpwEK(U8MAm*_MjWe+CK5cN)eCS=-D;jHn zw|w2;!rC3)chb46L#ZZ%3CRGaEFih(z?A&!4HY0;77z*-bqE(EYhhG2oEe9Al!>FIO4!bmElu5HEL(jqsBq)$l+acHSgkKzAo8Ca@B)_mq!P$ z&6O}X&i)+mk%xm3a%bQpX8|kykt^X*lMiY!jl;G?LrrI@e_E4QF2W#G{$wj^f4fm< zkWm~e)aAmf@SOqhlQ$5YSNpBfq)|Q96aUIwdi+H^JT!(3)kl>7=FA5~Nd=r8tO3!# z**zF+A5^uB?7_$tMVXDYxr`-ZfTv|+?5eL}7=OW&hfybuFxcVP)!kUlpFtM-YF1u6 z+!Y{P{51!g#)dqQ3aj+r`WW}(AWynHS+p9TZ~dzd09EpsV2{Q|cK{h)k(|DUD2|F4 zeG6~mIPUo`AdCy%H?Bah#I^7E%-*eoX06kc;4j*9*n zSN=8u8Hy#F)FgfN3s>A<0B2GsdXQWvP&&9)T|_Irc|yfdYteNK7X{XRqCKS&C?2iJ z^-PR=NNZ?e5`H*I`+1ZTZ^|TJ`{#szJ+qdQ)|AElfMxKw)n?5~RDf{NlxwsKHFk=> zOUse%iBqte^N?UK-P_*r&S-3iY03| z(h*4YOo#aBxK6y~&;sdO2!0%5O{vyYz9frz^dvw5PeM`$N!kZ-26;u#c&pCR80xx3 z&4ja!i%?C{cIlj%jCi?b(Smf11ZF;6YLU5M-YV#R!NCYR%=+-^C93L4xd&|L={ijQ zGNXBucBqriJNEukm-f#~hQ`rGDZRYlS=T%KcinH3aR{pE=YxG_Dxc|x8|u{s50Iba zMh5FKCCqsUQ1{8?&h2K;p620#X6Cc!V%zj^4s{#;17~U)^xR9t8-BU42e8ErRDj~x2w&WPvd*B!a4x}ce$Q8btY>L> zb74PNzv0m6IB}rBuqO2~L+~s|5VY`0aG5_Ieko$SSGO3@V+a9b*1s+P=~=#;G~S42 zgFh>a zX|Y84zO&Iz;tE(>AD?f1Skr$4>bb4u044WP|>yQ0S zA4-;GEjP6(mgFo`H<|IE=wI1vbCCAUBVTk#nz^zzdX!gB%<(4&a`9o!{L|Al^ZIqv z)ryy?>2rxqnOB?cLgv}lo59YTtHGP8)Pi^z^N{G3-Ewo6b_0Xn%~yUKw9?xy6qa8$ z0)&05%<9dA;^|339(XGE%PJae-R)C+-+OEF2#0PC@*8*#u%js2^Ff`}bJQ7#757r#+`OcrI;| zk#1>RzLgSV!{um`vbCH#4$%4b*4ttGOP&p3v2K;u7Bbq>AJ67?6zPAZebP4p9FIOWC9b$}wErVLS>k7UZ@GKkyMOes|Cizf^xGM9?3`2~ zL4=yXdFfI#;s4lqmEyh2R5NI{z!})#lu%&*DRLhmc6>VJ48uKnOzHTS;^>dUQS6&z z@|O>;Uwn>vEzj8BpK*MTI_g^+b;jfG15szX0E%5od!3p8o-pB_A+}GOiO(NXy23cl zQsoX=t&Y??^$fq4tu$Yfb^wKK9K&N zUFK|S_eiI$=gi`po95Bkulj>EhIhih&&Re7q$%A8*)Q{G{ed1c&Kav(e>KG^)@Fu_ zeiXQQw7J_1yI1ylJmqtb5ja)*X063dv+uC4S z=5^Zs+k46@qVLix$zZ+e`)Wp}wczI4oR_q^R&-r1-tE2xfzvbjmTPBiL&XjES0&Sb zh8xzt2b_(P_>RHue~m=(X~&6?+R<#@7!Z49Ztr%#|3!w`Rt@n`3cb71`VjAU6ARsp z53wBj=;<-yHX`=0nnXkKdZSC+CHlFZn-SVI#CO)oaY_?(ZF$%4;`1N-bzkP5Pq7to z`<-58d~)b@yX3=qrRVA_nXYJ<87>|KgiFd}eFB#a1OPYzwVr`Vo)s+rUjn`bQdwnOaw$PaskriPO4g{Z@cM1#`HuVY zSt7$*@v{S-YP;zNfa3NE?w7X(QB_h3XG#40l*dL{@zBNXaT2@cf~m=Nr~Q!V76*I4 z!#2%_x=&(gr$6~ny7!!q-!cY0j^EIBx6!hu522PWq;sRu<1`6+6kx4GuH5?GRR3{w z=qI_SFG6&^KBxC36Ujz-vIPCkPFnUWKYWoDTZvP={6-VM?|$A+kzjUR3tK!j`Bq%n zhA!BncrrUw*A{Ovm?1*k!rC}MNt;A)(6hjd_GcLTSBO8hE7>KcVBJGX@B>H2hozLP z45UN~SwhcGi6R}Xt8WYLhEu_8xr1*)lXBm=*lgxLF|}Eh4Pq~}K}%sq*^6k3@y&{| z3IJf!v=ZB8m1~@7j#VZpyvfE{rF#+Ti3vvvONm(12+o2IQptnra6YcL{yh&| zTNNS-+!T^-wv_ND?G94vZyuR{AZIMww_}C#@*Gn|{nyE8e(t7?11lQ`R0HA$Y|$2bzN}ap5OUvfNcqf!%-c~k%tl8uq*_~6GrauT`4Jyv`K8M z`VH1?!evVYS3YzY81DYPZOg8HTkGe!L)QCR9faVdlQ_zkcIgDyzKdv5N_{Wgx^O5x z`)jd%TC92MlHs;)QozcgvZh>eS!%6)nNAq;z>*awd2P?NT7H%aGLAp#E?urZ#V|8k z+zgOOe_y$*thl`h5Ib%@|HD;yca^FQC5U74ffAA6HNt|gQ!2G2y(Vv&i>j}94}Akn zvpl>k8WmI>0z<(6;MRuc`z|MLf5#c1xGVoU!&Mht9}`)142S{49_;$xa?lEU2Yqiu zfJb2FqfhG%AJ_JeQK^TxVs)w5a1r@dijt=6n^UtY-n%=Q2N?XZ1Q@4o@kuneA zBS!}Ek~%pju+YEb0Q2FQmULaispGxzrv*F~5$;ZbhXxOn3;O}B6Mv?e@ zQ5(Z<04Q_xKLr*PSKhGX)i0a0- zeu!59@7;1B!Ca&Mq;*+P!!T%!(hz>tFC0tLLQnG*5Dgv^@a`Z-gg<1+du{y7Eo4nW zj_VhHL>)*LfRSVBr-A|ep+sTZitCyq(XQliH*~~`W+fW7NuT{;o&Ydl1;V!QIv)=k zKx_cOJjS{eHb|-R-D_!#doO9S{c+>c9-7ghWzPaiA&ZG4Yr4$%ULbvIpPgR-CdK$eqp+C(@ecenOu$4yR`XOFpNDZIh!XjpNtnu? zf+h~5M{S2bZA@>ECw{JJRYed#vDVG-3~Z5g}TWD@5-+%bO>ygXMTkmyH^`*oWuCHR$Sq zv5h@^FA!o{JnNf7jlCZ82!Y*Yjf#EEd#dk;E zc&<0;s4iNld{_D%&4l1XU9knv-kXu8iDGGi5@X*rt=j*FDw0G(&7$py$D5~&+Ak~a z8O!XR$)ekz6gm0wW*t}v&4cdBkHK4#L+G!0)9o38RmJ5iCO`OrKeYXEV9oxIg5aR7 z`VO35Q>V+qHP z#FY?E42WC@h;LeTQT^F)mpu##^%)JQTa)Tc0mo49aQ$u?H>|LRZRFio6Ys~pMgnPO zu*CAHs}8cIO#yhv`1HdTXQf?jvCd znV4<14Kkh^2Mr-0MHc1}Wcg-xd}&p{QwB;gD*5a)gKxoe-Okf zPU!m$2-ZO$oQ1LBPdUYsv^$%r_~2^zslcoOILvVG?a!Gv0y97y9i%T@|L?76kEBsU z=IYU_-9M|8-Z$sRca(V_??oKH{|SGyXOnq{Lv_E1cdY<;*kuHZGXAZ`4i!@YYM@9Q zwAM*@IW|*kQxiyGOu&X5<3)pG;OD2yNB1)jJq4VH$I$y>&ML20ufT3!5PH47>d7MVLf=RMa9WYXFS5^5062X={@$-p-e)|f zSY3C?Ch#(OV~tiem?XV5xU0evgk_OetRBoFNlIuauHL|I`zR^G{qXu6oQdd(d*XMp z9WS65y6hjUCU=QUWW6z9a{ze_6U$TvzByn%Ux&bG1y({B0LO#x1+mSo#$GdV@ZsY` zWCuEDFmM3;_?*m2A5VU0tT6LmNN$ld^J-d7%%vB1KAJv%&s=FExIk)}R)nov`D%z;SkT~`dpPHt@c2I>%GZfm{C9Ce*z#W~=gUv^iV|eU16V}4 z*!(d}L=-uFHf%=3pWib4FoO1i?-e@^iX(sVLIxfe0I1k!nYKEs70BZ;1ZXO~2NUT| zbLol=UQ<&J%Pl^NKEf+ArMvZw&3tPHb>sLKHc1K~d%)qn#;>PaUDO43#OwfJIx}Sx z2pSuxu*Jck;Ttx6t%d0Uaw3i%(0w->&fdKBmYdDye{{+H!@Sp(nxEz>P4 zuyjt~CyrB0jzx)@;S?+O8%KcN4;v`;Odk9Bn3V??yZx}GzW74W9LGl^PCxA(zxFNP zBtwYKs%*b$3ug5M?}6jh3zUBh(^I2-BgfJ6R$?PQ>txI$oFe9J8S7BNg`oIQ-=m`U zuGZa;x7 z+CkYmh`AsIWD{#!7^i3bK4;hW%<7lKR=l5%{!liKM@#~RS){hj)5FMj2K`21TS*iz zvi%B<66K-E$n$FUIIrzo*}WKB>pYsL@n<_J57ygnuy6LBV77M04vL>&*;qe39f0g{ z3T)HR+kW;RfbhuY5F>GdFz5K}1-2#b?KTC3++0b^S?OtAdaYfSpukzx2f~Wbe zMntR$l7de&`0P%F_W?zPdWNL|#A9^!k*MOT%tJJfS)T5F#;?gSDgAi@o)nFuROkpb*cN?^*ZOu*_rwn_hy3#jru|YB* z&G8v$@*=#uO#7hG%f98TB*f_8hv{CEDMzpC5;1Dm%$G|fr)UiM^jFxPmGr(>Y6)&S z*QEjPR4VD`XV{?_h|C_(*wJiCy{xAjasHy!|j|@B%vXyy%erTUU+p;Ltx~QOR zV(Y=K?kx7gpgb!hUR;10V*_xHdFlZzEl=XD(kpA)+jI5YnI&bwNysZqD$~3i)z9F0 zZkcD8G(9N#W4WJb>Z1G`fvtc|ifMvzh~QRmg+oh4d8ll~sH4@V;Uxl}r!G&+RSJr> zOj%WHIDg5O7Hg|5$5%`x^U*xAhpA#7N9Cg&d1e<2l=K{5R}oTr^nQugLDx)zvAZ#qKpuJ-UJ*sYc- z4wm9!Sl9_!_VKReEEvJ^Cx_)=c!?03<2|WCIqG!J9`<0wqB+H)u;32aDB!;wnglqm z?pP2Aoe=O>6TU+H?B~C&>X02g(XJXXcwK;*%hpUS6!YTOxH~aqFQOVhNG#_k%dGyT zfI+)((>7Goc1=E+;r%=aeeh%cE6qmv(jxQD$qS0m#yO?3%0J_Z{Sq&~mm|R3us|@A z)FoQO@?4PhWeuyEU>8)Y<3B+_9Z=s>hNAEEs6CHTkk?6%75Dsz%B8{|u z&O5^a8cp)K~GW1%7N53w`Qh0Sph}aS9 zpo+NEb~(;DK*p9R{}p)Ea1rlvSO;X|mgQ9alCB!NLe$9n@_F3PtBZxKi?-Wp4d5B7 z@Hl>R9%7E=YOc(?E%|fHRWO2llA zXil1uTj<>0dPKS2K4T$+-OF=fgCCb_FC9=;B8Jly(Zu$1|>(zMw zw~=oigE4U~9O{*@aroD|W6h^Lr%xuia?` ziu=1RXmrneMA({4G{m*cZCdQ6qcX;-f$p`t)_DIV@WzbrgZcZ>Fxn3nMO?-~e9Jn@ zC0nz`6{`v#tv<2ywLnWB#-5rVd15?F0TB{mv`sEwod)t=8@>PeJkiq#Fh|<>p1hMU zy|8$H*iGZhB97FS?%7RvO+F6j_G8OcR-|J@rOH4&YKrSNK&Ux4ax;-}BmezO$Zx^p z+giQ7;`dhcF13%dx&I@@Z~jVnT5KGiBLYCjSRCGK-{S2_RN6FW&=m6To5WqVd>^2X?W0hv$uS)&UDN1b<7xtJ&*w&}IarS^7no*NCM2wU>r2ON)y@6G8G zvq^Ammj1oUpUK(vWp5ysU)%Cd!2}CMlne>25Cvff+-%d?>stnHo$JwJWILmTPGhvB zJ(Uf`zTZHizBk#+eS1=q=i<((t_<4uxTW_#jI};0O+M3K|0DQLa~8}!Tg%(4^vv(L zwPTuqlKbxC-St$Y)1ny1uUK-34iXP>zeKr2B##A!6|xq1kKp37H|MW*`6~bT^6p#h z&hh^RO9Zt0B)sBU1!TbEM}FB&J_X<=k;S_I5(&_QG)Sxa;cq1FkHqPRfP<_4!?C{W zS0Cn|UO=OZr{_NMuS5kbzy@%<@4ws%wEpM;zL!r`?c2WRU$xvP|1l;&3&39Csy^;z z0LZ`o@N*Q?N_$mmB=@(!Nmw30tRNwPU_pZi5hhf)kYPiI1x-Ytz+%Dxix)9w)VPsj zM~@#th7>uHWJ!z)04xv*z(7lv00P96Ig@7nO`A7y=EMnrr%soUAuSj z(v>^ZK+%v#leQH+m~dgkhY=@MoDsqU3lt)J9XpvaSQ9pkENI|hac9pX->&4_H*aav zr%}(`OVlXR&#z&}mOY#HYzG)D0N7x|L}lNVMeGRSBSV9VwUH|h9d|U$)X$+ux4HUd z>%hseXV<=+JN5((GWggKImU1E2`|`KL4ksT3TeB?&$=8Wb?4IY=QmBgrC*SMNI=XzHA1o@ z{qjsQ(m)KN(-)l|L~ z^{CNKS#8zTS78nF(~Uws)z({aJvG&iR*luyUx5u)SkGqFsMcJOO;*|Fx*XQoXQ7Q& zTF_DwZP{zF#dcSYdY#t&+i$@Q*VAg5%hud;ZQXXGZpCfa-FM*)u-J@_Mc3YYQEfKf zefjOz-^Av{s9t;tMps>p*!@@Gg&A(xq<}9PxZsJeJvgI;9nM(ejTMI2B8e#uIaiA@ z!kFWeQBGM}j|Tu*Ukxtr6mXD@c z>8GKNIy#xBMdn&GN_FC+-(N6m#vTHV5?YH4Rn{Acdj@$0L zqn|FTCNvPafRx#TkbeagG&lT=L0RCim;eDbHMUUmxEX^UXmI z{n5@f{#^9aQJ*goB>)&`-SyXDk6rfJX|LV(+i}lb_uYAyou}(k4_^4uhc4duv_lE`R%#y-uv&t4`2N8$uHmh^U+UV{q@;z-~IRDk6-@z z>961Z`|;0T|NZ&z-~ays7(f9Ikbng=-~kbsKm{(4fem!v10fhe2~LoL6|~?5F_=LO SZjgf=^xy|U7{XQs1OPjGKI}*U literal 0 HcmV?d00001 diff --git a/www/crypto_files/crypto_backrsa.jpg b/www/crypto_files/crypto_backrsa.jpg new file mode 100644 index 0000000000000000000000000000000000000000..53fafd777c8aa476f699b746c94ca6488a6c1cb5 GIT binary patch literal 6750 zcmbW&XHe78*C+5F1PC1g!61Q9g7n@JY0?u=P`V&0O?nBvN)r@BI;d2oDgx3WbSa@1 z=`FN`s&u4@vi_fEXLn{_?e6!^y)$?2nKSd5^Wt93TrC6FbhOY~00{{Iko;S~)n7n| znp)jJQ`Jb{;5L_;373hTr?$SJ{KFclRgHSKjeS{fQ!HYR3<>l`;> zoE$fyP%gL_KNpV(FBB>uFDN1*DI+5T<3}nXq!h)ZWu*SogoKKUik5~JLPrOY;)Zfd z{Xgfb9blvc5`bV32@gQZNCILcx#|L7|IFkh{}teWhJ+MEMos~yq@t$zS5SKmASD5T zNXbCtH)FCZu+BP%D5K;Bl@(A3gKp>+(6j7?0<9-7(gyo1)}G&~S>ZA(d?j4i@qMCHr5n|LvLs zXh9_Zh6iEBQhCXHjx*`7e0`jfPkTxRSS5krFoG0vl+AHh(cWCVL^!G{&bl zSaxM#$J(1d{X3D{wP_){1iQgzO@Uc#Rh;zE9kO|ladF|7zV5qlC>NmIS@9EmM*_^k z2uWV>27XhQ7YDhyMdp^NPs0d03h#JEkroH!pSWwwmK^ocXcB zk3qb7(JC+Dw25Iwz{%z3c2J@=Ma{HE+J{CT?u-Rs2FV_;X2Z4s6RwG;*H@BOY~+a~ z32S11rPzzx_sta_>?5p0Xc4;%KEiitYq;X9i`3-9LSGS-Yir%}9_l(P5_TdG1l^Y@ zye=4~_bOf~F*iWG*p1zBS#bumJ>Bt=BfIMZTk5{rcQSdh9DzycxZ8qC5@-)W3#78^ zm+%Hp>7@x{jNq$2l5J(5yZwjpACl%zYag? zZ)_CCZEto8_0N*olsgtCOf`=zC&WB4-%rgj`Z=VW+#epVznghWIYevfkvAY3Xdy77 z`pB3$uGEo34@8L16KRE_-3&ci8)KJL@Hjj0(JKaAs}+9^_}`?!C(&)QA2;WGRi^d% zhB1q>G*>|Fz2LKj2xPZUz9dyUk-&TW69evJ#W7lBJ`bP=Y6R+Eje+k=-tZ)Jj02Dy}VVa)jHQ*sC%j< zdHJE@2!7J;ov+c#i#x7g7YCeWGY2aNKsRo1ni%kVNQC-dXSxAF;J@)c!@J8bn%9SQ zjW3|-26==v#45qh6hgf_*B8QENl=;#iC-R5>2D?d<@$&5Gxum?+{&Yjx}tQi zE2K8N=^g6tg$Q?O^IY3fyq4$2+#; z!@;wXcaZwTLD%e7kiv%CK{cv-k?)yTbG}`|Kp&3cp49YjFSBW%K2!CoChW6@jO{72 zPNlXzHhijNFMF$+_MilXs*qkbzI$>ipQ9_3uKo9YwChU5j8rO`8!=aTEg-^$Xj{5* zc4wjMS@$w~$J|}t!1UZt*$?TvY7<*=5QI&_+cmDE$iz;F!Q`Oj4Bla`5cf8OSrY?F z^PfM{KjezLrcLIFK$Z#5FVXaQyYYetTajn71E}%!o_@77{&i~F;d%=G&D2%3oGRiw49W~jUjaopI& zWZBdL4!Wy!<`x6aZS?~z-4%Ax7Qt$pZ0}!@1Be0nQ7A3F5c6jzm~GDJ_KjzAYo{Yr z*(W-)U=eI5G`#PaGtH39x?biApnbG0cXCv?o6DpJpR;e6yIv#(AvpQ$YD4&e&s;Y- zp}Ac-d%prtdivBgEJhv5EPeaEy(L-KS zUCk?1y8MFrrsS}v+T|u5=QRDY8MeyKz%-A}->$p1?V(WW9^=P*?&6#3U&WSW*Dibo zh%7)QfMHQZQ}@D7`0WXaZq8h~%Tk*;7AfDA2&N4e!K~$m$DlknU|83ncH&sn+&SPY zej{`6CovjrL$mm`qN*LS)V!3aHukQo09`)_YyQ2wKikJawZXPt zuAk?8GrE>93V+duaSl1r4vL}D@J+MswaIoi-#cPm#N?h9~(Df0ICKz-IOSjwRS<~N- zm%84ZRjfKmx-RW~UO?RSiqH+3at0+X<`qEi%x(+5Dj!rG4h%<8+=zc)l#FKM5F8py zBn{d7YJQrj|H^#rS6a)!pE$IL(_R%TZdEGu^~7|fxcRX-H5NN+t=i;G|Gjd=KyQ!O zQBL1+>ufskG?dBR3KQ-Ky7t_`Jf8ScO3n-aOs-wWmd*(Z0VBs4840@o}bsj{Iq zl5Ws-U_tbS7R4pW#S_q*U+c-@7!Jy?$6fjog+*Ilq!7fP#WnI&mR!Em;3gD&dH)3q z>)U%_man+0V*_CK9TK%)_J@7E9*+4w08R9u&QkEa4th7h3sy5uji5wuP1N%h|GA8N zYyxkp=SwILni_1ho_{TMB6PAxHg-N%H^8M2he!_Sd3qMF^}uc7mcwnX+2x&5WDUKxKW#4yxwSavSRAWs*I=DzmM*mrr6tlP z%!o(B4=UoN(O(?*&1WlLfttuIoCUc!ih+7OJ}E1d4)FT%L(fJJWovcVwUd*ns?uLR z?_gfIenj_T{=VI7v3Breg#bv=hvlG>jhv>n+a zUv~vudY1R>`*rhqZasU0H(zE_;nMzLlmgmpak|*%u+XcEHiSx3DNaJjEAG<=#+Qvx zeN_*1eR!>#}`WshQS+n})}#|KaF7J5f_qv>Xh=3fpYkYvAr zeQh0YU(*M8wBSVftyryfHWP`;at2Cc<3>U{f7?oyVH5V=7YDWR;fv_r-dN3e+fLys z=65G@%9fpU!}KH~(%)ncraoir<%&bZa>_V!#<6u;E6F0cBAoi%9=CHpe=YYJV*e}1 z;WXT}fW~0#rL^p`*A?cZC}=9%hY?#(__xraQ~8RRCum1TI+6HTGb<989WrmW%aJle zcpo#0el7XVESZEg!-m=bPlt8yoS&^L7>Nr_EbsZt*n-N8*@0`*C1ogV7MnQ$e7r!Z?aZ=J5X>bK;DGon_db9z}SH4>r zNFpjSraxTuNotVBh+6k5mMA*S^K%s6`Kt-j06VldJSD@(bsD;n%xs%tND z>N%$?GIZE3iYEo=J^V<~2qk@3nq~cgSiOkF<*OMck2}_qKfQ)*A8wzfzjiJ*lLjA! zPQ5S~x91Mr04W}Ag=b79kKpK+nrbo~2&6psMEx2b%cG_?>VYM|n zN!S8jg;nthZ-<`V`J0v-aG>Vb_{OEwjxju0!)i)PsY<5;dh)n)>*0O>=N%lS;bu0% z!_TA3i*nscnrt`%SDTxvt7pa5Z^SeQt)ed#J}btYpx|L$E2yVrF9*o=+KnRG{}5si z_o&U;UpH;pfq$+tgDPB$gNvP@qs+V1H#M#&ykR+bD8c6M=+N~^*ZM|Xmsk_z$E18d zxpOD>G$fd>4>BLwbN6ZdhW;dPP(u+mf~#NIU+WI)LGQ{@L?!4K;Dz42Dm%})93)y#GJ`mdG zuG<$I&Wu+)+7u^Fa!(!~R=@k1wDz#g|I^pQ;7BMY>$rq9#i;`cG#j`4X7kZ(F@o>- z8fLeXpC@i8O(%65MlUX|S}Jde<3H9OF0b+)$vmimFB3j%DV~s)JnVLp1(j+BNJgIs zxUgt8UN)E+NuFQ8QVATJRUEUU+Xm(qU2b!0dsHYlv-!pqS0zYp}d%S(GLMF&KZb^V&MX(nMQOsG`i0~h# z{8VlklY*UQF^;7f2+=uoPNc3+&Ewb@+w1dtg7_iz9 z9AJmw>;%nEa}HaPr&YOi20YEq$3iy{+l~Vvq`UVGxejkWMP68^Zueg_y@d$-D!nug zN=^AW{pLMkP7wz~KB_QmV-wQDq)aP)V-efKm+M1*{WZpV(JhSXk|p=>HGfQTL23(W z5halbe7Xiw0kXWNXMnXdAKOFK=`&?0?w5=ASN0jE^MqRr*8W z*=$kbbi3{&*+ps+T6{Lm#$O{y$K4llc(&d12|QJL=Ii@bqotO$WBKKIINd25dQL9U z>s_1NFVb>!;pa%dw4uJW95g<-*PW(G>dVi>JlE%>@`DtsEnrAVqf38=#**W>P1FnN z-qAOkdNY(;O<_h!<4fg&j5~!*1_uMo%>(Hxr*i9j7#xXs{2y?kXjtoO?H0Ml*dh2X zU7eU*LR)_r(PnMLO;e4n-Us6t;7&e1n=5S)y}0|dI!o-k=VpHVqCTN%#^@xlw)~?V z#`}am^A}~2)k)mt`mNki@82ReupRrkLTnILoHv5a)YjL4E!?O5>C&wbEEmjcM=!jV zw_sZc{(8sagM<}<)(hT$xlum#%4;cn*rDO4G^)9_VO+#gB+sl|4Bp>dx<*xhq>t=F zzW<9Y3A}f#C-cS1(V+q&=9b9Y)_)*D6Y(U6F>s?8`{`)axY^*;mB{wGQgp;*{h0oDZc_{-yva%C;2ww)^?wManjArbw%v^+?L$WwQEH9 z7;m~NzChuA7VR;CWnG2EJF0GS#|N<%ki3nzk-i-zg$Ay*0{jVS?Bg4d^10y^m0Gy; zw!z&4N`gb`4FR+tNHk0;GnD{$lLaS;rkL#8PRrHNxVjeVlg4WW%3jqQG(D;`buOkZRi(+@8bAKB^<^umD`u@a@dK+Fj;cq=nf^k~ zKdt?DLCV>(G3^dPR*t56>xVn+%ugpOZ@gUm*F&8lHPJWO8$;v7&1v z{+l7JT+bm|TEF`rmU{$(ra|Es)H9=s_uLC-UkiVcONSu~rL>l$(i5!CgAS4= zd`cV--&=ZdaCBP6ZDj^oQB7|`s|W_);Z+gIpft&+9*fvt!;6>WrLyjoLymA04{i9@mU$@; zk6xX%hVusshNRBo6^~~vq#ivY%hJD@Tm1={!gRb4NX`o#U(=;5sGTU1zlXK0FqY%Lr3Q zLszUWOh$5mREk15bEFI;zLmb8soV70+0;3$0W51 zn94P4I^sutWYT~tXyv%pAz%WVT|&95BWz`6#(Ce%AOBrt7hu{&ulWg;lmtTQ3pR=k zdjeO2wO3nsbcON4S`h)7OK&$8@6M~caJ~5)cLh)qm-lZk8*@v)A4A*{$f%v}4gfIJC&mg|pSEIuxSmHDAo9an$=$)cayLdZ`+P)^ImFWJ<=;FkBpItde| z>hvul*R+}1-)Yb!_hix9AAiJiS!87#gIfeH##IZ!^(@w$8wnlxBjYkBa6+3?LaP8t z5aap!*SQ}Vg)vX6pA3I|zWsI~f0JJGevfkM`1o83I=ofUah2S&=l%kUSi=ZguXPAk zJ%HTF+g0?t0<;ry$FOe49};kHg?=hO^MUPG1mCO3+ZOt86zfSZFF#%B4X-PZrd0Kt} z-CP!M+_!aHf>O7th&MQNBP)`(s!$oZzWUMaCX4a!%zFA?HmbA-3kO**ltMCc*Yf>i zzK^<4lEC(FvgSLhy{Jf&Jm`7XcER#+&eH?MQQrCb(Co^-TWF)zHj7+~&K|ewLkA40>|NJle{4f0HpFaO<|J#B8pF7al*x1?G+1T0W z;{&z1xe4`uYdJhT+&tX0wzhV0aj|x>hJx~8_#XuP4;G-lL!eN<6H3?S_6B{&pwk_$ z&Fc&MK`xsmU6(%)h0A8WK3rEY6h|T!>H0l)AKIHnrCfKUzGy6!#bh)~rlEKuliTHV zeWameDn~d7fk?Kobf!Ss0{G3*nOLAiDMvO&)~$S@T(ib{V$`i-soJnR5?Ri@a;4sK zs$71|y=tx5aceY2&ZByx&GYJXV(jU3Ht8M$PYeLp?(~IY(Cd$b>-L7?$>l(R*7}37 zG&Y;f@z#c;sa&xrh3MNWmELFALVY{bKc`D&Qez0PH1@}}SJVGl;!Xwi3x@VOhZgHAQxwKMPkh{!rN<{24Ws2diQ_Ap|Sg*sPH1o*x zIM$VL6FJw}Ir5mTlu`0{I|Lq7Youx^eHRE6$+co`6vC@nI1Mo!O@4BQXGIP8??_&C zH$r<+wH%61Wpa<;=y_ewFPoyGDQ&CD+GYKUs<2h-(~Fk7BKXCO5i5zK?DL4sqgKZ+ zJSCvNWmI`i-$)!usu;-RP8y9a+xM&ACGoF&C}8Cr8x{}gue&;lZL4}=OEk~>W?;{2 z{vk0VUJep!4ABBWz%k|0g6hTsS{7^Gh$lqEp_KDF0t2Aj~mOS^w)RJu%I z!s*dZVObEC&3rx5p{(vy$a1XaW419GQq|bVY|~8`vsXPD)H=#k+Ie9z{F~ycU-`fU zV>8JPhsaUS-oVH{4I^jwG{a3GcMn;Ycp_qNLZ)W8{wKGU-MA1=ZNE0e970$=QsOLS zomm_iS#DJkN$rsP0VUicbXFlAA3uk>yT-`5iQI!2F*#~D*r>>tIY>%wp@p};au)rBSx=g)K&zFAV zy$+;JoYNTQsCJcMvAIN7=%5J(?Kg)0nGZ5_&7#bPiM$Se=a?AW__c0`v7c3?hs~X7nu8PljG+D>Z@xFx=flS=_bbQ&Y0>TS0vwb4Zk7BXYntG7V#coCBa-k1;6Va!oEoNDk3rtxH7+Av}9 zuc+2>6Hd1D@#tc;60QOGNvDj4tmF4$-jUWxmu9x? z^XL-31NbSg)dtWr#J5E7q;<;YkuB$aUWx{5KgSFAKKHwPsVL6qbSUqA-jA44acbF_ zNbUQ4+=)_2uF;uT@B0E0n$yx@bRJ6KeXEQOU>pczIh{wM8a>@5P)P7#d3{`qf#;U1OdEqm`P? z>U^7fQ;i*j(bj@~ZMFWfxo*Ht9j?6OFX+Cd2f5lYOm2M_{|P)SU+tV~Gc)l8qm(k; zN~RKj;h5Nk_92Z)-J@JD&)uVa9){Vo>TUKaw54=^pxSG|M?WjErIT0h%6n&Q^L6&A z>)$*b1|pq0nK_P(c~iBqTky(>w_5uKmZJ%Bhb9c-Vh?b_Rs)aFXw>*okN5RTn`m6) ziv{rCci8JJGQbX^#&Z=Vu-1%c+z2c4d4MUlF2w9z;|O+IXuXl?){@V-1dy7;+gzLt zATV`x=K={Gvc^LjuC3Rz4T}j@#U^D zXCb0^{3RYl$-TsqG?_bD1zhA20kGLjfhQf9d{20N*0A>(SNuo3M?BL`i!OP{jFvoX zypwj4_IVq=mO>4!v+m98`S2G;5>M$>%lg|xbv zt?pve7?Evd?UB>p$J^G%=52|S=&`Bj!^+9!ZG9~Eq`mvX?j?g@gE8Af{z2ZseCcgd z0M^56i}9Lx?P+^Yk{d7sP(mxg>OZ^WD&o?$Z4%{PGYENZ{i=Th-@;pY16%P2f()=w zslZ!CyK*Z0jNTP4XdhsU^%~S8cCc-KuVm@w?jc9MN^V(}Z}RsVqJ-EBN8$goq~w{U z6}SUP;UDavI1Z#--edG>9%{7k#@u9_6>l$RDxpvfvH~VpFp>iJfX}gE{O&Ao9m{98 z4=gq)_na@dGB!ATJtYht=Aj!GW`{RhKE(D64*VIGIZ0bP)z5=sMCqQB@o^QSvbJ><_kI|$=|4MWu=~9E+`;M}0O`j0yt8n;DR$&Junp#N zJi`faNOd?53oyaad!qg`jr|AaDF7Dd50rGkeY3~hq51dkf1FbT;ko{P8`iIa!+lS2 zWpDZOmrBFw(STt|ufqKgU8+$9r_C9a2bo0>m$VH_sY~XOxonu8Ev3h|MOPgh6a11u zM$O>p#~^CzAmZmgDyigbPnP|~LBw#*C~&TS7M%q=Ll742;mj=wN}WTbg3Y*Hl}p_; zQ-d9F!{So>kL$hNaXm{t!d?o^JWIX(O2hoq!UDL%ODx<2J;Nb?(!wuY|LVH=$3BNI z!9^r;M@6qkt(OtOFgO*B}xPWl!@G+Y3$>r$j((oyon3>_| zdC!=|w3w;yQC%q!o6j-ZxUsw3vHO~_-&3Nio>eQ3BTtX@j|XC}(_)#LVsAZF@4>&I4Kx=7rMa^KUK_P7}SGqJqS2yQCm;@WJD>7Adn`J11m8+Xu zJa%gQS9lYo7e~qG_*lw>g+b?3nD`;h=zhxtrWf^*XNZ=khh8|Gmo$~vTE8b$QIfK| z!f2`OE_>1eMY0B`M_y6%vZkVFL^5wg@?O8ExK>i>K$6yBlD|~aA!dr!3P8>)Sw<^n zt~BQLJ`Ri0x7GuQY6d(bweWKHjXU(QD6_Ej3UYn%UAC}tI0RNUo4Z69)rO|VmIA$2 zQjv>*HPqJL@D`3EKxdvb|CcmNt5mmEVBI4yaRrzJpI&Gln^hLk?P~JmsgmcVcQBxW zL1X(;98ee$_mZmj6AUbc&%9OtbMk0+cl>A8EOXpFv;HKbQ_JB)GxJ6*W1lLk?Iga- zE32e6a=104WF@m9J+nI^^H+%N+hFFjd3GHnJ?niryEj7BlvaytDS^*2M5ZMntrZ9d z1g#8!V#_kU77cE^Ku%_fL$uCIAvw^%9N1RSyH`#nZ6*V)$sUh7*HZ#&80fS$_hKYB zTm}T)Mtn<~cYmV(2%q_*%=R_HPoVPOhH*|WN={!&Ac(xBKBK88GNr-VrAO4IvFRXB?X)QC(o~tW5Z$(K1B3v}~>NA0e?aDcSw4*?oAq&xiIEURkpv<+Q08*E|)t-W97S zS<7D8b!Fvqcomy?+5bkf2d%TZ;VbJ$Gwz48n!N+bR?Ei_D(6=#+FvRb@hb{mvinA> z7_mUKw2_w)xv=ThcuNL~mg%sgdB@sb{t?w)W@8GA5+&GzdvWR>t-dw!QD7x2TeOjPALOt18 zUGQ--g-^W`Z#`{PJ!vKc;6fKsXkGqGr<|3qfzziUIlO%Hw0vW=f$y!M?6g4?u~D3_ z@d&0Gf2{_$qEV*3QDLo7sl5(B-=rwl^qa2u(gzN3+^U2#RbyFw8xSFGRGzTe*- zk=9{^*fGZk?0|&)~~0OL6d{DVrqgF%tTarBYe(Rl>CL+*qFUwAcd*80oV zhAQ}SAys^eilfQQ8S-OM9t^zgoCxy2+lqq53lyn3gk_42QwxM>M?zW@B6JHF-iGJq zhgV&PYY|hjmMk=1M?%hvK$Y#G(IaM~#i{GXxT6Kd48y#1g|j-%3p$-vnLVpE-5c~h z!L;S;QC&%NzCPz;-vDJ+(NaLGtzC+PntK+3Bgy~2O<*03?ptdsL zXlXD1B=UOa7<0t>UFD{gpTHZC?%kSoJ|%tG`(7 zvtCZ6k59K56!}G{taME*_hhfLsIQ2uwD-}E4L}GwXxck+ z{Wcb!+e#QVhU7LJtv7OrHnU?k3}{!qGJvZ-69MVnDJ?x8?X|GuWe#3lr60c^GB;B) zx)9bkzmIPwSy|qEY&z?0ecSw9&Nw}*UC97wAq=nT_KrjQ=p{PtYq+SQi|%Wb>3vH#!SSkv4c1_rbOuHH3xYFEs|u6{;Br`xh(KO`|i} zixWO$;eZ2U>x0qY1I5XM^7R9IrcM1W?L)ur_2@14*vZ-VviOW~$W+G>46*Wp?a{&c z(b#&KxBjsw%49&-F}2$^-sL22>^64Q)X(Y);N%R-WCbo@m(OP!UH2b^@HADw>Z`yh z{`x98=rjwYLglX^*g4-OkT7tOi$)McrWH?NVI?-XF6*CPqd&;<6x7i5mnI^iMKJWX zDwKNSOlI?(%YPpLIc!Bdnk7D3s7_e`UCeh~qzW9Rac@TxU%oJ2?r)~YR=51AIz8<= zJ?T00jOZU%lF2y>CX%OkOOaT(1glelfWI7H|zc1=!TTMB2JW z`Mi#Sq_>5hUh3am``=*a+~9sj+-~l@SBAWSu0CR~h=m|E`uw+~inp}gw={9l=vQvW zpdy=$LwJL`uMRQ4y$?7YuKD7wxdP0W*1|C;OSe&OJml{sbMANiFB!8=2x@Lb8G0`u z_o}E5*PA!I_P2Cfw`7V}aCB`tTMtG;j|@UrpGkkEUBgU+HI) zb6#`}UXnf=EtsF&P+whzUh@rJUApf)KA+0FUn>o^1E-#Ax1Q^S-s%;X$0uaNyz8>bllRvIHq&6z#5r9i;8cn25)Oy zAAE?jX+IOFr;PbOLL+^m9$x#4bY@RJ-#Ss>uRkHTSCBvkZ%<2itI-ZE;8;G)nD6r= z6f0^EzxUlK8hiM)VQ&aL9$oOWQodLuGNWW=_|0yA3?7g5x0m0AQi(+Jp$rkX`@<=; zTIInn%EfXSjCO;S5qF2uYG?w4-_dVKE-P^oz3B? zsUF9(xtLA%JA;MjcslO(#o$Q!>v}mKj%9O&L3F)cPv@#MhWzz>+%MNU&mQ4bX$0~M z)>U*6A9npNsM z4tY)8-$;Dg&SgU#d4BRMu~{-G+{8$dqFAKJk#}{m7!Y-sE_!)7tg&)FnE>7GSSWZr zf;xMWoo(XR(t3nE`-Ws*z2R`{{gy_2*brMP3D`dR0G z`UAx;a=HUSBC1N5BWY~5pYxzmMNtTbL-n^5Ws_=$XQOk+kRu;5*HUpbv*0{rZ=zZK zraewp!^kXVQQbs-wq;ebiKAsMxG1jq3V2biWuD{4scl)3(yVP=)5NJ`8-l11jh*o;y5u4i;%>G`pbU88uNZ(bCzHRiC6@DYV0h41i9Qz`%s<=G$*k?Pqn z1lgQ>CloEz(CRw6(&)UpJTB>Ay(*-dp}0v($h3aP7-fFNlhW$6lmbibLiFf zfuXD7Fvw$(?Qz&@krM!c<+bcrdT>&+i`&GuDoQfVVv ztKDXeays2t9a;pQF7X3=MHwW%UTfeDOw8!&ZgGGGupcttM8s&3K>Dp?X7?S(e5(2z z3ybFdB3}fMK%QRkm`j@%R>5)fcdM6>^UDY+w2k6rqSW5ojlqD|KRg}`dr{@{iG$_$ zg;`LJ0FU-0Xb2V##us-ASxm3(-Q6U*VDTSR2+8PU>kHzCk9fhGHkRLT~Bo6AAX%uUjdikmxR-p89QpmZK3~B3@Hk z6aGPJ+(E(7ExiI4apO&_RZde)WzEWP{wu%W+kphN`b>mMM?NOKTIuNyrSjjuCIn;L zL&9~`F=p`Od7Cstq%&r5Qsb%wLzV;d)|ck*ce;+E)P;LR3a))+c{n&_6_elO+{N=J zs{I>ycg1fxWBB!Jf{z5e(cp!W*C}YEMr3}QJ13?v9Gv|vB3PkKRBJG%q_W_VQzS;@ ztn59Y4TKzw>RA5*W)p6(q!h?`L(`|V1)00~gPUOS6g`XgmEO+xnCP8VQsGYbv|?#V zY$c_I6n!`E3N1$NCg@Yw#z6T!y9)Z*Ng|JVM;tp|iaVs1`qW>P2&=d#v8<=O-nF+Z z4pR%IS5-t$ZI1;TyaZ4E93)US%(*(BIb#n|ZNqgJ;JTB=-0S1@_3>vDsBnc7LCM+l z1IiMUX0sFGiGR5|(bF}TXK_VO>^a?}lLTE<7`t4^c~VFb0?R3g5FF&#&I>$+afMSs z$-x+SJ71e#=ah_pl+kgNOX_;|l!USXO#jkq_za7|zfLP^BktnQqz#0OVku|5?&&>P zLzbkVmBYP}Oi6E6XnH48Vtg3S@p0UiyUEH+wSpP;32h|Xm4NZ#947kI6~Hcc&IVSj zbCQ<~O`&>;#*C&)QUMs{;o9o7T0k~=4$q{n6>8tD5m^Xey zN&)79t-(X7$4@Q1hSW)MO7gV>oy{*Q&Ep(Qo*q$r zkFpjS+yCM@+M{aFBBp%4KIl1m6%9m6Cgd)$9Xw!rD*;3>*=C~lg;zKfoKP(F9)osF z>!}Ukuh{6`kt_g9D_hi;QU3Qa%mO(4Bybb#y%_4#fH@9Dq`s*Ecs~ZBp(g_f?%CAf z#MuuU3$QwIOG*{uyHor|a4*M<>agG?t9W?UKO*v#5#h@nAIb`CIt@IRvh4Zfs!BG7 z_TOVV)%CG!e2136^l`cNpB{u>=4?9D6Kh&7nJWN3+P&vNqRs}X8(Ry(tCcBlSXU6t z#*r|F_cZ+6O+wzgsRS4ANUZsN0VR=@Ec5DYJgiK1Z-u+eVQEOPx;!AsS(oB>Z1%H# z1y{Ba;5Cp`_t+RBZx@k3oh{6&=e?E&`_wX^cjB1jvz8&bM^pi)O$E`{9F*(N$7kkS z9!XC4{X5yB^UjWjWl(4S6V|f_MjuxhHMOmUL(knnyG^^!IScm4?llcho#~WoXV2`A z$*l86%Vm9!2<~Oh`oi!B{C|tugW|{1za75bxO!XB=bT!2+P8W24I}36li5`+Sy$^v z0&uSl1ekX9<`l)^P1fp3vI|8nY-)AA)=9Mfi&&!BCuEJyT)(yK9WvL>^x*iG1_bTp z3f{t91^7(l?KMT+)9YDFybK4VHNBVowmpV?HXn#n|E7BE=Gh+3)0gRn(9gB$A=hkc zz~HJ7w0AE#q|ZI8x9GFHOWSvOU_oXWo{-glpP6kMp>pd9 z;qXqGp!%#VfgW2>y(7bk-RqCa0&&hCm%EvKH&MHvhPeE1-^?F7Ka0jP;Z}^UG!8v}HGY&ovEkYkx7DDe!LIL6i-2w7U{*Z|7 zfc>-X&vy+$sQd03lde;?p0DCP-&A|rj`?m~dTxDsz6bZfCktQmb>p9;7J4R(@6|-m z(bR|M1hl1E*VlZ3PemgT2{=tfQf<9%ZNk9pMeFN8s;ryJ?8VppL5(0X{U-bcu@jZN z7e}>JpP(1BQ0T>_`+2N&BPk+5xjuQCln$OQNjTSc2SP&EPZ!c7WLwcjG9#M%EXu-D z&Wcv?gBM8O|GkkekL5ilv8S6U50!hrI^0o|UZf8-k(P~6jF&=;-<2d;NsPz0?~}YA zia|V$rl&2fzO)omNH$qK53{ATK&qc!#y3jBR(#SMaq?G{%s8eTd%X0zxD2Mm@5%y& zeR27HRHbtSwQ+HER|!QxyoRl~s&9Xz<^at6K%Zrg886CqYm7oh9}gkWaGk;gx^9yO zsPigeLO8hOgk`}mwg``G!Z2tWNU2t_;}Z`#J=I6qpqZDV~UOMpquZIV~6C3?YM2_ zxa&S(ta5xj8Q}B|82&bD5e%>Royob*j((mM`YTsrh!nv9GZQ@r=xI|sF*6?MO-S$Yx=WAYDXxPM_B zwr}m9TM?RHsRRJ&q(&|nIo7)@G3jr^xaT4i$%-jiihMRQV*OLl^HbI1ijZ~1nsY^{ z?DUpXLSdQluM*SW)RZQ)#y4D*HhrhRhfKq}DQy8p5cNiosuYonrcef^kzsy|v`>8^ zO`}uJU_4A=Vku#9%p^jO!Gz46QoQN4$KfO%xE+yp?oNz!pxE)&ya8^ zlVQ!0g>b&z5n@ZsV1>+L$3SMOQ)cOkW&z~Wn|U*g2eV8MvmKVg{=!hKlyj^cbH60! z*wp6O&E`1V<~T#AMGLn@ zONm7*J9X<2b(@q$>xD&|jYZpoMTdt)$ALwsDs?`u8D@zkSGA@7#u?&+84tH5&yXdr zY~as@d4+)`p9KvC$cBdEgob~17@FH`V7Bt#Cgq?`l)dPwF5j|?Ms{0Qklt1OZx z+))raTdiqTK)RPQom&mal719fX{2098sG`UN)kbm6^I^TU&n1MAI;qU*FT~Iogtc4 zy9V0N>&6l*KgR|8t)$1S^a&*4T!(+zUwb#kFeRaVs`4pq% z;}`409Al8##C62C$e{(fsg3oHbGcFZjVZTDDzuHx`IWV%F5)@@qkBGE)m8WP>J_Mo zqF_M9xO@=(#Bi3pbK}3k`>qjw`MG4tS=ZvV`|;uR!D%GPWdrQ4)QJaYmbQt}KQbN3Xo6)2 zO;DD)7bn+rw30%q6$Vkr)#zUeXGyM1fe+7j<33zS8J50S569+aZ65*lE`{I@x2ZAv zIz*>GWQC?#d9X;LZ(pwceN3})n4x)CCs#VT{ynmHeKY{vwirH9K&OVgF3N=AdZv7;EdwPs+Vf zU;nSEne+JUw=LPn4VmWsn}_}4CZ#vL5tUu)1a>ow_qbOHn!UhDm9Ad*FP$p-sgcfx ze=BjY-#hR-6i|?c4bZnq_p4zfQB{i#A9^QWafhcfw_*E4klf9iIkZwjcC7|w2Oc`( zS=Z|@jBJ3$_Qi)`+)I4GfdHRn=He`8Y>V)Nm0P=-@dAyag~1bq)}xPo?_v!fNXVgY zm!aR}w!iF1EGC)>CCqSo5OaMQii)6gH(7MvSOQzMh8rG&~ z__R&jgozKyb@Mb_un-woR8nn~2exu6%*YFozwk7jzA-t^wUF?RZCgA${c}_#Az#2@ z%Cly3^8H)@VyXBjpYEPjiXE9$O=ak>s}V{%-z0JjO}=2cT~2wpGcOFGLO2|qn4FE} zGFpq-HQlV)wk1NclkC?W4XyhUW%jK=8q2u_S({-yVSB^SEaF|^7_$z+eS5ddR>I2g zB-rTlui3o66)@DQ8S;I|J!?=?Eylht3&~vI+it9{G01(Fim4A<(3tSmDC=HEBzcXz zc!by1_`1ue#1#3_-2tz7r;FqChWG+q-#AU&As;`lgn_qc{t{PV;!f;!;VQ)Z zwBPCUv=|`+bP5+M$JD&bjRH`<->nDk(fMyP2brv0>?#Ascowgb0wge>9I?4>SWzTU z6ix6-OsWj~(Hu-h>M;q!oSO6*n^9s*nlIC1ZO%dlJs0gnfe;&cphXTN-F*MJ*dyZ( z9hHY9@GD6Ea$$cc+O%WymR_-l0@ajC(X{(;oYYF*&{awzl$%0okgnub`7lFn&GiaqY6ah*&dPfQa;`l zKTraV&^PT%G2P7#9N?HOyPT|5%sf=hJcek-$5Zm>Ae&@FQ;vOvHZw#UL@m1_Z%%arFAbRus& z?RwV$$6TQn-mB+gkJl2RlsJo*GJ}`$lGlnOAn%e_`qoSJ(QD0=S4~&~NaMAT%coH4 zEmy-Q)y}fi|}c`L%uMwPWb**5*8s(@Fs6tqRqr7U%sRs;^wgLp-%} zyOj0qB`b*7`U7B{8Jq;-Y{^I2p~re^WcGnf3Wa}1^(qVXKvhJlxOA*U*$Do$?i4<& z*mUf*{8-drXk^-BO!5PxW<af^m{I~4DLU=o6ovXAZH{m#~~oSa)*u$05fkjcwYF=XEr;n^hH7sF{U?}?u`fT5g&HoUT(F4cnBo< zR|<6oGwbk~{M2i87E?6h+%CYsY?s3=YO?t~>#l}vQ6a>BZ_oOBBMDdL)g3Rl$I~T3 zHJ9&gu4f|;zq9cd%KNX?pnbEwx1l^LcMv%-X*WN79xo0WQhx>rKwho})~?dF1pOer zOIv=|c+2{M-(fws{~{lTZU1@0JI)RMCi?s%09Cm(=MSR!vXLYL!ZT?oyz}#R#1C08 zSrlX2Gg&n2C^vZw$0~SQ1@haA3nU@%t6$CQD4QA>_wC_1Apwa1r#bsPd&(X@+h-)j8VOJ#epiCt}A*4TAgcoBc=!`-Th(} z^}}jjBYCwrX7vJo@_e1cLivT~UpMVz zh6P2``i+6J2q&QxdBHpNaQTho(&&#jm^*#EyM@fr#uUkPTiVo=l_?RI%A0YP7Cc?! zpE&CEGsQ+y8}qBbv-K9VOgbMH^mIO&w2QpM%0s>%yG*TE6~u6=kt-Z41MJsny>97y%(_q6Rou$i+SAT*hKK&P$H zdiW4B%)N7mb@_b6Ro=yWR@Dx9jfT0hOvyu9^WQAZ|5fgD*?9+Pzv}%e^j_?V5Ws(9 z^l0yUJIuEQ;lH1f`}rSne`0#pNzYGTUe4(5EgJMha4UeYjJ5%l7Z{j4* z;Co?s?fAb0=Ol1KG@_`9EWwmnaF4@xM5DdcAxyrcNG3FWc(b*koE@YnE~R}$yL#PFCC)v&&hD>o+VgA z6QWG{3-IQ+B{_gjF(-GVYUu9&&@yUcNjk`hZn%d8R$1fx_X~*Mz7Go_)W-+%Q;?#y zW?z~@Q2F_NDJaNkM`V=i6M-ERRBW`w+++-Lf}+Ag!nC7GiL*w^(PVUrWuvO~&MDQl zlne&6W16yYk@WnLYNO%_8hJA@cJF4)fg^*4=q_o4_hzgKUH~JyhV*d;a%#A=tPs{{ z=}7i{yR2qbTiGM_?=q&uP4LYbW*3=3!MQf#1*!SjbL^+K7GGBIM4kU(WIc3Hb1@pr zU0j4^9FZ!P0Vu?#^M)n;f)YYBkI6#FE+vTD(8Mq-raO5W^OAf^QOMhre`l}6(= z6sMPncQ!m65-i44MwUGbKvhz`(buA^R)jLK*Q`EtdeidOJB29g96m6D30Lc5vRxZX zi%!t5PIcKw7K=Y$lLS=oMUE3sTfc-YOMR7C$jEN=5kz9v>P6M9fM7R8G^HGiDI%7O z+}!_?p+CRORyXo*Cb9|XV_Rk-;3mqv=wHrku$6rSlO~P3HN;%p;9HnceTBEH=+sY# zucDlHVw&_{J9krAYK!G%?x@S`O_vyKxoqYdV3JhGpW(}vM*Q!`nbC3jogn9$!;|=d zfwZAY-pf*5^1MB1?)sJxE3VP#T_B5aDaRD ze6Wkbjp89KX6DyAOpO9Y35a!tI{=SBQ{1O%peP5=t?y`8-eYAqySJEV(uHWN@~h~1 zyMta!s_kj2Ogc}cE_s(LsvV0Qr_zI&s#b!k9viz+FYG@d?6}Zlk1Z9Qi+!NCjT3#_ z;M5;Mz8(&~s3^|`$X(a|VX?5EOwR)@xL$;ci35VN(FW<_R z`j}p)llF?9_zXVE}VqkHXNL;V&nMtgFbzBg#4ce znFVhH1AGstx3-gx`0optKTcG-Ul%>=I zh$mbbSPdRnvD{HH&BL+Z!Eq`evpiDGM`b9lnEVxH8`^a zpZobj1`RQWMk!#yHen$qXQ47#uH0qx%7?HClCw(|u>bo(lb_E~yvt!u&S_u33EKTJ zYRt4~%)Lp*4J_c!Am;&@ux|WhB{SipD`5Rsz&E(Zw@5CqS>Ve`E+kJb^jIJS*<)AV zqfVHmiAkh&Bj=)`5M?S9<)jeH$Pv{3Ex(`0MAWYmLoS(bB3W+2>%K4PT_`z9#s?X$ zQ=1dH{3!sx#5YmU0FB;Ax+h0vVm}h>60QPJK%Tqbh1=M7E-d7S6bkSXQ^^JkeWZKe zYXplVM^|d1uu_UPg{$yVMoAx>(JV**_^$S5VXr_a*pa2thQ(L6H3rWLpTDk5y5aTty_uUi4EUJLgHcvn-g;5tv#?t%H zHqKr+s$8friv=wAYr?OZGT~WMV4F7YCXybS^~R{{#ae_MHu@ItkZ4r|Qke@Z>Jp(; z>mF)ej2hG7*ZQd&YpZFGOquy1ntG|5aYmg4V^{i7IEC(aMenO8n^sWhxbdXwb`o^5 zO1d>=&VaF<#MkUClU(tl20B8=zDp_OBQ=UkxppFXnNhbu6E5W9^z5v8e!+1Ujdmto z;!Q#Fpj)%^!m*p6_MydbLnl_+HTiQ$Zo{s;LR0cPQ93d{O`UT&O?mWsgQj=qqO%Sw7BE`!x z!b?;iDZ)(8oG4CdQ%g80%5pma`ehqDnq5O3dPW~eAOHhsqBP93TQ#G~v5LXNWBEpi z1!nlUmsaMFR=K>Z)fcptM06(j8Tpsuc7o*vplnkK?6Q?I+g&Sqgwvu+yiUSJqu;C5 zA#`AP557o9WpFO+AVuCKH^1V5!=m@*-cgdryyip zr?XqHhuD#^+Rbk=ZXQ-`{+pb)uG%tY+=f(b!(KjAo-b!Gu23=UGF|R)+OI?wmh11V zcU7&cGi~TI9T;Ek+uOHd(3eKxSyf+82~sXbZU4dgiZOwO=hj|4DA%6>7g}u)zF``*?JK*w?~B zJXk*cYd`bRpvYO^f7Zg|IKmfP!;|lQ5voP(WIDez_e2H4FOBI`o=r^a>V|CPyTxI!whnqzOlqJr-<(I&2JkSkyWkL{{9- zT3k4%-B=ckoH`6@R{RPle6BiD5mv0BI>ITZbIcp;Ehp?FR^keKoG@0r&l{XLCz7wu z%Nb4tHFX5kzsQ(xNyC^4=U6GE>M3;Uh&67Bb$(HK82m)6|A|^p?eUAorQQmQmAs*j zmfo2>$C`gz3m zGOSTigG0^0O|gJQ36(>`gX0S}hjN&ka#RyCbCU{}n`*&>O3ed?f}46b+j!pS!lG<#N<8D&IX_~}t*3xWa12VH{wzYY*^(hbtYPJaD zw2ykU@BV33@M!$C#j4`bv0KBmo6}itc8H0~g{#Fy$fKgt##5NfO{2vvuE=$W)6T)e z?hM7dkiIRH%QLRUGnLCLr^V|`Oo(O5qlC-5yTxaS%QxuBJ89JJjMM+9*}ug=Q#>T# zlj{#0_zx;~APzW?08D-&9`KVphzlGf#Qlf*dF7v`lLpw)fLjid4`*Qr6XpO8^WY8- z0EdThN5p|6l05zRLPJxzqjJDeE!@%F&!HvUVuT*fThAzr+`(7eaZlXG3N4h6;CR%R zz)!Hd2Uns?OL8SRdI+4v#gkmX?W4Gpq~Vop(3-T=66fgdaKz={^MZTAodEaDbut`a zFp!1_4t5DnyYozs7W}Z;<1X}2%`EZC%H+w=@Xn9|hXC4wOuQfUUNggZo!(#K30jG$dCKX%exSYP z2Y~ZYQ+r9gQ*2tZYk89iV8aMrb2J94KU=Hmd4Y3n5ELIKdiNK9g16Lm;t~v=VpN<; zi?)ohsd_eWNx?I!|_O=+Qwyv@1MpUmXgSG$-pW;uj`2AbpCtn!`+&^aD9*6e0wV{NHw*Hb= zVQ_nAK~-z}+CTufmOf&j+sF0~LEDwLxTk%`nD>wiPg>1;T|-A3E`Q^YZ(t3NSWn0J zR!8wta7!2;c#UUDabn1!V;ZiFAEvVn^#io`R&d2Pr4@(6gI>w4kphCB(K=L-psS8&CFg#W@K zq5wRVNJYbtNq;4S<9GWau<0eoJt4ozCF6)hoH1Jy_Jn%9OJIC*uMf{g*9a zvXr@!=F6EjYsSoZQzuTJJ%RERsqa8R07r|`LjYi2Q>Ra%MwL31YE`ROv1Zk}m1|e8 zU%`eIJCKIVy>|x(KKyra-^Ya;PmY{8bLGvKM~6QBd3ER4rCZOAojP~z-M5DaKmL1p@6O?( zmP>c(PWL~Bz7HxtK79K3?dPAbzyAJy|NQ~P?>_+pG0afI4LR)4tMuq`ur2^bD>1YaO-vER6;*7J#TQ+S5yly1tdYhW2V>B|)Xo#n zJRf@`FUTK-1k%VNkt9;dA(=dKNhh03GRh~Vgwo0?$pcZu_7p5|z%CK|QcN$&46{ry z(HzsvHPbv(%{JM5Gb9~PXPw(MBPC zRMJRKq;swZRl}0XO{eViN=`rZR8vtw9W~TbO-;4bRY`3X)!MWq6oGs6q1Dz}alKX7 zTzTEq*It4BRoGyO9oE=lk@!7U*<_hr*4bvEeOB6Nsh!r^YO%dm+ibbr*4u8u{Z?E{ zlRCiMbJ0y#-F4Y**WGvFjaS}z>8;n^d-2Uz-+lS**WZ5u4p`uU2`<>+cGV-apoI@& z*x`mDepup&DW2HkiZQ-e7|)&+UcjEj#}!esjk}UtFg{{Xu0}9pzE)_ z4jb&T#V(udv&~K$?X}fzo9(yVjvMZ|<*u9VyY0>!@4fZzoA1B<4jk~o1uvZN!wpXy L@x|4aD8<1@FTxF{0XyamU2x&FN{{eZpq*&o>CZ|Toj{9ZP8#N`xhi&u(o(O z^@I6PmP%d8Xr_P+=Q%>)&99t~!6Zzo^@xeW2Y%0Vo1d3qO0^4Bv*{Dcw9EC&?3Ra6 z<+HI$HIH9lQ5ExbHsSDTbc*9bBaH&<9S6t>*z#~IBV-u#-8k0&!4(r(0k;f#bA~Y9XOGRJ`6mZ{M+^TAHIKD9 z8ZeKOq1ZK#w9eNcmd{rcvD}me%Rv?|Q@tI_G{Xdr zr8KL{5UUJ^%0a74=Z0;oEZR{OYZnmQ$~s5)6q1`8cSO9a$wrPW%ojfnWrxBt^gkCy z%Plagz?=2EZCYB^Dh)*O@Od8m9BNGkWL*#9yT7Hg7c~(l< zSNm8lCL_E2mdVJ^Wu>(=4v08ah2k2wg3=X;}Y6y3BD*u@nJO8f0hCWDr{biiYpwU`Xb?mZPV5g#LC2rih0|;1RmsoD-2%xEI_-R0y zdZowcEOGeNGl9YB*Nh2tzA>@Unj5{eJq#(y)#tt4l}ua_{RP7pTU6`M0hdSB)Gm12 z)HWjDl?kuE+}tzu-){*+{guX^+&ra3pXv~=BL0T)$05!FFCf~Ia9mGfm$E@ zWeb4IndSad`e@0a9QeR451(8)cS^;Do4RN6L7k^8%4J;o31EOwB0{!hnl0q*5*;zm zBjF%N7b`9c7>O+Hhv$lvVf4{JvgwPDB*z~daCG>CcVWssPwtQr%IfO}+bnW_iHE{~ zLGjPKu0EaJv3$_>(0q|C+MDf?U|@RwohGJH;S|Ux>;3bM^N=zFRgP^mX`vxO$9h{& z<A47kwjS~MVuWL!+3*GYG1C245*kOzMJI1n|2Lz{#5jiAYDE(O+#34c%6>w zCM)#KxQOjR8ly9n3ZEw2){XQvdnD_S^s}9~(r9z~>Mf;O!_P4fJ(ewziYkVEf8&uo znBY8G)vpic=!h2f3E#Cy&#C_V(ld) zc|7noF<)@qTIAJ&HjRp4+yf?E1p#kushyrcZeMlx01K9wPUVW;;iYP6mc1-E0e)?dAqKZ*9VBR$GCo;K7? zq4tcGVFn6+QBFzO`WkEOxi(!-qQ*x(<7#$fX?UPmR+v(o%RHP%y%D7aeu2!Pvnw6b zCN!dSZK#uR-+zOqQ=V?%s|}vUm2V3|w7P%J2t{jDXxiFqwysb+cZ`-hcrr|{53x6D zIqrYcH=dpt`&$KNdFn<=w+!GBQ5K7tQ@QGGC6~W?M*l= zQ@xG|UfZ-|pPs_^+AdJF0K0lUG%aMfqz$p1NJX=7D2J>=`mR)o%ug^jmC zzucp`q!?8b}M}L(a ztcTWbTAv)d6OfJ;$#g4DP+HV0uGU*$snWMzg`Ud@#Y|^xUypx7)~n`5DQJS6oAY8z zJSJG|UT95E?du-zFjj84tc#4tsiNqF7{1=1ng>!|RI#b4IbfI3a|4&lQmA>BgPIzV z56c$LaTg9An%F^GzaJ<=1`Ho&B5JtA^MMFTv({~zTY%alp`E9j>iuj;0<)upKtJX- zY*GKOg$W86t&e*Pw^v$ZpnBya?KJDNT-YUyrg3r(%{5NJqhu6J-aEOVZ(Ut@>4iE( zG$RG!t9#M=L^zH!o)*_7`(ed{?v|JnaUi|=$R}->k%k*sh`cuB0`&R4$tm#)X)O;{ zb3#s(fYuRFdU7?B>q(xYL>OqI@j|52 zSkt&ZsTnZQ4nBLAW&Y`&VZGYK0YWw*< z+5d-?+7)2{(SZ33n}33p1?8?U^R(YjE1Rx<05!_rzR15uK7e4? z50(-LodKjN297EQAz6Lj&IKtJ+o$k(x`zgFfbBo^>Iu#{2p}v(n*vs*f<*=b&-#76 z2tpncS=6$HWM0UXzyk)|y$JDx@rpvylU{0qMb3nEUJn2tq-pRLI!y_^f23sePcTra z@0kUWZ?l|dc43&PZ0L`(P~%-M=?OU%wouLdAijYR5I6wZFXG)~299vP1BF5ijBz>V zMik1r{t*V-UM}NS5hMok!J?s(rBZ>SA?13J2DG7Lz2CFa)OlDUKb}Jr;E}v@0iIvM zE@5UdVNr!NA<_7-OKaPrfheC;$ws2UH5810Ac#R8#-?ohlN}aAYc>EkYu}AzWsjKC zj~Z%up|3*)>GF({iuQfr6SW z{t$h)nTh?HWZ`2KC-K;C&oh?uv7dTr9Jyc|YCCRm#*&vM{!l*NlA3`866fh@OIc>k z^$12a$U!!5+73<#zO>w zyqyy17E%LBdeiSRpya)klJZ2%C#VdBm`#m>q+tot;}Je}w69!L(jw+r3-ruSw~fA) zdDo=D5+lK-`Pc}*xbh1p~_+@6P6iGr96Kvpk;do3(o}=K;HG%QAszM zzXvSxR5GdA-17|$POMb(E!=2nyyL)`{p?w_hHx9(=t^s7EA9#??*7%b+bn$AGmOq& zM_){JR=sf+2oUjBCiGa|<}swnUETB0Qp)ZS&2Gi_GTrgqgCs`N`2~FerH8uZrSgX{ zyR5&<{$ZQDQ3(0M1}a5=?0yc*69ZY|%dZaRLi&a8(Rrn3vS$R~8gxuze_p|jO-qpr zRUa=<_F?4_aGN=Hqlu<>KFA1g}hvafY3dI{UzC2={Z16GKQND|eMHA+B(#fPm z!d~LPks!$v6faQznLaC4{A|ClOWE|zrH?LMgnU%-AlSo5HKC|9)n-UMW01!>rNk-Y z8AoG?Rl189ZIF9&ksmk^Co(c>0TDP95K4mZ z9YS!wO?5#8`rDO#qAlAtOd{@qz1l777Atd8_19l;lU6RnzC#vfL_x$qKLeLtiz52Y zbsbeAvg``@SyPfB=2 zdRG*aRKyPzE_oXgmE~34B9kmb=Dm^GSBQe9!aj6 zc%)(_!BsZDpQ>JW=o1Rmn6V)8iszqNK&@1#7p^MMEM4H};#TO@r zrx+*RcbAvh2j*Z=>6uB@K20?e(Z`4%b;b>_$>w$Ok`TR?_j{X9ewl!yRz=n1^R`knnjq_5z%vLjTWho_7;`5`4{>=7= zOI^=+qVU1Ej<-^i%gsqA61De?7~E|8SnDK@6y}ts;rBv-m{c_lFi^^OlHg`Ce0YL8 zrhuXCY%}NpJ9Yz zlzG=!lV0)KtdylA>-xZ=EQ#&wvfq9|wgccbJ-wTg>zl{fMx{cl zQlU3NpW2*%1#anDuY5zbib4Sak-IBa^^IJ8zgu?Wszwu!hh>iQSxdTt)ph{@8~d4b znXukZ6!Xq6yLbSdtQvctvqq7C;fGfviH`eqeh~t<`RrLer97{oJgyyL<5kjKU)8fJ zrd=w}!d1dwcVS z{ba^HKbS^y+};1GsGf=~zB!y9ayZ=0Qi@U^tl&L>E*V>$een3lcTW+~PJtp-&p|yk zr2R6GR`o}6&Z9FGq=7iTaeB{yEWGmDpIiYgX!?|nboa;heB16j!r_JpGu-P&jx+Ef zaLoIuieZG{_(0LhjGq^Ob*Lv!n4i(*TpAkcaVFaFhg`J;Ns%8IJANN_uEKuEUvjf09XVg%%UAk9~qcg9ZG+Ln@8`k$%-ffr2s$JiXD=+8k5YubN>Z>}gYp=WO$kl7u zuWOj^HN0aA&~_bPeHpTP<2>4y_i8*)<|aY(5^>LgN-GCB6*}KHSFT?Ci@45Vz*fCS zRNObXqS4LHmFV{y*dc7^YCY=D_C3#4Uz|-ZB{t3(D~G$6EUPY|onM*|iDD{f&Znnx z;HABx& zd9HGg@gCrP#0$j7XOy)0kpD4+oS6D6QNo&h1QDrtD>&h8Zxs0p-Xx;Qg1&HO8Szi) zpSM&~XjK|Q=r9H986VhYdLji1`qPQ|F3;x$);qJ=WnL24Y1@wHO6pUyq)pkX#Az3r z0L6uDX3BvrZ%66$xTkBxhqommdOVm+ZLJc^sAM)krDNdA#XePqY9q(hvuxXo%GFla zMtWcb=xDtp+HlgdLg?>YHlT8-Qeu(=Sd{Wq4Hw&-`eCujzayuQl;&h-G*@3f2SDw$ zIiKjMiFh=5Zf4 zDbBcsZlVjTP>=35xZaVmEsejAG$|PUIKJ*P&O4#XXEd=A`Na2#qVp;H@`3T7e-rN#8k#i*en<686gLWbxG`7cWx28QByYkCd0Q~Q z`WYb(#OnOr&jkhrW-aPQdnf;mkJgPO;lA*Qu2l$VNqIJZ8Ih_hJkuh>zME2#UE~&= zxTCNX&{llK^F>F6t+;+t@J+ABn7YW;RI8@U@|2FY63dsbpS9Ya>grwzdg|)SLxpAp zjFVA%H8v&v^?g*$U%47 z%h;(cw87X#Zf|>#Dcc9-w z1i}V0K~%h+>R~#->op3R$+`dk_JK^i|u;*vl`hHKIO^SC=A6QYy-=naP|BGH8csYtoXieW5>?O?oE)4^QHM08k;X6aWAK literal 0 HcmV?d00001 diff --git a/www/crypto_files/crypto_ecc.gif b/www/crypto_files/crypto_ecc.gif new file mode 100644 index 0000000000000000000000000000000000000000..be218e25a04a20f2ef95a1060c63967b3b4c9afe GIT binary patch literal 4700 zcmeH``9Bkm))1Ix`?tNY*rDv*W2)|!Fb zYetzO=C3eA1v2(HkD*sDN07IDhs({|u(D(hpFMq|HkQV5$9H_U6i z-j&vGjl{W+RG@#WInEQJw!1UjAv=pb&)QB!i#m2!1`ULgD7xgmb-prVfUgD&kMIY^b-)_!H0{x{k*d2J^XJQ3a z`mmf8etCLU68S-x9ZART@>IiFYfyks~xA&espNxALm@nQz5MiD%{vT#)#i}9ei*i-@gB3-d5XHeWCn zi7Xd4rTp|3KAZYAoSl6d*#e%EReTpT_c$t@JN71`hdFB`3Z?h=G+>D3;r#CSofnTM z$5f0Oy+7P?ZzML@t*O8#1UgR=O!+&yq(t}^|S zXysZ_=y6m6#q{$UUYb3S+B^_SEIpVCJsI~oOBeh`4P)0eVZn)YhFd9Wp8j0e>d+l} z8%AH*le#7JWKhfN@W(zcZD#4s!qsvgSY$eF2PSP7rdPK$pY4CLZR%+U?;m(k*1tQk z?SFOvKYe`Qx9t5l&O!Iuta&mMA#aCkhGZy-a5_YJ(Zythr zdt7|pya+A-uJN|`Deu>~iSkR>aKjuP+cqy3*_Dp)U=7R?f)!c7L*HtFo_qT+Uh2?j zsEw49Hj^Q$YJ=PNj$=r+@+A1A^7M z#_k&*(8{f?2wND0jFh!7cHkXW3&lp~IdE{M+g}_aJas#jjY&A>x4zzlxo2fv$0|LE zS(9|k4aV88FU!&TfH-?JkJA8_<{F}gFFBTT=8&DLN+HVoi*EOQfK0Uo_q-UKSaD z@>eQzH85eVM>k&J78b_7r*JC>Ow0#d!S$2r^;3kK4kK*d9PWxk{JBJWmUqF%^a3`3 z_zxT(rZ6#Y7I2~Cw@|3|yrIdQT&%P4JK;$B{sO39GB3TcDH4n4cI9`bavuG-kq-FO z4U6quRoJm7L(Rn!QoDR~cifJSz4l4$-QV|%qP}n6WseS`o%U5GiQo9V&M#2s!Eqb% z6IxdwDnQ~?lo;N^f2mT6quMdGB#1YVn!qkpksmF_dY%1c7x6AV$}=UGnB01uX2j)c zrdqLlt-Lf9CE?C+IVN>QM$K=&TD=hp-U|<8adBk;Mr2NOmh{5eFzBgIB%0UMNAuUr zwXw@?(5pt&Zvnr+oGNDH)fZ3zy5eksuug9$Eci$Ms@yEwqC2}n*9k;n=kgYbpuN#FU%)tmp8HwIU$ ze-Wa)a#1zR3t2x>qImig329M(03IFM9CR%0!K5~U2(_S|uM{ddERno5)6(%DGc-C-f8gA@smHxFp1y)pb&yxTXDacDpG42fXP!>4LKeO&>-fIo%ki|iB?XPHZ7U*F#eR`27t|mRvP@R7)}iNc>S)P@Kl+^YWp7f0`E{Gw zbidB>Ua?5tpj+1j{mV(WpmUXfk!G;HdHM54*`p01;9a2vtFP1mt-GmP6sG~dN%!jb zS8B4a5&A%E_e6;P6Gfe#voIA4pP2DI81S70eHBp+lIH$iUF;5-XCx$4LQ5NUis7U_O<@cW;Jg7WZ0d4!Ni~| z(+*2gob?}kfV<-ppFhcJgj!ZVDPT_CjMeYCmn>Hpo*-$)F_6gRm&|@SX;eClYf!UD z-ELG#k5|CB_PK3sfu5+0?veUqaTk+S^(eu$;N_=!>~Y3|YEsgmN1p={Z~U>i8u(Bv zE~G6T3Q+OC=9qNyG(^uuiDf-jEX8j~H715t-%>!_#w?bi0kjo}vEOi!aM92?wB!Ha zr!td7b9`=Qm-@-s@5-PlzW26wi3M0)>0{(g?nBcckdzXC0Hdv{--dlYHib$2_IsXi zDCime)gSFxf6Zj6v|om>aIE~*+DH0V#B_R71z`7Y4c^n2QhEIq7} z$?|-a(q9ra6_Yk3;K>sMe`n@c>5wrV=gzhQ`v|yER+#NI5V8P}H{H+vqA52clT-c2 ztP7OmH*Wd0E@!F^@^&NVEm6NuCU-~D^I*{QSz+$+VdCasu8)E7cL0LJ3HH+rv0eu| zpMlr`J-jfRd+7+V2n)SDo6F>y_aZt^;0Qk1k;g(th`A#61@c|ag-Ni9!_@Mn&$Reb z`aI<_5H6FqZkZ!!OwRI~_5&;)Dr|_I%UK$-yw6q(^w}goNERApL>uwC>I~)DepN87 zmssscwft4MC*Uw)P&5Y%b^%}2@h^1OO1e!f^xo91dz0jQ!J|B!aBB`boq84Bwm|7I5DB8|EvKoASm0zL)l`YayT6>h9v{u@@dFSO(DTjLU zC*Lv?pS%5-vallK{8;mD*L?bOz20~!M#(a0{QY5aan)qG@9cg1*m8Qit@+eFbj#Be zt8{d?0o0BS{RU>6NG=jnt8kdrUW+djXVLkx2?syFzc7@4cUtl1Ec&i%)c&S|DzZXi zNQQ`dajwq!yKJ5|OBMs}_6}>*`7NQ-;)fjCqCR}jIfp9|YL%8Kr@vZN4Qb*0KxDL} zp%5^FOUUcGT=j)vMM+A8UP`sBP^I`>^)FWu(c^4qwVD@Nu8B-FYSFHLt7~pKi-dfw zQ5C3}l*ITKpiLmv2Pll38`@Gk((G8?23Rr4YSR7GZs?+ZlfWO zy~(9e83)KkL7D;MP53FCU}+N(0w0KznFFqGYC78?;js^(#g^4ygM7u~AwIFX? z5mA`r=i%<<9zXMt3bvnC-Fj`S05kCZ1qIw8^G+m|q;1dhkN z^X*e=?a5^=F*+TOQG~Rzz?8C%vKdlV(38}Yj%FcpK1WNEJNbQkN6AP_DV6L$)LwBy zMhjDxH7FP=3JayguuyPtO3pk5Z$WMmrZ($P4>LPR7F1*z^|vFn^Q4)2LgnOWe*>ld zq-^$5T7|JuJ#cPdYt?x&Ud^$?fKc30)tdopU3d@8`QH+Ff6^yJmH|XSOkG zP~5w+?)s7L6D|b`6m4;*xO;JThZc8tcXxMpcRRS-!TsRw?(WXv{{AoShq%doGSALt zlgUmdnc3Z02`O<-E(1iU9>`~i|KaQZ^6S6Z*MGx*{POz$`2P|3eO-(=`uxau? z)wH#>1p$%mTvNFv-kp2m#?m_rDDIUoJqvfg$#H z(IoBj`vT!mXk5WHAIhD$#LhKQ&j5U@`=LrVE6G%6e&lX80(ddjfRm_+DEt1ZWZmwJes5e?}jyD6A zYju7d@cP&4tTvj?7wQ07=+|3q_xp2bTNySxUGMic0j-SNJ-$#-gmi68y91$Uq`FmY z%=;s;q$0U=?JS3&R8~?0G%2Kz`D*`FyEP4-_ls)pEJkW_La{ z>D79@)$50VBJbUHyEhs~t1#u=et$HRCxbGTVa)@*(rC3k1?+sj-WdQ#5h-+cz22Y9 z1N5f5f$z^Z`=C69p6<{0m;3YW=^o$Jvs{DLX$UAxP80}e3Qm1LMD~-Npr7JYyTRzH z=DQ)-rsc%$-(nw$AfX}u?m%3Ir|j`%%SluJ^Dcrmogr5*b7=rnGq+H+&{m2A^waoWBL( zZ?ag3-V74ALW5@`x4g&G)3W?fnzM2bRh;$I+cu+Ptu(u5Z=59LZ{tYmr^-!p z6J!vnc`rD;rZl5;{j~kE|2($gVae(m_@ZfEX z7`s~Dy5|h`>T*y*I)UA8hnzKet%uQIv#v+U(yZ^sw*P6V~dfKFk*)UugC~Cie&+OH#0*GhZR zrnZR|5DxSFgwKmz|c21ewxr=4u1k%~jB_(KmyXPl!jY zC`Ka=Ill(zZzp@!_?@(V=6!#=8N{;t@R*3@Z)^;T1-JG_&WW-551?j{T;Au8wgrh0 zU4K6B1Tnf;e%=AzDs5kXfk~qT!WB z`!PD|LYTY@5RD`UaMtQVIlBswokj-;Y7qUw#=VOVmn|m28XFbozDo#pPJXj|LUym4O|%*`CTAQQ zlXZ1W%0(onlBgI{^qosC6eXut7#mk^aZIU+CZ{v27}xBcOKlh=r?(peX+Jrpbt6(R zg;jtI!E@>Tq7=+=V-v>gP8n0t6o1MpCM@~qGv@{=*lNcn)eC3sA^eLuN2I14Gw-uc zWXrgh$EI96?sIMsi^-_V#bwrE;X)4q52d0<2;L0FoZK-7nP7&$6otjd{C zmWKl57%EXpn%PLjheFIrDshg=*;vPiB0?l;NeP;{#KebUq|YPX{js^!j)xMamG{mHV7VVRpHs5H$t z1l8VhczSPBYRylRjK0rWdf=_r9tf}9v>lE zpYZ)<#KxO3)F)g2JA%ikwJ}qoSC!#+nU}G@u?@*(vJ&vH9LZP=j<(D1yQF2DAbrfc z$oVK^GA-0TGh`=lBCEIlC(OzuWN2gdC(kj*{OgqKlvDO?*RkyxcC5VWZDuQIhY&>* z6fXZKDaQNYi6&z_KDMcta#M#E%6WjC0^QTaYV&6gN1LAfeJUGpdNcBEkdU7(R?TK# zwefASCYG(rjNVG^YqeKM^{y-~+FTqBXJ8TOxX=mdfJNzTWmLYU0c2@$pQ$!#!Oxaj zkYoO@)@?F8)wOg$)|~zMb=?JqBX2L3Bj-efQav`- z_7CvU=Gx@_eH#Mhg*(f}z%P+|AxFHqU#RPn5!P*@Ot(J6O71*T>0=Lbnsb<==2oLe z3-r+43Ir1on4h!TAG{qs+6occ1$2HKGR1Kb{g}FvWvSa_Q*fJFuD;K`|2XD+_LvFi zzMuBp$fmbzpGcc}DCGghLx(Yx%WOErY5~vGdpedHryi?mpHC$9Ugt;TpBl1!V*g-y z&MwzHwV-WYip24(Z_B&259svj3v_NhPd#^Yu$<{$ckDnZy!7F9--HW%MBQIK5A%R; z<0am0Tr{8C*MWC#)4WFwn;QP!Gu7Ez_x4A4Z<*d}Fvuf?zQX}}WCXVmIjPZSK z9{kiY4RoyXe%pHQrsYHIMhQ{)*v0F485QWhOPc;TEHioNiR*qSD||oO2fr;%^FOtM zYd^1?zTUS`z8*aUKJT*hs3#SA?iZ)QkDWcAH-0@I`zTl^d0*fc*vOY>6fpSy>kEwK z55egVsqVif;rp8A|0>~kzwD3r;*X3S@RKtDRXyOT%pY6b7rHF~W+edsC4dk+@Hb~5 zNt;(vm?%zq;Jictoq7QMOCSSw5EEw*vwHxIdr*l)Ah&uT&q@&QOAtSHupkvaTzHW9 z3&x-HV3xLE>6KvFmtgr(YY?WD zp_b{Ph@2sO|EOU7NmYcXWDKZ8zl9m4qwBSW>8yl#zl8Z>hihSn+EIl$bB2K(vBNkL z!-a&x!qUUU`$DZaBNEjklHDUx;c#r*(BekJ)pjF9Zo^~XBI6~|+kOe*xl`4sQB9JD zuc$GV4@6e>b2k=5)?m|?C3&^Lg?G6})d+?2288udMZ3a<4WEP$xko3HL}r_ZkFG?A znTM5Nqx*fM4^t!|pW_&Yg|M9E2)q{#ypI_hiTP6;imSLrn1ORY=6v*gm$3>dQw_~_DGHJgdyfciqj}yTVm?$W`C@SaK3h%QzrbtH2GG}sVVX{1R9H21yK0TQQE%wYkWf?MA zeJn<*J;i1=r3#x~Y&E&sJVnDJRlGe`2`70aJyjMbMcgA*1}9a2EagZt)tEZP#Dl7; zjmDNbO;0K1nyTLUNcI#qRKt8#x-y&s55ILvIthQr%yBcG_sZ=vcV0RwP2Qf$9g=|fV*riqSQtl^pKCY`R6S$5f8zW$sGN-suy zO`L*?VH%4l3Xe{wiJ3bo{?x$Md@Z;dEpYX~%F`%di_9`a+m&ofQrQa?nPzV}SRUn$XJwj}Y*&`0cev#~9XZyx zxosNdH@LK=|H_;#Gtaqe)jZ3-JZq{>vvlCgoz`kpm1@>kbLt|>IwH6c0EyVN!Pg$1 zv2E3w%-HT4=|L881(|6P7Ws(EC3!fNil<;fi}ott`~1AjbXNG}FpuCZqE>W#c>)x7p zt$brGoj;e5xE`eVE%)5h6l)+KYKQ zO0_!5X}wbLI^tK_YtGwi@jC0G;_^WqhVC70Ssfi&on28K0INsr9ZIp5PupmxOuO64vBPyUg1`w?Y2qyXjKL&(lJ3rjDgqizUz4KDq2MDqT(s1&yWPyyl zLrk(msvkit_!&r2(SNMt<*kdUFMuMv!$R7_#qtNdu8KCrA@RMg0exs#s`>NO7ZJ=!rFW|fezXJ{tn3tZ`h4p-p$_4bmvV} z$)MCe5P2o&%B+z`v?)nw!lk}7oOq%kdV)PTpNXoc*4sBns-`M!e8X(=vZ8!tqq_BZ ztdiG%9g*P2JO2I#?p7C`z4Z8++Z6uE_^h{I{YEP0coi)GHhmX3%pQ1JLr_R`Uxr zt5~EPhR3JR%fW@De5t~(GxOYy44;Knk;ybMO;Z-B4db&{Z~*ShS=seS8Mw)7ULT@} z7BI`y4tM5@WzFj9!q_Y0udF&ro0{)d3x^X680Xn9k-1;8C0!9MdY82_z(s?}1x2Jq zeVZk$iYc$mrGLOB@#>si_~jkxC3U$m%gZGUndR1qMQ58u-OXkB%Y`oLxmAs2OxoNa z;IgM?_O!*4UQU^`&tec#R6@?8+vT#lcefVH!Xh3v6!$a{{q&UVnxECoee?wJW*V2= ze6RM})5coqC+I6+g$QlZ>iqsp$5SOxoNKvB&N-s zYZEL6T=Mc<^5iQw;9Jy}Sv}=l_TXDWLC6dS=BE3sd?TzoLmYpfTw0JF58vGR>WKP? zS>>q4b@|-JVORnP?fCobM8xcD(=A64>^cBfNOX74;g`c~RHsh?blclBa)&R%`ZX^QVcJ@^Dlch%44tgU;` z0_g&k|GW=*ub2UtO)wN{>$_;)NT_-E3n}dxf7VkspTP3+7fn8v&c=xMp^VJTcw>W8 z#oAvkZd9a&Mj9*t!2yTnjIPJ!?&b`O&lTzAOlQuOM#R?C*vvIUeG#@ovTlsWO;Mti0( zjV^XRHh%W>d-aNYRqML55w|RAvC1?xM23CC5;rXEvGQ|yiR^ic-hK<4c-&lit=~2m zgR$L&U)68Ja~c*;hx1YN&cry8z5ecT9q;i!HowW`hg zeZIwgzM~Yc5g9|=B18DQLH@wRSN}=e7X**Q5X^a_-yeoduRECjZ@&|YfX^2iNAW;1 zkzArNkk0mo*y!|D8cjCe>TD3O7{r>45!ToMKd*IxKG$!D z=8FGq9|$D04O4e89F8L32>noZG#*c)R~z=$a5A0B;&TJTd}=tG&lSm~iTh}}SS|r{ zT0=iIU9H!2dK@PsQLIN}fXp2>Ct5G|dsqlW61ppvDo3Ckjxeycr}No-wc3cUj+g7z zdYa*4486ot5zK|deBAb&45fr`Sgd;L`l%mWEzLTOZDt45n1q?O_{cu2F zlw$0GW|d{;bF7!ep8mrs_h(tTQI37v`JM`As1s}>%X2-*st{Lmz$zo~4*j4Y1V!%r zR|Fv@et7+8q4A#tksO0OCuK^LqBLXkA0=517l$c&;_qzA|9DX4NW399U4Dzo;DxhA z2(v!^)le&OQPr{{esFzK(x~gL zW~%XT+VJsACHxy)nyI}7ze>H+w8_Phy%M;({pdfFj*}1@Ob(r*gjg<%vMgI%i)^=H zE?vO((3@p-EvI4EHA9PC z<0r$qQKuY5w($Uh#D{%yT{W}y$R!*7QWg=i=TQN17S4Sb<8;?aej2!Iam*!G({e12 z5X&XjR#m*&*VJLwbqCEygiX=@g;jrSU@BdmMfdw=C~ zJy@oe?RgGxOSMbP>W9Qh)Znt#A6~1;ibH z!x=twQIX&VNL>{oM4<~2g_8S!A;qav4U%9qr;9OET7>+A{(-LLF3OVV5N?7_ikp@` z%+@j^4h>y|{x~lJ&1@a!R!mCxm_8!-8Bb>YXCJQsPLvdLHYV&(F)@g0gv@3(K_~ct zlpIIu+~+pV7Tp*vVRTTA=2t?7Gl&=`gN*-bHn~LfkXj{!O(0e@K0n$BO)q^IGIB1- zAo`GsRBTM@DKV|*!GviVY%HbLeUk)*PC^pLCC)~HmNu&W-^nCK4y`<&xmOUklptAzAUW zXoaLwN2$-Nq3{mtUbFkLqU{_*8*T)&Te+!j9dQ;l@~wc~pGvL;2cI`Hq91BYVjM#W zC3OF}p$o>%3k9M*QS$EB8xcOMceBmv!}!3e{$!6gKyyZzjjv*F^tBHvic#+=p3rY% z(Wra~xe02{Hp!I49+}gg)87f{{-sqhz$Shly;#+Z=ckdTZ zb(OA5LjurRvO_b*D!7FLNNG*k|7)$Fro5RCPue03C4U9FRnCj=N+&IA<4*d|xaFj{ zCb$8w8)UtYZJ{ISO3Sv@1fyqmC`D@ethM^}^xXXSi8?9WGigejravG?n{|(6=_U3E z$m-DxA9c{58lYi4{vnrrcCm2;*G+lR zg(7zn3fVr_ZWa`g%?Y%Tx-%V5Jb{aQ?uYVlwgX`tLN;5q^W^RxhHjh@DVSshfGy<% zQCCp)+DKZjWYe&GB6htPTP$h>f4@%#$#xfR#crrjQL2yG-Z&_CyO$w10Ftlrx{P4*M^^Gt!5@2J;P>NAf`*kPv&*?DCXHU%w7bBF3WGSFQ(Mk z#UEneTS`o=57n=6O|g&N<}V5}qULAjs=9K~5t-#NT*66!>k}9s8nf#ut&U3FU;C%IO+KM7B00nDrRU(+C-|IJwb7$yk zE%HGxBR<8D6+ZDo2@@Kk3s<8caU+rO0HJ8(Z?b_AgXXyYcJv<={rCO6&>{wJy_|?y zx}CKAW1K=x1MGi9g9Akbc-i@k2l=cACAuQ`l|@sz2Bql+Wts*jB?qO@@gyHaC7{K` zlSSpb(qsn*mHrGVKM-$bQ7Q7~{|z2eNFK_;6H_}#wS#K4A`wzK5L12_a#7V+ z%FYyeFv1{A>{F2*_*~`0ycp8`Xs+Qw zPC_8FKqOH^@3mkR|F&OCkB2|dH*nnE%UL18AUf=W&S|R6s|KztcRC<6qUF>=?-Rl8 z85?B~wyIhEA%TxrtK~8Jh&Q5VjHK}1O*vO=4q$gaYXQACG0Jq7c#a(N)UD(45-ZWS zlXlbK)lnHq^*IrySo1f|NzheQayO2pSMg9s(`~gkYzhe;_VGk&NO51J)oP}f7k2h? zRn(2s6Yr1kZZvM8bvCk&h*^@>vGNGMHB91>DYlC{DDz=#2+eBI%>_x`b624%0Y8d> ztE_Z{*1)@lo`F54w+yX+fy5Nm6BSRJ~(d)3BqM zHa|azJdn3?o3${}n*}bodXa@`KdE;LS`JaUE|rc6yinQer93&SJiZh?0uwCvBXM%k zy7x3_@~d(Zf|VXFxO=s@p@O%oGI*k8w5#gRNU9gtn3BYPrT8tL%mk;*+kg-TYaf2` zXy4f|KH|jr1U2?MDAbu~nU(R`33PQ<6RHftiUtj9j$#yZfBc(1FPwhkQFsQ75_wMq zcz4ugwUxYcgYYFMx~RTElTLX{oqKh6EA>Jm(;AfitqOwN?a{$2ML{L+-$s`_iO;lvHCM#?=&je;o+w4w|AA^qOYv&MiSiw6wWKM}64 z;?Aeh%8%j?&=P8s3apE$s)$sILun>OA}u2Q?!m=0qWF6MwM~X%|1~fEC2keeRw<$G ziIyQ3GE%K}P&J8Jw5UeXB%d*yB-mY0H8@mdAW^mULAS(E(;!z%XjHXF%Cc2iwlPto zc~f;>OmawBb}U)0;!$%q$#7X*b_E}*C3>iN1JSf6hO8@>19O&xfTLdDSGOm6idCMV|dFa5<5wv`IG zpD6@u`cgEB?ix84cs|zM5REhlp1C!LWAKxm<%89k3-h0a3zYK<|9#u#HA&F$N&yiF z(`A|JtGkguTzZ*l7Ug)!YI!wqhy(jNFaG!s7jqr9BBw;vT(7(I%{c{@C5msVnG zd2$%P)6cGp)g|6dY{=@*S^xXVwuP~%vzO9~LNL3#ID_%HxM3p)8@z?gkK>0g!Zh~J zl!V8ah72`#_(D$m=euqzod&kHCUeXjQjuQgADv}D-(qLqjf&pO#V*BW9dVApYw!li z6F%;THlgw+c`4!&J$Tf@h(cI+*XmJ(0H8#Ork|t2Qq`f{n8OdkA#NteAo`J^P_|o3SOY_2q%q(Sf#aq(b-BhyJ0S>!JSeHtxSBU1SVxaZ?@DBYt@t8up`f z)FX44Ba2WZN#7$k%_D31Bb(44y4|Mz`A7DtM-ILwhN`W0q3E`%W;Ro%cH(A9Kabrh zjy*~V)P2o(!5YWjrpNNG$6oB(o-pPfrKVO-X8kkAL0iYjSI2=cKLU_X!eC4TO;5a~ z%!6CZU3E?(C@{j0%)?Z5B9_dHJ5Ca6P9iV{E~QW>@YtLmPhwpyg1?_qZ=rDIh$gn2 zCdP{CQXHnhET=x5rZKFft8z9QacZXS6`D$9tDa>|ohH>R9{e_;PCaAIJWx~}%p11M zca`-bY#A-$mCil*BWGEvd)5FWlA|l}f_hlTuvF!0Rn4zdlY82PeArQQW>~?0QryinQU3@#{QW@VrjN6k{N94NNQ=?PcBOYvs&(ya~kyxag=bxASU_9DxT9(Vm&kb9o8n0B-&+{(E?ZN0F0`8&SS_5w!w=bqtts<1*#{&&T6 z82IbUSQ|k$mhSbtVD~nDV)<+F#^iG4)Uj*+K8xS0Gj449n z4jXR?GJ{ijPg#mk%XZ{8d1&Z2GXcP|e?&h}<`Adz4vuapQqSYX6OV_l4#s#24*GeQ zuIgh5xd|`X7;-UTv(d`(5ieE?y>E#Dw;q4Se?S6eRdXeQw?uK*#AZL%b5Ayw)Ri&8 zbM5FiU%Euoax7cO_9mCvU){7+YWCAOeZdWcHu9eabTCpLFsB}@*lZf5mu ze_q4=I=M(3$aDTdf>#m!!&c?CVF6FCnTV}6CZ&k zH9Jw%5V>2sdAZ$ysnd?lt6(6%<-!*~4dN*OzkwK3orpB(#redKhy^>?m|#zermhmD?F%OM(P z{|>B#;dc#meMs|v2sGWp)^*Z!8(??4@3C3u+jh12YPEenUhr8e|MhIYE#L@-y>)JN zbD5@e?J@I+d-mP_*{wXc@8_g*Te2yP?&4_Ls-8GZuK5QFT2XQNZ_Y zb~=UK%?sb=Renx7*sgXc?_H`mKFj~3DeXgE!%O=)F+Z<@QrG=mJl5Cqllhy^#801I z4qv)&?lG>PTC6SF@V;%ZSt}zEtF=CBdcS=9%r?z@!Od2KwQp#{-UHiu-uFIC^+2Vi+&HNx9gQOqNyN8kFzSMW`~@KyQA+@VVlkVmvbd+1%I0>v zyEwh4oXHo^L$y(RD4#8sOrx2>A2O{t|5Y*sD@)0I=M&#I#PDHvaxz) zIhx4ixTiaPH8!c!8FI|g#66#^Qk7^_v1zB8^Rt~Srt%MNp!v>H4gBe%z( zT7|Ff&ySbq^Xut9cTTh!t%L#JamzIvf2hLbTAk!z5n46~aqa}8a=+xeOo}zFI}%Ww z5Qh^*Vv|IWW~vuTOafuiLSQ>yNTS(qVYdT+&0!K+gNsTyv^24EIksXsP*(_*Xs1qy z5+!Id$dY8ZSILqUAj=J-m^D2PJt-k62~zo7Eiyt;9m>fgjWabUGR-P8D6**JT1e9L z#<`A76eut$Q&r|F&=TBmaLDsrVYtilLr^`-3j*a{OLM)r->BrQ5`!s=Q`XQ?ATumG zPD{VFyjB$FN8-{{6lLQ6N`cVqpaDdXh*JYn&o}|GKL1?^3fuQO05w3|j&lEc_;d3L zeBz%d4P!K&bd8hT?{rPG(meFdi<(&%#zVOs)h(Nj@71jsCGZ4M3m$A+b*Ec{Ryt=L z2{czh;s9~7Q8Q$H-N_FUU68$7!8m$WQH_p_!p z^DvfGHuDIcS5xUEX+a7 zNsG4Dh?t*u)2tLJuxU>23*&Bpw2Z?=lUtSZ!G+VxhILuXYm;q7FRr|CG<`_C+4G<} z)Wt=b8T)cxKfvF4K}G{M9IOJhb6w}W zZ}HspAP^C4F&x!+r8Uv&z28l;et|#kTK5^q?$luXKL0DjJ;0}aEIqy#E-nH7hr=Yl z?pH_|BK~(ahcDmf8xWDeXOHid#mVJY4FA{Z^HKP&paW+_C5$s? zA1Xt-i=ffkPtXt_#(z;zuAM&6vsf3-{)YrLj*|)>Il)H2o8)H!)esfDM7SKjCTe53 zD7~XYRG0zDxI72lSq`GN5-%ynZ29mX+`&jIuYD6tGxqx`#grly5=^PL zY=*KLI7%%I%@v6f%(3 z1m__FZJ}RGXw;Kp{Z$F*ngldj)F6$ThUC)O19mMbP%1_!tvhpB(o6-qbEOi`^q+Bh z6etMyDW~*D<72+_RdgSc!<;AW304Uxa-TP}WEc#SVM!^Fpk-qLz?o{i?NvNH*2$2} z;z&5xf+B`6xTqU3fr+{BUmS99@zjU8P+ zfAnIGGAXgn^~95MMl$fSRk;hfkQr5sT$ze-@Mw*xpVoh3R#!(%Q`3lD&Q1SSuEq{K zH>VL?S`oZ!2L8ots`IfjrsY}RU}tUp^I0t$wLdJS$RZqnfkPP=HD-tFk~ofJO&P|m z>OGfK{$6|~5QVEYqMBCaw0Whz3#nUzdDv+XVkQ7OTdG(~$us2}*8yo_gE+qKg^;a>KB+ydBRlPuSGh41L zc`@`13J7}((k(?zHa4<0=LX1m>O%~^6~SCyyEss-!+k1K_BhM=-vy>*{L#r^f6Z@Q zaX)r_Hrr_oMe5X&;B;RN*?El6>OGG?1H=jM{OUip&Q;sHA1<$zj-w9AjZ#Lz820}2 zAAcZWX<0K4m{rvW(75!NwQyINj9Kvv=2Bn!3qI|0-zU~kS)cl7uj(RSt=BN8S6ZXx zn4|T)*Ckq&iRoaPa(~!pY?*4dvV$LDL=yM8djO1(HZ*E33y0M6@U53fPKwotOG@Wy zz$UPvmD{YByvF-{{kqM6C6>pkX$hlJ{PMAWNJdSs?5$JdlQFZX+H~M1W#JnBQB;)o zWT)#vw0fAmP3W`wpB9hK{E?k6D2j{*oYb3 z<1~9CD>f^+E`zY%RV4(g95v!eb_11N!j7U*WcOW4B2X>ABI4f%}sCoU(G`? zD}ga>89FB$wS4}#;~7cq{gg}1W7U3FLKYqON`gpG}B;>H`383ZeI>vt`Vr_?MlH8Q*{2`aX}z5GEWT ze-y#hdJH&qN8Jy96wxTW&PEYNror;%u-Cp#HFk&QN$}-JE4;0O2t&%kKGRfd-r@@(DQlW*Ym!Q^7UGlN4{D1G*4XnNhkO9_M2OfSCUBPW!ubn8;mph zNl%n4IC8a`2gxvYPp}j4Q~%2a4gx;ETP5HAF?&E#|A_B5Tn9W<=#CzkQy=n84BGQ| zz~A2pnuFirM;NG6t#C$|Rn!Y?pv8TLAuRJR?RTcice1m8|KJ{mqX^acF5dAfk@!8! zg??WDr?PMQ&QD<}c*p{m_#b7)#E^m#2*R@nYl$VR`pm0KhAQc-I!oBOyXMWR(kaS# zxx@@51^B6h$gT#FFZy70;sClIGWdA>_`T>b>c9A5I=Kqarc!D)mC}TEoi%Wh`mi*Z zzmxWhp;Hw6^o$+&NFanE%KRHC6TVPoAKX%sZjnM9{<k7=CngE_*m+hyI}__ydm zzNmMBRQ#S%K>>qnD&CV}@FNL6Oc7G9DiS;?OGG-IrzpXlz9aSym_l(XVep5_M*%P2 zo*tD3F+T~9PKJ(bp}JT^s!I{Mq9F&eGMnn69%7+B`ra>g1GHh4x;|2F+``Js@14|p zH5JR8XCdgidzmJN0eqyX`oskPhA6jIrJ@aKx`~+~_eK7Y*<7yU?dglf8)8#Pvakn> z!3Wca4u*asWxOhsd^5y7+7n?Rlg=d*g&$#AD`?v(0RJ$~!Izf3Kw>-l&Rp-$+|arkPRKS)L}}crDHlwcd}4`XVTsFGX^3V~r%t)*FsVA&kSZ*&oX68VOw%ZQX<5ya+&-0x zJeNw@o_yD#Op6;vo7-F~n$pXjSQz;PTh-KuqBP$H*L=#L!~@#|Y%Z0%XG}sGPhp|Q zZHkjwC@fwazm<>MQRY>t>PrzE5Sbg;Q7qa^5exI3Xqf2tkr==Nqw+IT$&|eIwzzS2 zO;b}%jgMSC0ZWCQob2c{M_Q#GNUg}N!6&Q|31gXKTJAffrZifvHD~U|J`|Hm{Wo4p zLHVzh@T|D0vLn7frY}u-Xk~dUO+{*DMJ`RHuVpDixnw+b$=l$W2`Q?@u?EXn{U%M# zQDw~)P3=={KWSEes12VtIjidHtkpEo`I5^TX~(j{)R zwQ6((RJ2*P9Emn7(zeF}VoU^q_ncUH_t)$O6^4t4O7dklIVJ!k}(~Eq0gi)PIL8CuY=}kwh zd33<$Tdt39Q%rL?Xjo8wM>YQhj+=ifw@gG26FQ>dFU6}NE@PnHu{=#cW>_KtESbg+ z9?`kZ98^nF&57f!l+yntEaX+aB1trn&oogiG*|9FF{-=VCka`nsfyhS_LwrHQY`j2 zR2PgOreQdjx~y((uAv>?TLg#h4%>1=C`an`!NK^YZm@yY-`Z&@sAJvE$+jKf! z4zOJP=3-E$BbPrbsv0&rDy$}RWmshw=hQ87)wPT4nCI%CQWU*<{lIeFVZfw4Y)S~zW?Wc_hPS8A-6dw@@KE!KA|oLja@5_V@xb4^nRfxwtt zW0nkKzk^wEty*EnbiE74489+x4PGBc~7JY&7?;wvqPmF{tUHMJh1DIH6u$Y z+sLKV1#1|Io8B;FTELWxBbOQrQ~0V@8ft*I9Y|!!s}o-`(9!;R@K7(84cNz2HZM;jjUtooO4Q;~TysENP9ubM_ty{sX@xsh!=2<6^vF2;IfB}OtU$B3zGjTX`rF-n@&lOzo0DDaJreP%_r6WMNXK-0FIvIAdC5#-cF?bIis>MQR9;?cG}0#auleRGkQ~{nEe2bPC6| zTNE=am9kQo#x!ANr8KH$&8l{6YI&94imIf{tg6^^Xrma3A!#+snl)?L zw2seaz+k5~!gFG3tCmR{HoG0R_iQD`nq_GRy&`;VGk^}tlg_=qy2!cSd$XaNp1ugJ zfq<)lo6g=9TNOi#3FXrnn`^x=yP3q(34v?9;gd-m`>w?kz?I$7>nSGS2@u(0mE^jX z!Cq3zZUb-~u4galZm}I`Ic8%sd55mhj03{h(f(c=sS z%e)AdKclQYcbL0no;~v;_J*gu@IpXDl)Z$TaYnVaMfGq-kF-TkbH*&U#caEWNPKtq zY@3W3r#$0`fD(*A@n=PP<^2f(vD22w$d$y=o+QAPEWs5;iXC|Bmhv?aYQ!3ckXyTP zATT<>|FbtD?j-@LmpA^EX>7n3(C*v#npVq|-RhCu)1JM|m9yQRb^Mxr-kx*Mm3z&V z|Ll?f)t-;VT|m^4NBNdd+fl&EUC78?%;8xq&{3?$U82`fWcF5U)luTaU24Z&{>%k2 zt|x0wC!^k8LD|lG;_hzeQT)P*1^LR0-y4C}EBh0IKe^p+Su_wdDDct|a{mUdC4%sW z;t9p;te0tTVB~4!=xoG$DOVD$Xr&I!eX9-1Yog>z?Su+DCU)y|3;%-3Ao5Q)6RRP8 ztwHNd0eA&adet>{c9y*-LwR*wy8#7wx{o`%uf0N`c3iO!3UMo&-@Q^7lbRbneL6d2 zcUpNMUfZSzAbxwK=e2b)z5r!jhQ8c}MP6j9y!`EWd&0U#<9Np;-bH1-7*TjzIa#ioL6}8+Z7w!|RT?1%>321_)<~&39Ze5go^C+DMGW-W> z-OFBG`;DDI+RsBQzGJVh!`9AYqwd-;{sS}cK^piliTAv<`~3NRTm*U?t!X^$R!IFF zRO>bY;tikw5cu8eO3U9)6q0V|I|SfAaqGUL6j-$a9~AkXDDl^lcHSfS_yK(9NPSlE zz8;9Duh{SPMWUdw@P>mEjD!O*IV_XmP)Yw!0O&Fo z&BcNyGj>$Dl4VPmFJZ=%Ig@5hn>TUh)VcHJfq3}b0TmjQC;|XJ@c|erRH-|o41Wd% z06;2Lpilo@jduWFJEI@Lh7~)OY+18s(WX_qmTg0a$OSJ;K1niTWy&HcFU*XR^a0PNMLVo4aJ5I# zuQ!9!$($RrR=rzy@7%vz2j>lZxNzUbi61Y%TzT{4&yh!G4t=_G=hmrTufAP- z_w2xZ%AGnMfZeb0+LfoP9&7ld>cz7+EKe?itwF!K)xV#A{(t}f_aka40SO$?zyc8j zYAc`w5^R8Z2ouOK!U!;|B(NMqNivZP`bZ-WBf^lQuw?VlwGVMK(WMYK64A95RV0x_ z6nU!A#v5_WQO6y5>~Y1Y$eU`Y^WF&@8@xiLT`vQ&f z%0m%NRM7*LJkZfbmt4@D2FFxv9(NX-iZBavobk?(?CccOP)RM-)KgL2=>P;+ZPis* zk9t+sR+F4{)+U`=5Xwb)?bX+}01dWFVZX%ZufYKRXbm66D%+I1@34#ZS!una7TRgC ztv1_hwe6PMZ>Z#Gv z*y@e<>MKxNx$fHQufYym?6Ju%+w8N^PFwA@*>2nIx8aUk?z!nUTkEG$rdsd4#cCR7 zNsXFU@WBZ$-0;H@Ph9cE8E@S2$03hg^2z=wuiWy>F^3m$U8CmPbE&Tmo!Gm}bEh5C zQ9oVv)LCEM_10m3UG~^%pWXJ_alc*n+k&I(BV;RwSMm469 zjcasc8{6o?iGdJ^bxc$V@n{$7l@5n})Zrif7)U@4QjmotXg~>?(1R8fp$k=L{zDDWtedDC#J~3JrbmB3WE!2lQJ{nSxj#Q*29VtCg zYEPA>l%*?mX-n^Uw;oDaG-^1JdQ_z*m8na0 zYEz;5RBKw)rd1uwM$_q~6Ee@F`ta&V31AO<5Fo5%?J7x6`ck#RbggY=>s#F#Lwu6c zsu{&8r2hFypMtcfrn3h;#7b7d4%Qxg4QXHZI#Gu%Hlh@DEMpbhSjawBvXzbOWhq-x zuH@>2b@l9%uo}9K9`CIBu!lYd+Yi;Mb^wGeZCc?P+qlY>wzIV@TjxsC&+7B8kJ9NE zhx*gO5}+R+xyL>J`r(hV5`d_|jp}oy3SH?&m%7unZgsJnRI2W_s-exQTt*AL*Dja1 zK9R?H zjM*69Z@UD}sCPxX)!~hIun?B;api&B3k&viuQlGhaM-T;j_1DfLS27{2ju_*n95UL z9bCP^-E;cJ8#Rb$99~vwGC2rf;ZSP3qU(`qfm?b$+WHY%9wa%Yo+Y zmMPig4DOZL!|jK9{o!b@>I2frC6i#8&EW{Dc!2IoAH2xtF7b_6#P2d6w^8loaJOsR z?J6LO{Ri)Po$tfz6Zg5+W@2(;PQ3?Jx~HC?grQaM>1N`Hr5<%VBa!NF zHe%Ja?)9*jCyHQqBA&axb*oQZ?NDF)*p&!&FZ;RAb*KB?(@5}~)AHb0OZe{2D&~7U z9OBj{vU@8o(u?a_<*+8X$Y~vU$fvv4l|P-7F@0)`OCII0);y_K4tmFjKGnERdCgI8 zb9mx>@3h=`%#@A6Y#$cr1Q0sWS$lMUBz^XV-S(UHr{Z-_rQM+Z9=yl??X9DG?D!`B z#_9cL=bL+e$gjSqn;$-O3;*%QcQV_be_~MsocuF3|G&>KaQf-J^>*xg#{Q1G{)Iny z@WwsvJtBU1Blm9erZ2hYMQ_zE&+#a)06%W>9*^^4F60_d06R|rKd&;SJo0Y$FO zR4)TlkDXYr{p{%V2Bhb<2+YW;y>5@_j869epdR#rA6#(h)~t)nF6xS?>d>z3#P03D zkL;Wd?zj#IiSO%jaO}qKiF)wsgfIwwa0ioc?v_w+e$e>NF6;2F3hnL+tx$>B&jWwx z{YGb0|E#SZRErp8$m-dqZ4dMXdl280fulUIB6zNR+z-{={ZG7e}_)N_ET5;ZJ(G}6h6qyeer4Rjx zQT>Xs{Em^8wlEU0#|yh8{%+^cJ}MLCA=<1F(&|A|unqCfiof2)|1vKC|IY#E@Ld#< z8y&FVMiZX(sTa$ktiy0*+x;@yyp^o zj}+6d{AMv35h@s|(ipK48M87fxze&$vMBY&C9?!34GkyFvKxgm9X*cbd@?BAGA;3u zD8W*1j#5Fo44Zx~FAowWt4Z8al8j1{FaL5d1+y@X>MQ3GbiOOJ$PzB!@-ZDVG9lBK z{v|G)1edK|_>RAQVabGe-GyMrE`{Y4k>mXgFJRQARXt3{*vd z6h(zJNL7kOcQjF6G{HDjLz#3*o%BMR6iT18Ll;U%j}%dQ6ue4wNV$|qyYx%*5jv6S zN-HKw9nwb86i3xGP1$r!rOHal)Rq==PLFd-z4T7OG*9ugg^V;#C8;|7={lp7N(Z%2 zr_@lTG*JoFN#WE_rzA`9VLkP9QumZnEj1{_{xqK)^+5qOr|h#$LDfw|byP*QRLiJQ zH}yXtRZ=UpRWJ2biL_5s^*_uMQ5RKFZ8cX9bysnfS7QuSXO%xz)lOlxSY7p4yHr+# zwPiXLuRhgOp_NpnHCm}PO@Vb;fu%=T)mXU|S-ll9l@(jvqE>xXS9|qbZ#7-bRb9)q zl&)1=*J4r*K;R^#{MmBB%9Wt2JS}>0R};YUuP~ zeY7=O=MQIx9QkkL77uqU7KS!0>P2wFc##NtZT294!^d0DE1CdPisr<4Y_sz(ROCd)^#wjWZ712yOwQNtz+eO zW+l*WRd#PvDqo@2Eci9<09NaSFd_|?W(n7D2N!WaEpfdr2$zos$*yr@j&jS+Avtn# z3HER!H(=k;aV58K1$T2PS0g|7BG1%vJvVVjS7BWjVXy0H|5hyIRbt&X^v?DWbr)~9 zHf}p@V#T%)@78FAcXt7?V*hW{fH!xmw&jL5c<0u5pO<+}_T{qnZW~W|O^_`3;Wf5`B_kHy(741+$<+px35dQ}=L*SaeyJbdR`*CwGej_=#25il^9$TNiXicVMSb zbI15~*%)@6ih_gqf=!lW1(Afo)`fewZHc#zKNxP)7I^KrhWS{8-!46lQ&tDA-Lb*xPs-lC-XRxO}U4?b&@IhUXC(1 zd6S9TIF{XbmStI~LK%EV8I@0Ymvvc^e|VK&wv}a;lRvqbiTRj48JRmdpl*3~bD5W+ zxtF7v1AiHq`(ub}nU=LVo4I+LtEid(_L-%5oTr(b!}Me{)tbi@W)Cbvm)V$;IiBBH znc;b!2?(5_R-DUupUs({X-JhR8JoSin+bZL4VsPd*=6;)pBdVp8=83lI*2XVo+-MX zEt;M&TAtfAp&NFg9r~jm8l-n8qAOUS3;LuFI;By1MmbtvJvyXeTBKtdbx0a~C;Fl_ zI-@IEr*V3x{=2iK;q|3udZ=gGp=)|}O=+_nx)n>=7ff9Qw4|}UE>9PBVvb*}S=sH;KT96)TPZ-5^ z#+DBg5v8g(kV?*l)DaK;FxEhuok}@*Kvs9zktd}$w)41bFK^Z|E!67kQvbSP*BZKf zXexZdt&OnGkdW&b(h95is4#cV{8f!>(9Ni*xt064wi<^Jwmk0Al-6C7W=uLg=OUT2G$kXH83|K;Y zeCiZCaih+DPi)GgPWx=J78#p<`WJt)+{%;O%jKtNjT}=dyU5Ml$-f-UZ;q~&s!n28zYezyemGr&D-T4*SoK7y8d}E<9YtO zSw7}7zKgX;yJ;|rBc9`-uI6dkq9(o3oxbUz{^_MY>ZyL}t-k89{_3?p>$!gGy}s+g z{_Dj)?8$!WXPt&9288tb+p}F`*&f4>{nuGo-rs%PTU_2z{KK0a+l3wPhaK*dy|k-+ z*RP%3b2r@M{_eHi*+rc2E!^0*_O?|{-5Hs8dKcaG-rDUR@W~xqf7swbKlDX^^hv+; zO<&-Xaw`Yht=IR-^L)(R{M!J%&tboRv;2OQT+Ipn$qQY}?_AA$pUmNh_J17E?HtU9 zfA$-@_0!zXd%Vkazs>c0&Y|4(g+G70JkE_A`Ylr-#^ynKmO_8{p}zA?|=UDzy9&R{~i780m5B7fdmH{EQs*nK?L#eHGJsM z;emt&0VuR65P(Ji6ges+xDjJJk?uT}+-Q(w%7YQzp)lA76&F z+0tjolpAek9GcT-PmxTEUhFB;DM^z>T~C;`JAMo~vgE+=4&ZZ#006vp zn>%y<>^U^((V|O_K7cy4>eQrLn||#&HtgA-Eqb;sJ2&nA-MV}8{_Q(BaM8Gj3qNi= zIr8Q3G&6s$JUaC0l`r$f*Dmurc-y;k|L#3J`0?V)lRs}hJ^JqK`@n>4y4ch+(FfZmMag zoPO$QsGyE2YN@22YU+TNcKG3muD%Lutg?m(r*qQXIvuXM=F01?zV-_2ufhgP?6Afb zi|nzc!C9T0_B~5qw9rl~ZMD>1Yi+jOS*lg4sDA5hxZsW}Zn@;1Yi_#eD!6K2+RX}Y zyz%rGa|u7~f^i*wF8@BB`!$|l=eanspm zE6_h5ZFJH|FRgUbOh4`PXcJ?nowinEi~jZ1T4&Am*65uq^S4%22p3gh&wO^;Xs@ky z+bP%FD$jDyP4|fQM*MKYQZ6Z@ZDR7>oZf=t4RPLt4{mtkg)fdc~YDJ zkBs@{nv1--<(z-+IiO&t%#l+^c@+~(7NL%MNvC`CQ&%j-z7^ZHyN&zpy64XOM{wU< zcksdwZSH~6%USJ&(fdio?;!kcO_kQ}`uEQN{{Hv>t>68Hcmyn9@a`75fB_D6Ey>7?Rs=x@ zO0aJ=YRQr`qa+^rt#KTLoZ}J*{=yH6u!A8a;Rrow!Xu4uPMymf=v){&7|O7PG<;#_ z+NUo0RY-n3$%)wt)WfIL&vpMRA^?qu#3L#ZE&?>56Q7tf<9%;>Jn4+`K$AQxLa#QX zq2d;sV@2tOZ;an7BN@+V#x$ZaI4ew_8`lTNH_9=NI9yi)iPAbAwuOjCxe8lmS30#M zaga+aBq0x(wkASxk&J{D0#B$Vz(MkZWVvhhxqh^(a{Z)wY1PDqiB?4>V3Bt`BCO^vT98Zp;+%w!^SnaXS? zuShw^XvT4x(yZp!^5Pf%U1}4T+}x%&yU9CV{&Jk;RLmng3Cd5RbDg40r#soH&UV7{ zo${2JWiZn$@~twJtn4R0|GCeAh7OkC{H8$*iqL~9beGuVi_HdD&WK7>Fv0vD0xpWt zj9xS^&g>{NKkCttf^?+cgC;dkYR#0Q6r}_;S7t1@kq#|%rU|VnO>b%-aZYrn<2+|Q zca)jcsHQSMrDr^=guxBU6N5lf>QRmQH>kR(l24uIRJlY|sZI%+0`+HC0qRPydNr(n zYU#OxDpUX*K&C*s<4o@Ox^4+Ff3M>YEm0-c{m?S6bh#@aTQ?H8!gXzYEtgycOV^$B z)hICWBM|?{*!uqAFNoo6D64?S)66!qqTEBPYBaJ|j=IK}T>N77s#sdmY@{?WF)bKl zgA(tN7C6JiqH=0$8ZXY)n6nLEZ?(7E&|L9)u7z!DTcZ)-icz@4wQXu&`^Dd$(WEM^ z?nto-?UG%QSY#4s5dkeH) zBCgK63vLU9O{G)Ks@RD>O5WiYq4ITchgm0z@DE&CYB zJuXv`txV(`**MD&EQyzb?7$nhc}r>jl2ZAm89g^g&|XH8ph3x1vMPG4j25e-zY03D zGDyEriSdld>)s0gaDEjYFitkz!@=?~z=^dlA7LlpQ4?sgsum)96-?P3=Ffs`A=_kc z?P(vLcPpq~wTC18Y75u8*8e@Ver1VjQ*YX@t)^eEW6kSmdn?5&uJ-UayQ}2(2CbK- zaWQjSo1uXF+u;t17h#KT;y5>Yr7ha?P#YBJ!do`(UbnpmE$%MrTi)bWuDI*X@6&2= z{@w$Z_q(Ip+%T>dwXZ!lxtB}u+~Br~fi^9>i#u-HW-*KHjyJ%QM&0X*Ji8dC^I%$Dxb(*Ra<0 zO6u}+W1FsQk^S_rHB4#*Yu)I;9-^qIZSAnnt;JCFtWb&C<)&U4%5*jomxUZ>C*gU| zaIW*70WD=3shMbO4>Os;JfuRS8Sr-gyWp`r_`LUs%TyJ-|p?@c~^C==aiNH6-)vzLABMc2>_e~Tgh5rN1< zCi3A3H`dmjzRHP5P3f;BAHEbW_78*N^b$WC`N;lx{3PsP;nYxkFh#I7D952e0GtbYpZV()(x@0l5DBvb=PQY0l^Q&fQ2 zwr>f@fVy&k4fq)$S8@|*auirTl4esGC?L8QOBz^pUgv>?#B4^yfBt8J@j`Z1Ra7ci zRd2_Ff2UO~xFd5{RV!$N4wF?ccqXt%d$;F92thjmDYDg=P}#6m*ohqVWYKlq0*M1*B%h-Zk1hp33EVp;A2QELc^uYzq@ zxPZ8FaFm#Zn5c=F$cfmqgQi;$ciWj7&8-Qd>qzatn++QVLF=jUL3fJ z+1QHPh&!(si{H2ylgKpM)^O|AJcf2!7x!EM_i-4viSO8n@d%IeNE@FhiuX8*_$V!< zI4VsCbWayV%2sMhcZ%F-klKil`{Rw^$dJX;hP1eOZe@C!r~Y~{D1B;%c@`;*8~KYJ z8H^s;iy*m?#HfrVnT#iijI_s(p5l+Y7LZowbGcTK2}zR&X_JZ6h!53}J1L7$Xhu{7 zl+FcR!^Ln6$BtoCiS($H^2n4+`HuFOk5Q?Q6S$I}GFa?4KTk(tj#XlSgnTy%mNhAs zZv>6UK^mvJeVb4izVX_t42mwB0%5BZCd6q2F$k%9S_gUOMC zS(t?RCVNOR1IU<->6niRnUN`(lS!GCX_=RanVGp7RjDZ>m^PjnmZ3S8quC&E;~}Sc z8L5eytErl;$(pa}nz0F+vniXkNt?H6o4JXbyQ!PK{>hua>6+r$G!xfMQRtLSiJZr& zoXRvg*x{Ud0iDk&ozY31(`lX6iJjM}o!QBq+v%O%37+36p5aNJ<7uAN$(f|7o}$T~ z>-iw7qEYcFpYutd^=Y5?iJ$qYpZm$5{pp|o*`Kp0k^^d(1d5miil7IoptM*kFy){R z3ZW4yp%Y4>6>6auilG^*p&RO;>Diti>YgBaliZ@2C2FE4ilQm1qAMzy!pSuEDO$-X zqsvL7GisyAQY$Q~qdUr@J?f(+>YgPG+|n zXqPZ9xORtWgMNuZSjwdX+IeGwr8W4a3Hnq1IVfifnxjz4rfuq`Z;Bd0iXl`gUYOQa z(Dxsnd6j~-d@_TLnZjxpqF#X2r|u_yhe|r#g_Vk>r;J4wGkIVicz@HUkhuq^mx`&G zs-iC1G;|7DXeV*cL7bJyam*!@Xk?ti(vHxva0R!H{We;#ih#+%Tg3%&un}9x#ap*3 za7F2==XQxAwWgX%ti@`qjwz>(x*y<`8sk-@GM5(W=Q`DxeHRvVhPr;=2Vr0_VqZC} zdDLJ4He%)llh-$V3+AZwcc}4qt@yP^#rKkR#a{2Htw^_g_X@2sse3iYVO$ZYF~@VK z=B|J?dPhcjZFhHntC@9 zXcRx1Zkt#A<&sgCuWs9Fhs76>$NeOZm(*T(G_n=8LY9YS{`RT!F6w;+pCx8 zy0KburP_|YHM*=tTtpdgzy2z4zja*D(-H$Waj4sF31?`nN^iEBTBGWY2uGCasJy;f zan)0*6eqmP3p7(}x!J3|nu)a&qHTR^EI!4JAJkmxA_;S z-7>aw<&S$ibog7p?7Oa9r(yROd^0I(`3knnwy1SWUt0%l>3g`6yItE0!4X`U4ckt1 z%5ogFH%0q-8OviEtFxEqu|K9GkJoyTXSAnRvTf$GN;`vVm%_Oy!WucksK>#H=OZNS zcb*4$IjbZ$n|UjYW?Txx9jtglYqCVFc0`i09UEq@=fN78iyCWqG%U4HD8W~Z#f;g# z4Z?fA*L&ehbulS@{ycYlhFi9SORxEdf9uO@$EIxN7q~Fl#`CIufc1<`L8xbY$7pM? z@_V*?3LLEYF*qyn3UZ zT%*X8s#l1;mTbz|yTwWbn&1SfNt&og+90b;f|Pv9wM@AbY@md5iwlZWEu7209EU{9 z%Vs*mT533@Y|F`8&+-h+C5_Va ztkMtd(Jg(M6RlV1ibv2`utg?f)CjKjx_ubU(;97v9PQFUjhO^JEaZs0%!8DJmX6QG zx(LVA2HnsME!9zd%`7d{SB-fKe+`*14Rcxvw(;84k8HP+T-J*{)=C7_fDPFf zY#pOq)T>*L1;=sf=vqgKj>JpVQw`dmUDbXa*`=Ktg1xxcNUd#4*hImV);P$2+SrUu z+im{y*rxs0Yn?!48j@(5*L=O#cOBfnJ(8r2+mVgh;`=|cJloA(+q-ky$BorQO)OCD zTcRD>*^S-WY}L};(#ieY&Mn^Iy&uu--9fF}!>!)H&ECS@-o$O!-F@B>4c_Bz-{gJY z{9)en?a|adEHJ9w0lwV=PT|EdIS4 zSet$2zN=hGX>bKTMk%i3-#pONtlddMF(|GQ!&UjyDi|6F3xaR6? zcHGElF>@ale(>tY#df}tysh_2t$HlCax1`#)vpR1$4CAj6Tar^Y~eMwS`aH^qaI!q z3$$Y9c27*#JPUd#t9lG1!Z>VrQMOvD%);$I3oukLm|Yr{Yr*Sj9WNnEqHE~aMo z>w_0T8@#d=3xlgOv`ky#?=2;2-s#G$&xJ}5T)T1(?$rbgzmS`@^>^5JOOVnAY|+Tt zbW6Z5_iA~YzlbizT^+{m3w3l%*u5seMxJbPoQe=W7o2|W-|XK(qq*VL{%ufxy1h%g z7PRoO#o49`yr6sL6~C%l6uX#xySbHbx8d+wuDe57Ow#kaOU>~RpSqr1@*saj@8-$A zN^zGRan?QHC1u>57Bl-WGVM$HP?o>mAGXAdKw1ZtSZU_qYi6 za-ZxV%-hW_;%m>cX{YzAN3$ku>r}46AFRWDKeK#qv~cJ4F01M%ZsLhK*Io3|4z$CE0Kfr+2^B76*wEoah!G`Dq*&47MT{9WI*fM!pF4x@+QEY-lBCI!BU7GK ziPB|Dm@H+kr1^5D&6+WD-qeZHXHTF!h3+K!bEwgxL6aU;iqvUSs7$3UrTTQL)v8gm zUe$`#Yge!=JAO2{(d=2YY1OV}YgQmZgY87lm0OqYUAz8y@$S{zm+xP{fdLN|T$u1- z!-)|uR@|8JW5lta`E9|2ZAFhJUD`C;u^<7!8`+xmYuB-1&z4=A zHUiwab>kjL+qZ4tzl8@UKHPY5 z$S|!eGcPcs-0M9q+ho#By$IZKPCDzfh(YhVYbQvA+B;xE;Z|$y!zx`9lu&pC&2!O_ z6xGu?M-lB#Ox6%}bhb-n%k;HPA7xHb?g)>yujCHGr$(Ixg-YNI_?TXnM}voABlP4``8#|-ma!Js`?UVGm(7|w&| zlJi!E8^)2r8h3h+s$LKJ71*FoOtev_{z`1gyvTwqN z)iPUt1vlL9a<>K8T*XCR(r<4g$Cq+c%+GWjP%#Rojew+0;gTyOh*QOD%rT<&#g8c;lb%+V|!QrJgn; zYZJcT>otX5(M}Ux)kx}3t(49F=b2C6c}*v_zWVa5M_zqYwJ&~tLi4vBR{r<5eeKx= zP=FVKo9pxvp#mXswvH6)tU*_mUgwMU2S7poSD{umNc9(@nbicB2cylHlIvUXF~be6=8-nG(v5O zEbF2ek7maxjxmZ(+#?iUa>lRitYtQvQQC@FNJP2_fI(zr5DUn|xga1O_?ToRDM`s- zT}g(Mlbq?sWkMHXONIXSlAFjvNiWYC&V#1Rp$a=Gt{1`!mVy%{vo2>rPL8llldIs8 zW|_TK-tvPu9Fr$OSV9tZQiscgq-1>9NN5VMcKv(KMEplh`$6xT+r(x!fnz>yhSQtl z6lXcf`JEviF`Daa+asCz&Vxoh^|9J!Fl9_BDbg z)Q}1ts7wyJP>42Eq6K9rMI&lawWTwG|KupHdX%1hhBTie6=_LHdQy|7lt2CKXiIlA zO>@TdoHC{9Ol?|IoZeKYIpryA7U@!;;>evSC8|n|T2!PSRjElGDNBR;RPzM%q7|j; zRINJEs$%u382;sIR=c`YuZ9(@V$mp6&5EF*E>*2eU29v}`c}7^)Tw8s>u6xQQ`YQ8 zuL$T(PyLG5zXletgB5IH2}_%w)>W}>N$U>TvpoPTFs^W=>|`xlSRQ;ER<^C}YGONkTa7f5^@&SB>?$GE{gH*x}7Gblq0Vn9=t zx?3(Wb{R!p;;=Y4;7eb3+lM~!Zfd>nb2NI*>pby#Z+eWbUZvIByG(zt(eRUW^bof` zPNP@8@n!X@UEPi>6S~A*HdvT7so@Tv8FRXpV7okcK{mVDSa6o1oP`;|R601=Xl8c) zpJ|E8KSw*zOC7YVt&3tSE1Hci<71PDHe+xb8EIBT=#uT2#VqFJ#)HJ8xAiDRKYDR# zAuA)49U9~|{`lQirt+1m{BM6_HP+U)F0I`p$xB+YlD<9my7WxJ1wXEqp+hjWih0V2 z3tN?cOE8%$eqmUK9J$8*GOvXlt%pxr+AD`=wF!P(L&wybul~)dT77ex<6P%C=Q(l) z{_@)zoaOP1<FknM;+^0zxq^v-t@%^9qD6N zdfCZ-b`LWh>~xKJ&)vRrxW8TQai{xxzrJ?5irwscM|veB&Aac*JLvEF>O$XZ7xP%mZHYnddxx&=U{Px# literal 0 HcmV?d00001 diff --git a/www/crypto_files/crypto_types.gif b/www/crypto_files/crypto_types.gif new file mode 100644 index 0000000000000000000000000000000000000000..d43072b14391345fc99810be9221368eee065ffe GIT binary patch literal 11401 zcmeHrRZ|=c(=17Vgdhp-5Q4je;1=B7-Ccq#F2UX1b#ZrF2)4Mh*y1cM!JXwi@9#KY zU-VQ>^;K8(RP{*7Nb>NSti8v4e~<7#TwGlI$82nW|C<*G#utD8xA{N(p9B9tIKcG3 z1pF@x2%q2xA3l*t*BA5!f5K+aAE_@K2>(hcnGt zGM!qb{%9j`Je|#KEJvoPbTXUA^>}Txscbr5B=|F_Y;*Z+v9$Ah?X2dC`7-5V*<4u- zDunmiC~P%jEmcc(#sg7;UO%fAtIXyr4aQq*pv4xGc}N$nwd-A;*T*#(fFspv>-*1S z^6mB86&A0^($%;1yTb{Ta+aAHwSRjMY3w#mZ|h8_3giq)1rr+fX3Eu2V^OtRPGU>t zJ~+N~ww`5HTjlpmW}BP_cKV=_D<%Q0UqB=mj(ao3VlP#<_P>t?25H}059qwbn^DP9NSpGd?>XvpVDm>GgJcPLw zc{kQ})~eWsa_3&%b-ANGCd`xx!p43JG zz_g{OQPz^p+{;k+BixTMxC`CS7Sxgc8f%b;a-gQoaaTf`-SDCXWaq%zp%E|TV z)Hy6-rlu<@xL+A9*EZfLJ1oh-YugHTtvJdl$#i!o%P0u5trQb5EiEi_&3)1Y!kM2m zDyy3Dnzwb3`}m+`Esa3N3J@|XW|SQZ_&BLQ42dy+l*=a}DMZM}zIjSjqc~wm6Ixw8 z!cfB4x^9cAkv;LBQetyX>a0V`q=TjFqKNOT`f~NA-1T;!QKeI~r|O^LqRPR)UPP$3 zeV+(G7Qglrcg{>>I$t$*8|oJ(_P#R{%iSRXdNA8Ceif7z^o`rrdGu1$hhvP>Z^EUI zZ|C`Hf^!~L^6m^$eLa;jY4N9l>YC|h=K1}FYr8mY4X30$1?Xm8SqkR1psvO2Fr#Tz zbGxYTadx|egU+%%kdZkZ&VG;x)xkTePU)QFzA=9-U=y^gWHo&etTs&M0wYf zxP^~dTeFQ!VVJOk#g37*8#=I#38PcnXon@6k=5;)*ln~O&^aq|9TG(PHyn8-8+IP= z6bW&k;C7IC9oBm&ww$7F`zM?yU*-9n75B!rE_?4Pyj(^O)ZAT;{b1$2M#SuWzL+wT zWxa{!X8n4#;xzqwGe=AQ=X&{zde40ptC3&bF@8Mn<4(4c-@{>m(cATTe6Ns{#Q?eA zHEdw>?LA%Z71E3YSZoW9_p=4YtQ_z*zxjyqAoLz1A?Wi>{{0T^uV>uP!mmCBYjn$? z_qG=ycx%QeKY4hbWY~hPT)&~6aQ`JNV)gl4U5H+@^p_ZKCJcU8Z1h!1nj61UIaGLo z0?VjfOfu9iVl|oqBhXs>yP`_uSNR>RA6k8cSCdh?DLZ)A2Lnu8&Z=vw((hdfB&o<| zV}9dMVtYt~IcP4_8~b;#R_=!A(p2Ik(5OkC+ogXzp(hqGQGKgOmnGX*NiCH(r##`2oe8{*i|3~z z#^mUeti6hf@ug&vyB;+qy3QDpFXc$q>EC>Jofy}=$5KJS^Ma!Gdwimlt8H}BQ86h6 z$hpmgB%@%ci=9sX&WhrT_LSu!RxmziSryfatQVGQ6aYT>je&RhmpiyA5Ba)Oa1J2#5-xxi1*2XIBEyt z10E_awW=leXjYQy$8wT+4Zts##_}q*>;oD&VUN|M%!FlXnNN|X+iO0fS7#Ck;9KC8Df3*<)P_@fnc#slkZ~Y9>%`X;La)9lXMjD0-{HVy`}^R)a38~?CQ$yup-y_B zJV=4A#qYwF7TW|Rf3gP8zsimwXWPxReZW`)J^YuwG#2;WKrmrLq)yikR@=i6TU)ez?~u}k*+Ff4-6m=G=x`%e5gBCXh%ls*BY;eQ-ej%!RQliy>|dmPiA zYD{aJ*kkc|95=>j${3d4=g5AXuvTn>XDv;6$E(KS{j(^pi;+B&~Y`_IVi~PUY5Ob zF4@w+BkG`>{Y*PTW7+J`f@L@SO!2k>_&fi47N|G0b-1Y9FX!5Fk)p>iSYSjli$bo3)g(7wOV(T}6dlV!4_3irhOa5}1#a4ifhm|FsYC zcweUvbRUd7HjjQ7b4|lupBEDDm{1V9R`BrMj&}AesayQ-mc~Sjq2<}r3 zcP@mJxhfC59R8E+9KX+X$_@8BVb^&s0#03;{US8Kq&IzSbAJEz zTB7$X=STPcy<+#737qu_%HQ+2s`YvaoPON(}_vA4L17L&_UDg81koKE>42{U0UtgEOjrf_Ed{zD>aJ=JffiC6g=v99`wo)U;WsdV zRU_bsc1YNvA3QJvK=v_AD?C84or9Ag(&N(~=cV8jo-n@=YjS+@nFDuw+Ay;RUs>y* z@WZg&wlI~$Aa&~~6VFf=Yah3EXU~iv+vSL<{m498_jz{TAnPa)k4NsOpaAQzo=@(Z z_mOe!eo7I6NuFUtWwtgCe?GT)orL*RYRB-jMd^QvvT2KD9f=+oi5ixU)g6vplm=KF z`Xp!kDbx0#E{{WQ5AWFyk}i*hNQLTZ`(X4{Cg>WpfpG6KC8mhZ|*UgSt@TKGPJ)UXDTu- zJ2QXVB*!8g0F$x#qJ@+6-VP}Xd%8WJCDJz1+Bq|=pw?Nr=ZFHelc+0#Atk8*6NPwo z#O95rujRFJaDngoH%xdAGDcJ~~ImN|GmIbzh%Tkp8 zk)=qj$p65XpZC$tHr?w!Gh9z2LS`ve%-U^0CV%eHCp9bd93}e6t2}NtU@+aM_hV+r zO7`BzN^-9V6;F2@l!VgH71x%Y9n!%BndKeymDE8I*Wn3^M}e*0S#c<-4Nt*S!-)Z7 z-V>bx%e29@%ULf6>D_z;)`wMmnQ4>d5mP*Ye|3{nBC1FTlGgBRN**fhJ%NzVcvRjs z4$I{hylGVQY3kwCycLO?N3IT^!uO-kDMk@0S1Et=7YdYGF?~82k+r<@I<_DhghB@?At!`$_|a zop+H}?Zi6s=S zT5#Q0(v{U=9n|0e#VdL)F7W9r&+e@3>a2!#);@RE6L&T8cQxyEwfc0mXLogWb#+6# zdY-%f5_k9WcMs}ygMGS3vb)E+x+hSrk(3df!%Q=uyBAPF_V7EAdOgrID#CQOCF}#j zTvy|&9B9oBWO)bLBJP4PG9oGWSh)-MQ*dn&_dsNO)`$^cP>_YBfC6PN15N284ozvO%D)UDl7J-z zz~5pF2>@WDiNCflgIbc{f1xU(-2+_RJ&XLq3wjoC)tKR>mfE{2(EZ7vtGtCCTCd~U z(7WeBGT)&{5{q9if8X{-x@`yLocoii!6~N#a)okE@*^k2qbS?MIXUJ9-TfFPO7S^E z7=dF-;9jB$&El8N#+QM%>c1T^{hrl5{x5yCIiTd~am$JEJl}y~roJKjiD3Eu(dvne z?mm;3p7DtZZTrb-`NO;D8m;)U%!;%)WHLdeYUctG?TkW3Bs7&eWCu z^queYL(cS5_w>u!H2h^6fpo?jSHRqi+a}nAFK5_Roh`+T_w%Hj$F&Li>&$B?Tf%iO ziR82f$1LKR38n&nzbik^nF_@#H|3dp#|?azR>g#9or%D2j@H6}O<|7g73*kX?uP*@ ztDgy4?mWURFSUWXU5Sy(g4~0}LUbs|W5+?=S1wM%cy2*+0 zfEX$$>VfokTU6Bzz?;FM^ALFxbXrF~2w}^wm7kLtFXJBadc13M%d->|>WgZ=;^uyf z&$}b-&5Nfk#-kRxU7^cpmQo1F`u5DgFa<+dD*aU46|)rM_May4q~s|M8r`YO0U;~- zf~y@15+6%dI&k&;0ZN_*WCF`Zq6^Cn=Bu4RDQ8Y~H4B~WR}!T&371<%FhFetqEA1m z=uTz8pbyG>*uc<7YapVw{kKLYx^Lb8u6h*+|8Hu&41`}9fC%^dn*Ga#;`METZ3QD z%xmp{iT8`ETZzDH^bH1>mSqf-jam;kw+_C(O;)Sm1KipOHQr6x7R{aC@Pi=6K`og@ z=LXl&VQO{|twq5J==zev>yB=yI{mru@wzG@#ugpf4w~ZTY7G>AJ1^Cu!2wrkiG^`v z?4h@AhqO=$o*Q2N+=2|Qi8ySE3T+)bC?2b8y1VS%-DnKQZVn6Xn@>T-{k0|Yv`qm! z)HOQ46}Lt5_Eq8};dQQ?dAG1L`T5M61AP|Vlbv<5yggQ2(@hI$80pqo^nB8wbv)8I#RPr0YAbf<4;sD+Ckj!5npjfXRX3mbq(1@C^e{1 z*i!AG%bh&F-#vEYJn18wGn*WmyWZ80*{$|d6q=-h0tHbO4P2R}8%WRk$fjc&mkif; z7~}T-IGmjrY!LaMHIN>J+(00PMlvk(pjf4|IIU%<6ms6tXZIsD#dBHeqkBhV2b`m2 ze_m_kZ4Jr`m0uS;mKVyw7m9@!KfxEWyBE^$E;(o}#l$WpOfFf&F8PZu->+YiyyQPM^Q5O(whTq1Zbf%iF8K zRM^?&4YLg8j}f6yL)v{LxyOAQo|{oz>T`ouWo@GRt*-E649Zi*@SV?UijwX_JaI{R zKyi^1c6yx)jG!8&J=+5{pKGO@x$TbF2XL1eo4;BSd{Uvy(;hIE->%diboi_(lf~lDqhJ2RLN15j z3-0Ur!)7v?HkJ?Ml>$^sq^1R%XK9>h*2>qIO2~2o$Lo}f^N@(Jm}UxO6?AW-S}Io~ zXiiEs_?ww@Q$@2ksO@h4srO0e2Em}|4l3PdVnw+po)^=Z4qeFZYro5vYkfa_fU~@0 z)Ngbbur5;hteRSke(KS5Vd*R`jFdoWP1PgI=WGmlMEZz_I1 zx*!LvD7!EooR`~lG6d|hW0^?vb{*J2-#tHbEqNNOn+#{3%DWr6bzo=hC4TmOuD&1V zPM;R;b*HQsxzAfwENzJ(R&1ZaQ&;}cFjqX?_L$|(&=f|1rX)NzXQ$l#wsXb&x23j7 zq4QW0=G6a>1UA_?{!M>U992fXx~xH<=s&A)>lPtX7r@>n=Do#-%SF}V$5<+TLSsC;jSNUH{C2B*`D$j?4Xihlng9Mv9 z^@0i#ZjI`S_suiPawqDI^N5jSSc}Jakf|}G$HAL%k#sW+l`hp+_DQ8ci0TOSFMzAO zA#LcQ+5Y4rd|xi!v;T-h_ciM;iX3bH2e;=xn6~EuWof!=i$;(^z5DGtn$~$fijFSs z7F$Np@>F!@`Vv!ki^dn@6x<#ha}5i4#O`7%HFm4e5yK}12m&0WBN2xLdDIDsr_pT4 z__*s_i#Yy$)bQypnYq@~OOx*;X51H>K5R+4Y^`{vzG9ut)uz6m2zVZ70i>*#EoNR}^p zQqwxm$;w>=NdGkVcMN`tElid8x}kq~1qfv8b2lCU+tfKZ#x7G^Z#wn=dEJ{h4Ew4Z ze-TqIt@!Toc)QJ8=X=VAU6v=JUo{MGB&4P0@j0#AbZ|V!FT;6(cS{NT-2zVX9&R_o zja099r+fSw2Fi?HANlRLWv@`h*N(5aMc#j(^dDk0ehkP zyJGu;fn)N8e!2bIeq7kB*feHnyZ8xxVx&@tDGrcFf8j)F3Ht88|xHeMzY5v#kV*c=P_tTcH1r`bT=CxfN1^=iC0=w6cs>@ zLpJGeEx3z58%f1rdW)eWEvq>f&U3QW%NAL$<*ceHrAPHdVN+X5yvq;081=_d$)rlr5zZve{83&f(YlO(6Gii3du;0{wbpP^ zYN2O$4qHAM&(!zIipO_ktu~4|HL7^a?m+qDmzY8aIm4{_pDoJ$^F>_t1nuU-q>JrG zdR|SjWt_Auxq^}Ao`uVT%q@+*4HYG0DEeMR-tF6=mwU~d0NG0y){|6CN|{R zKO55dUw+sK5${zcPEC}lcBQRm=~9NYj+grREO9fAsns%E1Ssuc!A5XNi)>MK^iNf9lJ`&xRSwCz$3HEy zIuf>wu3TE6QnYdsPNs=1ah<>Ji@`zbRwE?g%N1mCl5*5Gy5W5FA-pGMd^LEgCfO^f zrEbkAu}hZxFr5v5_rmH)+$rfUm3boEmd4kbO|DeNk*r(8A64^aVpZdE=xv%sPzR@$ z6Ae%S#C_MkO4qJ9V}-1RA61N05tGNT!(EzX+CqJFXY5<{HmrkLtzwhpc*DqXsaHW9 zO}7}?2u#W?{Wta;qROvYN~Udg7p3HOnZ|ko#`XG@Yh{Y6uO4TaG7$Od6j5<7xeDP- zwEIxbn?EdnF%{=P_g#3Trp7IFl0#*y;aRPQWAGG{Mv9w(^U^X{+nw0@Ut#IegZ z=VHkmRf6vt6s}3qE3J%q`%<9QoenWgyNnx^x?uc5+xLtj>@kb_T8rYZ&V)<472$%cCAn8;T3u`d18M;vJHz|c zrCwzB`cOf8Q+(+1u%vrqD#+fF8@e(b=H3hxbg8?xtLB%$9y_-k9?WPcH` z(toc}~S-XsP z%-^$A4lcADZ^XZHtN1X{)N_^k<}*t1@3O0H<7V8_cRiHFd!)k3ue6Sf+;&fL)?uEPR1oSROLYrw2vdgbhEg>jJwb9iB zE*?TWl~8{X=EVU&Kt&V_`U@h5K7+;rV8QVQv2LMDxdBUa2_t#1eY2$Ijkqgn z#|yuhrLUw4iPRObP^n%HzA53qMg1(!&!28-vz zB$G)-3tyyNP-T+3!TK-5g%f;v3lhaDyy1u@X*6dK?*{=z`Xiv1i6%;g?ZIm?(&e$KF@QFh{nC zX+$$b97Vp_oO1$ALKfb2mbby>vbi9CA+q&2X#IFG71zuLrvYKi#9y!eLvFq*)mQEO8eWLEX) z*n)6pjyzO+c-vl33-)VnVsIHIf6^?+r{1MQY> zGyOa`{jxCq3Y&)COur${AmGltqn>&HbLNA@45G#ilEn-%VCG}!%%{{D6yVI~mKoHc z88pZY`rZu2?aUXX*{`^>nAEdaKWDKeW^puTaV=)?0JHd^vjnNLguvM^p;h(lMQFU= z3(?9jlbO!xfhH~`=$|QC`|&Y%X32hjV|AtI-KmA^7SUJ0v$pt}7RT^t{bI>;Db%o3 zrBo@roEr&k$WN1~XdLEP(3$AY3jOFaGx}7EF?0W^FdOcua^jZK$QH3prZKjtA+f6s zsi-~msnT#Hat)PmBjx{ES5rBj|Eaow37!4W$b`U=FEvT>3w=RZiUt1QT=cS_Ww z#`ssrLI*^5h;^L;BB@G?g4KwwmaF=cMNMPQC6HaGMV+^1!PcVoqe)#~RHZ$TwvC~7 zuad}bhp}Qg6M>R7Vh2aCp$tS{4)Vq<_tJ8I#7KqHR}d7dW{OsLpx3DPX(d0>YtS#d z2r}MAVf&x4#`*PHKv!#^tCSRIYUIt1N}7( zL6zx0R}h=h48LQ92>b(OR_AmtkwQl z=(8>BKdkwJ-})|q5(hFIn^*a12Q1yffq^VkEu6CUX9{_TZcb4Z*%o(W0{Px>XP4Y zMBrAAB4yY28}+YHEjh5oGc$j6*K-TiLl-i-)z~f>H6}8IKHP3-@^0e@X{QfuI0G1- zi;RK43_C?vA6)XQsP%;~3BO9hO@$L#N$#|xQp;CDvk{S@Sf#p6fVw<%trZS+Y&cP; zjA;|PSuJ4}k_vyo}C!ITPWjC6xW;OFzcO6_N-E!)lZrTMpff&uh9WEC`qLbYmLXKj%_&;z|HU zWCI%auNvBCvyeT!)xc6JK`f`js1KQody$Lw%(PdT;AUQP2R~NowCq7@^JWuG18NSN zpgkQ$ORJw83VCEQj+ssURamZNHjcD=k3|Zx96$x~-ghz}hQ>!XWJ+P|?cb*@~(EfKE^CM|NTVTqD(v zB?6^&AeVJmZJWcbx~?O0tWaKHD_2bIYy#d8$FP#k4KMTz@TQ3Fs9jh3!|L|EPRXcU%%T)uMT7#GNfkx`9NBwu} z)>pgPEOfo+xo~rIOMGa(W=+)y4X&kuEe&@0GATnP5o@Kyx>luDaErO?YeJ?etlLI6 zV5i!3?#v6c4NRcj!dq5(XSzz0yX)>Cey0gjq^s6k@`J>Ouh#6aIJzKn=77xmzO9N2 z?Oa?rAYz*k=umHK*X^P^F-Dr@P40FB{z0WTi(Xf6u5?%&^*X*=pxx;tCF!5j>|*l% z6V=mvIfotmykL%l?I@g6Y&d*{X7zo>ecm%UDnEY|G`!m1W;ZmMvi;pwvGGN?R%!Ag z9IttFbk)M|^fTA~=KyH70_<++B7$%oE1ns*t;*>Zaz?6+-L>^bp^1`b`sL$4gWSsx z_-01#aA#MR3(5IY#7!eiT7nZ*CS=yDhujn7xC^p_-(o$L{od=mqXtTGdzA4ycr2!M z%urM#j;=dXsj9P@QGNQhIcj+Q&tB&*rE~8~*FSpf!UM6dei{o#$&CfS?$d@b0{o1?@^W?0 z2;KF!xLqtWIcg22K9wPBTGqzn`4YnJ4O1&aBBY+RqE0u!$&}e0H0yN3V&;QxaUTXl zZUdxeRe#GPkRrGI=;J06V05sDi8hW=<6RRvX<$p{T4U>!u}oOpa{1}nC8OqZ|1CR0 zx>at7LLJEO8pFfTgW^U72#aWRoBgKu`%V80{KMFR#@>>ard7j=MF-1{p=|H8SMeb| zO~b?1(%{xEpm!0wX`e)nIQ-3yl(KQu@c}vP)N literal 0 HcmV?d00001 diff --git a/www/crypto_files/kerberos.gif b/www/crypto_files/kerberos.gif new file mode 100644 index 0000000000000000000000000000000000000000..d22b5acb321ccdc88af8d07c2712291d5e3518c6 GIT binary patch literal 20772 zcmeEtQ+Fl|taUl{)V6KgwrzWAYiirJ-9EMLscqZFbKdj)jBlNNk&E1AuOurgJCT%@ z;NmnU0@nh21^HhP5fKRq2^kp~v9eBs1cCrTK!6t0fq{Vq1qJ>6{d;?RK;VDA|HJ<= z@c$tL#P1OQFDknKwf|caLeM}EY-l{GhJt}$XjB@#@rJ^oa3oTh9I3{lk!UPdo2~K2 z;<0!l(I`CWrjm(dD%C2ziKf!2bSBfu9O>q=nQShXi>-;~^0|DWU|4*amWuf-h&UR3 z8y4!ta;0LKT$$8@#bAgg3wqDx0*z|j0Dt^7_5-bAOVza6NkHvp+n;O(Ia;Qg)jD_V z82+v{hqWf1j3Fae_j zoE=0nf!*!Lu%V3XOMY6Xn7R^m>_$Dr|#3Fze^e4%2oF64CNpK$|tAhP2 zN@cRBERCs;)k2Cy_tHMhXnC*L${aRMHws=)l-zP#GY`je42+c^cJ`EjO3RZZ?np?2 zt)QwXkVA(DjLSHt!XN7ut`YIx3Re?&HbBMQ*udjdDZ>20dXx;S69WD zvfkTipSt6(Yuoe2AbU3e-Q{{K-N(UK+E+KYVc!5|iS00m6>KInisi6XuJD_;+ibYj z8P}>Gz01={c4G4KVakwUlcgk&#FlA>?~NDPe}$3S^Rczp;HAC$*)$pFj(qx<90b>`mBUT>nlywwpY#m)p+!&q1ideY zn9&Q1rT~G%bw$JiE+I;~COer`>=?+eRMks z(IZEMWNc_jGHf@QxByI|l5>rpRwd9}&P;OJ1m`hhT&|2IePY^z=P~nNOc`5wq}?`mnP??uH5`5*`tLQpdQ{{BwMc~gVoL7i0UUk(xb6ew zuJoim7MJx@LM2}*$X>OO*7;O`K0--vX*uht;~GUWbN(zcIG6r`<{%JT;r~}=sR*Oh z9ES8Br<+)00=0d`BW2x?>C0S{?N(=Nu04(OY#!9|gvS)H7 z4n{+SdW{v_ffi`SOG}w}ps6O@I*1%|X6bvi@|4ZW9PCna z-ZiBIceUmY3R_$Fv;Ch!*sYz(6@WFuwUwl<&Jqu1YZbnbt-fvEp-c*(RlLrU@n~thlEouOIBY^tMnSpN6`h8wx<}mynya{T&>xlaP$eNJTX|J^UYB zORu(65n$N^ELtigbJr!C(HE6>S|XovF64H-NRH6dlttuiYB0R#At7CAmoKbTKR+n$ zqE_nWy=@OZFy==UUK)xwF8?N4&Hjr6w3N$V+vxg;q1(RHXFi_;ndm<^_uMN1l7FlI zWqul}eP|x4lr`DMYpfW;wh1HHZ_O-ZRdoKmw9Bj9xZo-{A!TC$*6>L^Ohcxx^ZHdwD9Wp9RmI*pd_4lq-gVzS0VejNz$EyGUh%Em3s;-(e%3Ul{9cVq4Vq^-0@b*_h}!N zd1~zk-)?Now<3pX@dL zd)o5%Ie61Mm%4pC=M6nzHKc-q3HkOr$Wr)Etbd15!@FDDK)SeS268MK!HfkSLbx2M zFi1T!KxhTU{S5>!3;Z1sgaBYc$_OBS@F(FyBW(329e1Rp5=1{kK9~F(U}AvSu1Su? za1I%KP!e!Rj@G#Hm*zCE!6Fzw`7c{j0GlUUNAurrOMkB50P!;)iZfv_=wPHU4;5%3 zaV<7p4i9N7HZ7_E&9y*Y4Ayz5Fh$Bi9%8<_|VZJj< z*EK3HE?-b;P7*G>P{V56Xk)$sBM2Vn@_C*x^i4<-uiLNAg?nQ~nnTeyI#2D|`XxK@; ziKJxM_(T(lz9@tU>q+J&7*b9$eP+mT=SdvW$ri$iT}P;#&Wv0sq60?)<*tM*Fv*-= zDRlRwf)f;BL5X}#q-2>%&P9~2%0$F$sS+e)L`jrXmC1G_sXxq=q}nN|K`9oIDD07O z)?R6L>v*u-GVUm3Cc_!!tCY$d68%|vO~lsb8p7(H)xD=V3K>zRO8lGE|@qNMb}j5MWi-LhnBioy4UQnM^(<>boBEVUw%+Vd>YRjQq{ z(4*xDr?a5wc7ygcPx^OK^Gc@e_atX0GGZ2%YW2KWagx(al29-=kRe}3s9Zy6Gh3>B zvF0F{lUNXOpB5Mo*@4&YgBK8m87|Ad(L8`KBS;U6ksUQGj4C`dqwu(`5EqoEu`Q2k zf$W>2DB6?-w;UNkF(*SL6s+AUAgr(`j2_B}5fJKxPUd?PYAT{HhABl-SX|glU`e$?ETrNbwGzfvDwd|wn5XjBl4KT*czkCChH}Z+ zyONEJr`<(K5mdIYjt~oM6_8c9c-WNzO2-pKlUy*p%8pppViKui1Es68+TckX^+-Gf zmJ9c&`u7NiZHE+Gsqs<8U-@yLN@!od@qnN7koZMzA2xpe7ReY`>CgvJ=xf2UWSCC8U}tR5qEMsB@eOn`$2A`n$7wToqvx*bL65`dS;j zZ&DF_;dE|k6eMoOAseZT;mRaf*(OzUx za=MeFomMZa}c4QW=U%IWpl1(}e@nn26MgCMe$zX(uAP0G!U{W!{u4R{5`#C2);MqJSQmm|D_a6-YdhGpyweai@% zQjOL4Mz_oxW_`+4Bl1f#VmZbQJhI|umPh2|^vAQ}d&EW=(VYZi#^@mjnXO7C^^o;y zhF!kWVrc^DeGP~U$6#HVjS2-x_SM9razAG|i4WcID2HQYnA6xwPxa|o zkR5U@-$WyyWfR|^oW@k5x;Yq#xzft;FjZe5*W}jL_yj!W6y3~$-PE`C>`9I5cFrsy zbb2?3fCh}^BFFY`nXM?@T=!SsmG7UN_slO}`?a(=Vmv!O^f?Iq5dr3^N$%>X!!n!I z*_q4k0F{3z+g8Fs|EjcE@+6Dk@r!;VjP_o64EZ|YYEDm5EDWhTk@0(xerqOTI)Hpr zg^~y0L>vy~T>$3WIipak4E|b`>t&1_IFBIHPY1Kit9~uyqEth}GM5f< z@$u7jzs=5NSeRuj!?(Ga9Mj6!n=VN&(H$;*u@r%x77I=;;cp`!y3Y-#Eg8~V04q|oRVxsO1!Zy`&1;cJGUfVXjzkEn=U1x)Enb{BJiJj3;h5fnuq7l` z%YSo2ZMxU(=~f&EmfCUq4D?N7wq@h&=g-TElX_OkZHjF1aZ7Vco&087a{b)C*Pteg zr#P1()59Ic1K={EK;L+Y&KMf;L+WQ7<8n9UCO6>ywt$r`0ghaJ{kg%MQlUfXTYKUw zUtr!_3x#R5+sdHZ4^lhuks%AzTleV!W*m{solzPaJ|prGMQ@aIA7fas2K4ErUo-i< zYqoj0Go7za2iv;}<00?zwPy&mP_t2PRZ(mFF&HucOR11$>ip2{SR8__46ChFt9{do za@lqZf*WTozo6MS11y3<*I|`x5MSAKX|jK z8dQau+absVg2FQqYC4fNmq&a*-fS)hpEJC)T)Y1=CP)32$J%)pxwgm7c3ij)k2H>r ze)jZtc-cKq7wTo#RI4u_=6KQ8)$ShwzU; z$0MWO4l>W2Ei?imcg}#AyI$V;R?s2kSBH1_YtEDBOI9a$*P%M{k#>3)K?++r_7}z4 zXZPbV@O3BiA1BM#CuuwDfSoA*xGk@pnywv9aRIhUkJG?u|4aeu!`O4xfs39WeDRwQ zt&CikC<{h`{LS$lbe$O6iWqgOONfk<_1X2KaDxr#6Lg)cp7yKA(yNP#o3ovpo1dGz zBZAupf!im8+ZX@ax4her-rKL8+aCc;JFj|RofcSrIHcg6?=eAcVuL9yY5{yEQer2^ z!W~2OUH2KqZ)Q>(?tx$?N)-AM(b5A_%&y-fr zYJ@6UjDL0WpW#Evn1Bgbqr_ll_>hR&u=9uB7{%rkxxU|PwoM)1z(S` z+&M@Kx&Mgoy%t^#xzq5^Q}__?9Do7OZ?KuE*qKosNp!o}?;8(LCNIvwj8sHZ=iv-e z$M>vy9B;z3x3&A08QKGDzTeqN9aTud97#YLh4zI0LLv}| zMIiNyfWY7hgg_&MfJdRz8w_VCA4u~(y9Z!}@gkDB$n+v_!OFP2?ttKAwD$_BBRZLnSJMW|j9NaSeUn~cVa?$lDX z)vh%=(yPYtzOozxj87$2w$_`cXNy>G&7$w?tp6o2HpN|emR=@#z3;5Rz1^ym!+4_- z*lBSngrQ@@*7y8*b3U2L?#he7d9+=~VNTEU-*|jEb7(dt#QmnVUCZndovrI(@!pta z2M}80zJ3+RB=5Yge{%k*7~g*6tK*7+Fca!OjA2#chCq;28i1rGVG@A?7B`5D6ePpZ zO)!KYmOasJRSYFOfRz}5pel+Xj~ptr)QVvQJitkmk{!e|0fodO`@tx;?nepe7nDT^ z-M;PzqQQolrOE42oTMr9$tow}rQjQ6XzSsb`mkE%qDFCwACM=hz37|=V1m_d`azdN z5~ew}#Z=_DPoHF1cyEVU75QI}niU0s5Nt}qP~>c)X-CD3%AW})u6^IVDNzd2l%*{y zvWz2YjgrL2uEe`I4{U0T+^JNms)|5yc6D`4d}$eZ)KIti&rY98+`(QmjESFYBbG#~hnReUO}buVIk1OSG8% zEc&}Gc5LhYY32ZGJukaIq$HbL^W!o9hBdg@d}>$ZouDY%_iDzECl~h)N}KfipQ1H) zR1de(#(j1}(hMAE!vKasj2v8MiIRCR`!xVL&f||Y^-28*(wkJXld{wfi)=@S)(-ku z{Hpyl!ZaF_-9HpM>fmt_Jl3V@7M<4R`C&XZmE~ofHr4f`JhruMc{q~E)gs*Hbeaxq z)ak)t?+vb>_{wVFgFPZR6LI9cQ4-U4I_XgJF}p=RO8l(n$_uF;Bm>T zqjOv669Lp^K89VpIcW~|wNF@Pa_=j=t|>ydU5&Y37wuHF@CIaf}xRN!bDg$RCDgBQ)T(E}INFroXu5Cps;36%_C(x3WB=@tUe@OCjG z0;Z6uO(Hbp3~_{CiP1FOCQ@ITokIf&R062GF|e4_cmQT~Q?()!G_GWBZ)V3oN6-ZH zOM{72*HRW+Q+rG8HLD%>2(Mh7NqgKi77{5Ns?$%pW{sUj3>Y*~U)=aBsp3O4+9 z8E6yMEcdT*+BPWEvk_-S{PSa$ODMTnau?H)7(4)t1hZe5O3tY0J{Pl=B%}&cp-~Ar zA1;ovheC5s!q>??OQ*83##15K7Zo2r$()ysmFNr2Sx#Nbf^ySR0vUNRmT^^9TTZDz z!-#deMV9K{YuES+vQtR`*3!SJ;iS7A=H@9?$@gS#{G#*~ia{UK^U5u>!nsvyj~U3< z=BOdRTWJ_%ijtrR|1%2uA(L=k3Gk8LU*T|?^sAjsNY zbpog4I#{wVA&hy;xdy!rk|R6h=upKkhGS(o8slQGjJssi8x%CcQOv1evbm=k22s=% zVymSdGHG~&EGkc&?Cox4R#yS&fYZiH`*oYN%aAekF7~DHn&Q`1J4I@IHJJD-Y64BUdoDOfrEA_o*obq$Oi^ zTK-`tdKmWu=z6WbAaQ3~ju=JrL6ktrD+<~k9}S6@KaJD+4r!b3LZb|A#qQHLJnGnD zG!82blD;*+kaaDH9Fa@($_|r#Yhkuty2yT9aXs`$1c~+Fo%sgTzVZZQLi<=G-iv# zT3Zp``|VTr;+Ei42e+;;VkjZcLBzmzyY!d9W7jJfzcp)rTDFwREf2AC{abl(zH%^3 zd=R8wjL`J0BTB)Jan;|~QY&1CsC{&!@A6he>6=~by=-Q{>wB7A9-tC*%;i$>=-q*(R=qsC3pS{l?%QCo+6;-!~ZS=Y2a=4v)7|FDa zL&e{o6PkI~A#Ltj>~ThXI==V$<*u)Eb1$W_{zqDzei!P7FBZ529j@ivBDudm5CwH_ ztLHxEHR8RuUUyz$#=a;m=ZrQm`<7@rzHgBoK#ubb=w`zGpMq}P4>j{ob>x38Qpam0BuEN%#XR~gxG-^zAf0eKO=d5MGFSim09^mcb@C#oO$Sax#8OH^EUK;niT1Y6oA-AT6GV0K5q8^bnJ8H#3=NnP?)LnwYqm zD4Lfj7g?=yF&d8^?*x`G-`5aL2#?^>Al=rWTsJ@M{xC7wa6hY91~8&gG!l>W3G<$J zxC%NDReM<5OpLR8AfZsKsCiiBXvDy^TNNTf_M+rzKVw>ZB&LvEwlmk(3n|M>Je^5Y zr({IJS1fp91iS&&aB0*&h0jP$+)+4xn;K=EIPX(i!l{P+$!j!KO3YeM%*IzVaRAk! zWXzjRWD#3pnp@JDPl8k$kG(M8>1xbePck(^!lPz{JY-nz9kr!d@~$gM@oG3+O~A1P z_JDfquUKlZm=s&cnC=#VU?px;h=9;imoS+$;nMh9v^eUylz5AH!c&BsDUGmnMoNv8 z@{?GOoj^2SPK@4!EHg3$NMO3!P==lq8f^++V}k9`M0tr+K7w3^Z%(d>9BN0U3;+~3 zS>PH8LL~#L6#+^lzy*$nUSALGES(C_hvnXpeF+1ISir{m}VB( zT{Bt)0a6by+o%^IE;gA|Fd-`~Tk+IYC_2$fI?_tk)wvY)2r5;BS7CS0I(;;m_-7ad zDFQ+Z1QIC%#AvAZY049A8XbGGh)y;~TW*w0TyANQp=Cx0LX>G~NIpfbuy}eFKKH)_ zm{$vg0EtSIo9UJ#>^2KTtCYyxpV@Jp9#4@%fe`0U8CPJF-cC_Kfl#nRRlpSkSsyqyNzwFpBB1qKnxAISmd`XHu2 zl!i-=$UdDgzFq&Ne98a7E0nYhfJ!NKtBvo=1%h}+q~Qhj>WTRti0FC!Lunm@PF3oG zQKXZe>8DdVuIY^D&Lixp)YYOl4n8(j&zHIVgZPLjFA% zp|(hygUwK~$TNacD6Gt?pGqy>%k{hnKCS8qULxd-wX98Q0i(u`j@fA3Cg`R{>>6)^ zz0_xvlB$gLz>Ftu4?u2Bzu8iGm+K(SmBWvfflXYJo{2Yu$w`;SmA|Iokx(Bf=i{R5 zQKp+w(Xm%0_gmyAQ#X`T>rO!Ch0IawNx~M%)&RPxyF50G){JcqD|`;m$=jT@Epnkw4b@gIkaM-jTJiIa8Y8}*Qzl~?cwdyfcqBMc#=jEc;)N1XuV0D0IjtOtY zb>O>gtCEIpjUNyCji68SuTLLuRr_r!NY9txZ%4b~ZF1`+7H&BX>x%GczkKQ=L#|+f zI_#Gh@Abazm{BL3&KT!L?v%ls@C@vetn`yg9N6d{NYm-NtC}Pu zZFatw?srr!#>!@U9^g$JAX{e}IBUC;E(pS*tXZ4L4(KB~=t2G%{S7h3!7!fQ+GFtV z{B4>~BOw7Pku!627#pk2e`0EUb=Zbn=6{qP7-b+vFkZbh#>8OeYfUK9D+kT2&jA>x z5-_D^&~MK?#QvSE;K0(9YleieZ_2Xo2Ro*?b13|h3WQhC8rt()E;vXHMlu@ykEJJGaX zv5-5lkomCa$vlvD#^C)qaEqPSFhh#fuMLb+VJ3X`GW`KWZ^cW^zR4Vn!I_eqx4UHX~oX!)FNmUVBxQ~{k;o&Z&Ash z?ZQ#g^kdNq>>nT`yb7RC|MrA@_^na5$+ z1<~1Uou9>FU+55^L`Ya|ydQ`9TTEEk#VVZD8QCW8m7{Q&ek#RVt$Ua-zLEl-o15cFQEVRR9kTCto2qGDk3NzPYxQf@X+w3)OTe|d+ zI2O?`$CMyTqPRw|I9jE!-^jB_!#TJKLhT(*J^6_@zcKO`w!ntG>;;(X?wqEK?zCe# z*2mpq+?>m9Tt-umY5a0*+HqXWbo{7082^2gJZcq>A>n0^!|q_S&u~}nKb3hxm}6lP z>Tu_(t|poHQc}KSNBVt>@^kbRdA+-0?g_XW9d(@8!51>PLk_o(5qFyIy*v1^>N>gm zUA{|tW4AHogc}aPueTsPy(hwaAf|jE;d~&Kd?3?&Ah&#=@KAc741b_Xf1oaZplN%c z9ebc#eV{*mV0e9CgnDGcd}OA4WZ`^dm3(B=bRolRFtdMTzn$h>RpSnSOf7NY?|I}g z9OH{u5m}Wfc&8*Id+PS~@eCx1U-Eo0pG&YhjeEeNvvREO-1vPhETxX;(SVPPU%s6;qJcs;(!_N!-*{od;tz2eQq$BGd_1d z)GFt<&S%hXp~TxMzO8A!&Iq{;4AP^CzC|H6Xx7K62m<`)jGgyiCE5Ufr*9ZP^uOnu zOF!Qd3Hwq`Wzy<3y$)TxcmupXQj-o2T$8k8CmLWhd}6ZmCo&0lcV%8PA^DOJjMLb;U8Dk{hW+IZx z5jO%5>3ml`+b!d@(?49(eH;Yc_Q1USBoWDrJxx!2+;>a8+dc;wy#OBSZH(@om|ul$ z9;1CeqlUhH^=}jPuV!s-ldE4-;jiNXK0}Tkg(ASOVL=*QO5a7O?;Ock{dD(#eXpyl zUguWK>w=!)>7Kx>Z-cq_xpF^;vCkDl_i{o%@mQ}|x}W{m&cj`oqcN9z4gV9#&eH(# z^Kk#bVtX= zu|2n-SxTgnaFDCa)*ng+GgvGaVzeG9W^;Hv91#Z7s@q(s)#9@ElKG^PtCw>eFVxz;GVFAFzdl@F zrZZ}1s;L&$Vzn2qHrUQN@Y`z9n2m&21N7lnA2h2o2zgJ|lI|8J0<6KP>_6BpmZ~(% z39dibuhyC@7f+}^oaAEcs83Jy-&mw~I)jQKuh&ep22A3M$>1?qoJVbEPI_iIpZ{KM zw7J~geEYmC!i-XaD1GvMJYB3dw{7S3Jipc-vWg@82>g7($tBL86G~ z2e~V!7}-JpnC1H;%e3PM{AgPd2g2L56Nlr^o)m-=M?sq?)MR>+L{Y>+^@q|MWE4g) zPXf6}V+9hmNaJp|JyAhm-`+?QgkibK5@Ay;%;F^ptdF7?c%%tpxMjG>Q*myz$kQH) zmrWD(y{V5P1)8*Wk`*N~$+N7h&NoseIv_U`9d|HRoF$niRa!;I zC|KhNmqS9*mbBJ!TT1I8Sgz-6Vg>>7J9(jDq&ygBH)uPH7WdQcG3tt(oOd6ilgl7Lla zNubd%<^aYjnCcql%2CIt(#VZ0Avhmer(vXcpL>1xooYMta|sIl#<$7J8;8WqtL(g| zEIiC6m>b;2K4$P3vYCiFox1?2`ZA@q7XQ!YA#}?#mw)g>QcnOZ+HJLt7l!f7#r*G! zCtWp0T$V;P*;?8>MeLWBrdjb^<<(!kSG5`76+IlA_Fb_!n?V>lwMoGJn%Y_M@TshS zjTrp*|9HWF?&iI9yV(w8tnF^CbU3wgV=P@@0yk3;L4-gdmFfVIuEE-z10JH8ocsP= zu&(<-`9H6F5>sdn2aSp{i)#VP44dmMi&S14X`j6uTm3!`G-r`f1_bA&xURW>E=34` zb3Hb|-SAyC=@OnkuY*53_b~@xm(6fS=e4{XXDb@roNi9`ye`7>u>uZu<$FJ#Hv{X6PUShq-4iiU^_r1C@=Rsq@Ad{t}lcTeI=FP{M2G&=eQ7ay+ZMks98P zCc8dzwGbp19+VnJ=}3s-WPV8L9Fso+*hXGXQ$KCaHtlql;}f``uD!9#En z$HYd0HB=!ZjM5aZPnUBJA2}>|laxAYR!o}=HpMlGlB`~HOmR9^iyeg=X)R_>q)o{` zWZZn1KK6A&lMF-8owS%Ky+DRs3Zqa2?~;2nT*wv8(uR@5s?$78#km%S1mEx}xw1)rco1LGz{dmSkTXG4`Z znNng=RT)X3HoYpJ%BGHg3Qy{-u8Zzg!F^E`7}uFx@)2FYByOe3%9CY#!6LI}hk(7A zCFAhRCFW$kjAKSiF8|~?>mO;!#m6LYiaKbynvKRTa9D?g`sOxojxJ9%7h;K?8QHqG zrRFgtQhQ1N#WCZX*2;@RJ=go8xy1fd6CqotdAY1q)zwap*k@{Wk3D;v&&>RsXSMTS zCB^UPiqY0Yb?@Y%R+qoV#wlcN7?9R@9Zaud-t}*7$-Tj}l}H*SGoC{F^JQ zRzy+5%S%^V-J{D6oh;UcRx1zqqY}&dauwP$arnLxGW@I_5dkS;_yX(J_u}WAj68Kj z8qC!v$H9_POlL^jmOdr!_K-eQb3`A2HEnv*ke2v$OcSl$W9iNsE-ZIUP1!+7A<$?i zgrkBH|5Q1_ZxIkHXa0A|YeJjA#kgM1L^S+;GNKnI7ZLwdn)PG;Kixc&yw*w<6=ymw zkEN(f=bS4Zhsq;NF)#O$AN2KoB;e=7=Wz2pBVuhaO~E;Lf743g(wibffwh#K-i|sM zd#!EOxe_($%7E2psZRi)s1R#|Q>9Z$Cr2A*&@+2X!!s{F>Q>SdV@Q{*Ju@EX*2uhl zPIcM2d2PU1`QM$SVzAH2d<@2O&prL^pUnTeB z{Xz5_#~w26Ick$CSA@Eu!(P^X+0^Nob%w*h(2hm2~= zlQV0xwoAMFTtUVF@7#>t2x%FHH0JIp@DCDug~vy#Z@!MHj>*erDV3jjKyK{^%6G;- zyA19Uq9)GL^|zV1M+bF5Z+$^AJ}Fw*Hir@T63ruy>-_@$xE7Sf@?)MFJ5 zCW7UkA>D~yipe4QujgF0?-SVxZiSjKRgFphTlaF_g+za^X-lC0E!(|!C)}JP8{Eg0 zmB4ooCB0`-_|{XQ#7i4$?u%RT=T#l$XWe%%buOrtq zAz>@GTzz41&*csy?#BC0>l5L%-R7MCXX{vxf@Y~?P>NuSew*t)?NomwD|I8uoUk%8dw&MIL7Au&#wZzq01QBs;%9K~wO-SM{no0z zF=F&&ZP<-W1R}Bl^B($XPXwis_IUme5~I)`lGun2Iv3cVgTkVQBC&5MS9r+0bHKdt z+4CD+q7dDE-@vzUG1L%aVHN`;zgmU^G03A4g~6+IgU&qmfR++Y&cp*YBbv} zwplJz$5*0!e1fp5Fr26e_?!(M_lsaOPvwpf9EWI~y#Q>Z;6r-CjLt++%OsMIq*1KM z(W;0H!<6zPO8Tqt4_z1&K`|?jDT_ogc9R@ak{tVQ(-ovl)$SsA|K+PfeCW7rdLHar zNS*BWoshwMNGQ&yWoY6}x;oMJu!Qe*wBmrC6V zge>SNZ7>0%-!BFTd4}+vdoWqpuo&4egV@>p1zBENkVynL9#*2aUc(3MlGVrF$Y(dy*_Ah+yQ6=LTo^W*^Fg z9hrGuse2M6>lZznG?Uu&BIXQ9Q$%@W@l*)qHAi(zN4x~4d=F&WEXC|m$Lw*XlQAaz z2J#kSMf{`Cz*20;9djVLnR3#eI1e6u5|JuFDZ)o79nB`)uYy{Aa+A0MNE7MaKjxYy z@XcBhguT()3MR5~@O*J0sBtlC?c|e2ubY&)9?Q!Ty$Y1A;N@KS`D9F`S z%xxtKde_UOdJP;p4PNI7F0I$?e{i_dOz+G~IdS^S*@_0SfFv#^C6Kd3(s8ouegyaq zq&5qh*;J>_9OcCB_>NKekbcF+fAK!4HIu9WlIT(LumeL*nlhDxqVj73P(P}00m}$3 ztG`(lwr^CvVih5E%F$sI)F*}N=euB&>%Uhv-Vt;_(aZjjln6hVi=FHk77^VN?};^S zUSi{lZIo4TTZfyF{k5~D{kB4op}wBT z>$*OBw_7{gKQ;(6h4dzj7(Ho{r##m#0Xx}?mB|L zxI^|hLl{p(QMzGeEOGI@WRA#SuEb$p18bB4FsVn!sZ}t?_)GSpZv%wfqx-39NTRC6 zhW6~luL!HE_&Ll&AyGJ3(_lZ(zTSIt!z#>Dv{}IIZaj%~uP&*x?gTCGz%Ou!J5}<& zu=`!=NKjG^u;@s#b!f6VoS;4+uO>vXP6Vh3oKTzfRwT$HwXRg8XjC=8BJK7Nd5GAk ztX)RzS1Wv7YSku3ozMmoKz5v%RFO8=L4a!TPm0j_?j~iuX}|)b;Y<)#6I%`k>`}SPdV!{b(G0j{BOC z^LqZrMb&KW7KUAl`_Vdy=3E{9rU?}YUO(s+%G^ms!QY*dyy6`l^D=F6hRHopK;9KM z!x5;>?g#y#MD3Eqh&2+!Ss26Fh5T5d?h%c{p$@~*!u6U+-G%=(#EHF{#f{B~zV+JF zX;j_KP2HJ-)Nx(cMa&rwET zFXM}ILFY<6YGplNX4vz^ZiheGC*W52sUG~Z9z^ob0=8BZ-=AApJB+;Xo11z_kGq?n zdWi75=ZsoVp9UC1MyLPwfKQB2`3-QG4jvL!FTbv9)9RrQrt@B$iE-0e8p(`GllSCSbPYeO07> zO*bSglx+<(eGgAz&V)lZZ!5=S`7AWFsC3Z`KHH77w=7Jm^`wprhOTrB!MO}j%>=+E z7S3j-$NPmhDp11aFgaoh-ex#fRt`rOI#E{k02jBYD@xW(VhE(WkBN`}wOJ6HO%#evSkRTL zSxpqYaZ#>CT(^-^^hq>*3--1F^vYS>utiGLNy3&*`14Mbs+V4 zBFKMnD3%}%ZgPNYvkCZPtBbTr)PFnd-ZIaGL2zcL<<4=)VdLR?W6|blntFfs!Qp7z z<`Mq7SN7sG<>;)6v&ofx$Z3Ad>6Ok2 zpWg;rivU)^`4#B*+HCjeUID~Naf!FJvgmS!xo`$F-v)eg#xXK^E_y~>zD59(-!?MZ6Y5_#TmhDr zbf+v4(T{b@axF2BT#m0VVV0iZs$Ox7+-l7n@o#FNrWxa9aeBCK35eW2)m(e>kF@HX zF|S2Dd?o{608?d@-OtsVK`kJ)f_G0KYs%xl!3*fhd12&rjU zL5;b)+=+;RiH0%eobUODJO#KJ9>gDIrdlB|oh=_4yMNM)t7n2ldH$w%>!;dH`u!v0uMp7Ri2n?uNi5ag*keNR;F{OKgD!R%s%>a@bg$_QStpw6f`?QFjN zsFiG}-|eWX=P7CLY;^o=RBVf9&cH>;j4Au9EyHDUXy9fk<=t zbQE;@Gxu3a$}4-loCD-iZ1Cv<_lXW65%fw~^f5=3;+<&fLlkd~e{Y524Il0j zp!NMqdx^#Us=oXj!iDZH{umBNA7G?aG4|!rt0Ol{!fM+YvUda z=9(I7`tRL(IGNin+lxSeVy5~?=h}C2vul?0+a@|f{<&MZzq=KRAK-I9f#D|v7@J|` zUwy0_1FA6y`>AB`fI#pqms73a@`u~`t+w^V`#`4`cWsfXus;Lw1fW2`GDbm;_)Fry zR#W)08hSRnzE@3Co%nqmw($=z1zcX-)~jDn?)d-7cK%Z|$?cuovlP%ggf5OxiX+Fu zdHx)c`2eZ#IInI4+v5kv;=bhV1(8a!#CGo{04{n(PjNfhtkf; zpGUTj9zwMLNBagwCgjc(0HWl7iR)zz(QlpL_xH2s`Rzy6_74Hn8vs1uF8s5m8bvqJ zyB?|sjHwUIZ0tj@&r(wGGW*x_RBxAN?}8QZ#n#h*w=2A!PY48w>P~1N2pkTFFC)QN zG#rswB84l_L_8V<%WSDV(Nr>?P&f>YJIPEsnNqpze*!QL&+$~blK*8(moH()JUM`7 zfCLL}D#*EDKmY~-fCd!`^x#062mm0U*)yn2r%$0~1YnVBRjXIAGAz1PA;E+QyMFcR zHS7VfWzCY!x|VI*i5R2Cl{=SiUAuSj<`ucL=gpfq7bsYOz~@lILl z%MdI2JZosW5BckAw4yXD5kL!3Oi{%Z=>jeQ0ciV6yZ~s*?Lnf}BWyR2L@SC#mM}C? z$RUX=61f0>Oj5}unPk94pm0J!yasO!D!ub0gz=*uw`$U)AdL)D%rVJ?2uUx|OjFI_ zo>V}A0T3XJu$qPv2t7Nkd@;+AxD;qj;>rwE&_TmI^Up&OO*AS5t88?)ECm>;&n^)K zlh8{s&D1SJ746j1PfdFAFwq>Xup}Qh;xbK3H660Y4O`8WQ&4HG|Fu>+&zqD&3L8yn zAmUX0k=0mB?2{@Ei4}8JTbXV4&&GH)kJM7}3f913ll||$5kC`=EE2PI)!A{$Ef>We z3B)$s>Ohoizs$~hcU=va{ZrR_@ikZ9ePOZ|J9X!^PA$zYi+A9H4-WXadW9`&%7-D2 zSmKEx9w>o}FJ_qEjXCB~wBZ0&*s^v-M9bj(LKgWdjR$m?;+J8D*Jd z{8XM-n%nNl?QUDOyaCT#bG{81EpWsYSKM;PNzeISl_aNJb&*Gh4D-!l&s^}nXHPo; z+e2Tw_0oC2deSdbUtM@&ch~Fn*pc6RcFqUK9rxU)?p^xnf$dY$;k$+}?B)F1p6=p} zPhNbzmsh@djGu?TX7H(R-}ksX3VvO1369A7%I-g!{k)DJKX$_j*Sy1lPJL0^pZgGK zHGd^+a$MO=w-DB?lX>VqpqXIh&gH-H0g!_Oyj=mKmp~DYkWa=E9%oQyvTv=BX!0tW z(ZZ6y`K9P}0N~3FafrjB@C9?_BVPc~2SNjq|B#49+)~ggmqPwH@P#N$OA}qVEe8JV zfczt04s}?70@x6Xxf(zZ3CB4g5>SX4GvXOZ_bXo^k%}vX&J^+UM1r`mEESX?@mN$t zEbftqS6oUD`{$n>R`_mT{ZOY|S#`$I3;n zQ=QJ_O*_lErriZ^QrWa;R^n-w^p#R{|7jD*?fz*y=ke2&=3JFKj|dlbV&<8tglFT5 zCqG?s?Vc62-;(x8(5d;8qW}e6MhlovgQn(@s%+>pr$hmaf#K?_6m^X^J!UNz|IJlIiNsB+c&F^rp(osQ?Gs)1Pj2 zUk79=KCk&y)}gMb=d7yiuG%?cl9Q`#C07-{3N)vRb&{<_l|BV|HeCf!r)nLi5Pj-a z!EUFKah*?0={l&uA~mUz6C^+#CXhHy7NqOrs{o0)R=^IHv$QH~tHPRCBQ5rEWtG%p zMY90R1&IbW54#HcYSgx@-rtT1wgf9`__gHErako4|Zd(U-Z6?y)K*Nb~7cjJ3nAW@F1; z?tC|;DP^cpo7vmbnXX#oZDT#p`;|n2k$lx{Z(3i=Q|-!ks`oXjP$A4rXD&3t53VoA zwu{sgLbswBcAa_)%wDUyx3AefCWF&OVOKhMq0pT0i#>d;>@e|rdTpSm09jowUAM&W z4JnFe+~QPWWV-pSuu3b8&aPTWl69-@3~>zNyo&gTB*vP zcw<_QNs}q3W9LrB%vKDeltC#**IpU6Ki)D8!zYV+m z;1l0D(1NDzo_prsB&ylP#ub5d_2^5SLRS@#h&J(N869dGj!V*XrSz#$ooee1ddjLE z9HJ9k+{9g4)U`g9zDgb7s)X6qy{@jN-+b0E4mZ)VHXyBSoowQ~vd_BiT9P2gqfOtm z)5QMttd-5IJWmhVc|$Tj%v?z`yk2~fdLuJfNu{ps-Lc++P~Rbj&#Y5>K0@914FoPXU`T32`ni8*w# zE7j_GTssNJ{&u;yZ0_Q%``zCbcf2!s?|oOQ-=(K_z^_Q+qYFEp&so9=dkkHfrie8>2KX3~tvZR#{KE(xX{o5BF zssGdez3+i<;ff1+$j)be=3!rZ_mSJ=ERA^8gRb)Szd!zu^Lfu(PEt(MKcPtW{`UFr z^botPvBZ^{#b)yst@_z4+9-d0#RxJ5wPlD@B$?a0yl5~%kKqeu>Ee(P@2#GYB2nK za0k&ZayqbmxUc?15dPFI{!}oXa**dz5DIIn|AelwmWc+{$p?*0`*=eK6$t_j5XPjU z03QklG4A)Kj|{)C2%m1}$`B6mi^%FP4974E`(+8K2MB?WonBDCTui0J%nk2Q5DcG? z+t;d_Z;@IrI7aa)`s}Xg$Oqzxe2~iL7cE%f{%KX-d-g?g%KZe(4(dAsM=akGxbT9n4 z?+^=50(b8mZE;Jiv2>vB9vcuCzbp`Y4unx~q2nUfJbJD(m@Ef@>4j1qokEr}^Pa|ir4Zn*bDCgG1IU-B;p(2i>( z3vto&9CN@TlL==fG(E92LFF-3Q<+YaHD$6jaZEO8Q=e)Rk#7GpH|2(~P?H1wulT@= zk#w=U9Fp&J^El6JzML)t?P~HOsyF$trjWB)rY;!m${>evEtL^26VblLj}{f`;y6+n z$3#YT}3adX~u2L9}sMyc>1ad14 zk;@7c9m`TF*|Hw>us!!O4apKDjglzSQU;ImHDGf;F|9fQ?n4325aCn%(s3+jvBgHv z!tD6k2OlQAI_5MlJf956H6Ge*-0&QRy=PMNe2?{84)@eqx0LJL$<6I3xZ71~mDRgaHV3C~qwbvt9# z-DWjasj?ZN4ODwFRbG@=$E{bH&r;7xSO;xbZB_B4G9dHvJEhfQ zK2jp>5l4$MD7{Z4*Rw5Ubxw~|KC@L2>2oU;ktg#p^qdt=YcWNU68aJ}AH`5jTht?2 zbW6pt?UoS-?UgGTG%s;5LZ_--qYafR88iBBR6(UwBL}u5my%ma(m+9TG)MAbL2?@H zat-~pU=5Z?5jHNrlJpLg5J$5_Sq@YgYBIajUiB67%Ct>UHcUr#WQ`CW0~Rqqc0UD= zSr5)c5T_VZQb^5`!XN^06S-}R*3)r literal 0 HcmV?d00001 diff --git a/www/favicon.ico b/www/favicon.ico new file mode 100644 index 0000000000000000000000000000000000000000..9f6f30e4c6de09f2e93be5e3cbde8a97850b1989 GIT binary patch literal 22486 zcmeHu30zf2nr~sceZHA_-90^TmN&28Jk8Qcr;~KLlTO^lBt}i5G10h0RE&xU3Kv;K z5JYwq1!TJ*!ezg*URf{uWl>gTQ2|8(#Rd0WP}KkX*TEZUC+SY+b-$VSn-qMv>YP)j z>Z`BnRMo$}?-RmAj23UcDHx9t+MftvA%qw^_Q~}aA%5~xA%6C=;cLqu3sLZo;z|Co zLi>^s|MI_#`FYKJ2j4U1A1f?>B!ta;AzopbtU{QRWIZx?{FM?7|Cl^Y0}vh_9=zef zSosyby}jgVtk7sQ!ra_kco=wX&a{Vyl{4#DbD=R9gsG-in3Lqq-d3gZD`0B%u*xK$x0q$fJh5YsfF_A+H*ep|@8I4h{-uXJ_H>?=SlM`$b({o#^cB z6k4rT==FM`R;$Gz+pkhN3tjJ^Xt^;cH2ON0rxhBlPSmw@l9zs=>l|dhK><>5u%2c2 z3q${)P&unuzDjto{9v^|%h9qftqAtl@tWmpTZG=wA`G3qthZO_T4Y%_gueHNs3U1v zuAb!>SZ^oES;ewE{Dpt8KV!8}S!!4g+c!%qoXL~QQY$>1wL-0t{4vdX{8^7irx*Tg zd$88Pb{T{^xK5~bEkaw@!ZwpyT7=HfDRgz6LNAH!GLTv*3x9nt^Yscn`Ku$T4gI2p z?dznxdP#cnTh~vXTgWSAR7Za6$ZIc2rLrVH&Xj|PaQ5&Jv&Q=iOUq!UgDHn#VYyf> zELCdCOii8`Q{EblTFiP=BP`ixmTaHOSwk6W*cT)X+iI#6mTa&2Vz!rLDcenQmTmW^ zeARq5OUL)vcD7$FNkh`=gjS~$ix=zpo}Tj33lEZ|C1pdhR5A9@vu_x)57m-nA8GVL zOHykoN0OGLraX0$^z3VrzrTUc3@o29<*PSP)|xuXo20AbI3{sysr4;3JxEpO`7 zytXM9CC{T>rjD6*c-qv7t5;7PGiHy>{N6kn6lvP@18nw;+hGgX8HwrxB0mwu37!r zy!Upmed`O|oH>T7DnsI$;Lj#Z9K(jYOqnue^u_VrWBB%j;CY`P4qCNp>wEVn+#h;t zPV?f$i#KgL>FT=0&D(S^Ji2z)@maInyl4B5A3tU4gn7FUga!xS%~=(+bkvag!Gd4> zV$;d4cY4gsmM!aBabb$uYEIJ<*S636CV5Grp)=bv*G5K!yIuLxGVE4Z^Dj2N z^Nx?tj*rfrI~O?D%vYP$v%7#f z+y2&P$GLOn<{zE$@hvV}(zq`2a~sFQM?A)lUovxJr~8-fUo0#w*6X#&v0?VD+nD`t zFMV|G{Xp}}@A&w(RZX}b9K3qM#ON{8rd;ee)al;g>^fu797AJS>4r2-OY636+k7r9 zJNN#lfggReWBI!k>fO;15uZPvFk#f5+U{dB+Gljk=-9Y1*Df<-{elJMGrCUr_?-L5 z{QXZqUHQ@b0q3_qNC{7f3y&CMI)CEC=sf2|b}E&f!=mb3)q(}7v0)9ao@SKH`|r#A z@4vr%dt+E^vQ!*&%TeKl{n0#T7igbpH}}_qhSfmVf%y2iJFfu=D&} zzh1|tw--Cgn04T5oM_t+g(;E}hd*`r+a)y_PRuzEbAjwS2B`Vs!2C z%{5ClH#wCS?0YM6_Nh~zo+ppmXQ=FE9Gc;$GDqI`7%$R>w&{}o&)~2C}A##xK4xc(& znGNR8x0oMeS+FqoV2izdc2R0+d-LL+xhpPQ@SDBvix1nEY=|BcZECtVA@yy3z~etL z0W2&m5(+oO$4C9Hq`)fu?egYRbLXz`_4b%vXQL@~b&Aido7^_7G;87TByscRz`Rir zsg!VXY^+sr*`k({US3~%&%VkTp(*~uhQ-AnsxqQ1vy$H)&Tm16a8I35tSu-^U-(5v z&QG14J7)EdpFW+>{VRW0=+sbHP*9M(e)e#F{(gLR^2~5`>06d>g-66B+2lE%zWT|> z%ztD2C#Qd^Td=-i!+Lf2tgo}n#KlQVXWA^CsoMg_r zoy~Q`LBym_Fp|VQ8e$%edKfe6h-nOU65G@fC)N=I5xWq>NbDlb zl-s;l)MDN&%1vTXb2al*jwBC>MOpy1S~5*i@TrRU)cFZc_2)T2@GxEtCT3NWG^AiH%NWo8kp1GUBag(fq+l6) z@E-B3g6o5MPtAMmGX>i+*2%QQxTboxNiS5A=8+cb6};=OV%nK$4?X2a+)4^2Ir}qB zlGxXo<5W2_;27}N5bKg8{*|~_o+IcD%wx&38fOFfG7u*-<~Wh(3;x8w5(le^gC!Q$ z5(oRMiF--@5)YGfBsFodMiQ~Ho}}ft(v!3tTM{R?kTmKRzC+?z3noeItRrc8UZUZc zlV=x349ySw-!=R>*6(r8z53#dFOC~$Vlr+V6H4l7xxDw%3k+-t2W@ zVC5RC*KKWo{hHZ93yTL>!RIFoOD+3~8{T|#hSvw?<^z9YWo!Gom6gS@H=dt7>g5+! zkGruHk01YbK}Tz$_Ne)qHP)}c{rlHnf9-cWO-=ngpC9$|OJ6QJ+J5%8pOtCyWZ@=;Puf27>sJk|A z_isLa?zxp$3T7wG{3u2Lt3#J8Uwchu|IRxb-&$O`eA%+g&2PS+wffSQs@4Pei(YmS6|9HtO>X%nMD4QP{nfrO^s+IQ_HGbM`c8||(rhj0uYt-|j z+`Qvnr0}-~?3g|;yW&X8r?VFhTD|qwx(&KivxVXDb3U2XV=`g9iG#!Bt#7^=96Yza zZPCiLmg`h5|51DeQ_N3vR~hM*JRwp36q{?95>Nq z0yF$M!oTas$I6HI3r~Ol()>KFX*ebKDLiUd_A17Gis^{Gi5QXQ8{*NUN8-VQhvMPT zBQZ4ePz*g}n)e<*ek>k80`EOyp2y-5uko1cJ|2q8SFVT)m(Gcb@@A2|r&<)`)ryL` zdePp~qnu+u#v@VJcv5KM>xCxfptx}UD(e^$TYMeF7H=0}`&FD+yH+b!EYu3mZ8<_y z)+U;IFNsUnuZj4?GU2gBFMNH|h0WSHu_v@v?9DF_Q8^_dD6T@pmeh;wdn<*_szQ;H z+aU~RZ;R%O*F?;|8ljHL5J4e+B0hDmh}EQtj`nk+@o_-Bf;%4!jlRw3fJHtfwh zAa;i33yY;G!o@X5#2)AtF$XV;obCZp&^sXXr*4RCj;UhVyzRo(B|yZ)M2bT49vPP) z;AyM9SN5n z-Me>%E;~zjdHD!;4^L58T_eis8-$gGov>ATiS1!oB6M$wh)b_#yZ4KYR$E1iHdmC_ z91?BqC&V4T-`(9U4jecr_U%g(Zd=^M{{7h^DM=&T-L?pO)ka}wV=J7UoJ2xmoXFv` zl;lKVs3;e=Z{HT}?d{^^$&=#Nty|*i)vKcGWS6pcyl~+H#|Xqjju+>NKUc`WvGx8$ zGx6#BUx*oV7l^Ub=ZdlOXNU!}=Zg7e)5RPaFZf(6`1Et}hSf^3lH>HoyFXV*j@eI0 z(?~MBLHb^0nQ`13ej<(@|A~0`J>DJ9ypu@svyk78tkZUtqgZ3(AjYn=A^&TH!#W#b zPyRQ^*kPk^u-zzB%=>@CtLe{vE+ozS9(78YO=f8MAxTm@y_M0o!*3n(W*a6dYn=GG>em&m7&idTjIb^7ird^S82Izrn^< zWw+7Z!O>}x^X7k8%EPf0<}1HiwR(*Oml>;%KbbT4(|MnLK7YX%3l}Y3^5vw-Q>IQc zo&MhYAI$i0=B(Kt{ra`n-}ud&zx~}?Z~y+CcgIhd_`m+;e~%sa{0lF>^vjoD`PHi? zCO`ez-~RmX{`=qmgULVs)BpJA|2gUx#rT^K3BQGse$8fA-p#PsYadH{~%t|4YZRZX+Kf>oVSd z_TI?*+;1!I%6MpK2>0*bSBU$lKe#_K-^jEqTV5OQjjZdN?mhe5n8z58d_FQQd6vO= zZ)AR%mV9$Rh@PGvoH}(1JZHq6J9of6BQ9OKgv*yNE9rap?kRcYJH{Z}D&MEg3%IYu z_3PJh?b%aNU( zjUv4s_4W0rud72vMFnaO9KeYaCqQjAxCd9>k?+a0yeHp1a^whVYinUJ7*JYTs!&Nu zi4xb;)S$V!1zlZTN`7NoWEms*k!d4OvYkf$zbTe7lXAIo<%%NXUh+`Mx|5QV5w2E) z=er0E4Mj*u2+~uvXliIc&*{^+c;&LvAF{6w9XbS_0V5?P1yNB^2o4TLU|=A4K8%2X z0QmWleEqO%*G@!6Mj$aUQIV09#rgB+m9`lBNAf}CFix`$o^_+IuTSAi@+kXuWP4;A z<=Bw<8pu~eV7}&o!v&*JJ|ENBeuA1QQDZEp02dJxVRXVm6eeF zQ&d!h%*;%rrKMrtzJ18b%0g9D6^R0Agcfk(iKxh|n;~)er9O?%3?SnLIlwygHCadwcS2uY$_X zma(0}yUI?b+_QJEQ}S)1OuW3jzV4%)J9n~wb}84}wt0fO26%aUVJGiN8P(R-Dg4TB zNA@{w$&jC)kKDXGXvzD|;2`GrM?wn62*+qbQWAW9{Gd|VBcADy-MiuF;)-qF-q`9! zIXgN)MfuuE{>YP!Y6EO+Z5eNbjg15BRj$}*YZ!9AtL&@*w zza3jWec-Uk0bATWk(io^<7Y3R@9sU+A3uqb$_BKb?MKbw7DPlQz{@j`JgMO1sNxv0 zB`+J{=;Q&9tx@pwjEAp(8UnWOM_5P+c_=_+coCBJ79b_I7;!QA2#-!;`+Z?=vmTD@ zE6KaBuQxRDdpTd^qptQKT3Zg2nsM~#F?4peqpRmQ&YbO4#*gH`t*uS@hUA#`*t!k= zK7nxFL^*Aw4B78)e*Vx^RHOIC0J^T+LD%&=sA@S1m8~6A8*Jh1v>7TZ6>P0G!NW5a zp}UI7S1tCWG((-*ggxoa*qhmcJ-TKjlyo4crVH5y(t#7mZ|Fip%X!4aM8Rq$$ED?V z>(calyB08 zJ$E0WXnaB}y9o$UtLZPVc?Hequc7@! z7c4&w#EO|2*d0=g?EGrz%R7-eW*U%kK)=6)U|e_x%DLHpldv;8eSvPbvcNR zi-)tjheEMh9kR*}!7nTwp6-$G_6&yGmLS;L>_&cFCr%9BLsiFd*jvS6`mg=*&!g61 z<^+EP#y7$xtOlXF79>@i!rrQrP?uf6p7OKMAGw3`G3j}T*A;^{hA3<~hSH;bNH1)LAHTmK?_BJ5D#8v+J-oikhu5+K z*nF0WMbne<*_(SX>s@aI#u>0Py9EK6UD%y}0{(fuu-tVV8~sjUf6F~&9UDY!=OFf< z89?!=0i?7KprC62Nd*@XQF;Z3&iA7%zmfAxE}UI9aqi+cwzuNkumO&o$F?{*A%OGe zZmxxKoUe9s^RFm1NK{Yz@2NR zhnoxMCKt|e&e+B|CYyh$V&d zo7fSZ1Mko*xcjHW#yW%RP6kvq``{m1h}ir(?BTZ>T-gnE^*O}W^ds@`HDnyWhvd#X z$m||K<%NeRzjz<|vjc3?Aad9b1zp!*;9OF6r~{u*+k!Qp#>2)k2rkZvur?>H4T0;n zK*Yy$Y{#e(ygLZneSNTo43wYH}4mea#>9-_T<5q!^gZ+5?N( z=~(k|BG$1zDXB#$GgP3io_j~`|5CXZh>eTozA_6zQF(B4p-fk5;jlr6)n930wk!=R zmZidBa~{^Nr<^zCz;SCfR;);NrNcrA41vX2dKaF5C=(hmj_UObqGc0ZlS8@I;wjwqP(;gYVT}#+v*TtSB|ag z3^02;3tzmH4YN-)*kBU|JEvf{dxaw*IU6TW_M)Tnm_p(4Rq*o5g7dl*s21+S>W|3V z)Kn~=oC32C7=N@6%P0pcKC}Hi4K@q*VavKq1iR%!y(0(us#X-Vb)x79_u8i}BLCPG z>_2`Dg?+bCe&s$4*N1TE_G28o{s?uq9-(!B?O+=!`^bAwKRT{n#u3hs`8hS%pI(Ld z=n8(vt%%y$2=CQZSW9`WSr(6F3*xbG?ryky#38?k>*<;ExOwLmw1>_kt?@L%v+J;B zdk*Z@rNZf}bhxfagNs=j92Y0SZIu>2RvB<#oru7#xd;i;W7p0~t_!7DWtk3j@)1+E~6Il;mrtitcKm<61HU@+&q)8%_jsseHRd4cO0pQ zPC(mmlGKBk18oQ^Y=w{3fQ>$B*t#nZ+xHY>udW_@a;p$qa1g<%6|i6*EM8QMY47fX zwM9Ovj-AGltAiX5*HL=<25K(eL+gzp9J@6{{vV+6+FcyE`v47Buc5sAJWk#kKzdd! zKAU3!FAsMF2ZbOjSI7NgGg{l)aj>=tc?JCTBEk@@-iw05QWTdSLZE*MY}O~i$t?o0 z$r;#_U4*@P<%lghh`5r&(AFPAe03XkCRIaS(h7CyG594^WB2}QXb&`VFVKXLcmvj$ z=W_2*jCBi(;OCTw(u$Kv%0G%7+D2qH_M`UvZ5+OS7j3s5;Lwdb=(ux_^1g({U%A0I zG7o32-Nf#IY^++b1+JSN;p*rLAMR&EcZY&TxCjdk#ug86*g13G9JHMn#DHtJuHY)M z=lSzDP~UKbW2g@yd&03RI)XBe!uGv;5t5>TXGjV*tkxj0unzl=b|Q;oJ1F}wLMSi4 zm=ZX8k#DZV@gq}0RSlJnsXVh0x&xNLTTo0~iLzHV@F-Nd=h7wguCAz7P=p6*i^ z9Jv1kVm~%QZS0KVdJ*Z59bo|ojM#zTm{9J`V`2AMK5;-cB6Mkp$SuU~v_|;Fm%}fy z5>}3xSj#bE&To19mI7pEH6b*y0ekoLAeDQc%ClEc!|~tTe+x&i-bDMkOT?KMuroXX z-rgx#WxfxoS?#DU?tqt53VcGNph?y!d;PGm-H41(BPLD_7ni+Q`gsz+=Q0co-2EEs z4-HAoFZV!?INxu<)<8FS1$n|J*c1LC0dP{qzAixAGna9I@gdGHP2D{>a`GhiT#t~cFGlDd z&T$qAaNEXjRDTBQT{TcSXy6-_iri8?4sedIuBu02aS1$J3$WzFBJAYaBlnwM_DApmMdrR}P2#F%zjNFcZV1KyzI#bqbVX-s{HgmGzYt8ZgWd@wS$b+kSKDMpT#7-|A{C%~= znEMctl!w&%YV14Mh|~jzkW<@+8seKvSFYjV1D?gm^AGYa`Imu`L+`oE*ppO(FU=yb zd3_n8gX^5zL=f`o7L$!!|&dBCiIv}YvWmvj7Nt198>*Q zFXBK`17ef1uxiy#tX&$zF`h##kN^i&G<>%uz{-9noV?iP*eFCMCn7o_1 z{nSa^;#hsiJ^B#KyHEZfkRFpB4L!sF_r1Un+D~^Qy}S}W+q1FWCKc8*AodG&^2&1#GbLQPc>@0L*#!rnFRG*5&nf*jG<1LXU5*`D#>ikS*BCz<(bw#3Svheg zzx5}tJ$N+0+rwjFWH~Y|%aG&5SeA@=@dw$AZISJJ$o_c1{C9|DFWtUQS@od*;$^m7 z&XdFEk#e4S^!Ndbk@AqmJw2y1)=Aq3h0lkKmA+;y`&-IMVtnQN?!kQw@XTw7ZF#_Z z4|v`sN%osDpVF5sU&h9=N4CY7HulZX!w0xKIKa8_0n1`N6J7W|*xYYI2c3H78G1_0q zShhj(C(DraNxmemlq78wq|UaMdaR?2OUp_XdkQ-{J8Y+oL`6jf&pvCR%hu7}B1+NA zZ`$NU-HSbSy3{K%A05kK?`X&Kt<8$PLeBmi#eSizv`n!#NT5wcGTT*FR)#ZY&L}dJ zwi7KaEs8x!iZ&HNLAz02S*6&fczRH8>>mIR+5qeb+)16KC-vC0b6|Zow(F_awxzz< zp871_vtdl4O*huBx1!$Kfi@MJv1N-Je0;nSKsy9!XAv9}gf!YbbaZqmGLSYI5fKs8 zZ~MbV+E&o!V86Z;$If4XfqLQ=>M-}lr&7O2U6aEGY*g7&kK@PlKI+l8)21LOkNTTJ zMDNk_Jg=Dg;5^E04;(kz!O`B4^#xJ}`KYa{Rr>63%Mlzu)kQu31qDMlvafg1u7Nhh z2-q18=Pg@dZM_ZwyTWkn+%;Sp0-|H$uy&Ob&kVOvcOC_Qbq)4rAHiNd&(w=fA*1Fj zGMg_Vr}Yxbk6ywto=?W9_rd(*P-qegP*vA~%En$CY&i?Vp)PcEo#z-BVE;cvT6Qk$ z3WbO7c4U{-VOIq8C0oO=-pU`IemO97^uyaL53l{5Gp4-Gv&fhR1f(89Z21Z7qE0uV z@*;H9hefyDM8c8VDC)S05}q-pQ%A4*xR83$^VC(JL{{-(6gC{gftC&&@9Dt+&n9F@ z$krn|Rfqi*wJ1N*jrg=01bFd$&8`6UUu404X&#o$NXPI0-W%4o@z|Z$fnB;zY)d~0 zRbVgD>Te;wV*qITbhPn% z8sJ$%a#1ZZ4UNzrZbx?A5oA}lAWB<|uqGLP>&QHQ2fCg?&{ve_l+^!Gw^?%L7IY?D=FNfF}!*b!HXh>S8s?&G<1Y7RF0Wx$sD$VGEfv20;H;<6g3N8nlX zp$m%5Ko)iHX+6|?QEz9sa348+tiSgTbz(Q*?V5@?uZCmId<|BAoQgGHhI1Tip)V;! zc4j*3k5<0L9icgJuujH$vs9RUmVy=Ysjpw1g>}@USbmj;Wglf=&0LAHk9D_pRdb7QO~9_6&< zD&l+`#WU3i+LhJT9m4+XRs`AAo zm9TLx!m`hE5$aWhlznZ~wXjX?v=O;}k8Qt?lUHtIi+dETRq?1f*aLTm-SFJz4j0x16Bn$p^oE*tJy)*wE8m?woRVu;Km_N;P+#iv{jqghB%I805D=M!9mzRx2`YqB zKna$A$+O$9vaokgHA0gPLsxqiRcEiEf%?7{+993lJCD%lR9IQ3B0Zx6d&A1GZC4bM z(h_J}mX5S6o&!_=8yRBY8qTxH2Xf6BQr7d;b}OkTSPeVZ^{{txhwYLK*euGz=O6FE zXH(;0_E8obsPhQ+q3%1m8k*{M6jL8iLA_*0?|EG2`YX@uj`yCTO#sJ_Di;Y6ZE&+I zg(r39fwUj+a?8bnDV(Ee$0EZ+p7R;k7|(fi?m1oKc=d8utZHGKRR@(KXeGkaTRqj^?Xjfz`!`SD;bw51|mQ^U{vr?Aa zi#%XEqz+7;Da&@zKTpw>7hC#^0e> z*#=qtH?`$Y-IL5J?>~wERQ{*WpT0K&3jC1#Pbh(B2mD`J1kcv@hkm> zsX9MFdw^x+15xIrIo(1)8?l6G%v<3Jy7W4D987JFduAW|V6#{l{r%O&i6SgWNA%RmKo~$iFV<+Y)m9e7cN1)gv3{ wd^r{+DSI!jjm9Q)Ue*Z7#&-;ea|MdHoYJBhi0G)?VF8}}l literal 0 HcmV?d00001 diff --git a/www/index.html b/www/index.html new file mode 100644 index 0000000000..86133dd771 --- /dev/null +++ b/www/index.html @@ -0,0 +1,3718 @@ +An Overview of Cryptography + + + + + + +
+ + +
+

CONTENTS

+ + +		  + + +

FIGURES

+
    +
  1. Three types of cryptography: secret-key, public key, and hash function. +
  2. Sample application of the three cryptographic techniques for secure communication. +
  3. Kerberos architecture. +
  4. GTE Cybertrust Global Root-issued certificate (Netscape Navigator). +
  5. Sample entries in Unix/Linux password files. +
  6. DES enciphering algorithm. +
  7. A PGP signed message. +
  8. A PGP encrypted message. +
  9. The decrypted message. +
  10. IPsec Authentication Header format. +
  11. IPsec Encapsulating Security Payload format. +
  12. IPsec tunnel and transport modes for AH. +
  13. IPsec tunnel and transport modes for ESP. +
  14. SSL v3 configuration screen (Netscape Navigator). +
  15. SSL/TLS protocol handshake. +
  16. Elliptic curve addition. +
  17. AES pseudocode. +
+

TABLES

+
    +
  1. Minimum Key Lengths for Symmetric Ciphers. +
  2. Contents of an X.509 V3 Certificate. +
  3. Other Crypto Algorithms and Systems of Note. +
  4. ECC and RSA Key Comparison. +
+
+
+ +
+
+

1. INTRODUCTION

+

+Does increased security provide comfort to paranoid +people? Or does security provide some very basic protections that we +are naive to believe that we don't need? During this time when the +Internet provides essential communication between tens of millions of +people and is being increasingly used as a tool for commerce, security +becomes a tremendously important issue to deal with. +

+There are many aspects to security and many +applications, ranging from secure commerce and payments to private +communications and protecting passwords. One essential aspect for +secure communications is that of cryptography, which is the focus of +this chapter. But it is important to note that while cryptography is necessary for secure communications, it is not by itself sufficient. +The reader is advised, then, that the topics covered in this chapter +only describe the first of many steps necessary for better security in +any number of situations. +

+This paper has two major purposes. The first is to +define some of the terms and concepts behind basic cryptographic +methods, and to offer a way to compare the myriad cryptographic schemes +in use today. The second is to provide some real examples of +cryptography in use today. +

+I would like to say at the outset that this paper is very focused on terms, concepts, and schemes in current +use and is not a treatise of the whole field. No mention is made here +about pre-computerized crypto schemes, the difference between a +substitution and transposition cipher, cryptanalysis, or other history. +Interested readers should check out some of the books in the +bibliography below for this detailed — and interesting! — background +information.

+ +
+

2. THE PURPOSE OF CRYPTOGRAPHY

+

+Cryptography is the science of writing in secret code +and is an ancient art; the first documented use of cryptography in +writing dates back to circa 1900 B.C. when an Egyptian scribe used +non-standard hieroglyphs in an inscription. Some experts argue that +cryptography appeared spontaneously sometime after writing was +invented, with applications ranging from diplomatic missives to +war-time battle plans. It is no surprise, then, that new forms of +cryptography came soon after the widespread development of computer +communications. In data and telecommunications, cryptography is +necessary when communicating over any untrusted medium, which includes +just about any network, particularly the Internet.

+

+Within the context of any application-to-application communication, there are some specific security requirements, including:

+
    +
  • Authentication: The process of proving one's +identity. (The primary forms of host-to-host authentication on the +Internet today are name-based or address-based, both of which are +notoriously weak.)
    • +
  • Privacy/confidentiality: Ensuring that no one can read the message except the intended receiver.
    • +
  • Integrity: Assuring the receiver that the received message has not been altered in any way from the original.
    • +
  • Non-repudiation: A mechanism to prove that the sender really sent this message.
    • +
+

+Cryptography, then, not only protects data from theft or +alteration, but can also be used for user authentication. There are, in +general, three types of cryptographic schemes typically used to +accomplish these goals: secret key (or symmetric) cryptography, +public-key (or asymmetric) cryptography, and hash functions, each of +which is described below. In all cases, the initial unencrypted data is +referred to as plaintext. It is encrypted into ciphertext, which will in turn (usually) be decrypted into usable plaintext.

+

+In many of the descriptions below, two communicating +parties will be referred to as Alice and Bob; this is the common +nomenclature in the crypto field and literature to make it easier to +identify the communicating parties. If there is a third or fourth party +to the communication, they will be referred to as Carol and Dave. +Mallory is a malicious party, Eve is an eavesdropper, and Trent is a +trusted third party.

+ +
+

3. TYPES OF CRYPTOGRAPHIC ALGORITHMS

+

+There are several ways of classifying cryptographic +algorithms. For purposes of this paper, they will be categorized based +on the number of keys that are employed for encryption and decryption, +and further defined by their application and use. The three types of +algorithms that will be discussed are (Figure 1): +

    +
  • Secret Key Cryptography (SKC): Uses a single key for both encryption and decryption +
  • Public Key Cryptography (PKC): Uses one key for encryption and another for decryption +
  • Hash Functions: Uses a mathematical transformation to irreversibly "encrypt" information +
+
+
+ +

+

FIGURE 1: Three types of cryptography: secret-key, public key, and hash function.

+
+
+ +

+

3.1. Secret Key Cryptography

 +

+With secret key cryptography, a single key is +used for both encryption and decryption. As shown in Figure 1A, the +sender uses the key (or some set of rules) to encrypt the plaintext and +sends the ciphertext to the receiver. The receiver applies the same key +(or ruleset) to decrypt the message and recover the plaintext. Because +a single key is used for both functions, secret key cryptography is +also called symmetric encryption.

+

+With this form of cryptography, it is obvious that the +key must be known to both the sender and the receiver; that, in fact, +is the secret. The biggest difficulty with this approach, of course, is +the distribution of the key.

+

+Secret key cryptography schemes are generally categorized as being either stream ciphers or block ciphers. +Stream ciphers operate on a single bit (byte or computer word) at a +time and implement some form of feedback mechanism so that the key is +constantly changing. A block cipher is so-called because the scheme +encrypts one block of data at a time using the same key on each block. +In general, the same plaintext block will always encrypt to the same +ciphertext when using the same key in a block cipher whereas the same +plaintext will encrypt to different ciphertext in a stream cipher.

+

+Stream ciphers come in several flavors but two are worth mentioning here. Self-synchronizing stream ciphers calculate each bit in the keystream as a function of the previous n +bits in the keystream. It is termed "self-synchronizing" because the +decryption process can stay synchronized with the encryption process +merely by knowing how far into the n-bit keystream it is. One problem is error propagation; a garbled bit in transmission will result in n garbled bits at the receiving side. Synchronous stream ciphers +generate the keystream in a fashion independent of the message stream +but by using the same keystream generation function at sender and +receiver. While stream ciphers do not propagate transmission errors, +they are, by their nature, periodic so that the keystream will +eventually repeat.

+

+Block ciphers can operate in one of several modes; the following four are the most important:

+
    +
  • Electronic Codebook (ECB) mode is the +simplest, most obvious application: the secret key is used to encrypt +the plaintext block to form a ciphertext block. Two identical plaintext +blocks, then, will always generate the same ciphertext block. Although +this is the most common mode of block ciphers, it is susceptible to a +variety of brute-force attacks.
    • +
  • Cipher Block Chaining (CBC) mode adds a feedback mechanism +to the encryption scheme. In CBC, the plaintext is exclusively-ORed +(XORed) with the previous ciphertext block prior to encryption. In this +mode, two identical blocks of plaintext never encrypt to the same +ciphertext.
    • +
  • Cipher Feedback (CFB) mode is a block cipher implementation +as a self-synchronizing stream cipher. CFB mode allows data to be +encrypted in units smaller than the block size, which might be useful +in some applications such as encrypting interactive terminal input. If +we were using 1-byte CFB mode, for example, each incoming character is +placed into a shift register the same size as the block, encrypted, and +the block transmitted. At the receiving side, the ciphertext is +decrypted and the extra bits in the block (i.e., everything above and +beyond the one byte) are discarded.
    • +
  • Output Feedback (OFB) mode is a block cipher implementation +conceptually similar to a synchronous stream cipher. OFB prevents the +same plaintext block from generating the same ciphertext block by using +an internal feedback mechanism that is independent of both the +plaintext and ciphertext bitstreams.
    • +
+ +

+Secret key cryptography algorithms that are in use today include:

+
    +

  • Data Encryption Standard (DES): The most +common SKC scheme used today, DES was designed by IBM in the 1970s and +adopted by the National Bureau of Standards (NBS) [now the National +Institute for Standards and Technology (NIST)] in 1977 for commercial +and unclassified government applications. DES is a block-cipher +employing a 56-bit key that operates on 64-bit blocks. DES has a +complex set of rules and transformations that were designed +specifically to yield fast hardware implementations and slow software +implementations, although this latter point is becoming less +significant today since the speed of computer processors is several +orders of magnitude faster today than twenty years ago. IBM also +proposed a 112-bit key for DES, which was rejected at the time by the +government; the use of 112-bit keys was considered in the 1990s, +however, conversion was never seriously considered.

    +

    +DES is defined in American National Standard X3.92 and three Federal Information Processing Standards (FIPS):

    + +

    +Information about vulnerabilities of DES can be obtained from the Electronic Frontier Foundation.

    +

    +Two important variants that strengthen DES are:

    +
      +

    • Triple-DES (3DES): A variant of DES that employs up to +three 56-bit keys and makes three encryption/decryption passes over the +block; 3DES is also described in FIPS 46-3 and is the recommended replacement to DES.

      • +

    • DESX: +A variant devised by Ron Rivest. By combining 64 additional key bits to +the plaintext prior to encryption, effectively increases the keylength +to 120 bits.

      • +
    +

    +More detail about DES, 3DES, and DESX can be found below in Section 5.4.

    • + +

  • Advanced Encryption Standard (AES): In 1997, NIST +initiated a very public, 4-1/2 year process to develop a new secure +cryptosystem for U.S. government applications. The result, the Advanced Encryption Standard, became the official successor to DES in December 2001. AES uses an SKC scheme called Rijndael, +a block cipher designed by Belgian cryptographers Joan Daemen and +Vincent Rijmen. The algorithm can use a variable block length and key +length; the latest specification allowed any combination of keys +lengths of 128, 192, or 256 bits and blocks of length 128, 192, or 256 +bits. NIST initially selected Rijndael in October 2000 and formal +adoption as the AES standard came in December 2001. FIPS PUB 197 +describes a 128-bit block cipher employing a 128-, 192-, or 256-bit +key. The AES process and Rijndael algorithm are described in more +detail below in Section 5.9.

    • + +

  • CAST-128/256: CAST-128, described in Request for Comments (RFC) 2144, is a DES-like substitution-permutation crypto algorithm, employing a 128-bit key operating on a 64-bit block. CAST-256 (RFC 2612) +is an extension of CAST-128, using a 128-bit block size and a variable +length (128, 160, 192, 224, or 256 bit) key. CAST is named for its +developers, Carlisle Adams and Stafford Tavares and is available +internationally. CAST-256 was one of the Round 1 algorithms in the AES +process.

    • + +

  • International Data Encryption Algorithm (IDEA): +Secret-key cryptosystem written by Xuejia Lai and James Massey, in 1992 +and patented by Ascom; a 64-bit SKC block cipher using a 128-bit key. +Also available internationally.

    • + +

  • Rivest Ciphers (aka Ron's Code): Named for Ron Rivest, a series of SKC algorithms.

    +
      +

    • RC1: Designed on paper but never implemented.

      • +

    • RC2: A 64-bit block cipher using variable-sized keys +designed to replace DES. It's code has not been made public although +many companies have licensed RC2 for use in their products. Described +in RFC 2268.

      • +

    • RC3: Found to be breakable during development.

      • +

    • RC4: A +stream cipher using variable-sized keys; it is widely used in +commercial cryptography products, although it can only be exported +using keys that are 40 bits or less in length.

      +

    • RC5: A block-cipher supporting a variety of block sizes, key sizes, and number of encryption passes over the data. Described in RFC 2040.

      • +

    • RC6: An improvement over RC5, RC6 was one of the AES Round 2 algorithms.

      • +
    + +

  • Blowfish: +A symmetric 64-bit block cipher invented by Bruce Schneier; optimized +for 32-bit processors with large data caches, it is significantly +faster than DES on a Pentium/PowerPC-class machine. Key lengths can +vary from 32 to 448 bits in length. Blowfish, available freely and +intended as a substitute for DES or IDEA, is in use in over 80 products.

    • + +

  • Twofish: +A 128-bit block cipher using 128-, 192-, or 256-bit keys. Designed to +be highly secure and highly flexible, well-suited for large +microprocessors, 8-bit smart card microprocessors, and dedicated +hardware. Designed by a team led by Bruce Schneier and was one of the +Round 2 algorithms in the AES process.

    • + +

  • Camellia: +A secret-key, block-cipher crypto algorithm developed jointly by Nippon +Telegraph and Telephone (NTT) Corp. and Mitsubishi Electric Corporation +(MEC) in 2000. Camellia has some characteristics in common with AES: a +128-bit block size, support for 128-, 192-, and 256-bit key lengths, +and suitability for both software and hardware implementations on +common 32-bit processors as well as 8-bit processors (e.g., smart +cards, cryptographic hardware, and embedded systems). Also described in + RFC 3713.

    • + +

  • MISTY1: Developed at Mitsubishi Electric Corp., a block +cipher using a 128-bit key and 64-bit blocks, and a variable number of +rounds. Designed for hardware and software implementations, and is +resistant to differential and linear cryptanalysis. Described in RFC 2994.

    • + +

  • Secure and Fast Encryption Routine (SAFER): Secret-key crypto scheme designed for implementation in software. Versions have been defined for 40-, 64-, and 128-bit keys.

    • + +

  • KASUMI: +A block cipher using a 128-bit key that is part of the Third-Generation +Partnership Project (3gpp), formerly known as the Universal Mobile +Telecommunications System (UMTS). KASUMI is the intended +confidentiality and integrity algorithm for both message content and +signaling data for emerging mobile communications systems.

    • + +

  • SEED: +A block cipher using 128-bit blocks and 128-bit keys. Developed by the +Korea Information Security Agency (KISA) and adopted as a national +standard encryption algorithm in South Korea. Also described in RFC 4009.

    • + +

  • Skipjack: +SKC scheme proposed for Capstone. Although the details of the algorithm +were never made public, Skipjack was a block cipher using an 80-bit key +and 32 iteration cycles per 64-bit block.

    • +
+ +

3.2. Public-Key Cryptography

 +

+Public-key cryptography has been said to be the +most significant new development in cryptography in the last 300-400 +years. Modern PKC was first described publicly by Stanford University +professor Martin Hellman and graduate student Whitfield Diffie in 1976. +Their paper described a two-key crypto system in which two parties +could engage in a secure communication over a non-secure communications +channel without having to share a secret key.

+

+PKC depends upon the existence of so-called one-way functions, +or mathematical functions that are easy to computer whereas their +inverse function is relatively difficult to compute. Let me give you +two simple examples:

+
    +
  1. Multiplication vs. factorization: Suppose I +tell you that I have two numbers, 9 and 16, and that I want to +calculate the product; it should take almost no time to calculate the +product, 144. Suppose instead that I tell you that I have a number, +144, and I need you tell me which pair of integers I multiplied +together to obtain that number. You will eventually come up with the +solution but whereas calculating the product took milliseconds, +factoring will take longer because you first need to find the 8 pair of +integer factors and then determine which one is the correct pair.
    2. +
  2. Exponentiation vs. logarithms: Suppose I tell you that I want to take the number 3 to the 6th power; again, it is easy to calculate 36=729. But if I tell you that I have the number 729 and want you to tell me the two integers that I used, x and y so that logx 729 = y, it will take you longer to find all possible solutions and select the pair that I used.
    3. +
+

+While the examples above are trivial, they do represent +two of the functional pairs that are used with PKC; namely, the ease of +multiplication and exponentiation versus the relative difficulty of +factoring and calculating logarithms, respectively. The mathematical +"trick" in PKC is to find a trap door in the one-way function so that the inverse calculation becomes easy given knowledge of some item of information.

+

+Generic PKC employs two keys that are mathematically +related although knowledge of one key does not allow someone to easily +determine the other key. One key is used to encrypt the plaintext and +the other key is used to decrypt the ciphertext. The important point +here is that it does not matter which key is applied first, but +that both keys are required for the process to work (Figure 1B). +Because a pair of keys are required, this approach is also called asymmetric cryptography.

+

+In PKC, one of the keys is designated the public key and may be advertised as widely as the owner wants. The other key is designated the private key +and is never revealed to another party. It is straight forward to send +messages under this scheme. Suppose Alice wants to send Bob a message. +Alice encrypts some information using Bob's public key; Bob decrypts +the ciphertext using his private key. This method could be also used to +prove who sent a message; Alice, for example, could encrypt some +plaintext with her private key; when Bob decrypts using Alice's public +key, he knows that Alice sent the message and Alice cannot deny having +sent the message (non-repudiation).

+ +

+Public-key cryptography algorithms that are in use today for key exchange or digital signatures include:

+
    +

  • RSA: The first, and still most common, +PKC implementation, named for the three MIT mathematicians who +developed it — Ronald Rivest, Adi Shamir, and Leonard Adleman. RSA +today is used in hundreds of software products and can be used for key +exchange, digital signatures, or encryption of small blocks of data. +RSA uses a variable size encryption block and a variable size key. The +key-pair is derived from a very large number, n, that is the +product of two prime numbers chosen according to special rules; these +primes may be 100 or more digits in length each, yielding an n with roughly twice as many digits as the prime factors. The public key information includes n and a derivative of one of the factors of n; an attacker cannot determine the prime factors of n +(and, therefore, the private key) from this information alone and that +is what makes the RSA algorithm so secure. (Some descriptions of PKC +erroneously state that RSA's safety is due to the difficulty in factoring +large prime numbers. In fact, large prime numbers, like small prime +numbers, only have two factors!) The ability for computers to factor +large numbers, and therefore attack schemes such as RSA, is rapidly +improving and systems today can find the prime factors of numbers with +more than 140 digits. The presumed protection of RSA, however, is that +users can easily increase the key size to always stay ahead of the +computer processing curve. As an aside, the patent for RSA expired in +September 2000 which does not appear to have affected RSA's popularity +one way or the other. A detailed example of RSA is presented below in Section 5.3.

    • + +

  • Diffie-Hellman: +After the RSA algorithm was published, Diffie and Hellman came up with +their own algorithm. D-H is used for secret-key key exchange only, and +not for authentication or digital signatures. More detail about +Diffie-Hellman can be found below in Section 5.2.

    • + +

  • Digital Signature Algorithm (DSA): +The algorithm specified in NIST's Digital Signature Standard (DSS), +provides digital signature capability for the authentication of +messages.

    • + +

  • ElGamal: Designed by Taher Elgamal, a PKC system similar to Diffie-Hellman and used for key exchange.

    • + +

  • Elliptic Curve Cryptography (ECC): A PKC algorithm based +upon elliptic curves. ECC can offer levels of security with small keys +comparable to RSA and other PKC methods. It was designed for devices +with limited compute power and/or memory, such as smartcards and PDAs. +More detail about ECC can be found below in Section 5.8. Other references include "The Importance of ECC" Web page and the "Online Elliptic Curve Cryptography Tutorial", both from Certicom.

    • + +

  • Public-Key Cryptography Standards (PKCS): A set of interoperable standards and guidelines for public-key cryptography, designed by RSA Data Security Inc. +

      +
    • PKCS #1: RSA Cryptography Standard (Also RFC 3447)
      • +
    • PKCS #2: Incorporated into PKCS #1.
      • +
    • PKCS #3: Diffie-Hellman Key-Agreement Standard
      • +
    • PKCS #4: Incorporated into PKCS #1.
      • +
    • PKCS #5: Password-Based Cryptography Standard (PKCS #5 V2.0 is also RFC 2898)
      • +
    • PKCS #6: Extended-Certificate Syntax Standard (being phased out in favor of X.509v3)
      • +
    • PKCS #7: Cryptographic Message Syntax Standard (Also RFC 2315)
      • +
    • PKCS #8: Private-Key Information Syntax Standard
      • +
    • PKCS #9: Selected Attribute Types (Also RFC 2985)
      • +
    • PKCS #10: Certification Request Syntax Standard (Also RFC 2986)
      • +
    • PKCS #11: Cryptographic Token Interface Standard
      • +
    • PKCS #12: Personal Information Exchange Syntax Standard
      • +
    • PKCS #13: Elliptic Curve Cryptography Standard
      • +
    • PKCS #14: Pseudorandom Number Generation Standard is no longer available
      • + +
    • PKCS #15: Cryptographic Token Information Format Standard
      • +
    + +

  • Cramer-Shoup: A public-key cryptosystem proposed by R. Cramer and V. Shoup of IBM in 1998.

    • + +

  • Key Exchange Algorithm (KEA): A variation on Diffie-Hellman; proposed as the key exchange method for Capstone.

    • + +

  • LUC: +A public-key cryptosystem designed by P.J. Smith and based on Lucas +sequences. Can be used for encryption and signatures, using integer +factoring.

    • +
+ +

+For additional information on PKC algorithms, see "Public-Key Encryption", Chapter 8 in Handbook of Applied Cryptography, by A. Menezes, P. van Oorschot, and S. Vanstone (CRC Press, 1996).

+ +
+
+

+A digression: Who invented PKC? I tried to be +careful in the first paragraph of this section to state that Diffie and +Hellman "first described publicly" a PKC scheme. Although I have +categorized PKC as a two-key system, that has been merely for +convenience; the real criteria for a PKC scheme is that it allows two +parties to exchange a secret even though the communication with the +shared secret might be overheard. There seems to be no question that +Diffie and Hellman were first to publish; their method is described in +the classic paper, "New Directions in Cryptography," published in the +November 1976 issue of IEEE Transactions on Information Theory. +As shown below, Diffie-Hellman uses the idea that finding logarithms is +relatively harder than exponentiation. And, indeed, it is the precursor +to modern PKC which does employ two keys. Rivest, Shamir, and Adleman +described an implementation that extended this idea in their paper "A +Method for Obtaining Digital Signatures and Public-Key Cryptosystems," +published in the February 1978 issue of the Communications of the ACM (CACM). +Their method, of course, is based upon the relative ease of finding the +product of two large prime numbers compared to finding the prime +factors of a large number.

+

+Some sources, though, credit Ralph Merkle with first +describing a system that allows two parties to share a secret although +it was not a two-key system, per se. A Merkle Puzzle works +where Alice creates a large number of encrypted keys, sends them all to +Bob so that Bob chooses one at random and then lets Alice know which he +has selected. An eavesdropper will see all of the keys but can't learn +which key Bob has selected (because he has encrypted the response with +the chosen key). In this case, Eve's effort to break in is the square +of the effort of Bob to choose a key. While this difference may be +small it is often sufficient. Merkle apparently took a computer science +course at UC Berkeley in 1974 and described his method, but had +difficulty making people understand it; frustrated, he dropped the +course. Meanwhile, he submitted the paper "Secure Communication Over +Insecure Channels" which was published in the CACM in April +1978; Rivest et al.'s paper even makes reference to it. Merkle's method +certainly wasn't published first, but did he have the idea first?

+

+An interesting question, maybe, but who really knows? +For some time, it was a quiet secret that a team at the UK's Government +Communications Headquarters (GCHQ) had first developed PKC in the early +1970s. Because of the nature of the work, GCHQ kept the original memos +classified. In 1997, however, the GCHQ changed their posture when they +realized that there was nothing to gain by continued silence. Documents +show that a GCHQ mathematician named James Ellis started research into +the key distribution problem in 1969 and that by 1975, Ellis, Clifford +Cocks, and Malcolm Williamson had worked out all of the fundamental +details of PKC, yet couldn't talk about their work. (They were, of +course, barred from challenging the RSA patent!) After more than 20 +years, Ellis, Cocks, and Williamson have begun to get their due credit.

+

+And the National Security Agency (NSA) claims to have +knowledge of this type of algorithm as early as 1966 but there is no +supporting documentation... yet. So this really was a digression...

+
+
+ +

3.3. Hash Functions

 +

+Hash functions, also called message digests and one-way encryption, +are algorithms that, in some sense, use no key (Figure 1C). Instead, a +fixed-length hash value is computed based upon the plaintext that makes +it impossible for either the contents or length of the plaintext to be +recovered. Hash algorithms are typically used to provide a digital fingerprint +of a file's contents, often used to ensure that the file has not been +altered by an intruder or virus. Hash functions are also commonly +employed by many operating systems to encrypt passwords. Hash +functions, then, help preserve the integrity of a file.

+

+Hash functions are sometimes misunderstood and some +sources claim that no two files can have the same hash value. This +isn't true, strictly speaking. Consider a hash function that provides a +128-bit hash value. There are, obviously, 2128 possible hash values. But there are a lot more than 2128 possible +files. Therefore, there have to be multiple files — in fact, there have +to be an infinite number of files! — that can have the same 128-bit +hash value. The difficulty is finding two files with the same +hash! What is, indeed, very hard to do is to try to create a file that +has a given hash value so as to force a hash value collision.

+ +

+Hash algorithms that are in common use today include:

+
    +

  • Message Digest (MD) algorithms: A series of byte-oriented algorithms that produce a 128-bit hash value from an arbitrary-length message.

    +
      +

    • MD2 (RFC 1319): Designed for systems with limited memory, such as smart cards.

      • +

    • MD4 (RFC 1320): Developed by Rivest, similar to MD2 but designed specifically for fast processing in software.

      • +

    • MD5 (RFC 1321: +Also developed by Rivest after potential weaknesses were reported in +MD4; this scheme is similar to MD4 but is slower because more +manipulation is made to the original data. MD5 has been implemented in +a large number of products although several weaknesses in the algorithm +were demonstrated by German cryptographer Hans Dobbertin in 1996.

      • +
    + +

  • Secure Hash Algorithm (SHA): Algorithm for NIST's +Secure Hash Standard (SHS). SHA-1 produces a 160-bit hash value and was +originally published as FIPS 180-1 and RFC 3174. FIPS 180-2 +describes five algorithms in the SHS: SHA-1 plus SHA-224, SHA-256, +SHA-384, and SHA-512 which can produce hash values that are 224, 256, +384, or 512 bits in length, respectively.

    • + +

  • RIPEMD: A series of message digests that initially came from the RIPE (RACE Integrity Primitives Evaluation) project. RIPEMD-160 +was designed by Hans Dobbertin, Antoon Bosselaers, and Bart Preneel, +and optimized for 32-bit processors to replace the then-current 128-bit +hash functions. Other versions include RIPEMD-256, RIPEMD-320, and +RIPEMD-128.

    • + +

  • HAVAL (HAsh of VAriable Length): +Designed by Y. Zheng, J. Pieprzyk and J. Seberry, a hash algorithm with +many levels of security. HAVAL can create hash values that are 128, +160, 192, 224, or 256 bits in length.

    • +
+

+For additional information, see David Hopwood's MessageDigest Algorithms page.

+ +

3.4. Why Three Encryption Techniques?

 +

+So, why are there so many different types of cryptographic schemes? Why can't we do everything we need with just one? +

+The answer is that each scheme is optimized for some +specific application(s). Hash functions, for example, are well-suited +for ensuring data integrity because any change made to the contents of +a message will result in the receiver calculating a different hash +value than the one placed in the transmission by the sender. Since it +is highly unlikely that two different messages will yield the same hash +value, data integrity is ensured to a high degree of confidence. +

+Secret key cryptography, on the other hand, is ideally suited to encrypting messages. The sender can generate a session key on a per-message basis to encrypt the message; the receiver, of course, needs the same session key to decrypt the message. +

+Key exchange, of course, is a key application of +public-key cryptography (no pun intended). Asymmetric schemes can also +be used for non-repudiation; if the receiver can obtain the session key +encrypted with the sender's private key, then only this sender could +have sent the message. Public-key cryptography could, theoretically, +also be used to encrypt messages although this is rarely done because +secret-key cryptography operates about 1000 times faster than +public-key cryptography. +

+
+
+ +

+

FIGURE 2: Sample application of the three cryptographic techniques for secure communication.

+
+
+
+

+Figure 2 puts all of this together and shows how a hybrid cryptographic scheme combines all of these functions to form a secure transmission comprising digital signature and digital envelope. In this example, the sender of the message is Alice and the receiver is Bob. +

+A digital envelope comprises an encrypted message and an +encrypted session key. Alice uses secret key cryptography to encrypt +her message using the session key, which she generates at +random with each session. Alice then encrypts the session key using +Bob's public key. The encrypted message and encrypted session key +together form the digital envelope. Upon receipt, Bob recovers the +session secret key using his private key and then decrypts the +encrypted message. +

+The digital signature is formed in two steps. First, +Alice computes the hash value of her message; next, she encrypts the +hash value with her private key. Upon receipt of the digital signature, +Bob recovers the hash value calculated by Alice by decrypting the +digital signature with Alice's public key. Bob can then apply the hash +function to Alice's original message, which he has already decrypted +(see previous paragraph). If the resultant hash value is not the same +as the value supplied by Alice, then Bob knows that the message has +been altered; if the hash values are the same, Bob should believe that +the message he received is identical to the one that Alice sent. +

+This scheme also provides nonrepudiation since it proves +that Alice sent the message; if the hash value recovered by Bob using +Alice's public key proves that the message has not been altered, then +only Alice could have created the digital signature. Bob also has proof +that he is the intended receiver; if he can correctly decrypt the +message, then he must have correctly decrypted the session key meaning +that his is the correct private key.

+ +

3.5. The Significance of Key Length

 +

+In a recent article in the industry literature (circa +9/98), a writer made the claim that 56-bit keys do not provide as +sufficient protection for DES today as they did in 1975 because +computers are 1000 times faster today than in 1975. Therefore, the +writer went on, we should be using 56,000-bit keys today instead of +56-bit keys to provide adequate protection. The conclusion was then +drawn that because 56,000-bit keys are infeasible (true), we should accept the fact that we have to live with weak cryptography (false!). +The major error here is that the writer did not take into account that +the number of possible key values double whenever a single bit is added +to the key length; thus, a 57-bit key has twice as many values as a +56-bit key (because 257 is two times 256). In fact, a 66-bit key would have 1024 times the possible values as a 56-bit key.

+ +

+But this does bring up the issue, what is the precise significance of key length as it affects the level of protection?

+

+In cryptography, size does matter. The larger the key, +the harder it is to crack a block of encrypted data. The reason that +large keys offer more protection is almost obvious; computers have made +it easier to attack ciphertext by using brute force methods rather than +by attacking the mathematics (which are generally well-known anyway). +With a brute force attack, the attacker merely generates every possible +key and applies it to the ciphertext. Any resulting plaintext that +makes sense offers a candidate for a legitimate key. This was the +basis, of course, of the EFF's attack on DES.

+

+Until the mid-1990s or so, brute force attacks were +beyond the capabilities of computers that were within the budget of the +attacker community. Today, however, significant compute power is +commonly available and accessible. General purpose computers such as +PCs are already being used for brute force attacks. For serious +attackers with money to spend, such as some large companies or +governments, Field Programmable Gate Array (FPGA) or +Application-Specific Integrated Circuits (ASIC) technology offers the +ability to build specialized chips that can provide even faster and +cheaper solutions than a PC. Consider that an AT&T ORCA chip (FPGA) +costs $200 and can test 30 million DES keys per second, while a $10 +ASIC chip can test 200 million DES keys per second (compared to a PC +which might be able to test 40,000 keys per second).

+

+The table below shows what DES key sizes are needed to +protect data from attackers with different time and financial +resources. This information is not merely academic; one of the basic +tenets of any security system is to have an idea of what you are protecting and from who +are you protecting it! The table clearly shows that a 40-bit key is +essentially worthless today against even the most unsophisticated +attacker. On the other hand, 56-bit keys are fairly strong unless you +might be subject to some pretty serious corporate or government +espionage. But note that even 56-bit keys are declining in their value +and that the times in the table (1995 data) are worst cases.

+ +
+ + + + + + + + + + + + + +
+TABLE 1. Minimum Key Lengths for Symmetric Ciphers. +
Type of Attacker +Budget +Tool +Time and Cost
Per Key Recovered +		Key Length Needed
For Protection
In Late-1995 +
40 bits +56 bits +
Pedestrian Hacker +Tiny +Scavanged
computer
time +		1 week +Infeasible +45 +
$400 +FPGA +5 hours
($0.08) +		38 years
($5,000) +		50 +
Small Business +$10,000 +FPGA +12 minutes
($0.08) +		18 months
($5,000) +		55 +
Corporate Department +$300K +FPGA +24 seconds
($0.08) +		19 days
($5,000) +		60 +
ASIC +0.18 seconds
($0.001) +		3 hours
($38) +
Big Company +$10M +FPGA +7 seconds
($0.08) +		13 hours
($5,000) +		70 +
ASIC +0.005 seconds
($0.001) +		6 minutes
($38) +
Intelligence Agency +$300M +ASIC +0.0002 seconds
($0.001) +		12 seconds
($38) +		75 +
+
+

+ +

+So, how big is big enough? DES, invented in 1975, is +still in use today, nearly 25 years later. If we take that to be a +design criteria (i.e., a 20-plus year lifetime) and we believe Moore's +Law ("computing power doubles every 18 months"), then a key size +extension of 14 bits (i.e., a factor of more than 16,000) should be +adequate. The 1975 DES proposal suggested 56-bit keys; by 1995, a +70-bit key would have been required to offer equal protection and an +85-bit key will be necessary by 2015.

+

+The discussion above suggests that a 128- or 256-bit key +for SKC will suffice for some time because that key length keeps us +ahead of the brute force capabilities of the attackers. While a large +key is good, a huge key may not always be better. That is, many +public-key cryptosystems use 1024- or 2048-bit keys; expanding the key +to 4096 bits probably doesn't add any protection at this time but it +does add significantly to processing time.

+

+The most effective large-number factoring methods today +use a mathematical Number Field Sieve to find a certain number of +relationships and then uses a matrix operation to solve a linear +equation to produce the two prime factors. The sieve step actually +involves a large number of operations of operations that can be +performed in parallel; solving the linear equation, however, requires a +supercomputer. Indeed, finding the solution to the RSA-140 challenge in +February 1999 — factoring a 140-digit (465-bit) prime number — required +200 computers across the Internet about 4 weeks for the first step and +a Cray computer 100 hours and 810 MB of memory to do the second step.

+

+In early 1999, Shamir (of RSA fame) described a new +machine that could increase factorization speed by 2-3 orders of +magnitude. Although no detailed plans were provided nor is one known to +have been built, the concepts of TWINKLE (The Weizmann Institute Key Locating Engine) +could result in a specialized piece of hardware that would cost about +$5000 and have the processing power of 100-1000 PCs. There still appear +to be many engineering details that have to be worked out before such a +machine could be built. Furthermore, the hardware improves the sieve +step only; the matrix operation is not optimized at all by this design +and the complexity of this step grows rapidly with key length, both in +terms of processing time and memory requirements. Nevertheless, this +plan conceptually puts 512-bit keys within reach of being factored. +Although most PKC schemes allow keys that are 1024 bits and longer, +Shamir claims that 512-bit RSA keys "protect 95% of today's E-commerce +on the Internet." (See Bruce Schneier's Crypto-Gram (May 15, 1999) for more information, as well as the comments from RSA Labs.)

+

+It is also interesting to note that while cryptography +is good and strong cryptography is better, long keys may disrupt the +nature of the randomness of data files. Shamir and van Someren ("Playing hide and seek with stored keys") +have noted that a new generation of viruses can be written that will +find files encrypted with long keys, making them easier to find by +intruders and, therefore, more prone to attack.

+

+Finally, U.S. government policy has tightly controlled +the export of crypto products since World War II. Until recently, +export outside of North America of cryptographic products using keys +greater than 40 bits in length was prohibited, which made those +products essentially worthless in the marketplace, particularly for +electronic commerce. More recently, the U.S. Commerce Department +relaxed the regulations, allowing the general export of 56-bit SKC and +1024-bit PKC products (certain sectors, such as health care and +financial, allow the export of products with even larger keys). The +Commerce Department's Bureau of Export Administration maintains a Commercial Encryption Export Controls web page with more information. The potential impact of this policy on U.S. businesses is well beyond the scope of this paper.

+

+Much of the discussion above, including the table, are based on the paper "Minimal Key Lengths for Symmetric Ciphers to Provide Adequate Commercial Security" by M. Blaze, W. Diffie, R.L. Rivest, B. Schneier, T. Shimomura, E. Thompson, and M. Wiener.

+

+On a related topic, public key crypto schemes can be +used for several purposes, including key exchange, digital signatures, +authentication, and more. In those PKC systems used for SKC key +exchange, the PKC key lengths are chosen so to be resistant to some +selected level of attack. The length of the secret keys exchanged via +that system have to have at least the same level of attack resistance. +Thus, the three parameters of such a system — system strength, secret +key strength, and public key strength — must be matched. This topic is +explored in more detail in Determining Strengths For Public Keys Used For Exchanging Symmetric Keys (RFC 3766).

+ +
+

4. TRUST MODELS

+

+Secure use of cryptography requires trust. While secret +key cryptography can ensure message confidentiality and hash codes can +ensure integrity, none of this works without trust. In SKC, Alice and +Bob had to share a secret key. PKC solved the secret distribution +problem, but how does Alice really know that Bob is who he says he is? +Just because Bob has a public and private key, and purports to be +"Bob," how does Alice know that a malicious person (Mallory) is not +pretending to be Bob? +

+There are a number of trust models employed by various cryptographic schemes. This section will explore three of them: +

+
    +
  • The web of trust employed by Pretty Good Privacy (PGP) users, who hold their own set of trusted public keys. +
  • Kerberos, a secret key distribution scheme using a trusted third party. +
  • Certificates, which allow a set of trusted third parties to authenticate each other and, by implication, each other's users. +
+

+Each of these trust models differs in complexity, general applicability, scope, and scalability. +

+

4.1. PGP Web of Trust

 +

+Pretty Good Privacy (described more below in Section 5.5) +is a widely used private e-mail scheme based on public key methods. A +PGP user maintains a local keyring of all their known and trusted +public keys. The user makes their own determination about the +trustworthiness of a key using what is called a "web of trust." +

+If Alice needs Bob's public key, Alice can ask Bob for +it in another e-mail or, in many cases, download the public key from an +advertised server; this server might a well-known PGP key repository or +a site that Bob maintains himself. In fact, Bob's public key might be +stored or listed in many places. (The author's public key, for example, +can be found at http://www.garykessler.net/kumquat_pubkey.html.) Alice is prepared to believe that Bob's public key, as stored at these locations, is valid. +

+Suppose Carol claims to hold Bob's public key and offers +to give the key to Alice. How does Alice know that Carol's version of +Bob's key is valid or if Carol is actually giving Alice a key that will +allow Mallory access to messages? The answer is, "It depends." If Alice +trusts Carol and Carol says that she thinks that her version of Bob's +key is valid, then Alice may — at her option — trust +that key. And trust is not necessarily transitive; if Dave has a copy +of Bob's key and Carol trusts Dave, it does not necessarily follow that +Alice trusts Dave even if she does trust Carol. +

+The point here is that who Alice trusts and how she +makes that determination is strictly up to Alice. PGP makes no +statement and has no protocol about how one user determines whether +they trust another user or not. In any case, encryption and signatures +based on public keys can only be used when the appropriate public key +is on the user's keyring. +

+

4.2. Kerberos

 +

+Kerberos is a commonly used authentication scheme on the +Internet. Developed by MIT's Project Athena, Kerberos is named for the +three-headed dog who, according to Greek mythology, guards the entrance +of Hades (rather than the exit, for some reason!). +

+ +Kerberos employs a client/server architecture and +provides user-to-server authentication rather than host-to-host +authentication. In this model, security and authentication will be +based on secret key technology where every host on the network has its +own secret key. It would clearly be unmanageable if every host had to +know the keys of all other hosts so a secure, trusted host somewhere on +the network, known as a Key Distribution Center (KDC), knows the keys +for all of the hosts (or at least some of the hosts within a portion of +the network, called a realm). In this way, when a new node is +brought online, only the KDC and the new node need to be configured +with the node's key; keys can be distributed physically or by some +other secure means. +
+
+

+ +

+

FIGURE 3: Kerberos architecture.

+
+
+
The Kerberos Server/KDC has two main +functions (Figure 3), known as the Authentication Server (AS) and +Ticket-Granting Server (TGS). The steps in establishing an +authenticated session between an application client and the application +server are: +

+
    +
  1. The Kerberos client software +establishes a connection with the Kerberos server's AS function. The AS +first authenticates that the client is who it purports to be. The AS +then provides the client with a secret key for this login session (the TGS session key) +and a ticket-granting ticket (TGT), which gives the client permission +to talk to the TGS. The ticket has a finite lifetime so that the +authentication process is repeated periodically. +
  2. The client now communicates with the TGS +to obtain the Application Server's key so that it (the client) can +establish a connection to the service it wants. The client supplies the +TGS with the TGS session key and TGT; the TGS responds with an +application session key (ASK) and an encrypted form of the Application +Server's secret key; this secret key is never sent on the network in any other form. +
  3. The client has now authenticated itself and +can prove its identity to the Application Server by supplying the +Kerberos ticket, application session key, and encrypted Application +Server secret key. The Application Server responds with similarly +encrypted information to authenticate itself to the client. At this +point, the client can initiate the intended service requests (e.g., +Telnet, FTP, HTTP, or e-commerce transaction session establishment). +
+

+The current shipping version of this protocol is Kerberos V5 (described in RFC 1510), +although Kerberos V4 still exists and is seeing some use. While the +details of their operation, functional capabilities, and message +formats are different, the conceptual overview above pretty much holds +for both. One primary difference is that Kerberos V4 uses only DES to +generate keys and encrypt messages, while V5 allows other schemes to be +employed (although DES is still the most widely algorithm used). +

+

4.3. Public Key Certificates and Certificate Authorities

 +

+Certificates and Certificate Authorities (CA) +are necessary for widespread use of cryptography for e-commerce +applications. While a combination of secret and public key cryptography +can solve the business issues discussed above, crypto cannot alone +address the trust issues that must exist between a customer and vendor +in the very fluid, very dynamic e-commerce relationship. How, for +example, does one site obtain another party's public key? How does a +recipient determine if a public key really belongs to the sender? How +does the recipient know that the sender is using their public key for a +legitimate purpose for which they are authorized? When does a public +key expire? How can a key be revoked in case of compromise or loss? +

+The basic concept of a certificate is one that is +familiar to all of us. A driver's license, credit card, or SCUBA +certification, for example, identify us to others, indicate something +that we are authorized to do, have an expiration date, and identify the +authority that granted the certificate. +

+As complicated as this may sound, it really isn't! +Consider driver's licenses. I have one issued by the State of Vermont. +The license establishes my identity, indicates the type of vehicles +that I can operate and the fact that I must wear corrective lenses +while doing so, identifies the issuing authority, and notes that I am +an organ donor. When I drive outside of Vermont, the other +jurisdictions throughout the U.S. recognize the authority of Vermont to +issue this "certificate" and they trust the information it contains. +Now, when I leave the U.S., everything changes. When I am in Canada and +many other countries, they will accept not the Vermont license, per se, +but any license issued in the U.S.; some other countries may +not recognize the Vermont driver's license as sufficient bona fides +that I can drive. This analogy represents the certificate chain, where +even certificates carry certificates. +

+For purposes of electronic transactions, certificates are digital documents. The specific functions of the certificate include: +

    +
  • Establish identity: Associate, or bind, a public key to an individual, organization, corporate position, or other entity. +
  • Assign authority: Establish what actions the holder may or may not take based upon this certificate. +
  • Secure confidential information (e.g., encrypting the session's symmetric key for data confidentiality). +
+

+Typically, a certificate contains a public key, a name, +an expiration date, the name of the authority that issued the +certificate (and, therefore, is vouching for the identity of the user), +a serial number, any pertinent policies describing how the certificate +was issued and/or how the certificate may be used, the digital +signature of the certificate issuer, and perhaps other information. +
+
+

+ +

+

FIGURE 4: GTE Cybertrust Global Root-issued certificate as viewed
by Netscape Navigator V4.

+
+
+
+

+A sample abbreviated certificate is +shown in Figure 4. This is a typical certificate found in a browser; +while this one is issued by GTE Cybertrust, many so-called root-level +certificates can be found shipped with browsers. When the browser makes +a connection to a secure Web site, the Web server sends its public key +certificate to the browser. The browser then checks the certificate's +signature against the public key that it has stored; if there is a +match, the certificate is taken as valid and the Web site verified by +this certificate is considered to be "trusted." +

+
+ + +
+TABLE 2. Contents of an X.509 V3 Certificate. +
+
    +version number
    +certificate serial number
    +signature algorithm identifier
    +issuer's name and unique identifier
    +validity (or operational) period
    +subject's name and unique identifier
    +subject public key information
    +standard extensions
    +
      +certificate appropriate use definition
      +key usage limitation definition
      +certificate policy information
      +
    +other extensions
    +
      +Application-specific
      +CA-specific
      +
    +
+
+
+

+

+The most widely accepted certificate format is the one +defined in International Telecommunication Union Telecommunication +Standardization Sector (ITU-T) Recommendation X.509. Rec. X.509 is a +specification used around the world and any applications complying with +X.509 can share certificates. Most certificates today comply with X.509 +Version 3 and contain the information listed in Table 2. +

+Certificate authorities are the repositories for +public-keys and can be any agency that issues certificates. A company, +for example, may issue certificates to its employees, a +college/university to its students, a store to its customers, an +Internet service provider to its users, or a government to its +constituents.

+When a sender needs an intended receiver's public key, +the sender must get that key from the receiver's CA. That scheme is +straight-forward if the sender and receiver have certificates issued by +the same CA. If not, how does the sender know to trust the +foreign CA? One industry wag has noted, about trust: "You are either +born with it or have it granted upon you." Thus, some CAs will be +trusted because they are known to be reputable, such as the CAs +operated by AT&T, BBN, Canada Post Corp., CommerceNet, GTE Cybertrust, MCI, Nortel EnTrust, Thawte, the U.S. Postal Service, and VeriSign. +CAs, in turn, form trust relationships with other CAs. Thus, if a user +queries a foreign CA for information, the user may ask to see a list of +CAs that establish a "chain of trust" back to the user. +

+One major feature to look for in a CA is their +identification policies and procedures. When a user generates a key +pair and forwards the public key to a CA, the CA has to check the +sender's identification and takes any steps necessary to assure itself +that the request is really coming from the advertised sender. Different +CAs have different identification policies and will, therefore, be +trusted differently by other CAs. Verification of identity is just of +many issues that are part of a CA's Certification Practice Statement +(CPS) and policies; other issues include how the CA protects the public +keys in its care, how lost or compromised keys are revoked, and how the +CA protects its own private keys. +

+

4.4. Summary

 +

+The paragraphs above describe three very different trust +models. It is hard to say that any one is better than the others; it +depend upon your application. One of the biggest and fastest growing +applications of cryptography today, though, is electronic commerce +(e-commerce), a term that itself begs for a formal definition. +

+PGP's web of trust is easy to maintain and very much +based on the reality of users as people. The model, however, is +limited; just how many public keys can a single user reliably store and +maintain? And what if you are using the "wrong" computer when you want +to send a message and can't access your keyring? How easy it is to +revoke a key if it is compromised? PGP may also not scale well to an +e-commerce scenario of secure communication between total strangers on +short-notice. +

+Kerberos overcomes many of the problems of PGP's web of +trust, in that it is scalable and its scope can be very large. However, +it also requires that the Kerberos server have a priori +knowledge of all client systems prior to any transactions, which makes +it unfeasible for "hit-and-run" client/server relationships as seen in +e-commerce. +

+Certificates and the collection of CAs will form a +Public Key Infrastructure (PKI). In the early days of the Internet, +every host had to maintain a list of every other host; the Domain Name +System (DNS) introduced the idea of a distributed database for this +purpose and the DNS is one of the key reasons that the Internet has +grown as it has. A PKI will fill a similar void in the e-commerce and +PKC realm. +

+While certificates and the benefits of a PKI are most +often associated with electronic commerce, the applications for PKI are +much broader and include secure electronic mail, payments and +electronic checks, Electronic Data Interchange (EDI), secure transfer +of Domain Name System (DNS) and routing information, electronic forms, +and digitally signed documents. A single "global PKI" is still many +years away, that is the ultimate goal of today's work as international +electronic commerce changes the way in which we do business in a +similar way in which the Internet has changed the way in which we +communicate. +

+
+ +

5. CRYPTOGRAPHIC ALGORITHMS IN ACTION

+

+The paragraphs above have provided an overview of the +different types of cryptographic algorithms, as well as some examples +of some available protocols and schemes. Table 3 provides an even +longer list of some of the schemes employed today for a variety of +functions, most notably electronic commerce. The paragraphs below will +show several real cryptographic applications that many of us employ +(knowingly or not) everyday; for password protection and private +communication. +

+
+ + + + +
TABLE 3. Other Crypto Algorithms and Systems of Note.

Capstone +A now-defunct U.S. National Institute +of Standards and Technology (NIST) and National Security Agency (NSA) +project under the Bush Sr. and Clinton administrations for publicly +available strong cryptography with keys escrowed by the government +(NIST and the Treasury Dept.). Capstone included in one or more +tamper-proof computer chips for implementation (Clipper), a secret key +encryption algorithm (Skipjack), digital signature algorithm (DSA), key +exchange algorithm (KEA), and hash algorithm (SHA). +
Clipper +The computer chip that would implement the Skipjack encryption scheme. See also EPIC's The Clipper Chip Web page. + +
Escrowed Encryption Standard (EES) +Largely unused, a controversial +crypto scheme employing the SKIPJACK secret key crypto algorithm and a +Law Enforcement Access Field (LEAF) creation method. LEAF was one part +of the key escrow system and allowed for decryption of ciphertext +messages that had been legally intercepted by law enforcement agencies. +Described more in FIPS 185. + +
Federal Information Processing Standards (FIPS) +These computer security- and +crypto-related FIPS are produced by the U.S. National Institute of +Standards and Technology (NIST) as standards for the U.S. Government. +
Fortezza (formerly called Tessera) +A PCMCIA card developed by NSA that +implements the Capstone algorithms, intended for use with the Defense +Messaging Service (DMS). + +
IP Security Protocol (IPsec) +The IPsec protocol suite is used to +provide privacy and authentication services at the IP layer. An +overview of the protocol suite and of the documents comprising IPsec +can be found in RFC 2411. Other documents include: +
    +
  • RFC 2401: IP security architecture. +
  • RFC 2402: +IP Authentication Header (AH), one of the two primary IPsec functions; +AH provides connectionless integrity and data origin authentication for +IP datagrams and protects against replay attacks. +
  • RFC 2403: Describes use of the HMAC with MD5 algorithm for data origin authentication and integrity protection in both AH and ESP. +
  • RFC 2404: Describes use of the HMAC with SHA-1 algorithm for data origin authentication and integrity protection in both AH and ESP. +
  • RFC 2405: Describes use of DES-CBC (DES in Cipher Block Chaining Mode) for confidentiality in ESP. +
  • RFC 2406: +IP Encapsulating Security Payload (ESP), the other primary IPsec +function; ESP provides a variety of security services within IPsec. +
  • RFC 2407: Describes the application of ISAKMP to IPsec. +
  • RFC 2408: Describes ISAKMP, a framework for key management and security associations. +
  • RFC 2409: +The Internet Key Exchange (IKE) algorithm, using part of Oakley and +part of SKEME in conjunction with ISAKMP to obtain authenticated keying +material for use with ISAKMP, and for other security associations such +as AH and ESP. +
  • RFC 2410: Defines use of the NULL encryption algorithm (i.e., provides authentication and integrity without confidentiality) in ESP. +
  • RFC 2412: Describes OAKLEY, a key determination and distribution protocol. +
  • RFC 2451: Describes use of Cipher Block Chaining (CBC) mode cipher algorithms with ESP. +
  • RFCs 2522 and 2523: Description of Photuris, a session-key management protocol for IPsec. +
+

+IPsec was first proposed for use with IP version 6 (IPv6), but can also be employed with the current IP version, IPv4. +

+(See more detail about IPsec below in Section 5.6.) + +

Internet Security Association and Key Management Protocol (ISAKMP/OAKLEY) +ISAKMP/OAKLEY provide an infrastructure for Internet secure communications. ISAKMP, designed by the National Security Agency (NSA) and described in RFC 2408, +is a framework for key management and security associations, +independent of the key generation and cryptographic algorithms actually +employed. The OAKLEY Key Determination Protocol, described in RFC 2412, is a key determination and distribution protocol using a variation of Diffie-Hellman. + +
Kerberos +A secret-key encryption and +authentication system, designed to authenticate requests for network +resources within a user domain rather than to authenticate messages. +Kerberos also uses a trusted third-party approach; a client +communications with the Kerberos server to obtain "credentials" so that +it may access services at the application server. Kerberos V4 uses DES +to generate keys and encrypt messages; DES is also commonly used in +Kerberos V5, although other schemes could be employed. +

Microsoft added support for Kerberos V5 — with some proprietary +extensions — in Windows 2000. There are many Kerberos articles posted +at Microsoft's Knowledge Base, notably "Basic Overview of Kerberos User Authentication Protocol in Windows 2000," "Windows 2000 Kerberos 5 Ticket Flags and KDC Options for AS_REQ and TGS_REQ Messages," and "Kerberos Administration in Windows 2000." + +

Keyed-Hash Message Authentication Code (HMAC) +A message authentication scheme based +upon secret key cryptography and the secret key shared between two +parties rather than public key methods. Described in FIPS 198 and RFC 2104. + +
Message Digest Cipher (MDC) +Invented by Peter Gutman, MDC turns a one-way hash function into a block cipher. + +
MIME Object Security Standard (MOSS) +Designed as a successor to PEM to provide PEM-based security services to MIME messages. + +
Pretty Good Privacy (PGP) +A family of cryptographic routines +for e-mail and file storage applications developed by Philip +Zimmermann. PGP 2.6.x uses RSA for key management and digital +signatures, IDEA for message encryption, and MD5 for computing the +message's hash value; more information can also be found in RFC 1991. +PGP 5.x (formerly known as "PGP 3") uses Diffie-Hellman/DSS for key +management and digital signatures; IDEA, CAST, or 3DES for message +encryption; and MD5 or SHA for computing the message's hash value. +OpenPGP, described in RFC 2440, is an open definition of security software based on PGP 5.x. +

+(See more detail about PGP below in Section 5.5.) + +

Privacy Enhanced Mail (PEM) +Provides secure electronic mail over +the Internet and includes provisions for encryption (DES), +authentication, and key management (DES, RSA). May be superseded by +S/MIME and PEM-MIME. Developed by IETF PEM Working Group and defined in +four RFCs: +
  • RFC 1421: Part I, Message Encryption and Authentication Procedures +
  • RFC 1422: Part II, Certificate-Based Key Management +
  • RFC 1423: Part III, Algorithms, Modes, and Identifiers +
  • RFC 1424: Part IV, Key Certification and Related Services + + +
    • Private Communication Technology (PCT) +Developed by Microsoft and Visa for +secure communication on the Internet. Similar to SSL, PCT supports +Diffie-Hellman, Fortezza, and RSA for key establishment; DES, RC2, RC4, +and triple-DES for encryption; and DSA and RSA message signatures. A +companion to SET. +
    Secure Electronic Transactions (SET) +A merging of two other protocols: +SEPP (Secure Electronic Payment Protocol), an open specification for +secure bank card transactions over the Internet, developed by +CyberCash, GTE, IBM, MasterCard, and Netscape; and STT (Secure +Transaction Technology), a secure payment protocol developed by +Microsoft and Visa International. Supports DES and RC4 for encryption, +and RSA for signatures, key exchange, and public-key encryption of bank +card numbers. SET is a companion to the PCT protocol. +
    Secure Hypertext Transfer Protocol (S-HTTP) +An extension to HTTP to provide +secure exchange of documents over the World Wide Web. Supported +algorithms include RSA and Kerberos for key exchange, DES, IDEA, RC2, +and Triple-DES for encryption. +
    Secure Multipurpose Internet Mail Extensions (S/MIME) +An IETF secure e-mail scheme intended to supercede PEM. S/MIME, described in RFCs 2311 and 2312, adds digital signature and encryption capability to Internet MIME messages. + +
    Secure Sockets Layer (SSL) +Developed by Netscape Communications +to provide application-independent security and privacy over the +Internet. SSL is designed so that protocols such as HTTP, FTP (File +Transfer Protocol), and Telnet can operate over it transparently. SSL +allows both server authentication (mandatory) and client authentication +(optional). RSA is used during negotiation to exchange keys and +identify the actual cryptographic algorithm (DES, IDEA, RC2, RC4, or +3DES) to use for the session. SSL also uses MD5 for message digests and +X.509 public-key certificates. (Found to be breakable soon after the +IETF announced formation of group to work on TLS.) +

    +(See more detail about SSL below in Section 5.7.) + +

    Server Gated Cryptography (SGC) +Microsoft extension to SSL that +provides strong encryption for online banking and other financial +applications using RC2 (128-bit key), RC4 (128-bit key), DES (56-bit +key), or 3DES (equivalent of 168-bit key). Use of SGC requires a +Windows NT Server running Internet Information Server (IIS) 4.0 with a +valid SGC certificate. SGC is available in 32-bit Windows versions of +Internet Explorer (IE) 4.0, and support for Mac, Unix, and 16-bit +Windows versions of IE is expected in the future. +
    Simple Key-Management for Internet Protocol (SKIP) +Key management scheme for secure IP +communication, specifically for IPsec, and designed by Aziz and Diffie. +SKIP essentially defines a public key infrastructure for the Internet +and even uses X.509 certificates. Most public key cryptosystems assign +keys on a per-session basis, which is inconvenient for the Internet +since IP is connectionless. Instead, SKIP provides a basis for secure +communication between any pair of Internet hosts. SKIP can employ DES, +3DES, IDEA, RC2, RC5, MD5, and SHA-1. +
    Transport Layer Security (TLS) +IETF specification (RFC 2246) +intended to replace SSL. Employs Triple-DES (secret key cryptography), +SHA (hash), Diffie-Hellman (key exchange), and DSS (digital +signatures). +

    +(See more detail about TLS below in Section 5.7.) + +

    X.509 +ITU-T recommendation for the format +of certificates for the public key infrastructure. Certificates map +(bind) a user identity to a public key. The IETF application of X.509 +certificates is documented in RFC 2459. An Internet X.509 Public Key Infrastructure is further defined in RFC 2510 (Certificate Management Protocols) and RFC 2527 (Certificate Policy and Certification Practices Framework). +
    + +

    +

    5.1. Password Protection

     +

    +Nearly all modern multiuser computer and network +operating systems employ passwords at the very least to protect and +authenticate users accessing computer and/or network resources. But +passwords are not typically kept on a host or server in plaintext, but are generally encrypted using some sort of hash scheme.

    + +
    +
    + +
    +
    A) /etc/passwd file
+
+ root:Jbw6BwE4XoUHo:0:0:root:/root:/bin/bash
+ carol:FM5ikbQt1K052:502:100:Carol Monaghan:/home/carol:/bin/bash
+ alex:LqAi7Mdyg/HcQ:503:100:Alex Insley:/home/alex:/bin/bash
+ gary:FkJXupRyFqY4s:501:100:Gary Kessler:/home/gary:/bin/bash
+ todd:edGqQUAaGv7g6:506:101:Todd Pritsky:/home/todd:/bin/bash
+ josh:FiH0ONcjPut1g:505:101:Joshua Kessler:/home/webroot:/bin/bash
+
+B.1) /etc/passwd file (with shadow passwords)
+
+ root:x:0:0:root:/root:/bin/bash
+ carol:x:502:100:Carol Monaghan:/home/carol:/bin/bash
+ alex:x:503:100:Alex Insley:/home/alex:/bin/bash
+ gary:x:501:100:Gary Kessler:/home/gary:/bin/bash
+ todd:x:506:101:Todd Pritsky:/home/todd:/bin/bash
+ josh:x:505:101:Joshua Kessler:/home/webroot:/bin/bash
+
+B.2) /etc/shadow file
+
+ root:AGFw$1$P4u/uhLK$l2.HP35rlu65WlfCzq:11449:0:99999:7:::
+ carol:kjHaN%35a8xMM8a/0kMl1?fwtLAM.K&kw.:11449:0:99999:7:::
+ alex:1$1KKmfTy0a7#3.LL9a8H71lkwn/.hH22a:11449:0:99999:7:::
+ gary:9ajlknknKJHjhnu7298ypnAIJKL$Jh.hnk:11449:0:99999:7:::
+ todd:798POJ90uab6.k$klPqMt%alMlprWqu6$.:11492:0:99999:7:::
+ josh:Awmqpsui*787pjnsnJJK%aappaMpQo07.8:11492:0:99999:7:::
+
    +

    +

    FIGURE 5: Sample entries in Unix/Linux password files.

    +
    +
    + +

    +Unix/Linux, for example, uses a well-known hash via its crypt() function. Passwords are stored in the /etc/passwd +file (Figure 5A); each record in the file contains the username, hashed +password, user's individual and group numbers, user's name, home +directory, and shell program; these fields are separated by colons (:). +Note that each password is stored as a 13-byte string. The first two +characters are actually a salt, randomness added to each +password so that if two users have the same password, they will still +be encrypted differently; the salt, in fact, provides a means so that a +single password might have 4096 different encryptions. The remaining 11 +bytes are the password hash, calculated using DES.

    +

    +As it happens, the /etc/passwd file is +world-readable on Unix systems. This fact, coupled with the weak +encryption of the passwords, resulted in the development of the shadow password +system where passwords are kept in a separate, non-world-readable file +used in conjunction with the normal password file. When shadow +passwords are used, the password entry in /etc/passwd is replaced with a "*" or "x" (Figure 5B.1) and the MD5 hash of the passwords are stored in /etc/shadow along with some other account information (Figure 5B.2).

    +
    +

    +Windows NT uses a similar scheme to store passwords in +the Security Access Manager (SAM) file. In the NT case, all passwords +are hashed using the MD4 algorithm, resulting in a 128-bit (16-byte) +hash value (they are then obscured using an undocumented mathematical transformation that was a secret until distributed on the Internet). The password password, for example, might be stored as the hash value (in hexadecimal) 60771b22d73c34bd4a290a79c8b09f18.

    +

    +Passwords are not saved in plaintext on computer systems +precisely so they cannot be easily compromised. For similar reasons, we +don't want passwords sent in plaintext across a network. But for remote +logon applications, how does a client system identify itself or a user +to the server? One mechanism, of course, is to send the password as a +hash value and that, indeed, may be done. A weakness of that approach, +however, is that an intruder can grab the password off of the network +and use an off-line attack (such as a dictionary attack where +an attacker takes every known word and encrypts it with the network's +encryption algorithm, hoping eventually to find a match with a +purloined password hash). In some situations, an attacker only has to +copy the hashed password value and use it later on to gain unauthorized +entry without ever learning the actual password.

    +

    +An even stronger authentication method uses the password +to modify a shared secret between the client and server, but never +allows the password in any form to go across the network. This is the +basis for the Challenge Handshake Authentication Protocol (CHAP), the +remote logon process used by Windows NT.

    +

    +As suggested above, Windows NT passwords are stored in a +security file on a server as a 16-byte hash value. In truth, Windows NT +stores two hashes; a weak hash based upon the old LAN Manager +(LanMan) scheme and the newer NT hash. When a user logs on to a server +from a remote workstation, the user is identified by the username, sent +across the network in plaintext (no worries here; it's not a secret +anyway!). The server then generates a 64-bit random number and sends it +to the client (also in plaintext). This number is the challenge.

    +

    +Using the LanMan scheme, the client system then encrypts +the challenge using DES. Recall that DES employs a 56-bit key, acts on +a 64-bit block of data, and produces a 64-bit output. In this case, the +64-bit data block is the random number. The client actually uses three +different DES keys to encrypt the random number, producing three +different 64-bit outputs. The first key is the first seven bytes (56 +bits) of the password's hash value, the second key is the next seven +bytes in the password's hash, and the third key is the remaining two +bytes of the password's hash concatenated with five zero-filled bytes. +(So, for the example above, the three DES keys would be 60771b22d73c34, bd4a290a79c8b0, and 9f180000000000.) Each key is applied to the random number resulting in three 64-bit outputs, which comprise the response. +Thus, the server's 8-byte challenge yields a 24-byte response from the +client and this is all that would be seen on the network. The server, +for its part, does the same calculation to ensure that the values match.

    +

    +There is, however, a significant weakness to this +system. Specifically, the response is generated in such a way as to +effectively reduce 16-byte hash to three smaller hashes, of length +seven, seven, and two. Thus, a password cracker has to break at most a +7-byte hash. One Windows NT vulnerability test program that I have used +in the past will report passwords that are "too short," defined as +"less than 8 characters." When I asked how the program knew that +passwords were too short, the software's salespeople suggested to me +that the program broke the passwords to determine their length. This is +undoubtedly not true; all the software really has to do is look at the +second 7-byte block and some known value indicates that it is empty, +which would indicate a password of seven or less characters.

    +

    +Consider the following example, showing the LanMan hash +of two different short passwords (take a close look at the last 8 +bytes):

    + + + + +
    AA: +89D42A44E77140AAAAD3B435B51404EE +
    AAA: +1C3A2B6D939A1021AAD3B435B51404EE +
    + +

    +Note that the NT hash provides no such clue:

    + + + + +
    AA: +C5663434F963BE79C8FD99F535E7AAD8 +
    AAA: +6B6E0FB2ED246885B98586C73B5BFB77 +
    + +

    +It is worth noting that the discussion above describes the Microsoft version of CHAP, or MS-CHAP (MS-CHAPv2 is described in RFC 2759). +MS-CHAP assumes that it is working with hashed values of the password +as the key to encrypting the challenge. More traditional CHAP (RFC 1994) +assumes that it is starting with passwords in plaintext. The relevance +of this observation is that a CHAP client, for example, cannot be +authenticated by an MS-CHAP server; both client and server must use the +same CHAP version.

    + +

    5.2. Some of the Finer Details of Diffie-Hellman

     +

    +The first published public-key crypto algorithm was +Diffie-Hellman. The mathematical "trick" of this scheme is that it is +relatively easy to compute exponents compared to computing discrete +logarithms. Diffie-Hellman allows two parties — the ubiquitous Alice +and Bob — to generate a secret key; they need to exchange some +information over an unsecure communications channel to perform the +calculation but an eavesdropper cannot determine the shared key based +upon this information.

    +

    +Diffie-Hellman works like this. Alice and Bob start by agreeing on a large prime number, n. They also have to choose some number g so that g<n.

    +

    +There is actually another constraint on g, specifically that it must be primitive with respect to n. Primitive is a definition that is a little beyond the scope of our discussion but basically g is primitive to n if we can find integers i so that gi += j mod n for all values of j from 1 to n-1. As an example, 2 is not +primitive to 7 because the set of powers of 2 from 1 to 6, mod 7 = +{2,4,1,2,4,1}. On the other hand, 3 is primitive to 7 because the set +of powers of 3 from 1 to 6, mod 7 = {3,2,6,4,5,1}.

    +

    +(The definition of primitive introduced a new term to some readers, namely mod. The phrase x mod y (and read as written!) means "take the remainder after dividing x by y." Thus, 1 mod 7 = 1, 9 mod 6 = 3, and 8 mod 8 = 0.)

    +

    +Anyway, either Alice or Bob selects n and g; they then +tell the other party what the values are. Alice and Bob then work +independently:

    + +
    + + +
    +
    Alice...

    +Choose a large random number, x
    +Send to Bob: X = gx mod n
    +Compute: KA = Yx mod n
    +    		 +
    Bob...

    +Choose a large random number, y
    +Send to Alice: Y = gy mod n
    +Compute: KB = Xy mod n
    +
    +
    + +

    +Note that x and y are kept secret while X +and Y are openly shared; these are the private and public keys, +respectively. Based on their own private key and the public key learned +from the other party, Alice and Bob have computed their secret keys, KA and KB, respectively, which are equal to gxy mod n.

    +

    +Perhaps a small example will help here. Although Alice +and Bob will really choose large values for n and g, I will use small +values for example only; let's use n=7 and g=3.

    + +
    + + +
    +
    Alice...

    +Choose x=2
    +Send to Bob: X = 32 mod 7 = 2
    +KA = 62 mod 7 = 1
    +    		 +
    Bob...

    +Choose y=3
    +Send to Alice: Y = 33 mod 7 = 6
    +KB = 23 mod 7 = 1
    +
    +
    + +

    +In this example, then, Alice and Bob will both find the secret key 1 which is, indeed, 36 +mod 7. If an eavesdropper (Mallory) was listening in on the information +exchange between Alice and Bob, he would learn g, n, X, and Y which is +a lot of information but insufficient to compromise the key; as long as +x and y remain unknown, K is safe. As said above, calculating X as gx is a lot easier than finding x as logg X!

    +
    +

    +A short digression on modulo arithmetic. In the paragraph above, we noted that 36 mod 7 = 1. This can be confirmed, of course, by noting that:

    +

    +36 = 729 = 104*7 + 1

    +

    +There is a nice property of modulo arithmetic, however, +that makes this determination a little easier, namely: (a mod x)(b mod +x) = (ab mod x). Therefore, one possible shortcut is to note that 36 = (33)(33). Therefore, 36 mod 7 = (33 mod 7)(33 mod 7) = (27 mod 7)(27 mod 7) = 6*6 mod 7 = 36 mod 7 = 1.

    +
    +

    +Diffie-Hellman can also be used to allow key sharing +amongst multiple users. Note again that the Diffie-Hellman algorithm is +used to generate secret keys, not to encrypt and decrypt messages.

    + +

    5.3. Some of the Finer Details of RSA Public-Key Cryptography

     +

    +Unlike Diffie-Hellman, RSA can be used for key exchange +as well as digital signatures and the encryption of small blocks of +data. Today, RSA is primary used to encrypt the session key used for +secret key encryption (message integrity) or the message's hash value +(digital signature). RSA's mathematical hardness comes from the ease in +calculating large numbers and the difficulty in finding the prime +factors of those large numbers. Although employed with numbers using +hundreds of digits, the math behind RSA is relatively straight-forward.

    +

    +To create an RSA public/private key pair, here are the basic steps:

    +
      +
    1. Choose two prime numbers, p and q. From these numbers you can calculate the modulus, n = pq. +
    2. Select a third number, e, that is relatively prime to (i.e., +it does not divide evenly into) the product (p-1)(q-1). The number e is +the public exponent. +
    3. Calculate an integer d from the quotient (ed-1)/[(p-1)(q-1)]. The number d is the private exponent. +
    +

    +The public key is the number pair (n,e). Although these +values are publicly known, it is computationally infeasible to +determine d from n and e if p and q are large enough.

    +

    +To encrypt a message, M, with the public key, create the ciphertext, C, using the equation:

    +
      +C = Me mod n +
    +

    +The receiver then decrypts the ciphertext with the private key using the equation:

    +
      +M = Cd mod n +
    +

    +Now, this might look a bit complex and, indeed, the +mathematics does take a lot of computer power given the large size of +the numbers; since p and q may be 100 digits (decimal) or more, d and e +will be about the same size and n may be over 200 digits. Nevertheless, +a simple example may help. In this example, the values for p, q, e, and +d are purposely chosen to be very small and the reader will see exactly +how badly these values perform, but hopefully the algorithm will be +adequately demonstrated:

    +
      +
    1. Select p=3 and q=5. +
    2. The modulus n = pq = 15. +
    3. The value e must be relatively prime to (p-1)(q-1) = (2)(4) = 8. Select e=11 +
    4. The value d must be chosen so that (ed-1)/[(p-1)(q-1)] is an +integer. Thus, the value (11d-1)/[(2)(4)] = (11d-1)/8 must be an +integer. Calculate one possible value, d=3. +
    5. Let's say we wish to send the string SECRET. For this +example, we will convert the string to the decimal representation of +the ASCII values of the characters, which would be 83 69 67 82 69 84. +
    6. The sender encrypts each digit one at a time (we have to +because the modulus is so small) using the public key value +(e,n)=(11,15). Thus, each ciphertext character Ci = Mi11 mod 15. The input digit string 0x836967826984 will be transmitted as 0x2c696d286924. +
    7. The receiver decrypts each digit using the private key value (d,n)=(3,15). Thus, each plaintext character Mi = Ci3 mod 15. The input digit string 0x2c696d286924 will be converted to 0x836967826984 and, presumably, reassembled as the plaintext string SECRET. +
    +

    +Again, the example above uses small values for +simplicity and, in fact, shows the weakness of small values; note that +4, 6, and 9 do not change when encrypted, and that the values 2 and 8 +encrypt to 8 and 2, respectively. Nevertheless, this simple example +demonstrates how RSA can be used to exchange information.

    + +

    +RSA keylengths of 512 and 768 bits are considered to be +pretty weak. The minimum suggested RSA key is 1024 bits; 2048 and 3072 +bits are even better.

    + +

    +As an aside, Adam Back (http://www.cypherspace.org/~adam/) wrote a two-line Perl script to implement RSA. It employs dc, an arbitrary precision arithmetic package that ships with most UNIX systems:

    + + +
    +
    print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
+)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`
+
    +
    + +

    5.4. Some of the Finer Details of DES, Breaking DES, and DES Variants

     +

    +The Data Encryption Standard (DES) has been in use since +the mid-1970s, adopted by the National Bureau of Standards (NBS) [now +the National Institute for Standards and Technology (NIST)] as Federal +Information Processing Standard 46 (FIPS 46-3) and by the American National Standards Institute (ANSI) as X3.92.

    +

    +As mentioned earlier, DES uses the Data Encryption +Algorithm (DEA), a secret key block-cipher employing a 56-bit key +operating on 64-bit blocks. FIPS 81 +describes four modes of DES operation: Electronic Codebook (ECB), +Cipher Block Chaining (CBC), Cipher Feedback (CFB), and Output Feedback +(OFB). Despite all of these options, ECB is the most commonly deployed +mode of operation.

    +

    +Although other block ciphers will replace DES, it is +still interesting to see how DES encryption is performed. Not only is +it sort of interesting, but DES remains in many products and we will +continue to see DES for some years to come.

    + +

    DES Operational Overview

    +

    +DES uses a 56-bit key. In fact, the 56-bit key is +divided into eight 7-bit blocks and an 8th odd parity bit is added to +each block (i.e., a "0" or "1" is added to the block so that there are +an odd number of 1 bits in each 8-bit block). By using the 8 parity +bits for rudimentary error detection, a DES key is actually 64 bits in +length for computational purposes (although it only has 56 bits worth +of randomness, or entropy).

    + +
    +
    + +

    +

    FIGURE 6: DES enciphering algorithm.

    +
    +
    +
    +

    +DES then acts on 64-bit blocks of the +plaintext, invoking 16 rounds of permutations, swaps, and substitutes, +as shown in Figure 6. The standard includes tables describing all of +the selection, permutation, and expansion operations mentioned below; +these aspects of the algorithm are not secrets. The basic DES steps are:

    +
      +
    1. The 64-bit block to be encrypted +undergoes an initial permutation (IP), where each bit is moved to a new +bit position; e.g., the 1st, 2nd, and 3rd bits are moved to the 58th, +50th, and 42nd position, respectively.

      +
    2. The 64-bit permuted input is divided into two 32-bit blocks, called left and right, respectively. The initial values of the left and right blocks are denoted L0 and R0.

      +
    3. There are then 16 rounds of operation on the L and R blocks. During each iteration (where n ranges from 1 to 16), the following formulae apply: + +At any given step in the process, then, the new L block +value is merely taken from the prior R block value. The new R block is +calculated by taking the bit-by-bit exclusive-OR (XOR) of the prior L +block with the results of applying the DES cipher function, f, to the prior R block and Kn. (Kn +is a 48-bit value derived from the 64-bit DES key. Each round uses a +different 48 bits according to the standard's Key Schedule algorithm.) +

      +The cipher function, f, combines the 32-bit R block +value and the 48-bit subkey in the following way. First, the 32 bits in +the R block are expanded to 48 bits by an expansion function (E); the +extra 16 bits are found by repeating the bits in 16 predefined +positions. The 48-bit expanded R-block is then ORed with the 48-bit +subkey. The result is a 48-bit value that is then divided into eight +6-bit blocks. These are fed as input into 8 selection (S) boxes, +denoted S1,...,S8. Each 6-bit input yields a +4-bit output using a table lookup based on the 64 possible inputs; this +results in a 32-bit output from the S-box. The 32 bits are then +rearranged by a permutation function (P), producing the results from +the cipher function. +

      +

    4. The results from the final DES round — i.e., L16 and R16 — are recombined into a 64-bit value and fed into an inverse initial permutation (IP-1). +At this step, the bits are rearranged into their original positions, so +that the 58th, 50th, and 42nd bits, for example, are moved back into +the 1st, 2nd, and 3rd positions, respectively. The output from IP-1 is the 64-bit ciphertext block. +
    +

    +Consider this example with the given 56-bit key and input:

    + + +

    Breaking DES

    +

    +The mainstream cryptographic community +has long held that DES's 56-bit key was too short to withstand a +brute-force attack from modern computers. Remember Moore's Law: +computer power doubles every 18 months. Given that increase in power, a +key that could withstand a brute-force guessing attack in 1975 could +hardly be expected to withstand the same attack a quarter century later.

    +

    +DES is even more vulnerable to a +brute-force attack because it is often used to encrypt words, meaning +that the entropy of the 64-bit block is, effectively, greatly reduced. +That is, if we are encrypting random bit streams, then a given byte +might contain any one of 28 (256) possible values and the entire 64-bit block has 264, +or about 18.5 quintillion, possible values. If we are encrypting words, +however, we are most likely to find a limited set of bit patterns; +perhaps 70 or so if we account for upper and lower case letters, the +numbers, space, and some punctuation. This means that only about � of the bit combinations of a given byte are likely to occur.

    +

    +Despite this criticism, the U.S. +government insisted throughout the mid-1990s that 56-bit DES was secure +and virtually unbreakable if appropriate precautions were taken. In +response, RSA Laboratories sponsored a series of cryptographic challenges to prove that DES was no longer appropriate for use.

    +

    +DES Challenge I was launched in March 1997. It was +completed in 84 days by R. Verser in a collaborative effort using +thousands of computers on the Internet.

    +

    +The first DES II challenge lasted 40 days in early 1998. This problem was solved by distributed.net, +a worldwide distributed computing network using the spare CPU cycles of +computers around the Internet (participants in distributed.net's +activities load a client program that runs in the background, +conceptually similar to the SETI @Home "Search for Extraterrestrial +Intelligence" project). The distributed.net systems were checking 28 billion keys per second by the end of the project.

    +

    +The second DES II challenge lasted less than 3 days. On +July 17, 1998, the Electronic Frontier Foundation (EFF) announced the +construction of hardware that could brute-force a DES key in an average +of 4.5 days. Called Deep Crack, the device could check 90 billion keys +per second and cost only about $220,000 including design (it was +erroneously and widely reported that subsequent devices could be built +for as little as $50,000). Since the design is scalable, this suggests +that an organization could build a DES cracker that could break 56-bit +keys in an average of a day for as little as $1,000,000. Information +about the hardware design and all software can be obtained from the EFF.

    +

    +The DES III challenge, launched in January 1999, was +broken is less than a day by the combined efforts of Deep Crack and +distributed.net. This is widely considered to have been the final nail +in DES's coffin.

    +

    +The Deep Crack algorithm is actually quite interesting. +The general approach that the DES Cracker Project took was not to break +the algorithm mathematically but instead to launch a brute-force attack +by guessing every possible key. A 56-bit key yields 256, or +about 72 quadrillion, possible values. So the DES cracker team looked +for any shortcuts they could find! First, they assumed that some +recognizable plaintext would appear in the decrypted string even though +they didn't have a specific known plaintext block. They then applied +all 256 possible key values to the 64-bit block (I don't +mean to make this sound simple!). The system checked to see if the +decrypted value of the block was "interesting," which they defined as +bytes containing one of the alphanumeric characters, space, or some +punctuation. Since the likelihood of a single byte being "interesting" +is about �, then the likelihood of the entire 8-byte stream being +"interesting" is about �8, or 1/65536 (�16). This dropped the number of possible keys that might yield positive results to about 240, or about a trillion.

    +

    +They then made the assumption that an "interesting" +8-byte block would be followed by another "interesting" block. So, if +the first block of ciphertext decrypted to something interesting, they +decrypted the next block; otherwise, they abandoned this key. Only if +the second block was also "interesting" did they examine the key +closer. Looking for 16 consecutive bytes that were "interesting" meant +that only 224, or 16 million, keys needed to be examined +further. This further examination was primarily to see if the text made +any sense. Note that possible "interesting" blocks might be 1hJ5&aB7 or DEPOSITS; +the latter is more likely to produce a better result. And even a slow +laptop today can search through lists of only a few million items in a +relatively short period of time. (Interested readers are urged to read Cracking DES and EFF's Cracking DES page.)

    +

    +It is well beyond the scope of this paper to discuss +other forms of breaking DES and other codes. Nevertheless, it is worth +mentioning a couple of forms of cryptanalysis that have been shown to +be effective against DES. Differential cryptanalysis, invented +in 1990 by E. Biham and A. Shamir (of RSA fame), is a chosen-plaintext +attack. By selecting pairs of plaintext with particular differences, +the cryptanalyst examines the differences in the resultant ciphertext +pairs. Linear plaintext, invented by M. Matsui, uses a linear +approximation to analyze the actions of a block cipher (including DES). +Both of these attacks can be more efficient than brute force.

    + +

    DES Variants

    +

    +Once DES was "officially" broken, several variants +appeared. But none of them came overnight; work at hardening DES had +already been underway. In the early 1990s, there was a proposal to +increase the security of DES by effectively increasing the key length +by using multiple keys with multiple passes. But for this scheme to +work, it had to first be shown that the DES function is not a group, +as defined in mathematics. If DES was a group, then we could show that +for two DES keys, X1 and X2, applied to some plaintext (P), we can find +a single equivalent key, X3, that would provide the same result; i.e.,:

    +

    +EX2(EX1(P)) = EX3(P)

    +

    +where EX(P) represents DES encryption of some plaintext P using DES key X. +If DES were a group, it wouldn't matter how many keys and passes we +applied to some plaintext; we could always find a single 56-bit key +that would provide the same result.

    +

    +As it happens, DES was proven to not be a group so that +as we apply additional keys and passes, the effective key length +increases. One obvious choice, then, might be to use two keys and two +passes, yielding an effective key length of 112 bits. Let's call this +Double-DES. The two keys, Y1 and Y2, might be applied as follows:

    +

    +C = EY2(EY1(P))
    +P = DY1(DY2(C))

    +

    +where EY(P) and DY(C) represent DES encryption and decryption, respectively, of some plaintext P and ciphertext C, respectively, using DES key Y.

    +

    +So far, so good. But there's an interesting attack that +can be launched against this "Double-DES" scheme. First, notice that +the applications of the formula above can be thought of with the +following individual steps (where C' and P' are intermediate results):

    +

    +C' = EY1(P) and C = EY2(C')
    +P' = DY2(C) and P = DY1(P')

    +

    +Unfortunately, C'=P'. That leaves us vulnerable to a simple known plaintext +attack (sometimes called "Meet-in-the-middle") where the attacker knows +some plaintext (P) and its matching ciphertext (C). To obtain C', the +attacker needs to try all 256 possible values of Y1 applied to P; to obtain P', the attacker needs to try all 256 possible values of Y2 applied to C. Since C'=P', the attacker knows when a match has been achieved — after only 256 + 256 = 257 key searches, only twice the work of brute-forcing DES. So "Double-DES" won't work.

    +

    +Triple-DES (3DES), based upon the Triple Data Encryption Algorithm (TDEA), is described in FIPS 46-3. +3DES, which is not susceptible to a meet-in-the-middle attack, employs +three DES passes and one, two, or three keys called K1, K2, and K3. +Generation of the ciphertext (C) from a block of plaintext (P) is +accomplished by:

    +

    +C = EK3(DK2(EK1(P)))

    +

    +where EK(P) and DK(P) represent DES encryption and decryption, respectively, of some plaintext P using DES key K. (For obvious reasons, this is sometimes referred to as an encrypt-decrypt-encrypt mode operation.)

    +

    +Decryption of the ciphertext into plaintext is accomplished by:

    +

    +P = DK1(EK2(DK3(C)))

    +

    +The use of three, independent 56-bit keys provides 3DES +with an effective key length of 168 bits. The specification also +defines use of two keys where, in the operations above, K3 = K1; this +provides an effective key length of 112 bits. Finally, a third keying +option is to use a single key, so that K3 = K2 = K1 (in this case, the +effective key length is 56 bits and 3DES applied to some plaintext, P, +will yield the same ciphertext, C, as normal DES would with that same +key). Given the relatively low cost of key storage and the modest +increase in processing due to the use of longer keys, the best +recommended practices are that 3DES be employed with three keys.

    +

    +Another variant of DES, called DESX, is due to Ron +Rivest. Developed in 1996, DESX is a very simple algorithm that greatly +increases DES's resistance to brute-force attacks without increasing +its computational complexity. In DESX, the plaintext input is XORed +with 64 additional key bits prior to encryption and the output is +likewise XORed with the 64 key bits. By adding just two XOR operations, +DESX has an effective keylength of 120 bits against an exhaustive +key-search attack. As it happens, DESX is no more immune to other types +of more sophisticated attacks, such as differential or linear +cryptanalysis, but brute-force is the primary attack vector on DES.

    + +

    5.5. Pretty Good Privacy (PGP)

     +

    +Pretty Good Privacy (PGP) is one of today's most widely used public key cryptography programs. Developed by Philip Zimmermann +in the early 1990s and long the subject of controversy, PGP is +available as a plug-in for many e-mail clients, such as Claris Emailer, +Microsoft Outlook/Outlook Express, and Qualcomm Eudora.

    +

    +PGP can be used to sign or encrypt e-mail messages with +the mere click of the mouse. Depending upon the version of PGP, the +software uses SHA or MD5 for calculating the message hash; CAST, +Triple-DES, or IDEA for encryption; and RSA or DSS/Diffie-Hellman for +key exchange and digital signatures.

    +

    +When PGP is first installed, the user has to create a +key-pair. One key, the public key, can be advertised and widely +circulated. The private key is protected by use of a passphrase. The passphrase has to be entered every time the user accesses their private key.

    + +
    +
    + +
    +
    + -----BEGIN PGP SIGNED MESSAGE-----
+ Hash: SHA1
+
+ Hi Carol.
+
+ What was that pithy Groucho Marx quote?
+
+ /kess
+
+ -----BEGIN PGP SIGNATURE-----
+ Version: PGP for Personal Privacy 5.0
+ Charset: noconv
+
+ iQA/AwUBNFUdO5WOcz5SFtuEEQJx/ACaAgR97+vvDU6XWELV/GANjAAgBtUAnjG3
+ Sdfw2JgmZIOLNjFe7jP0Y8/M
+ =jUAU
+ -----END PGP SIGNATURE-----
+
    +

    +

    FIGURE 7: A PGP signed message. The sender uses their private +key; at the destination, the sender's e-mail address yields the public +key from the receiver's keyring.

    +
    +
    + +
    +

    +Figure 7 shows a PGP signed message. This message will +not be kept secret from an eavesdropper, but a recipient can be assured +that the message has not been altered from what the sender transmitted. +In this instance, the sender signs the message using their own private +key. The receiver uses the sender's public key to verify the signature; +the public key is taken from the receiver's keyring based on the +sender's e-mail address. Note that the signature process does not work +unless the sender's public key is on the receiver's keyring.

    + +
    +
    + +
    +
    +-----BEGIN PGP MESSAGE-----
+Version: PGP for Personal Privacy 5.0
+MessageID: DAdVB3wzpBr3YRunZwYvhK5gBKBXOb/m
+
+qANQR1DBwU4D/TlT68XXuiUQCADfj2o4b4aFYBcWumA7hR1Wvz9rbv2BR6WbEUsy
+ZBIEFtjyqCd96qF38sp9IQiJIKlNaZfx2GLRWikPZwchUXxB+AA5+lqsG/ELBvRa
+c9XefaYpbbAZ6z6LkOQ+eE0XASe7aEEPfdxvZZT37dVyiyxuBBRYNLN8Bphdr2zv
+z/9Ak4/OLnLiJRk05/2UNE5Z0a+3lcvITMmfGajvRhkXqocavPOKiin3hv7+Vx88
+uLLem2/fQHZhGcQvkqZVqXx8SmNw5gzuvwjV1WHj9muDGBY0MkjiZIRI7azWnoU9
+3KCnmpR60VO4rDRAS5uGl9fioSvze+q8XqxubaNsgdKkoD+tB/4u4c4tznLfw1L2
+YBS+dzFDw5desMFSo7JkecAS4NB9jAu9K+f7PTAsesCBNETDd49BTOFFTWWavAfE
+gLYcPrcn4s3EriUgvL3OzPR4P1chNu6sa3ZJkTBbriDoA3VpnqG3hxqfNyOlqAka
+mJJuQ53Ob9ThaFH8YcE/VqUFdw+bQtrAJ6NpjIxi/x0FfOInhC/bBw7pDLXBFNaX
+HdlLQRPQdrmnWskKznOSarxq4GjpRTQo4hpCRJJ5aU7tZO9HPTZXFG6iRIT0wa47
+AR5nvkEKoIAjW5HaDKiJriuWLdtN4OXecWvxFsjR32ebz76U8aLpAK87GZEyTzBx
+dV+lH0hwyT/y1cZQ/E5USePP4oKWF4uqquPee1OPeFMBo4CvuGyhZXD/18Ft/53Y
+WIebvdiCqsOoabK3jEfdGExce63zDI0=
+=MpRf
+-----END PGP MESSAGE-----
+
    +

    +

    FIGURE 8: A PGP encrypted message. The receiver's e-mail +address is the pointer to the public key in the sender's keyring. At +the destination side, the receiver uses their own private key.

    +
    +
    + +
    +

    +Figure 8 shows a PGP encrypted message (PGP compresses +the file, where practical, prior to encryption because encrypted files +lose their randomness and, therefore, cannot be compressed). In this +case, public key methods are used to exchange the session key for the +actual message encryption using secret-key cryptography. In this case, +the receiver's e-mail address is the pointer to the public key in the +sender's keyring; in fact, the same message can be sent to multiple +recipients and the message will not be significantly longer since all +that needs to be added is the session key encrypted by each receiver's +private key. When the message is received, the recipient must use their +private key to extract the session secret key to successfully decrypt +the message (Figure 9).

    + +
    +
    + +
    +
    + Hi Gary,
+
+ "Outside of a dog, a book is man's best friend.
+ Inside of a dog, it's too dark to read."
+
+ Carol
+
    +

    +

    FIGURE 9: The decrypted message.

    +
    +
    + +
    +

    +It is worth noting that PGP was one of the first +so-called "hybrid cryptosystems" that combined aspects of SKC and PKC. +When Zimmermann was first designing PGP in the late-1980s, he wanted to +use RSA to encrypt the entire message. The PCs of the days, however, +suffered significant performance degradation when executing RSA so he +hit upon the idea of using SKC to encrypt the message and PKC to +encrypt the SKC key.

    +

    +The state of PGP is in flux as of the fall of 2002. +Zimmermann sold PGP to Network Associates, Inc. (NAI) in 1997 and +himself resigned from NAI in early 2001. In March 2002, NAI announced +that they were dropping support for the commercial version of PGP +having failed to find a buyer for the product willing to pay what NAI +wanted. In August 2002, PGP was purchased from NAI by PGP Corp. (http://www.pgp.com/).

    +
    + +

    5.6. IP Security (IPsec) Protocol

     +
    +

    +NOTE: The information in this section assumes +that the reader is familiar with the Internet Protocol (IP), at least +to the extent of the packet format and header contents. More +information about IP can be found in An Overview of TCP/IP Protocols and the Internet. More information about IPv6 can be found in IPv6: The Next Generation Internet Protocol.

    +
    +

    +The Internet and the TCP/IP protocol suite were not +built with security in mind. This statement is not meant as a +criticism; the baseline UDP, TCP, IP, and ICMP protocols were written +in 1980 and built for the relatively closed ARPANET community. TCP/IP +wasn't designed for the commercial-grade financial transactions that +they now see nor for virtual private networks (VPNs) on the Internet. +To bring TCP/IP up to today's security necessities, the Internet +Engineering Task Force (IETF) formed the IP Security Protocol Working Group +which, in turn, developed the IP Security (IPsec) protocol. IPsec is +not a single protocol, in fact, but a suite of protocols providing a +mechanism to provide data integrity, authentication, privacy, and +nonrepudiation for the classic Internet Protocol (IP). Although +intended primarily for IP version 6 (IPv6), IPsec can also be employed +by the current version of IP, namely IP version 4 (IPv4).

    +

    +As shown in Table 3, IPsec is described in nearly a dozen RFCs. RFC 2401, in particular, describes the overall IP security architecture and RFC 2411 provides an overview of the IPsec protocol suite and the documents describing it.

    +

    +IPsec can provide either message authentication and/or +encryption. The latter requires more processing than the former, but +will probably end up being the preferred usage for applications such as +VPNs and secure electronic commerce.

    +

    +Central to IPsec is the concept of a security association (SA). +Authentication and confidentiality using AH or ESP use SAs and a +primary role of IPsec key exchange it to establish and maintain SAs. An +SA is a simplex (one-way or unidirectional) logical connection between +two communicating IP endpoints that provides security services to the +traffic carried by it using either AH or ESP procedures. The endpoint +of an SA can be an IP host or IP security gateway (e.g., a proxy +server, VPN server, etc.). Providing security to the more typical +scenario of two-way (bi-directional) communication between two +endpoints requires the establishment of two SAs (one in each direction).

    +

    +An SA is uniquely identified by a 3-tuple composed of:

    +
      +
    • Security Parameter Index (SPI), a 32-bit identifier of the connection
      • +
    • IP Destination Address
      • +
    • security protocol (AH or ESP) identifier
      • +
    +

    +The IP Authentication Header (AH), described in RFC 2402, provides a mechanism for data integrity and data origin authentication for IP packets using HMAC with MD5 (RFC 2403), HMAC with SHA-1 (RFC 2404), or HMAC with RIPEMD (RFC 2857).

    + +
    +
    + +
    +
    +    0                   1                   2                   3
+    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   | Next Header   |  Payload Len  |          RESERVED             |
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |                 Security Parameters Index (SPI)               |
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |                    Sequence Number Field                      |
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |                                                               |
+   +                Authentication Data (variable)                 |
+   |                                                               |
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
    +

    +

    FIGURE 10: IPsec Authentication Header format. (From RFC 2402)

    +
    +
    +

    +

    +Figure 10 shows the format of the IPsec AH. The AH is +merely an additional header in a packet, more or less representing +another protocol layer above IP (this is shown in Figure 12 below). Use +of the IP AH is indicated by placing the value 51 (0x33) in the IPv4 +Protocol or IPv6 Next Header field in the IP packet header. The AH +follows mandatory IPv4/IPv6 header fields and precedes higher layer +protocol (e.g., TCP, UDP) information. The contents of the AH are:

    +
      +
    • Next Header: An 8-bit field that identifies the type of the next payload after the Authentication Header.
      • +
    • Payload Length: An 8-bit field that indicates the length of +AH in 32-bit words (4-byte blocks), minus "2". [The rationale for this +is somewhat counter intuitive but technically important. All IPv6 +extension headers encode the header extension length (Hdr Ext Len) +field by first subtracting 1 from the header length, which is measured +in 64-bit words. Since AH was originally developed for IPv6, it is an +IPv6 extension header. Since its length is measured in 32-bit words, +however, the Payload Length is calculated by subtracting 2 (32 bit +words) to maintain consistency with IPv6 coding rules.] In the default +case, the three 32-bit word fixed portion of the AH is followed by a +96-bit authentication value, so the Payload Length field value would be +4.
      • +
    • Reserved: This 16-bit field is reserved for future use and always filled with zeros.
      • +
    • Security Parameters Index (SPI): An arbitrary 32-bit value +that, in combination with the destination IP address and security +protocol, uniquely identifies the Security Association for this +datagram. The value 0 is reserved for local, implementation-specific +uses and values between 1-255 are reserved by the Internet Assigned +Numbers Authority (IANA) for future use.
      • +
    • Sequence Number: A 32-bit field containing a sequence number +for each datagram; initially set to 0 at the establishment of an SA. AH +uses sequence numbers as an anti-replay mechanism, to prevent a +"person-in-the-middle" attack. If anti-replay is enabled (the default), +the transmitted Sequence Number is never allowed to cycle back to 0; +therefore, the sequence number must be reset to 0 by establishing a new +SA prior to the transmission of the 232nd packet.
      • +
    • Authentication Data: A variable-length, 32-bit aligned field +containing the Integrity Check Value (ICV) for this packet (default +length = 96 bits). The ICV is computed using the authentication +algorithm specified by the SA, such as DES, MD5, or SHA-1. Other +algorithms may also be supported.
      • +
    +

    +The IP Encapsulating Security Payload (ESP), described in RFC 2406, +provides message integrity and privacy mechanisms in addition to +authentication. As in AH, ESP uses HMAC with MD5, SHA-1, or RIPEMD +authentication (RFC 2403/RFC 2404/RFC 2857); privacy is provided using DES-CBC encryption (RFC 2405), NULL encryption (RFC 2410), other CBC-mode algorithms (RFC 2451), or AES (RFC 3686).

    + +
    +
    + +
    +
    +    0                   1                   2                   3
+    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |               Security Parameters Index (SPI)                 |
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |                      Sequence Number                          |
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |                    Payload Data (variable)                    |
+   ~                                                               ~
+   |                                                               |
+   +               +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |               |     Padding (0-255 bytes)                     |
+   +-+-+-+-+-+-+-+-+               +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |                               |  Pad Length   | Next Header   |
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |                 Authentication Data (variable)                |
+   ~                                                               ~
+   |                                                               |
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
    +

    +

    FIGURE 11: IPsec Encapsulating Security Payload format. (From RFC 2406)

    +
    +
    +

    +

    +Figure 11 shows the format of the IPsec ESP information. +Use of the IP ESP format is indicated by placing the value 50 (0x32) in +the IPv4 Protocol or IPv6 Next Header field in the IP packet header. +The ESP header (i.e., SPI and sequence number) follows mandatory +IPv4/IPv6 header fields and precedes higher layer protocol (e.g., TCP, +UDP) information. The contents of the ESP packet are:

    +
      +
    • Security Parameters Index: (see description for this field in the AH, above.)
      • +
    • Sequence Number: (see description for this field in the AH, above.)
      • +
    • Payload Data: A variable-length field containing data as +described by the Next Header field. The contents of this field could be +encrypted higher layer data or an encrypted IP packet.
      • +
    • Padding: Between 0 and 255 octets of padding may be added to +the ESP packet. There are several applications that might use the +padding field. First, the encryption algorithm that is used may require +that the plaintext be a multiple of some number of bytes, such as the +block size of a block cipher; in this case, the Padding field is used +to fill the plaintext to the size required by the algorithm. Second, +padding may be required to ensure that the ESP packet and resulting +ciphertext terminate on a 4-byte boundary. Third, padding may be used +to conceal the actual length of the payload. Unless another value is +specified by the encryption algorithm, the Padding octets take on the +value 1, 2, 3, ... starting with the first Padding octet. This scheme +is used because, in addition to being simple to implement, it provides +some protection against certain forms of "cut and paste" attacks.
      • +
    • Pad Length: An 8-bit field indicating the number of bytes in the Padding field; contains a value between 0-255.
      • +
    • Next Header: An 8-bit field that identifies the type of data +in the Payload Data field, such as an IPv6 extension header or a higher +layer protocol identifier.
      • +
    • Authentication Data: (see description for this field in the AH, above.)
      • +
    +

    +Two types of SAs are defined in IPsec, regardless of whether AH or ESP is employed. A transport mode SA +is a security association between two hosts. Transport mode provides +the authentication and/or encryption service to the higher layer +protocol. This mode of operation is only supported by IPsec hosts. A tunnel mode SA +is a security association applied to an IP tunnel. In this mode, there +is an "outer" IP header that specifies the IPsec destination and an +"inner" IP header that specifies the destination for the IP packet. +This mode of operation is supported by both hosts and security gateways.

    + +
    +
    + +
    +
    +    ORIGINAL PACKET BEFORE APPLYING AH
+
+            ----------------------------
+      IPv4  |orig IP hdr  |     |      |
+            |(any options)| TCP | Data |
+            ----------------------------
+
+            ---------------------------------------
+      IPv6  |             | ext hdrs |     |      |
+            | orig IP hdr |if present| TCP | Data |
+            ---------------------------------------
+
+
+    AFTER APPLYING AH (TRANSPORT MODE)
+
+            ---------------------------------
+      IPv4  |orig IP hdr  |    |     |      |
+            |(any options)| AH | TCP | Data |
+            ---------------------------------
+            |<------- authenticated ------->|
+                 except for mutable fields
+
+            ------------------------------------------------------------
+      IPv6  |             |hop-by-hop, dest*, |    | dest |     |      |
+            |orig IP hdr  |routing, fragment. | AH | opt* | TCP | Data |
+            ------------------------------------------------------------
+            |<---- authenticated except for mutable fields ----------->|
+
+                 * = if present, could be before AH, after AH, or both
+
+
+    AFTER APPLYING AH (TUNNEL MODE)
+
+          ------------------------------------------------
+    IPv4  | new IP hdr* |    | orig IP hdr*  |    |      |
+          |(any options)| AH | (any options) |TCP | Data |
+          ------------------------------------------------
+          |<- authenticated except for mutable fields -->|
+
+          |           in the new IP hdr                  |
+
+          --------------------------------------------------------------
+    IPv6  |           | ext hdrs*|    |            | ext hdrs*|   |    |
+          |new IP hdr*|if present| AH |orig IP hdr*|if present|TCP|Data|
+          --------------------------------------------------------------
+          |<-- authenticated except for mutable fields in new IP hdr ->|
+
+           * = construction of outer IP hdr/extensions and modification
+               of inner IP hdr/extensions is discussed below.
+
    +

    +

    FIGURE 12: IPsec tunnel and transport modes for AH. (Adapted from RFC 2402)

    +
    +
    +

    +

    +Figure 12 show the IPv4 and IPv6 packet formats when +using AH in both transport and tunnel modes. Initially, an IPv4 packet +contains a normal IPv4 header (which may contain IP options), followed +by the higher layer protocol header (e.g., TCP or UDP), followed by the +higher layer data itself. An IPv6 packet is similar except that the +packet starts with the mandatory IPv6 header followed by any IPv6 +extension headers, and then followed by the higher layer data.

    +

    +Note that in both transport and tunnel modes, the entire IP packet is covered by the authentication except for the mutable fields. A field is mutable +if its value might change during transit in the network; IPv4 mutable +fields include the fragment offset, time to live, and checksum fields. +Note, in particular, that the address fields are not mutable.

    +
    + +
    +
    + +
    +
    +    ORIGINAL PACKET BEFORE APPLYING ESP
+
+            ----------------------------
+      IPv4  |orig IP hdr  |     |      |
+            |(any options)| TCP | Data |
+            ----------------------------
+
+            ---------------------------------------
+      IPv6  |             | ext hdrs |     |      |
+            | orig IP hdr |if present| TCP | Data |
+            ---------------------------------------
+
+
+    AFTER APPLYING ESP (TRANSPORT MODE)
+
+            -------------------------------------------------
+      IPv4  |orig IP hdr  | ESP |     |      |   ESP   | ESP|
+            |(any options)| Hdr | TCP | Data | Trailer |Auth|
+            -------------------------------------------------
+                                |<----- encrypted ---->|
+                          |<------ authenticated ----->|
+
+            ---------------------------------------------------------
+      IPv6  | orig |hop-by-hop,dest*,|ESP|dest|   |    | ESP   | ESP|
+            |IP hdr|routing,fragment.|hdr|opt*|TCP|Data|Trailer|Auth|
+            ---------------------------------------------------------
+                                         |<---- encrypted ---->|
+                                     |<---- authenticated ---->|
+
+                * = if present, could be before ESP, after ESP, or both
+
+
+    AFTER APPLYING ESP (TUNNEL MODE)
+
+            -----------------------------------------------------------
+      IPv4  | new IP hdr  | ESP | orig IP hdr   |   |    | ESP   | ESP|
+            |(any options)| hdr | (any options) |TCP|Data|Trailer|Auth|
+
+            -----------------------------------------------------------
+                                |<--------- encrypted ---------->|
+                          |<----------- authenticated ---------->|
+
+            ------------------------------------------------------------
+      IPv6  | new+ |new ext |ESP| orig+|orig ext |   |    | ESP   | ESP|
+            |IP hdr| hdrs+  |hdr|IP hdr| hdrs+   |TCP|Data|Trailer|Auth|
+            ------------------------------------------------------------
+                                |<--------- encrypted ----------->|
+                            |<---------- authenticated ---------->|
+
+               + = if present
+
    +

    +

    FIGURE 13: IPsec tunnel and transport modes for ESP. (Adapted from RFC 2406)

    +
    +
    +

    +

    +Figure 13 shows the IPv4 and IPv6 packet formats when using ESP in both transport and tunnel modes.

    +
      +
    • As with AH, we start with a standard IPv4 or IPv6 packet.
      • +
    • In transport mode, the higher layer header and data, as well as ESP +trailer information, is encrypted and the entire ESP packet is +authenticated. In the case of IPv6, some of the IPv6 extension options +can precede or follow the ESP header.
      • +
    • In tunnel mode, the original IP packet is encrypted and placed +inside of an "outer" IP packet, while the entire ESP packet is +authenticated.
      • +
    +

    +Note a significant difference in the scope of ESP and +AH. AH authenticates the entire packet transmitted on the network +whereas ESP only covers a portion of the packet transmitted on the +network (the higher layer data in transport mode and the entire +original packet in tunnel mode). The reason for this is +straight-forward; in AH, the authentication data for the transmission +fits neatly into an additional header whereas ESP creates an entirely +new packet which is the one encrypted and/or authenticated. But the +ramifications are significant. ESP transport mode as well as AH in both +modes protect the IP address fields of the original transmissions. +Thus, using IPsec in conjunction with network address translation (NAT) +might be problematic because NAT changes the values of these fields after IPsec processing.

    +

    +The third component of IPsec is the establishment of +security associations and key management. These tasks can be +accomplished in one of two ways.

    +

    +The simplest form of SA and key management is manual +management. In this method, a security administer or other individual +manually configures each system with the key and SA management data +necessary for secure communication with other systems. Manual +techniques are practical for small, reasonably static environments but +they do not scale well.

    +

    +For successful deployment of IPsec, however, a scalable, +automated SA/key management scheme is necessary. Several protocols have +defined for these functions:

    +
      +
    • The Internet Security Association and Key Management +Protocol (ISAKMP) defines procedures and packet formats to establish, +negotiate, modify and delete security associations, and provides the +framework for exchanging information about authentication and key +management (RFC 2407/RFC 2408). ISAKMP's security association and key management is totally separate from key exchange.
      • +
    • The OAKLEY Key Determination Protocol (RFC 2412) +describes a scheme by which two authenticated parties can exchange key +information. OAKLEY uses the Diffie-Hellman key exchange algorithm.
      • +
    • The Internet Key Exchange (IKE) algorithm (RFC 2409) is the default automated key management protocol for IPsec.
      • +
    • An alternative to IKE is Photuris (RFC 2522/RFC 2523), +a scheme for establishing short-lived session-keys between two +authenticated parties without passing the session-keys across the +Internet. IKE typically creates keys that may have very long lifetimes.
      • +
    +

    +On a final note, IPsec authentication for both AH and ESP uses a scheme called HMAC, a keyed-hashing message authentication code described in FIPS 198 and RFC 2104. +HMAC uses a shared secret key between two parties rather than public +key methods for message authentication. The generic HMAC procedure can +be used with just about any hash algorithm, although IPsec specifies +support for at least MD5 and SHA-1 because of their widespread use.

    +

    +In HMAC, both parties share a secret key. The secret key +will be employed with the hash algorithm in a way that provides mutual +authentication without transmitting the key on the line. IPsec key +management procedures will be used to manage key exchange between the +two parties.

    +

    +Recall that hash functions operate on a fixed-size block +of input at one time; MD5 and SHA-1, for example, work on 64 byte +blocks. These functions then generate a fixed-size hash value; MD5 and +SHA-1, in particular, produce 16 byte (128 bit) and 20 byte (160 bit) +output strings, respectively. For use with HMAC, the secret key (K) +should be at least as long as the hash output.

    +

    +The following steps provide a simplified, although +reasonably accurate, description of how the HMAC scheme would work with +a particular plaintext MESSAGE:

    +
      +
    1. Pad K so that it is as long as an input block; call this padded key Kp.
      2. +
    2. Compute the hash of the padded key followed by the message, i.e., HASH (Kp:MESSAGE).
      3. +
    3. Transmit MESSAGE and the hash value.
      4. +
    4. The receiver does the same procedure to pad K to create Kp.
      5. +
    5. The receiver computes HASH (Kp:MESSAGE).
      6. +
    6. The receiver compares the computed hash value with the received +hash value. If they match, then the sender must know the secret key and +the message is authenticated.
      7. +
    +
    + +

    +

    5.7. The SSL "Family" of Secure Transaction Protocols for the World Wide Web

     +

    +The Secure Sockets Layer (SSL) +protocol was developed by Netscape Communications to provide +application-independent secure communication over the Internet for +protocols such as the Hypertext Transfer Protocol (HTTP). SSL employs +RSA and X.509 certificates during an initial handshake used to +authenticate the server (client authentication is optional). The client +and server then agree upon an encryption scheme; SSL v2 supports RC2 +and RC4 with 40-bit keys, while SSL v3 adds support for DES, RC4 with a +128-bit key, and 3DES with a 168-bit key, all along with either MD5 or +SHA-1 message hashes. SSL v3 is the commonly supported version on +servers today, although some implementations of SSL v2 will still be +found; both are supported by most common browsers (Figure 14).

    + +
    +
    + +

    +

    FIGURE 14: SSL v3 configuration screen (Netscape Navigator).

    +
    +
    +
    +

    +In 1997, SSL v3 was found to be breakable. By this time, +the Internet Engineering Task Force (IETF) had already started work on +a new, non-proprietary protocol called Transport Layer Security (TLS), +described in RFC 2246. +TLS extends SSL and supports additional crypto schemes, such as +Diffie-Hellman key exchange and DSS digital signatures. TLS is backward +compatible with SSL (and, in fact, is recognized as SSL v3.1).

    + +
    +
    +
                           CLIENT       SERVER
+ (using URL of form https://)       (listening on port 443) 
+
+                  ClientHello ---->
+
+                                    ServerHello
+                                    Certificate*
+                                    ServerKeyExchange*
+                                    CertificateRequest*
+                              <---- ServerHelloDone
+
+                 Certificate*
+            ClientKeyExchange
+            CertifcateVerify*
+           [ChangeCipherSpec]
+                     Finished ---->
+
+                                    [ChangeCipherSpec]
+                              <---- Finished
+
+             Application Data <---> Application Data
+
+
+
+* Optional or situation-dependent messages;
+  not always sent
+
+                                     Adapted from RFC 2246
+
    +
    +

    FIGURE 15: SSL/TLS protocol handshake.

    +
    +
    +
    +

    +Figure 15 shows the basic TLS (and SSL) message exchanges: +

      +
    1. URLs specifying the protocol https:// are +directed to HTTP servers secured using SSL/TLS. The client will +automatically try to make a TCP connection to the server at port 443. +The client initiates the secure connection by sending a ClientHello +message containing a Session identifier, highest SSL version number +supported by the client, and lists of supported crypto and compression +schemes (in preference order). +
    2. The server examines the Session ID and if it is still in the +server's cache, it will attempt to re-establish a previous session with +this client. If the Session ID is not recognized, the server will +continue with the handshake to establish a secure session by responding +with a ServerHello message. The ServerHello +repeats the Session ID, indicates the SSL version to use for this +connection (which will be the highest SSL version supported by the +server and client), and specifies which encryption method and +compression method to be used for this connection. +
    3. There are a number of other optional messages that the server might send, including: +
        +
      • Certificate, which carries the server's +X.509 public key certificate (and, generally, the server's public key). +This message will always be sent unless the client and server have +already agreed upon some form of anonymous key exchange. (This message +is normally sent.) +
      • ServerKeyExchange, which will carry a premaster secret when +the server's Certificate message does not contain enough data for this purpose; used in some key exchange schemes. +
      • CertificateRequest, used to request the client's certificate in those scenarios where client authentication is performed. +
      • ServerHelloDone, indicating that the server has completed its portion of the key exchange handshake. +
      +
    4. The client now responds with a series of mandatory and optional messages: +
        +
      • Certificate, contains the client's public key certificate when it has been requested by the server. +
      • ClientKeyExchange, which usually carries the secret key to be used with the secret key crypto scheme. +
      • CertificateVerify, used to provide explicit verification of a client's certificate if the server is authenticating the client. +
      +
    5. TLS includes the change cipher spec protocol to indicate +changes in the encryption method. This protocol contains a single +message, ChangeCipherSpec, which is encrypted and compressed using the current (rather than the new) encryption and compression schemes. The ChangeCipherSpec +message is sent by both client and server to notify the other station +that all following information will employ the newly negotiated cipher +spec and keys. +
    6. The Finished message is sent after a ChangeCipherSpec message to confirm that the key exchange and authentication processes were successful. +
    7. At this point, both client and server can exchange application data using the session encryption and compression schemes. + +

      + +Side Note: It would probably be helpful to make some mention of +SSL as it is used today. Most of us have used SSL to engage in a +secure, private transaction with some vendor. The steps are something +like this. During the SSL exchange with the vendor's secure server, the +server sends its certificate to our client software. The certificate +includes the vendor's public key and a signature from the CA that +issued the vendor's certificate. Our browser software is shipped with +the major CAs' certificates which contains their public key; in that +way we authenticate the server. Note that the server does not +use a certificate to authenticate us! Instead, we are generally +authenticated when we provide our credit card number; the server checks +to see if the card purchase will be authorized by the credit card +company and, if so, considers us valid and authenticated! While +bidirectional authentication is certainly supported by SSL, this form +of asymmetric authentication is more commonly employed today since most +users don't have certificates. +

      +Microsoft's +Server Gated Cryptography (SGC) +protocol is another extension to SSL/TLS. For several decades, it has +been illegal to generally export products from the U.S. that employed +secret-key cryptography with keys longer than 40 bits. For that reason, +SSL/TLS has an exportable version with weak (40-bit) keys and a +domestic (North American) version with strong (128-bit) keys. Within +the last several years, however, use of strong SKC has been approved +for the worldwide financial community. SGC is an extension to SSL that +allows financial institutions using Windows NT servers to employ strong +cryptography. Both the client and server must implement SGC and the +bank must have a valid SGC certificate. During the initial handshake, +the server will indicate support of SGC and supply its SGC certificate; +if the client wishes to use SGC and validates the server's SGC +certificate, the session can employ 128-bit RC2, 128-bit RC4, 56-bit +DES, or 168-bit 3DES. Microsoft supports SGC in the Windows 95/98/NT +versions of Internet Explorer 4.0, Internet Information Server (IIS) +4.0, and Money 98. +

      As mentioned above, SSL was designed to provide +application-independent transaction security for the Internet. Although +the discussion above has focused on HTTP over SSL (https/TCP port 443), +SSL is also applicable to: +

      +
      + + + + + + + + +
      Protocol +  +TCP Port Name/Number + +
      File Transfer Protocol (FTP) +  +ftps-data/989 & ftps/990 + +
      Internet Message Access Protocol v4 (IMAP4) +  +imaps/993 + +
      Lightweight Directory Access Protocol (LDAP) +  +ldaps/636 + +
      Network News Transport Protocol (NNTP) +  +nntps/563 + +
      Post Office Protocol v3 (POP3) +  +pop3s/995 + +
      Telnet +  +telnets/992 +
      +
      +

      + +

      5.8. Elliptic Curve Cryptography

       +

      In general, public-key cryptography systems use hard-to-solve +problems as the basis of the algorithm. The most predominant algorithm +today for public-key cryptography is RSA, based on the prime factors of +very large integers. While RSA can be successfully attacked, the +mathematics of the algorithm have not been comprised, per se; instead, +computational brute-force has broken the keys. The defense is "simple" +— keep the size of the integer to be factored ahead of the +computational curve!

      +

      +In 1985, Elliptic Curve Cryptography (ECC) was proposed independently +by cryptographers Victor Miller (IBM) and Neal Koblitz (University of +Washington). ECC is based on the difficulty of solving the Elliptic +Curve Discrete Logarithm Problem (ECDLP). Like the prime factorization +problem, ECDLP is another "hard" problem that is deceptively simple to +state: Given two points, P and Q, on an elliptic curve, find the +integer n, if it exists, such that P = nQ.

      +

      +Elliptic curves combine number theory and algebraic geometry. These +curves can be defined over any field of numbers (i.e., real, integer, +complex) although we generally see them used over finite fields for +applications in cryptography. An elliptic curve consists of the set of +real numbers (x, y) that satisfies the equation:

      +

      +y2 = x3 + ax + b

      +

      +The set of all of the solutions to the equation forms the elliptic curve. Changing a and b +changes the shape of the curve, and small changes in these parameters +can result in major changes in the set of (x,y) solutions.

      +
      +
      + +

      +

      FIGURE 16: Elliptic curve addition.

      +
      +
      +
      +

      +Figure 16 shows the addition of two points on an elliptic curve. +Elliptic curves have the interesting property that adding two points on +the elliptic curve yields a third point on the curve. Therefore, adding +two points, P1 and P2, gets us to point P3, also on the curve. Small +changes in P1 or P2 can cause a large change in the position of P3.

      +

      +So let's go back to the original problem statement from above. The +point Q is calculated as a multiple of the starting point, P, or, Q = nP. An attacker might know P and Q but finding the integer, n, is a difficult problem to solve. Q is the public key, then, and n is the private key.

      +

      +RSA has been the mainstay of PKC for over two decades. But ECC is +exciting because of their potential to provide similar levels of +security compared to RSA but with significantly reduced key sizes. +Certicom Corp. (www.certicom.com), one of the major proponents of ECC, suggests the key size relationship between ECC and RSA per the following table:

      +
      + + + + + + + + +
      +TABLE 4. ECC and RSA Key Comparison. +
      RSA Key Size +Time to Break Key
      (MIPS Years) +      		ECC Key Size +RSA:ECC Key-Size
      Ratio + +
      512 +104 +106 +5:1 + +
      768 +108 +132 +6:1 + +
      1,024 +1011 +160 +7:1 + +
      2,048 +1020 +210 +10:1 + +
      21,000 +1078 +600 +35:1 +
      +
      +

      +

      +Since the ECC key sizes are so much shorter than comparable RSA keys, +the length of the public key and private key is much shorter in +elliptic curve cryptosystems. Presumably, this translates into faster +processing, and lower demands on memory and bandwidth. In practice, the +final results are not yet in; RSA, Inc. notes that ECC is faster than +RSA for signing and decryption, but slower than RSA for signature +verification and encryption.

      +

      +Nevertheless, ECC is particularly useful in applications where memory, +bandwidth, and/or computational power is limited (e.g., a smartcard) +and it is in this area that ECC use is expected to grow. A major +champion of ECC today is Certicom; readers are urged to see their ECC online tutorial.

      +

      + +

      5.9. The Advanced Encryption Standard and Rijndael

       +

      +The search for a replacement to DES started in January 1997 when NIST +announced that it was looking for an Advanced Encryption Standard. In +September of that year, they put out a formal Call for Algorithms and +in August 1998 announced that 15 candidate algorithms were being +considered (Round 1). In April 1999, NIST announced that the 15 had +been whittled down to five finalists (Round 2): MARS (multiplication, addition, rotation and substitution) from IBM; Ronald Rivest's RC6; Rijndael from a Belgian team; Serpent, developed jointly by a team from England, Israel, and Norway; and Twofish, developed by Bruce Schneier. In October 2000, NIST announced their selection: Rijndael.

      +

      +The remarkable thing about this entire process has been the openness as +well as the international nature of the "competition." NIST has +maintained an excellent Web site devoted to keeping the public fully +informed, at http://csrc.nist.gov/encryption/aes/. Their Overview of the AES Development Effort has full details of the process, algorithms, and comments so I will not repeat everything here.

      +

      +In October 2000, NIST released the Report on the Development of the Advanced Encryption Standard (AES) +that compared the five Round 2 algorithms in a number of categories. +The table below summarizes the relative scores of the five schemes +(1=low, 3=high):

      + + + + + + + + + + +
      +Algorithm +
      Category +MARS +RC6 +Rijndael +Serpent +Twofish +
      General security +3 +2 +2 +3 +3 +
      Implementation of security +1 +1 +3 +3 +2 +
      Software performance +2 +2 +3 +1 +1 +
      Smart card performance +1 +1 +3 +3 +2 +
      Hardware performance +1 +2 +3 +3 +2 +
      Design features +2 +1 +2 +1 +3 +
      + +

      +With the report came the recommendation that Rijndael be named the AES. In February 2001, NIST released the Draft Federal Information Processing Standard (FIPS) AES Specification +for public review and comment. AES contains a subset of Rijndael's +capabilities (e.g., AES only supports a 128-bit block size) and uses +some slightly different nomenclature and terminology, but to understand +one is to understand both. The 90-day comment period ended on May 29, +2001 and the U.S. Department of Commerce officially adopted AES in +December 2001, published as FIPS PUB 197.

      + +

      AES (Rijndael) Overview

      +

      +Rijndael (pronounced as in "rain doll" or "rhine dahl") is a block +cipher designed by Joan Daemen and Vincent Rijmen, both cryptographers +in Belgium. Rijndael can operate over a variable-length block using +variable-length keys; the version 2 specification +submitted to NIST describes use of a 128-, 192-, or 256-bit key to +encrypt data blocks that are 128, 192, or 256 bits long; note that all +nine combinations of key length and block length are possible. The +algorithm is written in such a way that block length and/or key length +can easily be extended in multiples of 32 bits and it is specifically +designed for efficient implementation in hardware or software on a +range of processors. The design of Rijndael was strongly influenced by +the block cipher called Square, also designed by Daemen and Rijmen.

      +

      +Rijndael is an iterated block cipher, meaning that the initial input +block and cipher key undergoes multiple rounds of transformation before +producing the output. Each intermediate cipher result is called a State.

      +

      +For ease of description, the block and cipher key are often represented +as an array of columns where each array has 4 rows and each column +represents a single byte (8 bits). The number of columns in an array +representing the state or cipher key, then, can be calculated as the +block or key length divided by 32 (32 bits = 4 bytes). An array +representing a State will have Nb columns, where Nb +values of 4, 6, and 8 correspond to a 128-, 192-, and 256-bit block, +respectively. Similarly, an array representing a Cipher Key will have Nk columns, where Nk values of 4, 6, and 8 correspond to a 128-, 192-, and 256-bit key, respectively. An example of a 128-bit State (Nb=4) and 192-bit Cipher Key (Nk=6) is shown below:

      + + + +
      + + + + + + + + + + + + + + + + + + + + + +
      s0,0s0,1s0,2s0,3
      s1,0s1,1s1,2s1,3
      s2,0s2,1s2,2s2,3
      s3,0s3,1s3,2s3,3
      + +      		  + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      k0,0k0,1k0,2k0,3k0,4k0,5
      k1,0k1,1k1,2k1,3k1,4k1,5
      k2,0k2,1k2,2k2,3k2,4k2,5
      k3,0k3,1k3,2k3,3k3,4k3,5
      +
      + +

      +The number of transformation rounds (Nr) in Rijndael is a function of the block length and key length, and is given by the table below:

      + + + + + + + +
      No. of Rounds
      Nr +      		Block Size +
      128 bits
      Nb = 4 +      		192 bits
      Nb = 6 +      		256 bits
      Nb = 8 + +
      Key
      Size +      		128 bits
      Nk = 4 +      		10 +12 +14 +
      192 bits
      Nk = 6 +      		12 +12 +14 +
      256 bits
      Nk = 8 +      		14 +14 +14 +
      + +

      +Now, having said all of this, the AES version of Rijndael does not +support all nine combinations of block and key lengths, but only the +subset using a 128-bit block size. NIST calls these supported variants +AES-128, AES-192, and AES-256 where the number refers to the key size. +The Nb, Nk, and Nr values supported in AES are:

      + + + + + + + +
      +Parameters +
      Variant +Nb +Nk +Nr +
      AES-128 +4 +4 +10 +
      AES-192 +4 +6 +12 +
      AES-256 +4 +8 +14 +
      + +

      +The AES/Rijndael cipher itself has three operational stages:

      +
        +
      • AddRound Key transformation +
      • Nr-1 Rounds comprising: +
          +
        • SubBytes transformation +
        • ShiftRows transformation +
        • MixColumns transformation +
        • AddRoundKey transformation +
        +
      • A final Round comprising: +
          +
        • SubBytes transformation +
        • ShiftRows transformation +
        • AddRoundKey transformation +
        +
      + +

      +The paragraphs below will describe the operations mentioned above. The +nomenclature used below is taken from the AES specification although +references to the Rijndael specification are made for completeness. The +arrays s and s' refer to the State before and after a transformation, respectively (NOTE: +The Rijndael specification uses the array nomenclature a and b to refer +to the before and after States, respectively). The subscripts i and j are used to indicate byte locations within the State (or Cipher Key) array.

      + +

      The SubBytes transformation

      +

      +The substitute bytes (called ByteSub in Rijndael) transformation operates on each of the State bytes independently and changes the byte value. An S-box, or substitution table, +controls the transformation. The characteristics of the S-box +transformation as well as a compliant S-box table are provided in the +AES specification; as an example, an input State byte value of 107 +(0x6b) will be replaced with a 127 (0x7f) in the output State and an +input value of 8 (0x08) would be replaced with a 48 (0x30).

      +

      +One way to think of the SubBytes transformation is that a given byte in +State s is given a new value in State s' according to the S-box. The +S-box, then, is a function on a byte in State s so that:

      + +

      s'i,j = S-box (si,j)

      + +

      +The more general depiction of this transformation is shown by:

      + + + +
      + + + + + + + + + + + + + + + + + + + + + +
      s0,0s0,1s0,2s0,3
      s1,0s1,1s1,2s1,3
      s2,0s2,1s2,2s2,3
      s3,0s3,1s3,2s3,3
      + +      		 + + +
      ====>
      + +      		 + + +
      S-box
      + +      		 + + +
      ====>
      + +      		 + + + + + + + + + + + + + + + + + + + + + +
      s'0,0s'0,1s'0,2s'0,3
      s'1,0s'1,1s'1,2s'1,3
      s'2,0s'2,1s'2,2s'2,3
      s'3,0s'3,1s'3,2s'3,3
      +
      + +

      The ShiftRows transformation

      +

      +The shift rows (called ShiftRow in Rijndael) +transformation cyclically shifts the bytes in the bottom three rows of +the State array. According to the more general Rijndael specification, +rows 2, 3, and 4 are cyclically left-shifted by C1, C2, and C3 bytes, +respectively, per the table below:

      + + + + + + +
      Nb +C1 +C2 +C3 +
      4 +1 +2 +3 +
      6 +1 +2 +3 +
      8 +1 +3 +4 +
      + +

      +The current version of AES, of course, only allows a block size of 128 bits (Nb = 4) so that C1=1, C2=2, and C3=3. The diagram below shows the effect of the ShiftRows transformation on State s:

      + + + +
      + + + + + + + + + + + + + + + + + + + + + + +
      State s
      s0,0s0,1s0,2s0,3
      s1,0s1,1s1,2s1,3
      s2,0s2,1s2,2s2,3
      s3,0s3,1s3,2s3,3
      + +      		 + + + + + + +
       
      ----------- no shift -----------> 
      ----> left-shift by C1 (1) ----> 
      ----> left-shift by C2 (2) ----> 
      ----> left-shift by C3 (3) ----> 
      + +      		 + + + + + + + + + + + + + + + + + + + + + + +
      State s'
      s0,0s0,1s0,2s0,3
      s1,1s1,2s1,3s1,0
      s2,2s2,3s2,0s2,1
      s3,3s3,0s3,1s3,2
      +
      + +

      The MixColumns transformation

      +

      +The mix columns (called MixColumn in Rijndael) +transformation uses a mathematical function to transform the values of +a given column within a State, acting on the four values at one time as +if they represented a four-term polynomial. In essence, if you think of +MixColumns as a function, this could be written:

      + +

      s'i,c = MixColumns (si,c)

      + +

      +for 0<=i<=3 for some column, c. The column position doesn't change, merely the values within the column.

      + +

      Round Key generation and the AddRoundKey transformation

      +

      +The AES Cipher Key can be 128, 192, or 256 bits in length. The Cipher +Key is used to derive a different key to be applied to the block during +each round of the encryption operation. These keys are called the Round +Keys and each will be the same length as the block, i.e., Nb 32-bit words (words will be denoted W).

      +

      +The AES specification defines a key schedule by which the original Cipher Key (of length Nk 32-bit words) is used to form an Expanded Key. The Expanded Key size is equal to the block size times the number of encryption rounds plus 1, which will provide Nr+1 different keys. (Note that there are Nr encipherment rounds but Nr+1 AddRoundKey transformations.)

      +

      +Consider that AES uses a 128-bit block and either 10, 12, or 14 +iterative rounds depending upon key length. With a 128-bit key, for +example, we would need 1408 bits of key material (128x11=1408), or an +Expanded Key size of 44 32-bit words (44x32=1408). Similarly, a 192-bit +key would require 1664 bits of key material (128x13), or 52 32-bit +words, while a 256-bit key would require 1920 bits of key material +(128x15), or 60 32-bit words. The key expansion mechanism, then, starts +with the 128-, 192-, or 256-bit Cipher Key and produces a 1408-, 1664-, +or 1920-bit Expanded Key, respectively. The original Cipher Key +occupies the first portion of the Expanded Key and is used to produce +the remaining new key material.

      +

      +The result is an Expanded Key that can be thought of and used as 11, +13, or 15 separate keys, each used for one AddRoundKey operation. +These, then, are the Round Keys. The diagram below shows an example using a 192-bit Cipher Key (Nk=6), shown in magenta italics:

      + + + + +
      Expanded Key: +W0 +W1 +W2 +W3 +W4 +W5 +W6 +W7 +W8 +W9 +W10 +W11 +W12 +W13 +W14 +W15 +... +W44 +W45 +W46 +W47 +W48 +W49 +W50 +W51 +
      Round keys: +Round key 0 +Round key 1 +Round key 2 +Round key 3 +... +Round key 11 +Round key 12 +
      +

      +The AddRoundKey (called Round Key addition in Rijndael) +transformation merely applies each Round Key, in turn, to the State by +a simple bit-wise exclusive OR operation. Recall that each Round Key is +the same length as the block.

      + +

      Summary

      +

      +Ok, I hope that you've enjoyed reading this as much as I've enjoyed +writing it — and now let me guide you out of the microdetail! Recall +from the beginning of the AES overview that the cipher itself comprises +a number of rounds of just a few functions:

      +
        +
      • SubBytes takes the value of a word within a State and substitutes it with another value by a predefined S-box +
      • ShiftRows circularly shifts each row in the State by some number of predefined bytes +
      • MixColumns takes the value of a 4-word column within the State and changes the four values using a predefined mathematical function +
      • AddRoundKey XORs a key that is the same length as the block, using an Expanded Key derived from the original Cipher Key +
      + +
      + +
      Cipher (byte in[4*Nb], byte out[4*Nb], word w[Nb*(Nr+1)])
+begin
+  byte state[4,Nb]
+
+  state = in
+
+  AddRoundKey(state, w)
+
+  for round = 1 step 1 to Nr-1
+    SubBytes(state)
+    ShiftRows(state)
+    MixColumns(state)
+    AddRoundKey(state, w+round*Nb)
+  end for
+
+  SubBytes(state)
+  ShiftRows(state)
+  AddRoundKey(state, w+Nr*Nb)
+
+  out = state
+end
+
      +

      +

      FIGURE 17: AES pseudocode.

      +
      + +
      + +

      +As a last and final demonstration of the operation of AES, Figure 17 is +a pseudocode listing for the operation of the AES cipher. In the code:

      +
        +
      • in[] and out[] are 16-byte arrays with the plaintext +and cipher text, respectively. (According to the specification, both of +these arrays are actually 4*Nb bytes in length but Nb=4 in AES.) +
      • state[] is a 2-dimensional array containing bytes in 4 rows and 4 columns. (According to the specification, this arrays is 4 rows by Nb columns.) +
      • w[] is an array containing the key material and is 4*(Nr+1) words in length. (Again, according to the specification, the multiplier is actually Nb.) +
      • AddRoundKey(), SubBytes(), ShiftRows(), and MixColumns() are functions representing the individual transformations. +
      + +
      +

      5.10. Cisco's Stream Cipher

       +

      +Stream ciphers take advantage of the fact that:

      +

      +x XOR y XOR y = x

      +

      +One of the encryption schemes employed by Cisco routers to encrypt +passwords is a stream cipher. It uses the following fixed keystream +(thanks also to Jason Fossen for independently extending and confirming +this string):

      +

      +dsfd;kfoA,.iyewrkldJKDHSUBsgvca69834ncx

      +

      +When a password is to be encrypted, the password function chooses a +number between 0 and 15, and that becomes the offset into the +keystream. Password characters are then XORed byte-by-byte with the +keystream according to:

      +

      +Ci = Pi XOR K(offset+i)

      +

      +where K is the keystream, P is the plaintext password, and C is the ciphertext password.

      +

      +Consider the following example. Suppose we have the password abcdefgh. Converting the ASCII characters yields the hex string 0x6162636465666768.

      +

      +The keystream characters and hex code that supports an offset from 0 to 15 bytes and a password length up to 24 bytes is:

      +

      +  d s f d ; k f o A , . i y e w r k l d J K D H S U B s g v c a 6 9 8 3 4 n c x
      +0x647366643b6b666f412c2e69796577726b6c644a4b4448535542736776636136393833346e6378

      +

      +Let's say that the function decides upon a keystream offset of 6 bytes. +We then start with byte 6 of the keystream (start counting the offset +at 0) and XOR with the password:

      +

      +     0x666f412c2e697965
      +XOR 0x6162636465666768
      +     ------------------
      +     0x070D22484B0F1E0D

      +

      +The password would now be displayed in the router configuration as:

      +

      +password 7 06070D22484B0F1E0D

      +

      +where the "7" indicates the encryption type, the leading "06" indicates +the offset into the keystream, and the remaining bytes are the +encrypted password characters. (Decryption is pretty trivial so that +exercise is left to the reader. If you need some help with byte-wise +XORing, see http://www.garykessler.net/library/byte_logic_table.html.)

      + +

      +

      6. CONCLUSION... OF SORTS

      +

      +This paper has briefly described how cryptography works. The reader +must beware, however, that there are a number of ways to attack every +one of these systems; cryptanalysis and attacks on cryptosystems, +however, are well beyond the scope of this paper. In the words of +Sherlock Holmes (ok, Arthur Conan Doyle, really), "What one man can +invent, another can discover" ("The Adventure of the Dancing Men"). +

      Cryptography is a particularly interesting field because of the +amount of work that is, by necessity, done in secret. The irony is that +today, secrecy is not +the key to the goodness of a cryptographic algorithm. Regardless of the +mathematical theory behind an algorithm, the best algorithms are those +that are well-known and well-documented because they are also +well-tested and well-studied! In fact, time is the only true +test of good cryptography; any cryptographic scheme that stays in use +year after year is most likely a good one. The strength of cryptography +lies in the choice (and management) of the keys; longer keys will resist attack better than shorter keys.

      +

      +The corollary to this is that consumers should run, not walk, away from +any product that uses a proprietary cryptography scheme, ostensibly +because the algorithm's secrecy is an advantage. This observation about +not using "secret" crypto schemes has been a fundamental hallmark of +cryptography for well over 100 years; it was first stated explicitly by +Dutch linguist Auguste Kerckhoffs von Nieuwenhoff in his 1883 (yes, 1883) text titled La Cryptographie militaire, and has therefore become known as "Kerckhoffs' Principle."

      +
      + +

      7. REFERENCES AND FURTHER READING

      + + +

      +And for a purely enjoyable fiction book that combines cryptography and history, check out Neal Stephenson's Crytonomicon +(published May 1999). You will also find in it a new secure crypto +scheme based upon an ordinary deck of cards (ok, you need the +jokers...) called the Solitaire Encryption Algorithm, developed by Bruce Schneier.

      + + + +
      + +

      +Finally, I am not in the clothing business although I do have an +impressive t-shirt collection (over 350 and counting!). If you want to +proudly wear the DES (well, actually the IDEA) encryption algorithm, be +sure to see 2600 Magazine's DES Encryption Shirt, found at http://store.yahoo.com/2600hacker/desenshir.html (left). A t-shirt with Adam Back's RSA Perl code can be found at http://www.cypherspace.org/~adam/uk-shirt.html (right).

      +      		 +
      + +
      +

      APPENDIX. SOME MATH NOTES

      +

      +A number of readers over time have asked for some rudimentary +background on a few of the less well-known mathematical functions +mentioned in this paper. Although this is purposely not +a mathematical treatise, some of the math functions mentioned here are +essential to grasping how modern crypto functions work. To that end, +some of the mathematical functions mentioned in this paper are defined +in greater detail below.

      + +

      A.1. The Exclusive-OR (XOR) Function

       +

      +Exclusive OR (XOR) is one of the fundamental mathematical operations +used in cryptography (and many other applications). George Boole, a +mathematician in the late 1800s, invented a new form of "algebra" that +provides the basis for building electronic computers and microprocessor +chips. Boole defined a bunch of primitive logical operations where +there are one or two inputs and a single output depending upon the +operation; the input and output are either TRUE or FALSE. The most +elemental Boolean operations are:

      +
        +
      • NOT: The output value is the inverse of the input value (i.e., the +output is TRUE if the input is false, FALSE if the input is true) +
      • AND: The output is TRUE if all inputs are true, otherwise +FALSE. (E.g., "the sky is blue AND the world is flat" is FALSE while +"the sky is blue AND security is a process" is TRUE.) +
      • OR: The output is TRUE if either or both inputs are true, +otherwise FALSE. (E.g., "the sky is blue OR the world is flat" is TRUE +and "the sky is blue OR security is a process" is TRUE.) +
      • XOR (Exclusive OR): The output is TRUE if exactly one of the +inputs is TRUE, otherwise FALSE. (E.g., "the sky is blue XOR the world +is flat" is TRUE while "the sky is blue XOR security is a process" is +FALSE.) +
      + +

      +I'll only discuss XOR for now and demonstrate its function by the use of a so-called truth tables. In computers, Boolean logic is implemented in logic gates; for design purposes, XOR has two inputs and a single output, and its logic diagram looks like this:

      + + + + + + + + + + + + + + + + + +
      XOR01
      001
      110
      + +

      So, in an XOR operation, the output will be a 1 if one input is a 1; +otherwise, the output is 0. The real significance of this is to look at +the "identity properties" of XOR. In particular, any value XORed with +itself is 0 and any value XORed with 0 is just itself. Why does this +matter? Well, if I take my plaintext and XOR it with a key, I get a +jumble of bits. If I then take that jumble and XOR it with the same +key, I return to the original plaintext.

      +

      +NOTE: Boolean truth tables usually show the inputs and output as +a single bit because they are based on single bit inputs, namely, TRUE +and FALSE. In addition, we tend to apply Boolean operations bit-by-bit. +For convenience, I have created Boolean logic tables when operating on bytes.

      + +

      A.2. The modulo Function

       +

      +The modulo function is, simply, the remainder function. It +is commonly used in programming and is critical to the operation of any +mathematical function using digital computers.

      +

      +To calculate X modulo Y (usually written X mod Y), +you merely determine the remainder after removing all multiples of Y +from X. Clearly, the value X mod Y will be in the range from 0 to Y-1.

      +

      +Some examples should clear up any remaining confusion:

      +
        +
      • 15 mod 7 = 1 +
      • 25 mod 5 = 0 +
      • 33 mod 12 = 9 +
      • 203 mod 256 = 203 +
      +

      +Modulo arithmetic is useful in crypto because it allows us to set the +size of an operation and be sure that we will never get numbers that +are too large. This is an important consideration when using digital +computers.

      + +
      +

      ABOUT THE AUTHOR

      +

      +Gary Kessler is an Associate Professor at Champlain College in Burlington, VT, where he is the director of the Computer Networking and Computer & Digital Forensics programs. He is also the president and janitor of Gary Kessler Associates, +an independent consulting and training firm specializing in computer +and network security, computer forensics, Internet access issues, and +TCP/IP networking. He has written over 60 papers for industry +publications, is co-author of ISDN, 4th. edition (McGraw-Hill, 1998), and is a contributor to Information Security Magazine. Gary's e-mail address is kumquat@sover.net and his PGP public key can be found at http://www.garykessler.net/kumquat_pubkey.html or on MIT's PGP keyserver. Some of Gary's other crypto pointers of interest on the Web can be found at his Security-related URLs list.

      +
    + +


















    + +     \ No newline at end of file diff --git a/www/test_dir/some_text.txt b/www/test_dir/some_text.txt new file mode 100644 index 0000000000..041831f7dd --- /dev/null +++ b/www/test_dir/some_text.txt @@ -0,0 +1 @@ +This is some text. diff --git a/www/test_dir/test_cgi.php b/www/test_dir/test_cgi.php new file mode 100755 index 0000000000..5171ff3e75 --- /dev/null +++ b/www/test_dir/test_cgi.php @@ -0,0 +1,6 @@ +#!/usr/bin/php + + + From 6e4f13519ce1962b54ca4875835d8d4e55092c8e Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 1 Jul 2006 02:03:33 +0000 Subject: [PATCH 002/301] Initial 1.00 git-svn-id: svn://svn.code.sf.net/p/axtls/code/axTLS@4 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/.config | 107 --------------------------------- config/.config.old | 107 --------------------------------- config/.config.tmp | 11 ---- config/awhttpd.back.aip | 128 ---------------------------------------- config/awhttpd.msi | Bin 681472 -> 0 bytes 5 files changed, 353 deletions(-) delete mode 100644 config/.config delete mode 100644 config/.config.old delete mode 100644 config/.config.tmp delete mode 100644 config/awhttpd.back.aip delete mode 100755 config/awhttpd.msi diff --git a/config/.config b/config/.config deleted file mode 100644 index 092035ebf2..0000000000 --- a/config/.config +++ /dev/null @@ -1,107 +0,0 @@ -# -# Automatically generated make config: don't edit -# -HAVE_DOT_CONFIG=y -# CONFIG_PLATFORM_LINUX is not set -CONFIG_PLATFORM_CYGWIN=y -# CONFIG_PLATFORM_SOLARIS is not set -# CONFIG_PLATFORM_WIN32 is not set - -# -# General Configuration -# -# CONFIG_DEBUG is not set -# CONFIG_VISUAL_STUDIO_6_0 is not set -# CONFIG_VISUAL_STUDIO_7_0 is not set -# CONFIG_VISUAL_STUDIO_8_0 is not set -CONFIG_VISUAL_STUDIO_6_0_BASE="" -CONFIG_VISUAL_STUDIO_7_0_BASE="" -CONFIG_VISUAL_STUDIO_8_0_BASE="" -CONFIG_EXTRA_CFLAGS_OPTIONS="" -CONFIG_EXTRA_LDFLAGS_OPTIONS="" - -# -# SSL Library -# -# CONFIG_SSL_SERVER_ONLY is not set -# CONFIG_SSL_CERT_VERIFICATION is not set -# CONFIG_SSL_ENABLE_CLIENT is not set -# CONFIG_SSL_FULL_MODE is not set -CONFIG_SSL_SKELETON_MODE=y -# CONFIG_SSL_PROT_LOW is not set -# CONFIG_SSL_PROT_MEDIUM is not set -# CONFIG_SSL_PROT_HIGH is not set -# CONFIG_SSL_USE_DEFAULT_KEY is not set -CONFIG_SSL_ENABLE_V23_HANDSHAKE=y -# CONFIG_SSL_HAS_PEM is not set -# CONFIG_SSL_USE_PKCS12 is not set -CONFIG_SSL_EXPIRY_TIME=0 -CONFIG_X509_MAX_CA_CERTS=0 -CONFIG_SSL_MAX_CERTS=2 -CONFIG_USE_DEV_URANDOM=y -# CONFIG_WIN32_USE_CRYPTO_LIB is not set -# CONFIG_PERFORMANCE_TESTING is not set -# CONFIG_SSL_TEST is not set -CONFIG_AWHTTPD=y - -# -# Awhttpd Configuration -# -# CONFIG_HTTP_STATIC_BUILD is not set -CONFIG_HTTP_HAS_SSL=y -CONFIG_HTTP_HTTPS_PORT=443 -# CONFIG_STANDARD_AWHTTPD is not set -CONFIG_HTTP_WEBROOT="www" -CONFIG_HTTP_PORT=80 -# CONFIG_HTTP_USE_TIMEOUT is not set -CONFIG_HTTP_TIMEOUT=0 -CONFIG_HTTP_INITIAL_SLOTS=10 -CONFIG_HTTP_MAX_USERS=100 -CONFIG_HTTP_HAS_CGI=y -CONFIG_HTTP_CGI_EXTENSION=".php" -CONFIG_HTTP_DIRECTORIES=y -# CONFIG_HTTP_PERM_CHECK is not set -# CONFIG_HTTP_HAS_IPV6 is not set -CONFIG_HTTP_VERBOSE=y -# CONFIG_HTTP_IS_DAEMON is not set - -# -# Language Bindings -# -CONFIG_BINDINGS=y -CONFIG_CSHARP_BINDINGS=y -CONFIG_VBNET_BINDINGS=y - -# -# .Net Framework -# -CONFIG_DOT_NET_FRAMEWORK_BASE="c:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727" -CONFIG_JAVA_BINDINGS=y - -# -# Java Home -# -CONFIG_JAVA_HOME="c:\\Program Files\\Java\\jdk1.5.0_06" -# CONFIG_PERL_BINDINGS is not set -CONFIG_PERL_CORE="" -CONFIG_PERL_LIB="" - -# -# Samples -# -CONFIG_SAMPLES=y -CONFIG_C_SAMPLES=y -CONFIG_CSHARP_SAMPLES=y -CONFIG_VBNET_SAMPLES=y -CONFIG_JAVA_SAMPLES=y -# CONFIG_PERL_SAMPLES is not set -# CONFIG_BIGINT_CLASSICAL is not set -# CONFIG_BIGINT_MONTGOMERY is not set -# CONFIG_BIGINT_BARRETT is not set -# CONFIG_BIGINT_CRT is not set -# CONFIG_BIGINT_KARATSUBA is not set -MUL_KARATSUBA_THRESH=0 -SQU_KARATSUBA_THRESH=0 -# CONFIG_BIGINT_SLIDING_WINDOW is not set -# CONFIG_BIGINT_SQUARE is not set -# CONFIG_BIGINT_CHECK_ON is not set diff --git a/config/.config.old b/config/.config.old deleted file mode 100644 index 092035ebf2..0000000000 --- a/config/.config.old +++ /dev/null @@ -1,107 +0,0 @@ -# -# Automatically generated make config: don't edit -# -HAVE_DOT_CONFIG=y -# CONFIG_PLATFORM_LINUX is not set -CONFIG_PLATFORM_CYGWIN=y -# CONFIG_PLATFORM_SOLARIS is not set -# CONFIG_PLATFORM_WIN32 is not set - -# -# General Configuration -# -# CONFIG_DEBUG is not set -# CONFIG_VISUAL_STUDIO_6_0 is not set -# CONFIG_VISUAL_STUDIO_7_0 is not set -# CONFIG_VISUAL_STUDIO_8_0 is not set -CONFIG_VISUAL_STUDIO_6_0_BASE="" -CONFIG_VISUAL_STUDIO_7_0_BASE="" -CONFIG_VISUAL_STUDIO_8_0_BASE="" -CONFIG_EXTRA_CFLAGS_OPTIONS="" -CONFIG_EXTRA_LDFLAGS_OPTIONS="" - -# -# SSL Library -# -# CONFIG_SSL_SERVER_ONLY is not set -# CONFIG_SSL_CERT_VERIFICATION is not set -# CONFIG_SSL_ENABLE_CLIENT is not set -# CONFIG_SSL_FULL_MODE is not set -CONFIG_SSL_SKELETON_MODE=y -# CONFIG_SSL_PROT_LOW is not set -# CONFIG_SSL_PROT_MEDIUM is not set -# CONFIG_SSL_PROT_HIGH is not set -# CONFIG_SSL_USE_DEFAULT_KEY is not set -CONFIG_SSL_ENABLE_V23_HANDSHAKE=y -# CONFIG_SSL_HAS_PEM is not set -# CONFIG_SSL_USE_PKCS12 is not set -CONFIG_SSL_EXPIRY_TIME=0 -CONFIG_X509_MAX_CA_CERTS=0 -CONFIG_SSL_MAX_CERTS=2 -CONFIG_USE_DEV_URANDOM=y -# CONFIG_WIN32_USE_CRYPTO_LIB is not set -# CONFIG_PERFORMANCE_TESTING is not set -# CONFIG_SSL_TEST is not set -CONFIG_AWHTTPD=y - -# -# Awhttpd Configuration -# -# CONFIG_HTTP_STATIC_BUILD is not set -CONFIG_HTTP_HAS_SSL=y -CONFIG_HTTP_HTTPS_PORT=443 -# CONFIG_STANDARD_AWHTTPD is not set -CONFIG_HTTP_WEBROOT="www" -CONFIG_HTTP_PORT=80 -# CONFIG_HTTP_USE_TIMEOUT is not set -CONFIG_HTTP_TIMEOUT=0 -CONFIG_HTTP_INITIAL_SLOTS=10 -CONFIG_HTTP_MAX_USERS=100 -CONFIG_HTTP_HAS_CGI=y -CONFIG_HTTP_CGI_EXTENSION=".php" -CONFIG_HTTP_DIRECTORIES=y -# CONFIG_HTTP_PERM_CHECK is not set -# CONFIG_HTTP_HAS_IPV6 is not set -CONFIG_HTTP_VERBOSE=y -# CONFIG_HTTP_IS_DAEMON is not set - -# -# Language Bindings -# -CONFIG_BINDINGS=y -CONFIG_CSHARP_BINDINGS=y -CONFIG_VBNET_BINDINGS=y - -# -# .Net Framework -# -CONFIG_DOT_NET_FRAMEWORK_BASE="c:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727" -CONFIG_JAVA_BINDINGS=y - -# -# Java Home -# -CONFIG_JAVA_HOME="c:\\Program Files\\Java\\jdk1.5.0_06" -# CONFIG_PERL_BINDINGS is not set -CONFIG_PERL_CORE="" -CONFIG_PERL_LIB="" - -# -# Samples -# -CONFIG_SAMPLES=y -CONFIG_C_SAMPLES=y -CONFIG_CSHARP_SAMPLES=y -CONFIG_VBNET_SAMPLES=y -CONFIG_JAVA_SAMPLES=y -# CONFIG_PERL_SAMPLES is not set -# CONFIG_BIGINT_CLASSICAL is not set -# CONFIG_BIGINT_MONTGOMERY is not set -# CONFIG_BIGINT_BARRETT is not set -# CONFIG_BIGINT_CRT is not set -# CONFIG_BIGINT_KARATSUBA is not set -MUL_KARATSUBA_THRESH=0 -SQU_KARATSUBA_THRESH=0 -# CONFIG_BIGINT_SLIDING_WINDOW is not set -# CONFIG_BIGINT_SQUARE is not set -# CONFIG_BIGINT_CHECK_ON is not set diff --git a/config/.config.tmp b/config/.config.tmp deleted file mode 100644 index eae93ecacb..0000000000 --- a/config/.config.tmp +++ /dev/null @@ -1,11 +0,0 @@ -deps_config := \ - ssl/BigIntConfig.in \ - samples/Config.in \ - bindings/Config.in \ - httpd/Config.in \ - ssl/Config.in \ - config/Config.in - -.config include/config.h: $(deps_config) - -$(deps_config): diff --git a/config/awhttpd.back.aip b/config/awhttpd.back.aip deleted file mode 100644 index 7c754f1db4..0000000000 --- a/config/awhttpd.back.aip +++ /dev/null @@ -1,128 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/config/awhttpd.msi b/config/awhttpd.msi deleted file mode 100755 index 278f1046685a463327df1ed30cc988e920c6fa67..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 681472 zcmeFa2Y4LS756ZuP3us{T}2%;W$3{p}V`=8Xw6^6PN?$f&@4W%md9} z9~^uMaPt3O|1Zda?}>v)xkx!Tf;B(|SPKjQYlAAvOUiydus#?FHULxsXG5?N*cfaA zHU*o3&A}F6ORyE#8Vm;8fNjBcAOf}rL%;guDd=Le@f&x$o zia;?K1xAB0U@RC1#)I8J3D_O%0rmuYfeD}#l!0>404hNh*c()X8n6%87fb~8U^18j zrh@&zG*Aobz;rMJ%mn*`1HggcAaF1^1RM%xf!QDir2WKs?npj&@*Kfa%B4TFLX!k- z;Bb%vY0wTjzw!$kO9;1DT&JnDR1SOQZBGq&1*Ai3|^{B z>dbM2q?S0&-Rf6mrGDeLEjoARs6KkH#?oEO#zw99X^ZrH)8lk!wQr zUVC*`Hdh?B=N~F|{RMFtMEH`QKPUXJaIk6%6?``Qk~b=M{AJ+>VXtofuS3vzpV;ub z_j;rJgVHxDud68hW#PMdKQsN4pl=h#!Zo4#kO`vrSpALloi)5x6?{%Nz==)0NO6NxI`?>#R?$;f;-|OdI<@CPuTz#+O zX75d0eHXb!?ih1Va3{ENbvLB@iKWCKeI+=&CFVv0hzTk>twW9_%~}GHqE-tzG+{=-&q%7 zQyrEyk!KhZBW-6X!tq--v!1cd#w#0d>r&fU_ttmobJ+JVjm`^eBB6%g*UI@4n_OGT zzpP32Et|J}$307#eaq%#u9@eo0Y4ppEWHkVbUkF~fyliBk$Ja=&yApkUEy5H_vJ{n zE8s5LRR4}fGOa<38cF*qN7}4Is+Zih7vy6z!`O?y$&N?3_#+^PMx0!%ufk zgKjV_Y$QIO%gF6&MWLUsLOU2KQ2L**E1#&ks`RVM;lH2{lKv02)4e5pMV>r<@)CJD zB>$9rT0XAgM(GrP!G-+wv*iy7<{|0ixQ3PARDR6fLrZu1nfj16F-gEZ)<2KRBurBM&*La;Uz^Cf2=4h`=s*cN#dK4{s?|;3RXA#CTMpA za!sf{sdQ|4s$!e6Z+}q@B>&w(_#>m9)eT?D|F_5ha!L7rQu*hK-*IOY5u|vF1c$tUZxzo!rsfES^tFv|`v1pA=i5p8LkTRG>Vy zoAOwDd`>deRU2=wh^HG;i8kfDrZL{yo@h$MQxeZevMJIo-r0`^72W|QlS?MdoEvYS z8&5^}iD=_UA{}Wp;U7Q*5-lAqk@*sf2_9K8R?vxXqX!zfw4$SN4h=IoM@e=Q<1d|`9O49TgkI@U3@`%3EsEF+R4C@x_C=l zGs!L~PqsEDB)KJfcO)81rpDUmmduE!(qb|();gynHYZ+^&54q-L~AV7RWiM;EuJcm zrQ;zVOZhf4(cD-bOEm`8)8ccK1^J(iP&tW7w$vs&QVn>J zO5%NcS4nxSKG7O)FR7iIOtm+3w3keuHnFxnm1vz4X)uK*38UbocvSwTDTP>jB$kRt z@S`Om$qkjN(CH#7ZIEP(^NGm@D$NnpzQ%0vM;a4pvZxEwL~Eoim7GKUOJf>qPR@zM zS{ozs?3^2Kjl`5sQsnUkabijIqS|*`e1?MZtB;#N>f?=3TMAQDg^M-grHu(?NKr-F zO*ut6(nJLJ#@u+Q>Om^rkW4kE#mYuH(%7Lg$&i_7C0nDVjV+1RN)^j^ZT#?#cxyvY zp|g=pw9Ze?i;s-N6RKL1eyQ2<);SbLgiz#bE?Lk_ov)ZUF&b2&AR+MuZIWGNu&J@> zd5JbD8tT8vt)@s^3XEdJJW1BIRmGaq@n{Y0OhU{0knU=2k1de=C1TRNM~36mnP_e% zpD5~9{2Cca#oIeltx`o2@pM_Nu~dauL5qn7Deh>gSIw0iZj5WU5(|P&Q_)CbBi1Ba zx3+Ao)2d$SV$_*RDMlg_ehGe3 ztgVfrs$9?>ZR>;6^uwSVVJcX`T&Kw`3|>)f}6X zRzIpeKx%_h?xb4O$LGf8C!noWtR7~g-3o&ePy*D8R9woCP))s1wAp}^@9lFb8i|gy zc(`VLTK&M3=f!u6>|I$ma_W@Yx{-C$O3N!pR#%o*jGQ{XE*g!_jMtZDBUY+11+&^j zd%TV`^BR$NNpGjHdlgRKNoh{D&Phkb6^u;hVI)RQG$d#YjW}-?=e8!LlAY0MH2Xvf zJNSj|XefBX3fDZZ6;Eup*%^pIBQ{ z5ow~y)4iJF6V|TEKGqE5XlYBflF74zw;zvQKo;pcf(_O~RX(QqCJj%ZeYDZPX{HUM z6?vn5ZYtR^XKqCLfOcdE6QAg$nn{(jP)pobZQDh3Pp(-t;yE>Y~Rxk^KTugxxrR{Xx^&K$$8nSW@EVh9>jUgRLt4y>w;hY@5J<1jKjsL_qo%oh4g)$0qph{uSjc+-|lE0IRx+J+#|O6H{F=@G;>sPHMn zHzkaq)QLAOUm}%CHtTjT;YWolNLMaTk#OW0kr&-9OKmqzKvitAF4iTSD#%i@s!sEY zE}Ld52~pjSB}89&8?wv=+1^b@R22E#Q(! zq)c^oV%O2y!&Y%4l{-X5>Lom!0*RM42%ilxXw&H!&SR)546~QC*z{Dyn_?Z!?GbCI z`a|+J9Z$_CPW7-Bg0XBfIxU%OuYkoVu2Y9i3IiBIv-Ik@ajF#`QV6w;RD^VOGTp8s zF5+FADjPag-V<$_NzX{6+B;&+Ii3^mNSHSZ(^f*d#A&{EfLvyxL$y#WTX#{pInaw( z#AJzo+uW|S@EOg%NI@^ko)HVRZj}IA9K9S)Z%rTth8wt)X*Rkvo)qJdwk)@ZMv&0p zq((;9xlb!sLGWyhHz6h>qtOyg`!-F9@sLh|De)kbs3~CbRg#Mjs<_h~_4$fnceF~$ z>83m^t^9~Ws|$G6RMo_D1R=?K6?17aiW%tvRFCe=2Bdw?raBrag$s#PZ32~!B1wV} zo0{OCn)}8gGQuQ)_76h@JXZlB}9{AaV#(k|Zcn zv4a+Yp{7yBXd=(frvaC?*V3!P>noa@YdcbODi}&P)-07e(GZ^&Z%MWz9ix`hP;H5;6zBPjmJ_AbLp7WU`(PJ6nak)BZj~-2l*SJHF%j7 zyp=HIQypwFRZ`QMu&)&<`z9RNyh|{F!&$l6+Mz3}%B-{vPd89v^s4vaQ7&SOLLlgjJ{HnVxX>8UnI*G{)0#ZtGAg&nuwRc6!%0%*@Lz0{kDZ{cb z(@zQ8Zdcr)AxVu@qaaJ7A{S|nH%U`WwPx90eUdgM)l3=@y#$?$sjk-7Qp^AC$Wz7# zk|%W6?F@n$av==!#?5D3)1|X9aJSh}x-E@&MsU7=xrJu+&v$q~?bvQ?rq)rfSY@ z*S|K)f4VScCK}u4s-M+&vww9ml{i8KtY)(NSF9OQ4^@egI0{2}2$}^-k|D6oD-rv$ z3KXM_kZhtpXhlj3vVaJxQUl{KA!Nr?vW2X~rSZ}>HgOmD94&2CL!F-aZwI<+T+l~s zkhMBR%t2PCVya;5Xoe8$B*Rl8 zoQrZzc)3UsR`G$`E?Nsche$9gR)$MaMzm1Ve+K=k)>cI)A|NVTqo5>4ss(D56_Pzl zDdd850u^O2PDAQyi58R;mK2qYDj8ieres{n_>w{l#*`F}Eh!vVQdCedQ;GP<~A^eCIvK|4x^#SP0Z%$T7| zWQCY;sE+0s+D$Wp)ZJ^S7Y{Uwb)o7dB_DM36q-oqugHQp}Pshzv(s7ZOceT z6t8Ajpz;}+T{1;Ht7ilZtA>%ZQ)eY8+dVfc{R;tT;mvgawww&pqw-iCG=a7Da7=qB z&?QUNS3we2DFW4>FhrV8U=*MmTJ7+Piah>F^%!&1WID6kw}`-KTrh%K}@B=Sg1}StwbVW zR`k!3zyt~d#&BpsYcF1>vQbSd=cFjpCGSk(i5AP7Ib-fJM z<5ZG^4vDB?;4DcRDTt#24b(I;95iK7r$&}C86drwa7R%>tNJIBQnb8$s+Q!+=f)f6 zl_eL@N+?QFY(;q80k$VFGrgHA0|{4)DP}0xQ|eP0AS|Z587mQX8#<<|(2i4=cmVZ@$jqngrwL|l^D5lUS#hc2yLqP}L^ zA0jg>E8dcz!%Mb~R6H}t-;R2`O$XiPoH(*9Jfm^9NWsX$kwxfKYl!A7`3a&=DTKxW zreX_4Ke|H#rbbD_3RNkiZlWwz@}iNMrswWV$<$ISJV!ch$p}hThOH_D$pm?+k!Bmj zNQIzUGU_*_1T<~}3T^yj5h#^frl;%>?3gyC{Ykf?7?XkoBo5sv zP;&x*auxfMlwozLj`%R`yBY6?JW~Ca@E1MESAq6q?lKQE2caExVA{&8!(`~1Y&HJ& zkx1#*tpZk$UJWyoww_c?ccf^l#KS}?T}ky=eaR#6+H^`;<#SDAFxU}pVMidU#!&Eq z!;w}GrYon_u0;ctwe(Y}{|w12l20~7J=(!b1YFxY(2&*eT8q@3bLkNb)1`c*-I+0q za-ljYwDJta%-o#OeZeXgKJ)kBSxA-D3v4vmOhu4g%28LUhc6DqADV>2-< zVxF36mEeN%P`YKiazK{}rj*)`FPs|drN9#)Y@ zvorDd7jTNG7E@%X9FMiwQHMw_nuZAy6!NW+sg;r8QDg*RyV1)1S=PXd@@06mrhLi> z=`oO75b}Sl3l-*odd7-EEKG<7jN?~kcA5|U9Bx-fzSs!X1XCnY%z}9a-TNzXMln;> zR$3#WzLm1=F>aFLGLg{_qwZ6|DaBu(q1K>_v5ZdjIK~qKkX0f`O4K4Ha?(GmX=-81 zZE=3!rEO$1xhx!_K8e62f!U#zlGCXlB5N_hJxAJ+;uKU15rrbQNQ{t7jntY*N?a1d z2bxP84{Tc!c+)yZ$5M|1bdy)|c1*u3F$~SdPY7;!rz26y2uMPcFMJ3|cFI>0sF{w= z2b!A9dh5oa2*{oKWPNgh8Y2CK3>XAjtCr_j0iBg8sQ#t5w3?$(w;Du1WgR}~1gc?o z?=g2yo0f@wJ(yGDWyR2R%ynXoG%ekP$l}qprS#0;ot`VHhAPYe%h)jqUqDLSGnu{SBxt(CIXV{O}}Oxy`g%3A2t$o9Gl3hUQGO-iei8oC;g znzpY{D~)F9M`a%xM{Q&KRGY^VMH9Q~cypVCHyS>B@sEoSFY zr~E3K)F3*d`m|ZnztYo?uco@wP)|0c7D~P?*zy=%e>0LcHBXlhIwVZ8)vOv(Uib*B zzha_ar_5P3GEcDg5Q@tu7}m zO8ps9AqSJ{rkgO%$c{A+rv2s3Rj{sm)TV24HAw0m{s{ ztTh;25NS|>(#NTKXvUtp6A#v(w2QvX@NJ{if^8W6l(wu#$(R#GCJa02+*$cDBS=>; zW%9FA)t+qYnW*|C%ET5iwE_1|m8k(d^w7=Jgc7uQB5;>fDivi(HA8w??AR&I7R@eQ zN28VKb#K)kV{JyjimZqeRAm{+Ak#AN5~KcxiB>d%8>rE%R(S>vbR*G9c+pUIu#5vH z4Fj2j3R)I&h`bt%t&Q|kp;tz#el2(QLsu20H-V4N>eIE!puV^n@lw5kA*mEC>aUbe z(UvKtY@ewV{jOf8V#gF(L!ZV?iov&X+J|&yBOHPANXDs_pjHQxb4Hp_qKER9R>@l4 zBr{nE^rl(roEA2cqdZpu_MQ7boqv@o-$+v+oNKm_tqj6D!xM}uI76gsfz-YTt6~{S z1^k0V$nqB$1~o?78sjIE16di|uF+@`4i#zdWW6VaiYhc(u9!}hTAUFUP6Ab@2rgQK zp{iDRR3>X$Oyvw$$iQijVR%$8GA>nG2x(zfy#zm$7Hn#~WP$k1g2c2QFEf}>3zGv0 zPOKYsX0b|^l(0lXcbj@jF*lO7Yu5hLHe|4;bi>RY$5P0Wt;ooFF|LsdJ6e_EgpsvO z^^5!))x+-aI%!FQ79*`B7mRRCe1q|BV?0`i$}`UL%myXw!nYCn=`<;~k+2#W`k<)M zy`8NDIr$RIg`0)l61u3yts_+r(p_ma2vTwpeOJutDNyZo)GKmX0MkjWvT6Nq{E9=bm-N)YQbHY zIoSGcsZDiP%3Iw}Hd?2R(f%BU7)!5Ze}QwAlN4*ZU9%`FXTq257&@%8%PkwGfRoKy z%9r{cRBOc$RIbs-!(!B`L5f8dsHw0d6j8oeLJD~f8A$8Yiw$~2Pe?^&msPa{BWAEY(K^Xi6!bwW71r19YJYdN3K+oBESWi-j=GbWYX>Tsf5Q zMmegNuuEY!WSM=hGBFc}LiQsu?0Z3*WPffP=f_x&W+1j9^Jxfl&j%PKa60_XG1EPj!x3+8kB`m>#0rzwy1X8^z=@(1!?O9*lg5) zsdQBJ)@F5lp8`|=;+D3NbrQd*tCy?_`tOc1#hbp!nuQOB+C63Utb6nDQ*>%|HDa^v@ z?4)8S9DFe==GCg=B&&-WlkFqS@`j+A=IBgREw&3Fv_KN(FUmS_X_%=r&)TY~yCytTo~p(Rb61@!)1VSs)VRbe#8G8LA4O-6J{%pt>MRUt zB%iLF?uQzw7FFP+iZTdg{>UC(2i!;noGXM#18u^gW}V`NTIL`xioZlzbtlebT}rW3 zB`a=dA(+_6bdP4^EwnXSjG6LDG|7~YI0<+VoYBn0{jZr#v}STmhzqJu$$HH*;e)1Y zr;lf9kW>-P(0pl5HukaJUY5d4HC;-t8YO=95N46t=z=A$#WJg8q_L?r-SJ2^hKaPy z=t#b0&Com=@uZe%5^|iq1%Y6kC9{^op1DG>41MgXJ)GEDa| zeXB-=3+j?rwUDt9%%XEwrekD)!4ewgJ0-5UX%QbKg{E2zrzcf=EM?RoLp&B%u$*7S zA?dHA93>tjY>IUW8oeM}RXb5)7ayr!fSy8AvYH}6nTU94 z`gOe|AXd+En(&S}-KvzP*KVGZWXbk3DNH>gm-JX~uxwzbgUt6uWdp(LEO?;+Bwx^Y z{+IJ6GUFiACcp9=hN|zT)&0~QhNO8$BHsD`++>j?dOjhV*-$mX7ZxPdM5nGdS*2Z| zf)-mn&NEB8LQGRyMst$wNR6zs&Q4dGS=TzLXEJ9xZ>ntnRNGC{0h=tTqKyZ$*E!n* zVsK8;?CX9@qFRw`VPL6$H9L?hrDQWL-ZNchLr_B&yEMf8ptB+K+X7V=cds92;TnT*&YQZ#1VsN&J1MvsXM-@9^h z<+PgeS*6S{?-40jfWlQ>Bc`L95vT?qPJ%8C75zTrKS{Qd31hPhgtZGD0#0{lT1XKD(-Jtia!FZJTZ+4Q=wpmNAz0#xKY?Y$F zv3t-^pw6pl%;{Wh??f7dUMaLrQssq~+{7_`F3arYO_lp@iaF;@_M*1Yi#6JqL6Mb$ zCfd|xDHf&bu-XRIYY{NnhOf#mQ;F1qNUF2AinPY#Xj^n4z_(by&j?^*EZuH*(yEFP z=!En@L`R%5VX>VV;Y%e|6Ada0qcdc3J3cXn+Cj>W(+`;C2!!%ro_f9_i%v>5b~Ivg&*W(J6K%LwCF zO@)qy4boOHIJj2&F&x$tB)#^uQK3w<(B`Wtd{f18A{!beM26R@Ik2c+5~u^t3d1HM zDYZS;#siIuk(Et^Cz`a{r_^g5AYHg@tnI_4T_03a5sH8~)Gnw|Cd!u3dTyVrNiu2c z&xOf?9yt+Eqpy}6GHE~u$aF5>J)&dMp*VBg(%49fh9KBzs3Y{#^eQBjZ@p5kyqD#R zCgqmUrr16u-Tl$Zc^*1l!C4yFiqNkk4g)ccU}x%7j{Y4@O3qg!D_EIoWkIb};v5RF zA$H005LNMw2x3@cimYo%A_0rW*D9ASqsW=Z35`i@kXk!4nXXB);J?x~37?Th9M&}j z;{_FhW<)s}CiaeS+5>tYVc3ya6Vf*#lBAm?2@jNc@ix|#zyZk~HM^nNbT}C0*e2Qd zPfXMlx?<;MN;0Is3$b!y4X4-pff$zt+6+-EqrA3T3W6-ti_P`=n{-Xi7^TNNV&KGV zMrRa7MGTEJTbhzG)YLlnUs3aC%fci$C@(Xnq@}+J4<33+EviFOy{60-ghrm> zHP;deQO!uVL}#g{E~wiQs7&?f_5NZxr#V?q-3r;M2uzB#CYqG0H9NaVm#eF9HU_y7 zXfcj-O%>lI4~*Ac;dD#Z)?ue=o>U;qRmC7*4^?IJwLVHE?2B@ugm6psvmKNF6*MU{ zFy*peuSxBBkXKn!$)et@p(;zs#(Hu|4Wy1_5+IpquA%nU7-bt*ErPcOl zhH^B{Mp?kXl#0p}y;V%~9x6*!{sg;EdkfwY6?Hg*s=>rcDwB90;x<1+xg{*oj9*}g z60I3%las8f(360ATpI{pwmuo!s0x_sS7={~>`SqI8ATkKa%q@bt+dT){pe%0Df3F4 zdZ2aEW(SaJeae{1YR!f?SQhx0-Ije^M!$E}^K;QLE*I zAlfcXrPxG{9jwA0mlAaFI=-R2>fw1*MgnRJqB<-?wNmZBVq~?PLDZ%@BG_Cid`3?w zCJetA)v_#DB^WlKdx4)$E~KV!$gao!nQ;wyp~{09E_?7`b<-sx|Yv$JOII(Uk@&!bcVJ~^vK_fN9QUe37*M?iYifROH5Eh#r6 zv>uFG*B~b7VbfFD*hgNfo~UO}DGG=hS+r&S3iVg0kagk{_f>tVoP(F*9PF0%@ zK?f(>S`2$ntATGs?QRJ+H|miposx1Jo!WtvmYy4E0m5m{3SssDD5ZLnRak1kt2|cH zdf>Z`YQRvD-nBSyM*}i8Mbv|hn=LH#Rp>}ioHTYcw98gNX|{G9i71?iol-1^bli4< z5nEiP8LJquxKkEgg}Az^+p)-gXmMnbRby5s9<^qiJ3>bAr_@}KD9I;S;}m2{wuqo5 zAnQKlCx`8bI#YWmMPq5SG={!OHtuD8q-Ytqv`44K8WYJfwK2I4S9F)Z;;9ZP@!T#) zRoR{mGrTv`d2;tASY=m1C=yn>VMD5rnChnHj&(I5!zG+WT z9fb;|yma8Dt2u$08;mfAUw8ge&pr@kJ^K-i%Kle7KtxX?<*BCINlk&)*W@Ns1Z#GiHsXo&=S&l5Txb+I|&ateC* zP$8+_He7%WRx95}0jijwQ?~h)o&Hym&aNm>S&aA#{Z4WJ=d~r1g;I zW8d8MeygV{4MmPhB8Phz6Jd=UYsb`-jutUU>4ZoOWy2COQMUM{F4>K@devHUmyM+! zIsHPvB-{>GU|9W5I(OYQD>j;&s1tn_sIVTRTguT;nrRA^L*a=xU2tkcgOrvu#|EBK zfvuGmk%RfKT1u9K)yg&F$}$`&am=HUT}MU^mbKv=w5XOg=**OvO>=VbG&M&=UN$AO zBZ@xSUY%-tTAmHFN!EvO0%4nNWG3J;H1lc&%5Es*b-D1yJTSAtwc=tVA4TdT*(UGf zc&|{bV`PK{lh%pM9OpREU&f7mXh-%mjdbu52n#`0AoieQmBs7G_XizyNOWc_!CDNx zrIOUksz5k7A_fblua%2f}@IAAYi8hQD;w4u{YjJCq|>t(}j8+Jtrzl z#F-!IkrTQ*mF+@mU_##TM|+Xe#w9(KcCTL_iBro;P5rBts3+Rhkpp_cDoxeI$1JZQ z<|+~sIe%`7oG!JuNYqnFmYj_y$cgcK4b9QT*kcD(n z*-B%`S5NfJVGmiZrdN9CDLv`QpRf?*b&N1U3b;87$sIn za|j2adQ4@l4hvb$R8|BVjkRQ%lgdDtlXhno2nH!qk)Zm9b2+f2{Mk2>9n$t*?V_at z+}phtQfOLMR;xdVzdCwVv9oYGIb03iM;0eliWT2%ZOm6|;s{lp*khIF*#d}GC)<&l zr7Fx-Z@u$J_B+fqbBpH4(|j2ls9ifYx5WSkAQ57+PfOlhh@mUhU#g+`e%GZnTSf2Ec2t@Vf^ zl8U$Xp9++7w{+MXlV*!XyiwJbZg_2I$o+txbNhEDUSD2i_%6hBRcgl|3)aw>VE3&9m zZnAQC;jV>6L1w5uZ{z^6(t4^9%&f@{EuD8nLzQEQ3|~>}ONro(VuH+I9s%P~QiPOX z&Yp5{o~4SaDuT?%Np`SISv6_b;^{&~@6NvjpmUv=sJ9s;1r(^T1A)_SWKiNJ=L)I) z#KDZLJ*$yu!kd2jwEuRI3YrrfV24D7Bl>N#z9Pv=l3=TcE~`G{^P^oDYHD>dkK~3r z(m-nuMu7&q*}8s|NN#$rs&4RN@g>MAl;?v!GpPCEgOYa;ut5> z+c>7EQ8DD~ERQY*;%zki(g5&W_4%Pg>18dkklNDI-M=~P$~cw5r*0|Ih{*H6Ts9?! z?96}RnQA&tNiL+i6QzENYo#GkDkGV82s@UdZ<1q@8Q6+uOJ$acooN}0r>2yx_K2*~ zV<~C*Szog!+e)Hk$*4%NdR-%-3}M~wkf_PEa?k9sxoQG+d&P&KzwuPav0LNZ!}-VY}G0N5!jA{cy`eS3}|fP z;C5z-gsjSW*GLayqOtqCK4Pg&%fo7z2f}i z2I*fa7bI9Ft#+_6*Ve2?qEiw4&~89V$*Oamd6fa65SOc+{m8~@AeWYjQ9Z>--)NSE z^_+7|8w1lX*-uk#Q2fyT;wg2MXbs1JT7ybkaA8CF=PluHiD6Bnm@F(Pt*ojlEkY_8 zUsakvs<>cO{zv!(-qsl9IMs#YOAAZOMi-2gb53wD zwxA-vw4k6Uzr12x(U_w0(oy3Jix+ivcFwA(nbyQV7h-ZY%Fn{F&6jU79F{G!-`_U3f-uvn^e>Qvk>tSqb?KW6OMQTb!b zs>*RxHa@=$SNT=t1?6Lk3&$4~R#hzG9|_b}*3GJ!Tw4eCkbf(n-wKVzq|%znb-dfB z5bJ-bhoOF%Jf+TRi{g!#R_SYXg@*LO;#o8H>itJ=wIylNlBN&YEGI7Cy&^qE(-hRNnd zVx#SPR7WFeA@!gYvNX~Nbia|CAKEOm>$+CWpyN*Z7@Cbba>8a6r80f$-qT7eDtF&g z3Pn??n44EMvNo>a4m4zD)wP{uuzs^;7`6@C<+Mq`0l`MQ%7g~1{nPR_y)_k|W520F zx{B)GJ%$XCT2)&;Wm;YN^g60;=+#)(l}_W|U|}_@Zi;bS8*i7GnM$M-LALz)hZY=T zsdTC7pxCly6Bt?cpkkNH5<*701hWP?Tq0|%iZ=Uc*+$lc!Z3^@YnD^ymV25~tEreN z8$f%Pu`&({Nqyy(47JrPJk#qqY*V2dQvVlIx7)~+X`E)raNGPdOi@hIamkrhS=NnS zAN2{`m?~6SF{x%UPbn?+K2`o{rZKSZ>KR**PB#n3V?woIZq_#$nOUiUzQLZyBFnQw zLx1Vf%z81i5Jmr&8|e@eA-M>ph!&KdaD3-u=RJP2|1*3M{~7#4=Tm2u^Mm8M`u~Vu z>U`&X<9r3}09XDqxjZ*;Z{_V={=2yEZ0>I57P+HbZ9d)|$$u*k{~z;3j{cA1_Sx

    0Zl33Q+Kr9hU}AQ(Gs`*9 zbqRNdw}Ss{UhZt=PVfdgv%LG92c4ML=rwu!IUQcoOM5Ne;odwi;dOcoy+vM^ceJ;} zn}Lh{`M=pK6n|c}`d{^wjE=)u(nZ^N*=su?cR3YUqmUQ@!Ky3xBFt zbT7ltWkoBwG1a%fyy)Vhl|xT0!UeV`RAql6T@Vv#k15@@7T%#kY93dv|zi=WUR;Vcy1h zo91nv_io<%d8_h1$@@>JMo#9j4soZi5Ar_9v+qCl zJTLFOAE(RU=W5(;X5-A7nY@gb@iS{=*3PVxSvRvuW?*Km%!ZkbGV5j5&kV?HkQtQO zjaG6fSljWOp*;D&#m*$2l!w$!ekuD?H=(9Vt=BcbdS!&N^_NS1_pYd3=`YVv-a}~@ z&|W-r!A!6g>72^bck-Macn-v56weu$xA9!ZU(X-t5ArwiH}N;~ zxA3>}2m9Ol+xgr3L;M~6q5g1xXMdz0^$YwWzt|t`kM+m--u1{{Dgf!TzECY`@-b^qc%S{@VV!{`&p~{)Ya>{-*xs{+9mM{x*aW zA&edTo%~_`2!9tp-`~|QB#cr17=N6oiC+RQs%l%4!Z@aAH6?$fA((j9`+vb9`zpgp78$WJ?TB={oQ-U zd)9l-`-k_u_fPKy??vw=?_b`_-oL$9yw|+fy*Io!y|=u#y?4BKz4yHLy$`*Qy;a^P z-lyJwywAMPy)V2ky|28ly>Gm4z3;s5y&t@8FX12NH~X!m*>N7!C9cc5$L~YRPADET zRF8R2d;Pn3HODVa_ks73GJVXme()c;bLb?{x&8;&@#bB{c`?cC~9-#F!(L$RlHZ;%V96;bjas_ur29_1<>b1Pzgzm3W2c_=!I?|Xd^+>Sv1^~O z$?+cb*mE|g441e&dS`lv`)R+!@ASL;h5jP{X#W_0v46b3#9!*4Kf^!E zKgU1MzrbJNU+iD%U+!PwU+G`%U+Z7zU+>@G|H1#0f0KWUf1Cdo|4#pI{~rIZ{{8*~ z{zLvF{$u_V{*(UG{xkk_{_}oCUef=K-{zpnRzSy-}^WEfAs(C-|XM&-|pYx z-{qf@cdvh+e|p}7{=@#G{^S1N{HOfC`_KCS@VBJ>Zb^EFnsjf^b348t&RYPpI#>Dp zXMA}SH~;is@LlZsx+UMFjcjG$@T9dw2B}*14s~ECZ;^=lbgmlUI0NC+@*nHPXabP- zBUdI=U$kpwEH>)T$z)WDS-qJNou(u51eomM-{m;WeGX_kbl!mMy%p^CN3NfPaYLT=`MzyS_maN5C+gZAF>41-p_~@>$lznGr*~MQuORoRuuA`S^uY(;Ngus`^Os+>$v>yhod5NC&VY|@zxn8+2VlP>v#k4k$60#&%_g+ArAtpd9Rr-o zrNZQUfVkyaAU4Efz-JY5Oa%Gqf2~scoJ=OneZf-;3B;2r5vu> ztGoN|4alvvs1bPz$l={tIC(!%4W;^t2%(VSc{hfu9QXUL95=5IxR~{6_Z{6c0e=s2 z>-hkDr~dltp?}=aJM~)r`l{!5zjU{=>XF|$&#dZpZhWoVIqjKlXWj$dPW3I_&Q8}* z&jn|^Nxf1IL7WMsJ)kdyekbU+gdTry zyb=1-pq~eQHS{|{%gDuXpr@a69OxbBkpo_b{z2%kg?<_IY3OG{Kbq;rw?HqsdkxfQKz#(%^-%8vbrJr*4*i4BUkm**=+n^8gnl~oHPG(?eIfKaLBA#R z_IM40S|s1`Uj!E7W!q-r=g#@lhZw&+Ehbr+Jo9uNNw7Q+O#F~ ztDt`k`e&ej0Qy^?zXp2v@k?hwe+2aP(C-6%k??rvyP@xfz8m^(=(~vz)%7K+>#bDR zbEvLqs_WFLj4jV08p2Y0UH5vrEkAKwxb>`w z6ta_(Po3*){B!?Lj)2^ZxYw?KY}{l=O)_S3y!E`nXgE5(V?6sc!+f9Uo#I_Z+@*K8 z4@gqp0I&?kVGd&f2ThLStO+7;^ELapw3cNe zKz;AVcrbkL#mG$G6^zyFy|*LxKB0TIBX^^@+Z4ADj-l@(;hBrn81s0>nc@2sMxAnB z$$hOF*WAb$^iTcX_d8NP`hJ~}>g-0$^suOk0?-g&OR*I|5X?+x7z8SCnMu&eJK zU3=%d`YuwV;W3PeWlTK5E$6OM_at|cyI+s{P&a$W89_^Jkb4eyGk4P5DaO_Mp6}ZG z7)ILmKGl_bnYzz$?R|-xy{~0dp1p5!?fn;5?z_0}GxuX|_Wry3clUX9zvSBcP1oKZ zx^jOS++R_L?M+4X)(GzPsM)#qre5|QOs&`VcAmY5db#&V&)&Ow_8#Yr^L7v26<&Y$ z46pCIiPn{SchdUweGIKIe4pq^8w}s)d-kR|a(lGGwHS@B%}9M+G#2YKnj46=bO$gD z-RCg0lDlG(&+lZEj+Z)@J69OHuugTfGu9dJ?C$Id{b)3rRrG)(XmRDZ+Rv#&$FV7w{InkH?(|M8h*6g$@>N!rrIh?lE;mmhBodxv3 z3u$dfgT-)>P0E7S7@KVqg!!Zt9=&D^Q}e?T~4}u z;v!n;IrtiJhoDiu-Wi5Yc^6mo!;78#Ui#_lol06_H*}l4|ET9 zeZG!H%Y3lgpu!wsN?@*g7&$kLe2^S@HF&lok$1TZ-9_%vXtWoj-(G@-`((F*a#-$4 zSuA&#yXUzVxEHz?skh7BE8HvHtBI+O=MCt;|D-hMlbu`K+f2OgcJIaK2i%9;M~LSQ z?%&)e-KX5A-DlkA+{Mm#_eEkOX?@jwUA?{SzU#iPY*rbY*WEAN5#;6dXw<($r|x=r zo|MlM&H!&6PfAo$qRaDDa$WLk7A6O}n|d|7s%O64A*wa1V zTfy5{YW@c5-jw(a)+e#=we*2el0Hn;B* zro4xLv+>YAXnX5hmfE_q&n&g2u_0&EE;jbIw)R_|)(>lEpV=_N)b?HbZ@+reX2Z|= zXQ^_Z)+bG8zp_5tH?h&T^--H-zwDc(%Z8IR>1merHP%eU)DZro(;j$*e4=paEao;Di3&O z0*iiLzU%HjI%E~555EgZ&Ue^dKkqs8;z7@=NBlCz-aajP&u?qKT2D8VlfIsA`trM{ zSUy71=$Y1@-{J_foGV0=$+7r#KYlI0e=UC`b*tl- z(1hviyM1Ea>&o;nk#B`iUMmt5vteGS%q*?__-~&5_%B{&4D7o+<;tjE{S$r<8SB?@ zJqo?|>820<(I*`~i@CK6zhm65xwR8|xiacE`_uC~Ytx%n?E0i9FV!Ukk$z~z&R&#k z=BM7pK1|p1J8Wm)?bG_**E39G-zD;4T5BFQ`#JAF=Dshxo^`+HcQ|b8J{)H;v*?R9 zY}Vhq_4k+9i`$-Yw*CcAlgILH(K9SbQ-5|s+eqCK^mHfR;pL!mKazo^-48-Jd^_4!OjSaC~nM#pkE;$GTU37{C0G z`*8fiVe||$hfX}@vVPik^PN#o%4CBc;i$Z2{@Bpv@Pe=(VjsSG#w%>Mdhhumvf1iA zY!b3WOX)BdAhs1s`!9AC@}n-Xm20;8wQozYoedo*oMtzwOjbovkBH@6>|&v(r*=^6k3`Jl{fk; z8-{f$@!QR*qB_c@)0?HzrhWg)d`n-~m35 z3-g`W=(Og#aGW=dO<%5bC^}ZXfBQ;d*ev`muI;yd_MM|y+nymx`APj){maIG_K!Hx zHT*{ia;)4;_EW!yO|o{3>7bMqllr$Ot#xIemR@|w(rWivf2^HQ*(>XVHpzZx->eTp zVdG@oYd^!Z)}}8r<~miHERB52ZNFuGgMQaF;Ujf6P_bZjdv`c%`3%nIRdB*$!YBHp7&?n8bp zgSOGX;%W=G%h|@&K57@!FqL=s-^nQd4!Tg?5Ig!xmSPBQwM+?DeluWZ&gWhaar_`x*s-1nEiR><#>P&HJS(!Q0Ilwv4Ihg%NF{ion_8)=S=4;)_tDsoabD{%F&h1@1gsH^GD~;#HiA_$+^Y3&H0OS zr*n_7e#QBf&ne(~x1%k?# z&ezVj&iAZ0_1rbwHQlw`wcT~y_1yJ&8|V&lH*z<2H+462w{*95w{^F3w|94Nhq^nt z!`+?Tk#5v2aCdbJ-C}pNI~JGY+}+$#x6G|@_jaq@ecXxeWOu4t>rQuPxOMJK_W<`G z_YilMJKKHJiMjP|qZ`ikggeh|aa-M&*}nFQb2!hmdUm)A+#}p0-J=kDj&+Z7PjHvI zC%LD%r@5!QXSip&XSrv)=ep;+zj0T%7rU3bm$|=nf9GE1UgKWpu5_<=fA8Mt{?Yxj zirLNXt?upa9mMfY_a67J?)~nA?!)e*?&Izg?sQ64?q}V9xc_utaR24L?7rgu+kMS_ z!+ndlcii{f58RL3kKIq)|M2~p`?>q2`?dRx`>p$|`@P%kdY22h$<*n_l>#gq% z^fvG|_6B(ydK-C%yPJ5Md0Tp$ds}#0do$h5ylr^jmiLG^#2e}E;O*oM_jdMn@kV$$ zpM)mr3x8jrPWRsyEH612et- zy#u_1y#u|2yhFT0p_uJ8cyVuzH`hDNYxY{bHZSG1d-J^o-VxrB-cbxP9OqcC(m9Te zj*Gn$yrter-pSsn-f7wt-uij#=Jlx1|JOf%Ks&UC z+Dnid6=ANg9DnhrUr(7k=-TB2oLz?f@t*~lU5ADAHm6)nZNv?zO9&!>KvJuuUJ`5O36*)*I3s z@zthI>nIyvJhpgL(YXAv;Xbj~`o9o?l*ASv7iG@z}!RN<)5FROm~~#ubbzE+-~M;|qz&_;LAV z#iL5|M~^8iE*?F8^q7kB!bJ_KuD15%tfDam1srl2os(!XCQWjdiySVpaBO*Td2y*E zreHLsTspoYzpP+XL4H-~n6ZWBMLdefEz;*O994K^=sbtmqI^;iWLs`j|704w0i`>;WG+|NYz?@vvLu z80z4$U@@CWcm@F(zR za1*#0+yZU|w*hqdNB|CNQ61y}hZU)sPu;`wUhr3NAGjYp03HO=)*l8E_eXg?1|A1b zfWLt!!BgOA@OSVGcosYd{sEo`{{$}p@#7_){{k8I(P%T3El!i{|?W0 z!F%9+@B#P`d;~rQ!dE{5pMw8@&%oyZNyYgRdamE?W2`8N39C5@EPHStcQ(s^2%$PC5 z*=L`9oIUs4(C+zb1P!pCp3 z$QW6cJ_$&_yarektOW*uwZS@IT_FAS`d}c~01N^ff{nn&K>G1b!De7{um#u>Yz4Lk zgTXdnTd*C7fbGE$umji;>;#5_VPH5I0d@wvfRP{{M8U4002G2EPz*+a(O?W13&w%* zU^h?#b_aWaJ;7dJ0w@J#pd5(&Q3+&rWp7XoYQR2VUm$YHBrq9F0aL+#Kt{>6pbkt2 zGr&x+KR5s!2o3@w&l~~{1+&0x5Cip~0W^X*XaaMylAsM74pJZu z+Cc}H4`kde@=_N#0xSeaf<@pca5Tt(W5BUsF*pt!4^99}z*2A`I0>8#P64Na)4(!t zI#>?Q0B3@;z}es&a4t9xoDVJlzX2D572qOpF}MU=3N8begWrNH!0*77;3{x6xCUGc zt^+H<_2Bp525=+z1NbBO6ZkW@3ET{B0k?wN!0q5K;0|ynxC`73?g96Lzk>U~{on!c zAb1Eo3?2cGg2%w);0f?I@FaK&JPrO1o&nE-=fFR}^WdN01@Izx3H%GZ4E_yX0k4AB z!0X@*@FsW*ybay~?}GQh```ocA@~S<3|4_pz^C9p;4| zYz4LkgTXdnTd*C7fbGE$umji;>;#4a(WeXtBf!pJ7cdg!gDBV)6o5id1d72ZFdB>j zW5GBu9_$86!0uoVuqW6HOaP^z43vWkPzkEQ-k=)PfPKKeU?P|VCW9$pD%cN91GS(I zOb0W-Ot3#V02~Mo0tbUbz@cCkm3KuoRpKP68)`Q^2X%dBIJ@`Gi0o(}w0R9O61pW+e0yl$Oz^&jma69-5xC7h??gDp%d%(Tmui!p#KX?E< z2p$3tgGa!l;4$zxcmn(lJPDoxPlLaMXTY=IIq(ngJoqPg0lWxa0{;RpgMWipz^mXj z@H%({yb0a{Z-aNhyWlufW&f8}Kdo4tx)O z0Np?a+cK#2KpybH8emPZ78n3HiN{$7h~{EFus)CzF*X2$z=mKWurb&KYzj65n*-!L zXGy0U=Oe-*b7VmrJxLyg9=ays=(f$8q|P&z`kH2m;@$+DPStt4@?8K zpbkt2Gr&x+KR5s!2o3@VgG0cfU>2ASVxS&0fJP7pO<)d~3liWkFb_0?7SIZkpbZ=j zQXmc5K?j%*I>7?a1&#mt;62>t~A3~mB9gImC@;5KkO_zSoL+zIXicY}Mtz2L9lK5##H z06YjD0uO^nz@y+X@Hlt^{0%$_o&ryUzk_GMv*0=K5AZzrCwKw82wnpJ0xyGqgIB<- z;5G0%cmuo%-U4rfcfh;gJ@7vG0DK5O0w04_;1lpE_z(CDd=9<7KYyq|e zTY;^?V6Y9?7HkJ1V0$nG>;PoUyA#i$U>FzROyK@r#$6o5i-CMX7@z-TZA zj0NMsc(5BN0lR}efSjwf7nlG_K^Z6q6`&H_3-$)ppa$Fr<ZD3}FigBYj>4WJRkK@*q*=7I!}^FHQ*X3zrUjI1PR z1BZhYNP~9J0p^2FumE&{Bfvs%Bv=HF0!M=km{eO{CF98ziM8axzFmFgxh``<)NN=) z4v@2!l)$X4Um7*?>WC9Mo|nwT;%*TtUmCTm*eTs!RwJlKD~|L!VFJ#%)T`^-q&~hh zsvvM0s0A^{m9$~(M<{zatQU=*!{L3{tPyf)j`4LkuFu)|6K#`q!_n&whxR#x*IKiO zZyeFg@!3%!kYVkpNdpu?z70-k5FHK$bVePrHdf1uubUTfdMgVZ&J1)OyPy|Iac8Vc zX%ig|4|FztwHHA>$Bm}avFKrKa~#eVbkg7UB5B}1kBCCj;XFd8qI8{}(J=Z-ha(A{ zPY&*79dBq*t~ssHnUw5hjVgA2u_EA@Lubo3dlASX_&N!kf#_Ve;krTi^EiP!o=R#< z4pnp>sMnU`nEM|wp6rBri({?N8MH~($jxUJLZEtCI=2yP>;H8yLrhMNI#vi?4 zlge}cRWmGc#^ff?Ew7%PDSh4B{-Z&YF3fB^@z~B;cVFZm@sPLip!*K5c;l}how-N( zdCkMlt0~#`$`5Y)^4*W}U;Dc2=G$-n;O3WFC-1Sv;G(=k@BV7t{a%{#+~c<$zj*0o zpfHcvE}cU z6rObQ*WHh9`PG|`FBq|Ge8H<MQ>J z@}+sJ4%zRbEsi+pi*J{F@#OgK!q4Wsux#L@OaI-u)1UYh&h z1>bD*^^>0-IpWc!&kwj^;w4{~4EX$@b@uwrHkWUF&exlM`{92cePiLxkFL7oliv?5 z-~54sHSd3*;QdE#YB_k(v4Z<%JXG+)8lMkX>yiU5Xx{wD<5tFYtY7@?zO}|KgEqNt^Tun(oIj!VnR5mV`TE?4Gq>Dx=qnd* zxBK(XSubsW^(%v3UVrO`&u472&$&1M?)|q%xBcUUtv-7Do-xsP-mJOe>}jWbc-y{r z@4e0;b2k6nePXlOmnL`J=)LtGE!k=ISszb)=%nIn8s|N>=W!1X`|!C1Z?Ap+KL&Q5 zaQ3cuY?!~-+<%?C`&z||+h08Jj!Oo!;q|jldcR?0>XJEm1225~o8=d8|F=o;2}O$@e)^4Z`CZ5ER6S(>va_d^eL3sc zceeSawfx(U%rLo)G`r3*OPnz;X`8r3;zu_;RZ?evd7k{|5Umn?Y^5O$x=T=wT zwzj+36M5I1b?CRZ?s3VJcf9z%`|a}COBRj&tn9)=KD*+IW8y2$^Pm0xl6x-tJ~8^S zJ8wRwy1Mc9uF;RpA6y%Ke9`D9|FiWL`(M&Hzav)u==~#FH~RAyPp`Af{Fb6)w_3Dt z_IVShq&8Y{!5eSfS~lwG^&)R<{_u%||9(bk;*s_4dgsMcuB~2v>tSC$bj{;8JaY5E zwPro>;OBSDUhmFxkLkSZ%_qmt-f5rBj=yi#Mh~yM-kT3z?0Vg^{||Nd5G2d@h5@>5 zY_Nv?U~trr(zc_Uc9!JTy76|;3+-VuM581k6D7Av*q38u~ACD`` zMDr+&kL|<%K^(WWpuN%+mh_ zH~fPz&gjgMQITG%(?iDED+ZtW1;#f;ob@e{#6SHFW|kMcc1A{BW2~etq3EIhNe3=xJww>ih*F2yP_+W37ln-EB zpeav>=6z~qxz*fRNOdmI?ox9}0%wAw@-C#j)8<>DP9y*<&1_cXbh=$ka~70_t=>am zHxsT~nDZ#;@DK*Hx;0qAm&vI}vq{0Quhv|PJLLt?No0DZOiFQftKp4JmC|Dg6SxQn zHd2}{hv_=0^AK0Ifvu<;82z0{K5st6Ktchn8U0O4%xQs>lfpFSdYQT$KnH?7ov=sOB$R)W`gjImG*_ZL}{Nfu{Z zQ?mw|mwyf^1*8HUQviI59g@InGSmU9#|UvBNTIi7D?M~gjLCG&@h>_81r{jwgiZc1 zu%KjpxUenRC%v&K77}%Z9wk7TwrXR3QmA!5$Cvvn_kvBRM`UgM`QW@GVYCc6CN~C* zlFd_a0s+2I7r2iyXvanoc00xVR2-&a|jYO2Ag&OJz12335tP$dl`O@xY<#ce1t?M^oCfA&))zcP>kaP?B#h^^fy z2B=Tvgi>H%2!UzGnYB$}(7j_f|5S{z!#v|8yoUAtBgRO`RLWOU;VOn=K?jM22&Z4A zK#Szf3vHD?>XFI{>5HHRB;{-%su)qm|3o8>+Rp+4^X~ST=omomBqoP>ALt8+z)6rZ z{=&-78qY>AGhn0(R_XP11U`3k>n(J#RyiNJF0I|;4(jLU(ZdrMW@r@I7&z8C5t>tb zvn44NS>9cq+fXF6YPE#{TtcK#O;mqrPFheU@3eZ5)b9Ec_#Ez(8Y>EUiUNwkn{jm} zN^k;@DPh$oSq-!|PT3|o75f7-)M*{sl~g(%7(5x{@EKn=_IUvr;=%= zP)0}ULcA;O{uQ(-&m*ns&E5vDTlJl&SvPdtgyxp{DY-uA31=qcdc#&$5hm3(J594o zCvf|JbD7px1vrP^PWrd%+TBYaY>z5!PwO91Mr?{G$UJF;&fL{PW{|QH&v{Z%D;=Uw zc@-}2e4~E*Ebs^WWl`e^ciraeDKOqjcfdpa8uRaFB}njlJ$f4Z!$>G3pOG{+RYdg{ zJ)54K8~TjC@UT*RY|i@`@AP-q9R3y>_h20HdK6)NCy9C8rDLGi&K}hGv^BXKUNj(p zEMEgPe68iX!=5eDN)xM}{LeTGly}fsydq?NpkfQu7`A@8ZuQXJd=m+q=-@=)PsHlq z)q=5?3#gh*mb?;Ms8>;Ka##T;V$$4l;umjhX6XIrfj{pdW-l^F(Oq7J(I;20-qW)kS7ssgd z#!Fs|0Zc)tH6A>qm%;7?Fk(;?_!!SS1`Z8DM?(sP!J76&EAL0Ji|Jp>NHZoDMDc3H z|GnfEj_Yo8S0Z%dwyX=udw6|@i`nV36$W9|1qil;!u2u5^Ci*U;PoQeDsBY=t1RWK|6(NN5 zCwjm$MBg2E4#uOv{w*3|7#@-r)2?(E|BNMb2tNo#Y)6iBlWBE(&?ae;%Bo;gn3VJQR%lx@FjwY6e2oa2vk1Qc()REH9Ai5jaa2yOOPO24O?tfoh zN*AzwB)mvC%DQrLfi0qP>P+dwwmXj?oyJN3b_OTC0>?Gig?)GU_q<;yh=)`7ODTv4 zgmgz#;UfQV7eY_wrWEz>vVCFMRl@@p@|Y6}HYe{{i3HOa*iy7ohKk_^Y7yBlfMhZ!HIa7vFS@ZE;u*uQf@0*#D7qfAijOON>H>UG+O{bN z`4WV2ntQ;SOxwN^QquX)lSNQ0gf4!s{XKd)gAU66L~^yDHI5GDM*m@)+5TYv{JDv= zX^6p1_u{*JR9dNtH5p1PsH-$TRR144+;Jkiv@{*0P%)=^t_+G3P?z3GjkNK#csz-G zjnYGRMsx7Ae}@mV(=fWZj6WrRdlPXiz$xVy7K4<0&5Qj}$2cc{P5p2`>2mYKwvSss z{*D+GNj-z9l9(XdHDHOcIDx^tn{Et4iat&1g#m$rbyXqw8%;>kc4NEha+-i^rG>`* z?Nd*8s}_T{CTfXs@TLnl5}$^)ZnscqJm^_s9bmH%x|E(9{Uf8rKH?UfGDJz=Mig!X zr~L^}&cZYm?Mkoj>6EMm&h-f|>I8sQ--lXB&x4|29&XP^l^MNApM(50)8KL)mU?8s zN1Ny#C9eEtPVL~ST~0qGhZHlQc37Nyb&c$;Oo*L%3uDjip~|O2_+P_^#qQ;M-w^`( zegxKTc4nU#^3V$%x1QLthY&EoatOcvTf(SK{WfI@5@)xn;L7+uEuFQo zNbqB)LjrFhu4`ODOC|nZl$>jGeI4GhGAy7a9?t0xX8SFu!&f&>;r^~}q8Eb;~ z?Q0|_5x_S!1-NBM*)xAj>iORUhD&{J(jU(4y<0@||F&;-75e`xD6*Q*Es-E zqY6k&W%Xiuj8)fF;4!d$l6as=5b>EFE=2tHWlo(#?)H~3F~Y%4=bT@Lel?TQ!7gkN zeShShX=0D&Kf!ADOI&=RQTw7ADs!nKzSpBqeL6&@xr0j*AHEIHEj-En{~ z`;JIKju;BvfW2-nETQrjQJ-GG%D$JJRfE zpebtZ2)%=+ce<9oZ^5%qoRaneM5(GPHS7orVDD(u#Z;5u^hcX1>xO`#D{7#CNb!QW zu1zPXxQi6+59AQ%4#!Y7{T0Zr47Vr2*YIhSM3m0mZxX>msO~>C-?!=!5Kia@_2yLR zJH%w#gpNJMp`o$pZic`^0pI7=rlgYvzf_urrTp)T)joK=mkhscw?y>c1pw;69{XUR zwH+&uhHE^*Ay-jal68}VoQ~NHF4AR(U@`ksMctFk%UWZRX}bK=H-4BYrT{uk%y6xm z`5#9aT~%eD>%AqtMzDSSXv=varjF2#Qv&jTCbJ@tbSLQ_;F_$KAo+F3)3rAs-?R?2 zmqf>Gw6x@LH@$9HBET{q2pAAJ5Cjk;5EKwJ5DXA35F8LZ5CRY)5E2kF5U^18f1CgK zUmX_w)y?SFxz z7mzoQ50EdAACN!Lc0Bg+Zk>T_6yZ8D5mza)j`EA2<;KZ*p_(L2;VBzYtK=9t;q6GGpyTJNQS5$ww$G)}^ZZ(Pu_qPa%w2zn!u^iCc~oy-twhE`IsVJ&y>BiviLHZc+Ww;sKc8AtVtV6_9#V`z#A~9 z2b{}cN1k@KK2&iH*SY(Hde*|#u}V0=pv91!=9n|v480&#G|3cdtv2m!$Nh#-NZMEy z-F^47bfLb37SEr2js2HKN11rkRG~_X=CC8+PYndyaD)OYTrBc?9eiu`nMn^~-OOCf znNytZs!*x+OWqWoh)XG<`INw7SA@i=oj`J8EOgtwmMqUvOB<+7&!u%x(^k>k=ls3U z^J=4{+CIJ?6-8PL!TWfrDvNEVWw}3&nRb2*c7Sw>38^UX?5hJ5vDs? za~Fx!Ut3{hzVhT*H*f!K_d)_9X=K`omZT`oig6`j6cEu+5Q;2<&@v6kD#!u2JfY;G zl7VDHtK|Ylm}8P6qvvMI9nCCVlL+7cCI^rYcz7?7cn`qMRp;4~P*ihkgC?ej5|;4r zD5{xViqF=a?Oaa+8mE1CyakAsTrc=%_+GM|XF6Us@kZR)Kkf}RkFo%|DLm*47Q^un zQRWEY2p<_M_1od5jN+B*NoW%)u?})RMP zv`CKwA=Ls`L*<*`{TKEpcHw|2Du*{dS%tuXV_IQ;4#{8dSvN)gBdw=syOp?<8`vG`FgCRwbh z);6~<-gU75+_c6`^NmL_)8V~jutlivreosBxm^=cdMiifh6P(9KB8iTM;%eCRR$SN zA{NK^6OJN=P;1v@0y-ndnB&Db)*YyHsN_ppP!!8n5}x0YLVtWV0szlfeR(;rP1ZO@ zTgzMo4c`}9ct!#pD^+KQcXOX0qP{;>q5jQq`>p-ic@np&9F7Ve3HtP$EW* z3AdGPLYB7jtUZN>7PB{75L)=<01PLD**pJNS#o34D+p_X;8fTgY`=i_47kZaF$;F zh=$Shw+8obxsFT{2;az!ZF{=KHWCOwR=ZL;=zRFL>SX&RGs0lvm=#iW8TCTP_j=R} z^rEV*#mp&5sg3%?>=K-EG{aOQT_m@MAyc(?*+4%uyP`OyfAt5&FsO~{O_^=g5LU|b z#5E4wR6dI#+Ssz5YE9@5$g@?Don$j=k#0r0@#cS{W6H{S15`D@E7p0BxrJHk%#4go z*m`ba1Gu5W5RmPdqC?==dTSpVc|Pi_Rwx zha}Hrvo#-ZS4i$YO(&pJ2A6$cG z0TXHb{VXI%YFya!imp{+JLH%f4!^J^ji;bYiX2}r3~7l}*piQM-0t_j{S>d4S&$|8 z^G<2x#wcK_HdkHbd4EOCk_SdK^`Wn5lEyv`{YRR>-$K}Z_=ksVo>NrX; zwDJNl4gdj749Yt`2&sM8o*Qx{)J#&XQ;iC{%k<#CCz+zbp@VipYuT)})zvFdb6XY_ z2RDm&!9N#4L)x)+Ke%mZF7QVrGeWDxAk9^l(b&*AqZ3rr+>s)qP&={`7laP9Y%k6*6Yff5$gYmMbJOxS`d*d`ocENYZxB~bp;!hS(bo{d z(IDar>PrmJ4#1}U=0=R>$8a`?n6>Tvh1^H5a6W*jAsqnh;spW)0R;nv0EGhmFW4Lo z6af?o6a^Fw6a(~s=Kte?+X+C4KuJK!Kq)|}Kxsh#*ZhALaQ^?-{Qm@S?f-x#f&Sm- z|2Kf&{eP1GKLMV93Umf^4s-!@3H1MU{=XWkELl(NkDxuMb}O1|2JOkn07lG0GgX%( z^!%dFvu`HP4fDK@`vuF&cGW}?oZ+RBkjZP`>4RDOq^z-jV~2#?&*8(~W3`RWW<=Qot+YE+~C@)XY@ zWy)5J4$QL3vbua6hNictl3*#{9-8MNJy>qG;cvjEj?v$orhtBKi z*M3M{Yc5oQeLRs9tf@V0?Bi|KP}-}1IFuFq?ovuU@72=>?M|0wyil9`5#H%UMex5Y zn0HZ@)T_GSQ0qxh{YKF^>gJ)ox-uCY8+;NknB9?^F-zq)@gRNRGGQ7i2W+OTLpKiA?Hha#hCONTLpkLXERN8ayEzfo|-Qhvk2 z6En--)azYd);=gE98|j0Hh5rXqS^D6SMASBYV$*uz45s6_<&TUZ$H_`FSQMG=@2d? zvhX6rFJ%0QEZWJg1T@Mn)Pyfzn*57j`YIe)+2P9p$i}GBhl2R_$Ig=*2}JJ`EqaVax2G5 zuUrczmltQ!fx$z0iKmrouQrdg9^BsV^Lb0Xm~xKAYbY@oSlILIXjiu$_&*^njN=(0 zEn$M3AN@3<_>jr9 z@k`X>Xsfs4=zG&G9O0}TwGVxJhQGe(rMEA1l9qkVW$4FKOUsuQK&rIm$rv6i?+M@G zqHTk;;gZy=v@_*I|7gWzR;I37;jYVgl94Yt-)injL0@^e%r6T7B5GpEt-uV01ILJ; zT%X<56}=GJPmnQsd1v|i*jJ+7q_orpEX(OWj+%?PE@7~04_aeaCo$#ySdz9`fB$YH zB@*$Q={kE;<6-}2zIMWK7$zA;#Rq(Yn=xY1hQo?^=L`61vD%>%-lX@vh)XJZczrOH zXzvUkL0qwLI-Oic;;G3Qy>48ydmx^ zdsiyif1kwp6uoH_c*=g$X8K`fj#jU*=WXu5ZkN@-P(6P;_)ToDgQ@#Ka$}tz&IMdd zpt{t?J893Skd3U_OHq9hD0dM4mSCAyOL90h)=?YbPW07`8f}Y5=`iy9w`qH=!eA}k zW+q^1KNyl2hahg81h7NvEpB>cnebkq3Kx2_(EEZ*mml+Cjz4h!&?%8=5=gas`V-HO zsDvkaB)I4qE*((rP9{)MwPM)Ih;+2;D(5$RI~>mwtGeEoe$01w6lrcp%bVkxP-wSIa_BDf!W{m;sYI45#9m3gVIyNmW=8)Yx zZOqZulI+++Qj{&@SG98g8EoRLN3BQTr`od>_=9H7a>h_{+Sv z;z_kxD|%2?o$~cg(+?;9K7qDOAA)RGCitDvv1Pur^RFZns#l4OY7$;`8Fq$5Xz1lrz)e{qPWoU)+3wf&gRh)=Nh@J(adtc) z?1f1%Puo1YK}V^y>jx>^?!-B_b0Yn^{|f`jW{K|j^a{6dMCA>@dK38Db_Dyl2MCqX z&{v*6vz8F(QERKhKMW76;+7*ISu)kJR~Iv&#nWpJwoR@uibLUo{1j`tPn1z`A&0+* zCG~&-c{tLe*e2W+a_$005X_=+gP-_4V%PfXAe%Yx=g*$8e5r}8Jbe!ImCKbur;dBZ z!D>=Rzo+<4wF|coVQF(ose}m#>3uroI*14<^ac}KpDa6L|Ini;#H}bKy+N2g&pBrGOyL-hg z=h$DZo#X`w9jUb@#&qUjofN`4#2L?My{AmPJ)G>$ebIX+Cxji7lYd!dNSj!_HQ* zd(P!-MbWSnbet^mFd%>*Mwaxrbw7FhETKY@q2jN8$eav*L+18aedTCbBaiflr5VEf zBy}Qca%1~8MsWt6O0Yd~{(5n0>Hw4f;rV*dI%Uw5aRoR#MH(S)8iqr&EB?Y{-T+_L zsj+ZAD!4TRZfCyh)OKefAsbd)4Ra(^I*H#b;REvMS>xNBW02{?OmD}iE@v!k;J%~C zOFHnLTjPfLKYrg+!Ustd%!sAc!AXMcNUtffGYR95t|j(gcwepb<~u{d{aJy{Sj%4- z4C)$tm0AD9y8*IcWmC4XuTa~ln7M1nE{ls{i_PC=CDf6*F!N*QG)F2zZ=w!;E|d?h zPc3=^!AhO;(`KvLifK}BQCepQD?86ejLn}!|LL5wT@qjYH>g??rDLzgGj(jN?dzY) zg{bX&3sySVg}S2@{x3`r2Y{~7R?JowsI;nU1>uEqZp*;_+t#ckXX)F`@2VdX+*6C8 zXx>bDT`v711Qh!bAdPq2uc8va4rq^U+jWJ>4Z7`ynIZIWGZga3+#?yD(N~Ph>jJTd zvxmEhy6uIzvGZ^r?1J9ryNw;-g}cG-HWp$St1Ud^kU)G?=_ zKnrtmRlo3~2KDj;F@v2-9wSP-j|67H8%GF@5n%^UTL1Ybg}SQM@xRjdBx1^G^MB&x zru2DF$JkAmG_{dsdO#8g{u6wH0idTijws8LnVP^t@Jhpe_GK-%3Z_pmH>mFQ&$hwH zgg)A2rY17M#cpDpoS=Zv@+gI)cC*-eyUm1}LGU>4Q$d(9@<{D}xCP_jH~?8W*yV%U zF51mOw4bHPYw6#BvZw8?xjo*S8q5mf^;yOq^?Y};3`iMCihySlv$Jn1X^A^Nm*etIy!*vGp!e>UQvO!t)F5B|5S)%ME! zitha5`Z<37_2kNKb74K$Qh%Rop6CQ zVXyr$2h}Q2)6bhm=&4KBJu4=$rVJsTiJGI=jD^fVnwnajd;#rzwZ_g0M&7*w4!8K8 zlvQ=)0f_5=UE=GmD=kV%f;F#4t3p=8k2ZQWW8>dQEu`#O6_|N(*p=#=tj~4ow9AK^ ziZ$&RM8)dOkDNk3c0)0Xkrl@1R>O79E-S1|R%NQHYXX;;w!KzyF)mdtSWDXLy6_`g z+_X9zfIo~S6)icog=SI3R2)B<)-CxSb8>#q@z+Ml6})=YX1(ug@V`b>N1h&`z8!`4xltj-e?Df5ZG2y4=OqCfivhn<+au=xC}j zK7R_2avxo7%wD;0X4*4dd%~rAbQvIAgIY!CAUXCI z-sK5~S4b^Re55>OPEx)L+th1C5ik+^l(Do<4f4nW(vuh->1HVu1JBS%cRB4(4&nz`|{~B0hqJ)7PCAOezA`tSrJWO`V(&h80(M9JGbj}~lGLd%_ z>jV7pZz0%QMc@)Ko-{53I4EH!cAsru|iUEy9B%eQP4Do<4#%aeOni9^qcfnwC-zs za>dTV%4)ZlLH?C>@8j8Pw!*%XX>B^iAO}O-=_SJ7A4mJs2TOSd8z;qGVaO^fU~^~z zt(_pT;FZ5rs%2p&#UQzLS6k}31z{X+<}q2bwWW(!R3>09);ENE@Gvqmwk8_Qk34d+ zWmA`@Mj1j&v-|OEax`!6C58x+js(&jYJ=*qhQvDa7c_b@f@Cf6xJ7Kzl61AEHG+g% zQ8!qWSdM<63cN&T_g}GJ#v|i2amfIddHiTwgrhMz*7!e|(>xCZ*;BS~Riq}7;F0t7ibEs%wzFX(6!6CL;v!+z5r zU!iBxi=+^^4*frJ%yugi5I-ib)aYO@cnJzc+W3E>r8-BLh~Pt`pK;BE&F~Y}X*D5g zqZ9yON`h5^KUydzgsiyD@sF=!UohB|W0TZuQq}>0V32oHHqW9oU%yr26@!_sX}tG6 zfUSW8+(vI)ufLM~D+!BD;n%#$N1z}7^oj9t=9^`b{I&);ifY913F&D#=a5gBPiX6&6 zMuH_OO0(>byxevk@vD#GHa`8MoBbC`_$QuMdcTpeFT7tG?e&Mnh0C`%w*%tO;&a65BCtez!1Ne$oAobWP7ij7_^<%%s|Fnhs~C4=9N;A1;Og;Wed{Q ztBcu-y?3oSZ!brjO5VRfqcUC?^yDxSQXR}0@lw&5`WjK1MJCRJj3G-MFNbbxtZBe0&6VB?J$)J zSx_NWGiXHHSVk#T+@cN!0A!|>`9pa)W|R6X{UkGp8nPg>UGRLJBbiH?>8!W~M=cuk z{azcK;@v$4{I%G%`Vn7cw~TyCo0}90IGF?Ommw5G_UtH2==EziPq*K&C+PB%Q!b?5 z%ulhm_rp4JSv*Idh3mjoVsYjmz3E$Ntcp)Bf71EZ+~s?U$=wraMsU*_zH(t^!s(6HNwP@X=5sv1kUpXpqm$JdQ+;k3psnE z`7Q#AN2MLE;P|iBH?IYHrmtj**Y0btIE}|rQ1Q*l?EV97hB6tZsa^MSV|~&`AVAy7U-=f zhGpGTvtNE}fp4GQjsb8`| z^UyHd%F2b|A99r!AbsWP98`@MR`;NPN8y4B`bh}OQNeh%=)F+jEW4?kJ9IFS6%C2? z<`)V`22j+gud#C1AY_4s^YOk@gmUmuA2i>HuB#rd>`HIJv@R(Y0csnaARJw2M+A7? zuAqGxB=K;CZD|^0tNs4ey$A01Gn%Y5~0e+xRH&hV-d#Dmlcm@lfo4_?GzKfyWEDq`UBwzS_1wa4A`uWtOMx%~ho7tjS@ zP_S^cMroa5SUE%xi*^jzUVSG^@Cwn$&b*xfqgMti;0oSP;6~|$DzHxIBE|?(q+=1Y zrzdS*%}>2t8#Kvs&ZQiIvo^k9T-Uh}f=1P6hN&yY3?}_i6H-5ZNO_(i`03{=D6i}c z4~Yf)LhKtX~olo_A{sK#x2faxiSN>T#H>DsU_6IV}@I) zkEn2?QKx&FNR&FQQ9-IUJbg%lq}S2uU#THHTG(N8vJCYX^Q>3CX`;>`Qw@(sU3w0* zzD6!Fq%}qgUk^`!$Ftqe7~0vy!h&YtVo48q?77F8c-93*;11XOEj6@Mq-d9Hkotrs zj2y<)b_@)&Btuy7mAP|%PpHZ9Esrq)KO*vO3P5S@M* zJh*ZnbV4Wf4EFad=tjy*KP30w*!JSnedwOywa&r8$)`Kq*n}0=mtaqgRpX8}G#D_@ z)_AA4#u<)Db1&*a;b<<(jF%Jg!Oi6QRGwi8q*MVANnzvd)+3FX^xOr8Kae>E@@F6w zws#n}Gsg0YqP&GNl1j$iX~p9l|z?P*Z* zI8|5O$R1b7u}?U+!{Bl6?mq}-cVF1E-f%*Oy@cqj|t{B#SV*gp&Ga!!Q=spgA zXM0>EUmtkMfUz6*TJB|vz@%m?+y!zn$q)vt7*Or*XhV74o`=1-k+iiI3LPFv@n)uI zJR)V8*Y{F-p9&c)-Q92Hx=fUuN$lTx$sQ1Pd%@kbiPk0Jnh-W=dkN9*B{@@n4~Gq` z!y7ak9Yq}IN(H&5vOD@mUj2Zf7=DC-KsV2)W^$nq`&1FwUkOmMSKgsK6HikhI3ebY zv7QPPQ)=R{BLIxS9N|6ns1$onFs6P(oD|q`9UxYt)x-@>>R*xLM>XtrmK5nIx*bSs z!5X-hG=^}Fg@E9HKgHpGggt=5)7fo;;HqzB3kHeR@DVYClcqPP4}1>K;2mxnG?6?c<3#!5{ri)#d-FFj|HGiiMeO-{+8xQEg| z0x9ijt}>%PxrUP@cQdX4^u7W1Rr_=4c4iDH6CF(~z&~7GN00NV z&L}@R>g&(~UK7CqBS_T4PMTwDeU%{S0fzujqM(e9c*rc&&9OzHzDk8V+i7o+ENA7v zSgNWxzmFv<2J8TP8Z_4W%s7P)|T}Z0jUy#W~-U%IqzqHm3igU6kSS1*yb@Eid*0DU{?nwpQrx z&#lvChu`pyHv9_!T#Gn=$%3g2XK1~R{F0$dcz$>;drlc_TIXkj%^rV zp=BYUD3gL~A-;|He)lrU-x|`Sm6E62qdfRbbRz^^bk(18sn%6%*!5~L_{<)IxIv`T z^U(oPIeT~nZm|q`tAR*7*cNpX4OJxMlkrxQomJmJV1{#Cih=l&6JU|bAHc}GV zC~P)e+ZipU0!t3o-puw`$nD!Yz4y(ec8RATmA5{1y;i<&Z6jtYjtjA>B?Ib9SR(7) zqL&^ zaL8Y0lWp@rQ#F>Y5*P;R}tn-1hzD z8C~{YIvA^35K23a>8*B^6FpMXjZ3#{*j9cEmw-Y|xRh)E{wRXUUF)Twgu@XB9`iwq z-n`_!1kabRC`4DMwe#Kbu%aP{zfk#StUaqg=@Dx^R6v3=0roF~Xr=O$!DMWC{as8; zaKTbGO#a71ACX1F1qQn;r4&M?DlK1#>G>Q6z;HZR-BlGxF$w5~m(e(Db;3Aoh+22Lz2xBJR-C>`kh zXN=}fR_uBt2*WtdaGHpdnEVW)7V8qzE6zh%vU z{0o>bI&8`w3r?dQdtFib@kKYT9M|3bLY?@PUcyq<(zN7)ZDBcKA`&w{!a1A+FVvl5 z&V8{~gJ7Ai!qL^z1b&vcSR>iKZ_WDcuk|!u`wJ6!&_vMU_qJ1h%78aG+=vH&n=Y=f z&8#6yzj+h^BLJp>rZVKf4qsDmA&}@cNy7*n4 zB(vHPr6;b4D7!7Nl`_+@| zeXg!Df1BB~R)}z~^z9v#%izxNF=(eq%b|^bZDlDG?+#fXQP*5?1Y&?6iLrv2WlJSv zNMrAdCJ8~(`J?)Y8h1$+kg{dh(9f7_3Cf%iapu*qyB=%v&@krE?cC94Yx|D-Bf0X< zR>F=)**|lui0T|g#gIEGLS<*o9)V@kNMqYDOA(OmT?}r2h+xOL52~}YB-i-sF*Lf8 zmJ(vRP!AX1oeHNw{W-oeT^olYg|9~@Tg$lBNKoMlFr1#!q8sdBw+edP!x}croz+^O4g#T+@FMr z?>IbJOZWsDtEvtAxjj>b3Fs4*N49L?sPsnYdxQx%$l0|)a%%z_X3nD-V**;oum?Jh%1Rjh^o(t?eHXC%a#mX{bYZCs z-r?C2t3vXE_Ik9p(h!`c(E_5JsV5A8&>WK6q@sH34iuUu9mSEK5zn7%o}-(r*YPgr zvQ;&q`DX&&j5MJ(*#B~~`eH655X3tLHLowH6je4FzFKo945GL5LfXK5;{?IPil-Kw zQRYvL=ZMbnm|(!r^i3#t7U^`w$CraCwU~2!yhi1?{wQkd$I4+QIWqF^_@bXB%YMN- zD7&bEx>W9_ z=xgG@(lK?(u)iCR>xh{@>kjIGXsiMGV2KnW;cfC-OumwowE=}t{WR5_x~8?IX3fCX zxZ|80`@~_iH;4WMP;&ZNmSzO#YUSLRyyqm$33H!7Fte8E(l$z3=hG$oF6a_JlvXU* zmMhjg+FOUxdD`6;{}$33us+vyg)h^phgCKL7fWgm@E>_?-IjwC(LHE^`D ztAKbR==h~w6K$KV5Q~+K;Hni=(&{O#rK*z2xQ~Ihi5iq<74$-Zl0L1;>D$@iMic_# zt684|d9PE9Hb!S9l$W@xT%|oy@$kAU40C%9kk|TpFanqUT=DZw)|2766EDStNBN zS)mh)i=oIFuS3gq&43amw`Pd%r(Ovr{Iuh{_dsTk8+wB*JmkF{QhKMSlD3m%*x4Sj zTZ-?b{N(6O`j2pHj1XZI6c%2F!$!b>Z6m{`ow{&N5W4$KyL>PGQ2_@gIR4s1RhGwo zBW5;Jr%@!Q8A|RKqW05z=Trm|QUXZ!0kc4X&YT zLSUa=gyb?3GU_I>qPuey8+=XO5-}Bf>BGqCPH(Q3`*J>;p<7=MW;?*6x%wCIymNURuo!jqUR&AEcjES}xP&Wih`zRe6c!Rm9RfegGfBQEvip5`~E z)i?V>*ctTHI?0N)_ez|yQ-WETg4v#GOWO!X!EVp+!4}31 zP_yn^pzg&dC^v9?$Bqex(e+?vq&#UDGEoR@O^1t_V9ir0N5X+TVZe z6AZiA?!$U|6dIK;CTSqEG!?PUg0i4D(p?-#{spxFq$LfVMcN7dbz|l_$*_3d}MG9j<7>qN=rFP~VGyZ_H_D7)TZ%A!9-GkeF%BkqiBM4O?^o zmK@J|s|~#}3>(!R9ElR*=5Y@$zcnNjbO=rT3&Jn{H-c2B?pRfP0X}Q_kvCW^PYwg? z``JA2+{qNv7*6!9zd1t*H&lWJovpJob0vH{g|k0kAy?d%_VurGARvRmTxds`9cc=G-qQ?pg~NVJ0-!6l|kCHpukP&YU$N5kCrg zag;)1WUPY=L|ng6Pe3ht?Dvy-l{v3vDeB4~LwM&^x|uD0rAUQnoL8kX2RWv@pzq@) zFpTr`lvv%?*36#qylvIsSPNj@s<2*}EMy9zlAF61@LvY<|buF z%^XN?k|W@ejyg&e;!o+(;%esqj_y*25|2q%uC(aLVjPUiw}H^EcuYT=Lpw%LB740V z@?4em(<%H=GNJqx1}Ts^BBx>OA-dtm7>su|<{7$U4vvp$znVWRovFR}pHJ~i=8D&p z{M>)sEsIBO8>2Y zdkn%m-HU!!HcSa4=P}V^PHF9zowI&Tl~k}K`GFP$}Dg0Pg1s#*fzW- zj-{hHkQ>&L@md%u^hXQzQ3r=Py*sl24nw4S$&_-~w)!Ps2K^cLSHlK!v2I&#c~6+> z{{cxrw!b8v_)zbOjBU)$9dz~Mm_{yl@YRp$cz9Slr55M&xJO$T_890-m{s||Yb*Ax zZRP*ZZD~0dA>{~XNYs`?bxIno&76*y*o1&2o670NRrY=mMne27%(RT%S9waw#1w5W zmq^coc6*SCGFj=ae+CK$TR#tN{S}|X7z}`_iWk75Z!cMiw?m;uxCMzWU&j;~znEXvnF+whR({I+e2;Cud|R=j?vq!C(=;@X>))^+2xE;x&bR<-0& zRCf2`xqAp}8y=-+zGoP?GztI63pIU?#=VugF0o;#PTu}X-@`mJSvLpaOFPB3F_$!E zo7msJT026&@v5dqnq8I5J_9ku2#yWdDD?mOg3+IrV=w}imT;Py5=pC~uly^-+IykZ zm|>oNv3M0_yXf6)!O%vx{|cv4i1+Y~PDH2mBBbJli-P|%_SZ7<^*zM3SQROmrhnDy zUo-TtrTW(#{cE27Rjhy6^{+DhYm)x8vIs{9BeF5VlSwU?l8D{Xh<`r=K<12$euO5i zm1VA`pZ?3B<&$c3&a%?CztH2D-}jbBq3pzJdTJV8kXFQQM96N^y4~=$D)+(^Qcb_O zZO|Cq#I9a^4(p}W5lzDj(Eu-*^k<*5OK~7On+?e+fiRqjPYXskJ@~W*^d3 zvHONzqbJ)jp{bL6En87}jBFq6iiM+56$zK|&6k$e#1oC|b3$Q;g zwiii*Rk0VjpxuH6Uw+zYP#G<-vO4<#v+P4^68vxD!ad_WH}bpSM}>pd96+kW;?#Q; zgP4IqN*`n2tUkuCwd@;%mi$+d2te($+*?FwgsiOh;6a@w7$@Q?+KxK z0h9z(g3uZ@)jJN421%0z7Up}-J+qqx>~r<^&+mI(->YbLX72a7=YBco+~<7G=pcrr zQjR0o#}%Oh8w5Mm;00PRm(hCO;0fhy zC51qcmhQv`NKmJEtI%O8AvZ(dPHYLxq^L>;VvL#sY2e3K)66tAZw}a3 zm9+`i=qPNJwW0ziphRF?uH1!Ixe*F25vP1RlG7g`VH?SWlq%Nm8xV9T9-|=I|ehm%Imh+6Z9%5(y0Ffle9F)*van6PxkuQJwLEy9%&dZ z2`ypll{3*Ng0$4?Ji9SoTEze_eSV`=*ryj-<~Tpx_&N6Oy|`L6VrP|oq4v}3s86zj zY*MlPxLn}-Gxm8_ke^W?4G77Q^3q$$tdVY^Pp@^PoQB#BI!Tw=m21}NTGS?vo)%@c zkR@N>>djQ_!n(fs96J9kWJvP1Anr2#KHYNM_%kMASOoJd0W((o2RDB8V2jnb z&)K<&aX5IB)T)_aO@MAf7AZ2eyz^8U%FJ8wND-Pi@FfiZit+C_ewN>df(W-&Tz;Rl z)Py!}4ST7;4k6~GTnabWV?66T7EDK&x$4!zS_cCWG&&WdZ#RAn?Q$Ni`c(2qBwg-L zpbMqywdl@kEmA#lS?&`MM4#*Md3o+nqtD1{$%}G-9(|^&Y&YbFqR)@u^UU1Gqt6I- zASdPi44>oRxd|7y%C!MTIa(@Kua)EQC5x1!k}F&)7ThOvDpV#%sj<9L4H+n0I*R013d_d`?+v;7J;d-kcy@MhiK_PC z>z`>nM8BT9vZ67zM?i{6759zOOtb{^+vW9nu+r(UOxg?zhl&b>%7=JNexo)fMb}9f zmRF1&mUY3C_zYVTqweQ;_#0EX=_9}DhcTyF^*#0qI!K%Iii&>C{fLOWC~TQ?kP04I z@-ThQgXcBy_KLZ2Wxfu9^{je+xfd1IS3=uh$9w}BA3n`Xc1)m4p%}+c4izK^3}OKz zT2_e#cCo-DCrY=8)r`1EEVGMcrn==;!$h493cfc_h2#^e(oH(@)x1g*N7FUtIF!-dv7FZ#SV&MgpX7#)8D zdXLjvCIf{o*p%>E`imJ9{ zEUFqps7Vc|Y2cN9jp73z&|cD8R@B!13%a!nxwnh1ZZY`2$nT~$3@swxC-VD6{w0xr zlO#7Qii7Xw=aIM*s)mhb@vTjs4Qjh=1cQIatfwq(asW=8tnr+|}nw%^eSLFP0 zMP7ATk+y$XWG&lp6$0u1ovlY8i>Aq$UG+yq{*cJ`iu{X>#b2=XU&jI6Ed&qgME_p) zu}|QsY2VzmoK>4AvTyHWn`@td2_^KgP^t--=N9(u`qq~qC=k~gHkCSCMb~5OkI|2k zlHM@wi9DU)?o&j*k@jy3?P%!qHwQ}N(4=agK+?EH0x@#)1j2B$mM%r3MkCv>5Y2v`K^46)&P`UU*N#WZ=Xn*2J5%*mutH`AzfM5$2}j7q|&wQRiwuMe>G7hx;S zd5Ena#w*X(e}&gAZ2jkWT?M-jszdXSp~4Q^yw8Kf{;IiDsjA8KMJYE;a(9RLL*y(F zb4|v@^({CK>i3}{nHtdt5d+)I>h}w;Wgp*&LgIRv+Rb^{$6r8Q=6eK^&)ML6<}F3d zy`^l!-6rUTeQ6!8Mrw3h`~|#po`dfT`A<>kanXNLbZuor9n`R{4|z8#Y%Cvfk@*bI zYrQG2*8<|S0Lk4aoK<-9Yp6L39}lB#jQR=1;7PWAHzF%t1UB(a{XlYA#JFkHh>1YLU;rF_@lJzIokE>*vDkFf(hTx{^YmRj_?5v7U=JDvxM+N zY{Ow{4@zpGU5Mz!EyMmp$oD+yR&~si-7n&9#nyjdq)F4b_;Sg0s2n(1Gh7kamcHSD zXrx0n4~m*VWtybCp^Ft4Q+p?=#3Xbu0}sLjpHzG9e!ft%vz8Y*Tz%C>m^F35KGaI7 zo+t5rb?tuY0j|x6yIWK77eHvg$W4Hk75S}FuN()tF>&TFb{`|UYNf)6=&GmsW_%-z zK?N4@;QR2fHRP)GdX%g*gra`zE6UhNK_cu=sr!OjAy0?l#!tbVUf`H8Rk@m~w6r$( z#r^y=7$(u^IT&3Si+0ZA6R^WjC;=nYJFpQII9=%55Wd}R`AUIoV(T|tphKtrGwgm` z$L^tndH1!tSl`>IoUjWLG`V)0irQVB^BY}V9j^VA4uv*XyZ-7y8XJ)Uu0^I)2F!m8d_>B7{jGYuHJ1c zJl+zLj%d=Y^M$hx(Z5v+OCMDmjqcrzNz3I!p$5#E(Oy8SHi$0RVNP;)p%g-Tuhuc2 z%U9edCHKj8{ro)n=4Is&V#&*MzQ+$`xK8$jDx>hXWcYhC{QKdHSow*t zb%tDryuc_f9H9)N!ta-Y7#4DOk~<&_(lMp*5nRN?vnAfZe2627YGNVyCREj`eU!asp^gfI>H3>}&Vx9Upy zR(Z1EKBNFa=RWDdiaL={#r?R7wt&MHq+x_KthL}p9hZoPK6h+KR_sOKf&F`%jP)&z zt}ozIxgV2)?>BW1%mFTl+;jwWV#c6u4_poJF^;H#nJ$HfV&I$2yHH&%Ou;up%XFWK zdAd6q^K|RrZ#VpX1%JcvHxI&RH|0@ZKNLRmn_rVZb$^UM7uSG#P2y!{;y};$5=Z1iuG@d{SgFg~5t^uOM znTy!i!4het^>YJ-sy4Pe?A#I!8=Lizsacwr5u@Vj7nJ0xIT}E=MfEg++FlyQwT0aL z6dE5;mmDdULiw3X#Tb3ZkjK`OjE_*trpgCarlXHdQ^OJN0Tt`AzJ;G!caEa|Bt=nw z%md$nc9ckGg>$BjH;o(@J~49EjGm|&6F)3>cJ>=pD;3RShJ35jcS#9v-7DKk!GYw(e|;*_BNvrLhDmLdVVz)sv0x zan=PA9Ow;&W#=6_rm(RwbYbQM0>##M0Vm0G=}H|d2|w251; z2Jl~-b)$}IwTq;uCT^O6o6xG6w-G5n0y%H4@8{B=rv`45pGUz2XOQ0w<)bl*DWkP5 zlz%aHcOiBc(e6|=9G4XhL}0G7^`Afq*><-6I5lu!q%1oO0{&hYRvzU;XB$5`iUu;_ zT@+CbyhSxUY|ijz168fAoJ0;B8eL`wohb(jc{i{eG_krI?veCX`hI0IV8$3qD5{1V0ID`}BeVUdl{ z&MP1q$ZpC(M#wx&GLTOt6%jd+T1_%!dnR)6^ca_IMud2j4x&!i4&30IU8_@+L>xg0VY20xn8>-X zVr?Sgl>aPCljUYsq}wr|E*fxEMG6hr5Dl1EkxT>DXaT%YIGiVSv=XDxmz@yCJB!d4 zm(Zc=Q3<{-+W2MtvzEau2Zo$jbW`0G02RsX3dB)rkZzXH5kG`9o4Xj zFrhm13>9ra=wT(WR_c{HFr%;Hdq~Ok!i?GmE4XoAYuFH4V*Gj=5`0qYHh~n(_;7`X zbmZuC&;l1T`J-(n=+{1K3dFGHx*DY=rRa}e4Y$eDbuq=-DNh1$o3Hee`}kRpAw z%^05i5xLfh98}mt{^Zoanbb4qj>DQp!4OnCKI+A2RK!F2#z*~Bje-fVjkZ&C5y>@( z^sdV~`J<&mFilTs&1BK_J~T~qbwg7`*CB2iL@E3X2Os990_o);e_yB;%t)>w+ES@Q zI=bfGG8N@wy@G*{r0Ux}2Pf+T{!QEKy4m=WLMm^4^-5p@BovqJ^? zfZhXK4*6zSRlI@0&yt5bV;a!I^5ll$4i_TU=s3o!@U@sfQ)w9HP&%-XPhp#l9`Y#d z%2MI$JUM|ZjAa*s^+4)*$;_XjNHs*QAUae^@6a7g}+rnY3KW~pvMEz9HeAqn|yCTuWT@d+~I(sC}0S= zBSjUsI4B#e6jbZKsk1>m+-zr?U17G_eU?%S@>D1l@e@*QTs+%cn~G=Q2B}Re-aUvY z-U!*EB6Syy1q%225T?XENbbZY^Fyk2+a%3E{898gS2`f6@Zipa{2Y?jF@DJnyhn#f zwm*Vz62>>lY>_J*ek*r0dm49V2@Dl^PLqvoJ~zDN)>IRB#lnd^)8x@FEYfr6mpgkp zmniL%O$#RitCDT!--o|swpl;CWIm)e=R+a*!|z$sq#y1@6HB!&6`Z^*`d(H_L|?19 z`BUAXA^vD{8Kg@=b7W6T;4#1W6CKX1J}MNetsFamOk_ zWlO2ZDxA|7SA7@8L!Uv~)d|a8#x7j+oL>fSm-3U%xYkJBb)V7|3Fzd9&36a~BDeEN zups$IF2M3*L;H?xZ_z~upRW+k>-kB-!`9RqtCVk7TVjEhZ29ZBmb4v;w&VbOwFg^_ z51ueea?_L9wbSx-jZ>SRym2es6gK)y1%hI%`n=teCbXO2SIW0;3rtueeLQmh)%gX| z*MYT$wnmHLXhGxD_5wXbGuuWk29M1gR9zTs%&#P)psg!X&`x*xrlG92&JuLcs>^RaqJ#mx|^b9DTqfIcvt zocKmPQ4kAqIHOdZgX1JHy@VXUK!*xFe(b(Fwl5|l zm51_vUOAH-Xd74llvw!*P(E3ar7h~mv$W+|^MTtnx~P9MKI&N4=%Su*%ebgFyR=2! ziZZps(u}I_Lrc!r4jFZoYjLTEjmve)Gvj~{;Q(Q2XmP5pfmN()M=;FRZ=@oqc(qQp z{<|t-*tY9jr!ecZ;z1v2iseFp`i_D$DhYESgYP5Xi$z|q7Ku*rUSFWLa}Fvdx+2Eb zZLs0(6J3mC*(UX79ET-nMvquLsFfur({M;B9e_5^IDm#5Jtcvh6<%^77t0qdL95V` zBed-oiU$?Z0&xmI=p{Fzht6K9zyujfjJ=Z&1agYJ_@?b@wgOWyaZJ7fQ#9jnj+&8) zWwfgqLs~`#GunkVqGn`D0(P45E%dH@OzN!3p=03|slXmu!o+P0!~r>@M`J7mne*9e zrU@;xl;z1{fwiL`Wj*aUTLOh7)Gtrbu&%XnT7t+~?o;Ha+o=mdiMJwl2xk!IJ4g7r zWOJ*cXnqD%`lnMnj|tN~XGmSC2R@|zpUeT(mTai%g5UI-HpzX;+cXo6RIByEYpU~z zEAY#*&20h3L%y4U8^S5oZ^lni{|F-3X4CCLAG#VhH_a-PJ8I9*17gf=H^}DN^BKGm z0)bL!Xki~)rdI)z>htJLI{WyodTJeieeL=ATzrQs8KtE1f~L5fEnH&GDjI}>L-|U$ zL4lw=K?vLU$&j2+qNz+dt9Vl(R`GJD%JpU*8Nq$zAiKx9e7M!bG3?t1(bxO*a$uW) zYi&A6UA|9);LS#1AWdlPa=Mc@O@kIQ4p(I3wYRs*TczDIR4n9(O zEjj)UiplJHmHptLpCXEEYjWAs4Z~C+!q_e%wSaS z_9m;nF=4Tr9|`>g36!^yvS~`zH%`o7&X1^wAV3MOJ&%-N%2>R!t>_cJgnHbmG$~Wk zsD$Ai9Tnt%O*zKKdh=Fjejc!RLrt!x`j++vd`{ysLVgM8E}-w6otvj-wB~t2PbOki zAZ-O%M%6H_i|LsS-wRYkCD2)0p%PC?h!)_XzJg~^54v6mhfr9KOJdO_ki$!+-hyP= z5-ov#Yyx`pK@**(UIf!KTi88!xwa0s>ba!ayDX`;rpL@!raTdyuuZ|BGz@}L8XvPz zLXK&#r#JNVT4i_W(NroUul)@wd~{vss+EdsL-k1*YU~c(lO~*>w%J;HR}vK7Q@bxs zW`%RpHYZ^~8U%cq)@YNB?K)k)^YF&MN+ImsHAu}~{5evy+f5X+$XYQ6WlFEWwnu`! zC{o-(eee`+;8KN}^*ZhfX>$eD$4es-f$HOt1N%`bmPr1mBdQm-xkBXoomte8&n>Vm zPxp;ck-Mm>$oa_rM^V~_iNwMRiKd2ZK2?D+DjT9WrazJReyCt~yCxPw`W3zmlCO{b z3O?q=i(=|;SEJkA4l`b{*OV!9phhGaT^h+K=Li=s@RP=>Bm*N72ZSERCAI)QmxkskbHz?-8uK6P07kXLep*<~M-&BC&q&aN! zBGgxaF6e8jJq68VmN-+PG<~5nT=}IGWC{vu7wPyO_zH@vPiSX^V4n#J*f=0{K)X5? zBdnK>ybMz~U=bHvLyK)8aR|z}r(C)zzg(Q3pO<$Be?~e(CPA+Z`~yC0?On!HQ=YT6 zau~|4R&;E`0_eif;+d~q#1~|kyk-1ZprgoYC=`kmy^L%WH!-lh{0Ns9`4vYNekr!$ ziHp=&UUElN=Iq9wDhfrZT#5sE05(HBlO`{HfL}-qo+Ng3wz;MPz8hTyfy{6&HnH_3 z*!gKlb^RCh@&ODbTVDWyuc2i<3~A~7ncoRl>%7PxeRF|&>_dPFwjn~Tcup#n6|qr1 zQ7Wj&ZPD~bPvSfg%PPE5E{<&F*l@uH1KWT~PQzxLU3#|RZz%doB!Ao=okELEJ6~Fj zW+Kea-SleRxpy_ShJ^tXHV19x(p`&f<)YQ~90cddgvR9JXAdSe-DOW{Z0vJm#DE%s zV>$?{jvbea#zwLn<33mDtcx{!GM$aFhF?t^o{C{!3v6F0v_`B0fF3 zdt3tFXo5*JfzpiSkwv57nU7E->qlGEj7uP6p7bc1hRnN2^;IT80_jmySEXRh866&? z)L~G!_H?=q3&Z^6^E#@78hZPE93FAG48Ft_j$PO)p7oFmurVmNl6UH`&VVIU?YXzE zCQMNMccK&r)h9sp@DZND1dfLy+$5>cG#dP43>G?Uck*36@Kg)|7etbw5&D6E7LHaN$Q09XA1nX7stu=H`2)NAV5KSQv!S zR%nh-hFKxleEp?PpFfVIG1+F7I-hz?8z6aS%bwe!J07O$YY=|kO7=t&g*LKCvtJGa_ z_gktq{jnBpN{0&8OH|F9Drk*SlBE->6_UP>Cik$&jtZ4*C{%j>2`W?yE!NXnyqT3; zM0MT9?lG;BdC||b1{nr76UoI;a1sxBI9?MFPik^80YjrJ+~_~s?mDL{l_z9&HTuKt zuCuy)C<#SR$tZmSjzg;A%J&qJKZ$Tg>fu-l*|1xMlqw!=L%a0hK=mk*D!4-BCqcH`# zV-%+G1&Z`Flz1kw1mbs$c*gwTVzuAF_y0)NYG@Z(E^pR)PoY)u^e-3>uCB@k4z27(?c&x4=u zd*G+?KKQBL01@{?Sj|HaR zwIQ?bVloe891uQX@v;plsdE|UgfCdUNIeP1_&X%tCcP(oQX{&F^E5X(5`Rhx4nl%6&mrWY*Lj%F8aXbs+C+DMv?ux@ z&dnGh0CE@i!^q8W^?Oznk-K6w$kSupCiS!q7|#4og7z9|p{P`huQ-ISD9j$hBVTe5 z=Fd*Nje=0vy}pvn69K&!DF|qo=pQ0o5nKsK6z?2b&6QGMa`QJ>g5V~_jI<9?s6L(b;E_3$+Se3EB}>R^W1I6$)DtI= zkWKmNh8FhimJ*8J-xGFz%z5h0V<&UB!xcgMufeN9$IZm6Nyq2bE;H3iNuj$YrZ-Kj z{j{$30Pw`}wc|q{sXbtjN$qz`HFDx;OzoAmLXgq%an!MfoPfPCTL=555dp;g<6Kx* z{CWIw*elI+2?|VIRn{gY?uP*?GN|{At2Y9q_{jNs9F!=U+Vw~&jG$}&96Pi}H|U+p z0744y%HtAA!k=RYshO(luhb6ZaXVMJB9h)k(s*1mek772OsF#SC z`mZUCOU8LvME-bobbN5Lq1Glh)5yqEGnK-Ukc*+!O^Q|L2u8Sgt(Rmbx*My?eWBvP6&_4jq)eGlOXYr2 zPS?^1qHld6ARpCX#v&;{{8{wi2nCKOoM*Vn4!?~{%AN^JGsS5&mWy^6NwB)mO?{9I z{+N29b*xI}XQ@eGLupPb7n$*=MtSl9bWqDSTRfyyr_n7zWXKy|q&}AP)w3OLTUA=- z5j?5?#l96VbBla|cpzJ%t{WjWw8L$4(kvU(vdi?`45&t`eUa)Bu0sx8l>-cv;$G=_ z5r;1NmmJ#|9Ni14K@F{`1)WDi(EM`9IC{B(+J0s`$%`?bTFK9;zs`k!5UeV4ARF-=KxX%Ik}v^&_{moH)vRhv*^)5I{#(BR0tH&acanR9=4EN1a0LGss$9w zc|MW{86@JWU6fnO-5AgplcmQs#f~`c4qvf{*cHuZO4MJ_w3k)-sKaFZCk(7N6r5^9p)u5cCi#qpxcxzteNmM5#HkD>&NvB#)B8Wq>J&1and)ixp(O4VQ@TR z54aeUI2k5l?V_uA8>Wi9dKLR*O98GLIZ9l^5ssm~C>C3rX0pv~o&w^Uryf*HR^rf7 z12_=3waKEmtd07D`V$l>#Kzr>a3=iowdd0~bM5(f{x?vPsr`0^g67sPg0VP&urHRJ zG|rS0&sz%QGt1@AXhb(XcV@7GF13L+MW1lBBw4fx(mub>6n=4#_eiI`6wNx43H0TZ1xQH_s^;Q&&8E+|VL)9JICm)1 zHJFJeYjJPi4JFG74bY)dduyL9VNj$HjUyk5Sy(|CLYoV-2a!T=JA^7GE7R%8I;^(# z;uW5vqKdoTjA2NsoArLg4OlDA)=(wqORFf-VdgYxgH^bAk#j;B3xsnQp&!4gydkup zGPL?to0K3fwF*B1GVc%-#Y&4Aax-i;uTi~fcvu1t@=I$Urz(8Hemey}MqR&r6B=~v zrR!8Cs(VUHnaobIstQTc3OfRZZLk5$P8O+)r=O;Q*ANZpi~(KU+yw#GDL+V2eqdLA zFo#Uh67DnU;7fU>FL9m7Jc588O3%IUq1vP`rPEStKu;dO4wqGk?Sgnk`5ZnUbP~F4 zsW=1uQbgu0M0MwTk&|1W&a5b+YQDQKY85a#4cr|D#N4-0Y1ff@%8%-x!0kjtf0)A6 zp|hrn1qA02gmuxyDr+KA=AeAIybO!X*zi!y)o(Jn|9!fL9KH<^p|k2o{(w z4>_R5K}?K=Lgp>f~?7y&q!YMF; zspQLz5TGV8u=NNs{Qo-)aj;ua;FfYH}j_&G2Sac8z>9vL|;_2MQ6 z*FmXmWG#euO6_FdF&X*t0Ro z3F$U78(Al$t&Cru0TDA+rYC2ffI9~6tRo+d^a>y8qyy4X={VL?w$G-6+1!b<`RU(L zNqoZzie5mn*P^EQA>6hos=Xw?Ry=WV*xwWGSe)SjRuQxOg-@U2qG%TJHj;yV9qY>&8oxWFoKxBAHRhoB0nmn=v_rMx9SKpcg} z`=|(_p(SXBqU4EEK?;1=2_E8GhaFg*B34@|peP<~5ggR*STg#JXu*vdYL9MHH#|Ll zo7ytk1S>QlkF#P~u71+>ETTD(UH7YF+DC4<1O|pGaeM&9`^X3P#}-)=9(;iZbfm8l?73WOy+0b6r7SIEU zO7iZHN{x6s>DU@Opg2r#slwkJt!!JY?07T{LC|wHIt^dlijZL~l&OQ!%*=t&9LBvc zj(lgQcIv8ODw4-v6$gXYZvNxQ|7R|Ub8KTP}_n#R+Lby zf>Rz+!cxsN9Cj#{bw%Xq=q0z|U3we{&+y~EP~O_dlp9+W7sKuugr>Wh@d8{fIky1~DhAPM6L^1tVH3TJtad`OEN1=wEL3cwiO*PK;?x!_9^phSkV|>(tXjCuI+~cFB zsZqo+1q(hTroIR?lyF!Pb59|1VQwG%R#Z(xg^cOw^#DkY{Xhm+WzXcc?0Bh+QmI#Z ze57(p)F}+A97kh-#`ly#(|zRk?TV7;AzSw0?z>ZsX6tbn`Fun~HN!mM<1w6YMD^AU z@hG8G+xdg1XgdecsZO-?L=XAKPZg#xph8!MBuE<7Xi)X@GQ0ADcZA>_824aH4y;Ax zj?@Bp;F6>%D>3j$j&YwF{1gUH-?2+Ae4^++nPFZT&DSei)DMEJjW=)`!Vb(YsW6qH zrWSul6&RxQk7FJFZhiv9OS;BYx5;tpoqbHc4W@unu}aHH^Vl#?0;bF}VJ1eqwRgDQ zr}C>{Klz%vij;yU$#LzjmwZ6)qRZ=lQLE7R*@n+hx6SAa`9O;;2?s-elO-pEV{+zKP04Z8Oe~PU&O9OU`(Zf# z8cD;p+C>ZbY{;|@GeIZmUH!5dQpOcP#`(d2V!R#VT^N69q{H8dTGsvS+ZNGv68igU z+F)g~i8x}-O;(%BZ&j5*%u*qA32@ZpGZS^Uybs<(6K~_rBLuB_lrRQuz_xU-4QJt{ z#+o&Xt|1_dJ7SiNvqC=}Z`sHtq72g@z0|TIUneJM509-tV%-}0F||Srtx+@+#lYG% z1%Wu!yJ_1t0(({%l?A$`k3xl`wusWP2aceHqOslB7OFSQhK|F^fe(GKB`#y1(PeiQ z+iNT#&T>{Z7zc%5vRMTwr@kD1_+BS*_{L(L@296K3U~zggrh9l&9lh#SUt?AhF~2-*FFrVEaFz8s zdR5G{Xu2lFfSpHiok@maoH6ARwJrxAp<>RPaSty^1_E!fa|*VXw>qa_QL2wFM;0y- zZ2ew(8j!UWANH7kPcMnTg^LFspVO|-;+3BQciZ94he6L^&xq~6 zVdH{_6>4#J;p)0S9jaNP73k5f%W1(^z}?bl!FOPgvN_o+CqMCb< z%}i%c^-O1XaJtln`>(URYS`IR^Nq8+nsN375gd+4g$&GfW1$IuCBT^LA))<@T(M$4lKRGs!ZpF9dS#e38?c?%xE{37zN(n2*OwMn2hR(|Jce(Zn`u)02(r-6zJQ_d?Woo7n^RYc{hemD;pY za+9d#Q8KDD1`J+u3Xkm|e7{vrlblhc`@jp7#2aT@JMf$edL!&r z%e?7ZwI%QD(~b(F+L94qa)9a4mC94dHIGFlai}@7nu&eMFh*NeI-6)n?{2tkTPnPOL2Oh(MbRPvP3qsa*!W(+dW zy*j!2D#;CNqHS5Won!KVG#wVY6xbayT9-Oq$w58rS;;#vJu(XQFF@f)7VXrmx*86m zNtr)Q^oMyyvH-;(y3(YqD(c_P;ZH}kwq*7fEy!A#(7igECZ#DKA}7e!{{*eN7ppRq z5h#D-t)V5iF}diwee+~88=-0U!^WJ_p*wU4?PfgWH4i`VD8dz57}!#gcO7#0 zhuHdDp=0!j^E~&r zjyT#Y9kf?IU4B`wgrQdyNVpqb)>}dv_iFG{;S&0BhsM{4T<>h?oRBLF{ewaTc(+sJ zR*G&c@`KRok-yIvz8bQVGhd);@$_g{jw;_OQ&Q;h2@EAJ9{Y0Y3RKQ^4Z;|-I$U;S zCX6(wJ+!V59R;G=6nVJ}wWgx_KMd9XL4i3x2W}NUowj9MU1T2J1=B8328yn)2o|al zE$|Or&n(k58782!xqW)}1yj0wT7qw=G+7|bDzxj_ou>3nr$Yr;W=!pDjBPVoHLv{f zIIH8|{3L31Y(W(4s8REkdvNqnqvj6opv1s1adwFALHOV?)8+|3j+!>NqG|Jlnw_d? z^X8|$B^9-qpXfbB1kb#sPNB8nTaYu**4oWP@iTxC`8lj{8ND!QF9pyD<-aa{v~7il zG@XSM9W#ywbZ^ua>2+QR+KeE@!9inqV(}1?sx|H^Q-iXp5Q?emz*Y#wL(qh}PpEyp zi+R|*Oz4W_^NB!)mX4eSG89%lhFalodyTdZ!}5*iF`s-hO7yhM(VP?h*PL-tkayTj zkgXaL3zAF7%g6^QVnNEbirPP2RG{7O0DYk~I-+|W31;5>It4>1NC9rqal0v)DD~z$ zQktsH(U)B&F1KZvngTjhsdQPrcsetmtipohgceijwvn@$C%hHNF+r^*qR&p8TCL2s ziow$g*18O8_0nq5x_PLCpw~yS07AB4behANb zfM`ge=Qj4(xlQtBW@8)**DLkQGml8^ck^-DVa>f|Yk;ay=Zm+5HrEzyl6AC6Hc>q! zf@TFLW5uIUc8J1Lrx}O>f!S$mmq6~*(!R_icR##b_R4YvQ3k~(T@ zZP3~zXsxx9$$+LX?AM4j1_7 zhK{Id(Y-ti6Uqz5?BxN&s+}~@Obel#G+GJbCf%XaHfch)db_$w$I+$VKDtS#;Sz46 zo3wRwleR}UX(X_!bLx~qMXA}mVC)86A9wi%ZC`fTO5WRWf_orjy3GUgg0xWWMQe$s z`Hfq&ojUxOh}(#luEI8TQ}dE#pQ?MA%mdBtPf;5Wn^+3G%;=lI;!5J;)lH1TM;AI_ zt)7WnmkqWqE4~bw7mqsuZeC}&lOitnW7d6Gou?$D)aHy7Mr)v%cTsDg(7IExMgGvL z%NBXF9~b#_y2xL)!cV87=afrUc+E(Ptw%^ArP4%p-w9<@GUP>iwUX!P)ke0{YchF~ zUhU*Dyxu|@=wliQ(rY^5>2(hI9=*;b>*#ep@zd)9QcSNY#7(c+#6_<;B==5iU7k{z zM{cG;OUU)~x|Cc+uXmB@^y(p#=yfHTK(DKafnHaWb9dnNKJpE{t|ed6YX$j~Ue}Y4 z=yd}*La!V-K(AZKK6~3X7LWdkL~oJk zBDM4uPtyrcZ?{rx8hVTB17r=oMa=`UlHMXeK$g+lUDW=M);+f@X0(| z+8xvhh{d3wd4*NpYI{wUA$_A!)$YY9S3Yq%z%^bxLc2;mtQBqG&E)zn^a@~V`~O5=02=_|LaUyV8Szmv<149Er7}kSBcmf$JQE$+MxSqOF;3njz;ssF;H1`O?y8cnH`hN0dLsYJ3&usC+5)A|p zE=k*0Nu61!vE}*o_IomVxLHNN&TL_y#aKTPixEPFs_{WkG2{u~JK{o9VH1}`%IJw6 zhv$Om7y)=c@-zhP46F7+D#kr^!0F;1Qc52jFlGDJWS zc8ZkG2;VX3M1326)PNEGuRsWaipW(cj(!Yr3DE?gEox=pld_gTAcrP$XiE9v4x1V= z8d5fXshhrv>a$xV_fS)Da{WquDnFA#V@w*S;eNHtrulq;p3S>d)!n3?JOp&)w~DGW zuZ~5pucVl&8?OCF9<@(;bE1wqy2A6+%k(2}rmCAuBbl8f+e`H$ZIWls3dxhcf+SPD zO6D^4NEFG!24Cz6T&!6Ck4tquJt1JdRZrmPp&NBQQOi@|77A7Aa~00w&I>K5 zl&r6cccoiV&9mxNla9Ya)$?5PDnpj(w3{_J+V)_xHJ9R=qGx8yT8Tc_J#4}@0LNcs zl~!0CMGSAIuh!-*dc(dF#lG4NN>|WB<6@KeptZQjv#QizdM|pg>K^Nz{LrDI5KO*| zPT>>Q*gB&tp|y12`tK@AEHo|}n*3eV9e@=J&3puI<}QYtj+@VoF6!uDgu1aQ6)osH zp}*&{hFm?V?!%(j#SU4a43Neug7! zJ*u-85x>!1l2S)tP`wy2VR$sQ(Ad?`#kGC#(X_j?&62Bui~hb}phTd&mTH z%-5aJZbFAR{0H=`vQ4stmSpSYA@ww3l(-C7Pz$xfWTVD^Xb!AQNmqTJnNhD}0##DI zY9-c7Nu5vbj*&VGMvFnzA-7$00iTxaMeskJkHP^`9@AwN-G{^=LXETaYp6~y0$haL zq=>qAl2Vb_Y4SCr}L>|O`n_~1WziQS#o!a zdTd_SF)EYj3$1I35vMmUA0&k99RC!u@u`04bk>VGi_x6wmC zR3kY^A&wlp4G7JoOR}%JJiF8`-=|H*R9FS*Y@9%+nH7^Qi6XN&$Ii_8x=Ux~Or1J2 z6}OFJwCVXSPEYwYsz@AzVf1M-<;o%|Q>Iu$&cA<)P+9LKziRn*p|V~TDj$jpmH+T9 zLgnB7J3{5*uKz`-+{6D{LS66?v(5 zn_OIT(Q+ux+0Ly~Cni0WQt%|}sIwi2G;Sq=AN=N7n3U}lftXtiaeUYlP?TFS6^xEs zLavC`^MxI7*9Ld(3;Xy4 z#1QYv>{{5z#iMr*Wusx_xYT-Y*&1yK%pJRSC!-;{;>hg;VpIA^I!*nF^z+#P{a%zY zz~u12qBez57cy&y852^%dHlgaXY}A8Xsgag<+?WNcYw)r9_IfE+atVmMynpSiekI- zSoK^WrKJPklET<67Te`XKtd|P_hBR=aW9-xs)nRQtU)+yVC&D~JU-0UpQg^X^PHXh zhmK&180>`(OOlqEM0X0b0@j9OY{OI7q+%NnQ*PA&4~03q*~h;}eKy#tO#!1kpzb*- zQQ#%63E$v4*nA8d`w&|x~ zGF-~ffKCz7;zYC$JVF5*O!#=JFtlK=V6n%ti(;GNNXWWZoG6x>BsU{Yqi>1b zv_;}00lkm>?ipBvUC8Vn565I6PM)j1;9hN#W+KsNEMtk1K z@flqsJy&-Yp$}k{k75Ow&E%U0qvTx)If>&3-iMkzfN2N{N%WgeGaBgruaU)J@!kw1oEeX7>I{ zI-HMuZTUX!`lq+^-kaGsZ{Ez#%&z38B2BDybrX9n*2G={z5$#7jsy1s9|HCP4xj^D zfOcRh&;qPq*~EH*6tD|$ft!KDz}>)c;3V)Oa0Xbgs)@Z5SP%38*8{tOeZVcioxl;` zVc-eiTfob}Yd|Y(Re&|XW*`Naz$9=OI0`%uoTk6;rZ%zjfyKZIpbOXvTnFR;7q|uZ zC~y=w0Xzeo0bT`Kqo^a$3G@NO!1aIy+z1>7jsTwno(4`wn?y{!jWPQD{mJtH+E`f# zKr*=iz(R8JV&Ed+4!{HGqb$mI5qvY3e6#{}08Rp*2aW-EuV|VQZ{Lk{u`f(^vDNo= zu?vrOvA!3&%Ch6QzC-P*(H{zY#m*>sp10izq_^6>!Yw<<=0cw0+lpqIc3ShfvP@Uf zwq^0OZ`hXNnYQm;+QPI#&i5U?Lop4{=ayk*6-XW1^*x0o9mu9xy14d`p#KcPuykHj zbAH}rEHOOXp>*4Usawl^Weg&^Ddnddw)H2++b^d)%a?h}6~j|3*r+MG;ld7BNFr7! z6xaxN4Lk5khI7}oT~$?ud|0!xyo0em+w(hU8+&LZMf|=*yoczO36W%dsZ=t$T3xNI ziN%zmt6EUzICndgxaAv>Q9h<@U*@%R+ZO8SM^Y0G?@+231Ki5`Ij~H&WZ>!-D`)ykkf&UGcp-MnVu9_B>L0L2SpgbIzev~*tDGt`~BHknZR zQiB6Za@*#C{%&PSBpU5cqY&NtWjgpXkzP}%|3T>2@*JLeKhwSf1 zoEy|9e6mK#PbeAJK+vd4TTPzJWxYB#4{surV}y+BQ6fr8+ryPHExkwa>^xUIBk!0- z+VCgTDU~YMXI*TaB7;szP)GXdszkZ_q3>FnSyN0+^`=vxi22!7hefpleXYQv^jm7) zGEekDhxA2!MsF~jnshNT2G$y;j@__^bX8w-)$9#*I$6pF83Z(z<+Uu2j-y=)nxhuR z@+6a_CSO@2Z+dChaQrmsQGzky&nXI_eCBe}!p88TzKoKrzRtyn1+Wz_&4? zXN)ZAI+`di&pnT7+R!yTF(esNNeSRhh|}_Bz3ZaW_S_L4&1b`x!}3!y8OE5_y}UO zpXW?18%-NY+j+-@7vyNCiq-~o?M!BhzAw0{4|~u6hLy3WmRS)9o$2JEY?{1OMG=Qn zWu6~oG6p$V^#lRU3B@`+!Gx@yKi-~pWgCQ-Q{|3fm*n!YPDgUpP*~TO1Xq=$M&|nP z8U3h_9W=MyIfi6%gmielE~FbOV_z|naXHUnk{8O_r`mv_ zCTF_^&E@0-p{HqM4fQ;p4fVW+dU?$W_44xmS!st}bR|ts(|1bqN0J*-4>K>7JKogs z%=63Rv1Zhjvs)Y2N>a#o*Tx`8NB_p8OV$ac zj2k+)aYt9vBe)~y7Mf~;#%07}e!MLAvPJ|`8bgeK;YCT7_rw*-lW{_FqEfy$Fw%Q` z8tv7+K4gxxFYjb4I$&l6Pc#nb+E7P4FSS57s&ukcd3BE*yU-7HqoN}c#H-{(h>9^= zkdRl5I93F1Fhw%rm_ZiqQe8*-#mxiKN7Ly`9gW&8lNNq7h7bGp2b) z8nPgabH|d;NkKxM!9{ASkP-^j!~qLRg1C?W&W7qOa535pH@QJ zn8_oWH6i4VHNCu4uH#HE&$`+~sjoQM>2*prIMN2ymkyG8GC@2U>lrz|?hfN*w~Ps? zD-+;V`6?^*vtfSS7k&}*mSQ+x38~Nd*s9Vq9=E7h|s;8Q08!d%{j{yiyi4 z=tA@{zgXtGMmksGyH$L2BkF;wUzB|q^V+gZE>T&yR26ebnnmuwb+_#%iiV$b?KCF~ z^IqCUuT*u@WNLH=d(R5S+`yv#Bp0I!V+%1SO$`ia#cist(~@A$NIHf>F(HG|Tvl01Iob&{PIXD$-G_?OVIBC8ESDW?=28 z436{<;07=;ZB#xZQ zSdc|pnZW$6+E!J;TFIc5oadvidpJs`>fmt}m|}+`t(hj>44xvJ#1zjkvFvM$rcL*9 zB@0VC>8^MP`)hTb zzshyzvhjvf(%(KFtcq==xq9~gDA^XHdr(PaU*!gRC||RY1}9G z$AV$kwOb|M`Wf?izTP0;I?Cr@I--mlt{-5LSZ*L{Nufx3?K76Y)3z|x_MkxSb;|lENDN&E{{6I zu9&e7+(N6_7HzOVn{+qMsH?eIu@mE!%N6}8gF(!v4l5RtA}bARGIALkG}5l^*%@Ei zZiw1-uUuL7!+;#@NUsIjs;aV1tatJF%cEaIA+YvXcEQ?&`-NG=-ovFWElH`?fuWiu zEE&5s_bcFlc>Cr^jS5{reX(yHP_Ln(+1Bctyv%I^VtNJzeq5 z-93rkEBpGlTs1JbbtrlD@JMRg_R(vuz3!KH{L1w^cWGm3ooBK+WA`32Z`saX7i-_~ zLUH1T_wIY&jqhi0a`+q`6%(%!Uj!@hw|U$h8ru!`_E(~qzTJR~c0l848tId^6F7n= z)3O*gDEC4(+r>EBHj)@Fwf;GilQ&Q9pM=Bb+&p>nfyqVl=E37P-E`AD#$vI_)38yEM^j)#iHhE~0HumB6TrM|%{<%fRDL77zzf;#?P7qjwwv`I_DA!ZD zpw~4Iw(_Z*#o31* z)#yAp%~`9lzv^r{%dQb_6t4&a*vgBA}^qHlO8LiGVkH zzFz(5T!gbaRV_Q~Du?y1O`mOjEA_7Di2oXgP3}MNfrB^Q{HupPc+0Qd`s*M1joUu_ zo3|hSt>3=m&X0WbV|RW06Tfr!?|$;0BcJ-c-@o_1KlsD@|LB1~KKdu0{?lU*{@G`a zKlJdQKl0hn{l%ky`T4(k?C~#r@x+&&`0FSC=BY2A{K{9qcIt1R{`xb2_l<9U>+k>J z+2{W8`ES4Qo$vnBi{Ja_e|hO&U;ek#|Ni|SocWI*{^*q-|L1?b`jglG`wc%JXMO;l z)dTYXy8dr^|G(Y@WoG&R3;*}^b>#CMavw#ZVEi7U*JTrcEd%4G2{ffg3V3#`2vj8_Ta<)mZ*?q_KQB*45DdEvp;LKe@J6{%D>2 znsv4EC+p-FY^Z$C^3C;KGuo+bXk3qvZES4kaBpMzeOnvbxo2DB{4edOl|NP`zeVd} zpU_^X9rRlHi8}cunTnr=c*Re*R_SfYb+N6v#`pPw*;syZU#AGp!F?jZy$2ZS6j~B3=o@eg##Fs-mEneu_$mU5N zy^8K?XLG}pVd;=H$yC}emgLP9j?B(3l$?TV_`GZN8n#fTX*(9;i<#%UY0cwldU>lA zebW=0a-$<_c9!<%_BMrkN@6>av3AyN+8*!IEZyX+wYiULj@$ygyD8kUitD;7-X6W5 zID@txn4x~0v4>do3#PY<{9=od-N_QP>sYsWh;gZTfNSG?3jgKi5$<=(4eoB=HRUZ_ z_7v-dgM^jraa@}`W#oCv9+~hkw@Zl+e;%vi(}#U#Dal62<{sA==k!%roPAZ4)@xwx zK|1tDUz-PMCw%jSkIbWn&b#STln0xK;Z#y#>>YDp8C{k)QZrPlxCecuGs3#j0zQ`o z9+@*r%_FiNo>M9?WtZ>5mQe0eO_PkRtxChaxMQp2sfMKE3?-6G^cRlzjQH-;D znkxH=k!j8K1BW&q<7_`>x+eFhG|u&NQl(w{ z^1H;%!p6XLxm9j|YtA++CrZ~7#WW`0$P7mapKT#~W)xr1-0$`9u^^k}ZW7^!LfHrA zY?p6VL_qB?rNSNRw~JUC<}$fRqcmyg#l}N?5R}S$q#jFH5-IZ>3#MZv_}@qncIqsopBjq{O?DejQrXxv`)q!;N_?`n}bXSVZoRoVlptzq~_^SUsd8a(T z&bD~fE&(o$SBN(W}-R`>mQcAkWzApVxO($K&OLYFmN=NmrHq9EeARm%N8s9 zXS?Pa^ztxXc`FpYp_x5qkJ)4Pm_25X*<<#YJ!X&DWA>OmW{)?|QT<&!9jzC}*<9e& zR!Pr*z6d-AoCHn)$AP23Vc=F^5-0*Dpoeq^kOcaGPM|%ct3tXoq>F)8V17s$-R}b2 z4|oiC1ULfR1snwS0VbdWDPRED2*iM;z+#{kSO75KmGdP%4f-7LOh`|L^hw|taDPbe z4e8y$L0})?06Aa>kP7KQNPB>dKrEzfAyt4yz=Dv@4JiXoFGL*|O8Ojd5;y@I1CECD ze&8^08{h+GNcE8J29%=&;_)IGzKgN7KOClzLH%FAbV+koV@^?1Wo|=14n?{fJ1--m?71HB+v)MfHvTN z*t-(2rmk(h5|yUIYi;j+y=|Z0cL8x|tCl)7K!6~ipn_3RK@nn644@e26sMr5skJqA zz=#L|MNidgRK%#Lu})E`MCw2lF|AU;YD=|Vape8`&&T@sS^MmHuf1~4 z`OmOVE8x$9egU}u4CW260ahR%*a+wW9iRqOKnNfQIshI(OF$xM00 zD+7MfBIny=Eq}d_5I1@!tv+4cv@30rCy?;(4a zPQRsQf^H75?_0G1*e4g*$0OKhIG+L7H|HgSepb-W32DzerM)VYW%?zd-j+h#%fKrF zSiGAM-%Z#K5Viw_ZG})~fDk`W&_jg!qlC7{2=VMi0#|^&jMxg8AoSHm$gdUpoGR$q zLi!vbJx!?RQ-Hk*ktJ;B2>n?jw6{)(-y!txgpht#NPq1ahb`)C##ZmtKKGb&+(18R zd}HZPn!mC1|D?2ZItFN74d89t7n;qXD>O5)?!N>0e9_QsZaP3Sf0ID}3A*gh0lbf| zfqor&I`kXRLD2uh<_wzo&gDM^5L-(BAoO3MmC($$+CwwH^?W6O+@bY2Z)GoiPKRdC z29AMd3wT7c^IGUgX!ejv2-AY>vdHOiz&^S2yf9|=-JRw_INd4yF~Sld{E1U|kyBXj z6#mpHyx1wc#3|fN_+4v+-wF2@oWK0#U%fJE%SOeK?%Jq49Y?9gAGUU+H~uj2({rT$ z|Ly}%hbvh6;5=X4T(Sl`66Nd;K0{CYM1OLUx&PqkVKXv=Jo?c`h_4_6K2KeJ&!3|w;%td^)!tsp@rrBKA zokP|N&r?!^uvYD;pM6u6Z7UqhB?G`?2RM$$>=@5J`#MxO-YsW-1)KtI zvhzE1+!F`~#){~dGTy@Z=Tyh>nDT+IfE#QthJ5UC#V}xulVO=1kHJT3+`+YhYTz1B z30wy3Kq+7YtUw`P0yrQOFaS#dJ+Kha0cn61m=0)wNq`y{1B?VB0R<2u*Ns~OyBIY?GxV!d6Xr=I;R=w~`4>3;0-t%JDFxk6Y#6h!bpB89# zpQ03+UEi;6P@a|5i%2UGHLO>}a~juQk#k49XCv|QM&cEX#48(#S2q&RUScz)iimr$ zJ|z+Z;3Q62SBOZ}qJC4Ah4eN~SI-V&+v%RF`4sXuuitk4T13uQh@PcT3IbvYJdq-( zFMo%nUfKhmj=4cE9UXb(K8Dj+7~R+Ms}O04Df}n9-OjGqkM~GMcTZk0T>zBCD+weW@f< zX$|t#z*aS+*PBsyC0QzKNUc$$el=-PzuurjJsjHNNUt+t8})NGGFxn9DYc_rJDF^( zu4*#dtH}y*sMm~oENHhB(5O+DR!2I$4%$F!l@aw|d?6fZ&?mKuBdvxbgOT+QVYH(| zJ4Tb4bQrsyvtV2nGU%;jFxiN++AwCoW+RiOluXuAGBaRY7QhBu=*)KHvy&P9vjPT7 zCD|~(QrOE5n9*NrCHibbUtuFF`fEjB?SNXXLVq-{gO)Uy>kz4qR4P5fde}ivsz?K= z)CSnhfIdOP-bSN=LOhM6!knovKDEXO8yYbe0P{CFM=Fe08Hw=%DmHFF!^RHV>I_H= zF`*pBj`159i~#0~Gnptd(u{Iu*vm{>K&66h0F@eAYsTC_V-5`rY>td(;*4yrU`K!h z46vt(0X|{@bUOGeY|ELTVP7+RUvIR+-hjypKL+4i2D1(6usdLa-OYdn(3?w@D{4^6CLmczI>``TLj1{PX?%@=JWHSf5=|{3QM-{QbN~j`WsDR^};898-o*|cfXXQat%mSr3X`8p(IMp~#&D)sgAQY=2SM6bWKHEz)` z@jb)ch*qtpmYwf@F*`uzW!Br~md5KpZDL);2Cirad*$ET2jsJY(n23nI!ROD- zomL=joSn3DdqLrh)3$FH1O)}f&8rz-HMqtL zhL>lE7sr=euB!aNB{MTKVa-NW@XY9wC&#OIZ(qM}+OhM|$RD?8v|;nCqI=$-GACcW z%+H1YK@J=kKQL2OFnHTx+r){RcdjcuQyh6QJod_!`JoAedY*|In<2@N%U9*D>xv(+ zw6CbPHaMegdU-nc@wDX*&|e>^%=`!~bdU0lJA z4TA@5-1?G6b2g+>8W4a)-TuxyrX1T*P*9LJCiIuxPoK-OUds%HT~u9`rDv{5&Y%3v z^}c`s}7J>4fE+M67}s{9~r>!5*;FXbdT8wQ2|n^^s)EEtW3ba=^*h(r0EF$_r>v4 z&*SSR`RCfRz2iCp$(?y>^S{qi8*)>|6&bH&ypig7Cpf7Vn~YPs${DXz@|?AfPx3qx zJXZ-GS;rq4x3#-kc&^HGTdkevx7r3=l5xj6F3ET$yr!dY%vJz@d2Fq&89{<46kd zBZU)3V!RdHkTY@MFAkohMB5sr2|Ng#RNzRA_ZY!>j0Oj1G=bAttQMa8n!sf^##_w} z?qU`A3*#0crnQIzpXGVIo?SzL z<^*mFm{^!`T)7!z0?%bo)bm{(IIdcQFnF$3EAU-F!#J*~GZB1svMyxOP#;p`QjG=+^8l4-XGFH-y|ggpgCJn@5}0 zkhfT%ed`u2TC{H8%uNuMKC;bQ=hJ0vquPAYPV6p|$x>wQ?Y?N=KCDIS^Ud6v#kOgk z9u+2TEAE8EDN|A)QzpB+i`%ws+X;2HY1h`>Ju)FCp^v+-X5OmL-+VJ-(4ch9v`+2Y zv>Ex9hg+LYDLworcS`ok_M7>R{mzIHiAhOglD94#6od201UJ#ZPP)!}1JVk|?D}BN zmD?jmC3YM)?(GiIhvVb#*2W_JoMo8m(yn8kp22g1l*-#LB#s-`F)=azbSHP2xLxa! zZq>tTA3l6H;_S&C+$rU#QAr)UcI()&L+6j>^7*sf#qHV*9dhc-<#z|{=2ox#AucJY zVEhFi zeiWeCyzeVpztF)oiCwxRj5V!`9=t3ktZ&Fgk(X37X_9P~r>9;YezauBh|#J94^hI# zBJKh5JfsKMu6>B(e(inw z{@OLVa`T>bB>ZR^Dtfc?mF7IN7Ls` zqUmWVH17Ru8a-?;-7UGtHZ~fs#jO)5;}BXw~)t zTCsIEEy~_US-X$Yf>rw|Ic^87-FB8Nmv2&W)en^U*+DX_*hq^$oliOIR#BF5J)J#M zLB~&=rKNdCXzJ8_N{n4k6O%U3l*COme?cJ?p1VT3D}JV9KRuumw`*x<@oCD<*hwoE z6p?n)7Wz>4IqlhhfHK$bqih@-R&6>&A1~cb@x#_q%CxPNb*P*&4}VWv%WqSG{Wh5| zR8#8Ybu?VDfTpER78PjLbmMxoU z%^D-koH3myswdF+(}Xg z*?Iol@yeAe@R3@&4}Z~kzrw=;-wO1Orhb8gC^$TVTm!<%bzm?>goe|==l}|1I${7t z^cz5(5=RjG##;4zukc_#%RWxxFZd>Vj_--;iiY1?UZhiBzsSE6@wjEBxg8O8%2{6l4&B!jb(b$1Y#fGQ~!f~mA8C_hvEs^WMyTPwamaYyy z*rthB|EJ}D2LR6G??Eg!0DwbF?0pART-UYsfDl5cSYu?6OJX@MPWVln_)mG!?<9`> zUJ@s9oLIJF%aLr!Rz-z@p$O3gh%S2Xy_cc)-n-~cQ~?4cA%q%;rtj@@X9fm@Y{f5Y zy|@0Qt95nHJ!PN0_t|Hca}IN#cK`HxdOhkNl0OI8^m_N&^2c3|Yrh`6_27J6+2i{A zCcK^$r+>x09!~4Mug6pJx0jy_3k#T=o8xZsqgLh1){{-I&6B;?%UfH%7S@x>f^2=3 zW;l~Sh{3@@^!N8;VqyaK?%f0VjJSUNI&R#!!KG(rX1Kbnjr3x)vOJ0vKz=1|-MWRT zsVNQ~d$RlX?b}@2`T6-}-aL+$ughnb>^tKvyBV$w@1mk2Bqt{$Hzxnefjg815TBD<*;pgWES65d!Iy%D6&JOnW_OP|3+r}2o&Q9?0@kT^M z1ji%Bi?OjWjuz?oFg&hay^1T;$I#FaMn*{;mR>qAdZ zA3~v!yLE;7(9xl%o-UQ^!^GHxqcI^NfulPwFAt@qrQG=B=H?r+dU`lnl;X^INAV6uM@P}z)PzKW6%rhTjO;8F5^o9!W-N_?9q~_3SC_l(9PAMs z9E^zYaCm!o5?^g$W@d(ShUW-p0}fX`!ckY3@YdCawvK?FIvnoWI@(;GuAUB8?=11; z!i5XVW8~!IMC0Sky<1pV!ra^(7pyM8iSihas;g@_e3`tlF|Q&1WoBj~JtG6Lgu9cg z3)Qzncr?if$!K_FBy6m0p{=cpFiN|*yF=f|7#3DmIB!aP*4KkJ;i1FuBb>Cf&p=Bc zpr;U8T6)mcHil5k5JG_=bWYQF2+l%RppP@BPeCBif`J~@(WRT71_ozwp76D|w}Y#* z3q0K2;6d{0>*a&Uun1(NrK6#t9^<4>n7p$&mYA5x)wi{Czkwm`@bhS=HpT>&eZewGG(6AuV7n!K3u0l)m zCAyo?-rj-k?oRX$_F#B)h?5_Ne`{+iH;0%^o1eFUowXwj&k~=6#6ucmQ(HTv6qjRY zdKSHt_t1Om9?F{Ap)JsX_89>T4bDOPq&5U6&%)d?7#_}fgjY2JqMP6w(|~}4CIlrl zBOs*-;rU%itLQ~?3Eh>Kky+P^y5=zi2KwRTmn4@b9N_HeiS)EI)HSrDtiBbMjUA|O zyNrUWcGR~Ip?~x`M#gRs?hi0W^3&elPBInE;jcw%_gmLsRA8|g(o zD5@Dj`K1ZuRd=DLWdKbreWZh?K-!hlI|(Ui@DB-tp_w^%2gjyBRM-ex&jeVS`M}E3 z6{aRG5NNq0v!)xDAIzYvs|UI#L-3A<9bS;v#Jm5`4vt~219R4&GpS~N0vj(L&aXKIG{xle`DOupVTaLigJQZ$<&9Dq@f@fMAT(i1h z8a4`j_c3_ojv}LN4uS1=;oUKVxXu|wc0NEx?+j9^CJCd#%S_CF!AS@*hIW^75Ztg%q z`v?-Un`l1A!^J8c?gqKIcp?WEzRJXf&$FPlHwmA<6NSBR1mKUqw1Q(u37nFfVV~3s z_sq+%%NW85=N<@c`;po_15w8V1b06`>hLV``ezZ{Ig6~`Swv=CgLlCs8pkG3m|0Ky zB^`!FXGwRF9P6GW-Eao_q{mDQ3}8?C)1B-@2RXWC z(uuUXW+Ya&6J70y%&vs9UoPC7bKvEZiNL5r8k0=eT4ciLY#h!Uio~%K;c$wnhEqxl zY_bR7Qg8(q^M~MBIffLHoAlm0h-kl!)WJEFPRyckXcnp6b4c&JkDS&Sqz}+M7#xAW zOD2we;thQrl0_$9=o?>z?)i%_Bb#Y%YDBuph;*DGEJ(+Ak-bSz&q7N}8$xqQFJ#ms zHn#;~+4T^WG$Aan7Rgn$2u;aBFx_4>CocM@!OBAfGrI(6ok}FTlL&3CIM{h)BRI1L z0W?=#O9$XveigwL6NtDpg~Xm2M0MXo(!eZA#}`p_Z4No3vqaMar1i5gm_iBZlETI= zeE3@v9Q|7uv`)Cd$S?w@4$*zw4aOFZ2n!?G4)leqy9*p_tl>a9(aqHZqNHRbR5igV zI2*QJ*)VfUfth1E%t=qXM;F35Ae&?_6P~eYIB%Z{9pbq_I~GSjOU0jm6^=js%8Tqq z0TK#3kyuNz(smu9=4(iAy@9muX(aW}AaVEs(uZeIIyR5;YYWI9yN^^#r;N;?fOua! zeg`p8W%%2V?C{Z#W3lg7fjIET037>M0*<~H0ZpPOIwlu|CB>+zCEtF9W7V#M3Whp?4+)N4|>1fzRV{@behxoy)-S)5PbqY0y8PjDrWGvHvfb`0ziY z@x`BF@x}Z8uqV3|R@_XoGKd_ePg<_h+?+zr@LjqeAa`N`g*WC=dwmgAbl2RNMbXU# zPQ)m6Tgmr9){094#OvZ zb%&XG2r_fYo(_-U_PslZZ5%^<{S|m6*TBRf4LX`JF!(9~#s}kJbRZu3`yyd_I2P6? z6Jd5F0*>d?;pUP9XQxuK3k5iQA_2ZpZ7A&=Mtw|^SBBh$#aaUaFgWaIBH zp@V3sr*zHqeH4t|LdnP^nun&~8yEp6H&-O4=c2T-4Hebhq(AdeM0}~PXhBM1HNw1_ z;HX~?oqhR4OB_rsBVl3fhQX0>gw^yQrtvaj>-y*(L||nrJhNM19a{pSbv({HXTTvK z4?!ul2uLqOa8?yuV~TN%#$ey4dHC%w<8bO&CdxXlpzY=Zl80L;xH653Ycpt>UO>m4 z1;T$G^;7rJc7GmqH>XfEFowQ6vq%tCWAFRNaKYRRt}bp6rKga;*o2nWPE=JlAR~+B zp0_9beS?sdU4XoTMmXB#L+f-T3{1Td9F>TG)>u6r}Y@9Wt2l__j|GB7-K8}9bWIDF6q#^>~5tZxi!@@GBVJ>c)} z4^IzQn3!8Z$B_JH7YB+#N-%Y25;rNf85^5MZCxA5&-w@x1Rf06<1gNX?C$VWBEZ@I~W@5&xU(^J#52@U>i}2lln1!4b(ku;wRF*|#IIo4lTU{B@)Es?%A!FfkhTyU|3wW}rU-0WeX z9SFlOa$u?-1?_VI(6fxe385eM9f+j&VjMk?fqlPE#JOYfq%W#q>sAbh&>AGrT&ftF zMDg$qRMNAN^h?9QAlmx+$md!@QcfN`0!YUl3x}x%&C#4;_&QfWTQ3wgelbWd$U!CP z`0}z^Was6>+&BxL{UH}lWP6yuxg764T;%SDOAm2aa1h7!4nx!6D71~WaQ=b?`SgxB z_E9{{_7~#gcS7)=Z~0;G+oAZw>!JATucGkf9}{7rT>@_hvT3jE<*HrG^zlVgh0tnAV;LC$Cu(z&6QUuKzK|Q`W5DOE>Bp6%8 zsCamBQK~8K<>kpm~zU<6<${lw=4`#p2+nUO0U8BI;V(#Z=3zamiksJkhu;O4f{| zQ+x9EG{$d?p}V&qp>e4c4UE`eO4?dd)7(Qe4#vzfg*c(@KzC-hkw+O626$5Z|v#=Ifk<|BvGT$oibj zSYuJFs^&-z7A4K*mu4w@@v&>XYu5s?wm+<_t1Z%a%(HnxvF!D`w}@ARn7DR>%9x&9 zlFXY0nyd2?xdHcF+vk#m?~C-Dm-1~%%qJG(bL)5WbC`YbfSwDOr@VQ}WA~y=J+W?B zT3!qNx^-G^t#WZ5_aDrXZk#7r)DPi2N4jx_=KO=%8Od6rRCbmgyFR`Owgf)7v;-f< zSBac4o%L{0@-9>Vo7T72?Tc_*Tw;1qtXt+6*?eCV>zIe&o?@B#7JC9uRBQcxgm2Mu zot%e{ls^uEG=<{kxszb6Pu|^6}}l z`ub;lsejhrdXjT3kAwBNc5BZ#Jn31T_0CMJSC8%AvweNG7e00KCU-_-Y(-X8_jr{dM@USc#pnn7%cQhWdK$Y(s2pEVn+kF9rF*;ZFqp`D%ug$3Ms3LPCCIM~^7XG5y0tC5nN0$*Q0ZeRZFSp#k_Uq`6T)zjA2 zfv&y|jEv54=M~aY)41~sg$0G&d4uqX2*NiCg@uI}9vK711?=qXVNQKrbaaB1r6u$Y^tt}D1g9Yo2%s&{g-}3wTJ)q_M@xXyr%ys( zPY;HM=U`%D3TtaC*xTB2=PX=ZTo6w@?ds~{c)-qNczb)p#>Ngt>}-XhAyRV+&@ncS zlKNIO4-6wHECy!{j9{R5210ECj0|mIWfcY+hXgpeWWd!u8~y<~hz!d^V0Z@cEdcsL z9q8-oQ-6-cgG^M{RC8l?skse3{k<5U80TW+dKznICnpGqclJ(RFf=)jQ>Qdx@9c?= zt5dkX0Qd)n;P_z!?ElaNTDpF)^Q}NoavOqjx)G7vkHm^mBsE<_TFZ45wO>ca#2tkA z#^KO=9taK3LRn20O6!ME)jW!l#$I&wj*$$^a&c;Ways?p0dpG%Bqbse)GB|tOM&{AJd57qRVj37(saHHKg>+z`yl2!rSg5x9c|Y zhbEB_(*W)FXzZ)UP*l?gQQjqF*L9$>xeGmmgP5Irz|Dj3co*4DK0Sa8BulMM5969fuHKdk0}%vxx7TLDJ<1 z5H;LJSm`9n8~PF9lS#C>(YP9O=S|Ga&%@uxAJK^kXr=iyJ3E7@+-fA1)FbCoCz5O0 zkX+sjzt}u@dS$^kI0p_k889^zL0dBlwto3=$?k$<{uQ_sjv%V>7Lt1IA!YCZN+#Ie z@dKo_-9!HH9i-&f$+Lx`vjv9*JUX&mRy42XK~BYtoeMPu_Q z8J|Pi2=za754G2)VPzbH_h0kE(T_rLXi{f8IHaV&E3vyq&XK>ho3bMc}_8uU&@ z;q-wR9M~I;gCE7=_z@8_HIs1St9X3==R_R+Yb;CzafmN#MpoA_GCC%>y|~=bSrkq# zpmuT*bvGAKHaUm|1QGOul#A=dLuY21p_1lBUi5= zs=OaQ33V_sPJz~eIOu#FkJBGS!r+Tom>!OYwLvo69P>#RZsC>@+e&fsn2 zUB8d&JBw()y@aOOCDcsMqWbD>q~(_)CSHV+iY8>`Hz6mt6-nWBaJDRl@QZXDI~V~c z_h>YCbRnX$4Ka1yh_35JXjLaJCX~b4zW|OjCZX9?h%Tyyp+z>{|3e18{3Hcs&BMrQ z8$1_xXu35+w9lb$@-9rw{BTM;3>8&_Fw=8~rG*)c49>xnWX;sn2uDv?!Ph?$ zlQ$S>PBy&d2}58BV+LJkHN`PF-S=4LXc-6ES&ui86OUjC;{=J7-)VK3m>-< zvUQ83cNe+!M`rhq=zNLedPksRd>Xn2W)OUq2(3>=`0%{|?0qW?2mUOA-WN3X*12$x zDo1E}C-QnnP~16;uAwp9Ap6VK?0Sa!VP-?}qn(a$?^c-V6u{Ck9gZ%UxL}%&kAFit z+OtBk_PJt{iz^CIQdxwYLMo5+h473IPV9}uxv!F-cQ6L$PKDu|i65+7Lg1H@g2;km zWL7s}@ah;A=H|JzQR%wo-I@FFkILcB5SSYjK>t($H20@q-yfoJ{7?kO$8K=zj7wkR zzg!s~MO94;qT+IqnOlX1mQEB`*Q2qs1+|Tr(Am|EJ7lZ5wd{v0>*H+AcZsbt(!bGb z*AbaijF7lOq~z2fF{uPYWN+Ep?^-`dYX4>TBE&0uOJBR~FqT+C7bco~|qW@Ae+pk+M zR%LNkXJ_Yfe8w(zX12Gl7v0_6-1%i$(;#hsk7BlgfdN!jR#8kC&)N0V)MP|PhQiF$ z1iIQnF7`1rFrYXqgkrB`L`OxSq_~KS_fnEY6th{A4{V9-@(L8z*5Twa9f~_Hz`;`l zkDz>nkna-~lM3O<^AwAvqo|@0t(}*-c-AK*9ATm~cm<@u!Y~S+t~Ge?R~KO&+5p$| ztB7g3kHmom6!qRih<63T<1-PKkcRS_2Co0Wc(O++H3$+_!pSoe$M#2)&zFYa$^isc z-9XyFEV71Xk<&j73w`o;KX8Dtkv+wx zNB-4&s3RZn(kzhM)PZpST=+ROz+5jC_I61qEG$?TCsW*>R&--mF%*TT}WO#fc+9MX`9`WHzoFq$?Q8=?2Y{j@CHfE-P~^g zD@bbY=6(Tqqon3;?)QHcpPG=T*VF6i_4Imr{SRL6|HGC0&3^@n&C8MGzx@Pl&FS9$ za^7}c#^%OXa^(Kf_{zs8Gw^J5!tBzQ+^8&5>W9$gSUovAcOZ+0O(h(fc1| z-hZrj)KHI}6~C0wwTJh}N7O0%(2s?>!oxfXZiggD4Uf%6Qj+dOWq#mKJ zxMh=~>dU*;6&N0hTQzt}udz1r+&706R$y*W|3520S)W^_IH{`tKw7dYU+ppZyJYj_ zxo;Y8Wckl?`KoVhP}PuAhZjNTvhw`cq<+g2pU5%%(iQ~y$MTHMkH;MVc)7Z#U*twUt zX_+4zc+W}k7ei7|aMo0RWfh+{aJ0zQ*(g(k(aOeQ6IU*vhw|2E<<*rKa$@8a)xSrz zb>$d>8oW)ftr>eUOm+2j#$LAkwKZeEb47MoCmRSUjTQcHscuzz{dt}uHBfzHlaQv5w#EjkDEPk|X6l<*Z_9ADh#OLq zZ9K(I@`9gml{B_+FK=)!+}Ld72{&@zUnf~t-o2LwV#{u(hqkJ2+o__kQ)MF~Oi@Kq zeKUJ(;ww54N^&Yn{7vG-W>pnsRh2D!9Jo){EBXt6DAT*jbNuIC{|Qf##7yn8hYH;5 zHYWCp{^~#Fa8OWG+xM!nzdB7U8on{RFoySg!A^q%ZVZGT?_GNPe6;xMyB}{ zc!vnlFC~EXuLY#>B!Cond)NnZHast(R7p-k>G8GTp5d&G9M|Wdq|({1VaFE!rpK~l zGk*(X$Ced#I5Exp;zKzpAbk$L?OOO-IV5&4BsBiUYIv<*Ly4>LI;#<}evP-e8e3%1 zdg3?2TA3qM!nET{fEi6*k!;;k&G@ z5}Sn5*6OOOS~KP-@|7i0mn{Ldi@*8X1KT16wo_%tp6@XU-7JwR;bGQLRm`((0yW0; zXNmS_1-lr#RW#Iid=d6kk>0OG{e${FQodvakJ0dfLg8 z=c}myf(<@P{9G&(+B^;BO{@!QoPko1zNxKXth0i##?SeDr)Qap+evKN&g1V?JTfYoMm`oW@0-244(JnaAfd$!0T3MIg@-MELX4ntM7QGT)o&-*H7T zhj<%a5aaX`|0VI9RP$H=83#e4nZ-I;Rb}H&6-A*Jp{lY;RYgfvWwTgED~omX7QV7r zHE-o_5hu3Ml=>b|W&2K*XZEy7wPl=~%+#YU-?U&HUDis=NGM8?kZPqJ{2ed9DR_Ze zavWVod5cVC{tm&53^bpw`w|=WO_B^gUu_>Hzr!UzQ~Qi7<&-}uuAj-TqsJL!8O5c< zgqJC~BuB@lWS<7EM389Mo?P5i)vYofbTW%e#x(2z;Y%)9sxo!N- z47trK$o)=k9c9j1@=0oUvmMxjtmE%Us^za4FOskqR5tSVEb-PcnXFueOeP0tPzo5knwTM@d}gCy$r{nL2Na>&Qyi z>Ni=1&*b>Kr11HhmgeA(5C4 z)m{8;-yYcJWnj7##3^(BvI<#Eaa_XmK%^LaC&+@F=5vKRkhDlSW6DUqin~6 znFqpdrvy3PBiKFv2zIN*>NnIxRiMaPKhJ+&DkCI^?~w@cpJ%bKgoP_)u!Pvw?eSs! zVF9(W$_xA#WF&Fp9xI0O3!KK?wU3JtRbJ%NKWEKdpS`RcC{C(0*HsK|do zQ9$95a%-Sul(?#rks2T}cZu5w_!0^gRus-!A~iOXt$S(Dm&7B!s$e@8*2eRMnnctF zp}qVn*%0Q-ubFa^n01CI*uv~1XXV63Zj11h4LofH8NLYL*&uB$JiC(YUrw@kfufaSMk{G|#cEfwq+LJ2 zQMJ;yyNb1v{7Gx?mX|4{fdM9gkQ4@HN+>N%lLk5^t;;x5XF_LyWLjvUP1>YG7-mSC zOd1HKy!!Z^^F8!QUK7&xzecit_nvd_J@=e*-``_BtghlMebMIrYR1zx%(EY;r#ger z?zdRiiS)D&Ikt-UD&Ju9d(PP(7QoYrUw__~Kpt$_ww zE#vYY82<7T`_aJS%;;6cGf!5am?DEJk@=LCN!_-}&lPR7lGI|Us z2z48%VNeg8-_+AXkDJsRbS0>FOzLflVk~aHz@if9RacqRMr9iI)=cVLz<0T-KO64)Rlgl3V4^50h{Xf_S2wEZTHrd9X7Swd!sUBQ%R&Y!ut;$ZDDtqr# zuB3WTvo)`#8+weEKIZ+Ray9*i-1fSKKI45*3DaF$4eE2CB6M@VK|SDoM2XQ?P3kf4 zW6CH!IbcvHK#kLhL4$hH`^U;Pl-OZVuYj7MKiJW%Jt6bir&Pv!1s@W8OrBeLLgFV> z7vd+)IP-tl7Vn^c5zd=7-$JiXo`3Oio=v_c=K|qe?BnCI!FSg9rn(x(#oNO+e%xoF zi}tj|JIwqi9NL~djpj}XCr+{AT3^#MPHFc#IEDnT)Vt1Mmy>^i@Y(84Gj&$*cFA*U z{Ga?y&Z%)rlTCD({uJYc+tVjFKzFMrmCGd_rthmbtU-isN(wx z@CM+1dcgONlBcJ9|A8@mm=xDxpbGpOUyxSlO<%xu3w_{wM7e{4{(jm+XZts}_E5;* zI$*JwO$I!S!Xj-d{q_!&C)c zp{xL(_TTIZi!ChqR!Do+e+Npv=)YU)`i9i?ywtKqI4?;2d6$a4#7&sr*3qrNGwF6< z7v0S>9^DHJ(eDB;q=$f)(3gRi(jNl*=_|k?dJ?#cz7D*Ko(5h`e+i7zGr)0r4w#_7 z2BzrmfLZ!3a3B2ucpbgU7bWO*V3B^x&v;?xRk6o<8(5QC8uUJJ8I7gV4b%xdMtH+U-G;na$b|1Ka$j+O6t!g^({$#2dRBHQ@rBp!>s>f z*Ky^9@|^Ob^0M+hJuKmFdP2f5 z9hWdd-;^*$-XvX1ZI>`ZyCs~aq=b7ZC*gi7BXl2Y zzXQETZM~7MpiPO|c?YfNRg=}?Qd#>X<(KRAa$ljokk@N{+OkHOOajboBEzxiMybqU zB)gA;jHVyabYYZB{QrjJmmB4}A%hm{g{odI%~EEi-q02)Is0j?(4fT}C-xQizb1*6 z>a}WJqw##Dh#C)RnMS^`RHrem5h>LcG(BGAct)$&OVx@&L^QoonkyCZ4J|rFBTJ=n z5xQ$MnP29lx!@=vS7z`+a*2~YfZ`KGSjJ4GMzQ~ z`-b~3&m~7k;VhxU2`(9dKVzI5ZS7!BPsR47ViA^g2Bc$=WEzR4hl~W< z&n<1yEYxnbkrGcNVq@V%E)`CPCu3G`Gt#1{CK@wrYGtSQr?RK;S8JkhEHf~;D+j$S za&Y)En@mTBa?WIno{SC)Ju)3npkXIsiC7jRXcF2u`NmL5P9^p`xUs45NFrtoAm_kp zNj1iwgFiZ*NVLnh$;t3OqopIGW6nktet6ZS@o*-`lZ*^FbKGWT($Yy=n2`kL0h=q` z#E_SqoP^0!Xq2{;WO^(-6+h6lZ1p6xX&Q(y<2^ z)2WF_W>*U}Fi2PmcskBiw4-)>PS-Rc>aw~t(`1RUNjsa)Q#nVD%5*MiJaKbmUTZ*% ztRA^ilU0z##o{bjt52?OEI)R(YGtl8FJ#eJLUNj{Aq4%;3xiz%M6Osd)oLyl zOjl<=ohw&ORhd}S7OVP-!JEvNDpahRCUeZNmTGzlHdkv6SWq`9(=V+|(>oT^($}!m zCLO*om%a2-rBPbc`XbfETB)q*yrh>3TAd6=p2elLa(-E2^>Cx1mu8n>lUb0nA!)W$ zE;Uw~sm^T#m1;Dy(p+h+D&v)grdMlrjgxsD`OB!ewn7EStyb6t;&QYF)_BXh%F?1` zinJD$D!F35k*DNRqp1Vrry4pPKqXXNY8W{6V zxT2C@)ToxP*N;~9B1vH>*mPmET#iFa-BG96iOFn^xgu5P=IYo>3! zMjpKqTa$XVY?qEFDXT3vWYeRI^~Q!s7>QCvqgdrgNv~EG+3T_85ZZ>h1sqOjqj zaG{{p8s_dOg0`hdnfGt;N>N)*&cTn&4C{J+MJh;Wm3fqoqLr{ZSL=;frJ=9zF0M&% zKGP)DpUn7Zez82yTU;1qC@DS@uw6oW1C+Fr_oR{*C5j!m}8uL!q>Qs|4M zpu8cyM01=5I)W4G9OyFmEU$=g7Bc6BszX*DKcsD7YJsYBlzJfnJ82vsVu2w87 zc^QZPA?Q*Sy)~S@8lX!k!&pI%yx3JF^7cWyT|_<(2lxulxhc`_h*@vQv?D|pld|Pv zTh0>Xu=QA50slyf7d{UzZSY#AuKCJb966vHVJr;VNnC20!Z7$4Mb`_10~TBX;ti|Z_~r_W+3PI8Nb~VigIn?_%YC6N@>^?zmj;?1&P(}L>4pw0Jum);&$T7# z3-eM3m$KydA#WYX+HxCQOYMF925Rr)2PIz~Y4f5(pL}r=+`{dBNIZE|^s34TD4AB$ zaH|&WHJwJP7NXV>6*6=Azz=~_mEIJ>uPSNIoJP%;n7uGBt=(*uA$)h>yA{WAuBACn zeWvs&k=d#x_Zcj#g37UbxS%zpTU9HZrlVU!xv6qdn(Y#4NQ*8xTxaBKHDasHFJQ>$ z&9c3uY-8m^(lL$hp^G~-sh_Px)rTBu zA+t7Xpw-Q;-M%ceOTg(27CR*=s|?pd%T%}Oa6R@}V?a1((U4TbqOWj_S61Mtq%=En zYbk?!y3t!kYC&ebrgX=Mj{olmrrDjZ{OAMfA{oezM*q-xrPZCS^UB>JT5ZuXibrKZ zsF@2u(Nw8dru;*u0SgkgmbT`TqtZhc9Qo?z5@c);xc?Y=d$H_BNtuqw98;0rU`b_n z&C9sUpE6f*vy{!g#dR1>HfK6*N%W<&B9NY4AR3`!VT^q z4bx>!?%FgOWoQ+85?T+V)O6dD#NJaTd&&BaKU3BMyX1_{ysx$IK#!19H!T`>Oj13%mNe*e?glltes zb=}OSp;zv3dAi&oMd|8*J@~2kb-F{;4NwC7_yPZ1Zc-GrGvrcysv2^sL3Lesr&l7~ zoocAV2t6Sss0MwVAqBJtTs06-LvEGR5OHy0cc;svxn_pUS z^IxrS^J5%tzAx$K`*?1?VdoxY7-r~XU_IROe7`)P+aV7QxVn5QyQPbxU8!0j?!D zpo-{W*cS{#zANCNjsQMv7c?L=ChOF3zIUUl`XB~v8R!NEhl7^~&t$EGKD2#@3#HW# z?l&FYPzOq|l}d0Abf@m%fDgR&)9d%IKPVOEp`MGq5D37RY-)%4ac{Q@#RJ@DRHGVn zmVg@EgYu}(7wm#HfdF?PD7ks_=1$nBvKS?>nT2iM?DKYZcjBMwQWf)czw`Ksk*sUu zUOiu%s#apld~n1$EW4mrkJgp@_crfBe9d~Nah1=*c0L^P^w_c{7fR&Lf~NHq%Vp!Q z6kJ51kMgGGNBt=BJW!YM24M@IJ7fPUeCyr8eZNU`o#PhEbuPYVK7&ai2Q;P!W9rDs zq&12-f4<@V*Z;KSI6u1`?{&7PMuj&cE90oS^2KFZuS)ubQYtIcdqqwQ&1v5FJn25c zw~(My!`#HouOjJw$GI`YoQ`dxSA>35s} z`^C2Pd|%l-iSfpe7bNSPMW>vA7Q_oR`y?dKeu{nxQ1encB1`UyXgH4&4O6#-)Ri>( zC9^I|*UGO{=aAT$lI6XKWs(=|c5B;h-6dthB3naUv#5bL*1xRWuRs5XpOo>e-pQT6 zcE$h4&wm5)4*O;TNdSODOYA&tR1{a1RZTZE&`=FFii*mZGGRw2i)oBtqqYVNnZcdr zs~T2?%#Lv@9XC5;swQSn<3Os(+7z9WWX+!J#GI3C5;rq(N6w7#BQet03}AGlar40$ zoe={kd8Ew*Ll(gy)ZY85i!aTbIlFuI7j;g(y6?UF?z{KC`|(~i)c@xH|H=Qs|NsA6 z;i1;PZS8%=-SPa1zAx$XP~X?^%r4*G_bIKv+1E>P!hO%s`oX>i`h2_ZWBNQ!pXCq! zP((U6nK}K=fO*Du2IBPZ478#H=xqZlV;=|z$FyMA>o@TV+^&fj#GVMD9 zIvSJp9ViB4iDd95ys+`z0xB#1-zt8)z|P)8Z`K26ui0z%n!RSP*=zQiy=Jf3YxbJG z{(mmP>tjh190+|Tb&&W0P)F1v-sTbWJKPM(aKMo>3!!9$NCY4jAVF+EaCi&T1vG z7v=W@F2?U!ZU(;(P&R%8&=!Pxv8`-^je8L~hHY!-pbV6ayC!7Fnc#BqB$sor@i`om zh>!;%E!`0IztRmEqUn@hU5wwS8)Cdqo2|g~x^xsnY(VBt(pIxT(m(+2NLUGvDI+T% z{VsQ;AwS*CXnYe74^cwgXLQ_XktkwSiB(sL_hVIxRc{xovHC!)I!_=+Qjv6bnOK4y zr8*yC5mweig>27&mT)?z|FAc zKld`xGR{~(4_OMFi6?*&b%Y#FqYOKTL$A!9{$I z3mD)+zlxDkEBP!S7qmUDgps$Lff6KiUMFNR2;DJ-P~#*Qjio$&9~La-^9DE^*gb=T zB~u3GO%8+sg#*6_q_(g=Ai)@r(YT$rKY zU+FwcKA49s)e&HqDI>KvfJEgBOgX7U2yDeez6+3#4VCf>%Y0@L-`NUeV={695*2x% zD1{rJl{-M6B_@U}!l}Vv%CVCqLTv{?n|$^V^m_zy4Wwua*E_@jGF7HC1y-zrRr@Rg zIb-zuv47=6|3l~yAhyp^hBM)7MIr;P+S7C~xRtldi^OUiF=|JbbbCl(ju8!WVQ7;k zZ5Jy6!Fv*4p^{!bMm2?{gp>H5H9Ai$#a_}i(P24><_WSCmV1Q?Vxo*mi@hR`^E_?L zlSSvT!93kIK=<=G&fz9)k4x3S-?P-BHy9rSZdyUw6On+N2yw=B-T!fPky`o&Qzn{` z+WZuQSp|vUz^(iWAarrh%4k9?UIFcF)o~PT&F*8$eI^ficnZlO|K(_+YC9S|hXB;?Ep+f&Tz2+_AH0dZ6#*}<}}i3bcIvt8i4Zo zP$lm!hlQ;6l##4NsvNsYnm*@Rz6AcN%E?DoG`twUfS3y_{x-IaG->j3fxK>|N;Eq! zMz1tolz&GVvZzoGp-)CT_N;~Za?8XKWc80=MI_tc=d)B~^$E(A9a!aw z#pue=S&gPOY4weYpU-6EcrVGtNi{CCQ`0oP@oupn>As9~yHjI>pP_W`Or2E0zZ+d| zr^IsT4Hk-=!#(MN`9sfB`@;O-?xJxh(TGF$s{x7}3wHYfTa{>x^{o*| zK}O75xIhc^bRr(>A@kEQcXXr5AQI=2>;znPF0czndu*ynwPO1~_*O|}&GZ?+ZKB~d z3&N|L3uT!m!fVdd@R~Is-72qqdpa%h4XGucy+w?l!N(Cjzhwg-gaEiW%{pIe1OI{DdAgF5C%SRnF$@j-^3Tgz|H#}j7fxgN8Z$K==0}A;k$=|wiTty8 zX8z%t@CTl$IY_rBuI0_IV`(U!rlCd9s1isP0UonHJWBP4M}Ji6DqZ2((WQ4m{`kmD z9V!I1su`BSHpvxHPaMvm$(AdNK!c?MU+rq#9X%VD%m~ ze`P1{U_<)CltBWxf&ST3K~9-;f(l|r$d5t!735iHq!g%QK%O{3#|^#81@LQO6{Nw0 z;q?TRF$=ngOeO{)2*N6(y>Er!DHLu+#!E!W$-CfZk8=&YCvJcKvl zJop)3=$U7U?J1b5GUASLZl#<{j)@`HSc?3anP%WjNMv_-D@d}Amg*4+PFJl@2ckYP z1Qs_$e)=UmAS^56?nk)b&ch|N(#g_LT?z7gz`p%JTEyRZ%Zb;>J6r&D)^LK~jm9s} zYYy;_0aTbInF~{7YXwoE7QF*Bf(RiG+iZo<6F4njUw#UMFLWSTPX*b^(lrP@26+#- z22pNjb%DzW{ybVm%CX+U@3!D^ktVQqu;0cG%v+HPf)ONoZsI)Ccy%8;HJ{;c!4>L$ z{zarEcp=@}J)#NpLJE=YJ|2Ula>L|*K)uJ@wtY%s`F!Yrl-^c7y+vLJfd;Yk76>#I zx)`w2f!JQau^rY)TYzW|DN7&+ZC;a0|ajtoWrhne|RlJiCE$bxOYtvd%CJE7FH`!m#N4>BIa}h83*BaneOKB^RDS zD~?sxIu>nU7-@lsPcpO+O}$1+*5$*t8nPK0#a2+H_#A5UZghiiO^sYBc*PgiLdyl< z_2g5~r*^jOgNLiD<`HhH{MUC~Q`TnUM0K^&LJ=XdH#U_G&RQlP=pI|0;fT*Bp1%Y{ zKZJhJXaF^;JTL~ac~ilv?I^%Q!BzLev$@#*uUp}%)Y};OUTu{PsjjDQm$X$@tlR~a znwns7Kje?O%HQ>y3+nrKrKrXIDlY0DwDZx=#4zxC>@do;2{xiNVmH=1sGL~uD#pJe z*2oeJ==F9+&IwW`fU|T^aE&Hg$tRGlfjjJ$tk5xrlG2XdU?jM)~Y5 zaS_}Ne;P-1Dvyzm@Eh(C4~YlHYSfWXvCSi(I@)6GA1;NhMsYtmq}RPv0;MC@Jx0*eSL=k~R$?U4#}BAdF&rgk@6iF00T7&Xc3 zcl_MSN(JgBt5;pO9F9nPR(RpSln5kiJmla?8n0YkG6%x~;m0_o_v_#$TQouWD_gd5 zMyrE?$`07V#@DKmExMOB4aZkr+rz`q~)uW?@37_1tjD5|+tEwK%^E7D&UR9WRT5Ak3uQbsgsu~yt4 zonKIIl^w(FCW-TqRk1EPF0uF$%t~;tuqhgFYO35z$!U450(p>55-}Dfo!YsTg@uvg z)Z$BIUnW{HOL+Qb4ooN?B`e6Jn#Qh;WEOenyXq4jKr%mEI)} zg>%|REvhZl3;5iTBG#<*x~B)pPRH~h>2(;^4tQ>RZRD60947J-u2550@HuMbgk$(I znrOVMvpzxXd>MOuW)BHDX%MS<8TBbI_Q5%gt}BtIby$20ApSZp97noQ3)OzmW>VU- zl~d-%(Y;{k{?B~lwSbWc7+&>;^68R?v>f$R`-nv~H=!u1IRO{i3US{I`NI@k3Bxxw zj_!s5{&(w8e$onxY*>pyk&!G!abmW^xyS)DWU2$of~$SkytN|C`lx+*J4~U3?H;lq z9dXbHwTwzgY_SD#)F;#KKc>Yd_{>C3i=_jBxbx7~Ah?I6M8QM0Vs#>3CsRA_XXMpjY0)GY`9nIJ0O5F5 zemod|#{D$6%X7)mbd0cC##U(XkcXibjISZj0|WZ|2T03SZ-vmD2HRG9;DYq`%|B)X z!%~%c9eNzi39uVob4r>Q2umr=@p>gG5SE8(x4^1I^rlXEAhbto{(&jbFXdp9X-$WG zvUx)sjLK}@p(*XqAYG2W4(qt3uKCo!cVO!nx>tirMD4;76tf!@a}tczc`>-H-x&t| zxP~xi?7i=w~Y;Nvbnh?G!TJ& zG!_ddcS07?;c;oHK-vI?MGX~FOBBcF@?xK z%pl_X1|kho7U5?I^M+j)W^=z*u&rOdO(0J#z(gM^wtFfx*#>Dai)I_aOKb}fH*03t zIWs2~c1loiBg*>|$)Q4qapn3G$N>P=K_2jejLYb6RIqsz$ivGhAEX+1*K&yp%%~$?k{Uz({xUoc(I0mN zvXSCu8$9Ey2(mzDxSt$cOXFlxY$u_(X+Db#di7L(|G9Jg(@qyySlglCOTb&fnoqLiP?aICvB)2 z7@k7$q<9?%j*pkXf+AJw)iPWxZ>V_817?DZzJss$NAQTK$@2wO9)l2LC%;am$It}w z3jl(-wQ5)0>4+-@w;-}*Le}Vj|bn9mXL>2r(3O- zV(5AGga^KW9{2(Ju07_vQWuW?tvU|71lY*knCh0lpl<0Njd@hAK=MXo9>ohJXLPzp zWsXkuD0O_QW0nYHbR`j?2rT)&{5!}{W zu&r0xpl!BEtF`Z&cPFVFcZA&#Lk_7>d)j-gY9(*IehOa_ zNg2&a$|-iu8R=Z$v{a@y%F*N=uNrCZvkS>RYEqjvKE6k7SFbzI#0|!cD%Uh+P;;Jh zc4At-!mw@iAN}XrI-Tc@ zZd_4nXja35$v}qm_r2;#2=0FGd*8pld`Nd!)vKykRj*#X_v%#*l9e8@#agWVa`cQ>ZX)j!l7udZz@3(q4#mwwX+yLn%Xdk{_*l{^-XPg5XiL3W0W=t zzOvV4gUH-W;Zyi06q!+}8rKj<(rp3?ed`5e1OW>fzZxc=anhHZg*_nijtq>XPog;2 zhSkSpv=+{)HgZ=104$xbTxPNixOVDiNVyYc04e8G@hr&DFuY`wqv^b{*p2vHW`S7Lx*E%V){}$+ z)%`2X-&c~1NT)|J0&4veW=EFbqiEjvQv+_GGQG%|qF zc;lD~GY2IwSnVwI#|B#&|DWng{LQ-d{`Ykmxf>wmAZJOImMfXE*e%A4AoeL*+Wdo6 zDf?k5OOG4EO%@)ET*tZ=6wR>{~U;g!%&4W z01>LQd|5tlHDzMWG#Zl7{l0Pb<^sOEr(!^ly+>H58=|b z?Qtluya8$tLB4>49<~pP3Zg?TUxoC#vzY;{GS;o4zk#v!-?ZT0or$WJgW|Re3`316 zk&-yY09rt$zn>a1X0T=s>o4ONo3aZVa!e~M-nWb~e!uik^&of%d+MG6)>F{7ya4cb zJmu_%nXwgnX(4B*b{(`hk&$wmjJdo(0ITnonv|od^_lMv|Y5< z3?nkOWt&cm(MS|o4sz!Vq^pK*0H`reHGF{Y){V$dPBk22fuI?Put10floEu1If-+j z70F*3t&{|rqL-zVgxCkFg#|m2G*}TkaTau@V#b5_1KBZJV0q2y2a}~0sYwVOK{F_u zc|M%)Lg)=7$EH6c)nRtph(Ait02rq9DHdksvH4od!dNuJmwNk=CpuYWbb)E%f1;sj zI#MJnV0*tgcL4>YQ>kK*h>Ht`hwB>p`&`8sv+)u<1Z6#1+XFWGi+Qkg#I1fIGz~W>Y;?ywrn<|} zuP;F+s}RDy!lwQN%F3bH$PAj_^H|=O*_s_B_&u-q&0V*k3C z)$}Nuv%YlOIs&%e?BeEF8dgCeg@+dV=(}?nJQOj))oY^BWEP>PxOy8J0Isr%PM`Y? zRBKHbWBT=de_;?KzX{0Ap&%EZ_&Dluevf%BnF=*3dPu>MM5wr|ICE2AZ#UEE~@< z$mPtkosN*Q&1amvk^V*9QdBuWH!!BZgP^8OqZT#E7057CQY~zqX*}mTQ#2kmAUTiX z9Tb5Hbiwt(cK-N0wiEb?Hk~0`G(qA>r~VItJo<-xW@~l#%K}A%l&S7OV-^Q8C?4BG z)uCvDd@t*W8v0BIiX1>|V`}KXe~FyyuyrsOXnA_3It!)q?|(UrSq>`9|H9#NltJ%d zQi0j7YRznzGRq>5^3ej*EDD@&1pV1BK{h0s^9ugxIbRMReOQGYFF296<5`7eWIa$ z>r*RtJRe4nGV?}{I{FUCb4~B;hENxFn=u1>f&Q%5G$Gq+jczDqBbHJd>qc!9ddk)1=H5dh zl19!^u1?u_Nvrs?a&^RdM<8oSJK^5j3Q6s$WvKCI``w3bjocnpB78eN)rY0Z_O_m{ z0f0rd4@O-vqi_@9Jg(yl3i!n;Pc>lv@*K8zzEc`@!l2fj8YgSj&_A=zu?yvo8A8EsTG~7LFQ%Hxc!`-pQ=>vf; zhqg^HXP`VrD|bS)+l=0sjFt+c{V6`Jcsrc{mH1l`0RnZZ4=SBp4NZs0R>TBE4&YxA z+^R(T9T&)_qbHbqBA;JjvUj+bWoFQFY9Mb3%=0@f%o6Wt2;#(3(chu+96*EEfL4Gs z<8K?Me}+4t^nQReH~ZdzL^SO8o%UA%=V^>RhE7f~Ci_+U8oJ!v2CQ!?@;)xvP{*88Y>PI{WXfKTtE;|gLtduU+zUzW zCnNokielR#;q^H=mDR%QPupE5!o4+G8K1Xq0@+xQLn<8Zt83E965jTayMK)X^kOA4 z*?nrw7uc^$QJ{MXy9s|m2z%(as9ruw*BYh@R01=<@SyKe`i~faF@?la5Tz6Qjw#*N zWEblBsO(sX#nn{;Y%XG=2+B?}-4&sD=?Ea*kU!gFS!v8LeWePV>Z$^#27iU!mDM$j zJxmi5u6KOu6V#C7L`)=0P{p_=_N;8heC@>Bvr^5%Pycdg0{Oglar=lX zBJRUK=}@i@pi7PR81o<=r!FYSS1S`zomTdgg)G>T6YkQMZE+GCB<4t?$%oWailmO! zS~r$$UH}E=02+kK?*%skDpCPMYZw|Wf4&)w@BNvfk%z<&D{wm^k8RdF0FlW}MSs8c zsc!imrKH<|0^p3TueZ}iUkGt(vKfD-Gz!89MY%;vwMC| z4$-s8c(iJ(6^?J>_T@zrw`zvlL-Z32&*#a9vDJ`KdDbytn(2}yzWZA?vAz#!v0UU^ zd_x3jYyegQ`tRu6;n{#&?QBLK)6-ym9!4#+9`eyK@Y&w5-vimMp*r50!1aWg^%hst zkN=WXPO{Oo$Jlhtiz8LNZ0D|C#G#QVhbxPUq-=8f$ukZm>acz6es|56PevTJgYH9X z`Jy73BT?iosHMX62%mxVb9j0EI3xN~WrwnY2ae*2U0@L)6rxu&S-3*=#);RVE?hw> zIOQrYgz+{8lC>S`CnY=ZdE9o@{b6IllU)w7X_>OJh=&B0JRXxDw*3+Ca-ZDzCsLar zmXaU9)FGQz%ITfuD{*g7uPcFtEW*P0!)f}$k{=F+anaOgmHcQh9LDf{CE8#Zf2dra zQ1bj>cngNJOa2kVX%KEfxqsct0B@Z1tD9EpY1qic#z`W^{c8CN<&d#-d0m&el3PGn zY31<23HNgx!0&ZvvJDoUI(Kw!Dgr=1x5MfJS?NEc zNu@oI-_VUTaRG&PbEEV$spXaa%*_j=T+$v$@fSv=+u)Cfzmz9#}bOqB~K{g|H{c+N+P(dnIs9h?okjBw>;%H4C%|s_t)_yFG zb0$as&D`6aVZ`CSpEu^TAjG{hE(-Eta8 zv$@@dQ6!#2we?^xD%KHIOep=llmU&CQk8yAzLhKj>iIyOy8_~64_UNQ^&ab-yK*a| zFkZgTq$1UOmSizP%Eh4VaFO?H<1NH{7740mnOZi2H^j608IZpL9sA(?$xW6r(OAE- z(x~e8>$gD9lE%}xD<<&)3w;z<-FB9CGh!pqJY`~KC*m=6?n>a@Td%=XWR#FIIP|Ug zLth2>W%`V?!L)&ia*($KavCgugwb_eOOCEF1L5eu{+S6N?moFv6VLf*>K`EN?gX)$ z?M}S+H5&@R(+V8z$a{l|G(e1O*!A9!VTqNHdSH7QZlIh&+XO>{?MI-c-#7(>qkk*8 zDyiaGSeV8PUznO2&te#aI^HyTC{J`-hHP-%^u?=#O`gn}Hv?bv4;M{2PB49f@RLK{ zg9VsI$7ASbB$Mi-}HWqLe=`Q9s!8{k7(k<0=-zOlX);kQeUe@PXKweVnd31Kb z28Scnn$Rs10Qw*!HKcYK?0};@452MW{>D*v%H|)3~pwrbT;&rxw_T_cZ*U_J5mI387 zIxL&dgF@0f*WsxIDDsgsUD?cAV1ktuIIMPkN{h`{P~af%)8`;lDddtz(SJv=Z00?( zlf1uoHvNw2@(v}PL>&(l8h!v3nhhz#6q+lz_JmO_t0X_cTL7zFy*1=_4)`)&Lw88c zy94wNwebU0-lxh`l|k+3R^_)g&k*j^U92@mQ}1_lkBgrj+wX0F4`d=>bDNM(r##;Fl(2C=O!|Z`|vd&h~of z7Z8)&=&}3#uHIogMnYIN7&wi7GQ7xFKN()+&;F{&AN?PT3<}}f0NVYD5E={bmQk** z&%Wc>)?z(HYu@H9++rCWef zIajYMA{+=s;}8`{i^e&>JF1FXh3`KLxr~DFRUd$QyA4%tX8jvs9SxoSX3P%|P@Y2b zrCAEKNmCTcOA{+9q>&I3!Vf{R;-!3Sn)$)SCYvAD*hKhf@>0}OW24N-lvoCQ1h3sA z=YtpzgG)9i+yiQ3M9?nT&HR0}k=W;U9ID8ZkqqI$VUWy^sbVB{3?hL9Vu$Qz3FB`n zp?#Y*TlVn1iuyN74*j{T5jn$cbu6ESCOk@=AyD~FF3Tk!+(nBcS4>GFtD1|BrQ?}o%;7fZUIC4peR8Mp!@ zWnrF-<-~uYy3(Vk-?rkPboz(ZASC=!S&Yi>c=L#a9Z?ud$+4PDgjvc%|_C zE4cIbxI*VhP8d%Q{P7hPLU<7ey>KwUQ*6ei8%PZr?J1JGwc3l!u}7^vtBTtNtrM*y zVmF%OW9U9s-zU4c50jm|IfQECSs}E~2Ac7J z%PAE1elLZ1{tMSy5+VN?jMgn|&^pJL*$@}#?j*XJgD4T!8J zUi4|=X&-%VR`TqQG`dsV%MScxwaiU4ix-&@gh4``vBl_Vp9aObJFuwxKvZ=fmF~jA zExhm+iWt&}7Yh#_j}PKD&W6MEW(;kdJ9nF?`)K8O7^xWEou$NA3(s$1T`#e&e?r)* zqm?lJZQ%zmq5cv7jsy()AEb#&{JTOJz0G??8U(!14NaPd{f7=!9`c|`^EB%;u9rgS z_cjKaFQwNL@kqUD*Hht*f(>h7OtmqR^*~X0kb-z=eYi_dOOg4eks40vRSc532~`Xs`5JOF(4YYfyzv7FY}dqKrO%k*?8Rf!=a{XUG*ad5aZTru zT}Wer+~i!$S!v7|hfqH^|LsOf@u1*mx z&6e1&A-=vZYHY}8-d8yX7`;|PFVUrP9n_+Z5#QR#N`y%8Qk`4OdlMV5y}&^kIlis0V185?J}o4 z@wP>K4d*qmJ;U1_j%>DL3h2z@=@%dMRo2jRZlHwdROM=sTDzUZ$;X>)Ht)XX?1lOf zEsQw}JIYzrDXIu7%vosxZY+_b!J?_?rf?Qy=nm^tkADBWdWf-mJnp0Nl|u3C@wh&b z&Dq^Ub5>8A7o2I4QW4~906|ZN#=RCH+|TSrbhk&kqyA-!RkA~$PSHp1HoppWes_wL z317f^-e%iQwUNTw(}lHf!-zQK5wLV>;*rWgK7FW zYL#6?!L=3ksnaj^(^Rp-b2TG2KQk8M$vWJGKzQ(}Lk%DI?hU z3UC8FVQ%C`nEJEVqWo?$J2xeRq#A;STG)cew3H`yS#%qbx3-9{gd##1fBdnPe zfC@k)_o?1yD$X=FaK;9#nz*OhM}NtP&H~~;D+~MlQ;RHEa z2>%f65J@uMD{OfJ0la&03=6$GG;yDs5#rjrNY!3L+}kp8PVicWoBUK{1w}WF#{+(vhD8-dnat%QQD1dK>^e?EM$mEh zfb@*n7SdVR;nPAhFqe;r+lXaYv!ryJ{DOO6^9Opm=_&#g1i`t$ONW}KiZ2Pz;fWo6 zDwODbVX?s)XvjN^sYB&BplgtK1Msk-i1-q$7uC?)=;^;l$`7R0!CTIvTRuldj$0;r zAyV~@&)ES0lM{KcxE;ZnW0|pIEcG*B{C#oycb_AB#X}{wLUH@@r9?y4j9X^^cnTSP zUMe#BfU_YV%|^dJk7gJij|ALG?}V&MzJ+EERgK&j$;oB7JBN-3OrqC8YEoy?&(00P znMNfPrqI6EMGi%;rfTEZ=>XEBd@=FK-pM3W*uP*Jr+jLa-ty6(j4-`giLJM6Drc2O z8?rO$JNmCz2YtQt(KI+z1#M=PqIdE)_mis5<4zJ}JL$jgA9R#YfhCH zm0-?|KiBPqeW5KeY;1Z8Pn+?eBTCiE)d6X7iw#7>`MY^JbFqoSK!8`68YMf^x%jqh9Q-P4QY1G5N^}eS$CjQ zf)Y=Wu@sM z9w2;r4{o}ma|iQsUpw8r?ZPkLRg^m2KF6|dVzrTb8aL&)P*keTNE_sYW|AJci*%Y> ztG&!mK8Ni!|KZpTXYc=EInkkVpaduW(f=I8#V=1ODl2eG|HGmVu%ckj2XRWI!aQQW z^#LpWcfht>ZR~cJ;F+Pu8qyd2B843evUL>YNoC2iV1keCe*j(HU^s1tcup~L zHcn0+2(z0>Juq-a;DN4PhFD=BMVI2wxp}w6@lL3 z0v6$gNCTRl0MTwnR;|qS1$Vb;BaVLD)`}+$3In>)jvgd)EuX+aZ+`q_n=j+b;wfm z8uy5DZT31_VD{r=KIfj#%MUBp^3ek?xb_xu_@u5aNa6ZUPFmJhHjpmg4hT%TMIWa< z(mj;2qwQ^ghD19i`Z-eTAeB5>$`NnE=Dngm&XFnyf#;*VTFC=Ww@Pw4V#iR%OThI`=2*QphJZZ`{n~J_Q9p%qjQBQXTO+$kUwrXY%z)9`!vT&;mJG>_ZC=*WFD_B8RzE#w!+?cYiE|g3RF4qdATfKS1+p9j5~HLU{7*O3lv-XYiR)i=3{k;09QXvVk|`Cn{kotaccuSd_8adGjH+B#~np z5IM<3YA-ybEf{feu~w0@*hkOY&knSp`GJADQxSF@r#!{yu(`qJ4?whHyjp@NvYp|b zIFqW$49rvmf>@6{U5PlKjO3v2HpUI2agpucF^O=4V$MG^7n`$B_U70ae8byw@X+`0 zY3=S*%bikZfWsdUgZ_kB39A!Lra0u0#yV%s@Yd@8sx0IUb(Xq`Gg7e%QtpH`oOA#y zX1tC~VZO4OJngJ;ozZQ!NNG6Ic$Kt&C&K1%Xe!QOpnfs_xa#3m52r-U& zbdV1V7XvpN6TKji!{6X$SIDA-@TeGp|0w6R)%IsMVW*b;u(8;Ac1qL4Nl-q6W7}F=lHErX`To zEhn{Cv~m4vtrM6d=C5_CeqNo=Avc-N!_)2O<(ifSX~0270S7UFgQRh5#|0ZlAqRPX zI0w`h%kGcI zirE=4c88LneGB`s)^RtKywIx7PiV_r2^gv90Jl&Xm<=lj#9@=_dc_0`0Aq}DBALt* zpmW@da4{JeT1<`tyOZpL{hfVdFmN%2} zSn%J1`N)L%NM5QtlxKMhi-kD%=`}r&b6PTI`cRsgqX%;2(x2nKfp{@eEziu8>Fll@ z5Bk58`A*eJN}b9~L;74D&yXy25~p&_0DdFokgcqL$i{7Dw|fzv_vO3UNeQ#tD#}RF zAfDNVm>@qy7a}Ff>F1Ht{PnzFu&vBx+A~G6gse!$k8tisczGGjCPs*jcaryUnk2N1GlAmN+Kaa@Yc5maZ$OY; z#Cs8z{7ISmy)bu7u&rz{G@&QmG9W+>ITM{(ycZ|U=aM2q9O~i8_c-+#4k{$yL$)A< zG$t?%(&Zz(3IK}{KwZoy@v1ZFGINM78*dLbW?JM-MtCr1zDjowBhf_q#^y2<7XT#d z26?7Gi_(_%W^6zqdj9) zXUSvT<8g(B?)E0!OcIdOl9DXMsJ!+t$4IrQyg{!mhD`+?c|WXV>^7Rd9dQ4^XTBc4P$82Nz+JEe{z^XBYAdJtys%j}3MC36yx^Zw8|so-UhGAz=lm(fNbrReWzbI|>p zD~z^la|VXKt`B`Bl3yn8tgbO+Uh`h0J!jYfY!JlJ$|j|#Q{8>?y>tt7CNrxgw=BjS zPr9eX*-p+C+{ppHbqejNjX9D-Y0OF4*agpm&FwI0D_bU@VQ7<8`OO~4ZrwBnceI85 z?E&6L_Z1?oU&ON|PV&P;?0VsLVL$h<(#@`QYneD#?+o@&k?o2%FGWuc_7}=Fh$LbT z2;f`iS~T%U7aZZg0-oTL5FeNKCA`OXl2%*G+;T$LsPfoHdq@H*zT>nxdZ5EAm6&%D$i27Q>65!Mm!`FT%Qh2ythbBth!L2^}>+6gtYTJ*1O6@@U3ZIa^W1iIxMdZ<- zVWVw4TPfL*$?hwO8TWudO|B}}xHZ%IK2kolNshwf&1p)fRf$>UUUDef&D)~*a>DDd z@+Vs~mLl0NzXAnkm~a;m4k}pACL!Wz9y)3DrQspt1^CRZz~}ffe9rLTv!ocF^;>fr z*eh!pdySvTUa8aB>yD}HHRWD-?RY+QMH=cume$AEn`>PHZw>ULl^70pCxHK@z65L= zPonI^#MZ~qb2POAp6Q$=(wVw|r6zYN)$nP^vhxM@c@{p+gD9=r0VrUlKD>JeugJnP zDGghXqemoqCo3fg0J<^2+>0;`SoTe)Qo2m1L{!fD#dpFPA+V{-OMs~+#xns8? zgz$j-ZjTT~|7P60Ru1KZo)u%4A0D#SzwEH0+Lc~Sp9UuB*HiJ}x7}EmXRPC^>5tp+ z;4b~%w~|*bspXt`Cn4IdHusi0o|6|<)75QBhqC*s>B_dGJK1g3bV(b#h@d*TV9|=U zAy=|Azdz|n*5cs`o-2M%PHS4|K$Wm*QyyB7=uG- zeH1fyb~`~sO)qzVddSwV_DVd8k{sAIICaX5b-l=&{Q(u5mHE)U~)ovd*oh zi}7{_kfE(D_J`W#3juC!4OMk^M5f>GS4;4Wxb&`BK$Y&Pruit#Q875H#4mj-V6CD{ z0ovUTuxZjG)m1*)6E|7Tp}GsIQ6!Tx*+7<9V)Z%`7~@vy-Tmjq{7gis6>R(o+ia92<@%Js_&_0L$s zG4lc{L{KylbQ)IInNnAmo>D$1IBS`76|ub&chM(eH4^Gj!I`(o9O==sToD*fF#(N$ zHXM(E=rwX4t2|}d!_c5E`4YCp4(ntU!;uFR<`<_+bHit(lJE)K%a(4Zh4-0_%xVEG z$YD0lNW0NeJ&W>55E~>wQkA1TR*k3OPDp7TDHiN8%;1b=GiPF0y6TonHV}>s>!1RD zGvR%TN7LD9(bee?RoOgV%9xWpE4mY}FL1Z3Gaf_oN}HJnZ3Br#PJqykR@ur*t?>%Y z#-n5+8oNuN&e>}p0l`p$q0^Ykm zSU^Q9UTvVVYYss6vzd}!SNr0{J2wDUcwmf_SfU;fut2zL52Vz}Q;ZL>RLRkqiXhCl z=QeX=Nr`We)5$xn7_Xu5r@kmpzG}YyLP~IJ z6y`@^N9FOj$5&lhi8nDrR_fNJ`>SaCc{Z<9G|%5&Sy_c=%?bd@_z+gcY-Yya`5MZA z%L<$X{;G}K1d4F&`V#j$66bE0gGO%LbSu9sgjPcr&YU1+cxL9w{rKoD?C=l@^Y?sm zw#yDE;tHM-!BctABXplRm6OqE`>$Q<_a_a<=52OQ#Mu<6ta)qU7oIoVop0bTcuHB} zb}7B@SS#{>eML2niIMBX`xNDbOO6}44(#e4^RP3%c^1~h9)RNzPQ2n0dtB%cpLSpo zl&oilp+iXrER~r(DmwzzcS@as71S+ zB=kvL(Pa5?vZc)oje*c8AFbU7jopvAXzX6xJ|kQ9-2_m41E84!82hn2T5u!&mVNAe z>z0U_u?#YL$QD$brVKD2=J>17$6N4J`det&DD3pn&so&5Waz_Ju`tX}kG#r`nrjC> zz$GlLgbqL>#uV*FtYpDQ*Md-CJV<}`D%KgWYnyyan>NRH<0=0UBn_(1gzD3LG=u;} z-%Us($z1M6^ivqEbUNqDUDb3225?jd`wwOTUiMH8WXO6AxVX)Sfwtj+eZvEh8v($k z&R5&?tcguJu_fb`XA{U*OS!>tyVEP5CR?zDsaP1qF)WgISV@~Js{oU2|DQ0aU5a-? zgbnFIfO1t6&=I7`HR??IAuyzHuV1>gnm)?B@hyH?Xc}NQETmP_4R{Y1>8xuvFa3<5 zO803eC|}{Q(F%Za%&1KiOpz^hzggW;y7xb{r^} zTUz-l!ftb5PW!`-c%qM^9tBYULCh+jYoD?UL_;W_a?%)uW=W0;cH**)!;{Z#BiWPV z@i_v&k?sACSu}d8T!vORuBMXae+_kP;_v{*CWkAcZF0Wy$}8+H5a0xb9W9Q$=FC#B z+^79uJUga@j#D|-<`Hui%6)7M(PwRCKl-eV8}75V9V)D>(ZrC?Scey}M$yRpmW6rT ze#I94=1}T(K;Pr;Tyv#GYzaj=!Whn%3bk4y>^~&zx493kA6*#r__Pl>2fxBEX#@{`{|^2?%sh$P7mKvemhdj>lL^8ifFvDL$_CmArWC#j~nzrsCQ z1XAZV5C)C+%bAzQ3{ouW{`wDqQlWxfZzVTtVJ!j4p;Ghq(8Wh!Fb4+I@h@fI?USH# zBv)P|*8|1OtW8KF@y3qmsrc2C=1&VpHYpN=DYrj5i_OyOaOF7zECJXy# z;lU#4g6@{!+mOhYxyM6k*17KZx(lR{FE0nVR6Y))V2IsH2d^}Cb5OvV80iGOI!n;n;sdGG@N94=oG93xM68ju)=v-hM&w1R@b-hsb zCc`3xr$ZNNr4xRG%U_V^J@e$Nz;x*{C=`lRD|y|fuH}KfJd5l_|F5DMI8s7*+W>Q& zAl`)OFFXI&hS7!B&sw^HkY4~khlfY#^fvRz)s5sZ1b)A z*xS+Cmccggfq>$vjm~cQN?a?VqDZycH%xYPXH?Fz4?V1M?VrBx;bR%$` zJY*Nm&5?dg`@&$eZV2sBY&H%dF1>+@4z!?`Az+1u1Y!! zbJ6+(gO1KRhkihKm~cT97===T^1ekL8MscX+4a(?&LK@MImIeLl3cwHT}6tomuBPw78yxKz6g=6Z)cz#BkrS5w@h&)!I)bcI`!-sE-SZ-40zu@BCoPuqzNgIXv1 z=sknA0pF7HcD`*U2!@>S(QGpfQihCJ5O2)DzM_}@izPDM2MtPSXK$~rk$AjR!QH?9 zR{AXTOJH=JI@QD}%j_o7p_kxQ7NFH|&3XDqT8HP*xvL(AY?gwEjPN-GWZ1lbom5nX0gtGBh2n%@_7dRvoYxVEY*G^xp zE-19|nx^$HVR(&TP*<56Z;1^q>0S%{ zp>Z6!{grUWH%F{RMAT79bmqEW4rOloP#s+cb<|0x8s=r~57*0OC`A>j zAE92(cK%AT+^eQeU1aWN(27M)Y=0$o+UQRN9OEq5}J`B`> zUKW*?qJw%!DlRe=7FOQ5c}Sl|_@X>jxqpJBVPl%Gglc|Bzf5qefnnhE5XVg4w}T+} zep8dyJhP_xmgluXf`7i+_e&+iAEqNHkYDoPBp3texfS?$7Cr*cmT#p?621dTp~mRT zQR0EQKhb%mbew(_=Bv^>$g9Aj7Ymh1xHZMC4Z3yYdQr)JDfI)z@XK)@H0o(x02WsV zZ%Yo|mK3~gG8rRz+^57FG0eh0a9$_|C}2)eHSY_*!VKl9BHwQf>Ahq#p$L zVDNL=ZA$ROL}j`!n<*r(O~vCR&|&c6Kvhv8-5B`7pp<}$89_bK>6ky^5M|+Tac4JD z3Nq(4Btl>@mRyf4ndn8XsYhK!|8Z?bI|(ojhB~?@85J5;A&)!;*yfNvqi8KgRSL2m zFlpHRicn)ExT8%lYH>NORp?Z-=?806`hLyk-=XTWGjyi@s?bdR*bV*mcMI(=qpPo5=~4T-6pD^u zO2e^wyf(A>D7u5W1Wf{VI(W$d7>^Vo4*0ajd|A^xImFwTFZZ=6eC;&$!$Yw*7li#% zUou~t+}AEgUyp?IAo}sOp&wi<0N2LII9>tcF@T2v?!y28jR183YXOA3yH5D?ww?f! zfJwkS3Fb*Kd%)}gvlq->F#Eym2Xg?-fo3HxLo+?*pdLQ1$162Cw7`vFMz);loWzW1P}wRh0+hT7ze z*e0piCgodbo1o{rIe5Phpar05o??7wW4^-oC9S=$Xze{05jEyb@)K^WFTp2mg~kY< zcSraGPvJKEQsMgwv#i;SGpW&W>%d3`NCB7vFcV-7KpsHJ9kgwdp{|p`Oae0rOdXgy zFtuO;!MsZirW#BYm?|)pU@D{AMyw+@{9g;u2=Kri5p6S10lAK73;G@14v}_IZ6~T# zz!T=GO&Na&mKSH2G&@5(aIybcNXc)JC&$|@9^1T>zm#10!q7rGURBW%?8ZYWk7aX- zL{6P>g)i_a47rcVxUr9E{mX%wZ=i~4RKBi3|7ia_jLg^dm9IlCE#2Ur$wY8 zp>o5OC8%JV-0-G!LSi6b6jzRLuv{k?)wl=#3fu!fR%jI$b#Oyzj6%5`*LsGu1SnZf zS0y)_3&|)LXU6aI9nj+1(F91f$*5{n1;(Za^GliyDw^Dpzl4&@tR3J+NwpMEL8a4e z>noNmKNu34v5J8=IaMOmYWa)w-_<0dHuL?Q+@F-*64)qyD155mCfu&RvE~Z$;B%C5 zp=^tP8kzQ7h;biV zY&(@9z+F>6Ehx_7qaW1I*KAZ5noBHrdQMkp_Lss~tP~F#K|md8{DgY zS>UD6to`kphWV(k;gqHxbwcaE(`+dN6N_}USfp+<9_Sd_Za=i`zKM>mI;rNNp|G-c z0V}83V^9gk9>Gr+_Fq)yOu$`~b-0WZstAx@F+vr2jVc=hrpJQZPC^Sm8L!+zogJv$ zUO0wK1eiU-{=Ras?-1J1RCEUN;T>oBaoHLCbar=s(D{$fV+jZO-o8^p5BSo7kGvFZ z-{*=>&uBgPTch%5^x(H<)WTG7xMFdNF8u>|Q^A|M@BO}GzV{j7knoQ19;UN=pO%T3 z)u;0zc(ioZ5nu(lg}%8;CWjg1W5_rb7z+GAF)_9xF>EEl?NqETgIrM&%Sy_*~_i zi(%#b2jL}?BYqm6#Znc6;t!sxRGBQnF_XpBU3ye3kwy+ZYnP?DxTna39t(qGrih0( z?gD&->K?!oR?~Lk)IfU-MoFi5J{{IAxJxoiwcO~8alBUQ3KiHf5G{ke4jb^3mqOUi zUnP2ptI+HjUEx)F9dBeCCS)45>)G_TGfP#P z?falRsR}JsqbO$1qcj z!0h|p3hLXJ@)wcYo(|D!p>{m#scA`A!>zDDP^8I!UdG*l6BbJiLLjhu(?C?0#G0q_0MNBj@U8t$k=$?WuhMx}Q zmdy)CY7QTiI7w&I0vDqkRH}kPr$0vb^3|Sb2x=N|m#1_=$rKCu=6R|YQ`7J^L{HX2 z?Vv#K2;U)e4Xv=)zzPhDTKtGv^u$$)?G(6;=H%=QGz58zhy&bA3-OByaaTcW)cnOF z&Wn+_C&JB5dI2H!lU_i{?)BpRlw--~kK+PbC^I`AN4;=Mh4#SP;^k>2=|SHc;(nmL zk4NtZGCn>u!Exhh;N7_EETrk4V9+8QBZGJ&A$egNDmR;Oxuj2`HU^>!TqMj(h6af@ zk-7I`$u}hXH>l}p1G-rgu`%vRoQysZq_-B~Zlus0OXlOzb1a7*8_I$jFG1nd7#DQZ zcr2-fT(@0BMhi(Bro)vkm;6=0%Z z2AUmU*9(xe?L6gMjQz*uTbhS+%C}M+_k+<0PzSIUzzt9da4W!)Z9kQKi-`$AEc9N0 z4uIp^{uA5xzRyp-rSbkB$+uG6y^x0i z0402?0dxS#04V_1-TPC?w_+Wc;QtbUN`UqE{zURE%NZ=RBP#fzH^sw#P-p}(>8Oq=0bW@#Wk{a|Bh zf1BY9lLIkT$%1Yjuy1&)Qz0%_G^3q~caYZ)9_z5{xjjfTk)T}nQm|?;E&*WrO!$wfeE8E zsD2~#r+=IJEs!EKfUwU&0@msKWTU^hSAU4RIQ3AWiRx%Z#lFDk7xy;2%^4I1ZR$SY zG=b38_6x?|Q%`_fAg%8sUpqwHgVrd5p>+?Q0V~!jI#Q1mRWXHRgE;Goaf#XSO}Gy! zBH1{GVRqd|&(MllOom{{4Oa~=(f9ZbC;i1I_$$b!UDE#lU6Be6s(>!j{inc&(nH{$ zNu*>K9%m%DdHkH&L$ih_Y& z*jJ@o+DY`Sexuf-@Ed@Y*OG-TL6m;{hF(p>5#)s&J437q;pnSMLV_~LSRMPFP}>V= zr)byr`)h&y@6q^<&=We^CfS_JHT6&9PTNFI-58gj1L<_rNpC~Xe0_)a(&ijlT}C_~ zpMx%Kaq&Pz4B9|-(4a+CDTK<$!RR{T<3qw0Z}8O;hPwg9kyvO;U0rQ3o_nb+E>Tc4 z8H0@rVq*dm^tHWwEOmION>&xD3Zj(3d_zSQYOMtS`6vM!w3^NNC^3!^6k<(h^D%WQ zc_5}q26-3SQw_b?+E~JdBXpmYrXH!^q9#rK!L_mZ-CHR4maW-yFre}ED>q&OiF-yb z((KV>*S*vQGCISNrb{(@4r%`E$Ipg?d?FeBP)NoN+@7QF;FXI0K(>&ec=L1)lqn_O z*Dr4@j9EXb=~5w~aq;L0`6zmXz9#0U0(;wc>^D`iA{2wk#II?|fVE1k?d>EupH>p& zd#e~p7mX+yLlO9yAy)EvT!!))PX?h|=nZOICtq+UZWu6}1VL2OP)il-^w4|56c{w{ zE@0efz_J!DhRmCjVw*j3S`{0mxJnlg}BGtW?s#vVn zG*se??IhC;sRyN#86W_*(ET3|MJUkuY==mj5AFC71v-0oP(twVj%WcteaCq#(7EMM zwCo?DK$FRwfS17-LOOXB?6_@BMP^;Q= z=)V8JMew0)&e4GbSRu(3a#TL6lJU!iW+hcPsg?LBos|UPptq@5SHD`siNksWFxp|7|`O5UfhxHwAQqOZ8FN)FIh)PYQ1qOXtP>(h5&+EbPfZIzuR#Oh<{MrWX1 zci%y87*pzFo|J4hP#X{pXFVGfH|jaiCLDf)Fi)+Ic|r2NNQ^+MkNJ~iGgq|H>0|av zHmRab5_B-h<}%SHSs!yivWXLISba=~Wb>~rG$SecS%;;Je7c2ZM3iSOk_JV1@DMrh z>hgHJlW3nzvs;-G_!?L<-@zc*`&wm9vDB$errD)T@qQ_^0*k!-V8j_jRC$66@X{5T za|C&oj8B6=6SJ%`enR{S?n=DXGDpr|29_6PSrtHYTa~_j%J>uf+X9fC{dZr{(%I!} zk?rr>M|S}vHOcYrO&R|MWB>vk@7srcko#SQ01g=cn_%09@xKo7zv^q12O8-#Yj{R| z=TSUrV8JanCBhj#3rTqT>3NpQ<1}XT%eN4TPTYO!AlZ^C}?@6_6W}gjqAGexl4$){L@@W_t^+UMOFu8vlcQ zQt(~ea;2$9J;NL3Yzp=SgB#b(Y|gtuH5awzt+|8@#sRH4px@6Ww=;(iBPlYGN5n%v z+^BX2m;QV$D%@hn*_)L&n5q~vdB1~_#S*hfDM7x$l<*?2Ag{x@EtObYVC&7~xlic= z&(Z*&emb)>S-7J?L!)geUwx_Mqu#ANBfe|T%E1^3P!gN82=zUDK` zW?V6(SW}5?hB-J!9YUSC=qoTL0(IJB&`M5mL$~4Qf>8%-NkK*ur^?p9!Jmd+B^Y$6 zt@HH;U9Akb65Y;YAq?9s6ESR;bOyEI4Lkr_%8D2kOWTDFV^|7en2utYHjH6x2*d6I ziw(I|UFmNx>Fa~|J=aBI*?lo*V_A0ha4ZAH996pYW|sD9>gVDvZD8=k=0F@{#oPWq z!O?M+nx3x_J&4yQ2p#%2{KkGweJewC_^KHtcQs&~rkV zgg=M;n9aP>Y!1YRu&v)>#OeM5qo+QgrrF@T{$Nt~<;T5OHLvT|35w1vG zKCI)?8rRZYYJf`ID6C6!9cBD`00-5XKw4nX%BEIr&9<%~3h`3?Srp>_9Y`T2Qwovt z14Lr#0G5UwMkK^>&ul3vrdzwTk7v_+ygq?iFBR{9I(skL47yEj{y=&MnO;x#qG<)w z@fa7JsRyP2|ip?R%c0;Cx+wUz7#8Hevjg_Nag zVgGN04iHe%52YUReXKzvdd^GeO!ymrlK{nk)A#X4zme#_<}OM78W)=;g{P{Fq~Rd9 zMkqxEJBoKwJN?Bc6~|KFgN`lmCxzM`@NnvPI0t6dzs1k$d(YRZ^&3xwYT^XA8C43f zfY8M!fY_%RPMC@c$%3I20+$a}o6yaIISj1i|qQp-XHUl%2+5tsU zv|e#Ap>=8Z6G~M2D%r+`Y_};zP1scm_^ZUjE|u(Y+}W+dv){O~zdy8jz#`02f+dH- z9G=8_cPAq{gl!}qwZuYJ@0E^M8-0VaohYaAv8S^a%lHJ}pqx)WojnC)vMM>r#XZL| zp`T>!rPDY|xnv7T+e@!r9;1wsl0}MRAzSfSOn6qVAtc$WAfa%$5hTtmr? zCd=u?ogC_F#D-dSa6h>ptad#RF~_S8b5vEaxUr;Csm0M=g;VmuG1Ei@iNUsxr~C77 zu0`@s$^O0#Lu7wuI2u$XVobto;te_|#}R?CQ1$v$J%K^(Hy-xa;&lp|`W5sz1D*}S z$xnJKv2Z0aPTX=|Es^m{a8?HgCS;O-L9Gk|e;g=ryWuF78ON++k|G#tfQxG9G9)f)Y6*;v#~~=PM=D&D*Z1+zEZv=Sh2q1HXh(_S zuuy4k?TO6V6Wp<8Jk2j-`PKbcfeh%|IO!4su51)N9o*<~)D%9v1odiSZ|z;0A>Qnd9oYhCO0I@o326<(XC#^zb?T~X$+ z+nih}yUglY^-(n?WzEkiwKu?COF<;h|vP4G@)?OxXEWbMuxtHWN-mbt2{t3^4M4x&$)RHBN#P`Wpg2EkIikfaxCv=ITt&joaOA*7#zaq=2X}nHWrEiapc-O zoV~(chKX2tuF~bPbL--1KA_0 zXP7I=V`K(H9}0zWO*>{5?aFNxR^Gu~jqhcZR&bpf|09*hPPLYm+1#O&+%8BI zV;3zU+R0L+*!(kRrl(&WAHt;&5=Eg7?_BM4t%16A(@ah9#*6sJPW9NzTu!I0jDuwI zJT5mNQ#s^nYPEGW6sXe1O3oN;jh(Bcc3x|>jWq+NfbGh9Wa{hQuaJo3R$tpx-wd@(UJ@93Xem!i9$1#pss1V3FC7hj9RL%gN0(m==S3 zMD>Lz0Plnfu{&+p@g?FAiN-(VjY)G)pMm*Gb7zFYm_^Kiiso!qJBX`OjpWvgu*lq*DLu#A+5fJsRQm?8;aq%O{gXae@w3(-I1j@Aw01ezj-Gr2&< z0O1w_o@I?1C8Dd8$6T>Re>jg)-O)Oe(1i)3IHnVNW0>hPu1lK+zv);O2~lXdqz;7d zxh{`kt(`M@TxB-QaJ9D#h@dU4+~Hud00#`tGFQ3H@fstU9*B)3K0hND%i6QZiI ziN5SkptgVnw~Hgh;!27Z<+PJPNEVP0zS(s^?<4b?#uiWvss`!-WnFE9*s(Ysn-__T ztAYj6;=sh9rZ7){Kh}mN`6EvlYBkq>VJ6)^MhrUe3dpaZq^pqmFqFhY^T> zTBu!SV7Z+xjm{HjXU>$aBJXmwGF7FA)9^)-E1eGQdeq}RDci^clpDy=w}mf6zI zzdk~Fn}%s%OqjoL0_BqXj0|+=oz|5i^^V9wrOoOVbBq428=;JA?5<($77jQ2oZ-A& z`3T`=VK_GrrLVDjINs_AHxRZY^@#pvo-_UxE~gE8{IyU~V6Yq(aVY-jnbGBTxou9` z)-L!ix7FCoBK%5qWLxWoeghbTH51ua(a&|m{8R(l!656gK~DrMSUueTx$8v=RBq+0 z;5|`n^5LD{W4n#Fc`+fxlp?8x!8iKNIHzA2(0TOe9g3IsrwSlq9ClbY(p(x8$(o3{3}dvHd0bvs1;<+K zv~;mfZU2pyAt79VdCz2T6+6byBS zTwrmbiX3K-6>frAM=lNl$&GYek9z;Q>L$y%ru7 z_+a7~l?n_M{P2@0a5!wMpek0bgXZ@lh5*gLvBZu9-v!j4HULnYbAm z8`vm6u+T+O7O<|yYIk54f$9xEvHCst#R4QX(UA=;ibNz zg>7_9b5$eHOnU-;-{^6zhHmG!yKT&3@CfqGIw0Q8)m{v5EuZRgIwa2ByAF`Onzo53 z9(irH)lyzXRC3rVC_gQBUYg&?)C-(|=D-zu?ASL7u3bdCfXC&)uJ56U9nJ%#2AHn* zhwQLhot2*u7Gs_YkT92rDjoC4MOk2;`LfDTR+)lo%o(t2SawFNYZi!>m-9x}G4&kc zcSDtUBajLZQ9Q`hn6U3tRvvsi?X(>h4(oDEWV_+W&XH zlw*RbplQ+8D7SgbJa#t}hB2(Qm9Zji7|K(QXBCS)W+bjeml=oBP_D5KLAtnB6f#1Q z6d<4F;oV5$q9}hvTvFDCzG>bd=7_3i7KK`uBDx!Eh(k1oFhh8V7kc1DANa`R3S~@e zoN82jf;w@uMtjl4m*~cfy)@~v%dbeja@E?QXyMJotX zW6U+UEwFmIoHFECOfEO?rgq}D7!6|-X9I3@t<7PI&4!{7XB%5rx20}V9S|hNmbxvQ z>vS|68e$k`+O#@TT_aGJ$&)fnC3Qe=fGC+vc-VuTT-R8K6E8rPDl02hs<^do z_Zqi5iXL5faAVi--{hemdmg{}Fj9>4tN(#tw2w^@KiPTyBExTv_{q=n7YfT>K!6`; z)5`xe2FSv{^L?T)Ko7|!n+576BUu$XIxBtNFZS5Tg54~~tFK@ner1R}}j{f!C zza4w;{SS`+{lkyCKK|s>6Q6zl1?m1r;N(BQ{Ho{cZ%+08>vUiLnQy-v_Zx3we z9=OhHVEeya{{Qv$|6`2Bx!wPtsQ>x%v#P7JD7(j$!!w07!o%XrI(QhP@!In8Yu8bk z&13`~(n#mrY}G5p`MZU#nxXeaz}(@h*#_*PWSPUS;=RCq-^4p;95;b1j%E&U{KzvJ zt)4R6oqbbquhlja)CWhDAu7~$?#dBcd$myhCJ+iw#b!7LGKjN;K z8tvXO%)K`)+WkO;`|j!4%xlv}j{ooJ(eB5Fxi`%U*Ui1N&RtKAtdY~P&OLWJ_g$aO zJbC@O-QUg5X5P<^c5fLLe@5Q9+dIvW%@_>P?nj1&|3k^h?)NN-cE2;i{q>u(nS(cv z9Nuut$n|rNePs8!YesheYTd~AzNvQP{C%`(?)dkC+lK&qBi7`noPhD5m0=nq>}G>qGT1pj4%=OWml3vH*lY2>VXuXXS>g3M zR;;pdE6QBX3j3<;nM_=So!wn&^Q^F!gEccMZ0{A9sYM5wXkW&yT~Xn&*}x`7w2{6P z;#axd>vmYzt)O!~7+<_-Uukugdn>K0Z7Xn{llOvCqUeH?@7WoQM*I>N5LY;DYrrl+ zv~#VjT7gs1+0$o3JBRZjdSWgTZPs|~oGp9$jQ?rx>O$kFqVUP=+MhJlC63azzbQ9)>| zHHj2yU4zYoLX;qV5UUW2-?{h9X7aPP1&bK>z{k1&bM85J_RgMjnV~!Faii9rwgkH$ zS&kKs`C73=eK^W}Nk&s4Of?`!b{jhqk+^a$hXPybZ9nrsj`)hawj*sHmsGWdlM$-| z^NUzsqBGvx#bqN~`e&Yf<_0IpSOLYhT%Vqrz%zSAkFRsI(4pdbpiW zpIE7EjpD*Tamg+##uoE;cxfnS&a=h+h%8so5if1xoJ35UIh~HGhB>D$`Jkb^g6wIw z!aJf(F-v<~H@O1yq};BgNyeb^L{LRjc7)N&*&9zscJESzm$&tt8p@&~+dn6feVI7nuo10-)qKz!6R+I!nnz~ z|6J@Tkl^@o+)H&V%i;>UmZ3+8LQD4u5e*qNNh{V_ZN-!mHrk}859?gvKEc+eXGI^r z#kR*nJg@Yk;s?Q2tf#or7*ga`?W?H)5U830a%vkl2Mz8)J0$9 zLmWvXZOvetZDLBOyH|yvwE^fYz1GFHUfSxg^iJh}=c^3OYZammtY?-oef;5+!SNY& z%g{&K&a57`JFaqeehG9|ZdCfJAh;?+3%@gu`T%MB^N3!0gnW^rHbVDG>53?!zy%%K4iy4MCQ&bgRUlvVXtulX5$+J})d}udRZw zO!Y3{nG2?R+sdcld>CsJI4{@PFHQXWCAt8f4?Y5ZH~3!g0zUr(UI<!mOAyJTFCl<_*r7jSv0ly8;1SMol|S4*E-DGvw_$@ovnwIfpgoQk{?wex!8 zID*K!LfUtW%ss+;rGCHEACPel0ep1tZOI=Md4}bB?@9S-k#9`uFG+pDO05f9XIFd7 zn*zU8XpPv2UoGU8^qY?Kt4Q1DY+iGuUw5PrI?{(6={FqdK1bRmcI*(n%;27%1o(HL zJNL%x$=OQrnXE1DlYrg_ghQ~XFqW>>f3BWVBGP--ZX zF?+6SZVEqjlkL62KS2BO!5;>T=*Pk7!KX8i-*r@_YOvAPq;{uDs6O>fYRlsG7cYN5 z^#{?zUAm`B%I)~2^S{?}q8pu)GZv6b$hpt_j6Jkq(xi2O2gn0f0d9bR-@n5?1WW^y zzyvS~d<=XDoCHn)$AJ-G7#IMK0EdBo;2`h{Z~*84+JP2n-vB%bR0HL}HefTb5hwwQ z0S_>nf*inV_uSsedn12xZWw##M6UOS*eAq$Esycgf_=E;j=nfFRY@4(na-dKY`~aPB?h-uvv_ zoaf%;gvJkrLT0Mh^1u{N9uqzP)Vz5({kis^;>z0#LAu0u_hZV@Y!Fl1*NL0y>lASg zL4SJZV>DCn$&17rHkHvQPUfFL_74>>c^^!{%B`9xxwv zmUy8uOxG`!3wa>z-FYgt!}0;0=O4|$^DdvE&_!bX4?52+=JTNIoz%a9D>xzixceWT zFphh|*eQb%!%TC7TACDj<9S#YTj=c)1^4ZE1<(ZlgVAWDceX*J(E#1YL&4&?1dkOO z(}PM2320ar#2O<=5Hyqi=!#Jz;YPKf5G%000>s$HLcwA^78D4LkpOGN6vtv&+Rg&& z;#dkXuo~=xm0%wBgRsDH#9}QMd zmnP8GwPL+i^i?aUR66Xt3D~AqkjZ7(zYG-Eze=sdei$5!0hLmV=h#1E03B-pw$6y- z8bNEIeYJqj*aCV4gZ=8T9~Q^0L&#;=mqH0jl@e1m$fO$V2kmoVK#n@eqzowJ45&3! zKRm{9lsJw?s{mBW$QqzuLB(g+QlLa=nJLJi1m!1 zL;ds!HQNLRw66~RWkl#uUwsqmY(QPnM|#v(kGdKWGMNv<1dTT_15&hC;)V7iq||PN zoZ61QRjRSfMT_mwcC=qjp+Vq$Fe`+Z(Mp%SWiSdfQWwe;0e{~r9DvcifjnL{bju9AJYMlYg(eDT? z`dx=$5h`6BmepZgV(g*+4d{CYW7I(70^?Mx$9TfnXliK!4f>l!e;W`@6fG?nH|Tqe zl{$>)mR33k1mlGOX(b?)OW;$Gf`z#hJUpZzkxJ24gd8D}Va&+DMT~PKmDBBb&~I{# zEre3u^H%m7^83Dx|A$2&5YYecUA@`N%tmn6#^x^94x8U?=0qTPd*^1S3+zRr(;{0N zJQ3KKHHc2zqljX-3{$1f&TVYWs_n$$q$E3$86L;j+liB`sRWA6PutqqG}9WWK{KcH zT{Dr$*0$Q*S|}7($B3}9HD4$cjzsYg3X|;Y?W;xh1$K4?)wa!4XR{bPbNkcwcGfdy zSeu(~rIkl=zrsoXj}-E8m_TbjpC4!^vJsex?91%}C(Mm8w;pMpB;@mHU6pENyQow+ z4mL?jN)nrwWBmp@YwMXp{^%9!mQ}BaNuN36dykPDW?49CY)Xu5U_aUGvTu~E4L~yFR$q6OR=#F7A_OFCM1=+TySw&xXe{4 z5ZKxYJvJQMs8T)24_G&i-===<*{4tRrTP(9e0-))zvg$-RvqkC=^cCR+CrCxCLXU~ z$HtALYj)4toS3li&Q$59hnuSUM2{G;eEE-K8XFr|yZgj5xmWz+uU%WV*u`cnj~ALB z6zbxAXwn>MR&ZW%%8*AguRhTimwdeZ$Hqp9WXw;?<4elCPX=wC5E^y*tU@609vxn{ zXll)*$)zPa9g~r=DdNl$tp4$>F^!I^CAUW`kFP!~e5O*(5Lzdh+uJtRo~m0^E01-a z;>MmVE1i?AF`QYlWXbYd(;FSfuO2hzN8j%bsy8GhCQf)I6!N#0H=K8_ajtc)4G-TN zwtLrXPtOC+^%s{fZyY0W96#QFjN{51i=SsEY)?%{G#5{_woWRLPYILB!Xl>}*(>w( z%u3l*5xdj}J>%#|>pMF7t~$9XB_lX9GvU~2(Fr^Af+=&dJx7fimFJn4H!3$HIQYPM zpE#fCzN`Jm-@CWw2VXz;>OCbTx{Q?IEs3*6o7vh{$#R(B46GQ8@8CJ5d%PDda$h;! zcl-}d_t!eDx#7OT7*#pkYo0DQHA`(3<$8DN(lfHzAt515NJ&VkTSe(8uc>jqzP|pn z{#sx6`1GXm3-gb9&##JQGJBKjnP>@}FHYib2&}%|+%(@TIXO9K$1bV!BA+v7!esmRWgm>KsQ1D80qbU|^A=aOS+A!- zz9GTRjC(;&oESJUSz0)G?{Py!L|$=LX-$>a6?eazH&?g@O&V3>JtxULNi5#BJ!?3= zfCb}tgaif#ZZDdXmbT@a{e{6f!w*zlc6axSU#4)-hiXb==cVn|i>mEQb0?c#><=D1 z_24IFp@%b4Qi4m$rWh{8#Z6u2dKX{Vm1(0Yyh=vNc5RX7W(+sg4@8B?&+5z)rm!ey z@}yn)|B}mVU77?A4p^u>^i9#cilV~8!i?FjuP;AiuZu<}s7tM+Rtbs8J3o2aAcs}-* zm%bJULGv`5aXj9*ah;hC+$GT@yf?3yV=>D?AP~Iwm6*11_&2>t{1NGS2mf{H_{8x0 zraki4`g5@9J_3ll^3)H0ou_u^rj#pEUP*Z)bns5(qzXKxoYF!}d8LHotQ~xk!ZDov|99Pc)Ig3n!`batcNO=n7 zy~93|b3B}K6uH90QM^19CT@wKJNPM;3J`osIVN&#gj|k5zD)Ty<;+U8iHA#Ekb6qd zXXrPN!D{euQJc7^M2+>)j|hdz#7kAkN7WPzmV00vcp)D}UaC|gRGqw(VKf{s^+JEk zJWSkFf&P|CO}w1rrunNj!5h|K0Fc0}G z$Lm$}9s;IJJGVt>=`rQFVjbFqJeR_wlkX~#~KIpw@c6Ze&4oO1UJ z)byS~C;z3qm)=Lvu~ z!EU|#)%UXO1BYUt0|pK3+t(||H)w2MTY3Dp z-JgBtIcZX&Ja*{d0Rv`y-rsV-(3p|-QA0z8sdkILGCuS74-N^L9h$#-k}s|&gDiOy zhbq50;IOQ8cFFv>n@{~`1`nA#_lqxmjt2%lCw^Fdk)0;JR#Gu+m~)(yMDp~X!E@&h z2@VcCKeVriKd9df%a&>6)vK>PYtIxh=Oi;{h71}0?T{f~ezQg_Ua_<H=~$<{@m!(XI_2fdm+<`g3wY7?6585cK-&vE#=KXrUcsxE1oK{EomcP@ z&&ex%-zP8N_MJO$^Hw7qJWvH0TaQ3tK{*`MpMaVxSGcvuEAkTbCoh2}?F49&kHgIy zcX5n1SP&lx3zo&e+#gb5)+`46CNr>fNj_-Gs-e<&3vS)N2WjbLpje=T`1l+Mos|k( zHQWKBD_UwI-mXi-h^p)`B$rI4#iq2n(GH@_F-MdwMG5V_9ZKIPYXzDouJjYLf zp~3z@e-EYQyH7aKn591mV&5K{^mD$yt1lmnd-g*(ci}_syNd7ImTnGY)Bds;+}>_( zKorm&U@ZJYvE59F3<`w^Y&VCdk>No1=a&6RUBw@L!olNrj7i&yu>SwOetHR9-ZEaN zE<@h4zuyvbzG;_M6!Q&yb8{Y#Zg9!tcDTeW^KQG3cK@=)|90QJwELGWx^KSOeRIw? zx9;TeIyUy?aXWkR`*d9I|M@?>52-%<_H96U<{$j+@BjGi_W={P`y#YL-+D`$-COWt-rVR^J``A8t=FCdS9LX3cO9Hx1GPu zr?}pJowl{Lk!R1Ialm!d8~I)9bv^E$*A;Ke>t5cyulJ3GuJ!3L)fv}=q>I}{(W-q-aW2Ano>M? z@PKRk{Q2|OzIm4|zm`v>>pAr;1=W@6ec-?Wl9!i9igh}2;=~DZLa!$W4;~~(j~ycy zFJ2_g&CLYY;IG@!W12_Xo;`b(l$VzimSst4X(@;O`}cF{(W6I6Rh5C%*Vl9PJ8bDX zw_WF(g4)@k|Jy))M*VW<&K=IjM%3XDj=duzgCwZcM2*+lEa4&lM5FvaIx5-GxZ(v9diBpbz-QhBD=7!)Rb+cps0|Pp>ImDPX^~e ziT;a>h~S`HwUVTyq>%LO+ezZaP3YGZWYMBUWWIbp>O7CrH4=4%ZrE%C~}kmCEV z{hb4XCCSXa&vWndKYl)+`}=lTd+oK?e)nE$Z_and`V3qsj>)L1s+!}M=^N|wYLZ_@ zMh4Q-(-B9!ySTeietSg3kdBa!Mnpxy*2WH+nmQ2BvxlcA^o)#QX>AR2Q>)0(pP^UKST*4kuFX{eSIA+5}q)9XJafWDT&K(XYUAeD;wyZ z)`f|w6(VDk(LHhz!?&kU)7^`_l3H|(jG_E&6MX$5aK_4+c+!Nvo+infPrPVDPu~I- z<^iy>62R6z0S=C-@b<_f9x~zQlY^*`OvHrdA}lxqK7moxep~2hoP-|r731C3)*9i0 z5WLn9MK8c&^NP# z7XK8qPMyNRLnja%Aw>7s6ow|LOy_wTch)$5*c^L5bHMw*GsX$62pIX6!YZ&F0cnj0 z%kPALRwu%9`ynhDf%xoI2%E=|)Hx1u>jcU=uA#Db9F3zB=s4GdqyKcqzW0;h>5+?+ zj51^wb|I~>8->-wC_6ib+^SAgH}|8lxtB0#0)(y{?j(xD2n-Xzz|4ZXL*qmc7Bs-l zI}ui9ez3N3hpCAh_!^$bsP4kKnJJWZc0=cQ7~WH}$5X41;r-v(!&y)VBkyu}iJA~q z)Q6DLUicSWL{Q-fvRiK&&EyJkjIFHg6>Z|s17`b#2a|?4zbDmFV9D*W~;p`oX06_w(o4S!& zcox1P8F02uf{l4Rjk!o1{3;G#y)VFN{Sq8KnTPk^2*rzXmUvd-5KJvn;gQq?tMEp6 zi(BEI*$Gp@2=qKh;gd6h^wv8FZo3KJ_9?`7Od+ac2I)Oh5LJ#Ly!% zQe+l3ATqH4p56l3IeEdD#-w*_6f!akky}uT0vZ#I9c`GIn&$9RTvCJJ#B>NmxyY_= zLRM2d^4o@ynAJ$*IRS3gY4Fs~fz#1!oH>wzGv8)HV^=c1dM_HgUJJqpZ&|}RtQamS zO>ju=foH}!*ryNTsB1U0?fQ_~GzDS%3_`nRkUBJt+`ehVbW9_&XBttNm*AT}j)u`O z6lBy9zNEpx=rmy$>9Njn!iH1OBOEi)*M|e)rzg!5VT9K?G=HBv*Nus56A+eBdov4= zUDu4f<_?H!n~+q|M(t`tR8|FC19ITunhhVn3HnLl$kk(J* zU|<-5ZW%cIr7!ffNEcoFp=ay_9djp`(VS^vYDCy%L>OlPOTri*ns3t5GSS@Jitrr5 zh4eba{lBLulMNU5wrxF{Q;boy+S z1r43}^c@qZ|5E^sqi!%Vh{TEgbRY46v86Kv0@CeZf4F0SoBZwg66Ge{enLdobX$}Y_zZ}c`&=~*;9g?y5I z&BYstjV{GMU$Vz%uf$>Z+rilTK@blAEfMM;MdBE>Cnh!r1;s_EuA#Lft^Z41D^h z7<~7)IDGeUARK635)?I&t_&cX;Ysra8k-Zy9=b{Q406WiP;g}yHJ9g6Nq6;?X%t?a zL(YX8C>^+lvcXFz%&&sKbqcKcA~@8835O2Zpk`tC40T5I=RLPq;IQoARRHGC6=<9ASeZ4M1L@1p(M0;+E; zpn00wL2W1*Cf*0e(0TO=S_vOB#N|j$EQKJjh{ka<0$l1~eW(;iNM7pS3h?dc0(|)o zPncPRAtQ(8)1gsZzjXs~4Wme?I}e|fYM3~Rp>-@4`UetWye|PpdlR6yI|`-;<6v_< z31){P;cT7;54UW%x|GnokdK2$6X74-ijs~YHk?CTZ7cUCiO;)&&Iwg`u*4|ac*i+A3N$BDxkC~ZHF)~hq557&@?eiG%ErqDb&hxQwD z#Q!YnCT^qk_AF|zPN1-V6umd5ktnRfu8$AnjD;E8-8>*n6VZCH5zQ?fsI00-dM1rM zUvC8ZhafX6AG!GraJJ8b#>pt?oBAR&Itf83IS5HFL}*SW!t%}{uBIJ=vKF{RmBBx+ z8UFe0u!|^zXKESZDjI1mP!A75G1T{`(b^#w$G*&goqjs+O%h-Lu6t;fp7@D{aPlps7+-Cw~Lp>Pl8N-IwvtFKF2n-B_ zx0gFiEUckrKzxYSIM>+9i2o?Z7b=}Fg${M;2P*lG7f-aNC-S)!eQkR zgHwmX5t&tu)V3}NNw?in&ccJ_WfzlIXAxQXVQGiW5a_guS!{!2GtW#flEyJ;P+mx8kTL5O2&pmUV)(1~mZBO@3Y8o|`m zjMl!UFfu+(SZ9l4C%q9JmyCh_KFmztS+v@hY;BhSnlJq9;pFWAXJ03{2Yb=lJQP~H zGRO`{fv+e5zG+$TOsIpMpb&PEB{;5^j3cBo`)MpYnq(qbSP!qrT7<+8AePoXB_rb~ zC;e|6yMeZ=*U@p|GTE6I;o=hkYwH*s+#iovVF$``J8?!o1~y&+2#*fu*81Mwp78Va zM{t-wjEq9C=hG+}&jpyCzP)7Y&&{!rt$`K@?@eItY>G2(R-GNqrZ*O>>>EOmP1oF9JT?mNXySg1z~(y zX$`V+^I&0|iLd{f0~eZm*m`rx-n~1|-FFx6;vjz?j_4l5F@1Gt8f(D(j3uqjbDD z_ru9!gqiQ>;FFzchzu{5_(|rOt-jK~=Hz7uj{vea{T$)oZVyvi1CsR-9NrTEjgN(} zJwf{ZO%n9KNQd$M3|O8_hRYcd>}})7#*BwYR61g7$`D^!huDe+h^tyqPWH{^@d?b& z&T(>|Bi_WHu`WB~%*Yv69y2(A5vIJr9)r#{Pv#uugd;yocW z4kcoU#{E4X)xtylSnRq(IyH9n5-RFz5gH}L!GkV1vL~2yTuin=1avh6VQU$I<2o+T zKSON}4S-*CBmyI15G_hWN`4tS`g(DLbakHA=yOEx4%Io!>Sg^tH;-vr_X2b1INy)N z!V=gxrr@MTERG$g{%|UyIVA=A}NP#i2cZ zeG(V1jH0Wj58?5tWDg{ftu}y>E0<7nwiUfYBWUgELMyFfn_An@-PMI#whV&RBynA_t&`~mHRw}vx{dwL={o^ZWOX-7qmh!{oD%CTF zS$F59@5}Q4n1B1BbrEm#3k(M(*fKlM#{0YkWA1_rB|7tO>5n46IBxIP+kbc8;m7t?{yX+H{(re1?*Kl&9$$~I$A7o;`0sX>&S`CVEXT*!%IjZQ zOZ}_st)FtPQ(NH#^}Y-rM>;da?A!{ zXB${L+xuTU`!P8=xpW5L{3rpDBJHUeKa&mTowUrh0^!2#WxBS>z%1ab3a6t-PP``8VH`Nw1b zM_vez$V6#%CrauDQQ0(t;)Wh{_KcDaOmlW>LP{FdBER9xdc)76arhWBck;tayqXgZ*Uxm zvGvgWi2A;26ou8j5aymmR&6^fnmW-vFo5YhGu$|cNXbTEtO%(^RVZxjhajOG4rhe0 z)yjm<7eeUlNypcJNyM+VTjK;@0MGPJxQe=9nb-?W=RqXY+<>5S8VS8qNIo|MVf}Ro zO2$!E--k%Q3~HMP^{X*=-o(tp9D#m;h)GIB3yr7g=_y3#R3W*z4%ufrkW$@>l(HrS z#O1=JQ?hpB-On#ZDH7mx?HtWG%Rorhb&Frpi-A-Ve&L<2J@9%FmQGZ44l zLf+5~i1O-iVy_nr4V`h?$OC$&q<=P6G&W3NMmiZ37>tVYN`z%p!6Uo~j={Nb3d@IY zQUUzpv)~ykhM`>&_}WSM>f=~^`=tP3!dk@D3?R1QB6ns$*mD~R1JfuRokj7*I}i_3 z{e!nqb9oZh#Ws|XJi@$<8!DPpGWQ0 zIh2myLEd@hAHRlNaSdFJ(%@)V4DHYIu;QVaqEjvfe8Ji1H%{2Bf6{)eu=d( zG8RE&Z#=X983=;z(zj>9?p4$1=(;9t44A6FiHj{kv(u7xtDLF>c%|U zt}mc*dI8mw)2O;|9pbza#3l$)T;7Pxyhdc_v>-X67OqxB(EctBhxbLo#WMy??VX6M zXhm#o7h-CA5MJ2LgICm9h^j_VIx>OU zk!xrgxrn~uQFsN$;`oVJBqntt#Jd2Nt^tTjh=5R-hy-CQjva`DpGPsxb@PO~^PK;Y z&3lKmzQ+;WL(nol2_1bi@V`!i##cgo`cV*e{Xu}e9}1!S9re9U4m_jF5MI`S+@4_+ zbqt|%a1>W){$)P9?!i8o*^>TfrXj+&1*Tg0uyRg=vs(tvn5N{32vjHDchxDCX|W za=y_;zvj)U+X#%#=FSjU=;uT4L_Ut~5n=aVV{l}DBrc9#;rxsXKd^o|e{lqr)y;^G z&p}2`CF+|yP*hcihK^>`G@M08XBTeJT+R8i@80u|GoSAQ^E1-FkxQ2mm0X0d_yUNs ztC5skj6s@jneX@hbmwO5!(NY~L*Lah299(=$^`G#2|@ zaxbj#5ia>$=jSuAHkJZAnu<==HN84 z`zB$jN9)~B9ARwaKsK!(vNAH^9bHBCW;%}VOMuRaMCczE!p<=t`R6Vo@4_wA(i-sW zG?3HSj)=e<1US~iLN^r-_Q@zHDMJX+2oTfyJ*)_!c{Okhp>@^4EX1UBqIl#c8ZS*C zIKCYI0ZDN4up>Ey(E2R_ogEiYceWEIwz@E}HUj?u*&aJNN zMYx~_;lY)(UbxEX(CqBokIo|t%l62zY#;glzYpQoUULgebL#wkdz>tdP0e$2E6+sy z&*Rj8?eA6@x~!9V?KR1-1F&BLCbZcheUoFqn9RNx$KKel0I!ke+`;_@u&gxa4(=C# z*GhBl;C}yi-Qy|b@%8w6d_BG%U;l&G$KSYfzxgjKo%6D#@$deGvKDl2dM(6p{dP3qW%4;9S6VH(BSLtIH0~mTTf%hF^wI6{^w^qPVo<^zp`mOy7Cd$J7(#5`olsopkTEe%C%)O9( zgkbR_m}|J`Ez*xcZ&~^%^z!Y@qx&V_@Md&H5Bqp#xa6DJ|MIm%MrQeE0_5oZgJtip z=&Bp&Qds`3v|WFcdEn!n6utiyZ5{1{GE&|wqz(P^%6vrP-B+~LPx22+c@3A+`rv_l ze|(^M`z7HAT#>ah*>6x?FH3&k9s3O|-kBQr^vm*0Qfl&Q>(pddbD0=FOgE|3yfs^8?rx`cKE2M8{mhv{JWo*`h4pgE&+Slsma3Oq zYAcid<|SHdRCg>AljzY>dle*OmZz-xv!xu1@kE2C@{oAyN8S@F;#bRTXYHf-C%Jg# z*Vn0V!dG5a=d(-&minDjl3OcCC~BL|KlLfZ7__ZM)r|g)b!}a(^B+vkjOb!NsVvb{eeV7~eBxf(^UM2?+9vZP z*C&kl8e-<>%VfBgli^d#(>KYg{-0(2_6sJp*JM`k{`8}H-*!LmE6cBu`A;hU%p=Ro zvJtkDzzW@wl@ZXG{~6N}CAl5DNLiE=b}(R7+MukoahsC-HYG*Xm#C=HI#mL_bsKr> zsJn>YRZ6lOq)!UUN^6xBcfP@1=@Yo2%~dok;C%d-AnTFqTq z<-4nRYkBLqhy5=-SSwGKx0Xdk@Yd4n+MUN1$*C7r`JLAp96$LE`v^Bz`n_ePH*@4yapdzCGwfQH;mzgEmD}*h#;)gTi=bykHT^YD z|MCb&>HB4rBrVy(s#1HOOXWY1D#xY%CzopaKhiiD{UYrG#{4_Y3xF9Zr94kT z=LMz(>v`*Se!(6#^EUJUFH6|)w9aps>hXBIm$$3ZK#|w>p!)fw^71OGFS0C(+oasQ zvinJ;tvp5TR+fSKQvRj2PbqCx<55)4Qq-EKDG!fF`FQgDw;05|^1OuZ1 zWa=)ztPW+;lygekmE_cZ&Eu)?SYx(H3qPm*Diz?O?iFR@WRX2-dwJVmFISc$D#}FV zO&;%w^~;Dn%Mn@sqcoIXuiPfTbBsay#+T)_KVo@VHj>sWOl(X{O8nn4fo)OSK`&dj z%JAP{ubX(AlwVn`wwbqu{|i>-FITIrQF*zKV&AopklV7F(ntl@vG85iZR%><9zueO zU81K~w{R?cy~u*vZ+V*t41UgFVVg2NpHm_@Aqv}ga@6S_s;^R}kfoNWygtg?#xP7? z=bu?x=3I-8ojlg zpOt8|f*M031qmAM+^|S!CGIKiU|XsCsHQO)X@P{`rqIbmJmMD%_8eic*YJWEiP%KSnA_F;bCXq{96esVK!rMYZMCsy(E$72`*v3J>C`!XvOyDk$DFQat?`QF)WMo$yrQ0X+RN8b5ozl1HFwsHRD< zevZ&{I|)>Y|2rljLM{#}mA3N!A7m!x`dK>wfI~~{eSKh5)wS>b7GE5Q@31N~+0u*5g$pE7v6DKoDdZ~sEu}%)5*z4`9ReQDCYVU3PY)b*H zz9xoGpRJ-+QCdZ`I*K3oQ3XHX{nk2XCNm*g?|bk5#~EgwwbovH?Y-Apd+mMB8BX%X z78k;frrbO&Lltm_(saq7oEo!;r1MGP1-b~lLP=~if8~xXQKx26g9W3tmz&gH!jZFc z3&xTajrrqq$0xj$8+6F9*!ZG(@lnS6L}$w6Wk0}NC@QBOOvs%OujoiC*ouK?I_XTq+NXB@@I z3bfjk;PNsm5`0*HdmEla$+K(Sb8EU2d=*gDScbdJVJ_FlHFfztoWxTqnoZ zn?=U+XMypZ1Y@po0_cBD(3cp`1AT9TJ}>w?;F`9g`PA!#!SsE2rFK67`)G1yX7FIV zt|@zL*3`mu^Q{@daR$+8+)9Qja?*twGMPDj+pd|%iWX4NUu@8;(0G0vybh!xc&i~f z27^O}lo_gB-yDKGcI~;mN@emQl@Xkxh)!j=o531IuNk~4f&D#>8472X1t+D&`40j! z6}brgYg$VCZzW`A8sl}x&nymZi&Mc9#$+wV(X=2kl~M7lKF9L&i;?p#1Kpj00F<6vG!VyQSS;UDqrBY56v>1Ob`R?$>4 z-H4iw46{)VTtQ0BgkjzoO_wb2T(v;bU(QYUysn>FTv9x%WcEzDAQx$(o#Ne!KHezA zR-8{-fO|qgf5*BmlGuVxR#^skO&;+`k#R0bZhMi(68aT@uCIofi?PlE$o-1 zrIUU-DV_cn=%DoOHz9mO znPW0D#JbG+fH!64qjx(p|3{`#yqS3r(3Ew7WE4}gNLxi#KD6DK<;^mRA29!cERq>w z&U4K98^dGZSVUg7Dcd3@Wj~*86jQQELrM00$X91me;QG06zj7|{@dA|z;9=KKTAH5 zO+9&uHKbbzUSgsCmoaoPbc3HEZnTijJ`2^o%R>Em6i|rxtJvdSpCV?%qH$_2sC3}u zryO`XcRgTedfXGKyTLZf0tMurt-ilnZ_&>IY0!h!Uo5 z2UUc2<}h`yPR(QLSKLCSxLnYCm4ByGm12f)NjAWCX*%FGX)fUJq=jg^S>7(1d#;yn z2kc{bAHzo&KFRPH!;csm4FtzBoW!t*;cSMB7_Miyh2g(5+{y4MhHo)E&9G1*Sj@17 zVJpLbVW=|vDZ@W9Jk0PThL$vfmoRiPT+XnI;ddF{%J3eBzhQWg;mZuaU^vD|a0>Kz+_s zmHejE3Tom78ufv+9`RbrR74o$c2I7;EK|M?)Ox0JMS;8#)Yc2M_@62FAhI90V7Q-( zc#tWBxk^?+{WYcRwG>Kw*fG}jOOsa`rv7B|NyY?q%yf-pN>HDfI;HdkHOB0dvJ%vV z=8aNzf^wK|lB@};&U}rOm!OuKzb6$WsB6qyr7;O=llfL@Y=XMg{6lG6g1X;)hg6uL z_CRucf_m0`w{%{DdKYCA6Vz$*&!tHT>YM4mmM#!)CoJ&?>6^T0)7|~r^n7u#$kD0B z^!1>o=~P?#pmedQ)~U|)y`VPg)OXS!2lb;1hpk&A?q+JNxGnujM8$5M`Uz7{>D2v9 z#dPYo>Cb@5x=5oQO1}eC0aFTeJ}*rX(=HnB=TuRyQ%|J-O`0ltbm~z0>&Pm1>(u+{ z?@1-%S)DqW{;@PeoX{yl#>di3k!9B?YsTkT%%&wMgM68A+v6j89y#i2y=+{@ds4aB zo>X?ZxHD0fC0{9?wGUguDgLULou4sAc8aZ2G-?hgmso$P7Rj!RiE^cQO{W?_Rf)0^ zP12Wfp}bJ6F44-mGA@>@#rzo>bqlDgMCnY;W_M*wmus1SLLxXt9)`P3w5|@A2!AmF zW%2$9+<^TqaV96AET$&mmzznZ$~;oTWb;UPH^Ya{()L;sN7Im*PC5(H>Gs2<^pX6z z%)c_7_6=HT4a3)x^e2z*>^{$BJy&wAkJCr?lUk9vb%U;7;|$k|_bR!Sk4NRmy7i`H z5MG)w5>IY-w`sWaY`iohT~PeY0d&YUfD7bY=F~H^Gn~e-lwrBfr_48vVJX9MhReCM zg`pqtLgdwxna|1N1?A%Lf^zT_F+S^6a46?)7PGQG1Wxi%K!c%zSLa)S--y+c`1dgU z1#24=Z)Noxek0z?+KoB(QPzFH&t$C^uZX$X|I_fMsLS4Icwel_{)6El#^XcUqPy5%&&$w9>iaP-( z!WL#+SNiNMFHR@ZlymIMAx zS_OEGd>gWlf}BUce@FwwRT7{H*Ap_X5;756VSH{8tL1faha8qS7=-i<@k>md`HnE}tvKX+AF$-%OW;(lhdR7)LCrKPQpsR|O*VHz^tXw0ET31(J3Jt-uZn zKY7m*7t3@W&u4m`d$BxSoWeI`;7a9-18w1U-xXp*S8E{H?q4Go`&)y7uE5$*akIZG z+|s_FrOV$c7I!;4JKO!OEg^rP0~G$b0vkHRAzu)vI~cge*BS!0)VIdt3tsPU^>vBH z^+8`to2O;1Z^;@ehSc@`HeYb{4AHVN)ZPWySnIidjqrGC>Dv_Yx6|3xxQtGu2il3z z?x#QS)3ULvs~v4DZt-`F-p%5qPA0mM#DkDe6t~h}7#h8Pg-@%K7@McNE9BcCv;m+h z*Inlec@q*F5@_luSt{9R8;BYq)6}I4GO~eBqo_%?>IQF$l}AV?H<(RCql#->PJutG1@HuF>mkYOKb&#^r2; zgf89CT-o5ox29^jx7OKM*}(j|CEkk4DrZw|qjyo|a%NT3c-*zlmSYcc3*XI+J-+PP@7GIs-7UF=ynTD8Sa*C=cl#uK+yYKd;=q!QT7RpYMK zEvWGpI4jr|HC1Hw(fSlOug0yasjKl+S60M}N2rG;@=Hx!Wok*I*VE*7FKKAh`O9XN z%<(R%s)DhYcGgl&7wlO{((rW>yQ!{nnY+@3y57YYlyhNaQXvhXq0+Ua0foASw1R}4 zQ+zR8Y2>K2lA7Au%7xBauiM$+TwEECHm$4z%~VusV@hQ=EO$4a#UIT@&PvaWnPpz| zD^AXwby07dRF@{_Rr;I3B(y-83SM#mmk&RvipN^>P{3^}PuT<{*YW+(VTs7Q_ z5gca<4@oC6!H9M*a(T*9s2MW_7C&!mXrs5ocY_FYQiksm9pMe$E?-v{6LEpHL7y*9 z@VSduQm)v_OR0Blnq!ZT;Lnl(dMfNXu9CzARN%)3qqicN``gl z;uZdubsd2&>|nY?g>OxG-8x^e+TYgZ>lhXteHR&TAhG*GH#*u{f^FJnd$>B(`7~Y~ z0`9CHqz)RJ(=PwI4pHrE?_A{TrpP?2MnkwGsy9as!)%68ACbf;DwmH*FX&*?@ z+n(4JRs{nabdIw%4s<3ugX?}{Uqp?&vZKu%KsbuV*3Mc#3OeXIK-(KH>7?cZLG22mCFs-nni@CSLhEj4TU!v} zFPt6S;1t%#|D~Vl^gv4NGePH zq4lH+=>qO(^>v2yS?yZi67M2l@rJEbB z^>wU+)`|`eieY)adeO!~Mi4q))w03g-mPa7zHY#!M<~!5XlEi}JM9vQvxu*aQxgx1 z*=QfO>1w5+APH!T7j4(s^&_3m*D?*h_Lhx|bq$y6Va1*Z`PcZ{{h{vRQodR&zJ5)I zFO-ZI`!@RM$LrHYi)h6MXSw2zgaV>U(m<|oN4i=KL5?BztpqMLc z!o#|?7HsHCKy+~3jes_^(Z#R>5?F+QwFzM=M(@gmNT>4*F;j>ssXE=<+w1jS*z{4^ z#Kl57|Kfz!Ftk$7*Rp;e@M0lNaOu|YGru*V19h{V7`aPSLVu$W7rDd|QHM_@c#Wcl zDI4%wU>lC?p53veH_rPKcm8RNoO-J%+;H6%2MF;37P_C^_e z?LoN{Bh$Du#Vm2zFxT3EUX_kQW3h*%G^PpdUdv;?fqO6=Uup4l5&tZJ)`jRr9mkIc z7Pqm*36J~14b2VsE(X7m`|1(H8YJt#z#nsAg%b4cJ3`b9msO&E#s9tL^IM>mW==cX zKh+zEq8Y;x*utYrwZ7&fvVIH4Ct}hU=9#mOeL%J1`ioI-4Ip`wVsr(#UVMjV)F$S% zCdI%?mTN)TI_^U;e^v@{et3k{1Dr4XdK8FRsl6E4(wAuUk@u4Gk4=|KXRmg$Wr!OB zW*Z@?wOpjn(iWZ#!%};U3(qtOzkDjsSxxNlzMKZitz-P+O^g% zNd)o4H{9hmc3TlUGEV!GOsC1E4q{4z---m;qSrxgqTYfClMLh=HYYKt#R?=2h<>p2|BcUb7=kf!0K zEj`7WS~}gp^1hK_bve}>UIybeJ^E5;ODePJ-iuGIEE}J7YP||UxXp%;mpsgv% zf7A)u^F3_}B(EzrZiZCPO`4(9fg8AFICN8MY1}WHuk9#pE^fH5>HX#Ar*gR=tALc&DDW+w_?^ofGx7dMDQNIkk2?3*5kQwLVF%OJ7*EO%TO^ zCOaKVO@)w}T$~v?*rRc+G~{(WTUyS_Fl5?xJwB)n&FpLS+!5yf3Q6RSOx+qM*)TXB znYZWu17ixW+WGMdp}@{(CJXbfZ(rR!zVv9+{NR<|n{xk>G1q`q*#M1-5P4Z9$}9r(kWZn0DD(tNp+{AUfgfebg=W}Gk_rheG@FD0a8jC4$mYVFLXhUdNogce zSO}0tz|4SanNiC^wG?xq*8iy3XwS5C9Z&|tR7 z<~&;t*+l`O2!k|yHp+zZU{ zUq4cj#WGG38H>9ceH%J)z2h^L6_?OQ2t9oCz|lh{9xNsbEE5Hki2@0rAYT%e#oft| z!Qg92WP+D?U?s97VFH66ISIW+^0OjDgfwxY!6eD}nvFur83 zYMMe`lH@eDBYKub58f#n%qEjzQW~%{lL6ra7Z(~$BW-DLyO)V_r9TDzDqj zp7J3G^LjSZbhAK?hD0G`p=mcBm;u2gNs|m0nV@-+1wO|&&xa5|IGOYO@clG1+>fBZ z)RW8x3M+%jW{`+QR_wVI&KHyNy0gH{?YTX-=dRqIdyLe0&(F|HnWEKVK>(srv`5`E zOgEj68j1GC=lMvF-YVh_&6W^3Da~T$ptqz!jbxcRkje1D({_+>q$PYOnR@!$kGbtHS<2EO5dl{@B$v-ay!>* z#f)K7lyv3bljxVe#u!`uh#kw_4!q zxTcFYR^8mYb=bIs^nO)yJ4(dA;r&mCFZ;4#BmVuvt^GTq zeE!LfN0|5ij>mBJF8kGvJD7jhjtPA3+i@44Z{c%;zjZy;AK6Fk{ZfipmGXWm`2v2w zR3~jrG~T|)^%q0+NZKo+ay0s^_eeUK+ zK_n)cLSrH^$=Z7xF4cC^3r!xS8~evIcGDxcN9pQUZM0{3njHsw-&wjgDzA-RBlmw> zxv>WICt7!Q%8ny_WsyNSGGOjoc53idbLLCne#S`j>hGTfaT+2UKkr-iMZEM3BlG@* z^3ON@!MaQCS9+9JNdn9_b zy?{o8K;Szs)@{pSg{Gz3`z!2457855los^Yi2nN1kz)qy&WaxzbT9PRpJ7hp4`u7l zhuK+&bcSTz`5(lH3`)#X3x2rynC7q_Fn{RGoU83w(OSDb+Gx-D&h_f!jz6h~9M7vS zI}SUZ+HwSq+PY1KBasg$9G4A8tUHf5UUUqpe{;ON<;Yq5&$b){?_lJ8;vKZ^Jm`4b z@upg9w>fI9YR=qGU@w8kP*@O^BabQQS3!ThjHtAJm!7dB z9tu@6G#0^bQJC{1N27fj`dJtyvz|mrNt8_cIV7`CR*G1kHxzBof=rfm>n~wT@5&XC zJ=2DC|5Tt0)lJr2Me1J$k15UlA-P~_wB2rhm>kjX%u;Xsd`4O1T_y6C6p1OlPv7uv z?>o_u-3C|XXs-GIu7aQDPaX82k@>snu~7deyBoyB=q9`ExT3b(i_{a5*Ws1WZ{Vh# z+rNv+j;YbV>~!Q+gF5l{ez&AK?N$Rh2gUuJXY>k^USadAn(yu)BC_|)97G)gr_|bS zpveO(tAmcmwhX}11CbMC=>hA`0kVy{&oMZHe^MQC?AtPc{*|QgW8gyvEKruhKcMb+ zkdI;sm?IrMD zx#L}Ma~v-__CqFT@b6~FOO6*ak304|{!GMUT-TNvqeSd@9IQ+VvSrarkLOeRK~&M{ zIRei_$05l_-c$PBa_`e|cUZr-0YRXKl3cvWK3^?2Id1$MevXzUJpBeO7UVmMp}p{z zoo1nR>v^cZ0uw#5ry^;p>+xjsAf8K_p?{isGbOsEG}g`g2zAG9+X_$BDUp3jJ#>}D zwh-M+bOY$}SO_#ls#--ncdSjLbI_CW$h%pQ7==xt^_C~mbIgFjm_pT>RBL@~4yjtI zMD{BU>WSD?qGIYoqTR7cL@gnlnw=QS1`Wd(I70R^Sg(+#D9m0?fenFaXs)y$I4aOw zfNzUpGd|<#XLEB$_p0cafmRkb5+KEW?6+}NkO=lIxwlYggn)8t~ooCn? z6IWu+mo~&UP_Yp;%G@wOY?aE9ofS3K6S+j?g*m4oYK*ynd!tp#D$HivP{RHtWdAZX zLiQ#v%qRO-ZywU@UqA{LDQKPyQ5{o=_7F|>uZ?}wr`z8}Ja_E1zJ&d2BgfhPSKEuM zw|tUp|AHpfQXhM$FYZe9a08@lvHSbj2bwF%jekz2Y#*?3}woh9LofY-5y;1IYb=1%R zL&bJRbw_8Bqht3+wS-h3HN@@!?p+miDezOt$oZmX^eJ<;3~Wrt8b!$}V<>X;rsn<{ zNj(wG;D<9ej`3J`PMm{f0V0N>$h%TBBmB;aRr>y*(QZ~{a==mGpp9Q zzZ6QUHE%xbr~#lD4h z_b~al79-`xUf2e8TkTt^;XT#$v4fzSVncwQ*rR~Wv0d9Zfb9*jUlB&*iru@79avf) zyL}r~oVe1v!ZEAR^z?68Z~~PhCudTnn@o{` zHbSr;oFkJygC_Id7rbGdNPMNgpoh+B{af8s7aq%MKq{CRD~@u&MJq+LNs%Ty23B~n zq}fwOxRUsLwrUiv~E2gyyM3HJ4iw`Kz@d`mv(g6 z6GrprlUwul&Cb6_^@D(%k8vcyUOVkiP-h0rx z^^b9VCDvYgh4$CcH{nb5ZMsH%25wz+TF-YYFxPX)^}mQadeb}yws^OQ0V!wR`(aaL zQ!kR+dC(F$Y1s6-O5!o6$}#t5fp$fh6K(7jZ<@~V;+9h%yHG2py%n>Rp9VME0059>gRe!}+3#Vo~8l@uxH8hNvYx3n}8YlV{FYcO9r-8+A>K zy#hm8cX_5oT}7&;fur!Yn>Cg+7J=w>46KBS_96^D=-UepcxdY3;|5$Ws>a>{HOmpY zxc6Yl3A!(5ZfR20iN$JAZh8XKv<{(U(Q3i00QRV^p^G=1Y{?fAt9` zz8qEV&no)^-O?f5|LZ}luT8o==FymsE0ICkg+)G7y58u1c_rli8Oh*yEDfh0IQ$IvBF_4m?CgK!QGa=D6%Q*n4ngcoSKoui8wPu(wnf z(BH514 zD`?xYDmn7BWAoeegOGdX4@o(WJ<%<^U}7=-5v^2B&FT*O1A?w#9W?^z--FQObvhp*cDkL168rw?orj0$bOD*rbm!-{{T-O?BkOSk}kd^c>KZ`<$Ng z*(LqTY+QFtRNtkA&)WMlQcx#x71${D!aooasB550zQP`w(BGvAy-yQ?lGx6FaIAHZ zO?%3%cZVk+q=Crc6|f6y`PYAFfn_+rd>8nM7H&u`D+ym5ujAF!j-%x)@`aw|LNhUR z8~r8P^+##j_QlP-d$6Mr8xGpW&@CXx6EPzUvw07hcgWLE7m`oLUOE+D6Nl8HehTyF zV?XA368>$!C#yjh+m#TzGhS2qEY6Cmt`fDgsLxegu7t0ElA`+9&!=)9CaQm#+Gw|d zH?6^4AKN|?hP;h^Nt(;uv0?|DnA5+Ny;*;JetBBB8dfN3h?Q1rTUT}ORE!S1Y3}-l z*cElqphW}i>dNb5Tfw=e09r`{wu?{vpUR#-I;!fUjW~aloxaIfK4hdB9(xZxQNPEBA%jZYF-3W z!X+LW-^Ds32{Ih~k5%=z#_tmHJ+PzKny?PQNeVGN1=4LH8MXS1^E5dMMU6f~R15}MHhLwQ?Z=&$KR+EP4Cf*Gs;3|>ngj0^CG-zAv(Hme2$HeSL;gWlMSjYsuH6E>>! z#%gRlq&J+{SfDrZv2mZ?Fk>S}Zy2zV1&t1{B{tZ69(?YFj~PCb;dA|)2Gan1&cmk% zK1usX#C?FK94DO(x9bx38Mp=mmQ`BA|74 z!*t*8@TcaT=;$Dpkqo|n!@jjUIVs9T-nk1qYm%M%%+=WW5byL=Vq*bX zjNPw8w@<>K{;L%;oy+HuHc%}pofOE&e{xkS1WYd9RUiZ1#kcF9?YjWYe%bd4{+HqV z00-BwLDBafHvWk>KmdUrbQTDelm3?JbJ_O}PFR?lkVUqX0JW<$fv@?b9{~V8K*GPMi#r%7IukjjT*77b6X&;vSwAev$0Y~# zC7o`mCKK@ma^e8~_UoRH=C=1xb!3XxRJ6sYHGP*>p^}Z~fvzyBj7aK5aqHUvU~Ai| zdXDnW7Iw(G$2um;w~0qkUZ>wst8GfqXoP9UJS)8Y78 zsD3U+x|{p!KvL^g=|H%ro7`22Rb<)*!*h*sTW8B8(n%hX8=@7NN{p)=7yUVB&}aqh zSs}vIyI=}AUGSdql<`!xW^VNxs%a*h1S=cG2?7QBeLLt4G8o7wlU0X35p{@ai(~+N z{sJ-bVTj{X0xqH(!Laq``AyW+1S(N}gBPSnsL+%=1MHB=?txnYrn}g0r579}q>Eby zV9#AAbcO$eKT@(oco2*_jOfsZgA^e^!X)D}jQZH-5bQAY_JG3u~C z?I?vkS+R;@eKzWlNU7Y#s^ny;L|k&$V)o5avU!|>yF$> z&Q}>=)d40L9tjxh_MH0&%7xdiRseHVq&W9E9mFAEGExD)SRmW!JAxzI*oZ`5!I4H0 zoVK|se(}iUo@#o08%EFfC3;P3I13lU_h^(e8;B3>{L<1gy~eGZH&aRcFHau?|+$iynh zv4Y>*&deSd{*$e3c6|6ubZQn=+p(Nr5`zDu`~Q=o`AX~JC=-H5P;2LwYn8?FSR zDuSqz<7%iC_WwAgiWa0)Q9i2(!+mF_?%R~Q@8etfefMw&J2(Blh_~Q9fBU|Vc0fFU zCW+r#iTOm2S1S{&32MX(Z<3iO>ylY@Ui>B26P?yxwo8E3sM;JO?$jchpc{7rYmIXk}j+C%2iAyG#VoO6-_^9?WTtKa*Q`V7w@i z6{5Bx5nkfait}kUL^PneHL*YwTQ&K`dObgKXVgS`R4S@{BKRMXQ^5f?>zC}yGSx0x z(3})xW~!L{;~r+M%=n`EkyXDqFMuRzwJg>>6)Lp$Vlh>D zvv4Y@kTv;B+@$9(#t!iGg?w=IgBjK#tbBehY(1^SydunE$OwKTna@eFzgcI0kc=^W zpt>1vQPm51$W=WjJ7M8Bk~*S$=4$pDIg=LgC>ds{7`#7;87(PyC4q{`3l z^sQrQjP&C(!_@Vlex5Qm}`(HWLClf3Np6x8$5uC5}=2jJ_AyG5Ur&q z9|oFW=^4{%>?Hy)8s;-mv?hVrIbBZrP&1Q6hIreDm~R8=JFaNW{5e~pw*D+Wiz!0a z9o7whodgY5%$F8hk6J z4eBvX?U;QjOSdm&jXTaS=aQ&ZezC#ZA^6&=VpxDMuaWj z!3xGamROYefkDs$S<0JBEZJoJZcG22Xmnh)UOI(OA{6V?O3WjoskXHT&2Z@wZIeJ> zy~^B|VjM@Ssy}1w&q99WeRlAfoaizYz&Ot+wvG~q40hq{69%UB@iuN5u^(t1Rbopq z#9SEIGm1JZI2F)n$MkalKPs{9B3_oXlO_8{F2#x5`vR9WniZe`bBSWK+*XC{`9$|ROpMTBCl z7%qp|v_nIzXjDkfC^1JSO8}Y1g(piP1aPE96UT(dP{h+W(&7rzy%G_ z&D`b(&?~|&d%+2ycRtX2&uE}7jZ>f>x)K`vGx6xPaMT5i1tFGd5FALG2BA#spPgJ^ zP{rZHHeCR~z?A~9g2sFxd=CUzM31MGsnb%q;B>)Bt!nS6i=J7h=e}f6`-SX1(=$iV z4|a?fa0d#wSBz$>6(Hak46I5C`0kBdz<>Q@8sfjr*Of^v_mK*$Yo``&9E*STg^f?L zCkds7!2Otlc6sTu7nv)L?iEHx)pYL{m?*kFq$eo3tg@F$Ub^}sOJV1Zjr2VZ)Ajs- znMDiBnYen#`H9=9G~(I66I5KTbf zpd~#TYtiSwx+xWnLA-|B)5kCK(1o(Y)TTn0NByW64x%ey0f-<`TFsP1H91QEon2LQ zx@pE=`F9Z8}&%8+B|leE9?1bayK&m#;4C+W$aL)7tn`J?p2>;@Csyb2*xpSAgB)D z)9oof{ZAd(yBqM8+qz;_{Z7^=(EeDISR-PK)cj`jtvLq%RrVc`_ms#F;F2e)+9w1r zt0(ZyRxYCkIm$|M4_^Wz-^>H|CHfEeMueOQ-?M*BLqo%G-^uHwy^YQ>wv%J(Q9-?y z*YYVYVKL58(nIH9FuYMFo!}V5thSL1QWG(d&im%D_v4l7vGb*R2P~%!7T0T$@x&7=kwlKqy180p4vFAKm81}Lz7H%&N2lV&`__cWdgk+1~&w1y^>yuf?4HEDz z5#PGKTkOV6;W|6xKu3xLEjpBC0L6I2w!Jv?FR+`FhS&0fC%}SX9o)PWI15>dUUrhB z$Kd^8Er)kwU26Sp7UNlNv-qd_;y7QN%ayLwfxT!>chj;b*+DP?QD4`gKJaRfU@`>13xEU!=6ea+iRsb~ z!4!!H^Agi7@RQSb6>#ax-Hr7>b`j7Rv<9<#8Ms~;i(l?%?clVR5f0e;#B>n=q~BL! z)sN{o4h)@`Zb%1Fnc9`{GrSo40z=&CE5f6gLGL%{4Y&y9Ew@}*z+Z{FVLzFc`3ItqPe0m*B*S}8m&i?|H#FU3#O#pyH zOU1o=d{b4n0DO{@w1I{uK!7L(ssyPNu^7~r6s^*PI`T;RI02!pGgmt?qmE)Ccx_AZ zw9<4F$C*JtoN?xkuNh~?8J#-_bwo`XXaNyHQhM@DxEND*ucl;&G&os&L*neY4W z=Jz`}=j^@DeyqLs+H0-7*4py%(xkFWp$&2UQpp_#82ECr$N4+eq-h&av|;(Pikx({ zy<6U9akRcf`QM27*IE%A_dMOCyMOQN*dv4ToVraq)cCon zE}-+RAl1Es>UfxR^KKhK1#Garp(>PQxcPNvQnN)y9zkX+E9O_4$r@&6iJQM?CTPy_ zaDDRI4eGZAZhp!{$|wtMMI|17)Pz+jK$V=5V*aF(Z5I)1234PC^S!7~gW!n`)n7U~ z3|<{7y!uplb*b>`8-Uj)6<#;oM^##HtD^u9zv?~$S%wO--3rLED;1D!R6v$dse()e z7{Kcd6pFm-g z_dSs;s2Wkk^=p-hG@CXXua&=C(-d+yYRq+K6M@RQv;Dz|H|&&8YG64$+KBw$57n(3 zz{%w?IUxqWF>T%%?LeM7EsCPn8Ei-Nthv#6C2(JILQ|WD?}p^Nwl<|vhmTO5ZXk9Y zK<8FJ(a;_Iow6u}%&1d|#Eaoc(a7ldMY85dAC;IX!iZ#Jzr12%&}i0>LGdjB&ve~EH@zZuMDr$N!dF*ZvOg( z0WGtI8k#yV3V($JKpS*G*sWoZ6MSF4GuV^e;zpeAE#{AAb&jN0KON=y-R|CG>M#73rre*0K zw;K}T94h90yAUKcQkxzee2?EfIQRq{qeT^$8>6Lz$E0=XDe9K^$>0F>6qvw_@9c$OkHp(Cn3GM(I$t1}wWAF2^eX5w&w0^XPBPfe0?HqivFaEr(d?HvZ^2MTtHXuvr2V z(RlCL6{s{mb%lb!Rmm`*R^4w9XlzILVGZdoH;o2Dr+z=cVUO4eqiz5$2*2!>Y{;~B zT$5AC9~IE$j|`3k-Vv}{L-(3En^4SS%dwPqmMiU3bSMMU8oC2l(Y65E;=-76OJ%^= zTuq93mda#J3T*?=L;K&Q(=eCLjU@G5KN6Jvh{d{M`+n#Ki#C+fT4+e1$s0>CZD{cz z#bpI1Xgkf^jM#2Po5r31%$xcy`o)e{_zghIHkA`yE%Bd_CaD=YBwg)iEY&~KmxH5= zTLV;D26ant0#gj*jGkgQ>*4p3If^lEB01eLY%4H6T6)7U`dlX;FGMz1j%vd& zUXZ8)8hTm6zQ5^V($A0Tnmm1E?+U@^=m9rgrM_T0dq~IJ23BNb0y{kQbJpMU$<(uH z=SAGq`#fBqy831RC(%f%*gCbH^+Mb^inE5-o1`smJQ_8MJJ?wW?`Mamwo_aNI~3k9 z;mAXow&*UCxNquVb`IiuDK3*84sW{o+dc0@qkBe*-wi9zM&-S3s{a1c^0J`38LjIU zT&}#CRNh!u&Z|_OQrgtR6qf^~X`XRipwcdC-yABhePi8ymzI|c<-Oih$Szl2K9%>k z<%z_l?JJ=6z5B_E(53Awr1GvF{q#>REw2d5`{lzMFAS8&zJPB#r}DJV#1*!MtTVh} z>{Ig}`@Pb_!#xK=fM2GzPd%3Q+0=8uRl3E`!kg?@88+RawDi!_&y{|H`qZcXXxij% zG?kv(AC2g-WCdX8Ra_HoNr&>Vo@W7i?drHV1a16N z+vd*b9wW8!>|j4pdFAHo4^l}4nf@f)pu7@Gq4v`9E}Lnu5`wxEEUkE%+Yl-&_6SlxV9NAee*|_Q$=_Yuhl#J=jlaX9=3T*HHlbA6-+AG1q<26cQrv;X4S&xG79^EEGBoIB#17e*TvU!1!Qa(|+>r03$=BR;tCySeXNoPP%7 z|Mvb*W&n0s%BG0zJ$sc>TJ0@jp)EHwC0uX#`GF_n(H&{x0vO7uuCl;@cLQ5s6k9?I zj0(vx=q5qcpJj{9EQ+*OMwE+TKa z-R?MFU5Ip42@u0MRyY6o64WcV0zHX~Z(NSuigL9tY9=Bn5MFpiRO0VKj2tUKE&J^S zjxVbJWsk(QK%qh|*%!RxG0dpU%@-^oM)p!|RibYP2m_06lXVNtiw5JC2@ z1IQm>6o5hk+8OPs!!E77%^F^!d6$SuFKhBc--Q_VxAtQxXNWQ)>cU(xV6U%^+WmT0zL85ZavwXc>zUslc~Bn zsDJNSAl6yiP$DX6G^Z_9$ahaa~Jf)6E5knkubgcNfy z1>bKamJpMBATpnFnREq#r%sPGvB|xf+9lzK67dm9?bZZ*o>uvRF23eFr zwUsQm)~l7sp-Qw_X%iI3%6r7p*69XV+CM9zw}$3V%8p#obRV8Hh#lme@mk zgikC+?ht$S;`!rA>dW`~bG(xLK_aOi!*72#$x^K^0*1?<0>u8T!LT`KDBU~K)PN#P zHsP)HFc`#xPqP`0YlCA@pAW`*i%#xE`^`w;Ueo3q&?58upc6g5L^Z&JLGTX-f@cj4 zwhshP7#f^G!J6!@z?g<^oav;Ay(SI#-*^hX19J`xpp1Y|_2I7i$Q8mUPQqmv9s^TI%yVl?ux?`(*)k&EqGOLQtAl>FIj ztauLP+B-sy>f;jEFIHt<_DK1%m~SI8@@tY|By}rCi)pr78o}A}_(nFsGRBOQ&euPPb<7@QB-SW)&3kLl&B%FRMnDMIJtV91Nozns;UVN-8Y}OZ#0a z&J)7BWn4R0i^f!(Dczjre_X@zl`Bpwdq6BuUFD5`E)f8ga`Bl5+$GZ!SEG&6(l8k6(qj@50C&x z%)1Oo)ZmLjq6S|K5*4jp79=}$Do9Gm-%ME;`30Ph(X#^*xtDdxRTH=6%6LjMDq~}t z643oRnpfte_{tlelO-W8$tvdI9#wi|T7Ng5>IQ5wjUX%0Kbf=;y|o21!+mVjNNY2N zPbm_<9Mnf4;Lh}*tHC+^JxEEtV*^^~i7lj@fm!Qy>byk4?N?g{pnU?+d9tIefc%yW zM(r2Xjz)hzHxGuRyl^0^A?aVdC@bAy)H;!-k&@N%&4a@q!b#p1Hl}z=c*|&_W-z8q zB#31>+7y3g6B25>5Vn6B%;CCZWh^l2elZw6PE<#cQB>Sss8Wg)*3AhB=f-B zvcR19^v!`<<0b>a30t{sFnoblMJw3K*9OC{*Q#?1^Vu*MK0&L_EzGBSFg!sNOPZ;n zTcbjy?*Dpj-LFwVk~S11J2wqf8Fx(vI{t5)h7n(3)PowFjrQ(=**IRK;%&_B@l8Xf zVxOXDZid-oBgGI{V_`bZkV@QKduCuNeynWt<=}Mm@cT}yt_=YFA^kL4t&eB0KID8N z*+nA;!`BN#y6Dv3lcdG!fi{gwrmen*7#93~=Ri8Q+-nKmiMT^)4j>MX9I=#KA?eSZrux-C; zEzaacAHWBK+Z#&ZH6N2&YCf8IxIJEe9Ync9E*&q85fyQX!voddf~o$u*e5QXm(^yu zxfDayQ5|GZjZab*Y8h*`!=uZ9cK?yUkD&cAdUt!dmy%mNd@`lB7V~iw2keAVjq>sv z)HpBCQX{=e`o&p(jfcOqO({rQ%r|bsx)yl(>uspqls;eG)s79=|43|AR;#N(!xmtN zE^SfNRwe%V!9)VWwQPwM8IN}U!9haOjQfQ$o&)L7&hzs`f{7l{`Yo-Vy4?S6W{)c zZ|NSN4PTzX(j{H7&x&t>76o`dBfeF&D7$uKUrh1^FF!tywjiMH*y~=mWIw_y-X~Lt zIp}Z51GQ_cDB$PX6A5n_R4+=IhH398xpnC!br6P`N?l> zR_AnJH0fPJCd&Syk+qlcXKzay^A7Q&r4q2@pNHB`uGlPC8D4OKYM0AyLRXG3kUY@Y zf8IqS&_MD8hB`M3Z3}T|{$dx=`S*le$f4YgjwROYq6}6;Z~(pyxy<~23|dc{oAS1z zkjnyT3-R+3<@2Q>7jFBM;^zgsl(80aW$=3<>PTE3QAc8Ngw&y7ta-V#A7jlh*u4A) z`^in6Ix|dLVE)n|vnmQttTL0G&hC=G73FH1O=xurLcl78omwB-oV#0{8V&!(MN4aZ zba;{0BSDasZ#zt&#q2V02D^cankBkh3ukEs{z*Q1DRL3IwLwOb zrP6UPd>*FpV1xA&l4+LX&M6Fs98rL#54zrqV`3js+c585Om*O!i6j=F0MrTNg4^ zEW23$GP$2=tqK)o{D(cwwgPk4m-}O}i~LWa@P|h1R@({k>%?|eL zpSmyYW7NHX55;qk3^9&5x8A@9zve(|q&>^(N9v#*~C@ow+gOZezi%o1B zJIVU(r|jP;ZGt9*H)Tr3d(#e1-N#NQKWLx&dD;Q$?NYT_ zb17Lrb>RnTXQ%dJC#GSuGm{O(-lqOisNul=A{x;2BvlL@e`S7HLzZf{juYmbVBTQk|Q!8V5L z&6MP0+#zS5Q{M%)+Mt&rdJ)=BU6?{iqU;04?Z=daYHOey@86mww?S)WVIph^P}4HUFH17b3{W_Ua~%u zH-; zyL1W-%AdilvjTe}?3(O#bMHJNBSN*7P%REavpq84FLAH@Pw_1jvuE!TcS4)aX_@6& zG|@P4jMR56jitGX>h>g~BzgTgehojLtEfz=j95y~ULfxNh{t4B0TUL;e&J}8wCjBw z@1n#v9f46as)Is3zM=@+H4^_Vgf=7sRf;Q@KL03*LiQ`MQwFD7{IMlOg}Z zH@u;A7}`58iy=vnlyF;tMEv?MXmgC*?}=c6M2b+M!1)ZmbT-->pGTNxN&x8e8x%oO z-F%%U8_gPkoHI#co4bUUBvdP6l_Q=ytiZwcpqU2@ug8qhIvM zcC4?6LG_=xQDH{_EX!geJFQ6qD5Z13j!m(>1gMjgMPcEF>n>Mq$EE+19Gdf6%d zJ*lJXhm^$vY@OLkP|ns|z7vj<*Sd&7~M36&Mi=kT-$ zqDXf0@8(eUG1?$vv1qTM@ku;NfP4&i*`CJVVmtWPXi_La1#j1r`Mxe}oPt|%D=q(L z!bEBYbR5l^$_g|vn5H)75`0fi3z-YBeXT`24|t*=SM@F`SxP+O-eTnJ_g{x!1BSK? zb)mHO_{L%Tc^j1dyysPOj+Ygy;xJi>N@aA!3g5AtL;)FPxKml==BuwGlRSAl8J7UN z`Ugy)*oMg4=E%L~+U0WOWE6l%=O7tqm$L-7FSGn+H?UbesAOp)6am3ra_Limr=OsN z13t(vqXQ!##LXA%#?hSx%$Y$G{NJP(*m3}o){Zj1je|12|FB<)?R#~geVK#pvwkq7 zeQr13I8$vO8iOo^_Vp<3JDO~trS`$FJKp>Ol-Kjm=rI^58mPSi`3u7G(A0&tnSP5$ zZnN-z>?Wa07H!8C+HBZV02?+Jf^wk-g(y*kFAB;$5L$|+jJ$qmlmDcOIjPB}8-|KC z*B&L_E|-A4g~@bpNRWk zikl9bY&+1?Og1~nV%Z1KexuQ-RaAD)u-HYqK$~4fL|L}Ji3?xpXQZTBOAY#4o5PWCA; z+b6eLq+<3AcFuc7>`H>ic*PJUp8nPdVW1HJy7kmLwcEO9A%yaWa|ou*1taN10y)wr z_s*6~>(-KbcVqq1OOt|^Zz&HHU>1d`_#=5)`zv<^Be}l>ab$sX-MBAX4ET$y= z8z$8#Nz(?BelGF94ozy%LDDBNshLv#?KnvkDH2soVk4pKO|^pg3%I7Q!PC^m|Gz&C z{cCakynk^0^fgH%OUmp!n|}xNsF&!~Tyx-IIbwk|XdV)&)hF#ISc=?XmTPTv4o}kK zQ1E8cW~b=p2d_bL#b(;PNc4oC#d%T8p2gk>KSeIZ+xamPXBw00ZAdOR9AUM#z&N?u zRxJd_#ixa5hQc%df|ZE>LJ5Rb+^Khm7q9kuc;0jx)fgi70>@#i!gxT;(|9Tf81v z0wtmEa#<^v)Gw{13WS-lR`N^5^C@N~Ru0W>Dnk!ulrImAWs7YdUUscwV(qf2mVG{$ z1zluaczg~%kD6^F?%u}x|&iqGWAw)t)%-uW$q$&yV2w3TVG0Uspzj0w3Njq`~wnv2EkOnTR9cSEHt;T*O-I) z=Dq9Du;sNZrL(JT2BCSI64OjEzsN$=ps;YT%C9N~Jh5ITJaISNnqP)g@xtb(@iwoy z8gDl>`|x&s^Fq93HRs^%s%9(Ru51?YHn#aFL;uOmAK^{kyp5rOIod<>tDr!>W~OSh z{QfPdX!zq>Xe~lF;{2XuRQEhIu?9GO3b6SKu48bWf~yy<1Y9Xlzfo{m;F<{6)o=+K z?MU?}>hvk826z~88GqjhuS_A}AobEDpuc)Kk>E$O)$((wYP;tRR&8f8YWciD>+iw* z3WNYUZ!&uL+@p}uual|2nTHw4^Hg04$fzzEHD*{w7v*Ob0`p12T1rAVBl5LIG@fNq z$UZ-rMdf2`lK<_M<*s&7`%hIIblA-HVBY zV&DEaB`{RLSc62sy4G5HK9_u5VTh|7jFbEOO+WhAnS=+zKBS;qG=hMZQgQYVrNz6}`i<+MRnLSG|> ze5i!PSNT@sYeaqZ`F!~LH}!RyZw0=-sJ{NdSA?&>R9_vw9DJ=;UuXKP_!?ASC;1Hc zTBW|G10Z0Ob7`95=$s&S2fXkQIj2tog{#dB|d5p%-_Ma z9j?vl^B>^as6PKUTt4+#f~yd&8{o=R!;)91VL1Ls;sfMnea~Z;|ItP)p^@gf%d~Ez zLK8&R(OlmMH{W_px7IcUzSIXlwI$(80KMCmgzsuh@3AG}>%-UEZAti+;;Y@3gl_@9 z+H6Vq=HTl%TN1vR_?n`=rn`LxeD9t*1iqc{!WU$zK>X!ggzxop2j|qxWYoKPD&E)u zW3LykRA}3HxS&bqX>gwd*L=7R!+SB@g%Qc0X5dLX;?kcuLWei~h!H8Nm&O|Yjeb9K zxxCr-GPlstZ( zHlBeu@(Yj+YK#{1m#@S_&T7X(VmxL+vii}cmxm!(P6yVz&4nUbp~liID9#QIuu`_# z6y^Q8^AiHNQK*EzVH>8>kL#yJk*$X3XS%}==9Gmha{0eVJJL`k*QWOeM^uzkzRS^w z(~1uJ*&?9?aMO~>ih_H}t6EdN9E5mEryjl+l!bYp7gj_6%=h>c6 zZ7x55g7)W|iqOYg{Z4?ZC6H~}yc6~7&t~sphk`&`p}RDvP!cXl6pL+czDl9H#Pg5= zG{x)jH52TAic)e5$?nYIC(%$hdrzI9367MxCT!6(?5{b+9uS~3wm6Hqjoz{{Phx-5 z3R@QPR{Ru@GAQ<`tF~Fj2eXH@&xs}`4^aDR1hs)>5>Hne2w7P8|Eix~B(Ftf2@-Ny zkbrF}7bMf>pf>uofkfeA7fVH;NBbOmV33g_a!ndA49$HgHCh%kZCL{JW<@az4QWo*jK#T%u4}%RyxgvcM3r6Vi}Z)Q zevNMfP}6>k#D9XUP`Z}XmlCH@q8obhxS)u7o>~;#~U{&>a|WKcXz)rvHiI znNeS5%CV90RQnOdlam(JHyaYgrVY`$sK!684Ca9i2E;Tz5vpEN#y>hcDBh?nH*JV4 zk3GE%O8+rj55jdfT*Yub2A81MX!RP6UKDh?q<#cTVeR%4a)&|w3V5qrvzNB-aI}r8 zd@DyR;0O$MnhmFv*`RV`*1(8(Ar0ifydguc z>)hbbt3O4X3BdR!l<}tyzLUW;iLXO3r{fFgp-^pRWmV|Gbhf=JwAeU&LMZ;D>_@z8bxvz)T4SZAu~OGqnVP$F z#JlLr|Iy`Ttf;V6cZZrg}Pia3s53w>Dbm(FpQhArA&y_2e}vd4S;`9be3E zo~ZD3g}VDn-mApH!5@8I$b+nt-UjsTAOXtw z?o&y>tY}b`fZ1AE5nebVy(+ZGs5q~{%AQG9c2NHn-DnZH6tIz@h0*OFC$*yAYWTZC z;J@rfC0mK#c}CGFbrm#3*y5sqfl2uxcRnC2SAOU=GyKEYF|fr2p`ro^lnO!~3v&VU zz5u5!9)olXK1jA=ej`4(vfO+oMa}f^sn#SaD&`Z=au4WAe#hTXak13HJAQ%cu!#v| z3s|8@7Lxwkhys+{{s|u5Ns>#mqqP>d*;3E6%9L50zmg*Avqgm(H|hF*GojP4=?d96uVeGM5#PJx-cdz*@s!H=(na zh7)VX(zt<%RMqB6?@x3dLXrI9Tyb#@kYT=FBH;cCeOje?Fa>f?(L9(7n6h_1#f(aDord zK}HQ9yz^4Xx)T-QtP^K);}XaK@xw2Mg^TQ9RDEax(!xjCL`+Pp-=qMn|1iA?8iBC5;~CkOH8mDByqgKSMY zehv$MN}EPd&qsv5Or${77QprW2H^9aQFvl(RR2HZ+!QjAya5w?DBsOJc;aw3 zYYm>VcUR>-lJ#g7;+Mx~4oC|BWf>|dG;Numg{Zfy`Utxd=2n{$Yfpq9vEr$yfh*no z?+~V_1JIFzfMju}xVnRt7>oIBzaW>??$-G_fq%3YI{o#(0xiaCE$Xhva+C@bs-6*z zKudqor+7^Ugi>>rLOKSn0NQySdT(A*#5^;-#e8I36|+~OdPj2p0yj3hL*d!l3XB>7 z{?ikQ%kB3Y*!^n|shQlnw&y4(P*+ zrsIL6Y<`hxi#yB1ie{DoC;B}y46V~c^WCP+##yG#g|jqx0C1}aH5GRN{x#NMPJPLo z?E3-p8v*{LIdNsvFE#?^2-Xj`4Y9yozLaO%WXr(VMye@P_5Z$}29 z0H3!yugUBd4S|X55jUPEP%~YPQ{Nw78lM>sPKPXc-)r#s{G}AndLhM~MZ`Bh23&=S zJr3N2fpw{0w>lRHO(i4!Kky5UWkvq+t?iV;-65!P$Ase$lK&VM8+ugE@qIg%2CFGEsd@MTEK z(U-S~4d~xFt!$j;pldZ`xa_;D+7=is0zWinprIG(&$aVjI%++*28MJ=U=j~?C69uA zpoDK#UaH#WLoUl>ygF%26?FHA*js@dzrknz8LsOke9sBhWGQ$9toBAVv{?zoJklVK zAu+!_fy?!LqZuV1B-%iHMHGNhjwFDg>>Z2CIk2_sUL_f2o$YzS?1gp52=@~9Ilogq z%YC`2p#kSuE5BAbB9)iN!nLKaGClUavgDyVxOM)lI4)u6!3=xD+A+7f~Oz&wO|G=!@L8oV{m;B zm;QO=pOZfgTv`$Sbc6Vpyy02_29M;>dC!Z1hLCh}#~PT#wPLgbHAM?;Hb3ys7u;;V zRf>M2bBpKr?^EbROH3^?4y&}jtV|-hrzC{F#7b>h>bc4}WS08kH;Ro#Vs?NC?6V5Z zYL1mjCH$FBlfoREpwQnW!@y|!ensQ4AyGTFsR>c*+=VHIK!zL<9c|U86@*-U1i$G{ zW{Kh{C9T|+(r}{j&XKTC7;jb=3g(_^+ES3^DJganeGRJw@kX#TT#$RsZ<&+$D8nuG zhu2?$OOn^aPmM@=RiQJ_&7C>OcH?uuDKYw1KMYM8b_m+ zCOSHSS;qFlA9A>(8*kHuog>};44(G~MIbJx1w9BQ!fGel4BhRJ0+vMeo2Ig&i4nPDgd9o3 zy~(0VSdyzk^NkfXbW&)avV7~Pt~4fx*IGV4XHcG=Qvz5X%{E86TT{%fE{))y1>BSw z#pt6oyzUhwi%OX%r`T6WxV_>iTIiJmZg-`)+3h*BC}lzA??uzD_VArrbm6)fUDV_> z9q`n(XrsLbZ=)nOx^#^ddVUK|3s@0Q>gVMhTrnq;w-u1ST9BBXIkDmJ%^Iw)jV&lD zVM`5I>k{7zs?z&kkrs&smy^~M6E=cR2Rs9-s+3afw~@Ed626U$s%8SR8ec&=j;Qfx zgF*!=G%Ln-G`jRa7_q&LE)j*9!2g~#kZi`=xLDUHX?c!P-+bsAs_%BA^6AC;bq0yQ z3An9oK2g_*pSAc8SePZyGx^f*2FTFr^eXxBbRo#ALXV_ZERU%~>1045-yKWtRGV>* zBOS;eR7p@s46Gv}e8l%9MBti%zp)4rvVnpP#7O!dDUueY$t$2}kwF+Jo2(=oy0r14~O2pcRu)7qHj`yT;1WOF6 zVdzfHRMyPEBrgviPcC==#n)b-W%4ebg)EJpKdij}z{|az$yD>ayh(Xc@|O*nNN=YD z9ZLad+h_n@HW{8|d^_OLOH$^#4^4%$JZkUEN6z77n zrRm_o=}qa%(Q5TO16ihb$3wDW@;{Bq4%yUXfkURvCRnoo(_}} zd1MrCfp8^B{400Z`Kg<~bS-XwEn5~mK(CA7by<8T6d)fjDnVIkuj72Eyf;+d7rdIw z@OcUT)M6}3G4ieiYw28tJGt<49zXMinzb+B%dM*(>9&#QHm2rL*OvkjAx1WYo!LfjW?ty5C z^!QG%ecUTSPNDLX_v|0Y9>ZQ z&JOt4qt8a=xv~3--J#&8TzfP5z-kFO&#(o?=ad3F#CGO9Gqy#7P~LG9YK&nuJF+o& zq7uB5f_>;~7ivf!KsCo=M*Kp$AgEc0^40zvNVb@QTGG&TaG zXlU^nr0HY{JNw-Hhr^>xN)&VUVHbv-$KB9}VP~_O&!4W2uOF}lnU2;qsWr3ng6*|4 znX~ueq*h28AB7?GdRMmkr5Sq%AUh1Rp_% zg&pPL`N*B=c<#-(39e`XUg$8b`ycXQKPjtDW0t)3?z|fp9t8gQLeR=T1M0;;ncw6R z1TsJ7*F)u&EqkF6N|k#x!F0#BK!|ORi}px?J3d+N6@zJIWQyTvT^5|+_%}DO7+93;6I&hqj~X1krYBy85x4d%8se^;BG0Rb zItzjEUP=DOB!6vk^jA~{4HcE;okt<(9`b}092f1>%KsG6f8LDKuOw{GeDtbdewwwB zS7o_Vx6&wgh~f@lH~1fD5jl$SaQET87s71tPz2Z1eN8EisZB0T;{r{SOAGlnF3_TU zqm6RkJ&=3&4q+fIr2@37mD{wK>i2_nP|^U##To+Yh1kZSdAtv|X1Lyf>s7dZ2iHdY z5UxhJSm9GgLxn#(3U>~74)^15KMwaUxOc(*4BXGay%+AiaPNbAUsxBWW0ktZUbQfm zz(ya3s~0ZgA0fmEaNHSt8f!T8S!ul*g1+#ELIl8(OdAf&?h9Av^{Jg;8|;Kp7f!#@ z2jxEWCoH$;5I{QfPt@LIpPW_tBpdrA@JH$sO#E~`JiiLpUbvcE;?#YO3q-(enDt45 z-v18C8tbN}8SJZXAtm)f-3BMYUAGC;b<=x9~bCNdQ#n|0EpNT~d%+~2Y4zGUazDYpWu z>k0vSbQ&CbS}Se_u%pSuvQSMQHq$+K_+n9s%_%?X_#!YGqP->jzjee`JH811Q1Tm+ z9fgYpYlpyvdGipD2ka96?l#B@-2kmbr6Q-<(PpZ5qnR=_q0@<*nhC(wP=hyfu;bzL zQIsx_qNHIl&hr6`fYm)XpuD&)CxS+-=&t?&$3MX<0Oj|=Ff{Y+Q*q%4r1Gus5Xz}w zZ7^OPqY&mn?de!&-y%UM3%_Pt3QOqP<5^--Hn=_1@G=l=-TESU(?|h>ez(&kt-se-wf=#7p8pvM3fY^l;V}yh_#bLOqm?#iy9So1(3@xnzzX{O?ob1&dxxEM z=u4wdOOLpd;@lf{w)^3Ox^aR~5DKmjIX_B_n*$vYcJ6g2#^uzZDJcKYEC{<{c)4+S zl{s*~9L9w`0)Tg%#)%ROX7Z=5PEHgeefgBDlM|)$B+eebPlLmvysz73EHE|vp28es zah~@k0<$E3z4F{2xLV><;W^r?59c@3eU6((V=-=-+%e@Rkt{Jau5VttOJnXXu&oI? zCEh(|Fq30r1~d75% zr#M<`Qd#Ru7~|Ku`6tB+J@?W!m|MZgew`G$5##u~!y@$lE0;&VY*ZVo59fVcKB(SP32ae}-!NJb>gILf!B+u2pHu=A_l;NeK|g*$xtv;>`@VT|i&J!W~FC{b$H{q>}C!rh@{AG1tZXX5T|Ng~p&QVL2YimJXPR zZ$AT&?A(p4S(5td5F-+_M1I%cbSs{uXC+xU$V|BJe)0-l`C=JypjT32cr@J5N?QQmh3w+Oe) z#5Jk|zHXN(^M_n&wO1#CPt{3}phx_~_ zh^y%c-aokP|78+3JSAR<-=Z5_eo#pi@G0v>{9&rer4@iRLQ)uvz#NG$Qwj=9f!=uZ z1Bu^(@4RW!ATPlmz6n?FRS?u!oj{{`ph51NG?WI(oJ2GTYm4tE8*+QMW6z`4`aA6V zm%@@=Xfr>O!Ec^4AhN)G`HqaF$RcKX9i3(-0yZOm5!tzAic+GwA8StAfm@To5u~5} zWs6xT>G_fl=F${@O&9YEs2I^Ck|E zg15t>CI@bo_zfe`YO$RkcH{E4!iZ|)8n1Lnv`H}AoTAF9m=)f!n0 zmDym8eHszODIkAw>A@uy3Ar9zWZR$$*G^0>QwsU^k1GeNV8nGbV8py&`8fkQ#3Wvh zNE+}1kkJWz8eFH)XejM0uz{PT0a54 zceJzffEs!oHGQUaNC$WmHzk5VI`;Ahyn=9Ttxj``rlvRh3jo@+HGQn6EB>gX{LIQb z~-vB;=kJhLk-F*did z)r#=1;p3iE*e@e2IGzR$#wWi43LyLdHECYZ{b&yc-^9mJ7WoqIfMO(<2*|d6haC&V4mvs8Z+Gz%n&O>2*g8#%=Wh<~3IJv=}r&L-qn)CwjJI zsceZsVqMv%x?99h@C*#fU>_^%lfRzwlkTkOIX$yHgG5nx;SIXFzy!9>vGQ+egRCi-u(;MF+}1P!6` zGo3HtE0k8QmX;kATcYRn;f&v4i6N(fiQR=cQ0yu^m=)#%_mnBEarOqMprmqT3t?g7sLLdYZfGS6vPWnxQ=-BCjzwW=p7 z=mH{JU>ztEULix6_SfQcKLc|>jFO-bWrH~K?!EpJp7^El!w1@&@dH?BIu40%zE2Jl z1E17C9PcD~+Y-n&h6#+_D)s>e4A6-2RXJ$pw+)nlnO4aiC*>NmCgd^((KwiIBA zlO^b>jeJuiOwUB`V9|k zGYS;E>O{FhF+aErEEddCVIh34N@dM2K_%kX4RTsF2FH1Y)5_qsal?6)H!bQsk3Tk) zCkq_3M{*}CkMHwZ3F$clWH5?@sb@Jr8O_{uydR0n#Nzn_Q=~JI4PBSO`LNJTC{i2xL+Co~5cB zII$Pg`09R!6ju?+Yy#tb55X&t@rBBJ3Vxl~8>3A2;etj1;}$~nZoh#yU4?`pJp3_J zF+}W&r;(nV7IJUZIRZAr%99m}fg(W5gobh~y3< zJLvFGi+?;YUoSKRR|JUia7csX82OD+H=5R7^x2pppXJ?%-vy4aQQP1iGT^uJysgA_ zTcW+9jrqDnx`-kA)!(+YM0 zHQZeo9WX$|%NP;k$7Y~_Pw)#g7^kU&5znTk0827}j;iK*^%dB5Y(ker_)p@0t;Bz) z8UHuZb0htq&d2{#<@kRX{(a8(1T$YxnAr9b4sqb2Pve1mMV9+^UYIWmYooE>UL%Bx zEG!!3=4pvFP`wh>-Heg#sQXg1AE`U54c=PyM}sDi$6N+4yM?^o&h)w^K0-^_D|WB4 zKC}f*g!~>e$sHFE_oX5k0c2(+`Z=!B0e^w}*GZ#XbVUY~p#ZFc#Gh0~PyknpiWrh= zLP5YH@!xBZYMobwy@qOX6)_y5ev8kI0|HIri4P6ceCpTm@skw}6p51#2T3YSVPvdG zA`#ZTk(V2&U_y5R(8m(g|J+IBRP6h250&*%5~h2D6~Xc(2d>X6GXzJwISTklo-;WC zRKyi|HHM(2JE{$s-26s0DkzR{ehQ^>+_HDY>rn{ULD?ndydm*#sE}B4)Qq7~W6;2m zgT>GJDLN%@G}+aFBl51J6cjv$IJMtGvy;LzU<>;K9O?lBGE3rxZPnLfbfu^o!UDtcDW zjA5h~Oq&ZeI=Q1@ILb*k4M#culb&3kAYB0rL%-R#5u3STI>bJ3f)p%TGl8Upg)Wg- zV@&cGxDh&($B+gxiaR8p_HB}*=)R8Tc+jFQtcfy1$k_pl#3SVYDr2}rtb_k>I!VNi zO8km%RhrPC%t{|W1(Rllq7$wVgqbDwBYEXUsLoC4!>PfxQ3KUkgfi$@;8Q8&giZ)mxkM`0e=78&oB8V$o67wK^4Q(`b!Tx)Sa{&V3p3d^=+U`W@a9 zscAH7jMVQB{Iuy|O?@}82R+DdHsOxh+?K$E`bc0@Q;PC3vOW?#U9r3pdR7T)4R(fW z6HPzV)*lUIVUTw2w&1%>w~6qTwW%s0M5Z1@Z)_AiANt~i%<&RWLC~afvOhI_4EZ7HMuXqbN*b< zh2YIi?tXZ_X0E3{cvX`-0ng^SoYm*wtlf9j;ve;U+~As99Dag6Aslxf|L1GFsS_FD`xy8Rw0@#jCctmkZ1$Tbo-(bZa(Hv<>4)hD=OQ@tg81I%QHUib(J^fy9fn}P<% zI32tNO2W=<@JVSM?pP-R)8$@m@QNzAra}mek!$W30>(Cd2Vj2GosFC2Y4|JvVjhJL zz)QXXg+N&^Vb;vK=_Smx>IIDS3qJF7^o)fH$$acdwAbW?Y-}@ufc~~10{$Gbs z^9o#10DwbF#l3%g6xFo=zCR|LNwUc-kU)R{QG%k;77ek)O>hI*Bq|FV)@+EHzfzW=(T9c3}maa8H6-FgdW}##UgOM$G z1BXuRbdMLOsEd%*C|FmqN3qN7AFO{sb`kLvyu)PNni_NxH%N8l=;L^ng=QR;WVybL zYFjbO#BNkn=H&X*T0nZw|Dc`d+CBpxkIFAA)?SyJd#D2?ClQZmW!@oGvEf>l#iC&x z&!V=^$>hhiO?7^JlauwC8lBO`s_QMzAw#8-MqW!mN{AO=bJ`oLqAkwrhC(P2IES@N zusq^3FD(nYqGeunEd`iJ-=WJsZah4W#4KVIEZkvdL`mWfyRPPhnjVQHg>^7pz2bkY zy-s%s3L+O_fC#u*#RN-_iB~6Y94Ce{n<;T*$(uuTF~cb(gVYl-db|}}18$_q(^kS5 zJcfru6_EIxTR%iYWe6k~KSR4z(tI^-grT&b;k6jVni_EJGsXM|SvF1*nQA!Iz$X?3JCb!{l!Rzo#w$Wp> zN-nS-7l9wR@k>Y~?GW6v0)uYHvxKyVp_0A(kxe}Ggu$@a3Uh(5-@?ST@ub)VGw3w= za4mjs$s~__hrUb#M(t!DWnQ2`aV+HN!A>Sz9;9yvGSMpJ<`rN#_cUIVQOs;I^we1#G72z6h0F?A{Dddy(D9I8K>Apb z77T$#^(yRntT?-=I~*kNdm&_2nKnex{)&5-TUT%Sg!s^u$_zgy``(A+ih_ zinnlCBlN}9wVF^E^TaPO>dysQw#qF{+P-oKV$wN{hv? zt_zoG`x(9?Z*%IFQy#g}X8-e++2UYQ-AuWVwYP4`5F?Z7Cdq~9PXZ{oy)H>cgL-lB zx^+5fi5pYNvf)a~amJNd#cRg$E&nAqhr3Pken*?pmc1W!>Fl4@E|3dTsb-wqQU4JT zZ9m%E+#GkGcrv;`Nb#-QRW)$E;Vhl!sk`1lB|G{(NgOl^I-IBX?k|v4(N%-iA~Rbb3eS4GC8ezs_g@A z6FkPO2Nfg|VMmZzV5ig-COh zo5V=`mf3Y|{Z;jG#}7A5Cr^(pKXbVJBoi8`OV*VIFUO5xNv<1pWx+l-F<8b#ePkTb zBb+=os@147GFH62eMX+T_^pcN;BX8A; zM176VtQwraEcO8$=CG#b>SSfhF1aiFJ>c}Fc1q>FdRa;;4TqHSNq~9kNq|-EtnlS8 z^^hMWWBHP$)+&bb#pV;J+$sTS%2$P64{5bh)lpzAPVTBOcTG6y%P;d_ORKeP#Y}DT zsC>mtEaTI9Ms_%3x|VU4o{`0j>0&d{GO`uEbegdoGTPsj+v@V^Sh!0rP7fBb@wsb#W?iaIM7|YbfGuN!0nRad8H)XUnTKEzG_1V8A#33r!O5 z|L3Y9A9kxMylQ$OXo1k_2dso*iXm%J9fY1=j#UwXg#pj4fqx=Lfm^Js!Axq}8b95< zt3fs*hz&xf^!FE`t#9s!uXdcRYA#}dv=(XO#$2U#Ln)iEl&YR?oo&r&w=-{%H<2?f z6tCXC<%?kHU&X8AHd=kj%bI28tt$}K99M)c;8H5>ZBs)t!(xbSCJ`rPIxI)rt&o5Q z{UsLkfEI*1J(qQZMP(98f++UOy(9!rX^u`%Y@-MYl9Ihx)5uiM)lM>Cs#}m}h*6Sf z|BS04r6jHVDOe93KuchxNzT4udQz#C1oR|~^dzxvuSQQc{>)QR~N+fVD7X1kCT0Wrq)S4dx%1~1}vP=BPY(5^2n1V&-&v(g@ zVBxFs`@2An_!F=r*{xI0`3$e2Sqr=obrOQ)+Fo;HTzMa!vDLY@Fb(SZ5-6s=6`>Hz z`v8Rc59y-jWH-m%E4D`qg=ARMfVRUL2Be6kOW&?nD0CQBXdc9T%AF7w%N)y@_%CzD z1FvAD+&hb$h|nh$r&f@6SU@h!$c$Yz{@)C#0QY!+TL(I7c$IBK=I&KojOF5toc6-J z1waJkuEM;GrY+ZKWABv~+p?J^p8-8KIjtVx$S4GYI?s=vDV!%Nj$V#Bq@Cr#LiL)Xmuz*J0ewQO7lle^4RXoTA1RacV~>+ zsTti6mXjZDjco*v&XfPOJa0uu=UMR&^RQpbvujMAWy5)nV3o~BR?y#N^q1hT@3xvQ zWJVuP)6O2+q^ftMs!LMUMX9Pws_OQ|ldMEdkBgkdIfC0Rm)v9%&Kr9(pR658+@$%v zrFSL18X6Oo6pQL|la#T!sP&r@sbrxKIn~qBv@1Xx(8+H>6ag>jh2NSEU~csJShN2t$Bn!ar?INaoRRGF#V zt3`8xX}BPI$zu>%>2RyL7*6_E>8FZZfHB4nTuL=Kd;Vq^DLvUuW@G8nGz_S5yo2W$ zxJ7^pImf98StuoAgZ5w?3>M&-SLIFHhC2!=a@w;PcsAdBTnm05gQx5vTH)g)*Tw9( zXJh%g6pPj&NP<1Sdt_&~I;Wzh2;yP3oR$lCs8@X#W#qi74j~cZWkch#dz5(XEqzqJ zwG2>=oqA51$A)>5Fr|aROsxKz-s*gZ&dSvPDp-RifrF%uxk2x3Saq>L|yjB{$g z!uWKEpMvpUkIbuTctpa1|OgOCy1$Vp|mCyFS4xw*nmm_5o<#jNtbu z71XJF!&yFAZb2F2;5;B`N|OG;wBdG?HTXTc6a<&6$7p(33YHi9;!$Oz8Mth@JOUMG zcgXJtOVr_&Kz{epvv_63++uDH228Vdt14D5J5yJO;NcH4gSZGf}cm=CH4U6IeNKW!{uTXja z2y%6Kxn212a@;5Mk=zXrH+){wpC92ct?8TAyqI% z;o}Edaodr)p2&h~0(yZv^ykyG;7Rb-7%R95gVc?w9wjCA<@Lfh7LGK`OAK^L%Tm5U z+wEEE@%T)YK4uxY9M#t(UmOD-dKR!P;c-1RCRGgX)lE;?XlU= z`l)~ocv|6UTe3L@_;S?b!z*aVA~@Rfzv5ve7=`IU=Bu?hi|5rm#{si9M{G?emkRa0 zU~92Bl(pq7-J)w2vuH{KjJGd5^0ZBOrR^w&RLJwuo|m|lF@jvKo~s}?zXc=uCg}eb zwti?wJCKZvH05%72%mr{1+!Z{HxmCz^+V0tEmd{yo0wEnS*D68^Ke*QPQugH5~=o5 z&V{^bsE;b7lU+7?hwg7Fu{(6i2e?HHLP~Hh1vYOw&&aLHcYNujG>hIru@4FyQT`UY zIRT9+^Cgl>gT~6`O&4yXh^Qccc4)klFsXu6oQ7h_ABJt%`^r12BDD!!u}NONc;7c#!ek zBMH{~tL-0bFv%a7T@fvp{X7%^A?NMy^VN9H_XJ~qf)(uIVCGQ@^CbDyxz7g9-@pUB zi_DC00|Ir2G9`F_Hw{0eL5ooo-X|DZ3X5Kj7HjW}d@n04W&z2HS*~I!Pr=&X=K|E< zhpRVe?UXAaH7iv!5~N-XzbyRP7qh~OCO}G~iyI0978~Jx{VabiXAn~4lN6`t6sR;| zGJU7mEjm(^kgnW96WIW*qf%8e@ck{VH=0S)i&!NGfrVnzAgFz1R1AJw-1s9FG zQWh*tEpwAuRaAfm;YFoM?QxiP10z1hrqa1V=MSXVi{VlMf=I>IJvfuRaxP}VO^;q- zt{4KrBNb#K%vUj5FW%lN;7Ytn)aIX-i_Y2A{i$Y}zUD+Bst}Ey*0|4R<6C`9jUf|l z#KWwtP}BT+j8zz~ZWyVC9#;KKT+FJ{d}%AA#$gq5u}x%Ev_MALuQED?S&vtK0${$N zn9ZSu4WZhra`U4hI)?*ua1O)hcSatR9IWJE#1MO*(C1_1!5Y+94qxWXo2@n2pE@W& z16kBLMdO~qpBUBxYjI5~k8WHjpUgfJ?y&|-Y=vTJL=_va;1Uwt5rv0jgXiZ!Fdfle z{B$#|egZG}5r_5ME1Z(cVVFhYBIqn;iB&3Pq(U}$pB1fW7Bb?>UldV_|N1X*v@{hj zY-$?{2SU(Mjf)ow=7dcQ9bhmaKOH!GgPWzAlE*q=_+|zi>(cf(38k{I9yl4NCd&X|0M}Og~%)R2( zdn8w6gT;4GB|PQjjD0yPEEKQmv~3E`u}E-{krKBZNZfAHh}#S?+&wyS_l~d8w4= z{wkYP$x8P#NKNi%;n!Zt3KdO@;(>xp01Bc41&L?YXZUL;AO$%ynt}w2b`;5HluR0D z3oiK@;RsNmAviY2ZAgS&(O}V?QHhln8KXek%B{g-qqHC@72O%>L0>t*^`p-qF8EEv zW0mz5D0#6_x<49xI424{6&_+1i$nLo$^l{6r0RZW)ToJGvJlmyX#^n0z62MOq2a~k zZ6J5NC5G>mk;P;&T}&+h5ZSPp0KPX;Lc5WLQjyjQAZtaXVR*C(U42387xHFArSv4l z@BQ%0>Z=-{)uI#TAwa8zqLmWnw~tX2eU6yRqiB5_(Msv@;_gwAn}^Z5cobTlHpwg% zrAPH+QvG0O51slhVER+daY$Rl@FelWURau8Yh^i#Rpc7B3 zIsNB8#RWQ4Ih6VqlH1BC?-V+{D ztm2cbfrdhuy=z@B-YRY2;Ve(ELxs1qh*XAnNgXh+`19oA0+tMtPx4 zoTu`Ck)}}~7usZ-cufU*!>7vIDSqTFJBnty5S}x_EmXwN&{kR`=f&VmQJqow`*>a; zh8g8DQkuV?_ltHE<)|~?7RKuZL!rLRat%kfhuO zb4N?Ioi2u2>Ki5xagakuf<%z?hWito&U@+RQ+O@^_IeZ~FYtPWSTHZGHf$7StIe{GUMNTLG|=FH~__EAGLny{s@2-yWlk~}gz6P`qFEBJb& zK0GNebndf+Zvh!=Xy=opL}}4Dobo^kgJRWe6#Fz>VFBH) zsGV{GLcGq&LWsl$7cg{)*El{k*jB2!2F;nG4b7AW;V-+}{?woxLmZj)9>W7^#&~GQL(Whf?LgRF(a`J+4$VQk04I-`Jd72fZC?5hFt_ zMOhOJt!OV8oBO1VPX_kOd?v>_k6b^F27Ik@F{^$5^*BA5nceSTR&fn8a6qiKir0tG z@_rDFM;GY^q&-o-I#~3WL0+^i6%g|9Hk*w0zf$>$^1Fn&6$LJ=*0`mpZV}3`0ESG2 zxBOcG6h4cBH42OkUjt*621a_!GBg5@ZC6^*9bkRlf31J4Tewv$*iMzJZ>Yg1d79pa zWT@4s2eM}Sj7!xtj6l13=!WkXw`k5R^J=X8gc=P!f0WzEb9y-St6ggSI&ANUHQ2lq zw!6tm{D$@C-JZGViseb`kal%lFY(l?RCKx@;(F5HjdC#~yGW7{A$;eUjij?5>l^10 zH`y^Z>SZkoR!UQ~kOcE4Ze1Ku&h}=Xd0BgNPACtJz8JV?LzLBVt7(mzY(?csGsr=t zmg*~+_u^$!A*%*06_7Q5(`2=@7$+7$y_Q+{Zct7_`OW1ye~lRicmQN$CYo4)prLDD@|F4>~Ja`y-?6wNz-k=MDFHw8cHJICgVZ$F%Dsis>3W3^@8Ir1AO; zEpd;%3n)?3p4GUdS$I%~#OBmjLOwh{k64Me8SH(zv<%W4)@)aih%x-S+ znO|A?9^`-EN666wC%SA&`E7jsW!F$2A$SsC@;$uFtS8d>z zg}pM=37qI(sx&Y%P{l+*(_hF|HKWFZlg&AqeNz08!^bW;l5;Klns}MRhujIv^nJi< z$#07v)=4g6|AL>8{RLjrzFGG-?S#ejGO}p624%`H+T_k~kLk+NOXpc+r!h~RPs?Q`9 zvyx?*RGcmqGfJ|2kF=Eq8L&ECs%GjJTTPG}3Vz6;T~H9WWHAQ*W_p!^US_cIlf7im z+p1c>%BrI4m{sWp@g{?~ipBd6{e@NsZxJ`Mu+FIWGMkd*ag8PwjXNk-?q~?+-3`gq zUIe{uU};t@+9kDKWdb0r$;qlND|s0aI$woyYORL4%hgrQ{Uufh$X~tkd;DCn4j932 z;9jQDqTJqOR?++08S)flS_rv>38eDRkbmB-FdEJryoWrBrJ*;(x^uWM7(9^04xwhq zCetX*5Oj|zHyEf9;-4dD=gsM_kl#R?#p)l>baK$OTXJ?tweLv6AxR*T5R!y$NjM=1 z2PNTk(sxc(^MnrJc5?9pZC_r$)kYrsfRY1$?S869yASnfQ2_2>aVMdp-+^{J_EEK2 z@eD2(Y9)V{Ds&KmehpRfv+?WO@C8q_yfK%WnIPpDubJJjR95EnkFwvvH3%wAPUeg$ z^2RYmrv6=#rhi(bpKHLYrS=cFz!Z2kO~`2voRx&rlF%gy2O7&SbAiv}4Tgnc?P-Hl zb%fjgA$&C*zb!L=*~W3)(c|1KSGOt&jTFBjifBOk>phi_0?HFfCO=;!X8v}Ou>6eDQhq#qaSeCJ;~j6p z_S~VpFg>%i7h}&1c&T?0BsV=1v_Ml&BE0yo-6~{?tqgRoTo<(uNwpy^_=QEwKTs9w z`HKa+DzrM3$Q?ZyEMhw(XQ-zG0$~XBv{|$grj03~n+v`~OXya6enqo)kIvrR^L?7_ zUcT6Wt%jfHzqW=?^IzM@HEgy}C=D<=dLF|x_BDcSA%@s+tN2LIG7T_W&l2q=vj@E% zG@0}75+?bdG|m;qEu_i)TJl>UGCzk#-ASW>&#eRY7NSxxY9$x2;PX)~Fcb&R$GJd1 zJ_RoD89q00flu(cj0=1ahb`V7bnbR@hmX5)*w4`{2{kz{SMrl(S4U7dO|F9U)nr~6 z2;n#g9FIe>f<|;hM9;1`t^Xn`xo1#WjteN%eUgWJ=0!9Y{Gdn*c^mYn1OC|3Qm$bM z16Vko+3IXW4jP6UG}@6TbO)=h(7U*JXz$#~1yOyk)!B`wNmLG8HQ*$3SV7RSsjSfh z;`IR8)h%9Cg}7JnN(*!zM%!4e3#HnNT;LF%dkqQfo(E3i@$g02d9l^`I@Q)gwM3Bs zPV%540JJJQ%mr3LK?v|KFmhCR{LS3UB~f>cftm|^1GP%0)Aqv^B`5*OKvKO zHaf3RZ8Dk?>g*{)`=9YpoV^8$`Ua{dzRll^g&SDz7>J%1`Ek3lk9S65uw|IBn_llh zj%$xw1KmxoIH9L{3UO z3zK1(#G?0Ov}-upe!Gx_2m@Fb!btV>tV3@h&TeXL*>y;{K_u(B04g%U&x;yoYY%8h(dmv@-qSOg^nY z?7&fD;f|F=6$XdlF2x3cfC}Ec3mDzA5Dnjay8V1z>J}Je>r)20#IuHh_jRD@K-(d| zFGmDZ&IPn8Q=1U$mvQ1FWI(?UuXT{zn$#>X;v**v!9OTe_qAJfbvK0SEEof#r?YF< zQn#mq{1yEWhUbV^^Q5YsazuWAtJ&;2)R?kZIUQ`koY^hKv}%*&gcar@zX*+o$#47f z=J188>!R$s*kYXHQ0}~U6@*wE4*T0eU$*mNXGEDn=d62p&MNWuqVK^tO!5^Zfda+a zg9ff)P`k>q-@(sX^@733TL7oGE93WTZ`lgF-^3@u8<3t8R7IyMlwH-8U3CI_#43z~ zr8DR}?eS%jyQx<_t16t3YcVY7Y9seS7^Gu?U55uFa1|ck9Ec;yT4J&Gb*Q|HFKY;G zb;$xHVJ}-$*G{+35^T7F+Q32Qj$(H)Xku3;@X4xhfV}w<1Uz!UP$^d(X)*^w zjn2!^Rj%!F?K@2!J+mWtMt@$_EuQM~R?kdm#~7vtX1W~gqi)S}-g<~+{ti`AaXX&c zF}(FFgYElY8f*vPZxH@+`wX@M_~YSk4a5N#s4462^}mlQCR^|~Z4>@Z zo$6C$)-1z=@6WEFX+L_+xC{3J2b1a+@o93i&s3Qm=5K^Q7XDUdhlL_yn}Rn{Az_0m zP%|O_fzmmGw+DZe73#)^<#PmY9pRl|x$P&r3 z0kyD_%E`CEi=2j^=977@i?zViTm5CXw2+h*8uHpjXnNTW$v=0S!wg|4E~6r1rHvITwJAP26t-p^ghs2OEo7v3p2L zK_%T{E86~OGp%~TisnD?Y`7{a+(!QQpe}0iREDMenKo*lW@J}50_woa=+laS;))E_jOJW^a@TPDKF`l(U*Sx{?}i*00;i8*RX z1lTrlT~hMaWDpvRa+c!iP9#v#gS!bam-3=aom(BLUWQa zLwy*N+QaM4t;(x?n+sg0>rMw2ippv7yx=k>$k-+4r6b6f+9O*`awMm}SXqidkPMTi zJHoqy);~}Hj3T|^o*CRhVYq1&4B`sb;9rsD9}UE~`r{OU8>UyFY+<5$+T z6f^Y=7lb%p|1u>}ZZ5@}NMh(Kx4v~25ml96*r4+FR1Cv5SDH^d7jGJ3DGnt8uLUyj z%8o!)sYAto3m{SwF6giS%BE`RT1V zN?}J`r8|P(qunqCHzxSRV2KqVMTI74S?laLiu%a9kJP(J)&7_!6H`BgyFOcv(o0%7 z{nTj2gnei@wLz^EZqAE42n2A$46mBD4=;smqdIt6pc$Y5l*zq9J9U|h`RS$BRB8e0 z{uf5ful}3mgon$CS(76F^BWzOO5ygrqAVN#Zx(fQbWy3pK&?MG0u+{)`tO$a3M~(f zEZ}tg<|i;+(RL54qF=s`df`=3pLscm+x7yqkx^SA4}?E4QIi$smb`SnNVk!}xk>+T zb^8}))pcPYOy@Mp0V3ht#QkYrac2KS_yFSmNqbs;J}!O{$ZRf+60+O z9)mPurhzOyHM~^9GWj(1<7;mnwhwXxDLRF^_2ky!blN?@*G_6IO1s<^z8V+Ipyok< z#i3xyN!;N@cQE3IM*f(ac#AYUEt=IYBcFoCO3vxlOcaisIXMi1>yrBQQS|)BFp4n8 zOGTPxB|b~D)x}TW&jO>rfhD)@qZ_RQgLuccQnKLQZ84);TcVezglXhasAaSX#cS=_ zO^Pq*(hTKsflmy`BybHM;M0T_>u@3NIYW_S)cF9k(9(%JIv}>=9o$C6FtxpL{yyVSS^{vKlc*!fT>KlzWdddI7J9MU3w-`)*{_5~1 zV|-<$zREW_n5?JrpAzEh7h6$#seUW9E+(WR{9|m6p(pYbbuq&oHWo@L$^^PPblb#` zEde;0tqk;a?8<5ejAy)L<{MgO@1-6lF2V3v+^!9eoc7Vf!v|!V;uFRPT?5wLOtRYP z_(*IYMlUrZ^RqVXTo7{Q#EluSo?wQyD4NYJO{E}$8-Zi{ppBMtqAgZk58nH>YCI`#txjGA=f zM?+G%4OI`4WM^M6Kc&BfDdjgbEs67AP2|6mb2hKs#(%q!m6IH*%QmlksMXnv{B%oE zN?anpSWaqMlrjsGF2scMV+sAWLq38~Cls+$shhMu!p}0w<65(Y8^{k@DK0m)#>5J3#wN6CGuAF2_c4{7#2%JhwsmI7 zX#S=o2*R6FtR)8i9;7A~=*v`pt(wTc(h{F6o10u}<04C(GRt1u2P_UoJm)j| zRG&%>VCK_30vgOf`VxRA&uQbHDgk<=4cJ2L zFSG`-qzU-8O_maBdJ#Av?r^)pi4mr50#v>(WeInfbNFBJpTy&T(lm)Xe3CmV;b%j; zkW4PTi72HG?!Q}TZxa}EL~+PT=C}I`p-ovOz@s&m#cfGwnj|MRK9Dl21Ua?X*G(na z5oP>9*DjxNsT*7Nyq&fT$YpkIUnfBpzd{xIe1@8y>uBlX0L2_ML6{pe0PKGg*9g}Y zSP}Z{PAiIrAO8Y1f}B@?CTW+o0Y5zgs^Vc*O{$IONR#a2Ob9P8;_! zyGpz|MH58fEt%(5NnA;Z!vUS$^9N1yRtyh;IDSL0)I>`~b3zcisx>~*Kt~LY95f;! zI&CI>Y?x3B;h&9-2kF>&AT~B`UM1E>68V>)z+?jsj|dJAe7OoQvt)Bik>#dDXN%DR<-bWT1Lt6n85=cC0$Mm@+nNe1;6V%)A$Yub?9y#${oNem*p+BNq-=LGBO#vyL49zTS}; zcD*Bk1>fU<$~`$3a7RXRMy0Ag>XfWkF&6vhXY$vYEcySz=jE^CZ_D4v&mixIRCTm% zwbdcomYh(}{U+Siw;IjVgq16b_ZpNW2uZ+$7+2Jk(_UEIWVyS!f(yI?L9e1fa10gW z?Wec^UQPsVfS#58H$4q#LcEepE)a+LNfPfZYsOuYtWok$+Q1HBZ!sFa_B@J$qng=@G>ZCE?4hLBK{P-|80 z%d6@W?yi3%svg6$kv^I^7XxP{)J9_gS$dXn^)4%(ZYmRKfQ@Hz+Ld?=1lEvZk85}f zIyJAVm){ucA|KaRGx@1kf-_jW-pJ%36Q zj>p)K43D-Sna;a4*;ptH7NfV;jpKvGuz0=)vIO0@`C%+Iwf(s3=cr8-Gc8GFYOC8z z-l4(83W%r5e}d%gn@4U(Q;l*mm7STC5mCID?!(B`=?*!Qr0vAeXkh}1+>W1&61idd ziOJ>jVsg2hZ-K_y2l?^Razll11lX7RwY9eeEcrqka1d z{R$kqa!fB@>Mkp*S(|E%>4uIt`(#&2vvh6IIr1{9y_hpuUTYPHhIl)aF;~1c#54B4 zZTLoT?uOvQzqiRr&^zLjj6pbEL$!DpvZM(H%`5cK2tIbhhjMV`GjY_R{E2ilN{=_M z1_~KGt)}jv`5fwDpp?yNBY)Y6nu|5*cu{4oO$a$e+qz$YH?D<%QH5^M#yth*#B5 zfYy1?{VuRplhTZ~GIH|@Jj+3+Zs>t-X&K$gIW(kKz#6=2Zr~JN-#LQXhv#9~-mnL) zc%f7{$*o1I=cyepR`w%FP^Q*6emu$)@syf5KOSw0I1x>=sU6q}*iu+q4CKf3+S~uT zx}yKEF89B#OHF$nVgPY^X=z6^#%r>gdjwBXHX|Uhs?tK}17#S5i4Y#bL=RB=$sJ-c zHD|UbpvR{`y(jP(D4FK&L4gG?BjU_`@EoeI4ucAd6^N{@#Sb5Zlz3%jD-wh(4O8+o zgkC)-Z9{a@7OBD|{Kh6rTi3R1Lk50f%eMRR!1;&+&ozo`p!PQ8)U4!{t8F9rQah-fyu~p? zZ_Cj|J%m(N@^_Cl@<#O&X@{lz3|{gXRaYEig!|ZPpf#30S(<9o;a$Hrc)g=2FoSh zPF02BiyI!vBzl4x%7u3;>80;t0mVMQ2pz_<4XSX{-%qOXV|oDegubZ~?q}LCT)T;f>iz>L9*i0tzW%=r=8o5{ABO_>DzV zc*!Md$V97*oTukz{3A8tNr*yPz&8gqA^{*EV)@e8Y`KFB&z8AkXG`>2Y_?3r*%BK3 z`fLF)U5O{F={{lg^5!y6Il2&{X2U}iJ~SFG_e#L_lb7(;OvFA^S-EbD{O9Zsf~y(v zI*jv^Cc98y`zpNWbp9Jgz1lzUXV|p;39Ue5f zgZVqj2OvaM?nMAVB1xA}Rj7irL*QP71g5OEgINiU{l{jc3m{=LxqAGA1hY_lSBdW72CCfUp zTr+>asy@&4Adfc#^ABsL?-l#3|w1IdjW7SAq~Va zb|o5&|Ud3k(_+_n0GRSa9r@7qtU`)qZ{YCdjn zThHd@35*=p<=I3)6J8UGjxKMI9^JG6Z^)! zIwhsx2lyQi-zXcZ8&>*Q^<1U2b)^!IjVx2o$<9cnRJ;Pjak>q21aI@;O%@>;86r2? zqTL(7L5k`qZ880mz3&Xab>W-lM4^kGlRAJK^rhBx;}DQf>MAB`E~X<3`l;J7%EN^%Q#apkPqvm?%A| z=Ot&i@=blXO3sTgVkeCrvGuhV@f#LIR^uk{=zG|_YBxzgiFy~o16kx6YKK1?H%dD^ z6}R~tvf`*(c-|joqav(xwqS1!f7K}D$U&@mpcBs( zZX(+bqGtxE%=fj*24B*SfBuMP3#dK8p$`gNHkMIU3_##(&rx#C1^TJ#Wq*;G@pA$6 zV@`JWA+DiU@}&VVFr=eDV+_4&v?gJPD2?M==X10k-#f@d6-oc8=gsDL{fa!am8lAfkr zYMFw&(tlOOSow=M|SScZZS7t6=KB5ZQF(RK}}lfS4O3-hwx(6xewKj zd~v~`6*81Tv91GUZdC|i6u_pY@w#PaF0cekG6bCm-QHjWCfAy+UBbaeqq!y7dC=&5 z&fdapr$nr)#NgnFzsdpI+tL)ALm0ZKKw3O!%3Vxa|d6`>s z9w2`niRZO=s7R&=%X9AIp4trKz30D7*z4wI7#+~8ohHv#lI6Bw0{+}S;JO;!Y zzXl@r6bdChNyZW2_Ho;8r@-yQSpnd|Fl|7oy;=wIHo1Hs0B98Unct=`CQ|s!Ek@xW z{09KdE%mhrm!bpB(|AR#=0#K>53&$Y77Suh*c4Yn29qFHqK3e$guZMS} zU-|Vv+mZG+>pRj-SyYqLR+EWs%W58O+XPbc>(OocHMZ%3y?MAzQ%K2h0?poD*9%%> zI<&^*k8KPGjY*-6X>pVFGc{{Q*f$nv%pC~JUvJdZI4)@-Zc?nvFDYiJ>QY|SC4Msb z1Qn57mn4?7zwocLAbxpVZ{Q0vspT&1UvPo?P_wQ;6I_{P(0s~z_Um?loT(zfi?qHRnuD z3%d0E&|oyy3mLQU!Jos2QDEy)Tf#4#s9ydMvOx=?cQ^BQ1w#DicYn;^9Js_^4ig&$ zr9sd|2(m!XJIar%muoOD7=nE8xUM~-_&9yqqx=6%ALIX1^Zt1}=d9xXm;OG{Ojqjn zHP@iS&OTG9vrjhW>+@@#KG8(i?fU>9^c;YnB$8y_T1uslBMgw`<|E_jFT>*RIDAK$ z@eR6z*;@|6Om#+uhh#Ovz}(8<9l@>EoKSG9?Zp>gr29%RjI&#stm%zO3thrM@M*O4 zN!?B~r5YQ@6)qMAP`aZm)yhF+sWL{hR6C(UPX#a-Zgm6jk%SJUV+MLH<#T%M+!%=4 z3E(^It?T-loK1mHO9Osq^4Y;EnLFIZ9X8wBHcreAJKVu%lQGJdxs>qVqZ4c)y@4cj z`G5zu24Sh)z_=@dv;a3cr6Moo;w14vID`UStr(83fE*q&!HUd8k)FUfIsv`NLlb>Q zJ)~sigt(U%Id=kE#;5ofS*F>Vw#Q+a$~bhel!if>7zCv>Znq$w6t*QmUug5fiYvHn z8olx1|0POQ?YB7na=AYkNWoBZNAST+ad7fRtA9}n6yE7So~dx+waFV(Fd!2GKFw^j zDdrY~q0oM2-J5a{vAZ0#@PGOglEvK&C5zS?2a=ASqcHpaa0T}O_E3)_C2RRf^3H&~`zqPSO5-!#;i??(KkdZ1^5u3qwspF(F24N223UPQ0mt#SB7 ztf^_eP|UolDDRYA5%l??2`gM{WhUS{EYcU?9JRDeSXI z3$4M0wxGmAIS;Oq?XUd#h^T8s-8D zgA1p>GK39eS;xJ?Re2#p9)?1pNXf&(y0M-G^715-7v*<(x!6-&!;T@UbSt}}+NF|H zFsj4C4^*BcrZ4F7BYLUTts^`?A~7bwC?S@ zNX_oS0E)!b+E&Sn7TQ)xR%bT^I}}1=3b5O2lbaT$XEZjhcpD>nv!kz6!3 z)||n(PgFYVhQXddXX7y79Zyob${6NR-;K>kRQm!(FPXgl8=Q{HEWD_lSwE=d@{pfm zE)v-j)4x&}6r)jo?s^png;;O|@3jl#eb-haw`+m2{oli&;O8$zw>Va!G1@1%~!wjCOiz&w)RS9ef% zF^3OQMU?Ljhj)LMT65eM(lQo7Mu)r&ZP464L~ofKg9P$6+zqCBxY@04a)1VP=wH8} zg<*d3!|&29-r&)9aCpQQ_;I6tQr>=qO5oh&``-it^ewW6*6FhZx4IvyuZz^+HvTv{ z9;#1*>Y)?v#{_wgNBQw`2{RHr7lXxC+xL^Zu~eh z`s2{(kI={mKvV6ms((_0CP6mq;o_4~1D^;(GxptVa|vDYHf&+sA?gkKT?&Qn^pLOf zlmjFk|35)e^$;HVG^qTyAXSc6o?{>2XIB8<{w@r=hW<)^s+TOKb_5KSxGvEn6j+xw z;pCQE(YOKKNJcu+^)ih7eSg6XM{PkYUJFdqR#*@-NDzb9uF+S;r<=4@QF&QA75mNs zeM$$5*U0p^hMF4~wFgZnR2Y)3MiB>yY_sMv4DYM6_4ED&v;lj3!KUHWFLl%!2hi9ti(LyR0cp3t>F7$QhoLx3B z0OhayRr> zrR%=l0J#^<%0R+GbgDk8j#wAo2=I730^{*077Y+g=)ty8p##5}c zQmowh#NT0sD*i*lL(o`H1v&hrev>v*K|8l^Y>iA#zcLGu6Li9=ln&e#AV;`DD$r+U zuO##W)B_((?VkzR$&c`yQkfD%W$LgDuBP?TO+Oe)d;;RKg{R7)y)Xu?dCqiP9Dh%P zT7r*sqq#3vH0Lei-iWM+#-Bnd$eyatpaG59@Tv+~6qYe{k=v;)?o5Ael=`NleCkLM zRxILmD1tkTwrP50iF)FDnJJuw>P=tErMs;=rpDaXq0>K{Z!SVMK0|%}1s57AC$N!| zokaHQr7cs0f9Ru6&^;Xw`{;`_R$XmzUNclGiRhRw(&D^2?3gbVee*e^Zt8t9h+%H> z*lZjonZQ}t=D|RT`3TGjDXHAc&ge|1b&OL!V6oBr=rrU9ycI$m=@>wOe26>ASHM)dPeN0IO8Fz{vTn++vR?vlf!zrzRa>d~#iMX*& zoc{R*mHan-#&YuUNjlsrrFi~6Z@HWJnPE#!+AhfXpJ==Ct&I7rdDDg0RazK143k%y zhOg3$*0=-1{7WU8Vro`%v1ampnh0NUH|i4gBj^IbC6wo6y;8jVH@V!}YNVPy33$`i z$uiOeAnE@3Hws8JozdUl$UPe>#%q!JYJ9_4o^7%;nifdq)~4y);bwO+IeeRDscC{5 zkA`qyNpxA8EUMGmXeqwWwi0~!Hs=ps702`|}g{l7 zLBm5MqsUXMpA%9;yViCy9EEGPH3(s_lJ>G_!+PdRD;WI-zQ zb0VbB>x1hbN8tkZv)~Veeg^%gH!I74#bxZxf?rKD)YCJ)FS)>4K;gXUe4=Asx-f`8 z{n;%JnZW#Q(PullK~9U}i7k4g0*sK~tfuRP9*kp*@HOooUFVjcTx&be0MW%ULt&H9~5kjlgXNA zN0h)r+R4A}Z>CxCZia}y@179fbcn0M2u~&Y7g1?D(;h-J8*OKxEN+$pj)Cu zE{sCXI|G;atQP=x27bZ|$SLtA<*i^LI{0F;!_C3Mq2agd!*5aj&6lXViGMJY65wX4 zX$T@ZI-^dl5Nyyu8@i<)Pr3cn{5Qm~Nof=da6vM7Wx5RE2?p#7zos9yY8fwlJvWBK#5EP**q0mSE95 zqtZv7?1E|8CKs-;$5H(>o18|4rn0p_TVMDao*pyJr=gE4P+uOesn)V`Snf2p*oQW- z_6YaXKC}>d6bxb)z?hT*g{l@Z-=wwf^2uSQ_d(uggXMr<`= zY~$!MUW3Pe_P&4$^%iEiGAcUjewbtt)0OJ^p06Jo6 zgZv#)G-IxJLe@wpBwzpX`6$%8Vgc4W@E%~=wt%)b)+blBKFP*DSy@Q?1QYMz;e99k zh2XEL*gUhdvBWHXMzQxf#oq5m6^*dzX-4|$Ge}8$p>b5o9i!4gqLDuP%q)J6AahS4 z&oH*^RCr{-Ul#n`27hzmFCYGj;ICob2w|l{;z9}{X)T8=>evj>k(P3lyPTRBgz=C-0EUN$KO}h>4 zLpXb-swlmp(#JLYFK!syb|QoGj&?RYNY{T99Cd9>W+&Cg1o`K(o7{v}M3}6;pP>FF z7N?$flW|&LHw~Pl2Sz(pb?;of4TQ#XGrp_K6FPIfdAqLI6EO+5)tvYVt-?)OJ1O(9 zH~#}vZLK*F3xBB-ReI(@=pOu$gHE2hvk_8Hgb& zO+hYp#`GgC{Z3*Oa;WduW1Dq@z8XlM$T~=U%({enm(5_vG$?n|7sjC6u?HIlwa#{v zV5~M^|M>JhbF~Og6{2qPgcb)eBO;{`RdW$n`(?PC_S#oJ>G zTEXyIpAKt%$Gj;#vtWq;-Nk>_l+u_8>;9>cbw8c(+eenCL)yBJ>n*x0e0$4u@v3R7 zRlI5zQum~SAXD8;A5yaRLB6$ptjbWE9Meyt>XpyouGsN?n%>|lZgyBV#iPvB^{c2d zAfH$;4Ig-Iy>#QitMRuQQjo$Jy|5fD@kc_I%DIB_4I;ZsO86C|J)+QnHKg?2p0=l_ zt+l78?{|Il3DSz%htFDDZHujKH;t#&N|mdom zdjMbRfOecXDe#vyM7#K91ct#ofST1IE3^gqDCZQqLTfJ!!K*k4_Xr|}0*NJSEW#*i zsq%g1ExX9M*S&1GN!FN&`aOXj--z~avTem+W0kJutJJAQtvHmoS`Q-m+e8k8gbEji zsK}lf-k7J77vw{Wb4b(J4kM+(j^y64yCne}?T$~JOI&Pdv$|)6i|rQ9A}ZUF&okP6 z>Xix7a4*@Bk#l(9Lx_-BUJp4^8d}zZJy(h+B|mc6*)w*wLlBY(=ko2m0En`;4Er4? zJCF320GVwk5+I}Oz7ilixAQ_12L_h_VW)G>?IeMt+kF!#;uEkPayj-n*J!vfv9Fv+ zxHp@MdxiiOmDt(yI-KJ(Kt@Vmy7G#<|T8}MsAATe60YQ z@s0z$h6@0UBZL6PuN8~MMsSC>5ed=Pws|lx$t`1BF9vo{1PgayUtahK-Xbh@v}3=& z;-h*=K*})fuamOz<-uIX-TbLP{2t${_NeFtFW}9hY>q2K>h3SmWNQExE+lc=cat}| zB0WPZAw)QPhj_f_Vdze=r=c8>%VT$ulO-sh-mjL;=^~7Wx2?66hm}$Pgc{uRFz(Wx zBSOJv%7<~A?ji!{{53$Os6~DlH=UHcw#Qz3%H~RuHK!tR689D+iL#k^a|8}$331_7 zDqWD-@b2x)835I_wk=YMO@zXIj)}*fP6H?qxA0yttT`@#!QWnZ#_0!uz}bz9BwVmF z6g#eYU5J*iGbYMR(DD_r?T>Wc?5I8EU^^fKA{Ws{B7D0ag4ssEf^!yMum{Q`S6%tV zak%xYzh5hE<<_2au{Dc3rwjVTxD~rRJIjo&Ipi%LZC<^4x~${+X!NqRM51)_=dIuQ z+iTD9ec`a}?BtCH-3_)sT`Cb3aQlDfVJrC~L96(`<>+g4)mRg)Y=$%f*BXoI9S7vEM9Qq`+x7 zd8H5CW#YZ|AX~dpC1*!nQOT*4K#KKGRGnueb!t}~Oc&*TtEcXp)wUN!1eohHnV3vw zI=90{2H^-7*I@IRpvT&HA?MpAC^pjtky@M~{7Z_{54EDGLT9xz^T9-dnE+;#jZ0yl zi)~3%cM+y#w{yHbuiH7MUDZu?=|bG+mSLRW{Pj8&i0bC{;--eOb?fy^EX<;F35%VX zoQy(1vIe{mJ{h&@${O(+3PEv-b1u9{@MXH7B*i%~8QYeTB~t-l>6QCrjg$EZB3`%1 z9!$6K0NHzHMmfg33K;v!v8j1s4acheVqJ?-OY69Lbr+s6u1E0@iLI6sV@r2Sh~`&D zJggg)zK$fmQfDZnO$2NnyWA>g0*I@eE9oIxdh7v!%F=Ik19!&Fh|KVo4<~LB;O5x{ zp3XpJ#V|b!TQOt8>)rYS;vDem1}TGa%7>7WQNv->0e=5%pHouY2L z`u95e_ss2T7k?ep<<>e`!%IZXv0TjDSS|*71+#gPoYfBDX_9NWF;I{C1U$FFsKNLA zt1egPBpliz+!}GkZ!hfO8g}!Cms;5Ib+tX?@gnx_2XerZyL+slJ&9@4YT;Y!PMmq= zvdRSoh=u~}#bME?mXkC8$do!iwUzY`s+Bwaf>d~a)6`aoke-a4fSH+0rGRy9GM-2$ zUt<1C0;DEqPc@p#1jVgihJekQceuzgIsmN+~Q4sK14vWD9L zkCpooHf=mNWf!l$7Cl&^VMNSqgzmvFb?a-pe|+N|id}^@?>s|!%6XJm4=CGKL@s5K z$Zo*_E98HJJAYY2nu{FR2gmDpM<@nlMP%YT{dva!G?xp&aTWft*FeCpP;`y^dW*2I zbL{U##W2ZOS2kQ*E`}iVo4tj`OVRbYAXP5^KBQ7ELpc)Jb4+9++W|ERB-E*(UDQ*3f}|F33$6$=A<7U)efDlAkc0GL zf)>8ee6rPgo(r)+2gs8GwRe)8%U#&)yNs^iEZp_bP1GWH;lgYWE-*VkL~#vAVTkez zh_<&+v?T*ZyO$qliIq||0w-N<4i_!L z*TqGb(*q_-?0HgVRb3KA_Ro#DpDTe?SGjmaxp+xVfvYlv%;!_cy)_ZGZV?*@DX4m! z<8iz+en@V9fp7Sy{=KBNLt5h3>QYH%yDvb|oZ+(FN1H>$ms2Oonc)z`jxuPn-4~sH zvfV$y_b^hDqiL7Z#S9%6tM6hPbdLA3}CE zJ|VYshxCfCCKk#GmrW2=2}KUV5i^qVU5V?Z?DXDco}q$7CF}VSq&W$Xpi|5XcCd4} zrki|Kh)lT2!y#}>u=2eHXL#g%C@(>*+&;0ssTm;F{bUqL0d7*4TF$pt%H{MV=r<}U zGaG9%Qno7~_Tc68gozS%oosiDGoy)0Y9s9!5_=5#Les^jBM55<2i~$>M>0qP%p{DB zr#QwmjfKRMjx(2HPd9aEG<_!94GW4AWh* zY?~uyyO;na6EV9gsyVL85%P*XJ0b+thirZYrt5LM{*d%nq+AvyysSr}Y&RBLxPnel zAQIc6caZP;8VQzxl{;31IC4S~S4dfZQnfbiiZ?bK13GG$@Z!L{mP+ku68pxGycL?2 zs|r`GL4_Ab@K{ME;`0yhK*?rDp)}T|{1Q=gJ3EmJs`gd4_uwY?TGgp_-&B@RF5xyb z@~b#4cbL2ZYHnwSIjlXlAA(RM+0VgxEvI`IWd8wak{>0A%x3lr90%W(R(t0Bbszw z*_q#*cOgfE0av)jM3PjQ+e*lVQ$2VzX{;6{huZxyNwU89x(}C<84cZ^8IdrFl?$B7 z6690jJS(7%dpEk7kL+YV2x7(&C3dOrcu8>{!cA%zh8pgk(*i@j7Ny^}KTCFHL|djM zs^yy%vBvj1LI>wet8gK6!N@`4 z!lwM5b@MvC3xlisByvQYC@>{~!2uFiAK

    8k z!p#MJOKgu;USVf*Wvs6P)L)qX6DlC%lZaAlLzxg;ZK!zjLHHlBwauYEuWg!yD!{jh zYt!SsA^Z6Y?ow_twV~8=%&ewo$YnMMX>=k zb(q-cU-#QA)(;$krh(esnk9%(Hl&c32-)omL}YvRy1L(@nV@!6DBgtPjB5&9Sj`My zxRN-bK1$~lc)?3QoWZtkIXfDHvm;0-$-XruXYQb#=d71J0ZLY@G^Q>p`VD)Orn+SemHnvCLp4%0pFC z;1d>=a*CbmP=zgjQpzgui}7>Rh9IlNxz+)b)C+~7exKS4d$8WOJ}G${=MZ+nlOpzd zz|u@meJyh8>ox^J6=x^1JykQfLsq;BBTU5Wre^?7JuaubNfj0$zD%?*`0a;L49$uv z73>KRRLuBYDeUoSJ_nEiVeT-|eOi{BWQVQ-ea*j{DDrSmuWVqM22r3$L(T(0rzqq( z)xGFrM>@*cZqSrdTCO06&>96=9zIC*h7r9lBT>3jON1k_y0}Nf z2#Qo@{*$)CA1eTB@)`r^m&i$`Kl_Y=--q*wx%=VsGY- zXYoZKS1@w#q3bS`5#wGbuXreidx5;-B^lh~mNZ*gRVDE+gA;N6)d0lCs&Be;CayM!wJa|M?Zyi1tUf2H8Ek9P@I`mYsS zUgTXAO8*Ul%frN_DndD5FBIg~Oi~b(w?dVl!W}2@;C1C$RFgQkg$c6l6Um;DL^v-x zSgGxx3*2q3qNV`iwO=ILDT%QD;ApkIs{kC5y4alI;#1-UAA7M} zc>oe9WfD1xxl2*b7w{NQ0r?{#7fd$HSD;dTe#~uH;u&*sy~*I@s}8fPPQmo1wX2Re zsC;tE646Dj3bCs{u-D?PTC#@qM7{t|zoBMmqFTu@5wRY#&Q{Bb*pNAGW?e1276(Lb4_CH2>^>gbic<$bYVl0F!6*U{hC zk)1@yfKfg&>Qhy2Rk40RcJ>ukm+))ja*BJ@}@~3Sb}K z49g!4_gXNog|v1gP+SaDsfW9mhCPSvv9(Ju6Ltp?5jog~WBoD)ID!G37le}p`3143 z%SA|wNbQ9e?1f$2><&D~#JQQU_Pq1VD#9%Vc*#3Z1aRsh^nw*oD!KJmKI_7SUuE0( z1F*MBm6v4Xlpnc-R*Nck^!!a%k%GSN9(Ek}lEI^g{Rso^5%4#*<2DiIGDd_a`2Z4) zuFb()CCW<{iKERacI?-nybT0cw#UsBW#S*e+^Yk&9&fz7>9B*nK=v%891i+bs~|ky z$t4s4FVv1bO_ZB+sRq0%)}I~5MUcYaikgTHbUEKr{w04ewOHl93zLMdCg*(57<=~2~{x<|Nvj}Y5Ntlkdm|`ZOEuq-tx-3bZV?=ZI$cUzq zbzjxj9TIIH>73!~dUM?&v6HLQNwzwN_xjXLslzh`Y#`a~a}GmjOru&T%CDWs_Ts)V z*(_%#axazo@-^7V5)^*6tK?V8Zk=u#9h&DI7Bi}I}x6c@qd%**gCwJ8G z9=$H>d^nZ)1+s>Z$@w>eoFmtu@??aRyu`Q8JLmx*^#F3K5Kzqf1Oq3sav+S4(!SA) z`bP&0xodni za^>tfHlbX!2N#JNK-54Cj0qEz;k5f_yU%6#9>_#zav-x-z9khUqua>Ul+qOCVfJUB z4FNgNY83&Al^3S`WXo*4TkFstgz!6J&kJ*of?3&BdjfC*5wZH!wYkeN9CNV!0?W`} z@O)B2g5>p0e5d0H*pt<8XG!WzuP4QNXTDlBML{lI+Eq!Be7V~#WpOOje7Nr$Rl zN=bpTvz+s-#M-be2^bpB_@{J^67y;fFxHQJEY6`m*AxU1rAdcm+ZbqHKJr=TNBmkD zi7mOdJP1p1(s4@prM(b{Ocx&ZJ^c>Sf?HDfGn$w1j3%s_njo~&X*a7PA5o#_!Ep_x&vHUR z^Cb_(4s_aaff=FY)DXUaTdX7p^Y=H?2Rx+g*U9}B{CDM(1-~N?2sZ^;_Va6gvf$4m zCoRMN@T8@i=3J4FTX#rv9`8qUwtHyKi8^1L_56kbP~JU#XwH*Bb9QX-jeH{?*|`)s zu$giocE=z&nIq5=)x4ru=MAn(DY&C^j+^oXr1m@EVj$5uf!nsh&4T|E^rvt*#CdIj zh7h2}pWQ+U!yN%llE8(@On5^J6XrhQamulOmOsW=*V-+TaM;yE#-rvJ-s(o*S^?A`&N(12f@VaTk#(UcxEX zyP=G7csS*fn-lIsK?Mn?y@MBBCnrz8u!r&S+0o#YAb61k+w5U{17JzdGp{;oyJn%9 z${w!xs&Jxhb57zUW?6IG+pc(SaRN@a-K*FM02Dh)`P#!eZzig%CHQ%MadX_B#7XQ0 zBCC9ZwY*$XARI!y=MG+mq>agQE+a)nRU^vZYQRXc!q7Ugr#90Z)aDn-NHdb|4&F0(d2 zpSxRdFW?jhg>L4S`>I;Y@A|8|Q45`)s%v{#%9T$i9K3RL>VXw7Uxo`>gKRLGxyK9L zy9fnb+yYdKQP_>=vwOJd3;6Tdo zvOD#a)w>kPH<=!Mt|^e25!}K|we1(#+C@pJ6>lCp^ zV-F^EFhO`NyvriK@~NYB4W6|?QC4YQ?7x(s6E>kqk# zj5*)|MIJuf#x-sM2tn&{ANusw6{Jcy3fM^Q{NC=9+cH-&(JgU3_U~7&@=Q5JwwmX^S|R+ z^puF24JPy{5&70XFQOPQ+rZopCg52SRRn$(Fk8Shfq4SVyI{_M=>j8u8sdYA1QQQN z1Ew5I9hkeoJO<`fFbBY#0doONz%wFh5}4Uw7J^v0pcfH?-{TQEO?=>a2sPDF))i3GC<%xW+U znA^ZS31$zNkHCBZ<~*2gFu?$e@nE9Cq=3nJo`)9@|8=9mj6emS6!QLkpEqBi;tS86 zcohi59_4kCI z-`w@t6uIltu@6H=pI`si^l|V0b4#+m@EYre`sHV?z3z_f89(d^{bJp)(;YEM!C3(j zYxf<0w&>1#&((Z)U_nLm$IG5F=68Kh-}Jon_3CMJ!k>6`KleE^dFfk@rpoJIE6Mb` zJVH0WVDGlpi4ULczJH|Q)7$R(+oW4MKgx^z^41;p;qQFAs4Vq?DA|j-Z;Z_eD*re- z{vQeNr0jgS{?aGEZT>p(=D*E#-4b_OTKcnRL#M zlE_aZUang6SXPDO=rl|BW&O6Y`^TPmeC-E?^sc*%m6@8~|F!qCbz?FL{@MKZhC5C@ zL*4r3@!%`xR{HOGMHO&l_N3bn-5?XUzVMcxXmr!Yq&r8ZE-yXv{a=4N{LzJ1zqQ`? zEOYI5&&_ZA>X!vvIQyk(@x}2sPMrCk-MqVK#M5DKPw2_Ne(C;WHHrsMw_L6MaCO(@ z&!3Fl9@swbrBU)#GwRN-->_oqQ`fwNIE5k)1mBnJVBq?&s3|0mFnaqqrr>N2y4SGeYcG;YHiV}m74yGs}T$YLVTRA^E z(IVsO=~Ds`{lQ~qQV{Q+X0E6J7feMFnYPU14tb>xk{uP*=TRsWX{wxDMY?KH-eUOZ z>yL4Y4C^atONGuvo0uepg)XrwHtG20nJ4(`X|E7PhEjux@r3dC2w_VsG@Yc-6*Gn^ zdVR5(#h~D;FwvztbW=nr^kx>?FbYHJh2(Asrlwhw6p;vdXqTCg82L7_Mk9Raj7D>D zpTb24ll-7zDh$wRAXBD{w$PB91(Q&)CZ8M#{Dd)4LX%ELlJRtS^zYgxl3R)}Z$+A= zrjjvd8;TUus;MLexJAcQgGFIWq^p)jWtmFMNs3gJHY#R*d{o+^wAoZ2_jxf1f;$1W zYFRpIjjW8UwA5S`aihHaRLjzGR%voo=?YCwRz8GKELE-ILwUkr2kqx8q_Ie~IBQw| z9K8Gn$-yU$Kg^}qpP#Ryw~OR*Fx)L7`3GQJfBwPCJ#UDcAHN_WF-f@)nYGC0q(ovr ziGM(#G$?pj$nX&|`N&bDL&uCA7j_LFYy5=piIXNPrd&HUV%qc>ku$HGH9Km~+~|2R zvBdjXD8qIzMliWx7J})61B-N4IzCRoe}bPk%B$2_t(yR^DT)o1(3d=6OxTTdz1}eR zp|b%((x}vKbW6p}_JEhtSj@#y1gUuNb|6v>?)QM+_mE(b*z=BuA%r|DHx^qH=HmZ( zF^USng9_G4E3VZnQbi#)i^@rh!wz;W!Eb%)S()HF74-9mBz*#CggIa-%mEr0oQ7iZ zN~z6y*2r1`M+EBq( zC`@cck=OjC(CPKi$We;oGM%ZEChq2nN&rt3V*o5%Y&Mk`N?8k!sx9=5EY4?MuDlNExx^HxOWnKqitn@lsQ3<02u$a(QIaUS8} z4sEGWRSVe*USu9Nlo*P!-TAo_yynlOw0zrS(tvXn>1Gqgh@0sfJ_ia3!~yuk_DieR zFQ%VgyqCDh^ z+nqJ(Y3Oh`lC6aBh=N%H`=;4sqKgUa^|Ve;Ew3c+K63-6Z!(kSbXP@4jH29~*qtGU zb?1#VRgq5b9nm{KqZtS+OqZY=uXtA4N?O?c4Z!mGuFw^G-YYF;#$0SRDk>n7u9Wu9 zA6i^*Ez@nJiOS<_1x;Wx&AZ>i+=}!>lp>Pldl62*WIYI-4yHgp4*zY|)1FVtU^K#% zZUn4o0qTPx<@e;LC;>{1r{l2xNOf8GVnaJX4+a1L#5^S~21t%HMDl%F)7)oP3p3L*3#i0qXptl>~n4OOJ} zrbYVWdT7G+Fmy_N@>pL*1`H`*zkn1axO)X8G@V6NZD2HfGBCESP#l_`qc<7}?$fd+ zwb_)*(gn0Ww~WoO7_>SZ^GkH547y0Iv!qs9)Vi7_tZ4~rOl3>8bmj75W|_Gvoi4`s zxvODp0J()Ig>Pr56Et*g_HwP3cNtFT-K=Gcy*{b*z3SDKT z5n+j46^Zx?9kjm=+!=2EG1klp));A+ zdlA(!KpK)5Ua8Npx`&#Ap>-8xeysrDKpOB`LBh=8OUsupc6e}|I5n!ZS=kEG zMN2H^3Vwcu37f7cGS(>ctOfg#i6=oxC>XYk0Y(W=eFyXFDd=w4c_5~uh%JS0MU9!Y zc$amKB8#j=Dq!qFT{qH@I#$O*TUjGRkULPTm>EC{%M>LbdqB!_i;b3BcAC-qZ(FUbKLC`gY`ztM4QZPX_>-WsVk-lxPU%}f$R-1Z+Ok? z120eAX}_b(MT+ zG2DVd>bS{Z?$d6)@!|)JXJzz*#G8-tDseebWw0EN z!N$Jf2ZoCfNv~sc5PUe_mffO3YmAO1P5#Q zV7RoTA}JHaQbzcZsh8r{z5MtMz&{c48~p;P0I^)6QmOp$nIBDQNMJ>RW@Vt1S`Zyw zpb4ZXg#u4gQqm1&8{na+>dI<(q!5A%q@+@?r0~N}s`^ur{0NxhVk_!8q4IJwq7npq zUVOHSxGl>{Tb{0>R3=258iWy<>zAr>mZ`F1W9Fo1XOnq^_Vv#&S~FmNLt9HT`8p#@ z-WPklr{c06<7Rn~K^n~H&_#?|o9v&xQyTIS2>oj@(MHJAJ!v9*>gu-D)z<-l z{I=C?ySXmZ-ya~<*x2X~Yt-mEP2F~=ZRCsuO+g*hAAqFM;OPlPWZm{UWZD9l%F4>5 z(!lD<%1xD(KJX!Hl7UvG1FuJWm$uj6kdnG6EnStdI5TU>(ropz<(d^a+T6VSf|aXQ zuUT8TZv6&bQ8CbxrDcZljm8R-x$;Jfm0_zkRoC3~m(8_XwvsXc&;+`n08p}d6VkLu z4}yChtfiJ0l>@l4dPhzwA151@52=I`qcK;qmBfwz=98h+JOQ@IT%AhgX;nGBtvU24 z`u!q3KgFN;Wx|LZ?AP!IKi?4bUO&;F{CUT}+3P3%lRtM{#ZU+MgElSupY8#o-rt{n ze0qSW_b2|7zuq43pZ@+`{qYwHKkqMZzdv1Nq29jVf4088_3rCJE;FI(>Tk9+G;X_P zyS>SAYx8Zl-*M+%ci(gGeSf|Gfd~Kg(BB_^)Tf`FKJ)n( zUv`}R>g#jgeES{O`MvY}zkc}f!o{C1b^Uz#O7}0n{?_yRRo8z!0S!FC{HY1(|91WV z*Tetc5dZ`G|33l$%*>>UiXmkX+XRhOatR%T#Q3$aok?h{#4rXWy|w&$@L+kAL^egU8R_HMsxN zdj|J^|MkKBKY3$t|G&LCxPSONzWyKd@y~4SmGcON_kq%Ruyt@ay|r)Pa_l@r$zMI> z>;Gz>_<^7J`k(6K-*|fPdhY)>{*Qd&>)+D19k2TO-|FQ*4yNA;V$q=WkChDWUlTC6 zf7*z_{X^t~`yU%E8npfs$B71o@1Zb}r|nOAz4uM$?1X{S37aUA&z?B2|2pt1>f`U- zAKNF3*l}MhZ8a(~unS-Z)?NVR= z1AY9t>|Qyo$=SW_)Hk04+QH#;=PHrB>&aeREqzKvrPPb4SO3}TmW#4?bt39rFSnPU zhgDpiXh>%7e@JGpKpV5(%~5Kkh}cJJG1-GnGn*K?nn|UoM|t-gn(#CQcj`Xgbun$q z(V6t-3ZPli^HVih?$mA+2|O4Tzh@>FXVSV#p6NA~yb}f)W%A22;m(E4q+P ze>#)on2H*jy|=9nVF+!F709<-Lj|2`g_6+tMty}o__o??qP=)gKxv^*8f&r8CMK8g zoU`-*4dQC9sDO;J4JOE{6J7H8txi>SDz#J8%lE=^18(rkb#t9P`)G^2Qg=HhinFZg zbP-!xN?SBgHSnVD@hdRs>9jJPCD*J*p8290hNkL)hBVSlKTz5H^7-8W(nR&{FM(qj zO5m7ITN#VFh8jh_(x76v8Tq(h0q#m7T&TSST8y3tCPmfu!WaEfYzrV9fo;qO5g45% z7>+=;rjn+1^Qq{d1eFNbR4U(3YovkRjib_V=Tu0Z6?^KHYj#(bdQF@I5GTcS5D9i+YjyT(_(+f;=fW%bsfSh3JTE4%KjgvGD&;wrI08*&k4^)PcwU%N1 z7O^EI(2;OU7ei?fY}D_B|A}$$M%U#kHNK~dv(wbNN-cvsgir>R_jdtBU8bNarnImjYzTYq7rid6wF{ zZfn3Ck^}{3r?KPX*xq3>8ELQ^TkbYB)85lEI8M zk{SgC8BOV`8Kad{y_9BfC&^rb>(TXAtI;ijV4^pr%!?76m}(-6nG)Cgjs6Mzr`}+# zH0o;Blg&bRm=eGO?f~9#Awyo8L2q(<6DK0JvfiNg2}h)vyj=ug7O!v~F_HCF23F)& zx4XHhd_8WxrOb=(b*P{#%$6G7JtmrW$2r7Z5*P<`sTq(4<0&sMUglk0UJQd&!X1dn zjv%-Ii5J7HUR+T*#PS|`hMu8k=oxy3o}p*x8G44Ep=anBdj7wA{DOxOyY4?sC;Dd5 zUD5SD;vni`+bu08x(fD14-W`(pH}wwr=sKL#Y9I3_~l80N6*w%=Voga8jBev78U7c zeQAxt`-D&`%aoa6WnL3KY25JWc=#=tH!m(OHfHs>;jyvvqGMu(&*<6n#zu$osSfu^ zb>66GIlB9e4w@IUU`{mr=0&gdE|kch@>@zpXNps)qsr*@Pl*;KZ>zAponl(inzgln z-4PZ4O>44DG5+Y(ieH&y*H3-1vggtAFV3fKZ@8K}W~1)Cu|<3CPQAE1*)``av7d+% z^{KF5eLWSdy57;U`seq)%Q81T^LF%>(f(VHJv=(@;}c6y>^}C&sIgtEUwG}tH(&Yr zzWb(jb+Hlp2cpfb--lKo>TJwdIO(rPm)CtVHpt|+*8l0ltbE+-*Svbyud}{6_>bX= zmbuOE9lkTYcxg<|8_b@k$4>tEsk^?o{obFhSmS0)Pu>37<_oTejvttKo}y5PAKoep z?UO7PQU6_ag>>$$dG}wp&42QfGex_)Cy&k3zU^;Y@}uU<=bkzkv?VEU%z@v>zR_~- z{-de~Hn2uLZEv46|FI84{Sy+$jNc>kzfU9*PoX&HCr^HP>W-%uPI+81ul)FwQ`7EW zz9;hTS$jLz@7+mns)ZomTsAv3?5g4mPft0V*#e}u0g6*#=N>~{zd?RLrd&k2~<|qxBouGgq%JL5f!I$7WLk9 z?sU$%11b?FBqoMa35kYvyoV&1=^D-j)uv z_TSGsc9b=LxXo61m$Lb83XGN{r3c9}ovv05D&xoCCOJ_S?)OfL8&-?f=|{TH_K6FfW&E0b~PintlN5 zbp`|hqAap|%z3}(zCSzvY0Lk&>pyMz|ED;f;C|aYyTkOQoVj*~>9c8|O&@lEHrFdo zu{%s(+ydH+uVm2AgN^`g##`Oj&bJtpv|wI6@xY%DF^ftXmirMDnCnn_V3TP ze{?^(%kQL`B~QkkDXaR~9e)PE(|c=L+ctq|S8ICy6Vso-^yBB2Wxt>)C#GjV zF+Jyr>69m?t697sXYuI&Q8YYNs+Ko@s{B2?>*+V;S1o_~P2+!`2>W;Ufxm|<_-4ZS zkc+F^8X%IeNnE;Weo?L2ov|Vm@B%ZK4qK{X7`Nh=c zSpT+O^^}IcKc_XfePMCcI>9ULjzB;Fzz^UHPyq^n1GEJ+2Y3M705-tw6?R7{;2PjE zpcqgHI1R`HDNb>UQ=H-yr#QtaPH~D;{^ftK*lZlA zMciR7hda+*<1nxD0eoNnC@Mr{$Q@4;J{7hL-wX5UV8d2zkDTWfL1S=s*UuB>YrbH-_N|dr+IieIPca)mMi*zJiNhldXCXt0?HTi*@ zB&W#*QcCL4fpiuV^;-D-u}SnH>~t82z+<7*?!JU%qme6s!?cZDxN z*Tjl>s4UVKR$C4L}I7w3p8#C76V;$HEXcv3to7K=ATSE-?-OMcQiDOavZ zUMEo`n#7Pe5>LJ$`-x27q#x1+)I}Srjn~#{*R@C5COyM!YjD-IDM6X9Od}h}4t7{= zs^w~J^q=*I=JK$rYj5@VP&{1d54IYkOjc$q=EW@YYENGwOc)`&FWeEfilNdJX}Xjo zB};RqR7p_Qk!duRwNXWtsa@1J)LgYx{Z)0<>T0ptXL`EsV{nFGC`ODi)mUsE3kIze zR86jctIyX$3R00T@)`s>8^4I#;V>M5BXJat z#xXb!?3jqB;OY2F;h1n$@D^K$7_1j64g>prBrX)w#BJgaV7p@RwrH1B$rmgaAO%Xn zQi#-78YqQH5mKZSB}GdyQk)boB|^_uO1q^D>5x<){Vd&++~fvwYgv^2Z@v|nx*EbdFpAkP|Y#lVwPNWEis>O zic|3=yhA7xlEh?ju9zzJmFLN^%2Fkk>>_t)E!LWavtg{3>QFsYFV$OZt|o&uy|tD) z)r0k+dW4Z`*jCtVS+GA3t^=3CFXBzx1)x9_j6zUf~&U6t)n(pW7Q<}1X!V1 zjnz`Lm0E@tuD`2~)BmAYH?Z-FvCY_R)6JFDH)9%wGQhu&0gr5k#8eULs(pR9kZr|8S|4f;tv zU%v($1Ua3fRh^WA^Z{k0nbo2+9+HT`iLXMc!<-r5ToCShs5Jz zuK0#DL>ec3D4mdNDNPg%HXf!-fH<13EKyd0b+eT-N zXcBl(J+%?o?2vKBjFYUYI2p%H;bwB5ap~MK?k@Knk9mLI3pc~rxQ4(4e<4tKO)%s0 zs&E@v`QM@MJ6B|k|O1-60`GLGx`BXWtTvh6l z`lK;w1AN$ryg}XuK8XiToDL(NP0o>PJBMr(M?WYt8gc`U(BKep$bv zSLoFYccY%sz%wicr+Q!Knu_^v>I(dJJ7f2r%Laz16Nc)1T%=-#d4v%nd||U|B2ioJt=04 zg|HE9FY{A-0B6OhuBAy0l=vrfhRB0R%;ia zCk`Fyq53=EJ@fQ$^fP*~ZVr}tjXs+Dfcpmg+s!iAVRnN3#ERGzR>mH%XVjW%J&3E8 zYG>eCUo}|mqYhBRA$trFUztfcaw+8QSx-)^$eL)dMj@z^MH?wmAlFV#huh8O-W0l z5PuRxdXr&LExZrWF`3LD$z(oRM%I$g$tJRs93YwGILRdiq==M2%-kk6>PcJB)|96b z?Lz$_V#4X$G?vb#i|E%7FGVzzz02mZh3reH8SKFHt<;y*li+h*v^W^K<=O`AhUNoa z)=4UlCCp7V)PCwA zwM6ZtC2JcY195scy^kKP$LWds0?6x`z?TK!_gD0Cy_peU^fSg9=1m!po@_c7!F|cy zI85@m*#xck=r;S3R*s%H9O`5UQ<}lZb>&p$~!l0#*Toe}#8D|fd!5!o>xhzfs zI}YRr^O1ZMAI;C^ckw%*3*YVd>R^f~Z%MfHO*>#q(0zHOr|(Z19p z&0|E{ZEZmv7KVVtScgGjA43wpZRK)~fLyfkC ztbsax3)F=fz%4m&Zc<#yD-}?M)q-5?O`_<5IUVDK^B?IQX!A5U~3?g zY+$x5du44E$%XL;`8?=XIrPlux0*YkvTBS$aVQZ@fxadI>(2!aUV>JjHPG`7VDBwx zJKBZzq71M@Cdz`?%|oZ*jI0=}at-qAZB!1PZ^N$G4cEdB>;W0i8*0#&U@-;GcKpC@ zfzY!M=-a@`3O*V;Pj;Q+6sI`FDNb>UQ=H-yr#QtaPH~D;{{1AlM>SWE%1<3}pPd$- zT;gtXwFSKt(xqefSN%Ib{Ly>_D7Z(}_mEuvaAWiJi@$9g)aBLg{x9_o=@jIDD=71D zV2_TSj@RzdvHj7^W1C;&a&Y0rQJr21^64IQe9Y&r?x{aF%xIk2F4A>DNxSl)ts7iy z5bC*LO^IiRxRO>^hus`?ul3N9EA&!J&jth9wS3*9!KKnsWuxqsZEF(K`D62OhyMR# z+swzO!sAAdj_NcxDtz?lPx{r24>@^!If+f#y>rLd;hQG5a`o&Ikm%}`{@n{OUXfV9$YC8*g5^?;jU5wRh&7 zYPiDj=7OTyCFQegjr_56@IUsn+Fx+`q2JWyqwdeFWn8%PM#Hlg?p#6@lL{WC6pbHY zaNl)4!c|WgGG)-M@@{zU-jNaIUo`Y6Z_+!V^ZsUiFB&%sd!mYk1+!AGcRqbT&uw|? zzJ2o_%qw`bps4qVM?a)YSWtvVJPMyOVNp1bAAEfMS9#>UX7kI)ggxB;VXmm=Y@@6H zjP1vLH>CPc9Za#;k*p*%qucYN7Y@lRocO}v)>o$Wt2k8Bv(AK3L$-MFvvP}X9cVw; zUJw)bLoa{tBOQhhEuH;^GPU5_tQs}PF8@jm&Di}O`j6V)0<5Z~iyJ?5cT0D7cXxM4 zN_WE{6=@`-yE`SML1_t*I&_BuhgOgf@Q-@$Yh1nm_x+ylJ3Q-Q@3q&=>{+wcZ>^bq z_L*4Tg5?OT9jRj>&Z<|DR`Baow^?KDO7FBaFU*tb^ad~qN;4w8Goq&~nUd?21_(Ib zB)Q`9!;DyFF>ewPY!B}|J%J?H9^x~RDUC+5=ujI7MOEy&6B+&ZzCv zyT*UqYw8QGlPRGr!g*F>A)=_E#f1MP-ou1WENexMVgb_-^TBNT&2pWdEWuuBm+_pe zy*A=wqA6zeS_Iv)%_2!U7PKyLO5=((1qYoq_8sjtgdOQYMFN2xWy%^27j9##z7ZV5 zU=hk1?eVxhY=``Q{4T4IEKcGOQ>L@#T4)&5ZZk?)90zHN(o`p}1<_ZKju z6J)|BQM#EC!?+AmMR7GPj;b)R@AdO({Zkdq(oW2sWxS9mY)= zrpcB}>iJo?+j70rW$S^itT5-p&t2EP*@$`WKqhU<>J<-Bj`bdFyeLOANktsLOdKOq zpwiA`?i?Ai*?rg|jNK64lX*>?4`{#5d(6Hf!?2f8YD$EK=(JInUuCb;`Z#mmY*{YM zup6XqEl|aQ0fu*ZzO|P*Ei0Khcu$ajKt#Hm@q{6&h`z&?f(X7z0~KZ%yW`$7^<#sS zv|S3-Fat^EjtE=_%LjqORbhFewOj=U@y6?Jt$T#KeEJ7_$G$MmU5`p<`3r5qP#@@+~o7bul1BsnAkG=LaTm<(uk5O-zhMWW; z!*`*rl1sMs|aY7wAX1Lb5S@ll%#UBswm5i%pqm4rqtP zAzsn~f|O={)h{`BxYFSo)4^D)CW7 zb?H{zf-Y^tO@&2F-_AqU)5camBEikz~`tX4- z;$ox?L!-BJfvca;gV{)`yfny(+#NL|KI=F8^VIO6Ud-Lf&+~X5%=XJ*y1K#lXtZY> zw{@kEV~prmBceg?_vf=UlWWTt?6xPlye!VP3++sroVTc7G}_9wsb$=WTf{OF8jW;& z1i3_l<_U`sO}jv#e|i&EqUH8dDq8J1sOACc-jXK`n(AEpLgB66IEiL_Dr#3vFD7#Y zZGqWGY2By!W)ad1aNa|RAwyooZ5~EpR+XX{&T&$bC(M=}ROScw%F?+)=~VcAg9e5MW0!cl8mkoRV)D-{dIuPBIT8BPblNZXb^ zggTfZQDS)0{hS}$S=W|**s{mHu_DD6p0h-Q8@0Lob#;D|6et&2*i-gXG7^nrw&3X2o`Y;{k!PUx=MvqN@(P!R;W9oN%;qRH{0qnB z-Db+uh7TMkIiG`aLekB+AFs;<6(SSrZm369Xx!@VzL?Xrr+wbww`|N>=n)_-DIL>3 zvAm{DfDOEtlb@&#ceqf&x=F0_dT*v$cY<5Eg?;^q@55oyC<~pwG=BQyr4nF74QYv| z;kX@$kksh2Q121^{Rbzew8~N!$ko&Gb6T55!J{xkBZDp+{ED5Po*`rTNXs4^o<>~2 zA~$h`%L<{DD{z!m?#S}^jQHAVcqvH>O*?`|#;bLNGzLc4-|ybZ zmE1;Ehq7g2Y1{C&CvTMt?*-Vdvb;(^&G`Oyr5kIxO@-4bvo}^9UH^Vfby=0yCz~Ma z$XD9k+9?bOW9=2fhYK<$(wdtZc5vJ8HSANlv~@q(fh(4*_4MbLc0Pjd)7q{KASR~? zC&`WH8HrztRI2P4`08?9@JU>7fYnQ~8%=w^!!eKT0QGeX8-X+?2e0xjhmB2kMIY0A4P)5yz>m7_B(F%1oB% ze!rUVB(=&}Fh95Cwj=;Iq7e)1gRqB%Jvh*0+A&Oe{sAGis-~z=%Uw3Wq~$^m=O!S3 zMIa(K90PXyc?xPHv8PU&9eerMj%!VrQ^T{2jmn^+ke$EFO9^olxSyAy;?K~Qv?eS_YJrkiDOwrIpKcz~o zr%yTkK~0&4Wh`_cePXb|oS(l#W;qQexwjthsn3>$WUZhSlew%03(iLZhuABoGn)b~OrDjusO^`l1;){3(@wB2ehie~dQLB9E!A|(|Y_^>C zT|3@~3!udIZmAGsxdwbVF%j63Q280+JS9R!!VJIeA}1{j?#0<8TADfSk|gM z-ueV;?p=+%A7Tc|Q@a8WlM zpnR;Bj`tihJRhx|*fxQZI9tXe;Q>GD6#JlOT6M{G*T(DGj8=6j*^;e6hK#^^IB#WE zhUTsEC{?n@kxJLBna*E=BjJY#3c{xMQCipW=S( zE(_4>Co0sAwXG;4VY|;+T|$oONHFu-F})1o@~j zt*^3!7w3>z<9W=_yTz?oG}0UN`uMc_HkF7UhQ;dZd{86Cv7c$G5+^1Xf4}dSpQEcH zHzcT<+?-I3r3sQ}XiO;IE-g#c2A^)BcCwLAGs}6xY3Eh@y|m#+)y$|4gP`-WA`MTl z!j(GV8cjDJ@qyup3!ZdH7XcKHEpDZnd6FjayE)cd%80&Rf*=TB8;M^;!YxRu#BN2i z!jggi1wB>BUmH*3? zb-#Vx@OF+aq%!LgG}Nqr)xEqwSd8*fqK5e;X^PAFsk5(my&Z@JH$iwhMHGNnxms+^ ztaK!N6F4D?ujRFEV8?)SZj}zx+)aNtk#bm#!ZnNTmjFmWx4(B{l`5cZaP5*aC4byN-c`?HChp>&Oyt8O zDb?g2Ct&obSEa%byy0XJ6~AJ~PS$Ik*Ea+MkfeI9Zo>Gj<5K4+6<(OMu_Zb#8Y z&_g~}d%mP-{JgSLJSK;I1JQDQDb8nDh#4@->xKawH^qB*fO{ z?)ZImU!P^cTO!LIE{XI((}=Ncj`(T`{}FyNkxz=lAq69P79*D$1pM1igP=#=JHhL} zwUX@W7VbF{g57^KW!Ip=Z1YYLbBL(0yFSP)eTQ2DV{8KYIPqPahPrW&qpPD;q`Gq|K$r)?g3VSpV z7+DZX&ttS!s-Mjq$v>=&(P&Ye>IhE=JAJLeee@Rdf=st6CfM70J>&q?2_Fr8JHHcV zXb1@dWS?`PkCsM@E`97m!V*5DheWLhH&sVswNAa(1*;cfT-HNV){Ud4Ds2u^11VY) zgkBRGGY5IU7RRZFhk=iLE|_qQ3MUbd4f&ZFUdI#l3mlvjRTnJ(sLXXPr*5VWOr+y` zSs}9<*h^7wfx-f=ggP6uE(9ylC_p5h_39Q}=iW1*px1`i{(zwEw9#|0Q$}a1)nV_a zU1vCvN1t~6;7NO|U3hc4gfD~+`%~-SR`b%mkJbIrNPAZ|HZSn}AwNgK9lHxrO&-@i zJ&}(OR*e+e#|piO#t$EhLf|7CJ|^r5deu)MM4qzt;Q{{(vW^R*^;btvbcCqejy>bM zNFy1KUp*jvLG9Gr+<$X{b%Oqa5_R2g13QpxrN<<4b=|oL`C4qaUsQqTx`B&WGzDC? z8uBnvXG64Tx5W-6VX*PR0TGBc%4z{4}~7eWjFJhN$At5w@_{#bFZcQ*7d|Ig~KmkyY4N z)yQ%2QzDR1Na_a1>2L{WBAy^S7EGe!XoppncZwT2w5S4+1^eB4Nz@&8FwVkcrGwWW z9iuXa!|n7JcXohxmZhhOOHhWw=%{UwOB^Ruf8!c(tBeHJ}&T`BZxQ*=jD zOmaTeDq3ELM{W}cDi}eCbr?b(+;&*55fRW1xXUgvEs#!_y4_x`+(fvu-JBb+eB@2t z-hDA1qiyLmy3J1sCF;)W;;(V7QwyXSyDGyf0Oxg!Q{2q z2>LU3zr8$C+T4-2PJ`v^D}5HDURFC-+SXGRw_V|_$xnGwLV$+8U^bI|s#FmrmSvdK zh~=%x&aKG+mzO|juc_(}>?im{7^+InkP&hv{yro9-pRr zKU>~}htpNM-4|U_aeW!EJ}1&*&T7GaprSoRQ?OL5d8k9rQm|C0d8kd_5aE`q(rQv1 zO}fzn_dIJsrDm!lrM?-{ZE$5<40lYj1PJlIzuBzn0yP?sRb8hO(sHBS;?ucl&V`5} zl`&K*AIwM}+OFG~09PchSt0NV6>+G@GEHgDq<}c=Ti|N+)%Xz^L6 z5!Xg1(vY?I?d8CGwpmNemM3uS;rz9a8YKN8Z8tRC)>gYD#-iCbI5Q4P^&y}>!+cp_ z-Atkgr^5jN#Hhb5uzvd`D3)IqSmC}duxcr3+Od9Lg=PLl2|Tf}^7D7^k5GzII_o)H0+(H<-+tYO%u~9P`;k z8@RenNR0`*Fw|+zBZ$oGPZhim7_(NV9=PFyEA3Bs-^+)oyy;xGFVoog{H|>5T;`>c_)1!;eaP4!l6mmE-X?bL+mTw!%Wx<0VRL#R3w8o*a(i7%SVs8=* zJhwPJ=4s8C%T~}Q`=pUePu}!VM`yG|GtvyOIX!^XRW?jqp(;^Q8gWMT!Q#Zs?DxcS zZ!vp7!mDiTKU_f8T;xsYt+bT9BD}-`5rpLL3FXj=V3+c+&;g~%k#p6|-~3e#kLHV(Y{DTPB#u{y*D)WZeb^Rb}#$$9bmD#zEcx${t9es!!bdv$r3IeEB$^RUnvZ&R#U zVz}cY2(x>H4#6jVR?gD}Rkdpu zn0|$PrVn-pZI`pEJySC&dLb2%?wfptcy{kh8*C4nEq7L1Eix{BAsvu;g?eTL_5%@u z&dW*FM2iBYZqj@cuMo~O!PcO$auYRY^_N9~(l;4bC};PQ+8M-|2{n{Ln0QQqjHY>+d08EZ&rXOtC__%U zAgXLgi(OknIln}sSc^bgMY*s<69lKX#P8m4`r7i zNIUYz2m>YN{1lCmG8sGmX(?_^#~(W3F_Y%BJIC6>wgfR z*4DB+8<(PRL9y=A6U*lc#hqS-b>dl38sROC1;J_K-49CCwI1$vX|}DT-(~9!EbZOb zny$FE<0`2kbz4ADVs)_@Jl#z{#RV1d52Z7yO;xV@0JsZZm_85Y%<`1V+*N&}!Pb?m ze$LDM*7nnV?U0UW0a9I7{HAN){HaD@&u)|qWgQ>mkmdYBy}vRA zCVZJZXv}#*Xr=Vs!Ul$&^$xu%PFv5+OxasaYq=1RdBy>_#M)xmKQHa=lRm9_U-~XiZFSgk9Rqhfr!r8L~glgBcTtb=wFTJy+!DifAaRQdCU1HJ|h? zjJmjF1}=mZ;!T4~Rn!s*%yIc1IvUUWMe>sxct1-XJ)hcs4(68s>}1Eo7I^a}KWIHDJ_c5XRd3GGG}?K!CeV|?&$LC<-^JPF^DWSM zRZUbh?i1?a>O3j_THO1UUP?(g*nm%AXwj#raYTANbADysS#>3YdiGU}J+iJc@pU;@ z_>DmVi3@Vs(vAghN_aH4)o46fre(5aFUvmAi+Vy>s^e)ufGH}n+tR>!EcuT?#UNZT zM@3>=R(&~R8M-GmPDxDx1!!6;sVz((r7a~&eO4XSQy8bzDX*=Ju-pku1Lgx;*)e(| zO-n8-I2Jk;#+EvjHfegR(W-fC&}w+ABY>Uk;5^Z$6_*vy)X&ug%RiMHfuOWR&&V1x zeIphmg_W|Uge6ea;xvLm=Aa?aCJ6lux-r!^;a*8j!AEsf%~CblGR<=9vYVtlRJAb; zN{~B99P9%|KZAUuMmoRJ>$*tb@OmByTjH|Eje3T9WE*{o^6`jBoqlYN*=+iu*8VQ3 zJodf{s7d#1!Q+NbSi$q%1!TbRsRwtnt}9aO&G7T3$A|jw-?ur_kBrj#rAF>L)LRZM zNmYc?E7R70N<(z!s7x(C*Fikv$xWsE~a+$c90w%RBZf*$~ z>f|Q6TdbH|4EI>8usnFf`Sx6>@iO)7RCv18Q}t+*rMmR9>vp*sn${6BE;!h(L(^j7zhZS8h_ahaa`Km+*~-G0!|_ z>$z5~bH(d&t8*2U6@%{E^0u`!4>axdYO6E#;uQsk-JB{@QSI$=+?{fTNvNe4c441_ zhW4r%+!gh2w5zQ@ygL{3y!3R&;yUkzYcW#m^ft^7tju3SKYELMy~=)wv#jc>a-Uhjzvkf&-Q}xQAEZ%X@hK_V8VpQ{wcZ29#%_awIkDS& zz@S(>FfcwAZx0w5n+gV|$ENN9Lt}Npz~ornJzz}iEEt#_JG%!Aj^zad6JvSzfKOtZ z!NAPe<~?9|tTz~#8tc6WjEg-719M}~_bwjAqJb}-#-i*a9Mzo9+T4&o+^U$`+jD{0;l@g4F%AE!@O<(DA9+4NRl^*dfiS2N0rD z)5zG=A0&vy_gMrzh{Oz{$JB&TpdN-ErY=EHN-aZABUh(aqgH2Dqf}>9qh;63GcFJ} zP3dz8;>UD{c_;rGPmiol%{0F6K@c^jB20=r7a~)t4W>Ks|E`h&zSD+J9vv5mwYeanHpVAeR?@G^ar=H14cH0pny98&}SQ zwbKimJ{vX`Z|rGY;ZI6?%DJaf}@-Z5S;S~oXufY zx)nOYaXaF)2k5GJ1`4O?2JRIS*~c(caf0hs(!x;&Fdeuu>V|Ckt;{KvdgFM^k^E(_ z0}BaL>WCo<(GI{vqUAY0*dk|N)1w&=cb{o^000m7$MlHlm-Gnt*Yrq1MgFhEC}q!U zQ40N)ZfCKw;v`LHvEu?Z-5g8?4OcOBac#=%$xJ=fbGJblJ?#7P*oN)0UaUS$BCe>U zKmbY9)co{diUXco?1#i{(RM*W&XsA=&$nm1pO?sJ zk@}T`vpCwT$H^LWKnMr3tmi#*Xdf3$`4{&ZEs0>6gAJKo_UM3EOwGY>y6YRfv3Wl2 zNjp8Af-`#wiK>g3cxIocNX|r`hQ3rs&8pb#on}mQ+ONgS{Kmm#GRy?VE%9p2@o8r7 z$qLN}Du1BmeFKm+Nl0=<6Xi&i1YruRy@McSQmYGd8*?ZcC3GJ@LsAp%qVl^-(_GR< zzsL711R4dngI^;DA2*t@aI=lM3&BUHa7M~SmzXb3x`jADE$*NoYJhD&Bdn=XbK({n zoX+k*YUVA6iLBCSXR3G(OVUj1*Fw^#g+~b6dJ;qr2EEoIXO*ZAt?7aDsM?)-mv@iG zyRt%pl2Y+`73T8r_ker3$Q;(c$!W@}4G9VS55O z&p_g~%`+q-$tuN=@?%?(26il1c6}hZoi?R%%sR6M=G1hy%qmHS9ax7QofT=vIrEau zpeMtp*&RY(r>k+9rBS!QuPypl~iC0nh&nZ1?n&K zD3J{^IqK@Kq$KuzHo*&uT*$_XkA>->dNCc_2eNZr0PtrZoE%3*u7a@S^!~*mSwDwoOO1%p+5s z!<%L(4=s)fjg>eRy}d)J)N8lU&u0Wxe0)*alTXY%(iKn+xYXY@AQFuaow(B5d)k)( z6UuGv?(1_8`go3Ue>$?D^+)102y*x2G?J_S9v#mXx`D7#VP;U1yAf%zSkV{Nxmc~=##sOaK)Oh*)u#(K@PiJwWxOLIe7-2 zLf!D%+DR=TG9#TyvvJ!q)ZkUg`8~Ls*-ojq_*o=#2m7*ce432lPCK|)9MPLj$in3g zwYfH*^>}();&6qLUkvNWu72)FYh9NXjTL~~+qoB>eVn%#2iYi`-F&zb@8CV1DTyHy zi$>I3=CVDN&)S>1e1UJ>l8+@|hRJPV;9>G=v=*}*FC~4==;gAYuh|E<;Y&zpe!La!vQ*<#oLR98PI;y>(y0-@dJP7Hh)faF(v z6XY7Cl=vY7Z%{Uab5MUvdW(9C$c@B@zz4<$#|OoSxb;y-P)B4(sG-z~%!)V*`4NSv zOyJ{dY#+2sg7@wg5c*OpvVlR@n3p*3A>0Tq(OVxIN(aXHhZstV$OH!aKlYEh#%+!D z54%RaB)SxS4@V`P@|31N+F}sV4N70y?Y%^U4AZDUU~^>QZo!T0hAko}U~+tkO4QaV z-f@(8izW6G!OPDQfzwGBH@uiOhw&wcJ-FAR;yveIuyBQADRdAT0N6zOx2YofcP!M@ zRQhWHM%~DHiVa)%PYmV? zqyhm5eSJ`(k4QsX-bm0^Fif6|wr(4KntS>A`Wj}9oTQ~}%?`%W(A||d6Ss+pi+QQm zWvaU=_&#!fq1qlh)E-+>PPtyXQP|^I+s;BuXH5Ap1KobNhrXc1p`e|ZNLPyDINFSg z4(rgy{0K^6Y*Gu;kaTcTX^saFH=k$v>c9>Zi|f5w~Usm8mNyCV{u$vK>UVG{4JxdaN4M7 z%&4T^{D$CDUnU-jwbxQ2xG%F!;FPO8}&Dko@!?(O!D)FM; zt-BpYd_a}g3@jG0)t`w&$2eu_-%H-Z( zL0IbY?rkpov+)ecP1Y}lajT?av zD_eRpDcxR{e6|r2=F82532jyu9#7}{)KzFuX_H{Q?z-x+82t{^Rhdm3g3Pv=$&9gm zZs+;z`6t>(nnd&wW=7qxJeCgqh=BXjX}Bk01-p$EM96vbZc{v%}Eog&t9 zyG?7eiDq$e0#;+xQcXhSEpIuo72C{3(lgdxSOI4!&-c)DEtj*rJbEXPC7*H9h4B*T zcUZzrQkf~wzUvW12w~Vzv)C^mBv%C`t4TwAVnB7lcZovY)jnv3kla86wcdaG4&?m` zm6>BLuyX9FzRGUKgS_QaqI;djPMQI8jo0*0g?#)Z?MC(!EsPhO%<{ToTUdP#a>9g06@tkdcENDqcgzklSjQ=9h>;3prwR zeu~)0Pr)f=a=XhK5g;#Tcj9^l_hnpwSKanncjGbz@o(dT_4BxB>HYN;R?S5fth+&x zydT!odsFb1f+A1T3FpY*SOSNjIxh)7<{n29RQkf3v|X1EaMzGG5GDa#(2|7+aUvH` zw=u3qQ$Z4;eO&X_-balejkl{l&gLHZ0S4Id#5p%Gkj?m_X`)?t?#bYrXHoMRZn4#D zVCJS$g4%oLwNYpJ47Xh*`;~E;u|p7_=sRl$J)kSgu5}n`SC(F8+Ze-v)_ha1HlEhx zz}~K-hk5w8HK{bJ%>ieXUwRm_4Z5wzP=~FobaXV-gC=#*Vsc3GQmD~7>$=`0(bWKZ z!G$?)a8&mASxL*RhBjvlzG0n1#%g7$`@6RE+R)TNzWL@J#R0TJ9I2U5`)Y^ckiGar z%0i$D2&YNUQ)p!CtfC=FQIN@SHs<|ShwU>OjvV{>%AtphLKG#0RNxC^s?DlaeRjta zLTOuDyY+s2O77?6B^2dmkcsyU#w*r&4sBXS=7p7P<!KIbZ<4oKm;dl{~&&kFm zv~i3N0zTGE5fhwS9P^t#C!N^1E-|yXXC7ghAiC)`I#4+(~@uN5PO}8 z*i|a1Kj40t?Bp}rcz9sHT#75z?b>{ekj=FYtvez6@VV91c{~YEY(2cCqfMy-TmYfu zBN4IQah9a~nnO&x7v#s<94f9xUb&dt1Yma6>8XgzB?ti=fxR#QbEMmj40bS1XIuw#{JY%9$#?_QB=n=L9ddP;5CiG2cPWv8HbLnUXYIcZO zqny6{;vhyyz<@PK03a3S-y+(*pBzNP(#%56*}=ln?VF!y$BruWieZP2DSt3G-_Lbw zN7q_-6n6Lo3C9(KA#J1N35V@K!c!V_%w2Q(=h%i901>U-Y_i9hoaZ_GtFJHT9|l0- zuYt!M6_hbF&mC; zOnMtk2O|qB39}$>jDvKEU%6u-ZLj3ojuW9M#^|#*cKwqUt3|$y0 zRDv0g6$mAL8v3MeU0vNoPEPJ#03G|4)IvRZb+PioWB(Ky8g%7rfaoxvbOOy`@BZs_ zcPs0$^RZWWk9bt5Eo$k_kQOPt>e1DsqKpva_ao=fPt}>iRQpi}Cv`!+G}{_cw?0s}BQjA!~!f5piAlLmB7P;geqXd8xwy+yqAszAJOn|i%`A$Hk8P$? zAh|(_W^5Zn|1m}UV4<5fJdS(y+}}>E?1{+Gax50N4zlx(cU1=SLRnZoX-HGU@^)@3 zB90;lB105ic}t8S!y%&meL4L>VT&?K(omK0)VjhA5fZkd%d%p^8#k?JGwCEo!KH)b z%!3!x2m~nPV;iG(N@>LuBQ&*E)WTwLdE~iSf4y=&xP) zG2q<$se(q9e+$sR-pG$A`EzGZSpO8Pey!t2C;8c$L)d?hu4;-fU$zefpxpf_-jy2q z`pZe=LS}B}HX?|uzw9!^&d$xw#m~Xd&G$2(?eFVsJUriyOuyLqodV%kzIg>Q4*-Cf z_KmQhzY*%dH$r##Mre882&3s6p)Y(ROqy?mq415co4yem+c!do{YE%c-w12z8=)G0 zBP_3Pgst$6P!9j1uy2GD{e?_S)C+f@!W zz#sYFOPPBBO`I&f#rOcfo_?3Hw)8MDw{-I`v2glZ?ibc~Su0y7i@$~bKK{8TcT0D7 zTW2Q|TMIERz#q83v~BBRW9jxwfuES)@7|1aL2>b{qG{b_@TK+Be_wo0u z-fp%YmSXH2fM3qOOSoA&Sz0@L*qV9#rWd;7*o31>_06-ch004c5;{&JwfWuux$wLDGnlJ!>g}Y;#yK4$}$4z(8$acqv zz2i~cMee0LdBZz-ue<*Wch?S40D!PNipKd0VE~A`Ey`U0!~3u0paA~|c=KCD|8byxZ!f<^kAE@yf1<-bZT^pF^Dj{F zC;$C7y!m&e_yg+xJIMaiUH<5jfAXC_;>+*c|DTTV^JxCb;eO-sKe+C1!RjY8|Do)k zBEoNh`X9LZ&j|1*)c$Sk`(2Rx8L0jNga1UT-{ANU0Q+6He~8atxhxhA4y^wj-f;2# z1vhtiqXYp3Fg7ocf`|CF_wg5aV6m`#;Au^z`FE}*c1O{_OhUu}=n^cp7G@r1R2)Cf zcwgVq+F$2TU**`k{*vSQTkcCLb^C+dxBAGszU@7Y@NL@jpH9&Mu+ZWDs_o0?%U#kA zU@F_1yE(f%TX~StY0#4?$*U;-_BRrc0pIsO1$>=K!F^54VZI*yrxAddxwE6o-Hp-? z_yNA`=mzy4`M)P)kbuAYd#8`D_i6+9v1d?U=`RkK*tehN{w~A)o%7{G^20rTo9glY z#8LS&1Ny&~!Tqlm!okJ=gM~nTwUCzYlhWT>h{c~Rg!4xWDf)*T+y9f1|8GW=_^X!x zpi9L6S!=x9|L`l&|Bu%G#jm*k=0X4ESHEiQZ(I9OZv6kDcK;iVe%Yh?4@USu>ywL% zjO_dD>r0DD5MOlqW#0|VyZik))O`2l|G6Fh-?u~jSO0z!#J)H7zxRsg_pROgnwdfW zBR>AQU;iJQ^na1}A^?CxOYA*cY+T26cgYpCq9~H88QX!?MsXH3jk*$FD~XPgz3=x+ zT8fe_S=%MKq?TIlGW*cOv1=EMVagkR^{YnEq(I~Rw9ZfAxDDV^p+P5rQ5bDM+#(-E zkrrxeps8)Rb`aP-Gjrd&T)s@pNv*}*ojY@8&dixJ=P`3Q+7wf&HKs4(nTkg>?=Hra z8g7m0OPIgnt(E$2XgJau-`#k=;vsus7xZg`WuJ#-*R#}y`?_2#VH;*3TfltU z%}kwYjqeDSIPn&i+0H4M+F-tpI@_qNZN6RL+dw|uk8PazhSuaRc;#ekjQ3%OG2U#a z?uJv^jIJk$D`Eog&3ZfJVswn_y;*O)K9-=_zDNAu=VA+a1bZ{Geiv8R*VxU-+Gyv) zE;i4N*&D973t0gH2g%2>(;eSaqbElLJHGFL)gzNf=xKf)d$09VTmSsI15YgehW{M? zh&=a%zqxgz5D0s7s>P7&v*ZP=cPOIy#2yw?&&!GLGX!gOZhS*oz8M} zc8FzZQ5P7K*Lb>`FU=5hi%83Kl3{2MP^3*&vUy!{0f}dDC4VD(efsho0nW~p-2$*| zO8M!UlLZ-`Nzlr(aItWJ#jtHgu<1&EI$yY&pGl|ENlt{HsT;L?HQXtIws>AJbVH&S zE9Gf0a5f%*LJO*(3#u7_-DnKetCe7XU3lpC)sa!R+U0z)SZ<-p9E8JyV5p3!Xmt8S zs3)VA$k+la88jMLHBx#~;v`#=1d+~w<&;m4rcZ{;HAZCxQ-|Roj{?e5;c}g^IaOm# znkfP)n#xb9vaM)_#Nufzl;$GkxSOo12ZDJV;!IWEi=rV)K2 zfHK323Tv5kp>#D@EC4V}3^IG000o{?E!A|$h?q<{Te?yzUjtB1je;Ap#A~u-(qyXB zDe$uj)yvIew=7ZOOhKRtmuw7Z^NK1OoZG0?++EX^8{pj(zebAe&w{tgc}ca^0D zP1aaeV}cXB(E?&=g%=pv;Cb5XXUgqR1XANwmD3HK=A4nqXaP7qY1I*n7X)6B1v=x< zEKp&jxdI0xW&5$_(I_-)>9Wk*qPL*OeNIlbmZeZjR|M5& zI3~QfCW-za*iy~dR9e<}1B4eJt{39i;gOaVb=%UJ=xPpE9BoxmwRBTefH}ND0dv&K z)8*m@Y^2gAV>1?Oh~A3T@-Qd?bX~4A=MwWo6EabvRhczdQB-{;vyi)9Sg0=mlhhZc z(6p3i$$SC_1i5g0|1byMRMznz8LbO^?zWl=CVMc0s?E6)JA@D^SKND&Pf zEAY=W=(jvxLQ%`Z0x_jqrloSU=*id(NN>@CC9^84^E4V*3M56Y)T9(FS`<{t0D(*| zX3NZMF< zxYYV}J${D%kpvQU@RgsfZt=L8V5l$75Tb2%;GB_}VOXBIB1tNxLXD)(IxU>x#&iuIj8{$mcWEq*G!)nc~>(^eqGF?5D z9!5W?`a&Hk@p_dgSI%aEl%y<6v7l441(vDBSm1y*R~jBU)v}UC>&W}IBsIW;g2{uv2C1!x z3I_r@z=fg82F)QijbVb7SwT|FEml`7mQz_UtD7eWgnRzPSnEkeI!w1&LzSYP#_PjA zqf8>SDNT5E1Kgm$Z5Xs7DMoYGx7-NWbe6~g?PPxdXG^|44bDlmdJXGLBqxIvMR3|A z4n`6gfM9ZG9q}HmaQ5JK-r+_(&H017LgE)$RhAr4IP%)SbE6sGm%B^kqePJ zTMkOP42DT|VJ79IK)VdP_(oLTmgveWo;S0tNK7L+@vxgw|$ z@($+40*DVJW2fq~4uw!^u2Q~6Qdr(1rHhshNmW4EmKTEQtoay_DSzEDA4nQhfBrf} zM0|FtSe~M?b)TKlZel>#*rq7RyrO^`T7+31MfTw=(BT?#5%GwIn%Aw!NxCXYJUvy& zF2Yc9CFG{Gs5=~~3v8=Nf^I6{NI~71e5m$RVXlDO9l!pfU(=#>QM4pYu~1EqfT&&# zY!{&aHT>;tn$%0_@mXI77_=(!yllfnLv2KFR53SQD_jL@tX#)vv9ARtNv;;;aKSRb z4B#CG86`eIsa`B%FCc1bOB~NhJb2q7@G3GO0v^4~8_*Z9hw<-Jt^(F)4X42=DdkD3 zys((7xaq|kI1wNlc?YL!hQNU1QLd0&hp9*+yHF-*3JV@UkSXC6AhL^PAY%A!guH@D zU05s<{9){lDFG?4tvo!{uh-pv1H%Q;R_jx>N^Y9G1Qr6~)>;`dU1E-jU0=1Ndu z#^IV~c%C+F1B5p$*N}oD9!+#NO4Kb;k_^-7IMM;td~r5Cj;yw5=LK42Y}=Muo%Ss& z*S?H8>#PLEoMh=TqtRS>VF7JInYjgLYl1T|kB_?aJQ1y{iV{+rVxVJqwc{PB7JHZy ztyz|0N(@X!WiAIa%8`vPgw1M;3@k5>lfa_GyY?E$cZ`xRRBMIOT;1{Nao-~~P0*62 z!D}F?%reNB3Yds_XA_(BId?TzDCVY$`6lsbbDA#jqKlH*23m_&HAWEy-3pBr?U9~^ z_3DiItTX6Tt3iWRBxz_rLe^VYWam>u<8AF_PNrqhnT#a(wI{Fz;Z0P|ohGLpzb+W) zl5T=R0mitTE0jnjZ?^_@e)@8L`bs(l<_XzT3VKqC#ArMVt!&MYLe}Yqjudc=V(=F2 zYzmT9crs$Y=(cY0s%FrHEO>O~D-j?|l0}6D|1MLQ16mL}DB6}q8;rrT3}^}#ZL^?7 zMht_nf-p^)QCMCk(ubKv+dxs_lg(92!&uE@(dxa0Hac)_DSy3&tSINTdZn;PUMpZ# zA=Q?{els}V*I|I+y#gnX=n0&}KEB&;ClA{pIOPa>oOXP^EO;f^>8WYo=X5hXzY}Ma zOIOjR1MWA@QG3w{f#i*CQ6Qf>uJ4StQyaR2%(D18*H(PB)IUisSg8&Olq;PFXLMpub(|#ecbyaB@irD(i+P0e$Ml zEueb)aogQqFZN@o-ay-K?@-Hq&c`n~fInUEK~&h^^x20$emm~S4sGMp<51Y8TZc1t zk{`q02jPRpg#MP2z;=d4(GeMuPq}Vy^e#nXcpm*v`;CbW&wID)Y_vZg-mx*Wi3`)# z*xBnt>Gu0)dwyiSwGFyGIoRHo4fz>32j8BX`x|_2zQwSaJw9OHqDS!=JB#1Gd$Wzx z`|Wu`+dA#vR&3H91qXa)T(|8+DQqWB>r;zp*iuB>?!q5_ZQR>W?}Xt~iwN1#mgG*u zNVXPQ_<7h#yRehp9X{=RgXT^hTkU3JXs7$;yWUjV#o6m8up{*e9QEzw=;f0*J>KnR z+W+4Z$~(1|C{NpuzU`=|2w;jq1m(o?L7aM!K^j@a>(8?DDwb6N_|h8~)Wg zwQA9vV7D)GB7O}Lj%!E?0V{sX5yG5Fud zTmqO<0FLf&Zf^>n>j3l59sV6t8@1Pg#@QKe4+wFb7ewZ)KA|h@!}r(gg_&c;!qoj+ z%08DF$&QY+D1a}{n22P8`(QGLkb!LBJi5*6;gDGKbA3KKiiRaQcVp4q!xzCPn5*O# zj*1{Ks~4wl%v~##E?zD#Y_ZI&CHjuNSC*wC0 zH|_Y+YXfTs@Le|UZO9KgGt%MQZHJ(h~+xP01NV}QFZT!3R zTH>p>>kmBNyYzZ&X+8GMpVkKZUcDQ@&NPG7{;BWfzP^{cvX>tJy;~R7;AeF8!rB17 zy#)2*h?n}Rm*TvX%R%IRu!HzU>|WeQ|1Plw=PofCZ9N?u8bX{ya)N6G<#xut+jPrY zaGi8unCF^d0z8dx>5Dz+w5ZSr{)D80H<@)(N1Z#{e#>hE>VHahzEmO1_fHgwogl3T}`<5;kF0S?RAmMQ)ki3iLsEZtQD)n*r0Hv z*k&>;m2z*bK{D)KEW>`)Ls1ttkYRrT&p&ov z{eA6a*q5Q;B*2{S@-L^~sJ%Z0n3uZRxA%Q?xjevR_ix_60>IqZ-@ZMxo|nQm=5N^E zw*cB%B+v6=EDFrZ3c5klp{v2TbYLoUPcwPmV zeFy!U5;tn^ivaWB!S?O_4?Lp)lkD;TXQ_?a`&WQ@r{`1A$;`}E##VNvuA8iDte+J} zKeId1&mrlza}8}fIx)W15mLe35xGZH@Y36fvyCf5ljr6sT<_*Ya-i|%t^d4tU7%v? zLX27$I^cD>=l<&e6j84{0Lk_EAhpg9#u7`b zG4xCIy?h8axEfp52V;Kj7h+ECL@@VIM@!gFl8Xuk22p;T6azB&vFEAhfAY+K#OLqM zEE}Cp|NFs$0K;Of$0K6KS-}H%z4v2%_cvbZO)vHDUh1w`(7r&@ooMR=0s8_bpuwGL zWMniA&pZ|HyvZjMeLrLeU+0rp1=XK;=Ba(LdhOZO$#XCPD?eHd(DX|U^`Vve1CyE4 zWZGA*CveeC&W0hp`@KeIGV%Uf0I~9o^G==T&&v0$F8#}arPYH=PbT~2>~f}i_9oYJ z>8S)l`KymU{uoTUI3D~fAHo|>sZjSGZz$jQE{pB%cmG$X{nYI1bk6`ay1M4-ir~K^ z&S=N}484uM2E!c6Og63!fkoMEuXpvYi!o~c*gBu=?}V?zF+84zHPJXdbOv8Ve2(Ot zo0z9o#4fwR4$Tj(=*dB6=#95lw2oUJCYH?($Q^qAA5K5> z%&v81=BfF+o!0c^^`+P7OBY7paOQn%E$&z>UDQL~jGscw59fUizLPlb9DIKTr~VMW z@5iZcc^2ij9jkYMY89#Csf|OP00aghBuX4bgzR+**%LJq9YPNJgiJOhIny|wK;+B> zXa#f_I6Y6DTkq;a)Wv!8v6acLGxJFx`$Kld8T3QXuGa6q^vb(1+ZTW&Nsk(XYmJ{Q zi~E*VI~s2;i=9iWaab%sWLWY*!eukQJlWwA@)6*;03inhguKtWHo6Osk&qAF8a#$m zvPa0AN3@Lz=?5WsMC|tdYcU`Q@hln_lZi>(lh-*kdBB`pPY3$$1^)hco+3kU`~sN! z+4rC9on87yFIB%id$Zbm>B8C{eFT>M$F<*?bP1GrcD2^u;N*t#I7X`Dg}=4&{0$@xEx20WcjbR03>9>M*E6_?0NA}^@lb~v+^Jc|3)c&j!ryY%!R zRXgM_;-!O$rGx!$@8a1@jkOCu?!lc9JcfP5Ln?WuKe5Pof>ci?Mpu_U95~na++QMk zzl;oD>f_`J@vbf=doY3v*)`O^6?@{0t6UP0^(2Uv{lKgLSKajoM^WAJ-Mh=>k{r3i zTta}L0XC8r!Gu!@Vrvix5dvHik|=3%b^b~=t$WoqqIEwyTG zqqf>!2qs!^I^(FN^%stIh$GBst&pmazVG+_*u8zXxkLYIX0myC``Pb%@B7}qAD_>@ z-4*1fkI!i1c_B@y3&SL^9s?ie@c&m@QQr~&Q2UmKj}alrU!>8J;yTUOWL~pZndrx> zdfAW5>-JzE2j(AFVKanx7`I_aV=ad^$aNT6OO8z#YG=1)2;UkW#?bX5ENRF)-dYK$sFa&SRUMt3sW(>jGxYuCl2sy4|Yb!dVqBA|( z=2w1$HR^A&SflRBVvU;5EPnO+(+lZ!QCQnq)~N8!4Yu6-hHF$9L!k+OcVt7QydKWM zv=lZ}nQ1Ak(@A}g{Y8#zW~X(mH9z=9a`jP$DKXwVVxnsWhUcf%F)g2zR<4v*9%A^2 z`s%#A5)&O0m~yOT({jFKIZv`&fS6yheEcKv{YOo7pTO`^JRo`X87U^2T2jjj2)}Tk z7PGTc)SqrLKOXn0Wo1U=zL4r`lIrBcNm5A*q>>gQh7YFKpWgSbiLO*R#_q#_WVukX z98B?H<%czgO!TEH$8aAus80TwjCLlov+utXxxw^LhiYO{%YKfO!=RMIBE)QFcS-<~ zKyAO|t-$9d`VN(2cn#jK+Us<`6!WZOU4*3k6iN9hM$8IUvukD@c*H~xsT_lR6X*Za zrd1-PRV<}71u>s8FT6SDj#d->rphs3S!-BR4W9^kkzM7*7&!lwh=HGvQp!#+_+60) ztykf9B#e}+zLb2J@3P0tcG)a1QrIlQv~#f?Q(Z+r_-4s-HT!Odh*_|J-I?eOjDf4( z7BN<@mP%fof?iz--?y_)X8GGR?Xr_qZ?P(QLKC9`OUlbQQw5fE$mj+Xd(+OQ9VNvS zG2N=_pWQoBqhK&`<8|>{qg`9JTz}n0rPdk+kE5{@parEoFMs34A6Ya#A-mf}(X4l= zq?2J~InydAT7~p9s$d!o*WvY6wtpQJ$+Xg_H4>SQ?wfApVwK=|7pCWVFS(e%F&uc_ zX-Y@eFP6PQy5=qio_9Zt_nyo=?@sdjw{$$OjkkkQqb*1JUP-OQ-;&=hg4>Y=AAC2# z?90FhA0xky5zHR1Ip1=!_XNSbn1K&|8kR!@b4zY!d-vv2ZgwJj(4#&@FhjYS`NF>w z%&`piPQeV9U`8|W!O%n1WXYpO2=1D^%;ks?OmAN1a@<2O4`;9!CMWh2%)9wE9^Y0D z7%R1c?8;F?aP=AZR#>++5zKo9ras|Rj-{kgH~S~HHwH5gf@zs#Ugu=*bArh!oY-D1 z@L>eAHek+c)A-?e^UI$I?oih2oY$n>GSZe7DmXBZIA1?gzH6E0A6cd$ z`L)#_?R@SOXB+!Y#&h~t&-vIDe#KZ?A9yxW*@(;wTm28u*|jth81T;z3@n?k4!-Zx zhu!+Yp!?-Tan0WgmcHVa!msUGr}_J@RKm%=SGG>u{S&-TE}Osi(ok;v+j`Qqc(CU` z27%}YRQ(GNfO}q#l3e*uQXYZS;b7ylt#Fod8uKF0+;8;1m zd?}@ij4^^(RS)&3-&(1}1IBF;eZ*&c!mb`(zCzjEoF7{mQ+Br0$4Z8mU#T^?^YeeW*3jOkONQ^Fwd%=QE#e&8>NJz#?ICT^pabsBUJE+Tc@J0seGZKmD03lm^0=Jtb-_E1diC-x%lLyaxG z5c*hEqVV<}E#yw*l0U_2d@{1pr7?xyHU9o}TBwPVkcO8SE+e)opqC;waq7tQWK=); zrJf9Rv|qcc&L2J;PFmB1G2;Ss(mXc5_abdqiSD|E9Oq$Z4`Zf7xE7y}p+RyyA4A6l z&S96E7tTntN_hg0bpV%Vif@Ds$vRpZEX`!`8;oB`j{5zyN{CIejvShEj*{ONODb;v0!m^ z;v9X{qYrxY10H?M(|x=z8Se-TEC>uto%>m0xjqWI7U>O0be)KvZ;ifCL{G6smtyqf zx&MwA_MLnVI?`>q`pe^_6HAh_IWGdcPD)or3e;)5)X^S3Ou18QLCspfT-00x;}N~c zNz(eiR@C}7a$JNVU@>fUZR5&eUa}iQ)3Bav7*~FT^RwGX@6sHfVIgU65F9fQ=pm(j z$Z|4r$_>pqUL~3eM+eE-1>)8hv0$Ts*sz^}=pdYLN6la=7NUsp)FJE#mSPANtyf^E zPPD`|q9uM$^eY=g+)W~GYf6jl7j2c&GD`#vkIy9e_2hW?gg#bu?MNLN^8$B1hWz;L z*bK+DK1z_kOB>{9---4>AH*5M7!&O@MmvW3x2|hrcmF6b`6m(^jR5pqSNIzvrmm3i zMxi+jMf)F9NDINRafXX3Wn^qBZER{4k2?7&+L8{*bXla88#G2Kz?mJ-;Xf+*b-BsG zGgFY!-(n=VSE*)W6@5%EqS$Nn}7oX|x?W#TKCw`Sl)6Q+n|<2uOH3{2Hh_qz@S1TC^MQzDpatzId6Q zbT1z1`HapxdftL-PI8mR53~@)>LcF16FXPsllhQ;A)5~wkqZLP)>bw)GdYG#hDaNz zgc;CjeJuEVkdJO<5%-z?yQad-tF6&&KOM#pr1BBw1)34o57cHSdK)O^c8t4I)aX-U zPV=@oyHWYvXD$g{gQ3e*-d6Yv7s@L(l;gV=#1g=RQ}r^e#r5Anz}TOKfU#4?SQZ=Z z6jC^r>$}{%y67GDs;g2TzcLKx9bx11L2U5%@jzS2P zD@wU2(~~GR7f+`Z6GP+XsrDMIO`($Ek@xP6aR;v!N@e#;We=oy^}#=T@=SEQ$}x7Y z1|`b@$ugBR!c4TAS1@DTL??u#!M(cMQ5vBlM~I#M{gdYwnI3yUH8H7WFOqUNS;`@m zEBaa6YX8@7yG`_n$}v2LA4nwr=TeNv<NCe ztY2bR(NXe3Ngjak9|VTW6~9ioYKi@-FsDaN%xX!lSZ}`yKLownnihU5e4aI?dLjEr zbP1Ots-f5VP{de0HbwGSiR3XVSHL|1J;)`M+hZnri;H7;p6_xwwXvyahd)StIyrZV zrH#2vj0^Vfbln8IPEzi{t{>j&Q18>EQj}sT{tAN1rWAE!lMoFOxK&Etk78TLSws~3 zHWz8v3UKo_?ZqnHSfv^X%kt;6ikwh@5nCJ62{2iI()Zm~x!t`w4=( z|6FsRu2pK2c6%^Meu7{ooo7xv2(C8W&VoLI*>hfICFy>GdHlSInRl3oJwq@TmD`y2 zbjlRL>?@zx-UujD1hZx4#7Yf3_wtvScK_9;W%7&3Ou1s##OXc)Lma`pHp`q0r%U&0 znEK4lF5OK8ck}Ft(*Wbc2N6jVIvF93i;OVnL^coWsOpJ^VXH6;N8 zR0SLk0Sav)eeo*ww9?k{PLnnPq4Xl9V8Iq4p{S*Rp@npaC@KfP5B>1Ly};3{SFn^L zYN0^EPel+F1(D;CbJ5BXgacK$zn!SIsX3yGtul<;{*3kV+ zA7B~>M{dst0dq0}KWv_72P>1`Ex_rAMCR9Lh%$bo0GAhmA6kQ00rTUK$n_C36s8D6 z!}Bvkh8ZyV@sT|}mH=jTe0YAiVN(y7gYl8;_jADfJp#Y4aKQtZ4~9kVAI9O3H#|JQ zOYnaRaVulY&J-efKV zoF^&#eV@gC1ek#%!oOL@`z{!v?7nWm)s6^%-#(DB5ir|FMjk)>fH7FY^E-!=X~5jD z1j^eLKMyQno=FbR?@nmIF94p-gqr7JU?7iGyvw~w8;AEG+-`9;DlNToAJk_n>*t#Q_i}dlc3%Y)HeV-5h1ldr|=oUvHdO zfI~T7Qi$^_z~QTo9=VZm#8X`X4xb}c0S@aeD_2>)CGio8Cb3Yg+a;rUhKya_O$Pl~+0ybYM{lf(1FmxpnH(M<`=E4myn0aG_6 zJii5y@f2WgOpUyr&YT9%JS{xGe@Bx7z-XpNmfs-2q)rdd?+RpO0%k-(WcfJ&Q&te3 zpC9)@08?pe$FCC$>_6F*wbMTX?j2kB`=amAVZc0Lk6dq;?UJocxP2cSGXXQAF!DNO z3}EsLBe#27A%=N~TyOsdn7tAB&4z*N0ATt%gY;%6a>jB0j8oY-eL(>Z^~)8fvU*d^ zfO5?U{~T!E(jPD%&1kou(^({+nXrzZ8Nt#WWeu3BnUUrE9ALK3{QqRZ&VmMpCWpiW z49%h;1Utfmg8+8IED%XBG_zx*z)mifA`XV;goN!2&1x6>u-yZYxQC%>a=gFL)R2gR z9p%;;BN~v9_yXiez5tp3V_$&Z=LbMv3JUBMBYmwIIJZ2(Z?dep6&1~0XYDSQ zB~}|fye_})Ml8>3G@K(h${2QH|oR*fF@<89%)YN24N~&~fNlflzF;T9uAzYJtT8x;k>J^=wGJ1ps z{v}&x2N#OhaH`3iB|j>gJCR{2*~#CRS@-bL_p&Mq4oqC-bib4|>cW9cgK*c0K@b1x zI(hG)H<#SnR(|fs?DcDJ7xrE>_i&#F8=uL(GCk8j;@v0}&++XZShZ#i7n6Ih*z~|Z z5C7-H%KAUQXQ}C>S#|QoUTL45ntW>S$=yBsTzlY+w;$QR`=6UP54v{EZ7zM@QhDG9 z(~1wiugx1j;7=!}ul}M>bcJfRX4i4IvF~5*+_UM|gbT;E#|lj&eTR=foilH8itQa& z`9D->$yw-}>p%{y)OR4ejpWKh#fV6wm!{JuC2e`q4v| zo=o5I#n}fN+V1I7WPeZNne>zOo7Z<9i>?{ht@qLY>hn(1cUw;6KL0Q7#ijGTEd$bD z{>Y>mGq(3#jRwtTo{t*HU2Oeg$2X^++BJUQtLo(PPY0eJyk&Z0{4)vrzAxGL%KWO8 z0J(6zvekMhgKxfXr8V`j=(D;D%dfusgW-(*bxt~70>d@D@ zbF57n*fTC$NtsY0pzS`q?-rp;zlXw;}ba9u@>qA_Y5&T>n+6rrcu94B7J za2;OljZZv>bUSgjRpzaUcO?+h|8kC6@0Y72W9V3#T0m2Inp*33_4b)?`o!5J&cMr? zmsoBLKGm0qN9G*VkwVj;F!9W|$Re#%wdCyAh$uzQRR7q=<9rk1-o1R=@Ap=l^{$Lom2V>F@kg!f?rG9tu*xx<`!bxn z2QFl`!{|2z@@0Z9K_7sb7}O-rmt)pj(RoC2a6)@=eeET87Mh|94zKGbjjH9%xfuuY z7938i%rbuU1T~*<87=Ow*BBhC78cV-FJ7F3{!8s|h&$QoL=d=lmcq#qc#@f8frXQU z8jU0r+H8&@)K2DNvX5OsKD01SkUp~@(61~Am1P2nZ7j?!EuCK~Bni~Sg{0HLCJ7^g z2y~QoFD2iV5zt5nKZO^=j0}jSFQ+5DghoCpz_2h5r}(J;J**TNu+Z8bKTnaxGwVi0uNI)|^&Y_!RKJo?%u_Y}K0z%Kcgw4q79-_@6SJ9+3nm6bArll zgtGU*vOhI8Kh6~`W{rn>y+%sbnTMj4T$*~Uk-Q2wx{RJClji`RiRslpr8YJD)Lx&O zIC&74rvao8JsCBSQL^nt@L!SSn4ot!7v3T&PF9qHcp197(dw>^G>sf zRy5d;_d3!*s@`dFEn2K6Z{8T6GtTSCslQ*nJ}+7{c#iSV%Dmk@tBjnxySK{dtukTz zhQwykY4SR<#QRO&CF6sVW0`6j!tDBG6Au*;iiQhV;-fqrpv2Ilz$oUcMPq?2^?IPU zkQia^DB#_URXdllOJFkAFiWRy+`fK(zu)&nD*`?M9l4t0-7%hvywAkfo?LmQS+>0h z{wt$bn#h$`f6JANs6P{Sb)&=SD~`2`ZQ>QVD|`Grx&^xK@c31}C(+>4t@S;L9&%z2 zuTh++_QKHkFbLyIe!Q#`A=2UDuEm{P^Q^9YmUR_1nKBwcig)SBV~;oeM8 zH-g-zmZptGqdSW?D_5#%>HgBF$b_Vj+n4k>JIRB_2yoa+| zm91=OT~f#Rm6BT|x+wNj5^K**UwjyUR7~}NH6e6lG_?0xh?dew@H%Q!6YYiAvtT1fo5azZ}VQ%dx%$QDuNz*nl>L{bW4H4!g zX$mU~b3NCkU-epZ96ITuG?BoT;}8#sKR=I(1afhY;>1nQUwNm`G{CC*vdFi=Ebt_3 ztR(6UX0+jjKGe@yP=u0_`{x{Vfh(R>bC2&;VtiO%sMe)CtJcBQqTamTgaKJITBVX{)hD~Y>Chj5WQB2&+A&>jIgivwAjIygIKJMC(wzFD36Jt?vh`n{hrE{x!gVdU^ zTRNN|0b|)qxGf3wYJ$g%E5l~x+l^I5{O5hu=Kfc=`*t@4C1jRcu5KsgC)4`!sqf>| zuRuI5e&+R@XR4J}Jaw?2#U6NVXzk;Y<~dG|qWK(~fKV!vQOnrSvQc_y8mN{EhMMII zl3BiN!Zwhoz|llZo4OPe)H})<2OP3?14*c<)PT~7u{uiW%fwg`DW?oYC5xi>)$QVC zyL>hl&i0dji+!nls&$_wNE*+|9*SMb0tfsT*u?q;);lQmM@B7Y67Vt!ESmqQz&^dj zjOnNZa+n7hN&tNr0}>d+({_;$zqMzuWgrC$kp1QvK=}5UvER88#Lva%gil3(y>7ie z3fl78WA1BWv(L)c>*(2ygoD04>ZA18r7tLmQ%zzKOtF0E!z;&Z6&zG6`JN@>w|S08 z+B(-HPBmH!ARQYiT`T(5nsEZ*kX5v$_KYh5dL`Z`;fhl{;W=V**u>|s)xD3^6OcHF zy0!a0+(nQc0xD+%dAgAHh~fyU1MGG?h(sUfXe3}0R|m&`Web_@%m?^YwpM(FP=9Cj za!1H;jOK;YNtcZ$ZSiGN6NZMY7@W(2{BC*Lk{yP1YlzP-@#&NnC=0Lg($kbfuf6P) z{h&=ChG_Xj4b#=)<{&8F9(t}FRHv4q#vr7TWP&0qZtl3!Q7Qf7$uSB|4H{Uhew(#w z+J{lg@8)Fh>$jNBAIUZ@Xl@0|UCnYusdv-Zxo;BAsA%>O3hU%Q2(?3ck*8%QnRIuH zhNpgAns_b_OgtCXJ7Vlb(z?k>Ha%eV^hoIH>5{1RoHu%E%$ywG1*dTC(T0XxmE^CS zXEroURTcO)W2tQ7W^9|jCsBb)p$MR5%7I~U&!zT^SYvke_EejzId|{Y!M;SVFA>Yf zwQiz`F#XNdSbfu01pJ&aMb%b&#;qGW+g$CAZjGbR9#-FG>^@FgFw)Ra%&Xe$(EDac zEbOYAFbB$!VD-6CFovmau5EG&hKAF2oJdJ?L%Zr5xXjGr0^=4A9Rd-vjXCn`YyIL8S8wE8ka`AG=L|`9@vSxzSOk*B zw2l+=1gey+1wmK3`Vt7aZj2O^0I$TICbJcpiAUbyWj)}{OT@xegTPC?75$25xq6Ay z%<|)?Tk_1(G-n~3Z7&X*ZTDfT;RHrmSz}x(DOMAS9!hg}vuVuNjJnP!j6p=Hdl;3( zs61X?Ejf7k9*cMykp>1qo+=L$w}Gck*u-t;Y4mX|_d3fx!g9|u>K5bNBPv)qp>6Tq zq+@g^E%F_@P*(57n9!_lThx2WenE7|YA&vwl4xS<481rZzs$2Do^uU%81^okLSjF6 z!L+1hf|cw*&1(Kb2>T4S=%${9huIq5(=_9tI%Ee|_C5T7Vd}GDy1*P~7{mKn-6hZ+ z?LemjH)~T>4V9u|G~)6fu4s&se$~=1Pk&RJ;NY9sL4E2a6-0M$za|v!lAUE++h^D| z(pOAr<+m%-mw`>8{6f*%KGudylZ2ZkdRBI0X$)rD{=+8*{6Hk8z(x1ENPcQnTr$5rY0=u2G zJWT?HfH0Bh(RzZMJU{^ zzD-&PPKL7}mP#?40FVJq7>JK>H zP40^;$i9R^5%(e#axf4I?{o*DaEGZIq1uRJFjBW9n-v;V<0hd{58faYu93bc)Zk?? zbca}oFREBnQCU?njFUe=E5s*{8pchaFK{QrY&Um>v_(uag5JB*uMR_c`Y_H;-|*(6 z8>o;|S%L7hP`Hiy&O%0NR~adx8S%-}gE?_w> zT6*v#LHb0oAg9X)__Cpo+!F#lSm0b47{M(>Bm9QWf^)TzB-+UU)&z#K29m@Y$XJ$p zA8R1NYD)h0)CfMfbXlA$4NF%LrdayUiiLYu>7-bF*^LEOtRbveDJ(Z5q*&SQij@{p zEFuFf`B~jqD?K!Hy|F}cS{thX-I;3prkW$w^rL`*bbYbY}%+S+Gp{E(4 zr-`Ab{Xsj<%FtZxzE6HDM{PH(r^)5LDF`yw7q2Qh-v#-+A(}%LDD{E zX*g4Pke5SP(KKw&b4c1xEbSM3?LyLSvozH84w8oP?r9p1DmIeVkEP*gJB_3zur$;K zlStY)mX-t5{UmK7ODhB_hosG9X>)m5l4UFn=hd`Fx_G(2KE})awT|U(sTHf1JH&F2!f_Fy zK7?Z>p+14*GD4l=seQYaJI$^*%c%2=`VKcd2<5IQonQ7)1q`KgmkE!~cfnXQxRjH^ zY~$P1QVgPvc2huCRJsKAWmm4EQV5E*AV_>T*=|Z6vp9L|!cQ$fIJY$TqTm}Xu3Y9K zJc$JyyGoAlEuX{i8gl;d+sRDweA%KToLe57uKa#6t7qi)b7ljd7R0luAlwq^3ihm^*i60GiT;EznS^X z{OFUCApS8V7~x-W2??fn@waBUZTP%QCfj4F)$t5feSbzz(EfNzCSj_WI`l`W!<(q$ z@lqLF*LxhvDya-kf*(b)8Y+W^_CrW^50$}Hzb#1iFsDH8k5Zs;1!@zL?WQsq5=TX{ zb}BnS)%wSrQq|PW32HoiO^t_c`r96AJU~_YG-9!UpHHACxEQqqJvn6U?kJO#B5NUw zHTC)+dV6X`+C90xsVq=YZL(fXF8MG?pU zSXxoBXmMFZ>WZ>eWy=-?K;Nd_G1XVLv;u~EhI#?m!OK@^9XeRK==K#rF90nc8$z?I&74&F9KV{Gpo6-#(bAQ&L7tV11hzi(|Uos;pQ|)WJX#) z7=Eq4+%O|;K*P+m6ny8ZtDr#5&D1&%_TzG=gx*f~OMqr(ni+d8)wk641z6;DA+~B^A>Pv@NRXDaE!v4%(3&_RzcL){`*KpS=-o<{xT3Z=T%0VFT2s z4O^gg)wbV*qtqOrM$LYyka)=f0hpoGxg@~vcIg%i)!e}zTl4L40MKMfDJ+KW8>xm1 z>i%%83xC1Ejd@0ZT;C49sw0qLYi?KDww?Vc<306AFwWKt-Vr1&ZYu66GPF_kXSe_e zz^ix)bzdI2W`J@uZ9v```=eYl)MYR?H9uV~uy{&J3VRMV-i&Ui^rF4Lt}yJM`LNEzXd%}izNcOB69wwXQH(EiRM)Gx=h^E?8p_x0av~oOC`6h zIjFRLWk#{C4X4$3*c4iS&e{(;o*jCo)FgSyEy(ls*>=sg*qRU7-fGV}0C!gdeL<`G zqV7U+@ThIqbr#pGLnn+A>1v*~Ncg^Hx}arpw4bErWJV-M1ei3DX$tt?VCl}0>_L-?LyZ~> z=tbY~H|F3_H3u)&4sfeGJCL72O+lzFeYXW|n|T-b?J%e$y&k+2xzTE?&d?ih5cN=f zoVr=QPU~kmEwI*t4$9Pz$>MPybN2W`HBiZTiIO>+gKRKZgDC-%R&&~ncHPv#+@=jS zG+|9zGag@AjOVO-($Q+;9tT=&+>?t|8~0p=RvY(>LaUAS-GTnjW7-tjwqswYOAZ}R z4ed+pigzA^-A3{&VAM#d?FVY%&6_0D$mBOFOeZYd@p& zu}@^OdVHELpKJAgSnIi3SbB$QQa^E?3U!!6$L*n7m)#St!2LAY`^L}ss%GfHn+pcJ zRMZkc(@}fWtFv6ei$a}7@Gs~a^%L}sY7Z>3HD7IOPS5xym=o%R&JNJqsXcH56rzJ4c>Uy+=MsbZuaW=C2HP`h;gc<&N*Ui8hr$YF`hG3Zk%NdMP%?_ zgJr5(0-p^Z7lm3f@rHel5e$a~g-wpBMbrn|)|{7M2pU8CWKerqN2;GJZOZ>iJpc)3 zn;JZEp;m)iJ>Zv6)YJx#(lFal5MJS8;T7iZE22YMIUUlT;FQGkQTwx<*tBzy$j!jC zgEj@c4jf(24!xGZ|MoT`+P?$kd)u)O-B67*OPbqbTMw@hb{?y5v2B7oE?{D#&e<;2 zAGEE13%**Sdad!U*1AGj3VkR|0xiFK$U4&`U_PwwPvda5&Df5L)!C#CA>&?!mS||N zxd}xJ{C{&446H(TV(*i)KC#_10%%5OH!w~ogRwVLov{-bsn&$#DFwf)$ zLz~ok+-x`!`llWBl&sImW_-9B`9P&=SDgQ>T~}_|S6kSXh`qXC6M|gTnX;{UW~KsP z2UK8DD54l5ei)mh!0?l9a(yc_R8@1R)nz!F^#iQ->bJl*a!djvTlGWrJ%PSxtW%_5 zVhL&HcI39GXp@l=(hCP8ZByR^w2gN`)64{`FFeaqipmEIdxjJ?L>=*8!#jNrv?tn4 z2a+r0=pYJYg@zn0*8HZ2qB{A3Uyg=RRneRvkOqcI=rHK-=LR#X6dC*&NL*Fi)K?&P zT78R}pBFHz?#bbT$v}(eP7Y7EgP))co7Mbj;k;=;=$;lXbf~$+Z74q#D`9sURztbz zQVV^~_gc^@FjIAFt1_-bpu4s=|P;JX z0h*F_#hQ}Znsd#emT#b+!b)rlmr$=R3w-&mGSF!)jzA*(B2ck)6@;utKV3M4bCDCs zCW4YKCp7wiwhqe?W4Z*()Rk&$o-M1bg=arO(TB+TK$jUZUeJO`+1Vsg{*{Wru8kd=Iri}?tuSB zY1h$-@QdJQA0*o?lL;I&oHd)Qze1G5Oz>nwxB_@G5(lWP=KHdjd9f#biyN)px6r;P=jM-=wPa z)#-5XSv$HHCmP$X>~uJkpRPWp-Z+|iH#vKns!~)FNO7^2LObjQ5Anf48y@qh?of*@ zSj}de3nJM@-I8%Jn;_2zI%E)5W)9?CvXZX0uB6_2E2)oOnnL1+4O7U%#bpXnpiEi5 z5Tz`KDnwbLi18K@FiAKPZrNh2j`cBTh%7!Qxx?KmNCpa$QGz6klZa73$U)q1w_WrL zTR_d#ZISb-j9jX=zL$T*QZ3h&9o_}c?yk@xe8B6XA@;_~J6Ezd-KxVV)Rld!td~UK z#bTTUu8TiHCHfL-kwR|4&Q+e~qeEC;XCxg4&&0LzG6`G_hi9PUs06yv6;n_#vKHif4>|%y4QV1qG9?b6##vaDH;-tTs7P8ccJIQVulG1fy@e>(=cUE-$iSHY%O3SALzmNd9;9UkdX3s5M(-FXgBWd zGxQq@!60o6@2rt}tDjUMuS>$Kl@27*b| zqCKIJ@j;wQn^&CY%0psS-AOTI6rRnciZe#PSASy^&v?>nDbJWO_=r6!Gm^mX^emO= z-+i3$?oQ#|$0H0pB7&|%2wtX(hd0bfFwuQyg1|gpV4f(EC~*+u7`Ug2p~o5tCYsqL zFi#YiCm~E0#!Tg83`u3C0s2qPZF53sD+Qt8AmSHX}=;P!9+7p7MQaH<|!QW zg^u@hQNETK2_~9(s=z!&V7>-n$l;b*FW&K2hORLZOf>T}f%zJNc{;-6;TheCyH92^ z^aDnM(OaJBI2CL2sd~vcV*5$g4(l-N;-LKXKIR#VpkiMuy>2<#8j(pXZ*x zgr&MHj$v5ry@%<$>v^u%v<*(V)7}zcJo#}9qtMo}IVR5yl0E`u&pT^QFrJ1uhGAN? zDJIX2h-Uz8O$X*Oo|ZUl~KQ9DEF&@8(VGs`r3$QXK&uoro!h|`0V>}O;7)GHz*B_Io zfa3`d4?n8F-yN}y@%(IJ7>#EvzI7>w=$5gtX?Bplj3f{P zy(=||KCdE9ug-h@tc&G!MLfgsJ*60>N+34kb=FO~Yn$R3hEFvIr7~mOq1>0wu~aMK z8HP_)!u5htx#4SBs{7&@hSzm&LD%I7y3Rv2KdjWH&4(Ui=tw-l5FPbVd~dUxxk6qZ zA+LD|Gacu(=joke8M-5$U`Sr4dd=%5A+LEtUh@&A0Oz%7d+B6`J{M0gB(HdLZ+YD; zG?1Fc1~rf7MK}^Pjw4Q)sNUx*;CVWuDE7~VS0XC%rcj8dUe5$FOD;wW;4SuJwH4q z&q7XbtXx&Flkxo1%rH#P_m9a_F6rZBmw!9tKE~50fnk`QkB`Z7D_5(J-ty7SjAwiT z!!SL6PKw2|h~r86Y{od<*GXU)rsq3j^7uHba?6xe0p0gXU>K(7kH+L#%#~-u$@e=L z&r=Bu!}R>SF?p77JlBn1SzfHFyU6{x)3XKO`M|oiH9*6fhN`+CTg0rla4V)BW z%+-ku!}rr=C>6mqp8W1SOZ8+T!)UUW#NKSkN^ab_a@owQ8P7+F48v=`<%0Gr6|~<9 zgjs{#c{cU&&S&T|i3Fp!miOXRe9f=qG|~@`HPo{b8j=`>f3H|%k@4@B`m1#<%EB;w z32THBt`$mHi!ks|0Hj&?C_0#_)B}5VkIzc7+H*FB! zbffU5=$=@4v8=6`uf4HjEkiFzCYb0tY!sNo0<(%R&*SetF}ql|1GOTVV4|7t5tvnh zxd~yu$NNnaEYeRMrTZ%HPY=-z!FN=2@JU(|2< zP}aMjNoE+nJbw_%bFWaI`w`|1+zy+boAeq(A5JD1(oc`~+E4!|fd6!O|4-fYo_IGg{K=R^B-YgSf<;Zr@#jXS@zWK3tNHdz@4?TwbN=EqZA%|9a4{8pjn zwuAz%4@YxF4dsUZ2P*Ou_8P@e5Vd3GSoG~DWDy|?}=-Kb|J zm}ut51m+!@KNK(ry-Svrm3x=nI$rV?WsmbB=SRsqJ*U`PzOdYjy&;(ZpC-h~s+N?E zk*@hyVb_w}APhr&m>wYgc+r&wX@DjZID*DCCJ<805a{&ywQL~JW~LhkKWT(4dEte4 zPv91C69$lFQM^reJMfY$f=^rm;vooN;do5qw?h)A;I&$QJKE0{a=7%XLH2tfUUYLa zv|aT@AQ2VZ1HJbNOQP_>&Qtghpvu!E+;eTU!nW?|E=H;0EF*({QwxA5K!~!yK6G(q zv-VF@7`7H2@=Nn^rhAX+Y$itL@U&ql^W1HS;WyvBy73YJ<^~wXibXN(lkgZu(HqPIR^DoLUY(XWJwagAJXWbu-m|g2KHAqi7nKU z*h&M*)q&DjHAY^WN9VReD|@c=C)Jmfg>3O{a~h?W2KW2w!a|YVDa@;rYvd@DG%eBk zs)3|>P#IHKn!yq(wW>!0yo`BDRohD`wpjiE)RVe@hc5ttLrdIU3vg9sen0n-a7_Za z=q+3|g*eHMDOgEz2#B!e-1qz5lLv_i8bbmmF(he7K)Y#*8*p-SxU21;qaE5=-DzjL z-JOmz3|hsNOCS+;RY0XE%E*qL2Cx|1mA9n-?|II-_vW#*owf@je)s!+-~W8i|M&j= z8#lL*PC?zcr9-kiHguyj6K>iD%1uklGbVXGL0=@~4oW1vvVs6;tLCv$TU_7X+4Q6u z(-ZSMgU+y9g0RX8PWnn?vNp%_R^xY+d0RUg+lg~^S2OM+$c+!i(Fr*X2Nw&*U6-^m z)YoAG-rGgHc4x;HRH3*okOzd3AJjq9%dKDG=GpLMYkNDce#Y{V(Mpz($vT!WiB&8i z%^H@FZUswda0hDSuwzX_O|7HWgX+4qbA7|c-i{_#q+-nLkUdUcM5-)yc{f)sOVvSs zkJ}ZD1*5d-R{$(P3Ch43)WKtt+Z~QYV?me1sLM!%vSn#lXHbedWJk;y@k%bL2Scb* z8MoQwF#}RK;0ekOmqXGplT}s_?lT&%B0Zj8ih2XFXjl$OHB_NunzG6YM2<$|EzOit ze^`!%9Wjsodz9UbMietf47nrGP}DtD#PalrPRSYZdBU;OFJgRICVb58@wfwiPioFk zjEo@XJoGKPqwFAsB36zqk3U1u>>3fD?X~)J_!$1Z00K5>%sbRiC0+Ls5S; zD0`tZ)P!N=x26#8liMrF6@w9(CDKQX8Y090Md#L-Hlt>d`s=0o{%5% z6>?}5Co1#`{N_pd^+V?tsJ2F2RGS5j0aF3Z>yi1#SrF=GC~uKP5FWHlE$=sL)0z^urbK7A3uJes4I_kYgH@qgU{FY5xgZh;r^mWYSregJ7e zmcLuvZ{HaA7mNyqBF__}k~#iQ?|nTgS#Eyz=1Zee-j>>O>!@TMKXZI|n6+g=vngc} zh%pmn&ZA~EHdnF^oZ{hxZ=ra6sB0pBZYi2SaMH*&o|f+uia@unBRiW zw?p#pSm-6@xC)3ogt$B;UtyltnBzMLwW84LL-Gygc@sMZu390`mcR39WZlhO{J>jQ zOv3Sn=(i~?Uy3bu(IU2(6?shQ`bs<^UO1LKb|~Ibth5w}E#q;2q1a-96pQB+`Abp0 zaqN(IOgwSyz`%J!yu}`u3wrk`%N3tliCL8TJmoK~@xEd!dY_Ir^P7tW<)m^mIhv)M zEgHN0VbQ0#pCis3({;q~X6oB*PrhqR>|65k(?5Jf87sPg$WxRPmyZ`6%l#NJUqD3D zHGmP~w>RiIl)O@vJyz`VQq9 zl>y25E9XDyP{3cj!19X#1thOH@QOI1oW)k;lDZti*Am+oVF-BByeVHRH^qzMHzZGx zg~Xl`3`rshC?Cog=~xAL=ncR!~b%{@_cO!=BcI9YT$_d{IUwKQ7~V%SYwh41BF zExLj#F&AaKkYy0nHm)y{q+Rn#6y;*>c+qA2b(HvGEgVX7&peUsknjbt1#IVBs72LY{>dMt0?;lt+)1l$jXRKIh`ENGOZ&Y z+`afja{Uq9Xpf0U#S^C5eFe&S20(ee3jvgq;t0vDm^8Wf6)NY{JSMhVG2~#k>CG1SujEED7(S7A1WB$fA+G4UJ$(%e8bw(lz$7=_&2k3c9V6S6Xfi*6VtKY!;+ z#QjKgk+RTqTG?tgjVnHjDH-=!6knd{K-`z7_^hTw@rCiN=D5$ganx5p_z|8th?Lnd z8)>Vtwwr5ZPgQ3L`LBBmHhzD(P*abo%CKgv-adU>!5dy;jptrv+#8gZX@A!gV9F@ z>(&l>ALV=|YlnR_>o(!vxrB(xdxyJ%2Dy?y=1mR7Ms;J|c+|3Gae> z&M_J9x5fKWbGC~6&u3HGsG|eFG2!=4i;tKNLup(yDz+C*hfRk+Jclj)+6HSMnCLs% z@EEpCbvxkec*V5eBycP8nO02Z8LXJl6`U6g)32CN zY1oZ3TjAItT_w}3n2@`ChAXCj0Nh^F|AQ5Ti>@G6-O>tzHi=tbKrlKg@wj-nUfds_ z7q2sG`Pt&NFIol;7@oO?O0n-EOq`HS^MXV_nkie+2&pt&fpOhFRA4oJVgv`W%y}q( z@2`|~KeEIduD~#2kAt%h5jHp6m;!o32VFQha-m+Pc?y|kEp%YiIsg+TL;emw%qs|q z5^ErYadx&bx)tB!Wh|L+}&*soX5gmn78hVe`zi=I7?=wI+IE@i=7ZK$c3nGntmV379$AQ)^B1 zRNoGmL)mKCP9|?H41iD0npz&Z)Yc0avqhaWPA0DfFi%ahZ-t(;{SYw6Qsrqb9cT%HHqkEhu$Lo^sa1I({xu>bZk zVE%0ydFWc$*MJ$!Q73GZ$$K9#r*o#3hj^050CSLDVV^yPJa3+Qm3uOIXd?bNV0!YV z&u>3qel(3d#N+l7U}CeU&+iL>`TN;Z%R2-A{WD;mpQE;)$>eY2n!xqRqsGf(_^FS7{q|H#pKV)QteNw%S ztJ4BSFpn;*iMh9V*tM84HxVOmB-F!0quj5ayB_DRHjeAzu72){bIH57>u+gs60X8K z1g-IP(nSo~od-;1U#Dy>8SzR6#b=WlO}v@fumFFf60=vq)b%9i#vN;8^uG1Twvb$1 z!#O)?G$mG0rAja;b=EcmGm9ZBJ}Yx_LlSPZV__2*hw=idm5C)W;#$Q+LzIAlm|kAU z3vB^*{TbhG=;MCdc?>qLlETQgs#_4WrS-Tq#*@5-8oNZwoGQ(aI&-xaXwexkDt>G@ zhrZOw#?ycb{Bb*FFCm6GiQo4q-wd%beLwaSDQ^xjx=Q>Ul-nm8vmX#YncOZ!RwV_w zcYS+n6Lv;An|s@PHw!hbf4ZKTZ7uDzdu9QRwzKSNp)78l1!D3))6=ub^6S zEg5l00?gQvWteJ3E~(;Xo3T~Kdw5~rqhpLBj3Kkg(MMl#0qtTi=U2v%5~`Q$#8ZrP zdnu@>(kf^-gO5qruYNT*tx^hpZ=ht7jj5r$5^T-A$Gmd1@0-O}c1-ktF9EBkYSSUD zo!PmF-L*<%pXKCgm4^6HWq2*FHZO03L{F8|r}d-@yRmB%-MAnIz6nmzb-9m>7gI8^}Moq@O1(RyZJkW(qS6V?CGD9S* zK>Za^txfoK@szPEVHLJO;axA+i zmnZhTU8ye_aYC1inZZ>h^X^u&8Wd`YtQsxA&A5WH6xc9-NgZ}=pxeOOV&BG#;BR=Z z{YT!&+2oEiW3psl&5ARR_FwM{UeW}G@m6ppLDubMpu=2Yj@^58NZ-w z>t(Gk98l2#-A+b2IU=Jd(fc&&)4aY_6Omy$CQb9qx9gvyI_d{P$1f?3AAGB+yGOHK z&z`C3zaCHXc`+@`jm^y|n4hF!nmW6l&YX*x9}UE4F5<86v#99T^hX1l)q0MepyFfO zYIP#8PqXUR$I8`F)ckmVPpKN~3(ejG@iR?IUYnuH z*ss-Ciw!DfI=Wv%!COv4UwP%YhBBwhpknlOkw1gO6hg0i55?TLwDW|D{yPK1q}KA> zG|AR9$%NqcW!h@Ldj8B)D*9&zhGA{&tu#9157K--)e|Idnu@~tjQ6@h zBA~esWMmkwX^p9m$n{jvQy-AsnU)@VT6zd|?it$iPhaeoRdlhDVNxaEohJD%EV;}m z(0lj2>+vfZ{PqSEPS=L+O^qEJ&|Q4^h2Gd~>TJgD)=lWHJ8^cj_Ov#(!%9Van-Kyu zw;ZWb=Fyus=tVcTZfR{MxJ|w7J*{2sPm@pfuJ7q?Y$70t+|bpzbwjuIkpRE48Fjj2 zv54%J=#q*&XGwVz;c-L)u`popQcDBDxz!3>9(A}qE~n2S(Y2WV5`5GV^2D4mzl2t3 z7**U>Jo@O5u0!9Jz)70~Xl=Pwa56w#554UFA53dAVY?^b2Z4j^qFrQe| zu|Lyy(JD`z;XZsb;CiOnH%BHD`q6#aoT<+z(8~PnoSA+16yVNJv%fw9`TQ0zZ{4A8 zQDpiq+G+aZc{BU&D!_&3{lV``)2@8$`_hY^^*?)gwgK^yad)=r&dV_vx!Yi`-A?Zt8y zy%l^_ytHEi-OuaIdIztGM-#GP$b#3jy_XjsNQ4C=-IG44j3RqE|Dgx$*x$cs$hKs} zyg)!U6Kx9sHDVYzWB^zqAZU;)$NEknSepcZ#P;G{W@LB+`N-fQ^5Ru?6+etp`N6=M zSwrTzgWFdfHKT;ReEBA_$}=Gi<=r*7b5%ZI`aVqTDlRZHGiPlQh?md%@Te36#bGm-EVFEn52W230ESqo_cP%lH*_usQ zV_>*09=d~vBJ&}4Viz(HWydab*OD9~oG`GRb3Uw8VGfpsRyOgSB~-E7hgaH4|C76? z0gI~IcFvq(W@JWZz$r*6M;TN3NpMh6ED#2SBpL=7(p1tbrTB*eW%rU{2NFC?uOGVg z-o1SeBm%bnZ@VAdNe5ox0%VrT_J&nk7fQwmGNNo^wyO^~^rkNGeBO?LcY zJ|Sa9kPMTRI635u#2@@KOx{eveis7fWBNd4X1fVOTkZvg2Wd#ELn(cm?SBN<(Z5C6BlTU%07?M<5Pdi(dS(4B_ z48}pewYo3bZ{9ty;^+wJ;e1)77w@(hxOmgAse_e|qX|rVov5M7?sOrns5IRt#jn2! z-QGZ2`eYIyqa|2$V{tlr$!Uj7-)W+lJ4wWA;s-!>NyU+nV-V+`oZ`3sv+){&z;6as zIgzzqE!^Qmy)+${9;SU?rP{f-XuJ1(dOz|c3W&R?xjNmvu%zgQR5L`#j-)IQ7R)L1 z)YJjq79bS&y)B+3*WuIT76LJO8G2V(5D3crbn?ctx*cULkPOdeNrG32B>i2G=Q9H_ zL3qRC7igLEu#D5~aI%%T@C z#1RAv`Q-M+15I*>)KY-j(;B#A@ax%c6wMmAXT}(s?$=;Bv&zXIegj`NAC&W{87b(p zIgfKYqx)tEE}J8e&NkJsI~}L9J&&_Bdl&@Hqu?8);F%O0BL&A|urcvcuynSDri+MM z;n2E`Sp$y)4cq8H><`s&)1WCE{TKBwYGL|Dhadc330#I}hZ--749_ODuq=0~$x|X1 z@Uf9I{LVwSXOIlP0yr?kuK*6r@XG-B+u%#`Nrc~$$cFq@MDVFU7lHGb%ckB++RO0N zM&Kop;aL_TEJ;a3m`n1%ob=ex1o7_il9Zrnn2XEMt(N4Hq@%>sSBX4Psl_DBh#!DC zdC}un;d5og3Kn$LmAlfWJK>6(P7??Mjyq5@rru)2J17>j$!4FH8m>MwLYT4N-~#(` zewif&+^_KBCKW@1%rxJ*v{05g7EnWC4}30T?SAk7K6GD+4?4Ekuj&XZpo(?)!QW(q zqk3j!R6AIFjAW=bv0zbvFuC;V;u2|18B4N&XY7Y7%Fr6)^?LDOO#ZtiSsaYXf7e~b z3cEy2P{=Sp63+7A5p6!*dwanDxXvRYW!X6 z*T3G*4VdZ{!`(rqgD#F@&TWDhcbufz3}AmPcwT5eRVJrPl^~r^JtWLcg2lfbajukw z;(_mI#jFUL-sSFz?y1ob5!(8G#04?=@b-PczDPca7E^u+)TB3I*fPp%)lyz-7yY_^ ziGC(^D8$d7V+!%}=f5ewAzGS1GhpKExe752J1L!|r9oPP47&mcs3bx!wPGKIeL_p$ zE5%X4%|KulT3X18bWgJ)f7nlJC#gjKFh?cAHmF2=zoxK9DeO-a_AV`bN^1uw%ostX z6A>iik4fR6uqs;G5h0GxtQKMEv}C8HHMG<~OHZkZP!4g%8WFabmey*-`EIAM7d7I1 z;qeoG__RhG{dcsTPD@uvE7n>mY$+}MMl0fbLMw9Bd$i)`Z6JS*K6C;ZY>@Tglx>Q5 zqo|MmJL}+ODQ<5N<*AA6tG;$Bsh%E}t`~Kh6mpBGU7`>O+ijr`sic$W*Y6YL(oH*m z`zL8QPO*)shkiz;b$&wz**~IQJVK@`QpvPXM0XAc5rkzEGTcsI>*KUd@I;3=IJ6AX zCxZ;gAgoM7X$YmElsqq@%lCK45)}>CFupbfmcj(K%3;C}5G~irt4GkvHwcO9_H2)9 zkpuyjq|;?X=&FgHK2@mgU3%@CzIknAq8RA zyg8^=Ud)tS-kA4*Z-iZbT6yVs#>vK`myL&L+~HmTx&P{@E0Tny5lXR*xLZuhk*p1f zR(_ID`^2wX{za0MLFsD~N-J-`BfK5;$OK_c1yIP!OwG(BqMHg5Tq!GSUe-LJ1&swX zYO{0_;&A0%Bez;rS(2aX$VtO3aQMnql@&NTQw?cSQJs#1NRATZ5<_d&t*wSopu(RU z(Q1=FQGXh4RT7F-;!YGQ>Z70?P01;;7iBNZ&&d*0us<&nrvK!q$~8MHJ3l{vao(-j zzK~jY?J`rzf@RJI$yw&?x*8JDFUOvpC0Pj^c#bSKSy>wJ=hm$JqQauwyzC+$<^mdN zEIo5JdQoMjr9zb0^_4XCm)}#81X2~T+OuxSx98kkR1gd)j5Zk7$PKG!|1AA$nl(k@ z-D<%4*BxVh$=rkKU)P7Jf4vec9+1D<4JY+$km+Bu+<|&LU_RVodaa&A?FK@4!2%Pd zRE3A{M%3<>5c*v3fhZ3X-)~X7KZL;7g-6-X9?Ek55(hrNTfGpjh~YXxt}6sBI)T7Aq|phkhiP&CR0qK(#M34H zxr%x#aNpQKsmghju3C%f9iV8~y##P?#<)GIoy8dUQ3S@gk8&3YZoXQ@+qHbYo>%av z;y>euFQ14X)cwffATO>)&DQ6tPI%lJwllt)A3$|OxGvV!YHTdv&D1Jz?J>X7EJGDL;VkO zdeafTgw7p{g3(LD^v36vwH<;ylc z7`+9U-hbTg^~&d$h3B{T#IhFo{A`%sl&FW-$?4@IdXH^>@(QKLpFw?bd?9w3rI7D& zwT*u$=iWb%8J@a)6vE%ccgLUCeHuT+ueaFQPhGEBCu?6TATvD~{~38sXgrOYRa39) zhcGAc!w^oVQ(QMhGwVOI+#b&uL=(n2K>KB(85S>HalNN~9HIx~97LiaZCxX%&@p_h+c`wrj*mWf~al(YFBqKY8FJR>&K&CV_Jj~ z9c4PE_SFYxCkyi;^l)7vqIO&}w%!uBOvB$m-MlTJ|uFteIS3bLZOfRD6ix=ed z;t;)oXD|K~j9v<&cT&0Ou3+?Rh}zD=1eY*B>yULA@ApPc_Piml$E|`@v<_PbU~I0p z4BPuR@9^x`u><^v)x!j7Ju4y}c7Bh7pIv7bB#bbk142!F?t z+baX{!=8Keef>Wn{D7T3EZ|>&@Zb0SMK7SnGz9!`!+x~9u_+LL8p40;w&yqbsK>TqC|DGc!6432( z8$XHdzI>Qa>9n@9HcNWTBv+&Mk)sdxdb)J%BD9rT7O5cSR;MK97TA_>`)nN|zZZqy z$Hb#-g6K*Ih8uj5k@sMqI?p-Qr5|*eu3#Sf^UREcEk(u}6_;mX_zyij*D^(>J-|{Y zc4z!pZv%6O5{Ju{5-Zr=6vYajXuVuVCb!R+appcSjf!;@UgHr|FCAIjJ{9+FR>qn7 zFRkugrL_;RBwi_J&jX?|>e7P)QTg08OR2r>NovwOfv(Rr2((+}TWSF#Qd1 zuG|vw24q)D^br3|GQldXL^tKiQ*!%aUAHoOfgkQ=MS7vw9q{t2SYdsi`bDY)5uO^m z3K1FXdg{P>FD>mATrEwMiDt3bfc!o6?=P^Fe2%d+HwzXGy}m@?5i9HqZMK4d?06pz>%{hmMf~?Vb&z9bCe1hS3gm3Ll5j4kWY#VYCBf-qo7W?cl`<9 zgh=q(?A%2KMI&G*b)oQ+Rv{?JcvWxsKR2O&nQ61<%uSy+KV!j-=&xb)Pr)czRfJlj z9TTb3j~!<)Mn#V|U3GO#>@}ph;s6&qzp2O1@!cO6n{tt{zG3 zN*n-G0&k?o$8Q2I>4lfI8e0*YaH&mD461Qn%5k{#duj{*H2r$u+P&P6>YhTc<#8Ob zLNqhdc0gnng@Xe0a)5J$GLJ88YOsW@)jM1TL1zWynTtmfP2<^sTZ5Gbe@exrEFn06 zNl{2`dmtu761DtE#IW@=K2Eh@`>e*+Kyz>jzSB~0sa|l(Q`1+l^e4d=&WBgq{ev{E z=olk7c$qMtc_aPKiVX;MvjAf$b6VZjBi4Rv-#nYeSpE*YJ`E2w)3`J6k!RSgpTV8I zeC!_Ol!>YOjzRNRc zY}QZU+8NHvY}3KtTJdk?Hg&TKifB0f+`CN1dW)(4fu{btr@{8IVnvJ5>R#TFEWA+F zI5bTzF6GnJ4X}<`wX&viPMX9t=FjvS&maj{v;CV!rPTJkL5Xe8Tb1Cc#J%UW_BDB( z{9nal|!iV2&z1$qZ+jw?p% zSTRaRr~_5Ru+h+JME3|nGB~z2qG2$yE&?_0y$EK^Xf4}d^(VNtsGNyi#de96U=vt5 zViRd1yaAsum!09g5>GEM#W$5ZL=i`$1(dXQ>`Fl-9c>nPJm8^`B;qzV_0_KT;l*xJ zwMu_CDMZT%Ze=9$ij-a?AnD6t+Yxb#D-DhOQ@W> ziX>8}oh39n8M(3{@O3GM-9<0&4HWhiLk^os@hU@Nl$aDp84^j~r1+Yaz*Mmqmm-y7 zJFqMvwK=p@PD^W*VvmQEB%+Z?@uZSO_A)76QIf#fCPk-G9P<$+u_{w5PAJ70_0d`_ zE0%=Iq--NiTxYIcSyOY*rY)<@BzIJ#*k)rTs$A)-MxXBH+BIuy%=X+{B-amoG3>&e z?o@pJ+$@Uzh=9{lZuLT{0&5?ydKBNn!4;Y zK4(A@UMxihxenx%X=VI-Qq$rn7)8A$wl~(bNM(1H@ROtm`8#5mZ{$0;bBfwY+&QLp zJo>LL&U$2Csl{S=ydAv;dZXXO(nuYc(kpsZIGAItB?Y~Y%=~^b?r)p=A+1I2MBYG- zOF0cyh+`e$x4r5q+_uZLnZcsXol%^JX*`0~;Sk#+bt#4QOKiuHl&;#Dt5`6$R<$6q zE|R+dPNhx#_xJKK4ha>QAEJbozIJL;f9+)Sno1FU7wpb58XwA3A&$gmq2;RuIVXve zM-E9cm7blEVSsiREXZ~WM~ z7AjCBOky>ea=CAYwHC8e426nLjkDM;xQL>eO^2=8a*ql%N)v}4MmUiu^wXaq+xz(syTEei;Ide7e=;XfFLg#W=XOp;@Snpb|O-sLl6l$s>_ z8$YW2dZixQ-0tf&Ptx1J7m@H!5Jhf=FD^>VP9-6~{Cg3ZzeT7|n|Z-CaEFA&Uh zS2Q5~)Ua?_iwJ69D zAge0xTD!3ZKTiQtxp6fZoXkcfVvK`5>HpPjOHgU+p_*mEnHR^hWeI2qJX$Vu3Zc3SW!W<3@_A&t1aK@s zMz#yGNO>JJ=O^zxB#KZyg9)YvJY$8F#)MGv4vXa6kBF4HoC%?Z&>>)gI1T{=H5fsm z{-Ak-GeY$PCd46NsO}L(DL3}6mfnqU&s!#h8VFO38GWOGIfjS_hDa!eNIZ%N@{A`` z1ei;J2*;vw$f0Dgg|^!k2P{XpIg1&g1|qhM89iU@WX2Wm;tUJ`5ACd0jVl0vLrc_M zeRNbsmVcc*LYwrYgEWvpfCf4e1SCll1cIhJouorPNGBm3F_Jb39g-LlOu8XxNWeC; zG|zT9t7rV0;~r;5_w1~?I)j75dPqW$kWu_X9TnXXhaGVkkW~@bVJ2I*>Q%k>`s=lL z<`3hMyuA9=t*Tq~>f_#9_o})?BaX{ps{$O)cse;nLcbd?IWAN3IZfg8@2RhZ8mZ2w z;w6l-r8AZD*pGM1%;zWZ5+?s%LLH!`GuRN;l%t;WnETz1&t&Tv}wcmRkyo%JNr%BpPhgtwlBYt8#Kz%3pWx&@; z6zUansl+P@5#SpLx%QyAP{A%ixEj5lR@t2h{G_;wLW>f83SxO@@V$%*%i78UTWLXo zEzA`Pk|p>~hIz2mmu#v4JSa0NHna- zUNWMIq&0mFVNR;tPyu@XgD^>x)agBfF#k5`2XMpU`$c-DL*m+1sk{I3vBKNV2O!fE zeroy#)=c496CD4Y!hZaB9rkVZEEY^SsI#+jQ*XPdK@(mvfm^J)z{92^kWCbkp*(O_ za#GPvmU;NBR&-{zZ`Xbv-1w~6<>6cJz)>|VeP?ANcnc!-0vGJ542CI4(oMCZvzP{NEZa@Em*q2))_2tVU zeW{DNFMk@;mxgG4c{xm9o{rR)W$dYu_25=TU(R5CIi2<8bk>*CSYOUyeL0==<#g7U z(<1ccDp_9|{=qh{vBZdlIzih#uU`FAG)MW#Ay>{*x#%ZAj*~mnr>CA3-1l(<9lJAq z+OAWUg%3;UDu$soyd$Jtn?v68M3gc_a+DA52wX5_yS8k~4ZqF#j$0K>tf#dxTm33A z-g$MowzTz-O@!L+VMUfXE72T#X_4LT!>B5-e z?BcS9!`1H_M30Zb<}?{$Zn!SUMl=k)!t10MjnU{qe8z1t*s$(Jn8#JnBjLX!IT3+)TUfP>F$Us7!2 z^d|`SjLQ9Q2(kA9!mQH;*)oTjU*6KiR_?n9cUt!YICYeXr;fsFI&}msCD(rV5N#%4 zW8>|18#}u^MkYp(%(ICFNh|!O3QVnE<2%BSS$TLlX2sKpFfy9J9AeQKUw)%Ih2D|I zm#VaR#e9ESUEpQtVIiT8MNaeg^Zo=^1NKongArTAhV>*ShYqs4gBsz*fY{y5j%aO{ z&Ms@$IEj+k{H@%)!<*26!!p&@wa2xK78W&BQ%!z%n3lAoje3p0h+6j;g<7=Pe{=C0 zRq^k)YsfY@{sLTSyR?%Z93J?zM&<=}V?#aO2a_0kdUglvM$zuTfNc*mh`%gO?xB~Y zxikrT1o3YYo&Kw|fEyS{fYo8p#v6mL|7Z(uoRe zALhDdG)}x!PmC~Evm=`!m;t!Gu$8a+#jlt+-jB z80*4Mb4B$qaY#+fdTwPbDP$~J&(Uae&CEUq^0l$as1-jAu+%-`;mv^kz7gA+jGjcc z2f&I_j$8m~`3E1pg&2%csL{s0p4};tj8UkW6R(&FN)>NH4OV#BS}6TEl?E#zM`n|l zYvy0uyJ##oZwroy!;Z|+BVENFH*S%Lx%$>!3ncVrhQVb;RZ_+t-7Qtbe0$9CyoA1+ zVbqNY5;=AMZ%NGf18R1>;l*D|=zAH4l-1nP)#H{6Jy7Y5n-qeP7LU85L;0r1?Y>L- zrfaLalZ&8YC#En|Pd@9VL$Y;bP(R4t0^Hy zEmI;~>kW-RM?G3TAID#n&^Ly}pIfEyuXt^duAcKy@y=T7sKWSt>t&uRw@tm&sDo+>oz9Qv1q>(VnT*M%QipZKZe6y76Lyd$X z@2+Ub93MJX=WyX;-O0H@%rBl4=Yqq}ebgo!0dW*V=AV`hZ%?cITXwbeG7V%%9#k zPG%NS=_n~Hx2-Fa)Y9UyHa{1gYx8p@{W#UFx4L^>ZJnFkz2vb4&f2YE384YFj>w>XQn`EGApx7*g$34_E6>S@C2B z9Gm3s6NEdLtS<4tlq}uMk5n!QQErX#_I@kE^{U+7hr{H32s5fuE*w8k#aQla^v}|i z=;eao=jN2y`mGE7GoV86AvjkeO!}1Q8VQ()JEo{hgrTXOG2mb~w{uEteDNdPV^gBH z<6qJLKS!8?>!p)ZB)+sG%sndJ3d|_seuOzNRoWLuqIVbC$lYs*P7lt)gNE4p?L5N$ zU4}7jbXs(JAfGvpFt^Q=`jAYnQ&E4Fb3 z7X4Gwqn8WSnuRdA>FS!>e1xe~p$DS34G8mKy88F_Glcn-3cWv||6f6vCuXbj`8dLS zGCMjwI6Z%kFu$LpKL1T1jDBu(dSAhb3}KRtLGwWvdUk}VGe)Ne`;tb4`P`_^zrP|( z(!A*Oz`Sc3!t~5jr}s|?^N0$)r$Ka$FvauL>D`Vn?enA41LHam!te{!>7^n}=7Q+- z_Mn6uggIym(%^@oXUO0lv+Y&TSFO5zQOvq*+jQ%ER-xJY062iQ6 zllu2IgfK5IldjoCqBkvz<1(_M)7yv=mLbdo*;2kp^p@nHeQJ)1#RA&k79)%^SGuMY ziC*Rkv`<|To!(LKIDjzPmC|*bNc7^+x#;>;KL8E>_jAG|9U-q>c@O$)p+vj;$}ejt z20RJA5skk@J4z3Ha>ct=(v|!AwHl8y7$^QcR;&dw4fs~~^>`7O!fZ0rm?dUYn`^7P zdrM=dyVJAU*zIoVF>Y_{!G;6biR^GF*R}shDtmW7E+azm8mze2bJSIlffb)FFMg9- zRsq6BRt1)ls4y9zRhdDwz2zpYVAbA&tCHgzo){eVTeSn3n4J#ZKgDNRqw!f*PWVgs z9YJABv5s|_s8lDu0rX6v&8i3zqSeO6W>4ETHxa-Xx1&lKJKdWb;hk}*aZ{JKsl&Y# zkekF-Jr=i{Bg^cLtUp97rC+=`CXxUW2$+Bh2y7^nIa$Sa?VI z!SR7FTNd^5^~6>E${Ak0BA9@@YDU`{yhQT#n+3f+Kisn z#>}3!d)&s1O^d`oJG~tpqAk`#jMqe$v4olfqyTqPoOONkIE@GH&l@Mft{D6N8+y+-rpdd~_q%%b z#kv|cqTx3(F*uGs+ks4MfKbKzQ+!r5{H$pBS;G&%sT{q|A7BIVUs#(TX9JO*l*tZ} z_V=He4Xh)YS?XOZbtlVvA4}cKQeR5uYQZ&&d0FdrJ2Vm~{S(W}Ka8>s<|_^)8V}y$che(hyPwBC52D z6Pi6C??V5A_~E>x198Gpp;Fi4wdHSZ@rTh^;e~45$mL19Pa%4{1jBthCav|2 ze`*~Z$F1(yVRt_9!$AJZg2SU!JR{$Q+$mqle0_Vba$ch_0b{VmcSX~0K%ae!A19)L zhtoZujZ(Rc{KqX4a`1U?_w$fvl@4fX6G~vM057y3&OGZi}YJ8M3o%&@Oj5}E)ynS z+GJW{J{LcVT{@);Q{N+xQ{NMyjlAF+;~|XBd5!Rq_f-hL>gzD2^2Ehox<7p{utNVp z`^3ZqqPqso$*9bgzBeZ#O#Hs$H5yI-%1BdlA!1|1XmEA|KNK{{9uog4d1I$?XX z4LgpV=yz(-!WzDdD`8(yx5j5ji>p0+7u#2&fjiY9PtlT;?fl@ko&{{Vaq5IQ)k@cz zgC~Wry??5&la_0|F`CIN2lb*s1#PaAt+VwkwOMi3tRJU(S?W%f`iN*OM7(^Fr{~xc z+VL~h>T08>)!pqz`~7a%a~i#!iaow)_I7~HjD+p?kii1Bqj)+cOeoQT8%F<>`q3oT zrBvK0?ppD0pOhQ#>-0m#ylADoPA6Q3KZQCSSytJS3ExWnXbK|?%aNZIk;{r8>a0EV z2#VZl%nEho? zO+k5w1ItrqoxF51@4~EiE`8+BPWlMqSe(;%KlZ0VKxleCgYWq}p3&$Op;at2^C9rO z%2JcT*5NGn^cWj8PqK0GjN%je16wzB_``n?v#JWZBL&u)9v*mQMC(h6`5dWS4f?ip z!c1XwaRNF3kw9+0tqI2#AJ6+>*11ccQt~V0v(&em! zF7VEY&bkewsf=U)&N%iwLSU4!S`!kH?QreOpL2pNt=wdcvOo zJ{phmd4Cf=>N^fpUH&)KE5?Mb;S{<1ES2+U950Wa2>@bg4f%my8>euf} zjXyyc@q;J8*SzEUp;{iD@O^#zu5u0a-gyv>=0Fh{cm_Q1ig-j?KXgoNmrHncBeZP+ zYsYHw7;0dufjHTDBN`w)0Fk9LAz-<%#h0eh8OuEJg_{9N!cR=@8gXjnO|7*Mc z=%}hYKX2YdB19*Up~jM8$__S|fPo2xG_e_(nGE^;izMxlW)@9?frMZ(;l~o7IE^|y zrhK^M_x9X9ih=BkJvMp}ZmHMNKXIBqw7DZ|$dLr5H_x^fs=Fa5JIlKD@ zoXNYN_r3Ss`@P@${eJIzpF1<0uDuyLXA7OTg~pVDH~KCR)bGf<(Dii&BL}hD^+Gr6 zq5^{!VTEaM{Df{tu|1B6PX+f^Rfn3IkB(c}=O5TUsEb%r*OyI<%C-^n0t0XK=eh78 zo=p3Jyy@UAM$-Ot%`Da_w*-VQKo94L{b+9bOPqUnQ z)&=oB>!iHn;>76~(|hwUb^`w*)W0vTfwvEi5{tzUXs)siqgF3Q?Ex{(RpCFU3jaA> z_|GMx)GJCWqY@SOu{U{D%XMVzUm#=erYxf!4Mk@4Gxt>$A8fq4omT5%u$oaU^#Srl=P~XB6$! zu8%M{cO98=bObIFCmb`e=?aY&3)WfIS(!yshcnKEeU{KMC3M18v>M!`Q~kdnz7|H0 z7#zYHucQ*jVAM*e+#Q@oQp7O)uyB%t$&TTi$qWsrMm&>6Bjg$3cKaSYasVS1==hWXlIlHq2o-MCn=x&;b;XqEGZCAun!rmOkM+ZJ#cQ?2V02iR&(zP?{$vNM4zXwQGm2_7+aH+5!lkAp+1L(XRdA(u6zNOqgxoU4Nw|roDlR{ zF@zYk7-8f>IsD6xK*Kdp8gnO53-D|6}W>?7~DO9mb-5{bYn3dWij>x z``|VkKCCvRc@IvAgvm*e1{cO%lg;YMri?ReE?~RDSU*Uy|DlT7t{-Dv-d*FMwQxCD zZvU4cE)?5rD5LV=IEv3bE$CG);^kA?s)Jv^yu6fg5@lU(bru(m_RQF9D;nOE0#10b zLb{;RSv>HX{bwJOEe|$9u7dS6>`RTTa^}<mr+jQ8$|;B5v?f$MN-G6Mg_HocKI z_0OS`lkJKJ$EIEJ*~aGZ`*SO)e5hsw1h5}es7JH zMpF*UPpv!|{-l-H_O+Epr_g4VOMX!0c6GnX?doGHx2t~?rK6(s9Z@=_@+Y5A`BUNn z_P-{-GHtvx*Tzfv%NeO8`lAc|h+#|0L2?z<#QHVs<`0yNd3URwXq>Xb!9!`76w}Vd zOHDO4HL%PWo94Kr2M;+-(r8+5DpoHNC+A3G8lw^?n)eX;mrndH+EN=?b@gPuc7hA5 zZ4mXPLw%Wv>I?9^9XRsygjN)ZWS!e$WVoVz-7NHDy})f0xGe&w3C(+4By5~A*2G7tk>?UK2aW{#?dwo)coSi17-r49 zMf6#f=-aiTZ+pd;`}eS^AuAQ*(nR!}Rj}4KE*prVTDtma6F(RGie@M5hYUt5Cb zOPI_GPrhd1oq3?b4Wj^~$p?Xa8wEXB^r<$!qZ{1kLE3`d+YiIzKKH?*d>fetU4qjIaUq}47j(BWg+|N@&9#{^x#a#{p;q?VSx$Vc~ z03*7|Rw#zHP7G~_m?9g*6xk%ENLcukj|c_%R}rZEMO?cqq)Z4YHsQE>g+qG{e)L@myUX-MN>r+siU4zjlDdE;K+zu5=wfZOPP-{+yzlQ3zsh!SZhFtnll zaU~lcW$2HsC=+I;*RNBbqN$7fT94XH5QG}}w@QwI(BuEqLdGI2a{Cyx3}(YAvA2cWiEZlawa z3yPVzMM9iYtH4YIpNO7BsR*au7URv>7W1340?bIS5c79Cn-Q$bh?t%5NiQlmt%cn$R1|c|$`0}_PRuEG^zDlj zf>_5k0GoI`0FGExDB)wu(`Zq)QB7W-P-J3}=xG8M6)j?j? ztQX81bnRKj94-f8-k_zcqgEz*ZI`$fX8PeEZXzvxUX=c)*i1MtR-w;zcTb!Mh7_6q zKz8)WjuWr{caBWv$rwD=+}_<2OrC+^swl3K1jbbLF^Xd<}^!DukKj7KmFV*gwy=78Ij~aM3)TEA?H%g}57Z0*A z$hhJ7B^~`A0u%eBGpArYxM0ySs8M~vJEGVgh?XdcxJoEL2LGV7?a{gA1|3s$O!QqD zQ4AivzZy0iVzg4xG0{EmkoqTG>L1E|@hF=+pFH&R_jL4Tg=5U=YQH7bHCw8Sa$n%< zllX-DXQs95=(`n;iItowNxn{!Ot~-kTagpK(zkW={R+p#O8&Ma`Fcq*<-VwAR`2ms zUk7#cBZB+F{GgF6sjfLvU6lKxi&>dtm)r$xRvP4fht?%?6B)FHa$oR|BwbI<*l0Mm zN6|56hmm|I!C@r)#m1RW?ccAX-&Z&$cAh3WXv8Ra9>MU}8!IawtJTpL6^@CO{CAS% zd6Hx&!SMGTOBx-Fttb%e>F5%eSjqDx$xcZ!S%Vb*iezESNB0}JsH_|lEBSkpB*Jqx=E@l zk6`}5R)uH3>$sq!bFCbcfRoCg&kKp1MVzPRS09uaj;6EfnCKQRl3JK2weV&OKfaDI zbd8QbX0U!%j){Htd`a@nlH|n%vy>@-g^GpraqQ zatyI`X#TqTI^*}xa;dImQeB0@Uq!*c{KqSuI{IlV$7HkZ@0SvC=KMgat5B+|h+tY+ zU7wb}wM0iBw{lGE%q^BA7fF%{_muJ^lbl{ssp#l`w{lEun|~-tzD1H;LNI%ol_YxzCWT?1ee(Ex9nDFn zJW`vzl4Or0*+($A^^Kl=_0VTq4gRIdF|lnfl_dKl$^I$YJXhtI*fy_}B>N@FWps^W z+e2SGvh;Nwy+Gv{?wuASJW{S)s;f+@tAb$0ng4xT^Lj)7{7~hXSjm-=5_VpQr$|I-s^ z`*d`-$}zERu9qa&Ns=1~2BUiPZgV=T_vq;DD#yf1UL{FxAd>f}bUhHCa~fE_N7@1$g0BctE?`o@wuZBD2;uRX^^*3&{BD; z+~t0+cV%sPrJKc|c#H9SPq+~UEhS%kLK85t5$NeyduK4vduK;`kUk#9_lfzj;;>iM zy8Rxn$M0QP&FHHLW0t23zi_1dVXg3Ac?`o=mAl$kQ&r)s@kZZ;A3_@8*rv8ENPH$@ z>p)j`D@%iPZCumS1`a@XPaFBG*KmYhZFQ+{rMIliO}wypqmeHvY46z33L(K3tctU* z;m_MUf`N|SK=+0=)?K7(s1!NW0*7z&RYTU+h zY#4bxABU$$^w`qA4JC!`&@?0t3wDD@`pBK6E%2+i@AhC13@@uZ7~7g)ptWOD2c8xe zSOb09x~Zp&Jws<(yK%%jxi`D<&#l3g+ks-jl^`FsIcWk2N zZ9y?~x3B5xX$ulgwl-{3U$8CE+X?psHbeIlR=W-a2R3#?uSEZ~#ImM$!{WGSo+aWs zTef)lQo(grN4UgA7P9h&B<%*^`c1gHkRSaXz+Aq;Tu)t4xyOX7YabL;0p^46nsX7Y zmp7ILty;B!Rus^XJ9f@?A;bFn;V$61OV}9L}$MlEC3|zb6SCj@z%3l=pNJICO7bNdiaC z_)P+bX79ZuaA@|vOae!a-Xug!{{x5P?kamY0DwbF)LjdBRK>kNXLqv+OUwod5P7-k ziUAP=$wC6D*;h6jl5CcQBq+kVkWE+!2_(BfYLwJv)y-jPYkkySuTr$PULVz3Z@^2% zU{Ju@s#mM%=U1Ptq7jO>RvuPz=RY%N=A1nV^XttT zg&xFfAB7&QMX#JWy87`Wq_=bCKLO|1ce|@tp2~fD#<5wqdT%{>fhg)tW7*v@`05@r zJK14MnaXA1QwM782_tHgt5+pcuc3Hb|CTYa{i3ntuNJT#oJ1!O$;9YVYlftQBa<2CzRaRURe-^Y9U2M@z)4jC z?+grBsD6%$%Szm151x@TQrP9#by#loaVA#sI#14B2XsUQbX^ z=85=M-4{2ov(O1q8sDHlB7=4hWQzsTiz@@mF$vCO#ws(5fbZxQSdQulhhE5FBx!J< zG#}1y7xi3|4>Vwqz{n)k@ufW{hlYk$#t!7eLB*1~M#{jEtg`09HAcBIImaouKG>fG zOmRb^+q#V6OOQ$-TpgV6Z%ABky@6Vt9S2xkzIg`>&*JZxcPxaz{pKC>(BFDwB%fT7 zq_FJ=+m*1RG)z%sb#B z=J+x54mh$634sIikdXTbkjLsrU)|e)Umb9U00O|MWqW;NE%I6h-*0In92@llpt=== zUca=>3JVu9y1G%m8+kiUgO@;L>J|6PHOS}`D+hKl=9oemCNy6T6l(*GA_0IdlDnxehYd+srk{TyS9txgTqdD3h~oVXm8*Ya4U* zGS{8Vbw6`G%v|(}!li4%ot7}6KMGnl1zW>S7Dt_L&Rh%J!eC-^d3^4No+`^H)io>j zxfMRu>_+KSZ%#4r-y9n1IWsAdWsU=%N1gO0g>;(xmKKYcsKsryp#Ojv%?79*ASU7H zEx^hEpa95XbDyC&Y3NCAbDsESXef4S9t7H&9_w$yIMY6Nu@3C%iOye;4nDk#0d_3cwM3bas5gky3;LG_Rsf&P<*ZsirfNSA(3z!3sT2smTTG{u zOz36dHA{+h(JY{bG%4DpNvd|~64l}v*$4yb8tIEh=`G19ok7h~ezXWRNYa}LBQ_K7 z@6JoQa{balImz+<=)~B7rA{R=0LMsRCFV3Cp!La&Y@~#-1C$Iy)kW?OB^T?}p;wV~ z1@E9_7^6OvjC$J0N=M_zx);R0(Kkf%aGz09pWG-W=0zv>8m=iZBz@2;WWje@xdLTD zAYocQAkJF3A^;$C@*Dq}pvn$Dh#;k?l9ZycP=qpQ5rXnFK4R)QlM_knIWsXjADM^N zdMs_NlOB=6G0ITL2K_5CYPcR6>lY0Z1=3)z7|3IB7qAA~scNv7F`5EXw!G7WfgzZp z5Pc!kcbtyBJOp1!K2mRv!^tK1Vsa0H+Oq8zBbiJyAnB3*Tyq?7+eyEe7~gAHh`L-; z?0MAX9!iWKoPqk>WG(V|26wm@ORq|Lb6;W6{ttjgK>u>=Gclo$4#p3gw?8M_%Qwg2 z_NURuM&f9fk5v0NYR z;4+jWO);ZL0z|J>c~s)uqbJ63XWf8mwTw>%IX@sQxw={Z(92v8Qg%7Q6hm_C2|<~6hv>9WqK^HrjHVcOP2PoN&#i4|TH>t~@ELmQ_0ti4#%H3l#LP7yynEOjtt_c{!_h zMXGvN!{>n6oW3sp8g9)ZGvbFMmq^e5s5g7zxajn4uSG8G^@|Iah|vpU{kqtG-L}`F ze=6u7Kw75shRBR&?kAjU`RS~^89>efJ*x;duKiFViXc6V@sSzY4zUDb0^ILT`lHkxWKJg-VeVm~dz} z0ABKlBvXHg^r$^&45$Okj9vtxW#4SfUnM3D3j-^0&0;i~Ie4%@Tz*yS%h@8y{(rk% zaT;(h(3=VU5VUrujR~DOK3)Bpu4kwCD{ROh)TD416X60|GS6 zs25}HUO#D;vU^Gv2WC9#DT2a<&Ir%3BCf5UWI( z)$TUP^PUp(&gc|WX^=w~T@E86W(7I)hp^m*JGmWy%_W2OlC-E7 zlNxaB?F)q40Zm3I04PaH15Bz)h|RS*$SPQ%v$ce)5Di_|=0j5bjX;|r^B15m9e?vI z8uy})MDq|t17|VoB+#810ji(KDCqz6IV6PHXdIVVC*27qSNKk5)P0j#*Fsz`GS{cf zl_turY0NcKlu?taTd}K6Bwct8KKt##uDh5FCM(yGctvvmb`Cya zycN5Si-cM*N60`G?I!G+j$GY@zlov6>^d2H)2Nd#_g=3f{SKQ3RkV?*&oWznv1b0W zgND-!GjLt*5*YP*{HsWFBWXKOM`PG0&nfq1(y`D%e8)5DH9nLYn&J$T%dOjP61${Up|#U&35A=7PgjN$i4w?RM-6s`~$pY`{y71xX6X zD`3nU3x*1gp% z4B!?EdEE4gRI)cd6nS5IFLAxqGHApsE3jUW%@{~f^Kvf=v#4R})`{I|i#)lV=D@Rm zhk3SaZBc`@d*W8)W!Z$hzE*lAD;23ho~MFs0 z&Y~_;jF@*f%!WtFlUM6!R2~O%P_8UNpASWu#Q>xk($T@RXQ73vV|L=l%<)f9&J?#5 znYX=r7LSgBHfSm%ip)THc9bM0@a#9rv|TO8H#`Gn=G}~HfXLouF2I-Eg zofHdi#MBeJu?q$bd$9{vF`gs1ciNzB=m>8LMnaZ#p)R4GU%+W;3b%whBZ6y9Fx&>~ zKVhn$hwo&xw0AUxIxOwYmerw-Nasw!h5mqAXQ;LLs?KmrTd0Z1)&x5(p)DK29kPI~ zC3S@&WHm`}2AeDp0^b=b_}VRzj%X(&VKr3`ZVHB5gR5FY0&aaFbo)BC=_x3VG5(8c zR4o~Hql%bIT9bo@-HaB;5Ibw={y<4#JB~JYIk+6~Cb57;Kt{zcu$DbD{*`$fz%g-T zeC(kZg%~j_6>14oM7xs5Fr080O@%2>Cg~A0!Lo-F=4gdU56uUKIO(%2NtK}eH!8Fy1w(0@(0oinxEH55p zrYek;HWi`lj^BM2x)RJcd`6J@hDk+%?c0-BcB!f&f0XBmQ^wt%!-d=*$qqv zNf^Yk^-OjXvv&)V-NEeL!(_i?_8w!hJ#4dPAAL8YFu;6&$9#c(gm2=j&Z?n5j) z&SbDA@*V-PGucFuK#`63dTt`S9J$`cvf0S>CU(IR)$7<*#PsaQ^(vN?Fb#D*Ce)_D>Bp9~@b^Pa3oVy7 zA$hpPvb1YM2&oITbq>p_a0JfLqDS!cq1x?ej)Xekxf4G+L(T0SA@V%Sf*TQcxHA%N zYl((C*Pw>N7hI15iDxbx15#J}`t|4; z3|R79J}O0#I7W`=s+1p##o{WfU21WcIqS>OL#n@t?aPz-HF3Q3e~i4|rqxmG)Dq-% z2K5YhpKRVkcN^*oT60_};G1ALQB{OlNo$A^hB~k^D>;JtqLc zYtzf|guRPuw{Yy?BZ3OAt$45Tn)e!~c`t&_K0s^rBMbH@kk=nGozyZmL1Q^bW0_#F zFQGb{uDR_1*FMd3QY}x?Se~e{oXgPA_^kK6Cr>MCktpk=TE0kQIagzuV6lT#XV;Uq z_Z8_7Wt~*ZQ#6(*Yb+Dw^)i~~b@x0rpuk3nvQDbyX&TE@HI@m^8nz{%{px!1uvLLr zV>s(n%UYcE^bv5@hiFUWN^?64D^F|F{3r3Fw-$=(Ir{+E6iC^6=WuS_uJ^7t|QlQ(YQU-=6i*U<^qDj%kmxRJ(XRM{ao^zm}<@vHftDK2x= za~*64-^AKBtQ~?(mycK;`1P+8JSvrXu7m9q$R`)Hb{44K>p9&kk8(S=>$wiLQz+vy zwRQ-4ox)@U|MxF`gWK7y=Q`MqO~w#w?GS{!%(k?!=(o>vJ0I$~4z@F2-Zj&Q_Mwi12=zNEl`R|Q_{eWQS3up^-SN%Q(w)dw7StqqNm1-j^)S(EPek|3y>iNGdYJ|r8xQqb z8rM;W;uw59!|A>EQXXn3jq9jG5mf#Z88Pz12aoVjbBtU^9g3jxWyZ5F@A_+qhgxIg zI_gl>s@7)uPp>)6Lp^5XI_gk9Rj3K4_srsx8aCuMiL4RGLmO%Y0`05T(#Otq;SGvM2m=6i{zTXC1F(i4 zsI7Bg0X!i~n~}s+!oC9IP6(!3(Mf~V5to+(U;mBb-vQV zxpqaI(a7omUQ!{VO`(p?aC@8l1fjx_E`>g1%NEMdut!(LulR^xSgt9X9XO_)*}Y;4H6Txx@zWd$2SXJ~b_1LY=q zllFDtkYHDeU^j+(*b8a8@i-Ib8F69ZCcH+gCKUh`cypB}f#0J{g3sID+!XAh7MjAH z8(M>1fe<90u@IEm7d!lZzt>r1XRkvGWT_2(FBK(%(`~QzS34J1R8-g%yG^AwvfZT8 zbye8Q%By@{cSWTgZ$pui8I~gfDh2%dr8c}9h5j_#70L2c)p*Lwt9^D@$t7W7cdE3Q zY)`4v<+Rth9e!__(?!+S0EGhGxKgW@+ZTJvE4}3|kHRvpFI}OCTw|0WYV6gHYPZu- zGg0NQs&Ox_thSS4gwxW# zj+UQ}(E4_u#|Q@SRvrD8=i$Jh9#!_rnhIYWT`Nqs(6I zo|j^w(BrA_E-tHZB0pP-pUvYat1S2XE9_8%QasUzSnR7@?D5r9+Le0{)^-i^Uhu!V;`P?v^RuHN`4wZYB@sU9`;m}i7$S!b$^a`bu8_bqogRW@i?8g#)3LA}26nkugY z)lIyILQ{!@x_svhTVwb5U6oa3Zjb!Zj?urk+hwmPcT~EasCg(YKF>cJ{DaLIWEpm6 zh`=tGf}u_&xdvy~m^VDThHZX+p@p$)j1!iv-sLu4NapP$vTNwh&#nO{pQ`oeXV-vp zORsA5?DkajC#>%uPa7Q?{A;8))_86-Dcs3B0qOLopC3&>IYSU;Wt`g{oU16z7+v~4 zLwaYHIN^ z?^BFq?>00ExaT~q89x^Zvxalr`R#pJKxy>h+Ewldp#z;XO)anxla$=6GebqB)$MKmZGhVpKuqFG`tFs0;zKp&3zvFi#SG`<*{_D%7KPEi> z(j;MZ+`8LScK&eUpV^N*Gv$q%>!+R0cs6|IrP?{ViLc%t^Nsoahw@*$V-aZ_v#hh@ zz9&kazxs>U=k6;gu6}Ca(savjr#}9+Ffz^lruVNEPab}US^L?cffrhHL$-a88rm>n z)cU=*8PxuFw`){GDj&FYL&S``|LeP-H=a9qp#8(+4?efqdEHNcpXzS8cnd$mb!73Z zv)BB2Y+; z-IMv~+rvJ(bI?uydia&6_x$C|rlX0o|1s{@ExX%3P2#LC+&grCV!q4W{ZJg@(;)7L}&g|My;aeH1@p0|LYc;;#jdnjs zGz-GGT^!HkI3qb;WpLvG!#0$`?YM)r4cvws&vvb7W2m><*gfu3_WM2R`#lb|_hD_> z9W?xJ^-?w4Tp7>#)tpaPnS0Uyqb~dh$h}Mf&)oH$fOG@NimuAs-vXrq1rql|c~|MD zhOKHTUR)wypCY?Ci$woC5%Sl zxRcx4Ig`7jbxrH($WSdc@8_fBE(5)^=*o|YM6|E)2JB=n8NxPtOj}Wdt5%CaX$)&` z7LAOeXk-ALr?M4eoTO_#l{^J>MV`u&2qo(aJ&&V@;QWHT+83o$_)r=*M%2jvLWWvo z=%fs>ssJ=yhSFsyR~4++|BfmUWO;xwaPBK=Ow$Q?UL zB=ut+gUf5Wt-PfhF0$KyB5b^W%y78a8nV0m7#5R8|IcCL_m&^SY_EwCY1zG`vAl(r zpYxv%8xLzw%i{)=AE)JCk#pA<*Bi-cmiO<{vA_8b=-6)d5_^&D^dw?*+=XTn z$nKx1#%_UVxKb@^z=aqCC%`o9C#*B)(^?H%bGs%FCKl~vn-*4l@*Ewp=qKCsoX_ZP z_ROUwoW_9WrePgw66M&R^ro0&K1R)88jtY~#+%vAwP+00DbHynA@F7jG$;ExwW0bG zDl3grhRRS)Pt`fUislj1bLB0fygWtoYlVclX1yoFZ1!ZEjjJ9ad)fV@k^Pz+VGpwn z70sw?yfRGF%$*V%*&6H6~+J96RUXRHxOfYJW$)o0Kv>4~vo2iDI!tgjFQ1$yLqJtJ=VBI{h zoWHQy<_XmL6_>RWN@6{@v>4x14`p$1t0mTYY-lN~H>}-^nsH)e&q7&jm&#DN4873H z2<0VJz~WOhaU3BrHwDI@o@3Y=L%#I4Xl-7n+JuG#=1-7|-WhsQ)-^evJB{I#IbQ2- zT7KGn%HuRg%Vv=4&Y@CqiaB|_--@9Mx8ZZ%TWYpYW8PA8bQ=Z?iy`gYabT(QJ>W4F zG&CRa=5}*GYRHHeycU(n@eLY@v)-kGR6!+GDF0DpJk_x0b_od>K6b7-&frB`L23)- zXKP>+52Kqnu*rv>4RE>ZSid5_lhm?x6+ReWY_EJC@}Uh_f%sneyGcEZEXpt^DO%c1 zcCqzPBf~sF(L;ToUU$O?Q_K_CgEZbH&n`4a0Upn`k#E?!=2&2T5_=kQjqDM&9%zjI zf9cpC*l)wz*n0K=A~m#bbU0e%j9~XdRyay%u4hu)5ZpRJB=P4fOb&U5!UKvsqxD+U z?xp}c467HR61p>p#iizCk`%_4bpf9}@iM1>!UrAl4h3)*jbe)tE7x8F_4CoJb7xBJ za_K*XP^z6iK-NJPp^s!J@WvexWCt}`62WLR_ou!QCXgpuB|Y1?@;U@1`+zxUQikDf z;w9Bp#4(OtQot}xPtq{Y(qpIwh1_X9#~W!>%ryt8ji=GiYq44mF-XQcb}d)0%_8lR zxiguCxYX_42xGURT@CQc#9~m^4B#8c8*nNK?*+8Vg6`tH07C`5eR`s0W00$!fokwU zYJm+HZXDxwyv7@e<6h776zbe#;% zkRgi<70J*8G8FjtN{ne~G6qyWs80)*2halb zGmy;ULHn-kfc%76K{6#Urw0^ePew6{JZwrJWHeOuT=Rqij8~l*7&oQG-qoMeldyYEOI-Vpd?CA6|S|Fpk{dZtXHT#fKPEf4I|vZ$wv&pm88=lQvX z!M?)-G|HCyMo7|MAwm*viugp$9X4`P5A|G`hH4{~IF~G5m>d_RpS0Myq@-8Q|1OHs zt5WX|{Jj0;9_mFhjk4tk=J(?dq2*@Ly~Pg}JveX43K3c$f-_RBMJvRkM+DL3GCdK!F{k=`kP?}VIA;rh)v+3`2y_)_e(ci2E^GmRu zz!)v5s3WRnis!$U(lc)L=y0?NKohd1VqWJciLqNG))+-xtJraRJE7E{AG4l9&G~XE6TVl)< zY3|8E)@D7jAbYo7fl3waQd{kP=zJ5G6;t&@^I&mqVxKA{-OT^Uq_O|%zxuEKtN-f1 z`mg@0|LVW`ul}q5`aiq4iz?ga_q@*-okOS-Kex|0kfiCjI$fgQb&iCQ^c1_$NYb=q zD7iDr05#}mbCf5Qao*@q+4#_b^n0wCdL{9wT*FGXK$Fy}kk<=>!0pr)h%K`|cSqS(B!{Uq z8A-w#6T1FOtSdcTAiFfA^U1N(AwZ9tgL^cUU5jV(HnM;Gm!w_veO0L)xQ2S}JFRk^ zFT_#fX99;f?xKSHprsPm3!SW*0y;0$9dWu*l`0oEOmtxVu|}y zStQj7I57Szx!Y6FZBMT@>=lU72d&s2o{flJu8ejvoqA5o56Hk1Hy$dEa4v`L3&?spVC3UQ93(L2u+=6sq0&cLBvrr2 zHk&F<5o=61y2SmZXB-SPg`)$y2I~1O8#-RS3EeDaW>KD_|EC%wL)K#^&;w4;t#pKj3jF>|*5i;%Odr4;^pHq0wvuct#p4kiD6X@!M6Ty7km|JK zyidL_*GW~@iR-B|R;t4*>O_!@PX_7~73SCIVeEA1dZvf}+wh2>MknWN!;dAsakT>1 zDsY_wH!ARG1)dy?!+?S?C`Vm|Ui1pQySq2urNA#M@JkB(q5{95z&jN9FADs;0za$3 z+ZFg}1 z=(`yA0J!V(p(t=0?F%Z`Tlh3AqGB3Ef6MRDoaR-haLl=(F#2KP3- z)eAQ`^)PA4;lIC#+pp2>bA=Qj1)e427J+wgwB44O#ea=EEa^l&5gSw}y(9=W{;U=~ zB$-G(YU@BX<#^EsSRAjoUyJ?1Hih0JO_@1-v9jN6*mzRJen;4|Y!)63rqL&))s~q< zI(aSacV(Y`gVy6V^%d67W??({8`bo=hijs9L<9L%mv9LBLKr8hD-3J`;`kYL(0T*j zq3VsFRNyTN{IE*NFPkM322rQ#83c*2kjMW59c2m)g}A-e(UjJIJ-9wy6rG(F(5Dy~ zOg6j@mFyPW`8wT#E2OBfCW@iYtr)i1ead+aJj>T0jg>wK@W~ZckWZ=T-VSWA+OsS? z`dgyW7)-D=W}D5>bU8B4j=Mf=se`bux1@HOa3E4E!Rw3ahf&lM8M4-xNj=-!dG`gG zzeRa9BdFxX*w_v_yfATiHu_-2=Vw@90i}Xb#88bocnncNwq>FCz9ydb#^512l@hDP z&Yy=KtbB=@3WU2OABJlXhl}mf;YzLU6UM~7#~6h%u{51P(-@kXX&Oz_5j2gWsfngW zn(Aq)qp6mr3{AVXVA@I3UufD6sY74VzLPQX>5(wz**aE8JowN=$I)E2>B8B>RQ+&Y zvg=wt5(?|-ahx45{tXkI1?xNUB_4UbJ6liAdR)513oZ@Yk;XQA3R=1Dqstd?)0T#- zj2hQnT%CbC-tKYfNvbX}S%J9pFak8b&8vm#gD9OdRHPxbd@0PaHiw+dO)Gr4bt_A2z`bSCH4VyaWXz=Vt@%4UV%S(6}rS1BF&It;j6Af)tWqh@(^h$ zNvfXfR9S6ygL^0{osEnKx*h1I(GHCrvPkTtw-^W)o+;Zr(}l=5+CFsX3a3=qU)v8P z%}C1ho>bIb@}wH!zYb4oSNTuEqYNWc(H_;#(DH-m^_I-;s!E3u1Fs3H%4!-NDo>;Z za;mZ+@eInvbXo?ayhDo&%`;Ryh>Os91NDA7kpDYmpSTCJ#>PTFk+IN8l@k_~Z=J|6 zRr`Pg{B>iIcvTp``Fe(F+s8*tr0$rb`De$AewiH%kE$KeJWMELH`FZt^N5Z(;957c`9v^-^ zzO~}(w2IfnAV(4}BW}y+#(?xQQ6zHH3rK!WE zPl%+ms6cm+C~JxB&JeC!?V9*%{0GQWr_OG(3JpMwB4(&SH8{xO4`4776i7n_CuOaT z#b6b%v8Y^TU`4duV&zxFQqi&UF9Us`$xzIJNp)aX8rKb2xeUsol4i8nku#!C|B|?q z)Yi6eIMxb7>P@*ILd@DH+z+ zcGgNpCILfipJNXElj0VfL%1@n$~nj`9J2FQcL8H=fIGQPSKb|SmNAxoM=6WYN569b zQo1x2;ZRTc@xpw(8(}LJ;&vga5Sa`e6ySzoK~5$a&(O`r>5=Zono1Am6v`LxTheteZ&3!Wuy;hyPjAb8`kD6lP|Y6>um z{{kp$q1kbenJ3N5<`pN#O=ny~EWBAj=I6O|jtG9z2$cAng~$|`a$y06iqcla!W3)& z-PY9yMR6tZU3Y-DFtDRS)SS6M;pY)6A~C0#!81DQ?u5u(-sSGYrj2tdF*}3jFi=r2* zn2*=*qo=3)*WGVt=9%kpr~mdzenWyTysKy$jX?o!3Z(iR!fNWl6%6xJ8nEf~p}g<>Dt?s7b~#fFgYx}qOuQGY9_ z5`rRxW*gURgQ8=F^=y3;9H{4{00Ly4dB`wxsxdlvwl3KvXioNv@(WnM>&q6C*S}9| z-7$Ayx(1J%=gv`}P2glt_>15xMg0-aGSUN%;`j{yq<^&3Y}EV$g8h9Acsvnx~VLUfckqPUY_H>7^+h>iiS-+2!@PPgjazTx4^_&sC;zN%1 z;_a+LkSmC?Nu9~X4;6F|Bf*aCaoH>5M1gRPup=yd|-vTKVXG$~$N9(|ABk zMPj4CnnhMi*bV_)qQgH)w+pOJWUzgS&{_gKvC9vQ+8kH^1I$di!f!x71xg%BqW6UM zVuFNm~ zF8C)j@iJ?K+Jv?U6lzz&mcUl7BFfGP2&LEWN<=}5y>NVRd8pfEQ?l3)m+43h26Zms z$6UIeGal#S*lJ!$0crNgr3LVLmgqMwhfn+vZLqe+ykgOLlVsn{YQj&MTe67ipYV~MWWP|F@ReGJ zJ}J~$YEzu*P9ecd)FZ@HcGZF@bcp5^USxJi4@YlFB}W=4Im}zn~6j~C%3^oGbktdXA)P8AC ze|EJ6B@MG|Yy&nR@By%m9Z@a&vs!VR-7}T#;PnG%OTerjivQ*Fv`h+~Zx;giNKyc; zvcb&Rnxu%z0`t&=VR-ELN41KW^f&aFV5Z;@5K5}VWaq&3a**dHj4L7S2cEx*IUN0^ z5YSDtfmiyu4fm`?8wTz7#9p>9F#C*{gyyTI;o{EmL_a&(FuQ!GU(tfE|@!e+x1fw=sdI)x!CZ4hMLW zg5zvfK4W#DX7Q9bzDKe}q&|U`5Um^z2rUuRws$?;mw)swYD=W7G;$#k?dgXb)mv4n zIGjfWu3%u0H|~CsS54RehIJN_i58N97!(LRx!HBV|w@6l!nz!BRwOSF;D3IWlig1}a8BuYc1 zG7S)9As~ne2$CioTpH?LhzK$~7eO@7Ne>&2<#L*&ZFvMZdN|WiJZs|;g0SDvJnIZf zXra%>h?L(f%qT488SMF!ldXhNt`6UE>; zpbRgmWy)*74dB427)dfGfNqli#ma&C(%-p=ZlUBh zaQVNi6D`ppEmX3))A zP|n=?hVBgYk~wly^~cRvCMcacWEM@0+&~AN$r0~*Y(A?Mn4Di1&rf7rRnpagZ21~( zCI@u+n(`WZ0z3Y>I@hf_*OeVHQ9Vj*ycEjhYX>HvWnr?V^FGaLF##=d^uNqNs&Xy- z6_oH)*@*#!?#2L_RY=s%N+orJ8T^hu!I>TU?x=A zIxVpD0*H8S&nl-sehl?NzUzXV7MLj)|Vi!(M$}jYXfK;Z642W>h)0g zPq>sK<{t-_pO+DP3T(%!*2kTpRXcAG^?EQ|fGU{} z)YEwsqb=>D-lTf+SZL&?^Va}l;lW@AO{bOf(c}RMl?lgXzB(kWTn9!y$+E(OTBn`< zMtNL*0zE8<+i%D`5>V2Tkt~!@qHPkmiu1(AjfqX2_Sa?GApbo+z6w%?Q|?KdRP-qg z^C?Xl#t%AE4ev31JH+#?E~*@%-ND^`Z{st+yZf}a_^!EQcb|9f?!H}t-F^Go-gzU8 zi)yg<@fS@kj9VJU7j@5jui>&d^nHA7nYoSjY8u9m25R0Au2(aD$28%PdOz2^*C3iW z?+sJ!3D69nX?n;narFf zj9@gpprVT{`UER=N}f^Gq(*e;o>tu8c6X#2G*X{C|~$Re|{7^{(%1B0zNO4dgc#5 zLIo^>oF~xnv`uO=`4=W}J{=bj)8M~gw6?y1%fAqE$WN>3F5QGk+G`|pT8Jhz??f9e zUSb=77`Bb_cT5^v;fAvBnrpCcfGwP9&aJCw2T9R-?5u&Ms`11*&$5NM@XKQS0Y^J3 z1v4Sqbqp7Y8}yu&_#TzW%7}HIvXb+)YRWC_c7<`xO}0l=e@Z}7v{u{7*N|OGE0^Wc zS|iw^dG^^@-De53dP?7JUE5O|17dJtz!J|t*#*5RSDahMwo9e&0@X) zCM{WV=C&EsFP0gc28H%@C~10nA%FR>OpsHK#DVx22fRr85FOy9FekYxzX5S*d5esfe0?Lf?x#Da7@0YPJ5}I=F!Nu9%3623G4$h1QJ0 zZB9JFiANfhd1Ymwag2V1I_r$2Mx4D_Ws$7j)JQavRn{}8+}YqaT7qd1YN|UseoDH~ z`vc;ywh&WBNY5Z(S1^bDj(4;mvf#O)V454tmH$SFyJs-?Y%C)*y(=h&roFS2TkLaR zXv5mz3_D?sUmIEc+>#xN-4{uBZ|WKBCCXF?;k75TuRil{{x}T&)TC*0DwbF<-HGl z6xFo=yqn!khGfGmu)!z+A_S!dG`L_{HjzM>5S7KnkWHc_;Cqn96_th=z?Oxilh91Y zt@J(H()Va9Mczj%wYE|~McB>a<`0MoAcjBMMN_0?wz@F=gztJo_p>&_ndpKxhd$u#XL(ikl#>i4@_h5xuN4u7@u~5S=VA0%$rOAtrBDNi~bRIj#)o~dP1f-f19R zeSG9zm#gnK8DsSpJ#VeFX9%pv;G3s+Eg|P7&@T>aC7XYctD6>`;DB}E7(BStYxayS zb^Dy{OMK2#OVl++HG_Ct$pkL@if8>#&!O*yb{B#CI6i1LZ)=pGzM@-;O z<-1fNS#E&wV<8{n>D)(>0W+7E+TMGDthzHYbpb93$r>g{lux%)giJ2c>Y5h8tMd)q zWz~R-wlI_6PEqnSpoQIQ^%^9vRTj*S9zeH8uOqsZQWYLl^g?e0-3V>Sc8YGH4vT>* z7uL1NoK^HE*f~omRtJbS>N-Uh(XhxIKy{4jrVv+bOtnXSP|zvdiE zxe91LXga}|;8zTyzaJ}O^_9lp$#AK(8hHBB?f8B80$crKRG>TC#V6O?>ZpV3O2>4; zh?o+J&Bzr2y*;a-W&0b`!p04?vAJ$iHA!1KXR8;XRuytUxAZqvUIegY=f@j z{us>#exM>$tB5HB0xD<8i*{pJ?F-q6F&`CT>$ZVGxTKeZrh23fN&>dMjVm4Wx?D&yNd=dcL}>GVXe$K@oslbta_t3Hi8BkvT8qNU&hrDLbVMyPt^_J)jFo~ zdKqu3yq*h`L6?!ITybz_-ipa~A+9nwr#4v`(I2Q~6hnWuN=Yvl4PW5Xl8uaxo9!KjxZQkZV->dWjUz6+* z%)%JJHwO|9L&(qoT@cFF>mWhyfewkA?pqJ?oYAH(tnqJ7ltbiM7>bC(N(>Tapy3N3 zvG_X9z{4oG{DcwE+>eMKK#E)QPb}oN>M-U z8lJ43zMB~hT}shsiDC|ilz-Eph-Xzk$@uUl;0;S`{@)t zKs=|WM2M$&Ipa%!|k?16H7i}_YNl@&4lAj><&f~Q#DZ_H1*C8e2YaUbq;wZO$ z&4Z1-gOd|d`;;%wUZs@mr<4TUg*Mf<9}Oea2S~L6Pj@wn>eON>wt_4#4Z6#5b8I=9 zGTOS`WX<%*p}bLD+C5ik1xmGUPX5T`0&e7^lFpAzdGvyO#F6tt=Xq!6`De&SCB0|J z`I25_6iwgJbZ$0(Q?Q(W167|ql`i?D@}f7WEV)LzH$eqjf*sVrB0Wjd@sjV2fs0v< z05)+LB6?7@1wadyZyj3L*z(F@g~e*R#2_uC6%~~Y{1GRljE4R_lnKw| z(BbUg;i`S{T6Sptdn&GqSuPX zfmxSYx!AgM?XzmJ0#8e`(2$~zv;49W)gwSbg@x*@JS=r33d6nXtOa;es7JLlnjxtC zSn-*5qutwHkqFa*jHW(U)E4DZ`3ivdz%r~?E^_?k<#@l6*0XngMa&5YEmUU0ns>8TGB>s9qD#;)>d2)dL99Zek!RN9tHCGvbEe76=g?TPg5j-rnN+05lz5%K!}4Cp=xDxeQY;tjdWbk|@m zQWr{_knK&=T1p;|(5okhU;N1WYqH__l>(7W)W^(f*+6{%8t(M$N@VN7+ zZO~wQMK%m9j+ztgH6XUtbQc%%bB3D|-P2E73T-|;h-6g$9cD{3!cCq!1F5!d`05L< zqlrogu#T)p(X^AU?per-H*g6X(mhQ1>)4#Xy-b%f@DSNci0Zj``g)v;Ou(Y#+-cgK zMZ24+-Nk5knc7`f8@*eg-Cfk~^0d1)?QU5X_6{aAV1g%+yzx=AVKrv?uCETN(ZhNa z#*^Gzii+PM{Z`RO`>l}3=oxPS!$)|~28E7_!Xem9EqF(elYM9jwH#)oS%|>pmmx!; zdb&J}@y-`e(R#Z46usH1-5jGgFVPz@>jk=8JqwH9iQ^2&YZhkI@rh#AOZ37BO`Wy_ zYeI|Ify1rAgfISEHsCh}p1!M%bAWj#!p>IX5wY43cVQc_)u>S*C-KzsS@=4!;_>G+ z1BH|r={+rv5{53C6^o|ul6Go%t$mD4Ig7IwzpA`=J~kmO;J%w0kpK{|Vfno1XxXA0 z7%el0kCwh0(a|yvM~naFmq!b*DM}m_<6)Xzjto;bod@hiFlrrR8lnz>gC&$CbQ&K5jdp+$-46+Gy}h^`w@%NjB2pVl?7KGxwd@@xXk{ z%7kBEEjqwaz7fhc>O@8jWt-xq4IuZY=|b64;zQYY#f$!_aw5J^6~L?@MV>6Pdyli# zx9Ivr3l{nXUe5Lv8GS|v5bFczD#_8iF-Go%Nm+RefgtZtY6iXK^qK!a0nm#k1R>S8 zmBMh>5E#T2jIMG;TIEn6Mpe~Q0O~7F=i0OI&5i$|#LDzaTou;UsGFWa#)1KHf_ID8 z`}rkxhTVGpk==}tutZIIS)1fCWg#qw0=*{j;>4%Bry6F~ATX38kz(r%wYf%WQRmAw z14(2wqdK;_2}eXOqjKRKkwY#fyzyUc=j3Zx!Yo=qEDreuToRA1Tx_gVDnhx&s+x0x z$FR{5Jt2B_8uN#A0XXh&K)F3*S<4>|v{@N!y@Y;C4sh((a%ECSVZ>UxZ1_U3iGX zjs}r4eBY_pUD(pc4>jW%tE02lMo z&~XtOsuT()5(3s&o`t5oHWh@zWHj5r&3TzwyndmZoI!%^<74%8v2%jLC694oA=%!C z1Ilp|*u|`JBxpyq0t%FDH`$$np6$5G2eXR#`#kyr@+{i(CevPWpN2e>p^uEewmnPCcMN2%XVsa z?X=|E{C19UOL6iSa)G%4m99E|1gb?j#wd*e5xMfgNrDA)^}R6(;nQQgA)#s=YgN45z*Pn!6Ro+bH zO_euC2)}@mjG_4|wF9nvP{&rIqri$7j`?U=R6S{A9x46|vu}i-qcGl~dyeYpNuY zC6O!!cmR(I%()$Ilx|M&aiJI;wiv!(=@>~3i@UZ|5=; z^JcBkqgv*P8^4N?(LNA9qO%;vA4h}S`4#z=&aDRs<{^J0Ps9e9 zLlvc$k(=}Fc7CMX_VhWk7%&^oI*wLcdD?F_)H@p2 zGIl!*mH_IK=$7pw28~JjhL(2|N8wGAV8#gzh;YXxnxJQ^KgKC@@d`BAa+;;ZE6~IB zb%w1uKusGr!1v{>jriMYxbFDSoAz{*S>CivTxn-?au$6&9v{y){1M=CoZR?{T+%1& zvVNe``Q=S3g%J(8E79s-Db3mnN%S5aGb@X;ei*$+yip#^`q$`v4c_0I<%`~b5AP>r zy%@bmR!kY0^)GlI2lsV2C$3xRVbqhw(x#P499D9PdJ=HISjt_2`)qO5_W&xP(KK5~ zMETN1Hfnl3n;-tO>&+3pD_v+5SM^fbmS1>y@x|=79Sv`zOFTZYCdiNIY1z2|vM4Lu zIM~#rV~89=pH1jhlNxahb!yBX#z$!E<2oUqpYCDlvT>cZPDhUrcj!?lSxKmYkpg@` z*pkpGQ5%4s)6y*bKBpWJv}vcyFfDW<&8}y39&33o@?4MqQRBJV)mfO2JkyC{ z5Pl)w$F;l2??Flgj*Cy!_Ithckv1K9+x7gN<*9q4(g5TbUEVt=hSL&EhkpL3&f+G& z`5eliV9*_2xB#f0mbkETA8xPE0ms6fw>4$m20emm$^g#sRo?S>4^j@JiHOJ>4eZPa zlg~iT4lY3h2s3h`Fg>T-szu2ycA===w(%bWR^x4fydylutZkQb2kNncufeC<4K3yn-SK_0h9 z7c#wvo*6Yl4W#C-@&iy#`AxL2A+rWbV56D=k5-18`~V1kw%D6lyl%FeRN=0=D-J`* zV|eq3NpC6N3x%XNE^(3XPSJJ^`uS0|ZVimPwIX2rc9*{n`SJ@$d)k*kHE4O%nYUiJ zMsw7EImd-_T4gM$dR=)f6jMO(ENaN3*gRbkW{)_o@KeNFDxd1n(QUXstw7+Wj*kIW z$c1|al1||k5||*0gV566DO%I>NpQ1fiq`BCBh4<1EyoroGjUyzZY8;Ah_c)W*n-5% zX%2M6m9d}u6~^}p_4c^6jNJ?=n-^N}Cl!A(@FyF8T==sBf7bX8qaD*jLJJyr{wbm= zMI?kN_@}_t-$=h9e#T-1(oZJL&*&R}vsBRKXy!+!H$!``rK@WU)Nm3nR0K>AH@bJxYI_pqRviC?nI;60*j$Bz2z~FZVB0>t<+&z8aU#V znYibHd=8b`iI+f22KP$()IodqG~m8%At}%iBYt84;#_ghwOwl3kB%(WS+>dzZ{bt1!&qS! z!v;g6npV@64;`B3JB807F2a~VniVc)LzvtOOkiAHuD*7mzAiTg%B@`(BZdrO11ef*3*w1SRwLfT*_B;LBVs}H`r!j0eUIRhs&>&u+t@k-?z26Th8exm%8SJYo zkdyX8?U0;Xhvb7ygMD_zAbyS@v)@CGc6ixVh*BV=L6`<%CWK4~3m_D_Y2TzkTc<#r z3~@5VR*0<-TOh{gW{AxYGY~Tn8zD9h?;EX+*1+!u2(=KlyNC2mt^uGP(iil8cs~qH z8`gK?lnfj^K}RCaokGmDV8`sq=uxB)eZ5CK5hNEp=326(d|BauEuW@NJc3KiE2SwB z>%I(NozU{kcDuaBEcW;F4)iN8-slH@@{4u%`ev^4EqlWvCrEi_@w-NyaIBmfyyh_E zH_GcPU!+HpiAR!AphJC5&pacp+fug-ybV{jTo8Y;sUIgj{jf5JAazl~MvV_Qm=&t+;B(kg1n8%jT)up}t zkqSyM1T?$hjN>MZmU_MDpXxYWagi#map5>Q1cQ0q zX@COQF|-1=JVt3ct~+D_4y4z+9wYyvM%HxFC%LrIPBD8QhYhB7FF zyFiyg@j;DV1EIG0#U}NO*TjIn=L`(UI?j9x?i%#7<8b$&5+gVC0p3l21$u;^BoZTk zn@AFQa~^G#14bkC(}B_S*T~@SD7;1y>m78?sC-9*I~=Q zyWNPodXKq$HX`bKCsmdFqV}T?)O7QAxQD1J`ZZOBn|yv4^6$V*(!z3?=7!hYnj$HxeL&)) z{6H4k;R9!bk^Qu2^#VPER-Q>8Kxg*%OXHC}6(%&8Fs5GoliHz}*(H5Eho(tSuDPXT ziv72Q(L=L@ap%=JvA<6kjcii3aqyvX1m7Jrl8Kt0qz+neBRW>0&P-^x`RxZPu{FM>a_yo&BMaS3S13M?04_x^o2~u^vimr=d^ss@ z7g-AJX*)3=P}N>QaBIq1GrOgi?nSr)LjaFI@d=;TjjV2BtLsr-*q5ua`Z*W_ztG_*>`pP*wa7a7JIvmJqT-B9)>RmaxMgeLUmOn9>&E66a}4++=h z93xoKUJm_6en+?TGmac1TaB9aay-(IO#Te@jpS z4gkLRAOb!f)AH31qazZ%H7OaW|MTN;RHmTmRBF{t?X7&0jBgR)eROVu1{;bIC1w;J-f}>@yAAHfxX3Tx2H5uDTf~q?y#Q?4J1j%hV1{36P9^qXdE}|V^wPJnSLH2! z?ZpM~Vz#^mx5i9ItaOnq$RKY)Z61~9(i>dl9-7n=xl5si;rnFN+f+s8J4Dazi_5A- zMeA+$-3XPyx`^*iAVA+Fm)^o}dSZQ>Tu)SO?%jZD*imvEd_Dm_51r728SKyX@uTI1 z#=+#@V={<(j|fd}vI}qMR65`XkD{7e{ZMN)U?~hPyg4xRX7A7&|KJTkQ|cd374Cr#2FU8*YDaRuwu6F@H{XLVmoSuLb9}sZsq7@; zn;H~WoVq;vd@^?uewZK_iE>pVora7>z_#Mzl3aC6OGxhcKj^&GMa?-o>5Llec$sQE zNwj7&q!K3JWf&|PIAW@~bCH)KCe{4tI*#$g)N*~bCAUIczphwGBJ5G5GU%_))>K>4 z7vgT|=0S-by}HKeE9mtY9$Vsb_APOPFoLC$kH%4M3@6*?sOt*75X-(>V;_gp%`ZL4=8VdCZS$v&hx}` z4ELFxcLC=Df56zbxv($E>S^dj<}zHvY<&(rCmosE&0RJK=?LGb*(GGa@YiD~Qtm@- zX3DTsqe9>Xy>JPBV}#>FpV|BaGvkh{I5Yk|D32WddMHEbL!exL*Z*Ts-t0suhxwmF znKOWbBcE1>J~x49S*#@ppHty9vKkkOWc^!efBz;!i`c2!>cxQZS314EiYM~CK6vx~ z>UKWuS3rAp{1`M;Q~4O>J>NVPzmgsZ`sVcyT-_SD>Wf@q1e~YisJoD7Q1Wx!TtALT zjS(|zO;b9qF=|{q1L$C~pqeTERK`46E+#;deot0+d1?4 zk>qm2;0KO4PKIJLe7X8fchs?Sj`FeWp{9k3!IM#3%Va<7IJvn4J`80fZya4Ych<&4 zlovAcDrejIo_<~BgEIt^I?t#i`8MebNf{u0wyV%hK2qpJM`16~d}~DG*LbXiRY8dTQX4gqq{%bHE}@ zlo{D&l+PGW1eA#hCk;(i4R|0>&1uPHloAguvrp)h`*!Ur+eOOnLq4!Y%3;_;+-b?c9_CI-IYt~os*vm^ zhpF*&+R#<^t|MA60`dcQUn&Q21YG~~@DWhx22tDgXIukH@OzUMa=4Vz)7EoVY{R4N z@JKkMOeyftx)8nR4n9l45Xy-V?(R55S~Tc zS7M%4rS(kfrPj8Db3zy9hg>O;djWjnqM@~7qyzG;XDV0+RqxCECuBIdV$`T)&8(D+vF#B(Rf zsSl{8wZFKyVx#=W^pAZ{8^v43iZyPsVh(j|_Lt(d4{Ihnooi#{kRjvdh(^8ZJn_06|JK7DpBrZEt$oit}(~>j0Lv9ZNfM8equYfY#=;&=w_bxS@A~VNn`W>IkegVFqZJpgIfRC*L?ljo4Gm+YrXy`iO>6^0uLs$<2h#i})lN z5Ue;oz)ym}Kv^zTp^1@}( zf>DghombA0_t2ClHrk&_ky0kA>sRKh1>s`lcJy%IZKEFT7>|zJ^?U3B`fNC0qhu}$ zRjkalNDEim{N&$2{?#xcbpR)(;T2$QFZSWg03vKVTA(^+QKy}gJVx@<-$!_CH~GWC zugBtSEE%%?_;(s9Sq=DeE6jc$&l1a*$D_|4RNvaEOCI@_kW3ms1^O|8-1$jVCD@8~ z8pS)%aT&5aBOO0W8XavU3o6ry5EH|0|w$|j12L5h2r!Nl%C6GN= zzAChnF#13zi{79(3~xX42HlTi_qGdpjvgV_)}1Q}<^f-vIPS%^!3uRYXk%mC>lqEMcJ1TYgK8n7!>aDqDkIF(N)& zr@6_d*Xi;+TXO=6C$AjB?WN!1}F!m04vu~DVF`^J*dhmiP0foXaN2PVj^ z%897>$e{Sxbr@KzeYl~#tFFLWy;MJ5m_YY+jHa9Gsl>M5IBzm%i5T7>K7UDogc$}U z9W#vQmm}NHkNubGhdptBT|eAj@mKW2z2By~$gT=aKfD2B27YEjD604e^}|^D-`5XQ z82+k$I8w$rh#DdIAsm44I)vR2UWTx(;=f8ij31L#taKj)X06VWvi842KU~QV=!Y}- zzp5XuUQ7D~GjDwft`9&6ul+mv;Y$7=)eqBh|5N(mNZB(X%7m~0!XgMuAuNNi62f}^ zze+!>wb54i-3DPdgoFHlk$zayJ>c zv*CvNuDH7~!mdV4gYP{MvBd(Be_DC1_6Zl6+e}R#cV@$TytRByH2v;oWco6Z)4?BE z=yZhmXY8|RzEv)=wwZ2302rtEoR^n)%syv$32rr|ImpuH=stzmZjR^$n~&>qk>&;p zQxv3s-yZ>~%UCg@%4xwPBa}Jx!l+Yb?7)h_SEss&Df%^Fo%rM(v$Y4TD)hNXM-zPp zPX;!OLb^H&+ln019u9am!gYb*uyuiN9~dUG8xBO*1+oU#1(KCBa?9*Hc;oy>1?VpR zO5MoX`1!dYn-8oJB$IC(7!=|64y+MG76|Mm)~YmDi&cv{HoyR^oj}&?9|Zh+16x5iP7trhY%+`24T5#YDHZqm(MU?v zZis#V@ExDc`?St%RH^tf8`+-p{hH)b#!d}Hcx7dBL_<#X<9vM9c#I61T_j2&$T$xA zR3_7*h{%$s&7TjQjBX0J-u&%Fa^oyS7}w9XKc3#oPh9ddo1gt9J}n_q!DY$WNo^k> zsQ}*TeWHg$6_Al1Np}+?XM|g2U^WHJp#IQz&em+I=*Jjfu_U1vCrq@^vIIKflvwSg zoig^hSO|+P@Z(N}pVEwof!U*IU{;6*X3HVzxw35ddDaC#>sG+erZw>3TWECl92%Xi zN29aNYkd1qNf9+Y+bP30hghGbNZu|01IP#Z$_xG!M01X@HK#X=7g&sjo2ALE2_Fg% z%YsEdE?(FyIf>&cKPLSuGK6;zT9Y|RO%uOfE7&{&4H^fOXPrz~8Sy`7NZ z+ACtJ6&<;MST(eCgtJp_yzboD;s~aGU2!Eg`{#CB`%}U_}Mfv z&7{$k3>rdzkaFCXGfE7Esfe)bHXpPKG=?Q>QD@e0P1-mgjzIW|Y@wYb3%s zYRhAhT~i;EU1^UIE42Y)zGBLQ21*OkECnu4fBDq!e%UU`uktMQLUKD`k3L^}G>b04!Z%mLD_QmoS2fRxOyn4A0V+Br_dt4HW9h4NKlc78qxe1+xY zE%cyEg_I<#wh@VuvM`sDG`RC1zQKe^F?99Tx@nT^v;xLIG&`ARvK>c-Zm|i7lr=q& zhkhCK*%D{nf%(PW7`FOVRLBI`>YaLO)5_KyMTbl!slW&bj2w$jxVTh#Rx&lRwwI*k zgScd6f8>W*%x8R;t}CFggwx0&u+=|+giSe~u=I1N1Q9lyB?tH9U(g7;0_PUAx7TrMKMfPiZR*EU_WiMf%X@Cl9onw_a z20Cl7r*L4tbvJe;%F&l8&xS6x99$|}eGV5W@_kP05@<{8HgfuIiuuT~bn&O;St+zV zp|M@jX2D0jP)v8net3IRme?C!KN~6;ZIy?=0j<&p?8Zk8akNz$XscYj@|9NUg;r4^ z<6fw2ejy3`l2T&0DWsj-HT;W4TemWWx(4Zm_Hh+bha8v56m)b4l6WUT-ShFd?#b{v z`4MjNRqptzOAa+Dh1%@{D)A$*EgSwF)uLP{;Go&gCF5$>UYZp0tqLP8bN1QZBf--H z+O4SQdmZFxRhSBws*pCsIY{JNWICQxa3u9h!Y&?S@rBx^%Ajv_?z;LuIQ zj-%5Bu1}*~|CN5fgBpXTe5v0fMhk3pl^$*PjO0=HlDdu|3u$a7b7^cL-=wjX+(+YN zayP~gkW_k`N|I@uMl3X*N*EeXBRU#qklt+=&m^5RP9cQGvq_l7nWSwSLYJ+s%O>y9 zqy^+%8t0LBXuOF0fyOTK8yYVqyJ%cQen#VET4!OM1fxf?If`~<%}t#rVMWR@K3Fi{gA82E4hggQqsI!ucq zDZipA>lnu@*G5A9~LQ**_*8PeQ5Jv#%P{ zl&c`g!F&(tVnAOPOCN>w>`r6a+ADGZNL1-ieITCofCkh(^>nQ!Q;wOV7w(0Z?wa$Y zUYHW!&W{fe%ba;J!tIbaYR;1e!6F8XV!biGT{t1DAc$-o=Wh**etoc~o^pQ4buj=7 z6!RGX056^IsYk|yf2B-@2Uz}bNDX26??U+Y0%nq&m*u=z$r+aOV%Yt0&z`wRu28t zGqHGbD=oR|B9{BSX|Z@boQq<5`f=Nd`6oZ|EvgC2GYnryfDbe50#h-`Uce~hKx#~< zCQ|r#l&?bXz#J7Ov0uM7F5E!5o_-_<4ugT(yJYbfZvWb_C*%rbgt7UoRS;i(JrlVc7b#W zwV4^zki~(GKJpH(%Wh1nN#Qz8zbmfo2x`)LMW6cTgXMelH z26_vcJiS?KT0jZ-bj=vH8aJB$jjk&DTV2KIY$wu>4|J6;bF8Dk!sxhx{XorpB|8Y| z%0%e02?N~)EaDehZ=uRdnjycR_x#5=RA?6&zP^j(#O+YSdC}?(Y4QJ&2KU6+&J}e$ zj%@e%t%x-gJobg(=my5tt5wc0^{)QE1mqnWoUg#IFGY{rp>Y*y2i{k$3d4-L+0gb6 zz;J!`pnD<|^!5MuQP9`_KTkpT{%@tAyD4Sb`@f!oYH%L>5(Pc@znp^Z{dx*|;6Fh@ zHx741Ydhz*bxT~e%$aj-P4<$sLW$c7T_%;hAPL)~lD$&NZmHxIspMs;WV=-Ix>WL# zFp+HiS;RAKL{W3+�mX=;GLGUIt;W};x2uPAS1)Wysf zuP3nIzYjOcrTO;$L}#gMtn8Rkd7W7w3t0ZJ@{#OJlSf2-R)Yv)@|cR12KJC&B=-7VPP;(oJByl{+%+o9__4dv9MGuX20u3D(9fR17NjI<&={p!bunlv4ul z19%dES3?hYg?F(aNq9xLONmvT+M9g0k_;t(Kub=DmK=TRZCBpDCzv?`UShxhEV?i= zcKp0wRecZlOU^w5Z64e>`W{x{qkKJ-{(HGq^zMc^ajRru zt9Rkv%;X|Fw|AYT(%WO&Xz1s99)-4%xV>0wcFV8Pv3ap4zW8DBdOTZm@Rq77hv4(J zCgpahed^Oq@$8{a-=Y~URo7isoo@38t@@uTrZ<;Zkwe(7BxKsz7oWfmq>rw4Jc_=( zoO|Irk5uV-3b|9LPzu5o`83cK@2Sw!*Ml!N!ZI)S3o+t#|g=8WmOL3GqzS(pI?4COS{)%c{Jmbd~FYJv)V7`SoZuRjJnrHqm=p748vNorX%DRfTcl zsOgN*qjng9Nmr?E7FQk7N!&5fyGO^?tfnfAW9)u-T?okq%>iOj?rY#) zGEzTAw(bLnTyJS789*}K#>Bz}-OAU5w%fLD*;}2!y-+5xWzxcUnR`iEA0rjU4s7-q zc^Fr2eGlml{7`2x|BKG@PY`|t;VgvF|Ejax1)&PUY6uF1FoYK&&^e4BwiP$UUFZ`S zpSKf@@#TVEx%mL1{N%=}PY_VRUqGl3*K#bxwL&-n;Ut7p5I%r#8p4MV+8~^PaQ0@1 zJ2w|*6w0zWU*cm!IWf}}BmAb8)ttZsu)LkZy*1s!J?QAP>`q6Sqmlg)o-mMTOs&m{ z3FR2{p&VmID91!yRW-#$hg%KWRO0@(N=Ii|g8_QkSflc6PY5@A3vuO{N1(Dx0APMh z6>dEA3kmQENBK-lPjqw&8E`wTd>Y*Pa*Up_F0%4Hx^i#p9`vL0)0gO63{aSqd&<)W z^UnTi-e(5##=_j48i(sw&GMP2nk-I`pA<$81xT{bnDeyX>8obUe?E9Q&}(7$H?oJ% zNY1@B|C>nedd`U*D;#ZQQo$ujxF~r)DU&$hr?;`yuTk>%CK5lI2@*kYsQw8ak-=?S zDjyXu#072|YMR*U=aJwwnGMcuWmR^dch2nx{eKSW7f^W@W$`z7uG8bnbm4oxg9bDZ`WZ)5lSSg)odcNx0N;LQe}5(&U2e**){4)UE=l z-TgrA1R@FTk`V6r6>h^uLyK1=@4*JnPYGVZE3)7>oT%xRgx5C}`IaVyrGnj1l333G z!vw@o7WT0F9{{o^Z|-A%dsyW!RHt9``gQQ}&9x?t>iLoC^+u>(K_?na2wknKI+56^2{&Nm1g=ap zoJcrr(&(EX4Mhrik?Q$3KNd~&=E*HRXW9Kgv=18UySYwE_YUB=(+Yg17pdLnSYT)1 z;>6ZV38z)(L0VR)@V@9hpi#a~q2p-;D_6 zgIw8^^4&nn*Nv3#i?S?rGg7^RF8~e0ashno696e8AQfB$biAablp)KEhCmwIToush zUKoZr!Bb+MM$hMd*+~K&7Mv~TzK!_Be(zzNp@p-+U9tOH<>P>GCnsNvBH2k0@+5Be z0P@l4wV&e1HCFt~;N*H~U~**u;W|F2Sz3hg3kMO6Lqy{!qH&ixPSPBmf)#SK(H!x1 z?v!A%b1nQk;;KD5AJ;X2R(pn^)nhQhQp^I(D>y(=?tq3<;;Mr%kDiv-z&twE@iE}k zS;VP>8crS5NktT)U}zoygnDHFq2A8UR=GV9gxdT=Z4$Nl%N)I%GNTA}FCtXQ5QI9H zaCQ)(A~U7~trZcYfLrL@{OCZccY)l{(*}dp&>O|4-H1;mL-0w#@}l^ZN6YCHTG2)5 z?!SXhGblPuMO2cwFN8ZZOp>_nC^9Yl3Nqm|S}_4IMxzW-QA@)az!#fed7w;&jPOv# zj{ijFdK0co9N?Pwk`gW(6we0U(TeKklJ#-{us3_lq*_HdKlX|;3K&3BiHlMu;Y z(p84$8}x(o$^4kme3(n-n{*w&#bb|>ih+aNWRRRzSs;Nc77tT(rGGB8BVf%FGQi_) zm!0jctHJ?-!@5`I0HY@w{0V_aa0d)WgtIl>-urt#uDXaSluc7n&7!^Y3<-pB|WgtUtfbS%9)+Xct zldlO+?IBJ9e*F;`OOMnU9?6{L9Vt8g%7RLVT^JEEWIW<1@vr>?eq`?DwZj0KH&=d= zSXrN1>xv2KGeX(WkDv7*sp$?{czt$vkl_ttqp>?^#F*(0#$ase4(c&Z?Fs61j1Dhj z^_8EX86gPeLX+cahy+ZGz()AanpcePQ)!}iYXBd0_3BJh6WvPhRl## zh)oD7F$wiptWj6WLoSO>7X)bPExhRfs(rib@m!s^=_g_mg5C8-UMs7+J_fHCywXSB z?5RiasBa#~+#oj}q97jUCpz8-z>Wf7#}Tj<8erKPV5vIYn`k_}d~z!uT(8rYKEaQr zS227%2oh`}lGmWvm>o>ardOA#kJo=cgFcs*;ciCSJ|4^CTDvtfT01ryu~i|C=?TQ7TmsZ zaiW1S$o=eV%jh1`WLtN&|9OD5wCqWBhJ8;M3z<;H9|^Gr_;CdMZS48UL6KzhDbxKh7vr)|Hq8yS zpt%8sXl|&D{Ndz{X=yztCZA6D5IDFvIn;qRGGr1=>n>>aX{0b#rz^&~Oht=C+X<~M zj~~Ww)-=$zk5s2QTAk)-b(;0m7eY-a+68hWRAy47GRZ?KgKdnJiB0$r#@XqwgTFZf ze{%%>W(t2j;7^L&VrxwZ^wdMc>u`j@1frctYQb$^Mb!Sej`Arbj7@d?5vB>~_3=bk z7u|8FIZ6GY6g8Yy@*{h{gxMY=dFs2-onF89Mt6Gg3G&)L@yZBv3}ldnfemyh9pb(x zOa8##EF-ngl0!s+@`E;1*Q0|bBe8#nT1o!(!+pC={+l|B-pw>`az8oOJU6 zAX(?eWgU(wgkI;&xTxX{OWsp#^>Vt!106~EoMZ_-WkMd0Mr3@c=p}lg2<;`%q6*Eq z9-&E`ESwkn)dubqa(-xR)kc0ux0DsYEV52c`MlJ-LC5Bh*+ceg?+2`f+7y{F{ym?Bsa@dt8Ic=$}W zM^Ah|qo5$N^XZVqHJAx$J?W!%Q`BTbQ-#W1N+dIIl<8n#k!1A9s`WjP2~SC(`B1;_L9reZ2k_a zL5wP-&gImc0~mPYJjgHS89}b{rHrxxuS10ggRMIk_`@QgnQAub74>-xe%oiBD}RU_ zVCFcG0$mz(z7*j4n1qidM%rMMiWv6LXy43Hj;p}ON2S}#nj~@=YR;$l9z|C0eE{Wp zlogcn0F)efS4AKA47&Sgzu(@ECsrwUA$YBUOBM;fXOV9NE?5GeTN2(6d}68MNGGtm z)H8&A4a0x%HgXp=MU0RkXUH3jRVad?D#6eVttw>zLz!?D8}-8ohgowJJ0g$aTgpH_ zER*u$2e`o8J=EzKQ@#Od^NZC;o9!l?M0s~N$7J()cGE!>Mq@T~G5cBpqul%V_Nq+5 z{HR_!jQOKZAem?ad9Io|dyL?pF}-n|ADE6t`N$Lt}Obbp&9<4^F zbZ7?bXx_~DoR>*k4KDFnWWfydq=Ao-GGO#hBX5eTN+*zrTIXRga%yBRb>GvaSw?l7 zM$=}ml{brCYs|(b_)Xg!l%1FJ>n7mQDVy|BXF<35xXUhfAGD8)u;{12d0BH?^h3>G zP>|hcoG*qM+&NP>aiP*sd2_lDD>{>76jSBRbin|LKmlv~>02E^`B)m{~-V7)-hoE-ZKvFZNo5F_2vtNpl%9iv;6B{KW4N z93aoO6Fq{J-FKATZ(iITF!F$;N5zf|Trv$9^!$vvqm>;`R$jjylGhu=j#M$wue=iPdmMD(S;| zzp&eQh|2imcI$-)#c&KiqRNX~iz?TTfGSS23w`VECgZ-Rswh7;=q90w9<)=Rs#xl{ z>XyL}(&z{}>X&9iR$$V4O8SO%pUm|s$)b{`8%T7x|6YoSzKd*WJyf+@-mx^|Pcg45Y#qoE?`}xUYNG~?%=X_QX zJLl8&F)>d0IPK&rzo)O+r`CHR{yFN}ZZm2ArChBTh{i z&8Z1>WkQ{rFmPr5ibs=D^kOo^J`=ad0B9iBE=n^CBXC1W&jrYn-*X`XCVbMMU0pDo zd}8?P$9(hECxTIzMk~{FHh&%D%$M5&VcdEXvHRqc>f+I6^CLYo|a82up00lCL^)X-_TE?!m9CDQx0kXUa7fl#ln5>lp6=SU|p(hE%0MY@i2 zq;&Zc=o@!_-<%--K((L$e9ou*-PP^V5Z%(E zK8(~UZLcHw`S1JtCtyr|4bs3i2wNcV5LQB14BGa)R7uoA*12-_g+hHwZ%8-y+hI)L2_AsNCX2=^Y>>bnA9 zUIgI*2&oX_A$-xK(|ru#2!uTlUV^X%!a4}$5FUf@AcScU?tox!`f5AgpRcq0e7Vl@ zxd*t)4S&54Jx{KC^1jtiKKrfv3Z8xX+2__j%T-i7S1~kwv9Nlz>$#_%X}tvF8`_L?tAFbugg!1bFO;kxr*l_b;3XDllS*Jx^-(B z#5nLQ5Tjn~^6zvOT#P*iF>b8e4RIXAwGcCreCU#7&F{4K#Q4dIiYK2>eTIG}^~u$% zpZn)05suWdC!bpVe*!gvlg*kw0DwbF>|F_96Lr@Aw*|xs8UZ<790UXe+os%?ZJMNQ zAQwr>9PMA(=pn0_Bj^6%+)8-Bsja_wc zAK&lIOxm=Vl7OGP>(?26{IB=ky!Za+{3kON+>H6)Jx(HGtkhW;E&|_eIgHVJaYZOM zMvTbycm+xm zdp*+yE!v95#e407i#)0Ex$OauPm6Xzx=t2?KEaD?l0x(yUb$6p0#z|?migdcg_VI8 z@J}k#dA%myBil}PXOi7MzsLzbf4I1W3k7(WAi0aWo41a`qWz_==dT*u1-bHU4%y#g z36%ExTtZs>{)p(7LDwKjq+jg?+)8=oASw_0_(G^zSA`OR56IdQ-M|KHoaXV@tG8Od z0WtYPqPqdU{=^r+Fu+aq1jR7#t*s!cNr{l?`o)y*^!o&i6zOmj0!}0oYvij3*R|Up z5PVWy`;m4FQ$4OITE#~~SpfY8ErvW3-8+e9U_F{rG&{^GK>!*_iQH(9WSzEm z?;1ZC<-v~VQbC=Tmd1t!g8t$lO!Dy{2+M1UTX8*wMVf-Uq^4SBvLT!@NhKwxG-=xG ziso0QUe%)I)z_%5ZPmKXb#2?V@6fT+^}p$S1J~uouHCxd)T3vwn|t@UB`rNeo!Pfv z{{aIB4IVOd*zjAkvNbtcojx}&-!NjN(PXw*N7?L-g3)8fjvIg5ZztUDoX8it+(J=t ziD%MeZ>i58m=X+$;i=Qg%BSCP=Zu-N7$zfSt{a1H@1JHDrAnauf{+lj6iz~WGt|}& zO{gd{@*z>a^sSZUITPXS_$97LZhX zCdYZ!wt&k$FJ?cTZE!}XqRZkoS+TorI$nEg?XI6A{pna%F?-J3d3VkK-QD;6{@w)( z@4J7|;s=&2eej`W%m47lKRx`&ibq$jTD@lNy7e12{`s-LYDQ4$V@l)N#5+b1XqM_7)T{5~ne z9#%qLBwpepdZHs5Drf4hqs$sJLufGPGC9;qpiqI4aLvN@L zD_{(4f@!dj3{{T&%b3yVd0^EZd2cC@&e(6qFxK;qpQfb;LlnNPgpu^Nj`E&Ptn#lr z#V&uRGgF=H+%W%quHo{$tcJ_CXzG?9u2){DWvWQr7ZqO+Md!lQRh(Z}&c3MfepaR$ zX^nlI!(*B1?_(R*^Wbf<gTb1t?ooue`Dz|IE^c<#+VeEw8Fq z-YpQD|LioTYFpMYzkgk9{ntOnRJ(!7*J|7A^w$}y-V8af*5+-cz3k16`}sfjett{l z428T-+OEhRgu4bQ3EJ^~h zoNgbPcy+{6KB3qzdU%nHVpqwz{=!L4+Si+Fb{d#&GAU6TE_0fA5=(N;V4o)C;oNa;B#}_6zdcNZRRykQnrrvsO|{3&lie zJ2z#tywfKsKRc3AcHlcov^GIb-k#!!>~qyT3CM}EHj?Q}DezG>dj)sRBbZ!|SK9s` zkzyCbn8kyW4I!OS7%narf{`Z?DH zL@#TlJe+uzw6%+FITIRCnx5-8$^!!1CYSQ?dVn^RG;Bt#bwp+6OUb@}Fj7-ryTfM} zX%|1FVFg5gVFCLg2FDn-G-Zs(Eoe*lpu=yX9n+k0G=(ugEeETVHOZsGLa^K_1f>lx zpG!6k_4Og~I6SV&imloUTLT*Z>ynM-AuKx`9#|8StVfJ>O^*45hpkN+Ljw=dvO~!> z(Ock~hLMLgk*;ASXR&kA4x84>*b>UM=uH&2B^%LumF-CQPM2)dn)rZh5Ypk~8mk@t zh%1;rnhI7wC)W(6sHVX8LfstDh|)M9J#LUIk6kbI7(48VdJ?8Qm8yFPuGO?WWmmr? zKYz3+IE^`@UlrDfZ(?203irU*VJ@WKD*_z-bq2r+OawBnlgk5u3aA8*0V@@{%|I3L zx0XZ7uR{D7Pz_W9E89RWpaLrCFU12Bfz1HD30naKfMY-vun5R#BVQ*XpAmg)S$;%^ znldGi%2tA=qP1LJ8Kq~HLSIeSZwp<3YRYSeYXOx=S0StbRsvRF5uj=h8ld`G$U(?~ zt`hlG2s^;9gMkuY8Soa+@*rb+UqD$Pff>L$;2`h=(CHZN zU4Uu8YTzv(<)>@-^YO@8G9hU%~4p-BG zQE#(ZY>DyN##tSSGv;f|IyiJBu9>Sb7z=EPILKf$>hm;6TQxR~N$=1na%F>gw8m(F zXGiO8c7w&70BeC+Kh~<(I`mX8db?ed7njyK1qLHH^kz+tQBQSb(3>5XzzBuq#uTU4 z3VUvW5eXCOHvy&u$?bX@v~#L0W@B8BCI}bHd;K)ZL0dMH^xtao_ z)JI5w9rc$Gn|-t`0WO2xYSfH_q2nC-#5icoNQ}c~k85D6p|?9UaVjPC>Ps8T6jrUp zjM~Mh6jy^+m~?uLE&=jfgV|uur%tK#?F4vhMuVCG>5`b^9Hr~?jnv20Tk5k}Z5A|0 zlRfWJn5hZJ*=6dpCNN?utY%WwUSPFaY#22YVw78))Bz3V#CZ+Y{P?B?g~@KwjwI(e z3aklDN%FNIU81X9Qd@ zQj1kpLga(urp5@Dm^NekXACA+le-dSikBrWf7-PDoN8&cY0~vij3LhTW@PG>RtFf} zjhZ;uL&`va{!OETVSHT8J>uA!mS{1VNQN2fuuI{$*zz=H!}z#o@rL+mMVO!-mt(`_ z=>Ie5ezERPo11E7uUAc*y_p#elZs_dwX_Qy`yQ&6P})5n&>&r8A6G4JwOZb>?ssuQ zWrtf~Xt>QtPZ=)axaj@$izuo*f{3TZC_DU8^<7M?{DdMiqw!}`jYs3rcr+f3N8{0W zG#-sdY6sQZn5s3xJ=>(8>#zj~J0Nr;?1-=r!cGXk+saf_r~43gMz{&# z4G8lQQk|<1QhRE@g{kN>Ic3i<73t+hD7`a)a5`NdA$?&d8zKE@IRl~jWcKq0#!I`&IVa(V2RZhk#8*8lf5@at#_*6)}qDY;4WwHOE|&MBYMMaf_P zp&YJSCx^2iJw`(g%br;wg&RTt;+i9CVpXQ}HvouU3Ae;auTjFSpg*ws#OjXhlhvQC zzAd)=nX9DOC`=%uj@*8PW6mR!j$~d)fAH|pV`mss&y+d8dqI9TNBe)g#wj~f_Zvi) zn@;)(UFq-4M&i}aW6r2#s?#qr)!k>Assj8(Pa)NHgpO;vq(ig};`;_Z;r3vT0@?#@ z02R;zXbv#o^h-=t4V(ZD169Btpc2>tYzLkJHUpc0jlf!9CGaq?99Rl004jhoAfV8f z026_+fDzCEgMdCjPoNvn9%urb-i^7rNv$u))-;+M>Cf0+nRHRiQV#MR$w;g3SCakD z^XL03>!EDme2TpOnvHhTURf7Wd!D7NBchLrfGn^2Yx%t*tKD&V{Zw~({KsG?_fL6k z7Rjq0r!@(EUunFu9$H5I7I+)@mez?di2k~i87NJv3DBhj zCcqo*;FZbQHSyP)*2d2^uZd?r+@dCKed(H-c(?CbMdB3?EpHo%b31l+kmF5u?d^15 zKZ>vVa^L<=yAPVPx#|^L0=+jr{_-Q9?5YXpx_{E~K1+vFbF-&Bbm&3t)lC=ndU8ef znO!S&U(RlI|Li%>X73vI&iVuA4L6kSKA7!)<=BGHEB59+w`8Mc$6b>PdJJCpL*Uq* zIXgbM@93FFemphvu~FJpC#QbA@0(uf^Jd?q>#1t@*y$%!AHTfktnSo?x4-@2)JG$x zKX^bd?0a?b)$5;F+2P|gxh;iuEyA^juj=%SC_X+o$d9V1f2Ty<7W7q1}CVWugGw%JDZ^6_tqIV7r?bYphkj^TxXjmT?)O|FZb$-P+*?6D6G>)vRy^N&wv9W8!t>0tfiou4|eG^<Vtw?U3WCw*VQp??)k;Dhc7-mq{DPqcdfc|)37f0yg6u2-m>lN+@YcG-#xZ@r>8#q zc>em7p|8x-=UlP%58;9Dr48vj<@&d}zL)uxVbS=(>wmYia?Fu+bJnlkl6k!3>1#LG z9@UN8rs~t(aN?E${Vet;_D}A9|F|Y=E06A;@#AN&bYAi4-Q&kB9=6Lm_r~_-kwW3Q z|84I)-QIH_0AdE)D3gbjT z#YzAbP;?@q;@E;%u*c4f%AELn&N+X*01qD|AR=|p-M zT|$rJByy5D8Jsno0?tN`oKwN6;q2fvarScBImb9^&MD4$&LGE;%iwP0%DFXM63?0E z!Sm+PdA>XW&yN?v3*$+6al9owDKC|m$y>uK;H~G?^7iu7ynlHJz7=1{U&vp{FXXrI zPw)r%!~7fkaXuhG2uuV4f~A6V!D>Ob;EZ5gfDlrI9AS;{jF2RnBbp~l5UmttiMES& zijIpkqAQ|5MNdTkNsPZ9pG1Pq;2H2TI0`PICQ3U7%f}U8RlDCTLG-FKM1kHdDxqXD(xAGYgp|%v$C?W*74U zbC5a0yurN7{LK7^iC`JA%vd%oCzc0GzzSq7V8ydmuu@s8SsPh$)*e;|>jZ0nHOKb? zcZB%>ds?dKH;wg@T(dj(yBg~9}3ig2^AT-Yug6}}LnMV2C(Xv?pC7~)%OxTJtt zU>Ud<)Pr7B26a9)mO4XU#%N$X|0@3`{}UfAzzeJeB!NJ1Qt(#r zMF0_EgbqS?p|?;ZoG+9JGld1ht-?m(ap5W9Md4N9T_GSshzN!?>7riIWzh}MxahIy z^{R1OEX5sxj4? z>Ol3Ra;Rcz1a%E{J+;B$>p!WtsrRX~R5*=HW7868!?f45FEnpDlU_`(qwl2eryr)D zqMxU0>5u5o=&$Jz29kkiSTO7v6oxy)hrwb982*d}j2OlWMk-?!BZraC*udD#C}Y$x zni$6!XBZb5Ba9o2dyGen*Nndz|1wONUQ8M@lDUal!Q8>TY>3rgOajZ6HOCO4C{`Y8 zJ?jAL6YD#R=_~S0_m%th`+o3+u@|wIvNy3?*caH>*nhFjIrawX^EpMFS_AEYyv4i~ zyp;xi^LP(LZT>E z)MsG**P!cHk6;B74Roh~yTRYUqXw1jG4MJ~eQ)se4=O-|)4XXhv|QSHS}{#dE2CA> zYG_JYBkhqPKTOl!(Dbx8dXj|pj9ICU{Fn#}s$x5xLaugnmB+80QkT9Yr2kM!(7TtV%9N#V``YoSm}lgyPMU| z`iF(_eeOHs+ruvAR&#fAhqw`f!f+nK{|u3<39b>Oltn~I~2b(gJ!xj1DT-)y;L!eFo&7r%r{Iu^Os7zSRhNnlChL5 zHEWcmW$9T2U(h$)SK=%4t?^a*{%XDreebVU)3Cx3!y0N@53QGWo~AKWmtk5By^-EZ zZ>M+Cdkk6c5`C0DZqV>k`WyOZ`VTssfiv(!G_d2vU@-WM^=uhuf-}vT;h?!TT)x56 z;arJ95Aj?nH`P#a%eYmBs;lHSa+|oVTot$7z(FTh&F$g#a?f)$1|EjFqg<_liV5xm z?yr4LbKe+Z^_e?ks7C+~&O;kiMKF+J!z1#@JQtoj&x;50#Jo^mxS?{#^5P9O>sRg0 z;AI;sx0IjC|Lhm5kM7!#dPPEL3y zCo`gl1<}QhIM?3Z$=un~a*m6g>s)&es)H?P=}L2$>tP=@*U8RjuA{4yrB}>zi!}&?k{Io zC8cF2i?UY<^3wRLQsS~R<5QC}vQpDiGqbWYGxJhn^0VSMW-ZQNnUSBBwJ|$;b)Ia^ z#x?8n5{fr0Ey&9$%FijXqL|XcHRZ+mJ2n)T z6qJ+}S8gq?D3a$Dm29gnT~c0}zpbpGW@}+X+1kc!YisJa?AsH&t6@Xyp0x+IZ)w|6 zaA426eX0#d+BbC^+j6F>sH&`T+qUX$)dzM|Y;COBx}$P`W6h!M4RzJcO^uCpEe&-o zE%nU}?Jcc`+IH5pw>GGDbslUv^xJ{Dy={l~9zAsUKto5z&Z7s8b#xr-I=H8+b7yz^ zf$q*@ohSAjS9hH3-g)lao|E0j&h`9$>fG@Q=T03zG|+Q=;7r$*v*#`io>mTCXc|1( zIe7l$z=ccWeS_!wk6aw+A0BMJcC~qEuxIqzAGd~EZeBhyKKjSqdpqymI(h$I_t2#) z*RGD-yfSp_`pr9kPTm;1c6WUI{{6f6?mT(;@X6GJ3zK(mJ$X1W`S8i3$+M3p?>&5? zdpgzkd}`v&t2@u8p1*qe{Nt-fAKtuv|MBsA{f94~{`&mk)vqsA{0;w~nHpu*A|OY$ zA#YWBMgch?DI+I`LY}`S1@Hp?XUd!dh|#lvF&dNu3PmXj;cjt6rW;UTD73^XSzBN= z5+57RmI9Yc5dn7NRi^txlo)TPOTFMz#cqV})z&j(H_ot@K<_jg{LH_3#fMz5jqi?bWhb zqTeUfU2}G*{I|ghb2s6vbQm+17vARDs7?A*iGMIUciN`OzM;%Hvbn0*XKPa39|@;F zx8ddz)j*(We4wJ-g409p#}s|`A9g(5>jz)ve*Hyj{%u?4U5L$$#y@7Ct?CjgXv55d zW%(~tWBs71iYr?~%7^=xT`XL?1oHgCgfrCbh@#qcPwKz|N_3A@xm~rYaKx=s{1JgS z8(&<76^ox#;>*DU;XcwwO0iMWFhIh3^@>pr!4^^d$fnO-HPq^-l7m}=n^`Lg3lnym zZ}M^l;10y|RSl3d7u&(Mp_>qlsqZj3V0Bz7wAzy6wRNdc)n%}>eMfN85C#KEGa`){ zmF8f+I} zp3u3CdDpCb#$5+-LVbNX?o0Bd-gG-) zod3Am|M>FkGKHNNS(!3sQmpegjSf!?#FFB9A7M7`KIMbBE=l%D8(@3?`slJOZym;K zlOpG+P||r)VdbJgH5LIgV}Ha5A;*X=KCAj2pH?l)w`|?3LDqq@)s7XzPGRK^i89Dr z8~C4!hd%7r{x(5n0unMV)+}sZUpoz%$ocA?hdAc*^W3q5Udh>G*MC<9_x;&@gBzJz z_mjW&H|%zZ+m;MKcXknEjyf4_YeSAaR(Mh~@^16Gen2KCdwAF={8BmFEUr40FIU0r zrqC3Q)^B@mql`E{vy=9Z&MQ5)5`Wa)A8({Ea!S$&!9z zYoXoi{fq*o3N#lK;|g>z$7ziNRgZ8^)#X$2o5}XFK~$)8)2XiOxHheo*Ln(0)?4cE znOsv4|8Ymt`F8GDKR)mCepr~jiQ_vE5%Htn@@^s6=hDY9nMz0&LI< z)V!L>T0{c`uN?GxM?AQearGwDMRxLrgPGDyC&zImXYG>#o>vAG`(_woT|8M6EK9YS zRv|?yf748rr-P9xHcYL87ChBB2o?{)XKS~gPjp2&tyA>vA9cSNpg~T{P=n$&LYaPW z{i<+kJ8>)i5a7id9cR%|XF$zqkmeeo8uC$ZDTyRNf=k|98iiVGnUG7z~+9z=t zQkb1qSxGJE#~)c#N*YsD3Xf1a!ZKzR80a&(rGqX<_>9QDzlT>)a$-y4cOsHSMo_2a zDJ%2?sJ-IKc{K{-ED6j}t3o=Z>Q1g598bV6>YBoEzuu0e-_C0MQ=Mhcu<1{?C^%+*{}^PqLcMv-<+*zwK9&&Of9vhcvCqS+ zz7!q!_Ll_!P(ZK0RvwD5swx*bO4oCQ=u+zkZe5Sb3r$mcBerQq0nm+%?vf57T7RRI zxv!*CJ+5Z9nwj-ARR+qT*Xw3$EsCxkTm+rJAPm0OT2u4<5hi`Be`9jPZ#|w+kNn7U ztJ-Pe+ou+Zpl39*-pFN$0Hzwrl;b)(JIUX zbqI5f(zvKM#q#~GV8Iv#sr@|S`c)`~hJO6~QBwSr_^KWf3BVsuxSAAbV5E;yG$_*m zA5NSVL^2zvcNUF z4I=ZqF9UHI&T7rR!vlRwKbnEu^D6e3@dO2 zlH-eW4v$Y0_9YC&7qMGDJN5tsIL9x}hp!VSAG=B%7nGLdjg}dwG z5)e@&fg{zB1j*)OUC?kj(3w)~CPpvS0^-R{o8?IN!I<@BkOC=8_KX*=UxZR2>(r=b zLd3xx=9TT{1-s2{$>;$xwlD}?u3u6n#db?!C<44yZd5Kqd6XkMm1vRk2X)iIgan$;i8asD z9WG8n<8-u%Z-@(WbdZLWw5m}L|mHpKz?lJ zj(JYqPFA~f9o6udAhc4BX#g>u2I=Y%8FB4U>iDHc~54a0%?P;TlI`H6VLs95Xd?SAxfcM za-uVal=cMLquAgrg|CpHw@l9&0cYn0sbE|QT%@7~>L8vHw3iZb?Iz%$LMDJY1$W{S z>4LW|aY>gUhmKh8(aaqe<8G;qr^L85GWK9J;rkBro*6f!wqdv|qB9OjlMvkW%5~!r zC4;LM3_|`IUW(GAGL(R3t+2R)3Bq+uwW^o1s$HLF?O@? z-@d{BDbV~02gZ5!7^XpOWxN$bNcop_vn1eb=Zi- z++F<+6FrP`46%t6D3Gl1D~I?!@H(yGBslvZkVx#G# zJ7dIRJtCrCz!yVSGp!<3$Y+*<3s!;$xv`5I>}l=9VTH(H$l>_6mJ5jOau>uA+48K* z5L*>$vj%!`65=gaby27Z2a)kW{jsY z<$=S+c5#n3w8(EkNLo>vWo+6rTE#~oLXFyZa&fs7y%lJml$g9$Bcjt+duok80VdDM z$A}w3&)Q-O2uP(8%N+J>_Cq}ejmMQ8XBQYxN#{e>n&|cT=0>~=1Ft-UwAK?lpHLq9 z@6WVM%<)X@Waa3nm2F7)X;&Ckl6l$`9z}pBNa+cZAetPKKt_73L~Yi=M%)n@G?PQPcf*B1rH2G&iY*sgN^-jQ3j{71rsU%QOCm&uQMo*HFNm7&dfXU`X zr9Rz|<>H1EIqbkcz|=5wE*bHtqAiVr5b0rQB_V`C1Y0=^^(lh-LP=2|B3h52#lVl0 zY|_CaAC!emDncFhNsgf;#hOce3y#;{gpabSQ#%EjeSU z*QM7H_j@wWbcDaU#jysItJo2gZsGjd2J>TM0A9Ohe24Frt_$#w z`o7wmbx`dJb4#E1yFB0T_H*01zj^C+LrP$aa|qNvFgdS90l}-i>J%E{c{{`#MR>o< z*R>?4`o6`7H7^v_&Zu>WNl4=^Ad`T9CB`yTkXoJbd%5vZ9qRTnogc29V+fA5>)_gmPUxHzxt00nYVtOH*`))wedN5}}44J=bd z*+l^|CFpg@zTEw;9irTmiWw$Zk!ZCewc*fk3 z{lvg)UM7;I&gl+G0J-4Si}TdoDa%Y|~wJ8-?Ufgr zJ43m`XwKkHq5~Z};7?j8HqH(A^U#v-Bo93%!d#X1JIs({Qmli@Df%ZSTLvW%BJ5OQ zLuK1Yd9uEAK%mA{kP#$__lqXfT`6vbnpg*Micn$hX>k2w9Pfa+ryBLO5)-YH#!Jwb zl(+_&Gf5M;PSU+=0J%wnjMG7}8f~i%wNdSQO<_JyA+sE^^?K5GbJhwj*8Mh721Mv! zSu3F@2cT(6Of-Siu$#Dz7B&eXk<_Tgx|;EikZ>jBW`(De)#4ECfYBoFOPU)LoAUNU zOSRYzJ?f$aj#4!%)u;tpbOjl`O^Jxno!qQNMJb`1fVzmPO*YCX&KO`zfH#AO;*^M` z8#x6Qmue1THaRqS+kXvicy;SSXE0C&N|@b%C^iE=@?e)6=6e*p*_2XNI= ztCo$?P1=AHddLC^dRMupu?(Q;G37eQyqnNjMl9Uf8S?26R0Y=VoAS~+;W}iCHv<@@ zW?_ZK=+(fUkZeYJ{Y3Cvr!70A3#4e@Cs2Rz*t503J>$h@$KdUt5%$3E4N!Qi7&CZ1 z(5k&T$vbp79)i?MZ|perG>TxA{dn|Pl@~x=p~PH}W3u&_)w$)(Ahuew=!9x98)!@Z zRP!Pq5R&6hXppyqS-xFiCMw9D0}&V%{E*scjnw7UI5z4@#g0OpQiK{y-8eC zZSDfrS_1G)J;YvyxvP46oy$T-!+rD+3p;Vi%iC8CrAJt;Jb=ZA9Uyr54Zs7_>AaE;qQ{ZlC%q1h`oe04*`Li`B>#gXLw$qFzn18*Z10 zu}yNXMiGEzIBT7oBvXY~C6Sdv$Ct8B8Ze7i@GP(ADvxRAEy z{;Asg!L@&}^TJQ;_k1!igsCNwO`}v)2-Yu-maLbRlw%#Df3$D>95hmiH356{{Z0zN zy0y{UVaO|C-dtL;IzHNCXB!dj(fjj=8qyC(QVUX>b&x5iXk_FW=Q&}Hq8Pb;)*}`j zO~QxKm?dQx%k~Zj&s1u(-&FQ#nonZrQP6ol&cpAJ;e4Wi?DC3lRi5Y%!rOXpzN&-- zhSXaPjn&#O{(Z^v%+a2rq3w+mR<)L%E^LTd$&z-n)a?nilISr+b#w3- zp&q_kaH=@H)!PohlnN?BHO_eLOevz)?Ce{Lb^NpnR!f?gl~!0q{!pE6h()K=g^;71 z>*igQz+hLLmhPC3Z@Q#|a7*M8XN+BZ?0y_~Sm%uAR=tFG`(JaxDSWEBVf>bJ9QDK?sX-k-->$iThV3; zlu||a@^0+F%NU`-zy$W`xGZq$X zt}R8BMK3UgS+z?CO<0{WN;@c8pelLj?=%gwz1Ul-^gk96)iLjQucj0dRrBdmon%xq zG=i5X@Vs~WQp;rd(Q?bUo~^+1s}=;yz%P8;8F1=;9z)zD=w(Yfr5 zeWRC0lc-I87)LgHGSGM+dGaB~SRfuL#^xyxUM7DC;xot; z%KVvBd+CIG8@|SIa;kDkdINB)7CzE$!Wbv`W6mAn1e}U^5u4J$ELKk#IR>JOSPuyN zmx{}~a6NTGqccIa$(xhrG_+PH9jwB}&kR@xsAWlYtH=L7ShrO2VG4f+w^1X{Hj!4>xcN;L4Qg8)?>&~-ZfodnoRx-N&7DB5*F$&(S7S2Ge#A8&~Nmn_+$t)%A zMJboOjZhJa@N}gx<77_eBj6>+cjQv189!#jj2J6aAV^2{XTtk;mX1rSOvoDea`iwm zfeedKJE0uwHA~ZgG7l>XclxRyzKx8SdrE3VQ;Jhc+{#!ZUri8Ge zx71EMOMnZqb8yS6{H?F3gQ!x4aWp_Gmmx%r@gOBLbt=bf6>WY{?v{zCs<=p6OH(_% z(3RVdvKoqDM&1e;tXEjK190p0m&nEhz~N19-F$Zd;wX)W@#P4sPO<$L35w@>qUknf z1bdVWrx*=3*_QRg9K``O=r85AqjKzW^Z+JO3!NSodxnA~7M*&SW4tN4Svf5(89Y^G z+3CM^V|;+kvt33ea>#iQYcjpx@uOr&us3(MblpE1lVo(M z>pSu-BSyaoOXg=@Kqz+)PcjNw3A4XQF7;Rs!P1lim1sTr{DnM5V|Nvz2Ir%&f5@5=__tx7bPy;?PfuKbem#Shyvj+UCi5=K+w)Ky+b zlB{%yWOJjNC5?7Uyi!$~=$cO|Cs%GS{VQM&?%&PUJ*hV>KmZ6uLv`7OeJ||HAJ!JGcG1W!# z0sZevKX{-F;;=CZj>}io!*6NY?ZE3Zc{VAVRHW^D2>4A+Q%L1B!fILv!2~L>H1!{j zGwMH!9t_(0RyiWO$Otqlq!2CjrxeKU&4W|0&GF^xk8*@INr#=(4;5Zf75O63M?F17CnQk5P^Px2>;D5| zwpku%)1^ObZzG+*LJ6g4!K9JdBNX!u!+x;Qwo7i17@E;9kv4=9A?L5`%-mIB)y@sCA+th-P*yZ7^q-Hks3{# zjg^p}O8LK^_}A(3`YPbxtUi1V|8JP!=Q;k5bApG?qOVIYJZKOO+WWyK|r^`KuOH|+>f9kRS>4c%=xGgB7t%<XT++N-8&KYYUh)pFE^5?{mn1y z_rTYao+qrNaYS>WE(uAxYHyt}Aw&~l0dO1^N0jj#j&~#&G6#93@|I5!^;ieT_Y@Mt z%WfzRu&-eUUWa=RE5FI=6aq`}9`-69^q%(gKYj(GscjMzj}yd&Fu-v^TxkC#d6*&~ z$_4hYBZbnGQ>lP>D`mbulv4ER@(7Y9pO%NQC6&1*?x^-sQvf(?0QRYLhXP6|1Gr(0 z{C;R*sos4%-o ztQOo3s3Uj=iKU-_C9jf=11kq@p_M^LI`m`7R|KI|(r4R0hmq%SFiYYiB7>BTX+FQTv-hVPAhEgakap^nd|{c?m_ zSY0!iVw|<_19T2q;4^x|O8kLW77Cv_Fcmuuotg+tAb}BNr^O{X$H8409q8g1V|ftG zSS)Em8rM+GwXmONiBF^`U_M`N=*wv$L+G2)fl(beU1P7LzCrz`9;s>~U{y?)nCo;s zC=l`h!K3H|;?2v!v6eqG#hWG63y$fcN&pWpR6PrZ)vu`%T zs9{;S-5j=eGl6~D*rz1j_o}+tDgYTQOnoSnPRT(0=ag`YRBNw3KLrYk3ziih9q`Z4 z@I;eSd_R>$f>2?yn6dS1fOq0)Tj4P8{j@CBT-#!y4v8HhLJ+EX3K7+Thz&qx^mB~+ z06DG*m$Yz$JuE97sO4u#WEG$SgFx~^jjX~|V8Wy-0Qs7TJOs>t3zo(FV=_;k22x1C zdZa_H@JgpQdH8-VlIPft@c^$M+6GWfQb^=i=yY6d~(ML=?3!*plR|T)>c^Q zHrj{@EWHcS6P!OT&Vrg*4^CW;6K&K&)aWvaOYnH$(s zhD3(C4nPw3Ggu@5{56REX(-Jpm_$%sKqpk%AEGf4rZg7@HI3Eeq97UwJU zmlUrEeIcf6PG+|O5uNDa;3^1u3gQ(9tvx0V`~l%hh)O$+Wa|m(Gs3;jhtP5H)F|lk zu5Ag{ZvW%{UZusDD4%l=%b>bQ{TtMHFWeqpNwO9ieTU`x9_#TRl)!bUIyTv>`wO%w zypl=~su9`5Q=LetGDo2*ZrL0ziwZM9L46#EG>o*!9I#X{g}J97R=)OD1>n~-dObLU z1Ch9v&=mA8rXd|#BPrF`g{3nm_&!Gvl>vH{-Mbk`VZ;@9xNQ&){mTub- zD*DeAy-FD+Q2%B!`N%C}|DDJ)y2VuVSXjcK4#-j^LIx&mUx#G~BU12ur z_brB__K?St$5;lKoTA5{d91>cGa9it!19Bj4Y0?CGcgsS`bA=hzBqWp%CappWX@{g zn#O65aUaJMb*&p>YlN*d0D*xRX&S-oa}a9)n_L(w*$iSjMYpK8^i2So@X$at6!Eoy zXr10;H4v5{@aieVrtz81X}CcGmc|;CtRzeW6=u2?VV#x;5~5&{C@h~n#A!y>tDz{a z!Hja5P(g^Z4wN2ol5`vL{1aH{l!;~xEHL3%X$FI3W%`7#WtP@!Ac<9?WgWcE>UhhWd8)l8lZ*%Aq$ss z%0YRNiEv`^_y>U~>FY&JoDilml&W!ZvS56lc?`*|%_w#&4S;2Dg(Y9RO)m)J+zU6V zWf6@eRk<$Kmz9V}iy`8I>b|8T20(H^xIhBA;2A)j0G>#HKM#L^NE6-yW~!Y~5H4T* zKs^?TNQC#hS>ca3*SX~~5+qz;()-Y!2ne~EHLhbn-r{4?+&#K}2@)Qw5W2}M^aLf{ zBqiQjqVOnk!E{9V02qlTW+Z2dARwD=ja~Q|8aiP&5fXN0l~E#xOA31$e~sd*C930! zZ`!-$^)J}#Z^N%HNt?n&I~c0aRRzKV-qZgi$}5G6`-3*Nlh3o;M>}1P_;-$8^l|MR46HKl;Lix z+B$0eF*Pjl0sA%7vYEg^2iv?Ea+58&*@kH)PohFXi12>WyA$9#QQ)F+A4jeS`~kD- zyzfUjgy%7Zbi&iYu=^5qT-`UBxuNcC(&$XYhaIb-#EpVv=WjEjA-;oPA*;|odl@G& zc<1*h{5e2o4@G1NFkwRMmJ?$T@Px8N73R{qYxLW+a0hlA8>@&CE9^hI4EW_b4>e=L z2FycF(GSG|J#B{m2?gpsK`qwXMT~#M05dC6`!zW{gext44L7vuNW68of5M<&FfG># z#FPeR03xY)QHqI48=<5RBus+#mE7ngyf+8Z^>B`;^I4uu1bLmUcj3q~JoZeOSPP|n zK*Vo`Nyr1gCE>Fhs3qHiyiKGRG;=)t7sonJC*8IFe3v0ChQr9Ff%t~3+{HO&0fw|0ew64MJO^y;j4gNS*BvyGiTgWf`Ur}wtj z>g5eS;PDUe&0~PYGPqHL_9pxB86-tqGL&j`Am#JWMO03g5d$|ZDKy~Ok!biDV?4w#x_MJ zGNjg;7{6Y#jd76hMsn3F>4bjuX5d38&N0(fz134|2mw>%M7O>&lG$Dtj8N8MYA}g{7z_k9g za`+lfurxbOgW7c?U29mFiB#*hJ|VA&k}|hV-qT1Xqh<`0>X{u{2_l>)v`uNq#k~%C zu966ZqMZ;*IB=0UcnOD7F&v!zWM(z>A?4FBLOzOo1wthaYbg0@5$mLwsIG!->}H-H zEsNMd3KAB+HMz?0Y5+(xqpbDBCVN?{t3p+%mN<`=7~Q7Q!pk}hXLz+`t&H-~m_(Ik zcmGN<;*aX%VMyrnWyX#RVn&0o>5-LYj9Xv7SzfmGrQrzIdiR4)jl(hb)DkE2>W|6nG* z@s|32OyCjkPAVfm+e8=%Bhs6IG^X#f#GlZRAfG{ zkl%JJWb;yXiSz|`TWCcRr5JqX>RKBYZr7EW5?mF;H}=yCn+Fft72XlKn53at-4mmY zmskwH2!@!7Tcxw0o)9@tgfjN7Vewj7<5zqe@LM?t3BqhhoUcQe4o^WPucD=-@Ch{* zQc;ipSPAi_lVdZY(1cscCPq#msySFT&m}X-Ybywq2_`#Br6%ARw@q;;Dva3G3Zfil zF(FWf2G+8rwG&)JL!tMs?z;KUY!8)^aNsCn39H2uweuus z8WP8HuZQ8!7L~g7H+x=;JQKbbj==RA#9$at>xnK}02dS>G(Z0OfPL^NmWLn56Xava znPm)w!ZBPNLN;Bc+Le=bKmFf6KA4Olg$gTZIDt6|5FjeMVOfG647s><7?u<=!Cm4h z{!1HP#5D%1(`z@dQ~6Pqpc0tW3Il;VFt_!_y8FPj!JE2hlAv{Bmw_&vy$2s^2m1sv zhhgd&pU|3uAwpl&G5PR-austfK`Cz&J^egv$-P?GCo3#=1PD(*PoApFGh6sTF3t#6 z01HnGXR;%W3rOq1)yv;)AwxhkkSzEA`P+Rr*+hu^HHz34!ODD`AcIK5#o{7t+=~yB0*H-uv;_N()>&>4Bbs!8h9}e)g)Nbl>*eLhHF><@}$D zk6BI99B+|NU-vPHbw}`K$q@}&C*ahcPY!Y*AkL>f47zwv3}Lm@y*k*UW-oPBF1um6 zd(@nVUL^UoT@X&(kzaYA-U{L7JunswJItw#RkQ+;g|9)N5?%PICGw;nC3#4bPs4@$ zyYO`p-FQKWPzwJpn4h@ZtF;~!^u9c0)D}d3SsP7EIO{?O>*Yn%VbMS}iQamHdJeIFmX(kNU@~_vuZ^Q3ql7Tf*4Asi730Wq$-SE%>;e%YaNL(bxFXDvBtgh97EdB2 zr8!-E+y_c6Qb;q(Jyetwey-0@aiJ=&qIGv8TKZBBb3*fsuzf9D7Fj^zJP^Y3^3z13 z3W_)(ZS;h3B1}Mq>wS7OvpN+Dz!}lRllcRo5wg}($lG{VkHDsT9rIMb2n>IJjlo8p zf~3o=!+b*Dfv!$*c>eU0TriWsv|2OIG)wd!M4~;Q^6BKfoJhMsK0~Qm1E?Shr2RXq zB`5+;1Td5E-S6#bDV}0!L75>-PYGX%t%XZb$P-!X^e~9H3J|AZpzdAYkjW@eQcMjS z0}M@2(XXTRumn`-vjri}3$Y@zDSn>@3rpx%S??_ zZRib$^*W8d2bd1gL_%rZ6jFtvzbeqghS%V;cFa=P+jRmHo{(9Q2lK>r>;mbo393&9 z5tUZL5Zz=jr^Dns3!umMH5^MQGVz_Mlsr)&3d%z4Z=Y0cqp`YO7JjmkY#uFfd|jIJUK?2$o3mNBBzv%0$gNbw})t6 zqt#0cFUBr{cXY3DCgs#nhxf0Pcc7;UeNRItu7e0HN5GU3Y5kJNlhL35d`$rZ-C8F? z#J}d^9$+^saPQ^e8SC_rT-w=TAt&PlYeN|hblzTAD#h6WtkiW@Sj?vYj#Mv$Dbe5V z_%4c+w-QQwIlq2R@a0|;;&ni7jAcpbLRB9LnDW!iVNT$)H+i~LAWg2#-%IFoodkk1 zxx>3|f0UwpunM>gDYn!jU8KO|pBX`sPI)bdj{sh9%|nV%x)SnCQs9G|F6w)FQ*KIm z779w9N(9eRHy=z{7)8ahh342oeViPf(pLdX=X5vEx9aB*^JfOV0J4uv3kR@`#L1S$$(kKQoLj&+2o#};oRvTFA2ad> zh{$p%Ptn|%**pDkIf4c(20;FGEnt{Pq!~nu_8-I($?V|GggT;3{V`B~BrGBC5S82% zo0ayNh{O0_6o#Kjq)SRGm!}G%6@P{;(nS-4Puh$kYfASrC~W(qqAKpgSNtzqUJmGM~{4x z!(&L|U6sK8$YpDK1|#~}8&q9Bn(;L41r2&DEtYc2h>A@SW&|QIBf=T@=ieC%*M#>E zjN$l85Z*3;MxL>ol&d#~M{pRs3`7FQ;5mjohM^x;K&198NOd;VgFuY6XofB8crFmb z9Dr&7U@B+|DeJ{xIsD{N3Prhc|Am*7pt5YFo$>aeqEh(4Di_hW@u!i5UIpsVQHmfC z^8}hY3#9`Nf%^l6XL5{rXeM!;+e0mE;C_gq3`949CUC_Nwi}Xq15{-o@}gL?8#A0N zJn3^>M+y)vGKAJMgwJk_Mg}c@-6LL$Veo;HvH@6i7{2Q+3MoAiH7mk!EWKtFqY)ZD z62icn=4?a6jFF?61et8THN9rVJ;e~JfT;iM5cVPo{9|#7Fn9n6^m!sh2t{J3xzX2$ z6RAp&hQc=L$8JFC6%64__fo**|7pW+2c0zo%tq8tX~47%0NbA~o`-j&_n> zrLHR98AF))`xzb9oH3khPWBOEe21qi$eT^H$^W+WEUK6 zDi@8USVJ*ihtQTV;b@@#R?;3dqZo9^lETmx>;TLzR2CCT1fZFhP?THDuS7u7OA5q? zaBTD)MAKZpm!9!>P5OX`Y&P$&4vVzPkm1&}jV=08~5>4p?panr}X>m74q$+3wI}s&< znC?f(J$DH`{BvDGistK5meMg0K3oWEZP!;7Ilpveu7wiNb(pynh%M$Gtz?11;gX{Q z-g8{bF-&wZ+J!I}by0B1y&?mvOLwzIf=JVp=TF`27s+UXy1$? z;aUjBz!<`M*e(l9tOg9lB3O>ee?PV;>8;@)v;O+TjU#*T_hetV<8(u`Cj5BhS~Jzi zF~z9t?GU}^7TUT+3gx{mr-dD1P^6AA>fCN7IuMFIB}yuHON}E za+QbFINa3*-_&$>`}j}B>X8{>Lw^b~jXpXoG;$a)O`zw9>Kk~V5fZy(G%aX)tr$>C zM2}_$2?)VifY7D45p1wYU;UO!L5^*~1g#&N`^Qus6!)FE&mQ*|$LRiQI5pMZprU&c zA(i~Q`jqBv-z!HI!-=y9)VLwYbW2W2Z%t3)*B>(eV_9JT*$QbDD|HzYhYGrk5 zb$WXGpU(-H(*!}Qgi`>MP+MDTWo3mxAdpC;r>Ez{#6&_u!rI!Jpr@dxryvG{fgxad zd3l0JL1Zlwg+d_&5il4GfkX%*{|W0PBq0B-0STT69fZz=j-a3*G7qVPn$W@MzyuM1 z6%wdLA$5=lD};`f&OZSE^!(cefv{S$0#H^uYdQc7hV-lzLhq}6}Y zj3!ulqELc@|12N`VgD5Az;uu>q#(uI%QcBNU?PRX-ICzUR`b zFdO_-Jp4h>b|_1=zGO60{Kdi2V14O$E;1CKL9L-|vQXtcxA{;*`BbS+p<1@u=Zcw+ zM)l6iL!Uo>ud(WhW>9aeoUeDBsxTjJtXgdH+#JeQZ>nBy^S?M)9&V~x{eprJFlsc{ zuJ=Te^H_{D*KK}HU{%l2X!*1~oc7RVWu&EkcRWww9iwJz!~Rs6-bahk*3Un_*V+!} zXtp&TEjGXSu`=4$bh3&Gt@lkpbcJFQ85tRkwYR+3B8ui*i$$Y<{+O$GSsm+W`*pH* z*Yl1^yYtUW!tSZxSvt%uSWEzy>s&31d>A$L`H$7{)z@J+bO3+>Q;DGDz{C?JC={XC z-dZT^3DixW z>QV`LE(Bn!m3SofgRKO`2u`cFOdKsq5R%$j0H9MuhTsYrI&G&2T3GeqKYG%%5JG^u zVoOp>mC(h)=S6nm3+O~`XL|OR+oPzgYHgjYqVa%qhpTc@D2Wk(#FcEO+0BpaRAt4Y zUJp*hHhx4(_A_zC!%cB!l zudSvr`R<)D2K@0migbs=weIsn#e^?4P6B9`2d@#IQR)nna~VOqv&}yyql5G zMRxpn=S&`e=3R_Q{W`oDN8<2ZPAF2liA(@_?WIGE@)Om7@^D_!&9dU>BszMHM&i^`WuK~q>rP}a-io87#({I`2WAKY*E%R*nja)Onu zd2iGb@LbG9N$2QnrR-M!{{B%r`Nk}>l>g6ZFSW;?-HvzIXe{Ti$A3Nwg-xJr8d<~I zwn(pdttJ-(mxH$ll`q@Ox|lrfZ}zB}?w=FeS#@8Wex>aq`}|zG>6pyqb;q3P8|{X_ z?@d<~`l&yh7oVVTH4wYdfpk1OgtJF9EDLJKj*pKCiR@mBhO>#%VU7f6BnR$~v60v_ zL@0R$<`wuH4BXv^!jH)(eEYR~gv|=VJ(LHnE9#=YGp>D04n@8b7ynEhR4d3VGJty& zAy3IT8uh0q_uF*?HGJ$e+KAAcNMNdy{$N5$u`&<#5!x%@UK>OGu)sRWD1kl4^Ud;w zWhfZ-HA_O}4aX7L#7o#&2p|1HUG)zX`!3$l8#y}*o6h(-=VuZZyVB@%|jY@fz zq1LQ&OKFe9uj1Y33kw-`xrT7|6W?1c7RZ}jr^=QHBn;3M@q|AgP^d@}rt)WE<$2X_ z@oDd^yeka;wM@=Bdh&ye$PU)477e3tlplI>3#l_GseN!5I9ItT%F3y%qdOHCd^yZJ zsytxA@0oQV$;P5k7_!4&k=R?wCdhQDVt4oLeM}cGYgodKx&w!^ZFVc-15r`r1k&&z}?JSH<<%mW%D8ei4PNQ7SnmvRN zs_zcz%M~S6o6_TND8U;oQTT;D*_k)xPaeB1A^ja8*Zt`Qg)}$#;VoQ=aZHcQ#OYya ztFG1gRN}A7QbT3hN?Z+r3~&mrT#JKF_(pOGj`TKz2Y#pLtw_XYky7T(14Mz0iVsW| zp~o;aW^{B~ai&-Kq9Ep1tJku%y)%_WPk z_G74UjK??OqpdC2ojSDPhJ{$&sV047G&r=PCMbMGOkSs#Vpm{?ZI~8qP$JXgiZ{BT zc{eXo@4o%+xs#Dh%aCqEp=O0sU71N=^Z4h6VrTbPQF7e}h99G_Jlr7aRnH%bRgy+k zPDU*1H114(T5;Cq_ zOeJ39F~y^YOY<_bMDa%;--zLm!81gb+i>vH@2h+Ak5XU#tkJdHPw%w(m6jYMWTnb& zi}mhNSJY^AX$(f_iB*%eE^?rhQP|fnNCbN#yv=>SpkqAaNe1 z7B^`8i+fY7Qr5_1lKk+Yc50_Q)=b(Ki8ensF()((^^joMkANfAGK;giP zKtVfK7sSEUJef*MTVs#BbMFj&e@iYV|C>{nq!ZZZkSn;#A4r@_s24w*M%~6Wzjex{ z*7*B-!@p_-3Kj80-_@>R;gLvu=9&<1*VkTyzOC$irX?S}*|!0Ym(Zm{G-oXS*%6PQ z0MqL@C;pZ){7C%h6UnDD5UJTbuVqWi4^yvn$-DaA#JK5Ft)CU9cLzq}t+P#IKdS?? ze^6TKRAGBA=VoT>(K*VEeIL7OG&p%)t3&8b^F_P#^|M5?J#wwc zRXGy7Pk!Y4)nD3&Prw(WrEM3ltgn%@o~OO9(oKjX7>@fkJZC?eed-FAK2MPeY@1%W zI-tL|ygCd_xI6IwfcHVh$hGwMX3h85nn&mI>E>J4HjSSOMgDGOT7J-3P4W5OXs??a zFExe>_X=+`JSD|hw=I>KuWnLQX*4WuFw9p(^%F@@4Uw2d3-;J@`OB^-yiPXI!%GWNoV9)m5B=dAy7fLZ zUsQnt_e~D=v+TO3t_oq|4yGd57Qa96Q(zqb?!tz|LZ5M2zWC~DbRFW)_A#PxMZ&jfj8or9^=gF7 zzFV-5(+hPVOAT42RvL|r5l)L?h|qg6pga-zlI!Yqi&*6RK;#&^{vsS5 z>U9>~6Ee-D-C%hNe$zLR0!|p?N z_y_cS`to%WWZ&h+H_q62R&mnk80$7idSJi zxWvzSB{jp999(&omKm7?rZqcw z+qp>m4E5pfY z0Z;i33W~iFgm0zd9u#<#rAj#Gb5&4rFBAe1wABxb##zBnPIFa!3Y*>+09in$zd>3H z1M@-dzlyC|9m~-mnp1tMx2Fr`VL&Xj~bdKbO&ocyhJQb%yi)S}W_U`dY zy;|vp$w72Rr8nN7Cpv{cdrH`bN^AE^-?Y-f6U4$Y1RmCcsq#wV3QKX;i>(&Q-8f66 z`h4Q?%ebw?-#haOAVHC>aM?z9s#rx$B0zyCE3L?&!GQbI%K}&`YVpg61V4tFeDwYV zqMEQ}C@fDrtLV6;?G*ml9l%A6tTe=@sj7evwN{SY^6&t1;|DD7Y(Z1BG&33S@6lBw zw*Y|-|MCLMfjo%Us`7(Sb>!3P9elcR;g3rurECd&i%Gl#_%xR$HMQ#iQ62|rLQQB> zjm!ji!iVSYEgZyCTPIhGJ)Gz82!cOcTfkiNmb8wHhYp$vl0kCe20Gt~*g$FX{@wT0 zMXc8`Nz%bk92B)2l2&zf4QXI*kH=Mu&w?wj0RbJNhDV+JU9zj|EB*1M2Vk2X^ zc*=DDw8_tu^`Z+goDWQP)z_gL!}1$lc<7(Lq@O_3(|R_)5ex3lP$P2iLLWDHHNOeL$2N7o`8Pv2leo9d)s=uJy}PvP{(v8 z-RwuUxnb&swvMLBjsd#1>VTIUbfsHAT6E|<_cA**>N^?FI|4~NPbKNj3EGY%X|4jl zkejxDcj=tH?Yx&1xXEO^{78LgimCR(bnsxd)G&luY~(uhaL;D^Q;4h}m`M;!JJK|9 z2K1e^q{RlGbtb@%y&E}}>bNQgN`*lBwE&Y2mN=>}rG2P!zwJ5km-@Ni?GzA2LpMn&v zuy%vSuPgh+kx)o!f4tYQZ{qOj5>@9ph#nZZ$(s0O2G%}o`hFTas`hmU_gSk6<+lp*@9`vYXN%H*9XB<*JfY? z4CM1j1#@f*E5lSc2qc#P!Hu0#2_CadfatG{yWmgBS3PC&gsPg)+>Ag4Cu(IFCI@M! zJdlvC zcyT0 z!&A}KT~*~GaS6#W8W;d^s+vU}uaXw@!F1PcSH3F%5G^-qK$DuhgF?q*)zCkY@IEd1 zmC?5K`|V6LH0W-VJgHBPc(ZOEopQyuv^T2f+lqQdkNk6Jq-7Q< z&ig`%*A%Mv!{Vk?$1;km+O^`SqAfIO=A+KibdHTA-oK`SB|yYRckep()9<(K?&sM7 zNZ#01p5(#vrw80+2mZMG$sgWU-mhg&0$lF<8T@-8{9EH=h^FJi+))ry$JWCfY78Sv zF6!-|@~*S}uGQ2*>KUkx|3~KW?zhg3(dy%LnWG$YFcXm1vhl;A?uhags;u)Mi9KCG z;rLJttKaR%A@Rw6^)dFzcTK^C9{9mGmlJ#RiTqBSDo6Z1|Dhk`^nD`a&QkF7$l??+ zevBI1XU#ngzQdBLjf*^{CbNv85ZHzL9sGHHCRcctC8lBY;k`#BCb_UrBUJiLP1(ul;n7nfL z@Q5Ul@bVyk5l`X!cRAQ{BMpQV`sRi!7@}i!%~y9F_4j5f?2-sj1tuR z2857n$Pg?dM#V@NraOcHgzF=Y*uX?l($F?s3$8zjV~{2@1CU+HN$i?Ais@wQq2UbR z_AnZ~9gPf8x0T*>z1=Z@k^UY^tG}mHpcKofl%c<`TY{t(cf_n?^eYUiEc!AGei&Ap zcf7`;oBffD!#$d#l$lxx1_-7zvQ^G(dYj31S7sckxq9Du+z}H>oS#^AhvR*Mt|jf- z^v5#DUg71*gNIW1Ec>&JFC50QrQh5W0+)N^l=S!9o`Q%9quDC+FA)r;Ja4fh+*Y3q z&+@s)`EGtY`uL%yKPE8zLW~Z6)iV0Oue-;~|KbQ@(keG=FcBGnz~>OgvTi9Hrm%!| z4sOBP?)o{G@utqbk0dqMkC(>e6BNnndf)#c7gVDBXu2m!K0`qI2$#4bFABGg<>1Lj zs&7vlS;+i_20kxz*KqyX`n|7EBtxMq%bY8MtCUS&5H&@i~G}HwBR?z{8y#71ko(zt5LQC;X-=c9)+lT$*clORg^G@y%O%t967JU!?T$ z!;vS{!AIC!gv;MF)y~?J*`y!x)oEve!||r&lo@K3v^*3j+L)Y;E}t@(hbN2DCy4)4 zQqOG=m@y$)@c9mw?ogcu!q|PM<%55!Kid(+9e)ZmIA3ZozFC-LepoJzFmbIJon2u3 z$VD)Z??IWwNxibv{tGY0DO+Z-wdGtcY4 zT`lBMTv2g7AvvD4j%bS2(L~*_HZA4xYjK&!rQ0@f1g~#Dvq(}u{z`dhKROcB1qqDn!ZHe~J>-|Of>Tg^AtHC!1 zN%j3EKZ4s+4Vq&$L&idPCXW%Pb2@K+T@iuj( zclM(;o?rEIoXoP+s+b#>w87)xph1ukd0-@W7~<`S^ z5)`hO#wez>B7Ow?<%zm#H*8+k#0$DxeMfVIP?qcmNCHz8v|^*5eYuO}e{=aeZ&~VE z>;eW-!TqBSKpgnND_@`CDCR3uz{QS5Jvm!`Fnk~QCBAaj8#2>_@J>KMuHCe(2Y#6C zB|Q^i+ZmTr#+4`3D|@WpG9ic+#2i)RpGxC59zn6Se#Julq%M{yXyXU7=4-AF#5p!t zu(>NX=4(AMhnMLbZFcX$bsjUu>WQiTJN(IzK2~%jqEEukGv-ARn8Qg{5W1yi(*1r} z)IFw=V3l2NyY0k{?7e*^J^tbV9nq5kf6~BN+#g)6>@tUrfj$X%tTZaz7L(Cu^XkUWd~dVYu4u6hpl23UmK)r(Ax$nHl|ECcm1 z^;$tf&n?zAhkX|I^NyT$-%-^9{*B5x7p{aN8N`YFdQ>g2BT7%nfCtcAEO zR-b&3mG()GjmS~W@N?@-snK-W;||@S0JYJ-Aj(GyBF-jXUqG4JeipUWY3jvK<(Kz6 z$@mt$muGM``~vL<-4%gct*}gKrg#P@(hPsv7_CCT__E1 zbvis7v$le`-fl%_rKgrjzU?Eifw!5=HePYYb*!a^OjHidrt;WCvN)vRKl5r#uFuvi z^77tRvD)x$D4MaUB7-g-YUF{&!`*#~CCv{EzqfwxbNBn)W`1xl6p_&3K&obCdTvn+ zl_)E7*OS*tf$P_tc&)Ppmk)GAI3~h0kIUOXTHF^nYm*OvNQX^VShuXecUYVrke6lz zDO6n~GIajSkzo&dy)elP^5otG>p%HLyPFy;UQ0;XAS@0*f@z20u>nxHPGm2awEzZg z#*Fi2uK%tx>C_tmgR;at>${WkfL#S{#`hYTKNQo6jcT`3+fI|f8vx<({@GL_LPM|} zKB>lJ+51GL4O>!uc%M0iB2h^nl5Pdz$iSopspos##G;bcrJmnMwn)Gb_37h>c_KCG zV~q3Xxu8w^hUI4yZ{t2TpPD%^ofwO;r*-4d3fd`BvrW9s+1J4?=Yc)T81T~~feN02 zSi+_!tGhs?Txw3*c*iGbb3yr+O;gE@=4Nr_4eua+FO+nnagL9o z-eyj0YBiaOtmuSsY{__6G@H)zvEWGMVd+E)69<@2ldYj3swjB^M$eOk-QS~Fa-lB1 zoiB1o?4e9vf~}j=XK^nxIu&Ye9x30m?6RywXc1tX%F|Ax6bwE+7ntH-kWQ!~wa>uJ z1rQ4QefqF`_*^+~VW!isv1$3pyhVf*iro_}b7a&x829ia-xlLqR#?gt`S>sflE0=w9`(5_9 zkeX1nvMl)UWSO5%;_=_mFQ;_Kk@vE{6);c@H zLlh>1EfQ4`Lf-yR`tV`3eH-$NR|ol44dE7s%15s00)x%QmTxNEl2JpUFGt?hMeoBy z71YH9mH+fkjv0NNvRh~W`YIOXXP(`ORV?~yo^5(?`{2<(weW|S!EkqMI%o9?L@ z?m?O{$Xxa)Xh=%3Df-g&DiP8vDE6vQ$RmAvqg;B`r07(VdsXxmfj`CaJ&NyJ6~#bO zLuJ5W2H~$BMa`vNg~Q&X--Tl1)td#Y+G~6e=aV0*t1-f5=DG(5t%GYqafd~y{ zUI1-V1ftE88rG8w8u==+q#RRQ6E_W80}q&*X5(Q{|Ll^_asBMTWlSpXJ=3tH#zKBj+?BQ2BUO93?Rf;0|_k|#S04(f3SQ<8z8Z$r+0L=cV zVFC#z4c6KXwS8EdVv*towX!iJme1}G9h)Bu3ptOoIs zi4<(BIvo097gM7snNP@1yVM*{K2UEL*Q-zP*-o7%VR#@}BcgJ+O``@qrG}Xv*@KPL zvue~sC2$W_`gn!nNJVKqK?8SLBQtiRFDlh(9f3f_hLNR_g{AU5LUkR*$Gv}K3fV?8 ztVfd50OmXph5zuZqSlrMh&>O4jS%xK)Lcv+)9%uYhczwJYvPLxubK(^mZPx5K{Fa- zXY|@Mo?xQp5yN+5`*zxa3C@fDjCu02maGb&uMC2*-+;sd( zWWxHDc3ktAGvR2%|`rv0~9=NvkL1=snxq#m_54554q#Zv##E<+a6 zS2z9dHkSc!85h?IMXobISp4)n2uuwJ&5wKnGd$ft9O)dZ?QYeeDo$TwtPFK*e7HDkAcVLUC%fL3A_$IAeY`ozvpm9^ ztwrA*;md;`I_5d%|74BG5#pvt95 zlDns0p!(Gm`Vhpl{E>h_Hj3STT3bnr>u5sk_mtY_Y3OJ?`HVi9`ZpYLv=G*eQS1nX zQK(FKy{@Q1cI&i;xxupcB#sWmn9^`oBUC(ApIiD7xZ(hTBghVK0Y7w)WevEkq} zx{<{|)nL~CZrCAw>iPDkwU`i*vRUs~4I0d>K#zetJEcdsw&$pDKmD^7Li`s>sBm%R zw~o3#cUbklM{IRA&+zf7^pD^M;omih$R4E`Hq+xv^?i>BGV-2&#%TaHwHJOf%9dWI zulAEXj)*cu30FeW2uU^o^#ljR&IM}D)0!Lm#LPvpPl>{3=z5IKt;Ykr^XS0F7D980 zKMlyeP|uW%KVYGR-R6V%Oj0yWqagZi>D$%ynxT*osbrCzhADmsfr+uVSsNQLe1BuWX2} ztVmDqpt_?f%J9U|GYw{+%omc)7Y~9>C;L{$wwHc{n>HO;oTLnwn19OnnIn8&APino z7hV-eLi`l9JZM-B=`)8yP@A7ufA_8anX%l8W#g(WZ#?B-Y@Qm7SxKp~*vDEu!LmFW zT}l;QD=M})4pwVnSZ!sPwx!MOV5bu{p(ie3{$-vwSGUmRGrP3BO8#V>Vr+HGe56k) zy0i?SMrhZ&867g1?-QA0&pyMcwx&(hKv+GbW3`<1wWR;H2%}6hoIBQr5_-qaBw-%nY#(ljuL1~WdK1eYEu+VMH zXl_(6XI)XQ6UCW7KR0^qwGjfFKdIP|~-yr8mivV%+w-*(62V+*hp1J8TNGR!-&TLUMJKcCMdk2eD?}u?*0$01VG;vL#C=|B{&QWK)n8TS zWcP+uRSquvcCKSPYs)(g$=0)M(GQ7Dh50wJUmFjJ+FGtyFy8N!DWVaKb<8Wa4BpFC z8msZuY)|ve_2O0&q?d|J?EkRuE&E2IE%rmMmP2JSsV2}{F&1i#dtTTMLn(Wf_e)1d z`?FAVKf6#|1Pze`2fFY1oOwxtVU{e7nXHUcPPT(()lPbx6Suol`p#;`6kzoES)kkQ zhax9}a^u>79b~Kn8rSaWkn`5Eb6&y^@HJjb|4wy@%ZKXKw#FYHEY>q#0JQKQ-TcqD zq(G&y&k6eVA;AYSjFc}$mp=AaR>`bX-~UKq#OI;f8(DD~zr%K&82d5axLWU!0rj`& z5qmb`rb(?bPHE>lki!{Nt~uCg?ntzkw|2O^<1%`6w6gPKZFYHr!+n_FVyZeFZg@1q z|DzPTK~2t*kEY?@A+)sDh&KZwe_&rvLJuj=9v61L2!_$Fj&{XV+4RQ62 zyX$Y6nTppocMkg({XdTHfBdC71^@B{pLnKLOAzWzV<~%;O`}OY*Qs85&9;K)OFThc z9?2!HiSK>@k50~JJz+Sfq}1+zsg8du9mhXCp-{f}{t$G+=Wx#P@|^Qa%<;g+geR`R z0GKA%3n=&c*zd{m_mmmuTyXcSmH2{`+8f4so}qBW_WUBk$89fFAE-Si81s%~U0C3(5R6Dh4s!ambzT>>nF-^qt#(_R&8+|JHc8!T3Vt z*Tv+{p$xU}2*=MNIyA^{&NFA-;IFpB)VZ zTp60Z-mCox6#Mn~r8dErORv>q*OxEdv>z+nJ)h2%Sh4SO<9h+MBaZ`0kROu`E6R{nJNcZun*m$dlSJp4$9G_7BDrJ8K z6Ma?ghA4Jeb*O&Ma9&_%bHHKv(ro-9qv>{&vH5RDISBVhw&hRr+3g=n&uhQx(W3O{ z_-|EXuP*F&N^*BAD2)Ph{3@=VR|X4hcHXu(*;EFcb^Z#R4Tv828IWqWS^H%@C)ZJU z`&of9o$+(}9pDTk`N$xlC*xN}F4x?}U{lVvNx{tS5qJ?6L`$UO)ue@@)_$D}4H?d^4^?{`=kTY`IWugo*y{c#(1nnP{s%mu{X)Hh0y($Y`t*8)!BI zkf4!To3BZH1ms9`0~XaMrH^-4d`r#VyVbtxzmAu~J?A(2hG%%!Fam$^`IpG#)o>`J zgx#eQs`{ennB-scw%GI!q%yoX_O}UHpD0l7Nmi|AH_Uokbt^JtcrY`gX|G*OWKiK& z_B319o=@M!u$!kNgx&4WwPTyx;+31$vzm)N-_`RJ#%JQ^hrD$z-|qpH-BX+o&q`uy zrIgN71q7&1Eb@}Dmv^T~Tv|(JXF5H8M8vkaxdQjQw67WxA6a?)F2<&R$wm5%DU38} z%h1=!z>y(>My8bBht`D4I*cg9(TGB={iTg5Y3$oXg$GX}j04_h52O*w$M~~`{mM^W zeO-0*Brm=Ot9e0JuUxSA7vxL^59{##>b+~sh_XmNW-%MevV z65$d55?i{#NRCV>8q<^J6<4z9CnfxfGw0PxdR`7vBAqRGFT9+#3n^`!*5$)EN}a5vP!k+wwB>lVWqBn4#3rl4c~#>Y>pN#<9k*j%r7T~X zW!}ewXx)_LW2Kc8j7>CGNf(*qVOn|TKI(9IK4XsC9EPSj<36LWYsDZXYK<(26=g}#XEV6zEx?qvEH|{^(C%h}#c|Y|&ajvZ4l06Wf9lAFBn_+U9FKa(*s&6kt9-Xva{N^tG zbCqF;ji10AgiT0-+YAf8POmYL44AoPDXY8UI|>f5$@2@aZ&uQD3ypxJ4IVei{_r~W z`8&mkjkESIGFgMS&Sn9O2%NSHspgx)}PSL;ON>i4r%PUa=DxM}4!zd(-#j zz#!VWXo?yLy$0ZWK!hP%B(arF1cDg4&XzR)PAPK}+3-g57K!;-vE` z{;?1JNQ^LeKBsEW$5gPjCNPlmxzPvq-tXrRx5SK-+FvCpK@M&?kr3_)G+9F)ws|CW zoa!iE?Kdn3n^J$fH83qMGw9D@fv7;lXyC@whg;}|k^=WPf#?RXJb+SQ9)iOFG&W)6 zuF9tVc&s-?!VNvKifx6SbLx9E%pZUNYf$zjtzukE2(cM}BE|TWHc4sn-x=sl1+M6` z|MuZF9G%mnw002M0T)Ea0LWuGVNq5XI4-BsOn9MOhsN47{wS(8;q2xT%&d<7>SaVAO z2{ex5`bR5q5PoFqm{>6YeT+ntHv<417X+cY<9(7JpgDTp*wlH)=Sc%qTOxbrnqOQ3 zAw!|DV=%dZco$w4Dr7n&uXVPA-_PT(#Sp<%zqD?@VP(5l&B;pU4`e9i-CAoZ)2`u{)jVs^1!( zUNhz>STMq1W{vQLe^u*@W4HpZ&8kIn569SIlpcKpD89Lm|B2uu1K!Q;(dPa&o3nQ> zDmU?8H`I&W*Exz2ZZW^b{wgW+DNQibDy_C@Vd2zEV;fyx~JHqdb2V6NW(x-TLN2+f|js5DgKhy6@T%>>U9lLmcM(D_M z(lQ?5_bnHv!%mJTV=!Dsq-gp3<`b9n$z;a!Le}6tMazZ$)Z>QOhgJJBFKDNQ?;FbP zc@LhBw@jDI2vt}HZy3}+9<5FleQO)*LOj(vYti|$`i`m6MOxmfld{Ysm@n_p{^26{ zPt^%zM{?9Ev*>$gj&N;x)tdEJ0nk@NG#0ECO%#Rz?=*H{eXBb5wY0+7iNoOcYof#L zFkqruK9r@~kqfKD;zFE26W_1z*kN?QRvduGk3fY#Y+omSBi>8n9zu{72)Q5m=l@6x zos-N}$*W&qmgzj}G*N4`6UY`y#48&G$JX zk=Q{KAq^W+-RY1xnmz7cEmP*zj`>2QB@6hI)z|2ae~G5=!@6ek-tC$MOuzcIPr3EyX;%!yftiJzyojUO5;^Yr?(VII_ z_bm{=tIZE#qD*0r&e%5HY5|b(qm|IPeJ@iDhMQ8dZhKHQ3e%QCZ@%BPaQ+ zAaRI`v(@9fIjD&e);%fq-I!WDq1B2n;>QgIfh*=Z5kWj_L8yZ6&9ge$hH1{LZPu;9 zZl4eYXkGQ?5e8V@NC8;wNa82?7wG`jz}LTbYt(l+q*UvhUitU|)=wR+)XZkcZq5GG zV(=sLD5}>F=aD28v{YA5VYdU+R8g;S2i!af8HoFm_VV2?u~GE-U)ikxq%f2B$3g4> zicid}vpINnz+$lxzQr1>f*=Hei#P~lUs#X7X6EF_!-~!i^~_^-$Uc!mkuF)WR&VU| zA#rO_(EfZ5CuS^no5bs{dboI8EUIr#zv`{A2wWAAMsKJlSU(7u1vw}~Dghob)}wU` zDEAzja5x|KeWB=zwL4tZtrwf&zCa+N;FNSth{g7>76}z+ee9QmXM_~#|1J`s%kHq* z>bMynWXn%Gfc7txu|NoAgbBqJTCf*-)nZsm3gyUF9^YD`ItpR4`EO2DIc^KYUT@0I z7b5PTh;uU|lQuWXkaCP{DoNRRt|<9VY6U-5QSVKeg-z)VmN!sVsRA}}vJLFpx#!t( z%iBd-$6L5u$#Z1@URaS%YBsJNQj+SsYK5JeOp#PSTS6I|hFFpA7+ZDZ=JQ}ZaeI4O zJUc(nVryPB5n-`W-15H@CxX3LU9DJgwqFcCKM7zJ<7P*rmy#*xQ217GlY48KZabOkEj}9?PKO%?1;1k&iU_NWWmnGet?*J<(%azUvX|bDy`($7He7EH_IAQcMUuGq z$nsmvwstD_xE9!iJGo*q;$ocHW3kDbr7(C&Q0%PD(ASP`YK~znCFx+Nc<0gt6UUbY z`@!eWze(&Qy*4r(&ByYKOQy1YXXy0c=-msmA&bbJRH`TWuSe9Pb|tLl3xwc4--$-=l}2yov?HNUSi_ z1s+FeL_Ks>+M;9~66A5V9pp3O~rWXPj4L99Lu! zf2{RBj4*Uw4@a`am9}&9bYPctY`7R=RbtLH*9L|!w@8L%INxKkb_fIpv*$lGx(wNaWsN4bX zwPr4d?NfW>tAPN#a5@ zC?~)-?tvfn$EsAmT9e9_g9C5>y?HW5tmLB7)JpxI6Q()5vJOS&sozJ$zOD`t&R$l1 z#&;HSO1DY2j1b-luXbyzu6iq9J>mX5acl)Y=z-URDvgq|9UC^yPh8*RKb9M6uO?N` zrt#AfxxzG2q%p-h?!5EMC8{RwTD1h!0RJs3$z`I3n*YSoLRFl@2^wQ733!x0$>9*x}UU-P`a~K2M0G;N?HZ z`0Al))7xJvy+5bs9A)sS!;~rk^4z*_N+>HY9=fJFx}F)zIllKJ z*!Qnl{>rdZE8FM(@d&^cG{icCKQBJ#j{lIPcu*k3(zJv>m)axtiB(pZP5Bd>wr~%& zLDyqppaEp+FGn?ScHCJ+EzIX(!iIBk4EL%=gS`+n!u8_w;9hR1Ba&s@yElrLuxM>RhH1s+tI7G%*sQndE zZ@NtKI%)v1^T=~)e#q90Un6YhQ>*o>|+`N34m z=%RcfV)pf?wz8Yfb5Zl}qI9GJ!{Cb9Xk(@Nb<5JK*4xUKfJ0n&5gYZNrUHITMxTf9 zeN*K%Efzn2z#QhL8e6)EY3_1YziwRE5W{1tKnsVaG4pjj`AEaHD<4 z<3#7V`4{+q9@2oeUmMDtyhQxGed6N6pGjK?iH zkl|a@S?&HK*LT<9H942qK@&7z%kzHanGCRwR{bxhJJ!>Yzbc3y_|@odv#gHZ5hVDYNS@NGjCbFuJq=4A_spP z_Q(6l2X@E)C_ft@S|XCJ#VgZexJb+5<)CbezXh;B*8Gy9n?Jj>{KuG&-iKu@sU73< zo2XC4Sm4_?ZC82k+@otWhLdz=xo<-rwidqIPGQ=wslX3w#oLCr5Z^pj!Bws3Xr`N$N-?q< z5*mm}maK=dsXs+0P}1|b{)N`xYIgD8{v^w-@4)_FYyxqMn_qpX`I0fw6xv1#^+6gfLEkeUH7ZA#nxoR;X796*1t*Qnr%7aU493*5dV^V70FwUVN_KJ7H_zFu}6JY%0H= z*Ob9p<4Ejl{Y!>75h|kc@%Oq1+i`sF{##V&$NQeT&L7X1c5*F{h3`stWzK69v3N1q zp6w@JmhcSzj_rYgFZZV}D5lf`4V>A2HGNSv zVnkLVm{C@8p*W-*`ppT}3U9GA74tAQ-M~9)A&2SaL|f%}Cb;4)|K++XKDQOtiO9)5U8MLLksU~wP;Irc=yPLPYJo}a+IgOl5P=4P?DV64F-Sd`| z(=dy)8$v+A62u^xE^I_D7Q^efX65yKoOQK&Yw?kX(^Tox@g?Sx)cma*H+%rk4Ei>X+7>6uwm zFKN-4IK$YP@0MsHL!)trnX*~4L`}o_omTqU`RDnuh9(obWNz~=b$x!%;sUZ~?-o6} zh`vubrw`9Ay>MIhD|GL3`@Z~gov3y$CQj-5O5jsBv6bMPqwlM|JAGvqL3mG|na9rE zJzEc_ai1$f3D7pLMb$`)7ltv68EwW=M$EB9Js_5N_D-lfZS(z8En|~-9Kd+%gC_e8 z%X@?B`JK$K;RHnzb%*o2xoBb&M-I^m>fORbtp)Ye_!8s&()_r`k|kb#CI=tu#%P5q zJQ_`Y)N~OCa#y=unH<(nYW-&Y>6Wq_w|LxEm?OE}dUm{clJWCN`pFkO zf%bKbHsjK1AI)28uQ*B%v-81c9KU`HJQz27Vac=#zZjJxxtkmly*Im@dYUUh#ty(8 zmw$e@jyJ!WcdA*wTJ#z>|F!(;Lw4y8T@s7y$+!F~*PDsjE6>;7daT^A2<@5Q?w8lB z-2Qm=b?xS;Meyzt_-rwxktls}V8@K#>cXP7( z_b&*J1Q92oute5Cq-jVj{sc6U&l-doE{CU;5JK6oh9#6HN93Lm%5b@cBM0v`#DW5n zf9L+L0Wh^Es!sqA2mnC;UcldbKn)*XL03smUt9Mv!pIO|Xz%^P$-^D-kY7m98iCNY z_j`;G5*84a5Rec-AfEbKyE^&2LP#SXiSi=!+&nyd9G%>s|63Qt|GNk%0JzxLIM`UY zI5;?Xc)0k46hwps1cWqXpY#2n>N@VdLQ9;S>B5_zVNUAP58ugEj^>4u&B7Cw5+`1Q+>nd#-`?$ z*6yC(zW%QRgG1k@re|iq&&@BaZ~P06cXs#o56;dnE`MJAy1u#n4=)e^0sT+>zw#pe z#|sRFLZCSR;ROP}{Eq-B6pL91n@sL0j;vZ?)&Tuc%3(y( z!G?sOEl!aweTXt=DVA6EQoyq)-+>^}_2DBMAL7)>EoQg2rR<89T^bu~ua!=z8DI5L z+ou_~w=Yw7{FcteUdi;-9^xPcaVSaQNlQM!Z~W@gKzH}h+$x3dOq*&X!*O1Q%p<=u zr6r1f#8)AXp1JbU{!!EDH0h_leo4i431KaWkbTQWn1Ct)uKtu`APLIY4c`@0@>+eF zGnRlk3A#9WTbd;%o`yJLZRv+ntt_D+R2yBS)Ik5KU#`H&;N}jTQ2dz0mq&xJ0TE+U zBL4{WCUR5e^Jk9&V|5p)&7%=El9V4% zexnzrXWG|lm2p(vlx_kY-TUVOD{eZg%eze9+GL^EW0piNUdwpPeDJVVjV&pwi^OHr zAWpUao{CJsZcNRxbw(XwxZUDBnrZAE`f8}Pm8bt;uZMeR9%@_dR2)CsKE4(oWodGn zoS}a>Dw8yXj?+HQI2x6Eugd?WfKY|24acf3*~ zM@HW-i|q>RRqb`03oH>he!GLbnQyf_mcJ`a#HFY-ntGPLnXoy*gaKH(Z@UGP&Jd>s8%*?MEDqtly4&8Ccc}&XO%1)r~j;C3nTn>Q(wy*d1Q9 z7uv@U5B6hg3V;9o!sxs2;4_6!Z7mMX83(gQJb$rHK&l2n;8$XC8iYREg1bb*l+nhYF5N7Ka5U|F|qyto@ zcD@eDr*Q7z6Rs68iLK0!?;<@`LZpdg_WG^{M+mqv^fxw!gp05GH-N#fd6eKB)vG+^ z;y*;weII&78r^y=7l#4h5`p)KshdTX_ST^FEO)5$;pteFSonsytS&lDy5V5gssEX* z;4S6AAD4aR;7#0QHd^0I#2Q^@;{}OqUpT95)NMxk)2nP(@u9EOzm-%N-;g}%ur&=? zJrxjOx+QpRu-@4r>K>5zn~Y!=Cuf%e!p4c#WH+-P>o0@89S4m&uck;hmUxxjag} z5^$ko>7Qtzfe?~rzNj&yPmo}hBDAR|srwV`w0rE8W&0U$RNo*nF&%dK(lkujS8E?( z8YI6*lOBl$hz~!SpeH2eCNFnpvdft`pmtc;{xy!5eWf;!!`sqBj~={aOwohdG>QBL z2+a<}t}cp?bIG*W7M?dRP?QM6H=TWtmEoK~If9mvKDRfA{Y>d|cvGZDL1&AwN)y@2 za1R^b1sR^iT-%H9I1Jp&s}Vm(Wfu0|G!YQ7Pk+T~sIO-gu3QVlrxhCWmjAQ2-0%GT zZ9CHj9SPZ@YT-d6?7&m9(j)36>y4{lvi~QVM0*U+Ux0UsUJw}LlX~V++{5;GTCk5X zm*`KW?EEJuP?A9DY3N2#I1^~w(M-;b;!p1 zGnR9bd~zGuQswOR;}oG~3EQWeM1xxw(jFtwDJY^x&L2F8tR9gY3qY%2Q^%#3B&pIcJQ)3!01iH>G5M9L9ci-tGo@qr zE=HBt`Q#H-|Az3JchlcP1xzjl@LO6YY~ zqSq;Tb)(_JA^XVrBJ0@%6ReZ?hXv(mJ1{_x3lluTaK)}Cm42`*bjK!LT z8x$pmj}RguoPY$|Z(^5>=oJ<7-a3Z;rkJ?wugk7mZ{8y*2JpW!Jdnnv^tRJ~+ERG) z%;WTV=`R)N-J2c?WqLf_n|wS12_zj=Se;9Uv!*~Uty%w_)-)TY9=b{a-W^+6M59?4uE z{fbG)F+ut55GtPn?KL?}pWum~CFxB8NgHOxkvB*V!4*eLH?f!A{fV(KWNT|;kFO4# z9ci^$d?$RxeRTr;cJr-qHc?@dUGaJo4rgVq4@FH+y16lCQxtGbHuCQEJ+rNb3k_>| zdzWs1WwVW0L)*ga3w~i|jlO&S3sV)$vGUESG+N!h*`~lKRd^}<3GWvk(q&b)v)Z_a zsvn(BP3G$&A#GTuE)Nh4r9jj2a$?pSBH+c3A6m9rDt6ZAy+=8jaU&?aZDhsCsxLbDjLl4Op-+?y>o&s6iKi**x6BvoFj~f31f4r-| zp1$m3_uhAiT{c-GlSL^1(0>ov>u|n3U@+BcjL@Thh$l4z$EwvK4v4Fonypa?aAznC zm$TDPC?0n8qT3{@$3p!DjAT4Zee43itvWrmTsGCZ(1;+K(_ef$CN2T}37jgc`S?A1 zx~%$Ox|$>U$qtR7U|lr{u7N@8W-8~G^(?)%7R`^2@>65C5d#C!N^y2QJfFzZuEb=_ zdx*w}LA(#UM9*f+y`GDe2J`1sG3HFQG(K5R;?3n{)Moa4oLgQ~?K?_$|A4`HtanM( z%j>!Dljqqxk_*Dv1a+7(@qJ6qeO12MLMbmxRVPv+-neKZYmn;^)Q9HJc$FU8Ah`qW?`o_1AmS4wcNPBc>-a0C%TFpYk}H5CD*HO1#K< zE4~qPtF${vm_yd)WD8Zf3LNlA4yWf4Sm}~h?H7KSk-{eVP?+JRZj-7mK@B@chQyXi zp`z~oFD(E9;f%}4`=(j7x-{}_Ns3(Mcx;@nLBps~S;As5lQFvv9UCQLn#--vh&wwg zzn=0J2t4PXJl`DZqH7s9Z>AYDO5A&x6>;j<39}Ey-Fj{vhaFT~*s|PkwYGNr5<)5} z*<27JzNG|{KkZjkZD!r|PVHBb%q$ll?0<08T6L)F5p57VD;Pc5UxB3aA7G5e`LbzF zZ(_1I-~IfQszvns2q$5EKgt!uCBMb6Duyfm)sQHxBj4$zp5;;Fb+DwCH>rIycl6R) zqHsd6gm{LFR}&U1ghGH9A5?F9aQll{vs4uIt5!T0Z6CVXWf zKOTF5cZRzrS^6lfm_*gqvg~VxzoJapvWQvL!2k3 zr`zHe)i;5jb!w8XD0z9;sf4-~+r%NaQU(F?e&UDwgMao)aU_gdL~)mn`GPzu)t~eJ z@?KEq9X-eJErS7K&zE3TacOO)6!WGt{w7}2Kaq1}o=6*^!xy7=#s|Mr-?@|;J;b?q zGaIHm^_)3i7b11BkItA)8t*4wZEMJM+yrm&lazqOZ~gWyN@prN_Sw8EvQx$)Ha9vW z5_wG7KDEgDqA~QpkoPIMug>IOw#K?v+LNM_6s>2UNPkkRrN6T1**Dhlf8EVci8iw3 z8G9X3U6Siw(PqmKu+iRDUq8>kLmkx~xS{$-vRo?aN`(#8yRKpdeLIY$h0zbe+-*jm zpWvI&y=&XI$2r^}ht#^229?@eESB%$(36{=^bz!ZI=!Uwij99Iqh0s}MaA@MO7RW; zcDsZ~!k&BTo>BYAF)2g_FB}(NZb_`gJq%nZbD%jFrNn9H^3Jh1?n->y-!6$gnRl6- zTk9p^?<=NpGN%U>a=s!>kC;P0_b68RRQe^yd_^~}1&zkr-cO8D%(ykRs=G!TO5`UN zvWwj~)1^q@un)o)L%(WR#qDa(um(1lw1gmrWc;5XRh|y4Uxd^_ev1F9ObS+OnKkLG zXlx>qNNikO`~;@{z~^o+bA9(q`U~lYqTBUGIz#z4brWkWNgjk`$6F*fd#rzf=Q8t^ z{#C9Gb3Y>;W>}0JeBqAtHx{1Up)tE9#L|+)&LfRt7iMxo9nsA8uRI{kvGFHVe!+R0 zUlu5ym+H+;)tc=IY|SvwT%Omb9VTuYfAKG?IS&e@_sY7gpnC7zEdjI}bo{3ARqD`Z zJMz=Z#$eqf>`H%6?9+=_S=lg`*%w&O|9rl-!FnO`w1I7Hv;2wF6}ZB<&s`K!sq{)H z;)=_aQmOS%vyr~g%`H>%Cd1w*hWUvDT@%w@_l4~fJQa7N#nw+kHgl3U;}5b>a+?_! zvXM$|$CqvJ#3XUvnGivmC$3ve7T}BiV61@R>Z~twetrvf1d>Wl=ju|9y(w`TWW)xZ zet&^gMJkCJ_Up_J8N`7j28cii4SY?0TP=MsyESZUa;zU{&@@ct`|SBRrxg0`jeuJB zvYY$UR3#^9v|^lJ*p|0nTqw=H@qN&zf@AL|IIlZXEDkhlMFI_CR=GH39}GyqrE->b zL;S~Z%c{+z-nV?GG>9e`4puvNNx*MPE?{SPVyM}h^P(U770nM5!!P82R7(`D^z7*u z#YtL};r)QUIAafF@jK&~HCDqYk9r@F5N}Rf3jSy4gYy>(DH(4X+j;E^p(9m z|Gle(GWU}$Aqny2R7D9%_}aFXZi~6ew-c4d92aBuR{dcJVrjzKAU-4e$)nIgZX7dr zaD9yH-IRf-o3`lnXQBJq+EBkOsu252tRi1muYKCr2Dt^rt&T!%vMFqJL&ihf{;8r{ zaiLH@={s!icGC*y$Bp^W+vG%5f%z0$f5kvG4?p<%^}*LNoY~52Kfe!(9iOSX*WTWs ziGImM|C-9z=NPo_~T(hf!k~FqY>ZFtzjfr;2XtvTHNHk5wi)N1tu(xc)w-Lqlx_Tkj^Ut&A#Ui~0}xI3I;K2+yB za+MKz4r>^R+3`(Tmw^RgZUTTSaw03f=h4Z^7uzndj6C?<+%pncfEo~{g*f40<{pGer z^R7;PE*U<(9#1l1_x$uD6}fZcuWw?7Wn1kpKC!MA)-pZs7BpW5b&b1!(IH-$ad&rH z=bv2I7dzaBZLxi0O_f_NlGMo}yxgSRk)`wrZ=5;u72kf9bg*pu@Nu}XDgf&QIO9|3 zrgq`g3uEiDpV=NB=xUtdZaOAYbE&?B@S%h=lQ-GiMRDT!-W#6UeHUvaaC0lx21j|S zCK|zwUy=^qxLw?zI5%)KNcjo;bPPmcJH1EQqs2nh?Z|V4-rq3Fp5#dGEQj%U`PdAC z1c^yFv-EGbp7xZRC=pugDa^!|FyfbeKjRE(g0|Az?Jq#i-|H1Cpk7<6Ks>kAnmJ+zDcBJ7n($Pq;mb6Ma3WK!(Wrtm6Oi@E z(W7%OMh$64TWfpAis!`FA`Y#Zs9h ziiMx73a7?f-vpi|PWx6kou`|>U|{Gmk1A-6>3abzAZ6Q0*XehE4-Y8JF+ScY7oQq| z&7CyA9bySe_yiUsQ#Saj@LiNWX2D>4T6h08V*b~Yf0uyVEw32Q(tKI2wdX&c*+=+H z^Vud1I$&8x>ss&bFxz3F2D_62vV1FNw}l!@#^_?@43F0u5-}}e1HkYx{BHgJcD5wN z+Ub?lJIc*62iTtpbVKFG7g;BlR$r=gv%=eA-+bECon-qIk_1T+vhrMM`8l@oXR1=v zqi)oR&CpYst)^p9*wb@BZM*sAsiYp*MWEJV-c;Dk44S1)n_FKd@t*8*DFBO=erj7C zx9Ib9$s^4cyIP|eeK33YcP|O?b@*A1mqA{ei#d;iIv+owwj?z^y9bxsf(rY&xQzry z1E0m!#-nhbv{|mL@C`k;7Ih{Op<%EvwoK-D6+~b^^)yqx?VZarmz0k4tg$YPqfS3A z0Elyz$@>4c={V|J>cpPSHEO%yRLLh(q?de>w^zVg?q$GI$vdyr=}L(tD-xl zoHnq$zv?WhY&DQF?R<6&k~@PV3y!5;{soldbHBB?U*^U4f8aipaqwk2tqszwEjZxL zyFj~<-n$qq_OGxd`emCKFkOz4%3i{Fa-n|348dI6@m4$b!?E(`S9Ow3G(FGn!)jB6&c3F7xurB-@b*+;sC6DIc1^^@ zz&_$lkY?S^7CqKeg*(pWS|Gbhhcw6k&i|)OfrPakxC->^zkY)F`#;;?zyIUyU;7*Q zzwy8EzcLyc8ag^U8af&R1AȼvNRa{iO! zc!lP$U)5rx=ju?b`pfF&R{xWO(cxbQ-`-!|yAj?nI$_u2x5@?+=pnB#JC^Pp9{#fA7~>CmxHw0Io*H zU%c+<`2Fj2b2vBtH%2=6*Tv@Q8xoM-9dN$O^b$lRz9!p+ezXK!(NEBVAf(9gSK%~v zX~@4;WoZ#_DJjw;;NH0DkxY!I@ThnBMjKY#-*z|N3HBT1%Lw1R1Y*^ZR|J`+qP|M z=UmtQf1Xq4)Zy!M?p2MduIg9at9$*{ch&ck1AvVm#(=n2)Xa~Fh*;T6k~POMOHz^M z){3IFA0Y#3D|7ttQ2RMl9Bm4;I<%)c3O3 z6c^%%pyopy@1~awM#iym>4^5GyNk%Sx(}vQ^P+zi=A!l=5+mZ(5P`-pwQLS>T)C{U zrm0Zcvt%vV5N-mU_?wurSkAvM?Ty-@=AT|=JwG(6T&6K#^=PLtEeOhIp^kOPYr5pK z9BX(PZH$IhH8wNbbrZ(zRgZ_Xjx!Z^Ul|O8Qe5?`9vPr*rr2N+*&Emz>DgwWW$d13 zx$tEkz#C%Eglx^olyo=$WVW-L7Q-p+*M}KH2r5QPoh7U@OClpHtSTcZ9r8XQ{`3l- z)MI&2eCH&DD1ZcyC2MUv-%8wR5K|9ks|91{vVT z?W|A@{^zyL`?{|<@sc>*9jx2FpsQa>t$BOeQ0aU=k!wV`d=AcC>6$xV*00{0c2~H( zepucnEB{w|(3VM=x^a5AGrDol=RxGn1Z(i*GW{{LQ1+eYCXhODUSov4##M^R=IW<> zCslCHK~reJ!e2wzEb?sV$eZ9N-heLkk$+e$#UV_(M(xHpA`le_?32W@iJ}%{7;iUW z;6F$tMlTWrBtPqI#TODh(pvL=kSK;LMi*d|Qf2(Ej*irvD8Op{UEF`)g8Rmbhj|=!H{0${FB81lvAI?`q zf<8JT#?z1x?^8rZDm5yl-H@2pSwz7)Ix6SI5-W!m>z^n&rkrt?TqavgqcJ+B-hP)- z7hOzeAvLbOb_Z;mC}!}$9ruPfiaD-;RSkZ{FrMm98zCrRi2_ZSaImINM3=A@!%tdi zH)gE(lyH=TCT-kVGdGY*IS1jVoH81-PCiO_MnO|9Ev(rW(WShH@Y8^`#+(7l8AS2Pao1j6F6J%JY!_Bc@E0QhGL0`=J15vP_(FY&O>Gq3}0y zxuk^jTw(@Wes_~`NARe!Max4mLkzX71H_5GjLIU7QlaSFgIBwvb%^HFV*D0 zIy3GGBh1W~L5A4+5VH@BW0)DijV6XWOJ3tr+0^XfpPu-;e_tH`}Y;D$`;W1xj^Hk0TZ?Sxetx_+>>S#^7jYB=f-|}rsz~*K7 z-pr~FeZo}exqamnnyKE%dea0^XJA^qr771}&n&8KmAIybwf=I;7?E{#{fWcR+soF* z=6#ui@Ts}@)5^)^ePcZKw4>+J?ll8{lRn!+?orOceEEHgAI1Z)O@BkQ{=Bm<&Lul5 ztB6*LIdFc(SVUg3`Z*Z{?}Fg{cexBg=NG$$xO4=}$xnv%jONZ&%l6!n#a@D~$!7B}<*9?w+`b$aqm*^!xC6$!* z*>a%dFA=OW3ao3uk~6<&2*Q#*thptAnRAFluo;)Da+#ZEYOn)NSX_$VNrRU=j%S%i z*lUrQXPK98S(sm1m_Ju|sfBx>XE-<@E&R$gNY~9T_9c87HX@NLB6&o2Od}%AQ^~c> zhHNE*{3PPw2$1&@QN$Hlq8V96<*)~gtn!SM8Vm=LhG}s|Ii7^JNJceiMzwiHwXZ~h zUZOhTqC2>vyK$n2EEO|xWWy!H$Em`nR-$Lh!l$WXW=EnIJY$y9Vy5Aux>F*yUSf7| zV)wXW4>V)pQlhJ0R4Y#+&rbAD24ip1Vi}ra?>to>+U%}1<8IsH-bPe5P8^Z3{@OPL zT1%=cXa-XZ32Jk?(xe%>x;Y0zC)l*PB2z@STZST7xw^Tod*!r40uj# z0dV(;JMy+Dx3C5Lb$#_&v9NMD0#>z{yF?h(g{H=q0RgM2$i=`~N^3883&&BQGk2Qb zYnr81sv8Jc{{&221t!6#7n#Rql}Gfrnml`|$S zEyCps-Wj}_2Z4}Fvzkcznn>nVaQ`DI58A`f#hv3+zEC51bhm&-+e39VSwpI@Jh4z0 zU{jrvE1?wdf+vxDX0;xC?_cbrAyetf%EN-kEktQu$ ztKvsUtW-+&04Td3H}B=hz7mi%H(EiRnsLKjiQ`qdcAB*U$gVH1n8&T$!p;6SmOW&h z)dOGEFqZK!lGWlBNU~Njj!?C*R@w1dxrA3)_?q26R!xtYLrood6_E#%ZjHNapkSE} zGnRj%4e*Po0hs;e#tAWB33{SVxB%u;jk=IqyGgv{;A!O^@#ON4ghayU-*EqxpbWvF z4(*6cc=QT>&d7_CiYJLEpy0{F&5WXXE77M0${{q6oYx1RB$IhJIPo-4M>P;8_Ulcg%O)Xd7F-*Yw*@;mIu2();h8m;3G7@TQ_?{ z*N55UVDZ$!;cLb4nh>XlCgSJgn>VLKHLFFnYecDQ(<<0%7i(uEapB6Vf(lwN3$5FW zmrWal&gz@JTUgqQ>S#NgcsmqUwRhIwI0KjSxHMd4ZkakRW#N((t!3 z4^UUAcDi?YY4mALM27DcY|9ZB5{SWP?R z4fc)n^#+u?fvn!&yU{Rv-gtW)$90|GRo2g{1|urHDXSocD;QI&r@g8dttvY*vg*dN zF@35w9{oULjj-5#e&>~h6IILReODS)lc$-}uUV~Qne&nT#GU<&vj65Hvxw>10%g>K z-wg>vUBbO<9@ERgQZ85AHRv4q#JKI>SNreF^C8zl;5#ZYc-k3WaqCUmvdI%>!5SDkzL4GiJz*M|sfk zbZ{WZDYX~>ohVeG==>v9Vw_qiNIe?TDj%U+NcTQ6zc8}qI#P$2lC^B1`8FDIQJhoN z5gI*eHdd0lQGzp8SVA|#LsK-T)3T`3WtG{xX4A7t+Z#+>u@TjsMC0RqG5%e)+-hQC zDtcn9a{>uTxff|->)mHKx_fP+Y?UA#iLL^*y)37_95`0i$2W!i5raygI!4p~qqA?j zxt}Pyk|a8?!K#0z-1gpQx_7kd-KYOIT}Bf^KLoPDrEQfD{y^>9H04FBkZqv)MBjKu z{{r_cGIBPgUDjRJpzy}5tlB^rG{{7@#%wTw@Hyy=2b^E@ZsiJJi&6U5Icrpp%Gwww z|CI+sggx|tU@S*F2b(bf!<$2yT?5tGM!T7|_vR{zG*1c$WtFRAt{y;JSHF1AKYbep z(hg~3k1U*bwtp;!w2d2n%FggE8OJD?Z7y2dwUjQ72c}Q;vQIj8O}fZUx?Q%MPgK9~ z4G?WE!?iB^5w7^~uk6FjX;v@#Wi3X;tb}!~#BQ#{SFa>=CF)KtS=g-={ARDHXW@ua|ySy zV>S(_*8my7HSbCP^q!Q~-p`IYn2B-+KzG@v(qraUN=7%r#unVfR+5$F?dO)W-uCw` zr3(6)IqfPs*;az^>K?B+w9h`mlm5obYMSW&CaJ!+<>>{4-5Q!*Ou2PThP?%|b%QDm z!D^6abRAE1F78@BhD?4o%^*$n28Vt#wDvwE{=WETo((~PtL&n^?0ja${)q3vc+5fc z<;G@LVHwgU_tHU|ZD%b(k?3o!K})4-#^J%`YEARlZ1&Qm_jtJMp|SPhSn#33)M3TO zp*_Qvez*3KZ_h^bwtMW<+(&tQ#sqk}^B9^)dC~Ux@ZxxUqufjX#1m!8zx#yJZ3p*i z3MY04t9trZO(k$@7GS9{| z`oZt|&HnmhD{6M?atY;TO->Ieby;{?X56f-zE4#74`9E>z2pGm)b?Oby1tFFOo(pQrOcz@BcPr z@G+wBHmq<{zWp`@{`#1STmBcvaA6i$D;2P$@V;j7zP|m*i#V6|D}i#_nC~+*(mU$$ zZJ=0Z?)2-u3-#mX3w(DC4y5z)v~;%`>(l~{7eJ5uygWfLqxSN7-JhYch2I$Vg}~#| z1ivU2h(sdOi&ur;?hVA?a$A3YRVtE5B$NxKi?}-&Nuk!N2!2&Ak;$O98>))9KbpvV zL&5m|g9&;~YNihoc3cP+`d#ZjRI%uhtm$)AM$}TJJi4f>)*DFDQyLhsk`+TP-b_>_F72o_Tpdj%2agJOAfoeNWvxtH5qwn#jbDa-fc+_1hhB|V5q}L*I zBoH`>k-v*$ks?Pw)J0-)D8qDrR;0riD;JRP)7*`RwoOD(W>2xPPO>a-M98sisy51T zZ)bs7<$11~SQWUQFGiVvjYm~hHU6g(>#2ibXR54u(RrBpMDdNB=|m8Vs{X^CG(I=L zaoD7yAPCK_sw6?)tlH_>WwX__P>j(d=#CZBE!G;rrW0#8^maa&}29Dyuy{lPFi zmII29PHJ{>TUb`bN#g#f-k)WA05nqOBuwsphccH7!%to4hg zS&B@%=5>8u`!-|>ynQ+|dw^M|(Nf2C=hqSbO&9DluVX(vcBkWj${1dN13M;<^C)F$ zr}H@DFyB4s%>6^cI3|<5NxSk2vwJl|pleMd1hK1ex;D1PZO$mS%YDtEmH+t)&)-Lw zP7LZs19xz8R#$hMy^SC1G4owWgc>PFA2e?E(0RhEs=v9oWbP;QjUOq;69A8~yme_6 z97lVMtG@cZCP#jC$VuS8GDc9Ds0597m-#4 zRSktTGu;JCLE-m9F-rB>2$jwP3|h6avt4rKpdb_cajxM%^^`GY@TB=$RKvuxW^ob| zs`$f}gS6IH<{$UEj>42h`^ECE{pI=C*yWW|-(}oI3npv)8hQ3a?>J)k^lO8U`MuEK z1(P?(s3bQ)W2=TB?T3Hw(g58M(-zSQ`g6H z3VQeC^|OwlcI@1oLxWDHCN_v zgiq}`+$56(TvX`0T}Zi8h!FxS$OsV}WLPf>J^$eRNzF+PM#tTSYJQtnH2zUe!(Jh- z>)Bfx$|P$VM6KaHA_D(5qo9qrhc}xx7&3;bobk4=_h=1XmVi_a_d+ryzFnp2n@WlC zroX_$c3bHosVLJ5raK_85${k0#)q?;=u=h#yWKe&nK3VZzh-C(Hi$K4G*=PxLo1Ke z)uh$QW|QV}PidT?x70;iQW(9CC`beN$?B(sy84XlJi7u?|MVcdFCF3VvjG_Ae0pf|{D+N2n>tZzN;Tq#Q~YLd zAN#E8h`<%IXn58?LekaIKUcfn^=Z&zt-D*5(PtG; z7?&@zaZcc`61ks7@Bn`lwAykFOGEs%l|gZi`V`+2vtJ#nIMPkBfWf5tr=}1&yNCqJ z>_5zUUh8Qv&#i-cr;bV9>lxzvgq5(`6kvVLA(?>!JVxG?(c}arrDTh)dpjzoA)SRU z7|&j4eH>-f)b>_(J$D1`cI|rSESO`vw=`UJhBMCHeX}D5v#wh$myLZw*w=aMOT!=V zO}V~@B~N8RojzVTdfU+#99p>AcliyCqvq~Y+0`yt*Bi(Duy2j{7!x{Hg1!cs$1Lf8h(x;@*t2S@8}FBWhNJG~QFb{9gJ5 z{cd@W@7i*GuVx**A6o@KuPp>WmIeJq4SM|L82rEyJ^lyhJzpOh0uT>9wIpm=lZv&S~t{wgHJ`n7xF(# zMN$RbfSS=U`q272k*eyaGyCv#e^4R_&Ak8lhS-Hl+J~)LrjOr;Q6%{4((^J7+DwW_ zP;N+`A*O++N&1uLvkU%BGe8s4D`;EU{(Dw9??sr2yMh_5@&^x)b^xx4CZFjeH?g;e zAs?0NpeEc=m{zDCHIbT?K!k@(gwOSNvZ4sLPyZL`00fbGhM;t^Xg)@3 zS)s%Lt&~rcn62oP7vdC4wbTTL3|qY9hNu*Vm{L`t{DG+40jlB!g4%?rx~rIiY`li8 zsH)FEljb1w!eGB;uNe=@4k$)Gqo11qXt+UU0$IOB1=M*HGa(pScEYsa6Ip^sHlZ6b z4J6wMAF?VUH&Y$5qXTY9mdrs&IM}vbzKPq3N^D6|7*>hflS!Bs^#ZE?T(ePDwAw1pQoS3wV&!jBvp1O{ z^donyU2LRYOfh&+217>7R7TEqyqQ3(O%+iEX}qmSj9(Z z9G0kL=!YZ;2_=ST--lN&Y9$EuptnVG3KxAU03+P5C=Sb~F5pgxiX|0aRx+uH6IzD( zK1)RM`v}g35LvQ9N|pkzjg-j1G~~i`&4dDYL!tIU0U|rS^^D+;)C82+%y%`#Nv(-Z zSH&%#8Mu%ccsIpu*-=EjQKV`G15Mo~t7F!TeTM#u{5OZ4)?Fzf#>hV*Yla`y4 z;a8TKRFxH*lhZ@OaNm;U9T(a3* zvOQdKcwBNETym;b=LO6%iY>dUEe|x!5*^NZxGj5zECaHEzZMtd2baAUHRQpY8VZvd ze%WDYZgYXz%0bP_f4h`})ij4jm4E-7a0^)pPg&`((eP^41Prc3Ev`fpDwdyR`#&!G zL9ZrYt|mgS#H$Gh(yyfOYXapoQ}tGWDOz-onqk>1nS-lY$Ze6Eva3EB7uxJrxWo1v znnSMSlLOiLcH*)0+9k!!p~V!B$y{xtBgmaULORi^iX{nlcq z`IE3OMURU}dXdO>ObZmVN?99p8`?IsH%NDUblaE;$i_$~E;mNl$H8-n8;I|b!;3Q0 zn;V@MGGlU^({57~Xq#ONtLx3(MD_Sa54^UjYwjC0s}PgL!LpSTa(`(jN3!IcoBj0j&VU%IW8kZ;!pYrlAv?U>51LgdyzN`}$N z`wmQ1@~=M~Ou3Ut={9YD(#OwjXdlq6KVeKIAcy8GO}b*bp5Mmie?RbgX&bmDc&qackK{M;cv zsDTzoRV^`m?3;SS8JWr4f$0}QayM^b*GdW5vl@~feC-l#`6vH=>~mmGz0E%O2g z{k>NhOR}7?EW!_0@9b(P3N?xshfWbd$DapYB^ut~kRzXNL*J<#Kffbin3KnNa|eo( z0rnGnffEOD%M|!ySND^!&=WZ;#qTGuku4{YLnlym$1&y>u}>$lSCjYE^#w145I6At zN5}r+rvd7xK>5=)+}Q%Ifb8!+(_OSu_hqkc(CclF~499AqjYBZD^QXu0R7@OXavvyGv23{oBt+Q}}B4l83 zX^mBWo0VHpMt+FgrKjo4t;t26g_u`t`_lPYz;UsdTp_zD_qxp~+yy__QsGH1-94)e zD>A8u!q87wBb0cdS?C0kbkTCBg8XQA;SZPs;b?4fYA%-3Xgy}nbgOp9mJrEKd_Z?B zwEkO^+4n+8Oy^c)ZMvO=olQfth!6P_jCut3oxN^bF)PE)F~OTr)`OH#@;YhBD37i2O}A00De{xM18&J~ zH~ZNw(dAEl<1|r+0=)cEI-cT%D;)XBD}8Bv^=m7->k#v^0jIOG5`>JLGuT)ehL$}p z6j|kmy$0Yujo%LAUz7FAJ!RQ(?xh1`L8Q zr)GWn7L?f1maFtwoAZz%&m}uyAlOC@Xpu`#voJ6r@-Ahwb-bd?YbtWlKQk>H8lh75>fgfhdU{Bvwknuqj@@P_L+T_SJ1jD>4 zWE+2b>JxeAncvOF)#`+!DQ(E5tlR$A(UrEsjn42LA(3=-lLHLnBnIo z?pAgqbe1PQ&ON5r+`KDE!{uw-Avdxs2lC2(+vDGTjjW*(|$9>Y`<6DbAr;4KouX~%v7n_0q5!qz?ZoM-=O-KNe~na<~N_CfkNYv1Jt z|KknnAQMgou{G%1S-XyZt{Zs6GHRWzG0(Sn(9XN@kMXq`{W&i1vbOQOfC9aX#AP{e z-v~aNqho!m=GQgf>enZ?$8-lbGQtz*adTG%%aoVbpM+kx+6}J$j(LKuJl8KJ9&e?B zDRCCB|=e^{1?LW^hst zM{5DfE-mJB6QehHN-!J_6;K}PfvSL1dF5DzvKjnk-Sy|Za?7#L@^eXpu8CovKFPNY zH6tR{Z6xQBJPfa$LBID(%i!U&r{%mG1$_Sd^&|v^Rpa8oqxW$6{giV%BSss}$u`3t zX_P}s0ktfM$9@AS1OV81Iv+ynk1PwwD`QFQ>L13Sx+)rsP5KGxbHr?_KN!?(uE|qX zBl|Bv!$I7i!Dqql{Dug+hruJzRQ&xf1O*MNigK1@Fa(QTIyh}+XE+3d(+{I9Azvzi zjMO;#gsQZXv>@bUNox7?_S`!E&ZZG>&D{^BRKR3od_31R{V) zqzbE=hzq>3cpg})rNpt|l|m;}jXYn#AMSq1*KEE>)I^0@C;~EBUGw$EHZ=%zx&MhJ z+s3%v=y~b4klEt2+8+ryOrPFtx<3)PPju9YbG6-`!;LS_w_2n#lv$6*;HzGzvy`F{ z=XTk~V!IM+C}8Rpx*lQe!4ttO#S804}QHKT)$4+7Vri4EpPkY;I8Ng!ohg%1R)=V z?F78zp5z687k>HSkE&dj8-QrOVkC}$@Io94@BFe8@k6?eB#OTMg(RAJjEgjeeXVUq z1*`<%%n{>f8BhZpXHx>>zCXSsBp?xL9f;zRziLU#3czb5Qje;VB}xae{Y+6Mc|Eky zbmk@(D`2)d)KM_UEjE+!IxWdmvW_s%(te{lPB7yMKFqdiS=GrkT?3H|D_;T1GIR?l z4l}5V#mg+6^|{OPQPJ-tPB%PX)Jeu@ZZ|-Uo!QlO?Jit)NSAv%s7#zi)pot!b=3AiKA)?AW0e6R zDQd0NYiIGW3mkaXu5MUPIzRo7R;*I>Hqr+>i!s*vd#Il>EXblZZVjA;I0&pr3qL4F zDsIJ>$9}v+-|OSvFJ_K4rHH57Qm3Y@P7AqI-A*vI;_4dz!d7pXEisbVTv$`e)?3sv z>3Uq$)A?-HF7^tm2!T6snO?OjjNwotl|NCIwRij8nscrNHy;A^ugf6Zsd3yOg5=Ha zdCM7HdpAr+AEzzIwb1eWNv(am#S z-2r}!hQ78;$wylE+bSzysqnt)x(9b$_dyAMlz1Ze^W7Rf+56m$@NR?o9;Rh}{ikq$ zW_ao|JwD&)+4QDm>V*mu?0()$RS^Xl4RXY=3{prD}#_s0;co`rEnf;Saoad=UP{Z&*PpVbnyX zVDc>3r;&TYvA&uR1|MQ16RLjPxw=q}PGS_7vVOt}h5(v_gvScXf!{x!!o}%Ge#Vsz zkg+&L$lH=&5?||V8)yPkTs%dOrM}5rG!n(3So|xjAT2o%W7e^l|E*JlQJc0 zhHuF*yUhF>oM$6im|BoM&vs^O@og1X*!drN)?+6nC%v)E0&WG!b-*nJ(_8{3M?;6w-D@Ip>GO*`m$7k5f#WJNT3d5!F=BVG1SY z>7;I#@=|$i<-<>ul0gyuLSZwN^ncF9O-1E5wmjqc;3hCIS~dSkRgCEFW1hCNN=i8P zu&A&4K#8b6Q6}^-u`JSDM>QM1+Vfwr9Y{<`E-1Y4VCiSGe2t=r5G`n}VbT0{tlBiB zGAYrlvU)A0l0RX4_eNPA$XBH3#h$tse@Itn-dyd5n_aiYt`_$aqcfGUAx0ClI#w}I z6Z})%`t1NuK(N1Q!Zda%?U&eZjZR}C8|euSOmBL}Wb&!KG8d}}p`BqSk<0<4p=R_A zE&Eaz%#oL+Ocq3j88#8TGI9y6{QOcrw<$1+RPV(W>1dHj0h|r zF|yrM57D<7e`EsUC@f7eREnEmRv*I&X3rkW5SzfC6P!qlnvUpOijg>_v#||05~Ug0 za)G8fp{ww+R3S-;t`W*+ms1LgUJJ6vsuYK>s&apdE7Olbb+ z%k8l|jGgtFed%IDtye9agAC&G1+%=_l86~|5A=>RANaX9?4CrAbi|F-a&}fWItQY# zpuap=&Yt_3k&ot1y>bL@?)yyxry{rUDs4``ht~h{cXLHZ%OB!gzZ~wNbD?-hikSI= zMkrC*Q2b+EVGr9zA;})nG*Fa-=Qnn>s~#}3TijbsG-*P#Rryr(yxeo%N^9(?s!h7i zB(8W?Dr+2z9jDWS8LC(RRzEfMpkCU4f!S~%$Ddj&yO#QM-ZxM6ZG%&P{Ppp0@Igg+ zDMaqR@e7NE`C@n(ROz^h*6`WMF1#sL>AnN@@Ex(%zD_#a4SxGxzTD67Hk0J{P{PQ6 zrcmp(6~ljBW5Bz4i}Joa-u+bH!++@{_`d1jbR8SVckuVidsoo!Wr$JWF3{iSkaBw` z>6q`Kkn!_WrRQzQqdr!E@o~Y$|8eVD;H8HVe3SI0Tz%YiWtaQ@SeW~H<{E<@2D` zf5YhK!I=Mswaw*)_A*Np^MFiUnJ_onargG63h<~!=|KuRXc#9Kw$T|LuCs-X^3m#mx z+*L8n$F|?ab|=P(&Bp-}W9Jy*6cFQ9=6^5>`5ry3l4=0 zUqkj@VhX5$B-A+t)bg`RYG~zRMnAg?(EkIbARJJMAr&t$5w9@eaX%3EDiR+f;RTP>tIZ2t{o;pT z=AA5Tg#6h=ye~sxVm}(}60RaEk39dd2fKOTTvWsdF5>4QqL2<2{7mqqq`6+dKiW3|d_z8B_05+c7$INF(bnI{FwgJ#_h zfNeKP=}nF8_LE3)&m`c8)P_xYm8w)JQ8F?Qkm(Ko#PpsqA-1d1XwA8)=wm7K59fh_ZwRCjtm99hX6#F0~pr8e9Zdo=9Pp-F2L4q$a~GogiS9M2wqdgqx^7T8xpN zIa!j@u9k3GoaJ^3^vyPSGP{8|@{B$dLjd|yMQNC6gEXTmFiYA-#tV!P3(fHIuB^3P>!)Q8 zVI{bs!os~=2Y6NCnO|C^Pr1jeA#(++_QP-X)0l|XnKLa_fH@3^tvnDjUFFj4ub)(E zKbbWn@W<6VYnwD5teog0n3Ez1E7}-MkspcBovseIwAY<|J?~Xsm?gaMH;WC9+30>l zo`kIGzykL2*dG6=>fSmZHlm6)*4NY?&}>1-3?(tBIn7uz8x5r!0~dqr72E^JDq#>&Gb zbc>0$i~7}z=Ja%+@+tS~Nx#eSBf6DHyA?0`C){XEBD*;fyXl(h^%nXK8oP}KupJ4r z-NF|A)=~A=zo`Z5>TP5C9dPvy%++Jn#YzVKDh0zH!__W_{c2=Uh5qhFclCxk!=^sN zq4Cv$y*&tvN_lp9E41b$mf`eDV*BUSP6@+VP0g7${W4F@-am$Y0fx&V`^%}TuA8bu zbB1f@nxm_l>nDbrvFc4=%`Fk*9eDq=h2flo@m`?zK63kftL8$T@ln6_(wy(cMU$fMssI; zfw_4BGD0HOy`t1XTEM$55z8nsh|jXTmb5$3nM;7sz&JI?hJc z+H1P)2Dbe>HVv1@6K5t17pnI=4jWdcUzF6eja=xg+`sO*GFcI8FIa0?c{?20R9N|R z8u^ABe_Y*gZnJXkH*y}c3SLh$6|(-Jbm2yH{gdmm$mGIH*(5A@$vfRBGJh|^%f{is zDt7K7_Ixk)ej|v^CV}51f%+hU{V-Q?FPz#Wb#5mj(j+bMAYJ<)s>3F0;wpR1Du?aN z^_NXPs!86%RsQ~gnD{{owpr1|Sh}%Esr5l=`$lG*O=bB()`Csd<3K#DNkM~M&A?5e zkVz4hUBiR@8y35An45A`Gcsed3a6WD;iF3JBf7ksdJp(f-o#C}pB>$yS!0`B-+@Ro zj@=;1&A^~qtMpL|wZ#ydLnjreGu>>g!>%{ZZt_*6cie2M;2w3^Y+&$YVA8S#^JIkI zqV3ONdC(6msR1D zF;uHn<&$HNhG`Fnv&`Hu1E&jTtBasVWtENRA5J%oR=2of*I^Dj2M@b*6t5!M_E1jG zxK__pPC#xe;9NwIY1*Td)2pY|dzjPb@3U9ZnB6&t-*JmytAVCyi2oO70Bl8YsyFRs6wZGQ#10w`Zr|7kjDv^g4Z$$$%BEexT<9NNM>xWfJ0!o#>C;@TpT zJbigXLsPk;a@(R>xuSbsLQA1lSkO(-D7z!8F9SV3**u zd(ZSZ?hM4&j4uu+6Hmuw&@D44W%$K4Cq(rEkUY<2e8LTU2j!Z)hW_HooBx|v_`_zO ztH?t&vlNh($(^C$l_AjEksXA4EvWT|o=@f%aD5-&TN{+V|Tl z#RimJ$CHc?6Ndkmt1(pb1*)Ot0nWFBQM?&w-CzCi-%~q?O3}GXP_e5l+B3$d8(7;) z3ojerc>+@5%g0~qXI``YJ3{tf*;l zgZ^!Gv=M_n-nIew?blwSp7x#NUc)ZjX|*5qjh*c{d`-hXfwkNsy`2-=oh8e`tzo=v z>)g`{lfw?3GqCM^&|U4QpE>*Qh1b0E3W<~Zd<*Cw!hHM-+nwe9JdE<4ODcR1IQ(+h(G8om?rox?EP8_T{^+XGYYom)}w(=L;c7-T{) z0z0VPJJ4`Yv1YZ?kj)qLxb+?FEF3z#~G^sIkx}q z&v*LC?z?{QU8}Fw8NKHjf9#xB@IJ2RCG|@}*#EIq z@TyYq(dKc^Lhxhw%iH$rdD;Kj!~bQz`<1f?{497;AoypZk~1#nPY?_uimaz1v2YkN zF-vk={9bJ8JdRMv83UAXFq}Xk6DkW(CYMg7H)==*B_55ZbJz?`08}XD zbNK`BFv_q02ti0h&51x5>i^&24$K$ZQ*1P94gQNe0NQFbTFjRG7k8jj_MAurt?0Tn z7wCb!x0soFt>5Dd`GrZ4c4OEdg7!;2EA7^JIEGjdNRWPKI-bI8u#}a4Z$6zZJGkptF=+k_^yvZ0xeuaFW8zD&`QywKw=W~{#%#>vr zqbv@d8>1P8QW|)|pmXeHK>JXZWgJCnlx3PFn4e&u=Tn*FSoL8gBUIR*?dQFnP?_d` zy_laCg!HAYnHO)GRU|;;SDh8b)mxYqC-zmHlT;{jsex7NPaKmgy?Bt87kpGzQ4%6# zUr>>gYhF;3vcp_lYa+u4^nS=+T+(*xQd`yqY%VVA2Y#xp7)B5-tr#b~@T;$yrt2-O zn&ntS2YIV*dS%-x#%(cD`r`>{e`&4YL; zqSb>$B>}C&WG(&GL!gnL)=`>O&Z>E|hp60fHsI=ia0e&(5e#c5g$eT7r^V^^YyZU^ zXrGmr*R1^)ci?3SdK1b!ukAv?zo;K%$h>Hrl*hkpUbN4=Y~75-zXBcBWL|Y#PT^m7 zJziyA_k5xd-1I>+X5I87D-hfcE&^$PL-78Op-ViZ%D4Y9bh){?`Jdzej{hD1{}%tt z(B;3m@Lxk0sQnkpxl=MWadokA^O+f;10hti;nf|5rm7NWY(I?HJ|r zrHX~p*?0-%ij^AW)|+F^mCLab^)Q(4%~h+7mSKsDAfVk^E4CQLC$)#YUdOk?jNow( zW1U!k$Y(;N1O}nv(0d~FtYqfhVS#=UWF!#d=0Genr@k)eUT6$gDC|j==iYn(ik%fx z?~TqTs@ACWDQksvuOpN2JO`PZLu|VTpiz_E;b}cJ9DM#pX`Qls&VB9qsD4#M^NOX?S)g-tY}3s z{Dd)yW|p(-0?$C`x=IA0<Un7G5KjN^Dm@ExOXv&MOHEJUI=^x*8%4*Ed5TFB3(GB$Rtk z*VdN}kGtJ=iU5^7uLcg#g7mzOqR+m^*iixt;97nE)R_%1^-?dMB| zY#T=R7R&9X#7oOO07mZ@di!G)=FJBoX7;-C0Bm{_O(pDftA~wGM8%9JW=x@i_6*kW1%xEf`-L8yn36^vPV;cMP43Hn!;5;T9nrmY>4Fh|{rK`a+ z7Cm~p8&tfTEjRb0RUto_;$UDk_L}A0+4~ai!)RKXa)_G9KlDP{~j&xW9bC8X0Ld}jd z0zY&|V0puZIuA!OX**TiinnocA;V@x{qlV%|>me;Z{z156vIXNpjedqo z4*dA62$z)IJ3k^9zJnhN)eDNp=zA8u|0HKpbd|@<<{Hd)OwcrVFvgB)6}#1A7V`Q> z>@X&YkDg-{jaaA!-Luy

    mK#I**Rr2gh4pjS^@5K2PvkCegiF9}!SB3;#Js53%SJ z>L6M~2AwVvktWB%Hok|8{+bm+Ji}>qo<`t+F2yXLXyuIfn<|20OyK8nTxqlkUhSbo zgO+m4H`h(G3UMi|p}Y8sf&VOsaHLf;?$XAnkDQ$W96LW6fq{EP#74NX=1<59N~VV_ z38ym5zKIFIjv^7Z*GU7I#AxepGC1jyROIdV+4i=F^t)2i9@4CQT3}b1$h%Sb^7E zon6Jq=*xw%ac4cnPYRB0f7WVyk|rrH6tL<2kX@#jPq%+4;h)@;$39V{D^AV}(xMiS z@FXpfw=A32r6D_f#tq1MsG!WMkYtu7$uwWA5dTC~r9@b$?Ow>>d9+raj+|_wX->2z zw9wdo6S;|Yvqrqk)>+h217f+w3XdG))VV!&aYv@T ze}&BO`PP*b1EGV*xQ#xwS*rUb^l!`VceLBY)2_#6#^f0|?#~kV9`d4E*nRSy*nw8> z`TN@TIebG1^acPD%x++27#(!a$iH~!8#KgDqh~9eR&)leFxtmmu;GdjagJU@T&8i1 zD2^X(w__9{s|oAX%^+J1^P6#%7~+0gjiem|iUNTM5$9>45Ktje?0ugc|9ME;jzu|U zV}DyZJy><=FkI=_)Y40HSor(>O+ywH^Iwog8kyNsHRQg+f5eF(s-TEArFG=F^d^T zFEd6JP13oMV)7mi?Rl{!uCwIUm?I(#^Q+_^PkX?IS?U8cG=% z+xJb-%E;3ufAcE&d3`-6)269I+@r0l{QIbtUtO~n{yg*iY~*-}8zg75e1r2M9V?b= zLN|RsI^%M10;wG@>+t+r=(@(8seZFwv<8?Y(MDn&AN`lNfc>)fW?>%(2;1HvBv%Ir zfl9!Za(eTK*SWn$wR_%j@{qU)!}J5_bh>-4sj@>j;!C#U4fqyPD{pJR%Dow>|2YyjMd$r7c1g1IT`i7)A* z-#>H9zF}RgW`CO^|9X)C=o7yvV4%;EZkl-Dq8B#7G6Ms!e} zZN-+g%#^DwU~Azo=SblFu&+CGFbte&17&dLqi{)Lz^IEmEYx3!qTuvoB6&~Fdk&@F zBYKc&atwv`3+#;FCA2@-0wsoin!@?E3%g|(hH?po)ZK^ZoVW|j3QJLj$ma(!j|6*o z2KWqfdbJsPhC6(Ega9;kz&Q`vD3WUa;hIP8jx*-r2$~{)xkC6#`2)FvE7c=3aYCjB zjkD5Z>B%GhJOIQJBN$c!+*CasLk(j>BMY&EqoJanEUbz~BE3`jTHykBo1<7pg78J6 zC?&1_QANez7>*y2aAK_{o;WA+yCbAH}UN znK6*ZUx>t;Vc{bH;@sSXHp>7)A7!-4&W zHACe)>0FDq_Oaw=L@Wq4w-;9s7!gGTMa+wk$Hr42`7eE$yZGl>VV|S{@sqb2Zn#Kf z@u;V(wsb;KX{zNIPsS*{1+c_E<0o}%uz9*8H%^dCdy$`Kpof=FfK{n?MxmZ(X%ucK z*dH$o0^oa)>gQGw5xG_tI2I6sQ06;UMn{tBSQhAST`r1Kex#KQKM?inq`aTI+*#UR zW6fDWvizN_qA(*8z@z-rv;2jtZ0JGFPAWXhx`2fOm;$KOm8_`TuPmj)s%jS~x27G; z5D=uPjJ2#RY^jQ>s31+#U7?PH6sh*{swzgPiXSW7@X~@S&#QT>NHz;z^{U8zE-Pp& z97PCmT~+AhNn67UTliVair^GWUbQ&So9U8Hf>rn#DN_tn+JejTfK?YK;Q+lZxm#5C zgy7M*f^MkYU4T4PC(C74~>~E-e1qKRD|-mIx6X-n3RR zmGM{8^%r(jq3LM_8#zDwx>Mzw>{TT7cPVpT+Va)2R5f8AlJ$n(va0od@+tKa>HCIu zgi2NIY?*a?W!?-0P=m2{vr}L5tXESGf_K$&LPQItOuv=Zc@ZZYWyYDa;d>H`mE~Du zi$#gdchgqEs7gSGpjXFV#0a2BCAoi8vdX$ZQ+@QtYh?Xwvlkh7bk@Qb&|gNE6Z&HbKaZNGm~q*+v<6vugdBgby}k4 z+V^-$g4H`1Pn%;hJJb+54|qD|$2*#7=!WpA#>QI>gxl4QB7@&Mx4;XXe28sM(w&i_ z)*9aNdc3LDQidxwF-k90`|F{iFX>Ait;w3*f2h0irBWTVd%zhnPnkXc`Nel2GBV0K!sewci`oU0h+TC$9ksXV%4;QBKEG*cT#pv@#a?=Qc(4z-orNt1 zYH^F6+x0I2o+NziejY9mBDwZHa{u}I8%6g?&=h{KyW3~VfX}JDO~SIN5t!X=^I&*J z!gUK3DEdF)3E!@xLY#!Hv&9Mjq;D&_61EiEd=7|)gI4;~wj?i}*f z%}L6d5Tu<@;~g78VxOoQPO!|RTAS$I5DUNWAs?OGzi8Ia$ZM!FdFRdUjw&k6tQ+v@ zqpa+C*l-l|0X|%m2uGLSdQ9(C_WDIyfo&VkXsY2P$JY>NU?#h^e0slMmO1OptRu|+ zhOYRq?LhmijyY_HuP#L;Ov1RF9nS3jw$b;KJ`&0k+(W`Yx7nV2!`tvhFb`htp6Z;V z=byjDZrNE2;O4Kz)(hnKor8Xz3mc!Mi>bm#vd8+=740e}pKKDCT+oe3k(+G5`_w%d z@6p(-B3((Dqg&wZQYX~=_X4{#$+AS?GcTcMYHKrZ?Q3#nvxM&(8qu~?ptVT(F^h-c zr9e2{hB(Y7w)&W6k%T_7iJ93Y(fFpF5erBj^WwstaD~rnY=I39jvco z^w9E--L6c{o={YAgy+XB+2JP=l_iF(CT?7Ez2n4AuWxmB*<4m^|Fer_!rjCnY)d@Z z&R0*MvD~p0?puXxMT+h1eX{>1-_3jS#==lqu1@FkULe*nykYPn9)LO8?7;-l>OsrbeJoRW_@7aq|btRIXo+tPgh{)WC9Qp5^gL8D7I` z_BmFKK0Fp|zd9pPk-i_4vq^ey)~@x|(x?Zru! zM5OF!6~npDhK~6?lj{fb7fN_HN;9HtPBWSoj>;nFy9l>r4voM&998ZTp;87bOY@^fdY4RHf=un;&t z2>67!-gEU_BTJW5pyUU}&U}SFNKsv|lsxQ5#~j%kVnekaTrAJ*O&J2$+ds?WQ9u@N z$G%gyh7PIC@?}WKmx$HJ7P$xelPe+Cq0W=#j@M7=8TBY#PcF4Hpv-4`xlW&+eT%PW zudb(xniJoiXLpB}V1pOC+UG{v7x&MXi0zlC>6a+qm&Be0-L9AT+Na>{SBJ^2yk9ec zg0Bf&Pi0@!&1sb$_Js~#?bX|lAK@=K`0q80WmR7-P9RXbLp6wT|9$Mece|n(4LQnZp(nKguF?w^h%*n=bPLo2?J)-0?%z$ z_M?JN{0FuqkB_>h$xO ziV7uWktvkA)pmhfk7wvr(yi3bKeMeKtG7FyTJiM4Judf3qP6DSs@U&VvURJ+s(I(A z^@@OKGT_+uRHpSd|DK#7MC_a6$y^PQ99=B;gViL5A#vJ;^RtRp?vm`4gyxNL0Bn-q zoAS#wDDavn7h&V^VWtiDy~Uo(`+99%>Aq&`f$Lz|M+Z9$W$tQz)^ONlYjcIn{WPR8 z=vm$c0RH!JZ1Ox+Jrx>t1p>3k$aXwznZ*4$K)I)5e~m7zY5xAXPfLbGxiP~SpJ_L@{Gk6#qr9q9jFG+%(5VJm@+l%Xzra zDKEIWprj~4uA-`}(1oU^_RQv{rXk|PzQn4N(yU%@+03rd=z56Bsp}2BH2u1O+LWo(_@DnnnQCb2%W)AHdIOPWfuiI#=Hcc1o;yOxq7-~8aayrt|PxGj_;y&^6 zr_i=6M5E8xFASM4vkENtNu&z)UgEaOkxN48F4*9eJ*iMZZtq6FoVOb)uHHg9FdZyO zV8;qW!nga=RTFPZZ9{Nt4H7HS>1^TFy|ui2+2S>A!K_3T8Z2Yr<7i%%R}zAS!v3%+ zj@fchIy`}z-OZ#&Rdk${vD;{wRoMRV(4=JX>AY;nvFUM4csOSU z+r2jYmr~$30OEhdI!+^>Z!q7&{%^#(y1F_?N5}a1`2Q{7{O|bxGqLW!xd03I`Ts$z z`#=6e7{Z4dZ|53+L=r|D`Wj;ELqPf}GVxfvh%LvKXxYr7uiB z(6u+6&XY(L>Q82rpN)I!jOS!Ou&b>%xtw=L=vZHG_Wo`BAWUhy*&h+Y^Ka(^-5+CS za;BhkwY!BZq?-3kWxqeI)qi$G{pz{lRlYx%zZQ2$?s|K!-t<60?E$;J-d~>A#`;@+ zeL^Td87M-*Smqf+gOhgxkq}x86;L^-c8wqGFn5D-#@zDd@y$<&bqMz`_QJ?A*bC$+ zfn_9`)N>1akxbT)dzP3(mL`U*W6Aq5d_2vhvVu=k2LSdl&4YN!cFZCf8H&>)1vwOt zgCtcT=ApEPdO3Lvojm9;RoBcaHPsLZNJ*p0w>ruoE4NC_v>iG{%d$(PKF*e&c6Kwqu0A7)(i0+`AB1$eb@{ zfYH#mKeiB17{3)EA%4VH6?Y3a6L?4SSK2`=p)_5zw!ukN1yR(aiL`}9s*2g8qJ+k$T3ZTk-c z(W)MVkN(}c7Dq;}VAEK^NcqJ$l?FUEu4( zd=%Pf{brUw*JojxRixTrj!~z&xk~x?m}N>QY|?i5yE)~ujF}aKbz)$Gl24(+9?!G|D`hB4?lA+DplI5F-{_pmz6q z!;&YiDH4^FFN2|6C^{lni?gjzIo_k`8I-P2$wpTnF6q&-W3NnmqtQU5Udj(@rZpox zADpvZYBV>~_f;*_S?^yGPM523c~sDI5M${)!lY75Dja-z(@6D&Hm4`O&=neH!^PxK zh*YyOO@CY|ms2lJ5!*6j&eReThbhmlMnc2KFPUjaqsN(FH^;6R0)3V*HPNY#!y6## zFpOfwHGf7MB%Lg8l$bXUL{&P_&#z0GBegx?+4HOmi?7jmXoyYXJAXcISPqdVgjLr# zmsFx@VQF-rzFv`p!EJSidvqSqU#oz;rHH&jx{Ud*wO`-#A6pQ*FCSA}F3O z)U-9God6~O;*b8s2@Lm&QbA;EzI|ji2mRFY@ic~yz*Orx4nwP{(bEyNjNYP<8q20q z%ihEG4)_o@e1M)!Q!!pijIar~VxmJ2Mq||vzG*3zzg!vb)_czWN!~WiP98>UfwuXK zr+D=|1#lHrbJ>EVL16t``)PR@>{37bs8&21y0%Nt*>x`0?9HmO38Jy7qP3I_V3p_n zj78<;rg3!Lj^4Rn;QZd#D7ieuyLS&HNEp%Xn*ZE+@5a^0H%sBNRguaHc8!^;va`Cu z^O8I4Fz5aga@MXsY`UOR0BB&R?u!?cF6o}P6ZB=^?FBoq${4%P-iJ$1l6@Y;7g$oF zT^0a!tk=IadF5FLxzI>0WDSs;F56)0&{?gmUtSR`JCwO`*Jht+sFszJXuCK4gI)5R z?$~;sdhUMzybeI^+<{ei`G*g_30LUc!=8Q_;sxKvqdqy1D!h*AfbY_#JC8W0U#Gmm z_h|-*>x1^kZk3HYooMl=3e)x&*@Tzw8kn5StM08DgjY_>Zm75j?{h?*3k1&XEBQo^ z)gthx-?BlMr6c$2w7*sY#Mo(V{2who(MOIrDZAG~e0?v*c`kc~-7KWRpDXwbef!UC z6McfWwd`n>3l984xPCU+%c{E+sO59U(l@j7+gsF}_Ob=ON#6rbJp_A2189;Ry~rgI zhy8w-1|ac;3xzGmTCk*Y$d-mF_J~AfKa)Y4j1>p-qB9-Zi-e6O1v8fU zHzhXH6P3i0AShC%8FWW)%fFuu&paMxTmclJcf#S0CA7avT?Mg;c>6cH=ZFT#;zCdcRx z+ik$nN<7BwaM7$##TGnEc3H-n&dMH^#V(auPn^U~Gz$(=#a)x@J&j2GO^$ne@jD%f zGZqrNgo{U155JX+KQ0T0jflUtG(uX9LwSwg47dNe8V9A7kn5I!^BT3#mH-WkC(??4 z#7WeIbRdH#4QEfJ1ao5s4eHTE#A_}vGD^kwKxxpPstiNxvckt-|BU9O#`t@XBnVGF zN1iMa;UGxgXF@pyM?@!;j{mREBS#^h}d&fS9y*A$)wP{JEu`r!HOHB ziGP+EZdbGaXt_L|(zB)Jkd0C`r{_YJX}uRh&K!E623G zgdD6C#>!E87)0;LgXR|*;Q?p*nern<+62GQ*nCXCz04-T(^Q0`)DI^inLRS$#Drxi z_v$H=0^aAErEJ>LKTVq`-5e*`I$9Gws}?RZ#Jmjnb$^X@z-I*@P#b3dfv^r9PVx!Tnmvpi&LZY+fZ@vVy1EXjUq$ z0ujzrnLtxItX*{ejn2cmeDb6!0ii}SnWX|QF5S8oZnma!sRB2nrrA0Qlu=gg`NJD4 zCIYjwQcSc5eS|4=2GP?V-S_JlP9!g+nn6U)F_?#RDZG*7@szW?I|Q#_KXVKxU(@Iq#rs{PsQ0_M(pT67P0*==O@J_Sp6IN*Pcc zen%~D$4g{ei%dsqX2*kCN9TKO$9o4VV(UNejscxc$n%a7?@B;N=a8;U*3^5a9$pt* zXve~Nt&vyPqIc)oc<0P|S36JF&Ux1=Z}-Z1(UEt>WM+5yc=z6U_Yz{yHf_(XOwWl; z&v{hOb!E@TdJp)$2ZEsY8(;5t-Ch`TdbeJ0_4*^C%KNn4?v2FJDopu+?vG}2Wl*QmZF#@1G}>%Wb#**n z@AQMCekpW!zTThAR~k%r{~u&eg`V!u_m}(g?dcxB)w3L<)@cYREG|@t?-X2y{zx1r zJAZ$OQ|$(0s9Wy-cMzP|6EgPk*SGKA6n7vl!_#*7zC+aQM$)yM{Fm%WwI9vK6OIAF zX`D*>?JEZJ_qX>SjynNV-{-gT+8Oepe9^;1Ha#hLI{Z2Td2GLlD9g}_B<*-&hZ(N#M0NPIMew{xTRs4R=^g=8oi|7M7t)Jk)B^~Onl z`)wL2{Zz4OX@)XRYS{}8uPI3{Sw96`{yUFtcv!Nz?t0O-tgtPsh{S`aCaJrw3<(uC zueOBIGLByfsWf%BzV*x==+)<>{N@7oxE*xW=Cd6_ht0emAxpKr8{JmY(a4kPCa+GU z(TKt-Tz<7=5U@x1Ft-$*G8K;)`FHkC)3 zm-RJGc^wS|W0jLY8lxf9xa0d%u?*w*+u9F0mdY_NxGvj0Z^{i3V1vhJY95^nEc9qy zCLPz2sB5LYXn}2F{o_~r*Y0?R2ZH}uq|GJjfH}6ZJg#1k-!D6?7YQ?@-z+uyvzn{E z!$#i>P(C3YwW68~J7uHw)89_^tO>a2{K$oVyBWZC_yA1A3N$wUjRm*%M$U<`2K4_- zC%L@O8)^G1^6UEZdFL;qoAu{ixPS(&PYq%GNrOpUNcX6NZd&e5_Z$E^IJQ&Uqp-)R26+)zZI0;GN z=S~z>s)c9-m63m#?R6ncKKV!{lKr@Ab)j6H`6wTWbK3ukl1bcKuoaZhf*fsgh`U%CeZZ^?oz?7VE zbX3;eIVlH;oJyj6RM~GXxj>YhT48idwZ%E5CYqeiqI^uddk)wzKu+&4Ij)80#5F86<(zS! zbs}5JvphQG-hQ8bgH%LDT_!HG=92Ubo}d(XE}!6XnF;#&kOw12C5&A$ z6Uy?Cj}k*AN=Y*tsr*oYHAyATSuq>y{7^`QOf4xvGnbh7P=x$>#J4{>2W)>RW{N47 zwUD0ASWC{j|2X1kT%F8*Q_cKyX{88|UdTmwEE6NFP)dqiDCSWsSG2QMO_yFQm42*H z%cfydvleCFdZ;u+uGAcsUTVmAth$<@{;4#kp48r4?dV&nyDz;AT5GQH?5fniA6xEv zYpxCWtmFr+5jWvI)rHGd8Do#H3<)b&^EX(l*VC+ySwA);4_=sZ+N@4^0UI+e=`00l z*XBZ>nu^3OdEt0zhufc;>tevwwiYt$P3|ct^H=v4GEa@T;a+M=A@5bKG=e8j^ z2IthujU$$4&{Q>ah?+)x2%agI&G_b(*K@}X@--o`jFjp(2%-Q_K(N1_t^@b5 zjLqVoG|e}J)jo3g25(au%}K-4+b*OW%)J zN6k?k1;3o<-s|S$5O!NCl+x6|XICNzUft2z7_P39NqhJF@x7Cl|B^kKqb=z6@#bHK zaL64A5Tgx=-d~38d>BK0vkajT0VB4iOo`rA#?Ue^ql&Q&$)&Oq2(X;V*bL70%kR6S zrCj5NSa*^0QKn=%Kl?0DT)>H}K8Bw#E0fs}#nEy57m<$(T#ye~RNhub(TDo?EQTk0`-L_)6U30k!K-Wy!oF{=OrVo$3&@qeY%a@d8Eq69@aG1 z5NFM;R*%m3Lw9Qz_!pt&IfvuH+tH)F5RpS*$HyU49QQBysViBQx=nTkkE!MA`<(la zW3FewOknr@wBJS+y#r_>b?Tvnw=4d87(f7V>RvbiKM~n{IL8} zL#A&m8@AW%a?Mi<`sSrb9Pj$Jya%XXuh&rUe|k%tENA-H?K@BkFMaskH{pUGQTJER z|Esqo@owj){R~>~y7QRkJL2?zozel{XAE-(_6fhuWr8VZr9NHNYu}a{!H+d@{1+CC z?`!kmrH5QUFj{GOK)!S1`H>5s!wvxlCz?uXKX_p^QQ+tRea zQ!BXk^UCGxeGB#L5g_<^muWyfsnB!3I1PU6==r?y@A=qA#XiaX0>8jUzC5FX!S`QZ zVC(=0u7Gcv0c#R|uc-mA68`tg0Z1$ z%@st_=A9HKiklWRFA+$m8A$&U#DMdciR&-3XCRH|-(ra%9?c-$mA`y1e+6)Y|4wh;qVMrO~VxS3=s(r(M}7|Z41$-A{5gMF}B21f(tR% z47KzOwN48~;tJtcqJj+|RTH9;F`^QM3^Pf?FlY4V*TD&OpbB&43IjXi zgmET@3kijVrG<(2h1zgMBx*(^dqx1^aP8aB<3_?Yb|XY?!(-qg<0UcL(1h?kscJN+ zCP~9rG?>czBP;&#H0DRv;Lw&PdAGoYcX~$E2!--3tfZ$BYiguocC4I>lHjQCSJa`Vq(a_Qjrs z#UA0{-kikTgh#xjMNEf@-eW{&pF}&gMNe|YLrPIYO2xyLhYQ}ueM^s@m5iKU!Ecg` zTGF7-ONeSJjqJb)z)DX52_?{z(h`CqwZanynG-2aqq^D>OCX~|;NoFN!O^G@@hIux zvv3$+lJTtR@$)C>!GW=>TwI|)xz1Mjo;9&V(qopnl0yrU<*DN;3zF~Cl3CDW&pcC> zza?vq#z=uu>}FG{aOlNWldCOLv;aVHP^=1W@=6*|7B@v40F=Q68jhwMNdir&Q_KKV zRc$o()TstisX?Qu`VlFjtI4YAagp$WnJC*7RvcpH}8lL>9OqqZZ7P-9()@t_9oxWP@=2 zb7xf5e8wgy3pAQ|p%uVT9?yIl!IGXHEtw8&m7bQK%Lhv5y-ix#H;y@1QxgiBcx zj@`D*gB$|}bH|-profKnwY(-9ThSwWy6CRz z>ZiJIdUdax=TrKCUGCGFV~w5Lu2Fu6OuTYa9T15@s_QLCy{ zySbiIA5qpB!3A5Dh)ErM>){#OUZcr~>8_C;WD!@8nHFJ@52sv`hgGR~4ivEHsP=u# z&&y0_hDi?dNH2#;ue&HB1XOBLR&!o7(tZ|rYBV!RHG*9;TVVk-gsDBoK~kXo_0Yj@3BjRCDOo`JjzE%uj5D<83X=ic5C zE$I$%ViloofEbskHm6N*O`JB~@m2tI)DC%+S(Z<=V{7DOyH-!Zwpu>l;Jry=0l)IytyR%fQvz*#11*bE9t)up`qYej99~GBB*=gwB*`C$enFZ*I z>a4N?7*YTRxB-J&T|=AxEwEi;Yk(;LU}m#xjyt%ws!PngYX#`lwVKtvb}2M2)yOJ)8eaY(W*-uQ`@Y3e)6}ayK zh3f^=?#rbvmbmcBgzn=l=tYR`{qxoLaaj(1)w?m#2a(+m-qnu{*AC^KkyTkyS=@`Vz8cf5=!;tQ#=NV>@9#;JdV#3XUmxyMuj+eDAro8I@$1@_RJz^{!K%gBC zH9q_VJtBu&!8?_q!ZWI-J?iY;tMN4gft6%CRm{U#3}k`sGqWBE<{1mU^37_mNRAvL z)UF_!ivPwLEu+Ye`@}Zl4vzeY1W6w!q4dhejY^wpH=N9#M4A|6Y%RrY*b8g-;pleA z_V;&4Ui!dn>hf;!ZlSqsrbwPl?VlvAoV+n>;udaB5}a~rXbUHtYK)#@3(jYt=&kei z&5@|BPMg>=o4&3nU)!o_dmXRj@!y2QgZ{)l+```J!m*c}*l?S{J)4;K_G{QmMW3jq zuA21aOs9{GnSg7Nkg6sePm!x=s_aZ_J&&oYELtfqqUD~G^J+q$X#Ae4rsk>=u9^bl zEkK}c^sJgg&1nii$#+}NFVw7Nl58BAn7u3q783KO3cb%Qay8L?7gk3mQ^hpTSfn;i z%-=v&ab3?#Z$?T%P2ckP5Ja>BnP&F5GT$s~*VmWE-|3OE>cwqpe_JgbPc5NcX1_(| z{z#W}MYQT&*GY9R8%!@L!Y}LFtYB2kcxA3AbgzikYu2ZIpgb{$wo3;%qd~&Ngmul*?>NpEDK3Y1WVZddH@CO9 zD)2A{WSZuEwnj3y?KOf#w7GI^ftyBr_`TOie#O&?TtVZGOJ9MuR>F!^` ztcKaFW9F_CA?z{E?3;Y=1?DU}TjplU1m5uME?~@#M{e!Qq+LyKFK_SkWgi{MY?4-P z5JqgzeNUdyZi{$quj_2rUst)U?Fu0I z`EFnG9t~8VIPvY6AuR30>;Od&w(NW6b#6|gv38pd4ms3!(Y0pq`3@mv_t0dg;b(S# zA7&g@?mcUk|JpgL)IMa&UB~e~V7fW`F+8A+UA4>Eb%amM0`3>fo)hns`pJ}d*DOcp z95mFPr}!>40MEd5*ZpiR+ItQx;IEMRF8dJAsPZv%wnn{=rKIL2ni`!dHsm?Ekl~k_s4%MVj@UKlbUm*3x96CAZiuhv068}r z5j!*EbGLL&+q!eF2|XoUB3jtxUS}KwRLCkg`Z5`L*=jNe0E#9-N!KRXVtvt``5=Ev?uwWXE(SP z!`|LW1XP+j1(mpG%erUl-k0F}#}yN67gR^q<7WfESEIaF_qwaP#dW>}8=FvR-4Q9Z z6(@_`m+;${h~BqAsWabQlvgs-=wjzn<5y3=cdxj2wXO#nQOlxMt4vcv1jr8zQNz++ zD?gXF$lj0W-H))T=k1mEhFxPg~S>^4=((K2I-uE@gCq>z3m)>Xl?RUq|cPpYq55d<7|JND+OE#kA z4mg3;*oeFsaWS=n4*bfDz#2)@Vla^bSAUS%8-YWnQSh%&kOj6 zlDT~0zZi58Ph|_mQmGuakPl@`TZucaT&DjVwnr(j7 z+rVPbi8LF-Zm?GUxz+9Vx&1gcSNw1Jz;1loFm(sRktjU&&@XjIA0R}9AnC_aT z%KtCfGtF>0a`VzQ-gx?yHxK{Yv-J|XGHh1Y*Zbq~I!Pv1&u?t~+u{@Qj{g@JiM;?A ztni({ZxmyDK}ejhsn(jlMR@=E$j2I5IQAp^qHn&XS-_1bYJ)Jc91Eies+w|x2)f=@ z>;N<(=B&`p!w0n(uG^8+D82{yl^9_V$%0sjfbatc6oK*oezp|+AVFDF>?lcHHPk2w z?Ep(JLEj6`EX~O4*dUEL%fc+fvZ~x9!?x@ENP#sB0NO}%-wrX$#nm1$OYwh#KgkJ# zkvhx&gN=zF**sZlQV=7Mp_AnxPia<^q;FwSl4f^tn4u;7pX|wvEJNfC!r}5)SPCbc zHA0B_Szbe}#6?xhYWP`orq$S4Sj-H0>fMZ=<~#C0Q& zM*N){W$& zO+#7jp^elZQM5&0X_JXQ&yp@AA7!N|A#HXf)%{X2Rz2oTitfWcT zTg_BMVb<{ZLM8kcRGO*11)oZT)2zwWiM3!7?{LF~5NCUXp0M^ZvEABV`m$n>+UAJ_t zc1_=On??W`vTWl)Sg|kr(Ogg+LbH<1kaNK!Yr)EF#6f9v-~t**YdbauBPR9 z9zKRktjCF`)v8w5x63-lW9PuA9i*yy+t10j?QYUH=3BryaNE`_WEbZ>T1QCtw(s%A z=XR(}E!*?5$}Q=hOGN0h=*9u^XV6Z8Am?JPif_t$Vb+ZQdtnoUm-%s=wAc653+V0o zZFK7A_w!kuGr>cIbPG@74GD*&0Ay2RpLCG6Um#Z3N@wTT1DOgy6UMYpFJpr!lyN7( z)g9(@1g)aS*2;EdK`ZpFm-&*`HA-|-~YEQdG+P{PFM^D$v8#e|a-qa-%-2|B?? z#H3gfmp=D#wy4G^31dStR7eRK&Xa^#860XU#cC` z%C1RSyU{w-{{n@j5gt-bvq`xa)n#2Jo%qQ%U?2cQ(w?A;xz9tVrQsg*d+m#|Qig;v z%@tUCT@XHdUsz@c7c!wl%?0~Y=xNqr^b98pc}hG9AhaxU`Ra_ejPK@rysapw$0WtC z!WH65ouxhxk6sw?C<2G(0^V?_EU-1v?fBSOITN=g+`lXTg=kVc3@nwCk5eF-d4R+w zDjR_Z=|TmJww2-68N%V7Lvg0JZim>r2p?K*4#BWzsM`lPYE?)sXRe^MJeAvRqp%L2 z4P+*o8VW^e2sx1fn_s&v>r}WY^p)6KhCx&vJ$3#XMzGNh1EpQwCf8>c*w+hG*~-&O z6czSi)Z8;s!evZWl(yM6T3q6*i(@u-#if#>Vo=H89xW{jE;bfM*jj*+*HYF0RjZQm zHCDfG>}?QP*FKyaT00kREzj3=wtACVplzzn&Ab&> z@HATc5Uc(0p)d}cUh{{s!X50xTW)yNJGrTDopBbmvTarSf0SGcj=t~agum2QMA(ND zN@)JuhAt30FSHxwg`DTG!3h6Vy@z#PAHoMx^$%OT0g5y1e0()qldpYHQH*+T@sxfu zlSbuJ$X!rNwn?Tq=IDaS|nXO1{g zG14=b*Z_k^Ux-^jv>$0G6mF|KH+E$3R!8Y|t!wZ)O(XJ-B(33?4w z>uOz>#)NKb@lMSctKe3$ZgOk#0i=zB+VU1&97&5X#QZhzHW@G88=bVQtp`b#3Cn3w zO<*HV&!qJsriG5UD>ds*GlZVmu>`T{tJeC@%WI4L3uRKeXVQ!|)j&XuHuC|~%3JJ7 zH?v0{Ow`dpYJi6I#FtF=#nsjcgonJJjg(s$cFbXL2~%2!vIfr9_WaPc*XX#iubc9+ z3t8?o7=nGS-TY)kHb=LO#DnQX;u%!j>j0RCv)v@xF=&fb2Y2rNap=|sft*QJ0MJr4 z5P1z*ubrsvMmi0{Ct}}=zSW{u;P2;jkaSPsPVANn1-bgT{iAs@ZKzu#7gm+~Ak+FA z9S7ic>yCHzw2$~h%yYLfyU>@iP3K0q2g7RRPst-GFAi!lP_(jbl-xMEgv zsxI^!_H0>7byth^VabDqRq^tvvr3@#LQ~{xzvYL_jG*O}vAVvTzE*w$9NjeSv&z*7?qhM4ud9H+Vf0^~ z?~P(w$6ZdupYRuMWVJcCEQhUoMG#7FG&IHwI65mHB{Y4TpI8Pr~6%{yl&o3=L zSmhq5tseNP9*OfFNwB=gLqrE+eiX27%zwRzPK@Jyy&wMs?>)PbiU{r+v5*I=E)HtX zD+Mu*dcPk9b?*89OtnQnG!RvD=FH{yW&tj}vbq;*{!&*IaaNHr_f;nXsRq3MLO26L z*Xt0D`si`VhOKZ3mr58=;9NMH1PGf5j0f?BoBomvjvBPY4RoMFR}4H3@PPj__~_$+ z%hCl<^Nn)|It{Y12nPrLMf&Z1D{$(IivmP;Pa!4XkAO0@%Pvmz2yITBHR8g^M1);dD> zsmkBW8a9d^HijF#`^z!H4bV^m+@grWI&r~n4rgZyJ{h6mC-$pI4t}q5pkEE^eznwc zBP79+Siljfq4rrYi~c&Sqs74;>>oVs=;NpmqZ1zSLFF*j=1~JymOCBc8&Pv;q4xj7 z?j0Ya6SAsZhZe(ytJCrrd&U{nGlrM@>>*z$Hm_oHzG$8NY^Ik2lz5Jwa@TKS^AIZ0 zb`bYa;nY(YN%TA6r&#kfEr`)nS8_Ftr&n`RM$_zcG;RwD9QSiaYDjQhrPXPsmlp#1 zI4kNWXbBHTdA6E%PykKLqav2X^~~G?AC1#EB#IrP4$8b}TY~diGz&rEk6hKrO5I;Y z-RsOW_}1MIjlF{h3?CUZUD^CI7J?%W)J;c|-Ahu7UW~(@)y+$SP0iveLu2Zl6Pkvd z#nk!vL8O5^mAlM^iQY_5!8OZF42Ma5GvG3C%Jr!<48WzzJ}>3zdF6?f=uwDZ8R*36 zW$V84py{8=X%J>wsNkOU;>HS|uFBx4*0HW?meEu%&T%EN!%ES69H}V|sgFTHH0FNX z;<5gV5nQ;b%PC6C&&g0{f>mbvSEtFFi`r1-NsQ>p5zR5QVy-WR*~`M&4{o{FsxboZ zsQ~ZJ`mFYnPp(N^@u@C~U*Nu68wL#LgXCzX$ z(Yz}LQxC>+R||sAQL`vf-EBORuiA2-QG&N!K!S3OepKTIXG%Qk7Qrj;$>##afkwqL z2SpOJ*^#H=1m+o6&kARjnONzvDw@I*XL=%<0etR(e1VC!!MSCL@v6iupM5Iwry9B` zd7`F9ZkqDeexZuwaqeKMbZbf90;X`n#x^76-lQghltyadCBBdWZ|8aAs$q*KG-j3v z*LP9p^JwK~(I;>*wP`u#Wn@)23dP|xlcImE{|4NHi>ZWh_28HFhhr65mgNcC1hiF3 zD0`!&NCk~lYaCQfVwNpx;5A9-45#t-msAaoRq2RSt$k1}(bP0Z)e@Ri?cuX*RaR|G z)TlmGotKjwQdS*HR;#(y+)XlEmRDVY$7+clYTn%_+Ec^Um8*d{t3lmkUccA82u1e< z=6pide78sabkrI5=XviHatoK1sPPwSct{Dt3%@9 z$dhJs1^>-S(kN)x$j;X=_V}wCvzAu^6RERK-=W?R-FZb)u9(TCKFr|6SpK8GT*A6m zA@e5%Z$n>#D$!jd=L*Nix(B3*3f42X_IMm-8c;q|lex6`UARQPxFp&#kk>3m#Us%T zi=Qsd&`{F@kF3@Gd!zR^Oo0psNSCIib-cf%c)ZL)zcgO{x$K6Q;D`+GMKU&p&(^!P zVtN1M3*6NFFKH%|sZp0@CR!yR)wd#r$odi~d=+hkI`vk+`FfoDdajSmr()l>aUaBU zejVw2_p$ue@U$1|Jg*J|LQLP;rw-J&{Js&+o{DnB?=9czcvG5IH!qz;ijA2=^-f{M z4_LWe(1q6|#rtciPie(F8@WfH+V||O+mQbGkje3s8Mwibpy4ioUCCK)_Q%G0w1cF%DFPWHWY#7CC zk5pHNzG&Hwz1xi~d91IGv`&t+eIw<1cE0qF^<0njM|QClnspJ-v_(yIR8RP1v8dQi z(veThAx=yq2l7wsQ%@XxO$=4r>_Sm(Rn2T>OzlL?lKz~! zlbw2$;;H+Z@c=bWy-iPLT~EE(v^^orJxWcjUd#sOPJ?z%5pGTcA)o^g&cYx}15MAo zCCr0c&0TfQBFNCfPt3zqbs|>Gi#yK}YR@9j2CpTMr*K%EpU+}lErNfaQ|=&g<_IUY zo+rkN=#m|$K&+;|oTt&PrK@tZ7;$K(9u%62WvgCf&73FIE+73hp-jDC&OB079m*TA z%y*Uc!fzcb;*rcfVv(^d)xBth_?M$A_J(|1Pq$L-YE{FhRGWL=jBwmpdtpIx*~Mlx z^zTx#^jHx6xW)CPP8fd684c+&Ti~)@#T0EYaRW#w9PMS@?rY`De7X(BT6NV~VahR3 zb6%Lv1k?%1J?>Y^rWFvDiQEM3%JzxOi9xucrbbw~To;XuMjuPTBUrN1oK}cQ5Ybf6 zu-?v9q=B|gpuL%`vYv4LQ;>U^vYd9ZE!4)bL}|UWef>AS()J2M^3Q?cWvY-|O#W}h zbO@N+>sT8BR;HfK?XKtX`%vYL&|6#Ai++5R*&7Q074x%(Br3q56bbLsVhefVE80vfbxUNu*|`<@`~me34(Gxuz3MO_&k zxX^)m_oGWNE5o#dU~h7r{nJBDp=Lje#WFo_KX<GYl>Ef@0?r&!s+3%7^c?f%4L;>_c=KExIo~0o}}ji{Ocs4IhvEL39+7 z*z8PEZSe-p6K{Ke@)PUpNx)Gzyk257f9UbK31n0BVsQogQ%aiwA|3dAd z>Z3;8>7=a)`%hvz9(7yOBTVPtu9Wf1SQ`WOiRtmbw)LU4BO({izni_7lymHUF-YGE{BNarAP;E$?f#PYuM}S1oA~rtEG#uSV&!S zz^Z$oUvW>WMd!=qFKhRrz_-M>x13CO3j7P^#)-d`$HBAGv1#uyvu;6dg=Cm(a4KMB2#QeMpa$WaN(O6&4Z^mCfQ-6H= z*nMe!xyQJEYcaQK!}zvCX044ztk?N$=pp&|nQfc-0$Z$x>ON3Lya#vnydQlS8sKr5 zP7l?7rXoGJc1f)&(vbKr@^*bZz^>Z-*nh=%@kV?L=Im^NK)JnvBjcLa{~ZW|L1EH9 zt0x=^LncioZShDplg;J! zaCQDjK9|q0his$vR6buUoa z&U_i>_XU&1YAMaGP|f92?RJ;@>&5ltYu#?2KO`)j^jrP@P&fv)?UeiNW(U>1gpJiZ z)5%mO`yy_qG!))R2Sy!9a+f|2!ZE6kfuhIL{ z$vU~8p6{=>*UQ^kmIo*5j5hp$-`M3Ej?k(QxmIU682FZrf*gCn$XsvvF4H2-n~r#7 zXN2Jdk(fjg#F^@aV$^rgS$ZPmY)H7!U ziDFb4BuP?S>mh z6P%|ea%AY_sVWNDI2JWpc$5( z=cT_|-z$pqBeAI}iZZd0Qb062sj4D~L@BFMFF2}Veg1n86m}eRR@HW6cb5A%z+9SF z;1d2pY#gTo&@@eRebO|~OLEh;ENf<684u@n*0gRre%7?1mB8RdEqSo+)SvGRS?OGK z!lD9tCUEGxA2+n>bo;p2@homXw3OQSU~n0L{a`rS3-_UTLl#oFDwDU4&6zuS6VZ*-si(K^AGUrq3w{4@B6vUg_jH`( z*Ygf4MZovT>hRW*=j z`tK(Qh2Sqm`#|*SzkEpnA#LkDF?a|e6v_us17(6pmvo?vD1@*U z>_er9_hB{K2Jjl=!}zWW%C*x6dzb6O*;t5><2WdA5fW_py@~!5Pz+PRh=t4GY9cq4 z3)4C}M1>g;O~|s-T;#xcEAbGc&6kg`U=KxFc^#Udo3TAsBZTT+5#isKkMf*c`YKOI z;2o!Df-NifS@DqIAXSV#bO0OTi*R%~h%uzz zvl>ckU@5gWwp1jFl}nMH>w7SXNmi49*o&*JB~Jz)J){orN18bX#pz-Prx*3Zi-qHYS(OAF*jkOs1lRQoA#jCCyc!I#()j&$3L= zB7%Xq&p4$&8=vxCuA}-89p}7gPce&uk@|d~BtxK?jEGB23RpH3R5?>jw7-jn$2u93 zSeyvuT9C!y2N(6gB``1+D#RfK7tef|3l>J;B-1q!Q;{M`Rd7ycpigCT7?`sY!bmM= zgr;zQSFlGw&AFl`165C=qnIK*m)ti{@-CJVlpH%|+Pj1^y5T5P>pGV_6kT$J6E4(X zKW0l9Tq;kCFI3JuR9a>#D{Qwdd1^jpiiuJxu6ZbQkzgnkJ)5$S;LXm}GctW8Q0w`g z6=+2qrBY&@8wjUmjHFwT<@skt||*qGZ`zH6kT4o4&unS|o6u*l=0#_h0O5+~rT$-}r* zy%&2?r{dIIDF_hGBRjkahTwYF#( z#%Mk7O|dp*LK=wXTxc7O9aGIVHsDjtzr;hX-YR-f8!9!IrDMuPn6_(pC&e1L6{X9x z?q;B&mD{|Rtj6bJ!=}xDDVE!+c?GRf^!mABSV~Q=>;s_jO`lm*V>)=3vUCgcEG*1( zw%7F}Trccrm`<``VGCdhJ+7y+tBRX5U;x3LCY#^BtRk zcAmYJ6`K_O)GFPzUvn4CoGk$}OcqBCa~kA!vJ32KA7_BTK(JaHfWQ-Cb<>+rsC_DC z#xtfaL*-zll+B-TydbK3oN=jru0HHa$fDs|tMHXj(d~|q;`dry%(V~k<-M@Y1D^ep zV7qs8^0{=a<8JLnc&&`$y)h0roKJ{->96X(D+E8B&6YBg;9GSzrvLnN@B2C~g`aSQ z@Kpp==P~Hi6ZJUqRYWECJ|Bf2nFh(5!&dh()6^51C&rs2Dfh8Hi62rH_MN6$_qp{<7<&8!#PD+Wx7l=DUv?6q0AoxZR7DLirdVVH{$gBU~v z-beL*9r5?RFUA3%t9rk${CYnR5r5vx@<_MKUKR=KzG-BBKK^nE@Q4#gz3rMA?*g&L zzG(@P1x9by^FZmwAMy4A{^K!L#I_o(FCKW7h$>!0xch3bR>3*FNLa_ED8h=6ocye7^#Shr?whx$N~S2| zMG9w4z9pp2;0_Y-qr7gk>X22dW< zR;+SdgrMpkWSSTT@Diu$6XGchlkcocL>p4|5Hf-u{$nArx!%M%&=-j}#3U1EVha|5 z38oDl3jIY)e^V&_VTgTl@Q;Z^GM7XcW|V28pnb0Z2yL8$D=B>i&wBBjuaLMAZ(oU0 zOIhSVZsU+IXSs@&h=)r{z7&IhdLy}F*^`%)Q&)|zz_5mPkxkM>MU+&joY<(Dn0Mxo zd*;wPp-Anbs1wUj9j1hsOOzjiC{ejUx^*UEiNqPtSmXrwS2V*=DrQL>`!Fn{Ai_Xh z)Q1EcXvlDqA@O0-mQidFYFu(|VxeQKKVV>#yJp!?@bAKq7UD0QZmGm|iK%R=iRekV z1~x5vQP6ln<+;8nQ;{8qk+vZOfnlQR))5NRK1pN=vFtH>Ew&${0e?+?Gplzb`T8W5&ro;`h zk!h*^1G1Ma$v=)#Q&AF$1v8PrBX7wS$(d6)A#7cIGA0RA979uK=c5V=l#k|OD}+DN zq2$q1rE%+~oDgNQi6xGOB`z1GA(}-1opRL?Vs)S)MOa`tx2JiSrcwCHs+uRMeJTZM zE`_o^>Apjm78iszm$_CnxtBem5W*Rzs;LiIX}$}#`HVq{2c`+oTq5_tn20!@%tDXL z6f3h(NVGV9Cm*}B%&St>mn=9SGB>cZSh$ZY7UDO-2*KYIktz$c%I{1iQ_{No;->ix zO-(g5UQ+c03>7v~l9TfsNtK3fN<}UWULlo82+JJPa^GP!rLl6Y1#>sH;h0oP`FIIA zWqB*1c~MhkM_hk&U#jxZ%JNvMiqy)AT&hZ6%Tl^>@p#ITkD&__Vq}X`4W{viZK~Rn z%Gw*Mx|hm2pk>u^`QY(x6}tF+O(o1c5wNGBGJQok2>sGixUw1MviSu`pcSiGm$1p! zs>!jcqTRCfM7Twfx+AtK2HC2;GrG-{8c=J6#%t9n8`hCZ-91AMQ)tz-A_};v0z6a+ z_*?ZX1b44c_ajuh12+>TSQ<%Z%rI%KVfLsl!UR`ifZA4r(r&f<|U=70TrgfT5K2T3lRZk^S zPsY8Rgd3P17517ruTGgD`|61{0{!ogbvMiTK@yL=|i|aL959mqtc(N^rj)y zJUL?ZE!W4jDW9o0xuEQsQ)mD0-N7xJjy5G9((W|}A#nkx^S8P#7O5`}D1RmbiGd(0S8C>Hx0 zstZIAQqf&XT-UU<)KZTeECWOLM{Grwu6;(xeLyKKBq@Cx%@_+aeH^J6Pip@e+W;J| z2bpgEa?&Z&kjh>ZRgV~*6xNWq(yge@wiE^>BKC<@;^-Dnconx6!kyqr*m z@RgCun$=)KoP8XgL0F%^ESh9^q2miu9if<(6#|g+16(-BQ(qz|tqz znk7Tn@1a-Rs#e%B-0lO>gC9qzgEx#bcTUzTDU@DF@*Hc!YwyAu4`s1SWIHPgMb{O{ z%v2iBvsUWlIuNZmO zlsHUa!=s#%#yucOF)=EXk&oW0A~1G4*WC&?{84o1x+sr-y2XU8&Am5?HwE|nAO(e_ zFkqwfdw94jTm$;zTlj^l7eH4Sju_C}nYP0@e&9Mn64&}WXCDyZKJkeY+u40NE{Eb9 z{y8M$q;Eh_q9?I(jF`FAXeCY&A*X6POG0Ce0^aHPH&N~W{s{a_Bh^4tb_rYwrX4Ma zLpR+EC1K7=79wWIt!WU9Gp0tMFB*3+M{i10qy(9?eb^|wT4=xltN+JizoO8TPUhI2 zOZgRJuTy>Agl3u0PwAO+m%T&D`Ew3igrmIBtYWDK51?#_Smy@IDiC_mjIha(eV}5` zrygbMF>R7pr;^jJl$N+QrV1-7rBXF(QMF@L%d7lVR4rjD^W-HOxu1Y%S72#@|Rp}tU=sfDH|GU)tY%z4x)Bi_p z!0&3{rgLz^T20q#LjH2W>e?X0W+wJ>hUeN~_+k>rwr}xL<;rI1^%4{CQWe>1mE^jS z!B$erW>e)l(!f^I(`q}|ddkXb@(Es{9c7Qm?tszeK)~)u-sVXE|B*e}oyFRm<=9>R zwdwx6$WKKL8nU~&z4qft33$HBg1e!wwt8&7O!~V)M!w3DNU}e&dEd5f`Lnk+vdhN5 z3Va3m-m?3>w*7y}o&+3$xh4Bknc}lMBG~fSRYUP zJHz;(Z&inH(|cMSXLg%Mc5g@aDre4aN7m_k_GL%TBWLa{Xa1{4{!d3f23G+=XCC=S zK6PgSGgl!!S24S1F@I;V8dr&4XOY=Qu~lb@6IZDnSNSU^$b_D>IgONhM+JEY&zZZs zok#H-2L|Xn4{l!sN}u!}5WeINzg6MD$szu?&XC6sU>yO7KNxo?4xmA*qmiDwi5<{{ z^H#1TT+v1unEO!|l-EqonF;_4J0)}jxP||KWf1tMn~BsCzt^GwQmVWH$i3>D0D!X3 zWH7I;Teoh0?w(UX&#hMo*q$rqQ6Y9^%cocBa#Bl^rw^c0dasQe+rT7vJI-)g5hqAE zXCfE~=or{AfV2LTQ>OY;y4+)Q5_}$#w;RQ46cI2#=&?B2F%JuVSGnsz@s$aaT3pEThHa|=fpqo36$oEuzNxE&&fKssY#yj#V`K9eXi7e z9RwlicD}<^d}nSw59IvoR=}eo-!mn?I%2>htdC!n?*g&UI?m6tmEQy8_hne`Tbv(Y zbg=jHlUFpP^^~{rS5GT3&*XK_OzU{u513kV#|*Wv+7Zu%8~>vezrfe0+g@K^AOsQ- z359)uKo|lJpZ1#lL4PD73KLH_Fu_PD5S`sJ848(rIFO9lRkeheD@8Jc0O-vu(-%k|!3rzlvekkaHj*3J=K38z;H@y^}1e1}; z1Q8|uRCMCguh~)&?rIwQ7P0v{_MjbauE(?SY@8<5ZY{UltzIq2Q+V%o``wWU0{R|p zkH@3g1TixNpHAn~l?uJO9v!dOt3IEJ94>tS?YjGol(H&(tGD8d;U;z(Il90a!QRg0 z-aJ2`-_Or0u_fg%XxzCzP$Y0m>U?lyYkv3u=1Mx-m z#*cF?hz`v2C4bnF=UdQKND_omJu2r%a2%!-M)5qZ9EQusvMkFVcVHF8%V>nD`U`26 zBB|?QLFFeXE2u6iDqv(5q&~QQ^6xwh?Bi_=`qu~qIi;V31(MmI%=haSP zukF>h6i=PjakD)4{gpkRpfL{<|Bz&q=fP5W=H^AywC8dlMwPAc-O#fl8DO2V?`Pt# zu27fcC1{tIloYnlLBQ2*mQ~c^JXKayld@e_$Z|CQOo(_~FR!+Nz_&^n^bVcY^@9M- z;R!~lHj@Fj^-(Vx7TrbY8x{>UY@1ds*QuL!HSlg)4&9^}TMqNI>^ghV)~nlYWr=@w z{{CPm&kOnePxgcke46+Bb`e{E;6#I(Rz{Ll-w(mEUE2?{ac->odaGGGpbnc>SEq{# zSv!mqM9?@&kQkZQ{etUOKTdgv#oS9nN=7}&(5cNh$+DTjI?Zvp$vDmPLBKvM2%*b7 zD~gfDJ}*hpUFadFG}XAMm|s}ChwooqT))FI@o0VbWw@D>&Lb)J_r^tPW@4E%In)-3Y2Up5?ibzZkTcDG-50)BMf z_96&&-VPG@b>ELN^mg7)3jBQE4ev)@A1^gtxXt=1EFtmTrGNOm@4CtLz8*&92)>_Z z?RLLjm)-b%-`30YfFGx`1V7)mx4Xcf=hI#g(0D&^RQ+F&=>p(%cmD7!dthj1eNaO2 z0jSCPzsb`D;cV}`vw}1y>M;gsc_fpnWB_ra3ZM^H-lwKm?d%#fy(K{gfkK4jj9 zlCcm?%3N$VWo__~u`x}`+I%u)@2?Qm;8V;vHlCzyFcsoOOG>{sKIPuVl5?L?%6s_*G?0Z2&DF(Bqh2%VI77ojDhTj#>b#Vh;RAI3XXw=j?M>e8|VBiSB&B zm`1x4#?6PV7$2)#Oo~Uzt6(XYQkq;s?P4Ky>(Pd<%TmPpTZ;eJi8RLr7(UOlgol#8WO!H2Sy=2EE&-lXW_c?k;BZ1Kn4g*dc6qSv3l)yCIU z5^^7kEd$OqHYS%^+t~lS6BjG7hAE4I?-F@|&1I!ckUT?@s{IHn_}=gqdaqmxVRUST zs4g@{Xq)O|e5#EpF;^y(S_-vC7eOx1S4s8Qow4}0)gSd?d=Q(6%ayJm!L&A-``DZ9 z6RE9DEwoyvl8dt!kF{|N=NMrhi~Y#?1Oy$UyugqBxJG3E^8T0$rxF;QbJ4WU#THwa zhAidEo7T#L=}K);*sfK&w06FPQIErdxTDk-JaG4Gu{1LhL5OkZqYj&k=pn8LT)W=a znrpvrt=TQdw#x39CDRzg@j*Iuf@{)C5CnNdP+W|G?|6HS{e9gbTg)DeU^SB%@Sbne z)S)}7JRf#(d}O)Q;Z&W5D6Qyq%w0PG_)NK*2w-_X#;yKO>Yc-Jz!og*i*p_8PM7^! z?MLis&!dozUl`;u2w3`rlJ1eejkQ`SJW>EdK)k;{h=7s(Huu)AEu%5P);s;p%dI?5 zMsYD*IS!R<9diiEh(iz4?7A#7&dZEhuNTvpCSbK3t{H1rFZH$kB_qi5191mX-i|j} zO4SP$tA^}5Cs}25l(Y!5S6X&fS@pD5+UsN7_2j9nOwm%ls*}g{rn$<+?Sj0?bE%@# zu3SgvVs-mtS$W>Yw+h#qdJ=sy;N&`$a{UTl#XyHj}2&X$AbBDPPK{JtxS~W?!z`mRf_iIjf?goE<58j z13WhcG1gJvPW$Ad&2AEG*2$o&MFVUtP#TQjtW8_lDfBn@30Spj3mB$AGb!Kw33^Ht zajId~zM$DHC*JJ2=|Ol2z6&>T!i621;d0B(bA1|lq`n(bE}+MyN>1lmUhi`)1~nij{4RU(VNYG^?PiAR#ES>_V1=yFi<)jB>QeK#o~&cc0?%Wt46vHQpOeh! zV;L=le_X%9Q=x|7IU2^d+%D@etzhTme&BuEyyY>K9Mf-2fPM!4hihKL%h`{_=OuLe zCF{BDz(uZPJ0FPOH4410De}5{BLj|{f193WdHIgj^^|21@HxZ&+>g33ZRYtIDu88w zF|+;j&eGd|oOeIFUU`iGV*$Vre)qc(-Wy&bUw7hH+s9J+j#Cl4WxCmWiaHQ}+Xwu( zM?<0BSBO8=HTcR=1U;5Nu3@Y4HXyw4 zV3hVxP=AJx7(m4k9xvkW`D$E`>JLfc7Tsf>9^yfsr$HG-df^HjtcshX1*kn0`x?`;x4C8@oY0m;UUtd0Vpa zKB0Y+p8C{u*fF0+n;%8ZKtwM={0>+6j%@gfO-N~FKyDa?1&{!3Pv`ikP>u;Vs*x5h z1eNOH?`I-=cZPqM=s|vFf1Tdxpe7vd$uH8)!5fJkLLr@y$*-8o;&;a&UC$#SLL+A& zd679#2+y7B%MXTH{e?t^$dHW|vW_^qyzrlccCm-Hx|@#ub7O4}wM|2qHFHg*2>m*F zWh)PJX-$|BPe{%L+i*uBvoM?LK)^eS_3JnGG5x)$Wwm)?*OVj~8X^H+JYGfh&)q$K zzyrB~7=gxu6YwK}g34iCRAIC06xk~db+PWtlo1Pw3bSGXvjG{aiHWLXp;5Jw;(3I$ z37iZbo_x9yCxi))H}=GviDH|H_CA54U(qgBQLqy(%a@KG5t+0~VoNbGS~8LT$C2T8 z6GO}e^(nG*4|VexGTrV2BOWso;bPhm6Jtp!-EXp&W=Cd#BXwOOGk+7a;3Bhx6AL8_ zBdwCjkYWyu2@~lfs}3`pfm1vcGph;&^G^bU%OZn^6T43ndw>&z!Xg{BDeG+^qX{#o znG$D)6DO8LDXv6Y_#<0FO$Lh+O9L}YOA|{|5_j7o3jl?u8@ZoDjH_(XFj|Q|evvb) ziFf@G$h+IfHtVEk|48Te$QQ)SfA7Tq+{FJA&BJZQS3$Bzw z=)04sNwcWMlW3GVhnBN~D2o-GvPb}`NC=C#N~DMzi-ImoKZo+a3}=a)C!s7<$-L%& z7?NUfs0yB_U6Rh?9m(Q=C#gpyu7q<*YBCAD1<`p_v1JySb!VB93CZ!LRCFiVI47y@ zC)s`$x%=jjXck%03a;;SuA*c~$QJpsCHWE-1?Xjo{Uy0F5~+Iw-e+gU*JMRnR*E4Y zOCIjC;4jv)t0o!2Wto32$|5bwljRER&-{N?6scQO=$}<0n&p(9`KM47FjN$5Sk(|+ z)ErXOjNnwvQutMuWer-?b)MA$%Bn#vCR}KBe9OuODas|RniZ@v0WKN=C1M)O>K$kr z-DpfHXjWzYImtOkH{o#z(IvnK&3JM6)p5ce^8WL^m4rP&U_iHdW9~dAz7o zL`Vf=`Wo6>RuczmrSnPyixv$ZDf!R%>zx{OMv5=g$TxLqv#18N`pSR#MmS z9j+kruBOu~E)4a?>#8>Y6?kejM#rwEq;s|^u69aPdIc*qZ>%>Us{f@oBKR~@=v8}2 z3<(gT z209o9b(a=Dsx(I`hTCjUGcSK!FznjcY`JX=hg<*Lu9%0ox&3M|{IOf|XLqY=Jq~4e zKV5OpOY@Lj#sQq$v9SzjJC3ifRzI0C5v~S(I5(A={AURCG`aIL3 zUCRp{xA_LTV(2NLPr8|R)A*jE`yr)m?}YiS+Sne_`oz7OuR|`Ou6-uATC6_@c&WJd z|5q%oQn<#%g|mB=uzR++dDyXgUaAHaum>^E7`i0}3#ucvu-i$Md3dN9si@m>qlfBX zdda!F*|mFlwA*Q{@KC4Ig0hpatHBVu-7uv&MA$iKxJCR+bIO@}i^hyldbN*Gch*RA zj%yDmcZ&jhi%?mOEL)4z!f+OG(=U^E8hvwF$8^n!3=Db;lu0%IoeJz?ta}K`mP?ln`-@oxmw#6)bJ9AW$%U3p-ZSy)59Ll4;1nyelsI|OUz(PV%JC_ zY~S5$4?J!sf8hQ>_D$n?N$tdy2 zF3ZRsd@^QP&KyNEMWhi*TTf5o%-z+<*!ReVhRQBb&7Sngo6g9y5Kp1R%IfaOg7(aZ z&y2ZWH+k;J!`jHh$@Bo>3a4GqrR>b5&CF%g%-v)yz;P|W`zRv7E_Nd?q*l*|{U}D{ zDpBwh<|0rbTDx%gbbMPz!0-8$ppG!t;WC7B)8$QDt0UwQLTUn8U6ksfZ{@C6(;)k~1MoNQmDID*{*#uPtg8nvzu457XWXSt)Ks;pYl&{JO=1{ zRx7=B^Wx#47fv5M?f^CVfDim29*>*i*ASBTAa7lt-ecP{YrWVw)umWZTwqUBmfu+# zMAFve zahZ7xt`ZesY0kI7d1T>4Zw>QzRM2Z%kG}be&FRW-_^M9g;`E01w`=E$7Yj`(K`NM-1n-6`p&M; zmX`L8!q;FH-ew5iZ5ZB7Qg?He&uU%HwiEl-A@HVUdtD^^j&^IU?WI*kb{i|h%@bq$ zd1vDq|85*l+iz`8kpD@m{Ly=A`)d=Vd)A=Wuj$J-MSB|h zdmL70@>YA=D{pE)?8Ogv?izP0%(w>s(mVa^JyWpt9K!Dh;F*cR{Y?9r zit(GY>Get90)80ve&yu7&i8(idikZ}uc&M<@A9u4^8?R!zpn{^w|>CKUf_N258n6H zuK^wI0B}fbn((_lLGb%KR`0X9{ea-#zbKk1{`iZ6pmI`?v?CdDC*1I)Zkfj$PXrOl zAS}HhlT1X@P>ys-D3Q%15a@+AuP>O5CF9tb;$|+I$t6ff>0VJTQc5I==%@-`D4Hxp z3b7Iif6QOVq$ruu!GESukCjVX3Hex|)^4>sp9&4T<>T>%qP&8-Lvqyb^#{Y^@I`Yp z91KU}aQnh>HXileBkVbafq-ERk}xR_f3G)&kZln+x@|0 z62BcE@5l4SW|QA7AK%ye!==+`6?@Zm=hy4!E#jUZXzj78KLkSfUH}Z)*xvwHzBT>e zKU5Se!N|Ji2BB})DjD3qG7yI0M6u$A5oCO-c&7OMU~vL8oohs9j6D>@(QGT>#4%hm zV}~)^A8SUjf3n>Y?Mt ziN>)JrDc&v0GN*-Y zF1*^#lZngPo)?&_x&a8OtNIc2sH=w3evO>$7hWm7<~dnvo0cVAE1TABjY^fua^Fjv z_PtnY+m54LE8EU9s&-4gjcFLWu7?>d!y2p3h}-Uu)(-kC;K`(2-_Hx|T^}e$G($fO zL05f00{N8v(3Iv0O$j6!3Xj(`@>A z2W_(z5c7H6c{=kcX1}ZLb~k`%mp-e2VpioeOqs_sFKic@H8;5%O7gry5XZZ; zVK)2yvg3xxXP2b5?eeah6$gC3Fyi%`)VL0w|CAWM{rhDrld^L2@jCMZ1it>%?0$#1 zgVX5W-Jo~)|3Yx39UqHU1s8;rthZye98Y8^BEf&Jalj4EK17BB4j@L>2N9C&L-Cpq z5Xacb=1k(AX=8F>PSl66cpIE*#7ohT5F%!@k_kB^L{a^T?bdmGXx-9fFR}{?r7xVFf&c(YyWUO+Q)5(RXCE%=TrZnvd z2(-?n&^44Yc9wq~WSz?ndCYj-k~5aeOPTmf%y_DT`{5^0f&>&V6kx<#JAy zJA_p#WT7)bpUu>MT}ak@vR3<9o_7RNDTCk&lnQhlO5eP7+Cnq=)g2CVvonvsQ(9zNgn|@{`y$N2=uBB~rPW#@oHpIqC zs|aa7QlWjQ#l}+ab9gs*zL=`!MzSVq+v=pO9?|kjJFrr9$(p3ufwS5ejT)l{e8D%$ z2lg5?Ycz=>gv_)c@9OMw`&Fpbxk^gM`!*`|GiSK=IpkJP?EnogH<-#Ughp;E@z2IR zJGFksrP1!F&QtBMHKuR17i_aGQSA%>))qEcrbKDFaxH>SMq9iGT(>2by;*spa+fV# z*_Y8pigriKfhyqStIh`-wTuOQ)1jBYlLs&M}Ed6Ok5p)rZsOA!PwfRD3VR;$;_` z(-lq37aUhlU~O=nGLii+%&ekwjjuLqb}EN2_ycpgk9}i`QdHxHHolPvfHSuDb=ep zn!Ysmq8_HMeYxWRR2{uQ)TEU$ z#;EI9_P!+1?aN3W00}{dYZDgRY$!Xc^)zevwWe;le*5>nIL(uDYVZ}ck z?yNGdZn{~Id5P-Lf~dFE`juzNiw7s8tXk`Y@27fJX-jac?Xy1o!t!#P>-yQ6Vfp83 z`G}3?{j5^&0D1#m!a{!TE8H5b#SkV0+e)*%OdD}nI6{~7B}_?dGn!{O+82d-|un)z)vXav?5g{gXUPnUEgG%>;7@bwkc-m7)fd(T7QUn!^)TOP;#lq|DWPo%ecO$!;S#V0~6=@F~;gSj%i z^+UbQz_KJ!1`}5#A=Ob*_Fr$cgC6tmbo7UR!y;63L@{?nRp(1IRl=h9+le8Ct?r_G z8W22WEjr`}Gz+{Ja#dAPrczh28x8a;Q=x4qc2ZNJHV;BbQlWPzs~7WXI}PH63T{>7 z#0*yw!3-2L50-GJBXtjyITHtY^Cuz=`NI*SA|9e<9%4!ofHoF_z7|50;w4EDDlQ&s zWFA^H5G-3B3Va3);c^dRgbK4&4|2i`v!e)e5f7sR_kSM}5;_ZOfehz=3u6!tHZc!3 z3l9$~53e-TxB*qLf{LgMv{7&OZ+Em$P7g^hkH{E{SZfN=g^JX}j67Ee4`*S60JV%N zkBk_LWK9W8fQpJw2y``Zyu4;hE zjAH7IyP{Y9=&fkLmHDEJ+a9^T7P%SDU56R9+m4wu#Z*zHstxk$fY}yt zyB2W|756BPlSdKx$`ScSL0iH>B?IX!hao(nYANX!`QIyaBRu}|FlKKoet0pox!uFo z#51!D=*d9gV;Sm!P8p5!9)*V$jlUlCwXDG3)D@qb!QMXJ?!s?B+-9dw!lWtx*jnu|r6TSS^i zMk?ZaR3d6(!D~Xmds@(VLZC)^@H?58I3w6tddzux9CStkWk!-jMv6s7T0}-h2ewKD zC2=}iE>>y*XKK;r%$o7cy7SBi=&UBntQLu^HjAu|h%7)wRyS}w ztM@$fV2uT3Ra)UJStcTTv?6!8`+w)h>EM?BTM9!i`&T>S~YDLcac+Tc|&Ng)J zE@ke%MDC$Q?(%p>aYb(7c<$x<->O1|d&;~=iM(fvyw`}l_lmsF@x1Tzyr1>FCW=Hb z%XIL_^xu*Bkd^t(>eLL!`G_zDNK^$Vk_Bj%1sIV9Sd|4h7y0Mwxda!ve?6173NuJ8 z3&|r3DJu)9sWJw}SzakM$0>^@C5o6Wi^deGX)24jCyID4ibyXCvK|x>HXI2pi-|mo z+k^}GCyHe*isdp3K`&%Y+px{k80gwv!z_Y)BZSl^O29Tei~>to-%6lAlz^NRX0Vw> z@)M;t7o~QQ*n*LS%2c}PE2?v^1i2n5fi2!lK`|KvmKcS){>x=I`ULKNi)Ha0kY#C+6&aO(rFq-D%4zq&UDPs;(q{-&S*#ir)a}D;t+hV`j zH0vY%$NRO0e>>D8X^jnQwNcrNoL8Q@Mi8}>W=d8MTUN(Xmc@1w?4@8IsuVM&p4UHtp8QT)W%q_XDSvV+zjv#7YY`iMO>`O7y)CN| zZ}WbIsbQ?}VjVTmMk;3Ag&8Gb zNGOVW`ka_rP?7klni*w!vLlf!IidvbU62fmV-jabF-uOzUVt-rO>?xFj0ylqjTG4seK-@QWTG89yG0L}@TAhyLyttj;w0f@qwc2F{uNdCUl$P%>t&^?gE>e10 zkT&OD?TG-LP1t@U?F{%$S?38y+!l6`PY)uGPOpVlO{>- zAgi>24vGP6&VlmL{)kgzk}J1dNO#UE680<)>S$AKm_fX1cOk1r;c8dm#6~z;q)w)1ZbMstn4n&q8#m_vE)j%@a|OWiFLrRBzWc?c!fk}x%kH4D(S#v?}--a z4pi&>V5cb9NM+jW$zI$r;mJu;u0c&pjuPw1@$C8vxXIe9scC5?smiIv?E3Vt@dEGZ z_2}tMZ|O1V>0P+8sjsO+xalMB;03subGWj0>8Wd;saxx*8{FADn#7&znb)b}1MQhl z>zOa@3dHEyU*E+mZ~@u4EZvpU(9_efHNd$EgIQ4cd8*1;o5hJJ*g)XcELKhM8SXq@ zci|P>Y-_oIzr^eV+!Sfd!ejLU;`KbOPX;N<$t$Uvz2XO-!2s{13Eg_X zu^eaJmZ-fF#k(R2zT^+Tj$w^gq`g$775jVC;o?kFEFyMDYFP<>BTr}97jL~J2RpF4 zeO0{1MruvCKV^ku%x_~YT4vJ*__$X3y=s*sV1k`!p1JDXz3PUy)ytb$9J84avvKgr z-^jB$t+NSm+8m8p7M7urzt$?m+gOj;-mqR?*j^a_-kPD^+3zNpzup$C*&M9d>6_je z*xnhkS>5*8L4w~owAnrK+5IxudAy!q;-z7z-2TqEt2*x+i-O7bi`BIkADZr1b6?#XN78Kmyc64w^B9V5-{#nDXEj) zc)UL4ppC$OTuE9rfJy`G#!=7mIqs>_mawq@%_mA(d$h|l4`R`rHmp8WH>(J=GLeW^A4?)_yoG8MB68uvKybsibCzk}{xK02uU zb%{6m@;Cab%l4`YpN5s1t?sLow);keBE11rBMOWeuWt-=caSBmw! zk@|cO!N`)`H`uS2S-S}%g7Rm(R631GZSlKf>2xNe)6P=FqM2MiPsk0)hg11{pqUCD=Y<#MG$lkRflvXxpr4Yw~#`}~zgv&C|)iIwVK!Jup5nG~(G8yx`9 z>SeyS_eOug|Bay}N#XAU{rU z-E&jScLLxj#!x&UJqMPRci0yc)iqSkb3!Q~`E!*JE(>>paB-S7rARRse}-TkJ{W}2 zmA39gPz|gVL@|tv;hZoo#;?XXPf;=nEY9>3CP_7of>d$A zY%*@~Dah+WS<9Cj9bCz+>lWR{uB%2>*DLBh$)vAZj`O518kR-8s#-2hBu(_pgEFr= zCZlkV+Wq;wYPw##ESNJvr-_fMp*SN6{n&1vah1A=A82d&veL~8Wk5;m@x$dx_>PH0 z0XmPP1QeMU;Z%hW`NK3d?fGLkE7gocIH{-fvShUfwvuF4SIT8$DLxCcyeL)d)BJ?U zb<^}LY(|wLi7t)f3Iid|ie+Q6brN%p3r@pE3l?tCW~ahsgVs%S`qi%~)arw%0JIg2 zF0dVpy}(@;3_IIP$40w>uw^DK-{0(8w~lSU*R+R4bQkRGh)2^L-AZ_?9eXf#wRQ%l zkGCeRTD~zH#*`3w41%>F?G4(D(tK!nOnh8B?k+|+=1e&8=u|eNz1NpSeE`Wzl2Ww3 zbH_Ch&Cn3&{z>BX|1H3HeSwzUQTswDc7+v(#+0S@lR#RX1q6I&mfX- zg<#8*RxlHKUq>?tWnmGriJ-YG#Edf?rHEyWl-(jm)pH!FyRJ52%Tm~gR2LWSgz^_O zHvR)UHrVm^FaBG)F)5|QxW0}=Xi`%4`G|=ShM`ml@Fg*8Oh|%$7HcM`bgBS`o3a*T z05&xcg|vyzOi(tqUOK62FVQrkTXp9lhyyo?Tu@yI*;O%YGPu~-drjONrr!12Yex7> zOy*PYHgj{xls&+R&o*>1>k!q9bNoGr5T7yg(t49P<9#N0{!i|swJH3$$E@dpQeKh= z8Ta=(LwF8t0w}L>Oz;b9AlXtp3|_f3LZ^H88xt=e#&LU}qezkp7qMq0;8 zYyCsDEpw^DtmM*Mzf)=DO0*8@Oh)cIa!d+5lQAD{n=m!A9Z|VZDhLgodHk zzU0c7R!d`w$*DH#xLTvQQYF#`HKP01wOWPZXegg^R0$fj)#!!hTBd4i&9$W=x0hB7 z%Zkf|vOd{j%S3W#qYTB693Z!aNe&c6rg(FK!YM=JO!uWRYuLtx+)*v_!PTw5X~`f7 zrN^ojCadpo>F%tJ@22p=eN8FXZQDxyt;da{wZ+zlxNvhC^Ob%hL? zI!0G45#57&4vsx3J-5v;zI$8C?pr4o&*@8^drv#h z=vv*9S}ggh*#&QyH>kGmin zU|rolwIDkLt6!OmW6j*u6_{rcF~Kj!Jtu|NTwN1oNKKs?Lw9JD6vk#`kAr2QDtwlB zojy!+ax@Y&RMhrNA;RzJU_nStoQ#Kk#0GrZRxN!Gh$s?X{D>#CK;E~Y)tIo zed&CX?*GkSn_BRXp(WB|A{D1}Df3YKl=GC+5d!$IiJg6XAALNh;_F;QzU@K>`C-@qf9I?8o^N#Mwp?KQ z>@S9QsoDFX?6>nY41;%Wq~^Ik?(2%kjCbW6<1xG4DAlg+8MchaL_wigIY4d%n#o@cxR`Wi@`f(pJOQs>g_cnXJahn3ueatxJ@tH&Uzb)4- zP^ACMa=p8|`>$nS==-m~1JS?h``^g_8~<*bmRn;DMWbD=FUt+m?# z_s5HxbeD6*YV%hZeChW3{R)$B2=VIY`oqz9Vky&%^xD22a5Af%tLHkynS3c-Jl^<* zu)*spHfJKN*AqJLji z&(`+mgIJ5Y*64uOTPQ!^r7wc6i|xkLWK|p=7sKnt(P~hvRHw)8+r#53em8Ho?@Wpb zS(f(Zx0$}>st&|%z$57!e!y=g3PR&^Mz#Xe6eMT-fH$2pLS3}X<^3=(6OO;ZBMIe1 z;WN+V2a#bJ<^;jCtq_MXmh)ys7Q_c{D=s4{ql7+u=<8UfWydcW32rT7X|dRa;v`AR zd}s&pysGahu0)A#gf2*ylw|U1k{QS8%05^p(K;_7Ct182;(uava-mO^)ajm%ligk- zHmwyF%yAukOFgo4ygD_`3Ta6x3iDsr$II3AcgoI+)6v`Zf}ASOvx_raUGdZNLoF-+ z@femClsV;msFna}KU6BKn$es0H6Z%AHp^NXOQ{KB5(h$mQ|FDddBrCN z^Lbe}&nT)C#Sg1)R#%Tv6;rovTf(YjP5n1hWOqUAxNeV z_tT=h*pc&+vKp<;oT^#P^NP0H_46t!JVT$bVHoYg8g3e1!UjnJUgG9QBYeV^Qyx6Z zHp2dPJa7m5UZ#E*`d3fF9tKiv%{~O7Zu|i{hx<*yV>uj1#$xa$2COdp4UuzJ)gP@j5yBsgDg3p zw=+MzpU0cHUOq9CK?0x0qru%DP>SA%-*Yx2|Mr0BtSv{h@_s*yyYC2Ze4q&NfiO>b zuLtCUpJ*`r-(LA!6l>j}mUqGETl&zf92_4K41o_$f8j3K`>+b>yX&JSSj?_#(Kz}?P zq+xSV+)@+=b;1-S!Jm(|MiuJ|w136_c@#kIQ-{CdR{&;(oS^Gk?G*6w;9Vtw@u^KT$|2 zl{O~6TxQ~tFCc!~s>KCnjh>rFqrjdFaH^hESACoR+O41nE{q>j-+k8w{fywa& ztzjK5Z+Tm|ViLPxD(sMpqLhjo_CVA)@+>=?ZcX21{8L$-1NmvSOqQaOf`; z=bE7FNK-DvW2pe7x>;zHq|Ndc%zr^1773XZjk#jkK?qRJOiqPYzvi1+%^3YLt6DyX6F)p)d6Wl9+z z5r+F)W|R&Svw6VSR3x+##qIN@kQ-F*P8Jo!BrX|y2v!%k-@1_8k)p=)&SlaimNLuk zG7Yt~Rkp!ZGFe>Wp#qD=a8ni9Rhh&26HL`YzbSS3#cP@zTXMqDOeyBi6WFO1d=B9* z^*3L|ieRD|;A2XSOD+_fP3s#6uTY>Exu+RapUYTscJ<9PMfh9UYQph=Rp>bv+$=4r zkr_Hv5)Du)6eDcS1rIftdN>-L2lcg1-4_=hSYxn6h^_P@Brxymvrd%G1vFRJE`-$E zznNM)uW)c+ccFRDAesQ(#Z`v13q3PCc4=k2rw%35gJGGM-cHMu%DYlJC^HxxHZ+#@ zr>D9n2yQh2(swp>;)CUZG88R7cb4QR2GDuaHR!%oR#e&h&W7!S`YP~Yg4W{5>@R~s zSPc;xfCJ>Vw_%3ZhG;YCL+s7B5ssOLShuOe|5>gA2#xV!(nmx%?_=V!jfrVfM`YaZ z|Ci-@Or`Zcp+3`?+BS7e=k-3RkI1(nb0UlZYZl4?XRoYC-llBA71snR}7 zkPy0X;_9fB6*ZoRifigpPmWa(>Rf~&F)z1AILG0_Tg63}FH280OHtWa>TGrzwWMyS zc80K65?U=w^t+Ilm0U$ol&(klKH27PCqjH&uJxd|wgu`S*{+f-m%Ox=2ISZ%)KTSk zJS=n$@iMxWWv$C%-LBF z>o|3fbG{4j3Gry>QW(CI{NUHwt!U@uYmQw`n9n7n#%E#4%)LS0)|Kh1`|zpGgU=<- zt@r3lE4-;)|LOOgkC^w`F9PR;FxTU+a@o*TDauanvBJFg$@8EwKbU@CP<~Tp0Y0k%KdXW3VF48G{spZ*KW>4H z6an~aRxISsROLb7?e@o~Zc6{G2hD=W&4cKnf&pf}MBzcQW-fo*1Lf5NP&s_p)4Zi2 zon_M9ES3Ux&75XitnAL+r&wPLZ=`Q$?p=x1%vh7SPm=SJJ{tl}_$sD0RW99@H1aqgZ z*5si^Z{CvTfnjH%Ic=c|XMxJ*kp}J|j^KpyRQ+k?LKnh0g3LR!)2BhZ~icC9+#nBmFm$PZIRkgkrr(+^kY$jW09lc zF`AOPt3(Z=eL+HPT!=}|otaSj|I zza*mAIihw;qtw!a6wPBZ&m0!igSy;f(BET=D1wIEBZMgu(%wQ(ITAQH67L`rx-p^# z+9MSI#a)iYA*M$VbO0kA$6SHpu6JiaB$SE2&wU{?;_K8CQp^*4%7edLJ^qf{(O~+D zoF@*6`cg$C$glf|tS8XATf=+!gS{swtj2b+TP>$2BB{q+Q&@3V1Y%PJl2CXljr&7o zP@kg5BD}{)y~iMp1%HVL>p(}Sj{5IGCDY%hT!f}3mAkq^CrO`~(_;k(oZ~>Xr(t<` z+gJE>nuT1mI|YY%5}w&@b42xZl{uTJ zyU4re6iZ|W1J5$?G;%c5GsxcKL9udl9TU!8v!dIB>{sIkOS9!(Gb`ME7T%+1#d4P- zLIx_bXCh*=GV=BfvQ5HVjwCD))ld^bt$t^s%(myzMOa3dJ7lEh*E-1eoD;%!Vgtgd zk`wchpmFBMEPlue>V8T3SriaqlebdPkF}E?uSA}7B+e#Ud8QX4511zl7C|@`^6eKc zGP-hUhT!!VsYTEoQx*w-kPsMJFNYQ(hB|OzVPUuDK9iSlQP|2>;v#O?VN{xHZ_MeFfEmEiPe~Y=FWo>c?<7eDVZTR&`}>A<+1aA zLup>UkQu@2S;vr-1RmiE?yjiN@ue^okEZS&;z5`hH0j-{yvCt_E zA3-yt34RlvQ=NWmVBxIcChO`kxJG)6CT{_^Ci+=*8E>K>Vep`M<3Y;+znIZ_2`=Y&cLeo3hNW;I&cbvo3qQKGd_N>R0XvbolB> zj$V3p6+Sh;PP+x$pd22~qdr1u49&aaD@qSMx0q+Ion;&3b8+XgKkFypgp3AWoB_##lR)jbOf zGMi<31O~DIXxxzM-m>a8ed*rA0W4Ef|CaADbLH_RWZT2(S(fbC!T~wj>^2eQksVRalUW``1$k!0vlnGEu5y&!l?KPl&HK@@#Jfos0 z{WT1ZJ0i+6@;6!+(`7_&s?YLkNKJI)Hbg9R*szAz4dh8Ns9D08=JKH$F zYXG5GE-rf*Az(soq!)Wiwdkv}@oTWHy00U8z`eT1_p84)yF00R(sXJv*L!f3rhnLa zDoA=@ym~6VtKZS}tnWY7$I=2J`e$h!2TdfLeuP~T)RqH?Lf^=#QId0z%f{OvOMTw5@4NLS=L%NwibY){T<&+gT0b@CcG^ zRJu~u{DRl>csDwhL?BBQI?%LyUF6(#@OjqsgqGGCj5j(<#2i?Zl}t3UzH#NQMI4`H zM_iP~mbEFTHN2FxEnO5poAofvoZ@8+!>QkMKKGM{1_gn+&8{XgPJj?S1@O8LyJPoe=%Q z#T}nz@YqdLTA_uZZTKT4t7Wwn-l@&)RhjPt%@AeE8~%%JMJ$9p3j6~&+1-trP2lsQ zSc?i1P@yH}h#lb=zI8vig@pG;_nvicd1y<(W><)B@4`m*LRr<-@%ZIQWi)1Yl=sAV zW>eT#T{KtS(B*)%M#ElqUm*8HAyyPv=d_#qd~_|nm{D`8O{aNzux*rkOpj)`Ya)Jx zw|8BAmgaMkT(YkIebxwn?p<fS>dTue-w2 zS0QXT1@D8D>Qu<=DfUq0OkcbnUO2N{_Tw)YO%E?T9%@G)R{O~EO_OYv@WRUKIMIqX z;9d9Q&qg<{>TVxU#~%CJTwm(!VEbM-;GG6PEidcpNzg5J$H-mBs;zB`LFAspxSlJ? z-bj+3zuM~Cpq{V!a+*Wzs}SEQ2;Om+-pL2u$rjwPj@(He-iiOZXCk}*_wQcB;GRD8 zp1bHCbo(Cv=l(Cj0}=lNi5~EQ%{kwx#3&F_&T?~wpU zK)AoF_mOA!k?-eGfZ$1p|4CTyN!0I2JnspKZZ|n9c6hx_ezqfo8e4@iJf4Hm`6C*2 zBBTj2{kkJQ$g=Y{dnY?m)YegF?kymL6;Sp z9PNG+dF^uTfoGrE{Lk8QRog(U>i;Sr_s9^hPMolj<+6b^qOusXMb^Vp)+%eUGV?DW(`+@Tq|^Imw#{9_69h?MPaqHk1d7F- zL0}*V0*MP3Dq;U$2r8^(aQmErP#`wD>eSeLkx&Avgkg1g!{J0MDQ(YGyCacQCO+}V z5EROhL?)e0k9Ik;iBvYX2hiJ{*uP(+fYWU@}a zDEBuuGR<7Rq>ScsWJ~2nIN4>X3U@P&W{ObO4yo1Ct#ZG3PTyH1>y~}_TCF!27?AEOy?&=FpMHhJYs1iF9IAuK_KNN5sHA1zbtFg2O*u5n?6LL= z>-ea<*DEsC=aa*tsW$~951yCls4%M_ZX`FS>2kOPU`02T>ghDN1AlmP?Nt0RR5u+) zJCpk|_H4sQ-;49<{aO7w$(}aL-|I?TFYubXAzRuKjw9PXhpsHo+^|qI+xDL6N!1jJ z2`9%tv0x?N^>gq*+t*TCDARc%dSo|ni+eQPIQdt5S{PPBy1K2+bODKfrmx9P?A6N&xr`Jr(cM-2@bU*Nrsm>KCKP z;|)NTFJ;OYh}09~n50yW{J0cbS@riSVVaJUXm(`ph=fH5+X*f~78i?@UQz=7$w^vp zwODCbT;cPK7tRiqaR_twpq^Jo#JN#f_O*FVUg}c0aS=RX0(s>EeR*c$_xsS(q(GXH ziUL6Kn{iq$U|DgDRM5pqT9-UzMe3y88(HdC8gKlRM%5RCy3#HQ6OS0-HJb8^wYJNO z65f+5K)OE%eOBamF`JI^s?kcj(|*ay6wl8v>k8x}sq2txm|`bR%*@Qp%*@QpjIm>8W@ct)#+VsnW@en@{GMmtw|nNB?w)T}|Iw>!ZGdjGqw31O~lq%HX9C*ToFVCd{ z)1#F}lWS3~jf0ILS}5(zkrfZfLIqeBan^3=nY5)-SVlC_IZ*}&E`yVe11aEC1;>;h zqota=Ax;%`Hq_~Pr+??T*}=Yhwr5LLW31ZEt(T*t89I-xyJ}K9b-vX$?{|~ag5#CS zE5vcUzy8Bq?si0ll%K|>R^0zmg-VFej^F6C6qsYZazU6}pMlNuiQIB3yE$|nl22O~fQ;8?mjD+tAOdtA6J!1}p z?{VgHp&iD3?gH08a5C`_M^<>i@k!oE8S#9=Ad?o=O}EdH>s+WD_xq@(9c9tLi*Z5a z_4$i79PxYu)=rq;1n(HauLizD;>bWrU!5@d)104 z^P7;`GAOp@eJVhsBO6)gQ|@q>_4&DCIDqCqUx*PVAc}9S;?Gjy%Y3NIQi>v@oxJcd z&#neKbk2ZvOL^79A+ux@`L|HB^wf9c+N$T$HHKKyfuw5<+Ttl)-r`|V*m{MmC3DN# zL;2Q>8HY`?VinWugawRR){ngC5(rEhjSfN-WBPJ~8$(#hf3_OQWeeBP4pucS=Gw*i zKB;7X(CkBJ6zT{)nUP_Y$-_|6y$O=EJCCD0>_c|uPBql|s3sR?5Yrv_Y#C6vJGwYS z7is#gfH}Qi?Cf`#`FEFXHcc}27aqLFLoROEpURJV$;NDkHS=sfbAQ@#3PNqu6SzcGkKLgvOB}WI zvrXA%Gh~@t`0dzdn|9q|$Z@+c=J~-c1A^U%=j-CQzkpp9a;uR57Wc2kwP#o78k`!f4h zQ;pljx%LkZ6~EZcbiOXl_X{{w#kQImFfJ{O`8m|&vYVSIE-lXWIn>p*np-$7Ev3&Z2gNfJ#PWiF_j+Ji3GGG*iF<}QavB03VYWDC>sb`Un_ zBCJA9hC-0J3A4;PZoFmZv!!#7c^hKrCL8cA{cglvA|my5d54R#iOcu%Wdd&UANKHu z$xICU!mrQ!?Cs36p=q{(lBs)Ar%hu%C)edZt@|^p&i#dDHx>Tu2e^VPbH%F;+3oH} zn(3@7mm0U#vaBaE@vQ6398N9KDF>>QY#Y$8j=i`Zn`V-3Yw7HEorbMPap7+3Kgykk zEL$(VHCe`vJ)H7HUpVH&HCY#~CGJM5+b&{XT?esG&ztL4uZ9iWR(?^q3^Z$8CYL{N zz?I*x1h3xawm+Anraz`EJ>Mp3a_rl4JPmw(y(nLEyNE@19~XVSo9=I0Ox1Kc`M7qs zHs?_-efp3oyZX>p{xaV$d3%$ec6|c(vO1M+wj;@Ytpdq$Hq7zL%UR#uUQEggeCl}C zt$WF4&gpL7^=Z#eZa;futBh{@c*XHytK;)k2i*Hk_%EFZc%6uJok)D0U*tNG^*T}P zI=}jMev9cu&FTDJ)A^%^Ta>5mXcGo31Q9c(27S468Q>uz?g~fh!ewg@mhBQ0?K(j1 z!Z73U3FcWTc=n^093Q6X{IpX=b)Kv!6og7_DT>?$3*0sgUOZLP=ZPqQR+D%8- z$QVn|-HWCOl-eVk8y zHn>8TYW(JWLL5DOS~1;h-Kjx(Fkx~69%B3<(|rkMZTdMp$t`@P$-OosgK}bnW?y>L z-w*lZ2rT;WrEdvDqYY+03E6xUj%w*sd+N^|VM&|j&z5G6U+%xOWzL=!>~owKL4ZFLFB>E2J&JOQ1Io07OT;t8|nKZ7I!rijK=<4Eb9Kq-$^Ij|3#cvt<~3Th>n%( zMGdVl6s>iJPptm1x5Z7&Gr5ODPUL;fNSc{A#B!eyACrt8tL(^#Ob*}b6yK^?|0lLl z%W7Wlqn=^C(WH{Wp=r*h6tN|~{y%2yid)>1BR%t5Vuv-NEOPbRBc16zjF)U<9#-66fp0~zcuEt*9j|0f#VEE(U^yBaN$KT73L+Foxupfu~ zH4YU!4xKv=Q#<~#cl^`LIPCWL=j(AehzWS)2?YEJMEVIN{)sR06Uh1#DE1Rye@%Rg zoj}cWODY-j5#RAbDeC_Do5NeWmpqT@_=;>3hbnQVmAQ)zOI4H-J* zJOYs{s?j*oT3HBc*4r#>R=0#w8?t{JZ3%7Be8?3MYg#09M`2nEiH4)>p9Ux*98Wy>V; z6gt9|%5^G6-xJFd&)cw*UI!t098;qhS4OY|#r~0d%%oVXg58@eu7;lXVW(UmDvwv8 zipZ58n=c4s`Mg0=$=g+wabEF6Rc?j;%@MsC<(zm6Y9V&xYoL0m9r{9ux#C9F_aVe2 zVsQkIqCA0La>37~_9;b@xn+L*R81S@a357-SCm_d;O0nDJZHXcHOy(ylnckIgn})R zKzt@3F0-Ld>HR+6-BnuovnZZ^;eBv|WDhU9UFiKnR1 zu1Kh;5tb&s$lpz=V-zoJuTW}Nsy3>B9k(YRcQ8~BTdjg%O z);K-tXkbE-zWNb=Uj=d&ExBTt1ywdT+%r?rRcOD))qGe{#yTsY;z*#eL!i&Vd z8fHCncS`)YZ4Q+sYCKhV(SzX&Ay5iPc@jh_?C07KGdPS>mBIx#E~s z2I}-EQ?VhLT08}YNQNg5J@zjcm=GGsG=@~#G5%<{uxeKrhCXTt}Ig2Gdz2NZoWW=etqZk{~Kk zm~)>A_g^gCps=v{K$p_0*NL^r$FXsCVg4RT`mBp|z~% z#j6Wt3JcXn9Q{u>%282jCj^@a%%?o63Qs3nyYy$|VOtyGC)lgz@JmUZFvySF+WQ43 z_v{)MJAbG(w11me)fcY9ah6Grp82EH3=S^pyC1F{E0OK~PJb@YBs6M^vCp$ypv%8R?y!w+F+ z7`s-yZAD!!E6juHl40Ap;mRl!I_2a`A2n&3Z*&BUk4p#Di0dcuUn=O^t>N+}!Shxi z9XDURkuK;pex(1Q`FcTHZcTl2F!)^=FC@`^&&6;}V&Z|g(7eSA_0R@yf~Oan+)J7G`F-ED+V!=FoCN`H;2 zn_$?Mnph^xqh{BhLtWY=l)`jfQv>maslMXnt?rkf9W@-WucULg0;=pLuvD#H)sFjU zwaf|33uT4GMXOXIR&_sXuznY@sRt;L*eegRn zSTWvAoC#FC|Eh~TE#d5?X|6J58q<6qKI|N{bnkQM?DKg4^P|hpA1>a!&R^IbVig{8 z4IlCxAM*Vl3gRCM^B;;dYrKGeUPNZp#(JmpuNRTAu&}texU{siXlX|PFW?mbUJXXP zyu30pGCDds*4NixUtfX$o&I$a>7+Nd77=^48pQd(WaXHsRG)34baK& zaIQjkIB#F2TIaVOvSu6l_d|oey84snA;tRRv7}R$x{wIQ`L5RRwOq7sPN#hh*sPvP zu64Jk>)nR0M-**tLKizz#hR2q*dK4R{tTx}Vp2SG^}b`(Xko4QIDY=ckYaoHysK%S zVXwI21%45a;xo4Gk7bA7sJQm)n?XYKufy~FOcOLPtc?J?IHQd~qPzkfaI(6+jbJM9 zvp*qph`oOVAB|&lZ81pXei+QL8-5FLi=3Gag$2v#h!SJi--?zJVBUz91s~6fr7|eY z4Ji**f)7M?R^Cjgxi45w?9qz%!T(+Or_eZnz3KhV%aT0)xOB2LyjEI6MAS%cZ zLkz+X_BSac%BqMR@Je`}O9Y=29`vm+H##eUIR2e9NnW6yA4_5Z-9sXLhIC$0QH)5? zH=|-Nf)7c1S*lScuZN`#QN~4LJ~s!483B_br1?3_LD9J}3PHwYBMhoDWt4#p+u%eb zBuH{ZYX?O zH#CYI7#7C`0h2#45#tr<@l+yQCB?FCdm#Bf`JK9mv@Fe+DfLp=NC&$PuR$bE*8Cc! z5(XE;mFp`In5>{C8e^3@2FHtpt2+;~Qv1F#|ACJ~;oNoh5O?i>fw3CF#&#_@1N+sl zty=lq4H8Tb8*aZ}0DLk^-A&^i{zYGX$~m?JTY|sEUXtWZfLaO~CU~_&508U+a03q3 zB}0H<=&zh;m=-*K4(LcJn-X`W!dHDUJ;9NGzmgn3IAXwZnK&MjN0%QcHho5e)Al8g zp?<$lt=F2(_6nV+Dv%mVB0Nr_=LczgLcM&MZ1|`vK3V%7Zy|Gd^80T5Lcq$)<3nCL z09)|)jpWZUDR*+vEJ#CA9W%asA3_WG2t_!#Uo5l0p9uvRhb97WYBI54_oc3s`@@p1 za)`tWIq8cg4&2)I>|o6e)o{aDazgml%l`3$_l;`W{rta?*RL zz?#f7E?$>8LF@_cEe*{9e)Q$&?wDGTqVruCTIKHIN4y_8=KB~JfQaJ(9^tGJcvOW7 z2lNRA{uss4?t~nE&yWGiMjX1(!(aRV=&XzX~%>X%*BeU zh;;S-*XCB4Fw3h$vvtO>$3}vxD$^`qYm3miOw~=(Hbr9UYWd3?>W5ciNb2!~kW?lt z`e-wIhxPYizK;adQBY;tG?EyTfv1UTg7G;vRd-sbHxIA9JTMllZ5#6sA8K5pd~3a8 zJ#%$tSPe!`Xg%W(bUS=peiW!9e3+qhdL7nW->GXrJF)P>eO;EH`wRf@xB!62Or>u_ zkr}nmqLSzBm1L!IdE$5%%^R&8RPh!(fzH3IQ()00u7|v)#Ng z-PBNfU3n4;Mz;JX4Y^14#YVO7nl>F9*&vyQR?%k}p`XVA49x2id<)GBpY{H?OxQ(0 znVa^F5%Y-P@r8M_+A<=sEMFyDpG(xqqhlRy)6ug!mF0Vq9qsN6^?$NR=EDXJ; zK}~^R>VjZ3@|5&yP2g3^f!LZe&ej(>X&!Nt5)_vS2ngHKnFAx)#|MJ5pxLqs7t@Ug zl!-oxn~Lnk!=I5xzsJMsYVyU8O;la^kWFvO6R-DQsmLFf)*TA#1b-HdCq8P*Jt%I< zFTb*#3~PhEM)hH;<0%sOvj&tZs|`$JRh9&uBVm zwKNX*x3bHjLIWbEo#Z9@j(hfddF)H%rYZMQdn7c~5B{}X2yQhBGlReM@r|#Sci%BGce1BlJQ}<1D3{)kZnNv47w4?KXvhx=^^wOMr|h}$I|)=! zU}SABwzsRWXg8)IB88fXvV5JNey3rdS)F`jHgg_6Rk9N|%-&-38E!fHy>v38*ijQX z%0^aNQLQZcl7-~L>YpX6S#k^l0`R9yUW@Z$4vH5X3CQhrq^~xFp%T{klFb{z9MQ33 zdlypNkz0}`4`~IWmrFP;F^K&RJ&>upuQ`g&CvJio);nZQt(dDWQt7S@Jt8;N<*hv> zVdNWM)3w=cUj&IHpAS@DALhr}ZtBOLPh4NG8SdMIOjdHZ0p{b|IDVc#+S>__~`!QceK)>hGrVM+_S-)r-|?UoFM&^5(- zCGW7GUhnd}J_mTi*3rNxcw%38;4po`to6Vhup}hnMBYQ#7yRj|qXE~Ti2sdZAHruN z$8!_^OXciOl3lL~1D{XPKk2GG>73{qtA9QldNBET^6$A4>~Vub`M~=*%0O}PE77qs zI0_rlDG_-p&U>+<&`v=5Q5t%S5aAB(>G+We`q5TQz`aWK9v+Wt$%@a8@ zxd|j7VeO$f2zeVN_#xc+p%bx9K+>^0{POwcDPN!kKVV~_WPoBM7z(AwLL0zc9pEtM z?HC{E{FU65=m+(+D}s|3JFc5PfoJosXXkE!{ha?su04?xRRN>7<2-(LLooHZZ_5Bp z`?rw03r)Ph^$TiLTO=+X zDmvC+q#Gh8>_U{j4vLVqNV^`w$NeY<;b;Ty$mT61MjJ||7~ak;j(j^z8t7<7=NPhc zT+TrPKkrDkDqOt8D4Q%oJ83Lzx>x}mJgg`}qQYo1oY)s?LR{sTSnn8vKt%e$Fk|O9 zvjsF5W)TNOJRR;hBj|YMg=o_SPV>h2-9NaemoYwISY8V;Dbfke*0H~we>`?Z1~8*b z7NVn|^3dhPo>gPTp%SX36{57>na$27rY$7a-Qw&H#AijtcO}G0`MZ^5xfwdT5;7*` z6q3^9L>cq&NbkpLIY((XCcnc$6DN*xa3<)wkI2EKHKi!YSQP;+-Q}-TSpQ z6JWjP9o(SNFz-ZukE>ruwQ?V2V~vMRLsKlD7Rryan~3uZ+#cw5vxH35gwiu5O6RNg zhTaKP`Ih{!&%N=LCacjlq$>Rt+=R4G*kY)V#9xu+gxSR!J0OP0Z}D4b1XJMLH=il! z%y%kw5G?LW;4F9>&TALWuZYwilgumiJuwr!)xJ^EBl-Ce`Tt7D+^*030mf2UpGGu^ z_e_u#tjhuf+0YCjiOGlaCdII7XActFrwO{|Or`z4PfJEkx3}|O4D^XtOy5ZezI!LB zy$NrL{MDseSc645k~c3Zm$N@Ar>Z|2CdtVN(rnjJ<6BZXnM)?TK>*jcKv@6WOeH^# zhI|zkiVwIJLb?(GPlsDMbiUyn+0Eb3ZnQ5@kF@? zy18b15a#G4_7PG@zwpwsCX#RQ)D`l;eB{l!;-P=!;bM(J5a#7+{@(DN>D>>K!|x^d zU=>E20xG&Blpm{~L~!jTeh3MZR)|E_7IoL+Sl8MzCx0^aD5;KQc&t#~H)b4QPSq>v z6T$RZEJO;f40Yj0W39K&VGqfv#Ck0Ic%2(h!tJJ7?-E>9eO1@g^hI=-`%jMNtq*S- z0xv#Z??45-pD+$2o#kqRP4-EI-#YJT=NFgQ*Ow zw$gAn=i}(m{FKlXR3xiak9(9)36}kJAkh)rIy;P56KrRQ%&J(cDH`v5YunOGDw&|t zzW)Q6f2b|%rnPv^s5rU3IY9I&Smq>HA>q0m8>IsrO>gfztu?=xQ)~x}n(3$Ij*}b3 z{v7o))y^o#&Tq>|_I@Ti=S4fanqQ7ONyMbF$uM(&0TcRZcqJSJYFsm4JdEWP{9>)I zcl6nhy1CGL1{5sOZac}JFp&Cm^7Xad8S=C>SULIlRY}=;ZIL@>0-U|S{{m0y5i!$r z%fqOO)s|!HTh_1m?V2weke-_m$}phem=rcT(<>&XK9CgN%GXDUY|RkLD3b*|(GJd_ney9Tn< z`sDs(xPK1{a~k?1>K~2_KvNl(mjJd5U1fPDG6XouM}wEr9gO)nu4FxZ43>d@*8Q`s z#k>99W(cKhgOzNCRcu{i3d51|`rv@R)ND@=QM(t@(DL%Y;HR&{WTP8q!_UgUcS`J5 zQhwL{8d*!hAOWX2NHP7HXUa=9*7DSTc#$$qnqbx^^sLXYeQigM-EP)D6i0>#CcEXW@z|YlpA{p& zS^&>Pzi_&Xf2Hj=8WK6^1Z;Mv9n?)UFa{wNY5X+GS4-&Ku<1o0AMv4?kbRm=MJ$Gb zq0a4QVq+(3x%)kqV4#;U^QqomXPZ>STz6V{nrw6Wi6#qdH=A>48hr&}(_yS9Zd#Mv z;MH*YwcDAHhy2CZDZ_sjD4Ko0nUN>vSUn#IFOsj`Z;1svw|_K;QRB?`orN{X!vCua zCrl2G(ag`(UnVUJ=47*$ozo3J+BMX5Lsmq?%qRBqvZGq(@J+Hz(SPKo=32Y|u1R&b zf1ZaN${uE%fr$6F81Vd<5CnF|inT{kiSAoIY8jTgBsR48$$j~?(ALwEiLE2mhf(NP zcl`1?|LhaE%kpGqTZd^8N#f=6cuzfsK8$gnX{n=4x7HggYZ3##_u{2{u%(c{gY1if=Gj9~MCuHMd}oN$f31Xm$5>7< zT8=gPqg#+K+F*cjVx#2l{rgTsNj-pXFUWkrTg`A4;st}|C5(PG?pQoku)%kxXruaW zb0)|N?KhGFQD)+bF9HT9_h^8eN}$Q%7Tb#po$bcsC@U$`+IYfHpZiRI1M3viO8?%f zEz{iX=1RQkIRtn6lrAxn~n1-&-4Dg(52ymNn>u-*w&0=M6Y zj2z+J=v!a|fkAg0iF-B%3Z8+hd#_*DoL$n5pnUU>HqX%KZHD%zjdsqCf2oKEnyDRl zODw0DA7m@HK3FC-UFx$^{mM~3lBJtW25M-iQc?9DFF94eX z7~}KifOFo%1jdhXiO?4sgR$*{vGR>EI?j>oYsn<1=ZIY~9f7f|#Fwr_wUCl2#x6z zH6a#G*QO@{*YZB8{JRTg+}-?nP4r!mXPmj^Ls!hhSpP$jr(mw#4QYDRXVshUo)wjz zp!<4sfrp1)6)Q$5P9I zW==w8&MT|HXQ%QgHcqsr*XJzB7pC;fpOkR|;n!uDYry!}m8SV?$@4uuuB8kvxFrry z`SwOK1S|$$0DK1z0FB1s3xxo@3qmH>=t+>?6bM6S_jr#gvn3RTFP_GiD6=gRN3PzM zBLwV-CDEI&_9V*Wi2^WgFYmw0?MY?9yrO(RcD^c*_J_sg`1N3=BT*z@s?q!Rm1IIk zhfv}5V$n)n@;Lfp#N)*()QLX54hM6!3g)T2BW1Z$jZ9H*8ofojgY^K}LkxiwrE{IW zP~O#2qWaSLYD;q2FxFd|?KXF}Bw5NK(=Viv@5tLP7M^3qiQO@_PvmftH zW%8k2kTA@Y7$p3VQDMqkt?q1gMw6Stgg~cKqgBDc$|YMFQ^@Px+5;YbF=^?Nj`+$O^KRPJ`~T3j{>=P8{t&1Tzr8Y;DpQP zeHi4E(ma^>ieF3fiOhuOlH#w z?IU;60XE|sF~YFICnLtZdnH1{dfG!P$$q<4Ey?-%o=%Dz5}%GYZY!Ho`Y}SsuKl?! zCP+e{y}Z04y0C~i(l7go$EGhK(=xQZ zHq;QmK1IuGdO|qJDeAG>Q|@fP07Hd7b%zq{imc(jB)#6UVcbD0QV$TZznId z(IDB`ece0bj0yKe)ko2kLc6}CJ-MAmy&H>&7n^sV2M~PWqTcuDrGq!&zV6 z#ArQI+MBSsNd2OyxoA4Ja*;rKx?;`1&KY|Z6qW~N92}yFale^Lx$3+vj^pmqQ&Jw} z4BuY1Z#S*2w_w)w$6mdz_WIcR?w#(b!qOG7CZ^4;>s-Ob?Y80L^TIi#!sBkD|LQ9h z4Li8VnAayMj2n0(t~UG#?~iC&?;;hspcSZ`;nXtTQ#x_CXovqqds^pbW8y|sp!CAF z%YYDs#6KDBab2Soxzk~4n-vzbW8{l{?TaJeK~Ji1CK=JXU?S?lbQt%AMavS9N#MqP zDGwB`!2t7b;KRb8@*Q5n`ht+a5Bni9n50EV=t;4uyEB4_18FS;<|{E;9ksl!T$auk zrf6mtYD=pvC=BxHu1KO|A%o@N_34I^xyEz+cv`(1#Kr-p$-r;~x5dF(Jv0Fl3!I2* zy~pW#&d|p4sA(kOZ^BvqO%aH}SYYa3AQJe9!X{$S3vm%HzjYvs97IMeV++Y_M)G(} zY7BJZwZYSg>Ff+AbnzL`yt*&+hbkfX!0Tlocn@?_T2L8lv>1FzzvDL_y6_(x&O$Us z6~*YY@%@uSK!@HS0;NNnVLAcPE6rdAF<+mG+kjuO==5l=hkG)>ad3RjunPeg3&IAhKxM!Yv9dnsixlhRew z5qS97-?WR8>Qiz(D0+<>43cDj9@~W%;Oz=>(B}S(^~YUn)Yp$Giay7)XXhm^ko0~S znUJm_J}nwAhf)JWoCHgEQdju&=R zcH5-j($2Ts3RcwgsOfcBtdS=9@Vz!`K2w*AMs#4K7#R}(K~Ja%LuFX#k#@6)e1(L9 zKcYSnbTadBMHiyHL};Y{^4Df|N! zYPzM?o15Ara})DQT%~oMYnq$hxrURv^65@elNH>t@hEvaD>8C)ST+?|;#1Sc z&>xccZuQXq7M;V`l-kcp3SlL6U6?Ou0l^O13rfhX0E2}K|EKupHve{X93w~EL@hgT z`$RmB0*B#Y3HWJkdQ$ctYjS9Z4XARZc5i+gQ-%;p{Vqf=!6O3FR#ydq8>`9@b&I&A zd#*l;`fP`h6Bc~Q7~oh}`*0#hCfv*D3yUVmMJ1b&_;sY3iMqH{Rf24vuHI7@sWE2T z{>BwYjFpzzy<1Mq6LcWevP`D#3%wfTHzRXwfA}qen2?q4KrcQZD*3T+5s$CVwqk7) zTOW>aU^H*4I@RY$k9TSDb*}HG!-xzKHod2t$zDa=rgWX#aA|p$fk8!9EXuOkZpqJL zvFr!AiZieCJX;*K!Dgu`59|5Lu0wW>PppM~vmZ7jms1yhKI_~k7^&c*@R&&NWuOq)pUWPSJIMp*Gn&Gc<_dauXl zBx?x$B!VA@esS1kCAX}weZ3itY_lu!S|;fyZko7sww$5J+2Rg&nXPTJ$#Yye>?NI> z?d7=n_0fNw>pSba%^~V>(ypIpF zvi27%$YV44A6L(z1>+VsB|ke2DyAL#);lQChiS2?xSglx+uf3l-QK^uQIRf6Sg^zio!|xT#Oyn%?`Y z+quTtP*Ti!`myV4O$%ZScXM_pUP&h)6bQr+7fc|ZzT?I&;Uwd3AW3Wkq?tPIJIQ=m z$nd&`XuEKqnvl2wFfLv&F5tZs4^kyJfm>@SLNt0z3&vJE=22IbY$IDu7bzMK$0r`r zk!~ut7HT}+Jl;q;IX-?p-Y?F)On9X>*pxvpsc___A*=87OLz^a9%*CP8qLi8Z#>QBOm za&Jf`y=YUasWW_%Gk-i4uS!m@fE%CBVDGyMB+cnQ^B6WQIets-^c7;n1?;p(WdZ9F z`YY$YSRp=RH9iwJ-pEcQi=2KJGM*_^fe~gw8#V!4VKn;8bnByjeKo<@00GC6UVPsk zv3sPNYQeMSD9NK9e>o1z9GDH_{-1oYK72xSzWu7p7@UPaf_yo+rklC(gfXWF?t=M| z_J#Os_#>_Y>~%@Fg%e^*gru+dQp`Al*-}E(21Th6-UD9oa@`4PLSIN@*eWATw+8cb zgwkQf65LW!b;OVw3q|U{UWYR50s$fsFr@%6ED^`2fnQrlTGk>3a-uFVLrn?ku{Z;m z%4m1S!?0>R@11%8DX%y^ua=U&toK0qC(%l^0DiuqsEk2TVbOxC=1ktfTHM}Ryym9q zpi3~J60`!dbJ~%up-8J906yTo5&!`o0BCi$T@5>Z89_!J$|4g@Q5NgN;}@ImqNo|= zde2KW-7Ov?mYF^B`%@|?04C(T-UC5#Vxui$m@Rr!v!YLOfGBjyD-1;n9w zwW;yBZSbf$k0aLhL&Zw9LQ9efk9LqrZI?8KGpFNwOCnwKoP@9()J(LAO53`2lR8ge z$&aTbOl%iSpz{wdr3@_hOrZbj#P}uiRY$7cZn9KVW_fz_IOI181V=1Om@hCz1u?Y= zL=%~3c%Zw=rE$y&I9We3!#z^KC{M z*8p0M9rP?}vD5%d&-nUGuigV!Wi=r{h%cW-0nZ!sBP7{p^dA#o*MibiW36|EM6}+Ct zLzoT7mG$PAW6wo>LFj+_gYNK*e1|l%FNW&xK48m^7f8RrTAE3Tz0fPlzc4uDJ}s84 z-MfeMBhtQe?mVYwZ;l&6=}~LOTULwSn->A+#})rjfN);9SV*oYqpTeMusO9Apeh?V zREED;4zWZiUnqC2SQi^BD!x#=J(lAB!|IDr&o;68o?6#xtGHl(d}1caepljY->R`H zmHN9>y=z7#hjcYPXSG$GDL_1txKS-F7CZe~ZJlWCoIL5?T+ys_#=cimwq^~Dd!_1l zbwpodv3Hv0*Qyo|0rW(w5wp67jG$W1nm0CrC;w^({`&0x>stBLH}4C=4=2^1ch+^j zCw>ZBFHKl)cVAPshIuCX1K$?sDYCABNATW58`0p?4~swf+3Rh0t9rx{yQA8vfvb6+ zbXYq7;LLX53T&9DZU~d9JILxp!!I@6=l*FdoC+09cG^H2+(0l+*051_z@6m$h&XSo zBigABXQ2l1qV>~P`#XyE$nrXcN7HBBbP@pp2!WK*t3%8-JvU=ao;EQkYITOX0U{1vVhZ(!#7)%C(GnIkRjGRLD1UTm{RORjEm z-=x?*36^}?R5aL@mspm=&|AIMWn|EkXcKvj&`&7UE8=_U6?4#;nn{;A(br@USX0*b z5{8$#`6gR7vWR6MUbth*foQg)Xg+HowqqdjV9=VlA#8)f`m$jkI-#HkAF5vJ6(mQ6 zVW<&gXdIVgr67iCq2;hDCgZWg5cY@3PrF}g+b1@C(0Ys1Ld~FLo4OO7H7-S6!ElWj z-cwC)v@-cFaXaMqw)=s8(8;EcfsSihjC9GU!-wQ)MP{BY95HMQ2-~Q!cFlb;FDzR6l zWg5Av?-{4-Mz9;lu+11|^ot{J+}^l?yKqvY_s5`#h{ZNR^4|0+^6G-wyGYTcOtY^P z0=f?g-Z*_ie)>ujN8t))OKtk~(}#`%+dK;TUj^`@2##S5w&n=T7t;*lzHgj(BenI# z?!1KSpJ;h-8=yiQw$XV>odKGsVE*m&KW#yqsX#O-}x*8Se8b;>*@k;PKk5zEj;% zU!UdRDms_O8G^rg2*346+u6p8QS;8(=lnI?6SKu(>mUAg=;a2OyXRP6FR%$Oa2PLe z1uyUvFYpa72ppv@2>maJ;xCBvFG%VyNc%6y<}S#0FDPy=C?PMYzFtxjUeYjL(h6SE zDca(FtSq(2>DoReerzl_bXWpBM?(d=gnm*JSZ0(~79_Mo;=AHE3|ExBI#;3>qAU{D+z^rc_y^H`zas3(rd+!GbM67T!Xd+) ziv5|8y&~atD^Jy7$JLz;Ws?`VOn9lHB3$a39o`3fG0kukS-3MP5z$@yyNBynobYL< z8~w2equsEJZ)8T6A+691iZv%{g!6AuHgiZw(Z0Z3!Li^KWc+$@K{x zvkx2`)^04mhPyJN3cudGcEdj|Qt4A(H(iuUr`Jv-kS`;Kn@QfyE8UKA*>`r4f8o6g zf~!z050l}n^BB{%`Ex5!U+2Dihw?)Hd7?V^@h%dxJ!V%Vu3XW1)7F{Q)A=DbYGcDL zN;!0}0$RZ}BsqOB5p!)#EOd!D+t^?(8lI zho9}FyX)$(mg`dg*hT4F=O|xK>EQJBDYM?Ouidpz)2+SyZm|4Tuik!W?rGTncEHoM z+tM+U=k=+FlSGx!Z3^-^MKDx7-eJ7`c5cpj--vpF)5$;H={4zDW9)t`-`%4BaaPkI zAJd&b)H#&w<kZ$UeFjtD6M!GIOkWe4MAwT13 zMF5??5O9ck4dWRdK2Z1!c0v={Ji+jo9KHdSn|ywls7}jJG&#ai-w}%R7A|tS5@-x3 zLzFHFey6ZFUL5UT5{_r^_#={=ToFy?h{V&FFP`lT#7kuhh!I!i42P2zXKfWp=?Rpe zsViJH$(tO=mHwb_!*h+rm(OR|o-8%JrC4ooxxF|(jHgsil#|UW{nn5@S7AD4!EUNV zqSxzRT&MnN?n1FR0h4uSKI&|8(9;;4$ozrsV7f>#ALICe{%F3+aB7G6!CEZDjCglP z{fwaGgh;&@(1sZ%FB8}AbejZL5F=uYb>Aala?R$h2!PvqgeFm+FFYn7z`7ZHv}Soy0?RLjFuVHi(a}1f=C0p=Zmrt zw$~?<25f)y-#Z!p*g;S_5+#XFI6(wqkR89sH4-udsE1yea6>sFm2ksOSDcUln7cdN z2yPf=yhxZB1HEuT4CAdJ3Kn6E5M~i({Mhd&O89Y?*fYA3>Mq1vfgDvztI?7IiTFvz zMf;1f0*w%hl9sC|b7HgNTgp}qwZ90}XzQ4f;x%Cwx1+d{`t+jpo1Au%LRlV&WIaDa z?0Vx(CMFy8Ny8Xw`3NVi=0iiU5EXJ`nCwOAMim+bhe#NI=gxQV>T34gEgF0 z4a9etu!$~=ozWkNtyQ*3gcdE-847ipF31&eJqXV)Dk3R9eAI=3tmT;CkfIe4Hr}|PcAHhIW-{uvNG}R37+SxMvIx4kgu1ZLGAK82 zF^TJ=E2(u4e7Nhmy2EO*nf|^2fqLcLP~nM1Wa3eB+Eo(T*DC0fAC>LY??UiK1Ikp+ zJR!^Tr0Q!t9;>^N4fkxvKXnUT)qNvfk!!r67)YE-e?GWUm81MYQz<7}N}48#dQ(&N zn?F^0?nB#AX~MgLR)!_>=Fsm;-Y6=iQLleWN`LeF4=0URqOhNjv%Y&dn{ZKWq1zBK zHaj&^VN^;DF|>vDT8f1OxWFK!%IX5`e3ThG9eEQO|9CXR*!}TNf4N;382)0hQ7I`h zHSak?v9wS#MdZ8~_t?g;+~I0LvKJVnfw7;3(fn{r zNOXryES$-j1_j5&KF{>Yo|+E(v+exXFSEI>BzPF3;5$5NL&$}e$ogcPdeW206iic(5=E<0J%UF!6FddDZSOj8EI(@`82nu$C z`La+7x@jl6tq1xU9=a@f)<0N)x-jWegbWF^Js0V5Am2w5qR63`9D}05Kn%H&Iq_IJ zdGy^+xGwUl$o2)y2Sr|CP0=|I!5LKiMzXXlNu~!hBJ*ajs7pyA79VUwb{6s&MwP_U zcdnDhadQqHhF*t>y=RK)NX)!?RB(t-PSeK7(qvQLPm@z47`N4wT>1toPpjWpCOnfG zIWx$ox?EJ}nC~jWCaYA>F=}5HEqnsxNjX%n(D}|?_89s zvX_`x`_A{&#Z?~rkgMo7kIzp#ROr?mC)%+vt>4__rPo>*K|+i0)=4yP@lV;HYI$8( zIb!YGQ!32`=iU@4ws8iQyKC~UHMb}V)>t3IWx7hM#?>@-&zL(SEHBX1)pmX?D|YZl zof&bstzV8gbgG_Sd)QDUxc_Atd-Ed(j?<+3Sh_@B-DJG_GgDG2kEDXLv#PSZW3w4D zUZ^dpQrhc_OepQm(XZCQ&HGv3o@@Dl00!6EppFqBf2{kagk5kB*Dt9h7Pp;++y3rgpGs*9F=BV-(^t3uL=j*4Ln1| z^nXq}4=Q8WYL|=Y@cQ2m1++n@!lCa9(>_dKoY*Adml}y8eIE%+qseMk*=Gv>PUPq( znU;FU4t9Ir>-nAIHb-w<$O(9a$kp`{n zbUR0#q(rF6_ac=-GBHv=jn?1WBrFsBefBx6A(~{-%A*5e_LbBt`$UILOUD|Fg=5br zl0L3G6Co(qt>@&YR!fb%L@1>}@k54Y z*};}|Z?@6?L5L5|PDH$L@NDtGSCnL9Bro!U+h2^Bx$6{nx=1KC+}ShMt3Nb5PvxZa zbV*HE3lJ8eh@);9e)oW5E^&ED^vu>c+&FYtEhO_YQI}f!fcTv7hhF5zG@Ro1>EmZT zeaA-PjJEQOY;@c&ek%-G@1{vEzuTQpq7NuR8q8d#35AP3w9)Sh&n3bdT6L=qwh;_< zi$7hb(mn5p4l+xW_{k~^v7b8Rvra~OIFA^F!j;`-+qb59%dUVpK{da2_6d!u)H&-wR!WUXxHwG!csgFk$m-Xfbq7|Y}< zOy_aC>WfLSi&6TRg^9_3Mo}xIv2vlcqG2(>>#$UUytTkkTP+X`{NKOnH~_>T4YeEuN^6fG;)Xne>BB1H>p=Qs3#v=KO+ldB0K!i zaLb(frHL~68wDl3K}}>U5UILn@W;w;h(PRb8^6#FKIX(~r>0R|G}OB#qDq-FK`7`V8>Jj0fRCJu)3hC7nPvoJzhdOQS426kWoH zAmOJ>D>6SSjBHvKT^fOG)G9HmC^7oay0h?!vMpJkJZ6qE(V@bU$yrcKAyks@S7S2Z z(O|w({SKz#*kt{TIV7Y@4TD3(vq}F-p-XF$No=4){5_kE16Nx;>84P%05%CKNEw_1 z>+_8UY?|h$rgi8fR2Y>A<*d|B*$ zP_MbD5UcvH_-;Qe+pP2zbv{)q31GGb zD@*8zhJ9iS^F;~^nQy=!(t@F9|4FbAK%gozcx(Qh90&h)LMu0P86d!ym(e#B$Y@*0 z6Kd12XwtZyz&JEsFn{^Z9H)DxpUe2YBcCp->)R`itxgWaZ!F<3(FJ!5bPHUQNyTKM zT^ojcYzK79pmYfLZ0(wI#z_&~~*pGmCCsTfZ4SZ)+zQnU)9nf>JPrf zyaHxpe;vG^2Uuo5iMy$H60cXj!t8IVXLx44>fsm$AC5v_ib1~wMk}FCryTivsf0etPrMs-lUIm!vX`QYD56qSD5oa$ z0>7eym(4Up9Epv21^WHu=5g<6-0=`*UlEiC=^w|z^}DpIr5mu%pV5) zDVBITR4R=Q+9CD9Nb{Rjt;1OED@yhHhFwhfncrPweBnuzm-(nS3@>Sq^lP4(M^?!& zN}_JnQCr_@$>{14lrWiO$We^S0mE$O*ha~C8{|NeL2uND5(v}og94_{rBkzLJpyE- zWkjUcJIMza$*5RAF&2*bzjLo*$GB{z2OZCJ9Zk*tTIe#I@GD`%H}4B0PjQ&nvRO!f zI4JsEx{P8LBRNW%6*i@m|nmnH8DLe2ue!pWbXK-TDt8P3$yc<+@ za#FS@p)?tYzNtdI$#JsWRodpQRXId%_nRVqlEOp+eNW{5sRZS<0_7hJiPR2*{g z1ynQnB?egxgZbTR#lyfp92_+q;V4qOB|L8>GLkhy{lv;7Q4@vr;VX?b(qZoxO=?tC zE97|U@3?1mi4KK^Q{6dMJe=@vYFwX_*vLv8!zx10GX#!wOk8Una8vyDB3$>X z6C4`C`U;Zviz`1H%C_X>W{Rv43@TJytMS5w)R0sgtUp+jx>zv)vsw#Oy!qrqd|nx zmo%odEMwJ>aI~yzmz(@C7}Yjxj8yEem&i-B9B@}s^UL(@RBY_G)tv9>cp>SyIqjIL z<#^v!PKnj7Q%)D!2!+>(!dVL^zg|(l zqZw;B6RECYZm*F@w-OtsqkycaPdOv-sbM>QXkoRuz|CrN4G7NJ*BIcBX}1 zBf3UyR|>eIpGPlnpP`rjYOnFN4#M$TBU^asj$YawUFz~9OSnC1Jk=A71J{omFv1%s zWeH74E)wuMdd5q2S{i*tOJl)cbMXYm!zUMIPn!=yB4^P zR~YFx7TE&0K2;VU>rFhZOjY5RusTkA9BL-0P%!q)lpGi~8B84QP7LZTbz{%>9vCc5 z>mB`X*Yj?yhb?Vn;g_JiTxjc0nd*P|FxVlHg^*X-7u#4Lp1J!|nA$OVSTgFLGCIdI zeoC(gD}@CwVEp+JaJ6O7^~7`IUGbBue;0nku*>NATIXST3vtWnuX$%;+TfK<<&7le zLf8;U$+Xnq*fLueBE-aBUrVFP-DfzH6j*{4EG>8jQ(I);bA=xRCv7w>i?yR;k{oQ5q$FdOVDGcg)VlY$^?hx46 zxNqK-scX!Ua9)v`A^ME>>6$DVKN1|VAM$jSe4(3a9u(HB;nnHI9i2>n}v&!hoyLcwlR z_31;YU`6>_V^KLvPD4|rW(SLCMnC3!7;mTb(X(kaPiAegyG@F6EZP=x1w zob96}r?u7CV=gYM=ST1Zy^ zo@NeGx2L$9&>v65hmYMqpgOW2di;?)DM@9t-B=Wv!?W4md$v6IvgLeinTl=sO#;zh z&)nt1G~8b`oG#fD&1{zJjKM)LTD+xl>^8L2{2TY#Bsf6)x<$I9r52LC&UJ$T#ht6J zf0UMe?y{`^RgQw&T_%AAc+WPIPc-|3-QUc8uD&(g6)HZvc^OxR{`wV-0}=pF=mWOc zbHbnIV%U-@T9=xi=X7JO*Wrs(F z;eY#n{n#t=02Dax7uSQYv%mYse8}1c2t^tGxZ5Ob7-^oE7P#vy?*pTJe)sW3mG&hb zQaL4k0>M1E8_s;3^bQ=4%Yn)hkn%YE;cWcA!#KkI=VR;j-HWKH6$a#8-8;`S|HqPI zMAb-_a>!P2s&;U_{s+!>LqX2N+L1)Zzj@fO&mDhPhhjN`eBgG8SkH#PTIG4c==-n#dO`R??6)$zyl=LN$9_AJ89x zRp^gKjW)%ZF9m+f?u%uOw@`0(Jl{cXtl1q+X8KB`5P6vgslqT!x?n=YCwp3P)_3C$&4J%6ZQUDkLB}EzG=6Kv& z+)v2PZg;*j*)QN(hS}!!s!(n#*#QPkCdJkE6A_^5>>HjeXvrIwwQRjaqaCk(c^QT$ zePA;+YJ$5zG^xp=BSYZ&C@m)4i@Xm`0e~4jinahoL&w}%v$$rA5qzXU{Bcxt(gWCm zWQdJ`rPb96Ec)sV^81*KTIar~eWJjn6eW8RYC&Xk&|D?%r zd4s`Yg;XT@AwsdUmby_7M>Kpf65km5Bsb38&2~A)iy%%%^1j&2uAU6yTj3Z50z~w< zDD~(xIWO|@^pvEy%LUa0T4@CyCgTQ;xF|h(RX?oiXpF3sap`NV0?Sx(3=hl?abv6v zx#!3kCDEg3lFxz2whF3=<~L(~PW0i^GUqU}9oo^)r)>zFNRecS)%G(B)`R36Jnf~xE*HwTN&3A zQ&f3dyz!_)E0g=jgW;4#+gV0JqJ_$ak4c!yL5_WyilJRGI}7hb)W=G_?8q6H?znUE zrK3c!2o>|%!n(!dqROx#!^-`#r4ev2E7{Z5`;(>9cI1Ia)r^jJU)9b+<|LMP>QOD9 zU+hD(vTlF9-F5C1AkKJp;;^nK^M+*9Xx*XLWQ#)%jlw<{4 z;?-=vo^)<^nWU7}RCm&GoIAXpk6d$g_zl^Qe!HB1qW-Y&eJnfqr`eD4X!~g??PMcV zQp2q^Ua`$NB;CKw;H=Pc?Y4mx#zWl-I&9!^=!7%rxg`vf)1e!BuBF>s!d-eP{Sn@X z-V@)T|xx1^fbkwK)szrUPc^8IY6AVZG9K39_C zB|C}qS5y;$d)&=igs2SJSy=(PG{7)Y`e_v1L4=clu{XV;|G z1&e>;7(!JtJ^|9ufmTe(HiV{7r?-5C$EAth9Y-MBXB3Nw z9I`D+Nn$ib7rw}n7#On355r-dr=tBjxHlEb-}Mwo6S~OMfMiAynmFs^L9~!9dvdQ3w;eY zg9tg*ZI08BYuBP~gvSf-qq6}Bb%Bowl0JDmkws>E!qQ0+{v=;AVUFe^4U8wu>g4#n zj|h%C?ne{dBhqou3lBN!MB>V(b57Nad5wc;Z-l3l%A@uVe&dav%wOdV4Hp8Ci&N3=^=J<-p?J#utLH1Fle6bu5&J5}hQu!w6`S9)s z3Y`}Dk=Ch_V*4xw9XRxbkw|!4=mZf=;wU+Xo5et2qe92$xat}bv*NBKC0z0wYyH@1 zUH)odWUI`sIhB!Ewl_sl+msEpuJ=vBy|G??|^9b4wM?VcFv$$D&*MA}Q<;yhj{Mw2vPMPB=XTj`lrAJift}f;o`GB%Ig?fF@ z87y&-;qr!@wqDbHX@v-B$nP>0p(y*}lTX&4Hd=!2{PFsV!e_qfViC#}wd#|F{83hb z(R9*P2@{Sc&ez?Q=o?Y^lpVuOEHI~mTF1Fc1KUkH&(Qy??}x{Q?RlPF6#Tc}t2GBH z&qeDNV7JB=Tz3r~|L{oSaks|^a&J9q}O}>YTPTJ*O6-uX?9KyN` z6=9%dA*n6*sH;rZa>TZYpsyGCF3hx+mF2Cu%~E}4oTy^JDm70v+i0m8YdTSh!s^c! zU#pqwdATZy9W7y#gj;atqgNgATOts?mYX^;s9jUtz1B}&p%JL`NuM;OH&eWoxx|BL&z<=NMj?og7kxWX~RAEW4KeE&`xBuG!a*U_ntp2 zFE{XM#34>Bopw3e!EURhPF2n*^Ep;K5ZN~)TQ+jCL~cC}Cd*?utv(V~<;22q^g@_F zFMY)*e4To2J@vNy6ZFw};J2a2j<%-jZRFAxS*X*DPuayyJLgOIrSq7ogpAk}XQt52 z%gz1iwZ`eI1k3}AB%mzu!gAV41d*B)2%wHX`3+sk9RcK4;P{{3^@fj4TRziS-65WB zJB>cvh3}$CuB%wQDEVj?!QHRIy+aoVmo@1Hngkim2g?mH!3m^Q;G{uV?RjN(It_(bkY4NLXS!G<{hnYdhP_aiRUPxqUa9H@h zoGbtn<^%P~ZC?1N_6n$Ui`^mk&*#Ad2b7=ssbC)Up$j3Qyu(v9q}tWQa(hN#Po>~L zrAI8g_?0|WC~%x2yy8#b7Z4y4P7srwBhp7+Ggv3FoFm2JA#qo#2vmL%9Q`uN|3w<% zi@N1~lvE=PJRFksy3!f)dB~l};X7Q(Iyq}(gu!Pbgx4MO1qI7@mZjHWR&a-h20ZYV z5$9JZxw5$qeplKkMIrQt3d`hH{&J?Rk@&x>6+Y5BC3MksiZ_;H1v{8_?=XmIl5V98d&{47(QJ*WR z2-e=+<6XScReTeg(R+F1#EjT&SvG~Pn!_}DT-c7 zu*6BcRGL#?1cE=|_?j1#kW=`Vl%#MnuX|;XxaMfpkw}k|<`0oSPK!~O&L7@K!^7G3 z#q8Te6o0gyxJ0wL5j3^rDfdqtB{I* z_gsG05gch(*^Cx-YIn&rX4aNM@$T5<0;h=az9KK8S~-v6+wl;VzcqO*0tM1UTVFT| z^1%j^4C>$nNi!|6|0OIr1$p8Wn|%4h&?WYv&B4&rM{k6Y2%3-i)kiSJoSJ1a-@*&# z$L`mLXoK!nm$rzomg4M8pe?BASx<5Pm_gWy?uj$^v%63-%lSkL=^5 zHJM>$ufTYBoc;(=1$1yUHTD;H?W-;{D%vGlfvKqv_7_BnRRp9FJejft3^Ba5Q|!Dn zn<|sY!C&@@qR|I!+3Mjx8pClzPQaquK6=T3K&s&6jLW#@ex&NX<#kM(+v$B64BsFn z_-Pd1yK`*%7@=)p(Ox9NU)DI~V^p~nr7XhDZ`{Fv7Bv66NDB zS<^6cv}okC(yvprqk&SYmfV-WrFM@c5^La3Ev5F);X|!>KFY};$x+iIFUr`v+B;Q7|_cXR-tCX%DK|WYs4t_mntT1Nt)KqTG(&&jmp4{$&3jrL7FR>%b(}a zU|n9Y=FaGH$lx3!2nN#-wMyd6Rg>%6ON7gDRLjHf+ma$j5?)eYr65a~Qu9Y5J|NOz z_DYGXPU9-uiS||=$00x-$C9GbQCd^+H|PU^_D{c1)l-H z;O{Rb{%ao!06xP306hFZ`$iA|Q1=!1mpv9xfDZr|=>N6{?St(4c>ZmV1sJ^t01H_F zAbR@`;6c&?{%PkedBOarU#A26kIlCqVf6Cydb0rDGSDZmzP|qU>y1E0Mh2jzr3H9( zfcCXO+g=%<&ff;C1!Qz|09+aCfEGw^2iMoRfb|TmzrA9;iOUOQ?*(vy>R@?wfb2Q| zFOV|UUxAKwP!8&=qvNd}7RVOVmlqe%kpXI>Lkn~a)DB2kpnkZxK>Hx$^$t*lbuZ8{ zkhDMoKx5&`0Jz@91(Fx2pA1m@TA;CJfYbq+!`9*jSsX9>L&oyPew%p5CEEcL_r5=UL8O}!~l>`F%A?AjDzM3()c(~(J>EH z49o)!ZvxG$1Eg_~F9I6YL3Zmv1895$ASHC{0ppqWt0%%O29OUne zj08Z4Dg!VAt(g&MepXHyARlIc)&iurc;hMnj6n0%QUc8vB%`-^gXHu!caU!b5cxr64P@TLrqKHsOCVIEXA4~k1r?1B704)T2gC`QNM;sO+>6$7An0>#GO z*&dJq@^=Tw-{T6gME>gJNYK6whaOZ)@-hikDa5_3jlga?%360Y(58lo22$ zWdvv$8G+^sk`qW;R-l-%0))6gYh>gEim$h|astH`NC8g&`&T;u8wu=xPGVwWdi(tE zHsAm7ftBf)mG$^Hog*55H?T+1P%wv9p49m{>oovi;@+B{rA82mUeo zkH%S9KTL9PaU~^juzdh+yKr)FC9%9E11_lF?5wQ&Zx)~t?Ef9~@dq|GcJ@gq7G`Fy zNf$PdF$*{|Gcyk;Nij1gad2`@vT@dMaMVn)@4t=tg9`@~=Wk997Ck){D5&H&V;-ru z^!CZa3=ZnXfCU^J+<=3PmFWW;XFrF5jHL?{3lCHhGdTF0ZA1jmzfwd5s2@<3q@*M+ zsD69@J*>nX%43I=9TWo#j&+$nEvly6er zm_~kSrG)0V=#B6zczat*OJw7hUsJ2{uyMSMh5hd-FD52sL7RCGm05X(mZpY=g50zi z+X-)wIl_U+HgAa5A;T}f$u8#mhzLDqmLw=n_Wilhd5<|KSAIqDj^Wl8^P-IL32$%j zUkB>jypkazBEcGr?Fmsyad9#)%*^1){i`$lv;1@Xb2c{B)}9qIr>=fPg@`TzR=bS+0pm+l-oznz}}aw&cl4sE&rF#AIbt zQ$uc=Nn)I#;0Jd0F{|PNlU$IY3Fr!5+)}CR;UN*It|6(zcN)eQx+CGgZa+e&C05q_qx^P-wP}qie3}}Pe7byLd_fYrBUj)_H7=`coLt$Q%B^y7f_ zGb_t>(@VA!PIGpRwRJ7-GvgaUe0+Smes|XU3U|yP$8#ltM;T0R?e95%NJ&XC&M7hC z_fVUdu(oQhEoyfiT2ceq>xLU9lzWamvP8ZGc~mUNhreG)Sy=b`MX+w#Wz zmf10-H3`k#U4LO?d4XAF^CYMwF0Rz9d^*qZJ}SP#$Dl9v zNT$G$Qj>sHNup6%F5N%&2A~1G-X!ET71Y%iE6A5r!8tk23GFd)bAt*4I%(=1hU)9; z>T=D5|IgEp=oXt`Y(fjI5p8T-N{&U1{hwnoQIP!^lh_})3OTbObF+k4q5tBHwa=<5 zXrapL^1;h%mHj`RnLz(sI!Bc4?S=m@=StAN=>PT9cgD@MugWS01|}x<9|yVro)Z5_ zVE^SAQxtTFn~90(zxz!5R)_n4(naF`P5R$g@c-xZ`ZxXe=l?tXf9p>o;2)gi`p=yD z{{NX%|7$jVW5qYFeB(yo-`ojeQZLZ%8&hI&y>X@1UuOL`PyXdd5a()vIP%~8_{O&D zSRH>^^)K6ct^eg)um6fA-`MfrEcwQjZw&dyl5br2#+D8L;=4Cy42XyTF%pR5lq&x6 zMFog0-&pF6HQ)I0jW_?zm3Mdl+|U2z(SLEJk(Se6u5xmU_{)O3k#c}9S^vEyId*zun@=8bVX=Ko>GdC*)7*8hWX z2mT7gELK{e@fiK($2U%S<6bIwr@tKj#wbo+|1gS@l-ECO2~q&a4*>yQ0MoZO#ssl8 zNKQ^5fq40izu%ZSAmJYl*AfD;rxwU(AiqfwB>+-F3IDLDRszT#0g}s z_8cJMA6|_BDFLL6w{1}TC^3Q7<856)4D0pAu^>gfv4$!#Xo+W^CP@KFyUkE7phl3L;{$b&Qj<+%p_ktAg#={_0 zfRq5@;*2+e*th|t0#IBvfK>1=P96s-BVim=2P9CeMS%3i&J}O$+yP?ffq$M|{F|Zw zSKvVGcO-atc-YvWEo{7hZT+WGY&?8iP$GHTAi{-!fWReshyAbgR<4InvJ}Tgpp4%| z2#&+X#^%C?L)b+`Bo2YQ^bY%-CO&SQvN$*aI0dNC!NCQT9PDv$zzGNlC_ruE6B6Ly zC>d)Qi{h|5`K6W;6U)iV$2qxD5aHwNk>FwDQ@HSO+EZ9Cr*n8vuHS2Go0yuKSyY9{ zYk=-2jj_RGDFSHPxP4p9nw))hZ?*MJ$So~N$<+D`3?5!JLFJ1bsz#elLsV4!K73kQ zx1UTbEy+zx3}z^B*uV*K^{~%WUteCR<>n^p3#PU7^-am?=*h{+XhONT{D0zr6XL5V zPS0*p%QP2cC!gq=nvz@6)6>z>7KbNgMT!!M6XLcO2nh&COAAQ|7Cjo8l3LN*+R&5H zo;I%b*F;f@zI&&AR41GxD3aGeJbGY6MrLKpz+gkG)TyDaemF+OTc-Djsx!Qn~n!^ zeo$aAw^Vui)VQRu!kq~%t+9DUzM4X8rns2U8W=MZn4KM)Clyshgv8*aqPC%tF&>z4 z$?)|`3vqqV+S}?XD=#Hb3Q7s5M5lG5y_)}BQ0lssQUY=h;$DTnpFTgWs|MdlQ z-G6-o4v&t2-GgnQy=@H0P3{KjYWjipfk9w)ZSC*9$II(8FfhCfWMmEk87Y0h?#?l& zk4M1G&kk_&bpb4O(g8!m0zgxt0Ql)$1!S~N0we1Oz`^MWkeS^Ic)2wIetyM(g<(37 z9NiD3*46=uRn0(ndOMKTJO~7(b^;c<^*~0$ODFgh2T7Z_tU7&gU3K%+n27ceZ0*zxc zKvq&CkQg)qc-d6~fdQpJYiBo*Qq&HlgRTv!WxYUXOf6ubng_VJRsm_ft3XQMAyBn? z3)HRO0u3u?fVX`0D?1&i0+r?EW&<7VZNTN_B``ZX3oI`$ z0~Z$;!13`hu(Z7N_ug@LcNY{RufP*1UYuAE|EdENTf8i4fF!Rxz%L;OU~x+TShD

    uXvAg7Jx0Np7~pDX9L(-+5lGne~y(4 z9`UcF{s;PetIGzm|N5_fKfLt~I_3-ZA7df^?`-eCm7u`i&Zd7qprXK`puoTagMvfA zLc_u%B0-0sTwLAUJv_aJid$$)H2{D^OYD7jP+V8KXVupJ zu{B#$wN+dD&;GI1rK#OF^VXIeXU5O6W*AwPJXSIwTOP@lo2G#lO?T6Yj3h)BIcI2c zY;w*yi<|@!2oORNLMV~(Z@+UJFp^O4ys3IqTe_;lz4zR6zVn^$eEFO%z5Vm{dV9US z{(16TprGa_?0nv>JpcV=*US3v25&bwuln|~@m`15o8t73D7)db+xu=bC4YPSzP7f8 zm6a8)kRSC-{mynfpP#SWS$3;?{`>Q=-jo-1wr9@_XYvOzK0c1?*RNxCb{0>bJOTNP zxO?|5?%lh`JufaUa&1|kt&7c-)lsYf@+8 zgZ&@5Q&UqMUhErN+nw`a^JDzL+O-j0ZSC#2HZ+7$f?G$liq*u?xUR6awuYUZ9U^Hi zY;IS(yU|E%Qe0e&l#~?0DU`$2-rgQoR#s4{R8T5akjv#2As4F0+(zbqb{=*UpM)a{2P*?KSfD_NMjm;odJ@a>B)n7jfD7 zGQ6pd(Wtq(g~ONe8(Z@hqF-TQA@U0fkV?3F`}tCPcf=Cnmzx#SJo<0vdYu z4+wzD)()4PopHf|=&VvgMtE2<{0JwB%mNarlve$gwWtpBt{n@Ii?J;QH2PONTm6@ zLLm`DMQg=ycXf3}oF`9;O35;>UvBpEMau+2}U10L0xx0WKv7WETphj+dy_+2I+Y# zTy%;-pidd$)r`pGE`+6YATpy1(OKPy%;`dW`4I9NMv+}ZrSTdH+eXpWJ%gyIaGd88 zUz&Ns$14c=d3k8-=to_9FB&@s(B5|q6;1tU@1MZ+>ARSkxktD!V}x)5HjnQ*y~MlzQG!MCaS_OJ$4>ROnI%W?RF82syhxrG1q zUyb2#F&F-s-EfNQLQq~G{ECL)pqYj$Uw-tq#3I@O`5suKwrl?VvZ!0k#P>_{eqQW8;ERE4t2I#iNObPe`nd2xx; zpLw;dh{`B{CZ`M~E!`;Y9zaF^6f%mtNS@Q->zt1Obt$fxmEf{bAufMk1j*M~_*O3o zU%wZLBY$v)S8NTuv%BGuHHv`3Yj7`^fSJz-PX%84c9 z4zD18@F_}q7m#n&Nh7Yr3E*YejZbE8=oW5JM%HWa3Ih9-ITUaCFar z#5|MiP9|iMG`I&ABc`wgktC~rwKot}e+w}Uvq-o)kIa!pBn>}7){Q09-d;!5ofVW! zFVUQqk$0V~!8~e6msEBRLH|$o5T4LLV&)55>jaqpNX672c9*=M(GYJ(g~2bt7oM&z z@Fbn+?-vMdRyH!4y5JpC47cE7IQr+n(JLPpNlynPSHdT@`e|Xb$t<;lgr4TTtw~6D(dg7 zp?u~ka_Ko|Y7rGg`_|i!kdjn~6YsdgU~ei;e;S3eM;Nlqz6Wlc3& zTFG}L|1X7nftc7B@+-CQ4KIL$Ezy*p3Z+F3jEz!p_WN|4`#uFqn*x}MiOyDeP+iEz zxpT=lbF>ip2b1x`m#O&SSOh%CE@`T}iC4x^!t_bcEt1W7luSORvW(K%HB{bPMeE&l zG*M}}w}h(uYbd?-2zBERP(N`8RTa$$bIyjdGzT7*Rk$Fk!P$?rIQ74?arS5&EF?j& zRQtj4axmhPvN1L`fuZ36t^{l9aM?`@Yf&;}-=x9#uY}uy6#TG18D~GI`(M-WJ<;Jj zeUs{^Lt>Z)dr=nr910P3B@ZQaJt*oOMrj}U+Sl)(a9|F(Bl9SpdW@>M71TUfL+9h4 zFz{dlEsr+PvqbZtIn+)O?&Gr_PO<||B+3V;P<`VOO0O@VbZP-5_nxA9 zfo%Na4Ghp6+UdDv;VCMnAE0Jx4&4*;2#ZR9x4$1U^Gi|N*oTJZVbY&vs3N*FH}oJU zvl*J;E_kWxVR^co=8^^nr$k(G@yGboZD?9XkkWY#scmCa#u3%ni=g5jxTMxV?vjoR zJ_YcMEJJioDEcnwhVvzLmJFY3Q;$36MgrWi60)I;^qPx?ku8b zVGRS1)(HPqw9h|9-_upJ-JeI*jTwwRT0(}l8DAeW!R3pN@bmSDHa~~_#V+*p4x*{K z0|iASdm%xH2#ZEhaRtgMI^pGB4v9DsYKIWSBxNEpyA;s{Rfs8VLTvd}q_z$~Q{M~k z#Cn94_aLld0B-U12*|BRYGW7q0v+(z)Ij)SKKTx15Pee$H+2Cjs>hI6*pDlz?Z|4M zMf1#KTz&8WL_oX06upmD(Yf#hLr)fo-gj}@$N{dQ1(=+Fhyagl2+rBV&PD}0l^tBj zpA8HML_|acf&%?uf6*D1*5o()dQuEhgZW2uxKFXo%*+B>+xm!yrr;kL44;S)qH#Dp zqod)U90w==WLOx-A)&Yhx&6b?5^wuvUxh!>%Pp!Ls>_78Wf{(VQvlhyOvD71Bd2f} zjxNmz$sI#c-#xV4dW@dO%jhDyk3LwzjXRIvq ztu1VAY~kSGNWQNFZ0)Q_*SSI@4nk6D7RGN}$MVw3R@A;7YkP;2y$E&3l^_pzgFsdSRKYEw7Uxx2FeRS(k!0D^z6e>`4g@B&Av$dw zDdhXqPS2r%_`hrR5&G{x#Ne&F6ldOscW^wMos%K>F%2o&LDZKG;j%gzE`i~QON!%s z{h*)#gocD6DmDzZw$V7FpGfjtiKV5d+p+%I8oM(eXoK{PBi?(YG$ zEDF{?l)yoi1er}FlujuylZWH<*+hD;hVX0wP9MsIjY&G`izc}FSHm-|1sNnu4HI*y zp1g-fx_6R(>9{eDzOga#xi*khQii}t(s3s7aJWP=S~7_+p9aX3ac~V!L4HLE8cE03 z*R`U!tQ;5ZitybRrSK-(!~D(dc=xAuuKcv|69m$8FjWd5QVSuoli(gAh-$alr)$$ZSJw-2mzRDU=OOp>kjf z9mA6toxFvGCr`F>Do>t1K}KE$O zq%#kf;^ZImkq}p-%ag3LSpC`j+Lb^z_=i)x8R`iSKX*8|S`)2JVR9xMl4Dx9niIeO zEfeZf1+e?E5SPSR@V=Y_ch^*kG1K6mSb&t)dZabABc-tudCk3Op!nwQ+&tD-*EqVb z5$+6sZXVdc#I1XXOf1LW&W6B7T!{$3R`@w~!Scr{h)VNXh{y9N7Kn#Z76I2w@i?#WhWawiIVK#T zNePIEPexKsKC&z7F?f9pkBC>-$wyx!cq=sKDjS!r``S8|$nOQ#FnIF@GOB9f;+YMx zBn6`Lv>sQg$);pOZk~#B-v&bh+iAc%RP&;`#CLb6#zo)?<~)1;w&=A3q>kjbrxCJ^IG<2>OY`H;z}|!p?s*d*M%PU~V>;`n_09Jk z?O&JQ-gPX(ZGD63L7i?{U1##XuG29;fxGK?=I_`Oc%xRk?<4#jJ$I@3>4onv1HUD= z&-3lyyYKM2y_J8&zQ+GA*V`Syx7XY2?e+F|J8yrtvwcqMzrCg7+w0lum-te@)ZcoO zb1g4}^|F4?pK*B8vpTz-nb@rz+rMY~`fM+J{{DULjK<9EneDy(t$r*9VP_lIceeMx zb@pRnVPX3W!1H6j3O^Pru`?D64;IkT-p-wENKH-U_UAJ*GBMEKj|UX{vNr5ILPtjj zx3`^?l+5k7M@L5^Dk_TG2WNZzV`F378I!H^7wpdF!0=-*SREHDZpNi-zn|^dHa9n+ zpY9cv72J6WOG`_5y1R2{LzEb20 zyL;dwjdjJ#8_rHnP^neicoL}?QmGU&sRD8-)k)}1#Zn@LSbQETr4rWGHn6vMfQySW zJlx#4a~6KSzDOsU4h;=)G+<{kLPA2|>go<#cDBOW8o4DE7?`<@n)Y6F-5;65AR@D+h2gWxdm&+7?^#8*swJG_*Ed{;)_t%GKAXp z2{d(2qo#8dL!&dq14~?-nx36cV+G=(t0%I{Ti_Ft4d)9%5TAF4lUp8YhGyY>xd89{ zcWZq1t`l6M+TfAWiI}Qu@F|!=eC-|Nj4UFe_aWl@9;0;VA<8G_kde{>*;lmo%`>QK z8H2X$DvH|%(AYhMk@0aXtt@kL5T9Lwh?E@URyU)n?*=sK4e+?Eg{x%|6sNRMoGHL} zhcfW-|8R!6RD*zmA^7AB<5I>LWL^_UZ+!&K&=S(e7Lj#r8QPAA(A3VMzT-L)LJMhb z{od7C>kpdEdR^zkKB&8(v4_6qW*X#9yMXuZ1tXS);} z``2Iy4dP(@RSJZE3no5JMM-%vva>R1{0L4KuLR~nX`Te}*%X}pIvM8-(qL+=g-DbI zGoy5T|JO_ikEg<3nuhecZWIkoqF`W_+lwomUP9&E8d~Sp(RP0gb#p5yzsd6B4^WoZ z3Lo2ic-quJZcvUhzt=)&6hU$uf*4H>ZV(Sl-MWdS`s)bIXoIa?4kTyOU}=~R@ySG} ze@KOcARR91Z1{VXlP)NMUu+9%My60ZzJQYPhbX)I6wQy;(f@D*T}vBiSy)2zt%t}f zuSH6_7BvlBC@SwlNog;#;@jZkR1NtL`7k+`0PlcgbPo(6p|KAsZNo@z8%12xAg*N8 z!zH2uUbH50#Z5@AYK8TsVjTOT0Q_%qP}e<)qP`gvU%QX1^ULUYxPrdLRn%R-h4kib zbdTPJ@SH7dNH@mBX;4*DgHqDR;W6O|2@N4V(23ma9(eg^k&=~*z?ew*#>UZlr@=od z8yB4NkkQeP*oJoYo7sD4NsY9J(GX(%e@tHuo6zj^Qwu zY0%I#4o77GoGv-SR&4_Z;xz{cTL{gZ5f+h%x%;!521s`{%_D?#W1uU1!rgJk*iE6*5FJ#BOFrR9Opk|Fn}Kv~3PeV!2=%WaTenVncb&^WGP`GN$%m=Z7?yToDAbOS zewPW!w_50b6^XA8XmIwgS}1>@wRb5+KvF&8>IYFaI)&=NNeoTQ;2zmuma`j~xDH2G z;vZQ);zN4jU|9htuY7p<7UHr)J`6u29UauLnfv_NCRaC9qNcG5C6)9&F${8xP?&w4 z2pgj;D9@$9##{p%`*1k>#v(i?2Zu{aG_~{~DXkQRrA_GQ8ANq+J30q@(As$w zgG0l3M7EmCW&iYZew^ieH&~vL{!QPxi^QyI#HLjur=$g$Sv8m-d&_da&-+1J_J8MI zgf6qU@yd+jR?hopKT4N3-J0Jj;c=h*m8IpyZ5Uf?t}7eQv6zbzbJdDfTUa{1>q9X?#&)wNyw?Vi*82VQRgcDEeqzxO=$>&wsm-bO%g^9uhw zzuVR2DgOMQ|2gC2ooD%X?o+;Ozizi!mBm?ugM-`g8N1k-+0n643=a=;=a+YyhOPcj zC}z8H;|3ZVnF~{RYNCw2d{DQY-nse zG}=4_N9N#?brOR7TJY7USKt!Y0l)lPNa=ct%o}T{8hwJ;kOsu37ebSfhx(QdZv3cp zvPU^Bh}Jg3JE#yQXOhY1%R@}#4Ma8FL*9)g6iqClxv2`KFvKzu|g!aX~1QJD)5_bgP_ z)+3r=gy)g}9$Sr=@>Y08lV2q$MsofTYNj8f>&`r)(i#vJo(W%nH=;u{`EThM8oY(} zt3$ANRl?rc7E&XM#Y|Ii?weHdvGNdC*^7<|ivJ(XLz7U6i}ocHOJ+b~8jHxl=IwR7 zH#djdcW$`qq?OPgX9M@`fl0Wmi95kX<88%)kOZneU67#SJz%^M>cls zkz>a`^7FqB;e4;PjcuE{{@flX`^HT3+S;>cBL3s`)W7d{tNYEA7UBc@&4hg81N)UC zrC4}CPr^H)7RuEkp%qVR!aFFpktwC7a=y&WX8%52lVAUe{o8LLRPuQezJ>6!J?26i zE2-RAv4eD{b@ zEVkfFc6|8qq(Ugz@qY5~$sKP721j?i9Xfb$#~XnX$&?}iPoR>kg)c)&?^&co=OxB` zp?JG$&w>5>bTl)P8r$%UOa)T0RQ}nX-Ji%3y3;G zIjb;x|HXE?*G+InVwG?Y&x9|aZ+zXjzy8%L)@OT=pGVuL8^r9xU4{}J*w5#g$%Q7L z?XlpC#7gPEnX4=;Rea^26;c{uuSBTabKo#vZo@mcm-m%Wp%4q@`}gq)DD^aAQ#i)A z;l2OKCx6tv{q}?3^9+PCrO?7iDCd3f-g_VaZYLtUp}_UqYGNdo3d}84Ql*eX`J)%x z>+vj90yCb%Oe!ZD(qbBmltN=3A*&EcC5#+OGm(NP8XTr zBR-)(K!2VpBf(ytfk+|{(olRQPbsnxzN5p1FDGUb3wdUI1y9L07fRS*e4bcjB4k*I zlnS2IO0swF-kqf4roQi4dhFX~97Y_DZc4rpLFS7^rV^4j?(-g=5y_#DnCCr?>6DB? zNwjtCiBy}dl~UOro|VX0Y4+Kkk3P}0-5h{1%fS=J4G$eRG~kwP$I$y#V)l27ZGIz? zDCJVNjtAb~%lq=Uq5g@_PaQP;^2Bk%{s6}-x)t8;AXCX@QiYJ~^1)u7;gLhUlc)4g zo-jDXJMjhYp#FC!4Nn}_*E@OSyO%*w+Q@_ouK$PB|GSeUsn7QO@*q#|=;0IkUm6}c zX7C)8=g?P}3-%Bg!ree9kPDT>qOX}WUL{0_f0y{@|&?bdqe6+P(u{Ryy!9Milya3q$!FEJJF23W4(Z$bX>HISL5{sjVHEL3bk{^)f$A2N7{_ZQN{ z<|2uy?v1T3a}>T|W>BKsol8t*3_2~#NfKqH4ezj2$_Ob^^944%-x5FmZnthC8MzXy zon(qYMT<-wI3MG8+)7BvAn(?fOd{*~hfOgfw`0#2d<&7-W)GVO2TDlX&zC6p z+*)n}Q}9fra&GqDO66i>-nSxSA(NKf1`!H4^vJ>-+VWiva=y#!NX}<^^5eaq=&;i> zRx|lG-l<3oltfrQu^XfBmY1{ZM3uB0795klM{F-r2&Dg_pzf@eUS(#Rp26;dLq4HE ztYRjb6C5Hm*_VSyPZ^MakmY0g+u(%0p~1^kKK<2+91&Xo&=-gF4;?>9%%FGtbKV!H z^vQ-4pt}-=039|GRB%zU$CZW0hFS`hTG7PmYJKj`y2PL2Dx?d&k_?ajGrB5 zpH6A*&~Ao$e>wVQ%8kM;rreH+Bq9ry#SSl8M_mIO3kxBMpJ3A_y~0mvUN^_@1vI?V{KcZ{lJ#^VP^~m@wfYq7#Yu5~;}e z*T0eprKE)a#5*D98MFQ`^inXlS1pv=@QnBhViei7m#@$z4y=T~{uQ6Bl7vtG1p{s* z6pMsv;nr7zEBP1Y|Lf)If8$1y>+b^Qe_$LWk$}<2l6~u4Iq|`g?Z9`~-NVY8TObG) zoMF!l*Bo-fCN-Y?_4nSZZhnkLw(oMuFSnLN_D6Nqt5>g!mz2(Bzfaz@f@jGLR2-5W zFpcSNa`K*AD^bvfnSBCyB;X!oeF-zYM9 zzN{b`7!9M}`fCfyBgvqstlbSTm!F)#q6kd9lcjrGDeO{N5X+$lXjC)c+$YgT z^RBU@42Sxn-QFj=szo_lzDH*hkIJ)mITBxmE(;Tj|@(_-&)j0dNxl)_;X z@F^Nu;O#tFtp$^(;!V3^5sQyB<;cw_VMm!8Sev7yipPiaQSE}(fbC`ySupND|Kqn; zmsc;%Zecor*gtfCn5T=6tGa5-jP7J))~HwK07~%x$0@y&i@&55|1CNG_5cxSOHVj6 zm2^k#Pzf)TtO?m9VMV@{@{k37)c9Wxa0;}urH{eRt$E==NKH=S*qO9T8e0*b*NZf{ z{O;+~;z2saadi1e$2NE#CSa;dn2*|08h{Gc zEN?emj;BJF5xjq+L||Y9q{BN(&ZXT+P02Q4LzJC0PKKL{RBs%b$Nc@zIH7PErd!%i zjTIjI;jx`J)%j3R8SPt#5J;C0h}4FaN}qUZ_up+Ul1J#aZNUQ9FpO&U@p9!AfeMsnLv|FYBcBXPERFV0sphRD&w9bqi zV%4_8x22D4p8j2NZ}8<(8NgD$2^@%GrbYdV$X#Yi6APE~%62>>H?^v}IbQp24%fZX z)3WfJPD&B=5$98aE1JmG=rQCZifiTeI!BF%{X_0Ik&C!~ z4W9d{MM?-fj8Y}8UfrCc0CgxOdoslq4bK-b-d;#ymm!Mq~w{=3SlHx3=8?ljPf#9 z&C`~>o+l#{A!`TLRBLmr8Q~!S`&>Yz`XPXR|0e!ciSCIy#pfbq?og?U^|W=FoVLED z_0D)qy(*{?TCaQZZn7^UB{rr?BM>ax_|~$T_C8fjFv574o6wA-)WYTrsL_63<1CD+ z-c<9K=GTFBaGxrc`cM%R&5Pn<6|hA*}k)OM^eE4u|3|Vb!GbFoAlnz*dbDY|KChBv>kk1&%xiqMteEK zgQL`xLDIbeMv;OrE%!XYgOaholAa~+2KDK<73Sc~s4Ma{mN!agEV*^keYFhC2%-d6 z8OT2!9e><5(k+)an@+qM9;1r0E7lm3If7H|QFCOLCt=Pf$)Kd` zRNYZZJ+NMkf^fe#ymA~zn6)Iu9wa{6cOd<1lktswvr2ruh#i8z>Qd?={2(Wot#a$3 z!xUkf_49BInOt5cf4A$!&}j7;A$!zy^$=pZ%U&~&`iY1#pYJIW7^DO1Jwn!{vGvJ* zF&c!4aOAB_u^mDAyxY#e1*s|QSSBVhj$TiV3kMR`(!q!d9nlcucd8od7Ke654-1p% z$u7lmJ{u?`xGsYyA*pnfHTf`Pqr!+VuV*QT$tNeAT{F7o%v9oj&d64|Lkv^hhoY}f z_sNZ0q}UCBWo)lxY_0+MdBp0nvB)5)8s6mrb=N+_@39jW-f5 z7jp6}tRcm`P5qlBHTZ+>p@zQ)HMtu-oK#z~DrfDP!A<5kg46k)zpXp1Afd{CMqQK4 zM7jtSAquFH6%;1%M3>HGl6U&5$5(y56XO;&A*Gy#TU?uLf*4JP%cd{*>O45!+*~?n zRy5V*B>11D8G98gFcm|(DA(HhSOLcH;*Lf3^@{YzWKg?=2m8>rk(HCvLL8-ofU0{Q zTk1nzg2<7HSxb)hxFZQl{a~1WUd=d|Dyp!}5M4Cn$PK>21;>uSt11)yjD{_X^uEIH zSqzf((<9*m2#X*jb6;HdjGlJqisiZAmy30czx)sXcEl@jiqvr6SZ4XWiFBXD%bwS@ zTEwInQ(L5S!2z#tO#hy?0=tI1|=yF9=T3GqQD-ny`doGKB z;D*^HyumAs+QElG`3Ouh4E5)L%@BNQCjiG#ssS04%zPb{5kyfBsq5d*jt6nJxf3 z%ek?YWL7^Fbni{E=vaEG(h}Us)p?asp%~*;n23f3p3p=`O;k>2>#>U#~L0E!?7^OD~dJOroyp>zNQH!1)S(ZEmQP%ZL6zLGc42F{rfEugh$?Ur~;XM4i zkD}HPhezHimwGtt>!Mj#?P?uvkpl_P&P;`n0eA?boEh1OZ$0J5oGhOu|K#Kzm9lH3 zmCS48$8+q6I!DtW?fC;q&^luh^MTtn_QVrCy}h{|7(UH1LEnSa*(nkO=&|G{EefMd z4`?VMB(`f7`|}@vVzJAfO@|ELAz25ihvuS|%)7H{Fr%iT?SOVzu_;0QLD}g@rS4Wy z(w)DQC68O`T{Ob!?Yjf#JV>1#0SQ%|(ue;-Hku_E)=r#4%`QlyYCP!(g{i)6N$B(& z@(-!TmT_zi46mrmZSvK+32N!GEp#0%PBgk4^8An|?YM(ov{Bds+TGjLIVENM5~PcI z)#PM{yi1M5VDs`^#4N6VYDKkOWC!&!FX7TsP1Y#~7Ksw2SVV0QCR*pq2I#c{gAJvF zLWf&Q0u|9Fr@b;cH4N_eAJDbI-wOXz+_U^2|K_kf9MJFHn z<88psn5r znqyHb$^fOxu_5Zrw7=fH&+VjvbP_lfR>|+aiPSW7Wf?tTS(SYATz@l=x6yb@mddOM zkxwIir0)Xh)V8kAuXde{5eMNKRpEp%+Dq&Qp=>aGo$cf&qY$*QJ-a)6wQP2}fjoF* z%1b*Xdn@2kZxG?ORc^w%y7IW^LfqYVUx~$AP#?Z%)IBe+LHi5yNcmY9kro(Xo194a zvqr)c!!>Yb?L$`+9MclV4vX9;dwrjouBw@QjKT^+5tOx(#+zJTUUf&oBiE-u;qnJo zuibATaeOlLm8p$jZxP*lfbqxBi7^<`YYxe5oQC{8yqc);28Tg+?CetL!}GUU!Kjry9zmg(&jstiT}RuWm;5s@X3Hn95{{nm z=WE*D?lt;6axlqmx0~fn(a)3R_uqc^g41b+7td$wX7l8g27U4TI{Eh&W-DMG>z{rf zy;orfTm0OWM}UvyF_imXuIk&%!K%K!)JBu<)iMuv`EeWSu;DC&Tj${cSVU2A-ILr}V+*0N;B4~YJM|K zo}XV{Tq%cjikYq^)L@2(*`#Lu)Uid)>w64=-OsbT+2bt5u0$weO&{?mf# z&(g(g?k@i6#oIdn4LiN4!&jyk)*y#*p{`0XjLk;m1?kc{5AV#QX-0k0Qs1zJkM1lrqq(uXP&ZHZvr!1@wP0i&Su@mU*{lLC z23q$aBC&09Qv3yVrC2)pDFA>&OTArdR~uKB{mxqahYHg(hP8x{cmEyjRv{IrVyUFAl8ni(pR@Nl_faJYLpnVl5=*Ea_j&Gl?6Z%h2toPSJ!;9?+9m3D z_u$aHkyzi}YhVp%UaD^1HrJ#>*$^Q$QWeNkl*kPJ+@DQs0y}&<&!~~9>}<4dTgccg79M%-UokDp1D z{=px?d;>Ac>DYqEvO%$)DF5j)Jx$9|UX74@pSqO1S$cbmRNU)S z-fJcz+W%Qrp|-*t8G1;M>`fRiS|8>i$M*feqp=%%70iT@?Lb2c`(fphZ4Uf!GS1pr zUqtpzyPra2|5l-q1H)$Q^e3JDjw$iyaU&OWbDxKpY@WY9>up5}%aw;`B(*~ksB)P< zi1`1RXTRlX@;=QuI)6(M2fl#z_s~)o!11oy{L^%%ID1g@RI=_)!a~JiRTC)9g@9QU z1qxcDAN`~`_^Sp_)hn0jDXUmImwrm+7ieEEDn=Ddq4>$Kkf4|myOEV$LTFPuGXZZHn!RK|ejp{5dQF#ME8t zxykwLMaArhI%b&JHHN`SecWMeN98mv(EVZhS&r6R4r^$y(l`gOwZ)uMy&BB>IR0Kc zQA)4!GepPk;ZYVD2@R4wd3=~8iWfDA5(YH`aDu-+PZZ4vd zl2V#_(+TU@+c8{vK=$FSSH~9Hm`=Jo4>NJHKQ|to|cIamlQ;Oy_}1b zxatp!EC&h+8t52nczq4~d{5nRkvEZ1xlvl)=}gK36^kRpAA^%}B~<{ zEi-JqRCDAk6+^>rPW#H7-x9k9M`26D5Kg{vo{u^~!aen{UN&*F`$;r!*ZQqCZA%qx z3#Tnru_*%D;lP2XKm^4wzZ=r}V74%kmHL<4QT7F~;Z|~=jYiwmocw$k1J0-j|GZyL z!fdw^ZIGDqC1jB(MhjOcba6mB1Q}`P5RY0V%PdW1keQ=pi;hpI@1gaz#SIiGPsww2 zC*Wz@qUyDa8T8-wZ_^#vQ=?Iy?p($;lKZP^!uGAcw;}**O=31xcXtFypMQf-Ux7D2 zWa;l0^l)@6FkVU_&JfCX{o^4dPL*k0$|*Hq`Cp7Y%2b@=aac1*&lCen+;T%(2cvH2F^# zh?cJk9IJ?jF+IyNCi9)a95*GLiC ze(M2r>uZF~ekY?`}HXB4$K%<i786u0DJB4Q>}VcH<= zP;#AQ^W(+!mF#V8zY7dFb%02TINQ@_+}|ldiI?SGjybHL5h)vzUglNq*NpL0p)S&J zrdN;I#wMqTNu6gY6rb`cmF>{}RPIz+HsJq$70K(?>e<=ruT4-*$XAQ&ClW<2Qv2fs zq`Pq>&68>M?nKXjNH%{wzv^wNm@(7=)vUtf2)q|FPI>TS3$k9>Ov8k)S|W#^AtLrW zo#P-P@ahfz+Onp{yxlSnmnppum++zRJtB`SLi_s?@xhfteq|@>Eu4eUI6fD ziKLKkASMwZ0hy)f`z0JgMu3ozvtk*?kUU6iIFQ#tXGBa;jwXix<^4k{3lYHf>nLLk zu426qceeCKu}!2WM(+`FDP&Q|p4nzfd!S{`5r~?U^#nWrdz2fQR-T?m(?dcILtZLF zMk&^w2Xf~?u7Ea>fmEMr6FsAyyqA8;=Dq_I@?kPxU&ELy5ZROUG(cjL)nMlfd3+vn zFF(r~L=F)0Xrj#gE9m0V&~tekv|xF!_VQfS1T;ZaJ5kP#RkR-(S&?3LuSy!!W0&5b z@LC$T^j8^?4VchH4slx*6GiUKCQ0o+E_B=|M!`M_nzem-A(NQ;mo9Bb>hLJSz4ejI~@<7c^31E2U zkj$qZVk{@rWTeSaaMijc;`-}wF4kd?seMu=HYIL?;bSuf;uXA%BRHBAckupNA_uyr z(u6%_*0|w9k6bU+Re`(oft7=vLIqURts56ui#|cUETK2yAq_0)*%#Sf)NlOa8cps} zwW%8`Yhki%#b|G$4CFnBl0HN>I{Y{%NqQ$k@BBc1*ZCE*_njD%FAu-l!9U-ByL)WR zXt%4@Nc1|n+MEQ^99}o^YlO%$fM(q4uxHH410n2&i3ZUq^)ieP)Uehm1>xUa4m%xl!91)S<+6-S09j;LTX{x1U+ zBe|l?Kj)SK_JDMfGMkDeCKIi~$aD!O)sUhf4T~6HB!a8gLPBC@p6^$9kf_;5$19tEyWJdE~R;Dza z2F&YBj&&J@NvQzo!hx-8r$#MR#>su(Ad)RA4X9q8GZsfD6MilCrAzs z3#BE4q(2wgiiDVD`NFlE<9p(K-zZ~((-^>P1h%fPIa&*~4rj@CH!pn;#tMN|`DQQC zl;eR)P7rF7_XVwy`)QIXNUh8qxzWJ0w@1Jqn7e_K;MJDsSC)4yE65!&3r}j*b89`0 zEvP1ewPitHeG-w0tcX?|Jzx`Zhwx67R)cAIAzR){v~kM7P&)VwN?IfPw1ATt%VIZU zM1dmI38~HClD8h4;_(Y5nLHRx`p|O&k$OIFaf_qqe4z@uOcLx>3D8lOz7dor?4)&7yYUQ`jmzzLsY3)PaM zqdWq=iHsbf{}?Zl8-e#RQB4}7jRoLYfRrKWemGG&B;V2#?Mx%@#i`@EU(oh?3azYW z4ryq_iKgeqt+&?l`M#4x+q9CQ=A7I1(y=n0rg|>E{v^f{_MKQF52n$R7NCClCek$P zWKmceTMHa7%M|_P=G@m)Eii1jE3V>om$`xa= zoZ-BWlI=vV<7rd#)wLo_Ng%VoIKPhMcb0mU*gu`N_qKG3C*jkzhV(u27%gkL|;=D$-$URx5DkZG4$Czl=W}2R_!Z`@6noM)_ zgW)AQs2niWx=bN(dY>5&T1bnxoRAWeX`cvIxs4xd2DJvo_pYyP$_tHNP?}}wa*>$Y za*%n(Pb1X*2(5BPD6wGom^p_h&&XyTe1VnGL(8GCNmk4nxtBCa_M=>Xj1Xd8w;%leAtHwm-f+kwF6fy6MI|Wed z-m{$7kKtQx(|_*lZ69uTEm%-5JQarxJS}T|W5N~cYwfwxk6c{Ny-9?!IaR1&L8rct z9R2O&_4d0OuTO}jH_rNE^k7N6m=j#uBnDlk4ZwHX$X!@pYn0gfYTm-IISISZo`eSe z`d3**Fur%ho?}wRjx=3bEf*22`Pw>igt7&~rs`oyshq8m9xdrSwFNFTB`@>1l%1l7p43?z3nh z@)QMb$>2czm?%}>9Uiv>O(zp+|IqS>3c(b8pYVJ6x(9Cl#q=Q8qsO)ttE7cJrTET7 ztD}&l5`KTL&Myu4u?UkioXbbkQ>Me|4_dnIdnm8+l3!V6DH(n+i*e>VhfzY^u zG{nBT}4=io=cb}@R}(H)ZuHH;CJ;z(dlxNuT{$v!YU>#-3OD;i+7zIgYq2}z#&hSqYN z7S^mb>-0XJ8T-V(9=g8nXfQOEbV~n|cYfjt0(4!;QBgG6SXI~UxvK`fmO0FJ?S^6dFk@DkB zhe~2TpDFv_=Lvn0EI0Le?@wyrv1{PB+Q8EqH15JYJqs;-=GNHV>mEd7EZ_dTG2ZLA zE*#maQR|c9tOif1cjC`^dDp%CSYLkSGW&WnC05LmYZ9J5d&rKD;vti7f8vnsdLh`c zX|I*wb%|^L^0Xfx9oG7A_$T&Z&-bCbZ0TN4P_&!*PGE-qlc(M9YfWa8MJHw~!)ft~ zb0vHKJxkAT-L8rE$5e}z(!HzV{gQR}O1VhXjh{5U8qj!Q321c>i+FlWeRKr;tKHi7 zJF0u|*t~{Oe#1`-J$z0s#qZLp{;-|js6rPgY<8R)Qcsyh<@lY`D?@{qV&InBSHsDC z8f!=k`i>bQ9{L4!r=95SRG5BgCwvOTys`JNM*Y7Lr50C~j?K#-yoD@~e;-al?vsq|4~QlMep2Syz>(^Sy$f1AhaphB4$N;& z)^NoAm6@`LB?Jd_@QSUkIqiF66@YNV`7JC6>M@}TfI(9Nn=+R|6@mYBrCS`t10#*# zmBkFni&U^))`=lBm~#jaXs#gTxB+oY-pB^!U7>6SumNtbd$1ocRY?S8t)mJfc-2q~ zSLt1zf)KF7VJ5=dRcDbEPB%4vl=Fw`35S_ZKTjG&w&zJBtg;lbkF* z%cQpxt?P)0wj+DD+9eJ1%@e(gm7VGo!Fyjv&{!&l$1Ng>!)4ypF*~x*5Xylw1CHF> zMbY4#mNT%z(m~;p2n8EFnv<&O;;_(1Ys2d8L^GJY$!^LyvI}JbkHQ2R65_Ou*mv2T zrxzl<zr(5OYb)$<>(j*uelyWc(?L;-s~}=@Uq{ zSv){FAzHShkw67yKlzZ3MD$%`<)=}mo0>b$Pq3zb*x9S$d@n$fNPaYs!Xf88SI4E* zhipi=De2r0Spim78*w@R{dZMI3G9J;lk&q*4X7~5&~!WqQC_m8Xtxqy0%1%z9{?Rd zS~#E>KFa|%am7L8Po_G1ROTp~x!OShUf5>Ad@=#g07XE$zsy8zx>^w(g%;vK$9rS! zj}^6gF_TB9W#I}uVMNfJ_^I$9D1>RKsr{jQy4+AGu*yP2#>K)Bu=PZ_ED*(FKQAhf zNLk%vX4GS+xIzT~oRh`S+G-cdH?#^+PmYs}Ib-_{ya?GF%5iFBU5*2Kx2=G}EqEnD zt=hI*Xz3Jdoq3Z4+@=A;ZDk+{ZwH7^=H=sQ@=ETLk$Er({l2B9IvEtOJX$$yn93;~ z#f8V|C%R*_s4`JX^m9r(Pm)_ur_d=zjE&CXz{Mre2(&vbSj?A~h~}z{vlfq}G_!oN znrKOW{tO-RyfEbbsUq#GjfhKeL3EMR=JdkB9eW}HM(b;kV<#q)6Yj9~3s=gON419C zy~CX)X#9x3aN{Fg%1Q`Yl*&shti{j(!^>a<2l+r(p22k~!1?59>%TJ+C(p3R(KQ4ypm#|HQO_@nghtta$aUu#JB zcUd~X0%tIO^X=)o|K7p^@!1~^#6vicr7NJuBgec``64E6D_c0tmAGYXNIX?`hXEyB zRX&DY5asdosO`XU<^$=tgZHZjHgJdJq~d#AX>o!^MQ{E+8+fQIepcZ+H1rFQ+ECe% z!-uT4oT8V9#}VaJ{n+=%N3t2rlrG+2Wr{M2WpxvEof>7{7uTzYK+{-w2S}^ zawjsv4T?edW-HN{dVo^wx@4o!%h0!4pP2r6H>aI(m$_yE*P=)B*AModMYjU0X)}B8 zCnWF5>dRI0R@ZCQ4nsQldd+nrNz3a)zYVT@A8LjA39UtsKl+r1Y za8;a);PC17!bC`-FS8~P)|BA*KH||B?;14Y9`J zTA$O=oU>y`>7c2i1~BT(!?dWM0mp5*4)l#^Q6FEdws6cde3z?+5+0_;wH1JZh~v;j zon%r&v&g2eg-(#aLo0~pdzYc?uq!c6eHV4gNOPpEX_;aXaP8H+j7pi}@){kIl@>L= z3Z72o95$46>vIk|prk(CiB3~BF|a5O17C^n=D|u-dX~0;!SeXusl~nQ(K2D7#Fdth z7-plXqJ~O$#`@%B-|Mdnfh7%hRii7^dp2cfG8tIX|ClLJv<6f(_`dg#oP$gPAbDtW)ik53)fTa*+{{T@ul=TP^Dvc&oud8-iicYw-(%hp^ELjW%WFG_p-FOCY@%9*9aU20_fyYCZP8Fj2!jfk)8!ZR@ zbp^hn8)$C>SdK+^3--v^WZ~_h@;gUnap-M)Xm!K`R0BQ|KWcU(1yPtxUu;9`Uf?O; zh!RhXZEzM4kvlY4|6pQiII~i7y=ZmWnlz6M+1D+VCK5mutC4DX6~JTT-{fGIBXLS5hX-DSJ-nQ z?Ux_Qw0v-)JCs*mN<4S*diOazjorO&lp>FBjMg@IA)>T z1`C}?(px3}pBZ@yN|YBFsnh7=EHfp4qXSb$^d!!pQR=N|5cW9;`0I!WFXtyvQdK#b z@~KODgH;S}0Ru{VvqX8?(0A`$j>rqyj79%S$Ubn+Y+o%m^vCR{CeOh@7FJp2)-jqO9>lw`#8w}lA#)jP0? z$i3TLx2Z{$d)R62YGb!Tvbv7!=pnMEWoSvh+db;Ylc*TFg?6i?HM41Ro#n;0C@on< zFjDv1{g`%0zACit4-o@PBX+|lY=K$k-)g^;b7kqj|-T zByHt~gG14H@oDeKGQsiXpu21C51e&QY(__T5cPbNK8BBwxx?LcinvCG>2m^;D+sf1 zL?OsVX|_}5(`-DDnKx+lhx5y`i`R7wojV;G)_?_EJYO^+)V}rr9+Yf;=$)Ps-=JFG zWeGV9nUS1fBshm#7$Gp{w4X!y-Jevl2Fe*ZfP1gDj}JRt_pi>ic4b@orc>Q4JyYL} zt)wRg{{+cuIy5eQ;T2AZ%Q7pnY-Ai^o@X#wPBR!$m}-tyR&2{YWIf5cuH)5O2PggP z*pnQX)Ovv>;y%lvV)$~`#oece-w6y&M=;sGG_lO0m8BzKL`660{nC4%Y`*JNG>Crb zSpw91F31?v9YdS{(N6wXI(yej{?<+|^K4rF{-8Nj2xDh5(l~rgV~XJUnymqoV-Zp; z<^|i*r#PjSwsa?fSXorUG$c7rB?ER^4kkTMf}6?Kx-}^?hrGqN!MMm4rebE8Mk*}p zv<4PRF=t?Tp`auXZgBvM*}3j*coy_9WK8;$EN*N6zxXwZi=#P#U*RrC=1 z@nz{$AjS1Mt;Uwt|CC+Ix=gudyBYK5yg<6x$Vky(cZFB_%xJb(i%ZpPYHLrcIVvF9 zpj$)pvH32M&w%=BAX2%_`dRy{GryuF8dBLJ(tshe04-F@0td<<8dV|z%A?n;s7?O$(fKg~ zIyGawsnRZnrO!pU0tBCI7Cw zTr4t}`ka{;wVZc#JZS=>0bO+Z;3LP0`*|^++>?GS^pz1(O+V>k>xpa0j89c~8_;G+c^6_0FdinPo+JIl_i?Q?U*FEGxw(s&= zg*%n*HN*XvZ_eL-{BV}+idwBHhV|tarKQ)8j+sBET>9Mt)t8)#@&fcmnkfG(@jq?% z4tvDktdC1DSLNg9p1G=bWfRa!9EJFT<8h(~atQbU0#Fnc!-tzvG=y4bl*z}+-LSGt z7CkVFD7~tvkgs*QCcfbdFLOErA}_Ot`^7GM_hVM51y2l!52X9EE$psliRs*d1zgsV z-@Nk6tI5sRWl=9_Ho|p4s{n(PRuBe9|e zzDcZF4MWCPs`h|UMC9Bl4Lvk1W{pT3;!nZxZpdnLlg|xs>xRKjXLKiGd5PuA5S}JF z>nxh(wS?H>bLH9bPF>YT{CAVd`#wAGeeJ11kQs6^A zqU%Jej+Hu97s2POGWMtC^fpU+ocO>a>F1@tCPfw(i@jm#$cEA>Hn=(;paK}Vg{llc z)RWZI9xUGjx+vLcJXzifwNcT$S(B&OpAzibFjGrjN&iLo`jb4vjV?)S&kqgVA<>q6Mw>2b~RlprZQ9)3s`1E_7^ljXceQK8Lx0aRKWR z(q>1lBn`qpl<- zV2sDA#oQOJl7z;ZbRRzuBBgM&gP^zu+7EhN7WLCmir4OKh8ow`toipWM^d1mL)gQ1 z1RWf<`|MN*ehm3^b+RLYewPJe@2 zp)5gcA2ZJpmZf8eIieH>(W91~@3VMEBnG1phl?j;x0pN~Oy>9tP*|BV>0$z){VT>X z9SoGJ)Thma!i945$J|QkdjSIx@pIoJ5R4oGM5!!gH{-l$+ET zf+BLe8>f@rlveVl@6xqkSsRcC76Onjyxpnw0rFQRo2mj~FRMOJ#1=ew#?D_nh{cMH z_je{+)n2EMRm;eeP+7K0unsb<;A#tw)%A)%y ziql9(Hy>=XoOwcDYHP`eY4jH=-NVEzMo-aVF{Ow^%Ga)kjI_h>Wsm4r?S$Z8E$kjTV(-}Lqtpd=;oyr7on})#9mFUexb_ecZstjpzc^W~hG`dqHz3cx<$J3MR z9Tz0r$AQ}u zqS%Uh5S>$BbWyAZX*w+CD`sPXsbpmwh0vKisWJK);jK!*v@ddeocB*+4nIhpKFHpS zY^FIq#Y12Ta;*PVpeidAfUhZN=p8**V6IN1bHym(pe>sFqC@h$LKPhL!k<#x{B?j!g@;QT<5^c_lYBC+NG?f+*b3+Vv z;)T#dtt>q<|I(aInw1kskAklwBfnol)%=DvWgr?RtjLkgFn%gW63=!58GIKd2xQe1 z;Yzr-p}qidVG%L3zu6Ems79KY<`dYcE@`yeYn-Z8xfl|MbyH4&11_;GjfqW=ae$nh z>Z$gXJgCz(S9IM8&AXb8=%g=)_7nlx;_my6eY%(BP{F#Sr}^b|@74RWq}xs|q)X%Z zII_*uaeUQ6@DC$}3|A=S41W>5@ja+VFm>)p zbd|f#zO-tb;WaNUhQ93bL9Gp!@?KzNWk0_QgEK(Ppn-Omeijd_f4%C<35{eCG}#@& z_&j5_;HulYqC#Y!R{wtP4Y}3V>>t!32)>_<%l^W;E2|!Y(`ogu2coZtGKT(a{-x9I z9Br+>cJC-*zJ*?VfMev5s}DL$8~^f(S!=JLON*FUeZL%sc*7szXD#`C-tp+ z1l>n=<`X-&VrJqMc1>kR3eDiHk>qe~aMzSrse_(wY~R;Sg|cv{DgMQT2*>h>dz zJgm*{{{h*2Nc|!y0DwbF&0T9#8_AOWP6Ypc)a)1 zMk6(#i%@ITk}>n^H_yq;s_I4IAs;cXem5-Ar@7DwAVV}e|yMG;Ck1voaD1Y8Qa{9Noj(>FapMT%v*WTuPX8-wLGy7XxyWcnc&+4b@ zz6D_EbWvF^m>;P*Qr|f0vfsZk;}5^Y*3S36#dhQQC*NA6=es`>$JJQwgD55hY0qS% zBHdm7DW(YA{|d#r6WKP*joG1+s5I*-+dDuT)Gc>*RZwRL|I8UXxhcH-Om2BZ@Pa7{ zF|t`~jC%zuWbSNr2{J`9*<^gqBo{4CcTX)e(aicg!eUYqb@pYC*W(NyYi=Fk-Fqp`kmGi50UjY6SMV_W%x|-&0 z)%iju0LU8P*2KfLBHiZq_iPCK;&JOs>#d*%7G8PIS=Zd;vF4Av8F|b}1CA0IY0Wkx zAyW^`K%;+P11SB<}dM+YZfK92Evgo`JWVzS4v`r2FVTpw=Y zptA$bctEw3rd+#+cVAPrQhJb3+{~P(zYqFd(7Aika=~nlgbn58%aCuDly3qBe3yaD zY~$%O3W|1(pd|dr10~HYNfEU|a+3{-y*dsg1($h4yNmmnEdQ?3gy@xObPHK~F7=inFj+-Q{#5gT( z;9zFudRtzK-au|&tK$bJpGKf}x=%8i{W2Osm71KY|a^Dck>j zcgtLnA;~cjQF=w=vfbM1GI)BjUj+gw>K01k?|GGsp)ohVC=^_5Bml;p6;d`6{(v(r zx1e6+xW=If5a+j-{kELLJ9QmOVx*PL9Y|mz1d5MrXSmMyJh)PqRpu0o7;9zHQG9Wz z*5ocFb!bnDua*p~a7}b^0rlH!L8zxP-jl{RO&%;6d1W!P^a9Y@QhJi?DAP~g%RWH< zNY@iGw=J0Ci{0s)Y-#CDvfFmIccP2T;t_Mgy^tkIZ@-?7V#KOWw(ohZL{_rOs+!dc zr7=Ru+mJQJ$x?|dB0aCpWx!CrjRNPFZM58}`*QbhoHblbf3LE`F5(&@NkMTlt%;~! zE87?pMfQ4*n_@7$oEBr^W>+SLAaGpF$o(EFPK+U(dCOXo33@NzF?+22u%uiB z3g(o?Wl<)MQVkEJ0aha7FG8BRdTr~4c`H+CuTp5i&_cz~y{EBUp(U_!>E5ayNd=WWVIuk#{dYOh$75qa)x&K@Q z4;De1`GDv{*1tyC#r$p(O=w;t<63Cpf`Bb!%`*>fQuFCXaaxz-voU#~ELNoeqOyt< zZn7pT;~?huzs}{FSumfZqx5KiJIp-7_ox|RBFPGygcnvyBh2!?JyG-2K}G%= zNWd;E(-$}s$Wqq|Er_2?y%}P#zo>N4M8PMJ$Kl;JTqy?!W{Dg>kF|=~HGwCdaa}YJ zf??KmR$uDSq(XraS23ss)}w6|!dASZ$lli?0P-a(I%s?S(e)Vlt#*p8fdW9l2?+8P z$NlVU-W!!eX2ZrruFZquJQw9f>1M5Gq+=(!Ue@2f?qJO)yYXTY7K^S+ZY!7+a=S%0 z$c^ZaFkw9&(lnR!%pA-Gp?4JcN%X%Oma|C8L&@~;$vj>TFC!YaZkKl~PtvyqokN$*nWWV>`M`Fs?y>Mf9vQu0MyKGIL9L&o6w3!zgb#~9u%;`5T{N!> z=cdX&VG;46(RlOeaDea#!~GlI$sh3iSwh{9zo@1>6nS2m@C4Lu<2n90Eam0@(K?$f zixzZ#`7USqn6+Km*O*R2-Y7?bdrl?fIP5MpQY(a?M|#ka)4`vFJk1W!>``Wuu#^`CiRN@9 za&8CUqYKGFnj!&KySv1xgsAa=!v{4=4_HdFM|}h=d&YMu_b+{b+DAgH7|Bjqp0Ol- zC0v`tXa2gr_8+>x)$i&oq`4mno{ltyP>%~@h>OapzgqIMPOCYH*gITz@{wjwu*d@J zB2gOVw{0_w@je9r@n&h9aV(F@Y7RV4(M_iq7#P*`j=)l;eB*N5Sh>-@H-AG9m|PgR^GsJV%Zb$_MN;rX=hA}@93hH6Q_lQ zKgbFD^RIM* zwrrV}ir?#~I%d^_hcK@B`D1fPXBRVBb4`qR+S`^x{pN&)$z*7!7}VoZAy#gW=%?h3 zv!W)O^q$sa+cg7~In7o?oSK85?V@{)OUt%HP!5xeF;t@Kudm@%uqri8d{V;YFOSj> zM>ffc?O6vAk9>Q0{KS~XaX_p+D;;Ya-D}ud!C9y86vYDV(E1v?b0AML^c-?-T#b3w zO3z=f^`KliIyWh%8RyN6#7?ZSEymFme7enQIVZ&| zvur$Jh#H2v?<5GEJ1G?ZFcf8;VzjX+Xaa0f6%>M7qFRx!;9eUHGcK8E%cAC;Cs_l{ z*9>4y_&2HKfCqA1S=g5^L|eB~CRHBta^9G#lo|q+50YwvGNx5l$3;HBm5oqML|va2 zi_NR$HSC4|mR4~;8Vd-LhrjDLTH*#iFk3z?+Ztf1X@=a2B?sbIXF(BvB3&ls(Cu$& z>xOY=dxo1C;0U1v@BL3+sSvX%u4zku7!jmreU|l>j zL}5Ij$N&nP6Ou`PMdD!8RH5(C6l}!9;JGh{rI#H=XV9y8DTG4iP+*zWO~2x;y{ijb zK1(VM)wx~TcJ43s!}O2lO{XS3vml(u!YR0+A@d@A?h5^zIUMKLw{kxqV?va!C5w#GYdFOT8fpQ8w>gZh zjU;!;Jd5K+C!$3(+3MfgEB5&P^P_4vCuxEd&rQ2bL1;ck;ArX2&5)~%30U;XOan+UyX#L6YKysfhE)7 zmR6$22HA1d5Q_pA;z4Sh?9&yHZM-|!Z+Ajgd|@7aW_Lv@cpbwAK6Kv_cS`MRi&ctw z3+i&a4r}8H8lzkeFr%+E<1{Sb4G?WN3KTHkTV~Yhg6L0MVWL~MB@#*`{iwAp4NFLX8F!QR9oX>x8! z4LRZK4jk-H+R1ihy`cKR)uxag)>bKUIv!pX3j~6vjG+1hr*8&r!ykdj1FCdU;a$en zrRMO|1W3Ydawgl990k)FEs%<{u*;IK;K?-^SNu|6>Y3k3S%ti6SbEyRtH=En z4EM0%l&qa}0?KryL=Uywd#nm<8Ay!2W8qY%zRBt`M05eM_R+Jvj^+h=3M!`9d0#Yh zb@h_+lEJ*+2Bw~HsCCD7vU_H-(_m{_F>5s?<#hD`>MLiw*pnIuUYd&8^gG%dc%u14 zi&FI$4tIhr)Jf0kkUSmW@Ld#j+7{oOb1k$i*F@2~=yhZ(7LzF^;Y)Z&3*hQdLBVbrdzwcpI;eGbo+JHhyLfux;bu@Ylhqswk^$^VBn{9`xuEyAIQ zQ9Pa;Jiskq#-gbyw%w9SuMuQ~i^fz>AnlOHsulWx ztxbxdxh0*x?ounwiMFOxGV5!BGgDJdV*Al9?W^H1cQf@#F9~60X=FfM9PtC{N$5`&&_?3u~+;U-OAd^=o9&rqVVZi>=<~-DG=#sf_sLZWm5v&4a1;O&4u}E^iJli6EvPt zwg$fr49+~AMvGq}t}(r+qB;Q9MYd)c4@RAe-f-Q4i>q#{~h244CLeB+r%Ae@@ zF$=FIVXe?qeSG&JKV;z!gNf^B+e(L2RXH3}%E_C^gQ8uGtju6~O+j)`DGk1iM@ztM zdDblNsFRSKFzn0Ekd>+dXm*%FIHV)#8Tqy0Ba`&>*+OW~(+_L1C-%xf>H7AV^-stMnfm1K3!jnM7^ud3>vlq z@-nu|eCBpc3Z!1?q<;E;=A^biFz#>qsh|Fmy*WM1_HR)bhd0WbNqHtK@OxPRh5(96AY${unXJO%l9WrXu*XW%-fUQ}O3 zEgVedQuB#Fb^a@y6sz%B`;p>27;`y8>RK`1bG?HCLlve(XR1%Grd!L+*0sRQ9J5TU zaP1U@0EzZTw})rVSigQ-YvMRR@*1d3=VRcK2VM(Cj_!8;<*q6?p_sFsgn`o+H>1UR z(ksThrE^+L_~F%^yAm*lc$l15tAP@7hw5d3q&P9MM)8@|xENk`RvbmjZH6!u`Qb{V zzbec^ma1kRQB$aEeOXn5LjetEI1t&{TtL+(;hkw^FIu~Hc$_;lO`@@dp6Q#3MHSLa37cq*blq5S3+Y_l{F;5(e&Zi$>m1C{2l2U+F zfm`!T>saMle?97bRpX8O##o93$C^(CDwdkEjrrhZV~$=rwvm!ASK>vnDa%etrJ)-< zSAlVW?5DY25dMYx2I(1(0H6@fu!!m0pEnFTiFA{!PyH4nQ04%&q8^yx&x)Eb$D9Id z^XXk8{5tGX@fr3bdNV+I8wg@TMaAUT`+cKp3AN22*5*0DtX-My8;G~@dFm#_`h{{W zN~oVse^5_sG?26C<>(xyP$#B7Bu%P2vJA-xT9x@y!w>~5u>Jn83?Kwf`7>%;qa@lKTnm$GMz<$4q2qOpSMA{v5 zcRKBadM{^7OC0oMP`sryBobLYPg=#oNN79R>(?JT?hHA>(FW<9*ma)m`2pdvm5G~Y z(|V4!s4Jpg!<6Qj`xo`%nB|htBYh#759y{TdxkMr}3w&9+%B^vncH8 zQ~se32cHz)iaCosHJy5K*Q6!rQqTyjEfHR0)J7l(88;KXrJ1M;>RP=vA61AWIY5t{b3n#}n#AQ>^xg#U zd`oQpVE`NM&j;g(V4^|i1}C%~Jz=4l6L41zGp zfU6!GELG_A^7`5XreZ1&6R3L-= zCO5|nOJC)&fC6=LvOAcOz>P#g3`W?wE0{gTS&6yKesMIglX?jtECkskHi<$Xptenl z(M93#Y{$wOSpc8aNxp4FNu2P6{;)B)+e1ko9IV#mc+r(N>CTtaRs%lYVC^G_XG#*P zxQ^dte+BBlj26z&@1dZ(YQe|#wFH22G(De-?3phW#lLa#?#NNwg%Q7jQP>yL4WACf zQFW+$a^zh#GCX`lyDOIPpv0ru2bOmmDBr-w!3Vj~z`sNG!I8V~bG;W+05^gcXSo3m z41s141fKwD%!B$ia>GYdfpxIPxW^iC5WZ8Zqaz={+LYx8+=IFp-foiHuB8^V}-G7T+}OkzUzOb{Ic8K#YkqY~`sp4iApnom#!obLipn zhRKe|Y8!$EW~oH9HMKnH8=sN_WIFQ53M9SOk58hNeZLY~7aDqyd1ytnmlBjJ*KU5J z7i{z}p_C5ME*E7!NmR^Os$x%XiPj1V$DfOMTtV`?5bb-C`IqYeTtKIYk7rjy$59IdmQ^rM3)?!QIl=i z?1gmS-qA$wBVI}4BTrgxCTKvU&H;XJd}Ox;kMrX4AFUT#f2+kxLZsx0Xz*(ADd?~t zHVI!~UYfDvppw{DQTSb`Y z?4ID98_Jy?L1k$%8;&_#x2MnzmZGa16thK7R3M*4zY=-fQ=d>8N>N`$1{Cuy%algr zKr2whevm{Z zIvlhgGcoUB^B_BUswk4&=pq@wfWA?qS2I!U7VO~N(aC@G_ut(uW}a*a#-o(||8Pof zcusX+Em-9u-*|u6|E;Z6e90(Ca+6+$kI4mz0|I9j#f7WgdJ3IbjQs$VZ<)|u!&+^X zSi~@t?G2>FBjs_P6c-9FrD~~>!82HeVpS&tXDn$ zjIjM3r!A>O7_zIoR!dL$c%9LY?`~Do)Iu|%de4nPz2w0g1Io8Q;-D=y_$G+zpA%Bw z;`}|&|7Y`Acc=Tzrx~G;KmW|L4f4>#_%-;m3y50G_U|9rKuYqAVQ68wbY&%J!O4)RkRT41;R) zb5kms=Q*V(X09jq&K#_Qo9v=%f7+}bokU&W#M7rXj!xvs@7bvte-RU~s^wU5H4Lv? zZ9>vy&W!JA1xbL#Ypcv104E|hZV@f$qh@*CNNDz@lrjq7bE{H)bYmVv4zR)0bC0Z9 zod~w`bbC7{g5fU;8dEuAp9z>&u^5`y_~>4?YQ1c+mtQa!kzXOrBu@dU-_y%Zt(P74 zvc4wWG!nqy7W6-C^xw8SsmsQTPars?iyzFKz4f*J+h|Kg7@Cm^8_gh>j96DWP)Jg4 zYzN{IWI%WXbmSparg031kfBQBUjE?klCzL;~sr=|*c552J?)E+M zaJBr~5E0pCtk%r8M1$3x(wHXcrTQMVXm`iv3jarA{665&y$w7G4b<-4V0WHemJ6iR zsdI*jGu_6~585F1dR-PJnKG)Vz!p|Q7Ohv;RNzI1J4pH&bm1@0+R8}G&^0_4XGQe- z2A$vO3F6N?^8a6+av&CBVqKP$QCs0~I<6Izr)CvI($i zicX`6EAw?Wm%C_lT;*5Sv(~F1<)Xtd3Jxwb#NTmThs1`U0NT`(@@QM4_N!1zo`}j? zER@R}fu46`=zxlt2-Gq}(I#G5O{L0d>bG8f+eaEUc%4$>C-1tBvDp6D?S@}Z71=`4 zmFV0_s+sT1ehS_2Wb3?wnD$v9u;&X3Q-DiPb!oSW~Ese$Dg+EGwTw6a3? zZ84e11pcfu2yZbP4SQFM%U)G%%0Jz!`PpU!S3KVFpgukduR4L_9nK?l$R(S%N&6Bw zTCi1&VFy^1s$9+!jnI&UBaPwK7zi5;x<{{<5a3YSS*gMr3wD>32%0UC4=?uu|6n6N zRNYIJmFP7sx7el zeI$G`C=O$cBz5MJP;D)oBHla4W0Vmr&sq8s7)WsCit>krOKEDHs8wlz5NXs@6uBwp zw@KmFDm*E3_gRiUI8=7Fwzj;e9Ki?({Uzjc3#Qm3pO#eBGKpbWD}3-a#NM?(!%Jdh z#b)wq_Vw3lI3E4u{BrN`L-*5Q@7?RSA3vXdlrs_FIZ2f3AS7&?0w7abK z{&Q#h`PR!9tyizf8Sydk359q4g#F&|VuWj{F=HHG>n|DDldWgZUbbGPt;aF#X3CqF z{Wi%jbOVB&@8c{6(E5Y_{{8Sjjn_;6|Je4XjS^q|B_owde3?MQ8kLAvOc9dczFXmt zTca3t-y*VQFVb9S%+ik-zLgBHL@%zd5!`tvm}22a4=E8$T%NP8&EB}*geKreZynOK^%Jg>42ehp|pr5_~i?bf0 zK3b&?`^za3H>>l?yar*B55`2!nmMv@e6as`?a%9Pi>9`+a#PjIm&2=xOiC}8x&3qV zZ_f{B7t6)g);3~;Cr}!)H_L@cKg*(!Q-)LoTwvw2=mLeqV5_@XU`qlse@3&(YU+LG zd>tQ&1^-dg5QEkj!-&Tp2ak&*9{62PhD5Q-aq%g*@#OH>%K!c^yzyi<`6&Q^LrcwF z>vkK-aX$IWbNCKpM(YK%Ac(;oprwSQNQn|D(IVH@#&+TXF(hY+n=rtFTqk+9JV%}* zfATL?UsYdb0E(d2PO?7UC4iZ}RCia`^(zR(^l@8)b(c*+^cV)@-RHkt{JEZJy2pd1 zJ=Pb30N``K9MmJBWU*qAX`O*c>jok?7-!#)a>+Pv&Tf)HGTGetr-XxPxCpGkbXUvG z@}0;7D2uyVv|dj8Cw=qy)uFs#IFFOsv;^0yh8h=5MRo)*>Eqv~ve}3j^LTfu&RRyH z{0f&u*y(tt0sf??ooC&kIXhRG#dzJ~-)dV$m5(xl^3JRCb3+~^L#&{Whcvzm@|1#u zz4HsC)74mn@~Gv9PwZN9F%Hw4y=AHetB6LE`9O*d4f+?T8ug4(s$Oxb25^S_{N1c| zRk@t29ioISt3BZXb)KJEvwq1}sq*IB9gc1oVw}jzeHVx+ti@)|jAd{WJsc7Y?6%-m!?4cM&JeX2JutXKU5MxVq!b;h>a9v;W^|<7P*OlO9QDDkro1g#H z)2(MZuKOMTu9SmjG&KLHkr3);Px)9`3*ggEmez1|=@@=!#M!~cns>Qhe86ddG}PZE zX(ZmwmB}CZYR2WW<}z4P*!((A8LCKp7HF_D|{LfjS33I7Eo2BJs$AonKs-VQ+4D z6!NyT33;3&)$u-SP0tQs#Wv1hIdC$dY)cqZuu~4|xt*jt&1_6x+R9cEbugrPdl?sG zCmM1z2N6+_O1OIV;e{<1;`Sg4hSG`2cwzn);Wdj{nhUPc{qp91B2ja)N3Up^otgZ6 zo8gq#->V~s6~eRQmp#S6?lBu~$`!_KY>M4tTArF!iQkiQXVwjtA!img2`3-**jtN% zQy-9BoUK}WCa^YPKVC2RuHMn&q4mUxSdAkH~)MLp!IQnkS`8ptlF3CPN4 zk$afieY~3|i*i#q609I7?Y(In-Ab;*m<7?RnO$n; z3XFO^hlb{KeqzYiP*bP{xcc}uJ~?Ma@Jl)+Phf>kNhiVADO-Ov_b?={j7{0%mT6;o9$%qtagy?6?O5#+c{S_3#YJ0nvz*1bqZp(kgw_Bmn0Z7)tC6F=Zd zWABdFm&M*?EgE|1L#UM->G&+?4J|pXU@*9Mu_`4KQefj0_I^%&7L^O?9npk`7I36H z{G^=vtwB{$4*D)1CgH0TB9{TI7>rOM%$9-6mhk^gx_tzoUBxCDqwH8b-L|!yqBOCI z_X#A(G28SLL-Xul=$Kt1&O6D6373(p5J#ldVB%gJB>M2koTIT8C|)(4TYe>2f_Hpr_Fxae`ZM5M8-$t7o@SKM z!V^TqYTXZXrB9~nvM1Xj1e-B%&QHq0p%x_cg#W?=-Z(ZDvMIR0_FiVC8B<13@Kp>I za@ay$SYfI!K4Ow3iv6!&pARhbtu&6|+6&5Phd@5}zz)sXlA8e;UK!*9^ZSFW zqMR*vGK?lfONQ?*nh+Adl#ZbVGh46OY^INCw8<$enLt zXb)p(Fz1+0C1t}QQa&YGF%#jc<$!{MkF>ZV94;+BJu1?V#->lp{hSH1Xtpwq4@#8= zM<$>wmrc5a3Yr0iwzY9I6pq~`hk?zkwbzy?v3gZ(*+ zm#)Jp5NbwaMLsl8>vRq#Gr10L6rM|UD%xGd9GP3*%_NGH+mLu9e$mzV5}^}uKj~Ov z!{GAh-kZ)f4VN~79sRI1&u zQt3)9=~GfFuZj70VG7uh7yKqjvcBt{eBMi1r~Uiuoi~@ir50*vVUK=d5n>SE>+5*f zf18V|caLu0ewt4{-XDGbp`Oy)A>Mw?`55n{@VdT^r~TJw<9@#z_g{bh?e}}p>z`WJ zO?tgauZP_W`iY(6v-H;Vj;H%)czleKz z5&|T8zZ@OBe0lD^YDw;%ybO0wC;i>i$$j^=B(5rnm7vSJ ze(&|s;#v6YtUlkF-<-UAHmH{0oYflB!Mxe{{ov~0=g-|Rtk*k4?+*XdZFRd{OXb@i z-$d`fsWqbZ-RWsN+Ns>04#I!9TFg%NPRsA0RNpSjt6Km)!)M{Ucf+fT`%2XM`&#+r zq!YE@w8FvdVzg7fc~h-Mt6v6XJJFAW+tKal-P<=m-i+q0YNvfa8SNdveRuNg?M?Y+ zbi4Xx(74rUpM7}Ssm!BZvwZvPc5wFjboNa&I2}x;zyCaMKEtp()%?p?kG;k4^CX=o z&s*)*HxUUD(dp#3<4UXCUimVyz-ep&XIM^il?)o);9L;@W33gF08sjF z=Oh`;?;N^`#46jRt%%Y7txDyG7J2 znrX=|%*8HSVu}Muj8s_L?%mITG{TkXA&E+A2g3MR$|g|=xBfJ?VeV21JBUhl~mbp!IDoU%p3I?_A;Ehfdqc{3QY;K9?w*zXAm$~4_$^zP zqnk(Dxyf9?P_MD$%ZYtb3>}!B8GfYTzcQ%2*y#$?*ms!4A&+$houyVXtL1%D9(wEf z77M0ZcUz8IKzuMkv1}Fxi^`KT$B0aKGEk{x$v|0NN7l_ivextq9qOOJ_EmHGb;;;ne#kM3x zIfZq4fTX9d>VE#GY(oLaV}7Nk;{qE;=?E4#H(ab6YDwRlLkTjEdnuc^WJxvEWyJ7I zPK6$Fh%(cbtJDZ?pDPs%d>)A=6%!1tMl#3%Hs-=jiUxvA_n44eK;&pK=}Mh$y>#aV zYm>Y8gemo6k5i-KmN!u%#tl8+k1vxUm;PAUOS95yg}rLE->O~K>b-tFs&+`g>0GvZ zmCjYz*4`iIOxX(+@T|l!`x)Jg>EOUtgbA@@fkv1zwhx#v+pnaODRcBFO$6-P;J}tS z_{Q!*1+**y?5{sϓq_4XoaWM>8uv7>{ROI1-Qpr9_X?=d5N4aV23W_sQV52-)O zf}^@JlZq(}Xga}H_sWrT{ZXKq$82g#Qrflv&6-bBsoZ5ibTiB+g1f?7RN*2KuCjj2 z%t}jZ(cEJOcx0}POBU>fFEq^_Dp5NQMc4p318;QB;1g`9B?+RJ9l-eN$}lQxGeDgf zK#lUx+i?2`GDJ`?4pm(KTAh)V4f!1>OpEz(R4%?`XC5HY1u9j9IGMfkhvV9Fd|igZ zC688RH}hhlb~W4JRT?4kUL}H2%mt3D3uiK)4#qH1W$tHzfE7DILQUu<@CS|5C4qit z>-gl}9zee_w`@!@ngn0@(?FbSjIKf4!qqk9`JkSIW?VB#*yu7H8P=z+Thsm;5`&;D zs@HDW0WE13!rT3&$L<}D`@FLwlfR)1&Zcp=dgqcjImPy30}P7PTL*Y%PicjEDO*59 z7@HI6Ev>5#21l=RM*t`2hB1lQzx{@~rJ>!%59T5j4&Ll36a**k@%awqcuxdAO8n>~ z8oP^bEio*e1H9Z-VfHS{hwk)9Lx=cEgp4*8DMtbWAZyE&bUw98u|%e)ICc=VxlG9zKg`EOD9 z#NNNmTkaRp{jc-))+OTbg99Tj#B8DYaui0)Yo9)qe)eH=Pyz)OVQj4jV7@ky4H(%VLg*R zQ8LMHV~xO1%>KR8_KYg1YErJ1l09|E`t_S|`Xp3sY2|^jaBXke*&~OCeZ^&ze~zc) zZ3gegnUe~+h4XRAa#Iy44I7hjaE%B{_k~HhT|Yg8pyP=o5A?e6~!zz2bf+YrkTq5Wi*<3TJnTBB6?dmwL5(G zYI6yyb@|D(VT-hooZxQDnJIs1PN^j`VDOb=d-tK~TPuH|hGaD52xePAicKWOuwY`r zMyM!b5#O<8Q;~umXG|Ab8PY335g}p`jk)N`d|dBwvh86{N_? zBbQSV=(LOv!p+$01srL*vRkfSDPQ8<^gqo9JP#A584KPCTjETebJ&gMNSbxWe>PeZ{;mpQ9QkkZB-gO7+Rx+iQ}@p zEn*Z@G9Ael(sV2?njBGIQjEltc33Kmy~;$Uhu)OycVsOZ^sIrHh^0i6E{+xNHaA$$ zp7*HbfmVl}au%N)3O5{6^+?yKKjuAzLQpac2v*F0b+P2;!DY@eyeJhSi?h8|YvZ}1 z8+1F)xMZ9n#|zr7KIrciWUlcIG3KeHslNn|9;O4Wf2u(QEE+>gF*-eCkLToo8+b@G zWx`!(STK*!1=Q4L&6ESLJ-U#(L7T0uS4Xj%cW{0Y9=wwCQu2qsd3X?C%}5a5>$-4? zmn(UAyYs4E-K*CR>6)ll_UNBiwf%anvEQJN^}|CQQa{UaKEis0WoJ$y7wyu?2fG&vDfJ-rE7ioZq7d<`S=D&l2{_#^)!^6KSN;1c<4Yvt9 zow|mft(X95b<>%hfp773N|AAe4C0?Sb5@bCxfo541sDauFqfSSSLC9cjnkR|vmqwX z9f>y@I*U}aD^d1K<_IbMsYNR3nm`3keoc4Cx-lR98#V%)D4irpe{)R$vyvmNxa4l`SJIF+$uj z^~=;y%K^mWkwyBAw0gJ8D(53fTDO=@Bgtwi=fez*9f$#K752m6>%a=oOFqwOU(VBD zkLDYTk#T?Ab5D8rLVoptU9lK*QP@o8Lkd@^?-N0u1`PWvq0CT6W)!28*d(5cbqXT8 zCr=}^h}3VA>C*mm419dur5QoT*voj`e8d!y`Q4x%ml<+&gk>cdBoMU{&IV<21%_HU zo;V)YBpf5#62+((J0BRRu~nBj!V1a_Zy7DBCcaj#WI1Lz0-}>DQuO#WtW3sHdj0Fc zYUeKk5CoWky1Fud4oc$D#6^XqO9+%G$-7gCuGwq+n@ zvd@}^lVpkYn{+w8aoTY=^YMQYptUMci3LLH3(? zgK7D-cxy8R16ZRY_wv&O$3Yj%CYE0jEt$9&>J5I$91I zgx&1HEE|E1QJg(q;@#kWNvwS+-m#L4cMKcyMLLNtwbIZEk@ux* zk)t4aNab=_O9z?n`Pl>EPlmDO41v6^yrS~#c`S)!G_P*(i3l!d(LRJDDW_2zmwT@p zyrTzc82m)NeKf8C3*X=JuDe#ADY>+6@{+Zo- zEbZ9cwzN)bIOF5#O*BDB0^7%|jTcs@n|LsR?}U%NVl3vQF11ccp=sHtvP+d`01i_a zPASj=k$fSbH{`{cr%cc6E!`y|v$KYu9KC4C`!8zc|6g3iY}^;s2N*~VD^vAWgt@#v zoo5=&l@Eu%gkzY)^rH44bC4m{a=kYFAv%UoUHNeMSKtQ5J!FL!zF6{S37ZGH8-%DF zaA0Wj++4_m%&uvqDU7%r9A7Po=7m$%J2Ji3Y@E2dFmUD8%{q4qv;%Pa3b5sSw&1lt%OMqUek%?*Lab&aia zty|~Qud<8?M%T}Cx&j_xOML#+cG*uzLlHTfgAhoV8<1`b?J*|B72Ds$hS^e$W?l;f z7{w9_lidz(|Ei5yi_rkPemdmsjCiLp6m2|}@)JuWaV{9OzN6-{9Izaavr%$nL5&>TB@q|oxhocW{Kw|TU6ICH zh6;$dDFI6YkFHEyCOS}ZrGgm?L!G_(Iv5LSd3FCT|cA)oX#ZqYN8d`Nmqw(gpxYW zpt)oxG1eXUMzjxW`N+r^@Rm52xMVkH0hdWLUeCHUO(WmDReQv|#Sj#d|F;dKFfZS9 zJzLlJBiJzVxLVw<9@x1l8Q>?V!YXPC(Jq4}TDdM8wJb6a7F!bTIXHo~BA1da88{77 zA;!?$k2Elu*E|$6E_j^GE#<@W8N3TyKcg6^r+pRn;^szSX&!>{@okzlCn>NBnnN1@M&vzge~a$X0}blT}11Iwq1;+5FrQ4l!DWei+pvH zEt$O!caSX_S_%$IUZgy$lRSsqMxU?P=m)ePPjSu0zOw1no}Pbc8K&`NoY*)!y@=A> z=)8$|XY{LvdrHGSz;OFd9q#+_q9k&YMA3`CJm9DxUUp8Wgz3}h8-g}$d2y-%H{xUvJXe4)7sVLVB3O06MYc7`pjf&pf5Va{* z=mi`7gN~5mZQ6t1qiP!^F@%LkdV%8?7(|YP>5f;b_zTP|XA8;O}#bGTyke>vm&C>*@fi~4W^FhkWI)hi?M#Wy4= zU(Ll);MaRrve2~p*i11%T!!LmAeCWFj<2kE@}ee-^P=IizzfI6m5sA>x%7y{o5a?I zv66dR<_K}NSg7+KZLZ*q5yUSzlWaw^ecP<)hWZjl z@FyONe$}@9WLj{yKt@l{fXM!fnoo=qn0->(R|~d5N&J@0c96WnfRw}Y!-J297p(e8 zmWKqC+1X&9PTcF$C%+FnIfRqoogW~bR|SDPInk~xWzE;VF#3Op-#xOzzs_p9w@r@E4&_A;^e zh(}Y8F5V@g8@Ug<)RxHNBFG(8P9LPo!4g$!UqzJsJS|al3yZ3;ntr%~cpJ}$T-c?A zT&FZ1_69E9%gt)#AzE9G+GC}(v>XmB5!u4F9pC2^*&*jfDF~yNSIZ%6sZAd>iAa6} zyUuv9xlu2%hmbjJhhzF!bX61F!V7bc`z4$BAQ= z$Dd5T;x7yB^MGE6c_C5p@^N`H>&N)NWeW^#P|eEi4n|M4%+ zc3wRDd6%yA@ubB6pO5g~8+wn!Fn)bK+uhtK{^{TTc$l81@6z{`KMdYK4+ro5(64@T z9#wbx6@Ki~cm3ys)060*pAX)DQ~6Ur{dD);cZ1Wx`<;GziYMOEmv8STTmRa>{IiDv z@#PS{hXSVJ)Hf;BAB&h`Sh#(Tz19>K#UeXA4}QmG=SH)1{V=LmoPFXI3~+T~0AR{d z#633fCnIrNC5ThQO`MR_(`i*WM7%$q%v`3Dty#D~r%}#pG|kq4)<-W$eKj`Vjka&vHVE9|{LKQ8jRJhOe2}R{A~2&? z!A{MKZ4(i5Yq+_w=L6L48Ax?wf`fT)Tg$HsUy!1OF5St8yW+Z|UcwVwN>`!F%?6H| z{p6>1r^Q4C9or!T%PH;Jq3lZ+j*5a9jKXDhw*m&UcI%_tbA7HJE1-qLgM9|;`$CD? zk}3FfM0#ltjQHSaUs3x$Afd(nL^9$B`VHl?CJFOZx`O5KF(~RpGg_%rV>SV+vqky( zu~_)vUz6}CGyXM}H(R^UultnR)Ca&B;-G5~B7i(#QliUyreZy7hI|_%hs~Yn#Oi~b z68@f*aG1JM7{Uy;m)Dl4joga(&k(bU0)A=~lQXG0250or_8iS)GX?{&jtHZB+Ony7 z@ZuHs=(697U;khTNTbXc=yn5~j5J4<}eW|<^!_3k0wmas^ zIV5z&F|yMnLQ-l^j9&(zg(NGMon`s7WONj;AD$sD!Y%(Ki1 z7^hdHo@6BAdE1SRw(P!d6Kd<=RER;I{=A!!oa z4H3h<;z(vu)OL|_rl)S;WabjR8%=2gq3H;EbD%Z|F#k>RlJmF66F6#%Pl1zbIw+3l zWe!d*7X}g1qe~J+GQ19m_mczyU(CM%dTB>L5ECk2Cs&X~90H*ObZU0Z@xl=W-!#nj ziSSKNp5x^4mw0TjDr&ZBmUAmpBU#x&04AfK#*ibzCRaQgi7$eV-%uBu)+=2^lhgn# z_w*)%K`ezD1L;6g)cp$MeTEIqSrb)H+D#wXwi#eUpI|-nTE28w!^kqt5suOXAXSgi8hZN>pb|wNa zSX(E)z?n6ED94mpvLa(;G*vMt2o1BADsBR=PX+r$897jRB^=@eW{Zj!b@tK!<_S}F z?y^z#4B5?UB4|#eA1g+^l8OXaW)eH};esr_2|8!Sd2O7S2ow&R0@C2+#qs4nA4F0J z;=Zec7OQ@4#4_=b4QY~TkG4a#;9$-la}S+l9|}Hw_!wLja<7)&`EL~sCyO3`XT`gR6(Q z)hpT7dM2}jcae}v(Q;78eAXiEbrA^E)J<0spK?nOJ&$_Nmn9t>dsM|FKl#6I3@n!n z)#n+D4LAQb1&HzaZvE|MFigDD2JwV2D7s?JkW*6ExKy;Ec zZGno;?f*qYQ#;~>pprJ`L>T^TX^K)rbepIkW+p6IQtqCy)mRIM#a+2F>9U+M=!oN| zQX#X)S=W;|nt2-t!Wum~;X2|-NTw@SS*u<=Iw3olkJ~;1#3=ai(Fd55r%CL`{7u#v z@3mlg4;T-)co&z1+s%z;Mwz>?QNveaEmf91f{D=H%Rzy(_TKmo_rBqx=h%Hm&@G8ZYS`)>;q@G)6TspyhwJJmoq{nxZ&i>*Qej4LT#|L z4P6Y|&6Zk+h9P`8Y%X16_AB$eB!=sW>zgXW${pNUyRyHrc*1#q@k3$?Z2jAz30K?P z*qf=fnAmyA9R*EEHx!opUqa34cE?O=YNC|Q>N)JIYne0a=-9XdlE@VBH zr6I4YWnseKHMt2I&0i_zxsGs-%D$ZNs1G5(@?N&Pb0NFaFSn$pwMzL@8tMvJbyWaB zzCYsOUG{&hP74n!m9P>975ujn$baZ_B@E^J(ELvS3j_Yh&sF3HI~tKCWbYs2>^pao zxL~^C8G2|S!Rztf^>xDa<}*#2=6cqH^jJeYaGnMKfzk4$>^Bwp#{Pln;}83j%zfq5 z)RyE8=3&aB8IVkfti!0-KZL3vD@Gx7$1nO#7=}ya&><|5_rZbu_lLjxyWjk3dpoRl zwzpsYC-aDExceXf<+YsEJVl6GX|Gw*T3`B>X|dTvkK1ilF+>QQ6RO zV}ihM=w7i9PT!{faajNfL$Nzh=Za1iL>j(_dQ(zVIFjztV)KCkXjuRgt&%cM)G&ro z=5#y;?8iy8=t_xEFP?=lItCV_FXZ&K5p`D%UTdHW-_9eBNCIz_w@N$`If{P-Y?+vI>4HdHUSF|n zd{HH-xXw`Z#Gt+)80-OZ8~46wy5p;vlmp7dmMV-crx+q|(%unjMKY3kM*ZeY2oD~o z6kKy0n8nHI1FZNdagGJ2ABTh@GONba!)O@;}#=T=Qcn0DwbFyj|&1BHNb! zZ-noVZQO{mLKGEnsOodN85L1LKt=zYNFae!Adw_NeYWm*>ox5mfvU3l+P$(3VAMJS^=GHd+BOCq>e&X}ZZty>`2R=hC2zn4 zZ{QI5U7{_;VcZ=wLCgjSEt`y)U^Voa9%wkjxT(UVaXRh%P$nn(3l9|PFV$NLS7zbQ z6bszMbo}%COkfILBmzA!b?Zhvb7n6>PZ=ZOTmXpdQjF-nh9#U~Uqz%EpbwZP7g-^E zj;YY9Y+}g>UB%K!?akodBexSKHRnc{-1&1wck7R+gN!t>^bGqR&UO-zQb)0|rbNON zdY@ndfX5i-%QBZVxgbhIrY^a0XW*8=VxLlKoY)~4&L}KfXKAPBzLQ_rIB@RK44$!n z(FLEA*9(iQLAl_SB4BQegNLp}fAqbv);cHe<24 zKLCyD?cj@_;eru#_{xxVs~|doAbwpkjE>JR_|svnO+h{)4@5O7++31UM%VXpbebSxV&!EeUrRI0@?k<1*HXN|VyX1i>MF`4AOsDH zx~ilE?UALcc=gz{i5USV2{j?~31~`pz+5zp4tva+CJv|!utC^B0u{s{ZHbf6@Nx-j8tbnWT=EHddsYXJO#>&)eleM(!2IF8*OFEO2)so|#r zxmsD%Gn>s+*ClX@Nb%q?#45gYas-g(*%vGV+uoYp+luuXVH5%-5NaYxu&`4odbZeV zertN*cgA@wePIDdD+GfK6HjQ4Nr}}6prxS^Y!YgTr@HF+Ea1HJ(=d3fnAHf!M?9zC z*j@(=^FW1lbV64Rcy6?dd^VU^8ST{gqwx^W#pWQhiTC(8Z4226$cLy<5*Z|!Q_yTR zCe)VP>r{19lFq06Ia@I}KdvwK*)KP`z@aTbks#W7tR(?w&@ntZT531!aA?}VY>v$i zuQJrx&dn)8PJ$_I`fj0EuQki9rhJc~Cm1!GGqF7dzD#66IN|X=qo9YJ8f+9Ry{|!K zj1Uexa>2NnVkbM7I=jFW$q$i80nu_Ww1CW4r|&J*x+8#K97^W|yHuFzZ$Y(*Uh&7U zX1irsAg`w=z__W?Y@k{wyM(<^_7%r+1(N}$7T6v?Gua5_L$@V3l}`L2;Pg+y()Y{m%JjcvN2W|t&6xye>R2?fCO`}(gdWiH|DR%G;ohn{l1Tf;f zB)9y+=jjL2`F6o5dk+;uq_Nl-6~(nnCIrch2JF`p6JJ54-Z8%xdmsY?FaX+0Y5-?PxLYFo(EMw$BLv#E+%r z@Q@FTdo@jrodYHohW#lLiMsGR@zyycx3eD8{ouQXF4=#m0^V7g3AIKT3!$0OL8n8G z;KI^yTQ3aO1tHOLq0CB_LvAtd<{}Vp*ixIhUcRfsM@%!u|iZ-9Ap(JsUV8Zu+|rQqYiUa(yzH zo*wveU@oJeQvG{7m9QHp2obkQ1@Z9|RKag^`xFUs&^~6!!LIyMP$4i%EYp=grt}|w zDfrbW7|8>+Efq~m6CZ>G6(|S0PuDEEnCe9d=aEm=+hY8M{_!;4lMS^yme$&PmINbvSa-5G*`oB{a5tkvn7`4TEB6;<~lIb@b&xvO<7PuW{^8|)aV z*il{VRd5EW&AO`8mh1+rqoMN01!XJszVa>(yHILW0d`QMD`cY8vX~L(0`JX#p+&5J zA-kI

    Lw<`Sp+>+cKU7bAs7ahcd4pZPCJAio%iG$P2uTbI@PmtPC#9fpVJ(S$f9 z5-`_4>R<36f`%Ir>mW$RDl$M78H1FpM5#DFrrRc>*X<*%lOV=-Zaih|c&fQ{`oUeZWE++O`L85q4Reu{wSFwRx*Q0@=8ZoI zn;D2YDj{=c)QPfPo?qwZJAdo($M)m%DpW<=kl3&$TtTkdJ?e^27uLeV^r6NO_UEdZ zoWVxm|MOQtb2e>p0R3 zO+);hvztO2Ke5{6kH4{218bE}wzz)sSIsZ}8O5Yvj-;r@Ptjv?xk?mb%F@^8WV|Ns zvYiQ4&unswJ7)3>K-QU~O8D6=%R4k}iSYCxTNJjt{fXHr zG!&A&P>mR*uWm?;XMKu=sMjkim*g&?LLyczn{c&OQm_)0BZX_%-OhNu;lCIGq*1(|X-Le$N(t_0?g!D> z@ZW8|ns~$w%*Hoh4d5Db3UGCgf+=5DN9X4!kt2DMUU5xX?6_#k zYWpO*d2aChc$hF8k4YDPq`}t1Q`Ms=D9VKC&NC8u;lag9H*-=!d}$Gf?)s^;4(0Ko z90_qhsJ3Y6!ZYE!B)a<&*;nD%b$7?2~2N)4^1cn`920Iy3cL zV5(Dq9bhqBU`*&UtR+AEIiZIo+=(d^q=gNrfh3_T2vThEgIT!5cZDAd?Su0J*c`0& z=mT~HJT`YSA>8B6pH3bA>Q9{~{Q=LzUkjKD5?0~lq7K0(2r-CIW~{jZwG8uN3u@u| zBc{!v`06Mc?EBmdhvHFS1Hu;s1!wJfegrxrbc*;X@nD;NZ?$NS=!K;Gf2a6{CXUp1 z--4%#TFog&Jy=>`$Os-qaWs(=r`Cp^zb19BjyovNXm4B0OOe@TSI- zsBLwtO&z>bE+vgDqMShUGE2?t3K?cBuvmUAQemPL{_f-aE)^L*K0|ANqOfbK#l5yl)cp)TpD{SK3~=+m`dT$ z8{O(_1gN}2ZV%I4KJJsjv4JA+XHpC+U4JaHI7XDtxsZTD@d6S9s}r3I?hs^k4AOto zU1ABzK&U1L>=419o(`CgUMNg9{>*;&?~p>A?r@!nl-k8eA=bKMq*l6Pq}QpZaBb$p zKXy(InU{*`ot%CAzg+R6T%~<#mM^Nsf^$=BHnSH+`VhW!3G(#~h4BbS?Ogg!-kk-b z1Nzqk#d%%H7*63RfGV2>5%O5wxU)AR1@``nzMFjUFr&Hoz1h}XL%;H#563t96vej= zf1ry}X~@jMA$%`CbZ4PA{{}Y;^6JsE{o8CZyS&R)OLx6m=AqX8$TUmys93zcdP`>W zZg$W(Kiyj_3U?>%hvM~p@*-P(&SnR>`CWGMe361jG<*H!@zr4bRIXiDpG)59bN%q~ zEO`ST{qcO4y;CzNRtp=)uj#XxY<~Ku#kg_$&B@Y_@Fal@$thNCo{3K~T9Y3-72j2B z*B%86g;HX!e+L(Y=q8W^)PV{xW{wY^Y>iV?Y>QtAsDa?C-z5Fm(CA_I^XpD{HBN;v z(EY($P-z6~H)iFLSijvuh#mHL=MTR3U7VRerPQX<6(M%R?pdWamj0AX0!E2Oe6;D= zx?z^=i$!RO$rjz!kL^f%D`-Yx>@^xp9`8y-JEBUUh5J%7Vd;If?s-r_@EyO;I8CjO zzsKmi6(@F_PGEhzV@1hGY`;;CY*b3@rOMAR{Nvm^ESd)eQ?lx$w;?WPA6y)beARo24Eb(d23QxENM4gIp!ou62@Qob+q9dfPZE zyF4~viUS!Z#aYn(iEigzL0 zfls+|u{3{vf6e#KPhLx@vv7J|zV)xll~L7w>c1UdTsI#4m-^GPJG^VZ<@U1K%--lV zyhs+WbBhLC!`<_?*LNSMolf@Y&dl$)p$9~B#-Z^#mv*8yO$bu7vWz-yc0(KA(@H!bR@!@aE;&e=0Z1r|!qYB)B`@-bz*Slkv21a(G`$&kBufGZS5m z&ij7QTzq(YuV?Mox2WS*!$Gg|5)}64xnw#@chmEa$#s8ubbY+N^_Xk!^*&04Wd_vl zO{p22UcGqTY%^WWoj+%z^U7ZTwBE|XkrT>PsyOrS28-)d?W5jE*N?ixYIG91si&)#R<1Mi3qdw@Kb^c@q=s*={px#d^qPHv zy%=9zMYow$t#jTQx~0pr$8Irs|9V&IE%!RN^I7)lq&j^rzxm0x!&1Lio(%KJPHuTR zEnK&ArK;QB-n#6Ku5TOl+um$Ec?e%BACp=WuIJbE#q+e$x((99X})oFm2vM*=TEis z%X;gnUAj2&8|BvF(oLUkZ)F>q$>OD03Ch{$hs>p0sQ6biKYF!Iv*7Ck@z8rA~0Q%OA+`@M_e zTh}{DeH6-ve{664aWif7<;<$@k~)!9Qz95bqlF1S+`7 z^Sj#pg;6*j)ofwSLz zdl7Ou4ClW^@^}6(vQ*M>e-3=J3wQROAV+AY7R^zQND)*pz+gHNj-qkxPQHW`_yzM2 z)(#C?q;-vd-$x({at-v{*^2_w9_-NL$qD?qIz9i!RfOKEGW}O8tg=DA+HKxQZ=thl zRZCD{0wXW`Dgi%yhnu)3hgT{dcU0AxR7F{|e9cOp!3C8(tRYFOiJH;dIQGFsWH=NG ziKreSb8r9X{0xDIm^pSQbK&1aDaIhpN<%6sqKMr}^}NP(V0EG0E)Kg6l0Rb|T}7Wt zvG1M->PhM!nR)$p-yN#kZ3<|0p6n@*|!^30P0c-KYVAP}E!2qjL)0+*$po_p1Sf}!& zd*JL=v*oXnRXF9swxK@`y-}ZX1Or{z2j4Rl%J8xyQt4cLjqgs-H+1=^@igBVkVhUW z-4M|fD=pQPLi``ztV_Iqv8W)jUo5D~0mGg>i^ZT5y)!C2*4znowa}bRUFr7>W7^(g zxuWrAqX8;O9Z3C7Aw`2g90tVkk-i%7)M}7wh@ssoJ)Sn`m^=Jos zgF4xXrYFY1wes~Oyg|*z7zb*i+)LE`lLzQ*8sFmNZ;jBOE>8aP-qaxJfqbh}F|}ra zI@T6{L;dWp`#!epZB)~hb(pGM4XL!04mI2^+gnr*&0?T&;RvCIvnsJH(qhb)!Eq8Q zL!u-ICa#2HIx=X6Fne`AIrW%$ytUTP}N4w=K9Mx^wEl}x7k zsh*Q<)U)8M8tS0~nI!6p5HU$Tt^3xr)IMGrT*5mctwnJ$RhpndhuC3tNd-@nfOVBH zeQ4iBcosru_r6{YzphbBY;UzNHH#`uwji34DJD1iUT*iuMe+fAps*~0Wu+*}2d{0w5^Hla z_5mmBetW8(s_K{V7(95{-ByP{Vp(e zCT}){^b6dhu?o4s2m3-$jYU9E(Nhj(aw;QH7>G3GoFG2zkm4C{2`Di*dd!uuB)yw* zwDUw`LTVzs-lLZO8jVNk;BLyHp5PZWWw|BGNhg(Ji|DKJNnI%oIj}T2ZiFVn_QG9$ z=67a^mGOtQSS=Uf7FoI>;HNB+0HP5#E@VL~R59!>a1 zc^e0NxV)xX;>!>qVgT7Rw>)mQR@h$|@&y>5V!%mUq7yCcg!G}+lKi(IvS%D@AEMAa z89B@8s*;X-)2}#n1~l5kB{BoNBAC_=hKM9^u4kmQ{K7YUt?3Wz;yG)QW6B98Ttyb) z2SMx%(xNO@S}zwgM^NZS;BK~8-bf326=>uYTFgd7TVNXfwS zlc=>_f*oj|DZ`MWg!0IHZ9^#o6!B(cDSD0n;$c7)d#9#SC*!{ zZhkV>;GSaxpk~r8r>c>@rRh*03s;Ox_0G=;w5N{?a;TWS4&g0b9;CaG8gX}S5ZRSR zOZ1vHM;>lPh|rOT_VCD9PYQxF(woHodobxWsvLx3cHOn2z9w{f@_5IyL`~4Cnyl%xF3_Z$-6SYLnD8!ulNsInaNpER|o%03;z*>YbRva_-Ff^ zA6^`ue?B~j1~mJoeaV03jZqd_qujS&w=d`plYY?&=~U=b-XpZR@bl_@De=+15IE&&yNTdaL=9I#|VfHtd?_6bPfpSv?` zHG|5aif~0ogU*roNwgpG!B*>F@Da~PM=Kl##!A^aYU0*#^e^9*xwIApX&W<++iY*U zjFw8CBW*qvmxYom_QTl+Tz!Z9smn|#`}9zb-XZ(3XGJ!+ikZ3m!sWC>`%Lp;YpZJL zJ|8gG*WA$;Ti@@yku|!)@^ardEKo*lGh-Q;xVGstx9KC=euL(2f|fMDneWGVuf7>x z^F(0$$iPtNL;OlWOP2@ifdoZO@lHb?O;$91sU@_GdqpZ24Dlxx2rHSEwQ8F?sO13VtJ?s2y)@1 zvK`PdWmQhL9!;}kqrK5c{)NB*O$Qh_wg%8*al**G(iP$!m;9uua7{5nGvP9jN*YH; zopH*PA`Fh)LQznqV<06wZj{!BO!HWC=~eFjJ35BSQ6D^?JOfoy9SoTiR<5D4=@(pr zqDGbv4b#S?i6Ce1>!7P~b3<2s3v*&=m^53sQPbiFxHdIJ>q<4=sA#y3I8-)2E^Cal z416k%y*n?Ckn5TI9!osI6?<3?CmeD+sYt~PaA@?ist~&A2^5Tl8TGCAC~ltM*JB*4 z(ka=R#=ng;q(8XoPH!g`R{#x0GEC4_n)3&Swn(x;`k5G$h|6nz?VY4><=kbhs-BID z1}c&j+hY`A>ucM&^>9AGQL!&80cdnV?9V!S#{TGpJGB*3hI@8>trW@K>UK` zV+&_ZhzXQ=ZO+XPnE(!8aV3e-O5GCYaB(X=(+p-iKDX-aogFP7qRlC0=|EEI7BKhq zHF3T&7`(Bf!JX4iH7B7tAw<5LPP)ysh&$j6WJ+v(K)CXRyG4%bIv0CZFNMjs20(9` z7KS``=m)&fz=kE|!{g>NP4FZmH>{%!=%YVN)&zrQ062Ihg&y$t}1}sRm4>d zxVA!|3#Ny1h~EeG@Mo-m%JKf^swW{*2c_c7pW5r6lXsFisWh1M6fCiDWcLFu?byUI zH`ah&QK$wwAT&_c%U?$_?4uzKhnfnK){`i-*i%HgQj zy~`};CNObghAWKTtOB&`MmWQ+@{>EH#RWV?;ELYA_?06xdFm}A*dm@`Nyi(}vaA_u zo5hezP399bE5Js+jnzS!H>)BrWf~}kTK3%B4PBaa-zTuw_kYlE?b(0L*Z~kovoujbD;dCTHlGTa&}rCzZ?Zu|P6$)diP)qV~Ga((%8MHuMMR|K}c&AiNXVkAkt(u9W!`rK+6 z8I|qZQu6|k)*W>UK-^c=mvXq_|De9SGWggs@bMWJX%Py!`<+q9)-xz1`$ZuLw!U_m z4g6Q|cYSUN9Iy!-uw8WpTN$iNR=@$JashWjahi%0%p|L>hv4WqQcdRYLI5x20K=pR zFQkcC3NXY~xQw9`aJX;_lcP%T9ac?q^ z9;o+43ijv|J*-Zt7e2bKCB==~H;RP`$oMsHgIP1BZ5@122stE0iFsaznWXS=e>5^7 z2-*!wL@;5HquDiHD_<%AyPrRFqCdh2#+o|MyS$goaSOQ()!}R0GsONfik9n;m89m@ zwc}0`d_8KmtYg%C%1yj`1Tpvwm-;l_a1C5Z7Yv#}?V(7Tj8@AXt~Jg}$%g1>hXVrS zwzIqOG78lMMxx|7J(~BfP@V|!`bKX$F;?1%L%6c}h56KthVDqV59RdPELfzNduENm zpoGaYs1lA~t^=#w=&%WL+%b_Kj%WRHLr7G?{Q&Hjnl-K~5baJrd}djI?BxdkdF1GR zEObUl4eCg8VL+=5cZ2EmuDPx$F9>E@y&2@9$QaMm&{nPiM1uiNh_n%$`Y$@dBPwxn zMWKB`*cO7!I36u-!z=4NETJU;!E6kUok%LDeQKk>0|QseB%B6%m7@vS2y(NFE43Awd zpsv#HHTyV?MCY5Pe{;2IFE5dtI2O)#_-++efw(r4pA)}+YC&;JT=U81kH8cDFM0_Z z<7d~%<>~3+$)W}FvU!Nt3ST0sfHqC6fzURi1r!UVaN$J1OJ<7%x{3%zfF-0?Ahb}$ z)jRVOQ3!&q()-0?C|GgcbZ^e`UCsY-HZPPwo{>Fg>4bs}|434rv5Zy{(Q^V@USh~@ za>6KFbG+K}m2}~U=~Hi<$1ko9`9_Y0cy961vv9%+p5?47shou)-0k?j@eGpLHY8I$ zPvj;=esYE}bDSchn4NxCs7d~dF_mpAx1-1+QbYON6lD?%5k7}vXx0wN2_B^%9tP_@ zZm#rW(H=EDjBRV9E?R({aiufHpAC_ekTJ#w^ouMWvn(|i?&LD{ilIhp%^{9#dKq%8 zMFCS2VI|1JT*C?H?Q;@QG#~6&YjteZV#7!nPr+9J6=cc%e*m#A#V-9M0DwbF?OkhA z99NS4P6YpL*j z#`bK?M(l?fi>|7B^S<)t^Q1ErB!QN}WSZ1pyl;xqYq<=!QI+UL)7;~kFadk*@dZ>f ziSR1Li6FNM)?~(Gd?{iJQ>ydt4+h*PLmMw%^=o_Z0T``7F%?WDOv&^sF zoGG{@y*~>~oEg9ex|OUci&-qKgtbOHIuS%p|5b?qV1?ZrXM;Y##+j~$sFiX)bi}T% zVCoi9B)xsig^@W!_>|>3SRYG9X~aAYya1Y3_g_iVdV6;I|EkviB~=U7pWj8-`c=z{ z-qTr;|KUe__{dr#@;IFz*qi{_oc#mVxZkQI)X4Ew$=SpFxIvXi;=Iz4qpnw}0SQXl_A(wAJ}t7H9cIs?qJ9xL8Z*hYzZM zk7<80t4{snKbO$|^x!_I0RAQ+z5e_rYLGj>$)V1c+ccGvOr}?(9oBA}-+hcrozlf^ z^RR)Yp^YXx&+mTbn~%M$;a92&;%ee)=Nf*c?3q74<>d2r`wFHY`J?h%_Rl^1ztI){swEvQ+9n%2h0=TLZx#~T&{3Fn z9l6W3N;SK5B#27VtSt}en7F=N8l`CMgJS7%FYN}U&YCBvgQ1MJhr)HG&(SB*gkWSr zs$tY=853uO#pxX5M3Dr(Qh{ncY?BU0YP>8ql4fBwwzaxqjcF=Ljg_IgAuD@lb;Ylc zo5^GqHyoHSilPPIGh-pJPep4+&6+zo8wW0MzeZUnEly95(@3B{&ydxE%12t^tTvxE zo+>TBp=E$L2o%!5jbtP634z>zqaxjI@Dx{0h}Ae$ zYIQ|X^N<7{PMi4Z48=Nq!$ z`-e1d&{S|iU%GH^*30%d#`30FKgtjtSca19Mzb_UNs~=^yd;AlS`H*rOQaD9Wn{Tn z2^LT_QwvZsi|%way%HHYALZADdVJ1F>ntyQ@%Tz1M43T{r+PQe7X8wV$es+HDfJT4 zaETfM46Jqz@S2z`@8Ktib1R7u=neZQUa4^-8g3K{*Rq*86WWMxgqyO|q&Ee74beiN z1QZEj5kVTwqL6b)WW*6P0H+iK>L69ln z2g=SWMqm2V@klYVh($%5y`GlBE-#UQjHC1T0-!o$06Wfl1%ge6@!knAvY1 z@uR0P%Ew=ScXsstz3l9Z)qPtVeNo;2`W(|$6Y)fk>J zudK-837?H;mSQ@|rwB%*)Eq;H#X=F*{kx<0AKw0ri~FWPu2B*%ZKV4uFO>pZY3(f^0$Lfr-}jh-x9;`z zckkbBM6t0?+Ym33^?boOa94=sduHMIS60!xa5U>*7C$EW$V%&s2t-P-y7zC<_UX-d zHb-r@r;xhWiI+?Mdg|WY>vWR_3^z)+n_Ffc$2fmiG^y!q6W)fN1CQTi9n=ILt$ste zQj(}9=3+FHHgZ(6GnU}tPdP<~+=koAL^OV&ant!dd8rn_WD&kW|4Iw%E-$Nphq&J> zic2HD#ju+Jp*GiLbdBF-SW6w(ZC4xzT_ZK6gU!-wnf8Hs7}n=4Z9 zym-$40#H5IiqsiPQp?{2s(d2a9cB7Gk zqofd*t3W}gdhOJxs&EaMW4Zs?v%jUlXI58Sr9w&@Ec9vD#ps@;0pl3z++bI2iG9!_ zfZ_utxr3`F8XM&wVyHQ>R^`|Jl=b$?2>`JTi{LTT&JhRD(tYIShBK(*n@ypsh35V? z#Lb%8vqfcu3K0ZM!xYyOlN1PHq~&Lk@r0VI!W$0Kg>9MW zkwYABS@n8=y)by((jQ8v2!x*L-@aA=?jr4+G*aF1eXXuoXBBU(V%Hbh&OW=#)^|EA zNUa6TQF>N?-DeS6xst64u4u}#T4h?PybW|`CX#T2=x&=On<-m=FO3K@H-o?5?4oUw zgKE}?4ng}`PMuLx4sVKCG4ToJ4#t!j4&el%=8Bi@MV*>YDM`jb>9TY#%7f?L*sRr$ z#wuy$(L9>ZD6zz<9#ur?af2w0{DSwsdbYv!gc-?4wvD(M4l>)0#Die!4`%i~>zYrr zta*I-A1eq%G_TGC8p8D$7xx-iWFdAVTfd{&3I4Bq4M+t-!Du*Jh z0dRcg%IH{uLL!#jj%A?P!;<;V9iH`37i@1^LQ$U<1^0P=i*|y0?g+%;O{r%VSzdXqW4Y;RpUgV* zAML&E7tCT(t6ovM&>r##MvuuZ9rfg1zxDTFDj3_A1AuY1uC<=45+Tw>CWc3B`Hy@L z=zcx-E%$VO4bUxCrwJ*J%vT}5Jm4_CbX;adnSDC$Xe*zNcl8kMZZnYyg0-`V^P?^- zfMrszg(x)s!+do`t}FMk>i1oF#kn|k_Tz^zX_BGxsUb(>dc-oRj1|{(MmV04;UT?; z!%7m3$GIOlc<55gBSgX;{Sql&m8K`@#87l8XDYw|0%|_$9jJ^(Yi*p7!UE(897&0j>6)u)+d{UUxuG@-O{s1Osk7v2fLs%T{R-qL!nJ#iLj?Ma!vO z$nA5>ptS7uy;}jAzh4|4e|Y!yK*yv(+BVf+U7;2$I_Lu zb}Z;*pREswmB>um5#4Lq?rwJ@tIfB_j>*5V0AnAUQ~zciiVQd#zg_Nw<8VLyD6nl0VK;=H&%7rHtM@{q0Yio6c4&1Ni?46RPQ*{98BI-B0BHRcwII093nIw1~vL4`@!i;RUC-io!W zLha0#WH-?}lpDFHPNf)+Itg+Q$Ru2jfqthztj1cngj?}K>psD}_eZfB9h8=|M2%Z=N5aKDZBAn@Ic$>@ z^=lVCV(_-`Y30r(KZ3DnQqTvP4761Nv5vQhi~)AAfNmS@Sj*LMHcKDnQrTtI-Q^Zg z_YY@(L$_MUe%F>GElf?^YE_8#ocmn`TWX0u5GGJs*?I;flSlX#>RxxMqUYox$-_w2 zTojzsmZg;d=EnP$(MRpc4Y#kYg~P_yVnAio2Pzkkb9~kQx|jr7rDs!_d^`7#M3HLeAGK}6ExwA z4q7>K8_}{nu!SShq%wIN5N7aR&-gHBw1!!sG;J-JoFx~>&lqia-~lcdtr$@ij$)?z zEPIN|K?l13`Zha>ZeX0T{n&^X#Xvt~=MtFe@6nQh6Gr=kY!ao;U6H2J>ZUiENUV}? z(R-A>im2&{OMqk2BXg50d@lkTdQ9u8M9?J@6+{+Cig_I4tHTBYtD~{d(no_9JWkSd zNWH_3UO3vn?$G+=#bovy4l1Kz`*gL)d6R$J(uI3gr|9urQ5DfE=U`r1AX36i;)3Lf zcdzm|QFfoQLscPI*r2|a-p>%E`z)g9L-!Q=s(#;I#oHz|7dxrXF6*Yf0WDjT{cMGF zQz=drua_V<0(8l)J-JdWzRp5Q7cL&dqX`C#ki@FhGrc6%YG5)IEvB-93xT)pj!Ph~ zT~*5U*b!_=>>CN*RVtZz_R}maG|(3W%)aU|9#3ZRwwN(|3=vF>oz#G}ndM%SE5LLa z{9AEo5;?gViQRw(sK;utQ9WBiMfq~UKV?;pUJVjiW{c3CWM-v{!!sOY zL}6>4>vuEr8~U=97pVC$m>~GiDM-BiU?SGzzPdt7TWO-aafx1jk8025OiRFP{0X1o zZKBX!D`+{a<0?A0e8u0WQn1xaMxS3qEE`+38+D%2@I1y5ri?x4-!jNm4#FGDBQ|l@ zPoig#+L#MJD}15ESb!~QNW_&E^D!Y_wvSt_a(p$r6FN-C4DTVDD`Hi?zvwdI<_UJh zP-f-$$m%2a%W`fte|-Z{AMNZrp~Nigo)oQF)Spc3LNGsF{*wqa$4BL#Q@4!CsnNyP zpGHI)av_L8z{Fh=c@n#5+F8gzkN7-AtdK9wk`K5c(g{u4oR@#d-i>61^B&VdFeEPy zS7WDm3Ez2?GF_S}Y{s}Qd!_>%#3X3~IB^Mq@MiZC-*y%5z0#9wWsP4V-8nRFX5JB3 zvW14qaZ9ViunNzdDenDVl}i-8KV+ZbKU!V6h|84Lh;D`hSVcsWJ>4=WI^nTeG_<@Q z%1J={&tfwygXR4~K0b!$6gS*uL7xp*M+onYQQMnmHr^|3%Xb3%_}E7*n(R1;-8Gi` zp?glZsEhI3LO}CYd40KMfr9P4oWS>@f@k&(*YubY%k?y$+}vmDXWtxGy`=pB5E+tZ zWI4UPhjGgmP~0mnb7CH-sD@A|$Zdl`ajo@m{oaB|1KW-Uo5->E2l9uuG|H_VN=d7T zwHZV#BbY3P(Rc9Txodovfhnbu#+Ed)qecEnyWWjPP$&_!+&dMUP2LsxZMLpX$PMkl zD(d!x1(pc>UO$m9Z?dBy!oc#;M%qA$qQTb;oe6EUv(J67Ph}DVgt)kgyDxHpRQULA zi|Vpw&fXsf$ye?sIe(ZH=VHHuiyfg~Q33dJZScJ_K~{D1MXWvGMqf09BA3z038k8bq^9*W$~HQq_s zadho0IJsM~vZ@Tm38>z840o&bi=U8}Bipdj%>e;4X0b^VZeVB2aSf2f$RKGtvOJba z39Ypf34#)bPM~vHe>(28qCa+9*&Yi+t*+3^E$i+4*YIh}t?y2LaJ_N0Rg`sW_F`}A z#q+I`^VJpGqg3jGb5fKG;aSscx4qp8KfjA)N@E%8@7|qlpq|yX8ks(d-g=+CcpjM5 zQR&1L2;V^JRM)A-T4*h$rQ#`KvBXEMd*DVNj~lAiGa_1nhAcq;3!V1z(Itf;RHuXa znn4-#5z^MZ1rxOQlqrkgaY3ybqwa#hvM+U%^8ZcHA=?$G5d3j-=%P62Gq{llHx55! zPd@n5=%Sn)glC7K=M?mu7EGWgQ6~6a(4dQ(#l8{?x1>_-%~L$6;5ojKi#H& zKEN(`SI|26h8H#r57o}rKfF15c#MM{I@<5oRQ!^4_%y`JTi@=5$0@f zzi}+5kjlS9sq!M4r*5`>`rT>w!KNqUNf*mGltOS4BU9T{g$| zE2(>FNPj+c^`C^7wpF&o=dOl)&_NMKO5|wsb|6q${zF&T;z0DagMpN{JoU+biBBg~ zj}CY%Lrzywcs{cNm!gx*X9dzzFO}hmj&f^}g(`KNYqE%3{nS_1G|g{qb>&ZgeBRmV z9LQ_MBw(H!Wj01LdFe!esUua@-lBWC@7cVGtc*04{e%k{q6Db25$%ixQx~C z>u&<6As5MlLH78u4|3%G8w_|az5b}t$tOTQe=i%SKl>$H|6$bUjVD(J7VxvCJj_t- zK9f#0j3iofBt#=>m+xoThfcz9^slby0N(TwlO)o_hw*i;>vyXA6~lS+0l|77R7Fm= zQvVmT;@I|idc$s}84=lq0W)6`hnZTWW z-^wfu&#eF#sRe1z1TMGG&>S^KM4g4j&u~{-#15%ARUY$7|1B-rTWy=>A(_CJ?E?`hlO#1@meciWulw3OESUp_#2684##-a*`9__NY3eu2QK#*(f`RT?gUZ5*4Q5*+=S{8zLU%hj>c1WDT}XIFOq zy`lA4(mP*vEY~-IRD6q!HOJ zrya5nO^nLzzBY@bZ6Ud1{LGzpVw8m%1zM7Fv@4qZGzY zs=u!kJ%+s@sdB=-?5bgyY5KH5X7ydrwwx?t|CQ&%|InxD<)3bmz*m_Wll_AEQ z9c1`xF5EF=-gYvC?_FebFiUEtLd%_aw&dS3D>8D#qIrZoT5ry=U^IkoDe@t;q zqvK^4nAJ!TD)e3kgy&_SbF+}-HW{PpPG1d5&KBv=LB z>G1sM^@q3FZaX0XDbL58=6*>=ccHv2d|1_r-B)Ka#8~?^4AIvJti}uAg6kiVGx|5! z$Tp&PK|oCt((+4tw24P(;S*-CL5r?lw0k>VUs`;)v&~C)S1;X%-rH|}xc73WL9MI4 z`E39BqqIDKl$P!T1KMAjmYvpiXZKNRc6J^mXMel-;j^X5>9n?YAD^7g_G9F9cD5gC zWqEpJezvzCCFt3s%eDVdD_!oLCu{S1yV3bTbw-YdXLIJ-liLY^E6AyLhID0|WDq#6 z%*HX}by`s>^|M8n0v#f8yRd#&1!oFY9*^Y|0^krHQFFUEtRLR;DA~o(Bx+Cw$z#!# z<2yLP3Ph_=4jL9ir*mA$|Iz41m>R=&DNHTbOna3(bvB@e-xDS3KurVhMwe~o;#(Y> zX^%<@Crd9qV#VNAVfGckN1T_q#cQWjB00P9`*cdu#1O(e@O|(y$Jgr#oCHET;>}u) zmXLBPcbQz6@FVv}X>B(RUebAK(bTT9(sGbdsXjj;vC{THZdXV#1_GW#mY>exm)p?9 zt-e)Z)D@E{%)>m*)$CCGJn?bF*VFMG$_w!(q!2fpm_UXv)MO*yxa;=-DjxlOSe?0u zbZo{HIgtq-y_bO~m`^Wnw#Fmok87?VI@2Gr*&Nz=K45x_&2^nIEH6rD411xbm80I5 zd<4PaZ3qcCb4Yr;Ap1YbAH^Uwk2&=WRB4jG43Z#mlq+R;NLzFHKr*#|1yGUfXCx%4 zFZSf!**WHaG@g?HmnnS5JmK*zD~oBN!H0;%nSfhxA_vfdIN1`MQY}qcMWQhw3>153 zkR59P$}~F)#jY7q3UsvjHQYBs=ku&W+|C}P^B$cgah+_2Z?KRX!(!>w#eVz5T&tZ8 z9@`^fECV$AqQ#+C8wV?r4sPOgvWE=Le4OVrZ>~%4??jwAv$cK%+Tn^fo`4G*|Z`u4$`OdCP z=X8Q7G?%)|zg+vRC_VQlXh;Z>L3}DY($3$Gt_KVVcvnt^GQ9{+fYf(?;1rfxYGmPs zb5HV-<`Rn`ic}Qn)qU zSuZ_5Xje=%h`OELs<(;QED9S!mg?XZ_0CI`Dn;cG`*X>7+n_J|I-Pvnk z^~FpL6KhH{UG`Ab5C_5NIaX&F48V{+7Z*s?fm!a$*!VaM$3BZhg#a499lR3p6=rpd zkfO(gYi>*Ut8BGwnb+LMb#MLm_s=p6j&8vVW7ZO<>h$lF&wog3&2}lS>Jgj zpSH5@D`Zn_y!2U~+HfjcdnLG2>&A`Tx5(WW*70g>Z|(3Xc$yY<%bUYv9n$@x^Y_`F zULEyMgmE`KFy>MJ)HrDULt|_8gnpyuaqnyoj>H8OwNI{WjVj7;H-RnTr~Nd6a?<8Ou7<>z?kpSEF_ zCio4*VzR436Wo8*e)x66SY}D;Z47oVeGYgxygDuc(_{EIyz6>;K6xQL?S=|cXBLZ{ za0@~Y>$%IB;@8*3#gwX%+>Sd>za10oy52Oun#q3%TZazxa(siIrK291WE>lH>dg?* zWeAYF4GIrunuw>(>-`vF5i%rGim(w$2W@^8Cq;;+pgu1*5r3wqY?5E}2YmvznOcqy zV=xkY?Sjcd#dLL)11!%j4v_FP%qo=<2kMgYZqP4n$_45Ex3(ZOzQq@@944i1D%je~<#4vp3Fbto?5Qe8eycS*b zS!6HZsX!SLp=8}H)`k};VHA&jB=$nKE&`*|6>`c%Yf~i1^~Qt28eCdy(;HYQdil*@ zZ9`o+h9zg&I6ksYw3EM%b0pj2cH~U{2&13O-Y2SaF8v{irl8VJC2l@!`&~vin#Z!E z3qJcI0vK4prrG~=S202q<=)eWFc%)w9=|7Oo$epK@#T-5_AmX(+Mx@y?YJb@_-x5( zG3a>Ni(~`=FxI?CdMH}5c%4ngRCYAT(h|H@SBw{F=7(bKnMahR{+{zw_a#G(8Gd{~ z17YUUb5>VIST&7<2oOK$#3qPmgfr-Vn9?~}_6aCMZ(;)xjl-+ za3U&ecE+EzK1hCOUg-F&MaN8!SG(?fYwWdX&Qp4VW0G6hu*gSAs;7%(Cb*wLJ?j0S zgT$he$6k*KqiG&xs&uLaF&xxiPg*{S*7Dx`(kbf(qnNz~$U4mga;G9a%yr|UFiJP8 zIkfn*88bNhhw(rWWnWm?jR-AKgPm*X=U%v)F^$t|y&#@lWAgLqRQ<%FWzC1)XiYeH zeFnvQH$x_l+Q@Sz)!=2OpV06siD6k9bXlZxS}*;P?>uV7XMN4c1*g#{oLk(2 zl~P~7MzVA4$wADBd9S-i&f2;=Z?7`N_5^)L^T0wFP?=b8H2ts<$eNrhBR^P_h*rT4ap zUVZS}$mOb}v?5MRaa05A$E!M*>wczQ?W$aaM)5ovz`7^z)&7Pie8HSdtHhEPg}T7- zUY+;7?zNIAmD{at#i^uRo<7-We9~!r(v6-_%E#lh%bmt9cN)9gY3y=mnJznxU3MC~ z>@;@SS*FWwW0&2=F1w9gc5Az=Q=pvYWd@p^?I;-_JYIH_+%|5K+r~|D+qg+?Yc@&x zWVi9j-a}J<+qkiA8#mT%GCRwV*=;1V z+el`&k<4x*ncYS*yR~H2L?%3HQAqFRiYQ|;4*BsE{CESmb|PnaFl=WJuFA#HU95M9 ze09y(Y0Ei{OwLO(_qqca*@!!96jkishbQAUC0vdL-sO{Non^VZcKDj4$H7gh;mBaQ zwUG;m5K$16++*p($eeuW)E58nd3|WqO`yEH#w54cMr6TRY4p{CjVUJbHX*VmLgoQm z)kAiy-CE1q!fWxA+$K}H;*9vb#)okCM`K;!fZn5%G*L={XXpU8H#5 zYL~;D;X!R9-OM5Sgi;0gv{va2T0l5{r5ciGuu>!dHFRmdX`SV&tqMI9lG1|5BiLP7 zA4Ke5T@iXWsipHD(A3c}{=l@W#5oImhTv*G7T!fgnFGqphpix_S|qGvLQZB4q#y)B z=1jDl-@-u-8`#2W6fa+QWMg^aN1c>aO?7%FN1qo`uzEO51a*Ypk-X=c}W2^Ig^L zzj$|cWdCiaPC2nlNOpvSE4G9uH$dAKN1a^sld%d^rVLfrAbMw-{l476!m7!htsY!T zy0W*bdQ91Dv^+qYX-~TcGY*PdT3Y)ix|&>Y(!$bbK1UBNHN%%bWLv+y@i_=1(^L)} z>GVIj56^3!{M(yk#96XGHqq;DHk+;Q(uR4ARix%}tkqYT@!E54lN1HVe1Mcdhp_x6b8E;&r_|PVoYIiDKM+<;G|ZO?#^w zKd@UJtHg_s6P=tRu>>V_9E$>wYm(vu-2@2l4Qa3YiMCuivkv>6@Q6(VS;IIlZ*<^6W@~yex;fy1{p@Me6!NU}c^ygtLG92>&9J$AH*7B74x7vO!{$mGVsrV9*j&CPHka>-&F5^2Cv7IH5-m~LAJK{MhTJN8 z+K?@0P92(4C3>^oKr!yQs8q*sx$E6{GGPrI78}=uJk?Zb68#QXH`y~WbM!1$adAn9 z0(VNLCJu@^Yc5`^2I19Yi<>6*kF9FSwA4G&s!2<8cYP(7Tl$0CqQ28%&L(a>5|Gw< z#OckZJ&;luq0kT#hnX07auFf z>N56jXW=(4IxfUk^(`;mw{G#it!V^F1S9&+MvObGgz)N$mbBAmm&gVaJ5}4(8cd;D zG(V)M9aGr(K}FR}p|)yK-=RJEMBK3u-vm+sKjcH8&t>ZLohwsg0>bnm`c zxm@b6Uanohu;lb>OzHfUfLq#DCT#8y_L@GE^ng zQI< zkTY2?i}_UC`3n*Oqr+&6lI`3baI}!~? z52Ju%v=L`vvs{h;t!T_h4*u_{pdqDm!9QW=CjMPFwZ)qXji(t6rirO$h=44rlDi80 zshV8|Nf`jx9tOP`SrC)SaFO6^EN5+rTuVUiF$Yr`l^_`1UeO#=%7B2*wSR9Z--jS^s@5xNuV{2X z^&kY21fzdHRLNMOCyLw_IPB+V5Yevn+(NC_A8I@DW;Wo~MyRf@p)P3$$Z#UYhilXy zYf4R8vAd&{t*>!ymSH)_WJ2VMezj9sSTvGsQTDEs-Kb zmd5iu5m{Z*3lq>2Gk**noH6OdYqdBHxrh*sqtn zsg|^^iw0hb9&eRRw5$8h5dbZ7tvp>~^@o?Z^TSK5{qPd&KfJ`n-_1>aHpESYI*tfm>baQ1`bNG`_k!^wc2|0#`rH?Gp8G;=)fKc_d!OCl z>QiX@&c^W0Ue6_vnuZoS>S^DA8lYm8C34QYa!P#tG#$gd&V*Zm;K@RX)5*MbA0*3;Vj3qV0V%tMI0!Z#41gp5Yp2DtyI|9&37LXM*DuUwk zC++C^nhTcehNK{}2IpY{S;(L?aWfm4Y4Q6LjB#pxrD>YK10pRjS5$;`e=G>u#0{jz z-ta0w9AA<;8YHI;ns&~ulf@Vd6Crly6bJ#Cm)E<>_G*#VHAu>f1x;^2r2)NYY%vD) zmQ$_$dy@%W0|hrcDQVZeYWS)#S54}+S>Dn57I!u4$nvgFbMa-qFUxA7UMm)Q(sHfx z_9!>&m$M7&0_6%ydK?Wm znmzlLBg6378`VN0Uda2R`~<^9Tt{zBm8l2mFQoF1x2pKvxL7oKv#4L%MVk3GT~nE_ z7ghfgS4utPXTo7$Y<_%LP~oEL7M6NCmLl;01kPI-3t$ZN+3p*MOM&F~UbCbbCE>Im z_eegif*)^T<5j9Q6UIPKgndiGq5I(-$(qSH@aD_Iu#hl+``5t)fU>9ERE00T$Q${E zxp0bX;DjJzXdp)7YGPXR-bC1d>wiuiiY}tVVqmCKOVfxo`y<21%>k{vDSory>4DkV z>PL4%#|An=4op_q7lu8z)p(iib$f-dLa!8vmHQI8e0dVfb6MkaO}+P;Ih=2qO_OoX zC3Sz)|6K5#dqwqRdCulS^O}k%&BuJsH9fSz29eSi+lg?EpKG+g{fdIx=pCN^S8ng> zce?I8VNrC;&mGNX4iW%S+~1-;dtP(C%Q?|4d)o?d+IwMeXHjIUl`={Fq!)uQj(^cZ zAP*O-Kgv>(?7u@;;CUNOugqRRzSU!%@Vh< zXftH>#F7EZ^XqG)AW3xc8HK@bcNxUDE*w8atiOsL1bSbdUSBH!Bl%W&*r@cM!Qg1# z$GB8t!IOurZay8CMvl49aD;%D{$a+d!$BQ--s8KN&_Ibl?=^x>-g9oY9&a) zZ#UtCE=E&%XjB_JjqH5|KvYfC=w&Yo7GR**DvR3dF(Kg&UTL?3{{HG zAN=Y&_0IO#aPDWjMEf2OF`fBiCf@pTr#QgG=+n5vH#hye`}Kcop4#6JJ6ODZ@A1Qj z53`vjKFu1Mj-6FY zj7!k5^Y!Y0rhnQh960=Q#~Idnl6Gwuc=&!uDHtYt(0}UrIgZ`e-0^)oG<4vEplO?L zg&mv8+wlJU)7Z-oMiyFU`t*02cyH!0z5YF$y$hd`_-gk4zPI1(oH2ED%6Hd*&|n{v zP8-7w?Z^GMK2vK_yQnDxm7-g=U4G-LiEoR;%U&F5)2P+(GuwB(?UwdU+nm zEH(Xa;vV}&@X6E1K3MpS=GX2@4B(vS+NN7Ca0YhivvtVk-G@e>y=NZL@zbe&n_jLD zoc``n>t(5{tt2VFi@D!tHO%sCELOQ4%v#n^xbbGg)TKASdEIj#`Z(+!bA4pU!@*x~ znVJsiv+Q#Ao0GhC9^zKH9`_pO`}KGf+k5h6FSGjxf(@-+XeMj+Td-e!Zcc|d$ptMNp_+ZN=6T}@snL1@gI-IooX<*(?exTOQ5(Ob)0>=5;y!Ud(xAbkzK?_3 zZ{D+hXw#y9RHj6#4xaqbVO{zQE5j^3e%6uU(Y+6=e2ttG8C-71OEdO&2`iG~dr&lG14WnGV*6Pc;l^a`koAj9Hr- zcGwr4yR>7Tlj+su&BY6M9GX2Ka#Q}~H-f_pCJr#16WJuU!_Eo&E*UV{o+@G9Zk(>k z-T(7#ZMf~#=MFv2eHe7Ww5#o+z)&NN4&3=!4~}N_`u5yo;wGJrYY%u#${IP(@1<~{ z`EhgOf!Sx-YCo4R?4uU-?fWFN@%_!b^omA?P4I2^ig{>rvkaw8Z5y3vH23I5X+Q~y#V&`si>}m46O~;i|Z?`+LT=l&)-?iFX6w#}ZA zcPjO5`qjOjz4kd@w%ri_RDF%I>2&_=M+xR8jkL|Tx0-Gd+-0$F^iIo-?fV-`vxAIY}fOc6p_B_pU+aE$*!9ndHO% zxZZ@>r;XA<-A=97eB2nS(*0rYbR5?le4l)lG3cb)#pFl{lpCmatl~6LC>%G!3DF==xD9@sAcxz zq~-X>j0Gua*Ak=~I)>l@PgGNi`!qfCAe*gq`dQDuCX005vKf&J1VwX`a#LRLj~tBb zVjg1=%NYCUQin(Dyl3Cl%}VSR_T;2b(yWjz1D{A9&J|DOpYRUje>>vZFUED1yGf^S z13Ir>VLH!dPI|xT0e(+zNf%$4d2NXEr56pa=fqztxVA2HRhO%c`}7`f+q9L-xbrJK zzC~&@jY~Q6af4UO-aoS)L-jB2Hodr5H;CzQ{QHV4PdEeJ-*x-h$m83Dv>P`?zWE*W zH8}6aW*^J4JHEms{W^E-)1fiRtk7QnS?v3_zsha@=STc_Co&FfKA)ofyn$^YN1T{E z?DnCEP;Knil3tIV7EB8s5>tF5eO$C^PPS3rB3?<{qzKJsg3}E)4Jk|?^sjR27kuRH zK0Un`dw$EGJb(AkC$=7$nAJsgs!;DN5I8e_i>H-2)Gi_9vGsH|A-zF0nm4>(%Cet{yPg zp7SYEGhx^6|1R|}x!&)GbFlG&UTch7`ELs~R~?o9eWhmMXJyHtptK1ipU3%|F64ZlS{^`Hrj80e2uQy^xCJoa$ea^qvmkvcEG&d#=p7AEK@n-kX zFY8_PZ#Ey+>3v+2Z^>R*n@NukU4N{$CM?wPM z5eL^S^1Qn4?8jN39*;XQap_?H*hRZH3{O2R)X-^s()jSWm8PA$wZ7c#!TKXBhZf{I zneW;BeV)~)!C#`!TW!93Ytl^R;M1*4Q*UMtOlx-Y-pwGN2ZgWNi%Rka1|`f89%eExp3|n&{LX7GU*Ftk_`lh6mTyzN z-?yvpc*~EEx<6X8sK3qmjq|h`XZWoV<@F4E=bo49V7YYcFvFc^E_RNvd^vcjTTiEx zdoA}fX6@#kaQ(1&-(l{OVJkl#^USpQ6670mqSXkMCyBzB9F;|DZ#HQA#eD0vpXwTi zSe^9Rce>m9)u_}%+qwxFX!XbnfAGCH*KOh?O@4gIzri8zY_jt9ProjG7(35u+^5eI zk2*cO7T9^jk^Q3wx+tA}J?BkAX2Qnw$Foy*ERSTFsu*^DdF1})^;+u2-X#z1V?9=$ ziR*RCyWh#qu$IJ<1z6|WNdg>uN@B2E!F`YU{^ykmBxBLF(Rm)X# zc6zSbk`ZU^$TJ8JP5SK9z@uUBz4`z3`R46DZuzx_RGwyi*0%U@C!zZr*OEtz@2t*y zvT@~3zm_@6yjCqvXm9)d#cG?)af3!!F2B<~boF)jS?9vu-Yi-?;nm|w*`t5naJsnq z--6L5d;E5VwHy~6b(in3(S4jxP)z7Xty_18yj=HC{e7do!@7L;y39*iAzEVj0ehQ# zmVY6%4y?!vDMbuFNK%cMFX`ifBxr#$<0Lr4X-M# zS<>=b+?andtgWrLFZ0?nf~&@J-4e^++^FMruUC(5EK^E7+j9As?l(-o^jmwmfWF}$NWP@O*%Rx zhs}Mu&}L1n-q=Y|t7a{A`ccw+eY?V-sF+sKvpY0z+wxIEH^(tsyWaCEoYiyV=oX&~ zmvmaUg*9sKO`W%=*Qd=tmApO7Xuz2{*YmNY(=p<#!Q+ybO?2$mmZko6a8}wAi|13X z?R5UK>BRVOSCa-OKF=DrXvk})Qx89X&dI!PowC?+?OK=T)}Bt9{Up0|FU}mznmT&; zhr3OBu4%e3Vok@h{}=_7*cg0dTg~hgY3^FQ=;-#e$5;PraB>INJvq+P@xSyZ$?Gid zeSIDIHDcd|d+s+fj5V{F$J@A?zAnCWc+o0h3;u1-@rN_@N0<+f@m^S%5}7PYy-=_x zfAxgJ-}L7eUtZYqLQn6b)48Gj_9wMA?HoFH{+<4|+MW77){kv@{@KBe#xp*OhTiGj zaqwh^!b_)*=9=A|>fbeg>*1Bhk`_nv-i4Tb>#F)LcE)q9P96^3efII4C5F4+8m$gZ z>G)$KTA&iWZHzwn;sw*FT#&xkQeia&3LgRVC)eX)lc3KMicu zo7*q7MNznhcu_%@!lAQ#itcTdhHN=@94~nkvPie<#tkP0B?a+rqn2BTo291BYx1#U zWD}eAOTIo9HoGzUSXx%|;pU%$u8i#wV#nXHz5D1VZSDSPcSHT{VQY@Sb!n-#CQVHu3y)txwS-th_WN&fy&w+)G?&Ti!b4mku z>jcx{NvGO5gk+kA|(*!OzMHhivV%DJPHn&fV5^L5ns4?lx7RDKq8y7ai^vHRVKxWD+L-c0e>TiKJ&I9%H7K5BCN^d(n5%r`CWbMLLS zZiMUIpg5yPLxVc6S~_KiMvG9jaOQ%rv9Is>tkAlmG0~*kNwwxIXZs1+$`kFqPB@ME z#P9Iz;SrtSMloZDxNMlPwY}k6%V`6;%;~?S<=_)j_Ssvs=)~IhaloJr{G-jA9@sZ= zsO`>4#Y-%=KA#02NiRurZuZV?Z(wBNmKJl*eeK~sXH$Y%;dZm)_{WPz_Q{{zZq8k< zg)m;PbGvJs(>@o7@_FhiO@Bsz8PR6$Wu=IJGmd=ix$H8#v(9AA&gL!PKVH{QJ@oU9 zN>h`dq9r#Te@+*?h_WAgt#A-ibD;R}ldNTF8%nwzJKq1mkKFK1OLx0Bf2;K=-F~A} zUYyO>!N(qkEjt(BvvBN(4_&NRr>Iz*3cT@zx%RyzppD_AV8-~KEvFvnJnCD+xTL3D zW+oUvYU{i(`n}4L3$6DzvfuEK&;A&vGg#`tZlg6_eWL1>ZZ>;(>+Zf8_OjvEeVF*! zoYuWIg$G1j3=g~0``h}L6H~a$zV15z=K1q6uX8&#WM)3xaxP)R$@qYc|82@LYW}E8 zk=pQ9;Vp~&KLi#pI37E3d~^GLP(8goZIzT>P1-K$da>k)@4C&|QBPBrF1mH5%^Gce zx8~U|H`-X;ShC*lW|vluGaua^zs>v9i-f1&)_o1Vlp0aw$ zjLsf{9m}VE_gElOz15(d$G#7{!XqQaQ^S6YdT`+SBy7Nt&hVettZiy4_%;IXFlw!T zgwoK4`&up>A2Z`6Q~F`?BFE-?kDiL%HL(}}nd9C@MXy(7#-H5tEavFPi{HkLv_1RC zxLFgyLpz?gy-i`)^pV2BgR%(d9F&xse%<}_>Q(gQbqj|O}wX*JI~|IL|Jk%Nxwtt=iFZaTc^g7w=Z>*fZl zbj9EH?q2aW<%(1Ov^ zzVYABk=>NEFAhlPJU4S8M}6Cp_Bz_ETf6}#W)r8VYL4z=c80N(f6uC246lRJ^`75) zr?tJA{^9cO-JkdyMmsHS{V-hV{lI2fiBZm5&jb#_8xiswQ1{l zomWlR5|Mf7_M&vHSBoAm`DP`W^MTpRxlnDSyK4HibIZEkDLfT^%XHzns5y?~9&Hyi zOBr(dhG6o@!MWTAi{5KIi@m$SWN7>$rNO(#>zJ-{G*2_xlvUXCv=qU>T+I^d(T}<3zA<(q_~gT_gV+HiQ5?La%%JDpx{oI`dBBhjuqPN z%U;)XV8Q3POP@3>>0;-dlK$yn%)3GP-EK_^*|E0Sqa%Umzdks(Pc65Ivw|^(`K(Pl zn@4RwT6+4o@B6m#_7;z$+3$vKX@B8ouP?JU9yu^xJ>_vz-?c+Wzuk7$G|TR`^RVyd z-nCn@D1X(<(fScVymxPI>FJvcnm3^N)%inPq%^b3GhuNwbT14(>$rK3Ru{8~Tegnf z8s2Tne3}=r}=|&6dL5X?RJ^u4DR?|?s_MlJ1h@DLrEsvSE?XsW$_;2Ae*Gl#Do(+6s z%eEPFdACBcr^ffs5Hq*i7XLn)n%V(pXZ}{xyHo0Jfduo%3(~m9q@14KTr|<2@ zj(vLJ+=$$Q<(zYjSoIO=$qOA^{5VT-=NRP$5d$@Q6+LP1(8~Ae#&x~)y9g)kY5v7% zw72DiyG~awKMdCGcuU-MlDU})Q@zpGFDbT}4Fb9dE}LB4efFZ4@Is>>N=>z%D;tNk zX_u@#?W4m@hoT|rp%*i`BAcEq_IKIH+wt?p2V z%x0ZeO`eS{y6UjjXd-=U+wS!TBt@aIJ?-g3fgVwds+ofTakfLrgsN3Bb&g(51 zt2=eiV8z8}=v|5W@%(_hleJ&MfiB4pm2PXVT$~p+X{D3i+68B~bWE_h|NFS3xdqzW=CAVIpA`U^lSGg&12uVH2k(| z$%zS~=brbiqb{FOnKFO(b>6_8U6MOJ8j`ScmY>Gj|3-DmF#h6jz)#p?%dWNyH{H8; z+&pxoudtQ(kt2I-x<6j!`A<>Ck4wXP-aohH4)(VB*OMb&Yp(7$H|~Dis&8tuUp=rN z^|Jf)d4s;R?78J-GehpIudX+x7Z`$@5%UW6Y|~5nwmNLTUIT3H$EX33Pqu&SI5~Z( zOGNW!UJqD#Y0smQZIrMmaaw%t$L$f4Ws{%bLs#y;P;jC6c+vE8(o=4k?^1^prKetL zqWQJK4ovW&N6ta^$#q=#|1`$Mv>ZLj-(!NE%C`92&mksz|FOSq`D0wmZXxbTq8Wn5 zdHT!!GkRW$+CHy&N9`A@Hzf}=4%}xl`G(=eACunfGw)_?V)5#!j@C%EUXwgh8b1wN z(NE>u{Wlw?Ex4}B+@_jvGCcV6Chx(W=i7c9mDAN_RmM+~)DbK5pYCkDME!m9$-$=I z_om#_H#}$c^33{EXAg!%bFC8+cE9NV^dOvgH&?SbdL{jzPPQ3%`?%s_dz;>#qRhZ^ zktVv)LpqK3p7QqT_+1m59~7&%Wat6)o)p^CpecM%9_8NNe zL{cBMu%4%fb^Y{4{d{k`f`)^N#0G25ISc=7KftJ4-=M83qvi}=Y0K%WjA^|&aP9E? z>xl#UXf;{h+%0n7v^}Gn?{@W?d2qzhnXKT&@dvWfIiv3W*uHUzuR&4Vkz0Gin-ruw z&-3oH>W0^2;TX35nnnj2Nt-nJp4dQ1=^}$QD*EoA_~%`7(^`J{`g~e?{DWP|Td=vk zKY7KtJehD~Py0Qe9F-gCEDrCIG{NSSYY30e;d#Zg4D}q%uDS0^*O+y+$!Xo>wA5D2 z7s{qPl)O{ge=lk|b)b1cyvj;tlLr0o*sW}M@K z`1w=Q(Q#q8&YE#94SR5lTFqL&aor8(>`o_?*0jE^(s_~6u09+U-?aXrGkwi&Mk}>) zN=a!mW~Itf>!hrC8q=1%nRIhUlO4}b?>uya*?B~W%Ffgn^@1E9?Z(f4bht70U2@kE zjYoYPl{`!7D-7Xzb49Lv_|M`4c_M$55iAt=NW8^N9{i8O!XS>AC*aHS9mzZ^ULbccbG)HP zZzj{3>y1DlYJ{SrxZ&_>46kmSKna2}@o*RN#0ayEy$#bBii(&aC{HAZ#*!xlJOUvq zJjla|8zg`#_G9`;f&+Qp95L62ENEwA$7Zqwd@+|VX1at2(_FB_AVoy8;mQ|s{dgiV zSBP*BWsoo|K~S)Ok4oBD0vW{pXbC5f=gZ>?A#UX1SgHg%!w0BQr9}3eAetU68xq-^ zkRQqH8ten=0+L*Q2u~>B2O(M_G2%jG9!yF?@`z{y;vf#+hY7WT&>EFW%_)TySqTDt z2=)w1^L>dlk+Z)*DE5|!30Y(+6H%!mSqkWq)}JdMMUdX*mCsbvKB`pSRK!z%50;Qi ziX^KEvLfUajyNk-H6Xi;AXMxvso8-jgN4q^_L=fq^K_3gmM5 zl3-`D(Gu!$7ITDz#g(>XdDAB}CaXfqY-DknrO0uwUj7M6#wTvpKpn6cF&O1QKYOa_x}R zHkTu$Q~;JF3H=*1nlgd_*opQGT;%DPi&gLQ4Psj;k@_eAp z5T2^EJ(X!Q<~|`@Fa{B-5ILUcWG+yErXWTh7Ae%3=f|g+HS%y)5RI~N@EUT6M3&q@ zu7a_#0y!cPvjVQk3}lng{wt_MS>vg=;uK9m(QM31eIwZsgoy_e@|cT6+#s*OaMDr~ zy*aQ+=E?PGa@9jsfqah#WGK0&O#>Gn987gK$o^bGFcD}Gb#hM5_V8xnF@3tcJ+mC_ zdZ9u@--XPLi5z`tPlDbgq$-0s-dr%HDH3QssJ|%JQP}ao00>xL(zu{U0lNclCKMo( zFK>kMoX9#q1s4aVKy>l6Jt``^0-LiEa=A^vcN6WNnVfWeI}AQ7Rf- z5N^Vb?8k|B|F2`d^X?55?rak&ta6gPY{o9Aryp) zxR!x_Y@tvfwDIE$gj^fq9nx4FzBe}zUYvtDp?tC&nWpC;5j*%=@ zd5qVL_lysWLdHi%5#tl%GozUCh4Gc~jq#oFlTpHuGP>g3@jJm8gb%~RaV|a`cfu#*L-0xXaJ(DtfrsHU@Y%R4J`tDT=D0UL z1|N&}!VPg_+y?K5o8rE>03QHYN8#geH{21Qg*3?^E<{O7IUdT} zHkm?HKh$qdF;)Fwh{!&qP{9bIpa9GR@(bmRFXt0sDI@^)8m@u@(lm%)unQ;-7l8nb zk&My5*^p0K8pTt-R9Wtl68V&U5)hDI5)%^-*R*NVl*xR`KI!~VPT<3J;)=Lp zqLjH8Omob~az#WrCod!h(1JclRsbcj1R^mcTX6zKTs9xg2k5?~483xGQC=?wgv+c* zeoJj%1IMh* z^5^jVxY|8v{c(K4QBiIv>Ck080QEwNheU)v5{({UBu036cMcEO5K=jSgXk7eDv4>l zCy4@jd}8qDVaMU2*)!@z(2xd7SU`8|3`09&Vnjld6>1?7iv|3eYfrBt^*L%IgF~7r zpDR-Xnw$bh6)S5zODqgzhlquQ<%vATgG_!xu1I9$!4Bhz>1>jBP*W*@p@+Gx?RYt? z9tw8q8tfWOj7Yhp#55)tkO4m;4|i@L%o1cBvcqHt8iF3j((5XOz1j=N+Eqm6P1Lx^ zgXrNYRvZOT7a%Wq+ z2|=B_h2g}jCdM{a>7L@p==x$2e@I8hWh^Epa|j}y}{@cQi(SMed6YX zi9~@R0LKmEMi3GG5HCJgjN%kMLwR~e{S6F!xN;ODP2{r`vOK96CrlhD(ua93g>Zm; z2{gHpL+2@rPv#1}xIzJuM=<8Cz@@jypCb%bU^5`tk5&sBVGBhZeMq7dgHp);VVCTse__}b2D-Nq_jX1q zV+Ug=gMp)4@oJ2tJ5laV!sYJ;_yT+hzO3Axf}?v2zEkerg_quY@$&b6y!1YdAN$4q zFRplB!LQ(VWcPiXydUD|UWD&}`x$jFg7`BkZ4rJ$?k3^>!T*8WMfghmBCd{UV)OCU z_y+tMo`Y}1cN2L_aryf=q|-Tw&H=cOL-}Ol{UGsv9DdPVN==^1T!21~pQP?fIC_tp@kXX>BVy|SG67G8 zkc_XuFTk_>jY^Yc*5RA+ZA6J}R9Y&;7UD;V-(>hb0Wp-akGkoS2tE}8O@)LwgP#LF z_u-1q1&q>CG`59Mn#8*h|G_}m5ljNu+#UQbJ{Nz1zXI8j4Wi#;_+j{+3-=PRy{$xS zE!f#yygh{F#C;Rb!sp?u@b&mrJR3?O=+ZK4@l8oYkTmh)%fNMY4 z^f7pE40gQ>xG1GI7xY0>LEJE)O`OKhg0=jMU&gQF3mCib+xUO@J^Z{}Da7>xz_kE) z+zYL23j@))15dI}&oIdQIi88r?`Ifi8HXUY2H%b^#!tcTAzYQXOCc(Iqsy$p(VHUF zX@VB{yNAe2gI`trG~*Helz=CxDV9Rqlue=IBo+BmBz8J~IsRD2gHjY8MFs{u>6?6K zL@7r#g!~3nIwK0D%fr#|rB4K{0_6}~LkOkN48SBGLlAVFd_!dsO_WOKkeHRJvSptL zu9U~pGDs#eR!S2iFTy_)4jQHzlz%QWzbHFDDV<+1VW!2z)iA`>DFzlr;jGD{qWO_* zeu5Acl)0$+6Wu>mN{i~BD#$1LulK{H(lm9cG)e^)7;qw#U`o=`fZ-(=ro@2qAS4;0 z;F$)A?=dB%FPIWuK|tvh=Ka8MB_RA00-%#!N|+L+p`k&<^^`EIHN5FTKq*WJN|-YI zV!u#r6qy+nMZln6c*WAv(%=a%7?490fh_TWU&H~)hQf#-(pY{N;tdPKC{B$Q=qNFC z5y8L%MlUctLgN^;_{j4{31#Ed@TQ+UUaq&d99o4~WPf=;Gz=p+qBxMn$9Ls~`isTE zK4`4tLA{GSy#sl$SPGeF07qt_Hy9+5!#E}hKx9+EB2Too2%A9&5QL%tt&kPqxgiIL0`7nKiyb!KF6lVGJ0)5at&YtV1P?qLE!spR*N@AxBO#uVLdm~)T zPyxTY7_o`wy)=hBaYam0?2)`G5UPqv_)HXd7NM<5rob1ie=|iAFG^7&Sh+=WNUo1Q z(*?95pMww+!kbhkydy^lnxmvIs{kRnIu3*@R$i_7q7b9?`${UMlrKkt2>wwE=1jUy zN^2z4pUbD$@qO&Le2Hw|#r>BS#Ii)dEK7x&D32a&2H6@~b`O*@9GTJCqKpc0z|@sk zEr6X7azg6^g$Quc1T1;JzFg40H`h%NC<)@CN+?Z3Ya_&NaA_u5+8$+5o)%z-wFRb} znaa2$DcM>4S`}17Li(VLlnr}cLT)wNqFixU8=^3jrwE!Xt3^byas|RV6lzflK0u+i zOU0yi;JD?LqflDjgRm@R#Va-fwDbT<<%Do}fv9yOaGFj9jhHqaxoW7Hw;&i|SyqOc zs%26kmH0tQ_teAMqRMKlq)wn3iE6Qi^)~V>2i0PIcN!B2=ONDeEVF zBH@6`+CguomqaXU+pyLKu3x5i+N%=VZi;@NV3LxyJZW;}huW^AI}SeCNsxPa<;<({ z)=p6&t(6CsLDmN>8VzPnL;ex=k0fY!aQZalrbS$|`-0-#Pr`vgd`DVH{A@{O!; zw6s}Cb;;Qv;opePu6+9{*ED3tO23p>5$d>T`&Q61**fTg6*Z6wwacu~UM=o(-rBVV=>8L9&Ym`u$sBPlM zoYqol?a7jy$Zpc7G>cAAAW1c$N_$hpEj<*09#5fcosAGErmEEw!|k&dt zMlQe+jXQ*D3I01l80qD8f*m6U-flSzL>(>LoEFIkKt)0v*+3@bfc6M=a zVtd*;kPGzo0&(dE7UV1DLV~L!QFNHLy+E7V1&}X-@H;xO9nAqJ1qz!@aF8=_8f(Bn z)<6?Wt3Cs*EX@0u46?B7W6m+Lvz2uefx%nhUy2x zdbqbfjED3&lD?cU7h7j@Cr4K&TN`^T2XhMtR~KD-0lDeo0-JN5_5#v~MAW_!72}3^ z2XcaV-fZGY?4{U1C#h=>WtgV&! zlrog5i+0rHilC@2xql*;N+tjS5e&NJ(#Zr}*!z%6gc$5TqO*VS!*u6Og{dR?Ya!G{ zr$wNfkpm}p@odQHBHDALv~NyMr788IBXw|wG!&g@DzmlZ!}aAz0>z$Q96p?<)b|Ps zwjkatc;X;VFfffaf8_|02}l^OSRonW)C7cwI!ZKWC1gM`i(Lr13#GG_Pd zZ)D8wGr+`v)yKqS5UbCi0Rs&Bur19kER6>l4eUSAa=I?LgC$3dOptB=QCMYhvbEF3 zK*hXa^>bJ}pM9&nNM z4Aq1-@8QraoDd+7vO=Tu2@Hg>8o6z6$t6!aL*3fINm#k48ypBFXN@Ez8sIzdQI~;s zk!?9%+(7cQ1X>m#LF@$xhlqwDw{R_?g2@&}v{SBZ2OS!Nmq1n)p{K11niKs>KP@;y z87NvuK!nh%-x5s0VVrhQ_5E(u#Y`j;NxAT-RVYJxQDa9fJxmM?4aUQcwWW=d2iO8#aa8w67e|A)ib~ti>vSXF z*sd%>9JpbYJsd*x%`6uuTW8cW8&P}evIOHE%pT;XIH=Hv<H{lGhWg$dFS!;mUaswsMhD+!i2TV^Tlijr?2XWy94e+5h*${V&`J=>886>u zd5}GqJT$mFegvEfA>F(O!6s_|^2AZs?IE8)dT@{N@;yGB^M~_0$mvlMvf$kBWI94l z?xCL}JSLAc4MLOpOs0)5xqQok4@J<#fExm5Czx=!+?zNq074k)4VlPHV zfkeI0LN^dYi~>HAGRY)D$ORWm&hXM$wt6sq1WZ1RMg2J;T=))0Ao25OA`@eZ2zsT<4CrGJ zBnG%ywDt_kqatbnn_h1efkMZ^jNF^UXL5M}i_ZKb&(0K~H96u;bLk3u1x)oOYf>P9 zeiM{NRUi`%?8x>PM6mD-S%Jj5F0mJ&C+b0zBe?muw6ONNWl@pf3Brh6XA1P%# zRRQGui32CJLkZgg?36JfY2my~nTnIG--EZLSp>b(b2o1o{=kBg5Qzfw2e4vfri2z0 z4S-k|BMg-;BC|(gXpQ&)Sz&pKi*Qw7qqGEy;=o=Ee1k-`FE99@hHOU)r@3gh3Ee1~ z8Z~2O$~?cEXK@(ip$pS>kc~qeSm#q~a;P$prz2{QY+b~OY$Upu>JS6M{k>CKdVf+MhX z2;e)&4O^&Ms!F)R?%?pKFaDUm@Yx!2Mew1WI2`JQn3WN}ot%Kl3XyIZP9cL6S8&3B zO(5if+k|~X;=>`-<|Kizja^EU^mfFGnylfVCXPlQ&|%2@IMf6ax>>*vos7sI(G+tg zL*E9dgs6{&1X?6o1byT^jF4h0=pg_9=&XOyO?#uyYhm*P{1ZBwP>DP4&E$v?4B^#z z&^edwsbn=&)1Fqoo!JZEShQ@Q^y|J17SXs|ANZ_|-j9$QW9gS!9HY7^h2}!LCSn{x zxTflkDC&E}tmrY2lR>RQZXO}8LQ+%@`RNiHW z0A7MH*l~t29Np;Y)pht(7QV_9!Dx_Jp@R;UoC`+x@IhS};`06D zaI{K5oUjLn4}UBHzHSzk8Jm%V2ztsxx>Istz@>E9Pt+_rSwwujPfy&mQIpk%Gc%=t z&>lE)<9-^Rv>uqx5q42JIMpVH9oqWxRfZPRJV+LZ8g>n4I`FwnVhbR`xpev>_6OI( zhqjEW6M6s%`V$7o!az%<$`sr4vHMx}&vTrty$-S_-Yge1?=Uf@GLzGUV%E zUGhmZn89dOfsm$hi&EsH>?Ee9Hblz-1AVAC_=lP%$tx4~xj{#Y^yo%PcgsHIRHg_| zME~C08xUD6~jf_-xLd@8rMB4uLk<3X`?4ftLnN00R5FoD3X2&OUG)jc`s;r zIjp`l;-fXt*8@~E4^`1d`704^RAF$@_OE9twAx`_a~(kYlhLlO{HuVjV*5Kayt@8| zU|Q}6**`6Nb?GmK@@4Jc$nqmAm)*NYx<_mv|5H=?CQwdMe%k*^&3l{gw%lGb|4YzE z&AGbrkAnK2Gaqq}VP+%jt^6$y4|`>4%-U-~rq$$E1LQ}pv@3+_(q9M622(`LMs&3J z&VJ1P!P2X-?h%UGw7>O0AN5!0G8=KlVypSv!G*u!e`{L*8-TtlNgkUCbukMBi(;%FNkPhJ-gbWB5A)JSB3Bm;k4H}T} zm*M>igsTv)LAVa#285dsZb7&W;SPlVAl!wJ1>rt~2M``Ycm&}wgeMT5LU;z@IfNGw zUP8!(@CpLrEgPOW5ON{pL3j-zAHo|51rXjscn9Gf0BJA@w)enKdLAccT|Y!-HOOB@La$dea?bqt1}1U3Q>Y$&wUbTu+S0aS>%067)~ zZ}fL24h+l{objK(F{zRZFyg|%9RDFUhGV17rUYj1-4n z49w#9@sYgwF|c93g^S`TfPoFJJsy&mAO<#|mN+Obf*F`eZ7`7ZMGVZa#-%CBAq-5v zW@Sm5Sc~#a59*{>4RBE$U>$#11_LY9`z3@NBNT7Ca!J1^I+g*0`Rahuoc5^}G>s8+ zWnkJ>m!Nnyp^Mez30|;El@w_12UQ7K8EMRpfpz+IX-W#S%1~4{-G%{^+sc7yS^kh; zvSwgfl~JQ48d*6rHO*l$ur`%YqviU;Jp)i|RS`u>Hm90OP&K?c18ZK6A}w7V_1ME1 z@cC*P)+hRI8>mz5n?Va_glIvEj5ved^LSY20QswR-VA<}|hc$+E%3tgdehT92GM zCxx+ST9fKpDodJ@XB|t0v1v;G6J?rMxAkO2>#mMRX4W(vSc<8;8}-pmX-ebkkPsSo zQRAORG`%{N48~h3lsuR!O|ecT1d4KFS{0gR9nKnnVwqWkGEH@Coz*3bCehZ7;?1Dx zjwzF&2=*H>pxUy6;`9i!4&@#2>v?aTNepx~E0DN!2H{>|?(bIs29#lQw4$3D&%0Ha zSy6!+r2*Zl)->v9)(@1cTDyTo{6BvK-L{pYrER;8WbVg+o$N|QqH4NMqz1~>S(kIJ zoV!}*U_cukys7l2NG`rbmiRDG6zXry*1Z5klUDnb*_SM+S2Pla-hzv zf;!!IIaX>ERUxP(A81#9McttiB(-G<1M1pUsCj4jF#WF;ySEdDp2oUJ?gUBA5~5G>M(=>{hIFZ{lQ%s zpx&d}($HS-kILT{9crzPrU)3S_5VQ)0R7tR+uBs0=PDpE;GlOEFbevibTC38u_g%0 zzykd~Ws-i4nzjS$8kMRXC(=Oe_TjB6M_Q8{px?KKvixx!^kKk3?V2zRu#_eIAuRw0 zwLVGlr_Ra%4@NcBf=myVHB?`Pgn$F%3NwC! zE{0ctxF(DtP5kz$HSD)_(Sv~v`3*_vR`T2006vEP1|M`gF|A1zl!pZ_hW!o~va$7V zVgWu(e~S-VA4AK_Sp5{>;s^0KBf!TW@PU+0eyiO9ClaANuU8jD|7A3kM|^{=jVD8d0Je{cp)>7|zAUEpQppRpB$h2o`_dg;o*{^;t= z?`a0OvHf$Jk?E#Zr^SJnKfG>9>84h*Mc~H%PijV{8zaSbQk@v^^2gWmDc#g!Jps6> zqi>I}TIi+=1FM5Qp4w{%_;LEPb|dF=460)-@-VZdaUtFsd!wbKxAG^TDeB-2svs_mu}0{E%Jb3&Ak zYP9WeFxzN&GC4)_YFH@;|nF{{!Sa5cI9 zxRU9sa}_i(;482Sn5smpQ9k7*s?=8-1{PGGd{tj#z!|?@Iiqc?)2|f`dRoCW_9;@5)JB3JeeN{3$+u74YoeUnp##x(2MTgbjp`lY^rt9tbKjcL38<@W)= zQ@!=s&1jC=Rc=+lPd$ydG-z&q@zn@$Q!nG>mNYL~m1zbzsfW2uYnqR?jLI0nTGqo{ zv@OL)lX73>)d%%<6m<=`?;e3}9j{Y#q^JTV9K1c!bDgdqF)4bm2vLVCd0iK-$jDnybG`e2b%0^z+A;JP^=Sp={1VWw zPa7!XFM)bJ&90Ui77^bX*{>)NsZYWv7 zOpDY8tY_&}7pbyRKg30)nuRZYYqUaDHxj{d)EfPLj;f@BRm?us)er$!M>Pejvo-vy z8&ydLEBCcn%dDGPgH`@o{3VI1B!n~cwOsG58!4H!{`&~ZO7MR<;>ya(m@2NMtfbuP zmn{)aeg4L3ImljaT|`;AIi%vsWm^KkR_a?|OZ&IJbyrqW!<3YP0*(V=_-`peejMah zQdaw=^lkpY_uN2L;d~#iq@;u^m-D`eyJl!wQ+oeOBe0lgAqQGos77zfO7MS5HUK>+ zDZ_u6p#qP_ztjgfZ1(R{1q_G^Y?x6us6ztRdULHxllGL@C! ze{dssYlHYuMgN@_M3q&3siOvUvJVLK={_5jB~u2iLGp=Ai?l3c+Em`J^i@~i1t}{v zBvl1}CY81?6{vK?R)b$^4|A(THbqHm9Fyq}d|qV~WZFa6fmIUj@8}O~4OfO%p#@q) zHV6OzB922``EO|tHar;^t&{Q^L^WHQO0-*Ll<;@72mf;laxu!FJ)}JJzwCiB8!CY= ziHyoeo^@z{aF~^$q*S5hLTB7WW|+WZW9X@nHvf|L(0@M&w$=iE8lujM&|Wj(33))o zQ)x}pZ`8V6-L>A$r;!Xp@RFD&f;ROc&12b^+*Yu?c z2c1egO_|j}?I9&9w+2g8`dh6N)Pf`Zp#LBh9ETDPdV}X*(-pKeWvmVG(Lf0Uy_LC% zvB_U*iJ&RMww0mj;i}-uKvOVY`-|<6@JniFG=$UyUKKQ>CFlBS<$*i|#?Jtje(Lkuw z@Cct)kp|_V{)Yb0ECG0c{u9mDN!=;Ie~|K*Y)_rm5#kB;62OOc1>O$8z$Rsr*uT?q zOKlGE0;@a?2vveD{w3|np9nys@2<2q<({Z16MYJu_IGsG492>^in2P4;E>kPsJH3g z(p%YcG|JF*!Q@W`dRtQP9V*LoybYqik4)*3-Q3Q6-?k0fiY7Mj;uBdA9qX(_DO+Jluofu-Xp-UO25o)`uR z5GO$8(y8*aAOJ+aR`irgF)Ru)sue&>X)`eFIg~-=P(T;jIbbqj?-8zCIK8C{PbL$^ zFl;OA;;O+ur5?O9A(%lxo6P8n0$BPYOVhC^ilHcqFL**yT3Q-B;RQp)(L+i;;Fsiw zVhFP2E)}U%IwM$?pi&I+;^JZ|K{a#+#HBMrL&*fyILI#vE%v=YCJ^~0aUmg80-2x7 z_w@~oLl9(scJ`dmh>XxEh!f@CX8X+uy+Fhf{*t$lP#jSvpNy0Fe!!7je)bGtD73V^ zpR`zPX(=l&jfDIwXJz@)$k5`@2r`c77nkIOhMt$pFV4;m43x{4M*8|*5to)PE)EIw zBja(1FmcJ{OUV=@-;6NJ33K9R6r&Ur|6&aYOGgSQkJ*+w(qL^yukO^H3B15Kq9H2_n(#+xu?{5gCe*1$5 z5^>cIGgPLT2tE(T?<07?@V@0q)mDO{fl)*hQ&o*Jh&HxTodeMlY=-m;rY?Pt;nL?| zArOW`P=}xb0sm9sJ>dER;Rl2gzzvqCE{(#5E84j#hOQ`O;z9l>c$z54gk-R3;sL+# zO4xbY<23C3rOnu#_fl-{ODQ(*jue}GUW$!4BE`CG2WluRe2igJk7AhDQVbg@!Z0I8 z>`o@YX8?REz|RMG5x~0xtSbZ?fFB0%h5+9U;M)Q`;N80y;O7DSWPl$5@ZA6wG>KsV zj{!Ue@EE|upWx2~_zZwg1^D>@F9LXXfOmy9Xan%W0NxPby8(P#fPWA0F9H4zz@G>B zBLKf0;I{+(LV%wN@Lm8v65x#hUJCG1fR_Ti6yT)*F9rA#xF5rP6z-*Pi{N%7;NJuM zOMt%v@aF;k2*4xk+W~qZKu-l|FMu8i&_;ki6W}udJ{92S1H1^}-2vVe;B5eY7{D6> zd^dn^3-EwGIbsdH3S_;)Ag6eW~#IW}O{}SNu0Q`A?KLYUE0lpIR!7>3p1K?8uem=m90Nx$o zD={Cydk5PK@bdtEGQf`j_-+7SnS$;}GXXvW;8Ov9KEQ*frS2eD#R|FuEqSl>CBWYS z`11gN1mHnAl_=;AbOd`L%!4o)!Uzc6AXKKH!oorRYF_iIBxw&B@M~=iyO-(T)BO^>#R~Kv7t{tYP zriQ)$F2z!kldIcLz0S)auGg=jb(On{b22kOqwD48%$%HZAYW9nUcG!tWWUVJoRw9q z2vJa+6F`>Ne)$;yv;(pfa1^|z%g1WJ%+$^+C@9DZki$`0J|_0Fb{t$m)A9mxir-Lt zmX?o6(vFJ_4-X0gfSlsILJ~l(d=ilzpdBC(06-84AYVQPNwMKbekdPMQTe3sSkNCqKPRVx@}ILv{RK@E zL`LS7=l^9EReqX4P!avlS+RK}{YuJzj*ZL9)7B2Cto+L?kbc@UlwBeH&lG?lG6x0{ za{9}9l}TTDaZp?(z)zn492IntCYY5K0RI%q7r)B9OI_O9pcnuT00q(YS9~|Gps?_5 z0o=$^wN+FAL{5Kq3kr)Hy@ESOqFJC>P@I*iU7QEw9J>77!h*NbS+i#4yvqyF&dkv) zD99loDE{Bvl@ud@S44J!0WV1odim2hBpe=lxk~B3SMW@28b2p ze-0>kSDddYc{l6TECe7457*4srpjYjLGkB+Vol9}EQ#hU;G_{?k-W`Uk>vw`re<-# zymu}0G+#^S0TTAx;@73wfZ#J{rRnkX3DpfNl+Z{iAM7Fs4=CSScwT&fUPQCEnEhC-Yk@Dr%#qc}AKP{CAzlPD~dCOIFXQW#ZI z0Av&rR0sfdA{YI_uIMBu(g21X zp=36rp1*qBfK0W{$JDR`jjnb%qGWrui;F)`#0(Y+{Dhn!rZg|<9SZRa<=vMzaZfL&gQwN~c8zlbAA65i%P95iI&4p5!A*2g80s>WHprocfE)0K<|YJD7=K9ex2;E(_oT z%O#d3=!>~wVu;>q3O|T1B&$pac!!ILVUzTQJ{&Oz!|pa96EO5OLJJ6Tml;fy^@ZF( zfj5SoKjp`&4ZF-Dq@A#M`Tc*Vrx67!fe$)}i$31XdA2@k|A z6EYy#vsfB+#=vGyE473#k^;~3%Es8l@#zVcI?DNt)lXd^T^Fz+%>^PMvKjHNN3Ls}RehSja+~#f|YEw{5Q(yH{ zw|wJUS((jkr8@hT=r+LQm$i(RO%Mb9uq%(Larse zj~yG&c1dJUa+FHOWUxn|R`34`YE3E;$4e&VZfcBSF=^^Co1qg;WRGx6Wa~Kk-y!pJ zXF+BndxB$P%F6)Ik~RU|M<=phIZ8D#go6F*Ji7@N&-PDXJDTM; zPGC<+oZTP>hy%(*_G}QsKX)A=RU+FKm^E?qKS40%pTV|8vgKZYL!?Lulqc0xhD;=0 z5@eA|0A0-XUk%BQ8SF_&Yq?2K0!%YFKuIcb0WIb3`ze)1pKUrjO+3L}dKXCI8GuR^ z%0TqI^1vbIEe9$AI!hqZ%F+KHngL6K0c#Rn7ia0+M7vg_@pP&z#Lp{h^)`ba=6Opk zB`g6%N<@n7b$SSUg8HmmAQu2de_=$bB4A6c5)84E@B=JS;*uK;&#`02drpi#7kDw< zHQ`P4n^w@!PJ!Yux7;z13-w-<>i{na(^WxLMe*$S?zz_qX<9*4s)?!z)G-eYncQ-_ zA%ux`Z$>*FPwRqdIJ?KQRpTXZaudLyq!QKK7APOeIlJf1g`|Z0F^|+^PJ<=~vEQi2 zph19J?hD`_$o|N^4=>2pz9g~{?H}Yh6k%7T9N$&4?@=a963fHpzsi@!es zr%S|s0JRSACWmGOk^KoyRwEW91{5NoaLNF(+}v{?K%P|c#b1Mfd_u&2K>BT>3~-Zc z1?&Mtt|`H$RPw%58QVb+B-sXdLWX}4s_5M1P&5y%{v9ubxU)afkbCYdNOjA7^NmoP z>S#xjb&wjE$#sTI5VZ3kwrWT_#14|wJ=Y$RohcbD;9ZV=#4oVfjx5+76>NLWKCUVziwDJWsA=S1VQ@fXi1V_*`aOAW#rGTjosl3wOMWCk#UNqaayLS^9zFdBCRUC~6E|^ohZN8bSiU>0oX8IDM5A}hjR#o&=TOZ5 z4pBB7;_kWczkUsH!UCcsRK1Oug#*^z zyl`&33i#dpl)EOWbSvy7z%I_u~nN5l*K@~BmTFZue?52BU0oCrePuaLu(*25R})$e%erGvo>H!$tO=PAA)9=l`P zoPXPXc=V2(hGQchIEkQ~3%t+&4mUFA+}8^jFuM2w9nM6}XfQ)e-iPST9nkS%RbRmV zmYu;X6NPLhZ_A+)jRa#Go6Q!}PYYrJS_sCfInD(3GB2`i4zFtZldiwOVG)DDxOo`4 z1p*8kf&*?7(>l1_9B{`V(^L@+@%-yYpt7S$Myq#$Rp7G0=G^{zyjxV^yd_rhrKxeO zD21R#=;J#tsXSR(9PeHjpUR{Vi)n1!J`W@QFKAEbqEO)pxDy9A;eXEbR8$^OUyt{Q z*W(?q8q(j0A3=o1g?Vu9$Vs2rb6C|=;EJZly!gJ^t*(BZM#uRR+o5mTfq_{-Zm-85 z7YlQC+!5bbS{$ipA(KHCWg%kx2FD(- zq3}B?3&Drq4)|2bmw<6c4$P6{gkjPkF>;$XJ-LdLMB+RESC1dDFg_aEJfiBcW2k;H zY)DlTlxfbZ=g+OonGq51&c0|EiW8lX8U?{Z+EurKeMBGX>7DKo+07QlcLH|~A9vH+ z_(N#b%$c4nrZj+}kE=>!6^?{NgN9VKMQ#g2VuvME4MFITs^-c+=T&q>qNhliGcFjd zAbsINRswC9)W)-mpFOCN+spqB^1qY(A1D7KWr7}_hh^ePST;U?l8#@0 z94429`)qtlCkruH=Sj?*kdrvUiCZzKe_X=gL2FD?KsEnLO6W(=)bznuqHry%Uor-QpSxlv`X_#Y%RLy*bC}$p%|v2WF|X zwMJMH7_jseIgCMF znKczBYb_Df1rCC{QaHd%Jm@DN*TKLXEOVC8$bBI4jz`!~;L$e}SPn4`)Jbkajz; z1X&J_kBJ))KekW5{*Wj9F$oFEgPXX1P$?=#WgEpm|3lDb&`*g9OIQnpIS^KA37gHf zg|OPLzp`Csc+$d>)6<1LXh^CvJv~0pnUs_5j1fcn#`o_Z-bKa@4DO$ml$aiqE>{JA z47wpbYkXpQAGZ^&Z>ufclkHA-X2uAyQQjxHrs95`y3cUo{y8%oNFEXA9G^3xx7(RG zNr;=`2M>%lvyq}O`-jlB+^wUQY|*cX3dn0G-~{0A^MrW$Vj&*5K!}yivF?fcXK-H( zcn0^)k+u^c5^y76Bp?lt1DFj^`-XUCjfN%AdLlhBCo?J4>6V3!&B|~=0!D)~x)YD= zA^J7@MH{irzNHjaC$uKgc96NSEAc#^bTS$dW|f%lTu^vA%?;~#F-6ZE)kG! zSei3;uro1vfRkJe9uha?=q_))Hak;qEE&4G_vCpkaTtXV$&sUbyA#1;Oux}4ucHS$ z)18SP=jfEQbf;nr1#l&gC!y25FkY4cH?-3wopy9S+BvjK>n_eN4|Lhw<^3*N_+{ZS z;cte26&}%bVApY7XLeoI^@*+@bv@kmWY>^xmv)Qj7T0ZLx5?e!@AgBt-@Ao&Kezk5 z?kl>#(EZ)+d%Cx}wqwMD5syba+@n!sWaOa8(UCckpGG$6d3Dd|p5uF#_k6SGuAaT3 zvZJO&d7}!W7DO$MDveqZ^=Q2md_Y784~+7p zYx=#pGXwlb|D2!CpCp~5E=6B@@aJ`LbDaOGC)D$)1>3hV@C3>4s!Y9JnK%D&3pmZ^ob@EtdX1%9Pw2{zXOR>Jq$VIT%IZWtqn?h^MO{ig z`0YIiXeN}$aJL&S66mZZgdb&XoLB@`*1~bpRkFs`8*#ERdUC)~%}B;ZFte5$G9Q;o+T|`mgiC z!@GoAuBPGPm&f_9=+5VL@%wORGyTyjIM(!sca;IAKRUdV^xMue=o#^yO}|PX-5L2S zN-8<>SN>QtxxtVvgaJry_}g3#FOwSyB>h+Ag3 zzu!pC1Tx-8Zu(X3%%Dpg^D~nx4k#_)q;RPCE>+y@K;*mf&me?eg1L0~^ZV4p&m3C$z$**_o%eGY;B z0s$@RD4{XhV@tHInL00ltG4|U4hLiYC-y&si()T%@mVVusn_*&)>|2dgCfu zG;_aS?iW+Tj;Z$oO0@`>LX~hhLmo@ztCexhycI3LXXWLf{ZVg^mB>8^bej;ej>m>?>^->`MK}sQpPKG!S5pd zK9WR%0$p|K&v_eCYe7gMZwLN{k6-_djD#)Y<*d zXZJs&fBOIN{%17)KfaC}Il^t)bzDb|?Ay2VnWgjUz&Nshzly(id2J+)9Ki1HeLI)V zyLb8W+7P}y0EB%z8NFvuO#(*_;6euXA{JK-gd_VTf)I$rT`lqZfWhgx>Se*$MwBP&)jec0fA9wNA@6g-obZuX8qTG#2e*Ph=+6>Sns=Z#+&7n2#7yfP%sY{ z_E3k^8h_^!6QTC_B|e1OHWgRohiRde>S<~zGdqL`SS83n26O}AAxG& zG_rC1jdqHaA1CYZD+j0OmS?7x%Sa-a73VIk!EX{mv#~zP`B*p3`;BbPZ%G z(|6h~dKTfu8bAP?3x5Lu=K9`CV2^z)#J^Xg&hVH?Kf=26yUgf+Z~pUNobLqx(mr6m z1AoALN5)&`JMah0ci<10@4#=J?}*@E9M<^`{nq&o{UaoAaF_tlo*E{`t#rZj#Kw%t%!fT#t6cH=PkqXvA3qiqRI;Kv3IoMfz^6I>l|5@9DBVlIWL zmI+)xbO53OXXig>-~T-O{wEs3Jpepm$AehX4Az<~MJ?`KCC<{ASAw zFK<58{ASAwuWmlo{6?nVSNHrzrk8eP?eiO%zOMNVq$ktYHNTPZFK>RcuKA6T9`Uu$ zZ_M-;)-k_f{7!Jzy-C5CU+n$vSk?ZjZ;l=NO2+%9FY}D}uMY0ryB`RMW_sWB#f<;y;K8r< z;CD>rUt@lQxe0aS*gi8paDGGnc^%@M7W6HboWH18ad7`WOq%PEFL1ylC)L)u4eyQA zoJKNz-PggdWcoT0ScF>B|J`eI4|$`W?1Evvv9Qqkwba>isJiw6gcwmrs=Yh3{bTeK*T2wsk@S)=;@`%m{3VC^J4{w<{lMgtg zKR5TzLtApmH!NGk=jMjqu_f0P%I6!(-}ppv@gmNMY595)FBkjyd_(yqW&XKfDdVlt zP-*S+`34caxmNobY3o_-eNwR6`+T?%Xzv5TV(&8>zr9Z%{dGOxFyl>o-{-g3`%G`K z_eqas#ic}s0HeIcg3tRaPXy_eE}>UC#LP-OlLPds1LSi*#EI(QrTGmw0l+i9AUxj- z!l)~sZSWaJt$^nkXYKd1=eL|azoqTj^IP~J^7Pm3{)7pCXrI1M%>!zGL~#hw`vjJ< z>v%+=(jPxmmkDpAKVFv!Z>F!yg!iSd!-V&xr;Ss~BMM*oY9>6yDlci2iQ|WAeMA8a z6@Lf_0got*)MotgL&s||;fZ9>$9W@G6P_`AeqoKbJfcv~KezyHNssA?GU3&rg?|}O zTmkaO`Rpd(lJubxM~H>&soTM|y`;7Kpc)zyA4w ziNN^U<_DxeqKr4Kd-M5-$*$x>)SMrf@zRy)O$yfh4J^c0pC43DUwwX1Bi@HlJN*JR zf$%;5sGi;;AnW`*}SNLvWMOkB^5vz7pqkaI(RLmpMo5cl|kpOy9{Mydcg zv$(4uViHJUz7nnN2+3X%@WSQ|Z1XASbJmXH}};-;DmLJdA` z_3))XmRSV*h#64`!#9Uj23CIUtZC3i&Ec}h+A0TMJyKH*B9=PyWns}HYaY-$TzG5` z(b@0;GwMy9x(HlJ4=H?f%{=`&gAi*DFeT0bLsIG?0viY9H$b72)>52nrDqfPZf;9o zX;cnum1bVjwdT>l>=#f6@+*b-pk0H&9GY8mz`g25s3^^;Bb$T4hPLR!jFLQ!pDtSy!^GtGh zTzD7U;dV~WNkhq;nc1GOQN44rv$HaX;#57nERM2fj_K{r%0)r5vn26kz7?J+CFMxT zN>6sW)g?KPzhz3LTk0Ixc-epRCO6-bfiS9WRY1_9aZ4f(hH?F#t2K`4+z;A)($-@3~&Y`@tK8A42N9z6<$23ursYQw1y6NveDL?qqXaH@wrhWrN`8W-L7g5K?7FYj9&=XCvM{>+=#>7;uK`NOu5 zS9ISm;wHxLjcNZUIcSLTcK{`o`|0KXH1c<-?1dx6ot2@w!X)+9ySvtoKNp>NS|&PA zcaAGtcHe(-7a!OmV>B8w3VrC%wCr>zJJK;%sP0YuJNj7$vfD?gK-mSG@8d^C4MkV# z!3*?B?6BM6*xJPG)azqqZ^~YOh>VgQZkEgGR^2*=40Nm>43=3A1g2!UGs5ym;|!7H z#LPtY<(}r>v8OWrJo;=lb)THo|fsvXy-|Cr@7>agz@=QSydC}01ner$*0M) z8c?Vs=@>&LEvvP_@jtMz7`o&L>r*R-Lyc)h-N*u==F&2AAPBc37N;9H(;4c_!!S-} z&Ah|nI7(k}3(r|loK>sf*c=?Tkb&bBa$K^OduQcY>W|~1thvO@Z2tg>i~@$o8(;>x zkT6gZEYk!xj(F%iCa`=%vN6zl`X^!_uHE`DnU~2Vi7wSh&<3L6lL7v+6DLs}r$E!v z9Z(+}KLH~oK*RgMu8~H-Egq-J9d<;Z?hSXQL)_9v39O8S#O$P0pFCNwuvws7Y5uXn z91&DVqgge7Y2I7B)k6bA@ID`3)0Tiv#!E2$fo_m5yp08?9q#G3hA~}r|9MQK)%=Cl z5*CQH#`YzCOYr*=Ht`OCrq$D)vMsRPW8?oCn_b(1u=%zSZ3}!YM6mV=-0Gaj= z&CYfui_36t2PEbV?LP!A{is2C@%~~!O!5@A(`2&&-XC&5Y^+Ton+!_}lXEYIRxcCP z*S;}A>8s;{eHiSuc|*LK*Y2$c3-TOqeQyJALs*iHyp6q0yiL8$yyu~m&Ak_RFZ4RR zt-J%~HZQoK;KG873N9|Vq~Owm76tz(xU8UMfuo>RLFQV?FywV+!;_kwE+A_}G!Oe@GQxV>O{!Hj~L1>S;L1+xo2 zEBL(Ni-Io;VhVc~#ummE#uxS}yrHmfVZXx13Lh_ASy*29MB%E!)rD&cpDbKk_*CJ# z!lw(LDSWnYec^_}jfI;ED+-@0++4V&aBJc7g)bDoSXf#3QsK*m=M>d1YEaa$=-i@4 zMU9IxiZY9`id;pLi`+$?qU@raqA5kWMR`S2i>4Lj7u{Yoy=X=e-a#&!RW!S3PSM<= zf}%p~8Y(WDS2Vxqj-mxc3ybb7T2xfFXw{rJf8PG^*&e5B|9lLs z`0!Gt57B)G!uss?Cv%66{R#W?87TDvpZ&Ku=1gr~t0ss3iTqzc{$|5q?k@mx3F6S4PK3xIWC+Z58rqUSsc6MvOpN;`#kU8;Y`E0?RF%kXK|*CVJ47xCdi~>6(C7Y zZZWTRPwl|5U-|n@$i#_B4i6{T$d$>>*(*>CQ-Lh`!j)B)2(mbQi3hsLSY)l3&t+cH z2r-r-Fpy^_x-q>sM|DSXR;JS!zhQxab)U_Wm^l^M)5Mdx#Kzs^oEo2;mK_`CxB|D4 zqZ0bX4RyjCf;`6H{-*em0}?%xoXJG$mpLUdJuTT0=T4jAjC73ZGA71Y9C2hNNpmmR zSg6Q#r@;i8V3t&s$dWJR&P56s3$dwAED6A$A&mvBzhFH^uH9HxF;FLoQxenC6UV1x z>4c)GE^LdTrRu}XJ8TF}z)H@6={N!M9G``cH~387NJktDV#z6G%Myh-2EgnxF~OG4 zIP|3oi|2ZfV}di=pVEWV#Zcy{kV^O%#|=)L)91;Scv4Q(BpO79Cb7n-6uxSKVT5%d zEFER@OB2p1X<0eYLKtJxh%~jtsw8SHDa!(xvb`VoL2daeYUx^N-6Q0y8H|$VK5tN)i@LzluaTU6xZp}4E@CFkvlO7 zA`LUFa;1MMP#{e5{(w$ymOI(#A=quOjH-lKsIp}538ZamNwUL}lY|!QNy$l1pBfh9 za6v3wJ2Pe~779iIAV-65G=_fJl&hg76w_38B+k4f^i`^lz=3oVvQr&c&&IU0S7Dlt|7Ct-F0zM)+ZpG#E=_1y9yla#ESOe|dvb+h;LNncTrE0IRuX;yVo zmJ4jDnOCjZwL@jML)kN^<8EgX`XC4906Ye>=8TF>I~|ASC9`9K%BQ1_)CwVDeA6se zno*f(DO`L7a!yK0T2dORyU-({awo8>L{B2;c_<7hP$QN8pf1do6~MI;4p2?$;1+ca zpPb*IR%GjCuK+ozbyBrH$w^K!RxK$vbnO9D!G_svK_Mcs+j zT+Sr9j;s_Md}L>3InuK-C&&_1uU#_EngpI@uAKuaT+jZC_>RFinvFIyNv)Ds9|!_l zJGxM{+G{j)*oiK^%Ooy8)KU4A&qg))MCgrC2c~Ev3e0u6_70@0!L0gohd0; z2?;Z%=r}c$F(&CuEHy)d1JUcI$lAf62ktl!W#&K)r}{AEvOVabYx(q2;HviQjA`e=&)5J#Uy+HitTVzXN;iv`HV<(Psou^U1)vE zs_(!-5Px0AOrMUntWs7poC4cRomzwpQ18f)id55FG9Iu@$w~(c#yA7THajE~!`IEL zazR7!6a@nS%mS1aod;NT+|*lI&c-98}|wU?Z~HeYqKrw;b}4qm;$w_8WtE_!VGt%O)mOW|9-dP`#&b zjITvgrTq-ep~#Z5u%eli?Lg8n_EZ=QnDo@jY+43NcLK%;Ss*;nQcI!6h?B`X@{^YSM*el7fDas(40y76)O!E#@0Ip=-XO z(P#SA7_#v|6Qe7nrCOCwzf_+l%La8dhFBDiR55OtAt)mi8VxrCOV(-7!7zVkqo!xj z%_(W_tV}j4m}EGm7FbHTYpJ(WSBhaF)JD-0c8hES)H_aNq)pA*_m9rXh*MSt%OSfx z=n~ru3OU|M8Q{=iEO?{$@i_C9i6G5aE>9vBf}oWc>ELr{Q0j_~pq__mni)&#IQ%gPkj(vz#ALO#{}2&$LT6 z^wxa(jkSB`s2fKj4=0?wF>NzU__1Q&i|t#E zyAT`3keGlL2-R@Q=gz9}S?O{EKpk-%WIkL_NcXqwYNS;s#yJi88L$Pr-IhfAdNEn<=~qyx z(P-y#c z&+mf?db%=XA{})pfjIzHn;K(`X0KG6iKB!D8N{fr)o*%nX~8#L#1l0SR=s>$gQty* z#t7+afJWc!Uoes#Wv!M1pU+t|4XZn7aN{}F%LNT(b^c8n7FgMJ2(-4!S9-yrOimsk zt21l-YRXZ)?VIa>=nQaFydyIwV?0{v5Vd$C2Se7ZTvo`>Z*R=+uADv{+RX*F03JB9 z$|R~b4dVtw9Q$PUl}4MaQ8`$Y!6R1I_}^MJcx>r5MmbJB%q0fc$gtS5(=dmSa}aa< zq{(L(K}f}A5}HCNE^R>dG}>I3=J#c->k4XD7>04skjv0hrF@W3p_#T79%ebQ=H!uk zzRWIIb=KxYkrv3HxZbgHh0R!XlU+{-6>RjHUB<|cDy;Sj;~e0RD@|o=t_MRA4ZD&{ zjWxPyXh)shbhW5THLtFx$jdS_t(NU+4hjEzT4C&7GzMOC zt;*0i7@OwYFf34g>ga1!tr|-0*Csv}aQ~kw5)A<6CpY-isY)w@tv_=&T%fxOJKU^4 z?l}$oaR+K`zbAtOf5A5E58LG|SAFcA^ZyoNA6?zQ66~=H{N05;cl<4_@w*p0@v8qG z#ooM{zm?dp7x;S;`}b=9sr`a~^#3&W{#E}yi`{^A|2AQ#AomLX@$W_KC#?S4jva>n z--p<3Sle$W_8`{&`xJWXxL(FqBYZ$Zwq!rn7btzN(_eazLRzxuv+?3 z?FnIM3roo2kb@zOv?f|h?XFr<)|T52OWsya7GTfBGTWQB#n{uVX^LhqZK9T?H5Sdq zBHMD?!?t&A2W<7U=HTEp@d$QaG{WxIhr|M;A$|*Rp+c5m56BiH)C?oOAFrQ*SzFpQ zw)K|OiP{7oRqnoCkNwxAt@dCa3b7l!F7#n-!449Y6Z0m2b(M_en2%DJa(dqO7WSPi z4hb=6Uaf^`-L;0}@_kJVq?)KhogsLzTgIH#&B8kz)n}FRwCY?42)3AG}jgOi&rHN(D&5ZZQ zU5tH3on{^N#?QKHmhcYqCL1&__VSk;@asfeKws}%aB;p&Ns1coLnJF7@;?L`LD|Vfe(ukHB+CuWGqJt(wQ8qJ?X-m zX3$K-o%&G@%$;>(()QO2Llg!}exbxM`SMd2-i`*{j=1Y+NZ@hMJmjN!zPAs;e~`bg z5$gA?@-FZa7;44v0H+UX$PAk3zpL1R81mHAde2^}z3ZZ#S7zNc?1QaUu9sw0;03#hHm^hAaTyZKq5- z1KgOY-QF3XdaaM@Hp!{*-s;_kpBK9}RW3Kzn)j(orpjUB{NQzaAMwT@=NNd0z(5f6=TPWlFc?;YOsmXjZgAD*}`h6%)%0A>NI%%+T7>-U`}g z>d~`)^HJ@O@ZMhjyJyY8nBV(Du*w`KTl8 zdl?#t(O!m|VV6ma%Yfb3pwj{O?CBc9HL(=!_V8OnPUT~JB3IOr4(K(=pQ2gcn`z{v z_-+cC7kMuO(0{(Sy-e9b;^%>j#)$Xxrl^=$O+lL>3BY5yYNk~o+*@nnHUw@nP~^B| zazM8Oc%aO>c*jbb4ZY)mVW#(|u3oZc1~w(0X_UiHTj_{jrk5cHRX4SjD^Q}u^z+yO zT&vQX94MYuSTo=@0qx6tDU@UyqJOaon*o74)^Q%YFOECd3AO;>?sdG`CgT*Y70(*( z&%>XWHQs-3=0QA_rx}OS3XHt0yx4qUetbXQ{(S2$o0-mZt>tEzKb-kmX`8%804KtT zt5*%*#8C&ioAl~(gG7RnUbzZS$wHMy@t|Zvns!-!GtTdtd^hpQhiUxrCe7;f`WW_TgzN-)s`9*NHJS; zYVF|vB;-w7Q%R4qxJ=8{(%|c__0}37_Cnx{&>Cy!Yoh?Ywf@=w?M5vgp(@QK+GScF zEn3S1W-Q93LN7D0i0{Yit6izJ(HsG3)3veMZAjZni?F0l1qXL(Q?(w5xn0K1m$5~f zSDU33Xk8?~m*KyycCmI5urAPA`|>_@$=uo$&7;lHI>=lv(4w@N+5)64HfUa>P1Cw* z)3rivq&7$!sNF27o8_9MB^&7|!;V^e?F#Alb59wTY6%8bQ*DSr_ZDrLcE6US-J>nh z#zCeHeEj0euUK1arY*5OB-9G0zSPg5Y3vByB7Kcof~lET7_snR}=FuTinQYAd0~^6mt7 z%bD8%kQAE+u#pM76}Ux4?I!hY-87D&8O)t-*ydsEF;b6yQ*Tzs zE)8>cOtm+5PO%BD`s;tnk3D6U(-y+~JBW?y{U2$^K7rKsc0tV+>wDiI#u3-Qzke$s z_Yz5o`NU^=TQOkYFSZh4cm64BiQDGP*Tt}nJ6Rrhm7gCY4-(SBw|;82KMr!2UUEleV%xo3-9^DDueo(qjW$I zFUR;W=&YlUJe*I8C@gTVJ6}bUlAJzWu>dpTjK>*u!qQ(m)TrZ*(4ousrP&!6Tqxn8 zDa&`~P_}Mk9Q}C`6kd$!fME?Uxn(*=UCZbQ4o3d|B_~t8DuS)G*;8FkbJUV5EjJw_ z7bwfAM@GELj*|@C(w6eQ+abkozSQhdT`L9ce=jF2td=(uF;ds{(xa(JdzC#Wz@B%==3 z%fjT&jPGZ>vyKS$Hm32Cpxgj1WySnXtzl9h6aDY<_!aoSp}x}Yr}mzf&KhsvKvA)Y zT$YrtpGZBVq-Cp7%HgkW!~R6aWuBW#2}x8xl6)P26PjvzCilSqHLB7FuM5j}$=EBq zofFkN!Q-c*y-i5tn=GER2{`MCe8Y8EA9=in8oT6svSOo&M#!cYC5%$Yo1Yi8m}Sv1quP5TA(!#zBAi8`cZlC z0NywWc-^hGlJivBS__V@KoO}{cFS0mg8rIm17EzL$sz3opY35CODwO)!+J2Zm4rO( z+@a9{mPj%VtC4F1I8~$H5DpNQ6BRIb;Jc~v{3AEIJT#6>C}~YZ^E6)L#F=FCNE8gW z#*1crAI3aXxmE>{XNlCNAN_o1fdpuXuS4|9DB$gs(~ym++EO^`Fd->c_F3kePU=ld z92dbMjEI(^$$nm*%7JpC=&mdr7LYjs=R?SbXPR=pvD4oL8aY?%Cj zv#HTJNqYcX@IWEo!0IbP06Ab8Beb*{m3hl|4^R1RmVGaKs0VG~$7WoI8S zV9>@PcmCoiCBx_zIK0*I!Ya`6^NqJMeS9DzOXIIP>4ay&r?$PtAGfHH>8ti~+THgy*3c&rB= z6Xnw{pNDmcUo1K62C zJ>b+Aif)d9hT17TMIYkBlP5Q);D7)`@%)68oJ=`)gqNo%`0!}#Agnu&T~U)u^;)a7 z^drq@65y(?8Jc_)WQ+(r8b3_Fn7Bwok~SU37xQqB>#nJ=iy|@2^?RHjfIh!|~QU+MybcoE#j;Pj?9%Fq^A26_BWTkW{|MBV*3(0s_8s|PRy?MTY z#f(1Z`S}UPSc-W9PfkMlxrj1oh$F!#X@3-(kX6jxAjAQ%19^ZP zS5J_-Gf-lTbB*Bb!ZW}B`_h|$Gpxb5DL%_9)k<#Ak3T6b!@QFXf;wJfx(Yq;OH`Rf zcyhoq2G~Jx_%`3pHq;mPCQM{3J);|ATULuJz9mx-lgseX1bIf9Z*hP+eTKEe^A);` znVv6?k&+G$l0pRp9Ei@G&4#9?>9rgKqmE2V4m=V+u&d_LS?Zf3z9HOq>;@hnu&|H{ zWoVc@=HY-?`r({G9a0jo281E4#yXDA+^e?CgP}STJpo0^E(V=Z1`c`TJSE$WBfgo1 z>QIf}^(UqgN<&~fBKM6=KO3SzI<(v9AS${~s zxDIB0JLU4O>~>fovTL-+219BZZ9tcIu6D#&mK6WU z>XHjd)$N`z^BJCXum^YkX*Zq$@sI*c*Np=bF$f#7fEvh^=ro>O2yNz>o>=Y-7|mp^ z2EME@PMQo{-_sW!=!4@T{(Gg$&yVBz`8;QnXOB?s7=Dc7l`QM9SSU%At2odvW|Y;5jP#rk*#}ySVm$M8E zW#1Uqx(7D8Y25gzL$Pt@D0CXCE``lc5d<6~%6hMnjHZU~OeMK!B#({qIJ$J|)G6$* z+G_JZnGZfOhZFAc$u>X;!2CXDJ=})^c(QzbKm$NSz`1}%fX09(0Pcuv2Hrn^FLtPhh(5W)CwE_k-N70xmI{B~Xg5e4k? zg6fOq0$4Pa2X&7?|e7MKcPF|a==@F#()s

    V)uTz!NLg=>eeCEQTNPK0~D zs3&?O^c>MjJP0=w-xAD%J3!*#JC4{@8ispK*u+h68zbaAKqL4sLg+c7iHMQ$!J?gv zXTGgPPZ<^@u7FG2bCHJpbwGI*0P2H_b3{i`gg6cU5c~!sz8>!Fh`k2)Hv&9>`l6Yb z0=EYsRQ?)>BzYe!+9Gu*B-9K3dcY(v7Xli9&ZThiZAWn}AVl)oRLYFN=J58im+1hgK9%XD@C%fyni{_y2RnFsS>+H=I!kZF(%KS%P`T(pP3 zKDg`#Ix7Iz!>>V#og{v9$T3(90}KYFB5V*`p0$4tC{vECl}_-pq}RY@$OyP;xVr%0 z1h78m!)1AH1~dauUiCqRx-<#*vjCdtD(jPSCLfL9-VN7|8e;vi9$LU<>8N9C02-)J zz6=Y6lv$puWOyT~Z`4D|h5AK4+Q_(INeADgl=7!+SkL5vvf3#9%&oDQhkMfI_pK=7 zs{vI2^272sK+5Y8_W|z7H~HHGU_OHYodGO6b)S4h0N75HT+R{2s7LBirqs1ik&pWZ zpfnn8Ht3ONAKa7Ie@M5rxDIYI0N;FqzA`Qpv@b;+Dj6|;Ab@%r1~?BuS>6t}FK zLjd^ZDEx{S-ct`KQ!ZX4z&Q`VbnGKY<3_** zz-lTXSoV`wBaFIw6@c~F7cPN)3uTuNn(S{V3zk0&zlojLH_Icj~ROwQt9pExg z^1^bcvK*Hc`a<5Xg4@Wzp**OoO#!Trh5**rc}PS3ryQx54C4q+ zJ)z9m_L)|-i*vzlHp?vQ8J9p%oxfjo}`uspK?4Uqd- zxXg1J;9>xEJ`q4&q-@zAUj!a|fga^ZePlhg1k?uw>eN30Y-2aTWgSsQOivwS+0I3d zHn@}v`Ah|kq$rWxF6he0W5DEfHGqJF^uJAnG)cJfEvrx2qC1&vCRdSeFN(w z1V9-z!jJWGAwcPs>QgCahLb+!OueS=un%I~dGJ$4Z2@#cfz7tY{vro(Gk|qN*?9oW zlXAZUE_r0zXE`|@vEI&sb~68Hd9P$bJk}juj&H0((zJ$C&&=?1AO)6@G^fL*EjIx! z`>*HVQWsbz_BP~W5`g}hfYAV^V|nbjW1WNp>Y)Wuj?@XtfV|ov75drNaSUMoGb}DX zuP)=SL>TpjIz^psh;Zt9DCkpu4UwMhv#E4B3O7Ot*jF|OGz2t89?gK?P~x5M!)4#C z(y>jme`*GxtQw${N@h0P*OT|>fPx)4GMr_g9&)5$AHu$jc~Umi!KQGV%X``Z45zhB zy(Yb2@DVJ_ay}?9U-HDXs*h)!!XZuKk{0u!T|pa*c+`K=GI1zB#uJ}1Wq!2x*dH^0 z%7|eX0_ZXwX;OyF&vY428qENtM?d4ubPCTV>$tfrZ4;EA^`i7q$%A${d){+pU2_u4 zcGyXlSCca2SVLK!1F6zwA4j(t(vWZ7Q$FV)hHbVv?%B54P8#4xouytdob8Kkk9tkH zT!ZxNUoJ)p;#?v5XS)iPeFj~A1Bp7x^pqphQ6}uunJ?St6-ZAylo#`3Uru0MQ5Wg5 zuj1UMJ={hBwq4TTJ?n|_?5CJdV*vG)X&KHuiOaGQ-)x7>gKFJh)aRfi4IoWBdb#n?Pqt3>2|R&~rK1i| zH&_o$!?_y!7M6u}8~bjC+i>3qv3}j)=tS#8!AdlVBb4o;)x=rYHC8tBA*bi2WD& zrOedKlclUDNq5iWzOqo#j%$K^t zF!uGP{!nMAYt&s6kGjNr>JZC9T$b64H`ADYre}G~cCTto`OSOUD&(OffV4&${sOqv zL(^@CdzOW5mt|)<(q}kb@~`><<)>t+U!=)DK%_iBWbNAkyb^29ozOPR6E%!m08HQcMORMA)*Jg3_Aj)H zX*bXYstU#z2No%Gy+x94#)i<0Pm;3 zC8uWpK#G(HdFD9EHbdYTOxZJx^};kAB`+ajHT*0G>wx;!4Z!sP+ObTdfhV>Bdr+`k z>tOx$fuC(~6@ap4I*xJo!X;mnJ>^B0I?@9!`vTHrUexjSaMJ430MlCK2Sa^8)d<|qK+~z z;!wWijWVSyh&vC!@-PkQ(njhGm%OzDkbm}Rlrwdb{aP^O#=2nrk`Gl5e?LM#9tDuM zE`V$RX%L^~V7+$*Fwee#%K=${g@6HoSilMZ%g1t24$A@5l`8g0C{Hl=K|Pn)&X1qwk!6r(SQd5Ie_MXOaNs<8qAORvJ4Xelxre@ z;fn#pXMW=WcLTNnh|7F40QUf<0GJnf8w#N8lL0LOw*r{H6z~CH1Rxhs4EP8@`Ah=L z2Ydp!4R8}+4&XQ-0nh_Ly=C721W;~afJ*@{0azDf0hAB(W*qCDJX{T6Jj>b$z%Z7R zZIxl?0+<)a$#(&10M=a;>YruH1PlVa3Mc{$0FWl@r37#>pc^0(K)uQU+z2Qz{EOfc zST8dHM*!3n_7}|i2Gnr`+);oF0V#lyfW`pQc^z=}3Y5U_+6nELc2xUDJD`1~eXi}) z{;6%(UejLEUeKP?)@#pb>$J7nYV8SarS_=ykhVhmhy4=!1@>n4bM2vaoBgErv-YF* zo%XF(rR~wa&_2;V)ZWov*A8lXwJ)_#wRg2Qw3oFPwawZFEz*9iJ>0%U+o(OOJ*_>Z zt->%t({a5X{_JejrJEZN`{;hqceWdNs z-qc>vDz&ZJCatGE!rsl^*?x_^gZ)Z-TYGE!$J&!x6MF-@ou9rw;|tHCyM}cR>&%4a z_p^I;?i3z=nv~uN`MY(JeR8Kx0&OEyl;ePr6mafv82(T^?Zr`GO`0e_PvqHnA)dTS ze1|A+i&Fo?#D^bvulF|b9U>J^7c=oG@%EsJBv=Jfbl?bYef}GlMF@C?DZE}UBD`?r zzu3KdH+XW0va&KUZrnKGt%QFZ?!9Hm9H@?QqO7t~M3?Or;{XiYy*pa$E*ppYaqt16 zy}8i@dziqOuG$D#sxVbN~*=I1wEUKah7< zBEfDi!T{p{qD+7R5k0O9JeGm?GVqIhz-t+xa`$d=;=~D&mzO7si;G27Rh8JbZJXG+ zbEhaTFBcUR6{57XRGdKhU9LQ_ZubeXQUTgkqO$6QaOJr`-zB`DUs75OI_1c#T$B{AgCF$EcZiD09inpQZsfaLtlL3a zM@7Z%qhcGN9CRx{rxN+@1mw9u%UdjpON!x^3Rh|w=%9Rk%S9e|a;26FZ(g}5EhB%p zM?S^Kr)*t?C`Q>!$}3T>N>N&}O_Z+NAr~rT40Hu{xVh75%6Y|;(r~tp)s=)IO@Cq4i1HaqA>u!L{l?s0HAP29=^LjhNT7vr$$e~1}jwltWu2RUX6g-nu@Xl z@&Myp&>5HL8;v?j&4YfiuJWK;fZ{xH_Byo$g8rH-A|e7A5l-uhIB2)`jQF-^&u?YA zpooZX56VkqC3J+w1zs%i%eQxxLrOV#v`$^xv)93apj)=JK`W^|3Ut3aA z^5Zi}i$(?iTKdb-7ABj$ES>(%t*Li^fA@PWa=UjgD7fRsef#z;7&yAHeC?NG3-|1qJF{=kn}UKepGnK? zJMyJlGE!GgeCoLs9e;3*Xp#HrtfmEb?AteP+>Kuq6mEWgE$NRHp%_{hM%)Zz`3vRsej@zz%v2^jWd+r&0vPX~L```HD zU-2Kse;og@+x_h1C)cD89r{B2u1^aJ_T4xxcF>^28)N6~pZUwY1k1u`g-KaOO4_!Yz zW7W_;efm5#^r@%%tbJ_a#25ZGdd}!Ew=GB!6TQ?_n=BK+Qd zpMO4k_Gce@*0?6ezZ0MR#D*2m-5NLcwn1@8ad*beADFcLSn#s-)4qu675zxBk==a~B?Ao$n)rGRRZjAfzAqN5*pcx6{K;E4V~x}K7f z^6;jNhaS4G%a)B3S9g8kz0U^@99uZo8?!C5Y-|3Mho0OP^+B(#Ylo>$;=AvTCj{TK z5)yuF#fpiWpC7*CvpI8ao!jqQ^a$G@>hso!&3#;J?n_V~DITf-Ok3U z{hI=IJ+D7@&r0mn5;$Esns}V2IsnlC&WCwyFXyAiyfSqhY<846FRuh;F9p3)HE(j2i4mM5C18F;Fy}~c%gV|zPbtUzMa`4O zA@96#>o5<(oYa^jao$sgIZs)snlrA$oThRc=Qi6gPuzw%5auqJ!*K4x`6K5qoV%1^ z?jq+eC}&9psjhM0CsocLIZxrd zw^I|$O)x*<93_wQ6TpZBubNw8epw7T6c>9%#6`tOTa5WkG2{ZkeA$b7;GDS_b8ybX z$MwbBa~xy_xh1qO6$yPIH_k=Jl>#4f1b8_gC6tw74hSemd;;d5BQPJuytKF&P~xAL zmX~9`3Ym|9yj=v$O}&tJYAWsla(?Q<{4~#)rxs%!phV4AOE70G1(X3w%0VLn^}%|{ zTL&I7j|G&_^&$-OSvjvSL0BomP-k*(3wIswImeBzK$$9pi;w^qQ6cBM#V*|E;oe&T z`C;A)C;{XZ;~v1dZyxkit{FfFipwz91#te$c`w%yDk_1KS_!@?!B-{b$#9`3Twf^0 z9GLUqQp|%n7cR#>wQp}6X2$&mJ0Lr0P6@YT+7U#)30A-~+kOlx< zD*+)IW!vf-+KKw#_v|Pt1iF%@>Z>af?Bo0jlA>IMOfQ5xUS+& z`!+c7xlMapE8_xMtK_y11UVd2n zwr!KIy1Z4}uxY(}<%DJSc<}le*X;f|F>&IgN$Hu-EV$)1*pq3kf`)_@cX=UZ?$-3p zQ|BBwp6Hy|F)Qop4x?XBN%=(|i}+6~N2TuB{8pz<@pIzFjXU0OVpdkii4#-)71lZ` zxLup%R!2waCr@@B`tkdl%0C?EbWZBnwOhxI9l9)xjxL(rI=EfiTZe!6(caF3x0F9} z|KX%blR9Q~>(;ev`07Q=9=_|Q_5<3rdA_`FpFTI=+;`v&tA3p@>1tOukGork@FUNC z@y7ba*W6^YC4RH9-=jC&_;|&Y?|hxwp@YlQy}LVn#7no08FT2pPO)o~e@jXl|J8^8 zzV-XbanUc-5tNDUEf+8*}k;h*k7I>a__y*4&IuS`1A0$2fa7?C&XvQ#HHLB z+&Xyr+y^g*@aNCFBPQXg7yr3qP`_a(CWeQnWvp8{df3v32K4XyWl)cZpzQ3ZnVmY7 zlni|HgW-u2QqwLEN?Y^xkDqV7a?`6{vW`cN+*Nwb4GI00FIn+Q3q7M1E41^*&p+D` z9}Dv8${72}cga5_kG-lD{gDyZUcPTnmwh%B8PwBotH}UIlxJTH@lPAT=-*trj4xE$Xclh;_829zx#G!A#5eL5BCtiHvJ@MH6uZWH7 z-w-cudsBS$<(G0D`=tK6*!K2kqU@nJMcMM##ex0bB9C9i?S?+}zv|3D=xK^mpv!$ zo4;Lnv!538ik}qEzx0Y&zUoEsAjXCV*1jed-n~JjjCx#5%YR0!cUoDK zDBCVdp4}%_zW1Y8^Tn^?gRC<6ziT^E9T585Hq~9 z#imzY70myYRT&Vsd7d$eS`nJp9Om;u*v}{@5d; z^2Ha#4?p}MKKke*@!4meiSNJvUVQuQw_?|4yQJ-S;J^Xsh%SDEzT`zVlTZoWij5pC z2F2bY;s*{Dj+lYMF(h6L?Ke;i866`A&>cEh3>`FBgiTDu6L2ApUfWCpb+$jC7l2n7 z;EZUEhTc~;5+8ojNc?sNX(NE!6ToJ{w!=KLl5zx2&JcK=7yLT~UT_s2@Sj09+by!Q z+<5Z;pYa;qq?sTjoI#$HSrqW`m`z@G{4;DWm^bCt5n-oO21TLn|4?kx2nv#ap^Jk< zLxY0m&A($o(84KVaaXgqsHs8G6gG;Uh-g+B539>w87V^p1^-?{h=nem7p- zp<~!JojP|3@7k^VwGllc|8ZGMN2}ItE^m89yY^RJ6%^FCNz-QMo!|U|pbIa$_>xP5 zTbN@-!*hcgk)PmTTZm?_7a9~Aa!&mQL9EVGUTO|~N|ah7&2-e2PJnTMAmPBj5Z<=Z zIs1230%s*~Rs#PM5-{yU*mLGBCO9W+1rx!HH~rOJGyacUrXx=E%M3H!>hab6CLUe$ zzBU{){{Px#-XM8xXiVFSBH{aCX+_p`B@x>SQS6_Qg|Mb&Obv&)sVS~#wOvihM zG3`J9`A_|gH{Q@ID=YP_TenKsvSo{OUw!pe{k`{g=(~39lK5s>NW;nx?@gXqPLu!I zT*{1c`R1E%q>OiihnJA|qmMnNFD)(AvA(M>S+YdG>#n=>)ho;O?QgxMfBEl!>j%F% zB+h> zk31q}L|N?Lzh9QctRM1$hr{~6kq6eg^*wv`NWRD;>(*KxmXW$aytlyDTW`OufBNyq z`YzCY8M1otp)%xKsACV5o}Ztu-;c7eZ13*ap}&SY*|ceszH;SC@N}=__4eCu*K>1o z^_-j>Jv%!`ce~vZJnkHQ@?^K}$@U;VN54J)c3H;Nt5?f%Z{ECFf9a){bk@&v&poF< z`Q(%Os#UA>C!TmhU%Pg#{_@K&>z{n`iPS}tXX-NMJNn+ed-Wafy{E4Mtp`^;ps(Mw zQGXu#vlTSUQ3u74U$)01p?Lm0eZ`6u`XdiNtlzWbZpgJrpD|;GJ~eMDc%CA8%?6Ji z5BT=Dbl2o8xRWLCuE{PL=ES*D@g{Yr9rGM6}**cyz=yT@I(HA0& zGJ4~UZIWNM9o9MalIa^ZY|x)wzg{l~?+Z&70l!#(_;Kh6boAjzAJq#BigcIDqd$cE zyB06jbEf6%v*ym#XHJKlbFy_8=zT zC!gtCUV2OaXm6GN>bpDid+vQ$pEG*_cyj4ea$L}nEb!vibEbH8@67x3*|Q(g3yW9j z^X5OT-+k8>@UT(8cj@0+x7cbzo$R&)va-#-32Nr)Rp| zGt-$FMAO~mBoH7q5|RKRA%t?y;V8$WqobU2mQYTh0Fn>_gb)HGAt8SEzYl#t)1Izz zyX-2vrZ>H`_St*w6~49Bx7Pap-@k(bA}F?6>FOD#se6#t-VwToZcx)UO!x3DrsnT6 zx9~u+-{85%&+zcD##E+lPC9B_I=NjSBewz!BC%jIfq+n!$>(jG1|00J&Kd8b|GDp|M0|stBq@m{y&4Y8aj^3teP<=IWgZX=R z+1lQEz2-$GWfPxPKtMziv8G%)`X?x=yG~SMDFIjV@wt$rIhV%1PqO*sEfZh5G;;WO zHE;b*5`Xpwm-yrVwI7d*MTF+}zcK(lZ3nyOqMF-V@P@b2sOiV{yLtY{H-?u$qfV+_TyJ@ld#eoTrIi9;h+gl`%Y2RzlM2agQW2die}fT znp!7wbe*!B>!g?6BdTVJ-i1YKOS`3CiaF=@rF56Z@tLF24JUAx9&>kb!B6@#Olx7X z^mV1y@*6iMSbnsOxmoQktEHlQfa-x!tX=)&w+>@%945WIm7v&4LW3%Zj4mZ1qgH)V zitnXT+`i1=#AoRoJe*2kRy%=~0j`u!6I^o}|LR*rv@T%LxGBE5O4{&aie{eExVTR3 zt#yjVpHn>gjEccEil;RXX6A?sF6H3IQ8+tkEC$BleBPfk7yR+mnt9Q~O}fcVI_?~o zq+=qr-V_&?F)%PhN~QEdNjKS*1DMLYF*o#Ks_LY$trKBrBq>B{PWZ=J@eViRc{LBm zWBFQl@;T+0!`1L|l1e*>*IW&0oF=CE4oNMGq+MSoe`1Y{@uw6_uhV$<1$FnHQ!&4; zHf>;4Ka|~Era`)-ws(y8f8fr6pPO(z9E{t!G>(0ya43}XmjW=EG`16B2nh@3+7%zJ zNhgMegkvr!B(JTHz@&0~Bg^p&wcr_0%th(xu*_P5;>$JmN{Ps}a>1_%C&~Qesca7X zvWU08m&#AS7pZllhP>KQ@;fzFhVEnTzen-l1FUjNEtpy(e|Cf7*)$TU6dzrD^67&A0ARSJO_6cOl*NJ zN0ORR$mHZL#>Pi%A=1>uWnVMrj%0G`;~e(Ct-5_bi%>Xm|LR%)-o{(X#|FbkY8L$W9twt?c>s)Rn$o??JWaX^4l>*_7ULRjMJ`a zwIv4+uXHZ?gfcUC7gNUsS-m&N?wVAXA)$4Ui1Gn^vKu(N%)B*!4*jKls}mjvXweY2-FT4>vR(9#M09g_e7346JN1vbv@EZ_>T|jGq)phdB?Y#HyK`vkPBqTT#bFoGH#XbfGM`>&Cp`=W6FDin#m_*9TYpAN} zCE#i`j>pq+@rWWRBcJ%fN)k)zNUCfjx%xWUog9Tn3@rMQ=17ZY9_n2 zPkVtLLQM@E_^eoahboSIT#2ts2{rYTq?ZokpWRJC_af~JPq_Z*8H1~v^sYQ*?CF~1 zeV<)lcyJ}UgxTfCg!vV+Z?8M&U7b1ad>$X|XT!t7krOTv;UTzR^v3C&_RYc9bOvc) zd3A}0I(sfGtkBstq%kx{XnZ6=aZ!?SEY}hf3C&EwD>Rc6`%_3O@1SUS9J9uDaN%`A zB`@EEYMd{t-cD8Q{3geq z`9!mOm-gY#g*5lv!kXF1nZweD{yICjx#8yOhKGlz_P!pto&Qq0?g~eaN05B+8OYRB<_Bx!w4h>hMi# zqGw%`@nToe} zCi_0iA(5@F^|!W+ zGrzG1+Lpd|=R$x7mxI0V3Gw1;s2?t;5;*s11s={BoN|rltXCF?Psg&$Azi=gIp9#j zu7AnL^^r%aLudD){~0!?&O379@+Ix*1336WE}pw<`S3@{{L}YidGCiQ{P-_Z_}TX|`1~jN zTsqZ2)HSVfktKxXcahvQBE3IH)z}=hBXjhO&vJA24lA-_7?)A@(`Qe~v(|9hHI2{r zX5r`4NnF^%_M<>T^E3Fkj6<(D%p5|~ zOUUYMCa0~Ntkzzv?Sr)Fd~<(knHQU~#TfPv)!nGSaY=IAy7Pee^lE9abH@2cX&2Q@f;)WkEk6F!oyG`h&Kx?}#$cT4d&o!nNAKs(2r;DU? zGyC=ha%gvg#<*2yfmF_(isQc0;hkw1+ltNA)%VzHB$tlu#AYW&-8Rj3{qx1R@ zle6;--5h5~``G@WVJ61MW%GJv$1*Z7@_kjFY<$K)$;t@E7%=Px_G^7>UFWJnVpDW3 zwl+}S+(ThmD;1R;lKUN7zin+jfAy`#j*-XC%bu@2-rmvI>TIKMoijDpzxr%*dtHxT zjfI{0823gV#yGL(WyJdNYsu_wG1~V+{jsU^Pj!~P|KyQmHN)b)2Wq>aCtukk4L!5{ za#PtD@-VV{W2dy2Dc=WMJzprc^|fN7zYRGVXMCIeZu2?ovUzQ(Et`6_DSMX@jDEAH zv-PF&H)4C-VkHtJ#vlB?=u^u3|8UaB)}zinw=rMJminc3@Tk8KUv@yGt$h>g0vP%uPl z8&{I`mQi0r$LK#JHiDAc^0n7>M|R(M`)^zMjY(g>FzWOlyZ-HW#yER(y}JLV>}};L z$xhiAjo$hD-*a!2XHRFpe^ZB7clP)Hk@%bP{CXMxlYalV0O7u?#CH<-P6EG^5_qL6 z?S7%ZJ^q~((zj^zx0R>ir}ZZaKU8?_r)4-Bes_H*fgKVs_Df&CzG)A&Gu=0(+4+2D z`knXoGIz#1zq3Ez`HgXJJhz__zA26Uo3H1$^E>-Hd!F{+Mr`2s2Ci>l;mh*#Fnlx? z?#ib66}E4rF)rimWB4{0?+w2XyYI)!%F1gW0DHdnvTYxJ^~e6s9vf#R!^dLf(F#5C z5iook#ACDJ^Z9xCj0lf>q_eM)#_&hz>FKdy+Zh>|HoQGCF;RGDf(-{ZuzvY2+k8yy z{uf4Uw85yKk%v*9Q7_|MX#~SZ!N6?Wg<}mXuBolD`BOMKIdM%s67}`fBB`0u$ME!bcHJ^orvX}adwh@%hl$uU@fxR{1<9#YHj`osq(4FP`hetYnh#$ zwaL)%o#^lHxA~J~W@ix`97bJZlg&59>!NVutA1RR4}gC_pfF1>;n?zXPn`i+Eoy;V=I19RK*2vPC9z;g{7*Qr!)Lgz2U>-oqk1 zEN<{IsY6ew9D7W)Y>aur=uf>C7F>#|K4S88Deaak6M z>f5Osn#Ppdg5PD?*PO~Y^O2b|yG!`xzvS_M|F<{CPMQcS86(It&ZWFbP6gZ|w{sQK z*gCnBYZTnrz})i~Q{$5C$Wx?6m#S@{>eur&e-qD(7l@0FBQrmbLCvRi*%C4;+bL-1 zrsDc2g&ji_Hun>oT}4D>88Jx}!sUcxoilUlNCv*K)dUL<45+?MaP1r!y^koEc#36a z193%VrxgAtY_ocH6-#wD#~i|Obq(N4w@{otH2!?NG&kJw)R>HqOQ5wy*g$DJp((P{ zCRE{{TtifTEzvo$OJ`Ye_08v`@W@Zz&0^2TCX&rv!VzSP?!9aC888cb&z%wOCETvz z?sKejD*x6~VPY$IpU>jmKa1qR2Py1-CyN8WiqtsHrlPu>!h$@NA7`73{^3^69?Rgk zLlzG2WwQ4J;r08?91)Ik_={Zjyq(X1pUH-LGKbuze#*vXDH&O`VR4nhJZqP>=v;as z{A7zJ;ab(gSo#(pQDyBU$gP-buEJ|RsAl*7GjrgJIL%w(BPI*e8Uu58Zj;eGMRZ=5 z?D`fQ9fawBn9K2B2uJxeTliEiJ}!lX22|s9v4W7~4jLxrXq*uSH6vex`_E`!eZlbK zZTi-Qqsf<~{mx^o)s1B3nrUe1qpZ45HoHLzQo9K9s^|2l#T?u#Y$`01{*f`#giU32 zjgu*#k(9Pk{PUXeiK`(%eUeh%MrK_n=Ps4=?vG3O{9}uJRAz-^EKq*qA=j5T7`EpfCAIHk38YRE7_KseP3I_-XGLuzMM0ip> z!O1D=Z`q86L0<5(k|!UP z(i7Z0V>x!pL`&NYo@c}Gy5xzQd}zdb5q9Fnfy3U!$ggMV;i7Hc8OAAN4fBhVZVbO7 zJpU>eE=A+wV8t&w9sdj~Zo%ca_*L`iuVlOZ!c1a(GvVpiv9!Cdn0f!5c;5TI35U1MoE7E~;v?)kqnVWEQL2Oo)C-p!yS2art-prN zZsOLId;&CnP8E|HHHe2(4PL^`1LQw&*`t^b|4}+xek{iILUum;nq1#fOG9fN6}5Vw z9>eJq(Hwp+9oH`kI4dl{^_U4)_gK7xlZmxhNUy1wN@LKVZ$`qZscXye76ldqyEj`yH9#SJ;^z>h|f-bL4z>8 zS>ub>?Y8eb?CbwdEW*fJwKO7KFJDDp`}@j%`KBF){n*y7uiCe%dOXyAWnF$n_B`x; z{;KRZwqTA5YKMV=88&63UE=52uo8P6?REc6u^|(i{dwzEeQe(v`Pgj5 zzixZ9H%U+JxBt2Ezav|t4My?5sV%?lnNeBW_g}@oE&ZGKZ@$}c6!`A;cTfUfAMpRx zBKUfFzs}qJ6I<~={QdvxT73Kbjk#m28DGDC(=#Kjp>OPKjPcuk8RslSkq(T>~vmvJFI{S#viukOE&x-i0 zh|g*}?}b z6>*6Xml$!05tkToi4m6=afuO^SZCU3#3e>tX8E<3ATBfFG9xZC;xZ#HGvYEME;HgX zBQ7)IG9xZC;xZ#HGvYEME;Zs(Yp+$0xYY7#(Y|V5IpR_yE;Zs(BQ7=KQX?+4k7Y$1Zp7h69B#znMjURPCFS>aC>e3M?cI*JwLcH##le!EMsqQWV_Bc w#-b5ydoQhx_BGYMf3THrj9b0a5~}w``ZweD+s~N)+%N3>({G#WxBu?{1G~ub82|tP From c8f348680f515d921f539b2ad5a6a33f633cf08c Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 1 Jul 2006 07:16:38 +0000 Subject: [PATCH 003/301] Initial 1.00 git-svn-id: svn://svn.code.sf.net/p/axtls/code/release-1.0.0@7 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/config.h | 52 ++++++++++++++++++-------------- config/scripts/config/a.exe | Bin 8185 -> 0 bytes config/scripts/config/conf.exe | Bin 91179 -> 0 bytes config/scripts/config/mconf.exe | Bin 138973 -> 0 bytes 4 files changed, 30 insertions(+), 22 deletions(-) delete mode 100755 config/scripts/config/a.exe delete mode 100755 config/scripts/config/conf.exe delete mode 100755 config/scripts/config/mconf.exe diff --git a/config/config.h b/config/config.h index 785747831b..56d8e8a8df 100644 --- a/config/config.h +++ b/config/config.h @@ -4,19 +4,23 @@ #define HAVE_DOT_CONFIG 1 #undef CONFIG_PLATFORM_LINUX -#define CONFIG_PLATFORM_CYGWIN 1 +#undef CONFIG_PLATFORM_CYGWIN #undef CONFIG_PLATFORM_SOLARIS -#undef CONFIG_PLATFORM_WIN32 +#define CONFIG_PLATFORM_WIN32 1 /* * General Configuration */ #undef CONFIG_DEBUG + +/* + * Microsoft Compiler Options + */ #undef CONFIG_VISUAL_STUDIO_6_0 -#undef CONFIG_VISUAL_STUDIO_7_0 +#define CONFIG_VISUAL_STUDIO_7_0 1 #undef CONFIG_VISUAL_STUDIO_8_0 #define CONFIG_VISUAL_STUDIO_6_0_BASE "" -#define CONFIG_VISUAL_STUDIO_7_0_BASE "" +#define CONFIG_VISUAL_STUDIO_7_0_BASE "c:\\Program Files\\Microsoft Visual Studio .NET 2003" #define CONFIG_VISUAL_STUDIO_8_0_BASE "" #define CONFIG_EXTRA_CFLAGS_OPTIONS "" #define CONFIG_EXTRA_LDFLAGS_OPTIONS "" @@ -27,22 +31,22 @@ #undef CONFIG_SSL_SERVER_ONLY #undef CONFIG_SSL_CERT_VERIFICATION #undef CONFIG_SSL_ENABLE_CLIENT -#undef CONFIG_SSL_FULL_MODE -#define CONFIG_SSL_SKELETON_MODE 1 +#define CONFIG_SSL_FULL_MODE 1 +#undef CONFIG_SSL_SKELETON_MODE #undef CONFIG_SSL_PROT_LOW -#undef CONFIG_SSL_PROT_MEDIUM +#define CONFIG_SSL_PROT_MEDIUM 1 #undef CONFIG_SSL_PROT_HIGH -#undef CONFIG_SSL_USE_DEFAULT_KEY +#define CONFIG_SSL_USE_DEFAULT_KEY 1 #define CONFIG_SSL_ENABLE_V23_HANDSHAKE 1 -#undef CONFIG_SSL_HAS_PEM -#undef CONFIG_SSL_USE_PKCS12 -#define CONFIG_SSL_EXPIRY_TIME -#define CONFIG_X509_MAX_CA_CERTS +#define CONFIG_SSL_HAS_PEM 1 +#define CONFIG_SSL_USE_PKCS12 1 +#define CONFIG_SSL_EXPIRY_TIME 24 +#define CONFIG_X509_MAX_CA_CERTS 4 #define CONFIG_SSL_MAX_CERTS 2 -#define CONFIG_USE_DEV_URANDOM 1 -#undef CONFIG_WIN32_USE_CRYPTO_LIB +#undef CONFIG_USE_DEV_URANDOM +#define CONFIG_WIN32_USE_CRYPTO_LIB 1 #undef CONFIG_PERFORMANCE_TESTING -#undef CONFIG_SSL_TEST +#define CONFIG_SSL_TEST 1 #define CONFIG_AWHTTPD 1 /* @@ -58,9 +62,9 @@ #define CONFIG_HTTP_TIMEOUT #define CONFIG_HTTP_INITIAL_SLOTS 10 #define CONFIG_HTTP_MAX_USERS 100 -#define CONFIG_HTTP_HAS_CGI 1 -#define CONFIG_HTTP_CGI_EXTENSION ".php" -#define CONFIG_HTTP_DIRECTORIES 1 +#undef CONFIG_HTTP_HAS_CGI +#define CONFIG_HTTP_CGI_EXTENSION "" +#undef CONFIG_HTTP_DIRECTORIES #undef CONFIG_HTTP_PERM_CHECK #undef CONFIG_HTTP_HAS_IPV6 #define CONFIG_HTTP_VERBOSE 1 @@ -96,13 +100,17 @@ #define CONFIG_VBNET_SAMPLES 1 #define CONFIG_JAVA_SAMPLES 1 #undef CONFIG_PERL_SAMPLES + +/* + * BigInt Options + */ #undef CONFIG_BIGINT_CLASSICAL #undef CONFIG_BIGINT_MONTGOMERY -#undef CONFIG_BIGINT_BARRETT -#undef CONFIG_BIGINT_CRT +#define CONFIG_BIGINT_BARRETT 1 +#define CONFIG_BIGINT_CRT 1 #undef CONFIG_BIGINT_KARATSUBA #define MUL_KARATSUBA_THRESH #define SQU_KARATSUBA_THRESH -#undef CONFIG_BIGINT_SLIDING_WINDOW -#undef CONFIG_BIGINT_SQUARE +#define CONFIG_BIGINT_SLIDING_WINDOW 1 +#define CONFIG_BIGINT_SQUARE 1 #undef CONFIG_BIGINT_CHECK_ON diff --git a/config/scripts/config/a.exe b/config/scripts/config/a.exe deleted file mode 100755 index 57824a9867c61fb2c25b1f3b4d46d09077104d98..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 8185 zcmeHMZEPGz8J@GR;Cwha(Vzq=5?9IQL$sFdT%1%2V#)d1v~`lJ?F3X3#%tf&K73!? ztrG`=bmdZ%)g_We0f9(WDk_0ce?+1Jr~JTaew>g}BnW>(|Co;oM=_FBRH*_h$Meq2 z-t6w#PEsWS2}YisnP=Ybd1r5SeDJwh*2)+Qqt@$;&7q}Yi0Ar`GN!kD{EaQ_^$l-5 zG8YyhEfbSYXW<|m3~HaceJa(O#CYDJ6FxoA2U?LRye&E`{9S9|-$4kbF7U~C}N z%AT(LxSwrgY#I0h`*7=~P|IFnR0{yA5mnI$>u3y|><*z)D~f?926Gk@elZr6yd;2l zP*fua-Ha7TzymH_wl!lz=PU)E3?c^_PN0txWo)Etv{a(LL60asnoF6n`L1-zv`ys; zd=fEh^V1rj^CSNs{jW#hi1SWmsjc$Yfe7;N#Yh~00l%=$}1o_LW|=C|VS@?!Y%LfA>HR1+(Uo4~dBy$0*E z&Yvom+dfNMpcr}n2DOz9>@jL@-uU!o^qmFgYPGFugzF1Xb);vWEZ*TvuT-booa661 z{T*Q^*0DGQk?;f_w8KCQSpB1Cx()XH(meX-k9BOX{AIaDyNx-=Buf;1usAzAZeDY} zsCU|6nw=#&D)8s%P-Q7nJ-!+GUU+-!nLhxn#lt^E(=&gGJgLRo{tm&l_~wT(aw=td zR?mo;N6QZznCU(%nr+(<I@rQVsIq}n#rEo1CqcyF?_sV9UYzzb7;_J{n2U2$4 zdjCsbKK^DK3844I;?pGH&7S$nKkN3NYx{+x&b2w==zi(we&J}(@0}OR;HbX%DxOZ| zHV#K_Y^tMl(xUj{TRqrzv^pIbLWpl}u09*ChL91VcS9|YUoS4hwkzj<0r~9wujzT@ z4SE+k@63@im8H$ja7P=Z0J%?oy#^KDq^x(I_UWs4&IZP31LJePG1mXMH^=XGT<@qdDcwlNR|=e>1<)TXz_ww#Q5heV`e6kAEUXOEn}x9PNs7_owKcC&ddO- zx1=%|K3255Ie#MA(^IgD90!y!3qPx7>v++^IpN80wjpCBT(sQ5;n0(oeK4Pz&R7S` zTq<;8)%SPSzlBPkeu$;=IRe;A4aALDSs|^V z$I$badu0zv{Uqu|)V0>swMWuWe7*?k559uy#mChZL2yJSFnL<-*wc+6>1=h8-E=1Q zAu%I}^wH0aq(O(pP@_Wf>e=gRmo(rEB|*J|SR3VoMLux6hBQ}K0jc8m)M)aQelGo< zCWA=df=1N$Lb*wDtVuE*EBuoCgGe8(yN=;A7)i;i#}L!(80tl#9W)J38}@{bVxA=G zayL+$9yd2e zggwyJ$oYMZ98_&81Et-v*65fsC6|;`beZDw8=gOOTc`Zck3=|)0A=D0P zfB6si)k_xm_Rj7?5Q*(;LPmnf?(YPVJ#;dXk}<`8MGq88Q`%9C{ZTySNFqxL(KP=8 za#m${3*+(=ONf;xb7I&Ca`yxx<1$dd-xV}o$v5R12R|)6h+uJNdj@JGVrKAtp4n%9`>Iz^1 z`ecrAK2HB=AlHQl(vVMp%gu0!Jgy{DBas1gZHzSXoa)Lrb9Fr+PmFHFvYPnQhQ;q(VxqsrK|`(73-B*gNW4A_7$Jol6+${RM$c-fBiX>%IUQDq8ZpKnT>? zLgt+YLa6k83y`u8=_D6Ww47cbXMkv~At3GvR?6W(h(qf-351G9&H{0NktEkkO*EI9 zkl!gp+w%_~BN%FXHmC!sr1=;|{0r&aLEIn32Zx7jvuIBjD75~ux;dhYBHT84Mtm%v z&E|8)UdB^-UMN}9Xo?nHIdNXF(!2Kdar}SFPG>C%n|8j)TnUAuMVfX6f!-j1J1(VE zv5*;j@W`Rzrw%4~awu`6|1cj+3>=R0fv1LskvW+5nmG!mI30?3iF}j<{lkX`HGM7% z9?$I=Ms}v8>DRs~ z6IQX5&gYcrFmWcMb;B7#(mrHzs$@?IN9CN{GCX)IXT(5*|C4!n*N$A`P`@z2HGI-C z3toq$AqB56VOl}$SiHv4IXIRt`8-Nz%?XQ-nkDIc$r`iCSu>NK$YrgZ3>JbPSOT?# zjT_6`t+`lX6$c*oEiXmDosmwAHH|&F;bWF&^oSptv^dIgj=-c;iirsXS=uje+whLX z#oTHRs@E31?PYn=nqMk~Y{YLC!Tx WzI|%@wBR&#J>SY-4;{; diff --git a/config/scripts/config/conf.exe b/config/scripts/config/conf.exe deleted file mode 100755 index 43dc07c0a6c1134803ceca594cca2bc38187cbc1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 91179 zcmeFa3wTu3)i-`78OT5ePJp0MgN!<8K)^%+2?iY!2vku~F5(rbpkfhtVFpkU6J|y@ z9!H}Ud($dKt!>q6t8{<@fj|OYTErVlwJ2)OVNek?2BggY_gnkSWHO|F{oeZjzUOf-~CmC;;y~dbk$z$^x7$L z*VxxinQ-%rdA>PwXWuk;>aD&Trp}r*JLvo2bl=?2EZ>Y-zLA%X_uV>s+Vp{4x^(tC zsK<@cw6U%Z+T(F! zHx4NzUVYOg?b0-#f@KBP!9VAs5&@T1+ELy9pZp#eoW77vtN9te$Pn9_ZUpY}&!=hE z51ckNI2HFbXqNUo{?KOam-x&07tpl&fpZn$<18^O3m;IFjz#c4IseZ{V50F!c%LWy@%|NB=?E=aA9TI? z?wv>VKaD!tr+$Ajd808(5?wApzhvUwTaPxm{iVGEnl<9bnzpT>uI;}ojHXHB!}|)1 z27SF|_8dE6gqCnu>FaZwN9MRZp|6c%zqRloO)LM_Xbko+uJOBL0hck-?=dR;)}<(j zHV1ph+~>w7C-wE?l8L;=T zI)#T9pba@ecX+e60bFYJ;POmxiF+^a|E}%_@xF(;r$t+T!hP(;)2X!ZzG5&1_Kl#w z(0JQeks_9~0b!Hy1aA54+~-WJiyjh5FVvN0Uiw$Acgo@Q~YgaBFRnv>ONo7epMd0S(C7 zZ9UAgETpkjDAkNXeyinybOTdBPD4`+0O^es;(fql?+0~AAfA)L-ZD)@5&aAq;be{; z*~F4!|9XK4g8thM#4DcKY2w6*kcYJk%%HB(Xngt27aI@t?)!4A z@bbQILp^TmeyI@L6+Y?;-adCy_-IaWQKCy5gH((|QT?bW`%&_WCiVo@RNGRG3LoyM zM`k6H$?)MkJvtAN_I#w2s%Ir$0v8(~Z4EZzwh9%mk@M3Kw&^8sy)DBG?BU^NXPqzWN_WD(b22FTTD zur}i^3iG`N?I9&V-vMar8A6ihJxAK`932ZlG&8zOk5Eb}?)Lpib%P%w5B;>Po;|f@ zIJ-$_J?cZQIob;|1^(I;H)BArj>8e2qU#pYx$`?opj-)LbTTUg}=|Iv@3At=fk zc^SIEhWn8(w62D*L>P;hHLnmBqeo85K@VK=GHSqb^hgLvkk z1y5*W0^OX_R}=y%T@4(X81uoYs_r8wHOG6RJM`$exJA3~u7_MFfDiIHwm+_$jGb2a z+hj5>I$wP_L(*3UhwJxK)!~+l^~iI$(eJ0Lfc+Q2TaTsLMBjm}CazTeu;n&A+Jv;@ z&y?u3ROc)Tp17X6*kFK(I0L^U#>RtB>CuN!1^k#J;qT}nHaqN>ll>~s8XwFF^m4!} zypp3m>%RM-xhqjM+%hXT=&mK%tI#q#VfIt&M#3U-PST>*{7;< z)Omn)-eg`0@{sWmGa8sNUS<4*8Gm4g9~ss{+$l4$r9P9R*RY!gpw> zMgue&v&M56kRxt2zHRmy*(W3wf+K&4l6^2?uLdJ7DCV`NKaR0TL&bxj%C18 zU2f?SFA&Fl#F}9R??dQFyRA#uM6lajq5vFyeMqI8jWS>}$GJInJOdQX0YrRJL2<1G((;Zl^Jb#1^4b;52cG!( zV8TwQY8S8_^OquH7D%H?4(!efF{1zwDq28v-yzN+h*AR#LkFuHY2AzF!qsf~MqG{b z;!YQWTx&3V(Mh&-HkRph_CRS9@koETwCl##8oqNfF4O8WfuRE)^{^XsEnUR z(%lViwKsD0F!~C$if_$Ycx`KW@ch;FgGOj^ei>cF@&5pBQOz)-J3_r>j9kgi8zn1XdKo>WzIE53WKxC{$n(<_wV#jEw6Yz@xjr`iD`UHOU%2_uk`)D@Nn?JR ze4|6`Mu%YfdgxIKfucXOC8iuk^AmU0>FWcowK-rUY+Vp;8Ky7As!|f(rcWR{(TFo}?-0 z6y$#Bk#cFl)h+^z;#nqtwuk6DqE4bN-hmfGSem@aVQDddD=h&Zn~Rtr&OC2yJBmU*USs z%Kf-Dv>6{(ut@UFfLq|&mP^Nwe04{3@vUG%;i`k1cMr&g48tw?3-VydL2w=)kFSRK z)$%<%pZ8Pc{@c#HpCR`Xm|qv(*B|4e4{ncB*hT&l>qIJRq02e|^rIAzTf zs09EOs368hN1<_@2?d+L00->HG_oYTxqm}O|7JW{Xf*;?Y>vzNrNY^?L~wdn|DHH8 zwPx@Ge6ef51#rFt&0D`B5c4O1y;gd^W7*v(QysN4EJeD|9%O|#7b1deBVVkSoHtV1 zS19c(GTs5wg5YSQ&~I%ZJA?dabHou32bR8XOu zWrlxwEjn!`_%Ju*G< zZUBXr8CJW=*F*p%R+7$IsfgIWI}KqGh(pa3=V|M8_%eDvj_*cl%$uz*uN8;fF)nNe2rl)wh=*FaAHFT4g2c1X?+W4q^F<<> zYy5?-{jtfe^LmlmT^E==gQEZhV>EI&(yUd6{SB9I$A*jGkHRQWu$JmXkl&`>4CX7Z_S|92MW%yRHSl&|eO!S|b2cH_7Zmv73WQd%W3;#1p;r zRXbwtZD!%}nk^Xi+#_P{N>{zUVOh<#fL2w0aNY^}sveOYp`8Gd(kKxoK7f3#HnyUN zw%WJ-3kc%7(!1K0gMSY@BPJh%L`nz@x|tUhMz@9fqCo}W&7P|hFDogQ7uSV8ZgSUw zwwBnX+ycuRuogq*JPtcc*Lm297an#vX&&g=%T4ET&|U*Hnqc z5p?wGwONbZ5 z9aMvs1iLm>`LOmO(Li7fr5IqUX^$lHYni_@7g{VO?C-#eboWb*dEQuc z4jcXxdL6Du1&f-h3Z*p@;NNyymyn;GSHp?Mi|IW6!jQKOME@*^X8@6SvUU7J|5wdH zJG>$i)4c>b%9D;eU%JsykXJ?0@MwLL8?FLdX&uL`q!3Z{b*UA6+1iJ&SXpunEM1VO zfjG5(341_OOW4%w7eg#?U`H?xxy$NTb8I;HJM=xbITFpQ^vYmsRJz4e8HkyrMe{8NN=6(s_YP@<6Q^b|x4^{1ox^J4?D3n<%dI-7D;>Gw1 zH@UG|xY5ojt3UWVV=!rD6R3l&u=08uy>)*Iwb5jJdBoTWV?m!1b7L1;DHy;%2P5z+ zTO0elXq5-W1soc%Fm}4-L7z|!#@feeV%f%^uvLb6P^;+zvm3Qw2Hpl`{N6B}Ru4F` z9cEz|HvdXMs3aQnRXyp}SJ34yD=@o|w!$x2W}yjlTERiVs6O)T3cAyb9fbIuC^)*A{6^PoW{SL_Eu&NFsG{eqo|kC@o(l zCoIiWEZxKDuF_G8C2I)%N*C(S5$>{X#w*5O)L5EuRq3m8V};vdg_oJ`s0^WnwCcHS&BQ1r}~CSr}_po>D^^w9@uy^dXYr9rCMKF4TEO% ze|+Y^pK4+BWLT(m*#fj|oLgFI^rUFf_-Fx(hOj8$SxF(-N9mq9?@0!{twDsWMW(Xt zKByJ%1W`$V5kC&pQ!Aqx*~cS0@sIU{i=T#jV=(2PcxwflL{Gg!S_!>w!Qx#;=yDP( zKIcqVStms}&ee#-L+gmr7{HQv7v?O%@*Vq3?4sndTw`nB{VRops6fe5U)9Z#n@eFc zq!4Yiwt{$^3t{$9HftIzY(7rN!88OLVTTDt|+d{g}CkOlvBNI)(Nb`@_3iVsku+J#Fxk zFg(`_B-$B^mG)ya#bc!S#aGDP4lz)%iwIJWgap#|tw_fINCbz7;5sDD0m97Az7`ji z`a2?AmaC#C740B4^qYkbpdS^RxA%`GL&uqw1rm^oaUleP+%zKxBZ436?!~720kaET z6D-Zx?%Jw)LHSla{Fn!DZU)yFH@CjeC2$w!hvIuCKH|XTZ>EnH{Otscd^|ULNx< zZky*}UU}QRPR#4mHjhV4>~3xI@|pKf(A^-G-W5q>IBnCmkg3c+hnZsj_8a8zbk^C1 zJLv*Ai-3j?wbsMdR&zizBA)<9v#tdFG7lX|gNc`qbI<+2*olzO-*-EW$h9R_>>_#7 zy~Z5pH5A%$*rs)d>vPI?>Px-oa{8*V{y`UQU<;PzV_YsZ9G?qMtK6zmq4F7a1;_GJ z+3=neOE2E#^R89o-I@0d;m+XQXSh?s=jx0j{GG^LEgEq%Qz^LtnQJ7o12cPynw~?Z zvK*b6%5r{|##zvcGm^&Htrh3&G|nEaIIluxtDiJp?t1{fGQ<hMEjVnc+n<-Syo# zdXwRxXp((Xj+!Q$S9oLY?r@Lyai7H)?S)N~v^iSh zqh}#*V>DBUu5O5VOU&UCh>Mn0l!Cs4ese!~ko7wAX74xexW0gA9|vb!T!zVFFduiy zAy+H`DsuqCjJ{jU(cD>#-iAT4X*8o~E%9)CJDd0vnh3zeea7~UR&LClWAl7PZBp}T z+WZb1c(ERwg9$7vA-rPnk?3dLg{<&Uw;p{IVz>S)3qb!9c58P(b|WTk@J`m*C)UYDBAT3iMB<6popo>8^F{4JWZGBcolw-RLer%hE2&bk{N1VqqhWmMNqv zu!O$+9O^jY1>8vaR&pTLBPYSS^!tW@1s+R^uE9VJ*F-fH3nH`dPv(Vg*VdKPhc)$c z6iWnXY&0caw6~x}{0KEt$U<4KP#nv!E2FsT@L+-CuU!knjt@fAXnph<%=8nu2&~je zo0h| zkKzSQNB2CN9IAzw(Fe)w^$ZHVe#=HBqZd>0lOYOwB^o6dWfOo^e+_uGM5dfO^lMK6 zThXK*jUooZRHHvs=X1TQ+?zE7jAx1JHo(bv?F`ieIDm;1UDyJI$ope+ghL8+>9yPk?`oN+{Z6-_oysCu;{DCk>|LyM)x@y z$f2^^N>WE$dhY8iDhd4psLKm%g(e7uaeOddPaZBO56{H+@xGe(ucYUb;Fm4fehUl* zzK{14;BPp2%wDfqaWkfU8T&J0NSSF)c{0-+!7|hAnHg#L3HM5cQ_dqwn(i#Me#>%& zQ_5G=x5Y2;Do@IJK9v0fUUwwh=Zpg0Iv!vt+lK61tOK)KzbAc@jDno zo3MU@?y+^Rte>lHCrf5P?5vm7?qk3n?{WhA+KYaMcjk+Jp0hR{@k^9Qd17VqMaWiE zbux7104j*u&BTz}W~({>tl;}FOdSZV*-|O^8Z4Z9IR)#5%t-7n98Y?%0${hwsW#kW zh_o)|eM90G>HabCib-Y7STvwP_|Tst49xXadIY0;Jq$Rq%{Ux99z&bUgm`vY*MHfRN$wpUjf+WDt}&RDh2PzN6xRj zY+wsyF2Ic~Xj%o}EH@ZEVl=GQk-+J@zaRWv7!jw-_>sG*ii?5T3H9OKhdShOl2he3 zv3>;>j9f$UV(f$(Waql(E|;c9hrn9(^{>Yt$L?+T@T}m6ca_F>%RSDgoq)o`U!C@m z!C*a3F-%8p*=OrDh{L`K_i-N#JAC-I#9y4{k2dEygV>PkH4dhm=!qjDP^d`$_cv1l z!J*Pfx)Zt!t1lYLrXebJnnnYd2Uw%Zvw}#_4nY>)j74HJBcngG?oUx>i@_MsLI^k+ zV{HctHR2l$O#ulQQiFjLvT=u%#>~-hgls%rgQ=BlZh+76Fy=L~)WUK7R2%*Z)_o#; z`3e~;a?R=jHBdb53Qc-CCp4|8n$vhKywzn?7sw3SsCFZGMjOC8Ik(RH2xuCtLSAU= z&W8&h2iu?BT?{uC9AVIao zs1|Ng^*(KsN33O9-5oc%HTlf_V=jJq6kfufLx8wELB zVYGLEA#5KS2TXvqj*lFdGRGe|&Kv69R3&DuMqH&SnCKZ`=GYQ-{uSeYYVgFc$1xSd z9-U!9~2Opazdcgnpr~e0>d^3 z^T85*{id>A%_BRy+`%0+hfDRyBPaskvXTB=eboei?uf{apr7^$NCo#a@hsbfUD$n@ z{%NfXHIE@!QA$j~n-wlaQ`G`KeLV<2JyMTc4mA^Nq<-0^(5Hea@uI%o6}B!8xAfPS zo{e&>L6@LW00R`cleK623a9F_O?E%I9pS22s6Vu+VzT~FeW&eDyMmGM#vG?bb_gJ; z^A%!0B?;Y0hZlM}1U)7d^;KDYgPeac#}#3Xzo(fKwmQ`&l%&bR~g26~r!ojnWEn9t{XpjU4AVGG*W z9y~F+!`K=uM2GRv)xkY+=4kc&nBghv|F7YxAnTJo4*aAx)_y7Q$<||NDzw;Ob~G>s zy0MjuLs%HBO*B7mffqX14;`rX<)X^pkfKAk7EeJnJU+0?iV%Tg+zLfvzr>$FhaS!I z&p?~_TPFI%UyNp^QO;<@A&V5X3-XEQ42Ev9Kc6^FiQUW(AIe+MJI+?UvHR)gL;j~b zh6X(C33|<|-PkVsyKBErM+LR&H4u06ys zEx4%m5JRreOXQ$uD>I#O+mxG!_QB;7qN$4UkCwPs2AIHz`_rbTW~q z>CI8}^eE3EaRKCYD9;@4Hgll#N>O?xmCmA7D6$zhV#%TQu(0c|JxpfwD0`(nrcGH- zRTjFNO}SmrdJ?~8g6EMOA)n1~B-JjWv`+()@fei%xjD3`@g5SMn~&p|^9RDG1v}Om zJFk@U72$>6oX~;VJ3OozvK1m@XG%8jIeK^&C}~GZE{{nHib||WowvjM6XCX+G5e@< zj^6P5ea+)yl}A8$!JXm5Zawk@B)-5O=F@EN;x;{>z!^xr^c^K7(@0MFG0u2{s*Ee;{B|6CXqupQ?k116v?LOt$x9SfQ$$7POLr8J7 zq&((vWGyPXPd#sf{sYmtaNZX%<|L2OmLB;GRB8_^@?Xfk(q09?nmW?D5>c_I#cneX zy`7V7Gz7yM=_M@$#wO~f;t1ip${&J z4nk~O!jmPp!=RLIDxsU5&`mfAkH806YmZ7ViaaRys(1ZW?r9Tx;E@M4JY!1y#wle8uklM;_08+vS8B%33bUuT! zR(c-;b?s5gBJ>a#;}OXsbTLp?{qQ<8%4o=p#~_=l-IVV`^|6I+dl5;gxhXrkb*EG? zcG@&dMJG6__NbEl?liUZ^L(;}XdVBJFg!@w2zi3%QV};~Oxd16tgryeJO$&Z#@>aE z`nA-u030hMyB{l$Ot+2Rhw`wNyodY-`=4w z@)9IBP?)q4dk*V1BQV5KG=zwr@|S~`;}PBk=O_KkTj)U4`rn~k)gOj%_Co@}{+JG_ zyHmr5I;y*(=r(nu$AOlH=GbfYdS`gwSeZjXgaL?a99S6%lbIZCMkB{SXcHi(ieSh* z8M?lPs^hRf2{@zmiwlejf4s0*IpO46=E>o2Jqx-d{f~}Ap5hlZJn`e0#IQ;^8W;?2 zngp2=RfQk5Ix<_Z1M?Bc1em+VOB}Qc20Vbf05}^7p2mbXkL43}tNRfMu^_NuFvZ>o zrsP1Ddg`m+$?WFaO|t%dP{4sQDn${c${t3^{|W&VpnS=#s!l?61VX*42H;PoLL%2{(EYzZbD|B>T5Omk1tCHYegBZKyXYjRF;xTo0Lqzs(8uz9<-g24y`O z#ni8}wlnK3E zV+91FSN;N_63Q7YQj`|sPY4n->`)KXX+3=Z;^`>Hz)sFjr#5rJEACI^eMeTw1aFNO z{(buN_14w@4*jRNSLV?FIq$!VK6^su`#H?c(73N0Ph$R+4T8dPbQ`wN8jJWx4A`P*;p$y)mRJ}z(c_DRqrUO@T zZP%i;ST{h5?&1)*;EXrAA2+oNCDPWTd&s5GIt!->QtIFH2AiGiz^-K11H>5*D*Um_ z+*Swjcbu^kPAt61V>MH#Sxs^L3#{Dj$5Hb)2$E+Uz++J=V-qvFntAref0Mms$yWoiDe2NX7ZwT|U z_=kMh4?<0fpB?~7b%LfHsMgW`JDBD3R4P6#MQ1HxpNBng&zDQM9J8!#huJ~(=mE;P zcdQDtSeO2jO_+Lpo2M_Yk8aYVjVuajvFg^cqpB>Zmu(9l&4qU^(xWv13xA6#@3*`; znrmL+)+7C3OXetd*|zdcgbH0}Ug*VxZy>T@JSoUTHw<)<6KQqK;f9{%OiblS@JX0C z%sG@3>K^_UxZjp?#H7=3gMN;15u)P*FA@*K&eI`tYJSuV2GM%h{F$(k#CAw09Y1Hl z+dZ(Y6F!RRG9NLlz0*Tk>(OhGkfl|S^3YR3;C6@{r0qqtJe*OXb19T10SI#= zgo&4=EU(9dqZ?5Tvf>6Yc*UDFaQN8blj?OhHt zUm;=70!a912R-@Nse<5L&H{kxWD;rc8fPhhPZ)!1=IIeK zgcDMOaS<;1Dg5Tep5_sL8VJ(O0p9UZ=kkquG=%G#$5GktN>PpSn3sAII~*~DeqoP8 zc?x|r2#~k{pRcl&PH#?UpP{k|qDRY^O}^y0Y9LY2ebU*7(1)Gp6*K39gV^8L*I;Eb za?ZePg8gd;+ka+kRBIplXR3ca#iH|Lqg#uTPWQ@3_ex6l3e61v6J3ja1MvnkH^IaT z^vIRWK}@M!E2i5xzg0+E3=M1TYGTlnpgTaafD$7 zQR!VxXqvLUE?~&^;VYd(s>&K^=*U*q_;xy*YieoH{DRp;W$#wm3i|$Z_BPzfdi)i} zJA6b70RlonpQ)SO%HIq2Z=KIEFbtJ4z&mWnIQa@?rJF;{Ziw^B-wS!?+cRW@DA3wia_*+-77sI?MVYTIrF~>NJ7@`*NC=Bhv0LCC%V!~&Ru(RMu z&JLBXuz*ws+_Q0)8sI(!7e<~M{Ed?xyqRb^;N+U1F%_Dx|B*tIz?~CAB>sf`0j?i= zxMhL^E;r%H6oeCr<5%#4p!E_12VKfR7z`E|@Zu|3V7g?x@I473H$g0D%!?3cYZ}m| zX4PORKrjjV`p_Q?L2qmg^I(vQKPDP)Id7EVqL&XrvUy_px4{9a_|fcWddd%l&ZY+T zQUfj4Hp&@rL(CJYf^S2+pn~uwH;SHP(XCo|izo3CM$%9RY<2{vh;&EE&glDy$`IM| zsUHcql?Y8$xc$?VkQ#A^vxLDxIQJKN!x5J?=Vb_D6gTi`PS#W=J0@PlX4QG)+@YW0 z)ixbMPbD5mDQQF+oR*mQtJquXc{8858Tv{FHeGqX$n1@k!2wFV^9P%`YHfLwIdYAUuSLqV;JN92CyFV%zi#tnu~lC2QVmAL0C!>kfz(QO$a+ zIt4cWT_Rl55eU^RpZjqtYW_75E+@h%SUwD%(3ZdQ9~B2LlfB=s@hTUTpJ^Z-ym2I6 zrc+aqi+7=oq_4b!v4|)B9O(lq=v$|OHfRotcUFxkb!JNTg{TYXiq%&=!XwA}QceRH z^F@Awq_lT+2BP;y0sbVLlTEfko?=w9PAnohA<%1px9M#~Z29eoZ6_gmrXU=i+6eYz zLL7vWh(i_&)T#;QW{8IvXnjG5*BuBsLM_aKX=ybenhC*$3TQ@+;6%2DhcmLpu0dzk z$(7PJc@4mOVxNuf9Euad&FLIGU_Y6n)*i>*h+@|Wku%l+*CLK*G9}ZCDDsT-c}UAv zWokaPBC%Tt@Ck@)`?`_@>GOiJ-m$uFT7Z~% z)PoCWj1AN4Ww-1__u%OvSubwk>EnQg$C6@ z*?i23*c)o!MmDa8u=He96@@uy*0Fxga32mrYrzhZ)!2b4m(2dCtr?3lx!M;u@dcoE;t8-04z1O^hT{ZKsI7(Wx%Vdx4yqSUyf!1z%i`^D4Z(1C6n zut2i&t?aeIMrOJT56_@8J3SG@Sr zfYR06rh6^`67X!?JB0PnX8iw0xB42pYf# z=GA^BQUkhZ!m6~a_be_-tw@&=&yB!ik3vtu%K%rhE2sk?w--f|!2-ms9l?dsV%~)l z)}bFL#g-_0C%-=f-S8bAchGH~l=vKj4pHtQ^(s676x>T2iEzuS$y!I{FW^DEH-V2< zR8?TV00pvf=2d<>#(PSBoX>t6TtW1Dw2K2^K-+h)+n{y1G%*S`P*i)7pEg6PDZ?|i z!1V05C>|gae%{6X}@x7VfGz-L7X$~OE7#37hV!Mot2-hwD1)95DV zB}47b05=dO_6IG(jKsBkP5}VaPDiZ2W;c_RvQm3*>petgju~oiMGp7(y=6Nx?ccpz z4m09a9xC2n=#cw7%)WH;1(2$WYr(?;=ZQs(P;%pkx zVmwnjUKvaHh=P4;gPkv!+6}))PYf5n6}MKua*kV2U3%%>*`7HCc)1!7C`^3lWc?CM z8I6vyKY&E}{&`!B{fUiE`Qps-|B~|gPojKt|d=jA3_sG7ntJ;qdR1n3JpP#U*0arK6fHtOxg|cnnC{zDd0Hk z5SgZYURJMquG()xgJ`R*yJ@QT@_n}Gy~d`*V}d^Mj^n1TC`(Q<8ZpWjn3FLb3V9O4 zu9-nAd58{J`p_1~&LxWyp@lY0TL~$LW79PuAK_>-(dO?CoBoz2x=rYig(G=Q7 z@a_N~6I!nT{*;QJQ}K;(AM8>Gzm*s4B9i$EVFF%ni?{uV13Q&HP#oBYDBxj0+Iu_o z-R;-^i2d)F`V-6Q5z^J}^KxK&(eJ}$S;Sw1{s#ROm=VdT8H)AI;V6p#x*@>MQ)E3f z1P%@nV@v_#))UuGRy~V(a3PdI7rcKkeR4k|zbEqHvbIRPsz=@gJ&C1?9g6g*T`;g? zHO#vnq%?Kz7u$@SX`t&CftGduATW&wBe526I`YOL&m8G5ULyzf)r?ua0fJq}nhNL@ z^dLlj2o%l1oYkP6i(r^eJcB?TW|PNw2(K@t-tNH$6w?gSH1SWG*`@KA&TTu)JG@*2z6;^6ysUjL0C6s6!Rn-c-Pqoc7@k3^ zMia55P#paX%Nc0FhI=VW$Zr6}tY#mNu*I>#5|@HEyr1kZprKS2ZPp{5fVUPMl`4uo z;-||D4spb}`gv4#G9|v3VANyH0y+xR0VBmTnWbJ-z2;Bk0s&^0qOEhCYOz*De+A)2 z>qVWRPG#7)SV>9OZl+y1Z<&m7P5?z@5IcId3_Q1`*gOmE68^wQB{0JODGS8$4_KWZ ziLevU4<78>P(|`+B^n^X#{=iUh<1pHE_GO<-}T5?)T_pvxX7-=oi!is%Kj(r zObl0jG;ALZ*8*7DP-CwmxmK6~trQvXbQB~qk~)$%8jrY1%ihiY1=YXzS6rL)Ra!-< z9zBTW>#Iidu=sKw7GKU&0o)<$has2H&j@tQ1>ms@vp5OEAuT*V!5;NzDuA{drKQ6# zXu5Y&2HZ{u9Dy1fAeI|o@=Czkli4`-c0JMn9vB5jM@n8A`HmFwk__a0M@$OwP5{_* zDPb_0D~x9F_GzlR4Jjzzg2gCbn_vNqip-^W+5#9%fLFJ$3=>Riq-Y*7OVj`X*WdAo zT+N|t5KGh?Iu*MOa-^QWPXI~i>o-a}zfBQbm_blqpVy`^MQ{ROMz@1B^cZ ze&pAkbVzOY;rA`#IqdT^Vf6dwAO$5lJ@OPmagZn8#Q{h)#Q>1K45i?KPGEyP2?eKM z{k2ROhgB#)8hs4|zP%Let`$f9hNVzR76RBfnujjdy?FoorLJk$~7)&w3qV z&{tjRlJ{xj=|}!r3bq!1f*Sg&u1-9%EWcWnuj-0lWl=Dpy)}oX1V6zGkJNerHUH)o zv1?M3}B@-EXOYwycgcQ5U$=?D00SA^)#$IO~3Ww))Q2`eh1=x4;{>0EM`jFv#+}L zC`YfwZ}5Hk$Hb%RStNw(aOXU@TtwT!CL~b&{&S$X$Y*RqKrkd0kTU}VFN9Mm+rd}1 zKeQ>jJ#?};9`pS9$78Jag-*i>-vbLemVY@n=Xo3qZo%_ZoCUgp)`R)97tvh+m z4_NR-R|{SO*=9Wr@iDZ(b1!mo3>EoyQ%vd#%fAVB=i)3GtA+~7cHjtdKLiE%<$=)9 zr+rwCI+_z4XUr=GWEX1>`X%1^i9s`1Dm@S=3ykeRn2v=R@AXMycNn1ru?E=ODu3dS z*2B=HR7z}P!BQF$`ubzIVk#w7Fx7kr{?u8&!%D6>rO@~waRPVRE)$Ed@LL1HCnEEH z4K|;=|of6Ah3^rQg_hq{hze~->fV|CVDn#aC z=lQW|=%-~n(9%L_Dc0ab1WnzMO=+%X=(9 zA~pQDt^M$fkdV!zASiHf^9A+HZBV%>Z|=4>It9N)L3>o?Oe&iEvwm#yqI)2n?&uUG zeHE&d?T{s2xL?`D5k^y0Zj>tez3%~zLX~Pg?9-6U>c6S^Mg^i(2&4q@-8kGbP8kH# zagvmLcWg=kg3F8j%XSf93IPT^D(eN!!D_KD#OvXfj@SyEk%*}!FRajs=Hnbw~WwZdx03gG8EhpZaFQq2EXV~<_rBX?gKE67@rLc zV$DxLLY(jff7+;Nqc)WKMrcQrJU>79R47c-`4B?_CmMPr$i<+5ddL*7P!(=#Z7np1(`jEt2wC{zh8xwK`w4qfH`waarw(w)_mD<1*(DLic<~F zZ0q}HNL!{((T74<|3LpP~VPKf8z{Pw>x&|j;R`hf<_JDL?yl~0bTXCu${Sx#Nr`KF? zsvda&h~TJWQ(V>^fTY=`T>8~azX!T&CHAHlZ$TCqXbLshJisF@fx^0NRxzuKd0@Q^ zwqR5j*-Jo2Uo}drxK)qvpjO3g>etjNX6aGBmCwG)0Z4p;@e_zVFl0Q_D)zw0tPD-V zGpptpEN|l7OaXr%T0p02KTZN9KA>7w;gE&>B+%5Mw*m!wjkOVzGz>=FU_@z~vHu1j zWY}-wYF*IBk?I7Dz<3GO`s*P!@y!f7)8gY3%cK%OgY2FVBDxd|PP3m@_h_$XKZ1Mf zb3dAlaX0aTwFkF&$_~OQ;PwR3OEBAtbxj?qK|2om4V@J1((JcUlf9^B8;Ov?69DJdQhBSB!j6}22;Kg zC;dtqSk``0mgmLkY^Gs?BE#ihRYamke+j(|J@j+>N2&O1?^2DBU5Rz9{5Wek#6YOSH%DKqj=&qWf1nH=TW zHnwZKiIy=8P@`Gmoz(2Yop?1f_8IvJEaqZ#nVR!ULwH?x^)XZI$PZ8&yDgUtc2o>D zYNdfjZDGKs2UYzUO2Piy(DF*3{u9J^_1W^cPowbUk@YUMrjFF z#;|7(YhA;$AL19d?gSxJoyOG&_>?JS&6(@n>6g14ulyzBU-iiTNVOiCihke1%2t1L z7#;LVz$ShvW(jC0A|SBoR57Xkc=jZDUY26QV~PIb118{!_^HpCC-^ZR-ERzI`R zRr1x(Y#hgXo_3Px-P+L`wikqXjQ5H28eeQ)F2{)01OS-f2j7J{ttSAD&ca{6;K78H zk9?M8%TNZN2|36}Nnig7vha{;d-FXSo;r&@U>pw9L5J!zI&2oFudoME-Wbe7tZ+PD zCJ4bCvztnDdV4p9eGDrN)~me3q6JL>$F5;E9n@n){r#)Qu^k*bxj>Z*eYS@#%f4FW z^M{jD@{yAm5Yt);hC;%i3mK$_q18~06#;ZR@`gXA830m5*~C5v@TV8^k`A z8@z5oDa>-N-|0Kpsl$vB2ad!qVM>UUr_Sj=e1`(gNx(!xU)A2>-u*nD5J;pKi=M+v z3)oW)cQhkK3vu#P%_t-0N?H){%l00B(=E!7_McVP1q z+m|bZdCa+Bge7S{Fz~W;JZN#8$@&nR_@LU{lflSjNLZ)$?&g?B;T&V$q>o+Kc-6y{?$wFAd`Nqow@r5&)#JyoC2r zAHK~fOU)Q_%;ki?(QuhDqH^tsjqH5%yeNzGr6(cQ=__EbuM=R&57Y_`o#A7Y@72|p zUeXQsf~oc}U(Yi?KhBF0C35po`IchWu9&+=Y@~Kdc=vv*;6xeidgI=R77$US0}z>l z)ZwQdqVt$iDq$4_YMca^<%Ew_<%V}3F<+8~zu{^yL>%UFGG+XI<3~Ao$YOq{<_0_{ zu@+OVBgX4^`ToHtjYnBQAvI$JR#J$K9dlF>H}}u55@z`=aZ}&z=5oE9F!$6~t-2n_O+k*~zprB?q!N~U zx2wLds9qt%o8E^!(*^95D;v@`baQPV&ej-WS!`2Hs!f-m{SeWRv8*6w85UGIb_l&2 zi*Dhge|9zmF!QBU#cDAMM?XRv)DIk)%S9*~UhGau$EtrgoTp0kr5_>O6p@#0Q;}!P z3#N_b9(;??^}C-1NEtc|M7eA)?z8-XzAAE#u(}gWAV~Sv-u6YW41v{+yBi-fJ(bfyVV-`M2uB<0< zZ)_C)*O^fgw*CNW^3!NWlx`t0NUg6(w=Wla*CX$MV)$8h^_=jtv>UgnT)_rMwQUta zlV6W`Rt)*2n)MWh{Z23%)|O)81ajhW z8sLEkkvtDpKh zK8>K72)Zf+|EO!zkS?bI!8t_0BR*h(zR-H`>kRUgt+k!i8m!;&(n`J;Ykysc+Iz6$ zgxct@_`T`O+ApKPdQjE=QQO-6S^H0{{UrCR($eE7R@vh4!iHME!pc>;H4BL`pfH}$ z7Gni5PAA6k#3;Y#W>)%u0~m|(s~A8!7BGTzIN+4awEF-WMR{nvQpp;=2M3Qr7!Vrw zF5RSA3}R_64p6^q?iZ>2m>2Nr7)OL${JjUbcnv_n3!z|Ahd_jF`SiEwG-ELNf(>;3 ziHH+#l^~0NMAU+K7;6D(I`@#y<%-UkZRsp0odu*b9Y87hwGfqA`4zBXWl1%)JLqKF z8Yk&uYdtf`@wL^~p8KR(f99pNSu07-LvqcqPDRd%2P?&*y=YlBm5wPYvonq2B_Ocw zR8%IlrSd$f{Hi;s)RBtnAS2j8Jmv@*h4c{$^4d&{HxT2Q3Zokr`yF)hlt@(VwkCCH zX6-(#{aH*}-H40*G+aSS9nk|B>i8Cxh~MuP$VYf-mCt%|ZXqbM-v*GwsWm#Y_Bz&% zs@m7Jt^F!%|CY6Xs%m3+*Q`#NweMo>(W?w_hm-Q zP9b*tUTN7TURt~PN5tNh*pI+g&@!ogYi8{|D6oE~YDaLf--g#{NB(K;J$6tqiNiQ8 z6VuO#X{y3BjF{$OoB&OMJhVT9u-`GEMUy;=NqqJrfuEA`bD=Eu7AW&H-lbf2s{{ z&tqgu^Hxn9T@{Xh+>@$qV%TZR+ezf@bn;fHcJa7Givi@= zltkngK_B)EWGYG66`AGY1?ezoI709maAh>vLkXq)ic7K8W~>krBw}&Pz{|Bo!Z|V08{Obtxp4nRqV&$P(g%TDp9TBYcVjO4ux(xp#Bj! ztXDuGZKNxhGeeQCY)g74N#BPU(_RE1r-mbzg-3AQg;fWts(GoZII`f3$DgqJrK~<2 zfMBZ`8TK*`5bd_Yi#egR;$7v5DOaZzxvCX&4b_Uz;JB;~pqOq2UtwXbTq*)w#7nCH z13+tS%?BH+0L1mrRwHcFLqJ0r51+rX4FEd^rXtHNpJ&kf5$T|g`hieqs|ljDmlNN$3g3{n_-cr63Gi8u67olYjNi+=qkxk$Y<4A# zSOWUKP&eL*aJK3aPY`M-WMqGVAP4eS>y=mwmvwEtR*z41cGM$HkpF`2e8t|avJLSM zwc1$6g~88LJGCx-DSzUp^^AhEQ}@oVX&OX^lM`|#z$sWS1)*oLei)y8h7*Hs+Y8N{ z#8>2Tzv2>a_)rH<^AF`Z)BI4U@FA?ogy{3}7#H7YI)nG}$^uV(Ch)ZGKLay$X9WeR zT?s%gRzCSOuA9KO?2z@w6IPfsp3a1RcQKLS1*C9X@h5;Ru{MReg{fy%8Gm42A@{_G zmN=|;RaE}Q*%O+yD3#xAL&E$`WI1ofXQIa9Xc8 zF9qJkFbjA1QL#~APmgNwpm-WP`WYndtTql%ArF84g}8v|Ej@ZODiHup`XQD!eP*S< zxw219sNB588~sd=TnHbFhkJCX^j~;BQjh4!O5x;tD4c3tv>MQ_>`vn!;k zU54K})T0AXExftE%!w6@9+^oCm;iPv3ouE>yGg)Co*CeYup+<|#rgDh8PDr_;aw*1d>6Ge}_0T^?KJfviXmt@qa{IAc_yqlcGBLu^t(n zlJS?SyZ;<$1LiFrD)%(-Km+wGyH2M5_pfwv*?~t4 zqF|pv7Lgg1gX{;1jFP~vk^F!$0lo#bV=VDgWZL{Ox;i{`M5yIY3FdT1j*=4ev;G3AHk4+RRg}>S}d}g2{Aj}L5>DN!p2(;z38LkTd)wo(F;6R&EEBwTD_B9N=5NTf+bzF0D2jI{{_3;p^sB15nfRTKzr2zn+gjkt6yO!mD{JNn`i

    H4hn=B)H&Nw?zjR<_0Ww=DQaveMUNrT?6j-kOzOn3W!x zl@4a5XJ)12S?Q;<(k)r(C$iF!tn`bLZf*bbS?Oo8(w;2&?9amY)2y^R3tr1gAIX9* z%qriVRlYAP{bpABtE{w@mEM_^ekdzFPSUONSd>-%YF0Xsm7bH8-kz0yJS)8{EB$d+ zx*$s)HCg5Nwn%Ft7EZzcKQ76TJezEbufg_)UABv}vmHe1@)sAD+U(s%C_1 z_-!(J!_T|T`Aqu?JJB18SWlBTLL0Rb6XDwlCSxlAaKi(f-M zBNsm*SN9ar74MdduSPB-H3B*71@vu3)gt^TKvUHq4P#eR)zF$3c&X4zaTc>G5WtR< z#rd$aMbvWjb=Pk45CKCE>lPy5*5Kh}@S~UJtY^UTwzRjd zt4sE|z70R1cWp*--T!Vn*=JfCe91n8+S(`RlTV6{*Zq9%{?)(nv**set-o*9 zY~Rh(XU_3Woj-NP%&9+|Io)^T?76<+%`@itX3q)Em_5sP+w|Z-4zcb0t7!xPRaZ58*1XwJ?TlG-Lcz0Uhl05Hpy9dGr_Go<{RV&y^pWGs zL$iEm+&c9~(|xmNPP<|DtQ%+CbcQcD+ZUQMZEA43PvwN>PNiMICi=|NN-i07MPHxR zr{BCj^MInH&pf2A?lbRNpVqn0yv`b~)8}ckwX-hJ&YGp2b(?n9ty;g%{d|{CpBJ1u zH|U@oIB;O+en4_VXZ-n4kGBe`TyD5|_KX{*Ygd;I=rc{bb{Og1p!xcMYp~!{(fUm5 ztoei=T)+pw0b0g(4LmWRo$UObQXJ4S{|b@r*AG1P>*uSQI_r#}@5ULkrun8#zj114 zW{N?l&AwCn%scfIf_B!V!l=1((Oag4=FXUPlW)P?89`oW--!M*-8XgNgt6nZW!706 zsHB*tdFAYo@8+rVr=uqZ+1JuFrcYBS6g{#xZszo<^QQaeLQC^z--1S6MV0Ms|U

    Jszh4 z=34w+oB`Vx_eW1|+m;lcUm#zbrQNFCrYRYnmD0MCgmtOA>~dP`cl{fIr8>8k3s2?O z`e>*9%g+T`g?7Gnu6CX_Oe@z0Yo%I0?JVsa+?8m3wX^X#6ZgChcJSrEi?zj9kd;oA zD%`_?eF$(5)%pYP>4Iwz=0gLuGuo+lvev7e+|#r&?Syvob>!x?Taw};b?ue`b!x`_ zXxp=9i@17f-SO>_dxiTXx$lVYLam2(yrlA-@~&Dj z?ux!kRVYi13;*iM@rJYMe^vgUs6odXbgw~|n&|EXTvPOM zP3TpFt!f(1J;OdU&4<5J@OLWyPQzac-k)(#`hD=n>;L@yj|^x7-{-%4^vEt+ zSA2V6=luTff4*N_1z7*;hQI7jcgg9F-q!;?uP1sP?~g~X>kg0K9bWe&d>5mqos27? z^QFf3g{!ybL$B@qJ$&+k(Cjv+ya!7|m+9tA_sQ43N`7CTeC=RzFruG>$%Dyr z<(qf^y-&V&Ao+cL@)3;C9Sy5&#K#6 zqV5vFwKv)RXPA^^*GQ!=I0o}x;IfnLe}+j(s_rl?a7^viGTzz1WhLAH43m;f_z@Y{ zDl_gCj0If(NVfkOCMCnPDyP=SV`^v8A#}d>X|ny#FezyZ-!?U>4faog>yu>rpJ7tc zw)U~9>NLJjfa~LA`=4P_GE5uoK#xh+Iu;{yJ_fEm$@V|Pq@=ap53+Dwm`-0LcYA>A zqh$M^VN%kHtNpvNX^bBM*TwjJnB@0=`pMUJCoj=1#rJ>y$=Akde^35BIS$wV^pme$ zhR@~r`yk0X_079uQ>om4beN z`}*W-JCpzFGx0mh+N+bVy_5XDKKa`J*WTB_S5cjLpAb+>P-6Y8f{uy=6=Hx8a0I;p z0s%r2LQqt6a!GFBN^0R$F&#TXfysc3*${ zrd_-3+jV!@eRa2em)+U_^PF>L=G-$0Y0Gwhzuk9Ep4>D4=Q;oLIcLtyz4Odv2!HO= z|KBx~i9hqhaJjJ;;$w@IiFf@Y70Se)`bR31iFbTEtQS`x5Kf5+bd~jJ4mr7#S1gjFc{|2~T_v3@hnvuD@BCglL^=&^sxU7liY7@yKCbBLQ z-}2*w%bF7qI4_&32dHQF-z*%`yT3D#xe z8-9FnSrg?LJ^l@F{gEFZT-J=9UTQaUIsXV;ule!8WsS|1j;SG8y#}sV{rKRr#^#d9 zwHD*6;QG2BA6(Xq#1+N2Fz?sF^)){}xU7k$G2>lDCHoq<{?LyPE^Ey6;a+zU6Iqvu zSN!kK1=k<=@xf(HXggXg2lhVz*UNr#I6*PopD!mWk*6BNfWTbN+LFEB~k1?-I(yv;L6^W#UWzkqYv9=!-|_ zdgu%OkqTvEpKpgeuWSjAu6IX|@5AxuLW;g);G!ZwHwl;nAE& zk3WTSJ?Yy)rXqaw^il1T;CjM8QlU&d?#Bn0HRjwY_X@Ey>*FZb=l%HLvc~4>jb$S1 zGBN1K2bVQA7a`kX_y)oCIX^zQtch}Mk6{S)p99xpetd9Qvjabx3GGLVJqE5v{rKRr zCQNDIpY`K|%Nl97Gs1Q~;x|P0r3G1+iAVhS;Ic+r z#(mysFg^mVhyD2AvL=or9(x#Ed;Iv|vL-%V9J&Ww5Bc%IWldZv!upN+5%LhY9`xgb z%bJn6O#CKrJqWG`{P^Iq#!N$dpR!6MZ5{yE{eFCKSz~h%a&rvd{ouOKj}Ic|W48r441nt% zKR&puu^Dy+sZHHI;JVw74=!s=`?$T&DDJz#b(e1kd9ETnde#~}eiyjz^y7oeny@6d zk5D&laVNO$@Z*Ea8fkgQVR*>u4shM>#|M`+I#-nPFnqUz>ob0Qa9I;_>DXN(aDE0{ zyZrdzvW6J$9wD`6zlZg^z;&A+A6(XG`_VrKz;+wBKJCW`mo+1C+-sHf)8M+*j}I^)Bl3{d&EWc!A0IFqLlbg6 zFe(#Smx-JF_~5c8=|_rxj(N9(YnvY*aCHFe6vWT|_TwDG4fO~<^6f+d>KNT=; z1y|0G4=!tp)6)LaLHejR2d=CiA6(XG>t|xqYb||d!IkmjgUg!Gdf#E#GT`d= zEA7Vzmo=t+bnn?B?libI`|-hLO*C~h{#+3gS(k}Tetd9Q6HPx-{CVcx1g=g$KDewI zDZPz%f-B|62bVQ=8WZ_)P}dZ=I{f&6Z{?sdQ^xP@XTA<_wfphGWlfm+D?tfDEE;PE z*G4}+xU7jBk3`HLiGZl=RV@lHh9dl!~kxU3mHz0|(UWxNJlSNrk7WzAT)q|Mdf+Th0rmo+1E{XtQSZ2;F*etd9Q zV{?7Ah(lXk1+FXo_~5ceTaNbm3bS7ct}Fcb;Id{k4ypS?Rn9BGwcd{pE^7|Yr7hNj z>vBInxUA8Z;pf*zXs^q`b(tR@T-Jmfqs6`s{>#9%&W{f+Yer&t)hgXOaJBmJ!DY=z zT(4PNt>9Yg#|M`+_$J><70H-W3sj}Id~jJ4$7N#QQp_vBRqw|Kmo;X( z(e~=WwcL*n_*FVIqop==%fYqGj}IE2Ch0kKDewg?MK_I1J_bNKDewI zEp@1S9pzpMt|fkaz>^Blg!cHI+Nd>M0u|A!;JVn44=!tLhPOs2-^Ji^{SkuHjF8gK!v)tx zetdwJ0%&5=jKF>oxEA>F!DY?ZxfXzHz8@c4*0|#PBb1{!m-*nT@#BNb8dv;aj9fL~ zn&-y{mo>$?kGww*T-APja9Lxf{oyEOtOnOyKR&puF}cFM0~YICaLw`KgUgyQ^~kZe znRgDj@cxw8;Id|9hGNZZa8>#7!DUTxijnuLz;&S?A6(XiY2UG0DAZBxLU2|3@xf({ zX+PRt<>-E@E)XT9<0l+-^f4csSa#gxGo6{UDle>>T|IC9#fvUYEM8i-Y7dM`@W=%_rbIzJItJgH(Z%so(!<3d| zkw-&AQ&W?(#&M2oZg%JoSv0pGf}AKj2BxJl9U?_udBn8d4BV`wGpP>I>aDI_(YU&< zaUDhFM_uDm6ty$N^eCrxf2+p^ziA&i; zWmwYCw6@M`u5GC!>LwI8+#zIbT|?axDp^Zy<8mriQw#ppHWIz&Yiw#2(~|A&sa!#@ zn<=reE8D&W{%yLuvl&nCkV`2ql_~V}dF%j6`M<$VcR_^ii42nn%x2Pajwjudd0pvz zL9<9mD0flvLsBUWI~_VIx!ALm$rXjPu`GYOQ=~hY10S3opHfAI!uF z=d-;%aA+kzBoj3h8ipGTpAsb3Y>2^AmY}HUNaaw2ysWg^5xJghcTOgtil}`-Rn2sH z*&Z*ImF3=%>k%pXm+$M|nC%+fL&ZNIQ!D-zQu47{F$r=C;z3f7Zb%;TNytr*+aUKto`Jjw`4h-rLjDdyuNEDL7miMboCcW=xd^fx(h9j8 zat)*tLa!t(KyHNWg6xJo3V9MjFD-oq@&@DpmcXN3MSs>OQtkCBFdj2f{K-jz;+1F6&T6hC>%=!KsQS9zj18@~~~5>NSGgwF>_aZ(59bDWG<*zCqJ6XYY;pbt z7tB=KEZ*q!Fo(9e;Z{AbX8!yIv|U7->t4KY(V|PRU7Dy}ym$$1bS9}^v2x|gRjXDt zG^}3T*x1!iE$+*C8ZGh#8x`46d1PB@d%}*AN)@nx54gXP0G|t7IxZ=vI>c!et zAg5o3F>}_L4pd_HoEGowbEcdzO;lBrlOnY(#xwEL;1!I#ek_N_k57u7@cc1TtQ4!n z4)KVnXa65{Vi|sqc^$lf+zF2$H{us}IsC?LwzyU76}O4U#OK6P@pBB;?v?Tu}geL+|CTeDeo1# zIVJJkEi~Vk!~mmI1`;YyhjG%WugJkKG2ip&3IzFg`acYEVkfV z?L7K01KVwQ?)GwS#|`3Y^neHdhiziJcw9Uoo)ljYUlh-Y=kYApm&JbZ6?~)dl6V zmbI;CA~(6%^V*J^JmDyZ)_u;D<0el>9%ni=&T$tlxY(WKoavMwUlADc2Y%jT1-~p4_ zJH2AYd66cIMj!R7Fk?^0F;I!mO89M{|Nr3s8+_(O=k>A0r{l<+44#kUJaP%23CQ!# zczEKt9mmoj=75YiglAU{8Qg!zdt|u`$HfZah>uW)sL0YygZ5G1W8OBD_gYnISvK+) zG@W(DWz89AZ?N}~e-`F|n=u1#=l{D9dl<*-XR${)J?h_#*j^m9nlZ((k9?Z32>U$# zKd!V-!1hVZUedN*ebV03D!wq2&7>|73k%sTsmvv`vcgIb|9R1ePqp9_wPz*7a>zW$ zYRFm@r~Rm0f&Ggi@SAyVhwG4|R23DXH-jY_`($-0&dpai+tYByn}LlZ7n%$LKoL4q zJy0)b_>^xLWYkTSRd?xiZvhqF{yHe z{(?KRxbR}1ps3sSWKRZeLtUpE&Q#O0x^Ow>BOPRbgasZ4&F@ z4xwifRR+$@nH4Dpxw4fdb+X%1J)K?I?PDn~dX1Vur6ljB$jm4}t~bAV*2ZM}mXMb( zY^a?K!%lckMq+F|l?ie8tb`bvnGi=KzIS#)JPY|&70zRG65<`m&mr@$zXEbKWGm!W z$itA6k>)vk9)ivBa}#1ZLNv*0IrLCH+u;~=L%z732df%u={lghCj zpML?)4ANc+>44k-{fppy0CE=cyaS&Zz3)T;kI20}`7~Ve5(oPdz7&I#yx`&}Om^Yu=;%`; zumc*&!d`=w5ioY1tlhp=7P@nos&K)U_oT*g7daayijRR%e()-CqH+_9A=cj2+mX6Z z8dq+1ooO>7sn44@(cE_fzrvhVQSR;C7@a>|oDiR1BITbDZ%4d2BBURSP@1vWjnzh% z;Wx3DE#98Z^*M#U9J&SGg%foNF`y)e&weF@bwD;}x05UDP7DH_2z@8S#whZT{#OYH>r`jwPDeP?r<1S4MdGYQ!nwu~3+0*Z6139*($8s5i0dKGL*9Y>JLJ?g z3DF4oCG^AiJiA58arhKU2>&ODWYb3n+8Q3aol7r8KRE1#o?V7JjxHl^Y~;|laAEE^ zs+%Z^(+6&e6jBtY)6k|=k0jVZAM)%%v2$d0&bDM%FB@y0-oi=XSt{?Zk7O+TKF88;b`@EIoFp zK)CLVB&piLc~LHKiBDeG^Qi*z;oHZYv3NI|5IcLMOu^^hZ%v3d@OgG$LNqB!;`7fT zb09ZdhxrCV`mspUZ(utXzTYPQuiU_b}XE~P5w>UT>dPlUY?oSH>a@H}RN(irl zpcBO9a%Fv%vy6KtT(roEDwS#Pqbm#1lgw;NVd=rIGZ6Vy7p^VPjAGyxtWP12L-s+Q zhr9&&8stHU?1o_dF8D-?6*FId;KdR0s}-D2v)vM-QzNcFCaU|-^l}MlGZFWjGlk?1 zd8sfH(|d4*BW5}>PGd;WI|&S1DrYq9#aMmiv(C13PoWo=9_qR!wPSO#mrmKL%;`=& zh*YihuKao+*`@b`bBe61o|v^-o*rn-sUfM}f#6gGmwXkxO5nGpRLHYU1x`SiOX*g= z<_WAdpihI6mODtRWd8(ve5IuKaGuanoH}$Ab@YlVLK*V-S4=+fx3)TWBhb(r9}wrQVTWqj1&qtU=uB z1vc^hC+iUAQdB2RjeMfT>`86y#T!$CHdKoOZLQY`*^EZ$TN@k^$(}sUju;uyt4X}~ zHn=(tJ17`FeC1D9O>!JkKMXyP5MPG84LJew?c3vJC3G_(&)<*r10>GwV&MOHALda= z8gc>T?{4(WI<-JHzh)iGH*iQ-zO(y5ShK!uadU~wkDQgxC&n|d)2 z3wSFNZd#~ImL$%|deY*=RF>lWaSN$8pUPuVLo@$OTqpCZe`uYfc`)s28k9+Ak5ss- z?sH-Yds4VD#4iTYU$Lt?@fiU3LFk-AZ6vGEg?lpUf(jEC&GMMaREj*8nZI(C3w7CC z{6?Il9{O@Zk@~!Yt8=>Vg~nlebqgtM-tc%){X(mk9>*l%b)LTYq%KTives)?T|Y3= zFA9QVle%o8SlzUAT?4+^m#_R;!gH^BWe`>Gzhp}!N`ib3)s=`uZ3*5@7h=vb>@N=Y z17j6g2wgp7J){GYgY1Od3E2Y~gggrwg1iTLA94_K2r_<2i71CmflPzUgj7QkkOs(l zNCzYb*$LSN*#p@Jc?I%1^h6QA!w-iLe$8ISg%tz3Ol{C{%&PZOSpJFS^4zPq{*@l7eZcZMG) zV4IEo?qoVc@y`gaosIwx@t+87P21BMk1mPnt}-xxTt`J(bUk z^Gb1vfzs5JcD8qA^C{w3Qrg+sgCOerJzVRE_?DNW~-g+d?2myhob>ac!1 zmZR-C#;>G!H*QD6W?+0Sn@{iXdQzLP{>h2m;eKjIs$JX{?sFj?8Xpu>{CqqYQ~V$P z+?=Gg{D9(^H9s1US+*nFP38EP@pMm8h(q+L8gMUp<4KNhrYyu$97kcXJ;QNXuYDZP=cx0)K=F=Vw)rx}(a>c70>v|u^s5xlZS2_s z{0}MK)6N;ZPVs{L1HDqtLGW0)&9VwzSP zm7=snmqnv^D>o z1|bi%VeaTC(huZRNXT|v2ho*?6dK&=sPRR2&K!#8*E}`)H`aGOcMgN2-lEH}X|5y}BXVQfn zc+_a=>&q9id6B4(*c9m8nP|`m6@}V)aJ5E|S8h|bkfk9L|qR&hdJz67^OfZ3>~f32{A;Ap`jgki^GTnc3!H zAoR+<@c4Qj$bJL)8X-pR-vKgUAP0a98p!_wav(swu4KO874ky?LfQWeHqMFB+&=`e z-$3wlL2*zaNQ~`tAUT7l0!W*I%mY$&QnaQ^fixRPE0BHz*#e~egJjAU6RSFp%9q1`XtMK=vERb3ld+ zTCWd)R9&bMtR#E9Olo_1l}4xy4^b)uIR*#KfPs7*$N>X614!F!&BM&Nz!(Y;Vm==> z&DGk5ka<7`4Wy2k4WtzaeoPn{2_BIB268Qsf%#FJPXfugQRH4ARToE*r-9&yo)PA+ z0U5$q!{Mm=KBc-eiu@SJFxrR`;{)5@Ai964w2{amLY75Sm0|uaUl~O{0ptK?<8bs| zNC;-*F!!ZEnlaOcHdg>iV5SXix+s-_TnA(b^J-{wEAg~Oc^(BaU?4988B_=k8f@PI zl31sC=nR9mYF9a!JHopE1#Fzlv<;>D8IU#u`4C9%s;JF`qhNzYM_8}ZfH>DgZ7Rve zK$Zd-G>~Q>RYrL>0O?OfnX_br3Wa694#+@fG_MDM;ODno9$EJ<0%7>ORI4bJLgW~`49IYAG*uEv z+qP(`tw5T0M3L)(4BQ???gCQ2JBmC^$bC`dIUtUKd>hE1(aY}wIbe*RVIV_`qdflz zWdD*VGT|8XjyiT^%bx}Wj|fCs^?b6a(TK-CA4qK-tknqY#Uj}BS4WXXAVV9XhzF$H z7>5NQ0(Wl09=wYXgXeJ|j)A-gWN1z_)f+&{4djPF4j8lF&wvaYE%p(Rs##Ho&gL?&p8&}j$cI1< zo)AqnVIsz%(S|1hIk+uqGYv?&aTLq}GF%?DsRc4*Ak9Dqj1ne+c! zI>9KLK-uB$=SED{;xe9F=&j!Pi4FmxJ3w@qn-x-8g6=Nbbea26Qd#CA1MKQDQ-Nif zZ5u)+m0|R9UQX;C23;O$L-ksZRA%*$RC#n>!@BOGGELX8)8<#tB`pOsJnqw zV{u_3H63UiWuxwj*vvC6=6Z{{-eO*FF(0(bT(Fo2Eam}=xf)GtmKl%7VBUz-eg2ac z^N__nWHG;GF_&A+`z+?yE#}uP<{w$ij%F^w5`jyP549b!(W1u2smOv`jPFoUONE;r zEi-k0jcijrQ`dB4o0{>ueM-z3f^yWOw@TMtkJb4Hbt;X_o21L5k?Ki0ca7BS!(q$y z3YZfX^N_{-UNKMgdnlXYku6qps>R%FG51@{doAX@7V~;*B(zz~35$7y#f*haQJMFI zEvAm;oW(q7F~4dtziKhRZk4&;Vt&?Qe$!%p(_$XBmu zJi}tf7o{do^-_zu-eTTwF|W6n3l?+1Vm@dw4_VC37IT-yjBiBDTGYH}F(0s)_gc)a zSj?|j%&%BIIBYTBX)*7!nD<%CJ1ype7V~=+^RF!CUs=pu*3pf}D~rw`yDa7>E#@aJ zX1YIygme~G$6&d|yxC&D#bUn2VxD3#JDU0Ta0WSX3}=uTdW?;HcBr1AYdW$`&4;>o zO0Xy`+H|W{{T}OHK8Cta8$;cvjiK)EkD=~~-(%e;jiK(&80zkfq3-XFq3+GP?s^R{ z{{!o2I!2dA+f*N;bJs}CUY%EPoVHoa?^?_Ui+QRKTE{8foit~FoW;D;V%}ph@3EL0 ztQnx+V*Z82Jl<-J@x^)7(D!;~nFlQ9_bq0+uu`eys;Qc$Py?yC#bO?`n1?OqL&ZGR zhpg7vVKMKwn15w4pJ;$Tl@^>NYIFjg_KJpWhR@?s~?a-)6PyPMw#wsorU|>UgVFn=R)37V}#c^IH}( zeRGC{k(FMX#XQYoPFTzdi+Q1L=iuCwvzS{g=A6ZxvzXtvnENf}mn`N37V`m%`9rHU z1}x@VEapLrdC+3+u$Tue<}QnQm&LrxVy16-kucJO`z_`-E#~(v=Jze;Dm}u39vrfm zKeU+3!`@Nn)AHiHYW7>q2Q20ei@Cp;r@G%NbGg+T!xnSSV!qR2zSCl!88Aa7K7oV& zATy7CH&xo8cS@R($ElPw*nYeFW5)#PbtIT=u-HN-G!kUX&u_45y4kAfW~6{wn5t$d z>_K&|Y_^yeTFmP$=JgiyofdPO#k|L2e#v5f$zt9Y^p0+goW*><#k}8Q-fuDQv6%ZU z<^hZOS&R8ui+PvDJYX?bTg)_$0EYcl-E1-Etacu>m={>gtrl~u#k@0MhDuc7D3HwY zM*-Q?!sY#lQ`HdI1lGq)pEQ)2B#d7LqnN80@7m*)nQr)mu4kv9MN<+%st zNsOU9(&j(6JbG+2b9st~J3s}7mf*}S^AJT>KEnbq%v??Nj1E7Q*8mK2T7aNDdNbqIMn3!CA90Y6U& z^U`DlAUcF$nGOM~TIDFmbJ9_+-9BWn_d;bOX!Y@~fj+A)|bxrjMuU=SeQ+;Z& z&Ad}}-F2$@hk`Lrc?@E1(RX|BB#U|kDaUsh=&a|_!$I^=(EW5KB80XtBh_G9jx~w= z0EoV7lgM8J(RX_!^0z?lS0&`9W_sH3m`_`nmwJGxT(3?!uU{h-Z8UBrPuU~}cuyjy z0okEO9hl{VRzj|yb(znDja~z&-0@J7ytBkL#cwa$>2ahWcY2(PsGOjLl<&ph*%Q=) zkQG4Wy)T_tD-Z`oqa#k1upJ0(NT`q=APKd$kv4ZxDpWJ9=^h{t;((@OTJ;5DIioM0 zCgyTH%Z8^LB+oYpL0^T)kAVfQsyK}N(XYnn%_+^Fddu+e7+*@N^5*r3rnyJ7Poc*48}fxK!U z&jO(Mb$A{yjYqY|2PLFjk3CL^y+&TA14$S*6+mc%8MUE$gs?fti*y&kX2{^F2hwct ztTlKjRXY&<`vlqVSs>4ZBh#bjDCr5!=otGHY+g6=x?3^Japn$1MW{ z#^Udhs@32rnT(NXjOTJfj8>frM6Q~srnFT8F-J=SkX(?88v}MuPzz5zYMKZ}3-Mfm zRQ)KAtOX&RK;AV-)e{o)TboxM$JGIy&uo(>M<+XRDHui4fIg|Q9 z_Qg}M$pt)=>O~+ljfSoI79;xTChcDVq4h{;^8t`w89e_F$Swmp`r|?r4CEvr`kP`| zo^ybFVA#wCvfe=GDXumHX#}!As4123Dj+mkWKBJOTriz^6B?MQx^IC^!r-|Mi2jB} zmghDg9fr+gKxhL99?W&@z@W|OoiD+LX07mOdJ9OifxHJ~$SCvQ0C~x<`Bxx!8pzQn z$ehELKNARTAyNh8puv0zkXHg88Z9(5`;F1k0GlE3gza+;kTxK)4G|GtKu*M`9(8gl zlL%)d=?*~*1PGh3?Lm) zhW%axgm%MLT|x*pBvj*YEs&w0UZlGk$gsh@1;~2_avhLzsorb2TpnHQzN?1PVvy-9dNbbWwQJx5T4pSemGQX=#gnJncu<=_27x)CGaa`FjdY0{1-sJ)(Swopg!V&Mm8r7L74hLb9mZiZwg6(9Y-rAk2P(GGX~q@a+-#qx3xEmC%1wnr( zoSGkPoxTo5<~ZlaF$s32d-#b`;U#nQqLv^fFD!yR>1Deso9u|RuWSb|gT8{dFmAxj zaEQsfk+Sk@V9+=o`{brc4zD_*eVjs3gVeTkwl|NQxLsvN9q{}VxbxOj^njYmUAIa$ zXBVd<9hMQE$lEu2c$p8qPe!$BCQn{o%u&L*lK1QgPPLPz$xE6-*38|DIDigJ;pf+E zG^!*$lTV&$n2rECK!P1OOpEMcvcho?DCP0PyYTU8G7%6k(T>R^PtuZ#w9$R|MaMn{ zYZl{{+128buL(SMDFXu>DzL!-B0rfj&UZs3$^%BCYA(dnrWkK>kn>|)aumUNiI9(V z$$jd7R+B$u6_vb<@?pjv0s}KRV@zi-NaS09WMbvI&IDyza$A$^K?kZ_c+VrhKMGRE zleX@qxrJ?0UFq(021C)qsy;tQq1R^N=_jlO?*^4Hlfc<(65m9fW#Ejc%7W8Nc66XyrDIKMI6ektyU-qcMv_yI zY`MURFS;3eTyDUrZ#tjenC?o$p-@19iE$HLC&Bx1h^c%O%G11bRRnK@(lc-+8jEpc zhSrs!=?LB^F(&Xzs-9s;^cvI+gps_Z6s zv-7m;IF+Hyg_i|vMXYE^oRG8urA@;TI%Pwi4Jep&o zL0|GJLKRqcg58f)W$7GGjjo`n(NpxEFxihmAHok7BjoX3#)!f0V>!Ob`8F=L=^*RM zX1CB%M^2HUgMN*$|1R^iASW_TpqiKC+Rc@u!XY46C6d^9eT8a8d80#?HW(ThRotGa z2s{weS)F(3)F>@wOtMm(imV8^G+tplPDI>Ia-W{Zi|*?NloVV_c>Fn>G2pt6Zgxs1 zX1I`SS=ZRQVl`fnxVCQH(k8sev7u>+*MN64;!cCImeZX~8M-c0N*o<@a|2A#3T{Nl zdh{(Svci&@xxA&VO)VjHrWHbn69Pove~C_fi%P3BQw z2gvN;jGxy3s>RgnADKh8nEKLBO{w(u%g|Qd{t7CDFVW=b7~LxGPm@Eyu!fWk7HH_S zEY2X2-b!~Tu>#qc%*&4DjQN@!-48Fa)Tx*;H)SwY$U(st+UX&k9dO>jRjba+7{x*F z$jMz_+~Fc3I2r>#kfSv%h821r{``0Wgsk{zGMYf${qwvf#(~A9)h-b|?pY&QP(nF= zR9Cd?k;jvFczK{_MpbK+31yMvy}fwEsIM(`yU6=8xM8e3X9hjTw9jXaHPOuGuYPcH3p-tXY2smFi>psLAF-J(5so4Hrd1P4SDz>#oxfwcoNs=I zrB=n3qd}dp<Nw zI2uMdeW(nA;Y%xLxhj#Gpr_=aE@k?~1vuSB*Hcdl>l|EB$zk4=-na#BWm8>q=Xgnga>@%kDw@00*`?x^3_O&o)}tbY zlN=p70kNR)%Ak2a9kj%*#(yu{B?&{TrMgJ&Hb{m Rw7*w%Hp9|OYt)y#{{i>HgmVA@ diff --git a/config/scripts/config/mconf.exe b/config/scripts/config/mconf.exe deleted file mode 100755 index cb7ff192a8c975b01fa24084c87a38196aab270e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 138973 zcmeFa4Rlo1x&J?t3@}3Q1PwK6)Ul45Xsn4wFOi_(ovWzSSFBj|S}UzoxjIqQfW$MS zoF0Sps(rIoBW<-Wx7w?v15^kE6VTd5d_%dd)M|UCqb)_n2%7vq-@VV|1+f2nfB&`q zYyH>yvov$g-p_vC_OqY;>}T(D&e>mB7AcNIA~F8&>x)FP{OVt$`TNiRET($@BUbGn zd1}AskIY7AK7Zr|bH8$9V*U-+UvtBiUrStd<#pFxpGy4O)rlLLu1kF7y2O-o&rf{q z`Y&DmxzVFXCPUP-rbZ$&qr)QSxXY(Rz88)BU|1xwEi$5bRJ3SZE>9SYwF9HsyNzyA+w;6m?h_no-= z*7ml@6B8qu_EhvYuPy9#el@lC==SY>eP8ybnw!yQ;3RbO+Shu!V##GkH%5Z!JCVqy zj%7pt)wVBB{9;n1V_EA{$4D*iI~86kS>~UjQg2SObamnv6C+-8vK%zB`{1;9BM~q5 zWSan1%E~|X8{FFV_kIdMf?HGJ*SWzM0ZxnC`jNCBLB&GfW_|$n@mVYXRQ_1Nhp(cRsyYyLJ3w5@F#4Z>Jx7Pzn!Q{+yPD5|o|{ z9vmo`tov5(ZR6%=!me~T#4qjecDDZdSeS`i=sk1sMG%?eU68Ey%96nYcN!K;eC|<& zS1k$R*>#OZXR%-u_5Kv<=2vERdfS_vTr*z8KQ*({Nnfk0X(d?Q-_>aCi!@sOhFUf! zg(>)LMgSFlqx4>4uDFR~M+HK`PYp;ZI8JlNjd0SBgOjE!-xHdd$yl%}O~E|+XY4-UsW`b`U|Lkoq90W_W848ExQ{#CqiUT!ITAufEt5<9##pAkX;}6U+ajJls?d~X z9?f!1uxY!fvUV#r+SxQJKMQ+NN2E@27sZD+y`SFNbR~3FpQy&D_{nJSvH+f1@J* zP|Jc?_kj~5PG$-!$<61FT2C&tt}pOlEUZp^?EDdI4OZ+}!3-uD8${CfWb0b>r~6I= z##OhL;Typ*)p(sqT8)U~C{7CZs-H(9>2@c5hm3PkiT}k?x;edsyWqs#u-1?aK12=b zU4MG=u~H{f1+wv{Y{!2(=~wCbzF`rD++zv<^0L%^?(QNd{V=6&bFwn(q}z+_Wl`!@ z=*Mtf=ObwFeu#Re1i@4&zgXq-RNm3{1jwtlw9bxsTR!Yw*K@>?9XqEV9d|MtA-#5v zG*yRv$RL`NrE3!sjse4s87m;WOvsJ^S?)Lu5KH-L72Zl==al48XS=(jsZz0fUwiMy z%B)Yplt6czH9IO}TsbPayG&Zn2$4GkTctxh_J6a}6CUJ^-u4Bfpg zUhH)_>18m(Kxwpn5j1^-8m-VxLZ1OW+9`qDE!-O}pEhcnmy9r26z z?Dwzo2IGDveW&)TzqZ6lZ$&8v``eh4dSh3+>5a?|DzK@FD00P-;|}CFxZT~>>9(hg z0Bs0B`CXFtXbFRg9<=6FVmP&Sf{hq~0rdsCtEaC|R*;FxWz0-gWHveJCOIqE)d0C< zz(l{H2AgO=W7BO=yXL)8w8M00XKpd&Ld^;8+cF;yxC%3DG5}VX!~G@ZyWS&TJpuM^I70NU34AEB6`g zp>WSixD{_grUSz=v(OUVNgukeNE+m6l`(ea@H-fPrqAnX8rD{d2?AG=dDjcLP1xIb zR@l{Evi#yyxr_zRKWz%(gcwUxR&Fjh3*+5=r=)h1<}O5|Zz92X1adc&bo9r&)u^G; z>q1*eyj>z#b(`U~+`qX5(JK6Dadiu>il`&jIwx7qblK?bAoeQ{zAw{2ic=TTrXlHd z1n=C=)$2h29d*kUFw26@&r9ea*rjFR14O+VqDZqVN_4dC%Lq zdfRDefXQB*Ah=^9Ox>!H)Nkr6=&^5l&EX=3OU!EFIm_XM?PxxDI}Eb{NC2QJA_qaWdSb(9&3S zQEMvM2>tTbNjv!|wY^BtZUQ2D69bTriG7^3qBZe+Xu`zc9nO-~l(;=nrn8paeOx>D zt>3Tvv8a=Igc}o}uM|ynrW$U(NDZCzaj3ehu>_dNs!INdm}1U4YiMU}(1{(DxA52f47|H%k{RRhD z91*haO*KZ3JD0+XwQ*gURl+n+v5x}X=^DE1IlJ9pN9y(&}JzQ!_32IgBv< zjquB!#Hr;8EXS_=4wzM2(A;Ua(7qzcv|5LaR>HDeL^Z5b27ma2sSAeRY9a?1i_~tW zHs-C*{!Ah~sPGAM|0PW1W+9K;n{v`qi|K{luQ{31DUl9>VO->D!urgyTx7A%NPd*y zGY4^R<{+~uS@}4)Vg=aUa(oI!0f(np@Lj5jA2V-;6~bdGT5Lsn6BTG_IOW+h`LimL zK$kSFZ4cfhF3CLxfCkIg!D+aARB_vXP}(}}DYvK6x$91@`;wU-U_I!3!r}>1dBjOy zXHlCDnDk%Pp1)wrhKbxUBDY#yXUQ#s9IQ}E;;+;cmuCNkJL*faqwGaI+c?g)2+o;k zhgAA{q*|1opkdXtCifxy4dLU@6ch~M%pY1lHrq1sv8sVTD3p#`)va#YX+srCBP*}K zAw6xFnTN57nbn4o6vn3LQR{}z#*mNQR1ffRJtX|GW)dX$I4U%7R%{EB8vWj^WNs!P zJEtZ~QzPAlWklxF5d_m}@F#^q=dWW(`erXYkcqb7Bp;CjvorD>Hk z)2vqS&$YqAvegl&xjn=3KUnoJG_n<-4{k}?N@7v5n85oVfQAX*=)z6b;u ze(;6=WH@{Pls^YeG1lreU^`i;`g2RY!!$hvU;aDZ=#TFLb3Sn)+>A?AcxB1poHjAj zbSphD&M)%TLw_8O;H}zras`BuS>vFY0gSt*q%5mp!$oO!n!PB=I`#rHt+Nt%+nsc; z3eoLC!9fY$3RJ4@g6<1_nh;^Swt%!LnHB3V!?Ej&GKx1 zO*2Mjm9^q=T3wlm+HW+*b@ES9`yx7G52}b6$vsi9gIrI6t{*eWDEJbh+|ok%kU8+T z=YBdrlf+M|gauEzLdMUAd<7%9ld?3AjHWOQgu?iMcq!YC382@waj8-;x)htiLtBj7 zHX&Xy=oLrhM-NFT5)?8Sl-lMOn6B?{K8q%ePWs27a()HSa>Wd~I$*itJrm`*JqIir zg-_t#-F5EmR|jWJhwz^vj2>5>K+{!X#SBQz8~8oAn=yr+ZhIBTUt37Z7Eq?@Y_;GA zixb=oWI?9eXy67h!%OR=-G&na$wGXXEvL1q%+mLf+^ReJq^|C}pE5R!;pxEdG8V~K?P;Ar3tD|8D1>Xdo znk$lxfDnPx-!twqhMFxtq%LBB&!}C+F8%O4EWp9C`UQw*mS)UA3LeVhK;`4TKE$_}dE$MaqcOi;uhZzuGHCaW1( z0%tV=7zJ&IEiPigEvHB*uVcZB!Qr$av2jG$Dp>TOA(otq1UEp#zwG1M_DvmBFQX`* zU&i`@^_-S+wF>vjeWEoMb#<&$D?+0phE(E0CpJKO&IpEX-#k#8C-s}RP6`=}xI?q8!$;a>T&g5d94 zv`%IO?2s8Li>`cIf-~|53!W>Yda(a-->GJ>R+zY%}#HxdxN_w?X zJxp0CE8aM;G0pzFyD^KI$x_De(i0g!Z6Ax1$)&-6sABO`GPiKe-cAYEtE92)Uv0OT z>|k)GYCzhW`kc~R2Js`5jh~k+TX>)}OD~j0*K<`iqket!Ep1yuD%FO{1_&3Ze1Vc+ z>|Vu_Rosh*@fQzeAmF=dfQL|B-=HLzxmWS6Dn4beVzmzr->X>db8Q3D zblBgpSA)WnFq?DiUxt&=}!{c0~L^tfZUE^R8g|}Bf-gHShWX@7A_`)tuf6lN_tdnZ=EtJ3Q#Qr(t)8Gf3R^AKn* z_~uphfPAjEe%)V>h;}nROJC>#en#7`fs@Xvwug15dYtziXE7SFz{iRH z^F7Q$qO5+_aFCFjt=;J%!%CGfK8-7qS|HvCY`Jx^6-lOcP3592s&0Fc2neaYED1i- z2#UirIp>do=mJ0XU%sN!;Cc1gSXH>~vHJBl6?xsubvJE%Dw%42$ses7gIO{`cz!68 zfl?br;Bw8(%?V>C4uf`161<@UT$-M|rNkyIHW7tjuH15al zg&BVg7!tvmtY6f!xs%)ZmN^L5gfcaPAcdH*Xg8R(z;)Zz15#p=u@a}WE_jB87(^L* zRK=*8=Rp97-~pD&lqWm}!x@{bA$XYn$y^7A^Ji#0Eq&7snEZ~7%y;nRJ+p9wJam6mP-}4p1sX4^2tj^c1{@)ElL%;L85+LYUDI`eay(V zMSq>|wYPjyjQ#azLYHEGEuR#bqIUO_SC5E~-Ge-PPY)SBpO%sK`x7eu#n&_#oin@X9yA9G4rYFV33N9mj3#TAzUeAko}vbRc;sgRI}g9=oJ@0r=mNE?VQ$?O10Xaeh5T; z>Rjy#haDZ=;$P76F(q|&H7DV1m&g1mEgvImDE*Zrn*lR@{!20OzZ&j^p`IIt@a`uI zoOB#!oV!Pe@yy36WUt|_9uww!yEbXfWpeUXxVt7dv9+ zbxtYnjpTlW?|b@CdN{XR`BJ)OErLf3cQtUg!1hq>CaUU;ZSJ#s*8gK4eEz;;fX{Wh z4*7hB>)Z}h&$u6#GiRVsul&QGA&s>(bJXHrVM8>Lr3M}p!j-t0O-~lWZ#j!bgTQi>|?36kUcEMvD z;CH#sA0WLLjtDAaPfqhDm6*{JP-eP+!+K*emFj{XYpmmPFEf|e;j#+R%?PxU>mDOe zBSfQ6x@QEogd;HjNbm`0gFyHiOV)f2`D|DiZsN$XX{kSr<^6Ijfos`W@TeMKb!)VQ zB+QmZE1^&s&HD}ChD;sn?)%!E742T^yLL^EuLPSG!3l}*w!~o;Gz)U6oM=&2s_raH zGAsr!N`r3!om+#clTYy8E@Tw^(ev@o-qr8;3*)U5k8rnb56+QEFyPr3I@JBsc7?7U zR{SWuw+Xm2RvgLJAdY5b)f{#j4W@42BMqT}P?roEA*zAI2ZCz9ah=-hNZLgI>=F#_3vKTxj-FQPj};D|OqfMOz%N8yG-ynf z`4?_?*2E43h1d<+C|zdwXiE53ztej4`(}MAVw+uErZvf%$6CG>*9yRzPPi`~$<2jzWP@!d6 zw1>H~+__tEegA6zbU=o#-{(;h9J^QXg(@!Ht61%WkJj#qMD6KS4STI<$MIXrZ(ZR) zz(Lf9VcWp^-(VTC{-*?KZF*yZq$QL9O)Pj+HU9+vuc$BJHwiQH0p}b18&EJf4VD&4 zf`+|{zpCP+_bOKVVE?^})joFzLoKBD>G=Se30+hf?FjP$+rxZ-*{q@O@BphO+D=uE zm7CFs27}or!88Da@&O1?+B*4TeoC@4Y@1k6GYGE83-bojSZVfLU|Q>LLTNU|FwBB7 z!$XJUMCu813@TW-22#x?K-eo|a3poh$QRVUYsSD#{Ly@n*Acfjo6NxsGlv>y54)_` zsjW1t_DZ{IPnl(+UA40+$Mcki%M&1{m=$}~mj2Z`_@_|b2#;#g7>JF)2dyk zPvRnZ3%V<`99Xp*qPSwabPwu4uXX!>|5}4%&vpB7YO#lT?%#^s-pHa#@4dqLnBb?T zfw5D&5=x5Z%aooqbp3AEz-7s!BYj4^SkMhnaII;-=c@jGN|oD{Kc>Hf41HO@-Eq&| z&tzY38?vgW{%Y!_PFD0om-9v$FmwS3@!hC>=vuv+aye%jTR(+b;~ufudmJahP6k0k zrdNfac)A$AOw?nfvXd$^oL2SoOn%fJl+Y|xmJD94rkSiF#j0Z-Ml~}zrD{9a8(H1E z?+%Bie9k=Y1T*6?bgF{EW;JdG5F9g!MrkPXdpX&3g|c9hAO%&8_$t?5N?@AW*qXl959r`HhIZ5q!)!yB!cY~j~@!(#r7`oGKRQ(Bb=6HHMbuM6P2xH@$m$Fi}vRv*hsDxI7@4>v5+RwTq-#uIEa>@ ztlb(Mrh(9$tgOf9IISlSgCJ-4%K7CGJ^|yxbM{ydL(K?FJX+S`Pl_)dcN&Pt$7`^5>nv@Of;Y(T_K$zlAK0Ew7U^&RJSVdnjr_w{Q@sc zMMQc`l42hVkKqKCCWHWgjfo#V-Rr#l z&^Bc&IB8iEeXKY&`mw0DgA~O@3GWq8`qTdH*XW3#ozatN_YurVZ$M=dQ8|jd&*L_At=l`-N&m+PtzlnffV#a2C;dJb z&OPQlb}#vh&X~$aI+-Lbki{&+X8g)@>J09iqbLL&*7&h+gi&;83c&#y`%E7>t&ahj z!Ht$X&C(%ZcYpUXkqzozIwux(Yl0+1zp$<(Yc~hf(k!nc=Q>NxgA!zPmD_NZd?+%Y zZjIF&DrGHp)o*P`<9;xqki^qk@!OzNNkgrojg2e_ZA4o;W=4hi8D3~7Ta+9LS1Wh3 z>j*j1$J@Aed&%dF&?;2k21`7Y!h%ZrFccHq4a(;X^jv>->G-g}(mzD|wzD{`gLoz; zLf~APqFWIEA1by>D}Cl}CNomMt&45nDl=Z$8XLo4U*O!WgZie&nv<1{=hksbW8ffY!ObyD#F_?Y(Z%es1rL zPG$yop@}|yLpWIkE`!`m4oBjDArVdv=mHAypp0rNf(H45a4gh3$u$CT-yCI3LIJ(u z8dim_!94cE*(35N&OOH(mvdqk{}XZ2e>G)Ql$jGu#uvRpS#5jncS^T_uIdG5?`r;^ zkvkNPxxM6lUMiBi`nHkl#9XZ@zQsv@PUGXw{-o12U}))$VdhTyR$BBa%eZ7IR|r<; z_7sIlCv9I2O*%1vM-C(fa|er+LguGUrW{k|M@k_@5d2-n42sSv<9j3C8@W4}m)zc~ zNxG2u$^Df-%kbvb1Q(toRV@R&`Dv}dTVn^CaS^-A?gZR>oK>c`o*G}J&YH4PGjr^m zQW}kt!(N}L-;o-j2%)n1S7vg^yvCWW!Vq{~XU?DzPDl3nH1*Be0zDaa><&xssD654 z>7UYc(l>zG(tSMlWv=^kXDBCuPJ*cnG?BbqJ#@q?t@Y2N2Ht zdpm%3Os_CG6mw+mtkl5}nUQI~{V~=~m|DbnsJ)7Db5_$|kRoB@dyh{1~^7cO%s+u}x)e>T-7xlrT!oPMDMKfPJ_3mfRZ{qB)wv zaL#S!rf?{Xwn!a61iC3Vt-iPUt=37=<-+Q2C?)gKVM*jy6?9l))o=dB+n#_C zS;nOZ>-O->mXqdj_DEYd<@FuT(nZ`1iG5jdVH}qCVDv^`D4H4e_Uz{Qml&G(F(wB(3ns>%Z36>>D?lbhzhg2u4tIB-(p9}v*nuo$a1cH9yTet~@cb1mJ7_0D21k=Q= zmON1*QW-f8u`HynwB-G)r1`y{GFq#!Rxa8 z#*($H$?WDV?#?E+;Epl680Qt-|M);Q^gA>No>J3?Y}1uT({x|Q2%n&7z9U#7*c(IG zBR>Upi(tR?;TE$$Jg8%I>^bb52tu09nM^nC-8tqdrt>-N{7$(yR^!5UdhOQ5r;Thn zHn$zZ-p)z3Bb^nICGIko4wI=&oiOk`$Kul%IH^l`VuE>V(F-lRBXL6M@nJJz`n_+E z+nU=)bQ&}q)6+oN6?MBg1gFalh0dvLP-=s?hb@{?UT`sH7ohc<5R&%raFLkzV5_h(@Os%=hoj_sm#!u;} zXMb+&fu8@EE|H05nL2baaDX+)(4|1os4wtn5d1(*@3Bo+9|gQk)@W=pT7?Dh%IUI) zA^u0XSS7VmWC=R4yfW`qTyi;CfkaTFa7hzz@J+~h>)ReiC-v)ZysEY05Y5Tf^LQkA z?}R$PD-&WAdcoBy!1Z26!`2IX>$`7YryWAdb4!vSDS(tY*i=FqqLj&@45E4#J~x}X z){64{13F*B^WNU87uD{><(9BLsrirgwe9u0mv2`WogGem;dx&G;@<1xItUVIr%gZ{ z1Cm|nGIZF^{p*!BWW|$NpBiRtescZp=5@%Pa5t1F(VZLf6Y_P+N5Ur0h~YI%Z&6{_FX?7lsks?QJ6!@Df3)l^vnh3) z^*6?xt6q$D7^|x4XpKG48e802mH`6;#?u%9&2I`tENI1l(^0PrB$ znRK?*HqR?i$jrKDO0pyP8Wq88_O}a%QCHW9z)-Wf08GJwbV|YE4x&M*cAbB^==_#< z<}kYapC#w>BR2eWGR0*l=|?jwy-bVcPpB(;$f7lk1S&?9Pnr;GS#2g`Ss{)l_^v>u z4R75993sI1@@jJvdT?x-Czd zuffDQKuOgfjDPVDGv}kWvu5z`GZoR!s^?zl<@g#Cn?1e; z9rPeHWUOWTB+6{^73wb@4qrIeu=OMIRm+Y(O7`|h?29K{%j?hUTS|Ek^=**2Y}#S(@uHaLc4X8=%m(S zS$s9mUp__(2(>w6Kvk3as>$lYy=w2JmX@Iss@8kmLyu{>VACzHES~W5WuIqITX4|8MBztK{>FJEdaX%7al67^zz)39ia!IIEx}UpvaP7ec zTX6ml4YhGRfXWFh?Vyct)?O@_ao9(L(GmusAX&M)>dzhN81y;O1UHeFW|x-2W>34UOXV-vHa%GT4v4%_snq8=a?keB!<1)Gl{jSx!s?H zh})BJ(!0z>4G(Klu6&Pq=>fq+zuP2+qq8qMMLzfO^^B~Y-8wW-femiw(Zdk(j0gr?=S`S9=XPC%TWOX z!Hz!-Dn`U=71F{QxxiLhuxe_GICL2=04)5iI-nIPNfXYm2x27BQs z==;5}xv>6r4^w&`dkv zzhSNF_A+=ri!x>`SHxye2a|QYWe+7jBqo%X4U_ir0l7O+%!J`l<#Jx&(z!>Q>Jwu8 zNquL+FqLPN?=ci7C`xzkxtROLL9|}w2#Ul7Z%skqlcAOS38YcQQLz-m`4mY#k)7&X|zh>N-qgnZc_F!i>@jjdQ?SZ>D(| z%zq_|O3XBsjcj4;(5G3sQ!WOU&lNN@W_vmfjrr}{Y~Nzc4K~{|3*dIOtLVe5KBIQk zh&F11c2X+2lcip>U69^^jLtpJ!PEq87&sXR5eororpU-^){8l1^xU3*bJA-~lVvn< zduBVCKUl{be1_F-zX$l&N4R-H3c*@`(^y)7^F>X!H>suyL<+(*c}?LatC$ZI#NX2N*f3q#$PzDHdw zJYvvk){wtY5lbf%dy3|uz_Y|2Fc2X)(2Qb3%vf;f0a(9@Itx#E0WVIs>A;u=bbA8%9K zcqt~N^Z)6nDZ9qTl)MX!x-+PQGxRZY?|||okSL%GA3#IISg=23iUs@q7PY}^4;U={ zNB)C=0u$evV*%Dfa`uZOBDB?`FUDNVVwL94mLN5Hx~9znx)mTZ zPV(0i|Ck7mZ8|Q_$^U`Z4lNFM5pMor%WgBte4gEd$_1Z?rOJWhs@k8KDHV9zu^2HL z=zRpj|E!pRtISvB%PH7T1i9w5DAgw7At_vW%j1@ZCnc)!bCWb4l--a*!-J(uDHDKo zaB^ZonEehEHdNQP8*D215hY?U|Godkc>lELmo(m&4Ib~0jW)f!ukrq^!Q*|gg$u{~ z2PjqH;-Kf3{tla;HstT6PWctytRY>QBS{T@Dme!&SNeyUr-WuEXQP}XV`5g-d)^ka zsx_yK%;1je5ed#8wbseD=Flm#S^uU`CZn%F@T;)YJZAsGpr0C6c>NCnG0y%1LJfIs zWQ9ZCV2uS&s|2CLgG9%B@9lA3BDmDFG2=gM<5AK-{--kj4TKs0A;dM5@J!}y^hR(g z)~J(0N3#Nc|{QcW-8{aZ4z^> z(~9U>sa!{bYUHP62kQ-i7j}W9j=FN&SGIp@!V^4&r;AFwZaMF`o>P+)3*>RY8Ai~7 zXGZkwKl13f%vljTd@@80lE-mu^>5ss&)0VjQ*A%SZw|q@ z@aHt>cfnafn&z`;F8*04Fl2PhW}JO$gW7oTZ?-l#gkQv~ISbh;@^x+>OWp*F9_OBM zxLLQ4Qy~gkT{ex2IJ!FO8TBzpfCa6!iVJhzw7qg?xa6YVT<0> z9J$>KcT2}bzeS=BtD;l2c~>2Mwq=)H8E6TQu+^sfsH$Y~Qb9L*JxkIDOL3idv`EoT zx*kZYJS`jQm;|b21onioF@qzKSjI1whv}N%=V3h;;HTZbbM1R|oO>>TLszd8>X!co zsOR2r1~U8FEq$71oTaB3L5Ar%^CKW_{3DgZjn+KQ(ueu00^Zq_214W13)YzNlfo_H z@GvN4aY{I!r$xMaUh;2Lj~g3SEi7CuKF^}1T|q591#}Ze7}{FI(y)3Img%G`be9Sh z#!E=1@_xtrfCGZ3b0C(`VX;bQ>8lii86pWoR!cbcPK|}fjT`+3VzX;qv+x8dzV#PU zx6FN&{6@MxRqU+j7NE>Ocq#;L{(WH-J%WmbofD;Smpc%8n!o#I=YBX4pxQKan=##8}lGTKH*&fo&F%xu~`q)g+>hw3{ zyMlMc6qq`v9LSR&KhwHHW5CJ0h3^4-`vgEFHOu9{M_f^@E}%b5@Ko)+xa96qsoCJv@b92c48Gv1 z|0uZgHPXK@1ZPktfSeZE!M}5ttAG~V)KuA_RH+wuC31S;Nxk&BZx~D9fdxc9$B3Mp z&X47yPQZ$k#tpK9JWY_Jnr?bdxQCcRzvufUP#T)I=W;)^_=5GUGFcu5S~(82f%`atKw ziBzA}^v-nQX@16p1eu-I(UKlZ4Rh8`i#0+_k61&RtNtVLPtjEQMYf5`+m>mrVBKd< zO>+^q4>L3O^rzqJ-T(*ga(hat4Pq5RSgQ(_jK{#b)og&!zC;7sIxQ$S3~`Mu$3dn_7MYfBD23` zaevGDEw{hcUpxnJBS45oM-|F~ivZ?5N5kC>WtV=jBls6?Yj@Uerkk9#ch->(Z2f{+ zByv~7o!e;w17~fAB>hMzcUO3?FWO9#*m=CkXPlbc5cS?$_b1*a=)IO2-a^!$hG_hDcN!GVq>~r$!=pI~|JO;SKfUn5h1nW*uUUWZN8NR?)@6OY zy}ciHAGyBe&BgpnNPeUH!eJUs630CV+kheCcI-~ z{l@0)P`yIL?@P|+C)!@MzW!OK^-ii6HzyOJ*qFEfl!3!wwEtS>q>lsydHQ2L##5QJ z|D1-54iU#Xc?$`HyNqo%;r7asRUZT&qpSLWH_qO300?MQK^D-yCA!$WB|0^M7u?k& zdhi0Ety9KD>w}xBxE~mHa}5b6-Hl)3CBHnuTOT<0te2P4dD%F^%!1$=c~2;mLs^C% zENdmY3=7RW5ko*#0uwY+UlF|~f>RA(`gx%0NC6-7unwJSqlNn4_^IgWe^1nu(eV`3>ovVRY1rX4e z0>kBtwo)Lj%{MV9o&V}?ewn#L4hu3USrJ@I-5@r?=b2E;IA1Az>k;Lo>`O%HFFb}4 z6y_1H%V@1VC&g%OKaiW6*8iAOJo~U#cOhi4cwjT>k+3ZIFS?J)(rA|uC~MgEltsXN z%S(J0mFstiKYhbD{#5X61Vq|?X5pPRBLEYj;AtTGtA)<=Crq_Yj}GR$X)xSgeE&c^ zh8WKRQqGx)rVNenWWX3bB~T7IMfCj+`+VTq9)n^|@2_mj>Pj8d_QYOHmRsVPOI0nv zPhqnA>qZz0XHZ{6i=pF{{xW9?%&T5`d z{Z{)ZiG@@RsHeCa6U&6$1Y}1+fatAp;R)XM{kAlHE7 z;-@Ii{{?&3iwqi^yX^}+&Ff=343UiD^I)j~eoVl}TmKi_W{R}F%|9AkXKuFX=DWd_ z{WtXEl>NGMR|v&f1Mop`y1Dt8;J1eHGnqrQ#OSHO92=xZ?#E#f35^YgpVA49q!lWu zD+_)N24*JN?p~)8BwyQo^fxhv;tCLzMSpM7HKg;*TOZ=VC=g`&79Hj7Hu-JLFc?P> zzej74Vmj;9B^n2BL8H8NYIHIaralU>&rE0qprX^-FwWw`4NQh>6TUn|r3eV$5CS)a z6>IjaxQqfwLUF~XQT)kW#_{*hU%XAmo_6t1FfU!0Vo!V?h&|MIIWAN8;Q0<-6V957 zaXY6RX3ng3B;>e=;eW)K4E{hP-4k3;^b?BQKlB9~Da8-(XHLLyptBRBJyr;cQ>HaI zlOAsHVG9>pihX~*=uKCpi<05zj@vK_=HoCq#+BDI*gta~47JBG*^>Nd?33phT-N_h zBPP|q-n@fWdwjs75MRoQX4)Kdn0qGYNA8)dGbuna7fM3tjTtjc&M98i5$31VZXdbl zFA-tW14DApHZBV%v-9snRjfAjKK@v6itfVPvpI|&XABsxVDcVfU`Pf!hMkoL4-qSi zK6~+GQOtS{JZ7PK0fqpIneJbUc&?A&-f=%**pMY2k`X?^8jv9O&Il(!wr588;|%!c z?U51gQsLmd@hcQq#+h!4?64>;gkUAGTnRV~$GMzhhRjpi8l0D$rODwK7&ZAF0(mnE zXP_euh(b#JF3>B#b|Sw+Q|gyd!s?@vck5sVmE_Y$85omK3ulaaO8WC@y(x?QAPLI8UNp=q`1mQ%-ujHz=sRL>~nhS!cny}>Dv6V$?e zK}im?!d)vXqw~z$&MG~^)8DHTf)Tg`$!Ax&+Mw%SfO+dUse<#weT5f0 z7S>zqRJ$ZP5r7X`C-!yhk?+~_o)e1COp0Xh{w_xXHmBlk^Lc3>Z=3G_9*sX*^>~U+ zsr|yrk{KNg}mrV{?6MdFUP-1MIMIW1(9)9mO>M`YnuM80F>3j2GolqZk zz10b>*7?!k`xfVivId;b%D)RID_!9PA8QliXpaSFuvtJV=LA0vqCoE~Y#~@do!vy0 zb(sPBB5ho=oU;>eNT2hZGSKcZR*96q)RiJl2r@JDz*jI4 zMf448S9j}G8KvGvWGq8Q^MRr;jPl2-1I;Kj=1@PWBDL8gmwi<~?n{Q^E`I>rZ>tQb z31J;H>s9_d_xZ1Dq7V5u`w%(}ngHap2rE6)4YA-P221{E^@#Cctv8w#YZg;53IY5a zVZ8PZ?(uzUYZUc5Loj^MW=qxf)EbSj?B@Yhj~E@m*AD^8FBhHFrXfT3zhnr6E2t>p zniKfB$0^!lJh7gIvO>t^|00# zyt=*-5PoX-F^?WBzk-aypayHzjQ(vCE|@Pjs$qc?-QGGo%2$&pzWoe;tRbjno9v*> z#`(X5x9BNq*rw{}cEc77(a~k#v0bcqm)WmPLde!1!t9Jhoc%RK4UOn}&(O$!7dN1M z3pm)$j;h7GEhsIf)TknfxNVFv2X!!D@OH+^5sD0pRRiz4Ldv#T{NdFm{=`!M^YP`| zFfl*sjh#=aH}+vHa``we@obNDQ#E+J8Jx?PJ&Vp{2}Wmw>%|}T-Xy+YXw^mP_<_;& zpOn*oMKld2a=q*#f3(!@pCa1l`-h2m{xD|+iH}WuimUxhJxMgNH8v^Q?yOzX&I`#W z*S~k;!On^U)0>;N0Ay-2LYV&p`nlBG_{G8eG# ziHA+b_-B>zR*xzKDs}lfR{mM5#rle6O>cF@6d?}8&i4+k7+BKf1v2 zH*`&s(MI@!mW+bGjnRldTHVq$sY05itZP!WV0iQ3qwz(tR)rg$eqeCw)pIM z@>1``0S^?+pzr;049Z}sI5^xNYw%916kdpjsOs)W?cX&mp~9|dNm1&WR<5651PHuw zQUj*i?~zP=E`J+SDZN-D*q_3R8SdwLHQ4d{0|4_KgO>W2RTZNN_gUnJ{n;L?oDPGjf1?cGJdFmJe7yKjkfT)#}1dA7;7M%FUxJwT0 znb*9(_fy7R%qJSt$Wgm9Ms5F^DMu@oJJ^cJ}yJ8=E>(=FXqt|;s^-dA3JqhT2 z&uVOTE`oassCjtcA0K;L=sd=hF*gmNK;yxu^(ApW3K;4zrTSS#?Bnq~;s*SV?Lkez7Bp7y^b zw;w{67o;?6#$XzoeSBH~js}YoBb-twIb^FZT8PYHPW6J$_;Brts*-*hHBLF8P2# z>PC7{w{2H|P)|W@!3GR=-Mp!ry0B(DH~aKp#|4Q3OHUh?v`~Siufz5pECr{^uZ&jz zh00wr#(U2Dt({Br(aFw=;?}ZFt!1BQ@4!rd%bFh zH}(mxm`|Ox>HQ-Aib$_5G3L=(%qu-b!tI&n+%*j^uIT@JME`Q=X5ueMm^mB^4O(tN zvRN@BsW(=tMfgmqs=lnM#`tn6A=fMStaVRcW61!n+(`fyigQPElijaCC;J&lx*P0f z`Jm#1D9-<7jo`B8eFCRQ|M{2OB$7N`n~@SFKEv{QQ0Q`~8vfj#ff=hd1;W`QRCC|c zLg}5Ln(Szm+~KSkrZLlcR^O6hZ)4T=<%Wdm0;@}B#h6fUQH#wpmB<)ugm|_DG`VpS z>u$|_FHx4OM-#zFPC^qg{fYC!COWn&gmwY_?p6$EFHIR9bMI>4nZ9FZX>0u}PV0|{ zq2vihV#4|S$Z3=7UvygURVk6_;)e45n%?oYyW4tN=g0GZ8iH4Z@m&89(UH6jBKMF? zaW5_YowLtvjm%@}*k*w!cs7A_?rYp;-xGq5gy4(Z`X?A>wp5w->sE&SW#@j;ht)d>51* zU_NsNjTzp0+l%2_pWOCIxxXo37_iLY>eeeI`#_n_8RX6$S{7GX{m?QU^UEDQv}~lx z#tbbRrLs?;yVh9x{@i*K#A_~~(3-zCI6PzixfjKua!5ISdB_X_UKESq9J3!?Fsi73 zik-t7(F?Ovh2QW^V_P@J2ukZW-gF(A7rK;#w3nB->x-gWTFXAuI=iU;m3-pNvsme1 zmJ`(01pQ_m%HEzI%hu0|-S7u*3n5>UFFRsH(Pvuu1|#Ho4}?Ffghy|Mc2+6*6}<*& zi*r{AL(W;j-pg5QCBc$W%*!=i=yUP3)~(tuv_2!(pt=0B5`3)GqC@z(QMwvXx%L}# z9}4bRUFpkFR{6@#gv#GS;Y!mZI&%|tatDR0OyMvU8h>YwkXy^q>uf?Lf2SX3=>X1j zKTaKZ3UTVmB#Tq$R6?9zpm4xXde2tvz*i1(k%g&dkfR*rMF+dGBq-l*IHFJ z|6?z&8#7+lT~J-rbW!e_BD*a1FD_|~9e{gW$|f~W5|-F~pO`=01S9{6y1nVTBf7e( zwWQLYpkZfw*+wah9mdT)@L=+Fd?x6_SEGN&v(LiW^4Vn?j^fHXJ zT`!e1J7-|V_7H)W_ponUCj}MNu{Iahz8&vw|N%-iq zN@N6I_;;cojd|V}_Mr6^@)XQXHta5IDTL0};~??orX&(;(n;S7CkAdU3fImey5fDU z)rC8YgWWocqknb#$jX@6t}$jGbm@0der%b7Emd|-!TZ~WHfWW0nd&s-@d+WOxaFFN zo%Eqtm$UR#SaAFJa_TC*_sOPJD-0sP>{op2Ji2kY`XjiKmwfmp0`%7TCSJ@vLyK&K zdZbL1CSMT}HdDRCu>)RPTFk$>77RO^Qj0hFkXG((Tm+dqBU4wSNrB|_YNPCZ0$D4N z9~Z(y|6qSssrzh^`(`f(6O4mhu3#v2TK^DSdcAsE7H9(fxa9@W8J;JJLz{@1u9qvB z#Jb1H!S7s0M<2Egjbsl;6}jaIWiZ<3SZMkv@TOF5795-Y-srDuqHSc`>7cY5EHe#iVq$z>!Jmoaf!f?Ahy0F7a-Q^U)JhH5y-Cn$;p*lTEUy zYqCjKbxl@^ghG?D@;LsoSpn@9Lq>_DFs+^KevpoSB~Mo85v|`WzsfTunN!PQw50XA zBF3T8P6>}QcxM*4nNhnrALl^jK}%u>PO9J0{C?+@lcT)tp$oM!pXZ=ZS}(Wvg{PP1n!$uP5PG5|qxvP;k4tz5sut#p9m&nznM5 zeS`LAj3Eua*OF)Oy=J_@_Zl~Y?(q|`^%ke8Z>t%K-@w~4Q_p(c zSTbIBisTDtfs$oxFr8exiQ;1Nz#0}s=pZzDIhio88ThC_#L%>!{0YNj<6lkw+zvaF zG6Qj#FKc;60ekjrwCX*@%VQazPw{#@6!|^Q^@jQ+Gx`3t;V!}9^ic?CAzC&FLt&e3 z@#!a~bVT-Cb<-K9QR;atTzfgCYYdqw>@Qp_df{=is;@zYYo^Gcl@?w{{(=7SQ8L8}haR0?w(>^KMNqoru-g_;7))5E4;+KnYLu5F{ zp$}4lp_i#O+%+9W7bNBC+ko9UIXR-~N+~|nkNLFsvmRR@H^{o4L9_W{bAWS5z1K7x8MmHFR=@`=GzJ7471ClYJlT@yhaxof!2b{qIx z^1lt!ANGA);eJty4Y|X*G2Q%Ff3miwO?Yx5LSRwjjF56Cau>nBe#MGLR2+&1d~lz~cxudwbz@a1iq9lT<`RBtDW$D&OaJyz88rLJiu z=qKWCjIuFrR?yzGn0Jb1C3qL-!T2{p(-D;EN4_K6(S+;EWWpb#BCdrcXoP>+5BImK zZX0#^H^Y);D*3HSy2B1I`%#7c3HhXDtdR<`oF1wr*m{k^6WF)0P^cGyPsBSG-f7vW z06$`;Q{&Z?(*wg#MD&tDEItUfef57hcsf8rvo$o!zQ7-21qVwk&bXM|j{Q=m25fc= zzyJ)K%BAItB3Sul29>p@Lu5^Yc{{`=Q&|8LGAZ7eUQDY0zY8$$0F!@RxK~P=)#F7V z-0cPT`@;R3t0@D=m%tHfw&o$q--1bw6WC5$+dxt7WQ>dbYLnkwte>4Kt6W|xsp8rT94R>Kh6hu#h!uz~r})h8oy6NUc8 zry%M9U6YMj+ZosP6ejvAIQFiw&l@xU7bZ`pJcmSs(s1Yl3 zilg;M+>iiJ&o-EO65s@lwBN~oS4HkI=?-zF$B%W*TAhI03#qU;EyMjc4XI47|yR3@sgZ& zIzbUsf<*Kc&Wgj+TbnLVZ{?-7M>s2n@39|k<_DbtG4sP8?flRh&JRbL^Sp)mVGM%N zr^AiQ9d3N&ALY1pM11k0Xr$=@XU&WKF8eRHmlRxf(;fNO`rYx4q30{HS5#p33W!M6 z4?5_;2ZYUGjak?=hlmt~^&70SB090*geAOy=Q#}9KgGVgcYW>Fol}NKW2w!Hckwm@ zo_l3hj4qjyGUsN5A^b%{to>Z@DcT6`zmk#H;Sbjw7-K8fpGN#2_Yr@@%_a0f&BGJz z`1XrwQo$W#Hx?ZJC7PKRW!DKoXxtV>e!Gc3LC1*B&;y{&|My_@`QLgwbx*ybk&rBR z>Rrg^f9~nEWM+Rpf0R|bKg#`R#LY*Tx#q=fk3G?pd~A5r36I57CH|!`w#(kIPSdJt z7JLS`;)>*&Rgr7Gf+1iRiH|@;GYj;-C3*#ruL3gAUj_QiMkRhR){q*_`&Ls6z((jo z|5;=&hx}W7U6z09+;JnEG_RPA@L_ECv=L1kS#P&|q%bYj-13n^uBKm#gRuk5jO4Pb zcm!>5`GV-09OovIzuV~3(ktl8(hK!v>7}l*w4BUrA?>F(-_mn3I)|hLNXzA7E5>)Z zi!pF%f08;~RbQqmr?`=nL(4A1Zn9;Um~k>1mAM&1>c-l-raL9daRzNX|EO+s9w}7v zNeV{_atUSbD3F}bq|5;WrWQNjqv0Dy@ul^fK8H_B4PWMMxx}2W;81H((~g$g;%eEH zvxvMc1>L+J_QQXIQj%D`JY??ZsQjwJ^H8im&BIN`->c6xd*k=3{Li#b`WV7DFLZas z_$(S4zd7mdDt6MZaoN9~AfHSl{A>R)33u19rksCKOy7-c+Qz_{AQtUI{1cX$OC^CO zbc^x!uHnT(hmPOe2CLIzUDIsu{wTC>J030+=hMtEM2pkSUEKeSSTi3t@8^f{gKBty z@+x5bi{iGo`1B=IT6S6Te>c~n?_?SP>l!ZW%4du{EsFUg80F4gpQVP8zJ)PE>dmlg zKeHYRp}esbEu+sB6CCh0#|f8VrX!58PB+Gy+uC1uBz5%e88KWkU-t7x6&hIM*Dnc*Kj$+e0Qi= zKEM2ks5Ht|&Mo+A2BYxswq$?~l%VU?GGzUpCZn07Yi_ ztg;TCin=kT8*rEksgrVRFQzs%tp3J$lYNC^el3nL{}9AtY;9R@aWg&3jB}7pc=Z$z z6(|Tc95H8G$gKu4|B}vMlrdfuC|U_*`aCzpLq>2POU=6JaE;UXNRl$kUc@)l%nfGWb`Oh((S3wt32wg;BS6YC_l0`t%ez6f2k41_L_cT+w^XWm7=pCxiXfrhO-yInL)kvdfC-(gMvHAFoPL|w?LD{~UMBkLR z5l{Bv5s27$nZ4|SXHCqt`kIfJn`_yGlYW%zP>@2r2{Ds=OQ7u}QMNhI3ZLV2t^R2q zcu;~lwN7B1dCmQ4D>lUWCL%fW+VQ8gFwmqM_Ni7c+?Fd5CZMnbD=4;Hde1oNWrKLT zhHJNPn2q%a5%={#$RK)yNNv1v87kKXu1!^bVRb8AqHg| zFMJW9ypF-~7`nMMCjH*m-nt-`)2sODAB{^5^kAWB;BCptFfEE?5(8SacVrJ zUp9Fk=_9z~b;>((pNNqG(fg~fqB<9`owk==rrEZiS6iH7m%TlQ+qF`rY$P{dZFef( zL}xrGTmNk8Ja^adn@{gc-aif_wf?~UsMwB&Q?>e$;#1WuhwRm7-H(RbtMbeyd*Nh3 zD?8Tj7|(Lz66~LRYQ_i!&PjsgIRC0 z0rURZxglB$0}pW52xn8^X@fxcK_q|M$lAIWbBkcI|J+ zPeQixT_#JD4GHtta+mBSLPIlN0>djqpXL66JXJeTlA5OVTzj@jPj0-lHZfj5Iqqa`<=UP} z>Nc^k8n9q!T0{51V$%vc3qNi(8JU6eZFtW+aCXr9oanjr;25X6J)URLTEXD){tZ0F7!UbuTxcO2uj z?I@L}3w~38(Ov#^*0+k+=MZjNTTqfpxOwh1^cRFm)GJt&w+j@1qDWTQO$X9Oaelcm zucwZonu%SUAEVwZhF7i+(e-dO84NxUFZ|ExYh(wP{!i%tNPA@={qO4fpV8My;4NAj z2d|isFp?fm)bjz<-$@`koFg|}@j>WP9=GQ`2Wg#Q(=t^e4H+*U(d-UC8vIZ_ZN$&B z)vnG)e`dxV^%D1}fD{Hn*Jhdx z&%FV&djFXMMG=r0x+oL)7VlqocaPw~y3Bef zLnb@oH$_^f4b=78x|CD9$?Yv>ZYy^(ive?Yv*g{ai{4`Y;uvo>!j}B0vD!`b`XFL? z(--|SOL*`NA~&Be3g&HfF6h!aQ)WuEp=U}iER>kwQ!w*Y@=;OK0q$;azhdf%Nx#Ge z^sl??yW{`+(0K$hMB#%X0Zjz*-i@rE4d188;@i z3Muod5mc_gI!JY+a!BWzWqF)YQ7}?wQUWM*9m?D#h4Cc%IvgCj(grcSmPt*sAoCiX zCI2f;Nl#`RoG75im|6Hr;LPuVYPmgR=6!B**8$@84s$ZkscNCgZ#bDQZlJSI$$kv0 z?rvIWp$js3%G72qmdRy4W{@qj$V|yM4e(u*5 z%VnV=b$gfq@WVnOP0a~Y0n-NvIcYJ(D{b`hC4>Jsi{C#xzH?$y2EzT$MqQP1Rlm;3 zH1WGi0_66Ws;0*MbL08Vp&FVV$jzdjJCSrUDL_oVJa@V+?l#4Glc+5|))ot&lc`m) z8siI6##MRKX#+#;Ly1Nl`NMv7QJbr{w1nek!)IO(&{L|#uX?sFaVBHN?x zC$XlxS)4W9RalWb>DiD74MKxua2bwb`^Td+Y~ORDF{vS98fn7P$EaQU zETacEpYDe5f=|H`YVf{=rF-u9=S{N`Gronx#R@WJbaf$`Q9x!i4CNC1=`Yc0!CIpX zonp~&GOzR(E2q}48hxhDn)EhXY@zSzFW$tJ*>BLtJIGNJAQ0#ze8(SC|9Yx=U_Gb6 zu!$E2#=KpgnJ1rWd{9)YR(`&%x4KD4&bpGeEdyg+}+XC zVG8puckS*ebB?!*7=pLd;fJD4e_{e7fUtqW&py^*;YiMAd*2X%)J(W1aaEY${tOr1 z2s`H$0ZpE(Fowwgiv0oQkM;V4QVzIW!;>k56ZwPM^ux@2 zj>kcldI-Z{sfQO|t_nYDwhLc3A>?}0f-p~^(1ClPeV+d!6<{zK^zBXm7dv5|?RdN1}PZlsHksxBFHR=Hq z2+FF6a1D@!ut*?bQ(Pc~|f5p93 z+q$;*8ntdkY^~@0exEt#E+;2oE5FbG^Zwu7$>hw;GxN+d&pb2p%*;76!4p^m@3RK> zMxG&`5pQDnd#r+g246=NbUcv`&^-h-sg9>IdLG0`8tjM7jzE=gw@h|M{|K!Nnk~Qj z5p`R$Fsy;Q|6(&~CtP@!Fo4q!Q-d#B?25EJ3r3W21E1m)siwDo&jZ-3I;Ao_c?^6*4B-1k;bX8eI9juJ^-1Bh$tm~*k3w_` z>)~Dy1w~h;4!6;L5XVc0Rz%^Vf_f|J1KQg$JrC=Uw20i;IH2dj}m+8W;XS z_MVye9D6)E?`*l656nw?1K}l16eG8nq36Q8uGlsmfi=FypURr|);BnR<+=m3MI?*- zZH66f^&g0EOMi4vdX~RPuY!SBeDx zok*>ItuTZdqAm=zMqQY*nRr<&@jxcdL1N-UNtj>ca!SRKQInGel*6^i)x`51mIH5H zirl3~PT!8L=|%@Lp{!P9dq+Kcsm)KNUL0mG8P1#5gZip^PTep{Li+SiB_V{Y(A zbjJ`DbQ!1V{z~4cIaT&b1G9BOKfoS%TJSGu&h8X;lEOdI(#c~qopR2KQzmjk3@oz=Pq#vkr`P7` zDbqFB_8$+wY*pIxshfM=?6WA>GJ`vdNlrHV6|}X;`;R7P@EYnumYa#?VYYZ@Yq74h`xAW~GSueBX0gEDFNCAcJS!BdF3&~(isqkiD2>VA& zjJNOj=31!Kh;(g5p-b~nRYSrv3O1fr(37e0g`SXiA@+v8hdQ-h&XbHRdSyQx!y|HI zs}K&hvz_j+S3jAToUFJ06$GPIe2Jx}P$?E+FlcUK`gKz_;T=5{=qEwAKMuYWnfY>}bXe^Jt5Kw>^2vZCWC>QFHB{gRQS9ZcvmO~E+kFLf4J&zkXU14BgX6xUQ9&T11J&}K) zuFxXJh0YroS~ZyM;tq7eg6tl;U}5LNY5O17A7&CA<0L*8!ZVSMrS2g-XbJy1<}Iy}XY(&yp7Z1Rwp@DhI3 zGH%a~fuZjY44s3c6g&QfBD{l~cxb@5hq+HJYUR$3T?0S6J*VsE2w;-QhmS*3%<23E z{hWf8=G`$cupaCR?OOj=g>EM@9~({KB}0JL?pR(1Ia*8s_*3|-Jk8P&>S7mGrDeTm?GSrKdK~f8 z0Z+6HEhSts_!c$={Q}7Mhv39@oHZTk4=O@?!x!KU>)>o%u?1S*N$<7Dx8uBw^gw#} z$excd=n&;Q%)JyJ00rKsjC69#YgdFfDumnkBHl~DM=2^D7`>MT0?)!{=0!KsP0m*u z(N{nfSfA5%h!r7(+CGoX2Bk}*h>@{HL)Op9qs%Z@Tkt|pLG+?8lRZEt^!x$tB}00K zgz@Ra-pB+JQep5TFh9#JFBiQ_D#mZ$RU(2DJ(~b4dAej9C?KkCpyK2OpM^66q*;Gz zjDoW`BA++VlK$v6yA1qRlu=oRUn6rcrUJAJKGs_RAQFvc5}r3Hnu+KksEMPH7voIF zb8^c-M9@1O8%L?=9%iMbG|Ky_EjL&fo;4}@G(xz)kAv0{Z$m$zd{%9?+&N5#8sM2qoE?|3CF;X?~H z^aeW*m@;nBN-w(b3^*gtPT{zPs*5e%TRYxEftRZRMT2|ZvVv{^QK6lduwMbsOYm7S6lH$tC847KhdwdZOn>LErPL)lKpE>d;P%@&m(5FdYhJ^h}Xg zxkq4FLB5|^>1F-AbnxU|{HjYI|+)w+DQaI4)7*R6TMl+>+Qkqf&`ODRN%R2GN`A}uHZ9_ zJ_ylg1s~NBer@Z|wtgej2M*bUe(RvXA;Ou@p(gM^MXLzI*aD>kdkX-*3`lu*NuTbX z{%y9uUg_=oKC?NnJ&=+_2n$co%iSU`>gyS^J^_MFCo&YVZ)Oid|`TgKls_m9i_}3r9=Tl`MCKc2+<27q8DG4D-fjNo9{WD3rVu2laMeMrc=eiB$}?`>#*1OOn%hJEP)7 zp6;~|IL#1W0MUHzlyL7;iqN7itC zLbs2|qpT%-hK_64JL@cEhtjZ)3Hch-Ca%}6{~(t_jGN_S1aY`9$v zERe-ryn6OdhEsSymU~h%W`ugccBYGb0-AFksz{Mra`5%z9^Ax-t;MU6BIlt2mOgTE z)(j1QXh5kQC;0xlFRKFY;lLxkUcj1v=_!;7%kw)TTkw(s8d&JF$W7d(08Ms=n~)(O zFcFg|pA&>rCq5fbym zS5PrsPzOA$NByxQ{Ryh9XJc%m zW^8{Kf8OB9UjzmrNF;0qs$l#Jcs=+yC{hf>IZ%AClvG}vvUzqP z_N{QE5!jFb%z3oG{#vW;X-wrFVRvA$cp;(-i|-`|Zu?wMiG?YF8$vih)?NU%*6eN> zBiGp<1|7oz!pc1MYw<@Go{wm_?(MR#rIjzrJ1jbn&B@C2PfzPib2=w66d8|7%ouB6 z3`XVyk(^D-%6z!ad=N8F1|?-~j%Ma-7x1&TL2`}-vapAr^vK8P8Ns0_Uj+fc!u^^R zxPkOJs;m2gr|nE=tTyyW~KY)T*omlsEkf1MGk7-7Qo zvR<$!Fhk@E`g+IS{@4mUji;Bde^%km$n|eu0JcNr37wXQkLhL%LE^4w(4$!AkM5e0 zi|W9JD9*`$taSZ9rL(!6`E103$Tlu}_VCtHFP`HJ184rHQj+q6(oBKTSomW6htTX4+p^-Jow4hAA1BWS2)2-p{W z1lef%wqdo1E3AAwPCAG=AOrd0G}lu^$cG(ZCFm{ z6+ncJdSg{eWa|hxA+~mx{!b7PdJXw*72TV?_+Cx&uHcSn4HL2?sIWty)H-Vl!$A6Y z)O%>g5V=4+=bI{lc@byos}!it_R)0SC{>!Az3|3m&}*Y?Hp3YG;gn{9>88Y(n(t;b0<~6a-F1@6c|P zS4FRbJ90FchjF*(-pFBa;ww8aXCSvHh+dT0IMyw@nHy@yLO&iUP<6x>c?vqh&Vv*W z^tm3T7e7%v{3X*+gLS3wBP2^c4^-dby?nm14(WRZ2osMIJ+Of^g z^>nOE94?%NVB7&Jttm%f6T~jE3-PhzCUEfiX}~E!n-Cny!uFwzL2{(l7V@1uBMsZR zNCGvJqr62gC`ZXUu-&Lfvz}M&*+qKKbBVgo^!Fe!bJ1khO&u4+aosa|O|d&?1G;fd z8VMY(3EZj1741~*MN#&kx;>*(u>Uq`a*2_1HRt9|eG})gj(@?rW2hXTy7O!$-ciae z*z&vrtc+pL9@4tyAQVjc1+F`R2`7RHczbhuuxk9C#P#mj;Vwt${*wBy{$zi;UJtdk z-nJTSw zAuAap1d!}xW#4ivWai0o9KL0(_Go>O>yzBG$NT*9`5{-}zoI1SdCt3VMrM&!+dE{x zmL#HZW#Fa+SbnS)klfd?Oy2Wn?l9eLso{V}t^t_3h;Y-ydQ`@BKK#S1ChC?hK{RBk2mqZzGh>dgzIZIPNSP|nu+!vNgW0O4?sK?8q#?!%ndJ)*NC>PL&SuBa3mr| zUK$EQIg45ZsfqWIb3s<58!+^l;Dd~m?CW1fnhrUsqF4P<@btUrqqp-UOlzkZ^_YjZ zudoL(d1v4t=n6;RFhTSty>?S6POrR)VIRZFj>vO#VbOx3fY+`eHvRNxM5FQ^-o$cn z=tTbxm|=g->^9nBwk69a78O2&{$7<9n{dl)(x#g9BdLF>(*(P%}HYXEcb z=Ru@#<&X6~B1(fcHi2y{EwHR@9K^CU&uTl^sl$vBFC0m~gef6>8Jn#3!!s1{o&-cB z`1$(t(l=qZIoK0hEV>7W7OB?54ki3%**4*h~%h2 zgVpfZAAxSCKts#2Lo=v?7C^g&!t|KE`UmCPdq^ z#gey36_fyp*z<;69<+C0%Okc=ZWiJ(=YkLx#OT1lOXx!6#c{?_pE^BbXA2&PgC2?C zlQJA>rL*{#5MSbP#Z%N5JAMyZKl8ET$M$QE5@7}*9z-BnV%3Ai5cP@AQpbOW=C!Y4k)qQ)UlVx%k#fsB09K@i0&wZeS@PyqUg@U6Z)9*OkZr z+j9B;!3q3-{W$(VWIGR|+FU?)mx2G`E<(c_84}*i_;sO_@J6Cad12%9%&$-BA}D9W zktw)!QKCJ+O(IKp(R#@vhq_c3&(+P@Fz-;f1=IR}@OYlpS>1eux`;e{z5Ew&%Ih1` z58F6h4efaIGvjY8P3w5` ztMG$T@E37;udpM$nM8&D{P^3c_{d`Q!FzV#Ly4`Ja(xwg9*6ILc3bFrCeTR38yQ)1 zVPpBMuXW}j&6|yq$@Gq|G~YH(pKr6~qPu}l^D*bK2b6Iw*4)0nK2UNqYo%lF*Eya4 zLIli0F1rHHDLltcRHL?oavs|B=GDb2<(2hcKZCk$%gK4@B87m-yRCWQMpjPFL-*cv z6(&5G4a&6ip^FT7LtR6JSpFBiY2@zkW~tG_3pdW#+p%|f+X)y42LA$!$jDK@_O?+X z$Zapv?qyNw5ADJ+9pL3}Q3W{~Z;!elCs8aP|L57pwCw_1x z$eFBVDCe<5Q+7{bX+k1dEYmu>O!H8FuxR3?Odw*}A*fQLL9}ixx^;a0h_xYrnJ>92 zQj1Zz>ur=lUvL!OEKGUqfkEW-#u+Q790yp=hPR<^3d_eoqczWs*(}`V4Ez_S=Uj9* zqKrp_0V^+lA8to~kn>RIi9+h{K?IbPf2LTUI4wln(vE*FT>HoF=g=QTPP_`d+epOW z&CDd6yKxLE+BA$+9Ii05g@fJa;5FPgleECE0 z*@QBF!D5@xK?9KNAutq`<4Rv3ugl!>7tj^xx8*Z-mru`(+zUM6!Pk?j$Zc?k9vAwz zg}az>?e!7=XAabaL3(j>Zu)fQ%=&ux+{3hs@mj=pvXT8 zeO3hd!F7+4ktxBuSl!DvQ+n6l#D&$)@ieUExOPt`G%g!N5B>HNsG~vc+P=N6&>tX4Z50U1bP!dgiiY`#c zW|qVZrA7|}lE|Sq*d_QJ!B#gPPL~Rr8F>e~>)CNTAN--~ZR7hQ|YbpKNF6?=?w&nL!y#JG?c$t5v1&Ibe9>;M{Ix&Lg96l zZ0S#DN+blPaqlvndFCRs7!{wgez#mMT=^j%pwkkLCrQNxz#jcAA^|U$f=L||5tijI zKS!gPg~=CWAoFTrCr*_hiHHfU1?L}PEg+W9CCq1m&gb~#d|qZgM=&2RBH8@Y7e1GK z4s3h_Qt}*xe4Mg&5P_7n!xOXPvDJ}xE|X$C!biMV?=ZVNjzD&MAe}lpOCKx|iOxpJ zoVoP3bMYk##e+Z)`GL;mwB%eqW-cYnWfODJ4WyV2Bm)fxg_1TxMlManSVN4*YmDi5 zL|;WCw^^c7CyP`?V(NUR{&1s|dM6&yJJ1!_)zS57LUsHTk{H>cV_wHcoIhWa@{7L% z%3nbwi_*x<#MIlEx=W{CmYg~puf|7CW$J5mY7ReR|`7b_6DA`bAk6tP~c!H03Gap9m_Z$xFUqMz-GD+Q(nED+6BEQh7JMoCV zf?mUg|FPP;@iW0B9mcVVn64$JYK_T5On!_L$Wvl|`EdfpKE^y*#~jF*Hz7}}55yM_ zIh_YV`gRp%kdv|Y@inzlv;^doE2 zbikzy_?%>Xs^#b|2E4<7w{!q_ts*BNcT6>fO0*Chv#8teS5`f;)kOZ7SeLgTbz~K2 z1N)})5pP$&WftQ|)mlWdWJ)yhIjE0l0|GTCqJ@cY>GRoPP;ex}vq4p8S9B6%>3$_e zla(~qOhl}n-`m+Bz371?xKXFy3(2+8ulXwaK7D%V;$omRan3f;^v$r%A{& z))-n5E1oB-vqd3nnOEqlcBVG+}uo~{foHP2xry$C8Y~}YoOcK2j z9V#**m6}yscq|46)JdpY4ygA7N8~riAtt0ZGo(RhU6P#jke?&#G0ggWM6yy?Y-#@r zue&hm7@hPWJ1JgSu*TzjCjT4umZMV;5oAq7K=fh`5U!;t2Utq+2i+5suU0AK&GwW? zYe<*kLv&n`e#kLa3Laq*xn+Ye@O(bv3|vPt>Pf~!h{W~JxDY0_5M-x?hu>dCLx^k% znAR+x`Y0j4Rm|^1onLlxewQ=9y*bEl22tqDbZ2p4B8mc{`1m3r`58XqB;QCB4-!S1 zlZt7HDBeR;j@+$LT$GIB9-?R^itUJ`duL5bWj5|XEy;-95$^|rnUP&!ZFDp7E!FrY zCga;qe8Ye*ay?_NLd@>x81^;d$vbS(5(sgK3jIh_H_k*jK{tta8EX=F6#W~N9PnSS zSMtkYu5061J$~8QKc{mS_}?~&N9;ApHpE}`YU3s@41Q$q)TZQY=tsGTy&z%j)V=yM ziUyJ4%?WuYzydrffZ*L&KkUBdE=vb}=6%%6kvt-g`xW!DJHG74Y5tdK)-*qOaL1Qe zkqNTT$7ftT(X@eXIkF(5`!3*#?>_@G>n;)yq|p*YSFaUr}JSjnPYT2IwG7)fwLHz;lib2Wgsu7OQ8qF*VtVj zg5%a|<7ln&@cI|x0-~35y6TaL5m2NRSlTqgC3$;F^4A3?htJ98{qCotkHyD5Ig;pH zd>@(9nS&r3C(og6?ao1r^*Jvc`cyg4?iFKTu&PGbW zB9K!u5R+t_O#(6w3K#K>upx*uM9vWy&-ZmRoXuCr(uqiM(kwjqo&5AupQ1=wSg1!FvADS7qdV43B94RPQuK(Plv zID>`uhoC1C!z09i?Xb@^lZ!$hg%+nvr3Q`+mr+COI-2rVHdsC)Ws(q*u#O(UppBvx z;S>HtLn*sBi%_BY8KIZ;N{{|Ng7vF7$ww1rqUXpD@Cn}yLYy9@PlQQ6g2j}}2rtEY zx?Uv=w-;ci$of#qe&2m2+CTPqZ$+)jC*F^C+zsN{J=32@P zrIfAjq6jErZQ=EX%-b;6YafC`=!f)VZ3?GtT*7y$u+hTV84INqm&l+?z^SzG;_Ogm zM!Y?T7emN%I)kKw?Be?Z(m3Qzg;#n~@k)4qatS+X^U{N#>?-4g4{=qfe`t4Tu?jsE z{XLr}_H#a9^W8*K#GRd$wd;!`X4Hab#xN@6ACz9 zHf166QAmUX*$~O$!CS>2`QtVnFH|=t3ky6>|$I5`=!h%%xx@xVuiK{+Hikg|Yz`PatFOLJ*OK zN+v|FBrF(dpFx%HC7zaTKm%jh=Yqa()Je7j(dHRLYlg!-{|A0vm;Z#Ce_ zk67*w9|qwR-o zC4Ng+>VCkgRPY)7B)$hhz1>oYSdn*F%O`Ow2i-!~`2ZqL5!3I9tmN4Lz;J}A`1`j* z5jppuvD_V4(9Mp_^f{f5AT z(H)ztpPB#k%Oz^lCLouenP2cqvj1ZTe4qpVoCBWgfPdwHzw7Wv9RA%7|8|Ez&w)SP z;Wr$9S+L`Oajcj(Q~b73lt=9{QvydN5R4`&>Nf?tJ$8KI?I*^{@^PNXXG z0gt~s1j5C-HxJ+b55)Wc)0^U%He<75&vC>|0?mv>$}pCKF{I5&Jq76hkubH ze!$`X+>w8-1O9sle4xPN^kqBz84iED1K$#d|6>RK76&}t;cs;KpL3+YRs3=KY8~-s zIsD@s{<9taLWh61Bfn0EzrYdy4F`OP1Aei?KRC(1IP@Ne+=1bx+2~KG3BQEy0ykaU zfyemm5C2Gf86RRa#YJdXa8sd#>9@JZvaFSo0-Q2mOJqV3orjc|Ciwk-FawQT7V8AL!;IC2RQaI5+sX5j5z zB~sAPi``Pt5?#;|DJW)dKU~KG{P0%%4|VLPzyqUM&<4$XcDjlEr*3b+AU`u-x2L#Y zx2L#Y%YWRjf}GP;vJ!- z_6JChG0kGUsa&K&?{&Wk%?XDOKwY-?5g8J>3q^V+rd@2>Waj@WseH(9X##lDzw0;i zA4$Sz=1)o*AIVbEX+P=yzxg+&#@Afeu=4-rBK)t?POUic#|bgi6qOimySZD*A2oft z8O~>-J29;tpHDm7PJ`I&DWEPhL@H|L9J!J=XI=hu`Vtop$z*Zt^(sw?5I6;NFF}{MwX1=4o3A z`0u~}UvgkkeS_bq^Hv9ftzM(n+v07m^&7rsqq^A_sQ0!SZS@T`^+tWQ-&o=GHXC}h zK-^jbLDfc+uQu4|9g|s1Ppj7-Yz&Mt0*N@=8X6ms)>sj2XbdDJ5`I>!_O`BW@U~@+ zwtkrleNA4QBEQj8y(XTzwxQKq6KGsxG&Bc%Ms@q5@`YmzBPl_qm7vDg)Y9k;coDhP z+vHnKf*S+Am0p$#i5B7EHL7VF{XV0{+Zw2DXwGb@Zmn)YvR1!Ua>f8FfTX$+xGYZj zN1;3cqbcYQfVxa?Gg2Uj2Jp=fF4iBupj4$WTc;(~!i6o>HD05n zx>Zuttf^`AW(Mk8eZiIWB+RH@UER=Fy`s@;_*w!DzGlBs(BK_ooH2UpywOw77>V*o z?N`^egD6qdDOBXy*E3;x&47rq3`Iqr^nNxMl2gUmI$zwbj?gq`Ou4EybOf|rnC`NxJ;STBJv8N!U0+=T8fSHLvu_PB>e3XWgJY)*^oxp1H0Kl9Bo!}B4_!#0 zjXW=0D1tk66v?o-MqU-p@;0_iwfT?E6g^yHi|!>LM{FFU_Foki7K{H{stfnY|5=*j z(^x;53#w}ye2oqMfZs3*O6z?M5MJ?)Olajv%{;NR6fxZ@;|(dPHTzMjm|RHt7fSBJ zz=f5?rDaA*abJ?cNOcXZ7#6J7s5@9ohG}#Vq3lpfaad2dWKpimhv$l_x!=l&h7UlAm2;Lo>?S zRL!nFUPlm6X}iQbyH0q_9u*^{x0P)#aS&cz-3U~pWUOM74H(Vd8jNJstr(1b#DJkh zG959leFR6jx`uXkB;+qJwsHtXMa%%p$@{pp>$Zhphp;6NA5vesN0ZFrBdI0-x@)LG zV?tiK!4^XLp;okc8yhM9i=Z ztqY88BIC5#h8IIAMtWeEF1dcxIipsMYBcJC%}^r1cda-<&GDg|h&2bPjzaV< zS{TvW5kp%&)HKvZU3F7KV?#C6Nh&psR2|sF8rL+pYkt~NICYd!xP@zN-j1&m;;mWmk-z@8{dwq6;3in^s$Ck)svEf`+?QokHS&|aY@ zTBvRPN~5kLYL*Wg3VU-DZj=;vb#-flFX*R^=tq}~Kz70yn-XQq@T2TC^_g}TTiZ}q zhfW>pTv9H66s|a6iCe9upP^@mW+mgC);ll`OCEtXpFKXJ0xOz15M{Ck{MD=Vup^pV z?`+7*YT%$^B~1o$TkrF67#fqg2(qrVe=VsT-H5c&hn`n72(*jUEHYGB2E>=Z*69~+^a(IolxItmh&72C zU!$*ej3yQet#?!+A)+)i`h2SlG(47OMRhGiFo9HwfgU!qw!z;5odvbi8k@dB_!cZV zZINAu72cX^mbA5fb-=LVa~cZy@-=%iL9(~m-w=@bijV~zNq1XXzqh19vb3{ntZrQi zy4Y%DMvJZws*TLQq~x~pivB6nVve0Ot{Jo2_Xp5daYk{%Nd~70(9b80Lund=P0hwi zFQ%(9EX?NIrxrQt9uRE?>~8b5uF|^KFn<8_`y0OR9Y#5AV*h8&9}TG>NSmF%#F*i-}}|5eZ7Y zB_;mM^4ass7D_&)73GWP&Rd8cmp!Bmz9^8iCU5iVhE`uQSj%xkW?&#a(Aoga8m-cw zsndW4_LDK>m^)M(W4(czu`R7W_C0puW{y(mTM@hx^KX>7x)~iM*u*y7TnEvpg><4L zabhgc^bR*HYDZdq490EFywFo)iqjfIB?>!*|7?IVnZ#_d1v7F^8!20{xn}Ry7#}>~ zvYRHA15`JdB8`rdqaK>Qk`OmB&rEwvmR1IWnlVG;Tuq3pZb9X>ps&G*T!VireXSrJgN7F>o3%Jl zhcPh|?V`F7BV{eRU`g(+MTN}sA)R#QvUr4LC8B9Iycj(KL0Nji@5Cd!WCkm0CDRL$#nh!?^uBB)+XbBjb z^_tu$_R5?YVu~z`_qNwG2Emyb%aVkpCqo!$%jCvw`W3_Lgm!gG)<=&N8@bkzr zlf4Lt3bM$kHDuu_0bpfbt9ir!i_yTzkAxKzh+6`yfX*7IAPi_SQ2iL+T7$3}3}-Gf zGCLMdAUch{Ht-I8E>k5aoMWuz5W9p4OF&7pgcTTwkrrfVWdM)xU7Zde>Pl_6vTY$f=!3!A&kU@HRflGOy9U||@F)??g9QpT} ztNd>h;mF@!th5*~qqSO;e%2uxI_FDlhBYvm{?saG6pGhtYjOW-!QRilm_^6nyBo zy5qMpj#J6W6((kS^;#5-W@$%4J$mF7P%YMA9s#E%Sj1B<^f^egn%Tc0Ki^VrgcIyMERm2}cBxqwuo1%uSLk&a zMsXVjHJwTI4z(m4vDLoh@^jM#LTArbh^r0a!TL>>b9-7CmxfrU4r$UOEi{cjBuS7W z8;41@>>)o1Po^F#MX9%xEyKU2X@#$mwAI>^6*8xR zHHw<020SLyR#pPASm9tBY;lm|lc7^tyf4(uhc;bZ2avzjGFu;S=pV3o|5>CDB zjho8S*`tig(z&Ixi$@t{vlrt3+*165Ya|zom;iC?H5sFTp0lQ`S*oEiIENo-5uzg& z6k^!|3&2yYhzn(D*Y7dPXP1;NC_V86)E_4TqC$AMaC-o_?&IzuR8b5a@roItbHO%dBddu`UH7JAHNaAB znTZxkAV!sA*kR4a@x`h!5usqSWx3hw#l|nh1dY#1PLZ_<)zK_?Yzru%cm=w9;Y@a< zoo`GSbgn?pa$p{ZLCc*r!j#04G*X^W5{gGL7NE3rfwH(>SS?i#gtZNf3&u(Z2R7gj z?U z@y2B2`#t%!IxN;848?$$q-Lu8<7&_k<@=T0vnZp$#yt{Ib&Y^SDibNu4aUN(K1TWT zTNILvRK%6<2dV%<3iE5GA}Z&F$^$(#uw=sdH7DT|*UNyGYVm9nsIR;A~jS}3V=5if*E*1flhqw(@ z&cRMrK%rK|7C~Ls)YU?z7IK&`O;vYE z`)&Ns_mR)gp+)L*z);@Sm@~fomAoqEBak^TG@hyvn%E)nN}IA(HxUy%dvu`5>~L3wJ@k;p-`#mvV<9%iBQj^ zirk7h5|&r_Mp5#NV;X49%slS6v>E22WA3@!=0)3&z+NfW%h=YqsKS0-cqLmDUha=TQ>|H5B?Fhv9d)7O za{)1yz%62CtVv5_c15=DyzzE}WUX`VBj2P*1^Fk|=I4*JY3!p+SR`!@RN)mc*>n-? zSdk_3_DzpfAJi^a_}cfw57)^1t!pQ4EgL=zmf)XW=R%homknopT{qx~YJwV z6iOLqp#R2DhVI^=U|<(>6LfKz9jC^s6X7aQBh?8o z$HUF%Nfy3TmEyoQ(BZdp)3~Pq`$XWLq(%YnaKSYJ-{Xx@BV5uQt&VaDJywlZ-*pYo zLFhrQ5St47d1ykcVF~VIp+6m~4vB>fjk%6h-+|ju2diW7{2nfPAg;sJApFk|x5j;> zxclS(V0D-}LVQ^ke1OV@3#W(e^OpkXzHBPsY5R$@uk`zZ5jWo~=STMZHo%U{_vZO| z&%v-9@9c0svtV%;p;(-x2=49QCZ@+>l1cc!N%{j3hcw_&lUUw-BcEY7^ai!6P zs8GiWb+1sDO6m@0-Nnj?V*nM-C`G+0$f{CD!yW@`zz&5S274^5O>bU;n|bBK^7&u; zUmj2f4&*NjE%FdG0ROWg=luVln*)n$AijP%6xL}5Nys3yzQfS+4o9n_`v|nULFn-Z zq1QbU|8vpOj>eO*vn0iV!gY)?&}xr40457K4jisw=tqu)&4ac7(?yeSJ#GKKpIH+7 zK;asW5qyN`2FF1&7>O~RBl%dEaTufdOg1N2{u3SH6Ht!_4%gq!181_-=jMSjS?V+M zBxpaMnV*>_%YVB5Gn1u0H4l`@f;KiubTU4_oyk%kn+M8dslS;A%4DgJOn2iEhzA<) zH!~lZS?WX6-FO7jHy-NMiRMG#`oMHI9)Tprrn@kfeoD-x<9q;IJ*K25p%=_~!TUU=UJuBhp5JOYX1D(aOw4x=jyToKdVcm$Fdzc>L~NrGF)i2&DM zO?TrFh)0!LsiyZzotO_}XQ{uK?#3gKkL&f$JU9-FO5NPdD3v>(rQkj=0_duD4Bh;}J+4m%FPxhVgCS znhW!m$^YNhWT`jJd8z{czrD#)mFmytpUp}h|E|EH_B&kpVDnWg?{ z9w?Kg-Y^f8$-<)iLbXW#)AemkmU_)RP$olpdeuBoCQF?L z^NPv;-_~TQm(932J;@gj|7NZ%^^$p@OqP1lJWwV}yOVk-K4CnKknHSK1J#Y3l zIyJ+;86L)Z9=LX!2g+or-SWXbjcW=SjMyV$+`bQ8Gmc`HW~xN z6LBTF&+diyx4`wBd0@;^%wc{b`u%Ur-$1|T|Nq=%sb|dtWe%)HPrn~V7#2wdi zRqepU*jefc)7^Lkl89@CBYjPh{|VrF+;le{fp}D{r0^!COU%J`KMq{mO?TrFh#fQW zS?7XxC1Pi($4qzQ5lAAAeY+n6u18IG;}OWd(`#tG(D^8EZ8P1CMh1kx9-#PC&ucPnshG2M+vAc<*`-Hi^)wgA_|rn~V7 zBsqQD*W|#&*jcLEbT=M>#8bPuniDW~1J|!jcjFO=8wOtjhB*A!!1a*nZae~s$K98! z1=t?~t_Mwb;}OWdFc5ZbjK&9n>jBfp{mML0CO+r;rOf&Ce|uJ!?6X7rdSMrv@ znJo1S^FSFrANu(Lnh)J+9w?Kg?l5~Bzi74$Ptdlqf;?_-{}*fKLf7Y z%>!k!)NN*Oqw`~UV$S<^-v+vFHG3PKisAcCp9sAbxNb2Il*v**HQkLzAjy5F_61yf z)}Ml|n@xA)5lC-bd|%Sd+zebdneN6T5Vuqwwb}*SO~7@d>25p%NyOFWf*}sS5x8zJ z-Hk^e?RaS>9)Dl18-VM2)7^Lk5>Ng8{ouSFxUMtZjYlBFb>4ok==`n&uAi9h#v>3N z@B9R8KY)8}f?vmA>@4+T)7^LkV#joQUXX25p%al_#rb}evSW4arUK-|;0 zg4?#3gK-nbaj;ezif;QFEIZae}>#?|S9!;bMo;JVUuHy(l5G57uKLLOHF*A=F_ z@dzZ2+ zyZJ&E?#qB{quJZ&v5Mh|qt?FN8-eRm)7^Lk5~t*nKFVgtxD>d;rn~V7M8^#82M=R~ zf$I{}-FO6I=L#zKgYOdH3YqT4Bak>Q+qJO|oFU-4*mO4@fe^!GeWbRrUoP;Afop^5 zZaf09q3D`CO*F~ng@d%_Z99Q(B^&;TvGTn_wAa1y>?1hK1x`3IC1^Z z6%S)|0#^qvqINUr@erPf>#9ESFjfa}U1+)+^u~b1ac$lwCdSTE>rHp#5l9@@{#@&U zYn|zCFm3_jj^RfxG_C`#3ru(85s1chwM$xOE*AjTTGQP?0|CUDBJRJ&fqyM<{lIiL z9)ZNu_I6#HgzX2wb-w9tJOYVh_;FIoc)0C4AGppl-3@d&K!e{u|(016=KOy8IL zM#0+#T&qoYgV_Zjn0@r3z#Zpm;0l`V#v_n;x|{cdGYDJ()7^Lk633P7`e`rB0pRkR z?#3gKWDK|T!Vri1fveSYHy(k+<2qfpI`Fmv*SV&1`;VKHzFL-Hk^e@z{6l2U|06HJR?lBak>Qr|V7! z?k3=BG~JCyAWjT@`x}94mFaFg0_iL5&mB}Tc9uHFbT=M>#Bu$iSL!&7u5*B^!E`qs zfh5OI^xfsa-2hzmrn~V7Br$cO`)&s&#?DeJO?TrFNMicF-1i9HmB3YJx*Lx``bytB zybid$rn~V7q<5O+kYC2i>IJS^)7@ZK4v^%O?!I3MzFOd_G2M+vAo0}q#wdt~CAw;W zYlZ1_2;`gK(s7mo*V(4K@d%`ETn{-ob~bRG zWx5-WKzif)wF8G8<1FAh({wi;f!Hzk_3RexX9Cw5rn~V7WM4Qm>|u+}Gk|M}>25p% z**`8j#uDH<-E=n|f!HzQ&nvZ5c&2%>&fy8m_%e58wPXn&Srn~V7q%RDQ^rCJt za4j<3jYlAT;o8;<*COCrXu2DZK(LeFE0sI`g}}AIbT=M>xTkXqT>xD3O?TrFNIcbJ z`=M_>a8;V_#v_n8uKl?xfvduFHy(lP4?`SY0bKJ;cjFOAJnsHn^MGrv>25p%*&hbN zw+kod0#~`|Zaf0{Cb)E*a^RX{x*Lx`zB#Trz;&wWZae~U!}YkUbesxYvrTv75r`YE z2oR|Z_uO?TrF$i7m?VNZhY>A+QLx*L3{07yJO-c#FWNlSsN#B?_vfh6Lx z-8)@zmH=0=>25p%vD5ec++|@d2CgF0-FO5N$MLi)HF00 z0oPd5-FO5NPy0eI4#i<~jRmeTrn~V7Bsu=Rd}HLk&_2IYKVGGzrT6Q9P{zTTSp#y8 zF-DCZGj`ng2`8O=%9LqECDY4h%&e%$J!Yo`3n{p$IhQWcYZnk=9ib3=Poz|d6bt|;4sPghB2VB(%>Jms9XRCa$OQBW+Hg@JR+D?wgmrA zuUIhMdQ{C{Tp{=t&jS&XZ&`&4oH?6|?Hcd^w<|^C6W45Yr##!r{DmiY?I{yZq zrhwuRi27KZq$ml&63vRD52wOONdAD0MF%N;@}~9BsN$Yl+o^HMA)Qr8xDtcx$eR9! zI@M4IgtdG~dOS6VL`ngy{OFgM;)oT`itWcyS~Xs!9~u)G1;z-&@YI1kIS($JOQ`5n z););2(3VHF$kD2jfCaJqiexr7R{2`1ygp5LdrParx%90{pYPab%NM}J%Zk-0u*I7xw$G7r}0Vy%zR%*t=o7VYk6P1^YYL*I?g+{Rnn1Y})0;Y7lHL>~XLs z!cK;r20H_GA?#Av8rTNdHrP(s5bTw(KZd;#_BPnNVeg0C3i~+hF4&h~{|fsVZ04q7 z^*z|pu&2P5z*fMX30nud26hANRj^mX-T-?$>@Q&-fPD=1Y1kKF{|Ngo?8mTsVf$TC ztOmj!4m%9?I9LyCF>D!Z1?=gtXT!SvOfv;1XT;CPn4p%(`4|m2A7i3gfzy?~hXbUJ z#8>=0B_oJ)GCbBv6vOb2=$ZJ+|17*6)Tz$Fc@jUt=}RX%GSTnF`C@O#-4}D66>}xN zJLgXdy;9wQTzDSNTHGjo1HMFi+&Nktcl`0AtRGHn#E-+n3H+TH|4le);>jmZ;%_p4 z9?vO-Q>IMCZ(31tNl7Vx97$%)KK0a7=ggT?UOsp3ym|8~Dk>}I>)(O}j&jAksVX%k zB_$1(PyEtS(-4MVS~^TxT6%hVztmI&OCUm0(^YDkcv4c}0EScm z`#Q^o=Vi%BN^&~$!As9hOaIP*@8leRQomEOE2j59bzsFIhi09=1aXGLuB^wu<%b{nk2yy}5 zxNE^XZsS##x=w9SH>excbagY%GGM&haZDcSL3_e(}j;`tEH%cD&fkj>ZG(L7c)?gR|Naf8)ld8R`9wK4|8w%-n&8 z4joXCd(`j|Wiy7Io_p#XWA4a`3+H!s85>3n9}ylt!nk~sp;C;Px|Vy?fSg=o*s-@C z0}X6s?os8Ju7xZlL|AGJ$T4z{^46_H;vZKYvS8t&W00Fx_NtZ-$m!SLpx$TX4#*jf zJdQCY8UrRzI>nQ19AgYTbVN*{J9(1fF(zeu^702BO090v5gw{y@!#PShbERP!OfQX z|L`vb-IT@f>_Z0RX!dC>Irpfek1>W0J2o$W_=p0YE$H^U-W-P>dpO#_7(B<|+y?&t zoB1!CnUmPBe>3-Rw9Fjf8H90Us*D6Yc_$qwaa@A7bQAi3X7v@mUHK{r_lM$R%o%7G zvz4L#4jK}zrY;ZA>&+^`yBzeMV^OVX<9R{D1?Hr+B`Gu*^Znf%iawwNJ#d@+zZkA- z(O!Q7A9K3i?11Y!v|1aZS6qKL*<&&6X8ixD1-%7vZ$Cb5F|PoNDO9waV^E zEE@EgsiPCf;OU>5QUmwjwASI8l5avUYK<(gQZ_a4QodvYT7v%i(LCohj#r;G3g#zK zT8EpUkr=-VyNc8eokePQN0B-L?z=87QjfsCu%Sr(HdLhEhW!Gz4E{4 zfpaa=o&y_zy$tXjzekhuNIsE)rT;Ppd5amAlqlc*dm#7Pk_*%lY%&S$oj}>5KbQIjaF#i5k?rU zG5|zlkpteFkB)V)8}HWg1l?D7Ol_&2dk^G)J?(>OK_ z|4w|(@fu$X?jTyzf@(qcQF&dFy2-NZ@Z4lsh6P}83kFa8u7eQRiBNY+t?>D9$ak}S z=K(4NGR5APCu5Ij8Zk}$^wl5`7)CUY_|MX)*WFU2w!@CQ73GC3gPWG&KY|^4dyyIdn-2Sr+i+I9Wrx6DpbCS{ ztD5C9Bh9y|(EQI*2J}<|H>K!n1BR+8YUmVYEHmO)4JdUJ(wF?KNNt3D6!vY{0e1i= z>@wJY0RAzaC)}y+(RdEDEW=ab*5jnzI?$SU#lf^`s0Tytz{%7hHjP-=XhGfLSa!p( zs)r94MC=DqeH}zg{>oaOV53i_{_A zMQSYUd{{s1X4p(?jMs_v)eH*P8Ocfwj>YEqZ^RCPUsSwcW*OGS7L?9XC=^C=VYSi} z*@C8Q^07=Nv}0wb9dg*Utw>!Bdp+zeuy?{<0m}uOD%{jjQzbWnKwDs+qtxwB6scEX zzkoerN0Ay0dmb#qpM2l_=$Z+g&nZ|K_rmV-Y=g`A1qodD(Y>20%i5+lE>gWMm(f@#)TO; zzFDu|ve%_I-#=wdQs8(A!-1OdcsMijY;|^ijY2;TvX5m#P@k!(hld1V-kFeOT)X7O zTyQ-AZ*0KTl*mVxk0oRE?#?20=`-4n!t?8=i`2__p0K+}Ray32JpTe)0(;r>MXDW^ z@NZ(P{*Acb1mAy>f4uBkMuNPnz-}_uRTpS(7DH|Qj+cQm9;&Ero79`l=1e{qh&lKfVmvhrQpj%kiB5`yw?P_JUWx znLXy;i2F@&{wMiY_*(o!jahnRlKTvF>n?b$NVQnD7SBq{GQ0>Dd{U=t&3Y(q)Pkhq zHXU1O(aXZ#=9)E}S*X_P=9ONk9@6zGeIF0lsBU^4`YG&vu-&ka!afQ6EbQ&D4*gxp zKnsmo>a5kPn;b?-UN9|T92znI$h6jTDshN^N`fDt~pO?T?Kqx~z7` zY=iaiK$){dlCuO7IwCgZ8zEYP+-)>Mk2bh(i(?a)@@+h^*mi(D3~IDeK{iO&Ps|6B znpfIBj1#sKLx=4|8LJ!xVTPiA+Hp8e=@3YS9heZ1P$Mi`LtR2CSO*R`(Iv%jzSvrV&Wq+f6kh;9I_sE ze^8_zgMAD3SlAcea<^v!RtWoO5A;h|w|H|9o&x*o`$cLE>?yGSiUL3Ede~CfKSqjF zGi-m@l)n_Id;Y3%t+Sp^ykijlG2-0^doFAitQ}|Tdqv9pNc-Qgo;HlnH3(xKPyJ2D z`Kk3xjPoOeoesPBL(D;}@*n?6kva@EG2ZTvp{K&03d?ZAdeZGfK3>?f5@=Wi_e|Jv zusN_%;C~(V5!j!=24T;Ey#wi`xl&WGM2+=g^)n*0Rbydbn-FA2;B#a(6`L%Emho(wlWAo4B*y6ELvDo7GCpccUqE|v^ev}5)v+2 zv~Oa=_4JS^Ypl2Nu&G%(wNkO{<$A^yYYZ2JvHQhiTkQ7qi6v5T9{G6D8?W%;Rmp5@ z=(yO+qbsvg_=RTKa@C5uW|!PhRc(vD?oc#5cJDke3wmn_$*8v38*eXGy-<5;HIk8t zo)>J3gj^lvup~{{90F z-1S0gELHg%sjBm(RQ2YI@vsjN*8Os-T8?o0m;T38HR+X9Ri6;Xc&(#VudsqCy~A!^ z&^zoWOM8c1Q{6jk**U$#(pU8ko9YsFOhBm?2hBeQ&CalL(CiG`0-Bv+cYb40gq;Oj3A+S#Icy_rJ8UQHCfI9WZ-TuGwj1_I*q316h5Z~>{XSJ? zzz&AZh0TK<2U`d`3w9Cga@a=LcG!zyuY$b^_Ac0N*e79k!@dC!IV2-^;OG3-^aH^JTo+YS39>~7dMVBdxP0QM``jMu>j*j!lqS75nG2Y;l6 zKjO82|E<^md+YUks;UaRMa@3!zmJ6*m%m}@7cW@hHy-{b+&D^iNLAHP@v4IREmc*= z-GGS`lqyQ8YG`T+wtA~t03NTpRnu@6(Zp?#I z{S0njgHrdWV(|`patzyYsWod>wly?YaVe13d?JpSTHDx&Ex5qA zs;U{4fCfHup>RpMsUyHgj?)SEPYt#?p zej)1W^cdOdujxXzipsOTnsx92-Ow1nNar<+N`1wrMa04VT5&_9WUI2_#@42kXH7pY zO9^Y$rTzTPb`Dqf^V?2!eLsJU7eDQX6{nhNzqbYi<9CbpOP$^-?s}4hL7>??{I>vz6{dJY6CdfS8 zF&T$DCgZ6pxgHbzQjZCKsYj%ZwTX0Ibh?mt(CLd#vsG1dO;vS`A1#oK*`{h%pcaMJ z7ci4*M0+6JFR5Bzu%#9a3PTw;+pX|7uuEI*uUGFWOq{Tr*63@MIm9PePjA5WmDLTc z>Qiy!dST#6OIhVz(?V%so5p3T7M|%T%|0*Y1PrfBL0sP44Jyt{0qLy)jTx}>;jh)G z)Y=q(aD|or#+0_|TI~EY{ZGZ+jEX^@z8C&6rJKT7|U*V0<>EO=PnTxSvaDi-rF#rHywct5;Im0={5PeIqzk zkuuX8nCq(zHhO1aLfGgnMxxyq!~SbyJkY)D_%Y~N5mwTt9SolRe_=siGna3@{?U^( zkxCVSmN{h$=9QJ7c!C{9S^IzKmu?j{MHzS@)4k+JB*sx=c=Ky4gsq>=AuTEC7<4Mt zRtR;yG#AWcR$#dOKgC@Ekd#N2{#VhghQ#qg6qVDt9G++qGKAd)4Hd^oPNF0k6Os@` z|5i7c93Tp6H=YPE=IXu|lp;u^dml;|!8D zQeM2Ex$pJs*MIlCUBoNRO%?3?-~amS*RNl{?!W(k{%1d=#nZb)7eS+F5ly%_d=>uv z?nyl3*=3S+FEUfT6{9dhM3j-z@I>)wc@rUNhu{mI!sHKW%G&neTg@IZ0>6#Y=ka+) zt^<;t<0Bh^P@2nx=MDh10Qn@zAPr_B^B{mmfILJp_!#?`Z$HBS*|~nHM}f2hqzjhJ zztERC4@f&e(m>L9u$XI)2PkSsc$PAXsF$bfix?}DjWHfD0=>22z((Y+MqN@WGBPkL zv9ksKy*Ht5@}=;WIm9lMV{tj6l+LUy$Xi; zfGI2giB;3kfasXHVSzki6uoQ7TL zfP)UiVwt}Zi>=TyHuBR24_nM89PhB$)o6w5LBsM^Ad{FdjBmi6(|vA&O#4~RGb{bL ze+&CO+aY*p(UeP&p+N&ox>9tw2|O)_(4&`&FtqDIU%ZE8u#;!>F&ys)(sZQ=+76`l zYLSVDd9BH3?)Ykoh8zMj-QTAkEissic?LKGe(e(96FgGWXHFOyf8F z$hdGV?W%W&5=k%DTrWSNdPBy=dr_Es`PRbNNV%hrdAzq)*|sYdt{EHCQ5|86?3}ce zOHoUwFgP(JypOar14a}+Z3IY*Crnej_;U>-mm|PAUM>7pT1qj9TWX$kRUv@JX%myd z>Ad$5$kg80*-|b=t@s)GB8)+Q?3UJDOV6FLrT4j(j#rB%)uquXv|{o`+lpzdO2pkT zXYNhXQbL{wWa`a6@|QreYklM*Dit8F2GT_EW#1s4D}hwV{dk zUFM18Mb-Xwfur3GU9wV_VR-;ZE_er-s^zh$hD!>^Q>9(C+RcKH(!asUHugQ7Ol5t!TFzoE z?vPPh#We!tVjyX(`&ou~W})VWLr^=+RVw7iMFxmj?BORLUa50Ys_hWSRQd<1Q5q9- z!u%r0WY)9)Ot+4r+FuHpoX8LmT?C{OAeR7X&X!r2WN0Nk86dBRO#U2S=1o8{!~Qtk zK+F~)EiqFAX$8o8faHo+XCw0gASv9_N}|LrAk6^T10)^P-UJc_$Tx{6KpqB?bx4fe zwQ5`)%Q%Fp|1o4T*d0r1KLMl}Ag6%f2XjV-+jagk&^v*B{sKrVKrRB34N6@KBp)DG z0jUQ_0Z1C2ndtL2AT5h?a_s)0RVsc|K(FcZduj7Xg_JkXHj~2gp@GQd|8}Hv(w}$RLo$oxaRCklNq- z$Q?kk|KKAHASo=H65rSZr1g(J@^vcpK_7VtNG=#(Z6M8$vJ89guL-%^FZGOW_}D!@ zavqTO$Nf?-CuFBDb19JgCw!S}f#g2v%M4Me0I33LVUd)y>z%}Nzt8g_AdLX|G>}P) z&@6%$0LkqZ9-3hagNritV7B@mWHO%;87lQ-Ae8_)0i^bTFY_eH?D6%P^DOXSF_GxJ z07xZ3E(J0fAg>3~2=uugNPVBrTqK#Z{it3gWWa^+_>dinZ z-}Xyw0FwW%k8A?c_=%6)4kZ0wKJo!Ve(odp0?7o(7lBL$z5E>@?ZAJ20HpO{pXU)E z&5!uVlR&a|?6B9(IUClv%a@rCB>R3rV)LVl!p)Q01tG6n3Yq#HKC%)>>oY!bBan39 zha*5zO<(4ALhkU99Y8Vx@+ly#_xUnk29getZvbg;@nwDtWGb-Oqd>BoeVJ20>NOuZ zcQ(e(MjyEVNGd=s1QG?vD}hXv{8Fz2(hBCm>wsi~8TKY1wZN*IfYiU~^V|+3`l*k6 z5J+m+NA96gyM5$-AkDw^k$(X)RrZl@0m<6goIT-(KxzSU0tkMtA0<)ZNg$Jf4WDxk zWWM9eyckG27zGP~Os)52E&NG)J45l?`;9Y`}kwgSl=^y~U4$pm%X z52O(wp9fM4kOM$6fj)`a3rw8o@jKCGDMDVt(c=nIwR6;in*znk16KE zY7C|nb6YXbSH7`IS)*Hx!L(v-D&|>=nW8@$l0@3R-O3sn#e76Drxo)`#e7OJXBG24 z#T+T-1&X<$m~)ExkYb*zn6rxcsAA45=KYGfTQO%8^IpYVQOpMv^K8Z3qnP(A=9*%z zE9OJWpHC@&o~xMain*nj=O~?*E1i!h=7wV4u9%M~ooO#J^yiFXo>a_}iut5so~M}c zn?9+_t~Z*Bd7ENBte7LkoL0;&#k@-~A6LwC6mwoNw-s|uG4EH*$CYm!Q?YJJG4D{! zZN*G`?*P4sv|Q;N9q)|K#}xBI<#nqS^SraAEayw4v? zAE~P$ZFg(+70!ls_1?R+)6PA6V2ZF$*CxGV$Ihf;KCGD2APIPSRw_T7)9qwrR4V3% zVm_vHru$7nU45mq9AcSUiut%=?om3gRm>}u&TYk9M z%o$~kjAAY+o%g67#82Kri}f8+J(yL@bCu3{rSlf0b4ytxrRF(4-mP@b zD4n+|=0i$ndTuGGt8ckt&MM|vY7DMYI#-p>+f+o#DdwX}=Y@)SwPMaF=DcFADdq#p z8dJ&|^OQ9zig|}(KB|~!E1mO-xhBkAa2vBXoh+&UXe(;F*S$u1(ELszycCcX^>(rR z%rZSqY1hm$eZvxayI`n}kF4CK5gg7i#C?Sk|*lqWP4^AXiw^A+&|hoC8Z+CucZalMW|^M-(yp0h`siLYsBmRBbAL6T!nWtnpzVz_X#0UP zXnW1I9hd(dAMw?ev|YSz>1@$Zklxjzk03p_N$rC4?N%PuR?G_(b5$|#P|UNX74BKb zDaE{7je?UZYRyy3brrRuM?2^DLyCEx(s_kq?pD@FDdxIjKCE=cVy$CFTd8zT3-ePj za!b;KGmp65-D01aWqJ-tyJnW@+b#XxmFn=_-i&4`AA^iGIAg7h?`c0u~)N?k6t>v zbZ#i-`AX-KV&0~hPbxc4D(1~f=Yz`5C)H|sfzr7t%uhk2t%x;dj*z{RVxO61dJc=l zW|ryOC;i@anstJ-UB=GRd7_~py@R5UAU#{9c0u}%sQzjz=14KGRLm8{yhSljDduC! z6EccYETnDdG`t(dnc=9U^4kE?N! zQR5<`n3pT&&5C)qV$P}^hOA<4E9M2t8aZW+`N|qO#k@^1A5l8bQp`DJjl5!RDdxFK z=d5Cml+G2!oK;@8MKMn*=9Mzu-KO8^Q;K<&V&0~h_bKM8V#X_7 zI-<>L#k@l??^n!q#hg;iYZP-sF&|LOI}~$TF&|LODdkbilt&$P9wj}PQOx@l^K8Z3 zqnHmV=B#3FD&}s*oKejC6?0B8uT{)Dm7NbNJMU6<&MW4eV&1Npn~J&Sm}%g=0wb51 zrysc_a|w-ZQ#)i_Bysw5T@M+U#{2vsW4U&kJNx1ZP1W{c)%Ho%c6yB;IuW|ry}`Z% zLEEoKyIRt&a5K@gMQUdmidw`Le*Rc3CD!%Or+o(cu*{!cp9$zQbq4yd%%5JL_d%cN zR}>+q_f_dHmig1_BXy;WKB!B4Y-v?_=04?_N0nzDb)G5A>4e$7G9&{Y6r{TBdwbm2 zakV4GU+D9_%MxbZMeoUX>eII%(b>N9VJ>9&SG_~#9W>;h@)@=-olAIzs>4VF5=CBJ z_PR17t(b0nb+&6dna-9@C&TT!cmWhN!qv>Mm z|FF~^90o|wk7g&a``me?JoW??)8?OHNd zAqy3fRmf_E3@hX|h13lG6uzammXK8hC563R1`Ad5V%D25zLITCj-^-xev(WRtE2> z#4n8L1*g0-NvpV+UOP&!8#Oy8gwW@oQL23>$4*8b1~T8al#!nR*%}~^0eRq!eC5J2 zNU|C2b+r@oIY8uj36^;gklP#&{SJBn@BYj?ePa9K(v)0R5>2!arRW24tMjE6Ay#I- z638+;?=Z3!$UavWl`jI}r~8aG_+_yXKM^F>s6s|o%jR95cwuTa;$19Ligd=SQTZ;g zlzJ~p9d~unug2+Bn*7TSQwpz%rRvg;+La8c6KzAOIo3B==X-!m1vdON5Pq^q>iPnZ zovtq8`38{1=3OX}wZ>r}{QDg#_3uFLxyv|24Qczb8$jJa10FpH;b15|nq!sYI1Bk>8 zX1)u^`k?K10~t;Fi(fk&O`2Autv>fbMj{gPd>%+6(C4c_+5vJ1h^%0F?9hvVTaS`8 zg!vd`WChF2zok;c9|ECI;+ekyBEOeGf7zE6^Y0y` zFMbD^l|gJd=RCXu(6tNi_byiP+BE(x1C=uGRz^Mi+=W5xtA+X3dBQvoJgq>(mjS8$ zT-r{$E(SuMMCaE4kvk*Y(kp@dXAnv9KvrGoml^@mljt1Nd&pzMoJ5J+Ad_}7baD$2 z`mjuFUnJfPM#|lg*%6fbCm_3=|Ii#ag7=5l0uSE{nO|P!Yxs4l%XwzZFM^J0E{et= zqF1r!9`j2*j8gKOHMYjjh$qT=(eES>`F$?SL|7_6&Ag`ze@Q%g4v_s$XF^^CB%Rc5 zUo_3Xf|MS7DP$6Vj`^kV5kH?PGM7MRR$!mk1Ci%9xb_=>Gy|ENfY3faorgzZ_N13_ zXWUqh?MvCyC&(I7*EmXT4_dJWNIJ0Chk&$#x;_D<9r)n`KvJ&lWQ~1<{K~KE+f?dK zfBt#|$bScs_J4pJ3+n1VAKn`zGI2o1uAyW@VCa=z0D~nIIlilFUSR0Qrbpp-~;% zfm9qbMz=9^Ht?T&A+y`nMWsFi2xK_n;aBuWIoHcnss$Mo^7Q!`kOjd=c?`%= z*I!hs3pe&sLA%ZavLLAoSEDBNhV!4;CIZL=wO@cz{C)uOpA3+f3`#E}eMo_lOXLIp zSq_;@5a-_jWJ}QYw*Wbi=!2!zpj`vlh-4FMOgV2M|Dh}uS*J6#bOU%&LG9x}WEYgZ zbj5Wa?v=p$x`x;hcx^gWaRmI z*5_+L8iAd^2ju&2bXKL7B2Pyv;Gs95r(K`ojpBuMPzKui)D{%xT6&m|~@5bo7= z1(3Y+1Y*7c$PuSu%&91%O0X6kgv>-xY81%o0I30yJAKv@fYkAoEk<>H6v(8ji;(+( zymZiS>F0nvkC320x}yswlB6HIVJj$4L4OK=vnf*)&F(AdcM#nP$NAHXw3u zovr$JK(c`~wgE{wW~%ExAnkzXvp{AA*D?2~8ZwwZ!*LEFCvnM;FGKLWBWsOuL% z$P!5mf5wZDpXg1#eVz-1K8ef)Kq^5iGC<}yW{N))fNCxxQTawSj9{GF6f^uj5E>UTCsv9k1LiT5qL01a;bcfr%8f5NcUK@o$h|ls=7Z(wn-|nPgr8nYvrg z6Y@$RQwg)p%v1|}{tC!soeY(_0mzyF83Hm9v}*#0{EDAFVGEFhL8h6jowmHKxL4REWnP$+g*8w@^+I1a{;v0%1S0Z29Yp+>- zEhR@nMk|v)%|AxMBdkYx^%k2%D8@UHgbO}7GLFd{4n00lEtW^daIxAySS*){c++f% z%X`NIn1%xKVAFyC8*z9;ba)oYWM?{sOC_YVD)$eXtQp1iG38^%z^2PZ$`2NtGYijn ztpAomDD5LGGg2lV+t#r{KjM#N9x$F8Gr2ve_Cs~7>|)OQORb6Gb>qbnYlS_f@lhV(@8s;yVAQTC5_64HC@3QYKpiOhUb~sW@02CS3{x8?eoS2Czu~s7YUAkC02aYPxf< z*k3BIXK^ZTYp^W#ELDnz7uF-;9Re4)2XP1`P~}JgPC<*!{A?ifqU9GH?5p-mDFeZRZJSJdJC&P^Db)I@qc+SR8a9vQr}>l}F-2 zdB~P2jEqq(%cK@k1s891|UcOnd>x_0U=WxKxH zvMY!o8DCGGMZ?YE2CeB@e<9c0LUBJE_7t_zj6p-%k`HA;#>Ml=&uFF+qk($)sU14rHc) zHLv*&_c9xFOobsp*AGHtwkc&&vR3399KLI@R~dVvAutoI{>&jwjV#IESY7%~DqBKR ze_Y*!iO39YKBo7w`Nv{F+hWp^CvXNRz>{Tc#S~A-_THg!V51c+C+LfJk`KM=O*&+5 z1aV32ro1IjoQ41@YYAzba_n-|*##Es8ce%%alwJZaa&<>m7t$7Ia>dt3M86Htl&h| zl$RPo-KMQJS*p>LjpdQ-GOSI@ab>J9jz6OXy2TO4l|pgJvc7l}6HRerfnnSMMN2FL z)`nxQQlFvf)qkbPJj@QS$o1n8szbHd(B#A-lXq;f^C9OCbWu`1Ti?i>ww=TUaM zD;^)CO$3vh+S0;JO=fR*NFHHCFeL_A(rq+|aZ!qDV8QC}$cDrnVc{PC2zlad*Evyp zY}!akyg_5Wb7aKmdtFD$=xmR>vNRXJ7^!1st(4>xcY2$!rmXA53OSU(;Jh3w-t_WoGih(vNm*VOwn~`|K0CexQV>PYQIg%+!7;j0enx z9&tb~JZVfjtmtzX#~1Ts9>x&n5g7@l8Fmlflw9nE2A=sB2fCU9_A#s&m#DN6ZB{Wx zOmw7XQ8sUNs>ipE7U<2zL3)vf6@z{vDX2%fb8m613_>6rl z0)iB&Z0}98w6c#&(ft9eC+w__QI3Esj%&sP+6Vt*Zu_`^J>r`t5Vs2yGv)Zp5FQtF zS!LIFo2upUf#DL(y2;|itq{;*m?~Xe=E>rui|EOzSsa*C z_JJbPZHQjt9%v=j3DQalSm;bU3(1y(8=v+@v(#@l#-y*!qjF*sUWt2Q)vOwW5M^&j zkycQ{A7AznTFXUGna;4T Date: Sat, 1 Jul 2006 07:26:10 +0000 Subject: [PATCH 004/301] Initial 1.00 git-svn-id: svn://svn.code.sf.net/p/axtls/code/tags/release-1.0.0@8 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 From d7fc5b7f04837435ac7efadd21efa86a49fd5bc6 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 1 Jul 2006 07:35:12 +0000 Subject: [PATCH 005/301] Initial 1.00 git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@11 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 From f8e703ed65067bb5c161e23b431e552af70be6aa Mon Sep 17 00:00:00 2001 From: cameronrich Date: Tue, 4 Jul 2006 21:47:18 +0000 Subject: [PATCH 006/301] Updated LGPL licenses git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@12 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- bindings/Config.in | 1 - config/config.h | 116 --------------------------------------------- ssl/Config.in | 6 +-- ssl/Makefile | 10 ++-- ssl/aes.c | 10 ++-- ssl/asn1.c | 8 ++-- ssl/bigint.c | 8 ++-- ssl/bigint.h | 10 ++-- ssl/bigint_impl.h | 8 ++-- ssl/crypto.h | 10 ++-- ssl/crypto_misc.c | 8 ++-- ssl/hmac.c | 8 ++-- ssl/loader.c | 8 ++-- ssl/md5.c | 8 ++-- ssl/os_port.c | 10 ++-- ssl/os_port.h | 8 ++-- ssl/p12.c | 8 ++-- ssl/rc4.c | 10 ++-- ssl/rsa.c | 8 ++-- ssl/sha1.c | 8 ++-- ssl/ssl.h | 10 ++-- ssl/tls1.c | 10 ++-- ssl/tls1.h | 10 ++-- ssl/tls1_clnt.c | 8 ++-- ssl/tls1_svr.c | 8 ++-- 25 files changed, 100 insertions(+), 217 deletions(-) delete mode 100644 config/config.h diff --git a/bindings/Config.in b/bindings/Config.in index a268f80787..5af0c0ce54 100644 --- a/bindings/Config.in +++ b/bindings/Config.in @@ -69,7 +69,6 @@ config CONFIG_PERL_BINDINGS Build Perl bindings. Current Issues (see README): - * Doesn't work under Win32 ActiveState Perl. * 64 bit versions don't work at present. * libperl.so needs to be in the shared library path. diff --git a/config/config.h b/config/config.h deleted file mode 100644 index 56d8e8a8df..0000000000 --- a/config/config.h +++ /dev/null @@ -1,116 +0,0 @@ -/* - * Automatically generated header file: don't edit - */ - -#define HAVE_DOT_CONFIG 1 -#undef CONFIG_PLATFORM_LINUX -#undef CONFIG_PLATFORM_CYGWIN -#undef CONFIG_PLATFORM_SOLARIS -#define CONFIG_PLATFORM_WIN32 1 - -/* - * General Configuration - */ -#undef CONFIG_DEBUG - -/* - * Microsoft Compiler Options - */ -#undef CONFIG_VISUAL_STUDIO_6_0 -#define CONFIG_VISUAL_STUDIO_7_0 1 -#undef CONFIG_VISUAL_STUDIO_8_0 -#define CONFIG_VISUAL_STUDIO_6_0_BASE "" -#define CONFIG_VISUAL_STUDIO_7_0_BASE "c:\\Program Files\\Microsoft Visual Studio .NET 2003" -#define CONFIG_VISUAL_STUDIO_8_0_BASE "" -#define CONFIG_EXTRA_CFLAGS_OPTIONS "" -#define CONFIG_EXTRA_LDFLAGS_OPTIONS "" - -/* - * SSL Library - */ -#undef CONFIG_SSL_SERVER_ONLY -#undef CONFIG_SSL_CERT_VERIFICATION -#undef CONFIG_SSL_ENABLE_CLIENT -#define CONFIG_SSL_FULL_MODE 1 -#undef CONFIG_SSL_SKELETON_MODE -#undef CONFIG_SSL_PROT_LOW -#define CONFIG_SSL_PROT_MEDIUM 1 -#undef CONFIG_SSL_PROT_HIGH -#define CONFIG_SSL_USE_DEFAULT_KEY 1 -#define CONFIG_SSL_ENABLE_V23_HANDSHAKE 1 -#define CONFIG_SSL_HAS_PEM 1 -#define CONFIG_SSL_USE_PKCS12 1 -#define CONFIG_SSL_EXPIRY_TIME 24 -#define CONFIG_X509_MAX_CA_CERTS 4 -#define CONFIG_SSL_MAX_CERTS 2 -#undef CONFIG_USE_DEV_URANDOM -#define CONFIG_WIN32_USE_CRYPTO_LIB 1 -#undef CONFIG_PERFORMANCE_TESTING -#define CONFIG_SSL_TEST 1 -#define CONFIG_AWHTTPD 1 - -/* - * Awhttpd Configuration - */ -#undef CONFIG_HTTP_STATIC_BUILD -#define CONFIG_HTTP_HAS_SSL 1 -#define CONFIG_HTTP_HTTPS_PORT 443 -#undef CONFIG_STANDARD_AWHTTPD -#define CONFIG_HTTP_WEBROOT "www" -#define CONFIG_HTTP_PORT 80 -#undef CONFIG_HTTP_USE_TIMEOUT -#define CONFIG_HTTP_TIMEOUT -#define CONFIG_HTTP_INITIAL_SLOTS 10 -#define CONFIG_HTTP_MAX_USERS 100 -#undef CONFIG_HTTP_HAS_CGI -#define CONFIG_HTTP_CGI_EXTENSION "" -#undef CONFIG_HTTP_DIRECTORIES -#undef CONFIG_HTTP_PERM_CHECK -#undef CONFIG_HTTP_HAS_IPV6 -#define CONFIG_HTTP_VERBOSE 1 -#undef CONFIG_HTTP_IS_DAEMON - -/* - * Language Bindings - */ -#define CONFIG_BINDINGS 1 -#define CONFIG_CSHARP_BINDINGS 1 -#define CONFIG_VBNET_BINDINGS 1 - -/* - * .Net Framework - */ -#define CONFIG_DOT_NET_FRAMEWORK_BASE "c:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727" -#define CONFIG_JAVA_BINDINGS 1 - -/* - * Java Home - */ -#define CONFIG_JAVA_HOME "c:\\Program Files\\Java\\jdk1.5.0_06" -#undef CONFIG_PERL_BINDINGS -#define CONFIG_PERL_CORE "" -#define CONFIG_PERL_LIB "" - -/* - * Samples - */ -#define CONFIG_SAMPLES 1 -#define CONFIG_C_SAMPLES 1 -#define CONFIG_CSHARP_SAMPLES 1 -#define CONFIG_VBNET_SAMPLES 1 -#define CONFIG_JAVA_SAMPLES 1 -#undef CONFIG_PERL_SAMPLES - -/* - * BigInt Options - */ -#undef CONFIG_BIGINT_CLASSICAL -#undef CONFIG_BIGINT_MONTGOMERY -#define CONFIG_BIGINT_BARRETT 1 -#define CONFIG_BIGINT_CRT 1 -#undef CONFIG_BIGINT_KARATSUBA -#define MUL_KARATSUBA_THRESH -#define SQU_KARATSUBA_THRESH -#define CONFIG_BIGINT_SLIDING_WINDOW 1 -#define CONFIG_BIGINT_SQUARE 1 -#undef CONFIG_BIGINT_CHECK_ON diff --git a/ssl/Config.in b/ssl/Config.in index ff3aba5975..7607f750a4 100644 --- a/ssl/Config.in +++ b/ssl/Config.in @@ -161,16 +161,16 @@ config CONFIG_SSL_USE_PKCS12 default y if CONFIG_SSL_FULL_MODE depends on !CONFIG_SSL_SERVER_ONLY && !CONFIG_SSL_SKELETON_MODE help - PKCS12 certificates combine private keys and certificates together in + PKCS#12 certificates combine private keys and certificates together in one file. - PKCS8 private keys are also suppported (as it is a subset of PKCS12). + PKCS#8 private keys are also suppported (as it is a subset of PKCS#12). The decryption of these certificates uses RC4-128 (and these certificates must be encrypted using this cipher). The actual algorithm is "PBE-SHA1-RC4-128". - Disable if PKCS12 is not used (which will be in most cases). + Disable if PKCS#12 is not used (which will be in most cases). config CONFIG_SSL_EXPIRY_TIME int "Session expiry time (in hours)" diff --git a/ssl/Makefile b/ssl/Makefile index 2b0b6aa65f..476576c1ce 100644 --- a/ssl/Makefile +++ b/ssl/Makefile @@ -1,17 +1,17 @@ # # Copyright(C) 2006 # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by +# This library is free software; you can redistribute it and/or modify +# it under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # -# This program is distributed in the hope that it will be useful, +# This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# GNU Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License +# You should have received a copy of the GNU Lesser General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # diff --git a/ssl/aes.c b/ssl/aes.c index 7c41c753fe..9a696fc77a 100644 --- a/ssl/aes.c +++ b/ssl/aes.c @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. + * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/asn1.c b/ssl/asn1.c index fa44dfbe63..42de09ba12 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2.1 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/bigint.c b/ssl/bigint.c index 9702dc4fcc..99c7b508db 100644 --- a/ssl/bigint.c +++ b/ssl/bigint.c @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2.1 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/bigint.h b/ssl/bigint.h index c98b3837d0..d607174fe5 100644 --- a/ssl/bigint.h +++ b/ssl/bigint.h @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. + * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/bigint_impl.h b/ssl/bigint_impl.h index 1897fec16d..8a0104ab1a 100644 --- a/ssl/bigint_impl.h +++ b/ssl/bigint_impl.h @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2.1 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/crypto.h b/ssl/crypto.h index df25e64029..8f7dc643e6 100644 --- a/ssl/crypto.h +++ b/ssl/crypto.h @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. + * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/crypto_misc.c b/ssl/crypto_misc.c index b98181f025..76cc36a165 100644 --- a/ssl/crypto_misc.c +++ b/ssl/crypto_misc.c @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2.1 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/hmac.c b/ssl/hmac.c index 289892a48f..8fb0439606 100644 --- a/ssl/hmac.c +++ b/ssl/hmac.c @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2.1 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/loader.c b/ssl/loader.c index 5f43d4982c..a41a300934 100644 --- a/ssl/loader.c +++ b/ssl/loader.c @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2.1 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/md5.c b/ssl/md5.c index 95adab8648..3f5ec030f9 100644 --- a/ssl/md5.c +++ b/ssl/md5.c @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2.1 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/os_port.c b/ssl/os_port.c index b278c4a291..01ab779646 100644 --- a/ssl/os_port.c +++ b/ssl/os_port.c @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. + * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/os_port.h b/ssl/os_port.h index 73f4d9be28..049dce083e 100644 --- a/ssl/os_port.h +++ b/ssl/os_port.h @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/p12.c b/ssl/p12.c index ec84b8b14d..54a8e4622c 100644 --- a/ssl/p12.c +++ b/ssl/p12.c @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2.1 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/rc4.c b/ssl/rc4.c index a9ce82ccbb..8126b4f148 100644 --- a/ssl/rc4.c +++ b/ssl/rc4.c @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. + * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/rsa.c b/ssl/rsa.c index c6fe654cbf..d433730717 100644 --- a/ssl/rsa.c +++ b/ssl/rsa.c @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2.1 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/sha1.c b/ssl/sha1.c index e1d259c6eb..5f6b2c3b2a 100644 --- a/ssl/sha1.c +++ b/ssl/sha1.c @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2.1 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/ssl.h b/ssl/ssl.h index 687104e629..bcac9ef72b 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. + * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/tls1.c b/ssl/tls1.c index f3a4a1c5dc..d70f73b346 100644 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2.1 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU General Lesser License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ @@ -1581,7 +1581,7 @@ SSL_SESS *ssl_session_update(int max_sessions, ssl->session_index = i; return ssl_sessions[i]; /* return the session object */ } - else if (ssl_sessions[i]->conn_time < oldest_sess_time) + else if (ssl_sessions[i]->conn_time <= oldest_sess_time) { /* find the oldest session */ oldest_sess_time = ssl_sessions[i]->conn_time; diff --git a/ssl/tls1.h b/ssl/tls1.h index be8cc1f957..c0c2196027 100644 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. + * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index 7043876429..6ddd799a2c 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2.1 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index ff0eb62a52..1226e85a80 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -1,17 +1,17 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2.1 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License + * You should have received a copy of the GNU Lesser General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ From da46383ade9ebd4ac08725d17a3a5453cbf9b9e1 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 5 Jul 2006 08:16:26 +0000 Subject: [PATCH 007/301] More LGPL license changes git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@13 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- LICENSE | 178 ++++++++++++++++++++ Makefile | 12 +- bindings/Makefile | 12 +- bindings/generate_SWIG_interface.pl | 12 +- bindings/generate_interface.pl | 12 +- config/JMeter.jmx | 250 ++++++++++++++++++++++++++++ config/makefile.conf | 12 +- config/makefile.dotnet.conf | 10 +- config/makefile.java.conf | 10 +- ssl/Makefile | 2 +- ssl/aes.c | 2 +- ssl/asn1.c | 2 +- ssl/bigint.c | 2 +- ssl/bigint.h | 2 +- ssl/bigint_impl.h | 2 +- ssl/crypto.h | 2 +- ssl/crypto_misc.c | 2 +- ssl/hmac.c | 2 +- ssl/loader.c | 2 +- ssl/md5.c | 2 +- ssl/os_port.c | 2 +- ssl/os_port.h | 2 +- ssl/p12.c | 2 +- ssl/rc4.c | 2 +- ssl/rsa.c | 2 +- ssl/sha1.c | 2 +- ssl/ssl.h | 2 +- ssl/test/Makefile | 12 +- ssl/test/make_certs.sh | 12 +- ssl/test/perf_bigint.c | 12 +- ssl/test/ssltest.c | 12 +- ssl/test/test_axssl.sh | 12 +- ssl/tls1.c | 2 +- ssl/tls1.h | 2 +- ssl/tls1_clnt.c | 2 +- ssl/tls1_svr.c | 2 +- 36 files changed, 520 insertions(+), 92 deletions(-) create mode 100644 LICENSE create mode 100755 config/JMeter.jmx diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000000..32e42d5a8a --- /dev/null +++ b/LICENSE @@ -0,0 +1,178 @@ +GNU LESSER GENERAL PUBLIC LICENSE + +Version 2.1, February 1999 + +Copyright (C) 1991, 1999 Free Software Foundation, Inc. +51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +Everyone is permitted to copy and distribute verbatim copies +of this license document, but changing it is not allowed. + +[This is the first released version of the Lesser GPL. It also counts + as the successor of the GNU Library Public License, version 2, hence + the version number 2.1.] + +Preamble + +The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. + +This license, the Lesser General Public License, applies to some specially designated software packages--typically libraries--of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below. + +When we speak of free software, we are referring to freedom of use, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish); that you receive source code or can get it if you want it; that you can change the software and use pieces of it in new free programs; and that you are informed that you can do these things. + +To protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library or if you modify it. + +For example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights. + +We protect your rights with a two-step method: (1) we copyright the library, and (2) we offer you this license, which gives you legal permission to copy, distribute and/or modify the library. + +To protect each distributor, we want to make it very clear that there is no warranty for the free library. Also, if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others. + +Finally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license. + +Most GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs. + +When a program is linked with a library, whether statically or using a shared library, the combination of the two is legally speaking a combined work, a derivative of the original library. The ordinary General Public License therefore permits such linking only if the entire combination fits its criteria of freedom. The Lesser General Public License permits more lax criteria for linking other code with the library. + +We call this license the "Lesser" General Public License because it does Less to protect the user's freedom than the ordinary General Public License. It also provides other free software developers Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances. + +For example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License. + +In other cases, permission to use a particular library in non-free programs enables a greater number of people to use a large body of free software. For example, permission to use the GNU C Library in non-free programs enables many more people to use the whole GNU operating system, as well as its variant, the GNU/Linux operating system. + +Although the Lesser General Public License is Less protective of the users' freedom, it does ensure that the user of a program that is linked with the Library has the freedom and the wherewithal to run that program using a modified version of the Library. + +The precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, whereas the latter must be combined with the library in order to run. + +TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + +0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you". + +A "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables. + +The "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".) + +"Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library. + +Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does. + +1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library. + +You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. + +2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: + + * a) The modified work must itself be a software library. + * b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change. + * c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License. + * d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful. + + (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.) + + These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. + + Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library. + + In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. + +3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices. + +Once this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy. + +This option is useful when you wish to copy part of the code of the Library into a program that is not a library. + +4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange. + +If distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code. + +5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License. + +However, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables. + +When a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law. + +If such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.) + +Otherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself. + +6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications. + +You must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things: + + * a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.) + * b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with. + * c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution. + * d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place. + * e) Verify that the user has already received a copy of these materials or that you have already sent this user a copy. + +For an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the materials to be distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. + +It may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute. + +7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things: + + * a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above. + * b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work. + +8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. + +9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it. + +10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License. + +11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library. + +If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances. + +It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. + +This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. + +12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. + +13. The Free Software Foundation may publish revised and/or new versions of the Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. + +Each version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation. + +14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. + +NO WARRANTY + +15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + +16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. + +END OF TERMS AND CONDITIONS +How to Apply These Terms to Your New Libraries + +If you develop a new library, and you want it to be of the greatest possible use to the public, we recommend making it free software that everyone can redistribute and change. You can do so by permitting redistribution under these terms (or, alternatively, under the terms of the ordinary General Public License). + +To apply these terms, attach the following notices to the library. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. + +one line to give the library's name and an idea of what it does. +Copyright (C) year name of author + +This library is free software; you can redistribute it and/or +modify it under the terms of the GNU Lesser General Public +License as published by the Free Software Foundation; either +version 2.1 of the License, or (at your option) any later version. + +This library is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +Lesser General Public License for more details. + +You should have received a copy of the GNU Lesser General Public +License along with this library; if not, write to the Free Software +Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + +Also add information on how to contact you by electronic and paper mail. + +You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the library, if necessary. Here is a sample; alter the names: + +Yoyodyne, Inc., hereby disclaims all copyright interest in +the library `Frob' (a library for tweaking knobs) written +by James Random Hacker. + +signature of Ty Coon, 1 April 1990 +Ty Coon, President of Vice + diff --git a/Makefile b/Makefile index e335b82c85..ce029b92fc 100644 --- a/Makefile +++ b/Makefile @@ -1,18 +1,18 @@ # # Copyright(C) 2006 # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by +# This license is free software; you can redistribute it and/or modify +# it under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # -# This program is distributed in the hope that it will be useful, +# This license is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# GNU Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software +# You should have received a copy of the GNU Lesser General Public License +# along with this license; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # diff --git a/bindings/Makefile b/bindings/Makefile index 47b48befca..8f1fc88596 100644 --- a/bindings/Makefile +++ b/bindings/Makefile @@ -1,18 +1,18 @@ # # Copyright(C) 2006 # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by +# This library is free software; you can redistribute it and/or modify +# it under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # -# This program is distributed in the hope that it will be useful, +# This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# GNU Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software +# You should have received a copy of the GNU Lesser General Public License +# along with this library; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # diff --git a/bindings/generate_SWIG_interface.pl b/bindings/generate_SWIG_interface.pl index 7509e17cfe..c4a98ffcef 100755 --- a/bindings/generate_SWIG_interface.pl +++ b/bindings/generate_SWIG_interface.pl @@ -3,18 +3,18 @@ # # Copyright(C) 2006 # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by +# This library is free software; you can redistribute it and/or modify +# it under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # -# This program is distributed in the hope that it will be useful, +# This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# GNU Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software +# You should have received a copy of the GNU Lesser General Public License +# along with this library; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # diff --git a/bindings/generate_interface.pl b/bindings/generate_interface.pl index a063ea2cc7..067dead21b 100755 --- a/bindings/generate_interface.pl +++ b/bindings/generate_interface.pl @@ -3,18 +3,18 @@ # # Copyright(C) 2006 # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by +# This library is free software; you can redistribute it and/or modify +# it under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # -# This program is distributed in the hope that it will be useful, +# This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# GNU Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software +# You should have received a copy of the GNU Lesser General Public License +# along with this library; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # diff --git a/config/JMeter.jmx b/config/JMeter.jmx new file mode 100755 index 0000000000..0ef7c74696 --- /dev/null +++ b/config/JMeter.jmx @@ -0,0 +1,250 @@ + + + + + + + + true + false + + + + + 1152004173000 + + + 16 + false + + 10 + false + + 1152004173000 + stopthread + 0 + + + + /index.html + GET + true + + true + 80 + + + + + + false + 127.0.0.1 + + false + + + + + 1152004173000 + + + 16 + false + + 10 + false + + 1152004173000 + continue + 0 + + + + /index.html + GET + true + HTTPS + true + 443 + + + + + + false + 127.0.0.1 + + false + + + + + 1152004173000 + + + 16 + false + + 10 + false + + 1152004173000 + continue + 0 + + + + /index.html + GET + true + HTTPS + true + 1443 + + + + + + false + 127.0.0.1 + + false + + + + + 1152004173000 + + + 16 + false + + 10 + false + + 1152004173000 + stopthread + 0 + + + + /index.html + GET + true + HTTPS + true + 2443 + + + + + + false + 127.0.0.1 + + false + + + + + 1152004173000 + + + 16 + false + + 10 + false + + 1152004173000 + stopthread + 0 + + + + /index.html + GET + true + HTTPS + true + 3443 + + + + + + false + 127.0.0.1 + + false + + + + + 1152004173000 + + + 16 + false + + 10 + false + + 1152004173000 + stopthread + 0 + + + + /index.html + GET + true + HTTPS + true + 4443 + + + + + + false + 127.0.0.1 + + false + + + + + + + + true + true + true + + true + true + true + true + false + true + true + false + false + false + false + false + false + false + false + 0 + + saveConfig + + + false + + + + + diff --git a/config/makefile.conf b/config/makefile.conf index 744234c4c0..c1167e5d84 100644 --- a/config/makefile.conf +++ b/config/makefile.conf @@ -1,18 +1,18 @@ # # Copyright(C) 2006 # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by +# This library is free software; you can redistribute it and/or modify +# it under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # -# This program is distributed in the hope that it will be useful, +# This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# GNU Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software +# You should have received a copy of the GNU Lesser General Public License +# along with this library; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # diff --git a/config/makefile.dotnet.conf b/config/makefile.dotnet.conf index 7589550c74..23baf70c5b 100644 --- a/config/makefile.dotnet.conf +++ b/config/makefile.dotnet.conf @@ -1,17 +1,17 @@ # # Copyright(C) 2006 # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by +# This library is free software; you can redistribute it and/or modify +# it under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # -# This program is distributed in the hope that it will be useful, +# This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# GNU Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License +# You should have received a copy of the GNU Lesser General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # diff --git a/config/makefile.java.conf b/config/makefile.java.conf index 1ecce11940..59bde86139 100644 --- a/config/makefile.java.conf +++ b/config/makefile.java.conf @@ -1,17 +1,17 @@ # # Copyright(C) 2006 # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by +# This library is free software; you can redistribute it and/or modify +# it under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # -# This program is distributed in the hope that it will be useful, +# This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# GNU Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License +# You should have received a copy of the GNU Lesser General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # diff --git a/ssl/Makefile b/ssl/Makefile index 476576c1ce..ab4db3d9d5 100644 --- a/ssl/Makefile +++ b/ssl/Makefile @@ -12,7 +12,7 @@ # GNU Lesser General Public License for more details. # # You should have received a copy of the GNU Lesser General Public License -# along with this program; if not, write to the Free Software +# along with this library; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # diff --git a/ssl/aes.c b/ssl/aes.c index 9a696fc77a..74e8b666ef 100644 --- a/ssl/aes.c +++ b/ssl/aes.c @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/asn1.c b/ssl/asn1.c index 42de09ba12..6e67d3c7d4 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/bigint.c b/ssl/bigint.c index 99c7b508db..797ca21703 100644 --- a/ssl/bigint.c +++ b/ssl/bigint.c @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/bigint.h b/ssl/bigint.h index d607174fe5..2291f5c878 100644 --- a/ssl/bigint.h +++ b/ssl/bigint.h @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/bigint_impl.h b/ssl/bigint_impl.h index 8a0104ab1a..9d48182866 100644 --- a/ssl/bigint_impl.h +++ b/ssl/bigint_impl.h @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/crypto.h b/ssl/crypto.h index 8f7dc643e6..8a79a84f15 100644 --- a/ssl/crypto.h +++ b/ssl/crypto.h @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/crypto_misc.c b/ssl/crypto_misc.c index 76cc36a165..8591aacd9e 100644 --- a/ssl/crypto_misc.c +++ b/ssl/crypto_misc.c @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/hmac.c b/ssl/hmac.c index 8fb0439606..cafb2642a4 100644 --- a/ssl/hmac.c +++ b/ssl/hmac.c @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/loader.c b/ssl/loader.c index a41a300934..400847b856 100644 --- a/ssl/loader.c +++ b/ssl/loader.c @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/md5.c b/ssl/md5.c index 3f5ec030f9..c682e11ea6 100644 --- a/ssl/md5.c +++ b/ssl/md5.c @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/os_port.c b/ssl/os_port.c index 01ab779646..19932293ea 100644 --- a/ssl/os_port.c +++ b/ssl/os_port.c @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/os_port.h b/ssl/os_port.h index 049dce083e..b8354cb6ce 100644 --- a/ssl/os_port.h +++ b/ssl/os_port.h @@ -12,7 +12,7 @@ * GNU General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/p12.c b/ssl/p12.c index 54a8e4622c..2d198dc90e 100644 --- a/ssl/p12.c +++ b/ssl/p12.c @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/rc4.c b/ssl/rc4.c index 8126b4f148..acb5f14f2f 100644 --- a/ssl/rc4.c +++ b/ssl/rc4.c @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/rsa.c b/ssl/rsa.c index d433730717..f401cf2859 100644 --- a/ssl/rsa.c +++ b/ssl/rsa.c @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/sha1.c b/ssl/sha1.c index 5f6b2c3b2a..1f06732352 100644 --- a/ssl/sha1.c +++ b/ssl/sha1.c @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/ssl.h b/ssl/ssl.h index bcac9ef72b..27b1f3903b 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/test/Makefile b/ssl/test/Makefile index ddf3526b95..d8f9474511 100644 --- a/ssl/test/Makefile +++ b/ssl/test/Makefile @@ -1,18 +1,18 @@ # # Copyright(C) 2006 # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by +# This library is free software; you can redistribute it and/or modify +# it under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # -# This program is distributed in the hope that it will be useful, +# This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# GNU Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software +# You should have received a copy of the GNU Lesser General Public License +# along with this library; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # diff --git a/ssl/test/make_certs.sh b/ssl/test/make_certs.sh index 57d2a10f8a..0e58d73bc3 100755 --- a/ssl/test/make_certs.sh +++ b/ssl/test/make_certs.sh @@ -3,18 +3,18 @@ # # Copyright(C) 2006 # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by +# This license is free software; you can redistribute it and/or modify +# it under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # -# This program is distributed in the hope that it will be useful, +# This license is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# GNU Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software +# You should have received a copy of the GNU Lesser General Public License +# along with this license; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # diff --git a/ssl/test/perf_bigint.c b/ssl/test/perf_bigint.c index 116a1ba013..0bd1e9f8b9 100644 --- a/ssl/test/perf_bigint.c +++ b/ssl/test/perf_bigint.c @@ -1,18 +1,18 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This license is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. + * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software + * You should have received a copy of the GNU Lesser General Public License + * along with this license; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 7c547ef222..aec29106c5 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1,18 +1,18 @@ /* * Copyright(C) 2006 * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by + * This license is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * - * This program is distributed in the hope that it will be useful, + * This license is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. + * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software + * You should have received a copy of the GNU Lesser General Public License + * along with this license; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/test/test_axssl.sh b/ssl/test/test_axssl.sh index 4a22985fde..01ede465f9 100755 --- a/ssl/test/test_axssl.sh +++ b/ssl/test/test_axssl.sh @@ -3,18 +3,18 @@ # # Copyright(C) 2006 # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by +# This license is free software; you can redistribute it and/or modify +# it under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # -# This program is distributed in the hope that it will be useful, +# This license is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# GNU Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software +# You should have received a copy of the GNU Lesser General Public License +# along with this license; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # diff --git a/ssl/tls1.c b/ssl/tls1.c index d70f73b346..41484949f3 100644 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU General Lesser License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/tls1.h b/ssl/tls1.h index c0c2196027..9f611f7750 100644 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index 6ddd799a2c..45d4bca5c2 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index 1226e85a80..061cfcb387 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -12,7 +12,7 @@ * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software + * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ From 818037c8e3f46160a8ad731fb3548c04485b0190 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 7 Jul 2006 10:58:03 +0000 Subject: [PATCH 008/301] Added the health.sh CGI script git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@14 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- README | 4 +++- config/win32config | 14 +++++++------- docsrc/Makefile | 12 ++++++------ www/test_dir/health.sh | 21 +++++++++++++++++++++ www/test_dir/tmp | 1 + 5 files changed, 38 insertions(+), 14 deletions(-) create mode 100755 www/test_dir/health.sh create mode 120000 www/test_dir/tmp diff --git a/README b/README index 2d6d7b990a..ead37bb977 100644 --- a/README +++ b/README @@ -136,7 +136,9 @@ Win32 issues this. * The test harness appears to be broken under VC8.0. Debugging shows a problem - the _close() function which is weird. + the _close() function which is weird. CGI is also broken under VC8.0. + +* CGI works under Win32, but needs some more work to get it right. Solaris issues ============== diff --git a/config/win32config b/config/win32config index 5740814929..4c197c83f7 100644 --- a/config/win32config +++ b/config/win32config @@ -16,11 +16,11 @@ CONFIG_PLATFORM_WIN32=y # Microsoft Compiler Options # # CONFIG_VISUAL_STUDIO_6_0 is not set -# CONFIG_VISUAL_STUDIO_7_0 is not set -CONFIG_VISUAL_STUDIO_8_0=y +CONFIG_VISUAL_STUDIO_7_0=y +# CONFIG_VISUAL_STUDIO_8_0 is not set CONFIG_VISUAL_STUDIO_6_0_BASE="" -CONFIG_VISUAL_STUDIO_7_0_BASE="" -CONFIG_VISUAL_STUDIO_8_0_BASE="c:\\Program Files\\Microsoft Visual Studio 8" +CONFIG_VISUAL_STUDIO_7_0_BASE="c:\\Program Files\\Microsoft Visual Studio .NET 2003" +CONFIG_VISUAL_STUDIO_8_0_BASE="" CONFIG_EXTRA_CFLAGS_OPTIONS="" CONFIG_EXTRA_LDFLAGS_OPTIONS="" @@ -61,9 +61,9 @@ CONFIG_HTTP_PORT=80 CONFIG_HTTP_TIMEOUT=0 CONFIG_HTTP_INITIAL_SLOTS=10 CONFIG_HTTP_MAX_USERS=100 -# CONFIG_HTTP_HAS_CGI is not set -CONFIG_HTTP_CGI_EXTENSION="" -# CONFIG_HTTP_DIRECTORIES is not set +CONFIG_HTTP_HAS_CGI=y +CONFIG_HTTP_CGI_EXTENSION=".php" +CONFIG_HTTP_DIRECTORIES=y # CONFIG_HTTP_PERM_CHECK is not set # CONFIG_HTTP_HAS_IPV6 is not set CONFIG_HTTP_VERBOSE=y diff --git a/docsrc/Makefile b/docsrc/Makefile index 574d5ebda9..a9a1e502c5 100644 --- a/docsrc/Makefile +++ b/docsrc/Makefile @@ -1,18 +1,18 @@ # # Copyright(C) 2006 # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by +# This library is free software; you can redistribute it and/or modify +# it under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # -# This program is distributed in the hope that it will be useful, +# This license is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# GNU Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software +# You should have received a copy of the GNU Lesser General Public License +# along with this license; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # diff --git a/www/test_dir/health.sh b/www/test_dir/health.sh new file mode 100755 index 0000000000..4a4cdfb417 --- /dev/null +++ b/www/test_dir/health.sh @@ -0,0 +1,21 @@ +#!/bin/sh + +echo "Content-type: text/html" +echo + +echo "" +echo "System Health" + +echo "

    System Health for '`hostname`'

    " +echo "

    Processes

    " +echo "" +ps -ef | sed -e "s/\(.*\)/
    \1<\/td><\/tr>/" +echo "
    " + +echo "

    Free FileSystem Space

    " +echo "" +df -h . | sed -e "s/\(.*\)/
    \1<\/td><\/tr>/" +echo "
    " + +echo "" + diff --git a/www/test_dir/tmp b/www/test_dir/tmp new file mode 120000 index 0000000000..cad2309100 --- /dev/null +++ b/www/test_dir/tmp @@ -0,0 +1 @@ +/tmp \ No newline at end of file From e8254fa575391e0693806235447ca7a789b95424 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 7 Jul 2006 11:10:18 +0000 Subject: [PATCH 009/301] http/https directory listing issue fixed git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@15 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/awhttpd.patch | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/httpd/awhttpd.patch b/httpd/awhttpd.patch index 932c0583ec..ab63d6416f 100644 --- a/httpd/awhttpd.patch +++ b/httpd/awhttpd.patch @@ -1,6 +1,6 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h --- awhttpd/aw3.h 2005-01-23 13:17:14.000000000 +1000 -+++ axTLS/httpd/awhttpd/aw3.h 2006-06-28 20:38:44.921875000 +1000 ++++ axTLS/httpd/awhttpd/aw3.h 2006-07-07 20:37:30.890625000 +1000 @@ -7,17 +7,16 @@ */ @@ -173,7 +173,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h +void initlists(void); diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c --- awhttpd/cgi.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/cgi.c 2006-06-28 20:38:44.921875000 +1000 ++++ axTLS/httpd/awhttpd/cgi.c 2006-07-07 20:37:30.890625000 +1000 @@ -7,29 +7,33 @@ */ @@ -362,7 +362,7 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c +#endif /* CONFIG_HTTP_HAS_CGI */ diff -Naur awhttpd/conf.c axTLS/httpd/awhttpd/conf.c --- awhttpd/conf.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/conf.c 2006-06-28 20:38:44.921875000 +1000 ++++ axTLS/httpd/awhttpd/conf.c 2006-07-07 20:37:30.890625000 +1000 @@ -10,11 +10,7 @@ #include #include @@ -450,7 +450,7 @@ diff -Naur awhttpd/conf.c axTLS/httpd/awhttpd/conf.c +#endif /* CONFIG_STANDARD_AWHTTPD */ diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c --- awhttpd/conn.c 2004-12-07 16:11:02.000000000 +1000 -+++ axTLS/httpd/awhttpd/conn.c 2006-06-28 20:38:44.921875000 +1000 ++++ axTLS/httpd/awhttpd/conn.c 2006-07-07 20:37:30.890625000 +1000 @@ -9,15 +9,11 @@ #include @@ -525,7 +525,7 @@ diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c return; diff -Naur awhttpd/errors.c axTLS/httpd/awhttpd/errors.c --- awhttpd/errors.c 2005-01-23 06:49:29.000000000 +1000 -+++ axTLS/httpd/awhttpd/errors.c 2006-06-28 20:38:44.937500000 +1000 ++++ axTLS/httpd/awhttpd/errors.c 2006-07-07 20:37:30.890625000 +1000 @@ -8,7 +8,6 @@ @@ -562,7 +562,7 @@ diff -Naur awhttpd/errors.c axTLS/httpd/awhttpd/errors.c char buf[1024]; diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c --- awhttpd/index.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/index.c 2006-06-28 20:38:44.937500000 +1000 ++++ axTLS/httpd/awhttpd/index.c 2006-07-07 20:37:30.890625000 +1000 @@ -11,7 +11,6 @@ #include #include @@ -588,7 +588,7 @@ diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c my_strncpy(cn->actualfile, tbuf, MAXREQUESTLENGTH); diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c --- awhttpd/main.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/main.c 2006-06-28 20:38:44.937500000 +1000 ++++ axTLS/httpd/awhttpd/main.c 2006-07-07 20:37:30.890625000 +1000 @@ -11,7 +11,6 @@ #include #include @@ -828,7 +828,7 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c return 0; diff -Naur awhttpd/mime_types.c axTLS/httpd/awhttpd/mime_types.c --- awhttpd/mime_types.c 2004-01-26 01:08:47.000000000 +1000 -+++ axTLS/httpd/awhttpd/mime_types.c 2006-06-28 20:38:44.937500000 +1000 ++++ axTLS/httpd/awhttpd/mime_types.c 2006-07-07 20:37:30.890625000 +1000 @@ -21,13 +21,14 @@ @@ -862,7 +862,7 @@ diff -Naur awhttpd/mime_types.c axTLS/httpd/awhttpd/mime_types.c + diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c --- awhttpd/misc.c 2005-01-23 12:59:09.000000000 +1000 -+++ axTLS/httpd/awhttpd/misc.c 2006-06-28 20:38:44.937500000 +1000 ++++ axTLS/httpd/awhttpd/misc.c 2006-07-07 20:37:30.890625000 +1000 @@ -7,33 +7,33 @@ */ @@ -1008,7 +1008,7 @@ diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c +#endif diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c --- awhttpd/net.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/net.c 2006-06-28 20:38:44.937500000 +1000 ++++ axTLS/httpd/awhttpd/net.c 2006-07-07 20:37:30.906250000 +1000 @@ -8,9 +8,7 @@ @@ -1111,7 +1111,7 @@ diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c --- awhttpd/permcheck.c 2005-01-23 06:49:29.000000000 +1000 -+++ axTLS/httpd/awhttpd/permcheck.c 2006-06-28 20:38:44.937500000 +1000 ++++ axTLS/httpd/awhttpd/permcheck.c 2006-07-07 20:37:30.906250000 +1000 @@ -7,21 +7,23 @@ */ @@ -1202,7 +1202,7 @@ diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c +#endif /* CONFIG_HTTP_PERM_CHECK */ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c --- awhttpd/proc.c 2005-01-23 10:59:41.000000000 +1000 -+++ axTLS/httpd/awhttpd/proc.c 2006-06-28 20:47:25.109375000 +1000 ++++ axTLS/httpd/awhttpd/proc.c 2006-07-07 21:07:26.250000000 +1000 @@ -13,14 +13,12 @@ #include #include @@ -1282,8 +1282,9 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c // If the browser doesn't specify a virtual host, the client will // see "http://default/thedir/" instead of "http://thehost.com/thedir/" // Consider this punishment for using such an old browser. - snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n\nDirectory Listing\n

    Directory listing of http://%s%s


    \n", cn->virtualhostreq, cn->filereq); +- snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n\nDirectory Listing\n

    Directory listing of http://%s%s


    \n", cn->virtualhostreq, cn->filereq); - write(cn->networkdesc, buf, strlen(buf)); ++ snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n\nDirectory Listing\n

    Directory listing of %s://%s%s


    \n", cn->is_ssl ? "https" : "http", cn->virtualhostreq, cn->filereq); + special_write(cn, buf, strlen(buf)); cn->state = STATE_DOING_DIR; @@ -1660,7 +1661,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c } diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c --- awhttpd/socket.c 2004-04-25 13:03:05.000000000 +1000 -+++ axTLS/httpd/awhttpd/socket.c 2006-06-28 20:38:44.953125000 +1000 ++++ axTLS/httpd/awhttpd/socket.c 2006-07-07 20:37:30.906250000 +1000 @@ -8,19 +8,11 @@ @@ -1747,7 +1748,7 @@ diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c memset(&(my_addr.sin_zero), 0, 8); // zero the rest of the struct diff -Naur awhttpd/urlencode.c axTLS/httpd/awhttpd/urlencode.c --- awhttpd/urlencode.c 2004-05-14 10:53:47.000000000 +1000 -+++ axTLS/httpd/awhttpd/urlencode.c 2006-06-28 20:38:44.953125000 +1000 ++++ axTLS/httpd/awhttpd/urlencode.c 2006-07-07 20:37:30.906250000 +1000 @@ -13,7 +13,7 @@ #include From 94186b6f216734bdbd660283e95ac675f7312baa Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 8 Jul 2006 00:25:27 +0000 Subject: [PATCH 010/301] Now exclude svn dirs in tar git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@16 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/Makefile b/Makefile index ce029b92fc..c1efd9e503 100644 --- a/Makefile +++ b/Makefile @@ -50,7 +50,7 @@ release: -$(MAKE) clean -@rm config/.* config/config.h -@rm config/*.msi config/*.back.aip - cd ../; tar cvfz $(RELEASE).tar.gz axTLS; cd -; + cd ../; tar cvfz $(RELEASE).tar.gz --wildcards-match-slash --exclude .svn axTLS; cd -; docs: $(MAKE) -C docsrc doco @@ -70,7 +70,8 @@ win32_demo: ./axTLS/axssl.vbnet.exe \ ./axTLS/axtls.jar \ ./axTLS/www/* \ - ./axTLS/www/crypto_files/*; \ + ./axTLS/www/crypto_files/* \ + ./axTLS/www/test_dir/*; \ unzip -d axTLS.release_test $(RELEASE).zip; cd -; # tidy up things @@ -131,5 +132,3 @@ win32releaseconf: config/scripts/config/conf @./config/scripts/config/conf -D config/win32config $(CONFIG_CONFIG_IN) > /dev/null $(MAKE) - - From 2bab7a44a33bfe3c3bbf7658bd8eb669907297d4 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 8 Jul 2006 00:58:36 +0000 Subject: [PATCH 011/301] removed CGI from win32 demo git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@17 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/win32config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/win32config b/config/win32config index 4c197c83f7..ce1e485c68 100644 --- a/config/win32config +++ b/config/win32config @@ -61,8 +61,8 @@ CONFIG_HTTP_PORT=80 CONFIG_HTTP_TIMEOUT=0 CONFIG_HTTP_INITIAL_SLOTS=10 CONFIG_HTTP_MAX_USERS=100 -CONFIG_HTTP_HAS_CGI=y -CONFIG_HTTP_CGI_EXTENSION=".php" +# CONFIG_HTTP_HAS_CGI is not set +CONFIG_HTTP_CGI_EXTENSION="" CONFIG_HTTP_DIRECTORIES=y # CONFIG_HTTP_PERM_CHECK is not set # CONFIG_HTTP_HAS_IPV6 is not set From a10e2dcf017c173b7d5f40d2de2ae44c334a4629 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 8 Jul 2006 01:04:11 +0000 Subject: [PATCH 012/301] version update git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@18 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/awhttpd.aip | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/config/awhttpd.aip b/config/awhttpd.aip index 3b68600ab9..575102d520 100755 --- a/config/awhttpd.aip +++ b/config/awhttpd.aip @@ -8,21 +8,25 @@ - + - + + + + + @@ -30,11 +34,13 @@ + + - + @@ -47,9 +53,9 @@ - - - + + + @@ -59,10 +65,14 @@ + - - + + + + + @@ -91,6 +101,9 @@ + + + From 0a18ed7e9e3258cf5ece8c66f43d2435b88b7b27 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 8 Jul 2006 01:04:38 +0000 Subject: [PATCH 013/301] removed tmp git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@19 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- www/test_dir/tmp | 1 - 1 file changed, 1 deletion(-) delete mode 120000 www/test_dir/tmp diff --git a/www/test_dir/tmp b/www/test_dir/tmp deleted file mode 120000 index cad2309100..0000000000 --- a/www/test_dir/tmp +++ /dev/null @@ -1 +0,0 @@ -/tmp \ No newline at end of file From 5915029090f40bc7fbd1d2969d1e116c2655f811 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 12 Jul 2006 08:57:34 +0000 Subject: [PATCH 014/301] health.sh tweak git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@21 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- www/test_dir/health.sh | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/www/test_dir/health.sh b/www/test_dir/health.sh index 4a4cdfb417..f63013b14d 100755 --- a/www/test_dir/health.sh +++ b/www/test_dir/health.sh @@ -3,19 +3,13 @@ echo "Content-type: text/html" echo -echo "" -echo "System Health" +echo "System Health" echo "

    System Health for '`hostname`'

    " -echo "

    Processes

    " -echo "" +echo "

    Processes

    " ps -ef | sed -e "s/\(.*\)/
    \1<\/td><\/tr>/" -echo "
    " -echo "

    Free FileSystem Space

    " -echo "" +echo "

    Free FileSystem Space

    " +echo "" df -h . | sed -e "s/\(.*\)/
    \1<\/td><\/tr>/" -echo "
    " - -echo "" - +echo "" From 8578256d9ffac69b95da4c401314bc57ba7224c2 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 16 Jul 2006 10:48:14 +0000 Subject: [PATCH 015/301] added a better installer git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@22 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 46 ++++++++----- README | 16 ++--- bindings/java/Makefile | 12 ++-- bindings/perl/Makefile | 24 +++---- config/Config.in | 8 ++- config/makefile.conf | 5 +- httpd/Config.in | 7 +- httpd/Makefile | 14 ++-- samples/c/Makefile | 19 +++--- samples/csharp/Makefile | 2 +- samples/java/Makefile | 6 +- samples/perl/Makefile | 4 +- samples/vbnet/Makefile | 2 +- ssl/Makefile | 22 +++--- ssl/test/Makefile | 24 +++---- ssl/test/perf_bigint.c | 8 +-- ssl/test/ssltest.c | 144 ++++++++++++++++++++-------------------- ssl/test/test_axssl.sh | 57 ++++++++++------ www/test_dir/health.sh | 15 ++--- 19 files changed, 238 insertions(+), 197 deletions(-) diff --git a/Makefile b/Makefile index c1efd9e503..ff4f43f020 100644 --- a/Makefile +++ b/Makefile @@ -24,7 +24,7 @@ else all: target endif -target : $(TARGET) +target : $(STAGE) $(TARGET) include config/makefile.conf @@ -45,11 +45,18 @@ ifdef CONFIG_SAMPLES $(MAKE) -C samples endif +$(STAGE) : + @mkdir -p $(STAGE) + +$(PREFIX) : + @mkdir -p $(PREFIX)/lib + @mkdir -p $(PREFIX)/bin + release: $(MAKE) -C config/scripts/config clean -$(MAKE) clean - -@rm config/.* config/config.h - -@rm config/*.msi config/*.back.aip + -@rm config/*.msi config/*.back.aip config/config.h config/.config* + @rm -fr $(STAGE) cd ../; tar cvfz $(RELEASE).tar.gz --wildcards-match-slash --exclude .svn axTLS; cd -; docs: @@ -59,20 +66,21 @@ docs: win32_demo: -@rm -fr ../axTLS.release_test > /dev/null 2>&1 $(MAKE) win32releaseconf - cd ../; zip $(RELEASE).zip \ - ./axTLS/awhttpd.exe \ - ./axTLS/axssl.exe \ - ./axTLS/axtls.dll \ - ./axTLS/axtls.lib \ - ./axTLS/axtls.static.lib \ - ./axTLS/axtlsj.dll \ - ./axTLS/axssl.csharp.exe \ - ./axTLS/axssl.vbnet.exe \ - ./axTLS/axtls.jar \ - ./axTLS/www/* \ - ./axTLS/www/crypto_files/* \ - ./axTLS/www/test_dir/*; \ - unzip -d axTLS.release_test $(RELEASE).zip; cd -; + +install: $(PREFIX) all + install -m 755 $(STAGE)/libax* $(PREFIX)/lib + -install -m 755 $(STAGE)/ax* $(PREFIX)/bin + -install -m 755 $(STAGE)/axtlsp.pm `perl -e 'use Config; print $$Config{installarchlib};'` + -install -m 755 $(STAGE)/awhttpd* $(PREFIX)/bin + +installclean: + -@rm $(PREFIX)/lib/libax* + -@rm $(PREFIX)/bin/ax* + -@rm $(PREFIX)/bin/awhttpd* + -@rm `perl -e 'use Config; print $$Config{installarchlib};'`/axtlsp.pm + +test: + cd $(STAGE); ssltest; ../ssl/test/test_axssl.sh; cd -; # tidy up things clean:: @@ -132,3 +140,7 @@ win32releaseconf: config/scripts/config/conf @./config/scripts/config/conf -D config/win32config $(CONFIG_CONFIG_IN) > /dev/null $(MAKE) +# The special debian release configuration +debianconf: config/scripts/config/conf + @./config/scripts/config/conf -D config/debianconfig $(CONFIG_CONFIG_IN) > /dev/null + $(MAKE) diff --git a/README b/README index ead37bb977..1ca2020094 100644 --- a/README +++ b/README @@ -33,7 +33,7 @@ Select your platform type, save the configuration, exit, and then type "make" again. If all goes well, you should end up with an executable called "awhttpd" (or -awhttpd.exe) in this directory. +awhttpd.exe) in the _stage directory. To play with all the various axTLS options, type: @@ -45,7 +45,7 @@ Save the new configuration and rebuild. # Running it ######################################################################## -To run it, type (as superuser): +To run it, go to the _stage directory, and type (as superuser): > awhttpd @@ -64,8 +64,6 @@ to see the same page unencrypted. See the README in the httpd directory from more configuration information on Anti-Web. -Note: libaxtls.so may have to in your shared library path. - ######################################################################## # The axssl utilities ######################################################################## @@ -82,12 +80,12 @@ axssl.pl - Perl sample All the tools have identical command-line parameters. e.g. to run something interesting: -> axssl s_server -verify -CAfile ssl/test/axTLS.ca_x509 +> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509 and -> axssl s_client -cert ssl/test/axTLS.x509_1024 -key \ - ssl/test/axTLS.key_1024 -reconnect +> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key \ + ../ssl/test/axTLS.key_1024 -reconnect C# == @@ -152,7 +150,7 @@ Solaris issues Cygwin issues ============= -* The bindings all compile but don't run under cygwin with the exception of - Perl. This is due to win32 executables being incompatible with cygwin +* The bindings all compile but don't run under Cygwin with the exception of + Perl. This is due to win32 executables being incompatible with Cygwin libraries. diff --git a/bindings/java/Makefile b/bindings/java/Makefile index a81d8811f6..7e69aef521 100644 --- a/bindings/java/Makefile +++ b/bindings/java/Makefile @@ -22,12 +22,12 @@ include ../../config/makefile.java.conf all: lib jar -JAR=../../axtls.jar +JAR=../../$(STAGE)/axtls.jar ifdef CONFIG_PLATFORM_WIN32 -TARGET=../../axtlsj.dll +TARGET=../../$(STAGE)/axtlsj.dll else -TARGET=../../libaxtlsj.so +TARGET=../../$(STAGE)/libaxtlsj.so endif lib: $(TARGET) @@ -54,7 +54,7 @@ JAVA_CLASSES:=$(JAVA_FILES:%.java=classes/axTLSj/%.class) ifdef CONFIG_PLATFORM_WIN32 CFLAGS += /I"$(shell cygpath -w $(SSL_HOME))" CFLAGS += /I"$(shell cygpath -w $(CONFIG_HOME))" -LDFLAGS += axtls.lib /libpath:"../../" +LDFLAGS += axtls.lib /libpath:"../../$(STAGE)" include ../../config/makefile.post @@ -71,7 +71,7 @@ CFLAGS += -I$(SSL_HOME) CFLAGS += -I$(CONFIG_HOME) $(TARGET) : $(OBJ) - $(LD) $(LDFLAGS) -L ../../ $(LDSHARED) -o $@ $(OBJ) -laxtls + $(LD) $(LDFLAGS) -L ../../$(STAGE) $(LDSHARED) -o $@ $(OBJ) -laxtls endif jar: $(OBJ) $(JAR) @@ -79,7 +79,7 @@ jar: $(OBJ) $(JAR) # if we are doing the samples then defer creating the jar until then $(JAR): $(JAVA_CLASSES) ifndef CONFIG_JAVA_SAMPLES - jar cvf $@ -C classes . + jar cvf $@ -C classes axTLSj else @if [ ! -f $(JAR) ]; then touch $(JAR); fi endif diff --git a/bindings/perl/Makefile b/bindings/perl/Makefile index 99b6e4d249..b1943a4764 100644 --- a/bindings/perl/Makefile +++ b/bindings/perl/Makefile @@ -22,9 +22,9 @@ include ../../config/makefile.conf all: lib ifdef CONFIG_PLATFORM_WIN32 -TARGET=../../axtlsp.dll +TARGET=../../$(STAGE)/axtlsp.dll else -TARGET=../../libaxtlsp.so +TARGET=../../$(STAGE)/libaxtlsp.so endif ifneq ($(MAKECMDGOALS), clean) @@ -46,13 +46,13 @@ test_perl: endif lib: $(TARGET) -AXOLOTLS_HOME=../.. -SSL_HOME=$(AXOLOTLS_HOME)/ssl -CONFIG_HOME=$(AXOLOTLS_HOME)/config +AXTLS_HOME=../.. +SSL_HOME=$(AXTLS_HOME)/ssl +CONFIG_HOME=$(AXTLS_HOME)/config OBJ:=axTLSp_wrap.o include ../../config/makefile.post -ifndef CONFIG_PLATFORM_WIN32 +ifndef CONFIG_PLATFORM_WIN32 # Linux/Unix/Cygwin # # Could have used libperl.a, but it increases the library to over 1MB, so just @@ -60,22 +60,22 @@ ifndef CONFIG_PLATFORM_WIN32 # work. # $(TARGET) : $(OBJ) - $(LD) $(LDFLAGS) -L ../../ -L$(PERL5_CORE) $(LDSHARED) -o $@ $(OBJ) -laxtls -lperl + $(LD) $(LDFLAGS) -L ../../$(STAGE) -L$(PERL5_CORE) $(LDSHARED) -o $@ $(OBJ) -laxtls -lperl ifdef CONFIG_PLATFORM_CYGWIN - cd ../../; ln -sf $(notdir $@) axtlsp.dll + cd ../../$(STAGE); ln -sf $(notdir $@) axtlsp.dll endif - @install axtlsp.pm ../../ + @install axtlsp.pm ../../$(STAGE) CFLAGS += -D__USE_GNU -I$(CONFIG_HOME) -I$(SSL_HOME) -I$(PERL5_CORE) else CFLAGS += /I"`cygpath -w $(CONFIG_HOME)`" /I"`cygpath -w $(SSL_HOME)`" CFLAGS += /I"$(PERL5_CORE)" -LDFLAGS += $(CONFIG_PERL_LIB) /libpath:"$(PERL5_CORE)" axtls.lib /libpath:"../../" +LDFLAGS += $(CONFIG_PERL_LIB) /libpath:"$(PERL5_CORE)" axtls.lib /libpath:"../../$(STAGE)" $(TARGET) : $(OBJ) $(LD) $(LDFLAGS) $(LDSHARED) /out:$@ $(OBJ) - @install axtlsp.pm ../../ + install axtlsp.pm ../../$(STAGE) endif # WIN32 clean:: - @rm -f $(TARGET) axtls* *.i axTLSp* *.c .depend ../../axtlsp.pm + @rm -f $(TARGET) axtls* *.i axTLSp* *.c .depend ../../$(STAGE)/axtlsp.pm diff --git a/config/Config.in b/config/Config.in index fea9c0a6d6..e9c3eff1e9 100644 --- a/config/Config.in +++ b/config/Config.in @@ -29,6 +29,12 @@ endchoice menu "General Configuration" +config PREFIX + string "axTLS installation prefix" + default "/usr/local" + help + Define your directory to install axTLS files/subdirs in. + config CONFIG_DEBUG bool "Build axTLS with Debugging symbols" default n @@ -47,7 +53,7 @@ depends on CONFIG_PLATFORM_WIN32 choice prompt "Compiler" depends on CONFIG_PLATFORM_WIN32 - default CONFIG_VISUAL_STUDIO_8_0 + default CONFIG_VISUAL_STUDIO_7_0 config CONFIG_VISUAL_STUDIO_6_0 bool "Visual Studio 6.0 (VC98)" diff --git a/config/makefile.conf b/config/makefile.conf index c1167e5d84..713d00c59f 100644 --- a/config/makefile.conf +++ b/config/makefile.conf @@ -20,10 +20,13 @@ # A standard makefile for all makefiles # +# All executables and libraries go here +STAGE=./_stage + ifneq ($(MAKECMDGOALS), clean) # Give an initial rule -all: +all: # Win32 ifdef CONFIG_PLATFORM_WIN32 diff --git a/httpd/Config.in b/httpd/Config.in index 6b450f2bee..c9240864dd 100644 --- a/httpd/Config.in +++ b/httpd/Config.in @@ -36,11 +36,12 @@ config CONFIG_STANDARD_AWHTTPD config CONFIG_HTTP_WEBROOT string "Web root location" - default "www" + default "../www" if !CONFIG_PLATFORM_WIN32 + default "..\\www" if CONFIG_PLATFORM_WIN32 depends on !CONFIG_STANDARD_AWHTTPD help - The location of the web root. This is the directory where - index.html lives. + The location of the web root in relation to awhttpd. This is + the directory where index.html lives. config CONFIG_HTTP_PORT int "HTTP port" diff --git a/httpd/Makefile b/httpd/Makefile index 66e2908bd9..3b8f4b0895 100644 --- a/httpd/Makefile +++ b/httpd/Makefile @@ -24,26 +24,26 @@ include ../config/makefile.conf ifndef CONFIG_PLATFORM_WIN32 ifdef CONFIG_PLATFORM_CYGWIN -TARGET=../awhttpd.exe +TARGET=../$(STAGE)/awhttpd.exe else -TARGET=../awhttpd +TARGET=../$(STAGE)/awhttpd endif ifdef CONFIG_HTTP_STATIC_BUILD -LIBS=../libaxtls.a +LIBS=../$(STAGE)/libaxtls.a else -LIBS=-L../ -laxtls +LIBS=-L../$(STAGE) -laxtls endif CFLAGS += -I../ssl else # win32 build -TARGET=../awhttpd.exe +TARGET=../$(STAGE)/awhttpd.exe ifdef CONFIG_HTTP_STATIC_BUILD -LIBS=../axtls.static.lib ..\config\axtls.res +LIBS=../$(STAGE)/axtls.static.lib ..\\config\\axtls.res else -LIBS=../axtls.lib ..\config\axtls.res +LIBS=../$(STAGE)/axtls.lib ..\\config\\axtls.res endif endif diff --git a/samples/c/Makefile b/samples/c/Makefile index 656b8cb6cd..95a3381cf1 100644 --- a/samples/c/Makefile +++ b/samples/c/Makefile @@ -24,16 +24,15 @@ include ../../config/makefile.conf ifndef CONFIG_PLATFORM_WIN32 ifdef CONFIG_PLATFORM_CYGWIN -TARGET=../../axssl.exe +TARGET=../../$(STAGE)/axssl.exe else -TARGET=../../axssl +TARGET=../../$(STAGE)/axssl endif # cygwin -LIBS=../../libaxtls.a +LIBS=../../$(STAGE) CFLAGS += -I../../ssl -I../../config else -TARGET=../../axssl.exe -LIBS=../../axtls.lib +TARGET=../../$(STAGE)/axssl.exe CFLAGS += /I"..\..\ssl" /I"..\..\config" endif @@ -47,8 +46,8 @@ include ../../config/makefile.post ifndef CONFIG_PLATFORM_WIN32 -$(TARGET): $(OBJ) $(LIBS) - $(LD) $(LDFLAGS) -o $@ $^ +$(TARGET): $(OBJ) + $(LD) $(LDFLAGS) -o $@ $< -L$(LIBS) -laxtls ifndef CONFIG_DEBUG ifndef CONFIG_PLATFORM_SOLARIS strip --remove-section=.comment $(TARGET) @@ -56,12 +55,12 @@ endif # SOLARIS endif # CONFIG_DEBUG else # Win32 -$(TARGET): $(OBJ) $(LIBS) - $(LD) $(LDFLAGS) ..\..\config\axtls.res /out:$@ $^ +$(TARGET): $(OBJ) + $(LD) $(LDFLAGS) ..\\..\\config\\axtls.res /out:$@ $^ /libpath:"../../$(STAGE)" axtls.lib endif endif # CONFIG_C_SAMPLES clean:: - -@rm -f ../../axssl* + -@rm -f ../../$(STAGE)/axssl* diff --git a/samples/csharp/Makefile b/samples/csharp/Makefile index 8e299fd749..d30b37c263 100644 --- a/samples/csharp/Makefile +++ b/samples/csharp/Makefile @@ -21,7 +21,7 @@ include ../../config/makefile.conf include ../../config/makefile.dotnet.conf all : sample -TARGET=../../axssl.csharp.exe +TARGET=../../$(STAGE)/axssl.csharp.exe sample : $(TARGET) $(TARGET): ../../bindings/csharp/axTLS.cs ../../bindings/csharp/axInterface.cs axssl.cs diff --git a/samples/java/Makefile b/samples/java/Makefile index 0bedf52218..e8b8351023 100644 --- a/samples/java/Makefile +++ b/samples/java/Makefile @@ -21,14 +21,14 @@ include ../../config/makefile.conf include ../../config/makefile.java.conf all : sample -JAR=../../axtls.jar +JAR=../../$(STAGE)/axtls.jar CLASSES=../../bindings/java/classes sample : $(JAR) $(JAR) : $(CLASSES)/axssl.class $(wildcard $(CLASSES)/axTLSj/*.class) - jar mcvf manifest.mf $@ -C $(CLASSES) . + jar mcvf manifest.mf $@ -C $(CLASSES) axTLSj -C $(CLASSES) axssl.class -JAVA_FILES= axssl.java +JAVA_FILES=axssl.java JAVA_CLASSES:=$(JAVA_FILES:%.java=$(CLASSES)/axTLSj/%.class) $(CLASSES)/%.class : %.java diff --git a/samples/perl/Makefile b/samples/perl/Makefile index da910f9b76..0599196c40 100644 --- a/samples/perl/Makefile +++ b/samples/perl/Makefile @@ -20,11 +20,11 @@ include ../../config/.config include ../../config/makefile.conf all: samples -TARGET=../../axssl.pl +TARGET=../../$(STAGE)/axssl.pl samples: $(TARGET) $(TARGET): axssl.pl - @cd ../../; ln -sf samples/perl/axssl.pl axssl.pl + install $< $@ clean:: -@rm -f $(TARGET) diff --git a/samples/vbnet/Makefile b/samples/vbnet/Makefile index dab5f9599c..9f9adc66c1 100644 --- a/samples/vbnet/Makefile +++ b/samples/vbnet/Makefile @@ -23,7 +23,7 @@ include ../../config/makefile.dotnet.conf # only build on Win32 platforms ifdef GO_DOT_NET all : sample -TARGET=../../axssl.vbnet.exe +TARGET=../../$(STAGE)/axssl.vbnet.exe sample : $(TARGET) $(TARGET): ../../bindings/vbnet/axTLSvb.vb ../../bindings/vbnet/axInterface.vb axssl.vb diff --git a/ssl/Makefile b/ssl/Makefile index ab4db3d9d5..14d50ac93a 100644 --- a/ssl/Makefile +++ b/ssl/Makefile @@ -29,12 +29,17 @@ endif endif ifndef CONFIG_PLATFORM_WIN32 -TARGET1=../libaxtls.a -TARGET2=../libaxtls.so +TARGET1=../$(STAGE)/libaxtls.a +BASETARGET=libaxtls.so +TARGET2=../$(STAGE)/$(BASETARGET) + +# shared library major/minor numbers +LIBMAJOR=$(BASETARGET).1 +LIBMINOR=$(BASETARGET).1.0 else -TARGET1=../axtls.lib -TARGET2=../axtls.dll -STATIC_LIB=../axtls.static.lib +TARGET1=axtls.lib +TARGET2=../$(STAGE)/axtls.dll +STATIC_LIB=../$(STAGE)/axtls.static.lib endif libs: $(TARGET1) $(TARGET2) @@ -61,13 +66,14 @@ endif include ../config/makefile.post -ifndef CONFIG_PLATFORM_WIN32 +ifndef CONFIG_PLATFORM_WIN32 # Linux/Unix/Cygwin $(TARGET1) : $(OBJ) $(AR) -r $@ $(OBJ) $(TARGET2) : $(OBJ) - $(LD) $(LDFLAGS) $(LDSHARED) -o $@ $(OBJ) + $(LD) $(LDFLAGS) -Wl,-soname,$(LIBMAJOR) $(LDSHARED) -o ../$(STAGE)/$(LIBMINOR) $(OBJ) + cd ../$(STAGE); ln -sf $(LIBMINOR) $(LIBMAJOR); ln -sf $(LIBMAJOR) $(BASETARGET); cd - else # Win32 @@ -82,5 +88,5 @@ endif clean:: $(MAKE) -C test clean - -@rm -f *.pch ../*.so ../*.a ../*.dll ../*.lib ../*.exp ../*.pdb ../*.ilk + -@rm -f ../$(STAGE)/*.pch ../$(STAGE)/*.so* ../$(STAGE)/*.a ../$(STAGE)/*.dll ../$(STAGE)/*.lib ../$(STAGE)/*.exp ../$(STAGE)/*.pdb ../$(STAGE)/*.ilk diff --git a/ssl/test/Makefile b/ssl/test/Makefile index d8f9474511..23fcaf3bb6 100644 --- a/ssl/test/Makefile +++ b/ssl/test/Makefile @@ -30,19 +30,19 @@ all: ssltesting endif ifndef CONFIG_PLATFORM_WIN32 -performance: ../../perf_bigint -ssltesting: ../../ssltest -LIBS=../../libaxtls.a +performance: ../../$(STAGE)/perf_bigint +ssltesting: ../../$(STAGE)/ssltest +LIBS=../../$(STAGE) CFLAGS += -I../../ssl -I../../config -../../perf_bigint: perf_bigint.o $(LIBS) - $(CC) $(LDFLAGS) -o $@ $^ +../../$(STAGE)/perf_bigint: perf_bigint.o + $(CC) $(LDFLAGS) -o $@ $^ -L $(LIBS) -laxtls -../../ssltest: ssltest.o $(LIBS) - $(CC) $(LDFLAGS) -o $@ -lpthread $^ +../../$(STAGE)/ssltest: ssltest.o + $(CC) $(LDFLAGS) -o $@ $^ -lpthread -L $(LIBS) -laxtls else -performance: ../../perf_bigint.exe -ssltesting: ../../ssltest.exe +performance: ../../$(STAGE)/perf_bigint.exe +ssltesting: ../../$(STAGE)/ssltest.exe CFLAGS += /I".." /I"../../config" %.obj : %.c @@ -52,14 +52,14 @@ OBJLIST=..\aes.obj ..\asn1.obj ..\bigint.obj ..\crypto_misc.obj ..\hmac.obj \ ..\md5.obj ..\loader.obj ..\p12.obj ..\os_port.obj ..\rc4.obj \ ..\rsa.obj ..\sha1.obj ..\tls1.obj ..\tls1_clnt.obj ..\tls1_svr.obj -../../perf_bigint.exe: perf_bigint.obj $(OBJLIST) +../../$(STAGE)/perf_bigint.exe: perf_bigint.obj $(OBJLIST) $(LD) $(LDFLAGS) /out:$@ $^ -../../ssltest.exe: ssltest.obj $(OBJLIST) +../../$(STAGE)/ssltest.exe: ssltest.obj $(OBJLIST) $(LD) $(LDFLAGS) /out:$@ $^ endif clean:: - -@rm -f ../../perf_bigint* ../../ssltest* + -@rm -f ../../$(STAGE)/perf_bigint* ../../$(STAGE)/ssltest* include ../../config/makefile.post diff --git a/ssl/test/perf_bigint.c b/ssl/test/perf_bigint.c index 0bd1e9f8b9..4fc77fecbd 100644 --- a/ssl/test/perf_bigint.c +++ b/ssl/test/perf_bigint.c @@ -52,7 +52,7 @@ int main(int argc, char *argv[]) plaintext = /* 64 byte number */ "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^"; - len = get_file("ssl/test/axTLS.key_512", &buf); + len = get_file("../ssl/test/axTLS.key_512", &buf); asn1_get_private_key(buf, len, &rsa_ctx); ctx = rsa_ctx->bi_ctx; bi_data = bi_import(ctx, (uint8_t *)plaintext, strlen(plaintext)); @@ -89,7 +89,7 @@ int main(int argc, char *argv[]) "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^" "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^"; - len = get_file("ssl/test/axTLS.key_1024", &buf); + len = get_file("../ssl/test/axTLS.key_1024", &buf); asn1_get_private_key(buf, len, &rsa_ctx); ctx = rsa_ctx->bi_ctx; bi_data = bi_import(ctx, (uint8_t *)plaintext, strlen(plaintext)); @@ -128,7 +128,7 @@ int main(int argc, char *argv[]) "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^" "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^"; - len = get_file("ssl/test/axTLS.key_2048", &buf); + len = get_file("../ssl/test/axTLS.key_2048", &buf); asn1_get_private_key(buf, len, &rsa_ctx); ctx = rsa_ctx->bi_ctx; bi_data = bi_import(ctx, (uint8_t *)plaintext, strlen(plaintext)); @@ -170,7 +170,7 @@ int main(int argc, char *argv[]) "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^" "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^"; - len = get_file("ssl/test/axTLS.key_4096", &buf); + len = get_file("../ssl/test/axTLS.key_4096", &buf); asn1_get_private_key(buf, len, &rsa_ctx); ctx = rsa_ctx->bi_ctx; bi_data = bi_import(ctx, (uint8_t *)plaintext, strlen(plaintext)); diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index aec29106c5..21cb63c13d 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -39,8 +39,8 @@ #include "ssl.h" -#define DEFAULT_CERT "ssl/test/axTLS.x509_512.cer" -#define DEFAULT_KEY "ssl/test/axTLS.key_512" +#define DEFAULT_CERT "../ssl/test/axTLS.x509_512.cer" +#define DEFAULT_KEY "../ssl/test/axTLS.key_512" //#define DEFAULT_SVR_OPTION SSL_DISPLAY_BYTES|SSL_DISPLAY_STATES #define DEFAULT_SVR_OPTION 0 #define DEFAULT_CLNT_OPTION 0 @@ -481,7 +481,7 @@ static int RSA_test(void) uint8_t *buf; /* extract the private key elements */ - len = get_file("ssl/test/axTLS.key_1024", &buf); + len = get_file("../ssl/test/axTLS.key_1024", &buf); if (asn1_get_private_key(buf, len, &rsa_ctx) < 0) { goto end; @@ -535,7 +535,7 @@ static int cert_tests(void) /* check a bunch of 3rd party certificates */ ssl_ctx = ssl_ctx_new(0, 0); - len = get_file("ssl/test/microsoft.x509_ca", &buf); + len = get_file("../ssl/test/microsoft.x509_ca", &buf); if ((res = add_cert_auth(ssl_ctx, buf, len)) < 0) { printf("Cert #1\n"); @@ -547,7 +547,7 @@ static int cert_tests(void) free(buf); ssl_ctx = ssl_ctx_new(0, 0); - len = get_file("ssl/test/thawte.x509_ca", &buf); + len = get_file("../ssl/test/thawte.x509_ca", &buf); if ((res = add_cert_auth(ssl_ctx, buf, len)) < 0) { printf("Cert #2\n"); @@ -559,7 +559,7 @@ static int cert_tests(void) free(buf); ssl_ctx = ssl_ctx_new(0, 0); - len = get_file("ssl/test/deutsche_telecom.x509_ca", &buf); + len = get_file("../ssl/test/deutsche_telecom.x509_ca", &buf); if ((res = add_cert_auth(ssl_ctx, buf, len)) < 0) { printf("Cert #3\n"); @@ -571,7 +571,7 @@ static int cert_tests(void) free(buf); ssl_ctx = ssl_ctx_new(0, 0); - len = get_file("ssl/test/equifax.x509_ca", &buf); + len = get_file("../ssl/test/equifax.x509_ca", &buf); if ((res = add_cert_auth(ssl_ctx, buf, len)) < 0) { printf("Cert #4\n"); @@ -584,7 +584,7 @@ static int cert_tests(void) /* Verisign use MD2 which is not supported */ ssl_ctx = ssl_ctx_new(0, 0); - len = get_file("ssl/test/verisign.x509_ca", &buf); + len = get_file("../ssl/test/verisign.x509_ca", &buf); if ((res = add_cert_auth(ssl_ctx, buf, len)) != X509_VFY_ERROR_UNSUPPORTED_DIGEST) { @@ -596,7 +596,7 @@ static int cert_tests(void) ssl_ctx_free(ssl_ctx); free(buf); - if (get_file("ssl/test/verisign.x509_my_cert", &buf) < 0 || + if (get_file("../ssl/test/verisign.x509_my_cert", &buf) < 0 || x509_new(buf, &len, &x509_ctx)) { printf("Cert #6\n"); @@ -918,8 +918,8 @@ int SSL_server_tests(void) * 512 bit RSA key */ if ((ret = SSL_server_test(NULL, "512 bit key", "-cipher RC4-SHA", - "ssl/test/axTLS.x509_512.cer", NULL, - "ssl/test/axTLS.key_512", + "../ssl/test/axTLS.x509_512.cer", NULL, + "../ssl/test/axTLS.key_512", NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; @@ -928,9 +928,9 @@ int SSL_server_tests(void) */ if ((ret = SSL_server_test(NULL, "1024 bit key", "-cipher RC4-SHA", - "ssl/test/axTLS.x509_device.cer", - "ssl/test/axTLS.x509_512.cer", - "ssl/test/axTLS.device_key", + "../ssl/test/axTLS.x509_device.cer", + "../ssl/test/axTLS.x509_512.cer", + "../ssl/test/axTLS.device_key", NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; @@ -939,8 +939,8 @@ int SSL_server_tests(void) */ if ((ret = SSL_server_test(NULL, "2048 bit key", "-cipher RC4-SHA", - "ssl/test/axTLS.x509_2048.cer", NULL, - "ssl/test/axTLS.key_2048", + "../ssl/test/axTLS.x509_2048.cer", NULL, + "../ssl/test/axTLS.key_2048", NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; @@ -949,8 +949,8 @@ int SSL_server_tests(void) */ if ((ret = SSL_server_test(NULL, "4096 bit key", "-cipher RC4-SHA", - "ssl/test/axTLS.x509_4096.cer", NULL, - "ssl/test/axTLS.key_4096", + "../ssl/test/axTLS.x509_4096.cer", NULL, + "../ssl/test/axTLS.key_4096", NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; @@ -959,22 +959,22 @@ int SSL_server_tests(void) */ if ((ret = SSL_server_test(NULL, "Client Verification", "-cipher RC4-SHA -tls1 " - "-cert ssl/test/axTLS.x509_2048.pem " - "-key ssl/test/axTLS.key_2048.pem ", + "-cert ../ssl/test/axTLS.x509_2048.pem " + "-key ../ssl/test/axTLS.key_2048.pem ", NULL, NULL, NULL, - "ssl/test/axTLS.ca_x509.cer", NULL, + "../ssl/test/axTLS.ca_x509.cer", NULL, DEFAULT_SVR_OPTION|SSL_CLIENT_AUTHENTICATION))) goto cleanup; /* this test should fail */ - if (stat("ssl/test/axTLS.x509_bad_before.pem", &stat_buf) >= 0) + if (stat("../ssl/test/axTLS.x509_bad_before.pem", &stat_buf) >= 0) { if ((ret = SSL_server_test(NULL, "Bad Before Cert", "-cipher RC4-SHA -tls1 " - "-cert ssl/test/axTLS.x509_bad_before.pem " - "-key ssl/test/axTLS.key_512.pem ", + "-cert ../ssl/test/axTLS.x509_bad_before.pem " + "-key ../ssl/test/axTLS.key_512.pem ", NULL, NULL, NULL, - "ssl/test/axTLS.ca_x509.cer", NULL, + "../ssl/test/axTLS.ca_x509.cer", NULL, DEFAULT_SVR_OPTION|SSL_CLIENT_AUTHENTICATION)) != SSL_X509_ERROR(X509_VFY_ERROR_NOT_YET_VALID)) goto cleanup; @@ -987,10 +987,10 @@ int SSL_server_tests(void) /* this test should fail */ if ((ret = SSL_server_test(NULL, "Bad After Cert", "-cipher RC4-SHA -tls1 " - "-cert ssl/test/axTLS.x509_bad_after.pem " - "-key ssl/test/axTLS.key_512.pem ", + "-cert ../ssl/test/axTLS.x509_bad_after.pem " + "-key ../ssl/test/axTLS.key_512.pem ", NULL, NULL, NULL, - "ssl/test/axTLS.ca_x509.cer", NULL, + "../ssl/test/axTLS.ca_x509.cer", NULL, DEFAULT_SVR_OPTION|SSL_CLIENT_AUTHENTICATION)) != SSL_X509_ERROR(X509_VFY_ERROR_EXPIRED)) goto cleanup; @@ -1000,8 +1000,8 @@ int SSL_server_tests(void) /* this test should fail */ if ((ret = SSL_server_test(NULL, "Bogus cert", "-cipher RC4-SHA", - "ssl/test/axTLS.x509_crud.cer", NULL, - "ssl/test/axTLS.key_512", NULL, + "../ssl/test/axTLS.x509_crud.cer", NULL, + "../ssl/test/axTLS.key_512", NULL, NULL, DEFAULT_SVR_OPTION)) != SSL_ERROR_INVALID_KEY) goto cleanup; @@ -1011,8 +1011,8 @@ int SSL_server_tests(void) /* this test should fail */ if ((ret = SSL_server_test(NULL, "Bogus private key", "-cipher RC4-SHA", - "ssl/test/axTLS.x509_device.cer", NULL, - "ssl/test/axTLS.crud", NULL, + "../ssl/test/axTLS.x509_device.cer", NULL, + "../ssl/test/axTLS.crud", NULL, NULL, DEFAULT_SVR_OPTION)) != SSL_ERROR_INVALID_KEY) goto cleanup; @@ -1024,8 +1024,8 @@ int SSL_server_tests(void) */ if ((ret = SSL_server_test(NULL, "Key in PEM format", "-cipher RC4-SHA", - "ssl/test/axTLS.x509_512.cer", NULL, - "ssl/test/axTLS.key_512.pem", NULL, + "../ssl/test/axTLS.x509_512.cer", NULL, + "../ssl/test/axTLS.key_512.pem", NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; @@ -1034,8 +1034,8 @@ int SSL_server_tests(void) */ if ((ret = SSL_server_test(NULL, "Cert in PEM format", "-cipher RC4-SHA", - "ssl/test/axTLS.x509_512.pem", NULL, - "ssl/test/axTLS.key_512.pem", NULL, + "../ssl/test/axTLS.x509_512.pem", NULL, + "../ssl/test/axTLS.key_512.pem", NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; @@ -1044,8 +1044,8 @@ int SSL_server_tests(void) */ if ((ret = SSL_server_test(NULL, "Cert chain in PEM format", "-cipher RC4-SHA", - "ssl/test/axTLS.x509_device.pem", - NULL, "ssl/test/axTLS.device_key.pem", + "../ssl/test/axTLS.x509_device.pem", + NULL, "../ssl/test/axTLS.device_key.pem", NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; @@ -1054,8 +1054,8 @@ int SSL_server_tests(void) */ if ((ret = SSL_server_test(NULL, "AES128 encrypted key", "-cipher RC4-SHA", - "ssl/test/axTLS.x509_aes128.pem", NULL, - "ssl/test/axTLS.key_aes128.pem", + "../ssl/test/axTLS.x509_aes128.pem", NULL, + "../ssl/test/axTLS.key_aes128.pem", NULL, "abcd", DEFAULT_SVR_OPTION))) goto cleanup; @@ -1064,8 +1064,8 @@ int SSL_server_tests(void) */ if ((ret = SSL_server_test(NULL, "AES256 encrypted key", "-cipher RC4-SHA", - "ssl/test/axTLS.x509_aes256.pem", NULL, - "ssl/test/axTLS.key_aes256.pem", + "../ssl/test/axTLS.x509_aes256.pem", NULL, + "../ssl/test/axTLS.key_aes256.pem", NULL, "abcd", DEFAULT_SVR_OPTION))) goto cleanup; @@ -1074,8 +1074,8 @@ int SSL_server_tests(void) */ if ((ret = SSL_server_test(NULL, "AES128 encrypted invalid key", "-cipher RC4-SHA", - "ssl/test/axTLS.x509_aes128.pem", NULL, - "ssl/test/axTLS.key_aes128.pem", + "../ssl/test/axTLS.x509_aes128.pem", NULL, + "../ssl/test/axTLS.key_aes128.pem", NULL, "xyz", DEFAULT_SVR_OPTION)) != SSL_ERROR_INVALID_KEY) goto cleanup; @@ -1086,7 +1086,7 @@ int SSL_server_tests(void) * PKCS 8 key (encrypted) */ if ((ret = SSL_server_test(NULL, "pkcs 8 encrypted", "-cipher RC4-SHA", - DEFAULT_CERT, NULL, "ssl/test/axTLS.encrypted.p8", NULL, "abcd", + DEFAULT_CERT, NULL, "../ssl/test/axTLS.encrypted.p8", NULL, "abcd", DEFAULT_SVR_OPTION))) goto cleanup; @@ -1094,7 +1094,7 @@ int SSL_server_tests(void) * PKCS 8 key (unencrypted) */ if ((ret = SSL_server_test(NULL, "pkcs 8 unencrypted", "-cipher RC4-SHA", - DEFAULT_CERT, NULL, "ssl/test/axTLS.unencrypted.p8", NULL, NULL, + DEFAULT_CERT, NULL, "../ssl/test/axTLS.unencrypted.p8", NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; @@ -1102,12 +1102,12 @@ int SSL_server_tests(void) * PKCS 12 key/certificate */ if ((ret = SSL_server_test(NULL, "pkcs 12 no CA", "-cipher RC4-SHA", - DEFAULT_CERT, NULL, "ssl/test/axTLS.withoutCA.p12", + DEFAULT_CERT, NULL, "../ssl/test/axTLS.withoutCA.p12", NULL, "abcd", DEFAULT_SVR_OPTION))) goto cleanup; if ((ret = SSL_server_test(NULL, "pkcs 12 with CA", "-cipher RC4-SHA", - NULL, NULL, "ssl/test/axTLS.withCA.p12", + NULL, NULL, "../ssl/test/axTLS.withCA.p12", NULL, "abcd", DEFAULT_SVR_OPTION))) goto cleanup; @@ -1242,7 +1242,7 @@ static int SSL_client_test( } if (ssl_obj_load(*ssl_ctx, SSL_OBJ_X509_CACERT, - "ssl/test/axTLS.ca_x509.cer", NULL)) + "../ssl/test/axTLS.ca_x509.cer", NULL)) { printf("could not add cert auth\n"); TTY_FLUSH(); @@ -1343,8 +1343,8 @@ int SSL_client_tests(void) if ((ret = SSL_client_test("512 bit key", &ssl_ctx, - "-cert ssl/test/axTLS.x509_512.pem " - "-key ssl/test/axTLS.key_512.pem", &sess_resume, + "-cert ../ssl/test/axTLS.x509_512.pem " + "-key ../ssl/test/axTLS.key_512.pem", &sess_resume, DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) goto cleanup; @@ -1370,50 +1370,50 @@ int SSL_client_tests(void) if ((ret = SSL_client_test("1024 bit key", &ssl_ctx, - "-cert ssl/test/axTLS.x509_1024.pem " - "-key ssl/test/axTLS.key_1024.pem", NULL, + "-cert ../ssl/test/axTLS.x509_1024.pem " + "-key ../ssl/test/axTLS.key_1024.pem", NULL, DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) goto cleanup; if ((ret = SSL_client_test("2048 bit key", &ssl_ctx, - "-cert ssl/test/axTLS.x509_2048.pem " - "-key ssl/test/axTLS.key_2048.pem", NULL, + "-cert ../ssl/test/axTLS.x509_2048.pem " + "-key ../ssl/test/axTLS.key_2048.pem", NULL, DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) goto cleanup; if ((ret = SSL_client_test("4096 bit key", &ssl_ctx, - "-cert ssl/test/axTLS.x509_4096.pem " - "-key ssl/test/axTLS.key_4096.pem", NULL, + "-cert ../ssl/test/axTLS.x509_4096.pem " + "-key ../ssl/test/axTLS.key_4096.pem", NULL, DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) goto cleanup; if ((ret = SSL_client_test("Server cert chaining", &ssl_ctx, - "-cert ssl/test/axTLS.x509_device.pem " - "-key ssl/test/axTLS.device_key.pem " - "-CAfile ssl/test/axTLS.x509_512.pem", NULL, + "-cert ../ssl/test/axTLS.x509_device.pem " + "-key ../ssl/test/axTLS.device_key.pem " + "-CAfile ../ssl/test/axTLS.x509_512.pem", NULL, DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) goto cleanup; /* Check the server can verify the client */ if ((ret = SSL_client_test("Client peer authentication", &ssl_ctx, - "-cert ssl/test/axTLS.x509_2048.pem " - "-key ssl/test/axTLS.key_2048.pem " - "-CAfile ssl/test/axTLS.ca_x509.pem " + "-cert ../ssl/test/axTLS.x509_2048.pem " + "-key ../ssl/test/axTLS.key_2048.pem " + "-CAfile ../ssl/test/axTLS.ca_x509.pem " "-verify 1 ", NULL, DEFAULT_CLNT_OPTION, - "ssl/test/axTLS.key_1024", NULL, - "ssl/test/axTLS.x509_1024.cer"))) + "../ssl/test/axTLS.key_1024", NULL, + "../ssl/test/axTLS.x509_1024.cer"))) goto cleanup; /* Should get an "ERROR" from openssl (as the handshake fails as soon as * the certificate verification fails) */ if ((ret = SSL_client_test("Expired cert (verify now) should fail!", &ssl_ctx, - "-cert ssl/test/axTLS.x509_bad_after.pem " - "-key ssl/test/axTLS.key_512.pem", NULL, + "-cert ../ssl/test/axTLS.x509_bad_after.pem " + "-key ../ssl/test/axTLS.key_512.pem", NULL, DEFAULT_CLNT_OPTION, NULL, NULL, NULL)) != SSL_X509_ERROR(X509_VFY_ERROR_EXPIRED)) { @@ -1427,8 +1427,8 @@ int SSL_client_tests(void) /* There is no "ERROR" from openssl */ if ((ret = SSL_client_test("Expired cert (verify later) should fail!", &ssl_ctx, - "-cert ssl/test/axTLS.x509_bad_after.pem " - "-key ssl/test/axTLS.key_512.pem", NULL, + "-cert ../ssl/test/axTLS.x509_bad_after.pem " + "-key ../ssl/test/axTLS.key_512.pem", NULL, DEFAULT_CLNT_OPTION|SSL_SERVER_VERIFY_LATER, NULL, NULL, NULL)) != SSL_X509_ERROR(X509_VFY_ERROR_EXPIRED)) { @@ -1683,17 +1683,17 @@ int main(int argc, char *argv[]) goto cleanup; TTY_FLUSH(); - system("sh ssl/test/killopenssl.sh"); + system("sh ../ssl/test/killopenssl.sh"); if (SSL_client_tests()) goto cleanup; - system("sh ssl/test/killopenssl.sh"); + system("sh ../ssl/test/killopenssl.sh"); if (SSL_server_tests()) goto cleanup; - system("sh ssl/test/killopenssl.sh"); + system("sh ../ssl/test/killopenssl.sh"); #if 0 if (multi_thread_test()) diff --git a/ssl/test/test_axssl.sh b/ssl/test/test_axssl.sh index 01ede465f9..7a7003365e 100755 --- a/ssl/test/test_axssl.sh +++ b/ssl/test/test_axssl.sh @@ -19,31 +19,41 @@ # # -# Test the various axssl bindings +# Test the various axssl bindings. To run it, got to the _install directory +# and run this script from there. # -if [ `uname -s` == "Linux" ]; then -# JAVA_BIN=/usr/local/jdk142/bin - JAVA_BIN=/usr/lib/java/bin - KILL_AXSSL="killall axssl" - KILL_CSHARP="killall mono" - KILL_PERL="killall /usr/bin/perl" - RUN_CSHARP="mono" - KILL_JAVA="killall $JAVA_BIN/java" -else +if grep "CONFIG_PLATFORM_WIN32=y" "../config/.config" > /dev/null; then JAVA_BIN="/cygdrive/c/Program Files/Java/jdk1.5.0_06/bin" + PERL_BIN="/cygdrive/c/Perl/bin/perl" KILL_AXSSL="kill %1" KILL_CSHARP="kill %1" KILL_PERL="kill %1" KILL_JAVA="kill %1" +else + if grep "CONFIG_PLATFORM_CYGWIN=y" "../config/.config" > /dev/null; then + # no .net or java on cygwin + PERL_BIN=/usr/bin/perl + KILL_AXSSL="killall axssl" + KILL_PERL="killall /usr/bin/perl" + else # Linux + JAVA_BIN=/usr/lib/java/bin + PERL_BIN=/usr/bin/perl + KILL_AXSSL="killall axssl" + KILL_CSHARP="killall mono" + KILL_PERL="killall /usr/bin/perl" + RUN_CSHARP="mono" + KILL_JAVA="killall $JAVA_BIN/java" + fi fi -SERVER_ARGS="s_server -accept 15001 -verify -CAfile ./ssl/test/axTLS.ca_x509.cer" -CLIENT_ARGS="s_client -reconnect -connect localhost:15001 -verify -CAfile ./ssl/test/axTLS.ca_x509.cer -key ./ssl/test/axTLS.key_1024 -cert ./ssl/test/axTLS.x509_1024.cer" +BASE=.. +SERVER_ARGS="s_server -accept 15001 -verify -CAfile $BASE/ssl/test/axTLS.ca_x509.cer" +CLIENT_ARGS="s_client -reconnect -connect localhost:15001 -verify -CAfile $BASE/ssl/test/axTLS.ca_x509.cer -key $BASE/ssl/test/axTLS.key_1024 -cert $BASE/ssl/test/axTLS.x509_1024.cer" # check pem arguments -SERVER_PEM_ARGS="s_server -accept 15001 -pass abcd -key ./ssl/test/axTLS.key_aes128.pem -cert ./ssl/test/axTLS.x509_aes128.pem" -CLIENT_PEM_ARGS="s_client -connect localhost:15001 -CAfile ./ssl/test/axTLS.ca_x509.pem -key ./ssl/test/axTLS.key_1024.pem -cert ./ssl/test/axTLS.x509_1024.pem" +SERVER_PEM_ARGS="s_server -accept 15001 -pass abcd -key $BASE/ssl/test/axTLS.key_aes128.pem -cert $BASE/ssl/test/axTLS.x509_aes128.pem" +CLIENT_PEM_ARGS="s_client -connect localhost:15001 -CAfile $BASE/ssl/test/axTLS.ca_x509.pem -key $BASE/ssl/test/axTLS.key_1024.pem -cert $BASE/ssl/test/axTLS.x509_1024.pem" export LD_LIBRARY_PATH=.:`perl -e 'use Config; print $Config{archlib};'`/CORE @@ -57,7 +67,8 @@ sleep 1 ./axssl $SERVER_PEM_ARGS & echo "C Test passed" | ./axssl $CLIENT_PEM_ARGS $KILL_AXSSL -sleep 1 +sleep 2 +echo "### C tests complete" fi if [ -f ./axtls.jar ]; then @@ -71,6 +82,8 @@ sleep 1 echo "Java Test passed" | "$JAVA_BIN/java" -jar ./axtls.jar $CLIENT_PEM_ARGS $KILL_JAVA sleep 1 + +echo "### Java tests complete" fi if [ -x ./axssl.csharp.exe ]; then @@ -86,6 +99,8 @@ echo "C# Test passed" | $RUN_CSHARP ./axssl.csharp.exe $CLIENT_PEM_ARGS sleep 1 $KILL_CSHARP sleep 1 + +echo "### C# tests complete" fi if [ -x ./axssl.vbnet.exe ]; then @@ -101,17 +116,21 @@ sleep 1 echo "VB.NET Test passed" | ./axssl.vbnet.exe $CLIENT_PEM_ARGS kill %1 sleep 1 +echo "### VB.NET tests complete" fi if [ -f ./axssl.pl ]; then echo "########################## PERL SAMPLE ###########################" -./axssl.pl $SERVER_ARGS & -echo "Perl Test passed" | ./axssl.pl $CLIENT_ARGS +"$PERL_BIN" ./axssl.pl $SERVER_ARGS & +echo "Perl Test passed" | "$PERL_BIN" ./axssl.pl $CLIENT_ARGS $KILL_PERL sleep 1 -./axssl.pl $SERVER_PEM_ARGS & -echo "Perl Test passed" | ./axssl.pl $CLIENT_PEM_ARGS +"$PERL_BIN" ./axssl.pl $SERVER_PEM_ARGS & +echo "Perl Test passed" | "$PERL_BIN" ./axssl.pl $CLIENT_PEM_ARGS $KILL_PERL sleep 1 +echo "### Perl tests complete" fi + +echo "########################## ALL TESTS COMPLETE ###########################" diff --git a/www/test_dir/health.sh b/www/test_dir/health.sh index f63013b14d..0784c7e3a8 100755 --- a/www/test_dir/health.sh +++ b/www/test_dir/health.sh @@ -2,14 +2,11 @@ echo "Content-type: text/html" echo - -echo "System Health" - -echo "

    System Health for '`hostname`'

    " -echo "

    Processes

    " +echo "System Health" +echo "

    System Health for '`hostname`'

    " +echo "

    Processes

    " ps -ef | sed -e "s/\(.*\)/
    \1<\/td><\/tr>/" - -echo "

    Free FileSystem Space

    " -echo "" +echo "

    Free FileSystem Space

    " +echo "" df -h . | sed -e "s/\(.*\)/
    \1<\/td><\/tr>/" -echo "
    " +echo "" From 3a700442f603f6fccef74f61d33885519c8c35ca Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 23 Jul 2006 12:30:37 +0000 Subject: [PATCH 016/301] Don't display false install errors git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@23 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/Makefile b/Makefile index ff4f43f020..8183dc0672 100644 --- a/Makefile +++ b/Makefile @@ -24,10 +24,10 @@ else all: target endif -target : $(STAGE) $(TARGET) - include config/makefile.conf +target : $(STAGE) $(TARGET) + # VERSION has to come from the command line RELEASE=axTLS-$(VERSION) @@ -68,16 +68,17 @@ win32_demo: $(MAKE) win32releaseconf install: $(PREFIX) all - install -m 755 $(STAGE)/libax* $(PREFIX)/lib - -install -m 755 $(STAGE)/ax* $(PREFIX)/bin - -install -m 755 $(STAGE)/axtlsp.pm `perl -e 'use Config; print $$Config{installarchlib};'` - -install -m 755 $(STAGE)/awhttpd* $(PREFIX)/bin + cp --no-dereference $(STAGE)/libax* $(PREFIX)/lib + chmod 755 $(PREFIX)/lib/libax* + -@install -m 755 $(STAGE)/ax* $(PREFIX)/bin > /dev/null 2>&1 + -@install -m 755 $(STAGE)/axtlsp.pm `perl -e 'use Config; print $$Config{installarchlib};'` > /dev/null 2>&1 + -@install -m 755 $(STAGE)/awhttpd* $(PREFIX)/bin > /dev/null 2>&1 installclean: - -@rm $(PREFIX)/lib/libax* - -@rm $(PREFIX)/bin/ax* - -@rm $(PREFIX)/bin/awhttpd* - -@rm `perl -e 'use Config; print $$Config{installarchlib};'`/axtlsp.pm + -@rm $(PREFIX)/lib/libax* > /dev/null 2>&1 + -@rm $(PREFIX)/bin/ax* > /dev/null 2>&1 + -@rm $(PREFIX)/bin/awhttpd* > /dev/null 2>&1 + -@rm `perl -e 'use Config; print $$Config{installarchlib};'`/axtlsp.pm > /dev/null 2>&1 test: cd $(STAGE); ssltest; ../ssl/test/test_axssl.sh; cd -; From 3b1e1a8e79ca624f105640dc9f35b9ed2d3a8e56 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 23 Jul 2006 12:31:31 +0000 Subject: [PATCH 017/301] Now use 1024 bit key git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@24 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/cert.h | 76 +++++++++++++++++++++------------------ ssl/private_key.h | 80 +++++++++++++++++++++++++++--------------- ssl/test/make_certs.sh | 8 ++--- 3 files changed, 97 insertions(+), 67 deletions(-) diff --git a/ssl/cert.h b/ssl/cert.h index 21697abaa6..972a9e4b5e 100644 --- a/ssl/cert.h +++ b/ssl/cert.h @@ -1,37 +1,43 @@ unsigned char default_certificate[] = { - 0x30, 0x82, 0x01, 0x92, 0x30, 0x81, 0xfc, 0x02, 0x09, 0x00, 0xf1, 0xc3, - 0x87, 0xc0, 0xd4, 0xf4, 0x57, 0xc2, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, - 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x34, 0x31, - 0x32, 0x30, 0x30, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x29, 0x61, 0x78, - 0x54, 0x4c, 0x53, 0x20, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x20, - 0x44, 0x6f, 0x64, 0x67, 0x79, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, - 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, - 0x69, 0x74, 0x79, 0x30, 0x1e, 0x17, 0x0d, 0x30, 0x36, 0x30, 0x36, 0x30, - 0x37, 0x31, 0x31, 0x34, 0x34, 0x33, 0x32, 0x5a, 0x17, 0x0d, 0x33, 0x33, - 0x31, 0x30, 0x32, 0x33, 0x31, 0x31, 0x34, 0x34, 0x33, 0x32, 0x5a, 0x30, - 0x2c, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0d, - 0x61, 0x78, 0x54, 0x4c, 0x53, 0x20, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, - 0x74, 0x31, 0x12, 0x30, 0x10, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x09, - 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x30, 0x5c, 0x30, - 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, - 0x05, 0x00, 0x03, 0x4b, 0x00, 0x30, 0x48, 0x02, 0x41, 0x00, 0xd1, 0x3b, - 0x30, 0x5f, 0xa9, 0x01, 0x42, 0x3d, 0x86, 0x6d, 0x72, 0xbe, 0x40, 0x6e, - 0x51, 0xc1, 0x49, 0x7f, 0x57, 0x75, 0xa1, 0x2d, 0x36, 0xe5, 0xc1, 0x3d, - 0x0f, 0x20, 0x1a, 0xd1, 0x23, 0x6d, 0xfa, 0x74, 0xd2, 0x3e, 0x23, 0xb0, - 0x70, 0xfc, 0xa0, 0x6a, 0xde, 0xec, 0x41, 0x88, 0x84, 0xfe, 0x54, 0x15, - 0x6b, 0x61, 0xc5, 0x16, 0x62, 0xb8, 0x93, 0x41, 0xf1, 0x4f, 0x3d, 0xff, - 0x2e, 0xbd, 0x02, 0x03, 0x01, 0x00, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, - 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x81, - 0x81, 0x00, 0x0a, 0x45, 0x3e, 0x8b, 0xc0, 0x5a, 0xf5, 0xc5, 0xe7, 0x49, - 0x6f, 0x8a, 0xab, 0xbe, 0x30, 0x7e, 0x13, 0x05, 0x7f, 0xd2, 0x9e, 0x13, - 0x34, 0xd5, 0xd4, 0x4b, 0xd4, 0xb7, 0xd2, 0xb3, 0x12, 0x16, 0xf4, 0x5a, - 0xaf, 0xb5, 0x71, 0xbc, 0xb3, 0xf5, 0x96, 0x96, 0x23, 0xf4, 0xf4, 0x75, - 0x24, 0x64, 0x99, 0x30, 0x6f, 0xc1, 0xea, 0x14, 0x78, 0xca, 0xe9, 0x85, - 0x46, 0x3c, 0x1e, 0x97, 0xd1, 0x4f, 0x80, 0xd7, 0x16, 0x09, 0x6e, 0x03, - 0x5c, 0x05, 0xaa, 0xcf, 0x75, 0x10, 0x17, 0xba, 0x19, 0xb4, 0x92, 0xfa, - 0x2b, 0xe5, 0xc9, 0xa5, 0x0d, 0x20, 0xc0, 0x2f, 0x8d, 0xc5, 0xcf, 0x91, - 0x44, 0x63, 0x4b, 0x32, 0x52, 0xbb, 0x74, 0xb8, 0xaa, 0x16, 0x1f, 0xd5, - 0xa9, 0x92, 0xde, 0x8f, 0x95, 0xf2, 0xf7, 0x73, 0x34, 0x27, 0x26, 0x41, - 0x88, 0xb5, 0x7c, 0xf0, 0xff, 0x9c, 0xd3, 0xc8, 0x1d, 0xec + 0x30, 0x82, 0x01, 0xd7, 0x30, 0x82, 0x01, 0x40, 0x02, 0x09, 0x00, 0xf1, + 0xc3, 0x87, 0xc0, 0xd4, 0xf4, 0x57, 0xc3, 0x30, 0x0d, 0x06, 0x09, 0x2a, + 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x34, + 0x31, 0x32, 0x30, 0x30, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x29, 0x61, + 0x78, 0x54, 0x4c, 0x53, 0x20, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, + 0x20, 0x44, 0x6f, 0x64, 0x67, 0x79, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, + 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, + 0x72, 0x69, 0x74, 0x79, 0x30, 0x1e, 0x17, 0x0d, 0x30, 0x36, 0x30, 0x36, + 0x30, 0x37, 0x31, 0x31, 0x34, 0x34, 0x33, 0x32, 0x5a, 0x17, 0x0d, 0x33, + 0x33, 0x31, 0x30, 0x32, 0x33, 0x31, 0x31, 0x34, 0x34, 0x33, 0x32, 0x5a, + 0x30, 0x2c, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, + 0x0d, 0x61, 0x78, 0x54, 0x4c, 0x53, 0x20, 0x50, 0x72, 0x6f, 0x6a, 0x65, + 0x63, 0x74, 0x31, 0x12, 0x30, 0x10, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, + 0x09, 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x30, 0x81, + 0x9f, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, + 0x01, 0x01, 0x05, 0x00, 0x03, 0x81, 0x8d, 0x00, 0x30, 0x81, 0x89, 0x02, + 0x81, 0x81, 0x00, 0xd8, 0xe0, 0xbf, 0x15, 0xde, 0xea, 0xaf, 0xe8, 0xd5, + 0xfd, 0x0b, 0xa8, 0xa8, 0xb3, 0xd7, 0x46, 0x5d, 0xa7, 0x26, 0x6c, 0x0c, + 0xb5, 0xd9, 0xbc, 0xc6, 0xf8, 0xc0, 0x78, 0xd0, 0xf6, 0x56, 0x65, 0xf8, + 0x29, 0x48, 0x0e, 0x7b, 0x0b, 0xa6, 0x25, 0x7e, 0xe8, 0x7b, 0x79, 0x6f, + 0x38, 0xe5, 0xb5, 0xb7, 0xf4, 0xe0, 0x9c, 0x91, 0x60, 0xf4, 0x06, 0xf3, + 0x40, 0x1e, 0xf9, 0x91, 0x19, 0xa9, 0x2f, 0x47, 0x43, 0xb5, 0x9b, 0x1e, + 0xdc, 0xf6, 0xaa, 0x1c, 0x49, 0x79, 0x21, 0x28, 0xcb, 0xaa, 0x49, 0x73, + 0xd9, 0x09, 0x05, 0x4c, 0x02, 0xf2, 0x4c, 0x4d, 0x6c, 0x1c, 0x80, 0xa7, + 0x14, 0x91, 0x44, 0xfc, 0x12, 0xb3, 0xe1, 0xe7, 0xe3, 0x4f, 0x44, 0xba, + 0x8c, 0xc3, 0x74, 0x39, 0xe8, 0x4c, 0xd0, 0xd4, 0x4c, 0x24, 0x61, 0xb4, + 0x40, 0x95, 0x8c, 0xc0, 0x0a, 0xb7, 0x02, 0x39, 0x31, 0x85, 0x93, 0x02, + 0x03, 0x01, 0x00, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, + 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x81, 0x81, 0x00, 0x0b, + 0x47, 0x24, 0x52, 0x7d, 0xb6, 0x63, 0x78, 0xbc, 0x80, 0xdd, 0x87, 0x6c, + 0x90, 0x4c, 0x33, 0xc3, 0x5c, 0xa7, 0x97, 0x09, 0x1c, 0x09, 0x4f, 0x9b, + 0x6e, 0xb3, 0x5a, 0x3e, 0x46, 0x92, 0x1a, 0xc7, 0x87, 0x15, 0x59, 0xe1, + 0x88, 0x5c, 0xce, 0x6a, 0xe2, 0x96, 0xaa, 0x32, 0xec, 0xc2, 0xed, 0x78, + 0x8b, 0xe0, 0x90, 0x66, 0x93, 0x14, 0xc3, 0x98, 0xab, 0x33, 0x35, 0xd3, + 0x7d, 0x5d, 0x51, 0x0a, 0x9c, 0xb9, 0x10, 0x58, 0x47, 0x7a, 0x98, 0x95, + 0x64, 0xff, 0x4c, 0x5d, 0x82, 0x19, 0xf9, 0xea, 0x0f, 0x5e, 0x9a, 0xcb, + 0x32, 0x27, 0x64, 0xca, 0x6f, 0x58, 0x8a, 0xd0, 0xc0, 0x36, 0xf4, 0xb9, + 0x63, 0x34, 0xa5, 0xda, 0x36, 0x50, 0x36, 0x49, 0xd2, 0xb7, 0x3a, 0x21, + 0x33, 0x5b, 0x3e, 0xd6, 0x5f, 0x0c, 0x99, 0x83, 0xb7, 0xb2, 0xf7, 0x8b, + 0x44, 0xc4, 0x5e, 0x73, 0x41, 0xa9, 0x02 }; -unsigned int default_certificate_len = 406; +unsigned int default_certificate_len = 475; diff --git a/ssl/private_key.h b/ssl/private_key.h index 180d5722db..1ce34d6744 100644 --- a/ssl/private_key.h +++ b/ssl/private_key.h @@ -1,30 +1,54 @@ unsigned char default_private_key[] = { - 0x30, 0x82, 0x01, 0x3d, 0x02, 0x01, 0x00, 0x02, 0x41, 0x00, 0xd1, 0x3b, - 0x30, 0x5f, 0xa9, 0x01, 0x42, 0x3d, 0x86, 0x6d, 0x72, 0xbe, 0x40, 0x6e, - 0x51, 0xc1, 0x49, 0x7f, 0x57, 0x75, 0xa1, 0x2d, 0x36, 0xe5, 0xc1, 0x3d, - 0x0f, 0x20, 0x1a, 0xd1, 0x23, 0x6d, 0xfa, 0x74, 0xd2, 0x3e, 0x23, 0xb0, - 0x70, 0xfc, 0xa0, 0x6a, 0xde, 0xec, 0x41, 0x88, 0x84, 0xfe, 0x54, 0x15, - 0x6b, 0x61, 0xc5, 0x16, 0x62, 0xb8, 0x93, 0x41, 0xf1, 0x4f, 0x3d, 0xff, - 0x2e, 0xbd, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02, 0x41, 0x00, 0x91, 0x79, - 0xc4, 0xed, 0x8e, 0x35, 0xa8, 0xd7, 0xdc, 0x62, 0xb6, 0xf8, 0x1f, 0x16, - 0x55, 0x53, 0xbe, 0x05, 0x83, 0x4a, 0xef, 0x50, 0xdf, 0xad, 0xa9, 0xc9, - 0x09, 0x7e, 0x3a, 0x07, 0x15, 0xc8, 0xfd, 0x16, 0xbb, 0xc0, 0xe4, 0x98, - 0xd1, 0x45, 0x99, 0x60, 0x75, 0x6c, 0x64, 0x65, 0x89, 0xc7, 0x1e, 0x35, - 0xa2, 0xcd, 0x14, 0x05, 0x38, 0x39, 0x15, 0x1a, 0xb8, 0x0f, 0x05, 0x96, - 0x01, 0x01, 0x02, 0x21, 0x00, 0xe8, 0xeb, 0xd7, 0xa8, 0xdf, 0xd8, 0x90, - 0xaa, 0x3c, 0x21, 0xa4, 0x04, 0x31, 0x6a, 0xd3, 0x21, 0xd8, 0x25, 0x98, - 0x4f, 0xb8, 0x28, 0x93, 0x2b, 0xb9, 0xe9, 0x5f, 0xb9, 0xa3, 0x65, 0x77, - 0x7d, 0x02, 0x21, 0x00, 0xe5, 0xf6, 0x6f, 0xeb, 0x50, 0xc4, 0x3b, 0x01, - 0xc3, 0x42, 0x7d, 0x50, 0x33, 0x7a, 0x09, 0xdc, 0x08, 0xe5, 0x76, 0xf3, - 0xbd, 0xea, 0x0f, 0xe5, 0xf1, 0xd3, 0x3d, 0x2f, 0x63, 0xe2, 0xb8, 0x41, - 0x02, 0x21, 0x00, 0xdd, 0xcf, 0xb2, 0xe9, 0x9c, 0x7a, 0x75, 0x91, 0xd8, - 0x7f, 0xc4, 0xdd, 0x45, 0x5e, 0x50, 0xc0, 0x3b, 0x41, 0xda, 0x21, 0x98, - 0xe3, 0xf2, 0xfb, 0x42, 0x29, 0xaf, 0xc2, 0x6e, 0x8b, 0x73, 0x55, 0x02, - 0x21, 0x00, 0xc3, 0x5d, 0x6a, 0xd5, 0xb2, 0x87, 0x13, 0x4e, 0x3b, 0x11, - 0x78, 0x9e, 0xb3, 0x2c, 0xe1, 0xc5, 0x72, 0x35, 0x67, 0xaa, 0x49, 0x54, - 0xd9, 0x6e, 0xd3, 0xd4, 0x4f, 0x2d, 0xbc, 0xa1, 0x37, 0x41, 0x02, 0x21, - 0x00, 0xc4, 0x69, 0x08, 0x53, 0x3b, 0x32, 0xb4, 0xb6, 0x6b, 0x1b, 0x9c, - 0xf3, 0xf1, 0xf3, 0x1a, 0x4a, 0x96, 0xff, 0x70, 0x25, 0x20, 0x1a, 0x9d, - 0x65, 0xb8, 0xa5, 0x8f, 0x9c, 0xc7, 0x77, 0x64, 0x74 + 0x30, 0x82, 0x02, 0x5d, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 0x00, 0xd8, + 0xe0, 0xbf, 0x15, 0xde, 0xea, 0xaf, 0xe8, 0xd5, 0xfd, 0x0b, 0xa8, 0xa8, + 0xb3, 0xd7, 0x46, 0x5d, 0xa7, 0x26, 0x6c, 0x0c, 0xb5, 0xd9, 0xbc, 0xc6, + 0xf8, 0xc0, 0x78, 0xd0, 0xf6, 0x56, 0x65, 0xf8, 0x29, 0x48, 0x0e, 0x7b, + 0x0b, 0xa6, 0x25, 0x7e, 0xe8, 0x7b, 0x79, 0x6f, 0x38, 0xe5, 0xb5, 0xb7, + 0xf4, 0xe0, 0x9c, 0x91, 0x60, 0xf4, 0x06, 0xf3, 0x40, 0x1e, 0xf9, 0x91, + 0x19, 0xa9, 0x2f, 0x47, 0x43, 0xb5, 0x9b, 0x1e, 0xdc, 0xf6, 0xaa, 0x1c, + 0x49, 0x79, 0x21, 0x28, 0xcb, 0xaa, 0x49, 0x73, 0xd9, 0x09, 0x05, 0x4c, + 0x02, 0xf2, 0x4c, 0x4d, 0x6c, 0x1c, 0x80, 0xa7, 0x14, 0x91, 0x44, 0xfc, + 0x12, 0xb3, 0xe1, 0xe7, 0xe3, 0x4f, 0x44, 0xba, 0x8c, 0xc3, 0x74, 0x39, + 0xe8, 0x4c, 0xd0, 0xd4, 0x4c, 0x24, 0x61, 0xb4, 0x40, 0x95, 0x8c, 0xc0, + 0x0a, 0xb7, 0x02, 0x39, 0x31, 0x85, 0x93, 0x02, 0x03, 0x01, 0x00, 0x01, + 0x02, 0x81, 0x81, 0x00, 0x94, 0x07, 0x72, 0xe5, 0xbe, 0xad, 0x79, 0x3b, + 0xf7, 0x33, 0x2c, 0x8e, 0x05, 0xf8, 0x1a, 0x6b, 0xd0, 0xe8, 0x91, 0xf5, + 0x16, 0x07, 0xd9, 0x82, 0x5c, 0x5c, 0xd5, 0x22, 0xa1, 0x9e, 0x42, 0x02, + 0x7f, 0x8b, 0xcd, 0xbe, 0xf4, 0x85, 0x52, 0xf6, 0x2c, 0xd5, 0x09, 0xd2, + 0x2c, 0xf4, 0x2c, 0xf6, 0x07, 0x85, 0x80, 0xf9, 0xdc, 0xd0, 0xcc, 0x3f, + 0x22, 0x31, 0x15, 0xf3, 0x49, 0xf2, 0xb5, 0xe2, 0x69, 0x99, 0x04, 0x04, + 0x49, 0x21, 0xdb, 0x9f, 0xa1, 0x54, 0x5a, 0xfa, 0xe4, 0xd9, 0xf9, 0x07, + 0x05, 0xff, 0x9a, 0x65, 0xa4, 0xeb, 0xf2, 0x47, 0xce, 0x56, 0xc7, 0x72, + 0x49, 0x48, 0x5c, 0xe8, 0x14, 0xd7, 0x8f, 0x25, 0xcc, 0x49, 0x29, 0x06, + 0x6a, 0x54, 0x7b, 0x17, 0xdc, 0x9e, 0xd4, 0x53, 0xf0, 0xf5, 0x9e, 0x85, + 0x25, 0xa1, 0xeb, 0x3d, 0xe9, 0x2f, 0xb9, 0x9c, 0xf6, 0xe1, 0x80, 0x81, + 0x02, 0x41, 0x00, 0xee, 0x02, 0x78, 0xc7, 0x78, 0x85, 0x04, 0x97, 0xcc, + 0x36, 0xbd, 0xd6, 0x11, 0xe2, 0xc7, 0x39, 0xd9, 0x34, 0x51, 0x72, 0x6f, + 0x8a, 0x0f, 0xcd, 0x88, 0x32, 0x33, 0x9b, 0xc7, 0xa7, 0x03, 0x77, 0xd9, + 0x82, 0x35, 0xb6, 0xdd, 0x1f, 0xc2, 0xc1, 0x13, 0x40, 0x83, 0x55, 0xeb, + 0x60, 0xeb, 0x81, 0x8e, 0x0c, 0x16, 0x62, 0xb4, 0xb4, 0x3c, 0xeb, 0x08, + 0x80, 0x9c, 0x79, 0xd3, 0x38, 0xca, 0xf1, 0x02, 0x41, 0x00, 0xe9, 0x45, + 0x5f, 0x2e, 0x16, 0xcc, 0x93, 0x50, 0x40, 0xb6, 0x79, 0xbc, 0x38, 0xe0, + 0x56, 0x68, 0x50, 0xd3, 0x2f, 0x73, 0x8c, 0x8c, 0x2a, 0x0e, 0x81, 0x4a, + 0x8a, 0xbb, 0xcc, 0xf0, 0x64, 0x34, 0x46, 0x9f, 0x07, 0x7d, 0x22, 0xb6, + 0xf9, 0x46, 0xac, 0x57, 0x23, 0x8c, 0x1e, 0xeb, 0xd3, 0x05, 0x4d, 0xa8, + 0x83, 0x6a, 0x67, 0xf6, 0xa6, 0xb1, 0xab, 0x8e, 0xc1, 0xef, 0xef, 0x7d, + 0xf0, 0xc3, 0x02, 0x40, 0x2f, 0xc6, 0x59, 0x3e, 0x18, 0xe8, 0x02, 0x73, + 0x01, 0xef, 0xdf, 0x0d, 0x30, 0x4b, 0xe8, 0x17, 0xa9, 0x8c, 0xc1, 0xe8, + 0x89, 0x91, 0x19, 0xf8, 0xf4, 0xa4, 0xb7, 0x0d, 0x46, 0xf7, 0x34, 0x50, + 0x03, 0x5e, 0x0a, 0xb0, 0x29, 0x14, 0xae, 0x00, 0x19, 0x80, 0x32, 0x9c, + 0xb5, 0x81, 0x9f, 0xe4, 0x42, 0x82, 0x14, 0xa0, 0x3d, 0x8b, 0x8c, 0x4a, + 0xd5, 0x4b, 0x13, 0x9d, 0xb4, 0x93, 0x4a, 0xd1, 0x02, 0x40, 0x64, 0x8c, + 0x83, 0x77, 0x61, 0x5a, 0x73, 0x11, 0x3f, 0xa3, 0xa8, 0x1b, 0x8a, 0xc4, + 0xa0, 0x5a, 0x3c, 0xa4, 0x9b, 0x2a, 0x8a, 0x65, 0x8c, 0x67, 0x4e, 0x31, + 0xac, 0x55, 0x41, 0x04, 0x49, 0x9d, 0x02, 0xe7, 0xdf, 0x99, 0x7f, 0xd2, + 0x30, 0xe6, 0xd6, 0xb8, 0x84, 0xd9, 0x0c, 0x27, 0x08, 0x81, 0x9b, 0xb4, + 0xcc, 0x58, 0x9c, 0x51, 0x84, 0x0e, 0xc7, 0x6d, 0x34, 0x89, 0x50, 0xc9, + 0x0f, 0x73, 0x02, 0x41, 0x00, 0xda, 0xde, 0x5e, 0x1a, 0xac, 0x1d, 0x1d, + 0xd7, 0xb9, 0x65, 0x26, 0x00, 0xf5, 0xd4, 0xe4, 0x28, 0x84, 0x86, 0x2f, + 0x00, 0x9c, 0x41, 0x00, 0x52, 0xe1, 0x47, 0x91, 0xc0, 0x52, 0x05, 0x4e, + 0x0f, 0x2f, 0x0d, 0xca, 0x9b, 0x3d, 0x89, 0x41, 0xbf, 0xee, 0x9f, 0xa1, + 0xe6, 0x9d, 0xa4, 0xeb, 0x45, 0x7f, 0xe3, 0xcb, 0xa4, 0x6b, 0x0a, 0xe2, + 0x7e, 0xb0, 0x87, 0x5c, 0x40, 0xb1, 0x51, 0x11, 0x1d }; -unsigned int default_private_key_len = 321; +unsigned int default_private_key_len = 609; diff --git a/ssl/test/make_certs.sh b/ssl/test/make_certs.sh index 0e58d73bc3..f0d609580c 100755 --- a/ssl/test/make_certs.sh +++ b/ssl/test/make_certs.sh @@ -156,7 +156,7 @@ openssl pkcs12 -export -in axTLS.x509_1024.pem -inkey axTLS.key_1024.pem -keypbe cat axTLS.ca_x509.pem >> axTLS.x509_device.pem # set default key/cert for use in the server -xxd -i axTLS.x509_512.cer | sed -e \ - "s/axTLS_x509_512_cer/default_certificate/" > ../../ssl/cert.h -xxd -i axTLS.key_512 | sed -e \ - "s/axTLS_key_512/default_private_key/" > ../../ssl/private_key.h +xxd -i axTLS.x509_1024.cer | sed -e \ + "s/axTLS_x509_1024_cer/default_certificate/" > ../../ssl/cert.h +xxd -i axTLS.key_1024 | sed -e \ + "s/axTLS_key_1024/default_private_key/" > ../../ssl/private_key.h From d978b9a522154311ff804c3ee7eae7cf9e8f720a Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 23 Jul 2006 12:32:11 +0000 Subject: [PATCH 018/301] Keep socket connections open as per v1.1 HTTP git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@25 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/awhttpd.patch | 172 ++++++++++++++++++++++++++------------------ 1 file changed, 103 insertions(+), 69 deletions(-) diff --git a/httpd/awhttpd.patch b/httpd/awhttpd.patch index ab63d6416f..a49d1dc4cd 100644 --- a/httpd/awhttpd.patch +++ b/httpd/awhttpd.patch @@ -1,6 +1,6 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h --- awhttpd/aw3.h 2005-01-23 13:17:14.000000000 +1000 -+++ axTLS/httpd/awhttpd/aw3.h 2006-07-07 20:37:30.890625000 +1000 ++++ axTLS/httpd/awhttpd/aw3.h 2006-07-22 18:09:01.968750000 +1000 @@ -7,17 +7,16 @@ */ @@ -39,7 +39,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h struct connstruct { struct connstruct *next; -@@ -46,29 +45,46 @@ +@@ -46,29 +45,48 @@ int networkdesc; int filedesc; @@ -72,7 +72,9 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h long offset; char databuf[BLOCKSIZE]; -+ int is_ssl; ++ unsigned char is_ssl; ++ unsigned char close_when_done; ++ unsigned char modified_since; }; @@ -86,7 +88,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h }; -@@ -111,13 +127,20 @@ +@@ -111,13 +129,20 @@ // Useful macros @@ -108,7 +110,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h void removeconnection(struct connstruct *cn); -@@ -129,16 +152,17 @@ +@@ -129,16 +154,17 @@ void procsendhead(struct connstruct *cn); void procreadfile(struct connstruct *cn); void procsendfile(struct connstruct *cn); @@ -128,7 +130,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h int openlistener(int port); int openlistener6(int port); -@@ -150,9 +174,9 @@ +@@ -150,9 +176,9 @@ // misc.c prototypes @@ -141,7 +143,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h void stripcrlf(char *p); char *my_strncpy(char *dest, const char *src, size_t n); #ifndef __HAVE_ARCH_STRNLEN -@@ -166,12 +190,12 @@ +@@ -166,12 +192,12 @@ void buildactualfile(struct connstruct *cn); int issockwriteable(int sd); int isdir(char *name); @@ -156,7 +158,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h // urldecode.c prototypes -@@ -188,7 +212,7 @@ +@@ -188,7 +214,7 @@ // conf.c prototypes @@ -165,7 +167,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h void procconf(char *filename); -@@ -202,4 +226,4 @@ +@@ -202,4 +228,4 @@ // main.c prototypes @@ -173,7 +175,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h +void initlists(void); diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c --- awhttpd/cgi.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/cgi.c 2006-07-07 20:37:30.890625000 +1000 ++++ axTLS/httpd/awhttpd/cgi.c 2006-07-22 16:54:31.546875000 +1000 @@ -7,29 +7,33 @@ */ @@ -362,7 +364,7 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c +#endif /* CONFIG_HTTP_HAS_CGI */ diff -Naur awhttpd/conf.c axTLS/httpd/awhttpd/conf.c --- awhttpd/conf.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/conf.c 2006-07-07 20:37:30.890625000 +1000 ++++ axTLS/httpd/awhttpd/conf.c 2006-07-22 16:54:31.562500000 +1000 @@ -10,11 +10,7 @@ #include #include @@ -450,7 +452,7 @@ diff -Naur awhttpd/conf.c axTLS/httpd/awhttpd/conf.c +#endif /* CONFIG_STANDARD_AWHTTPD */ diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c --- awhttpd/conn.c 2004-12-07 16:11:02.000000000 +1000 -+++ axTLS/httpd/awhttpd/conn.c 2006-07-07 20:37:30.890625000 +1000 ++++ axTLS/httpd/awhttpd/conn.c 2006-07-22 18:08:57.687500000 +1000 @@ -9,15 +9,11 @@ #include @@ -490,7 +492,13 @@ diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c *(tp->virtualhostreq) = '\0'; tp->state = STATE_WANT_TO_READ_HEAD; -@@ -57,7 +62,6 @@ +@@ -53,11 +58,12 @@ + my_strncpy(tp->ip, ip, MAXIPLEN); + + tp->offset = -1; ++ tp->close_when_done = 0; ++ tp->modified_since = 0; + numusers++; updatetimeout(tp, time(NULL)); @@ -498,7 +506,7 @@ diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c return; } -@@ -95,10 +99,22 @@ +@@ -95,10 +101,22 @@ freeconns = cn; // Close it all down @@ -525,7 +533,7 @@ diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c return; diff -Naur awhttpd/errors.c axTLS/httpd/awhttpd/errors.c --- awhttpd/errors.c 2005-01-23 06:49:29.000000000 +1000 -+++ axTLS/httpd/awhttpd/errors.c 2006-07-07 20:37:30.890625000 +1000 ++++ axTLS/httpd/awhttpd/errors.c 2006-07-22 16:54:31.562500000 +1000 @@ -8,7 +8,6 @@ @@ -562,7 +570,7 @@ diff -Naur awhttpd/errors.c axTLS/httpd/awhttpd/errors.c char buf[1024]; diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c --- awhttpd/index.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/index.c 2006-07-07 20:37:30.890625000 +1000 ++++ axTLS/httpd/awhttpd/index.c 2006-07-22 16:54:31.562500000 +1000 @@ -11,7 +11,6 @@ #include #include @@ -588,7 +596,7 @@ diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c my_strncpy(cn->actualfile, tbuf, MAXREQUESTLENGTH); diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c --- awhttpd/main.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/main.c 2006-07-07 20:37:30.890625000 +1000 ++++ axTLS/httpd/awhttpd/main.c 2006-07-22 16:54:31.562500000 +1000 @@ -11,7 +11,6 @@ #include #include @@ -828,7 +836,7 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c return 0; diff -Naur awhttpd/mime_types.c axTLS/httpd/awhttpd/mime_types.c --- awhttpd/mime_types.c 2004-01-26 01:08:47.000000000 +1000 -+++ axTLS/httpd/awhttpd/mime_types.c 2006-07-07 20:37:30.890625000 +1000 ++++ axTLS/httpd/awhttpd/mime_types.c 2006-07-22 16:54:31.562500000 +1000 @@ -21,13 +21,14 @@ @@ -862,7 +870,7 @@ diff -Naur awhttpd/mime_types.c axTLS/httpd/awhttpd/mime_types.c + diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c --- awhttpd/misc.c 2005-01-23 12:59:09.000000000 +1000 -+++ axTLS/httpd/awhttpd/misc.c 2006-07-07 20:37:30.890625000 +1000 ++++ axTLS/httpd/awhttpd/misc.c 2006-07-22 16:54:31.578125000 +1000 @@ -7,33 +7,33 @@ */ @@ -1008,7 +1016,7 @@ diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c +#endif diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c --- awhttpd/net.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/net.c 2006-07-07 20:37:30.906250000 +1000 ++++ axTLS/httpd/awhttpd/net.c 2006-07-22 16:54:31.578125000 +1000 @@ -8,9 +8,7 @@ @@ -1111,7 +1119,7 @@ diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c --- awhttpd/permcheck.c 2005-01-23 06:49:29.000000000 +1000 -+++ axTLS/httpd/awhttpd/permcheck.c 2006-07-07 20:37:30.906250000 +1000 ++++ axTLS/httpd/awhttpd/permcheck.c 2006-07-22 16:54:31.578125000 +1000 @@ -7,21 +7,23 @@ */ @@ -1202,7 +1210,7 @@ diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c +#endif /* CONFIG_HTTP_PERM_CHECK */ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c --- awhttpd/proc.c 2005-01-23 10:59:41.000000000 +1000 -+++ axTLS/httpd/awhttpd/proc.c 2006-07-07 21:07:26.250000000 +1000 ++++ axTLS/httpd/awhttpd/proc.c 2006-07-23 10:32:07.593750000 +1000 @@ -13,14 +13,12 @@ #include #include @@ -1229,7 +1237,18 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c } else if (strcmp(words[0], "Host:")==0) { -@@ -85,19 +85,22 @@ +@@ -80,24 +80,32 @@ + if (isdigit(*words[1]) == 0) return 1; + + cn->offset = atoi(words[1]); +- ++ } else if (strcmp(words[0], "Connection:")==0 && ++ strcmp(words[1], "close")==0) { ++ cn->close_when_done = 1; ++ } else if (strcmp(words[0], "If-Modified-Since:")==0) { ++ /* TODO: parse this date properly with getdate() or similar */ ++ cn->modified_since = 1; + } return 1; @@ -1254,7 +1273,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c if (cn->reqtype == TYPE_HEAD) { snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n"); -@@ -107,7 +110,17 @@ +@@ -107,7 +115,17 @@ return; } @@ -1273,7 +1292,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c if (cn->dirp == NULL) { send404(cn); removeconnection(cn); -@@ -116,12 +129,13 @@ +@@ -116,12 +134,13 @@ // Get rid of the "." readdir(cn->dirp); @@ -1289,7 +1308,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c cn->state = STATE_DOING_DIR; -@@ -134,36 +148,48 @@ +@@ -134,36 +153,48 @@ void procdodir(struct connstruct *cn) { @@ -1347,7 +1366,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c -@@ -172,9 +198,10 @@ +@@ -172,9 +203,10 @@ char buf[MAXREQUESTLENGTH*4], *tp, *next; int rv; @@ -1361,14 +1380,18 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c return; } -@@ -217,36 +244,97 @@ +@@ -217,36 +249,100 @@ void procsendhead(struct connstruct *cn) { char buf[1024]; + char actualfile[1024]; struct stat stbuf; - +- - if (stat(cn->actualfile, &stbuf) == -1) { ++ time_t now = time(NULL); ++ char date[32]; ++ strcpy(date, ctime(&now)); ++ + strcpy(actualfile, cn->actualfile); + +#ifdef WIN32 @@ -1466,7 +1489,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c if ((stbuf.st_mode & S_IFMT) == S_IFDIR) { if (cn->filereq[strlen(cn->filereq)-1] != '/') { send301(cn); -@@ -256,16 +344,24 @@ +@@ -256,16 +352,24 @@ // Check to see if this dir has an index file if (procindex(cn, &stbuf) == 0) { @@ -1493,7 +1516,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c isdir(cn->actualfile)) { send404(cn); removeconnection(cn); -@@ -275,6 +371,7 @@ +@@ -275,39 +379,57 @@ proccgi(cn,0); return; } @@ -1501,40 +1524,45 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c // If the index isn't a CGI, we continue on with the index file } -@@ -282,6 +379,7 @@ - if (cn->offset == -1 || cn->offset >= stbuf.st_size) { - cn->offset = -1; -+#if defined (CONFIG_STANDARD_AWHTTPD) - snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s (%s)\nContent-Type: %s\nContent-Length: %ld\nLast-Modified: %s\n", - VERSION, - quote, -@@ -299,15 +397,41 @@ - (long) stbuf.st_size - cn->offset, - ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end - } -+#else +- if (cn->offset == -1 || cn->offset >= stbuf.st_size) { ++ if (cn->modified_since) { ++ snprintf(buf, sizeof(buf), "HTTP/1.1 304 Not Modified\nServer: Anti-Web V%s\nDate: %s\n", VERSION, date); ++ special_write(cn, buf, strlen(buf)); ++ cn->modified_since = 0; ++ cn->state = STATE_WANT_TO_READ_HEAD; ++ return; ++ } ++ else if (cn->offset == -1 || cn->offset >= stbuf.st_size) { +#ifdef CONFIG_HTTP_VERBOSE + printf("awhttpd: %s send %s\n", + cn->is_ssl ? "https" : "http", cn->actualfile); + TTY_FLUSH(); +#endif -+ snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s\nContent-Type: %s\nContent-Length: %ld\nLast-Modified: %s\n", -+ VERSION, -+ getmimetype(cn->actualfile), -+ (long) stbuf.st_size, -+ ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end -+ } else { -+ snprintf(buf, sizeof(buf), "HTTP/1.1 206 OK\nServer: Anti-Web V%s\nContent-Type: %s\nContent-Range: %ld-%ld/%ld\nContent-Length: %ld\nLast-Modified: %s\n", -+ VERSION, -+ getmimetype(cn->actualfile), -+ cn->offset, -+ (long) stbuf.st_size-1, -+ (long) stbuf.st_size, -+ (long) stbuf.st_size - cn->offset, -+ ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end -+ } -+#endif /* CONFIG_HTTP_USE_QUOTE */ ++ + cn->offset = -1; + +- snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s (%s)\nContent-Type: %s\nContent-Length: %ld\nLast-Modified: %s\n", ++ snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s\nContent-Type: %s\nContent-Length: %ld\nDate: %sLast-Modified: %s\n", + VERSION, +- quote, + getmimetype(cn->actualfile), + (long) stbuf.st_size, ++ date, + ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end + } else { +- snprintf(buf, sizeof(buf), "HTTP/1.1 206 OK\nServer: Anti-Web V%s (%s)\nContent-Type: %s\nContent-Range: %ld-%ld/%ld\nContent-Length: %ld\nLast-Modified: %s\n", ++ snprintf(buf, sizeof(buf), "HTTP/1.1 206 OK\nServer: Anti-Web V%s\nContent-Type: %s\nContent-Range: %ld-%ld/%ld\nContent-Length: %ld\nDate: %sLast-Modified: %s\n", + VERSION, +- quote, + getmimetype(cn->actualfile), + cn->offset, + (long) stbuf.st_size-1, + (long) stbuf.st_size, + (long) stbuf.st_size - cn->offset, ++ date, + ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end + } - write(cn->networkdesc, buf, strlen(buf)); + special_write(cn, buf, strlen(buf)); @@ -1544,7 +1572,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c return; } else { + int flags = O_RDONLY; -+#ifdef WIN32 ++#if defined(WIN32) || defined(CYGWIN) + flags |= O_BINARY; +#endif @@ -1553,7 +1581,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c if (cn->filedesc == -1) { send404(cn); removeconnection(cn); -@@ -318,7 +442,23 @@ +@@ -318,7 +440,23 @@ lseek(cn->filedesc, cn->offset, SEEK_SET); } @@ -1577,7 +1605,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c return; } -@@ -328,13 +468,13 @@ +@@ -328,13 +466,19 @@ void procreadfile(struct connstruct *cn) { @@ -1591,26 +1619,32 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c - return; + close(cn->filedesc); + cn->filedesc = -1; -+ removeconnection(cn); ++ if (cn->close_when_done) /* close immediately */ ++ removeconnection(cn); ++ else { /* keep socket open - HTTP 1.1 */ ++ cn->state = STATE_WANT_TO_READ_HEAD; ++ cn->numbytes = 0; ++ cn->offset = -1; ++ } + return; } cn->numbytes = rv; -@@ -347,11 +487,9 @@ +@@ -347,11 +491,9 @@ void procsendfile(struct connstruct *cn) { - int rv; +- +- rv = write(cn->networkdesc, cn->databuf, cn->numbytes); + int rv = special_write(cn, cn->databuf, cn->numbytes); -- rv = write(cn->networkdesc, cn->databuf, cn->numbytes); -- - if (rv == -1) + if (rv < 0) removeconnection(cn); else if (rv == cn->numbytes) cn->state = STATE_WANT_TO_READ_FILE; -@@ -361,7 +499,47 @@ +@@ -361,7 +503,47 @@ memmove(cn->databuf, cn->databuf + rv, cn->numbytes - rv); cn->numbytes -= rv; } @@ -1661,7 +1695,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c } diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c --- awhttpd/socket.c 2004-04-25 13:03:05.000000000 +1000 -+++ axTLS/httpd/awhttpd/socket.c 2006-07-07 20:37:30.906250000 +1000 ++++ axTLS/httpd/awhttpd/socket.c 2006-07-22 16:54:31.578125000 +1000 @@ -8,19 +8,11 @@ @@ -1748,7 +1782,7 @@ diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c memset(&(my_addr.sin_zero), 0, 8); // zero the rest of the struct diff -Naur awhttpd/urlencode.c axTLS/httpd/awhttpd/urlencode.c --- awhttpd/urlencode.c 2004-05-14 10:53:47.000000000 +1000 -+++ axTLS/httpd/awhttpd/urlencode.c 2006-07-07 20:37:30.906250000 +1000 ++++ axTLS/httpd/awhttpd/urlencode.c 2006-07-22 16:54:31.593750000 +1000 @@ -13,7 +13,7 @@ #include From 202f18ffd956eaeeb48a8b0170866475a205f32c Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 23 Jul 2006 12:32:55 +0000 Subject: [PATCH 019/301] New file positions. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@26 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/awhttpd.aip | 130 +++++++++++++++++++++++++++++++++------------ 1 file changed, 97 insertions(+), 33 deletions(-) diff --git a/config/awhttpd.aip b/config/awhttpd.aip index 575102d520..a460ecbf20 100755 --- a/config/awhttpd.aip +++ b/config/awhttpd.aip @@ -8,10 +8,10 @@ - + - +     @@ -23,6 +23,16 @@ + + + + + + + + + + @@ -35,44 +45,94 @@ - + + + + + + + + + + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -103,6 +163,10 @@ + + + + From 415ff0ad4c0ad2d319ebfa8882a6dc634e322913 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 31 Jul 2006 08:16:20 +0000 Subject: [PATCH 020/301] new config for awhttpd git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@27 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/win32config | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/config/win32config b/config/win32config index ce1e485c68..fe94084f5a 100644 --- a/config/win32config +++ b/config/win32config @@ -10,6 +10,7 @@ CONFIG_PLATFORM_WIN32=y # # General Configuration # +PREFIX="/usr/local" # CONFIG_DEBUG is not set # @@ -54,13 +55,9 @@ CONFIG_AWHTTPD=y # CONFIG_HTTP_STATIC_BUILD is not set CONFIG_HTTP_HAS_SSL=y CONFIG_HTTP_HTTPS_PORT=443 -# CONFIG_STANDARD_AWHTTPD is not set CONFIG_HTTP_WEBROOT="www" CONFIG_HTTP_PORT=80 -# CONFIG_HTTP_USE_TIMEOUT is not set -CONFIG_HTTP_TIMEOUT=0 -CONFIG_HTTP_INITIAL_SLOTS=10 -CONFIG_HTTP_MAX_USERS=100 +CONFIG_HTTP_TIMEOUT=5 # CONFIG_HTTP_HAS_CGI is not set CONFIG_HTTP_CGI_EXTENSION="" CONFIG_HTTP_DIRECTORIES=y From e8ef4b4b84dc511632a8b41d0e2dbcb0f2854ca2 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 31 Jul 2006 08:16:46 +0000 Subject: [PATCH 021/301] new performance script git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@28 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/JMeter.jmx | 83 +++++++++++++++++++++++------------------------ 1 file changed, 40 insertions(+), 43 deletions(-) diff --git a/config/JMeter.jmx b/config/JMeter.jmx index 0ef7c74696..5070760b05 100755 --- a/config/JMeter.jmx +++ b/config/JMeter.jmx @@ -10,7 +10,7 @@ - + 1152004173000 @@ -25,7 +25,7 @@ 0 - + /index.html GET true @@ -44,40 +44,6 @@ - - 1152004173000 - - - 16 - false - - 10 - false - - 1152004173000 - continue - 0 - - - - /index.html - GET - true - HTTPS - true - 443 - - - - - - false - 127.0.0.1 - - false - - - 1152004173000 @@ -89,17 +55,17 @@ false 1152004173000 - continue + stopthread 0 - + /index.html GET true HTTPS true - 1443 + 443 @@ -127,7 +93,7 @@ 0 - + /index.html GET true @@ -161,7 +127,7 @@ 0 - + /index.html GET true @@ -195,13 +161,13 @@ 0 - + /index.html GET true HTTPS true - 4443 + 1443 @@ -245,6 +211,37 @@ false + + + + + true + true + true + + true + true + true + true + false + true + true + false + false + false + false + false + false + false + false + 0 + + saveConfig + + + false + + From c4e8d530cf5ef18165f2fc2a4a3f724a40b4afd3 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 31 Jul 2006 08:17:13 +0000 Subject: [PATCH 022/301] New awhttpd configuration git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@29 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/Config.in | 43 +- httpd/Makefile | 3 +- httpd/awhttpd.patch | 1228 ++++++++++++++++++++++++++++--------------- 3 files changed, 803 insertions(+), 471 deletions(-) diff --git a/httpd/Config.in b/httpd/Config.in index c9240864dd..09f0981a67 100644 --- a/httpd/Config.in +++ b/httpd/Config.in @@ -28,17 +28,10 @@ config CONFIG_HTTP_HTTPS_PORT You must be a root user in order to use the default port. -config CONFIG_STANDARD_AWHTTPD - bool "Use Standard AWHTTPD Configuration" - default n - help - Use the configuration file that awhttpd normally uses. - config CONFIG_HTTP_WEBROOT string "Web root location" default "../www" if !CONFIG_PLATFORM_WIN32 default "..\\www" if CONFIG_PLATFORM_WIN32 - depends on !CONFIG_STANDARD_AWHTTPD help The location of the web root in relation to awhttpd. This is the directory where index.html lives. @@ -46,47 +39,20 @@ config CONFIG_HTTP_WEBROOT config CONFIG_HTTP_PORT int "HTTP port" default 80 - depends on !CONFIG_STANDARD_AWHTTPD help The port number of the normal HTTP server. You must be a root user in order to use the default port. -config CONFIG_HTTP_USE_TIMEOUT - bool "Use Timeout" - default n - depends on !CONFIG_STANDARD_AWHTTPD - help - Enable timeouts to be used. - config CONFIG_HTTP_TIMEOUT int "Timeout" default 5 - depends on CONFIG_HTTP_USE_TIMEOUT - help - Set the timeout in seconds. - -config CONFIG_HTTP_INITIAL_SLOTS - int "Initial Slots" - default 10 - depends on !CONFIG_STANDARD_AWHTTPD - help - Determine the number of slots. - - This is just an initial value to allocate memory. This will go all the - way up to max usrs. - -config CONFIG_HTTP_MAX_USERS - int "Max Users" - default 100 - depends on !CONFIG_STANDARD_AWHTTPD help - Determine the maximum number of simultaneous users at any time + Set the timeout of a connection in seconds. config CONFIG_HTTP_HAS_CGI bool "Enable CGI" default n - depends on !CONFIG_STANDARD_AWHTTPD help Enable the CGI capability. @@ -100,14 +66,12 @@ config CONFIG_HTTP_CGI_EXTENSION config CONFIG_HTTP_DIRECTORIES bool "Enable Directory Listing" default n - depends on !CONFIG_STANDARD_AWHTTPD help Enable directory listing. config CONFIG_HTTP_PERM_CHECK bool "Permissions Check" default n - depends on !CONFIG_STANDARD_AWHTTPD help Enable permissions checking on the directories before reading the files in them. @@ -115,7 +79,7 @@ config CONFIG_HTTP_PERM_CHECK config CONFIG_HTTP_HAS_IPV6 bool "Enable IPv6" default n - depends on !CONFIG_STANDARD_AWHTTPD && !CONFIG_PLATFORM_WIN32 + depends on !CONFIG_PLATFORM_WIN32 help Use IPv6 instead of IPv4. @@ -125,14 +89,13 @@ config CONFIG_HTTP_VERBOSE bool "Verbose Mode" default y if CONFIG_SSL_FULL_MODE default n if !CONFIG_SSL_FULL_MODE - depends on !CONFIG_STANDARD_AWHTTPD help Enable extra statements used when using awhttpd. config CONFIG_HTTP_IS_DAEMON bool "Run as a daemon" default n - depends on !CONFIG_STANDARD_AWHTTPD && !CONFIG_PLATFORM_WIN32 + depends on !CONFIG_PLATFORM_WIN32 help Run awhttpd as a background process. diff --git a/httpd/Makefile b/httpd/Makefile index 3b8f4b0895..07261a52cd 100644 --- a/httpd/Makefile +++ b/httpd/Makefile @@ -72,8 +72,7 @@ OBJ= \ mime_types.o \ index.o \ urlencode.o \ - permcheck.o \ - conf.o + permcheck.o %.o : awhttpd/%.c ../config/.config $(CC) -c $(CFLAGS) $< diff --git a/httpd/awhttpd.patch b/httpd/awhttpd.patch index a49d1dc4cd..5ab15a0bf2 100644 --- a/httpd/awhttpd.patch +++ b/httpd/awhttpd.patch @@ -1,6 +1,6 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h --- awhttpd/aw3.h 2005-01-23 13:17:14.000000000 +1000 -+++ axTLS/httpd/awhttpd/aw3.h 2006-07-22 18:09:01.968750000 +1000 ++++ axTLS/httpd/awhttpd/aw3.h 2006-07-26 23:09:27.343750000 +1000 @@ -7,17 +7,16 @@ */ @@ -39,29 +39,28 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h struct connstruct { struct connstruct *next; -@@ -46,29 +45,48 @@ +@@ -46,29 +45,43 @@ int networkdesc; int filedesc; -+ -+#if defined(CONFIG_HTTP_DIRECTORIES) || defined(CONFIG_STANDARD_AWHTTPD) +- DIR *dirp; + +- int timeout; ++#if defined(CONFIG_HTTP_DIRECTORIES) +#ifdef WIN32 + HANDLE dirp; + WIN32_FIND_DATA file_data; +#else - DIR *dirp; ++ DIR *dirp; +#endif +#endif -+#if defined(CONFIG_STANDARD_AWHTTPD) || defined(CONFIG_HTTP_USE_TIMEOUT) - int timeout; -+#endif - ++ time_t timeout; char ip[MAXIPLEN]; - +- char actualfile[MAXREQUESTLENGTH]; char filereq[MAXREQUESTLENGTH]; -+#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_HAS_CGI) char cgiargs[MAXREQUESTLENGTH]; char cgiscriptinfo[MAXREQUESTLENGTH]; char cgipathinfo[MAXREQUESTLENGTH]; @@ -69,7 +68,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h char virtualhostreq[MAXREQUESTLENGTH]; int numbytes; - long offset; +- long offset; char databuf[BLOCKSIZE]; + unsigned char is_ssl; @@ -88,21 +87,29 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h }; -@@ -111,13 +129,20 @@ - - - // Useful macros -+#ifdef CONFIG_STANDARD_AWHTTPD - #define istimedout(tp,ct) ((ct) > (tp)->timeout) - #define updatetimeout(tp,ct) ((tp)->timeout = (ct)+usertimeout) -+#elif CONFIG_HTTP_USE_TIMEOUT -+#define istimedout(tp,ct) ((ct) > (tp)->timeout) -+#define updatetimeout(tp,ct) ((tp)->timeout = (ct)+CONFIG_HTTP_TIMEOUT) -+#else -+#define updatetimeout(tp,ct) /* empty macro */ -+#endif +@@ -96,28 +109,13 @@ + // Conf global prototypes +-extern int usevirtualhosts; + extern char *webroot; + extern int allowdirectorylisting; + extern int allowcgi; + extern int permcheck; +-extern int maxusers; +-extern int usertimeout; +-extern int initialslots; +-extern char *quote; +-extern int initialslots; +- +-extern int numusers; +- +- +-// Useful macros +-#define istimedout(tp,ct) ((ct) > (tp)->timeout) +-#define updatetimeout(tp,ct) ((tp)->timeout = (ct)+usertimeout) +- +- // conn.c prototypes -void addconnection(int sd, char *ip); @@ -110,7 +117,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h void removeconnection(struct connstruct *cn); -@@ -129,16 +154,17 @@ +@@ -129,30 +127,29 @@ void procsendhead(struct connstruct *cn); void procreadfile(struct connstruct *cn); void procsendfile(struct connstruct *cn); @@ -124,13 +131,17 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h // socket.c prototypes - int pollsocket(int sd, long ustimeout); +-int pollsocket(int sd, long ustimeout); -void handlenewconnection(int listenfd); +void handlenewconnection(int listenfd, int is_ssl); int openlistener(int port); int openlistener6(int port); -@@ -150,9 +176,9 @@ + + // errors.c prototypes +-void send505(int sd, char *reason); + void send404(struct connstruct *cn); + void send301(struct connstruct *cn); // misc.c prototypes @@ -143,12 +154,17 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h void stripcrlf(char *p); char *my_strncpy(char *dest, const char *src, size_t n); #ifndef __HAVE_ARCH_STRNLEN -@@ -166,12 +192,12 @@ +@@ -160,18 +157,16 @@ + #endif + int iscgi(char *fn); + int split(char *tp, char *sp[], int maxwords, char sc); +-int confsplit(char *tp, char *sp[], int maxwords); + int sanitizefile(char *buf); + int sanitizehost(char *buf); void buildactualfile(struct connstruct *cn); int issockwriteable(int sd); int isdir(char *name); -void status(); -+void status(void); int trycgi_withpathinfo(struct connstruct *cn); @@ -158,16 +174,15 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h // urldecode.c prototypes -@@ -188,7 +214,7 @@ +@@ -188,7 +183,6 @@ // conf.c prototypes -void defaultconfvals(); -+void defaultconfvals(void); void procconf(char *filename); -@@ -202,4 +228,4 @@ +@@ -202,4 +196,4 @@ // main.c prototypes @@ -175,8 +190,8 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h +void initlists(void); diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c --- awhttpd/cgi.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/cgi.c 2006-07-22 16:54:31.546875000 +1000 -@@ -7,29 +7,33 @@ ++++ axTLS/httpd/awhttpd/cgi.c 2006-07-26 23:05:56.890625000 +1000 +@@ -7,93 +7,46 @@ */ @@ -190,62 +205,69 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c -+#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_HAS_CGI) void addcgiext(char *tp) { struct cgiextstruct *ex; ex = (struct cgiextstruct *) malloc(sizeof(struct cgiextstruct)); - if (ex == NULL) { -+#ifdef CONFIG_HTTP_VERBOSE - fprintf(stderr, "Serious memory error...\n"); +- if (ex == NULL) { +- fprintf(stderr, "Serious memory error...\n"); - exit(0); -+#endif -+ exit(1); - } - +- } +- ex->ext = strdup(tp); - if (ex->ext == NULL) { -+#ifdef CONFIG_HTTP_VERBOSE - fprintf(stderr, "Serious memory error...\n"); +- if (ex->ext == NULL) { +- fprintf(stderr, "Serious memory error...\n"); - exit(0); -+#endif -+ exit(1); - } - +- } +- ex->next = cgiexts; -@@ -43,7 +47,7 @@ - - void gensysenv(struct connstruct *cn) { - + cgiexts = ex; +- +- return; +- +-} +- +- +- +-void gensysenv(struct connstruct *cn) { +- - #ifndef LIMITEDCGI -+#if !defined (LIMITEDCGI) && !defined(WIN32) - - char buf[1024]; - -@@ -54,7 +58,9 @@ - - setenv("AW_VERSION", VERSION, 1); - -+#ifdef CONFIG_STANDARD_AWHTTPD - setenv("AW_QUOTE", quote, 1); -+#endif - - /* Commented this out because (and this is ridiculous) PHP - doesn't seem to work with this variable specified -@@ -70,30 +76,39 @@ - - setenv("QUERY_STRING", cn->cgiargs, 1); - +- +- char buf[1024]; +- +- setenv("REMOTE_ADDR", cn->ip, 1); +- +- snprintf(buf, sizeof(buf), "%d", numusers); +- setenv("AW_NUMUSERS", buf, 1); +- +- setenv("AW_VERSION", VERSION, 1); +- +- setenv("AW_QUOTE", quote, 1); +- +-/* Commented this out because (and this is ridiculous) PHP +- doesn't seem to work with this variable specified +- */ +-/* +- snprintf ( buf, sizeof(buf), "Anti-Web V%s (%s)", VERSION, quote ); +- setenv("SERVER_SOFTWARE", buf, 1); +-*/ +- +- setenv("SCRIPT_NAME", cn->cgiscriptinfo, 1); +- +- setenv("PATH_INFO", cn->cgipathinfo, 1); +- +- setenv("QUERY_STRING", cn->cgiargs, 1); +- - return; - - #endif - -+#endif } - - +- +- void proccgi(struct connstruct *cn, int has_pathinfo) { - int tpipe[2], fv; @@ -253,22 +275,19 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c + int tpipe[2]; + char *myargs[5]; char buf[MAXREQUESTLENGTH]; +- +- snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s (%s)\n%s", +- VERSION, +- quote, (cn->reqtype == TYPE_HEAD) ? "\n" : ""); +- write(cn->networkdesc, buf, strlen(buf)); +#ifdef WIN32 + int tmp_stdout; +#else + int fv; +#endif - -+#ifdef CONFIG_STANDARD_AWHTTPD - snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s (%s)\n%s", - VERSION, - quote, (cn->reqtype == TYPE_HEAD) ? "\n" : ""); -- write(cn->networkdesc, buf, strlen(buf)); -+#else ++ + snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s\n%s", -+ VERSION, -+ (cn->reqtype == TYPE_HEAD) ? "\n" : ""); -+#endif ++ VERSION, (cn->reqtype == TYPE_HEAD) ? "\n" : ""); + special_write(cn, buf, strlen(buf)); if (cn->reqtype == TYPE_HEAD) { @@ -280,7 +299,7 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c if (pipe(tpipe) == -1) { removeconnection(cn); return; -@@ -108,7 +123,8 @@ +@@ -108,7 +61,8 @@ return; } @@ -290,7 +309,7 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c // Close the write descriptor close(tpipe[1]); cn->filedesc = tpipe[0]; -@@ -132,19 +148,64 @@ +@@ -132,19 +86,62 @@ close(tpipe[1]); myargs[0] = cn->actualfile; @@ -303,20 +322,21 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c - my_strncpy(cn->cgipathinfo, "/", MAXREQUESTLENGTH); - my_strncpy(cn->cgiscriptinfo, cn->filereq, MAXREQUESTLENGTH); - } +- +- gensysenv(cn); + if (!has_pathinfo) { + my_strncpy(cn->cgipathinfo, "/", MAXREQUESTLENGTH); + my_strncpy(cn->cgiscriptinfo, cn->filereq, MAXREQUESTLENGTH); + } - gensysenv(cn); - execv(cn->actualfile, myargs); +#else /* WIN32 */ + if (_pipe(tpipe, 4096, O_BINARY| O_NOINHERIT) == -1) { + removeconnection(cn); + return; + } -+ + +- exit(0); + myargs[0] = "sh"; + myargs[1] = "-c"; + myargs[2] = cn->actualfile; @@ -331,12 +351,11 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c + *t++ = '/'; + } + } - -- exit(0); ++ + tmp_stdout = _dup(_fileno(stdout)); + _dup2(tpipe[1], _fileno(stdout)); + close(tpipe[1]); - ++ + /* change to suit execution method */ + if (spawnl(P_NOWAIT, "c:\\Program Files\\cygwin\\bin\\sh.exe", + myargs[0], myargs[1], myargs[2], myargs[3], myargs[4]) == -1) { @@ -352,7 +371,7 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c + for (;;) + { + procreadfile(cn); -+ + + if (cn->filedesc == -1) + break; + @@ -364,96 +383,277 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c +#endif /* CONFIG_HTTP_HAS_CGI */ diff -Naur awhttpd/conf.c axTLS/httpd/awhttpd/conf.c --- awhttpd/conf.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/conf.c 2006-07-22 16:54:31.562500000 +1000 -@@ -10,11 +10,7 @@ - #include - #include - #include ++++ axTLS/httpd/awhttpd/conf.c 1970-01-01 10:00:00.000000000 +1000 +@@ -1,265 +0,0 @@ +-/* Anti-Web HTTPD */ +-/* Hardcore Software */ +-/* +-This software is Copyright (C) 2001-2004 By Hardcore Software and +-others. The software is distributed under the terms of the GNU General +-Public License. See the file 'COPYING' for more details. +-*/ +- +- +-#include +-#include +-#include -#include -#include - #include +-#include -#include - - #include "aw3.h" - - -@@ -23,21 +19,29 @@ - - int usevirtualhosts; - char *webroot; -+int initialslots; -+int maxusers; -+ -+#ifdef CONFIG_STANDARD_AWHTTPD -+ - int allowdirectorylisting; - int allowcgi; - int permcheck; +-#include "aw3.h" +- +- +- +-// CONF GLOBALS: +- +-int usevirtualhosts; +-char *webroot; +-int allowdirectorylisting; +-int allowcgi; +-int permcheck; -int maxusers; - int usertimeout; +-int usertimeout; -int initialslots; - char *quote; - -+#endif /* CONFIG_STANDARD_AWHTTPD */ -+ -+ - int numusers; - - - - void defaultconfvals() { - -+#ifdef CONFIG_STANDARD_AWHTTPD - usevirtualhosts = 0; -+ maxusers = 500; - allowdirectorylisting = 0; - allowcgi = 0; - permcheck = 0; -@@ -45,6 +49,13 @@ - usertimeout = 5; - initialslots = 10; - quote = "Fear and loathing on the WWW"; -+#else -+ maxusers = 500; -+ initialslots = CONFIG_HTTP_INITIAL_SLOTS; -+ maxusers = CONFIG_HTTP_MAX_USERS; -+ usevirtualhosts = 1; -+#endif -+ - - // Not really conf stuff: - numusers = 0; -@@ -54,6 +65,7 @@ - } - - -+#ifdef CONFIG_STANDARD_AWHTTPD - void procconf(char *filename) { - - FILE *fp; -@@ -210,11 +222,11 @@ - err++; - } else { - if (setgid(bl->pw_gid) != 0) { +-char *quote; +- +-int numusers; +- +- +- +-void defaultconfvals() { +- +- usevirtualhosts = 0; +- allowdirectorylisting = 0; +- allowcgi = 0; +- permcheck = 0; +- maxusers = 500; +- usertimeout = 5; +- initialslots = 10; +- quote = "Fear and loathing on the WWW"; +- +- // Not really conf stuff: +- numusers = 0; +- +- return; +- +-} +- +- +-void procconf(char *filename) { +- +- FILE *fp; +- char buf[MAXREQUESTLENGTH]; +- char *segs[10]; +- int tp, err=0, warn=0; +- +- usevirtualhosts = 1; +- +- fp = fopen(filename, "r"); +- +- if (fp == NULL) { +- fprintf(stderr, "ERROR: Unable to open conf file '%s'\n", filename); +- exit(1); +- } +- +- +- while (fgets(buf, sizeof(buf), fp) != NULL) { +- stripcrlf(buf); +- +- confsplit(buf, segs, 10); +- +- if (segs[0] == NULL) continue; +- +- if (segs[1] == NULL) { +- fprintf(stderr, "ERR: Unknown command in '%s': '%s'\n", filename, segs[0]); +- err++; +- continue; +- } +- +- +- if (strcasecmp(segs[0], "listen") == 0) { +- if (isdigit(*segs[1])) { +- if ((tp=openlistener(atoi(segs[1]))) == -1) { +- fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", atoi(segs[1])); +- err++; +- continue; +- } +- +- addtoservers(tp); +- continue; +- } +- } +- +- if (strcasecmp(segs[0], "listen6") == 0) { +- #ifdef HAVE_IPV6 +- if (isdigit(*segs[1])) { +- if ((tp=openlistener6(atoi(segs[1]))) == -1) { +- fprintf(stderr, "ERR: Couldn't bind to port %d (IPv6)\n", atoi(segs[1])); +- err++; +- continue; +- } +- +- addtoservers(tp); +- continue; +- } +- #else +- fprintf(stderr, "ERR: AW was compiled without IPv6 support!\n"); +- err++; +- continue; +- #endif +- } +- +- if (strcasecmp(segs[0], "maxusers") == 0) { +- maxusers = tp = atoi(segs[1]); +- if (tp < 1) { +- fprintf(stderr, "ERR: Bad value for maxusers\n"); +- err++; +- } +- if (tp < 10 || tp > 10000) { +- fprintf(stderr, "WARN: Value for maxusers (%d) is not withing the recommended range\n", tp); +- warn++; +- } +- continue; +- } +- +- if (strcasecmp(segs[0], "usertimeout") == 0) { +- usertimeout = tp = atoi(segs[1]); +- if (tp < 1) { +- fprintf(stderr, "ERR: Bad value for usertimeout\n"); +- err++; +- } +- if (tp > 100) { +- fprintf(stderr, "WARN: Value for usertimeout (%d) is not withing the recommended range\n", tp); +- warn++; +- } +- continue; +- } +- +- if (strcasecmp(segs[0], "initialslots") == 0) { +- initialslots = tp = atoi(segs[1]); +- if (tp < 1) { +- fprintf(stderr, "ERR: Bad value for initialslots\n"); +- err++; +- } +- continue; +- } +- +- if (strcasecmp(segs[0], "directorylisting") == 0) { +- if (strcasecmp(segs[1], "on") == 0) allowdirectorylisting = 1; +- else if (strcasecmp(segs[1], "off") == 0) allowdirectorylisting = 0; +- else { +- fprintf(stderr, "ERR: Need on or off for directorylisting\n"); +- err++; +- } +- continue; +- } +- +- if (strcasecmp(segs[0], "cgi") == 0) { +- if (strcasecmp(segs[1], "on") == 0) allowcgi = 1; +- else if (strcasecmp(segs[1], "off") == 0) allowcgi = 0; +- else { +- fprintf(stderr, "ERR: Need on or off for cgi\n"); +- err++; +- } +- continue; +- } +- +- if (strcasecmp(segs[0], "cgiext") == 0) { +- if (*(segs[1]) != '.' && *(segs[1]+1) != '\0') { +- fprintf(stderr, "ERR: CGI extensions must start with a period and be at least 2 chars long\n"); +- err++; +- continue; +- } +- addcgiext(segs[1]); +- continue; +- } +- +- if (strcasecmp(segs[0], "addindex") == 0) { +- if (*(segs[1]) == '.') { +- fprintf(stderr, "ERR: Index files can't start with a dot\n"); +- err++; +- continue; +- } +- addindex(segs[1]); +- continue; +- } +- +- if (strcasecmp(segs[0], "permcheck") == 0) { +- if (strcasecmp(segs[1], "on") == 0) permcheck = 1; +- else if (strcasecmp(segs[1], "off") == 0) permcheck = 0; +- else { +- fprintf(stderr, "ERR: Need on or off for permcheck\n"); +- err++; +- } +- continue; +- } +- +- if (strcasecmp(segs[0], "dropto") == 0) { +- struct passwd *bl; +- +- if ((bl = getpwnam(segs[1])) == NULL) { +- fprintf(stderr, "ERR: Unable to look up user '%s' to drop privileges\n", segs[1]); +- err++; +- } else { +- if (setgid(bl->pw_gid) != 0) { - fprintf(stderr, "WARN: Unable to drop GID to %d\n", bl->pw_gid); -+ fprintf(stderr, "WARN: Unable to drop GID to %ld\n", bl->pw_gid); - warn++; - } - if (setuid(bl->pw_uid) != 0) { +- warn++; +- } +- if (setuid(bl->pw_uid) != 0) { - fprintf(stderr, "WARN: Unable to drop UID to %d\n", bl->pw_uid); -+ fprintf(stderr, "WARN: Unable to drop UID to %ld\n", bl->pw_uid); - warn++; - } - } -@@ -263,3 +275,4 @@ - return; - - } -+#endif /* CONFIG_STANDARD_AWHTTPD */ +- warn++; +- } +- } +- continue; +- } +- +- if (strcasecmp(segs[0], "quote") == 0) { +- quote = strdup(segs[1]); +- continue; +- } +- +- +- if (segs[2] == NULL) { +- fprintf(stderr, "ERR: Unknown command in '%s': '%s'\n", filename, segs[0]); +- err++; +- continue; +- } +- +- +- // Otherwise: +- +- fprintf(stderr, "ERR: Unknown command in '%s': '%s'\n", filename, segs[0]); +- err++; +- continue; +- +- } +- +- +- if (initialslots > maxusers) { +- fprintf(stderr, "ERR: initialslots is greater than maxusers!\n"); +- err++; +- } +- +- +- if (warn) { +- fprintf(stderr, "Alert! %d warnings!\n", warn); +- } +- +- if (err) { +- fprintf(stderr, "Unable to start: %d errors!\n", err); +- exit(1); +- } +- +- fclose(fp); +- +- return; +- +-} diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c --- awhttpd/conn.c 2004-12-07 16:11:02.000000000 +1000 -+++ axTLS/httpd/awhttpd/conn.c 2006-07-22 18:08:57.687500000 +1000 -@@ -9,15 +9,11 @@ ++++ axTLS/httpd/awhttpd/conn.c 2006-07-30 22:35:55.109375000 +1000 +@@ -9,26 +9,16 @@ #include #include @@ -470,7 +670,18 @@ diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c struct connstruct *tp; // Get ourselves a connstruct -@@ -39,12 +35,21 @@ + if (freeconns == NULL) { + tp = (struct connstruct *) malloc(sizeof(struct connstruct)); +- if (tp == NULL) { +- send505(sd, "Out of memory"); +- // removeconnection() should be used normally +- close(sd); +- return; +- } + } else { + tp = freeconns; + freeconns = tp->next; +@@ -39,12 +29,21 @@ usedconns = tp; tp->networkdesc = sd; @@ -479,34 +690,45 @@ diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c + ssl_server_new(servers->ssl_ctx, sd); +#endif tp->filedesc = -1; -+#if defined(CONFIG_STANDARD_AWHTTPD) || defined(CONFIG_HTTP_HAS_DIRECTORIES) ++#if defined(CONFIG_HTTP_HAS_DIRECTORIES) tp->dirp = NULL; +#endif + tp->is_ssl = is_ssl; *(tp->actualfile) = '\0'; *(tp->filereq) = '\0'; -+#if defined(CONFIG_STANDARD_AWHTTPD) || defined(CONFIG_HTTP_HAS_CGI) ++#if defined(CONFIG_HTTP_HAS_CGI) *(tp->cgiargs) = '\0'; +#endif *(tp->virtualhostreq) = '\0'; tp->state = STATE_WANT_TO_READ_HEAD; -@@ -53,11 +58,12 @@ +@@ -52,21 +51,16 @@ + my_strncpy(tp->ip, ip, MAXIPLEN); - tp->offset = -1; +- tp->offset = -1; +- +- numusers++; +- +- updatetimeout(tp, time(NULL)); + tp->close_when_done = 0; + tp->modified_since = 0; - numusers++; - - updatetimeout(tp, time(NULL)); -- ++ tp->timeout = time(NULL) + CONFIG_HTTP_TIMEOUT; return; } -@@ -95,10 +101,22 @@ + + + +-// Remove cn from the used list +-// FIXME: This O(N) operation could be avoided if we used +-// doubly linked lists... + void removeconnection(struct connstruct *cn) { + + struct connstruct *tp; +@@ -95,12 +89,21 @@ freeconns = cn; // Close it all down @@ -520,20 +742,24 @@ diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c + SOCKET_CLOSE(cn->networkdesc); + } if (cn->filedesc != -1) close(cn->filedesc); -+#if defined(CONFIG_STANDARD_AWHTTPD) || defined(CONFIG_HTTP_HAS_DIRECTORIES) +- if (cn->dirp != NULL) closedir(cn->dirp); +- +- numusers--; +- +- return; +- ++#if defined(CONFIG_HTTP_HAS_DIRECTORIES) ++ if (cn->dirp != NULL) +#ifdef WIN32 -+ if (cn->dirp != NULL) FindClose(cn->dirp); ++ FindClose(cn->dirp); +#else - if (cn->dirp != NULL) closedir(cn->dirp); -- ++ closedir(cn->dirp); +#endif +#endif - numusers--; - - return; + } diff -Naur awhttpd/errors.c axTLS/httpd/awhttpd/errors.c --- awhttpd/errors.c 2005-01-23 06:49:29.000000000 +1000 -+++ axTLS/httpd/awhttpd/errors.c 2006-07-22 16:54:31.562500000 +1000 ++++ axTLS/httpd/awhttpd/errors.c 2006-07-26 21:44:20.734375000 +1000 @@ -8,7 +8,6 @@ @@ -551,26 +777,32 @@ diff -Naur awhttpd/errors.c axTLS/httpd/awhttpd/errors.c return; -@@ -34,7 +33,7 @@ +@@ -34,21 +33,7 @@ snprintf(buf, sizeof(buf), "HTTP/1.0 404 Not Found\nContent-Type: text/html\n\n\n404 Not Found

    It ain't there my friend. (404 Not Found)

    \n

    Anti-Web HTTPD - Take back some simplicity.\n\n"); - write(cn->networkdesc, buf, strlen(buf)); +- +- return; +- +-} +- +- +- +-void send505(int sd, char *reason) { +- +- char buf[1024]; +- +- snprintf(buf, sizeof(buf), "HTTP/1.0 505 Server Error\nContent-Type: text/html\n\n\n505 Internal Server Error

    Internal Server Error: %s

    \n

    Anti-Web HTTPD - Take back some simplicity.\n\n", reason); +- +- write(sd, buf, strlen(buf)); + special_write(cn, buf, strlen(buf)); return; -@@ -42,6 +41,7 @@ - - - -+/* TODO: this really needs to use the connstruct object */ - void send505(int sd, char *reason) { - - char buf[1024]; diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c --- awhttpd/index.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/index.c 2006-07-22 16:54:31.562500000 +1000 ++++ axTLS/httpd/awhttpd/index.c 2006-07-26 22:18:07.609375000 +1000 @@ -11,7 +11,6 @@ #include #include @@ -579,7 +811,28 @@ diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c #include #include "aw3.h" -@@ -52,7 +51,13 @@ +@@ -22,20 +21,9 @@ + struct indexstruct *ex; + + ex = (struct indexstruct *) malloc(sizeof(struct indexstruct)); +- if (ex == NULL) { +- fprintf(stderr, "Serious memory error...\n"); +- exit(1); +- } +- + ex->name = strdup(tp); +- if (ex->name == NULL) { +- fprintf(stderr, "Serious memory error...\n"); +- exit(1); +- } +- + ex->next = indexlist; + indexlist = ex; +- + return; + + } +@@ -52,7 +40,13 @@ tp = indexlist; while(tp != NULL) { @@ -596,7 +849,7 @@ diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c my_strncpy(cn->actualfile, tbuf, MAXREQUESTLENGTH); diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c --- awhttpd/main.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/main.c 2006-07-22 16:54:31.562500000 +1000 ++++ axTLS/httpd/awhttpd/main.c 2006-07-26 22:17:40.968750000 +1000 @@ -11,7 +11,6 @@ #include #include @@ -605,15 +858,17 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c #include #include "aw3.h" -@@ -21,10 +20,40 @@ +@@ -21,10 +20,42 @@ struct serverstruct *servers; struct connstruct *usedconns; struct connstruct *freeconns; -+#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_HAS_CGI) struct cgiextstruct *cgiexts; +#endif struct indexstruct *indexlist; ++char *webroot = CONFIG_HTTP_WEBROOT; + +/* clean up memory for valgrind */ +static void sigint_cleanup(int sig) +{ @@ -640,17 +895,17 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c + free(freeconns); + freeconns = tp; + } - ++ + exit(0); +} void initlists() { int i; -@@ -33,15 +62,19 @@ +@@ -33,108 +64,118 @@ servers = NULL; usedconns = NULL; freeconns = NULL; -+#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_HAS_CGI) cgiexts = NULL; +#endif indexlist = NULL; @@ -658,39 +913,42 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c for(i=0; inext = tp; -@@ -49,6 +82,7 @@ - } - - -+#ifdef CONFIG_STANDARD_AWHTTPD - void usage(char *cmline) { - fprintf(stderr, "Anti-Web V%s (C) 2001-2004 by Hardcore Software and others\n\n", VERSION); - -@@ -65,76 +99,138 @@ - - exit(1); + } } -+#endif +-void usage(char *cmline) { +- fprintf(stderr, "Anti-Web V%s (C) 2001-2004 by Hardcore Software and others\n\n", VERSION); +- +- fprintf(stderr, " AW has 2 valid command lines (see README for details)\n\n"); +- +- fprintf(stderr, " %s     \n", cmline); +- fprintf(stderr, " The root of your HTML tree\n"); +- fprintf(stderr, " The port to use\n\n"); +- +- fprintf(stderr, " %s \n", cmline); +- fprintf(stderr, " /awhttpd.conf Conf file\n"); +- fprintf(stderr, " /default/ Default HTML root\n"); +- fprintf(stderr, " /example.com/ Zero or more virtual host directories\n"); +- +- exit(1); +-} +- +- int main(int argc, char *argv[]) { -+#ifdef CONFIG_STANDARD_AWHTTPD - char buf[MAXREQUESTLENGTH]; +- char buf[MAXREQUESTLENGTH]; - int pid, tp; - -+#endif + int tp; -+#if defined(CONFIG_HTTP_IS_DAEMON) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_IS_DAEMON) + int pid; +#endif + @@ -701,15 +959,11 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c +#endif + initlists(); - -+#ifdef CONFIG_STANDARD_AWHTTPD - if (argc != 2 && argc != 3) usage(argv[0]); - - webroot = strdup(argv[1]); -+#else -+ webroot = CONFIG_HTTP_WEBROOT; -+#endif - +- +- if (argc != 2 && argc != 3) usage(argv[0]); +- +- webroot = strdup(argv[1]); +- tp = strlen(webroot); if (webroot[tp-1] == '/') webroot[tp-1] = '\0'; @@ -720,29 +974,22 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c exit(1); } - defaultconfvals(); - -+#ifdef CONFIG_STANDARD_AWHTTPD - if (argc == 2) { - snprintf(buf, sizeof(buf), "%s/awhttpd.conf", webroot); - procconf(buf); - } else { - if ((tp=openlistener(atoi(argv[2]))) == -1) { -+#ifdef CONFIG_HTTP_VERBOSE - fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", atoi(argv[2])); -+#endif - exit(1); - } -+ } -+#else /* not command line */ +- defaultconfvals(); +- +- if (argc == 2) { +- snprintf(buf, sizeof(buf), "%s/awhttpd.conf", webroot); +- procconf(buf); +- } else { +- if ((tp=openlistener(atoi(argv[2]))) == -1) { +- fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", atoi(argv[2])); + if ((tp=openlistener(CONFIG_HTTP_PORT)) == -1) { +#ifdef CONFIG_HTTP_VERBOSE + fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", + CONFIG_HTTP_PORT); +#endif -+ exit(1); + exit(1); +- } + } -+#endif /* CONFIG_STANDARD_AWHTTPD */ addindex("index.html"); addtoservers(tp); @@ -750,6 +997,7 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c - setuid(32767); - } +- if (permcheck == 1) procpermcheck(webroot); +#ifndef WIN32 + if (getuid() == 0) + { @@ -773,9 +1021,7 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c + servers->is_ssl = 1; +#endif /* CONFIG_HTTP_HAS_SSL */ + -+#if defined (CONFIG_STANDARD_AWHTTPD) - if (permcheck == 1) procpermcheck(webroot); -+#elif defined(CONFIG_HTTP_PERM_CHECK) ++#if defined(CONFIG_HTTP_PERM_CHECK) + procpermcheck(webroot); +#endif +#if defined(CONFIG_HTTP_HAS_CGI) @@ -787,7 +1033,7 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c + TTY_FLUSH(); +#endif -+#if defined(CONFIG_HTTP_IS_DAEMON) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_IS_DAEMON) pid = fork(); if(pid > 0) { @@ -808,7 +1054,7 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c - signal(SIGQUIT, die); + signal(SIGINT, sigint_cleanup); signal(SIGTERM, die); -+#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_HAS_CGI) +#ifndef WIN32 signal(SIGCHLD, reaper); - @@ -836,7 +1082,7 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c return 0; diff -Naur awhttpd/mime_types.c axTLS/httpd/awhttpd/mime_types.c --- awhttpd/mime_types.c 2004-01-26 01:08:47.000000000 +1000 -+++ axTLS/httpd/awhttpd/mime_types.c 2006-07-22 16:54:31.562500000 +1000 ++++ axTLS/httpd/awhttpd/mime_types.c 2006-07-26 23:12:35.656250000 +1000 @@ -21,13 +21,14 @@ @@ -844,7 +1090,8 @@ diff -Naur awhttpd/mime_types.c axTLS/httpd/awhttpd/mime_types.c +#include "os_port.h" - char mime_default[] = "text/plain"; +-char mime_default[] = "text/plain"; ++static const char mime_default[] = "text/plain"; struct { - char *ext; @@ -870,7 +1117,7 @@ diff -Naur awhttpd/mime_types.c axTLS/httpd/awhttpd/mime_types.c + diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c --- awhttpd/misc.c 2005-01-23 12:59:09.000000000 +1000 -+++ axTLS/httpd/awhttpd/misc.c 2006-07-22 16:54:31.578125000 +1000 ++++ axTLS/httpd/awhttpd/misc.c 2006-07-26 23:12:39.187500000 +1000 @@ -7,33 +7,33 @@ */ @@ -903,7 +1150,7 @@ diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c -void reaper() { -+#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_HAS_CGI) +#ifndef WIN32 +void reaper(int sigtype) { wait3(NULL,WNOHANG,NULL); @@ -917,7 +1164,7 @@ diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c #endif -+#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_HAS_CGI) int iscgi(char *fn) { struct cgiextstruct *tp; @@ -929,23 +1176,98 @@ diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c -@@ -235,6 +237,7 @@ +@@ -129,63 +131,6 @@ - void buildactualfile(struct connstruct *cn) { + } + +- +- +-int confsplit(char *tp, char *sp[], int maxwords) { +- +- int i; +- +- // Skip comments +- i=0; +- while (tp[i] != '\0' && tp[i] != '#') i++; +- tp[i] = '\0'; +- +- i=0; +- while(1) { +- /* Skip leading whitespace */ +- while(*tp == ' ') tp++; +- +- if (*tp == '\0') { +- sp[i] = NULL; +- break; +- } +- if (i==maxwords-2) { +- sp[maxwords-2] = NULL; +- break; +- } +- +- if (*tp == '"') { +- tp++; +- +- if (*tp == '"') { +- tp++; +- continue; +- } +- +- sp[i] = tp; +- +- while(*tp != '"' && *tp != '\0') tp++; +- if (*tp == '"') *tp++ = '\0'; +- i++; +- +- } else { +- sp[i] = tp; +- +- while(*tp != ' ' && *tp != '\0') tp++; +- if (*tp == ' ') *tp++ = '\0'; +- i++; +- } +- +- } +- +- return i; +- +-} +- +- +- +- +- + int sanitizefile(char *buf) { -+#if 0 - char tpbuf[MAXREQUESTLENGTH]; + int len,i; +@@ -231,34 +176,33 @@ - if (usevirtualhosts) { -@@ -253,6 +256,26 @@ + } + +- +- + void buildactualfile(struct connstruct *cn) { + +- char tpbuf[MAXREQUESTLENGTH]; +- +- if (usevirtualhosts) { +- if (*(cn->virtualhostreq) == '\0') +- my_strncpy(cn->virtualhostreq, "default", MAXREQUESTLENGTH); +- +- snprintf(tpbuf, sizeof(tpbuf), "%s/%s", webroot, cn->virtualhostreq); +- if (isdir(tpbuf) == 0) { +- my_strncpy(cn->virtualhostreq, "default", MAXREQUESTLENGTH); +- } +- } else { +- *(cn->virtualhostreq) = '\0'; +- } +- +- snprintf(cn->actualfile, MAXREQUESTLENGTH, "%s/%s%s", ++ snprintf(cn->actualfile, MAXREQUESTLENGTH, "%s%s", webroot, - cn->virtualhostreq, +- cn->virtualhostreq, cn->filereq); -+#endif -+ snprintf(cn->actualfile, MAXREQUESTLENGTH, "%s%s", -+ webroot, -+ cn->filereq); -+ + + /* Add directory slash if not there */ + if (isdir(cn->actualfile) && + cn->actualfile[strlen(cn->actualfile)-1] != '/') @@ -961,10 +1283,22 @@ diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c + } + } +#endif - ++ return; -@@ -279,7 +302,7 @@ + } + +- ++#if defined(CONFIG_HTTP_DIRECTORIES) + int issockwriteable(int sd) { + + fd_set wfds; +@@ -275,11 +219,11 @@ + return FD_ISSET(sd, &wfds); + + } +- ++#endif int isdir(char *tpbuf) { @@ -973,50 +1307,51 @@ diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c if (stat(tpbuf, &st) == -1) return 0; -@@ -292,6 +315,7 @@ - - // FIXME: Arg! This function is horrible! Rewrite it - void status() { -+#if defined(CONFIG_STANDARD_AWHTTPD) - - int i; +@@ -288,26 +232,7 @@ -@@ -300,14 +324,16 @@ - fprintf(stdout," [*************************************************]\n"); - fprintf(stdout," [ DIRECTORY {%s}",webroot); - if(strlen(webroot)<35) -- for(i=1;i<=35-strlen(webroot);i++) fprintf(stdout," "); -+ for(i=1;i<=35-(int)strlen(webroot);i++) fprintf(stdout," "); - fprintf(stdout,"]\n"); - fprintf(stdout," [*************************************************]\n"); - -+#endif } - - -+#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) +- +- +-// FIXME: Arg! This function is horrible! Rewrite it +-void status() { +- +- int i; +- +- fprintf(stdout," [*************************************************]\n"); +- fprintf(stdout," [ Anti-Web V%-6s by Hardcore Software ]\n",VERSION); +- fprintf(stdout," [*************************************************]\n"); +- fprintf(stdout," [ DIRECTORY {%s}",webroot); +- if(strlen(webroot)<35) +- for(i=1;i<=35-strlen(webroot);i++) fprintf(stdout," "); +- fprintf(stdout,"]\n"); +- fprintf(stdout," [*************************************************]\n"); +- +-} +- +- +- ++#if defined(CONFIG_HTTP_HAS_CGI) /* This function was originally written by Nicolas Benoit but I've rewritten some parts of it to work under as many possible AW configurations as possible. -@@ -329,7 +355,8 @@ +@@ -329,7 +254,7 @@ while (fr_rs[i] != NULL) { snprintf(tpfile, sizeof(tpfile), "%s/%s%s", webroot, cn->virtualhostreq, fr_str); - if (iscgi(tpfile) && access(tpfile, X_OK) == 0 && isdir(tpfile) == 0) { -+ //if (iscgi(tpfile) && access(tpfile, X_OK) == 0 && isdir(tpfile) == 0) { + if (iscgi(tpfile) && isdir(tpfile) == 0) { /* We've found our CGI file! */ my_strncpy(cn->actualfile, tpfile, MAXREQUESTLENGTH); my_strncpy(cn->cgiscriptinfo, fr_str, MAXREQUESTLENGTH); -@@ -349,3 +376,4 @@ +@@ -349,3 +274,4 @@ *(cn->cgipathinfo) = '\0'; return -1; } +#endif diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c --- awhttpd/net.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/net.c 2006-07-22 16:54:31.578125000 +1000 ++++ axTLS/httpd/awhttpd/net.c 2006-07-26 23:03:46.609375000 +1000 @@ -8,9 +8,7 @@ @@ -1027,54 +1362,39 @@ diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c #include #include #include -@@ -23,9 +21,11 @@ +@@ -23,17 +21,10 @@ void addtoservers(int sd) { struct serverstruct *tp; - tp = (struct serverstruct *) malloc(sizeof(struct serverstruct)); +- if (tp == NULL) { +- fprintf(stderr, "Serious memory error...\n"); +- exit(1); +- } +- + tp = (struct serverstruct *) calloc(1, sizeof(struct serverstruct)); - if (tp == NULL) { -+#ifdef CONFIG_HTTP_VERBOSE - fprintf(stderr, "Serious memory error...\n"); -+#endif - exit(1); - } - -@@ -44,7 +44,9 @@ - struct connstruct *tp, *to; - struct serverstruct *sp; - int rnum, wnum, active; -+#if defined(CONFIG_STANDARD_AWHTTPD) || defined(CONFIG_HTTP_USE_TIMEOUT) - int currtime; -+#endif - - while(1) { // MAIN SELECT LOOP - FD_ZERO(&rfds); -@@ -61,15 +63,19 @@ + tp->next = servers; + tp->sd = sd; +- + servers = tp; +- + return; + } - // Add the established sockets - tp = usedconns; -+#if defined(CONFIG_STANDARD_AWHTTPD) || defined(CONFIG_HTTP_USE_TIMEOUT) +@@ -64,7 +55,7 @@ currtime = time(NULL); -+#endif while(tp != NULL) { -+#if defined(CONFIG_STANDARD_AWHTTPD) || defined(CONFIG_HTTP_USE_TIMEOUT) - if (istimedout(tp, currtime)) { +- if (istimedout(tp, currtime)) { ++ if (currtime > tp->timeout) { to = tp; tp = tp->next; removeconnection(to); - continue; - } -+#endif - - if (tp->state == STATE_WANT_TO_READ_HEAD) { - FD_SET(tp->networkdesc, &rfds); -@@ -87,10 +93,12 @@ +@@ -87,14 +78,15 @@ FD_SET(tp->networkdesc, &wfds); if (tp->networkdesc > wnum) wnum = tp->networkdesc; } -+#if defined(CONFIG_HTTP_DIRECTORIES) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_DIRECTORIES) if (tp->state == STATE_DOING_DIR) { FD_SET(tp->networkdesc, &wfds); if (tp->networkdesc > wnum) wnum = tp->networkdesc; @@ -1083,7 +1403,11 @@ diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c tp = tp->next; } -@@ -104,7 +112,7 @@ +- //active = select(4, &rfds, &wfds, NULL, NULL); + active = select(wnum > rnum ? wnum+1 : rnum+1, + rnum != -1 ? &rfds : NULL, + wnum != -1 ? &wfds : NULL, +@@ -104,7 +96,7 @@ sp = servers; while(active > 0 && sp != NULL) { if (FD_ISSET(sp->sd, &rfds)) { @@ -1092,24 +1416,43 @@ diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c active--; } sp = sp->next; -@@ -112,7 +120,9 @@ +@@ -112,41 +104,37 @@ // Handle the established sockets tp = usedconns; -+#if defined(CONFIG_STANDARD_AWHTTPD) || defined(CONFIG_HTTP_USE_TIMEOUT) - currtime = time(NULL); -+#endif +- currtime = time(NULL); while(active > 0 && tp != NULL) { to = tp; tp = tp->next; -@@ -141,12 +151,14 @@ + + if (to->state == STATE_WANT_TO_READ_HEAD) + if (FD_ISSET(to->networkdesc, &rfds)) { +- updatetimeout(to, currtime); + active--; + procreadhead(to); + } + if (to->state == STATE_WANT_TO_SEND_HEAD) + if (FD_ISSET(to->networkdesc, &wfds)) { +- updatetimeout(to, currtime); + active--; + procsendhead(to); + } + if (to->state == STATE_WANT_TO_READ_FILE) + if (FD_ISSET(to->filedesc, &rfds)) { +- updatetimeout(to, currtime); + active--; + procreadfile(to); + } + if (to->state == STATE_WANT_TO_SEND_FILE) + if (FD_ISSET(to->networkdesc, &wfds)) { +- updatetimeout(to, currtime); active--; procsendfile(to); } -+#if defined(CONFIG_HTTP_DIRECTORIES) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_DIRECTORIES) if (to->state == STATE_DOING_DIR) if (FD_ISSET(to->networkdesc, &wfds)) { - updatetimeout(to, currtime); +- updatetimeout(to, currtime); active--; procdodir(to); } @@ -1119,7 +1462,7 @@ diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c --- awhttpd/permcheck.c 2005-01-23 06:49:29.000000000 +1000 -+++ axTLS/httpd/awhttpd/permcheck.c 2006-07-22 16:54:31.578125000 +1000 ++++ axTLS/httpd/awhttpd/permcheck.c 2006-07-26 18:46:48.233750000 +1000 @@ -7,21 +7,23 @@ */ @@ -1131,7 +1474,7 @@ diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c #include "aw3.h" -+#if defined(CONFIG_HTTP_PERM_CHECK) || defined (CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_PERM_CHECK) void procpermcheck(char *pathtocheck) { - + char thepath[MAXREQUESTLENGTH]; @@ -1210,7 +1553,7 @@ diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c +#endif /* CONFIG_HTTP_PERM_CHECK */ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c --- awhttpd/proc.c 2005-01-23 10:59:41.000000000 +1000 -+++ axTLS/httpd/awhttpd/proc.c 2006-07-23 10:32:07.593750000 +1000 ++++ axTLS/httpd/awhttpd/proc.c 2006-07-30 22:35:33.453125000 +1000 @@ -13,14 +13,12 @@ #include #include @@ -1231,16 +1574,30 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c my_strncpy(cn->filereq, segs[0], MAXREQUESTLENGTH); -+#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_HAS_CGI) if (segs[1] != NULL) my_strncpy(cn->cgiargs, segs[1], MAXREQUESTLENGTH); +#endif } else if (strcmp(words[0], "Host:")==0) { -@@ -80,24 +80,32 @@ - if (isdigit(*words[1]) == 0) return 1; +@@ -66,38 +66,32 @@ + } - cn->offset = atoi(words[1]); + my_strncpy(cn->virtualhostreq, words[1], MAXREQUESTLENGTH); +- } else if (strcmp(words[0], "Range:")==0) { +- +- cn->offset = -1; +- +- if (strchr(words[1], '-') == NULL) return 1; +- +- if (strchr(words[1], '=') != NULL) { +- while(*words[1] != '=') words[1]++; +- words[1]++; +- } +- +- if (isdigit(*words[1]) == 0) return 1; +- +- cn->offset = atoi(words[1]); - + } else if (strcmp(words[0], "Connection:")==0 && + strcmp(words[1], "close")==0) { @@ -1257,7 +1614,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c +} -+#if defined(CONFIG_HTTP_DIRECTORIES) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_DIRECTORIES) void procdirlisting(struct connstruct *cn) { char buf[MAXREQUESTLENGTH]; @@ -1273,7 +1630,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c if (cn->reqtype == TYPE_HEAD) { snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n"); -@@ -107,7 +115,17 @@ +@@ -107,7 +101,17 @@ return; } @@ -1292,7 +1649,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c if (cn->dirp == NULL) { send404(cn); removeconnection(cn); -@@ -116,12 +134,13 @@ +@@ -116,12 +120,13 @@ // Get rid of the "." readdir(cn->dirp); @@ -1308,7 +1665,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c cn->state = STATE_DOING_DIR; -@@ -134,36 +153,48 @@ +@@ -134,36 +139,48 @@ void procdodir(struct connstruct *cn) { @@ -1366,7 +1723,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c -@@ -172,9 +203,10 @@ +@@ -172,9 +189,10 @@ char buf[MAXREQUESTLENGTH*4], *tp, *next; int rv; @@ -1380,15 +1737,13 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c return; } -@@ -217,36 +249,100 @@ +@@ -217,36 +235,85 @@ void procsendhead(struct connstruct *cn) { char buf[1024]; + char actualfile[1024]; struct stat stbuf; -- -- if (stat(cn->actualfile, &stbuf) == -1) { -+ time_t now = time(NULL); ++ time_t now = cn->timeout - CONFIG_HTTP_TIMEOUT; + char date[32]; + strcpy(date, ctime(&now)); + @@ -1399,19 +1754,16 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c + if (actualfile[strlen(actualfile)-1] == '\\') + actualfile[strlen(actualfile)-1] = 0; +#endif -+ + +- if (stat(cn->actualfile, &stbuf) == -1) { +- if (allowcgi != 0) { + if (stat(actualfile, &stbuf) == -1) { -+#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) -+#ifndef CONFIG_HTTP_HAS_CGI - if (allowcgi != 0) { -+#endif ++#if defined(CONFIG_HTTP_HAS_CGI) if (trycgi_withpathinfo(cn) == 0) { // We Try To Find A CGI proccgi(cn,1); return; } -+#ifndef CONFIG_HTTP_HAS_CGI - } -+#endif +- } +#endif send404(cn); @@ -1419,18 +1771,14 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c return; } -+#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_HAS_CGI) if (iscgi(cn->actualfile)) { +#ifndef WIN32 // Set up CGI script - if (allowcgi == 0 || - access(cn->actualfile, X_OK) != 0 || - isdir(cn->actualfile)) { -+ if ( -+#ifndef CONFIG_HTTP_HAS_CGI -+ allowcgi == 0 || -+#endif -+ (stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) { ++ if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) { + send404(cn); + removeconnection(cn); + return; @@ -1451,7 +1799,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c + + // Check to see if this dir has an index file + if (procindex(cn, &stbuf) == 0) { -+#if defined(CONFIG_HTTP_DIRECTORIES) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_DIRECTORIES) + // If not, we do a directory listing of it + procdirlisting(cn); +#else @@ -1464,16 +1812,11 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c - proccgi(cn,0); - return; - } -+#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_HAS_CGI) + // If the index is a CGI file, handle it like any other CGI + if (iscgi(cn->actualfile)) { + // Set up CGI script -+#ifndef CONFIG_HTTP_HAS_CGI -+ if (allowcgi == 0 || -+ (stbuf.st_mode & S_IEXEC) == 0 != 0 || isdir(cn->actualfile)) { -+#else + if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) { -+#endif + send404(cn); + removeconnection(cn); + return; @@ -1489,34 +1832,29 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c if ((stbuf.st_mode & S_IFMT) == S_IFDIR) { if (cn->filereq[strlen(cn->filereq)-1] != '/') { send301(cn); -@@ -256,16 +352,24 @@ +@@ -256,17 +323,18 @@ // Check to see if this dir has an index file if (procindex(cn, &stbuf) == 0) { -+#if defined(CONFIG_HTTP_DIRECTORIES) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_DIRECTORIES) // If not, we do a directory listing of it procdirlisting(cn); +#endif return; } -+#if defined(CONFIG_HTTP_HAS_CGI) || defined(CONFIG_STANDARD_AWHTTPD) ++#if defined(CONFIG_HTTP_HAS_CGI) // If the index is a CGI file, handle it like any other CGI if (iscgi(cn->actualfile)) { // Set up CGI script - if (allowcgi == 0 || - access(cn->actualfile, X_OK) != 0 || -+ if ( -+#ifdef CONFIG_HTTP_HAS_CGI -+ (stbuf.st_mode & S_IEXEC) == 0 || -+#else -+ allowcgi == 0 || -+ (stbuf.st_mode & S_IEXEC) == 0 || -+#endif - isdir(cn->actualfile)) { +- isdir(cn->actualfile)) { ++ if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) { send404(cn); removeconnection(cn); -@@ -275,39 +379,57 @@ + return; +@@ -275,50 +343,68 @@ proccgi(cn,0); return; } @@ -1526,6 +1864,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c } - if (cn->offset == -1 || cn->offset >= stbuf.st_size) { +- cn->offset = -1; + if (cn->modified_since) { + snprintf(buf, sizeof(buf), "HTTP/1.1 304 Not Modified\nServer: Anti-Web V%s\nDate: %s\n", VERSION, date); + special_write(cn, buf, strlen(buf)); @@ -1533,14 +1872,12 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c + cn->state = STATE_WANT_TO_READ_HEAD; + return; + } -+ else if (cn->offset == -1 || cn->offset >= stbuf.st_size) { ++ else { +#ifdef CONFIG_HTTP_VERBOSE + printf("awhttpd: %s send %s\n", + cn->is_ssl ? "https" : "http", cn->actualfile); + TTY_FLUSH(); +#endif -+ - cn->offset = -1; - snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s (%s)\nContent-Type: %s\nContent-Length: %ld\nLast-Modified: %s\n", + snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s\nContent-Type: %s\nContent-Length: %ld\nDate: %sLast-Modified: %s\n", @@ -1548,18 +1885,16 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c - quote, getmimetype(cn->actualfile), (long) stbuf.st_size, -+ date, - ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end - } else { +- ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end +- } else { - snprintf(buf, sizeof(buf), "HTTP/1.1 206 OK\nServer: Anti-Web V%s (%s)\nContent-Type: %s\nContent-Range: %ld-%ld/%ld\nContent-Length: %ld\nLast-Modified: %s\n", -+ snprintf(buf, sizeof(buf), "HTTP/1.1 206 OK\nServer: Anti-Web V%s\nContent-Type: %s\nContent-Range: %ld-%ld/%ld\nContent-Length: %ld\nDate: %sLast-Modified: %s\n", - VERSION, +- VERSION, - quote, - getmimetype(cn->actualfile), - cn->offset, - (long) stbuf.st_size-1, - (long) stbuf.st_size, - (long) stbuf.st_size - cn->offset, +- getmimetype(cn->actualfile), +- cn->offset, +- (long) stbuf.st_size-1, +- (long) stbuf.st_size, +- (long) stbuf.st_size - cn->offset, + date, ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end } @@ -1581,10 +1916,11 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c if (cn->filedesc == -1) { send404(cn); removeconnection(cn); -@@ -318,7 +440,23 @@ - lseek(cn->filedesc, cn->offset, SEEK_SET); + return; } +- if (cn->offset != -1) { +- lseek(cn->filedesc, cn->offset, SEEK_SET); +#ifdef WIN32 + for (;;) + { @@ -1598,14 +1934,15 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c + { + procsendfile(cn); + } while (cn->state != STATE_WANT_TO_READ_FILE); -+ } + } +- +#else cn->state = STATE_WANT_TO_READ_FILE; +#endif return; } -@@ -328,13 +466,19 @@ +@@ -328,13 +414,18 @@ void procreadfile(struct connstruct *cn) { @@ -1624,27 +1961,26 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c + else { /* keep socket open - HTTP 1.1 */ + cn->state = STATE_WANT_TO_READ_HEAD; + cn->numbytes = 0; -+ cn->offset = -1; + } + return; } cn->numbytes = rv; -@@ -347,11 +491,9 @@ +@@ -347,11 +438,9 @@ void procsendfile(struct connstruct *cn) { - int rv; -- -- rv = write(cn->networkdesc, cn->databuf, cn->numbytes); + int rv = special_write(cn, cn->databuf, cn->numbytes); +- rv = write(cn->networkdesc, cn->databuf, cn->numbytes); +- - if (rv == -1) + if (rv < 0) removeconnection(cn); else if (rv == cn->numbytes) cn->state = STATE_WANT_TO_READ_FILE; -@@ -361,7 +503,47 @@ +@@ -361,7 +450,47 @@ memmove(cn->databuf, cn->databuf + rv, cn->numbytes - rv); cn->numbytes -= rv; } @@ -1695,8 +2031,8 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c } diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c --- awhttpd/socket.c 2004-04-25 13:03:05.000000000 +1000 -+++ axTLS/httpd/awhttpd/socket.c 2006-07-22 16:54:31.578125000 +1000 -@@ -8,19 +8,11 @@ ++++ axTLS/httpd/awhttpd/socket.c 2006-07-26 21:52:07.750000000 +1000 +@@ -8,61 +8,17 @@ #include @@ -1707,7 +2043,7 @@ diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c -#include -#include -#include - #include +-#include -#include #include @@ -1716,8 +2052,42 @@ diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c #include "aw3.h" -@@ -62,7 +54,7 @@ +-int checkmaxusers(int sd) { +- +- if (maxusers <= 0) return 1; +- +- if (numusers >= maxusers) { +- send505(sd, "Maximum user limit reached"); +- // removeconnection() should be used normally +- close(sd); +- +- return 0; +- } +- +- return 1; +-} +- +- +-int pollsocket(int sd, long ustimeout) { +- +- fd_set rfds; +- struct timeval tv; +- +- tv.tv_sec = 0; +- tv.tv_usec = ustimeout; +- +- FD_ZERO(&rfds); +- FD_SET(sd, &rfds); +- +- select(FD_SETSIZE, &rfds, NULL, NULL, (ustimeout >= 0) ? &tv : NULL); +- +- return FD_ISSET(sd, &rfds); +- +-} +- +- +- #ifdef HAVE_IPV6 -void handlenewconnection(int listenfd) { @@ -1725,16 +2095,16 @@ diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c struct sockaddr_in6 their_addr; int tp = sizeof(their_addr); -@@ -82,7 +74,7 @@ +@@ -82,7 +38,7 @@ *ipbuf = '\0'; } - if (checkmaxusers(connfd)) addconnection(connfd, ipbuf); -+ if (checkmaxusers(connfd)) addconnection(connfd, ipbuf, is_ssl); ++ addconnection(connfd, ipbuf, is_ssl); return; -@@ -90,19 +82,18 @@ +@@ -90,19 +46,17 @@ #else @@ -1750,13 +2120,13 @@ diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c if (connfd == -1) return; - if (checkmaxusers(connfd)) +- if (checkmaxusers(connfd)) - addconnection(connfd, inet_ntoa(their_addr.sin_addr)); + addconnection(connfd, inet_ntoa(their_addr.sin_addr), is_ssl); return; } -@@ -113,8 +104,12 @@ +@@ -113,8 +67,12 @@ int openlistener(int port) { @@ -1771,7 +2141,7 @@ diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c struct sockaddr_in my_addr; if ((sd = socket(AF_INET, SOCK_STREAM, 0)) == -1) return -1; -@@ -125,7 +120,7 @@ +@@ -125,7 +83,7 @@ setsockopt(sd, SOL_SOCKET, SO_REUSEADDR, &tp, sizeof(tp)); my_addr.sin_family = AF_INET; // host byte order @@ -1782,7 +2152,7 @@ diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c memset(&(my_addr.sin_zero), 0, 8); // zero the rest of the struct diff -Naur awhttpd/urlencode.c axTLS/httpd/awhttpd/urlencode.c --- awhttpd/urlencode.c 2004-05-14 10:53:47.000000000 +1000 -+++ axTLS/httpd/awhttpd/urlencode.c 2006-07-22 16:54:31.593750000 +1000 ++++ axTLS/httpd/awhttpd/urlencode.c 2006-07-26 18:46:48.233750000 +1000 @@ -13,7 +13,7 @@ #include From cd9b3c8865197d247ca15602e893350b5920f4c3 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 10 Aug 2006 21:02:56 +0000 Subject: [PATCH 023/301] improved performance git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@30 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/Config.in | 11 ++ httpd/awhttpd.patch | 387 +++++++++++++++++++++++++++++++++----------- 2 files changed, 303 insertions(+), 95 deletions(-) diff --git a/httpd/Config.in b/httpd/Config.in index 09f0981a67..73e304cabf 100644 --- a/httpd/Config.in +++ b/httpd/Config.in @@ -28,6 +28,17 @@ config CONFIG_HTTP_HTTPS_PORT You must be a root user in order to use the default port. +config CONFIG_HTTP_SESSION_CACHE_SIZE + int "SSL session cache size" + default 5 + depends on CONFIG_HTTP_HAS_SSL + help + The size of the SSL session cache. + + This is not actually related to the number of concurrent users, but + for optimum performance they should be the same (with a penalty + in memory usage). + config CONFIG_HTTP_WEBROOT string "Web root location" default "../www" if !CONFIG_PLATFORM_WIN32 diff --git a/httpd/awhttpd.patch b/httpd/awhttpd.patch index 5ab15a0bf2..ad1ed313c5 100644 --- a/httpd/awhttpd.patch +++ b/httpd/awhttpd.patch @@ -1,6 +1,6 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h --- awhttpd/aw3.h 2005-01-23 13:17:14.000000000 +1000 -+++ axTLS/httpd/awhttpd/aw3.h 2006-07-26 23:09:27.343750000 +1000 ++++ axTLS/httpd/awhttpd/aw3.h 2006-08-10 18:33:47.609375000 +1000 @@ -7,17 +7,16 @@ */ @@ -117,7 +117,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h void removeconnection(struct connstruct *cn); -@@ -129,30 +127,29 @@ +@@ -129,49 +127,47 @@ void procsendhead(struct connstruct *cn); void procreadfile(struct connstruct *cn); void procsendfile(struct connstruct *cn); @@ -154,11 +154,12 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h void stripcrlf(char *p); char *my_strncpy(char *dest, const char *src, size_t n); #ifndef __HAVE_ARCH_STRNLEN -@@ -160,18 +157,16 @@ + size_t strnlen ( const char * str, size_t maxlen ); #endif int iscgi(char *fn); - int split(char *tp, char *sp[], int maxwords, char sc); +-int split(char *tp, char *sp[], int maxwords, char sc); -int confsplit(char *tp, char *sp[], int maxwords); ++void split(char *tp, char *sp[], int maxwords, char sc); int sanitizefile(char *buf); int sanitizehost(char *buf); void buildactualfile(struct connstruct *cn); @@ -170,11 +171,12 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h // mime_types.c prototypes -char *getmimetype(char *fn); -+const char *getmimetype(char *fn); ++void mime_init(void); ++const char *getmimetype(const char *fn); // urldecode.c prototypes -@@ -188,7 +183,6 @@ +@@ -188,7 +184,6 @@ // conf.c prototypes @@ -182,7 +184,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h void procconf(char *filename); -@@ -202,4 +196,4 @@ +@@ -202,4 +197,4 @@ // main.c prototypes @@ -190,7 +192,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h +void initlists(void); diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c --- awhttpd/cgi.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/cgi.c 2006-07-26 23:05:56.890625000 +1000 ++++ axTLS/httpd/awhttpd/cgi.c 2006-08-10 18:33:47.625000000 +1000 @@ -7,93 +7,46 @@ */ @@ -652,7 +654,7 @@ diff -Naur awhttpd/conf.c axTLS/httpd/awhttpd/conf.c -} diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c --- awhttpd/conn.c 2004-12-07 16:11:02.000000000 +1000 -+++ axTLS/httpd/awhttpd/conn.c 2006-07-30 22:35:55.109375000 +1000 ++++ axTLS/httpd/awhttpd/conn.c 2006-08-10 18:33:47.625000000 +1000 @@ -9,26 +9,16 @@ #include @@ -759,7 +761,7 @@ diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c } diff -Naur awhttpd/errors.c axTLS/httpd/awhttpd/errors.c --- awhttpd/errors.c 2005-01-23 06:49:29.000000000 +1000 -+++ axTLS/httpd/awhttpd/errors.c 2006-07-26 21:44:20.734375000 +1000 ++++ axTLS/httpd/awhttpd/errors.c 2006-08-10 18:33:47.625000000 +1000 @@ -8,7 +8,6 @@ @@ -802,7 +804,7 @@ diff -Naur awhttpd/errors.c axTLS/httpd/awhttpd/errors.c diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c --- awhttpd/index.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/index.c 2006-07-26 22:18:07.609375000 +1000 ++++ axTLS/httpd/awhttpd/index.c 2006-08-10 18:33:47.625000000 +1000 @@ -11,7 +11,6 @@ #include #include @@ -849,7 +851,7 @@ diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c my_strncpy(cn->actualfile, tbuf, MAXREQUESTLENGTH); diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c --- awhttpd/main.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/main.c 2006-07-26 22:17:40.968750000 +1000 ++++ axTLS/httpd/awhttpd/main.c 2006-08-11 06:46:48.437500000 +1000 @@ -11,7 +11,6 @@ #include #include @@ -901,7 +903,7 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c void initlists() { int i; -@@ -33,108 +64,118 @@ +@@ -33,108 +64,119 @@ servers = NULL; usedconns = NULL; freeconns = NULL; @@ -958,6 +960,7 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c + WSAStartup(wVersionRequested,&wsaData); +#endif + ++ mime_init(); initlists(); - - if (argc != 2 && argc != 3) usage(argv[0]); @@ -1017,7 +1020,7 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c + + addtoservers(tp); + servers->ssl_ctx = ssl_ctx_new(CONFIG_HTTP_DEFAULT_SSL_OPTIONS, -+ SSL_DEFAULT_SVR_SESS); ++ CONFIG_HTTP_SESSION_CACHE_SIZE); + servers->is_ssl = 1; +#endif /* CONFIG_HTTP_HAS_SSL */ + @@ -1082,42 +1085,92 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c return 0; diff -Naur awhttpd/mime_types.c axTLS/httpd/awhttpd/mime_types.c --- awhttpd/mime_types.c 2004-01-26 01:08:47.000000000 +1000 -+++ axTLS/httpd/awhttpd/mime_types.c 2006-07-26 23:12:35.656250000 +1000 -@@ -21,13 +21,14 @@ ++++ axTLS/httpd/awhttpd/mime_types.c 2006-08-10 18:33:47.625000000 +1000 +@@ -7,28 +7,21 @@ + */ +-/*Code from mini_httpd - small HTTP server +-** +-** Copyright C 1999,2000 by Jef Poskanzer . +-*/ +- +-/* mini_httpd code adapted for Anti-Web by zas@norz.org */ +-/* A couple TINY changes by Fractal */ +- +-// Reformatted for aw3 -fractal +- +-// FIXME: Ideally this code would use a binary search or a hash table... +- +- #include ++#include ++#include ++#include +#include "os_port.h" -char mime_default[] = "text/plain"; +static const char mime_default[] = "text/plain"; - struct { +-struct { - char *ext; - char *type; -+ const char *ext; -+ const char *type; - } mime_table[] = { +-} mime_table[] = { ++typedef struct { ++ const char * const ext; ++ const char * const type; ++} mime_table_t; ++ ++static mime_table_t mime_table[] = { // Fundamentals -@@ -161,7 +162,7 @@ + { ".html", "text/html" }, +@@ -160,21 +153,29 @@ + }; ++static int mime_cmp(const mime_table_t *t1, const mime_table_t *t2) ++{ ++ return strcasecmp(t1->ext, t2->ext); ++} -char *getmimetype(char *name) { -+const char *getmimetype(char *name) { - int namelen, extlen, i; +- int namelen, extlen, i; +- +- namelen = strlen(name); +- +- for (i=0; i= namelen) continue; ++const char *getmimetype(const char *name) { ++ mime_table_t *mime_type; - namelen = strlen(name); -@@ -178,3 +179,4 @@ - return mime_default; +- if (strcasecmp(name+(namelen-extlen), mime_table[i].ext) == 0) +- return mime_table[i].type; +- } ++ if ((name = strrchr(name, '.')) == NULL) ++ return mime_default; + +- return mime_default; ++ mime_type = bsearch(&name, mime_table, ++ sizeof(mime_table)/sizeof(mime_table_t), ++ sizeof(mime_table_t), ++ (int (*)(const void *, const void *))mime_cmp); ++ return mime_type == NULL ? mime_default : mime_type->type; } + diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c --- awhttpd/misc.c 2005-01-23 12:59:09.000000000 +1000 -+++ axTLS/httpd/awhttpd/misc.c 2006-07-26 23:12:39.187500000 +1000 ++++ axTLS/httpd/awhttpd/misc.c 2006-08-10 18:33:47.625000000 +1000 @@ -7,33 +7,33 @@ */ @@ -1160,26 +1213,63 @@ diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c void stripcrlf(char *p) { -@@ -77,6 +77,7 @@ - #endif - - -+#if defined(CONFIG_HTTP_HAS_CGI) - int iscgi(char *fn) { - - struct cgiextstruct *tp; -@@ -97,6 +98,7 @@ - return 0; - - } -+#endif - - - -@@ -129,63 +131,6 @@ - +@@ -76,116 +76,6 @@ } + #endif +- +-int iscgi(char *fn) { +- +- struct cgiextstruct *tp; +- int fnlen, extlen; +- +- fnlen = strlen(fn); +- tp = cgiexts; +- +- while (tp != NULL) { +- extlen = strlen(tp->ext); +- +- if (strcasecmp(fn+(fnlen-extlen), tp->ext) == 0) +- return 1; +- +- tp = tp->next; +- } +- +- return 0; +- +-} +- +- +- +-int split(char *tp, char *sp[], int maxwords, char sc) { +- +- int i=0; +- +- while(1) { +- /* Skip leading whitespace */ +- while(*tp == sc) tp++; +- +- if (*tp == '\0') { +- sp[i] = NULL; +- break; +- } +- if (i==maxwords-2) { +- sp[maxwords-2] = NULL; +- break; +- } +- +- sp[i] = tp; +- +- while(*tp != sc && *tp != '\0') tp++; +- if (*tp == sc) *tp++ = '\0'; +- i++; +- +- } +- +- return i; +- +-} +- - - -int confsplit(char *tp, char *sp[], int maxwords) { @@ -1240,7 +1330,17 @@ diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c int sanitizefile(char *buf) { int len,i; -@@ -231,34 +176,33 @@ +@@ -198,9 +88,6 @@ + // Check for "/." : In other words, don't send files starting with a . + // Notice, GOBBLES, that this includes ".." + if (buf[i] == '/' && buf[i+1] == '.') return 0; +- +- // Give people a "hidden prefix" for hiding private files in the HTML tree +- if (strncmp(buf+i, "/aw_", 4) == 0) return 0; + } + + return 1; +@@ -231,34 +118,33 @@ } @@ -1293,7 +1393,7 @@ diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c int issockwriteable(int sd) { fd_set wfds; -@@ -275,11 +219,11 @@ +@@ -275,11 +161,11 @@ return FD_ISSET(sd, &wfds); } @@ -1307,17 +1407,25 @@ diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c if (stat(tpbuf, &st) == -1) return 0; -@@ -288,26 +232,7 @@ +@@ -288,25 +174,52 @@ } -- -- ++#if defined(CONFIG_HTTP_HAS_CGI) ++int iscgi(char *fn) { + ++ struct cgiextstruct *tp; ++ int fnlen, extlen; + -// FIXME: Arg! This function is horrible! Rewrite it -void status() { -- ++ fnlen = strlen(fn); ++ tp = cgiexts; + - int i; -- ++ while (tp != NULL) { ++ extlen = strlen(tp->ext); + - fprintf(stdout," [*************************************************]\n"); - fprintf(stdout," [ Anti-Web V%-6s by Hardcore Software ]\n",VERSION); - fprintf(stdout," [*************************************************]\n"); @@ -1326,16 +1434,44 @@ diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c - for(i=1;i<=35-strlen(webroot);i++) fprintf(stdout," "); - fprintf(stdout,"]\n"); - fprintf(stdout," [*************************************************]\n"); -- --} -- -- -- -+#if defined(CONFIG_HTTP_HAS_CGI) ++ if (strcasecmp(fn+(fnlen-extlen), tp->ext) == 0) ++ return 1; ++ ++ tp = tp->next; ++ } ++ ++ return 0; + + } + ++void split(char *tp, char *sp[], int maxwords, char sc) { ++ ++ int i=0; ++ while(1) { ++ /* Skip leading whitespace */ ++ while(*tp == sc) tp++; ++ ++ if (*tp == '\0') { ++ sp[i] = NULL; ++ break; ++ } + ++ if (i==maxwords-2) { ++ sp[maxwords-2] = NULL; ++ break; ++ } ++ ++ sp[i] = tp; ++ ++ while(*tp != sc && *tp != '\0') tp++; ++ if (*tp == sc) *tp++ = '\0'; ++ i++; ++ } ++} + /* This function was originally written by Nicolas Benoit but I've rewritten some parts of it to work under - as many possible AW configurations as possible. -@@ -329,7 +254,7 @@ +@@ -329,7 +242,7 @@ while (fr_rs[i] != NULL) { snprintf(tpfile, sizeof(tpfile), "%s/%s%s", webroot, cn->virtualhostreq, fr_str); @@ -1344,14 +1480,14 @@ diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c /* We've found our CGI file! */ my_strncpy(cn->actualfile, tpfile, MAXREQUESTLENGTH); my_strncpy(cn->cgiscriptinfo, fr_str, MAXREQUESTLENGTH); -@@ -349,3 +274,4 @@ +@@ -349,3 +262,4 @@ *(cn->cgipathinfo) = '\0'; return -1; } +#endif diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c --- awhttpd/net.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/net.c 2006-07-26 23:03:46.609375000 +1000 ++++ axTLS/httpd/awhttpd/net.c 2006-08-10 18:33:47.640625000 +1000 @@ -8,9 +8,7 @@ @@ -1462,7 +1598,7 @@ diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c --- awhttpd/permcheck.c 2005-01-23 06:49:29.000000000 +1000 -+++ axTLS/httpd/awhttpd/permcheck.c 2006-07-26 18:46:48.233750000 +1000 ++++ axTLS/httpd/awhttpd/permcheck.c 2006-08-10 18:33:47.640625000 +1000 @@ -7,21 +7,23 @@ */ @@ -1553,8 +1689,8 @@ diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c +#endif /* CONFIG_HTTP_PERM_CHECK */ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c --- awhttpd/proc.c 2005-01-23 10:59:41.000000000 +1000 -+++ axTLS/httpd/awhttpd/proc.c 2006-07-30 22:35:33.453125000 +1000 -@@ -13,14 +13,12 @@ ++++ axTLS/httpd/awhttpd/proc.c 2006-08-10 18:33:47.640625000 +1000 +@@ -13,91 +13,92 @@ #include #include #include @@ -1570,20 +1706,80 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c // Returns 1 if elems should continue being read, 0 otherwise int procheadelem(struct connstruct *cn, char *buf) { -@@ -53,7 +51,9 @@ - my_strncpy(cn->filereq, segs[0], MAXREQUESTLENGTH); +- char *words[10]; +- +- split(buf, words, 10, ' '); ++ char *delim, *value; ++#if defined(CONFIG_HTTP_HAS_CGI) ++ char *cgi_delim; ++#endif +- if (words[0] == NULL) return 0; +- +- if (strcmp(words[0], "GET")==0 || +- strcmp(words[0], "HEAD")==0 || +- strcmp(words[0], "POST")==0) { +- char *segs[4]; +- +- if (*words[0] == 'H') cn->reqtype = TYPE_HEAD; +- else if (*words[0] == 'P') cn->reqtype = TYPE_POST; ++ if ((delim = strchr(buf, ' ')) == NULL) ++ return 0; + +- split(words[1], segs, 4, '?'); ++ *delim = 0; ++ value = delim+1; + +- if (segs[0] == NULL) return 0; ++ if (strcmp(buf, "GET")==0 || ++ strcmp(buf, "HEAD")==0 || ++ strcmp(buf, "POST")==0) ++ { ++ if (buf[0] == 'H') ++ cn->reqtype = TYPE_HEAD; ++ else if (buf[0] == 'P') ++ cn->reqtype = TYPE_POST; ++ ++ if ((delim = strchr(value, ' ')) == NULL) /* expect HTTP type */ ++ return 0; ++ *delim = 0; + +- urldecode(segs[0]); ++ urldecode(value); + +- if (sanitizefile(segs[0]) == 0) { ++ if (sanitizefile(value) == 0) { + send404(cn); + removeconnection(cn); + return 0; + } + +- my_strncpy(cn->filereq, segs[0], MAXREQUESTLENGTH); +- +- if (segs[1] != NULL) my_strncpy(cn->cgiargs, segs[1], MAXREQUESTLENGTH); +- +- } else if (strcmp(words[0], "Host:")==0) { ++ my_strncpy(cn->filereq, value, MAXREQUESTLENGTH); +#if defined(CONFIG_HTTP_HAS_CGI) - if (segs[1] != NULL) my_strncpy(cn->cgiargs, segs[1], MAXREQUESTLENGTH); ++ if ((cgi_delim = strchr(value, '?'))) ++ { ++ *cgi_delim = NULL; ++ my_strncpy(cn->cgiargs, value+1, MAXREQUESTLENGTH); ++ } +#endif - } else if (strcmp(words[0], "Host:")==0) { +- if (words[1] == NULL) return 0; ++ } else if (strcmp(buf, "Host:")==0) { -@@ -66,38 +66,32 @@ +- if (sanitizehost(words[1]) == 0) { ++ if (sanitizehost(value) == 0) { + send404(cn); + removeconnection(cn); + return 0; } - my_strncpy(cn->virtualhostreq, words[1], MAXREQUESTLENGTH); +- my_strncpy(cn->virtualhostreq, words[1], MAXREQUESTLENGTH); - } else if (strcmp(words[0], "Range:")==0) { - - cn->offset = -1; @@ -1599,10 +1795,11 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c - - cn->offset = atoi(words[1]); - -+ } else if (strcmp(words[0], "Connection:")==0 && -+ strcmp(words[1], "close")==0) { ++ my_strncpy(cn->virtualhostreq, value, MAXREQUESTLENGTH); ++ } else if (strcmp(buf, "Connection:")==0 && ++ strcmp(value, "close")==0) { + cn->close_when_done = 1; -+ } else if (strcmp(words[0], "If-Modified-Since:")==0) { ++ } else if (strcmp(buf, "If-Modified-Since:") ==0 ) { + /* TODO: parse this date properly with getdate() or similar */ + cn->modified_since = 1; } @@ -1630,7 +1827,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c if (cn->reqtype == TYPE_HEAD) { snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n"); -@@ -107,7 +101,17 @@ +@@ -107,7 +108,17 @@ return; } @@ -1649,7 +1846,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c if (cn->dirp == NULL) { send404(cn); removeconnection(cn); -@@ -116,12 +120,13 @@ +@@ -116,12 +127,13 @@ // Get rid of the "." readdir(cn->dirp); @@ -1665,7 +1862,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c cn->state = STATE_DOING_DIR; -@@ -134,36 +139,48 @@ +@@ -134,36 +146,48 @@ void procdodir(struct connstruct *cn) { @@ -1723,7 +1920,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c -@@ -172,9 +189,10 @@ +@@ -172,9 +196,10 @@ char buf[MAXREQUESTLENGTH*4], *tp, *next; int rv; @@ -1737,7 +1934,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c return; } -@@ -217,36 +235,85 @@ +@@ -217,36 +242,85 @@ void procsendhead(struct connstruct *cn) { char buf[1024]; @@ -1832,7 +2029,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c if ((stbuf.st_mode & S_IFMT) == S_IFDIR) { if (cn->filereq[strlen(cn->filereq)-1] != '/') { send301(cn); -@@ -256,17 +323,18 @@ +@@ -256,17 +330,18 @@ // Check to see if this dir has an index file if (procindex(cn, &stbuf) == 0) { @@ -1854,7 +2051,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c send404(cn); removeconnection(cn); return; -@@ -275,50 +343,68 @@ +@@ -275,50 +350,68 @@ proccgi(cn,0); return; } @@ -1880,20 +2077,20 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c +#endif - snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s (%s)\nContent-Type: %s\nContent-Length: %ld\nLast-Modified: %s\n", -+ snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s\nContent-Type: %s\nContent-Length: %ld\nDate: %sLast-Modified: %s\n", - VERSION, +- VERSION, - quote, - getmimetype(cn->actualfile), - (long) stbuf.st_size, +- getmimetype(cn->actualfile), +- (long) stbuf.st_size, - ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end - } else { - snprintf(buf, sizeof(buf), "HTTP/1.1 206 OK\nServer: Anti-Web V%s (%s)\nContent-Type: %s\nContent-Range: %ld-%ld/%ld\nContent-Length: %ld\nLast-Modified: %s\n", -- VERSION, ++ snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s\nContent-Type: %s\nContent-Length: %ld\nDate: %sLast-Modified: %s\n", + VERSION, - quote, -- getmimetype(cn->actualfile), + getmimetype(cn->actualfile), - cn->offset, - (long) stbuf.st_size-1, -- (long) stbuf.st_size, + (long) stbuf.st_size, - (long) stbuf.st_size - cn->offset, + date, ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end @@ -1942,7 +2139,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c return; } -@@ -328,13 +414,18 @@ +@@ -328,13 +421,18 @@ void procreadfile(struct connstruct *cn) { @@ -1966,21 +2163,21 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c } cn->numbytes = rv; -@@ -347,11 +438,9 @@ +@@ -347,11 +445,9 @@ void procsendfile(struct connstruct *cn) { - int rv; +- +- rv = write(cn->networkdesc, cn->databuf, cn->numbytes); + int rv = special_write(cn, cn->databuf, cn->numbytes); -- rv = write(cn->networkdesc, cn->databuf, cn->numbytes); -- - if (rv == -1) + if (rv < 0) removeconnection(cn); else if (rv == cn->numbytes) cn->state = STATE_WANT_TO_READ_FILE; -@@ -361,7 +450,47 @@ +@@ -361,7 +457,47 @@ memmove(cn->databuf, cn->databuf + rv, cn->numbytes - rv); cn->numbytes -= rv; } @@ -2031,7 +2228,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c } diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c --- awhttpd/socket.c 2004-04-25 13:03:05.000000000 +1000 -+++ axTLS/httpd/awhttpd/socket.c 2006-07-26 21:52:07.750000000 +1000 ++++ axTLS/httpd/awhttpd/socket.c 2006-08-10 18:33:47.640625000 +1000 @@ -8,61 +8,17 @@ @@ -2152,7 +2349,7 @@ diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c memset(&(my_addr.sin_zero), 0, 8); // zero the rest of the struct diff -Naur awhttpd/urlencode.c axTLS/httpd/awhttpd/urlencode.c --- awhttpd/urlencode.c 2004-05-14 10:53:47.000000000 +1000 -+++ axTLS/httpd/awhttpd/urlencode.c 2006-07-26 18:46:48.233750000 +1000 ++++ axTLS/httpd/awhttpd/urlencode.c 2006-08-10 18:33:47.640625000 +1000 @@ -13,7 +13,7 @@ #include From e2cf04d6051956bf2b3d08202257ad11027ade98 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 12 Aug 2006 02:52:36 +0000 Subject: [PATCH 024/301] Added warning when no certificate. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@31 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/tls1_svr.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index 061cfcb387..9449b8b452 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -42,6 +42,15 @@ EXP_FUNC SSL * STDCALL ssl_server_new(SSLCTX *ssl_ctx, int client_fd) SSL *ssl = ssl_new(ssl_ctx, client_fd); ssl->next_state = HS_CLIENT_HELLO; ssl->hs_status = SSL_NOT_OK; /* not connected */ + +#ifdef CONFIG_SSL_FULL_MODE + if (ssl_ctx->chain_length == 0) + { + printf("Warning - no server certificate defined\n"); + TTY_FLUSH(); + } +#endif + return ssl; } From 54984d108272c69ffeb3308f21ead4ebcf95d903 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 12 Aug 2006 02:53:21 +0000 Subject: [PATCH 025/301] Additional help comments git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@32 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/Config.in | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/ssl/Config.in b/ssl/Config.in index 7607f750a4..56c7173efa 100644 --- a/ssl/Config.in +++ b/ssl/Config.in @@ -55,7 +55,8 @@ config CONFIG_SSL_FULL_MODE The axssl sample has 3 more options, "-debug", "-state" and "-show-rsa" This mode produces a library about 58kB in size. It is suggested that - this mode is used only during development. + this mode is used only during development, or systems that have more + generous memory limits. It is the default to demonstrate the features of axTLS. @@ -73,8 +74,8 @@ config CONFIG_SSL_SKELETON_MODE * Some other features/API calls may not work. This mode produces a library about 37kB in size. The main - disadvantage of this mode is speed - it may be several times slower - than the other build modes. + disadvantage of this mode is speed - it will be much slower than the + other build modes. endchoice From de7efdea2ff907de26a65119d41a7f0fc4cb9e58 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 12 Aug 2006 02:53:44 +0000 Subject: [PATCH 026/301] Initial version git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@33 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/linuxconfig | 97 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 97 insertions(+) create mode 100644 config/linuxconfig diff --git a/config/linuxconfig b/config/linuxconfig new file mode 100644 index 0000000000..79a3591a3a --- /dev/null +++ b/config/linuxconfig @@ -0,0 +1,97 @@ +# +# Automatically generated make config: don't edit +# +HAVE_DOT_CONFIG=y +CONFIG_PLATFORM_LINUX=y +# CONFIG_PLATFORM_CYGWIN is not set +# CONFIG_PLATFORM_SOLARIS is not set +# CONFIG_PLATFORM_WIN32 is not set + +# +# General Configuration +# +PREFIX="/usr/local" +# CONFIG_DEBUG is not set +# CONFIG_VISUAL_STUDIO_6_0 is not set +# CONFIG_VISUAL_STUDIO_7_0 is not set +# CONFIG_VISUAL_STUDIO_8_0 is not set +CONFIG_VISUAL_STUDIO_6_0_BASE="" +CONFIG_VISUAL_STUDIO_7_0_BASE="" +CONFIG_VISUAL_STUDIO_8_0_BASE="" +CONFIG_EXTRA_CFLAGS_OPTIONS="" +CONFIG_EXTRA_LDFLAGS_OPTIONS="" + +# +# SSL Library +# +# CONFIG_SSL_SERVER_ONLY is not set +# CONFIG_SSL_CERT_VERIFICATION is not set +# CONFIG_SSL_ENABLE_CLIENT is not set +CONFIG_SSL_FULL_MODE=y +# CONFIG_SSL_SKELETON_MODE is not set +# CONFIG_SSL_PROT_LOW is not set +CONFIG_SSL_PROT_MEDIUM=y +# CONFIG_SSL_PROT_HIGH is not set +# CONFIG_SSL_USE_DEFAULT_KEY is not set +CONFIG_SSL_ENABLE_V23_HANDSHAKE=y +CONFIG_SSL_HAS_PEM=y +CONFIG_SSL_USE_PKCS12=y +CONFIG_SSL_EXPIRY_TIME=24 +CONFIG_X509_MAX_CA_CERTS=4 +CONFIG_SSL_MAX_CERTS=2 +CONFIG_USE_DEV_URANDOM=y +# CONFIG_WIN32_USE_CRYPTO_LIB is not set +# CONFIG_PERFORMANCE_TESTING is not set +# CONFIG_SSL_TEST is not set +# CONFIG_AWHTTPD is not set +# CONFIG_HTTP_STATIC_BUILD is not set +# CONFIG_HTTP_HAS_SSL is not set +CONFIG_HTTP_HTTPS_PORT=0 +CONFIG_HTTP_SESSION_CACHE_SIZE=0 +CONFIG_HTTP_WEBROOT="" +CONFIG_HTTP_PORT=0 +CONFIG_HTTP_TIMEOUT=0 +# CONFIG_HTTP_HAS_CGI is not set +CONFIG_HTTP_CGI_EXTENSION="" +# CONFIG_HTTP_DIRECTORIES is not set +# CONFIG_HTTP_PERM_CHECK is not set +# CONFIG_HTTP_HAS_IPV6 is not set +# CONFIG_HTTP_VERBOSE is not set +# CONFIG_HTTP_IS_DAEMON is not set + +# +# Language Bindings +# +# CONFIG_BINDINGS is not set +# CONFIG_CSHARP_BINDINGS is not set +# CONFIG_VBNET_BINDINGS is not set +CONFIG_DOT_NET_FRAMEWORK_BASE="" +# CONFIG_JAVA_BINDINGS is not set +CONFIG_JAVA_HOME="" +# CONFIG_PERL_BINDINGS is not set +CONFIG_PERL_CORE="" +CONFIG_PERL_LIB="" + +# +# Samples +# +CONFIG_SAMPLES=y +CONFIG_C_SAMPLES=y +# CONFIG_CSHARP_SAMPLES is not set +# CONFIG_VBNET_SAMPLES is not set +# CONFIG_JAVA_SAMPLES is not set +# CONFIG_PERL_SAMPLES is not set + +# +# BigInt Options +# +# CONFIG_BIGINT_CLASSICAL is not set +# CONFIG_BIGINT_MONTGOMERY is not set +CONFIG_BIGINT_BARRETT=y +CONFIG_BIGINT_CRT=y +# CONFIG_BIGINT_KARATSUBA is not set +MUL_KARATSUBA_THRESH=0 +SQU_KARATSUBA_THRESH=0 +CONFIG_BIGINT_SLIDING_WINDOW=y +CONFIG_BIGINT_SQUARE=y +# CONFIG_BIGINT_CHECK_ON is not set From 488d6e95a290bc3f2b1d089c47d46e69dd2bda59 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 12 Aug 2006 02:54:24 +0000 Subject: [PATCH 027/301] Added dependency on Win32 for install git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@34 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/Config.in | 1 + 1 file changed, 1 insertion(+) diff --git a/config/Config.in b/config/Config.in index e9c3eff1e9..14de5c8f28 100644 --- a/config/Config.in +++ b/config/Config.in @@ -31,6 +31,7 @@ menu "General Configuration" config PREFIX string "axTLS installation prefix" + depends on !CONFIG_PLATFORM_WIN32 default "/usr/local" help Define your directory to install axTLS files/subdirs in. From 0045db57d144b6536b6154d4079a6c7827ee8dd1 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 12 Aug 2006 02:54:55 +0000 Subject: [PATCH 028/301] Added linuxconf as a target git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@35 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index 8183dc0672..f1e1abb985 100644 --- a/Makefile +++ b/Makefile @@ -141,7 +141,7 @@ win32releaseconf: config/scripts/config/conf @./config/scripts/config/conf -D config/win32config $(CONFIG_CONFIG_IN) > /dev/null $(MAKE) -# The special debian release configuration -debianconf: config/scripts/config/conf - @./config/scripts/config/conf -D config/debianconfig $(CONFIG_CONFIG_IN) > /dev/null +# The special linux release configuration +linuxconf: config/scripts/config/conf + @./config/scripts/config/conf -D config/linuxconfig $(CONFIG_CONFIG_IN) > /dev/null $(MAKE) From 0a53227725fb4a04fe19533d09993c16f685206c Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 12 Aug 2006 08:31:29 +0000 Subject: [PATCH 029/301] cgi warning fix git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@36 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/awhttpd.patch | 72 ++++++++++++++++++++++----------------------- 1 file changed, 36 insertions(+), 36 deletions(-) diff --git a/httpd/awhttpd.patch b/httpd/awhttpd.patch index ad1ed313c5..7560242408 100644 --- a/httpd/awhttpd.patch +++ b/httpd/awhttpd.patch @@ -1,6 +1,6 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h --- awhttpd/aw3.h 2005-01-23 13:17:14.000000000 +1000 -+++ axTLS/httpd/awhttpd/aw3.h 2006-08-10 18:33:47.609375000 +1000 ++++ axTLS/httpd/awhttpd/aw3.h 2006-08-12 18:25:58.390625000 +1000 @@ -7,17 +7,16 @@ */ @@ -192,7 +192,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h +void initlists(void); diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c --- awhttpd/cgi.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/cgi.c 2006-08-10 18:33:47.625000000 +1000 ++++ axTLS/httpd/awhttpd/cgi.c 2006-08-12 18:26:18.437500000 +1000 @@ -7,93 +7,46 @@ */ @@ -229,8 +229,8 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c - - return; - --} -- + } + - - -void gensysenv(struct connstruct *cn) { @@ -266,8 +266,8 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c - - #endif - - } - +-} +- - - void proccgi(struct connstruct *cn, int has_pathinfo) { @@ -311,7 +311,7 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c // Close the write descriptor close(tpipe[1]); cn->filedesc = tpipe[0]; -@@ -132,19 +86,62 @@ +@@ -132,19 +86,61 @@ close(tpipe[1]); myargs[0] = cn->actualfile; @@ -364,7 +364,7 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c + removeconnection(cn); + return; + } -+ + + _dup2(tmp_stdout, _fileno(stdout)); + close(tmp_stdout); + cn->filedesc = tpipe[0]; @@ -373,13 +373,12 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c + for (;;) + { + procreadfile(cn); - ++ + if (cn->filedesc == -1) + break; + + procsendfile(cn); + usleep(200000); /* don't know why this delay makes it work (yet) */ -+ } +#endif } +#endif /* CONFIG_HTTP_HAS_CGI */ @@ -654,7 +653,7 @@ diff -Naur awhttpd/conf.c axTLS/httpd/awhttpd/conf.c -} diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c --- awhttpd/conn.c 2004-12-07 16:11:02.000000000 +1000 -+++ axTLS/httpd/awhttpd/conn.c 2006-08-10 18:33:47.625000000 +1000 ++++ axTLS/httpd/awhttpd/conn.c 2006-08-12 18:25:58.406250000 +1000 @@ -9,26 +9,16 @@ #include @@ -761,7 +760,7 @@ diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c } diff -Naur awhttpd/errors.c axTLS/httpd/awhttpd/errors.c --- awhttpd/errors.c 2005-01-23 06:49:29.000000000 +1000 -+++ axTLS/httpd/awhttpd/errors.c 2006-08-10 18:33:47.625000000 +1000 ++++ axTLS/httpd/awhttpd/errors.c 2006-08-12 18:25:58.406250000 +1000 @@ -8,7 +8,6 @@ @@ -804,7 +803,7 @@ diff -Naur awhttpd/errors.c axTLS/httpd/awhttpd/errors.c diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c --- awhttpd/index.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/index.c 2006-08-10 18:33:47.625000000 +1000 ++++ axTLS/httpd/awhttpd/index.c 2006-08-12 18:25:58.406250000 +1000 @@ -11,7 +11,6 @@ #include #include @@ -851,7 +850,7 @@ diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c my_strncpy(cn->actualfile, tbuf, MAXREQUESTLENGTH); diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c --- awhttpd/main.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/main.c 2006-08-11 06:46:48.437500000 +1000 ++++ axTLS/httpd/awhttpd/main.c 2006-08-12 18:25:58.406250000 +1000 @@ -11,7 +11,6 @@ #include #include @@ -1085,7 +1084,7 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c return 0; diff -Naur awhttpd/mime_types.c axTLS/httpd/awhttpd/mime_types.c --- awhttpd/mime_types.c 2004-01-26 01:08:47.000000000 +1000 -+++ axTLS/httpd/awhttpd/mime_types.c 2006-08-10 18:33:47.625000000 +1000 ++++ axTLS/httpd/awhttpd/mime_types.c 2006-08-12 18:25:58.421875000 +1000 @@ -7,28 +7,21 @@ */ @@ -1170,7 +1169,7 @@ diff -Naur awhttpd/mime_types.c axTLS/httpd/awhttpd/mime_types.c + diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c --- awhttpd/misc.c 2005-01-23 12:59:09.000000000 +1000 -+++ axTLS/httpd/awhttpd/misc.c 2006-08-10 18:33:47.625000000 +1000 ++++ axTLS/httpd/awhttpd/misc.c 2006-08-12 18:25:58.421875000 +1000 @@ -7,33 +7,33 @@ */ @@ -1487,7 +1486,7 @@ diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c +#endif diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c --- awhttpd/net.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/net.c 2006-08-10 18:33:47.640625000 +1000 ++++ axTLS/httpd/awhttpd/net.c 2006-08-12 18:25:58.421875000 +1000 @@ -8,9 +8,7 @@ @@ -1598,7 +1597,7 @@ diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c --- awhttpd/permcheck.c 2005-01-23 06:49:29.000000000 +1000 -+++ axTLS/httpd/awhttpd/permcheck.c 2006-08-10 18:33:47.640625000 +1000 ++++ axTLS/httpd/awhttpd/permcheck.c 2006-08-12 18:25:58.421875000 +1000 @@ -7,21 +7,23 @@ */ @@ -1689,7 +1688,7 @@ diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c +#endif /* CONFIG_HTTP_PERM_CHECK */ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c --- awhttpd/proc.c 2005-01-23 10:59:41.000000000 +1000 -+++ axTLS/httpd/awhttpd/proc.c 2006-08-10 18:33:47.640625000 +1000 ++++ axTLS/httpd/awhttpd/proc.c 2006-08-12 18:26:51.093750000 +1000 @@ -13,91 +13,92 @@ #include #include @@ -1764,7 +1763,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c +#if defined(CONFIG_HTTP_HAS_CGI) + if ((cgi_delim = strchr(value, '?'))) + { -+ *cgi_delim = NULL; ++ *cgi_delim = 0; + my_strncpy(cn->cgiargs, value+1, MAXREQUESTLENGTH); + } +#endif @@ -1846,15 +1845,15 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c if (cn->dirp == NULL) { send404(cn); removeconnection(cn); -@@ -116,12 +127,13 @@ +@@ -116,12 +127,10 @@ // Get rid of the "." readdir(cn->dirp); +#endif - // If the browser doesn't specify a virtual host, the client will - // see "http://default/thedir/" instead of "http://thehost.com/thedir/" - // Consider this punishment for using such an old browser. +- // If the browser doesn't specify a virtual host, the client will +- // see "http://default/thedir/" instead of "http://thehost.com/thedir/" +- // Consider this punishment for using such an old browser. - snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n\nDirectory Listing\n

    Directory listing of http://%s%s


    \n", cn->virtualhostreq, cn->filereq); - write(cn->networkdesc, buf, strlen(buf)); + snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n\nDirectory Listing\n

    Directory listing of %s://%s%s


    \n", cn->is_ssl ? "https" : "http", cn->virtualhostreq, cn->filereq); @@ -1862,7 +1861,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c cn->state = STATE_DOING_DIR; -@@ -134,36 +146,48 @@ +@@ -134,36 +143,48 @@ void procdodir(struct connstruct *cn) { @@ -1878,13 +1877,14 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c do { - if ((dp = readdir(cn->dirp)) == NULL) { +- snprintf(buf, sizeof(buf), "

    End of Anti-Web directory listing.\n"); +- write(cn->networkdesc, buf, strlen(buf)); +#ifdef WIN32 + if (!FindNextFile(cn->dirp, &cn->file_data)) { +#else + if ((dp = readdir(cn->dirp)) == NULL) { +#endif - snprintf(buf, sizeof(buf), "

    End of Anti-Web directory listing.\n"); -- write(cn->networkdesc, buf, strlen(buf)); ++ snprintf(buf, sizeof(buf), "\n"); + special_write(cn, buf, strlen(buf)); removeconnection(cn); return; @@ -1920,7 +1920,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c -@@ -172,9 +196,10 @@ +@@ -172,9 +193,10 @@ char buf[MAXREQUESTLENGTH*4], *tp, *next; int rv; @@ -1934,7 +1934,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c return; } -@@ -217,36 +242,85 @@ +@@ -217,36 +239,85 @@ void procsendhead(struct connstruct *cn) { char buf[1024]; @@ -2029,7 +2029,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c if ((stbuf.st_mode & S_IFMT) == S_IFDIR) { if (cn->filereq[strlen(cn->filereq)-1] != '/') { send301(cn); -@@ -256,17 +330,18 @@ +@@ -256,17 +327,18 @@ // Check to see if this dir has an index file if (procindex(cn, &stbuf) == 0) { @@ -2051,7 +2051,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c send404(cn); removeconnection(cn); return; -@@ -275,50 +350,68 @@ +@@ -275,50 +347,68 @@ proccgi(cn,0); return; } @@ -2139,7 +2139,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c return; } -@@ -328,13 +421,18 @@ +@@ -328,13 +418,18 @@ void procreadfile(struct connstruct *cn) { @@ -2163,7 +2163,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c } cn->numbytes = rv; -@@ -347,11 +445,9 @@ +@@ -347,11 +442,9 @@ void procsendfile(struct connstruct *cn) { @@ -2177,7 +2177,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c removeconnection(cn); else if (rv == cn->numbytes) cn->state = STATE_WANT_TO_READ_FILE; -@@ -361,7 +457,47 @@ +@@ -361,7 +454,47 @@ memmove(cn->databuf, cn->databuf + rv, cn->numbytes - rv); cn->numbytes -= rv; } @@ -2228,7 +2228,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c } diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c --- awhttpd/socket.c 2004-04-25 13:03:05.000000000 +1000 -+++ axTLS/httpd/awhttpd/socket.c 2006-08-10 18:33:47.640625000 +1000 ++++ axTLS/httpd/awhttpd/socket.c 2006-08-12 18:25:58.437500000 +1000 @@ -8,61 +8,17 @@ @@ -2349,7 +2349,7 @@ diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c memset(&(my_addr.sin_zero), 0, 8); // zero the rest of the struct diff -Naur awhttpd/urlencode.c axTLS/httpd/awhttpd/urlencode.c --- awhttpd/urlencode.c 2004-05-14 10:53:47.000000000 +1000 -+++ axTLS/httpd/awhttpd/urlencode.c 2006-08-10 18:33:47.640625000 +1000 ++++ axTLS/httpd/awhttpd/urlencode.c 2006-08-12 18:25:58.437500000 +1000 @@ -13,7 +13,7 @@ #include From 3eaa68bfdafd1b19fc78d1bb1e5d067e6c868ba6 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 12 Aug 2006 09:21:14 +0000 Subject: [PATCH 030/301] cgi warning fix git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@37 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/awhttpd.patch | 41 +++++++++++++++++++++-------------------- 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/httpd/awhttpd.patch b/httpd/awhttpd.patch index 7560242408..634b8b47d8 100644 --- a/httpd/awhttpd.patch +++ b/httpd/awhttpd.patch @@ -1,6 +1,6 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h --- awhttpd/aw3.h 2005-01-23 13:17:14.000000000 +1000 -+++ axTLS/httpd/awhttpd/aw3.h 2006-08-12 18:25:58.390625000 +1000 ++++ axTLS/httpd/awhttpd/aw3.h 2006-08-12 19:16:59.687500000 +1000 @@ -7,17 +7,16 @@ */ @@ -192,7 +192,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h +void initlists(void); diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c --- awhttpd/cgi.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/cgi.c 2006-08-12 18:26:18.437500000 +1000 ++++ axTLS/httpd/awhttpd/cgi.c 2006-08-12 19:17:29.171875000 +1000 @@ -7,93 +7,46 @@ */ @@ -229,8 +229,8 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c - - return; - - } - +-} +- - - -void gensysenv(struct connstruct *cn) { @@ -266,8 +266,8 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c - - #endif - --} -- + } + - - void proccgi(struct connstruct *cn, int has_pathinfo) { @@ -311,7 +311,7 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c // Close the write descriptor close(tpipe[1]); cn->filedesc = tpipe[0]; -@@ -132,19 +86,61 @@ +@@ -132,19 +86,62 @@ close(tpipe[1]); myargs[0] = cn->actualfile; @@ -364,7 +364,7 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c + removeconnection(cn); + return; + } - ++ + _dup2(tmp_stdout, _fileno(stdout)); + close(tmp_stdout); + cn->filedesc = tpipe[0]; @@ -373,12 +373,13 @@ diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c + for (;;) + { + procreadfile(cn); -+ + + if (cn->filedesc == -1) + break; + + procsendfile(cn); + usleep(200000); /* don't know why this delay makes it work (yet) */ ++ } +#endif } +#endif /* CONFIG_HTTP_HAS_CGI */ @@ -653,7 +654,7 @@ diff -Naur awhttpd/conf.c axTLS/httpd/awhttpd/conf.c -} diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c --- awhttpd/conn.c 2004-12-07 16:11:02.000000000 +1000 -+++ axTLS/httpd/awhttpd/conn.c 2006-08-12 18:25:58.406250000 +1000 ++++ axTLS/httpd/awhttpd/conn.c 2006-08-12 19:16:59.687500000 +1000 @@ -9,26 +9,16 @@ #include @@ -760,7 +761,7 @@ diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c } diff -Naur awhttpd/errors.c axTLS/httpd/awhttpd/errors.c --- awhttpd/errors.c 2005-01-23 06:49:29.000000000 +1000 -+++ axTLS/httpd/awhttpd/errors.c 2006-08-12 18:25:58.406250000 +1000 ++++ axTLS/httpd/awhttpd/errors.c 2006-08-12 19:16:59.687500000 +1000 @@ -8,7 +8,6 @@ @@ -803,7 +804,7 @@ diff -Naur awhttpd/errors.c axTLS/httpd/awhttpd/errors.c diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c --- awhttpd/index.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/index.c 2006-08-12 18:25:58.406250000 +1000 ++++ axTLS/httpd/awhttpd/index.c 2006-08-12 19:16:59.687500000 +1000 @@ -11,7 +11,6 @@ #include #include @@ -850,7 +851,7 @@ diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c my_strncpy(cn->actualfile, tbuf, MAXREQUESTLENGTH); diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c --- awhttpd/main.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/main.c 2006-08-12 18:25:58.406250000 +1000 ++++ axTLS/httpd/awhttpd/main.c 2006-08-12 19:16:59.687500000 +1000 @@ -11,7 +11,6 @@ #include #include @@ -1084,7 +1085,7 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c return 0; diff -Naur awhttpd/mime_types.c axTLS/httpd/awhttpd/mime_types.c --- awhttpd/mime_types.c 2004-01-26 01:08:47.000000000 +1000 -+++ axTLS/httpd/awhttpd/mime_types.c 2006-08-12 18:25:58.421875000 +1000 ++++ axTLS/httpd/awhttpd/mime_types.c 2006-08-12 19:16:59.703125000 +1000 @@ -7,28 +7,21 @@ */ @@ -1169,7 +1170,7 @@ diff -Naur awhttpd/mime_types.c axTLS/httpd/awhttpd/mime_types.c + diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c --- awhttpd/misc.c 2005-01-23 12:59:09.000000000 +1000 -+++ axTLS/httpd/awhttpd/misc.c 2006-08-12 18:25:58.421875000 +1000 ++++ axTLS/httpd/awhttpd/misc.c 2006-08-12 19:16:59.703125000 +1000 @@ -7,33 +7,33 @@ */ @@ -1486,7 +1487,7 @@ diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c +#endif diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c --- awhttpd/net.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/net.c 2006-08-12 18:25:58.421875000 +1000 ++++ axTLS/httpd/awhttpd/net.c 2006-08-12 19:16:59.703125000 +1000 @@ -8,9 +8,7 @@ @@ -1597,7 +1598,7 @@ diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c --- awhttpd/permcheck.c 2005-01-23 06:49:29.000000000 +1000 -+++ axTLS/httpd/awhttpd/permcheck.c 2006-08-12 18:25:58.421875000 +1000 ++++ axTLS/httpd/awhttpd/permcheck.c 2006-08-12 19:16:59.703125000 +1000 @@ -7,21 +7,23 @@ */ @@ -1688,7 +1689,7 @@ diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c +#endif /* CONFIG_HTTP_PERM_CHECK */ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c --- awhttpd/proc.c 2005-01-23 10:59:41.000000000 +1000 -+++ axTLS/httpd/awhttpd/proc.c 2006-08-12 18:26:51.093750000 +1000 ++++ axTLS/httpd/awhttpd/proc.c 2006-08-12 19:16:59.703125000 +1000 @@ -13,91 +13,92 @@ #include #include @@ -2228,7 +2229,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c } diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c --- awhttpd/socket.c 2004-04-25 13:03:05.000000000 +1000 -+++ axTLS/httpd/awhttpd/socket.c 2006-08-12 18:25:58.437500000 +1000 ++++ axTLS/httpd/awhttpd/socket.c 2006-08-12 19:16:59.718750000 +1000 @@ -8,61 +8,17 @@ @@ -2349,7 +2350,7 @@ diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c memset(&(my_addr.sin_zero), 0, 8); // zero the rest of the struct diff -Naur awhttpd/urlencode.c axTLS/httpd/awhttpd/urlencode.c --- awhttpd/urlencode.c 2004-05-14 10:53:47.000000000 +1000 -+++ axTLS/httpd/awhttpd/urlencode.c 2006-08-12 18:25:58.437500000 +1000 ++++ axTLS/httpd/awhttpd/urlencode.c 2006-08-12 19:16:59.718750000 +1000 @@ -13,7 +13,7 @@ #include From 73c11ecadb57fe067845985940b3faf5e978b533 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 19 Nov 2006 00:32:10 +0000 Subject: [PATCH 031/301] got rid of a write system call git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@39 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/bigint.c | 6 +++--- ssl/crypto.h | 3 ++- ssl/crypto_misc.c | 14 ++++++++++---- ssl/p12.c | 4 ++-- ssl/ssl.h | 4 ++-- ssl/tls1.c | 16 +++++----------- 6 files changed, 24 insertions(+), 23 deletions(-) diff --git a/ssl/bigint.c b/ssl/bigint.c index 797ca21703..8d52184a81 100644 --- a/ssl/bigint.c +++ b/ssl/bigint.c @@ -165,7 +165,7 @@ void bi_permanent(bigint *bi) } /** - * @brief Take a permanent object and make it elligible for freedom. + * @brief Take a permanent object and make it eligible for freedom. * @param bi [in] The bigint to be made back to temporary. */ void bi_depermanent(bigint *bi) @@ -243,7 +243,7 @@ bigint *bi_clone(BI_CTX *ctx, const bigint *bi) } /** - * @brief Perform an additon operation between two bigints. + * @brief Perform an addition operation between two bigints. * @param ctx [in] The bigint session context. * @param bia [in] A bigint. * @param bib [in] Another bigint. @@ -1038,7 +1038,7 @@ static void more_comps(bigint *bi, int n) /* * Make a new empty bigint. It may just use an old one if one is available. - * Otherwise get one of the heap. + * Otherwise get one off the heap. */ static bigint *alloc(BI_CTX *ctx, int size) { diff --git a/ssl/crypto.h b/ssl/crypto.h index 8a79a84f15..dae5a5f3a3 100644 --- a/ssl/crypto.h +++ b/ssl/crypto.h @@ -269,7 +269,8 @@ typedef void (*hmac_func)(const uint8_t *msg, int length, const uint8_t *key, typedef struct { - uint8_t *data; + uint8_t *pre_data; /* include the ssl record bytes */ + uint8_t *data; /* the regular ssl data */ int max_len; int index; } BUF_MEM; diff --git a/ssl/crypto_misc.c b/ssl/crypto_misc.c index 8591aacd9e..edfe5bb7ca 100644 --- a/ssl/crypto_misc.c +++ b/ssl/crypto_misc.c @@ -31,6 +31,8 @@ #include "wincrypt.h" #endif +#define BM_RECORD_OFFSET 5 /* same as SSL_RECORD_SIZE */ + #ifndef WIN32 static int rng_fd = -1; #elif defined(CONFIG_WIN32_USE_CRYPTO_LIB) @@ -50,8 +52,9 @@ const char * const unsupported_str = "Error: feature not supported\n"; BUF_MEM buf_new() { BUF_MEM bm; - bm.data = (uint8_t *)malloc(2048); /* should be enough to start with */ - bm.max_len = 2048; + bm.pre_data = (uint8_t *)malloc(2048); /* should be enough to start with */ + bm.data = bm.pre_data+BM_RECORD_OFFSET; /* some space at the start */ + bm.max_len = 2048-BM_RECORD_OFFSET; bm.index = 0; return bm; } @@ -66,7 +69,9 @@ void buf_grow(BUF_MEM *bm, int len) return; } - bm->data = (uint8_t *)realloc(bm->data, len+1024); /* just to be sure */ + /* add 1kB just to be sure */ + bm->pre_data = (uint8_t *)realloc(bm->pre_data, len+1024+BM_RECORD_OFFSET); + bm->data = bm->pre_data+BM_RECORD_OFFSET; bm->max_len = len+1024; } @@ -75,7 +80,8 @@ void buf_grow(BUF_MEM *bm, int len) */ void buf_free(BUF_MEM *bm) { - free(bm->data); + free(bm->pre_data); + bm->pre_data = NULL; bm->data = NULL; } diff --git a/ssl/p12.c b/ssl/p12.c index 2d198dc90e..2189509989 100644 --- a/ssl/p12.c +++ b/ssl/p12.c @@ -192,7 +192,7 @@ static int p8_decrypt(const char *password, const uint8_t *salt, int iter, } /* - * Take a raw pkcs12 block and the decrypt it and turn it into a certificates + * Take a raw pkcs12 block and the decrypt it and turn it into a certificate(s) * and keys. */ int pkcs12_decode(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password) @@ -390,7 +390,7 @@ static int get_pbe_params(uint8_t *buf, int *offset, goto error; /* we expect pbeWithSHAAnd128BitRC4 (1.2.840.113549.1.12.1.1) - which is the only agorithm we support */ + which is the only algorithm we support */ if (len != sizeof(pbeSH1RC4) || memcmp(&buf[*offset], pbeSH1RC4, sizeof(pbeSH1RC4))) { diff --git a/ssl/ssl.h b/ssl/ssl.h index 27b1f3903b..c314cbc8db 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -354,7 +354,7 @@ EXP_FUNC int STDCALL ssl_verify_cert(SSL *ssl); * - SSL_X509_CA_CERT_ORGANIZATION * - SSL_X509_CA_CERT_ORGANIZATIONAL_NAME * @return The appropriate string (or null if not defined) - * @note Verification mode must be enabled. + * @note Verification build mode must be enabled. */ EXP_FUNC const char * STDCALL ssl_get_cert_dn(SSL *ssl, int component); @@ -388,7 +388,7 @@ EXP_FUNC int STDCALL ssl_renegotiate(SSL *ssl); * @param filename [in] The location of a file in DER/PEM format. * @param password [in] The password used. Can be null if not required. * @return SSL_OK if all ok - * @note Not available in skeleton mode. + * @note Not available in skeleton build mode. */ EXP_FUNC int STDCALL ssl_obj_load(SSLCTX *ssl_ctx, int obj_type, const char *filename, const char *password); diff --git a/ssl/tls1.c b/ssl/tls1.c index 41484949f3..e157147a7e 100644 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -902,7 +902,8 @@ static void *crypt_new(SSL *ssl, uint8_t *key, uint8_t *iv, int is_decrypt) */ static int send_raw_packet(SSL *ssl, uint8_t protocol) { - uint8_t rec_buf[SSL_RECORD_SIZE]; + uint8_t *rec_buf = ssl->bm_buf.pre_data; + int pkt_size = SSL_RECORD_SIZE+ssl->bm_buf.index; int ret; rec_buf[0] = protocol; @@ -911,17 +912,10 @@ static int send_raw_packet(SSL *ssl, uint8_t protocol) rec_buf[3] = ssl->bm_buf.index >> 8; rec_buf[4] = ssl->bm_buf.index & 0xff; - DISPLAY_BYTES(ssl, "sending %d bytes", rec_buf, 5, 5); - DISPLAY_BYTES(ssl, "sending %d bytes", ssl->bm_buf.data, - ssl->bm_buf.index, ssl->bm_buf.index); + DISPLAY_BYTES(ssl, "sending %d bytes", ssl->bm_buf.pre_data, + pkt_size, pkt_size); - /* 2 system calls, but what the hell it makes life a lot simpler */ - ret = SOCKET_WRITE(ssl->client_fd, rec_buf, SSL_RECORD_SIZE); - - if (ret > 0) - { - ret = SOCKET_WRITE(ssl->client_fd, ssl->bm_buf.data, ssl->bm_buf.index); - } + ret = SOCKET_WRITE(ssl->client_fd, ssl->bm_buf.pre_data, pkt_size); SET_SSL_FLAG(SSL_NEED_RECORD); /* reset for next time */ ssl->bm_buf.index = 0; From c98ded2ecae50e3f4012f28ef9033fb480179949 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 27 Nov 2006 02:41:54 +0000 Subject: [PATCH 032/301] fixed pkcs12 mac issue git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@40 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/awhttpd.patch | 30 +++++----- samples/c/Makefile | 2 +- ssl/asn1.c | 22 +++----- ssl/p12.c | 134 ++++++++++++++++++++++++++++---------------- ssl/test/ssltest.c | 26 ++++----- 5 files changed, 125 insertions(+), 89 deletions(-) diff --git a/httpd/awhttpd.patch b/httpd/awhttpd.patch index 634b8b47d8..59eb7eb819 100644 --- a/httpd/awhttpd.patch +++ b/httpd/awhttpd.patch @@ -1,6 +1,6 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h --- awhttpd/aw3.h 2005-01-23 13:17:14.000000000 +1000 -+++ axTLS/httpd/awhttpd/aw3.h 2006-08-12 19:16:59.687500000 +1000 ++++ axTLS/httpd/awhttpd/aw3.h 2006-11-15 15:09:14.196258200 +1000 @@ -7,17 +7,16 @@ */ @@ -192,7 +192,7 @@ diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h +void initlists(void); diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c --- awhttpd/cgi.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/cgi.c 2006-08-12 19:17:29.171875000 +1000 ++++ axTLS/httpd/awhttpd/cgi.c 2006-11-15 15:09:14.211883700 +1000 @@ -7,93 +7,46 @@ */ @@ -654,7 +654,7 @@ diff -Naur awhttpd/conf.c axTLS/httpd/awhttpd/conf.c -} diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c --- awhttpd/conn.c 2004-12-07 16:11:02.000000000 +1000 -+++ axTLS/httpd/awhttpd/conn.c 2006-08-12 19:16:59.687500000 +1000 ++++ axTLS/httpd/awhttpd/conn.c 2006-11-15 15:09:14.243134700 +1000 @@ -9,26 +9,16 @@ #include @@ -761,7 +761,7 @@ diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c } diff -Naur awhttpd/errors.c axTLS/httpd/awhttpd/errors.c --- awhttpd/errors.c 2005-01-23 06:49:29.000000000 +1000 -+++ axTLS/httpd/awhttpd/errors.c 2006-08-12 19:16:59.687500000 +1000 ++++ axTLS/httpd/awhttpd/errors.c 2006-11-15 15:09:14.258760200 +1000 @@ -8,7 +8,6 @@ @@ -804,7 +804,7 @@ diff -Naur awhttpd/errors.c axTLS/httpd/awhttpd/errors.c diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c --- awhttpd/index.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/index.c 2006-08-12 19:16:59.687500000 +1000 ++++ axTLS/httpd/awhttpd/index.c 2006-11-15 15:09:14.258760200 +1000 @@ -11,7 +11,6 @@ #include #include @@ -851,7 +851,7 @@ diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c my_strncpy(cn->actualfile, tbuf, MAXREQUESTLENGTH); diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c --- awhttpd/main.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/main.c 2006-08-12 19:16:59.687500000 +1000 ++++ axTLS/httpd/awhttpd/main.c 2006-11-21 16:30:37.093363800 +1000 @@ -11,7 +11,6 @@ #include #include @@ -903,7 +903,7 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c void initlists() { int i; -@@ -33,108 +64,119 @@ +@@ -33,108 +64,118 @@ servers = NULL; usedconns = NULL; freeconns = NULL; @@ -1040,7 +1040,7 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c pid = fork(); if(pid > 0) { - status(); +- status(); exit(0); } else if(pid == -1) { +#ifdef CONFIG_HTTP_VERBOSE @@ -1085,7 +1085,7 @@ diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c return 0; diff -Naur awhttpd/mime_types.c axTLS/httpd/awhttpd/mime_types.c --- awhttpd/mime_types.c 2004-01-26 01:08:47.000000000 +1000 -+++ axTLS/httpd/awhttpd/mime_types.c 2006-08-12 19:16:59.703125000 +1000 ++++ axTLS/httpd/awhttpd/mime_types.c 2006-11-15 15:09:14.305636700 +1000 @@ -7,28 +7,21 @@ */ @@ -1170,7 +1170,7 @@ diff -Naur awhttpd/mime_types.c axTLS/httpd/awhttpd/mime_types.c + diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c --- awhttpd/misc.c 2005-01-23 12:59:09.000000000 +1000 -+++ axTLS/httpd/awhttpd/misc.c 2006-08-12 19:16:59.703125000 +1000 ++++ axTLS/httpd/awhttpd/misc.c 2006-11-15 15:09:14.321262200 +1000 @@ -7,33 +7,33 @@ */ @@ -1487,7 +1487,7 @@ diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c +#endif diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c --- awhttpd/net.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/net.c 2006-08-12 19:16:59.703125000 +1000 ++++ axTLS/httpd/awhttpd/net.c 2006-11-15 15:09:14.352513200 +1000 @@ -8,9 +8,7 @@ @@ -1598,7 +1598,7 @@ diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c --- awhttpd/permcheck.c 2005-01-23 06:49:29.000000000 +1000 -+++ axTLS/httpd/awhttpd/permcheck.c 2006-08-12 19:16:59.703125000 +1000 ++++ axTLS/httpd/awhttpd/permcheck.c 2006-11-15 15:09:14.368138700 +1000 @@ -7,21 +7,23 @@ */ @@ -1689,7 +1689,7 @@ diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c +#endif /* CONFIG_HTTP_PERM_CHECK */ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c --- awhttpd/proc.c 2005-01-23 10:59:41.000000000 +1000 -+++ axTLS/httpd/awhttpd/proc.c 2006-08-12 19:16:59.703125000 +1000 ++++ axTLS/httpd/awhttpd/proc.c 2006-11-15 15:09:14.399389700 +1000 @@ -13,91 +13,92 @@ #include #include @@ -2229,7 +2229,7 @@ diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c } diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c --- awhttpd/socket.c 2004-04-25 13:03:05.000000000 +1000 -+++ axTLS/httpd/awhttpd/socket.c 2006-08-12 19:16:59.718750000 +1000 ++++ axTLS/httpd/awhttpd/socket.c 2006-11-15 15:09:14.415015200 +1000 @@ -8,61 +8,17 @@ @@ -2350,7 +2350,7 @@ diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c memset(&(my_addr.sin_zero), 0, 8); // zero the rest of the struct diff -Naur awhttpd/urlencode.c axTLS/httpd/awhttpd/urlencode.c --- awhttpd/urlencode.c 2004-05-14 10:53:47.000000000 +1000 -+++ axTLS/httpd/awhttpd/urlencode.c 2006-08-12 19:16:59.718750000 +1000 ++++ axTLS/httpd/awhttpd/urlencode.c 2006-11-15 15:09:14.430640700 +1000 @@ -13,7 +13,7 @@ #include diff --git a/samples/c/Makefile b/samples/c/Makefile index 95a3381cf1..c941f781db 100644 --- a/samples/c/Makefile +++ b/samples/c/Makefile @@ -46,7 +46,7 @@ include ../../config/makefile.post ifndef CONFIG_PLATFORM_WIN32 -$(TARGET): $(OBJ) +$(TARGET): $(OBJ) $(LIBS)/libaxtls.a $(LD) $(LDFLAGS) -o $@ $< -L$(LIBS) -laxtls ifndef CONFIG_DEBUG ifndef CONFIG_PLATFORM_SOLARIS diff --git a/ssl/asn1.c b/ssl/asn1.c index 6e67d3c7d4..487d848fb8 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -42,7 +42,7 @@ static const uint8_t sig_oid_prefix[SIG_OID_PREFIX_SIZE] = }; /* CN, O, OU */ -static uint8_t g_dn_types[] = { 3, 10, 11 }; +static const uint8_t g_dn_types[] = { 3, 10, 11 }; static int get_asn1_length(const uint8_t *buf, int *offset) { @@ -152,8 +152,7 @@ int asn1_get_private_key(const uint8_t *buf, int len, RSA_CTX **rsa_ctx) dQ_len = asn1_get_int(buf, &offset, &dQ); qInv_len = asn1_get_int(buf, &offset, &qInv); - if (p_len <= 0 || q_len <= 0 || dP_len <= 0 || - dQ_len <= 0 || qInv_len <= 0) + if (p_len <= 0 || q_len <= 0 || dP_len <= 0 || dQ_len <= 0 || qInv_len <= 0) return X509_INVALID_PRIV_KEY; RSA_priv_key_new(rsa_ctx, @@ -191,6 +190,7 @@ static int asn1_get_utc_time(const uint8_t *buf, int *offset, time_t *t) memset(&tm, 0, sizeof(struct tm)); tm.tm_year = (buf[t_offset] - '0')*10 + (buf[t_offset+1] - '0'); + if (tm.tm_year <= 50) /* 1951-2050 thing */ { tm.tm_year += 100; @@ -228,8 +228,8 @@ static int asn1_version(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) static int asn1_validity(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) { return (asn1_next_obj(cert, offset, ASN1_SEQUENCE) < 0 || - asn1_get_utc_time(cert, offset, &x509_ctx->not_before) || - asn1_get_utc_time(cert, offset, &x509_ctx->not_after)); + asn1_get_utc_time(cert, offset, &x509_ctx->not_before) || + asn1_get_utc_time(cert, offset, &x509_ctx->not_after)); } /** @@ -259,15 +259,13 @@ static int asn1_get_oid_x520(const uint8_t *buf, int *offset) /** * Obtain an ASN.1 printable string type. */ -static int asn1_get_printable_str(const uint8_t *buf, - int *offset, char **str) +static int asn1_get_printable_str(const uint8_t *buf, int *offset, char **str) { int len = X509_NOT_OK; /* some certs have this awful crud in them for some reason */ if (buf[*offset] != ASN1_PRINTABLE_STR && - buf[*offset] != ASN1_TELETEX_STR && - buf[*offset] != ASN1_IA5_STR) + buf[*offset] != ASN1_TELETEX_STR && buf[*offset] != ASN1_IA5_STR) goto end_pnt_str; (*offset)++; @@ -334,8 +332,7 @@ static int asn1_name(const uint8_t *cert, int *offset, char *dn[]) /** * Read the modulus and public exponent of a certificate. */ -static int asn1_public_key(const uint8_t *cert, int *offset, - X509_CTX *x509_ctx) +static int asn1_public_key(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) { int ret = X509_NOT_OK, mod_len, pub_len; uint8_t *modulus, *pub_exp; @@ -353,8 +350,7 @@ static int asn1_public_key(const uint8_t *cert, int *offset, mod_len = asn1_get_int(cert, offset, &modulus); pub_len = asn1_get_int(cert, offset, &pub_exp); - RSA_pub_key_new(&x509_ctx->rsa_ctx, - modulus, mod_len, pub_exp, pub_len); + RSA_pub_key_new(&x509_ctx->rsa_ctx, modulus, mod_len, pub_exp, pub_len); free(modulus); free(pub_exp); diff --git a/ssl/p12.c b/ssl/p12.c index 2189509989..a74bdbf287 100644 --- a/ssl/p12.c +++ b/ssl/p12.c @@ -57,9 +57,14 @@ #ifdef CONFIG_SSL_USE_PKCS12 #define BLOCK_SIZE 64 - -static int p8_decrypt(const char *password, const uint8_t *salt, int iter, - uint8_t *priv_key, int priv_key_len); +#define PKCS12_KEY_ID 1 +#define PKCS12_IV_ID 2 +#define PKCS12_MAC_ID 3 + +static char *make_uni_pass(const char *password, int *uni_pass_len); +static int p8_decrypt(const char *uni_pass, int uni_pass_len, + const uint8_t *salt, int iter, + uint8_t *priv_key, int priv_key_len, int id); static int p8_add_key(SSLCTX *ssl_ctx, uint8_t *priv_key); static int get_pbe_params(uint8_t *buf, int *offset, const uint8_t **salt, int *iterations); @@ -76,6 +81,8 @@ int pkcs8_decode(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password) uint8_t *version = NULL; const uint8_t *salt; uint8_t *priv_key; + int uni_pass_len; + char *uni_pass = make_uni_pass(password, &uni_pass_len); if (asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0) { @@ -100,11 +107,13 @@ int pkcs8_decode(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password) priv_key = &buf[offset]; - p8_decrypt(password, salt, iterations, priv_key, len); + p8_decrypt(uni_pass, uni_pass_len, salt, + iterations, priv_key, len, PKCS12_KEY_ID); ret = p8_add_key(ssl_ctx, priv_key); error: free(version); + free(uni_pass); return ret; } @@ -132,20 +141,12 @@ static int p8_add_key(SSLCTX *ssl_ctx, uint8_t *priv_key) } /* - * Decrypt a pkcs8 block. + * Create the unicode password */ -static int p8_decrypt(const char *password, const uint8_t *salt, int iter, - uint8_t *priv_key, int priv_key_len) +static char *make_uni_pass(const char *password, int *uni_pass_len) { - uint8_t p[BLOCK_SIZE*2]; - uint8_t d[BLOCK_SIZE]; - uint8_t Ai[SHA1_SIZE]; - SHA1_CTX sha_ctx; - RC4_CTX rc4_ctx; - uint8_t *uni_pass = NULL; - int i; - int uni_pass_len = 0; - int id = 1; /* key id */ + int pass_len = 0, i; + char *uni_pass; if (password == NULL) { @@ -157,12 +158,29 @@ static int p8_decrypt(const char *password, const uint8_t *salt, int iter, /* modify the password into a unicode version */ for (i = 0; i < (int)strlen(password); i++) { - uni_pass[uni_pass_len++] = 0; - uni_pass[uni_pass_len++] = password[i]; + uni_pass[pass_len++] = 0; + uni_pass[pass_len++] = password[i]; } - uni_pass[uni_pass_len++] = 0; /* null terminate */ - uni_pass[uni_pass_len++] = 0; + uni_pass[pass_len++] = 0; /* null terminate */ + uni_pass[pass_len++] = 0; + *uni_pass_len = pass_len; + return uni_pass; +} + +/* + * Decrypt a pkcs8 block. + */ +static int p8_decrypt(const char *uni_pass, int uni_pass_len, + const uint8_t *salt, int iter, + uint8_t *priv_key, int priv_key_len, int id) +{ + uint8_t p[BLOCK_SIZE*2]; + uint8_t d[BLOCK_SIZE]; + uint8_t Ai[SHA1_SIZE]; + SHA1_CTX sha_ctx; + RC4_CTX rc4_ctx; + int i; for (i = 0; i < BLOCK_SIZE; i++) { @@ -185,9 +203,14 @@ static int p8_decrypt(const char *password, const uint8_t *salt, int iter, } /* do the decryption */ - RC4_setup(&rc4_ctx, Ai, 16); - RC4_crypt(&rc4_ctx, priv_key, priv_key, priv_key_len); - free(uni_pass); + if (id == PKCS12_KEY_ID) + { + RC4_setup(&rc4_ctx, Ai, 16); + RC4_crypt(&rc4_ctx, priv_key, priv_key, priv_key_len); + } + else /* MAC */ + memcpy(priv_key, Ai, SHA1_SIZE); + return 0; } @@ -198,13 +221,16 @@ static int p8_decrypt(const char *password, const uint8_t *salt, int iter, int pkcs12_decode(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password) { uint8_t *buf = ssl_obj->buf; - int all_ok = 0, len, iterations, key_offset, offset = 0; + int all_ok = 0, len, iterations, auth_safes_start, + auth_safes_end, auth_safes_len, key_offset, offset = 0; int all_certs = 0; - uint8_t *version = NULL, *cert, *mac; - SHA1_CTX sha_ctx; - char sha[SHA1_SIZE]; + uint8_t *version = NULL, *auth_safes = NULL, *cert, *orig_mac; + char key[SHA1_SIZE]; + char mac[SHA1_SIZE]; const uint8_t *salt; - int ret; + int uni_pass_len, ret; + int error_code = SSL_ERROR_NOT_SUPPORTED; + char *uni_pass = make_uni_pass(password, &uni_pass_len); static const uint8_t pkcs_data[] = /* pkc7 data */ { 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x01 }; static const uint8_t pkcs_encrypted[] = /* pkc7 encrypted */ @@ -221,14 +247,10 @@ int pkcs12_decode(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password) } if (asn1_get_int(buf, &offset, &version) < 0 || *version != 3) + { + error_code = SSL_ERROR_INVALID_VERSION; goto error; - - /* work out the MAC of this bit */ - key_offset = offset; - asn1_skip_obj(buf, &key_offset, ASN1_SEQUENCE); - SHA1Init(&sha_ctx); - SHA1Update(&sha_ctx, &buf[offset], key_offset-offset); - SHA1Final(&sha_ctx, sha); + } /* remove all the boring pcks7 bits */ if (asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0 || @@ -240,8 +262,18 @@ int pkcs12_decode(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password) offset += len; if (asn1_next_obj(buf, &offset, ASN1_EXPLICIT_TAG) < 0 || - asn1_next_obj(buf, &offset, ASN1_OCTET_STRING) < 0 || - asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0 || + asn1_next_obj(buf, &offset, ASN1_OCTET_STRING) < 0) + goto error; + + /* work out the MAC start/end points (done on AuthSafes) */ + auth_safes_start = offset; + auth_safes_end = offset; + asn1_skip_obj(buf, &auth_safes_end, ASN1_SEQUENCE); + auth_safes_len = auth_safes_end - auth_safes_start; + auth_safes = malloc(auth_safes_len); + memcpy(auth_safes, &buf[auth_safes_start], auth_safes_len); + + if (asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0 || asn1_next_obj(buf, &offset, ASN1_SEQUENCE) < 0 || (len = asn1_next_obj(buf, &offset, ASN1_OID)) < 0 || (len != sizeof(pkcs_encrypted) || @@ -268,7 +300,8 @@ int pkcs12_decode(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password) /* decrypt the certificate */ cert = &buf[offset]; - if ((ret = p8_decrypt(password, salt, iterations, cert, len)) < 0) + if ((ret = p8_decrypt(uni_pass, uni_pass_len, salt, iterations, cert, + len, PKCS12_KEY_ID)) < 0) goto error; offset += len; @@ -327,7 +360,8 @@ int pkcs12_decode(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password) /* decrypt the private key */ cert = &buf[offset]; - if ((ret = p8_decrypt(password, salt, iterations, cert, len)) < 0) + if ((ret = p8_decrypt(uni_pass, uni_pass_len, salt, iterations, cert, + len, PKCS12_KEY_ID)) < 0) goto error; offset += len; @@ -348,28 +382,34 @@ int pkcs12_decode(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password) len != SHA1_SIZE) goto error; - mac = &buf[offset]; + orig_mac = &buf[offset]; offset += len; /* get the salt */ - if ((len = asn1_next_obj(buf, &offset, ASN1_OCTET_STRING)) < 0 || - len != 8) + if ((len = asn1_next_obj(buf, &offset, ASN1_OCTET_STRING)) < 0 || len != 8) goto error; salt = &buf[offset]; /* work out what the mac should be */ - if ((ret = p8_decrypt(password, salt, iterations, mac, SHA1_SIZE)) < 0) + if ((ret = p8_decrypt(uni_pass, uni_pass_len, salt, iterations, + key, SHA1_SIZE, PKCS12_MAC_ID)) < 0) goto error; - /* TODO: actually memcmp the MAC - there is something wrong at the moment */ - /* print_blob("MAC orig", sha, SHA1_SIZE); */ - /* print_blob("MAC calc", mac, SHA1_SIZE); */ + hmac_sha1(auth_safes, auth_safes_len, key, SHA1_SIZE, mac); + + if (memcmp(mac, orig_mac, SHA1_SIZE)) + { + error_code = SSL_ERROR_INVALID_HMAC; + goto error; + } all_ok = 1; error: free(version); - return all_ok ? SSL_OK : SSL_ERROR_NOT_SUPPORTED; + free(uni_pass); + free(auth_safes); + return all_ok ? SSL_OK : error_code; } /* diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 21cb63c13d..c1ac2f1fcf 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1083,31 +1083,31 @@ int SSL_server_tests(void) TTY_FLUSH(); /* - * PKCS 8 key (encrypted) + * PKCS#8 key (encrypted) */ - if ((ret = SSL_server_test(NULL, "pkcs 8 encrypted", "-cipher RC4-SHA", - DEFAULT_CERT, NULL, "../ssl/test/axTLS.encrypted.p8", NULL, "abcd", - DEFAULT_SVR_OPTION))) + if ((ret = SSL_server_test(NULL, "pkcs#8 encrypted", "-cipher RC4-SHA", + DEFAULT_CERT, NULL, "../ssl/test/axTLS.encrypted.p8", + NULL, "abcd", DEFAULT_SVR_OPTION))) goto cleanup; /* - * PKCS 8 key (unencrypted) + * PKCS#8 key (unencrypted) */ - if ((ret = SSL_server_test(NULL, "pkcs 8 unencrypted", "-cipher RC4-SHA", - DEFAULT_CERT, NULL, "../ssl/test/axTLS.unencrypted.p8", NULL, NULL, - DEFAULT_SVR_OPTION))) + if ((ret = SSL_server_test(NULL, "pkcs#8 unencrypted", "-cipher RC4-SHA", + DEFAULT_CERT, NULL, "../ssl/test/axTLS.unencrypted.p8", + NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; /* - * PKCS 12 key/certificate + * PKCS#12 key/certificate */ - if ((ret = SSL_server_test(NULL, "pkcs 12 no CA", "-cipher RC4-SHA", - DEFAULT_CERT, NULL, "../ssl/test/axTLS.withoutCA.p12", + if ((ret = SSL_server_test(NULL, "pkcs#12 with CA", "-cipher RC4-SHA", + NULL, NULL, "../ssl/test/axTLS.withCA.p12", NULL, "abcd", DEFAULT_SVR_OPTION))) goto cleanup; - if ((ret = SSL_server_test(NULL, "pkcs 12 with CA", "-cipher RC4-SHA", - NULL, NULL, "../ssl/test/axTLS.withCA.p12", + if ((ret = SSL_server_test(NULL, "pkcs#12 no CA", "-cipher RC4-SHA", + DEFAULT_CERT, NULL, "../ssl/test/axTLS.withoutCA.p12", NULL, "abcd", DEFAULT_SVR_OPTION))) goto cleanup; From 3c59f849dd5d769da13b1479333194064a54c16e Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 27 Nov 2006 05:52:33 +0000 Subject: [PATCH 033/301] Fixed issue which stopped Montgomery & Classical reduction from being used git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@41 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/bigint.c | 13 +++++++------ ssl/bigint.h | 4 ---- ssl/test/Makefile | 4 ++-- ssl/test/ssltest.c | 24 ++++++++++++++++++++++++ 4 files changed, 33 insertions(+), 12 deletions(-) diff --git a/ssl/bigint.c b/ssl/bigint.c index 8d52184a81..41446dde6f 100644 --- a/ssl/bigint.c +++ b/ssl/bigint.c @@ -734,8 +734,8 @@ void bi_set_mod(BI_CTX *ctx, bigint *bim, int mod_offset) #if defined(CONFIG_BIGINT_MONTGOMERY) /* set montgomery variables */ - R = comp_left_shift(bi_clone(ctx, ctx->bi_radix), k-1); /* R */ - R2 = comp_left_shift(bi_clone(ctx, ctx->bi_radix), k*2-1); /* R^2 */ + R = comp_left_shift(bi_clone(ctx, ctx->bi_radix), k-1); /* R */ + R2 = comp_left_shift(bi_clone(ctx, ctx->bi_radix), k*2-1); /* R^2 */ ctx->bi_RR_mod_m[mod_offset] = bi_mod(ctx, R2); /* R^2 mod m */ ctx->bi_R_mod_m[mod_offset] = bi_mod(ctx, R); /* R mod m */ @@ -743,10 +743,11 @@ void bi_set_mod(BI_CTX *ctx, bigint *bim, int mod_offset) bi_permanent(ctx->bi_R_mod_m[mod_offset]); ctx->N0_dash[mod_offset] = modular_inverse(ctx->bi_mod[mod_offset]); + #elif defined (CONFIG_BIGINT_BARRETT) ctx->bi_mu[mod_offset] = bi_divide(ctx, comp_left_shift( - bi_clone(ctx, ctx->bi_radix), k*2-1), ctx->bi_mod[mod_offset], 0); + bi_clone(ctx, ctx->bi_radix), k*2-1), ctx->bi_mod[mod_offset], 0); bi_permanent(ctx->bi_mu[mod_offset]); #endif } @@ -1383,10 +1384,10 @@ bigint *bi_mod_power(BI_CTX *ctx, bigint *bi, bigint *biexp) if (!ctx->use_classical) { /* preconvert */ - bi = bi_residue(ctx, - bi_multiply(ctx, bi, ctx->bi_RR_mod_m[mod_offset])); /* x' */ + bi = bi_mont(ctx, + bi_multiply(ctx, bi, ctx->bi_RR_mod_m[mod_offset])); /* x' */ bi_free(ctx, biR); - biR = ctx->bi_R_mod_m[mod_offset]; + biR = ctx->bi_R_mod_m[mod_offset]; /* A */ } #endif diff --git a/ssl/bigint.h b/ssl/bigint.h index 2291f5c878..db3d112b9f 100644 --- a/ssl/bigint.h +++ b/ssl/bigint.h @@ -29,10 +29,6 @@ #define CONFIG_SSL_CERT_VERIFICATION #endif -#if !defined(CONFIG_BIGINT_MONTGOMERY) || !defined(CONFIG_BIGINT_BARRETT) -#define CONFIG_BIGINT_CLASSICAL 1 -#endif - #include "os_port.h" #include "bigint_impl.h" diff --git a/ssl/test/Makefile b/ssl/test/Makefile index 23fcaf3bb6..6420503b9f 100644 --- a/ssl/test/Makefile +++ b/ssl/test/Makefile @@ -35,10 +35,10 @@ ssltesting: ../../$(STAGE)/ssltest LIBS=../../$(STAGE) CFLAGS += -I../../ssl -I../../config -../../$(STAGE)/perf_bigint: perf_bigint.o +../../$(STAGE)/perf_bigint: perf_bigint.o $(LIBS)/libaxtls.a $(CC) $(LDFLAGS) -o $@ $^ -L $(LIBS) -laxtls -../../$(STAGE)/ssltest: ssltest.o +../../$(STAGE)/ssltest: ssltest.o $(LIBS)/libaxtls.a $(CC) $(LDFLAGS) -o $@ $^ -lpthread -L $(LIBS) -laxtls else performance: ../../$(STAGE)/perf_bigint.exe diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index c1ac2f1fcf..688e203f07 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1650,37 +1650,61 @@ int main(int argc, char *argv[]) bi_ctx = bi_initialize(); if (AES_test(bi_ctx)) + { + printf("AES tests failed\n"); goto cleanup; + } TTY_FLUSH(); if (RC4_test(bi_ctx)) + { + printf("RC4 tests failed\n"); goto cleanup; + } TTY_FLUSH(); if (MD5_test(bi_ctx)) + { + printf("MD5 tests failed\n"); goto cleanup; + } TTY_FLUSH(); if (SHA1_test(bi_ctx)) + { + printf("SHA1 tests failed\n"); goto cleanup; + } TTY_FLUSH(); if (HMAC_test(bi_ctx)) + { + printf("HMAC tests failed\n"); goto cleanup; + } TTY_FLUSH(); if (BIGINT_test(bi_ctx)) + { + printf("BigInt tests failed!\n"); goto cleanup; + } TTY_FLUSH(); bi_terminate(bi_ctx); if (RSA_test()) + { + printf("RSA tests failed\n"); goto cleanup; + } TTY_FLUSH(); if (cert_tests()) + { + printf("CERT tests failed\n"); goto cleanup; + } TTY_FLUSH(); system("sh ../ssl/test/killopenssl.sh"); From d521a68821d04e3464f9fffa5f90b43db6d8382c Mon Sep 17 00:00:00 2001 From: cameronrich Date: Tue, 28 Nov 2006 02:05:07 +0000 Subject: [PATCH 034/301] Added my name to the copyright git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@42 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 2 +- bindings/Makefile | 2 +- bindings/csharp/Makefile | 2 +- bindings/csharp/axTLS.cs | 2 +- bindings/generate_SWIG_interface.pl | 2 +- bindings/generate_interface.pl | 2 +- bindings/java/Makefile | 2 +- bindings/java/SSL.java | 2 +- bindings/java/SSLCTX.java | 2 +- bindings/java/SSLClient.java | 2 +- bindings/java/SSLReadHolder.java | 2 +- bindings/java/SSLServer.java | 2 +- bindings/java/SSLUtil.java | 2 +- bindings/perl/Makefile | 2 +- bindings/vbnet/Makefile | 2 +- bindings/vbnet/axTLSvb.vb | 2 +- config/makefile.conf | 2 +- config/makefile.dotnet.conf | 2 +- config/makefile.java.conf | 2 +- docsrc/Makefile | 2 +- httpd/Makefile | 2 +- samples/Makefile | 2 +- samples/c/Makefile | 2 +- samples/c/axssl.c | 4 +--- samples/csharp/Makefile | 2 +- samples/csharp/axssl.cs | 4 +--- samples/java/Makefile | 2 +- samples/java/axssl.java | 4 +--- samples/perl/Makefile | 2 +- samples/perl/axssl.pl | 4 +--- samples/vbnet/Makefile | 2 +- samples/vbnet/axssl.vb | 4 +--- ssl/Makefile | 2 +- ssl/aes.c | 2 +- ssl/asn1.c | 2 +- ssl/bigint.c | 24 ++++++++++++------------ ssl/bigint.h | 2 +- ssl/bigint_impl.h | 2 +- ssl/crypto.h | 2 +- ssl/crypto_misc.c | 2 +- ssl/hmac.c | 2 +- ssl/loader.c | 2 +- ssl/md5.c | 2 +- ssl/os_port.c | 2 +- ssl/os_port.h | 2 +- ssl/p12.c | 2 +- ssl/rc4.c | 2 +- ssl/rsa.c | 10 ++-------- ssl/sha1.c | 2 +- ssl/ssl.h | 2 +- ssl/test/Makefile | 2 +- ssl/test/make_certs.sh | 2 +- ssl/test/perf_bigint.c | 4 +--- ssl/test/ssltest.c | 4 +--- ssl/test/test_axssl.sh | 2 +- ssl/tls1.c | 2 +- ssl/tls1.h | 2 +- ssl/tls1_clnt.c | 2 +- ssl/tls1_svr.c | 2 +- 59 files changed, 71 insertions(+), 91 deletions(-) diff --git a/Makefile b/Makefile index f1e1abb985..1ebdcfc012 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This license is free software; you can redistribute it and/or modify # it under the terms of the GNU Lesser General Public License as published by diff --git a/bindings/Makefile b/bindings/Makefile index 8f1fc88596..322b37080a 100644 --- a/bindings/Makefile +++ b/bindings/Makefile @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This library is free software; you can redistribute it and/or modify # it under the terms of the GNU Lesser General Public License as published by diff --git a/bindings/csharp/Makefile b/bindings/csharp/Makefile index d7fbdb619f..87073f5e43 100644 --- a/bindings/csharp/Makefile +++ b/bindings/csharp/Makefile @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by diff --git a/bindings/csharp/axTLS.cs b/bindings/csharp/axTLS.cs index 4622dc5535..5239cd688c 100644 --- a/bindings/csharp/axTLS.cs +++ b/bindings/csharp/axTLS.cs @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/bindings/generate_SWIG_interface.pl b/bindings/generate_SWIG_interface.pl index c4a98ffcef..dea277e6ec 100755 --- a/bindings/generate_SWIG_interface.pl +++ b/bindings/generate_SWIG_interface.pl @@ -1,7 +1,7 @@ #!/usr/bin/perl # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This library is free software; you can redistribute it and/or modify # it under the terms of the GNU Lesser General Public License as published by diff --git a/bindings/generate_interface.pl b/bindings/generate_interface.pl index 067dead21b..4f0fc25fad 100755 --- a/bindings/generate_interface.pl +++ b/bindings/generate_interface.pl @@ -1,7 +1,7 @@ #!/usr/bin/perl -w # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This library is free software; you can redistribute it and/or modify # it under the terms of the GNU Lesser General Public License as published by diff --git a/bindings/java/Makefile b/bindings/java/Makefile index 7e69aef521..a1933b92fc 100644 --- a/bindings/java/Makefile +++ b/bindings/java/Makefile @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by diff --git a/bindings/java/SSL.java b/bindings/java/SSL.java index 9d64206300..53ddd95a25 100644 --- a/bindings/java/SSL.java +++ b/bindings/java/SSL.java @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/bindings/java/SSLCTX.java b/bindings/java/SSLCTX.java index dfd08ec950..34bd9e48c1 100644 --- a/bindings/java/SSLCTX.java +++ b/bindings/java/SSLCTX.java @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/bindings/java/SSLClient.java b/bindings/java/SSLClient.java index ef624d60d0..02ad38c7d3 100644 --- a/bindings/java/SSLClient.java +++ b/bindings/java/SSLClient.java @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/bindings/java/SSLReadHolder.java b/bindings/java/SSLReadHolder.java index 0749ab3e85..e51e0a593d 100644 --- a/bindings/java/SSLReadHolder.java +++ b/bindings/java/SSLReadHolder.java @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/bindings/java/SSLServer.java b/bindings/java/SSLServer.java index 6f4cf00e8b..7aa7fc09b5 100644 --- a/bindings/java/SSLServer.java +++ b/bindings/java/SSLServer.java @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/bindings/java/SSLUtil.java b/bindings/java/SSLUtil.java index 26451b20a0..d5b6ba9f23 100644 --- a/bindings/java/SSLUtil.java +++ b/bindings/java/SSLUtil.java @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/bindings/perl/Makefile b/bindings/perl/Makefile index b1943a4764..e04bd3c7d2 100644 --- a/bindings/perl/Makefile +++ b/bindings/perl/Makefile @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by diff --git a/bindings/vbnet/Makefile b/bindings/vbnet/Makefile index 5c7a36d6a3..bcd6cae4d2 100644 --- a/bindings/vbnet/Makefile +++ b/bindings/vbnet/Makefile @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by diff --git a/bindings/vbnet/axTLSvb.vb b/bindings/vbnet/axTLSvb.vb index 7f08195258..c07258df43 100644 --- a/bindings/vbnet/axTLSvb.vb +++ b/bindings/vbnet/axTLSvb.vb @@ -1,5 +1,5 @@ ' -' Copyright(C) 2006 +' Copyright(C) 2006 Cameron Rich ' ' This program is free software you can redistribute it and/or modify ' it under the terms of the GNU General Public License as published by diff --git a/config/makefile.conf b/config/makefile.conf index 713d00c59f..41e66702f5 100644 --- a/config/makefile.conf +++ b/config/makefile.conf @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This library is free software; you can redistribute it and/or modify # it under the terms of the GNU Lesser General Public License as published by diff --git a/config/makefile.dotnet.conf b/config/makefile.dotnet.conf index 23baf70c5b..110e27d3bb 100644 --- a/config/makefile.dotnet.conf +++ b/config/makefile.dotnet.conf @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This library is free software; you can redistribute it and/or modify # it under the terms of the GNU Lesser General Public License as published by diff --git a/config/makefile.java.conf b/config/makefile.java.conf index 59bde86139..2194ef44bd 100644 --- a/config/makefile.java.conf +++ b/config/makefile.java.conf @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This library is free software; you can redistribute it and/or modify # it under the terms of the GNU Lesser General Public License as published by diff --git a/docsrc/Makefile b/docsrc/Makefile index a9a1e502c5..136264b08d 100644 --- a/docsrc/Makefile +++ b/docsrc/Makefile @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This library is free software; you can redistribute it and/or modify # it under the terms of the GNU Lesser General Public License as published by diff --git a/httpd/Makefile b/httpd/Makefile index 07261a52cd..22b8d0ff23 100644 --- a/httpd/Makefile +++ b/httpd/Makefile @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by diff --git a/samples/Makefile b/samples/Makefile index 4a7acd7861..fbb31149a8 100644 --- a/samples/Makefile +++ b/samples/Makefile @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by diff --git a/samples/c/Makefile b/samples/c/Makefile index c941f781db..0ab81e70f2 100644 --- a/samples/c/Makefile +++ b/samples/c/Makefile @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by diff --git a/samples/c/axssl.c b/samples/c/axssl.c index 955340ca82..7575c263bb 100644 --- a/samples/c/axssl.c +++ b/samples/c/axssl.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -17,8 +17,6 @@ */ /** - * @file axssl.c - * * Demonstrate the use of the axTLS library in C with a set of * command-line parameters similar to openssl. In fact, openssl clients * should be able to communicate with axTLS servers and visa-versa. diff --git a/samples/csharp/Makefile b/samples/csharp/Makefile index d30b37c263..267a49d15c 100644 --- a/samples/csharp/Makefile +++ b/samples/csharp/Makefile @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by diff --git a/samples/csharp/axssl.cs b/samples/csharp/axssl.cs index ca8281d654..eb80146533 100644 --- a/samples/csharp/axssl.cs +++ b/samples/csharp/axssl.cs @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -17,8 +17,6 @@ */ /** - * axssl.cs - * * Demonstrate the use of the axTLS library in C# with a set of * command-line parameters similar to openssl. In fact, openssl clients * should be able to communicate with axTLS servers and visa-versa. diff --git a/samples/java/Makefile b/samples/java/Makefile index e8b8351023..eca097ec70 100644 --- a/samples/java/Makefile +++ b/samples/java/Makefile @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by diff --git a/samples/java/axssl.java b/samples/java/axssl.java index b193725ef0..3d138c6cf5 100644 --- a/samples/java/axssl.java +++ b/samples/java/axssl.java @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -17,8 +17,6 @@ */ /* - * axssl.java - * * Demonstrate the use of the axTLS library in Java with a set of * command-line parameters similar to openssl. In fact, openssl clients * should be able to communicate with axTLS servers and visa-versa. * diff --git a/samples/perl/Makefile b/samples/perl/Makefile index 0599196c40..0ad96070fd 100644 --- a/samples/perl/Makefile +++ b/samples/perl/Makefile @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by diff --git a/samples/perl/axssl.pl b/samples/perl/axssl.pl index ce0266b02b..562d4747c2 100755 --- a/samples/perl/axssl.pl +++ b/samples/perl/axssl.pl @@ -1,6 +1,6 @@ #!/usr/bin/perl -w # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by @@ -17,8 +17,6 @@ # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # -# -# axssl.pl # # Demonstrate the use of the axTLS library in Perl with a set of # command-line parameters similar to openssl. In fact, openssl clients diff --git a/samples/vbnet/Makefile b/samples/vbnet/Makefile index 9f9adc66c1..7349e67cc9 100644 --- a/samples/vbnet/Makefile +++ b/samples/vbnet/Makefile @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by diff --git a/samples/vbnet/axssl.vb b/samples/vbnet/axssl.vb index 4eb210a3f9..ce64db5e83 100644 --- a/samples/vbnet/axssl.vb +++ b/samples/vbnet/axssl.vb @@ -1,5 +1,5 @@ ' -' Copyright(C) 2006 +' Copyright(C) 2006 Cameron Rich ' ' This program is free software you can redistribute it and/or modify ' it under the terms of the GNU General Public License as published by @@ -16,8 +16,6 @@ ' Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA ' -' -' @file axssl.vb ' ' Demonstrate the use of the axTLS library in VB.NET with a set of ' command-line parameters similar to openssl. In fact, openssl clients diff --git a/ssl/Makefile b/ssl/Makefile index 14d50ac93a..61864a5b72 100644 --- a/ssl/Makefile +++ b/ssl/Makefile @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This library is free software; you can redistribute it and/or modify # it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/aes.c b/ssl/aes.c index 74e8b666ef..8aefbf4f6e 100644 --- a/ssl/aes.c +++ b/ssl/aes.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/asn1.c b/ssl/asn1.c index 487d848fb8..44d2adf09c 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/bigint.c b/ssl/bigint.c index 41446dde6f..24e6a53f86 100644 --- a/ssl/bigint.c +++ b/ssl/bigint.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by @@ -423,7 +423,7 @@ bigint *bi_divide(BI_CTX *ctx, bigint *u, bigint *v, int is_mod) if (v->size > 1 && V2) { - /* we are implementing the following + /* we are implementing the following: if (V2*q_dash > (((U(0)*COMP_RADIX + U(1) - q_dash*V1)*COMP_RADIX) + U(2))) ... */ comp inner = (comp)((long_comp)COMP_RADIX*U(0) + U(1) - @@ -449,6 +449,7 @@ bigint *bi_divide(BI_CTX *ctx, bigint *u, bigint *v, int is_mod) { Q(j)--; tmp_u = bi_add(ctx, tmp_u, bi_copy(v)); + /* lop off the carry */ tmp_u->size--; v->size--; @@ -478,7 +479,7 @@ bigint *bi_divide(BI_CTX *ctx, bigint *u, bigint *v, int is_mod) } } -/** +/* * Perform an integer divide on a bigint. */ static bigint *bi_int_divide(BI_CTX *ctx, bigint *biR, comp denom) @@ -715,7 +716,7 @@ void bi_export(BI_CTX *ctx, bigint *x, uint8_t *data, int size) * @param ctx [in] The bigint session context. * @param bim [in] The bigint modulus that will be used. * @param mod_offset [in] There are three moduluii that can be stored - the - * standard modulus, and it's two primes p and q. This offset refers to which + * standard modulus, and its two primes p and q. This offset refers to which * modulus we are referring to. * @see bi_free_mod(), bi_mod_power(). */ @@ -898,7 +899,7 @@ bigint *bi_multiply(BI_CTX *ctx, bigint *bia, bigint *bib) #ifdef CONFIG_BIGINT_SQUARE /* - * Perform the actual square operion. It takes into account overflow + * Perform the actual square operion. It takes into account overflow. */ static bigint *regular_square(BI_CTX *ctx, bigint *bi) { @@ -940,6 +941,7 @@ static bigint *regular_square(BI_CTX *ctx, bigint *bi) } w[i+t] += carry; + if (u) { w[i+t+1] = 1; /* add carry */ @@ -1018,7 +1020,7 @@ int bi_compare(bigint *bia, bigint *bib) return r; } -/** +/* * Allocate and zero more components. Does not consume bi. */ static void more_comps(bigint *bi, int n) @@ -1051,6 +1053,7 @@ static bigint *alloc(BI_CTX *ctx, int size) biR = ctx->free_list; ctx->free_list = biR->next; ctx->free_count--; + if (biR->refs != 0) { #ifdef CONFIG_SSL_FULL_MODE @@ -1338,8 +1341,7 @@ bigint *bi_barrett(BI_CTX *ctx, bigint *bi) */ static void precompute_slide_window(BI_CTX *ctx, int window, bigint *g1) { - int k = 1; - int i; + int k = 1, i; bigint *g2; for (i = 0; i < window-1; i++) /* compute 2^(window-1) */ @@ -1354,8 +1356,7 @@ static void precompute_slide_window(BI_CTX *ctx, int window, bigint *g1) for (i = 1; i < k; i++) { - ctx->g[i] = bi_residue(ctx, bi_multiply(ctx, ctx->g[i-1], - bi_copy(g2))); + ctx->g[i] = bi_residue(ctx, bi_multiply(ctx, ctx->g[i-1], bi_copy(g2))); bi_permanent(ctx->g[i]); } @@ -1442,8 +1443,7 @@ bigint *bi_mod_power(BI_CTX *ctx, bigint *bi, bigint *biexp) } part_exp = (part_exp-1)/2; /* adjust for array */ - biR = bi_residue(ctx, - bi_multiply(ctx, biR, ctx->g[part_exp])); + biR = bi_residue(ctx, bi_multiply(ctx, biR, ctx->g[part_exp])); i = l-1; } else /* square it */ diff --git a/ssl/bigint.h b/ssl/bigint.h index db3d112b9f..e233d79804 100644 --- a/ssl/bigint.h +++ b/ssl/bigint.h @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/bigint_impl.h b/ssl/bigint_impl.h index 9d48182866..156e940547 100644 --- a/ssl/bigint_impl.h +++ b/ssl/bigint_impl.h @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/crypto.h b/ssl/crypto.h index dae5a5f3a3..f6277adcce 100644 --- a/ssl/crypto.h +++ b/ssl/crypto.h @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/crypto_misc.c b/ssl/crypto_misc.c index edfe5bb7ca..fa3f09390c 100644 --- a/ssl/crypto_misc.c +++ b/ssl/crypto_misc.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/hmac.c b/ssl/hmac.c index cafb2642a4..aaa499dd2c 100644 --- a/ssl/hmac.c +++ b/ssl/hmac.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/loader.c b/ssl/loader.c index 400847b856..c8b74f3b2f 100644 --- a/ssl/loader.c +++ b/ssl/loader.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/md5.c b/ssl/md5.c index c682e11ea6..f2a2ded676 100644 --- a/ssl/md5.c +++ b/ssl/md5.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/os_port.c b/ssl/os_port.c index 19932293ea..56e6e3a06a 100644 --- a/ssl/os_port.c +++ b/ssl/os_port.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/os_port.h b/ssl/os_port.h index b8354cb6ce..fd9f83929f 100644 --- a/ssl/os_port.h +++ b/ssl/os_port.h @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/p12.c b/ssl/p12.c index a74bdbf287..4f37d08bc0 100644 --- a/ssl/p12.c +++ b/ssl/p12.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/rc4.c b/ssl/rc4.c index acb5f14f2f..661d027c98 100644 --- a/ssl/rc4.c +++ b/ssl/rc4.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/rsa.c b/ssl/rsa.c index f401cf2859..60b36891f2 100644 --- a/ssl/rsa.c +++ b/ssl/rsa.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by @@ -17,8 +17,6 @@ */ /** - * @file rsa.c - * * Implements the RSA public encryption algorithm. Uses the bigint library to * perform its calculations. */ @@ -68,8 +66,6 @@ void RSA_priv_key_new(RSA_CTX **ctx, #endif } -/** - */ void RSA_pub_key_new(RSA_CTX **ctx, const uint8_t *modulus, int mod_len, const uint8_t *pub_exp, int pub_len) @@ -122,7 +118,6 @@ void RSA_free(RSA_CTX *rsa_ctx) } /** - * @fn int RSA_decrypt(RSA_CTX *ctx, const uint8_t *in_data, uint8_t *out_data) * @brief Use PKCS1.5 for decryption/verification. * @param ctx [in] The context * @param in_data [in] The data to encrypt (must be < modulus size-11) @@ -145,7 +140,7 @@ int RSA_decrypt(RSA_CTX *ctx, const uint8_t *in_data, uint8_t *out_data, dat_bi = bi_import(ctx->bi_ctx, in_data, byte_size); #ifdef CONFIG_SSL_CERT_VERIFICATION decrypted_bi = is_decryption ? /* decrypt or verify? */ - RSA_private(ctx, dat_bi) : RSA_public(ctx, dat_bi); + RSA_private(ctx, dat_bi) : RSA_public(ctx, dat_bi); #else /* always a decryption */ decrypted_bi = RSA_private(ctx, dat_bi); #endif @@ -183,7 +178,6 @@ int RSA_decrypt(RSA_CTX *ctx, const uint8_t *in_data, uint8_t *out_data, } /** - * @fn bigint *RSA_private(RSA_CTX *c, bigint *bi_msg) * Performs m = c^d mod n */ bigint *RSA_private(RSA_CTX *c, bigint *bi_msg) diff --git a/ssl/sha1.c b/ssl/sha1.c index 1f06732352..80f311b18c 100644 --- a/ssl/sha1.c +++ b/ssl/sha1.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/ssl.h b/ssl/ssl.h index c314cbc8db..6c939c1f2b 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/test/Makefile b/ssl/test/Makefile index 6420503b9f..43c9a6cef8 100644 --- a/ssl/test/Makefile +++ b/ssl/test/Makefile @@ -1,5 +1,5 @@ # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This library is free software; you can redistribute it and/or modify # it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/test/make_certs.sh b/ssl/test/make_certs.sh index f0d609580c..b7a872b98c 100755 --- a/ssl/test/make_certs.sh +++ b/ssl/test/make_certs.sh @@ -1,7 +1,7 @@ #!/bin/sh # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This license is free software; you can redistribute it and/or modify # it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/test/perf_bigint.c b/ssl/test/perf_bigint.c index 4fc77fecbd..74844a5e05 100644 --- a/ssl/test/perf_bigint.c +++ b/ssl/test/perf_bigint.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by @@ -17,8 +17,6 @@ */ /** - * @file perf_bigint.c - * * Some performance testing of bigint. */ diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 688e203f07..7bbb58e0f6 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This license is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by @@ -17,8 +17,6 @@ */ /* - * ssltest.c - * * The testing of the crypto and ssl stuff goes here. Keeps the individual code * modules from being uncluttered with test code. * diff --git a/ssl/test/test_axssl.sh b/ssl/test/test_axssl.sh index 7a7003365e..072ffd0cb6 100755 --- a/ssl/test/test_axssl.sh +++ b/ssl/test/test_axssl.sh @@ -1,7 +1,7 @@ #!/bin/sh # -# Copyright(C) 2006 +# Copyright(C) 2006 Cameron Rich # # This license is free software; you can redistribute it and/or modify # it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/tls1.c b/ssl/tls1.c index e157147a7e..4aa6cbfa96 100644 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/tls1.h b/ssl/tls1.h index 9f611f7750..fc343e512c 100644 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index 45d4bca5c2..da6034be25 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index 9449b8b452..b3505c2663 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -1,5 +1,5 @@ /* - * Copyright(C) 2006 + * Copyright(C) 2006 Cameron Rich * * This library is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by From 3064f8d199d1b1576e13039dd2c85e3cad94f852 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 29 Nov 2006 01:47:26 +0000 Subject: [PATCH 035/301] some typo fixes git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@43 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- bindings/Config.in | 6 +++--- bindings/generate_interface.pl | 2 +- samples/perl/axssl.pl | 12 ++---------- ssl/p12.c | 17 +++++++++-------- ssl/test/axTLS.withoutCA.ya | Bin 1576 -> 0 bytes 5 files changed, 15 insertions(+), 22 deletions(-) delete mode 100644 ssl/test/axTLS.withoutCA.ya diff --git a/bindings/Config.in b/bindings/Config.in index 5af0c0ce54..bf916b13d6 100644 --- a/bindings/Config.in +++ b/bindings/Config.in @@ -10,7 +10,7 @@ config CONFIG_BINDINGS help axTLS supports language bindings in C#, VB.NET, Java and Perl. - Select Y here if you want to build the various bindings. + Select Y here if you want to build the various language bindings. config CONFIG_CSHARP_BINDINGS bool "Create C# bindings" @@ -78,8 +78,8 @@ config CONFIG_PERL_CORE string "Location of Perl CORE" default "c:\\perl\\lib\\CORE" help: - I'm testing with: - "http://www.activestate.com/Products/ActivePerl" at the moment. + works with ActiveState + "http://www.activestate.com/Products/ActivePerl" config CONFIG_PERL_LIB string "Name of Perl Library" diff --git a/bindings/generate_interface.pl b/bindings/generate_interface.pl index 4f0fc25fad..fee6eb4c5f 100755 --- a/bindings/generate_interface.pl +++ b/bindings/generate_interface.pl @@ -200,7 +200,7 @@ sub parseFile #=============================================================== -# Determine which module to build from cammand-line options +# Determine which module to build from command-line options use strict; use Getopt::Std; diff --git a/samples/perl/axssl.pl b/samples/perl/axssl.pl index 562d4747c2..e0200ea0b2 100755 --- a/samples/perl/axssl.pl +++ b/samples/perl/axssl.pl @@ -424,11 +424,7 @@ sub do_client $res = axtlsp::ssl_handshake_status($ssl); if ($res != $axtlsp::SSL_OK) { - if (!$quiet) - { - axtlsp::ssl_display_error($res); - } - + axtlsp::ssl_display_error($res) if !$quiet; axtlsp::ssl_free($ssl); exit 1; } @@ -456,11 +452,7 @@ sub do_client $res = axtlsp::ssl_handshake_status($ssl); if ($res != $axtlsp::SSL_OK) { - if (!$quiet) - { - axtlsp::ssl_display_error($res); - } - + axtlsp::ssl_display_error($res) if not $quiet; exit 1; } diff --git a/ssl/p12.c b/ssl/p12.c index 4f37d08bc0..f88594f194 100644 --- a/ssl/p12.c +++ b/ssl/p12.c @@ -268,7 +268,9 @@ int pkcs12_decode(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password) /* work out the MAC start/end points (done on AuthSafes) */ auth_safes_start = offset; auth_safes_end = offset; - asn1_skip_obj(buf, &auth_safes_end, ASN1_SEQUENCE); + if (asn1_skip_obj(buf, &auth_safes_end, ASN1_SEQUENCE) < 0) + goto error; + auth_safes_len = auth_safes_end - auth_safes_start; auth_safes = malloc(auth_safes_len); memcpy(auth_safes, &buf[auth_safes_start], auth_safes_len); @@ -315,9 +317,8 @@ int pkcs12_decode(SSLCTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password) { int cert_offset = key_offset; - asn1_skip_obj(cert, &cert_offset, ASN1_SEQUENCE); - - if (asn1_next_obj(cert, &key_offset, ASN1_SEQUENCE) < 0 || + if (asn1_skip_obj(cert, &cert_offset, ASN1_SEQUENCE) < 0 || + asn1_next_obj(cert, &key_offset, ASN1_SEQUENCE) < 0 || asn1_skip_obj(cert, &key_offset, ASN1_OID) < 0 || asn1_next_obj(cert, &key_offset, ASN1_EXPLICIT_TAG) < 0 || asn1_next_obj(cert, &key_offset, ASN1_SEQUENCE) < 0 || @@ -421,8 +422,9 @@ static int get_pbe_params(uint8_t *buf, int *offset, static const uint8_t pbeSH1RC4[] = /* pbeWithSHAAnd128BitRC4 */ { 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x0c, 0x01, 0x01 }; - int i, len, ret = SSL_NOT_OK; + int i, len; uint8_t *iter = NULL; + int error_code = SSL_ERROR_NOT_SUPPORTED; /* Get the PBE type */ if (asn1_next_obj(buf, offset, ASN1_SEQUENCE) < 0 || @@ -437,7 +439,6 @@ static int get_pbe_params(uint8_t *buf, int *offset, #ifdef CONFIG_SSL_FULL_MODE printf("Error: pkcs8/pkcs12 must use \"PBE-SHA1-RC4-128\"\n"); #endif - ret = SSL_ERROR_NOT_SUPPORTED; goto error; } @@ -462,10 +463,10 @@ static int get_pbe_params(uint8_t *buf, int *offset, } free(iter); - ret = SSL_OK; /* got here - we are ok */ + error_code = SSL_OK; /* got here - we are ok */ error: - return ret; + return error_code; } #endif diff --git a/ssl/test/axTLS.withoutCA.ya b/ssl/test/axTLS.withoutCA.ya deleted file mode 100644 index 9e1bd632a2f3b9e584064412f92364fb120cfe70..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1576 zcmY+@c|6k%90%~QKFm2}9Vo{<5szN4=XrXbKfbT;>-G75U*EspUmOLd0tN}-DA12E;k~pYG`<)} z5L8TojzB2T!R@#gM*-jbHG&mWz>Mwa8W;p@xAb2V5Kayz^7jQ%5DbTa2)PYU5o{IT zWr4v$Kq3X~iH*)GB%Pgim!ERFOj$QSunT!1Ud2@Hc2dQxKLZhqBuT-h6@^?~_f#Wp zE4O-^ajUJ*?=w(N|HP(t4J;~F1q;`TrIX^0z3*F{fUO1Vs_6P*?9Awvc^Hkn4R^WM zp+uZ$#+agM)Kc!^j8RsQ@~*O}sL+Je5OW8=^fsmT(z`xjcQ0!pJ7Wv~vL1fBW88MFENX! zTHA(;&e6FBA|lFJ(ACwsCVl@^etkfR$g=SW-psrMC3Qx7D z4Kwq7e5+Msl_z$8OglI0b8iN;)3H>l-;~^skn@H+*hTk^ltp>u)p}_?DKC0$e{$T# z+HmvFY<>|*smJi!{bAyYNuqgh4BfDLj_d*U%>Kznh z3Fc`d-z~zQ8w3%J1YYWpYfE$J(_-gqfIpkb7H z*>)q4gN~+pg)hns3(+}z7DwM_a&KYkXo)wgaMHU*C&kJzU+--$w@J0wkb#iniVmU4 zwmO-|k;Q92q;)ZaK|C5Z*m*CtEgr_3qQt_N?s!Hz`_dv0Eo-I3jy3BpU5IKd$HVz* zy>cHvhCR`e5ETz$2SC5Xe2ToAJCFbVZ2v4j!o+FeOI_%J+w0<8S%LQZb#EsJ9#rV3 z{SMJn<95baDG=`kk1Z<|U`bV$f@`a>s=exE@2q_AD$v0@V4WMZNR1fQ!DUOt=6kM9=rif^`B}X6mVi5d6V&+Vv|#? z&CPlw{&++2#%pXBWNi3bV_9sHY-hf_{5ZntvpI`7)JNWMh9F6opZ4cA*mwMS)z;IJ z6);Nt;<(FG(MIL?NVqKTX85=%20BhInebK;6nzqw2p>K&J&|YMMAGJANg?t z-_+K#6h_EHThXAd0!?cBb&Fex-)WdJ#S?&0RAGv0#J_}wLmBQ0mqKhOmUelk1UPleJ17 z9P1ShrXjWbLss2bRio{E0ciYV_Jkv<{%|fr<&0}vd2caL*l~4E{IV!K!SkYyD+4XR=#?O${%KQv z)@q9zR1WHXn`eA{`c&mH%rlnTbgR-h%0s2XN}YmL&0V3Nkd!~`3!L7-C;$Ke From ada6d5e41bf92324d479091746cc43a50d6b8e60 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 30 Nov 2006 05:25:19 +0000 Subject: [PATCH 036/301] some small tidy up work git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@44 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- README | 9 +++++++++ bindings/csharp/axTLS.cs | 3 +++ bindings/java/SSLCTX.java | 2 ++ docsrc/doco_footer.html | 2 +- ssl/ssl.h | 2 +- ssl/tls1.c | 2 +- 6 files changed, 17 insertions(+), 3 deletions(-) diff --git a/README b/README index 1ca2020094..2e4d492bbb 100644 --- a/README +++ b/README @@ -111,6 +111,15 @@ ActiveState's version works ok). # Known Issues ######################################################################## +* Firefox doesn't handle legacy SSLv2 at all well. Disabling SSLv2 still + initiates a SSLv23 handshake (v1.5). And continuous pressing of the + "Reload" page instigates a change to SSLv3 for some reason (even though the + TLS 1.0 option is selected). This will cause a "Firefox and cannot + communicate securely because they have no common encryption + algorithms" (v1.5), or "Firefox can't connect to because the site + uses a security protocol which isn't enabled" (v2.0). See bugzilla issues + 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon). + * Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an AMD64 box (using FC3). diff --git a/bindings/csharp/axTLS.cs b/bindings/csharp/axTLS.cs index 5239cd688c..78734e4366 100644 --- a/bindings/csharp/axTLS.cs +++ b/bindings/csharp/axTLS.cs @@ -340,6 +340,9 @@ public int VerifyCert(SSL ssl) * * For a client this involves sending another "client hello" message. * For the server is means sending a "hello request" message. + * + * This is a blocking call on the client (until the handshake + * completes). * @param ssl [in] An SSL object reference. * @return SSL_OK if renegotiation instantiation was ok */ diff --git a/bindings/java/SSLCTX.java b/bindings/java/SSLCTX.java index 34bd9e48c1..2823511b1a 100644 --- a/bindings/java/SSLCTX.java +++ b/bindings/java/SSLCTX.java @@ -168,6 +168,8 @@ public int verifyCert(SSL ssl) * * For a client this involves sending another "client hello" message. * For the server is means sending a "hello request" message. + * + * This is a blocking call on the client (until the handshake completes). * @param ssl [in] An SSL object reference. * @return SSL_OK if renegotiation instantiation was ok */ diff --git a/docsrc/doco_footer.html b/docsrc/doco_footer.html index 84c2b81e54..e16051cba1 100644 --- a/docsrc/doco_footer.html +++ b/docsrc/doco_footer.html @@ -1,3 +1,3 @@

    -Copyright � 2006 +Copyright � 2006 Cameron Rich diff --git a/ssl/ssl.h b/ssl/ssl.h index 6c939c1f2b..b9dbb83209 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -300,7 +300,7 @@ EXP_FUNC uint8_t STDCALL ssl_get_cipher_id(SSL *ssl); EXP_FUNC int STDCALL ssl_handshake_status(SSL *ssl); /** - * @brief Retrieve various parameters about the TLS engine. + * @brief Retrieve various parameters about the axTLS engine. * @param offset [in] The configuration offset. It will be one of the following: * - SSL_BUILD_MODE The build mode. This will be one of the following: * - SSL_BUILD_SERVER_ONLY (basic server mode) diff --git a/ssl/tls1.c b/ssl/tls1.c index 4aa6cbfa96..7e76e5a75b 100644 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -1150,7 +1150,7 @@ int basic_read(SSL *ssl, uint8_t **in_data) if (IS_SET_SSL_FLAG(SSL_NEED_RECORD)) { - /* check for sslv2 "client hello" TODO: this shouldn't be here. */ + /* check for sslv2 "client hello" */ if (buf[0] & 0x80 && buf[2] == 1 && buf[3] == 0x03) { #ifdef CONFIG_SSL_ENABLE_V23_HANDSHAKE From df2886ed07a1e1c3836a230119c67d5fc0aec798 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 30 Nov 2006 05:56:15 +0000 Subject: [PATCH 037/301] fixed possible future version bug git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@45 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/tls1.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/ssl/tls1.c b/ssl/tls1.c index 7e76e5a75b..2194235181 100644 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -1168,17 +1168,12 @@ int basic_read(SSL *ssl, uint8_t **in_data) version = (buf[1] << 4) + buf[2]; ssl->need_bytes = (buf[3] << 8) + buf[4]; - /* should be 3.1 (TLSv1) */ - if (version != 0x31) + /* should be v3.1 (TLSv1) or better - we'll send in v3.1 mode anyway */ + if (version < 0x31) { - /* if we are talking to a client that talks v3.2, then we'll wear - * it - we'll respond in v3.1 mode anyway. */ - if (version < 0x31 || !IS_SET_SSL_FLAG(SSL_IS_CLIENT)) - { - ret = SSL_ERROR_INVALID_VERSION; - ssl_display_error(ret); - goto error; - } + ret = SSL_ERROR_INVALID_VERSION; + ssl_display_error(ret); + goto error; } CLR_SSL_FLAG(SSL_NEED_RECORD); From 3d2f9ac3fd4ed04ae7dea9d19f5cd73b57e6f95b Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 1 Dec 2006 03:57:08 +0000 Subject: [PATCH 038/301] adjusted version checking mechanism git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@46 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/aes.c | 13 +-- ssl/bigint_impl.h | 1 - ssl/crypto_misc.c | 3 - ssl/hmac.c | 2 - ssl/md5.c | 255 ++++++++++++++++++++++------------------------ ssl/rc4.c | 10 +- ssl/sha1.c | 4 - ssl/tls1.c | 35 ++----- ssl/tls1_clnt.c | 5 +- ssl/tls1_svr.c | 14 ++- 10 files changed, 160 insertions(+), 182 deletions(-) diff --git a/ssl/aes.c b/ssl/aes.c index 8aefbf4f6e..9154a5153f 100644 --- a/ssl/aes.c +++ b/ssl/aes.c @@ -17,8 +17,6 @@ */ /** - * @file aes.c - * * AES implementation - this is a small code version. There are much faster * versions around but they are much larger in size (i.e. they use large * submix tables). @@ -34,12 +32,13 @@ #define rot2(x) (((x) << 16) | ((x) >> 16)) #define rot3(x) (((x) << 8) | ((x) >> 24)) -/* This cute trick does 4 'mul by two' at once. Stolen from +/* + * This cute trick does 4 'mul by two' at once. Stolen from * Dr B. R. Gladman but I'm sure the u-(u>>7) is * a standard graphics trick * The key to this is that we need to xor with 0x1b if the top bit is set. * a 1xxx xxxx 0xxx 0xxx First we mask the 7bit, - * b 1000 0000 0000 0000 then we shift right by 7 puting the 7bit in 0bit, + * b 1000 0000 0000 0000 then we shift right by 7 putting the 7bit in 0bit, * c 0000 0001 0000 0000 we then subtract (c) from (b) * d 0111 1111 0000 0000 and now we and with our mask * e 0001 1011 0000 0000 @@ -194,7 +193,7 @@ void AES_set_key(AES_CTX *ctx, const uint8_t *key, ctx->rounds = i; ctx->key_size = words; W = ctx->ks; - for (i=0; iks; k += 4; + for (i=ctx->rounds*4; i>4; i--) { w= *k; @@ -474,4 +476,3 @@ static void AES_decrypt(const AES_CTX *ctx, uint32_t *data) } #endif - diff --git a/ssl/bigint_impl.h b/ssl/bigint_impl.h index 156e940547..762a7ccbb2 100644 --- a/ssl/bigint_impl.h +++ b/ssl/bigint_impl.h @@ -81,7 +81,6 @@ typedef struct /**< A big integer "session" context. */ bigint *bi_normalised_mod[BIGINT_NUM_MODS]; /**< Normalised mod storage. */ bigint **g; /**< Used by sliding-window. */ int window; /**< The size of the sliding window */ - int active_count; /**< Number of active bigints. */ int free_count; /**< Number of free bigints. */ diff --git a/ssl/crypto_misc.c b/ssl/crypto_misc.c index fa3f09390c..4d5ebd4ab4 100644 --- a/ssl/crypto_misc.c +++ b/ssl/crypto_misc.c @@ -17,8 +17,6 @@ */ /** - * @file misc.c - * * Some misc. routines to help things out */ @@ -310,4 +308,3 @@ void print_blob(const char *format, void print_blob(const char *format, const unsigned char *data, int size, ...) {} #endif - diff --git a/ssl/hmac.c b/ssl/hmac.c index aaa499dd2c..8ac6ad3c1c 100644 --- a/ssl/hmac.c +++ b/ssl/hmac.c @@ -17,8 +17,6 @@ */ /** - * @file hmac.c - * * HMAC implementation - This code was originally taken from RFC2104 */ diff --git a/ssl/md5.c b/ssl/md5.c index f2a2ded676..87dfa04ed7 100644 --- a/ssl/md5.c +++ b/ssl/md5.c @@ -17,8 +17,6 @@ */ /** - * @file md5.c - * * This file implements the MD5 algorithm as defined in RFC1321 */ @@ -49,26 +47,24 @@ static void MD5Transform(uint32_t state[4], const uint8_t block[64]); static void Encode(uint8_t *output, uint32_t *input, uint32_t len); static void Decode(uint32_t *output, const uint8_t *input, uint32_t len); -static uint8_t PADDING[64] = { - 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 +static uint8_t PADDING[64] = +{ + 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; -/* F, G, H and I are basic MD5 functions. - */ +/* F, G, H and I are basic MD5 functions. */ #define F(x, y, z) (((x) & (y)) | ((~x) & (z))) #define G(x, y, z) (((x) & (z)) | ((y) & (~z))) #define H(x, y, z) ((x) ^ (y) ^ (z)) #define I(x, y, z) ((y) ^ ((x) | (~z))) -/* ROTATE_LEFT rotates x left n bits. - */ +/* ROTATE_LEFT rotates x left n bits. */ #define ROTATE_LEFT(x, n) (((x) << (n)) | ((x) >> (32-(n)))) /* FF, GG, HH, and II transformations for rounds 1, 2, 3, and 4. - Rotation is separate from addition to prevent recomputation. - */ + Rotation is separate from addition to prevent recomputation. */ #define FF(a, b, c, d, x, s, ac) { \ (a) += F ((b), (c), (d)) + (x) + (uint32_t)(ac); \ (a) = ROTATE_LEFT ((a), (s)); \ @@ -117,11 +113,10 @@ void MD5Update(MD5_CTX *ctx, const uint8_t * msg, int len) x = (uint32_t)((ctx->count[0] >> 3) & 0x3F); /* Update number of bits */ - if ((ctx->count[0] += ((uint32_t)len << 3)) - < ((uint32_t)len << 3)) + if ((ctx->count[0] += ((uint32_t)len << 3)) < ((uint32_t)len << 3)) ctx->count[1]++; - ctx->count[1] += ((uint32_t)len >> 29); + ctx->count[1] += ((uint32_t)len >> 29); partLen = 64 - x; /* Transform as many times as possible. */ @@ -131,7 +126,9 @@ void MD5Update(MD5_CTX *ctx, const uint8_t * msg, int len) MD5Transform(ctx->state, ctx->buffer); for (i = partLen; i + 63 < len; i += 64) + { MD5Transform(ctx->state, &msg[i]); + } x = 0; } @@ -147,114 +144,110 @@ void MD5Update(MD5_CTX *ctx, const uint8_t * msg, int len) */ void MD5Final(MD5_CTX *ctx, uint8_t *digest) { - uint8_t bits[8]; - uint32_t x, padLen; - - /* Save number of bits */ - Encode(bits, ctx->count, 8); - - /* Pad out to 56 mod 64. - */ - x = (uint32_t)((ctx->count[0] >> 3) & 0x3f); - padLen = (x < 56) ? (56 - x) : (120 - x); - MD5Update(ctx, PADDING, padLen); - - /* Append length (before padding) */ - MD5Update(ctx, bits, 8); - - /* Store state in digest */ - Encode(digest, ctx->state, MD5_SIZE); + uint8_t bits[8]; + uint32_t x, padlen; + + /* save number of bits */ + encode(bits, ctx->count, 8); + + /* pad out to 56 mod 64. */ + x = (uint32_t)((ctx->count[0] >> 3) & 0x3f); + padlen = (x < 56) ? (56 - x) : (120 - x); + md5update(ctx, padding, padlen); + + /* append length (before padding) */ + md5update(ctx, bits, 8); + + /* store state in digest */ + encode(digest, ctx->state, md5_size); } /** - * MD5 basic transformation. Transforms state based on block. + * md5 basic transformation. transforms state based on block. */ -static void MD5Transform(uint32_t state[4], const uint8_t block[64]) +static void md5transform(uint32_t state[4], const uint8_t block[64]) { - uint32_t a = state[0], b = state[1], c = state[2], d = state[3], x[MD5_SIZE]; - - Decode(x, block, 64); - - /* Round 1 */ - FF (a, b, c, d, x[ 0], S11, 0xd76aa478); /* 1 */ - FF (d, a, b, c, x[ 1], S12, 0xe8c7b756); /* 2 */ - FF (c, d, a, b, x[ 2], S13, 0x242070db); /* 3 */ - FF (b, c, d, a, x[ 3], S14, 0xc1bdceee); /* 4 */ - FF (a, b, c, d, x[ 4], S11, 0xf57c0faf); /* 5 */ - FF (d, a, b, c, x[ 5], S12, 0x4787c62a); /* 6 */ - FF (c, d, a, b, x[ 6], S13, 0xa8304613); /* 7 */ - FF (b, c, d, a, x[ 7], S14, 0xfd469501); /* 8 */ - FF (a, b, c, d, x[ 8], S11, 0x698098d8); /* 9 */ - FF (d, a, b, c, x[ 9], S12, 0x8b44f7af); /* 10 */ - FF (c, d, a, b, x[10], S13, 0xffff5bb1); /* 11 */ - FF (b, c, d, a, x[11], S14, 0x895cd7be); /* 12 */ - FF (a, b, c, d, x[12], S11, 0x6b901122); /* 13 */ - FF (d, a, b, c, x[13], S12, 0xfd987193); /* 14 */ - FF (c, d, a, b, x[14], S13, 0xa679438e); /* 15 */ - FF (b, c, d, a, x[15], S14, 0x49b40821); /* 16 */ - - /* Round 2 */ - GG (a, b, c, d, x[ 1], S21, 0xf61e2562); /* 17 */ - GG (d, a, b, c, x[ 6], S22, 0xc040b340); /* 18 */ - GG (c, d, a, b, x[11], S23, 0x265e5a51); /* 19 */ - GG (b, c, d, a, x[ 0], S24, 0xe9b6c7aa); /* 20 */ - GG (a, b, c, d, x[ 5], S21, 0xd62f105d); /* 21 */ - GG (d, a, b, c, x[10], S22, 0x2441453); /* 22 */ - GG (c, d, a, b, x[15], S23, 0xd8a1e681); /* 23 */ - GG (b, c, d, a, x[ 4], S24, 0xe7d3fbc8); /* 24 */ - GG (a, b, c, d, x[ 9], S21, 0x21e1cde6); /* 25 */ - GG (d, a, b, c, x[14], S22, 0xc33707d6); /* 26 */ - GG (c, d, a, b, x[ 3], S23, 0xf4d50d87); /* 27 */ - GG (b, c, d, a, x[ 8], S24, 0x455a14ed); /* 28 */ - GG (a, b, c, d, x[13], S21, 0xa9e3e905); /* 29 */ - GG (d, a, b, c, x[ 2], S22, 0xfcefa3f8); /* 30 */ - GG (c, d, a, b, x[ 7], S23, 0x676f02d9); /* 31 */ - GG (b, c, d, a, x[12], S24, 0x8d2a4c8a); /* 32 */ - - /* Round 3 */ - HH (a, b, c, d, x[ 5], S31, 0xfffa3942); /* 33 */ - HH (d, a, b, c, x[ 8], S32, 0x8771f681); /* 34 */ - HH (c, d, a, b, x[11], S33, 0x6d9d6122); /* 35 */ - HH (b, c, d, a, x[14], S34, 0xfde5380c); /* 36 */ - HH (a, b, c, d, x[ 1], S31, 0xa4beea44); /* 37 */ - HH (d, a, b, c, x[ 4], S32, 0x4bdecfa9); /* 38 */ - HH (c, d, a, b, x[ 7], S33, 0xf6bb4b60); /* 39 */ - HH (b, c, d, a, x[10], S34, 0xbebfbc70); /* 40 */ - HH (a, b, c, d, x[13], S31, 0x289b7ec6); /* 41 */ - HH (d, a, b, c, x[ 0], S32, 0xeaa127fa); /* 42 */ - HH (c, d, a, b, x[ 3], S33, 0xd4ef3085); /* 43 */ - HH (b, c, d, a, x[ 6], S34, 0x4881d05); /* 44 */ - HH (a, b, c, d, x[ 9], S31, 0xd9d4d039); /* 45 */ - HH (d, a, b, c, x[12], S32, 0xe6db99e5); /* 46 */ - HH (c, d, a, b, x[15], S33, 0x1fa27cf8); /* 47 */ - HH (b, c, d, a, x[ 2], S34, 0xc4ac5665); /* 48 */ - - /* Round 4 */ - II (a, b, c, d, x[ 0], S41, 0xf4292244); /* 49 */ - II (d, a, b, c, x[ 7], S42, 0x432aff97); /* 50 */ - II (c, d, a, b, x[14], S43, 0xab9423a7); /* 51 */ - II (b, c, d, a, x[ 5], S44, 0xfc93a039); /* 52 */ - II (a, b, c, d, x[12], S41, 0x655b59c3); /* 53 */ - II (d, a, b, c, x[ 3], S42, 0x8f0ccc92); /* 54 */ - II (c, d, a, b, x[10], S43, 0xffeff47d); /* 55 */ - II (b, c, d, a, x[ 1], S44, 0x85845dd1); /* 56 */ - II (a, b, c, d, x[ 8], S41, 0x6fa87e4f); /* 57 */ - II (d, a, b, c, x[15], S42, 0xfe2ce6e0); /* 58 */ - II (c, d, a, b, x[ 6], S43, 0xa3014314); /* 59 */ - II (b, c, d, a, x[13], S44, 0x4e0811a1); /* 60 */ - II (a, b, c, d, x[ 4], S41, 0xf7537e82); /* 61 */ - II (d, a, b, c, x[11], S42, 0xbd3af235); /* 62 */ - II (c, d, a, b, x[ 2], S43, 0x2ad7d2bb); /* 63 */ - II (b, c, d, a, x[ 9], S44, 0xeb86d391); /* 64 */ - - state[0] += a; - state[1] += b; - state[2] += c; - state[3] += d; - - /* Zeroize sensitive information. - */ - memset(x, 0, sizeof(x)); + uint32_t a = state[0], b = state[1], c = state[2], + d = state[3], x[md5_size]; + + decode(x, block, 64); + + /* round 1 */ + ff(a, b, c, d, x[ 0], s11, 0xd76aa478); /* 1 */ + ff(d, a, b, c, x[ 1], s12, 0xe8c7b756); /* 2 */ + ff(c, d, a, b, x[ 2], s13, 0x242070db); /* 3 */ + ff(b, c, d, a, x[ 3], s14, 0xc1bdceee); /* 4 */ + ff(a, b, c, d, x[ 4], s11, 0xf57c0faf); /* 5 */ + ff(d, a, b, c, x[ 5], s12, 0x4787c62a); /* 6 */ + ff(c, d, a, b, x[ 6], s13, 0xa8304613); /* 7 */ + ff(b, c, d, a, x[ 7], s14, 0xfd469501); /* 8 */ + ff(a, b, c, d, x[ 8], s11, 0x698098d8); /* 9 */ + ff(d, a, b, c, x[ 9], s12, 0x8b44f7af); /* 10 */ + ff(c, d, a, b, x[10], s13, 0xffff5bb1); /* 11 */ + ff(b, c, d, a, x[11], s14, 0x895cd7be); /* 12 */ + ff(a, b, c, d, x[12], s11, 0x6b901122); /* 13 */ + ff(d, a, b, c, x[13], s12, 0xfd987193); /* 14 */ + ff(c, d, a, b, x[14], s13, 0xa679438e); /* 15 */ + ff(b, c, d, a, x[15], s14, 0x49b40821); /* 16 */ + + /* round 2 */ + gg(a, b, c, d, x[ 1], s21, 0xf61e2562); /* 17 */ + gg(d, a, b, c, x[ 6], s22, 0xc040b340); /* 18 */ + gg(c, d, a, b, x[11], s23, 0x265e5a51); /* 19 */ + gg(b, c, d, a, x[ 0], s24, 0xe9b6c7aa); /* 20 */ + gg(a, b, c, d, x[ 5], s21, 0xd62f105d); /* 21 */ + gg(d, a, b, c, x[10], s22, 0x2441453); /* 22 */ + gg(c, d, a, b, x[15], s23, 0xd8a1e681); /* 23 */ + gg(b, c, d, a, x[ 4], s24, 0xe7d3fbc8); /* 24 */ + gg(a, b, c, d, x[ 9], s21, 0x21e1cde6); /* 25 */ + gg(d, a, b, c, x[14], s22, 0xc33707d6); /* 26 */ + gg(c, d, a, b, x[ 3], s23, 0xf4d50d87); /* 27 */ + gg(b, c, d, a, x[ 8], s24, 0x455a14ed); /* 28 */ + gg(a, b, c, d, x[13], s21, 0xa9e3e905); /* 29 */ + gg(d, a, b, c, x[ 2], s22, 0xfcefa3f8); /* 30 */ + gg(c, d, a, b, x[ 7], s23, 0x676f02d9); /* 31 */ + gg(b, c, d, a, x[12], s24, 0x8d2a4c8a); /* 32 */ + + /* round 3 */ + hh(a, b, c, d, x[ 5], s31, 0xfffa3942); /* 33 */ + hh(d, a, b, c, x[ 8], s32, 0x8771f681); /* 34 */ + hh(c, d, a, b, x[11], s33, 0x6d9d6122); /* 35 */ + hh(b, c, d, a, x[14], s34, 0xfde5380c); /* 36 */ + hh(a, b, c, d, x[ 1], s31, 0xa4beea44); /* 37 */ + hh(d, a, b, c, x[ 4], s32, 0x4bdecfa9); /* 38 */ + hh(c, d, a, b, x[ 7], s33, 0xf6bb4b60); /* 39 */ + hh(b, c, d, a, x[10], s34, 0xbebfbc70); /* 40 */ + hh(a, b, c, d, x[13], s31, 0x289b7ec6); /* 41 */ + hh(d, a, b, c, x[ 0], s32, 0xeaa127fa); /* 42 */ + hh(c, d, a, b, x[ 3], s33, 0xd4ef3085); /* 43 */ + hh(b, c, d, a, x[ 6], s34, 0x4881d05); /* 44 */ + hh(a, b, c, d, x[ 9], s31, 0xd9d4d039); /* 45 */ + hh(d, a, b, c, x[12], s32, 0xe6db99e5); /* 46 */ + hh(c, d, a, b, x[15], s33, 0x1fa27cf8); /* 47 */ + hh(b, c, d, a, x[ 2], s34, 0xc4ac5665); /* 48 */ + + /* round 4 */ + ii(a, b, c, d, x[ 0], s41, 0xf4292244); /* 49 */ + ii(d, a, b, c, x[ 7], s42, 0x432aff97); /* 50 */ + ii(c, d, a, b, x[14], s43, 0xab9423a7); /* 51 */ + ii(b, c, d, a, x[ 5], s44, 0xfc93a039); /* 52 */ + ii(a, b, c, d, x[12], s41, 0x655b59c3); /* 53 */ + ii(d, a, b, c, x[ 3], s42, 0x8f0ccc92); /* 54 */ + ii(c, d, a, b, x[10], s43, 0xffeff47d); /* 55 */ + ii(b, c, d, a, x[ 1], s44, 0x85845dd1); /* 56 */ + ii(a, b, c, d, x[ 8], s41, 0x6fa87e4f); /* 57 */ + ii(d, a, b, c, x[15], s42, 0xfe2ce6e0); /* 58 */ + ii(c, d, a, b, x[ 6], s43, 0xa3014314); /* 59 */ + ii(b, c, d, a, x[13], s44, 0x4e0811a1); /* 60 */ + ii(a, b, c, d, x[ 4], s41, 0xf7537e82); /* 61 */ + ii(d, a, b, c, x[11], s42, 0xbd3af235); /* 62 */ + ii(c, d, a, b, x[ 2], s43, 0x2ad7d2bb); /* 63 */ + ii(b, c, d, a, x[ 9], s44, 0xeb86d391); /* 64 */ + + state[0] += a; + state[1] += b; + state[2] += c; + state[3] += d; } /** @@ -263,15 +256,15 @@ static void MD5Transform(uint32_t state[4], const uint8_t block[64]) */ static void Encode(uint8_t *output, uint32_t *input, uint32_t len) { - uint32_t i, j; - - for (i = 0, j = 0; j < len; i++, j += 4) - { - output[j] = (uint8_t)(input[i] & 0xff); - output[j+1] = (uint8_t)((input[i] >> 8) & 0xff); - output[j+2] = (uint8_t)((input[i] >> 16) & 0xff); - output[j+3] = (uint8_t)((input[i] >> 24) & 0xff); - } + uint32_t i, j; + + for (i = 0, j = 0; j < len; i++, j += 4) + { + output[j] = (uint8_t)(input[i] & 0xff); + output[j+1] = (uint8_t)((input[i] >> 8) & 0xff); + output[j+2] = (uint8_t)((input[i] >> 16) & 0xff); + output[j+3] = (uint8_t)((input[i] >> 24) & 0xff); + } } /** @@ -280,9 +273,9 @@ static void Encode(uint8_t *output, uint32_t *input, uint32_t len) */ static void Decode(uint32_t *output, const uint8_t *input, uint32_t len) { - uint32_t i, j; + uint32_t i, j; - for (i = 0, j = 0; j < len; i++, j += 4) - output[i] = ((uint32_t)input[j]) | (((uint32_t)input[j+1]) << 8) | - (((uint32_t)input[j+2]) << 16) | (((uint32_t)input[j+3]) << 24); + for (i = 0, j = 0; j < len; i++, j += 4) + output[i] = ((uint32_t)input[j]) | (((uint32_t)input[j+1]) << 8) | + (((uint32_t)input[j+2]) << 16) | (((uint32_t)input[j+3]) << 24); } diff --git a/ssl/rc4.c b/ssl/rc4.c index 661d027c98..884bcb534f 100644 --- a/ssl/rc4.c +++ b/ssl/rc4.c @@ -17,11 +17,8 @@ */ /** - * @file rc4.c - * - * An implementation of the RC4/ARC4 algorithm - * - * Originally written by Christophe Devine + * An implementation of the RC4/ARC4 algorithm. + * Originally written by Christophe Devine. */ #include @@ -47,7 +44,8 @@ void RC4_setup(RC4_CTX *ctx, const uint8_t *key, int length) { a = m[i]; j = (uint8_t)(j + a + key[k]); - m[i] = m[j]; m[j] = a; + m[i] = m[j]; + m[j] = a; if (++k >= length) { diff --git a/ssl/sha1.c b/ssl/sha1.c index 80f311b18c..9a42801f25 100644 --- a/ssl/sha1.c +++ b/ssl/sha1.c @@ -17,8 +17,6 @@ */ /** - * @file sha1.c - * * SHA1 implementation - as defined in FIPS PUB 180-1 published April 17, 1995. * This code was originally taken from RFC3174 */ @@ -179,7 +177,6 @@ static void SHA1ProcessMessageBlock(SHA1_CTX *ctx) ctx->Intermediate_Hash[2] += C; ctx->Intermediate_Hash[3] += D; ctx->Intermediate_Hash[4] += E; - ctx->Message_Block_Index = 0; } @@ -239,6 +236,5 @@ static void SHA1PadMessage(SHA1_CTX *ctx) ctx->Message_Block[61] = ctx->Length_Low >> 16; ctx->Message_Block[62] = ctx->Length_Low >> 8; ctx->Message_Block[63] = ctx->Length_Low; - SHA1ProcessMessageBlock(ctx); } diff --git a/ssl/tls1.c b/ssl/tls1.c index 2194235181..e27d911981 100644 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -596,7 +596,8 @@ static void increment_write_sequence(SSL *ssl) if (++ssl->write_sequence[i]) break; } -} +} + /** * Work out the HMAC digest in a packet. */ @@ -674,7 +675,6 @@ static int verify_digest(SSL *ssl, int mode, const uint8_t *buf, int read_len) ssl->record_buf[3] = hmac_offset >> 8; /* insert size */ ssl->record_buf[4] = hmac_offset & 0xff; - add_hmac_digest(ssl, mode, buf, hmac_offset, hmac_buf); if (memcmp(hmac_buf, &buf[hmac_offset], ssl->cipher_info->digest_size)) @@ -974,7 +974,6 @@ int send_packet(SSL *ssl, uint8_t protocol, const uint8_t *in, int length) /* add the packet digest */ msg_length += ssl->cipher_info->digest_size; ssl->bm_buf.index = msg_length; - add_hmac_digest(ssl, mode, ssl->bm_buf.data, length, &ssl->bm_buf.data[length]); @@ -1066,8 +1065,8 @@ static void set_key_block(SSL *ssl, int is_write) memcpy(server_key, q, ciph_info->key_size); q += ciph_info->key_size; -#ifndef CONFIG_SSL_SKELETON_MODE /* RC4 has no IV */ - if (ciph_info->iv_size) +#ifndef CONFIG_SSL_SKELETON_MODE + if (ciph_info->iv_size) /* RC4 has no IV, AES does */ { memcpy(client_iv, q, ciph_info->iv_size); q += ciph_info->iv_size; @@ -1118,7 +1117,7 @@ static void set_key_block(SSL *ssl, int is_write) */ int basic_read(SSL *ssl, uint8_t **in_data) { - int ret = SSL_OK, version = -1; + int ret = SSL_OK; int read_len, is_record; uint8_t *buf = ssl->bm_buf.data; int is_client = IS_SET_SSL_FLAG(SSL_IS_CLIENT); @@ -1165,17 +1164,7 @@ int basic_read(SSL *ssl, uint8_t **in_data) goto error; /* not an error - just get out of here */ } - version = (buf[1] << 4) + buf[2]; ssl->need_bytes = (buf[3] << 8) + buf[4]; - - /* should be v3.1 (TLSv1) or better - we'll send in v3.1 mode anyway */ - if (version < 0x31) - { - ret = SSL_ERROR_INVALID_VERSION; - ssl_display_error(ret); - goto error; - } - CLR_SSL_FLAG(SSL_NEED_RECORD); memcpy(ssl->record_buf, buf, 3); /* store for hmac */ is_record = 1; @@ -1286,8 +1275,7 @@ static int do_handshake(SSL *ssl, uint8_t *buf, int read_len) ssl->bm_buf.index = hs_len; /* store the size and check later */ DISPLAY_STATE(ssl, 0, handshake_type, 0); - if (handshake_type != HS_CERT_VERIFY && - handshake_type != HS_HELLO_REQUEST) + if (handshake_type != HS_CERT_VERIFY && handshake_type != HS_HELLO_REQUEST) { add_packet(ssl, buf, hs_len); } @@ -1338,19 +1326,19 @@ int send_finished(SSL *ssl) /* now add the finished digest mac (12 bytes) */ finished_digest(ssl, - IS_SET_SSL_FLAG(SSL_IS_CLIENT) ? + IS_SET_SSL_FLAG(SSL_IS_CLIENT) ? client_finished : server_finished, &buf[4]); #ifndef CONFIG_SSL_SKELETON_MODE /* store in the session cache */ if (!IS_SET_SSL_FLAG(SSL_SESSION_RESUME) && ssl->ssl_ctx->num_sessions) { - memcpy(ssl->session->master_secret, + memcpy(ssl->session->master_secret, ssl->master_secret, SSL_SECRET_SIZE); } #endif - return send_packet(ssl, PT_HANDSHAKE_PROTOCOL, + return send_packet(ssl, PT_HANDSHAKE_PROTOCOL, NULL, SSL_FINISHED_HASH_SIZE+4); } @@ -1421,7 +1409,6 @@ int send_alert(SSL *ssl, int error_code) buf[0] = is_warning ? 1 : 2; buf[1] = alert_num; - send_packet(ssl, PT_ALERT_PROTOCOL, buf, sizeof(buf)); DISPLAY_ALERT(ssl, alert_num); return is_warning ? 0 : 1; @@ -1505,7 +1492,6 @@ int send_certificate(SSL *ssl) chain_length += 3; buf[2] = chain_length >> 8; /* handshake length */ buf[3] = chain_length & 0xff; - ssl->bm_buf.index = offset; return send_packet(ssl, PT_HANDSHAKE_PROTOCOL, NULL, offset); } @@ -1516,8 +1502,7 @@ int send_certificate(SSL *ssl) * master secret from this session for session resumption. */ SSL_SESS *ssl_session_update(int max_sessions, - SSL_SESS *ssl_sessions[], SSL *ssl, - const uint8_t *session_id) + SSL_SESS *ssl_sessions[], SSL *ssl, const uint8_t *session_id) { time_t tm = time(NULL); time_t oldest_sess_time = tm; diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index da6034be25..b9642b34eb 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -211,11 +211,12 @@ static int process_server_hello(SSL *ssl) uint8_t *buf = ssl->bm_buf.data; int pkt_size = ssl->bm_buf.index; int offset; - int ret = SSL_OK; + int version = (buf[4] << 4) + buf[5]; int num_sessions = ssl->ssl_ctx->num_sessions; + int ret = SSL_OK; /* check that we are talking to a TLSv1 server */ - if (buf[4] != 0x03 || buf[5] != 0x01) + if (version != 0x31) { return SSL_ERROR_INVALID_VERSION; } diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index b3505c2663..ad463def35 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -108,10 +108,20 @@ int do_svr_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len) static int process_client_hello(SSL *ssl) { uint8_t *buf = ssl->bm_buf.data; + uint8_t *record_buf = ssl->record_buf; int pkt_size = ssl->bm_buf.index; int i, j, cs_len, id_len, offset = 6 + SSL_RANDOM_SIZE; + int version = (record_buf[1] << 4) + record_buf[2]; int ret = SSL_OK; + /* should be v3.1 (TLSv1) or better - we'll send in v3.1 mode anyway */ + if (version < 0x31) + { + ret = SSL_ERROR_INVALID_VERSION; + ssl_display_error(ret); + goto error; + } + memcpy(ssl->client_random, &buf[6], SSL_RANDOM_SIZE); /* process the session id */ @@ -174,8 +184,8 @@ int process_sslv23_client_hello(SSL *ssl) DISPLAY_BYTES(ssl, "received %d bytes", buf, read_len, read_len); - /* must be 3.1 (TLSv1) */ - if (version != 0x31) + /* should be v3.1 (TLSv1) or better - we'll send in v3.1 mode anyway */ + if (version < 0x31) { return SSL_ERROR_INVALID_VERSION; } From e146dbca4f57360037f718f17448025a58953d21 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 2 Dec 2006 03:26:43 +0000 Subject: [PATCH 039/301] fixed valgrind initialisation issue git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@47 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/bigint.c | 2 +- ssl/crypto_misc.c | 2 +- ssl/md5.c | 185 +++++++++++++++++++++++----------------------- 3 files changed, 95 insertions(+), 94 deletions(-) diff --git a/ssl/bigint.c b/ssl/bigint.c index 24e6a53f86..b525069a33 100644 --- a/ssl/bigint.c +++ b/ssl/bigint.c @@ -1068,7 +1068,7 @@ static bigint *alloc(BI_CTX *ctx, int size) { /* No free bigints available - create a new one. */ biR = (bigint *)malloc(sizeof(bigint)); - biR->comps = (comp*) malloc(size * COMP_BYTE_SIZE); + biR->comps = (comp*)malloc(size * COMP_BYTE_SIZE); biR->max_comps = size; /* give some space to spare */ } diff --git a/ssl/crypto_misc.c b/ssl/crypto_misc.c index 4d5ebd4ab4..2455e27c05 100644 --- a/ssl/crypto_misc.c +++ b/ssl/crypto_misc.c @@ -50,7 +50,7 @@ const char * const unsupported_str = "Error: feature not supported\n"; BUF_MEM buf_new() { BUF_MEM bm; - bm.pre_data = (uint8_t *)malloc(2048); /* should be enough to start with */ + bm.pre_data = (uint8_t *)calloc(1, 2048); /* start with this */ bm.data = bm.pre_data+BM_RECORD_OFFSET; /* some space at the start */ bm.max_len = 2048-BM_RECORD_OFFSET; bm.index = 0; diff --git a/ssl/md5.c b/ssl/md5.c index 87dfa04ed7..b069011b77 100644 --- a/ssl/md5.c +++ b/ssl/md5.c @@ -54,7 +54,8 @@ static uint8_t PADDING[64] = 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; -/* F, G, H and I are basic MD5 functions. */ +/* F, G, H and I are basic MD5 functions. + */ #define F(x, y, z) (((x) & (y)) | ((~x) & (z))) #define G(x, y, z) (((x) & (z)) | ((y) & (~z))) #define H(x, y, z) ((x) ^ (y) ^ (z)) @@ -113,10 +114,11 @@ void MD5Update(MD5_CTX *ctx, const uint8_t * msg, int len) x = (uint32_t)((ctx->count[0] >> 3) & 0x3F); /* Update number of bits */ - if ((ctx->count[0] += ((uint32_t)len << 3)) < ((uint32_t)len << 3)) + if ((ctx->count[0] += ((uint32_t)len << 3)) + < ((uint32_t)len << 3)) ctx->count[1]++; - ctx->count[1] += ((uint32_t)len >> 29); + partLen = 64 - x; /* Transform as many times as possible. */ @@ -126,9 +128,7 @@ void MD5Update(MD5_CTX *ctx, const uint8_t * msg, int len) MD5Transform(ctx->state, ctx->buffer); for (i = partLen; i + 63 < len; i += 64) - { MD5Transform(ctx->state, &msg[i]); - } x = 0; } @@ -145,104 +145,105 @@ void MD5Update(MD5_CTX *ctx, const uint8_t * msg, int len) void MD5Final(MD5_CTX *ctx, uint8_t *digest) { uint8_t bits[8]; - uint32_t x, padlen; + uint32_t x, padLen; - /* save number of bits */ - encode(bits, ctx->count, 8); + /* Save number of bits */ + Encode(bits, ctx->count, 8); - /* pad out to 56 mod 64. */ + /* Pad out to 56 mod 64. + */ x = (uint32_t)((ctx->count[0] >> 3) & 0x3f); - padlen = (x < 56) ? (56 - x) : (120 - x); - md5update(ctx, padding, padlen); + padLen = (x < 56) ? (56 - x) : (120 - x); + MD5Update(ctx, PADDING, padLen); - /* append length (before padding) */ - md5update(ctx, bits, 8); + /* Append length (before padding) */ + MD5Update(ctx, bits, 8); - /* store state in digest */ - encode(digest, ctx->state, md5_size); + /* Store state in digest */ + Encode(digest, ctx->state, MD5_SIZE); } /** - * md5 basic transformation. transforms state based on block. + * MD5 basic transformation. Transforms state based on block. */ -static void md5transform(uint32_t state[4], const uint8_t block[64]) +static void MD5Transform(uint32_t state[4], const uint8_t block[64]) { uint32_t a = state[0], b = state[1], c = state[2], - d = state[3], x[md5_size]; - - decode(x, block, 64); - - /* round 1 */ - ff(a, b, c, d, x[ 0], s11, 0xd76aa478); /* 1 */ - ff(d, a, b, c, x[ 1], s12, 0xe8c7b756); /* 2 */ - ff(c, d, a, b, x[ 2], s13, 0x242070db); /* 3 */ - ff(b, c, d, a, x[ 3], s14, 0xc1bdceee); /* 4 */ - ff(a, b, c, d, x[ 4], s11, 0xf57c0faf); /* 5 */ - ff(d, a, b, c, x[ 5], s12, 0x4787c62a); /* 6 */ - ff(c, d, a, b, x[ 6], s13, 0xa8304613); /* 7 */ - ff(b, c, d, a, x[ 7], s14, 0xfd469501); /* 8 */ - ff(a, b, c, d, x[ 8], s11, 0x698098d8); /* 9 */ - ff(d, a, b, c, x[ 9], s12, 0x8b44f7af); /* 10 */ - ff(c, d, a, b, x[10], s13, 0xffff5bb1); /* 11 */ - ff(b, c, d, a, x[11], s14, 0x895cd7be); /* 12 */ - ff(a, b, c, d, x[12], s11, 0x6b901122); /* 13 */ - ff(d, a, b, c, x[13], s12, 0xfd987193); /* 14 */ - ff(c, d, a, b, x[14], s13, 0xa679438e); /* 15 */ - ff(b, c, d, a, x[15], s14, 0x49b40821); /* 16 */ - - /* round 2 */ - gg(a, b, c, d, x[ 1], s21, 0xf61e2562); /* 17 */ - gg(d, a, b, c, x[ 6], s22, 0xc040b340); /* 18 */ - gg(c, d, a, b, x[11], s23, 0x265e5a51); /* 19 */ - gg(b, c, d, a, x[ 0], s24, 0xe9b6c7aa); /* 20 */ - gg(a, b, c, d, x[ 5], s21, 0xd62f105d); /* 21 */ - gg(d, a, b, c, x[10], s22, 0x2441453); /* 22 */ - gg(c, d, a, b, x[15], s23, 0xd8a1e681); /* 23 */ - gg(b, c, d, a, x[ 4], s24, 0xe7d3fbc8); /* 24 */ - gg(a, b, c, d, x[ 9], s21, 0x21e1cde6); /* 25 */ - gg(d, a, b, c, x[14], s22, 0xc33707d6); /* 26 */ - gg(c, d, a, b, x[ 3], s23, 0xf4d50d87); /* 27 */ - gg(b, c, d, a, x[ 8], s24, 0x455a14ed); /* 28 */ - gg(a, b, c, d, x[13], s21, 0xa9e3e905); /* 29 */ - gg(d, a, b, c, x[ 2], s22, 0xfcefa3f8); /* 30 */ - gg(c, d, a, b, x[ 7], s23, 0x676f02d9); /* 31 */ - gg(b, c, d, a, x[12], s24, 0x8d2a4c8a); /* 32 */ - - /* round 3 */ - hh(a, b, c, d, x[ 5], s31, 0xfffa3942); /* 33 */ - hh(d, a, b, c, x[ 8], s32, 0x8771f681); /* 34 */ - hh(c, d, a, b, x[11], s33, 0x6d9d6122); /* 35 */ - hh(b, c, d, a, x[14], s34, 0xfde5380c); /* 36 */ - hh(a, b, c, d, x[ 1], s31, 0xa4beea44); /* 37 */ - hh(d, a, b, c, x[ 4], s32, 0x4bdecfa9); /* 38 */ - hh(c, d, a, b, x[ 7], s33, 0xf6bb4b60); /* 39 */ - hh(b, c, d, a, x[10], s34, 0xbebfbc70); /* 40 */ - hh(a, b, c, d, x[13], s31, 0x289b7ec6); /* 41 */ - hh(d, a, b, c, x[ 0], s32, 0xeaa127fa); /* 42 */ - hh(c, d, a, b, x[ 3], s33, 0xd4ef3085); /* 43 */ - hh(b, c, d, a, x[ 6], s34, 0x4881d05); /* 44 */ - hh(a, b, c, d, x[ 9], s31, 0xd9d4d039); /* 45 */ - hh(d, a, b, c, x[12], s32, 0xe6db99e5); /* 46 */ - hh(c, d, a, b, x[15], s33, 0x1fa27cf8); /* 47 */ - hh(b, c, d, a, x[ 2], s34, 0xc4ac5665); /* 48 */ - - /* round 4 */ - ii(a, b, c, d, x[ 0], s41, 0xf4292244); /* 49 */ - ii(d, a, b, c, x[ 7], s42, 0x432aff97); /* 50 */ - ii(c, d, a, b, x[14], s43, 0xab9423a7); /* 51 */ - ii(b, c, d, a, x[ 5], s44, 0xfc93a039); /* 52 */ - ii(a, b, c, d, x[12], s41, 0x655b59c3); /* 53 */ - ii(d, a, b, c, x[ 3], s42, 0x8f0ccc92); /* 54 */ - ii(c, d, a, b, x[10], s43, 0xffeff47d); /* 55 */ - ii(b, c, d, a, x[ 1], s44, 0x85845dd1); /* 56 */ - ii(a, b, c, d, x[ 8], s41, 0x6fa87e4f); /* 57 */ - ii(d, a, b, c, x[15], s42, 0xfe2ce6e0); /* 58 */ - ii(c, d, a, b, x[ 6], s43, 0xa3014314); /* 59 */ - ii(b, c, d, a, x[13], s44, 0x4e0811a1); /* 60 */ - ii(a, b, c, d, x[ 4], s41, 0xf7537e82); /* 61 */ - ii(d, a, b, c, x[11], s42, 0xbd3af235); /* 62 */ - ii(c, d, a, b, x[ 2], s43, 0x2ad7d2bb); /* 63 */ - ii(b, c, d, a, x[ 9], s44, 0xeb86d391); /* 64 */ + d = state[3], x[MD5_SIZE]; + + Decode(x, block, 64); + + /* Round 1 */ + FF (a, b, c, d, x[ 0], S11, 0xd76aa478); /* 1 */ + FF (d, a, b, c, x[ 1], S12, 0xe8c7b756); /* 2 */ + FF (c, d, a, b, x[ 2], S13, 0x242070db); /* 3 */ + FF (b, c, d, a, x[ 3], S14, 0xc1bdceee); /* 4 */ + FF (a, b, c, d, x[ 4], S11, 0xf57c0faf); /* 5 */ + FF (d, a, b, c, x[ 5], S12, 0x4787c62a); /* 6 */ + FF (c, d, a, b, x[ 6], S13, 0xa8304613); /* 7 */ + FF (b, c, d, a, x[ 7], S14, 0xfd469501); /* 8 */ + FF (a, b, c, d, x[ 8], S11, 0x698098d8); /* 9 */ + FF (d, a, b, c, x[ 9], S12, 0x8b44f7af); /* 10 */ + FF (c, d, a, b, x[10], S13, 0xffff5bb1); /* 11 */ + FF (b, c, d, a, x[11], S14, 0x895cd7be); /* 12 */ + FF (a, b, c, d, x[12], S11, 0x6b901122); /* 13 */ + FF (d, a, b, c, x[13], S12, 0xfd987193); /* 14 */ + FF (c, d, a, b, x[14], S13, 0xa679438e); /* 15 */ + FF (b, c, d, a, x[15], S14, 0x49b40821); /* 16 */ + + /* Round 2 */ + GG (a, b, c, d, x[ 1], S21, 0xf61e2562); /* 17 */ + GG (d, a, b, c, x[ 6], S22, 0xc040b340); /* 18 */ + GG (c, d, a, b, x[11], S23, 0x265e5a51); /* 19 */ + GG (b, c, d, a, x[ 0], S24, 0xe9b6c7aa); /* 20 */ + GG (a, b, c, d, x[ 5], S21, 0xd62f105d); /* 21 */ + GG (d, a, b, c, x[10], S22, 0x2441453); /* 22 */ + GG (c, d, a, b, x[15], S23, 0xd8a1e681); /* 23 */ + GG (b, c, d, a, x[ 4], S24, 0xe7d3fbc8); /* 24 */ + GG (a, b, c, d, x[ 9], S21, 0x21e1cde6); /* 25 */ + GG (d, a, b, c, x[14], S22, 0xc33707d6); /* 26 */ + GG (c, d, a, b, x[ 3], S23, 0xf4d50d87); /* 27 */ + GG (b, c, d, a, x[ 8], S24, 0x455a14ed); /* 28 */ + GG (a, b, c, d, x[13], S21, 0xa9e3e905); /* 29 */ + GG (d, a, b, c, x[ 2], S22, 0xfcefa3f8); /* 30 */ + GG (c, d, a, b, x[ 7], S23, 0x676f02d9); /* 31 */ + GG (b, c, d, a, x[12], S24, 0x8d2a4c8a); /* 32 */ + + /* Round 3 */ + HH (a, b, c, d, x[ 5], S31, 0xfffa3942); /* 33 */ + HH (d, a, b, c, x[ 8], S32, 0x8771f681); /* 34 */ + HH (c, d, a, b, x[11], S33, 0x6d9d6122); /* 35 */ + HH (b, c, d, a, x[14], S34, 0xfde5380c); /* 36 */ + HH (a, b, c, d, x[ 1], S31, 0xa4beea44); /* 37 */ + HH (d, a, b, c, x[ 4], S32, 0x4bdecfa9); /* 38 */ + HH (c, d, a, b, x[ 7], S33, 0xf6bb4b60); /* 39 */ + HH (b, c, d, a, x[10], S34, 0xbebfbc70); /* 40 */ + HH (a, b, c, d, x[13], S31, 0x289b7ec6); /* 41 */ + HH (d, a, b, c, x[ 0], S32, 0xeaa127fa); /* 42 */ + HH (c, d, a, b, x[ 3], S33, 0xd4ef3085); /* 43 */ + HH (b, c, d, a, x[ 6], S34, 0x4881d05); /* 44 */ + HH (a, b, c, d, x[ 9], S31, 0xd9d4d039); /* 45 */ + HH (d, a, b, c, x[12], S32, 0xe6db99e5); /* 46 */ + HH (c, d, a, b, x[15], S33, 0x1fa27cf8); /* 47 */ + HH (b, c, d, a, x[ 2], S34, 0xc4ac5665); /* 48 */ + + /* Round 4 */ + II (a, b, c, d, x[ 0], S41, 0xf4292244); /* 49 */ + II (d, a, b, c, x[ 7], S42, 0x432aff97); /* 50 */ + II (c, d, a, b, x[14], S43, 0xab9423a7); /* 51 */ + II (b, c, d, a, x[ 5], S44, 0xfc93a039); /* 52 */ + II (a, b, c, d, x[12], S41, 0x655b59c3); /* 53 */ + II (d, a, b, c, x[ 3], S42, 0x8f0ccc92); /* 54 */ + II (c, d, a, b, x[10], S43, 0xffeff47d); /* 55 */ + II (b, c, d, a, x[ 1], S44, 0x85845dd1); /* 56 */ + II (a, b, c, d, x[ 8], S41, 0x6fa87e4f); /* 57 */ + II (d, a, b, c, x[15], S42, 0xfe2ce6e0); /* 58 */ + II (c, d, a, b, x[ 6], S43, 0xa3014314); /* 59 */ + II (b, c, d, a, x[13], S44, 0x4e0811a1); /* 60 */ + II (a, b, c, d, x[ 4], S41, 0xf7537e82); /* 61 */ + II (d, a, b, c, x[11], S42, 0xbd3af235); /* 62 */ + II (c, d, a, b, x[ 2], S43, 0x2ad7d2bb); /* 63 */ + II (b, c, d, a, x[ 9], S44, 0xeb86d391); /* 64 */ state[0] += a; state[1] += b; From 396d3407781c49dc38302901124526d256f333a7 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Tue, 5 Dec 2006 04:21:08 +0000 Subject: [PATCH 040/301] Make our cert/key more compact + fix small typo git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@50 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- bindings/csharp/axTLS.cs | 2 +- bindings/java/SSL.java | 2 +- ssl/bigint.c | 2 +- ssl/rc4.c | 5 +++-- ssl/ssl.h | 4 ++-- ssl/tls1.c | 2 ++ 6 files changed, 10 insertions(+), 7 deletions(-) diff --git a/bindings/csharp/axTLS.cs b/bindings/csharp/axTLS.cs index 78734e4366..9362fbae2a 100644 --- a/bindings/csharp/axTLS.cs +++ b/bindings/csharp/axTLS.cs @@ -88,7 +88,7 @@ public byte GetCipherId() /** * @brief Get the session id for a handshake. * - * This will be a 32 byte sequence and is availabile after the first + * This will be a 32 byte sequence and is available after the first * handshaking messages are sent. * @return The session id as a 32 byte sequence. * @note A SSLv23 handshake may have only 16 valid bytes. diff --git a/bindings/java/SSL.java b/bindings/java/SSL.java index 53ddd95a25..a2dfd370b1 100644 --- a/bindings/java/SSL.java +++ b/bindings/java/SSL.java @@ -88,7 +88,7 @@ public byte getCipherId() /** * @brief Get the session id for a handshake. * - * This will be a 32 byte sequence and is availabile after the first + * This will be a 32 byte sequence and is available after the first * handshaking messages are sent. * @return The session id as a 32 byte sequence. * @note A SSLv23 handshake may have only 16 valid bytes. diff --git a/ssl/bigint.c b/ssl/bigint.c index b525069a33..55482f0a8e 100644 --- a/ssl/bigint.c +++ b/ssl/bigint.c @@ -134,7 +134,7 @@ void bi_terminate(BI_CTX *ctx) * @brief Increment the number of references to this object. * It does not do a full copy. * @param bi [in] The bigint to copy. - * @return A referent to the same bigint. + * @return A reference to the same bigint. */ bigint *bi_copy(bigint *bi) { diff --git a/ssl/rc4.c b/ssl/rc4.c index 884bcb534f..471e15ffc0 100644 --- a/ssl/rc4.c +++ b/ssl/rc4.c @@ -69,8 +69,9 @@ void RC4_crypt(RC4_CTX *ctx, const uint8_t *msg, uint8_t *out, int length) for (i = 0; i < length; i++) { - x =(uint8_t)(x + 1); a = m[x]; - y =(uint8_t)(y + a); + x = (uint8_t)(x + 1); + a = m[x]; + y = (uint8_t)(y + a); m[x] = b = m[y]; m[y] = a; out[i] ^= m[(uint8_t)(a + b)]; diff --git a/ssl/ssl.h b/ssl/ssl.h index b9dbb83209..d8ff953b15 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -165,7 +165,7 @@ extern "C" { * call to ssl_verify_cert(). * - SSL_CLIENT_AUTHENTICATION (server only): Enforce client authentication * i.e. each handshake will include a "certificate request" message from the - * server. Only availabile if verification has been enabled. + * server. Only available if verification has been enabled. * - SSL_NO_DEFAULT_KEY: Don't use the default key/certificate. The user will * load the key/certificate explicitly. * - SSL_DISPLAY_BYTES (full mode build only): Display the byte sequences @@ -272,7 +272,7 @@ EXP_FUNC SSL * STDCALL ssl_find(SSLCTX *ssl_ctx, int client_fd); /** * @brief Get the session id for a handshake. * - * This will be a 32 byte sequence and is availabile after the first + * This will be a 32 byte sequence and is available after the first * handshaking messages are sent. * @param ssl [in] An SSL object reference. * @return The session id as a 32 byte sequence. diff --git a/ssl/tls1.c b/ssl/tls1.c index e27d911981..b6ba0c68b7 100644 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -28,7 +28,9 @@ /* Don't import the default key/certificate if not used */ #if defined(CONFIG_SSL_USE_DEFAULT_KEY) || defined(CONFIG_SSL_SKELETON_MODE) +static const /* saves a few bytes and RAM */ #include "cert.h" +static const /* saves a few more bytes */ #include "private_key.h" #endif From 8213b750a1f9a4206d712cb93fb5d4fd0c5b8411 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Tue, 5 Dec 2006 06:32:30 +0000 Subject: [PATCH 041/301] Forked off Anti-Web and made axhttpd git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@51 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 7 +- README | 11 +- config/Config.in | 4 +- config/JMeter.jmx | 2 +- config/{awhttpd.aip => axhttpd.aip} | 8 +- config/linuxconfig | 3 +- config/win32config | 3 +- httpd/Config.in | 22 +- httpd/Makefile | 28 +- httpd/README | 6 + httpd/awhttpd-3.0.7.tar | Bin 194560 -> 0 bytes httpd/awhttpd.patch | 2371 --------------------------- httpd/axhttp.h | 164 ++ httpd/conn.c | 121 ++ httpd/main.c | 323 ++++ httpd/mime_types.c | 190 +++ httpd/misc.c | 268 +++ httpd/net.c | 176 ++ httpd/proc.c | 780 +++++++++ httpd/socket.c | 129 ++ 20 files changed, 2184 insertions(+), 2432 deletions(-) rename config/{awhttpd.aip => axhttpd.aip} (97%) create mode 100644 httpd/README delete mode 100644 httpd/awhttpd-3.0.7.tar delete mode 100644 httpd/awhttpd.patch create mode 100644 httpd/axhttp.h create mode 100644 httpd/conn.c create mode 100644 httpd/main.c create mode 100644 httpd/mime_types.c create mode 100644 httpd/misc.c create mode 100644 httpd/net.c create mode 100644 httpd/proc.c create mode 100644 httpd/socket.c diff --git a/Makefile b/Makefile index 1ebdcfc012..f4c2c86e8b 100644 --- a/Makefile +++ b/Makefile @@ -34,8 +34,7 @@ RELEASE=axTLS-$(VERSION) # standard version target: $(MAKE) -C ssl -ifdef CONFIG_AWHTTPD - $(MAKE) -C httpd untar_web_server +ifdef CONFIG_AXHTTPD $(MAKE) -C httpd endif ifdef CONFIG_BINDINGS @@ -72,12 +71,12 @@ install: $(PREFIX) all chmod 755 $(PREFIX)/lib/libax* -@install -m 755 $(STAGE)/ax* $(PREFIX)/bin > /dev/null 2>&1 -@install -m 755 $(STAGE)/axtlsp.pm `perl -e 'use Config; print $$Config{installarchlib};'` > /dev/null 2>&1 - -@install -m 755 $(STAGE)/awhttpd* $(PREFIX)/bin > /dev/null 2>&1 + -@install -m 755 $(STAGE)/axhttpd* $(PREFIX)/bin > /dev/null 2>&1 installclean: -@rm $(PREFIX)/lib/libax* > /dev/null 2>&1 -@rm $(PREFIX)/bin/ax* > /dev/null 2>&1 - -@rm $(PREFIX)/bin/awhttpd* > /dev/null 2>&1 + -@rm $(PREFIX)/bin/axhttpd* > /dev/null 2>&1 -@rm `perl -e 'use Config; print $$Config{installarchlib};'`/axtlsp.pm > /dev/null 2>&1 test: diff --git a/README b/README index 2e4d492bbb..db35888d79 100644 --- a/README +++ b/README @@ -9,7 +9,7 @@ This is a guide to get a small SSL web-server up and running quickly. ######################################################################## The axTLS project is an SSL client/server library using the TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web -server is included (called Anti-Web). +server is included. The web server + SSL library is around 50-60kB and is configurable for features or size. @@ -32,8 +32,8 @@ the extracted directory and typing: Select your platform type, save the configuration, exit, and then type "make" again. -If all goes well, you should end up with an executable called "awhttpd" (or -awhttpd.exe) in the _stage directory. +If all goes well, you should end up with an executable called "axhttpd" (or +axhttpd.exe) in the _stage directory. To play with all the various axTLS options, type: @@ -47,7 +47,7 @@ Save the new configuration and rebuild. To run it, go to the _stage directory, and type (as superuser): -> awhttpd +> axhttpd And then point your browser at: @@ -61,9 +61,6 @@ http://127.0.0.1 to see the same page unencrypted. -See the README in the httpd directory from more configuration information on -Anti-Web. - ######################################################################## # The axssl utilities ######################################################################## diff --git a/config/Config.in b/config/Config.in index 14de5c8f28..de1808d8e4 100644 --- a/config/Config.in +++ b/config/Config.in @@ -107,11 +107,11 @@ config CONFIG_EXTRA_LDFLAGS_OPTIONS endmenu source ssl/Config.in -config CONFIG_AWHTTPD +config CONFIG_AXHTTPD bool "Enable HTTP/HTTPS Web Server" default y help - Build the AWHTTPD web server + Build the AXHTTPD web server source httpd/Config.in source bindings/Config.in diff --git a/config/JMeter.jmx b/config/JMeter.jmx index 5070760b05..f62c03f0ee 100755 --- a/config/JMeter.jmx +++ b/config/JMeter.jmx @@ -1,6 +1,6 @@ - + diff --git a/config/awhttpd.aip b/config/axhttpd.aip similarity index 97% rename from config/awhttpd.aip rename to config/axhttpd.aip index a460ecbf20..a1806c0c0e 100755 --- a/config/awhttpd.aip +++ b/config/axhttpd.aip @@ -37,7 +37,7 @@ - + @@ -59,12 +59,12 @@ - + - + @@ -199,7 +199,7 @@ - + diff --git a/config/linuxconfig b/config/linuxconfig index 79a3591a3a..44e5226ea8 100644 --- a/config/linuxconfig +++ b/config/linuxconfig @@ -43,9 +43,8 @@ CONFIG_USE_DEV_URANDOM=y # CONFIG_WIN32_USE_CRYPTO_LIB is not set # CONFIG_PERFORMANCE_TESTING is not set # CONFIG_SSL_TEST is not set -# CONFIG_AWHTTPD is not set +# CONFIG_AXHTTPD is not set # CONFIG_HTTP_STATIC_BUILD is not set -# CONFIG_HTTP_HAS_SSL is not set CONFIG_HTTP_HTTPS_PORT=0 CONFIG_HTTP_SESSION_CACHE_SIZE=0 CONFIG_HTTP_WEBROOT="" diff --git a/config/win32config b/config/win32config index fe94084f5a..ed7efe96f4 100644 --- a/config/win32config +++ b/config/win32config @@ -47,13 +47,12 @@ CONFIG_SSL_MAX_CERTS=2 CONFIG_WIN32_USE_CRYPTO_LIB=y # CONFIG_PERFORMANCE_TESTING is not set # CONFIG_SSL_TEST is not set -CONFIG_AWHTTPD=y +CONFIG_AXHTTPD=y # # Awhttpd Configuration # # CONFIG_HTTP_STATIC_BUILD is not set -CONFIG_HTTP_HAS_SSL=y CONFIG_HTTP_HTTPS_PORT=443 CONFIG_HTTP_WEBROOT="www" CONFIG_HTTP_PORT=80 diff --git a/httpd/Config.in b/httpd/Config.in index 73e304cabf..f720e4eea1 100644 --- a/httpd/Config.in +++ b/httpd/Config.in @@ -3,26 +3,19 @@ # see scripts/config/Kconfig-language.txt # -menu "Awhttpd Configuration" -depends on CONFIG_AWHTTPD +menu "Axhttpd Configuration" +depends on CONFIG_AXHTTPD config CONFIG_HTTP_STATIC_BUILD bool "Static Build" default n help - Select y if you want awhttp to be a static build (i.e. don't use the + Select y if you want axhttp to be a static build (i.e. don't use the axtls shared library or dll). -config CONFIG_HTTP_HAS_SSL - bool "Use SSL" - default y - help - Build the HTTP server with SSL capability - config CONFIG_HTTP_HTTPS_PORT int "HTTPS port" default 443 - depends on CONFIG_HTTP_HAS_SSL help The port number of the HTTPS server. @@ -31,7 +24,6 @@ config CONFIG_HTTP_HTTPS_PORT config CONFIG_HTTP_SESSION_CACHE_SIZE int "SSL session cache size" default 5 - depends on CONFIG_HTTP_HAS_SSL help The size of the SSL session cache. @@ -44,7 +36,7 @@ config CONFIG_HTTP_WEBROOT default "../www" if !CONFIG_PLATFORM_WIN32 default "..\\www" if CONFIG_PLATFORM_WIN32 help - The location of the web root in relation to awhttpd. This is + The location of the web root in relation to axhttpd. This is the directory where index.html lives. config CONFIG_HTTP_PORT @@ -72,7 +64,7 @@ config CONFIG_HTTP_CGI_EXTENSION default ".php" depends on CONFIG_HTTP_HAS_CGI help - Tell awhhtp what file extension is used for CGI + Tell axhhtp what file extension is used for CGI config CONFIG_HTTP_DIRECTORIES bool "Enable Directory Listing" @@ -101,14 +93,14 @@ config CONFIG_HTTP_VERBOSE default y if CONFIG_SSL_FULL_MODE default n if !CONFIG_SSL_FULL_MODE help - Enable extra statements used when using awhttpd. + Enable extra statements used when using axhttpd. config CONFIG_HTTP_IS_DAEMON bool "Run as a daemon" default n depends on !CONFIG_PLATFORM_WIN32 help - Run awhttpd as a background process. + Run axhttpd as a background process. Does not work under Win32 diff --git a/httpd/Makefile b/httpd/Makefile index 22b8d0ff23..b676c8f9e4 100644 --- a/httpd/Makefile +++ b/httpd/Makefile @@ -24,9 +24,9 @@ include ../config/makefile.conf ifndef CONFIG_PLATFORM_WIN32 ifdef CONFIG_PLATFORM_CYGWIN -TARGET=../$(STAGE)/awhttpd.exe +TARGET=../$(STAGE)/axhttpd.exe else -TARGET=../$(STAGE)/awhttpd +TARGET=../$(STAGE)/axhttpd endif ifdef CONFIG_HTTP_STATIC_BUILD @@ -38,7 +38,7 @@ endif CFLAGS += -I../ssl else # win32 build -TARGET=../$(STAGE)/awhttpd.exe +TARGET=../$(STAGE)/axhttpd.exe ifdef CONFIG_HTTP_STATIC_BUILD LIBS=../$(STAGE)/axtls.static.lib ..\\config\\axtls.res @@ -51,31 +51,16 @@ ifndef CONFIG_AWHTTPD web_server: else -untar_web_server: awhttpd/Makefile - -awhttpd/Makefile: - tar xvf awhttpd-3.0.7.tar - cat awhttpd.patch | patch -p0 - web_server : $(TARGET) OBJ= \ - cgi.o \ conn.o \ main.o \ net.o \ proc.o \ socket.o \ - errors.o \ misc.o \ - urldecode.o \ - mime_types.o \ - index.o \ - urlencode.o \ - permcheck.o - -%.o : awhttpd/%.c ../config/.config - $(CC) -c $(CFLAGS) $< + mime_types.o ifndef CONFIG_PLATFORM_WIN32 @@ -91,10 +76,6 @@ endif endif else # Win32 -OBJ:=$(OBJ:.o=.obj) -%.obj : awhttpd/%.c - $(CC) $(CFLAGS) $< - $(TARGET): $(OBJ) ifdef CONFIG_HTTP_NO_SSL $(LD) $(LDFLAGS) /out:$@ $(OBJ) @@ -106,5 +87,4 @@ endif # CONFIG_AWHTTPD clean:: -@rm -f $(TARGET)* - -@rm -fr awhttpd diff --git a/httpd/README b/httpd/README new file mode 100644 index 0000000000..cb42bfd66f --- /dev/null +++ b/httpd/README @@ -0,0 +1,6 @@ + +axhttpd is a small embedded web server using the axTLS library. + +It is based quite closely on the web server written by Doug Currie (original +version is here: http://www.hcsw.org/awhttpd). + diff --git a/httpd/awhttpd-3.0.7.tar b/httpd/awhttpd-3.0.7.tar deleted file mode 100644 index 79105fbe196f7f57ab442485351d5b69b4d87e2f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 194560 zcmeFaYkM2Vk-wd{!S(+TV>*dQnP=*d$g*}JijtU6BtueGyml__5Ezh%Kmfsk2Rqr1 z{k(qeUsd-U0FaawX*atOuf!r}daApttLxm=>BZ@2)Nii*;uHR?^7HWi{a^6U+Qa*+ z<$v``KfhR8-FWce{=>D6^#{LLU0c8RVD%Tt{ZBZi9Q1fNN(V{ui)L?pl0TgB%Wdy{ z9yU3f&KFZT`(KgkeL(e^1kiu+^{;nF?WH%_aZ(?TPJ4r4?Y|~|YPF-&_Audpqth&D^v?R7Y?LLP_HdN+ zTJ|u9@$%?s|5?%>^!}1HMoBX}&pN$+HW)4^+pXI6o%1Yd^#&)s(J1RCSG{p^nhmnW zq&>PbOpdcgIv!>Md3KfbF1ks(tIp`F+sKxa{Z5wh`YdgCYG+xJcALreolYldwJ#Y1 zqpKg*_m`8UXKdqIt)_pHm%S@SI{$o-Hb!X&fXT4Ox5M6e(6FhTW!=$mQ3F0sk2_Zj zQGzuW_S!e8?Fqp zes7>rFk2f>ZFt%ncbZ@%88W_P)Jsm=XS5y+N6WR^L6(BjFw)xopm*MGX3gY0?Tnd2 zmW;CDsNFrWF+`Bb#VHuCzez4qRua^X^iM18Hm-p9AE~W+ZL`-M4cf=!5#Z9KJ3c#R zDy&C89W_of`w$T6C^=_I+r4hGzP!fVN-eX?M%L*t=vtg9bn=cdK{>CsUu`9$tG;Hh z)q8!g1BEntO&jchB^~9x`;=+d>2*(P7wyq$bwJqwIyz(cP6%-D<94S#x{5<(QhTpA zg`?WuyR@60q}}9ow{7F5)n<=DoX%i46UsVptPkltn4xcgrgTk+U{c5?3hs-dOz)T zvf*;=b(bDT<8C_YWLJwx7!HN2ir&AG5J>+?4sFjB&|X33<5tHT=mn&J1}|}rX2Bd&8E@g+99KLa?>8{WM_#j zc4R2zK(1Bxvv>LmYD}|E@^m~nfu*&o{c7FboVH;# z?AYwAZ`?)%TkMyY`>+4Bm_#tm_OQ`o@8wvH__W2Y#l>c}e@NTOZaaejE0`?E#P^|b zPmol9qm^t7+CGLrAfr>J)G!w6B1NcgrrBAqt9{iNq{CDCs&`-tuf~G`9IG_wRSb?)OFfqLo+ul<~;lNS*w+7vDL~8S9?~b(3~}h zf2w~8Jr>nFOHKv|arh)Jgi<3E$z`AI=5q34kfQf=rtl`rjZaRT9Uxz`i$zJ&E6JbM z7){2NgGb36^BJFIa{x6pW)mW9qbH^B(qt~1n?R&5c5PF`vK?jvWNUSsy$dZgQp|ay zOBs-uo})#XvH&3pyUcLd9*LbDo%YUHffqkqwjPXrT%PQ!b|{U6si!V#ZEJuATN`y1 z1Tm0arC=UVTWAqe$SA=XwfjkWEGm!?LX1PO3`;CzIXPl*YQUfaA+*GJ_V*5s>QA?K zTonDD=Fd@G>F6Y2>Bk?l=4?a>T}AIua8y~sgp3qX3{WWFuxt9h(#`e&jaJf9dM`r^ zvY^p}e>6l6Qb<5Q;!#`Z4I3KTuXoNe8&-wf!uI^Hn)WB(MDjJ|v@sYrB)p5wl@JQFU&k0WyWr1rjr%z>2fm(xxPaby*f6n=iJL;kd7*T&_)6 zN}vDyKZt>7|0AAuUu^wP*#B$mYik?W|LgZx*YW$T<3d^6xVN$P+5Z3UAh(U>)#V4t z(vw8LJe*`EcawU*-;wT&vNXvmO^vKFqcU%SooBU#uh7#I@s-xN+mP;)%2dOk=w}V| z@-`KIsf$ETyv9%ZA-Mqi7&A_SnBn zZ04bE4{?HIsKmzb?*tKrmWYPtCIw>W-TZ=N=9w8}uJK?N^aeKfUiVzqppc%VeYDcF zak`jnM~eX@AqZRy{Mb7?Zf8iN)RacIZxW;oeV~1q!g^sgCOwKG45NT-WJ7FN=@AXg zf@X3N+!rDMJ!bC1Y{2wQjZ(XQI*=ZrUxm8>LrciiFH-zJn)bwNz+{(bDNQ^^UFgNT zNyj5JmQf(1i?lsLX&m=`Q6uEovEd{RPim&m8UNI7?;^3uiGHkSVGxyM2L2u~5{)fP z3Q2th;kkb-%*^yf{v%>K+ZBtxNy1jwmgnl+3bc|DcOFfn$fMavh#|4ziEW1tUV2EdM07W+2 ztrki@q`-y+*RA%+c)()zy3D`c8TLe0%x;if;6yP(Dtu#5myObqEfx zuQW?OZ}z%)5XB!DM{a0aKj8NrYa|yC^GcaWyYWuC<|$+_1ZN^A8#+GBM7+vpGw#|; zI#^B~Er>z1`_kp4$Ep$jrL=*k3FRiJb9hu{On^kS%Y+Ng1V0 zQ$p+ek^MiIX8(m*F&quLjsBI;F@Te>ieet;y>_$Ya_aWFOWiT^$MVB9WhmCH%(QeB z77MNc#T4M!s&c}x;Z2}StIndpdh;(h>W%BuYH9C@mg4F~u_N@pS6`c_ z8ICOHuX3x3C*rp4^2kPLv6-`+sJc(Qv_J&2*LCC>Z#I8VimO%8z^u*pl zA_Ohs>~#@;unoEF_$_+knu`oKC}+$Ol;ZnHnu8wJ65eE%HeF8M$TMo|o3+w$XM|%! z8wyJJ(Jf?P;2vn0J45Z})NQcQ=A7b(J@eWf8=LoGxjb{Biv-(2UYHx^3=b<% zF(IKzH;=>%;F!5!2}oVE1xRI>A#K7#_KDF>NCw=TNyp&8$Fxxer5F)yIMgY~e5CoTy!aFH|Vh z32Gw})V&!5h08O=ed7@i{JD>k%}!4!FXKfnGTL>;wZy34$HocZQo|m|K-oboqJO^2 zvOd8jw1#HpinV4**sjY)>t<5!(2K>(|D0*i|dum4ZpF3B0KBF=vaF=S;^iuRj!cVoTmNduB_eUTl@ZKlO_ zXbf$Z$F2f+!hhwI;j=zw&1Q{TyCwRc4I`;(0~ttx9V)^K6+)rzYd^K#Q?S^b*d$bRgphD5o$Q#a_4J8}S?4>>gr^pCQ3VJtT}~ zE?rQ3CTbW!;i-FL*)12{PA~OvrBUnDvfeqvkGwKAz3Z)%ui^6W^bR{l(LGl*fezVT z0Tzj1fnLn1$L>_yx=s4shv+ z+tPVEJ@|>3wgfvH+%%K4p`EY!qpS1=n04&8ra6tJtT+o7-i>uQ6$!m_Mr>TP=I+dkMp*)UPR?BqFd>3Q>R& zZ>FU)P7e@GM1S$Ju;*qnrLsj5{EbdNrQ{FyNVkXRYqr&7N)qaqvgVs%HExEr>CF%{ z!4Q|46_#=$t8NSCz{Z%2dPP|v(qj`UekTX157<--gy0=kSo=bx=8JN`UlJkuEDC?E z0_zp0Uxc)=H`69>aw`k(kcS6%wqI=@Z9Nl#T3^~kN(gbEnagx_kuM*UFtd>T$3mb) zCn@O&kgHm?Q1cv4q`v5VGD3%yhHx8DqPb+=m>?u4D2)|i)!9~>wpj<5y`RGc{~hky zkKRY_|KHpHjx39h4qpIo&i}*Jzoz`p)zy0>i9USz(DMJ*?tk|Gf0D(R0Q$>cCj7kE zeVx46+TA*+?6>``z!>YBlt(sJYB< zF7WWTzgx6d$#XP*#A0hiwnRpN7G`8@9QSj#A?1Ug`@c($NFhO_?RU}!UgpEG6zYu) zOwXsi;YcdPt9p{G5+hn$TH9ECh$(wmuO(Z!2Ci`HN#BrdHKy{J7QpG=wbKROEl|Z?nh%zd3nU4QRhiD!gYx5plk$l>Gdwif~tWIL)boC{|qq? z0^qw!hcrk-Q{2uNIaXGfxn_@kkM~z%0sUH9W-2c?0%TBYfu<%YRJ<9I{^6-t?&4DrTSUQstifZk7HHN);Q_TFcN?#?4EP7&c zQC&kp)Vzi49ZNd7O0Jn%@MaYHh+nyb1} z5*)ZNUD`XoWv0fL%$u7Pg2l>59{^Y2P7x6Xm9$#|jlXGlx*(eMu9!0$jLjo>t z9aIT35KveM6T}Z8TK+73sy1O$RH%{9A-;rdjk%&x3P{(JZADoT?_V2F$Vc){O1_3D zxJ|Qpfx;Zf?6B22BA-nm5A-HmKeNr0sfqHeXCg5GMGd>s3x(hFO9*ulCKfEe6l9K^gx>5^AS z+e|u|I(3ZJX0B)%lZzTrK)<>6M81ZK=e$s+DO?&?wy*3=a6_dck{INqZV^Lz7}Owq zoV|jtK`F5kKpNYbd~YYB2%9pVVAhd1h(%EBkt||247H8SEQ8{|i{DO=GoO&)$_B&5 z7f6i`BYE)_2A5MFaO&`td>lBqE${~?Hk>PhAs(bZuM#5|erpeEacQ)Njld?U#Qm(J z3)Yl0z2T!|er-XbCm8rZ$r%prbHd#7>kE*s9QPWH?W7=2g6}{$8rn<6l{zl*NV=0{ z>LPEkyu!d-Vd7yK%l+AcdSFd!kr53J>{IS?4MK!jWH$kIWt zId0Gw!!RKtFFI0BN!1^+;VRSWXy4h?WWm^5>y@?2eYAW?N<>^|%jO?Y&QN`dI6 zFT}lYsbHy@CDt8w`x&50;e@@%JF4hZ4E8oq2|q%o5zqIJG4oVB8c;) z>2c`Zv1LhkC%Haj!7H5dVuY-}8+;kE$HbX1g&4{R+u$Egj>I%$l#957xTT2~MOk1c zNdv1sj1Uxr2{{|UxD7N#wAhHQN z1f2#`dyp9{7V<67dd;aV#DrSJn|c?^wf`4%-y4);RM?}fgI9-1efL?ixwrdl`)GS_ z_b_?Bcfg-!Q7tCVwhxaEwx7P%D{J^_@7ebA?ajI#NEKKOj?fvZQXoguc9_2FF^WeA z&LGVYchRs$LTQh<6j+cVZS*RlDA*3!tQLAtJu0r{guLXUk9u;G^9^dE?;MAwqd}Xq z)eEgSP3QKV80OHP$s4{{Bp(-EW}2RcZ(<=540F)vjqgE|b2gP@a-6lBt>*}hQ$EPK zBqPKb#uVO&3HL-Zr2ukaJRoZ2m0Kg((w@ zwJ?C(hR_TYb}f^Pxx&P9(b8QuE9j!#$)ZREl537Gej;^k{w16dM$iJq2&?dcI%Js9 zH)mZam%!pG#zJ_L4wikS#kqPbo~N9jqomlN;B<7^P2Yd=iIZL3DHzb*Qy9ErMUj)g5ufCN6uK&~$XlwiT)N zo(aZBT68#;=)!USDc$NC5A01 zjW}trYE-3(-x-$m7%i{VhN$sKZI-j09YR8Kdwgc++x(DN)PGq*@>kl8F-HLq zGD0*Ki}7+~3{UzpD-keE!gPc%$Z{)SM2#kJ9)V#JjZWIuAvgvdCI8nRWn@c;0^r%2 zPR&1)YtU{kTD1?kr8 zpqcOM5~5kEe3jhNG3C`{iJJ9KuZ9Xx5ZUlBls0oT*SsgAV$)s4ZkZ=b1!~;M>pEYY ziG-`(QG3BWTx{gY@am7IpWG#t0 zO1HR{75h#MB+x7?n#S78tjM(d5;qo>a#6y;Fq_<3%>uSF=n~RE;Xcdcy@p79?U3k@ zYmnoQBrgeEEEGmSamdF<0>_iX-FSWj)zkDjos(mG2a+=wmdIfaY+sgOUpmim2$2IR zCKn0Mtx#JF;s#UWFxr%Sj(e>nV6_fmX9d$1p04TO$G`=~TQ;sm*Tlml*6o>s;)puU zOK0s$1R56BVAyxO8)Utfj3CMOLQ_IQg6i-TM5|m0-F0#@S9j$ORfw)Ig>ETk5&>GP>fk2Lc{hzQQ@dM%Rz9fW!c~gsJjVa z?1=U7Pf&AM^lP`~qRA!s9@vNM0a8^6R+}qVs*xs8);mN=!;IZ0PNNQlROx$X;27gy z{DNLLBM(s+!+V%79)MDBaEdEyTbP0VOsK+K$3?(SsYT(S!d_$lvd=-TVC@I9Y*n=Fv7634J zh}(It1O(;>6>A4nQ}-NESYQ<6|gO&727mij#5W%A_i%O)eV{mZZdjL&U+nl?^qA4 zUSdQ846DG?J>sMJx$euJ2waF`)F$g`S&Yuvrf_3ciYpuieVLToC={-!0u`8aE?l0% zJQF7WK{3iYGhb)xJ1JxX**=*q6SDKn<0NW*cbTFnu&&WPkWOHs4Dla zM8OQ?GBchfm~v@=fkJ<(Hj(dYJiE-XyCx+#$E>2|~81=DF zBL@%SW~g&<4U%i|?=$&;H9#$#UIS5ADVe8ivzm*7fvbrvkoC-iVhR)VSemk2Dn}9u zX*fo&HM5f*m6EgR<(6eSd=#B9sKi(yCtM>hhT)`k#lYBvekXr|fTzIkmo z}`HOB69fus&1<90ZfXu1Qn5lcjge6>^vNL^4oJF#*MzpU5 zPi@sQ1D_TVeJ=8qeVKC{eP{J&eCs=M5eRs2yi2zcW{eBlflkJjJbyMg=i2R15J*bOnE$qIs}@Xe>f(xl)_c5TD^m zivG#~8B`ye1yW;K&Nw;~4{V&Jf8m{G1(#OHYu;z55&O{wS4}X7dtF6`v^i>%S#`V% zjJG;}OQBq3*PGsAmPX!HEvW6HMDc%%$yc$5kZ%?E2--q{UCG+A_yQf#PiBM;o@zi3 z>7&NC%y1>)-_jtA8q7^?s}Qz_uuBp!E?p}iGy%Y9qX^y=mawIQ8!)grw&3BgP*}s* zC%#^^qc~txwRTFpU8s=zl9h+>s6EBG6H^;)4kaKH?xGSh6g5badxg#*D$?iZN-{b4 zmpsj&np(`YARyy^L6<?E~i0@73Ifa%&3<-4qc-sm_I8huQP^K%lBdQEJ%g6pis_S86TK8WH=y1 ztQ;M(RicJg%#=L@*AZG{<^qMA0z%ysvVrMPE1As@mCPGC3*rDMiGXW`t?fzvTIfz& z=UYtOyYEXE$NTr1}`M&8N=`V;~m8M2?73HNnDm zk;36L!on0JTwNHpo-DqS>MrK3nBb9Fym%s^c_U*5=}t)q5bwo$ARLlM?}MQ@Js*dI zaIqu5q`>%qv^VKFCspT!xhi z3uKDe=kcEinVOW33eC?n63pe;alxs>sXtSANGK%p@yHL_f744%p=? zq^MOiHcOPLcZHd7wPYy;rOjQ^6JjqgKk*%u1n?@M6}Bv+mAHZ#@<1sX3_^S@{Dm25 zS_Sj)DH`W7!y=@7iWnGGMDH;qC*@fUPED)*laygT);Z z#{dztGNkVqsoP(^>qVR~okr{DyS|U3A5z85ZU?cTLKNC5jgVd}$_L})HH>JKo#33vZF?il+{sZ{Vn1aSeJ$*_yq1BBc#ADH za)IKftkJ{SDz9uEvz}6|^OT(0iBfe{4$ioaN`IR2z4pl}6Bh)YQ)k(#iipm_q>MUC0v={aKh&8#$W{)N(&eE9-Bj7c%6#E-=j6m5CgArHAyVc)i?D?7NPwMwbZkCY)dSpaDRMWx-_(mFyqvy*Q}9 zO12Nbt^K3q&C9Lb+Md9_*=9V4M|FL$y_>wDOtp$es{x{rMG^-leOLwg7Ndxu+KMl%L~+aUa4 z`|uCc#jgd#{_%BP6;llm*aiQu>bsk^Q2MB}keY7t-QH`!9Wrl&0^cBzDeD8ww7Ax3kdY^HJfdF z*A}Iw`SR-M<@Uj|xS#Z(o;7qUq(DK5)WGS9*(X9ULTNuEz&`*uMaJcOSg7wHC1UwpJQ<#@s;_YW7@GJLUO>o~z zX{g(AKJ+$}?jv)k@$fq_++B3CAmxVQjzKbpt1l4FQn-S+b8or{&J?A})hvWSQ01&{ zv+_Y=`4Q9c=}3~)O}k)m%Vdx3#wQZIPTo6ohl~%=Muu?TVTo$@eW@*-PTv$m5j*Bs}iZ%-08{lx(3lj{|w;vj{s*m|V< zU>zy`V^HQ8p())8Kz<;tRE1WWK_D)d00+WMI(Wi zJhv#^#e|}ON3SDPs}mS(88_+VY_W{Nc%03unBiKPkke?M?;)nSPD6xcgSY|BQfw{1 z#O*9UJ>c&9GF=DXq{vr99Z`EdVC%OM#w>^lXG}}``6dy zgbBk+MTZ)~sS+~CaNoqtaQ3k|bnvZN_9N|#ImzooPy9EBq*z@R(y3l_(Xg@A<)4YB z)q~$HPSi%wZcdyXW9tT%sc#!esyyHF?jPdmGM zamR})*tQUlD)WOv_Q!c5#xBl*ksdRxEmoUbk+Xdqh?cz;)XphY^VV4I zn)fFnkzs?ULhcRxOI99LR+{-2+!BQ?bY~AOoMZwv{&Cy?q*R^ZC(V``_^!y!)vnCC z1T+b^50{q2$t7CxA1OL(+$+!@i207;gvr|Z1{LSACaQeVyW+EXHk<}+@l$h(hp)+0 zBKgD41rKUN8Sorcr7J*T zCU+DbE6SqTfnFdfSHenM4Th>S>p8G=_IsM#-%4LgNf?y=-o53GY# zCkST1eHakF>4&Cs7^z7G1#FWTyY`CcMB-wi)QC$6R1I@qo6e2N<&Zm$2ddhY>uf==B3@NoU%=lW0o9VAqLvw{C0ti8Nb#f5h9 zo*KI{r?&JFerjGI5_tm~Rai7$9-zA6#OlZ{M|W2hnNYbC&ZO89jK)(35$Aq33_u>p zfrS-SjwC!RdmZ)2GSn1TpuTX1@yE4S1C@r6w6g3`q7u64fk&p+;x6m&r z@$hl5{c)g(LTnw@rD1nv>Z&@rE<$n#H#(67E2Brbun00`PKzP-7>X6khDsqFSyrb8Sj)kR65W!N_e4UINok!;(-uCM zMzEYDzr$Enn<0l`Qx8;~>Ie~tQb91mmLnw0098#1(rL#Ex$7V#rV#=>kIYr@=|`Y- z(nZRM)VYp|I%ByIFPSGL&?|iK-0UVwKuaaoJ#vN{^;|+Do6R>5Uz5{JNR*A@l}OP< zZLcV^6bBs`tTnv!w04yjG4699hb1razVn>tQXewfyr{m1Q%kRM97sFS(8^@;aVYxZ zKoR}u2%qJ$bG2r23~9`gXF~fKefcy!VQJxShk`%@^_g_nu)|vz>R&FRF-dH?Mwl67nz8N%@ zkAsYl14Sqerhw)#M`9oQn3KwWKgL`#@99|ilTtxcE2zOvuq-C8WPj)1?$|LMb^ull zxJ*?So8+9`Q=qYmrzokO?FHp6gz91{kZda9nv8+oiNB+$GHf$whKPlBMk7P){+^Ro|Z9w^+ zXhNS6FgS|O#n|}WQ~GWlnta+C>~KVyN*sBKFg_C2Kb0;R^?yQvgaSxK|Cp^ox*)f7n%OCGZJX~OS83oU83N(gGsxp;S(cs($pT(k~~!m2T5@+hfG!&o#cR24IYVj?i$>$HgxVNI)xfRW7B_f^$>!eF+FW29%K|rN`g<%+?l;+mw9?{AFSJj)*+(mdc0%3^HElXV z1y&vY!cNvgXR+%8?EHlQ=l6kOsPU@D#iUY?Krjju3mLqHrs~_o@();&!o4ZoJkBYP zt}0|FQm|R)NI?To>#V!t|2#+@D}&m?bFWNM2Pyt4*YxtD>}ts!Ly%xwiMDg0o%O_h zJ6>!A9D3dxv#?-91)y^6?PI}0-;1Mwz|DUt&$@yJo@6A8z+0H!sR%{?{DGA)Gp913 zRqH;WDF{O~k@8Qr(j|0?w*J^t$83^^VK%;@XhQlwH6n0-yYsYs96%_KHlJx#I&Z7d zmM=g6;`aVWoL>4lg;|gflkMpgj6=i;Z<4V0J3NQbSW0ezYgI>>O z<%Z!f7H)l4?Eo|!n2!CLLo)&aoT*9b8n7yms_m-kd6w%{;~`}-lE+pnLxHS`4)f=3 z^V_*y%?)biY9BKdAvEbd;RvsxD&Gpe*>G{|gUBc>OlyZ?1j$?|Ir%Hn1WoJen<~_r z5=~`yT_%q;iivURk;N{Anm{_b4vY?<4>1w{)+Z2lzhXR2N=8Ka042(DJeD^0Ewj;> z>94~*^3JE@o-TDQOD;?9?$i&D?y_AfNU^OaAa|c{ALQ?e9^$UBss$n!#RJTJ@tzdo zZN=eV9=+PpqQQWnm!Ynax8QtkyQMRpM_tFso z$**z=I&sb!Vy0E|JNSg zd$6|pU`_Ww+*@0F@LB)=6l*aFb93{XlSZSq`FyAT;_#bfX^*St-pIyY+FltC2P<|t z)C%!W-5HcDk>vJe@*0;2MKlyZlv)~V%OGfAB`}Mqm7xXLbwRZ+-y3|gL>`D;NV(LZ zl4`Q_Y$v}7=hm*p&YBtbUg`FRQl~e}=cHEK*?y{t@06xX=(JXQy1lDwr@sk1q;|OX z`haBCZ=~}qH&7oq;o2a-Z^VCP+VGDLonQQ}Kz`AUVEi-Y0xi4K)gGN?Z%w@M2Vz(M zMb+h>oTc--i3?wO{^fev|Am{%ec6 zkSz5|P53p;L`^jLh1xIwJtMau{FB@%2Y%l7_dEI5;^@&Be0g-V|18jh*XocuiX+;b z%EK?j{`FJ&+8_Ol|5m;>2Px|zr<%;dYD(Su>gw7O|G6il%YQ0gzogg~q5jg@9P=$n z*NV>9m|`d36C*DSzL_O=v|ECaM^s)vmA+>Qt+KfnQ^5Sw$*=RL@B7QFzRd-vVIJTo zd$kqyZNE<=uBwf_^0gViUg$(v2?;lI1&LxHR(>j9SKhqO9}{1HOX8KPB+BP~IvVvK zt*l&JTr8h9h8N4+x49BUTmU`s_4{;KYBTxub9jyrhPLV1nWk>z^FZ~8_kR_iPkvpz zd7s~kuitl9mfPK_5v-x6_ACx^ce$6`#gvEe`4tKI?xUcNJzs`_dzd zarw<%R7$+7-u$gG3Ssya&}eQlO{TGbFWn!Q5{0Ewl=I}Tyc zCaFRcqkkWD*9>c^)w2}eA=A~+8Yp*`XdC(}>EJ=n z_FO!jb5(o08I$?Ut2&wc0pctcq7qwGo^Ktzz~&0GN6MNg3%G=?WAs=+_Oj-ev1-FeOvvtw|f<#vo7<#r4vA9jpoKeYrUx~BNu?U-JzwhZ7$ zm?qKqh-S)C17$;dx@@t?Fwwr`*}u8j!}%(HEsZo`u~G_YwPC! zefT;5EW}L=Y*g1?`}5YpGVdBP2she z-6bq%NJX0)x-lbUCFuB*&}+5VL;|D5;|4D&nS?HtBk7s0)lt9PfBmNbW!A@}r(8Dr zoazb(s4a(C&hXs1?7r-vo!3YitGub@Y3=IB4j<(?<;tZw4lZ$i({Uk%4pYCGz4i)a zw~b46>o~(vY<7YeGARV4k3_pmiPbqk%} zHn|P8osr@3s@;9@#uFN3P}JWn*Xl%8!||w`%9K!(ubB}eEu&f*aN__Le&Kc1fl55@n>_rGu4`+WZA zA4mLqK*;(3AIF?*T{_fNOUVnBCAy9$!=1z7Nf<%uC5#mH)3MeZ8io86IEl&56j5%x zBhe&ykHlw{!)^s3NC;77a4!kZ9wje_G{ohgT&Bt&EQj$uQB_=PDl1VBTtr!{$x{TZ zMxqk#i)1o;p@tojNUCpUfi1+5|MofA@r}yZ>n^;DWFBMxH0>i2IEu`bNhhr8LdZ^2 zp*qVE*@&4qthJ?zs5l|`XPK0>?r7bpFUx8^Y>1bkJTTEJFj3mZwPBo+q@e z@H?qJ%5JoJ40wqtY=$7F@BjzcwIU%kOZPItD?CZRaw$a&A_f7a+e=A35~Tc2pA&q> z2C&F&8uj`y(Nh|1uI0JM)znw#4PIP?m@ctPx(95$*PV*WMt)K^Qg>&UBiMfbOFThn z+SB!nW|DQpziYKuDr@7|4qHTr%2*UwrhBM|J=E_o`=m$?BqLDzG(}*@0YvL5kWUtY zpSJ_QoOH;uyu^sjr4GN=!rAYZXGKH5J)4z>4nn%BCJwATv6Fq|lw)^tSqTHJEczDR z8ythG1DD|vE>gCtW2l*ahJawLc}W6*vd-Z2)SqRROQy?*q~jtx&}@*EI6?Wr1J!^g zPHR$}LGfx)F)+w$JSE8z7jBY%HAq&-8CyY_>yv}I0$2AgG|-#i2?MSWg0pM8NWZ#F z{u6oCtoD*DS$T}+e_D6jRQXYGL= zA%%ldmBFv70IA9%#_R%cq*G2U>ba#)TJpAEouT~8`E6x4v+Sx>Qe^9i#IPA&Z$C>m z)*n82$gMNA=iHjWa4VZrx9$pKkqBdiUkezq$Q-~!$PePAW6S}v<2N>wKnwPO<&Wv1 z+}Z=9@Bq?EHfpR48h06pTuPy)w=HVPA3vo37|gF=KKbn`Gtf`e0Hy_d+<8;~h64mb ztC9BmY{BdIo)fdD>Q__beWyg?hLlx+g}V|spGRWIm0d^$Q6r8ho0SgW*AlR}Y zwIq;8o@`=*?mI{z542tAOfn!MOXDn)RuV!mrl`nVpc<8b5WE~d8$TQ$NEGJ_X}`)6 z786v`ms#>`rxFQ7UX2!)lIuF>bItjYItZ@{w#4uv53cS;wIlI~C6JY%T;_05nSDLbfmbRAaX?wSKqM9UbttuA1-=z;6x*|% zQ|!Z>aa!1o?~7N#IAoc&w;m;PVTH(>I9uUtqMrnZdrA`q?(pi2-S7?wbIM1lw&wlB z_r4;7{OoqoY4vC1OCYBVTU;!B7r{Ya;ae&pD&qNsFev2om69KkXw5mXiN@3CuA5`{im?g1(RZl;kw8 z+sodSDh524;-7XFYAQl#$&xQO58o`hXU^Ju&H#H4*UJBjCeiYM$4c>mTm z@c*sfUtM1(6>OFG&&I=z&-q`UU?rwOB9S(hSBsN0H~Rj9uB@v~5Tr|%Naajdo&k>@ zSy}$*Schp-WQ00ydVi>B!Du+`l_-RA*}^NtfeSv#b_|`eWh(`ex(DH0qfSu;8!}f2 z0GOXa!rt;zZg%QZprUzghge-(n3odZK1LJ!A?aG@CByjr@Gb>TFyWNno)=p{U(~gA z5^|Md5sZ5sGux_5tSu0{p;m|;0CpIb5HG`1gP;42oJukX(6bdb=`Q)f0ck|s40-hp zxAlyrhP64j8I&-qIbrHKx(=%X9%6+IFBqb4(edn-M!CS~2xRQP+@Er0a5?eEAK!aa zrZC@5P!cuNP{siin`=lowGs^~;n)j0s#6{}NuybK{Uutt;)-97lt0<8X(UC(Ds?y$ zJCvfOTrt+}@_xB?R};pO5zZ#2bjeDM&SECsEJz6y@ejo=S62P?WihseFIl5|L>!ZVfCq9a@kA&Du30@`CpGAV?5skmJg+Fm6pNMrUYig10C%`91BCDRpJi#{ z2~%Mz}S6i+`8>{tMop|oG zh#ldd#0gSj24(~2APUqKa#rhNK2#Z4*i^Qdw$WIID8)6)C<(Ps>u+W;xxn|_pC`

    PpdMSHTjjE zCf_*h@8|T_+@HTj9|`V?979@D7mDV(iXOypVESeZ+^~pR%Nn;~yrMYd+xoL-2Tb4b z=JAB>eO0GJP8p80I4*>jNw4uv~yr<~%4ni|{{EX?(`N;nG8hm(TKe`@2DF($Lqp$F}ihqm7Iz0kV zj471Jc=P6s;JNwrRtHXvVL`$0``vb<*I{=&&AL6LpthSvzy+u#sb}g{0o|%P82x<` zzKg1z7LwytsXT=K^bD_NLP_EakYTma^epIBuIf04@C>f~`q9g`+q=*A-fNg;%|7_| zti+k++1f3$T1zX-<^lhb)GviKh!>gdP^-!NwQ_dle=Z|MYBf9lCuThTaz#$|mEmYC zLGs4b0L4Da-`kq_J)vU7bEQw_B2j_oe5clO1c*S(<<&$AkTU;++m#aKe=sn_6K*Bie|_|YK29$hr|;OO%R`bx;CShUR1bf^>sN{$#~nRfQ82)oY5Q5}9XLW) z+LrBG?LltmUS_x1usVKo@<}>4R&^ctqppHL=EEXRc}J^521%$W|9lpk zt7%5oCH!g#ga()R%Jb|QlF9tPEhM}A{cDoc#J9tp6jn{sLJE1+^)}Jki|h_k551Sl zf4EE!r8UUdA>m27G!+!|xP;9|nCC15rHDY7yB^9Ck*Nz)q$hsVi-isl`{hwZJET7&+EFbv(mi_d z&$u{vMfn}W>BqQ~CK`{~%cG`Rsw+!w%#x?|%|Gnyy-3#X=Z}KQnar75HC*@U%=?<2QLnR zw3-8Yy0f?Whr{jv*h=oL{;t&X_AYlR)_2}+?(K4&pDycrd$_ZAq>qc?+0~10-*8{y z+oQd=$|inmwN{h09DcRQA=j^kChONUF({gJl5AYl#GrVS0wdnhvprbj+h<%fnE%`_ z#(VVL{+8Kl#r*A&4Z0Y!Ju}baIxC5WMul;+R>H48!H1`x-jy2#3r%5i$uXR{Uxz<1 z8bw9jmlWL8*niRsWLtLLq?KThZ$`u1?lA4X=zI_#1f?x19c>0&`N*HJJlCB zzIqqp>y~?=-q32NTQJ_r!~7_7Lt0C#N*HAc18-pI_|lIg|BPYYCu)Z zbEBcqFwmb-l{4DAjV`UND>-(mT?ww9>TU?`H8`7}`F-pcUJyIhM^Hkbf!Uu`+V*ID zdo$&tYAm<6+^r)YVn3)?rw#IDfyzfY?cYKCVPw zyNU5L6l81&}`3fLOksK0yPb~yb0g#rh6BX`G z+F>9q^<^8L%H5;z5Ka^}|FHl4pLMl~E=RdU?a_TZHl<-Be8(JG6#jg#Z(~=fYWV(W z)r&%pzS(UY;iVLc%1guk@wnY-7Mjwv%PC0Ywo{nUN{TCX5NIfjp*<9f@YRug=CKo# zxgxZr0zn;GQ1w=UjHn7-+hw4jyu?O@%X&wonW_edgnsDS&~INBg*qx9+Mx1x6@n!gXkoAP|KaEJ{~v(p5BTIu3r|d!yZ;iSS)N)8fV&uu zA*&*zN)owL7JEj$dx0tP$3M8>y}*2giuYk292fc0e|=y_N4}IeGUd7`7q1=<|KU>j zf)WCKu3zEC&ij(@g=$wNz51r^KcF_gddIz8E{=_WOPO>gpJL7Z>c}-z zNzn3r4ewcWUw~5E1Eo}p(($qqdr^vvk{GYKLjV+ijI#TJazowy91$+!E!XSIiHDXl z^JP&6t*FpnMcX6=#`L;dOY{p2xd7ySu~fM_B6HY^SSzHiC?0Iu6R z<`!td_hg5nguiF;++hm!6 z%nQyp$?oeNZod49XB=m={9=99#8tMK%pGQax;9)~Wd1W!E`I3F85E5LkIbt5@pm8F z(i7Ab2FUoDVC}gAo|0n2GSNQDCb4-=O z9r&1iF`|#GeB(q2lqr&=psRvNtQuMCz?v(iM9$&J>MlKLi6ZHBGfGr~Vbq6)er0=9HKu!CzXUNpnK|3|E)asJRjQ?SA(CI-bw5cSJm9^zH9sEr8{_sN==0ITJQIRGRSLuiD zuZMGsfV<%*66npX0*%gVg+hQ_JSz{#FC_n#%)yNk4&6ITGC!=fF9p!UhJhtvj@VxF zttc*dJ?NioY*W!F3q5IOaTSxqSf7At0bqIjcR}M^;#Akqgwi^PVUf@KPEJV%AgFp) z24+`ldpF;&{@Hc_E35mq!^5@s@MjI4Zoc>?S&c(hz*R6UztqsGdhV8P+Zz~aW_Brj z%Is5Hreerolp;O`$xF+6;7v8_BTwn@h7-7DEJ_MuYv5r&!@Z1q-ctXPgjai<{X=BI zvPkKbz|`GSUH9;2NucW~DUJA{e3t3UAl+HVAq(f{BXP7)6FA>uMq$Bd6vs zDvo-9C1H;UY!Sb5a0Qp0TY;HQa;-r7v%V~IbB#?j2@AOvhV9`(AMgOP6r8MaZpbV! zuo&j=>y@iO@bC{;xBuzB%LGq?I4UzZ{}!*VRF&Y4yt!hvkd=gEtmy{Gk^Lk@vS@xysv z&3f|qYo6|;HrM1i<*(q~9*oZ2hW=;ttovW3Fo8cPd)s3gf@y8=d%=#z41WfjYbyBa z3hcxjkQ%F!G&6@?dC9=z-}%tvgE)BpzQ1blN)ymSby1!I&(^G+TNmFXb2qvnqrlc7 z0K~G&x+$oPOyp#d()Z)^eLy^jij67!7W6iKe@4*R(PAmAcUz=+-mJWbw|9pbNttV| zZwdd(u|OmGW|i{?>7e@!lLOK;ve)c+tIt4NO0b!au6wM~fmCb0GF_Awx7hDn2M2ox zkGKrdj^au&0-obVK$APa9^OG`$4Uv&fgr_Akjkhvg_{3fpyp9^rbRx(aE3+F>MuxP zEjuu@K|M7_2DJ?u#DH8+9dWA$459r6b;xIBSd*?3!SM}oqOqsrmfA?;iEVyji29lG znt%XJ|6P}Ie)N7uIYT>ls);|Eo<4?_7A@E0Q91^Luf7r<^ivE)f5~^Df3+6Owvlp> z^{hW1Ah1{-znnAsBiH4K*@Ye()`SU_l^&>#E<8Lb2Rq3cl&V`W_ttV_6eRbXJ zH+7~?C)PQVZ`ZObBAooXN#())^Lq=n{8iv_x`J7mzaCU^peLrT=@(c;vsq-R1%H#j znf&bUhPv?SEf{<-g+kmw%9JWn@V%4wz^yl##O{OnDh6hv_k$4p;5G!$K=CXjSI~SD zqGx^V$d-o#yCl%^b+b_@n3Ifo0SY;fUi^A(D#81%3b-cd+Q zEqHtZPaKIcR+cN$tH_AAk8$ticFc9te2U@bWmK3s<+C9l^pH{Y%gh;`g;`plA zzYXCf89asa(z{QD_EHb;k9kA)&q8*ooBwHimld2TgqL4_B8->2cn_5SJYt$mu9%+S z3`x0$k94j_6hqRSO>~`>iB=>I0=JQGWtPNnNUhebpiHaGLH%?KL)_&mKgGLY6P#bM z-8(takB&(c>3kM(eAiET0(q{5e<;36I{ZI^BEWnKtPs$eiI}^&Y9u}M&hnk)H@`{p zhhHHO^!SI>J2x^8(-xIvQ%dvkBBplbg2ho%<&3l`Vl7Qll~6blO>+8(!ap+ghIZ2F zhN(}>=g7H>2xL_ABFX=}Z5T6MZbKCN4Mg3JkZrQkFGCF7`bmZd>NWtLiUywJJuafcUvY{s~ah=^2%}y)qMS7qlu~}Vm(obYJG3#J{ zc`PDXiMIW0nLf6O&%h*Qqf^zGO?AJ{j zObKG7O^v9kcS)($Q~el=&PLqK5=XxRS4>4e&bx<&S`yi}UP=wAXl*vXeD*F5@;}Y%pHh?;r539vi0hasGz^wT1Dfc`*-O45=64AQS-! zi84!O38*oKzPycj(!^c-i{%6ilwq?f1;pP847m-{FEEHLA!F)`Qn;}4VHnp9IXbF? z5{I9sWO+swMJ;W{r8EwWT)B_>e=J7g;#P0GGzWvz*&Twi*Y&6^!C zC9~0W*a8PuJAjOpqU3h5Y`mwY*(+{nv4VVi^ScX*O;J)?Wx}Y&MKxd<*V>Ix9Eua^ zH~L(V!w=m4m?)p_Z=s2(VW>nT+rU#qJY%=!Nu@L1X(zLjh}wA-R7g6+>x_PL+A`!w ztt&R1yuwU6-+l!EBdgqfA^xULCZcR{x5q7@456r>>AMIH z$VR#XO^u1zgPM?vY1Nm*6#Wq=0#PyF2?_d%#)M5i!i+DA&w~YRdp_#B`P+pe;A)$C z+t#$%h8y9rC~a8TC!nBW_d%(Qq=!k zm;N*wpj4s<_wGqGT9d9<`d6>kACl~2_22GqJXqr{aL)gJuK)O9>fF!%>a+egt^du^ z_2A0nfx%fw6e0jb@Y5?<=N3Qf3?26 zy0Wsh`@`H5zEbt@Cyyob_1DohW#gXA?DFx7zogZQHGlkc@7Z?-V(rP)0BN(vyCbx! zSU;2^^tz5vGkIK3ULI^c|K^7|4Sw#4u3>n*Qh&1ic;5gX=)WrlA3z$R`3)lPv@Flk zAI<@PR$_RGKgP5rE#md%UnUl@bR^{VMO>w<-aV@$`ds&{{m|VER|g!CSys9_z?RV$ zB;wX_UimyO#A7hLjZkXKcdmS5O08cZ!lTu$aI-zMI>iTp#!7rVd|z9V=O05iV7bywhZmA9d5V5M#sy(pwOdt6zYMB^ z{aFpPAwMd%b=o|XDMCeYDwnb4xlWTO9!i9Li$sX>-;XnY8V8Vs{7v$ooIT`!<^1Qv zwa@22Z&|sI^ZK*=pO*iHtS@{$*X8!=1n3RrUrPXPbPYw%kVh>&ua|@zXMn+mw0Gfm z3Q3xVUpXXNX>g58r_|;X91+daI!UFt#1vFn`~2ugNHCK9Q@pG?lBOaQFkQR%_2!eQ zligy7(ydKZrn`)~{10BtJSb{j1ziI)OjhL+;8q&@#xmCIW>kyH$3u`@nbdBP23$Ea zrM(qED0S}j{QV^*&ZptHaUA}ud;t3>++d}uk}VAopB2@hECpK$ z#s+VegHP470_licy@nLjg%zyRgCnV=lc#R%FxM>F3$92r*sVuLvgDFdd1ts1^24y| zC_iziKkPW{PzMPoaKIg)a#wgUH9)&JLW7?VK(s%C?W~FDr{t2VViaiB^W+@O#MYNC zF=L!Qq_$1DBrpD*+FaH>bi0_F{$cTcdq*lo$z8GQ#a5eARk^-xDOdJ>=I11+@+gDXABN0dLK zYjU3F+j!8E_T%eH)${JFucGhTxO(2724D60&XS+kXj28M%K@?+cHyXx0%}UZ(UBr< zcN(9ZhIpC6P|8!qv6CsuL0x!}++?WhQ7m~Ph&zp3Ki5q=mu{t;i0E+72N~V_$Xns! z@5Pa&@sKN4LdlYb?y~2&yCyOIAq?VG6z#k(1+SU3v9Xn2x7yyd)S&Ls_De<*&9pg*F?d?aq+X5x~9{ zBtw0S=ln_XScg`EZ^>sVJj@sbnD#FW>81b3!DTnb5cRYR`tsZOd;r%%vz|+U>{mgv zb2Lx_;hXoHg}cVyYxpZc=KHO;bh)XsYzjKuGFoA4C7kQaBW2IBRyyvC+^HxeybqA< zGS%g5jNr@w{YN(7{1|5?L?t0;$u&DqpS;tdK-I@iat*=}4b=>EQ@S94F6C zoFZYJOp6CXN;US3b|M7PzN|M6kd@4;sneWQywEE*2a7k{Qut#kiPpcFhpHKI`n-6b?KO`+d)?<$xV66~u^F+KgjT^!%L3r)3odjA;+N zn{jF_q?K;0KYZ{oOr1x{?JOP{a7{VS-PPg}S`?Dx^WM>UPV%psS*+$pjMTBENqGM;{EX?8eG>NeiaSC4tM_>|^qb0zw&% z;MJ`5 zn=f~snGY4rIj&;4r^CIS`oZ>L1^WK>{uULQsMK!V#_Bzsa`VH1#W$3TSRSTty{7#D z$C>FGcFhJw%=OybFSeVD*McCi{-estghPKyZjFwsed)F zTgW$)wcq{jcZ(>utGc80_nZ~p?+xFj-5&`wJ^oA9`uDU!ULdN?6K(7$8`AbWWfEn+#8&D@ieQfI!0GYxasdZsWzO~9IEZ}0Zf6oly#w$ zD1e=%qX?D~gvnCN+gQ$2$cfr+dI19~^k#$c+fUIn$tC0*cRILY>gj-_I7XK$V0)Ty znG))nZec9K-`t#*$He_+3SCF=HmC~Ut0K^xU5MWApr6elpn{S36Fkgyw2+JEe~9~V zu@T4;D^iCB<0l_IAya&TTtL|w)_zLnT*#7am|wX*m;8M(zCp2=@nXaQulT~pq)+6u zwMtA5cQCrl8x7ixQ^C(cXQh{yOR)Cx%hB*W|B~VJn)|M?;+ji#7IHiH^7E5+OV8V9XrL?lBYyCg{z>uTFa7MK^oBq3Zzf+|_oh|u zsPfUM{Dwb@G1wn@PnB2w<%KPkFUjT7eQxy4UHsp~GKaE}aeSxANERQopdillBr>JUq;CU4lRB{kgH#*ufxeE>XHI%epY) zs~m`L>z>C@C%~B`P(x@ooKALEh^{0T%X!Tx=@U=`%@Ny|SVDeEl8}HTX z@_kyhPJDxwrZ}U=G;owkE3T6`?F~3mmMxXJe40+70~S`a<$Pg2lQcb^o^PqG=q%D) z>-3)5M#e7hscgQ|`-iu@zkkbnW4brMzwvVlAL)IW;#y+@(HSq$-|}G&FHHE9+p$?s zb+c7^o-JXJmKrymDO4NlVMNLaN2eycy*38&f_aI(C(h25%vaoqYmoU6u8SJe;j)xeR6uxqXDNBprm5OVV)Bhy<7^dN?b2U z*~+lac$jxKgB$~tLhht4)rL$9*m|?tVi+naiia!VqBL?{x~+8-Nv5A zCd2c4vs=X%<%R=SAu4E5JD%swPN(rZJcXc&2D7NE+N5nluS`6Uv#PT3BEp$TqhyRxm@C4 zhMvbZ-5DKDG$BuUvZu45t}4ud^!rmZ*Y90qgMN=NLf-0PU<{cwp{%oVJ}6mp_6IaF zD1Vm;&2Iv@a2_+T#sO3t6d1Vi;_WkPCoEO+F#bQ zh!1|Bf>>%->{S{Xg~;ArDYcl;MbzvjfZn_W_87Z}`MT80;p%A|;^^eZ$@M_Oh!pb{ z>0tTRM#n#{PlGuIOo81QP9E1&v?)`8rrV<*jjB(JbhE-WU%G(E&n)|;)5%W? zS^E>adD_I51!ffk&fno}Axs)lywu}{oyJ~#v%B}QzWX9ZBJ=jbMD?m_03!=RW#7IP zOtWluNe9KW@Akj>hU&m~bfDRPAC#(v@kI616zkNF3k(0tPYd_GHYEel7@*-d18e}| zFRgLcBBvHvVOVxa_JV5JjFOWv?syLCWJAGCIfmZppu`Ud&d5tI$*d!OerlXTI7-Cw zy!`G}eu17o#L+=kaGKtt!XQXiJf^psU&D|P2_`YiiD|x|!Am8=M>54TH08}C+ zprpx*-Pg%hyzo*ntQd~}I5(8neyaTv%_hGOoz%A4FHO@*`rj~+uT>n0!7ME~ZGPbd zmwfeAU)P)0ei!cpGgn_6W(hr$o zhLc<`v@5)IwjPZxPtK%S*h)Ol&wwk8ri2vfnT7tRta+Yk5_+x8#+YIO=~nlvdF!#z z<>CjkG&rx<5Qby<_<+`$v+d%(Q~`I}hL(!;zL&R$EG;g6cf1KXO5)7f2H8hOcAV!Y zH{@NruTqHIx^f~^jPPrvjm&dJ;<1CfLK=t!#tc+pt5lf4 z8I91_{^lEq#jdMg%CnrvMd^QEJiZZ-jU#p!Qq0POW<|L~M@1!ld3~Hdhq#8N$?@w~ zUor54MUvcVh%2v3ySys03*UET$_rvpiH{oom2?Sn68E%~DiNhH$t*M?&0}P!)q^kL z>NYyjkmK8jJptr{SNl#v5C4SAZ9>io^3GgIw3UV$B;kxkLRL|InP7Qtqlp~yyfdRg zqv4#WCdi7eZ=kE`0Zfw?Z31!S8Dh?N-lOy6{X5qxUfX#-<(c&D%y^iRnT|A68f!>d zRt{moT*P;^C#*imv!0Gir;SF|=b!EsvKPjpI@#!B16>^*E08J~&DIiVM&e4y48p;= zRfYS;yhTJ!wCQJ`|+>3RZixE^Mjl_`@K9@9M#g!&Jwc>sd?JgZez7$Bo z=JS%s4O7wJlzfom#@Zu7?mQ~(SbtdJwz=TTOVY%}*uwpbN#<=E^?^F;Tq2kh9?4lM zRk-4&N@q=ab=NB6l-_#%E6}4t&9)L##|5jcq08Wzf;1=7#-n;w9BkB3i<6D|%a1m$ z*xAOA=In7IC=PWOo)tk*;*h2OQzOoq zeXIGF#H{3^)#O+cQpy!_8Rev5B_poPqd2~)Y-CYP9j}IWI@PtRtpS}H$t%JS! z-w2eg5>F1dj^H1W=dZZ0 zkkWP!B4>z-Yi5@oSPJFKse?&sDoBgPfuzdeoli14 z5Wcl}w0H1b^3$(}f1g_{pNSwH9|}f?$P@h^Z`^nOdzg2O}Uth?<-kL-iwDW~Be z7uMleH^baP^B5QvshyRjA*+((^BlGEnvHf1G1;M{>hci~2#gl~nuI%NWc{>H#$Esr z=fg1f=8(_IHwPTO@N@qXpn&*>b z$~+}wq%wpO$rLhY%rVbI(V(Kp+(2EGN>bOXiHZmz3YCzAN|O2iU3;H%9Hs8?+~@hd z|Mz`-?yc;-_8Puxt?xWcMHtDBwbrhv!sag;@Iwn%5^4Z*SJK(C!$cNwlVr3DvaN$1 z@+5{8k_B^EhqX0;2D`2_#0Vb=r)%V|r=*rhT!21#DebZGv6kcs2q1nG$B<-Q2R=ny zvczH^$mE?$liXa;h%`hO{Ys^}e?)g7Y6XK5J|>PAag`3c4xK$%V{W3T;jE||=MPlT*gz`g=lQwxzXQj);O;-=|aOc zQdu49Ysyk+Uy`SZa+m%uv`FyCD}&WD~H2 zOg+Fhx+7BzM$R$$9NA|uVvmG%WHi`f1(p=Bk8Fbky}$`?1?`6u$w~;)v*7|g!kR>$ zjoRA`)U>wnV9E(Bs@M__3dcioCM;zT#PVbP*S})Kn=rpkSOKT708&F`CR+VLvT&SZ zo)kZdXfZD5P~{qOb_JYc01X;0-5~1$g^ifp;wOm=Xd6xBg~C;nw6vFobA*hsAoT6{ zs|lJYRs@(Kc~DIJ0;>fH#jc{H*+8JkuiycBNjMh9ZAoNV0u#HS`il$MP)Qd2TtQlc zxZ=s;AFzNlnbZY9*XWFfg%gK3E!x#XY9s(6&iA;2k_NiM{sh_#S}@8R3wKvg6FTCB zLvdvjvR42d11?HaNllBmW7Ae(>WN#mwYOmemnu!7`H_h@^%+&d1ltkUL+$z>T3GF!zL@AnJc>bNm2$O6v$rA%Q$f-0_!ucQ) zz8wnKY(N;qCxbslAV5F(fY5Lv;WL?r0|+Q{1^XXJ=yoJqWM8G3Ejn2fxvB9kDKLdM z2()+taQqbxVfcte&#Lf)K7g-^j!iytO@_DIE!J)oUGdi6tg zZ#QQu%k>LQJemeN+DO8MoM#|O>niDPGSyeo(lyo9hVWh`6;qTj6^Xu-8Q>ZN>@y(0 zNR9z*Etpj&?+3mk__d)n0%I@Q6zbM|_nNXtxDjijho8)D$0n`6Fgu#VidI5dIn5Ga zcIf;<<^ufS{A;trV227M{{(gjjAfb18OqJhSQvWT+r|2B}RXamtR z#S}Py;+Xy88#%?5qM`&Gf5Md`tIH(F=bQ{3ikb`~HuzqA{{?oK@N-X8#E#ZlQLvq$ zd$3k?l7f)}XB=?>&JYxZFR*I`A7IKk>LsMMg@0fpP@5z0{IWUL5!M|=h6KzLjfh4 z@%P|G&rseD@T{`5h5vacQ5ApUpIgBMp8m5dz^?c|x&maB{QE1Iz~w(*0R;L_C_VcfP^M79dGnM`ZDWbp= z*j9li+X>aB8gpfsoP!Gw4MNIe2*E zh*ZaM2uwou0z|3>K)-~U;E+oS=4*y%9FpkKmlUHBt-S=*j=(vb2|qOacg$PaNK}Me z$P9Dvz}z6oZp@-0;MD=H-BdmW|3HMMXgf|Yuo#j_ECZz_Fbq&{6ypIPRtzKk7$=3; z3Ys=Zwf={VwrTIcd!o>Hd=*&9c?o>!igA%`j4agyq}@tr>kQc++f+Q>ux+!F-xFIXe+ zL8sbxzUvKKHy{-+0EgW0XT6d01!G;}yeDNV;UKAkr??E6o%F>#zcAwk1^x&oI0rrH zP?EQR*4v!&1?~z&IZd#i>;-x6DD#@MK65u`JL-b)JA!pd^9}q?4vx@g_>#Y zjZ}FF!_VaSP=wFXz0lR&CM+r>N`#!IL~V^<*2$w}bN)+p7N@YPQm?^xYeDM(Fd^G4 z)NFP_f+czc`gC&C0EVC_E5=(=t}TAR{yrRml%m?|u8=Sryi1X(of8Y3p-8xtx#1@V zTC3r$_P9EGg5@2ecC1J!u88DfWr2!AnNLb(k3w^-pe`^}W(4naI|mfv3w@y41)M1R ztc>?q8L`K5>rv2E%+WKqGx1kgB^~)bTrY&WUDyYWKUI~5<$pST?gm6!&EBM7BN()_ja4>NkhWVi&HQ5g}TCrU~MB&fx z1Zw>&EJ3S)qH-J*EI{6TGKWMCYoj?8KrRucB}bgM?BobXAmfk9R@N$f4N;W#dJY;!>NGZ z9VP13VP(Nqjdut-G4lBVyErEx8W|!dD9UI@o}vMH8h?IQ0o4AK$aP4XFezpS?GKHq z3^|=abINtY$T05bh3GIk%$U*fR~PQ5RG41^*d@@z!XFf0C3J;c@lYUF5Aton2o24Y zD8*Ir91Ccxpdtcx|A5}2uRxuL@>k&hoT!%Yr|CAj=B^$nbetL!jphfxWA<%$jll$n z#114V5ZxgL9*Xcl1OpbP0Dpi2carpmlzn9O3hN1YFD%}Tf*x?1;y}>md(tSHX zk_xO-0mw=2VeSOMi_j zj{*d0Fb%{BW5j(To(6UivXMZUO>*2X9(#*b+1>-$bwO|ka|E7g9)eCFHU<@Rc6KMh zF(MIpkun~HD#((@haD=kBs*E+!D^IKjkW?2 z-tX8uF#40Qx{wG)6L$)=MpdyqK@da|1x=&{dNoxP4IDf&oP80Wr4JeOA+x=%GjTHt z5l}(_0@x;@jYgXUJ;PiC@GFiUPQV}k4L<JYdNG>k3fETa1kY$)7z zm?C6`fZRG0A<9%Bkg*SS31pK4x?&T33J~##6$G&f^$D;EAU*xSSX0LTn{q7WmS8iY z0VrNwh8CCzxszEHY_I z@8$z8b0svMG2%Ra~Gfi`Hacm4(2T&O# zkRAXb|G-@#-U|!z0zuJOyCtSPVRn6$d*= zCxk*~@Dv1;d+~?o6cb;jKB@Tb{`9OO|0pc3>d&3lKRmBfp4eY+H0^mr*PDE;C!qq$ z$(`I5M+5lYA&HIxT`Z#ny0X}AQn*K=vlAW~IMEb4CvZ@(At}e2qJzPF6@jThkRd;V zY>m`wf}{e<;ihRq<0$?sCh-SBe+O3LL}r4!M+N+N*PzmQAWfoFRD!yYw+vOYpLnv> z%E`vf7M?j+8ar(@C%Fk~qGHH)R+e}>&L4a+$-%TgJm2RI>8^fwIw{5GBy`62Lt9=4 zXD1uJ$?*B15qR!{J2^Ly8z4RyvOy2PRE@L-emG#W^KuZTgSAzJk>6|_GU_bBkfV^=NBAzB5c@lf8Xy-@?Da)9~5>e1T& z34sr-7rfQ?ctid&By@rR`iDXh@;3cZG@ith|K;WX1K)D$b_l{F^68|VFHw-PPuQ8I9K`=M{w);$4?H;Q-{S%DYyS@sDRD^=@c$H% z5R(#<6qOW({J#>SBLDUO{Es+*{MY~E$M|2+0b1^v?5ly2@=oEKF|`K>d=F|mH(@)c zA3Gu6GjJ`PaQZ-<|Cra;+||V#x`4R+NsWJ;#UFUEPUXXjCmF(YLy*G~vL3mTCMQus z6p!+TC`Y5MBI1Ts^d3+r_9YPn6iQo)Y=YDyk|L5=sw7TLb1yqb2xmpDLE3Z#nG>is zjBZJ>CW18e11$lr-WHYV1%(tADGK-=>Kj7V7@UGQIFo?pTjHdN!m;2k2{f1*O&5N} z{alNSttY_r;BEW+>0V3PnJjj7+I5==B^<9c7$~XudDBCU=8;Pn) zJ2#oCZQChDws}t#I)->Bq;arvvIgg23_=u*9w_v|_t(|b&PfV%B35>;rs!7$H1rXs z(IlI(Cf;H+7QF@u8G6JxAgKC6w8L_}0U5v@aqzdmBq2?KiyJRx2C)9`Mkn&~aZhv) zx)xBdVqnKOR%{T8E|E&Tah48E5M*myzyDpYXie1kVRQ>kq0o>EuhM2yHLXp$QfL_J zf`!1gDupdw0AB{x85vs?9#2o>nehkX{(M*%l^5mi!h_Z)pg$P|e85}TIbrkpL14xv z^o!}?{1ZRc41kZ@C1_O@NS#c%?7a9U!F*xc(Z9*ThWKMLEND+8Yzv&e)reF3R}b7D zoVOog^grm_O~$(vAi}Kyz1Y-%B%eQX-pPj!-{Z*;#sCa{6V~XOV|WkAkNEY0obKr6 zp`4fGn~dL6c@Y7WcY%uQ5SAogY?NjQztref1J(ze3kQRYN6FVgfVczXCDR?cAhtpE zZ4o#TWbHi}6OkQ@g!$1T$vMHSyezC7K!xiDiN0(gktkX_7%EU@Tk}0odDV)jY3^!= z*`uh&XE7m^0SsgNv7WF};gA6V=Iabd0^w6A&25Tivq=~I8v^h3c7UUviVlVts3#wA z1UeAV33+|!4x3t=JK8~3GI=6-U9xCPupb~$$m;@T2hshIqZLawM*As(DSQY4AWkG+ z48W9+;Zq=FuAt4=oUylkf00nT(t9oqQuVN;{%SE(xC2wAD9k$hVBp0Tv!q)n9;xS8$*$H zq5PU92F~xX4MH{K{;9zH?y^nnK8{VWI02kgqY2O)2^z$LA5d&aWu=W8TeY`P&(NRj zh1@SX$Uh-*=&;jX2C1oT1Dqk0a%8HzAVoPWRPqAz{oyhIZTQ)3z*jOg0ATC>-Z7?J zHPksQeBvBXw+S|%OytOqaEe58Or(A|`ceo4lUhu1!vEH3q0WJJ;(z;C{0K~%bAVGD z3>p4MgsJ}@4nmRtsV>C-1{J^`$p2yzQkeWNBC$?V3fdz1|G)8{|Dm(=e_sBl26jvc zIFp70SMXUpMB=g%t-uJOg4pi55uS<-sdV zSRkbY&w3sJGkTAH$avoZ>_gB9k*`VLnPa{|_;=Pn`wkkdC5npt@Uarj$D4olF*KU^ zm^>Tk3Na%{VT}c7AT|r>tk-yX5d{_Suo~b(h)|{10t~wpZyPE$o}Abo76dE|ZZ$wM zGe2@^1OFXj9r3r9QYo zpc)Lg^AT|kc%vg{G$_+Vjz2=|KIMnsQyv2j9|jJ}Qx|z|61aO#bdOu>$(#}OFEr>X z7!^9JAN~`E;QuE5hgD+~4OvdHT;0eb3SR;P`~>*HeuT2CzZ zDNs}j>71abcn)&VY=d(ZvS>m|Qb57hpy(#YZXlEeBDOhly>xK4fLxVGfX5SnPnZCx zT*$P%X#Zhi`@ZCc65;BV`V3Y+23Z(x6dW;Q8E^g=S3jVz0mGGi^&B*tM zgjIoAg{=@#DNSl=IX6&vI6wk4;As#QM|B1;hdUAANSG@(H3AC$~eijGXKflHP+dWpY^0KaqJ<9&@fmdGnzNoGg$}St6i) z3eAF1fncICdR{Hel%|3CR1JJ4 z8i;r)iBh$~h}4nD=_8O&JLj4;Yed9$f%`sC`w7AaO6IllL~&V4YB8!K6AM5Ylop8Y zvCx*8LPQVKAHe$`N#Fm%)YtzB^!h)33<~{s1eavtf75J{{J%~T>iUX6kzcU&)BKHI zp&y|C;!;wQ>qOUK^1rx*2+)7Yf75&>b&FMzClU#eJ=SK@i|>BOV`0OZ_+h`#-t|KkIDuDq+y| z3zKZYE;r!@tb@{f;&t$L*n*XYxC4tqAVQnTS>At06OX#VSSv{R4Bz3=3rKeYK7lw_ z03sb&^j+OCX3HBD#;|Y&mdnx{-141(-GB~2&;;hh+yP7cjyJJ&c197bLPTYA5^e%P zIs`0^7WfQQPLJxIPrDGL?!c4`Fdj;oEreor;X6CvN+_S>Qm5_2TQma{$UD&lG#Tbl zS=g2eAt9*ciz_wo5;aa%9>DThc|jUIi0`$4$|O322q|YUV4?y#b{6gqpg{oR<3wp37!Pe8u(Eqd z&JK`>AN(UMfTe|PAsdOv*n$X021XTPRnk{h(*j>fd0|_y%LyYK2|>)D3WAD$;_yF; z<3*rAoubTHXp@kB$kiFdeCQLK4wO4`0oD}t1_{%q?g|_x-9Qt?%Bp0#OGm@raC$f6}U0k>pjVe35U1uN!*2ydWgm=O*e z^4w?}62+$K4!mfcZBS`wK{rsK;l&up7ZI3giVYNTc$fhl@qs^nphuJ04ZFkC4_Bct zt?gLhKN@5(3IBt6(N@UC)`jN%Kk?5$!2e=W>(&uO)~%Bek(82@09pX}U-ZBEpZ*ER z|8XCH|J_Nh!swzqV3Yv1pOsb4*3HpDfmO~8>4X(*El8e7rwxkYZK~Ul{ECo=o3pDN z_{5~|s!&}tWRRR4E|5Ah_$>jyo2$9Pa()<{4dU0a9J1%5|r#$l} zKLgV(l<)#1CQo@od4d`!qW%EIIf5M=FtepRmNy7X#O&-O&q+DjoC+}HCPZIAvFHf3 z*eTJpsD>Z14r4<=8#y~C2!STLLHLWj8;Z(B=?mq(0LePITgh|EDdN{3X0NCKouV&r z|1G>BrKgGZ7`EV|JjXslS6B`l7Z8Sp4gqWMQX3%omvb#AA3h8x-Zyy6!Eg#|VYEN^ zQgG@o1t)z;UJF0x)T8rH-3K>vKf`J(PRxPa6GW0vxeno<^kix00U0Y0Vv-ZaSBOJ$ zO4xf(z>*Am?+Mt`d_i*GgIo;BQ`$&AtyZ8~_Cy;cCyY)B`UmYf#NdLUN&-r4VLP!8 z69xufY8%uJ{h+GqXp@LCKfJ;lz!`>Vpabg#wgE10w9=`6VBb+l0Ce{AHZ;}AX*+1 zoSYK}2?ZGfiwntF1Pq!w6@G-U4mG`nQE#kIs^h88p4H{9{vp2v|a`NVsTM5AQ1>N zIMDxe)lC5-@Nl}Dn&zhIHB1ZXn7C7{7IYB^M1q=%lCD>xT)s`Bsb03?h)G`J=gT$K z-1F(xn9qg=oeT;(6hd^Nn?G&4u8Q-#)ES4orZJu>+PyvBtuvh0SjKo|=+lj=s>Gu) z>fF&=hx=>3Hg|dNW9sPkv({>`zt-D1?etJKu%)z3zd^n2?m$@TT@2fW|pqhH!EWne-aeC^G} zn6;Y2>;St%_W}2=LbsRuWIem181I=C^L#FAJ3m|g?ZH^%T$g6K#owe3xu;v!=q^00 zY|ox{G*|!XbrQiio;zD~{sP_1-#c56Efn4@CnLcX(cXKz#i*>Aus@XDkjKK}Zl7Bw zb1^pyA=XMN(mm(HjjdiX8SC=ZA6PZ`Ue-@>dlO-iZFo1aWp?PdC+_u01(p#SJ3JyA zrpXtSnFb7|?$A=(vSqPIkois(ww?ud>0-?3mLDhu=yaHRG#nWVNZ=CEe4ev8BjAgT z;tR1jiw^}I$+uqyj(>@m8>Vx2AUu?HqmDZ7gSs0e<*tzfn)A|?7tKEARr~(nQYnG; z<0JYpf@^1d>K6_iTvs%lq`7DQg00WCKREY=A@)MWBF@J$jvP8+N_BhJTZ~@aD%f-a8Y{k)`dXdFyZ8wgj5?8sUJ4AE=epV>E z&hmi=!U4Zqk%Ax6sl4gvNb$VOck%d1gDf@WOM8NkithWMpLfgg#ZX38Q9)M2k>^i3 zQ-!Ri=>Da3MPEkxmL!TAmUnv$*PdES z$DDS0v5HzjPqoD2rP0aP4sGfjmQs7(n7VWID&4b$5LS8*t%ZjNO%`x#RzKim**ENX zJ7agY`W%6Ka|8`6eQuUGL-|t`QBt|Fy~Nn34V^^y%yuxw>LWkrABI3%`6} z%`l126<|1XXwzaweztMH)}tFYZd}l+$i+plVIvgf8BJ4av?Uxb)K;nPQ&o?O%9zIf z<%?>|xNU1mR)xH0*K^y)D5aV2NrIio%GMFDNu^@*a}V=|2MN-o u*Q7dQ$Dv zR$1XnvpN*ZiSmE=ncaAvAjeUDsxiadF zW30P99`;&KH)7fXYVCKxW z{=VX-0f`ra$F>obDlYWPoNic>z(v#vqc2wOJab$7IMF&aTgK=zYnYc8m%Zc*1_oum zn$BhJ-(Gt*xt67MjM^TH6K7b(wT+u&!&5SHAZ$`){X&+})Z2@cC%NFN{)>@s>h z-DjjZaFniItyU0oB(hynMMta2@%H$)>R27(G!E-yycRJ*TN|%IxC<=(74tTde8VZ~}YPi7hMQj>&S~*ynKW z;e~YlbZLuoXU}>$2z0r9&e@`#Q=WQsbDdL5e=&peHIuI3t-DJ%=x2I8j@6R3{Pem! zG24(}Y`wE^=zU+MTK*LQ#Jy74yQF1Sk37ox%m1p23p^mMk;v0}1jCFODB10S;TDiitq6&)o;t_l$h zvL01<*YXoY7(}+;uLzDisa{f|%6!dmnz$^Fyl{GLjIeL(Qkwt^n=C#8{ULvUVa4&0 z4-HwG%hb9X1m>&nUvGcg>Xk-!y7H=wdaFh41yU=Pn_I*g#Hve0s`AfgyxUhX@?L-C zaH%4jS=`1|yBI^qQnoi=J^f_%3&Q6@p_@)O z4SjpFw9oH69LIC2OjyuV!KTOfmPh{e8xnzgW36}V$7<{#d`K)4GZA9==2COPC}4az zueZQcK#l8F(77{eqocy&p_vI;-7tQ*S| zmu7Ci`}R?VrI|xxZvQw?lkpbu%F|jG?+Fl&F)NoROOoop21{#}Bqk`>eSYlT^~zWw zw4pISJV{hYQ|-}}+K^U1h3WqO7izYLDa*;Y76%OXE?cB}Cz}7%@Jb)sJ0bp-uP*j8 zsjbS6m0A+^C|Yyb#q4-CKLXb&jhdTP*Z18o=V#V0$R6?S7?&>7p}Ws^Pk@=;^0eff zIeK?pUN`#&b_}mPd5b2-EKcFz^(fXmH$r>W3yQ)!VKd>gl8IBREFNrWcHQXZ+uu#QZUj;|P7gW=ii z<56)nK25#vcRt`eomMBt3<%|jcmIQhDLzA;;p?rgE;wA7|53T1#-PBbKWdGJM~bXx zMZWiRf!!a%IS$a@kZ8DN*E+N4+k+!~(Z>`%KlJS>Dyni&W`6B0#+ei3Faa25S?(l_##|D>_^j1Ya4;*ig5#&AuWVD3EXx*%3LqnlD zO}sxq{^}3-j%E;JZmG32_m&+@J9^+ahsy380fv^6eTLU~&Y!nCfA-KO zozLwpW7hf^F$~5G<%tTTvKleRk8{6Qtt=Cj5YHk3QT!->_T)!76QLJebJQOZ%{o%+ zl-DM3>DWsT+{txsksWqey5-Qrg>Q~zRmj+mkJ7=d@0wjS9N1NV%{0%azx#GezS0@O0D5o-63cH;TPu_7zhluGV9WB51gGo?o(;vS(zffaKk?J zqA&i}fr|2ZkGj{#X}z7JuDq--uChE)uE8qqOTmadGv8>BlZgP6ynNOL?ZD6J7gzXw zd+k49dYa|++&%4)t&tYf1KRrQivpVmjhLn!wPwwhcYE#K zk>S^`S7XPM9j{q^v^PImlweyaJ9u+P-=oS3mdfbh$`5xV=IZU@{W8#{Y@V`zmf=X} zYSP^%^WE8dv!Cu3le%H823 zVc(J7*+!eAy-S{r@g)20y`8?JFDEr5=p_9sJ^oMcn4`V=O~-RT9Sb!6)P5sVT9iP? zdc9cMs9$d8eY^K_B1DXH{03K$+E07PZrN9{sE_5%!er~N=Z%R{SB(0<@?A{KC6&%9 z+ZwuOm-NuL*1+E_ADun8ysja0wY_A)-qq|;=DWu1Zx_wIs9iJ~ zJbjk&bwZHPsdGuP?m1U9(g67srgZ7=PK%OE;EvQ=lsH^K8XtRiUSWHQ-;mwKrf(M& z*IT%rj@>cOL}*6FR-VW6Q!O0?oa4C<>9QYZkA)$2Xe)LHpLTiQX`1&TWQIfhY2FG$ z!CTzw)fbcf+v6^#q}P^kv5U_=vtjY?8ePdObFItcNFyvf#{T`as{w7l>+T$EnZA-; zCu}ay@#8t_o4GceJiI+8{D!|vhiB2?ld~Qg`-gJ#l8uI+{^}F{Cw(a27b`4@=Rq^h0YwYG3AIPjJ8aZ`vY)F4;DVLs{T;j8m zHz(%Y63VC#(@~jsEHXdKyU#P=+db=e>m$d1QpIo{q)W@QlYh~YF}0QHejDe_qx|Mx@#*8T0XYDUZdnv-!xF3q^P*CDYZjX+CJM= zo-y)XPtWl5~MhrMy*t3YAvzJ)2$P@#6G&Gams1$oq6s`6TSFz zI^F@dV>e}4NN;zsOUz-Qt9n}cqC&bewavLmQ{~e~m*!5B_;%$@b+(N1@?4>sJLWU0 z>}mMirm+2>!L&QmVvRX(!dW;wKgi4S`GttG875qh4>Bsn^(G?^Od*Z;G?b(3$<# zT1kfd^THpB&D&10eU}Jy`Q?c%gRQd2usxWYPb)@;6KZ3n!Q$?bqgvjeWXyYLWZ z%nEPsE*S9C9yb(P5PXJpnn*`Noyu|(Uhea&r6Nq?)msKG&9|;-d%G-hMkUGM)}ANv zYZOOTm7dVnC4Q=n)-t?lrlfPZjnH&iH(y;ZRvm=@eQZj0=grSEZ%AwGuic^TJ(gKo zcg@(lGcEQ*&T!9WKK3=`9L(Xs?VUZ#uu#zFm2;rQUFq3XhD=IV5528EuF2ui(9r&ZWhF%Q9bwr}Z6rmvgSFhqz_FyTPWy)uws7IoIB67d!Lm8^b+{zmI%= zbCU1Uwx?-PWnxj)Ytrp*XIV$z;abDOcMq7xtHy(0A1KNQALZOc5OJ(r-`7#m54!DH z;U$~51iI82^k(c{BUgD}l%;CL%R6M1FmWkcszV^yG%F-<5w>;x!(wN`eO+fsG zPTla3eb>FioUZ)tKw@V3R^{s!^O;msLY^;5NZr`2rJBkTkS1o|er1{23oh=okz}W$ z%d#K3<|hY!o3mwP=yp*-YvhY-IqmORPO%agW<~gMrfefhU)Pq%b`Bv4tys=Lnsxil ziS0`t5SLthrF>n|OkqSk<ZHgmsS$OoqxWjwQK$$TUfdvhXnLdU@&8T5Z|3ljo1g_zYgstGasjX4Td% z$)yk8dXM*CHue8~-}&kD7&R~HRusHDm$%aI`o$tePf_Few0^_7POjB}`aoay2Cz$( zwYa0CV-%M~_LbVtkF7Z0u5AR#=xCaT_W0-6=~B+K)OgM6zSu1sc{Lqm{*t$Eu6)eD zQuUC|Nlc1gJ|%TtVan1u0ovEL?S12vXEG99rhmnF{dNCglXWe|{c@X5(lLtk#n)c0 zR2criFk9hm)y0&Gdg78Ldpc5kJ4CdH#%`=@mhLPwU12XZGm9Zo_S5})3ZtFNLT2!V z)m0eIU*MLmqO4kJ^rW*O!0VhVmH<0z58x3;%ufuV2hr7!-m zsh>VxKWY(cwbJRiOT#JstIhfAEn?2F6cmj6cV`1h|6n@)NmW~0yWE&_$t-+P3e?Y8YiG-Tei*mo;@6YvY#bYcRe~9V^mktQ{p}l#y8MCUh&Ntt&+ccI=@jLy z&8Vk)T)Q_)-D~LWTrK9iPkHuc`L?&kws?0mU1=z9bnNstxP0nai33O3j3W12cAl!? zFE{pI(o4_QHueu3T)Dfby{YNKmx10w zU!BXNeUEs?UF%I&Y!Ch|?^LGwn=PY*l_bv>nm#L7=&m0Zv%ej#5-C4& z)hU*1cMe;-m)B{eUjmJGhbmvE_u1ac6xjjcftO8A65`gJH-Z?7^GO{QTUL0#&E!cw zt?1m`L+WT}+7zkTvg_7|FV_P7y-H^t3uh6(pjFV*Xm3-IoV4z9V!>}BT<5OTvikV8 zm}a#f5wBdfd@x!qF!LvbC67Of8#TeM1NtaD4ZJ-?_tm;Lc|Gho(titoGP z*TNm~wDCfxB*?VB_VtEmRNcN*ZCM`pINdIbFV)gMLPbblI=a(!&5Gsjc6UpTpPb91 zz5Z?S{z&8eZ{Ox>zx1p+r@z}L-7#Yt$7W_fIgyXoY*M`K+Yb2;yr}dP3OuOHFSXfL z@Fe4LsrWS+2^%+dH3zm#e^7E-Kz8q^*Mu9^_ZHu)vwCvjVZ5dZe~z~8xuX_mPnGG! zUa&hKC%NR&F2R9u_Z$KFjKdEWCI^l+*d(taT6{b8ShC(&Hs^AD&6czCj9SH_rQRnk zmvu-CV&-y)?>;h?9?UYs>`~n{GG!( zzP&<$T?bpn#~waCPGlxt*?DdFiSsPu-$mZ_Fv%ux3yBk>0?w3K%|9@B_j;7iu0c5V_XK4(#u%Y{_?A zN|^aRp?bVv<>+|Es3pSR`IMEaRv(y?@oKKpV!=QbMORDN_qbp?eHwE@%MNA z7o3)^Xv=1pCG&1<`ijI_MLjw;-uBwd`u?N#ro$!mT7iLW>Ss^d-F8g8fA8L0Y5v2P*SM4jEhRX}`IKEuWslr)KKs#yd6SaWxs0xQQ_^7DN{2=jop=w~UP-C3;T&(guZogThzyoJNQG zBS=giBaX1IX<4_Oi-pDF)7`MyqpiIc=AK{|W4p0a!zbYB3wxO)TdzgsLKsv;cl+_d=dI!AZ&`4G}j#Nxk~SXGcv`>c-dC3`mKrS#6@@Iw@1t~SJ*Q_PmHjKYj^BnCzdvBKFORI*W)m+{;HtO>Wl|5g? zu2wlW`L)6X-O|`cZAeloF)D0s%&rKHlYrut&Mwq(p-UuG$?pKwA5+WXdSDC zV~^!p<=&Hg`r~guhaFrI&qK0gza(Pp_wbJFbPsm+Z)2^M^0NNwfpT(O`$hEaT3^pu zd?0rh<07JUX4olf*YZ~3AyAq*e?bR$=>NgfTH!`KM zC1tJQheXXNP|8Yag}+N^8S}7rcqYRA^=q?7>2j`30oywVbB%YFFZ+xajiU*3d%_yxh1zDw}>Z^l93glK!PJR}Hg2oYHR| zes}(;k<{=$`ZEtIMC6{jEK?l)Tz3CT@PgktPq|-hb0DTNFp^4)kL%FIk%&4fkvW~l zPKQ-0SghHnDNA>VS<|ssX_U1Lz3ET@HIe5rgRD#P@@1yJj+Sn^a}BIFg|~Wj)n(9a zSDh!iaP6t#p1j_m98&dW`Pfqh>T6n>VCv?*WL>}3IZk7V}S&3iv+x0Ow_jzOBjJiR;TLuee&Tbh}T-W=&(1f1jw5Uaiqi6H_Y~T>j^hw8*u_YS) z{_SJl!0ziK+4TYL_h!Cm4orz-c`kXq^-_wdclS!Cmp0c5@{`pom^MX)s<4op)1}i4 zj~+bey0OV1x~_{*92qLIT}AnAP)-)<;`2n?`4nFOq1ZmIvi2tlj^~qo`O@}8gsN`d zY`N&24&TZQDb28XcXxQ}OLa@h#^^LiSGC>fbPH*2mRu^esC^Od-rfXLMTI_j!2i>!`rXlI7UW%Z z9ei_GXs5YZqod98iw0NkUsevz*k`ch7+Y3mt}g44Pg3TEnp<|4SkG$iILjrT;xh87 zZ{TI$7R8~e_XEvkHPZCkLa#$@!2;J!VbeIcPD*Wmd*fuB?34Do*^1Be?fR~sJ)2oo zRr1lr@@Vv-xaqeXjfzHFy{^=ii)~U}HeDI6Dg7Sn(!^_4F^97%IL>dlE6u~qF^^e2 z@sx@;w=(_m4s{hKhvni~#6899>&;7e*5$i*)tz;G@g{L*$H+!z5sh<4ayC3OzqKL2 zeQs&d*k~`0?pj9vF!OEcC-d@#hlZ@(JT*V`3h%sBo18q*4En@M#g(FS**!d0?kgAN zQrT_kkfB*qSC?^V+e1S^X3^v%2Z_Y&%Tia0hMRr+zMR!(b}s6xuxn~!w`^7MSuy9t z$?6&~!66~EE!@!ao&dX{1?5KZdepuUb|wk_p4^#8ZJpQ`t}c5 z+I4msEhIbZ8m@PpnoEx+7F#}H5+AM=(&IgTTq=SzBjqR^i{S&UX*p>rDfn-kF}_`k1fa!MTqkH+NUob-8lDetSov>kHV_TW!1cxKyajY|13Awem)c8-jRjkQwl)kx!JxfEJBP642$xM&( zy3H9e+|1humS(dhMn09=`1P-~N$e|_5%}f&)k1~W-Y=bIbo+n&`a)RP=qgGKAp^~MGROGY&E3Al=$u%5<=MLx zSuaeQk~(W1pW5r`>DhZfLfpF22_%$KZTU?h#cWR{%h?&3&Uy8BDAY@Tx^K}_w6eT1 za9B1W#fx+Hj1bYWN=0vz*np0_z;7>FnBr&BGbxUJt6n+&?Ock??mdc4~rXCKY13t2C`DC$tSl=H~D2%hAJ#Y^7Ok0;n9Dk;l! zeU?)dlVZ9qzL;Rb&ye`cUP{aIRaR^M*U+!kK1YL2zMjj>uAbl_n<%m`@@s(KqqIu- z{%42uoG+?zg6S`|==0t?$okx+yf&JC zeC9uOrIu@Z#bJeaJ&#s51?b1}&pU0vAf$17cF(s5dPS;+f}A4Xb{t-i0 zsYgeqC2-}mX$ShWe<}^|sCtkh-%et?0v;HvXUlyYDH^MNo?R9+*P4#C^l;+-Pmfo- z6c!TM#rGGNUlct?H+z3wh-P#CG|qNXP+YkRVSn6-arr9!MTF#OF>@DN%N8blo~IzN z&&jzoGB4;nVNXT4VflEZ#Knq!j^!*8L9yXXK|(~c1v%U@0ir{1XuST}quCd_2} zP{u|GS!Q9Zx0=&p2&4xd!-A0~vsLdae+#?&*0uArwLORV$odG;6`Ios+#Ja~H$(a& z!s&(vF4KuFV&kMMiInY;wjXGUnN!f{Kv?7`G2X=!+mzKZmSlMJ4na+6`brmq?8P#G zFMZyb+rmp4rxjn`*|&S~u_NzY4ZIr{+qZ_VN;V#lXazub5-b0DXr)0Ik^1V^!V+v?5=!b=G$l#edMT*Nt0B>9j9J~ zg-?=->T}!5oO4?%PP{&Q{9#aR;pflhTb5-G-%JnCK6aF|bNY@8+Pw*K=>_fyjBBzp z2NXxlns@uMWJH7~?U2$8?N}e(z+2sRNOSJeQhw&7?2PV}zHNtC_n*3!?+S*UnLW$O zGgA0!-+LB%M(WDcXN>eD1E-YwSdSD$xSnNjxzpV}ljQvr^cj|~WG!5$S#%H0>@e{# zaC8vh;(VIQx8rKj>)Q?=gs`=T*pHUq{N&%JIxM8Mk8!zvxsu z%^)(!9$=6Sp+BW2?Gnt}p~E&L=Hm{UCT?tQbsEGVZqScTwMnm2dmb^Bdi>ku)`3uIm+`QTD+2|BB+8NlhT;ZiEVwRu(#Qz3Ypco)yZvI?N?oe0 zYgA4=eXLRyKeH=vurFnHZ5Qi2(aL1G&d(`h4r7Vy!Q1Sn*uE>(^N35gcn_^fd>SjY zROrd)-&M!F>e(@9Ob;u4JJAC;-X$j-2AiL2WVDb1YS~WM&5oU49Bo`lfQanyr!mhHsoukU9M56r~dq2IY)!5RHbjRt<-c~!78_zk{ zZoJN%PJHf(GdEfl&aF5@x9d!Tt#kVdvzbpBABR|rTrwl{a>Ovq$>J2-K&MJr=@1-b zyWr_2LY2=)BepH7K}_3Op6_p9*b+o1YF50dbQ&kShjdWwX&6>mIzgtezG% z@G{FkaHRF5i1F|HEW#f04i@$1&pmonFE=-rXY1+bHRASl<-!@p4ZCyR98DR!l11vU z30_QUmn+(5VX0ZV?*x&VL%K&iC9b;3qJ~S@__)aSw|e|a&Zc#HAFMu~bMJ8-cYpkG zbswLy3!1XGoVK5dI`cj>!nZR1RCc4XJ;z<{h@*R6ciyZb@}+f@6%T|X&kCU#X??BM zA9fuu7yJDl-7GmvgE@muO+rsxkAgnk`_i70m);r`3d2Q#&-07PzEWy6C%wB$j;X3Mo410=gHt(RHzOgdY~!umT@p!=mv+|W z5BKQln`EEg$wMTTC&&$U=o^c=m$1byzEx*1qusXSjDALLxk%P^?iDLmt-7;Sr|rX& zv*{DhC(c)&4& z-1^+HAm2FoRi7=`;>`$}&!_p^$(c)+V#|G<;Py7mat^ zEBAI}_gx6Jm4#i7fO%(}Chc^lKtiZ$EkmF~0m`dw=tL!PL9gkfF5=aR18 zf-#xkX%S9*Nu;gM^!U4LU-a402et5(#=5M9+l@Dl2-Ez(WXaZan2 zw|acPC%Iv`N7ldY%9UEqRp8Sw=x`*9X+z<=z_Buu#8mo^8xDTBowCi)R`4eHNwzed zXI&*LwY_w0Y>jmdcY2wao%-uHsP{pG8Ov4|FT2{{5_3dSib_=Oe-sqN7mYKE4Hllg)f)8`j*fc-P-SlDE z#-QgpiH5g|XFWVkce3=L;^NX-#FF6RtwaV7f)?}iML~3Tjx(0ohG;0WZ)4Qh9A`Uk zk#&z%GLz~#DH3x$%SnY*H{4edV$Otm^H({vi@us^R=j@tR`;tj2-jCEs@T}N;r=oX zgAD|Q6NIm;-di($r0dfvo+G*3-fWi0iSXbjDi#~)zcSB1Gn<#4&EojB=|%@QnYZ0H zUNEoEOTTM1D;@I^_X@(aYQFkSEoe@&AZ`IdQ%o$yAm^nG)-dSr9bh{za^!AD6C_;&P-AJ z;}=sk_kiE*Q1DZk70bgc7TQQ1dY;peWh1zI{((N55RG zxu98Z_@I2&Z}m&}%X;lR*|YV@y52^GS3#H9 z2XBeqKX8_L!AsXG8<;+Pj36kxlsE9~EuXWV$5JJT;1jeuoOuy_GhvUlW-5WzC9tTN@r)|t=A_>`pD$crdf0lh^Y0QS>mkW~1XV`F7pQZF_6G z-oN2uVHPaS^K^f5dVQ9>2xtjnQ&YJ*d`{@*eApc?dM^zW^x)pFbBnt%NBmvaDJ9;U zvDt=^8-k|EZU~zu9edY9$rLu}6 zA3qKEj`z$SBQ-bA@c8g@F?*aqUhmn1LPaB=Us~vad#A|I02nmQg@UWK5y zPjhI>>n-wqQmgN|d9xqqjGn6=qwgM~_#8mGQ#z%jLAs?S1nKVX4(X7tL${=K zNjLZa(%mVYhi(qvet&#_ag03}a_@bwHP@WiO5kSm+?h9`Y8Y#D)xh=+-U{{=OEPT+ znF+L#q{|Erlo4kH33uRvJ2K$+m!&|qQmc{p9GRCoA@on#ZeJpM*GyoE!<>^~Ow$c? z;k*-$v1ib$lyLy*5={QqPn?2iGJ_Qx_Y6r94635F1yeU7lyXoG>s#0(8NzD{{dnOf z>=l*rN8m`njV?GskEM)bkgyJw=@tE@cxZ-?g0S)*8JGkgn`1@K-r}@YqCR zWYl#Lo#-$KeW4&S6D&U^4gyP>jtyU2Ol}sO9=#2VSHj&9`*4G~{OX;ayqD@w{ z_^y!#7401{0&i5f<_5zLvl3{w^3ch#r;g>$a0zi_MlM^bppcjAc>@lR5Qs8SgpH%w z#D2kR=Cy0F#|_<9w1m**aBw>CUV9(?>E57(Jq)$HY-8E+I;Moh@08`e5xwhkVF<7} z8f8!TAkSz$ztY63B)&T%)i$>4SQu5vYPSg6d4oa2wTwK*l852Q_m5t`v30&g6GIpT z%-rlW-vx8)sF4CkA~_jBz$~YUD{+Fvm6w8eAsmj|Z?6FmJ~i$5>>vKKNdH8N0e)|+ zs{&Q2Y5flMadX4|yMSDx1Q;4d60`<%=@Sb|J%n`6`WePQHRxlfaDj@^F>wE&9F%Fe z76oI}VJAvSZ%NVorZw{yM*Q9jr+FL#8boK>Hf8<>CU~h;@fAnOe87<+~6?k z*pTSx!pLaUm3a4iBXI|81Sw)EaXkb**o0~2D>LeE@fa>9ZZ16JZ<2DuIdkq66Rkr{ z3)cbK8n4}LS4>(4@_Ta|b|M4*Z;tr|sR#GB%Z0;P@9fSrDjka|ApF1XvsoIXsY9KU zps)GYlW#Drz*ei11@W);WBKRZq+?C6Zu9T@a48mo@g)Zk^^xKz=2RJ3S!nl8d|;JP zf^aQJ_iIAi!s2}}@Pjv5Q7$eXpg5LZbNjblxTsN*j4lb;t59$7`B@kl=aFX4OCpI6 z#APaVDjk{v9CijPYdcK~=kJgaGa8LyB?m@zrjG&5Q_Rsh1tWjIbgD5qwP-ML=}^oe zg+T{a$WDX5?PmafR^2;^5bPjS{zOdB13E`!!TWr|e%&u&pgH&j_ykTBaF!3)GQhz+ zO*vYT10BiYP=^#(BZxo}`}!BB6R!L|^A<`yJWC`Y*zWzeu!9UNBy=1y?ubL4eUmLu zW4^|3J7lmoyMoZnbvzw$ZqhAGn!X$^O02Qa+2*Uh-ac^<-55LSWn$A#2C?|~M8+eB zF&j6Y1CmVenC>2(NRTW~Unc=RF1|H&E0*zSN2IRtn7TzVNFs+zGQ=V*mKr1u=Pv$e zKbgyw9*M3U+NaJTNt2*G3Dclf9c0WPm}=xzNG_uc>|_i7csA1gR-X`{KEx?s5^4S( zS)~Mm!EkahLJ&G;*``&4-^C`c>MqC}t(e!QsqNjZ49T!8hEQaLA=qdz`=kQ)1&9R~ zGeK_rx1Dme<$awETQ=>6-4M6Qu7B+(f^iWlj2V=jP?&8KZW6Zm%Gv31lU>pQ_-lp! zM$=>5Tj%4x(rPoYWxgC7x}Y)aC5Eld92NqYP$s!B)!*wFV55*TNOa}#()TGU2y)9# zpEOL5jY*r#q%>KMb~HP6oUd-?*(-v_6!*HjN7*}_|GRo!>#)1(C)o)Hla4QZ-TE=` z8C1BvO%v~sr&ah%x8~6ChdA}PJwk{5C^osaK;tzy=y=TX8(mmSm4+mTcgiIRhs2z_ zB;x)n7(`w`brq?*kR~oVu762QZRPoDfwUw^hw>wlk(+e?Y%Jm;z!>!KsYpa`@brVd zNe-eYdMlPUDmNo17JsreCI`k^UuR|;h*?rmhZIML%8cF^rw;Xy_86`f%vvZgR+;g+ z0LxjWhi1fE2IfICEo_NmZy69|UAgK6!o7I^=M?9Af!QNfaQhzeaF9W-;b<_`z;Na# z?cifLfzRO2lIZpCrar{BXL4<&p{Id+FUB;Cd*9JgEoF-3B)!_~Cl1r5#5&rh1;K^y z%}9*i!*8X2@hST(*}kL3z-b3B?kfsfk9pM{H}{#^v}#zZRA16Y{;8lEDe=u3J}AlN zn|p_#e28z)I9erIa=*yU(Ok+WnTX)OjmAKmquuVhS3+cT^-2jFTFMilR;?YrKB5nG z>)rp4HbL~MTso#`n_5B&3z(djI;`SjW9!J^Ae<-*UM7F6&FFD9nKEi=|5}nP-&jz~ z4s{QsOvIKlpOIozDT|8VvHqWT;uyZ>CcT?oc=HqJUi3n|ayk(q!P?q+t7Gx|b3y7y z@{IrXb*62AK*L+UOW038&LqZv@5i{%5705j^SK#vU*)}dzJ0#WaFdzP4-&Fxox-BQ z1vLjjsoQfOdH07u8UYY~sE1(Lg`Wh8QIIXF~Ppt@+{-uKsp1;*|f;E9Y% zDOqkP)*3wj=Vu`hS}Z4mGlCh?1qoHun#r4Ip)@FHD6?f|j2$f{5-3g>LsZ<8GaeiK zGNEv=zA7*Vqj9v)aCK;K5Tg|Zq9$hoHrN|wX@G_N6%jd#rPU1Bp0}clNXU(a%X!Uf zjH@U`>?SwYuzvz50HHoYxIX0LN=oYb6||XCHI@U;$DK132Ax{o1&8=xZX542*QHw1PGweanOVXyOW_{2 zXR-{y8-km`S--~C-eoW{jJ13RU63$ZdP=XT_I?k_G@@Ub&>!ozf9KYh69V21GTBJ5 z4r@b2tRt`vUbFATg+JuNqou8Zv&&4!`_PLx$e09D+mFS;hAWI!CB)aef2Fk`6z{zdHb_CKjPUa5U+0ND+Q1=m9e@&w8-U3!s z2DJN;fl|g07_4(0^ZmPlAhg721#FsM_hk@_WUgQ8ORoH1`FwEZPPk&%u+t)QIDG#5 z_hGZ^ynXZKDm|g=BBY6zY8M@RN=)g*qxb2?w)TquaECylG|@?IQoojLnWh zd<}Aj;|8n1PjYwo&!QS*TjNwCusk^SmgoKm61B{KG_FJP#a{x0oWE4=NPLMDzhSAf zBSbm8n?gO*9u+6oMjHeBN}U9+iw_DTng$fa_;4qL?3ICvD75BZ<4ju^+E?l~bmsEMbTF;C0r7$TRZJDpzNcJ&-&d7wwB~%=ypaxWTeleg+34$;gJ>aI`f6WSLAlMC?Tsb5d>dtdCk!C zvIoNwdkMbpw3 zepq5Wxd$Lg8irZ|ggR0fXbVS+G3XwQ(s+PBErqF{&M7O!x=)C5_RA@ja8jH2U2iPT z7Cxxgaf^ZqiKdX*l1KPe>Q#y~BOl&%pW676g}ZgcJN5#33mzv4k&vqvyWc7x&xae- zt8o#re74R4+S1;C1O=5vd4fI^!XamVN(52&jtz*rd9pSU^5lc|(<4d5vvoi?suR2j z8kT+*@MB16Xwz7|SDyX9-6S}y#>VtNJZTkd>hdL$*YQw1{l6E$tW)lWh95yFS~j~H z6!|wULMW{=MEI-t?h~QwwI-DbTkjwI#!trg?*w`YqdAfQKj5FiVUDVs`G57CKh>vC z1adoBQ7fC!;cy<#T|tRTDjft6qv{Z3gl!*II}zaX{Ij#5w)W7|d<&x9o`gI(J6j*C z(0{F%HrnfT8;P#azIgq7BB`)l?iH{FA4+@8)^XZUwWyRS(hp36H@jb4KLn?Mod=Pl zVmY0<>mM2PnpyOJAJSUoH9c*GMj1CKrvC2{wx6`^VkA>X=qDSF^3VsIorj5!V+>WK zKY*Oh)_iW~wV-6A*Wx0hG5eDp7nMc^x6PlU4JUVrMeet%yem|e$i>P zK|AQJ0`UZHhtPZxlE!H#e8(aYVFF&nM-37OXbS?~Yp#rPAk6Gj^WR|A1RXpjcqvn2 zZ_M5hwM6jug2C@3b#p6HkeLa<>lS)q`GKpY;NQcFK*=sywEXbX_Pco?7`sNUb|lYN#TD6 z%{WO|3K{-zOr5sj%fz3g{g;r*eb>g*+SNgux?+@sqacxpjR5bCR!?- za#4{^iubF~M>+O@lyV`1mkOQfG&PtzptF_g#ZW78`9#ZIDysmRa`BYdgvL+I6{$ol z?iqgyiHf!g3|pAl+eI|kWCuP=52fbwznn4XdkoyOi{9&-wOM5L9-WIEFF`h6uLc)) zJoWDW(R|sCX0_W~>wbL-e7lEFV|`v?m|O|GG$kJbLP^(ayKU%jl`(~j1dZ-=G`Im& zFXG{ScjMVTE_)hg&v%6A(id=V|3+*1o&TEt7$z8T(`zhTy;ZPip@jrHHQ*cfETp&S zfl$PN7J&S||L4!~lSQ%1)5bOnB@T4(Ls-i4_|MT0SIhDDh@e;;jbh_EEYr!xK{>lG zz&|xPG9@7{2CICz^ctOnQ*_65=GoE_V*XQY@5OJ@Y6mHT!}?j;x)C z5PGN_k(C<4^%OgU%Oc3As~3?bW7S>uGh%T{o}{I*&#D{8Girw{$WaJ4`V zfy1nxUXS0rMp03b^EZJ)$Oi0gAYO20`%5@f;5Pp`BHAzkL7=Fv1KT4RSqwWbIUvzX zkax1h!FQ*@$%uTY{v_zt)~9dkYwf&Ru5wiz`!8c;25Lmm1_pDuM3)-tylsr^{sd*_ z{qa5@ufy6du>&zd;qBId1dfEZD22AHd7ppK*9*reiM*h2IxQ|h; z`$R#kQrQyZ94JW~9n97r>*6xQK?Pt_@7{b+U^Cn$SlS#6KV$6mS))WT14EDU26x)c zQGJpnDnr18u%Nvlr41_woIIR+So4Fv_3S-7qqk-3$y{)nDvd%0M(e0OvA|LjkHA21 zt7PGyiQgunl9pqi_eTEtT!%r0He;1ddusEmEew7!nwu$Q1ub9xs$QtTFK2Af{W9tG zHM5{rg;B?w0$!jM2oWrs7XkJt#NhcA9X+7_AtM>dR{FLZ@1Dz-4U}U=LfJeJRqfxa zI*tFe^SjPhAl;qaN)TV;{Gcc`e=jgaB=2&w{e#l&hBHCzaX0_G)6M=MzJ}8RS76n@ z!!zLE>Ezk2$=UgWT$a**Mrd{Dy_(a-9&ai|@m5QwBvY*<|LuOHIz;An@$-jf z(Nv{6U(eHVZNS~Em63n-vdxJjRG^t)P&KTZ_!kxuQk8bQUD7;QP`mHNgrSsDNd2hQ-s;Ua32IOp~f4S}MZs07QGi3^g zI$^-khTZv-Mvzx$&(1#UjvK6RsJEOf^s-7iZ5Q_GDoITdI19_X!|C+mbq-}YI)!IvjaIRCcCl{B@USCLXexm%q^8+~xbOG@ia|M({k zyNXvZDtB+HSZBi#5IM))zU>-MtX3C@Qhis6FxhYvNDALv)WUxB_s?vi6y1qMqVT7i zaLc#;?i%6=m>2(|5rj8SNw?4r$ld$)U0i%*uX(#=52$w-!n~($w<&t}J@IaCWN&m6 zR^vtP^>UfV2@2_x;4pd~pcM7od==0RP8-Yh8;|1~BPD5;t{EY~rF-oqsrIYKgEa7R zMXTe}@9YE^^+ZdOGthq_-yjJ>?+3)PtMlh`H)TqB_Z8X6){BPG(z`PUC8gU~hvrq6 zN)78c4t!}G1POm{Z)0aF5OY(vZgpu2t^$Dzi@!=LP^oyNiQM$Q_P~x*j8!YH+bYI44@i{e%i~rvL zRWu=TkW&HGI=Qv&GA!5pZ1)@y0cTmR-ZGzKuNapQceYf&TX05R|j!C0)ncX6ax5g`Ll@CT@+l1O0hVO>KGX|mrVbu zqBLhCoIDj0X~e2lE5>iUi?&amaw)-XGO3L4&lx&$`^G3&C?g(Zd0q=;q8<}k-7{iV z@$owaJw1oFooauRK9i?T@3v{N2?UpYWrn&JLp$`}K}rRcw8#Uz{l2d;kdTo0KDAlN z%jE*e#cNN!CkdRPnfqCp(Bk3J?CFcI{5+>HX1(41>u~4?Gc!7KeqnX@4xdVoVFk zy9KF~uS-LiI)1H2O!+SRnPz@>)-t=#Zy8iY{2U7zJLI^sIS7mv-rbvldVb zRyN@qMJcK}KO;^rG-P<3j+7DC36`T$0;Vwz5M zxEj0Y_1NayT}yR`mzN%^2zN^O03m+t*AaoyG>U*jlb)U(l{%InvxVyC^OhRdt{%J} z4V;4U7V62}?4jaABFQrz!hg*NKBiZ*b-HF2=g2=Sy$pU@G!$BQv>FpV6oGmVNv9jo z3;#Dr=%VrzjE33Jj{GBH?KfJ`*O8CujhY{SErOSX0eR4*7!sCQ0`*I6$o{5d7VY_* z2fVmeK*RdPw}E{cjbtq@@3Rj0y!Ws3y{epv2fo*|S^Q`WUwAPJ_Y z(YF_$vuRnh%^yW-x@dM_b)0mDG?0B)qr0xbj`v9B9 zfk!b7(f_rXG1_s6de3b*%Qz>mAmx(xb}0LH z-_rByAT&yb(=5vI(DC+E+w_C%pZASKV4$#QTIurc;o;$(!?4qLnn7z-*$mq%S`ZNn6u>qx@)G3F-r7u@~SHb!cVI^ zBf4$kO)Mmdi%gZk{g}5W_Ed#WcFJES89sC=%omqyF=g|7!&I_!_*%OvY-LwWDUQ7G zw4_lvI4Hwv_IG$VaMSe*kMM34_t7qbUS(nOmvWq7EXzuz4SPg*4~9{qZdu8oW$4M5 zveGCPbL2+*i865nUDyqLb3~@Wer)!_Dh(DQq5)NiGUPX7UclWl zkU=tDy*raUY2J&~!PaLwk})Ped|ov0TI<-%RZ@WffI7u20e4~)lQ>TKfA{xC{A|7= zvfqCD0P_VvAzZPx_FkMICo+1v-G9i)=7u`$5q~0qp%X^x0n@j~#8`A3ZB=0F; z38YT?UTgJi#xmhQX)}}5`>$)Bo=O6{PHJlQVjp+!yP$kMuqHR{Q4aUCp29_1YO<8U zkEvA)M0s8t<2~(db^m07T$N(veE3?^J=-lL$l399Ci+Obhdov&6^;6zgD7Uu)NYT+0>l6y>0aJAp3*N zJu#GuA3cv1m6sm+TPYdw_UQ`{`vlUCneIv4gcI3b_pkRh4!+~1cj_ISO?C$pN_x%q zzOT2et1U{gaaJxYRwBM^Ttx^|r?NyK!qed2DPj*B_jx|sk7Dbv&35O12FQiokJs$& z7lk{EHQ}7wQw4v~0OCoxyKe=Lm9i6bW2W;lpc=K8aD~%LDU00YVP)`-RH~G}^TlM# z#<2#oecay|`-<)R+ffe26$cGAqV<}Km(2J5!d~A^Ar=x{VuvT}z9L9mrp@g{fp^^b z8$!GkxPNP3^VtI|8{8I4pxL2nB0?f4O%al_!Q@C6x5Qj>#AnwN}1j}rtGGU z)^@#I?QM3Ka*MKw!|{}9KCf7$vu--|5U1CEqPbXpAEcOv^!n-u`VUAc;&o2~=(b+X zAx^uqueRqHUMi`hyNy1GG(YFiCdC4G5(1=T;OQda_-f^o#Wp<-Uhg+r>|rnAqiLBu z7IuI>M}F^lzT$D_u^Dx}MtfCw7;#dQ3&1K+KOY=qM7=pP)(dNyAQv(Kkb_aS9%0t# zpkM0DuP^}rMeZC#YcQ~s`4lI|SfcPjO(EQ5`UHh3-{<9040i4{UdV`6|8})!^mvsn z&*W8&GU-)Jb>t&mdoW1OJDJXE`1|}~fYSfsC!G>&!Op|w5QW&&k{QzT$+A178b>XY zj#FoUBGMt7*TDIaZ`N~&7B>vYD?Tk1CEShdxpq;=>3mEln#lLs0)NzGGyLs4e+-Ys z50E84e0JMUv1{sfEhmdef-+5_DNGk8wSBzbbh7nbv2_S42@O5)zYY0>MDD(;dSd9m z6X)H|Bu-c*wEhDIYsp=02F$$f#^!&_Gv)sgGgNX)GFQg9H&72uJ^DMOC8_akzEl>j zzWb?G>3@f2WL#9e(7x(1`FX`!+svH|-n?PVU`~?B^GDF@H zCvPe8)jxI^<^6H1M{SINi!^uDEwcqtE6w*!&M@+@sp~lj00{}ZOi29^k?(saVCIm$ z9K>BWzt8UV_Lw9~Y0zvv{qkRoj@>pAThhp`&h*(7;N$Elk(n|=l0f`<6AH{6jeP$j z$d&mFPe6^hk8bo*U8zOsii})^f#NzLcOa;tYVBdtq|Csul;Lb#aOjyc{QJ<|;b#f7 z(PAN-_RB$aDYJAt(I|(rOZ=qR>&-#WMYv`MMgd6KXGp$cDp#2SN%(8W^h3TM)aNMt zb~KHpe9;yGpqG3(2t4YXmKk`2st7!;=Zik0N&3{?1@2H9K(`kJXRbHA&ze-eUsd_z zK}Z;b5^@5b1g!F_`@c#jB}P~0Znw3EQdV_{SbBC1r7jx1y^ONs^-56+U61V~h$(w3 zFj~ya^`&>JA<&TDhh3TDmvb1K$;!xJ8hOppCJ5`&)vKi3`C^H@T$tD`VBX&&z24ea zQ2VnxC}#0!l*~8dYszSX2&~nlR3t&z^ooUqB+cZICEGL2bq|itAhNc@-I!I+&I3$y^yuWc z@qL;g-HV?7n`J&WH&Q{002OM~Zz`Sgv{clT8{!3P#t+0I)S6^kpHX7 z4-RuK2FW&l6eK4O=R#g@JH$rhE@ur^ksPM_{&>4M`8H^=Bjo8>MG*E1NI$nKfpEB+ zt^ckLjC`4zxSI*&wY#0S*#j;|HS+>5uk)RhRD|&Q`@>@b?naGjL?4VH78QW=Dg+jQ zUC*g$SF5f-ilKI#gT~f+mZs-w36G9}v3^@7Mh-;fl`&G4RAQ(Y+YRnTGlaeBr7;&_ z2}6`(ul~@JKQ2*>zfve4PDEl3#@!Sp^{kKl?5pP^BEum6A@wOv8I%=4Zf;vPo}L~L zTId;a`>J{PZ$e3(giq@}FYD$OFW;nm-8k>^gFSX$C(;qSeL(NI2l@!ZE?w_#bogu{ z08c2DYarBjI+t!^rhwR8S(eMkk()!choa(B;yQg6aDJV?D)i|Lhj8vhtm9FuW`aj& zWU#y5Vsz4}`!SA>_rqZOQlY@-fz7t#ih%?HdZ@cP{$Gx%uDp1>T>9-^kX%sp#rNDl zl&=>*hRRCmtS7`@(>C7>pMoz^l-0I<1kc-qzLk{^sMXcSJD`d)Fp-WA*6n4Ybg1!8 zh8;ZLKCPc^(+>*S?Bft$3~z0fiQbk2wQ8+X_pPR-k7wBc2;nO|4z@?tS>3n3DP!!;6Mv`> zbhDdF{baS6a+BRFb7*(`qe1r8u_|6Jl3_mvDOOg93bw&zjW=dP=ow1Y_M$TBTVYYOxCu z_KL;u6h|x5CfK6e6rCds9ZT0x<{>D zoIe1`1c+UBcsqDN4Rw6dv)yi|b>5PH15f-w&+gcMRN8Ug&fUU-0u_UWp|Q0`76YoZ z26H(4ZPh%l4elJ$TKJCXphJ?7&1bKBw(UpzYAv>;#B=o5T^*p~R>9^FwtBb|f@b~o zo_~j8axEz{&CTBRux?kAY1@>W7mhLtP%KVoYAM?s4Hj$x6U)vKJXN`R`JeW>!GOCR z%1sf@pUCsu0xg@aF|)`3vAHQr`BO0^eiucgzA}Z~PO__h&xuy0Psf=?MgP4yHtGkD z9MFYbQ$h~xr$Ld~@B1i*{=PnY-{U~p{N^e9>Uc9q$qZH%+uGY##?+QoyxjA>bi?*q z&Lc+aPt?9?C!aqrem`j63k{VBeBHw!g`M2@1RjSInVQj2>p6AXmP>Y-&{M&5eU<3OO`9sgHJ!PgM0?01ki)PPTf8MTr_~O_O0~ii9 z7A47+qY66a#LqAzX!rAv&1b`oc~h$VPr2F!WD)rfe;5!WB79whf&Z#%;FDUi%gBrd z-fZ!443aUsdX%LQ`MIbE5=Nz~)XeqR&s@0QDKGb|%_a)h!dETPtz5JNz`d`pXoPI~ zo$m5)Yd9^l0!P0*R$H8qs6w{7{h$Us!sbm2^0+s*9j>Dvc8_>cB?|mRh{L%N9vR^p z|6X^_`#z>>v9&+^`#tU4S04KL^Je$yiCw%PvmGxVbnS7z*6?tz4G~GgdAwg+)#PluvKl3L6K1?}s$8 z7fz^qj%#1;td#oAKh~n>n%9MSAsN|RhDK&NRG;2HB>$_OeEz3Dcmk6a@0VD-Z0pTU zX~@Xvr^9q0hYHu#F^LwzFufQ)vM_>tp^vEvQ{B9Eu^ANhtj@u1fRd_0_*=<==lX z|Ep^Tw5nGE_eRKpd*ZK3Km+*@$x`6s)sORzNs+zg;c!a+?keQ(M~^ygS#g)PpEv-2 z#87KXyR$bKV#(ff^RFabUvS#q7Xd}B+iUQMGT=aH(`P(Y>-0Toqj>5cPKI3fzgp~6 z)avD@^fW$|dx=hTC0{Az%OTo`)Oy*m3E9GEC-9}i2GjqXRVvg4p{I?0XK9Eb-Q905 zlST(;&01_e^I7uW81#$*S5Tiwhv(~71XS$)N#c1WV$Q#*NVN>4wv8+tRJ~8(}1X0{0N7y*=(sF zg>PhEgldwj^F}AZN356Lzfi-aMW-1aGP0{mjY_o5Yh}^nUswSbp;c%QBKzNsnDA6g z*?4#@>z=FmfK8Z2312FqjhV6e6p!3xS5?dZL{FM*KsP;uM?M6&uiTRZh1MWtPbZQ%Q{Q&#KMP9Pu*-)X z+UGN`5fldDr<>U`y1$vU)R;PrGKgTk&k9VNS|!P=KQeg0N%Jd}>e0n)ssHZ*SzQVUM??YDGLjSlYnN{U0~lKVJER>lvIIXM3nM#^)Gw(T0jYr;lhBh{mw#H7 zf=aKy%&*6!kMMIRU>`Meyw@(T?B1@}+gB~@W@KoAO#=s+JZ9Av_yp^iAOe~A`;Mb| zt-uFJewJr8vgq{X5cxB7vj_GEPlZIM;XOjF8u0s$SR6gm%jeK%$9cr%%Hu)~jI+Jk zqpjz!_I?20Y<93b%{?Bi$zxmY5vjCNA0 z<_^=^!m)z5m31n>PDmMtE(NmqxL|eTL66)z$i%={KapCskWGV|yZ!Y^ZBM&Jj5(oH zs_Ua3kb*ORd(Gw0_RdS}w;hnCPD%fieeQN)_bJGu_8@h{{`a^Wb@*R5Y`Ms!$Lj=v zyCtRCZZ1Jin?7pQtOI4Y<9B`c-S^N+&FW^KbG3+>awa`|i7vM9lT7n33aQ1;<0vSZ zUMn-#N&vW?3pvJf)I9UzJMqICV7QeB7@8&OuwkA2uuseY)rvV*4i!?$Q-l_##g;IZ z?X_Z4#%j>&?7n#3x_%`tYVzECHt_2IC5_$6%;J4J*6XC#MhWB(Zbiw}53#H5&Uu;- zU21p5%ETL`wOm=6>^SlizI3G|=BljQTf z?236E$KNAzwec4+HuBbiO%_?mlSqwdSPqJxD86qw#qqn4Ab>=1es5fid_1A_b2s1a z-}cRInph<#Mg;BU0`tYCLMocvQnqRIAfsxXqDD)+g$lLhxQHC(Rl>H5SB%>3yC$@W ze3JEp*c6E-&)3__CW=ETaqvzr zcQ0XKIC{b~60$Kv0T@}gpAioOZbw`}9RxN(;Yetc{~bC7=jt3424-2pQ6>)?Wk9uL zeKfF45Rk_mUqD$|AorLHCkh<@sO6p|Cx+eablv|)q*jx*cU)TznVKLeBPkY4uT;e= z$-I72Uterqt?x4=v}qBy{5rU=P6`h)?;A)RVSw!!*_8l9CIdwT5C`C)1Bk^)Y}sXp zp5f}3hwn3%t<%A51B|&j=qK=02iHX%Z?0ZBr3jK+`2iz-R;UZl ztqV$!$DT5l#kzhHyq&5*Kk1-~TrLOnxb&U+_#oh*;wCS*cV>33!vO_atr~qH>?ieO z$*h=^8a)KUg&w0kG~W2X>7@Gm_@*qex61@47*L$8x2o#Gf5oIACT=^dBx1|w!`kYc zRV_)@VmjgfyUKd7Iicr}ti~X}VS8+d1=1s8(9U3Kl7{UAUMJv<{;SzY_lsFdoq2I& zk8U()sZL1bHQn#r|E`>Yh}A%FZWBvp!?v7}M@Lz0znT}pr=&rPNzWlHg-t;6NmO3v ze;o46mQ_LJ7h7pY=sciU{S!Dir6B+CRjSa*`(Z!ZN%U@*c0IGWVxEuBq4R#@*-*cy z8&XV&9hN~%l^)fl9@!>E;Y>7zeS;br^w^6%oh_cgh$w8#rkY#6&-F^kQ}yY1Xz;OjetK{ftPfbI{ZBa39d=2=b0{F5d`3s5=i^F=?+E3 z`_YeE@=w|@`%mtNU#p>&D5jx`VJl?PfmJQ6t;Z`uwYtt6uwKr%E2y<;>EOOh?cCSaKE5u&Z>( z9BbziU6B(sBWF_#y~Bc@{IKEDGLM#z!nKiR4CStzc?fwe-hU&~`4m0cFodsI64~gA^NCw^Hmd zHZL)cd?sk&dI7Kgq7~Yi#>hE0lb{3nQ2QdS3d)`UD~7yH!`z-B+-d5^ll+&VqPGWG zdvY>lQN|$;m-NnKbtRCdmp9*Hz{BHZZygSY z4m4y7{tqHQ!@m%#(Dr?hL3DcqBgmcXgl-xb*xa79YEfh|q~PX-Sme^vD?NWH3DvB6 zPfiKtC28AB{6#P{DRw(IGO&QI{xPuox`sas@K9z`kifZ0)FOn!b$Mgl%Jqy-g<= z`CTi$$Dn$LH=IxiQ5JoyBr@>s4Mqa4AUlji?gsPOZ*<{1dIG4)i8CM5`|O)Ak3EuS zKBk7HWb-<7!UjpRA&>}gzj4#k-u0wWx4AriDyCkS?_M;4)7i$lO_Tm)`7$p(Jw?FH z^g+Ilr8(>cpdw`P+&vMeqEcQU_a5Lh|`t_zR5dwX08JdJNHU>&Ig z?*yje>ZRZB>SeybHlxPDaX?zY#X#}RppN3&kEW9NN;M$Y$MhM80G%Omf$j5OVo@uj z&_5Z5mA6m(*=CHwyGxmDX3_e1q~|Enq?RTAhPV? zqo3SK@Om__6{ar={~Mz0a@-C^a$KtWnO-`ZCM5sz=bH*;gXIr zA%gg_stBr9gAo|1muL!5B{?bqc{!}3zemrfux21O_iT3d@cf$oaWOUL^dmH2(f9nI zTkL*&fGh}Jp|Az3`*pl_GrHRd84eCq{e1#VwXour(?`tB2Hbb4F@#CHh`6gbJyx6D zdQQ(W{-$fP_9P^S=iMg&9$_LAGIy*@oiKcQrD2l`CnYsPq83R&(ZO1 z)}fWeB`AZDzV3TX1U1za@$6s<10dZWAKBG(Kdo-Q?4P!|dEg)OKW2ZKREFzk=VGcR zpDC7K+43}@RE~vk-i@$@8sE&-*>x4Ry=Xag+*Y=%acP#jhSAa%<+ol!@?ZZjOo~DE z_3~2ZY-Ma9e;gJKa=dd5G*f0(>9~PSP9usD9c&O92i`8VAL8yf_+M#?!(~6*T6S#f zGsSenQQ0Y}*nT?q1-1^w?Ncmu5M0By z1mw>`VN6b?<|tj%usK8*11DD!OdR6yxv|oP&7EwyvvceKVmsd~p+{OWCisGE0$wSM?>5^R{4Q#R^z|GG*ky*lZL^s8 zZTN(rrW%wPWm>1X%cD{KRraSmZqeNE(h@Ko7Ub061!0=jt3RDuiHbOF2>V^}hld!P zAJUz(;BUIXd>Ro;f#L2viAUWp?msfgQq>%odH|muUqg=-Z^#62`^;V70sKRr-~KCG z#!i8OEB0K}ZwIjF1Pb9^5KTz;M&2s4)9&oagDV>^@4(#6oaf%3?ZcnT`cR~nvo)Pu z=AyF%iQPyHGkdg7Fn_!^6Ag_g+^MuX_I2bnh#n`NDxMe**9AfPE13V?7CbukEp{r% z;o*d?AUsJ50d?gX1d5zx_rpvytD47jHjyj-{@A>hO&;5M1dSiHG#WDy~+c;XxV%13&)LC!*s1r2V@}-h>FPdSelk$=E9~?UIoDBh8FT*M17xp?eo89HE18R zj*Hd%{@Wm@TyylVB}2vhqM^Tsx&7Kg@=6vu{1)v~Y+Izy;2@X~j7~*?5Q$@jeG5hi z5{kr?8gebdM%cpd1%p6`R99!~h}L3BCQDp@aNN-KqyWZ}6sWl`nZ+MtYX9|9P^dL& ziqdKksyuE&Ex&s`=% zow4Rson*&L#{G#1au7B8~gw^?5>nZl)@aELtKX#ghC1(HtcOv!(FTkETkpxe+kV zzM=CkGECqrU_ha_r2psbHCv(YJ@YaJdo1&=vGAw7I$VwlXXzm(YX4d%kz0w+^ZL6x|SE^i&QOvfJ0Y`=cD3%1<CB7pcus znm7T5?P0MppfxmeIM%v7Z1Ab}OS}mMk2oTe`CCN2C-Y3iWM4tah^Yp-^Ej%Bt>1bU znZB#FsQ}XeN#u{Vzc6GCqrGGWrL+IkeRn2hPoKv8XNz7F5I|hr-Bz6D^oLW}HnMGS zOs(>}1Y*lbHax+vF5%_LFMq4bln@VzPaH44qP#&){N?xFK`$+0Xge1~L_FT#pum&;H4jeyZFM{h zN8s!tQ2^8OUN6;;bgYXgae%Y@`uqUW0lIM&3>ab+h4Cwf6Ul4Fk?X?qUL(eIWi^WlB3d>{hbC~tDU-EJwcH&O^odd6C3 zDk=KgepN5c*C=tI<=R-i)SO5V&&&JxF|dU;F;E_3K&}w}OY41xrXBASldq%6(9F5`3OezT&F`QngOuIigj7*8IHK$$Q9oj!khtC9YjfQyr&R=EcG&QL@mv&} z#F*SEE|D*{^kkhTmNtnaz(+dDImcC!o|*auoT8RS7a`T0*u)^UR(Lf=fgoUs@g`K!8ACw9&qcjy@7Y%QbYoZqV=xfaI!}=kb^yYxE={O`4 z@X6TV6esI6Mr=cA5MO}?s_ zLeN(Tv;i(9z}B;^nvSkdNJwaBB&`Dx$OCGUe+FHMLYESCp=qIlV}1Fggu0M&{Lu^@4wD zmTuGLkZmZ&zNrgetDD6_IcfvNV*%3O)uDqUYIPTfLEEy4Tbl0y~?x+bIh9mnlGNn zgSZ{M2jtEBm~*XIAOlaM~nclqLc5e_Ph z|MrW0Wyi?(b|p$VB~UidUq>{wUN2TOE~{sxW3stnhXEproaiH5k@ToYEXbLRI^pw@ z)96hhEJ!R2w#ej?deP-C_JqO2*3DvFB-_Dj#;(gSW(-Y;D^X^w0Qx$RCoToJr~hHX zC;T4VX#qu0(_4|15+WzXe0crM90z+OP0W9=#!O^oMJen*J@Xion{Am_oTeHI3W9fm ziQ^@jEIgk~j|P?;o_88Mq)niP?pinX{x|mALKQP=jvLJbOXjy-g0(3e`qvl39Q^5{ zC<8CaX=wefXF4hcUF;kjIO4dR$`hr&vM2sRz;zNqGW7Gq#EUYcJ(%;H@0#orSIJDs z=>lhjKDtwX^^@svq-MoLvc!Nbn&6!LYu_A=A!=s3>F8Od0ZSih>}V}k@Pcg|&8dDF zLQ#9VH>tnWP@&y0@{+Csd;uR|1#ih$aK9Ia*Q23|tO&`QGDSuO(QhNA)W7JRKmI-}=0k7G*?FS1`Z zO8ymT^H_G9yV5eKy^VV7jYmV7^BVb6c5T}06a&w@Z@UIQuc&Toi|`g3O0rtqS3pGb z%()X5eN>_3;)8PZU{!C@MtfCFw|NwQbjf znPRfa>FM~F&t5-OzebU^Tl~@P4?pwa4u*my{lY5CBM87CqlS ziWGn=+1D&@ym1fA&nIT}}0D6i>c7;28N*v1L+C zPA9VSl$P4(Xy1bH8xmkc770%_s`wn6F*-Ax;xz7ZfqL(|S!v?X3~Z4`%(BZYYWu)8 zM@~;vsBoB5>MvNIkM7qjl6IyB(Yo$Z^!}IA%bp=7roMkR0G*?RAok|Z&J;O1)a`k_ zgoLnqVfY1C>1#6;o2gFO)8I1V(cNIIU)^CRhqEe!wb4wIh@Ezpf0eZi+MFl<#BcV?6cu5|fBkPzqiEsj~C zZqDi95q8@ufl*IW3ohcNj+9-G1rHuQ2*alum+QJb-i9 zE>{C89jaUaZzr(?X*JPztm+`k)bFU4DzT%<+Xj-?*novC6C9Nbi!%Tp2}_HZ}9$owd&c$9m#OY51neC(KL%nQ2Lz#fAn1XmiK?ZLlXPIQmTnXL6kjA^ED}9 zA@kTUskuA`wiSqlVJdfc`af%I$t&b_p|RcP@#p>5q?xv3IvS}oja=>j?*(80n-dqS ze5y3LQp>ffNs)+nl z7AUutzWb}q<$oWVHd6%}$h_VqV6IULve)M0Yq1JNnDO-&Y-N+!(acyM2vqx)6poEK zH@Dt&LeS`df8O4|S*)!Y2xMjYliBrW#k?Cx44XFpV`-qHW1`7d_eO%QS*UBz(Gg_| zCM*$9Kx0LpQa@_BChT!0EtIS2+&)$6xA@(4a@^QbsTbRz>V+1n_k*idYdd49_6dx8 zhja2u3a2ZLry!@JT(jt?e6}lfWLNCpAk`eZURWjsp+ac7%ueD)%th};*wUL9Lv*-9 z7VusnP2*GVpr1Kw^#aRlkG29G5^?;P*kM~ubMA&54!Z_iYLSZyP(E+faUo#s8#y_A z{6p3*;IM-|wTOGa96u}3__*Hn;_XGniE;D>Gn;HzA%n-S;_yH@<%YLJfZin;{GHi*3r0qmv7)2dKix)rRJ2 z^T;5pOf?F8=!6J$%uw>eA>{ukHnYcuKx)17cG_XYonGAVJwUN`n$6`qJMyUw%(+xj znwF78-4z@kw&1bnE6$I*hj52t+gXmiwt^QVk`n}QvC8cUaJ>cv+OlHsEQ|YF^goOK zOI?{=n&PKnUUo^eR=#bYTx672|FKkT+}}{~?6hP@WMXptPH(`}p>-qlqhg9SgOHV( z3FETc({|3YV7aDbo_h6dkM~J@voIawO!|mvg3dRvi69}$tULGq89u;g&LGKMunDcE z*|Lj{61ZzsG2W7Ro8jK<{pa?4e8u$xF*Bv*_22zkQnoL53l?^j48JGOw>f;Ru8$VD zGZZtFfs2-wkK_wmjEUVk|MD&hW;mteoG*{zuk?#c=-N!pgY+6CIa$bt!k^| zW?zht-&*!cG_M_jQ)js5;Z=$OB`sA3m#SSLKv_>?D0te5 zk(=T~?&L1a5QEh!pX+nk+Q0fAD#^oKaY(5%b2rfrelDwd(uM=ad#awBCZ;?lsY- zQzkhQZl@gm~O54%BRB=w$I%2Gg)p0hhBxo z)wTIaH?2Ne%)3Y->+LBTubGsOH?ya0-1WDKF_+!gOI}jGkbGl`&pGDz)QN1x`j;H7 zdD(mI8Ny_yUJ{`+%W~}IS}@Awp?~tTfY|vB4+RB^RsQPCr034TN68HS#&mWR!`CYp zeaVT;Dq}ffVj1I3`+JOqyaesf;0j1`279RLkm(!W{&yN>-)0Z5pDD?CoJI=rd*a?D zglW{4bjyXXZ`_qmPB<0x#0hej%w_6n)~CA0icm~0HfRTzLouKX*m*AxD9aBCkb`mUH9-9rpr&9ZvW^;{qC-{H|cg|<>8Wl z+0cmADnBOkT}YmtRef6rcr_XbID9UjE}5K^DoG8C67|^{m}tla<7SyF&aPWdN|TC# zPP2La*S;rfPscTp949o?QA1{FgW2YO(5zpx<;989EXTxH$;mNcLJ`vVd*FQ1c(f6K z>+JJxS2Fm#h|k3bN|@DVhI5i2d$fC zD*o*1ohZFreEtlzwiwg$Aa=+^*zDpNWsMmC`HsGh3>Y&crXB31lJCWukK>ZEk8tQV z97OTF`FYk2B0g`^4=cUb?$^Nn^1ROd z4ADc=r60?F>wJ^{TDQ~w{FlLB(~$z)b&3AJxkCl=+&AL|3@#c}HRc1{hyP^XG9&b#h`Gtkrm~ zMx{OSSS(6n#P73AI~@^YGQ~*ab9My`P}Z8^7gQvVn5S)?Wr+RlvNWb9w>fS6@Qp8H z`SQ=8yzbJ9n9I%`nL&;7M&9u|kKj>Kz|~pP=53DW^#WP854Tl4%6FuJT^Ep=Jc>oe zjwA^h&h%oUR1V#^7Ykldz<$eU3f{GHXW%q4Fj9*nR>5y2Gj z@Fxm{=Lx7OpmepD0dwJN;>M_46vqg;gby3kC(${)y{VILcBM%CknE z>>r$Dx7jYZaI}ZLuD3N^qMEU7SegoIV7?Qo()xP=(8Ts3%+C!IJrLi=g8fUYg*CXqBkw5wDGrji<%Q#wW zH%YYgTt?q&b=q-|;8ad}0q%ogeXhhIJ$_ z?U2FFS+V1{Q&c9_9Eo`70JX65*2H9f1l{D%8QafJ`|mW_^&5N-Gb%Wxf;Gw8&mLSH z+MgB^3KeU!-^=I<&X{+F!DR_3vNTE&hIr^Cp;0cvXG?3&<1=b(NI8PI9@L3NYR%XP zKP_g8{Ja5h0F=4$q1f*_W6gG@RZ!BjOtsuM1o1PX*Z*<47<3CsNGS=OYb;dK$6?Wg z%wih*qaS^Ym1C~P;TTp5jgl|@*r-uc`X6Rb$GI{E8H?2PfA5or89sc-N5@lZ#s#8aIi{EE7JXbU_4Q&U@F|-~=u!=rR#s==@A3B>*SNP5i z-ikNGrNo%1zjP6#k>yUT$Cd#bH0uRCaBu`dKVo26zhqT1eQpXbQRidYRF5(Z51 z&!0^w0d3i0{o+NEY>|bd_J+1G={j=qzPo|j+Z55~I~ihTI0YCS>wBY;BWSZrrQ3dU z{4D%d^oieKu#oKY-|E;kL>LPrk%W1zPS;8Ru!s~WpZuN`gYcl``-zLS6P?m8{#O8Q0##ml9{t;NdQX*Um z8sWBqR8^=KhRYKX2TlJgY8oi8E)x|o3TXxM-jpm07+k1x`|#o)vj|? zGw_%jxx@PB9;ZDii(o&2TGVr9mcv@feDzgHFA__Tt?uJ={_4|?P`CpeVRK3$@ zqUj?i;-;pmO``7uU8-fb?4PR)Z%#yHL%+VHlTFRc6!!YNcek50OtZVuA)FqZ8XyM36aMqa5UU%E0OAVu`JdOFQ`+|qmqQ0{MY6>{0;-!yfsQ;d8w818=IrY`t3OhR0@(DJg4>KHRxb*YLICX<>5$wj;-{^Y z4%=xeuDA~@t7qp_i^$|;?h>2|@tOt1arAlr>1kGwQXtFdhJe~xnkx|2a?;%!>2WN^ zDJUufaEZHEm--ui?jCErPxyLFzD_RGXG=Ky z^}B^~dBPe4LX&0VLDAq@S=&!J@K6jvm&H1=9A8bV3Pj)gETP@Z+DQEseI9c?*HzE2 zc(lS^7mUcZrPII8f7XuYX{7OfThP-hX$lF1B5gEg`CLz#)q$x4VwdeV3;N}w)AJOH z=G;-W@f#a!qGz44FTSkbZuBS@GUhRHLMxM+jjhfPWUyd@5<7nB`DZ@qsRFSYM}nlVh=&5cSdb0 zVNT@MfNotWq;v*M;1PNJoA{nop>W~xQH9=Njb@-Z#sq84EmE4ZuiM7#4PGDb*RP;E z{GWveF(fT9ar^mS7hcpX=6}UMo)0}%F%UvAakX7(JRCwd!W#QKZQg2!KXc_uXuzVx zZzBX1i%f-zJWky39r%6g7zlaj-xEcvH&_u-Q1($-y#}JV@E-p9AB>Ws4>X;mdtS=M z(9(!FH|dr9lxRv*s?f8aJ{)nQ=@$p47TLdL`m`&58`+k#nz4l$FWT;4g|NP9v8`(K zI6VBp3PWphSZjaFs`+qrHJ8t68+TsQtenBOu=3JFKe1@pslt1Da9cj3p-#U{r=J#Z z6myJ}enZ0~;6Vcej}=qFh$+G3=`oRbsN$!+10mO=z4k^tdWpPgaCo}rIT^yF9P$Et zEaN7nKPOD%fPspFcD2gM zg}^$DTz43G0_=(&44&OKYRuekAYrp9krJuAGe#^fg6~cSY-ec$!~RQ5YKZ|?4H*Yg zcOJm0y}_6B-s7c)m!n0fj>ri12va*L5yCj6|0qqCYydcNQy9(|_4w)DQRZ9Ue^Fgs z%sF53_&&M=Hm1RcpR1nAsq7!NBI<1*@R0bmnQwelR{5`x#NNCQrvnfb8T`-p?2XjI ze&CvLabwm#A*Z2$nPqQY$TR4+s(9zZ?xJ_^H?dJ0aQN@vm*JV>jFT1OjYDIT`UhF)4q3KD04tK5kgKzYzq|0f3sG zltcgDB-k{St+{d?9XX-` zw}+mWNAmNP>iO>3r0}25U#!@kt z7MHyJ;=S^x=2=UyXHU@N3u5A-fN@*p>9C)88bSq;e|>L^trKna7#}rw_%l6ViOq=L z;W3VqE2 zwCr-%;rp;@DtDW$LMXM|;qdIg?9`u}o9k6L6m3PG00rW%f^f+6&i3*A_Y%rLv0%+1 zpOM9s?+olUTelTSbA&xh)he_PR79|EPL>5No&wWYwc^z$f1%t6A8K$pVN0pxf=(y) zMdBB6lbW0SB}hocs!7dy6_fML4$rf>cCxav$Wlm2Q0z{$Ass0$1pGfL!mv;T#F`Ez z37SqfQ$*5Vq2qQtf8N&OA#F5_suU2husoV`_t#C!;P;1vvkOlWnJ5>m<$6OwDMLN% zaon@wphyJ-*x>&ERt}cd@o!B5QX%@?PWdzHvABqSjuf zD4T1|S2nYldw+VGDd;lhHs`5+(zKiHE^ghzN)mtw+xhIGY;L$dF_u-qoZaa~Q#>Rf z6v3=AvG?Db6szwY(`z{zAi(b%-+^XRVzcd{rE2<^PMzb@tliHASg>=OXo*`nFZxIe zxC?Bs+NbW=B@!#oT&eU)3aqncFryWkH!;UuFr`5qjWH11Rwv4Q7jx!A)UO0(PDyMo z-xgUkZnec{(`k5k7QKL?TM}AT@Y@UYvnQJ}@!0kKO)>B_E7!E6D4nLN*Zi_wq}*^n ze9VGDb)ob@ku^cQZ!G7b_Qfq?MI}eT=holvs?6Z|05W6SC$*^Z9ZCTnmu{?fpTmk% z0Sn3gzv9DbMiQXZ_?D4pteE4I^HVcbk(B<`zf#Fo4^t4HwEJ&-P&A>SGLMd3)a+LB3u5-pVBJ)a1I4!a$_L=^Da1 z38?|<;G|9+0e0eKWNxGk-XD|-Q47_+Aiu7o)ujJAA00RN^>!3`NM5BTs6ChmwXDuo z=sNt{VlLa3M}i{+c`STxDqH?X8MNWI)2Vk|n4h2D+arfy{3=rSZoq51{rkJtV)Wo} z-^p2U##&yis<=a0K>O!+NBv@LB`RepVfTw^j?)gYNgcYsH&?#bL^+)DQDF`LGT*7_ zlzC@mb>Flp?JU=W%Er6Pvr7Fr6_s`(C)`Q%?>%2*TiZPqb$*=s{|Ucfh~)&Yq_2(U zqrbMcCLhsbVq%XM>RZkyB=-e(lae{aoNp)Q9sIwBc@xMg7GjD0&8_@c_A{B|RM13u zEz~7smu9}^&= z();|D$`q7R0h83YWhXOy$GH!qMI)yFyuAD_m)4Sd2Bgbp4qrU}wTR>Tp>Z&<&7bKu zyBRA?SX=@p7j^RK>AU1n2v?GMo8GY1t6qI{%v+)fApH0AwI27!{o9}0?`fabzJlfK z9;HG6EU=ux`=`*jUgMKXPK)R7t2vMBD}s1k7R>RNlGn63eCbM#@G7Uo?8=kg;gr+m zpKqh`iQ&xqth#*OF+7~ULVeZJ|1ClbX*_J>li7uT8$l78h0YhKI|55`OaA~rp~XzYcw*;Y3O^qjwx$>LcMcp0Km0q) z|Is?-^5<7WS68Bm37*JVSu^u{q|RaNl{6l2GL90L+4a_KuTd5up^u{frW7xZ8!`U7 z{CBvr|C`z7%F-1@hyK61%@McC!^LG0BJPrp6{S$9p;CMP=Iy}1AcJiAWKR*3LV*8v z%WALw-0>a?aB`>F2U->Li8q%IkHC?VyfG)5Aki^K`y1gk7PHfy*%%;`;u+2Y#LnOA)rSy{a#0IO^|Deslrq~zI29L=TyvRj|yyIK9()O!=;ENh=2ZEb2IsR+oR9!JT2p@4zZ8 zqkE<;{85HpnUJU7$@%WR&koNA=9ne)6#xnxra|C1TXd920pAzpIaJ}e#-rp^-!oeRSl5s#uoCc_yE>b7qyE-_>MCQWC9{ z&xZ&+zpea4|655RE_zaS>-Nj6+(Q*yJS`^X45N9aKjv+dwtPLBiVf*h*7ee%DnRSN z89AaY>oZVAfFG8GkLT3R3c`^gP0OhvQfs5zQg7x&g#M{5%|w#zUJ6#e<&kmj zB9El8n9LUO-5yMKb+;8>Goc2|PgeDXoPrwQ#@T|VBp`Auh_ry(vPeacM{AciNl{Rb4JX2Ce>(|Z@X&8{XoeXMZ(%@ zyxku>O1|rhHoN88@}_b&X@g8xLPUDzwb!7iGG*Rl{SJtmJ%kr*{<3`OBbHry^zO@g z%ky0p5kpV<`rk+j7_1*ev0e-vzG-mrD&G8pTBmHFOZ`(DPp zBaR2K#;fZHIRP9=&rr0^e^bFTMT^oX^Njh>B%Be5DS(cjf=?0-7=`V9L_)8&kAf%7 z)1uq;ejw$<8Ysp*1E7LE*@@2VCut@*n42Jq1VVEj)H@J2#g z!I5x7trO#WaxQhJEaK-PmvSrW<%f(gv5_*Ck!R2>6q6lInppIVJ4O~Y(_gx4P`d4JI}>0*s517 zzMb9A`%0}@xGyYLA1=o8V66Bqb)XY`;Cep_jrjFaAop7e|g$;+@SlzckQ01k~t8F z=NelX!(}Q2eRSQVH^Lh~VMLDm(DB-TB_TXS6kAA;&eZJoc2rg^ns;8V1$wyAP5_DO zZ`IPNjkf#j=fkqg`+q|3gpP5w>vfov(_E*#?8 z(mROE(q@)j4IKjlK}ABw54#?yf+;(R4bco={hQx#WUnT#b|%63n)?>Auz2;oVg zU%&=qm(4V8dR9<7Zg|&OkA~2iF!*j3={ni$&Wl z0|NvQXASzYuj`jnfpzF)rDoZJC2xAPSG|zt8*u%$y1M$}>}>Eu&-P^eWPJQaA~WlU z515>jrP4`A!B*;f2S7?PQm=w%bhV@|MQppE3UuY=JZp>caLmR>zoy7 z>`P2jW|)-0(S|_*SoE0xHt%5!A3-TlRxc4~ZXG}oijihIOpeg+{Zn+)z8m`9*ZOLR zr2p&J*yva*J2rSkx8r?7?wum32Qe1kWUIqzyTS7XS;zh6i|5lGywmx%7R@p%6J7)g zabR)ZbQm_gbAmL>rED7#Olpa0$nl6N2Y6xI^`_FL<8YG2<;;o@1{(!p_G~@(`Q4pt46wc6jBwYk9B_fBZ5eFENnwD}Pkcuh<2F{?9?vnSA8~P*hWt>#$ zBLM!32#5t}QH7z7#Onf`oL%H<=v_JpSSL%DdvN;W4e%u_4`)F-)(GhrKnj=#Nc?(b zNF6pjm_J6W{i0Ci(V?^J4PiM@as5CR>j{Gy-GY3iWCaz)RCfF zMEWvK4x}P;zHlTr z_OW>mXmmey$FJA?rt|m*hl(wC((+rp@%Fzf4&h5%9!#ErDb9z(iEA?~(!bX?iL)xA z%n#r7^QC^B{+s0|W7n&*9LpTbriDpJZFm}n3C390HytL}p|}*V>-@9xCu+glxW-q59bGPp5^gcQ`!_X{NN(Q95n z5UC+d;165i9o(~%*b%b}8R#UH!1*ptSA}C-wH6Hf!`8Q>$m<{WR02^=vEu@I4te1F(}(L~Xp z8X|b`wHRQXwNMg7a2Vt#wxA&jBP4}0(+-p7+4i18umldZVoU%6fLv@OZUr^fzG`gJh=>R` zw)uXw2?7%75(8;N8Mbw877S@Q3Cx$M^z`(D;Ktd|$$f>5NQc-gZpR(-T(4UQt3}Su zijBy2`)RB`8>YB@vu$UrlqtYcUa#he7`O=9BxAeHx%Z6LzE(Vbz@Ohp&8^>@p%!bSFF29ZlXx&`dV)%5< zoLRM=hI8mfTo|Q8EY{)1%66#bv8JDsj++*p(?|bWNF}%NCMr?o=f&e`F>gkCdPFyL zgx!2|;q5==*a4;~1S1l?Nx^zuZ9R$L&PORTL$OO-iLC!(3GkiaB$oK{Fi3(FQ&a^O zxjF4iBsEOJ5k7i)1^8FTzmOo}b>v}G9Q?L!AD|$NyAzEojh7WS?X4qh5(x=GdWj6j zB)9v}Q&54AL%@!HLqs##3P}}6PlbgmHK|JS1SuVMMBHiT#qD`^Gfwn>VRcNc%Bt!P zPDEXjj1Rn&jba%37V zQ&1Kl=wTQ_6nt=3A7X*#b`4H$2QnJd$-+!=gXQWLpQeVfNU6oRg%rS;tPj0TAkA1D zsIqGnsI-_aQpq(;3KWtLekrf>i5%0aiqh6qis^kXxg}iV@8k2`=;M_p4;|*ideEGH zPQ5OEH!f2Cc3PX`#vhZIg(^22y&sKf#XV>HyV<(c&f6m7yATmpZDlX#4l(hU0VHUP*C|%BBE>`S|)$w?Ttyl&O|^puQXo zL1|<&xbDL9y*>lV-BQ_G;oK=~r&Nsl>liJ>1Q*=d0A3mj$v-rz$%2BH;? zP-??@(Sb>oi6+6?$yd?pC*@2ij-sl7_Mw{;IuIL%0i=(J#v_lQjv)nj@}Hpqu#|z@ zwc30t5hA)dMRL?=0B4~g?*gphCFyG`bTUh~LdI4%;?r#*d{IwE5AP|mdFFnFeGzF3#pUAmzE0?keER!q zFrUowW93LJhTIQZFx^?|34S9&WsxCL{XarZGjI~Z4lM>)qCEnMeMr9g`-%x0hx5b z@Ov&Mk;MWdKx(JU zu_X9{@)xZtRuy@12VkWO90;@aCL7&ML?}I!Yk7 z43YrKAPXVIR1{+bVi*!RVg7_=grY5P{Gtk-g(#ZS){uWvsTqNBKl3FY#G* zfM&BpF^RK0Mut34HLY@lf+DT)OSNm3rFBFtuT8yBTD_WWXu^&v|0RV<%-iL?@)ag9 z?OCorKIS-SNX9j_zQ@ul;@hJ4-g->R=LEWMX2<524_F+WQ)>G^U)$<7Q)6(=uXP-> zUefv>Rm+quOi_n!7=Tz)XVZtga-tC_6z^^@?%G7XlVBK ztMxtz5`7}Iq0uUnVk{`ERcfltrJcWPt+F-gpnH|2o>FIvA9b-5tl3fR@SNrGa8dj} zKfT}8AsG02S~4{|d8Bx0@!|5RI>_6=-`CZ(E{P-6E{tT0ZH{%@8CgU`zbH&8(LDjb zRxo))-o#lJE=NIXnR*4IqgyPztNI?*2@kQvRm(QyDnhiGx}#QMyiwzrRGNUQVG3iI z2Bsq<_aFo;C@)|vNQksfB*HgF3{4W`GQ(65EysuM`AwZsNfaJ92zVdB?AR8IJ zCXpFP-I+x)w{U(v`D%ojQw5O0NDRi5gbX7D4blG!sJ)o739HUlwn*06*K4PxH;hoc9!bw+G`9e~=!$o-XJx3(W zXaTS|R#7%$3zkaaO}8%@mZB@FNdDAqe%vsY6y7wImhQ4#9sBTv=ag=~?u*_xCUk$a z3eJg$YdCpV(da||KIE>hezci=IEk0-c3&b2OfWr+`d(OUy8YQx2q%{ysVhs;IAHb&$&S%K`Z{umumlC03UcBgeOMw}UY7;Ix3E>iRYgM> z`WAs8oInE!Wr9@0Yz$>VilFD^0oqRBrPL232mC^~(lkyIN;4g#DNvmd!-#ME{TJsGgTiUGeQs%78P08#_lK3b; zwTxOFxTQoZkL-n1bXpYV*0fXPd*jhAH~6*~Hz_F3*pRgy8ykIMjMhMiOK2y@Isf+BZ5h8Ut{8Qj>HAAuknvotFi6#nwbyZ9O>Er-Wh%N9L8(Ee>`3D zyjd}7qjj<9V}?`KSq>(=c)Fd9UHh{6%4Y2I%~9=Fo41KiAnh_%?EKfnvS9znyS}I% zZB``P{*!|PN*YS9;gaI99RBgc1F!vhEh?uGl<_c?aJD|SbpZe_HLW<^PfmwT7>)Re z;mO1EQbUfHya=rpp_X?i1@Ix#&F?w~h(-+sf)NA(MHrraP6(_;OiE<+%K>pa^Atm( z-Vw-#2pt4*2IPb7mzo7sVqp1w9k~Ex+O)Ovfsg=Mzf%~Ws4o={;2>y|(byh~I5f?p zpD==<3#V9$O?ttoQc=?f%c05NO~S5up3p2^p}ZDQN(iuwPFl^cz}MOCSkq$hQgmuKHz zVyKx%284=uFnLw$JLo;0$5O<{j3s@;>co#3wK7NTGBj9=m?`6TSO)Dd8>+IpX9raG zTV$eF^2Ko}l}lnKeIy`GWWPAud278ZJO~{%zr=0cRSk4$8>N2+9RQ|GP;S!*_qg4Z+8*^mwlH@|XXO+Ir2p1P}o0 zWE8q1@)!vyL|W;bVALJLZr$z7AOOv9sM+^>MW;&M=sG`~YaLn>Hq?naLgA9pjF*Zu z%WX^;;gs;*sFQvJu@q&2u!0BRxb27lyZTt2wu|Ib=4f-BAE5Dj`~DNTe80KOqV>!AbXPr+-ac&$wr45Ry!znHzt}j> z9p0yQ!MRBDPNL3NU(4yLT<&64CNH(k+;j1@%2cWaT&|C5!IYln-Pu#YFB1c-`W4&C z{3`{2g2SS;{l7S#9jE9`@e9|0)=QVywPEQM*NL%W?WRxXK|#owuNX9@oM3iKC_$L7 z;NT4;-*)}5Giva>IM?pFPm)1V}UDbDGXH&TBmhx5yWvV2k82D^l z8aye~t3%|F+a!bdeNHYdvb@Jy0|L6cf;380ZvGyfoUF3P<8t41ZEHYC0Z};EOj4&Hj$9B!zZj%6+MXTYyA<7F+7UE`bt5p+>yz!7sxcS?xGHc`+Zz&A{;i2nZ^W+!5i<3C=g-~ z=dsa4b;?Pv+zt+Yqu>9_-?uVamTS%&OnwVzpy@C4dFpQL5V8Be_P#1AuAu9((ctbu zg9UeYcM`0T;L^CeLuj1f4Z(v4CqP4h;0ci65Zpb4;O=wt&6>6Tm-**q9%ijcKeXNI z>f5`k>Yj7zoV{CwI?hwgYh+F_3$CH-Vf*}WV|{~+*=5h(PXo0^tsV!2jyW~WAPTJ} z`-j`Y_4QWI-Bf1;?gnfE?ExO;KMS1?i$cri1*^9+9lk5@;KiX4RYovH7~)%6G72gQ z+lxK3FDLzJni4SfAw1jC11~b|nli6kJCBC;I@fRZK;;RF*1?(F1G-L2xj2G{Jh%oAg8zIvE+vgG=2NWu;xUok zcpDvkpk1-?8J~OfHcT7aJS@d359t-5M$QKDd!%f19P%V2ie%(8T+Z(7j|DH4i11)& zBE2}{)NaVivZ!AZV({_i<U+h3F5C(WO=~ZKzd7ciQUh-}{ zA${XUV$78Oz`HJ71gHx=$3+T^(T+mS!=jW!mQ`)i+aHn6$wG%v0HcPsi42!w6InEs zS;mg1e0caCj3~{8*p4Qs1rkkhqg3X`344@z?WF9?owuF?Pop0^mUVs&)pRw-CyOBi zoB(JF=}*YDESZOF&2-!KeM@R`#y+`?H;Dr3?s|rr^}Ogv4D?)F&Nrb-uMY(<4|hE> zjw)WFDvRQvTSPVZNctXkhuaFdenPL%P6Be!M9OPeeXrg#Ehd|P)dGiAyjERaCN*~J zc^&$sw%F`T8h_e2Yb+<B;QiRHN9Vg8jmDkP zeGXqon2hIwQ-Fj-j*#o)HGH;qwW(tA<3JWKr7#}5Y(@K>KJL;})_$#+?T8^#M{xE0 zTtUyUQPvF$zh?%y$?H(F)zVBe$*a$sg3c>TE^rXTuvXPWd)K|q$}hVb)2>4+npH7D z5}xw4aF3gIV12pw_blC~4tTtgxLP9AuQKu6NvJmDyMji_MMMlx2M!lSV(tPZJHq0* zT$yw=B;0&)WV%*gdf8)CyLqHz>(#~)UTlV(E5E0M;cj({Bx8qZ(FLFzGZR|8NZ6+3 zdI>>(OTq)j!=FH&C`c47CpmKK`77IkgRL{exfvA)_65*nfJB8J$E+H~yQT>P@z6)OzFF|H_v{a@ zkl$$xH6^B*wK+d4d)-Tp%4;&ba>*NQx!!!S+l<172P`w;S)H!UJ-@p$JHKqfq|+m6 z-99}7${Ws7k|;%aL%dLBkv&X&t#^j`#)LQ7RtPsKIW;qVp*KT-5XjHk*%7!HKpwg% z6zshh2V+fy+UWWIA$!w;qssL#+7i7xa;D0trmC8jzrOysva*@U@y25#mYLniu0`%s zpuVauQhydKeMrf6*rmB-@=np#&&0%kASI(T_64NpBO&eAPf;Q2ez30yMdP$3F+@G# zh6+gC+qBULYZkIO9}C|t#h?@M;^J{Uqr&`2_9kp33{e{upFD$^>VU#~x0|W-Le`wb zoQDSa5zV2HFRCt#i;h5E;P@=(xuPQ_CjmZsre>%GyB*UxI2P=D9VOw-(l^{ipAjI5cKSDYJzjlS{Vt1S8q*>IP? zYg3SAf@kZnL;gnaPR`TosYWNOm&;xnwb`Bcy0il9GB>BAd3AVAGv~um7omY$DUD;I zY(nB+)+?C1uCvAjt6+048L0vvs|{_dMeb6EIP)Y#r}po^I&QDc0VL@Udmjw~Ufo2i>o z+Z=({q!@(=s@#(*#>Pi#Ui9Mg$a};PS5^OR=IogO^j~;|{r8A|&x=QlNqXnXvgQ#@ zc@_kuc}s|l8nb>79;faZghhmzqeU{wX*Zp;hFKKFvH-Mk3nZaBv8LD_N{1k>bXAa zmBjU$Z`Z{LgAVdJ3Fd6j24RxK-BOut{)|cy8OP4b;h~sIyYqZ3bN_VZ>S7-jp^lTf z1Z$#K_Pk7Tvk?>QO?m9Yj{B1=@C}bRJLZlFv z5^yLXbz@%vQ2G4y&dXm}DVZMCErZ6ePBUN#B!A-(bJ4BgZFHk#LAI$F-iFdxYmo_M ze`0j3xjZ~rWWMTfcY6x&|C+K~-VMk9(8%HjG+!iPa$Z)0) zZ9lJVZ6=69evNm3+0vCK5!mcS)w1NgF{w-BoBfj?B`XHoqSA)GHnzMxa{m{Dp8J;9 zj73G3it6me-R-2$e#cSZs$A0jcSZu)`}M+TO)+Pf*HX#ExJqthVVtE{L6Rff{KF~- zOziPJfB4Ml8O@ymzkq`F`{57*S>>#6_~`a{xtbMf3KJWQYRxVSO}va)#phy`9;P@3lii3k}%4y7eeDcs7t8xxBYiVE~XLh~dfvS$aSat7s~(s{&k)&O(oJ z$Dj@ABcw}S+zTDlwJHmUeIHC9KaM4{g`wJ`Zmx&{9mY36LQL;AzaJ)wA^N;D<#_{$ zYpk^HVvl6Q&!%U6j#hx~8BAJSmVW@0%}4u<5z@>RCNIh0Hn#EEUgjlb%=~*{KtSGY zu(uhFmJTgF(z&Z^b*prtHAuhWd<_Y=A23!=6RBvfGp{ffXAH{-(@r63vpng_5t?fI z-eLt~3x(f|`lOHE8}65wws`sz&cK?pd%DfVO~Ua4eGZ4WJ>GsG$J&Y=j#TSj8((Yb zIvFWd%lusGpfB-#$)yqDbgm>?Fl6kL4<6Ya&Qvsd7tD^aIc^xY&n%iGWU3c$XbNwdYc%_z& zl+7;Em%y5hGH47!k_B@>UfH51jP+pm(|*VH{E)*|fVWy=EcEDZ^(ehGy9m>{{@PZ--{ceHL~FtH!c&AlE0{ZR0px_o zH_WyO;l#ive~Y7~IId0`mnA@tx8r&WlnBx}y&&wy$15Gy7A`)Z zF-bXt?xga3M-@mB>OF37jREbHgT*WAxuY-xYlQDlp#rCS*1=b<=n{ z(tzdVC<1e$AqYU^nN!9m$TDLmD~j_hJO!QycbIMT zW6|vR)VfJ6FDmuS?iXfvhI4G8ezb8+%m=bE%7s(x&MlFQdPHe9pR`S1358WtQGnCm za3YNxGC7Gk^AAT}mtp*l9C;%dunfQ8);9O(cy`pfn=W8m6MBDA7joM#ghL~!UMQ=- zcL!8v-ltdqqxIdeIZR=SxT_@-K50*)p`kk4=mD6a*(LYCg*qPxqG`Tks*<~Q9KQ{H zI)B%js#0^9p{A+Ng4tIBPRn<+WYi<86xLSx!FqOgr$>ajXgLDO%%CCHTyzFSDLKk& z0>oAvnW>68JV4%IM#uT@sv|&T1x&=_x05hYlOwn%%qudjL=*c~duQuSmwVshN`Or9 za&s*7NDA0N8A>WB2z&fwHIQ%8&NR@^3U>$&5})~F$KlL2DJ~$wBOorCUgT13OG$IkNLK|xf89f=LDb~po1)rghmsu1YH`k#V>J|f#`>4GB zsy@sai>ICd1R{`AtPas+OGF?zZ`XE?g6_@*0HNgoiRH;NJ)*o`soK&(Bc>I$+LWb z&FXAaVwPW5jg-Ua>Zgtm9ze4Y!6C(sVbh|E*j=4wlm~APD(Ei=m2~F+6C_y+PB`eU zzxxwpT0S3+bQc;t*6~XGOq~%!pl=YwLEv12JzG;%cQgZt|4xlc0L3F-Wum$+bW4XW z#fCODdPGQWaSD5))${e_bWntn-wYYGnazu`7_bsB9@@~tZSPEyv8QvDwn{hoW~y)J z*?`n-%DU0vLi2+h&BL#h2rEUyJ^#ZSAm{18dv+{GiY5%*2aYIJGwYp=KI@Kwl2=jl zrp5T7^Qu&+W*VHendFc5zX`&7UZi+CXShn67gA+P$R6AfR?MUDJ{vm0eBL z$Hfm?qW&Cv@6OzL7t_9Rk0{>0iV+yMf-1?xTYuxDPmcvpJU$~sT&-J)?MDC&5yVH0 zF#?_cmV~b$v8-ImYuWqi=_)jbHK_mBFPf+OUH`M4(wZ_rjn9SwS*2oQP`s>q89W@# z%yfCU8VWf0d$F;5Mm6Nk8qx+1hCJrwdk=u$_f#<(3#pX8U?ho=F00#9~Q!SK(%;JK;fTR=U$mrlElpDu3k0; ze}+mgZVZzM3_i(uec6w1Eo{j2h%s0&|ZhhEFti;&OGMRay zkC~m17bO$*fZU9aH>H&Hg2Q~P@dBWrft;eLo%SgoZq(Zh-NaY~TP*JH!Ow2kdFUnKeA$!eqYEWFskBDscqS*ZWQc1jg!;;vHf@stQW6DW1%r+WdNDxoM21>ru=Ou zdSbB4avK{!nq?QTpc`DwXZv_MDwfG*Y_}F&tw*BBni%mIl2-<-)|N+xe70HV;(0bq z_T#^NIL0DAC@^!11+7VA1IDXdmSf>$o>68*JcwAWpchFip+w8iQBvlVKi=_e8&S)s9`&} zRAmOIBcFP&4OFskeD^6y>bM(;dfd_{RxvsXP@qoKv(1OWja*vnV`Sue-E|3UYkZhR znyS9C0%bbRyw(xY-`x2{EHn|;=j3}?NYWJhFz(A|C2qz@O@0pZ=KOLdH47R`ay@WM zkHmM!05AO5R#!|O)h1?^HJCg_+7orrk1ffqoep`(Sq<7+*k8E{$GyLZg}W1>C!-?2 z#(Im%`M6sbdQr8T=RH%i`t&$>T#sU>h;zQMqtWv8tE*%efk>Zq()~|RK6?%tYhp*f zXx;S6^GPko9?qs z2fYPNaS081W=_-l2!J?QoZtFhmG11h)iamdD=wGiruqGYl*HviWp3sRBkj7U-;a0Y zRm9jh$_a^BT~7;+dIW%VG*SDTf4b7Mvwu3S@O!rBAV!c_=FqzYv;pt-HV}}RVMv4s zWKMO}=^OCozE}S39k#Kz_t|KV(n{Vu-$BqEOX%Ci#?6@?S@yUYp?hu7VDbn+%bx2~ zo)>tCYa@=W`Ebd;lATb1nVnppjY+J}oJsu_C~UdsYpv&jT0{*ofN=_*e1hH~_~Z2Ax$SX3)Ce7rUNTdgMg8)Z@tz zR~t8RZ;43)mFPK)D_A5un^*8T*r=@*%<2sH%Fen3qTfj7`u3GYgQMHSp{dD+bExJC z0_$I)7{Ik#%D(4q&q{unGU8&hGtwZ3Z;oURl-53lF*1E80KXYv@I;h{{3e>Me1=Q& zcqr6$vi5X;b=?`9TY}*f<-RQA2G~yz8!LfQS6R=MY)2S|jG8^Zy>e~!-)pe(XHjn( zJ)*gpGNTR{+~51;iF!wuYso`KEvSxTp;D86{$Ot2&5?=yeEr;Iot2)zOa6OtHn5g&7i<<8xqM>W-BSnLFUqQK_gKkW^K0n<1exctDRFJ`l@*~ct<#rwsM_#2n={Oy(ZK7;bxwYJsPo1K(LNw84>r*bl5am9B(2hr?&-uWnb zYqa*833AO(@p?=qEl9ZyCEy<%Fwt-gnNc8r#m#l#Q$!dHgPCa(d4opv!9O6aU?Ez1Ew>XKjq|Xtr!Voe5$`%_S+c7Jl>H~g3_s8M>G;H~(}wi39#a9v zq*?LRJ(suANXdNz*8b2L(*Al78^`-?aFN~RuU|q{fCN+otifV0XyW4 zM7(LfeNj9V)GbwN0r|7b&by}|-PERm0S#zl?C8jX^Im{T2dBgosUHDrqPDR^htu-8XfnXe^F#1YsRS#k&V^Atc4Q`}#6bP59QZg!>4 zyO9i2vrlwp9OTgQY@*62&aar?p(3LXXu0PK=E$c%rw*~WyWDrV9}avxSanDvT(Fk7 zew-&YJ$`t)9zES2iga#WUfz+kfHbfZD^xcCOZ&=w$I-(^qFA(T!U8R56ZXTlwiR;L z|E^lsxCZo9d+B1|EM8cU;|@?tZMf%P1}?-p?1hD^vdbOuVjKh>TKKg_T{+R#m~mxaK#zGnM$<{5s(tzqcAA+i~b^6n`z)fQ>k+?2K;yrb6Afa7uR|_M5u2A=-dj<&>_niac}2Hb+q&+5@W+i2GQ#kuIWB2B{b zsv#DbE@hT)3T!gp7W(lW#B*$=0~O1uNTXz*>{C6hvH#7s)a~9YgBVUaf>IY?Vtt<9 z8fLEv0=8glIbmPj;n~ebAkjq67kh1*pX_!$n6zj1_YhLztn!#x;|y5x7+5jJ3>xNu zoL`l+H=UOPd1X5@y!`%oz!6c6DX>leXZRK|KsU5V<-2rS{KmKAGFzQbGCLkTy!%Qr z_`+85sR{CwAkcd1lBk25$2YBob`4zo4f7J-AtmP zrf3K<3&{UI2v(WQI$?88)Z4qO{+U7A{5UkN-__(@RjNCf%Nuojcht6%khpQ4{0 zrh=~?n0`_~J$$b+J5OOA6$~W|Lz60&9@>D{d9rGdpUM9lb;!nU(+3Z206&r5M2Qi- zykg>`@)%&JjqZ-PaX9nGAWMVse(}%W-RA!-B)DKWiSdv*o@zfDRZG#WVu&dr((Z@F z(M7Ay3Mi4XePeBm$c-zSKijPnzxWB%hepEN6udr~nzi^G#OY{~Q;;F2SlDOB;1?6m zsyO*~ez#{#Ye{490lwj(j^^Q|JzTo}Va=-GzT|sRTov)&os8Kky5~-A!)*dQNm6v) zX+eH!`iC5@q@T5=<%tS2?8mm9!w+%EQQjKfRPch+Lgbh4RjJKZaUNm?jh?N$Lay^C zKiCil(<}KY0I4K8+bq}^ek^-}G8!a0hJly@|fp@bGxkpbtTQE_G2PT^%fozIzMxGg2x(7FEuY#@t7IL^8 zUVneTrlhl8=qI(d+E_6j0xj?lfWZilRbyL9(8(|OuKDE%#@m=Re37?`J5*;EPxmW; zD`WP1Z^FLUkX51}W)jjjih}x+lj=?RUiaYf+fp^NmCj;GlUTS5PvcDcir;48)5Gd? zl|JsJR~0uu%?jlrQ_bxDKB2bi>~eeP)AUj3YGL0dqz|R2r?7A_Vi-|H2(a7BC3%WlwZP4_WDeKd$}?>L+2$~ zKCUe}f_>w(jK;hVGxBV6qfb2a9-tzA_%XyKCePxw{>}9+6E{e@oCUoh!kGD5n{7|n zzLAk?K;92?h?lYMTs+mo+U@vlOXmgG(_PmTJX>S1=w&sS>&y9M({$6B$lMlj*oV9|lDl9-Dzkvb=o{wW-UvT3hlG~=ioKQ+Nk(uJt}45#9D!~4F^RiB zbLUN{73_hKGYDum*PjV=hJmrj>&k#$xbby#mt)Kp$c9?>`0gPA`wGzW0jkzrlZIts zipB0D7qgg)B-#{$+*Rz3aH!2bKP*E+JPZu7|NHEBf8$4HIM5!V~Ib={qIPkr#- z->D9Ks(0$+n_=a<$z^~hTJ5zNR-wH0GR8}&XkaU#+1m?&EH5O`y=P8THxAf_^)@JD ztb0u^d1XUtGQOYUzpJQt-3WRC8ERHij9T@Xw=uh)%v7`;*<#ml5D3Hai_cp2Xz3|P z#uFV$a1Gtt_!fHIM-y^6WX5US_A_&meUX`&x$evFN{+hwzWu!eVP=V04%o=KbY!7h zt}T!!D3NLAtkN4H*w_Dy>+YR+v1! zyM-QHBRyo$2uBtzPH$gb7|PI6=D>KL79dWOo`UnQUKPo^+4g2i1FsSQs+#cqsbbluO+i ze!m*o*j{HYSZZ>of1fq~5)&AxyA{HTtW!I-jfkt1uO6kP*h+g}6P|0uw2+I60M{Fr zeFl{rjXWF83a`lqo0jEZ{nnP*ITzy{v(?}$U^y86`r4M9&3Q*{Cz&L}nU&-$t^A-l zZ-~pJ$?lS8fIo|V=hMl_Md*_l-#&ljOmDLuQG02s%n5?9=f&?2?TcY`1^%~t&SF0G zGd_jpMV=Zt&!pRGd-&ZmQivEz>JN&Y-3ewL?Aw8OdUm$@8;-pIb5ysJ_EjpPI2KRD zmCqIr`LkxTs^~+gp4xS3HY#IN_LkBD4Gd6_hb*O(>!AkVcT1UhO#no2o-&$kiLjvv zIGs156H~*a`=nw7`w#}=-W+RUo+T+-v0R_NX~<1csT$yZS+gage-z5u&kypr+4x3J zPaoxT3+W$n6!TrVA8`#i$XTt{e3g^1*xJ`8^?5tPxASgU0x1H#_8eTW9q7|(o>f8` zF@>~v^F;;w*H#jM5Tlc$wU^h83Nx@>bgNoJ!HeVu7ksRH?0n1t)H3r|O!@A4x|q6J zgq#Hp99wjGnIvBDwv$1~I3u>(%CLa6BEY{beZkJ=EC@|!O*CW)Q%??$lN~zy-fU12 ze0Q~aGh~)QhINj09tzZTTe!7CD$oU|yVjwEJuF1n3n|F%89a`oMDM2pto+=}gB)%F zZp7rU*Ym6S#=fVOQ;Ld8u~2k~z!Za60bji?H~Sc01bgGm{d$d5tx(R}wVNIwz@+8* zF-I^HE@;wz{$>6wQN($=^5T_Luyuea5)f(`b`2a5OIQakhu)NFHX`4O)-|%Q%eL=O zzt|6VKD#_zZVHh=aL=$YGV@#UXMm~_(4&kS{`P@&8!h0VpDZ}mIWKlD(=|0X9bI1& zXPPjv4;_xzIK#fm8lC+7nPWz0m5PN+Bgl9WkzCB> zwcmnMD&rKSIQW_y9r*cpZ=pmP_an=`?%58~h|FB3sc<=B1y_oj1b)U^@BuBe(;|zH z$^gJv$o>4JI+4&*{qwd5$+x56E0`y0v?U}AhmyK$XTj0;&yu|h_2yOMTM+GDYxVr_ zEA{Lc%_)h%%YKy&Jp7O5hOCK`U^T|rdS?ivMvwBj&WkX;@`8{%i7RB8*F=@d-D0kkS-;WXx&BX)^jtzN!6UPj{G# zx0_mN({#~8l0$1f+U# zWQFG9gD4^)C_z z?aLCmHtz5ZqW0n1k#bC#wOCPg<++SjmHJsg4)wcb<#SOi_M!{5f1u881i|uyL+~E$jGW4e0#VL%gh9PU?7ML%+ zy(Jn$9?Z>L7o0?I-jZA7gnX}Wt2RDtxdP%^xS?dj6u+n_?~m>d-?Umr`r|%4KKcb1 z2`AQ9H%)t}F#>}=E;7=Y8D0qn5{=*0bz||p3&E*I$o21uZ1+8M;%iSl8+^E`6FvHZ zLnD@{qf%WohgQG+j^WnTQ4K_%Y6xI0pW499^l}tRME*0`>Y?{OA?Ff{yg9-iQG7P*g z@#Qdoe5Pe>P^Mqj@Ldh;IxyKy@;s5scKFyHw0f6!mb>boFJTs<(v*lkfnz{s8nDvp zyXtww!klM)YOGu3EVM>z7e6mE7||VXRc8#zSBf03$6z{9`h@t{V&2h7HBh;l(fRT z-*||rRjJmNDtGgrlab>?m01+XMsq~c(8EhQri^r1%LaSGKZ11|{eLXAy1LHQALY1G zeg-#Q-0s(n!fz_@tfv<-LgakN8(o z4-pFSva7bB(QtQZkm$<`v=j7-yT>{p6-`R~;d}|@OacCT)?t*4KN%G-}<<1^Ibaqy_1-hULKBto@=TALNk0$O6<=CK@_@B4VO z%lYOqC-m+ie@sfK!ES(e^96K<>}f)BYva287xn#f7{h0)p8K!?E#UxuT)7D?!fBk| z_hxkm3!ki(9qTL>ozaGKr3wbL=9V=il3vHz!elLSCN5K>y}@kk>5btCZW$P>b<+qR zghi2Ob|NA`)-zX~EvNIguf%H?2ap);YeG)HR{=tNHzxxJ6~-((?y*XAxb(}ashyo$ z#0ST#k+6RtjKr{ak7aC9~pXv1(={IkuPBrbS8p| zM$d3bnRCb|tkxtN5rL2n|E^M}Uu zbNFU;G!OMPd&2n5d|_jpw`oNJ2aAivDQ)_@vX}Y`3HXJIs#>fSkSTkG$iXC>BBj?R zF_@g4ewP*HPD@QHY~Rs1zlg?}TJ{64>^B#4NOO7036$0-&rmMDTq7TJ!v9+bpw# zdZQK@Awz@G{fpb-J-(H>&sq?2JTfx-FK`>6!UXb8Q7;US9#avHiO}?DXT*2a zpLA?8`Sk%U>$j;g_3Z@o$ughS)#d{wwT#^M^P={nyVSFmSy= z-5AJwhSfuQskF%bedDZDKlh=@2OS;3N{O_DZ)gM@9{V29!f}Wm=Hz{M+b~q;Q23A^d8 z{^DnZl9hIgz?jhF6|54kHr{Up^@)ID6n$5{hB#y>ZAaZ{T{}+tXEbuuGqlDCsi?>l zu%NGZFq!V%&OiQ9mQs}<(?x|EI45^nTl~^vP4}e7lt=6_qRxD|Dbu0Z(QK09#1BZD zQaBDXi}@~{G%h~vjfy>sjwak^|EyK4^fcf(_H+bjxfr(l+<#||PA?l}af>i)23AN? zv+GS5TW#xB9NX&rr#>x;L~7@TbZ*r2>kCnjw}ZqRCKj+$RmM7Fri7xCc!B=9>HL88 zNd7SnX$)@P9zJLcJlqj_grDs1KIsCXPkl9GTT zBM2BnmzzgaOVf~HFC4ujxw|*#97cj@Y%xX0NH|QtxQt{2qMA^sJTyp5_}W*hb-T{B zQ-zEpD*7~BMuhh*Yp%Q+#PKyzgZBDK_z#3$3~4mYb|&i3`{|*~=ydHc{vklbWQObN zPY*K#F5*4SV2_3?0v@#z6p!|&p$-;ytj9d7^E*NR9_X$fE0~oQd6^Q_O&&4L5b~yS z`t*lQ`Sk6@b8xNU)Svx*v4EdMk%-J;)}!Cx3p!7a(esV3&Nj&IW;t9ty!UHbLfqHF zp3y2V)>gYE^7`B+kUs?-NdW6d8ZHhmogZbOd-YVhQi_A1KjkJLDa?DvUv#VnTsd#u z`_wZZ|8#jn4T>rHHFB{(X3&J@8(+<1Q2OQSP;7{^?K7;5qFeMCvZlnrxn31m7NVw%tjP#j5$BVFYbcs`cSg-_##PCN=ES#r|y4KDBdc zuU5pg5!@)GrYu{d3*2|Yx1H}K=nv=*h2c@JnIiX94wFZ$^s%GqRz(icfK}^^4EX#qCKUTiXjz3{$Z_3MKkPc8E|8@YT6 z>)$?o_as_dl=jHq7q^w&ia>f69aY!ycq<|1qwEIi4pYyPe3-u2-?x}!nycQ{f({^C z{OJxyT9rB*?(B<}0I_}z?YjM)%ctoYt;-xMfGQ=#R{9Z)Pwvq#?6|txdIkir?w+Am zrW=J#3{bTMT>Ms9UM|hgx7ti3I1BFe54f)XsC#U(7Qd?nMM1Q|(qoa|@0@G*ou4ed z!=*Y!vo{J{&Wh`>N*Oh?JfW8zY$%bQ>tiU=t845RA|sVVMgT+~9@t@r8+ zh~=h-Ct|MMtpGdrtJo&okxl@oAvy>Z5}*$mUBYu+tf#ApWV9{HcOa?)341y zca?NDb~GFz3IsZ=58$f2Pi}M$bE0D>GT-}-hZ%PPSxKu>hiR%t$47vq`Fkqk(a};Y z-G%VRr+&Wyuoe&JJMMn*B)qr923i$le;)Jb6GVzzIvN#_J~%r0>d*en;_J|6`BhEW z4;aVykH^y+bEyNL9N_Y;lwLm6nBhb3kE-~4oS#>fc+PD3&xC$ewYLc$RFo9vw%S0K zdWbHVx61!R6AEwP5wD(Npds^`VOXW)k4%4u|14QJ)AA(^9xW83uyL3|gG|TXvSC=2 zB?mi*zH+)Gzq}DEobk8+Pr@|jSEdh3p3GzU&Xmf}7Fq$`!mF#RyJ=R<;&41Hd>fgy z1acvtKQJ~hw=92H#%b>m=iO$3>5O5N>L;@rf>EvczAXoOMuP0WIgdA`nF0L?GPDg( z$LqxUrZ=H?SB9nXr379+%}M3ra-3*l2(}!rdyCON@dP!47>BPaj$Y*ppX^On4Z&2W zjGooIK80x2@aFD&YLXYfzf?f$;lOjcdw=Xlrrqz47qH!+&ndS5{)n)jgtp#Hz&YoHro+HgDSw^OWp~(Pl>dRnUG6)7l5MLt60P{90xl73^y0);8L^YBBlUnm0VQ`veBy<6YM zs!f9*MuhYo1cv4S_0?){)!+$D&Q}Dm{9L0+;IemdqLisH+hO;5=X2LD_D7Eo>7IGJimI|K;G373o5g)c z9}6>~Famp|Dt;p%qxWoQxE09PElZ%0vgn0+W^y{~BmvGW1t6R$I8Rr&5IUj^HPq5mKXRVIeif4qfcw$V$DwL z3w${{@YJ8y6=>{1>*nF=U}NRQiGhLfwe6f9|Hdn_=mth1pXoL4}pIO{6pX$0{;;BhrmAs{vq%Wfqw}6L*O3*{}A|x oz&`~3A@C1@e+c|T;2#425cr3{KLq|E@DG812>e6fe}lmP03`SL<^TWy diff --git a/httpd/awhttpd.patch b/httpd/awhttpd.patch deleted file mode 100644 index 59eb7eb819..0000000000 --- a/httpd/awhttpd.patch +++ /dev/null @@ -1,2371 +0,0 @@ -diff -Naur awhttpd/aw3.h axTLS/httpd/awhttpd/aw3.h ---- awhttpd/aw3.h 2005-01-23 13:17:14.000000000 +1000 -+++ axTLS/httpd/awhttpd/aw3.h 2006-11-15 15:09:14.196258200 +1000 -@@ -7,17 +7,16 @@ - */ - - --#include --#include --#include --#include --#include -+#include "os_port.h" -+#include "ssl.h" - - - - #define BACKLOG 15 - #define VERSION "3.0.7" -+#ifdef CONFIG_HTTP_HAS_IPV6 - #define HAVE_IPV6 -+#endif - - #define MAXFILEPATH 1024 - #define MAXIPLEN 45 -@@ -26,6 +25,7 @@ - #define BLOCKSIZE 4096 - - #define INITIAL_CONNECTION_SLOTS 10 -+#define CONFIG_HTTP_DEFAULT_SSL_OPTIONS 0 - - #define STATE_WANT_TO_READ_HEAD 1 - #define STATE_WANT_TO_SEND_HEAD 2 -@@ -37,7 +37,6 @@ - #define TYPE_HEAD 1 - #define TYPE_POST 2 - -- - struct connstruct { - struct connstruct *next; - -@@ -46,29 +45,43 @@ - - int networkdesc; - int filedesc; -- DIR *dirp; - -- int timeout; -+#if defined(CONFIG_HTTP_DIRECTORIES) -+#ifdef WIN32 -+ HANDLE dirp; -+ WIN32_FIND_DATA file_data; -+#else -+ DIR *dirp; -+#endif -+#endif - -+ time_t timeout; - char ip[MAXIPLEN]; -- - char actualfile[MAXREQUESTLENGTH]; - char filereq[MAXREQUESTLENGTH]; -+#if defined(CONFIG_HTTP_HAS_CGI) - char cgiargs[MAXREQUESTLENGTH]; - char cgiscriptinfo[MAXREQUESTLENGTH]; - char cgipathinfo[MAXREQUESTLENGTH]; -+#endif - char virtualhostreq[MAXREQUESTLENGTH]; - - int numbytes; -- long offset; - char databuf[BLOCKSIZE]; - -+ unsigned char is_ssl; -+ unsigned char close_when_done; -+ unsigned char modified_since; - }; - - - struct serverstruct { - struct serverstruct *next; - int sd; -+ int is_ssl; -+#ifdef CONFIG_HTTP_HAS_SSL -+ SSLCTX *ssl_ctx; -+#endif - }; - - -@@ -96,28 +109,13 @@ - - // Conf global prototypes - --extern int usevirtualhosts; - extern char *webroot; - extern int allowdirectorylisting; - extern int allowcgi; - extern int permcheck; --extern int maxusers; --extern int usertimeout; --extern int initialslots; --extern char *quote; --extern int initialslots; -- --extern int numusers; -- -- --// Useful macros --#define istimedout(tp,ct) ((ct) > (tp)->timeout) --#define updatetimeout(tp,ct) ((tp)->timeout = (ct)+usertimeout) -- -- - - // conn.c prototypes --void addconnection(int sd, char *ip); -+void addconnection(int sd, char *ip, int is_ssl); - void removeconnection(struct connstruct *cn); - - -@@ -129,49 +127,47 @@ - void procsendhead(struct connstruct *cn); - void procreadfile(struct connstruct *cn); - void procsendfile(struct connstruct *cn); -+int special_write(struct connstruct *cn, const uint8_t *buf, size_t count); - - - // net.c prototypes - void addtoservers(int sd); --void selectloop(); -+void selectloop(void); - - - // socket.c prototypes --int pollsocket(int sd, long ustimeout); --void handlenewconnection(int listenfd); -+void handlenewconnection(int listenfd, int is_ssl); - int openlistener(int port); - int openlistener6(int port); - - - // errors.c prototypes --void send505(int sd, char *reason); - void send404(struct connstruct *cn); - void send301(struct connstruct *cn); - - - // misc.c prototypes --void nada(); --void die(); --void reaper(); -+void nada(int sigtype); -+void die(int sigtype); -+void reaper(int sigtype); - void stripcrlf(char *p); - char *my_strncpy(char *dest, const char *src, size_t n); - #ifndef __HAVE_ARCH_STRNLEN - size_t strnlen ( const char * str, size_t maxlen ); - #endif - int iscgi(char *fn); --int split(char *tp, char *sp[], int maxwords, char sc); --int confsplit(char *tp, char *sp[], int maxwords); -+void split(char *tp, char *sp[], int maxwords, char sc); - int sanitizefile(char *buf); - int sanitizehost(char *buf); - void buildactualfile(struct connstruct *cn); - int issockwriteable(int sd); - int isdir(char *name); --void status(); - int trycgi_withpathinfo(struct connstruct *cn); - - - // mime_types.c prototypes --char *getmimetype(char *fn); -+void mime_init(void); -+const char *getmimetype(const char *fn); - - - // urldecode.c prototypes -@@ -188,7 +184,6 @@ - - - // conf.c prototypes --void defaultconfvals(); - void procconf(char *filename); - - -@@ -202,4 +197,4 @@ - - - // main.c prototypes --void initlists(); -+void initlists(void); -diff -Naur awhttpd/cgi.c axTLS/httpd/awhttpd/cgi.c ---- awhttpd/cgi.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/cgi.c 2006-11-15 15:09:14.211883700 +1000 -@@ -7,93 +7,46 @@ - */ - - --#include - #include - #include --#include -+#include - - #include "aw3.h" - - - -+#if defined(CONFIG_HTTP_HAS_CGI) - void addcgiext(char *tp) { - - struct cgiextstruct *ex; - - ex = (struct cgiextstruct *) malloc(sizeof(struct cgiextstruct)); -- if (ex == NULL) { -- fprintf(stderr, "Serious memory error...\n"); -- exit(0); -- } -- - ex->ext = strdup(tp); -- if (ex->ext == NULL) { -- fprintf(stderr, "Serious memory error...\n"); -- exit(0); -- } -- - ex->next = cgiexts; - cgiexts = ex; -- -- return; -- --} -- -- -- --void gensysenv(struct connstruct *cn) { -- -- #ifndef LIMITEDCGI -- -- char buf[1024]; -- -- setenv("REMOTE_ADDR", cn->ip, 1); -- -- snprintf(buf, sizeof(buf), "%d", numusers); -- setenv("AW_NUMUSERS", buf, 1); -- -- setenv("AW_VERSION", VERSION, 1); -- -- setenv("AW_QUOTE", quote, 1); -- --/* Commented this out because (and this is ridiculous) PHP -- doesn't seem to work with this variable specified -- */ --/* -- snprintf ( buf, sizeof(buf), "Anti-Web V%s (%s)", VERSION, quote ); -- setenv("SERVER_SOFTWARE", buf, 1); --*/ -- -- setenv("SCRIPT_NAME", cn->cgiscriptinfo, 1); -- -- setenv("PATH_INFO", cn->cgipathinfo, 1); -- -- setenv("QUERY_STRING", cn->cgiargs, 1); -- -- return; -- -- #endif -- - } - -- -- - void proccgi(struct connstruct *cn, int has_pathinfo) { - -- int tpipe[2], fv; -- char *myargs[3]; -+ int tpipe[2]; -+ char *myargs[5]; - char buf[MAXREQUESTLENGTH]; -- -- snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s (%s)\n%s", -- VERSION, -- quote, (cn->reqtype == TYPE_HEAD) ? "\n" : ""); -- write(cn->networkdesc, buf, strlen(buf)); -+#ifdef WIN32 -+ int tmp_stdout; -+#else -+ int fv; -+#endif -+ -+ snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s\n%s", -+ VERSION, (cn->reqtype == TYPE_HEAD) ? "\n" : ""); -+ special_write(cn, buf, strlen(buf)); - - if (cn->reqtype == TYPE_HEAD) { - removeconnection(cn); - return; - } - -+#ifndef WIN32 - if (pipe(tpipe) == -1) { - removeconnection(cn); - return; -@@ -108,7 +61,8 @@ - return; - } - -- if (fv != 0) { -+ if (fv != 0) -+ { - // Close the write descriptor - close(tpipe[1]); - cn->filedesc = tpipe[0]; -@@ -132,19 +86,62 @@ - close(tpipe[1]); - - myargs[0] = cn->actualfile; -- myargs[1] = strdup(cn->cgiargs); -+ myargs[1] = cn->cgiargs; - myargs[2] = NULL; - -- if (!has_pathinfo) -- { -- my_strncpy(cn->cgipathinfo, "/", MAXREQUESTLENGTH); -- my_strncpy(cn->cgiscriptinfo, cn->filereq, MAXREQUESTLENGTH); -- } -- -- gensysenv(cn); -+ if (!has_pathinfo) { -+ my_strncpy(cn->cgipathinfo, "/", MAXREQUESTLENGTH); -+ my_strncpy(cn->cgiscriptinfo, cn->filereq, MAXREQUESTLENGTH); -+ } - - execv(cn->actualfile, myargs); -+#else /* WIN32 */ -+ if (_pipe(tpipe, 4096, O_BINARY| O_NOINHERIT) == -1) { -+ removeconnection(cn); -+ return; -+ } - -- exit(0); -+ myargs[0] = "sh"; -+ myargs[1] = "-c"; -+ myargs[2] = cn->actualfile; -+ myargs[3] = cn->cgiargs; -+ myargs[4] = NULL; -+ -+ /* convert all the forward slashes to back slashes */ -+ { -+ char *t = myargs[2]; -+ while ((t = strchr(t, '\\'))) -+ { -+ *t++ = '/'; -+ } -+ } -+ -+ tmp_stdout = _dup(_fileno(stdout)); -+ _dup2(tpipe[1], _fileno(stdout)); -+ close(tpipe[1]); -+ -+ /* change to suit execution method */ -+ if (spawnl(P_NOWAIT, "c:\\Program Files\\cygwin\\bin\\sh.exe", -+ myargs[0], myargs[1], myargs[2], myargs[3], myargs[4]) == -1) { -+ removeconnection(cn); -+ return; -+ } -+ -+ _dup2(tmp_stdout, _fileno(stdout)); -+ close(tmp_stdout); -+ cn->filedesc = tpipe[0]; -+ cn->state = STATE_WANT_TO_READ_FILE; -+ -+ for (;;) -+ { -+ procreadfile(cn); - -+ if (cn->filedesc == -1) -+ break; -+ -+ procsendfile(cn); -+ usleep(200000); /* don't know why this delay makes it work (yet) */ -+ } -+#endif - } -+#endif /* CONFIG_HTTP_HAS_CGI */ -diff -Naur awhttpd/conf.c axTLS/httpd/awhttpd/conf.c ---- awhttpd/conf.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/conf.c 1970-01-01 10:00:00.000000000 +1000 -@@ -1,265 +0,0 @@ --/* Anti-Web HTTPD */ --/* Hardcore Software */ --/* --This software is Copyright (C) 2001-2004 By Hardcore Software and --others. The software is distributed under the terms of the GNU General --Public License. See the file 'COPYING' for more details. --*/ -- -- --#include --#include --#include --#include --#include --#include --#include -- --#include "aw3.h" -- -- -- --// CONF GLOBALS: -- --int usevirtualhosts; --char *webroot; --int allowdirectorylisting; --int allowcgi; --int permcheck; --int maxusers; --int usertimeout; --int initialslots; --char *quote; -- --int numusers; -- -- -- --void defaultconfvals() { -- -- usevirtualhosts = 0; -- allowdirectorylisting = 0; -- allowcgi = 0; -- permcheck = 0; -- maxusers = 500; -- usertimeout = 5; -- initialslots = 10; -- quote = "Fear and loathing on the WWW"; -- -- // Not really conf stuff: -- numusers = 0; -- -- return; -- --} -- -- --void procconf(char *filename) { -- -- FILE *fp; -- char buf[MAXREQUESTLENGTH]; -- char *segs[10]; -- int tp, err=0, warn=0; -- -- usevirtualhosts = 1; -- -- fp = fopen(filename, "r"); -- -- if (fp == NULL) { -- fprintf(stderr, "ERROR: Unable to open conf file '%s'\n", filename); -- exit(1); -- } -- -- -- while (fgets(buf, sizeof(buf), fp) != NULL) { -- stripcrlf(buf); -- -- confsplit(buf, segs, 10); -- -- if (segs[0] == NULL) continue; -- -- if (segs[1] == NULL) { -- fprintf(stderr, "ERR: Unknown command in '%s': '%s'\n", filename, segs[0]); -- err++; -- continue; -- } -- -- -- if (strcasecmp(segs[0], "listen") == 0) { -- if (isdigit(*segs[1])) { -- if ((tp=openlistener(atoi(segs[1]))) == -1) { -- fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", atoi(segs[1])); -- err++; -- continue; -- } -- -- addtoservers(tp); -- continue; -- } -- } -- -- if (strcasecmp(segs[0], "listen6") == 0) { -- #ifdef HAVE_IPV6 -- if (isdigit(*segs[1])) { -- if ((tp=openlistener6(atoi(segs[1]))) == -1) { -- fprintf(stderr, "ERR: Couldn't bind to port %d (IPv6)\n", atoi(segs[1])); -- err++; -- continue; -- } -- -- addtoservers(tp); -- continue; -- } -- #else -- fprintf(stderr, "ERR: AW was compiled without IPv6 support!\n"); -- err++; -- continue; -- #endif -- } -- -- if (strcasecmp(segs[0], "maxusers") == 0) { -- maxusers = tp = atoi(segs[1]); -- if (tp < 1) { -- fprintf(stderr, "ERR: Bad value for maxusers\n"); -- err++; -- } -- if (tp < 10 || tp > 10000) { -- fprintf(stderr, "WARN: Value for maxusers (%d) is not withing the recommended range\n", tp); -- warn++; -- } -- continue; -- } -- -- if (strcasecmp(segs[0], "usertimeout") == 0) { -- usertimeout = tp = atoi(segs[1]); -- if (tp < 1) { -- fprintf(stderr, "ERR: Bad value for usertimeout\n"); -- err++; -- } -- if (tp > 100) { -- fprintf(stderr, "WARN: Value for usertimeout (%d) is not withing the recommended range\n", tp); -- warn++; -- } -- continue; -- } -- -- if (strcasecmp(segs[0], "initialslots") == 0) { -- initialslots = tp = atoi(segs[1]); -- if (tp < 1) { -- fprintf(stderr, "ERR: Bad value for initialslots\n"); -- err++; -- } -- continue; -- } -- -- if (strcasecmp(segs[0], "directorylisting") == 0) { -- if (strcasecmp(segs[1], "on") == 0) allowdirectorylisting = 1; -- else if (strcasecmp(segs[1], "off") == 0) allowdirectorylisting = 0; -- else { -- fprintf(stderr, "ERR: Need on or off for directorylisting\n"); -- err++; -- } -- continue; -- } -- -- if (strcasecmp(segs[0], "cgi") == 0) { -- if (strcasecmp(segs[1], "on") == 0) allowcgi = 1; -- else if (strcasecmp(segs[1], "off") == 0) allowcgi = 0; -- else { -- fprintf(stderr, "ERR: Need on or off for cgi\n"); -- err++; -- } -- continue; -- } -- -- if (strcasecmp(segs[0], "cgiext") == 0) { -- if (*(segs[1]) != '.' && *(segs[1]+1) != '\0') { -- fprintf(stderr, "ERR: CGI extensions must start with a period and be at least 2 chars long\n"); -- err++; -- continue; -- } -- addcgiext(segs[1]); -- continue; -- } -- -- if (strcasecmp(segs[0], "addindex") == 0) { -- if (*(segs[1]) == '.') { -- fprintf(stderr, "ERR: Index files can't start with a dot\n"); -- err++; -- continue; -- } -- addindex(segs[1]); -- continue; -- } -- -- if (strcasecmp(segs[0], "permcheck") == 0) { -- if (strcasecmp(segs[1], "on") == 0) permcheck = 1; -- else if (strcasecmp(segs[1], "off") == 0) permcheck = 0; -- else { -- fprintf(stderr, "ERR: Need on or off for permcheck\n"); -- err++; -- } -- continue; -- } -- -- if (strcasecmp(segs[0], "dropto") == 0) { -- struct passwd *bl; -- -- if ((bl = getpwnam(segs[1])) == NULL) { -- fprintf(stderr, "ERR: Unable to look up user '%s' to drop privileges\n", segs[1]); -- err++; -- } else { -- if (setgid(bl->pw_gid) != 0) { -- fprintf(stderr, "WARN: Unable to drop GID to %d\n", bl->pw_gid); -- warn++; -- } -- if (setuid(bl->pw_uid) != 0) { -- fprintf(stderr, "WARN: Unable to drop UID to %d\n", bl->pw_uid); -- warn++; -- } -- } -- continue; -- } -- -- if (strcasecmp(segs[0], "quote") == 0) { -- quote = strdup(segs[1]); -- continue; -- } -- -- -- if (segs[2] == NULL) { -- fprintf(stderr, "ERR: Unknown command in '%s': '%s'\n", filename, segs[0]); -- err++; -- continue; -- } -- -- -- // Otherwise: -- -- fprintf(stderr, "ERR: Unknown command in '%s': '%s'\n", filename, segs[0]); -- err++; -- continue; -- -- } -- -- -- if (initialslots > maxusers) { -- fprintf(stderr, "ERR: initialslots is greater than maxusers!\n"); -- err++; -- } -- -- -- if (warn) { -- fprintf(stderr, "Alert! %d warnings!\n", warn); -- } -- -- if (err) { -- fprintf(stderr, "Unable to start: %d errors!\n", err); -- exit(1); -- } -- -- fclose(fp); -- -- return; -- --} -diff -Naur awhttpd/conn.c axTLS/httpd/awhttpd/conn.c ---- awhttpd/conn.c 2004-12-07 16:11:02.000000000 +1000 -+++ axTLS/httpd/awhttpd/conn.c 2006-11-15 15:09:14.243134700 +1000 -@@ -9,26 +9,16 @@ - - #include - #include --#include --#include - #include -- - #include "aw3.h" - - -- --void addconnection(int sd, char *ip) { -+void addconnection(int sd, char *ip, int is_ssl) { - struct connstruct *tp; - - // Get ourselves a connstruct - if (freeconns == NULL) { - tp = (struct connstruct *) malloc(sizeof(struct connstruct)); -- if (tp == NULL) { -- send505(sd, "Out of memory"); -- // removeconnection() should be used normally -- close(sd); -- return; -- } - } else { - tp = freeconns; - freeconns = tp->next; -@@ -39,12 +29,21 @@ - usedconns = tp; - - tp->networkdesc = sd; -+#ifdef CONFIG_HTTP_HAS_SSL -+ if (is_ssl) -+ ssl_server_new(servers->ssl_ctx, sd); -+#endif - tp->filedesc = -1; -+#if defined(CONFIG_HTTP_HAS_DIRECTORIES) - tp->dirp = NULL; -+#endif -+ tp->is_ssl = is_ssl; - - *(tp->actualfile) = '\0'; - *(tp->filereq) = '\0'; -+#if defined(CONFIG_HTTP_HAS_CGI) - *(tp->cgiargs) = '\0'; -+#endif - *(tp->virtualhostreq) = '\0'; - - tp->state = STATE_WANT_TO_READ_HEAD; -@@ -52,21 +51,16 @@ - - my_strncpy(tp->ip, ip, MAXIPLEN); - -- tp->offset = -1; -- -- numusers++; -- -- updatetimeout(tp, time(NULL)); -+ tp->close_when_done = 0; -+ tp->modified_since = 0; - -+ tp->timeout = time(NULL) + CONFIG_HTTP_TIMEOUT; - return; - - } - - - --// Remove cn from the used list --// FIXME: This O(N) operation could be avoided if we used --// doubly linked lists... - void removeconnection(struct connstruct *cn) { - - struct connstruct *tp; -@@ -95,12 +89,21 @@ - freeconns = cn; - - // Close it all down -- if (cn->networkdesc != -1) close(cn->networkdesc); -+ if (cn->networkdesc != -1) { -+#ifdef CONFIG_HTTP_HAS_SSL -+ if (cn->is_ssl) { -+ ssl_free(ssl_find(servers->ssl_ctx, cn->networkdesc)); -+ } -+#endif -+ SOCKET_CLOSE(cn->networkdesc); -+ } - if (cn->filedesc != -1) close(cn->filedesc); -- if (cn->dirp != NULL) closedir(cn->dirp); -- -- numusers--; -- -- return; -- -+#if defined(CONFIG_HTTP_HAS_DIRECTORIES) -+ if (cn->dirp != NULL) -+#ifdef WIN32 -+ FindClose(cn->dirp); -+#else -+ closedir(cn->dirp); -+#endif -+#endif - } -diff -Naur awhttpd/errors.c axTLS/httpd/awhttpd/errors.c ---- awhttpd/errors.c 2005-01-23 06:49:29.000000000 +1000 -+++ axTLS/httpd/awhttpd/errors.c 2006-11-15 15:09:14.258760200 +1000 -@@ -8,7 +8,6 @@ - - - #include --#include - #include - - #include "aw3.h" -@@ -20,7 +19,7 @@ - - snprintf(buf, sizeof(buf), "HTTP/1.1 301 Moved Permanently\nLocation: %s/\n\n\n\n301 Moved Permanently\n\n

    Moved Permanently

    \nThe document has moved     here.

    \n

    \n\n", cn->filereq, cn->filereq); - -- write(cn->networkdesc, buf, strlen(buf)); -+ special_write(cn, buf, strlen(buf)); - - return; - -@@ -34,21 +33,7 @@ - - snprintf(buf, sizeof(buf), "HTTP/1.0 404 Not Found\nContent-Type: text/html\n\n\n404 Not Found

    It ain't there my friend. (404 Not Found)

    \n

    Anti-Web HTTPD - Take back some simplicity.\n\n"); - -- write(cn->networkdesc, buf, strlen(buf)); -- -- return; -- --} -- -- -- --void send505(int sd, char *reason) { -- -- char buf[1024]; -- -- snprintf(buf, sizeof(buf), "HTTP/1.0 505 Server Error\nContent-Type: text/html\n\n\n505 Internal Server Error

    Internal Server Error: %s

    \n

    Anti-Web HTTPD - Take back some simplicity.\n\n", reason); -- -- write(sd, buf, strlen(buf)); -+ special_write(cn, buf, strlen(buf)); - - return; - -diff -Naur awhttpd/index.c axTLS/httpd/awhttpd/index.c ---- awhttpd/index.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/index.c 2006-11-15 15:09:14.258760200 +1000 -@@ -11,7 +11,6 @@ - #include - #include - #include --#include - #include - - #include "aw3.h" -@@ -22,20 +21,9 @@ - struct indexstruct *ex; - - ex = (struct indexstruct *) malloc(sizeof(struct indexstruct)); -- if (ex == NULL) { -- fprintf(stderr, "Serious memory error...\n"); -- exit(1); -- } -- - ex->name = strdup(tp); -- if (ex->name == NULL) { -- fprintf(stderr, "Serious memory error...\n"); -- exit(1); -- } -- - ex->next = indexlist; - indexlist = ex; -- - return; - - } -@@ -52,7 +40,13 @@ - tp = indexlist; - - while(tp != NULL) { -- snprintf(tbuf, sizeof(tbuf), "%s%s", cn->actualfile, tp->name); -+ sprintf(tbuf, "%s%s%s", cn->actualfile, -+#ifdef WIN32 -+ "\\", -+#else -+ "/", -+#endif -+ tp->name); - - if (stat(tbuf, stp) != -1) { - my_strncpy(cn->actualfile, tbuf, MAXREQUESTLENGTH); -diff -Naur awhttpd/main.c axTLS/httpd/awhttpd/main.c ---- awhttpd/main.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/main.c 2006-11-21 16:30:37.093363800 +1000 -@@ -11,7 +11,6 @@ - #include - #include - #include --#include - #include - - #include "aw3.h" -@@ -21,10 +20,42 @@ - struct serverstruct *servers; - struct connstruct *usedconns; - struct connstruct *freeconns; -+#if defined(CONFIG_HTTP_HAS_CGI) - struct cgiextstruct *cgiexts; -+#endif - struct indexstruct *indexlist; - -+char *webroot = CONFIG_HTTP_WEBROOT; - -+/* clean up memory for valgrind */ -+static void sigint_cleanup(int sig) -+{ -+ struct serverstruct *sp; -+ struct connstruct *tp; -+ int i; -+ -+ while(servers != NULL) { -+#ifdef CONFIG_HTTP_HAS_SSL -+ if (servers->is_ssl) -+ ssl_ctx_free(servers->ssl_ctx); -+#endif -+ sp = servers->next; -+ free(servers); -+ servers = sp; -+ } -+ free(indexlist->name); -+ free(indexlist); -+ for(i=0; i< INITIAL_CONNECTION_SLOTS; i++) { -+ if (freeconns == NULL) -+ break; -+ -+ tp = freeconns->next; -+ free(freeconns); -+ freeconns = tp; -+ } -+ -+ exit(0); -+} - - void initlists() { - int i; -@@ -33,108 +64,118 @@ - servers = NULL; - usedconns = NULL; - freeconns = NULL; -+#if defined(CONFIG_HTTP_HAS_CGI) - cgiexts = NULL; -+#endif - indexlist = NULL; - - for(i=0; inext = tp; - } - } - - --void usage(char *cmline) { -- fprintf(stderr, "Anti-Web V%s (C) 2001-2004 by Hardcore Software and others\n\n", VERSION); -- -- fprintf(stderr, " AW has 2 valid command lines (see README for details)\n\n"); -- -- fprintf(stderr, " %s \n", cmline); -- fprintf(stderr, " The root of your HTML tree\n"); -- fprintf(stderr, " The port to use\n\n"); -- -- fprintf(stderr, " %s \n", cmline); -- fprintf(stderr, " /awhttpd.conf Conf file\n"); -- fprintf(stderr, " /default/ Default HTML root\n"); -- fprintf(stderr, " /example.com/ Zero or more virtual host directories\n"); -- -- exit(1); --} -- -- - int main(int argc, char *argv[]) { - -- char buf[MAXREQUESTLENGTH]; -- int pid, tp; -- -+ int tp; -+#if defined(CONFIG_HTTP_IS_DAEMON) -+ int pid; -+#endif -+ -+#ifdef WIN32 -+ WORD wVersionRequested = MAKEWORD(2,2); -+ WSADATA wsaData; -+ WSAStartup(wVersionRequested,&wsaData); -+#endif -+ -+ mime_init(); - initlists(); -- -- if (argc != 2 && argc != 3) usage(argv[0]); -- -- webroot = strdup(argv[1]); -- - tp = strlen(webroot); - if (webroot[tp-1] == '/') webroot[tp-1] = '\0'; - - if (isdir(webroot) == 0) { -+#ifdef CONFIG_HTTP_VERBOSE - fprintf(stderr, "'%s' is not a directory\n", webroot); -+#endif - exit(1); - } - -- defaultconfvals(); -- -- if (argc == 2) { -- snprintf(buf, sizeof(buf), "%s/awhttpd.conf", webroot); -- procconf(buf); -- } else { -- if ((tp=openlistener(atoi(argv[2]))) == -1) { -- fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", atoi(argv[2])); -+ if ((tp=openlistener(CONFIG_HTTP_PORT)) == -1) { -+#ifdef CONFIG_HTTP_VERBOSE -+ fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", -+ CONFIG_HTTP_PORT); -+#endif - exit(1); -- } -+ } - - addindex("index.html"); - addtoservers(tp); -- setgid(32767); -- setuid(32767); -- } - -- if (permcheck == 1) procpermcheck(webroot); -+#ifndef WIN32 -+ if (getuid() == 0) -+ { -+ setgid(32767); -+ setuid(32767); -+ } -+#endif -+ -+#ifdef CONFIG_HTTP_HAS_SSL -+ if ((tp=openlistener(CONFIG_HTTP_HTTPS_PORT)) == -1) { -+#ifdef CONFIG_HTTP_VERBOSE -+ fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", -+ CONFIG_HTTP_HTTPS_PORT); -+#endif -+ exit(1); -+ } -+ -+ addtoservers(tp); -+ servers->ssl_ctx = ssl_ctx_new(CONFIG_HTTP_DEFAULT_SSL_OPTIONS, -+ CONFIG_HTTP_SESSION_CACHE_SIZE); -+ servers->is_ssl = 1; -+#endif /* CONFIG_HTTP_HAS_SSL */ -+ -+#if defined(CONFIG_HTTP_PERM_CHECK) -+ procpermcheck(webroot); -+#endif -+#if defined(CONFIG_HTTP_HAS_CGI) -+ addcgiext(CONFIG_HTTP_CGI_EXTENSION); -+#endif -+#if defined(CONFIG_HTTP_VERBOSE) -+ printf("awhttpd: listening on ports http:%d and https:%d\n", -+ CONFIG_HTTP_PORT, CONFIG_HTTP_HTTPS_PORT); -+ TTY_FLUSH(); -+#endif - -+#if defined(CONFIG_HTTP_IS_DAEMON) - pid = fork(); - - if(pid > 0) { -- status(); - exit(0); - } else if(pid == -1) { -+#ifdef CONFIG_HTTP_VERBOSE - fprintf(stderr,"Anti-Web: Sorry, fork failed... Tough dice.\n"); -+#endif - exit(1); - } - - setsid(); -+#endif - - /* SIGNALS */ -- signal(SIGINT, die); -- signal(SIGQUIT, die); -+ signal(SIGINT, sigint_cleanup); - signal(SIGTERM, die); -+#if defined(CONFIG_HTTP_HAS_CGI) -+#ifndef WIN32 - signal(SIGCHLD, reaper); -- -- #ifndef SOLARIS -- signal(SIGPIPE, nada); -- #endif -- -- #ifdef SOLARIS -- act.sa_handler = nada; -- sigemptyset(&act.sa_mask); -- act.sa_flags = SA_RESTART; -- -- sigaction(SIGPIPE,&act,NULL); -- #endif -- -+#endif -+#endif -+#ifndef WIN32 -+ signal(SIGQUIT, die); -+ signal(SIGPIPE, SIG_IGN); -+#endif -+ - selectloop(); - - return 0; -diff -Naur awhttpd/mime_types.c axTLS/httpd/awhttpd/mime_types.c ---- awhttpd/mime_types.c 2004-01-26 01:08:47.000000000 +1000 -+++ axTLS/httpd/awhttpd/mime_types.c 2006-11-15 15:09:14.305636700 +1000 -@@ -7,28 +7,21 @@ - */ - - --/*Code from mini_httpd - small HTTP server --** --** Copyright C 1999,2000 by Jef Poskanzer . --*/ -- --/* mini_httpd code adapted for Anti-Web by zas@norz.org */ --/* A couple TINY changes by Fractal */ -- --// Reformatted for aw3 -fractal -- --// FIXME: Ideally this code would use a binary search or a hash table... -- -- - #include -+#include -+#include -+#include -+#include "os_port.h" - - --char mime_default[] = "text/plain"; -+static const char mime_default[] = "text/plain"; - --struct { -- char *ext; -- char *type; --} mime_table[] = { -+typedef struct { -+ const char * const ext; -+ const char * const type; -+} mime_table_t; -+ -+static mime_table_t mime_table[] = { - - // Fundamentals - { ".html", "text/html" }, -@@ -160,21 +153,29 @@ - - }; - -+static int mime_cmp(const mime_table_t *t1, const mime_table_t *t2) -+{ -+ return strcasecmp(t1->ext, t2->ext); -+} - --char *getmimetype(char *name) { -- int namelen, extlen, i; -- -- namelen = strlen(name); -- -- for (i=0; i= namelen) continue; -+const char *getmimetype(const char *name) { -+ mime_table_t *mime_type; - -- if (strcasecmp(name+(namelen-extlen), mime_table[i].ext) == 0) -- return mime_table[i].type; -- } -+ if ((name = strrchr(name, '.')) == NULL) -+ return mime_default; - -- return mime_default; -+ mime_type = bsearch(&name, mime_table, -+ sizeof(mime_table)/sizeof(mime_table_t), -+ sizeof(mime_table_t), -+ (int (*)(const void *, const void *))mime_cmp); - -+ return mime_type == NULL ? mime_default : mime_type->type; - } -+ -diff -Naur awhttpd/misc.c axTLS/httpd/awhttpd/misc.c ---- awhttpd/misc.c 2005-01-23 12:59:09.000000000 +1000 -+++ axTLS/httpd/awhttpd/misc.c 2006-11-15 15:09:14.321262200 +1000 -@@ -7,33 +7,33 @@ - */ - - --#include - #include - #include - #include --#include -+#include - #include - #include --#include --#include --#include - - #include "aw3.h" - - - - --void nada() { } -+void nada(int sigtype) { } - - --void die() { -+void die(int sigtype) { - exit(0); - } - - --void reaper() { -+#if defined(CONFIG_HTTP_HAS_CGI) -+#ifndef WIN32 -+void reaper(int sigtype) { - wait3(NULL,WNOHANG,NULL); - } -+#endif -+#endif - - - void stripcrlf(char *p) { -@@ -76,116 +76,6 @@ - } - #endif - -- --int iscgi(char *fn) { -- -- struct cgiextstruct *tp; -- int fnlen, extlen; -- -- fnlen = strlen(fn); -- tp = cgiexts; -- -- while (tp != NULL) { -- extlen = strlen(tp->ext); -- -- if (strcasecmp(fn+(fnlen-extlen), tp->ext) == 0) -- return 1; -- -- tp = tp->next; -- } -- -- return 0; -- --} -- -- -- --int split(char *tp, char *sp[], int maxwords, char sc) { -- -- int i=0; -- -- while(1) { -- /* Skip leading whitespace */ -- while(*tp == sc) tp++; -- -- if (*tp == '\0') { -- sp[i] = NULL; -- break; -- } -- if (i==maxwords-2) { -- sp[maxwords-2] = NULL; -- break; -- } -- -- sp[i] = tp; -- -- while(*tp != sc && *tp != '\0') tp++; -- if (*tp == sc) *tp++ = '\0'; -- i++; -- -- } -- -- return i; -- --} -- -- -- --int confsplit(char *tp, char *sp[], int maxwords) { -- -- int i; -- -- // Skip comments -- i=0; -- while (tp[i] != '\0' && tp[i] != '#') i++; -- tp[i] = '\0'; -- -- i=0; -- while(1) { -- /* Skip leading whitespace */ -- while(*tp == ' ') tp++; -- -- if (*tp == '\0') { -- sp[i] = NULL; -- break; -- } -- if (i==maxwords-2) { -- sp[maxwords-2] = NULL; -- break; -- } -- -- if (*tp == '"') { -- tp++; -- -- if (*tp == '"') { -- tp++; -- continue; -- } -- -- sp[i] = tp; -- -- while(*tp != '"' && *tp != '\0') tp++; -- if (*tp == '"') *tp++ = '\0'; -- i++; -- -- } else { -- sp[i] = tp; -- -- while(*tp != ' ' && *tp != '\0') tp++; -- if (*tp == ' ') *tp++ = '\0'; -- i++; -- } -- -- } -- -- return i; -- --} -- -- -- -- -- - int sanitizefile(char *buf) { - - int len,i; -@@ -198,9 +88,6 @@ - // Check for "/." : In other words, don't send files starting with a . - // Notice, GOBBLES, that this includes ".." - if (buf[i] == '/' && buf[i+1] == '.') return 0; -- -- // Give people a "hidden prefix" for hiding private files in the HTML tree -- if (strncmp(buf+i, "/aw_", 4) == 0) return 0; - } - - return 1; -@@ -231,34 +118,33 @@ - - } - -- -- - void buildactualfile(struct connstruct *cn) { - -- char tpbuf[MAXREQUESTLENGTH]; -- -- if (usevirtualhosts) { -- if (*(cn->virtualhostreq) == '\0') -- my_strncpy(cn->virtualhostreq, "default", MAXREQUESTLENGTH); -- -- snprintf(tpbuf, sizeof(tpbuf), "%s/%s", webroot, cn->virtualhostreq); -- if (isdir(tpbuf) == 0) { -- my_strncpy(cn->virtualhostreq, "default", MAXREQUESTLENGTH); -- } -- } else { -- *(cn->virtualhostreq) = '\0'; -- } -- -- snprintf(cn->actualfile, MAXREQUESTLENGTH, "%s/%s%s", -+ snprintf(cn->actualfile, MAXREQUESTLENGTH, "%s%s", - webroot, -- cn->virtualhostreq, - cn->filereq); - -+ /* Add directory slash if not there */ -+ if (isdir(cn->actualfile) && -+ cn->actualfile[strlen(cn->actualfile)-1] != '/') -+ strcat(cn->actualfile, "/"); -+ -+#ifdef WIN32 -+ /* convert all the forward slashes to back slashes */ -+ { -+ char *t = cn->actualfile; -+ while ((t = strchr(t, '/'))) -+ { -+ *t++ = '\\'; -+ } -+ } -+#endif -+ - return; - - } - -- -+#if defined(CONFIG_HTTP_DIRECTORIES) - int issockwriteable(int sd) { - - fd_set wfds; -@@ -275,11 +161,11 @@ - return FD_ISSET(sd, &wfds); - - } -- -+#endif - - int isdir(char *tpbuf) { - -- static struct stat st; -+ struct stat st; - - if (stat(tpbuf, &st) == -1) return 0; - -@@ -288,25 +174,52 @@ - - } - -+#if defined(CONFIG_HTTP_HAS_CGI) -+int iscgi(char *fn) { - -+ struct cgiextstruct *tp; -+ int fnlen, extlen; - --// FIXME: Arg! This function is horrible! Rewrite it --void status() { -+ fnlen = strlen(fn); -+ tp = cgiexts; - -- int i; -+ while (tp != NULL) { -+ extlen = strlen(tp->ext); - -- fprintf(stdout," [*************************************************]\n"); -- fprintf(stdout," [ Anti-Web V%-6s by Hardcore Software ]\n",VERSION); -- fprintf(stdout," [*************************************************]\n"); -- fprintf(stdout," [ DIRECTORY {%s}",webroot); -- if(strlen(webroot)<35) -- for(i=1;i<=35-strlen(webroot);i++) fprintf(stdout," "); -- fprintf(stdout,"]\n"); -- fprintf(stdout," [*************************************************]\n"); -+ if (strcasecmp(fn+(fnlen-extlen), tp->ext) == 0) -+ return 1; -+ -+ tp = tp->next; -+ } -+ -+ return 0; - - } - -+void split(char *tp, char *sp[], int maxwords, char sc) { -+ -+ int i=0; -+ while(1) { -+ /* Skip leading whitespace */ -+ while(*tp == sc) tp++; -+ -+ if (*tp == '\0') { -+ sp[i] = NULL; -+ break; -+ } - -+ if (i==maxwords-2) { -+ sp[maxwords-2] = NULL; -+ break; -+ } -+ -+ sp[i] = tp; -+ -+ while(*tp != sc && *tp != '\0') tp++; -+ if (*tp == sc) *tp++ = '\0'; -+ i++; -+ } -+} - - /* This function was originally written by Nicolas Benoit - but I've rewritten some parts of it to work under -@@ -329,7 +242,7 @@ - while (fr_rs[i] != NULL) { - snprintf(tpfile, sizeof(tpfile), "%s/%s%s", webroot, cn->virtualhostreq, fr_str); - -- if (iscgi(tpfile) && access(tpfile, X_OK) == 0 && isdir(tpfile) == 0) { -+ if (iscgi(tpfile) && isdir(tpfile) == 0) { - /* We've found our CGI file! */ - my_strncpy(cn->actualfile, tpfile, MAXREQUESTLENGTH); - my_strncpy(cn->cgiscriptinfo, fr_str, MAXREQUESTLENGTH); -@@ -349,3 +262,4 @@ - *(cn->cgipathinfo) = '\0'; - return -1; - } -+#endif -diff -Naur awhttpd/net.c axTLS/httpd/awhttpd/net.c ---- awhttpd/net.c 2005-06-04 14:09:52.000000000 +1000 -+++ axTLS/httpd/awhttpd/net.c 2006-11-15 15:09:14.352513200 +1000 -@@ -8,9 +8,7 @@ - - - #include --#include - #include --#include - #include - #include - #include -@@ -23,17 +21,10 @@ - void addtoservers(int sd) { - struct serverstruct *tp; - -- tp = (struct serverstruct *) malloc(sizeof(struct serverstruct)); -- if (tp == NULL) { -- fprintf(stderr, "Serious memory error...\n"); -- exit(1); -- } -- -+ tp = (struct serverstruct *) calloc(1, sizeof(struct serverstruct)); - tp->next = servers; - tp->sd = sd; -- - servers = tp; -- - return; - } - -@@ -64,7 +55,7 @@ - currtime = time(NULL); - while(tp != NULL) { - -- if (istimedout(tp, currtime)) { -+ if (currtime > tp->timeout) { - to = tp; - tp = tp->next; - removeconnection(to); -@@ -87,14 +78,15 @@ - FD_SET(tp->networkdesc, &wfds); - if (tp->networkdesc > wnum) wnum = tp->networkdesc; - } -+#if defined(CONFIG_HTTP_DIRECTORIES) - if (tp->state == STATE_DOING_DIR) { - FD_SET(tp->networkdesc, &wfds); - if (tp->networkdesc > wnum) wnum = tp->networkdesc; - } -+#endif - tp = tp->next; - } - -- //active = select(4, &rfds, &wfds, NULL, NULL); - active = select(wnum > rnum ? wnum+1 : rnum+1, - rnum != -1 ? &rfds : NULL, - wnum != -1 ? &wfds : NULL, -@@ -104,7 +96,7 @@ - sp = servers; - while(active > 0 && sp != NULL) { - if (FD_ISSET(sp->sd, &rfds)) { -- handlenewconnection(sp->sd); -+ handlenewconnection(sp->sd, sp->is_ssl); - active--; - } - sp = sp->next; -@@ -112,41 +104,37 @@ - - // Handle the established sockets - tp = usedconns; -- currtime = time(NULL); - while(active > 0 && tp != NULL) { - to = tp; - tp = tp->next; - - if (to->state == STATE_WANT_TO_READ_HEAD) - if (FD_ISSET(to->networkdesc, &rfds)) { -- updatetimeout(to, currtime); - active--; - procreadhead(to); - } - if (to->state == STATE_WANT_TO_SEND_HEAD) - if (FD_ISSET(to->networkdesc, &wfds)) { -- updatetimeout(to, currtime); - active--; - procsendhead(to); - } - if (to->state == STATE_WANT_TO_READ_FILE) - if (FD_ISSET(to->filedesc, &rfds)) { -- updatetimeout(to, currtime); - active--; - procreadfile(to); - } - if (to->state == STATE_WANT_TO_SEND_FILE) - if (FD_ISSET(to->networkdesc, &wfds)) { -- updatetimeout(to, currtime); - active--; - procsendfile(to); - } -+#if defined(CONFIG_HTTP_DIRECTORIES) - if (to->state == STATE_DOING_DIR) - if (FD_ISSET(to->networkdesc, &wfds)) { -- updatetimeout(to, currtime); - active--; - procdodir(to); - } -+#endif - } - - -diff -Naur awhttpd/permcheck.c axTLS/httpd/awhttpd/permcheck.c ---- awhttpd/permcheck.c 2005-01-23 06:49:29.000000000 +1000 -+++ axTLS/httpd/awhttpd/permcheck.c 2006-11-15 15:09:14.368138700 +1000 -@@ -7,21 +7,23 @@ - */ - - --#include - #include -+#include -+#include - - #include "aw3.h" - -+#if defined(CONFIG_HTTP_PERM_CHECK) - void procpermcheck(char *pathtocheck) { -- -+ char thepath[MAXREQUESTLENGTH]; -+#ifndef WIN32 - DIR *tpdir; - struct dirent *dp; -- char thepath[MAXREQUESTLENGTH]; - - tpdir=opendir(pathtocheck); - - if (tpdir==NULL) { -- printf("WARNING: UID (%d) is unable to read %s\n", getuid(), pathtocheck); -+ printf("WARNING: UID (%d) is unable to read %s\n", (int)getuid(), pathtocheck); - return; - } - -@@ -38,14 +40,56 @@ - } - - if (access(thepath, R_OK) != 0) -- printf("WARNING: UID (%d) is unable to read %s\n", getuid(), thepath); -+ printf("WARNING: UID (%d) is unable to read %s\n", (int)getuid(), thepath); - if (access(thepath, W_OK) == 0) -- printf("SECURITY: UID (%d) is ABLE TO WRITE TO %s\n", getuid(), thepath); -+ printf("SECURITY: UID (%d) is ABLE TO WRITE TO %s\n", (int)getuid(), thepath); - - } - - closedir(tpdir); -+#else /* Win32 */ -+ HANDLE tpdir; -+ WIN32_FIND_DATA file_data; -+ struct stat st; -+ char buf2[1024]; -+ -+ strcpy(buf2, pathtocheck); -+ strcat(buf2, "\\*"); -+ tpdir = FindFirstFile(buf2, &file_data); -+ -+ if (tpdir == INVALID_HANDLE_VALUE) { -+ printf("WARNING: unable to read %s\n", buf2); -+ TTY_FLUSH(); -+ return; -+ } -+ -+ while (FindNextFile(tpdir, &file_data)) { -+ -+ if (strcmp(file_data.cFileName, "..")==0) continue; -+ if (strcmp(file_data.cFileName, ".")==0) continue; -+ -+ snprintf(thepath, sizeof(thepath), "%s\\%s", -+ pathtocheck, file_data.cFileName); - -- return; -+ if (isdir(thepath)) { -+ procpermcheck(thepath); -+ continue; -+ } -+ -+ if (stat(thepath, &st) >= 0) { -+ if ((st.st_mode & _S_IREAD) == 0) { -+ printf("WARNING: unable to read %s\n", thepath); -+ TTY_FLUSH(); -+ } -+ -+ if (st.st_mode & _S_IWRITE) { -+ printf("SECURITY: ABLE TO WRITE TO %s\n", thepath); -+ TTY_FLUSH(); -+ } -+ } -+ } - -+ FindClose(tpdir); -+#endif - } -+#endif /* CONFIG_HTTP_PERM_CHECK */ -diff -Naur awhttpd/proc.c axTLS/httpd/awhttpd/proc.c ---- awhttpd/proc.c 2005-01-23 10:59:41.000000000 +1000 -+++ axTLS/httpd/awhttpd/proc.c 2006-11-15 15:09:14.399389700 +1000 -@@ -13,91 +13,92 @@ - #include - #include - #include --#include - #include - #include - - #include "aw3.h" - -- -- -+static int special_read(struct connstruct *cn, void *buf, size_t count); - - // Returns 1 if elems should continue being read, 0 otherwise - int procheadelem(struct connstruct *cn, char *buf) { - -- char *words[10]; -- -- split(buf, words, 10, ' '); -+ char *delim, *value; -+#if defined(CONFIG_HTTP_HAS_CGI) -+ char *cgi_delim; -+#endif - -- if (words[0] == NULL) return 0; -- -- if (strcmp(words[0], "GET")==0 || -- strcmp(words[0], "HEAD")==0 || -- strcmp(words[0], "POST")==0) { -- char *segs[4]; -- -- if (*words[0] == 'H') cn->reqtype = TYPE_HEAD; -- else if (*words[0] == 'P') cn->reqtype = TYPE_POST; -+ if ((delim = strchr(buf, ' ')) == NULL) -+ return 0; - -- split(words[1], segs, 4, '?'); -+ *delim = 0; -+ value = delim+1; - -- if (segs[0] == NULL) return 0; -+ if (strcmp(buf, "GET")==0 || -+ strcmp(buf, "HEAD")==0 || -+ strcmp(buf, "POST")==0) -+ { -+ if (buf[0] == 'H') -+ cn->reqtype = TYPE_HEAD; -+ else if (buf[0] == 'P') -+ cn->reqtype = TYPE_POST; -+ -+ if ((delim = strchr(value, ' ')) == NULL) /* expect HTTP type */ -+ return 0; -+ *delim = 0; - -- urldecode(segs[0]); -+ urldecode(value); - -- if (sanitizefile(segs[0]) == 0) { -+ if (sanitizefile(value) == 0) { - send404(cn); - removeconnection(cn); - return 0; - } - -- my_strncpy(cn->filereq, segs[0], MAXREQUESTLENGTH); -- -- if (segs[1] != NULL) my_strncpy(cn->cgiargs, segs[1], MAXREQUESTLENGTH); -- -- } else if (strcmp(words[0], "Host:")==0) { -+ my_strncpy(cn->filereq, value, MAXREQUESTLENGTH); -+#if defined(CONFIG_HTTP_HAS_CGI) -+ if ((cgi_delim = strchr(value, '?'))) -+ { -+ *cgi_delim = 0; -+ my_strncpy(cn->cgiargs, value+1, MAXREQUESTLENGTH); -+ } -+#endif - -- if (words[1] == NULL) return 0; -+ } else if (strcmp(buf, "Host:")==0) { - -- if (sanitizehost(words[1]) == 0) { -+ if (sanitizehost(value) == 0) { - send404(cn); - removeconnection(cn); - return 0; - } - -- my_strncpy(cn->virtualhostreq, words[1], MAXREQUESTLENGTH); -- } else if (strcmp(words[0], "Range:")==0) { -- -- cn->offset = -1; -- -- if (strchr(words[1], '-') == NULL) return 1; -- -- if (strchr(words[1], '=') != NULL) { -- while(*words[1] != '=') words[1]++; -- words[1]++; -- } -- -- if (isdigit(*words[1]) == 0) return 1; -- -- cn->offset = atoi(words[1]); -- -+ my_strncpy(cn->virtualhostreq, value, MAXREQUESTLENGTH); -+ } else if (strcmp(buf, "Connection:")==0 && -+ strcmp(value, "close")==0) { -+ cn->close_when_done = 1; -+ } else if (strcmp(buf, "If-Modified-Since:") ==0 ) { -+ /* TODO: parse this date properly with getdate() or similar */ -+ cn->modified_since = 1; - } - - return 1; - --} -- - -+} - -+#if defined(CONFIG_HTTP_DIRECTORIES) - void procdirlisting(struct connstruct *cn) { - - char buf[MAXREQUESTLENGTH]; -+ char actualfile[1024]; - -+#ifndef CONFIG_HTTP_DIRECTORIES - if (allowdirectorylisting == 0) { - send404(cn); - removeconnection(cn); - return; - } -+#endif - - if (cn->reqtype == TYPE_HEAD) { - snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n"); -@@ -107,7 +108,17 @@ - return; - } - -- cn->dirp = opendir(cn->actualfile); -+ strcpy(actualfile, cn->actualfile); -+#ifdef WIN32 -+ strcat(actualfile, "*"); -+ cn->dirp = FindFirstFile(actualfile, &cn->file_data); -+ if (cn->dirp == INVALID_HANDLE_VALUE) { -+ send404(cn); -+ removeconnection(cn); -+ return; -+ } -+#else -+ cn->dirp = opendir(actualfile); - if (cn->dirp == NULL) { - send404(cn); - removeconnection(cn); -@@ -116,12 +127,10 @@ - - // Get rid of the "." - readdir(cn->dirp); -+#endif - -- // If the browser doesn't specify a virtual host, the client will -- // see "http://default/thedir/" instead of "http://thehost.com/thedir/" -- // Consider this punishment for using such an old browser. -- snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n\nDirectory Listing\n

    Directory listing of http://%s%s


    \n", cn->virtualhostreq, cn->filereq); -- write(cn->networkdesc, buf, strlen(buf)); -+ snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n\nDirectory Listing\n

    Directory listing of %s://%s%s


    \n", cn->is_ssl ? "https" : "http", cn->virtualhostreq, cn->filereq); -+ special_write(cn, buf, strlen(buf)); - - cn->state = STATE_DOING_DIR; - -@@ -134,36 +143,48 @@ - - void procdodir(struct connstruct *cn) { - -+#ifndef WIN32 - struct dirent *dp; -+#endif - char buf[MAXREQUESTLENGTH]; -- char encbuf[sizeof(dp->d_name)*3+1]; -+ char encbuf[1024]; - int putslash; -+ char *file; - - do { - -- if ((dp = readdir(cn->dirp)) == NULL) { -- snprintf(buf, sizeof(buf), "

    End of Anti-Web directory listing.\n"); -- write(cn->networkdesc, buf, strlen(buf)); -+#ifdef WIN32 -+ if (!FindNextFile(cn->dirp, &cn->file_data)) { -+#else -+ if ((dp = readdir(cn->dirp)) == NULL) { -+#endif -+ snprintf(buf, sizeof(buf), "\n"); -+ special_write(cn, buf, strlen(buf)); - removeconnection(cn); - return; - } - -+#ifdef WIN32 -+ file = cn->file_data.cFileName; -+#else -+ file = dp->d_name; -+#endif - if (cn->filereq[0] == '/' && cn->filereq[1] == '\0' && -- strcmp(dp->d_name, "..") == 0) continue; -+ strcmp(file, "..") == 0) continue; - -- snprintf(buf, sizeof(buf), "%s%s", cn->actualfile, dp->d_name); -+ snprintf(buf, sizeof(buf), "%s%s", cn->actualfile, file); - putslash = isdir(buf); - -- urlencode(dp->d_name, encbuf); -+ urlencode(file, encbuf); - snprintf(buf, sizeof(buf), "%s%s
    \n", -- encbuf, putslash ? "/" : "", dp->d_name, putslash ? "/" : ""); -- write(cn->networkdesc, buf, strlen(buf)); -+ encbuf, putslash ? "/" : "", file, putslash ? "/" : ""); -+ special_write(cn, buf, strlen(buf)); - - } while (issockwriteable(cn->networkdesc)); - - return; - } -- -+#endif - - - -@@ -172,9 +193,10 @@ - char buf[MAXREQUESTLENGTH*4], *tp, *next; - int rv; - -- rv = read(cn->networkdesc, buf, sizeof(buf)-1); -- if (rv == 0 || rv == -1) { -- removeconnection(cn); -+ rv = special_read(cn, buf, sizeof(buf)-1); -+ if (rv <= 0) { -+ if (rv < 0) -+ removeconnection(cn); - return; - } - -@@ -217,36 +239,85 @@ - void procsendhead(struct connstruct *cn) { - - char buf[1024]; -+ char actualfile[1024]; - struct stat stbuf; -+ time_t now = cn->timeout - CONFIG_HTTP_TIMEOUT; -+ char date[32]; -+ strcpy(date, ctime(&now)); -+ -+ strcpy(actualfile, cn->actualfile); -+ -+#ifdef WIN32 -+ /* stat() under win32 can't deal with trail slash */ -+ if (actualfile[strlen(actualfile)-1] == '\\') -+ actualfile[strlen(actualfile)-1] = 0; -+#endif - -- if (stat(cn->actualfile, &stbuf) == -1) { -- if (allowcgi != 0) { -+ if (stat(actualfile, &stbuf) == -1) { -+#if defined(CONFIG_HTTP_HAS_CGI) - if (trycgi_withpathinfo(cn) == 0) { // We Try To Find A CGI - proccgi(cn,1); - return; - } -- } -+#endif - - send404(cn); - removeconnection(cn); - return; - } - -+#if defined(CONFIG_HTTP_HAS_CGI) - if (iscgi(cn->actualfile)) { -+#ifndef WIN32 - // Set up CGI script -- if (allowcgi == 0 || -- access(cn->actualfile, X_OK) != 0 || -- isdir(cn->actualfile)) { -+ if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) { -+ send404(cn); -+ removeconnection(cn); -+ return; -+ } -+#endif -+ -+ proccgi(cn,0); -+ return; -+ } -+#endif -+ -+ if ((stbuf.st_mode & S_IFMT) == S_IFDIR) { -+ if (cn->filereq[strlen(cn->filereq)-1] != '/') { -+ send301(cn); -+ removeconnection(cn); -+ return; -+ } -+ -+ // Check to see if this dir has an index file -+ if (procindex(cn, &stbuf) == 0) { -+#if defined(CONFIG_HTTP_DIRECTORIES) -+ // If not, we do a directory listing of it -+ procdirlisting(cn); -+#else - send404(cn); - removeconnection(cn); -+#endif - return; - } - -- proccgi(cn,0); -- return; -- } -+#if defined(CONFIG_HTTP_HAS_CGI) -+ // If the index is a CGI file, handle it like any other CGI -+ if (iscgi(cn->actualfile)) { -+ // Set up CGI script -+ if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) { -+ send404(cn); -+ removeconnection(cn); -+ return; -+ } - -+ proccgi(cn,0); -+ return; -+ } -+#endif -+ // If the index isn't a CGI, we continue on with the index file - -+ } - if ((stbuf.st_mode & S_IFMT) == S_IFDIR) { - if (cn->filereq[strlen(cn->filereq)-1] != '/') { - send301(cn); -@@ -256,17 +327,18 @@ - - // Check to see if this dir has an index file - if (procindex(cn, &stbuf) == 0) { -+#if defined(CONFIG_HTTP_DIRECTORIES) - // If not, we do a directory listing of it - procdirlisting(cn); -+#endif - return; - } - -+#if defined(CONFIG_HTTP_HAS_CGI) - // If the index is a CGI file, handle it like any other CGI - if (iscgi(cn->actualfile)) { - // Set up CGI script -- if (allowcgi == 0 || -- access(cn->actualfile, X_OK) != 0 || -- isdir(cn->actualfile)) { -+ if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) { - send404(cn); - removeconnection(cn); - return; -@@ -275,50 +347,68 @@ - proccgi(cn,0); - return; - } -+#endif - // If the index isn't a CGI, we continue on with the index file - - } - -- if (cn->offset == -1 || cn->offset >= stbuf.st_size) { -- cn->offset = -1; -+ if (cn->modified_since) { -+ snprintf(buf, sizeof(buf), "HTTP/1.1 304 Not Modified\nServer: Anti-Web V%s\nDate: %s\n", VERSION, date); -+ special_write(cn, buf, strlen(buf)); -+ cn->modified_since = 0; -+ cn->state = STATE_WANT_TO_READ_HEAD; -+ return; -+ } -+ else { -+#ifdef CONFIG_HTTP_VERBOSE -+ printf("awhttpd: %s send %s\n", -+ cn->is_ssl ? "https" : "http", cn->actualfile); -+ TTY_FLUSH(); -+#endif - -- snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s (%s)\nContent-Type: %s\nContent-Length: %ld\nLast-Modified: %s\n", -- VERSION, -- quote, -- getmimetype(cn->actualfile), -- (long) stbuf.st_size, -- ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end -- } else { -- snprintf(buf, sizeof(buf), "HTTP/1.1 206 OK\nServer: Anti-Web V%s (%s)\nContent-Type: %s\nContent-Range: %ld-%ld/%ld\nContent-Length: %ld\nLast-Modified: %s\n", -+ snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: Anti-Web V%s\nContent-Type: %s\nContent-Length: %ld\nDate: %sLast-Modified: %s\n", - VERSION, -- quote, - getmimetype(cn->actualfile), -- cn->offset, -- (long) stbuf.st_size-1, - (long) stbuf.st_size, -- (long) stbuf.st_size - cn->offset, -+ date, - ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end - } - -- write(cn->networkdesc, buf, strlen(buf)); -+ special_write(cn, buf, strlen(buf)); - - if (cn->reqtype == TYPE_HEAD) { - removeconnection(cn); - return; - } else { -+ int flags = O_RDONLY; -+#if defined(WIN32) || defined(CYGWIN) -+ flags |= O_BINARY; -+#endif - -- cn->filedesc = open(cn->actualfile, O_RDONLY); -+ cn->filedesc = open(cn->actualfile, flags); - if (cn->filedesc == -1) { - send404(cn); - removeconnection(cn); - return; - } - -- if (cn->offset != -1) { -- lseek(cn->filedesc, cn->offset, SEEK_SET); -+#ifdef WIN32 -+ for (;;) -+ { -+ procreadfile(cn); -+ if (cn->filedesc == -1) -+ { -+ break; -+ } -+ -+ do -+ { -+ procsendfile(cn); -+ } while (cn->state != STATE_WANT_TO_READ_FILE); - } -- -+#else - cn->state = STATE_WANT_TO_READ_FILE; -+#endif - return; - } - -@@ -328,13 +418,18 @@ - - void procreadfile(struct connstruct *cn) { - -- int rv; -- -- rv = read(cn->filedesc, cn->databuf, BLOCKSIZE); -+ int rv = read(cn->filedesc, cn->databuf, BLOCKSIZE); - - if (rv == 0 || rv == -1) { -- removeconnection(cn); -- return; -+ close(cn->filedesc); -+ cn->filedesc = -1; -+ if (cn->close_when_done) /* close immediately */ -+ removeconnection(cn); -+ else { /* keep socket open - HTTP 1.1 */ -+ cn->state = STATE_WANT_TO_READ_HEAD; -+ cn->numbytes = 0; -+ } -+ return; - } - - cn->numbytes = rv; -@@ -347,11 +442,9 @@ - - void procsendfile(struct connstruct *cn) { - -- int rv; -- -- rv = write(cn->networkdesc, cn->databuf, cn->numbytes); -+ int rv = special_write(cn, cn->databuf, cn->numbytes); - -- if (rv == -1) -+ if (rv < 0) - removeconnection(cn); - else if (rv == cn->numbytes) - cn->state = STATE_WANT_TO_READ_FILE; -@@ -361,7 +454,47 @@ - memmove(cn->databuf, cn->databuf + rv, cn->numbytes - rv); - cn->numbytes -= rv; - } -+} - -- return; -+int special_write(struct connstruct *cn, -+ const uint8_t *buf, size_t count) -+{ -+ int res; -+ -+#ifdef CONFIG_HTTP_HAS_SSL -+ if (cn->is_ssl) -+ { -+ SSL *ssl = ssl_find(servers->ssl_ctx, cn->networkdesc); -+ if (ssl) -+ { -+ res = ssl_write(ssl, (unsigned char *)buf, count); -+ } -+ else -+ return -1; -+ } -+ else -+#endif -+ res = SOCKET_WRITE(cn->networkdesc, buf, count); -+ -+ return res; -+} -+ -+static int special_read(struct connstruct *cn, void *buf, size_t count) -+{ -+ int res; -+ -+#ifdef CONFIG_HTTP_HAS_SSL -+ if (cn->is_ssl) -+ { -+ SSL *ssl = ssl_find(servers->ssl_ctx, cn->networkdesc); -+ unsigned char *read_buf; -+ -+ if ((res = ssl_read(ssl, &read_buf)) > SSL_OK) -+ memcpy(buf, read_buf, res > (int)count ? count : res); -+ } -+ else -+#endif -+ res = SOCKET_READ(cn->networkdesc, buf, count); - -+ return res; - } -diff -Naur awhttpd/socket.c axTLS/httpd/awhttpd/socket.c ---- awhttpd/socket.c 2004-04-25 13:03:05.000000000 +1000 -+++ axTLS/httpd/awhttpd/socket.c 2006-11-15 15:09:14.415015200 +1000 -@@ -8,61 +8,17 @@ - - - #include --#include --#include - #include --#include --#include --#include --#include --#include --#include - #include - - -- - #include "aw3.h" - - - --int checkmaxusers(int sd) { -- -- if (maxusers <= 0) return 1; -- -- if (numusers >= maxusers) { -- send505(sd, "Maximum user limit reached"); -- // removeconnection() should be used normally -- close(sd); -- -- return 0; -- } -- -- return 1; --} -- -- --int pollsocket(int sd, long ustimeout) { -- -- fd_set rfds; -- struct timeval tv; -- -- tv.tv_sec = 0; -- tv.tv_usec = ustimeout; -- -- FD_ZERO(&rfds); -- FD_SET(sd, &rfds); -- -- select(FD_SETSIZE, &rfds, NULL, NULL, (ustimeout >= 0) ? &tv : NULL); -- -- return FD_ISSET(sd, &rfds); -- --} -- -- -- - #ifdef HAVE_IPV6 - --void handlenewconnection(int listenfd) { -+void handlenewconnection(int listenfd, int is_ssl) { - - struct sockaddr_in6 their_addr; - int tp = sizeof(their_addr); -@@ -82,7 +38,7 @@ - *ipbuf = '\0'; - } - -- if (checkmaxusers(connfd)) addconnection(connfd, ipbuf); -+ addconnection(connfd, ipbuf, is_ssl); - - return; - -@@ -90,19 +46,17 @@ - - #else - --void handlenewconnection(int listenfd) { -+void handlenewconnection(int listenfd, int is_ssl) { - - struct sockaddr_in their_addr; - int tp = sizeof(struct sockaddr_in); - int connfd; -- char ipbuf[100]; - - connfd = accept(listenfd, (struct sockaddr *)&their_addr, &tp); - - if (connfd == -1) return; - -- if (checkmaxusers(connfd)) -- addconnection(connfd, inet_ntoa(their_addr.sin_addr)); -+ addconnection(connfd, inet_ntoa(their_addr.sin_addr), is_ssl); - - return; - } -@@ -113,8 +67,12 @@ - - - int openlistener(int port) { -- -- int tp=0,sd; -+ int sd; -+#ifdef WIN32 -+ char tp=1; -+#else -+ int tp=1; -+#endif - struct sockaddr_in my_addr; - - if ((sd = socket(AF_INET, SOCK_STREAM, 0)) == -1) return -1; -@@ -125,7 +83,7 @@ - setsockopt(sd, SOL_SOCKET, SO_REUSEADDR, &tp, sizeof(tp)); - - my_addr.sin_family = AF_INET; // host byte order -- my_addr.sin_port = htons(port); // short, network byte order -+ my_addr.sin_port = htons((short)port); // short, network byte order - my_addr.sin_addr.s_addr = INADDR_ANY; // automatically fill with my IP - - memset(&(my_addr.sin_zero), 0, 8); // zero the rest of the struct -diff -Naur awhttpd/urlencode.c axTLS/httpd/awhttpd/urlencode.c ---- awhttpd/urlencode.c 2004-05-14 10:53:47.000000000 +1000 -+++ axTLS/httpd/awhttpd/urlencode.c 2006-11-15 15:09:14.430640700 +1000 -@@ -13,7 +13,7 @@ - - #include - #include -- -+#include - #include "aw3.h" - - -@@ -37,7 +37,7 @@ - (*p > 'Z' && *p < '_') || - (*p > '_' && *p < 'a') || - (*p > 'z' && *p < 0xA1)) { -- sprintf(tp, "%%%02X", *p); -+ sprintf((char *)tp, "%%%02X", *p); - tp += 3; - } else { - *tp = *p; diff --git a/httpd/axhttp.h b/httpd/axhttp.h new file mode 100644 index 0000000000..7af635a715 --- /dev/null +++ b/httpd/axhttp.h @@ -0,0 +1,164 @@ +/* + * Copyright(C) 2006 Cameron Rich + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#include "os_port.h" +#include "ssl.h" + +#define BACKLOG 15 +#define VERSION "3.0.7" +#ifdef CONFIG_HTTP_HAS_IPV6 +#define HAVE_IPV6 +#endif + +#define MAXFILEPATH 1024 +#define MAXIPLEN 45 +#define MAXREQUESTLENGTH 1024 +#define MAXCGIARGS 100 +#define BLOCKSIZE 4096 + +#define INITIAL_CONNECTION_SLOTS 10 +#define CONFIG_HTTP_DEFAULT_SSL_OPTIONS 0 + +#define STATE_WANT_TO_READ_HEAD 1 +#define STATE_WANT_TO_SEND_HEAD 2 +#define STATE_WANT_TO_READ_FILE 3 +#define STATE_WANT_TO_SEND_FILE 4 +#define STATE_DOING_DIR 5 + +#define TYPE_GET 0 +#define TYPE_HEAD 1 +#define TYPE_POST 2 + +struct connstruct +{ + struct connstruct *next; + + int state; + int reqtype; + + int networkdesc; + int filedesc; + +#if defined(CONFIG_HTTP_DIRECTORIES) +#ifdef WIN32 + HANDLE dirp; + WIN32_FIND_DATA file_data; +#else + DIR *dirp; +#endif +#endif + + time_t timeout; + char ip[MAXIPLEN]; + char actualfile[MAXREQUESTLENGTH]; + char filereq[MAXREQUESTLENGTH]; +#if defined(CONFIG_HTTP_HAS_CGI) + char cgiargs[MAXREQUESTLENGTH]; + char cgiscriptinfo[MAXREQUESTLENGTH]; + char cgipathinfo[MAXREQUESTLENGTH]; +#endif + char virtualhostreq[MAXREQUESTLENGTH]; + + int numbytes; + char databuf[BLOCKSIZE]; + + unsigned char is_ssl; + unsigned char close_when_done; + unsigned char modified_since; +}; + +struct serverstruct +{ + struct serverstruct *next; + int sd; + int is_ssl; + SSLCTX *ssl_ctx; +}; + +struct cgiextstruct +{ + struct cgiextstruct *next; + char *ext; +}; + +struct indexstruct +{ + struct indexstruct *next; + char *name; +}; + +// Global prototypes +extern struct serverstruct *servers; +extern struct connstruct *usedconns; +extern struct connstruct *freeconns; +extern struct cgiextstruct *cgiexts; +extern struct indexstruct *indexlist; + +// Conf global prototypes +extern char *webroot; +extern int allowdirectorylisting; +extern int allowcgi; +extern int permcheck; + +// conn.c prototypes +void addconnection(int sd, char *ip, int is_ssl); +void removeconnection(struct connstruct *cn); + +// proc.c prototypes +int procheadelem(struct connstruct *cn, char *buf); +void procdirlisting(struct connstruct *cn); +void procdodir(struct connstruct *cn); +void procreadhead(struct connstruct *cn); +void procsendhead(struct connstruct *cn); +void procreadfile(struct connstruct *cn); +void procsendfile(struct connstruct *cn); +int special_write(struct connstruct *cn, const uint8_t *buf, size_t count); + +// net.c prototypes +void addtoservers(int sd); +void selectloop(void); + +// socket.c prototypes +void handlenewconnection(int listenfd, int is_ssl); +int openlistener(int port); +int openlistener6(int port); + +// misc.c prototypes +void nada(int sigtype); +void die(int sigtype); +void reaper(int sigtype); +void stripcrlf(char *p); +char *my_strncpy(char *dest, const char *src, size_t n); +#ifndef __HAVE_ARCH_STRNLEN +size_t strnlen ( const char * str, size_t maxlen ); +#endif +int iscgi(char *fn); +void split(char *tp, char *sp[], int maxwords, char sc); +int sanitizefile(char *buf); +int sanitizehost(char *buf); +void buildactualfile(struct connstruct *cn); +int issockwriteable(int sd); +int isdir(char *name); +int trycgi_withpathinfo(struct connstruct *cn); + +// mime_types.c prototypes +void mime_init(void); +const char *getmimetype(const char *fn); + +// main.c prototypes +void initlists(void); diff --git a/httpd/conn.c b/httpd/conn.c new file mode 100644 index 0000000000..a36271709f --- /dev/null +++ b/httpd/conn.c @@ -0,0 +1,121 @@ +/* + * Copyright(C) 2006 Cameron Rich + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#include +#include +#include +#include "axhttp.h" + +void addconnection(int sd, char *ip, int is_ssl) +{ + struct connstruct *tp; + + // Get ourselves a connstruct + if (freeconns == NULL) + { + tp = (struct connstruct *) malloc(sizeof(struct connstruct)); + } + else + { + tp = freeconns; + freeconns = tp->next; + } + + // Attach it to the used list + tp->next = usedconns; + usedconns = tp; + + tp->networkdesc = sd; + if (is_ssl) + ssl_server_new(servers->ssl_ctx, sd); + tp->filedesc = -1; +#if defined(CONFIG_HTTP_HAS_DIRECTORIES) + tp->dirp = NULL; +#endif + tp->is_ssl = is_ssl; + + *(tp->actualfile) = '\0'; + *(tp->filereq) = '\0'; +#if defined(CONFIG_HTTP_HAS_CGI) + *(tp->cgiargs) = '\0'; +#endif + *(tp->virtualhostreq) = '\0'; + + tp->state = STATE_WANT_TO_READ_HEAD; + tp->reqtype = TYPE_GET; + my_strncpy(tp->ip, ip, MAXIPLEN); + tp->close_when_done = 0; + tp->modified_since = 0; + tp->timeout = time(NULL) + CONFIG_HTTP_TIMEOUT; +} + +void removeconnection(struct connstruct *cn) +{ + struct connstruct *tp; + int shouldret=0; + + tp = usedconns; + + if (tp == NULL || cn == NULL) + shouldret=1; + else if (tp == cn) + usedconns = tp->next; + else + { + while(tp != NULL) + { + if (tp->next == cn) + { + tp->next = (tp->next)->next; + shouldret=0; + break; + } + + tp = tp->next; + shouldret=1; + } + } + + if (shouldret) + return; + + // If we did, add it to the free list + cn->next = freeconns; + freeconns = cn; + + // Close it all down + if (cn->networkdesc != -1) + { + if (cn->is_ssl) + { + ssl_free(ssl_find(servers->ssl_ctx, cn->networkdesc)); + } + + SOCKET_CLOSE(cn->networkdesc); + } + + if (cn->filedesc != -1) close(cn->filedesc); +#if defined(CONFIG_HTTP_HAS_DIRECTORIES) + if (cn->dirp != NULL) +#ifdef WIN32 + FindClose(cn->dirp); +#else + closedir(cn->dirp); +#endif +#endif +} diff --git a/httpd/main.c b/httpd/main.c new file mode 100644 index 0000000000..d3e5e1aed8 --- /dev/null +++ b/httpd/main.c @@ -0,0 +1,323 @@ +/* + * Copyright(C) 2006 Cameron Rich + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#include +#include +#include +#include +#include +#include "axhttp.h" + +// GLOBALS +struct serverstruct *servers; +struct connstruct *usedconns; +struct connstruct *freeconns; +#if defined(CONFIG_HTTP_HAS_CGI) +struct cgiextstruct *cgiexts; +#endif +struct indexstruct *indexlist; + +char *webroot = CONFIG_HTTP_WEBROOT; +static void addindex(char *tp); +#if defined(CONFIG_HTTP_PERM_CHECK) +static void procpermcheck(char *pathtocheck); +#endif +#if defined(CONFIG_HTTP_HAS_CGI) +static void addcgiext(char *tp); +#endif + +/* clean up memory for valgrind */ +static void sigint_cleanup(int sig) +{ + struct serverstruct *sp; + struct connstruct *tp; + int i; + + while(servers != NULL) + { + if (servers->is_ssl) + ssl_ctx_free(servers->ssl_ctx); + + sp = servers->next; + free(servers); + servers = sp; + } + + free(indexlist->name); + free(indexlist); + + for (i = 0; i < INITIAL_CONNECTION_SLOTS; i++) + { + if (freeconns == NULL) + break; + + tp = freeconns->next; + free(freeconns); + freeconns = tp; + } + + exit(0); +} + +void initlists() +{ + int i; + struct connstruct *tp; + + servers = NULL; + usedconns = NULL; + freeconns = NULL; +#if defined(CONFIG_HTTP_HAS_CGI) + cgiexts = NULL; +#endif + indexlist = NULL; + + for (i=0; inext = tp; + } +} + +int main(int argc, char *argv[]) +{ + int tp; +#if defined(CONFIG_HTTP_IS_DAEMON) + int pid; +#endif + +#ifdef WIN32 + WORD wVersionRequested = MAKEWORD(2,2); + WSADATA wsaData; + WSAStartup(wVersionRequested,&wsaData); +#endif + + mime_init(); + initlists(); + tp = strlen(webroot); + + if (webroot[tp-1] == '/') + webroot[tp-1] = '\0'; + + if (isdir(webroot) == 0) + { +#ifdef CONFIG_HTTP_VERBOSE + fprintf(stderr, "'%s' is not a directory\n", webroot); +#endif + exit(1); + } + + if ((tp=openlistener(CONFIG_HTTP_PORT)) == -1) + { +#ifdef CONFIG_HTTP_VERBOSE + fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", + CONFIG_HTTP_PORT); +#endif + exit(1); + } + + addindex("index.html"); + addtoservers(tp); + +#ifndef WIN32 + if (getuid() == 0) + { + setgid(32767); + setuid(32767); + } +#endif + + if ((tp=openlistener(CONFIG_HTTP_HTTPS_PORT)) == -1) + { +#ifdef CONFIG_HTTP_VERBOSE + fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", + CONFIG_HTTP_HTTPS_PORT); +#endif + exit(1); + } + + addtoservers(tp); + servers->ssl_ctx = ssl_ctx_new(CONFIG_HTTP_DEFAULT_SSL_OPTIONS, + CONFIG_HTTP_SESSION_CACHE_SIZE); + servers->is_ssl = 1; + +#if defined(CONFIG_HTTP_PERM_CHECK) + procpermcheck(webroot); +#endif +#if defined(CONFIG_HTTP_HAS_CGI) + addcgiext(CONFIG_HTTP_CGI_EXTENSION); +#endif +#if defined(CONFIG_HTTP_VERBOSE) + printf("axhttpd: listening on ports http:%d and https:%d\n", + CONFIG_HTTP_PORT, CONFIG_HTTP_HTTPS_PORT); + TTY_FLUSH(); +#endif + +#if defined(CONFIG_HTTP_IS_DAEMON) + pid = fork(); + + if (pid > 0) + { + exit(0); + } + else if(pid == -1) + { +#ifdef CONFIG_HTTP_VERBOSE + fprintf(stderr,"axhttpd: Sorry, fork failed... Tough dice.\n"); +#endif + exit(1); + } + + setsid(); +#endif + + /* SIGNALS */ + signal(SIGINT, sigint_cleanup); + signal(SIGTERM, die); +#if defined(CONFIG_HTTP_HAS_CGI) +#ifndef WIN32 + signal(SIGCHLD, reaper); +#endif +#endif +#ifndef WIN32 + signal(SIGQUIT, die); + signal(SIGPIPE, SIG_IGN); +#endif + + selectloop(); + return 0; +} + +static void addindex(char *tp) +{ + struct indexstruct *ex = (struct indexstruct *) + malloc(sizeof(struct indexstruct)); + ex->name = strdup(tp); + ex->next = indexlist; + indexlist = ex; +} + +#if defined(CONFIG_HTTP_PERM_CHECK) +static void procpermcheck(char *pathtocheck) +{ + char thepath[MAXREQUESTLENGTH]; +#ifndef WIN32 + DIR *tpdir; + struct dirent *dp; + + tpdir = opendir(pathtocheck); + + if (tpdir == NULL) + { + printf("WARNING: UID (%d) is unable to read %s\n", + (int)getuid(), pathtocheck); + return; + } + + while ((dp=readdir(tpdir))) + { + if (strcmp(dp->d_name, "..")==0) + continue; + + if (strcmp(dp->d_name, ".")==0) + continue; + + snprintf(thepath, sizeof(thepath), "%s/%s", pathtocheck, dp->d_name); + + if (isdir(thepath)) + { + procpermcheck(thepath); + continue; + } + + if (access(thepath, R_OK) != 0) + printf("WARNING: UID (%d) is unable to read %s\n", + (int)getuid(), thepath); + if (access(thepath, W_OK) == 0) + printf("SECURITY: UID (%d) is ABLE TO WRITE TO %s\n", + (int)getuid(), thepath); + } + + closedir(tpdir); +#else /* Win32 */ + HANDLE tpdir; + WIN32_FIND_DATA file_data; + struct stat st; + char buf2[1024]; + + strcpy(buf2, pathtocheck); + strcat(buf2, "\\*"); + tpdir = FindFirstFile(buf2, &file_data); + + if (tpdir == INVALID_HANDLE_VALUE) + { + printf("WARNING: unable to read %s\n", buf2); + TTY_FLUSH(); + return; + } + + while (FindNextFile(tpdir, &file_data)) + { + if (strcmp(file_data.cFileName, "..") == 0) + continue; + + if (strcmp(file_data.cFileName, ".") == 0) + continue; + + snprintf(thepath, sizeof(thepath), "%s\\%s", + pathtocheck, file_data.cFileName); + + if (isdir(thepath)) + { + procpermcheck(thepath); + continue; + } + + if (stat(thepath, &st) >= 0) + { + if ((st.st_mode & _S_IREAD) == 0) + { + printf("WARNING: unable to read %s\n", thepath); + TTY_FLUSH(); + } + + if (st.st_mode & _S_IWRITE) + { + printf("SECURITY: ABLE TO WRITE TO %s\n", thepath); + TTY_FLUSH(); + } + } + } + + FindClose(tpdir); +#endif +} +#endif /* CONFIG_HTTP_PERM_CHECK */ + +#if defined(CONFIG_HTTP_HAS_CGI) +static void addcgiext(char *tp) +{ + struct cgiextstruct *ex = (struct cgiextstruct *) + malloc(sizeof(struct cgiextstruct)); + ex->ext = strdup(tp); + ex->next = cgiexts; + cgiexts = ex; +} +#endif + diff --git a/httpd/mime_types.c b/httpd/mime_types.c new file mode 100644 index 0000000000..5bc959be4c --- /dev/null +++ b/httpd/mime_types.c @@ -0,0 +1,190 @@ +/* + * Copyright(C) 2006 Cameron Rich + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#include +#include +#include +#include +#include "os_port.h" + +static const char mime_default[] = "text/plain"; + +typedef struct +{ + const char * const ext; + const char * const type; +} mime_table_t; + +static mime_table_t mime_table[] = +{ + // Fundamentals + { ".html", "text/html" }, + { ".htm", "text/html" }, + { ".txt", "text/plain" }, + + // Others + { ".rtx", "text/richtext" }, + { ".etx", "text/x-setext" }, + { ".tsv", "text/tab-separated-values" }, + { ".css", "text/css" }, + { ".xml", "text/xml" }, + { ".dtd", "text/xml" }, + { ".gif", "image/gif" }, + { ".jpg", "image/jpeg" }, + { ".jpeg", "image/jpeg" }, + { ".jpe", "image/jpeg" }, + { ".jfif", "image/jpeg" }, + { ".tif", "image/tiff" }, + { ".tiff", "image/tiff" }, + { ".pbm", "image/x-portable-bitmap" }, + { ".pgm", "image/x-portable-graymap" }, + { ".ppm", "image/x-portable-pixmap" }, + { ".pnm", "image/x-portable-anymap" }, + { ".xbm", "image/x-xbitmap" }, + { ".xpm", "image/x-xpixmap" }, + { ".xwd", "image/x-xwindowdump" }, + { ".ief", "image/ief" }, + { ".png", "image/png" }, + { ".au", "audio/basic" }, + { ".snd", "audio/basic" }, + { ".aif", "audio/x-aiff" }, + { ".aiff", "audio/x-aiff" }, + { ".aifc", "audio/x-aiff" }, + { ".ra", "audio/x-pn-realaudio" }, + { ".ram", "audio/x-pn-realaudio" }, + { ".rm", "audio/x-pn-realaudio" }, + { ".rpm", "audio/x-pn-realaudio-plugin" }, + { ".wav", "audio/wav" }, + { ".mid", "audio/midi" }, + { ".midi", "audio/midi" }, + { ".kar", "audio/midi" }, + { ".mpga", "audio/mpeg" }, + { ".mp2", "audio/mpeg" }, + { ".mp3", "audio/mpeg" }, + { ".mpeg", "video/mpeg" }, + { ".mpg", "video/mpeg" }, + { ".mpe", "video/mpeg" }, + { ".qt", "video/quicktime" }, + { ".mov", "video/quicktime" }, + { ".avi", "video/x-msvideo" }, + { ".movie", "video/x-sgi-movie" }, + { ".mv", "video/x-sgi-movie" }, + { ".vx", "video/x-rad-screenplay" }, + { ".a", "application/octet-stream" }, + { ".bin", "application/octet-stream" }, + { ".exe", "application/octet-stream" }, + { ".dump", "application/octet-stream" }, + { ".o", "application/octet-stream" }, + { ".class", "application/java" }, + { ".js", "application/x-javascript" }, + { ".ai", "application/postscript" }, + { ".eps", "application/postscript" }, + { ".ps", "application/postscript" }, + { ".dir", "application/x-director" }, + { ".dcr", "application/x-director" }, + { ".dxr", "application/x-director" }, + { ".fgd", "application/x-director" }, + { ".aam", "application/x-authorware-map" }, + { ".aas", "application/x-authorware-seg" }, + { ".aab", "application/x-authorware-bin" }, + { ".fh4", "image/x-freehand" }, + { ".fh7", "image/x-freehand" }, + { ".fh5", "image/x-freehand" }, + { ".fhc", "image/x-freehand" }, + { ".fh", "image/x-freehand" }, + { ".spl", "application/futuresplash" }, + { ".swf", "application/x-shockwave-flash" }, + { ".dvi", "application/x-dvi" }, + { ".gtar", "application/x-gtar" }, + { ".hdf", "application/x-hdf" }, + { ".hqx", "application/mac-binhex40" }, + { ".iv", "application/x-inventor" }, + { ".latex", "application/x-latex" }, + { ".man", "application/x-troff-man" }, + { ".me", "application/x-troff-me" }, + { ".mif", "application/x-mif" }, + { ".ms", "application/x-troff-ms" }, + { ".oda", "application/oda" }, + { ".pdf", "application/pdf" }, + { ".rtf", "application/rtf" }, + { ".bcpio", "application/x-bcpio" }, + { ".cpio", "application/x-cpio" }, + { ".sv4cpio", "application/x-sv4cpio" }, + { ".sv4crc", "application/x-sv4crc" }, + { ".sh", "application/x-shar" }, + { ".shar", "application/x-shar" }, + { ".sit", "application/x-stuffit" }, + { ".tar", "application/x-tar" }, + { ".tex", "application/x-tex" }, + { ".texi", "application/x-texinfo" }, + { ".texinfo", "application/x-texinfo" }, + { ".tr", "application/x-troff" }, + { ".roff", "application/x-troff" }, + { ".man", "application/x-troff-man" }, + { ".me", "application/x-troff-me" }, + { ".ms", "application/x-troff-ms" }, + { ".zip", "application/x-zip-compressed" }, + { ".tsp", "application/dsptype" }, + { ".wsrc", "application/x-wais-source" }, + { ".ustar", "application/x-ustar" }, + { ".cdf", "application/x-netcdf" }, + { ".nc", "application/x-netcdf" }, + { ".doc", "application/msword" }, + { ".ppt", "application/powerpoint" }, + { ".wrl", "model/vrml" }, + { ".vrml", "model/vrml" }, + { ".mime", "message/rfc822" }, + { ".pac", "application/x-ns-proxy-autoconfig" }, + { ".wml", "text/vnd.wap.wml" }, + { ".wmlc", "application/vnd.wap.wmlc" }, + { ".wmls", "text/vnd.wap.wmlscript" }, + { ".wmlsc", "application/vnd.wap.wmlscriptc" }, + { ".wbmp", "image/vnd.wap.wbmp" }, + { ".tgz", "application/x-gzip" }, + { ".tar.gz", "application/x-gzip" }, + { ".bz2", "application/x-bzip2" }, + { ".zip", "application/zip" } +}; + +static int mime_cmp(const mime_table_t *t1, const mime_table_t *t2) +{ + return strcasecmp(t1->ext, t2->ext); +} + +void mime_init(void) +{ + qsort(mime_table, sizeof(mime_table)/sizeof(mime_table_t), + sizeof(mime_table_t), + (int (*)(const void *, const void *))mime_cmp); +} + +const char *getmimetype(const char *name) +{ + mime_table_t *mime_type; + + if ((name = strrchr(name, '.')) == NULL) + return mime_default; + + mime_type = bsearch(&name, mime_table, + sizeof(mime_table)/sizeof(mime_table_t), + sizeof(mime_table_t), + (int (*)(const void *, const void *))mime_cmp); + + return mime_type == NULL ? mime_default : mime_type->type; +} + diff --git a/httpd/misc.c b/httpd/misc.c new file mode 100644 index 0000000000..bca059b5bf --- /dev/null +++ b/httpd/misc.c @@ -0,0 +1,268 @@ +/* + * Copyright(C) 2006 Cameron Rich + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#include +#include +#include +#include +#include +#include +#include "axhttp.h" + +void nada(int sigtype) { } + +void die(int sigtype) +{ + exit(0); +} + +#if defined(CONFIG_HTTP_HAS_CGI) +#ifndef WIN32 +void reaper(int sigtype) +{ + wait3(NULL,WNOHANG,NULL); +} +#endif +#endif + +void stripcrlf(char *p) +{ + while (p && *p) + { + if (*p=='\n' || *p=='\r') + { + *p='\0'; + return; + } + p++; + } +} + +/* Wrapper function for strncpy() that guarantees + a null-terminated string. This is to avoid any possible + issues due to strncpy()'s behaviour. Thanks to + Werner Almesberger for pointing out this potential + issue. Needless to say, make sure sizeof(dest) > 0 + and sizeof(dest) >= n. + */ +char *my_strncpy(char *dest, const char *src, size_t n) +{ + strncpy(dest, src, n); + dest[n-1] = '\0'; + return dest; +} + +/* strnlen is a GNU Extension */ +#ifndef __HAVE_ARCH_STRNLEN +size_t strnlen (const char * str, size_t maxlen) +{ + const char *p; + + for (p=str; maxlen-- && *p!='\0'; ++p); + return (p - str); +} +#endif + +int sanitizefile(char *buf) +{ + int len, i; + + // Don't accept anything not starting with a / + if (*buf != '/') + return 0; + + len = strlen(buf); + for (i = 0; i < len; i++) + { + // Check for "/." : In other words, don't send files starting with a . + // Notice, GOBBLES, that this includes ".." + if (buf[i] == '/' && buf[i+1] == '.') + return 0; + } + + return 1; +} + +int sanitizehost(char *buf) +{ + while(*buf != '\0') + { + // Handle the port + if (*buf == ':') + { + *buf = '\0'; + return 1; + } + + // Enforce some basic URL rules... + if (isalnum(*buf)==0 && *buf != '-' && *buf != '.') return 0; + if (*buf == '.' && *(buf+1) == '.') return 0; + if (*buf == '.' && *(buf+1) == '-') return 0; + if (*buf == '-' && *(buf+1) == '.') return 0; + buf++; + } + + return 1; +} + +void buildactualfile(struct connstruct *cn) +{ + snprintf(cn->actualfile, MAXREQUESTLENGTH, "%s%s", + webroot, + cn->filereq); + + /* Add directory slash if not there */ + if (isdir(cn->actualfile) && + cn->actualfile[strlen(cn->actualfile)-1] != '/') + strcat(cn->actualfile, "/"); + +#ifdef WIN32 + /* convert all the forward slashes to back slashes */ + { + char *t = cn->actualfile; + while ((t = strchr(t, '/'))) + { + *t++ = '\\'; + } + } +#endif +} + +#if defined(CONFIG_HTTP_DIRECTORIES) +int issockwriteable(int sd) +{ + fd_set wfds; + struct timeval tv; + + tv.tv_sec = 0; + tv.tv_usec = 0; + + FD_ZERO(&wfds); + FD_SET(sd, &wfds); + + select(FD_SETSIZE, NULL, &wfds, NULL, &tv); + + return FD_ISSET(sd, &wfds); +} +#endif + +int isdir(char *tpbuf) +{ + struct stat st; + + if (stat(tpbuf, &st) == -1) + return 0; + + if ((st.st_mode & S_IFMT) == S_IFDIR) + return 1; + + return 0; +} + +#if defined(CONFIG_HTTP_HAS_CGI) +int iscgi(char *fn) +{ + struct cgiextstruct *tp; + int fnlen, extlen; + + fnlen = strlen(fn); + tp = cgiexts; + + while (tp != NULL) + { + extlen = strlen(tp->ext); + + if (strcasecmp(fn+(fnlen-extlen), tp->ext) == 0) + return 1; + + tp = tp->next; + } + + return 0; +} + +void split(char *tp, char *sp[], int maxwords, char sc) +{ + int i = 0; + + while(1) + { + /* Skip leading whitespace */ + while(*tp == sc) tp++; + + if (*tp == '\0') + { + sp[i] = NULL; + break; + } + + if (i==maxwords-2) + { + sp[maxwords-2] = NULL; + break; + } + + sp[i] = tp; + + while(*tp != sc && *tp != '\0') + tp++; + + if (*tp == sc) + *tp++ = '\0'; + + i++; + } +} + +int trycgi_withpathinfo(struct connstruct *cn) +{ + char tpfile[MAXREQUESTLENGTH]; + char fr_str[MAXREQUESTLENGTH]; + char *fr_rs[MAXCGIARGS]; // filereq splitted + int i = 0, offset; + + my_strncpy(fr_str, cn->filereq, MAXREQUESTLENGTH); + split(fr_str, fr_rs, MAXCGIARGS, '/'); + + while (fr_rs[i] != NULL) + { + snprintf(tpfile, sizeof(tpfile), "%s/%s%s", + webroot, cn->virtualhostreq, fr_str); + + if (iscgi(tpfile) && isdir(tpfile) == 0) + { + /* We've found our CGI file! */ + my_strncpy(cn->actualfile, tpfile, MAXREQUESTLENGTH); + my_strncpy(cn->cgiscriptinfo, fr_str, MAXREQUESTLENGTH); + + offset = (fr_rs[i] + strlen(fr_rs[i])) - fr_str; + my_strncpy(cn->cgipathinfo, cn->filereq+offset, MAXREQUESTLENGTH); + + return 0; + } + + *(fr_rs[i]+strlen(fr_rs[i])) = '/'; + i++; + } + + /* Couldn't find any CGIs :( */ + *(cn->cgiscriptinfo) = '\0'; + *(cn->cgipathinfo) = '\0'; + return -1; +} +#endif diff --git a/httpd/net.c b/httpd/net.c new file mode 100644 index 0000000000..dd325a61d4 --- /dev/null +++ b/httpd/net.c @@ -0,0 +1,176 @@ +/* + * Copyright(C) 2006 Cameron Rich + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#include +#include +#include +#include +#include +#include "axhttp.h" + +void addtoservers(int sd) +{ + struct serverstruct *tp = (struct serverstruct *) + calloc(1, sizeof(struct serverstruct)); + tp->next = servers; + tp->sd = sd; + servers = tp; +} + +void selectloop() +{ + fd_set rfds, wfds; + struct connstruct *tp, *to; + struct serverstruct *sp; + int rnum, wnum, active; + int currtime; + + while (1) + { + // MAIN SELECT LOOP + FD_ZERO(&rfds); + FD_ZERO(&wfds); + rnum = wnum = -1; + + // Add the listening sockets + sp = servers; + while (sp != NULL) + { + FD_SET(sp->sd, &rfds); + if (sp->sd > rnum) rnum = sp->sd; + sp = sp->next; + } + + // Add the established sockets + tp = usedconns; + currtime = time(NULL); + + while (tp != NULL) + { + if (currtime > tp->timeout) + { + to = tp; + tp = tp->next; + removeconnection(to); + continue; + } + + if (tp->state == STATE_WANT_TO_READ_HEAD) + { + FD_SET(tp->networkdesc, &rfds); + if (tp->networkdesc > rnum) + rnum = tp->networkdesc; + } + + if (tp->state == STATE_WANT_TO_SEND_HEAD) + { + FD_SET(tp->networkdesc, &wfds); + if (tp->networkdesc > wnum) + wnum = tp->networkdesc; + } + + if (tp->state == STATE_WANT_TO_READ_FILE) + { + FD_SET(tp->filedesc, &rfds); + if (tp->filedesc > rnum) + rnum = tp->filedesc; + } + + if (tp->state == STATE_WANT_TO_SEND_FILE) + { + FD_SET(tp->networkdesc, &wfds); + if (tp->networkdesc > wnum) + wnum = tp->networkdesc; + } + +#if defined(CONFIG_HTTP_DIRECTORIES) + if (tp->state == STATE_DOING_DIR) + { + FD_SET(tp->networkdesc, &wfds); + if (tp->networkdesc > wnum) + wnum = tp->networkdesc; + } +#endif + tp = tp->next; + } + + active = select(wnum > rnum ? wnum+1 : rnum+1, + rnum != -1 ? &rfds : NULL, + wnum != -1 ? &wfds : NULL, + NULL, NULL); + + // Handle the listening sockets + sp = servers; + while (active > 0 && sp != NULL) + { + if (FD_ISSET(sp->sd, &rfds)) + { + handlenewconnection(sp->sd, sp->is_ssl); + active--; + } + + sp = sp->next; + } + + // Handle the established sockets + tp = usedconns; + + while (active > 0 && tp != NULL) + { + to = tp; + tp = tp->next; + + if (to->state == STATE_WANT_TO_READ_HEAD) + if (FD_ISSET(to->networkdesc, &rfds)) + { + active--; + procreadhead(to); + } + + if (to->state == STATE_WANT_TO_SEND_HEAD) + if (FD_ISSET(to->networkdesc, &wfds)) + { + active--; + procsendhead(to); + } + + if (to->state == STATE_WANT_TO_READ_FILE) + if (FD_ISSET(to->filedesc, &rfds)) + { + active--; + procreadfile(to); + } + + if (to->state == STATE_WANT_TO_SEND_FILE) + if (FD_ISSET(to->networkdesc, &wfds)) + { + active--; + procsendfile(to); + } + +#if defined(CONFIG_HTTP_DIRECTORIES) + if (to->state == STATE_DOING_DIR) + if (FD_ISSET(to->networkdesc, &wfds)) + { + active--; + procdodir(to); + } +#endif + } + } // MAIN SELECT LOOP +} diff --git a/httpd/proc.c b/httpd/proc.c new file mode 100644 index 0000000000..3eb164f006 --- /dev/null +++ b/httpd/proc.c @@ -0,0 +1,780 @@ +/* + * Copyright(C) 2006 Cameron Rich + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include "axhttp.h" + +static int special_read(struct connstruct *cn, void *buf, size_t count); +static void send301(struct connstruct *cn); +static void send404(struct connstruct *cn); +static int procindex(struct connstruct *cn, struct stat *stp); +static int hexit(char c); +static void urlencode(unsigned char *s, unsigned char *t); +static void urldecode(char *buf); + +#if defined(CONFIG_HTTP_HAS_CGI) +static void proccgi(struct connstruct *cn, int has_pathinfo); +#endif + +// Returns 1 if elems should continue being read, 0 otherwise +int procheadelem(struct connstruct *cn, char *buf) +{ + char *delim, *value; +#if defined(CONFIG_HTTP_HAS_CGI) + char *cgi_delim; +#endif + + if ((delim = strchr(buf, ' ')) == NULL) + return 0; + + *delim = 0; + value = delim+1; + + if (strcmp(buf, "GET")==0 || + strcmp(buf, "HEAD")==0 || + strcmp(buf, "POST")==0) + { + if (buf[0] == 'H') + cn->reqtype = TYPE_HEAD; + else if (buf[0] == 'P') + cn->reqtype = TYPE_POST; + + if ((delim = strchr(value, ' ')) == NULL) /* expect HTTP type */ + return 0; + *delim = 0; + + urldecode(value); + + if (sanitizefile(value) == 0) + { + send404(cn); + removeconnection(cn); + return 0; + } + + my_strncpy(cn->filereq, value, MAXREQUESTLENGTH); +#if defined(CONFIG_HTTP_HAS_CGI) + if ((cgi_delim = strchr(value, '?'))) + { + *cgi_delim = 0; + my_strncpy(cn->cgiargs, value+1, MAXREQUESTLENGTH); + } +#endif + + } + else if (strcmp(buf, "Host:")==0) + { + if (sanitizehost(value) == 0) + { + send404(cn); + removeconnection(cn); + return 0; + } + + my_strncpy(cn->virtualhostreq, value, MAXREQUESTLENGTH); + } + else if (strcmp(buf, "Connection:")==0 && + strcmp(value, "close")==0) { + cn->close_when_done = 1; + } + else if (strcmp(buf, "If-Modified-Since:") ==0 ) + { + /* TODO: parse this date properly with getdate() or similar */ + cn->modified_since = 1; + } + + return 1; +} + +#if defined(CONFIG_HTTP_DIRECTORIES) +void procdirlisting(struct connstruct *cn) +{ + char buf[MAXREQUESTLENGTH]; + char actualfile[1024]; + +#ifndef CONFIG_HTTP_DIRECTORIES + if (allowdirectorylisting == 0) + { + send404(cn); + removeconnection(cn); + return; + } +#endif + + if (cn->reqtype == TYPE_HEAD) + { + snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n"); + write(cn->networkdesc, buf, strlen(buf)); + + removeconnection(cn); + return; + } + + strcpy(actualfile, cn->actualfile); +#ifdef WIN32 + strcat(actualfile, "*"); + cn->dirp = FindFirstFile(actualfile, &cn->file_data); + if (cn->dirp == INVALID_HANDLE_VALUE) + { + send404(cn); + removeconnection(cn); + return; + } +#else + + cn->dirp = opendir(actualfile); + + if (cn->dirp == NULL) + { + send404(cn); + removeconnection(cn); + return; + } + + // Get rid of the "." + readdir(cn->dirp); +#endif + + sprintf(buf, "HTTP/1.1 200 OK\nContent-Type: text/html\n\n\nDirectory Listing\n

    Directory listing of %s://%s%s


    \n", cn->is_ssl ? "https" : "http", cn->virtualhostreq, cn->filereq); + special_write(cn, buf, strlen(buf)); + cn->state = STATE_DOING_DIR; +} + +void procdodir(struct connstruct *cn) +{ +#ifndef WIN32 + struct dirent *dp; +#endif + char buf[MAXREQUESTLENGTH]; + char encbuf[1024]; + int putslash; + char *file; + + do + { +#ifdef WIN32 + if (!FindNextFile(cn->dirp, &cn->file_data)) +#else + if ((dp = readdir(cn->dirp)) == NULL) +#endif + { + snprintf(buf, sizeof(buf), "\n"); + special_write(cn, buf, strlen(buf)); + removeconnection(cn); + return; + } + +#ifdef WIN32 + file = cn->file_data.cFileName; +#else + file = dp->d_name; +#endif + + if (cn->filereq[0] == '/' && cn->filereq[1] == '\0' && + strcmp(file, "..") == 0) continue; + + snprintf(buf, sizeof(buf), "%s%s", cn->actualfile, file); + putslash = isdir(buf); + + urlencode(file, encbuf); + snprintf(buf, sizeof(buf), "%s%s
    \n", + encbuf, putslash ? "/" : "", file, putslash ? "/" : ""); + special_write(cn, buf, strlen(buf)); + + } + while (issockwriteable(cn->networkdesc)); +} +#endif + +void procreadhead(struct connstruct *cn) +{ + char buf[MAXREQUESTLENGTH*4], *tp, *next; + int rv; + + rv = special_read(cn, buf, sizeof(buf)-1); + if (rv <= 0) { + if (rv < 0) + removeconnection(cn); + return; + } + + buf[rv] = '\0'; + + next = tp = buf; + + // Split up lines and send to procheadelem() + while(*next != '\0') + { + // If we have a blank line, advance to next stage! + if (*next == '\r' || *next == '\n') + { + buildactualfile(cn); + + cn->state = STATE_WANT_TO_SEND_HEAD; + return; + } + + while(*next != '\r' && *next != '\n' && *next != '\0') + next++; + + if (*next == '\r') + { + *next = '\0'; + next+=2; + } + else if (*next == '\n') + *next++ = '\0'; + + if (procheadelem(cn, tp) == 0) + return; + + tp = next; + } +} + +/* In this function we assume that the file has been checked for + * maliciousness (".."s, etc) and has been decoded + */ +void procsendhead(struct connstruct *cn) +{ + char buf[1024]; + char actualfile[1024]; + struct stat stbuf; + time_t now = cn->timeout - CONFIG_HTTP_TIMEOUT; + char date[32]; + strcpy(date, ctime(&now)); + + strcpy(actualfile, cn->actualfile); + +#ifdef WIN32 + /* stat() under win32 can't deal with trail slash */ + if (actualfile[strlen(actualfile)-1] == '\\') + actualfile[strlen(actualfile)-1] = 0; +#endif + + if (stat(actualfile, &stbuf) == -1) + { +#if defined(CONFIG_HTTP_HAS_CGI) + if (trycgi_withpathinfo(cn) == 0) + { // We Try To Find A CGI + proccgi(cn,1); + return; + } +#endif + + send404(cn); + removeconnection(cn); + return; + } + +#if defined(CONFIG_HTTP_HAS_CGI) + if (iscgi(cn->actualfile)) + { +#ifndef WIN32 + // Set up CGI script + if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) + { + send404(cn); + removeconnection(cn); + return; + } +#endif + + proccgi(cn,0); + return; + } +#endif + + if ((stbuf.st_mode & S_IFMT) == S_IFDIR) + { + if (cn->filereq[strlen(cn->filereq)-1] != '/') + { + send301(cn); + removeconnection(cn); + return; + } + + // Check to see if this dir has an index file + if (procindex(cn, &stbuf) == 0) + { +#if defined(CONFIG_HTTP_DIRECTORIES) + // If not, we do a directory listing of it + procdirlisting(cn); +#else + send404(cn); + removeconnection(cn); +#endif + return; + } + +#if defined(CONFIG_HTTP_HAS_CGI) + // If the index is a CGI file, handle it like any other CGI + if (iscgi(cn->actualfile)) + { + // Set up CGI script + if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) + { + send404(cn); + removeconnection(cn); + return; + } + + proccgi(cn,0); + return; + } +#endif + // If the index isn't a CGI, we continue on with the index file + } + + if ((stbuf.st_mode & S_IFMT) == S_IFDIR) + { + if (cn->filereq[strlen(cn->filereq)-1] != '/') + { + send301(cn); + removeconnection(cn); + return; + } + + // Check to see if this dir has an index file + if (procindex(cn, &stbuf) == 0) + { +#if defined(CONFIG_HTTP_DIRECTORIES) + // If not, we do a directory listing of it + procdirlisting(cn); +#endif + return; + } + +#if defined(CONFIG_HTTP_HAS_CGI) + // If the index is a CGI file, handle it like any other CGI + if (iscgi(cn->actualfile)) + { + // Set up CGI script + if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) + { + send404(cn); + removeconnection(cn); + return; + } + + proccgi(cn,0); + return; + } +#endif + // If the index isn't a CGI, we continue on with the index file + } + + if (cn->modified_since) + { + snprintf(buf, sizeof(buf), "HTTP/1.1 304 Not Modified\nServer: axhttpd V%s\nDate: %s\n", VERSION, date); + special_write(cn, buf, strlen(buf)); + cn->modified_since = 0; + cn->state = STATE_WANT_TO_READ_HEAD; + return; + } + else + { +#ifdef CONFIG_HTTP_VERBOSE + printf("axhttpd: %s send %s\n", + cn->is_ssl ? "https" : "http", cn->actualfile); + TTY_FLUSH(); +#endif + + snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: axhttpd V%s\nContent-Type: %s\nContent-Length: %ld\nDate: %sLast-Modified: %s\n", + VERSION, + getmimetype(cn->actualfile), + (long) stbuf.st_size, + date, + ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end + } + + special_write(cn, buf, strlen(buf)); + + if (cn->reqtype == TYPE_HEAD) + { + removeconnection(cn); + return; + } + else + { + int flags = O_RDONLY; +#if defined(WIN32) || defined(CYGWIN) + flags |= O_BINARY; +#endif + + cn->filedesc = open(cn->actualfile, flags); + if (cn->filedesc == -1) + { + send404(cn); + removeconnection(cn); + return; + } + +#ifdef WIN32 + for (;;) + { + procreadfile(cn); + if (cn->filedesc == -1) + break; + + do + { + procsendfile(cn); + } while (cn->state != STATE_WANT_TO_READ_FILE); + } +#else + cn->state = STATE_WANT_TO_READ_FILE; +#endif + return; + } +} + +void procreadfile(struct connstruct *cn) +{ + int rv = read(cn->filedesc, cn->databuf, BLOCKSIZE); + + if (rv == 0 || rv == -1) + { + close(cn->filedesc); + cn->filedesc = -1; + if (cn->close_when_done) /* close immediately */ + removeconnection(cn); + else + { /* keep socket open - HTTP 1.1 */ + cn->state = STATE_WANT_TO_READ_HEAD; + cn->numbytes = 0; + } + + return; + } + + cn->numbytes = rv; + cn->state = STATE_WANT_TO_SEND_FILE; +} + +void procsendfile(struct connstruct *cn) +{ + int rv = special_write(cn, cn->databuf, cn->numbytes); + + if (rv < 0) + removeconnection(cn); + else if (rv == cn->numbytes) + cn->state = STATE_WANT_TO_READ_FILE; + else if (rv == 0) + { /* Do nothing */ } + else + { + memmove(cn->databuf, cn->databuf + rv, cn->numbytes - rv); + cn->numbytes -= rv; + } +} + +int special_write(struct connstruct *cn, const uint8_t *buf, size_t count) +{ + int res; + + if (cn->is_ssl) + { + SSL *ssl = ssl_find(servers->ssl_ctx, cn->networkdesc); + if (ssl) + { + res = ssl_write(ssl, (unsigned char *)buf, count); + } + else + return -1; + } + else + res = SOCKET_WRITE(cn->networkdesc, buf, count); + + return res; +} + +static int special_read(struct connstruct *cn, void *buf, size_t count) +{ + int res; + + if (cn->is_ssl) + { + SSL *ssl = ssl_find(servers->ssl_ctx, cn->networkdesc); + unsigned char *read_buf; + + if ((res = ssl_read(ssl, &read_buf)) > SSL_OK) + memcpy(buf, read_buf, res > (int)count ? count : res); + } + else + res = SOCKET_READ(cn->networkdesc, buf, count); + + return res; +} + +static void send301(struct connstruct *cn) +{ + char buf[2048]; + sprintf(buf, "HTTP/1.1 301 Moved Permanently\nLocation: %s/\n\n\n\n301 Moved Permanently\n\n

    Moved Permanently

    \nThe document has moved here.

    \n

    \n\n", cn->filereq, cn->filereq); + special_write(cn, buf, strlen(buf)); +} + +static void send404(struct connstruct *cn) +{ + char buf[1024]; + sprintf(buf, "HTTP/1.0 404 Not Found\nContent-Type: text/html\n\n\n404 Not Found

    It ain't there my friend. (404 Not Found)

    \n\n"); + special_write(cn, buf, strlen(buf)); +} + +// Returns 0 if no index was found and doesn't modify cn->actualfile +// Returns 1 if an index was found and puts the index in cn->actualfile +// and puts its stat info into stp +static int procindex(struct connstruct *cn, struct stat *stp) +{ + char tbuf[MAXREQUESTLENGTH]; + struct indexstruct *tp; + + tp = indexlist; + + while(tp != NULL) { + sprintf(tbuf, "%s%s%s", cn->actualfile, +#ifdef WIN32 + "\\", +#else + "/", +#endif + tp->name); + + if (stat(tbuf, stp) != -1) + { + my_strncpy(cn->actualfile, tbuf, MAXREQUESTLENGTH); + return 1; + } + + tp = tp->next; + } + + return 0; +} + +#if defined(CONFIG_HTTP_HAS_CGI) +static void proccgi(struct connstruct *cn, int has_pathinfo) +{ + int tpipe[2]; + char *myargs[5]; + char buf[MAXREQUESTLENGTH]; +#ifdef WIN32 + int tmp_stdout; +#else + int fv; +#endif + + snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: axhttpd V%s\n%s", + VERSION, (cn->reqtype == TYPE_HEAD) ? "\n" : ""); + special_write(cn, buf, strlen(buf)); + + if (cn->reqtype == TYPE_HEAD) + { + removeconnection(cn); + return; + } + +#ifndef WIN32 + if (pipe(tpipe) == -1) + { + removeconnection(cn); + return; + } + + fv = fork(); + + if (fv == -1) + { + close(tpipe[0]); + close(tpipe[1]); + removeconnection(cn); + return; + } + + if (fv != 0) + { + // Close the write descriptor + close(tpipe[1]); + cn->filedesc = tpipe[0]; + cn->state = STATE_WANT_TO_READ_FILE; + return; + } + + // The problem child... + + // Our stdout/stderr goes to the socket + dup2(tpipe[1], 1); + dup2(tpipe[1], 2); + + // If it was a POST request, send the socket data to our stdin + if (cn->reqtype == TYPE_POST) + dup2(cn->networkdesc, 0); + else // Otherwise we can shutdown the read side of the sock + shutdown(cn->networkdesc, 0); + + close(tpipe[0]); + close(tpipe[1]); + + myargs[0] = cn->actualfile; + myargs[1] = cn->cgiargs; + myargs[2] = NULL; + + if (!has_pathinfo) + { + my_strncpy(cn->cgipathinfo, "/", MAXREQUESTLENGTH); + my_strncpy(cn->cgiscriptinfo, cn->filereq, MAXREQUESTLENGTH); + } + + execv(cn->actualfile, myargs); +#else /* WIN32 */ + if (_pipe(tpipe, 4096, O_BINARY| O_NOINHERIT) == -1) + { + removeconnection(cn); + return; + } + + myargs[0] = "sh"; + myargs[1] = "-c"; + myargs[2] = cn->actualfile; + myargs[3] = cn->cgiargs; + myargs[4] = NULL; + + /* convert all the forward slashes to back slashes */ + { + char *t = myargs[2]; + while ((t = strchr(t, '\\'))) + { + *t++ = '/'; + } + } + + tmp_stdout = _dup(_fileno(stdout)); + _dup2(tpipe[1], _fileno(stdout)); + close(tpipe[1]); + + /* change to suit execution method */ + if (spawnl(P_NOWAIT, "c:\\Program Files\\cygwin\\bin\\sh.exe", + myargs[0], myargs[1], myargs[2], myargs[3], myargs[4]) == -1) + { + removeconnection(cn); + return; + } + + _dup2(tmp_stdout, _fileno(stdout)); + close(tmp_stdout); + cn->filedesc = tpipe[0]; + cn->state = STATE_WANT_TO_READ_FILE; + + for (;;) + { + procreadfile(cn); + + if (cn->filedesc == -1) + break; + + procsendfile(cn); + usleep(200000); /* don't know why this delay makes it work (yet) */ + } +#endif +} +#endif /* CONFIG_HTTP_HAS_CGI */ + +/* Encode funny chars -> %xx in newly allocated storage */ +/* (preserves '/' !) */ +static void urlencode(unsigned char *s, unsigned char *t) +{ + uint8_t *p, *tp; + + tp =t ; + + for (p=s; *p; p++) + { + if ((*p > 0x00 && *p < ',') || + (*p > '9' && *p < 'A') || + (*p > 'Z' && *p < '_') || + (*p > '_' && *p < 'a') || + (*p > 'z' && *p < 0xA1)) { + sprintf((char *)tp, "%%%02X", *p); + tp += 3; + } + else + { + *tp = *p; + tp++; + } + } + + *tp='\0'; +} + +/* Decode string %xx -> char (in place) */ +static void urldecode(char *buf) +{ + int v; + char *p, *s, *w; + + w = p = buf; + + while (*p) + { + v = 0; + + if (*p=='%') + { + s = p; + s++; + + if (isxdigit((int) s[0]) && isxdigit((int) s[1])) + { + v = hexit(s[0])*16+hexit(s[1]); + if (v) + { /* do not decode %00 to null char */ + *w=(char)v; + p=&s[1]; + } + } + + } + + if (!v) + *w=*p; + p++; w++; + } + + *w='\0'; +} + +static int hexit(char c) +{ + if ( c >= '0' && c <= '9' ) + return c - '0'; + if ( c >= 'a' && c <= 'f' ) + return c - 'a' + 10; + if ( c >= 'A' && c <= 'F' ) + return c - 'A' + 10; + + return 0; +} + diff --git a/httpd/socket.c b/httpd/socket.c new file mode 100644 index 0000000000..e7faa78e8b --- /dev/null +++ b/httpd/socket.c @@ -0,0 +1,129 @@ +/* + * Copyright(C) 2006 Cameron Rich + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#include +#include +#include +#include "axhttp.h" + +#ifdef HAVE_IPV6 + +void handlenewconnection(int listenfd, int is_ssl) +{ + struct sockaddr_in6 their_addr; + int tp = sizeof(their_addr); + char ipbuf[100]; + int connfd = accept(listenfd, (struct sockaddr *)&their_addr, &tp); + + if (connfd == -1) + return; + + if (tp == sizeof(struct sockaddr_in6)) + { + inet_ntop(AF_INET6, &their_addr.sin6_addr, ipbuf, sizeof(ipbuf)); + } + else if (tp == sizeof(struct sockaddr_in)) + { + inet_ntop(AF_INET, &(((struct sockaddr_in *)&their_addr)->sin_addr), + ipbuf, sizeof(ipbuf)); + } + else + { + *ipbuf = '\0'; + } + + addconnection(connfd, ipbuf, is_ssl); +} + +#else +void handlenewconnection(int listenfd, int is_ssl) +{ + struct sockaddr_in their_addr; + int tp = sizeof(struct sockaddr_in); + int connfd = accept(listenfd, (struct sockaddr *)&their_addr, &tp); + + if (connfd == -1) + return; + + addconnection(connfd, inet_ntoa(their_addr.sin_addr), is_ssl); +} +#endif + +int openlistener(int port) +{ + int sd; +#ifdef WIN32 + char tp=1; +#else + int tp=1; +#endif + struct sockaddr_in my_addr; + + if ((sd = socket(AF_INET, SOCK_STREAM, 0)) == -1) + return -1; + + setsockopt(sd, SOL_SOCKET, SO_REUSEADDR, &tp, sizeof(tp)); + my_addr.sin_family = AF_INET; // host byte order + my_addr.sin_port = htons((short)port); // short, network byte order + my_addr.sin_addr.s_addr = INADDR_ANY; // automatically fill with my IP + memset(&(my_addr.sin_zero), 0, 8); // zero the rest of the struct + + if (bind(sd, (struct sockaddr *)&my_addr, sizeof(struct sockaddr)) == -1) + { + close(sd); + return -1; + } + + if (listen(sd, BACKLOG) == -1) + { + close(sd); + return -1; + } + + return sd; +} + +#ifdef HAVE_IPV6 +int openlistener6(int port) +{ + int sd,tp; + struct sockaddr_in6 my_addr; + + if ((sd = socket(AF_INET6, SOCK_STREAM, 0)) == -1) + return -1; + + setsockopt(sd, SOL_SOCKET, SO_REUSEADDR, &tp, sizeof(tp)); + memset(&my_addr, 0, sizeof(my_addr)); + my_addr.sin6_family = AF_INET6; + my_addr.sin6_port = htons(port); + + if (bind(sd, (struct sockaddr *)&my_addr, sizeof(my_addr)) == -1) + { + close(sd); + return -1; + } + + if (listen(sd, BACKLOG) == -1) + { + close(sd); + return -1; + } + + return sd; +} +#endif From dabdec8fcc63694450e704b9cfb59886f75a06f3 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 6 Dec 2006 02:20:00 +0000 Subject: [PATCH 042/301] added mime option to axhttpd. Improved cygwin library build git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@52 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 7 +- config/linuxconfig | 1 + config/win32config | 1 + httpd/Config.in | 11 ++ httpd/Makefile | 14 +-- httpd/axhttp.h | 18 +-- httpd/main.c | 266 ++++++++++++++++++++++++++++++++++++++++++++- httpd/mime_types.c | 18 +-- httpd/net.c | 176 ------------------------------ httpd/proc.c | 89 +++++++-------- httpd/socket.c | 129 ---------------------- ssl/Makefile | 13 ++- 12 files changed, 357 insertions(+), 386 deletions(-) delete mode 100644 httpd/net.c delete mode 100644 httpd/socket.c diff --git a/Makefile b/Makefile index f4c2c86e8b..03a220e5fc 100644 --- a/Makefile +++ b/Makefile @@ -69,9 +69,10 @@ win32_demo: install: $(PREFIX) all cp --no-dereference $(STAGE)/libax* $(PREFIX)/lib chmod 755 $(PREFIX)/lib/libax* - -@install -m 755 $(STAGE)/ax* $(PREFIX)/bin > /dev/null 2>&1 - -@install -m 755 $(STAGE)/axtlsp.pm `perl -e 'use Config; print $$Config{installarchlib};'` > /dev/null 2>&1 - -@install -m 755 $(STAGE)/axhttpd* $(PREFIX)/bin > /dev/null 2>&1 + -install -m 755 $(STAGE)/ax* $(PREFIX)/bin > /dev/null 2>&1 +ifdef CONFIG_PERL_BINDINGS + -install -m 755 $(STAGE)/axtlsp.pm `perl -e 'use Config; print $$Config{installarchlib};'` > /dev/null 2>&1 +endif installclean: -@rm $(PREFIX)/lib/libax* > /dev/null 2>&1 diff --git a/config/linuxconfig b/config/linuxconfig index 44e5226ea8..00aaa90812 100644 --- a/config/linuxconfig +++ b/config/linuxconfig @@ -55,6 +55,7 @@ CONFIG_HTTP_CGI_EXTENSION="" # CONFIG_HTTP_DIRECTORIES is not set # CONFIG_HTTP_PERM_CHECK is not set # CONFIG_HTTP_HAS_IPV6 is not set +CONFIG_HTTP_ALL_MIME_TYPES=y # CONFIG_HTTP_VERBOSE is not set # CONFIG_HTTP_IS_DAEMON is not set diff --git a/config/win32config b/config/win32config index ed7efe96f4..a275fd2fb4 100644 --- a/config/win32config +++ b/config/win32config @@ -62,6 +62,7 @@ CONFIG_HTTP_CGI_EXTENSION="" CONFIG_HTTP_DIRECTORIES=y # CONFIG_HTTP_PERM_CHECK is not set # CONFIG_HTTP_HAS_IPV6 is not set +CONFIG_HTTP_ALL_MIME_TYPES=y CONFIG_HTTP_VERBOSE=y # CONFIG_HTTP_IS_DAEMON is not set diff --git a/httpd/Config.in b/httpd/Config.in index f720e4eea1..8d1000e026 100644 --- a/httpd/Config.in +++ b/httpd/Config.in @@ -88,6 +88,17 @@ config CONFIG_HTTP_HAS_IPV6 Does not work under Win32 +config CONFIG_HTTP_ALL_MIME_TYPES + bool "Use all mime types" + default y if CONFIG_SSL_FULL_MODE + default n if !CONFIG_SSL_FULL_MODE + help + Use the full list of supported mime types. + + Use this option if a "generic" webserver is used. However if it is + using only web pages (html, jpg, gif, png, css) then select this + option. + config CONFIG_HTTP_VERBOSE bool "Verbose Mode" default y if CONFIG_SSL_FULL_MODE diff --git a/httpd/Makefile b/httpd/Makefile index b676c8f9e4..1b57b3c803 100644 --- a/httpd/Makefile +++ b/httpd/Makefile @@ -47,7 +47,7 @@ LIBS=../$(STAGE)/axtls.lib ..\\config\\axtls.res endif endif -ifndef CONFIG_AWHTTPD +ifndef CONFIG_AXHTTPD web_server: else @@ -56,18 +56,13 @@ web_server : $(TARGET) OBJ= \ conn.o \ main.o \ - net.o \ proc.o \ - socket.o \ misc.o \ mime_types.o ifndef CONFIG_PLATFORM_WIN32 -$(TARGET): $(OBJ) -ifdef CONFIG_HTTP_NO_SSL - $(LD) $(LDFLAGS) -o $@ $(OBJ) -endif +$(TARGET): $(OBJ) ../$(STAGE)/libaxtls.a $(LD) $(LDFLAGS) -o $@ $(OBJ) $(LIBS) ifndef CONFIG_DEBUG ifndef CONFIG_PLATFORM_SOLARIS @@ -77,13 +72,10 @@ endif else # Win32 $(TARGET): $(OBJ) -ifdef CONFIG_HTTP_NO_SSL - $(LD) $(LDFLAGS) /out:$@ $(OBJ) -endif $(LD) $(LDFLAGS) $(LIBS) /out:$@ $(OBJ) endif -endif # CONFIG_AWHTTPD +endif # CONFIG_AXHTTPD clean:: -@rm -f $(TARGET)* diff --git a/httpd/axhttp.h b/httpd/axhttp.h index 7af635a715..d4e62f6166 100644 --- a/httpd/axhttp.h +++ b/httpd/axhttp.h @@ -20,7 +20,7 @@ #include "ssl.h" #define BACKLOG 15 -#define VERSION "3.0.7" +#define VERSION "1.0.0" #ifdef CONFIG_HTTP_HAS_IPV6 #define HAVE_IPV6 #endif @@ -47,10 +47,8 @@ struct connstruct { struct connstruct *next; - int state; int reqtype; - int networkdesc; int filedesc; @@ -73,7 +71,6 @@ struct connstruct char cgipathinfo[MAXREQUESTLENGTH]; #endif char virtualhostreq[MAXREQUESTLENGTH]; - int numbytes; char databuf[BLOCKSIZE]; @@ -90,11 +87,13 @@ struct serverstruct SSLCTX *ssl_ctx; }; +#if defined(CONFIG_HTTP_HAS_CGI) struct cgiextstruct { struct cgiextstruct *next; char *ext; }; +#endif struct indexstruct { @@ -106,7 +105,9 @@ struct indexstruct extern struct serverstruct *servers; extern struct connstruct *usedconns; extern struct connstruct *freeconns; +#if defined(CONFIG_HTTP_HAS_CGI) extern struct cgiextstruct *cgiexts; +#endif extern struct indexstruct *indexlist; // Conf global prototypes @@ -129,15 +130,6 @@ void procreadfile(struct connstruct *cn); void procsendfile(struct connstruct *cn); int special_write(struct connstruct *cn, const uint8_t *buf, size_t count); -// net.c prototypes -void addtoservers(int sd); -void selectloop(void); - -// socket.c prototypes -void handlenewconnection(int listenfd, int is_ssl); -int openlistener(int port); -int openlistener6(int port); - // misc.c prototypes void nada(int sigtype); void die(int sigtype); diff --git a/httpd/main.c b/httpd/main.c index d3e5e1aed8..8254d3c540 100644 --- a/httpd/main.c +++ b/httpd/main.c @@ -33,7 +33,12 @@ struct cgiextstruct *cgiexts; struct indexstruct *indexlist; char *webroot = CONFIG_HTTP_WEBROOT; + static void addindex(char *tp); +static void addtoservers(int sd); +static void selectloop(void); +static int openlistener(int port); +static void handlenewconnection(int listenfd, int is_ssl); #if defined(CONFIG_HTTP_PERM_CHECK) static void procpermcheck(char *pathtocheck); #endif @@ -123,7 +128,7 @@ int main(int argc, char *argv[]) exit(1); } - if ((tp=openlistener(CONFIG_HTTP_PORT)) == -1) + if ((tp = openlistener(CONFIG_HTTP_PORT)) == -1) { #ifdef CONFIG_HTTP_VERBOSE fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", @@ -143,7 +148,7 @@ int main(int argc, char *argv[]) } #endif - if ((tp=openlistener(CONFIG_HTTP_HTTPS_PORT)) == -1) + if ((tp = openlistener(CONFIG_HTTP_HTTPS_PORT)) == -1) { #ifdef CONFIG_HTTP_VERBOSE fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", @@ -321,3 +326,260 @@ static void addcgiext(char *tp) } #endif +static void addtoservers(int sd) +{ + struct serverstruct *tp = (struct serverstruct *) + calloc(1, sizeof(struct serverstruct)); + tp->next = servers; + tp->sd = sd; + servers = tp; +} + +static void selectloop(void) +{ + fd_set rfds, wfds; + struct connstruct *tp, *to; + struct serverstruct *sp; + int rnum, wnum, active; + int currtime; + + while (1) + { + // MAIN SELECT LOOP + FD_ZERO(&rfds); + FD_ZERO(&wfds); + rnum = wnum = -1; + + // Add the listening sockets + sp = servers; + while (sp != NULL) + { + FD_SET(sp->sd, &rfds); + if (sp->sd > rnum) rnum = sp->sd; + sp = sp->next; + } + + // Add the established sockets + tp = usedconns; + currtime = time(NULL); + + while (tp != NULL) + { + if (currtime > tp->timeout) + { + to = tp; + tp = tp->next; + removeconnection(to); + continue; + } + + if (tp->state == STATE_WANT_TO_READ_HEAD) + { + FD_SET(tp->networkdesc, &rfds); + if (tp->networkdesc > rnum) + rnum = tp->networkdesc; + } + + if (tp->state == STATE_WANT_TO_SEND_HEAD) + { + FD_SET(tp->networkdesc, &wfds); + if (tp->networkdesc > wnum) + wnum = tp->networkdesc; + } + + if (tp->state == STATE_WANT_TO_READ_FILE) + { + FD_SET(tp->filedesc, &rfds); + if (tp->filedesc > rnum) + rnum = tp->filedesc; + } + + if (tp->state == STATE_WANT_TO_SEND_FILE) + { + FD_SET(tp->networkdesc, &wfds); + if (tp->networkdesc > wnum) + wnum = tp->networkdesc; + } + +#if defined(CONFIG_HTTP_DIRECTORIES) + if (tp->state == STATE_DOING_DIR) + { + FD_SET(tp->networkdesc, &wfds); + if (tp->networkdesc > wnum) + wnum = tp->networkdesc; + } +#endif + tp = tp->next; + } + + active = select(wnum > rnum ? wnum+1 : rnum+1, + rnum != -1 ? &rfds : NULL, + wnum != -1 ? &wfds : NULL, + NULL, NULL); + + // Handle the listening sockets + sp = servers; + while (active > 0 && sp != NULL) + { + if (FD_ISSET(sp->sd, &rfds)) + { + handlenewconnection(sp->sd, sp->is_ssl); + active--; + } + + sp = sp->next; + } + + // Handle the established sockets + tp = usedconns; + + while (active > 0 && tp != NULL) + { + to = tp; + tp = tp->next; + + if (to->state == STATE_WANT_TO_READ_HEAD) + if (FD_ISSET(to->networkdesc, &rfds)) + { + active--; + procreadhead(to); + } + + if (to->state == STATE_WANT_TO_SEND_HEAD) + if (FD_ISSET(to->networkdesc, &wfds)) + { + active--; + procsendhead(to); + } + + if (to->state == STATE_WANT_TO_READ_FILE) + if (FD_ISSET(to->filedesc, &rfds)) + { + active--; + procreadfile(to); + } + + if (to->state == STATE_WANT_TO_SEND_FILE) + if (FD_ISSET(to->networkdesc, &wfds)) + { + active--; + procsendfile(to); + } + +#if defined(CONFIG_HTTP_DIRECTORIES) + if (to->state == STATE_DOING_DIR) + if (FD_ISSET(to->networkdesc, &wfds)) + { + active--; + procdodir(to); + } +#endif + } + } // MAIN SELECT LOOP +} + +#ifdef HAVE_IPV6 +static void handlenewconnection(int listenfd, int is_ssl) +{ + struct sockaddr_in6 their_addr; + int tp = sizeof(their_addr); + char ipbuf[100]; + int connfd = accept(listenfd, (struct sockaddr *)&their_addr, &tp); + + if (connfd == -1) + return; + + if (tp == sizeof(struct sockaddr_in6)) + { + inet_ntop(AF_INET6, &their_addr.sin6_addr, ipbuf, sizeof(ipbuf)); + } + else if (tp == sizeof(struct sockaddr_in)) + { + inet_ntop(AF_INET, &(((struct sockaddr_in *)&their_addr)->sin_addr), + ipbuf, sizeof(ipbuf)); + } + else + { + *ipbuf = '\0'; + } + + addconnection(connfd, ipbuf, is_ssl); +} + +#else +static void handlenewconnection(int listenfd, int is_ssl) +{ + struct sockaddr_in their_addr; + int tp = sizeof(struct sockaddr_in); + int connfd = accept(listenfd, (struct sockaddr *)&their_addr, &tp); + + if (connfd == -1) + return; + + addconnection(connfd, inet_ntoa(their_addr.sin_addr), is_ssl); +} +#endif + +static int openlistener(int port) +{ + int sd; +#ifdef WIN32 + char tp=1; +#else + int tp=1; +#endif + struct sockaddr_in my_addr; + + if ((sd = socket(AF_INET, SOCK_STREAM, 0)) == -1) + return -1; + + setsockopt(sd, SOL_SOCKET, SO_REUSEADDR, &tp, sizeof(tp)); + my_addr.sin_family = AF_INET; // host byte order + my_addr.sin_port = htons((short)port); // short, network byte order + my_addr.sin_addr.s_addr = INADDR_ANY; // automatically fill with my IP + memset(&(my_addr.sin_zero), 0, 8); // zero the rest of the struct + + if (bind(sd, (struct sockaddr *)&my_addr, sizeof(struct sockaddr)) == -1) + { + close(sd); + return -1; + } + + if (listen(sd, BACKLOG) == -1) + { + close(sd); + return -1; + } + + return sd; +} + +#ifdef HAVE_IPV6 +static int openlistener6(int port) +{ + int sd,tp; + struct sockaddr_in6 my_addr; + + if ((sd = socket(AF_INET6, SOCK_STREAM, 0)) == -1) + return -1; + + setsockopt(sd, SOL_SOCKET, SO_REUSEADDR, &tp, sizeof(tp)); + memset(&my_addr, 0, sizeof(my_addr)); + my_addr.sin6_family = AF_INET6; + my_addr.sin6_port = htons(port); + + if (bind(sd, (struct sockaddr *)&my_addr, sizeof(my_addr)) == -1) + { + close(sd); + return -1; + } + + if (listen(sd, BACKLOG) == -1) + { + close(sd); + return -1; + } + + return sd; +} +#endif diff --git a/httpd/mime_types.c b/httpd/mime_types.c index 5bc959be4c..f6576f4c57 100644 --- a/httpd/mime_types.c +++ b/httpd/mime_types.c @@ -35,19 +35,23 @@ static mime_table_t mime_table[] = // Fundamentals { ".html", "text/html" }, { ".htm", "text/html" }, - { ".txt", "text/plain" }, + { ".css", "text/css" }, - // Others + // Basic graphics + { ".jpg", "image/jpeg" }, + { ".gif", "image/gif" }, + { ".png", "image/png" }, + +#ifdef CONFIG_HTTP_ALL_MIME_TYPES + // This list is a bit expensive to maintain normally, so it's an option. + { ".txt", "text/plain" }, { ".rtx", "text/richtext" }, { ".etx", "text/x-setext" }, { ".tsv", "text/tab-separated-values" }, - { ".css", "text/css" }, { ".xml", "text/xml" }, { ".dtd", "text/xml" }, - { ".gif", "image/gif" }, - { ".jpg", "image/jpeg" }, - { ".jpeg", "image/jpeg" }, { ".jpe", "image/jpeg" }, + { ".jpeg", "image/jpeg" }, { ".jfif", "image/jpeg" }, { ".tif", "image/tiff" }, { ".tiff", "image/tiff" }, @@ -59,7 +63,6 @@ static mime_table_t mime_table[] = { ".xpm", "image/x-xpixmap" }, { ".xwd", "image/x-xwindowdump" }, { ".ief", "image/ief" }, - { ".png", "image/png" }, { ".au", "audio/basic" }, { ".snd", "audio/basic" }, { ".aif", "audio/x-aiff" }, @@ -159,6 +162,7 @@ static mime_table_t mime_table[] = { ".tar.gz", "application/x-gzip" }, { ".bz2", "application/x-bzip2" }, { ".zip", "application/zip" } +#endif }; static int mime_cmp(const mime_table_t *t1, const mime_table_t *t2) diff --git a/httpd/net.c b/httpd/net.c deleted file mode 100644 index dd325a61d4..0000000000 --- a/httpd/net.c +++ /dev/null @@ -1,176 +0,0 @@ -/* - * Copyright(C) 2006 Cameron Rich - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - */ - -#include -#include -#include -#include -#include -#include "axhttp.h" - -void addtoservers(int sd) -{ - struct serverstruct *tp = (struct serverstruct *) - calloc(1, sizeof(struct serverstruct)); - tp->next = servers; - tp->sd = sd; - servers = tp; -} - -void selectloop() -{ - fd_set rfds, wfds; - struct connstruct *tp, *to; - struct serverstruct *sp; - int rnum, wnum, active; - int currtime; - - while (1) - { - // MAIN SELECT LOOP - FD_ZERO(&rfds); - FD_ZERO(&wfds); - rnum = wnum = -1; - - // Add the listening sockets - sp = servers; - while (sp != NULL) - { - FD_SET(sp->sd, &rfds); - if (sp->sd > rnum) rnum = sp->sd; - sp = sp->next; - } - - // Add the established sockets - tp = usedconns; - currtime = time(NULL); - - while (tp != NULL) - { - if (currtime > tp->timeout) - { - to = tp; - tp = tp->next; - removeconnection(to); - continue; - } - - if (tp->state == STATE_WANT_TO_READ_HEAD) - { - FD_SET(tp->networkdesc, &rfds); - if (tp->networkdesc > rnum) - rnum = tp->networkdesc; - } - - if (tp->state == STATE_WANT_TO_SEND_HEAD) - { - FD_SET(tp->networkdesc, &wfds); - if (tp->networkdesc > wnum) - wnum = tp->networkdesc; - } - - if (tp->state == STATE_WANT_TO_READ_FILE) - { - FD_SET(tp->filedesc, &rfds); - if (tp->filedesc > rnum) - rnum = tp->filedesc; - } - - if (tp->state == STATE_WANT_TO_SEND_FILE) - { - FD_SET(tp->networkdesc, &wfds); - if (tp->networkdesc > wnum) - wnum = tp->networkdesc; - } - -#if defined(CONFIG_HTTP_DIRECTORIES) - if (tp->state == STATE_DOING_DIR) - { - FD_SET(tp->networkdesc, &wfds); - if (tp->networkdesc > wnum) - wnum = tp->networkdesc; - } -#endif - tp = tp->next; - } - - active = select(wnum > rnum ? wnum+1 : rnum+1, - rnum != -1 ? &rfds : NULL, - wnum != -1 ? &wfds : NULL, - NULL, NULL); - - // Handle the listening sockets - sp = servers; - while (active > 0 && sp != NULL) - { - if (FD_ISSET(sp->sd, &rfds)) - { - handlenewconnection(sp->sd, sp->is_ssl); - active--; - } - - sp = sp->next; - } - - // Handle the established sockets - tp = usedconns; - - while (active > 0 && tp != NULL) - { - to = tp; - tp = tp->next; - - if (to->state == STATE_WANT_TO_READ_HEAD) - if (FD_ISSET(to->networkdesc, &rfds)) - { - active--; - procreadhead(to); - } - - if (to->state == STATE_WANT_TO_SEND_HEAD) - if (FD_ISSET(to->networkdesc, &wfds)) - { - active--; - procsendhead(to); - } - - if (to->state == STATE_WANT_TO_READ_FILE) - if (FD_ISSET(to->filedesc, &rfds)) - { - active--; - procreadfile(to); - } - - if (to->state == STATE_WANT_TO_SEND_FILE) - if (FD_ISSET(to->networkdesc, &wfds)) - { - active--; - procsendfile(to); - } - -#if defined(CONFIG_HTTP_DIRECTORIES) - if (to->state == STATE_DOING_DIR) - if (FD_ISSET(to->networkdesc, &wfds)) - { - active--; - procdodir(to); - } -#endif - } - } // MAIN SELECT LOOP -} diff --git a/httpd/proc.c b/httpd/proc.c index 3eb164f006..88c7fbab68 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -31,9 +31,11 @@ static void send301(struct connstruct *cn); static void send404(struct connstruct *cn); static int procindex(struct connstruct *cn, struct stat *stp); static int hexit(char c); -static void urlencode(unsigned char *s, unsigned char *t); static void urldecode(char *buf); +#if defined(CONFIG_HTTP_DIRECTORIES) +static void urlencode(unsigned char *s, unsigned char *t); +#endif #if defined(CONFIG_HTTP_HAS_CGI) static void proccgi(struct connstruct *cn, int has_pathinfo); #endif @@ -206,6 +208,35 @@ void procdodir(struct connstruct *cn) } while (issockwriteable(cn->networkdesc)); } + +/* Encode funny chars -> %xx in newly allocated storage */ +/* (preserves '/' !) */ +static void urlencode(unsigned char *s, unsigned char *t) +{ + uint8_t *p, *tp; + + tp =t ; + + for (p=s; *p; p++) + { + if ((*p > 0x00 && *p < ',') || + (*p > '9' && *p < 'A') || + (*p > 'Z' && *p < '_') || + (*p > '_' && *p < 'a') || + (*p > 'z' && *p < 0xA1)) { + sprintf((char *)tp, "%%%02X", *p); + tp += 3; + } + else + { + *tp = *p; + tp++; + } + } + + *tp='\0'; +} + #endif void procreadhead(struct connstruct *cn) @@ -529,20 +560,6 @@ static int special_read(struct connstruct *cn, void *buf, size_t count) return res; } -static void send301(struct connstruct *cn) -{ - char buf[2048]; - sprintf(buf, "HTTP/1.1 301 Moved Permanently\nLocation: %s/\n\n\n\n301 Moved Permanently\n\n

    Moved Permanently

    \nThe document has moved here.

    \n

    \n\n", cn->filereq, cn->filereq); - special_write(cn, buf, strlen(buf)); -} - -static void send404(struct connstruct *cn) -{ - char buf[1024]; - sprintf(buf, "HTTP/1.0 404 Not Found\nContent-Type: text/html\n\n\n404 Not Found

    It ain't there my friend. (404 Not Found)

    \n\n"); - special_write(cn, buf, strlen(buf)); -} - // Returns 0 if no index was found and doesn't modify cn->actualfile // Returns 1 if an index was found and puts the index in cn->actualfile // and puts its stat info into stp @@ -701,34 +718,6 @@ static void proccgi(struct connstruct *cn, int has_pathinfo) } #endif /* CONFIG_HTTP_HAS_CGI */ -/* Encode funny chars -> %xx in newly allocated storage */ -/* (preserves '/' !) */ -static void urlencode(unsigned char *s, unsigned char *t) -{ - uint8_t *p, *tp; - - tp =t ; - - for (p=s; *p; p++) - { - if ((*p > 0x00 && *p < ',') || - (*p > '9' && *p < 'A') || - (*p > 'Z' && *p < '_') || - (*p > '_' && *p < 'a') || - (*p > 'z' && *p < 0xA1)) { - sprintf((char *)tp, "%%%02X", *p); - tp += 3; - } - else - { - *tp = *p; - tp++; - } - } - - *tp='\0'; -} - /* Decode string %xx -> char (in place) */ static void urldecode(char *buf) { @@ -778,3 +767,17 @@ static int hexit(char c) return 0; } +static void send301(struct connstruct *cn) +{ + char buf[2048]; + snprintf(buf, sizeof(buf), "HTTP/1.1 301 Moved Permanently\nLocation: %s/\n\n\n\n301 Moved Permanently\n\n

    Moved Permanently

    \nThe document has moved here.

    \n

    \n\n", cn->filereq, cn->filereq); + special_write(cn, buf, strlen(buf)); +} + +static void send404(struct connstruct *cn) +{ + char buf[1024]; + sprintf(buf, "HTTP/1.0 404 Not Found\nContent-Type: text/html\n\n\n404 Not Found

    It ain't there my friend. (404 Not Found)

    \n\n"); + special_write(cn, buf, strlen(buf)); +} + diff --git a/httpd/socket.c b/httpd/socket.c deleted file mode 100644 index e7faa78e8b..0000000000 --- a/httpd/socket.c +++ /dev/null @@ -1,129 +0,0 @@ -/* - * Copyright(C) 2006 Cameron Rich - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - */ - -#include -#include -#include -#include "axhttp.h" - -#ifdef HAVE_IPV6 - -void handlenewconnection(int listenfd, int is_ssl) -{ - struct sockaddr_in6 their_addr; - int tp = sizeof(their_addr); - char ipbuf[100]; - int connfd = accept(listenfd, (struct sockaddr *)&their_addr, &tp); - - if (connfd == -1) - return; - - if (tp == sizeof(struct sockaddr_in6)) - { - inet_ntop(AF_INET6, &their_addr.sin6_addr, ipbuf, sizeof(ipbuf)); - } - else if (tp == sizeof(struct sockaddr_in)) - { - inet_ntop(AF_INET, &(((struct sockaddr_in *)&their_addr)->sin_addr), - ipbuf, sizeof(ipbuf)); - } - else - { - *ipbuf = '\0'; - } - - addconnection(connfd, ipbuf, is_ssl); -} - -#else -void handlenewconnection(int listenfd, int is_ssl) -{ - struct sockaddr_in their_addr; - int tp = sizeof(struct sockaddr_in); - int connfd = accept(listenfd, (struct sockaddr *)&their_addr, &tp); - - if (connfd == -1) - return; - - addconnection(connfd, inet_ntoa(their_addr.sin_addr), is_ssl); -} -#endif - -int openlistener(int port) -{ - int sd; -#ifdef WIN32 - char tp=1; -#else - int tp=1; -#endif - struct sockaddr_in my_addr; - - if ((sd = socket(AF_INET, SOCK_STREAM, 0)) == -1) - return -1; - - setsockopt(sd, SOL_SOCKET, SO_REUSEADDR, &tp, sizeof(tp)); - my_addr.sin_family = AF_INET; // host byte order - my_addr.sin_port = htons((short)port); // short, network byte order - my_addr.sin_addr.s_addr = INADDR_ANY; // automatically fill with my IP - memset(&(my_addr.sin_zero), 0, 8); // zero the rest of the struct - - if (bind(sd, (struct sockaddr *)&my_addr, sizeof(struct sockaddr)) == -1) - { - close(sd); - return -1; - } - - if (listen(sd, BACKLOG) == -1) - { - close(sd); - return -1; - } - - return sd; -} - -#ifdef HAVE_IPV6 -int openlistener6(int port) -{ - int sd,tp; - struct sockaddr_in6 my_addr; - - if ((sd = socket(AF_INET6, SOCK_STREAM, 0)) == -1) - return -1; - - setsockopt(sd, SOL_SOCKET, SO_REUSEADDR, &tp, sizeof(tp)); - memset(&my_addr, 0, sizeof(my_addr)); - my_addr.sin6_family = AF_INET6; - my_addr.sin6_port = htons(port); - - if (bind(sd, (struct sockaddr *)&my_addr, sizeof(my_addr)) == -1) - { - close(sd); - return -1; - } - - if (listen(sd, BACKLOG) == -1) - { - close(sd); - return -1; - } - - return sd; -} -#endif diff --git a/ssl/Makefile b/ssl/Makefile index 61864a5b72..28a900a21c 100644 --- a/ssl/Makefile +++ b/ssl/Makefile @@ -31,7 +31,9 @@ endif ifndef CONFIG_PLATFORM_WIN32 TARGET1=../$(STAGE)/libaxtls.a BASETARGET=libaxtls.so -TARGET2=../$(STAGE)/$(BASETARGET) +ifdef CONFIG_PLATFORM_CYGWIN +TARGET2=../$(STAGE)/libaxtls.dll.a +endif # shared library major/minor numbers LIBMAJOR=$(BASETARGET).1 @@ -72,8 +74,15 @@ $(TARGET1) : $(OBJ) $(AR) -r $@ $(OBJ) $(TARGET2) : $(OBJ) - $(LD) $(LDFLAGS) -Wl,-soname,$(LIBMAJOR) $(LDSHARED) -o ../$(STAGE)/$(LIBMINOR) $(OBJ) +ifndef CONFIG_PLATFORM_CYGWIN + $(LD) $(LDFLAGS) $(LDSHARED) -Wl,-soname,$(LIBMAJOR) -o ../$(STAGE)/$(LIBMINOR) $(OBJ) cd ../$(STAGE); ln -sf $(LIBMINOR) $(LIBMAJOR); ln -sf $(LIBMAJOR) $(BASETARGET); cd - +else + $(LD) $(LDFLAGS) $(LDSHARED) -o ../$(STAGE)/cygaxtls.dll \ + -Wl,--out-implib=../$(STAGE)/libaxtls.dll.a \ + -Wl,--export-all-symbols \ + -Wl,--enable-auto-import $(OBJ) +endif else # Win32 From ce893c517d7d6257f61bb19b6822dae19e66908e Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 7 Dec 2006 20:33:16 +0000 Subject: [PATCH 043/301] lots of changes for axhttpd git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@53 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/Makefile | 5 +- httpd/README | 6 +- httpd/axhttp.h | 38 +--- httpd/conn.c | 26 +-- httpd/main.c | 501 ++++++++++++++++++----------------------- httpd/proc.c | 441 ++++++++++++++++++++++-------------- www/index.html | 344 +++++++++++++++++----------- www/test_dir/health.sh | 2 +- 8 files changed, 728 insertions(+), 635 deletions(-) diff --git a/httpd/Makefile b/httpd/Makefile index 1b57b3c803..a6023e7760 100644 --- a/httpd/Makefile +++ b/httpd/Makefile @@ -57,7 +57,6 @@ OBJ= \ conn.o \ main.o \ proc.o \ - misc.o \ mime_types.o ifndef CONFIG_PLATFORM_WIN32 @@ -71,6 +70,10 @@ endif endif else # Win32 +OBJ:=$(OBJ:.o=.obj) +%.obj : %.c + $(CC) $(CFLAGS) $< + $(TARGET): $(OBJ) $(LD) $(LDFLAGS) $(LIBS) /out:$@ $(OBJ) endif diff --git a/httpd/README b/httpd/README index cb42bfd66f..ba11528b02 100644 --- a/httpd/README +++ b/httpd/README @@ -1,6 +1,6 @@ -axhttpd is a small embedded web server using the axTLS library. +axhttpd is a small embedded web server using the axTLS library. -It is based quite closely on the web server written by Doug Currie (original -version is here: http://www.hcsw.org/awhttpd). +It is based originally on the web server written by Doug Currie and is at: +http://www.hcsw.org/awhttpd). diff --git a/httpd/axhttp.h b/httpd/axhttp.h index d4e62f6166..06057d215f 100644 --- a/httpd/axhttp.h +++ b/httpd/axhttp.h @@ -74,9 +74,9 @@ struct connstruct int numbytes; char databuf[BLOCKSIZE]; - unsigned char is_ssl; - unsigned char close_when_done; - unsigned char modified_since; + uint8_t is_ssl; + uint8_t close_when_done; + uint8_t modified_since; }; struct serverstruct @@ -95,12 +95,6 @@ struct cgiextstruct }; #endif -struct indexstruct -{ - struct indexstruct *next; - char *name; -}; - // Global prototypes extern struct serverstruct *servers; extern struct connstruct *usedconns; @@ -108,49 +102,25 @@ extern struct connstruct *freeconns; #if defined(CONFIG_HTTP_HAS_CGI) extern struct cgiextstruct *cgiexts; #endif -extern struct indexstruct *indexlist; // Conf global prototypes extern char *webroot; -extern int allowdirectorylisting; -extern int allowcgi; -extern int permcheck; // conn.c prototypes void addconnection(int sd, char *ip, int is_ssl); void removeconnection(struct connstruct *cn); // proc.c prototypes -int procheadelem(struct connstruct *cn, char *buf); -void procdirlisting(struct connstruct *cn); void procdodir(struct connstruct *cn); void procreadhead(struct connstruct *cn); void procsendhead(struct connstruct *cn); void procreadfile(struct connstruct *cn); void procsendfile(struct connstruct *cn); -int special_write(struct connstruct *cn, const uint8_t *buf, size_t count); // misc.c prototypes -void nada(int sigtype); -void die(int sigtype); -void reaper(int sigtype); -void stripcrlf(char *p); char *my_strncpy(char *dest, const char *src, size_t n); -#ifndef __HAVE_ARCH_STRNLEN -size_t strnlen ( const char * str, size_t maxlen ); -#endif -int iscgi(char *fn); -void split(char *tp, char *sp[], int maxwords, char sc); -int sanitizefile(char *buf); -int sanitizehost(char *buf); -void buildactualfile(struct connstruct *cn); -int issockwriteable(int sd); -int isdir(char *name); -int trycgi_withpathinfo(struct connstruct *cn); +int isdir(const char *name); // mime_types.c prototypes void mime_init(void); const char *getmimetype(const char *fn); - -// main.c prototypes -void initlists(void); diff --git a/httpd/conn.c b/httpd/conn.c index a36271709f..2cbffec2d7 100644 --- a/httpd/conn.c +++ b/httpd/conn.c @@ -27,9 +27,7 @@ void addconnection(int sd, char *ip, int is_ssl) // Get ourselves a connstruct if (freeconns == NULL) - { - tp = (struct connstruct *) malloc(sizeof(struct connstruct)); - } + tp = (struct connstruct *)malloc(sizeof(struct connstruct)); else { tp = freeconns; @@ -39,23 +37,21 @@ void addconnection(int sd, char *ip, int is_ssl) // Attach it to the used list tp->next = usedconns; usedconns = tp; - tp->networkdesc = sd; + if (is_ssl) ssl_server_new(servers->ssl_ctx, sd); + tp->is_ssl = is_ssl; tp->filedesc = -1; #if defined(CONFIG_HTTP_HAS_DIRECTORIES) tp->dirp = NULL; #endif - tp->is_ssl = is_ssl; - *(tp->actualfile) = '\0'; *(tp->filereq) = '\0'; #if defined(CONFIG_HTTP_HAS_CGI) *(tp->cgiargs) = '\0'; #endif *(tp->virtualhostreq) = '\0'; - tp->state = STATE_WANT_TO_READ_HEAD; tp->reqtype = TYPE_GET; my_strncpy(tp->ip, ip, MAXIPLEN); @@ -67,27 +63,27 @@ void addconnection(int sd, char *ip, int is_ssl) void removeconnection(struct connstruct *cn) { struct connstruct *tp; - int shouldret=0; + int shouldret = 0; tp = usedconns; if (tp == NULL || cn == NULL) - shouldret=1; + shouldret = 1; else if (tp == cn) usedconns = tp->next; else { - while(tp != NULL) + while (tp != NULL) { if (tp->next == cn) { tp->next = (tp->next)->next; - shouldret=0; + shouldret = 0; break; } tp = tp->next; - shouldret=1; + shouldret = 1; } } @@ -102,14 +98,14 @@ void removeconnection(struct connstruct *cn) if (cn->networkdesc != -1) { if (cn->is_ssl) - { ssl_free(ssl_find(servers->ssl_ctx, cn->networkdesc)); - } SOCKET_CLOSE(cn->networkdesc); } - if (cn->filedesc != -1) close(cn->filedesc); + if (cn->filedesc != -1) + close(cn->filedesc); + #if defined(CONFIG_HTTP_HAS_DIRECTORIES) if (cn->dirp != NULL) #ifdef WIN32 diff --git a/httpd/main.c b/httpd/main.c index 8254d3c540..da26086529 100644 --- a/httpd/main.c +++ b/httpd/main.c @@ -27,23 +27,25 @@ struct serverstruct *servers; struct connstruct *usedconns; struct connstruct *freeconns; -#if defined(CONFIG_HTTP_HAS_CGI) -struct cgiextstruct *cgiexts; -#endif -struct indexstruct *indexlist; - char *webroot = CONFIG_HTTP_WEBROOT; -static void addindex(char *tp); static void addtoservers(int sd); -static void selectloop(void); static int openlistener(int port); static void handlenewconnection(int listenfd, int is_ssl); #if defined(CONFIG_HTTP_PERM_CHECK) -static void procpermcheck(char *pathtocheck); +static void procpermcheck(const char *pathtocheck); #endif + #if defined(CONFIG_HTTP_HAS_CGI) +struct cgiextstruct *cgiexts; static void addcgiext(char *tp); + +#if !defined(WIN32) +static void reaper(int sigtype) +{ + wait3(NULL, WNOHANG, NULL); +} +#endif #endif /* clean up memory for valgrind */ @@ -53,7 +55,7 @@ static void sigint_cleanup(int sig) struct connstruct *tp; int i; - while(servers != NULL) + while (servers != NULL) { if (servers->is_ssl) ssl_ctx_free(servers->ssl_ctx); @@ -63,9 +65,6 @@ static void sigint_cleanup(int sig) servers = sp; } - free(indexlist->name); - free(indexlist); - for (i = 0; i < INITIAL_CONNECTION_SLOTS; i++) { if (freeconns == NULL) @@ -79,46 +78,52 @@ static void sigint_cleanup(int sig) exit(0); } -void initlists() +static void die(int sigtype) { - int i; - struct connstruct *tp; - - servers = NULL; - usedconns = NULL; - freeconns = NULL; -#if defined(CONFIG_HTTP_HAS_CGI) - cgiexts = NULL; -#endif - indexlist = NULL; - - for (i=0; inext = tp; - } + exit(0); } int main(int argc, char *argv[]) { - int tp; -#if defined(CONFIG_HTTP_IS_DAEMON) - int pid; -#endif + fd_set rfds, wfds; + struct connstruct *tp, *to; + struct serverstruct *sp; + int rnum, wnum, active; + int webrootlen, i; + time_t currtime; #ifdef WIN32 - WORD wVersionRequested = MAKEWORD(2,2); + WORD wVersionRequested = MAKEWORD(2, 2); WSADATA wsaData; WSAStartup(wVersionRequested,&wsaData); -#endif +#else + if (getuid() == 0) // change our uid if we are root + { + setgid(32767); + setuid(32767); + } + signal(SIGQUIT, die); + signal(SIGPIPE, SIG_IGN); +#if defined(CONFIG_HTTP_HAS_CGI) + signal(SIGCHLD, reaper); +#endif +#endif + signal(SIGINT, sigint_cleanup); + signal(SIGTERM, die); mime_init(); - initlists(); - tp = strlen(webroot); - if (webroot[tp-1] == '/') - webroot[tp-1] = '\0'; + for (i = 0; i < INITIAL_CONNECTION_SLOTS; i++) + { + tp = freeconns; + freeconns = (struct connstruct *)calloc(1, sizeof(struct connstruct)); + freeconns->next = tp; + } + + webrootlen = strlen(webroot); + + if (webroot[webrootlen-1] == '/') + webroot[webrootlen-1] = '\0'; if (isdir(webroot) == 0) { @@ -128,38 +133,29 @@ int main(int argc, char *argv[]) exit(1); } - if ((tp = openlistener(CONFIG_HTTP_PORT)) == -1) + if ((active = openlistener(CONFIG_HTTP_PORT)) == -1) { #ifdef CONFIG_HTTP_VERBOSE - fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", + fprintf(stderr, "ERR: Couldn't bind to port %d\n", CONFIG_HTTP_PORT); #endif exit(1); } - addindex("index.html"); - addtoservers(tp); - -#ifndef WIN32 - if (getuid() == 0) - { - setgid(32767); - setuid(32767); - } -#endif + addtoservers(active); - if ((tp = openlistener(CONFIG_HTTP_HTTPS_PORT)) == -1) + if ((active = openlistener(CONFIG_HTTP_HTTPS_PORT)) == -1) { #ifdef CONFIG_HTTP_VERBOSE - fprintf(stderr, "ERR: Couldn't bind to port %d (IPv4)\n", + fprintf(stderr, "ERR: Couldn't bind to port %d\n", CONFIG_HTTP_HTTPS_PORT); #endif exit(1); } - addtoservers(tp); + addtoservers(active); servers->ssl_ctx = ssl_ctx_new(CONFIG_HTTP_DEFAULT_SSL_OPTIONS, - CONFIG_HTTP_SESSION_CACHE_SIZE); + CONFIG_HTTP_SESSION_CACHE_SIZE); servers->is_ssl = 1; #if defined(CONFIG_HTTP_PERM_CHECK) @@ -173,189 +169,27 @@ int main(int argc, char *argv[]) CONFIG_HTTP_PORT, CONFIG_HTTP_HTTPS_PORT); TTY_FLUSH(); #endif - #if defined(CONFIG_HTTP_IS_DAEMON) - pid = fork(); - - if (pid > 0) - { + if (fork() > 0) /* parent will die */ exit(0); - } - else if(pid == -1) - { -#ifdef CONFIG_HTTP_VERBOSE - fprintf(stderr,"axhttpd: Sorry, fork failed... Tough dice.\n"); -#endif - exit(1); - } setsid(); #endif - /* SIGNALS */ - signal(SIGINT, sigint_cleanup); - signal(SIGTERM, die); -#if defined(CONFIG_HTTP_HAS_CGI) -#ifndef WIN32 - signal(SIGCHLD, reaper); -#endif -#endif -#ifndef WIN32 - signal(SIGQUIT, die); - signal(SIGPIPE, SIG_IGN); -#endif - - selectloop(); - return 0; -} - -static void addindex(char *tp) -{ - struct indexstruct *ex = (struct indexstruct *) - malloc(sizeof(struct indexstruct)); - ex->name = strdup(tp); - ex->next = indexlist; - indexlist = ex; -} - -#if defined(CONFIG_HTTP_PERM_CHECK) -static void procpermcheck(char *pathtocheck) -{ - char thepath[MAXREQUESTLENGTH]; -#ifndef WIN32 - DIR *tpdir; - struct dirent *dp; - - tpdir = opendir(pathtocheck); - - if (tpdir == NULL) - { - printf("WARNING: UID (%d) is unable to read %s\n", - (int)getuid(), pathtocheck); - return; - } - - while ((dp=readdir(tpdir))) - { - if (strcmp(dp->d_name, "..")==0) - continue; - - if (strcmp(dp->d_name, ".")==0) - continue; - - snprintf(thepath, sizeof(thepath), "%s/%s", pathtocheck, dp->d_name); - - if (isdir(thepath)) - { - procpermcheck(thepath); - continue; - } - - if (access(thepath, R_OK) != 0) - printf("WARNING: UID (%d) is unable to read %s\n", - (int)getuid(), thepath); - if (access(thepath, W_OK) == 0) - printf("SECURITY: UID (%d) is ABLE TO WRITE TO %s\n", - (int)getuid(), thepath); - } - - closedir(tpdir); -#else /* Win32 */ - HANDLE tpdir; - WIN32_FIND_DATA file_data; - struct stat st; - char buf2[1024]; - - strcpy(buf2, pathtocheck); - strcat(buf2, "\\*"); - tpdir = FindFirstFile(buf2, &file_data); - - if (tpdir == INVALID_HANDLE_VALUE) - { - printf("WARNING: unable to read %s\n", buf2); - TTY_FLUSH(); - return; - } - - while (FindNextFile(tpdir, &file_data)) - { - if (strcmp(file_data.cFileName, "..") == 0) - continue; - - if (strcmp(file_data.cFileName, ".") == 0) - continue; - - snprintf(thepath, sizeof(thepath), "%s\\%s", - pathtocheck, file_data.cFileName); - - if (isdir(thepath)) - { - procpermcheck(thepath); - continue; - } - - if (stat(thepath, &st) >= 0) - { - if ((st.st_mode & _S_IREAD) == 0) - { - printf("WARNING: unable to read %s\n", thepath); - TTY_FLUSH(); - } - - if (st.st_mode & _S_IWRITE) - { - printf("SECURITY: ABLE TO WRITE TO %s\n", thepath); - TTY_FLUSH(); - } - } - } - - FindClose(tpdir); -#endif -} -#endif /* CONFIG_HTTP_PERM_CHECK */ - -#if defined(CONFIG_HTTP_HAS_CGI) -static void addcgiext(char *tp) -{ - struct cgiextstruct *ex = (struct cgiextstruct *) - malloc(sizeof(struct cgiextstruct)); - ex->ext = strdup(tp); - ex->next = cgiexts; - cgiexts = ex; -} -#endif - -static void addtoservers(int sd) -{ - struct serverstruct *tp = (struct serverstruct *) - calloc(1, sizeof(struct serverstruct)); - tp->next = servers; - tp->sd = sd; - servers = tp; -} - -static void selectloop(void) -{ - fd_set rfds, wfds; - struct connstruct *tp, *to; - struct serverstruct *sp; - int rnum, wnum, active; - int currtime; - + // main loop while (1) - { - // MAIN SELECT LOOP + { FD_ZERO(&rfds); FD_ZERO(&wfds); rnum = wnum = -1; - - // Add the listening sockets sp = servers; - while (sp != NULL) + + while (sp != NULL) // read each server port { FD_SET(sp->sd, &rfds); - if (sp->sd > rnum) rnum = sp->sd; + + if (sp->sd > rnum) + rnum = sp->sd; sp = sp->next; } @@ -365,7 +199,7 @@ static void selectloop(void) while (tp != NULL) { - if (currtime > tp->timeout) + if (currtime > tp->timeout) // timed out? Kill it. { to = tp; tp = tp->next; @@ -413,11 +247,10 @@ static void selectloop(void) } active = select(wnum > rnum ? wnum+1 : rnum+1, - rnum != -1 ? &rfds : NULL, - wnum != -1 ? &wfds : NULL, + rnum != -1 ? &rfds : NULL, wnum != -1 ? &wfds : NULL, NULL, NULL); - // Handle the listening sockets + // New connection? sp = servers; while (active > 0 && sp != NULL) { @@ -475,7 +308,130 @@ static void selectloop(void) } #endif } - } // MAIN SELECT LOOP + } + + return 0; +} + +#if defined(CONFIG_HTTP_PERM_CHECK) +static void procpermcheck(const char *pathtocheck) +{ + char thepath[MAXREQUESTLENGTH]; +#ifndef WIN32 + DIR *tpdir; + struct dirent *dp; + + tpdir = opendir(pathtocheck); + + if (tpdir == NULL) + { + printf("WARNING: UID (%d) is unable to read %s\n", + (int)getuid(), pathtocheck); + TTY_FLUSH(); + return; + } + + while ((dp = readdir(tpdir))) + { + if (strcmp(dp->d_name, "..") == 0) + continue; + + if (strcmp(dp->d_name, ".") == 0) + continue; + + snprintf(thepath, sizeof(thepath), "%s/%s", pathtocheck, dp->d_name); + + if (isdir(thepath)) + { + procpermcheck(thepath); + continue; + } + + if (access(thepath, R_OK) != 0) + printf("WARNING: UID (%d) is unable to read %s\n", + (int)getuid(), thepath); + + if (access(thepath, W_OK) == 0) + printf("SECURITY: UID (%d) is ABLE TO WRITE TO %s\n", + (int)getuid(), thepath); + + TTY_FLUSH(); + } + + closedir(tpdir); +#else /* Win32 */ + HANDLE tpdir; + WIN32_FIND_DATA file_data; + struct stat st; + char buf2[1024]; + + strcpy(buf2, pathtocheck); + strcat(buf2, "\\*"); + tpdir = FindFirstFile(buf2, &file_data); + + if (tpdir == INVALID_HANDLE_VALUE) + { + printf("WARNING: unable to read %s\n", buf2); + TTY_FLUSH(); + return; + } + + while (FindNextFile(tpdir, &file_data)) + { + if (strcmp(file_data.cFileName, "..") == 0) + continue; + + if (strcmp(file_data.cFileName, ".") == 0) + continue; + + snprintf(thepath, sizeof(thepath), "%s\\%s", + pathtocheck, file_data.cFileName); + + if (isdir(thepath)) + { + procpermcheck(thepath); + continue; + } + + if (stat(thepath, &st) >= 0) + { + if ((st.st_mode & _S_IREAD) == 0) + { + printf("WARNING: unable to read %s\n", thepath); + TTY_FLUSH(); + } + + if (st.st_mode & _S_IWRITE) + { + printf("SECURITY: ABLE TO WRITE TO %s\n", thepath); + TTY_FLUSH(); + } + } + } + + FindClose(tpdir); +#endif +} +#endif /* CONFIG_HTTP_PERM_CHECK */ + +#if defined(CONFIG_HTTP_HAS_CGI) +static void addcgiext(char *tp) +{ + struct cgiextstruct *ex = (struct cgiextstruct *) + malloc(sizeof(struct cgiextstruct)); + ex->ext = strdup(tp); + ex->next = cgiexts; + cgiexts = ex; +} +#endif + +static void addtoservers(int sd) +{ + struct serverstruct *tp = (struct serverstruct *) + calloc(1, sizeof(struct serverstruct)); + tp->next = servers; + tp->sd = sd; + servers = tp; } #ifdef HAVE_IPV6 @@ -486,9 +442,6 @@ static void handlenewconnection(int listenfd, int is_ssl) char ipbuf[100]; int connfd = accept(listenfd, (struct sockaddr *)&their_addr, &tp); - if (connfd == -1) - return; - if (tp == sizeof(struct sockaddr_in6)) { inet_ntop(AF_INET6, &their_addr.sin6_addr, ipbuf, sizeof(ipbuf)); @@ -512,10 +465,6 @@ static void handlenewconnection(int listenfd, int is_ssl) struct sockaddr_in their_addr; int tp = sizeof(struct sockaddr_in); int connfd = accept(listenfd, (struct sockaddr *)&their_addr, &tp); - - if (connfd == -1) - return; - addconnection(connfd, inet_ntoa(their_addr.sin_addr), is_ssl); } #endif @@ -524,62 +473,60 @@ static int openlistener(int port) { int sd; #ifdef WIN32 - char tp=1; + char tp = 1; #else - int tp=1; + int tp = 1; #endif +#ifndef HAVE_IPV6 struct sockaddr_in my_addr; if ((sd = socket(AF_INET, SOCK_STREAM, 0)) == -1) return -1; - setsockopt(sd, SOL_SOCKET, SO_REUSEADDR, &tp, sizeof(tp)); - my_addr.sin_family = AF_INET; // host byte order - my_addr.sin_port = htons((short)port); // short, network byte order - my_addr.sin_addr.s_addr = INADDR_ANY; // automatically fill with my IP - memset(&(my_addr.sin_zero), 0, 8); // zero the rest of the struct + memset(&my_addr, 0, sizeof(my_addr)); + my_addr.sin_family = AF_INET; + my_addr.sin_port = htons((short)port); + my_addr.sin_addr.s_addr = INADDR_ANY; +#else + struct sockaddr_in6 my_addr; - if (bind(sd, (struct sockaddr *)&my_addr, sizeof(struct sockaddr)) == -1) - { - close(sd); + if ((sd = socket(AF_INET6, SOCK_STREAM, 0)) == -1) return -1; - } - if (listen(sd, BACKLOG) == -1) - { - close(sd); - return -1; - } + memset(&my_addr, 0, sizeof(my_addr)); + my_addr.sin6_family = AF_INET6; + my_addr.sin6_port = htons(port); + my_addr.sin6_addr.s_addr = INADDR_ANY; +#endif + + setsockopt(sd, SOL_SOCKET, SO_REUSEADDR, &tp, sizeof(tp)); + bind(sd, (struct sockaddr *)&my_addr, sizeof(struct sockaddr)); + listen(sd, BACKLOG); return sd; } -#ifdef HAVE_IPV6 -static int openlistener6(int port) +/* Wrapper function for strncpy() that guarantees + a null-terminated string. This is to avoid any possible + issues due to strncpy()'s behaviour. + */ +char *my_strncpy(char *dest, const char *src, size_t n) { - int sd,tp; - struct sockaddr_in6 my_addr; - - if ((sd = socket(AF_INET6, SOCK_STREAM, 0)) == -1) - return -1; + strncpy(dest, src, n); + dest[n-1] = '\0'; + return dest; +} - setsockopt(sd, SOL_SOCKET, SO_REUSEADDR, &tp, sizeof(tp)); - memset(&my_addr, 0, sizeof(my_addr)); - my_addr.sin6_family = AF_INET6; - my_addr.sin6_port = htons(port); +int isdir(const char *tpbuf) +{ + struct stat st; - if (bind(sd, (struct sockaddr *)&my_addr, sizeof(my_addr)) == -1) - { - close(sd); - return -1; - } + if (stat(tpbuf, &st) == -1) + return 0; - if (listen(sd, BACKLOG) == -1) - { - close(sd); - return -1; - } + if ((st.st_mode & S_IFMT) == S_IFDIR) + return 1; - return sd; + return 0; } -#endif + diff --git a/httpd/proc.c b/httpd/proc.c index 88c7fbab68..d4bde5d8c8 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -27,21 +27,31 @@ #include "axhttp.h" static int special_read(struct connstruct *cn, void *buf, size_t count); +static int special_write(struct connstruct *cn, + const uint8_t *buf, size_t count); static void send301(struct connstruct *cn); static void send404(struct connstruct *cn); static int procindex(struct connstruct *cn, struct stat *stp); static int hexit(char c); static void urldecode(char *buf); +static void buildactualfile(struct connstruct *cn); +static int sanitizefile(const char *buf); +static int sanitizehost(char *buf); #if defined(CONFIG_HTTP_DIRECTORIES) -static void urlencode(unsigned char *s, unsigned char *t); +static void urlencode(const uint8_t *s, uint8_t *t); +static void procdirlisting(struct connstruct *cn); +static int issockwriteable(int sd); #endif #if defined(CONFIG_HTTP_HAS_CGI) static void proccgi(struct connstruct *cn, int has_pathinfo); +static int trycgi_withpathinfo(struct connstruct *cn); +static void split(char *tp, char *sp[], int maxwords, char sc); +static int iscgi(const char *fn); #endif // Returns 1 if elems should continue being read, 0 otherwise -int procheadelem(struct connstruct *cn, char *buf) +static int procheadelem(struct connstruct *cn, char *buf) { char *delim, *value; #if defined(CONFIG_HTTP_HAS_CGI) @@ -98,7 +108,8 @@ int procheadelem(struct connstruct *cn, char *buf) my_strncpy(cn->virtualhostreq, value, MAXREQUESTLENGTH); } else if (strcmp(buf, "Connection:")==0 && - strcmp(value, "close")==0) { + strcmp(value, "close")==0) + { cn->close_when_done = 1; } else if (strcmp(buf, "If-Modified-Since:") ==0 ) @@ -111,33 +122,26 @@ int procheadelem(struct connstruct *cn, char *buf) } #if defined(CONFIG_HTTP_DIRECTORIES) -void procdirlisting(struct connstruct *cn) +static void procdirlisting(struct connstruct *cn) { char buf[MAXREQUESTLENGTH]; char actualfile[1024]; -#ifndef CONFIG_HTTP_DIRECTORIES - if (allowdirectorylisting == 0) - { - send404(cn); - removeconnection(cn); - return; - } -#endif - if (cn->reqtype == TYPE_HEAD) { - snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n"); + snprintf(buf, sizeof(buf), + "HTTP/1.1 200 OK\nContent-Type: text/html\n\n"); write(cn->networkdesc, buf, strlen(buf)); - removeconnection(cn); return; } strcpy(actualfile, cn->actualfile); + #ifdef WIN32 strcat(actualfile, "*"); cn->dirp = FindFirstFile(actualfile, &cn->file_data); + if (cn->dirp == INVALID_HANDLE_VALUE) { send404(cn); @@ -145,10 +149,7 @@ void procdirlisting(struct connstruct *cn) return; } #else - - cn->dirp = opendir(actualfile); - - if (cn->dirp == NULL) + if ((cn->dirp = opendir(actualfile)) == NULL) { send404(cn); removeconnection(cn); @@ -159,7 +160,10 @@ void procdirlisting(struct connstruct *cn) readdir(cn->dirp); #endif - sprintf(buf, "HTTP/1.1 200 OK\nContent-Type: text/html\n\n\nDirectory Listing\n

    Directory listing of %s://%s%s


    \n", cn->is_ssl ? "https" : "http", cn->virtualhostreq, cn->filereq); + snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n" + "\nDirectory Listing\n" + "

    Directory listing of %s://%s%s


    \n", + cn->is_ssl ? "https" : "http", cn->virtualhostreq, cn->filereq); special_write(cn, buf, strlen(buf)); cn->state = STATE_DOING_DIR; } @@ -179,14 +183,14 @@ void procdodir(struct connstruct *cn) #ifdef WIN32 if (!FindNextFile(cn->dirp, &cn->file_data)) #else - if ((dp = readdir(cn->dirp)) == NULL) + if ((dp = readdir(cn->dirp)) == NULL) #endif - { - snprintf(buf, sizeof(buf), "\n"); - special_write(cn, buf, strlen(buf)); - removeconnection(cn); - return; - } + { + snprintf(buf, sizeof(buf), "\n"); + special_write(cn, buf, strlen(buf)); + removeconnection(cn); + return; + } #ifdef WIN32 file = cn->file_data.cFileName; @@ -199,31 +203,45 @@ void procdodir(struct connstruct *cn) snprintf(buf, sizeof(buf), "%s%s", cn->actualfile, file); putslash = isdir(buf); - urlencode(file, encbuf); snprintf(buf, sizeof(buf), "%s%s
    \n", encbuf, putslash ? "/" : "", file, putslash ? "/" : ""); special_write(cn, buf, strlen(buf)); + } while (issockwriteable(cn->networkdesc)); +} - } - while (issockwriteable(cn->networkdesc)); +static int issockwriteable(int sd) +{ + fd_set wfds; + struct timeval tv; + + tv.tv_sec = 0; + tv.tv_usec = 0; + + FD_ZERO(&wfds); + FD_SET(sd, &wfds); + + select(FD_SETSIZE, NULL, &wfds, NULL, &tv); + return FD_ISSET(sd, &wfds); } /* Encode funny chars -> %xx in newly allocated storage */ /* (preserves '/' !) */ -static void urlencode(unsigned char *s, unsigned char *t) +static void urlencode(const uint8_t *s, uint8_t *t) { - uint8_t *p, *tp; + const uint8_t *p = s; + uint8_t *tp; - tp =t ; + tp = t; - for (p=s; *p; p++) + for (; *p; p++) { if ((*p > 0x00 && *p < ',') || (*p > '9' && *p < 'A') || (*p > 'Z' && *p < '_') || (*p > '_' && *p < 'a') || - (*p > 'z' && *p < 0xA1)) { + (*p > 'z' && *p < 0xA1)) + { sprintf((char *)tp, "%%%02X", *p); tp += 3; } @@ -245,24 +263,23 @@ void procreadhead(struct connstruct *cn) int rv; rv = special_read(cn, buf, sizeof(buf)-1); - if (rv <= 0) { - if (rv < 0) + if (rv <= 0) + { + if (rv < 0) // really dead? removeconnection(cn); return; } buf[rv] = '\0'; - next = tp = buf; // Split up lines and send to procheadelem() - while(*next != '\0') + while (*next != '\0') { // If we have a blank line, advance to next stage! if (*next == '\r' || *next == '\n') { buildactualfile(cn); - cn->state = STATE_WANT_TO_SEND_HEAD; return; } @@ -273,7 +290,7 @@ void procreadhead(struct connstruct *cn) if (*next == '\r') { *next = '\0'; - next+=2; + next += 2; } else if (*next == '\n') *next++ = '\0'; @@ -295,8 +312,8 @@ void procsendhead(struct connstruct *cn) struct stat stbuf; time_t now = cn->timeout - CONFIG_HTTP_TIMEOUT; char date[32]; - strcpy(date, ctime(&now)); + strcpy(date, ctime(&now)); strcpy(actualfile, cn->actualfile); #ifdef WIN32 @@ -309,8 +326,9 @@ void procsendhead(struct connstruct *cn) { #if defined(CONFIG_HTTP_HAS_CGI) if (trycgi_withpathinfo(cn) == 0) - { // We Try To Find A CGI - proccgi(cn,1); + { + // We Try To Find A CGI + proccgi(cn, 1); return; } #endif @@ -321,7 +339,7 @@ void procsendhead(struct connstruct *cn) } #if defined(CONFIG_HTTP_HAS_CGI) - if (iscgi(cn->actualfile)) + if (iscgi(cn->actualfile)) { #ifndef WIN32 // Set up CGI script @@ -333,7 +351,7 @@ void procsendhead(struct connstruct *cn) } #endif - proccgi(cn,0); + proccgi(cn, 0); return; } #endif @@ -362,7 +380,7 @@ void procsendhead(struct connstruct *cn) #if defined(CONFIG_HTTP_HAS_CGI) // If the index is a CGI file, handle it like any other CGI - if (iscgi(cn->actualfile)) + if (iscgi(cn->actualfile)) { // Set up CGI script if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) @@ -372,45 +390,7 @@ void procsendhead(struct connstruct *cn) return; } - proccgi(cn,0); - return; - } -#endif - // If the index isn't a CGI, we continue on with the index file - } - - if ((stbuf.st_mode & S_IFMT) == S_IFDIR) - { - if (cn->filereq[strlen(cn->filereq)-1] != '/') - { - send301(cn); - removeconnection(cn); - return; - } - - // Check to see if this dir has an index file - if (procindex(cn, &stbuf) == 0) - { -#if defined(CONFIG_HTTP_DIRECTORIES) - // If not, we do a directory listing of it - procdirlisting(cn); -#endif - return; - } - -#if defined(CONFIG_HTTP_HAS_CGI) - // If the index is a CGI file, handle it like any other CGI - if (iscgi(cn->actualfile)) - { - // Set up CGI script - if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) - { - send404(cn); - removeconnection(cn); - return; - } - - proccgi(cn,0); + proccgi(cn, 0); return; } #endif @@ -419,7 +399,8 @@ void procsendhead(struct connstruct *cn) if (cn->modified_since) { - snprintf(buf, sizeof(buf), "HTTP/1.1 304 Not Modified\nServer: axhttpd V%s\nDate: %s\n", VERSION, date); + snprintf(buf, sizeof(buf), "HTTP/1.1 304 Not Modified\nServer: " + "axhttpd V%s\nDate: %s\n", VERSION, date); special_write(cn, buf, strlen(buf)); cn->modified_since = 0; cn->state = STATE_WANT_TO_READ_HEAD; @@ -433,12 +414,11 @@ void procsendhead(struct connstruct *cn) TTY_FLUSH(); #endif - snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: axhttpd V%s\nContent-Type: %s\nContent-Length: %ld\nDate: %sLast-Modified: %s\n", - VERSION, - getmimetype(cn->actualfile), - (long) stbuf.st_size, - date, - ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end + snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: axhttpd V%s\n" + "Content-Type: %s\nContent-Length: %ld\n" + "Date: %sLast-Modified: %s\n", VERSION, + getmimetype(cn->actualfile), (long) stbuf.st_size, + date, ctime(&(stbuf.st_mtime))); // ctime() has a \n on the end } special_write(cn, buf, strlen(buf)); @@ -478,7 +458,6 @@ void procsendhead(struct connstruct *cn) #else cn->state = STATE_WANT_TO_READ_FILE; #endif - return; } } @@ -490,10 +469,11 @@ void procreadfile(struct connstruct *cn) { close(cn->filedesc); cn->filedesc = -1; - if (cn->close_when_done) /* close immediately */ + + if (cn->close_when_done) /* close immediately */ removeconnection(cn); else - { /* keep socket open - HTTP 1.1 */ + { /* keep socket open - HTTP 1.1 */ cn->state = STATE_WANT_TO_READ_HEAD; cn->numbytes = 0; } @@ -514,7 +494,9 @@ void procsendfile(struct connstruct *cn) else if (rv == cn->numbytes) cn->state = STATE_WANT_TO_READ_FILE; else if (rv == 0) - { /* Do nothing */ } + { + /* Do nothing */ + } else { memmove(cn->databuf, cn->databuf + rv, cn->numbytes - rv); @@ -522,24 +504,16 @@ void procsendfile(struct connstruct *cn) } } -int special_write(struct connstruct *cn, const uint8_t *buf, size_t count) +static int special_write(struct connstruct *cn, + const uint8_t *buf, size_t count) { - int res; - if (cn->is_ssl) { SSL *ssl = ssl_find(servers->ssl_ctx, cn->networkdesc); - if (ssl) - { - res = ssl_write(ssl, (unsigned char *)buf, count); - } - else - return -1; + return ssl ? ssl_write(ssl, (uint8_t *)buf, count) : -1; } else - res = SOCKET_WRITE(cn->networkdesc, buf, count); - - return res; + return SOCKET_WRITE(cn->networkdesc, buf, count); } static int special_read(struct connstruct *cn, void *buf, size_t count) @@ -549,7 +523,7 @@ static int special_read(struct connstruct *cn, void *buf, size_t count) if (cn->is_ssl) { SSL *ssl = ssl_find(servers->ssl_ctx, cn->networkdesc); - unsigned char *read_buf; + uint8_t *read_buf; if ((res = ssl_read(ssl, &read_buf)) > SSL_OK) memcpy(buf, read_buf, res > (int)count ? count : res); @@ -566,26 +540,12 @@ static int special_read(struct connstruct *cn, void *buf, size_t count) static int procindex(struct connstruct *cn, struct stat *stp) { char tbuf[MAXREQUESTLENGTH]; - struct indexstruct *tp; - - tp = indexlist; - - while(tp != NULL) { - sprintf(tbuf, "%s%s%s", cn->actualfile, -#ifdef WIN32 - "\\", -#else - "/", -#endif - tp->name); - - if (stat(tbuf, stp) != -1) - { - my_strncpy(cn->actualfile, tbuf, MAXREQUESTLENGTH); - return 1; - } - tp = tp->next; + sprintf(tbuf, "%s%s", cn->actualfile, "index.html"); + if (stat(tbuf, stp) != -1) + { + my_strncpy(cn->actualfile, tbuf, MAXREQUESTLENGTH); + return 1; } return 0; @@ -599,8 +559,6 @@ static void proccgi(struct connstruct *cn, int has_pathinfo) char buf[MAXREQUESTLENGTH]; #ifdef WIN32 int tmp_stdout; -#else - int fv; #endif snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: axhttpd V%s\n%s", @@ -614,28 +572,15 @@ static void proccgi(struct connstruct *cn, int has_pathinfo) } #ifndef WIN32 - if (pipe(tpipe) == -1) - { - removeconnection(cn); - return; - } - - fv = fork(); - - if (fv == -1) - { - close(tpipe[0]); - close(tpipe[1]); - removeconnection(cn); - return; - } + pipe(tpipe); - if (fv != 0) + if (fork() > 0) // parent { // Close the write descriptor close(tpipe[1]); cn->filedesc = tpipe[0]; cn->state = STATE_WANT_TO_READ_FILE; + cn->close_when_done = 1; return; } @@ -653,7 +598,6 @@ static void proccgi(struct connstruct *cn, int has_pathinfo) close(tpipe[0]); close(tpipe[1]); - myargs[0] = cn->actualfile; myargs[1] = cn->cgiargs; myargs[2] = NULL; @@ -666,11 +610,7 @@ static void proccgi(struct connstruct *cn, int has_pathinfo) execv(cn->actualfile, myargs); #else /* WIN32 */ - if (_pipe(tpipe, 4096, O_BINARY| O_NOINHERIT) == -1) - { - removeconnection(cn); - return; - } + _pipe(tpipe, 4096, O_BINARY| O_NOINHERIT); myargs[0] = "sh"; myargs[1] = "-c"; @@ -703,6 +643,7 @@ static void proccgi(struct connstruct *cn, int has_pathinfo) close(tmp_stdout); cn->filedesc = tpipe[0]; cn->state = STATE_WANT_TO_READ_FILE; + cn->close_when_done = 1; for (;;) { @@ -716,6 +657,97 @@ static void proccgi(struct connstruct *cn, int has_pathinfo) } #endif } + +static int trycgi_withpathinfo(struct connstruct *cn) +{ + char tpfile[MAXREQUESTLENGTH]; + char fr_str[MAXREQUESTLENGTH]; + char *fr_rs[MAXCGIARGS]; // filereq splitted + int i = 0, offset; + + my_strncpy(fr_str, cn->filereq, MAXREQUESTLENGTH); + split(fr_str, fr_rs, MAXCGIARGS, '/'); + + while (fr_rs[i] != NULL) + { + snprintf(tpfile, sizeof(tpfile), "%s/%s%s", + webroot, cn->virtualhostreq, fr_str); + + if (iscgi(tpfile) && isdir(tpfile) == 0) + { + /* We've found our CGI file! */ + my_strncpy(cn->actualfile, tpfile, MAXREQUESTLENGTH); + my_strncpy(cn->cgiscriptinfo, fr_str, MAXREQUESTLENGTH); + + offset = (fr_rs[i] + strlen(fr_rs[i])) - fr_str; + my_strncpy(cn->cgipathinfo, cn->filereq+offset, MAXREQUESTLENGTH); + + return 0; + } + + *(fr_rs[i]+strlen(fr_rs[i])) = '/'; + i++; + } + + /* Couldn't find any CGIs :( */ + *(cn->cgiscriptinfo) = '\0'; + *(cn->cgipathinfo) = '\0'; + return -1; +} + +static int iscgi(const char *fn) +{ + struct cgiextstruct *tp; + int fnlen, extlen; + + fnlen = strlen(fn); + tp = cgiexts; + + while (tp != NULL) + { + extlen = strlen(tp->ext); + + if (strcasecmp(fn+(fnlen-extlen), tp->ext) == 0) + return 1; + + tp = tp->next; + } + + return 0; +} + +static void split(char *tp, char *sp[], int maxwords, char sc) +{ + int i = 0; + + while(1) + { + /* Skip leading whitespace */ + while (*tp == sc) tp++; + + if (*tp == '\0') + { + sp[i] = NULL; + break; + } + + if (i==maxwords-2) + { + sp[maxwords-2] = NULL; + break; + } + + sp[i] = tp; + + while(*tp != sc && *tp != '\0') + tp++; + + if (*tp == sc) + *tp++ = '\0'; + + i++; + } +} #endif /* CONFIG_HTTP_HAS_CGI */ /* Decode string %xx -> char (in place) */ @@ -730,26 +762,28 @@ static void urldecode(char *buf) { v = 0; - if (*p=='%') + if (*p == '%') { s = p; s++; if (isxdigit((int) s[0]) && isxdigit((int) s[1])) { - v = hexit(s[0])*16+hexit(s[1]); + v = hexit(s[0])*16 + hexit(s[1]); + if (v) - { /* do not decode %00 to null char */ - *w=(char)v; - p=&s[1]; + { + /* do not decode %00 to null char */ + *w = (char)v; + p = &s[1]; } } } - if (!v) - *w=*p; - p++; w++; + if (!v) *w=*p; + p++; + w++; } *w='\0'; @@ -757,27 +791,98 @@ static void urldecode(char *buf) static int hexit(char c) { - if ( c >= '0' && c <= '9' ) + if (c >= '0' && c <= '9') return c - '0'; - if ( c >= 'a' && c <= 'f' ) + else if (c >= 'a' && c <= 'f') return c - 'a' + 10; - if ( c >= 'A' && c <= 'F' ) + else if (c >= 'A' && c <= 'F') return c - 'A' + 10; - - return 0; + else + return 0; } static void send301(struct connstruct *cn) { char buf[2048]; - snprintf(buf, sizeof(buf), "HTTP/1.1 301 Moved Permanently\nLocation: %s/\n\n\n\n301 Moved Permanently\n\n

    Moved Permanently

    \nThe document has moved here.

    \n

    \n\n", cn->filereq, cn->filereq); + snprintf(buf, sizeof(buf), + "HTTP/1.1 301 Moved Permanently\nLocation: %s/\n\n" + "\n" + "\n301 Moved Permanently\n" + "\n

    Moved Permanently

    \n" + "The document has moved here.

    \n" + "

    \n\n", cn->filereq, cn->filereq); special_write(cn, buf, strlen(buf)); } static void send404(struct connstruct *cn) { char buf[1024]; - sprintf(buf, "HTTP/1.0 404 Not Found\nContent-Type: text/html\n\n\n404 Not Found

    It ain't there my friend. (404 Not Found)

    \n\n"); + strcpy(buf, "HTTP/1.0 404 Not Found\nContent-Type: text/html\n\n" + "\n404 Not Found

    " + "404 Not Found

    \n\n"); special_write(cn, buf, strlen(buf)); } +static void buildactualfile(struct connstruct *cn) +{ + snprintf(cn->actualfile, MAXREQUESTLENGTH, "%s%s", webroot, cn->filereq); + + /* Add directory slash if not there */ + if (isdir(cn->actualfile) && + cn->actualfile[strlen(cn->actualfile)-1] != '/') + strcat(cn->actualfile, "/"); + +#ifdef WIN32 + /* convert all the forward slashes to back slashes */ + { + char *t = cn->actualfile; + while ((t = strchr(t, '/'))) + { + *t++ = '\\'; + } + } +#endif +} + +static int sanitizefile(const char *buf) +{ + int len, i; + + // Don't accept anything not starting with a / + if (*buf != '/') + return 0; + + len = strlen(buf); + for (i = 0; i < len; i++) + { + // Check for "/." : In other words, don't send files starting with a . + // Notice, GOBBLES, that this includes ".." + if (buf[i] == '/' && buf[i+1] == '.') + return 0; + } + + return 1; +} + +static int sanitizehost(char *buf) +{ + while (*buf != '\0') + { + // Handle the port + if (*buf == ':') + { + *buf = '\0'; + return 1; + } + + // Enforce some basic URL rules... + if (isalnum(*buf)==0 && *buf != '-' && *buf != '.') return 0; + if (*buf == '.' && *(buf+1) == '.') return 0; + if (*buf == '.' && *(buf+1) == '-') return 0; + if (*buf == '-' && *(buf+1) == '.') return 0; + buf++; + } + + return 1; +} + diff --git a/www/index.html b/www/index.html index 86133dd771..5a391a34c9 100644 --- a/www/index.html +++ b/www/index.html @@ -1,7 +1,7 @@ An Overview of Cryptography - +

    @@ -12,7 +12,7 @@

    Gary C. Kessler
    May 1998
    -(26 September 2005) +(1 August 2006)


    @@ -193,7 +193,7 @@


    - +

    FIGURE 1: Three types of cryptography: secret-key, public key, and hash function.

    @@ -366,7 +366,7 @@

    FIGURE 1: Three types of cryptography: secret-key, public key, and hash func and suitability for both software and hardware implementations on common 32-bit processors as well as 8-bit processors (e.g., smart cards, cryptographic hardware, and embedded systems). Also described in - RFC 3713.

    + RFC 3713. Camellia's application in IPsec is described in RFC 4312.

  • MISTY1: Developed at Mitsubishi Electric Corp., a block cipher using a 128-bit key and 64-bit blocks, and a variable number of @@ -385,7 +385,7 @@

    FIGURE 1: Three types of cryptography: secret-key, public key, and hash func

  • SEED: A block cipher using 128-bit blocks and 128-bit keys. Developed by the Korea Information Security Agency (KISA) and adopted as a national -standard encryption algorithm in South Korea. Also described in RFC 4009.

    • +standard encryption algorithm in South Korea. Also described in RFC 4269.

  • Skipjack: SKC scheme proposed for Capstone. Although the details of the algorithm @@ -463,11 +463,16 @@

    FIGURE 1: Three types of cryptography: secret-key, public key, and hash func numbers, only have two factors!) The ability for computers to factor large numbers, and therefore attack schemes such as RSA, is rapidly improving and systems today can find the prime factors of numbers with -more than 140 digits. The presumed protection of RSA, however, is that -users can easily increase the key size to always stay ahead of the -computer processing curve. As an aside, the patent for RSA expired in -September 2000 which does not appear to have affected RSA's popularity -one way or the other. A detailed example of RSA is presented below in Section 5.3.

    • +more than 200 digits. Nevertheless, if a large number is created from +two prime factors that are roughly the same size, there is no known +factorization algorithm that will solve the problem in a reasonable +amount of time; a 2005 test to factor a 200-digit number took 1.5 years +and over 50 years of compute time (see the Wikipedia article on integer factorization.) +Regardless, one presumed protection of RSA is that users can easily +increase the key size to always stay ahead of the computer processing +curve. As an aside, the patent for RSA expired in September 2000 which +does not appear to have affected RSA's popularity one way or the other. +A detailed example of RSA is presented below in Section 5.3.

  • Diffie-Hellman: After the RSA algorithm was published, Diffie and Hellman came up with @@ -590,17 +595,7 @@

    FIGURE 1: Three types of cryptography: secret-key, public key, and hash func of a file's contents, often used to ensure that the file has not been altered by an intruder or virus. Hash functions are also commonly employed by many operating systems to encrypt passwords. Hash -functions, then, help preserve the integrity of a file.

    -

    -Hash functions are sometimes misunderstood and some -sources claim that no two files can have the same hash value. This -isn't true, strictly speaking. Consider a hash function that provides a -128-bit hash value. There are, obviously, 2128 possible hash values. But there are a lot more than 2128 possible -files. Therefore, there have to be multiple files — in fact, there have -to be an infinite number of files! — that can have the same 128-bit -hash value. The difficulty is finding two files with the same -hash! What is, indeed, very hard to do is to try to create a file that -has a given hash value so as to force a hash value collision.

    +functions, then, provide a measure of the integrity of a file.

    Hash algorithms that are in common use today include:

    @@ -616,27 +611,60 @@

    FIGURE 1: Three types of cryptography: secret-key, public key, and hash func a large number of products although several weaknesses in the algorithm were demonstrated by German cryptographer Hans Dobbertin in 1996.

    • -

  • Secure Hash Algorithm (SHA): Algorithm for NIST's Secure Hash Standard (SHS). SHA-1 produces a 160-bit hash value and was -originally published as FIPS 180-1 and RFC 3174. FIPS 180-2 +originally published as FIPS 180-1 and RFC 3174. FIPS 180-2 describes five algorithms in the SHS: SHA-1 plus SHA-224, SHA-256, SHA-384, and SHA-512 which can produce hash values that are 224, 256, -384, or 512 bits in length, respectively.

    • - +384, or 512 bits in length, respectively. SHA-224, -256, -384, and -52 +are also described in RFC 4634.

  • RIPEMD: A series of message digests that initially came from the RIPE (RACE Integrity Primitives Evaluation) project. RIPEMD-160 was designed by Hans Dobbertin, Antoon Bosselaers, and Bart Preneel, and optimized for 32-bit processors to replace the then-current 128-bit hash functions. Other versions include RIPEMD-256, RIPEMD-320, and RIPEMD-128.

    • -

  • HAVAL (HAsh of VAriable Length): Designed by Y. Zheng, J. Pieprzyk and J. Seberry, a hash algorithm with many levels of security. HAVAL can create hash values that are 128, 160, 192, 224, or 256 bits in length.

    • +

  • Whirlpool: A relatively new hash function, designed by V. Rijmen and P.S.L.M. Barreto. Whirlpool operates on messages less than 2256 +bits in length, and produces a message digest of 512 bits. The design +of this has function is very different than that of MD5 and SHA-1, +making it immune to the same attacks as on those hashes (see below).

    • + + +

    +Hash functions are sometimes misunderstood and some +sources claim that no two files can have the same hash value. This is, +in fact, not correct. Consider a hash function that provides a 128-bit +hash value. There are, obviously, 2128 possible hash values. But there are a lot more than 2128 possible +files. Therefore, there have to be multiple files — in fact, there have +to be an infinite number of files! — that can have the same 128-bit +hash value.

    +

    +The difficulty is finding two files with the same +hash! What is, indeed, very hard to do is to try to create a file that +has a given hash value so as to force a hash value collision — which is +the reason that hash functions are used extensively for information +security and computer forensics applications. Alas, researchers in 2004 +found that practical collision attacks could be launched on +MD5, SHA-1, and other hash algorithms. At this time, there is no +obvious successor to MD5 and SHA-1 that could be put into use quickly; +there are so many products using these hash functions that it could +take many years to flush out all use of 128- and 160-bit hashes. +Readers interested in this problem should read the following:

    + + +

    -For additional information, see David Hopwood's MessageDigest Algorithms page.

    +An excellent review of the situation with hash collisions can be found in RFC 4270 (by P. Hoffman and B. Schneier, November 2005). And for additional information on hash functions, see David Hopwood's MessageDigest Algorithms page.

    3.4. Why Three Encryption Techniques?

    @@ -663,7 +691,7 @@

    FIGURE 1: Three types of cryptography: secret-key, public key, and hash func


    - +

    FIGURE 2: Sample application of the three cryptographic techniques for secure communication.

    @@ -972,7 +1000,7 @@

    FIGURE 2: Sample application of the three cryptographic techniques for secur

    - +

    FIGURE 3: Kerberos architecture.

    @@ -1065,7 +1093,7 @@

    FIGURE 3: Kerberos architecture.



    - +

    FIGURE 4: GTE Cybertrust Global Root-issued certificate as viewed
    by Netscape Navigator V4.

    @@ -1238,6 +1266,11 @@

    FIGURE 4: GTE Cybertrust Global Root-issued certificate as viewed
    by Nets A PCMCIA card developed by NSA that implements the Capstone algorithms, intended for use with the Defense Messaging Service (DMS). +GOST +GOST is a family of algorithms that +is defined in the Russian cryptographic standards. Although most of the +specifications are written in Russian, RFC 4357 provides supplemental information and specifications so that the algorithms can be used effectively in Internet applications. + IP Security Protocol (IPsec) The IPsec protocol suite is used to @@ -1245,24 +1278,37 @@

    FIGURE 4: GTE Cybertrust Global Root-issued certificate as viewed
    by Nets overview of the protocol suite and of the documents comprising IPsec can be found in RFC 2411. Other documents include:
      -
    • RFC 2401: IP security architecture. -
    • RFC 2402: +
    • RFC 4301: IP security architecture. +
    • RFC 4302: IP Authentication Header (AH), one of the two primary IPsec functions; AH provides connectionless integrity and data origin authentication for IP datagrams and protects against replay attacks. -
    • RFC 2403: Describes use of the HMAC with MD5 algorithm for data origin authentication and integrity protection in both AH and ESP. -
    • RFC 2404: Describes use of the HMAC with SHA-1 algorithm for data origin authentication and integrity protection in both AH and ESP. -
    • RFC 2405: Describes use of DES-CBC (DES in Cipher Block Chaining Mode) for confidentiality in ESP. -
    • RFC 2406: +
    • RFC 4303: IP Encapsulating Security Payload (ESP), the other primary IPsec function; ESP provides a variety of security services within IPsec. -
    • RFC 2407: Describes the application of ISAKMP to IPsec. -
    • RFC 2408: Describes ISAKMP, a framework for key management and security associations. -
    • RFC 2409: -The Internet Key Exchange (IKE) algorithm, using part of Oakley and -part of SKEME in conjunction with ISAKMP to obtain authenticated keying -material for use with ISAKMP, and for other security associations such -as AH and ESP. +
    • RFC 4304: +Extended Sequence Number (ESN) Addendum, allows for negotiation of a +32- or 64- bit sequence number, used to detect replay attacks.
      • +
    • RFC 4305: Cryptographic algorithm implementation requirements for ESP and AH.
      • +
    • RFC 4306: +The Internet Key Exchange (IKE) protocol, version 2, providing for +mutual authentication and establishing and maintaining security +associations.
      • +
        +
      • IKE v1 was described in three separate documents, RFC 2407 (application of ISAKMP to IPsec), RFC 2408 (ISAKMP, a framework for key management and security associations), and RFC 2409 +(IKE, using part of Oakley and part of SKEME in conjunction with ISAKMP +to obtain authenticated keying material for use with ISAKMP, and for +other security associations such as AH and ESP). IKE v1 is obsoleted +with the introdcution of IKEv2.
        • +
      +
    • RFC 4307: Cryptographic algoritms used with IKEv2.
      • +
    • RFC 4308: Crypto suites for IPsec, IKE, and IKEv2.
      • +
    • RFC 4309: The use of AES in CBC-MAC mode with IPsec ESP.
      • +
    • RFC 4312: The use of the Camellia cipher algorithm in IPsec.
      • +
    • RFC 4359: The Use of RSA/SHA-1 Signatures within Encapsulating Security Payload (ESP) and Authentication Header (AH).
      • +
    • RFC 4434: Describes AES-XCBC-PRF-128, a pseudo-random function derived from the AES for use with IKE.
      • +
    • RFC 2403: Describes use of the HMAC with MD5 algorithm for data origin authentication and integrity protection in both AH and ESP. +
    • RFC 2405: Describes use of DES-CBC (DES in Cipher Block Chaining Mode) for confidentiality in ESP.
    • RFC 2410: Defines use of the NULL encryption algorithm (i.e., provides authentication and integrity without confidentiality) in ESP.
    • RFC 2412: Describes OAKLEY, a key determination and distribution protocol.
    • RFC 2451: Describes use of Cipher Block Chaining (CBC) mode cipher algorithms with ESP. @@ -1374,7 +1420,19 @@

      FIGURE 4: GTE Cybertrust Global Root-issued certificate as viewed
      by Nets valid SGC certificate. SGC is available in 32-bit Windows versions of Internet Explorer (IE) 4.0, and support for Mac, Unix, and 16-bit Windows versions of IE is expected in the future. -Simple Key-Management for Internet Protocol (SKIP) +Simple Authentication and Security Layer (SASL) +(SASL) is a framework for providing +authentication and data security services in connection-oriented +protocols (a la TCP). It provides a structured interface and allows new +protocols to reuse existing authentication mechanisms and allows old +protocols to make use of new mechanisms. +

      It has been common practice on the Internet to permit anonymous +access to various services, employing a plain-text password using a +user name of "anonymous" and a password of an email address or some +other identifying information. New IETF protocols disallow plain-text +logins. The Anonymous SASL Mechanism (RFC 4505) provides a method for anonymous logins within the SASL framework. + +

      Simple Key-Management for Internet Protocol (SKIP) Key management scheme for secure IP communication, specifically for IPsec, and designed by Aziz and Diffie. SKIP essentially defines a public key infrastructure for the Internet @@ -1739,10 +1797,13 @@

      FIGURE 4: GTE Cybertrust Global Root-issued certificate as viewed
      by Nets (OFB). Despite all of these options, ECB is the most commonly deployed mode of operation.

      -Although other block ciphers will replace DES, it is -still interesting to see how DES encryption is performed. Not only is -it sort of interesting, but DES remains in many products and we will -continue to see DES for some years to come.

      +NIST finally declared DES obsolete in 2004, and withdrew FIPS 46-3, 74, and 81 (Federal Register, July 26, 2004, 69(142), 44509-44510). +Although other block ciphers will replace DES, it is still interesting +to see how DES encryption is performed; not only is it sort of neat, +but DES was the first crypto scheme commonly seen in non-govermental +applications and was the catalyst for modern "public" cryptography. DES +remains in many products — and cryptography students and cryptographers +will continue to study DES for years to come.

      DES Operational Overview

      @@ -1756,7 +1817,7 @@

      FIGURE 4: GTE Cybertrust Global Root-issued certificate as viewed
      by Nets
      - +

      FIGURE 6: DES enciphering algorithm.

      @@ -2148,7 +2209,7 @@

      FIGURE 6: DES enciphering algorithm.

      intended primarily for IP version 6 (IPv6), IPsec can also be employed by the current version of IP, namely IP version 4 (IPv4).

      -As shown in Table 3, IPsec is described in nearly a dozen RFCs. RFC 2401, in particular, describes the overall IP security architecture and RFC 2411 provides an overview of the IPsec protocol suite and the documents describing it.

      +As shown in Table 3, IPsec is described in nearly a dozen RFCs. RFC 4301, in particular, describes the overall IP security architecture and RFC 2411 provides an overview of the IPsec protocol suite and the documents describing it.

      IPsec can provide either message authentication and/or encryption. The latter requires more processing than the former, but @@ -2173,7 +2234,7 @@

      FIGURE 6: DES enciphering algorithm.

    • security protocol (AH or ESP) identifier

    -The IP Authentication Header (AH), described in RFC 2402, provides a mechanism for data integrity and data origin authentication for IP packets using HMAC with MD5 (RFC 2403), HMAC with SHA-1 (RFC 2404), or HMAC with RIPEMD (RFC 2857).

    +The IP Authentication Header (AH), described in RFC 4302, provides a mechanism for data integrity and data origin authentication for IP packets using HMAC with MD5 (RFC 2403), HMAC with SHA-1 (RFC 2404), or HMAC with RIPEMD (RFC 2857). See also RFC 4305.


    @@ -2190,12 +2251,12 @@

    FIGURE 6: DES enciphering algorithm.

    | Sequence Number Field | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | - + Authentication Data (variable) | + + Integrity Check Value-ICV (variable) | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

    -

    FIGURE 10: IPsec Authentication Header format. (From RFC 2402)

    +

    FIGURE 10: IPsec Authentication Header format. (From RFC 4302)



    @@ -2242,38 +2303,44 @@

    FIGURE 6: DES enciphering algorithm.

    algorithms may also be supported.

    -The IP Encapsulating Security Payload (ESP), described in RFC 2406, +The IP Encapsulating Security Payload (ESP), described in RFC 4303, provides message integrity and privacy mechanisms in addition to authentication. As in AH, ESP uses HMAC with MD5, SHA-1, or RIPEMD -authentication (RFC 2403/RFC 2404/RFC 2857); privacy is provided using DES-CBC encryption (RFC 2405), NULL encryption (RFC 2410), other CBC-mode algorithms (RFC 2451), or AES (RFC 3686).

    +authentication (RFC 2403/RFC 2404/RFC 2857); privacy is provided using DES-CBC encryption (RFC 2405), NULL encryption (RFC 2410), other CBC-mode algorithms (RFC 2451), or AES (RFC 3686). See also RFC 4305 and RFC 4308.


    -
    +
         0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |               Security Parameters Index (SPI)                 |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                      Sequence Number                          |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                    Payload Data (variable)                    |
-   ~                                                               ~
-   |                                                               |
-   +               +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |               |     Padding (0-255 bytes)                     |
-   +-+-+-+-+-+-+-+-+               +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                               |  Pad Length   | Next Header   |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                 Authentication Data (variable)                |
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ----
+   |               Security Parameters Index (SPI)                 | ^Int.
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |Cov-
+   |                      Sequence Number                          | |ered
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ----  
+   |                    Payload Data* (variable)                   | |   ^
+   ~                                                               ~ |   |
+   |                                                               | |Conf.
+   +               +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |Cov-
+   |               |     Padding (0-255 bytes)                     | |ered*
+   +-+-+-+-+-+-+-+-+               +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |   |
+   |                               |  Pad Length   | Next Header   | v   v
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ------
+   |         Integrity Check Value-ICV   (variable)                |
    ~                                                               ~
    |                                                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+       * If included in the Payload field, cryptographic synchronization
+         data, e.g., an Initialization Vector (IV), usually is not
+         encrypted per se, although it often is referred to as being
+         being part of the ciphertext.
+

    -

    FIGURE 11: IPsec Encapsulating Security Payload format. (From RFC 2406)

    +

    FIGURE 11: IPsec Encapsulating Security Payload format. (From RFC 4303)



    @@ -2322,60 +2389,62 @@

    FIGURE 6: DES enciphering algorithm.


    -
    +
    -    ORIGINAL PACKET BEFORE APPLYING AH
+  ORIGINAL PACKET BEFORE APPLYING AH
 
-            ----------------------------
-      IPv4  |orig IP hdr  |     |      |
-            |(any options)| TCP | Data |
-            ----------------------------
+         ----------------------------
+   IPv4  |orig IP hdr  |     |      |
+         |(any options)| TCP | Data |
+         ----------------------------
 
-            ---------------------------------------
-      IPv6  |             | ext hdrs |     |      |
-            | orig IP hdr |if present| TCP | Data |
-            ---------------------------------------
+         ---------------------------------------
+   IPv6  |             | ext hdrs |     |      |
+         | orig IP hdr |if present| TCP | Data |
+         ---------------------------------------
 
+  AFTER APPLYING AH (TRANSPORT MODE)
 
-    AFTER APPLYING AH (TRANSPORT MODE)
+          -------------------------------------------------------
+    IPv4  |original IP hdr (any options) | AH | TCP |    Data   |
+          -------------------------------------------------------
+          |<- mutable field processing ->|<- immutable fields ->|
+          |<----- authenticated except for mutable fields ----->|
 
-            ---------------------------------
-      IPv4  |orig IP hdr  |    |     |      |
-            |(any options)| AH | TCP | Data |
-            ---------------------------------
-            |<------- authenticated ------->|
-                 except for mutable fields
+         ------------------------------------------------------------
+   IPv6  |             |hop-by-hop, dest*, |    | dest |     |      |
+         |orig IP hdr  |routing, fragment. | AH | opt* | TCP | Data |
+         ------------------------------------------------------------
+         |<--- mutable field processing -->|<-- immutable fields -->|
+         |<---- authenticated except for mutable fields ----------->|
 
-            ------------------------------------------------------------
-      IPv6  |             |hop-by-hop, dest*, |    | dest |     |      |
-            |orig IP hdr  |routing, fragment. | AH | opt* | TCP | Data |
-            ------------------------------------------------------------
-            |<---- authenticated except for mutable fields ----------->|
-
-                 * = if present, could be before AH, after AH, or both
+               * = if present, could be before AH, after AH, or both
 
 
-    AFTER APPLYING AH (TUNNEL MODE)
+  AFTER APPLYING AH (TUNNEL MODE)
 
-          ------------------------------------------------
-    IPv4  | new IP hdr* |    | orig IP hdr*  |    |      |
-          |(any options)| AH | (any options) |TCP | Data |
-          ------------------------------------------------
-          |<- authenticated except for mutable fields -->|
+        ----------------------------------------------------------------
+   IPv4 |                              |    | orig IP hdr*  |   |      |
+        |new IP header * (any options) | AH | (any options) |TCP| Data |
+        ----------------------------------------------------------------
+        |<- mutable field processing ->|<------ immutable fields ----->|
+        |<- authenticated except for mutable fields in the new IP hdr->|
 
-          |           in the new IP hdr                  |
+        --------------------------------------------------------------
+   IPv6 |           | ext hdrs*|    |            | ext hdrs*|   |    |
+        |new IP hdr*|if present| AH |orig IP hdr*|if present|TCP|Data|
+        --------------------------------------------------------------
+        |<--- mutable field -->|<--------- immutable fields -------->|
+        |       processing     |
+        |<-- authenticated except for mutable fields in new IP hdr ->|
 
-          --------------------------------------------------------------
-    IPv6  |           | ext hdrs*|    |            | ext hdrs*|   |    |
-          |new IP hdr*|if present| AH |orig IP hdr*|if present|TCP|Data|
-          --------------------------------------------------------------
-          |<-- authenticated except for mutable fields in new IP hdr ->|
+          * = if present, construction of outer IP hdr/extensions and
+              modification of inner IP hdr/extensions is discussed in
+              the Security Architecture document.
 
-           * = construction of outer IP hdr/extensions and modification
-               of inner IP hdr/extensions is discussed below.

    -

    FIGURE 12: IPsec tunnel and transport modes for AH. (Adapted from RFC 2402)

    +

    FIGURE 12: IPsec tunnel and transport modes for AH. (Adapted from RFC 4302)



    @@ -2397,7 +2466,7 @@

    FIGURE 6: DES enciphering algorithm.


    -
    +
         ORIGINAL PACKET BEFORE APPLYING ESP
 
@@ -2416,17 +2485,17 @@ 
    FIGURE 6: DES enciphering algorithm.
    
 
             -------------------------------------------------
       IPv4  |orig IP hdr  | ESP |     |      |   ESP   | ESP|
-            |(any options)| Hdr | TCP | Data | Trailer |Auth|
+            |(any options)| Hdr | TCP | Data | Trailer | ICV|
             -------------------------------------------------
-                                |<----- encrypted ---->|
-                          |<------ authenticated ----->|
+                                |<---- encryption ---->|
+                          |<-------- integrity ------->|
 
             ---------------------------------------------------------
-      IPv6  | orig |hop-by-hop,dest*,|ESP|dest|   |    | ESP   | ESP|
-            |IP hdr|routing,fragment.|hdr|opt*|TCP|Data|Trailer|Auth|
+      IPv6  | orig |hop-by-hop,dest*,|   |dest|   |    | ESP   | ESP|
+            |IP hdr|routing,fragment.|ESP|opt*|TCP|Data|Trailer| ICV|
             ---------------------------------------------------------
-                                         |<---- encrypted ---->|
-                                     |<---- authenticated ---->|
+                                         |<--- encryption ---->|
+                                     |<------ integrity ------>|
 
                 * = if present, could be before ESP, after ESP, or both
 
@@ -2434,24 +2503,27 @@ 
    FIGURE 6: DES enciphering algorithm.
    
     AFTER APPLYING ESP (TUNNEL MODE)
 
             -----------------------------------------------------------
-      IPv4  | new IP hdr  | ESP | orig IP hdr   |   |    | ESP   | ESP|
-            |(any options)| hdr | (any options) |TCP|Data|Trailer|Auth|
+      IPv4  | new IP hdr+ |     | orig IP hdr+  |   |    | ESP   | ESP|
+            |(any options)| ESP | (any options) |TCP|Data|Trailer| ICV|
 
             -----------------------------------------------------------
-                                |<--------- encrypted ---------->|
-                          |<----------- authenticated ---------->|
+                                |<--------- encryption --------->|
+                          |<------------- integrity ------------>|
 
             ------------------------------------------------------------
-      IPv6  | new+ |new ext |ESP| orig+|orig ext |   |    | ESP   | ESP|
-            |IP hdr| hdrs+  |hdr|IP hdr| hdrs+   |TCP|Data|Trailer|Auth|
+      IPv6  | new+ |new ext |   | orig+|orig ext |   |    | ESP   | ESP|
+            |IP hdr| hdrs+  |ESP|IP hdr| hdrs+   |TCP|Data|Trailer| ICV|
             ------------------------------------------------------------
-                                |<--------- encrypted ----------->|
-                            |<---------- authenticated ---------->|
+                                |<--------- encryption ---------->|
+                            |<------------ integrity ------------>|
+
+            + = if present, construction of outer IP hdr/extensions and
+                modification of inner IP hdr/extensions is discussed in
+                the Security Architecture document.
 
-               + = if present

    -

    FIGURE 13: IPsec tunnel and transport modes for ESP. (Adapted from RFC 2406)

    +

    FIGURE 13: IPsec tunnel and transport modes for ESP. (Adapted from RFC 4303)



    @@ -2563,7 +2635,7 @@

    FIGURE 6: DES enciphering algorithm.


    - +

    FIGURE 14: SSL v3 configuration screen (Netscape Navigator).

    @@ -2573,10 +2645,9 @@

    FIGURE 14: SSL v3 configuration screen (Netscape Navigator).

    In 1997, SSL v3 was found to be breakable. By this time, the Internet Engineering Task Force (IETF) had already started work on a new, non-proprietary protocol called Transport Layer Security (TLS), -described in RFC 2246. -TLS extends SSL and supports additional crypto schemes, such as -Diffie-Hellman key exchange and DSS digital signatures. TLS is backward -compatible with SSL (and, in fact, is recognized as SSL v3.1).

    +described in RFC 2246. TLS extends SSL and supports additional crypto schemes, such as Diffie-Hellman key exchange and DSS digital signatures; RFC 4279 +describes the pre-shared key crypto schemes supported by TLS. TLS is +backward compatible with SSL (and, in fact, is recognized as SSL v3.1).


    uF+d zwA7CQYy+q#L*)54jc(J8(q-f%IaAA~#OZze@}gjd9Nk&a#|>t^b8J+ep_GqMlPm%% z*3}73hHFdi4CR=45Kr#58;9V>i zkC*QC;*5wQlqcz2 z!&Oj^K;ol55S~REMqTY-4V+M;;n>8`qeE1~+B;dTp|7KU(BuwJGer+k zAY7LZ@rgY@L*!9cRtUwfwSOQp`-VAF%#qyY%&Xqr|q)=Q&=n z83A1j(}Bx2PaBbD(FL4{ub_ctgEKo^6v`ggWzCD3wQPqzTlW{0%d34N?oXU(-f}t4wUc8+D80a5V}^& zQ@1IK%Rtve*n_(d@V6fc@CpQX=d6JqacRpMt%1GYF@lnQz(vj29(j=p?3ORh!7aGy z@6qty{2(CWo> zq!k)i*n|<}s^)fJwbi)S)}a9-%wK7_76QRa`7A4|IE)J@bg;T5j<34(`jM+)mqVk1 zxeqbUoY2}MRw{V)Z;SfkdccnR3lU(WVKBB~HjR$)T-9Jq#DKWwjvzNU?Z zx^=b5qFs5h=8Thwf!;D!k0V1Egb;2p9gWUzD5ZE{|H2gvHRwrEqXccDY2;j@simu` zsMD4pE?i-=DurBGLnwpFY}ri4O!QCIDm@*T#?@Vv1^7xPJS2zAm;v0>gx_ln^EdU|C6`N_F(zlD1{*5j zuZz1Zd=6&Z)5{;1b4jVZv62zWwS;-;2el|Y$Qpi2l}iy`bcBi51o^eyAu9vx*M=AM zMpXoNRAjiDqEC*|*N2I$L9Qh_#>#H=HikWETTQ#vED|N_XniqEjb7TcZAhpS0Dl$SI2*8u#SE+6 zvc;|oIP@2vwLA1pMllzFneVsl2*KtCH4|m4(|;I)88B2XLZe_v1gVf8P2z{^Q5^c<~=8 z`g7~yVhNz%IsPMubv|=~I-ku9=}ZHCp5^%vj!dL1xwh{K4CI~+n25CJmJ>tKkmOq} z`B?D5x7wu_x9-bFn%v!bV8)kc7o>GpA{N}>MyjRW>s$^;ha=4ESIrB^pnTPUFc#Wu z2TtZ@^bhq5xP1~~>AV_$RMPu}D8ZIuPNQxKeV=@)UbnvZLj85#wdrN6dD>P5OkuF= zwN=}qj)_Tl)l^N|5sHo)rAbp^34&m8ZTE(y#ngg@O^8NSnuaf0ugj@LFad8+UR7sk zvns==yt;Crp{h1(Mtq%33%m;j906ev(u@)7w5(*lWYph4Zwd8wJz8a@HoEeW6(2@j zSa0Yut;#YjQ>N{dLC!1m({gl&S1Ic_~PkBouGt6RL$WRqRaT+Bo&PN_tmjoQD(aOJ8P^e}ZnspG{4glS#WZ{G3tUyX!Izxo9M0!+|Xwx4qJl=Mt!KQTC~QGes* z+*^OFR>~PSFLj_-0n1B<9E(v-R!!Zy))%QpYylHn_R@k^fuw zKQHHhy8qeF^8d&9Nco>uym=WZY~Tb?t@ge4uOlV?-*0cUT4fEuo~kmmaaNT$J{q1* zVsbKuYd0nI_ZHI%*nS z4$`uNX7~ag zQi)+^UmqTqUT3*|eSC6MdQbWaTjtsJ$ycR97jbcJi|m$%i5>`40&Y5+c;ESU>Fp+E zm{R4t+t2sRxv<}bS^&M!MY0FyyQ&=B2|xv72)qgCvib-jB;Z#!#?g41pZ9e11Yki; z;l`#@h}|}I36TI1jo{cnp{3mte%3tO&kXvX!QS~02f%Flf4|lKyzSHfho3+Anf`x_ zk3;`y#Zd+P`F)cDXdSWvZL}V2v;rxB)UHqaN_vd;?j1&Tun5nu6&HQc;Dg|LQQ~iM z0wt44nn6k+nI@<|EI&fh{%B4%A)M2V4-o{ma>+UPXXblM*bM+uTZ<5iQu zJu$+SFB)SAM5C5*e;P+X(;>nuDMg~<923@>2oxv=`c(Ne%SK6zG`Yo;R)!A_*e^jX zh&Cauz|26!)gqJ|SbARjG~b9m%@t^LVNB7i=8{e7iHUn_{1B@esRgU)vI<7Y8QrEP zsXL$hVLuNT4Yn2(TqkFV^tJiSmAu`6h>$ZTt?Egc2MD66wEG_0V1 zt6qPyx8I5G-fduGs17m?1T9J;10}xNKG@ywG#V}<4zn(*l>;X}!sYI?Z^nsD$LY1j zk}2B-sL`6ZHs&QfKT8T!extrg4dkfvbWbrnzui07?R;Aro4$mHW;tHKAO9HL=7x;Z z26bUxP2xAn@23g78Aq0uf=4z0LkqL=8d~t!8|{AAAXF_b3W)v!)PVv(mqyM*y34uc z`A*|E=ZeZ;;AaZ(q(+8OQXwUJJbDvf=OS^yD{6FEmZRuU=-dX3CEEo;%51e*Sa37S zGt3V{q3egx5;-?SIR2&%OpUFo*RXn+O9UEpqd_u=(&Wt?AdUfwa?fB=Qh~i3zKlxH zHl<27+qRe`42yNOqiYKXL@rzjA9DjZ4}-|PVykVrHsgU4QxizKi9!ZSyF*@UmgQYX#q>|xw7s!kWbYGYZ*5oT*GT7 z5L6!~c6ZDm6$Y4kmgZE%ASgxejqj(1QAX$D_E5P`+7vIsh3| z%Ti4nR~4bI@p3quvQE_1k(z+O)x%(^90f;c=nnHVOPPXN;syZ-l47XQvvcsx-qGO! z6KTW$kmr4-L28ZOFm|UpxuzK50JpKFusjh1ql%G-&6jC0Ve{Q}7Zc)xoTWfp1UaLW z)Vbzh>5*Z21~Lc@{s1;KmA~K;SNv2&h+yOnUOEhvC!!DT8%>AC7d&(XQ$duCCfukv zbq1yKpN<>Ahg6?FJaCMxQz`koj1TQj9PksDXJ9k`God3S$B|kg}ii`0g2WM!E zT(y3q0nrP8Fw_;$q5v;M%sAu(Pp+K(q$%o5GRE~#RRtT+VF6tJb+t8PQ%c^-keW|( z!=uplgdIl$A@vJasxKvg2Bk$f>&}>TvxHe99;PMi*#wzgr0&`Yv=W6K8AFSGjvQx< zTdPq3K6AFIZdRfMKaQ;6#o~(TyKMZ*b-WXZq7q@cw_&jiXAfNL_8lJ0@p=SQG;vW{ zPCtx9c{LIluLc{?M!PEu8GAl5&ZWkvK?vv$EmKzsW z_595c)8Qo;TL4mDXm`hm(2q+l!XhF9x~i6eo}bw?Vjti5WSvcf!X!wavX%5_4)t-? zhro$Qost_0o3ktniX#&@(F79-T@Wsn*%WK z#p$3vpk+UJ@$7NusC&G#eb9{Vke;OFD-)?F09ii>BgO;6L^Cms)h3CDBjY(FCID7U z-6Sj7JvgJsyffenk`%o<5!h*pKYE(r8r6(NF1i_WHebC5{D0^0Ntq5HB+G=a49ETM zV+w9}YSd>Ci4JZ;F;Kv1!`_)~TK74!rXirw-WcmmF`gu29sllB9@c7#d3}uQqk6>< zd*GuAbM}4S6$sr}mHS=6m_f6ak~#tY#3JIv75qkt7DmaFS5QA45gpeQEU3xTUSzJL z0KVMHSj=XG5;^Gh#@~%rTQ6ZHmcLJz8*w#2gp&U=h>U+0y7e2kqv&M zD^2_)OVk%>;YQb@#==+&T}N9!zHy+V$+Z~=9)dVBiqSf};G@qtl`n|m*x@4p0C%10 zYY&W0kDXB%2X(+kasE0nUW_ROpdDcB;jvNeLAQ#6Lt~mU1aKzR@jz2>{?>q`bVV3$ zU(fSZy3A0e2zJ_67RI~|`h*n2n?iRwCwZz`(Mex19xmh!00L)MVlf=ln=&=~reb@R zr41Z=70!{QHOUK0TT{hC5M97Wg!-1PkGOSY6=t{XBlet@V{X|hSna2@B>zy?3%+in z@~d4BVM2grcTXhY3Jp2!ZUCG*5q?MNfg*T$VNOyJJURu( z8QjzrQuIuj+{Db+3Nb0|vkX#_R2Od5NUlMVw_3{gRoOE%Y4C*IpHU4~*NF$|xX`DC zqiD0}4L1oR7{oPe)xLCSu+_tbOA{VZH{sn@jYnPwp22~=z=sy72RGreIB}F9Av3BH zkc1Ya1fzDt2<~S|3c|TM9ykRr0>+CspYvgCqx1&UC{-%~ALn{QFdDbcKQkF?CGtNW4k9pX$4&bZ?ZAcRNBXdD3o z$rqLt6!HcQ&!&+BwfBa$B!Ed)qhQ7y;{4y$9VE2UxsbvCSLh z-kjxrr@qVzRJZQg#G`4d@H`-Ej;688AXEGrHcyZ7D?ipIqx$ZLAEWx29^+Sj42o`g z3g7fYGB$168y|i#w#CPyJa9xcbNRs!`8JoH^AG(>9gqB6edC8nD(NYHt#CL9gKTgk zhz%ToX~+y5!0?;~a!Npv@ELqD&k(iwF@E0BBowb3{U*~Xf- z`_Wa__=Q@-ax?o~3QJGqh9CkDIv3vfge1LCX+;Lz3vGHsR3YbwA+#yPsSQd+{jRPUF$_ACd**e+ieZ9&m=P7uP6LEhh6l zyVPhszpkCbqs|=1u72h@b-|q7CpPGqcsPzHc{1@HVhpmW11N=C|rJB+-@*2l#Fa5Aio*0(?n_^d}=9IjpES4s|l>3Uo5S^Wr?AzmqBUgLkL! z1#ek(`L#88v_^lnw&34K`0p3^?>}tmf?tpZ?Ge5M_Kd#KGSl}Y8$9CTz_JqeZi17= zmq}N_scTmk9;t6lxhRdMS^kE{)k5*8u67!;d{7f@SBUj{rf(b3zdEN3hMH{!XXt1p zYANpZl-}eb9<-Y{(cYhnq7b@A-~OE3YYVfAZ@X&ikbWCRR2wlV(1{D-IukTLHLGT} z85(5|cdK(U!gLf{aOx*yjC2FZbuj)l^<0@lro#;(A>E|LZ$5*PVmze&>L@EELF!{Bq57BvaoES6ZQQ$V_?~Z`Gn7AMIF8^RL#` zOGz2*XxeIgAq2&j*5VL#d9GP4){IlxL{$)TvMBpv1 ziW7vxY{2SkYw?J0eowycf)uskJmLJbMY5Dv0Wuw)%)A?Oj>`hFnN@ct| z+|v93Nw8fBFn5b;dg4#nv1HHBN-)4TFqH2IXn8X5KMH2T!TaM_2w;2`t3M5G`1&s~Vf9DE- zn)0eMX>yHJ{*@{vQs5TFFo!$(jBj)ytRHE1GAjUEzcs3jme78PO2@>i$jiwRf%`KE zm^`S#Cw8b+ zXph?cJ{2vmthhTu^A39lCuS!&Xi1C%Zc_A0H5O2$sx4!5QUu%_nvsilzuP;E?*5@^ z5s5cDVVxRbKk1FZmPtW*d2M-mQ>mdmUqLNTy7G;$O z@aVv?>vjgY@DlZ)!xzo?R2_6^I3b?VsNqrtzc3Pn86-`Mn{MW8Ubdl*(d3!}x@$}J z)R>Qsw(LFW-2Kj$xvlnZ z?|f3nyGF@@JC}@jOJ3sLOFAfLcLQ))4_X=xj03V5^4B7BjC0dy%bu;s>dC{^v49Jo zzuJOyb=9WG9e2Hm}!{DBL$JU zqw2ETLU4{{#@xpTHLDHKW&f5$*Aa{qpJ8Jt_ZNMc+3Jy)L_olGoF@z`%;clc=3x0dRFBd3m&=Vxvab`-c}upn+?a)!5e;f(MGJ_=DaLIl z2bq<|zY*0}@f#bbl@o4*Sz?x+b;E48zsE>iQecySvT&+Hqm4Q|VsxSGOmAY$4wI8d zBoNGMQ}j;3EHrT4Sv+b7+9CE7RS

    Jxe4T7~${Pr|e!x176#BF9a_SGD z1t2#J${P&2`iY`A0JV8-4$5lC*HXx7h&E)=ci*k8t-X8+xYtj{>bQghS^-YYPeF}C z4(q1gdSG1AkDYP^pO-%Yd|ockTOyFQ0+4EZKwVwktbiRffE)M`dRp*2Jvc6~{&Rq=2KKpNy*5vPF-<+gs4e2cx=@RvK%m5|xA{OvD!Xi{CMFolZhLYJn{Wp$zNweQwh1{q

    Djq=idib>(Y6rZVV2x) z0TA0m2vieJ;vodmOIZ#>Z3WO1cMt&rhA0A*Gbk2$WTWD2(sq5{f8UJ0S4jN5k`cg! z>iaLwF+d5Dycdrl$<*(sN!m;3UK1SBDky?o4Xoeu zUcGgGg>cE1u-}5smBHgT=O2zvdx6tX`(MoBa}=$I?BH69_|E5FYoT+m`qV2MZi6ky z!WxGv2IO7jh`Aio49=)($*7%Gr1tW#JA4qnARE85Tg~CZFFr z$;<93!@?!#sRj2e@p&G%_exh>#xTVF;iRAxUViKZJtXLkm|vH`_>wWA9~lt?bHu4$ zh4|%@xY=l7Ka1{K4e|Uun-rl=nT*|Du5Xxvvs_4$) z!Or%HDJ;tdHgT9&H7m7NS}C8l@YR8$x_>B>6bH=6l>Zo58o14^V3Rx@!Z1e_ zgf}BOaG_N$({g9@A(pm$oCM$+2J24%J*UrjG(L|Pxwmje0(Z`R^>R3X#O2u}WNoHD z!rViSvm`yt*dNaQ&%!q?vi^;D*G2f&Fx%?%iKZvMu^u`ZmF)9MqM9)=@v5&zEyY>8 zCT5%d&i3Hy@bB&-IOwwdtTT__DK)P{ta+C(`V(489VC+_4z&`aWR>sC(f+u;qNaHd zs8%CHie%sq*LtLEC16cLgaL+Yr2#|Jr;l$Ga$8%4=;#Z>oFmi6CHoK?i2~M4ccUBR zd)u6|Z)7$I%zR@M5a#>C96)qtLohhTh{A*mdRFWcV)q?-Ztv!d9SDNT*tK|8dU`ZL zSXx3D9Ql^i!=c#YMl_J~{wvYB(USv#Cv> zlqjC3Ptg;Ro+reWL0e5#?`)z3-J0unQv<+2IqQi7^c3zClF0?+V2|?ai_>fbx1ebT zHcF@0zBd6&pX>ET=%GR^5Tdpo_y8eFGnw^ zzZVB5+{ACb+S~6m2^5&xy9^LLZ4y+PTD+mD{C$%|PZ}ZpIp_$xCLRuX92=2MUpb*O zj}s5G40DY_(re^a9i11@GE2|Gv;ALbF)BszWD;MK) z*DVXYj=-A^cGffnH(Y%pbBtbOW*mO|t=5k+x0PJPifixX5uCJO*2B)cwqZ8kBi96N zPl7{$#l5V z92(GQ-657`25-}b*@IlA5Veg#4j@(AROjNM8G6GJroQyve#+)cSm*)!tZN4~PI*sTrNd`LGwkDW8*t0R(bqmhBaU zJB>#pWGGhq$yjaw1Pn@%a~h(R`%Og$?ADPU^b;9hKu^g_9joeKFo8g@0K=#tm3y&w zaH0gC(NvvN#r^iC|N2?y8N9qmF8o*chF>6;N0D>Ub~etV`~pHqr*Scz#EOTl=NZL6 ze+9*m8!(I}9M*;r%8>!Ge4cQQg@J&ZuXH~*zT3A^2~CrAYhht8I#J84r@;8YjWNMd0|M=Edpbk#hhp zKZ`i>oXKD~qzIYkagON$vUGI4X;VR_nc|eTNh;DKMiQc6pR5xG{}gG=9cIos6h~qR4skw>!OX40J_`zdruFZ zbrkqcqW$g*RSPR@Qkxu07=_kX(;QM@nv8iCV#}0;MKJlLuC{mBPh-@b#=Qg9YGNNa zdyu3^Wrw~d0O4V}dJbWEBg_bY#<>{O*2A4=RD2>11ztQQSL1rGnKW+Qs!MmpMl-4> z3Rb#sJRVX^!ukjci?Rt|BdRU!ww5iamdRdyy;0qF66gwh8Ftlg{Am~vOHf`Ms72W| zHR)&ls-b&SUmLe7ZLw{p_`C_x#5lyt8)dbgWDsDJLieE4xpfObv>bR_J&0Jc7yR8*APSVADwJJ2Ks5c zl232lZ`-vGb;=!DOBUU@mRiYLubuq?4CEf9?2;)O>HS# z#^RuDe+W+I5EdJva>+KF7rMV6oyIricsAck;2;Xcy-5aJ2(COQ*@%*=Xwr`i!#SkK zgCJ{g4Z@4BIvs(43Cpg~Co-e`YWrvx7yhJkd~$5jK1=)14%WuD#74$R1Bsbk`pSal z-?gk#&HrD-#W^IrfBzU@v-$tl{rig9_xS%-tMxPg|1mz2|2Hd60>I}a0IdJ&Ui&i; z0PcSlyaPDaNiCsz0!l-;5#T_NHx3A~icZtO1}sTcoifA8^}@L!ao#k)^X zhaNpsMW;wtp6{7&-#o4}SH5z4abibQ? z7)(-I?nV`SuU>+|l7roxzk5HuY(b!@g74MKg0q2=@7|BvG>dhk3cgn_3(f{gzI#9M z!l)L%7p}z%BSHLLSP(C~Jn?(257cfi-ch@vr)Cs--d+gbli_GVd{-skeWrs^mQ5BU zdQkK|db-Gh`D_9msgfTaqN>qgrhtAn1+im@?wI^z04CT_p>h~^hGQq*uYFtjVlbA2 zY=?>V?A@Tds5`i zNapX!QGem}#i9%B7tsAwZI%G#3LoN_J;~3U`O{_6p`y8LR9A9h(jaSnu&>$LYS9G}DD{)15BDXb zJc~|~UJOdZ>XzO6gbzF%K?60uC5lC|C=5KRXWx{yI z!#_=mH%XF4>j=V@ttp(N-`eh4x;wZ{iKgQ*+$O-CnXL#5J9Q9>sftc|5y-yT`eJK} z3DRqL$DqIutC?Jki|d-K73BOTcc%>#s1|zHb86w7UQL(h&8n?uHA2-c)Dlz6-MNis z&#iL$?ds`|aQf|coqm0~Is)skl~Di)uSUxYfWf%3g!2==nSirg02gZ}lEbk?SWug~+RsQJ`>A9gy?jxe*Wb^BiM{Tk%vs2Qdl~mKpI& zys#D24}K0}k9iJ1^z#gJ3`JILU|%@T`LW`v>|^zVAFFfRK2|?W3Zo3eoLkvRzfjVG ztpLCDiwQMlSsR`As4rgN5B&m|QS$Ak94KUl0P-;~OcSRFU-t(Ym^2eruu}{hSEqLw#o4|0EY5 zCI1Wff2^1MKOX*k|MO8k&ixOpINtqyzHW`bK8srSH|{^&c<_1o?guhPP6jcCMTwpz z7un=GdKRbg**m0y5oTHTo+r6@ha4|pwc_3Jl=8m7To=guVp6;q0=|8kO$!uU_*&Xn zBy7NIv<&8+_4F zwa^-G8nYQvPWEJV)t^n3JsdzjRZ7AEp&iz^njLT*MoMSbdNaCe=%i;9lQBAlyM4T@ zhc;eaEr%NztE!Oq1D+-{QmXlCyo~cxNPsq7`8eqf2f+U+zP)L|hPD|@<#FgRQm}|u zC^S`a+~~SlF=W+gKT9xBC76j}Z*R_rN-P5w{P)wL;>O9A9|u=wz@*Xk!SPSXVCo$aHe?cd&dp#3qys2ix!uBx}hl zjOEG2Ldi?60XPZ~CTRe5qA&yd(W(lOQ3g~EcXcKiZ0=s$NW?T_tr#zCw9itdhO7WH zj*`m+B>T~@DEtiPPrH+8YJ?p#V3Ln)5*lonJzok4)O8M_*0eDbdf@_wL=@56ajRvO zi*1XB+qm1d3KsqH3upDTy2VzNZ#mh3G$S(oY9Ny=`mD={g_-+!m3f7^?WR~`ocvwx zQ7;d99a9)yl>af-E2N{j#=T?W1s#6vq&Be2{nkarBFj#PRmx*`RcaS>T8PcT!Nh5j z5N1oY<>dXtK>F2z_C&n;vqbfzsETNPqR6(|N^7vQ#E=<^vvhwR%wI~&0m`D`T0Yi+5G=U z@&9gr-foxq|IdHs|3AjZ=l{w1<9>^6zaHFcKa5(x-e^DAXa$@<-kbk7cBjDUpSz6z zd8K$D(l@eyM=c~0Xy&Q&3~1f)(_4^1P_f4t0hG=k=|=9Ks;A8?ZKh2{$i82?RVRmD zqWw*Ex`T=u60q6qcwproeTnDON-KCoK|{BkV+V+F{S-{(v$S!y4k@YX^raDP*y41s z!exRtTwqYtOzM;+FK<+}o;RA2Fq$`Yv0|fYQ0(@8SN*7{kFLwyd)kbEPb+gL*j9?% zIk#ApCUQZn{C=|t%)v1CSkb9R>GxD6GH_R1ZqsW}^jWTZsYE_xNK(}X!rN;`&ch5N zbsKeC1@6=|d)Z8h$Hp_eXc9w>C?z;;b$-{W9Ax!-6d{^5+(Kx!-PrPmrJHUw znz5PgN`utX(&LOSn@Yw^H5e*-lfbydOe(1lj7Hhb_Z=9mQ6J$I7EBiU2q~xR@H&HA zttfj#A#2{ieHpANq^)^%gTmORb!oX7{jWa%v$+3Z%)jTH{|_Fv%K4u^zyI_3|4}~j z{MRc^Az&WF90TU_d+Ybr*NxU^8xMY6<^guE)A&NkT6~{@&2Wf;{b{@a8-OD?0d3Gl z)}M~hBcq6iX^y^w7h_5&OHv#JZJ=Rd2QSj$m9_yOKS3qFqZr>G4SH!a&;nH3jVEuw z*5z5;iw=*YZyQh$>IcgHW|;P~H|*0IM|m-&uF12N`(9hbj9nzLw#1kw^T7?-6%R6= zs0OcStZ?b1)s*OvwZqFbOq>uV(E0PjC%10Z^c_?U+p=kSZrt4AljF|wTeYs_wAB2b zA9bGWeS536f4IG?er`m9VZ#ydP-LC%lkL6zTQ%sO=SblS(6tOlHX3ySqA)f&4#obd z>bGvSRR_r8rDthJlbSI=L38@1S?2t9;Vo7alcfQApZFw&60NHOaZ z*yXJLgT`WTZ$Mt9wUxT>>sByn(5RHFuUYTl%HhCIuY;V3zXFOuy#35k@A)m71^l)veZe~j=O zb)|mQN3f|Bj$vL>stK858V!SqT7@fZxTYymN5zVrB}L>8gVg5Yrs6L40jUEwZChvg z^ptI?l`v$Hd=-p{QAPZ1XJ>csh^EspHI*!PkzFQaonhjJ!lNitJRSvS;~+{lv%Fj} z*i;;9sKWdjUm}3_6*cbArrVUunM}TGwSV=EPF;tF1PDX4v(IJ%}M9@c>8Im zyZ7|q@JRhRIPM&s97lhQy!TIz4xe?8e|vn=d8P$0T1XrS3jNe)Q=&#PX*5|cZeZim z3ofNs!znee#cISy^0Ytge-9Q#_@g0B#pjcJI1BfQ5wF+30$=s*gPl&}L!1DnwTMoE zeN~gY+O9Jz6F33PQuB?-Uy|Z0YeS(&F=NDM}4B~3Vbk{cnl$dz{ucLcR4yu29W-C$HscVc!3_w~?;)Rx7ZbE51RSJao-wZq+D5?t24~`Wd`nuB}5ea_qTud zTlMux=cuEI-SK-L1tmZzF7j+M^uk3zC~}XZIlalIqdvxyiNFDb4S-Ik1t=~q(d(f% z;ZRRxc5{wYBG(CJ>$kf=N4jGOl$93shIE91eKdjuF!2b_S15^i%B8g#zO*b@GKTN! zO z`)2#36aBGDM;xj|fp)v5ujFv|X%nxi;*D&Yr(NR$tJ9 zD^rxPW*e-+GD-yPFenGd%$pnzXs|Gn#s_0G6a)HRJOxyJ5|2iwIwX^$1bq*-f!G8( z+qI%Ep!thWaqkLE;_g1)>-HTT^pMQ|q6A5Af0JFWuCpnsq$3%Puyzv)Od3I8U1wV% zy*p*49^m)PjG_S&hmiQmcb0$veN}Hh+(_RK$4#&)7yhsS+F9Zzx~{uplu^Pv|I_?a z@bWQ=Y@*tRjRWUDz&&kib<}yfcYJd6+r5L`&bKTv6H*%XCyi*3lj|>S%JkdN*f39r zBbLh>UZRmyA-Sy*MPri97;*15NVK2k$)q0_F*jm$1KQIN8;P#f32m%eMGg{}Ke#el zx42L@Y4S$)qm?EIVJfE+;N0cvnjUI(L{eNNYH2j!YF)k@s0r0W?iE^XilEEH{J z9Rv|t=oI>qY=Nt1aODQRpz`}xhhEf3RxIKy@w08jhj0R!>$z!RIe8pNem0KYE*DbXUqaBhElnqg~mxt&Kx%v z+)(>q6a*35*<@wh1!)wcp$JG=*yPQ|PYy`5pdX6I0CU<9g|f3Yb09=R>oLs$W&)pJKR!Q=jehui>Y)~ER zz}W$?_{mkFINGZ?F>y_ zQ1dq&=1T973(%|Sk!lW&E+63Tfp(eGHC08jgBc90C4lL7BreQUTR4gpXmZ4tgpPJ= zWYM3x8%3*3jyc~A!%?0kqe}3@$Z(-&fE|&fN@NawoHeru=r1Kq3$tQux%VlIlxsC& z9d`GQ5R#TRG|sJf$#U?`-qGO!G8PIZ*d3I$q}9Ki(G*axchwaUN~Qbt+E~#nMH&Vwfk)Q=xc)hLU&a-UKic8B8P~Pp)kyLqhA>!TXLn?4jrUK7Z*-Q`k2*|a!(*d z^RX41Q6Tz&R4y<^XD+%{z;7e6~+&cC1)C1Gx&k z2p;J-MH3v0a||tt7WJ^a89)!l59VEr1bTZ*%j%6Pw9$!mM|`5rKl00m+%Wa{fGU2L zN9{5RF0|~mx(l(HVV@Xz$CIS2%`T(wTy&hz3D>wQiv_F=wYtAnV-dF3wBzu;*h(!p z7KljW(vF}O)r0J}7{P-Y#?CHh+js*G_NVAxuQq>j6}2tx@bSRWwQ5~u zXE(f9?Z8?U*=d%Ik~lT%WfF7`3sRjsu?B)#a-cODiVdl;&$6)_kxw$K@D@Tlz$Nxj zH5tw1UL9%0-K2~vXr(#Av>W=AF?$t6GSFHfQsb_Kcm^oAfd(Hk16eC-+P`@<)Vo}RF8r-t$6a9QPddR5~dIoz@_M7_Y@-iqMooPUyx? z*GaC5Nvuw|+S1{x_R#DbLXLN~8^kyP*AQ?ccJ{Zd~Yxa5cCX$&wBk+mpCPK6E( zwZafU8NBz)A(Wkg$zy}MiRv~5S)&>;H9eD?xpr8j1P=9b>7O1zb)yi8l1_LvCgI>x0L^D;SVSE>dXDvk{Y0inhk zmEx_L0}Nqx0buYLY5`^9sLMl`!;f2?)NGcVj}tE#IqI-Dm@u&4*}!AaKMXfcoeT6Z z+egz_e)F<)&^e5yF--}ISgxR<)%lv^b`K4{6r>PM>J*v`>7Egk_rlhNOiXp;I8yL8 zJoak83mlYV7V>oe@bUKkF~i27Ma$lGFyj)A!;A~67I`ol_6pnqB>_R=R`tFv<6U?q zN~?g;z$6N=U_r9ZoAU%M{OG-wL(YNEiEx9nTpL6l4D2e%z#M}n>LSHU{$V^C{vjzb zt0nHwv0~a3RR#ALFkfN<>(jBfGYF?SmzbjQp<^Mf$UsYq@ImvJJb@?}l`(x0=wSEG z2L#~2$;tNP{f-Mj-%_gO*gg|ho0sdfQ(#RA-C@B^^_jetL@ckvN_hFZVg^y{A}KOw zPqD^N6jFAdhHQyG0P_{a)2rcV2ufR2?bj*cEhoZNyk|o?j&HyC7H$V_-Ku@xs+FA% zOYxcgTP-zRA_$JtMtZsMjkI&LCxc1@9EA~po!oTzhS(bWT@EK1WhU12u*8@Pmsi!T z<;>a3p=9@jbeJL~);2e5(do7N%ivQ#f!Y=jU63Ead)<`PUUkexC(gs0?P}Nl`H^t4W`M%S1 z?oGI(O$sv~7&hMe0E1-#gahWo2aytQ$}D{p_AtAhC)+RfPq;~tg}5=O z5@@L>n%c2#?Rbs3ZS_QB7)cjQ%z&jGo<$)2gD0LbvJB{Yt%VfamDC)9?L0v99()ug z`NCn{Rus4UL9o+6&6X7NBCc*(Y{wGwUnLo7bJpsG?uUA0Drma|0>m9wx98lFEzFI% z#DyrhJ`EbeE)q+t1No|B5~{;=fTm{GUAjTdVyr5dZDx z{0|@JnZf?X`BB!@srfwbmj1_k;Tz4@2p{Aq|_3w{3%h;q9a1<05J_Uo;%- z|IOaJHnedh3&ZCt{uN`+6QcnMkg%NujB_xS9gewp0VmmYyz(FoFt#+K)r`1o;`7_z zy7hHt1lZo}bDlTajge-$t8dlSRn>J-kplY2l=<<~2GQiK^eo9rk7k8lGm+P*W1o>; z;!9IWIM29W&cln5B%ELd`uHbKUN?;ndTFA%jSM?+-k(HGu)niwr5S>%umA-|_~9&+ zjjc00^kQ|Gego}gNl;F=w*^~9Cl&b4?yfMI;ST=W18m48M0^i=E@2OL-r1G z)icgeao=d*Xz4< z1?9gDm%gKZHDY0Nu_L*2a%I@(_6Ezn;j{{_Hdx0@aK- zH~f!)JZ^s3{|Lyp%`f}k*8}oh^UMDC{}vG3Mf$D*@TNs5Z0|%sC{*ANgQd;jyNv*` zoxWI?sqjv)@9G^;EeDA~bfOF?2PYqtJCM-8#iFfLY5GY=_7-fRf>fskE8pcuC$vl# z)s|8rP;><+5Q-wFUL+48Bvz3(d(XOuUMUzsf?;0be>76&!V5HLRNuAHhXM2K;9$4A zweP_>(Up-doapLI1m)VCFRGPQO*^=M-^nFP;CFXk{&@W6sC)Q)>v+p+Wb8CDHjPj* zFQ5tX`;sIg$@|%G2*(f!Cq-KgN&`OYJCOBHr80BY8xFzFz;*n}*gTV2`W ztYxDS^qf}RJ{XfcAEO3_;&|(00jIF31`z`C^EW;r?I!PgO)BGG#O7oG*atI(tONp# z`XEdy=gaCu(>fp%40)E`977)Qp%oW7VNQoGT6Qtb$e2*$NCLm(t+Gs2+Mo0!@v=Id z$xvKdyRtKN&Z%zRe=}HU!oPj^_nTArZ_J*P@4v|xBz_Pnha5*e#8wio#lUl>@_$q` zfm7-Y$x~=@Hg+>b6E%^!P$q9m6Sc8X*z;y3}{Oq=P_q-dWZ0!RkBNjSb!xPH$nk!qBVGe&>Wz^txw-O1zWMOMMWg5ZhpHI_|335NwpKR)7+sm`*q;GPL;qndR)Udo# zfS7~L1x1#jUul1Q-5_vW0vANp_B=!Q8M&Hbr6|8}2nyEKL^cZSjINgI=)#Z}20S2YQ{ zhMRF&14SK?we@XmuH^sk61Sk6K^OB;zlnzcV z18$uUjwHh9jC)8dMjl)w9O{5#2w<=6>?K=A$GzjNmvd}}_v2xA>$$l<*nhK!FOTLL zsvPiQTL0c9hXmakI&E-^_ZHpsD95i44~`F9AkOJ6m3|!vPQRN@WAOej6Any+|+M8aNuFN3#YAVO;gSg{l=yS#MEtSYFe6F z4fTgL%~&X2Zl*sp5YB4=n1%FfpPR}jHI>a~aaQBRn#$UC)efjwigP=UC3?F?z>o{p zD{4e3Rop&cK5X4nzGn>;adqs!2jtv_3S#>_qW+;&js{a{AHvOVJ!*0NuUWIQ*HdGqdMlAA7mZs9p209M{Ro4);-SJ(&1n;$U5?UgC0W{@d?T@ zwcX3w(mOt{1_@@Aq6h;(=5rK7kZ?4SlglO)WCV!y062Eh&62=?rtm1@s`#}*BPaJ^ z{_WCp=zQME=lI(_4(-n68sv{ja8QX!55sb8Q@KRi_!WOIqb9#SFTE8U;n(s*52;YG zk*QDG%Gm8v(J9;k)s*v#p?gRs$W)&R^u-^c2#+wrM7tc zr=BQu&q#U-508qEI|JM0S1)7Cxt?-%iet1oVpS^(yR5Vj?JKojmTixv28xlpy*H!i zDgq8Z4F=QE=-Rz4fOpAgItr)&xt$sC;(;OJDXZ088JraMBIu)y;^ZP8@KeXm?L5lQ z<*HiixaqbbKJJWp?s z*Z=%kdOyti(QqN4;O)1XD|vm)2(BHNs$RzFMfH?TX~wAQw&Fv(alM{oMMm_eLZ3n} zE0igLM$M1f=7y|eFuf$K;>k7L=D191g~Of?X-`j zfKVG}adFD*s#KR>CfAuMs_p@mk_eYeSGJzXyi#IGI2Yc3Trk7Mhid-RZ#@Inv#|$b z?7>h&mPZIerdvOPt>itnm0)<&%Gxj9)9G|9Gr$r&wyFlFJWW)|5eA@Z?7VT!1=Mp6Dzw6gJKD=)5xs5Cu~GvW$(wWBlu%yj+PfY zNBjjdNPDmLyWQtp>*2kU0!}dJHyaV4brr!v0x(XBabHE=#_Kn>)n+qn9l`)3gY_w) zpI#ue+ro;ssEUFgdE-czHZ1+-*eEpp{=XT+9-g_mFT{fl+s)0PlaT>>0*|uG)Q&r3 zRHYh*a7dghOnwH9OY|S+L=!qPgQA5JpLt4=&XV*adidduK376lCS4_Phq8!qBQ`4E zkiwbo?f4EF2qV!&d~NB)p-V`?9nGvf6lM9Z_vW1Gvaol1!`=ysAe1%?f+!L1(&}tW zv%Eld7nHu)%1vP{nl$_t)8c;8P&O*icV+`FT_zp3OeHmt3;f**_>2V(boGPO=DOh_ z_0RyYn5Elkby4wQv}UcR{bg8$(1NpjdpP$i02!@4(tKwR3Fq`Gz80H&>mYYk@fI@f zWAZ$?{Ge@(8Sl@dBsKYUgY=`dn8n3M;&-5#iWMYqM)wb*(nUnbP2Ea*AFNx?dI_lKfY4t;ohn`sj`otr#$nkp>@C(S;gxL$kfpbZY*dS08Ch{`6#>gz= z?2?bsj&rRx1UQYnNja&JoHUHym0&!ee=#P@=H_aXonFv=1@n}kuL_q6u|Vj^Da9r1 zcM!bi8nEIhfE$Kc*0NFHPNHJ)we?glvIEC;ahjWJJn)>JLUQ`w>7lMDnB^U{VX0H& zWQa&a{nJh|4fu)S>xjK)pt!Gt*`72TRV8bDmnzG;PC=DL?&|$e3FOu$^>*zqGIiEg zF?akp7ScEN<}Sv5Hn7h&xMKsMdpft=zuR2ntAA$L|F9hN6&!$P+yAUSdbGOg+5f=z zM}OM?{1G3={zt8N^CD<3uYHRKK#x}1?UmK^J{-ce!T3m<&FNuQ55t~Qg!pMBlqQzQ}f6vy5IfTskr-szimB#E|1;MM~+?{P(zf zbZovsj|IlouJqw}YiHN|;)KHd{l&rI?!m!p{p0mvSAHBjuK?)oj%sCl_u!~&zP>q> zA1pu9ck~6}U_uH}vhj!*iDuM1Y4)2VylDhp;>nY5$wRjh!Pm$9^#r~?!1xI4WJ!=j)Pze|2~u7+w?EinwvxQKH=&dF@Ms@Rf^trFy5M+9m?PR zW{_+>+YW=dImGAJJw!<27@OrvubfK2xJVsB-MUI|%wKBBu7pTlSI_UET@SXyP0jh$ z)W*5%*z^{=sh_XP4bq#g3<;89(Jt2d1BsAhzIgMLSkYC3w;0xF_$*NH*$a?>jK zb$}4vwF;1|yH)|>cGoIE2JhU;!JWqfr1h@b1c>lms{pya^JeVs-&Ez$tHMV>9g;c? z<<_=<)559Kz8SH*f4OUo-Qzpg==wGM@%!5b&$7>{1KaejI~32xyVg->>RqW1pT4)k zAA4ElH2$1=c&67a*M8mTYTENh=hqWHp|09~&7=@Val4c1%Bcjr$6XIN=2A#iv+=)Q zAiP=r`*H`68{$8G`?%97$$t+!f69M<#HULBJ16-ML~!u{SzBp8L;-O1;rhc050C@7 zFjbBp7s;fUMnm)fI0w%CwvnHd|A&Z(=Vht!yvEf7Ma0icfKZtfAqalP>=XGE?Mcol zW0Agu#ta{^u{_`_%X}H?Y+;DS`<%E=`CC2?PO$Ut1$Q3wF@6MAqmtQh zm|dc}i*E(i@6Em6S_syI@2E2TdWOHgSHHHMU(c@aXPe6g4J=FX4WLw!ol#it5Q^no zPKNXB>K=|n{nW`!D9fpd5CubtugGrv)rQPa-lRVBeB296j3|7nr;DF*nEhAF!7D5f zUq$_5$anwB27(P|I2;1O*F92UzYEEMWiD=Net5m+i8!kXz>(D8&EhV;8fi3s_GkLGOw(Y%#&eMB6 zQ%pr@(JSU>F}RE=>~(|JK4ia|43H&F#+;{!0xO`3kh(fFFZQBOIJD=DL&?HnKN z>>szWnL+_@zN$%1)hq{3yefJidt1MtnE@1$PXq5=q#E98_$70zsIL6`rden!aX`!PH5y2X3RPvh5xL zLm<>K1K=x4-TN)C^IN69Oa11wzUNy_1~seSQ|b4X(`{X|qSMc6JN?Y-^s~xNL;dDS zeW#x_8Pu#!pGc>lIi1!uD>}Vh+v#nu)7zDu-k#m*?Iwe|O{ce=PV1UgGksM*)mQ#p zUsX@`)eW^Z;ly-3^L9r)Ypq2R&@4?JNpOpwQp9^82K3Y zC^pWBgTq&7ZVmEHt_<(VNCZef95ieUqwHRT#;QC~!MGh`dN}zp^+=;l@je-CC>jnQ zGvt)367*x2{J=L6J|PBbXq9peJfyK{P0(e3GIlq2;m!m z`X2?$I*O?zbiG0EsLK*871=8ToSUR%LQqVb1S&{}ueP|`)a&1MuVw006go9`EEb&N z5ew{=$Ve8r{R0fxJ~yX$4-M#$qq-_M_~=zGp7+|GW}By(d9Uy&y2dt*%+uqSU-6w?SN) zs^U~OXa=5aJ`J{=Ue2KrtGPgOn>^$OO&xn0`D`F42;-hyC%JP@7HvTjx6O8|6RJJj z;C*DheMTwuc;xDa$$*kLbTg`|S>szKg(p@$r$PtL<~)vZX5vuIn%w+w-CQW)(k9kG zYekr=Q7+t;f*V-Krk2m?2@{<)djOrK z?ebJIJOEg0(a7BgP>4F1idn5G)Z3Id?xLEDEsw@Fwqep2U%Y;?lqkZy1dKayih!S# zp!S*Gig?Av)#u0wf}+nD-y%^jv$MsNGy;vMn;{L3Cs6LYN+(pGjp-Y&$Wiv~v#WPa zf2q?@FE3wzSp=jRSg6E5o>69K@v5Qq_!O|3!M5nJEN*N`O}C+}bHBcNe;@EQ$GFyw z#W2`O)fH}&IEQBvh@V#V8D@jd#>>IB(q$VbCEgV|^0&(Tm6D1^DMl+@UDr3m1PT2? zgZBUn_3z{()ngl6jLev40szhYIrEOK;BDv*nyqQwmWCL7n$(m8fBBv>GM>zev0;U% zPggZ&P`qZCH)5cCVq(;Ij)TT9`AD}IYFMP$+GdDeo2rkcHieQfeo}AUifWrwuLM=F zBLQyPC1~#6Tl2QS_X9A#ZPm&Pbe_o2jV#H5n{VP>$2jgMrwMGKOB5jbsPLy*$JHhw zOG40MsGM;jtv4w2IzXckBxd}03-lf%Q|1dn0|`Lr+$2#S?WHA=?Zb35{_2+rEMypO zH@nsG1jW??2E7~{lTwjx5E9rFP>0l%tF87rU?SPM>4%-x+Bz&b`pP-aAGRK?!wPxN zgU9PmtB6TjTH8{EzFimD8T*K{fpZQb59TG83z4nK*&eD=(UMc$$+I(uxu3$*ncPUp z5KrCU`=z`RhvgEH=^}*~#9wHtv&zacy-hN!cK|$n8axckV7BiLrsIRbRo>EY$~|Yb z$78R?@r^aUCGCtq%eS-^R+-O8Q=uJkNqJ#NB>5{OMLbdgw5B6gyNgp$6euee8~H6w z#O{lo?(XxW-s|pR@5Sz$qaWuUtr{PLKlc8AhW$s5X_US~`mdYpKh_?%+kX7d$E$09 z+JF2JAIJWKSDdUrbokHjSK8kP?X~qs->$EIS7H4Rv~3Vg2C)ChIW0X4j;?|5jWBf} zuoBm|j{m75d&ZMV>ZSA|Kl*Yuuo-E-%(EgH#a`ks9H!@ju)Fi@hO}SN^orW^B8$p1 zC((D7le3bf`tW>}CdCmIBB3di!B_T$Eg>o^e-DFJwWqBdw>g9&eu;nRx3B)9#k zkuOU8grzDLnw13IPHST#cRRHxO}m$Q-U@m?|4qIge3Q>N12qE5$HD3C<23YYN**$- zslzTyC)T(VpGxx>U&Z}tQJKuQ0&Gs0*P#5C*|;!0ZF7!GNnPM(Cvh8;sOS~#Rjrsx zRZX6hR&#bU4mRLhNg-`k9eG$YhhcTMsJWZEHOWRdcFV3%WHX9)ZWsktZKx(O$g49N zd0si1Vl=KDj!uO@&enUc_qX<*y?KGRAMcbaEg+b3XJ<%~?*X2hR6p?D#xNQnVFczmZR==#qjwc`Ry}ha`cx6 zLcQ`F`>Fk$DR}g6!F3!>Hoy666J(3DIN$tc)C>mE_2xH&W&n~Iy!x?;Hf5XN>;Vag z`j$8}`5-Sge*kI&MLtu$q9e;rYNWFA&T>rs7+*8>Ct6)g z!}zVjJU`tp0O1|wwT|@tvwDDgg%6J>C`eNvnp7gU==k}((i;+FBW7XCWG-H`Q#)HH z&E1BA9Xq@INX%h5iF4J4pW>X`zyaivAdI7ga-Q0l|f06Q2E!@{>Cf*!x>&*e>puw{dL3&WAd|6JGlK1x) z+!QHRO=52C%9P>)U#XN>cFwhdo!6qwr_ow7fJuKe#-wudi^aSIy|vgoHd52+%;CiT zUJjb?p-)EGWz%ClRtrVvfz-|;!#8R@Ek>}t`)cTRA)w1vA^25Q2&uSL3V&7=0}^h- zf}fQw;vr#|%Tk>s$tj4(id7DOF15d3U9Bp6>9&nOYk;~1uf2krx=~>|i>%W0JFH;H zX$SQCIz1Gj^0O&Mg2agNRHScmMd1%G4;0lv&IR){VB-%?q*t7B4)A>gk=CTP5yZbw zASvr%BPWf#$wWv&yD~d>qEe<#oZKtacr+N`Fd7d|n$Va|m12#O=7{4i0G+V1!Z`Wc zR#!z$V={xCBxfo+7^NjhukAjG9A@PFUcFf z)piSJ<(7p$Ap_D>C2mxYdC%FqJ!q2348?K*dj= zCm*oV*c~_EIjga%2JU3%#tQwYcuQdjcDH+U@dtmm4|aFAj=TK*_^+?|+up%G8h!q? zZUUgl{+qq-;m$S{Ki=8ve%kPxwAJI#G^@s`{du4jfPV8Bi8i8C@$-G$(({bTz(Gu| z=cVm=%zHdZaR1HYe9yDi<&&><7}jxeOml=YhP`gUzo>IGx$} zT{9TotO1IzlA>yj@VQ1GN^3}c?*6iK+&g-+z1=-Ja)3*+T)ZM6DeW?vq$=R8k$Uu% z#BT2}K0^)GFgbav!j}9tPr^716+cR*|J0;c16~jH3V*6MvTN|IwdLfk=+vmHQL*Wl zNnruSpYn#a6#PyrIOH9xwDddvso#+@#k|9x@=mW1rU$h4h`d%~kgC=gM1!QpAV2vf zVv%4T-MD?}KE}(W-JNGW)VoTAExe)cWqAz^+wG~_KT5g_r{2L40NCH!>o#SD%UJkt z(*M`r|BRza9#6i;1<=gReg>~>z1tbe=HfrgyayQU(|a_Gue>Lt zc;r1%x$@>~!d6*NWm?^bNdEo)s_AeZ5)aH*OeSSdl#f7U0Q%ARNLKwHNhte?%yKa4 zjQkcmD#w6;<2N@>^Jai9Ch#R}Jw0tbmAKAt`9ah#;Md#a-8(zu&NTXKPcjsY;4lOj z7tLXF6tZFEMfkKaL}Pc&LWT~@%ag$s|5Npn z4l1guV~kT9B(iYdP=s+HQ50NZ3($NBrY+A#c3ft*I^xMexhK_O!5u(JuG@0Ky{D=R zY>%Rb@<~sU6;*VsL%7p=On?aharq*qT!oU_cW7d&<7(JCXNsd3G`c$D_fGt4Fa5hQRIu2xhJ^VZX1nTr5^AHVA1nTi-+ej}L? zRCHYxYr7ydB9+eL5e7eBwq({{dTD$q3?%l~BnW7N#6>y2mX$p3Tvzgl5%DpeDo_TH zuf4Ie=kQ0BJ(ya{uhSyBV#OoccGvFI#=?k~NJ{z6}6>&Uz1X2lgri@q~joXV2wPeb!AFn{_P)e%GJ9{l}l-8SQ^&MKjkF8TfE-DjR^~)DeEQZe>A(hbp zN~8K@9cvtqSQ}tsrG678H=O&8x_ZCShvTJcSrZ+fvKYS88}Z~T5CP|n%qJqQP$9Xf0?XXgn7fk79s9@u~SF1OIt+t zLXnp@11i38ErNzVgOj~kCKY*hun??EUq~Rp$BHJ)U6=*vjOjZdPPg{s>fhn5dt8&&a23~p6J@v6e(Bz zqM2r^9kWb0mt|t6L|Wo|fMM~6I%;Se<%# zo}dm-b@PeWMrifstrS{XdbcdI67ZcK0 z2DNCGb^=WaEkVVej0PX3d7+BtRi{wOcr$yrR@bCoBndR^=Su>L%JZ#W%IS&dPphSl zE>{e+L9_(KvLvCA-8t@8bG)qRs~cF64daV=c+=2iN7>zYs_Rztx7D(WhRc-m#_Fd> zx5&v{2~j@R>mi;co@fJ&=9EU7GNennVn+wl`LrQCN5nr@TfD`#|6d>MXFfM;=F$ z{yEX)+P&dz2El7<6Smrb*qDWk3K!i3C zNgkXHvlHu3bWQ$L^$L>|vLi%O357tkwrQx+_GILR8X3z0>Za}_njI3xSOzC<$7$;T zd!y+V$zwDrnmFjir^YXI<9N(pCc_~bhmgxxWOQl95JZiUS~Ap74b#Ite<&M4F}Vhi zV>FaXV*{4VudHP!T7j4Y(?jeUDhr4f@Z_4|lqVfOxWODr!#dG;(g~^zp89?X<7LtV zd({LhH{g)UFe!4A50U~BwV?K5nT~OdYMGBsQPsHXHGk04%Jg?^cH@d68#5V)iiy_j zuuOEjJkkDiI`WkTLD^knDU-}jwhMK*f*LWqhsOYB`K)91*J!ylDG=RZJp0 zmx$?VF%UHw*1Z4iEx84<23C!&Y6a;lyrUJzXPPYH znxK^0dTQy}7B*vbpOD#Qj$KVm-VXCicT-6J{vdSYNv~EG9fDw@_ z_C&o@r}V0NppJ8g9pGEH_|fcD&BYDeh}FEyZx~riE1sd=Tl<2P8tgXAEV~C$WT{FgLlxY zV$o37D&a7E;%%=Xd@T!$UqRJ1R&SEo+ODw(?PD!B!8d88N^;VnTgi~i4q_GnN=;6O z+2w3GYD@yuxK?r+v+88bFK~WjnDuHaDJ14zit_`$@34!U3x=1nk@w0*UW{TwPG;07 zS}m63ZH8VUb#ok&AfpQ`DpiudnIS~?5S6EA-Og;YQN6J;?otUPG7xHWl?gss5@DrT z_?8>qlKHWL#Zs-u8l z52$qpL%6LQ=qoBq72(t^q6u0NZ=y^mk3Uc;i@>{^Tvty&I={xwFHv$j&-4+X9}zvZ z&{gt!^AwoW+VI9s91ZU~JUfQ8tgf^v0KDYdWSGY5LB+9hYU<>(0=^`KE4YBADoOXrW@ zR0TbL1HQgwQ4^QFaT@vzi6R@D#wgh$bWB6>A#bOkWzh<9Am@GVZf*35wt{pK0xOw` zFW@Jbl>L&F6-X^O)dH~NXyBkNCN?;(Jd|aUk`%`AACC&#lEz%J%Zig)mo3tKSH-{W z90ZI1YzBKL>{ztOE-bd;hq>5O`M?!f0BM5`j1BY75CVOi&@@WPWdx6WF8qht=c!9=x1Xo+K~3>^*hOZFTwhRj+$+#P2lK^(xuesfWa8 zxs9b&rIg~H%yay$pw`3EFxskP1B4Oj3!|~YoWNAQJlxvb+d2#m-|Tje0($m^K;5HD zd~s{7&j^R>(gUM>0Kr=69xf{EU5ra8 zsYNo16$M9prjf;HzW|Yye=UJ0yY3%XEdGldI-?b?V2S_!{G$N>LC(U_-0F=yP)3)mm6V3 zBl?DIY_n`E4kA3q7nUka$BJU&peByjLTpj_s8GR|q4U~kH9c28B!v^C@BIY0mB|2> zZ5UJ55vxj6U4`?@m&+Gf4o!*`X>IXwOj&SH0eXVR7adI!(9F9K?pJQTiYZ&{_cbo+ zYJiRnw&@Jszg>WtYQG0`K~o&~defdX3Oj!0DDA8bOOXk5g^#j@>kUjTgS^s}Xdk4# z^xVFYSY@&f{=XPp2u+zqQe*;3eMDbkyTN~B81Ry7_uQ%cJk z$qR<4q@W>&fDw#v8dN@K>SmBpQEgrcKu}Ut0-gG@3AP5jswenf=}JPTEcE98;uArdvK~QwO-}%I(M-mljfFI`5esh;5{<=mmV4?MCZVd8N+(J*ZQ@wipP_bZ`U>1Z~|Ne zrfs#eEWp}#UR|d5>q=S^q-+sn#J~io(OR3KM+X+{2+crQow{o~ViZ!<%s849*o>h! z_MFZbdPPHY@u_Ya9P|2xCd@M6l>2aFAv971+w${^PYZ;tP1@*8#q6WZ!6}_UOT0XA z)4v_}--(SqP=wCuNrN^s23$jdCoX6|Ccs8BH%vNV8n@1DbtANM6~4^|#|*y$_eGHg z{Ev7nJ9k=W=bIN*DqLt+y+siie?%i#{`buV`Ti+*cN3|tyWL6&f>F)8x|h`|mK%3k zsDms4U-n+Qw?M~tJQ^3*df#aRrRYUaO)#oS1`iKLZG?UGDOo_5%u0T4{g6WKOm1HNB5l$K6nt6=#!S#Ji~4_0_Ry%nrPrS^d6|T*lq<4 zw?%hOLnDj%rY6n}xyaB|!h|o!L!R1?>x8S5Y;ZlxHHEE|;sKfnH8oGAX$MsY1PB zs+Q7N9m&8Hui!NwF33|<@(xQQpaaPnMTr~r&oxv9??0!%FW&5LAMYIOTSuIw9hTNC zn+1C=$@a;&Muo-2v9xcY9@Ir)fk`{a#{zx*Wa*p8>XmOe(J&HaE3}66t*kt4VcqfX z$c9yHt&*ZVcrfWKc39@aX<6#Pd870eb>lz1$(BQvL@4T{Lz`5+`EQgyW*k<`=`}Q` zr@M=%1njZ5W>wzNMssXVsm1%!q#&L-9IB}0d^9>q&ZcMqCB|S4?MqA6fmh@cKS0+AE4o|_Uwf`swZd=g1{_B|g5NATO4h6yOHO!`NGyYt zUr<>L-eW-v!%E#X;(`snbRHY$Y?UIr;utnMBjb?bI<&CVxqq-vQZrS=ZO0e9N_Cp-d{=cP0D*0hr_YLMh;HE^b^d)x!Oyy;7V znv(96iNDvEa{XJ9q-m;M<@4*&Nj98Ch)O1+lVlW4u5Y`Px^U~M-UViXfu{n|&s=yR zjNtt{yor9lE-&-}@Voi?=_a9EH(|{gyM%5iESV`ZGYT!6v(8ug7=_P;bqL=|e!!Pd)#e$|W^jRgK?e%8>&2 zOhqjd<0?tZ2iL`CcSi5Zn>SaUjK;(Gc6-Z|MKbwj?^*W{wurDuzX$s}yYMf?Mf#nS zw839YX!v`@X=Jl+zXwX}VgdJedl%n|^dbeL{@4WAvT%L{Z;kXBus?6gz6mb#rs?y| z%wjc5crk+=tc3|vSJQLMplo%#7Q*r2n{EvVe03`rFSd4%>VVL@TS2ikZnhN{e(K35 zK`2L~Q89wF!lo{w(0o5iB_Umf8cM|si&T#k17*%3zoFp4X7E40eod}6(*@Sj1Pi40 zGcut)V=4<|6?drKtx`bK)$sNr(5=Lt+no4n%Xvq)PegG;D!g88`cZf8z!;bb+#dAql>|K`Yk z|DW#r-R}N|J4grgn|=7Z;ZxgZiR$@Da_g=yEV(UjJ%2u<-$!qr*>4xUQN7u<->$fC zpYQx+zx~Fmd*HPDclYhEmx-Y$MZS6mI*JS^>Tj1c(d4F&?3t67+RALL80LvZtZ}&_b!eM-> z0xH5c+*R2mDXxjtj3YoHz%JNkCc&o@#gJlz(q$V*3)R&rW}*7U!H}tugTv==$U_f> z*!=dm89e^fG=INs2H#fvB{ptpA$Z?{|5o6?ZxosQt&N#4u;`;^@bFW!M9Gnf&o1K$ zr}oW&?}4Kh^V)|$Z@LX*E$;NpK^);Jg?LImQaepW*$K}2oDWDqNQ z`&$RZczh3(yZx!$Ap66gCFl{~fEHJ>NvJIMl%waH{jI~l_Ff(Eb z2zvH}nE5b<`7pUH>sEsBN``3@9<0I*Vn70GK^|PdR&$0xWWZULEHCwfDoP=OX+}f5 zh2vz6PgTObvAWh{GkkI@n5G5g?HM=}wd6!TJMtW9N1au$0HS) zgVwL~bWwSAd8Yh2I8KAZe>6G7OjCtTX$F*Eom5Twbd`~C3|2Vm(Ac<1hLfq)J<1Q^ zMH+1K(41!o3JsM(&SS4IJQ5{(fd!4cN7=wATn=_HzH~Flk+=idIz#tK1f)Pq#Fq$4 zoC5hDMtyc!L$Q^@z|ix4HojK#t=e?wc)1)MT4d+bVbU)}hpm|S;rU%0>g_-%wwXVl za2L=c;HiLb%Sm#_DW)lKXVlzb>wYRzC61jpJjegA;dA!)v*TLfGi3|8v;VyNOZT~( zI*SXKI5U3OHYGn(%g$Y>)t$DbAoSqz1Z=1qgAyiC_#<3Mvxd5jPnG?|2vuLPn*{F5 zd#QwQGP;%~9V-D(nSuWLO&cqk_K1uzEoGUq8>}?5Q8#U+I6u~wyA^VKfgTmE8;cfC z(p=gol7*Z>Uxjn>n8sgoZ1qf9Rt z3DS#Y6<^?-pLn{K2T(%sW@NQqb281q~~sR(=P?N$&7bDYik$3bsqI z-r2?mL1Fy<&Tbfp9}y|Fx!QZWu*erA*2IvN1_8;-W>9BYa*7umW>6Ql1aYA}b{)=; zLiZF=r9JR1*g!vA5zdzrSILQ{=m!B(8-Z*5zG=cTF?v)6K2p>lfa#b<6}P(R!-WYi z&_@y5Geqx8!XZfo)cYuo*9svd`gF`9f*fpxJ1$K}dA=*GDNRYhub+S1+3hm6JwFhZ zy~3WdiZLQMxOvnAgo1gzD%kltM_+E98q?sEzYGTRj85WVL+mvbcr*hml(zDfH@IaA#<9jo*Xu&gL)Ft(R~Cw0`sic;fJel&E2sJC*C!AO$) zTv&BUv{Leh9fP!ftJSxP!tx(>Uw5~TW!*_OWL&UWR=uV-Im9C1-mDe0kfM$Ipi{km zZIhyt2F$%zHW;9!|NyQ|(U3C^Z96A>K=$`P5Yj|+S%O5onsWMr9;Kb(tSYef%O{y&M zjcKu>7NroPloH+qvk*8yK=h$OGviVH*#rZQ-Z2Q{=>WjtvnuQOHHD+%3u*K+6&{6# z!Xs#k+X%f5ey|SX+{AZ#ad7w=wzRTVRO+H&-9?BQ$|#HIpd>$t`@;z16?mPjbl}kO z^DCu6^V&VDDv%E554BM@ccb#`!HJR~;xb^YI$7%aS=&80sF<~C@vw>wI`&|!mZqa@ zBC6#20*70i!%lq9omoJm@kx<;^sC}jZzyb#p?d2a@?=or@yeZpm2XHzQgPf$MP*>g z@gygb=?)D-oSntyxu#6OHKuwXAwzA=IhES$?4{9EELc?TC2vax-W< zCx{m(a`#~C`72Km#1VPPSmc$cckJt%I^|EGkb%0+yMxIwvqV*BS$4U!@RAna#L{AX zRBo7rkiRwY&!=E#-{>fAiIJs)E43pes+}+!cagNyMN=JxpN)cNamu$-h=;6@S-KVG zVyLS-Rgv!bl}!KZ$Zlz0=rwU6)jBGPBIp*bq87B$!ML-}ek&12l>;1y6M}*eAPxRq zA%A!q3D>9Xx4ffjm)HV2l*Fi`3d8G!l=o0s?!spUt{2V|FKzXOgYm+>(RhDzVO`EB zmuSneYX?%G@=eRscV~ZHO{rbktv1_>R#_}=vc011OPiz>uC$+KOW?5F_42n7D0y)j z@2Q&$lA9H9m9C;F1b*F80`!?h3i`sQa z0gzyl7?d24)mo7f0l*eLj*>Ni*jMtZl_ONd2h*EUe!J6K?LsLABhsy;N1iE*^q+MP&4MrXywLU8THB z-qsQ?91GmovSFB(y}(9Q}mRh`b~D2%O(@p-h3|cO`uXBcxZ~; znT@7OLviysO!q2#Z;IZe-`jbiiAyOy5}wU<0gSck9!|U2V)1Q`dFJEIrNxCwVPi2@ z^|B>1oAs{f`ec4^QfK?@-gNMV0G3xQ5#>Xt<($AovJn(;0a-e{4)U0FP5Q86oG_&K zKCkbr)N$>qv~iV7Qg;D?Xerc*??0It#_LGthu_+_cJC}Vbf3r7w|EXatYe1Um2s;N zSW|Pgx@lO%`ny8w0xtHwpH;n8b-v#6>Ts4?!#g=~W0dow(IMYVuJ4q&(-;vQu$ zhQwh|y{~fMt0vzI%L_bfzI$1fXZiYq3G|>F6jKDhz8w}o3Rg!5xE&{}3L-13oQ3oh z86nM{3>y~}#i^sp8m5RUdUUD{eaYw(1{1Bruv^vlpN29xx*e^3HToU05@z-A`}1f# zj?;WW*#j|$OUFcwA>u8zIuYpKOBc8G^tfz&aKY+D*U&&23h;%ix^hKd=&;B~)&LvPr{5y$#AFuDDt%P3~d$ z_|2i#BHUSdKno0b1&#T+5Xgd-HxV_r_6XL(H zOD5!{+T5Ab5sSb|@e&z!)lTZ_+_^OIQ)^iK*ip{>+OT*T^kum-bZ!q*3K@W@`kQpSzW$lG~V)RhE>URl+lGfxnA}pYXVEL z5oF5PJo5%46S8SBqo=7y?gL%^`IKN7&OE3-Rk;FNGwlTnsgAy&7F>Et;V;fI7BVpi z2C7XKsv0ll9I}S}9-b!`zy`bH_m)JB+YRVI@V#ZQ{LV}o3~M8nPjW+ysiwz)%PL? zeR=OnKD>&%tei?dS5+#d%V?6q@!}j!Wrm6!B5Dl(=pD?%Z#*M!-)}6uvjd?eIdxt{ zp0cl)iZCeU*f_3+{n3Wz3Z|YCGuBd&RITXIi9M8|q?gv}X(>KF^hRT-LR7DWRmtTY z{DP%&^(p$Q{GYyhG}Qn2^E2!7F&+=&NvplwUIEl;Jz8!rcUJOAe`Ux?f|k#}yp2`( zJbw5P|F*w<)VBZP=iyqX{U7bs$L$V$9=9L;$7=i0x8HXDBUt_Nrf>dCQDqeb|8bt= z=h3LX+)eNQmwwnu>Hq8u)&srb&5NMD{OH@D1IxCuy0)_VebD}Hz5Q@~tsP7t$2 zcCW_4|G}!e(*?DFkwe9a!x`x($yaxntjT0STDy8ld0Qy}H4wcfeOH>;mO zAx=^p%n!+mAYVS8w;yIFAL4%DJ^W{q;S=R}WkvWhxmBnOn2Za%fNU^PT8^_mw_=4@ zCjv$BPVg@UEx|7wcm%(_YR=8ANP1|=$!(|g!$H4Sq69~LA^2=54GqVWr0?2Ph`QK< z%B+SCWyhr`2c>c?ujql5%KN=C|5N>tWbjoTC!ev6fW3C~Q#;+YGa}`FVu9kY)~dHI zC_RP-NEQG^?h}6c@4eUFJnGzh7^0sGnLznBmDFAWRzV3R=glHT#JdR`2S%A$>Jzdd zA7PLi2CqatrF1EB*MNoCh;W)>eLmt<2vA?e7ht|eiKdu+oedUZ3UfrVY80G-=$)DvgizJ%uF-a3cU8D@ zQRPi1lQ=cG^#Y9huaM-J-2_z^ z;5Z$}N?M3U{Euk@3oZVv?^ArL_IM&GS2zXi1{1CKwy@jkFRHF(} zRU#X07(h@Aa@$^@thaHvPD>~M(a(2Pxr7|WerD0JTJ7^}0)bg&Dx;hnd~TXaU;dc+DW#;uK1i_ne>X$*zwA@b{}bI^y=f07piIH#A- zpPE=i+=*UaKj3^9hh0Y~Kw$IE6S8ga1cE{4J)pF%?xQpR0UWj7lTkeKp72EZ&(JQ> zdq_Nk|7^rkiW(pf7&SAEt8lJ?U$Rs98Y~4wR=d9(A8sAJ-rDYlx(;R%rh1JbRKeU5 z4Rw$#Hi6)VVbH3tjR~8$F3?g{Ta)N!;KLhM^(EAT)?P%H!Qx#tI)Nr~3_`(AnEi;z zKOk1}M9%0^V%2tEda1>U-{ng3ohOLU>GJgk?p~u=!T2JXFe^a$jrUG%1CPQL>8uA!T zdc@0GxbFqj*G@Rp8Cg8N?q#QG_Xs5fTJ_-%>rN_X~UUP|UBz?|{|c^s01 zyrJ3=dp)c`3yceBp-0ok4i6KnD^jyfcV(?LH*t6<@cmdkd7^?Y3;PiU>;S5mO|Dy% zw4IH~=-M#%L&2Q(pbG@X8zsG6oDO(^&K_SxHS)^_-)+Cye{bfa8w~}0&#>ken{4#AYsAb z@zyikFrHftVSGk3kaFyr;4}c_SjMUr^B3>;QI8^yNpf`MAb~A*_qvCNdq}W%LAbm8=<=fP0JQEf=pLt{6s#qb*^Gk1}rAb;-!8 zJR`LE@6p&Td7fn-%TGp8{?V$6_>Ye{ucvvANO>s`h<2c{WuZ&T>_I`qOBKDq?xrTu z3SzpA<{7#51gB-1dz}%=EyUl37+u5zvWv7H!pMbSt@@;jaJIsrmDB%JEXhr~2+F?b zQEl2cvJ{T1F`6=HNl}wRImQ(}ZZk0%4jXFk^)uj^;Oxfgtd})bK zAfQm^te^1!{bH~QiscjujGe3ABVjlwDS95|=gtEmWy(!NLHHX%V389+JbcdI@+-2 zC$v4dciX&nY|f0UhWJypY;{Mu-idAN48HqbR2@bT7A0dEqehkVU^CG@d5qmu<8@KK z?QS$U+wrl5!tJmQuXrvHeYRfj1TH=!I$N}A3o$e}^^bnid~bO8UE=!}=~&^KNUj@; zr(pv(8V;6DVt0=jvtd0WY5_F~w)YU9lJMj~1F8ezK#HP{GE#dww7XEYaI$ISj1~PU zArOYLNs10)ZR6)3caFQO&vuTR!Hb<=y3gU8I)g^h?CgbJKzR8iD*Km<2;pMJ^}?lU|Ctktp4QHygkCjm}W%}D^?$5EQt z2Q@r8>vQkmINd%PBl{~a)S+gbX{uwFaXf~W&-!+6@gY5Vpew5;P;PS@g(uM&%GS=~ zON`CoJSj%gK~zNEL+iw{4lF$&8U>^9PVeRR>n&iit;3)ZWxEm*BF{Do78T zuj-q%!IU_`DgfvXWJO=X@XE;$L5wg19?P=|n-o*O>nL=BC?KO7TzpP<>CC?VA|F#ckX@bQ?*sr7F6s@2#=1RqbPz7v}9F=Cql!qY-=2cCQMOc&!332@C)=p-5 z01N;!I|Jq5&9@(9)}dw&=UpQSO0}GG9I?5tu2amNOK2_^`w5rqCstAXRVsPfOY+@m z#3k=r^#Ja2l5d-mR=J``ay4ihEE?2X0L|^>d;7|9p~-3|KnIc~gfq?AUJ3)=*IZ0G zs)*l631*NVg;1Vtl0^9-2Q-=(uLDa1A`-cWVg4{it+;5obMU#{0ELM8m%(9y@Lao>lDnl^5y});5;Dpm5 zJuoCegk8s;3l~6IVUlZWk1c89oz^0v` zh!hps2(9vl*FGSW(OnoMwHIu>)nGvVVT_m<`jv&5m--ZMn+YY^%LzPW?A5ZLkaR>) zluZ@>5rPzt#@Ph1L|z%Zlyp`AIWi;!a04(euoO2N=BagE` zMKaPD2lA$RfFOKeQ6IB73@P;l>MCqNtc8$0mt6*2w%jHlPKw!?$0k?M!+k z?T3U54x?dy!;r_ux^BXU&I82JAMyT4Rnz z_O1y%tKBAXKfAzSQiv1`c3eyb$?0j2iWt_~tw&OiV-erro^ha5q7xeyOZt*nQ4+&m z8fNcJDx5(LYk>rWy)X1wS#lAx|Fb@cEnGxVv?4dp-q4{tH4nCdm&PXb2R2A7b`komO>b`O z%~AL8`PT84Zf@$eHgy`Ca+wRaOn-QDL&}$1H`E_`EuG&CW+WKh}#|Oc*pd5a(hy^Ol{Q68=M}ExDMW? z*W{m)Ik;fHSb_wnk(j;H^93?=^5|NaplSO3c^P72`fQ2+aArQKQSbb|Kd_4fDcj~`z^yCW#H)(3J&{r ziLXLmGYZd@a@1BKEfyz=g-p~{IV+8|?Ex7dC=Co$<>GUmeze~DOuH_h}?S8~!s)lnol^dMZQZH+g9^S9Smub&-qb8tTd$=ig}5*(^iTfljQxqd&RK_<8%C z?a-N61F?$W&^4TZGZOP}EAo_Qa;X-8zf~Dos^{DtCAz74rjw2#g$9Af%Ya$_RX7--=f=X2A<6(HWn`0(3bqR1Qzkw%R>x`$KEmOk<9YB{jAEiOxtm) zLdKMhd4BtyM5!Gpy9FSj{qc39$d}p_GZhBn^qLJ~8@ym4l?%hSLqxfSUso5D`!l)m zt}=2~(Ux;-BPqOc`Yd>_$-=pV_qf~iokn1nvP`v#T%#@CPAx5|byrVd@s%eOU1C{X z!P^Fn?@u-Z#F3r-%Ys^@XwrV z<6Z?FqoLVP(a%d6;i!HINXfU+7(RXaC|r`5O^NncKntG?v+t#6&0vtF3k6?_Z!P*3igEd9JVlL+J~$XT&V#=Lnw>v+0{v;6KYiK> zm)rqin}nfn0bu(bBPKPNX|pJ8Jor}OnrBBIzEfl}$k6=8gz2OwfJ=r7t8>euEf{>l zl8(71VVJ#(0n-tk8o0Ga;|49|8HV$kAc~Ur9ht(LkdvgDqedil-#}YesTPtPpV3}# z1{u_a`AE-VF>Ln3Wfi$g{&l2WLOix9$F1H30;rt#={g`eXZLgk1f` zB8pSn=5hL`ZP@?wpBv@>e|`L~_QOXN^8e#M<^Mn8Qz8Fz{I7>=tN>VjxYBtPfb`#a zxZbV^08mx{e7XE@nTV03e_oRP&+pxv>BT==u(zD=ftoYOMsA$%9sNHr81Sz36ll56 zqlYdawq~CCaQL)Yf)@nDs-#X!I-a1K&F;}NI(VTDbih)@R(N|>)t;Y60KeWWD5>t| zo;=fPhkj?#*%aCuV#Mo{q~Mt`l7{8oa<4+WdK-m_t(E;urosmCg{<`d^MPe%(*I#{ z@~_wbK6>=<(W5`<|G(+u(SKTTqW|r+P9!G4Z~|a7nDvM4^>&2`Fzlmr5KYj+Hf#yVg2~MV3oZ{0)Kh*Tu6>GyrpKiR|0PvIE z(2ude(v_lRVv(@RX>Q~oCEuH7@L;GNOUBb2R;Gy0*gI}$3j}RPcW3VP$5}p!hnR}O zd1mOS3KmaFU?_<8Re~W(E4mIRz!|?8#S!4k3EuvbrE8qJYLW)jdAhlZ$#CIYux>RQ z;wcRem)aFE@+ZA~dUDegIcEV2gtMm13>fJMX_aL%8m6W-pPf+6sbv;LgLJ zj>rG&hEIL|yy2Iydi<}(XyTZiVt9A7tFk`dfbeOn1q5Q%oeI?s;l3g@pR@R6F88mZ zvUptFKrB1xPFkk2V>-w;}y<)*ojrN*C-W3u!^)7%D+E~HkTqS98{8#?!PS zovVU|&e>j(P|Hc24-@i0VomiCly- z706|6h~8OT6xmq2R$I|jCudX7<*1ta+(1s+IJnK!xv!>Fu~j=VF_{@)pH0r_of&?g z)cbuX2lJX>i04F-Y0WzoEn1~2()&-Ju}d!}Nl^~W%6k%J^~K=C2-bAf%TJ&2U>o== z+|?6h5s!v7m5X8UtQj=ytsV+oyL+pZ>pZ}az|}EuDwc}o6h#9e8;-4?W^Hr93zbsM zUuBs#2~$8_z`{IRgahn@UA2d%sR|EGJ$Hjr&)=SwiXrQ7pO^3gtG?bkKJFgw2YXw` z+duB?zr<&snLk6MFA+<&w_f+&?7!IA-#PlR`+Tke9I5l}^}*2&&Nsa2ge7mmJrwzj z#lCX@O!^d)!-^w>&OO<5($`{wWg2fP0V}F+l!M0mUso5xnwmBuDauY+N7RLEfl=-? zq3B0rSQPZt(eX)O=bLCHq2n{b1iN10xXVH zR!iAbL2ENuXfJ5&2f<>Ma`0i^mk}ln!@0sI_(Kg~_)gtmx~O4WCfWN0>+V`qPIZk; zyd7y_SfUA1wpU~-;DtLLE7ciw)#|pnYQ|r!)&>`Oif5EO3iZ{jGd_G-H%8r6)x^!? z743%_%e))k&BmYp5Y2)Rsr^;6OO1uElGJRAV{;l&Dknl4lP?K}hsIQFiVf~eF+|4+ zj`08fos*KUZXCBA$tcMw_P!a%J8u}$MuR344V!Ty@sb{zy|Up z2k*amw-B1%>$o2R>D|H&b63iGrHa`%_TFA0?OKm;h!{rVF7VIL?2<{$rcZ)9O8P@{ zcpHTlqJ>}`3&Vy=@@P0dkAU&m;GA9?R=K`iuAdf@VRgBIU2c$^!NFTuZfKX2zEzbQ z+vUc1-d2~(?Q-O6UtMl$mt&EzvfQORFK~2Jm%FmdUCkKqKTW|#UxFXnr8FWaC0L&V zoAoslsGjTT8lr*>A+87a;ZInise~sd6X5IP!o?Pc%D6w{zCofqIkROT+%WA>?`lRP zE+e_^+?_%xH~%hs`;!q*mzKtG0I7!T4Nn`<7{XX|gJ`$G`$k`}$v`DTvsq=5pi}lH zBNY}&an=x83uNX64?5f%yWP!>-LSOO7z5)IqU_bjntl9cI&s@R=o-AdUU6%s@6#in zccv_=G!wU4&C(g-ZvW+lb;F=a^foAn?z!o;z*s4rI8vi}J!poNA*(qW>^e41Vom6D zJZ`l^ZzpJ!_oi&aCyMrnWol-ftEFRhV+N>`Xc(pa3jWH4XdM@|pNg~Hpg!?q20hDC zh&u76sdPyndGlJVSkt1miTjDAiO-F%r2YDh8NJqT!WZoP3QW8F~<{b%; zMGG{E!g8VPD4|IS&mc6&?iuwRpmvzzby8Ny5XmA0z`bE+t5)B^yj(4ck_KD3LRU38c7*`do34 zy>7vi^p9L{5=b^SZZlnZ)l?~SRCTQQ6Q}n|ehaL~J&b_!KpoULn}h(EqMO3vS+gyq zpW5;WN-h1RtD}0U^zKyCpKVfbokwDj>rJd9`};y7iN5sWspL5~(s@`#YEkn!qJvQM z1x#rxWJpqKh$U#9h)KOx1yl#=?~+k7LnE6GYK%ke)ft)tIyjABOAfTgSA$ghX_|th zrB=bdT%CBa;2q>eum7*Ma#hD2E)5y-y3#%jHuSFzWHqZ45}qQL zeRuoGEp@?F7kt5_3m0{}X}7gH=JK7ik2tNiMu^5Jw>;G2@-Y0%jfO=^T0pHaDKJ#k z*@MM|y<+D1N(s#X4DX^3dTFUlM!q5oC+L*`+lUK63V^e$z?c(oX5cl@2o2LHNY*6o zPbay_%2&f1Hx{fM*^|OuSVgKWfg)T8-3Uff!AT*mCdH@^RdjqIr9W?)Mk}p)+||y z9OY3^7Xw^%Jn?$(@&p_F4I^zQ z*)(@L7A$QB9e+TgK6>lup{f;NC2iMR)OJa@mie3Lv{Ch)Qne&?r3&>S2O*`lq-h$5 zPIwrYSUlgzmBR6`q(RESQTah@r3ekK1*$Pn?DJ7XJJS(qPwKY{>z{WSLt#7^$JzTT)ioap2 zWOBRtn>UVVL+-G3I-%RWPu6#WGB_QoqZ&7p%uUtAeJYVIz!RHxQGhSj`}*W7xAYkt z_bb-^crMKU<7=)BO{Xg-@em?)*8f>x&*Mn#ZnI&k=)8;VBrpFEpvKOKuXJdu!Ps|N z_@QYwlV){YV-&tnQh7h(eQ&_TRgC{ zG#b_uRV@jbbsLdB&u5|WM2z_;QZkiGRDID(uznLO-DU6N**NRWSk$9i#oIL!$$LhmnUI?Jsr=~mjeZUtuUhf-5GZ`_!m>x@QQHw>)-(l@FW!s{;|41&{NIsYQVp+O1(nh0Fu!5*_0t z7ROa)fGER&R8!`l==Q%#v_iyo*M@}~Yv6Lx%nxnSVGatYN=g)`^GJP%=y`dq`|pSg zB0-7B)ImhU6*WSWwJoqvt8I$_iYv$_6ZHJ11wn-t&1hLQ#vd4NYm|=Gh(wF633RozFSIUn-Du-bT6BjR0vf( zPP`7=Fj{zQr0(dZEC*yX7yv3|!&rC=OG{?p+`%T|le?oVixN+0Pqff(Wj^xF7AkKH zw3UlxnoxqGrA}`)ltrI_^Lj*EsO2#9+GNq6l&Z z5vGI(B$K#ULCg#?YHc|A91WsxE-7OWNc9>+wku@Ke-b=V6)f{fZ~xFalrZW!Mw6<)-(bN@ zw!iIAWyz%tjuoHa78ek!THoZTw^-Wb15c5D%VR>rqq7^&2b`!PJIP?PN0jL9AxfAk zeETrzCunK$k7=A27WWUs9G^@+Hh_y!W?V+is6;!!h&1C+j=<(>KcQU1!4w7gFX zf-c9Yx{P(00}7_X90y*#@D6IX_{*417_;5;jyc0BYbJ{-sHf=;HN5 z_K$&%%Mm!p^eog!6;M$r=~r!I0874jK-^-R^~fa-!QfKpaH~~w+U8lew2cmtuyOK^1Q+``oC&OSns>WG>aNKNmVuR2IP2m zOyf!ulW){xHDsUEBlU$vOsRI!)*os{d74Ia~_%u=98E%(Cq zGxWQ$W~rmF{*z6s0sD<*^k^UGdUt!9l(uNBFM1eNC;gf|irw1bUIv`Zl3eZLR&H;3 zip~c>LS05(pR%Y$P5l7EWf0+g4C;pPI<-0=oVSk^M2F;p?2M71Z<@Fnn-fPITe^Dd zntZilpH-rBt$n_5K>F}6xsvE(zQQ)&Jo9E^)p^nHbL3^pb*Xn3Z~(JiAI@l_VvxYo z89UlF?pHc+aTg{Kqzu1|a;SlU>@l=_y)xYgK;50M%I^%aL$88!wY?q|PrinfRKfh} z(0a@Q+a(YQOO!{L+coW_<#Vw^*Fgp*9N}PC$otBa&lZT3i^~ZkJ-XmowhUUXc1#G- zF4qyD@4E_f1t|2)oom~&*h1A=WKLFQi@Xg+RBFS?8R#5>Hwuw*AnroI! z{yqC|_MUYQ*S)74!_eseXh+d>pLkO&p;IljhJm7dhb+ZEN`yY!D~XU4)xi(mq`L%H zDS#ac-lr7mZnY2jNY5ZPJet z7kq2C%o&WS=3Fh-6nI88Wy&EMB@rCkomk0gF4C}>mYr*AEY&sX&_tpt%M zeoBlbF=VOBPa1^+Ep}|3izf1~F$6>=+M0>Vvln}_$V|0$_FD7;A&HP?9)G%5J`?r0 zOp7fXiC)LDCu9}(Tk_$Bt&kT`;hXQjU;h64(*@l6@!INlctvkTbfNgL$KAcTN9_)_z!c?l7@bif zmPnxM%pE!*mjdu&ckAWR+(_|MgO@e!TTO%G5b$NX5ptS)@hTBV*27AO>3W2wE0 z^oI?Nk$>ZXTm|Fd6fKV@Ktl;OlEd(xH>4K_hkIMcI@}p`GBjZ}@!;CoKYnqzx7*#v z=k3+7%!mAAn&GULlPx%02oaUZ*=I%)fSPWo2#fz)m|rLb1L19}@1k?Fk@-GzeqmkN z8~kd%rVIA9W2qe|TEX6_*NeIJ(%NuF_ad!KDqFEw(fMD0oy;q$eKWk(TfkdgU7bhe z<_!=lE?@6DO#U}#a`~xtxjt3f7WX4b5_&^~x6{d}Xv$BlP_`Auvrr0J$YK2d=nkNm z;6)&zeUpp~wf?|$bmEO}EKQZZd5la8H$ujg&OVySjHpp^;__H%NoYJhJi8%ug7P|b znGA|^)2W#i8l8aN=BU6JWqA>rigLg&YmYDOm36y*j3+>J*}eHxKa|_dB~M5; zv3jIJTgb#N61^vE=WmS1JgA z6jG=!AAJ>7WXx5k6LWc36wd^BhY#Nl@p|N)3_$fCdPC1y<6$Vb>O9n{qwTGrgR#}I ziCdL!>xl4`YTJrEY%b`4m@B^{#Q>j{j{=$CnFj*YE9*MBqT&_#*OIhwYmQVYxuq9R z0t>9;)~HI%)QB)wCS7qjGlH?Sq(^%fD72Tp`Nm-sf0JAqIQ^b+7|sr@t2z1K8EcLL zO?uGsO|9MgZHd`-M|_4aN!L#XYN*;u{f zuhO^7^lfUsUYW1Id|{7uD8sMb_1JW>tC_OXg>|pknSS^3HjB~^GzMa?o*SV;;xXV_*I@_oF{pTU*##?4K?+ZuzJdK(X_Z5d2=Qeta~Z- zhHr_~?Us6)Pfr96ewC*%H}Vj^sb?4kLOsRr@?3${H{0?YLcld|ZJ7;svJEhhBi+qP?auuFVp;HyjpX!kUU zhXXDT>a~d=_(cj+dt>fOy7d!hDX-cj+ z%q)QXqBf7cZtgV6CGLib?jHDfC~0LJGV<>Z*8MN|)W?6PS@;^^-*1TjzV_|o_No{E z{n4Yx-~Ji@{g3$A@!w^|DgEbKM}oh%SK8kN?e_Y^@7Gs5<>2qT(};6_dY27x% zC%3yZ0_?*ZHP%ySry5rDG2-m*c~d3tZU&SmJU^F0;WC0a<_g3OqDm-cfSlm`68Ow$ zQsnEvWJfmiA?kD+mC4%^nhzP#mfy10WK)FsHD23YBY;pd%at z7#!oHelbPXRP^(@lyVju;sq=4Bk$9NfHd^vj1UzFg{_3nqaoMJhZzj%BrYyvpuej$ zfRs80%}?`~M(`t!XNpW;6pWH93S@|Rq|k%5Paa>AriB7JJj3kk3wdx6O%j@Zg0aQP zrH~bb$7vxQ&ttVR)b|KvY#_@psWRP?Aqyc;-m09zXbY!CvK%in=d4)v1@o51jg@Fc zFm`5+kkA#U0R9oG@f>4D_k?l>TFpv(*=6ds$x{+zn3ouXab7AY!z>yErxE5n1@azI zG$RmGzG())un=>GbtW-F%Y(Bl8!Ss!8kIKy4wv(rGYQay-91a~AU>I%d5HuDnfIWS z@a7A0+w!)TECq70q>LDf=2$0cuq%&4J)gvnW+T`_*W(!N z_GvC*Gt-XD*p(`P&Q9^t?F6QqqQ}GR1E&)4RydEZg93$2D1VM=YRQYBBY2!I+gEeg z4IDbo$()%EoQmKZxqgt@Xtl%N$)UJ3rxcBvMmJ~R1v_c+8ecWWp&6gKoK2YUk{ee< zjMqNBvwH`nvDn<4PI)UzVpCk_AwrECrMgg+iEGBb1NJ=7KYF1j;q7A*VDnnZcO-~> zlJLO$JNPx=+t{fv>%W!Ch}`l?EK4Y*D9JE9cA{9gz^3;(j#j!u9a+ReFl^;VCW(rQ zrd27B3>i+I&giX7);nb^L6&(b-XZ{8K%>93m6ayYE6ho#R-wVz)LIPL663z;?dm)1Pb8_Cg<-aE21|rabYm_f9@9u> zt+OC=j}^Qe7rBs6iJZ;@_K!kXh;{1ZpoI)e(~m8flgM8K`TY|k0j#ha5w9Ql0_v;%{Cmc3}rpN={%*elBUQQ z=Og(u_@b8?fvo~bOiBbnxsbc$|PTOf8W z1)F8BVptS)2c(z=YM8keG#Npj#hEhYX&6A-@apm$Hi365%&axFU4h6WC;(x^Y_H$vx!Xj zSR|JrIxmXt;gvT&LQNS23l{u+1w(Di zs0nX%p~cOh<9HI`G$rpSjg|5BKtV*_DD)wNWhkZ^P{=%Di<2m2C7T}UcoOIE#R=Ag z1GHz{8D*oufFx;l=>)H#`HaNee>kjJf|R3~R8OrT@Wv!O!qZBl1z!-C+t49K(5^Su zF*yQN6ZutjGa|B~yuk(7#LmN63jaPajajl?8kN&?U`zO=%t#HEpwQXo0#=O;z757*B^SDPuhXQGB1gL@;u;H+U$ zO~}hEN@{cJYN8Y!a)k-nhU!321NGy^t0^I67EQ07ZB?agjtiU&E$&53*9orne^2m-6*`7^(PStFPCkEWSC%!Z z944;D-A6fOcoJF!XO}}Q{iZgky*D*qswuc&fe2v@#*e1a?1~tGiw~UC2vG06erKYA zal7ob<;5P+D`AT114AdO6Y53ppPE|;*~TT2ip4*bbWw#;66nN6Ff4gt#z@$Z#+L>Y zc*XZ=q=xWFc15$ydK;JxWUup>+nl997JkKJi%ICpPScu zg!o$K7)tO

    t8?`7~gA+k2pA$Bzq>{0EqZpdQ!MtIDfO{^@PE^QInSI9PY#F#z- z&R9Yn-R|1F5j9Ofoqenzo~xB``})M{>u;64&Ce%E`qAF3HYH&&8|sLi#H}PnR?}>G zO749TVdycFP1HVNlT85v*seNr%d^%#X<6JXI)%i`_z}&4P#EV4K#{ys@Yd`B4^+l) zJd6mD{etAOI#AwlrZQN~b2)TN~E5QUc}HbUh* z8J!ECr&L4ab^5NxL#Tso-ruwcw3#d1(lj^Z*9iri{&*CnlepP2ZzetKNDGJvP}i6e z2=je2Ik2+C%D!%B!fW?8_#s#g)_qom8*{c`lL1x4@R$e-R@W(4LW)0HUDFt&=nyf5 za^ftt-)Z@r15;Sc8S(kbJ_NYd1cP0pm53wd8~uUiXxuZ!hy%3COiRM!p>SNN#54pp zRbTvS+r1%> zU3`q%!n1zXKx-fq4nuJl##GgCHt?9eE^VIVe^%AR7V&7Dq4BE9u-zbAt}Gp1BO#;f zvk}pDO7@Y9Zby-Kw;}t~TU8v7#T2P$H?XqzYL9%afT=#eaZ+t*Wy2$tL`rMOk#)~0 z9lQjvjm4){R;UzdtTRzpqVg_X<=H|jUw99kV$g8=FQTNyX;OxJ>87nW)TbYE zx>otnziqYNd9t?^nmwBi`PP*#A|gJtC`^btuw=9GG0)+WFXhSzResim(FWf`G`*WS zRCb9q9a$GDJBB2u)|P{vQ|y6X&6vv3q8dB7G9-#LS*+vqB+8Jl8H_-H@u6UkRSXIq zC7v(@Y+6_&D;ofAm}_{{P29F`VN*k;%V(zp%FZvaE{D~r3bnA(Eze+m<0SSX;~7_| zWgcpTk>fBm^4Mb~9A*rMFClR(DNSQEUDO~>!J`r)DdbH}HU^ddA+5wdOMA`SNa^Mb zB@O?g(s%`VoL{)%v8x(^5lrgB`J`xuQZ1)0N#Qx*`KX>}W;AhH4cjW^0n%t}>4H5} zlJtHh^t0weU9VT+Hw}qru@st5NDK?n+?!B!M-Rq%Yh6+5{3aTl3kUV_GR1?;x^^c~ z4$XscEQAfHS{se6t8~I6Kv_kR#@91PwH(020$Id+Sn?IaeHHrs!a;31;k_@pS)n@a zJ*T4~Fw17;HC1uRYxaG~cGp=hqySVw-IdH*CQHeohobUmU<(MWt`?742l*m0;6<^b zV*|>yp0d&4CgQ97*s$Ifg?d#KnwvR+LodM{VQs8?&Q>YW75iLQ4>zoa}r?<1GyQDcQAXy$10zw#_093uTWdLB%@< zijxJ*h~HG7w7!;}&bGGtsCYWEl+u}_mI#je$feW)FgZ!&zGW$$={#iL_{g$F#FRpB{NRAo=H=oulPbsZpq(}CCw z0=yIT4;4wA1lTdjrf26a^HPdqbQ{aMFQ+lLwTrVuk=~M~)KZlSx-x^Z*x^JS97nCt zU72n7u>>Ea^|U9}669AE|4mVt+}=5d37tF&u!_lN-};nnK4wAmc9TiTEI=UocV!i>i?R4)RZ?6b6?x0rpkn=FCnOD9}j2@Nr}aSuK= z-J^WQz#n{^F>X4s>c(9@zv>6?on`-$!ROk;8^>=b$c>}6?)scpc zqNQdJ(LR`qeC`^3{XiyPMgaT}Jgwp=DVEUwu}PaD*RHO_CvJ~X9-K^*pyAO70xuZ|W!SzHaR{C*wciQt#h{~uU=;^b zywy)b@(a+$#W*luGwAMys@q<{Ez0UszDWE)!OAp(vI*@Z<}`}V*c~T`^`OD48QO`? z%!ypukP=e1Zi#PNWOtcO_eZMx)++n!>?QR|tP4siNO!#ztLUQHXpD_>I5 z;`uHR9}EXWWun}KyReh-x#W+jh}>@Y@gkmgpS^h*-n+*<93jeQIfUsnfK?3OC(Fh? z$vL)%==jmGPm^|MQZ`_kmCx(H%m4qT_z&k_p^e$`A67e^wTI>S50C$h|L{kA%JCo0 zDgHxy)x>{T4ccq#@c-4vUoHLvY|<1{aEO!qx$iZ9ey`e<-FN~kJEA0- zAh?q{Zo{hhS$zJ+jV;eo^vr7h_U!h}eVDBqnbnKCNSqFwyWLt3)eWnG@cCva)lg>M z(Arh*>_}Bv*<+M8>Q7Bm`3sKE%084%Ngaym-+m_k|LHUP{7+84MgXYU=YRXr<96FW z|G!=9{CWQW5g-5j#}x+#puN2I9Wnrq;PhYVtOf0F*Vn#VZ$GMF05}L7$u~>{_M$Wy zV?Gm7iQg(3lpRQC0A#2fNGCb*BI)ezJi8%~PBgv3;kdzWrja}|@Sz-0#KtbgOBw3O zrz-hS>KGkKZUU)6Zu*X91||YMW|F$_)!GIRm9bXar8H@(`A*Z#No1S;x5Wu1b{$_-a1ztSJ*oukd{>T3sIM!N6`7r`PR(|^WMOv86;X3(=c;7SVr@&PQcU3e z2y&J*uFqaH6DM-ba?`%CkQMFbE3Z+;v4s9L#dx@kd?lv9+Y^gqQ%b6B0O5vo(v zVhl)el4rxXh@FU^r9IM~J;Xw+pK1tuT%zZc-oZjSHe7SU6ktW*rMVPe4r16lZU}`F zr?j0K?@Tggy7$DLb!{3(;ZsP{O=hhfO`t6^B($Z}nWHLNt%`14ouzKgy)I5RoE9q9 zuj1g4xQJ!@9J+=9Ku?1>q$10mc!I-j zo{l~LMzdGF6VKY8`h8wL5ev4PFUalFcj&%N3cl(X-Io)Ljc)Az&6+yVJ9sJQD`RC_ z+e%r+Yg=_4GRz$mOqm`Qe8+)ZD68`tQeFs|y!B?;FuS3gVXmX{qv>?JtD$Mzy5m9r zaN1@IdMxgUDF(UJSSAC8R@)i&S=F%R1lv^OH-0(620VBIs0Dvq4y*)g$xdN-;{?-} zC51Z`*{~~DD%N0Pau5MN$zG=lq6YGMzdG5<(9d?F(^AJ{wOR?#<|rrQ04Ie&Jhm3m zN+E!;m**)vbv&-&uF8jaQbve1%`an|RP$O~mkhC??1T=-E+^TrCUuMB+l@o>IqMP! ztlm(@Olntp;pdm63Uc3%i3KRYDBgLAMb^9ntCW*~{oU_#xBL_@PTswE+zj*#-#SSC zmxW8gs(+a#{f~H$O3CF;;9M94=#;xPJj*6<5{<~@bMN5!o87I}+CnopBykc%#KBp7 z33WHHVz4zBBsomW&v8D)021x*zh7Gpo!}|TExA*ry-S+*<##2Gu6!L(D+v&S{F?r|`e(TND+S?l0R2cgfVi3&{LVrRnyHS@qL}>^N_w+IvQ!zN^>@MkG zCceO?8=tm@c&xUas4~Jh`kWEcV;OzjxRTlt4{Jxobylq%y-H&zgC+0dJW9$LkAeD~Jr4bl zMh&wEr{QbtCQJb`v`^?8>;vj(8go!W+9>40JX|6IH3eE@A4l>s z_vtkB*>IgIXEFfh$hEEpkZ=&sYfPApm`R0jV8+&Jeb8h3AhU7v*q~NvY-=jnwllU5 zPlo@(v3;l*8@HO+9kD87O0R+}t1%*M4%E?mOMrIS{2y-`~>5B>yMxn{rPX_Tn;j@PF223zk zB)u5gun1vWbkMb|N&c`2TQAw92&2QzWT|7%jzdI0z+2QRZ%#LY>E?%)Q&J9GoRkk{ zN{~fRr|3ltY!)Y#NzG52aOHFB1e^BC$PV*@;DcTj!}+`qK`0I$FWA9*4=j;7Mf>6}$aeef}VQ|YQ0Vs0Sfq|Gy#tVvTo^Py4SwXZ_LY`s!-=>i0OJWM}8uApeYe-im}Nqq}EIxpkHk)nIk%6Z_eSuZQp1`YcWR zj_HagjYhGdd-LcV0!NF;!uWLx1ZfZz5q@W7?L3m0dG5u$(gNWZ#bEi>igOI&$<@Y_ ztjMSUhT@-R>ZHtvj(e!Vs-i~~DblThU{;(0N5TW46X)RYdG|0l-c!eyPA5m1<}5zPT<>tSAwR45W}j&xKgDs!4#HN5It zm3|@N7XU9MbrPYA(&HLKdd*sMHmPZ@?rTO-f06-aM0rt+=GQsiEV;5#ESZy>vKnQl zl>WfpgcbgW$8=F-3=C;Rc@x(7i1H%Y2783pRUR_M$a9fVP`HNTV8n}=ULvOpGv57+ zR@*D<^kSs-VrgdeU-L{1T={+dZbxuwPoF%Y*P8Y0V{Dvr^h=NWg{MVQF$AIvY zcMz26?VxxGJg6!o^r(2Ndi_pKp3GYViv8f=0Vdma_5n=@h(znY$JGC;2^9aAe`fN3 zU&HwSKW^mz+TT7d^M7lrfAW8S#K+_R*!cf3oBkmS_!w>f*H+g%6{df8=KqY<|Hv`< z$6vJu|JcLe=dHtia%hKx-Y3_j)_~&%3`g`TKtNXZz>NZTYfy@VqNuyMN)tVRZLs4loJVg2(nk5cSaz zfe$38vi1DAR6ct1OhJ6JE8m{){A5~@Z?6x2mTzzN_vG7dcVB%w){o@N_QC%4mU_Cq zwX0z7&&{n=#`G7bHJS%hxZr`dVJBNVV+N#g){KiL@CA)VT!bnF5gY{cXFd28+M!qK z#C{OaIo-gZTBeveUZE^-4$Yu(W}O=tuv51z4G+2DIn|MujbR8iv34kK6?p#DF}N0| zzA@Vk08KB`;_DrJI=3d{O>`VYJI50U>nYmYkLmgxWLpZS0P zkdICOamC5@yZu;sf5HDdLHp7A+QUi>!0t3cAu}Dcq9LoJi+C~yZV^*H-c=(&DZl)* zs)HmeJt7P4o3gLs)%6z|h%3dXwTaH)Xo`lrI{xFm3K1KG^)sXq0o#ARK0J7d+P{r^ zp7p{oFS3$d0seZ98DN9OXu?uM151a|M1q^7Bqv6bGdBzTd6toqo0XWWn4n6l!R@;p zSenUnT*QO>^I^A~7Fi<)mt)JOr$@HysxJ&(p{ zQ2??mYIAvfH_uo08IVh_;y#9pWgNCl`0zEFubL`D zQY4@>_K#_T6D+P5R?;qb@776Vo?}YTLCcTxiV0-V?}~GeaUZ9wM1r8tF*d+=;)_lSA*V4l)u&ue9qOc3V* zbf>7^JW1#N@!M;W-Ja@UsTHNjt8b_?qaoh}oiD&6AcedT3VAgh^sMyNZDIZ~8H*~+ zw&yYvs{yz+UFHs#Q;&NUYAr_x8C9zGo;~Al{b8(*F@w-bLyPu-f}q-%odQ))&OFZ- zDczjB(QK-oW^V#t5K(-k>RPC`EJ zn(DBmrIoG8qZz9S=80&~EJ$Q|I*;D$9>eJrs@BV(^+_xJ<*Q7uzhY-mH%_*3!yvt6 z>xb?S!C5ppL0l63G|w%o6j3xpe9O(nw+!k&SzFUG_4V%C-agpf?QS0{Mx%arTW72~ zGptkA5EABG5cpwtx4U)J#Uo-~E`nbF^$_zFm#OC&hRlWq^2IEofWSkYT?kIvVfH6F z6PNbJL(^U5SR{ruSQ$_C{=1M~yXnLH^hn;VJT^i}&H!u+L-#J}y;ftrPgWDmOBmC2 z*Mfn7E}`-Be350G1Kxq5PHpS%BVCfb-Pjc?Es)ws=47Dp$~^~>3Cb>_Nhl+;48*-# zaiDwtY}N2f=C^45hw+h8|GePUD$$MLAwvoY7ZEU(YTU7BCje8*Ja;X33In`?>20Mh5*!g9!0gi z*T?ffrPcQik8oViM{$HW%|l_yh7DCjK!7F0UjUn#t2CbDxpq$AacLPrYE^{&_S~bm zC3X)FkN&!Uy!DIPugbXtxVVj(tmM$119asue4kyVpeX7&(km>1L=c?LG!Jn)$XT_W#+Ud+U(~89P-At$ zL0=W=3|la}fm&JRHa4XR_Kc+0sEI42srQ=;fo()b1m@IW-nI?G1`Vx{N1Pysm59w`!yZg=*rJWG|pf1@Eq)XD=g$H3 zMzQkQ2=Ci4D3d9I6H>y1mJUkj9x5Or=sFH>vZ`g@5?fLMMWX0h65&&mFcSG)am56D zBALQMjxw7wg#{t4(5zB{lqr=iUh|n}As<_I6>!pbc+&VL z59ebQJ+aWo!m$#iBsE^#6WQht zf?72?pDOHCvK*hBC$HpBtqK9p;=I7PJfhd6ZLHS4yIW>lO8ZH0NF*0d-3QheMPM8&~1n zZ#W3}^0xC1=M5Q((4zLGbmO$DEcll&XmOmVFZzj}15^hEfOA&lQf!yk$C6?x={mnh z&IP;HT2N;c20IqrbX9nIiGiSO!4w$u7?EJbV>iqJ>0to=x`reZV##P92S zdH4yk#;PvOU|~krYkH`PB)4f9W;f8O$IB7)6|9Tf!Md=cDtm4{3@Ek$!8+ci?V(l0 zUcip9w}@N6=@Nk*soASy1UrxOP-L~D+d7hi$I5BHDreP8;z{XxV4B`l!BxU=RM4b# zcx}drKIut1jSX`p7M<1(*yJ7Xd8iF*X-&Liwn6IFO}!VFg3gAshN^^GKc~XdlFAeA zb(~Ad)(BmQ1M9G)a>(U2Fpo4jS)t%H@1Oa;a9LXXPd*~nj29`qeb7`6*%VTv_N&zn zToBg$z<*F~lk6 z>7;8s;K>wtk|RnYqc$xmP_^EGHnw7Nv@EdUsVWFSrQyHTz#?)14fj#V+@kU~Fzm3^ zI%*3rj=0qi;^5RTIO=;8y1YqWFU(h+^wOA1?5af}w1o)RxYkeL>A)3bfNohoEikcOz@`7!ZetOKcESfzv{P9{z%OyMjBEF3c}F*hh@yr zP*mFLblbUyTvfVuY=D{#-J6<5Y1DEY8BSYujKs7b)Bx87clx)Q6*IoD)MH0_FwIKw z+d`+gW#A-1%W~;`uhvCa`umK=>f42VY_f6$xc6R?_YjojRb4T8ev^*Zt)VGQq**t~ z))2Wehd{Ls5#E{rdK@_~5vv`Xbca2tlBXPMpp{gLh={5e_eVp?QJiT$=MqY_w`(P& zWS&9G#IlQl{)rOEhOkb|bDR?MHi}2tESGeORMLYB zAsHK zzsu2Krv2w1V*lTH{AlgbpZ=f!rjKX;c~179o%VOp?F~R%!4~Y-E8xNM1nu4AE1bQ% zQF=B7Vjv}#Gt@u4ezV;=OtNP1Y!dwwGrOD@#dv*XOhjVdjb7&ElAON(zhyAVTWB~P+&Jt-EhIk7yQ&cJlZ+fpPR?=!=9OU-irBxe!JY6 zud3bKf3r9DXtnLRyo#m6+`JilV>`qcSPxsUCf}B3(gnWt=J>~h!=qqs{%|?ii6_7b z43kmbKfeZ+W;ytA85r~6MRGQc6G}GwAozJX*p7#B&dwHal1x65@Hn2tsNYX8jAS2; z1sm_5#CiWIw7(EqTAVp-_Gstj{?;*2!@2oiSJ&2{%sfF8IS}EEKpIGZ+6ZYS2ZZ-p z?J9YtlzGyEttPT;X672LcBnll$9X&*WUV9}0CJH3qq`0-caDw^|4MhgSP{uh=oIPh z|Fm;>uy2=WyCv-VVkyxH9poaPT$oO@QEFg13cp$lo^qc9cIs6JF(x!pGKk&gUw68@ z&*xmk=pG&(zS*Da_z(FKcW%vpzSrHGd+0xe|Ia;wo+uv}VFS$BufJ`WLdZEZ(5<1j z{Xz_k!m?+9=hK?AUJysSaydz$*vT;Kf6Ot)X-anrz^kterhs3-v*Sh~5j?j&bZk*i zdTmvp$O)dJgQta2KT)TUa<`Gbrvie;XGQ-FSw7^{-U2N2orWL^%k72)u;$$NLBS z-8tDP?u(t>xw%#M*|UQKpjP{H9=aXxA`wy^rXJc!NaHyV>m=*woQHSp>N*FA=R8&M zPv+(xyDxO3bKiP!emv}MJ)fKV?w(L8kh@0Hk@7<5e+(jRbdA@I!M0-&=TMWKeUR(6 zU(Iz^^^~5)X*_{RW!<$p1k~~3C&<8F_I?b_X<;6kL>9Q?5l`T(Vxuo2de~nJGq560 zC~ZFu4ZUI2wvswq`^$r{vwz%uDIj*Z@P>)$$b9?AiOj!pkIswNJ2vkxVX!Z$f@~AQ z*5K4^Gj=(ms`Q9I4b4KA$-|76m?TzE6uXY5JX|a)#xRtAX&bvmsmy6<(=e*k%>|N* zz>ct7KNuc+!`!Ns`a{at!Buq~ZTEY(YJ6dQw>o@tbk}w$kHBU?1fd)SwDMqm91YL0K;z$fZ`ct-U)tn$pIm9=C&pxeNyM)E~-1fSjl%IT>1Tutkv|`8J9B zJ`By4*DjxyjjI_k zRbl~Y=}aGR>zh^XXF6K1t=w{kN}#W6cS_yTiLi;$cx#ugvW~iqD;*PZO0cVA%W`#e z{9?tYoC6ct3SY7^@bzTc62MoKX-CL8Pf3O^-s~UyN-}x;%-51(v)$LemJFVDk6&-S zIqLdqGJ1nm_TKEyeOs~KXJz#WzPmh+BqOc2#3K+!2`hnSC`r_<|R!r_|{|df3w%rlUf4CDe|qRc((d?H4QOaMnIAuCkLfCC^3_ z{PA=;NZDGD@TT?9Ozqox$dCwJ;%;DWCR@mdTsph}r zsNFaXm3xV8eGPpGJ$QcA({Rq`Zv|kvFWPk_k?ynTN#zs2A;*1R5`gMFe%LXc$WKS? z_Ufx?nOT{$8F@7wM)@WPjz->x#E~EvuU{`C=Hw#^&3Y{YWq@$ zvoyZB#|QhRIdj6WS2p})vxE_zlTaSc{d!O1ljYDjKacLV%26>7SL7QWuwi+h*hrj* zYG=*xHwBRHc+ScYW_zp>1P6rW^pP+G$49e)c`nFC=bm+(kH%4voFp(O*FtpYP;|+@ z-3l86A^2T=KhW@c0zGFkfOe&3zv|!?rAygz{j)xK*Q@GozyXTj<1g(tay`sI@n&b9 zs$7N{94^B=&ll&sDpTFXfTK6T`SKO0xPiN(yV|Aby2wbEZvK8eIG`X%9`AyW@#?%? zdb+!_-}TrQfndTbp;K>uGe_^R0-RwK%Fg`}9 z81>gJhmXnyc?4d|_$;iv{N^>&-^6_o<0SEoE?PoN27#yI++p-+%q^yZ6Z60M~N|^4u?2*SFh9PaJ zcy9h%L^ECDJs*h+P1G**`3oJ1_=RJwE|kF-5Jv!FcN$^oZK@I_DgH$-q>74pHl6fi zU3F3A5E+L(q`NEgA4+?2%nVmVN514GEx7NG9s=a|PS zpY$ojz|QldoxgS8Q3O6+4r3QhkXFUPIGR|Qg_B-Cv51+QCGgY6m!yXAKZ-bh)z7`f z;I>w9%R#V(X^60Bj!wey&P0{1bYFeXo@Z) z0h)!=vF?qRvFP~6Zg6z);`ryS!)~y16udq>_-W^P_jxeCbp*fXo59aJ$3GstImT$! zhg>^1Y7%m4PF7Wi!n^X3q08HDW z20tF`KJUWAXIU*%0KTMb(_J~;m#3G%!|VVXaFY`>KqUlsJY)|I5_FpbAX{& z2MXa>Kv*{YdEVUuUh(A-R=1ZDrsAu9$P(EPv;2SUXO{gx+dhAJ8?){IAFZvG?f<`h z-1*b~|Bv{%_W!)%VzJtN+mIGt zhv;dif&IL*zt(YKz#|Q!!VN;wZWVkC$KTE`rKit#4_1ry|-(NE9tD>?rm)!9NntB&v$#z|GN8}`Z~yBj>SvacAXB} z4ca)Pfhqaxyp7?;q;>1uge_Ff$wclTbGp6?uO9UuR-VisX_OHbeI9_+vT zZ-iouv(+@c-U1c^8A<%H&A&M5rljr?elSiil1Y|QpcBeee1fb!Iy&H7(fu}uM9IiH z0mu}{W5qdaNNEUtz$IlU$MT*5m>npPjQ*E|TFJ!{-0^QlMWDSF6p6~-<}ldP80A#= zNqhPW4B(dI{UQT3L?THQnXLqysI{``tdK@N<95>EXE=?r%e+YvYkbuoMjVNqy|@|+ z_ZLDXUecT-C>oPpw^COkAbKUJs7Ix7lf01$Bk6FL$D$ljVf#yHwflVMaBlwoufM`c z|Ld=2)fB9n*OgmM>&lE-oi(W|x1LkzN1k~zN)JjCnxms*nRY{wqwZ@> z05taI@i+pW6ocTLvY0>022-Hd{>kO z0u)V)4EH786I?Snn*VivIjq~>4hKNvo13T2Qo<(ncBOJ|aJsF@(c!ox$v6)KX=6MB znotl;0!oMEVA-MFds~OE6cmYcOdycT$Wv6KB*l~+Z_v(}fg!C`;5E$dFI`+(ZcR;8 z4Sllc&q9vS^g5VR^`+`x#B>j7?pccQBUu4N=}3}-eGgBj!vPNTFb_cuZEE z34}(-?M>ncHG?*fBQXvTWs37GC#q_qp8-a6m(P})2nEyR5DA4+c7U`*f_IMaOjnN) zOu|CdioriV$HU+?$YL-r*L2tnGQ%6f_)UVeQRRtGShG<!v*ZF<;ovOG1~63_3Z*LaCmBb=Ii00vvO^s%hekH1LAfFt z-k)eJq+G2eC<6B3D}A}HFjprRFV#Vn*RA!b@ivzlK164T^V$t>ZN! zvl1Q<3{K;-H#@t}ds|06Yz*q25icE9iVb$zuqbqwaAo}BzWCnSDD+Sl@Kzg%BToY(RyHm2WI%a?@EBdzO;8HH z+9o*VPUy)?R#Vu{Nj$r$*(lF6pI%g8dC(o6uAKGz2&5sAdGcUwxkE=co=cO^0s*J} z{CP4M#3`wJRO)5%G(;eDir}#hW7Yu@NJJoRZBVNv0SX5b)9X9P$4fNFQN7$3+fz zlTkUDa`NCG(~L8U!Lc*a880gtKc-NTB_?AQGdO>NAeK(fzwBbH()oq?;3|NB-FHWG zb5dshn|wZWPei)5m2(I8@hG|?-*vPvqbWb{T9jo93H+Co94>q9%eDlq`U^qTm!n zZkf-OBbei_6Mn*Ngm;s)zG6e zqJXvGRb*w9NA=))0>4M`CbI^;4*fH>qGFpZ7;s3-n`6Ka1~qJE=xZ$AQ&tuDD1(i1RiRzib?~%o)vr#6s1BC zC}KbB){qv|461tD6X${wMm*sZ1EpT7p3FUJckbDAOXdHN-O0xvDxC3eq!5#>BI1-h zi-L$dixCw_9xqY1Wla?&Yk?1a9$(A@AcCic9wDogqf9!lA*c)*J_NF|k&X}$5dqbB zX6_jj=tnR#%ywocxQpoiq7jpDeS)eLGLTsefb|LVOyOimKZDb#kL*jrdZ23ZsV;fK z*_mh+{1rWf>ete=PaUm9E+@@#IM?8$XlSwBI0-lP>oKQYU<+=CN}3E4=tzV5G!vdu zIY8hGipsOkkv=`uGcwl!;RqKV{(ciQE+ZHSNAP0H zv?(4cqA^6jH5gS`F}r(jb}Q!=1kad46ILWzoWvMy2uT>pywa)_H|!46ZF31^$vB0% zL|Q0fgEUWSNHd8+<41cPc&__dG|8RG299JE)v#zp31Sl~A&E1+CVm&DCXQgKV3Ehz zUlc$nM(vceT{UYaDpBtAZPyH)8*#;8!2rDgw{qaYFHv1bhZxTG0*<*nnY3os(Y_5F z&en17W%qdBSW&osFr;M3h65xDDIftb=Sk+D;C0p%@fEQ8RRD#LQ{b?-Ily0`MkE^8 zqvcf|{gfW)m%QMD6UzZ#yFbe`_ z;hq)dkL+44sT5-tCx8Ve5F3D87)Sk&h|mf`STk4|RmFIJ+B)1ie0k%-U4Yy^Ia3xZ zw;%CDajZET!KB0MU}1TAd4Y^mb(kpukJl!nn6&l{)SV(XBl`|Ju>fVDB6;4I_&R4i z6$9Nncz)w3M|eLo%8a+xXAg9NK%I`zo}RC>$TA_m3>Lmw!1(BVgJunKK{dWmH#8VQ z6~Z1JAKo}HQsmNRE_Jc(&{EFgv9~2*Jo!n@*Z|1gWWzDj0ec;bf=0V$t9t z$&q%j3W=0^(suCnE#SbrcXcDhF`+wn1(kWRvw!nCF7Qy7&(Nl9p>*$b!zP_@eg_W- z}unfafp2Q1U?j!a9kQzD)JinMjgEhk_GKDRD9_sO(7`{9}r-RmFRp zkeAegXNbPr9JZJ5&$J;IsjzVcQBe_Wsk)Qc(mo~1i$LaS`Mg$Gf-!9W*xi0*3rnh! zBk-6B1pYX4_+!agl7-A6dosd|ik~W!KRdl=JI6;m`^OH0W*l@*61keDt3G>`iL-$r zk|7sg=(;!eTGLR1mz`>4)t8XBx}Hr~^hfE6>@Y#ZotzHwrVaCQaG)yVy>56X(HLX1WaX^m0sHUFNh1SeDUhr1gE9~^%K;1Rcyg^A|_L8%d zd^R|u7yS{{Q;Y+{TRm?Bx%Kd@_UFgQPsurbKOTY zWv%Jt46yi`pH}QVfQFvgN90<$b~*ToXAOtWlZ12KCuL%!CXC<+3uBHaRuE;UOc`iq(0lw}K3C9NJ&(l7wBV};$<5fO6qH_ijBlX z2dPe}Zy^1bdS(`jV;&fLnXwi29sAZGrVDs~wTZ}dsPkyGq;1fRRd?gf>z}rE-*jhm zMLV;9VINdW+P*;S-+Is9ym*1xQ2wUx7dbIGZxnkk45R54NPYS}?ODGu8{pg=e1|Vz zSI7P}Numhd68m4qU!5<&yB({cm2@z8dg7C50+PCT<1rts7MPkc*R3RyvIcyaG`G0F zN!ukfv}K|$hy_duI)e)%l9k<83|^`0NRdA8fFcr(Xia0QF4ZFia_i#WNv z1q;)B3R_MmF(!WuVl_yqfdoy@S{c7JY~8S>QIXCbZEx+XrrBPHh!Ea>k+O>yd)ce? zV(+-362>v|D_PSIv{eRBY#Rx6cCnG63h)81E@&Ltr;;_#l@r} zz^&$#b$C`gVfK{F&CP!^Je{w44P(c*%k76}^R_m?8fGKM@L@US+&gVF^04Uv;CNsq zYGlR?LTy0oI&6cpq@bA7XK9lS*g49#JG-Kr|RMBEE->!X>_b^@`-v z6H}yBS!6UFnj(vpMFz=*DY8-xCA0bxv;trcvWYHU4R)MeN*(pBTxOb%00`!~fj{Nf z@jn;>HM_Z4+03x8$~>tq65BS zp@(*lid2G$y6Lzg-BC_XX~=sUYqn){XM2raa6o^I%|1|(i0(|`tm>ok#yX{BQp8Du z%$(6HHXg-8)}z99=2$M#5KT$>_BA1u1zyZeu8A7r`2s}X069A8KoidgD8zIOgRp!I zDz>6?5|L$XwP&+_+Up%1bvt6Q%T~Az^DbHY?y+sS7&Ll&y`5j&hf)q;gr?hj3DTDA zw9pKFQ)_QWC&-`qo<@5|+n9&WkNc_7s*yAYA#|_Ti}Dfd*Fi8azmmKFxxA((A{f+G zkwzVmK^jULG`U^psRiD93N4@}DWK@Q*JdG5uY^KGk)R`Pe;DN;Ug69MFY}z-Vtxsd zL6QO2-k(IdSOt<5{xn5}0d2``M4#Uj?hJc_4Zd(1_J$k5r;V8tfot_!aFO8+{t)G9 z7wU8)m@WfEOtcK8mx9ONK6f#nz;cEYC(-z9HwY9tRavuZP^p3?A z6nR-mIron#;Dljjq9L5=$k)}GBeM9f>*?~jGEgDmMsdcC7n%5Fxn46GP(B@_D?`rM z#np19Nw^L~av}}bP$?-%V|a~O@{ov%4-FacAzhaJf%aDxOzVP)@bRwNRELN4CUuT6 zT<;b@a1MW*t4)I_?5xZ2kB0|8ukhEyzbZZlZL?5~MqZWiRX=8IrKHYGeJf8QU_4Lx z*g`UfEq)k{SMs=kKNMn)xBvFil4vfV9!fkb1K`=U!%`6`QB6|{_q0NlaMH}$T z!Lw_nKW|dsIRkYrXBW4uhr$^R+0X__FCKDHjyw5c1_!@Fq>Jns|nn=e9v^Rq^R*(obL;hqER?Rpz0bG=p~iT;PbM4JjVVsA+~O z#|eLW@b{j%8&Fp>Y73aP4n6?aJ9D}2*xAqTYssRXwCJxf!RrilQ9l|}02-wzA4dhb z@Q9Wi2-09m;-S1~k$Hkg20Z0Ct)&87s~E4cpH}^y!>dc1?=D8;G#Y8iS{W~CrRc$t zcDq!eBg7L@yEA9>mMu19hK~1M?{Dp~&Z+CqkrJpQwoqqq+6J0CR7VThMK$iVS-Tv)L zmuh+U#_wywvc>`W-@rubD5GFD85voIuKD(;F+ZfEu$|(KBP|=*mgM{xAG-YMnAc&q ziT!nK>E#VQmqiP!&KPoVx=j~)cke^5wiC9aa9x}7r{4@lXz`A5ILHo)*bx;T9lZ{z z@_ZP~6W=FnXgt7Bqm36kyWPcbb!Lyf2GIZ?pG(Mf&DHD38@s(l#pW>)5@X($qMpJK z(={ryu--+fZE=IwZ-AjdM@BjNE!M|`v(5|Wfqf@JYXuTOc|h!~ z*t&*ck{&{)jDwHCp+6k5zXYm{~!tMZ3$^zk>h(=OEuBPWmf*(Z`s!XJagE zKXH!((!o#wGuht2WqiZ~n%TjSd!u-ALX{Xzwga}zaJ{F3pz*U3LoAc?k!qWIHK69i z>3_;$7pUX(>bctIJalwRTa-CgG79^sg4nO-Sk_pb!%btwiMPIV!%B?**u+Gzk1h_R z!j^V=-gk+!-rL&71O6BH|)Kq$Okwr%op43+fpq27#7Lc#D*$K-b%P0l&y_QqNte+%)#UsapF`^;)z9` zCvR?|zPbhrI5SCYndu7?o_hAdmF4&&FFH;amFVxR~zsbkhK(40v z@;LrwWLN02GGrwdgfOY8<$c3yJ9FPBH?GMEI4m?=LV)~7gj^^05L)Ny+c!j`$ z%oR_7A^q75QD_dHMm*bQSpV+ey8jD4v*JIa)6iE4|9nIIXZZf@V?X}$(b=CQAgu5DjO^|_qi6v0I>qHY=0ee- zxg`4u#fUqJaz95UCPQ(=`>kghBDsLoL#xWo>Vw-c{Y$cXP)T+JoP#3`C(G;MWL4=j zZ8%5AhZ+!{#Pz@`b6NWU_qL9I)DY2>p&lN-y#d;DGx_8OQxA+@-vCYA5gDHNFxEqq z0@Z1&0}|*^b}@X19WB}d%88+DPp9&t1ozzC(_;@BN4OWKnk&tSty)G1Izd4_{l6G3 z_rDH}xgq}lBRBwj`rlsrGyeY{^0DbZt~e0?&hq0m75g9l|0rlbT7UH2`lIiwssBYX zDbRXO1iD+3{uz-q;1Qif?la>1F~q;d@{3Wg?~(JvZq=D#J)w<{5AA1}_WjPM}q%sOPA3=fCHiOyPLe$zh(7C9$t zdv+}wX4yD*F2nY=emUL(G34O&T$}8JIV;vNS$b2pv!8lJCigoH_azL!sehy)<^Qq_ zgrE{80YhDRQ6#z8%R!|u1Qs8ia4`e9T|`2TU=g&A0ayoQYBy-)oIn!aG=m2KD&*z@ za-`>%X%m|aH|Vi6km9dT@E^%Y)(h01Z`{NCYsq%@lMZ>}CuKV-KJE+x>eO%2+57&0 zY|yJ4(w_8?Q+T~Cn;yR7uG&);YzCkd$Dz z`bpS&I$RzzD9Ruw<35asjd8yjj6>^Pd`VGhHc?Hqx0+3Ug*VH=2`7sLG7#zn^UCGjuB+nVs7a-c!d&8Y9ejPV8Sr|-Pu0)+PDgo6 zR0xM9J7mU8-Y!>e(Ft12xFqUSkFxY}3y#}<)p3Vc(}WBbgYnG( zQI>pNZ~*X>x(lcU8<2M*EOwE>ESyT%Bn)!wB;Knkz64zux1~lqFN`sIU4;%*=tzYQ z=A>~d@Klo{y6Wp%D4Py_#g;aMwT*k$k{HNAD_BF*0(_0ry-A7avWYWlmqETCcx`sE&a5#e!J;;R{XtgW#AAh|Zx^$v9nT67M#_NDZU?5eMHm zZw4@=kWy+6GIHxucKH|`OgCW8{$$v|jgJHnD+y_!u!I4;v^qr=zQqWdL!;_qgv)W> zdI~IBRItg!@m`NpVVj$M80iWbwE?)}JqMbNFfd3%fYcd>N4@&}N&aF8VdO~Y&Jiu9 z$j>O!hS~z3i&II>w!uiL_b^$U}Z7tgnF_-_*y+G}T?4Clm$w zL~Vun(k99Of3Qh3XFnXkE44#lPsJD_k(0|o_%Dw$03;^X;Mq{s&B)y3TsAA1(**c38 zJl;FvRMb2V{`RR}0&I*c@yKy)Pm>AMBnPcjmeyTOS*Ti=oifZk#ss&sfjR=ELltR! zxRlskWG?R6GM+Wh?x3MtJv31+&$tkUQPH-(*Uz%`xnY*u&VDBNG8GktJ6ail_0;~h zC3cBnirXx*w;IV~1yzE6>pB33tK?{MsYwZ({ZGv!h9lX!p%Y$@J9dw`bDg_)j&vE5 z=n~VF3=aS=pli5dW6n$X5u+v{gCwns1O>8{7JECf*~E-IW(JJEDz&!!>c$k6(?>*d^2$? z5{t62p$-!4IGVwt2n@Z?K(;{s(>{Xm?R`?ZD8z*)8|D~f=7be(9FK_BCYX-d(eC}P zs|)4`S6z!!ZW1FJ4~2@-@rPIcOrEJC95^RgajxMzJPAR8xtZ|VlglKU8DLIwhi#Ca z>k7cW{1B`L>#RR>PIRjX!W`ZNQz14LbOI;9M4!YQN@JqJn=446fdqA(5lRGc0`VSt zv#^0lV=^5$4Aq&@X(0&>aFQ%wP=0Ai>%dTQ#C1m$YRT7$c{ouIEk&54KLxs)Q$J?X zo}vF>VmM>iU4|?Gy8~;D$i&|#u9lTp4x)CN>Cm|7GF+^t9hRyq-(OL<4#TF>y-vb1 z7|~7pU}PINfXIk0mH=5l0T{6Ls}8^h%bzyIRs$dwaQ8S=M#6S$GCw!YfKO{+VR)DQ zuUeV-4_TSbyDm*vFAeQRras8h!S-A5jt-f&n}AOUzPs**?`GJA5BvUIut9H9!h?&O zP@yO>2t}v*@E1*!x@u;GDB2{R$&U`NSq_3j|2!~7v|JnIVmPtCv%BuxRX8u{-elcJ zllUJBO#r0E6V<2<;Mu{!Zg*>6LpagZu(Kz+qGHmGiEGdf?%!9_ZvgJ@y!`PP-6kW=AuePbEq%_2ksZ)DuM&r$kNE?Qu#|1Z)9l6;+u^-Rk_j=vGXvy$o5=S3- zPPDWO45lODno*(gOV=IJxih5myAA2QdPwJ$L;8%Ki@msBy|cd4Tm7>Ws+&X>0ZJ0U zs^(a=5~7A>g#VBURftBnII3GWFpx$Y1^cic75*+J1`Pv9^4DRM3(r2tWJy>)E=cJF zpwXNuSfYaPr)}Ln!TXL3NjvwcEL!3YJ7D+Y1QU1WIq(@Ox@Jf77{rC!R2pvzI;0M= zP5^#LPw(4_C-8aOQezM_qc%`QI#N>q0yNk@*x%kd)*2L1QShu8Es9lHUGQ0FiyRaD zy7g3eJxQdY1$c@%ff+R{evhqfyrBfGK&`n^gDKqt%w8TSb18vi-63=G4K=^TWu~I+ zaB!{-Qd39h@Q$G_U_r7xPsE#+>kBJgpmjA%P=osb>_OWW)4B;`>XeQZe4v z4Ux=%=mV^73Y-s@dhj6dS2iUNxzs2)t#10gO#OZeOONqC_qKlNp(oujOmG2wNm&^s zb0s}h!Rh8LEnmUhudn8lNMj^!{*7$0$XXeJK6u&KMW0$I(Zpso4I2i+Qs~J@Hi3Um zo&tqPS}moYl?}|9K0Rrrb{Z0Y5=QZeoENE|O9kwEr!?>YHxJUYBB1Fub_8gpf{(cg z8me^{9?0^7Xpkz|<_sj4_vwNjmhqi!)7`QRlW30AL(l0NT0r{Q0_NSA$bFv?5BSCkPTV0`URs)joRjtgbc&o4TR)-kaUJ+8BrGhT6|} zeyXdDA*ya_`=EB*7`^I-+OH3OuB(mFt8S?MW`D1)Hb%HgPf9g4=VGznt8O7>t)h=K z@9;zfM4ZCbvauYNL_RT-%(*6@Tu$BLv%MhsLrOq1q;itCx`=X)d;gxr4a(ddFE|nW zCb*YJaZd$w5Bi}5lephN%oe`wlc{mI)kwm*268J)FT2NEhcA2hgaScOrdo~@$%+nr z_Hq1H@?o=5!f2S!5GM5jx;bvZ3Hod=8^jH0pm*?k``~#Oo4_OgV7xUsI|LeNwf~IT z*TA+*z_#xIY}*C)>W*D|)kK%zougL`yK})0!N(=KN%Eer&ldxc-sE2Vyunf)&GPHOC^cwe@0QI*9ny$h52gNpcZ?UVKxT}R5pRCGgzy&N$ zgVKKaMry%tR~w%;Xds4*=3qFgKJ6c17=XSuixHmrzv@HA96V5)*LtJsb)Q~ud#^p^ z$>fAgCG98u&~2~wY?%0m1MYFBqDzoqIEIRuVxO$hpvi*=TXbaYQ*5Nsyb>#TOcuk0nO zZEh5aP4eAoB-VU%mR49b_K|OU&>!;DQQ6j0yqQJz4GVav15eP1vOjD+9k-rRKQS{n z`nS zOy4w%Z|O#wqCUCHkWpPS18P1!X^L9q4p2#rG6U*p$`_7M?ha5%y)pypAh~FY8s;v2 zJ(xYOqm1Vj%H07fsbgk99b;^0R@>YGDyeC1cQBU)wa_`K>xHrntJDoDA#=F9BADG! zy$Hsb1!Jm)bR!WuIQHp}*wyRXE8+C`9tn9PI6727Aj%z6$_DJ3?^+C*Yvz6<7uDUj z`{t{BD+r2nJzZL@+8fTQWx^=sxJ(V@V34XyP=p&g3mmvwJ$D7{c8`t^clKZ2vSDrF zaKbkRcWP5>7Jt*`s=i61`6%pi9#&q}A-d7w0Sqd8&N3>JQN_M>Ri{2>vu6Y`Px;#A zD(7_G8(3I5rrYB*-y43NW7Ro>_`Zjs?YX^m{s#bHR zmeGmaX1Ke@RqUMCX~+JJR?Ow>{=FlpWJvuHC>yc=+j@W8J#x1rc2=J+z`@}~n4?a< zd*ANfBVhIK!UtF#J}GtBm)~7oiN_Dzc1WK-b8wil>`v4#<-6G2C4#O34yWKm%z~BH z37Pg2%ezDeMX|Lf=vRcL>otAl1DyOG0h)4s#7R`0tUA>YuAd#caxochzq2dL|YtmFNp>e z_ff5hcUF@pw|e)~T@IrI^f-kIHEA6(`GYcygi}rQu{1VP<>gKeomEI{*SIy_BEJ?Ttgc=U#?yjB0bufRyp`oV>vmeNERB6M z*@n71>1h@$_7jB}w4vEcTGeErK8j%!*XfmuCoIMz?ovPmz6+@;GL|xpezJrHKUB_Z zRqX(_|F6Js=r1a+NfSiYKrebK$Z_DQ)U7oYJXZy*js{DZ<$yaxuUgzs4+dSxz|h&7 zlS(Y%&nJR$8#pg$>_m4vKptcQDbc$(4DTFJu$l&}*SJ#OZyNMgCB@1R<6rhm$n4>* zb0r|Qf$ADd-Cr$_TTe&Pm4C5d_r&ZE_g>8FFW{-7u+&FHMTzx~fi1GU@Vm-Hs-?&- z&7#3?udqX?Z$WnNMr-}n{%@p{KsnwV?teLzYC)}ti zmkh3WDUE@cs)BLG0Sdc}Cux5oX#sr7Z9(H`R(7*(pO-eCJF5ae_`&uXfetkpPFbbk zf7b1aRHump^3L0tf-_-^39jSdhpU}Iz+8Mfri)^_)W;kgG$YH)%k{M}D2S;KMe)u# zzOw7vm2a=`03>*Q*nM5EEW<#&LE|jlj=IOYJ4YpLZu(i;T;)(>sW&B(ihDjOClUJqNy+IiFM4=s zs$(%tB2Q0p!=it3+UZL>eH%6zeA&@Ud{bK!D#pG1w8Fu-m*Qxpzlj1+s~s-xzCe4d zquy&wuDtu^=to39-zNiWJjKv0C>=zTNpu|wU5^JjGx+31;UO2@l}ut?Nusfk50ggl z7MorH^^7oAQQyHZHi?7Deu@%UO1>6W1L`Q^$TqO`(~S~tbF3H@^#*TJOfLYQ9~|a3 z0c7rQ_pp0#)b+SAi?hCyEds)Nb6C>+Vo*W@M4L^f{h^EKz}q*250-}1m?w_4amAHu zT>*9Q6mLC+FS+%&FM)(!phdxMpWDO%Q6pswlN29;n2EqP+{OK{2@Ct-2~>nXOG{0n z2kt71g_h=^$9=^uD;p-4E0os6Zsfze8aon%^UhxQ(lu)>4{v&ahH;*_T+uvD)hQex z^iauEu+f~(IB=?Nx&VK*1*&L4`!-&FxwXbmTZhn}8^lXb6AT3`w5rlHd5CCJH?5p$ zY2^&U7sSL%{b&-6@+#%Cr-7@yAg_q5=Utpy)|{Vl zoDk}lksjZrp@)**bpo{U!6?CCo>F{LgG!Y+?${SbGiu*N_H+P=e|Pxn|KERR#()1B z$v^(%#{3_h&gxnz{(Jk+{2zbF$BX}dPVwI#aqf@R?^ZgUp#9zYqlfDczh?Azow?v* zWGDTgU-xDPX0HsoUPwT61<3L>#=IC})suzl91v?7ayf4d?dabWD=-X08=vVE* z?R>AQ>)t*x#fFuHE)?NfjL|1-(HQUaJ8&i}Rc+Nyv4cOHNH=lTCfeC+d|R-Chc zwS@zCyt29mU)S4@);kp(Kop$CX*{7&V`y%`iK6*x<234jPBNHsmKW&O-P62~mfg?8 zGK&3NDpi?Ta2kl8kkjOEAdiE9*ZAAcL9qBwi6qYl)wZ+D2)*dd9juL z)}tFQ@BHGCl4`JbNQ)HkS~dCTTg1iUQRC91GDGH=i=l{5U*stz>fNM#z1H%qTI*tB zyu$cfU-qH45eQC?iYJfRO?}6QvA`NBdbHx?;2m!otkZXfGD_0r;3O_C;}~Gkr3=lXsxFanXeW&^aXNRG z%Ct6B?`g7^^v@GAKBCj9; zdpP$=(X7hhvM*(yb|F_yH^MBv|ng8z(`S|=FXMgP|{_oLB``e)X{rbc2fdwq{ zf6r*g!-33<-<|WmB5QZe%C zgTEyip66DoPt6eY!#TWdXux;&rfN)6bXbcinI0VWOuJ#HYx-^<7bSptq{3H7L!?xU?J9Vf0r~>;I3v zZ|`dxNf!Ov{uI5smx%?k$L5jTg(x`=mO z-FkGlS`R}q$uN8FqL~=G)m>fvs;aK8u9C8bBg|wLBteiXz>}~jXRQFp&Sy2)Mn!hw zN@dvS;k%GKF5*C8+)T(>i(-j$sXzq_W4?%bHOTblLb~<14*VJ0(c~Lf?jDBV&_LPb z1*xI~xtV!%M$@2xj9t3}&vssk_canimB!{v<=xL#G#PTSS#PEIxhkaixhhQYbEih) zB4i??usD+tOA5cLeaTL}AU%t>)9@Ob_!jSLR7+rWgG&6vTz5=e7=v_%dy#oexUsWW zW1~0Op{)LVO0fkdNg7I%b>&e~dlky{EiP^D1lkvHh2C&TrM-w!v!ZISWWGZV!;M-y zJThd6WP$W)r%DT4*wa2LimM-_!PH>HKeVv-2qbJ;Y~zO z0Cu)y0Ok~yd05?Cm~*pKqBN{&Et=sDF@~PJ_C=;tNjq0 zFW3839uQV(`Q|Y-7mF9!F4blDD4gG;MgH+dvs-o(0qQ9dbGnCBs zpb~;)$Yz-KCKxvcPVA5rv1ivX?G@?w22LZkR~sZdz?)pDAH8W~f!Re(0r_s>bO=f^ zYAmQg&Kqt9mw8l?&9W4uv0N1Z06G9w1$)XLo9luUq60iju?pY0gKT>5 z3}pLQ<(1cCDga~$Qbc(dSSiZk;e@xWp(9!- zM%Ry;FEBd0Gh*vh`YuB^hHrV1xvR`L_gYCQy#&l-aKlo_GjYbq#9mbJNUExO^VER6p_W%mX_XmE+T$xX&jtQo?7CU52+Rivzf1*nTT*P^4W}*3k3Ab;%c} z*%~6v+@Nd<<@yDNl_}t`{LV{fmG5blj@W3sDplIlmS2VG1&o3>y)3^nuLm1%6-Cy+ z6%jNNdH#=<_48{!AFY-LuFilk>|VU?b@zHF7!l%}1-Ew>S6u8$)xvz_$|>YmwX#Hv z!eQQf17ADU!Y&EAD8|Yi^}7oy(lA9wH3PC4VM>yYAwxQu2x&|U+|TbJ)~!SLkp8lC z<=)T_Ea*xJbgxB)T_uI$ZxYJdvemNlzSEtZktc^Vfc!=t=&0h@BY*T3$Q535w?#l??q&vck(nLg|wAY}w_Lu4hg6T9)P(6@S8HDAeC>#{i$_7Qy&d*aU z7zy5dL9ng6?UU(F=zT^Ol)F8rxZX7vT*ZJbN|fp*yZ@zRefv1D2_)?&KUtaj~XVdage6oWk6!VXadt=Hfq33 zhb7@yE9tgaNk7DvqiS?icHrf~BAhjPKOdZ4>~{|i-<|ZzVij+Ea`oL@d9$UJ$&J!V zDk`eRk`DKfg9os5C!LnA{h8>@5%s05M=iywOmN*N%_q1&t-=zIW_&;jBv1^}M&g^r zSL6G_TH0Ntx%k39F66EYi`sxi#2Hteo{KY_FjzD_ZviC8)xGw@i0r&&CJcwX&F_S0 zs$(>$(uc|fQoC5cjpSQgb2>5M38ki}B*3cOhYbr~lTUz#S`A?;K0y0EShj{TQ5C}; zE1-y5`c*1lEm?~?-?hqjmE4HyV4CvjS2<%-1573yRS@++vOloH>v|zMycF-4MvAH( z^c$&NYsmPoutT}Vog1pM+IEhB4HLY!PijH<;yZG}QHk?xpDi`IvK=H&<2K64gJ^#LgKr$R61dAA?|$nK^0|h4vQ#ZMT|D z%U)8Pf)uFYq}N$n;~SS)ShmoHMEP|mSIehTO-n1nIMy^{@5VIJ0El^T-nBK!S<3kn zoxi}BWNReVrjCS`o$IE_7h1o$suEzRnB=H6f_1>$q`M5W-Ks9O)2!;8 ziAFYCO0tQH8Mez!Om(Rxt4xB(IAo^`j_=#W*;YhLyi{(@RUun<;2dll%O=5;kn|g8k(AVTu4$>AWT9MUL2j1-eIrX z?>Q{4y?uXz@prW;v|65o6$Vhws6_wW?ryK&m&nWgZD`UA^oxc&^v0nR+M;2E?tvF; z=$V7Aq-W$Kx2p#kcmO~O8-LR4Ypw-|Q7~^=dsZKZ9?f*-tlDE&SxRf*s_XNz5UXl~ z*<_XlZj=FLNA?c6TDpKAGGnGxid0ZXR3XqsG0SaOA`|~?OO-HnI6T89zPr8}vx^_8 zM|a6`1^{ZSnThY1igZ=I)U~_ZEYyaUi^dK&*DN$~V_7xLpGrj|uY9Rtb&Y}K2&3{P zR)2=>0?ystlV10ZhuXkl<2W(WJO$FrWj|zug zIOeR^sZ<`Zl4w#mBjVIK&9HYz@A|zx9&cGkV?+=e6Fw#BIF0>-!``YrxBmn)k(MpK zKxQR{Fgp6|Q`jlV`iM)hc5RjU;tpAp7-&y0e-3Lx$b<$&2+gWYnQ3ln3_|o?HH^Y9or!E+)aLj1vHywYipJy94eRZtk5>qDk_7EEZUSw zl`!W@Zjh;GC81PQ2@pBFh!SszB>)dq&?X^)(c!Mp*H1CzF;l9Mt0;?XfNY*5w>B#s ziC8v9j!b>gQP~tFX7p+F#h#nzg@`%uX-GoVG8&Z0*N$~FurzVqQ@Q1C!NQzY)vXk* z2gSxZJgJ>MM{_G(CU*k{>lpEFVb9KLq2d`9Bld-2=AaZSPubZpKco-?FgNcI?+S1n#VDlKYUE1JX8)RvK4#3Rtm{P+BoMB9jRgRglo$pah5v@5*ox$;ETTao`Q< z%J`-9Oj=cgVSR^iq@_@)F4IWw^HA5;84QcXp(5D)b?*$S>Tt53!@V+DN~(IKawyx~ z^QuYR{QV7{@bHlhpfD$Lnk7rXdMA&Ta8#P};EuOe%e-MveCx^kt5Pxtv_G%S&pTJ}Aj{eCsiHF$0i`vj`xw>_dvuk@UougKgz9 zD`URm$d(jRa%3}|R8A#THL^+tB^Ui&S#mSDpP2=g&%-b$8%6!bDXWbAmb4Eo|FXvE z%vFoD+HBCSu9a={mQ;F}_&`0)dS&)Iy0&aRct=O`%Be1un@BsQY|`v7-=abuGCR!Y zsGL;Fa&Q^dki^R92wmcio-phY@0n|6&O)<)BT>cKwnQu4m)86_y|iL%RoZD)Ak$Ch zab%rOW)Ug1BRXM{O>k+}Se}M?v&YhVw0d+6fl#GNtH<&yZS`1wmD8B#-)a`y#~!E` zc#)CFD_tfaF+)wJjK=Ph{iLm_+mO{jx^v0dNv2?~pd-=%uv*Tmw4S6l>1Wwh=H-<_ z3Dq3*$}yfat}1e{u!>D%sFrDqS=wf5+en6%8l)qduJm|ORCw|beh(3dp*^sC84}Li6p1wQjowd)6GS(oBz3Hvs z-IAqcL=z?st~C4XxBk=pPx?D>rNbU$K)>r7qHS&+f7f@a&U{{4cGkOM?0pPmr(=(* zi@|Dm*&)iRxXMI%IuMc`R>+DrYo=lixkQ@}Vy@QQC2!&7>ebqsywF2a<42qq$43=! z_K#2AbWigyRvAhAyTwjTpGb#Z9HZ$3ioHf&gL&;#y{Y~M?S67uN*NbHEwG#O`l&AjV? zZ^t`!sBVLh-d*u>63c)Hl~Nhgu1H2g@#YBadRSOW|K$LGi#qPJ|KBS6f7;w?Khpn)cntb4 zN1QJJYjUwY)@nN&!*HqC;cS zRVtt>E{fCnM&X*c!Z;42ydJjd*0{{9?~IF=!h+paV2N#EQT+5}Fto~9g1|&hyV!qo z>gem_ONwi~v$+m)m&tPl^-wOmI<8v%Qef}6D?`iC{bT?t9mU9T83u(hF$TlffUc4f z$d$(@JG?ia_?fc+nM~`ROeoI*nPE2XD1mvm;)++7orDcU&*3>a*rq7>E%&|tH9g`{l8*x*_Wcx>@*LK_If|# zZ*(F!$ivyaAC6yu;}aYe!n#1n0Qtps6{0Rz@K@Vt6;lQBX`epmqd;c<8Gulb?*FxwGGtMgQGv=nP2me{tL*f$e% z&{tB+VO6%F;>XGPQaM^NmGy&j92_(&y`%ac4v$}z>o-zM2&Cqj<6v=a-v$1(`|7Y) zfPT224HZu+3>tY~FJ?1tM}~eXSJYA-FcJ%*lAel%bXIrUn>VM&FLl6tM* zFeDk<^xCxAukhN$lZ$3m#weg6beJb`PNQTdze<9Ozbr;5b9Z7M^}V##0DB9^)y!in z1kHm#+vzKBDg``5l=xmGt5&uN@~7$bh0DhKB{j0J1G-y5H{@d=9_5aVdHXil=5Aigc0tXszF^@5d4vJv<;(J=JBMAfw z=uk|;7LfNCuesS`m`G032=Q7RQu#VCwEuSW@8A7dzW$?d6g6pL=sqak!kp{ocgV+z!suDzcKybq-3(1HBk=5%Y z*YkaOH%!$2dSAJl^!S&Q1tIx8rnh<^mN&OS3xpvSGwR zH%VJQSwh-t9Y(s5B|Q&qRS5rO2z5_Ry6@Nb8aK`rZrB;vOt|77H!h^PSD$3%w@~>N zkzaUbXSe5=hgClKdI7I*)N9Ugwm5g&tQ#R*`BS-~U_35%dxwX828CmRca_B;oX)Or zG(2I!YJ0Su(LT{%wcew62;R zg(zdLUfg6a(9uOSIzvAk&=7>Rw!jus#YYN&wi0JQvX$L<5j_-F2HrL|1rj3*2z=%ME_np|rMyV)h)s zkzXgBHB4xBj2R$u;{YH z&Ca!3m$b;ymP}`NAdqhBCezLv)n~~xYa=x=PlbHwy#jgiTeQUC1@{U6q!+wqvN!yj zUSY>&FYs4JhkS(=Vn(Yvg&7`lC~WK`eQsJ{#4;gZ-Ww zI~@6GK$G+);mMw690$Z4Ac%lZ#YDh0TzZ*gfH~`1z?I9dae$mnr?akbMTRhsXJN#8 zf89JN;&${>u|BldpPjA$#jp}U=k#CsV z8x_Ac>b=5V_2<(xndWNJgh&@XgsvA&qqBwOU@fF&rHt6fON_#x4p-pEi*+0!8V%|Z zO-hwErHK#b)&n4-6=fUKo4s9m{8#%thR1IS+O$UOoog9dN$ z^L3&w^;%6uf37R5Hg#nU3pG3T8h-&=T{ERK8E4*$nv?kyHk*MUO}#`>S4}?~BPc8- z7ZWrvI+8Jiqo=~M-LyfWiH8XNFeQ8w&fMVy`nK?&NjEm9d(-}zNAR(=9 z5}8I}DS=i@xsOr@H=GehGT;R*e*PJX&5~FKTe0g5+OixghJREF{$fkuPXNDDU>?*C zYZBpUt^=U#I()dY$MGj;poF2!@kdYY$LHSX4*Kum&LH%nujT^x(f^HhQUCX>-QIen z{}1sX!O-M0O49i>AXn64lH3H-(LCav#njVrNJrr!7&a#f-3pqZoCySn?gS}7nUC{v z7+=8Ce47c1;%(qfBiOG_fM$qJr=1B5 zzhZe15+Y}gJ86`4qUUqot1A(1?2f(JRci_~C>b~A%|?Vijo084cg6lyf@%X#@Ov={ zuVK57x^gdu+M-r#4v-dS(YdoY8=t%Q;o#32ZK~57Zz9W3V3jFIG?OGHnK)CPyRrb5 z;LNm{h74mj(%C{cBK0flkHhEgT&a+uSQuY>ApXR&ZA50R(`t>+#d9$e&s|6uV?x-J zr)tm(qs9Ww4`;UO3w)p_)|A{Q+Yw@mLT+2uAWR~fjmfz~q|go5)DhWdcZ-M34M7Bq zJYSvws5St~&n2IS-4eUh~uxWrXLxK#7$RK|;g2KBbJ=r2VZPlmBgMexZhV_N}59==;>fH8& z0erskrtsOFOzHbAeEww~(`SU~^Go>b2NU=__EA7OO0MB^FYv8T^?Gj5KA-+C=l@qh z6nz^5(EIH_OZ>mH`Sg+hKg1)CjU`8uk?DXf2Bhs?s+!BOw;Keh^;>hYQVW(KA zRHiKgY#nHC00pO0;JVQ*YYd_^smo%42UG=ZuYy2e@G>kW$x;fUNb<2&ufGle9&SU> zD^-&$*3ZG3chO`r=%rxnX1EKR^ z{xk%9v)0g0il8_WJ?x+qh4&!U$0)E{F7zisks2BR@_Ac$D8u(SGBoM8BQ60h255q{ z7?D>vS{Hl}ZU_t)x z>W?DC!#vCRe?~RGwvPMGf7jbZ`=6&9oyYqh5AvY?|BG2-eHcVD&+P=wr?}^zB`}4& z*bfXH0t0P~(Ep1w@|@8?s}g*-;jInq@7E1AMC@3QZaF^u^<4DrVu=C#9VpYqa0KsN z5A9sw?*RXjy3ZS=4X-({pA$;Cqfg%%G(A>#kg7t}Kf=RapJ9%?)sg=^e`IQ)?i1=5 zA;&m1)$e_5nvYG(nUaq}V0F_Zp;OS2kk=(b6c?_c`ZMT}^Og)TJ8F3L>Zk$u8`{p4 z3`nW#Y{b2-F#o#~xcQES;tm!!^+)oEgk4%H)dV^}m<5y6Vaz~!T4{BjT{2stI6s&G zoM7bQU%n>}^#Sz1<9SMECqJ#S`65k`(v7Ubf6Ya+lkbtg2UCoPC(b&~`gvWo5q>;w z7yrO#IsIp$_gmC)pZ;favt<9dx$(IFdyogo_ixzMkUfUqcAM*MXRF=B`*38Jk*SGx z1(59;Wpn+uq|Ivf=J3hMbfxogs=G9a8S2e$q*z>=xxuL|9!+4A6~SZW$f&jg$;Z zj3cuQrow8)w;ZcwNsBd6SN+6));drBWy#3$^>1wBzp{?|*8kJZQv8R_XPw9O{}2ye zU4R8EO}}Iman{zcN-kZZlOx9gsH3{MLUpXCvcb**m&q(3{V%D7z3E4#z_L~?G9$S}A%(PA{6g!o>UHxTUXc!!sgQBQO_H>a&V>^>$;7#I z6#;?$3N7oimFCOF%5c?QIbTUv8)rZC&u!&rv(?;LN!J>!Rr`O+4QldHSz+LhiR)T@ ziz|g6&~n~I;&)4$6lj`q36ul<%_16d$E&uKzwh`jU;ia#-fynsUi<%zqW_;~TTdVD zKOf{_S#Qrf~xRP0*;?`!k1QRY-c6>X`trz6n2 z>Wg}#UnoxB@N8aK>WZ zv5J#u=)}Q|;h@9i*aMfr3}YiUHXN%TS=oE?Ts>>~^C|3{$i1bx=x43;3Mkq|I`w7S z$ZfUTF52#FOUKnks$p$|C_tSm znO6IkXr;NQA~-;-Uc7jb?XJ|0j9%I-W6iRQ206M~rkVzIb&!JQvODN)n`u)KuXV17 zkOwA%E!QlDn@gW$&&eFcNNskAjN?~zsvx__G`@spv~GZV0(kO{Y>17O)fyCk5CAJh za-QcMinnDMp{9y#gahO?Q8=7?vL>7iBv%9PL^BGY`b1Q1lj#tK*na>#rUUhK6wp}~h@9)fPonuaPDKOX zIaJ10?4Vn*H;)Q?^XRU<`2}pvL7>a+%OmHB^|Enxv2t_1W?L_DUygh5Ck)Q}r`u&< zUDwM~2|QHZR#ZQy%^NTQDbSQZdT1WxxzqoPH1GP_I_|yy`K)CBy|MnN|9g-p6Zptl z0Tw&y>9nPu7U@#MxI?}L4nL4L(Ur-CvQLABMaPkM)0sqgcrPf< z{NH7eZo?oN@*W)@&kT8mEjVp$GpCWkl$u4Srm0B06g!8t0 z`udR;e8cAs{}1Yp!dKUEpZ<5VUB3VMc>eb=kG%i+TW+9Kp5u#VAdXye`Ku?8_%Ep? zVAt|eDkl{Kd103~hDbtK$J56+x7GNfEe8ANUw3dTQQAa=c4@Of*2xiCNSmlA95KqB z_}k?Z2WlTDWDq}|N3(E(#1XpcZ<8mc<4c0mm^k9{^ARq15!SwzVUKg!P@5j*+pE%+ zO64GX_;E69#EzKQ;-A_TSg{-8%;8tDJC58V6vS}+*qJ1biFr${zCgr+xN*czf%Rwt znI1!@%qKX2M>)lh(WHg+B@EN%BkcLOzoj?kVZz6w#kQJ0iJ2M13}lS)83wp_q{<~U z^jCpS)MzxYFBW!9IwGS%L@idD4dcJ8W!A$y%jv&)r|s+NxL5z%F4})SeY*81|2@c~ z^uNomD=ri9=+X!}e5Ls3Q+eQ1vKITB)oO*Umi5GP)|u`YrUv}=2Ukmi1pzS=41X{! z1W-y$Ws#0^SrQqi-VMA)qpF4FY}oaMyI#L_*$+?w-M`&F`8QtuOVJ$+Ii zIavS%9P#$uZu2BepzgOABrBymIM7$95d$F{*V|s2CeV{8-wqRho+;y5v({z3_}Dx zfFXv#!$cY=2ix&I-ct>ts16XqKu<}9ox@fl3HA-tFT04$8*i>atj)C~OhJ&J#!w{( zAcNgQnoy0u1U@;nAh!ca1oIl3<|i?GL{7Ks=mCSn(NJ4>n1RcLK6f__z$6=0`3mR> z?0^P=?63fXY}YYKHD`*|Q{Y;f^~qFU>^D(|8FTu&C;G?xr$2R1dg7oj-ku!)c(B*o z6IQnmzb!}nba49m_}!`a2?O~YoxT^x`=WdFUi|goXwMP7pWmMJ`h9VHQa^a}_VAzw zX$MEUhwt_dj(!lYpxn{%sW?1<#STDEj|EmJK^^q^2<%PoWcM}v?7liUJUD&t)b|fg zj}Yem@rme)x80M|gWY$B-4mGTCvT7YJ*a*Uz#bhO?Vms`y*It1)0Tj0AyM>xgkPfn zx_fwtb=AA?0R0n0P-xyHULPOs^&s(84^ZpAI_z;>(5l_T?!g;J>~-ICf9O%EV}No} z$83zA_~~^Ild!%n{J(p8aD0UA*gZZvJ%OJNH1p(C7yap=-*ZIwurGs_h8?8|GFJ>p ziH?a#6hYTI#n2o5&TEP9fP zn_vK4g^ICRm52gj2}7cdPTq1Lw2H>f#cvW<-K^*f2VHD18mkuy?9Xf^LyfX4z zP8JkPWI;p?Cu7DQFynoa-Y63kTM`Q?i4K#S7#&OFB&Zw?mBDD@fw4}OHc=n7a@SAr z)-^@>+I3XhCM1Q;V;v9`@}XStF-|DR-UO<^IV6SZD~!_$SThs_VA=wFK&pZT_bv_> z%_xLjzAovoyDuCGkaR3m0dR0nTEQ~x-V7zoSxXe@0rwc;WzquZfn&Pqq1&FddWaU7 z$%K1T%e)>eo+?A68ZJe>vFSs*Zd3|Fg}FqW*7lbNzAu{~(XKuC)NLDqhXQh_-MT31As1 zV_$x9Pnb@9U?J$$FF|%RkgEstP|#frp)84OU63QeDQu>c8*tJqB$FmtYKu2Oj_4vN zax4=Sv>rifCeqt<761VRJ~WR|-M}%*K(4rLiG6Yom(ewkjt+47h9hx{9&8jHWDN(# zt_Es3q8%RveO6_~VzGeT6JK$K??^k+0tmEMZwcH2W^`HIG`Iy~I+>8SU%U#tO=m71 z;P1t0C?6KKW_vO1JD_HK1^ zr2H&GS}Y#gS79JMFJfNqBj@1}qP~Oz7lz=RrZY3z5lGWJJw5pbsI;iB3 zcQUX#y~M02F~YhI%Xb7^e%u(p5jq6;D+wcokS$JgRQCQb4otI6)+KCJZG?q3(cKNR}Xt z07jvL?1m!A2?6L+ZTQqxfzLz1GWx_CfDi82c>W2Bgu~<_t9sZwst2CA@d@imI{Pn^ zs>&qL%1mh2z;4AT+n~S7GAfuWKpEpQ8wy|`SGoAR5rv262QlLUfxf~Z@UEA&f~*0h z?_h)x8<(g9ewr9JUU8$!;Kf>E5d9y-67a7t#45mqz#45cK#LVyjH-ZNSuGq*R*S~U z5H3xLdWkH3pPSc*eB5t z3>%h?o;0RsE8GYS=(=%p1kT{>Ez|i+FZH3Kw7<;-*`c2vUl@KbQxHx{vlP_#0M3rF zzHV5@a%i+v2rWiE)6zaiKBju)!+97K=zw zp}DSLQ{d$CfZj0W0wB^b4+B|xTfZL*(!rKwRLGR!Icz!begK98>q5Izrzkk0NhD!a zh%%^(d#ccuk7}r2rC5A81fh>O`Dlq}>MMup(%`@kdWqbI0FRA?g5_)`85x3#jOPJ= zUkRd4=c{7u6yyx1x`O8}u}09)$eN)e3FC^ONr!dNkZefC;MQ(K{lwFXPZz7jAz+;a zm8X&xX_+t``#Fw`;>1soC#u~m3FmSRe>#6?%VrPcrIHZ1dD#b0Kpi94*i7$G2tH~W{OC*eZ~ z{~rs4;a|A*hkwiQ|9)k>%M00a158W-D#Gg#{1k?YH2BCAc#TPt>=Pz)rw`~Sj;~T+ zA$u6bDq=y=)HwV;K@Cwkem=5C9wr9yk3J9opoaJdaC_n(LmGY%jnG5ZwD{TW6E6o< z)@cb%0s7?Oxr-BvCo=vlrqTKvOa*!(Q6YZn0DrnjMM^4(#(Zi>b`2~jC2F}-}Zd&Vl{{ch^aD-R3?>XqOv06E?FDm$*gSZX^%A)! zSv=fehb<>@7Z%OQ_7SZ z>IRK70ui*MD+4wa6sh&t1uGH17y;4qJhuHS;f_DX7!cQT^~ahLfIDt4$;I3>WRmA7 zFj1@S1ttpy)63caOa-cfQTO!8(3lN9vJxGqM-eCFaoF&H4aor@h-Kik zOOL`at-=uvr2^Y82aX7JF}@i=JCh&yCOeqHn$B8f3J>-fUWDYDAVh}(l;8k->F{t) zr8?LnC^D*@(JS4(){8PLJ8~kSSa}68OLjV0LdJ|y0rOSMW8`upYu*Z0NFJxUWs~?1 zWtoB;q4)iAxjW*48#^yp1hI80<58kfE~}#<2C{nueQBXGO8UVqk4z>JQ^C|olzv&Y z;4dSSBq9S85()Ieg>f_p1AHlYE8J3tYu2elnunbw0k^jTT-`Z6xben~ixHOc1KeJ@ zs6-x01@V5+9q}2yD`Yq$6&*AIabP;QHNZ`7FJNt88w_>-)M~e32eAz^4r3d#$-=7= z4V+96iHki%g+q7jj~j$>B*VcSc6-OTsi%Y)z>7!S<=``lhA32IOuGPOQg=CrmrpFl zpF2^3WGZZg-%9E=P!mj|2!jinTlEuK4L!zuFGdb?CTO8X0#4o_hj4#XzOO1PRBwgQ zml;E6O&Ocr@Gv!X%PHs|waQ9V2o%WhhOdlKs%XswBB5THhwZ;HI!DQ73pH$*>~gu} z5hIL3!s-iw_WHw0aCbKk9IIn$iNd-KoFtyl$#yIHj-3iP${eX85=&(02E#Z4bMfc2 z2xaubME1fY5E;R3j^jVmouJ=OZ)wS18_sCEJSbLe*f92;??y}r4tM2XeU7N1h#FPJ zpzy|xU#*LAl$qkq$ylk9!?EIGnyUVb+cn-*mCZWKrV~OJ4zfbRFrvB~DCL4x9OGD1 z9i3BCU5T7oc0|>Hk`6JbOeGA2L7aBVu^{XMhzS`RQ^C&+SVB7|+O4n_oy~hIV!<(F zd*zqOo+_?(0uzR3UFax@x%-b2iHwB-j-Gg8a4#>IW>k1sqW=STe}EGJfH#~dFQjdl8QgB;c9(4QDG$9Kx+NW#f)rq6e00hjL&G$e^PR-8nFBg8d`QBDW&P zg{qgcBRRBhK!n+fcyz2&X#RmyF@K+0x3GU3MI@5#8>^JIlyV2rFq^ zSiwcr&oFUPDO_oV4Ifp|GD5dninuUi0$c?A6PSqS1#_N94T41A<1me>;uPl6DJwz3 z4U-qZsfjnlQxLOd2qS*KYQSHzgNzCx*iPGa{Bt?( zrXRlOx-GA7J~YtaI6PT(L)SM+i0p)KKBp zDhN}n97LcBq56h`X*~7bxMXZ4t~jG*JoveS7Zc}*aea-efxdhKj@L@;#ZAFNg~A2ztdhb_*%)L?G%&pVIL1V5hOy3q}R z9c1IjDbCD5vgIck1frn$#6}nm#r(#WO9RMlp=jZD59xhx-HM3|5j89{d&C#_I|QA{x~D17dSqrNXftbM zRtLU*Nc!b4yTH`Qa6sFE?h8X>v{X5OR3Y@#QOLq|N@v>!n=k}upd!^r!eF^V6HJ$P zaP7pJF&)v^6sXp4sB0!Bi+yr?(S-kAlT;O>Q9H-4RGA=Rr?lR(JxYojexyKP z_y~3*yHS%GvQ*=bX%$$9qKvWEL=PE64+m!$V~nO?h}^3nuXJ#6K{lI`P_QZxifN{% zDc0T}($He<0Q-qO7A7`sH)$%Q=ZMQ)QUeXc8Jj24K*ZgwFm*8HU(pS1*jCRXuCW#j z>?ukkJ;B`RBnYi_>r4}6Gd8$R6g4+Vx`;^a?@m@8G z78xOi0rVlNiq1FzNobqyOHt>9V&${O9TFgK=R-_AI<`(@6I~6A!2@Sc)_Qa2e5)6hpUBT?TQUwoh6d< ziFD6h;T|V0un|iX%JUtDsG}6vW{CT;Tri%}k~nI_mgfU(N$t&OB#YSBS4ewh+jCQCf24$58}=QY9%^$ zv|;Ks^q>u<3ZYNBg-ghp#uBmi*pW+uEr?kfx1V5M?rLn?z_<+!7~XLRPqb9aOJHgw zrB#?Ytc*hU{Iyz&tCGlAcw+F2{u(w#2NXzL9S?F-s38(3C>@0{9-#n|VF$45NU;Kh z6p&oY$!vvgIeuTXotG#$&5;j&E zcL70$?(t#vQ+&*>lZ*YR&X7Z^R>Kr$(G+($$SKy1Ub;^TT~lcoj*1h+PfYUD!cEG} z>)hf=`jRkTDv>heP3XL*i+1RC08>fCkVJre?X^=$HdfkCvugXZWhMYts& zC_8y)fJLr4eH^Yz&i~qy^ z;{885cIsr4J07(j)bRH|?*CE4`qNGRQD~#K`0vb4@%X^Y{F<<_x+u9F`@x z{OB=_;*G_ZLuxHaM(H9lVPP>iU^Mn~!O+qirX-aV<@YNn9d%I-l94o^a6ke3l8ImV zZzV-JL~5=!4)#_m`$xQ$D$^URNI(rJMggiPRT@07a47s53##M!ujY=CS0n~saFc=% z?^qA}56&wbn4gnYm>$z2>1ZxV=Y@g%J7!3&Ybyf&QATU|C>es=oZ+96|jj#vLR z($V}@X($XQ6nZyOe@%hIt>t3HPp&5HNt8hK)2JuTf|(ne_;=EK{iQxvDOD&Wu~=kwRN&76Xkm5mFDGm!}|Avp#}NyJ#J1> z)a18$V^HOZVq!}6v)SK7`Fz$*7XS z14s2Q7|7n})jzLyNsipcL5rO#rxmtw(3+*Pr>rLSD6IHU%aYTEfXz0oC`(Q&3x>eD z5P)Us-;=6I^Tfa)Ag2LB62({X%f?X<>mFTbc{DC^sx{zVr9>s6Cjb5Qf3>W?FG#=!N7P0w@?WP8?c?!( z&d`Rm%MXHkCX#e)juKBWWt%Yz2@=wFyG+tbq1hqTX6Pw!dUlYZ#n%E(Ml zFBoW-(ROAx0bx|OM;wgO;&h;t4(S91=ki5;_FSneJj<2Xzlz((zJd)J1;!jZ6VUKd z7CaW|ej*sfY;+`sX3ISXmIxz(-TLYnrK&O%@oCogoQ4eRgqNN2KqU&cVfKS?_bD;z zi>gt-lAFA}uIcov)D;e02r`6pvsHdYt5B4vU9N~IWjS`;+T`+TtS?|N&9TEZOFDdK zFQ?O}rLLZkuL}Ncm6j&MGj@!hcO-vuS{hX6Q^(0(zgyFCs8X13_@5UnEbxI$bQ~ne zG`Wz!HH4E8$?Y2TkylX;f32&Vk1rAJ1YS`Cfb8dsR^()6UBE^IE{OQigWec98LT$* zLfS!G&9Uq3#T5=>J?ZXTHqAcxUnF@?z=jInqM>juUrLLCN<={k2qwu~A0@D3AHsZ! zJZ^Zbk1Z4+5FmRle1zV}=LS@tFBI*Pq*QBx_hZi$pQ?GqEX?x;%#W&li#$6mZyArO zdCMR`dPV<^<=GsBVIp*DK-x%WL?cL%vG*gRLxU76vSihl!z#>W+lUc<7Hgl)eXcYR zE_)&h!gM0Wq;A9HR`IS%AeYTf*L3!;^9olIYY$#LaPo(A$be%(fd` zWn*e;MpMyT@t#l4ktcTbuvs`a=+VMm=>M2-GDq&J=6c~OUiGHIldkD%t}~%5qer(! zh4Et=Tz4lgs)nhY8cuWje5?mXVJtfdNHm%&cTG3-mQNWa(dIA}Fam6h%0nf>#I6Lw z(JGf1bt}YUkHQrYj_C+jRO}n9i>oqDlswpT&dXP zldhZK@#YHK5?fpMqXH{7cWac*gN=rcc&yb8)~GsRtj13c7%5*|_CxIh&nGV?Zb>g3 zB=eWSkgkv46<)x9u8 zq=1-fnJyH_g&Q}9X^r@wtIZ9+5AH{f~p_8fJ>qG0t4%<*O#nnD=D%4de}r%3n{7LBt)c! zkC1$f#bDH9to`3dKC-@%laLI>nwaY>Loh+u+zIp|9X7qlR(g?+fL!Ec*8Bbm5W<{HFz2^SM%ga81^oN!bGRRF(1&6YwkC9=PJiBek?5 zCg+7Ca#n_%k&&I%F+1aYxu9n$`<~H>RmrQ0mx_cylukl=*K|@@{(oy`f6ren`hQt8 z{8#J$Sy>%Bou8opXC1r$`CI<}V*Ot}A_G9L(m{uB0AMd4ssX^%-ap&`a7_O{rvD!W z{hzV-qpSb33Uk>mGVA}asbohlxC<(cxPuz&p$s@T7;2g-6Rx)&dnywW7RHY1r3uBx z!zchyAVDzITnJ%@k|b-BWLdn24!aQ}xD3M`D?)@>AY6@Dt;iNAnTZ}OtNW!9hF4sO zA>3dQ+Hy!rwl%z(3nDJPN|Y^~;)|tU?gQB*JyPa{|1vsv?Cgq;XB?-vSH8@?z}gr> zdal%mZ6KL|PYv4$hH8n}3Eq9-J{uq(Pq>EU;1dMEOn875)m3Lko(AV~x`YN~yh=71 z_=aSfiNQKL7AwGkS@oZt=rB!D0g78w{Z#_VhrOUiB#68>T8H>}irzq5Pq2z?J$m0w zD5+ecXR9O$l5i13GuT6%Iy7kfDw)(d_P^2)MASk2mq!UIWolHIkRTlmI^sj9ba^Pm z^V*;hf+I{MtTEu?;Aruft5nCR>Af(yoK_NwMcAM?3{NyAiKh$!iVP)8d5yQ^)N4voKom(F5GAtXu zK@22_5Ab9}_Yv?2n2MgSw{i^F;lb+5C&< z6Epx5)h0I*15cn*jB{jWA&;oW^2~z_plm1tWzapS_9lj5XiI#t5sBplRm7J~QdGp+ zA55)4MOcmkCaNok(FO-mAK(a^XDl2Ggb`f0x)=Dlgs+Gr$ru(}!b!E--GrpU7Mpmn zZcYMdY9^P;1QLMK1D7d~C&JH&f}&@Mbwdb2HZWcxMr!)j!VnTXl7Zu4;xcZnV#UD- zE(s$zv}3}K31Ad2;A7$e>kmcgfJHBKzG)E%QW+oiN}aL6{O_}RFjD%d96W(;46{_!hfeFhaelEGleJ3=jUD5x7$#_8X*hUsSY2bO-W-;po}4(gM>A zABnJl^o!Omde1e0qfTa}rp$G5a z*pZ?nik}AX1wEiifJ^H~8J9cs0|#1$@tW39@Da|;2Lt;-&Wd3kg2{-3MS}bpfavJu za$HYh{wOutxdfE0p9J0YPcXsQguRR26V8`-%ccCV6x<4%jOr2=&8Mk337cbkjz(iA ztZ2v^Adup5*BH%lLxE@uSsg_()^uiChnSUV)JLL)UZ1W21t6YF&IkA>K&IxAMc7-F zx(Y;q-`(`x+J+7UiYO~M3MQR6HTAvb0$FE}EMQ^RyR z7#P6%2@!w!kxBPzarY#M&mbjU&nLMlAx$C<(}<2tj|e8kAI)l6wTcRH7^Zj#HNAFK z1YYeQDu;2Scw^Vuf}QYtkdo{mq(v2PdBk1j3dg)@5jEuUMC?w=7wkhs0`yV^>y(SJ zOIP^>I}xPr&Mn)+F?3|ca4L#+b4g`R8Dt7BggWe`Y$R_lomY@XhP5t2t~&ME7=K>s7XkNs!8xv&vJs3z(MK~iK9Mhx&+eyKS`S~ zI`o(76X0utTi;MAxGCAHYI5->O!|e3CgzxKaYVX>2GPgWXciDWeoV7CN+fReRAWqxwVM?Jkne;- zfW6Dc#=6J#i>KLUeIS>L>MK7uE#c57vlcbsFPUq181v=mM@9gAooV9x7xlI~k%I~y zGA+$w7^TZd92I{dKd*lpycRe86WNS%Avv*!Fx^~g6(a)Zag%^5IxNYuNh^V#<1<~1 z$>Duw&vap%D=PTa1>JNo9T2ef9j5L&WqZV)nuCO17-(AHNR4&q@_YT2j3L`z$>h@Uxw5@hJ?!w0tpYpI1$l@e4JgmZ}xcx>{jbL3a zi?^FdAR(I46J}d{{yp6A&Y z;wk2XN-7RhuaLActkPsVa+HyM$w@w$PK%o+7=IAwoc1yI&%>Dnn8~Vyt*2+dG;bC1 zFxJ6t6Rln*E|v~plbCXy^J$57E+A6Uaim!C9OX#9=2MMmc|c*QNO;4Ym>J_BD>H2Q zGD{Xxo|fHhqymLsIhZbDwL(OoM`s1H!IaI8%lV?)^0_dAE}#l^NCSPytU$TsJn(6O za$tEv!-3C5I#pf_T(q<0u6YOTIBL%|)osLz@pyK=Nsi>mvc|LX3Uhnvr+Siu%E0qv zdXs>C`@HMIh+3JW7ZW%W2mRv%p|L7qied((qVI%$AEvOmehBTea%sqoN2PQrwu zSM=0$h~mkJTtZ*)D1s&%j1_qyKxG+O$dgk!-w!6gBuu7`)(_<2y3N(h3(3sO=Am41 zvEwUUWIr~P&U8Zvm-w%kmY&Ey3X{(d4@{^re9q)4DTbAVEWEe2X&3!~dGEnLqwlqZ z9H83vO@rl$kD)7M@}mr*8AN%4JL8p+v02>m*qG`aBSm3J^bM;+0i?P8a8Kuscq`yN zyj#J1YnW_>p9OG(DVh8b7zcM(q3Pb6JzOU#v|uAQ45EYvzl%gx{7x@~rc+5=MjC*9 zz?-Rz$XFrX9+X$wNB>0Ax3kZFkf>^WtEM3h?}RDGw%)@f&`;prpXG z9f?m(l#-pfAgQ#88dQDTg)z?!XDYe??BwwEI9W`B@P(4zB_8C=680mfURRbZ8%LWX zKUL1`+!@cc4st0u_c-N2gY(mh)sTd*!&Wm4=)%ShPwi9yGqO2QD1<_ceH=`P1VCal zX%VF|6Qi`JN@;0WEp8fq)f=Kot5iHRW98t04}j}D5g(H%*e3T|*0Y-Zn`xE@f^9Jf zK&obYxa7W=Bb>IV0q6mnSTgTV(+}7sIx6XeX%iT;{QpZOM~O%v{Xg7(1#p4TOpi3XRl=4EdwYlZP5T&t(nqeQYJh#z+N(Er?u~ zRS{tQz@)l<#f`ulu;ys-(4w)jGJYh46b+b#28$L8!=YE)E1wBRas5Q;g0-9Pj`%|w z`-jnPFhpGi%EIbBYB}0z#L+2n^A5-(O!QOB;Y3%0;%9EjArlOjGe8)ZixseLK@OJz zDx=jwaPa6x2AC8~KY*i&hC;2Ftbl!F-9w7^`&(IXKfr#a!E_xh@?v$NHH?wWK&8?` zS1P8zxfHl7n~zv|TA4aNJr;&sv|wm-?$m_7Uy+apdcr6y;P!)|g)I}t06Ow~5tSYPB`V`30e5Pb_EqKFKTLy8q{SkBG$bhGmt&W>_1rN;_4`$K zKrUqx*BB*|*sW@ZtB;fkoT{IDj_|#T-aU*%hJhooVY8*k%*aRsJ%VXmik=!pa#;4E zXuTIW>s8luC0?@&e+o!Uf;ZTFKupm9KUxIJZAl5DssMT)!Uqaf^16|A};6oA)^tk z5!3jLuE9xc$`)*dPos`o1s)2Dlq``AfV6RgH}Z2!VjD*M8Y9PlEYi`x@Q&qZxf*1( z|EpXLYPOcIR|JXJEKlqyea1N9IKiB+dm^h*nK2F$z3i-vS zfdhp5%F(9^@)4Ipu4Mxb$Up<)Zsc)jKp=~cr@W4m83r+YK*pek^J zbeWp~I}(tBc#8Kps-g>4Ru|l+a&ZucA?uf}vO{$#E+<-$nGOSjlqzojD~0ijMuEtd zrjEuT*rZaRL>%~#EF1Vkn6xk?QWvs6=u0}}VZ+3o97xxBI4~^i-0ft*u)w!?l%i6+ zFh?92%4K3sS8R5npc%5>CquNgT82~^mC)2cKnEUnR=9cSLN8(B<;tQY0+&R-IIb<> za%>{&VQi^eq^^e|#<@%w=Auk82y+aAOUq0%pv=V+jOa-ox=BT{ z5?;!x{iXH^FSW1fC6~)pO+~?kih@Q(W|;J(XL{mF^@2KRQ_&46gt$ZE_n@X?N-YQ6 zple`}6bhJeXA$wG@>I`$Qy9FFU05c5fOVD`4MFT9wade&pkcpK2Dc(Y(@Q{F31XiC z=sjCbATKq@GlWy9Bnnh`I-=9EFz7-5Mjk1L!!w46WzY76?V z7Pcx$gf!&@KbYWagTt|+^d$}Hw%Taz#0YmDVyotkNY?E`jqWB|JBY3eyDXLUghG(2 z`!9|e7o>Ht;o=71ltc(qhP4?ezIQ>XB^Y{8Q3-#*R}k;n;5+{{|6WHSAwSz&hA|(1`vF8^1yEXn?V5z84$+(1OoDnVR5kJ5CF67V{ za3nZELUdyR*n6aCu)1^Vb6`6U(WW`$Rm9J}WRf0@_KV;ks8q4>sA<-%3rep_ z=2s6UT0d^y;692+vRcCP(Q}NE8RP>GMnyb69Ai>^hjnC{xUl!56cTI!5R+@g)8dvR zIKK1Xk`}HTO~j#hnjeTE#^57N^=4{;r;4W-g)12ZHZWZXkz~M^OYBiPeqm;pjYsKu_X)&_T+LO4YSuUxYc=?{G`RtF-5`yf6zmu4N4OT08)(z07U<$ z;C19DVq)pnxX6A+`F1W0pteQliXN_ArF$^5?qF@=Q{p09N57wiR!ss63G}t!V_7Q zI~s+|L;7?<3FrZ1addaz=uM>cf1IbY$yWlGcsY(+h=5nzUi`!xZO5&=-&o}U_w3P zFa_1+he>34art4SxO76*!?)qFZpLn7N?MrpoGl99H73Ep+=!(tQ_rF?4XsN~%P+cR zK%B1eulUuV5+|g^4_5>#n9ZwBFuE$?s7V;$z!9kD>fR~vGodfZnX*Ih0;xQt==;TT zqNFAWZDMr_#-S}&tTU%SSST%?8OFl`aPCE3DY66p2fhfDbcmcqg|{dKoB%?S7DLiE zV9f-y1ulxiZMezNqzF&~MBW2u2W)||8o`#4fz7c`Xdh$*@5ii1P(dnKp+hnzMP@`2 zp+i?P@Xw((Gw~40IUg8LcElHx__t5t5@0VtxsfR;9Lxnt33`N#FiDV2JPO$CtQ$-> z0m0n~5NQao4_4(vabT#~YMdZkT2z-lV7hP<-Ud4jgv-5g=Ej5aAB0g9-$NTGnIX8< zQw^DIo@z*kyr|h6dJwP}2DFoogpq8%>;lCXMJ>(j*9^5FiUqP`d(EC9`ZYXNh>oHl z@k8@bA9_lfj13d%j+RvUBk)HtTICQWiCBCB;DUMqfEG2(jv0l6m=#*9O~NRGtg!B= z;}{=L2Q%1s>Hs5jxO`&cqv-rF_bRJ!*-8T2IM;PlsL@OV8&oc(iXT^%O0IC z;I09DY$VLx9(c`R$WM zV*|ve2MW*3;hHL&MOMRLO+n^v30&Z}N_r%ts(}wIR>@-_%H6SYy5s>8$8`_M zW5B(WnB@fhYEtw9t-ii-5bXu4mt;H00Fa{_=Inh6@_HhQO(M%kf@aF&@Yr4#3!cdu zfq%0yc<4_Bzx(9!f+aFTC|lXIOLACW*aunmkxk5A8e`Lvc>xn{!%$%+`(Jj4tn92z zx%Yrl!WR;^yHGqY>}IEBdZw$ri?M451OunavZI)7$3E_8I!3~!ir0qO897ALgjL=? z0%{ln>UKs)qrr?$*_oNySsCUAhuN)46TX_+u~Ww^a{+FNrh2{pkftQQUs@Gbr~tZ% zAj^R=lM*)qDC`Ix%61IXR_L~12!%6I@UdG4Ly?evoC#+qXu3zoqgDrO!j?dsBnM@* zssp+vzvGtBU5J|?d4LJ(r0yWUIc0@0eT;ecni9_>yD5Q5u(DBoI!b^&>b+hkjk z;u;plC0&AK#N1Pb5C%Ek48@BIBxwU86t4f3C_8Sz0r+sd6EZp(cgZq*vwA0(Cj#by zjARMj(}zNS<}z6f&3DM8=jnlc@fXVc=U9;KkVsXS-~E^gMi{usHUpP+5M&DeBW&&1 zi<-L(LO2J*84`^J8Owv%1V*d+?GzW{VRKnLLCD3V67-*d`_fPZ+$tadgHtyKrwRuc z;l~oy=Yo$MfDSNEl(;X6N@^N+f`=`;x#x&c2CXfzr^Vak{Wi>0nMS=0g!cu;~Vw3Y`} zEk-$vB?0X~K$e$BR`SRwv%QaVZ@ktvbrZ!1lTDEEFeH-}5=DbrdJFP|$!8&+ z_prK%H0`p>B|8u)!qcgP!)~4xdul2>7fmPQKg=cl|2#O*k$bLp`ab}Y_kZ}W7XSYQ zf;^lyYQg`@?9{%a)&D;$46rnRkP`sB5@P_I zQlW{&lSc#;T3GNuIwIg$NWeciB;X%*xYrO8VD8vq6Qmv!kZavRBJwgWSUXeJ-5emq z8UQ80+Ddpt0xbuC7tmva$-210JS39`tqQLKFk!?Z>~+-8c+@mqe;97k91ssuUYMSO zyN5S~#!oq{xV>Ps^H<3nLwYQP=TD!~L`pjA|~&+VzFQDVbj+c^e-zw9|p zLQ#;A4LKf{v-+X)eN!1ipEwY%8h%3{&gy;y z^vHzY(6Erue|T#2-VAp$kkB&8v=X-i>F%9gBLB`x1D`1DXJ-YnQ@xlL;>2Ul@m&}s zhkjj9F=J&3@EbQBZ=3=U!8Qn76=R;~I@{fhZ>1H8soX@zPX+jq?VCvWwQrudV06;bHPYLgg?J6Z<^KubUceduH z>NxjuKtzOCKyntaBvIm&B(BVA;OmDCRmYv>60Gd@R5Jz{XZxcrDkv@~EE=c-&czAr z7MdskpkO`%Jy21N=pu&~DcbCH2nQ(+*4XE`i8%8Sn*>S-`!uhON%Wy$jXdY*K>5Yr zK~w|N<~V#O8^{8~C%1yHB^|@SK#XC1r@ie9f!&%F&nF~xR3Z3m zn=ImNx+mC6s7U$GF=>?F<-Y}L)ns&{_Gq9bD`7|+h*E=8V0**FL2%O z$xpBlds&HkUFI>Fvakr7p5f#OM+ua5dm|ypRjZGbkC2v=!b4a$s!7R^H>gm6;R3KH zka~H@?MJf$(-^?D5sW`hy0^ge*?^@3Rw{k5^RX6ioWf<&beMKUfy}}I@Kd9NCRWwk zC6y?Uo5U38qr+Ayw5Oj5nqJ%~2 z2d+_bxDUkX54gd_NHdL1c&q6_F+>ieoW?YY@4+tWz`*4YN5=LH4GZx*bQ2!Veo;_& zx)x=`hEhd{7sVWhAyzU1QDBh_xLmKqy3&?jX z802*Vg&a8?b4xOaHg2p`Ur;G$XS0f^BW7b;9=~ir2lXhQR8N(F?4TGa-Qga6856?~8F!|@LxrdKMzkVR-X6Uu zA1#l^#Lq^Iq9yr|{t7Vna1`I5kH!n!16ShI#8#LuJ6$O8#l=p8%>*XSlzEF58c!J` zm`ogjegzy<9cme7&S;hDlKX@z;Uh&UFvdieIdlP*WJ;oZCHTaMuX^Vt>b#T37#qC; znkI~$Dw(lo1uk6!DzMz3r2Dz5Q7i|RHXJ3L*T!bYNJ8{mkA|3Z#AAthA5xu`y3Dq6 zs1q4&5X1Wbe$7-r-sTmR(9od?a*f9laZSKRLd12*lwt;|2Tsd~8Vz1X(i*HWfQBXk zWLNY=At0lyZsZXgFq5L3?f2nCdb8H)YJVG4|0)JqML1j2VW^UlCtTFB%i9=P~Iy zutdK_iI{whDVmE-L{tYiG^QG7-aI_(HAbjh0oLl|M<@X%Y7})UL@0g{8Q^eh#=Z%_ z8AIVCAhv?loMV0c&DM1mvK}R2+ z-EK_+=0kDeWf1`5;LV~_zo#k+E7lW=V&^p0ASgXSyg`$cCld-0~3 zHU%A_3W#{66(XJ%00TS_QpZ66i9b@;qI{kN9;Ut>-LRk<_iQ28c&jWz-Yr}>WL?#n znsNR!f(pj`tW|)%%r?XTit;rBkfZDZa~<)hQM!7e+>pS2HH@ORV+UekQ(PnPG7?_qd1vLq&fHK6=iD5zDkj@qrzhBvHYK zczMSPrC_coiSz`%I7$%fqK~E#=OeGwFcQKYH+qQ!_Yfb{N6$fBc_Cd9;vGwDo)cj% z2TlnJ_ze;eC7!lTOq@osUi#cclmMdcm?qCcCPhK(awIS!p0Y9d)YK|i0@6>VTjhXv zV(iAg0>2iB5|qt*jS+&Pfz}5*2E;qbI%lNe%ACP+%C%q*@~9$nI|yz|d`p)wbk-mf zK!YAdC0f#zX-a93Fn+ixVqx_VxHn59{iZtvJQHT5q)N20f;KeYQjm-HH8D09{iVdc9LmB6c%?#>X0N5g3zjE zJ}mh;WFZL2nyf-jMs*xn?C>Zd>1$yHR0ZQT@!h=1|0eoL@=`@C3U)twg@3UU+#%4L ziQEcE9~OXHR*+q$rHe>nrhAK^I%k3n2$xW}wgI2lC`Giaguy40NeL3#<{Tj3=+;^A zb`6S?F2Tx`3PKM2!jU>a_=QorfsJX2989C~ZbB4wQFyew26iSzO`YcU4>YA1!nsUb zTNac{@uG~2dfZ@Ofms#EZwNZCR`&@(~`!SyOgiB6##CPq+w zxTKC0&GAWU@Zv*zU=ceIZGfA#<4N5H=`=$D~(@RNgXQ5KiU# z1kvHn<_7CBV1z0$BVXGnw-cE=f+sN5)0QBhB*9U$4c_C(%;1%pK@xdsj)Q|%MyAxT z?(p|{S*DT^1M{lRP0eCLuVEWvaYd`78wl%R4=)+>k|Y9 zEH|3aAkiOQj7fOcrDJ)*gDe)J zevxTHH*9kS7!+~S{fHxI(QC<5k#NV&7I!EnlB)q27-d3`M7lLhsHS4l2-Bf%Sj5~S zbr`EgpKO}SfSUuzfeXL8N|U&0h(pY_L`~%_@0e$Q>3inoRC;lBc+RX34cjM-OtL8$%(c!7Y#PF*>Kbn%b zk|~5Im@ht00)Zac92$=`bPR~Ng=VTF;5nidF^%UYlr=xt>48%Ks+Xi2hppQQMM*2# zq-?#%2CWxK7^l=ebm(n?Gc;9SZFZFypdriLqFo^jSPO!$FeiKRA4j2^n}vE2Q=stqA;-CPM<(!#RXkatI$>d)|bT6i0DT zP|zi)Amt&%;YtMUty%BpRyW+$T!G>C2s(Yt$bI0gz;?4_)~LCbYu8m$rZQ)?KU|HT zUke&ntgKZvEGS-At`pRCxT=JkOb5J~YPAkPpf!*?*Po~k(2C+KVb2_?q8~6&eOaMa zi5F(2vgs&s*cppJhbuN_q484%mX+gcWT2X|u>b(Jq=sCT5jCnfOjYZ8XKHFqTHOHP zA4gNGgB#>r?k6n#{Y*M#Dq9%-(Y*mt>K5PQq)~0QX7^qP0f&9$Fmv z(Dx;3+-gb6IJhtOIW6vs<~VNL$~+4nuoUrInfR#}|HX2zjRBVUGq^1h?zV#NK@dY{ zL~Wz~ApG_OfET(Cz|nv#mS$K)o@JZ=(tvHb1dHFUli|h4DjjS^jAy# z4~2yvVFKt{@;`S>lK(lg)3N-|f6L!LIsS*I^g5&j(59dtp8vxsQw9+BuNoZVlm^8D zVFUh2HwW?$0B}?Mg05^MEp?JgCn9uYc6Q4P~_avvq7WIhaNrfb6hIi zcoZSkr?@p80?3yPMEDTW|46Ja8JSr+f8cqBcmM&EA>p&s$kjlatbsy=-7>s7T{6Ff zBvc_IM-ad8^C=4WKqDTq#gkaF#_H%!peQS&=PF`0)tpN>*$f_9GGW%!tW0a>jB1l# zSYy!n3?2<)K}E|>HQICe+6X196)EHD;bW0m8jH`T$(way6O2Mg>fsN&dUEkOCfB5A zUA34eH>sCWdX`1cWNDaFcDY>Up9a!TdP>e3bEFjOIccZ{Ze($ssDhWdL@iePbdXHCyt3@EJZ}>7OC2%M53S4 ziXG7g1lpt3s8fou?Hg4N7xcQ8{YF36fPJl-ax@hTtSa2+0yE(w zRDF8F7Bi7MApZkgoD$Z*!;S_NUmDtAF#B|>GrkCbi*@Q?`oX8v@!QXB{IR(btL zYOASjQ$rKUHZ?rQO${`_Hmo-~-bt57hq_5Cn83rc#GCgkwg7aEI}^6==%*HuqjrQCUQg8kqp&Ap!Sw(7mltiFD1PaPWc}Fwl&e8Zi7G|e23(8z*i}2&uB)lR` z@r!10rA>|OG!5k8O#~AnwM(g8!0Lmo8&VL> z2K7nLq+MYxlr)!i!W;`Pp>pAp3o(J*uZt(HJw)v)akRP~$qg0;;hVaQcY5drz#~9m zgy`=H?zm2hkxnEh2yc!jDM=?OIexgw^}NFP%yD`UKl@$v!qqb+!9zz`OhTq=91(-m zGYK%dgRCgijC87o#?_E36y}j+=A_Mki9G2Ig{wGmm=97AiNMR6C>swuJ)b6Y&SB@i zMt-!9rlNk8B=;tjg+_R}cqJBSvoZ~|x-GHP)Ly;U_GLuAPR3s;p?_V{t*Qyla#{CIG> za#Eff)fX9MKnyQ-)40efh(89yj^B+6vtsyaLMUx02+6F1=tL}nTgm&9(rG7XneiOF z6dKccv+y#k2>E^790eT!RxTyw+ZG|v%g2a77nMOVkV95IbiXNn8Oly!+MY(VJc+5RM*^SWx@)ViQTG7oQ)5 z=#x|!2=bou>i#~>laI-&dm3Xpn%bv{4g90^PeUe8G9yPz2d#l8MhT~|?Ek7lY8pBP zVsnAdVhog$>ZKNvGUA!R2f!)u0PPwS)+7{oOlAECsjPpgUPt{-)a>-FZPo4QbUSkG zj%Y54erFt?amp>~Fh|8LtlCMyCX!77{y-CeACD5hub#yr%i(Pi6QY{|CivlpWA5Pp zMtATInaAA0|H*%~`G1>TG!M6pTKvB|ouAbqKL0~Thfc@*zyFTE>jn+%-AFne_FALD zK0S-szf<79l)CKy{fGZN$7V|_DeRe7I)44vld7Vn1#5p@_~<8NX0Gb>cHgFN_gMG( zs`}UNk*1!|@{S90WA(@8-Pz>wZJ*D`UN!&nRh`?fnsLIe6IW*Js?#%U>()lPaMn3* zKG~-66>WO->G5{ol)|r^pY0zxc>jS%e%$uq+;5^i`rNVk{fYa&h>m=9$f8}F9-SEa zY+>UaXI?(-K)sEd&-(Sxvo3Gbz1tf%)&Hve*IR7+Pwdw8zI(UyuKQ#AKl)6${P+d0 zcKIMby!jP*+P=jlIamB?tNX}{y;8=mI_`nzT0B=dePT=RuA-DyUr$~7@i`x!YYT7s z@U&^!o2E40dgf)9o$>N6yj5!WTrdKYQckZvL!0TY6h=du+&}FTeO=sB`w`pMPGb-tj}7 zr%qjVUm&kvz0KD>T9DJ~toPUZ`wqC_xp~X4Xe^!Bp=ZxucSq~nT5g*$cGTM+{ORn| zW%F};dd%K__0?BTpFaJB7OpwnCSQKwkKYz7Sg>of@8V8(_ODZ?PD}5DANEPP@Qi0S ze7$`6@^Onl3%)RH;o5uu_@eFgEz&PKyL9Xojf*=EzP&@^^D|a--Z699uuIPDQh91% z^T<2y9aS=HgZ-UmwiAyZ5sh}gtDt&}iSSwo7K)--#3y6bv6er%mD3wvThz~4{Iu)7`{Wi~vsS$MMeLI+v*(tqZ*twgcDBa*RNj-*YHRB zrlhIMTdz9rOmFFkz|#FcpM1gz>3wH*n^*U{d)793tEKnE>7Kdm%hx` zAK$p|M%ynbnr%)W{-Vt` zcI?=1>MmF~;GWLf8y`NX%=}`JWBOMQ{_;W{dG3vGfB*5l`~9y!ANVD6#o%)WPdvM7 z=e*nZ9skq%^j)ttD=6&KXXujg-+jJpYNO+)uI%6ajiD3zO>U9i{LEg_UUM&dp#3!` zowfdHrC)x2el+^*z4zYxYhnLC%kTO08Er?yxvuUPHnXj1{&SbN-)MPjn{7KkYSE)d z-PNm)zi?&dxU*Ib7*)sh!xQu76)gH>_fHdId5;WhyUh1&^yN=Kf8w**vu63q$}So_ zc;5W^o3;0IuKelj&c&UpzMp7&==VpOKIpyw{uNhVIjUFhVQ*%CaN{=*Z@9A5>78-Y ze{%NidTh}>xsy)sFz1pFdOg)mK0K)9#zk%E$AbUz_b;w_(75=l@f5(X_@pZfw%pE=daLFcws%{4P40`!E`DfSuRbaFS6=t&U3U-rbWOCmcl9>5lWZ@yFW>e4oR{hc zufOm1%GWPBr}x~xua`DH{q#pa+5OxnljdLX!KPt0ZEC0E?)~}+_1%JPTj$j2 zo|l(qd!yw`+R2-*Xxwwbws-IBw_rgN*V1nW)U7z@(RWrkva)7op4(>OMX&xiuj8t` zb+(LN(?;8FZ2a?qXYZReXiM{}rZ0WuzUf8BXT29_kv?+i*j_g@t~>g++lDNA@8(To z>VM$5w{h{%p%tC(-nMPq;Iy~jx^B_(#SaX+B09L3F&bt2$B#bxSo7xZ{q$3SZHYkO z={NG~bYIl=+*^aM*-D1qvH8BdD?a?NPG;t*w-#R0_|%h2R<`sGY`X8|`hiaKUKr$i zq2!nAmoBM$!H#J+KiK=G;HD*=Ter?{Y@4&B`I1X7XxFRRRSo;4_h{Lwbkt@xPgTEu zyWIQMqpRkQdE|-bi+9-ub=}=2rMtc7*{7X$^Q>lBV?964N}alTwdeIW_Gf|?2Wooj!UA9`cx-US!8>Xxdo32ArU?pOCe-+0Qezc=WA zSF@#~^HyGYT>iGLSH3AdIIGG&^@GiIU7oM{;Y;P6**E+r=MtsMhzCZt{4}#y%hne^Jn`pQkB_?d&yRzN~qmbCn)`BjBYSFLP!XO~|_ zwLBx(Go@a*ut)i-Ke9SkO=&!BX`yZ5IlEWhcHWRDh8Onlzh~yo$M!Xy=V^WQh7H?q zIOBv(<6FP*;)_jfwiBl{o^sOJAKg%|Rf_GxzIFE4*gP(s5L^Go$v6G{!$*%zvb}d{ z<6hT3eC~#Cw~QHc>EkIsjc$9QZAzx+-CVVJ&n>Ob+Zed^{AW)N@49OE+_zh`YSpk| z!&gR+s<>vl{UQ5h-!8kZN$X9Mwq6%lzPw}0yHhe7`hGg~=Q>l02c{m^ecBxvo#u8K zvN*DR{u|f4y7=-*|Jl(!<)UUQ?pW(dng05fSI)Tp)J6@S{H3Dpi35M0*Y(%WTYlK! z_IoG3Qn%}An~zKX-sc*3@2}UKJmm39o@<-Fw`-54D~^vfh~9et8?U@~$5idDuRhG* zG-1r9A9sFt>7q3`4OTqz&=)J$J+=4QX9vySw)~g0HgC0Te{S10)8<_8-8)lklNK$s zEsR`z$t8E)efMKc^D|x?_|mHvt!sMah7GrkI`IAVKmPd3_usEf`7XatQR>&H?5St- z%qZ#GWM;~D>5fP4$n@?%rD#tu5W9BX=V#V+Nd5YsSoPiVi*14I5ifkOeC{I`9r$s6 zRh>F#%~*9@T28Ae*`H>vSh#TE-JJs2mEX+SThwsNxG(x_|Mk1wnu0XGcT%TG-)(L9wEyFsZQ4c_ zw{-RBGyjcQmwfX0ozIQ`F5LID6?11i(YF2v`+n;bSpUV29WVI)+w`Zl>Fdg8l&p+p zf4{0r@A(5K?cMWfc8@<&n;-w-#cY)8BJ<8+~@GA@!QfYv#>avAX^H zdxk&1r@cF`>B!isy!oyF{QcE_m+#-*rP=a<3mUb$xlNC2pA1JYOUawrv+>qh&wEZ> z^y({LeO9@**}A>&J(4nb=AI2Nq-SJ=U!T_S(Ocd+Wpj&rZdiNKZ{^)K?Aw0(aWk9U z=Xm_?x?dlEMLqecuOBF#mVWIO-Wi!IJQFvLy}OOO;Hg#j~4}FzD8nSB~!M$=rA@bj`zLk&ZtjS{M>}Uc zQ+7_;@H-gCD~&$8+`sn1m3Q6c-?3`MZ$EE%dh(x(pM2<{(_1xcmE&z@Yjd5W@9sCR zoBGVtvyVUSwB_Ax-5-0@KFxRM^Dms2a>b{QYa{Dld}^oWH|_ehQIqb04=4Jso$!qF znJ#-b{`%7=SIzul^Nw|I*`ysS-=Ca&VEgUm4?T2Zc<(dQ-}-vP^&`h`*}Z!8={??^ z6|uQ0G6I);ziH{oXPkJ}mYmN!oZoQfBeMpjH@!0R)Z7_Q1fFG{eK(}ku|4D{o%zQ}|M|ncbM;xfb`2S^F?+-{SM~krB=?MHcJZjmJ2!-W zIbqZbr^e3jX?yPeXUgCIX8m)IEnWIqzmEp4eZS$dMXyX4y=_J7{aL@9cI$%=I2)Xt z`%2h7-C43_b(5hVU7nJceO8l+uBlh}*FE|9Z9~2+x%7>eoz>4@jqQG_#i)(FQywn8 zZL)3E{)catc1;h3LYto(Go-Mv@b-1r1eYIoU8R5hv#FgsSFL|my=TVURa4GBxA21Y zKkV_|^!01&zIyhGALp()ZuEfzFE5>V`wgd^((0YknNQA7dwJiY4;Tx7Z%*eI=N0_- zznyzun{k6}#nts1ta|w2UN^PO9OU1&^p2OVoH}*U@Ry1Q4Z3;u>@T-|8EtUyMN?k> zX5gF)E-Wc&U%u+hy}z6gTlnz9+plYzTd(_^%1@?69-NX{H@xJxFXwK1t9R!!OQ+44 z*n655x+!JZjHf;sdH3D-+|yHC{N%E+C)rk)6zvZc6g<<$o&Iyv@1}1Ey}I=I=R2jR z7cJk!NZ~4N$EpE$WVkPj`EwhTJHC0XB@=7U=yv&%&wGqm zvZi<1+y7m=-~q?_%dXkIcW1_yzD+khy?xE({hyTe=s)Y{=kBc2>dlvO+G{)i`0c+B zw11`Ti3=*`&Fa^5)!XZy*2?R&I`{r&O|DE0{Qm75zn^{i_{X17zPWnZN$;-vdR&id zPv7(P&e$tY%ip!|?&|X9?t;-de%r@Cb^hVP59hx-r}NPHtsfoyQiHEkCQaV8X5D@A3Et9ci&u4S zwQuFheck^2?dDtm^TgY+-UH`f@Z)W^_2ZtayY!h0$F9no8Lq1OsLS3j>bCs-p5GqH z2oC@8hOSRs(!Ie+KNj_sjvF**Tl34?eAMm0*e^D|bo{c7*^`F<{z8jRo*7Rq9QMNO z*|Y8CbDp_o!v(g-NBllQd*-&rJA1vJGU3EI^=#MO&}hxp2g>EEPdUX~XY~4p15(sL zVA8f5&iu-`?xO2EOdC{H_1oHo!{+wdJn*$M>XhzZ@aUtve*JFS%r;d^PifO|$lwwC zzkTBr+tmlMzSCCKx%op!ooN2I6DlOzYrfSZy50JwJ;T4gbkN96ZBD(S#i{9qtH0a! z)_Lchw`^+eu8*W&5B$E@>+yKJ-lZwg%oe%(zUt}qp3-Xddjq?CTi-tAtu2E}PuwK0 z^H1NXU&|)9Y)*~l*`Au{Y}fAe?5JaWa}?7vDsT2uDLJMwrec;l{hPd&PF<#{PP_bvW;TFW-gFMZ&v{*`kF&dMr${kY?vV_N8G zwtDmC_D@|^$GhN(CsNOUq3M0Cr!MRF&OICJjd;iQMg4ET`lGIG-3yDFb>G?H$9bVT znJb!PO*-(~&cKF&{hD6X?4~WJ2kX5w`!1X9{hZs+d8bo)lk2Wr{rk^zf4MTdMg5oa zThy=c`<*V=+O@}h^-#kZHo5JN2NplMt8HWDjE8PJuUoguC)nx!bpOGVXTMcGXWi|} zxrM*pG`Z`y>?ldetornW@Txj*S8g6rddufq{xf<8BfyhyxZ#G+RI&^#D7|$U zy5aQgx7p6Lt-ANsy00zy;=9o^T6&u_IS_iKbJ6St1A8C%W5=F1u9+;qDbHAO{!PcH z?7UzHI|=@Lc zJL!fqPRY-md_WpMvd-3*KlPt_QdWx&5@ig=MMk2>Agd5UcYiyYRQ^8C!Aba*S2Qu^S@p&DrMQsH5aaZ zqA11ofOl50t^c)mYBwvFjQH%UIondE^qKi;1PCjr#?2U(V9nk)SuG$Vb8W7XO+3?TRa(y=-&8-805s{7t>Ri{Boy^Nu`w|NGlNx_IM?uAB26+vk+ra`K+x zr`^$b_27c6A^!hnd1p*~dUjRshhLb~yA1p3Vw`>e{*wwoARF9{J-ClRVxj8$Ye&E^gz{R(n zvh%aXZ7zQ~vVA41jj1>z8gEZ48996Vt!;}Qo;UBRtFEg0?ke|;Xjkn-4wo!E4>?t?2WGG;7xIPZ$64M}xD!_;~HeW$V7U+k4w%V{f`AWlG~q z1A&~eTc@S8TVwy|j5=)!v+jOx)7WA&p5Yigb7qf`LdPfK2Y{CJF0HO$X1(PF#NhzFiJ^ruSzK|sF0%NZGCwO{|W zW=e*uyx+j6@u!~vzf^SYVQu}{9t|t9r(4zerKwGNAXAu)OB)q*J}=rXB>Gx@$1#(NYh>hTgr++Zr54t)ySLHmz~R$G52& zBaK`p9BleZ!g;8u*i@gaw_mx^*kXF}qreR~r586wt(@`TV?)$hJg)yp#s|U>){y=- z2aMlMZ)ny}OTXov`tDn+d0A?eOzxVnt?}HWr%%86aKoI**fTHLK|1Kei^Dy7d`+4= z+~Qe=fr(K`T-?=>GH-V7+&OCP*MR22gQTxgz$9A8FDu!&weekI&HZxUclg|}tunY& zx4??2PY#;;j8VV2@5L6Jwn{JDi}5j0gZ1ZY^jf>tG)RBxc>1(Bh44U)eKU@2*&^FK ze9Zf#(2qPno4;E>RodIztKn)ACPNlVq$kG+iL&3|Frb>Dnmd`QZ?f*OT)&Y=M7sbJq9gjKK(opmQ z7qmU1zckJ^{;*g7sxVH^*s*47;&+W%xNW0OFAx8L6~o?4JKQJU=DdTx=d-xJId~8n ztXZ?>VC6vT*#QC5!2hF1BM0nc&I#?`qe5x8+_Yei&6bDK%5E*v4k8gQD?!=%;<#v4 z!1-iNVntN$b(wynM#vYOi=R1W&gad4S)@04D$2wsCoj%mmW2$Nc=g&f(+>vr`>qhe zM-F##cMm;tD*5egQ>lV!PJ`Xf?zOs^=2+tItkf2#a;g};29{b)OXUR zjT`qwMs6ErTB3K<05>DXOzF_K+j7-C=Ew$+Y^~jz-ntq2J(x<)o+g`~kw0h7!@Rr% zDmC2a?v%IXiyhRB*)MhKucTS4OBddaGE_2hJyXF}!X2BjZ{XxQ=eh*nsg<+H8Gc%P;WXCp!?RGkR^+tH;&HSuo z*Ba}XgVS2IhFBdd+|;)@V%X$D@7ZBCHTBO!)_#5A>QImaDw0C)JxjY+ZuQL_AIv_E z&K+^s#yVo;aP@Dz`#6KDp`l~d)Z)*dHzE=}U*6nNbvNeHvJaIT`zSWOFE1}F+`eZq@M1k?{~kC z$Xu@cfpk1Q^Si=jsndV&BvGVdX*3;N?4w<8{A%;He59uDJTiOmxKiD#`nbzIZR_w> z`!@xAs2uPvI$*En<;@Bs^YZg8W%~}BF!%lI(npAnso181yP1aitYt(ZVhF< zdNnU`t}?~WYRL)x=>w(w<%bVFshnlo$0TTVZdgmei?|0prjV9B1%qdAZ*LH-gE51H zL&UY`2FpJld9%PNoe-1gUP3W9QEuy5zP90>oS*)MK|vhlSZgQu;#r!GqYH*q#d+gm z)ig{>*Oq3=;tnh-cWRloQ&vSOwo(7mImTsNYW%pm9&?v$cGD*krzYQs;@CNlw%utp zB4TfSec`-C=gJJ1K7VVPAE-+kqXFoUn^tPeu zxR%!UOQbG8kG0$sY|`XflJ))_WyW2lfhDR{+BE0N-0$k?45P}Y}xC|FLVzDjgU#a;G1qZDqV_&p?f`PCKK-?H9cOm$E4^VoRYy1vko;yk;z zQ_0qemeq-Xf!mKySbq>lk-7XZ@yXNsmD);U+>Qa4o3zl_+_-gzs_m$!7na`}88`-a zdGYuCpYkTQuHO(IyVdpe2<>qU1|wnKTJ;n|ovRE5OAk%>-^^{rg;EuB%7vnX_km;wIv+J@)_Fve7Notfk6a@z}9V2>}Ih z=6CMYXql1IP%$YNpOs0*^rYjzW>;W;Aay=DGvR5|W+BH6A~TBt%CnxLCSBW^vZa=6;QheU%O< zQwlN&xXFu0oY?3RX7eJ-(5|NDjE>IG;8~2M#_D@-5)*gk=1x>PfYYW#^z38vjN=$` zYs{QEZr>Y|zsAM62agHvPpRX)KC-H@*tzZseS$^Lrb{iAp*{Nyt>zlJ?R5k!0oL!! zmldf`q7EJ;6{r?FFk@s1?@lErm!Id=?i~A9@VHv_x$|U(D-J1kjB45TaBj}lEQMhW zmuZLR?i&2vu-~*Z((%)xEFM=E*V7v{na@ot1Dwou7#g1blIalqiWqE=aYCgLw_Yv?oo6mP=+uq%j_UT6fBE`W?{YM& z>Df9`)ANWL{qgD3^A_!s_TcEqZ&~P=VMZz=hXp7ED~-Js(_c?z+=rejaYnV1@5U93 zvMo41T@eMhh6XB|3wmu#d)MWmZ{IL4o0Ka>IQjLv`Jz96)uc)XveOh~mlKilo z?4+cb3)M>O%CldpD_(8M-QqB)vdYWq`=QHnD!b2?tyyV5_u=H%s@pwMpDbG2))*8N z1b8PuY?7=>!yWzd5r*tBW5*snbLO6Rs^N%;W5bALLx#*$s%_1h%DsC=%f8Uorq|2Yr?!Om9c)?jaaTzRl$nEu9PjGFLwyuU zGC>*7R!lT8G11m8^wRzO`LnY8rUwrmIP9}+_IwiM7L}HsKAAwctk?Hcah>t9`m0ff z!@b-Z@ohf$VqY{U1-s6DnDQibbEaaRbCoBs7w^il{`%{$8{0-Nc5*u7ab^9>mtG9U zQ-^!S+4}?H_J9F-M){igGUvJWmlS*s1P|Fb^T5yy@--qZE8cBcer^)iXu*KIo9Eiv zn%_s8uG|uTv6|%4)5_L1*%kPVkRgDr#l^+F6-M~dXago}*iMRec*q>>6WSjyCug{- z#eeqfqWb68iieizSsGLYdsrW$+_3r5dZ788>C7$PR_u8_x0gcD7&)hsFE`Aeo%5Ts zfBM^+NxhF{XSb!^HG6u7V(a8|?}**5W1v!l2F-SH*}Z2EHRCCTLa{cPd)&>YOf{%* zInQXJtLx)a3$sA@AhY;W|NSA?4Q+ORY-n(`XeeLBvDx`e)wginYHQl+=Np%QZ!6bJ zTS-#9CQW(U)?Ch_(`Pt3KB{fpx^-(0a~h2XVj^?%wb!={7`IE#q`IPPuT;eYf3t5b zFMwO|iCI1L!m)alD)l)#gMo8)L{Y;tI>#NTy@1r+MZm6zHg&pYN>yN@-95)xO5~y~d(*?6~o76EdGaI}U}P`S z%Gb?xb(w4k#+7ku!2hu#-`9Q~Fm7llwZ7sCY2b<3f#JJ)x$dobv2EM;kNLL1wC_Iq z*G~VFr9@A+F&_uzmPq%Ik6C+>`zmj1%8Z4llNELu-rXG<5^^#=-j~4`vg2+@Ts8MR zu+pJN9+2+(znvnLmhH4nGhpl6`i3oI$ZlYiIBtabw+Gj^ZWwZOWB=-!&kM4{R)^`R z#Hwjha<7jv|MqfW;MhLVH;Qm_DxN9ZMjAh)Pg&dYd~=+0LguHBuk!uYXEiGZ&hN9n zHeWYHE0VO(d2o)G?sB7it0GpSng-wl{fTQpmaKKQk5nR1{G$eQi8QR(hU_wLp`HNYd(U>h|jr0lq3q^j3-SN5se ziz?EAHumaKPo14TA0=hgen~Ag+9bQbf6w4q6v~S)jkW4WrF$!AOq@7qZ`Jng+qEuz zO^J=2x|a(4Ht@_VfiSsGteL426jBJ>_{9&o!@*eNuSinQyY@Sp2F#h9@^nw&GsC7g z39SeA4{HsPe{|@Xr`)PYt}7>t7Wb`Q^}VfGP9;B5t9Q`ZvuC%N zf6Giu;})Ns0|u;1v$C_ZO$mgllh-d*e)V|JQ0_>n0iI#X;ko2%o9dpVR#oPN9=6@q z^vzS#c%V($iP@A$&Eb7w&3Pvayi9Jx{AnxVhllZE-HEUk)nOKxTcQauv z+NriDL3j0;6lIE{)}q9uq{dI5ifS8W4*`Q`y0S^bJxxtbZHu#?wo-2R@OcXsta^QW zpWUu;11!R9RM`jFRi=AwFNYr-pSX0AiOH(ZA77QPX-&HJTw6)Lf;Te0$UZ6W z-)pTs*Y@a=!^-#B7aD6nolK~e!cEnZS(xE)rtU58s;Rm|Zys){)%76T(IYcFbAqdV z`%p@)9}V6xL0$dHInME7zai@xA1ZTBoH$WAZ!+UA*RN~86vdoceCgt;QzR3U1!~_G z`Soegl}dXMv2EMpv-EvN@>lFGL>kUo5`ovSvTC{1a6fGFl4D-p2V1KT?`mz1OiytDDO#t@j?OFuZzIb=ctQg1dLW zzue{Mef#en2M;>P-nxBzaE^BmY3Uc0l^4IfNqBy3^B{}C)>1*Su>^}PWz62;*;j1K zXD5%WPCT_B=>q#w<@134tK3W%xyi?#FF7B`x^>WWtf8Ue#EA!R*VR3)TB@5pnp`u9 ztzBhHZ)k9Gnl}5G{C<6{fOnnpA1QjVj$`~E58X5T*k z<;xfS@>O~&D$lR<9{r$(D|-mY=f{_~c3o<#W37&9$)17RBmbzxT1`t!i%29I8J*9s z%QRL|e;kW0TH(j{!=KZDQi5iK?i5FJXI42ap*-mxij2qSCvQhNQ_sOFT z3bn@N>e5|Z{rp;5J~&<5)K_~S*S+WMqR)Qok9zs|j5hGE2)xu9Z4^1cLQ_*SJw1Kg zE_Lvvl$4Jf`kBodOa&?u9v%(^Y!!&Ez!0!9U!{^%c)%wwONn;r`?prc)3ciM&uWYv zYrPPEF%5@%Qt-eR}>yeCF?_Z%>oSo-!cDO$755~taGLn#JC1D{^s`D?F+@?^i=dt;gsv;0`5bG+sp z4ov&LG-Gw}EHH2b14#~tV_|Xi`qn|#llHXG%FgrFty>3favE%1_NpnUwOpe|W>M_X zqd6YhAn5D+<-y6Z3zy`rmUCaSEno3@@y;(yF*P4!Op2BWNv zx+iC*4Bj-D*IaRH&7;UzKZBC&iGkxD+)B9}?W1VFlM5mh;1EHayJ5CLdBs~`-4c7I z&vzf`u;6p`;ceQv%F4>pz2xhi49dq8?&nR@dsW=iecrrgAcD6Kni@}@-1w$Ap|z#YFtW9?vkM)n z$$s)Seq8CIoY2CejdxYr2CoYt^w%<#)7pFF_-;_4t-P@%rLHNIB&6?G#SAz~18CW_% zQStcd^wyO6vb@)-r5ef=3U8*&l%Fay`=rkush~UF^Rt#F<#_JXCR;c=?=)arBy9He zi3+`Pttcz4dBan65|K4gN9V(#&7%eytJkTL23ics$<9)1wUrKd)Fg8anA*31+jnEk zS?TUY_wVcK>aI9_F3^eCbCSOPyt#9S4jmdX+T2VWi#IdZUz{)H?jPva zBWR2r(8%Ftt1{!%stTex1Eg&uMgU8xJjr*KhevFVr<{Vq(BXYF``t(uq;`00ViHWknGfkX#O6EBE9N;jBDS*W9*s;UnSSgZKaS^rq>@5qz>#d-f1=l%Z;&N~8Z`b&Z+ zhVu>!G=q91gz}E(qrAf(#X;V&3`l(RW^^yMKZIFFcaJhyOQ}fmMHUl}DY+miECIn_ zr7?XtF#i!uS<4|*?dOV`f))kOex(?FK{5Kj zrx=5d`RjkKC<8%JhT^&Hr_t$zu8{Sq!uFnkM>p#WryB5QQ#nv`ygKc}KagvnYlQz! zwCCpl{)L+hpA55>V>sssvKj&a!08%moWDIEH6PR4!I*#9d>~*+5Z&2qx;VtM2xbzR zhM2bE*X)+04e^4~L9ZcEFT}*)UqkWEfG1r-Wp@+!2+h_9b2xCgm>Cl>A!uP(oxLMMXP4bgD;w*#Z+MfE1bbb9bHmd-P5P{=Y0naN^;r{OzR2;PAp z@C$1SM9}vlv%P)}v|B8B0h$O^u<;*ohl6Bq?i@%1rm{9_PpHadAqBw1(SjVu?O9Y= zz{WF31S^_1;sm+EjK=dBjieC=eXx{9$B_JCnpb!;a1p>n(8)eLDri2CKA88L1LF*+ zC?uFSl-BMsG$4it{6PaP0f|kp%7Jo_=mdHaesXIB!~;o+hvq8&fk0>wXe25LP?X{A=*5eyIcgs2hA7oXMiry zvW1iyOHKean4h_Tuh9sEL1%Ow5*hqL77w&sjtJZ}s`i5D1`Bua{3u5h*oyh*n1z-t z#4IfL!w;DyOxJ-~5Lpg*pKd}$cFr~Q0T|cF6d*+iXtNMv^N+dLnHj|Zd&DC~1npap zGK7slQ1a7k2l`Tx48j7{qH*w0<6)v8pp~99CNkgz29%%NLEy+i6EHL-1m}c9AR<`f z;AZ495!{bQE}?~>7fHyyGX?hw+jOz}B_vD{Bq;S{K|mofMzsgi?U}@Z(lTi6LoLKs z(5Xxxt}n_I{w;#=-HU~wx`XGTsP3JI)M}tWJlP9IV%~J>GMXn1hG#JAx&@Mng(lwZ z6uuip86tvLj0OA>`yB~&ka{2pQ9{+g00uEr1Ol-Y)UJS(uv`$`%A?XD7fK+T?B9M_ z80V-{hX)ykG!k+X*ld)WSfUP;87NK^--kn|iWg7Qji$Lr>(pghn(j2MJqqeZP8i9} zMG=j7-rj!D0WV?{>YVEe_=YfkljbD&rvD8B_M=l@tjUz$%1d&X~9J@kE@8Ko* ztvxljz#HRvDEKywKUgM+jgnC7U1HqQ0VHx9>gFy$LkMs!f&yZ0z z3YrFg|9@`byGRU%+WM}Oe06FI`Q0NV+UO{W;MLg>PH1GK zff_G7Suh)bLI(2W~yH{Yv}w1=mfJFV(G3#W-mN}oBc&Q zD$$UFvVk3)ra`a({mi#~;38u9ETJK_>R#+E-U2AYnB(JzTY{*%gRv7S2`cS0k(miB z8X;fym;NTFE?gv%`c;E>G6jzlz!#vRYWONf?*8ts50lp-~Ux!gd5peFiK zIWR0|vv?>ZJsw6KeE4ic*gP>;ftWlm8nCQv6m^sXhPr})3QdC4RWOQ}5H&S^nQBC2 z&esTzqTpg5QC(dfuc*AdoHh3jNa zfyG7jjVYvW;3A5T4E4?8*YypFEd{|QGHuIj_Yi!PT9!ASAAcfUiU}CX{Qw?Z5h4&_ zq(Fin#2?QoiYhJgd{L!s*EJGhJp6(}(vC-l;b>;u_8B07d*z^09U}EY0vHZVXoz`e zVDrVEfJdIdz@C6%5Ob+e0AWd><{C(K>%SXAY?{ZiOx$x!=Zs@Wq_j^vY?M|8Bu4%I^?d&i;Wp%+yG5ezd`A$P~29tr`WO~tHQxR*` z9-ty)a%}<&PAUe{I8s4d!X_`-ok2-qNksNW9w<>>~A+8f~CQF#OW z|A_8(7}iM+o4c0Qf1~CfMa?c~f)N(4J(dL;ML`vUg5H2c8e}Bbh(Dc7X6*mQ7vbPXgRoyC^{2~&O6L3{ zvz8zMvhd;snTxI>BPGy9#3dO>F#B~anIISBaU<)jGKp2k%siLgb5YsgVc?qEA z@UT2i$O;yJ+7<~Wy`f%oYiba#*2DEDH0+v2=dd*Jq7P#++b3<&UP51I0}luG)(4$7 zMst{S=q{1PT^{o{%o9mc4y5poE)co=C#H&!mF|Dw^UxLYU-WtWLjH))6KdH%@p*{N zMzcI2E&xfgDpWJRCIy1_z&B0MkQ@qad&7Rud=d8Mg}@gfgY<6B7yWY&#AE&eAB2iA zv9p;WVYehYrzGl|V7>mF@^uz|!mGbU^|1G4e{M+uk90R&Pxx0w#Z;8c^I@Q`fc~$} z=StSk|4gj-M>G|U7P071G-RxLA*zvoGFI#~Qv5S>WDp;vQrqu-Bgr?QNr5|R!{Ws|BX3**KPolie8H8puW>YzUM^KZ6*OuYi zlyEW))RjW#d7+95#RGdkli#8LroQ?=mHKMZ|AEw3KiK~%vd`_GKBMdXpV~T8rcCLO z|4C=kzxzM`6aSE5REDw0Wj5UHCw$!-#2K32WCo4C+=xJ& zOJ#eJnPj2{fdk?YO%9b!^9F>g@pvwmu(FdIrZK(9AZ(e*VzP+v{a_{w+1Y~Ldf;yosGvyQv|$|p72a15`~+tZfkoBiviz~?fuH=v?-Be!LIQx5owY%7l^|`0 z=X7KmQZZP6@_cA$7J|o6SacTKh@c83UEdq2f+roQ8S>hUcqR4tm1I*%Sm=cD&XY`8 z;)4Wgpezc7Vk}%GN!1Zt{h4MWwD6T!BLZTxjFJ9ecPb>Xy?8m1y7AiyE+d;l0g?YQ zK!olV1$BboK#4p$D3MO%fM>zowVH4Xtq~GoA{;>X?a`QC)MbEu3fZ%;~yKzNN z>(%3(G^4UFYcsZd7;YF*x=%4N~~iDvLq zY|pw71%%asRs_=V&m~d&P`T~oLSOj%&qZn@@(mlfbAQ`pR;La3#@@Rkn%TI_>ViRh zI@lnjAz}>{{O->Kzk`qNHV|5X-!y;TX~kjrSPQ4SblF4!r7GOVPUUc+v?C|oZ42_c z{GV(L`aV9|ni(z*I=Wpnr=3<6omwQCp+|U+Q5SURi~dA2o7RVva^;ub}mkjaDWfS*4gM3xL_-pgU5(6b-hfbPgJ!}iSl6BZ)d#=!HC zBf>^P7lb4V8K@fg=%QX2VfR>$5+jSHfa&n?W8&`h5K7#wK0--G_S=Je_v00Mw0$0rp6=I|52oh|d9H9|1szm_oG^3gKu7El-H>shya=IUhYrB;#*O zM~@Q8unnNdK_U^l=@5Q)Umx1JnR|*l59||~p9sExUxZn+R zq8Z#p(S?AwzpIYD?@lzsPQ;ok`cgX(GUR3U?&&icvi_C@o6Z}74wSG4BVW2|ayvE9 zKTjSoPm8UrE#}xt3VXo`kX0r}oFhWzfEbcX!=hp?twRJYOv{n?=2 z6c~V_CtZ+osC0x9J$6MX5)eotS^|d+@Utr-Iu!{`;GrwB4(?NkkW0Zt3Y-8RP3fv2 zgl8QY#`D6804G2Py}Bv_dshQ=_grh|*>;W&-IZTZvp=b=d^QlxTr6jGbBrfo9hpL* z`h%`VkCGVdNrO5IKP6F6=qwHlec?eO4U5S{pGsv5#)q_d5vPN1Aqi;V z7fJLI-fG&;1R@X#gAVt+E%7b8T@B~hbqT7x(jIZC4PC$ph~ zAcrn#u;;d)OQPm6`A_Dbb$bf$f7pA|_O`8SQTTo}o+tkSW$TEvDN3XUCz9nHS(X!> z+Ln(cH|@1uU5ErF)Fi+Fpk+06|Ihm`-!<(C00)gudc-ys3G8w0wbx#IjaRq5xih`F z1=E{HzXQ{o-^6Ez{#RdnuF}Vh`0uNo_2pvx_fETgr~kc;&u>}(%MlPR8~+_^H~rnk zmq9d8(coXA@g=%7H@*1+!`nmnjVpQYw7hp(-s{lvUZZf1Bg12ZB8StF;mH`rZ>_OyI@Jo-;iY;cZu3mx=yVB9RUqRz_{ zfwdtA#US>=m>P1XED=a!*g}JI@)bstKy*yuuvY;`E=Rl%DR4BjMnM?TWB~WjK8E+B zpr6V~C=fr7q!%`K`g+lh_ zd-%nC__n|vpThb@h^pu)gRVP)cZps)PA?t47qF-IN%ARF4g`DHQ4Eyur9^Uhjv9=- z<>_-n2YdAEsQwRilu`=V9^`q@Jw*s+4RQ;>DxP=?IgzwEctbH|fCp_{E*k#2o}i~f z{qsJP__o$r>mOsN)h0|l=`m{2pv14K2;U0?yY~yh?!C%j_w*~L-7hoMngp$lQnBiz z%oBGQz*U$@A9f;d2@br;rOw1j3}J{Uo?$#VJ_(}K_b3J*dG1aPvR^@mE*50p9@5Mp z`$S}|Ap3F(;^UefJ?{ypm*A5;Qy~m=dIF3qLZ=;{=`tPMwR+gjjka*~J8eT{-ICz~ z$j``AWw!iZ>B9AGe4LFo`Cqu04SI|1MKY`2@*hV})DvK zgAnKev2Sj`D?27Xhu-&S;|W?y0I4A&l!csjk_!&^sUla>Sq(sd!&)3evyftVs)Njm zFA8r@gHKVCswhF$uG`Q(j0eP|KVi4e{g>N&uV^7R{9Zy-0w@}J*qx+dn2S4O3j1}_ zRC~Su=1^6VzKO@AsygZpD*|AxteOYAZ~n6TrcjsLpQH96EXe-bV%H*Nq^ihc>@Ds4 zn5BRyTV_@Nzx%ItE9(0H1g-}WVLZ@$9x^l6!{-%UD=F@m?~(8T12MzTUv*?&XCtCJ zD{Vk!AyKu3)9xrQmcp1x`oW^uw^UW;Lx`)BnU$|}aaE5)B0+gq%AQti@Ny>RY zya4@8&Vf(>sqT*lz?z)17dPEBteb-pTV%$yb5hJ`1QB2lOp5ay$gv@JmY~-Iva4ep z<49Q{gPaT<6cSGCO?Q-AZoh_Upwk8KL@*qg2L)I&3nuq1>54;$tH>2m%;%gw6(}q; zHmB=LcxN?ZEe36>GQJnMb0)BHePW{tRv$NAM7N%r49LIunnX+AijV<|%h>v3~ zqL2lO0&QSAJ^*J1)UObbQhDmPTmHTZby!^lPZKYhWGWqXKb|xBQ@5socwU#@k${QdjC-od(K;{^fPSwi8l~c(aP{8~@=bt1 z5GVg7m&F#q6=PgT;QC5(P08@!OR7n=Ax?rlyp<)6ssx&*Prn_Q1pui4?2}gEl^3R>F{KObZO%|8I=>XIRE({W3mrFkFN>SA`?7c!#8W@2e zc$KA#xiBzVX*a-`M8!;D9C_b^g$25oj3~VVO&GyTPz^ti>=ainSoaZk^x>FU7eWgu z3<@B(!~+m}3oB*^4nu7L-`{mlZ4PF}_ajTXX~MBqw!^WIgFzCXm<82qg{KqB=7?p3 zrGQ=!&3j5i6Q}?@DtfGQ)}tioRL7SkQMMh7@g|OXYnL2WLl?!07MggIMoz1M+$mjA zV>Z!*f^3VmX9vZ20vvB3@Xkw$rUa(E$3W?F8vD0A&Yu zfTqSMsR=2fI!72(8wBMTsK+}4Fwq@el8s;kqX0nCa0c%=2Lnm6F_c?EoEb^sc^_K? zM>0mz|6B!8j!PIggu8?wUoXP=;+%^FMJ?966D4o~&WpAJwd!SnZM{?_oFp<6_% zFqSiteVf8KGnIG+Daa3<544~ORRMyt8Sil1BpyryCOo7hV*I>xJpj%pONJrddpK~{ zghejh+w3%7o)hz_cwx5UY%~9%FN#J90h1t9^U&tcCGdqkve%a@8$xbK>WzWbC(w{M ziPb(I%1yHQk%(9cr4rkjAN9H z##l%I*d5R~)dgUW)@D4CbDT(Xucw<6Dx(g2eXBf$6*!roU5f|Lmw#L#s}ap3#kAkEhx=gv^cb`%n1$74gZ5kO+i-qTsjN*tUL`yqcHwM>Hfeweh+SS zqmacn@H|DHNRl#V**J6t3b=|w2U2a5F8A7$kKSc7QdgeaGa{&?P>W9b{q~clwk1%Rw0%li@K%PEqsgDEyf9H zx~9lg>F92nZfX`oimk}GN|cM(%`l=3s3;Lq9SOXqhN7E*1JOUmua}Dol z+6JX~RjYZPNS-kSPi^v@uGUoVt6=ArsDK{#^~FOL{6uwUY23)*3RVur`<(jsdx3ut z4L$|_j4}Csw+q!4YENZc{_~dq3T<9%{Bdz3Z7 zKTR}7(*k~~B;%_SEE}Z3v%*QLeQ*Oh4<#!$Y7aFON(zL-xnRP z33^UMSff28Sw=lJ5l&OQ&}7JbWqCU80yx9QeClx8fAUaOEvmxxCM~H>%$9u|J>ehI z6jQQuD%4VrZc9Dz;E7&~MaCzsr?wjB?3ZrA%Hh6)eGv?Cu5+l7+8?--?zcj9)|p+V zN*VtSwOyoPn%zY>iUtX$X|Epg7s>NFug<;#X`i!lgSAA)AZ##D+zutyL17JDb;DeR z6P4Ac&OK%0Lb)_yokizxXfadHDS*X>?Q|srV~$;A z$5J~L0paOQMzo+$(NIZkL=6N)R%}xO4a(7AOfQu%n>M&YMHA!|pQ_cCRA2>CqovM{ zN+q2{KCc&Ij13~d${Ycj)^i0Wq1f@cFFHh_V@=7m1TRz)qo3gX#M`LIG&O2DM%?K87PvGsPrFvGTy8aafSimB$Dh9UD_42%eu^rPYdZ z%7k5JHNLD6=qx zp?Cp;hDg3eVFQ~Y0-~tasz~6!e)Xdd%qwE9%Ax}>M@jtZ#W*q^k{QUv!yeMS`a1u+&Ox$HTN1OXIvONd7 zmbqh*ALLnECroXx&+>J?xBE&hZwwIa=9)gGsq|vcA;;^I7~B_#-m3raf;Ohy_>qNSu`%L)Fu4 zDeQQqIAJkJ2F(EqI|3HmVwSCW-ZK583mYF5V&ez2n5Z}m8psM-piqEbpK~C%NkU1A zDJ@w`q(_p7-RR(4kgDS#Rf(8kk($hz0=L$%`~tyj381$rUOM!ETs!1O>DI)}E4j(J z0Yd>caSw#^wPLvuaVr3WV4O#2fJ1dFtEshHRBJ|+YfrZicGp*HQsGO}-B%pp$BtlB z*G)U`aP;*kX~CHu*R2^e{aSilYc!gLYQ?nN>f@y1mOS@XWjhgfLqApDoLykC&NUJx z4+&jJYMEg`{_%*#<0gl8k-p;voyc8mydk2z^3HBft=T7(T?z}{Oaj=sF2Rm< z5D^8}H#q5=U2nS@Rl53B^>8s~KbeT!gq6&TAC{zEwnraA7~_y#(eq}45(--;86|O^=*-P^8Yc8#1swHv)N{ zxocso1g2%%4!cGghE1D$7Gl=CK=#!W;@^jl$rD`LOMX&Y|$qi7KJJd!r@4CN?y=FXu) zujNE4&YhcfCeM!ue@W62{WDDGLerf}EJQUFDr(}Q7K%f9BCIH^r_dD7_;yfkK@;GC z8X1qYfDZ-SpOx*s2hjJ^Aj+x|16%q{wvK+T=Vcti+hC^KqSOj+#twwW75`EJP zCMI3e0Ai1?1enllkK z29|+~v1?cURx`0qcZGa@CMe@;HDUKOh@))iS1z1y^A#K}{6_c+Zra)N{D`(Z5U@{q zlN2b#7E5%8`MBYq1G2UtJ0+9xnERm{2m;`Q;)>+s3S2Gjr8hVjvzdUMP1C^gi?mwK zF$fd!BB#(umxBBRpMq#W5+!_rS2bGI1F27&Zola=`#3!zj-c7h;ctBC#mW4M*g->!Jl3Sw;bK8R5h@ z;k~sA>M~%#OWiU&I6}#6pG~ncMX?G4ZTYW~cu~X=5*P*vo_xin^AQ4R4d&_PuYDI%s_0h(>(+7q`(e-q_`AdZjv<}S;D7!3ePx)GsClh9g{#n60c z2T|wZ_SscZBQ$JfMC=(foZwb?{A5r20OBJY;0Cmbw()Rs!!-&P^5-bVP3RL<%><)3 zKLWAuiQh**8V{z8xIl=BfF+>~gS`;006oxzhzDxeLFVC#(5jKWjB#YMe8(LxT(g!E z{bQ2%~2rjCaE*|qZUZLV_k)$Lms%z~^Mb22p5Lqr!0ky(0{z$S!tcf$)lQC3^ z^Drz+hPV!$Pb&R@I-w< z4@}0NzY&r%Z~#s~vA+#S*+z?*bZdzvriB;j+r5QIP3<6!u4@GXL8mM#ORjXrPCR6x zW%r1M2W)N+m&>M%|AKe->#-B{Xx0*?1~{EC7%FhGENb?-{E|`~;o2(uTCzMc@vnG~ zVU{o6rrKaM5l)_{kvg6$Bbv|@7s;$B?A63^l-&X-wgoa!xSJIwkZDLT8gVd6JljaT z!S!u(s2&++!@DM7ld|fUb|~0HFNtl3-5O!tBEDM0SMF#62lS*9BK}B?YQS5v2En~tlODLyL zPTTTVAx+C=e?LZ74fHx`V?xXB#)Jp7F?-1F!jK5es<+ws7RMcs47;xlX;Gj;z zA^~E1z8e8PHSI#59+lVwQcH#LNq#yXg}HuCLE^~W0KG(`EXzyJU49nshQN{L2 z9Asv(3W_Obs;16yY}RHIj?Wi)xk>|o-lNaZw!z}#b6hDaKo?sFu=y*J9Tk;Vv=}fd zqYx&29Q8yUIs5~eZZEPhdkP>l3vEojiRJb%&WaMivq6K>WM7$wumewAj*Vb^yZ|GS zUqimqNgG)b3OYMkp4I1frlqSlj?xH$kn0$*Fh^)rl13*{tTu}`jw1{i2K(i27(Rqu zB;fGOQSwDaM4Y0903zH)0>fwXfHuo_DUR=ul^-Yy(%MiJloDgP zp)iO^o_UYrG*W+%mU4_YXRoO5P-+`?Pm~OlMG3U4&cJX!rP`WPy{v(2nK% zp}j$-JApWT-?@L>xqtjGaR0c5Wbdx~2Sy!-oupkojE_m{N_|a~{OMTd&Q-KKnk_Hz zC)n_!N_+^Mk~Z0I`P=RTyo{l72FtaQbf|pugMzKUzAK0-*O;kI@iVB4;!SI-RhBMF zY)@4v&vX0qMb|xK>;Kptuiwt zffskc$ic-`+_^`cPhI&t6+&l_;0hg`$1X zf=Cs#ZD9&%48YK+J~KgqHa{v{gjpOlP4TA8TGXzwJh1;LR)tm$2g?wHE_j?O48bO3 z$5*fgsKuT##Y>H~nPn8C1n^j$Ne$APlBo&GyS!=}nQ~#W45_q)@r@;n5VJWfU?v*C zc(wryi`yw0J=?hOFa_B#+69IRc4ZIO;FLGRE03ww#ze2Yxx}4MBZ=thkUo*CO?RY| z{V!Tnls2{eDe}l|yD=qejD28;m17ebPwG@Gl4t0(?rw;gfVh&V|CDM*nPrjL<-6rp zYkl?4=ry<3FHHj-TWEhiP-!8Egq_3ehqPv-qeNWgY3amHnK#z9AXtCz)%LSzZ;rNK z{Y_>hax02c>cR=STz2|#0$+RG(xx;!Cmf_=9S=_>|5$8%hDm!TXOlS$S;45INiv4(?Z?!a zv)Eeo&Vo$bY*EVzS3uud8y%6KthiK`AG8;S^-uYY$t&p9S;#F+g(|@^b~{?T;pYUO z8$Rok1s{{x3zYAV(!x%|M+vEJ*?rP=0ofgb7lT*_&yAZeV34yG6Xc|Pp;Jj9+;izV9C&BA@7lXzlK1XhhtoEvGRy45 zU=>G|_PoWjqiOC;VpPW$7tdi00VX^4?@V9%RbDi6&7ka)PR0n%_pA$uiu{RiLipVj zvl_xA3VYDm;amT}I(gkX!Zt>R6^0q$9XCH)?8_`A2 zHWeMWlDqb+E{qkuw6As~+81V5pLex`QE{n-gRwHTSstWxHzT&+Nb))@;9opPojn`b z6oV1;`>MM+=j=TO z|EO!hg)Trv&k;dSui#H38Ho=qJ7KY4*Uk)9LOkm#>jAlj*HLy_uyVKd`lU(rWD^)o zRxI|!dVB#(m?-8vcN7-#I2q^46c*_*nI$FG{ar^pRb+Ukvgbcj3jajF(_#9 zM(zY7Oes0SuH{6ATVd4wLrfG&rooY*mQ9r@!7;xEWC7=u<&xOR1@7U8V(aFw-!%{3q^w_ z2H<@$g30p%S&#PpV^{%F{#8N*}Z+QDO^I7 z;t`N)=$COgM&r7G{a4xlG5r*wMK)(+<03v;kYc(u@^F>wI=Aix>V{={5h=JUamOqG zct@TrrT^^+q;PX8oW6m*scw4~5mf<1aE$Lp2vcBO-!(CUd_Vg9VLrptH(}6ojlCUK zsYzrt?a8L4-K;acqG%f3U_I%asI)z|hd(|wZFF6@RClT?#v#yP=)##jSqfV!#eF!R2d$P}XPfovL ziqB}Kj#v; zwX{1h=`^FbI~a4Ach6Yx!fza?n-Nl_Rg|T+JSLb%iIalz2Df)Q9VtQ2H%{pi)xfIh zdnI=Y1v;;o&aZ?;w5#k06FQN(Fm@bxA5%#K%wwBfJPuEyI2J|&QO|YHbUa3;X(WqT z$t#!<-LinNN{3vIudMi_E~&?yvV)$HQLj?LioY2%@=8kF^0o(A(zN2nJM*281wQ9< zHjgOZWrnDm^u6K)CPxOS3V`7HES^~b6(|=F`oxEWbD_0+EObX74J}GkX;3x2tfL+M z9*1O%DRX)jl2`yc3Iog!My)g`Vg%+xjZA72Kv&6;{o0vmrhRpetu3u`5aX%kondqo zTW_wa%BCNn*{&MErzjclofkft)WMXcm!(8rjvgjyg3I3)$| zz3|2qrX<0&&TES4Mef76>EWP`@SlIoc~BpaZ#PaEtDE3;=+`}6x>522*7c1imZ4vq zv4bpS6n)bk8B{%T6|?^k4LO>ysT8V%=%XSEP%KC}42ih4X5(Y7LM(w5R3^~O0*k{$ zk{I|NR4I?~YIG7~*L+qi03jlt3ncc77_;6*xHt;X0lNkqAJ^T4gMdJRFd>ouJS3tjT?0iW*Dy^~3&N%OD$St8sH_!#V;&Ue(l6`?j=b4-qJ1N* z5M@q5;4Qu20yH(PCm;zY%}Eh;)+H%_9C9$Dd_%5L)^!HMl>`H&ro>y#0SZD0zaj-u zWdy`wcd;ifZ-WJQnA}eQCOZil zM-TXr3gm1IKB@pMVTM3}7U@{W@PL-PW- zk#^I_1VI*zaGK(*aS4U^;*boe1uakD#kC|;Bt&lO0Fpt^1YY)><##NYSiMEYafA&F zZiRwkSi!O-zL6{XDMllLH7p?{7{Vm@>RvH$Jmk>lk_>VCo;&D>d9i*lP$nYKOxUN6cx z3LehrRd6y07w`Z+Nq|nD4yzP+UP*Q^MPbmkb;(*}iI$)hf=3gmZaFWfeLh^-P5i6*UR-$S^qP%ytg?`Kvic{ruIY%Sf@Q8&oh= z1T&?q*cs5b-#OcQ2!kAyM0l8P9sm)0trVf-2PVC4N6YpPhBE4oRrbMSK zpsHfNZva)5dd5Xoc}fVx=O%E97;@#qWK5m2j)SJN>r6M$B;kgM4?-6d36P-ZmEujG zo+}}1(?jZu;&{tek}VHa6it)^0Br{(Xp-1c6Kv~7kj*q%^XIi$qXeIG=Nyb2wh79*?3LvYt4LrJy0Rahz#zBAK9+$6$J8SmlEl}9D%tc}c3 zxErPLFcNAV?TT&##B)f*6J{OQjtL5?PB2K8KORw2#JakcO5Li21Vz_<b&2T4b9o z4X7ZP5?G;mF1!+Dmyr(Gst!-7IuJmckC$MU4*R0-NH|#%6BQ=w&UMOUNn3=Ib?3^v zCm^wb&%~r0x(e9`kNLC~jnSW~Cqdk*WMm9J6tGEHU7G?CeWB5LZh+}mDr~iCOh}wg zHAGTp7O_obn1X?X_bs->O%2gVL2@mVCM?P%9FOtH_69+Eq9`Tre2)80>P;=LMs6IZ zgLg|Z8+QBajYCgVM7$ACO=_8(Y`2KkswiX98S(Kw!`k`#2W(GLc#bPe7c-axrsefn z!%;}h!d`&dW;UayR3>X}^G)x_R(!xg`@~Vn?3ZH|o(GD2;!W)h61>{dHKRcG96-$E zZj(VpfN~+&5vIV#RYK(f3$AIbN<`@??FpGG08nv50G%N#lN^o=vaBZsGhd3NT>=I? zrZ~@@ByNLdU~b3gk?>J2_z}f*ChSG^3M(^`<4;jCF7Vo?AtkuzK36uI1?T>li+ zbJ#H=AzGZ^E}-&+C>!QTplIlLq!2RHHhjFd(e+UIcStZ?atxK2c1l(ydXg&5Gm&G{ zgXUx=_uw>YRkit>s@juAHTg1W>jlf^-*=&hen+8)9^Hi=y3Wsx_&?*`jmQ64X}8zc zOYwj1@;~3s=fd%SZa4hT+h^Ah`v)4iaO@we@2L6Et zpTIV%3jA}Gz6zXt4aq?b`>UD8Yfr4uKk&QSp~WFV6Y_VW;?U?lkt!&8;9KkYR6F__ ziTCoPrX_rNQYGW7DIs5NmS?Iii8ofKG(M=VVOizZ<}uT+89V*jY(xE;WvO4AVyf?y zSMF=NLfKokP{W-;RyhMl7FuI}fLfK)EC;W>;E2ejQ`zq+A7}Rx;^G)%Qf*ooqiPKE zrUWyp6ctShX5>w^yuXHE3zK)G0N+>+RK-=WravRNLUF@#c!j{(mWQXM=nCGn=n7i0 z?0T`GWLHI2@JwU{-;JzL5m=!ZSHV-aR!dN)!YYvX)(NUm8B@ViF%{g93Vt!9LJ3?b z4XRmQjd*FdBPy7H3S-ku=219>Tt!nrNt_C%U}7n_p%m;$3TR*M1*JF&{v2@>ys2>% z{3&r1ys9_~*X*A=8O={@%HbmWOfTI6PQM9(eGXB$QSGUVjd_+^rKCNpJfbGkBHMej z;7Vz`;aU#6vyp2)m)UXo)VyxL*{SPfPLR?%Rd~l1NYhLg+45pu#YuMZ`c-I(tG#5s z$zHOwvNN4zy(#WpGjM{gP!gd<5fUb!Y)_+r;Tg^21rK{MN1cz;vc%q!nOyD-UO!5+ z+++!5LPZc^)t)uzLc}L^c%WXjx7ZERo|;tSy4~9*W3}cQU5s{|+_LDO1vPpBwI`RJ ziQ_u`3fhHHh9a#j$b*&SFVLH1!~~p9j(Po&p5U1pXVc z)pZaTx?-~u!(WJdh-#Hxk&ummy)9)inoyJ>5^^uT>17~xbFnv9FDhKW?u~HV6f+%K zJZir%12h%m6uIIqDnQbJA!sRXy3V@}QGz=sX9(sKm~-y?chX>QR zAmg2v2`F~qc$eWI9pWhWnR&elN+B*LhnuXR6@;=kMJxE;IDrP>%Zt;2pOf@sru|qX z8~2=7TNO{XDM>Yu?xqfl;+0qwH20u{O>SC~x&+xF+$WuUHbAKqq7$AqVZR@BQPbBb znDbrPnQ4k#0vaz;XUC-pF>OvTvollRkQYT(DPT$=e9I(O!XbIew~59v*|OcxRhGDB za)qwm*?79*sGzC!)j#_{&Bqxsn}gsShxsW?QBc|Peu6E6YHvgO$wI(Vev{ahtBnG> zV^9YYvd8PE!3mNDBs5G#Fi~+2Cl@6tI(pcC(SRRIl&E|V1;^1K%Fm~fj+q`&j(5Cw zg^*UW!ZjB7?U<$7>awV{ty&3BFlD<39W#TDSX3oPY{^1aPw(E=nP}qjZ8y3kPKX*1G zTyaO!zCl;`ody=?Tu? z?l=vD3gsr--7uo9SAfIgXF{!hd>J_|I8XP~Z2QkmG=GcC2nKTCcqCYs^*h zFL4m$l(D^H<>L@<@+BlzSq#u)nrJC`StCI;)XhZp*2!IwYMsPMS`i_s^5V$E^%D2K z5@DVcowOKEsT`fuCE*8=Na?G>E1H~?XqW4;2!cKGO2)4H2Mj534XdILnMb-MSO5SX zZZ91ilMIJVphjgZs$88dUsFCt5c!Pj^mv4$Sy{gCoW;15WoN4!6AC+$#tKrcCBBy> z)f}?FAp0VE>&S#}WFJ@WQYWH5ucI4K->V9!Z@K2`q>mMm^+~`rBcT4|5cV3L2a>U+#0vXaVxfUu%CingS>T`ei*Sb)Ey$r@nrabs+cf0>P9)gtCI3d zPS==p2cfb^FA|5V22Yqu9Fz@2iRGI&ghH95Tq2G_>AqPJNx|m+tVjyplt>Exe32Bq zsgV>a11X5TZxt=OKo|vYVi<*)Q4|WEP(<>26eD1q>p%+gcs6?lhi%Qw>d*L4IYlW@(Hzw6O1Ee+&yxE^ zSw-;>3ik3-^^23-uP@92P4Uex($)FAv%O01?CW-Ub%}yDbt+MXl1J(cS}?Kv1ulRE z=cuCRs_nX3G)v!xPn?&lA;~#}l<2rnao6oW~nA$aL1PxqMM8 zxg!BV(W6y-5Uusbn?}jG*f=11mvKOxBD$J&Z+AiiQ>nZ+)jA-vC0~Bs5v&4O|AA>R z%sq;)PZ}c#qt(UG%5~NdCtu_PZJAqM<&}rn6DJE})L^z-NP^z){B z`uWp5{k-`+{jR|a>-L?nexIh`SMDe>{$W z~Kl&i|e`Nqns#8!@72kO9!7Z-z^CvKpN)e2lz(pWPn1{jgCFq0FXJ$k@_)qN%A$lG5o=m% z*^FVFg(=$F;qapi5s0 z4%*zAGRfJnjZHf6(QsYh}U4p&KR8kb$ zX84;u5bVu1JDlIsAPc9+h;`dZ>IFTQmG_{H-cdfv$f zCa;IjmhZ!N@5J}@Z>P$M*IGK6^y*}3QmrLV)pFjQcuVEhPP`w^C$#g!xp$&omimB~ zf6OLSq?!IP^G;NWQf++s!#TgMXc}H`exA_y=4bCjy)0Gbm)vs2OKQ0_3EBYciEmn! zZ{YdTq~|9U&rk3Lw`ITJr%TmOPl}7E4>cs9%pP0|H&Y~_)U>9a^ovL*)1M+-- zb*u@erk4?Fbb>U`=1I<^yE7Eh3QSERRU#!Znu8kmnB#Lxq)&rpi70)w%!*zlXBZfd zG=-)eOxR$=%T10mrP3au`3BN4SQoenNL_mn6jD#v72ztTXAPW#;vyJxhumreIKo5u z+M}MDrd=$cM}!J;&}XQ)$b$aG&QUtGY>qa&A0g+=G~=&XT(1|vFY^28&Nu42bA;v))*n|_wCf>h2_wDQ4) zqBUUjq{!Ajtv){W^qgj7<>RQl3{wl+1pq4RgF%T&5b*>eViqHd!xs@sO(j9Tea!n) znIJ^N%q!&U8iaicot})lr&IFo(G5r=waKzqf!Dsrm^}j>++e@FPS@(suh726ZPzr? z^KU|Uk-*HCC7uGAn`;X-gEN;#Q2!;@FP-Rn7ahzgxeDfjiBUs_sx2rm3ezrC(s|a3 zSz0ivDpfrN{-XzkYe=b>M!1s7nGBE!Nw3On?o~%uETZI&%z9!G@2uQk>EB;DuDJ&* zof0>5uu{_+yXY4o7d&Vx1@>GRMn|JQSdmqY8Chg;#M~LhMb?2C<(YL<&0PGq*1@Y# zSs7ZUnQ_77%u_OYP6WihmYF9g*c3lw6;>q6RVp62(omiUAY1!rg~LC5sjCv4(+w-- z(-(7?16~%ijyO!}*o`Di>P!V)&$1w(m=4t0MXyA5c8tM51INI&N|5ka$g}V?fQ7&E z)td4p^1uB2aU=<`9xp{tnx#T4c9>mGOAKZgr4ww9QeoHobF zH(aPcF>Lzu{R)dRjs)-|+LkuUUFuG4;OO zUNv%Doyi84egcy{g-gj#bwxE0X94cwLH{1&L9cHtuiaT8UF9>y{wK`4OV`o|TKPO$ zTbp42L!W~E&)Ujr`~UcB*V6lp&;N4!pBd|ayuONz>DBs}ZvVC1URhZytUr{#v;Vr4 z&*F7{kY#=m<@tb&IaC}B-~oX9${oj3RP3&=Qh9BLl(C)>14m}~W}B`M8}>PXkKgPZ z_i(ZllxoNzdu;ejfRM@~(HXY-TaY z<95fsh|&YNE%EDNL{}sI7JuuP9QP7lQ=Jz7Y#{*ZaEr@w;Fxq#G(FP=;fGx;8Rx2; z0NacD=Gsx%8I ztwyAk?w2MKRI&rZ|;%6Lyr8jCasZoWzUDbBuC>eTo9UwM7}+*}LS1LXyDN)sB&y zITof#C%J^0hh0oP(}hs9SkVqi92=f0-a6cSxx4@N5K6X}J)9i|<7J;*3GI;jA7k{@ zI!(^-Adccs$wz$Q;VH32XGN0wzkb1kgRQ4d!aT0S^M?P}Z<|vC&4}`P?Jc@;ZoH3y z=qs|}7l?)bZZZDg|N0p1K)=Wd5q^&HIum#t=E7pU;19zfMgvX`C^?Q}R?)Z^fZ3(w zP?N)~wiwsUu%Iz`TS6KP*)6WJ=#7UlF4E8fJ_fE(uJP0k&z+?;IQypG=8>NQUJgid zsG%N*XY#aO(+F%IoIEJTaC=xhkUp-_#DUD{FT+X2c@!W*5jYuP;`|i7u~1;jm~ay2 z$|E@+XA&mp%?m4-gBgOS#Uv-30eGC%2XvB}(_O?|wlH}>cJ;qna$wkdwJ%%?03f11 z^nP z4C$xc?Ps-SsQ~X|nqlc(ml8%`A3U~J-W@rGzBs=C5-F!=Ll^+BN&xVIg+qm1SYLRb zFEqI;f8l++;7$#ZYC_o!AHL@ai?Qn6hE(?vE$k+$K)h&y7|P2og^Gkzme?%l5yOe% zQZ6K7dqe{*KQwQ7C9q0Uyjr(#^vNiUsZ`Uir8SKq6fE9B2jMxB9x4#<^#%^1UV9MK z3|#2BNvhm6u6~_VZotKBC5Cz9ws*USd2`OHK3P`EuEaauS21^My zR51|)b71y*Z5;Eq?y2QoxSuW5n(hG1CR1of_S07X1tbH)N(W?}i(v7FIxCP=r%{ii zFbzqI;HlY|@ttJjW2s%c|M>nN?l0b7Y%Suy_n*MBfD z@b0J65AWWjAKvYTAKpFhf4HAL*n=@-eR$BQEts6Bb(HxU3l#= z4>pmuHD@?cB~5c0GiEzsI14bG1sD!4&h-yx{&Cb>i;X8YG6umdUNRS-i05LAQXvrw zWTsiz4MgUgvc)|qJRVhOsLmCh3;(x+{UQfZvys?Ex{0`s<|Rjbd?BM3je;m;P9tmh zy+nhoiVHDxn;S716;wOKvq~!#cpO+0(b%Zz>J4F{I778Q9iRBiswKmJgd^c#zxLhj zIzDsV|A)X1r{|Xz0L-}mFRvE!KX#T^SJv+C|F`jRxt~ml>L~rr31{P}+j~2}eceUF z3weC>ZZE;ti_B=9g$5dT|ChWRdX36|3TYKj-YF^1+?;N!PE14K59v< zJgR_F1q32j#9s)&rZ1ptG>W(IRu<+oB1F;puhe`#`qJcKHVXGBdf1Y2Z=9rInAe>q zt&wHnpbt2?LCkTz(^+mzZ;i_(ju@4tI3kqYn%p|na)v?mjGP1KnI{~RyRKN7kI|^! zX=-@}45H2*!QJ)m_j~w1zka_57x>1Ek;4THNHqZBp1#?I)uUDU!y39QRAj-!J-$>? z-G9RtXw~peb?=^YA%@a)A%q*^y?gU@g9E=OVBxj^U%G*`ReK-TrcaK;9n>+t8{d=h zXkuWiXDEGFUjgH4f57zT_o@~v84lrsSg$?XeZKc<7cQ2jBJ!}z(^3azEa*}cKbS8x zCd=MlTeblyBAk18=Z%m`s7iD>y?4*4*=|$-7uKE%sTCFY;cQIZ4)$sx8`hf&!XfGn zEC>S11^L{7^tn6>dji_ifE=?R{Brwn=cfXI0lolUZbkjFfbD>%qX9c)YW3wp*p2PE z2))o+u!R;bKAHBawk0+Js9L{&@UY?6TeKsKqEZ;;JJsd~me074h{)P9R%h*$CwD6CZu#Q5+Lpqv~GQ}IRV0X5u6z+dkhRSU_?Szd0bMM|oYzLB&Q zS`UE6La$={ zmZcV*kk|&r(FOuF2+=P3G49(ZIHk95UPuFZOS);oSDo2nOHYyt$z&}dHYv4hf8VIT z`}@X+hYed`-ETlkLbdvq2;7D=zMgA%GkShd?%6sl6xNzSpgK##*wyx2yeD<;l)F)M zwA`9%>`$fEVra?b#OxLohf=whayXCc@L%q71=u37%J{0q{4#wtOfwX6*i?WIl@Odz zs9B*@WyTEa3kO8?%&|p3%@M9T6Ebc;Dym-97-EOIKriq3@du;SvnUOYr=a93&7`>G z_5qF~VMe5CBEphfep1#cR~$L1lQq$i@zy31&I}jZp_@1=n1Mr46}}kEptepzi^xjo z1!D$bPza#MxOhI|m2D6JZ3dP?`?dpmv=>pt$&JXAbVvy&EKM#W>ErqRRO0q1GLN7wt-5DX<2%D zVu_O^{&3tq9qul>o*}-{5kY>R&IZVg5Hvep;`NEgFUSA60R&3)e{XD^?=pxA=&>PD!Wxm;!gRB zD99Xn^5X2HOmf=X2x5r3Ujzg=Aax^ChMAPjPEA0c@s^Dynym84I^?h_^aq6;1|jSd zUv>Eo%YCRfs(Fa;7q)=J>n<~*4%>haECX8ubUp42SB%qdWQE)ply4CbFJ8#mi(_wT z-%L%7uVor_Z{WtfGVj{L-0sLoENSp0>*9IPi!V2HS$`Rx1VoNn{<8!p1y>l>NO3$A zU?0hU_WFB1qcAJb<2eRUft{NsS*Bo~=t#C0GV2VPF0$&xFfim&-c3G_u&iszjoFoY zG!3CFL=+_GE7{poj#ZaMRKDvHKm*k~NHY*9W@U?9C9bN4PsCxiS}pgELY%kYaf?l1 zm6(C$W0ff(ckYH^`xlV~&grUv}qy~&WNl+&b<$C+`15f# zqTGs=cUucsgiv)GPSUM`m9{^(W>8h3FhKsRFE7`=Cl2VSz}!rn$Oo<@<1VHGY5Dv0 zHh>H$JI7zU?hRR>p+KWEeQ#EHiRo=aV<{>47Ut&BMBNf)y!+MCc^PCQ87xXu)Hb5B z6lKXZ?-q=ealGSXaAgZwBCfW0cT#&iV5hMy+pz=c73|9`0Wy4VS_p)jY@Ru&RD%o! zxA)>?xm4x+O2by-$#P$LGAa^-(!``gEc)*)9(HxVcHdAMd!|uV7KCoz(OZIRGAb1+ z8s8V-%je#gn-Wu-qqp9mqkKex@luH|te8~G_2YVnP}p(Zgd9OlcTHpw#3t1-LPgG@ zAey!<_OT=e;=y!Wd8Lz(pJEOIKR656{2v$!UA0oqYII#?WhN)C;Y&mMx2xRB6ZcmZE_){g2^!!C?3uJo;dl)aS7J zD32(==zXF@Io%O8QZJpYC497N>CV;J@Wsp)nS5X(h&?|GIDa?rRFtpqEG~Ir{a``i zpJ9reLqD*5q{NRV;6+gBO9{lB*qhRX(Yyu2(vt11YV>iB)V)p44BPYvL1xig zP8Yl7*ZB+V7dY2#7bBYsw7p{RQ^hs%2ZpZAA299=6 zZ=~Y@6&*^k5sbr#tsoS7nC!DTVJtddALiXVP3U4OIe*7l@w_WCaHi814igrFNFpkR)qQ5 zfg*CGVD6^az%fQFBa+S0AqGj|K#f!e_J0?lqo7eakE%1*+76=TzTl34iiy5OOYayS zEh5AYdQJBE1Z2>Tr#gisI%Q%T?ygemc0hn{1sN4~@V1)0+6J)KzpYw6oEAw_T>lDqT5Nz07=0+JMFPY)Ljh%8 zT#z&ZY8EGDB--q24cs8<0LJi!Ph?O5Huu!!`P9>!0k5K z4UEU8L4>uuBF1B5Cp=IJ+jS}1IWw(-}a@uG2*lN3zDe0CSY*tu~DT71NGgno0 zhhMQ>0+{vaYP*G-u+-#y+_W!v);P$GkkZIqMm=loR1WCh7Ixppu_MygK}2!GZ3Hc? zhzxiF<1}e36<2kqx2aO2GKV$fl zkMyMkPh~IPG#STvrzru_1bIKB9}+fQue=5HD_Urgt~v|tmU32@eoSi4MqZK2ov;+3 zUKYVv>IB_H!wBUyWIjgd98dv<2_sZE=uXqdXSe;c;A1!*Rra7Y-MN^lmHJcLU&9_V z(&tF!$x^CGt>f)tJW@-?<(yTSI7Mrt2wqg^lHj=(^(ClSK8w&Mj0ij0QYq9*S?ox1 z9F_k?uSBssBGg(CQ(hH1F|Go%OF*J}?$&uy@S8_DP#&U`73!UE{A#i+5IUV%!37f6 z>RNo?1**(c!MWc(RW=B8TcJ2caG#(+*=W^j^4MFTP=|ff@U+G#H$>lIHb-{|u%$=F zcNWdp%0G(ToYJf`KVdkBjMaFxT4jBV!0x}#s2r}hWRdD?6AxY9(ULNR3OZ7Y!M0VOsx1Ar_ifB^;O(;bq44ym z2#cmQ_i9%e{~_oR(~Y{v zq|aW5!yx^LA>*zd{6P@Z1OUIq&<}G&_?{IVoZtZOF<|42nB8{a6p9ml*I^cOdP6a{ zV+>$7i2fPYxyJNp;~Z6cN&xbvG=G6ea~Q^dI=`vmotV?F^Vf|5ukw`5)lz z9sR$Rk4mhE1~C2L6Z}C#pzb0 zy19{{?q(yw?@#nCK=oVvjgMTK6WFcEN*$wf(b42@~sac6n;J4-tmeNq7yT;)?qqd-MW$)cvUTFnU) zFt#A2@C4L(l8W^zDZok>XB>J_ypJDjx$-$Gt|woYMJ_@KO7n3Xhl8g06$E6tMi}9aY}jS=EdWD&!(IM?G znk|NfhRxjZ)l`hAm^;>)HuGXpr3$xqLPZr;0Ayp)unUwj0h68|+vyn!Th)%hbkfx4 zhAV!EGAorPHdijDefJB)2>N-*vrvdDJp-{sp*K<*L~kwSnmQ?3DqL6^OQ{5n6U!(C zY)SK4DN(e1zt}{L2b71SkqY=P^s%sq{zC)Y-hHNiX7K;Oe%-kI=h35;PD%c=vUUE2pP3%v(=+(Ut)a3=-zqUXaOOlwld#Lf zfRA1ZP=kWFEQE8smvIK@)A2BfjlvYmTRzQEHzXZgW�{s;1`M!xP?r;;&1BiF@}b znxVgh{^s}YQL!NuE0=Q%a>-LHsfxmas-n7VXO(_Z;a-i{q~UOg&nOrm|4aWsBLjA< zEW|uY0r>bl59bAMhT^(o7rajyyvG2G z_OgKnhR;3*Sl}}S;y*tX7#9l{OLOs;PZgj`=u7Z|I z!dy-e-W{hYa(ZaV6H01qO+Y+#KOF`UCW$(twD9*cWtrY<`uDS?Oj$OJ(2(zb2N(Fh zm{3z$sa=!i!a*>?oc7q5KeM?^l`pbuH7mzQFg^+ECrOUM&jxsz$K}N>C*$aMV3!Kd>zL#FwC6lzqg? zAEQ|Eq>M0IG@G|8{$(NaVY`j-CKwC`WVI1~rsKu3Z9xpn>bx+xepd<4eyH$qEIJ{$xMhQKo{T)zQW2mWnox6g(p6+j@1UHtRV=~bc1tP z)!w7)7)m`T~2U2H@R6->6OFQt%22$rN&JrpDj zDXSsfyKrL@eiKuGtd5fy2%pma85>%`smy#g&6EFYF>jeL2;(nAN}L2^W-IIPbf@oX zWQQB)i?IAB`DyJ#VRI^yi`$cubD4B;G;f=`y>N$ZTL zWt7qx-H|L;62r}vB)Wb-412VPBMf(wlk0CL;T?L)aLCRfR?!RFfQH4z;wE6j zj1+SIuL9|&QiM@&3hw`Q6T3Osl~J5XK_-7rX!j=ryZ@D7je-!MzGtEMJ);PpB>2aX zj2XL%vWqUvgr$%ec~(qO9yv$%GizWTVtfzW8d1%$H)N4EO44CDP3XIOY$IRDeAJk_ zktrIfn=O$Z(at3=VE|i1URtN&IE{d0c1hBe4AAX>LIpxSCH_T}8YRFP4rw$DZzEQQ zMXoI^0nX46$2c|kiNR3EG|GEZv(=f%v2^G7Vgl|unauQDPsomwS1pWCw}Ek}Xx9V! z0PJX)$aXLDAETwz69*F5DL%Dvvd_+sWLAZ^qcQ>F1DM>|aZOV^JzN*4$RJrM-&Afq zcP9{5-;)@UmAUi^WXe=f>LVcIF}iYdZ342L=}iF%c`tRxy-*6(dpd=qn?hCHW&Ou! zlbwf)m^IaZ_n3gPh>P*$106#5Y;_e596`?J0u=T2T}PtN%y<8vA^#bSt}gzW75{I2 zb*&ixk5WS4$$xI)bG4;!7OHvBiwcl>ty(f8hm53ZWr0176E973or!BJw% zdZI+jfr=3glguudWR~qw?r8M!w+VDOD-+C2xz|K_R3VScU?egs6<-fA0AWC$zegoU zS!=I(2fJ_nvik;|CNd&wqNeDi?Q`?XaD8vw}-oL%*z^$2$fYe@AaF# zSBJ&shV-4{9NSVx`2Wak$xmAQlmY!wsju@tjYn%Jz|M_b*C z?&kW22zO?T$8B_7q-*<_3#0WhSBiDAyR)NcOPACpDtO(?8oG_s!vuH$Yp8YhM(+l3 z(JPw%mFYa{6hnQm+yxja>&7$+16SRJ<8~7fl#H3xhu(g46tycweWmUb8-=o@#7}dgTG6ue_><)^8bh0`Imq28vc0!Of~*_?*HpTZS6=@amtOn=*ee|w^ z$8C7_nhAi6J67H`P>8tUgo|SC?6+vbgazns_mAXQ#J?HMZ_kRcP*sQ$B_}|I(Q69N z%mE&9w1MePMzN-_A*hpC(WkIMsw`qte5RUIzSJ39?prhp45XTd*$7UWQ0^q#2RnOv zNaMp`C=Oh`Fzcq#v0QLQHUwI#6{&!tgD8g6OR$qeifP|$!uzb{`@0AuvG^s=Fl-05 zV$=;VW(5tNM*@qeyu;80DRo4R)T=kb%D^YNe z#3vWWz||YVz|}hp{Ex&y;N|pnS}dS~E?zDNVUK*~itI%ic0V0qaJDXU6#N>cF_hz= zg+y8z0FtvKJ|ybRvI6Y9zD!{UDCk9v<3w1YdrIRtp@G!wc)c-(oFh^awtFehMw<2+yT9x~OmKAqIlUEp#otJt`{vwyp*A260 z^3*aU73Jys&i(9td%0#cG9; zqnT5Yw(KF}_Acz{QJSC`Dn&WMWk|Z+af;v=XQ(Ge!_L&2UV&h>+*Ku_SJUWIV_K0F z$m!wEYd2(3Xbl$+0gU$Tiykhk0zJ%Q9~H(J0Kj@p#ZinTZ5@XphNwkD{1lBAY~rO! zp0$ivK+uXKp#-@#bz1Y|5FwQbH3Vpk24PNcEuBEsBzpq9b3PA7NkqJ%rYvkHtI3L7 z9u--!-(HTUtlTI~S(%%rIP;uLP%0*Tcxu6cm{G-q;`#I)t}%zvqpSviF%>jI9jDcl z0^1a}y^>Be`4q%3Dh|3}WDJw$t~&^WluwxD3d&-pz*Q7+D$$M}&Dv&O39U?^GKQ+yw8jh{DIfB2qZGa7DYJ25gYs|9k*R6JbhI*251>p0Qob+s zBGVRBp>(MnLER4x?-+Zjw|_ zr`RYgml#`xV(&OcE72la76DjXagzxbde$-G-o4WS*JwG8dVQT%w)Ru4)sjmBCc0F% z$v_WDGv98mv>UBfjqf4yK{L>V;85GSTy=`XgZ2O0t&d=nir;@PHk|x4yakIpIov&AP0(QM%2jYvV)L` z`in|^oB4-L{{^<0UK(;aFdxz|HuUy#4ZV#AX!BJ!yboi_7b9?u!<6$$dxTQ0U|Lif|5ds^lN0u|)gL5DS}z&yKJeSi%gbnI8~)O`kKctP zD~l+E!x7#fGNH!DQ5=w3ZDFv0QK2wSD*o!zuMrkoNccNN0U6PE1z32H(u09%AvI4E ztF~2{+xIxb-C#s<&3Xd2G za*F1c>=LcxoPV04iTO(7;@@kyei3G&@1=_^ufY1PG+K!)3k$znkrul4DM z4}_-$;|Djv^b~UjP3lTA3Ec)B!U+dK!#&e*M;?vbapy@iG9Br{YJ%p_FoU7fN4H7` zjZ;#vfL^$Oc=7tp+XFG@U@(|>_@dHmMAz_ZL7c?r!(@z(EAA);BSFD}uoiBs_g7jg zz59z;hd|RbGi+=c^czw(Fl+O_Q`k(;K2VPM!Gc*Tj#^kTaef2E6~NWk3g{g*kDA?l z(2olN3mEHL58mBhy8r(D2TXNOm{TZ=z49Y60gVQV%TPv}T?UJH&o4seCjiO&c!&P| zZ~FH&{d>RF&gjcq`u7$6TWewqW)ie`G*5aV6Gv)}%cPB?Bsd@OEc6Ya+?2KA2ljWG zNMn;ZtQhuq0z`Ktdk|hKG{=Mn(j)UFVt*@hmA|c)zwlzAMQGS+Ex<{(ApE^mUzo{B z_4lB@n?K&IH?dvh5GS_!a>3!ooI0BQEH+H|Nymf4OQt%+p-t@Qu(~6zr1-yLM|Mw$ zQ}S!z{OT_>>|qc~*DzPO@=$)B0Ldm-m0`#gOs=y9Ya%^*&e#H@Szl`?NhOg(*5mN) zTV2X5y^k~?S{u8fBUab-tsT@I_9_)YaF;d&2DgdryF>Q>6Nru@jZj@QyosYyRcsjn zci`4B%vWI=y~)#9fob&IX*dV$JX7dZPr=Ab{jvzb>7>DDw6V=n7$8qJ%`I9+<5c&^ zkWQqsz%Ice0}t^l4tA?aE50Q<=YK6cSZE5N-vYG$*FpxrF<8ph7sLvWs!m~|C|)d{ zq9d^?|Eiq9s9_&ro+9wbUHU431U{L&uL*o1wPDo`-$NyXLjE5ARE zCMuqPdMHikze$aM|W%VY%NPc57X!q1~+|v_*zB5 z^QblU5%V#C9qB$ZzH9+KN+L7S1ywrH2pmvS^u!dX~xMLN(QBX5)6i@iA(zZsEd<;v&PmCn2^XZL$VNdXKxsEPtoqPg(j7>p~e9G z>>OKmJYxUg`v)N#3NTE(uFBh((}+_VvKV)%z&B=(3owq?SFs#@XWp4D6gZwf%|7Go zvw0MsD}FxXMID7HUd{cdK^CsBHoYP{Pon`=XEEt7S^@tBrx4FF8HRFuuUHd%%ZI5@ zh5=tM^!)-J;kMwF;K2cuGd50pE{N$diZV@0%rZhvZR$zGMKX5se^AmF#S%o|U%uQ(gqJoJf<8a6jT+gn|f}rYpEL zh7p~f{~ZjY(Eq=|865T>qo#*vB5fSB)awV`2u6T`hZSAZcXJ_+n%=-0Pxx7p8#|)%k&S7&vp#@8Tc$kRcu}xr=2(EP?aRU84^bpA?Og=v^FWAOdlQc z01p5%K^!LI4Az0i?@SDnx5;{XdSHvijn?x2hA_iGhU2)&vB3Crk>j-xb^p8N@0K?J zgFm0QfXHsFv^(GVL>__jpu>o8O$$I|@N_<+t20(tA@)h!?JelW7I6DfDQs1!#~6;$ zR+lD1Ur#M4#)jx?b6q@kwU;`vjXH}V92q@4yR$r{7E=lrZ)p`1j2qi?SVxYe`d8-4EWgf_YeHP!W4c?5+M5H?#HG_a<0~`T+L_P{}l6n zr9P(L|Jv<#DgMi&<<6b__f|gFD+$Fr9Wq^43;;7l%&QQRqq(f#a?IcB&$;{p*)|ah z_q4?OIyEcq_3x$3{_CSRZ~h0Kw9SK`=|RUlc(#4GjjC7kWP9h&sD3pMcHg|& z$A~y<=F#4(zo1oO4cbRJ`p^6a+rq!l0{)?TwJ$dT{D2UMLd4=}tuxEs$RcR_PnfNi zjw7>YLglgVdQ(8&ps;W(kbrN>@gBaC&cZyZbaMFlR(gRosuP1}f=VZ6P5(4HImHK< zVVBHTp)D@g^gCA z1)o)2Mas|+c!W)MskS{XD{t`+U-!f?8*fxN(IhS`aC56uqoTfyp33fIuw@I7#V zHD`f-Wcgz)aa(>*F_bv=W0~z)+22V9G~x}70Wie97%MIj zR|*|#i8SCAz17!cYo;S+f&?K?a7)n;=sB4g0W|-bX)@iu#V#}>jtB+j?Xj^ zqhwCFKKCRH+P!U0PaE--4pJfOa)#6$P|0kEYVi85W4)!BE|@odi5Vu$x`S(duP=RTT~HP z(4t)xQ3r8)aWp8rl2fZaX=daiqFk^AbILn#nWD4{MW`YPG;oAcgLb^y@*L#Q+T-=o z=&JU3ag$>+Q}?&M!70k1i54&1hipf7W%5;gOT4l)Ez($95@Sshm6~pF=z&x?7@c6> za`d<-loRJ#1|X|rmC9RIBxvf)auJeO3$(X%N%&q{s8zHiC#b3|C#Z!6d9_lDEu^_MHg78T)3o@(1Ksd-q^H(J6(Hd(PK`e z!*_hP=T*F#+q<1S#|%sb&W2n1*OqqOeTttc^4}MGJG-wAu4?@Af9A0NeN@cW?V@j2?w zW8xnA7@Gw>swgIRldXTx(Q+U|^~-V2*^B(Z>q1woXGEoC($CM(>VR~tigWA%Bi0=o z?G2kw)bU)c9Y_t}kV*HB*ETVJP_KyNM5~ZAL@FjpTcfx;8242ADSSPMh7tEbx_Fv@ zCfZ!QYK_iGViWc8Z%ES`jgJR_8BNraLDR?M94#yHA;GbUy11nTbNCJhoUKUfRMqHM zfk?Sc0id~ni26M{<(PM#o(ah&(ipmAQ<5Ggm7pH~A<1DWDi1}tk>D}Ch{KGtMN4qZ z4(n=pf#-|5%6tR^o0wIVSAh3yX2Sp@gCH-krjug#BqWU_Tr?^23e#*s|3B^e2m8+t zf8Ktx>+c=-uixzdW$)SUGrzWd0Keg2{(0~4r~S8wK9qQ~{p#><{{C}+`_+k)AoxO*p;{a7DoRD$LH_tzy8~sy&r!% z^ncoa@oX0!KHY_pZ9jdn%U!{wc3y1ny=?l=wqI`lxJ$M6p_Mlt7UR+RKmW9gkFdXO z`2Wt~-u^3`#?Jn$!#D7=3A222sH^_Gcd*;^x8Lj?z)-#CZ}y>i1Sizkr$(UOt6gpd zLG3#$0!8rm+k;&*mS?-$FQBahtZWy)9qr`Z=cYeX&VT*8l?~#n^fBxFUt2Gp|BqId zSMJXL+xWbUx@m%kuK$;aLLnaHa3&@|wFhH5YM)a~h3D+v_ZKk|{jRmV{EhcIP4LjE z*M9x(>CX2%yHCGc{O;-M_F}vJY?k1jbGa^h+7Uwb0$&Ud@tJ%x(xN6^IT zch8}TM~~Wz-*=w2ccHQG9<^6)Y9c=llH*_i<@k$gS}o{K5|f#1AdxrxQ5vduQ0d;Y z@OX>@d-{tH-h_jYmB;dphv2kc>P<#d?hIyP_cq^>w`ee}?Jmaa-RbM${p;r_Ug=!8 zou}hy&}%JUx)p(gGah+%>9)+6$}P=>O>@BLBJE6u(R{7U2cwI%H5o=T@o^U|x3cIM z%^J`7RaSwI7i(v`*V~KdYeql$<~PPSO*#KD4G~_nuH470^S`}b^8f9uuiu^jxAFO- zXeIy1mPlQjV0(Y`8;Sm;{+~^XlanMMROcN zgL|(I4&l0Vbg;kk=iS32xI4Ys-TG5qJwDuj&CeQ3jEltzFZP}mio=sq;g@?acc-z5Sa}rFTW)rQ31_PM!;l4B3 zjV=GZcaKtvqLD0oM=`d1H4ppdYc}NX9yX;X!R@eESQV6vTKtQ65>?Fr1nSuX-s5pv z7I{Ipo1~m0fD%U}!(oVFauh;P`3=;W8DI=Q_M+5Z9Qjqywqd5;q7DjRSGQ->m{Gf; z6C1Fz`fTYswW{`C;r`Qwxh&8pc2D`#gF zoz%drj%Lk^8{03nUz(GJUb~#8TOB2UKwq2S-F=+TwDaFwYOdDDjPw7|8eH}Z=l`SC zM|bD{ZG0a8@Od~;&YxSgc5AujQ$z(g0JdttU-y!;Y_Z*0>(qXD@{RYHr35S_FjrFf zc6dGtw`w9t*m?L6Z@7O^O+RY2m+=7xx!>ZOv#I&x+r4L77q~b7IXpjuQ;J5o(!oY* zFuHq>Uk`#DEyptaWq#rh>6j|imZgnewvSssR<{ zHxwv-81_(+QT5*GfP7NsvGaA%;jFlebi)*cRy4LhhH{J^q_#Ozvnrh~C z8jAHyl0F049ph99=v(>;>9K%7`uN(vw#Es zvHf~)>*%N#b_eMCSnmx6;b*e+k&a$M)5Bo!2H*|1zpdKgo4332>S>Tg-8X2;FbsFd z7jCPzBJbq!3-(qs&);U@Yhr2;TD_krdYJ*v&q0bxsTUX--qd*(qN;p-^=Xv9hLHt) z`vauIjNO?tBtnb5n2i?!AS^fAs;x4{RWBZppkzpwTUx!zC0|7GM|X({>5%E%s{N_H zPx!}7YYPA=g|HT^b;{mP1C3o4DhQYyRDgvaM8{I}M+vH1oS!p!F`0iB0EpmrUOB8$ zPc?ZkK0Y|l@^EMdv^T_+*K1a&YDRO2D#iRIdrSk-ngX(yd(U3Xfa+_wyc6_yKLLPd z6;8v8lttLjQ}j*9hThILo?QIr@c1B1KSfL zn%cPpOBQqJ}8P1p}p;MK5U^=>yt%degNmvA+Fo(!0ayCbi6 zMU)%5IIhRq%ZM#eZ9Q2W=_=R1#99zAa_?mXIFTU=dvw7$5# zyuQBJ*)_Py0xYmzWS5;ra`ZJoshGk}xO%*d znyB5Ui|d`W=TCRnI=fGwKNYCV7?j#QRl`cVn^8B}?2gmTH6aH@0OPrSG&uohkdlY_}$9Wr|nLA zd;8gPd(yCZH45w6dJq2x;>L$2(r_YmriG9(S)=Y_(GT%s^W*VS#pU^ucwb0@}Ks~TFL&iy?ST=aVwvnPlJ3R^IwH$g~&aD4_wJ&Kl;2h9`(?9ClxI$ z2ithyzoo~$4L?rKd=(VMP|r31oa3kdb2NZMb?6_$xd*Ic)sTuaHIocKMFR=t!m+fZRf=UE#W0vO z8KvYc)du>fGM)R9+6(~V1OqdjKaW0_dOo8Br;_g32X>GHsYv2D4*KLNM-h(60v$Xb zBn0xOXyKZcdXV6}5^d!)==uEsZVIuAJ;kBX;9m4GleSfKDZBwBBMQ7#e;MRZ?#zE3 zrrqdMFer6n`F)=0h(g#50w_2kqhQLD*v$v$(oq!qN^e#GQ_KH-lj$4#OrihR68jTB zGwA!uD}L?-SW)u`qBui01(!=I_Z zFPL!zH!elwBAqfhhoLtB95I>i)zO!>9|rjtIKx_lLOUYu9U}pUo$LLCnL_*HSRx~_ z1HzpJ@^yTs?0*UHx^(3}Sjo3GasR`o9RIiTfBdy;nBUCL|MLAm$NG1Bz2hsz0Gnn1 zwZ8nQX#c&wa%cZ_E1x+7HX&PC5t0cXWAr8Q9hbxf@>P-)s9&8A#xxn>C%tpqFBk3CtVC=l6v+e&Q6Q7W#{2Yr>?9fhyvoN| zgK9dd79@U&&Q`44EIvk~dZ+2cO5s+pkNZ9RU&H4lZQ4~=XS$-u0O-ZtX)n7@@Zymh zM}wx@wP*XQJ5glB0~y0(kT)IA-in4G6DcI`!+d#u+qj^^__{cxg+FpWG5*n7C_CwM zdmlppC#A8U4wZobeai-h`sn&r+zxsMmEKbdp_*Q*`RcrXPnF(Zs1o@&yw3}D5WeqV znjfGZl`X{$P=BrDLxpAYZKR)(2}(+-Y*V%S*$>@eZwvAMA%+5ect3;xe|s7Z2FaFY z0P(5$0ms3&6vTRKz2-z{b3^q|A5GbXO`!ly+51hOV}eLn3feb(56zk?yb#@8$yGib zFi}xaF*?f@N*hE~aN)b+R%z!7S>gaMHpVgi;c9ZrG#>1_6k>nW{Dk;F3ZgWVFca1; zpiYt&Marm0O@Cp-UjPJ#FYn`pM&;6ykG$1CyT^Yu`aj3{-wV!B?bjW|`Q_MvS@OTt zV*aO2yR&+C{@=>ydShE*e&%PdMMSjW3+Ctu_$p(;m6JUcP?CdzwsqR4PTOBz-&lUM zvG(Z3(>@hhC&f8=LYV0faw6@{BiL53v1*lUYhe5$_6aa-zZ0ZglQ%GZY+-kLI)SMHk zi36jMv4DD~B6F=YJPu#Rv1<4&oZ&U)B>>IA^zm)3liee2Y-l!*X`~bK2AeSC=aJl z^TIJ9*-U1h7W~be7gjvIdz5Kq3;AZefB^NrC*+%6;Ej_Cz-2{(O}Pa8o-=5?3_@`X zipJDm&(t{~;5E-fsQy>wxqnNaIq83veoAkQ{;#)}OZ5NF|MPY}*Gm|u(tk;9axL^< z;Um-k&Ml__xG?>n%==#t{TCYjG>Vnu=EeE>`OXM@S3V=$GK%wGgE!Hrsm6_OPplSn zHC0BRH9rSYPO5$m$BIfvI#i+&9Vr{LP8hi<6#90f;NqcU?hD>MIUj1ffL+)(hlJ!3 z3_gHr^(ZhPr#g-Dq+aM9V`bV>CGIC0HH=8;D;`F3(0|n1qQ&Tq(f`#)74-iu{@<;9 zu9q-k==2>!|I4|+d*k6qlnJsOdz`8b19itt(5`$y*a&NhhJMQzga@UA0n=YOXT!bf zgW=u{o(fs%OgKjEi$nS&_y%+gE*}$!JG?Iuc9X1(~N!DujT&~a;QWy4a~>={sw9?n?Bw^r2_NC!UnsO%(H?N7k~cJT*Mj7jakP#kS3l2N+Z4eLEKO$*EvZ`r~JpmTe# z{h-%NF-&}2g&(&hEe+@iXoqg%mvJ}_RU7n!h^6G}rHmA&8F^f41c{z%gNP<8-%ZW6 z_FA#d7zoxD@`gzH@CS8PD8xF{t#>t`ut9oW^Z(`7^6+y`Uq%`KN$C$1#cUO|57v04 zRP$qJRa12`(S z3J?F092XzqVicbd7U5avf{x!KdK!}o*2PaWfRSsRlvlfl>WCg$Wka$8zw7iPsIh-{ zKfB+(Kl<>X{_g(ShX;+V`n&hF4?n<<``OVS{_Br_x_|%g-#(}}9zWUG{O}Opz5n5T z>xV{7TW~~}5v(ae;o*>u>oB-R(@t+;n=s(WqYq8&zo|EV9l<2F84VomJKo-6#b8ps zC|$RKh-3Lv0!5*YfDMxokUc@oRop|zEy{nZ_#k8C(hRo-qZUa7p_FBVlC-kC2lvqp z*8AiMPqt2~|FF?Cx_alHCJoXkF4&@_{?};|fJx0I-94JpA~VYrvt|8Z8l`qM5j{=N zE?hy;6s8RpPPg5r*fwNp*I)aTy8GPJXAb`F%6|7*AJ;{V*rhwT4*D(V4V z%rG!N#^DEkNG{)Ue-~dO&(4&7N~e5}E?Y?MCGl&hQpnp^ao_p?HOy23Sf7b0r!%38 zU@2iXmCt(^)<2Poz?s@@Q~Y{UnKB3*V@!X`Jq!q$xl>w?OpL>JXR&?9!(frsDC74<_3m4>-Mj0&wdE=a}YxNJ$osF**ijrRVIm=+lC|7tEOK zQDJqmol+yyP{E;D5;acK^eL1)>Eo0jK^~j1DyU(lOuxtru&f3BZp2a=n&TWCF{y2o zxmJ&sT9D4xwih6Wbx6e{V^qbJa%NI-ljA-F)}OX&v8^Q;A=+IcnF-G+6(eQp@DiA+ zLU)?2@}~?k|12B~WaN1ipGRr8wCtGcEbYSf`WX7hX%h6hn0(9(O6?w5a2W~uYQjw< zi1G~I0FxBNVKUAJgdX`>;z>c3M4obAhl3cc+qJk0cg8N1lK7}m?umRURJCY= zG#E2Zj!%x|BaCTE$iGTT$8-LN!ixX)p( zK8qwG8hV6=7IcXcvZ{Ur|G+W~5zET6_X4K6XF*JqAJ2-6M4i+Id}+ht{g@;@e=zQT z6o0QfPp_N%%)$Se)9sRd%(nksFY13fojd!lTlrk8-s79u3Lx@xNAZnlfiNwUD1US^ z&~GNIfWDca1Nx?<1Tt7lDxmLYX@I`DUKP+cGj%}UOtBLCrb-+1jjay)W`aKGn+Xb` zZ%_*HjZ&3t11C5f6;&}8RuFyTXk_?=koFuU(KjU(%^#GbFfqcUqVelEq;t0ZqFX^S zYHVO91KV2c8&TQ}Xj}u56xHavQsaE1O~krlAVw-A^!b6>_X@2MSibfy{Cb~x=)XDX zFW1Km`oFfax>ltBtDQUj&#io}mFOW6K44x`odCj5YKlM83amA+mfu24R`Rd@)~&!q z$=?>b-qvb<{MC`C9eUdSu6;qnuy%>$xAnV@;}c6ySSZbl(VnH|Z#NoJv@@${M;C3o z>Dlqxg<;_RY>WvRkx<7Ax#X0NVxQIds+&S;cjL8DJCM8HaWam3Ex@N)s9WE?`1h2?seG=hS{xrbr8eJa)R;u7DzCq!= zF%HjYAmnzK<>|PKfh~-GF}#P@jze&Y_c_Y3gqo0+{>h+h;fnNkyhYPS=QgU{);N_Hx1z(mH1G0(4`wSX^^<-iS6-NoyN9o-4oPv zE7%FM;d|5aTOMMr$~or1;8IXp)~ePqpU0l-Mpi>1lMF#DrCd6_*;Gd@};3D03wM-No%9+(J~{8sKhG~VIS=| z_`9L;fOdPuvktUpnPnQ_DXCP`KQhj{%H5kbDz7wVTi065BNP~p#u(SjkJukqwd45Y z;x^4_>-vsF<_Fs=om<-4@)ZR{HL3foB9puUjxuDzfr*@^6j0rxJp!8~q4>qtE>WW>d9K^7ORay)YE7n7 z>cbU`2adjDO{`UEBi`Ggo$XJOHLw0q(A)O57-_11l_w=MdiM>arN)u zGwuFo=jXgiAJgxD?eJK=2B#Q)Avm&YWNy6%UmOczM;%AH%_5{*GXvZNcA15zDq-c zbUP4uT|Dc|@fZzHFIMlG6W@fNQO0@kda%bYQ!BZ69WCd$c-3UYMtm2p$P&Jb*UP)3 zOH^WU@x?2Sdza|#tN=_dU1qPU87!$|lZ_dCk2$jp>k{_(u+#^)48P3x-Q{As%f)o} zF`sGj-?V%6*#G#sc>Mph6)1ie|Nj;~GuGd*B3I~RhWvkJwL<>CdT0N2E1#tYTi5k@ z@ZNjiD_-AEfde56UsjO^S>~U@sS>2!({pqWh(_Z9Tj)HnEWvU(=RZcd_W+(c)?Nk? zU1P81rR7Kd^6JLw^2VBL?DhT{XSU@1QDi6nV{w%}ed0WWQwSfKXEivPYj=Z|aA3Js6Y>h>JR(LcL~$L-f@c(O!brmZFFN7AEprPjku$ zsbo!cTJEVSB_=mv!*6O6Op)I&Hr|#{v`MD= zScja~Bt_r@RnA^z=?Bk``X&*&#V0s+{{HYG;M9yER)fp5)YvQ)>uOs=U6SzEEonez z8hf|=0gcBNju!kM{Kd5mf+ic=T>#Y1Dkmc>+HTwkZ6e2BCdO=TDaYgfyOqv|O%))d{s%02Vq3uyj2iw)g84PkLTYn1HP9uXCEdzm zr%~u9%FN3-`%wFN?jB6t$}TeUo$1#B5YYPlQH^LTKn_C*p^dT3-yKlj8qxi1!@r;D zdQN}nu-tDrM`3%@qwY5*%`l2TQP`&B7;oK{z4U_N(l(BCPYX6MsAZ(Fg&uDJ!Py{E zV>FEK1ens%jh>M~uh*eo<~tjou7)(q-{87R|9?%e!H}!FdZV!%s zCZS#voh8)q4lPLzB|OW|qU^dEdfHqM+_k#^4_aPOZcvh(>2_h0QLV8er&b$!88kj{ z7AWItLER3slXt6Y9}JtI$Tqw{65Lu@%lz>3h`b+b<$bKt2$h~iG=er9R>DdR_S-=Z zqB~z7J!Vl~O&%|V9#l)ChtlDR><7)n6 zf4Lz|EH0Y!Fe|ihlhpag5S>>pvHMzT=e~OT;stKMTiST;2D#+ko5DXL2AMbHA&>Z-$_LfteP{-Pdr2%{)w~@Ikmic#wjC}d6AQf$suZUFEp?t~R zZvg&+kB6}fahDW)`QN8MoLB#IdWAk_`2Vj~#Q$4a>)h#oZsYUEs2}&jzQ6tUuX``{ zw%;867qq%j~Q7gX(X6H5be6q6dg8Gst1aYZc9%Xbdbp{QQP=jg^@<;+UNE%iLS_l z#t=H6qMj&El#DV!%T{P&gJ$IW$_w3S8=!)`33@&KNQpx9OY{Q9hIx32IukP0DpF30 z&Ku7-NKeqvaV3AxA*LVU8$ z5EK3EA2aBl{Q8*6KKat}Uor+jL%0Nj=N9}i0=B>i#nfgYl)}mo864*H?)OSWl>Dwrd5U>!&vn+jP8$SLmrzC z{85-vtUnYxEYiZEvuZ-`qg2aVGK>QmMiNQSUbt2P&<61pz;LKaA%kyO`j4R!jzbD3 zD1PyTz&JG$=br`{1xD;g;h;zRJq)_1qB<~vLvdUhjG`^zI?$3*h0wM#2#Z+2!={xA zMkDggMkioPFC!|3Zjz>9HcB`iyV1}{07+;>MPpD6q3W%NL+8+#12_~1(Q(V4qNP5y zgHGL=lG@TfW7N>on*BgVjoRoLdeY77RQweiyQ+k=)ZnErh@00aUaD^Eae+uG)3#HpL}Xni&Te=$o!A2nfy`9O`>*XEM`b3Zfqe`Qd9r9P(f|DBb!m6am@ zk0yb4{QoU{uA8&p!{`x9`zi(na6f%C)WG8&xo8zid_JQug?)6Gb{>5#ldtKAsd*~H zy$O4-J&ts3CE}q#+{olzx8+xcfwQ_qz0q(BO!1JN? zL?@h-W^nfvnmLZr{1ij)Z}~C`vfha>q2Y}HpJg4CIT0`*t2fMB5)__0@GRJw6iNw=t1eLjvcKpqgli+Qa+7P2-ToS6^RGb>gX<`MYw)?4 zjB*3gPHA;~(}1A-#L6qqqWMJ~nJ%~5Xw2R)u$HXovg=L4gtoiVH)9c|S32(9>MCQ1 zw3#a$QAz}iDyfVHQGY04v8kd3>tT?7By-!k&^)Erj44(el-%1tdba;+S4;_+@4!Du z_%PUW=vS@g5YOWzb)HGw1=z#^#T12tpQ2=pF{o2)7my_z5Av*GA>j*xAhFOetZ$F) znFhU{8uGWtO=^X2n`XqaETkeF1v!cpGMkG0p?KDJ9E%tSSO!qe;ZS=ps9F0JTOBFy zhzAS)x8M3Bj9`vG2MdZeYEc0ZM?Ee4a7fT8tprXhC_T`P_--r8hK@)o4tJSHtW4S! zbObW?GyrxdWJ3c>3G~Bg43E#z#j6fC_;JQT#EC)=IAE!)v;?q2ze*-DFn-=wz7wo#WZE7GE;+72J1T5ZUFOPP~$urV#MbheqWFlx1wO-&7FEtMhR@{RY#nF z#gb(_v4j}{n(LE_Rf>#%>w>ofz#?)2p_C9nI%oy!LNP?)P8M7nwZVl&V>gJ{+nV{2Tu$PDympyzd{FLYSVvc+N(R z@E(%)iU(HHk3Zw8F<7hpVnOvFWlEsmqKm$2nF2l>Eu?m+cygM~~n=DUM0^ghitiDDDpMq#W zR>Dy%0BMrJG#|8H%BKgZwoV>c3$HCGI3E$1otEr^4%9Xe{OQ~0M|j@=Itx_`mj?$^mJ81XX>^Bjtx&9`DYIy`!$p-wOpn8VSSsU^ zkFRaoH`ixA`_HR*f6es&T3Ic{e_Vg`X!Xwi^EN)pPz?8!as8rS{tbwvu4Wwi0>`G6 z7LssPXdcGoBW9T0T|%ODlwH9OP-;)&(J20u3_g(q5V9RZB=8wUw)eZhO|jPxP-(n% z`Pm>jbDgksYSBziVKYp3Hk3ncNph+I=iF6!ua$FC69uwa2wVU#+1!wxzBrcbak9hA zR~NgMuOJ5;A28|<^c(*;>;~g3w1oa~A~{i^rL*81xr|{zu0Rxa#qdZtCT^C9+F3Fl z^yu0Njgn^8a;y<3;E(uhEQD?@G!ojQP zFT~?%#~u~K`qV(SHPJwry=~f^uWcY~J;5p47Q=czWE`v*0~M|tbG8eG;dM{bI=j#= zv=$1+&)V$7ME+4CYBU)wTTEKkXxt`tv*=euvaJj`s$NR&>*A~GSV%0=Fr~lR+!X^@qTfaEBjAgE)xKoV-!dla2B~+!tGgctn{!ekrot+}7<!vSa^{5a9fIYMj zR9DF6qcf%b<~&yC&Sjv$LYI^ z#y#USl-`ldG>O(vIFzWB6>bG*YArw2@+}D4aDh|nYhOg}K40Z?$@~9>6oNDE|I2GD z>!tfYyuQ2t-@@kx@Bd4c0sz+4d^i97pY@YF`!8Q_A0GX5!|b*GOyRRPwU$P_pTZa! zG;176()>Fhs+ZjVPfnTImKsJ$a532SX&d240@{+qR$=M9oB6h0}c=P@P35xMDZKYl%_9lGF8+LL*JwrpO~oNCfb!T1D)$p zxYJ<(J)H2*lWYuaz&|W(K^ZK+P(P%&{5)}9N@e~5-#w3UFd%9UoN0QNM!9$usym92 ze?|F%ajqnL2duA(ZRrZYo&WkpCIRcT^XKg!cg<^0)o20QoWgUpnpiK%S^z^71Ju;x zS_59VXGgu(TKWO;cC+TUT7`3^wlvPtCF*?%=tdeMbzNF(Enlk2F*R1WD6l^2;XXNK_Zi4Ykn zl6qCU->NmOg9A!&W3p`&DS1b2eDLlu@%8ISGwWEWf!+l*Mv0mtoj@(rr0!?_kQ^~W zn1wFJLxSEYC;-g}N9|LSFsyff-~8|pwq!5y?%nI^L3eS)wN}eHj6|dj1qBX-Y%M&! zpawpNCF^s*=zI6>^*6|c$gks@dt$@dh3~+_di;+(L@_NagH}O!_);xSNpwuYn8@IT zU|4y1=tX*@kfJW5cOc6G?MlePNNdMI&!iIjV;h-`|0k4T0b{YyMpgNBnrHy*-_IH~ zKI*vfMzKqUklZcdI#j6rzXEnHSj)+U8X91#iFb@FHn@-%Qb1w=Ooj}W{fbagoWLNI z4O84tHAGUJw$e|jqJm-qjeao5Lcu6$vnlr8ibe73s;SB-A(t6U zvm&RLQo@H{3ukZBI&t*(ou;$OP5+C-M7}vFx2;b(QsKhrkdw5$s8q3PVxka6N)h3k z)sjPWFd`dQop5w(SXCU|WWTREC+l^(EL&|74`x^^DOtC+qS=N9AFM4^Tzq@EHFG6v z4$G}p8qKSLg&zpa)KApeKC+eG7s5XLbJ`M&Lsfw<4E%*ZU=r26@RgDw2qEtvj+~U-= zwWI)~l+)56Xe#=Jw=#C!xapeemn)TFUeR!#jzjkVDJ`$!hKZyz(W z4LUBEAQcG-ou_y_J!~5s%~dlq#?F=OMajJaxlj}`3qy1-S4-iN54i)YLUrCl8mJVa zMTiJL*URS8;|dZ|=)ca(?~)N*Pyu2BQ4MrrT_wC?+LDy0~wudR0Z&3tC)|H9ARaFpL@{+H#omF3k^{+IU3o&N7O zKG*Hydq7U7KI08iKXELaFX4+qH)A8PwzT~HQs;Yrd3~eZ-dJtlhC8QmHMn>V7@5Is z=YVP5ToRa*L2?ZIAoc}kaMAy;ToBDS)AK3iq@}QTG^G$6Z4_2_N|9c21c%LORUWaW z2ZBmgjzlvnZPkG<-{Aqq#(%%oc(1`$Ln{Q7esKK>0oBz|V%bz(4KZ|F&Pf5nJRF=;a2B8lJ&NmsarP22GhrH) zH6%t+lp(GB6!kC|jYPCT!BAGXl~Qtf=(OcO<3RZwn5Y+i3J1xE#E}x!=%>TO*Gtdg zzk`>DuT`5()I?y+rD5m?qaY1Qz#HHtm&I&4?>dHJ$~o>*fU;XOO{2sf!H{CkNiW@` zNAar;Ps0ocqHlO7sN93;(*&YE2V~8IjN+r~UZ~T|&VY_WuwEE&vW39D24$xd;mNY- z2~e?;Nz@xrm_Cr~0B5LtiHNc8nM@KK<0n-?5@piEFw0OoQitzUyMZ%F27}}b2MJxZ z;9&8)Xs?FRbjICom~kX5$_OPX3V0mceU!00F&Z>6ZWO%bWf#w-UV>RFh7=IY%wA7C z@#8QvbC(cbI>b~BuX_5eMEcSaT=9i1jfv;ZO|jOtMuD&}HAV;+-IGKFQYXS#V>I=B z9Qj$4g@io}yo_SF%53N<2TYO>U^ttRVn&UNsnjIFvwlp=d>ozzpP;GmGqA3JHiPJ6 zD7dW)nrTRg z%FYtqTa%3k!yr4y6+?5w&_Y+577fIEVDH~Vqasfs$ORiHTv$3D@w~Z-Vk ztSq%x{pIgBmRC30YtDwf-q~Gqb1=7OVRwM>twrZX(IqgD*?Rpt`(>@8F&h`9 ztr(e$2}ixA3}VFCMA^FQ_o8@L1;pB2zaFw-mel6ewrkT9U0|FJ%5PinRF}v{6$SE< zem}_LcE>J458$=92C6E3s&oBI`I@75vg05ydDp#ai#q!f@~+HkWGW9=&Wr*L04?D& ze>}n?GO%(*c!zs0clX~O0*uy|u{mJ$0}Q~Rw<>@J8csh&-Oziz{{~BT$XUzI+ofs+ zaT1>oIaghloh2zSEfl(uSjITfkC6pJ+ZpD|DIO@SYfCYr#}uhGKEVJ4iGQAqQ$Jh; z26oW$-X83}LFX=9GVk^F!NJe_Z_quUru+Uc{SE!jYB#W~FMtCY;I)7V+xF|d8`+Fx ze?W#k#>(K=Fa8(LSP>9EfUAR{$N3V%mVX?n!rCNiZ=~mSpq7FFPE|CA!Ub;nf)lze zyD>D4K`PO*4J7KnawqW57dDc}xsKzMW2G&@kdG=yNyN7W#l>+L1stduwTPOvh`8a4 zdjeawHEiLJn4}u>Z5)lV)7Zd?s>yS;EF4g8b^5{p!L-k^uj&GfhE-aEepl8Ex;T$| zqpESNSKai~AqUx~iXoQ5|K>y zepQe82>Kfi;jF9Iuyn1-Tsq(+Zg>X;;a(hKsM*orytE3~4&Kmyt#w*x)xNUQ{?bt5 zVXTO@M(~i0P?YF)@>p=pH8XVDBSLemXfV}dsM8pv7y`+b(9T@)O7tuY?NjZ-fN=(; zotRLEj5M@G`^}AQD0B5NR5th!Lf^FtIEVK1%lIh;m>snW<_3N>SP=G>awn5zjI^fmsY(pFWA4?I*nRSD9aPM)tg=A6O30$fJ(qFzW`RuNoa+@x*ItzWCamuqsOPB|l8gdJ5EYIzGzZrXJa)kKbAw{(PxK z95&1@pbx>r!Y#&0RUIc%fnazkvDZ^5T{XJc{9hHiWKsMP2r%3@x_tGfw3kX|pd+7LBfx8BYcw8?=#f<%hfar;z^m2$V#AiC%iN;ocC!@DsVx3zNTGJDMJ@7} z^cE@wfVGR*AibBI#p2drRQh@-=ec!QhXVu)jj&1Lbs*ceYMd*)%SRs=qRdatAXXa4 z_HhR@EKJMAdRzr-VDPJ6ql0x3FOrLx6{6NO6hb4I+3bUXBx%yfPm*C5@vUV-n*muv zTKlG8f?g4`hizttHv^%0!=Tw5(7>y<&TUbke=d{na1`Pgf!R6yQ@DjvvJ%ckaE7}E z_k;~cA!rsi*0$ibp+oOiTyGTPpjni7IwPWD|6_)x>pN~PM)ymkoCb3-QqEOwl$3K9 zHYo=n3n{+>Rh~kQ+f0r-h8$mCj4^{xn)Safiy@ zlops)U;pN;-g{Fv$8;{Nd)BM>qI4D)2*m(!Sa2#6*jZb?2n)#GL-5b6?y-zG;>{Sq z@`VO)l7^v@TwESkuVr258t*UTs9H8;0}Bh)u9;c4aZQmuLN_x-8z=RwDsHA#H`2;G zCyrLS6`!x`lw-na^;2|mdZV&ZBMXJOrcn=FWDx$AEZ9`bR+uv!()u$6hjHmU)~pvo)3xVD4)V?Se}qX46XhTi{b zLgtMn#l?rM(*zS1)rL`)p;#4v;<56Wt zn1_D1_>}yt2?6^|c=S_)etlcK<*+GzzOS0;_U+BscQ#0gE8&)uA_ApB_ar(`ZK>Au z?q#qm$-kd92VY8yz!))hBpi=g^`d)?w?V(^wSEL#m@f|;T-WCdNRY!JxhgRs3D5B9QQw>b$idMy3 z9lzOB!@RK;4j*2OYFIVsD^m^nI-6=xF{T<^xkxqWX^Cp+rxU0~Utc!NBpq6zbV2Un zRzxO*pR?ZugcB&iuU|BrTXI1atb!jLk4>FDg{4u8ibYWO)(!Hy!ZAz0GXc-KLnXe$ zZ}t+KH`Ws4!x>9lEUm8=x`I5ZMhUA2`YMV?YH21)P%%acuI!)$Gg9uo#~C60D%^lj zwL^uJkSliDA#ThRXxKyEjKLIgk~P@+_hJpU zy3}6rmmh5`FK={K@2tUQ_k3+8S`$sM#K z8t0icF4g}JPkx;lCe4&?uyraC^(v!{9O%Cx5e)1IQ|&+ zY9Aa`a+yd894c%&HB>QoK+kSQdqxwc&})`28_7>EO7ru{b?CJvlm61Q%(sq?(38rk z>>#1+OPV3&p9e|;6vc;qiZSSt*hOlK3Qr`Q7sYSWF!rx(V)I1&?rnXdY{|{m16Ck5 z{q}mPQ&PoYOJ#DV#Ajx@wbD?~rY2CK5II3T75|~w5B2fHUv{N}Rx>=7rUhWaS_E$% zro$)>DDeBvn-|YZ)s+py7}atVDs>d3c@f|^ghr_@-r=b`R$n+PRGKb+R7i5&n^OV_ z!G!4nkN{RqvSvVo0U)7i#wJJVTy!av`p8>_MYGTUiZ#|f%!6Q61oexEjV#lMnLGY> zw9!#1)wCA1a-&#?Vs}N#gWB@@^nHx~)yjC|?AW3a-(RVcW=aMq=)#T~?iflvQgd(; z$*}Nj;_fG|-Stv`#~%SN+F#uvL3B(dcLWocSnic%{6ZHFVdgCdP~e2wHij=Sw))uB z%1D!FSE5be8;*MEbb`+UHqhSh7>A@W0^eE0TxwMxZ?grDnJ?r%X~Q`WKqeh zD%wml){JOFZwRw#b~k=Ibr{OZ8Ju3!S{Kzpb$!xkTQszB5z)Oizo9SMfJRhX;c$fX zmdlE1;uJ$0J`&GD@ss`-10`WI$bW|9nbZ3e#596178WFAi_%lr>RNtxjDi6J@*x{| zxW|&Zpepvfh9--^uPp+lJ;_gN!uhMZAH#68h~%VJZMZPmILNjd9FnOBuSi4N3e920 z#+H?|0bC0vGPo=nuXGKwQf25e`PR$r0hdSn<$mwM{TBS=*YEf6e~p6ui0;(oHnAI; z9JV#r?9_ItZoSCaF!bhXxPZRKK#LJl%sTOpL0r_H#ba2&xv^GQdcvC$?>!N}iuycV zP+5&GhB3$709-`6eTrsq<0{0KL#gJw@;IXY3eVZlJm)C?7@{P~&ucD@m-mN+e4ckk zZga=y>dpLH#+AsoX;uixzd^>1ZU zC&O#QN9AzSH};Sd9k5wRl|U;-zLjd4`G{n>kwIeI>@Ss3QtA9SnF!o|TIv z+owySmgG0BGB~i>2L&@4ruEhkJ1WCQ`Az?Dw`P~hLw>7n*G${KSepS*AA{2P!5AT* zN8Laif0&D;8vt4c;B7s?KtO7_XjH7DplCzC7z+Y-5o!MKY5}PXqkjf^%+77D_B6<% zE^~K&9hFb54msIdhPU8a5aNTDWeSQQe!VlwP_*4*vS5A&<+pE({O~;QNtJ? z7B&kN(5XQba-fn9X-HOKB!`u8k#V_X4aGN)e8Kqv(G4=A!=J{Ij?`!srgV(3a*1#e zmi7~ki1!}3|66DqV`+tbSPYlhY((|g*x$J-lkoFs5OpJt5|+e(TA5iHs5fIR5cE6* zvGBBwY-7D!ZIgfdssG)wxegdA8(TYGlUV{fTf@m|FIH)$bi*-_BUWQL8s|8X2nWPS z7Eo9wHA&t8vA`)Zkc<#e=D>=bRSD>%p&^l%EzYLm$gYo$dOMUP0sUX-#Y(=RB2Ag-oL<}J@!*b3vVD=)I8xW%&Q-I=jK zR}^D~%8aUNELeuJh&4*(v{(9a8<)uZ?3Byu!{6Me?VpI2c)hNA{?qREGfO4~A6#kE zVyuRm>Dtz#$Nt&`BRT=O;rhS^g% zLZK?g)*MJ}Ra+Lp)f2LA1WFh|rR4tY+!ypaygL}dir(w?*0&t-OKe-y9NQLFZpkil zad)}lKlIzCHIe5@bNq`L68O)YOIfC;C<6q--2I3V2m}8VgRq?$(94-sq99x4M|7<7 zcN^uV;zHqiRehA6VWP8SBr1IPg*uxv40;FO&w@B_Dt|Z9B}*Z+C8BUFmM1QhrZ{`p zKxE%{)oDEGKsORL68u&l4eEPA6igB&h43UwB(ajkGo6-Xk+DTdn&y;iSjC-lqg5df z6rl_f340EO1&~3yhal27aS7!JqU>>FRncsMYz>DcJv9Rt4`PB%s>LX9 z1aTEhpzqMrR<0PX7CB~0C&eUddL4k}*qy(;@yedeEvbeO^2}J6puN>>^B-#EMG7XC|aar8pzM_Im%| zu;wh39dn_~FcciST?#$T_h9NuE22Ev?440^g6j)kq$V1_+hd&Q{^Cr;n8JT;!|4Ad zpBeW5a6())``1kSf4B{;7vsOKu6OS2|8L`SGfApKjK)k+$aN&=`4WIJzHvBa$^X?} zURr+SFRyN_E^n-Tf4lj=>_>D$Tq-9RP3k`=BN)!-NK%>PNi>?0qsuL-eA6aWpo~*g z0~4UYttlCN3VTjrQmKx+EWknq!-Lb&!a{NDjV{iKQ0$yy*SEr)ngMxhV7tw(y&02k%3oBKCT(VZn~7=BoSaM7jQ~Fq?vany?*#?kScw!Yosx++ zESU*}oTL;VIi@=*@V%6a_5liRU=s&DxQ%7m&E@;z{mmP@PJTle`#ALJhU87C zkGzWFBP>mWHQBJJIRsd}A<(cnr=vI$E1)E3+yh{S5X zeO7}+ZS^Rq?hRz9`u#2Y^g~bzWj+Z6uHyTi0nLp0zxPlEb`dc8nsfhsa0GCjRGDqcG-{)i#f z5!noG-3l&EWTzEMAu{3Hcb&CI9~ctya~-+ph4;$~1_A8W*mV$N_4<$9G>!8kgUw6( zeY8gD)g~hXpJnBKOnVmHvFfV?n6$9h&VM1}#UjGr0o#Qx#h7P}uk@oZOm6}gH4-9R z5CyTL5(+l`(UBTRrtncVGCs$>dlbbq%1v#wF$m)$9{CY`C398cd+f(=R zA#VYJbj0z?AP^0+h(YwwMIn0R;*jpw!67Qxl)u-2MXHypU=fYwLTF@a%*3PXqiU5R zu-`i2d>v$2$b6*c6>WwxPv{gNQv`NSyt(Y|myosDNBx5b!5|7Uhdb0<(*x^*iaW5W zrrWEQjOf?Qh1xlkCm=gVxtjF4ba^OBR8)VHJBUV;o3GK-)q6C)6V8C1qYj;UM*J0K zQ-ncC9H^ANH#z30c2V0kJJU&0#u}q6ONxhdUky z)*X%vuxk%6(zBHV2+I7SN&;#%&O5n49wtjPs)|(|ZR%s9O-vSr8u^Dk@S+^V-3BGm zhTFhJ>8JX@@^we&^&)_pj6ZrU-DYh<_{C-_CoJ;YR|l_mcSLe*!$%{r#Re-xa00i^tu6OP78c?eK6uq)UVRv=iDt?*^%HdZu>!f@74CRXK#+SU;RySUe3j$NFLl0 z)f8qD1@XWA)~}=*#oLcXH0B@}Gl<2-3B{F&#AOJCA`UJb=A#W?%DbJ>w|wKR!mFye zN;AC>dQ8rtr8x+Ke-jkpAc0$Tb`DEF)VB2^{%2#@Ea61tXQ6(M=}eQexaIF*l5?m5 z?F@tTQ#eS*8QR7MXh4ld{1~eyNk3-n3EBt5Y+W;L`D4`Yg?%4)#?kiS{wpIHp$%XY zmF}onLgXmcw?9p4B1+4&g=FHG|8)5e-r|-Gd5QU{>;qjLz5TciMpLOl$dh%0xL?PC z)b5X4>i_pK!o;@${C5ohb>Y7r{1;p3lcG7|vj4AtVW(RtNiiC8EYltN54Zf-RDj7A z%g{B$f8ux6*07;t^R;Wf_V{a6T?CayHE4FwX~5S4|MBB3|GUl7>*MLKyVGCyEQ%4s z)-DiM+N2dynKmAtl2-mJgde{9eC5wP_MfL$>|?t9=W=Itty8l9e6)OL|9Kl9I22-i zD*WVoe}o_Cprd|&ef!WuJX$3rax?^N9g?dr>OV;+Al{sIaE_#pr;6PVw8OX!dDM{@=#u`p@^#IA7WyV^$+{Q_s_Y z6P?cI{*j3Dha3{i-!FB(_m|f<+UFJ9>=cKllSvfMN{ZPxynKe(B#PYq1}6^UvzK9VKw{4RsRjP5qGC;C!U! zA-A=~t(nKr9)=6eKi`O8d2eZ7JeOJLc-@Ae&Vim7!I+47wK+NPv)xk?x7o6aE~eQK z+1rK^61WmhRb=PI{=x1uU8p7rVao+2z^N%I42V@!Lj0H_;}`=}#tf;NSeT;K-Pb0V z|6!lm=l@l2|1;13)y`VU|FaFn@6P{Q_~`rp{?Sk7hJ!!8I%i;C{CQx-+b>DmP37?O zhyuf?fD_OL#rq`9(I7YvQx4?;6fqc*^cqK$(1`fX4R`ebFXYrPCjO4kokpB{c$C>P z19E()0J-CSKTKO)N3;=)^8^jNx)cQh1^p<7z+6}A!Yvau;)uyzv3O$4(2#n0chowC zrl2IogZ4A3Uv(8v)J44g8}hGJck>AsalDABQxl^ZkTx-l$3r=}3TsE+ah+^+T^UwTM zX2DKm&q)+{%A=h)EugOP2qOiKF;tT7md(OYh<1FQv$mgSg9Jp{bX$0UDYB-tKpC_! zYG z!}#K`mXJ1_kfR#hCrNH^=wc(%LhpJ&4kV_RMre>r$4yiOw#bZfxTYKl;nA?(oCBYi zY=B#LoK35yyPFjFbsc>bvg;@~POfHMnl?>Wax-uc>kCb9Q_mTH`42|)?D}qNn=@}I zn~o4}pG9zY%>T82X7K+UY3YgyV5jr{?MIJF^1nyRD|h_=t$eOc@_-*oP;>aI-SHRw z=g}ay5?e@$0M3ktLFuzACV$nKNzCj@TW5b=ULj_7ZDY0bJI?-kBhl<ps@=ePFaiV2fHArL)>GwA?w^`e1_DI7eRj{g z1N0NZK;Mh@YZEJ!f48V)9f~!5V){bNM96U;C{i0b9HluHaI>H5r1O;e%D8w*BtH`? z7QR!{=$Vt8)u|Jex6AZpHLWV^DEAo9`ZS1WzQ@q-DY9@pd|ZFDgM^7esXELZsRZD} z&(YA|NycYk3@qPCqdaYFunt&aM39TNWQI_gosXN{@?re%sPu>80IcSuFh!rJAbE z1WhHN?Sb*%#fmxGy}Rpd57>cZbx+pX&$B+NLTeviGZ{SKqvD2$tnzq@eae+3tVl7ushvm5#0@XRWv)^6L%*m#g1&tXE2iK?ExHe#}Bta!ItFlR!X)Vng2hpdj!949^clfRj@F`8_7mVjDzuN`YAj$i$)& zj%kQ&F5%+@SaOLO_*9C+JcDm3VTUtM1!m@;&4zbujI-V; z>N^>U1zx&?640#!dqGj0j8Bz6EHwR283Op3%3#Wftsz(QBzpSduv1z=X>aa4*}72% zWxp;xOiYqI87x*oX=HMlA{b}#JqzUl;b$UmiywW|(qs+=a&ygFi#LL53NRkuEF2VuA@p`Ybs?!5QaOY@(4nC-pe@&q7Yc z+=Wi!0CT#`DQr+@OOO{u4a|r+M-j<#b~zLcB-DPL|Sp_6;0zg1wj3hC_K z6|3fQob}L|s%)q$d}{jnr0WXKt8iI?M}--gi;7~d94<*ctmGpL6VrmT;)NytI0+D( zk1C&bF>yeV5kFeE?O5D-2~?A=z-2&O_4->iLu-~(L_zL7xAfYXliqw5FD>;+?Ow0I zpUNuiqL>+8hX_T9 ztEqo7ED1^icpZ%% z|G16M4MZ?5nsWQE!W=E0Np6gWdTFlxq0!BF5X2|r-~`RJZG(>oerJ8D-Ck;c|NZyI z9()iTr$Ks7&eZ{CV8;U%(7WHKtbhr-GKX0feF_IqEJjWuql3hcc^uvYZKL}s%Flgl zLk~uersb1aHa#@9nAn4A2j&A!87Jv}G8iOhY?aM0$o%csdp=wL4$d)Y+c^RO%}j+0 zCz_TA*+(=IkK#`p0W$*DBFs?+A-CSk>NeVy-DJLfYlTzb&kOaLc<&gWT4xez{ z(0WOxYix*UJL6toFB(j2)yceW{!%o64fy zea(1VYl>mL`w|gY~0*CRisFOSw|0r zhX2CE_s3|ZET(h7b2HF5fW}8i31Pq_Hn{ExfV1hX!YYiJ$DwReCW@iixrCkkMHM=RJ4qPC_SR6Z)8GsPpQ?b~!Vg(<9tIynWRf$I{IMB~4%tLJ zeK(Cpc~+QTX>h`nRSnM+GqaWA(?_db6_V7<&iPk);xBsL)W z(87JPiNWF<>Ive!u3^V#yuthb-146*gaMcp|7T@or7Zusi~n;gALajV@ZN+0u%G>w zWLh+qsbe={hr@3F>Y2do7F5=?Yt6SB?_S?gs_TL;(k519+j{#2+ zD1vT^VnrCnXE}pH70e0Gh?}}YmUkxfRs{|iL--jb0G1Hv`UX-wgDqD5H*oekZo(G5 z`p*s6cg>#}=RY#NDCWFUA2ZJXmDT0tlK<~o=kEN!jn5x>_j!NxU%;&xC070DWXxet zygz#C^lG)1_!aCoUE?R%n;b_aPAJp?Wy?8*V;X&K&ht||$&W);Igsuq4xvq}1tp8a zLh*^xjW818X2;U9rT3ry_rb=N|K7W2&h!L-Dyc2~5NR!aj}rc?1;F$x8L`HKi^RH> z?ufsj;Fi9KgqXgI@Rkec&Zp002;)+dc)9m-S7rb$;2Wwwwf;DcKKpfL#zDc7C4_MU zT73Iz@2{psd)iZ`>wrpuXKVu#J8dPN2d5lxP<4U*!F~gN&?NAy=h<(payXubckfU2 z7tgT5i)YVYZ2x%B@D~&RPybac=9v~ZRO_=EunIwSf`L@m@R(NJDrABFMU;^qu@}No z(+lHn6lMTn1IG<5o^5r_*HceHeZ$0jQrZFvv*c@qf~SyaLqxeyRB0eQMnVaa+?80# zRv;*+C0{KU)Jv#Vf_2>9tR3Pg;%s))1OmMqvM9JzS@s8dga&pmTO^Y?3iX7PWtd#~8XbpCI> zv$C>U%Kxx_m;d2bKG!YR!7XW|H#3tvIKmo6HkQ+TC)OhErOvXy{Ai=IywO>?rQn3* zV|x0;`|8FR<~<*uHxQTlSrRYg{#g){@l>9ojdhrHgHcGqxq@!amPTj>lwY^)h6*yK z^9N8ou(vy#t^%E&?!0;Nob<)D_v!n%R#jy8e@vk*DRuJ+r!8ZP)-}V&($^sZ9Ek?= zES+X?VV68!U!Ak$IG(@kFY|Ukj^{4=%V_>tg~?#flD#A^$%~|@L>R;pSgYGqPsq=( z$*Rex5|og69@7s+vIBr+sIjfT-GLJ8s{q0v3r!(u58l9?BI$)#4!Xh86nWP42!CdD zXxbVDJxOM9#fEy}r3dAJ;g^wt!Y`xlAi&fh{G$jFDgVnj$yLYm4EC4N6~^sx$P~)ZGp9_cAADq$DEH&^VhoS`n=t_TA4K2Y z;t1FTws7E4+>j9v;E?R9cb&EM51Y<&++KX%Ew?)>t843zzWaXr>CUs==QXz=??h>V z11JB_>!a5%w)b8&efai2Z}$&(pV8NyH}q%k`O%B*gTtEu;8Pe1toe{rRf;N^pN%C<#V#_K$0(AoG)7LtA$s9#7DmIf+v@yAMto@O;x0^`rH;=d7 zlw$4&gLD5l4TF#50m?W)p4F(r5N`{4+zrqn_ftq06sgpLwziuTjF7n6rvDTU{V+bs zPaF6Oy;lMtQKNH|O~Je4H2Fx;_f!|;*8;q30z_LfN-tc zAwlbAKr2oE(Yo34nh#_)Q1AJW<(AyZ@gV4aTs%z%p^nzy_v?S4mj%mA2{yt@hxrH4 zw~%rWz_oQ4QS6H*CJn~OqF9D7*0x#1rU|T%70Oo7FGP0B4iJ+iV9brPC z1FzLE86&Eu;%MMl66)s~P||tH*s!CF8x05%b`+Bw*G%)%_?lfa>kP)n1R5uwyCgw+ zPy!__IXaFlyiXT4N?ykVwau#1aYbnwB*0wYCqpbjQ5R>VW&o65SM;sYCsp}W%VJV0 z>|aX-=IHMdGx$;s0)R1IrA&2!do>6a7iZ4h^g|6jd}wF5mM*i?G|T`vbr&_(%)Fmd+63l-`CR) zp|J+)y~FYkAL62QH;wNA9n@R?icNB`N9g(8>Ibudwd5DA9{f+iU~C=m_~Azn<+y#f z{9#ibJqFzTZeqFioaH(nHf>=KjBW*|qEMAff9o%QUg_%=pFG*}*Eii-olDhfU#iw} zsg?y$MW_`!qbO~iWmpYrqUo<%G}q;-oG_Bi+uXob+>JSn6Ye9~I>ffLF}gxWZ9v>d zaOU_U_yAHst-lv}ZJ-W5?IWb;O-azzByO6vTR36EE#LU2nk|)`XGcxl4QBhG&<{Y- z^qqgch}V*^G{m|V6FatD4ng&x_7-dwf3?8XTnbO;!_`aTD}D-m08OqleR3{A@GHvx ztD1UrD&}?J{r>xbWhF0Zm2n8fS3Rg#=RBxYISL!|`#GrRQhLloR`6PQ5+^B!vIe|~ zdPcRI*%wN~hIK#qPk@DMxaRjL5SwD&yr;#_NneC<=}DO7;)H@vcl=h%e+SzS{&* zrRMXqL?yB&dg@7Ip>)oy+A+}XGekDDHVH6TPmc!=>>f&pxrg2u!HUgeD-@81BZ-}b zI@R9|`b1B)oDfq>Lye7`!J2J^sFC)X#T`O>#o9zRU1vP19JUPKCP zF9wTPGoV?R#|&o#TbE+8RY*OnfoqKzuMJZMsev<5iluw0Kftxg6EptBcB9d_u9ei% zUA?9hUC;u9TFZ$jdLzp?pN!91RekJOjoyaP&pkdk!t$KQhl+N1iwDT+6%LSFAyjqplT&|v znSNG;ehv#Y6B3-9vJ^ys@{)WiFeg=>)A7Y=0KyT zo)zlv@^c4FVa2oO{Hz4KzJ7iK$J0I~gp?re%GU-+JISVzeBb2OpJjw^n@uXa4JErn zQQzj|*J794^`AWPS3k^E5`~$|&#~-{s1uYv!6wD5LlDj|8>0^481p!xQ5_KJUKk8G z?*p7;LzIi{$KB8_-;|7=D%QT5lpN08Bn9eD#(2Yi(dn6+9L04#oPWN|CWqZ-hBD=fg|Ri>TiENL(}3(m7iE6Lnic_FWc zbk2}sLApKG_BuhQ2Xv(Ib1&D=1`CMAk1_@M8|437eT+iEkt5 zuPYdalNmNiZn+)6Rw-U6jSTpg5s82`@j(ZC`lg5}$trlajWfQQr{QRT#NRnHF?+>0 zrpy!Dtt$(ZF~bInEmU=p69Wk!ALs1D@Y@zJ7af-Y$!#nTj5s-R#mPkl;q8c*%N(5w z2M#@$4ptnC?cbA3`l|BilFU={%o9YOiZA}nsSTMx|4y}rN`!p{@%1&W1irj{LpwiY&Ao72fx zB)1$=<3Yr(TSg>b_S;fz&UX{4zK|F*KH<%QS%Ce4+zEv`DPA6E_mvIndgbSx41$sQE6cn=*YaOP~1y#VOJcpZF_ngE(jz?zcOS8s%J{7rB(( zO11!-n`R_(e0XOw(~dob7$;tq{Z-Yk&i+zMw`pHd!2si`{YLrU|K+Ugts7Qcj)ncY zT&aKCZ0UcbO@&Kgb&v#`tOCI+#Y`{}5hT*re?m+IvXxF5`_T>>b@^n!jIk~@WYlc) zd>onyQDeghPIo+gID@GYlx+R=uT7E5lQD-9*&Ch@QxISt&Kt~>H6t+F|K^|!7d}en z3a8+R8~=ayz6CI@s!TY2H{sP*5CqiQDM@D1$z&!;TS(f{v`O1wnuH{!yu;1RO>*hX z-09pqNdpvHKm?y4sEDtEpt!gSvg>ojq9~~UDlDk1Pf%7-R~ONh^>=^#&-a~k?mg$; zJCCF@X@QKA&fI$*-}%mWzVn^$d=L1PIaY#uLxR)KVO#il@9!!dMxk(=f@#Jm$lLb@ zpRUC?3N00gqu?O`{@JJakF)Hd6yU=T3*J7(@yBL${IfLtmt`c0?XX3lDV>V$H3_3l zxj0StkBhUoEdhtr6Qo=MHll={K(9*J3^5x+1I0r`*#!-mIl|0{6xV>BkGSP9WioZO zX2+it^l3s&88vBu;h~X*MA(>In)EX=MKxY9Qm zX8$T=mpyL>`MDFaEC4*6@KOa$5NT8ed4({`5pqJDqVghjJTpejc#fiVf(*{deI4fl zM4Y8#a#TSyy*6XLn4Ozmt<&=42sxn}In$|7p_EOUk+dlw7!QGxgKLP$(LZkM9z;Qa z)M0S*AgQ>W;tjo@5s576=dmUsti%P2d%u)k<7VS#IaCouK&D&KbgtyRIucKwL?2F7 zN|SLnJMl}v=+&0Q^ZGniL`Aa2?}{;(*3s&$tFK3(Z4_~t*bYH=4HVj)yGC10!mce# zQIu?^IufcNfrVpN&85}Uh(4Ahiy=7`QRq}ZV>Mp`?laY-g4k|a-97^^r- zN)u09V!?biZtYbHBJxOf`&}_))aq*Af-J?3q@~?Lu~_ zoOAN?N8A(e1dknxAG3~mH2CQ}C4&eZY&Nmb*-A6y!d6^$Bc!U&?GCTk94aEk+lIA~ zdSNs0)!om!5}mucn<*d;y=_HsZ%Sk92O8m&2!&{6B}0`WZjP@;^7n-1#5Z zwyv4W|1&Eeo@EvTQg2u6(<1*}?x@gP;1n$;3Cf!qh$i2~=;6SVCUm&Tby6Zg#`+YY zUD&7cJI}*89%LLi+^7~hH$nz5147~ACN{8ji_#ozT@z8d@kowVlH_=Sgilrkcvb50 zajFgg7|6Cau8)C2AgN7gz#_?!eH08T(TGNOU{sU3H3df~-#kY&A9d`Nn~xeNd3Lf< zi_z3!7YJbAF*ye{7MgMTX&Q0<)s=agN7;8F!JBV-I^p=GjLnS8%q43+VxLm>fAZq6 z`Y5vhx2{>U&XfPSc`pC+tbEGGH{es#*yu_C$S&O>#8*;HkLA=cEdr%Fa@M$!Z4-Gd zJl^8on@!xD314nK3*LLTQP`s02?Lvz=$UOTEp5$bNgHW-hg#<5$lyA)coME`n9KuW z3z2XDjZ$Xf^7c#fOM{^%Ih+k|W51JDI@U}cWVJmxopA5~J_v-^YrwqtmL_f_tllo6 z8{&K2uwO8hv+$BWAqD8TX=~&spoCgQgzeap;0u^lGh{0qGqSoho?@9$YG^??ZC|;s zhL&bOpgj8uEylAN-heqtNtix*+%Qb~Tu$uL>;r7?X1awwq1ARUQapH>ax zyO4MaxG?NV$50!f^s?CoO4z+%1uT1(=#B5EkA# zh6L$^qYj{OlR60NML0gPLIY_%8Ms7*2`q3?fuB~iY}UvI1G)6>v@w}hc572gFaYL> z6mD*$MPVn81EBzz+RBy;93epg2R3N%FZ>77!vqc6^9bW#;e^<8d{I4(osXXRHi{+0 zBeh0oy-0j2PN-^RZEIKw5VFFa?55n-pmL*xBDG=-@5w;BVSBt-36y?;5j{;r-#`e- zHn1VuxgpvSKzw6v%8=inxtXUuXhzF38#G4A5{7LzR(ROOo27$ht-6*2J!%CpaASxo zt!NlWiJa}HfGbMsyw5;=eZZH1SZ>y&mS*icL?o0#dd^2y7|#Zo2uCq;h>PmsqDaOA zw@$;g!%c|T7c!0O))v9jWH!T1a~xAQ0EzV|OsNC|f6o@SPXS)y@a7RsyTI}Zt)FaU z`7uUmMTQ+RC1{WtGFw{UbwSx8TWTRje9j9-j3FG0^B6}K@-hR|ilSXW8VD?@UqM|G z=!j};p!r)Z$nPl&BSABgVNenC(i{tL$Y)1!9_mS5&C2<~`ADRPgnL<7yYgA7O(89H<+4(fQ4X7$mD1oY#vIpWL*cNJ8KxXX z$(YP^2pB5;iV|bHPirHDIy5z1j;5yBhG4*iQIZ-a)FdyM4$WouB+FY(CNbMe)*wO$ z;FYcPaU$d<%Wk{Ir!u8k<1nAJGtaD&$52d~V15}aUdZBsN3_BbZgWHJbmGB3WaM&w zmWq%Qjcg-A`f1#V4b|0wJQ`1Bobw%hBe={Z9cKuKaN0tAq(cxE_FWXq&Fb(lbP_xBI<4fPEVZRrmy z1-r;Ud%Mh7!LMty0-qh9A-_g^3UYD!8gpszgM$Rg8cb$E`Lj!#~ zhq@>g@ZLtUhMI`0W&vh8lioHD^mTM@=@=Z6d($(+DRSn~p~K;%VHDU=rZt1z{qTKw z$IhOiZs>Kmr?0PH?wTAf$dW1EA6fLdI64AB0M(@4uK0drMnWTjidG!Zk8a{~w6F^? zs}$I>`NC~Mn<#t)&A_9cogKqNLmiuYxd;7Hg+dxs+R*zQA%c}TyfyLVgHfZ)Pcm(-~#oG}_q>Y)NF z!m^UZ36!PLDd>XLLianFNTDJl(HRZ|1tvBU^4&WWvQrF~A};zbZlR|C`X)QZ@Q$t> zo4W=Ew|Dn@dQT9sg?C?p-a7~S`aRv3TW0KF=Z%WVjOCQ?WtIt~oYnRKar!aMBgrvw ziGdh14UQxGCl}#3?Bb)|?kFG6VJ3c>HLO}p)^)i;hjE=n^i+1(ZmnqlJoT3dfS%zJ zUH(k<0s9PJY0TIi<--ggv|TV_0zU!PJWf!R40iW|#5mm1dw~EFlhJ+g7-$F(rd20h zv6PH^8;sI%FAUL(dw-V8Ruo+m#TYGHx;2M$1ok=k3Z6TpMQDID9&E@D9@d7M%6d7{ zYcWezf$p51lu?x&y=*cNa3$HUdM!g;yK+p#(cvo`Ji9H|1kt@#5Oi8XGP{!*9TY6Q z?M{mZrlzcdi1}|Yv%O7v+?1!UVZ&T-F>}-!`p3RFXzb-*Ae@g zf~uGlLTUgKPte+oZo|}`6XNSYu!<>g4#j3nWoKtUUd)nHy`PPyP57vZZe^P2Xj60@ zT4_ex)|^#AO|;ic(|JHg$V@jm60_PEk&Loaz(+v#fhlD|mxbyv;8ku_7%)fRUcm;` zNEHx=31gw{wA-!IW*ai}DS+ZuP)TZ{QgjyW)6zM#PfG>WK27aV`?Qoh?WHRbW(xK+ zj)8e9715@&&*+%eKBMCmB^V+W8M~Q2FTYAzIZQpUZE$+@UA`U#pCbFesU?XBet6fv z#qNJw)~xZ||B?!G`~Pfw%DuM_BEdMW8EB+Y+T|~&HEPe{G3vR>ym%+~F>^x&S zM%OM*2TOPH@{PmyE?Bq^^s!3Y%hgTjRbB?71=JCBC+pc3GfZ08$gAT}pG%1KPtEkH$k|ox-2u#c9 ziT6rIy@9aY**;K<{Va~Zs};4#*Z=;xGSggFbw`T^2{rO7d^Zs z(+i$HI$zOj=|v~=7Nv**BUNW>>cM!m^fqj`yZ5|~p6*VLVm3sqOEHZGuFk$gD`!20 z0gJ4{MkRW-5{*RL6png|_+fOvud`BQcM-75-+~=0ZX!^mF!*2=!nP#_wlEV}bfBPw z!D)<^UL9jFvkG<`1iL>_6hnP71c)u=3`kT3JNsvk-Ja6{BUSuM>wC1nyy~QHRZ8(f zOc-$+?V(NQeK{$=bO(|}V{<;p4IBJb-1#rFg(h31CJQ!#Hwp!ss06$AnibBz{K&9k z7ePXnmtEewD{L;`y;WngK(5?~0PZE&t(A8+Ce&n3uFBs+^eMKeW5O#8n^@2~fwEe- zs^Q4Dk zn0k2$Q^2+^qkEq`X_>zPBxN-CMOPgRnPbgD-fzJm_QK!X%lVKL$As!o?yY` zm&tGb-Alt;z1kzV%#558GBV&pmdci%0iUIEShU6u1rDuMT+`v*-P!R2@(1GdMB5cy z*K8q>AKoN_1RdRjBJU_=cDSmga5-OgFqVI@`%R!9JJ{#Oa#1ahdyj#90_sSfvy7Ve zEaSJs9PZjIxce9HKrB)EvQYgIU%ZiJN{l{QePuG?q!TiI1aAa?Yy43hM7)wDFA#kvgQB9W56mE|xnK~C9 zET1)vmIQVsaB*xT*j68+F}>Kn#uGi6@vNS)Kyzn!Iv_3N2%56VDX>&@^%hY&(kw(c z_7Y|?LWpcd<3=vYH&B4X%H~jWK(l+0<4uAvAO+KT;Fbs9po<_2kAacPScphS%Z-sA zBYE%6sI|&E3})37UE35}t3+dM(dM@3x=LEB6jVJ+0iQTk&4qkAN@SflqUOODUqC5lqeMgrZ`ce$Zz|lVT!K| z(`lB{gV-!Su?tuk@5_jlvER=ic9jr(inRyiMPpEv6W?T>`?JPaR!vb`Of_wldrCPfR^uxsGF zt^o)#g~%H>Oe-MP#Q?7TeFM;H^BR0(fUzxYjr_a4tEUg`bb+AZKd0Ap0{VbD-J?8( zAPQNEs%+WTO^%t_DFA2;v;q)>OG{7aStAWHV@+q@j*jkL(yL)cNCEOH7@)uo_jc^) z3WPAul0VRZALR-Nfgen1YTBfkb0A3@gt!XTT-ev!1w(Fx-6>F38bF?BOtQE#$SNVe zW*K|1S2dAERg8P43=iuBt$Q&B8aawO;cKu+guQMX%W9exr1M7|*ojCt8X>a~q+c>^ zsC5hmnj?`wC|?me*TF#7_MW~#n9~E94LW5ZDOwI+ZM*eMFcvP-A&bqE2Yeu=AkaxM zzz7sQ1hBx?fxaDW7|9H4$#4}Oc_BEm@r)I;jABp>Z0R2YD2Dnd45UW6Ab=x9kO*%O z8C}a11EjNKs3ZSu(oS0nOt@*}vT;r5FJCzgdV|Pk5gPuiT*D=N+zJ*O<+(e%hsxJw zJPDDid|J!cuL@O98e@7oNLXYxjK|DLBbz8T00=z{^wQI}t-JSd=8Lz8F&jtLwjvy% zayDoWsciVpB-K0!V__+BC}{-xdtg(*^<+a6xHyUrpf<)QWWT40c<7>RoVtY$PLhu;%MQGg&p z8(O4wM0%mt^Uof%ZdbAKi8+M>fFsC4MYE|Q7HkKT0IM!U_(QQJrI{uCWuOFv=R6XQlt|_lL@PK z>tge8azJ#VXS$_QUH+BWtCiUort?c{5Xyji6+$|YqBjE?H{{R>m`oz~fp94i2_g=l zc7_1=Dr6L{u!>kv+6f4zWCp>BvwWf*#8(D?9!$T@shv(@`OgttJ*q0>WZFk_kPIl7 z*7xKzdWae^h`6q1r})85+mnWcb%KV^+ZW+C*)t_JZ2&wL5AD>q8FZz$r75C9K;>1*2i*Eck#X7P<;a>|&TB zkaRVvX5nlCXK<>I=3{b-VZAAIOb1=YxTYo`uOvj}S0T$KtRvm3Hh!JpCap^oP*aB*~U0t=#m|+zD=oze<$cR2Tj4ZafvC|=lBQ?B{=Tj zgpMucp|24Gl+!c}viGfTNMwpPUX~oQ%rU5L8(AY@hPA44t7Fe;cQiCafP%$5u1Xc_(Y{izPs)#gP@ulXh4~TNy zgkobmx+{~7enUVvjm9(2Tys`qtmIYVpo1X;UQ+u9yoeJhj;TH&sB{=&p4(%CHiRvo zOffphgA0;n54sHciFnJKNNr^VKxl6d8pVowM<| z1S!`p#(9c^KKUFVa4^?7pujfB2qS+p90;)`@3KX5@lLYqWMnbbr@f=Ps68Kze6gNAS_2R5<)14%xdlp4 z+b4+Q$xFNAq@SzaZ8cuaJTsxs`pq1m|2h8ar7h99@KS;KhSCJD0QLH~mEq;q<%r zC=OY(Nl#3IKbSxJVf9hO z{%>t`%^Gk1uhu#HkJ#Kp&|_h0S1g*118%#o_lkAxzJ2i{8vaBRpS=5 zfg#(O00NXFZ8=G)oLE*IKjf@3saxaNm2QxxDFl8tfUG+jKO=gi;%5W^$_j+F=w~yd zm>DgukLqzR36*_Fqp&oFcXju+Gz$Z?CpJ*C3U%_%tDN|XCdVu{9)`v>Zq|Whrp7^c zEkt!-4^-O_gi)%VCADR2pEMx8=576^vH z3{R5k6;mwMzbkwiOeh8!9qgz;7>lhoibk{~IRXedjWNC*K_-oZ%lVQ5msZpu3=Nxo zg5Qq2R5;;(oEmRN`aL(V2z4NN5C$##B&_$0e39$8%P~m`n#f;Wo#O zNpO1=x&iUiGUSqCOgp&iq5(07fj)C-OYlNsj~hrM#STVo=+RJvol0Kz?eNsjb95h4N5ISiX$i)SjMNvmcZ8a_kc?dZdpk(g`UP5L( zc=9aA!Y{nEOI_B|YIZg0gFM}!xbqMIL!xnR2AtyPiMdq24x8XSVIb$ydY9g>zh}qcxoqU~%;1^7WfzKycu&|-|5R@hl=61w zWcOyGC`;DBt=^LM?<72s)b(Wi{0^C0!NoH{$+#1qOSc~U?pU+ie-Lp$$I{++b>r6eN2|Ky{u7(0>QDXpr zl6|e&+(XU@gWVT`=TvjF^~@Uj_M!mlh8icyJT)eaG`-QcsSZe2qDLRQUVDzvd0)zJ zF0Oz!?%Pi$$*~6IA&&CYVUGItB<~9gp+AN(DwzbXmK+TWMnWNp@EKA1q`K!H%0UH_ zVe!MQ`lS~lT{51P=0-!(!m&rd%vu=sA$dU~XzgCvcoz(;@*pcOR%4~0k@GJ=q8GEY zn3KXDOAz+U7RyC}k*P*+L>sNqa ziniK>y#?7uZZi=XD{@`QMi1f7YHjzR8jp7lTJ-dyoQz8PuoYBQeUoQ%eGGyPJdkWx}+l;PpAcp%Job_Yj1Hwr1hl@U

    y>%J0a=t!tWT3e3opax=wlCS9VZZMB>&Lw&Ug`2Sn8r6&jb7HU`}Lx} zD=Owr(m)%PiRHM+$&y3U2RzuWF5XKiWvc2HW2 z#nS0_mWdP3e7tP*qD70&ojTGz`TyDb5_qWk{r|C4ma=3?RE89?N7f=D*=3Eg48|5S z%#0-xPZU{G)`*Z~i4a8_l9HlA6rzNXo$UIbb7n9kPtU#2z4v$T-+4W+9y4>!clmrj z-_PljfQs|QczHEaQGH0YUBE?@y)w;Q86(*F*R>eQq`hShmR=pj>E=W zDM(l(R*Wy>ULKo? zYx2Gcp8ZAVsJDC&7lD-oGWkp0H4omt^@u;ZEuMk1{+)Q15tbC@$CG-#-$veIcXxO9 z)~#D*Wo6gAwOVo_6+7J9NQ8uhzN(xI+upR1mNqObtZN%ZX=J2ERrG*xEV)Rr zu+Mj8d;1Sjg4=hgG@>|LcCX{bP%C^L{Pg79xpP7fM=#~%2*Dg$A9=M`gd`;;g@=cW zTEA?}wFDlr*VEGj76OSxIyht%Z@8*CK3c2Q)!E4!QlWBrw~~@ldW}|^*zLaFY+6&t zPjqQwFpA09=izV9pFbSDDKzM=Xv~{0UrxNLOy42S?TY_$`BHXJT;i)eDdUfSf(7q*TOu zGq47(y0zjUg+bJfO0MWA@uFjOpm&x906gqIHG*%ts@3@~lKUVt8`%N}5j_ddCO#lk!)TvV^0l}GP zRSEE?j*iZwiO)eciC%?fkI%rIK9!yG@$m`YsoekZ;c<$w&A9JMF8Xi~*RagbAyjkSku%N9v{y@`9yWEH^|C}_Ty-fPJ&ks2@8 zqlA6@c%`4yCp!9ac6Jb~Y$gtve|wl*DC<7^&X)i&VlxeHdGw^G^*{bGS8%dnZY;+e zP+}L0&>a;_=wK_ zBmyJ8deu>w<#5=J?d(g6S>eMX1cznM+?CuS@rh;@>KA(jeYIjip_I-`Pqv?`Q>T+y@?x&siua2I#DZ`Lz{_pY)iD9sekU`J})LgMFpo zfR#O~+XR207oh_ag_S=&CuAnu8Lo^P`u=W@C9EDrcR1ku`r5WqzCC-c&~cg^VyXxb z!5V)kNl{M3jXrZRrq34@hm`<=C^;p?_w3p7KeFD~;-p)O0Ns{wfG;bC&mc?EsjcKq zin9O4t$WcQ_pci(bLCNq!9GH@bWitBiyxRhqM^Z8;en{@h<8bus_?mct>=X*XcXFyh)e*kVcL2-tVa*FhW8aM~}|tTAuU!THb!uOQ0eKTZ=v; zdTR75g)&yV%hkt1!q8o!Vge+PfPmMhb6Z9|4x~oVVF2?5urx1M>Y19(l~D`TH8ey= zMV&u?e*L<2yqf07H%Kc+x$)-etSmJO6_#G|#BTAd`%kGA0z|00qK>03Ois7jXvVXo z2CE*03m;y$&gF@Jjy;O`dzWUcuVh7xNbfcIKhiW0^z~-CG?QF?O%_oQCW1P7vZ|_z zPf*Z0SO8Ejbi@7k2TY4F=jbfNSjWG;XV|QXiE*+5g0J|T(P1}dkZ+^F1 zZg%whP`h09i(>Tv2?b--?oFk#FnEPzDkH}Qx!fB>_?hr4I#=&fR( zR;+(CH^t~<5OPD;p5bni@m!Ue_0&|MXmK`s8C8>%_uS0+O>8WddHjIJuDL1$cqg9# zGCi-VqTaYsj5P$)V_i0l={YF-+Vm>S_WI(xW!oIG9x{1(@H8Fxpce! z!^CjaU7*#zh{DWT6K)?#my`DPAH9FfR$k@~W0!lBn=7(&rzN0r+?t)Ay^IwN3JR)v z@xt%TCRm}vdmTN!(Qo-RXJ6cU!4l2&z`j1Wqw22C3yL>KUq~0_c>1k}1<#B-*OS6FuzTZeV}udTv&e?%*4D z3C9n5`uYXHrh4iEn2<$)5E3-L!?SN66RbL33JVCS!otGh;^JLuQ2|ekobAam6u5M0~7Et2_cNBA<-Cqwqi>u~zH3%Ga$inoV*+;W1)t|fFE=@u@)7P( zs(m$#8~9Tru$K>~c=z6tN$@@sT=Iyo{M-Ozp*tVA*`UKbWBa*2yGYkRPW zs{EzXvOo4)cD@|Fv74IXn9<|-C#`d?(@BT4G-K#$q#`@4RW;(PlKHA{MHE(IL@R7R zKB%irOFT0-DRMTlDEBn(%DU~cr`@Zf1OP)o2Uw7Ek!mS#zBSz)0JMkDgTb@LC5D=( z>2=J-u5`Yf9Dbb?bm_~^Dv3*d6bW$t^VTq$Yh&NV-A}1R4ByzDUvE!(kwlE;WRe$x zL!~UQIX+6g{2j1`7`P9=N=#&AZ#A@y z*3^F>xVfY-s#}@eOAipW?n4&4>bf3|e+0PW{z$b9lP^!>#(0Zz4UMQ+(FUY7^N~w; z`D@vV1|6T+*4vKi-Y9<+7Y!(;WA677qodF3ynAi_q9zBJ%CK8&2Qy>DPA-n?$Y4?* zE_x%>)_r?C#`~4YNJlL=Vb_@T=@kt498X@RClwM3=~KIHd`=^^ou|E;{@`f+yLW|% zC+EL?`v%w@w{PG6_RT@zc^ zPeO9OM)tTc+BDgTl4rl79rq({@}R-XHVN? zB{SWrLlpY@`W>B}nlZwE(7pXc<7BbPWwa*!O~wRlJ?)Nd3=Apt_Vr1LJ>KU;dP5{= zMybBjmjxR=DVuTaKke}K^_&486Xs!_x&FvHzuVf{IO#mszUG@ZeOhNx8!FaU9E?im znsjJ%+Ao+rkT@r%ul_>ttzNf!8{myN0<4BWASfv*xA()i3*ke-Z){&ySJTkY7?8%) zhe`+M@>hBPm~N%y0F2?=qKU)sec@~&y4y+nWAI&)dsD**k}R48+e)15B= zkslz~@wkkIyUJns%hyh8DN)fxIs_|8u*(LT6Whf3Pd~pnrx4=ScdgTFYBW7FQwG@N zfDK=V!%#KaZGma)=v+!jm;+plZ3jH`+zU!}djzge(@GR)4Jm8B@$yw6-94^Pfq|W= zY7!*yYMGM?MW!VzB*#8_dw&n0M=(<}akTf-Cy|%ZpWSMSetf`kW)@Uy5wLeuy<7g^xGA z^+Q3LkJ!t664!f~?mRu<>bSC$5?17>1Z0nLTl7u)!>Gx;F6)XL-Aq)S>|ud{#emRUy zm8sH>sxbYK-HG_Xo2DJfY;%{(*i{lg7#`~lAs&_ug6<8Pw) zKl0EtxqXzvO=6fhKClIQHMxJOyqvO+HThWN{nuf166l96<_CS)E%mY-s--wSynUMq zd_(8peBSk*Ys73lM~UY8Z>IFR8+v>kCF<(x09R?_cImq6LHKAya`O3z2>rt;sfIej zl=2aU*+$sb&rj1iV>3^ZYZq!7f8c%=w#B5Eq4VR%FTl{xK9xd|%6v<&f2+yXUU!r_ z(3p;q@p`;~)2%@=7@xs5an?AB@NDkjYgO>%@C`JhhGCCS!f!Cpf7(z|M}39v?c2A* zA3bB+_!|wzBo9$AF)=wd-j=^EFS#y^Io+7Of+a{;bYB`nmDwdHBct}N#6;59V^LR) zu4{fB;}rTPeV-I2%p%s1&GkvW-fOZWHaU5{N?GAc>Mpp-+Y1cbs%mPb=l1u6!UEOp z+#=FzHNQpuD0WHf>1Cq`_u#zJ%s@x7pE+pbcwToN2fU)g_70TFdwS;{b z>#Zp)Fglm;X;kTR)x^XEV4?d4eHjj=G#8I!V{55NYvCImsX5nGW5{{E?^cJ+w=2(Nn-8{?8e|qEC6#vP2vS~iN{Ek- zrzb$_Jj~sUJJ!U?nWdN3i`T zCjTHaEV&i&naW{!9js((%*K(E&h0e4k84dr+0>M{Gvj?yg@97?uYoLkjH4qXl@1?1 ztHI>7Ej#ARP&+a;)rG>&}2*O66)om~y~V&(R!_PtRfHV%zt?Tw5*`l7%%&tq)p$M_Fdgo9He3qQ?FbMuv+9_HZi zxb&TV;tq`$T^R`S#hRe97!{|(_PPWt0JQr5$oKi#osA5u~@S7 z3Yuo^km$dB$UpF$*5PZ%zGjp9v9;KzmR;}@@ffQ=P!;7^evB_(3)MwK@#*~esIzB{ zoxI*s#3|a^+Pb*xyJ^8henha?wLjWTngS;2{b+rOYQPs`&ciS<;n!WC{GW+bJbZ8+ zXk2tJmFMtlRGPd|tn=IJ`?L=1>n~_PQBw}(*7nfbx0X{RC3-)a8LqmomB6pJe|UQ! zmSv~vt*)AeU^a=@vx=l-WLGmtt0}LsvSSA7zx16-cY(ds*g*?8XUv;FkIYSr-ZIE| zbMfv+>4@-fJ$?rqol>#78;lj*#;UwfFD*=Y~1y( zaUb6v`$4YqfRXQvW+CTsh9A}Zc|ONGhf)lo?DwXnv8!mwWxR18>+NzBJ`y~1em&O9 zOVnqpk9n5=cT&NGh<5FZL4kp+CFe?wj7ohs&@wBhEAt}HOH)Uhm-xOOs?l3k|R?rN!?qnOXR=b?(>1HvZ0FkWWnK^XX*}#(G9_Kb7$GT#FV0pyu6xTL_XUVLQcU^ zee212rDiv?JpTOQ;fgRh*(CcXB#IwhPukkP_MSC-vE8k_;_2AfcmpC>G5esrd`q@T zwCps0W?mkRCGDXX_co7z4TMo7MMXvFrfF&<%5Kj-KqjqSUS9OcfWDoA<5tw@O$lVP<{%11moYv$P}4wJ;*7;X;>%M=cvBdt(Ziw^bfy1G?X z*7&~48T*HLLiRVb&CJ zyG4R#wvcvqy(EG$IEax_LYIj>TYpHgL$h|IMr-10ip-dY$}yGW$8RYqZJL}cU}Dnv z3@iMAMuzUQyn>u4v^)fshQsN8VivA1I8 zE|{=|VoXj>m;itErollcxphpMZzy0xLqlrOg7voF_}<~nH|=8$0Stt;GX9MC;=(I} z4?{Xb;k$M*!X7*j0}SSmMWV`=NF5>*>0!GSH(dMCC8rfsapsIPJG+37j4QW;d@@Z) z)&3)Xl3nY4IV2?;hYX`Ve7)y7LLXdR4Z`yNs{ zkAu?{Ox8zX%^&u7K8jP~xK>^cH{`(t_uVAZQ9oJ~bKf!cE8L7SaE_oI4dIKvo4 z-tdTtFK1WmnJ0D@=-`Yb#`>foOW*(xJ%B>MXsd0K~ZsH-G*uMb*JnK6rB&b zG{$Mm=;$aYR&uA2)0xyaGX2!q9l@%Bs)XpM=V zZ-FUOU{Pa3ZywGJ*F9rr-?5`V&6*;x-$=iHGvk+CDhc0^s9-Xi( z(D4)Vb62@U>to93(MLhfeY-mLvX2O+{T;J|Wr+_7;PSLN$h*z#4SG5})?h~MpO?wQ z^rmlS(sx&7Rd>sd7SbLGnaCm%Nf@)*TN-K@?qv)G?6tkhsZ+J=bGO+JUgARgart~7 z{v%JF1nNmZS4`KOG{-x>mEI7 zqI;RiQbqA3?cf+i$0%XKx>4IdtKBzg}ua{g&iLw+@m5#Pf?B z>(;F^$gB^kKR!77G)Q?5nNurwmw}J95$dQy!HHRC!A9fz^mNnZD|(rF6Hp?Z6ft`nCco`rMK2c=3$-WvcUTuY&>-(_kU zVf~?4A=CY&C&+w4z%HXnYsJE|^K6O>=n`gPW zFb2(vSd{yi&Ds~|xCZ=SUTE*$XQqzh%!5p7z+qb=aYf)P}5E?eX z_d=BZtVk5e%lKZ$gnb+_<`w*ulu6^wqU8H22DH_}60UI8X_5Loe*7a@DJX)@#83bk zYbQ2Q)Kwv9I-2IQX;5 z<>Xh^QUU@qUn>T^^%yuKzI1bE~zA{4N9IdU?N#_F~=b3TjH<<5AHo9^Mc z84}WWvfwQfUq8zM>6th*CL`lYf$?5j?Y8Ek3;8zBx^X&QUU8;E-D5}6E+?Gvn3*16 zx3kM-3EACrLb4)8XY#$xGpe++nd-+l1|3=-wU`U5C+s)6`sU20p8b^!u8G|l#z^=! z)|A6u?%%T-$@|3U6q?#f5mHiB*LKzxZ712`HR|uu8){o1%dFP)Je+L2Z#pt8%)nvY zeG3)8HbCtURj|o*bqI_PzfF)ekvctLUurFKI5^h2W=Eb&ulEJa^W>i3V@Fjr-&S5` z0(_>~yRCxT_TPK_p5HQ9jCHsfD`Sw=DD*-Q?k9DZYxj4#Q<&INxYVn1!$%H|j$R|L zBnIxahYqzryU*#9R$p76TikO}YP-ZA25M)NWMXCgE1G z>w%uTj#UXFmMzNcEldn4%~a(|bvO-;D!|tH=rwMx7UbObLDze_X=Cc1K&N{j+$o$i z&Ah$xO4~4#JC8em61Aze6}u9?Q~7Lf+ni=YFgBl!5oaFU^-`s^P{5x~X^;L{mSQJ% zQj!wYgJhQ0DwlR^245B9-Me@1!4!^t`);La>N_;K=4NCZ)-xi#9r&JvXY%tA-s{N? zy=fXjY;tGJ75&&1Zsz56H|7qv+^6p8?G+Y>0UV0$+TH46m|O~vjNIon)m=H##YcaM zP9eBJBQ9#9Rx2!U+bO4t%SE?JMvkK&M#jY08XisIBiFuYs-tt3PKT4}>Z9Y|I!3y3 zLRrTUYC#T9Ok_3{n+q~o>F1kQOLbYpb_M9F%V+x8@S&Y42I#|rhA+I_O-?17zDsdu z8HQdVJ}%;-2kcgezSF}U+oguT2;BAKsXu6Pt8Qv)YOJ?G=-6#I7gsq`F(A@%vm0{E z%uGyXXGUuHw4_|N2Vsl`9>q<54vN!z`Xc+8P5PNAGI;7XuExR?0m-y>o=c%S(CBOG z+U0f^K0ABQjl>(8T{Snn_mXLo-|TzdX9gv;I_o|^xnozGk&%&?pKo#wc40s%yn2f% zi-hNQZ6oGfmxgYU!>)%(lyZ{CIFO60o$wJKlBIZg@P^L+<>^S2sQ* zQYg&>y@e81=&Ka*X0t?lk%8dF|Veum+B_%cqrw*SW@2t?Rk=nwW%&=QA+r*RB$0%Za z;%>6MC(q8VPA%CY&z?G#qh4>kE?#@@U|L{bUwN6kG~fKa=52V#)6&vXRiE%Hy;6nI zT>Mp|pZw92y=DW+cQl$m52F>xXneRRkA4{LjLYBQyH`$u5X1$$NuoU8t84YO)V)^XU5r@+53gX|N;) zaKmVT9anQ;oMq#B330)FxYUdo%uHaDjY%v|Il_mIle}`T=j_;pA0u*Zl^DK?`-~Yc9}EvX<-R(#Z@+IM#fq3 z1t^{=I~JFdgX(>!94)|xEYOi?G|WHqX7`>wFIrn$pWI|7G2!r`!)&z#3}S5O%lEet zhwSXqb;_DHZQ`OlehXI-EYGdEf1kbH9exQ0QVIXS5)o#HG^t(4whIi86GXX9pYKQA z9-nhIjMhn!&(dM|OC{jMe#}Es-)nJxaZE|7=Id9V;NWLwr#f6!Zw1Fva%i3$ zZf2?5N$y8i!5?89C6ws#<@u$1_Z}&9lEB6rl_~a#iyIgk^8FYSzVcIk1y+&Wv6K4Km+A{*y`48;tha^5Ww!YT(PI>OM zsb_X(#>~_4Gqxs#eurSklkJx7y zRpw`8OkQ=P@tzsVy|H_z53}Vah1V^J8-3QA)qjZa`8;iELRVfon)6_<=8)ND&bO~* zN*+zP%ubC-NlDf0A5pipy;-Y6b3hZeFMvK?&RbSO!fkG5(p+?dt8IQq#(f9AJy&Gs zBu~D&k~KV>34>i@3QxaU{PbNV7ky)YYZ8nZMnOqw{6KQ7l3V$_|8!B&n|IwYBrp!E z0^`Rs!&ObF`vL$xy}Xr#7_QyC`Sl5{oVupwnXgIy`?p@sYpy$HYnSWL6!jR@(mgvZ zbhl8P1m?5;ppMh^FGcqi?n+WK^^iXQydLFS>Q?4=Q+Y>GN3{%tV$^j7&!=+Vs0IQr zro2?UHH+Ic-J$|R+UXe>WSc&e783(DEBkkVr@q)?xP0BOKX_o*kbU;54E0`7HB~h> zSh;|C*&*J!?C!=+8OuVsq_1{Q%1A3h*o3jx--5U1($n|JziCK*wKYjYn?6jw{;>509W5B+2FAunV{W{!NK83ktzm250_tu?$dU|>h zk&z+Wq;x{=2&O!Wqcm40J8GrS%)h>HHi_ru4$b2icIJ)1_f~`)zWl~koK<7@W&S<- zwqnO}qGx8u&YUUsfjw+_%j`CO;kd3$fpw(j@W_bV>}ajL?|K2#2lq~Hwh3c6s6jTC zF)*B<-&((`8u6*e87q?_t$w6=G&#QHx$C5%O`2ta@pxa;UCU>oyt+4D#)@`Hp9RQ%7*jXwZDF8MEJAZWk{i> zqWV72`lHb@>;hX*+mxosG>O{)jgvIHYPU_IS5$Pg1Q@Wzup4J&(R);T=DeB(+hp+xC85oQ{!uY;945XLei@mW00rCtK{7ZvXq0dLw4&lWc}3qf z8#f=1QCCA>D*kO!m@mLa%(s5UD(Q6XYVqs7%ZBYHPyT5K0*_M8@FcuiwRn4@G z6;^xc6~tIWK4Tw}$h1|^muzwc#w02#Dg-Peu3JYYIzcxteQ2UeJzHP0E-dq@h2O2J7Dmty&Q^fQh@bth2X8bpYyJB5D=>I&F0Ozo`Te=cY;Ac21o|3sTJJfxGsf@Uwd*N# zQ5vLthnv#o^h)pW2w#^j|BCZqLB;Xo$NBj9sHv$L7#PlR3Q!EbQD%>fjHK-U)X`C3 zRk>M6NGR83&z?Q96K!OO3vcZUfZeAW7&XPzQ?=FeD0Pt$#kKW@)tY0`KnG)EW6VKM z?F%^l4u@__&$11As-vsh-rL*T(UJP7zD3Z91Vy@z4y8$2QXr;AHWL(q`Q~#!{b`c^wFFRW384OK(!Vdw_q&u`!47`S zvj6H#@JPphXC`>~U&!W8wKSXiKb%8;F~(G%?b~JEP=E@{&Fx>JPXqTNH$MIhu; zB|_GGTeJ&Unsj-&Ns##fc7VF*cGz+5^uQ2reB zLW-6pg+&Rf1B-O9UeF`b0P8@Br_c)`m^cOc{4-Duza~t_;vR5rP>EC8-AsMR*(&gS;h!ycoq}SEaYATxW(QDpdL{bM=X@cA6#V{ zFtgEL&E4+^@R$SC9w0K%z?OwFvMtm^5aEXtQiP-Vsla@8P(ezNBKRCM_&Eb20sj#y zcuAC$3rb=(pCAtlCi0mtI{>u{w??=E|5AaQ0FW$5h}bJI)?b+tvGxSowYIZy!4Q_@ z(EP`ry8s5ZSj7NRuuh9<+kcs{9gam?V37FLAy5K?&*w#`DGRz&jtj}{TpWlpVG%LT zg2({+U2bj6Gm5_B(oL`+o}nHHtb;>C`KlmZ0FyX@+nZ2(*zu>@!$g_2AZZ3l5P-$3 zR%;ObQ~6lD#9G)v_==+oNe>s2Z{aI);yINlZ5RTO7GO?4fZtIzSV8zv7l=nd9SLS+ zTF6?@Pqk7%#1$@3fDFUg;nS~yq72_8ak{0IM@|qM`1Tf)H9CTs;IPYdiXAA69S~5x zTr0#PT>$Nj#m^AABtIbn5V2T%kpW0!qA^x@*^1A*PZ$l9+s+CJtP<7|3Drh`a$)gP zEt6nGc?TVrMD_Sk7<~nZ%7|QEtE~vMKeGIfu%nZQTP)l+sE^R|a^RU)DeUMa3 ze^XRa&{v-Sk!V?oXs{?a7g*oQVZK}{J_8WS5;^ZZTj3Vv`O-cX99-ZQ!o60&qAsBj zsDKE!gW3mgFaaFr3MriVZHyz7?gi5=LMsF5$i)$(u~7R^t%ijnz#v_m@yrQTQUI7&Za2AAYj#da@WDxWG>4=nc zbhLDSe@KMeS7H@Hx$T8|*uX*q#xr6exgGQaf&cV3?G7+l0OvEyTNdQ|F zgISye@Gss95|!0hqA~!zCHmL4IuaudTAVzPJchCpf^5$F3nJ(cq{>pO74K%CRxUUF z=aio>i45oYyLyL&(QkAMZsotPS5R*JMyGBF4C?Re6x`px(J53+`tR!%+QPrltu+D= zY=2+3(1!bsZm~$5I#gO5&(^={7jgub*j$TF?rJswWTHZnh*&Rxxi#^H)tBntB^#E= z`doynK>KqMu3AiYjl_SqVDCVlFE}=WDGCk&FljJ$jz}sVFcBtR)`0?Y1xx!E-Xq>D z!XSwSU+5e<2I|}K>1B@F2et1CtlpnrK zR6!*F`dSGy7Lw^wb5>Styo(%=ha-huz|5Zfv9#paPH zS3Ah=fv}xbOU|R9RIPA)6)H%BU_t2J3XNG-QXUjNgr^qoA*fgsvF(UYi|n#WMS7y= ziJn|A*h($nf-c2Q{UGF3-?=|lqoB{KZ+(8|2l zcSI95+n=x|T+0F+Gje|GV$pz_B~Io`l)D{|!&sqLvkq4_yn&(MpuqrkKa}$rPPK|C zA$HW4c@)IP+p60NybJzY>q!O4ZTMeYyTwJD7hOc)Ap~3CB^wb?4#_aUIa|1qXz7T` zpe;}H3nuKI&xO1a__t&=mt$DJ3B><&|7t+|PdEPpi2wP%Re|`QZeIn6CqlgB!Sa+V zC3FXc`|_HFP=UUAU2+&I=ZL@;xLmmf^wR2rz~hU)F5Zf@p666cV60SH^SH2x%74GK9sz_4gBouhha^T7i16E$2CybO*(tFn`3jQx% ztHys33Fv>OkJaP9ge62of2#i{zIUzu-@oNri~m}S|5~g6w-)vFKNj`1R{w7;{A<~L z1ax!3&sDR4FW1#0B5bf{xj; zuE64ah+mHcd>IM;2De%{_5+8sw80>(1)W?h1u%AKL43^#d;^@IG}a}wH6Qb^>}?fr zzbsr4>4dg}#tDT9{4^C}6c?BYKNVuETHAkJ59pf(BIJgf`Y4n>d@aDKVju- zP!1l-A@bQFC}%GSqLo2u0c6#7yeou|8f535C6gb4F3@k5flFD z{GZ5L{ilD=wTAz!;XiBm&l>)-hX1VLKmVQh&pfVkRQ=B|o&U9if5Z?FH2uY>IKc66pl^m9B&VS)hS^g@8tE!cXP38kY3aq?dsv+JNS@!y*W$UJw{N!r39h zK@_O96+FIiND-iI;hKI%$&S*k>4#7JZI0AnZ<4=)O!9M|i@M9qYfB*|b4;;`+h|kJ+*8;Eo zV*CJI0QN^O9X>EE2#Le<{_h~C|Hw=ffua5WL>4#1UziCVB3yo;^7m%+SHU@8Mo^sU z?@x(%`~H>X!JqRX!e9So6Vkws@HeNlAZnIPM#&M5L;n{1zVhxQgt9M_>8s=N_|v~o zgR5fm_z~(Np>y6YL`U}k`C$i2GDj$omO%7nNTADmpHYv!x~8apTB;M|GHp>{-!>lAisV4eii=*Ud!;`ePZHbF!;W|ssB~4|IhK? zRo9=`U;iii_>=fgaWP=cm#jY^4A$a5|2^0LLHu8yfd4{JFb*`?78EmJ(jfpXj|2~x zui^f`gZoob5~2Q!XIG#`R)PCLZ0g?t`2VG){!e55N6?PQe*ogwBK-BA0rr<0)4yy3 zAE<@0v;%=*MWRptz)J!MM*55I2B1Iw;yZyu_&@%WuLB6s;6MBd0RQPP!v5-nEISt9 zMqiC+zk>bofBmare*zl6fb*}8&J%(ChwWBNb%&IW^aaWVsh-98acSp^px zxE}tO-;@R`wT-oOT-NR(1KpL|!&7MS)9<|&!6N^@_aOvEgD>WJn|~oP|BD?Kj(^Bf_H&$LI~&`mTKWJq8(Zgi?ae8&PAZ-FT89ZSkyen ze>c|iSJ8~nZSrs@{BLke1PX2eObm}sA+11VN(fkl+oIi|`4Hv;5CM7^oGCy(;wVKu zTMz}YMz}cOKm^eRA{c%goWBT5snwK(v4tQ}cqYvjVL8*BHE{iu@-T)M9$hi!? z;UtbQ4X zM8v?8ry_f$#Uugt#$b>(06(mOL4WhLs{g;J691__{w)4)udvAS_&+gGu{Hny-*K(^ z|7-sLn*YD%|F8M~YySWL!LYx7D-uA!CkW2}azL6#sc3$&OYdj0&XMd{R8v0vBhVV6NGD_koZ5T7F}rYDI7irJ;KtK`0>962te(^ z@d1d|7_{S05q|jC21_U0@?YR!R;T$d1fUQ$q7X$FEaWz?7%d2v8xB9tPQ7cu%t;JfkR;){XMNz3%#kxOh zRot~wsSEB1O4V;>?#)erAogotzu#+ff4^Fi+?hFZ&Y3gk{O8OJgLF74|H2$b$TuhG z2t+d|TH<6nLO^I{GeT@U#R+n|k@{eop-Bft@3czjyCSloa8x*85CL3YVCA!MG=Bkw zgU5`czJmzalEI!X-Y79pkWPq6gz|;zr?LVvj23hjE@^zhZd^v_PU=dq>BDcSk5&>V zwJB)rp#dnE0EELcxS|+X$qp#7i9o(h=A1R$NleoXHLSlN9`w#tlKo==42c8sJH(Xje6?rEwaVvB9^HFROWs&Y`0pfk6Y& z2h?>9?%-fI-P}tLoj;^C%9=*cdd?f9f34RdGPHagS#W5$nSjZLe8OWdN76a0uuvnQ zDN3ybfgBLmZ{9clUxT#%CZHABt;S(i`?SPNJusru4}yx!SCa-`ILk28m6KoWhJGB) zWt(Wh+r#LNygxB)m+Y=fj>9It^jKn_z*!{bsu6A4xVXomW%=K^kyb%9o1F_%N zMicli{8S(R4eH~%|MgFKT==gG|8?QNF8tSp|GMzs|8M-4L0oCfw~4LXt`smA0PF++ zhPvYv|0VEr$DitBz$opjPR1AfR)q?|nNNA{395o5b+XD)heR~^q7Ra)ENxGl7qhJvmNmcT;f0j;JuNwKsub( z#^l~1CxF4!9X9w;xDi79phXBnp&Of;1auvE>y%HRUpfS9k;pFrF)xc30cup11}g># z{K=;GP}AU(4IVoXOFplR~t>>e?cK(p$+ms`?$`3{8Jtm{^!E~ejonF1nQ1(8XLR+ z1&~0dFEsead~hLvE(Fkp0R9CtKwUuKUjPWKbAhzo3d6eXme__2I?RbcKBILS0$s!U zvU3q1lUOL`VtYJGMd4{Gi1?7k1_xoF+@A6gl&R_FW4qon>t`3n$76CQi!GjO5k0kL5M6U zV0d+jo-{G2B~5f7o@NC^Bf9AuTy?etPmJl7Q(3*#S*dh|0%$hjAO4^@KC%{0x@PwS z;2U;dfbE{6LeZ#~tqAN8Oy~l0a6{c~%8Vh15S`|VN5dD9P)!h%bxLI&PXkd}$J=l+ zHXVzwcpU*zS_>dNE!)Ocjr}&|zD&y+8)mMtIB`~S5ordR&u$$D+FNH0fpYL>K?O`r z8VBQ6*G@aLq7EQ0%_AT}#GziS1_j_Iy_IsT=QrqvqiW!CLQeo2gonZw{OV0ntXT$~ z0ext|7lnP~*G;AWqu8LP`0%oMHDMu*d_rRtOw{NIEeVw>ouDWLzB|1F3J-!;HP@eO zn(oj$aSqEte@GV^JI&a3nDNU|3jWpC9~Z0#4U4m0G(8$LdK&=DzSW?!$WXDp#D@ij z2!vLx0K$py*X?t(4yK~3fY|~w8fi76AtX|n^(2LZB3246iDeLGxL!nOsQ2=tr#Axp zjj91cB!Q_^!x;$;Je1B(ZwY{Ng;Q}r3IiP|3=R~;tIWTSSjnP0uYDt!yTGB?*op&!1hH0q;}tuTAsf%Yy4aY;nf-;`7{g2{(0!ooSd_}B z)04Oo9eoJLp)y0K(vo-rbZ;>D1#(T$A%*#e`(~Icv88 zp+cjEJ>Vbe5`wGwPRu_Wydf6Z0yy>-cC`8gG!L#sm<`C+1I7{AG>2$Jr?-%3vBF;} z^H(GYPH zjgnw`G2@JXVe>D|DQtt>$GD-;cN(S-CXbAnF7q#>MZE44_EhvsI6mmCj@oVK)8pi)G7^O(5YdJ zhpA!2XjbcBW~kK+b1OmYXTeozK$ER7*A+LyltBt@REDq#j4Z)dW-=ShyugTJpxVLG zM1Ppghy#jEz&}X`vlf`&kaGmOMe!Z3Vnml*FLAH;uIYR*Tb#ZSQ~R}RBN=-h!;~*pf%YB%HRYv z0PA!DaN9^)FdZEmo2+S|9L}5(0Ym485i`2610_^L9+_d3h**m0QCOz|zL-u=6PyNu z@GJ+!18pHU>C8HI*?^&vKJ^obD;os%uq4s|#@nz{i=ixJW42AgP{52-5l29{h-UyL zgc-^tkjhAiC7`TN(x}h2Wn)5Mfo)Kij@s1JZwjv55JvPH1?tsnaIJ1Mfmtb>o)96v zqBE-XRyH3R7+o`IGQ-4bJ7*wsK^K8k4Fp2#Ag4j4@H#9sHNi|?$V;FcR!ErbNCyXw zIr@aUG_%T_4XJ+-B89yG2;$X&qZ+_M7z+y_zOfb2AP=oAplx_D4YL}-h){#Enrj1; z%z_Ad!G`5VPso^l5ElsXhu}ax)pAgk1j204QMUCR$T`pttr=bdq~X!(0aOTj@$ke0 zC~c?~V4fq57?}qBb(HmvBta`1JP^il1x!VODMyDEC+aXCLn|eCFDO%A1yjP;4>h78 zfQB<;#rBg;^DqZP!E?|Jn_}v91|7pjSR65gVsxB`=;UDrQlm@H=HbAS!ET}9NM-PF zjSg0w1_Z=|8}%8M^I$&&K!GSi53lwyAuE<%hdLfTib=>D&_2T=)NWP=kY1gh=qN1R zYBqu<=?rTyDkzf29u2@8o{>)K!LUZ_Q>0OYY#FaBDP!2+Rd4fzK2F*udQkhgDjh2H}#PMRO5=;Y9&=f9y7kt1K zF~Ybw)RZt0P%lUHiDU`Ma>?KrB_1P-ixSHfSfm(GCX9>|(@lX+iQQc7e}$PM1|N+OO#j`2kKHl3cweb?Pa@AT?y)qg0GG^ zpzD<0ztr<${I>x#^nYsO#rSVfpODbt`uG2Yg@n5B-#_E|FhM%F4dw+0RU1i6lpOqj z68z7tIrum3y+_M99R8P*D4}x9*~$r7V-m$@Yx)IOd}E2k-;l>lo8&X7m#?>QkT6RB z=@-3c_U=?zd;QsY?d;n{#a|Uq8ah;&^Glj=mQtANvts&^mXVQe*WGn}s`7$^za7}K zddyb;K0ZFTsw->DuWUQtPkZ!m?a>_%9toFGHEkbuyL_?RuIJX8w#~+RJ`+tEKK(hj zV9}L#<^zo`UCyL$LMRxr_{_(a$=fsxgoXv;1%_9RiNf!@=uUXK- z6v^ety{f&M?RE1|Hzy8G+Per_z4tqzo8j!1wFL#K2XcEfYu4=flhfbcfAC=TtXbdf z+2dXD?S$G#_wSoy*X~O@o)I#y|NWV}Q&V$PIbFJR2@Vc^`s=Sx9$xRzv155f#hMe> zf9y9Xd-;-p<>?W^$);gBF+1nzi~`daKCqFOBHj{->44xg74f$=uH;ZtU!aul`5E zh8&UVq19@wIQD6Eb+s%u)_3ZbZ@#%!Ue0@OYe4`0%j9GCduJ_Ju%NuW{QTIP>ue;hr9_pRLHw?d@{`KSUrnO4{`iwrTPiW|zZUe^dp8QH?PH%OG-g`QDl?^`_ zUXeR>=~DlJznY%a-l1fl6n;^t|0czc^NVH4UDKsNweRiig6wODhpx{{ILK|DbD`?e zl$Hr$<0KOI(xF%0;!FxWdhp=cV(Yp^i;~3ReLt>MR2*J>;>RENh68ewK8YVPLEjB7ZnwG-^>rz&b`{@l@S<*rId^huQ;y{OG-)_lKXk-{iDnKZ5Y0DNnTzjPtUcd zZ=USEQgo{Yr!?cplEO>RCw`Ef9m;9`5yy?w{Bru&t2W-vRH+^(jqsMm%p6l&smr>s zFvd@P*t?CfWvjlX%YzaVPtF#U^y>8N%AOgaUPm^m_jmG7>DZwIb*pUCoGyJX0!{%r zauP<27?`??6L{+GUDLXgDN1FC=6h~v+jlx`c%n}bXzmHuoM_Ya?SycTeX^%dsq+s=j&p&aE?F@0s34vA6Z?edg;wtnv{}FRSv4DD&Po zdKt#KHMjfG?99v?GuyqHl9FPks8+37E$kN6Vta=}(R!&HUqCL2c>3V{`Sz0gD;B&H z+w9h+1K~489%}#6v;P|T-1>9u(>(vSUah^(adypZIiSb%f3}(;_ww-Y@bW4q4&@aW z_vPdVs3z}D<=*eHN;#hTX|MablYPN}C@d_bDvr9BjHn&5|EE0bs zHD}+HOuw0d*D5Oqn9IMfy}ezw=7gW@jn17%Y%{;2)@Suk%}E)yKI_uXh(1Ni-0{R> z^HJ|j8@e@D$K`E{zWS|J_UO%d`i@(!ENfAAXia(bx6daOtsH)4M?uQxOT!Fbu3zun z*YbsQ&B%<5?~fhp-fwhazQJU=d++Lg|4xVU1J#=3i(7Pxi4&h)+&RwOCs=#5|Ja8a znVDbi`mriw*sQ369L4%XeCq4n`qxyQ9&!5Asp&Ijj2ky@_NOhY$K2bu91MlnmG>4B z$)=^RUwW036DavXs~zFq`k{AlI%ic^b*=Tpk(L`38Sy<&0Hqa)L~ULbjTuvOYW=X4 zD_7P&s_f$7QS;!~z!@`U0MW_v2ubeS72~RJgVJ$kvpF^vQ}cX$t{m-mXUkCD{<+>= z28`XZJ9VqH`J~u)5=i`KQDkJKUVm$Guy*vVvg4;t<>lx1%0G5|<*FfzjL|WJ{i-=t zqurWu%)gE~AZmM|J-489$E0JQ)h2(mxsd@#{kkJq)|=v#nifW}9++%fFNi8V4={*;bE zy|gt2!YQAOyS;5%tIlV`0y(>8y)h%aC^g61GiC;Pd07YFlc&N8ld0yMsl8TBzpWLf z^}K%lx~HdSL`1}^Q+#^&UMKrBqFuXoEnaP1Rz!9$eYMat zp+$EB7Pky64w&?4aAxM&Jid1iNtx02LeE$H%&j7SxqD^Lv}w}>J0Iq5*dXBOFO^KV zS~_RNiWT$c&ks&NT((IK3S}ylN+1Y=06}wM@oUSa)eld|Dz07gno}zIxTjbwUVBWo zCS+sf&9B-HH(cSa3E{Xse)|3VAEr-_&S^7uc2RKt@$&NbjvQFqEsQrcQ1wN|3}dQr zbV>y0y<&@>kI(MYr<3xC(z3$juXA&AOP<{5{qcd2iNDsAOsJg*hBN2xU8heMm6UW-`u@AJ=+f|E!+PJ1ATREysTsrJZeAUf zUFD?>;|@F+^f6JI&pp{p&65mW=_7sqmb*HqUHik_!gs&?cZ>ePv%j3vsYj1FlNXL? z`x!TqQ@CZz@ll-jwZhCzOStmk!%Gb3z8QCCXCE9-E!(I98us|{<58nVZRV+So<4p0 z+Us5OmoJ|HtN^gH(PHs7uPpRq43fkxl~7uwL<*Hqgea{@S`-yZA(fI(_B3(cFS=577;VgO4;>@GI0 z&!rcea!S;{lv}f-o%*-10qw%HD78fzC+GwmrM4Ju{>0 z`uE|&4Nr#qa>K#4=N1blm{#wD6)Seke0nuB81&cr^~q`d4XKM-f{gtF@&Y;@UolO> zF3@s#R$I%e!xZ&(#j0(2kNIB3lhe+h&pF@Qel4sRRetN1s*KF$uEz3WGOy@jmhyKm zDqLf^UnMi?SX)Qjf7Kj_Ef<(kvStm_3v^}R(aXDZRaI55_dQ+*b|_)(&1!9p?h0YU z-`eWx>aGLI00%e*C_Z}BS59DM+@giT!p>G!1*F!yfV=G2zMcJ*)PRoHE`i0_2fG^W z&w1Rxb8O2}xx^z(auL(rL}Trjw%FZ5?_rANaZ8rxaGBIXPoe&Le?NugMgxJs;mniQnH*M;NwrKZ7 zM*A`Rm3I$H199ot##ijPtwbX6b9Xnv%j+vxmtb;j{BZTlu&bVal;w0(mvz>Dv(J#&{rT}yH&h*wdu7y)=`}A( zrI#)}!Y%5!g0CV8+ zTGD3@OWU4N^M6tDFx_zH%=rp_&zDW>D+`h|I!wMsY}x?&Tqwlz60 zeOOw9RVUJm`%&#?9mjS5$S~9D?8pvmWIFnQ zCB86Dp15H{Wo4x_7V8l!1GX3Lp03LuoQg@?xm}e6zr26SJ7*55TI&m-#Q72>6L5Sm z-PfF(-AS}*e7t1&Q19pNmgQAN%`_H>*?|g|1LLIag#C_c2A!XbDq?0?NBM z85w@PXBW0|^SCG8teAdnxPNYh?e0@n-n{%q^c;2h!X3WXRjRDyAAFlG%FAid{cs7TZw}{v@*xfRNBgACp+V|T+KQw)83YJh3 zT%LV!)4ADddaL%It9$mfr}6?QwKKjbyT(x>LM?EExA*h#??ZPENW=**zm}ILzj(15 z*m8m!18&_*RE&vM*0*lL~e8YMl25flTXt3(?a?6=1 z+^O~40^HCDqeqj}N zgrx@M?E|nAEYjY*matN4cU08IH;JBe-^b{lFT6v3bLRW&1K~#dXP;C(-06?v?p}sM zm8fMTTcP&I?-vt2voKbEweJ4S+TWMCy}8$WY6+*vTKntCH=2io22xj;n;qt^RzKM4 zvD!4bGEKVbY<$rjl46C|^DDJA8OOE^f0N&OusCls<;b*!+M734CddFmz!D6|_JhXh z58pRj_yBef*()EnI+WO%ZRW9bQ9APG-nX6ysWJOsFRoPG-^rGO#_aGwaUJjbtg^l7c#K=Dkcx0vl4pa3V%!`Hjg5DqaJh4Z;Ql%jcGFn#Xqk?$YlscXB2siW?a8 zt#)|~mJqMR%KOKT%@uC8^EzZ^a|Ju6q$uH?p>UWrV6_{&UBzqLu6}tAX2<1ERhoR; zBJV`ke*CuwPh zRi~^s>M4F%e+#A1)>F29@$ko;M!R62ff<|A`L_eTz3Hlp1_azHFicE4saq6l?eZPFRk?aOKJ%2t+TSP}4C>nK^Y+28tu!C$YQBrjr)iPr zEG#G*`9YnHr%y*T4-scnOs~*M$Q1kLQ}4eFoAcq=u#%0*UF;+4cP1}@HsTAW8V-kJ zXJ=p7g_0;jcgH^Tx>r@j#l>aIe7J6pMrU_0dTuAP1YL=OO|Yk zo}OWTOhs^aS>vgD_lvkMioJ}Eesj`Tl?h#?xk0bksYHNj?ep;P&rv)$eoj7-mM)%D z)>59W^WFTeYq<@6Ra@Pluf)-YLTmNazIo-EE{0S6Jf}PQT}_6at*r+huWOh{#GXwp zEiILjk}51LT>gEKY-`IeA|@uL-+6PWJv$c&YJhQ{s(&)~SybX+yPZ(nA{nuA|81>d zvGQ)Gq^#zE+WAl3lb>^9g=v{YvEv%(Cuc>(^(+?kn~dFLK{En&G48T`!VLNZxc z_*j2`|FdV$UcYuP?6|X-S@KN9ty|C*2b3In!QDU!)7&zshU)#$?3`Vfq8-)`7XEDQ zug9Ho?RGn@8d|^q;}hp&12xCCh?d7Z5<1htvH77*c2{&vhqT4JkX8H2^rTw%?PKz+ zwspK{v2xXA-(>F2?VKkcKGeOjbLX17M;A(5FSjYLsNkBfP`*c1EhIfuYSp`(q9WS| zIvF)hTLwCB#R7%2Wg^8`E560_vfM9gzZu7=>}>XdIJK9Ofav0)7xU*9>9t}K|g z_Tc3QaonnYR|8#iB81(n&-hfSi#&VuC>y-t_6gV#bTKG?s7|EBZ2EgA9;+Gc5x%Om zwY5N1nz>M;w(29gH$E+GM|`}^%Jh?VmU8U6@kKfI058A6PY#NXVyJ36Kbhl!x`nm zM5pbW!PRRQcYOo;6fe)q86~xxN4Ot7derkgH1P$d-nLI|1sfk9pKtv+-4nWM)8hCu z9fT_cV&oK+Gk7bV_xs!1x3nEQ#{8f!;i&xyv$uVsvhOu6Go$1Ll%C{>y)>x{`_`J6 zmNwm}tmqzR8`|j6E?$Y%#>S=Fm$mOfMVkWsx1md*`(Q+7_dVG`;4#p`P`1R2LQ6Z%=vIYw)V_>({S9Lf;nix@Ql& zi%OD^P*ZhAlXUN=>g{dScA_Ub&$h~*V?jxn+pagC7p=2qU4w&##SESI9_8vTXNoDA zfX_3ZyR#+7<>QM|+w8*B)Y5mkSoY)oDapynvzHG($nn^=!VMMScm4kKqjnEh;LiwenERpr_&6jWgC4 zlWqc4_C!Fj_hO@qnRl*)emVKPbvdd;z;G40YyG!BSnNv9#=qk5>6wNq>F@LO73B`z z%o7n*ol@4{uM#l#GP7P(smt4Ffu#_wr@F!0OvJp02J|A~j zjL$Vqz@+W!7L)xS6BQ3OhaF;hu}n3NT(UMR%Ug|fVy=(bG*vC>`hpFQnV60wB>{;_ zU+wyaKo*qChv#~zZyJh5msq&n7Kq$s~KW zHMiLG;khx9n~lpTG3Wsk=YG7py1IR>bU(kJs20|{et*x!Q&WM<^qx~0hbANoW zV)m}3Tv#WRKsu0DlaswsUtTSrfifz4HM^xF`eHC=Sr(?QR_T7?0jKpobCoQT&vS{I z4usYn zbEHs{_sOzdk@B1R>a;2oe9PBLCz})7xY%Cq*paYxtAl^oBeo=cFE6jaK;_e}e5|Xm zmx8(u1#7UO)WWY#FIgS++Cg+BN=fcP+smD|t#I)qsan`SD$UGeiAFB`d~<(nT6$O z7IPK*aY13yhq~9DA(?@wd!~zK1Lcf=&Z|$u1Bz#DvmWlf@LVH)-#)`AGlAWqd#1Ay z)Y_!&y1oy7I`HYutQ1w*fUh6-zHkvfx<{@eDM{v#tm)H_L4p>?&i>t5Wcx{)m$GnaiJnuW^e%pzEWSmUi@*rvh-5#k7DIfpFYoZ-o1lj z_uP1=J#5`XZ-tBuVI%Y9Sr0e%b+q})t%~j5F`XP1rWi3l!sX1)&&=4A_!f)3 zG11Y2CEH8w?Mt`Kn9XmPX^2^cI!UQc(Q>*(P*sUPbb!+qYMVtJ^i@voOEy z+r$&yp>Uo@1a&%BRekLlqKZWthXEnmc}bP}>3SEtEZy2CNhs81Zm-%>>!8+)C07@r zv;4dZ9aMcI2OAoF-gTnF&G+F~tiF8Hl(lfz@@Z}133cUJt%F@sX|g$ufJzr;pFv zf4n1GknNNScu6jB%AGZ9R#X(*O!jV7f%D1hpqI}w+jY8T={DL*edx%&4g{B=D3ZjE zXhH2g`UNbp`{oSRu2ACcM(5=X35O{eB-n?AHQYUTYr$?-Hj%2cH+C2_20Q0t3VM1f z;+AWtdf#Bue;%~K%j-e-klo#d!Q~Y<`})2-!Nuz5=;-P;8Sh=X1HuUUB#0 zoG)*qQEaIR2?XTVsv6?P_gc&aCFCajtlu<=hZ|u1S?^sA%@kbT!=E z*qFKOs#bi$IX2z;t!6c!s?EQ?P1o$(WVF_3-MX^|2D83>E9B!deT6Pud-~Y1t|Y&% z%bi8Kv58tQ3>vG=cUl|yo0Yoe`B&BD9c2bBYTTTDM5evr392OY(v~avl{e>iaBO+n zG{-jl&S7PR{O`iw)wYw(*t~s|t`GNL+bu-i;O!vQst3(^l^=Hv1#&L&*x zx$6rieRPK7bxzb;m*dZ8MYEnif8Hf_p}}1)k9=a22G5*!hwAAlw%K1Uvs;=rF;%dY zY#Qjy)7HLJq%vQG@_nc|XZ<%T1A}c(F_j9w1o^f%30mFdb|0>X>t~Cj#M_+k@56c|QZBp1lF!r7s#$k+>>~1lJj0A*rlGhNE@kH4q%%;#=dlLW z_-twDwIlp%X|9`z zRNz$>6iRe43-}*O!~M`zHc=j@+=pM^_HAJ!NcyIqw@FwhpvWZW>>TFf^O4uw#PMoB z);v@nrL$OcFfDx`VnePNO0GgsNNAd1r&{srOTnzDJ9qB93Yw-W$bZr#g0-s4$I!17?8C%QM^J3A{&@}#Ir<>H;O z3+o*V-Bj5k)leqM0=xGPpVFEhc~BH{&#$e@a3@!%>={+I)FPD)_V!i;LJN?!=gB_q zYIfF_(%eL0-{|rzEuP6s!hFw;prF^Q&9|ndr5!(xZe7G3$MyiX<>XoW(A~MIE4Eo# zt;o+`opbqGQ{PsH@0KFWsISiogJ&;%*6hB&ZcXNqd zB4HSEJ6xb(=0ZV@%^M}pKQRh;Hj_oi$tmSyg_;JxCYSjIhqIp5DZT_kK#k?cq03#X zS@$+=+;N$+@x&FTj}I*TF8dj@zQ}V+_pFL7SbN$@cBs>D=dHN!AG34!I9^-tR%jWi z6uHr8|Lh2-xtluKSS8L?B_4>7C$&80_i-zUU;--73m@I!L4}x`J$+A{Id|q~OY%MJ z9Q?LT{7&V&rbSK6?W&pwi<#6={Kk*CI8l^)huKgMyp2LaYJ`W+3F+(?^NSRV_}ueH zz6sOC7pE8gv8v{Q>{>b2^|EZ!n!Y>_^>cLAlAS*@s4MRCYV6R!fO*P-miW!3rP{Bo)~s=~ zI>6^>6?whxTlc^$wSLtP|}0&zXCBvqczXi>EP1 zit*^l=~NoaHt~ZQm1WeRYjwb2GaGw%owt13`u*{@_KEStoK#o4_yKUZrXuag1Du+2 zHr1>^^ zl1W^Z38p|F>0XT!R@Oj$d|Gf2<&yW{@Zl11>x&>m~PzeYkQZD>n9( z(Sfx49_lhOgRk#o*q%|_f6zvx(&xc(?HHhuAC_lBJFZ$PbvpNz3U}UM=ohD@ zlBaj??%YuLh)=ppKucpV$&Zwkb)?Wi!OP-BWAUy6&s*;(mSJH@PO|U%R%IMW*|KSH z;Da!MkSDNvNyB=zio=%Qo_gNm$k>`~vR34yPxG}V7dexZW%frOZkg4-><(|xv3FSx zc=Q6n^p#;7KcA^*?Ns8{Yj{zLQ&+D%zPP4%A=9F;-kpIRd%Oy@`HdTH?_>GWIdCv8 z&emtzWmluf7hv1(t`J(@)++O*=TVBbqx$Br-lZP$D`OKqsu$%4c7*RD-A-$dUAtzr z*`qrL_<+tdbfFo$VA;j%Pcd$>N`gI&WKG*M^|E)d=t%VoVoN?R4yGXkH8JEIx!>TbN$v7r{>PdjFD+UhGjcUsvv*tT4F^FZfS5s^RU&p#Q~ z|F$~i?4=;B_6xq1De`VjhQdvJyy=Y`pTzp;$j>V(D}?Ne4t_G$)(Z$ z7oTlp^EY!256droLHf3MUBF94&nhpaBl{K`ZtZw6Z1yCUTp%=;;u70-XbW+%77 zQk$&;m;8m9nMzjcu(){`?O$RRdsInEK|w($T|`;=Y=)VQPeV{%R@O>ud**Y|PnjgY zy;>!8BJD{>hG~q@@+~glMa2M-_ivRjib&1$jN$)$;+{B`suJLjV=b{FsQ&59g)Ds{`Yq{edEs~hJDHCb6%`2_`z z+flnd80@Q>=OmyS`q{#sKQHjfJNcDC$D~?C8}z=t=+<&xsQvu8&bNa=(%RSh_+8D6 z>;3Jl0WY^%C1)L!&Di8Oj~!LC%^?2a9MzU$TkPJn64QqnPhO zO5AFAf%M+q&>394^G-%NZtrA^R8m%!YF(qDv^01RD*01MNr`7l$jbGsZz`;+)#pj2 z@h;KNaSWXuVITkH>xDGkP|3w@Z_KreL)&Ww)`UF_+k5<}k5i#{-JJsxr3Efe&Ca1) zZlMM(lVyWRXoND)k*%QBY z`gvaa{ERh~TwEHfMgnRW7g%xCT3-ZaPFGdIDpO8o9VQJ%H+VWGN|xgyxJ6m-D1;96 z?fU*{dGH;QbVb^UPo~B!d$^adx)=A&4nI6pA!Ido_YLK` zium#MYd9aDU6)bwuIu{uEv;cWwR-!cMT}k_FwalfOj_J_nA^0vn3ywTK!CUEY;uiF zc9&C;kM+*_83)rGtgYvAL(hwqpYpeLWM!)cy{~V%73Yb^vpe1(2;tvGx?~^J?k~fx zP#4F)*u{H2MNz`(_A=tR4_@=FLa$wNp6#zM?dH?-`VLTHpXcK_FE$0-U2C9T{q}7{ zZ0s%Pkk+8pXJZrDMa(wzGz!!%W{u>oz{EQw$R6AD`u6^d7q98PVM2YWH)K;*QL(kN zlm6Z(cjWcFdlZ?>Ra#r$yzz*+IY&U?vsanaq}!z|J5wFX6JnJ&MCfAkd^iAXfRj!V0YfBC5t2Y-Dc@MXu_T9^f0UXLtZ-K zWFLQvp^o$I%RGAN=HokJJoR18sVIIF8#}wh z6}7%Q5{5f=4ipzZeEjY(6H3Ir(Bb-EPh|t~vJB|Yuy6xe-s7iFzr8Vgxrv$Cmba-p zm(4$r-&niWi;(BjkZ_&Y^loTC_Ck>g6Dnf5j-~&J*Tt9hE~s(xwKLy-HJ!MvG`KAC zwBe%S)+$Y2{e%;Gp*NSm=lBr4H~pUR*&)iTfhHpqo?vZjo8xp;>s1mlbo$bH8~X&jaM5Bp~_`k%2r4X=e(daHm+b*$&2$ZuRgJxA$tAagzS((Z zxD`5l>1?>*c59E6)v0@liftMpdlqgKocCHpa)-UHgey(OwKwEw3hEHE-@Gu`n}3 zY^$%y@4;EltjcZH#)+}=1y6nC1ZsuS*10b-eCxsgn&PS#y~^0wc=hUM=LuFDHe~lm z*I(gWbx`U_`U(<x_pUZ~}iG@*ipp_^x@9lf4^4{-OO&S!z&dRm8v2I2&j zm&(YPX4GWPKeTnp+d1+JGEWyJ0@{w6Wz4K_SK!f865RcYe3eP_MFmgEtRO&>qN1WK z7)HuFOU*+mR{5FTUn@;=Y}9JwvTwRZ?tSQW53q>4cR|9?&rdx&9|ijfNW8~0*RwA| zp(_`UcG;|;C?Eg?2`rn7VN+qZ84@e*QUQI)#O z^3uMr_I{oJf}?h65_+3sm`Th{5}>`nvzk<;EO@`Mn7or~VV2ypyp`zz@p!y_ zPHwKBkB^U+m!ynL=aby#ivcZjlb48#--I7_+w{+9r`fq38jCjVo0h42UsR{CV%@rR z($dnLoSeM8yxT=(*gifq6h3(HAbZ!#*49GzJ9A`ZW%B};E?uhq^#u!V*CX#ju=-X< zC-n2RSI!Sz!&z+4c6_>Bm08~*P(fc`AAihE??TbYm3tOsp7DygX=!EE($Ue;+IsR@ zT@%)yiO4*Sn`p*dQmAB6e?f?4!FuDY&&5xN-3iahhymGc~nAAQ8Yn$*) z?QB1@_cu&0vkZUGkzN07K-l8O_Ze3$Lye9HYg(gFsAUv`wG=l5>IsE5@`a*zc;bn8 zI%J@snGM@j(PPyp})FmxK$J;^>dz{{*?n8yT4C=jgd?{eS1A{|`Pt zz5l^*?f>u8@eBMPRV5{bvG_kKic|PM|H?Ck|1*XEGll;@g#`4!f&@gJnl$X6Uj}rT z0sxu<0Ga{-`o9GKKN@Uy^qPe#7`<-)191S*lR@$4prZKy&6ok$@c@Ql*dYiaPvZY`T4j*eLpIo zB@$wihz}m=PdYOkDGQq4^r)CL?#PIDLm<-vBSL*fA%R)oM*H9Do2ceFR1v{Gcb4;usb26KNiV2K-}8RfagFRDyJgKPh>HEHGqv2vW)u#*v}J zp^OR!OWnxGcpne?uBJf`rApr`M%F50E;ugbIN4xH5&1S=HfnpuWTZ!pg(Jre1e zkOi{2KLt;cSH}9gdx&a-Rk#77))!101PhQMtOJbG1WJeDs3|n8CeSJx*?4zREQck8 z(g8L1PsMX!+)=?~^dNW!l4wFH1DyY;PY8w=9+@66ga#6y)DKOi2N?js-5`)52r&vz z@(F=Zp>Xs#19)N(0gM(jlg16sKwnj$uCZbUZ7_64Pb$DeJRl70(fB<;Z}ReUry^m& z@s-J=0xXX#0|@dPf!X$;&LAWwjPQj)u*2x_c#+jkpLz)A@Wq8d!veuHfjtWezl!02 z(4-)2E;IsRPsXC{AlNM;SXUr7DP;Vz;20i6AgWUkoFW`G`)J&(u>?_<2~q?VP!8gU z)F#mwAsO^PSjAKu6oO!84Sxp|Be-V%U{^uFwZOPRIubQ3GSHPM1i(-Tln{uyL*Qa? zXAy`5-#}kvokAc>2sd_zapM@dEY?of(u_tSj6XK|vys_KbJ}MJ=4kGlUjl@5O!`VU+paCxiq6rNsZNl&YqdV=VL?cPY zrFk@&Baz3U72`$l^zwlLu4u8N!Fu)tbAygc#Xu^ARp;gh86D_d09Q7dCLq(|r%gbT zjN1f%KS=B%0NxXV_QH{Tq5dQjD1kTx(r^;>8(3PJTmFIoYMOB=Kw^M1j4@aeP`8mO z(4LHg*b%)88M}-cghy-hxT^Bk94= z4nrMnJUP%8@C?Ax@HqD$MjYZyu0Z_5j)_H~sBMa{Pr$Af|J*XflQbX(EeX?%q0L9B z2^tGF2l9wegMda-ycol1PihL%LQ110|3ZB*Lzr|u&~p1r)j&&l(zOKRNW{NX3$)56 zT?;aG{z^6QTAFk{9ylOZ{H1!}MKI}l$asngyi}0cH&I2f2#?4IU=dN^N=I#gkn}df zNEt-XvFn6EC5D5F zZwR3by5mUh)TnB32&iC?8Da>CqyrT)q6E16;mJ~T(c>p!;L)_8?GuN92kMg~tzbz= zQ^26dEcG9(0;3+7w6Wab=UGU2pd|xlMGD0KEFlnaep(R6kF$hf_o9cN2meSi?#vjp zD48lf!AkKDaqcOk5GtN4)shG%6$y;QNJM*RHA{*jZ_(}qcUaB=tl8g>2mwik;3*?% z;WbH597u#?$3RjaNCHNXgh!^6jX$IwZp6C^ zPQtA0XPw4@aG@W&YNVrRtCPVVfy4@g7cYb55niU&qdJV92bT31VLwOp8y)!+lJ?M4 zmHN+EE+=QToQ%bC^47}9S}GZ|Z5w|e6~fB^2GykofTFRtF<(c8r~(P02>=T%cpNzd z0b?G=;zCmeA%N{bNEjT!lg6Tf(6{HH0ekN>vU$5i~M z|4sLgQDLpe#u=LO`uMMTebB;})6dhXrU9Uo(%y{<_5^ku$UZd6GD3Hdz)?LYupDEG zg+vTEYzT4uAW0Ow8_*<29YK#5(Hu5rAaPIt=i~79bHy%mB>}yN12GUm2cisw!Qp0z zMC#!$Xb}_u3JO=lc;*h%`Q2R1H~!+BztWF7kyo7~sD~7HDd6C>#suR_J^V z)|owE3n`?uQ{58a5=KnTh~ov+Z0yLK97732_&8+12f0w2d?DimLI~jUc!;?ok<4i( zBNA+{SSOFgswf#tOA~xrUNvamnch^U(a-7NGIQ?uyk`7yDBiek{pK;s*0h8>+AO##z=#HtFP4oQl_|G=rR*dI);@INA>&8!o~bD4_u@-yQL zgU$~dUsR`TFaPD|=k}j~zkm4$HHrA&3O~gEmRFXWvj6-W&y@XV%KkHD|CzG?Oxb^? z>_7i^>_0TS&Ki?n8Fi*E{``-bfYz9dwf|7v2N=JMwF1HJ>7%^U5zlXshXd$qIOsMH za)AYkoDF3oPtw~Tvit=2$Rc(h#72ohbBtUofLzw;HBfK#An*i821ZJM>T>g=@g~40 z6dsBZBajCUa+C-G8u~JVHZ8+4S%NkOPPh(kA#8MkQy_lt@OMWf0Vo@?D|is_KJGtB z16v(_m5AEYKTQTj0|z>75S1WTKfpL}FvX4-jK)0C|2e=7-#1sNRXl2*Gu^Pi$7A56lEcEO^YQj%3I^ zEBd6S8qMhTO)Oe}jL8V83o#pkoy8jVSQ~988sE}Ip9+(p3K`~6RKXT1@OiAI6Y1Bn zR5DPg4>C@Qz>#_Q*C<4+XMcr6*h_IzG%_xOzeXj^Q21BqG)40Mno{~o9EV0DA~Mk@ zHdj-fU+Ii)wE23JK^J_YnmVb`#V0ajGZNrIyUs{L2jhrHhHCd2Kb1MyoC1!thc+X8{K}2CkA1lI{}adb>y?8gqxo));EOq8>>$O z1d=4ACN{eU_@E)yKOWTwnzzXP*8cKVnBliHJ_veRGkJ~GkkHCYQ&X=?6VS> zpF93Sj|9cdUjl=ckXKNYK&k^hgeOrXY4ss5sXoHsB?s&Y43#`~ARul(fz22+_IDVJ z|L5(#0Sq2@>QhGF|B+{W`!AS*vcInm*vU^>c_RNm=ow@GRhCm$MWK~{9|;pb|Ks-G ziN~Mz_usGM&yT+fm;h7b|8G3M9)Ftk27LaDb^OBrS6)GR%=wRkoCcKQb25+a;xbsOaZ4P39sXko_n4CdC21 z{l8u+|HPS;25cMx znbr(<*kgpw;zvp*x%pEjQ8JY5mnBcQNB)g1k~$^~=C#qABefZm+arIz8GDQw4lFqk zxl}r;UnY7c$omVr$0YyD#813;Gj^jd*%J^Hik@f!V$hH&2)rhv!+u&EH5=J4kmLs0 z2%*)1r4lL$YWX>_lc1D@LDS2He8lN1>}OfQ2*NkrCpTb>6a1&>2*2#ye_HaIGRggC zpI^&=us6ov5&wQA|0yW^DF4YTPU-*u%JaL08k+n^n>Bw*{IkLZ;m4Q$US0a z_oFxmwNa9W7lDD#$mw#$59R;}0x-mXB)t@RixyfGaib6&y$R7FC_sXdg${`=qXjdD zbX3?wWDpo=qDcr0v`PKMKJm9@FAqQq!4C_a-7-)iiW8mGX6*6jH{;O_huzW8F5+Yf zv>S~736%<=J0fSv@bx4Jnh|t4hTeU@Ls*(v=KKx9rU%vH^9zZ_Ljyi-m;4*@)Rg@3 z|L5n|`#+sk{6qGCc{xRuANGGJ`PBaZFFe0{kE8AX46_Cn0o2BN6v%5RtB>(0fHG6D zx*)$huzR2>eh4!js;7Dyr!0QUHOf=DfNF#@IW>cNLIigeMZ~lFjSWu4BDCA)mlGKNK41TfdEa@ zU2!0EJM2Fg{6^&wUN0QlErwJYf!`K0p%u#|RxG z@S>x^fyb%&XBfetw7&om%mLR9h=Tqdp=kt+bnR1E(yQZoYt>7Rh$g{mJx--XKhDF81AQVXaZ{)6t#XJTM$0KE?7U|$ChxFh%> zj{(1+o_0ioUkcDKsI%Z-iqJ2(1yD*Q=oeff^h+6bfcx!?0b)sXKWB*F`Y_%s`R&!w znK+~vAins3XRy=M80s5XiJ>K>sxj>Bqs+myiznlFZ(~I{*kM~R`xx)Y&@ku~^aG2` z2rYyG&;?KGM}!LS75RgMo{J7XI^so%W>jjV0F_h+M|kYl!EYUZ&?f?kG>CSD4oI~S z9pS4~09+}kIH+_wwa9X1A4L=7aXSGy42r;Srwfc2V^Qd3)Sn~tI?~3CI&k1Gh;VlL zVAF{EQDtRkAMpm(8mXS4HAqPe$|jzqfsED<=(MA|3t`KQ9fo`u$$%bRDugHt&k}|d zaP8CrVE|n~qQ6M#KU*LIO*?*pFnaW#Ef8WM6BURsxIbAS%!MXsGJ**GCkuob+1LU{ zC4=?6e}uzXAi6V|eiecS$^5(PqW8$ylNPF~?oRn}X)<_W`@qTJGZ6$O1dQ8+I3A;X z=IOQ?Pja9uZJ_`*DK0Jw{}=pAbN8lJ!I&O-2`7Xq6NLz!TymHyQ9ApZOcp9}qGQYy zBU1q+{O6{^3M8-x^;Qq{LIgvM4~{X(;JYx$oeNmF#QFGp;au@>91bu%U;{rD#{i#JeWJYe(LHFQrZeB=!%!s{^04k>0o!~b3 zA(%Xp1h}CDsnM1_q%a^gLmM5fE(}OUO~F9OVX>l6+pyR%CDIc(j_u@8eMs*$EEX=B zmV&V}0Z$n{I*elwCc!}~n#y0m`zd?ksOQ)AKdS%9-#7vM)%l;I!VmU8Wx1*IzklWV z-P;$<{x>pf{@e*5SeKnS?S$hIHg^WWO@$Axhj@$P2-rE51Mgv$@FAcGPe;e#>P7+ja}-cs|z*c)TA zj)Hp`_cb*$f{HOF_ZS?Q2|iFupy5>@rv}utzfpXCQ zD~2 zF9-ev%9@6}651C>cEgeIL@ykfsu70R^D!alxWAR$Y@TVhP&7BB@TZJ#zzD$mGR&0O5k41{+3-}js&&CMQT zx1=Q9*V=CIXhyel)6qH7QKLnlT3*m-7V-ba&i3^D5C2>7 z|9vFu4EO>=PYc1^&{4Qed{IE_PoAh(Y3WqW{~)bL@-m4&%mQFR{J&OfYnuO`v|vfF z;{SU{pFM02WdK?`%#0)U1FMg6T_B9)C42KMHBb0gQ?Jq|Ya}g8IOCAngXjjQPK-~D zA@12tm@qTr3K#cWVlZB6N?+**G?zu!V%_J7J={gmgvg}HeDC-{dP8K0ZnpDeQj zZMN*=))J+$<(PFHQ^P|D8|&FSGvJoVNdHRsZ4J_~ZV+t?ljB%KvvCX%_!(_#y9p#q`JVzrDHfWQG6x zNY(fsMjw&{{sjJ?v{w9oFKI6R%{}&tE(O0^8@KC!t<5Jh_}|%Tt>VAmOWJ#Q*zXL! zKkG8YGdp|r{J7U)cD>pBcB|8D9u5xkd*#_h97!i`HoK>Eh`-{F`oVcqUrmoC&Cj}` zVhuNT?Y6b2FL~cX3!1s}K9;d3+Q$jM_~v*QgD>K;|4O>t6%76x^1#7}+6*#6MW-hj zXCCN{3BMFRzM;6++~f_K zjUzGIw{P9}41CdWl(H$Lz`h-e_i+=Sn{DgCo{vG#v3MQz>8pLagFz>PxITc7ZHib8 zPo@+?;2Cqq7>qmKe>FI&KgC-1ni?j1cn4bBvi4kg#iYA$V`+@o9Rc_rH)CZkk|&x3?}2EHfsa65zx1wNBOtPxN6?CGZ&y18Wt#mbz} zpGc%c90mU5fxB#3v!Rx!9l@tr0$#E*S~vqH1`&^e8w0wHfa2WWhK*tkF4=CO3T?z) zwwMU6B(OL(`Bn#zx7!E)5U*(!O9L^r`DQhs40!*CkyjPg3@amliiP{nwO!dnp4 zB2aj-f!#jSnZ)Z$)k4k3!A8Fk=^ho!Xtth4rKY)58d+5zz=l+%)rwN|i}~9Oh`2E}686J*Vy33+s;o z3hzYJ{P$%PCX=@ylUtj1`+0K72KvoxpO>y%IsR0=o!1xD^=ZiGPZgl`qyxAU2DHcc zlyWpLU{TjJJs}n5nW;I+XcBr_8gF8IIOp!$slE=gFVvo+AHIR&llH-o%lBc8U4_mg z;mF8&hWB7R;u_s7@!14a7ZHR^=(5ZWnUj)(D=#S{Q6U?qg_Oj}n6sfAdNPcK!y8uD zXG&ZqFk{zPm;mWz)!`*6FkOS3gnA-DE7&kc{N8>2n%lNLOiS5zLJ&v_Mee^%CSdVrx@{*VgH7 zA%|2Sr~$x>XD(8m$D$BSS>d8v%XFizZLL&G1WiW))e`fe@VJF>@JrEG?8Ec^85C-c z%G6s2*zdJMaZnIK;jynm4v6#fVm{?Je%AS4I((GCqKB@tQg%%!=18c13Rt1c>`@WOgtvN zzkz_R1GE6t!(j~SGBBW?DJ}R@-4pwwd)(~|n667>lD26WS|J=te-cR_Bk7}79^!>u zmlEe4g;9|}&C}Yt0D;5;P=Xbbvje;ZSdPMLB*-M%9f{Z(v$fxTH=|YuI1u+nX$iglb5QW71cw!70KOHD*|7sat|F2*nr97TSH8u?6A7aH;swnrWi~NoQf^^u z<+AH}==uDZL+Qo~U8yECdV>^(|1Z!?7s(_WbcXjt5fO1c;bM$S;tD-#HfPw=a~A2T zcJ-7*?{GevJLlN`&0BW}d_i)~tr;<4Vlku8%b*Jkq(HViG5e<$AZF30?DYbFvoeFT zHTw%?c)C=zkz@rR9Wc5c4#8fr_UDcSRUzkmC-l%_1BB**R)l}?FeB2FMZAqOw?<8a zbwNZ-QkwLIHwNw8rLsQAJE)A~ZDH7MWI^*7ZZ1&inhQ8YD(E$Uog@FO(FKPf6hSj! z8KE#VxlBL~8)a!7bSF*SrZ?g}UOXoCf=*Gd_ zla9GsH!9JzrkU!KM$MdhOBRqR4U`W-uOp+=WJaI9;vQ&zcx8jJ2RdWny!&?&$$j_? zI5+~NV!&rpSjj8w(8Bx^Hi_Y<4Z(c)V{veQL92 zTWi-7(?jLM${MwEigQx3YEz(-Cnh-Ue>a1FmG2m3}%i0CC9@GpXN0iX*l28K*k?a%!s6&j6BkKupp$W0z-^zTf*#F&Y)K{v5+6+hWYXs_ zX($I5&bW+D&FYN!q_H=QU@b?D9T*ca`X7A8Bh;{uSpMDA4p&MCghQM zSy>~w3@FrDg}&fsT{@OQ^1grgyi=^C6GoA|lnHhUuN4lm&!PVkjX{_z0z?>^Zg7Fm zPUJhm&d_C{M6h029h5>dsWP=G_7yZ-WBpF=DHH7AuwN`S5DIVaPR$abD!x1non($d zB(q}_zX$vpoxGANS_P`u*fdn}c#0~rVWjqaoOe*+hNiFJSB_^5&)b{aC=%i(h9j+L z@-)24Dh2QWkemq*-> zK;LLV>BjPzm5<=<19tt;CEHupr%-<{6v+aiFkR~ z9F{d#;@MQ!U|qgzX|t4`k#G(oj_^zJ8L*?pBAJ?vOx)Gz05R#1mIl40jFAT_m(-=N zg!e3+{}$B^>sg+}A<%{|W79^daEGX-P&N944TWq#>p&;v@5v6AI!5q&SHg4$KsSca zgb7^cq!}|k%}JkVk=BnYUqEW53K}+(4wcq3G7`e0V5la~G<0uy`UI@1n&dx*X_f4% zMQb6MRVi}(hE^S(u-49Q>*?;+<0-ppYE?Dtd%J0Mfo1hmGpzni(p>v*zB<2i8w>2e z+pU@S4^N(~;=kQbTG@YB_TQEL_b;&jre+l~`I?87-FId8UD4 zmkhx9#DR5JO&(|jM)QW5;`5zkK1ZvOh(_EIOp$p)F=!&v`=W58HDu$SBF-*h!5KJ` z_M*+s$ZLnsPcGKYrYYQ)4U6<&5~?7bn6b*D$%0^J)IL$iO-xYF%tD=Ppa+Njnpv~g z^pd@1Oj8a7WlN}lI#b~&zUC3`Lc5C443Y0p^98Jp*&I^xW=P3$!_eYk$bc)=Bn*nS9NIsZ@958U3b&wB zWZlEfu*M3TBaMwhNzp>kU=9l1x42dATGg}(9t}0z>0hw#;8zAnr^={g73$n+V9BSA z_l?we(=Xb8=d{Vz3Rcq#;4SzZ+LsPYsDL+i0Pt7o#=2siM3@T)a(nj~R~jw3O>w)i zQGc%K%^A$X2K${Jd&&;Zdb2eftMS~L|MZYHt5EXQEhsV8!ms!hrxmGy zufK+0+bOa%@HJ9csao_5%)^PPw$neMtIx8!s&QTBtenb`x^wM06}Hd;lQ(;!W<*!h zyBW`A+e}9SlxRjfQezp>Cf|fxla%)^Wq=oRSj)`AO*Ia$(GR8?lkucHxk0l>_&xC@ zv(CtUrdXnqX~D>rYK!LlA#^U1LN%%W=jMq#eve6}oC|%A$fku8Pg(eAZJPGi7Hqc_ z5X$^&hzBDrOYkugk;Ydk60@ZXc5P<)q8+B=?RG8>A#=NJ`~$CN`~yf^P$T*X#@H+L z_ML}A5dk85B1#nZq_3Ru4NPN!n>EKe#w2P9HVFOfKoWbANX1p?nIlt32}mk4c$l-M zH#!&lnqFzad;1>g1>Bn(>2aiv@qL(qR`7o?S3nV~0GDUdRRsbiT$c?0^h_bETg<1EeCuN+gGgtnk6OB&^3A`hOnAV`!Ax zJOqtO{tE4Z+!A3x-FpF}3C3YgCK=jWMYNkd96!N2PQAKk!i``6(u3ZzbL4>VO5)KG zk&=K_A^}7N9hs5Q0&kE$F*gStFeC7Wb&|;Vc5l=Oy-y@l5VYvJ3JP9sJU9U$OdD|V z8ywW36acPMG3GrV@Lp&X>6pXPpk7CikSdDtNme0%U2Hr+WBIjI%-j&SO zu0?orSfo3WHUUiV&`u>Ej5sKDK$P+lhU(#ol*TZ!+ec|1=`9S5UL#Kc?e$K(XMm^9 z>De#UVj{IskeEpA6zQ=_Ei=h!hJnu_zXJX>qe=_kDlGb>7l#xqt$y0CUz{DB)CVsQ zPQSkRvVxhN+&qFLA1ViEwG$$sN`kr|lKcc`kfHGFS2)Y5hq>AX#CNMO$G#O;K^xns zaT*sdkc*QjRa%&%sGXGLO)gCE5GdCtQ^*{FGCRV_*NlmXIm5l6qeLJIXQm*KGaiq* zu1GhMq3i#<_bs=mk?-wk$@TVhck^Gn8+UTO{q0UQtkSY+uK%yN;JjlSi_U*MZdKg> zv^xKBFXJ$-kTuDg}z?!G;DtAiUW2j0qow{qaE9C#}S-XC$`rSspE zo248|>uzqlW36B3mIO0<^luU~2WHL)I4D zaw{T7!uoEKM8F9`F&;BMRG|l?;N76x%E2pjtO4E3jb10niozSv9VC1W)xJ1=Rrm0K z0`zqP3f2hbRp2L5-;kCYsRis8pm#aKQe0IUV!{awE=(dvr23a?x?&^)i4_@A?ZZdx zg1#ckN{8IAdNIZ=AOI=qskVX1p(p4fz{)l+gM=DO3pOt&>HPBI>{wesb0Fij)-u3L zya8ZCD8t+kwFZJF0u3p7hX3q z!wi0;CNctyha>8m84Gqe9`o43`_!=@kw}d3xC&OX2>O1Lq93tuP);C&#XK7WZR*?E zxq1g>b+^I*sKdkspZgy69SRs&LGZ)S0Oh{WH^ry-hZ}_s$q_;5rbk$aZc30!)m=G^cyz<)SOIRi z2OdEjW@c4*hEClHr7RZQ*U-wXwG_?8P?9Tf!gY0I6N5B25 zELcQfP)+87MwoG>LI*MBmH|)q@+!85__Qxf345IyaRv7*!%69@jN%H?qgJ4c^tC5_ zXWU%FB-Y#l^TO)iDF;F4VssMg<0vSBJ2fdoIy-tKa8l^>Cxu&V+~$**+u_o z@a@5Qm-Q~#*?IqU@34Ew?1Kw!wu zv-9r71?!(%y_2)!UKjFur=8^YP>?GM;-@1!??N(X(04VtQY-3zSjqoU_uu^<`6-Yox14)V zKlhw~Aj|~|bP3{lyAASn3Bm#g1qB8Kdw}lUL9_ne{{4eMFCKm#{yZ+sg$6ES9wFcx z7VPEX>kIp0y9@%u4}t^4+yVlJ26=mW@i4CdUw031(bWSC4JEBZeSulI`MP-faWHom zKNn9A^i}|9C5R0lBZr3#_VR$2V1F*)pBv9Rz#q=TEx?}_1io^>G=q4WR|k6sdvGw9 zAn#xZk^VseejGN0CwLEx-xcGv$!20;>tly91 z^Z6sD?|*zYA4W1CWb|elD3RIQ{zo$T{9TEB{(rG}S8xB-n2!E(AK$V6_O!Csum9Tv zmISS_|Na*~a{~Q6e`2?R`}ZerFZUqudouiQSR4HG9sXf8i`72O+uemX=2lT+-0k)M<}7V++94D?LA<(U-cFu^%sQ$W&!|9Y}j!#dk{wCgpX>w~bw!L@f-Z8sQ&k2E@ZJhSQK8F5`$4Q%5L*7CYFV6z<@ z9W4?U_MS27nL$~zJ{@xMi-k5TmMvSBl4lcpA-TomtcN$GG2_O4IdbLJrP>ywgu)FO z85x^54@l*KH;DtoTg*-QJU8p%m8)0hoaDEeAO7sO6`cxrEUSitdA!Gkg?Z0Zjb_!E zIw~|Y)X&e)*Z0D&KX>nE{Qkp-daSjF4mtJdb0>=T`Sa(jtgN8a=2J1lsrzKNXJ&o9 zv$9Lmvw52WieA2aSyYs`diC$TZXM#2QrfvJ96M%+gN;enLsq@4nLc}uKkS#xUmjfR z%C&0+PoAV~*x=s3KWK*4PpMQ!M;9l1#!IDAKA&&rajNiLle(;|9SI3PC;FexFU~tR zxLd-$ef#`WyLRpTwmtc)nxyjL@=wiualNh2fP*t!=X^M@YSoDGeZFM( zoE8*3!N`Dj*RfYb`)xic4rAYoM~!-rHfXb5%65x$2V-A5Pbwe(@zq^kH+xIV?c27= z?;oCUtBtIURm1KH=N>-9S*#YEA!{d$95SSrv-7LhuXDn8dw2eAXRhnQ(w9T;MI<>r zf6=z5@rC2qQtbQ(hRqtVWdHI|y|w z9$v~~+4Y=zZQG$;q5%tdX?E?DuQJxonPbFanKeIm;fPcwn=pR-ty{O6HfshJ=*^fu zNjb66(Ya;a6MP&U9G3f6GFix)56x^-(&QIXK5^^>_1Cggj2w_LSy`qLxo z^6`EVg<|vVX-=O>h$5m2ive{rSkc+ zXSG;I&z(D$oei4IzI!(@r!YM|{bNZ<6T|86->ZBL)*icdEvER<$+;~p%SBB-K8)&R zy14i5`^#7Jwv3!`_V>%z1BcxB{OVv&#l7*t_aDrwc$ZW$PxkD{_|I>T&uHM}n@Z-miNsh5x6B842^Ev&nGf&=6d*HxDJ}JA>)8l{rmEEx6bPQ~*$=TrmZ#p&Nx2m0Gm6T&?X4a}*yM~P$hwUAm z5N;9}YTr)X!KI6=m4CafDSX z<$={%55;R<-~AGwk?{+`UwZzR(9odqnadW$^KaB1)yjFyn^EJ(j|XJogLgzkgiKa+ z#-NlwQ)*Lwi$fgG9@Ts zMe&ZCcFq-zZ8tYxI?c*(YQuWT+qQA-?06|b_TXno2z!R>xN+k`LvMS=cQ7)TI&a>* z3l}b|U%&qO^U;2yi=*XJ9U_ov{_`rUX^Y;|C%9;Ax zZ@=x@y}NNo=Z0CJ{aUqZNhFdrYt~?fOP4JxeDY-LkeyTeC#P)Mlx4LgWOH<{JMBK& zo;sdiBKUcbT3xZF!O`2d$DLnlF@OI2=Ik!Ldfm8q(f`Y`q@=KsBkzIfhA01IaO~#o z^~V-&+h)CG{qtwJO@99Hg4Gj#(pThwC7k2F9w18ZMOjvNuJ^o`Yklix?{3Dv>={i{ zd0iH#vRFHI9SebTBOtG}b-R$g(Wd&W92`*KL1I<+KGp4XcwR%-lB$G&r z-@gas^V;K~>jE1#YBc)83cS^}?b~y5asqsOcJ15OqeuBp>$vFR^OrAg+Y~TvbY%Tm zvvTDfEoTbv)wjKG{WWaLn9hsEmld^Ql zlFnVbdU|+F!G;VQR{E(pA7C87{I{RSJ0~SAT(~x|{W^Tqs7D3ar`q-$xnya~s*s;N z`wLH=w46IPtb+s3$232A{gAdj3=S8caveO_@%^GPak&>P*H?7>c|w63v1y%!g~j!4 zBfexSCg#6*@ddO$b?Vd`H*TCb;ofRy$G#KG%03e_TpzxA)uCCl{8z6Qn7StTBrdx? zw!nAL$dRjjQciVyH|))rHzn66?33kh8(B0f{Pd?|(>^?YTrv0Trh^$Db`7~AX`KD@ zQGmN6h7S+fHr$BS&&8!yQcg#JJq;S+$mDG1vIeety1HL&g2WP8Jr~Q7!G9x%cYp)X#Ye#rA?Z1!dbe zZSpi(bm#Dd+c`OncYd7oVau%ZPU^BTGkPDK*J^!8)~0~LGiD@qvnX2m`Sp>np;vD0 zt+nxFrXp<5lvux;Kb_1kK6dQb-Me=icjz-2n+>Q>uU_vF%a$zqD&KeD|p%X=z|-dvrVA z-f@4}q(he{r%ivh8*4Swepn-3H}%~NwXf;!Lx)Ce4Iz59t23@4yY3#MFg_wDBuAaw z=IrZ)v({fTm5ReyYDY}a_GfVv29WBhFN>}PU|VRTe?JL zZ*Sz;e*AO3*7;~EYJbzxV0sGeW zk+Ms@8#ihkdtg$9Q~mnM={o}X?^~@6H0$6z{?p5wyB988c;yPOd-v`g;s=L>>>~>O zCjgl7fW#5sL49%b=QagEdUF24Id(rxk+e1_b$giN)2IBYEBLb)gx@_NvodaaIkkDJ+T5V!wXH*^jc(f8dfkoP zU0;{Q-P=I3*f zo%%k9KNqx)c_L}Y<;KjIu}UCt8aT7-qBoJ(KIIqhKYsjTYED?DaoW`=zDZj@Fpy5^ z^1Dj4+9UalFe7C8a4wJR=K(^?|-Q7)KSA% z7k=8$zcqf{hR32Y`{z#am!69)GN|q1=2mCfdHWGP_he>f9zHyBYe-weHxG{0spE9x z!GjY8+36PhFMTaob;V72Y_}BTnmm@z&w9uizTbFf1J~tsk6HBrvd6Gtw{G0<>fE%GiOEv#h|!Ue<6hp_ z`R2`=PoKslD(1(ZuT$s9iz1J!!y@WfS`G`n-C@b%7Ihv!w%ZySE4t+t5plbq;I8f9 zGaIKwnKqodcJAB({rjJK^CoKO(4ld0pMkyrD2mAD=5JjFyg#IV^FYvGsWXe!eQ@dW zFd*}G?n-!d&UCHiH=&oE-RHg)!DUaDnJ@4Bv#eYDcI_@-zFhuhR$q5d&q&qaP0t!f zK6~A<@7VX|rgLmpTpyX$KjGG?nXQ^{aEmYaRQz@u*V;76YTL>{vn3lgY&bOTBRA~u z@UZ1>vwXUCO*nPpSEn^=_6(ixV;bDPSK!owl2@-@bsxN~)zd;h$tI!A(4?{PUY&ar z8`+yLteW?bh)KSbUMKpYYxV=|ZM&RXw=%#6K6o%Rj5SYo!ap%>*O-#}R)Zq)e!u%{ z{KT>`bsxQGSTF15%>xGx3=Ly(>H=IkQgQF?Rj{*P$)yfr7OUa=62O2q&d;$0h@O+P z9X@C|ox?gXoV)n!rI$BXleFKuCj|QYFa8{NYWmU^xr@8rEjUd)be;c@)wle{RI$;# ztcMMUOiymgYP0v^u3a78k3CNu4J!|lZoDQ6Ui{$H{Qg<^sZ)=;bQ$sVQQl8eS$4w; z#0F8XN3QDq?C9#u%zd}h{S=Ev+h>l8?a-!Zl&$RojFrlJUQ{%{Kdasz1J22PvI9j$ zr&5c>y`$DXJ~l1J?w0{R3vC-^MMXxwc>46|g(JoW{ZfJe*4#~9+TUT(Sze35maFG@ zbsllR=JpM9^M;Ulm0zFq^ZJGrWuG6Mm|oj@h`+!8fVqu=71C?9EG$gsoOt_U`-(mL z8hLsqT}_q!-YlhQXs9mM^^&-o-hF6}} z?d^E`Q54oN%O@ox)q6 z+Z~qIs_o+V`Db_jy7frM&+pG>!H=MTaGSQ{RL3-<}a@}xqLBr4qN2ax^-*u`xgasRxC1_ zjE#!$T%Wh~vTxCPk`ligP~cs^?Cs()F0ZRgH4;NPS&!3D7Uddf5Vt+29b-TRBNK`oXQF}UNZ zmFGuYSo*bg!T3-3<2lVFw=NIfj4$%Ke7`Suk=fqc*HsxMPtLbqwCMNo-C3;3r^dUj z3!IGg%8Mxu8^Gdnm(-~rBEC}hB>(0br@q!JX0>nM_&`R7b%BQsje19ys!}$(0S1;d zF{7PmPs5o%@mm3<2r~}9C^j}&n2?YXEsku}xN$fB^3O+C+Sh86<+-=b$Rp+F((f;g z9BgIP(9X^f$dg~Pd-jb?IC)~s+V>UnOuslgI|n<>i*#{b*o3|4P{MQ737f`7jmn2+ zZ{4zG+)AUFOSfzpmfe^=Lnxa+S}NErnT-Pp!{3cPz44`Is>IWVd4>($dxS1;-2CT5 z?b;{QVFeCccYS!^!Qb6qKd(E#cbYT6z~o$2hfcm(L%KH~5dC#*e#r~N)0yoS`ySDzob3y(ojMLyU zuLbAQ-E<%snszR`Gh%$npqslyg}ZjGSrxZ**`g-X$Hx%9HKdUNm4xT2z>(p!s`zE@2O3+o@* zeb?&%?sd^eIq!1Dq$4AUasEK?IMp3+e9!o8zP_2gimZCr+CEB-U%v<6xK0gr-sp5$ z=%>`+yq>MY#$}gWPU*REWo)xKV-wywIi)Hx*IoB88ha^YvqUU@^ZxynIHRj}7n2GP zRZLuP@kpn7K(-R}N4 zOVvrXg2lSHI`!V+#0IQ>f@I9>>HZ!aY+B#HyvuVpVdV1s{IVDFJ7aS1T9_^_u2pM6 zba-A^<|n5|F3WvQ9hHy0MvqRLva0pYz5wxx zCw+~4TUs(Wyu8a|^V}C_M>jDv-FqZ1bIOJdb0c!LCHCemn18nK*FA4;?A+vQ>hUgN z#o_I*?nVw6a8OmMa#-aw;bXXp2arQFt5L!^VcPa1+%Ip>H?Q;c%al6a;sw9Fc>cVf zaYMF^onunM!OnQAkq2zr&absf@*wKL+b3&^i${(eY1h=q(%364t&~u%49vJ;Y8+*5 zzFKs?&k)YIc8#vz?_2(IsAA;E7d(r1_K{_Im&X^qJOfnZn>Y6cmn1E-{K(jt54{~FetPzE>TY?XkdW!mpSPbf<;?CJ zz+<*-*>b=9L;B2;vGW|8ak<>XK*DP?*SllKS(b;r_Nb!qoJ~omlFgB+_13l#2aWfp z&1=?ADt&qMXusfQ-EMEbdvMvt4N)9k;BHr-5te_=eVUa#v`ee5tgc-*0afYvaaX(f ztoYL-GWXxh&Yu0nwZPWbv`hEMI;JC|Hu6;}BO@cAcUX>Gd#f~T$7E&EEyc#TQRVio zCJ(od%wF!$)Bfm*69%P=u8M12diGv+dtd7}!M*1{6<<3*L>7J&$eSjS)}_IhdS_f7 z|N7qV73Hs|ANbs2-}txQFHd*0bQ}6GBO{|*_wM!`5(l1AEM@V!B@AD1u176{V-;mN z`=`|(T$WL~9x%yIW$)aVq-+n_{QAy;{MWDJ50};n-!^^Hr-${M&e?-!)m!2{9sl%l z=)H@HvDxW!SIGP7O_; zS@9{~ad+WQ9h!;lHm_ct4y2{*8$}a)_UxJL)6puJb?@H2^UEwNo^47hEuFVxho64| zk0&iuMtof`CeQFE(b8p#(7oq!%6`8z>J`?mWy`{%qOW-YeOq5m0K8KStz;^>XY*J(aE`E`b>Nm{`l*_#0%$Q_6$7pB<=O#?iFS4Om^O| z*|#kwWeD{$iLBQ#33fAZMvXXuEd4?}KG=wZz7Trj0vtoub$CxravH zx?vpqa`vbEj)M28=56|I4Y{8gw|nnib>2q5*=r0MPTt7^%aXQvb6#Ga-@$F;#p1Uo z=KQ+2YxkKmP5s8ScUrKZ$BGqA9Agg`JmNnZxz2Un{;?&ahYw%9sq3v5y;W1e+XoL? zj>vfY@Zrwr{Qh>%jZ`MfHY#?duyO){b+^J{0K2BzNE-8qa{rUNe7Y&SDLOk7bq(2>RI%m4ON$dTW^L&^1h*dn( z<~|#O5>5r%t?=Ek&(x|_54)8KwN5r$ERo9(t6#KOeD=;BNwcxLjob^)bHvVdTmo?% zmq^T)ogZ;P*=66}(cFE>cq?wVZf)A^DjR*?ZrHG4-MV$Vwl#Fw(xo%wR;`)aVlA)R z?%lh`jUCGu2$ord_89l|GN)G78-RoBU;F1RPv&}U4H+B~(xQ3u8@F$7AG&+yNq+V* zPrrII@dLvbln0({SMa;dqp1B|1}y#bhY;|GhD5&PMSBI+qLN& z;!=^XXyleUGiS~O+oo;XwtYW6s59ZCEj}aMC-2s+TbC|f%FBC~>)A0oZ9XfR2v^amkDJAuBLBZQGeM}ZTEi7!=y!qq8!iZa^EJ7}Hs^y!! zcW=qVtXXbuZpH=!Q?D#pvLtnBBle8i@u%~n_OD2^H*n$a9KvZ4zhFV5#*OpDcHCu~ zzosWAyKM~tu)VnW$(c;A>HgyBZfyiw zvb)KmLx&C}BqW@S2$@|rtnQm5GkYg05AjWD&uCd+`ERkaKN_U%0j#r+%43Mi4Tgov zRV>U~hDV672$39CVk0BsJpBh@o?-=|qAJjt2}LmyfygOJE>q&M=Ijd>_RWAUVs8(B z_ie7Drv4v!sB1p|$xpTMAB>>(zuL#Q<3H@|t!-@d<3D=#u&Rmw_-}mvLFfN!@_*Kx zA*?w=SaXK(hilx^rv|^9UA5-uV9n9Nnxlg?M+g7E%KfRErAU{o!49e?ZB%BuKb{3t zh$sWhGeqVBC78)T$&6e2c{|B`pjeb5N-f1IdJ#B91($&7b%hAnaEY_IgFm1MG6TuI_irQPxE%(29u$Qp|=vc^`K`b;C< zkjc-qB97jvWzEnkWs_5o=?m2;;n!$2C7Dn~+z2WIrW!B^%jEM(ay5JEe(!md|fVyr@4?wp+atP#>LOCf><6O3z_6wp9 zC?h4Ex>A9`X;KA>V0JTwUd=kazS*e#2(<7Jq4^TNRH9Ic1UMH%c&ojjO@9g1SU3nx zRVW-5h_3=YF}6ZYAA*8|W|mLlVlG&?T3!WCe;eiL)n;qv1J8ShQ8Y&+bCv^LhXhX_ zOYl_-{O{zLRFH|{z#ggctS;yPsp6#6WNFW}w$u^ggy9y{IcBh7QI~LB7Ssu0Y82$Y zM=Y(XJ+CX4lZ>=F(VRwtN<4$Y3PKd22E3!1WQEn$RI9$Enr=BYU!bFNATy#L(r!f) z4Iwt+LW2s-T@8>9+^ce}|IqL(^<;OldLpG2f4iC@S^dkx9##^>scMY`KxrjOBd9?m z9z;zW?0q>i4YtBIw7lK{FkaiUm z168m9Z9tO0tKgsTAUz>cW4?o2!rTH~cwSo4JV-B3A)TlgBC3og@H#WnkO^j5Tm4+x z@L0KizF%P#Sn*Ba8y(u#P4cTfOAcWVc!rW50f~O3`~_qcl_Xpetw!nC!7m5>0&}E5 z$VdhbL`}#TP%}Tao4_DP<1sjyB^V}jW{TRVj{s~m`NX2DTUCR^S2$gB%Zu%9M}| z4VenLSR|0Z=S3<3mqSw+f(=N0~?k zuS(=G^v0D+5SVZ^VJbq8K&_FDb_G+~=Fo~*rFZpUi0Qx(C}Skx*g6V^M$yzfSiN~z zgd{K-^(aF)06PG(SV*?vDv-DkgG(v75I_?adL?v#uF>!;E9p|uzKzO&!ot0pEE{0r zXbr$45bGfU0%#uvK!uWQBY-n9=~kJCo;Kj2H1xC)Pm`y3kW6=jYpQcVKq(;cf*LJ@ zAVD4p>lDk#q|22sktSkLWG7pO!U$6ep`}g*B$pIkRHdB)iYy{6Re)aLk}(QRs$!V= zhpbmkS+;%aPNv zYp_eC@UB3_*N&Q|WN`L0DZ>?r2#DzP;@XEOt0-mLVC1zX3n5dOzyZLLP^3vg+myf@ zbc98O!+KRIgc3M%KsN|>WnMuR_kf_HggYoULA6^u6=e~oyfs`d#6{GudRsl4U z5VR5nuTYO5J1)RlS^?p*No_G&jm81_85kpTh#W+>Es!!vK-rXrASLNC$pOjj$@&Ef zwjSH3-Lh3~0UZO#XaGkI{bj6#!w;_nYymTab}BByGIW7UGCvc>3W@EU{d5>HS<`{t zM<}IxAjy?nAfmIm!}8$_{0I|B6@-XH3)%rm&Ia6cKsU|IH6{j)x0_k8y}t-x2($*# zyF&B61`5HnMyf?FKBVJn2uO0_Gy(?@ZwQSKf)t~)G;FkHGpZmkU>orLa5x0?KHMM@ zAWI-SP#-?bOh&gAgyc)yff}Dmsiui72PN)@qzjs%)UYOw!jY~kj!OycbJRxDPFB;p zc4V-eM+_=<0|%vGR&lRp2}l!ewTnRBHX{=c!q-AMY9NS^f5B}Xt56C@jQGwnkzof6 z(;8K!hvonbxeSN!ph}->I;Dvbh4WfB5xPtdNZ%ky50AbM-5SvU!VqYI=qD!?3cUpj zsCEp4qo<3PvuY9Y9o_b*ws}0nq}cBZuTcBFcN?sA*eQ z8mq+r-GluZB#sgz^qzwIUm2sR^#Zn@sB-f@jOLNmSw<_&3caN;fz-mmRH||m0u>c` zl887c<(NjO9DzEma|c2dUN_NfaXtTorg5}CXci8(iK4OrS$FwDptP?e*g0rb`yX*l zGr*vI?;FnO>hN97^d0=D!$ga;;3u?jR4SjM-wIVoMW-dLe1YpbV4%xWEArxG(m#lY zl@-oPpw~!DY#mOk*8@^(2@ylPsbUzq(hjbXc7W`wqvTPWOUIL?rCbb2i>6nk6^3L0 z+WJF(iC@8%t7lm7?jPY;l|Z3w<_|J1g_dDKXP^kC4MqMiKI73|ew$;Fi=dDJExY9!VXH5jMueJaGCy47(VU)kSw8T5{OXH zOIjHUay_Rlv_U9ENZSDW0~+}l<{pN6p`Dfx|A8eXeZkdZ7IohYM&O}lzqh)iZyBTU zO7kAQ^N@o83P{y}R)PJHw;5~0y=adB1!=w zYHg4dTm1oWDHT#F9~VSc3orVC?_q(vhzQ5W)?mRu0}BX|3J1Xb4t>*k%8aj2NJY5( zJL~KM=r|gvP(io>A!i$RxO9> z5=JD0Qlf{Bb&IOttSfZtS@Eli)}e_iG#k>zpefaZ3Lb*gQrm&P@eEd6l!+u7hfG!G z6Slr+smqVFqBhNgn4%^7FRK}B5##x9Myvj9a;#eU4KY@&{3B8`WbuHL2ZEnKT;1f+O|wv-ph`ud96&ixvUPdHcP$)LRdYyKqm;DZK1L!_X!t$U zwKY-$Nw@je}_sg{cg{MA3+jlEE49Oa~SI5`#-2igLfx ztF|SochZAJ8;kY&#dHb|M@g8cNhs^GNb{$rY0V5t|0^UqnAVuj(b6t55K*nA()t!s zMHFI9uoeW#*=SFJW(jF`0jZM{qG(gKS_UWq!*|MHGXgMl0T9nb&}}LN3NCH%UjCmHq1VC!}~Ynmh_lRyt^n5kkEfZ?wOuEomY*(cPYKXKDte zrKZpkr$HQg{BV|_cez?anUzS}H;clBTF<#TiCWc;0RQVFz@_21{wQ>NCApF2o37!G z^kaW#R>-vtqX3k!Oe&N}pyNtGR9Wzk>- zQ$Y{V|Bt%TBNQ$)C^h??+UJO3X(BHP26U?qN!FuMnht1c#l^erXO!7ShB`vQd&ej%!3{Skl(QjdI3`q8oO(uW10;-SG`6f-GR%W>j| z1_sZ+erI6lk-so73Pq|O7$x451uH1$5JL*BCaA4S`4&FQlyPZ2z(uN+{e@&~4@tq$ zQB(rsYl@yrU=RU$z(XQLWLa4$7M-IFj|imQ&(xU^0@*Pjvg$F3JCdOxJaqFrS*1Fw@n!P3Uy=tM|@%5I~4Ty`L(Jfgq5fr zkd~B+*zZ!hZ%?X9lPwwXU#-Dc$6%{#sFgD`HyFLaR}+Hon@1{p3t|71$M8Q+7D=Bm z>Bss1hcZ$jXH|#~e}*bz`tIxh1XZj-zyB8c0dxWaCTIe0#1H=#LGukc3%3p(*<7t{83(s?12akS zjbOXFyF$s^+ut8Z`|#)yJpH5-tq6wdEOZsbMU zg`^);qvL+iFu}@B0$Ei7)m2zH;ijOiod0p6NGVFXRFN_bGkVa_Lg}9&h5r^b0{TR> zT0&HbN#81g_lIiW8U5pn;2ANh;2EJZc#P9{s0yC7m8J}yE%?*M!OGUbzET-Hqra;T zo_--b>|a|6?|<`Cb^bRsVfi=q0kgdIw70J&{~P+~<$ts5VQbIA?El6wRQvfK&;M5K z`s<{U`D=ZAr~adjwT=Gz_q2uUUz7juKmYmX<^OZ1BW`I$Ax5H#L)FbyWYKT>5T6W| zTbANv^0$9ml0PcPU)4$ejQ%}Y{`i_Cc>F(<+wae=@}EfHXY_xZ!7qUN>mQxB5B>3H z^7RQ+nBFkInW2m!u9|2P_mSO1VmvH1`65}ckcuxWD zDK#$>Vwh+K{J>zes8WQ(6hCrC<}nG3*arJ2OmljYzJd-7K@Np_BMmLEZ=8w{VMnV) zpnKAu1ZHWgoh2G;n3@jBbESt4=4tC(&6!OAQ^=I)s0IBa?=*g!zz3;`Fen#B5)JC) zCp?O(RAFX%@0yvLqqj-A1R(-XZegT#AEqT@yvj8HQ)94Di3pVm*#?Ys0iCLq7>ZM2 zLwBtcY?+R#G;t3K2*h|UuD%{vlt=;RNIgXNz<4+`6l_noAP*Owht4ZzXxBoRV(@?- z6co+ut;{*-vIvMSQs!lF)to(I1R5VM6hgF+yKmZYJ7%m689|s;AN3D~O0v>3> z3Cs<~{1YY|vQa0K(cnfu0lLVA`CvHM1P^gsDdwZV!6M1DugTDL?r8FQKLH-D zhVlPZwg8V7!>-+-1(4YUxX}-#iqyV0fenQ|2?vY9ByubYmnaFaxL`i!7>XUP7O-Yy zunCvU7-ojxjA7pX!5%?8@QW8f0UBKnaq%7G5saC2?Lu_rVDP8;h!LPqE*vuajfRN8 zYz{V>klY8L0~kMt(?Ol!SJh)NA<+gSTO(I5T&a-J+XJmz6d0}w$lp>7T3b0J>OmBa zm4It}{~~7(r;p~XCZNy_$A>TgQU;PnKwoyH;eZR&cqqW3pj?<4 zQ5mNagO=EgNL`4En!gz*rw;? zFa8`e(|y+*A+$=Zlw+Fy%*+vnQkTg_snBM42kt5OpRqq^Mv7P;n5Aag5_oi3BqZmF z{a_jvBo~@g&0Wwv$XcppASSZ7Fd-l8eMH5C9Et=08Vz6%gF>|M1V};viVe6^HvpP*vbcz8M9smW-2V9*I?nkbuNGgFLM{)$M2wcgBwO|Aa zDI5&)L6IoShPSB*c?@hc0flI=Jtb&Y2%n4qEF4@@LAeB}G%(!;OdUnA%_MSxR4t@w z2g-n`-8N)LqA@T}r9>r-qsWA|PqrB#e8{^3TZk2lkhBATz?3Q?6ubfu2?5lccG&%| z`hG~~kB*U+bpP0D+&?zGF&k?KJ3H|2zvlj_@&5eFKGoX)nTqIN?BhH3e=9pXTYdXK z_@l=D|KIr3*#B$n|NpmDerh}cHJ*SPPe6?);D5jqP;HqW+ElDpriY@Y8ZUs3p`I@)J+94uTI(G&|2~qJ}&G{TSA?5?sM6AR0wANiuD;v0;_Im4C zX~a4Js=je6X5+S&HdQuGE{1l}2nGa9tjGUz-9j@Ej@dH$wgw&B!oKbF`u3B^!Ln=m z`EH}k-EVD8?SB16HPC|R@MGys0%zr;9Y459NxO1IEZ8+tDYVCdNs`U{k-`@y&QXA# zLE9NTs4vx!Pq?G0svP9`EHgsHNR{#9vI9ntoD{W)Y+XVC42cw(yS@o9-8Hbbg5a{H zz@ay5}B6O<(Fh@sj8x*=^_ z)|QBXOHxI~29o|bkkbQnLjX^YpkC3HaH(jF1f34oR&3C=RAoFr*&_1=s-zKW6)p<7 ze)`S2$C0IQq|!L#o+MozN@TO7F9SVNB-9@ZeV`ex5*?%udZH*PrOpugRUb^{d?Lz` zG`M}^+dsghN$#@$3%e#VYBDWPq)pR?vS~s#h*|e^ue_A!~ zFZb~s`=70~mA?J2M-SVY`rrSRPmTSr#{O4h|NEBxk5SjEF+hXMvrx*K?B?MpyIl4C10X~ zAIjT4$u$5oX;qPZ@7mgc+nQLI#6o6t9BOTTJkiCOT-P;fq9aWQ!CDVGI{lVU&aUO62M>q~!q@1O#J4 zNZSp;Fn6$HB`Ptq*`8eTjb7X_T-x}+(>3^gqfg8Xv=I#UGG#pUlL(XwxGI>70Om$z zQ%uTSr){Q%`CE;{7PWKInFogEL4jYJ^@2?rc&v1%LRw^gtiLLH32^hqdckUCI<4wj zp#PRx*yyc+&yTGEYJ@78inKD);5h*NZHJjLfvvj?48!jav`$qB1r6%0v2NRXB?vW} z9MvGyY;=f65RHOSG(HB+cC^tHRU5?RFv^gA8w>~$K;&Vd5QzOPzGeweLZD)|+$eFB zF0)`3zr~_};=si)?{F+mp++%C0MwNbfW0CYqq12-wmUADNEH}QErlg7QU5?r zjDz930+_{kD*c6N&yo3LnyIKsR=dL zMd)vnSvUu#pl@Yo;ta1LqYv0F%(U|V>mCxVDF*pRY^-(sBfT7KdOKLv_(y6!Kk%v6 z|HD+I{$d~B@&8!c+V;?o|F#CVYy3a|h0j0D|AT34GXE}r4(-sX(x3D1ap(LC(z(=x zaM!qUYFs%ruACZI&i|$>hmJU)6jR(SkEm6^yJ9y$8aXLQG zi!oe)3q>-C04c*TPEn*3NPrF&rB;HS51ltE4CfOHsahqH#*wvo2o)&C zqcht|%+r66g%rj(gRw>d;U^q0Mx}_9so>t_(%uPJjam{8-@=J1Ef_#cmy-!mXxWIc z6pF$natVrKCbwn)cnBj6wP;JxQ|7Y0RRl(91*EM&&j?gypAm93>WqHTG9rp*7@mP- zF=~dJ2ik@tr0pO|%?IybLIq^|2%3M%lE{t}iJ~wG3SfzZ2R8(h}gfw0YncZ;U$$dGxPG!eHr}SZUWh4tgo0jg` zd^`%kD@rMWsdh8~f#3&IW5clEShOD{s8J!?_#nu8ERxn;A zTb6dxfw1TlK~UX7sDXJ!z?x4YA&1-&VB0{wAwtAKs|>dT;QG)Dz=tXVToW9v0$Y>n zgz4#om8J!f$_EcH}rt#<#gd0rk^ za6o_FV3!~d%sUth3_;CPXYK7$86-B#;CUv3Jjco?=H- zL=Ws0MXXp(1rf1hN5O`QiUkq=yZhctUP1s-&%68oe4jftuWXr_otd58{myVNZwDVA z%+s6h;_l_<;sEZsc-XlOwRiDw!fe5J9-bV`&Bfh?0}ADMVz5G@C>IAGSeUzmx1BTi zX=Cf+=E51lqC2{9JYboQp5B-Z=4Io}aj_ffX5)={4fXc&^l<>y+k;{~Ts$1TK`jpM z4jvr1u;u}7Vh+CG7v|$^)Pd9r9aMRWSG!4OG zp}Ih??A&Zz+*z2tjk}GL1NzDnl;TZ?ui?$ZhB-UHTd+PG@Sh#W#nS`!!_L!#;|+eY zKsUWPvQLM(_&BgI8*djMND)VGPj?m_(i42)i3$PVc{t#uKw4u8ECH{;-$Q*IWCddO z4mNI}EWjTR1^#_WfVv^^>3=;Y2?de_MW(4y!v^4ye6Qg2Pc)K-UbV-6Wf7!ruA`p# zueqUF&Hevo#y{h~KjNC}<>B-Ty)zsszqmNtdxO8H!2i`7gFoFyy<0=0bxn7%x8aPt zS(+3#%4gV}S1)tVwQ;tc@>d&d#?V1Cym+mHTkA1|r}&nooV%GroRV%jCC6DzwD#QW znY=LNs&8R>%GJ`Q+bo3Z^n3iSK1bJYk^6qyZo4)Z>xSsXC#Q-K-JS={&(6FUT3MBt zmwT{etz=T@z@v9xPBGMMvSX)qzrnrl1tbk?ywh-p+8D0C#<3GwZKlkO>qTo}lAyMZ zqt}8?x3IL-Pg>M}=9njHm2C%f%PT4iHeR`W`SR2P(_EWO&Ul+v0$A3C{`R2vO z`eTBFH)dvLZrL(8jRU@v930htUh2nr+4nDBxia@uVCMxPPySfhqnJZ8)Evg)JS-_G zcp_~%yUDaMetv%L?(S}GIluqfXOPz0cki0f)*U`1;fJUr5`JYBbL-GVOWfva1mapHU8a_*TqzWnL^?Ag^-?~e{n^?n;gS6h;n zcEd8}meHsR8qL&v-qr1gck>1>$y7M$>I~F6XEqB4Xl%2{&)vY}2+a zV9={^1CsM%qoVRF`y{$rT3D=b)0uwUa9}4cx|S?ivTfV8($dmk<4%v}O`KTd;?iOD zsu_=uMpsR64=o83z7R3n9d?iKRl}B_j~n1G5*f_29kDxDBgy01QezseM~@!w-n}yk zh!TsRK6%oJcI@1_bGf;o$lTkvlk!S3GBVzmm$z1*@%F9MO>N!rt5;*n9-Nxj!JvxQ z`u+XLemYC~@435T4QH$W#It{1y5=?f`o|ZC%td!5_}slWzxqvb_56q@M<;xIePU({ zD=VvZ^qF}jKrUy@n)S!o;4WQOzkV%lJoR2tk%?KBbI(<4);xdlqW!#6gO{_L(#8k` zTQ_Yg{`jWEHT6e^BzJ2@pR98Gsnf$PL z|BChzl06sm^Fy9^$0k(=4p4vp{(Z7#ESte#Fqv})VShb(z1$$6qM~B#Q;xsCe{^*D zg(OR}2wOWB7ndPJ7Q3eI&d5mk{dc;i<_rvo)|A{3Fm8IZ4D8rA+b}uLKv%b;wzg)g zRss9QCWbJ)d`yl#TI;>V-9T3_@z$l?XKvhxDGunEF~u)K*x$lp`{+ZyCT2ag)HR#g z`ON_hAJA>bwr%=`hF+FUqGDsacY{~4_+ZzrU8NRDrvm$1TDF~g@*oQc&>$^oWTbkl zR-uL+#Ru19-w#{+^7f~M%*@{;fy>VS=I7@-KCB=By zHG@>|#Fb?`ZTQnqhro0@V`z0JU%zP|LCw(;@tetv~c3Eec* zrp=!}KPM+=!-fq{pN>uAxUTnV+_>?El$7X&Id7(J*x>PIaCh32g$whGLxv2RQna_E zW8Sns{`h0}o;|I)TWe;6@*6d3#OL$Zu3d|%FI&F6-WhwLmb(q8$v}f<$P7V%JvEd^}R(vQc0wWHL{MR2RSSKehTC^^y>w4~(F%OD!Pj@l*U%D)2 zweK%Zj=`r+8O)m((9MG5s#BD*VR)CmYDdaW+YTFM`F8QRxcnT04b|O$omgxq*}Ps~ zU;o(@`7wC^~p`@l(+l^-QDZSTK$(XDOUq8Bd~>ewc_ zCM~}|s}2s(Szfps?;IjBv$TymkTag(FxbFwVWQ(Mt!$pd$XU-PW0y1UkT zG;dwn2*0*><3bmIOfJkc8xW{S*G7VDJiA6q+odFp))bh543F^mHy|SJ^`VxURHNYkyP5Zn#ZfI`oy)U zHXcGtN=jPwI~?JyTj%HJ|JHtl*;nMr#3rK>)^Jo?%1 z^38pXHl4~61?-&~>we>xQ$=ORj~~B%`*y2t1EyeefcELv?`?VcukG3`O-#IT{rXnF zjD>?PS{|Rt{qUje_l&zo*jmo>KRzF2XrXuh+<1@mix@p_Z@&7QcFR$FP9IHA2dwR@ zccQE1fq=<}FHK3G@njFyahBQ0mK?q4+nLdBI(rTu9=*+1(oefdye7TrUP(zpXr6Cg zbbjZvFDG>vUm?v*ykd~P*tXHT(-gdoVUwB=8_3pxl1C~WY$X@AY^efy@H3r&|T zm71ApI5}>_)GaIv*`pq}>;7_IRFKwcce{hljJG$HMn^w-`0%gb-B-2@Yp$jicBGNb z#l=0G-o3mly0;{7*Yomgd)8V#+c#!?QQ4S4M*QcBV~@kyuXfMa)5AuK)z0C-J?n6K}C zNr}fqKr;^TI1;)=Ul{wbb20FqtUs}i-whBYuk%jZ5g_{Tp=jF5z&Q&;ZXc~)yK-=& zi7Wc4$Hv5rT{X=ysb`NKLHAG0w6L?)syuY}cIExqnKzuRIzN_fY0=^8wh`0Ew&`!Q z{`#KYFDv8j>@5MB#{ba%)(K8#;oUoRN=r+dn~>mC&|>8{UC)&K6DLk!>fXBTz`&|- z1$LoHbJrsui#x?U;%l?nF*9eb4hpgwGOPFESK(Jb6qOw~apFQ+UO<*s`jyB)Mi+O` zkRBPr+v4bGhm^m9Gks@_Vgs+StgP(9g$orY9+qT8++G#VjGk<1c`1ALYFpbCj)$90 z8#8K6$%g}hHz%y$_>ed5z`Us*f^)H@YK?8|?3ye;Z#LR|Z&p^;kt6=we7mT>x_7)u z6RYd@?wu^o&Cow^@pJL&%MSC}uXx2!pEmjPv)@w(PmbE&Jo^|J{&PmI?+jeBnYLU| zPN4Jc##6Wl4j%kiQU2`i#P_2e9AFDgNo}7^NApdsLsn~(Ae1?I6!Fn&i zSCeiD&21Jrj&Na zs#EXA`4#TmVGxwhcqm+ueV;YzfYz=Swkw(*Hyi+bkC7v9Ucc_#vrP{MV;Ot&*zoZ9 z=ht_=diCnVhjB@w1qtVyG&%aL)Zxm=&?W{3BmD}yEnU*S$-{@H+x%jAH|;`03yX_y zn+*GF)6_^E&1viA%^U3Kc>2|=$Ppt(#KnCC^97($c*ZyW=r#E5;pkWQf?6!IrqTKg zt5^{LeBPeDCC)vwY#X^x>}P8FabUGi<)h`y6+M5A(CezLed*Grs#miI+B-RgONVWK z(klGP%kBfmzh&yoHCcJhKie_!=IL1-+ikQN}EO6EF>Dte0T59g9W8CQ(%i8BJ>3zHSjO4!Ug8Q_ARoAD5 zY0S^QuQ_~1N*h||eHV7`?)G;4dC9SWDsRE2t3012_f9Wx%;ugx{jgWB(T^V#{4$MZ zIi$oTt;x#TUzp)8T0GV)D?YYc=h87ICJQlI8s}+g=>kVuv%PApQ~M(h zmX@AQD+}u%x$fcd=`p6i4R&2*(lR?TJp9??$B%Q4YN-uM^#-HncG@yWi^XR-?S~nx znd{th^g-jo>rAF5G+tHLCjYuYv%2!*y^}K<8x8mH@EAO=rH@E(wUNF)WA4e<&vvZb zyT7HAQ}UIxh(Ft=wy7vcrW>2Q+>mU~Z08k}axAi=mKvD1sx|I?o83R5wQDY zZe+*i&1WxOym)2auGWLX`=oEbnxFsfaXu&a<@Dy=^A^x(G_SPFcPG4g{^{iwbAkHh z$4&cN7Cwl?G_ze(Gt*p#dtIFLQ9PQ*OXinl?E5V=*>-(c^vccCuqh871a|M<-QKBF zQc{m&Sx$^0A)(j6e~oElM4p?xoIB4Ba!oxr%PZ_^wRTIVl4eJKYjn(T)X0&pDfwDW z#~j}iP|&fxCmCD$D{sf{c68QoS{@4Ldjb>ycLAit1A_+@bTiy?c5TMXnq9i>KRP&z{bj zRJp7C*1@qUIh!vA2k0gCH8V@yw8&>T9%Yekttgu3c-vf0HYNa)9)i3$q5TG&Jti|C5$lBbuRP zSohVd&X37i_PKHKgb&<@bKCN7UK+NAyV&{C-GS`Iy88;RNi)kIo$s`G@t+g=&}dUm zPq16>H3jQe5K|T~n8s!=ZPMH~>~hmnfj8D#4K!LgyKC202Q#~^_d24k(Lbs}n!3pj z7_j6?ncBR)nzMch>o%VJ1KU#Gz zOv#sa>*1C?yidEqQJ=>bl|NHIlcl{d z-?cPs@0IeY7n_1PtZUCU_DStxW8*t?puY;AHRxDee1VBcj|*!@hhLu8vgOq~chs#6 zHM7Co$|6xsYviCvco}Z!Gg-Uk{NDp_XU&ayAc#^|(_a4U#G}k+YW*rc^xJtu+W!2V z)2G`79A3Qm#hmn4z@@vsE2uC-bS-m6b*QW6(YaOaXU~Cq_w`Jn;_w<>6R8-szT3zV|_)gNjaL ztQMCz?O7LZX8_Mor)TA@(G$vt-q_76*}Z%1>bPag7q^}79J? zM&Yw}BQ{5t1 z0vyBp?0)IVzQ%hmzZdd&R@W-o`nTJ3{ru+ClG4&1cPD+?nw2$d{glRy zweQ9oNKes4G}?tVX?Kn!wV(|OO2Kp=AL!f7xYONByPft(G;E%pU;a#ZYh3O03x9w?BLK;G-4kZmeawS=sj=p52?1b4{!5a&Px5 zrqirkd$nsL4qP>Jpl@UK7Jgowx05$@4dGAaet7#N9ax2ojLH3cfcDF(%JdYzDD3&i zo$;gnEO$l~-EBedd+<)+E6Rt3RP|cI%zt)vY-@F$eMjT6rf%FgFEnp^Qh(0E1!o6--uvqMuFY;b z4sQ}y9@+8YcKG1Iholu!i`7;W--k#!U~uqew@f@2oWA2I`_t?5?V5c4G_{FK*uvkQ zJ$*VzOOtMFYMGpPs3*6h|3Tv}3mUEF-;2EW`qA35GJk)6(>59gTF&X|6%z3(ugvQ@ zT9HiV8s7N)+L%G0*JJ$BxBzIU%_ljHN-P61Ba`9~H8f30xzD~t?#eD-779$`yg-x*JzcAYx) zuRVFd#%$fX^={R>j9KO5=UcXAv)M<0hu3+YOZV=x4URbPl}2&%HYcA>VWLp$&F!NP zY3)m&-*%8d@ch`ZK|XEu3b))ow0zUXNEXLyk1d!HR(;NYoSibFSI6G8-n}=2snUrP zwx$bc31>!U9k`R5JLi*av5A{buRh^Tbo?VX1xlqF8X92UVc@^+W<|ixDdN(bqD^sQ zs?2N|_jmZ`uCOpSJ9hGp>yJKnu%(;Cxg7l&Q! zpLuD*%R7HoSG}BZ@MHV^6JEPKKhxd7Zp8h}%uKyLeayNg4LL1ZM&sxuj#_xGZzHwi z)s=Y%rZ*o}nOU&`7|9QnZ|s+*?(p66^47tkmoF2JR5S_MK4bES`_0?T-OJ5xw$x|WzCul;4S4|FP&s=Zl2=W-Oz`2=gyt;%MGfZY)-DIn7?zU zyGJpHBPbDveqK1PK>ZiqvgIPbedqEj|GYTn1*YAhLrH1r=K{}xovtJTTQYd?-MdEz zhFGupExeJ+|{)$819})BfEAe;a&D~O?~~~)Vy&6CcO!H_<2ZD&bgSqL;iY{{_;ql>dH5a zUDu8GZ;y%D=xIH-a8GF3t_$qn)H7pBM|yhZEz|eY)^>aA6A{-aOiNv-Rd=>k)P_Lz zVgH-gwPK&o`B2n7=xrLa^Pp|MceCR5?AsSzu*rSSS~blnyJ&zd>07oG6co50+CCvH z?DfgHzc1qt*l+I|qe9^HxS#f0* zF9$SttM4&xHphMgU{Z56wVu6u2en!6nkwYCUY1yX`D)9n*IMn%NO=2h;S)cPwsZTL zo5%NE-Cp~7R#^VDzntGsp*bxrj+yiE>9c1oG;DmG?DGV_oM9f)4RIOZ~3xiv*K2-o!5RH zM{m!bJ@Mnm2L=T#*Z1oi|M?QDQT8h^1~`|#;gNlD4-fw60csx>~IJ-gNH*|TGxU!Qt^ z%$8OyTAf(6Bd_gZK&l519%N=(=qy?J#~%+KJu+*qu_rP%r>Jbzs#RbXUaXTbEAI6} zm&ubSJ32a!8FOz=?>#!dJfWM_)5nh^#bSDk7DeKN&0ah_tv%D$=*r~zqu9OM z%#~a$b>sPOZ8B@tEFd;rx^x-%;a-!8?@hQfLtG1P-n@D7;>Ci3H~CK8b5s8cH8xON z*J#?hwD>P{J5l~L%VhlOG-j-p4Rux>Cwn7 zW#7K?``NSY?CiAEhNN9yx^!vUvX=CjjT6okMIKn0WTs{lxNA78eZsIBVpx~Yahv*Xrbph*9v9NA^qNhYn=)fxFz%A;zdw`*iY*wA)ad06Q-mj|8~XfoqDS-lJm zR*ncNhY;r0gPEu7+9742hcpY4DTl|$0`G(`A%Or8&aE$B3@rvkIt~N2 z8c(4I#3HOl8B`Qq;?ONTfew)!Wxf*}?hww9s3C?ZJVJHh1RymeVqG*u2-}JzR7Ehl zN{UH&L7`%92s<)5NMFnsu>-{hlYm+lM?uN~VL@~wFnK9Rh>B{1oMOTkl&6^_1h3o( zjg6MTyju{B0=n>M7zwy>uye5K(Bec3p*H40uwZE{#0!Qh5*=VE9q?u# zaTf&v^9|7;5jKVZLPbhg1df4(1%{4pfh z4<6^1As5JWxB-z<5%?kSP&!~Vt|x?ifjna(RLf8Y;h&-^fO992K%EQItMP;71=k?1 zQeR_X&;%mvg1*4Khb+iMNHw`D1`qb5L%xLPgm;-mr}P&%&D5^4=(vxG95WfZJi$yn zRUn2aA?EU-Z;ylh$LVp;o`gC8 z>_eEk2y`?S){J-?tkQ7G;v@)vnv9jmVBBpKg$cHWNCt>TGodbscOZGtz~7o;3 z1WMSp7C4dVAx>?IOLl59xfL!fX1M@7yg zBs&N&ge!>U#z`pbB%K*qkQ%t!M*&NwJftKfKMQ9b z?x#ZR3ItZ8D%K!#QV`q?>BAtFqRyh05_1p~XCtQ>Y|Moi&OylTN=ayzNRdQ>{9r&2 zGz=6(hzgS~Ywj0IsVc>wYI=;!BxQ>1i7QHqdkto>HKx!AejLqOkvfC=lmykm8`xW- zG(Vxs<|l;V!$ShW_4b5?1N~AbT4=V4$W3sPOoU_@Ih52u{C723a|v5pP@&FOr<9Nfo^{7KTskg*+avMxoUv z?$J?TOvoj}L4^N>6eI3+z^{RWf?9_Fbrjmi!srxYq3+{C8v&i5K!~v~k>HbYsSNg9 zW?#v%uArgWV*#0D=AE3)QAuv`#T17{VY)Dcz(&Id-C*PPi$UQ;n5nfpZZJvkcX>8x z9Q*?)8yJq%KsjP5!XFSM5J`Br%#&*{cyGW%3-nNzDVwUwmhoWvSPhtJ*G?cJ1140q z%ZiX`9}Q2)XP|3fu85Fm0mQ4q;c-aM1flAXxJPiRCdC2bQ6qwJ+QXd6a2?Vcc~lY$ zq9Um{nkQF-xK05of~d`sOg9Tuz3eq86?6^QZu#)#3V@UZ#}PFWsdY6}5e;v2tz^R= z>*664_?aIIPWAAAL6M3DvxU*4>m)2*hJ=`J0*y;XWF(QiAPDD%^aPRqR#p+&J$%4{ zqR>yW@|y77<(VMR4O_P!xO^1gvB*!9s}A`K&98ti>M$hQ@YDD`~_Tz3t^ zzaw6DRZ%o(u2f8VBm@N*a3osj2&9%uKDkb))Dq0y6rRBH;e7@{EmEUFjgK=ks78p5 zpt%nZ_fRY-DTBUX-HS!n&_GOK(lrtrC>KJcI3NqE zX>L_TlJQ*;6asRkMCcTsl*lJRP$IZ=B7RRDNb*uuN2_Z!=!Cvk2(rs{0!0s!ng9=K z;9((rW<$x`@im$omRq~(hEE%&yD6QQ7g4|NMj?0=dK>wVD3K7MyooR&wI1Z|K>q;- zMZZd~Q`DG(YNxyz!sQF15vm%Y%2m=4Weu;LkmzyUltix(q{P?EfLp{BO1Ol0X`m@b z2oNS10*W9p_w7KjKnC>S4ar>P9C&@@`Dyt$UsHiG!lyhfG28u)i9#>cw2RN|*7`|X73c;Nc1}p+2 zYCtAeWsRc;DZamZa1a;aWO{sfcN#Umbyjgv)Gb(NqvehD}gGP%C^%RT!6yeW|Jg zUz-JXT1b?Quj$C#PN1Da;o2=1$0S#57;FJ08VPqV0hI!W16M#aOio?0b@Ct(1@0Y| zB$cnBk@H5rFc|G#0RIfb*Wf8bA8!+NnOO)viw;6d8EDQ8D<_MBl@W@?0x}eCE5tA) zI0Ua5LWUyWA=gz^iO7J=0B~S-p zxaQTMh8cJf)+*jc3va}xDWH}33J}U6e4Zd!wmR(N;O1b*p=-z#DKWu^CD+y%YVr7T zphD5qIEa#bpzhWb4YYj(Ck3*-GA`3KYVHCf$0F$x)Lew(V$ni=R5U5wFl2xdOrl}K zlMrDAx&{;yVBo|e!ooIvQUIfyW(WWFSVJ z1s)=TAs^I&IMUz(!2~r)iA@s0yr^gx5k{L8Q8CKifQwMUIaLH}C$tGAM={DQ97o;M zf{$P{7meWxqEUteVx&mu8h{!Co;>IbKUataNyrAncVND3c~ff`0cfvTXipYI21l-c zjkR2bNdllJTDpK!0?<|Y0vX{jp@m`GT_Ji=qdc?&3}36oDPO0p2oed9%+_WuLV=JF zuhczrkk61{dPPhZ2^$mNY$k|~5aL6lzP2DT*4-BL$~U%!;Ff|1hl67i(OQZNLfQ60 zb@5cXH}GAG=sCz9$^AWB9^8h24^ZG{!x$dnMFEyc;}jO}x$+IGC?^9c))M)OvxL}? ziVB3A4aNaSo17QO;OSNSMT+XVp@C>W7Ch`p+!KkVqes{3LcofGt%-44BP%&eLAbfW z(C3X6$#tdNRY3c(@l`L}Hsa%yYzH2}6N%AkD$xlx`o=~8@%&Y-#ZWAx(!v5YMJfxG zg0uwkpb2ZCls`c>y1j-F#RLZ`FX^Cy_%$ej?^r_*b$RSiHb%gp%b21Z8`Nb42O>d) zA!B6s$i0X#WQ?|m$sWn$_{3udg-@s&CWdP+Sih>+@t17}#t$FJ3i_sKFfle&i6~SB zzzjnbS(_Tb1x{5@>I&M_)_xVy8iIqss*2+j)vU_-V9hW(tO~bE-(5*4EN}l8H3YQ- zKR`MB6!`BU@IY#zx1x{{g)cKyDw3?rc7d3(4O!q1d{;0`yH1>7z{LQb+`!OE0*ZE! zTRGtS_zT2Xkf4P}$X|5WlM-!`#XIP>_O{RkbMf#1t{v_UODJ0nSqcqBS1p?qqhz#q=Hv+rhNt^Hu zc5vQA>@hQjlx%?P(BXVRwmleasQ`Q?`wvQE8$${Rz*rKi+#;$XVgp5r@Rz^4W>Z{~ zRa9+gZx%(fHC(a%H-_0io~-;I$x}|(K>1)O8~gE8<;JpfFeZkWv9X1riG^8>bTAq} zla>Fdt0w*jkQ9UOTL(n>FgG)+1^)wGO86h9#wLa|%-K$xr_Oh^uz~ga6^tx9?C#-S|Jo#zscQ%K4v+P0WAd|NMwc|9f0?V0~@uJ!NwT z%F3|J-L>;{r+=Ty$esTT;%F58JCzGMfe!)7Nulplv_J$GAO!qC4>+;4BF`*L*9wcD2=3vnutJj--2f*);=|EQ%nE#qTE{?>FUm9M_oI(dfq)wvG~>Zb3>E=L z7JmZgviQzpxZT(etuW(j+`0_#mAx%nzDJM2lzj%90^@7)Pn~#DScMC?sS68Ld>1r} z=m7l6f_T}DAE+yTj|Y5d3Go(q-vT&)U^?i4R%}p&PJ&*B)5CBU76W~4cph4!i#}w- zLm9A8_yH3`UBqM^_X{5lN{&&y7X$BwgL^zcJB$wgB7c%j^s zvW9#SW`w=1yN|paUk7g=#WK)r@p}#)#bXZmY6n~~N2-Ami}_A9%Bmx}2<#OS7gDcmfox5#ommbr~Z> z(fIicBE*1j62LpM2qJ^2SPM~@jPY4!gsGQnDvk*1h-YP{xBi68Tb+{qt=RiWYK8ZK^$^3g;I^O zA75$2s2_`fF#!#Tkc5IFBH`W>WWU&+Kvr0&XcqQGj8R1fG(f{^6*Dlv$ja-bC~6dh zf8#;3U%Tj{G8rz!abJ0apP{mb+J-+G{|a(ly8`F~6u=h})s`2^7jj^57bh*V)?q{V zKx}-|o1A~TI7eiPky&$W5hZ|;h1>M+XVdV;$gG%rA>ex(vATK>B%A2JBY2%jHA{#q z#P)neQ-AzLf{hD;r^+cdj`Ec}5Ka}M+U*-^oGu=7t;5LS zeelEI`*usGRGbQPMWgq45tJ1plkQP5!|2@EU4=Gl@#{(s{R`|Ejuj|CHRkUTP3Z&xmO>t5=Ivdans^}>8Lz!`6 z;t(MCn{bqnK2%jaG>=L)7B@nOEy%P{Op~IIM>QVc^%{|$J^zy$vgVvO#HO5fEafO8Yr=_4i?o;PGpnQD3 z^L^$bDyBR5rU;-T;bDIuWz4^M+C!*h1&v%|&ZBY)LvRakuoXt^F2nDNd6dZ!$yPxC zzV%-|3y?pN645&Nq~<&bSqxRNK3T8eHoYGf<@yHiUo5G^M<)%V3NQUTMZzGN@Y7Aw zKo%xHd-KmIFI;pQrntD`&;Th~=m@OAAmW&rgQuf%jS6ua2Y6(dd>cIC28Dt8>viK` ztw=!8>0}stlLq2JH)46HhFG9>5`&_+{BA0fkgeMLGSt))|i(86bmg#TekdKR$7ePD%a?bxMPZfP#i?6DJmVgrI zB#q)tuFAVYu1XgA@%tD-{}a{B_JxOG8c;v?+v~?G##bD_q#4wI*J@F59=eNScpkiQ zQc?`QVggjJPo{^y5W-^BkfoF+7!|E6Y!Wp#zb{eX*1`v!Qdl(vhKo4}Gz=SLu@2FPDFyzPySy8G~?mbE`}=SjKnkWS54fWSDA zsUT`TMWHHrohqA#UWTc`9EoVBW&N)MNv&CHov-72%D?Pgv;hgU+CWc_j_HvI4+vzXUPuT(2F_92Byl#4>>`G_SyFDxxQ&S=@ILqtQ2+xqIx3t9f?J{xSb`fr5COS>sxbu61S%)m zz!&20>B?$zV}frG)B=@#;KO(ngmhy^MoYq|f}ktp#bOFK+?erXfSG6-hMH$b?sib< zG_j)$KfS~!AZN(d!i&;Wa%*C3ZG>06ES5?o6=sF$%6>CJH$r(*T-qGPqKKgqo)|*W z=^8UFYsR|eeJ0L4z#db(pzFp0RWMb3O9X9=$VYgnd?N8GUHO%XI7flFOL4Gk#cE_s zVkvZvDPs>j7RPpzg_W&v*&*%&D#-5R!h^P*%ftu&a}Zj5kijd~1`3L)!~~Tk@_5i={AHARr}^_zTbJ1O;9f z2q|4@B#|ZtiwH(S1cwoMPgf@Ye3Tjw0twm?TU{f9;hT2yd-9jzYLG7c0xk&|S%SX? zSW&+Qclz`pTP`2m@C&%Sq*OSxWx9OoNHoxseFBI9n97C#ngWSSs1T@rJFW!ZXhBet zx-5i`d;EbewGy~&2r8k}qO>%Pf9ZjsYhY_+x{RV3B(Z#GVsv3AXB$NV`Pz7+ zd#Yb|^Ym~c-%u#V&C}L`uA;SsAmFVfe$>`l)m7TMc-VN4P;Mh}x6W3o_|g`&vmOd7 zwAnTeSl=%oaBYoOlr>vVPd5h}k9wP6i(~qeZ6JQ}nFBE+%mOp~y2jYsa2%9G&b{Uh zAC8T?SHoxo6d9C3wp2vi{%Udb80zL${|MjKiLPlJKM)wEa`xl&PwbwYE)IciZGj`Fpj5>L-dKb&X^% zk+0B|9}_o7{{R+_e}jJ!#6^aII%&fQ6A@qMrxU5(oD)w)`YznAO4tex9|`x2g8?f8 z64&mYC~T!7J#uQRDYFLPGUG%fsH5c6Ku;A4i|n?pzKl>`?0lfNRk{!2W3DgYKT1aXEl6 z{|&*AP7@or@tI4*&hp*jTpeVXv!2Z3`NY6B=3;N|V$=rWv&I`((K z#3>%UgRx{g^6VVBrUCP^L%=phoohpEYDAd9!Wb}o&tU$9KO^AJFqGW;?}tBw)#%~_ zk2oy}W~9VGB+hXuY$aDbga-HOvoRZSC`ylk^)QkFGC_wPb%B~ZosA#qQrHe&+vy%s zoC5j6U^@YVQ6ig3v{Ln6cU9+lRP8@klw=2Cj4t!uKnk5 z?(ppIWZDrNQw^pa`S+7wCE35Cc$if~`5+YDWu-I0$^d+9)n{lybL6B|spcvCstqSj zschK~TpQrjcIOJYp**U0AXDeM4B5sFd+NIk6$i(uHX=wQr1pap3$hn@a(7%nYVDb< zB$>5QXf7UHAwelvihW^GNKosU&hJ-+T=3y|?cG~0{`l|u$NQHZ38Rwr%M@(`K>unK z_668|bwl?xWU$vnT#Z-6=~W(jUkukfk)ncr0GJ@|NBoz;1Qk8LFL5LOpF{rrW7bP9 zMPFjP2xLCehUqfDKcpa0g);uh-v|EpUm$%wU_y9*z79yJR^WpMAnMgEA`K^pDnCc1 zu>9*;CXwQZc1Wa=I`ttl4U=;-W&ZLd-aax0OQdWb3GOG6el4&cEV8avig^-CYN@CR z4MD+^NFh>yY!ytGiMN)bx|Ohi;Ppdr@$i-njSNPX3@xiEyak>Us>ZTzQTtl#y#J1@ z)~a5}9{n%{qY9Aj{{bCAw`@SS>=d*$3sVWW_e~`IHrE(A-QUqQrn<#{Bjz0872`Y4 zzfbY?tYoI*(r0bxx8aQB*=)hP}& zWt_QxZiwNu_@?MdgJA2Fy-T?jP~mU_GW}B^cK-p6d^?gHyr`NJJy(GCLIfhwb>Isu zxG7%Ikk_d*F2?k=8)&eYGo!KxF?W zSM(?F*mt<<*#G6u4d;dM1-x&rqwf7*hDN5QCN=i|ng2Zh{X?!EXvY@a)qb!Q)>GHj z#@8mm+0)&DN$-I#U17m|F&(}V;Nxv)g^`#5^d2z5qwJZRi>(#h*+lOV7|j<1%OBVd zb#b$|!UFk1dJp&=QXxR5z++IAonoB^;5Afw5P0gX@|hS^j4wc9;0L}t3+NN{9{PrO z3Iy6P(3Finz^g=i&|m^Dm{*c+=jra{;^yG##j(QlgJDgw)-o}Dw8sT#x-jwq=pWOd zr!J)?Kp^tyJZglEo12%7-C!Fh2Ole}PQV1Z&rn-?7jN(yH#j&_42IY^vKl~QCJX$a z6vm|ccnX!PI-L$%8-S~J3%Z6l0@D|VD3Xe<5fKh}t$Y&))Z`0cjd*97mKZjQt`RK4 zbP2ZFF~L9NY+%Y-hq}PTU`9_NkFEjV_J%x(L3QJ8hP|h>nF$$<>Dwvskxkd22f@=_ zwYDDKt*2P}|8M*91^S;I%NKrA9rfyeGiCj6ZeniqQ~&>ntKs^8)ZeE6M}gN+=|OPK zq^1oZo{Q1bf6NYy`e_G#+JXN!R~`Bv4Q2MY2*J13QIGyNGd3|*_W#Yz%zx_tA8`#B z2pEjP$ve=8Rt%sn8DQ!kBnsvWL#-G?Iga}M7z3^81Af!j$E?23h5a9UUjpA)RW&{; z@~3eD*;L%_WMHNl(lqHd&`t+BZDyv>jkdEnGltjXwS7#Im&r@oDZ_}%hlq-b_W7F6xP0KJg4-to?uy7Kf`YgriVK3Ee*Dk5%X{~2N!q5J7Lp%ylK1X%?z!ild(OG% zoZHaA8{9}Y3zRX)ygp`wRfUlAY|7U=dDuWuguHhKfhPpXm}02F_&S4;;D$h5wP2wA zv(|dET0v9N+PSJh3_YWgDJ8F=HN+^778yO&h7FLDQ}cxxjvZhc5f(I}jRgV5bP*m# zB8}`nz8MD_OVtE4S~bn&bDnh=XR=oS*}$`GN*yasnB{cuLMRSo0LSIZrBv9clT?JT zijI%7veiMbG+RS?En6_qZ*;tvCQP!Dy@@FRrRkuWQ_mX%c8Rt*h7bS;3BPW=nw->0 zMl}qOgv101Sr6rq1NKJ;DaxGHC>>1dG&<_U1LiO9!st$G6*hmBXqknsPkal0U-qdmE&${&#g#f%09ANCw66TXJ)T{xU(iAi|qZ+Iks0eKo)O^;U zlg%D!*<`wyQaK{luB94Co~<){-{`EfzL9s&U~9Aix1QMs7o4g#t64RVVU|c%pb^Y| zH7){GQR%~^C_!VKqVlK|BPMZU6!C#rp-A26qKom^w+VIR&xR%(*TmMTNiOdYnPqG?)l-B>6Th_I{1kqI??H2G)vXwPDgfgQ3yP)Pv8vXt=)7PDngeRPrgEoK*ywRMGL}h^i7Ro_jzq zXh{smCTaK=SbAi#kV#{?6MIwb#G;nRl7YcQcVBOOU^IbQ@aUhwDqz6cxCCjC4RbOmKZB)(PoxJ* zaX$qVAC8ligmsZ3Xj>G~>WP7^{ULJRdBpLItS7C}nA93Omv3l|#At&YBzylRP<$}_ z6h1z%t#^2EpdUxozY}La$cR8vG=k1b-Gc)I@oo&tx7V>eZQWJ24v!2DJBqWM0hlsb zaxdV11)%G2s|0C@L@_%QBC4J?U?QWp2XN66jYXp&V)n?2jP4wYC$@DBCq_nxdj~ed zp1i3y-q+)L?p4jKLhRK_RN<*CT~)+$&u+F14v!L#Zs>Eb8c1@)qXvEMRe`3?^r*m| zdk%!=-*ngD&;6h>A#*_G3t8{LXj6*^WbCs?Wb1-`rNNV0`pjU zRAA4&YW2r^dbjrTdQvU=+*~sDbr~P^#MjooKCj~V+~T)% zTS)MTh(w6g*H7tMDwGI0N|@0nCCW^U@dR?y`BxWVDZ2D@J|Ss(`jb;cy-u%{mu zoYfIHh-^NQqB;62t5Jt(@AwDmb`Zx0Sb1I@SMzE%Ni7<(y$X1E9oqo#vo&h1%* z0{@*e7_^ZxU`R0_2!&KTTg)W&w9(HHLn%iE%^+xCfQd?xu^C6| zA|`O50LPR2bMTRL#}zHj8?gaTLobX1Nlt<^z7{&OKgfi521Trc$q%zyx*kVdCmyg) zG4s6*81Ev`J`Wdjzsra!(0@`X;3JVqkvkqX!9%jn{4gJFyLG<#smECt^vp3Dd3&?JfPJ}80~ z?HF=;R{LP5n0FwD)$>M7F)!m~2o^47Tl6FZne{4-U$%_j3q?#2me;3cOyNdJaK*Da z4kkq3u7xULlGd{mjB}}3iak_6;0;D*;3z|Zx;lv)5yp;a6sz?j%|kKhjU2R9XiOf$ zX6ok5)0ky3-wNlz>@oqKQFj7Zc$RM`wrQu#k-3h;D_RBEMKMG0PlBRC+@+0a{b3le zoyv*+abR^cOSq@n#8a5Nbfb1O9`Z>Mu_zrLE!i{tJ9QuTW0ZZ{J=$Sc0Jw_VE(`F` zNW7Y&3WmE1Y7y?IDEYS&d9X|{@EokECb-*?bOA4zOp)JRQ&cel7}K&!e#RTyRu+1< zJa20R&A`4*(A@RT(giK!UBgwnWJ#U^-%%XMIg|6OgF?Co^~6W*6sQ(FYqOm9w%JRk zX-PA4z4Wq}83_#KKjvZjHyIP}rxFoE>zvhkfOh=%xTZ{u3^_0mnAyY^;5ISRIJ%F&qensODpXhm5d180}k5Ze>sd8=8uyfO`Q zsL?_V&0(U^H%1Omz{eS@Vo8*OCq62zZXZsgZUy6B^;*9NbTv1?IwEAE+#t9c#K@Hg4 z3#@f#??6wS3az4sh_@x3=$0qxF)YSe zqBeM4%o^GRnl|Z%x|U6XVbvSlPJy)3Ej+2`#OmC3ZM4PJ0H(6(?D8~mdlTYatnC<^ zJKnjYGyar!$a=&MV5RdV5GG9_zEw&}iJmK%GlSnPI&Wt2tw>7P7`#bN0=lqJn5@aJ z2?7AHC!bG6r5%P>lpq2DU3tCNHsCWY+M_E13t2MymTm~NU! zl0P}dUIOaq{~m);T!XPdY!sp^O)JAmS=~=LC?C!^sdrF14G>EV41)TGB9^Id+ZZU9 zI2m*t@(BUCYjuQ)t&dPgBbOb;69mS49(=CUV$fGS1rmgmoy0h9k!*89h-HE+%@BuY zA9W0#E?^=`Iz3~RV{^$MnEm8(YBr}8`=F~y&ry*d7t@fQGpq??H*nzr56P-j9#SaW=pMiekMd;dg>jQt|-)u?3x1g94wF-6;qvH z#5ko&WT%)pLBwUF1Zz;a23t|=hD@zM`}2@)T!JngBi}bm2)SWmXy>X4yb5NVY1e2V zMuc{g(Ay8$y~qnHKC|6w@nhC-mHq%T+0zMiJ8;Cd_vXG6sSWBPFC%)`eq_ z@!eZ!Z+tGOv`3G+`RKer2$=$OnGFfyphBCl?3-wV3dwLLMCudvM=*Y1-}<<@+M!S= zWKztqb-AOsV#nH03@>?4N*Lh5WTa{A3tKWDNLyhdF9k2^^@YWy8`)uDvp8#5#2WKm zN$lDw)1r@e2zdbkCFu1+ZU9VileK|R&_e8Ho)F_mXmMfnWe82i)k#EPR1VQzc9Z8Gn)+)ySxtkQ@l(Ym25Al8WzR)+ z{1Gw2QvrxI;IRYI1vZWsn1c4?r7{V|AGK5>YT`B5uXrx@V|rJo;h{jeYDnss>m8dj zya9@0NIFEY1P8Hy$Y7P#(tK!u?(_<=Qnhjta7{59wteLSyCJ-@lo`A#R&a-K;A0Y} z0)k`%ueyXFwarC@3ifAONzG1$Oo@V{mA&DIlk)LVMH_dVC3}RWi?@`~+pSf87G&~8 z#j(sab4|0d?0$=VMKwPYW(hW?HFhK?-Qa7nGiv6B8sp>aisrEydvl&N#FJ81be!Ti zfT7eO>%kV_d;xGd-c*OFR$#XS7zI?jX@18%e5p6v5ER2t!&N1npqQ}FOV}D-n70KA zdVp#(?4*(n5Fwz|ZPoyfv&cSi3x=~|ggM2vlVF$|4Ok)>JDFIff23`fMTAwP;*}}0 zI?2pJ5KaDbqwPqEiYE z>UT^}!xkA3!1o3GA**#XH37alh%u=bVV8&93a_I+&D8PhtI{hVx7!?OhBljOp)P@ z3O;ap3AZ^KwuTzzHcJv7l*w!Al$FM;a?(QpZQ3Vw4iN%-9+zezuVf9ybAnrGOgA2Xzp z!GXrXO`E)iV9Sj<=Wz%dWkHv>C1Is>xd}O#CpSIezyOB90he8-Tmw;V40r5}CAUVq zpzD-$<|^#^cm^<;mR=ITT#nYV9ZO7gWsU=WvaTpqPS|yeRiy-8yBrhk5RaG}h)qV7 zXM=7L+?C2hOyx3;+*J9~2haIqsAgtS#@$$s2rAp)C#U3oF89B`RZstUa$gV!~unH#m{#d6!IsE;76e?9Jb#sYFofhvpbbwyvTb<=`#E1o{G(5thZG353G>=4KcR3O#deoOhNvTdB zJxZdZuk;d%k7koskJ3HL6T((-sekkf06?}(z)>_j^mEK)l{ zM$PCTlm*R$nw65E$jjF=9)Y2Vr(Ze$CQ^G}r2w}}vU?7sjVBrVnN_dXQ zVuJ}K=hqGq(7G9fNr8M9bSkDYfq3hsbp83Lr8a-IMQ~@cQJBj6<6r!Ju)`Aqi`vQpV3|2=5OAec6yQG{KvD@UEDN=^ z0z&i?MZ|AgA)AaQO4=TJj2o-^4V~&*<%cZ}eQdx;c3NIWdg4)%8ntXC=@VN?dhpH5 z(C@al+z`s&^I!fW77`GnOs5d!TE$^6S`3wI#wkmMJ?N=?Ba-zo?3fkP)B}R2aQbz- z0KvkRZ)Zb!L|pZ$xh*Yhsm{yY*GB{ug~~{vUM#eP2x{kQ(UQ!IorpL%7(QZr%iy?~ z&8GYP|^T^svomMC%e8{aUjIY}^&uRe#zd0GR!C~3Bzv&rFMZNU;HnQ3VxJ`80= z7@Slby0Z>S8k(Kkk30U;H~v>oYNu2u{I^W}Z);0a)S3UObzMs>|KFl~?D4;Yc_j(N z;}HNnN+WYO7c~Qvw6p@`uj*ME5xg05MNQ5rBAC$_3kY7fbOM4!)GUB!kJ{Dq3Om8H zKTT>%F7JAlQZvgk3V5))_Y@N3lu%(5u&qw{C}4YW5d~a2@{4!}e-R=iy&`(h!%Ju! zc4+<%_teQ8e@b;G_B5Y|r>KdoT)7f=K3gDM<$%~9r}c>mHKk`=FHmgcvZxtn27O2A zmYGqqMVc3$+5;U?X4n}Dh34q&@8%ML2bdU{N_H3aQ%o3BNyLP+1z1~CxOgXF6X$MQ zWicoR@tG(rX3=DDzych-y{K-Dop)d=$Rh4nB*o$Y(c2|KjaS|iQ5S^K0cxNSX>6O$6;Y67FVA!|ug2_h3pg_jpP&>yS!0 zmeRFk@(Fsl)M0}G>460WK}%zJRHHC+3nxfUDM&XSIH2SN1F)UznoFvX;Sj7f;Hz^@ z;gT||RKBR{q)8=c&T}A^wXEdx%8UcGwn)+dRYuTYf|r^(?BvW&iO>}R^CmzH7!V)@ z3-1~MsdE(MN_BrOi~*G70Iv$tHazPf)H_(53rhWACp_kI>Bmjt-c(gPQw1@U{w*!* zfJ%Q<&e4;klHf|;mX=qfWeMEP+C#U3s7udADh|QK@JAY1u4L_T;uLXnXFfL9J2S*m z#4oa1QUoJZPmFBs?v9U)vAl2X|TT>9AV<)pp28=fo)xVy*-I7T?0LR z@ybzcujh;MkpK3(E{K?R*Hm0`TA*{^{Vl8`IeW zfjTC8QW6zKDSx3YF?m~N5F?}gqdWwIaUht2`V@=pUmIFY`@n!sxeS6~@20CzU|fus z$M$<@`$JvBUHx*Sq1E-2>=^T+zio7aWwCnK=;&~Q8H=T!onUyC8ve$aA>D8gFNc%q zS|KM)d{fjo`=K51?*PHcF;-sS8RQ&uUe-23T?aDI=)mT`iOxU6nE1u_Uy9cFrmn4h zqaGNsZ!NTA4Ai$h*wi;_f6zNXA0WdqpKa|OXy;;BwNbU&nvGP*JwvIGgf)P5vGCMQ z(>ze2%BHb$O0%h6rg&0Wcq?}#uJh5_5(QnHB(n3NSmp7vvb#J5+~cIOMDyZMwaI%` z7|FbrE9iN)?J>6uYPoe!3R_%kF07>wIEA7tq>Rpu$?c;av$BAcW+1_UTpZ%$CZLyS zt(yT`hS(frS0S09tSYCrpsF8J$=vdtmSsvVHJF~1BCAeH1vyv2McEO?BD10ndx6(TAeWZJ}{w-6*?AT%v>Ds__cMls0ra$YHlENvEqHW$>=m9T#|xU za};_o9U3IT-jWS8@Q7{Ubh_{b;~<^P2q22`Fd&>AB|~{cr!`IVm3b7x$1$ubsnR2G z55XqMuVx)tmNH&R$Oyy&R+QloNrFUF)IzgdJya5J!lZj}U}Th-KcNBq6AOiiSqY>K z{DrN@LP)CJBZ=Prp}yYkUN4EmGsB$>B^wbhOgA6vEqi*9nBgX#%PPpZ{=vCRIK`|m zgfqKz(C!8uJA_%2WXm_a=0}K|SZg*ZRF*hn!jiBlKH9w{F%aJ|8n&q*!Yy7j+$mdz zO?EyYQYB%ydL>MpO_kK}%1+r(ZZ^!#_mT&@{TPrN`t8(ouuRS+Gf7Oc%E_0QOi^j- zrAqUjF@RzCP}C7IPPco$CRoH~0fC8y*djD9wl7#~%$btOS`%fGF?kQJvV2BmM_8dS zVd27`X-F1Ur)`yEslEg*LzUsrnf1sPCbg6j7nQ?&C8Xu1EIVQj29|VsBgJdc}L` ztaneR{9vXrb?*qZZ7^Gm@so0Z1en8!*p6M7x$l_r^)G+$Q|H&ut6%TEf&sch+0o+sExo2^RP zGn$CTL+)};zRv-zWxgnRPH&xrWa()&nm6Q=T3CmeC3vLdnYqV|W&Jj(>SWt;TIQCl z*W|qNZ^^YSafMpb0&st`j}f}{9>d-)WgKFXv4w|$GrIMcMwrUNLEl?9AFU=CvxuKp+cN| za>wkmDOy<*r38y}OPOc|UC6C5rcd*{WeVaUrF_B|nbfr5ctm}`Xok2{F~>aiWL9r& zo_fe?rP4HvW}-M2jgeo7_KeLbx2dxQLZNW%=mFXP%5Dp@e9p{@bdRU5Td)gm9T+X`dS)XQ zy9QzUa$24~;$?`ewF!lM@I10bFBWpe0+~|sniWxG9eN_$!2?h0XqK8xXK^^|D(`VT zJA12-r_*P}R-b2T`pWWRS#{D`%I7y7EP^nHk!q;CGX95;FmhkK&gdz%gM|*#xJ4^& zOoWUD%q8gz+MF$8qM4D{d5V)Sg#z-S89elM3bI8Z$#yXo)G!MVFu&M0UuGyV881&T zU@Bad;AderWy047%+C7U+-=0g-Aos+Qv6L!Ixp(xY=BmJR!3DBc8Hagm|H2ZkT{0& zY7T|xdh<9?79NEgyOj-9Xi)CNs`8dGFuE-WtE&UsUuM^J+a>F zAwnw9#o<`J+IhGuPL0{dVD9itycZFA=`2X=w!n>iF!MivSo1myk$F9x|7i@-Uy+ z0CO7#4rQ`gJN8GhGY*8WnjbF1;9w};tDmPVcFj5M6=2Vo=rj_cqhCVlZ#~9f0rZ?dBFLyC#lUaHJ7v;b?XPG-qIP5>A%|E(-lG#~g ze0Amma3&9M3;jzfEiC3{2050dfn){PX2kEzF|zjD`6ldCF=1s8JXWe+KpG;ai7M8k zb~<~!62iwT2~ed<)+1J_QN$^FADWjph*y$cxr9xtgt5$RPB+yf&s54b3$x$)bDP2C zEX~63Yo-Sl<@k+LR(*qzTsH57pHe}@{=Bw3J!pd39 zm!_+PoXD8+1psV7lfO6nc93|~%dk(a$1XySmAcumfk8Ea)=a$&gH5~7u7{i~VTZZFZJ@DYP(@rzVgC)=7 zXK?kvza)B*v{^1Gx`GeHPYge>q7OK)6~PAHg?vlX=UzpvBDNzB`S=F~!X%SU-cU}C9Q=+ScN z;9dIW6ld^wW)sI(CGv>l>p5i*_a2s4?r__Xq^#liyj;F;tBil9a4h4MBOISsnjO4u zR;j^}InFyXIBUdB2<6+bPS@v_7ktrjVPnqR3f7-16E@acI*G8$WTmcs7VG1m|2s97 zT$KFZEiLfYk^j3b8f~rR|6YubBmZ~L#%{0d-$QCDuajYAOv~z18a?eC*2mO*K_|Ux zz6jcfmNAl(Ghx!BsS`RGP$!kKFgD@H8$PEj;gk|-mhk2_%o5(#7(J!2sR^@$w=}i4 zp1OEh!V6kPBnclE$-3(k+j|F^n?h2tX)T*VXIp!F`_iDW(`Ra0s*dRehx>bXNDTym zQSMKsS@v;T;jII`J8+WZ!aS$9?SV&{a?!t)8hqJhCP(TF(!Z7FCAVr=LV<5qa;b1- zImx|pD9g$kyn*(&z!>n&q(`=HR4XLq)bfs)MM82c-eN0=cM{18$(N;+#Fb*bquoj`@wfFBCsTR}Kh1Z{DM$&Cdi=Apla}L- z4%9`!_0&p|8X^F&TY5$54|oX`Vv(2Ih1ZUypAj1QZ8a^7?uMQ<8KHeqImg%r4^+z5 z?xmU$8jH*&eAyp;tj%iVg@$5tPYn(4oKZ-q9OsLw%~I}`9A zQud5z0FEQ@fQJ+SN=N#;`uchYMu|vA#h){-%)1bXz=SMYx`qjDXjj{w4)GKkh;NP$ zlK};N0%-mX^PSm4zcGR5$zcpz;O~axqg#gum^(1t?(l#b%I(6*?(f=>=m*~3wK<*u zrGE41mObVjQ+7Af3?A2p@)|iVk{W?9VVGv(TjFC?& zq1(%5wa}v}6T@n9CkCASrpWC{I*%NmI)YuL9muu5!qrLr}&qhYO`iHz) zax{XAWO!RwpWH^N>V1O)n+2RUl5z#>x~gvM-Hc(uaz_I@?N2~OiVyd8d%_*>?(Mh1 z$=A2^L`;rX{Y`y?U2<2$aa&_OgIhOZ)^e{QnNi9fLmKEB-f5pg*E5bX{@k;NF)gd) zXM!DdW*&YZVjUd;G=;ml(32<+07iXUWZQxSv>7@r7iU(0`lz%DrB>Kc8C{X~`0Bi- zPQmU)_hY($;Ih*ag-J{9w|Vd7^=Wf=v9=c2XIOqddfbPeSf~Ch?23AOzQa*zc5<3@ncax=8l^3R;npG7v`Gc zns#~#XPvmi3#bx3BI+cmWI`{9M?&C8TKhYmsB=2PT^;ud&Z1zihSq4t?$yu+i>KGd z`L)~i`DDnJ*oewmfT2ki1VY=i>OceL{tj!M?eGCPAC-_@>a0*;hf6dKC@*GM8Ov|A zj^_)te*kG?gL>MHGTlTOT>)eBM;EY06t0#8rX>H)u~LXa!^bF%rg9;uutwU|5RJXK zWw^^}CL(2N#o#N*3?qQ{(0`GkiptOJCf;zL^20x4SS+TlBOtO2T5_*rimW0okrz`J zvTEFmFPB$y>`A>S;6KL(6MaQaMPMcX#nw%m(AN6exO2umXU~yeQJO#7?6540GyyHW z2t`BFVMa}9i2mecF}qhJiQ`f`0_|%DVtopjHgq~6N29R}?OzGh?%^afE)>LNpO6LW&i<}*Sxg-e9((rfYOYf5=RFtEsGu zd&!EE5m{Lrx%6$NjkQA=2NxH zGFA^n^dN!ZoxsVFKvd#7-U&qA#4AUgEJ7yH>e8QIPEj5zD0z)zasYpZ=;ti%IDzOW zooz*m;Hkiz?y!a~jqISaO|@wnPAQUEh6WomH+ebdzA%rH^6Fr~wu)BU=-mzh!nAo^H64dA;4{xqI!Fq(%^YR;d1AwB=1OU|*V#r$$1F~bn9{MU zsTB{7Y$`L)7aFGKA%5$R2TRm=)(3-KLuZJzULqAE!&4&OXEItP@juMD7UQ&ek&$KJ0>1 zsz~RCi(nyAx>=?pPYbsD&`TtVszebh5yd*YylzYu@yYAPtzolD?Z!7eDb|$_M$YvjeMv(GibsB!SM?jO(d=TCZK%4W+bO_Uwc_ z@eBjo%(>-dev2$=e3xKru5+pLgS?El|8#%4N9-KyyPHl^ZCN$JLHQ zF_$Mz`zQv$t+i@oA_6ndlXz8_uZs^*8lRl13;I)phq)mwX3^Q!A$0!Xok?eVJW#Pi z)*XiR>272mGET7&vkiM7wH#KCMV`WZS5?<)JXx$mohC1i<}ikoo|I zSRwO$VsL;q#eZBuzDa!etnBKjzyMa#LM zSlXb1i)2N#jdP7T=FflT@HD<6Dw(Z(R6_4}DR!l@x4Sd=lukzFm*Wf2e$O5z|FgI4a;7-;0t>UEwwFjd zlduKgsU-7RFpUVJU%N}C`}D!?V#!M3wV609d(eUDb2-1{b#mC!JTuu@N0rG+QrU^) z@>%7wBaUQtGB6+FyEU zE}ZnkLeuv?opT8J^4?DceL79NAJ_4)mu+VjdBsZF<4Q*XE@BYia!WJjVK@SM1{6sv z&yND7n<@nrx+~V1zpRv2uB$42#o1bVqi0KcBfqpn?vzH3d`9lPNcN;i^GRMLcA$AB zFETa3IVLY+_2-bhXn}L;by#T-Ce5EtS>0xwq};*uV`c%7xUGBhm=fE1z4Lkt#t`Wk zP*jm)%!77|CMXYp6jU65&k41LX%2{Kk??|T*vLrMhOofkHu}2RTVaqk@-ITbc>DNG$``v-abg|0|~(g^9dsR3Qgg>HJ^KnC;7%|7%@Kw3h#CF+TSE zUqfutaif`67O-w54=f)3F$^f{kq0bH;;EvNPwC{WBJfy6pG#sei$rO1Fq#`|U1PMl zF?uTI25W6=Z;CEnZm=YcvuDY{%)D0GSZ-g#xXLnHEwgl6Lz_uZB8Uo8ZaHd|PrK!; zAX0BtlqPDPX|m>$4NIynT@lbBRgY5XBco)CN?MqyvF6ZbYW#-J+T28fCz@HVxv{u! zqR_Esn;XlXtBhY9+F=6%Z#HB1i9%~*==!0gI3C%NFT-OVy;1E+vji4->S!uR>G@D; zf7uStx9f$${Tct6#KKh+8qr5)tG9gNbXm%E3vZ}Rt>VKW(ERB8D*mcsNY7d=-4vPj2 zsja6)MKSBfP7!0t6*ztr?BP*P8{^=(+LFgx-Jn$$l{kYcY{(D+s)B>pnYa;eqU7=QZ$(R;lOO6A$XK?IrLp-%!KEO5H-|Z;;B5DQ!Y0xNVHHw#+)z zsR3)CN9C?qG)l8B*>@@o9jP;Nz<3Jd>>6fZ<%XI@lRY#?nGj7^1v5ySpQeYaC>L~+ zlT!3_3<01X@^x(M8#)V5;_BI0gf}NLS74qrP7S&!X1NuB9ZWDWfx$Jx?&-yGgfI|o zX!CGms1N=bJdhyR%^U|OMVg{8&XZE1APa{J zn=M&P+lt-?V6qYlS%oGxmV=a0izS!0#cX16ze9yIZ2m~FY$;1on>m);w7e&sBXrXv z&ekh-(@Ei;0+ZHZ53ZbL5M`Ndl}(S>S)I~BLz5X$SP|w}^w@kb=MmaFC(L;y6A%gM zSnf5-2W$wQO{h7|4#&hsXGBp*NCtk68Cuq<^9F@Wo`>4%9kWz5g1{ynT$m}S+%5)aV_TV#7gmT2p{ktifc@s2J3#U~VE5SeWgHj2E-ql}m&X z(qJRSZnLr?QMr6z?&L12q-f$OEGx2*aPUI;!FskJ3hZ49jHF`w2t`Td_#n1$W-0RvrNBBqrt;pSNDRU*Y+@8j zC&QUA?BMkY`$Iqn5R?>M8_tBFT*#3(z|DUAGapE9As*tXG|PN3u*@2Lp|ETPwKI1= zsmK>N-+Ts=Q_Jju6Nx+R{L>FO)A(VJqw|7_2dH>JWDjQH8wwXeNWBc9rL~tl*cYDc za!BA@z1V%D#=S+#O4O68#C}r^rj+-0r2*b`j_7VcJ==TvW*)Mt&Nj~5X&#XQVG{{Y zST7x3j^$!+oMrI0oiJqnOWmR9*-E`*J7+S0C16Y2Rgn4f2SeWNS$CIL*xW_{cp!+0 z(!81zK6A5aQ3U=75M>2iaR+qFDo}lin!)E4hQ27V*dP;YSq=D&eY!#&v($=3v?-MH z3xUQ-w(&Y`+!4P@!z}j|)%;A@3NXM1^49KRv2f0MYXX zdv%y?39`Y$t5*}dT1<7j&Q7Kig6hlXvdoUEPlm7?JiZ1 zooxHXRn9Zi)QhehJm1bdq{DbLi9|!_m}%$g$f%{Ho|0fzE=Y9VF`|CMvF#Dn8_(8yl>`xB@gMYM>ugfs1S9P&fN{ zQZM|Kju`boB3+$cXh&Q4)@(|rk>yjWJwDiJ;`eGe+Tk%bw3=gsD7ilzg5XW+*esb= zfp3fTUYW>HQQT%lVUT6TV80+pzhFoA+}ju$X1^3}I35x!-}~h*%B!>f@@kg4vn5~| zV)zttZ+3w5t9T(k?BdTpc**^j|4T8eS};v4mAqgC);W^M7wV?yVtX-s9{C> zcz^>`sc2@uI36~fuoPfth0{&y248D>-X$NEj@(RE8iy$fKGvxQ{Pc+K#05cZf{ttH znHv?*A_c?Bp@#$kD8jq?#A&S@XSk+QI%>P7U6NjH^NGjwikGZVFOz${G>Fq3{8NDE|h^;IDmRZ9F zfp2i545Vj>qg9|pprci2PT`JN)ow`x9&Jb>4`^4IV4hgVk_wvRLL#9 z{0;x*Ki0}4CWki9J6;l-aMMtw(UP=wC9#r=8Y)>jI!}_X=MbA$PQG@B<}HbMJK=R* z8C!FO-HGZ;GxY9|N8b6yf5BIf&8raoRX+Z!rM1}^|J4$W)#ASv<71EifNM@1YB;lYkMrirxrI{JMy-Raed|Ib&aTXc=s+3Y z3X|2WG_{#B1kJM_jLBkqwMUwn_n8Y{fKHQ&dIksL zu6|7#G`%xzwJjPP9^76@WxohEPQSB>VzULY*}}m*gV+RY2j&>g7Nw5Lc0XmSRr~Vu zUnej{yR<#-@HQUZcJj$)e4A+Fpy$w(Sq#lTSnTu{1 zO2#A>Fl+qT!{%hv%_o4)O_Ws*qVq%=(m=o!V(1wBQVF25v(128?&_G89I^0XL?tnG z)eNaCxtE&SYCk+4IusyXP-B=oQ>E zIA>>h%76d^tiNPV|36ZnGlsTEa#Ce40 zU5s-cCBypykCIn8d9I^%-XmFQ2*{k{A<9ZlWh_>+HCQcpM1-%@w9psx%_G{Pf?x|I z63)rlys?+UuGbeUDY7dbx&P*#Eezr1eH}$Z$2-e_bIl-eY zE$y63DWJo&smLZb%R*EW^x4}?@ZCaJ1nMDG1DtMqn4+s-GYTSC_LzN zKBtx~bU+n1xB=riUNZ?d*(( zN$u89lx#QWl-ar^avcG_}kloH^gh-C4B zlG3PHO}@c&7Cn?(4m<|G)RHK@EbIW!axql6ASziDr5A>H%kC19m+rx(7G~%dWyl?+ zOdqMTO88vk3%%XN?Pj+H4lxvCclj!k(z8Vi;R-BWr@2ak zxaJ!~E87)d3sW+xXj46OMX5C_&gw?MGwSx163*FwSg zN2tQh>}M?&Oo|0-PGFMzS~yrO9IO@&RtpDPGT~s7P18Fltl86(ymT-ahgVo7n-lDT z*&>BTZZu=5Sf9#e}(UTPuM_4>UdlL&N4kShaYuWfd>xv(48+#cH8q zwNSBYg^CFwY$-*HIbf3EsYQm>BEx1KGgVelz>exoYLm4-ha|eJLdD7sJEbP+tj~Ms zwYafb+?e+zJtoD~qQ*?uxN?5Ryj(S6$1D?zyV;6^$O?*<_O!3$@_2iInwV-T6+?zv zEQ=t+hAMD~7YxYHWapwHnPV*_Go0Y`)eR_zU_xgp5i?eeM zS6tj`Nu8aqe!K*%v>#It`;*_otQZqq-IIWqMYqvEw-)}TUU#%t6pqf z^PGe0nrqQ@wU71jiT`5}N7cCeZAH2Gzi3NS>pDmLU+cPPE&gv&K8%a8kUT!=EF6zs z$kx^vJ*Ba!2`^-8X~K9s+l6eE-udQ;*b||6OEbcbA!KwWM;&#=4a@vc#Lx;wdTi#+ zrw#iZ&W;EKyG|%v*h?LW*p#3WM;ekh8r2QC#e!`gA-l3aqZije|5+WR@^o6ChV@<0(cr{91l`Sf!Qw^hJ#3n7(yl|;^`dtN zxl;w+=?z($*eOj@YMfvd9OP_`!~T*^xCMWgVH7i5TxW#<9ThB42gF>6b#X!O>FXXG z+Bw|2dCREp>;c*?LeLb6Mw&}BU(*t*{wXQ{PgbXo zGV*_{r6uZ?|7-U@FUrR)|4*_DnPcXK%uVpMxjhE*|2nUH9JA5_#31>uQLk;eZ)n0$1Aq`33k#>Tp27(^MnxjT_q$d5edf85Y4SLmgkz1wH*Xlo2h@6 z4d13@Fa8n@QBz%sMwlb2)PN($1nx~d$Ap!GLz2clb1>MonNk}x(@qvnp6!^g@KCA& zue}`b!Aa~;ug``4c=P|v3~~aXpQ`jxhW~@G)8@?o6m4y(@&Cp6#CHr04v&sdiAy#! zQwn&-Q-AH_z5ey2c1qQje+BEm)hYkAwnl5~e=$CO>mMngw)~&@AD{J~8cQD1^^gD5 z*8d`WeAhovKyCd$^FQ9}Kc^doiM(o5hX<5h|1GZkudS^$`_H0${MNsqfEo{YW`Dfb zKXVnTmIP3K|9AR-v|&o<+WKFFkKg)d6i{3J&-72J_1|1222g(gcb@;WHMO9dAL<%S40h5=^m|Y5aHvsoz|;f$ z>~?VD86%xU@;1;3zk1}vQTT2)FbMqyMuxlXg(u}7NwPao$19tvtNf7KvuqF0z%4&u zCtmUsE(0e6fv(|B0yL6O76Zdw1AV<4J4s$ak2nAf{)tqwsIfa4$?o0$xHN0e{T5`_D=;P{;agNP2YZTM1|cmQOm}9;nOgO=)@3 zkRyyb02o@F%}}5&nR8&tyIkNLn5hIi;)X_(DOw93c90A(CV(dpNMc|ayv=7w!??3q z{JGXiKdYFBgJ5mc!=cr>aU|M?9u6&S?a>ww4~Ij&L>Khq&;KLSS~h|UXWo63%lGugfy<{wt|ZqD}6V**#a^alP3SZh{(0j!X}ke-fdS^hOb zdF5y)H7W-o{k}XabA~MJ9-9!ckM@f7~@5rc~8}b1Y z##6msVQ_qIhFEZVm-1w%yYXS5E=&0-Fi?5H+xTlrO-ntn-vS%YY_9n1`MCN2aJ;Lh zKVHo~%JF~X`F8%_(%e+@|5=oe?E8&g-oSbDN*;4hDh13eG^M35(l<%73Kn$c`41vC z(K0B?D%nCn1aBxHFV7HVO3~8HvmTQR&R8K-86~SssQC!lguaTHgeRq9o<>Y;rzZCX zCJTjJdt>AD^mK$#WsZ5hNA&!JAkIKw3+5P|&{gWJo&in@tr*F?mSb65m=8a)GXnv@ zA1Mt(FUE>AZi~iH0nd&UGP$$}@FoonB+?V#L<%ZARSGPRPg++}0IpRKN>LQi=Z>yYzS=u6J042J;HATQb<)OHOf?WlD=wwr69vqfBnXDnZK(G4;pMvy##q z*AikY+0`>B7fI>K#-bsWf+9V7vWPyeEaVLz;?`kn2}+&e1WPDoQW;FT2h$@+#gGe5 zdK9GoubNd<>``)2^BKmUY|U!>i7{iqtgsq6HBXaVW|L|JI%3GNp27415i`P}R;pO&_kn*DcCKC4I%^Cz!o@rtlOVFkjPS5stgpl>I?;vmcO zhC4${*|HA>R*iNN<}!-ksPh>8f|4eFF^`k+2R~aH?G#34(9e6BSj=+LGLLgTuVDo; zLRa+~gYQl7&@3=R>ZfVaY0x!r*Ro1r7HTePV+g6Fwh&-*`Np)KRML%59?8BDbQD`h zu*h9qSi7T7`_9IJUh=BcJT}0UD`^A)p@GR&c`>Zq8Vm5cfM^4;!xO{SvmCz|YHFyk zXj9PUgjS$AbAY5V*pJs>;7RtnP8uH#%?^$Lr_HI^6ij$vm1SM(Bn=e$6j_DLwNJ|y z_XljR$BLNRl{6HyA~HKQ1B9U^6KP%FTg2u9$Fb7zz*Huj@#AbKao_&hD(@8y}HtMuQBNW^MKV!V-bK(DFI$JO%-JN{jh*)PoRykMzzLY1 zD_G0YY^FKj1j{Pto*58DN{yH`%(#-h*`BQfy*sFYWgEEYA+Wt`7|DJ+ZuSk^Gn!#& z*@*^_PzyS{lE8Y1cO3xPQsIR(C|N@b2-q!~M1a{?;o)EtDAm|}h!&7+tv2HXwIhgs zK~@DFyc?LtL^5fbH`&fj#f`Q~ZJX}>AH^7>v6_1fZu09|Tm8>}qt5f+mNq>9X{{y@ zexGOg{_i*c>V5?Sfl=O_cOT{CzgVorY5!f5Gu)k`rj?=cOzlk3)pLbNuEh(u$9l&~`ZkEN>6P`k+2$zf|ERB&oW(bDo`cp3`q*+bz|QYoU4adn!gX?jh75un$Iu{?JN zXq%nEGcb>23V3z5UYw#i>S&{#!E@ln=}G!90-@CA8+gG+ZrDs^=nQt)`SWE4ei+jeMVU9Xf8rQ zq-YM|88f2;=s=ZXWCQH(E)Q6OBk{g?_b6elvDu@!4>)XiLsN&Kg}ax+f!1X4VhWwY}Mffi9|?{Ao8KD-fULy+1L@J(r5Kh z#YmDH!41+9iAMH=kWJI#(KKgNH5Hl9tBfx5nw?Iw2MbN+OOTo|QzO@e6a6~@Vs5Bs zmVKrN7{#%AuQD{xe{%?Le+t6zg7m(gKwX`tN2c={C|E&bua?W9v~PAv38bE`KJ!R{ zq9zoyazdJkH4`>aaenasL(R2npK5*l_J8WAP$dPRoc!MwbM61J)|&tSqI{~u^DIY} zSqK1v#OVIt%=iD+#^xAlinX^ix5r%m5!C^A3I!!Ry_$p5JR=6VzX(A%@w7`$tF@b)f9w zcVb`zQG9~}>WG?0w+8ku;NNQ}v=;E|mcFc>=sb!-qCU<}VAugSbKj)qYsnF@T2iw= zx3zMEg8<45_f5dH{m>L9n0C{&>I=gXy9uM;Da-xM(u(6;DyTXZg6v5|0yE|ShYt`s*G*_>B?HPv!(>g@ z#_pc@8q5+7{ZjzC=?!n}IDr}IEmtho983yp1A1oK2Rr4!oo(<;Qg4I6P}6w2ww4`k za2Rl`tR_7vQ1f~3a}8-^L6&JWOsNA87((opf`B~wC_9-L2Q&n?=XJmtcV5b?IXt7| zuBG;dDGK=M#(0xilOw%EO}yolS8Fz_;as}vP{j7+^_-LmoH@#hwtUuE)IOi}!4x!N zr>zSI9>U0bwf|67!gm;FCbu~We4;AmH0Vt8=- z2=EKo!mGFgv5PIKZ?__G+QK9rZej{%dLfH8jyG&*=<84K&8*gTWNtbpLlAc+h8Zwn zf|pWK;|-dV@ODgYdtn!4u32N6P}l?b8;Pvhon6DMD8eo#PNLZeJ3Gz08N;k*Bodsa ze2m{=u`3vfn75VCXCWxEhx($bN(%REC;@fNLZU$|hnq@uZEXC`2kIMNZQN6a$~(Xt zVd#x6A}2Iu;gm>lR}f&pULd~t;Ugi$dt+l*EyV7FGJjr;Z<7l4Kzfb{zAFv%s+RiR$K6eCRH z1KYynz`>9MgX(^~oDL%+%sV$(--vB!o4R=59iL%tU54Rg>9m-)&ZKm_Ih2YK>=_id z-tW@(z-tSKVw$C?*~N;6p9EtAXU*sHjU(s9wH<2K8K)n4fRik7XG76wd{PPvkw*cICo zBCofUFV01oqmA7S254rh0V)VN$sp^Q_OXHNS}!??!Ot*Rk87TN%K^24K9<_BXU`tM z33eBy#HAY%p!Y&OM-ro1o>;$=FtEf^Xr8ss-!$zZuoP@gXS^tO%4-o`!0sW3W+|PY5fH%%c%$@kaVD>`0=w8S_Mo~XdCPI(oLw5v%1b_U zq~024*c?aL1lelJY=E^T1Yu&6gei$8m_HuU4!mPibvcbdEF`de; z5tpLM;}g?sYM#u~Oya(h%!LfMBqjk|o60G5B(%;obTC5{}1cXO&fvr-I|To#54Z=AZ}& z95EXP+xZ3O6j?DFInx*XHWIdh@j0|S4h>|GG80%D6Y88wKEddbd$9bx7VPGdf|xzq zb9~IEs6eZ^UdoeUp=r_PgPE0-bZ%0C@u_(&N%pEU#xr=D!qleaF;)1E8N7Ta%qk*J z8^s<)+agb!m@#UNe0EJ?w&WaUE11NrYZlWBH-~huqpIFAV1pIzXf~wMX+(4~v`f#i zj*RE5I=xUlPL@~8R<`coG8?c3nv|~Yj&lhv58E$(eC@v?jb0VbfXn%Rv__kp_TN}7 z|NG*6s-w}{6OYW|6j&xR&y(O->jIqwSIr6JP|x7}K7Q+;XTPk92S~a6PfhDw{$I8G zUl!?8oz;W~Ml`H{Hf!G^G26CPk|v{~oUcIdx&%Q0WFHVO zF|kEjEvV@kkj@l?mNR{`$>}t^1$&U7hQkqd#_gGEMXJZ`#Bym{?^QpE!HnQ^0K&7| zg4r@#JB_s|6^G8G){_jvvZ%y@VIo(i_E)nXdK$4cyEm&(XM1?wu=@DGHg;BlzRc`k z1&Ir*9_rPz{6D4nfAeC*|HqnL@?Tq9E&u=Ge5%7J=E47)%?%({Va}53fLz-HDjQ&J z4|qm@{P@2}c36!*O7s8LSc_Z!Z?5J4UYw6l{P!$9z&7>9`+Cp^tR-sq32TXxhK6Fc zXsD^O(Gmr9f1ym61S?X~M><-F?$ClnMhI4RMl-iXX6#aUdt@Ghr+#O{AEaydUh$?hUoP+zL)aNX;1#|AR zTAJe4@^%Y07Fm@BT;vT{DTvfS7o0JP=X;p3OY9$2XNb@tsL1BBSrEoZ``}JcQqcEOXz6&&!VF(wGFB`Q3LBPWWD9Sl?G=&aF%SuBtgm4eFI}Wk zo*f0{C&Zjk*YUL#1}1rX+UUQWw`ZMvd>#g=2ATjQu31CH2$U|Y7P!PvC%6l(<0csE zAl{2&tTDIS*Zz{|YV-F784}}Q2b;4+t9O1~=vn^%{qoEaw z3Ln2OL#$&_Z?FZ!_B^5F$Iz7;7;~DTPSA|P9C7O8{k~p-%|4OH=qa@`I2AmIvm2>^ zWkirB(A_yQJL=<52_WmeA8{Np_D;LN%~0ZQC{gixY%_P%K<8htTARz-6ilZ5!~OR9M?MRt|5nJjR@D@m04XiiR}>X>K47nqmVu1#@A>6ot;labD5(eQ>juB{y)lXB#0 zs+Wg9hlpz6l9^Pf+Dl^-^~P&5-=R~al0|pH)RU%#+sMQv+jgjLR zF&?tq=f^M^Z4&+CS>tBPS)8y60$#_ zDD+O*c)Z#5NNUq#FSnAx`nlrS0<*;?W>s@c1i!$d8uO9D`B3?M%n9uv>EQiNn5H*I zTbV7&DMWOyZ6Zm~AtX%#bXo&rm@1u=N;*x=rBiijQ9@qL=u;{u07IsLCKmV7noE(m)| z06g|>hA$P7Vtfwk3JC)KZ;{rQf*9sZ&%$*zS{}#tCh*TB{?UARDiNqQ@jpi{i`|!A z@?Oa>P+GDUftCBhv&-zOV!b)2L#($lYr>TT>QIk;+#Ipf*6`WrhXqUvJARsHkg}@z6OKR6Q`S`MmQWI3Q6GHOh+`qf z-_U>=NqzlQSilht5MbLPGWG_}l+b4~!aQ2hx18PuonxV6NNECos3|4TVOL7<7T^`$ zx4{~jo>bV)==y2%=3UPKu2sSQi*IZ_s9Epb_t`|x7(g>iNzM@n7-WNT?!SvPAz58= z6dT5!w9$ka3+Pkd?A2AD0bthm4C&+DJG5NpK^|rhfSy|cbiz#?`b=Oiv~&3;0d~%Y z?>dQZ=y(OgpbE9gbTldO8rBcUZ(}OEd%^k+C+MW2-dg$Bd0&%}|(F^YEAdXgBAI_htTO zCGpCI3gU^9m{T{%@aPUDDqp{RbdkhxcsKM?y1Z7HA<8($q)1_tBA(1_P7d;$N7RVC zX63}grBsMm$jt7~F4Goz5xV3u!OYJ%Y|m}X37Zwv_X^JnIcARzoPmb(FPbUJ*AGZS z8-**MFJk<*#LP^x;DjY51zy6e2d~tST)N8&*OklGT-l^Ch&oUO0U21$?kg%d+w^)z z@uDFnGj^ZcDsFZ!U5mHG**lU!f-a(ZiKHYHJJn5(5a@*nHo%1+-(OI(^!EBHwQXgv zMUEdhXyHLMyRu@&scZ+LIC{=#IYrAGat>TB-i_OChOa&jc%ogN4I;vBXVs{{LsMp$ zJ^~1K828^y(V*L}l1i~$8Z^9GMx`K49gA_Qt$tD%GgmsjTC&V8?~)5b@`aS3qbB9- z>+Gex+0h3L)_tYaW}#0cXdWXSt9+z$YCpNa?WY!grdpgcRp&KLJygm!iO(_D_5qdD2yCO_C8;AUOE0OS zWqx{|Lu#&+_{6ACD8aJ!iE6IMQZ^qz%ddU;oSsF$ovHDKh%7~AvX^Zo0$zxH}|-}j!^o_pt<`<&}sR~OzX$1aWe z$74CCXajmWS(yRkzI$uA)9Atv2APCfj`dTqSD|^#HC=zlH$C6{&X;y%g7DGTV9jIm zf5>o@(MBA9Zex3|JO0MRQ0$IO?iTU{(l_KH?BLb`xiV@j-=$qvQQG^iFGB}fkPYH? zdPAI-_2N}YC(EwGqxnpx0i@zLNHbmJ#lg3bFG?=$@@f4^Ds=Ft-p?fIB+srl|*_OOD%Q@%Y?Uj@ntTI8Gdf4$eV zOZCP6w#<797UelUjP^v z=_pX6)e=An<~ryT%`2kLQWci1BOszX;|#H|Frz;RG}C9dt;BR1bc!SQy+Xa~yTjOu zzrP~_@&Z*a;s0a0XWZxvxQxy1SQ}3u8oT$B`!k=H@kQ3HjN^Iii6P(vDE~J(y_-LD z1#z%(S_U52M$P=Ma(q>5W+-xga@(p=!-hd}sZSv{b>e%K!6-_|`M#BOx}cJCRYbAT z;*`Yw@B;2fF=UzvhX$R*t;FezileOm(La50lC`47FRJ9V?t3yW`rq<|_=h@bs%$a- zsc9yTbT8aG*A4CeG@j&k4qcAj0?(70A&P73h?oAEq~dJN2GjvHE(HM;0YlOIo2!C< z9%dr-grz?psO?)w4a*kyu_FAe#AFhUK^2YJ9|6sS-wGM`gm&`Nxkj-_Dgj*@U!m0-mm`G|8dWc6`5la zrR?9pZaUA|n?MXv!lbvC(}mre{O`=^kW21sJ3X(c0!i^t)QTO6niQsl#z$9a{jRg( z|ND5~rZ?lt<*D);@Srqw_SZ?pwEDP_yw(X`OcKnBZ+R$ihmTU=l||Y88Igr2)=x3< zHf%&neCyw=iwq0yvHp7R8;YgSp{rO^)T0$2N^943?X}P@*IxUOs%CWm9;-^Q@ZFqA zUD`3C$8uBn`?@oWJGVh~2k*b2#qN34N)#}LhHh_d7L@1iEQ@}g=8nz+7!n$rB{fw7PYa)!!m#^fF6NJzP`Y}x zA|>A=8gseCeiF^jE#z;O{;jJqX{q3y4;>2Z^t;Rq`$~mxAznGq8kj)-@42|OgrgCk zL_f;Xn{u;Fox2!6bP{>GQ@)TXvN?2Ae#nMm=dI_NNJV#{(0_$J}qV-)u&P ze2h!xcwcSaC=IF0*%q+*)G5ONnB;%*`>=JG3elHN3YI5(@yJ@q)^tM3rfx5^H{`Dz zM{w(79ZA?rdQ5wHnM$Uk`^9<1t&W<6p3TH24Ms`-nO2HV3Bvj`onIAbnPj2IB{Ys9-7Ki})V)utIj$ z)+gVNS(x8#Rex%_(Sx7Io5tu0|Kce$dU5qLZ&{?~V_rgGU8r>dH|({?y%cq;;QJjR zOqfDr%-o(*``^k3tnTUada3=lehJFnV*5_ivT$HK7HcG%*duu0%3Ucuk;;!e;ctV9 z#C{hMagF^?acOBcFqz>uFR9>q$e|7x)&A=XOI=Xw$iM;3Jo%5p!u0g#MDJYRZ-F_~ z82~cVx6Vyjg&?B=^}TxpIYs4HVroOFUnldJB+GOWKTX~Xf~VBaqaviuq+%+fl>hln zuPpj}VhoEXmXC;;@dx&%_`@kA8&m2VyH+`3yeh|H&tp<9bR-HB9$N(8H|z61CW0?R zL!L#w2G5vg8p}$C%^sIUV`922JMdUHDftzavn_nf@9{TEavbaE9iBrYQd%4Giu+C`j{sOBF&yVUPg$D8it<9Ry zIw7&wNK+R>-facPV6ltb?v4s{9`m+LmVYn3`(veTXQuwxO#+??Yj)>P7Za9BGUR!`;LD}L)$^BSnUX9C4_ox*Pln#P*PYlEn^<-dr0&Bj)&Pfu7_>yolyM z0`e^fxeXA*oq?aV<@`K!Gr$7}6A83MgQ>-(?XdGu)35~sx$|Id1@Nxdpc>#Y&jfVL zZYIRzwRA13D*-Qu9U&Zy4grougF$Gh)dAdPg`Af8o)8YDK2L6g2Fuk%nF6kMj4oBc zmDPi-sF?%!=kA;Dd4xtJy6}t5is@|6Y*wKWGa(qjpuT+m5NIy901To>TMpo5gY!VW z>#r-Ij>iQ+%se8%4PC0@|2OswxOh4+QFZe{3jm}3-~HAz<+x(8KpnFQfYAKT7x6j@ zLgYr-VnJj$@Cm5yC0c6YqiRQo2$PdnU_uS6iM*W%=2o}R%S1Qw$R1M79sf*oEp8jW zZhk*ZG8FFiR;m3c#*|0c2*jP|GoD825i#elml8_tI81g>aVwH9)qG(K8)Z$7 zE}qpdCO6x;=(Zj1v(>mD%}S06(Q4PL^sFzs(KR|?1l}Yn&zk-b3OZ8PT;qDX`>%jU zR<`vyCDXmCflz%HMdOp`w@GhI+b$NW&rUiEQ1exLG-XQ3iLb9k36ll$yd+7JK&| zlCIkF_d<;ddGM#VoUXCc9fR*&ZKt``-`+sG{o9ATj?#v_3SV4iWsv=%Y-gK@ZZ6;$~48j+g2iX0~V$$sA z(Kq4y+#_tK*G+E5!V|HP7Bgq@Bi^Z2|DcP1DD0n>_Bot)xq|1W3@eoDYcf)s)7Nmj zCD_IeM>{8N@NC~kZvXdsqNeflh^4mQyHL%9douB6Nv&~QdJeRMT-J*`FJ4X^EM|H4 zpH?}gtVKm33tLFgDYEUR!wqd;(W%&iBJH#r7?sj)pc&l^){|;cO;#8?(WF9Zo*hx= zsZpS9hiiE;IAwP(#OQmtaq-F=2m=J;U+o;;GF%`ap4i&hI&VQ8%I5*PEdebYT$XWg z^a|3^R%!=KIP1qIL+@NxEh8WwX#4h2;|57~gf?Owep;yYGEaOfoW#v`#xFgj=iiib z<%Qk@mdJw9QcP%J->ZbVCQ{*H@7S8;CuXl0RbIax;e9)(Ap7#6T;w<5zCqjK+JDg_ zgvIZ}`$rv=>PlguQOfKqN?>nxW{X|wjXCEkWt+%f|(!5V<#8zE2eP5S{ zmbPHI@`K?wy7D!hADSVQ9H*w_w*?m-)8!dk(Cgj(&VI2p^g%j9{XY2zx>s|Nw1wtE z=~EiylcxlIzh?_fycR#m$Bzn3-rTLuIpiUt3<@vWCMUn;BsX3~K3<+BqbopLwMW`s z-Nr}6d$&}~{DVQfY%hc1gYdJSzzUX`R40%cT3!+&7Yir4*@OGT#jDq!??W0ZSlHY76`z5Rt39(tS$iL zZ0&kXSdiXq?er;>XP^k?zTr4~Jks<|YHRO%4u{l)}>K*X|y5QvA{)8}O_m^4-I~1-4dZ-)&Vm1U+5B*QQXI`OAT(Ldw(P*mg82iJBA1_@-hzR?LthTlX zVkn8{@Q-whU1PgF4`wsa$DDc?i{1-XZ*$tj`~1QZw3NEMcHPI-WhD^X43g#xCAneRXrojToaGlm zs}3$dJ-5$Ehutop+{i}#Dtmr?uRnPe<&XXo-O)~B?Ab=0^rzkOF}X;HqM*_-Ox1J0 zn%E}7zwkTKcRx7sXvRe#$4`~Eq6HhIubO5Q_WGNXAgo|2IuY^t?Ush~1Kmj?)~5*XjDN zq{be{16xlTl>1ZiG*&2Cg=`CGRG6gCjUNR?@G*7)r1AmOZ_r6UV@SHx1sk1E?R6aj z8YO;lD(?4Ne~iw4oaT5}=Mkk+l^ zWS|>=I-T%#@CpzT5yu0%y0!#R)ahG1F!wXX9q4o}@Z*EAPuld2Qa&J`ZXrtP?6t(7 zr4Rp|l=lP>FL$mW_L2Vw{4Tv1Mdffe6LK?9RblS6=I~Of6(o2hLjsT*Kmp}vKyuy8 z4S+m4u92`61sXUZQk#jR4#x-?R&0XIXQ1Dxhz1sb^h_L7&*if{0RE{uOaNB{vj>0> z4$waUWVX3qlR(sp$L{gZ1;h5au4nL6X~?31vTkI&K$QV zd{J3hYVx;MPT{it)A4Ty_W=7!+M;U~+hQ#6W}v9@q&*!Dn_p~vjIGf#9|BqO|p5LbF~!$oog9zQ)KSV^HIWOyADc=Az8TgEODj~+hn-; zX(bHm3fi89xv@0#%+}Ujl|wH@XP{?Ib=x!rwF~|pzFAvHge{?4*>ZY6p8|*zs_oJz zu-M;3zIi@!;)-5So{F*`ME5@C-FjdreBp4!?lDhh5lcl99PMr*=}i|Xzp*dX!deKi zO|b?s&MmOqPc*W9@`-Fiu;ncUN}76-H($2(1-#i8zX^S>C6GxJaV7;>3o2?J%aTvm^gnb<3E-| zik`fLZKFGG<4n&foARwcz+aN>t~4j1di!deXq(PyhEQv@nY7KaG=rYDz=owfzN&${qFn>%lfN0(~`_sZ&v;iE08~ zexd$#xdr5DHs2o{*lTBwQMAYfeIw)kovNH?OwaX_T6zL6Z}EI;jRCk>Ph}=?T&9266rCCsnk#?tz{zI zu{ z_J%(=?hnO#r46J+TkDYe>AY~PbsCpd4!NCtKCZ|RCC40mS3Bz5>lJH5&y2#<%tOA% zT6BHJpXyL{Pc2@qjTaNtfLC;>EwGCaEr|m9p-&msC&Yu3vu`?s%BEPIpRs zJ6U4>o(bLU6VSw=H@1KN-yAW;$>*tw_cf$eWYTqky3xaTVh2oDVVJf9`73{`e zK%0Yv2Spy?rB2UDkIKxx8ePiecze$tx8J=rWv_M2Uzw4nUPa2S=$3w?;A~;?9Hzoa zTKfz}8;LDFG*^FnpYoG#dIf02>broIzi)2NhPiF%VXa!9ZGRwQvGo3ChK-SR#UaeO zDfG@5rSxEkqW6y;P&p3mZm))F=Ge)nHB!iZx!X8-u zqOf0{n_W~6q>PDKOmAjn^p^APi{;MG>FRy1#{c1WR!`3*(Z&7yDzx_-(LFtTdwYG~ zT|SPg3dT~29QB5pX#arP8~syf|E54HLNc=$TxXElkLoUb46U&+mo(PYeQEO)cR3dMuujLH7EtA8VZ&;LuSSKQp= zzvZ1&4F*!CKT?T;(X8)1%LT$;`?3)nK61Wa`g&Ir@&!XvTRdV^Pi3NCH^z5AB#6D= z??hMhA5~(;M>d&U7vyeXs76K7MU34LviE#yC{)_W_fz_F-M<3iwKVbQGykl2NT*or z%9_khHHjhH)1?Z-Vk4st%EFJ0hJ#8EUQjxwS+FcTSg;chGQrC`&)*Z?mox9YlG|M% zzrA1FV2n={t~8cZs>sUZ<8bn2gI2U9w4rUEzYz0sNF8jMbejj6;RkMb1Q!%!f}+h@ z;(0kieXlhZNX}S3I!7z6c2X17-!;?Kx`l@$1vSyP_x1-9!pe3cuj-pc#W3z+L=C!LL zySwuR_rFl3Be+V^NzApmq`Mu^zyIkr=sOyGujZ}OMKWS*PVUsn@qeoOQ-Hm`m}L2F z`Q>lL{c~YCou4LNzrios>qLzH)2+CL)C!^GD=~NMd{Avj#Sbe!?c6DOJA!es_Vil4 zJL*9n=(t=dr2x-TpVX9p2}HocHxf$mxsGUeULew=pDA+eKh{{) zdFK0`FB-LmMY4ngFmf-9jC<397=>v$`Z&EeLYvm>V$6ER9WZqdQE2*=GO%IzbfOI{ zOv9|t9A40Gsw~?0tLyhuiWrpG&mv`EV^CkBc+dws;%$l;y&qKOIc5%>oE2ZA|FP~9 z*zKN>@)s6fSl_l)dzIs7q^lsTQNb}n*QXIzYQ9fkK?)6a1M0N2%M@9W~`(hRG93Lamt?2d+ zX;%5&0MHobduv3=7gqmt`!p*ZJLZp^(|@QFeyZF}G!F3cesq;umt0-*I!SoXe)TO+vuj?KN zcf=q5%$Py{{jC6TZ5j*cm8zV6976R@;wNU8?&NRrxKGOX*=sI;UdFP>M-&ZK9yl{y z-a-vK$)C5^&Ad*#b_0ANc?iZ!3>m?2-&{Iuk4q`gu3K}<@3k3CDmPPW?|g?&Wc#}E z-)h$;s@kmA+L!kA3r@X(BW> zZkp&Y^S_Ke-C2qs_a2x(rACo}rTzZB`k7B+K$epv{fTksR5sY|&GV^O&s`pWfMIF^ zq@UzJ;jvx%m#xRgXXkQw@1E@h`3u|67kydHVn0otj+p{9{uS_dZ`UW1R?X;U8Y0cg zYNRD+l<49Q+2eovy2e&cs|kMH)M=paNfLC}IHt6U;SA8%Rs8$I>s@!Nx%usw_yiN4 zJ8vSmd#uM_pE9v~H=&8Wge6V6ztU%9P5r5tTu!J|eMdA?MTeV+AL&U4-pNeCWdr#IQ-AlJf4cZn&@rv)n72{)B!;Q?! zh*QZ}L1fu$+ILM~$LAH&oy|OYQt{COZdM?>VMuFYJqI5reWxd<=FtA4$N%fdgTSU| zt1@{m;IS6HO6V8*__V)d#PNz#mUO{~@^9?^P&ktu83w~VTokv)c|Qt$>07l|FTG{2 zlFI*A#*j{3jBbVrQvC4WvtBM!uY~_Roq1f%J}KJ1B7MMfVB4=K)QG7ux%s`kM680Q z{>V^@I=JZb`kPj0GNiucVK5`hvA-PRKP;n2RHO;g6%QJ&WOYpYYFs7YG4SgBL_@$H zrx;ak!mZ~4sHxd*i|2(ryk$$du*S;bUmx=iD>cTqUKDShkO&XA8cNR^506=7Dwy0o zk;^fE{TTJ@t-YjBlRax~=a7!yr#avTpDcmnv;^X6#m<1zsOh5{r*?DvfJYw!$sNU2 zLH;`PfHJYc;azF|JpK|8peBHyRRU;qj&AT`WDj_B3+L;9`&qCqR4IDA@6RZmilxp< z=)FVR{I7>Q`9&=C!7XA##<<*r6wJ3(BLndYZuoAXzZRRdeYCw?>AjJp+=ttDB}|zg z&Ji(;mb~sLAf5cvoU2&Cc>pJS-6l1sq&G*w8M+4>XpXOBOXa7fiPkYHY`*(RWyU#| z)Wb^2Ao!fNPp~F^J>rS_cQ7Ndy@u$h`WMf7<16CB;;DF@oVEi0zeKL|R6h>esox&u zF+VA@+KA14z&+|4_$wxSE&pCqtQY0Kg%^(WGb(FoCRu0P#b)EjFaAdS;)vhM63%dQx+^9$ag1YFeMzkR9_uZ?O;Y<-YMqUuVu=;)H}k zf0Mju+~25s6TJ~)U!{7STJQF4hC1JRnak?MI>T*=H$V)IU)b7v%h~mW0#MC9`Wqh6A{U|!EGPu1`L|9#_yRnZXpO?(yUO$3jx>$=WO^{Ap=uwUHQ<#(!BO;VXE*vLKB`yu4gK)s zV|)vm_h)J9)6!a7$0lD2f5wC;DeAFmWhvKz{#*E%EZa|sG__$q9xK_73Qe5h zmveT0snk?ed~Nehk(S&>K1WacBEB_x|JU?=Z{zr3+2Jn~l4YyE?lKGAk0bKtZ)iVf z@7c-Sn{7WN(WDwJ>s`916kX9k9sH0^>^A-Jt+6L>z8HTU|H#`DlGNh(sciH~CTw(H zY{@c^apa4|-DnI*o7u~NUJ}t`Tic#`<#+E zh>}gl08g2(*F-k*RBXA^tzDd5i6(~R<8y^3bJY@S`uL`au1S@-L8s5(j)_F6Nd)?1 zkQqe5oIgc^eOO!n$|KpoPU#en3l`^bI4 z{T%IQV5&i$wx6E9pqIY6JC&A1_yxQ&22xxLJTKIGZjRb6-9WjmwVqZrz}r(~0f2kZ zKpFrY2H%%6V0HMy=MXy#p$*cE)C zoA^3g@$1QH>QLrpB=)K6@6ef_Z^sVan=6mzjDA%YNv(?|bKh4{I=!O!Jo?z*LWJ7R zK8FzV{_D}?zNn+c_vbPRL>lKG-!L9X<$Sl#*uLabI+K@PS>hYz990^wx62CvlGQH3ZV_ecb*~gQ5A-}2c;>9k%wTd3kKR;BSvdieZ$6V$4C(b7IqnuFF zds`ibop`R;_uPpSPM9^Gv=uaaoc&_?oypvTZ_^nmx$MfreE%v!*z(^qCHNP|o4#Tz z+7g<4(is-?K%+?1*stiP`dD#X2|X<(^_MDvK&p6(%cboFhAcc4528Rs8N}JV{t3}{lH{w zw>A536BPr$)PI(2=4vH;SDR|zhwLlLGqqzn4|0lsGkgguGMI~a@uBn=i~5=1uX{-P zgj?-_d?Aiu^LE6tIW_NcL-)?tBuYGGM#;|KK2fsvzeyz#AXh=HS$dn&ctU8v9G2atx^rcPWkee<$?$36=EHlEHX&8 zpIIuGvtkvabLll?S5%ZHVv83p|HL2Px*soDMLIBdAu;%Ko4%}uwyvwcZ?$mz25I9o zAs#5QYKJ_Gz{DHP-o2&@?MJVSa|h|k-}^~_#6Z8SNG6g{9+0^?v=WfTSNNIXM&~iU z!+2s5G&ReJy7$=a^9NMBMb*Q7N{ZOTwiUvPn$`F3@kU`S#Vevyi%)jrsNEp}*#?Z> zI4^nk(Eh@e@mqE-j|CTGLz_b7y_@UNu9QK9cM^i4kHU_;Zxf$C&o;(J6i2HqPDs7%?6FYsy-g<6>q8H$GzWLY4QCzYAatM z@a^sGqZXbP)sp2V8S6&N)cbzUkP0L;k=-^}7EBOc4SpFDmTgSGb^J%i)th%EYf5NI zJn-(kpv2u_ws*N?>vlvgRa9L%T;Vn*=?^&r;q|dy+}d922EJo6cRvtO-_AQutPE!U zlx;p=DodGLq|Gy^HZe7|GBv{-Bc-RG{COT|xCEi32C#sfo&gqEOtU4xqfU$G0UIde^YiNY5}RcBi-T@k4$Xshm5M}Yl6|bAFTw~Kjzw>OW4`YDYX9Xy zf_&6&pS1C#c>WF_3JrRM;#rQ|UH70H!;z4X{*Hnct@Lf}EzOUCtl$~h9I2_!_lz85 zwFwPO_A~U!11g!?r&m8iu^vgKlcj-28A14|rYEUitQBgw@eLpLX&!nF3R<;%c!W0{ z!-nfh?HXBaI8H9319Jw`Ji`EYpa-yPYfR1(jHY2}JughVCd zb0w`mhpNPjagpUZ2u);+5q-D5o5Mi-;r5$E2Bt{kfwB8TJiF{vcZ1hD&gDMB)vJ#i z3JW!!M>Y8#lbZh%GqYGX^)s+K=|YRf^W}#7Q^_4`s`5dr{{bU=qLmGKdnCalsE7GEr=$Ii7u{&3QqK=#2t`EZDT_$yyPT8zW| z{cYpzaF&R!!!yN9^4gY%(j=zk0j>KKFBx{bQ0KAluVqh|p5?!zyci*GxqTm5dm^pb z-2(Wpe@X4W=kFi)Jh~4>q&z`JVQcuOHz#$;AG7H!@M=9tnOD!C`tx)b{}kVhwskDS zyUcS-ul2HT{)-vq@FWrVcsWb5PLTc$$LANV z|3p2VpZ%cu7fBvsXU)P%rK1EAQaXKAq??pj_`Nh`Kit*1eaYNi?JvbqrKBLZ=h*X0 z1Zn4yyYhj-k6CdaC9pfTCH7?2dGJmdti_Zg?f1Xtz~i4nw;`(`+$SCWQZZj`wwXJs zUtJHUyc^`@QFpo<+Kx!>&9aZ&CyrJ}E0w`e;!hAR#Y!7kk4vAP_3s}aVehZ%P~{wvaYad24#X~Sg1%_7c^V-2(n(IfDz zlwX$$C-Am!@WXElPOv5v>Ba0HN!~rrm2@eWUYo5Q6s~?Uu4y9@$Lu?+ih8<`I2#9A zZ;q368tnkNNjYVoRCAPHYVG8Y>Ueg!fDyig`8WeYXi*f5#j}$}6%E>10>ius5Z-1> zq)QgAr`n}4HyaG#ca|e!bNc+0+HYq&-QnHdA2!WW(e(-u{Lu^OJao`CNXu`v zYS7SGZM2^w+vi*sa9f=Fh|dm#siL5OwQ>h6qjjB>SAp4gM-3u{94ChZTRY_;{I;_M zd<)=xc@zgA!9bJIMi2tK+H{tEwd`8Y?6FSFa-BnfXRE*DKwM2%L&Q-1`C6sgz&}#MN#TL}SdJP)FGre!O#5-*^MAP}N0lrr1hB~Rc|9C|7)Z|JF`giAh)IZ} z00a4$Hq0Eba-7&sItzy4U9!$He$@M#0NK!oqZW{c(}8U8Vw=AP@*bL0Sc)Vmp!`V3{qhK&o{^6^gq=GoloPLS!Pk zM&Vb}u$6gF9woI+U*6q!`KnKUy!OZtnJobwrK8MhwtB&NZ_QoArcLb&cglgWj zAKzZvA?zHZ2s{7SMkO|)f$#&*%e63K5Ky1(pzFJbV)i{3;)P<1?d{XcnZ1n8z|b?v z%caYHRl;Ee2ak^+2D^Ool4qJ}buyL8hM;yEj5Y?yg$X2_TjfZy0Cp;5({5grKZ94G zWh-`$x&^>PfnHFX>%!x!&skscc=d3o!+OF29tGO};Z5a3n8ejBK{uUxRez&^_N^2E z$(D`n8R6jPTEUc|e9qE2G93Tef>K(qn-EJ4b;xj$Oz)#cm?0d%fdJ2q6A0)q8@exb zHY5P}%{1;vU9=NZ`)sUh9n81lRc{8$;g>dYm*>aEs^Vu3SbesNy--rVd zsvz*=%j_k0gfGNE)+)o3y7WSsS-P-S@@gt8do^qsrJ zZZ3qZqkxSCTj)hHUF&+lV=BZ~=z$1$%t?E8`DU&C;-YfH)~k*?EdR4P4Q$t!s#4-_ z@w=nCrj>Vqmh7h|Qy_xV#>lAO2A3rSITriwpfDXGMVK=MU#`=!_{|w-&tc~~p%Mny zi;;t1xc!AebC`<6)jqP87x8^EGtQpyuRf`x1GQX($y#o92M#WPzM-YFND+gJEKJKz z80dN}fssH+f3Lsjx(8s;`^#k3>krnX28AR?>D^Ksc;2h|AiLjx25=SGR| ztz_d5Eb9?|%QseZ&%Fn*^a8H3m+>cu5a{A!dE<84G{Os2??)=JRaXx`AJ6tX@^)Xo zm>>1A5cTNCZ~#bdh}hFHUu1HTs`yojC2*DvEV*?aaj@V=rKO<%lu=&S14W=p`(9N) z@$09~T_O%}d}>tNjRn9MNS?#p5e7cj3EBG2{V!77m53Rxs(6=btS5;P4aivW{l&#m zJU$Ne%jT+I6614ph4faH&~08<=7p}_VevZ&?Gm~(3#?H$Yk?Q8VZ5zpMK`&wjb;RH z1qQrEG~nPa)P9H9$B*IIEnW>j zMlb1LD+Ew<#|`R;L9s|-7UH1iOE)Up)&{PCc-v_btmP~dMe*NW-Iyy5ht}&N(Bs;;K7w4F3kn@z8*M3uK)b$CM-aI1{C5ph(@ zY#Vx|W0G(I_C`gtTp6I6530mjhHCdf-kTkFU~R^`H$KSs`g2jbVV&jiKri$>pRVn) z51w`Ln_CNhP|Pvv1>P)V0~@s*_wB8|;I(VrIE~_I!oW@-a*K7cv-_8_q=$Z}XwWh`kogZw&EFUl-Brqe@ z)1l>wonebP#iM9_tYtiD=G1QK&Yc=O+~pY36pO>>UrAFfr0~s*kXCjQjgUeEm2G!UF+`UMjS6~RK?^!!^ZtT zZ2$WcZ>@N|%kjlJ{eVDeyPL@&Dux2=`ov_1|}M6|G7@29ld0j6;Lt)Z^B@+|m1wz#F^COyz` z0CkHS4oxm1DddA^1ALsz2)p@gozQEvIE(j4WdBf!-)T3;OES27aUoMZ+McCh^Tj*_ z-+RV#gzdudqC8eA?O|{XNK=36tP_UnT(b}7J zl7>Qgs7#t?U+&67akb=z$3@gF+tVmrmwws@<_;}{D{)in z_iUxE*AO%#lEC#@Q6V#YBes6UBcDoQ-yXi;)|F1i1Hznu5QLATLfP5Z<9Y;n&z%y? z6PC*XY8iLwVPxH~oVaqIOE-~CQ+l+;t<)=q@a%4b?AKXu#LQ?)83{$gCN#zLf8^e0l334aYS?Osh zxQr7bMzy~CK4}cO+J8}^Lg?$qws+==ED4k0(3y+i@)kJiCdtd=*DLPmgg;FIuu*W| zcj#3;!q&IPL~) z6327>i&8+W>Y?bqGFSP{ZtkIh_-qUd2sAS=ls6k6pXbZTry&58JFths)p4*~5t!s# zwkyh8y?K34Vc8U9pznL$Bk6Y5SKEVNugTv2{m;C()jOl?^7zZ1;Bw?mP>WmyyAZ^A znykRNd{>uoP@Gzo*F_lUB;s&K1P@m|3@`Ux9EQPNy$1EN-A@X&&wvciLkt``6(geR zyZ^U@a6E;`^4f_4F6VZ#Zd@%3)Q=#EX+8Y`_g6u-JlZYLDhEfxb%O4&(JNGjw55w=sxuWS* z<{D0t##YdoMU>g|iG=zjc^`_qyLyOs+u@yV!9~nhJ>3<@*`O z?s|LR46@s_cAhU)qXJ(a1QSj`B=K{u zP_Hw<`^*(1iBEyx*V~p$K*#(K+@WW!T#sdBHYbu0xQm6dqS2ut|Dhb~S*QgPeAJ3r zNryOy9}&3PuBJi2TG15>ZE(>+opIb<4R0dI!o*9Fs#n-%sqCh+p12mXt%m?^?^`-# zAHF8Tg5Q;gwO#EOWxc~7QBoTXlb~y2BM=me1S2leCXHOc&_(h%=tX)Kbk6vKEyp4F z!=x&H10695x)^6OG+J^$bALp=T#foEU(PZwa;mVbIsw8RZDr#+Kw$ymZG;OLu*rea zzSxH@p8Lg1SQ1XNMV5}&$$_FZ*ZKqanIwnrJ`yIn7Ch>+Ef5E~I_p?{(d)N|PdRKk zZH-&Lh^=P^UavCuw(L{0XsBM}<1kBJ$L(Sw244Ly00RjuZ`g7T+Y)U|R#w|_DZF)$ zo6hj^l+NKbtsXVhW%;4}Q#CCNwix6?R5usHh&ZnWz4*ZxpvElfI0FYRt6-jjo^0jVbJxcigCXKQxKHeixn62>Svhue+Aqwl+d1@h+(0n1VrP9&vEowq zt7hro4YoUxTAA1FY@mBfSLZ;h@v1mT3|GxWCvg&Vt|~>Eoep7!Tw&a$zBDkSLwZ@f zW;Ij+q!^bUu2&1u>iT^&OF(MLkC1X3H}dYZqMR*G!ujI&EOh-cW^sk@=7{kyOnC)& zd=ryhZfJ-s#lzQRdzmmHnQ$-b)dG{ZrBuwK@t4yOO(xIDtC1UaauEa}#98Obm@HTVZa^2l^Oe^UlQoQ zuuLbf^)4aM=#g)C97`i~dRr^I4xrqLzCO!cM0tqyeai-}&2JJT?O4E#hO-0sc8#yw z-tJuSIbu|WTU^1wxMjc+rMPO^)D%}{-h{3BT5|sDi@@9Y$Dg0~g+7S*6gczf$1jn7 zQ+|O=5t-*ETwuLsSZ(kP$y)6<*>8v314UNc)2{=^7E+$ez9P8$qS}6mD889S0lue5 z)gPFnX3Ubys3a!CWpv%@WM?HVh>qDxB65;6%hq!l-%;HWXZ8_Cz1ZYxJ3hZvxnZ9k zz;N-Qyw>~X0r!4>sq#c9D(g>K+2kI&mYc0T!h`?H{IFnjhXVZM!sFuMO=7G0Ys=N4 zfjGmPn-YLmkep(Su)df(vL3;k&FOQUttv;_qNCenah?wLOU`VnHZzUb-j`>*g*vK4 zt~=wEpp_q2@4PyHo9Au9;%+n#i7=F~Ix)ASfshxwmLixLha zF7;Y4U79cZBF(11)4s_drI@Z*!c1Iw6y#?P5jGPgnLc zw_OcVrMyf#r(9lXS?F79;A0xGTKwnsU@viN!`bi?ZxM)_fpwdkkIF*LcV9i3%*!;k z#cz>Zd#)8=D>j_hcI1aHrOse_Vj8FQl(Mto%wdTh%v1TeoV;KS?nVe^*Gni?oYb_$J@6L;gctPJ67g~H)T6(I*%2Gb;&5b3$U!8CL~-CzPx^(U%h&J{M&ciaD2qvxg&1g7&^b}`Y%3jW$Axo(ZW+xhYVS;XZOsFwWAtL zxOsNjuOBX(aMm>L`xEu*)=j>!i_>xb{&U~2oc~_$CNFhd);4a$vuiHC{L{@G0`iKKBPaZzo4~UD7=Zu;mL((^eh{LyU z|L6APk$j)--9`7@-k-I-eAYibcFL3~tr|SF>!oiF&CD^GG;6-ATeokoUOK&g_=)cp zrJYF>MgM1?9r=9S5wqWVtH!8ym8&=Y>L>W~?5OB zeY@R#9;-HO`q8KAYl_#-NSPN9wA9~!uqJU_pUCNp-UeC%SfbaeKRI{VKdi}PXPlom zufNrr{9>zp&4#Yq`^yZ&k9p!{2ly|(%ExQg49t16d-tnzY~hEBi#yNjT082@4@H#^ z7Vjt={K@GvKksipuW>-sg{eV}HvkRrq$5rmWXGcOEx-W85!|8vk*!>%{3{_L)alH4fR?EbP+M(??fd=(usi zciHAOJDq{{W9?qtWO|#c{(cvo%{KZm&C<$1OFnmC#jdko9$d-~U-d?d9aUYc#%;K< zZOYA~wZ?BOxp{FywQrA4+?8Fa>hQpxe|D)_<>{xNj%n5EnW0Z!EUY~I$dMyEcaN|R zJ8`<>TVq{6zEv~BWFDE;?fZ!xMxM<1=JxZGuaD{6vHzJjHLHh|nx;>z`Dn!N6Z&;= zJJ+mPGc9?3zwfL0`3>W)mAo-#dGbU}qkm<7VCgryd$WxEYmOF^KHMjaIXGm;p_w0^ zZNB1*W-XoO#^08nEneND;P4M0K5w+!F93pFzI?g9X?y3aG{5b=`lO#gHyI1YgqHM&Yf?R6m?pdKH%4mx!r!;cK-a!l`Eb3l`ooj zr1py!hJTawWv@zaB@D~B_WMs`FRW`?zkcoHHXBQ}7k&B8JKUyChgT1r(4o;Ik3QP; zvDr7$-r1D3aModA)PlsE#lsTE9FG}Pdgz^R3@vL`oi{Jzg_!FfEIRj<3*fuv)5iwf zxYBda)jr!6E_|*-$LkAc_noo!=Fn!J55AOiYsKMP{VI)bH+Rk8KN=p5o7R@QcIANG zWHME${EqF_A8&TmKKaJY1BbgU${d<|-G6x7v4>K+Jvk$$;rdTMdcMb!qeoYYXXZDb zytq$|Ha9-`ZPQx|(m&GwIr-GO#pjFrzcps{yHo0<&h7l(+7f5Ap|=Z80pVzP+e=s1 zPaSf(^XH?l-~9Ka+Bs7i0aVW7UTgXj*6G8)9=2_2bYen_ z=;*gE<{4(}`1r$<-)|KXPGueV$`8nv&(}GA@<`iFeM4^EH1Yh}{QMnnFWUZetyag5 z9^A3Ldj0wbJ5BBP(t$R?ndj4cd|7|VACtG57o^Ubzbhx8+43r<1N!FVbkIHX{>3fD zyTjHvN{Utr%RYSqC@zyHuU@-$Qo*cVLCyXBkDXg_xLfW|a}P~-y!P6~_o4^xJUh)L zh6CwcS2(8A)xlR@sro$7kHI-tQe}O{qiLy?woM5HEI7xSu>5Mj!|NLFFF0G2mXOfm z#i(aSv~D&1e3t6C0dF>U|5G4<9DUKu`pBG|Jp-oDm8Bct~8uZCIv`HCj>V8+)y z?SB+r?p!+dF=6wyOWSH6_#!ajxi4qW_Ve>AZFACEcW-6C-*&bCdgv|jm$QRAt$3mJ znzMUSH+H$@=-s>b_p{ne7&k65BH_%-DNU<&XjE%X&Ao@J?yGlt*W9L=i&vc-6Rf>` zX{zp>-BY)kSFT(+bLPyGLx;BAHt9E@C|}GQoRy{hwozP7*ZE$1XT}Wt{P45Q_W;hG z^6r~AkG$S?dBA}~hx&vSJ^td1v9%U;{OVtgJDom#dS~+%T=nw@pL1M2Kc(pMBa5H@ zw|V2c@9rqLQgvZ;u{}F`!IaWUfwhkuJ-T%8AD3ngy|r?2>bUw}04cw9!53pvRwUm3 z*1FWuaQT{6`8%F}>fGG8*S{F&$jke3%$RN8x4HdEw~XUQx0?h5^&)plRduQ3_8JRCe}vtxQW^ipZ-UGiAzVaBKo}{k$)yMR#4Tw?55W-=IN*Pp|(Hl;HYg7*I~O zO%0BYih8MW<2e^!n_Y8G7w3&;;W2AJnmxPsiUsFN9Mk^YVLuRK&-_%-zfIzY+y9IU zbY)ii{p!_hv$;o)9@ax^UMWtw_{=~5nK$r!$mL6~HfU}AX>!Fa&nvy~&&S;s?M@n5>#a`~3Lk#{`GWbD&psW$_s3?t58UYZ zv*YO}X5Q^xQ!EjYkue2V z&W>w-=*=->_T(4M99N60GbXtAsvq|3S!VrtDNx3WKAvi+UVQ}EivK7a*l)8TBQ~t) z>>rm;RI64kK^xkz;n!b(ZLHJ!qtKdFYmAC39TTuWq*ELJM_zwrP2Q3P3$lj{S$C!I z#B-x|SlSG}1}HM`>iOa*t9A066Yc8Wy8gn;HQv~$4+{Ep(IOyQ@7lHNyYIeRHZdfo z`<9H1jB(?}fxef$-4jsaJEd2zZfvsgyH~SHdsU8#jvh05^!@_}faF^z@YRF`dnVWK z*y?GZNo~Dl8X4E{$v0+<>X#iRX1(xL))GK7K!0z2?MM~>xkbGfja(hEW5m&@VU=}ZyAR@e`J`q4)lN*sWcTDNWu z{+-_W;OWsVKNzNuXx<#mXyP|nK=`lq)-(0%$K)?~y+fl7Sxf3ZZW+V}PVU$q{jBVD z{g}xe|N0NTxwQE-BZT&2!nj4b>w=j;-xeGPw3RcF~0+i8!5^A0U|c z7>6y_X&k86Y~TLHD0t1Cl$et6XH@vUmgER$dN{TmRr5&e>3d!VcNI2?F)N>`Q_h*)FxpEB5hU|KA%GS|`EvvAo2EmPrYKc0wL7J< zzRKV}7>-2)iv~bh2CpPUH%izCSA&M%N!`*qDJYg#!vHMUfW+gr^%o5^&z*FTX8|nO zP_&+Chne{m1=*dvi5CWtNI#3<6kW_k}WT zx=PZTQ#_Dd063>0&3g#HlUG(seyC9+Riz|_&ox$>VuR($RLr#I6GDx=5-1s-8OQu% zwg7p#fHF@y)eDljjpz)-l36ey^k9XMX0`-60N;R>qD&CcKvX~o$JH|EPQisPSZXAb zs#sFcV4ScNioWpwfswFw5nG>xR=UFDKpy25adGuBYG3K(BnD=yl~S)~a@6}*kxS1R z2N(q_F7RGXfsYE+5K|`Z^vydT(E8)$M{27?07^=xB0YRZ#Ckgw>nRmyh;AsIpkr8> z=|V&@7fR|Voiem~3fRLy|8k%#uSR+{qYzCZF`6rO9vIKnI2LEN^B2 zr)gRvpgIaB?S`ZTRxv_Z1WuZYN*Oq~@ofA+9h7;cj=7!&dg9ofy^-LnXACQBWinCzmIs5ttbrum zfICwp(d&dc(X|4{CqM*X!#PHW2v=C|-BWj%)0(JxG{-Ug90+-CS&EmnQ?SHVlrBjJ z*(J8Of>QZF28BAoP4z*ovS6lY_#~a(>~tf8qX#Al7OWgfi~_bfiP$Gy(}JUT z&$&&2=~~=YE7s;b8w1JDEK0-$vnSDEEPw_W8Wf}8kOqXnTrnG=5dS452*7`u>{jv@ z%sh|Q2>j)+i{z=SE+gR;4Vw!Sx1gleNJItFsm-061vVVUi{0wZwUI|ygeQsXInb>@ z&px?3!b@0nH^@gxMoMA!iqJ01xg=o&kuoV1OO;Cqx`Dte&)*B$a)1%Z28RFm0xFGn z$>tT<5Ysfy$|Y3-@Ug354s}Ev`J#)@fG(+F%bzGYtd_Nk112pt&ewB^z&Mun5|Ww7}T3_@pF~>_Ut0Xbkw5&}Ldp z_1dJg)W8-kB3lNAYQ0a8c*>CI86u^PXLuD-l6YAXL1peN>{h}y3^W@Jl+}^khEGdD zvFA*(cp>X}M)Lrmiy2|%QFz6mDNDKoxB%p4LeQWT$+)msgp$w;xx9vE z-ok8NsgZb!L4bP-CQ^a|$|nFgi;KtjXL8`+(hJhZQGmmvTB=~nN{QkUjIf%k#72p) z1b%{ACh!&`U_DG5@+1*SO3d>_n>ikKmqt^cNqvAfi8Q$o+dPGeT?s%gX4@0nLLy)g zuKcdNh50PS?n-lkfsIx>JpeT1Il`vg6>8o^GJGZx@>hbE2F-omU~|$t1>o{0Dxgc5 zYBFqS%b79wQUk@Bit;K-l*Updqn|+C8Kp$C2qq5Jk1&FhfroZdu!&*%BV4P4RYlmn z4y^+e z6T`u*hsdf4XXSRGgmWTXb|l+@MU$0m35-O*yYs!3TUnVhvi5PP4*{(jGYqsg5D2OP zBIZf%G>lBDKc)6AG6yTF?t)}szybjVY_gmuuL=dWVw#eCL?}2F7b5|nqskG<$mvU) zB2se>lV1vdiAe%r$ewKz2Juq5&-jGc^jIvhqn_#BRh3W}I5FpZ5D=R1P?D7E4X3JF zBg0B|*8PVy2VF&Yz(k~JCpNE8p$zUnCX*N0`jQTV<#n{>ZB6i0(QX|mh)^6L(vUfb z!-cWY1U50x>=Bi@a<%!}fcLC)Ec$&%5 zwaParJtx(E2j#2di=bcNYB>YUBo@UniMK)hbhx`ChS&Qi&?| zATiO9eTZ#GN&^yNDikzXHk9uLsHjSe!)Uo&IZQrbS+0V-kKQ5Mpd$j6XFLIh4e=!n zR_BT0Pi>vbi%UF{AaAf`!-gy=35?~E6t}~s4s77?W!T`7kU37|QRO+Mr3FEoYeaIQ zO|Yr}LRZoUFka(fD6py^8@CD9#CH!^<3#1>fc_3dT&It*Ded?en^YzgaDhD=RTHGs z(R)00rsWa7Ldp9pcs5C_&6-Ssn2(J)qBOD=Un_xK?|_9PrH--ngWVOdBpQ#Z0veTD z178u!=)=gtIqMY=z(WwJ8Yr!;3-&q z9V>xg(~;1}%p639XEVT{4j%5(|GZtQYFkkwE$oeAKxH282LZ|6Z0K`A9-Z9C;(Wny zQ0e56)!%`3ru~={sc|q(iI2`oa4#>wYA_>US z1oD3&It7HPe3WBz)n6{qB9A+7;R>t9O3}6)Rg<-$l_TI9nAH4#;Up>`?s{!ABU7os zYooEH2XLl!c)hBuS|Lx3n!vzbLlL5W4EKUXzLv7v`{Pxj$U$1JG@xWQF}htj zb|+)+MPWdUi!f7C1iprjbViq~BFl@RL(8spIH9I$)e1up@*%BT`5h0HA0Y(8y8}DOugNEjg zR~a9?#K4!`0Y)BdL$L%NqFMRqmnMp@7)yMx+9wgeq&__bnX+|H308&dgN+>~liNw_ zGDv$`l*L7r$xyqTP-94U)KfGGcL^1k*^ zW%%fA*+QmL7`+F>DK>s9L`-4`bQ541TOPiZf$YdzHX=F$lFhM%Pa))VDezR(<7)(8 z49Y+mHgZWXgBvtVOi52le+9+WacQrlr6+dgv;quVh6Po#?LpasMa!WfflO!d-2Lc0 zlQ4|&AaMjO3f42I2(7dUR)D;QqZeCVQaRH%Y#4;TZ-?%iCl{$e^XSp)I z)OsLT5hNN@*Apbbqw6w+3UtS!6y~Y7GrYY*b;Y1mD!7yoc-_=XZkLQ}8FV2-4nAt$ zW$b;vbcCq1^nF9G!DeUTx+Jx~BcC;m5BQ+WB0;4i7hKfL&47da8L>tRd4@cos7L$= zd`Z6oD5P%ovKJ?bYGC1S(krCNe@tx-OeKFufeuujgYo`F6*|IbiH_#MVG&$NNK|-O zRAd-XV{-v{qxu~GiPbsO;{O3UgYRF2IgbBt9vSH){vZ8##Q#S`Muz!uk@ph_UqAoj z@&CTo-`!Pm&`5(f=B0cMWhlPbc%>VEpeu4uu0RbGYH$;{kakJ1!!p)im zhlO%sp;6)C9^4FmC#P+IDs+}$!@guBwEzzFg6-0Ho{P6T@|}>$aw&F~U_vS|8xgAs z2-avc{#Y%AF>N9^#9To+t(j+{%M3yEcm{7i;WPQ6mIRt=*=I0<13Y0K7~OfOJNVGT zHI$A+U2;ZjX1BzyX-TOmnJF2a_1xgWoX0b+6&D#2%JgQELUK@t@OI0hQH+oA3xU#T zc$+(y>(K?q_4B9>82BAXfd-BX4xk5kKX@b)8l5UPW5B-?&u7n3oV*d)3}_`)_-$ddMuP<(NJE)0_6QY( zh0_8^&%~1qNQRZ2LvAq)$5(;7p)}4Yeh8Ad$bO3C#xucZzhzFii*`7*1{G>>r@1 z1`Z7ExHcNYik+TxijM;F9B#cA(tr*Io(Hz}!XAA=&`3UWxWybG1nZLZ>=V3Jx?}_D zArTIqh9AMd+w(5;C?3exI)`4b_!Rq3(@#NDQr|Zj?35Jz&QY;1;*o>1^bOaP3$4(1 zarrJj38sHwKf?azTx7JSP{ywko%m)FJOg-U5K2(&iFtrdkLA$AuWbB4`UFBIf_-SW zC>r9)qotrk3i^WFqHAKil%!-#T`)Y_h~0b9+KWL!L6}0BMFiiaWF#j`{Uv)oz&kO9 zFbj#2vw0UxP=khtP+}5+sc9qxiyln^!&o$e&J~CpUP^jXIfV-8L|L z*u4TBXfv3046Ge^P%sxW}P&7n^)Z zj6YZfcG_k;YT~^&4QT(`j816KLBBeoDplr&#fO-VUA!2~!S!_7i2UJ@5O1h=NaP08 zyMYVQa}8tQzqnSUClw%C!WB9ZB}fZ^(c3;LExqe2Nht}5J=E63dsR>;zPiw3QdR_C zU>Yt&h{tG;hngC+>LBM#>9*BD+&$3c2lll^cotmLkqG%}(rUb3t0IU{4bA4svEz$% z`a(GIvr^kh_WsgFf@}zfYTzES&Z~!5>!bAT4QP6-P+6}M+ z2UNvfG=TA#5jzl3^70 z#B`FJiKYWzK$(y0+gNNO`}UG3c%#IWvk+-)JR_cccy1cKzGX35!P@%_lf&!_^olj0LD{s3S z_|=XwLi;Myqp(zLdfvPl?{VgU%K}0>REaPgRMN=Ovpdum$C7(7n$1?3Yk}{9WM@Da zQAH?m4flahBm~|&C6G}nhA9soNRfd+DdWge&WpN{mocwxCo(v`Zi zX%Zjo2Rm6j=mVd!;>ys+jBV%&k9`sVZ^XqroxE@10V2~Vx}d8R+|5|2OQVicvGn>q z-tM-!6w*Bx%!Sb&1n_BSS)86s^RD(yGQL=rBnP1F5y=5P!X^(Lix&)sz_p5z=BAhG zxO;1|Ler*1lu#R+bj&so8QCQ;oV+U3l=ZzdM1>lt3{dDnR$+*&5c-g0A*oNu;DW=8 zF!dmbRCWb{mJzj+vjUWOe~!|7p#{3#B!Vb=r$O2Tlfw?A_{yBqvGy6|9Eszzfh=`J ze%Q~^P5WJbE8WlE<@b{7XoZ)EZ1oHgM}6rW`Z5`XhuH>fIy2qQMG*ooN2pzIkAd?C1jI$VF zt|~37!KfQj@TNpFaMLU!$k|>>sRQ+CixDZK@^tS+$5-W&D5-$@D@tBIUQ5*Dxuqhg znuXUG1LmcnNu9Ea8MREoCun}GEsK(jk5f_UeB*;7IRJWuygS)2$}Qt|3it0A^>OYg zCUUo@AD*a>rGvBZT(z(=6r?*q?fqf*_l^R}^cg%@P#93_wK>LJwoY-7@2H*{*t+fsai? zLJjVS^Lo(m-RR?Yf^60K+$|yF`T8J4RdwDc2UhXl^nql?hx4wFxI2|d?_DNU=Tvv! zgMx?rh4kXRE_X{T^1A)CJg)-$mZiu@i6X%y3h&N7%pv$x_Zr=G4uiar-rp(Drh|6HsOZNEyU9$`hpQTPX z3VUa0P~OU^j?P{`Df?#`reXm4iF$wX9gVU({9M@)ex}+Fa}}cKhdfvGL!On@k9^Be zMsK*0qEGzD_qws>RPU8z-YSMA&%Kw8yf7$?!m6WtTlSPAcpgZKu@p90-;?t;9(YgD ztBnE-#ar*`Dqb5@OeCtXd1}YX5t)~Y0ofP6x>ah3p8d*iJv)})sP^nr9a4;-+Db8! zY75m7)dgzBaNbQ6V|l-3MZ3_loC+ahRXeZn<)L7{1Jjnw$lcVx5PYxZzL%T{)I`*h z*n~+-t-@Ir`~f(o;+XLGjGlG$b0%vz$|9^S%PCN>(UCH-nWPC_@ z&;>Y?brWEG$+Nugtt3ZYRWDxbdx(8dz>}A<==|X|E!I84DtIfTOq48T8%CxC$*Ly_ zmP%?B4KTRhr3aG&e?THtTxs1;7eKB+x>!aE2YT9u`v2VV(xc9@QR*HcTYwRfxngz@ z+a1|r3J)Q9ie4*1gCpoPFzOUKA=oR7UDU%@FqDo1RV6T4$zhg&B$*GSFaQZ_stOWL ze049|NhVmN8L%`?rG219Sruv&)>K}iPA97CDTR@|^b(+%h7_SnM9I1~Y_2sR6VJm4Q!M;S&MX_nH5RqyTU)&h2Y8sKq585<*eV6U8V5c}8dez%vD##qLd?H9QzUhpn{nsa;;_n$*5S zIwTVHHge3UE?y4Jb7+WpxB`%b289NNlraF@G>B!mjdllb%k&le21y2xMtMPF zo`-d2CMv_MRWy*SiGi}D3Pd;n9OGh0qzv8$kc7a+)F>8$c>2O}s51tZ#~4P|PB z(uIct@OKAQ|3CUEBmO_g%v1l|eP?qs` z!}Rdy!Tpr6|LHovl(dJk za18ucqsg_K-B4_XPz8Y*Y4sE|Dbxj0g$w3mg%?KP|2VlVw7cMjI8Hl;b9hv;3_>rY zWfu^^NehQ`p2Qqyj zzX|fFr>!@-mC<6$hZZVyIJ3Fj0QAEA5flUgCKg`QlFpr{7u;k*aMEbv(v*pzQ)idw z3uEI7lu15gB=YmLw<)TPU@Guz;#qJ>E$m44kU})z_VVPUi%?KdSg3eaD8Ws36RKQn zQY@d#4b(K=>12>?_km-kHCl3n9*iB1*6t#9O85=c@=#4t_zkZ4AuR+|7Jwtng|1jzN#r(gV{BJq;V~ldn z|IqNr=HB_=!XKXh58?+K{VJTF&7TxBm5oI;w8%82mES2`zG~E{q2k3VwPhT*U`tQe zR;eB1$OYRe{axi&l6w|vM0{YS*Rt0Yd`*2~Jzq=CRB{{QEUTQM?EWOpk^0TD(^EEM zoNMJqp3Y9NotMk4a&S+_BnpAj`Id!42iC3d_9-j-z+$l z&%k`a8P4|L`Cg?z_yRUpbVwg6d+bG&f6qo56ZC}v=r#krPys)E5P;X(pCg&GW&VPb z%|b&$^Wc#1;IJ^5Yc?`6DkKy%6HP`ZZ_AM~&i>t-<-hPpjsLrN(Iwu;4B&TR{{?5l zL;LT8`0>5|@ZZ4uVgfGD{u}9a{x^>Z`9JoawySNN+0Xb_sP281um^0C0A(Rb4-neT zvrxD|x9ma>>)0moHnCINDPep1-|x&wvSr74p{2CFOHN;GS(+J1qmgDL%{=OV5Au8Z z#2iMUNwymkW^CjFX{dwFXLY8UaLHJjm~oL!=%mTQ#YN3(+srE0^_{ZLtP1>J(HkNV z4jK{vg71qp6aH_L$)|nZ^--Gf-q1a$)B_Zk&ebT@f3ti*R=&+5Yoj1CSQWS zMwULsLd{CiGSfd^`ub90eDVWyi}b-FBh5uiOSLBbEQ>DUZBL7aX4Jhah7 zv=T^S%$o>RX(4HvqkOWRp!w4rV~v&6LssnW)%eeQojN&3b%KgtqMQTp80P}eG0si+ z;y&7FjDMFC{+0PA^QZm^vMvZ)CC|oPrbD)+oTZz8=G!up2Ba4lHyBTjGR!fA1r7~I znuiC~F(fn*pFjvT6PzA_~z5|n>yVPEi@ zKL6j#_V0}Ozr0>8SI72$%a8j1gZzr-f6&;qyY351Zb>(WDR#)}COmFc*YdGLiW9g=z291-eDv!Y3aUErSgGkV{+LPwd-q|0=`>YeXZj4gx0_1B= zMu-~?M?LiqKbkvU7HJfI50CmJN7FGH_%BSH_;cXr1pjnSOk9dWI_# zQA~iQrMnX7UHoJ?I{u|>KxHJpS4U?%cp8?Sou4K7;!&&@08T>h$$T=wzycz+9X#f$ z()GHYpa#TD&+>WrJpuXY$^QSoZk_Bmq14-k_V%q@WuB)~O2>`KJ$}hBj3suCf;;T6 z?6fmVGTF+$TJo8Sj?HokX2Um02ToUaUnMk!$+LUsxGE{i#dj?wlP`^ZL7tCs%y|LK)3?C# z!0{uzU7&Y89lI$lb8h&ErbL3DwhCbd3OIew4$Ij2} zRhhKCRlouHUHdz9^^8u`p$8jQB1%UwhN-MQxgb$;QLA;W28g|esC?3!#T}@^sqwOE zWemJo;_w>qJ4B3u7{|MZMR-y1FPU#~tP_gcAApP{Ca?!#02S{eV17Z0#WyfV z8O-Wg5ygi@6Qal!%{fMt9-r0Wv-(oXB;BU_Q)AnqY8HOQDz^`+X23flz!c|Pi@gut z7@HgQggd$(a7OxF8ARvQUeyf0$e|eNi3|{YGf?tXl6K}zQqpik}*7IFL7CmQ7voF(a7EnZkSvh3^1#M3|_+kBaP?m zIod-oJFZx!k68dljU|@?=Ska6#c-#F8xwkB?>*O2(vyB>Ol(gcFtL6&P8V&Mn2t0G zp;@z-%@H?*3v2xT6N_&9?EnN4#?+)F5>njcgiWjER)Yns9xE)I=jy7GD?3hj$4I`< zjRDEh6WN$SulZ?E`tU<{n zRO@qMO$SB991k1c~T<|^nNm==Cj|&Kz@(9CHrZOpy&yeO- zWf@l>&?Eh`U61PI)8PNzkoqh2XT|zRK3i^mljk1_wP&Q2yx(CNHfvVld(Q(H4Ly{ZWI)pQmHZ0tAZC91yU8>U4Z4ZtbJ0b z#xz}99cu9aLp9W3(xC@h)#I0B{*edG`%!0^^*o*x{Ih4s&w5)@43{uA< z=bT{N7XuL4WBB+5L6SX$hhz+T`0|SaibOO@Xzp|o@$!E;tQyMBycJd&RJi_ir;1Fe zge0}BlDf{N<1P0`vCbz6HV7h*q;c94*)cvzXH&#DidY(CKw1!$mOhd3?~`^XRRokd zZoZa*A^!qci#h$RaQ($=no;F8GGcUNi3}h~Qx5z7GPBx|k{wwNT|fkNDa0X6uX{ov`Nq!T#Ak zJNvbD%HABE{C0Z0v$xM)v<~*4Xxh{J{b`!;1hpkx>gjdeFfQSbE6ji^cnY090jvMA zZfxR>flJBZ105!nV_3!E#Cmk&yJ5Yy)&QtHsa{)eXdgd*)INRsq$I8>iC?ioawJ|k zy`Ek-F4cFW{ktRmWiM!3y{%a^RKF$--+Ea6FuzIi|73rsdANT+IA-~O+E~lW|Mlwn z>ZAOBh~HV)ja+8oHc!`OzkAUTv;;8$Y~Y?bN+H@j|KK^?wJ>JPI^feZoFO6@@(b#^ zA$^mwN=f0a19>86Hjo@H$S*4fG}mMBe7mi@1p`33U>GKdar{eX)4g^s$;qZc9vAO4 zDet-OPCmmJ1jiUSZH}5w%gLKg>AN$Y;Pu{VS~Ixudw~VoAYE!>*J04#(iXaLJlHbL zo0}Vhk44euMi6$=A^Fw%f7bd>_S~1?m~sBIys@^CU;k~aKYJYi5Al1-rmO(P@TT=2 zEHlu?UC*vZ3Kt(!VWwkzcZgwZr>!l2{yDR%{P}0RLU^`w@{*2K>Tf*1T4ANp=Ef3h z-uhPGvsVuAGUkEs#K~4itL4>-rtQ6WSy$->vU%aA+a7kbCx`o|r#mlUwTc@~@CWTT z7LQ_--d1F10c#V@{KSN4oFSQTULEfIw!fT08b+>k4H|?oI}|`@FP@@i!{2b|rv=g{ z0>#Yh?9$HwI&`Bb{~y7S*_O{DimZOiaKqof_Bunpzk#MlA948!ooQJR=XA{;KOwn& z3p$QLb4k~xl3uhj8rV(D9a(*l8C!QG9f4+kml~>?%VIouSx*g9?rqieF_~huA?eu!V&9NKqQH7iC zz{UFzHXfo_m3dBW8zZOujbjrxewE|{wD=ucaTn9~j*shh52iO)J3Kq6_dSQdoSg2} zLz^D8C#@HZ>HkxLo?6o7(V@w0s7YkIJE!~Xb>v${EzLSss{GYX{1GbCTeh?+`|N{X2AVJb|3jT53akC~^c)$xPS zz2X7@(WQv;wC*&Uyb{n$%=Cj^&l#^7*KP8m=T_b^arabwKxohw6-d?K1NrAx>Q!7`Zvh9ET>g~wJd5FfT0+c>VYUGDZ+Cl5pZ%`h66yyu@ zPwX9ZkK3zOaHWgWRwy1jjwha=F3}(edh`N4<@7q@i{*T<1~OaJb$b#{&~wu#YZy!L zL(k!P=#o*#acx^TY`x=;~lxy|(m z;36mqwdrn69zH0SX6Mb1NmV}a+2$123!v@sb=Vm+igtSR`ebjv4s$@u2T_QV$C9qW zEF4p&tG&Jx)oq8RlrQ|_p;qNGDGLGRs!?7c{x{$wlPc0vJk3yqRC}_2aJoO=+#{9> zpE>iCC(b+q?(})5Ak*j1I_3MBb+R26 z1KCWs2ZL>U+a8U!Lwg&v>FsbkaC+OIVQqH@e{Z+ZIbt&BrVzDcw&hz@T<~1tMiqZt zLC;yXE+k|Nn#(RMjVaVL`G)${wH#=Q84cBi_84q;p`p6{ZO`w0 zL9=x4+$@>ub?;Wa6E~WR6FfWEwuj+%yFb{5Q49P~fxq!KjGgVU6K!|A>+Qb>9r)|g zKY9)+J`1MiFVZ0J_3VE$?Z2s={z?}8$(f<1&zb~-=a?bdEOu(l+ z7**EzyOuNliilM|nEh7_!XMNGtWck`0vGkh*E0m?u+6ds=lH463S3x$y90b^6Y!i? z-w6%&X!y;w(3tIaK4p7OVxR1s{IRegx9Kz`HgXzy7{rHg%*SwluR?zNDR8K!gxh!= zjz8QlJO2Oi?l0nJ~e#QMiywC6t zpVR*vYpaj_{}8{4{V#015xM#OG90t^f7UBw=l?1G^W*yO>;Furtwd=aE&bpy{UDu~xtN|uB>?qR7F$%gi8pS5Qn;3qg@5UCx;w$K+`a@mc zLl19$yn^u#b?)!Yk3}i0&Nf4TrjZ-hU!T2L+0@B>4zFOX9XPk>4chTOFwd#$SlaS@ zH^fL6X)+M!4DFc0U*yuR(3qk(64yXAYmOS~jhff*Fslc2@|I-;2E#GY1`M?5O1ZLW z4EzqzTQe=uq$Xf5A_BeU0MNGAY1E)Y1HU7BtY(VWnn@og0dU;N4!r?+tZ2;YWP-u} zW8}k8Z6k8nm^NJ>nlsy&zV*TDSR4~@S~;N<9)YqU@ZZ7$Fi#_CN{loxB2lL|ehvCA zwa3DO%sVmn)8K;}e(>BIy>TR-uxQPM>{H8e?;v{Pl>VQuj3aK4=?!_8Y`$_Jy5bv%DcxW^ynEQRcie7wgWGNo#!XnK*50n)epq16+8a7ZuHdqFAi)bnG` z9MtD6beof*YbI8)R@y}&`_<%%LMa-v0udh~)1a-@QYd^!XnS4TQY zPSJfJUn*F7(9lkYgFz6v?8aqX>jOUua2?=gu9SML>$#y7+TGhNAZS44&_#C7ilPKQ zAT}+kve`~*ZsW0PNUu;zyJEmJRDt&@K2$Zq1C$8>hc1GqYC{uHStjP7h?9lHERw^$ zMcz!9QGjLSfKdu&Sx_Do;6?3<=~QyX1u^p!Z&yvbYC6>%gtQjp_`Qvi`ZI<1O4{6w-;-veIH&zeVn%iU+}vRU{{M5^rXf#02bHJOM#1==mJS7G*2( zAUND_6rEd<;6(HsK!p@A-a2#;g`@UjLGg7tA(!BCf<v2!c1P$e@0h& z9A{L9`oIV2(u~7UoT+p4#Bj1soTWuXo_t$j`O>0gwoTjQY??TS;(3=ervQFMMIc9s zKv9{1qhhuzX3Ed#s0&J^o)kqvKv*fjSXD8~;V3XxCt$3a8U9~pA2~{nx~hLlaaSeo zYJxi%-#LjU<(3dU`D<#cGq* zmg7o63&@E$lohTLV2}q~nf^{EtP%y|39Q{+j5br(t7VzkW8<118>lSCnn zU3jM0GZ|Ht0?@3905nyzQpEr?YwKH;GPA8PbUV-+JO&NS1{@55%{LNnkm3eR*YNT? zU**?G8)&c}$PPYH|4-L+UyNhM{r}a~XO*$|Pt`~L|3Q9_`v0T;|1Z}61?gPn7cY-` z|G!A@rvu&S47sr@p1yB`frOM<^XQ5JA+I?<+77URaLm`C5@G6~87bt|X%Cw;f?1P$`5V$A~ATcj@4R!{~<<4;nkpo?~ zEb{tZ57tLe9Q96Ma^JB+M+0=MWgaC+po}4{7)k}MLl+7K*YOQ{7^Bb&k<0b?2v6=! zX#8H<_{@sX^)SODW&(lQmQtKzRw+_tJMIl(xet1+h}Vepl#Pl}HCQWVHvrcW7gHR% zP0$YFu0XX)q)tJbN@PTwO66P^id$oNGo$S?SqSlkK_B$(NW0U>q&}jq##9# zJw*ktgCX8*iIe_CHX%wGQCZNC$rOdClWB@KqtlZXmLwNnqBwCfam(96)UnA7&Muyt z{~h`!DuHid#Ky9q)7WvWLCnX)O%T4rI~r3u9tvnvaaI(Zl{NFw3X6~)dOjIzMrhLU zlN&|CjXmD%m;+T=LAAOm>$hHr3h(g}x;fyks&HZ5?%D`@gItX$!8)YUR z&)@(d5L)_E#rLlRT|$-oH_$Ew>-yqyBS4p#2qcFrpN04@J)HKuS;l8BPBUVM2^R)Nq-9u-FI?oE(tQZ;FuN zgIT!32vb;16=d^Z`!6hV7{K|Tz8t@e&r$0+oM0G}17Ruh;kZl)hXx`k18m4A;06lW z@`ZDV^e3~nEaABU1;JcCH}p%U5Wm5Y$89)lea!Nz8gGUXA|3 zk&pz9!}8}d{m_sDY@g__E+6Newf z6^IdNSY{ACh#1TrTBr~ZH?RZg&p{(|3@ZbNFMuIdUva)16B#iI;T!7aD@>g!5b#)B z09Yl?sw6D59g20}&5BBa&0mMP=;1jkSh>k=W)G3V&!URQK z5%E;GGeOvOXwZJ};S zM3Nl^qJnqClW6)NL>77o;@3iVAk`l0-~iJ?Vd>EDDewS68?uutg-Eccf%aqvTRij- z2Ol>i*9I!-3G-!);#1imGD>Bpz1qFXiI6RPHkB1+@^svw$8)QE-#D@); zM592rXoyV;ZL%qYNX4T;EQLsgC1OV*JEBprJfRk3q!Xwe2`}sgmNod*lt5pB@99+h zWQU+F9_s-01Puct5zWy5j z`wAlXM>PH(|1&gMZfN`s{BvKR=D>cCjGFWTtly#XY< z2v0rEawpoZZI0k_bzWaRe}2E>1)mDZi>lXuGP=STv{A=Mi}c7WBamzB*O?4aSdJH2W2 zf-`4yw6!nAjDOnpgVGYm!^S>00QrbrC%}aGty?W31{N$>fKE#UGU~#gS5C{Q^SjuJ zo?o+S_^FY9{ephI$K{H+!>5MUNZpUc)SIPic`*DZKEHeCUiRvUsj~-#lA}ErNVYT6 z*AE>T9ND2x%2;W3#|KO`OaNHk<7MNhhTxmZjV}wAlLPMFR(rin+04RX%zNS!!^OoV zUElLcc)xjIOVK&ca+%5kx7W)v3eKK&NYQ$ml{GxjR?cg`Y6g9pkRW~F&fG-X2So~i zY{j$R!#fqWn9^u8nOHyzkcR zCYv2IJZWsh4%f2uufQWLn`!nqc(MlTuPuvhU!>a2L(r9JAA>?fJ4a%LI&1Ogq& zCKbmHJd49v#D0269X{u^3ZEwT+N&AsKKlkog;D6${~&vfi_5|7`?qi3PS0P84M`ZUts$W{h(lhs*@0OKrM{ zx@sZ6S7Pk&__UpKCNd8QY*KLA^Ad+kH<(r{vz+K_?Cd5MTEzG*uc?=~w2lyD2gr{d z&h`8yD$>`tvr54VeX8P@=rI))6^L$T)DZFQgT0oYa*K=KXQz8TcxP(drsp9Yp*pl< z>~MK_zY3tGr4>-vWbfr&n5;Vd{QgPCVjWvLJG<*I zxA!mVAQlp2<<9YR$31Bc-d{lf z(6?wyOT<2cGmVI9yJ|Mp7ID$Q4rdb<*EHKY=ZJH12o_tBN6#hZ|~;z_>hr**0nyDYuqK;66S0AE2gV^TwoI;BS(jR ztBL4q(MV9xfRq}w_FOGa+r>Em$mL0<8Ul^Ih3eYqvp;K{bqxx#0j~Wbz3;`Zd-L<4>wdtgR67EJeAGPb*F6h~M542^Gc?0*(!FCM-@U3E85wEJ zA*ZLO-#co-=q<|bnzOg;2=F-n)+_X-ILr-Y4rd;X(d-)-?%y7}<5!87g4Y`|Ef~vv ztdooOm0T}fH!bn_#Jgh?D?_^)QWme-KI2D8!0+NA%DRiK#+tj;R+(#PFdI)h0tTDj zcMT2>c6N5^GS1l&2+KUL7%y33XS6f=WXoj%fAyg}L;Ug1lX*1ynStxc58TJ{KW>a= zH@MFOf_rFkK-DGs>=Z?5AFGISwb2GaS<`Oay!p9P>3Y|r{Pc!<36b2gCm(`d)n!07 zYGcQZxT2z>=T$qN1eT7zdwuV)iSEjk9&ZPbhT@sm}TP(FDfE61amU_7oWF?B?Mb(FQ?_P(+1~Hla zA9_tz@R}I3ht18p;TF??t#JqI`0P`o=gQ;D!+Pf`DXFNdLsmf6Y~`6$!)j#>b!1JKaYqW!xTk;38p)>Po0<8WxG#`||eZS6!w z!^okR1@2`tRhOeRH7jp*O$X?l%Elx`JK46Y+`79(l4XbJZ@9%54vu zEe+1{P24Tt-)7<4)o^M5qH=k4HT8uHpYv3mH*cPrni}+Cnh#BYl-~R#rvwkDy_nfvPkWo!hY!?_cP9N{ z_1VeiybGWW%u-KaC(E}h<`4_w$s@~}7`65nAY3734uBGUWl?h%+^W`%Qv&$;1rO&KP!A7aCyrdiZ(0AT#BCv#b zy0};y2oBj)61~zojYCY)&V~%XdemS=st$GF`b13JrfYd8b(|sdvrp@3Lsno*a8Kcu zx+}rQA&)9KL0T$!_2opKafDW7U#MlG97Y1n*c~(e;ZWgq%f|AErw_8L)HnAHbofYR z&xoD#;HJV-<71F`Sgfj~Bt6;vY5g~$@%D9hw~f8u8S1?*=-9kC%uIRty4u>$FAtDk z-8;4gvToGXZBiGNS@l@@t#h*KTcR#_U#BN2Z3%yl!&Lj>YJo&b&;2bA46{Z&N`{P0i+^J3ozm?AML59jM<_F_O?xwWIL*VC6txUyUqLSv73sX7`Hc zKeKAg@e%3z8Lqkia%e%QU2uI`6Zv;v1!T33JKho`ddB=PE z_T?d;N>@qTxEzzTYgb?RW?$bE79UHB@?`tQKbAc^>lUUQJIgoxa8`f!+)m|12?p7_ zfv)Zx!spR@KQft1=o~jw#*7aIWxq_+@k(p>0fNsV3xHYi+CeQ>NAH^nC_0?VYx%r~ ze94Ut^X?O}iUVbo`tp|^;0#qMOxtUDrN8r*Bre{R(7$JslA%vREM@(@OwZ=RVk?cM$Jy}P8Ro_;;zFCKeqCX1vi`ro;vtw!H zk)`sG8-uQ85sZkHdFu`tXaqee9c41@FdKtL)hwgNA2Eg}#-1^NK++SZ+IR^kz|Ov5 ztHSB4qpwCDJ}iI#gs95Kcc~V-oY&OW4tU#n%W{64+L(#S?#9#6L*v6ri*-&#pMPV$ zij^!-1*RKFPya9Wz5}eOWotAP6=K7N*kDtX-iu0=CZIGaq98;F2?Rp|NvMK?*g>&Z z6h*OM@7S?n2UM`4*g-`U5v5q(%r40e1oYf{?z!)Nzxgc5-ZQh-tXXx+n)Mm8G{zmj z6z02PEM>r$;`@|dr3*LNKi(gD`pl1(TL!^5!l<*Vx>!X-3{3seJmaz_k5%n_Aggfxd)a2k>0j%DkFwXkF8Mq+)i^Bkl5NtbmK!&$ z-KY~QnBBevW~3e%Z#>cP`nLKP(@S&KS_>lY6&CK_gskYC02)+HwTaAZJj!ka_Zd7 zZ!hk@eCe8y6`5FhqVe0beX0CcDLidV1aQZYi%D7f7kjRy6pQ=eR%H_;uxzoy+SRN>v^mW_jk? z20LlEY;tS$zBXV^-&xhAURHeO)#YA`w;tZ8Kp9goZn$<+)z6aDZ}rjZ;x%7q8n0sH zz1dmv6j{dLH83BX%b53hC*5|e+mDa)>||{<(`)9>pASNrH!oc3b^yPz-|Iyq&jcTM zK6Tzl+v;)m_J+28H5_U>!hXUI*Pwp4x-Qju(G=_&M08;o9}mM%|k1Er<$Y~Ps^ zg^{-`vOGLhTwC9tpy+8hJvmgpAYF#uf6hXqL5a_m-k+V-qu^TcqIVMlwlkR_YEFe? zDfAb|szQbuA$w_OwVs{*bf6A|TT_5@{I+~2a4A|n^rmf;yKQ+}Q&2dv-`l|0*vHQ= z(I`mC`gaa2{i#`$THT56!>kK;J@$0IR>*Z4b?2yp>KfxOcY~IXUG&z2mGSXhY%j{~ zL#3RvGft0Pw!b%bW#Xla3;K;8H}2q}L+5rLKMYL#g@t*Qg|Uu>7O5i@f7<^1wtCK- z0kf4xalNLEZ#p~pa`uPTa^DPX#=)%bb+Zl36xP2F;(GALN-I=nDI7n1`0erPGlI3- ztc;55PQ2R-y!Yx?ubNX?V|2%y+PQy!%*}P?YBz7bIC<%e;ntVib2mOX_{zm$*6ePD zr$MOZx?}X&AC0FUE|FGA8!O|_P#-IpUbERRZLGtRkBj>CJxss+rtzIu-&xvm9;fGS zn{XcZ{D9$xoMJD(sh*am?y^|$?ykO$&NVB?*plNK&)&W*z8CVSJ91>^(E-Ip$8AQB zWATgqc!BwsO^P!Z(PxURcH)!DC4>YhCd&6;rT zK@Q)cN0%-mR~!B;aqAsJlQrn^wy!K(S?aLa0f3=`L(A6>A5zEV@Rw-ha2- z^N*)QQ{KFZ-IFxsN{^BxKR?$GPl73a)hnEbUOmOU*&Db@^TUI(v)}!U-lIC=@G;IBTwfiRN46W(p8Mt%| z(?%qYJ6d5=qTtZn+`Qf*I&VetwAb?}>kj4u&u87bw~oyNYH5=uwSGODD{B`M}lsRL{*(7S}ySyXi^4(9F%bR=V%Yn%KSF+?Fj?u?z9`ri6T+K$9)wB5KD< z=e@B1c)q1k6Zrn}OCMU?9yDsctn$g=3ZwhuBH4bAM=j{5Hd*h8%FLXePX?wJ`KQ3o zw+DwJPB*ITP}Df}`YCHdX41I6M<2ZbfTWkqsY?k`sO_yFP0=}Mq`KeT`-AUTiua^R z-JhzxbEZ`6kA3lGZdd2<{X%mQsBFIM_IZ| zKuNBl{gtu_wTAm;D4L%Ak8SI&-)qW*3Aw8S83w*5j#6OGc&(CGp%Q7gl1kk zn(*P(;+1xkA|)4BTmH71N8EksUiz1Yj5=mXNn13;%gP_A`=Lg;FtTdO&Vs0q+p?+1 z>@_!;+(+9DrRU$BGiT0%1q+_O>c3QRrEUD~{hK!RRXx5XbLMPQ16%d0y*R znv{1?(z31k6yxGPCLb!3z8oqo8P|8B|LeNL^(IS$T>4R-t_=91Gj2GI`_ge{(kjcLQ&R%V4gViLb~`1tsc6Mm}KohIy1EdJP% z)vtBoc@6oq&99H0jNhPsvG&5IXE`!U)Ll4{t{-oARiXoj+TY**CX%N3E&1hAms8Qm z(;FLi7etLp*xRG%SWBtYm}UE$rdAeYP0vNF*ZCwJXFNRI^WMIDa)Tr714phbuBZ7k zR`4>?cZa0bCY*hgap1w0kF1tWE0+6)Ok@u5WUE}M1aZEnXRksxUhSa-yK}O89<0<| z31TFvCfBF&PCNaMc%~>Fvf>AGyZ2P0D-AIW(Hk=QQ^tq0XAQzkq%WP1AAp=c|D3XJ zYGy!4GxO@QXr&=aGF2B|3{^N^QE~T_^*)2-m==vNI{o^!Yhza595Lq8?IS{X-VIWP>VXD%FWbW3vvdS+it-?g(A#O2)yI=CAX5SN9F;@A=}9i_GlslIH0j zhPAX-dELlaYsqJR+GKBh>z3+R_0X()6%Y1>?D_Ha?7q~NHxIVB?4wXr&!unQwNM+# zi~N&-v?d!ZEmzqq(w2E!>syai%~-!;MSm5Q4}0>mB3I?ohPf{6Q@vRI%t7~uA79Sl z_Kz(YQ3n1XRlIvQBiTUpuloz`1}L%lpNJlY2~AzwO%jX z*VS;4<=}4Hw{4p{Z=PeCnkyy$^Lp+Xc`9{bcJ|k~Q|eDFTXurdJV!y#ZRpU5)sMO@ z>9=Ri5+s&axMRn)t1slzTz%#@^!IDn?Ygw5pN~(sCv#@IP8sj&s_=Tn`0;kKMr+;A zojYfnJn(FQzxj!z-F0SV2dPU(o!#z|=h@@v*1=Bx{_2Gr&fIC7xohi!@uLksMtAcb zr=8z5ASC5eVqmU$s>hvqpSULy2bD9;VxGnu=GZkC3!~0 zg(IzxUmnr8_0tjQ8_b4TUAl*bg;7#2eKAWYdvBKE%qg;ZmyCO}~gkU4v~L z_oORa^Yec<>eyQMx%cmXY-*anW{oHFP&(fkJluZMvfrCWeKdafO`hERW_#}4^72CD z+UmhkW`mvkKN%@?QEFPuqpC*=3Jy8D+}tK)+u3^iPxkk}0C*xUp)WFfR6y4r^Jg|a zGxKLSJ0F>LPx;=FXB0X5#Yw4b_RG?lwja~GEld7dcYEjZ3FZ9`O=2e{t(^X4%8#ZO zwab=`%etA~W#aKwUuzaouR?- za|WG^?>WqLME%IK$G`5}e&+s(#{R`4s>~D?Ps>Pe@_#$3+TPxNnT9>0R&!VRy~b{C zK;)z~2Zqfu8eDv-kGzWS0NT2BiE7pR>n{y-Is5ZR#)#z_r?xgWj+-%~F@OAkOP3T6 zEPeRiOz%e1gNWW$2{glE>Cw42FPzV6ag0$u$2rC?=_2*{>1Bn6`b^Hz9peX@j%nyy z7D#!hGjRIuk%dQ2#5JB%aLCe@m!AM4>y3O*xq>}MzW?~z?O616ZNq)rR}5LS)g`;6 z)NW>Jo^!_g_$Z?#jO%r+btiS7vp#%~rYQCa{gkdIHF4JfdhK4HmbF(~8sB9Pv+8=L zmQ6_mfq>Q19Xkz+l%%x2R^|5Z8^(_G?&Hu<&7JY#bn2x`6&C9Y3d*C7yn5N+_WNhM zfZbP2l;kKqlq=26%r34~td>cfGG)zNYIdY-nr&)}UdX9QtAcg!Hr3AsEYg4Az>I;% zb{u_YIqihNY~A;BMd=49Ab6PB`o7}v$x=6;!iFq$>7v<6Qtm%n?q%o2PFiEEagp+L ze5E{X$qvUCjYBmYa`=ZH3>`M?{f~fs@o6;%Iy&PbJ9UvNbr$`mll$U-sRe ziB^=9pQ*NK`(=i94=8k&ib*{^xG73;PTI2N>ZdomZdv%lQ{E=g-|>>nvuDrLwqH8A zMMi2&)tRLwrXLb&be`tOTmd$@@>KIE3Zl_3O!lcJ-=U3YA7$x+^5KtqtoqYuxuF9Z6 zJ1g{h%%{vK4X|84x^8Ywm7S%H%?PX3uEoWR{pVG_GtJ0wY@VlLTYh$?AAL)diQBy1 zG}@uplbEj;&6*YHd_Zc4k__EUU*C94^My61Xa2lzpAmL$g61W&Y$A1O&Qp?LS;UE@V3$Xmh^>GN+1abN=R13?DU&HucAcf>AV-;&6liPf+3$_w8uw)nYWx0B7`?$v zr{E5tx6Lv`OG~E|U>Ofj>Yp`y>7IP^B^uIGz1-eNAM2r|ayL7=_Ws4spZ5kz4Y~K# z+~$dNNM)ncu(Fza`)DB{8}qbmPd#y{Gn_KYX-L`!+tC4(w|*4``B6!&F?FNVHFGu< zT+7?yc>4~WGPq|~HJy`geN|;;Cef1LoVjuZnc(rTi=Lv3P5qiR-WgK-lHqRChr0DW z@aSFMmXoJ`v^Z(boR18Q?^p2LidGn7l;~D;cVMQJp^K?()2&&DS1f%0=osx(;sM&( z8BYY^&lGZv)$?cmEHsT+Xl#-AXyK(6CF{aR%e_2%^fYfNJdti}v_9YP?5V_O4%%sg z@5zhuyz85Oek*;Ml@*qmKXz+;tmo)?!^e*}_3e|^p8eU%!zfLk-}I&If5a-?*e6r5 zC+$d-9ldMulKF39dtI12Jo^5}C0YdzawBBvyQS}s8aY~hnuGDVtOu=M7HzOOsUo}N z$>w{?GI7o|xw2`V8!T;FYPQ72#y)j6bU1cR_4&XMr2{d~BIE{1P4V|B8TKu&fc>p$ zk3wreNzO1N(|qXP3v6Bg#kMfMnW;`L|N0lA@O3gd#J zqVDmlSEbqAJKkMNdFHo<#&?H$%vCsfI`qntx^BH~2lWk87=JE*QeV}?_YYriPsJi5 z6Ik9$o?TWM-?e9;{zbjw`3H)3`nJBWZ01v3O3(MxTr8U@d#Ru1!hw4CPb4**DlgYs z?=hfpW=LY_y^|l5)imb&%vE?@xiM#G-1Ccl4?Squ9Q^)rOH0ehs+5NGZpupLQ7cAD z%LZBn=I(lTz-iS{xgK3V(SDk9N^-m^m0cPeuO(CkceiHWP75Z~&{wqV-)-%36 zY^qoJ`JQXqt;hVkekR6iPFOz5{qgy65chrdf(4^e3ODg1?!38^@6mkgb45Uerbpn< zAFX#lR9E}b+Th@}>(}>uIGyl$L&BLufzxcieSAs#VdADc7LnfTIY>I^PSwvDIS*=A zeqY*Pd&GCU=hcIH28#8oDyy=LPE=KF+AKr2j(#|I-x}48@1}!&>XFE7J6zVPi^r>aJW+w1v!dR@)#mr*Lm_CPO%1ScT_bgd>HT>F@8k;D; zuT4!xv%TFGysEjCcY1n5L4l63h0N6AT2tm$kKB!Hi}7>jtje~vjQx=!@6gv_{(-q! zSuaytmA}Rtub-<`eE-v{>&urfS4pl><<_cbNttb}DvXs;-OA8OPB}K|dUa{lP)ot0 ziUP~n>P`0DEAs=*-RkWQ{1|miD$*?{jM`P-CTMzQP;z$Sloej#p2NMbxXGvSNnUBdJ}nwDvSh8P%amm@PmY#Sew+J>;;P$CzT{Pndr5t+^Yag}E;7-x z)V#(on_qDE`x~!2AxVtGYc_otHsSv8E0YhOo#V1%%Kn_COD6;dCV#1&%+((AJYmAt zhJdq!N5@6Y^dE3MZcmny`sxoWc(D&1TGf^eni^oMl3-T$F2kA6EeZk_z%A;bQZnT+Rv^qB3Y{;jK-pu$9%5JR8%nw!a$Y;;# zYZ84F6C=;h-k8^t_d&yc{mrAiSJ(P!dXAZT_25kf z`-hoZwrn{ftA4ti&oy+LD2YE|{!NOilbnzL zm)5H6<_|wN?k#9k%3M~Gpx1Mh!x{zeiWXoR-wxqseGQrw(wh3{XtYe%9>7bwV^I64 zyZ$MAM}?H{EsbNh#Qyl!+_L_LO)t-!l}j`}o$L0X)cVjOzWe;jx&it!>xLH3=Fj1u z;JtDjzp6)LW@_1>g68IC;0@;GSsy+w$D7wjee6)Hcs(ntN0)wxx6mPXM)JqK z!Cvuo?7YMF%bdJl^_on5j@X6nRy8XxfG^=vV{N`=Cxy=tBK0J8P z(_c;n(75D;)Gn+a+ zy2s*a6eZu$TzAj9A3)trspBY3Os!KLZuRC5HMyK1X;uXG^Ez3|k*W6Ie=kb^~ z*LCqs*hI_SGl@Fu!@^AcY4@1>f>sCn3HnheJ=9Dq4rl~Y)lz#8?b5xLqR_A3@tDvS z)6yObGQ0CbzRi+;U~PVPLjPCGy=;$vIMcdp*|Jl?TklB8UMVf59b$R}20m2Jw(fgn zjamF1`njkhGaD=N8{f^e7Su$gp6)`Sgj3uuER8RDJmkcskR1~Sju|jAX8q00Kxl2h z+<)BL_I^Olvhv7%m*$;*7VOJAob+Z-?yAtU`tq9&jCFIn`nF;holYO9H%Xyy-@aGw zzVz%`?>b>Aqjck`$0r+1Ou7C0`^n4?Dsr0bld?`wo3+8X+C?dO?%v=FE{kg|l6beb zy1CWYFWy?SZAZ7N>-{TDR>(Yf|8PBJmbOuGMFohF_j!7G&1%;K0bAWjgaJz zPxoqTFJ&Iu9Z)1aa8ya+AobZG^c$$C*lUo9Q}$uSEoT)lXN=I}zJV-s=<&5umB-WA7t zb2}ey8w%JL(tV%-du?&jBl%6+(>J~gI>mI>?iZ1q@A$d<@n`qO47lyi?)uPUTi%7& zo-PwsWOVCY_wdNHZ%y@gws}m;zY&{mamF`$)dxUgqyday>lj0o&rxgWWWR=)8tP$03_*HsR8_K$SXGDJ4^(eGUVrBZ{{P)pe z#ww0cv*c!9yLPRYvUTF~iwg=13$=Z>X$&9!xL4N6qW8g4Ew{S&y4_zRea`OPyH#d> zi@ml&`|-(y1ml4ZQ$8i1%FHppxp=@9OWw;Xudc7oO?)mNo3kTz)r)AFlyddH14%%u z1H-pBFqLEeYLq(0~&1`ii^i?xwWI`Hn`7F?fOAQe)PNn zWiwKYVNTQg*WSlXY&s8IC^-L-fbWRg{-cIU&%tvO0P2 z;HT#5+=S6*9&wiK&yatbmq-CV!)%3{t4c~s?P8xhjT<-a9^m)$=gmIbXKr0yT>j`7 z*Dj?gCNeTITiK>-&%x!#xU|^Ou1Lt|M^eX9dw=Yjyxe2SxqRDgk2zq`uqC_1qB5M2YY+R+zU=vG<3Aj1r~t#;mPUg zU+eUp7TM0aKX~#zp0!|;-0h4Ir?kbF-@SV`e%!ddQ;sjo$KB7&Q$EurOSeR-zig0MOElLTVSHp zfcJLt@m?*eL*$hus)Jn~z5nv*)2FhsvQ3+iJtdiUGoF;akC9QRbC(|DJ2>+Bqj@sD z)-AhcJhFOjN`$4Itl+-#(;?OinKm_s!*A~@Xi;gL-nd~wY9T$K=%-4gf7ElYvg9T^ zDW#%;@fV66C=`mdzkn-{gW@^e=7ZJo1}l@JPRR+^X-2o4J;LA z1`x|g@tYZ8-2_<9)^;iUl0hMOdpDLaf|O7ce}UqG9leH!pW)HwNO%k%p3oQNiX{@x zG7@3(0~9NGXrGjSHU>|WDauF75+$UK5D-aWiL3=!2|a}Rt3(A7(n^Yy8pKbe*xDv7p`&>q06)MA0)q4~ z3o4f<`elrE5Y1ge4+WfnW|BbIp`3^~80ip69N-W|q8HBdah8IKEnrardT~3EHkKL< zJZ|iCJgPGp@cJ2;M3S9^pNuA9$YnCo?2?EFIb|vs2L_-gmY4!&PmSY=@*U_=tzlLO zTOzM2`a_SJ5XquP5~(i$bZF8rcH_sf1Xv0SvQ7tOm@xMyFOI`uMc{41#I1OXSPBlD z@!)VrGZ0a#6qpBP8q9hth~yKj3PqB~0i%vlj0GtP6Qr4A4B zoX8a{A~>4-03~=R63*fQ0|Pt}B74a138t}_V8(`9p-7q6H@RIyltu$#@ETh7u7B3DOgpbAE8} zUn8Id;{C4@EexjOfo+NRRG2IX_AQ>p69_#5eiC26h=$j=f!0u(zzRVAlTbay107-D z{*M9LFjQ~QB?81i9gidsGjpe*aVkvGgcDN$zQN>498}xrVHRD8P6QXo7f^3;K=|Te z2CujnjIx4A;HgGLqRtSkNEk6LP)}NFhHBbkz=R$cMoBcoI~WyU0m8|0p+~e$MgeAh zLKE{aqVeoOC_JEsP*KEQ#l|uC0=)ZTv}FkCBpM>bnh|X)VnS;}@Dp|fW`)PxFqDH( z`iP3**`k5}!$Hss-XMVRI3AH<3idZH26ZuU#}s;4JS-m%4-8KX%*ul$z9K9r=G3Ao zv#?yqP``$Tu^DLNXqGWi(_~!uu*X1KbtrtIYw8fK-;*)4FghA&$02bsCk@xCxH#hs z-zi)?Q&UH9eF)(Nofa@qrV*im`j_Im5v53*>lV?*L>Z6BNyX9B-U1fTH7qoX7#(#E zEUE3HJ~U!NdqZd^ymOXVKBYKjCCu(9c zk6pV==wJ*Nq55LS!Et~tCrR+I*(YLjuzFZ`gjz9_kK1NGNhsvSZJP*=B?bYeA0$vS zLbN1yLfZSSfeC#-p%2yxU}zNnMlT<=K0=VQIUX$uQ~{oy2Ojk zA;Y4;SlApZ))Dlkap+7Ts7gR@qQ-(SFu+&`0Kwwn9ZGCAg7uv&j^g(>{h!W;Nt)M0 zlVKVg|LR_!KdCVPeEyD4`~6=)1PuRP7;u-@NOSWJ_J5(DHv7NKOiWEFi22`(hUCxx z@%>+t#~=G@K>vGSbiV)3)YQn-qRsf5k2E&=v;Xg(_!#O?iPa(fUu?YtUc~R*@(6q% z`#9ik@+`#?_frv327N8MHYt66o2vq;2$mokXF<#!8nv~DCYEO6_D}}^R>v2(5Nq6L zkF*tg77iEM$j{W^LKwOPXAr4IdW-`Xe-;{-h}MS>nTRU39t)g7Eq8x=+C*m`UpFsL zny0^qHjR;6bsNpaWQ&NT8edST}cPS9?zk;}Mw`Z@b}+Pjm>q9xrp*jlrA4S*ATes8qNcjYS6| z4uZcpK5(7*Fu>6QWT3$fY79ijT@QWB(!=~lbRq%K5l(j^(}C*;sG`Nfz9Mk^Xt1p? zE|<*+>bX{fUs2WJH#K3GjXaUMf) zLJ5u7*dU(%?(W(MS{Lr!KzmH8sTLL*E>sI@XjQy3Oe;wp0sZ(Fx`B6I1XzfpjtEJD z=I%5hmTI8_0i4w%u2~7iLbwhv)@hG2qzXoS7A{7=jXhpfGz!>*UkpQgG5(JY2Z|5q z+P~AYHiY?S1_;$s<9P%Q3#7ETBis_q8ZU})dTGT8a%^huq7jGA`@P^gwG8aKugqKltH}Sp4RR7 zK1PE4(m++XiG^SsIK9DTiV9)+Lzv>OVq+4&?H;i9t52&%=J{+@Ow18IjqmUFVq{vX-dlagw?&$(QSZ?M(g(+nI{kPF%WK9GvgOEeL2EG9dOA z9SiszW5GBk*`p)zASkWf#-F50;=;ekgJKLQVn56Vk(4`Gs((kZ0d!FW$pnNOR7`>- z`sKRD!4Lt$?F5MPX#zwCt~%PF)!H@opVJ$ijv5>b*mD-2%q$|&0Rkbi$=Jpe(b_b& zA{I(4_3!{@a7rIt^Vb4CG=s;YhqASSY+zU1k>m)VgR9>*x&~dB5wR@xf)|$Q)wmfbHTCu!SKL2eFkL@nJ$UT@>(;eKP@<+Xgyc1X&FyXetH; zE(>U}01`%^5AZ)Lgara!4){-3w;dEX1QGZUfDvHn65*g^7ScD?CW1Yp5tKYwXfDKw z4`O&$j2gj0Lagwl>hS@w~eZWhc$oULH|YoZ2Wt%Z<{`$lN22U zH)v5dy5z;iIx8ulX=mTbH6+G961^OPnAwJO2mP@A$MI9znWmn+-~O=w4rj*pQfeBhR!Uxl~Mo_;!T z#~9%$xA#u5$KW~o>lZFJd=eLf+In>IK?|of>}4EDl7(>~jO5u6(ImXPb|ecp(KmX%I31Xd*`leNAR15!I*?-4+SoN{3TFu5Afqh76hoe*=Os_AV4e|t50?#moL$^}{d^|7c{({y5^IPKSuu`>!X=9x z;dOS@t~;~GV8#Vk7sUuzZ~!an8{-jzJm!JY35^Q7sD-y=MU|I_iD7R!egVM-wXz2%nOIfCoJMfsP?;fe0ngn!38dHn0Y) zE*}P zKmn51is!NbhL98RuguPrAWAN5!}f0w%bn&B2M-@3VOGQg=$XL-xUl0R!qA?h+-+q= z5C}3iO@Od5qF@6XLj>u-B*uiHZEE4Q$)kV@SqwS|0JQ(uv2g7;(3uccOr1=LX zCkkP)wndr_wvA1?pxP0GC@N0q2-GqPc)*n6Q7K{z)i_oYhD%67Bm+IZg$^7%-z9<=kQiyNL`8vV(S|RLp2D+OPh=-aG4;L0GhysBQ3v*&qs)rLiC|_MKKHK zq7fvqiawRWWo!Psq%gL^XMsRBL*Y_RC^`ux-gqiie34ejP-xFa0jIG#KQD(o9EBPi;cG4=p80Ky(wVeRSbLxv%!h;V?bBUEq1 zR41IuLJ>gKJ4C<_v%T7+=}y9)K(8D7j(gG~3(O%+CyKDsVhcSy!nR^VfLM~$7Wzn} zhDDQ*VhUM&ks(IHoF*9uVwVC+X81A&(jq3vC>Ua-siO&s0}``1=w@pCs4;oMm7l;8 z0Br+oh;cBP76^8NM3b#)iOmB;OHP`|{SD3|KDevbw&hT~Wi$+F({eka&Cnu7#7JA4 zWI^CmJ5;AMKe9TJgrYIJR*3IfARf0V-40Xy?1^O?uj9mm zJWL5f+$2S=SY#}D!m7P52qy>dg3zHv<1_rshJ>wf;fdH6RH2K!?Di3VC;JF~H}V&* zX#uEWFGy>|7#<`eV+gG)W^PcPh6j}3Rvi{Uk|A;$I-FU6J=a4_B}K^+h=LJ7;_Ly* zsl*OB3pCMO4H#pR_Gq9e35kx+)px%1-N|4|n%(&2yhOWcMHA7q;(usX5qFZrHI}wm zOhqz-FdoJs2yF?M#0Bj-V5+T6m}@*MEwEYGiY!Kb@n8a-FT;f0NT@B^v0+DKf*-M2 z4U)^l5{L&6qPVubZw+`1JNDUrM2Q&+)F{ESa1lEQhU(LOot?+ie4YLD5cHd)zYqS+ z+0!Z2s%>4&pkd!(8*t8$k2QpzeuI;xaXk1RJe-D28Kqja=c$fn%-CG?SR6dzM_OZt zPw_1hkiP%&R$_ccPUw82nL#jS5a&;K@HGahw+`9>k3a7R@HcfX*6;O{9y@=@}6dd6{0}p&@*ZP6~n-EG{w;WNS;Bsz!x{7aa&K^4vHphq|WZEz(ffAPnVk+7%m8~zZr zA=p#&t9S>{sa{F=lNK7`_~@XdU<3Za-l1RddI>yW=CQ}<*Hk@}_u6$B-@Izi=Ywd1 zPuf@l%mI3~HHJ7BiN+=59i*rm0)&GG)3vnMhVpG34g@tdG)FJ*$v$o_u6|HvC6^%` z#&GQTFov)`v50~QS5Z0u?d0t1=;P+?2b5LEz&k%@^4Edl+OcDR?$`+zV*?Wd(@vUC z6?gwIBZ+2%mSBfa&gC!?I@>x++Wmx{*cFyV14r`yWlU`mUIn%=#~1g}$lC>IG}P>> zNp=$9HWiWMEdnZR4%-by^c!1&AxatGZ39VcU(+4c96(aFa1Pf)RSag!Iw6WA7r0Z} z5GGYJk;LErPf<%mF2HU0{wy?SCG$i;<2bJ#v-du0u4O~0LR_U z!PDNuSr0d3gr7pF7x6_X)YJZNpHBPp`A>g3J^vZ`_rU1<{HGB-`PuILr_sni=Rg06 z&;Re|KO@oepJw>+Pg6q^Q}ET&%*@i<6rqRmfaeIT0Qm$c6KG>5UYiyvJo_koAb!dd z9=;S-5^3YMM<&4|d8kCuS8dK}iYr%nbUW(rD|TQt@dp1pO>pNsir!5d5(2+u|W(BvBcX{ zDj{YXTG%^n@QBHXMbtFf&2p$AYUV~pYM>DhZ+kzQmknA8{qE%Eqisk!EX}3j;^*t* z=xc-E#!AD_fKK&t7$^3GD{93H0H*?%#}a)F5Ws{LJQe?K397(mw5jqiAw5rkc-T97 z`A!01jkmkkWDjRgKboJtkBhUPjhe9$h$XBb3=lwpf5*DpyZFLypfQ>k8Ubk|`rI}U z2>^&b8%{$|sU7#!vSTXHsqz?HeL4v=0H!gfvr1Gv|8+Yu$VX2LXYmmI7z7&}@B-GR z%F|=o<1bzyT>Oa@!sa0QOhliLkSqBa@VQhf9ZphOQssHku!x3x2ekR)cK&mp_WIw) z+1|;+`R|1BEC0{Lv|aueQ{zAW-#_vpZdyRkIfL)*Zw~n@w}nu>;r1B@0@HwobLo7z zp$6V3C%PaA?veNnFY=EH_=i623 z#o$xb5nnWcz9wIEWeF(PrqgxZ0D z(9!FlK8WfNFJB~_0iwQe21h^@IfXXBH-h+uBkFLX)1AeMOQfocy$_2+m&5hrIK;wW zcoHWxnnkDKdF|1f9-(vqViFbaAaUIXu_IV?nwHN1G7Z{bMX>NYh{SH>!DvYG$88Yc zjZ<;2%m#Db3^XQEMSdml^9^v<63!Pv6dci;U&vg1hB>F;mp1xCIB3{UlBZ0?yl5DDK%Aj73flnB!2n0l z(LSP~5~d%~K*{2langTVynp#=um9nOG5+700q|eQ|7T%j@hAV^Kk?~k{PF2G@b}+` z(YgIMHXdozHvgZ6g_-Fe`~OdTyvNJP_6PsVQM9)_FnX~q&npG|$_0PBg1=ZSIBbzs zuk%I^^>MY%esZuKs zEOC20Ed5R2!7r>+%0IbYxzr_aqc_8;%4p-j7`t3m>ArUk@0fP(@WvjAGDphJn-~_^ z7-z=cc;R)<203KCS@UY?;;x3x?^SOm^qH;xt!h=spe-TX_ZtrRS(UB`JH5vz@blE& z8cPKML!awSNA?)Lv7HrHT^l&4qD?^{NnO|S(|CD_;?Df3; zCp`L1xpQ>yo*f6wHxD>-Xs~0>Xcd#;(;k}L9=-G3{v*XhW=74qut~8b)1-gm<%zzO zR=;%-Q>=p)_>=^_{LC2MWrU|DGyipgZkM$`{vUhK0np^}z2GAGx$747GY)2USORKD z0t5mef1n)v8sixUH?$z5m~R- z&eD9}eed4AdpF+QyL<0K7IhYGdDSLtmd`&e|5)V79A5v>scSD>!p7{m5v*u4Bzj%s z-aW^fKcDW_|Mc73cRN-N+)|+0-gxqagY1*P299%)dA~^Le0T#zJM8`YJ#^h=$%M9w zjUin*zl^)>&0Y2T5|^#JCiSebWaR%IooXG%Srp%3#@4y}eeCS{NdxT zDG7UN$=}|uPatmJ{-&V5>-##!7ND9ml1e`|yHR$-8Z~MKqAdU$rzF3&c`vvU{vv}m z+-FZ5yyPiv1T!*yN7wc+;RQwZ+#w}*i60u ztlONX%dYNFU4NPXcI(i0nLD1o>bbIG?DD4MU;gYem9%nsVC+fH?+8)sdc$Xg{lz<( zT5rVesqI6DJ)7-`yZM?u@$UlK)afS|-q#LPH;HJm?ZDjjN9BJs*#6^?37h-8+eXj6 zRQlw1Rm*307vVP0TQA#kioE0Fu9B6wIrENDqL$?ifA-?nbD6K6-gt8IT-<)XPn`uD zic+?_FJ4-@<;L+RH;&cma(3ym?+4vH+W&ZI1n2&!gdU#DkKH-Un0+{eG^XyMDST1X z#M7&yxAaV|C6E7}Fz3zAd!t7{Pck+WmF>GXA>hZfSe?;9?I+$HS(5T*LS4@{k6g~& z-n`)MgnK0q+kTinpuaZPG1~=>^_Iq&Q&9Qndo?aSrYQTHKI-e;+iBp23z5Zs-D4iYQ(eJoy zUI%{6M3;s9TN$16v$&oOMknvxA-bLE&XcMA7QI?NHQ~uG>$8%0t&XR;yN@p&xU^^Q zv*Paiq^FCQ7yoZKVMI`qK?N7R3lAP>k~?Dl22uF&#h3RMZ52%G&!Dt!Bknyc^+alt zE1p_c@|4qP<(Rbayp_{5-#5x4#K&&!_D%onJJ`PgW<-|KfC z+m;u7xW1Csm`NJB>DKh-<5w@@iBolB+6&(X)IM{}>zdtsYI~E#{6KFk)h(UwNm0c^BTOeV+wT$mkY#W^8S`sb2I!PmkaQ1Dl72 zPPYV^%z zvQzGv^vRly0$Pm+d+PcoE?Is;?2Y?7_fOdto%oNEb?X+t+}}+5*l+#R=EeNfHK$8_ zxly_qo*vUf3zn_Fm)aQ8vi28Gs9A7npI4i@_d^Q5i=HNpl(%2hbpD*BYl&Gwxl{Z8 z?K|ORR?@1&F>Crh8tHxEexr*U^5{(<-@doys~J z^O!hEv$&z_&d6`vuD3gXlQz}0yKbhaPm+|JosZ_mAV=wXrT>S1#h*6cR!+NBG#2JPO`dG_+T&1k2jV^(Br6(7x* zq?6QW9kDutlkw{1)q&S@2ke~q>k;>#(xTR%o!KY$dr7k+-+FJ`@?*yKA8U&qkKcGN zZAR9S)|v;|^h?*m{CBP;Tp3PYeLkK$XvWq2A5)g*pA~Ky5SKCeP3XzfBWt-wH1d8o zXRb2jE%Ac?i+OiO-Q3)tpP#55Ir+mNYQvuzzRkZos!oU0KDf1RY5nSNciY^iA+^5d&Zmu2u?W_T< zelP9fQ~!@Pk7~9oDmq!~3huf+T_y=1? zvjQ(Z>hGR$?|q>bH{}%Fd)%rerSeN1_i0bw{W+-h6#_Lre`(8)2S@|{oW-Z-MMn&} zQ(BPTE;f1NlEOoeaQin=qsLzE_Q0=jdn=Dar#GiH-}tiSmQIc0IFyo8V}9Pgh=0T- z%(KR-+G{26KkU7?WPhtO(x4cRwF7%R9`}gCzmT!S^Jv2iW=88aD!*d4y9rxsJsNs0 z^VGFXCw}0peDeG1dbMI(NC`_$j-J_Jmah1R^Q;l)cK`I`_~VsJOSa6oK4prq!SI}( zwKEqzUGQRi=r89V_`G_0chTQj6exS%VcCFYl;z2Dmc8aZ^lvk%_lo2bZMznZd0n`k zrM)658j`$eR$ssSq_hL`l-jvxcs~?Rs}m@j{eDNQzt^Oknwwe7-kKY?9k)BcQ?U6v z8Km%%Y>HsSf2gPE6eZ8}zgDup_}J==zf5e}ef*92$v0b_U(dbNpnrbJlW;%3es2$! zmel&8W59#P*%$r2-sRpt!|3DYIzQspj5g2lty-vF=FHtQ;G`I*a}UoA9n-LpLa}(n zw4}ws`)jvpGck2$y1##o)+Zj0+CL(H{>MoFK`xo4FR$0GcdP&6EzyzZwl~zkR2)-L$&neriqr zByR6cgF758E*-dGxO?FwzRQd0Y-lWX4H;<}cB;D+HJAKzTu3W#}(4NBZerrd(BX_L7|HI#X_qHxv&~9)0{>gV1 zYomFibZf#Q&t-5phfXgf;g|1OS$l)TO_tp4$<$Ttp+d>MyUX+9zqu%waD8P;24`Zk zx))xxp4oNk(ZsvZme(h`9lG*fJ88~6P4>97RR`jF_3$}AX7IH49rod36%tC9H(k6I zN}f+1H|MbWGCuIrZU6WqC)DO>eSJacZ&wz-{7D9`(xP{nP# zbmzeN(ao==kWaRX+8G*%R~>KPqO?u^@tTUDyA9%gev`MBwvW2?dqJamJtN+4r_H;+ zz2hqO(N});7rhuV<=eR3J}x~dVYh!7M(1tZD0j^{G;?)_TH~1>O-_HC8j2%C>Dq0( z{;gl!LYzT^2Mxl`n2Gu~+ory5oEzXHoo*&KlJ7Fma4aF7;fioj9Lj zcS@h$Cw#bV|6CE)haUfCztBB6Fr-ULuTfowx{1yUS47r7z2ri(^A}c9cZF_CJ>M}* zF?44Q-^i9vwvBoHq8pMN!mmS^C1i^>@uz zMlMcS6SnxThLWEqXD&_{!B{Y0`u2WnpN-;#c3(@|8};ji6{nYet1 z-4k1p_P^i$SCNqYm(ML-;hK)ZxU>60ia+$-oh{pXaooNs)Kyc@EKn!C|Ei7>Eou1S`MOwWP;t^0`Q_iDZa4X@=Nc;M`Qj4N?!y5Sy?2oO+ShA(aZA&i zd6QCqpV0DuZMCjP2fEaJ3N;+-2pSHfi$CF)i z3!eLgwK>c88sE6#Lbn}pBcY1) z&y~aH&&aFBJb&|=0vSspL#i*`C_+tIJd=OW?)pK$qSpTZNB25hj+k}pEhm2 zv})IbpLDIBl>C!J;;xHRO1j^@=3j40V9bTkwa4GAe4dgRdbiGw?fKAF8l&CQ=UuuS zT|O((SH0=F@}cHte3yQ!J9iR%n0{vBsGE*=wLDslpL~|>>7TGsc{uI}yWgIAPh9dF?O6HK4RUG8jnw3`B?SXL9?0|F{iEEt zaZU-bd&eeI@s_D+oMS`d0Q_Eu4ot3B@TeR6PTe&X)$2mCqadGE_B=rfbY;s`d zp4hEQ{=)$bdb=YYp;4_yjJv<-2>y9do1jfUE}i~M*G{urt}F1k-*dyB(;XyF14FOn zTnd~&Cm?x#!vfbSUSo1*xZNByuiuq6{53yg--xPR)Ao=sNNXDXH^vE8Ct zl(tY^`;e=7R&pleR^iV*e*M^|bZ=(C-oC2gZH5i?88$7o-rY?*2EF08`o5X#d%y8X zPwy`7ynCN};g5kqgY$Er-N`%r!DI35$gBU5M(+w=zVBso;g-Lj+<16nV*Lp1$D!X3 zt$%Z$C_23}{r$qd3$I0;&;7kau?By*_uc5&@`g*LrYNFJTvGNtR|UYzOO znDfZ0cxz-VR2z@N&`G6MHZ32s^gpPsYbuS^IOF=Bhu8UEXnGuSRV{ zZu9y~R9*OaiEOic&BEk~ksen%Z`Q2*`1j~^?&Nh18`Mw9cKo&2Rm6&pN)5Cd-lpr|ykNdfRQ~nrFjn8kgie{4mPF1$~YU zhu`+sFk6ymmfns(%{v**jS(DMeZqJAnLlpF*U`|P#@`sSI5NGjCRQG`=G*vKc~Rf7 zP1yB{PI{c6L)WPLzgg0-%fb8KJaC)I{WH%zT~K^>xsjT^etfV%K^2 zlGWeMO)jdj)q5Z0M{ei2e6h=|Lv?3&nzhV3^L1vgQ8C}n!_|n3c5!W5qio$42re}s z>GM|6XqL zdHTPy^uHoHNtUOhe;#ryI6D8q@S|Iu|D`$af2o!Lx-z;;wWeS&)$|M8%TgJz516_(iFgv{HOX`+W+~}s80KzY6(WsJqZ?)3+Mw?K=y$@ zASk5Vk&_V|4)Pc{$D-wKO6m@N_Y1EY6%tS{|l?O|Jy>3 z2B?O!|5sHgtN$ZzgTamy9Q(O>IOzX$s@48a0M*ag|EnbsiM@LhD=FYj8x8UTNx%h@ zz*r44>m?HV^r^J$U~CX-geDiu6>{AmV|JznaegEUq}Hf%<%n+^KN1xZ%Q8i|a+L-z zPsi?bBmwuCkf+`X4s{s^QWCrn6FT5YS1poci86qfdYKXr?i&G-z`87snGlJ^;tcPh zkV;F+km+Q~Tu*{N7RCk>M<9{A0~Q4n@Hm-L3hovekR#W~2u5cO@E0sQk_3**v_{9W zz^7FOgCD6vf&LCs$i)QUECY|n(0h8oHQ?ce$EW8gC5W9KQeWuRv0iu_V!#LuMlTeS zX%Nr*a9tvI0(uzjfnW?cJWixV?nE>~BeBS(Xr6>{;FV1whwEP~%aAJxUg$kAhAYp& zLs!IN+|vt^s$jOE2|*Oea2p`T94nl_qEZU+qdNe+=vULs6W~IDibiumJYE_Kmrga5 z%<$FI1Ks-v<-$sZfgxD2gfv?T^_%jhNoo3|7&%6G$0Tbo|4ZUQm=&jya&SjZI<+g} z>zWG3qSq5hpkbkiV{L?qauo?Ng7ic#%dt#>GzDYkSl0Y#Q<4xE>*j%8?dD}gFK}6D z_?|7wkV^)%hZ|D^)|4^I7G z)d$=4j|n!Zc3@@X;b8txrBJN)f2e-`&iQ|Jgc!L*qtdFDr~u8wG+S0xSqb_;Zde>2z~ z|0~xAoFn~jfS;BBU*!CcbNsLRkdP_U$`GGQU@?~@*XF=02uuL@LzrVWEv7$#m)-Ev z6aZTK>;)1+3y)(s^8wfJj=I%1jRKPkJPvJW@IZ*(OryUb*NBOvl!y(_Dm9!HjzmJd zMin9SHwFPJsqm-nUiczw}a-{($%mK?dsqIL)A`6da zs|G3+D&(fk91XbIPNT~1ipOED^3)nB_FYRt0n$~P3>ir&(~$?GE~@muL<)&YBL%`s zJduVZ9!%@5PiedU?au!+l1gb~4*EYMfMT`(1C|8N{$CA&Otv!v%rNvyjSOp-T8T!k z){*dJvWX*Y{a4hRHs%+b87D|cWOMmK(8u|)yi}neH71PD6ToRJG2oH^Ad>+E?m5U9 zmB2|!;Ks6eiEIu;GnBxBbWwU9`~@Mra>?q5IB&DVg-T}w6sOYYax!wjfbJQlfqSsR z%TR1B9=&P`b13J@3{Qbc67Un_SsWo7Txm9B2xR&ZxH%TaC4_l_bf6@{WNs{-hUYP3 zBNCYr90)uJ*T2k^#m@ z9vYF58pi=}*elF(ECx;(#);s@BDYzE@%XH0h#)|=Hh^g6D$`X2^pgR|1P~pD#T0_^ zgBchINlacM2izN!joygr3lY*x5}1RiMan_3qHJ(E5`im~iR9WcU;%M#89Jzdi$D!` z_1J;ODiFY;*OY-v0?UBsVi(2ei9rQh8NfVnnSkMz0swA4&4E?}e}8`VQYUCcQdzbL zUO3xf5Ff@bhlvWub~=oNfeAtxiQ+W!TzGs7%aJRjc5uU_N^>MSeR=IN6N9Y?KLu); zL@rVosDQ~P`jIFk8hWdm$^63<0VkG?H~qz$U6M#+uW@2o!Yoy4QOA;Sj&Mtd352V` zfDruYhY<+5YQ6(9cHs5>&oBgYW0UyN9CnqADkj1P8Cj@i;)l%@u$b{|W*CnHneUiihT(?Mt4@*XG@ z_fCX>Pzg0vu-eq8+Qn$>Oo#}vt6BE;Hq$A4djl7|U|Nbyc?ijJC7lL&<^}qDL2T4L zGLa`&WuqAlZUWRpmeukrL7ZshmCt5@F7Xb2O+QX5_+WI47lnN@H5_AauH~ z-^b4u!IcKVtU|7&%rsI9F3%)^DuQHrqHK7y=vpDd0ZP+GW6pkpEnIObtyT{1(UWAV zZ3QFiGuCB>-I zGa$1j#K;`7B~9E6rAi|cqFo+jX3WNtQYM>?76Gmyh^$m8R2eFW9FqW%lj#sSA_XGz zX%LwWHz}|pCLoWo$QlxT1}kMYKUsji#e}i+kBNeKcqxy*U^kF)QowQ?0Hnf*!`Tp7 zf{|dJJKH>WF2WJ`Kh)8>NI}HzRq~_gUECAOf*K4M=@7_#wO|To^eb;&b`zF-A{*Ey zce;fNg;JSB0ftXcxKhz8pS)l;#apursWG@C8F^+(T6UIh5GW6g0yA+S=r&lgil;y_ zf;%ZhR)EDn)gK~D4e2nLGCzk2Sae#bSStaN3+dw~NRf|vYV;q>;&|NHXgEDQ5v>GGSTOl}iuw$0)~$M%pcsVlWU(;NdGN z2Siro=(-ZD_ZHw51g8W?L%WvUQ$a^`42$$vDq*X9Y>t)yGXalk3PWL8!BxV8 zCJ-`S1UxLMbqJ7A1oH> zOysf=Bi(OlHN37q8zvcThmNL=`N_(FBXL)xmHt zguqG^Xpv)t$b?`cxGrsA!w z+}LHBs>F_H_^J-QT$!$_LiB1y4veD;GXQ6|st`S5vQ&lmk%7!McGJECo-uKNzUWnR z|F(v{YJ=VVALFUL&&tEW`L6(fI>U1R2V4p2-2bVD@X7l>XxsR5wtxf(Jr;l;&zT)Vrdkd&syFO(w%enDm z#viM_pYo~E%DK5?q8H+E!#;W623&q@L#Jg^*X2;RWu?oi7{&kYjz*Y?atI=V1N>$h zqA)82W^qP^g|*EA!GVg}_BiL%QX4vwIZ+kpM&(yTm)ST!L&sdTeXHW+|GV1Ps_9=+ zQpHquWr;5PU|){n?lYBkb`^I2qT1~#w)H>8bLo|lha>x6e;fWEf&UMu{-^2#nVg>=%ZDceaj>A}#Im>?!O)@L z*n7Fm0`*o1$hZSiC2CO{VdFj!I1>+lh?V8(fVKgQz(Bc@gRSP3vVo9Fj2IaMurh5n ztd9I!+0*Im4uvp?FqV^&V6<;TElIFIrBH3aviLDE%viQLC_ZzdwU4r|I{nnSNI`S3b+yn^K0gH|77CwYRk?cf}03%WuX_f&Z(35%*`9 za5Fx^EW7;H))lg~F0;_(x3uH$`75b~PLJ3q7g#f`qMg{I63I%7G;c29n2o$!2?%nVq=p+H1BN(I)_K+}0 zEejIze;^|T5($^?K0xw3clxNEa%e1Wc9A$z$TZWxIPt<~&1PI|wo`8cQ%@k=w5||Ky zOb76RLgGRY#|t<^>5^D19?${9b3hIFgrvmr)jE&|LXMskxKO}KARN0pij$`nDX}Jn zeuoE3Irt({a8X5@zU1(HCe-?1rLXmwN?+^al)h#sDUp2QG%|R=lE}1Lm4=O2Hz0Kw ziXA8pM)n$l^~U(YnDKqEx!rxRBb$3PFI43o2QvogEeY|7C~t8v?{!Ar8+gP~io^;7 zk9go*1#l5%kr=L3xDXPQ?NaoNo&kl`7cf7!-F8ezakV59s|KxBmJJi3;mMIZyg-*h z>(M3(tiq848g_Eh)27PMh_cxtohS^B1@LGyvXdrRqyhFP2rohjbd0Y#YIqi^)e7LD zS(l>@6DfgZkqL{iHp$e2mQOCL>B2+1DjS(FAZ@oSI8X(q&D+>gP3PRmu!R`8!@uy4 zxfOmH2JsmCkP!i6pOv-%g#kps9YZ4n-gQL^L$`6r3L~{xYb&E)VFQq9zcLVLQgLFe z;>?FFgjTf_1LtOgK456vR)7Y)=&80C)czk7sjMo9;j($g3UJVcQJ|PCcqD{rU||

    $S?u2Crg&kY<011wfHed{$4ikrv&E&GZNrK7Z zsS>9M*x~greu6;xLM8yh%AWwhVool>ggq-$CdtwoWSHd?fL=+$9jW!t5$z}f2ZG%c zsC;7GG)0&OUNj&(%Rp;rIt%f6j$~1C#Rzb#CL$&}@K&-#wO?h}` zI?wz}j!`O!V`WUbDvx6r0d{6$Wz0t$u(}*g+HgwVvJ)UraKE$JN6n2cP5P*no#iL> z$jndZkrhajW^&-WBBi#l$uudp!(!U8!gLNK&Vl4VFp$_c4t6$jXCwa)H*(Bo-Py{W zt^7aS$}v|8&Q|Vh<^SPUZt(EoZ0F8){vU4VnBy5|D|fc?|8OhU`$KXzb7wRE4>xn? zo`kcJe{GH2uCCqkx)GdF*YyV+p z!}jTUII#bqFen!O|7aAN)Bj)fgn!Zg12dWYj~jDX`i#ffJg&+3a*k_$E%qF!_{L^G zh<9uR{tL9pFmD1DgKI^OZ(1O-bB5C*o63Qykh?>{X8P?rS(6>^$k~>;<3Q3;w^IhIKXs z=ZR5gOK_g5bhZTN$wOybsLHnRwV%#&wgl%1HfK|Cp7L@wgo-IsoQIPt9&Dfgsn+{H zss1#E_5Ght|L@fj%5ndv&0FEhck`$ILO3p4AdHLWN5wK@Oz*%n1ggo!nOt_fFgb=D z!{bLpaN=#jQqAzfa6$nm3BA(GBGAf!O=iZ&TEo(8!gAu{`IcnRD0C}WHZy^fz_l(P zjl!_T8_%-I3L3@F43^Ca2k_wXFDqEOMcDvs3^V2b*n1Y}HmWNXNJFX+$Z{4IXbLZa zrZ(tf$#Fi8A|lJOt;DumSF*I-P{BfTITO0Bh@gP`-|IbTJ2l(Ju{@VZZUqf?4O%vz89*kF&{3T61@H(*n z@^5UM7n+d&!Fbh>f64g2KmWNQ6r7O%!Fbh{zXCJtI)A^JR}aJ(qsRZjhB=|?^PlH} z3QWZR2jdl<)tZdaQ)N-wq^GZ?GZ7;mUm&o&F%}54rd!F1j&xTi3Hlod)>eyVAQ11S z$6R{&DP@C$gZ{xrzozE`=~Q4H0t#YJ{?TX9Zhpy>Jg^AIYxpJ$QiL9s88#IY*79Ag zP0b{x4;4+Uek=AXBH?v?G(7Aq3E=>1$$F_uVJ#kay2xXgL$K`cmu1sK`gJ+G$cY$J zaDI>-#SwJeFB*o2n6wbngm^T7-|4LbdD#>QcK69=mz04;o|slJ<$~$Ms!b0O**D$` zNm)q5enB^6b5UQq%{L#RgaeGYa7L4cB5rqBQU-`3E%IP*0b)WOb1>!0MRqnUz00BM z+GLJqJD2L#T@0E}5{=z@@! z0aQlGMZzFLt&l?*g#-L^I6!|Hskh`f3^+1|SSbkhM#8gvz6!1opU=s|JTS15eFb4a z$q8&AXxJZQXu><7RZ?k^NL6eaI<&lO6G3xHtPO8vF}UmkPtpdkhE5*zM3VdyGA|r} z=A-t*eTb6biS*L<@%6Dz?ej#elL5!q58M+LA$uYn?8EqaiMlK)rhx*YAI8}W)fn|P z#y*fL;=%#Wb$+1&PF^UK1eF5vM7rn~s){2D!qMR*rC>6xpu$c#zKw#p6F>&5I2AB} zNDKco&W=g}q^a_QkYVKVw{Zf{t*S&%#4b>@ZLs=9IZ^8e?)hpDp_YWzLQ(NVz^Gt( zoG4?q-=IVWC^j}2ChXx?YwAMHak(o4?8}E+S_hBPpu`j5x!Pg;s>!D@ft$J@u9fw` zX*pdh6<31~2{tvMM&wAE{WLPkV*)qCd^O??rIUSgs2l@P z?K>SVvC4h&35i&^sFG_nP>`6 z=D2H3RCs_2ot~)E7b2tyVhW)k!F#aT4IKodpVUc8PBzSXlI6E#d1(`Y6a__Rg9ap- zzWaghq60kz#@1z-VAgUFkF>>(B?C~xBWn$ylZ?PuwaizyVBn-=!*(*sa_HF3a_Sa? z5CMK0CB{nr5amNgGy4&oO)C2wL|hBnAQ1)xMa3J?uyvVfj%h%0OauNJIF(ysi}IvV zAvjSekc>>Mwlsfhoj5CM5<7O5zyvT%ZX;V|mezNoEZeXFS;NaTgJvdsY=Qz5$Hj7|cqE$11r`0H%u z4_aX$03H>&U?pKll)=P$< zDtSZfAEFJr1h73-AjxxPYl2uZ<%K$)x?2LHImho#gRY7t9fAatND8i>GVC;79I%K} z6y0k{Yx&s%>ur$sl41yk1~3tRoApBmz;+3S2!IQy<`jT#qN$)ojB`OzdEWO(zQ_&? zDZ?DWp~W+>JCfJHFDT_(j!2Q6BkPDm6xGz4v5Buc>Fe!@cKOmB(e9Yuw zcTCG8{|)MX24xj|ggnchCsu-Avb}>Y3t~S3r3A`2ffC+6r4@0OQ%gbeWt(+m41q*Ol$@Rl8jX@7s zy@Vwh^XGdATX0f}DVjze;^)Z838|TsR~Fs@01^xm^eTa1C=d#f;JoJ0+~$S`kQ$gn zPEbjFU6Gs&22KG`fYm%={HV>p@)F$ooh{PCbTJDyij%i zud%UdBL8)-mFcUQ=$pv%eV#nu{-^ndC#*a?=QmoGX(HYCRZRCy zWbG!hcH;tmfU>2d2ao9?m5mnB!u#sd{Q$Z_1}_BOuwO!rXTxp%G!X z>{ErZ==BqK0#%a1F?F z2a<-<6J=yiU(AqpkJ`+gieC77CN%*f>r<# z>lpg56DF;Zh{BS0l0Amk4G0zJMFRk;63Hn8s9S_hCzyy})u413fGrfk5fpWNI!>7x z$VDIu+Q5uW5}xN1_;z6Wh<~_8wW5-5gBT778x`r*$=|3phPj; z*^*v>Az9WE^xx3vh&YAe6>Of>R4`p64SX}Z`@v|o1&2x`WFUMTru7UHltZyBT>cX* zD?uAFvQ<)zxp_BUvZ&G#3y53_CU|RtkDJ9|tEu%n+(}2A^d{TV%cH3{N%WGQRB~CO zHQq`*(O&rO@sj0I3Nd=i1#9}u6Qce0bipniOxiNrPtk-NOvR5 zwq%M#Nl!GDPQ>~;qbV?oR8O)u4#T$s*zQDkTM9;rcg4HYU?_=hxJcs5;2Y`fh<0}3 zSng;apr1knNi5m3GL>lWNRy6aXKNfTw!{H7tW{=X0adZiXrjwYTBBXj_Bid81Slyt zHe=|Kx_VSXSKB*6vEp~mJpp}$h9uqspd6-gA<&i^?U6$fC9G4g*+^M=)b&JE6;H{_iVR|2L5qJYZ?T@#Y05(t=;?w4kL(JP|l%73M_o-)Nbvi8SI@GmUt#i~lMu z3kRsQuD`Gd&{^v9WhwD1`v`1V_7j!mbTkbHOLlBclLHp1K(+lX=qHH+OTCH$py*|p zJ)w{*2{}yh(P_|)6!g=FJ{mm#g1p0~CT4g{yR<70p(@K0Q2!%Km^mxTx;j+NB`zX? zbO~!^gvt49$VEYCSvki873ip562?Nn2>T@*pkKW1K@e-dmG^_OaeiP45~HNBnmVi| zQpA!f=uGlFFTs&7TIV!ma$^JzL}Qykz~_LG(dTI{xH=V?He zShMng*tRT&;mN=X+j7nw%(k5Khpkw&=F2K*r1ft@j2&g}(~J=1zCa}Fx#OT*6bsH# zsfjbxZRJ--tHtFjy+9ML{~S|5QOf$T&I~IgMdUh82l!6yhgS0;4+_-axZ(f<&M>s| zBvoBy$<($BR!GGup~Y96FEx=H9<%f3heu-elT2BL-qw4oaF7jz`yZITMjSaSt4c)6 zg}1^OrCehbz4|Nj_*7)JERfHf8Dq+k%j@%si%AO^Z^^5sUOGY&Y~u(^m`3(DmfPB~ z1-7)~3ur;f#$-0#i{RdzZF1;x4q{M%iTO-Jk$}-H8XBP!6?S!F*mF z_BF(qp?q{4#P`U=RIKQDd_*gaIg2OtaI7LAF7egPO%G!`_9mX6Z^2y?o;2AaF;+ z24l745CppYRDhxEw(n8bbs}g=k61<1V9;gD(EDaHXM@jj5Ncm50a~Uf_|mY9zGd1=K_)$7)ze{$BMEt6;d98Al<*~8?HXYS8DQlrnTQ>xBodb%78~C`*XgeZ0j2*eP@yY@| zf>B-*jAVjr6*tV7ykw9%Z<$px*u4P@Co}47$5aP{QI2>iTk9Ej$f8ArVuAg}Vz9gp zu&*2m-{~2IvfOW!yF_ih{Nkm8lF33m#f*bv!A|q9qnOvR~Ma zI!2vkba@>Div%#iD)ZZTY-@MoH=rrt8l)ythZ~e8jeE!`w(Y4J-jpF1y!;0iM177( zbM)|%{R-nbCYwsXGoJnoN#}e8fdl$#=EuRY%fKAx{7{~uK-bHf361go8xsS<%n%Y* z2aze7g;8Ha&n9kHajd)O9`yY39(0H_gqjZ^Ui4MdDqigK@KN=dV zpa0SnYM9vnJt(g$d%D}FyN^dbnx5!rO~Lzx_;2bI`2Vqp@HD(l$t-Peb$y0^Ha)WW zdbslSV#i9u<(iblf0G_RZDSfPe$$MvFs*VVSG>1}wD)U<$@T%sJb%NyA3l8RW|!;8 zYZI-}^tz3|Uv=s~z0z^aBhRnAcfEV*rkkHx{Qdl<$%p2Tt$Xa!xp&uRe|hOKhyV1o z#nZZ1Ov|pAHd~$C*m3`+vwr?k;rzRnoVaw$-UX45R@|`XuH}1;U3V|nzWXm*zxlIi z@4T@3wQHV!!|$4R%|otN=f8VM@y!RPZN2)fS@@wCg0!lCybC$8M}?A}A3e&d7-AFf-m^T|KY{+4Ub+ut}xcC|eA$vW3tr%D_C zBX{FdpFF+oo|~m3x2`v?dEtSti@$k$;rF-xUl{zL?e&3r*NK_;CT+dv7k{^VpKI34@7%WY zS3i01%&7y9$#XAsEnc%SeCWL|9ev5RsjkP#PS-ITj=Ou_olS2X@uAE0oRpo>^5P{k zGe^zc_}`OTW^7n?Qt|ZvX`j0Ox9bmm4f>tp-m>h^&)rgg$HfbFCudy$vpZh$zI4`< zHBTRV?gNKxc7;|gz2fL;PrQ8bw)4GLEu3-vUUT1)de^_#?R@eb&moKF?woY(4a-m2 zecqw>-JJQj_vZDkmZ|&hbg!Sh`_%>WzP8bL==bLiuK1{Q#Z?#Gv(tZkpKHm$qw0>M zrrvVfbsv5<`3K8Rd~4I$+gDxj%PWr+UwQt~Vv;;FC49@~<-c09^1LHwy?wsN``!Qg z!|_)iw&}TdT=(6z>$;P+Ty*W9+PD9F>8ano^rp9eORl@&iud+h`^@w+rcU2-*n5vJ z*mdKs+n@XK-ff3nV!ZrT>k)e=|Ks`L#hrh=YYz!Nk}%`tZ(e@Wd5bsfn9|}pHF(*Smlyx&)zUu?cAmQG?=QM~-vvi)44wJYbKkmt zis%(LK>wVs{-dXX1-?jVtGf#j0g};4q)|55I_C=XjZhvNV%a8V5erLPuvbT?a zzjV$MGa{fLx5oZ;-^>|zeb0FGhaV1{a_hdCkDMRd@cNDiXH463^f^bn+&gaH{BCjk z^3d$rmj^Cc^P3mk7i_(F>SyO9^z`~Y_bmOlE$eUG^{u{H>E<o>+9n zy-%(u+OMVWoxJdv)chqg|Ka5wzuvsN60M z@yKS*EJ*Vv&Pdtp1i0;rFFcK(o25b}srW5+H`zg35s|RA?V^Nft#F68tKQCFd+eFB zakC1bUaqOU!g8;btya87)DF?c$I?y>ixg#iRt#mnxgz}}yFjy^v~#;`PW_1&hOsx= z_6<_Zi=L>elP!ft%)@)NlYYl1jZ9H?bvYbi9&yMlTC;}arg*~Kli{D0YO4PXs9NXH zW+OdcS6Z=ZBz)g1bsSS7^+jEOe}aDIi`;q20;hFEo*4_bRG1oiJ$>^vNh7G%1~4^k zED^FiYSK3ldwqdIi{wUZo=Qqo+?&g-$0RLWyK0>TX}cYpzU}fj=Oz@^%eQE_W=4mV zG4qM&q0j5*S4rrv>GiKu(tB#{EIhv|wsyTh&0D*^Lw~pyigmUK?43QJOsA6YJ}@iGV11!~QKRb93p)ml)g&$R@+@{`#pK<8kR|`F`B95Q znOw*++;U<%b;SHVPFhI%?ro;nO~J)&p*0>1AvHqv9g5Djoo(|&n z=VaM4ka@a!TVZ(P)7+GrP>ZsPo@u%`;DB&f`f#V>`C<3)x_XNvDYFCp$z|r33(*h0SW@Q8W%^6Sa zyX$=}oD2&0z7gnSt>?X}Vm+XGtI)NQu*IOD%L!_-qth`v-(0b`o^s{(^L+U*K_6@H zQV$h8xN~E}2MhPBv2BLIDzDB3b&=whCVCABs0#wb9m`72=TF;zjsCT(a$qE{Bj{3b zfb%TjX!6Ib{Aa)Q`#d`_@DTsHTxsey+oW9$vq-Ub^`wE)c?0HhFtuM9OW0;bZi}LFQ6+fGPcXz_F8j zrfKu(XTit^gfgJ&kIdVjG7ArNCHsgijc@#-${d(__k1DgLFQ76cG)_sJU+p!5R7hZR| zSlZ{yxvmz0t-eS2kK?)*i)jOlhMOm2@ilM0Q6zU!&XFzm`F$MLeIA?=88Q7R;oy;M zquqydfuTXBsQ?`M0<@ikJrC{W_p-zbAjwS(1Vu1d}) z`3`IWa3&iKQ$jD{raRkaj9AO&X&hU%y!}YstUAqX;E`$!`NP)_?acvJm$ZXsFdZv% z#huG@Oqhb^M)cZibw{E_v+D_pD+OLo$=bHc7KkV7^|WrPrka17DiKEW(ViZf*HnH= zQO7#&m&M&?eF@6K8v8^spM*nR4Y`LO?O0bOo;~eiPx!^2xa9{n?DM-_I#jElCBS_5 zz;-_&k0G#5xcbZn3?{N^QQJLW3cgsqAr>K7A&8g>0$WeT=GPUtka5P0MMQN5=@O;PXulRf@qtAl_S2Qn+HIa)1=r7ZCh>rpBzM2~<_sD?j5vzlz8iG@-oEBtZ z0lxu-3TM8xZr2C~M@gi!!S1=vR-zYV?uutFt_ztq7wk3}+OIbQXw0%`*=v_WJEkpl zw(;wW?l-R2e-k&Y^!7cj4dkw*`yb&WxqVu5&--wGQ@81djo*{(8FLgYUc&?H{r3wO z58!{7Ce2-_D)e%(#p&(~&%1|~ue3>3xJ`CabKCj&l{x9l;DvQt5QSe?!%Qt z_cm-(-z@3o*}2YOwrQ@Ig88Foi67?3KAoMZ9w8v)_%>?Ux8KW>JD*10mbWy`oL)4A z)I@i0d9-LznA3ODxSm&gO4dzt&^7e$vT@llqi2dLwMEjGIGZ#tK8q3KGRyB3UIlg-Vpq2c8jiqJqKD?1Yd8teDB8%i+L@J1qh- zQo!pLStku20~HmQ<0&t$ndphi^NBIGevy8QS5}p1F8wlBzgs&nx&Tu)Ul!1;7!f)% z=$IJBCziw45A>I7x2pS_2VWzsN_ScidbirTeU_nEs^~}MU-t>zyL)@7EWQ*k9{;Yj zr1-I`__aSa8Eul?9%lLb>}b~!xwohJ-+khvMMtcfxk4=^A#?XB{dk#0Q*x9^=M&XQ zwbfz9aZ*(+3Ze#zb&V%&e-)I-f?rc&w-GM%_KI1yZt6T`z2&-R+}519MB;Mue|7qzh`~@g4ClSKT6F{4`K1_RzwFW}>jBvs8HR^y`GnEg6#L{$<^+ z8mreh@k?43Wt*LNlH0wg?2JW!(}~dcaxP{;R3i=ZnD!R+Ds##zV3C%6=L)&1^G55A zh^*BF9Krjqw@VvX#krNeZS82sVz35=hRv}7GQeRe{Jhg!&-w1^?9c}aR5LK)SpB4Z z#HfQ;v$~#~DEwly>L9S_(cL~!LkD;2_E|TrRQ+48jyCyDd&9V$?=iortMK~Mld`~! zy}CX%^AUJ$Uiak4J4^p5#& zElB+P{G-p9^*;vv|Ht|72JrdM|DON-fB#G%f9NxiwnoSIZ!6oUN2V%%>78G}zWiIwhoG4Cij#w}v0vrgRYjQI9XoEf~EU#CAB6Cc~$ov?zoK1T8o~ zGbC#ciLMCjH-$uocyAH!D38Y$3>N`WhbZh<^duO0!45XjvFC9wgvFjX*4%2r7t+dI-cLnIjQ!;h|v+|52&nI4G?V86jXbh+rZT$>pPm z_7b`dIJqld8+GNwP&AfPel#Z;gg;>-i;Ora8H%MF<=KZZHVgu<2qwhejZ1?9WQce; zDTtnsfFNzw&^XYPam_*?!;nTYLgDS`P}Z>97CGCMpv@qTl`?fR1%^e87c*O`keC9A zV?_(q>_<{1V8rG;G$eG;Kh zZccDFM1AHMRz|#ikHu01R)AC&LH|s^S7=;8LTQZPkYFlYF?}o)1A@9ZHoj{i2+0V+ zc|d~}Bm-s;#5@GG<>W?&IzB=Rj|bj#sDFe6X`)agR-y@%27?L#tHBJyBZ3WCi(v+# zt&2pe&%T(-(Za*QW`!`((1;UcNnT>*0AC0uOfVARwiNC>Fl*NYhWG~XHWbe*dMb=k zLq-(zD;kWXK# z4$J~j-4CmRXD2{LB5DwW%ETab!-INwZsXa}zM)&#(P(RsMvaTr;v{6DmN+$KbsG%C z5G)+XrJSH6h4{gTXi%Z?<_8Q$piyid!apY6-NpNik^@UVqhvC%F8)BDpn@Uh>!GPx znZxz>s{-bR-1Xnf*{u$1Q1%du~>uo&bnVS|GLjEk>7>F}BttSHSCb2d~ zK^FX9K{q2A(f&hFGLDT|n-q);@|a7mKLMN`W7)9aw3Ayl(C9GEWQ7Kn9~m}KJa)9n z%SL&Ro$rt-iKCJx9IF}r#Z@OQbms9w<5@NX2DNMvmQGR?eYh%|X$P755b_11rmKmj zKZI!f{Kq@TL23(wh!I-E`h>r*ZBlf19}n1?B~wJb(e~+iK@~?#4lIX3JaZ#q{MYp~YeZqf2bl%?`k+Ud@f42o8Y-G&mB6`-Du|UO%Qj^X$}kZ!gCbKW$TOI6 zs)m+{SRIqUcT51vW&@^2W4iGiwvItTb991@e*PKcGYbgH)oHGlkT^hfRDD_5!e%LQ z?9`-?@Sj72|F6fO(YlR*`r%5C)nX1TesVqLws@>6jv6t3q}5!qamo#)5FHdeDla5&I{!3YatO(E!ZK^l4he@G~I6CX6U zj_x~%@derP6!^-3@x4cwGvLseR5~>CAp<0Zb8;BWr-^B}XZc~Qu;UN%<0OR2M(YZv z($=3eKZ>=Di`6oFXZT#O$xF5T;m-QMUMOqbYVrb+i${Kt?sCq~vAz~H5C` z(a3P@`ajX|-}C?fk!Q^MKWp(H`N!JVK!pB4B7sDJ{)o^x90bkmoYjAxb!>P$49}`Q z_srE0?qREV?qa{r_!WNkYW_rP=j>Igpx$O%)*}L+>jmEs9~R6y zC>F7S;Z*uW6Rr&hzq#?e%T4l{Mq9(2cwHE>l(}{nYBrCK{vY<9wV{n1$eWn zJ77?&-z3f*;T3j5;DDRVT*xx&mKvPcZpM#5a=H2KS0$+*egT33D2Eb*#Z0t);cQQ+S%l}x+U zO!_tE{aS*LW-~R#ilWXD*^A+)tNNfQlCqDal|@U99KZA3 z_wE0lKjB2LMBsDo1|c+)S29e3IPiSDXD*`w71(@UC3Y+lDdmD$D|(fBK|)iWVrGC9 zBtGMK&qIg0zU|t`kZ{VHCSGWQ!?DeOofmS3nZ#(%5mS;)(A`k9&#|8O44QaJ~?T z@L6h8Phe)sT-SCzMTrQxE&Wgf351izNw^RQv!$H~sU(s(PCx^p?o(HIRD^-5j^}aP zg^v0nAUu+ejHssyCNkwts+jBteoC2$6k`SBZW1o84hVrek*jzT27#TLD)=H2e!+0* zIU!9JQ{u)_a@SR4$I$spxx$|MaqPyvVsb2FU`aq1^CXPoKqiV0l5?8{sZuuK%G9Bu zswQ>A&=yeTh0=+HE2yKeOJBrMBvnB>UU$*JB#+{ig3bcKbUWy6ot^%zJ`4ZGjjI&o`zV{`pw z80kc&6Ql6u`sT*=mQHkZqD>v?4Z#ihlVa{Ild1YB`ReIM1ah!`bhK~lc|Ema@Bvp0l)&L9-Yp_C8-UsmP0ctGssR%d6o%1x7ai z3g$W0bTvM-Y+!Qm{#g}BRf67a1h}(6fPk=p7;~h}9P1LD!0Jq3MJ7hKk?YO^xoWg* z4%*4evI(?G-tKMWy|X~x8m}`4FPp$?PvBL0KyRZ5&bR8ps|9-CfF5|Wdf+&V^?|b&eMJx6y)E3$(y7N-&L;O<k5Dtd}9gwTT2** z&2S7lho^eFsLHK;=0~!s|6!Gn|uxDohWIMJ{}&}EvB{_>A2e^zN2P36Btna?h*W&@kbH6Zj`Qo>7T}3oF ziB+s;bK^6}`)6uNeb9kl;IvsjHGVU>XBxm*QWOGPeOFC~8K)dTTT+bc!!-AsQPe?B z)Pnj6qqMGzOjO3!X&1OuiUo3`KJh8zB-O>JS*a$jMK(YUTF@72&O&9CC6w}o*0(=6 zZK;@QWGLPlp5tM36Jk+?JNZ*}BqgeTPo~fhKrRnUePlvqwNsXsI@oqMdYWQU4^b~PM*cvwsQdCP~9_{zKF*A?s zy|%yR(Rp8K0t!~-O5eED%4c}H)LAa*UN*TaYE-HaFr{Lc3=p(OrWw#2HR)oq;Wc%5 zmNyor63_Am%hcjo-e{U?7&35SIwvt##fhndhFB)WME1YT(%ijV3)cUHOz#fI_3MA| zV9%`odEUeRpL@Ap@4h@-Km3KL85aVgJO!++pAYsAkB_YB zb@+$x^3QiI`2NrD630#7zw1w*|K>8!dHDYCkgtiGQ5bGl`J*f2w{R)Kg$=W* z?|TdEj;{sZKh*y2aNO|y+l8`=e)IQ=n zrNTlFl&4Z~&H7IA|3?3O?fa{i7N+Lcb4^bxOWr&GhPsLFj6swd2V+xP(_n*z6{>iQ> z`=1Alx>FoC+JENE^#A;a{@=Y^kF~|loZl+AOb=*cfWc}1Oqr#2- zH`}{AZL+eeV~C-zw(h+>Y3O%gOFOCjjntmZoUu?NHILF70NFcOKR(@Wt3v92bN8^h zS~*`Kv&`uV`!D}?)Fye4B_oxyOR}=~e$xVEm5k6Z;e0$i0U5h5->mO#HOU$jKzL2- zk-WnAU}SH7WB=&q)6K1e*ZaRcnw|=Z9D%jCW^0RUomh`F!d6nj30R)|`*npZ6J~2|iW=)t@1y7pNb7=VVZaMj z8b$gjxtJw>D$}ZNIIp20hYBbB;`t_Psxef2nJM{a?B4 z^zRJEP4=Jq)8{{V^kM$*ey%C|k8)RSfHU0&cxzs8V;fMIeBA^fw2GZRQFc21kl!my z4UeUPJ}C|KN`mj!a8@t@#K38V^WWE_!;lWo$w+nw{x~4N8H*sd0tisrT zZK`N)j0#KFoHU*%RpYt4P2TJuldYe3kB(<;Bhe;tBK<@g*6iXlnL#|2?W8cRbI@R> z3HZj|BH-&R?)Ls6`AY}alpCg|O|rR9gzQ4H^$35b=u(fzDoy?mHXPnV#-f$E4RVUY=O0|joOMf@BbJx znoPxvwyH6s=ZB0|uF1)Gpu*PWC(d<-c@uS9#Gb`{#jiX4@zpBy^jBXVZ7!1wbS}|h zj?L*>*p87RhBBn})kb;C!q~;?PZ7#i#eeOhbINceFG!Dn&L@}9vqgu*13*xZ70Wu% znAARSg-T?}xCbQbn9O`c@?bpLl?G?CaIY#(ui##_JCgs@_pj@FN3iqjrv9Jr&5Zvk zV-Mf|eO!-8H5_#jjTk;h>oGa{42s;V56cMKm2kxkeMX%*0HVyn2bI{^YVd73H*Esi zJXlrJud9$B!z^PYV?cyo{S0JG9A@J|A}i4IhOQ&{v|IuR)%)GZ>auQB4q&r^Kd|ERmsv&tFWwgd%d~tO(@2!btlC@hDv` z;Hzi5crH@3=qr;vZFOd5IaSdnD=TKU0@t08ryDB%c~uoLh@JIz{Sf)K&q(Vn+U-_) zu)6{G_;_}PBa)G9nR)2e+XO6di+4L`_|WSNF-&a>nx#>O8-s_C*oT%xik1!_j|m_# zkzK;g<)8zg^7xIdw-*^6RWfK{aQkx$bOOdHtzF&0hNq@_sLZ}tdT@f%S4cGW#jy~i zgEpNds*-BJr48-WberuFJH(+Dh@;1cFxry+^J2;MAM*Xrwf}cI`oG2euj5bKf8TzX z|Gk&%UhRLfc7o<}#Xf=T|7f#cK?Z%;n{9oW-{i_kufBrXnp+$gPugbmp87Le=9}#A zD%f9R0#_?0@LH3Xbf+v{F~OuLATtyW=)uDEJf)S=r&&RX$uBj4(w z`Gqg=aJ*JWbFn2!ZTPhuWqd6_e68gy&OyC_4(edsCv}{2sH@qCdUg7tUdvfh(xo@z zz&N9r*~q6p@NENO-~o_8JBVvQumNq>6mPz_UOrs+b4}TQ-2XGY>j*G^ApT3>2M_UI z?&F#(fBbugE}%Dz|2#XG9{+i+|1ke|FBi1`S$W{nSIUG`BWL^I-%A7Oqu+BGxydkybC+ZmytAv6@SD6?y&GE9LS4C z{e*d5y-4cHK9n+Eh1L~mPvpgE2G{e0FskDwZc1mVzFNLg)J>qECOd7;E1;=WhlfoU z)U@SA^RlLZ`6>A@!Ph$#AiM4^)i=B695ILdn zn8#V_*qo=fZwtDZ7#N?Qop(Nb?DqQE#cwb=AAh>M`uxSfO`J3ljtG1^V$y{cPNcCL z`ANe4K-x~c0PgzBjm@p?omabm`|3rGLhPj?5>AjN^D8+G&CQ`DQbdx*p)FGu$K0o05+|NyGVu9AQA|Vga%iay>J68nQ5^ZsI3)6hO-byk>TIJ7|G{=6fuT zpr}td=wIl%G8PQJg}_Z6Pe#tIp!vBJVhZr=)QN1*5xx!8q(1dy$)dpZeQ~>*`neQf zcnu%1a6=kTwzL$7?3 zHBnKd%r=0u(-+wG)>okU7Mb$m=kF3Mqkfi%Z4p!0p#4-fzq(ys#W+LLWGF~xyGB{S zkfhOQ;V3lE0qoO~4>)>N=`SFCwMfS>ABGy$5ioqx(S_<)b?|WQEFFH*+%!b7J0*avRyOkQG@vp9>G2Wy$*gVqE0hA5r%%y6S$RKi?jFMfnr^5Q^w;n>xaFq zqoehmtzsP+XUp-pbBv|Z%N^p$aYkZAt_q}M+#AUly-LWNz4afrmP<(Ep+4Mw%j_XC zK%o8Y^;CBS{vV9{Wr6Zefg-CZ$r-!?B-B>sW&I@^6X?K@;e|{(>1UuhU$)aLx0mRo z2x$5RiDlXNvsre=wHn+?ibtyxV3G>5a$b_!?ewJ%Y6Kl(JRWxK_EaOhLQy8UUYiHy zAR7)l7;+>z&pL_m1f8rCAIv9U2FsyT3mrAmh&e8`K-rtMrFjiNP4*uJhidy0V`$|c z6FeUr?jMl#Za2F;kb@0X%}wJ;mY}l(&GQ^3$tf1Y53eAsR(<;#yLShCbWUoxytZ+0 z&`!E5@=98J$FJMHj?fQ>M;q-yqHe7pcDD&`!2=mJYidNYh=o>;>E-&-7RJ9j-P_(M zsVh@$}HVbsp=&Ou{#~pThbjmozUGOUX08;8vJ)@C!l{#**Hh<5>2_4YS6Md)pRS9iyj_56MqzVF(!bx?fT z*wHE9ZW$ct>g(eVeOubs_4aiSo;Ntuy>VD1=z*WkgZ|fbnen8UNpKQf!AbNIRN(&{ z7-wac;mtfU2+Q!th}Oyv-HRN#1rR6!xBXS;|z<|ewH16-#d-j1Xk@ebDFGk+PH?ZQ6 z=ElPAzQOJ(DY;;|uab^8R;A;j-^rBX@CZ;_(S#Qvjya=8=)JM-3sY_q=ka#0Kd{q2~pjr;& z9@|O*6sLgkD1b8GItnlz&9*wZ%xi$?=xc!J=%KA`!1ktvK~B1 z>Z~%vS8c0TtT8UWm`g$=NB|OY55-Mj%tOJ=aA}Uz3i=z186t~iXwyqCy;SRcIrmOq z9`=>5&$tOI(^9#Z;2fI&m~(i&k@)EARlhX)KW^=^az*=3BK~7#!^)%aA4lR9vj3QN z=CF=&==;CCdBxHApCj_Bvj3&Sc?s;$_kTr0L(|dyKN7F%`)`kfEa*^1s!VLOn9aQE zF(#M)m#=7UDvSSWYG^*1|NqFmRxj+@)JZW_xW(q?EggNmon~ZNJifKLGam06>N3ym z8QR!~sz2qSPZs0x?tZ+;Y(})?Z)44r@oi`zK8_tV;*;VnrPE0kW2s^)vc_1A-{BwI zO06LwdUeq$X6!YXJndXYLAss1)lQg$c3~GNB;6V+nj0xSzqdNhk8u~2?XzHK+9FwuomJ+qMj?Teb>&Ssmw<8mkj-Y63o|oL#1qYK!30mIJy- z1b>v@!rW4&WHBPvRrd8T`Yj@BR$J3pn(V^Kj+j;kW+{P7ePB+{wum_Lu@NU7G2?4i z$1U+t90sm31-vK^Q%E=?YgWU~y19`xqUY6d@p*Neex0O~l2b5R0*-vqLuTMrrGxjnyKtK~!GCu-_89iGIu1>z`83z)i>w)> zzlZvC${ovPTno-#mw0!mJpk#$R5<_!esieLqw~Ve!AXHN=z(sB+7IG^mB4I~Fqh5# zheMuE0rNY;WIFlHp|1x{E}qd&eq&bKl+|$^MfmqJEX!KClHjkAH5=)}AtRdB$9qM7 zhsYX{*2&3@Olx_1A0k)9nobdc`D*$Q;ir)`1N>(C019+12+E-KL2FziFBR?N6f#cI z&Uv@oA1|PsDrwY)2~&{j z!%2wXv!hKol^jJ?>(W+)2yr;mgJ+Cdcs7rV0ha06lyJ*3)ApFDcOnXMc{1l!im9rg zdz8auVktbCwwyv{LR}-XGSDy9@Xb=f*HLSijcKPQ%mP*DwNoQlMidj0((f2D?b&vg z+mt*zUCLnYQc7kOL-^#i`S#|_5sCrNL~(qWyPPD3Gbe29AjRR!n1~N!lyk5w$+$)> z%$r#7Vx|c_WhYD|rqFF2&4QCICMKXyuV|h{?9fa}qo!BS#ZR52nYTtTO<67_SquWu z%>fXwK5^bEK%-K|DnQR;)`W*CZGd86C9p9&;W#VE-Vdr zn0OS!3SbhjUKiFo;#wIm3O!Q~xKIux7fX!tm}z+?)kU(4m?>Br zfrI944_F8Q&`r?ki~`(%*1(>P+0;Gb6LcKGM^~dYc1<1h5QQh}SI6nIHbA5Td^kHf zDGQFlgjlF&>+_t3CQsU|a)=OM+VYYjk&xr$bsDWzcv0yrlo;Sj;8-Z07=c-+9_22oLtYa8qyNw(hh zkY`e`WUNfC9t*aIi56@P=v#@l$nC#S;tYa8;e`6KU{8H;pilgcQ~M#N6*a^k!F*A2 z2lSI46{F#Va*%HB|qtEw9aJ?#VBMOeNFAiTaNfg{MAUm>Gf?HX)49lVm zozk;NAS}^qR9n9QT{#T6Ay6mrd(<3(_2#G-6a&<1+Jd8lOqsDmiGx^>=ueV+;3dR# z0;@v)Nz?U2U5arJAvIXS>@URr^7m6AH7kTHon z!8B9o127C8#SConLXsHOixojUsH-GB$OhDHBG98P#10c1Yp^II8$cjEQmBw@hz~y5 z@ImJv`V2B2oEGmWB_u&oNZZM|%z$E`e-SuePM{)a4ho}@pXP|aqLji=_YnV>cg0XH zAP|Y{@8#5k+Ve~SKmsRe27*^2XC`fw@PP3Qej@3>N8zlU1vLo8khD4_&7Hzv%%J?E zHx(@f#nX>kD6Qcm1BVGu7i$8zDW#DS%I1u?f!MBiU@7NZC@BbKw-ZDziY)=OP8I=< zJS#a$`2<`{eF#jOrfUuW-rzaJ)+2Nn1g=4MMDpsKG(KH#iet%>4lK9wpoLNv!Zq>y zpnPJ?Edg6k;DS&F<~BGE=ZVFmsbkA7m^QIQ$3rqqvMCcHNrBZ_;jU~DOaXcc5092E z_Nm*2OmzW1J3;pa=s>@eu$PWYj;}+8lgq6r*y4C4LP)>^mZAv-@G$|Us1n_#4LzL{ z!z8dXAMtsi%wbbeS+GH2JulpE2Dv` z2}D~d=tOx}kzytheV|)rQFzYr5tIutn{%;9y`Zimlns>PO^)`U36NAPb(^JhH+Gc8 z*)cqMEN_B#h$qd1>4HwDra=cxjBBELli}`ha?quK0W&-13>l{ug!7-0f--qW%6=Jx1c&>oD@=!YX(P1jyUjh z#46dFKd73wEIb3!~--T`I01 zL_Y3<5oxUJ~EtU0ENg--P|TuKm{a28&=;?2_}G?&mq^2q&W1F|QRNGB)gA!=^2 z-8SOaZKG=UHH^|(wGb%;P7tgKQxsN=mbDDZvts+$T;TJ37q58a#Bc(*z7AZMwlct4 z_;NdjrUO^DGZ_y=ZYGIR!SP0kt@>aPa=Ic?Q9&aSVBz!s-)wYGTSmZxSfd!pH0A4e7kzvBNQW9b1tm?w?g63L}yBX9@G@FYs{X~X` z$xkB2P=|{9gJn48Oh>@qS2?bt$hYA9s>-)n7bz1=BlSk*Z({NAn=A%y6-Joc6-Kr-Zl|n@ zlwS{~y%eFi)buS{Ox=hL#$vHJc@D6>f-nQ#RQ4$?4HoVtPd7%!w$w0ea16htMvgS* z!~hMd=tZ?i~n@J=)fnP@8-SQPH;m^g}A{(voW$hz&1XGJe zRyIT~6;ErHFZgBKHf8-^k}0+-7dAPnH5Ybo_s}}_Vbd>7u?F&8FBvJe20FlB@k@H& z-QE>wAR7(!4)t~8FP+Q*@VmJBGSFXKc7h)|Hg%mB+F?&4e%<5XrWNdk{2+a21lnRz zAbLRgS)78^NUOk|q31086b(G4%9WKr+9V#eivFW9dYdSOPEg6$Cr9i zFDG;e^cIASga)rxzm7c6xpVC#-*p#moqH zp2wbr?HLIRym$umLxkg;fxCu}*YqmKV@AAm7bToQ23HW8ZMESKc?5J_<(86rDu+@k z;L(UVVHX!xc8|z5y{^OYH^PtW;E}t*m>j^vrq>k@-vGGip_T*W>HU26QJqCKA5=iQ z5VCuR9XHik5Y_{%y>r;mk{4$SFCngt(EdnbWmBYrz9MZk$wFx%b4T8hq*_3v5u3U` z9L0ywu%xNXzJV4RV84P@1e_|u@&O|ZC&xh8qAc^tu}D4eh;p|FS&cms=A{0@wempJ zMq`|E?Fea=B`PJNO67(`5&v7If)I9Av?kd2Vy^FF5UWu?#nA9eaHCrvB(Vx}tPq~Z zhH>(`N}YD3J((;VC^BxfI7A5q8J~Pfv)>)5uxBR9#P{nUVUGDh~9@dxBl5MJp{# zY>`kqgX()7s>P^hMe3tuirXn^in5ed?7UE&HJ_y(oHi*A=pinXHe`)t`pxOI99r|H z={FaLD-cjqTj>o5oNuLUQGA21aiK9v^A%}Cz&A2s6bgBsWTcNg$->^w_=T1{biL)s zx=xjH=*x7*9>?vf#{dtu#VI|?MddGRe1a(V;=bj4Zw{g%+Vo4-X3~!^bt1=3v|_uol`KYuQAsc> zLgdVZsYhJ!6H8S;K)|h>2gADsVICrjMascK-Zpy6i0P62-14U?#D~O$G9m?-zQ6Sx zf+WE~u5C-1{v@kNYSjp3xX-AS2hrH85K7Qd!?6z{-hoW_4#gFvEq3gBLg=c9C#&3S zzpx|$O;CB1SWtG6>z#syqBMqqh)P_>FW!&UD5cOSvvYG`O_-HR#^%)fdNh-RsF_Xf z9Cq_46IKSSNSeV4#``N~fD$`5VH?5wD};WMM7iS@eymMCL5($eHSk<1BLz_!2hnk7 zbQhu`mTLFRIx%fbBwseH>>}gf*U&}{EXQn`F;Ykx5LYTa*DaQxFNqGc^f#3jd5!u{Et3AixIz)f_?4H0n#xB~>US1|bml zm~y%apT2p@l6%hKN2Z z`9s7uNEervCAYa`BJ4etQ645xb&O5~&?yv(YSN{+qmIFecooD+VoR9&QWuoD!cvV2 zSGYU!0CVQTpp1{PU8Vdvwvtz}x~PanO`#w~ehxjXGF=q2n_i@wppz*rG?OH|v~VAL zqfvUtAm=bziUCnuPm&JtemY{P6-|ShE8;B*GEC6;jZyio2`E%4m$#BT(P2<;yg!T% z42gge?gK?Uauv}0>~X-;;Hs(w6|jRs1QpPSvVa0T@QQ>JA!yNHJ8e6UM zD2F+7lri>MDx$7dl=2-axkcY;2T)6A+%dr24Y;x7=^|GeDeWrQCPDQjL6>3=mQ<{8 z6o({}u>wfUPEiU0VljRP6$)!L3Q+E>z@Bmu9)1lCF_RA0qH6w##ve2>?|i0|d>m@uG=ZvtE;qV*?2soKm5 ziUF=W8vuv-w$ zQKg0uudf%u4T`GOX;BB7<9m`2^LiQPFYOZ?$ffXFnl+F@)usJB>-ETsk*mm%YGBD$ zSs+BH+7LK5ew4Z(a=brvBDBU9VKWt!Rn1>b9~qX^>}c;bGg#1ZjO2g<6iXgm@=7VI z6pc+9gD2QoAYN8FfK^Y#Sw+BtSIWvuAxi0?lPuv%O1K`yT<7LgSV~!lEpw)uZ%jSfyp-rlM05wo5Uus1MNqqnq^B0j*a=kZN=Y`=|9{ELcwR zNsjPqt%z|WAXE691~WMV=Kc3ZL$uCb5zZG7`^o|hX$~|;+CE2I{1_FHB^KL|Mf^`h z1RNtR6M%@w@LN)ksayH1Xie0}Z!MPwV---;4SOVnsK^dDJeO2Llq{KT$Or_Y_zg!sdAP z%+S2i;Ub1NVS;3!3t{2AS~QF_LMLn)b0X9WGA1BAT9NYy2_&B-wLHmr%CrnV8vu2# z55Y7=2hu_)%p7EzvwLqm%e~0h2%%GH$6(8i*-S zslF1mavWP~rV4aTp)6jB7bb3@X)z~+&MIUlKy)POE@PEt*dZ{LSDJQcj}(hgX1z3p z31Vk?S*gPkAxlC*L*f94+fCu8^p$7pU{eva0uKb42uS?VkX;VOh6%nwl!zz5huqSJ z(i{RR?kG~Q)6mUmgrd8gw2y-d&UR5#KY}}{Q*aW03#EW!Tm`gh7J`f^oJTGw!_a72 z{?8OVQAu`$Ol=1vpQ@c?7Dk(c~Q*;DqhY_dKs<;8%oMe(yGTUH&clw3t%RhrY>)oD(3 zY3&IUYs)S~^GnRE#a!%}b&I|FYSA^aV;Ny1wgt1YQAvYIe24)95)#F!EWoF zQjgGifwn!49=@-*a~LwHX|Wq5<)j^X%OSAeR6t8{5udCuiHNF;j!8?oeR#Mk!WRds z6OD4RqB;fMH+L&I11pRnY$59N4!OnKeMcjZaNOp_HH-7n6Lo3f*B z*2$u{LhMJ4hp-|E(z#UL#aJ#?3<25FM&A@ENW$w$VD>Aa2}qlDT5p_J_55#s!kgDR#uW8GS2i`5=YPhs>qqmy9f{W)A^+POHPzen zbG_BR#zb#|PERY%o1ngpO{;vWj2|k~zg5oaP;l6T-Dx=*rGth-3pfdsq z=$K+*$3E4|I=tm}|IEUvqPTxAuKqfQYv3qv8Pg0cbH z@RosIP=oTA;K0A=sse5}cMFErV6dSIepIF(O9lJ}V@?dgIJ6tYu1Jrke7z$59QEi$ zX(AM|o2RG;j0Bnv$BpxKctAxl8M)t`B7M#-QR)LG z(->=FOAb!h&$a*ykA-yZvmor=XG0YT6)2v;VQBJM8JY@ozG7Den^O*|JUd69rINN@2LaOFTgKLg;S2w%QYSOP~TR#Y2h z)=3v&{cGE^O4uNVBN|V5MLWy53?B#SV>qm)TtbjM9*IRTnbfIdtnsy>%%OwjPSmKzoCe7f^N|o@IvKYh8s=M~S%o}@ z_mLD*IbUetLni~!6sq_G(M6QXo(6>ML*W&6j`HC&H#CV$?|P^ue&1-;VTMhWQ;v$< zj?`Cn+X-X=1qYM)pfjQ$cqHVq~r~IYff7pMl@RU9d>yWC#KH z6l#y3)1BKT<)(64R^G!#C+A|YIbMbwx4o$zo04`;kA6rnfnXfb&VrzM>O3?y#W$2P zcpg?v>pTd(DHKY?JYxW(d>v(?1I^JLqX=sm=q*Due7lgFk5%a{>5k_qXrwW=G8~Ch zZnC5jDzY3XG*|vcctd2?E0KnoZ=@CrB~k=Ju#e0%cB zW2Eh*!Z4=m!Za_Sq{z47167hHzH3GS@_f3@0w*7T75mU&YJ0HGPT&SCpL7Gr%t9%> z1=Lg0&BvQjUwt0p?ZXvLB_HqkaTW~hhhF3gxp zrzRSOudP93Hmts~&~=E|Z3+n_H~aJ~;)3pImLd*0Bbw+WN*ugK`sIL~vjD+53m`w_ zT$)&ym2)z#IaDGug1!blwKc5AAeq4xiRZ)SmbMZFCuyae5eMrifs7VQ6e4SUWWis} zF8-NycJ#l8^n^^yQyrk-LzE*_Y*U6#!gtNssZf3$rto(u0EPpe@Zjg^ycwEZ(8(0t z7HqPtf77zT&FveP4fVA5pEbBP1m?+rQ8i|O1ef)tQ9FZ)UKVP&Arp;S84sf)D0DDz zKhsa%FRdR1k7HtO!B}M7&kBGAXd*5{GsrbIERW!Ia=roOc*Ou1Lp;rBE(`ZV|53c| zM9+?x+nuIK7s}Qw>P@wnzPUWQ3p#0TGEr`iH@puhx7pa-(%9J2bSCVZIG)|(d2! zH@XF{?ddh!&={O>@$LcWx^~u~y8{MhX|)Sf0ViK78 zR+C-MQWEgulvmK9%Vdn0n=tn#o8Jhjo@n2@~L}@(DLQv4By~ord)~{pLTdcnEAt?j1LZ7smo6kklnNIC_`!-7Q=8d zyr_hYX&rn;oi0b@or0rs=8Ki^{Yr~cYtWNvu1`RAP`M(!JBXLD1p?syi%lnxfo>?v zNTBuF!xX;4sg=u2$kg0fzCX^RIh^Gq6&NSVmo})l5MQpN92+IiU^YQsH@W~L-15tZ~Yd8>2*#*zd8EyiFYMHkrKf!2$dx>Fw(7G9&GS@HrASxAqS8Y}ztpLW_a+{-N{CP3z3|{`1VUdi%SgM)$d! z2f7Cb%}oPl@5ar2z1>|=v$wyqZ%bEi|9Z0np6lN>Ywmhc=lwpy;Z%8=hNd zZ0sKB?17K%9ld?ML+3@!b-hFV*ylRvwB6j?J}}hVxuvgt0JQ9Z&6@_hVfZeie^Y;N z|GEJfrF&y{{}3>lei+K^J_kOSgFWqieKb`27MT42&98IQ=JN)6*Y^yWJ)8Qvx(5c0 zj&7J)dq-b44+V?r>}&7c7&W`vH@2_url&SRF9Xy}%x-H>H+==;wf7tCokP8w`Vl6b zoBD?a;A0e4IWVLi-P$|Y9W~nrdIu38>jpMK_XtjS0%6u~z;pfG+zW!*4D1Lr!OvR; zyZyOzb+`9HUxPRU_`;BlV}B}^*w@7fYt)h%R=2*9A+}K(Vpqi*SC|dWEe#DV%bUs! zu_y}uaZIsCZLx38S9SZZrUt&oF($YFE^lgHUUC1cam9+G_TMA%dPCTMr9tJW`S+;# z_m6uA?5OqksP%XH)?b0{l03bdJA+4!zDJF|e=1kN6#ik~Iu2F@%CSj+^U#GcCnuMV zpg3h~PdZo)1U-FV)~G=ZjN<%@QqaYZbjN=MdUwp`4*fl=7(G(lrB-xp{U zDeux0sZ`YR$;rvusYuKiK#h$GJ{-c0mU!i{5dn|@7%lod@Dtzi65-dRPMM?b7!EDw zqm?J|&}Nvo3z-RnQh16h5P`a}S~%2JAWjHV4s$}|x-8zFFWAdeK4p0)%a6BP8giGw z(C!kL)$bC>fOV{TI~hI)FH`we7iG5ALx3F*Cpn=?Wym7xbp4Oxx6qu&VeD=JIEimf z;>0tH`g%KLI+|q!H?hEslPFjP;yq;#Y-tZZP_^aOZmnxMf4UAJt%9CrE%kHF>O;t> zPiP3K*OcW_MSM?VGnQ@?wK}1T;mz$sJt{?DP9lZOT_p}fEKt%@wrZ?5WOAxXI33EI zI?E^3IlWmWt4s?G(`eh*wp4nDFsY4}e4Mkl<}rh&KVc^=vo;%k&hx0uH0_%otwT+#!ZT=CTS+rG}yWA=d||^ zbq{OjU?k%vtc+O~nryN1*r<(Tbfnez#nRZ{5xh}Uwl~VUO+?hg1i#f;NmcI_k>cRR z0<8dW%#g|8EkA$0g#}D(y4tE87xgqWUrPD=caay1+(tg&s_veZ1i&H4@UE}F;z0H- z>Guc_O3vp=c`C&PQf*r3H>(WG_awqC>fF@7P9homH&U3@iqDK9Jlfp2D*H}bqLY{y z_bRL5s9d6Y{|5Q?+)_>?B1Qikx^a~Z04I8+U~!!kxyd-C@_T89^o^iOg!j`V+Hlr4 zeYNGdqwbZEcan}iBb z(o_pT!!4f%`6&}w!XVx|fwc@kP$j1iP<_d6QhtV9fQ-ng=qgI6*N#X~3CQ%e~|Cth(HKQGk1$sM%S zu*Mr4j~h)sqI%TFFVy!8{{d+ZklQ%zX$oV5#31?OrOuV!)=_=u?8WW%N;U_N4mhC5Ag4U0JT-{{W#yhv- zXqxKAbMR?0S(eQ<>}fV_1|Q`tBY{UNw@JXMf^1AVqI`&P6tpt+E8Dg+`ANH=n#+2d zutw-2GXpQ3MibEzPU8CN3qnU!l|CvSl4-z^skfs($gx~yOkG?#CvmBgaR+4rq_o?jMA&4E7gi|biiGPHL9ev(2InbOpQEN-z|{39 z86Zm6xm2|gbc(u&rT|3hK{zfm*H^x_ZG-i(7=M15G{1d&y#WkGjZ4vy(4qRGuHF#k z%N;l76@l>*VK%mbn7 zNfW5+>H~Ye&K23i0y{mWs>1iwrLjxxlri;AA=2@=B#UgG3@L`JZIDZ^Xh8V31t5%z z!{4@VM^t9%gP%Y-2{ZXWBu`#MEHs-5PYz(Q`Ov(VND>lloa%7})vb)oQLM3%0Xf@OHo&dxq$4A_1 z+H;_(g*YKe91sBk634yq?OH}H3W1$|65l1=P0-e}5 zDaqAND#D4zn(S6PsnAC4eQB+B3NcNt7aC3`n5kwuGt;aRM0jJvj1Hc*L-zUN7}LV|Wl4gadUehRj3DAjD> zdGfHzs`W4c_oU%v!pTYhO_VOYm>hVXqT6eX_Z_|c)5Cjc2wVjXakaIz02wLNDEnJ& zU=6B?grE*Fmi9CdrGg-mX4*0{^`WgEI+@PueR42001&%tps};*FkHoB+jp+_8Q75;;%-F9h#QD3I~OFbEV!o4GY8c_15rZvHlvW zwpJ5{{pJCsHC$1F#ufC}4~fU}e68pJ$^tlyk~j6Ef|kX{EAQ?Wu^a z)m^BII=f)TBX%JFce(Cfb)mSP03uCs^i5XqmU@0@l%}lKv9ewsW~FP^cBTAK9gcNNaXk9k!;CX|?z(LAKhAwbC z)Z8*a?g*0*!*B`c5*0=Bu&W}*s8B65TtY8Un1Rg$-SFS?4&zL9p<6%A8JC6)#D0{8 zq$#q60&ZKlc#C~14kM}>`jI1sMySI&D5F`}*`{DNHZ8b|V~#XmojyG^SJboH%tdwj zkM+2I)dFSkkS2)kWrVuC2@vQihmk_b!j6r&DP6EL#8J!itS#*-yx5nxHJ`SuOzFt_ ziGk1@QAS=@_$Vd6zt!YEA$tWXhRr6P+HY^Vx|f#k#joIcH!HR|y!g)AWif(edW zE`MrLuv4W)UMH?WuG6nIkM$lo1lXYEP`Ze09&a$vqD1M2$s?*X(nEW^+Rm;4W{cGa zM?rw{R>$EB-+JnSWW{o=LkB=y5QuTTXYE1K2}G=rB`SGS=OTfu>=kH?LC@m%up`Cf zD8<2H(=7vivfw#CAl5F+dicm#Stvx_$j}RhsCyYv!*5VtLBvl|ix}aztCllAw3bMp z5vV1iE-{4`1yP&Pju+9Kq?HK}Egg?k*$+{gm<-C3G5d14HHK3ZYlu|-%2tZ%ze`}L z7AS*u@h%gqWriCbOs(t4LXrg9-Q}P@p^PZA@(w#*K4VQ#IUmkO zFDX9WeRpNf8&&TFZ|ZqL4QW_BSmzh;rdB)>?>N@7g;|11iSOzn+ZLa7Og_0z$4v1(y;?|hA2F)_M z_@}wukp1{UvO*M4wq`9q2kT{mSD3_Q7=QExJ``3+7kPAZ2W^BjuPD7aDJm8qC;}?< zWR&r6Zms^4&OFt&leHs)LF~vtQA)$~&5`Y4h+teQ(I6<*sk?Y6)~Wk=N~9Cts3Ra~ zH?s>?c>EgxQX>YA3CJ^rZBxW?s-jF3{abKLBgl(`&&Co~vE0U?!b>qR*aRkHVzMn~ zq|)JNPKT=2EthR3Rbs-0OPXqvRh<`G<+O}th&DKm5+__WX$_(2zDiK)71vVOq9?=B zCy&Tn>$~{rm;M&y9eCU{93k^g zq5wOHG>FGl7X_3g&56iGK`;?8u4sv<;bZ1X1afs9qEaZ+)<&jswmLbUp+7J9CCt7Y zclBw=+ZSG7qH^PekzuE@B?n7zpuCFdumnkwLN_{Qf`%o&1C_H#Ww2H31cBQx4&vMWKg7+F z5%L!L$RP`w_~Zpi3m;ZrB`o6IgM?KuKvc{)Nf}FI6{VWMH#s~-0ZhKdq|F>_w!`ZD z%Nqu3<0SZ?sbA$My|M9Qwzt%A(&;QfZ+|+z#W&QV~`G1bc>kX0rM`Vq7v#0-|h5gB70HWD&;+@cm z9cmt+&`yq~0(x_$0{Xuw`OneR@6`Yl=vt5hLBfN1%PYn|n*FD8fWwsir)v5iu`_H^ z8f{+F0ZYfZ=TiQa0%aqSjuxcIzGWdaaRcV_Ddf0dD%!nRpp0udpo|KmOvq(t?8-`6 zdGwp0k&?RN#OSmY)rwetG!IK`-_U+8MOFp7eb3ES*g z?9xHoB3c#LQY-7_8VMVp;4mv2tF&>@pD=yUb#hD#0V1Ryg6yx3HzMWQUT$eoBn=>%o2h4N?SSa*J2;mQlyUCL#qm2wC)Q4H>6-xYvLtJvM&u%Fa!v$!v+d8yBug2xw`B4Pb5u4fw2TY; zx=K>wa{UIL4;uelCNmE&$rM``6Y*EBSE7{>_CqS)85OzCXC~^#qvnJkDlH-$$Ia8t z3Hp-a9PtgS@EFolSFe3xkCTnEE+RXOL{;D1&Pj`=49j7L`LLh>CYBn;Y71gy9B=WG zkz%WEw`T7FVzLY}usAJP5#!!0AKwU7B^rBZBPP@m=3afq$}_l7e5y)%V;lL4ymMy8CXGyTrfJL7b!~-ZQJx}_csN_3Z^0YiVzeO%FbT?{* z)WG%}d=zwFhHj2Zx+N&GKrPm8jUWLp<9JA~{bNHsfQUPAE0?P2BxM3ZAM+{MN(dFE zSTNa@$jsvdQ%doAgD9?#c%S zDJezqPlBbu87gw@giR-(`b&Tqrg{<~dQ{9zC-i>N1wI7)P;sAoF`^S2{Fe_Wsd zPI6~kBtZRI<=&;OjAyq-e4?WuRz`I2dr4Y2IB~=dq(~xZUY;L$8@r4e__Tr%mb{P@ z5JJn59&dT>s-AImf-qwgDjQLM2E@M|yfNru)IgDL^igOrs%^VaNg_^IF1$K2HXB*5 z!5%t_TOrj1b3zuGE{Jm=l?kfcMO#DeIn16KD6j;A8vs&3t-prIcr3yxs|xDNJ~5vL zYu7|7uc)0*O9>XZR4qQFOq%sszb<2-k|JV0u{sfFzY`8#a*<-(5_Q^}_M=@Gd0@ST zk_dtka)z9nkU>(47G+R7l=cF-_A)-<5jJ!5om6W)k%)6_)Jf`Oh!+=-HDP0MU!`~z zl|h)2t|}q}s=6~CG98v2lvXIvHw>5@Ae@8mMO3zBa)=kt2(cs&)QE3}F*BBYfEw$# zCunob+=P@9C37_co)Am7p6GFEFsj|r_<+EYJe&y`o)F+78rrl9rDn`6>=chx1p}g# zoNZKHVxi7Lxt %J5jK+Z>j%+~V+277Jt(5gnf%RC0gF2BT1BrBfR3{Fa zuvXAzu2!N1B3xxMG9;0U7)Mlg>q$bI1N*DO-5YnPZ*JokAieOQ@3Mv5o`IiXc z6bfjD%B1QzAfVbcS}oW}DPJ!7Mg=WFBL#9myzWFqjoJxt;*xMKf$qc3n!I4CTbs)4 z4B9TqNO!{&kf4@|I3TvBNahis@##&GlEM;)!O02~RTSGWH4-C8kDy;kkzu5a-%;vE zzA&3gd8#EHSq)Dlg36__1uIIF#0&fqB9E%8i~(9y0aIZeVS zOF{zjg&lvk8p-S}vekmnOtxdW!^biOX2~)zr*bYub_to9F(dL*D=mSUH)nw-oU?`T z37`%gYQ#icq?S9a1PQrOtoQL%3lU#d#PWGL=(S?E)%>-cmZ(~0=H&^r3hPDSNd%?q zIcQ;z29YpoFT0G{2~QQ;RPn@4k#9~|m?lHAG-MlT%*S*1IK%WAgFJ;=BJ4Z`@r#55auW-D zT@?nViigmnG^Mw!PEesu(+osIQj9S{fITfP5{QB@g2XcUIL-*qj{s$PFOxATw9TWB zVpLvhu`*+LD^nhQ8R@2A^`)~Mb*s9531qIdX?v*s46QsSrp4f zVslYZQymH!FTvNG{ew%!1bGR-kZK&MCt}B21u)Q>n6EaMfw2{aGaP=ZhC#d;00uEnj}aiWN7tw%*dwacg(??He}i9~}JrmMwpI z{`q%W))!N$FJ&@+ec^?FQ!M`N#TVbRckkYhee7eO_{1k}zWL_eyZ_;;tG>B^|NcAg zyz?tx`N}=_+;hbh_kQ%F4}ARN|9IVX-@fIRM{c|Ad;9l4cITZx_|lht_|>mIb>#}6{{JV{G@SF&*bw~NH{%au?}NY3KX^*b zqwsIh>bKR@JoASS$!AtU+b!>TY3!wQ_}QA8lWR_$&Hs>m&WC^aejfatf$isX*wOa3nhf-Z^TT#M z@XwsV&pkQwB>K1fzj@xLig|az=l(N!-g9df)SNoQpSS+{-F;m(S?F)|*H5Xr5dQwu z>#4!#af}P@=ie5-Je%4^@jrMb*3LaxbM@SJ_S}8jy?f`LeERth-F^H0SI&R$hFf~R z^qFt{*}UHC>J~n~ZqI35mz{cd`~EBUoYZl}z9-Gu$@|`I&Ra7#zjpT{pIYfXyC84w zo^wNOTYkal{RienI@TAZ45EdTteiT|AW$j$F7{p81g*<52p z&ac0-yJN808N9rJzy~gD|hdSk3Hiy9zS&doD+Vx;J`HpPx#W>i}rl-A0Iuo^TR!l9(U4@ z9;kUs-xHf>ePZ*vtM?xNzP?Ad)y%u+@fcf%$Rq~oX761`F~E_e~a7p zw+9|QzVGc%&Hw1>KYHS(Pv5%Y=NEh=z2)=!YL9t%@kn>){(T3o$wa>X^GiPV(Nk(> z*6;u1wP)`=CpGh`PtLUOzwoAAfA#1Ii=Q;>x)(>g?;E@IfBn@j{_4(w;@%lc7asiC z(`%Q^&o5|Sa>b6zYnS%CxaZh+-}9}f=f^f5sJZ&sh8;7GpV|AV(_xUB|2Vs2e8+uj z+s1c0cO3hNeFwaE{OG3Ju8v*1dF|ZBiH7^ve)ipqW*_&KU)^~7tbY~gJ+Gh1GKaLM)U@4T+_ z*ps8T?Vfo;-@chQUDmPa3-gaT{~P;`oB8Y7Q+FI(cjl+N@A>3g*B*ELU*GZD|JV4| z{1+}Bd*$ZyvTaWO?D@vpch-F6FCKh*$e`RMX9{_gggcNA~gcl=M= z9=@O^8XfAGyRc>7Pe(dt-njp*Dpk{gJvGL`zXFdC=t3LD1*&lfFg3FKl&XZ5gn3cL@>&)X*&vbs}5AWFi z{h4i>W-smRnYm=q*7w%j{l9;G&kH~K{_I&RZW(>L{`kku+~-fc_x|lyzj$5Ech-FQ z%G3Vo)^*o>u;Yhcs{hv)x46H#^zU!^{h}FvGiTzu;m#)0+;QYIv%;?=S%}0N;d+vgV=53gB`41L7zi0l(ZkxTd=U$`# z?!vET?wQfCWB0sg{(Q@y-|@`6o@Zu!eeMIZ{yuWw7dNck``I7w*tX#IJ;$7|d&z$l238M$Dzw)IWb57p;7Y9GJ^&S85 zgY5dbH|{p}-}vRdv%gU6YTmZ#3wy79&ja?VcSYBxuDNRO^P_jB$1m@HWcCX+Prvhu zV`t@`{Y>$}-S2JMU$^XiGydh_Q_lE9v_Jjv+5h_3hUWO)&+jwOKl?2&%>3Us_xzpgx29`n;@x-s&-Y8O zeBin>oG;fL6MbgeRUOy&f9T}DyW*=qTlmZ3ZSC)OReQ`eP3z_bk}IduIRs`d>a@Z2tIndgpX{ ze`U?x`L$Et{%?1*ogLkFqB--ExvNVzolp}ydFFSny8Bm`%zbLl4}bC2C%$>`dsnVb zcSpC?POQGnSTy(4f4==gOa6P!jOWb3l@I;0{oLobe!Js=GgkcNy=!;fwr6hFGc#92 zW*&FW-<)%gSz~wAJuxe?Z$`&4x7XLdRKM+vug<@~+J9_(*+Xx+{N}f}d~KlfrJoJ{ z<|j}5{gM~2nW+8k_KnBve)x+2shRzq&t27X*Ol{^%>3QTp>O^B-fOSF;qsQR4&M6J zzifD+XUHJ$v)%r!Ai-f6j{cKi}E-jh7ETlE3CFxBR^C=Pm#8^7rm| z$0twt^3^{-_RE=LUS7E8*f|}Ez0dvP0q6Sf)~5IUxP9??$9CMcV|m-!Wu;Ho{F!-U z`}MWIy*+!=?%8KPxxD?{yOU3)?ws*Lr+M|r+Ri<<9GEq8;f#-7ePG~*xeGt_mj7(O zC$jS0KmNei1{RwK#=bEA7pMQI=G=F`w0qz`l9&I@b6aNJbjoPWlfSHAHDNCK;x%X0 z&R=&$_Olxvf7|VQI&S}$4Q9ed@r9=70NS z?T-Jr_U-?3;F#mz^4J$o{PKG)c-vQ&-tpI)zVVySHaLGU@2#!9@3>X-o4)^tx1D|5 zjWx&acs})!{O6uI_}PZsNtc~?+R#USP&l~f`eS$e_dEXf!0wr&pZZ+>KlitFo&C(5 zZ@%>dKRD(`JD>l%E519YrhQ(+zwLYLlXF^sH}msb#va&xih0EukFFel=)%tI|6%W0 zpyMcx)N19=t`8$w4mg12(Hyd7<<)9eAAeS?Wl0vcc>c?lZDeH`NwdOMn=T@ZKG~6JYY-E*E~`ckf=fuIlcY*;&bg zSQflP^FZF2sjjZBuI{d>uCBWFwu3qU&^r9Yf!DluEj#<2xkbI-kKT9Z-#mQngGJB( z_Br2?${Wv}vPBqLT)$!6qkp+z;FhPayX)exe*3Du>-~X8o((pC;JESJ_w%%Q4Ikh0 zr;hC}KDYOpU;O90MSFI+UOhIyf8T*AeaV8}vyQ*KJE7OlIb+jL&%g1=@q#DwT5s6( zp}2MGIXyW$w|}^^^uK=dZ1Jsscp`G}o!tW^fB&o9cPua5z4Nn>K3zDvddfL3I*)DM zy}R^=nx9M`{@+a6LYVa^P|px zs(ZM2ZC=?M!+D2S#!DW!y6pjP-fv%<`|kaBZ9StvT{5)(Cz|ufRr%*F3t#f$*3Rmn zV>or@`i1gP&TXG8`z&wg%#~HI7Uo>Jz2JE3(9-_=eZNXCdwpT?fz-X9bU23RJEs** zQx@%4a$h~8pgN~_hC@rgaoGp&%g=8r2n+|^vubBKa@|+vR|;$X=-he1w2s>w3tlU! za@^4VaiBpf&3~$^U)YpbS(x*Jvp}954+SotajfU#!>zT`mp$&R`%~e{ ztiABDGq+!z|H^E!qq^v#DVxeZUH`}R`t+p3KkQsxoVVnL+`UildhGQ%FPxos$?0;A zw>!V}gH3O~v1iF!p^r9()14JhzOwU;&pYRNJFmz++?!vu?X1>4`yadVhlh%me027< zXXZ8tWit-1dheAzyQZwa_Vv0uJA>Y(FtmJl^Zv&IpX|v$I<;V4a`&|2*1=hejxTOe3a)?YSwSfts!3kZdG&?Q9V-+g z^Get4axY$&yLIn|{=Gd-Mc=!*F*mZR@QB!WaBkU9!DPvY2d=GLw5{h@@R66+x(dn) z3vxeOam|tAH@`g;NL8P=_U-b2KakV$QrnJ(ycyBjy2Ja|Hx<3v;@NdH|NRZ3v)K9V zCmovtKiKq?Lt4Cdv9RLt!p@z8mxqtm<`3(259zxK>Klg_E^PFj=Fm=mZ`Fc>ITug4 z-o4K`^U1+zLHhWyoc$kl->=Pm{OvkNYQ?OF0{55Z`rgYeyTMU+#o+CSimK}!TME8) zW>OlccX;!^_4voNrxnkBt6`sO{oe0BdrkE#=dHTsz%Or+hJIak{Am6%|E+KR;)yz=>9xEdVlUsd5)?V-`rU~_3FMyzZa_i{>;05r$4;stgHLy{eE{Wo#=nYbMr%+ zPd}Xdz++eb{Mc26Wp}*PTK6As&)U4_4(C(Os@DguKYHa4|F!VP_bCkz{&?z;v-n?z z8q;k>^XJUGNIuPx`)*$MHgUz~n(zKwcf}P$Ip$)(S@FU`kiGT=FawCcl-z9 z(pv+AyY(Ia?CZ%p|F->3@4EJx2iNAL3SGlFg$ErA4mvA7o%MH%?>=MwJ+5Q1zbsaY z*X6vtx&GI;ENfWSHS5pL(yQ*t3ph_(URUB@aLL8_Gyd!-yZ@r<{M?()I8?ZA`7iSh zY4SzAUAf`k7dY-cE+cuj9n_e}C1YYFqq=N+K^+llK3KxXQ=#a$E8`G*ZcN)2H?6RFA3! z!7Ts|%&kZ(nkKtxDvLpk1tv(H9@uKE;emD7Az%0SQfNlEq~Q>KNli(L;Hn6bNF`Zg zJ`P%UTcF*8aS-dlr%M(X2yPvN!$~xy)WU0wkV+4vX86lk+&-`j?zA)i4pPnq!K=J! zErvm*gFIUnMoR|=8Q2f!-XH)TCot4a1l=aA&fknQfZ~;gWj&nI6eWmmIp|r8bn<|J zBhY7!y{j6#@8FBEnlT3{78uE1A?_9I)p^`5QeWH`4#!#izyuuIVLOSim)+$f2#vUt zc8shbK?7&XT;Q$H>+J*oiKHCWbU})Hgf5k!j7D7GyDvz+9w8JGMCvgt;&~L8%f(_u z>gf&w;SG2L9^o-oURKNzO3()rDR}^jvq081-)?h=mD={)c znAf$npm{bGeP2^@XD>sd#^X`+pAP_bIB6b*JIU(4WH|(6LFzGwAaFk1*)K@Qa4$fS znaKrA2_b99FbTME=ux=_fK18e5=YB)E2#+lLO_BjrYqTHX~R!YazTKNQ#Tte5g07s zU;~FsqpA-A_%WhA9uAb$)NTS6=?TK&GD$3xMe>f^cE(g)k;re$#O%|Rl$uUKGXzN_ zJst#S%rKlwhf)lewLnUf6FL=Gc5e07>VVTcIi6#Gv+Y+Q+ z5m}7S7*klgt@%;d*#%zvGE2=+IwEAwFcIij!VZbg6~J9|Q`I@E0fctCKnJsnlTKbh z&p;*=80p|*DPZE0tPwxz`ah=rr}jc-np3I&Rr_oFcKwfh0Z!_F6LF2Nc9o(3q2!pl z$qCg!qVy!u1G8h0`}Z-?`%08VIyT9=Pll#>CLePH`p8q!J-WikhBcp6V3G^7rr;Dq z#wPjerU7S^Jyn!$i7(6>f z)F~mWRpP+FfM~&(#RI}7-P&2YwQI39_A|Sef&I3g1%!q)0gqttP)an*7m)=W`!+I* zGhM_OG%SCF)Yev_hr|+HtZk*|b*iqS9wWCdC68I8-TE4^+vNB4D9Bh2BJs!bTsH@Y(h%= zkSG!QCgYQ^LsesnoUqX8%4Dc<jP{V9NNd}4U^HX7_-r&i;%jxlVztm`~<-xLF1!1GYg`aaQ znUhBd8UqfW(=4tC*CQCoqX?KQg>wr4P`psBC4>gEg;PDY$K!U5Xyp@_!e|b4RLGD3 zX0_yC#y6S^-V^PJ+uLaY%L7%jh%#k^AoVaMnh%A{GEjp_4b`W!heKu=k11S+&~nnz zggO%KhO)@mp(%RCc7U5&40L+-S>}hAbr!0}-gnUi91<2Jlx*mgQgT~ro})w{y(gTq zfMAD{uXbZk%jgmsVnU)wiPlQWd4Za+9E%xdW8Nm?>nPo^5+0=7=FG!kNZ+t=g8fDy zp|^mXHuxge6x_~fXI2b&jfd`0|A*UAZ0Eo{Km-LWVq~xvH+oVAbmmTtk#LZXLIUVv zpDN7yj>yq09U%}s;uph1ndXBNwn|qxt;KxMG&X09#0?~sPFygpVq-9uA+j5O+6i%+ zLc_XX@^j$-&ozer&u5lXssC42+Wmis{=abY{O5#R! z_I7pins7_=at#=&a;^ zDMw81jTW_$H|^A3Mp4AU5kezOP~(EcN|@FqTqg+N2)0qq4k`%Z_461SnP5l{qqYcze6~zp5 zCd5gSJi-D)D4s&9VT3_ zf!kyFugP6q6eHY3$mD7UI!Zu7V6xU?l7R#ZQfJnQxPnk#BHx)2V~HfSg)W7cA$Uxn zLlI-DkK)>14o+5>zMgI@McK|0q^R%#v4(S^(1&xruv9R=2Puvy{OllH$=Dyp85IDQ z3VvR|zOTdTfNwtXhx}xoTPFf#P!_*GXgB!)mQ#@E^Gh%=q4qC8P>F@W>Qpf*UV_GC zqM@L4&j@TLAE+^d)ka6hBD4#vt0RTUq!d2wqunQ<6w-4FY9xih+rZNRl8&OUD<${K zQJS;~g#kq6)D@xs*qUK9vEQx=jR3&g$C{8-w5SR}17op4J58x5nD;z}*2X&)ERGlm z(O}-vP{vy-eU{x|^4!?r^*9p{;F8eQW(1^6B5WcFp`0rNd= z8-L&2V7$jlqaB*84GPKtSrm2V7jFikq;VmoE(mgh zYRI6N+|vr#g&b5P)^MF88C*=W|3H$6&N{*w2^!-?#(I}CwZD?s;yT&VsOcq5C=NoJu%H4{O zvBlCKhWvS%w0bPyof+`7frda5^#)W@fo>{GB4&XyCl(sC9V3zADJFv^r2ea(3%`li znCm|*k0+@BjJf`2`~Or0Chh+da{X;_MOxP?I--dRIBY`td3^2cbTMrKA<{EqUqhN_ z7P6YHxGh9w;4(z=?)u3X=_o@=R5tOG(MmnC{EiZ_sTU4v4fq(M42? zMz(5?xCc>P4hwzuM#KmTf-z30hEQ#)2sJ`ranN5Ctf>^@vQD%FB>_?2sg^L_%m&IB zxgDySB8!2XWJ{BAZ#}LA(=vR7cas%6(I<&~b#GqNyir6`xw+!Qv-WlmEHVZzzL*#f zBx4DPsy;o{MXCxy(o#iAsdQ;VA0*3i2*zSuyzDzLqWe_H;wn|~l*u1)F?WTl)6|zo|Kf5#KfvBLcSFhZ$Ol? z2J8orZk8hA8K}tkka1*JcJb-;KjyK!DSm7YmeVZ5$U?f(Nw5T9`g0PrbW09GcG!^o^C_JGLOFd`$QPb4RF;z`c3kG~@>U@FifP}*`&s3wbyy2LY zoPBQkDIFDzu&Ay>k}a&or~|D?=r%`laAQgeu?g3%0L^|BcR}6v{BO85%pwS4UXEoa1>l9*>cLoZ+#%GlO&gh`#r<0>&@fnTM=e zC?D8&hJ`R1>Ba_aA<426I=-TkDW4NAo`!VdfdPXZrra`6$zyb(WR)vmjF(QN9$|9h z?;CWDqW@tMpz(?V`Q`Qhni_xAr2an<*9rUI$iR1Ub(~oL4^)A%*XI9KHF^GXVlJ*X z8eNS_W0h&W3 zA(HE_z5=9+A~h! zFc&QgJcMvEj+pUeixy8I7NRQND|hH>ES*vywv1#vY{faV&{Ji(V4(4dL>Nncs@`<(k401}Y+AgyhH-WV+5mwN8_}<1!`DKq9*6Wft^Xqk3%D z23gn`%Ly`?JD7zR;>YiFq9?NR4K%ohriVdU&k7?%P?kG17QmSkJ;AxDxECz7&R?S7IzYcKD&tHX)8nx-Y8+=L@s2^0v>ghELm z$%o3=k@8V8%-lqX-N#6Mj9dk*LKN65Tcuj|#pRZHkd;CnofA3k_lQ-+ zzVJyy9aLzIWY_a237Zv zeM`|LMY70}x{7NqfaNs;!(SjHR}$KXEo5YeEMg1;tDDIL*mTO3@lL83u9^!5n=LJz z7EFnE79`gvEZRv`kplCZ!%zv-=%CYtMBc8Sh!ed~HIf%BPxI_J zRjL=7CCMvG^X%wVsu!w6^MW>-XGg`To`i!GsYvtqTvBEw0zT2CS#hTweBE(Rlcgdz zT^CM!$S$cj>BN#vkLO*;I@;u=XElRr(Kzdq+$(UpOKKiuRCRFJFGGl3>65%A&|+fq z3p&B|d%ddDPYSQP(seH^U@PK40$(15aC$(C2wW0Pu^b(F?E?>_D`-!oHMs3hkO|G- z>46)aBC~6JjiJY+OeU9&A2VgMhQUFCHX7xTm1$INkSnLDrXI}&m4l=r1%@r87qS_> zIG#&^-anjPgqxzwdOW3%l*Zx!1FZuVZU^nSWp`)61&aD~F{s_b7D>R4f}STBn?2y~ z>+gzbe$dE=LL}#;6Dufn#d9Mdgbpyga&=^_+Cb=QbR^>EhVR&wjvdGl5QYO$csts` zCZr)^})EUWscSp3(^-!b9{i3csGL{ZckX4)83Yn{-S&z#fh?Mg>~-oADH;)Ttd-4m~*o zm|_gmmfFD!*%ZRU=)j>A2!a~Q09rI)0kAZ3S#2~A9d!i!d%M9K9CitIy2#9epO6_4 zI_pVt9HXhJBnG{Ob4h{e2txJ)Buro{>l_={9nQHa=t-Tds}yb#C~oF+gqIzF%|gNP z5AIYHdhZaw!C;eNOaL|pO_hg5EHIc|<~tRtBj2h4PbG{ZI>KX1 znwg4Dvn4$|Y_}&K&rMmRR`wYUM}eIVa~C!)@XM|p={q2e7~R3-;HyV25B~y+ z2q}WPaAuHiesCD59%=S($V^LoNjQv6b`Syh%_b2XMe-zEj7r_^B;!=+#pw|X`=N6V zC ziYrO5lNT4Dpp5dE86QuW@ey6m#sO=Vb7-m;;P|n`WP-ATlCOqiT+SlA$2!ru+K3)A zLk=bs4f|YLqjJS$_l{;mamib%#04{{jeA|vNMwcZk<&)iqv$a+=x~|~BW@c6`&cX4 zb_8fz5a1O4Tnp3x4}QwL|4iv4sl?gu=-RM!X_Tr{|b9ctMFTLBb%j{czRF!R}R z%lIHYIt!OidDsyZ-C`gFJXJDC#VrQZHAz^mENa*{WF}HZK?~>6ny|snmSAo?uLYQE zKbk$2NKY_C^B4qs@Sa2htRd z!N?H~p4aCZ+DeQXj(dzS5U>Idf$vE%fXsjq{T~!^xnh@5h@cgu@J+a}?HX%mlAy zm4KToa9&wEuceGAUtW-?+?z+i$qA4Ba1dH)JDq;3&lz{3$V}_GfERdqhie2 zRnY1O0d#G)>E3J>tHNpq4LQLEGH0sJGOF~%9>+m!TxVfrxEvv~s#Zp}_0$MHxWFi& zd6gF6J&}e*9f?e0f*$2C3gFEZ_X2!Dl?wbKBGAy^ycGgKB*0T+Z%GQ zO^oW>hk}I!bzJZTc8)%?;{W>ee9kn0c%2dxSVjM<8JzvA{9kip^Md`yS^3N_7v<#t zkl!na_47x}@;Ur}W{iw3CC?@NmzgUSl6pn{kb(dk!eK2AQM~L{N5g@r4u}(#C2GMu zIKKM`ZC1UmS*HyXq_~yh6$JqF2uM+tgDhp36E2JuMp2Ylt1>JUFKr#fg4>jpBSe&f zP&||$#pfYeQAD)Ne^Vf`DH;UUH@p$_{#2&4UFFB9(XYfkY4f>bWPZO* z5DwXK#lBvMye1n5K zyJ7&PXN!fIT|V~9Op?8`i~P{1lj)L4ut#_8jLLZ&60{Hi5N`k$5GMQhFBN&2st9va z&{OkJ4}V*63=0`I2#}bOb!q2q#ZjzDT+e0J9p9nQX!pwDel25k929D_L_Zmjq}a~U zU4G$@lLPoA!Gz0jFcr)44YDn}P6|JO>Q=Ou<+0M&xw+u&H%_=*8u_rfG+@pHhU&J_ zQr4IbTR?1oT2vnWmf7jNywmF=fx(+1!<&LY=e-=9{>wCAS&cF)2g7V?g9tXv;Hq|& zk4c%X0(Wcgr3Ge^!gNh=9;VSvQsq)@7e?g?R+C3LWi8TiTNv?6LMbcmw9v0(VkhPt z26nJd4&#I=lF(&a({>td72LmIUU_j7=1cM>E8qyPM-o!ZSr8=#ERjkn12!@Xv5GW8 ziOp1oG8!{=eS#1hQVo?WF^S4ZC25Li1$S&NDhDNS>S4z&KyoromWnnl;ZP^xy02Pm zbE`%JOR^YV(y7L3tgx_p!09dF6!g5rYK%d}in~3r&B}2j{I`h9L%5TaQQ+CMLUEhG zZepFdT^hw+8N)3rDaPBwoH1I(xPGQ+YGGnN zYiY(igtZk=y4))iRKWk>;i^c6#aiOwOdWM%nKBY$w_PjEpnBt@t73FI#C#_rVs4gT zwUdA0|GG~prwZb96Bn4VQG)@~G6t9(oyM!OiB2*GlN=~{*}&C*G4 zI`4DxIe$}h6S>pTQ(mcPbUG3tWh*t%di1dhGu0N0XR5^Ou-5|n^9Cj`mnkRX=X&626w>pI z%29tQsWj1DRelB>?4ZwW8uXnzq)KG*9VAVzRges^=L-oVjUeOX;$h|!N!_jmLQrJL z!4Y(-o{u3*qW*x>v)f-(&>WpvNNPk!XC<@>evIuQG(0ed!7H7c!C1Y*#c@^-K|&U-Mf%B`Nt5?{rXvt6nIlFM++8TGz(pgkmub#}O9M7&46`v~{4d1} zytajzB4k&L%2h`xs1zj!W8reMUDlxxbzui~@;I6a6IO)0>0yzu1>(5V9FJq$$rrIz z%oEJ^-m>9mRfW0m&Wb;Tk>2ncazebZWSQ1K;GhI5#%vA<1vp{#UI3~$1Rm7YQC7Y& zaMqQQO6n#6V)dfRzZfs-3*JQOI#MsPCC9+=d)PFJC3%dH9D;D(8Z0d_TGUbXDG71p zvSaqqBO@2jnz&O^MzUxLPo|yL)0K7+2b|W}(gkdIk53jY#TOcS$i%e_#wJpqa@c$T z2M51kxM>kNYRx3CT)I!_@`YWfk0!tfR^aoAdn$_pNt#Q#nl-JwV=dzO|p<6u@|yK4zdAy#orT(@w9X(6>OG_i7fEW*Hq{V?qY7)Ph{ z1{0QsPi>sNVYo-xlU@*weX%*X0eLe7SrPIpr}PZYz?dIufG*LUFM#Mt$*Lm7>EZ&+ zoVKx5rc?}b!7AqXtPD` zHXq>_3W;Kl+L{qg0{v?OUjbnjuu6=6m5}KZDF&yhq=Xol12xdb4!qR<47!5jku*m_AFoc9tKt>YAhHPiZ5tD$TN4~|h0OY|~fgeX4 z?{d454)?sypEZ42wfWPW6R6Bp`G+9@2?;>ADXIPrBww?@885i22i~1~tWoE{Wds>q zr6J@`x6W&g4Iglpc)GY`6zx(z4NMHx`XD_ag_#%VKt4x!#E~@eW*7&| z;?D~DD7l1Wle)ccgtPHlU=sg^nIt3T6|^Ns(4@n0$EF3`IQF(^q z!i_THsS*MzxNyAcQg*xEYzO%Uyy=oroUAO?pqMPVhFu(!O3?=cLLAt(x1J8*+hih5 zR~`FdF8QlfLAl_T> za?cEk%HqN0>4t1qy}2_={sEMfQ*exhy)Ha|`F!N)LW>dV1863b3 z!rx(Q*_dUPi`6sKlH=ufK>(uJ0CPavMs8PS$h{ZOyXBDCtfnee8dYm82kD&pt{C;l zfJ;{VfW?5LU#+uI$Iz(uaJI#hN=(K9o+-~V7lR?Hp&uXN200`6%xE&7?HG5fUD^Cw zwS%Q}(Fpe=z))c*>-X7RTQXVJ09S8o04^;`DBlh|?oGYe?k^Qb!`u7~g3n?a9X+=|oxxio-XGP?O!g(*sNXfwhr9dn|pP408K^Y3G1u&*FBj+V^nHcmyrE1?V=xdx-Ez@JA4!j6%W;@1pipx+8m| zl-X9xi6bZgJ2p9!Ym#Mj6?A|F=4kgfMH>C$yyTOlT}2mIc_dx23@i%fUxXfUUG1os z=%-~Z)n0o1vUYLB4j4dw*~4OdsrnhQ5!MbyRvH?IeiQC%X}ZL#y5CaN=4N;jwMY8I zT%3wFMtBdni6*p%Iv(cV;>E1(9!FOKX$51dWJtMhHf@x+bpqHBas-w}iq&jt8(C3z zf!(ZOMe!0S%%+=N(M1vnS*C?g+9--@%_$jE&g1xP_sbEc&374e3yl~@$ zxbrHFvF_py#_>{L$aBCrUeHGwXN6w@t6eEAK(Q)(wLmJd)fG;@sMU6Q(6JGzSVB51 zu@EpA^b|;|+%%R#u^>Cp(p)cAb=1thiTfkCWv;{o=Bd-mKRzz-RGGXvb7(dO?UdQG zKN{xDg~8(di;!KatWFi~i{#9d^3)YG<-wAfRGiAN@tc!Z5zG%IhS`*oFTF)rm@J0K zdhSP3$i3eIEs=;TD^`YC%BBQOg$PuSnEbC+^GnFt}A-rrSMLF4qL{FhCtMe3u8P(3NVC6@)IZ%1|+EMZ7 zsC0Kx3HTW~W2zo8b2wq?b|1@cMm1C}w*_?aP1D3&Fc|$aKVQHkb$H2*EoZ|^F>P#)Oj7nBzlr{L>Wz&sr~D{3)ozvfU1i(<(`iES;(X*d$xp8!pq_R_&;!YFUyc zN@eY>ptczvUzmZNdBW$VF(6fJyR=3+BN#1F&1r4izJ;nTji9y|{zijB`dfvkB($t` zoSUi_L4#!2-a++un6{p+4VRTSiv^RJNaoUKYsugmuy5U!wNP{xEp2XW(mD|%Z=QG$tI)d^ZBMQ+Vx&@f zmX~5PId`hejU8t}nCE#ytI%prs%71)L%jptF{*n;F0|lKpQ&w7nQnNLT(F8vvS_E7 zOrYrR$&P}P*%`lht5;1t-ONCp#+|2dkFu{kH%H@M?<_9|6gK4|piOZBE#>nFjNmhv zcz`4c7KeSca-_!#@q=NC+EGD@%9*$^O5DEH7F~!EH_jzn%g|wz7DRo>f!?lOX`PoH zdU&(b7@4F4PaUGW?P%vj&t>O2YjSpnJ3cw(O^v>-Pi0>mXpUTegei4No?(dK5YxjEL@6l>XLk7hi-1L0%FW2Poz z2yw%ED=IPfPNXy&^-_`(i7`E5>Utub4oZ$H;RYbPs-(Wk=e6l{ID0aAZjaF4ak%G9 zR3Tf0C3A%WT7t2lLg42C{dJ(yJglR(NF$72TcpXM568*`vOyn2xU}ol#;@z{>nE&W zNb@s9T)9?bAFlHahP?hrgojuq2qO{yupi-&CASx#tqeHIgg}2k$O@{OSQusqgA|dK zK`t6R88J~WIy$vRvsl9{#mB3KW@d*eAIFLtsW{VeZPyz3dK>gNkaEMr5fQ5?&_r4{ zI0$x14gTQ~y#fQ-9474*MNlRVitS;SakTmbrRupvV2j;Yza3DwB%+0-e7PM5Z zd>qt%tJLp@`azl(=TT2xY7MDPX~x7LS&6I$Yz`7t96-keQIA)Saj_Y21pNKohq~fj z9RnTyvfb1nhEzH?X2YgAyV+pm$OV^lsX#q$xpgckk0(&3EQp>D_x2BH)Fzfyj%yJ@ zf|1Kc(P8hJ4O-G7N1yt-JG*jqVGM@3_LRxh9hE)~2GY_=-ZAm?RkWwfFh?nCMz zFaX%Bnq%UR!|6bfn}aT6GmK5P)D0LWq}WIv*!Gq7^{l8PoW~%)ig)%NB=_sKCW~Ii zL)w8O9dVMn505sbD}LcI4((ubUKwNfT)7Q9qKs9VI)by zI2kAa+S@VEeSOCb@t#8i-F+NE2T*yK4VQG;j?CC|(l}H)r>p0YZfV2?hK$hn<4Sj6M`c2S~ z&c2?*17*6)fk-p@Zix2}^z|It>x3ekyD&rBd$4z)JH8Jn4k{u@i5*>CeRhjtY)WFv zoG5}&GOz0e`UDPcIAZlF?uP@gbR2<>-Eg?uf%pg+N-MFmm(0ka0S@Z^>O|d$%HRjO z5A9{!w9+#bJ-bm=qmmE_Ntw0&265`+WbEDCkd!d^B_V(z2r@|i#Qi}yFDJ{ZrYl^q zEI)EOO)Td#+HE-mZEppf>8|{~tBKI{=Ahv1K+*}FxCI834l9@v1bnOghuwM#TLjf9@YbMfR$kSFsu|mc&+&A3^}J`%4?;-0f(LC zQ8brlcJ^sKfu2^WnBJ7f6J2;xxpTQm1q~x+L^khNoj&QRw6C=Hp&xV07pR39qeLkPcAJL3>L5O->TMSnb?xo1lV!Wpe61GgvmfNfa z{P4~Y#k5E|PkG}(ny8dg<-5uWceLZW4#M@uukYT?iyN6SwYW4AN&)cGOMtQ7lkkeG zjsaPQ5R4Go2@dtPHEwGp3@u;fWNneFGBD1LbdPB*gy=zy5Fn z!W%=yHJWBlj)B^ye>yyN!pQqWzLV#A{;TYNiDaI!_|IF~TH5UIzl|*m@&C@sXMPvH zwErP)UDG8BBq}2DxT~NdxbI`l-WT6e$G- zP&B7TuPz(s$2G(cIE6!CcTt`rx{t$65Lk~n{JTOogj1k7b&Quf8=bS}WwxDzn8%4i z(LhCOrg{JYZcNcXt(XHq>YAFl*n%GnTu*6eEP*?dJ=1geY>9gp8<_#wt0)p-Rgad^ zQoX{17HOoz>0FW4LghPw$b_uxfO%N3P9JkGza-p`Q#3Kn)XTiUjF&2B?!&o_cy9fM?vZxvRx;wh; z?#|s_Ys#BxvFBe_zsBP4s1_(yE%#hcE%!3r{1}FEv%|WL{7T4-=waoH)UG;|~V@oMipBz0-M2%Cz>Di;{&24_Xjt$YyH-zGh4-cn! z8W{+eV-k@FkXcz6ZP5-hmcV9#QgwJlMS^O;gQA0A3ovM(65P+SWpP;1xmXgar@g?WPF2oJ+N#qMNS5C=gfB0NPleXaOBR*mfaUwRv>a{s3b`t+WEs@(sZ8=G3} z`u|(EY-wA#|DTP|d|rK(`#%t$vwQy+YZY()Ev@v$r>QyGxLs>(iM2Gxnzj*k#w3@2 zJqsR)&xq)+>K#8E7Ri?4SvX8J%_QBkaM-DR=F}ahPf9L2E=?y0|X1(5(qtRj(L`B&1C_&K1nCc-(`DEEzkv(cr6PR%g+C zGKrZHaz%zXNz!H7?p@lPC~7e+nMOy}bf%^5S@=kECxH1T6PzGNwO;H7MOpEJg=({G z!yvB)8e{~Dnl6$lFDCP0a6OYw%#aB$7D`rBLbEVQmH_x>CF4#N&!8bp@ys&2KF-tz zseT#-hSxGu9)1ukV3bPnaD6>&E`_Eor~cTXFI02P($wL~e5?e^vadkfnzU|Ga8Zh9 zs3AV;<;WJ-)Cw3u1it_K9!=5_IyAe`?C9;LEZV_A z-_CtaySn@Odi!=p$v5B5JX(z2w{LYIs=wtG8G@_FmnJt+#qhmQRnKdB7;{aaPXXA zxuI4fsXpyE55!_{9B$la_9$EMcJd9hA{LF-n;1tynm|L=XE|2h}4CI}vjyZ%E!W>sbhcNFZmSWqWz z@?`pUpgb<{S#Z!+GiHB*U?G((hzJ~oV!qt z%jG6$s685;PECgU23E$w0;*inAw9Gu0Aa9sn`9zHR+gS8l;2a!2AOe*bQs7+CZ^5E zgiG*fxO0d6jwD0#)YvEpOHLH>|DfdtO>LA*cp1jo`jwMPio#;U;O7jp&$;s2aoO## zy|HnLClyeqF`h2v?&!@CfjA2EMn%^eIh9QspUA!=v>h&6!t2EcoS0P~{H(U@Qp_tH z==EbXPr>J54w*7)Mk&X1k(ZzBl}jBA23&4|TWgoLlZ7)ypKX!kcquzUm|{h&U2z_d zvN@EW#IQrbpeq8}S+^W9!Q#cWY~eCTwCgofTwwX_TUZalAjvmp`U8@!b>(^_0f=M~ z+-^HLLVWZsH1^35Ak0=)Sr+tSue??W#$7i0laCiZadamz`Mzwm>>ns3vgW8>u-?tc zer3h{>SA0zm#I1k>ds#39$j#`?c6>8s!3M>@bMK0xW_0+7VNzwhN=Lxp4Y) zPtM|);teaaM{RcoMOuJ|8gDw3fINa8)K)||UF&M4ST1bW^jS$yLT;&c5ENwy)8q zxnU!SgdP)sfP7-Qc#lQnZJ&BuLz7RoI-n-f*8OA&g*#w*!Nzkki4?O`Mk(TRtWmz{ zr7f)F3MD0Pg|%0CX$e&tbdf(PyU16Hq#%NyqSr7PwCT~<@@7A3SU)9QQfYW|?#(PqLf;1PErcMp`CJ zwBZF15pMbe703+> zJf~sgx!DC_@M92$@nR^ux;5g|bV4WW)kC1FEwhm)DG4S(D0hrfdN z;IlTiZf%&`AhYuIR7nr?kSG>(!NkUW)+4P5foC`D!Z{DSk~p-k6a}HmeqCD{n;qN1 zRb$BB1a9etE-~m6n5If?1V7KDIU4r{9$=5WBStnQm4{1+^A*Ni1K`d8EVT%emHTSoqBDQ$_zrw$nUiHK1zt->pqs?Djv+O$+)zXXP`$+Aos+53Zb9 zDFC@@`&3f&u`f!?%t}&N=ka9$Rwz1p?iC0s9bnvF=FuDwq zF*wW4@yUlH;Id3rP9qLl1#mu&TW9zPH)r4uT~BpX<&l_;y5?-=gk8(d^=>@-pDOep zl;KZT{j-|?-{#h>&366Iw#JqP`hPY)^GgmT`hT$JU^iZ|=h5!F(xJdtDjo(~ESv8p zwE1p|H8!4Mn{U#P?&)G7k%W6H+EsPr6UlKfB*eDyvCszK1~tk90Tps-a-SV1#Jh(K zTOq3#wG5$`2|9N8d}%r)+Q7i0-ik5F&9;QGV!#YWG_7ApqkF}>u7%erA16&RGQhtl zP>B(8XS9iIZb};`{}FIXKp8$t+L_fL_v}Ku&)S_#kc+fIvJ2XX4zCkrP{xy9NJl#lPD^xC)yaw{9gP2X|o?d{jvc?uUgL7%ehkJK147H8mA664^u~ zR~UI&yR9y`1<=tcKq8+{8}#IjCSXTQh2iQ|^oIyYqDU5$ z9f+iDp3bBZVEp*BJwKC3hRJPoT%T@jM3`j0=mvv6Ig`bFA%{?4IF?B}0U=dXm&zp_ z5GJVAVlJuGo|_~4q8KKlrzbKL1IimK!=%R()nQJISB251^{Oz*G?}`pP-d=r$I_0$ zbLsq8RhV4L+4)q0W{o+EkBwngJ~e93B1v=&8IBxq;*%^GdAi8-ykh`t5LE#R&gw~$ zST<(H(FT$v@*D#vGRF!D$ND!5VEeN3$lgDY6mi$V`_U#W6c~!bqnR z5t1!1O{X10fS_hrpHAu&Chy#53?>h{Z26p#WuxWj6TlU+VX_F)NIej2YQ&{~06CS& zM=+CuWzvpKDWFIm2Qn)`(Yd6slWx`KjHEs-QG$_V-f(P+=`bc!EXkBJI|*u@6Lhr3 z9K?d;kLxBGuCXj5Ty9l}8j_}i1dv>FoNl#b!I{a;9w~%T6=J$7#H3?k6NpKJuI#*H z7^lOdC2~8_Nmhb2bPO0#2NhvcN}liVN9l-bLlPoosdATr5KX6hHB#~yi%`Bf+@-J|Et^klB zfT}>aWEXOybe@WCEf=})rBZ$-;X=JIJDg#wH{)PF1cXijTy`D6khlCOwy>6(#gDaq+j16b@%)|W##F~j6Yd^ z#cZ-&<$Us!@n|EEOwPCrnTRx$OpVYDJ#)gALsIB5o59I5GKn!gN`6ohG?uXv$q#yt z(1D?eV~oQwbSaVipcJ3<)Ji?ZNA_6WJymx}&1WUpe0Ge{3n`KOu*ebff9A|7vRR`! zMLsn}!!0#+Y_en}1M>nYJgZF3lrn-A_r!*>kT9)W!aZb4VUkqT>Had3IXRd7%(Cuh zC1@P%cJS{X&gM2tyofFC^7nOHO@MIu=nVG|4&AyjY}^_or2 z{tF<9>lar8w@mqlD7BrO|GH>hQ3 z$0sPh<^(z@SkTF}+?XWoCgKtN4vF2?(pr#ZO)gbqYKM}7zy?DzcvEb6b1aI@+)P_3 zX}MZH6r9#F!v6(Tg`MS_zT5g>TDMKZf6njubNy61{|TWo&#?YiYipZ5{zp@D+k*f1 zv+|kW^G-VbL1P$K&+L!?J&6$`ryaCZw&tuEW?!y&@;BKu!y328+RlPz7&^=~P@6ho zg$4|Rm$;N>6m@bn%N1hO&a5~d&+CPJ33QK(geXE0B;PPBGt`QhoX0vU?&=A0kaK;e z2_20}i)bwB^`Z?aREZDs;EIrSu16`Pp3GD%@;>}Wpb4WJ?3{ZuE zQzB1mPbWxA$Y~(}EN8RyP@_IT!E=vPpg5I-Y{LbqR}Zi*28j=;+1hZUd|J7HHi z^grt~78ZIt3APcqlWfA;bGktHbOLMyzj@L5>(2aKli_3s=**95tIo zmt17g!@>eOC{X7LieDb)TgmQo9(Z%%BL$5lEYIT7ok92mX5MtrB$ye!QL6~&n9|h< z7yzp_m>;GqZd~z^!~NgoT|InRM%5Hf@%sv!OS!c$U*#McFCmdl(IBk)Fm5s7^Vhkz znpBf`f;fmaZt#U!h+6(soW<>BH#b?15spXrth8(6Wt4X1vzVOSbRL*(BaR=;Cz{}4 z9&UKq(Sy^id&P@EnThA~%ch;Tht%!rv)8&|j62--{vYw^I=4?1{@)7YbsAd0)#QIo zZT9#tjSKR>v-Fu?rq{;*10k6m|37C=UtO581&9^muQArtcqT*qIjleEc}i$;NXuKq zF0artQ`l_h+uQwRXdQ=DI37a%k=u!0#rYkuFL!T5Ic|WqFhp+!x=R%1Q$0U5X5+tb zfX>?iDuqz|6FEN5HL+XxI6hU*ejo;y-S6#(!&V*}8E4pN-G_9*ENUKWP+- zB_JKJfX)mL;8>jJiVbj(ZZ$e?fc~uZv|*823a<^?%{PaE@bXMQM8i7m+e(%F&pUKl zCV*A;|JKIFRy+T{VE=uVKJ&U0R0@ERqv%^V+qL^xYypf70fKq%QlH6!si!g~GU`OX z7f|d7q;>A?IZ#SaSII?mqONE1pa4$Tn=ue?u{!#7oo_=adOb>y)PUqEy_hi4W~3rb znm4rsX(J((vPY+AZi%&?@ka^L9=q;=o34QrpMp$*OZZ6^$K29xpsv`QfU*q8CEFJE z90uzknH9yr&oH%oX(VkVH63K8sE#1sFA`bJANTv>oxO)|=%U|_u84$RzxQ=d)pg_P3YG~Xq`_JRvSLw;0!aU2}8Y|0v#8@c!8P8KKk8Y$u1cr~g z*y0W1IuZ;Pp(Gz>G(*#@i;}<-kYIxpjtb(-mS8~WtcHFRCt$V~%1*#E>EnV}jzX_C zORh-4f`J+WevJO1(Fh@oN=4B46o(rq0K5leClhHSr8PiZ4b(Md#4jP2dPHY|-=488 zG%|~ALIRlT;zUtyBu8_Lg@<`^<`8Ug5Rx?^Ee?hoF8Tl@EvrF*M8D^@b;6PIf4Pc> zRg^zR%r7a#!vbQX!u~2jum;?r^Ine>>4sDkXVpMp3v>;o5(koc#(LYw-CN-UFQsbA znRw>94kvzq)1Ed0mIxw7#?$6PmvSf$mqFJQ8~9k^Noh}zz|^p#$<&o zE{hHnJ2Wh}w(7!C4yAN1fzBhWlL?g#2~1F-)C%zmsBBKP?DOr zI;zNj+FBcJ_8(1c&20<*pU%o>0~Js3Ij5mBTb%Bbnzz|)C48N|hxYXBZPy}9&f@bK z*<`wu(zT5Nniur>2IBn#9eo23Tre3e#@QO92L~K1zM~!2bsQS#mcg7r1M!|iJq{$~ zprF}SrX#Df_vqoyjspkc2aa^~YZQow(-dD2vcKb+j-xV|nK+i1rhk=|0*F#uG&yDv z07($7=2}uHIhn@`cVtN6g&lb!#;NA!rA@11x}}v7?P?XDe6&gqLACPQB3dOyaxt28 zrD*MChRk<;_ii%ULaTO98{8}3*lNf24HChV`N9rB}{I7 zAX*B8(CpTs!J$F2n09yccegbS4G#@t%Ekami+A<(1u@Al1NZE91t#gP@bVZ-MdW1H zO5)u|2L!yCD~p%RjSE_m%CYXWI?P-AcjR4VF~K)0SPX zpdg0~gF-qTcqHhu2yt66Y!-QSqGE7m@vt4nFv)b-iA%t`Vk3K&VF9`lbmo;S6(w|m zl?0OGC`t3nmL_z9l?GzsEDiZSMmE$H!HI!uV$~^g0dzxCexmFkZlx&pi`Hrc4%WV_!0@C$ce0c}HDN z0G`ecq;t)MpSw?m`(I?r$j(b0)$V`Itv36=rY$6K;r@3vKDPTG%(-PQU-b&eFMNz& zCxz7;-_Y!Cd_xs)d_$FPd_%Lj@eT3QZ>ZvpZwSx0p$a!XUfYoCjnB$eZhRuye&Z7v zE;l}rr`-5Ns(j-UiEcMO6~J~0Q!;J$L6Poy9~8N6_d$`V-UnT;d@f^VUHOLOE8mdg z$~ROphtw+{q}Z=~kY>B`L6UmqgA~^*-w@%xUacgYAQZ(*1CFc({F-lpgYV zy=5`*E29GgyEM)Qi9B%%9)-)9Wpm(iNs%-R4yMxS;o*i^R!`Q2Ywf^!sFiDercn_* z%{%C6&!EhMxi%gvs@D4QcUkGu(6dK7)H|ScA0;;nnY*N{oP3ig11YGZqsWkS&&cIx zD%~_B&~nw_)^pauFCnx7_iG3TDu;TS>z>(>3ub>$Z=Y6gXg!CtfbFgl)Vg{#texb$ z;8Yn~mwO0XGYj)@hUdXvt91Vp6{^=p+LcNdM<-TQN@nknYwqlD3_0(Mwg#5DMq1TO zV}WQl97v9!|$TK|k$)H4mHmNrHT3Gh-OX+Z?0FyP0Ckxih73l5RM5FW_2=&7L3;zirFXvr)@ zQL!aT;G^U+5N(SzsWp`n&N@IRw_*i$?BHr!cg3$y>&X&oB$e+=uAot$mIl2Odp|%-KaThh0eKG8s@T!2nwZ#30ER2u#6eV?yl+p(B7)XrfTvGpYTc zH-=jGglLyAIElE8?dv_*tsoR~+6`P`8t&ExsOnLbY`Cua_IDpX(A~#w>CV#5mst5W zP40dc!G{I}qxK7;3kWPypL7JdfS~Y?DS@?v7Pjy3{=Js|S$JbWXoztEJRl)JK_7qL z;Rz8!7$RdQeEeBQq@OVIe=;XhS^7V3(!W{I|K>J3{cqdaxiSg&n&ICs+%8Dui#@}Pm|aSlvQZF%&*H0 znImlfAOH?}l7=zrsa{r6e#Bq&e>M z;q!7>7)9g?#+Wv|gR6;WCY21P@&|9qdU8Cc`3DL!7;iAAQSv#HD_Im0NM0lo@na=Z z<3@5E2)e*czQ;)`+HV$FH(RNoB-4H~_ZhsArQYmgc2&-@ZB4T%4Go7M;C9TJ52bEq zBeIc$Y3tD?oi!x1<3P>9&12Sr^oz{S@dQ|>^6`QURBJNmC{pz%i+jFRpt#k~hnS-} zl$+8DrL5Kf7H18pfR11JC^z`|kXY>kRsT^4%p2m75czvN zY{i)LeMI^WVUwU!svnW2?c29$`}C=_UMz+WgIA713Z(~$?2N}l`;4E}Ft!>QVFN1CL8s+c*;56mt7_KRzA&T1}t%t~{E%iZhoYMGmH|CnGSR;!_o179Xj;2%rV@f=g-FkyQrwgw9+xWl+Z_*>aP3ip6Xnx~|D*&D;OrSsRadF8IP) zPu+h$=2^66xu>JRMrNSi5 zgKg8ybJiVR)&kdfNJW0>EC*vu2raZTL zUg){qbEoI!p4WKZ;CYMZ?VkHQ_j}&&dC2n-&nG?q<>h7((zwY6>&(wXn?#a5J*8OJDl0|D4X^X;(b}ZVr=*XhvqT`F6 zx9BB{-mvIhiymC`=%Oz#`re|a7yV)J%EjvzZ(bZ*+_U)T;<3e3i*H|i*W!09{@~(I zFaGM{rxyQm$&w`(EooS?b;-UZH!L}}E@;F zOM90lmKK-ZzV!7=-@EkVOTV=AsinVOwtU$Y%bJ(%S$5;H?6MavyKC9Imwjy6mzMo- z+3&m;ckbme_3Keh6^D}R07n)4#(^_-VF@A>E5ecprTed)ZPo$o!r{``*fZ#w_P z`FEZFf%Cs`{!cIPUU20Fofjl7c-{qfU-01zzJ9?otJbV)TGhKMv+5FO(2cdt&ZzHRl}R)1>s57yMJ*|4T_O>)g&taagY@rsQHH{QDOJsZDS@2%ffKVJXZ`p?w=>dJ;I zufOuIu6*dqA2nRu(9>|D;XMuC4y+7Z6*wNaH}I90){ z({`}!ui74I``;~Fw-mPAzvahUH*URo>l?RzecRe?hqt|C+h?~g-oAVL^S6Iw`)^`f zV#V0|WB;`yykla=yLbF(XTwf?=i7Jwpxxh|XuqfZ$z9s6n|Hl+*OOPRzbbLny;ptz z>J3+?u71bWKkNv09P4;*$Io^*?k?>9;O<{_#yU@Sexj?cYj4*bU5|IK?mp7}hVJj~ z@$VVi^PW9V?`_+A%id4yTfA@ozE|w~de3D&$)5Xqp1x-5H7BombpML|{rlgr|N93v z9Vi@l_+ah9YYx8Z;I|LeAIctjsMpim)BCF4?;LJ8eEje~Uc2Pl!`I$@?Z5Xm_1)U{ znf^8X@&0%B|8ijWz{>`{btG`4bmWoi&cANxy8EvC)%9K1zw-Jgk4BH4Jo@j12-?e`TCpR zee>@Vy@`7h&y4hpym92|WM}fV$)BXIPQ5zyW4&E}rT)Xw_R&|4{%EXy>{Vkw9=~e* zuJNB5oyHrCpC8+I>@CNBHPJiq&WUH!*QX!IEX&-S`EYi1b|U*|?(*Dp?uq>7{O$QC zkH?O`=J?Zv{e^d!HRiDSq2gM?Og&Z#l>V~xy~$mZcTfI$>bj{9Os|^GPCquYY39W< zKRmJL#NXbs=$7OykKDTc))(ITy^|d$?|EL$^G2Tc$n!Tm|F-8p^@6=Gc-ISkFPwPc zzr3jNMX!9(|NO=EfAR2bm)-V)+kWtud;ju1x1V==;r6fp)sDY<%U>`0YvZpUe{su; zU;pAi+>yHDpYLqE^R7F8|B~cO{`qg3{^oUm^XyAUU;6mVw!G}kFJJQV?90FQimP7n zu2-&l<%w7R;8h1-_28?uSKsmK|9MUPHJ`hy^{%(P*7w@dYoC1Gf!BTL^&4OR^4I_V z4dZY4>fO8Ve&CJk-uU7-{_0JsH+|{NSHJoGw_Ns?JKyr#w;FH##yxxQdGOvV@4f47 zOWrp5wts*7b#MR7-){Tc``&TsJMMhP|GqQ(&L`j1_pV3p+j`%9?_T%rm%XRzs{oRM|58r>!0~bAT=leYGE4}YO{{H5_|JwWazyFaBZ2Q3d|4{!AZ~Wkz z58m-$&4V)!KK;=6Lr;F_h7UdQ;cGtp$iq7x{@_1G{_&k3S^tr{KYHOuU-mKI$8P)B zvmZb4@n=4f|HMx}IrhmPJQ9E8Tc0}msjobG?W2!>djF?C`%ioR=~JKS_{_&Y+y2>) zd@lC65C8MFe}3rmTR#8bV{MOp@L$^g<%5rJdHlgIZ2iKAzPSC14?nTQet6%H znt$|>AMg3`7yo1MKc4zY{wKft>Fxiy>ObH3v%t^(;lHl_ug9J~`t(yjFZ}%3|9;6Y zF8Ref|EKkT9(m^QGvEDX=9jis=C{}X_J_Zl`u)=1zwUp7|NHPC z_W$AA&t{%|_StWFIz7vlELpl_@iKBUdA-YgE7q=Dv3&W8OIEKrf9++LUUB(lm#$l< zZHzQ%{?LYX>jGPYp~j}x*48T;wzqF<-Wh3WZ3ZMYUaxn>@)Z}aTzPRbA(qW^{yh5$ z&#GmfK2Nr;#_y?JRa3XB=GjL*>j+P?816yhv&2)kXz|jTWwj)??E+6tU0q%6;@ZV^ zi|UX8s;yh(S-fh=`li(#OV{|XO{{(4hUVSJ?-_Z;-(Pr9-xDo`Pm*Gn)_Ce_6r{A+ z5|X!Jm8Z70W>IZzot(L9(dzY09oH^i(|r7%XTRxLQCCBnShvb^mFJ%4{o)-DT)*Y1 z&(HjS_PztIiLC2;l2C&{Xo`w3M0)Q%2!t+DLX)BpLVzfckOTn*4NVjk0ck2C2(F-r zps3gZ5wW14V4=9kVs}>r3$BH4CJ6|*tB?Ec=kxx)&$}C$%-nO%y?4%>Ip^No^KUyW z9pfkbK;gwP+>_q3=aOeTZy(uB<0YZN&7`@#+dK?;b35m~8r+e0EQmmpZgtLDr+ZCD zWyvPbk-g5xlfbo(mvcuLC)W)j_M7T2zN}iaE$!K!Astpv=5wDRJuYjugt8$s^@0gD@9eDGSd(HJ$}-< z)~#=F>+9G7j9r(j$K9_@O!f8X<{z|j8gdGw{2+hZ$YNnNb>k}ZCb7PE(SY0btz#c#^+%VT>Nq_nSbuX4 zE^yR%uFKxV>koMq;#4o1myB6<vQI@A;W!>PxJ4F1#LF>zi}g z`o)g@^%SQ!%lxaNoWu_v7C&nGsJP+sb;P2ZwdKH$XPfZCg)+X*5+@9m^?Ggdj@=-n zrIlGIE+oFG-rAz>5>5^Bef^X;sF#+y`L`0j6)#$@l(+le4K%$Rk*-M8l*!+>Fy_6F zw-Nc)v)HVR-K#wX+&^4GSest@*zigHxR8bxO7KeEiItl_Hm~s3)a`P=gBAp3B+fkq zMHXeAt{+>&_mU(&4$S4VaxU`ok<24)d+t{I`?Az%*P0FUm({5sKDuz$$=yydsA437 z-=gG$M|*Q1PHyj}$62=V2U!I-OnQmV52a*Ag#1sNANLzH)?%mzwp6JTPHsv@^GENh zq`KcbNVr$fwe+%HPmuGbEhE)K`En(_gWJyPoS`KuS;R;mK3lEcRY(w(<4di%9dR-% zIJ&QS(7EWb=Y3^)hb^qWnBv6SN{u~>Sy}Co<3Pf_lJvQ+l_ZwDJ7k%yBO0n4b>de8 zr>gq;fD2De#{rjY@$(d|OHT!DFs6-i2ez>G92Bg$b8|MWpfA?-Y+fOuM%I^4qs8$WTzOT2h}a_$&3!%l1hBMQ;5X zw*o?zEk-9Es&T$mot;ulG1`ea?uQbFFDv`;z@jZC&U>EH0_pB6#^Ov14(}v29T$7rWUl?^iea@~e08UU=euM+ zxKD1i4hiZu`R(IEfl;H#l7wqkm31HH7PYi?Y7urv_3@s({O95|#m}v;bstr@SylE{ zFS_B;o$IW^^#QBdB>Mh?}e2bZ^Hy?5;!U?(aAL;&XjRNa%VQCNqCEpKJH_ zUl%^@_Z-^W=9DfKJ`T*gWs_^~>YM@m_U@o}H^N<^A^li|dWsI^{#xPKk-AjiM8uP= z_wG_$O%*H7b#^&e5iWfwFOIoX{!qiHU-l-SsO(zSt{oW?f?Qlnx{ZBEb~ zGV0Yhu~qxZr6*1N{1&-Ml`B0~c-gEX9of!2*-I9?p?~9Sd7tn`=@2ByygDQVsxP7sSRr!kQ#c`;2>owv$w3Jq&#_P&Ddj0Qj`Dl^sTdH zucTW_H5>1m?dhs8EPn8b*?^;|;e*PPXG3WfwSV?B({l4kQbwYgzIPTQE~#bTqZ6K7 zTl*oi@s;u7&CH0BlA_bCiEFo7UD=WMsN3s?a%xVu--kuwrGa^v7lCoQ+ip3yCM8$7 zt}uDDPJdya_sSbfXq{&>pZ4Y}xSm;&EUdOw%F*jwM^BdiH~?8droX_H?C(F&-Y@Jj zqVo{htE{+i93a-2URbpzd+6T$hB$=|tgzjRn+2M0j^#-{x?1W<&oUv? zi@1uyS9(#c3-ur9<&`ax>UR6IUvzoJ)<59vZA&g$y!y1Lu-^>Bea+1SSFb+k=y=rC^`yW5kD;NV zfq@s#pFbZO8hQTw^((l%`}FD4e|v1dyQnCR#X&*xxWJ#{fR4{toEP-TMtqDjh5in= zN&y|vN5Nta01SLwH$h_p)%BJeiyQOd&;o!2AkD-1z`x?bKp*&66yVI)oA64oKP)cY zgv@N{`=%P-M3^4n*5wbsA2)Ff%XEhV<}uSb00wRYR4kwiUJxBzYRAQa!Uw*Il@O0{ zZi#fobL&a~UR*v_(Dw)gB;#(wB?ag^NKQ=$z!vr*Q!s805DD>v+XvTkggzjGLw5%$ z&i)v@=d@dz+iqLvyQ?v$-2#9lAdUFk?y2Qfvn>z>@v~@<0%D-Q_Zf}=Ob^Rgex7qp z{vCUX0)W>E0r;7)5*Pz2)s~&lz$|nwcC6cTVUws+o{Idiee!(U zwbHfL6&cCmHfh;+Kps-FEGTLzK(k`C?=WHvO42|UZ=oQLCK++QQ50)qDLLFh$BNF? zA}~9wyzv>5TC`#5keA5zou;w(`l|E+G&WGRM2AMQM~E-sZM7>(wFXLp&p&NHRT#PS zoXJYQ2o@^JS}5+q9}DKQ@OC){0-qYhB+51%GFzGZ`at36V2KdZ>U8yq@Qn310WUuP zJsH+D^TpSFI@RzdvIG$tTx~VVdI-#wego=yI3jY1EKf?t_x2?v08kU);XztZZutSy8VYGE-v}CPqt5^2V9OGSULTNbD^s)} zx=E~afT}yo>pZXUE6K*Jap5|v)yer6JNWVGjvYecJuQHU%Pn`*Hh24tsk2O7IsyRE z4L&+$n02}N$mN0QISY+tp%Ls;<+sA8w6Vb>g2^2`3G z`>P4eRD`np_=A2cB@9i{S}83!MNrxCO)|gi=?ncBE%!!XBfm~CViwYAhZ-aV_}#-M zKDgNm7tf*`;QyH2$e7o&y>z2ij=PnBZi3Evt8!Td9wCwEMP(&}S&Dap)lF7rV}wlJ zVwdA^V2Y$4pC(}UvWEn7zS)4uVKJMyrKtsdJMnK*y`+m3$vZ$gH$ph*VPWT?o|v_Q&bbdpCJdhQ$&6suHHbq(&_g?0CTvkZcom=1u8V7*57)F6B{nY(l%%(w`%f5jMdr z(SfbrTMrC~Iu0Nj1X@sMu+4{@ty0VTf&(PWlKF&#o7eL+InTr2YGtKbR@SVPJKHJU9UCa$J}ybtH@+m8 zjzn|`M>G~>j0N*bxbGg{;XCj5?kER=A{M%$=x{1eCDT?vz^yVhN3MlzvOvQsG;2fZ za71-je2Qy3&nVC@lg5vt4envKvKH!9sA!rZdap{Uf7Ead%jNmC(^+4;b~qah^bi?E z{?y)_Pu1&qHb8#WVNa^S-^GxX^2G%`5gB- z4FY6am0KumHo}IlOjUJEH9)-{vz%DLudUf8lCpEI*)als?1ATtd$-Ogy~#=t99g!6 zk99Te1Hf~6?*_-342%-;m66wlC#g9Fg(+tBo+b5FI-`04H2Zj~8p$TSW#et<^wKg> zk88I;rS7aZ4i3>#ZK8ua)#ghIVl6RETj`a~8$DbQ3$oR1JEWTOq*VnhI;^+Rvr%%P zk_9zpg}lPet)d-ctde3qo9MNn|oGanODA}~wep7$|aG>q3h^=`bKmUX1~ zk;@~q-gnmy%*z)(yzvqL;YhxB^2z+XHX*4)Pg^JjR|Lbd`>YlH_-$%}4RBVPvAcjx zV3Bo!;7D22b{3EE9Rus7wWPbD)re6%xG~%cpIqFCLdqjDH#QOq1>|>#ytF=zHInV~ zKSodl8{;bDcdPXPOJ&Dcgx^Ui$A`R8+od9aJI_>25uGxj#>;i0#n+0>_gddgA5Sje4}L%I zL?a6sv12doWd+XGV}SSEZ2xY)o|VHV)2{FW)}lI(vuEGoHGhTN=N;F=k^P(>mx9SA)&%$CpPb{1 zS~gd#2x9DV$@0+AJ=SLCG=j)gc*#STvw8E&A0aU}+OsyEc=|#%BUP}kQz3QKG~_GSU*0Q2!Itc%2IxIrA>av!?R(fPtxKQ51dci zZ7Y$+dWT~OfESnW%G^M8`lh8RXB$=v417oyh-%&(uA9ND!&+^wP;g~#=s2DSmm`XGbP4I)qI!8Z9<{*%o;t@U#hMKPH5xou`xm^}U*R`fjB1+fQB6lRug6$e z1+Bi}M=~%&3^3<-7!i|!;m=?3*oS0IU>3&|?SJj=UsZ^A^(`Fhh%*izATebc`P8`W(e_<`3D07wcEl zM`SO1qiaJ~#x#Y-f!@)M62Nto7*R3`r@Kz5GvZC1kGX)=Db%7rBpiq80J$+HO3cl_ zVNT2j%xy_*h=FV{ueaKm$8!&c01crtfLbEYW15Z3YDsOlFMWMJ&uUR3pb?Jo8S(yY zFvIi#?zLA?EJ?fZHfwO4B&R`2LDsFr=m*a8$tY+@-&rYZ`g(rgg#|XCnoym~@a>FL zUXM-p7nPIDG}gxm)dKX2G{R#Ow64vIW0+s0U6Jkqls0J%B#)$`{{T|vx&qJd$CJn} zz0gE)Ulp-U;q&_(c_Q|0bgK*?TW^W41D1&K%&P^?CIcd1vh9FxL4)qw49rD7F*#Zq zzr0U^xbcvQCs}OE%{GuMpKM5TCT;L<@07rX$tk<1qD|b9ep!ULtOz^V%zQjD%tfLZ zi!U{a$e+W@Cs~rGkBiUYe_)Vt!4R)vR{v5(tQ4V!K^^qPblx;vzt@$IMwYBY9e0$y z7O~n*Wy`wqtV83B?>M_ ztZ7I;(z#wjZTC%|MZZ24_s!UiYC`GXkKb}JeP@?MSryr)wu~v5_!zvsNVSe=6f!`@ao!^=8ih=@{z# zod5d~#X^w{N6p3YgOfU8VXWxSc;K;-ObRVBK_y-TOi=v{I2sSCfeDj{+?-^3@OEGo z)z9C_@oY>c73>5Pti~iiPC8p|58s zr}-AzlLLpg(B_P@MF=%C0Uk+8G`wLD2Cl+k;a{<1+0Dm6EdnW_>_2R2IIJEPWKdQ^ z2l`luPVFnC2^`XdNmBi3q`0q;uI7-go+O<{IgKnNmdS)M2RVeK2r_BqBo&@(?Z}Ys z3sR#YMI^1nVW-_Y^9el+BStdF<`8=eZO)iLL&Vm||Mrvo&&uDe|8Ns;{wp%RW&icQ z$p2xaqxWQJ6CukGl-qCBO^{~bF zx2VI3Jm5^8?7iy|FxV_HoU8#_Ky9W*hg(`G;y_NWUoOxbWTh!^3J?{nryaq^ju7PO zX7A-|O|ZkNg3!xJn@fj=(`1E^q1P89mP8^m7-6xIkqJ{a#8bIjt{LoHBw7|Bbasn5 zf9&bhC~$HYJ&6c|pi$!(WcFLbf(S;?$zeDwoNRpx>C*sYr&orYB__;x62u;g z{3pn`Ai^9#SH&+a$}|Hs-S&i7;;E2ZLy3mH8^|75noW2Tig3eJ;$ht6Xi6k^<^T?% zb=mmq?8A6a9sbI(CU)^O$Qglb)I{vA3rU6@JB|^gTe4ee!3^cFjtAGmyf_#;oUTHl zrAj~m7!nTe{H5ctbaE(m*)mnG088$`Sd(Bd=1D1#KN+vc<*m)+jJP(F?E!J6Pj|ea zF56S-Q6L*(9`aGyokm-P!RMmbptLwFjmm%mVj_FOVTx0S_GWM=7tBCzB+Q9@;hTU3 zqlod57g^oXwYdaH<+ezt9*^kwCI}=8xlofP6piW zY~X6<%vy9Zq&Jh52<&h0(7@fbMEk&}8D=2dFLt&j_HceyN9cuu#VT5AfD;{-J`yWVgBY6EI2@u^^xD)I= zyzM-_f|l5MIl9??mw@S{Uy%Xl`+^44-tD{CPf~r0vlqeI)zbyKZ{OGa8MI%!19*ay zyVpO^*Uxlc;SLQV!7s?ui{Rwy@LlYu5`Og#FL7fhxAgoz{h31dZSK~#wuFDe9j5y> z_wUyIDRf`qZtV?gfS>#K-PK8|Z@1eUdItYVyJ5O-b9b_}bNxrd!Y2F*f4m!H{9L`h ze`ux>{s;VB>|7nZ9RHC74(S&%zI1OaZHY|sbRP}}QW;vI&}kLbzj~QEMG?cvT#pbY z<4*tKu+y?tVZS7_rO>%)f)l0-gwsUAX%|7*Rfr5@XmLVSCXA1v!hNly!Kn@()`>}` z6PfUAAr*eJW3{wGwY0Dtj#${Wh2vT_W-BF{%@X3J5~>PEw^P|DMTanG=2QQLII#iP zJ~Lyx$Wz>v|0{E3Q{q1uJ@sGWI=y^<{x>~iy`TBten^>d|0m`E{#6$ta;m`a3 zBg)_0|IcWA|ALHf%>U@?8_t~nHPZk2`;Q+}H2>X#*3_I#Oh1uF{BuHiEi|WwSH#S# zq2w@1G?~F(;F_Q(N3WvLsqDEPm?=tcAew#fS@x7+{2R$? ze=T|n;Y_h1LT{t-IY_4P#48aB zR}>kO3dk18F)XkY6$TWmF}ODdWXsV2*|DA$yz~bVv)cj<8}z@bDl7vEYgEybU4Rvu zqk)`|5*}-|afR+Ubi>&~pkosq6CLh|v;W~5G)GQN4g?4pGW(@{igljS!Vcu z6FA`is*G>_{!7=;;7kAir~mgu$_)H>_B+*N68%X>AJo$~)73LGobgUYd*MKi>aan8 z&}bMSh#92d#X)Cx!GYXE8z)yiJPrm^(j#%OTs^(*?VXmYa&WU@gijY38kAj+4a*FD zXP<^KK-pLsY>bS+fWXga*n!Iem$A=GL5GD;VW(D}0KT44nG1XUMSU)w9Sl!2g<{It zzZ3z3Sx;7HP`{`$<>fnt>ogcu4v7V)%N&Gi7xqAKhQy3Bc3LDDj2e%J#|m%nV(s9m z3Tjd(2X3;`Bp&q4krm{?zG^~uZ=zQOH#c~YNwmqjQ$YQuQ%r}`rG1t={n8|)D?JKE zl9|zj|F*9GEMJxx_MfXp|E`R0*nd5EZfJ)6*ZqnA`eTZ=8d`1Ac&NcnC**@Mxj`$F z3Pp&J&j&?pu!{6DmQI93Ghp@5VOg#)2f zP$e=V%!)}Sh0}>)TC`Y_CY?gn3W2=f|HIz1Ku1+%S^a~~$C&UFF)*Dbk!}o~bRc{Z zBA+CLumJ*r5#-Z$I-PV&r@QG-0NFsGi6llapsf59g0i#B$SUKPL5^XAhTkBIGQ+yd z4!YnZ!m?r15f>zTZ&kg1uO9)FaoydsJgC&Wb#L8!>-%oqdi`oJP%Vb(ou7x7X)>E& zff(?(ogQ5YEQ_5wgCC=tWG=9~(GgF*0jTOCrwi6R9^V3;)#dk4RTS>ASgQ8hA$qN91ly9{DCr%B2RKTOEC?PfXBjDd7NdsvS6jxfF~pj z)|IE?A$~fyF&a%#YD1SB^qd$i`G776%l`^olG_~6;l`(w&6$_8bgo;U>NaNceFK9# z$DEz*e&``IlbKD6Tx~fO_JGY$Zp>!3FTUzx%gM=~IsxW=pWV73TeRFkYRb@Hsy@|b z%nlQ~b8<4$jj+`51_LPFFlerO5O8znq-X1JO;jyWdak=Vd#)Q40|wQR1umy0X2n51 zP;Pfb!FgrmKxw>ow*jzvUnww(ib@--tAwGZ!*pEX@Y5A5Jy5^UBuvlpoSZ2$i;Be3 zmvg0{0qj0ss-AY#Ec9~V$ySt?o|n@L1RfuV}_PO=%FFJ%*xGX;ve2iBx=l z##3&9TVv{6Sa!|T8*_4?>F`)EFD&F-kV%)${u{Gt?}2|*_iB9h2VlYKbQ|!->Z`D& za;@OLYRg?PD_OZEF_8@ zogp?MtxgT-e515-sM9><1m zmMW{u4qRY{!LmUPK~Fx~oG{vS&e5nb#4zf_=89}DlmQig`v%cri_pq;&ND_TFIL-4 zrL*D1v!^<5O-w5>l2$s3s|9KNXG`hXT`z%U&;Ni$V%7gh?*H5R|1-=(<^F$&?>_&3 ziVFree@@~_==2m=Hl(oIF*huC>=yg%UaOD$=O99_^T6=iWLM$QhpC_4FcL!?Ln z=Pc#8TnPq|2C)o&hbQPNqi=1(ERtsA6nT;j3Bh^3$X+TtWfx@@TPyJ8cQ-xc5=n%S^{Y=IG`~*RJ#C zaSC2BK!g;+(m7qkv&s?he6@^tQK*>-mC7`KADQL|ndTd0nj>VI1)1y>4RNc4c|5s0 zl>JajXDD+)-vA2_EFz=G7V-!@aY@cO%8y8nXuycmhG}L=!c7>sJQWcKBNt6Ah|CHJ zEGxfgzw(qz#(^$kGl7>N?76is_Cil8hFUjZO{LOGH-_I+p(jY^u(wj2?4(xO^XSbo zdOT_PrEE@%kqLdV*D2x z%V!kxNJOIq)~1*cDbRIm^q5EjrUd@bocpt#P+0~GKPNhs9g+%zOK%kFP1yXxpP_{B zVWfNLOTTt^l|e5gvlo9QEfyYfseF7ISu>%n3Ik;_WXd#)4HSOQ9#8lR41wXMm$Zs) z0n95V8*d(I#f3+%kskPZ+tQiE(g|!MxJKx1=DM4W-%|^-F?{SSHNf>V9P~6?;W>h9 zGC%GZE@3+v!gLm1pn-a?@WEjzr?!-X!#r#Sjle9|Pvc@6{rnrfmisgk(raR}d-}@k)r20iTRG z2!{a1(2dK$U;ugp$i|=pSSP_vJ0B?PsxE~5X)w2?xypvXk}h4Lyn9pQ4Yyxlnuoc*F8#6XDcLN_CiKZ1Zw(vQQ3I4q2n z%?bwp6@+11)LN92K<*>Lk$u}ZUeDoCJbxaC&v5)~4u8e*_%7Z^3BUOqpTY51p&RQ2 zd>on1@sDwS!Y88shSN)r4%Fcvi>0E{FJZ3}@Wuwm5?C){U6*vghLKM$t*3H2Zl zOW{-tI>-of)ez<^BIS#G&VZeuABa$Q6eXltENEDQL=?g$qT7TNfccnf!BZ23yL8rW z;y)GttDrHVG4_jiUX}!>^B!#FTAmh9VI_Hn<1a#g?H0${Mx$nRs)2^T2I<|gQULA_ zjMW%JXVGE|9VHfH=qT|RL#OG5F?6)P7(?et#27k`4r7p*j4{ZWS${rsQQP({aBeFG z{%vzW=;0R9nfVn+>`b`=e^IZ_6x4toso8!Ozl)rLnm7>GeuBcNkpqj=-b`WC%z>w? zw!cPU)X;%V*}k2^sHww%a3h6LV+Yn}dkuwAbH_-8y%fe0IL0FU7=^JUj)@2tQy5F+ zz%wY@$I{PSv&;PN^Xoqio$Dx`G2L-uHBg*|Khu8hSofq_+x7?$e%06rbx;zzsBT00 zIV)O7A3_?Qy#~12lL1ZJ4!D^$=Wt6Sy;yzKk#Mhn- zUid(Rcm-r)^i4XbyxQhKk9SZ8+(fmilQFIHgh11`AwRZ0FIf$UtuRj7j$ZHVY|W3w zCU3~s)~l1-qCk=Q{A;1=Yn_3NhWu-sx*4fo0P0Y6Y_DKXNWrIBDN0sDdv-3o23e+s zE+*GcZUc(EdZ1Xu)L4%93#iPt&`8B{QxlFNR3B>tWj=+K!(qs<0y8`TDz(4K66!F) zh}`n8V4*JP8}hFlIIC=!*`^w=ZXjH(V@Re4vJj8~1)#H)fBi9FG*1Dh?V89SDS|;f zK**!MS8|*0x-9>x+vhocV;*&~7G(xNChcUQgUPe!t+8I?{Z_c3(&n|S2|P&FygLZV z0Dk1>C2creuV~RgGlwoFw*B#HXXl!bj`p_>c4N%%I8faIx^%#xc*xvY|G}EK2<@Bk zp;m>YwOEhn>=XJxJ*v7R_=nKJ#5waV^I94blUtbll70Blh5^?^<13wk*w6)a=ZOXt z+y}o39aPVm*CHE}E_f!i)j-*1!$?%|dG+?&C(#5qJ4keOb~N#ok}kFfh~VRgL31Zg zczufhmL6Xmi+AoxCrb%)gOk75w~f!yF1^;bD}gSWfFjj=KJDalYo}z6Rq$sSPBv#l zYAxC}i}|yDBG^}G$JDKa=Nj4o0ArnOBFvV-e7!jzY}XFx68PMl1)&!{FCpLo0d>F^ z@4XPCeSi-ZoRshZ1cSjd7Scf_59-nZu|C9}TR-$l-Yn*e0~>b$1QUdZAxwcVAA%dg zG6-uSya?g%SBZHNF@HgBZkEmfW}s0w%*5Y89iBcaW2DaD_1S%PmmPf@I>XG;pgRzx zH0B}Zp+O2}f+=^G!T$yZc;QhGO0tgd)2YchXzK@gKab)4yr;DPPO* zu0#i>_Xwh>VQNgLYP8&;8t%Vb4MlR|arAMAn z$0~ahXCoz>(iPbctr|jj6VVQ*QDS#f#VC@}l5!qRs;Edydo(F2NvQx4fW$$d8VJZ7 zrG};8a8M29(=kUmy2=K@Glp^ zAA}-o4GAusjzlbTM3QWX|KRRNO#UU60c$D50UwJU!krVpl;$NSux#w6apMbz1gsUr z08=y98m3bR%^Z6LrCpnn)Qmb26kWH$DT9Z0j61}iL9pVeJq z_Y0smSc)Im2*XZyxhG6oTI#b`2@w9+M7YQDec$T=)(`0vOMOua;cz2%2|frMh21$F z^%*I+Pl8{ zToO98&+1gnZd3E}33NfuAMHP!GR~@)O((BEuY~Rj&|Lw#W*HrZr4l;yLpDR=JK_P! zVPDG%2^~&Mi$R&hF66EzVn28e=$-?*D#eX-&q(NEVX+k(E#jnfn>Zb+M17RetRCca z+a+{;fv)dO=zbxgL#Ki6CURflWkovb`;2D(KaGSA`M)XQhyJFEUGT&38wnlS z&B+=_7}Nznp^ple8V2tP4YN7N5^;WslJWZ(3=OX&A);<&7tWW2=4VufFw7)R48x4! z#xTrU8Rs(wv)(DJ*HqkNJ~j+@r?58+vsSGO!%-AI8;03F;gv8PL*eFC0?c|G&Ib%; zp7`g&a2$nkd^7l73de62U^ct-4Z{f()`elVA(9-1*%Rer816;kjxfwtzc_9f+=s%$ z!mxCvM7XaEzF!9Slfe(j;6xeRUj`45!9SD1IvJc4(NEOma%ZdzHpt*K8Js19@d++0 zbCl3tD`j|G776X4fcDrz#P(1?d+Z`&dnlki&{0MGu@t_Kybp2u76IRf97BG!qP))_ z9$R~J`IjK>C6RxX@O3|zkAj5$qk#U?M-i!y9_@lUk-xk?Mk*pXg%9IjJ{{ZXOpN!BUE`XkEAojVj_e^e-YlXqnJqY5@YguR=STpwYt z=^VhRygn0@eaK~i(buk__*me{=!LzgUK|$oqLP*3`0WAXcd#;YZ)&ts9KXmf7wLh& zlfxxSalFJs{a64-|Grtl@MT<{u(!2BDULTCwExo_FYI-_s1)ai9xy+=%<;nB*IOJG z_P#!l$^R|Dg+hL1EI9}8SP8ye8M#;XpPZktR~Dm++$-zH=VW28ELA1y9}oJE;&@^2 zY_eny*Fmt#U}7zG4x#IW5@Ir?`Iq?1>|Q@zYo*y;ce6UE+%wUVkrw&RxS|)H`3t~=>EkBnhanUu+>2aoVXk-TW)OZf zgRk!r`Vud}w{wXlZ}yaNlM8b}9M-Xg{*1z6cb5@MLDAIl zIZ{H41y*z%N4H9E*gTao!8IT!X1lf#5~zx7uU1Sq(~a5)Iy+rTLZu8JIUHZUvUqKl zfFtN$U@BcqXf@Kcwlojj=an**t;pG)u&f?MWrdyO2!csfmg)8iryrKzxh|{U4=YyL zUiJUwOY;7YBT(kC`TrX}0rkVb|1)%0#<08J|M@Ad8`~d0ruO5?xP$LMWkAy1_Wud4 zuG`<`sqo-28b6MVTmSyUoStEpw}0mFjJv=8_(`sU!U-csSn;g$ZxDo~Srs8q5K`T} z`?9F07|JiUoI+oY4YTq#l^pvG2?HiP5Zk?9{JVm*}r`B z(O2fq{nh;WyB~Y(Rhw;3Ma3Sc^YzCcf8FDG+vR#=;lj78s`do}dzUQPw{+?L<;&k& zwru~(l`Cs&YwPOj)~;RK*x0yX!-g$ew!HAd3pF+GH8nNu+_`htu3fu#?|%LD*WZ5o z?Y(>V?%%&Z6gsea^*_|tw=^`ozjo~hjg77A*B{!j;mD>lOcwr$&oO-&!}*zu1$ zcb?p}>!V$}KHk0icdx$s`#pQ$|LHg1{AAz0Gw;58rlqB&wYBxgkt4^B9cym>!^x8; zPn|k-`t<2DXU-fraJIGe-&$MG9X@>S$dU8MkAHsR#2-KUsQuKbFHWDn@X03^&z!mR z>8GEbKY#x0+5h&`FS3??`hi1s=e6qPvfwe1H&+Ma{w9(t{*Wp(_(Nn0oG+3|iu z-=UBH%b`6lwLYWEeJZi=*DoJ_)==`xxrcwf^XT*Gwj)~$dp5ni2XDc^k9#W6%Vf34_)~`Hh+)&q8 z6{}5uOcDBU+kGy#cjqeuq2v3?KJFHmmp4$kc)*EGZ?zqd9sXX;u%SJ+4lJ56Vac<_ z>sFJ!`47E1@1OlOy)(}AoffZIaKsSx^gEZccWM5lIofi4bwzx0!SUydcWf;`?1)}z z(CpWFrgXmLJFh&QI>kBh&E|rB>G#d|AN{8Xo1+Gg%BWqQoz(kDmnv?SrE<~syn>mv z7e^e9QRdCsw(4Be!U2WT6XP|DGV^!*S9{+9)U!H+u0-`@ZWE2R5a@<{hd zZ4@J1l-y`cedLXwrY*}bU8he*7U1j)rPmcoW^+k1DH(9?)F))5SRpYBN1xGnRDyo5 zK`Rpv5}^vT*q1((47`X7q`}br534hHdVNru>9H4A8#`mfcf+v#-MdjZy#Z2SeLp~J z&p}mg9?Q{9ui>hn$|2b(4uYFu79W~`&;4mu=Rs{#t8xh=3NF36a?O+RU6;~yBLKqF zu?t&D?x_EiR(Q*1RXEev>H=6~{b&Ohg84SAU_?`imR-P-wUoftbT_BPtJ(s`#jS(x zS>`<|{2Aa%9aip$8`pgX7!Zpo=!tfDVzT-vt6M?@rsu)BN!aseA-H%@#ykXFD0UVm z)TQcZx4bs9N7zicb;Gsj^2{IuQrX#59yQxa!R3c?$Ib0_6ixMzCPv58DltTJ5vi?h zJ&B_q44HsY5+VooTt_;)`t8>Jab?y*DqXxNds0?UL9NkBz&jCf0Zh=Z*BOv>JkXwA znc;ab?a}$JmFE7^qfL!j3})_U+Z-a($Fg7-`OR?l&56~~xiG_JQIB>IJ)85q2f9Pj zHHj8NJ}Fik__T!HpfSoqswr_<1{4b(E5DanTw;+S+Q}qki#Q2-aBPlXh`jDghr;cx zFP_$J79?}{&8#exPI=T%-q3+0TRdqRepAeOd5?)sUoF1S`jS2YVTZLU5n6pq-)1d= zYQnWH?b>ckASiw^RHdKyu!eX#kFp5$t%Y3%{=j7}A&O!Rcz)^pgIB6+bI z$+csygMeLI6n7xEIUP+60cu`M)<|Yvtg}PqO zDG=mp-pDV$Q5mr+GUxN1Ix3RVu-87UX5AYs87Im@Cet0el;+aOflzBuie(Dm6=J@_@2Is+C+Lst`=JK_~>I z=8DK_@G;LH+QX zq>_Gf*sMXii5PXMgS}$rd6c%Mo9kb_@yZsEKm=CLdOtmj^jHvKFea@nT! z(ok3q$bb5ljo}&+0^^Znw=A=+P)EMaV4zGTszE`g>xPbd^xBbWuBO}^x*dZA!k+9qtGUbqsiP##VHj_EKeE(m99Ob@2cX`Flhz-Qj0*e3oH-maYcX?ry03stjOs9S z8NX(%`z$_f+dYu^z*vJ!>WklvleWXRVTk)l7C-xbRH?{0Tz*7%GBUI_HeJ~eAg6Lr zfO{C)HJhyTmpB4O>XEBtP9cmYcc?itulMSUY1gCS{?&)>e=vgKKxx6EjX+xYs@I+Y zNeE_CjxY@TID)P^z31s{^VNYPsAC6Wuj(&z3@ndYNe0H`qXGwFC9xL!Ge4iqdg*hbFn;DcL{2|a4&SO4iv$`u*Pje%m3Zli)Y5dyWPhp!l5gbW8 z#fcn;H=1~7@Zzi1d_+9Qn~RaRk)wJxEc^UyWABNdy#=?Nz9-`AqSnJ@meh?tg$B-L z$yYy7%I34WkNa6UnAaff*goqkYckN4`?$RaPd_hvWG~F%B&hQbqHq%jpZjYk3)jJJ zrQzfXy(AT~e|ak6PdsXoO4ut=h*c@;|5Vm$E6D z(yHv72@sgLS*HhR>GQT=oCQrEULhai0#Pc_hhD5O#|7jxU4`#)?55a886LVP$z^=($C}vz@v}i zRfo*s06?ote=P}G4I%+DFhT&t$HLK%fPnhg0 zCp7+bMA%0vcm{q$ln^XL zrgtqXPDe*n!!mDxiq$a9K^@o>mk5^r)5REb*<&fKs>Z^ zR+Dkaxv}N`%oeUJF_AHFIZ=2&L0(u(n7bO3=mK{JX&jXXC8|O1y`cXF9F>9)d5PL^ z9%nG&J0PqGQ&`vg&iUybmD)E_IV}I$jIEsnz6@k!OeahcLU~+b|kY?4iCS?-un7;m#7RF1x>|BENFGC87 zIUWiMN|@I5WStD*x9T?sZE6TW{6%ZN9WD|@2*-Y$T@8}LM^1aRihBn#q77lEPDm>$ zdGCQj1Zt>bR+l|4K5h-rt35pm9i`1V(zgYqRD*#R-1)PuuN8p;1P{KxGHvth?pq}w z%9uc129CiRSs^79v~3>&U6)yT++w;r1=mUwCE-GYbxYFGnmBp%@d{e9Jq!nrn%QYH zhG-|@Vq5c<_t4M0DVZk7lRo1@apuS!$%L$QfTE5MC+{9%Si9ZWzO{JS$xI(UJaYX6 zA+r#00q_Pv9NGYQl9aamE-8r*z>(o%a(GHQkO}Z5FeCVD(1Gm9KUCF$7oFCusnt}5 z0ifa(@}VsLm)PnvcgtWk=nw!QGiJT%h*Czef2IW}10X`wHy!rDU;D7XU-ZC@XLu0&`gzzA{mb;{&;P!FY5aF|{KfM>Egik@pa1DDegFHf z(CnSrF#zXaV{ZfP+y(5||A5(XE^m8FO9%rCO6Ub`z6H4KR)j~#z;FN%6&=r_+FB63 zeSC==*8muR0Z`D^NE$tk>EvbuZ9)X>tu2Xh>`LG2dV6brE6Gh2I|_Tm{~qD#OjbMq zfY63ZtzbqRon6jmmm?G7nb2`)gC&2^YN!l@Uaa%8*bQWtq3tyMq4QsLKl^T7M15V+p_7~{O1}52Kq!hMq(r*K3;_a8*djfDS>ZpR zMfy}BabJfA%Jnms-31yq2+R?JKUF{~_BSXx^^b#8>|r;15s*aM$?(_|I1W1Ro~=_p4-|0l&`M3XJF6 zR%b7XiFv!9qd(a|2!l4!!s5b1=lCqC?hwSmn)!19U>cw0b2|f(02bf{_yG|>9FPL! z0Tnltcn(YfZ-I|&N5%nigM6R}C;`fVN}wjF51NA3;0llm`hbC8 zC>RYUfT>^>xEU-4E5I7C2|NTI2fM*OZ~(juJ^&}dSKtR29L5FXhb@Q6!qi~;FmsqA z%pK+r3x&nPQefGzt+4H|TG)PAJFFXa88!qPgFS~$!vQ!aTo5h^SApxpE#WS3Uw8;xm#PDTY)+8Y1nH-pEj7A~F|Qj@*N6L!L(tAs-{(qEIM7lpIPAWry-XMWEKA z@=?1{2T@(90n|g(GzSNV2!|4f35N>@jU%2TmtzOVevUI7H#i=1%%C~Z5@=1d4cZqS zjm|`uqnpv4=o{z>^hXR1BZD!-xL|@Y$(RC6J>~@FI_5FvBNmU9!~?Gm z_B?hJ`B zsLTJ<=G~7DePTXIi2E5BcDH zQhb(tbiORUdcN~~kNHvja{TuE5&WC^5Aa{(pAsMlXbX4>Bnj*kI4v+H2p5zUv=@vN zED$^_cuVku&~hPjA%@T0ud+jJ`~m%r=<|GVf&NWW8iJ$R3k@Dkm&w zFP9>>Pi|D6Ti#4QR=!q#PywZ&udrHSw?e-nOi@QMOmU~;btRaRu2Q(tZlwWbq_Tl> zv~sQTZ51vRbCoqJ`&1sN3aYM9%~U<6`iq*hny*@s+6A@G>N@I?>hoCetn95zWzl6q=ALOdV^C2?+tYg;|&iR{%WLRwA!fI=&7-sF~hjt_@N2Ogl1A> zGGe#Ne?XpAKIocK3-L_wDPq%NfpK{Q1NOL&n$mQtf zSm8LnLU9Fa#R(^vlY>)<)2OqIbF}j@7r@2drNrePMUE0nIq8aWrMT{NeL~fsrcy7s z@wo-KHM_law{S0TAMud)Nbuem4lWIzWSB6D851EUA;lq2Lrp?ULMOw_!pg&5gjQitx7ua( z-qo{_UXcf*&{2U=$D;|+tE11wh{q(w3^0|Lxy-Rx!`QOeDV8H^PaGKMAJ-Aj&t6Pj zNsv#-NqDfvbj{8+Gl`ywN0RVK(Mea56_Yn5Po&tSG^|CerLXNtl}yb@eUN6JR z+O+H4?%>@wD#?{CRm-b3SAD1suf9`bThm@ETU%a-s#{a{q~5dsLW6!o(;m@1oA>;- zH+t__Ben5dlU`F(vsiP%KG?p5eUtnB_V*vKI?&Og(o%C!@ZjcFpf#cO*`dHgw+=fV z?m41=q~)m0(OqqPZF%irdvg2Kv9M!f9X=fc#~qIMoG?1kc2f1^-cypNcAgeEUC@c` z%@Pe9MeS?{xh=UmTSJMVb@Vy{i_*$d_u&RjIPc&g8^@AxJC zOUEwjUT(jlbEWO7&egVSy4TvT>s{~YH|RexU_8)y!|X=)O{<%|gZ6`$hn$B7Zh73g zbKCFs*qz`zPwz(FeL1{l_~S_WC~`FK9`0WGeX;wsKPmila7=gX^aHC0SH|7OM;_82 zK7SPV=+oouC)`iUCnP4Co@zclHEA>1|7_*6$IqG1KfcKQ8UORHU*vx|`YZX@D^uQ6 zk6*H0&c4cjE%JKr8|^ne)0FA^Z=>FRe3v&PGSm28|NVszULPhtCVt}hwEZ`Q-%fmX z{5(1vH9I>y0$2iQ6p90dM6>Tq7z`TA#m~*f$;l-`;N#_AE-E3uTvSYqD6J|-Bq>XY ziOK6JD64B|Yimo$8JOs68mnq)YeGUm35$l=4IF{w0MRh^Ssfez!r^cj5{85$=JwozFgOB0;!%t63U=%xGka`MH)!m&QwkEMTYH<=viJd+{lu;Wz~6G_Js z^XVcZC9XQi;sMb&;}xat0aT`Nufx{$8rRh2oi@9@YH&D~MqFoisrXggiS>`bW&wL66Z`*^Ae5EYe2~{n} z*Zc^^sjbyiGm7~8x{eRULopp@kx#w1?;cEH`CUkB@@nlB_bHAzcYKde$=;x&mv-`S zlpZ>nBfSeL#x>sb!f;0;ue^O;&S9UYlfCO)M#l@L_aAK_v~X!mw12c@5DO^31<*>~ z3RJors#R(~U*jJX1S`(ouV$2=|Mto8Gvrd=RAfpV)jsIj*)=ljJXvZ-OuOP!4` z8k|RaF8QbG3-a%uDmJK{H1y@uUDr{ys#N$hi!S7_gL-0P-#h)@pR|_~lp7P1+$vu= zaMsr-81sMJ(rWhXq_T?UO_!%WJogX0eSV6eEuIjqmNq!-R`n{@=0o1~z?+^kPdz#f zUW*wuRo8h9N9f#79Sl(8)-5|JCYd`T%vEP#aBV_g;=Eq+&3Bxox4q;w6w(iN2Uk{R z{NnP`+L)`ZJ3+~byi@9WLaSHNCG%e^nvaItzxDTRin1phI810WnAp{E={jh3v$YPW zc)r<^dz+Y-1K)8SIn5EP()JtF?Cct287bP^{RQWgR)od`cuhZ}jcaCS}OrD8vNdgwB4Jx|!Wp(@1Pj?Sz_y`&Rn0TC40VY`nfe<{7>g-h$t{#nt^ zEgP5lA5uEpCdGB4%03pp3kGr+SAKH6+T&*;(XjdHR;#1~>E$={M`#XD1jJr(`kpd6 z<}izOT?@OA)0S=qDyxRY$OrmmRyrfh8G&5D! zI9B*@=YFNZZB$+fR94IFuoGJYqepwj9kxGpdmtxiyCr=zc30|c*{)&7^sQGTXMyDV zl{q5QvV2bO51JOL^9IXB9sfz&zUk=EmFJ%s%mOP431`Dq`<`Jea0Xox`?jRl9>CP! zxhcpjA5C!XEZs(JA=tKFc(>2-MNW5n=W~@N=O%qS$F#Md@|N|~RbFv;jlC^v=W&K| zpj~7Y;q2x~D$0oO`iltN%z>8cr)^Vc4tJytOQ(^cX_*_MGR$HsT83I>Z7a*JZdtxT zTCU0IXd&jOm^&}8M*5n$+*7`_GRWT%n|iRt;nx1b%w077U%U2<%8p)CeTs3h6Ncw8 zdNV&3y;5{&HK@7j)a-q;(t<0LVYgOV^WvpUTSYUGu8#xv-GtFOl!%!`gYv^W>D|Zh z&$^A&K156@?nWIt$-Qhv-s1<1Uh|-UA^nHHNugisMph?`DryvY z;?f7lwYy%JUmI$ZzS&gsPBXe=qV}NE9oM~4Rpi0rn!*-m(5B`pdk@X+SDRp#JKJsT?-G@mym3HfqikL=)X|>mpYn};DNL=Ng94#?h_Q02oFA9fwwz+dxj z#Asl!YZkb1{LMYnH73jbLehUZVRB*A`u=lc166}(kuryl^?rI+d%)*Wy{DaTsQu2% zF8A7$Jx)Aq<_vG+>oPzT{M;todwOM=K+olL-3xUMQn6d_?9ZJTXWSop(mFi&&^(ED zqu4N)l{_lC|L{)-h1T8;xl?*l)m4!yCMRN4#&;*yV`arfE&eIt=TWO3WuFt=R$5-} z;tFTkM#gznVDG=4@=EI{Gm#C%1fM+aC{-{bC->3AeVJ|li2Eu|ArD79;dK*c5-Zi@ zB-h&QwXY=4EN|n>aUF3rJ4R{l4MJQx3TRm)omo55_i9`C;BgQ6(lUTrZQG&!L7F$^ z_2}KxgT6KKA3Qv^Toh0_meF+Sipa!Dt2b_a0?Qk+s72I75xMUB74J#A59UxlZrbB{ zy&@<$S1dlhECuB}wBskKXZPG5HC(jM5eS_HL~mIX+c-OH03Ny`FMfa<-W;o4i4kuw8qu05$+ai=tp+MpBQ1_Z)n}b!I(BVpw54CnQBYe2_WzuQg*DDTm?(@`TqG((dzQlRPoDOC>B$Fb|J#BT>|`p~{L?^nki7$Uga#9kXM@o2YKX?(W2 z^!}6N&$>;g&sk8;Uvt2f6c(OtEUOYYcri@Ierp>NKInS!0zcBB{Zgaj(PZY}O7Z%u zlHzLjZj^U#l8_`Hur#e1P4zfgsnf`xX0lgUYTuPa0|}ZB&zhDjxAOA6W3@vgk1I2e zCJiytR@4TEYn0YJ_q^obG7|S&V=wO}(N(@ZcotCk%p!dj5P0;a!&bmltfA&yWnG4M z%gj?#dbjV3oB~1d%Q>b3J$kzZ-JGST2nQw&$LtJr9ygxo3})81ei-gy7MIZlbb0f< z?l^*diiP)C)X8h>KIL`2(R0j?538))eyTThT><%WMd`$l`wh9Qq9LD8W`t_LQrxe8 zi5exhY@O3Gnw%r_C)R68je4xU;lv#1%zHLcChdGWB7CQ-T(Qy+`miTzyG1rBIyZ{wD=g7Y9#Z& zqT{dd-*hy-!~fOLSla*nuaL0}7V{O8G>#TQOCn)0Sj^Xq-BAgV@!`zKWcegzVzL4j zgIP$|okUb5CSx&B;%0XBImWp}BJv8q|7Il3fj7#Nz6c>Hf0f6s1|_bZt2h4@TL3*W zoDm%#0JVk@$7Y+)TKy$I_`D_=Q{%Ass7O<+aTtRZY>LGg$A`y9GEAN3#fCFj#%l9N z*r(>fQK6E|mnOx9#Uutq(ALoA&&ewoVKFkM-}E>*Cg4jW1L#5WDGJ23>~4R7T!lVF zvyNmyMT=znV0lssNkMfEX_#n2Okqn)`=5l#&kIshBeF%zrL+%;i4112h)@<3_K7uY zGlT}2ErTrqlf;(yKPpZ7q7 zlcA9ek7g#YTc6Bin2?~iSfsh;o3L9%3=f|BGpEgjq)8$|dGt(3S|m1~;tyDp=UJ1# zvTA+9YVrftlzG;audLs2e!~`&5FZ~C{e^K3T;eO2<$}v&ux%d`6U{b6`f3x>H*;t7 z#STMgk#P(ows>Q;`7vP+(VRv8Z(qs(jQ-^P{{m9)e^19>;(x0D5&um`T~}wx|Nk3g zENSIp>Fz_ZCPG$BqO{AARyaLgP0iXF zLMkAV7QK;8)KZOMg{rwz)si4V8W86~Q6+AUO*J?^7`kk}@!t#X+lvuNkBMSH=`80l zXC%M6@h=|eiwiQQLm==hb|E|}lo-dNLwFdAzgZ&@)gbX2e=3xH7;7IwOpZyIgUn_z z<}mE$vu!eIp$ugR?2Q!@9cpSUW3m7XtvU}(%=XXW5U#O2$<3PTX-y4qbFp#vGN)RT z6o~BGlG*|vHjEZW3}UcvTyY6>IwLMFBmv3>x&X^L51gDl_ojFb&_vZZh&9*X`9C(S zn5cQ!Z>Wh7nma3jEeYy|F^w3;VuU~rFfJZ~qBeyJamH#iQ&r-(Qhwi7@C8y`kErsy zfJM_bfB7@#an_+3B$uG5%`Tu`|zIDe$;(|lAw6%xOSs+^=LT=_ecl^a0Gfl0N81#gA2m*_^kSQ^SsXPze z6qF1lZ>A@(pv@}D#07uFWV6Z4!DofDeYb`(Q42Bx_F9zfMzPQ#qI7C_sx;f{sLj=c zAe3a5oX-Cp`u_S~xV`)rb^OKkucQ0j{!eW^ohAJDe}%rg{$+m0rJ7&;&|_j&hcn{l zR($iQW1-=y?8}?=JCYRy>-SA%_L3=2_-(u4KOVDBn1sZ+%aY zsbx%bJS{vLif`Hez|`=|(nMx1^*K9cHX%lbM=m@$fI?`EIaJZPViHja`Z@1Stdp4R z)eYN6eTm&Q*qWi`-MkZIna;J+I6in@bP|NFHjmx)rK{}FQhw!1Vo)fw^N(dhVljeA z{{9LJ3QQLU#+)9XK#TmUg}tgwl39?g7C%4YYVmVRss-)euH@KVwuxay5$&KyBzZk}*{#e(AuX3Q&W;RQP^~ zE$6Lvu|<8aWU+aNGU9(XZH0NkP!RA(!ESSr1JQFKbofTYytxsB*bQZ{%}0Yoq%$HT znY3UiA~7N9kiJ+V+Xzkn5OU1f4s;x9TYSts{+s-N8m`R8D-gHZyrKU=i?g}YKhgm4 z{Xn{{xx2NOxle$-v%59b#@zDn>G+QOulqrvy12Vox~%voefh%sA82u*y8j~$Y`z~z zr&_yuSi89gI9a>fxmf)z1>ds%KnH|k$R1D|m%k z1C~^Kiu*sX*WdYmAe}vkRG$DhcdEU!?cWl=nDK`*?BwEZ9bo6;_V?^(5#L`+H@C8) z{uAjC-(O4r+qS=m?+4P&Js=D4q5QpB{mS*%?e<__ga4%65Z_-*x3{u({ztxeOO-M&u*sn zQM6FT!io@LTX_CwLR$RA8tHpJt8f+s5e#7qf2;2+tS+=thzyBSosU%GgV_x73wL!a zaq)VOWFHS<`aq8iW1t&5NmVsiRh2X^kp!)5p|JJ~Y!4)oElWOF0Sayxi;;~Eienlr z{+}%gVp}9^ZiT#PweoHF`@bDGEYT7z(Go4u5-rgZEzuG!(Go4u5-rgZEzuG!(Go4u f5-rgZEzuG!(Go4u5-rjHJM@15)U9Gk0I)FtbP8{Z literal 0 HcmV?d00001 diff --git a/httpd/kepler.patch b/httpd/kepler.patch new file mode 100644 index 0000000000..dbab7e501c --- /dev/null +++ b/httpd/kepler.patch @@ -0,0 +1,64 @@ +diff -Naur kepler-1.1/launcher/cgi/Makefile kepler-1.1.new/launcher/cgi/Makefile +--- kepler-1.1/launcher/cgi/Makefile 2007-04-21 06:41:49.000000000 +1000 ++++ kepler-1.1.new/launcher/cgi/Makefile 2007-05-16 22:13:38.750000000 +1000 +@@ -16,7 +16,7 @@ + + + $T: $(CH) $(OBJS) +- $(CC) $(CFLAGS) -o $@ $(OBJS) $(LIBS) ++ $(CC) $(CFLAGS) -o $@ $(OBJS) $(LIBS) -L../../lua-5.1.2/src -llua + + build: $T + +diff -Naur kepler-1.1/luafilesystem/Makefile kepler-1.1.new/luafilesystem/Makefile +--- kepler-1.1/luafilesystem/Makefile 2007-04-21 06:41:49.000000000 +1000 ++++ kepler-1.1.new/luafilesystem/Makefile 2007-05-16 22:06:25.546875000 +1000 +@@ -12,7 +12,7 @@ + lib: src/$(LIBNAME) + + src/$(LIBNAME): $(OBJS) +- export MACOSX_DEPLOYMENT_TARGET="10.3"; $(CC) $(CFLAGS) $(LIB_OPTION) -o src/$(LIBNAME) $(OBJS) ++ export MACOSX_DEPLOYMENT_TARGET="10.3"; $(CC) $(CFLAGS) $(LIB_OPTION) -o src/$(LIBNAME) $(OBJS) -L../lua-5.1.2/src -llua + + install: src/$(LIBNAME) + mkdir -p $(LUA_LIBDIR) +diff -Naur kepler-1.1/luasocket-2.0.1/src/makefile kepler-1.1.new/luasocket-2.0.1/src/makefile +--- kepler-1.1/luasocket-2.0.1/src/makefile 2007-04-21 06:41:49.000000000 +1000 ++++ kepler-1.1.new/luasocket-2.0.1/src/makefile 2007-05-16 22:36:37.125000000 +1000 +@@ -47,10 +47,10 @@ + all: $(SOCKET_SO) $(MIME_SO) + + $(SOCKET_SO): $(SOCKET_OBJS) +- $(LD) $(LDFLAGS) -o $@ $(SOCKET_OBJS) ++ $(LD) $(LDFLAGS) -o $@ $(SOCKET_OBJS) -L../../lua-5.1.2/src -llua + + $(MIME_SO): $(MIME_OBJS) +- $(LD) $(LDFLAGS) -o $@ $(MIME_OBJS) ++ $(LD) $(LDFLAGS) -o $@ $(MIME_OBJS) -L../../lua-5.1.2/src -llua + + $(UNIX_SO): $(UNIX_OBJS) + $(LD) $(LDFLAGS) -o $@ $(UNIX_OBJS) +diff -Naur kepler-1.1/md5/Makefile kepler-1.1.new/md5/Makefile +--- kepler-1.1/md5/Makefile 2007-04-21 06:41:49.000000000 +1000 ++++ kepler-1.1.new/md5/Makefile 2007-05-16 22:06:44.593750000 +1000 +@@ -15,7 +15,7 @@ + + + src/$(LIBNAME) : $(OBJS) +- export MACOSX_DEPLOYMENT_TARGET="10.3"; $(CC) $(CFLAGS) $(LIB_OPTION) -o src/$(LIBNAME) $(OBJS) ++ export MACOSX_DEPLOYMENT_TARGET="10.3"; $(CC) $(CFLAGS) $(LIB_OPTION) -o src/$(LIBNAME) $(OBJS) -L../lua-5.1.2/src -llua + + $(COMPAT_DIR)/compat-5.1.o: $(COMPAT_DIR)/compat-5.1.c + $(CC) -c $(CFLAGS) -o $@ $(COMPAT_DIR)/compat-5.1.c +diff -Naur kepler-1.1/rings/Makefile kepler-1.1.new/rings/Makefile +--- kepler-1.1/rings/Makefile 2007-04-21 06:41:49.000000000 +1000 ++++ kepler-1.1.new/rings/Makefile 2007-05-16 22:05:28.765625000 +1000 +@@ -10,7 +10,7 @@ + OBJS= src/rings.o + + src/$(LIBNAME) : $(OBJS) +- export MACOSX_DEPLOYMENT_TARGET="10.3"; $(CC) $(CFLAGS) $(LIB_OPTION) -o src/$(LIBNAME) $(OBJS) ++ export MACOSX_DEPLOYMENT_TARGET="10.3"; $(CC) $(CFLAGS) $(LIB_OPTION) -o src/$(LIBNAME) $(OBJS) -L../lua-5.1.2/src -llua + + install: + mkdir -p $(LUA_LIBDIR) diff --git a/httpd/proc.c b/httpd/proc.c index c65d0998e0..0e4b3e5262 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -26,6 +26,8 @@ #include #include "axhttp.h" +#define HTTP_VERSION "HTTP/1.1" + static const char * index_file = "index.html"; static int special_read(struct connstruct *cn, void *buf, size_t count); @@ -125,6 +127,10 @@ static int procheadelem(struct connstruct *cn, char *buf) { sscanf(value, "%d", &cn->content_length); } + else if (strcmp(buf, "Cookie:") == 0) + { + my_strncpy(cn->cookie, value, MAXREQUESTLENGTH); + } #endif return 1; @@ -138,8 +144,8 @@ static void procdirlisting(struct connstruct *cn) if (cn->reqtype == TYPE_HEAD) { - snprintf(buf, sizeof(buf), - "HTTP/1.1 200 OK\nContent-Type: text/html\n\n"); + snprintf(buf, sizeof(buf), HTTP_VERSION + " 200 OK\nContent-Type: text/html\n\n"); write(cn->networkdesc, buf, strlen(buf)); removeconnection(cn); return; @@ -164,7 +170,8 @@ static void procdirlisting(struct connstruct *cn) } #endif - snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nContent-Type: text/html\n\n" + snprintf(buf, sizeof(buf), HTTP_VERSION + " 200 OK\nContent-Type: text/html\n\n" "\nDirectory Listing\n" "

    Directory listing of %s://%s%s


    \n", cn->is_ssl ? "https" : "http", cn->server_name, cn->filereq); @@ -347,7 +354,7 @@ void procsendhead(struct connstruct *cn) if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) { /* A non-executable file, or directory? */ - send_error(cn, 404); + send_error(cn, 403); } else proccgi(cn); @@ -388,7 +395,7 @@ void procsendhead(struct connstruct *cn) if (cn->if_modified_since != -1 && (cn->if_modified_since == 0 || cn->if_modified_since >= stbuf.st_mtime)) { - snprintf(buf, sizeof(buf), "HTTP/1.1 304 Not Modified\nServer: " + snprintf(buf, sizeof(buf), HTTP_VERSION" 304 Not Modified\nServer: " "%s\nDate: %s\n", server_version, date); special_write(cn, buf, strlen(buf)); cn->state = STATE_WANT_TO_READ_HEAD; @@ -414,7 +421,7 @@ void procsendhead(struct connstruct *cn) return; } - snprintf(buf, sizeof(buf), "HTTP/1.1 200 OK\nServer: %s\n" + snprintf(buf, sizeof(buf), HTTP_VERSION" 200 OK\nServer: %s\n" "Content-Type: %s\nContent-Length: %ld\n" "Date: %sLast-Modified: %s\n", server_version, getmimetype(cn->actualfile), (long) stbuf.st_size, @@ -491,14 +498,15 @@ void procsendfile(struct connstruct *cn) } #if defined(CONFIG_HTTP_HAS_CGI) -#define CGI_ARG_SIZE 14 +/* Should this be a bit more dynamic? It would mean more calls to malloc etc */ +#define CGI_ARG_SIZE 16 static void proccgi(struct connstruct *cn) { int tpipe[2]; char *myargs[2]; char cgienv[CGI_ARG_SIZE][MAXREQUESTLENGTH]; - char * cgiptr[CGI_ARG_SIZE+1]; + char * cgiptr[CGI_ARG_SIZE+4]; const char *type = "HEAD"; int cgi_index = 0, i; #ifdef WIN32 @@ -506,7 +514,7 @@ static void proccgi(struct connstruct *cn) #endif snprintf(cgienv[0], MAXREQUESTLENGTH, - "HTTP/1.1 200 OK\nServer: %s\n%s", + HTTP_VERSION" 200 OK\nServer: %s\n%s", server_version, (cn->reqtype == TYPE_HEAD) ? "\n" : ""); special_write(cn, cgienv[0], strlen(cgienv[0])); @@ -574,6 +582,12 @@ static void proccgi(struct connstruct *cn) "QUERY_STRING=%s", cn->uri_query); snprintf(cgienv[cgi_index++], MAXREQUESTLENGTH, "REMOTE_ADDR=%s", cn->remote_addr); + snprintf(cgienv[cgi_index++], MAXREQUESTLENGTH, + "HTTP_COOKIE=%s", cn->cookie); /* note: small size */ +#if defined(CONFIG_HTTP_HAS_AUTHORIZATION) + snprintf(cgienv[cgi_index++], MAXREQUESTLENGTH, + "REMOTE_USER=%s", cn->authorization); +#endif switch (cn->reqtype) { @@ -585,7 +599,7 @@ static void proccgi(struct connstruct *cn) type = "POST"; sprintf(cgienv[cgi_index++], "CONTENT_LENGTH=%d", cn->content_length); - strcpy(cgienv[cgi_index++], + strcpy(cgienv[cgi_index++], /* hard-code? */ "CONTENT_TYPE=application/x-www-form-urlencoded"); break; } @@ -610,7 +624,11 @@ static void proccgi(struct connstruct *cn) for (i = 0; i < cgi_index; i++) cgiptr[i] = cgienv[i]; + cgiptr[i++] = "AUTH_TYPE=Basic"; + cgiptr[i++] = "GATEWAY_INTERFACE=CGI/1.1"; + cgiptr[i++] = "SERVER_PROTOCOL="HTTP_VERSION; cgiptr[i] = NULL; + execve(myargs[0], myargs, cgiptr); printf("Content-type: text/plain\n\nshouldn't get here\n"); #endif @@ -626,13 +644,14 @@ static char * cgi_filetype_match(struct connstruct *cn, const char *fn) if ((t = strstr(fn, tp->ext)) != NULL) { - t += strlen(tp->ext); if (*t == '/' || *t == '\0') { +#ifdef CONFIG_HTTP_ENABLE_LUA if (strcmp(tp->ext, ".lua") == 0 || strcmp(tp->ext, ".lp") == 0) cn->is_lua = 1; +#endif return t; } @@ -652,7 +671,9 @@ static void decode_path_info(struct connstruct *cn, char *path_info) char *cgi_delim; cn->is_cgi = 0; +#ifdef CONFIG_HTTP_ENABLE_LUA cn->is_lua = 0; +#endif *cn->uri_request = '\0'; *cn->uri_path_info = '\0'; *cn->uri_query = '\0'; @@ -739,15 +760,6 @@ static void buildactualfile(struct connstruct *cn) { char *cp; -#if defined(CONFIG_HTTP_HAS_CGI) - /* use the lua launcher if this file has a lua extension */ - if (cn->is_lua) - { - strcpy(cn->actualfile, CONFIG_HTTP_LUA_LAUNCHER); - return; - } -#endif - #ifdef CONFIG_HTTP_USE_CHROOT snprintf(cn->actualfile, MAXREQUESTLENGTH, "%s", cn->filereq); #else @@ -794,6 +806,19 @@ static void buildactualfile(struct connstruct *cn) *cp = 0; } #endif + +#if defined(CONFIG_HTTP_ENABLE_LUA) + /* + * Use the lua launcher if this file has a lua extension. Put this at the + * end as we need the directory name. + */ + if (cn->is_lua) +#ifdef CONFIG_PLATFORM_CYGWIN + sprintf(cn->actualfile, "%s/bin/cgi.exe", CONFIG_HTTP_LUA_PREFIX); +#else + sprintf(cn->actualfile, "%s/bin/cgi", CONFIG_HTTP_LUA_PREFIX); +#endif +#endif } static int sanitizefile(const char *buf) @@ -851,7 +876,7 @@ static void send_authenticate(struct connstruct *cn, const char *realm) { char buf[1024]; - snprintf(buf, sizeof(buf), "HTTP/1.1 401 Unauthorized\n" + snprintf(buf, sizeof(buf), HTTP_VERSION" 401 Unauthorized\n" "WWW-Authenticate: Basic\n" "realm=\"%s\"\n", realm); special_write(cn, buf, strlen(buf)); From 4d8f9ddf2c74db7d2bf8bc491b64c98f46397504 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Tue, 22 May 2007 12:23:39 +0000 Subject: [PATCH 078/301] changed some of the scripts git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@97 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- www/test_dir/some_text.txt | 1 - www/test_dir/test_variables.lp | 14 ++++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) delete mode 100644 www/test_dir/some_text.txt create mode 100644 www/test_dir/test_variables.lp diff --git a/www/test_dir/some_text.txt b/www/test_dir/some_text.txt deleted file mode 100644 index 041831f7dd..0000000000 --- a/www/test_dir/some_text.txt +++ /dev/null @@ -1 +0,0 @@ -This is some text. diff --git a/www/test_dir/test_variables.lp b/www/test_dir/test_variables.lp new file mode 100644 index 0000000000..c1ac332f02 --- /dev/null +++ b/www/test_dir/test_variables.lp @@ -0,0 +1,14 @@ +

    6xU0uN=`#tt+7w`dvEjCs}Tz_^E8US2s10UH1XoPjC06r26 za0(8DJwz=Q<7+}F#ve(=V2RNlrPXPdF}-C>cNxk+B<#{hb_upjMC7nXLPwqnfJY)A zZrqp>ZtR7Dh2*s&7IGudJxit+c@iZ!>k2w@Ej6bUV;~~l*duRdAN+{vedNrWJb9nE zW-OkcPg*c`dPVG3O1LP@g`=HSKz`Y=l5p`3i-YDb zq*oF)yT{_d`JW6bJE3`jtK2G)_x_465Z_ZpO{qwgnJRKo4@P}*4)=sD(05Y>#FN&S3SByga% zDdu&6?h4>Y00uW?1DwzlEp6n+#ua}8s?1>RL3z?T_0ZZ57Mgu`+!D^H<((EGxzb9; zMRZe3Wk|0M^YEXd@{yw}*`n>l41Q58pfEd+tCj`8!M(T>;FQOLC#~=(Q%nz8*)`** zD3NA|K~oxYcZ54WN1}N#*hP5r{Lwm%8}0miwqZW}!?OBNYhx#+9|PO2OfMtr=s(V3 zB&^u2LdNz{!jMQs(;Uqu!wQg&9qXC)$fQh23c_w%y8DJZ!RKDMMxuC$C)1XI6_&yT zoRBeSSr0X{Hb#SZl;h+l3CCm!=i3__#Z(=bY@VNgn9Vc9z8Hm=5VmLxAAdKCI)O#O z2SB%%xPxRIxxo@N(lWXch7p2%6%viv@hO;`+fU&~*qgbE6hqS%yBsqnCv)XMA%G@l ziKIm!S7c+%g%iHcg>vMP-7ElZSNCQeaN0k!>gSxnWyJFB=hNYoB6|NHYmadt_plb9UMZ`A`;K8NJB34a1g5YeTMxF2EW+}5|zs6IO*EiDwr)e|Mg0FM2RCqbHz7Dq&k~}<)=}On!IEx?}XGh+`#BM zAaziEkv5^Ffsl1e8HE5c2_=!kVq`OEH7Dy?|(y=b2yQF=MNxJ8W{lQfAVlBBSMlG-B%_~tOi zF{xYeaV1E~UlhGWB(ONR0M(Dww@C*JAWG6&Je7eec4HxB%z(6MKwxs7L$|lSNbl}E zjjo)C6aupt1bCS`LkNmwWuy>fi$TC|d}jzmG(QlfOQ6_in{!d4X2{gXdbaMp z{B3~BictHU;OfyvDT?})xchWp%O2%7pj+(7RNez@Kv z6r}tXgtv+6QCYVj@8r1e7txN+_^7_GY@s+xu>U{2;Ez>B<3BV*vS+vbf2?KB{(m+; zJpSX*mVP1lBmGr5-+;WX0TA2{X^w|W&`ofF(&I@;DKM7IvHRT&9s&)BZexd-FxiTY zjE5ms9gp*7$3>)}7tjPBczq^oOn{p!OH9gu0T_cFTZg-QyM~|{akt=?@eu}UR&z|* z;KG?AFVV)hbC@g4XhsV-KSywYjCoU)p>C44RB+lRL!>)ZLfA&abi9zz8eE-5H1KzZ z6b6cu-4UYo4PyHcWe=-SfShJbRtbZ|r8J&5i|RKc$`(7 z%v}vkiYnqTFectGI?1<=1&|&H<3(fbL~zq_*-enu*dn0F{R*6xX$MyJH3iO#rA(jgj|rX+pQI*uv|fIzD$GoHCp2r*^nuC8eiP=18e~$$#;zfrmFP>Fwz5 zwdFkWJ-9clOofzSaBoOiuLQ~0vz5I{8+pc?v@3R;?^NtKU#z&%x8f_rfsvmVVH+Kz zx}pM3WnyVFsc9L{_FK$LL>o#E(-(kN_qy-Pyw=H=OCyvs!r@*gpk!Fzq_$gjT`YbB)d#HQX+Yb z<-phh{;i1Gw^JkQjBpWhu7Mkk#AI8&rd3J!s$F~&O1 z;=wU(P^go7iflCHonby_Y>vs=l%|+ZBPa}=sa&r_BT=QUPMAh~BwpAtRZpX=Lh@-x zti+)Ks<4}G6rn?|6;f8?do+#lXqSMelk+At?b~-@fNkjVsJ_YrBH6F(j>00uAxAY< z_T|86j}ntfc3)r|knxaEA30#LjG;57X4(`gS)sv7u_Q0SQUfVJsuiY`&BM!!$*5?3 zMN$1qVliZ1vQw{CKI7_}LRhZ8UlDw22UtBK>DpY0aTlafJuO`7Ok-t~m#PKo^%!gV zQMQd_!MxL+1o=`oRS`b54H6F72n>_nk_5HX`tuw$orCM#SXhajwJxdzcMfd{DQ;fE z>z3QPS3W~}*#+VVvvM$8Ztd>rg3Rj5C?i>3hyEfX9YhWbhxiV2tDe;0Td;1_a&Ag@ z(E}>kuvlkg(K`F0h>*3>7)3~k-yK>CgbuSJiOC*gvXh*Mp!ud)B&w|=%L!jV_C5Zl zA=uh{R_j@7*EOHDHWH=f1V?QnJ)vdMXn!YUZtBVyd=GiOkTJ(7ut zH8E^zae`0$nj_y4b8G2<_`$qG|wAEZlj-lBw)bTK(YmF8r{~BSiHD#q3A`}T+E*A6CX=>My=oJ=>x7}@ftRl39}W6OR|E#J4H2+HCN`DVvoc$D<;~gf&}Jc z^Q&?rrvy!Fjl@^doK3hKiC_)Lauig;5d_g8Aee55MWZOVQ*pqx-$OP+h45QuDQxlm zm-`c>>2q?@+F-vFil)V~!L-t##G?Eocn~;cH*OG1NR6DuKeQfAbRSHsX@jDt4#E~> zL*R-aovZ|yvl4`ED6{-K=POK}aBr+f`ciA|Q}U<8``^Q|0V`_%)g1HO|3=r%-T%(U z$F~0>$HKmyVgg|2$vk(sBO(NEK9#sf$j)#aG9&_)l<0? z6+>(}AKggRWYRXv74MMb2B`cgC^Pk>&UR&N&(RghO;OF3+!P*1Mt!v3Pvx7p0rTbkvkN4xbgWr?j}JT<0V7tXB1r-Jv&L9fO;N?5nzqV~Hnu&I0j`Z! z0Q_#A@tv9xl)ZfrMY!30mT>ziB{*roMIi`(uu75o$V%nYX&cv#q01Gi5sZroYT`yh z3oG$lHj5dRO)Vq5OcE)CC+CUVX2QCfPCg6XeVC3vjAS7kggO-X8311`HI8|m^oGifN@snzmbR%xHuhvf2CpBgVx~mfH}TR$j}E! zwF_Z>8j5FvFa{=bf}uE60$A9U$B@o3w$C%|DR$B$q*in$WFAB;VJW-^(@ABR91{}S zUQ9=)>=SYyVvz`Y-9}aE#%?b`a|}3C4{66D@e-)V#tAR#BupedVY);Pjw|Vqr!1fc z2keub2vDGhl?l)~V=XRA)(B@B;Sq&_N90UhN;$Up0mFb^zaBGZvVwGf{ccMUg9 zx_^6+WWTjlsRf~hk%`zY5j0Q6C3%8GNX4SY?qL27LQV$Ae57ThQYwI+N`w_P>m>6e z-({rpd|OCgEK6M~fvZlzMMrAj63miC7_#9krM_6D2)vM{E@(mqu8b-ru$3~bIjqVq z#k(if#hiQv`vMrj&slCk7yx})sExdE&{m|^h1y|R(R`ZVZwl3B`O$o8^EXBMX8Iw& zCJLhv(|WP&UclhBjFcCbrXb|o0L-nBqcE(9%#3fu7N2Ak*dm!+DicwYNv97TCKq}F z(>I}z(>a5mw`DW#IE~K*_hvZ)el|IUDyzI}N65Fv(8(WF+levlwy75)+kfbW?SzX} z;(UwnK3)>gv)aO#7e=-!flVPa<*v3N>4Tt1R!*QRz+7VjX1pN)y*O1njKq<`y z?K0lx1y#-oEHje0CsCaQiQg{klTHw>cH;ZObV?Zg9_e%G+-G(^Mf5+pMCJ4Ut!rNA z_5W{)&gp+<<5TXtot>T2%>RcJM%6lJ&E@~Yhkz1xsZ?H9K4r$fe99}unQvOz2un#0 z2xTmzOiA}xvC*uNIzmYVOK;UIz13H6mO!#rOUM#PN>wIHV9^|ZM_U5F64L4ki-5Nz zJeo%KJy@7hia+|O^7;8pAN=^_=reurQ&OtFlGE@NPrsMI(`e3eh)AJ%@$45)zR9ei zCgQ4Txr^E_@+9mNihA?*>6u1UpF;gc%SzfQ{`AbS{bHEB@UM|H4Df*V)_@mc71C*A zN&~fyIj)OU$ctg;g;*t#H8OG?Rs~-0I!=`e=ME%1ofF2MO`mBT`e?GuWr>eVG6EjI&31|J8^z2vtRi0;1bU^^JwS#iA z@Zj9I79v9`^|&D?>S;V-#Q=d`5s*w^RJo}+g!{GZm|BxG=oi)PG_ZJDPJAsZOX}gB zaZ;Vqvi_-ew)FH3c6Ek0rU_>rg<$!Cc8~VkFTi+(yky9M2GqS|6j@Bp<=_IuDGJDu zORoqpz<(I46SzR$0N$R}mM3RZ9VrNbBAGi1;iJQFm6W5mcbEk!D#e%gdb%LKL=*O; z6b-x%TjS}UJjQBvj7lkXJ>r1EMnj`QCt(g)or$-LcGYqPvX>T22~q65P7MIqtoSi_ z2vuCRvr4M&6Xpzw)y3QGyb}c|a;8Km*3&amEx}Fe@H4@*mbB!k*)2>LFxO$7W_j{i zb402m@^-KeUZcMi3(5<>L&8c}iNS?ciyT+=3>iAShg+9nT2RV+C5Ler9k>W$7_+xG zX5P-In$qz;ngyeDy=EvHCjgj1A&b&<);=MsVyj=eRt*kzfX6Dsjfj|6HJccqhf|ZX z3OJ*ZT_5zIv%(z;r{pch9%Rwaoze*wFAYR_5gE^LXU9;-wtN{Ypaj6# zr*dk|0~fnTir~FE(lYOfg|-ZMn$*(6R8}7*UxA_ohIsTYpaKh{)V1YVKsXmg7g2$| zq>iJ}XQ}z85G`pz_^&9x;z_L zzO2(WrTR0@+0Hs$p26CKDk`CV|96{m1P;p(ghuPtU1t4BOnR9R7) z&mq$$R3}$d`Nry#I#{@AJ`$;e^IrFt2iZjqebde@3~=)Vk?7sTQvKN}eFF_#<>Ie= z5-OkVh^{3jCsx{uRgt9n7H7vRAwjVqXXi^$T=^`)1VSPfu?sOmjgDTFh(w~Al=`y) z8Vx74x^PwD;5n2hc~#zR4u$Oeb@CkS<`Nc{Z`HaJ7P|%OBZO-g=PZ!;w(?B#Fa@cS zNcza+UeC{}Ms(N3lEkNGhesWuaAz<31doE4aYPb4=FgBctptyqpl5Te6)K(I(YuTb z<#&Vv0{ND_h0RjpMp2U>CvKD?vTzyACw1b>E)C+V_EUoYN2T*WLZD!8{>Roi|Bu=D zaEAc6o^WD+(O;GG4Jnxa5owM`#$Z_*O`$w>`{NNs$#DbPMc;wAktA){=^MqJfaPqQ zH2gC*I_DL**%H`pM1YznMl`ben4Ttk!jxQ+06)d`!vXtw05=|GOrOx40}yEihoLf! zi9sWbI%jNKfS@TOP4N-$0}m0FLE6G#uh;}XPLYcKzBVjm+7U~u<&#}e$cyEhNfC~l zYPue>Un)s7r2ut%TA5^J;^4xvW&6(FH?3T`68&QYG8XULlrv*zHTz^{giDt~nHe3` z1Wmn&s%t008EpIw8TzzF-ip@MMsuSI+_7TMvVQ@75F(bh~iYw<#B+@#Qk$TZ#!0)%b38 z4BW{ea9$pNJRZc;ogj(y!VMq9E_AZlk#z_`zu|d3tzGZw!==Ba3r4sNgoxJ|b%?xd zblIU*=tibuZh)1uprNL$S^_dh&6X)met$SB@vyrM@}s~VrA+&-8#g+tVW&Sdp-DGx zBrp68(TX@XR01&GWl`Ath1JReXZKkYI)4$l(sP;*x>t(@Uoot@xcv-l_|la$;XC@Q zzYhWC2T!!?(`>=<^t8=mxXRpk;I;41)w=Dwl%fI; za18&T;6~eJ5*vz`x%4pBaiW#LPq;E7U8ToZ%o6UQkCj9heSE-Y5zM_aQ?8aV(lv+4 zc_q5q@9gb9-_8gLKZdt=3=R+O>>cju>UGtV+&63yg&JBBXotbAZx*CCSf9AR7Gifo!xF#qbSN-9xlV~3&+%{Z zFe{E9xm|V~rX#TPBTTnVKMv?SHcyY0;)Q;!(Dy35=4j-G9Maikh;V9$hrS*k@+r=( z^)DpG&-o0^jNS^L{)?=QBZTb!oJFJX0Vo!Y(+L;FaKl#a`?XR`SjxD%p`Q^ozB_4* z*}2AjV~eyj%L2Q@Ng0F!BV`TB>-(?+<4p5lR&?#lI+@~Y->U^VLgY9&&goImHNh1< z;i_5CB_yXRt?l-;beb_)dbz5&iHsYQJVqQLN-3;dV8pP-`5mG;sax@JB}mF&6um^G zu{h*4tRJawlXi5VOXm7Zs@RQ%AWDouLvprD6*vL%!3z}M9FmKo)pffI0J9hXXiPFQ z0Ai&8kSzuPH+Y#D4AJ~BlzukBF57r`dWm>C zdUvoqBLKlg4Hzjas_EMCh0Y3W@Q!peTi%rEV!C=LA!_Qy7@dx)UJST4Jzc#^zD7!t z9XZpb=;_&o9BUAD^fuSv70TxLIc){~k#?kbnSM&~|2bR-&|?0d%~7BH?{oe?v+}Y1 zKT-GRc+SzEmGllO>ItfI<5sZ6xE!Q1HLYlSRmhhOc8G9f0P%IN1#!Av{-LTu_7%94 zr@i?(Ln3LT!_iqs%HPPx8IrPG*)yn^gQVA?5tMO-JQ{U_Y(M-5?Gl(hf8ud?B<)Ea zk1&r78TQ=AT-a+ZEPFp9c^w7rkFWYqG5()TM#%HS>!V2i$JW+XkN@Y|wd>~i|7?89 zc9ww;BSeb|H_@`j^K~qk7PF=0X%-l#2;xPsQmtU1wzf9f431gs`N))|ky^AG9I1Kk@Ny21V75PNSTryQ-gPRbHkP7U za}0%GdIGK;b&H0`*TLbM$XS4H6j7~lSlz(BIKzy*9A}ww2q&+*x?2O4NYDz^R5Nx1 z4s`o!s=>ZiCu~}0S;+N_s%K47kO=8D)z#)j)kQ|j_$5-x`Zy^eWdSQ~VPRJJ>I$x`S1qs1 zrAy+LwY9<8y|sHKHc2p&k5K}}2XWC^2D_LcrNc^WZRMHd=9~_SQ?^1`x)78w@Bzq$ zsv{Y~GuH${*A+Anm z69e-p6(Dm07dN134>Sd&wJMdv6^Oc11cMpvh-4yw5V+{lrb`--;RGlItUUe`iMVho z6c8I^Z3VHh+DMbkY)pstV0g;aWB?J@2uvyCU?5-*0?Ds%w@tMX96%Er0UdW%OXT7j zZDev>Pip)L^pA~^y~SA*^c8*MTupfUWF_sgAJM201?JjiLD-nb4#@i0GPJRt0J2eOYuli# zH{;`4O551h)U;m3PwqYugEjgvv-IgZz` z!qG;*ft4Y}S6BfIvsmc7J~xzwNee4DXJpB+DT6|NBPQz%z)xx_QdoUcJ&37SvT5H3 zDrhiQ(G%#F4P*njq;D%F3c#sA3z7*9^Esi*lRzunRr2Y=F=`;xO4~x#M22@IHO_F0 z;8X(VO^}zg0!ZZSD-p>_^$D9vkj~LT4_B^k@*c>VO6y6!xup#Y-$N{T@(=7~G7lnU z1v3v&8;Bi%{Vfp%2tT)If^7Z*8AhesRYpt6_3nwKOm|gxt+ZZPel`0wB5CSq63=xY5H) zS)3E`?w$&9kvZkW)y38%Z&GYb#D&9Cff_H}M5tkt9|`7c66CBGVD=@#;$4vgG3l%A z5?prPzA|=SEF^u#w;wWmrza-NS~`l@S3WvL`Hznh^3wH09l(fFsOilRTo|FVn?{P7+}@@ zb>NMNXtrp1C9#(M)e9f11~n*{^e=1^63-FGD>b(Xo0HjFwJ?#cZGp~WpsC4KjrMqQWjHNPi^>d5q_gHxy&zo=e79qID0UFBhcCSr z7+X*%&(tE^x6j)eJtEmKNLm!GAhI=EQXSu6!L~1U;H!P(zynyUj=K}Fo-|-q$5mch zZ-u%OBvIc6Hi*zigj0wxK6h1_S4b+Y{6*!CWYM%pf7B7y-IZT=Y;zQQlJs^(JF>Sy zPZj^}n7}W0Xdfm@?AF;meQWvk%uhIC$N0>*1yOaF?-?ri$fr~s`zo(pf=IYTEOLRw z4>s|;9YG8hy{j2#C0B^MgV&0ECt=?$F`b$j=GQRD$}uwoec=&DeQqFF**001NyK3? z9x%7h5GjL|si@|N%abr4)n0W_wRi=96I@f>*qC4cZg0QU`R)W(yY=IA{1H7(WEYD` zwqeB#(Nhh*4~FaBFe^w-?`bY2(>q~N2W8)k*$+ePo>;z4$#;vw2vj$R?VXhLt>kTi zS;OaPBcW%>k;cGv%Nm)DbC`UYW*@tplbA!oHUT@wFXx2iHZ^b#R?aOtqvu@OR7bTo z;CEIwr-kj;cuE5n=yWimkxA8TbqK6&%dZJSHDq5axAqw?ZSK8K0ttS}p$utJdj zVKLAL;IHDPPNW!Gl?(p@HK!Y6lzgQ%W=p+e7r{Zf}rNcYgrnt zSW|Pe5s;K>XrlR5Jy) z9OhV3W+z$}zX*I>yM~7Q`+9m@Npvzsl3|7UH|^@^9@^SDJiyN)P^Y`s{d$-9x^L%@ z`~4RFK1l0d#ma@yBZj#!0tt>nh&_gf3=z%n^<-Fzu*sc#;T_q8?8r~x(F5?0CX~!* zf<@*WO+-dPj&I1A&J(mZg#)ZP={(HZPoqwx4%_|Hyh6(wLDIP$sH(efc&K|v7a2u6 zdc{Hn;uPF7b4ZCe9HpTKm@90;Adr)-8q|F}yolWc5t>ND*(vCwA*Mm@;A+@oVdEx) z3f2)AQCPPiidOV&g`Atv1+{t~v*!t7=?&zmQdbAQ&S?XFc6Ij-4G6(U>{9kfu&Ad% z)NiDAA#)PS*wafo42npslV-YWU?3zRZc9(!U{|N)bI-h`!LOdisLD%%vAopRoS*J^ zBUkY{p_;PM-e>}iUbCZU#eshtvKjJcG9wWuG&2EC0u$t&#oi^192|YEO41z10whKN zGhTpp1kOOzC|F4v1_5_Oi>otOG2C+Tr(L*HEwl5Y3-qgZQJJg~;%0ZkN>Dq)&6~8G?pC#O5p^ zK(Dyw1eb6BA<=agiHf0Au=qs8nji!a=S$jZ_j#Wa3Iu~zqg{(E_DED)>k1ZvFw|KS z&eMIOItW-7&Jv7xHDL-sZj%{19&jea{mPFD) za|!a6kPZfNg{VnTQn0Z6Ae0fw1T+IgLdobE4HQl~$OJ_Cif2`GoCsEY5mF&0IM}_d zzq`LHtdK9m-P?L+E#O+^kw#;yiCCM3QNeYUp3Yf1jY5r(lzE6Kce|py344#d%aGMX zmJGxSV!4S?YU4kgsf{`E@cCvD` z!x*IP)twIWjkK zyJ&kcmf+es75g$&-prNC1!>3gEj3TaU^Il%Oj8}JMA9`eYPW=Rh*}HbifLq=q?V>( ziN&=`!$8>*MlmJ|D93(KdZBG&i|auUqK$FX%590!j_l@~$*2hVR}R-KvZaT_d3?*f z7`Gq)Hmeeg}AbK%7H|SpipHHE4efgH_2v^Mu8vH ztjuK>z#Gw+UnkY?k~hxb9(v}(cJn9qNzGw*Y^M$it1IN*rfDu2A*L#WN>8P44wdI0 z;yhBkvsZr$yXtJ}KiB27(?kKV>j}c4>hlcenMH1x7BZ7T?>J@VG$Poc4 z5s30TJy*vk==23?l-H0_N9tgp`)Hww^xxu{Jmz{)k=5RTIf^Q&vliAjONb;bZ|8^V zzt$V_E_PBn0i_)-Noype`2ASKC4H5$&K0}HN^AjFCTMkpKJhKCRoZ18bj_5Cgy@1w zd%GghipZXL0|X)!ER!g5TudNTf~4qBlCarIT`>Bk>;aE%B$TB9HGnHBB!$g(x3$kx_G6@0)u2cJ)>$Ibb?5 zOA7*%gG$Rm3>6KLLc=^YN8HFkxCiH`N*_0v7zILF9yNvb!j!rjFA-_*Q`p4J^6rbE zjCPnbjF7Ynk$79T4Xps&!VM}tTczU;}L4|ya6$YJSAfG%l(_fd?A?Rt4J zG0T`mHf9;qV`MV_vZtXmY2S~-O`BKEoZFDG`tTcZ+in*ul4p^d%yhNSNJf~sFi`qB znw`ZmKobSb(rUrOg1lCWu97jsy~+C>c&EJt^3%Mf?na50QN44($-BqmaSm(w5jq(F z+L!L;^6_C(I%_cM*T4I?Reow$rbX^WWMAb-(E9}1QO_R1Lw7SG`hq({{6Izp>g2m6M5`+7I`5aQ>_1*DpTv?kW5j8@r=%e0YhoJD*}iu1!o=~WvP2cJg- zo1MLbux@$E6l31nI$Q^3c9qCoE}p|i_#r~*=LL&JE+z8@V2dnma*n>k|g zmhRrJAyG*Ob^UlA>O`T$_%Ks@vr_E0tCU>EUBaJ@_+bE|YWZQH{k{~rGJIIEkn2=mXPr(siP4iPeyHlbrRwj9oP_v0Lle9Q*Y+_+j z?361^RuHXrV5?d$?vJ|RPF@N{d6G6)!cV;N*xoldM7YGz@YcSay`61#s1u9|0nTI? z_9GxznD7u~e6oEyMDre>@l<#$T^*gB1Kqtl2fLhc@C@#15^Un9z^x!>YQlJE&F(?a z9}Cr3aocR(Q=?C5f#~iYv zP0@9j{~_A8rjia>Wk=5D!A^zyE{*C*t^COn1+xac(Q;g+kjsLf6zJ*EXxR3gmdfSQ zx@jd?!BJ8oEyh8Hus9}}6fmYpP=&Xewp?A|$$+)M#6_4#yiAt;+@{PXFc~y?VM-4E zfI(qS4r0^Xa@E^1dBKWGGAWKi63iXJO>QNvS&0$e8#8W4vv)Yb$^F^Rd8BA}KY=Yb zI_hqVtURkpPeUo^xth(WP4I?Q9@^56rXv7MFs+UyAs+r1L|_?D5n4CF0WahM6Pvc; z8FYl>xt!2|lWmw{h9{o>F=M~88H21VQi6@Kkd)hr^NqRmPA`K`k^O&i7W}{0wlueT z_WxLPZvUT+&ym>Mcj@Vt=7J93N6fw3rg!Szy~c6xjzVI<=4e}U%j~*$=k??UGy?jR zgrS*mr;dhys(ogPL?VilU|2jaO?r;S?XNU1v|WQ8ogG6RWIokS)l%tcZ&%+yr!sjS zO(Hcw!=Pg{q#Ye^>VlWSX4Gja;#CQGO&S{{Ov1`#f}Yyomr46jT!xV=McsnndmZfQ z+kC-LSCCbU@Fr2i-wfB&+q?4@AWhcQ+2`egZN-YU6$^t9=~Joi!^soC~YAj2`FirnX2;X+BM{XNY+GAvP6sxerogdi~O8;6qr* zBVG1Jw^^IxD;RY=(6x-1}o&ZEmP8! z6Z$yBo7d4*_H&){Ij5gIUTBJ~4gQ_@9N1u4d)Yc*s+(CAjj#QJ)LL?B=}6h3&(5HYusE(A4yGgf^Zxk z#??$lOPiH&fJ|G8lvoB2;Yah1_t^D9G6Y%u~|pW z_r;D#+h8~Y&}KDshf$g1QUs7wPx`M1dWxb$5r+Dq^W*G=N+6fsohDlVtrwu4J-StI zve4@2_haP1cNlzG<)9vncEDovZ1~b9TJtDAk`WTxT%3sV$BD?p6JAj<4ayNRq9kPd zMT|J=k^ORUm@ar8tgPp>U7>=G(-0B~;$s__2``@1H5+RlufDSRSC_QutvAIXi5YFVZ0ysm)@hPHS2Zd34b4zj7* zN9nYpPLAf117Q}xJX^Lv1!{j#2hzr z$plSNpqdzvFgK<#pdxer>qn9Qy2H3!O_MfgY+>qd>h@}=FOnfm9PxGUUQPMyRlTvQ?+y#)Pm>0 z3K4eck&5P=wT}vC?HSO&+hw~{-aWS*j`(soN}aNE!+1}sX2&u@1`;D~C7sLBu(Gwg zuXl5IUs$Pwg0DtTYZ*_mBZ#M0xes;0yU(M<1)9B>r3>0ZF3hh4hh&1q!}dv@l>6jX zcSpo28FsiC`z3R|=nVXZ@p5;%Ud;&XG##5=y4zx&$Ig&Sa8riD{+`N(9hE1i;gnv? zPq|ufQs(I>^LQxNlxE(~ZE=cF4MekX2Hht`VdjuqJRuc*% zQeV;nX;*}9LQRq#mTZJM$Q$ZcWyjX;9$^Ix8HSQl(^Cp~3sB!mzgmuT=u{ohOe2?# zYYGHTHnM6~PfjVhv^t^cNz8cf3otiyaN6l3#7%i9O>GG3ys>;E?&ujH3;6=S+QK3( z)B<5?gVH#dyNzKtgpi~ub@{c>*)=!>%w(YJT&I;z4Qvq@B#fp#&u2Dc4% zUntDP4tg&RZa-*8=U0g!Z>VqRf_|Y|KQnDoCbMXKHxW4sP52X0k=p%R3yok@ zO#vMjZKXqO#qSgs=wMXf*P=2q<=~qZ2nag3LVH$6$$J)5CWz`ducKRF5?j`D(GT88siT(0S&ePE zTAKJEAP-}nD6%Y3Sn%3XlHdgrtPJ~hkX;K9E!6N*t)XNMOp$Hi(IpRK+|tv%!)IT` zyD8K3-Bt%L7$kG!+R!+mo4FCk{IKx0dS2H6V~8$7-=*U=7D*(N$^>$qnj;;p!4}ji7!svI(3mn@z(GSwQ9v?38Q= z9ijV3`&7T2J|+79S2F%jthpuTjsMd;=l?$&A0Gc_mnZ(ut|J=%r*Mn_U!Q#%0I2ol z9sr2D^;a?okP~NMl5Lyrm@u{i)(Hwj>EUpr#jr2T;9QCvvuiGL%&dP3@PCW!!cFDq z1DO1}HEZ(mfB3lg|C%+eYpRqr<>^r&+ua6@8f3$T?vupm>wl>ej z|C^Q15E#soGsuJv(cr*zS0U#FBZaZsfC3aVp4Btp776MD%b;#!j^9{PAIYlOsT$G@ zoaNv)l{81rMaij1P0i3a+rW4qpt053YEV{(=FRLxHbN**JbE=YvYxdpIcV5LbguFhI0vG&3eY)BG`QCZg2TY%`1msSw{CuIU8X zA@T~{kczE;5%DwaqwxA~ZH=|M_K69f3^^4Q&N_6V(dl(it_r zJE&&ILLp}L5HYO;xbs0g94$yzaNy!}AXG!-M4@#srY=M40rYlkQvzWHI$DW6u>*yP z{*^7XqG3j~y}A{2!!fC5)8&9;SI0nackebE5}zSwwUj}MPQNpu$e5WM;V314+XMMa z)S9cIh*F@)rL|@Qlwn065k}TXwxN-}sYD`d7~;DuwMX^f5g1Jn{^Y^W^sEVBbhhFs zVBv+;7~&Sbv*9}hrro$3`uMmO-_1?w&mVKS^}Ni}0aj4*VeH8PnnS{j8FHJJqe zgAl*>w^GV_QUmuQ(F~1L0qeH_AT%JqWhFp^2Sx+9iyrHCkW|MFIzVu>2LjqM z^W34iY;B!+Nby4A53$@k`wrzr?801792l0G^v5roLS-Y&5dtWcnE6mV&6GMCaSj=9 z>p5`wU~|C1sVUUAu{%$Hz5{23oCh<$5EP~w-!_VY$IBD~AkXxa)Tullc_DBkt&{~& z2oj%RD_)`|{~|A9%z*7(!<}85cW!ftf}*}Zsew|Ssb+e1b})?#Eez5y=;2ctNTY3Q z-Z-->2TKk(`n(~K+xy|lC_&B=CVf2vMhqq}D2T9;k7*W66xm?Jos&n%$g{h!l-O{3 z!RrX;niRrl25d%+FLBP`TN@1`=#T^5p_Pj+64^|iI{0{llGc+FrLf2JfYQdib3@W= zvcFo?a3L75;+e)Y;bTd43O2WFj%_NJTvEe}hoz_%5snEE;=(As*`ovcaiDckr9h4L zHR?)XDU<>k(h+S#z&H~PWTX?Ev*#ti@4J|43PJ3MDg^TEMdtyu-@{>L0>i4&7fQkq2@3SCSo5NZOG3!lc;f*dMvVAC9dA4dPOw1FtYM`- z06!=2Sv?E6F$UoWP;BsLHt;VZ)xS-evIh7So$X2?P~WR1g5Zk47M{Gosc4Mpc?snZ zp?Ew(#LgsCXlfOUWMbq!*^>0V3gUuExLG3j2lfWSw22T7FiChO;W%RDW~iJnOmE#O zpSoFB?G~t=RVTf*uaIkxOp!55Ra>Dd3WctklSOKdWMX0Rry2gVz@OF{#SC3W5Dp_2S}p!;mVdU$KU+imaDuLlbcr(_0^ZZHNF>ut{%axs zwb~rYXUhaCV?ziy^+{Kuc8TFqEa3Qs&Ya^&;T~w+=EJDl;#*h7P-!i-`nD8kPy?mZ zCvQgpyKn>o>6fek*!V{P+X19eeA>*Ow&1T8_Nx_twaUUK6Ow?VL+l$uJ@Ih{if~x4 z-_syjtdt|aRESZiW?a`{`4wXpWG2vTKNh87R}jfHjK-a_ugw{dsgNT?5d92dQBKa# zf~&ZC;YcLDD$${x&FhUO4I_)(NUTV!u_Yag+GOps6d5`DFCJ2!&hL!Y4e7uB;)~Pu ze8q5F%!KTL*hqb#8faNKW5Sf=r4{;eb_s5z#g<)7Od7i(j7@#Pt}nSHtTZ>k_^E?p5)l!SPQs!(nCTcpHFOGm^%V>c^4!>3 zWH((mH`tV2iuO6c>IH0A#Hd4#6bchTP{(@55TdN7*`j7d^t4GCTR3V6+08m; z*(#s4ql&Y-NVXEp^$1YwD~P|&fUQ=7uR6p#+ng1y0j7p!0`y$iOy?S+I{y6|oVo2lFpMK`H`eK5}F6J2)V zZ3NiSL@-2C=KwpD9tE2(ZE1#lqOx^`8V8ppma;1^f!KWl5<@;$@GuP{8jFePzPS<` zXH!*OWkpmE4FJVB!Wt&+HB}V=4`M z_aQi|PwJMH)EMp7`_4Tb01E^RPNGUev*<-)V47PFVV_`);F3Q?MElG!FnwUUv;df- zIw6=<1r$z-tfH{ToLBE9ne}+>NX87yA}{JGPU|CrPC_tuU^6W?0`a)&1CaNd#<=?km|l_$Rm&1t2yW1`A!_`Ep2pM^952>Ak8Ml^HQ8j2Y+v*V^*{}Y zBs*eQx1}BG=7KRA$W*|sRP=cDsml(4H){Ylo z>}FIYL|LSfEBBRDpTelK2r+t^th=^~S|m{U(3Z3rU+~x%c~c}PK@b5Tb#HnMf&f`8 z_I;>Lk!VJy1kA<}0K?lTgeDbH0R_d1`SpzAAtWYNiL<_Bsh72nK@{NB;7BL57`GM? zr^KeEu**Q15`&y1MG4lLaKoT6Li2+h66r~luB=y@J&jw2u^YBunxW0G!;%MU$FK*B z-(X1Vjd4N4NK}qa*w$8zPHvXd(Y%YIDN+DNk>4ab!CN_ z0}{KLZ^~h;H17+wQy0;h$hY_IK0xbqxiW-F_exNDU3OrUZYIUa>WE}Kwv?XjHOi3APe&142N8np}xSA~bZV19=Dt(&E{ZtJ6*O_@?)rH+$gOlFAJ9#TA{$Y2?w4rEFI2hiLA zrK!;~HL&G|G%hhS~(x26|^O&rIdPHlGrT*J!>O$Z8gw0bW$|}k2<>Iwp=xSy zM+z|S2F2(|(K+jRY==L-JIzOUwm9Ux7yZ(9rz9=L%qy}&p`VL#!q62mq7LN&fv zM1kJMBEyxE7YB!nFz3o%`VHAH>}Tv+)cIiCSDe6pfk zOCXf>>KEL1tDdt4YmAD8{Ol+7+Wd>3T5jjAy| z6xO^;spdXNv$~x8aZe}p+|nh7Yh29|h_x(U$Z$X$?|_*1$vV%YW{@de&sw8rdF!4T zjh%It&r^DFP+DoT>I@?%fc2$KfgAYCvvX>ezu<%8=p)UX-0+eLk&l zNv#Ob?qYf1b{A{$2i>Qbz!O|{Wo~@?nYQ^rU#M7fX~hKSixeviy$k($%t?!np}-^* zDVcvHg{H!F!-63n^t4hNX&yBLVZVDCJav!*&XJC9H1{d|DJA|FkI^>MK8nTvTie{? ziT?%hALrtKRsQ3S{1xP(ze4Q=Vt=*!2mflXVR7{~xUT9@Q7u?8lE$fy08|R?H7>OV zJK);}xTDr`^(HIkbS8uX4om>C2@)0h< z)C5H841$s(R8vh=dEk?(8xhEu6r=(B1KANGzEm@-w^6D&Wahoxin`i~OgGvF4YS|` z)uZ<9yPep|W$J6{DLtuXgVfnoD98LLj7cra#St2Y4y}m6zx;*orTYbF!(-7~{Jsy?Ubw#XZlu3VwvAj~;otZ0W6W_Ez0y41+(W90Ok zL?+B80Sil4*EH(_n)=(N#I_(>9B=6A4MKUrVv~ZRn`~ruXgF%5DcC~ThJ3X1ZKTuT zZS03hw+nTWd|{6u?i_3e&_azMesvHu@-C%WD!vYGYGV2_s%+8kqk4x5mipx%r=kkN^CSWXnkcGnoH1Yv$Jf ztbFp$Kl#-dYd$kFrjH(OABE-rSai+WR(JgWmgc$m-?Q@B*1h%2b?W}A{Z%i*&umrI zL{-%lRaN_zEV;V6`pv0S$}~;OvZkh{uDa@~dGq!!TzFvV(rb@7=DOpLzvhG!-g4Y= z*DqiGme;=at;?6+aMDRPzV3Bzd;RO*{)RWa^VCz{v2x|RYHQye2;5X#dvhrCo>1u4 zaQK!rYu+D=y?5=}55!`(wYA;e*7l)|8$Y~x^G7>7KeBoA!R^~WcFs8;+p**Bo}Q2O z_kUt&=;P;}d(W<2_g-+pKU{d>r!Kwp(-&WS?`4;LW@P04v9bGg{ejCbf50$4pG^MK zo;{zRnE0|~eQ|2)%U53cl{dfnt5;wBmAAh2tp^SqxZ#Ey-ucdV-g@h;AN=44Kl;&+ z?%)5_g9i`ZefQn>-h1z-KmF+k9(dsMpa1+9zxc%mAAIoIYae>+TfcVWjbDG;+rIIx zcYX7wn;v=3dmer7d%yjG4}9kXANW5X{pk1ZxZ`_w-ud|5cmLZbKl#KbKl$W8{^Jks zzyF8#-~ZG<|MQQ&{N%ac%p+i4^?6Jpw@Pi-x_{Tr~ z=}*b4ryqIbmybO1?6!J`t04`d4IIF`EA|iFFzDGaCzjq zhg$~vKD_Xx+8b8<@o{C7`HN!%k3M(qIomfa+InvEHP3wPu7%Gi{g*AAchWU|E0lBR zcP)Qpi+00LZaVO>n%leP-|^Yg&(NxG{m}dcE62^7&RMal`aRL(?z-XJ!D|jY{iy@* zx$dz;_x9HR>gH!QZQB2x_b(cH>X}d6ed5CHx1WC2)1wDhoU!D?>ks_$e?|^2+2O6i^rDTSoP&4 z&;8(~i`FgpNz>^s-I3V%$Yt3B+it&YDDl3PffMFE`1g-|b>H9qP!;aqxV&ds|B3|z zOaE!{{BM7_bLooY>CbMy>X^rVeel|27e0M$Uv21)pKaZ%nt25S1>zhc$E z8U5Ft*4y#@uB-m?&rkjIsy|g9yuQ2l`TAui?pZpt@XhMu*RQy7$)T0~t4@9L*9Z6g zc~5;+jZ*u$TQ{Ya?d@N&NPa zc{tv?=$h+J>w9wH_m7$X=(@UhG#0rwyLk)aN1SX&t5-oc=>e;Pdsuwy*m7H&1%}4L?~~eeXY=)OzRg zl{L5Sdh8!hzWU4?KDp%kHPvs7FI~B%`t+fy4&(TtLmk!4OII#_<1gACe&n_%-f+P` zZhiMDHy`ZSea6$j>|Jou3vW5LYou;})o0fJ%YE7xRpsj^zhzV6h6SJbX4^le=Uazv ze$BSi&sZ|QukF@HPi|<UUwg*MZ*1>hR`vD9-~FZe!9V@6&a7JT+@Wp%aPyOg?);{@^|U)O|9alT zi}x=)?mhc&IOdNl7tH(Oxwr56-uf3`S9kXpzjfbRU)ntSpX+l^^B%N1J-x{I35!?bDks-G0+) z3#_l7I`QC-7gfzW`MWEIwtnP&^B=rq-nHhRw}Y#uM5{lt4VeRAKDk(%$kYa(FH|H9M9F5mfF zRr0^U|KQ3AvGTyCz=+F`+@%MRS~;vKJF zz3QRs7oPa&8B>{^zx!JKH@~abA7?)Mqhk;K`Ly{@-?1`x)j3Pgocwloz?iq9=Hpj} zFMH#>8!o$f>7K98OLyPA=KLFXf9Ag?*z)t+&}!k5OM`rkhT;P0ObK5^5j)#IleIPcjr*DltNKcjl$*zOwZ!l9eK z`RGk2o%`GQO;^mnzJFz6^UN={DgXYJ zeRsa+qd)#u)#-0K=bY%);F8|&FMm9+dC~g=cP&48lXAh-1t0zVc@OXY`OWWJbmu+G z);)VquzLH@=IYh?S22|w*9s9m)x}E-N)XU_`j=ax4d)pw=R9(pYA;Mo>TNY zKKqtmzYyAd$Bn_r`zx*%^Ng?LY2+=iTy~cXqz^KQH>|#QgK#m05QF zw%$!UhwJoDJ^SbIBWEnT{>(sDx#6~s9{tM4SA@@4R*)vPJ@@#Pd(D>`l`pn}$`u*U?zH!PO$G>@U<=?*e=lB2iNA+i}`q8(wpVsc^ z+x_`%?ayDi{Dt}E8=K#9&&MY}U-h{+eB#&t``Eebp8DqY&1%hCKK13L-)dfYZKiSf zz=q%c?conRRdZd{qTtid#=0*1@y#24TeUHBZNs>FOwTk|>dFjIFFOQ=HRk39*Zt~L)C#}9$R(kJ8!A4x~$>ZrPpdpS4KX#>_30|`1e2j z%{^`&4 z{qaxU`1=QLGyZq``9J)>#+k~=udjOg@dd$6uYJp9|Ml}tPru{Td7ZmYzO&`RUH|+2 zw|(SG-yHkdhZl@}xMM8W88|-n$?Ic>{&4GO>VAIK{J<9j*F8J$b8DadUGIN?`SZd5 zdNO|KbG7&F{Q1I7ckcYesarSPS@p!-lfV4YhyV7CKP|fA-lnR*{Nmy}Ci-tU_lwuH zB$t2t=bwDt*A_oZ>n3bZz64^BVg1eC1O^A6(Ws zb=SB0{_yN~R=x3KKX~iaRgdoax2p4&UBBV!&%JlcvMX-=x2nK8xxz+lV#liv1RZ2tZIH~+`@yvGLn&s}tPFmZyiG;s667v8t*@Bi^8^O1Q! z`dsSJDepM3YTnr&yYQX&&3m}Ds%qJ$dmas}*x!3`Rn@D*;HeJx)@wSsb{`%3elgvYJIr;H-eExH%%~!N1?%uhgKX%F2mgxOUGKoc< z%Cc~<>J3Xzdh4bom*2D`Gqfala<$RF==djJ zS?}a|&n1>U9?YKeXl%_*TSlT)p-s!KUY0)Qv8u1!vg}QVh6D3X>ZscK#)I>N2j`zR z_1^PueD5DmS@qiei{7lf;ik)$jvt(V>=X0O>)x?`Rn;3d#eVV3(rc8(b%&x0HZ9ED zwK)2ks(E)UyZr0csy**mRo8ODYi_$HblYc7dgCci&wG8nJ|(6ZwBd8a=1wg+B#^U`^XzNRg|_OVlrJ+N=jl9qQ(+*_ZD*f3j=$XaBk`d*jhK& z?sduIbIFOj&rt5$6}Y^9*p+win>t3_+J16y@ zd*?{isnwtT!cAAc@1yg7^|sf&uK(KT>jQTz-M#;&-=28(Prm=*#TRDI&)kxIY~j-C z+m~$m=*3$WFWle0{KB1|`Q_{9Z>k!}+){tXj_Y&!-h=bzKXqx>NxPR{Gfx}%$f|jZ zst+Cf#4StXk9_#|Q}OTKcv@qorL%3tyPsdU_m9gydCNQA@s|%Ro4;e(!QCf3w6r&K z_qor6uU8hl{jY(a|5g81T~$mOKH>g_H8*`oyZk+SzS#22uRiwd!)?d3%pY2^{NV$4 z)&H^ar4@S?PyWN$UtaT}TL;&CVP#eO+T{!0^VT2!^_>e>EweT)SoVDDo~0kUFWd3i zEepP|ZuxbaJ|3R8wEF2=R~%Rx{Mc=`|Mv9{KGb&KsV%!!RW0jpxnb8QPKYhtx_@DP z+xqzjmTFZC>o)a&`!CVG-;ADk+5AoYi`(@ZzjFJE>y|D0-f!<+@c7az`xjsE{DL!= zEoi)N{_5xFuX}#Mt~1{AWX~!ZJDwkFyFc-#zq}?pZ~N>1 zxN!0FJAQl4o3{VpGxIwZec+x?zvHHry_-H!_4a$$tsGx-|KhuDzwg>RUX$)$Sbfu{ zmwj+qR{6{s9ZR=GPdxR?`+Lq^SfecZx4ISY*tDqjn9nYLXzA|g*r|W{^YV8bTD;)i z&#qX$7)X=D`J}##FlnFy)bjr1DmcKNj|->{hCt- z?pvICY;oe-i_f`fVc>7~?Ko}4#=w$on}XE`@7(>^!okNDFZuU>zWmFdOaAzC>A!vM z|DC$5s{M$bab2Ih`airwi;P>TMF})EHSKEI($v&B)Tx}meP~CI5{pEYK`X1rt)`}~UcB}Wj9XTwt*L2p zaxya65;3x4O+y1sd!eBi)MQ^9O{^A4Sc$;Kn)UDu{?XLLM!d3JZ|PQ2+qh+0cTY}j zQ^vHcS{ILN2|d|fr&@Y4p|u-ILbDT*X4I^zsLC#FM9G=p?g^=i);G~sXp2cby<5p@ z$qfP1no4TsxTaYFWjw2mZV-W{#GlC;mumz*fS(Y5ByO4kjFz$?U}<};Civa7v8H-G zTsJFFy%B7sCN>1N7->sOTa81cZ~*O($S+n4hS{!w*MX^78+HzDZ9EfNS>HqlzJA0= zOl_>GS)b4+6g{y4+&L^&Pit9%qiW|d0WOh?Tkz2RY&dC*8G()K)e;6qis`8_MNJa$ zdPp@(&lq3g0A0vO*)U9tCAr zl8Oae08f^j8Q3_8|CUwYYeJiaV;c%9boeFH+PQKI`bj)Ps8l_d&(`a5| z=_7hlw@5SH;)8@r=DxIs;#oox78&%GY@J4-Ais@LYr{H%1+!I6YOp2^(=~$iO>C0c z1F5Byn$D?7Y$~vE2mXM{`KMc`Ku|!40|ssZHF{{fzyRb{$gC%mj7Gchmv^C**cd^; zs7{vu7W_Bov*Jo@h%L&%MzUCxLHeV_s*vc53`b*?`_-|6q##xW7C_jpmL+xj)oh&_ z*R%0<@+9k`hk}zz{%Bb(9oN{r4#4j^4ckh`b+zye%e7Yl|3-MWs3RK3Cfdao7?Z0F zwpEw~m>?FZ%Q5;dG)u0wGg&QD8lqhlC)BJC##98V^T^jamG(WM>87()l-?ZL#0`%V zzMX`yvKxo8szv59ZQ=0X?KEH;(Z&hiHnKp-DKJLmElnS;Ts9du5*oCW&`0&SKl*nL z^pxJDn%hfQoJyeEnoHZw8MHagRQUVp%m%Wwz{a|6It%H99@ohJJ*tjyrf9iYbHO!0 z^R(-l$=1MTeI%(HmKImd!sIVkB&2KX)`3R0&@Tl>_Eguasc6$JHz{OfdTn=Yi3p^0&HBv7K1SpUpL!*iQWZijSzHFHvL~l087-TF@R)=(lLJkLFJG_- zHBp92=xNSB3Duj5rVvi6XL3nWT!nCvgeUqf1+sM;CfMyODNV;G;0KgT@*c9ffgMB? z8%_?3sR0AeDhBuuI&0QsZE6r6l}j391SnX~8Au6gn%Gg^vw%E2h>jBnsRM;XC}3*o z2_re7+x$k&km)5YOi)-AEd|14q^4#k!DND9V?rf}9MjSQuXE6Ck{@w3LplLD2HP8f z$N)MF4crX$1VIl9ssu>=3NpHga-I=qdkjGy)?!d;Su%eDL;ws&9EiN+rPLBR%^Yr zP_3fgTBt9s){08iYHjgxwchsHJKr}m=gc{K&SnE@A9vIKFxj0mXXcx4zWL^R{6EI; zUWw31*bU@MIb@8{u}eeqg-#9a7rLd>Co#oK7bY zVwc@OT)(R97iqE>0YJeB zwkCo$ThSn+tRa(-Yd|PL_Jtf(K=7zg4-{_8_zNQ^$Y}HUTlJ$Z&5k?CKAj+{q59d3H!-3kA%DY^)dZO{a1SRE z-*W*Ow_G1yNYpN0q|;#*Rcb7z*os23V@X$JOd!Yr>yYxd!s$-9)IxHyVnn8#DTByU zY~D2!^rKmnXUjs-GF;Mt;x3&z0l(4LTK1DIBU5P>ZiUP&1t+bdY+_Oi){_qfbWa%0 zorEw6fW=Y{cY?z7DyAI5^ymcZ)lMr1)PW*Ic!20(ogpP|!vpl87+JuW22U%d6P)Sq z4$tw&1m%HD4^e0UKiW;VP^rz+3p5ld>1`T%#*u9khN8`M#bm!4r<*gNu*0XqP9~7q z!(P!6f)XS3MfD`Q6S)>?L2|QI?C41d zKGKoQBfuf)_bP6!3aatMf}s?hl7Bf|C6)U_Fy1E?(aoCH!0O`@!+MdH#kgRrO)BIgAcg`(&~nNL+*a?o|k zAwEpBs?sORq$)K6K=_K(t6`%_@hh!{sv5PibFhQ4HIBL?kuzPWJ=%$_xE$(`1G05S z8W~tS-N@V=!_Hor43Y>2S?g`gPIjEb9$W)iEo$`Wki#$%M)!6?AUF{@>GijCTI~~X zqy>~ts>o>xqMQfg#!;-|?ZxQa;mS?(g}E7|#C#5#zhq+)ScmRhGyCh7OlX&6&2(1d z3^vwxp;^$IIK52`(vksTJb+^gVZT-tL_JQsNo`ePgtO|D7}*n{U|92atn^6UNI)Nu zR3#H>)ec9t)S`wtWi_cL5!7T&4apwZqbfrADQQdSl39)L2YI)kph;c{g(hBHlUYO` zlKl-vzfnjE&fCvyH~|^wnqu%0-tmYYNIs*f;-=HwB%!@Tx1Y;xZ~h=E0Q1yDjPx{z z_uonmjCr!=Cl{qi2i~Tu$!(e(LoEq1Rk#Z$-9lCCs*wp2ZHU|?V5v~t*pRgi1TUFk zu$|~yp)xX+vR1G(=>vgprE2;$kl2%=uV6%pmbI&$qziIz&Z(>SHR2A2Qz>M>to}%J zIc;85-?*G{JXbcHSa-4`>pId_B8wP}6WOYhX;Rrly6IVu9>Uu??|={vwI|4Z9gs^p zR20DGn;SW^$PU!}rq<+M5+gS~zVIqlX*4L#OcoLJTJzmAV*CnAW~1h-gaLzW_oYD^ za(eZ)tF=U|J(!?dj)+sjL&?qrruw5=MPx3`{S~ztgZ;Q5AQv*ihI5GOrUVI9XTu#7 z7}qQcLVRkGplWx+1)d;xsrH!MRu)b8$CGy4x)6mMXsU zohhXvNvXaZM(tFM7`vT_bi=%*F#`!1YCJ(ELryDpS%-biy@ha#?@&Ua;+d^6X~Hb2 zQPn3E2GCr{PWA_*02Z9I`wdHj!F+VNxn%K12;bI{;VLl?nnXw^M79vxCW!D2z->sd z$BD+C1fGd0?$FQ^Q;u~(WmbkJl~thHGf{E_L$b{iR$`PV2^%OHIm>mPrn^Q{+TkKj zc82K@q?DP*siCH{O!6i3KfFMObDy3r+`c8ln!v=`0dZNu6ItQLF~*cynMpIWoQ>R1 z2MlBO)iEnjqjBD&vK@>d{!p^W_DE!CF$G2>=qCTTYpA# zrOi2ogNdt@cbk<2oDeWylZjIxN|5>>;5t*x4LBBiFt_?LW3c60^h;ap#N^OUP)C0> z$*GU1>12d49%zBJ{Z327f~Qg?CdNGc=*Ulw%cuh;qrHr$Q5oeWG#bE&?&##R1+FeG zkvf!Mdk1MTsiH($5e&pTPA!=>twiFH0Z}$mEi8vZvqskirb~t!*3(J4oP8$924ICS8l-iXDtSmI!d-*#E0af- z4UhLA?4^W;d=36}87;1H<{F^Hl6=6xZGuo1WIXd9GDji$pz&EH(ix<2i+<|~FV(iR zG=isrww0Z)uX?y1Es!qj3tewCi?KD2P#_}*E zp#6*u#X-4~$F|33u>L%Nz#I&FBw&Z6MGGiVHK?)hoj_t$5N-2ux!u|;Xl+8T;u=D0 zqu~T=OFzVRfWIO@T|S4riUBg?xRS;q(uQ;m(_cJamvMabzCw~aU|wu=Khd^bU0tkc zX&G~`q@J%H3_?g_jr%kd01W*!lz_BkwjG)DE+vi@t0v+AI!kC3#8o1{5G}YZ*mYiS zMC0S3f|tG~F1Y-;0fNaP`W}Nb&|_!Ii}4a-*nawwYL1UZq6Xto#Z17s3h9F9QyD9(zGU z!-Ac%R?0R`Lo0?>pa#>yH3Rh4hOs@2FIj`04t^~o^hU$j8%>(2glBQI;h7W2A7op@ zX9@BSs7FUX6C98b{TrrHBZ68q1IA1b9F2SX;_P}zc2f{gtjYJ`R^y=WrB85%r6DI$ z?i;51(p|&U-#+O%w6dDBxM8m-!*-Ipmz^?4A*+hfubO6dOPj*#%A{sF)G33PRK<8; z7W*HTY~M{+iSj5>4Y_|C<5?+>(K71l4^W7s^+S9n>(moyf?EHX5SDF1$ zii2Ve%*`UjSzs%iYN#!@lYb%*3kFXGA$LKAGeY(t3^y5DKpw9tTy1u|GX?@kc)g(8 zEbAv2sv+ph)F|L!#W|dFiL5~yY$7a`1BmLiEZ+hjonV17^o) zFp%!aX&D%V^~ffXatUMyAQ_L>w?1QcChgc(zqa>XBBx zO1~;1*+H3#K)|zQ@=D6dtLZ(HVir)2A&qH3vtH-nO>h56IA1v_F4jRF^hx9f!=wc> zSO{7;N?F^K6DpQz$d(-CjtNcDlgETiv*a6FK(|BK2+glqpu-ZF9im5$YxPNW_B{&J9O!h-c7>s{>z3P2*%Qxo7i4*N9A}&x;J0) zfFd}*RE(ciW2R8MG=wI+GD&PE*>+GeSl`$u%`p>(B$;i-nNXxuKPlpW3_JK?zM~iX z_sQkuR{W=_xlcAYk|p0iurLy;+YN(as#f0df&io&=!QeM!y{39xB2R5Jmx(su&S# z08{|5Hsq?KQpZ}EXiPAiZZUNw(GUr#!S3qhdD9c!$1YE(@fm(KN;K@YIQ4r1kJx|9uIASLpsv=HPfVy=%4J53#AbdcPrJ{PInVxkC zBsXxaT9+z_j|JQdYGo`2&Ns01Yf(j$Y4lnc+;c4c4UBs@!{90#agOf;Yc64b6*3(; z(Ib#St#k$31zo_H2I<-(5%H*s^8oiY%ZStzef*e-sK3yIP-K{Y>o=*eWYkNk(?x() zW8r?9$V}XP- zzz#TRJQxF|mJUTS?;e99jRxAC299MS#mS%)F#2PZrD)x5Ckjm>7>BE>&bm=Ru%nJo z$Y70hP@k7Bo1&QbuEmXMK+doTmK8|3l7K=2GnOGEn2O$J))D=ylyZAKMz(LLLyj@~ zGH-6Is-!Rjw;8$|*55X_d1PD0z zO;3m>ziap@t|8gq69^x7DuhR4CVJt)!^iKz6l(*7MP?M&a1j*CRF}#|bR|XxK>V20 zCa+?anpmn(1VLEku`*fKPT*2>H=<9<58eZtP!s`9&u+i^gMf*GsqV?l1I{oS zD}ppPAWJYp0y4`rjGr+Pf)I#&iC`RnLDU{WI>#ZZMkG?1FtFx^IW3F4O+IO?kL}7i z4NdjFs=De1#y|B9lCQbNOaAuFljbk*!C!R?eNFURkJL;)uJJZ`>s#u)%~G|GwDHa* z?V6;Py2b{NRL#fh6PgHJj;h3sjj|i?t;4d>IT~7+`4(>^RZQos$NPM z@+IlO^t!5sdA_EqI`7=Nvu&GK`^bQjz95oi!94PKi?3;3T|LaMVfN`hGBGkuq6F#9 z>gwk-B|lvTw5Y0Us#;Lr+%ndS%u-LrAbIE3ESTq&8k!~Vf|iCRA5ONR8DCUSKOnEF zYG^#GsjjBBh0L_ccvn?JeREy4uZfJNSt3mv$=_qWlt>GGb5yxL}b65*couy?_2rF`2RBgzfAsr#uJ$F1UjV2a^GLC z8L}A%V8#KMaR6o|w|b1=;ZlKJ2~TPX*pG@B5TDMuAw?50Rtu(2hlb=X3q?!Iqy<>X zh4rX=Z4jz}43s5?(IN@$a%oRUqITj-To7JoEhp_ko z42GiB!YECyTp`9Et_Rd{8tjobsP7KI;dL2!HSdXI#x6%w&^Mp`IBP*2h2CH!V zX{8I~8CHMbvxoCrLm#6BeBW7SijABEr0Cy8@e@~&S8VEAkrOHy2vShrKms>Rm{tU6 zkRl=mdoa?5Wf?>{z^JN&m}7Ab;aqX2I)F=YUr?qG!Ojr7ASB{$FG#cD<*TrGi4bLg zJlZCcBZ%gkTWVo}^k5xwFFhHuKS*UJ1M*d=4^DJ%L&%JbsXeC7OpDJ-!;oDH-uNgO z>;r09a(%6&F<8)q`CAEJP+1N>NLE5gmRPkG;SmAvKOU1K8qC6^r&CIpioPfk1^>ax zD4K1ZFgPu$5e1zb!5}(3hEH2KWz~dn%9#R^Xi$Lui1B_qA48XTPQ_ADc*oLo>y!GgL9=$Q91!KJ^H6mKLc9X03-EftjU*m zvUw?~obT|+VEFuaG8w8~8IsNsL7Syvqo&9v6{FE2JS&szQC;guggA>QL3*Q!fdVl( zn;DYU66zsvEs~t)LRe0k$&ntGOX>(A1@QtF7_Bzj8ydAVVnq~szBy9b0>5F1C!%c` z#kcg`;a5Ydp9Ssc`y-TSmtzJL!rTSk#f{#US`%g#FKr0J!9sYpu}y+tQJ_o)uYqD; zv&{);i=3$xh+a55=&_a1D2$TRlZI^K;ShF(P4MckpY9qz&}qJCa`6R(k{BjQ zY82y4@5{IpMa1$X$r-uyrD%;ncd(c(YW-TM@*=tQ#;k>G!bk^IiD*WDV?%R`Q|3AB zGCY(pzKE`4oc16T356bdTUSkqhvlwdBnqJcmIPq^oAd}wAHYhD6r(7)H~ytq1Skbj zybvJ=iWiYN0GXnjzHEu#=iQ(s9M@4+DOL?ud;s;1OV&74@>0{^H0CsR>z*;^w5LPl zWT+EspBCH`gV5|UYd>K@L*f`Mq^%vkfT9D1r3EygXkk^qWw1b0KrD;Juttg%c7Q!- z1@#fmN~=*6=4NXc<%eahepiZfi?tIKc;uh8GZ-oJvI zivb!FmnwW@h|1)lMUCx7!+|33ZU7t$o=-FKgLzHh-eP?T z#lMoUUL>EG5&<}kIwYBHk@7%68X0wf@nYVLUmz*SE7PuWNjf5;B3LRo-IHcQv8mD30xObVY3~kB|TM=&9XxgCn!x%q) z(fr8cY9lmk++?B_tSb<%uNhbS5EX(BK{BcAnHG8(w2%=+IHEaSZ75d=%DxaLZ=e~1 z9hSwbt2lAPi0zRU!9P{a&CHx_qBYn91=9lVd$m;|!T?lMq_-LaKs_*M$JjBTQruOf zGQ;_V#+q!@Wut~*B^aalt=vG^t2Z|ZFo-!(;4%ybMGw;)JVLjQy&C>q8#gY+NCYDi zC!CGt2v03$*LT*|`6V&TK%2>RQE3CfW#HE2~ne&>F)+Mu$#_?X++s3h0O0;? z2CBnB}?YXAW>b%frKb4uh3-B?~Mo6rEA&f>LUL&6q@BcWJ&cdG|Tzqa~~|)z(RS z_ar&7gd`#}7NN5)M#o_-Hp`8Db)ZS=o)k7ydQ&i%3-|<_i~_5OrzAthVs~r(#H1TW zi;ErtNLmB4E*Ps*Igps&k6DNH8=r!pmP}k3<4czmFgt;QupDSk>p(4lI%~jGYJ%>A zhr)>f)z@SqLfJ;4el1fB53MN=8C+65xQ;O4&SM;eMB6}wEdzAR(6jB>$n36WOJ+#d zL_B72rQviWDxSWv!zy8X8P2BwrtWkqt2|tT$12CV^Nj`R#MBUOe@}9GV&DuFPcM2O zfpjvN91O{4c%Owvey~jfV=5JyjZ~MA}0^tz(=N?@%ISo43alB@QTK+?vnNFZO7 zbmK%hH?CBYlD}lKYn(|!j3IpaX>slFCe3ZKL5LNif(hE0+OYb=nkL+r1TBo`XZIS5 zXW7T*I4lp8r3Ln28Ucd&qveZ8nM6q3%_#BQ^P z2!2|AsbRiaex*q#dW1Q!+`P9^l&HovhlnnHYw8gmswu#O88u9fQd-7t^LCG*_oc7d=RYg}9LMVDe`2{mi&ef`?MaXr}6}Q}+(hE(%LX z4VcT1;B}Ew6%SY)p51)DQe%PU82928<3;*@&59Zjsv$E(0gZk@x2!4Pg9jkkordOf z5UvAAHL$o7t|Wt^2Wya*?&VsxQ>hCwsxS>#_t;0pSfW(uC6GJWh1d^#QPLK*xlBM0 z263xEFr^O@FYy>2mAkMMhl!D)5tRcW@R`5YypzE9tI}|!gel^T@GDUbc(@p+iHRMY z*puAn0<>auP_uTBrbo>vQ*jzOP*BeMJIJw1h5Ttk*$M~8LL=Y5d{bCBKc#)#@;X$0 zA}Y0K$d+jf3aYNxO5hV^^`s-JzWV?VfZABl6C1%WC7~k680(A2h~+t~Hd8S?Ays{L zGbvBScPL#D-JLZwC4*$j+skb>NKgB`*(l2@gO(g3HZo>Vg4 zI51;8CWHz&7K+m*ud?y18ymVkq_)Cd7KrcRXCb{ez^P%u;lNYf>3l?4OD}E7XQHJa z!L`dTqWVT=*Hck$!J#LI^s`H1b|(m|ffsVcGhiRf0!jo%f*IC#u-V2{@s6YmGt?(x zJyYIql1v`35&so0IH&b$v|;;B?`#bJurHPy_?2Bb9J@=;dLv#syew3hS?ze_u&^J5 z3MYuk_#?{Stp#- zs>EqH`JfAf3ILYIjOfANFUjJCyd8)Y5L3 zO5o%p|HdFDHeyT(J{9(YZ031x$s?^%*vZT`#I*9h3Af%vgGl>BlMlw;@1@Va3JLLA zD_R5KUfV=26sZ1ggjzEg zp4njd1rgNEIFk}lNR8IS+EL8t3bchSjoy%mo^9>qviK(ZxAXL!bJEt zW|_eCG9awbm}A%-9B(v6pqj&bjA%RkRfG<$E8}RvO4+YtpKz7X1AyQjA#|QpI)hfq z;N}-z7X|>tXlOpwTDdSFOcjO#0SejZ+hFDE6ey=x zzndY^lrQmqW*)t2V{au_K#0!=Ga3i^r1BmR>)M&q#F(F^|5)bhzm^>pOw3xz%7{rg5*=}DLS)utRV27gdVAKz%#nFmlSTwnFLub|!!Nw_| z0l<9qyn+c1C3;QmBsVDDSP=kz>8(sV#t>m(p=J7DRN~q>bVMzYEcTcil=Q0Ss0}Ol zQt}%sx9jC-FM1_kQ=AjCp7R_#`jVuo=v>dX4sZs0jLp;LNj4a}hYzC^bg!$ymx2Bl zLYYH}Ltln=vUe0iZA?`a99AqMs32%L<`!Wg22{^BN^{Mjf;{=}T-7hfd1%Wat*|K% zMqDXwtWO#c57I>%>Od4wu?0CWt!1=XLNQs#aT)bSy%vC{tLK=-V@gSITWLI9(l5Kr zZhPpw2}*uU0Y%+$TD*zmCg-;Y)=fLq+0k5CHKur6Twd3{CG2Jyqa- z>qH=;n6ZO|nFUmoFD%T*oixr;bA56)9W{y%hiIiGmFuPm8%Sg+ZeQ34r&8von@6|lNm!PU-~g{gRD!gq)`)t7SWNdPxY zVTX>=SK8A#!5z(B)^sipqoLr8arN_@=cN-Wqc@x((V1{-!1r|+2Yz^&+^VS| zGE74G6r0%8PI5=(ct|vSN+jLAC=!fsLfU#xSYB#YZw)7z+$fgoa z;bml~@Pd@nVr?Why%|gAPziNjIEE$y0%M@Cgo{vs1wb}w}jgG!nDo- zE|s~bk#ma;ie>sT!XzR>QOE3#RJ-3cl-{zvS)_|@I}sjISg03Gk2PJ5F}}=%PjdJ> zox1n=RP7ZI)D_{lT2}R4;7ebCO1-(?9PJ7f|Sl){fj$j-4 zdx&b8F;*v%7~@WxD2>Sjgq_b>zz9xr3&A1e*r)F`!c5q?uIL0Z;(`x>@9lT0ro^dr zH>~zX22)eX-Kwe~MUM1B3ok~k1E*^=fE}`c1MG-2S(P!e6PhHSr){zruM}oc(dk5h zD|pz*5Du$ne&W`}R0It9p*S+;5OfyIZ)s%;<)%&eW+(6MRAQQFH)4_2ieP{{yme9& zaR~A3b&*&*!d>LwG}yJ8gZ$7dk%QJo%?ynFgs9(C!T82HVDh*gjLXy zO@NDhW4pNFuw_TcVNexOIAIp4iK;hC^VnK|iFLga#dI^4?StzO4J;{zfZ`q?RF=-W zLiz#JVq~GrEZNbBTeLe$bzB(BnQt1EeS%+-LSU8BkOOhOo^Pk~ggXyq#_4U8 z&c5svKGj3tG5lii&2ELd`Z*10Z34@ioQY*>D7ndRX{b<+2PTWpPZl1@Q)6&v`r)r% zd)W~51ak`rK8rw>9nVWUjC$ua054lv6OwKGpS~6t&{ReQJIGH%(VwOM2}}@5&`7!JV=sALIICz)Cp! z;B?(132@Z}eQThsl68j6Nu^b>0q5j!U3w= z>9e>s4kpGBku-!;>jmGxk8;Qcr`m}ztWEpE8jgUz?xe*n63qy@)o{#wXjO9E>FffO__HI>{-SKK3gla#Qr6UAtJ0|UgRaD!mPiGwzP z<-4q?M67r6vEdW)re6rdRF-ZO(GQRYmOBdn*bY^c4O;}(a_bXF!lErTl|m966L!vs zUS3CSX~{2(>V!Bnrm-sp;lwpbZTl7x#XO}+DC>Hu4eph9^pqHuQAJRPpr{CS8QU;` zriOw5uMog=&NSn4L@4PnKge1AF2nyg!_l}K1C$A_e6Shw#7j16J?KldmXzV46}qM& z8CjdU1}F#UylKo_@>ybI;u+U%3NJzH*RJe5LfGEPP;c&b@NyTDPkX~p=?yThBbQgdHn9@{zKB+LjFmwe8 zN4t5}eklzG22F@V2PBrN4B3E!C}TYZ`_;iZJo=>yg#-f#FuyK9EA7E+un-;HTkd4z zkhw6AT}d8@$4YTu(KzE#Xb&O)I)m*hTv9ZJMTP2KeQOaGA;1@)Jwy~jh{1$g1ArJY z9mBA@ldEP(>68!K8!l8NO3fD7>TBQ$=8QHijcMg%x=^fsXF%kefAK}IyL##=9zcHk zlngX?^_KsUR{XtlFUbZt9&})$6c3!z*n5S|N&(_1_zi>n?5jOZ43A7@Qndz567>T9 z(+gYDL!F`S>YAcT$%jGMBDw?zJ!C8l0cv`1G#m;XJdT;aDTCp`4P?QygZXM1?9YUx zFf^ILdvNp*CttJyQez62Ge^nswe4lcE1F-9rbS+Cn5NybSJE1!G#NFMV(xTjLRynS zc#U{lPzeRnn32#Lu21a%n?t%uFMGhtBC2&ChdViHzEsdVWtHJbGpG-}3^eL&>|yv_ ze>O!-HUmGR9WFIWY#}-d$9OSA!D0vp*Hg{lBeV#Fey&D{su>g$x9ICD^lFQ!Xm+Zp zn@`k-im3Gtcqp=;eB|dQc?j?gV!S8CSD_U#MDDI}!^tnFJAb|hfz|+^>C6y226X( zGu+6jbUwtzyh?gjr+F$0#wjOi@g_84GmTJnAB&|DGH2WYE~JdGOu=7x3{S#2i<`u+W=EMTVx=6fxg~ zSt%f1Du}H&`_wisK|jS(usloog~|1r_Dk7azilPEE0QZ|5|ZJLG(BZD>nD};w0*{6 z2T!h@oBWiGA=IV}uG4cCE17Mb+vI00X{e?@?b;hc!7x%Mw=yZzCViR7*HYW3bhoxq zT+gNz6X9Gwr|OYU%XvOxx}aFjE4ig^q|&3*Ls8q8nv_G6?w4w)mh>RgpZ4wbAQ1gm zyLMD+MX|7@-M5BzA}Sv#iK=@M497uoEBN028@%%~>xT6^Bgv8fX4lFTo@t80bZkp0 zWr}ulZi{w8Q=pz>+fK1ATvxr!#1bfW~MB06{>;$r(V#%+ELUpikwZa)J$P5UzpQ1_Kgo{$w2JbYw+%g-{d8@|EOn=>VBNF8G6j?-zgw88-_tXs*LkP)mB0@G*3<{djgbiK- z7X3d_LTm<$MxKONb9|}MH=TiF@l4G?7{riGu*8Qt$n3EmT?A_Qw1LlwrHhy<%3zF5 zH~}#>SONv)h*4uM*wO~7~RKltuGu5C zs9{2KLjN;m46$PMpx6Q`xDXyl^P@?hb7U=!zl7Dm;t-V7tiz$AU%fM=#91biF&m=* zc8ahm5o%Gv2W9lFW7IDhI1xoU_@bCgYJ^XizQZ&s9`uoBe3Z#~Xv$Y@SK3NJ3^8Ys(H>Zk4Pp`N(r~BF(}9#HoW7)oXoFlZH&M-8q#!J z%*Ms_q$EqQ0%go_Vp$XK0)UA)tI=mAyfhvo6%4UYr4AI#Ou!lEq(+%jg(VSJMWbO? zx7)+=m_>;`D7xJ2XamqV0sD;A z;zadPr-p|WDaIo4v}Pv6LlEURs>nuoHpgtC2)%p*Xdpu)I@_f`r}+zfO=m4`ZfUBk zud&;_saA&tOv;)m%~@q3SEsRHD~3smW&V^^)Q2iqb094mw>Sp@L6#86m6|~e!AZnj zL_E!GImZFyNyjbFh!Bk_`pK`?m{b#R`lU4v56UfEItsD86y|7*!sg@!co!%PO%Xoe zjp;97lW$%_i*K>Fy1L1hA)#7sOt*ZgQeC5j6Vl>Xv6BHekXx9f2j}+n-LOO5h37B3?#1-` zo(^df1du)lMrfK-C4Fa7g~xWdraOYpp!Cwt32jl}*aDN0B%(@;K}Lv*G)HGhu_N@n zGgj)NI_J{#=qVmBfi)F$go-nE3>DL>Ke0YXFVt2eWKk9nUNUv<7mz1N1d5^ffsR z&?2RT4Fc91au~~KPp__ThRg$7d5T(%(iLnCevQLzY-n;2s%B$@Otbcq>I?`>Le;N6 zY*9XhriPY=s)o7FR8wrUd+{QdQr8qW6l_785gR(a-shoe_H0hg4Rcx+d7Dyj0?f&* zuwmwWTYQBaGg%_gm`Zgvj^(D4-EAPZs#3cgS60X?ONHscnu2Lq=*VR`)+3o(gf^{gcgYkMsc!zEQP$H!;2*+wIqB@9(4|{1Cs{Y-GK zv6-6&Y#y}KWG7uIP?kmxwUcM@BinjF`f581GmG4y9Mr7D$5R(A=cop~3Xsqztxc7J+aflMN0YSSHk@cB z+HX8zgDuIm2Pc0}FB_N3Tqx*e)6z(%=mVdowdAIvQ->oqOf|@CM25A_lOQ|{LJRUQ zy`7lW9C3>u)+Rj6&Brt0G8q7p9(j$y|C2Jo|Cyg}?#Dj2j@dxh~Ajy=dUTi^JitrfG4afUR7)diCn8tTj0~-FbOy2Mt#QG~efE9lpMU?k=WbuJMDz@Ux3A{`o~0{p_;KF6-{@-mqcAl~-PQ-F4S}?|a|7 z!Vb zdV15QXRf(s_x0C5ck|89-+c3b-f_pTw`}?K)~$QDZTro=_r7@Vy)XUnhp#;N;HwWl zxbMe5e(mwc-}sOJcw^VDUBCS0FL&?W{i|R7YUj>3_w3p8$}6wD{`%{0yg|O&|I9P* zJoC(fXP-Ur+;hKw;e~hi?0N6S7yt0`%OC99_u(6F{OPsV{`l5gZyh*rVE_I`18Mi|NGzn(Jb`u z^W%YkU@y4xzH*HkII?y}&#tw3N1t@=?j2j6ysTi<>9^KCxb>Ic9X@I4Z+Aa<=QCGJ zRhN&fd+4rbuXQ*7;M`{)+V=d7MIY~#Dz&!< zm+XFj{^_-q{pZXtKl-gZ@5*^gYFv_&HT05(B58iMuke{FWy5bbb>EqPi!Xc2LnB8k z1FyR^yI*mKw(0buQ3J0jKjN+p^P4Z}-hW^BHS6~5++IKK-OX=RR<3#e#{Mn)-nx6+ zkeu3EMt*01TTjvG+}mb$zw?*Yo}4+i?7a82J$tXp${OHVvh#aiWdHVv`|gWhQ+d_S zn()~*muowJQad|xgLKo|dkQwX9?yOMm9Ng3+V8g$Mt-#=FzcBmvF@5%ZfXhKP+W3U z))Rlf{pT0{^-nHO|fh3rgY2i zDjP?-e8&xR6>TiZZ@jT+RMY6jb;s3vU-qs3{Kxy=SpDh1p7nM02gel*S)SLDbFsX4 zebL6;oyCo#M!fW1&xM~YALq)K#yoOeWw@ZLu_*Vx!hup#^&>^aZ~L+bbk>~khqpTu z@uxP#^Q9f@ny(oC)>Hoa{+FyfuHmJemj`9lYi2TRrf= z`mDu;>vD$7KeZ{a_JR?Ac>9`>r!HT2L;v~mnxf_Zxodr4UG%v<4f!9Bezp3N$vx+7 z`)c(p_nHCQ&;M*g_O@f6np3}g^k!G+tW#P(tlTuYwYK=8A+5Eeo_u=f-V=UXJaGGu zhECpESe$>|qCGzxcG0vA_vXHwKk!6)_)x$UUc$bad|4x0sp`Tnj*w;FCjq8C^{$q#om@GXx?9$4>hJFt`J^hD~?D)>j zN7sxTotxb-{kq-5PMRD&cEuA@Zo2FFCysDc^gF4mJMY2#gyh;b;oaAJTwjLo8aDrG z-$U!O_a8HQ*oiY53tUf*|M2sPPkj3ESj|=R{?3{oY<_9y)~Dq;$8CxJYT;7@*5n*< z&6*8^J}&N;_1OGdmj8O@7srm>_SmyKF8gYB+aG5p_9c$qv7#n4GWyhr=<3hkoxS0J z>(M*P)YVg;_}#NJE00`1dh{i4Hl1-o@!)yW<#pM`ee+Q8L=?~9MV^qw87-uvmeqyF0YX8)eq?b~Nx-|xFEj}DiQ zDf2E^|G|Cl9r^et*FNc4lM~1pF>KJ_wku{npY=!AwFQG;9sl<)KHL7l6Ry*S=WHCj z{nhZ|Prv*yulSnvoBns(uOpxJJ8?zli^sk4GxzL@_lvwg>6w1RFaLAmaQE6TCuVOw zx8kls_g`-L?vQ&b@4Ya$HUIgmI!of&KiNOHaKZbo$dISk6h?QQtvtNDsPV;3bFQmg z_f>1jTVHtIaUFeNP2R%4bPt}k=6f&rI&wDVy?Vk^Yxz``?&`l}@Ydn~UF-5xH!R5ca_z@I z9k!+C4-E@qE7#>*`pWI=D!1jX9DHZNTDNP^zAc@1fA^`Qc0BwG*ZVt*>+<$AmweoR zK&g7QeCy6v4h(;$wxIjkFSZAw;&3Vh8%!<@)o^s~KWe>b`?XN%hq9?0me_K)a z>Bmg_!`-f&?&7P@tQvK4?Bqwrj6N#otB!qt`z-H?QNE7Z56{gjIcd#I|1EbN(IV#! zy6M>QI|uHKWcO70dM3{O(o^X=seEA32S3{M#NHp?{N~B+{m-3Ncu%x@)oCZcSv#aV zCtP}0&P7_=Ksmm*@XVZ(mM*#TrJRCG)(>vIy{Ne7qkZldH;owBF}!=>foZ1<2p&0l zVCUev{P@`|o1WgiY3Te9vL~#{Uf)<8DBiX9iy!>-?i&a0{Ql8b<{ZD_rsBZ{%zrb?VNAfB*QCEpoo==rtGYJ7UP9rNcgQ1xNj6 z-55{K*$-WR%=vZGzO%Oe#@W-?jLFX3lza8yt%3g;HKyvylb=2RhEKPSxMz59%R`sG z_etsO^YT0+?|Z!Po^^{FPW<8TMt@nl=7_&#UHgYCtB?8PId^nsFT5&RaAr+?<$}dy zgZCZy%=66Xg7wo%V$z12ymNyW>@D()F37K(FlS_U*88t~zI9=F^@#^vS^s^+@F#yh zaLvHy*39evOLyK6KCIt1y}kQ{NxrNXg0%;aY06vlUq4xz^_NR3i@aG!{JQ1IvFF~@ zzqK-F!fNlJQ_H>UuK4LMJYxg(N6Blyy0W0;mHua+G`s1loa@`4KY!L^$4<&$``b@i z51hF!uc5ekzdZXlJAU_f-^%9}Jo4d(SDpO&fGOom`yJyNF|DZom}wJ>0tFA8cGURy zs>en5zV=b`oxdEu<;aUy6#w^<-P~lth z`sPzVaLtOYJ*h(;H20qF7lses;+lC}@fl~1oYPaZzIJ`*zT4}6=lhj(`@DyKI-_gH zF-QF7i{r9>wEw36x%0`qeZTsTs^^yv9QpF@kKTRt;IeTeR!=Odo%YO2x!u3rdEKy| zWmkQ5cKO@VfS%Q{(SvG!w`8&VoYlWRcEy-oA3glz`!5{tn$lA+dQW-I39jxzdq$mq z<+bBnOHMkFw^qq3F8f}=A3xap@@-EqpVB`1(~Fng{m$mUbp7P{li!>0_Da_|J&l9+ zeL4O9aijBR$2J^SB)wECwZ4DEM@PQ2@uP=tQvX(a=BxjsPLqZm@7lk&pS$vyOPBol z&C2~(jL529Hf-ypvlspC<;!pX>C^4MyRBdQZQk}ob;*$x_pYzl`KRk182jdTvP&K- zS$81oky8$QSpVOTKkEMTOa7gYjM=f^&78`u3+^5<=hUsP7q_i==e67Z`pZxIui8Gr z_4(W9Zs}~?F#oZ2lR|~hy?O7kzZmf1QCC0Q@XU(Z?|yaK*yleye$EXQ;|89;bM5$- zvQBDT{we>ETVGJO zXZ%R7{Kqk?UvIy7*XPHbd0D^jPd@p=Qwlb2%3aWtd+ir%M*3R^&Cj`ITVdm_oXP{S z?KP{9JhT3W+_QczXL)bTQx5i7Rz2xwgmk%H4%4H=XyzDHq>2u3+@= zP`^E{q1wv(-id79KjdsFtKjI<`c)>fc6a}LdG4US1Lo}M%=7jyys_Z<$x{a3Q?YmJ z=$1w6YPM#bw>437lTUWJe)rbIVTrXzw$2;8EAP~O1)(*QZ+xUap~wH4WGE`99PNXgU-kL(^_x4vL~y9-ZYcQs@6XVl$$IUP@Xp~^3~^X zEV!s3GH8$MXV(^-v2$@r)=;l&&WSzQ?w;(0E3ZFuet2%GFWZ#mLUb-o!-E!r^=zY(I);w03wezCKs%r;AS7Ra_n{xN66DKGEbC)`gBtggUp4mUb+1Z$9COUAaenwM32&Sk|+!z4nvi zj@mKxh7E<$P4WIi2HyJeZLd$6bMMr#*^Spc`d{vo<)++q=f*$3ZFc9WkKd59?E6KH za{n)aEdgKau}2p_KeTcF)>hYufe-y;(*-x&k^S!F#~$0bw*2^#EqTk zwgG2H&x~Fh+mn+w@Rr=lJI<{dkh5k+;n@owc<1=+N>^+2+HqUvtxp8Ida|UbFnMNpHP-=YglD51N$S zl3Vyx_g&*Y9{*L*@&PM;(Ej<+w_evgkqc~+naYmGiqOXAluvj=6mkHVpDN_<=w9DZl7A*G3CJlcipmM?Uth>jX481-Cyv%f|&Hc zXm4Ik`H&G8JUDlLPQKLtH)D&gsO&#x&_e@ub_@vb84!4G!0DTE zO8&ZI-f=~c+fByOKUuFZYBX|%Y^odshS`mzQWME#>fO&yTW*zB; z<%MDgb`UR+z?>$?ORJ8K(%L6zmtI!$+d^<*j_g{51!sTs5wN9!{q|1|)1m^b_2Hwl z#8W5o+k>;F+24l=+yZ|e8e&T={pC<_TG*)|)hI-o_qLMX03r($?hE-RhmOONVlC2z zV4-7~%|18;=oLuc@&S%=pGIK7ta#aPDHN)&5Bk}Uz1cY@JGh&G|6ngA6dzb&SQu_;9IYGoXRgB%I!3QdZ4C=AsC z3!tiPpoNjXp+^Lj;M-4ve)6GtyDmteIS#->-o6aq8Lb}aY(>|JQIy|>ygNN$Wv`Z zH-MqYQXtqyb6up6Om=w(dmmER9#=B71PyitO)T zpL+0_eCrEIa|qPre*g(t{pKKmR6r*{KSZ7}NJ>YP4`hIEjd!!xcF6$Yz-CFIRmg*N zbkRw_ixVc3mdv^> zrYJ_j3d}44IRMD@WFtxrJ3nOX{Cru%qN`KN%Jo->JDDrc(3UIF93H7E5yM4+<%2ns z0YNtvHr*IHHFRX?)p}P92uMxD{8+|I;he*tB>aP0o$Qq)Dw2gEE7-1-MU?miMo5ht zQV`o4Px(2}2H`$nSJP3NhpDUZ&`MY1c{P({#F~X{=4{$L!RVZcc`&a<0R)uQ+_$g%-Qj-!Qaz-Kjn)N$qTLs*w36*lWUdfAQ*gR9OtT0LkBY!e( zw`*J%CM4`cUWS}pX8iQ4SC z3W*YgzA!GEt`P=9m*%8XsV&$Ab%bLI5GMdK+juP+4Y1w?e>XeJ&=gTB^lzkSu~_v~ zOdztrqzR`dLcju3(qaL&0|G%<#nuEa5~~0KSz9ZJky&MsI4Yp<)klnk}2IH@4mWppt+n<)~c7nUma=sosrIPS(w1_i-Y!->(1z6M-i1 zFf0o>j`i-~)o>x9S!W>bV0b||uT!ui{FaI%2_FzGXQG)gs}(;m=Hy-&6DC+K@*~?- z(}|>k#e@3a(h72bgoB!f7ly+cr7*^dDd~>UkZ<(FhJ|aUaA?xp6blDWm@iyX8__=# zFCpeCi z7!o_!4gnHlWNB?LktLy(?3fS;B`p+E?sAlymisPHDCI5$N`Fw!hO0nn%YC#^ZbJX_ z-kX`7U9Ds%u?_v#`hX+t&V9Uj^N#QHyJTA`4&#BXT$1~gQWO=SgUD3bwg@mPbXT5oOO(ZCGK-uJj-FY*=ZHZL{Dc#GVV6dIUIwsN>dkh zsI(@T%3YXylqZMu4MxK*f$JmUlLTkvL`HDMg6UxgOeM61ExU@~D!*VBz9h!{X zncHFj@_~Y5p3*_NEK&o+mysJmUMSiT5*dEs!3XFLX9h8Ev#zYaTtcNLJ)#>uunUql z@e(e$Fk6Tz9SZ|gM@E*SjDKLKXB>G6M?0Z~k|kl69h1(Z2s@iQ^(Z*KQc(kuktKy# zMrns^1D2A%9T^kvT{Lu^tXFU*@bjJxmN%&5h0BJ)nJMU#L>N3pu2SH#cW$ExKGW=&e=ROK?qq zU#Bx31LAW7XeRboYf7~1DK<>?dMaavV@9_b>FNuR&w4y6fxxv|;R*#?p(P>X9h=&M zjA4e&L@X>Kx$*n0eJJzmQ-~qame4c05J7gBWXH|RFg3A#*-j9*aiSQkY1G-MHJLfu ziW!YK>?GV$z#oc((1d}hiH9-&A_39>2uJMRvY6dr*rj>CD74*3Xp6&Ugx%24mmeB2 zFB~^w39Tg)g9|;BqD%+B*CUSrt;LHiTlm?_PZ_h0aC-`%NsLY-%{CJofnYnp9?Mq1 zTWub_hVcvJF3O1O$zW%qhn2t%qxtm>bxUv$vX5S#zSHAHI^1#AGua2@Bs2X&TwjBv;Kn%H6BJNVQk`@B!2ndt9 z5=3laL!l2Uzl*XLtZ^ucM9H8W=di@<1h!A%g{kS#V#x?pu!}qK0p*$xN{wf_8STX8 zz)W_qGYq-@js%?5L_91`f+vR<@GWc|+SXvN5e3SOQZ$g=X`LV}rKM^~(`c2Lc2{1< zF(UMRc#J4IKOuo=q6Dd;ZcrkBbH87L6VY&#**eGHH%AH7S=TE-@LC2 z@s8MZi$PCqqMPC{$HZKH?C)g`b@EU-rw}R@Kpu{a4wPa;N>*w93lR zi2c`ad`9fQM(n?aC&n2)?29B{EXRz(x0X9)Na6V!;_P zJ?LWKB9{vZR``+;^7*{ck31Kc2Px8r~=z(A%133annMSlX+bV&JlKqn-UGEf2Qak2X$N?002~&+5Un*HH#io zxtLp`6=ruooU`*%vp^NI^+{SaO37OzN;XUq%cT=goHa0D;)exU^|C=sbJ?+31)3|i z1|g(NINcS{q6uK90l+tsN$Fe$C`hJ59|g)H5CZERAgF^15Q&~2o+wr`;RJ+z!4sjm zUnZT*kkpWs&FviZD62C8MuFXIgP^oq*y}O2$^fysv^7$eg{^r|Thv5hseO5+1hAo2 z-vQf8i|b^Mg2tYt0g}0Rb&3rpODjqM8$81{iBJ?O@Y;benT+6FD8o`o=5%f9D$426d6=T25m6VM$SgCdSeb5-mKjGd)wZ z3gsa>>3L`gyKj?lM_NxQg9c^6R>>+W9qv@NjMA?Zhy4cfXO&UvC?schXtA5>O1CXh z!@f6QGbsaVX&TfWm3Lha&YF(upb#FwlBR^Tq6fZ|=V2}<)yTPGH6QC38Go}afUA#Y zNFbN5TD6KN^#|QZlw(<7k}ad4HtN~$;7YR-NairEwKzqzueG?v0Wl74b0Uk>e7K%twhP=+no|s_MZDtLOxyWIq*@XZK7g2x#&sqy zi`uCa6^>hEintK_rl1U5RmI2;V=6^i)YZIYk&U_7?Y6Qov*t6>DhUKp4mCR*!6+AM z7IsVN1-2$zR1 zV`k7y09QX4>0%Q9fcQD*N7K_kPdTI-Y*K)SV+aI)j?!PyS zSTd8Fy{0f=xe!H0{>VVojVR_Lh%kCKdZ<1a zGID6L18D$L3&~)=25?vO$G_nr$Ng-q`GPT!8<=z5ap%@`1bx|@i!d)aYNQ6zAvL|` zgKJ{HlobpV?c@>^DGBr)p%@W~R3A50vr{H0UZG9dGA-DYRuKbbh5pxVgX|(~v=1tu z!R>>lmxiWmSx62XT<7f#Oi0n>SqK8YS=A+q*W9*`H}bQ!La+0r8>=i956LiU~8bl z0)cC9djg~o5w`ogIXV*xb5h`R=SgN#NtEM*X;8Zf4szfP6^FRSW*SA1pr0eJvs9vw zF>)Q-TWzJTCsFMRqnHBe0HGhn@G4LK*wn3dJ(lPVN>?sO zWG0Q2A$)$tAdqC3%_k_nAtNpkE}Y|iLYMD&pT?)(6HbdM$018((%@MROf3ks%#|!J ziK7uIh1+d%8WTdmQeWb)a!Gb}Nj@U4Vs#9xj$L!5@$`0o6 zp=SN@u(R0c5x`4)=Av>VOEWl91hNe;21A<&<1!N@Koun*2Esb*3(M;I5L>(m1{*RUuUn*hRNblxXeGN{vo%ZwFc1H}rPW+GysJ&|qr zNkd1@n%-uf!|M+az8j-FT*@n6$#tjDkbtr}#A^(vO*Npn8pZ@f&mOky0@%&~V0#!H z@UM>D!YylpiH!6w4rmzG97jC>{U}Xm3nN_wm8*WeZDBD2e+kj{et0ZYn zuGk@62r8lrdr+`515K=ldIkFgqZhOJXT%>OD3fyB(OYHfEUeR-8|Swyt7)p!>YKGC zO^pZE&#RlKd25>4Z*M?bR^PI)acPUjQZ&^xv>dE8&ev)h4%YUsZsjj(M zYi!c$7cW^jf>{hH8p$Y z*0Gk=%w1GRRk2RhE~=?t9MI;~EUsBlhq)SADNUG+w{F?OI()?Ht7-7m)V9<&Ho%zF zHa4_0v7Z6f%cd5YbyA9_^-qB8Ik{w$p1(De@8R{|D~D$z7B=#zh7Uw5e2}A0$@Y| zFrok$Q2_jZ=>j~%Y_4kg>^yM!C#D|JA?s02btHr0ToS%S`foVSU0dSc;tX9n@Z z^M;cMYI8x`kj$iPh-Uqhc67JcEQ+rA7A^6UHxUI@Aki&#I_Rm>xbuubX;_HZFnoEdvg8G3QUKm4BKo2R>1GiW-q%e=%&A?Pvw2^EeSs^`8Ex5#Z zy2GiJnWP3xwdR8xM?gCW-0ad3KLJu>OZ4t`aK6L<4}h#lo&S2kD!U;h z5@bmn7p}|Qp7yY5L>qg0Vns2b+utnU?vn+S;JDtP2JPVoO*pKnOh= zS!lS7Ns%iU31RI8lm%gWWI60iWF1O77Bj5#%0JUj=_y00Sz!Z-H=ZE(Y#5UAAV)`lxzziB1R1qp#9kHTx6IV6h7KS|% zpIEu`KzA^+q!hBXF!H!+MK}c5NUT#v3KdbN3Y|PavXGM&NOei&?3z@h%Sh`uD~uLa z+G$}}d5cOQ0|pMoW2J0ilo&Z0N|YFnY!ECV?C^hA+?W=})S0#+&TzWO$e={h zM~8_tl14bafUoty#XBnmkig=ky~7VXd*C9I`@n&3259iCUF6}Q_IM4T4IYz|WA+9Ur;sTeNlY2q2rz3w@RaOgZSsl0M{1Z2p=xJ` z2HRx`1P=G}LyQ-Oc;{iI3HQ#Ac!%4=k(GkyOr(rX1K0@JZ2@tgi1AHX z2YO|`Ch{#GWZ7U3$ql5QA^h%}VOt1-t)=^tz|!F<-fO}5Q;%eAwy}k&%+*ma1W2T! z;E-JMuK=7^Nb;Ob@+iUS7>m@y9rNf8 zB7w{igF438$N;unTYO+`Ne76idK0OY7FB6XwHs;ISYvj19$gw$nV$2~NYu~FY20MQ zRUq@yqf=xtQ<^kl<)v&ElWZ-7rUaAG4!4jiN~o0pA)BM~BAY$SxluG(k9vb16nzam z*by435)BV?veD5?r>S7W2%fA2TLNRgquwnX$41yDxXl>*f3wzYp)>7H`POx zXcFFCSnc6e7tt+X`LmH11H?h!H8fpNu+<$FY*w=o&q9Q*GzqvO*C^R3B3Om;V%%bx zZ~@6e&Y$E886g;$T#UX2CDoxx?uy(*CE`3|hkyk0$(I}v&P0Dm3Uu7^JdWTm&ezWH zFFv?xBHn#Y;V$qd7_rX1hOGC_D)4;ETR0tJ`HHuta8>~0tZZ9gc`+B4OvusX@H}~f zXCP~Z$bQX$K9gg@#iS|cF=j-(02BBFw8I<7>@lL#9bSb|WwWC8$Tv!VvqPb{7KnR} z;C-^o6fc!x`yCiCFvg1tn@hkpf$#Gz`Fh@Ag0+p5%SKwsCRbiCtn251mb~3p-nruK zj`IT_ylhkwXUPtT62}0xpj680CQ1Z}v$X>ez%b%(3v9p%w?cpf$Q7X!O5jXri3kAu zh*O1UvkA*o4{;#saSVQBL^8234`Y&0rZd8))86b1bd%yETUTy$L1za>vqN$vC@5h2fHh!aIRK_OYiQN*~3EPh>FzC6yGj~IT1Yc|q| z+o^YFC~O!C3V?rBSPXu$dQdW#0C^7u>R74Et8Eg5u7ong$AxiG?h8`$S>ODgLY^p^ zVAp-0mv_hO_vrDcA4*T@*4c~!Y{ZmHi4{VrggMt`T}u_10#k77{(xi?qKW*C=K@c! z9X7%1$p@q0ElqbPOT9Te?gAI$_vF}IS*h`@eMsQe)R0K?OA``)75qyZ0A271=qmxT z1-zm=@(A77Xq~m|kuYJss^Cg;N|ci!*M%O=-RwKkKtki;1tBX^j$o&_8icCxdkCJ0 zi;nsji))2Mie}`6Gz%0Z7psi>3)_yVWV;n%n42Ih4A6Mi{$2(Ijg&TA%+nq26WF=( zW(jOEhToyrtOEfLu3o$Zp$`mDQjKjI)*nz{TQl#YerF?H;R^BKK5A#T@_3x1yHMM@^n?QUqKYaWyiL)Vhy~BU`{SD(zS7D1mgAd}g=-C2U)?P?x%3zP!*96m~S;D?MR0CQt|wOm8aO>qV6(q(HSb z7lE_#AWWOimpduH?e{s4xX*ziCMB_g6{_jf&#K+vvUx5?;CSFF>jIeManpXY^|UB> zm0{jtXtuZtE2{E;?Nn9dKL(tQYF-BAxJv(L;46CgAa7(S%xd(x$g{T7+fY1RXa(6{uH~ z=#lmqK31Iwb!wz-r|x`9XBfz85}lV(!(=!4KEXUfnXEV7g*sa{+Ok9{79H;uVlE3R zTgv$@t&p|w2E-y;1L~6uA?vnp`En0}CbQRockEFSl-d0Vexf}%{8k!?Aj$HD$A+1V zzrZS6DTA)BjzY#`HtQ7?BXd%rykV`a4qjcA)gq{>#hsGlno!=Vh|}H*n(5`1X8Go<47Sb3K zj=tLBOgx(4B{@_8yH;q?36~m`mo8Q2DAz_{iXHSN?m|iwAq<@#s8m#D5U5HcMliWDK>*(4C!u>sNP_O*@JjQ%05O0P~Jp%u0%F~BkM5qSk&X|F~TTL z^~0W)dUP-g7FTr82O@LMb}=SjP}ky@hy>wGIsqgD4eLBn9lFbvfL7bU>PJfsH^Gu@t*Lq$grosBjkP2_xu|#4eGAyb=rAC&S0?B}Ur_tyTEijF^aM?!EUxNZo z(gcD9rpRnJ!i3R8|8t9Z@Yu#7pzzZQD!#pM3SG9WFztM{Civ`RHk%FN+CD5>9AzmF z;kS}%E-Wp0@#wWgKGqqV6*)l#^ACEKa!hW!jVP{ovY|9(@MxMoDuTV{%%g2BtNm>@ z;t|ml9GxskcWy~4^kKFr1E#p}d&26b##M*ory%C@P!6QK5*<;R(n2@)Xc#qfF>8e@ zGoMe#W`(tw1LkT-v%1&;K}2Yd66PX@nqi4Fs*oU#WL!imwy$iic_ zfpjfA!igBmjtU&06v8IVgYXeXI%C^`Vq_rr3|iR2*@u@xwzKJH zGHj$^gUKz!m?0ru5JqdZSTNH59Z$n9L+7z^kcFqE%~b#%^kEIhfO=Y6o%XM0S!bF$ z;A}`%A|WJdTn{5mKIEkUED{(U6)di#zXQ;UWL@ZBY5zB}t8@CjlJd1K3o8;2H|KH+ zUpWJrv$%oXQf(}x2s~tGZRiQV&;SBXtWUA2S8jG;T;F&ZvQBO>K!!k?WqVlIg)j}IoNLSdUB{^_q zJY224Fk~4VFRve^`UbWXV{saA7@Iz5rysznU^zSU#th6G3__-05TBLuhooL}<|vib zsS^Z*O*x;jC#(r_$qNJG{tr|tp4hA+Eq|A^BH|3Kp75oI>8%w(P{35co*j0Hnz+&LmhwJq@(>axhPXr_E)R?9Q6w%TXNYII+u_hQ(y}D<5Jb07Fy2jz(kxFdr;#Nr zR({#U(-u6!^i>g^V(wYj1l|nUVqDGCVdSP!ndFIpGKO0+aYIxslLP{729&bwT(1bx zBX6l)ppz3S2NWM!N2}Xi6RM%eey-OfA;rLz3?obt0lBk`bOg1b?r)JPeORP%L*``Rt}5p=zm*ypeZYeoBWepbU9-nk<(sFlHe$>>uJn<{?7ip|An z4DMkxu#aOnz*VrLai8!~NV97Q{YhHLylAyVT}7ErTnM1!PHYH4r7g0M?gGS2OXrG) zA(%^)1kK6kh;kdD)9n&Kos}p0G7XJd^t#HkfT3<21&?NP8ycI&U@o*Hhi#WJuqSv*S4jzHo&iQnYzNUHW*B)8joDL4T9 zCe)c=7aV>TNDjlpPEqo6g%KNwy_W&TR#tpmfD02k`KG$XjV*O;HS^{*d3kE98ExGl z)PpU;t;9kz%7dY)(}QKf@-nm$OQ$k=!0~2Ut~V8G9$`i%Hy$i}&1d>Og<0l{0!zkv z#n-&qoldf+B_*2Wxyq+RSekX4aQk1q##2blADva~Ff=;>=9rE(R;?e4X+fhxHamo? zj0HB;&97^!YXa3@-a-^JN81ns!{5dW@j^W=Ww_^Tu4_85uBok|W^o<6I2q@;BreAZ(&7PuRUH#;ZG`R5r_gckCJEw-+>PuOZ>dCFzk+RY8TiZb#A-SLT zPy1Z6S?kw&YuUG;Icp)&7g~hDPBztS%cwtS6|ac1*+vOWdkSP0?6)5tr|~huGSgqR zA=qi^5^gpWYr>E&HQh%OWLXr{k)3DZRMY}PBDJn$Fu+C-3c^tr^D}^PH}edH)oAQz zR|xu9WAhebyedfvLwpSE*;*_gMf6)VOdeU9PEN+?LI&%cph0mMk+)d;0}4=>F6b<0 z#ssE?a9;&g8w}npAr1;5&Z8F z{O=L`@BdQ#?~zEL|Fb~goCGPj-~FP$kAQ!VfPZfV`1c6<_cs^)+pfTrI~xj@yIZI% z`Gai4lc)o`0Zm3EdXo?>Qjk!@!_*QTmTkMx0?1|MRV)w`bTeqObSs6<+l;-rT*j78 z^8ufVLGs{>Kfkp%$t%gQTd=N>jf|{$iBiEuLK3c629*a(DS>iWg_t!ss~uu3!Xtz* z52rda78Ei!L=nnGs*8IWnW`@=yqT%kg7f~kCw8g3iCc4muH1sUv71iVmq4Bo7DG$_ z251NdIJ9V-%?JeL6&P?rT*qBMVf`CI5JFDh%&QO&muYNcw{w-Xhz#W5bHBUc8 z63xfX$NenUwEf}S4M(L@K9r?cpMgFOO-iU~&e&VRHH6f$CK$vGkqBqC~54_srz3>FBNiGGkv>qp(=8F-lTs z0ct!JMK&;`ent~Aw2Y*k3JbVe<11C-2?!YAf!W!0AzsXBPNbzGcJK~C?B@K zD<+k*J3-|gLFDwejJOR}7G5UjMLA+-7C$QEV)J(jaE1F3$Q2Oeo|q7>cytOMdA5ixo#q1sl76;Gt$?$P%c$Nshl-TnzBQ;m zC|Ov_WY3i4uZUU#rQEzUpnD~2HI$sUhdd2iWu(VkPNbl9;2ni-U=fOIA4W7m85)|# z@Y&->Ggc&A9iTw6JwlT*+r~nADbEX+?Z{oi)FXu#Xt|Fe0WxhSZwdwKcewi-WwK7n zHNL29<92ofC9bqM_*h|92T2tEw{ENfQIA+JAZ_r;2!O4V@QC5-jg=~9095Go)JOzT zc`Fg`K*>k@6)gyR4ORfUFVhrqw>`wq(f|;dtclQ&Uj{MY#?AvJKz4&~yv62ldA58E z+$oLlMz+#P(S!&p&4Iq)ToPAJO$6IkU=O#F+K~NTESZm|;7K%}up{ngwbWUr{VF&! zccFIJW5tp|{z3(NY0uCEy1NG}uHcGmB1EkKYpg9}N7DeA1+zJIYCmd^#&6V6e5|xjU=F_21$# zt!Px5MG?@3*Rd|FmF>Qo9Z0d@-!HHH9Dra8_mrupNs!*1=x@kvNi|=4A`#QW@qWg= z1zQ6Cm_Qmkxa))>%13m0Mj}}{0zK7m>BeG&bRc+so2Rqo=$ru)CbVs_%&0B5Y4W>} zp$w=|;QtOCP+v;u8&d{ZN#+K6Rfc*V$8td4TuK>I@vp!KLa2Ohx=%%r(1r)$70J;eiMIk+`)(F=2z8RGpU$GDlS9EY;($j`+n zsrn(VHm@+@Ae15GSSlr`HKN%va9*iIx8vO5HStTHOB!)+Jf^&8b zPKp@2XVLvIM+fm5BW7H~unpw0D7J{nede}uF-eY$`m>~_Wno)OQ%ytjqMDYvd2-hc zV1xi$xBn4hsrnxw3sLqPGW|UR>Riu&I>!NM2c?rexqI2OCEXm@GVj^UbuN0GZ@t^^ zZeo!S^1`lfnBO>{CGDsq_kh?EYCiUD0PITclS{Z13+bL~&-j&uj$mQGFXa9yh3Vk2 zG9_LB6etf75%nd-gBcBUyg}g@9;rOe4ej14^iuy;E-IX;!6}*IKV$|`bhEAaK!O_FqT?Qf1$ z2ae63BH=JQI5VVPn5<>XTgZdxZi(2}GW$_(DecnqM{y6=RIx2jC_<8o7z0tMUO=Y| zdnC5aqzW!kd~!`#cEp4MOqsadD^fsT*4+5{0u*s4B(j2Z2gmYkM}`$aa|;)0c3`AD z9nX#xFa-TpB-De`ao0{e1EA&UwJoXU(^sX*>2lEet_b3J!~#OgCN4=&p?j+YAr+;t z2X=Ltz%R8&%K(%O2j?A4P?sEBw|MM8j#u?9BHBBY=gW>qfQ|Rtqqps&s7c&ZBTlip ztA9(Rb11yQus?M~ILu_bNl?fuq3!cZk`IgunrM6^{gRnlLKq-jlxe=$$ z>Xs-#%f!=(45%;$qK0s%TJA9b^G~BK_17?wTso`j+qP;lY4&Urx>b`&G*+F^flQ`d ziKw*9#jr&xkX-baVRyOcfL23R0K+`YmXeV1_w4ULnJtK{*q!MX?7bBXQS%90CchQf zh=8etTGe8@=ynX=vWW}=Q}T@olOk%sDE1nLanz_Dm?W?ka!OFtNRVzZAj5PtsLUP# zaRCA?7N&P}03U30aJHAuUMn=EsvfgP7A8wUh}x{2383_XI1vWK)ivFWFb2pxD-ka9 zPbLl1X3b=dv8G|po?g7V0`{AnW;Z6<8do-^10PaBf^!b*W)G5p;}Rmwyew z)U(ExP)0$z8KWs6x)2zQYYRz!LW=;2D&ZDGSzPGlG>n3A=)hIoYvVNWQ@Gr>^g+ex|^2`2|Ml9+IS5)Zdg3=dG%rFMjaFXZb00f?YVcmTan zQfof2CktRP12fdFiMoh!Y*xrJY5|llkkh1Hf+DrVGP#+WivcVl8*&InDlHsi3oP14 zSYXuL00}pULS&nh2xLPPyULRV!!59e@oGboh;c2uu)K9mT`q;Ljkrb~&~fZ4gb{>f zK>%DLf!&@Y|F+v6CW_u5J@+aZtwsrn@>3SAlV6r+kt1fcR?S7i&yq(H^5T~BJJiG4hqBz zoZbK|iR*+#L72M=xR^I73Isne5(XF|7-rfGYFT5#Hz{%G7DH(Th1R$nbyhk(J8r~g zm9l?1LK!8`f($eSWrB#WJP3?vK(1@GB2&mcOnf^G)ldbsrm#UFD|nA^?C4@6`hs2K+@|Fc=)LVhzZ&LgYC#oq#O1Y@@+jo2;S@cc@v( zRwrXdxtVB)w=|f#gvJ0C$=k+3e+W?r!dNiCa6% z^O82Uydz~xcC$mWhq*bJEtg#?niUD!HIGB6=zQXq%S9ZO^(c2fhXlmsp<7;uL!s@b zTY4gY@YnsV*!h+KF*}uwvA6N<{4nvm=91bv3wzQf6+f@UVU({#(dpd1Rh`AusGZp< zr949#y~dKRmD;#i8XE8+8#A+Pd{mGjp)hQ z3Wv7e#bzNZhs}K0VIrJknPzF0vp|w_=MjodCxowSj+oI-gCxG@NN1Dk*?;HG!R1B{ zL6}QgY09gb>*g97>+FQub-=#m${@V!t+kY4Sn>&h^R|SO2w*W@4;6||EwgL-o1Paa-jgjErBzG{p7;qq0ZYGaI zY=&xsY(3X}&`1Ia$}%>FTr|0WYAxSLPdXv|QaP|(cXuWZv1z!ffNvzSk2f)=61~O@QpLPvu-6K=n`w-) zOD-AEM+~k4@pm}NfClnfBSvnPJS(qLs6)AbL|i$1$Kw+7VyNBll)Idn=yPUG z6&}hq&eb;1HA}%8`QRmW&e7CLgar^EHA!|vVHAEO!;-|)oOTDKRXA6rlQCf$q3!}? z2t?#hmIAL6kwmP-OzIJ%gRv#{B5m<)**fMzU)^%Jvoq;=`dZuA&{EgX(zd9sVL{76 zmkz^F#`Jin^r4l7NjMhtF3KH9bu(L%W8lH36x3P<#tk$gU9u<&Pn}K+h#d)w0H)%R zE@&7cydw30xmdEa#eLjGj}RPHtZ%UQ8E_{S)U?zst2wx>p7o_^eod`gPg?Mx>oH6^ z*kozK`BqH2j5i}fdZN!1t~>N`1~yJ+rYKugP(Z0De88=CdMP_wtFL0L2KrIULTtmF zW9q?hgNHj!q#)w2u#Z(J34AD!rZn6zQa0CZvIbO*U#K}Y{EM`06s3_HY&BLyQ0ax5 zO+*G_?UzGf4JlfWsmUc?r8H{d{pGVlRzFIxqp&OsZaMA3UKlBWEs8ZxJGU;~tVzql zOmI#eZ<>e~YK^&yuEk+_V9ew=1jMpK`)IOa0h5+^l1a-qzTRULCNsuIb>m=9Z@Vh6Opgq)v&Q63`-{)_Ui7Rn$T1jAU7&d^@SI7Y<@T zI&?MsDmc9IH2}wwvJNmXFS~(;%`Qx6gVB&B^1K!zARJL5GBJft&Z-nFojSv*DAO2Sl!c5T!MnqN-v+D>tPrdH-UW3n5Xx|2UCliB z7g!ngubz$!ys6nZ5^6hZ>~JZL#biU3;&Kc&yvTocV2I^dM~NV=9I16PMo|gGn)eth zHYG_2$l~TTu={h&BAUPw9;g}Mkv7`n7M2gQ`}BApU>p& zZ*H95vaF^l*Idi?bGF3Ud`nEHfqD5z?qljJYVH7yz58AG>4bBc7sSZ&op-k@T8AHc$?y{-SSmK2Pz#K9bAs}Iqld*6_bqG)| z;L;v9$rh?1Ts<(>u7w9|@xx-L@|HkXf?7>nm|T}ghp4VFNDKwmyVZ6YaR_jYK`~_b z0?OZ(oj<7ZmVi2}uOe$o;DQ92CI?o9qnLXda)%kkJ5gNFKx9+HsBj`>9BG9?2)KLK z25bP7;x%1Txnzi)Byk-o34<$1+TPemS0Z5|bcoVyl53<;*gy+Si3I|jJ=%-%h1AW- z3d^q}@J*j)_L*t+T$x5J5l>9hO->YccZtBD>QTi<#7(B>6xDTr1aeShbySUrOM(~S z&4tv->k*v=o2?p@n-cn024zomYhEZ&7F3Gv+#;d~`|fqR%XVi>8v87K3YaGWiNddb zgh%2w1SPf2hvSoX{spv8CcIU3^b`NRV#>72toZNc6(jcl!|^E@#E*xa z-ooS@?aBIr9(uZON+)z*;=e+7$@zuLnU~5x>zzhNh~Sef=x^Idw44IcbG~7 z_Dj5o>g}0Mb~{_5dGpniy;9_hiRofv6*X zkB9xpfN>2^&XV$lUN0={z}jC|EKlUjqCruc4a&EgCLCgAMD%vnK%O`&QFdOpV)=ci zT7jzUHaq=vbu=i#D?ZVVuGYLX3*^;re?y{bFRGWMSd_hml5wtC|J%dLRePThTosG4 z5yj$~24OY0(xsDKu8T~+H(*sn0e^Iq+Ib4u050O%BZ3Sr%q1eh4&{97)nG<)zRqJW zpjSZNO&N(z9PA3vE)OJZ=v1ngB+-*eAo-~P|r?9=c z!*L@CR>c(R3>u9_kEjxWEyWIiwgc;$n(cK=36=#zUO{2VKfw|ic?S1zWHkth9S?4d z=Qr9p3VBeoBT7JaLNX(Crn86X;i9-fZ9Q*bwdN+b9J-NGh1xEofsdVop_-CqXW??} ztX$%GR>nc>m^?P}#vsp2p)hWDu(-517?kOOoD9(nNXrS{RE0ne)!0~IBEI}XVI$TS zNmT+=S1Uh;Y>mck10(}MbBU-3ysTgvE^S(*tVal~>s*TvbX7?LkY!qn3S_4Sef0@* zZ2wTrh+C*^Pa)%XI7^F)SOf0^%GxHSjf3`=!049^|B{M2X%%gD5Q5lk>_}W zZg`bGURfc`Z($(^*mal5Lo@h_zNvcw5 z2V_k?DvF&8#1<6Ao;ApCh1BbOQDuAeS)a4R-xDy z<qX%2VIf9Hh>b`~{sn?OJ<+ZVPRZFFql zEe6*u_F;XB6Kf&%ONZPo&|0_RY~`?#r3_gGA~TVRgDEOr2H+VS0#%4G3wwbV;kJ1P zdyCN3okBN@_!eFaaN$*=iMYhGP>)*jXKs-G&1zv3G{uT`B5bI;5-}yf#h^~THS-Fd zqc6_eU8qQM>DjOhDvkpj^lVFbMWh!mUl6uYU5sL4aCSl8C$@r)0JjJL1eQ|h;8qNO zc<@gg=ZFgdyKT@FS^N-q_S`32 zNO{E5u(g81);-xz!$gR7c%Lp*94!d?C28ncn`NkdfA6EbK>B zAdc!TX_=t;NaJsnVkKi^gi7YFDmaUM-brD+*0A65Bre38I3yfO7Im{$x;+|PkVqaq zGOZOYp+A;5#C8AOYd2}@>2R&ryiowRcE!39)S+8z6qXRU5b#PDzLvI#R0wy9fJ?Sp zzq%rbFU>26C(rggiW^I^$LbQCu1!?zl-wI}5iN^dKZk0{rP@RDQKO`ehc(EG#zTA2 z7N)CR2HJ=wlriwwR6n5J@p_!Pp8>0WP}oAsCboz~3qygBA4PzrQWnHVPV^-h6hq9u zQEkqfcveybqR)|Y=$EHZMd6flLw&nvg;>DK8p94amn9-_sEN4$Xx{ZJ6Zr%IjOtVPp;}k5V=u?r9O6TOpV}RNP0<NTkGnk#6)za2@&v`UQEGsKT@GRR-FaWsH7@GZj}oF{BU?m277R2(v|Ej@=p z%b9~P)F_W4Gzh$D!$iV!-!Z7&-H0B+IGRRaB7?lcXkW9ik*?VX#fr4BV+YLz6INK$2MMW zuRbLk7dKRklpR@) zMQURli~uONR;4X&QCu#(MM1_a23sfFI7R1-$<+a6u$~kb`&)-(zEoWR8U?p z7G*;KCOy_n%e%!8smM&tYl|LdGtRIhXIL8b_CAzsB5dcN!je`#|V&ya5Glj@BfYe9;`Dtx1$Ja3vRxg_m0oL`e7ChKFHvwZ7_2+{WHm7q&`LsNu<3ZW+-UXXU3_?_8{pc5 zv|snqvy2_SDQiy+w!L*r&py6Gz498>na5GAg#`is3*HSHRAO5kD5|g)NH6ex=ojiv zXVGR&UAoRLDl6Ci%6;KB=_YV*q#!Id$q(JF;uIuAL57=`Y+?UCx`p{XZ$bWN4n?2aSU&D9u+<~LU}>yk>cCi_V7XD;W$njztaxI9vkPz}-60+2DBK}D`c7b153 z&k}!l0jMA#jTimyX_737us5QTMQA!D=#MX*>f@Jiu$R*WTnwfJTo0DhVj$$s_k%&R z0}q1-zym2e_lK{I>0wkTs)(6|b~AmD0ecf>kP|(Wta_m-F{7P+aGVGFLHHT$>l(}B zo-Op1x`2aV&0P=_(3xyuSa=ciC7`XbR2%5vE%i+WUPvU!ECfSpBawcr!wmA+NbtayYo0J&7ba2E z9!i^lG(wXke{Yoodyf(kj|$1`3U|pwy4Edj*@}wAZ(AM-Ge^z1!~NDG$|Pak2r{RR zBpbLy%IL%kq#Vxv$3l#x7zlP`@xGu&m({?97V?h#G=aI_nW&lUxS~*ffKnA4BD(p$aWjQ57n$ zs+exWYr-39w}84xphSiOLE?dd`xm5JUWoSu=aN%`$B3D=FH1_6FZb~CBAcDGwkkX0 zDG@mq$ih)d1{S`pt=O`;=nU!TFWCMgVd1e4O^@TG5-|}y_TPXI#J?hq@Rp{#lcioi zNj!9p$E{K^40P=Soy^Yt~JOyR_nao*4%Q z%$gjTZ8vnuMrT(6kVjno;OIGNyR2c)zGgZya01PlF2-3X(T2saTDIA&ZvIR#Bq9wr z%)^M~GLdDlhlS7M%Lhzq(TP+>%u=E!7Hd}E%j^lm(^~})h7h1ua35P-1g;BH3WxH@ ztQSqB=(Vt&%8`dHd$tuzIC`431>^!qCfnFcews5bXgOPMrC!j*cuO;8suYu{Bs|SH zQ7{}@BT&gClOtH40c|W=BbJK^whRYaX|b`C(u9r>xA^^ny$J@rrE_3s&P3t1 z^;#Z{{%^$D_`mS!=lsX0vs=pm^mG1CEvua7JpZSbO&K}=hvPGd7gLhf(UQ?9-f^GD z75~v%R>)6G8)p2+T&RvJ+8Lu%1VP8eCLG*QA|9eLwmJv)p&b{|kf1-V(1f}f34`r< zCQje16HS^M^AwK9B7;B_;-LHlDBuo(70_J32P8z|=0Kr15D`Y+o{L-s{U?*-#MDI0UPi7X|3ie+QWa^e`^ghcAa=f$iyriw z&(uLYqU56okdH43%EcGNpi&f}GY^Ypl0dgbs4id`L6BjDXdYy;ViZVkA~m1|#HY!a z+_@X$sY!nj#!teXt=R=%qd(I(YFGbgeKr)P>`Y=|IuO6aW7T2Aren>$>o}a6eFSi) zx@Yl!L#HxME~Sg>T58x8qSHQ$jtK-Wu>Y#*!#h{bDa7-H>tKAvv%2*(TiEGzvII`t zo@#Y!g{^0`mr?WC#R1J`l#Nk(@=X0u&AnS7?CinYtVzlXauzntM8rU=7sXhLGTY3= zXw3bNlf=xnImTdMwT+GY*ViEg5gvqAYVS-uaKr;Rf@a!N0Q2JGKf%zBB~zw48bSw{Xdr6YS}-0^56eMWtEjv9rypKQ>K=W-2aE;GuR|k zGBsL@-kpRf;tKFbBIOz0T|AeAtX5#bT!b0t`UVxpwPS&$d`U@+(({1a3) zQi>)t8(O>wy1+OE)*56Ty(lz~MD!$Q!x9)vGnwM5j1EJOvGsD;grl@su+pqov$dlp z6w6VO0UNmb!sEbmNE&(sPhwJhMTPk=wU4UyfsZIZt^M|xajM5XKjhVChQR!hXE=wt zgqR={DVFO4vdinp%1dU>?l~1F=xVJb}{5 zUl9+1;b3hdpBOakBC(F(=1fg^3ij$8oeZ!@4=XwXKzvfbZDrDA65ksJODc-V-L3;$ zh}VZyB1RQ=@@l=lhgsXV7!1`J^TQTTB+WQIM=dK-RC-FW$QJ@Ct;qBh7n#NWnHn%rw8q)i9V#BR zB^8dFF=0EM7DSirH!;I*%N0#WM9$o+Mx=Ji>iADM3a%1I z6-~eh7jxLz!QK{yv^lfU9o3e0*7%~5qLK*{AjgCW@O`$GOXk6qXwO$v1X+rT+>%Q> z7H-qSC8+5z(%=x?lISPfN13=XkhrDEcU>N$RF?i^??*6b&6QV?Dmq>R(rQ+jwM?K)vo z=|i|lwoIW=%m=}O*tX@_sSR8xiw>dI1617e`GGx#V0&!SvxPSk5jQxRoWVDeAwy(~ zgP_p89W(&g1c8;xn!<(wsYo>^BRI&`2`~r2Q*Fhmd$P!6cTZ(Q!g%@#EtOS)WwBM) z9mc`QT@Gw&C94IrS}10}BdJYhH!6CXbCmrS<)FjbheFt)y2o1n8R{L>fj4eHhw{45 zN|ysXJOnV1blR|qjAU>nI3}z^zhh_|U0V>V9?mDg+!J?g#n6D`M6=U|8@^No50d67 z>JUVciZD?$fn6+sMma5v$VA`c7$z-tc zup)WkHbE+9kg^c9lmiliOH0CRoB6Ixd}aR<97u)4f#P?eWnnUtVyv2IiqpGPmSgoy zv;aG&#$JIrlfjMyR-61;z^6D6%PAq5U)Ui}JBZ}V^cJ53mb}*4OJSAmRoO9Axsg5l zC!kgMsaRX>2?6T{ z#o!8hkPGv`OhxiT9sp{DHI;HWIEAq6du;whOHZg`W!5CIXocM8|ZJJiY$TT~7 zk$f6v6-!kp?0YEIDtq9-`D5G;dzb|)#GVOUp>Pt=gxVr81K@qyS^kxXw4MlZz#d4O zg)fu?SP0TOkcD{pr1ADf6#Qb;*(FSP&1jJmb4V>pf)2SCMz3=eCjp6|K=<&9@||lW zM|#UqiD+Q)(Hd9zuAn1dkA&A@?gdlKZsbPH+n*trL(D5e=q4zhixt9_;+ba4h5N}M zV%&BoIgA)vUi^m$&8w&5*}`4^G+VUmYNY0f7lOrDFud?DS+b00+w^jZISZoFFsT(*PkfW4B2TE}JlG`Db+YW&tfYOj< znZ{xMfdU>1Zt&Ld&SXGbShn_|le3>E~h`M+m1Avo=5c%QfO7DbB8s@BQ=sv>hT`?(^{z843qAV}Ejo^XsT z5(N~WKr$kDW_ZJES`JU(-pR6%RiZLJJdNE!nqPC25x{F1U?k-n2#x1G5A+Fzk@*NlDzJH$IN*{*P*Y$Jf*R(m$2+~GQv{L&7jdv^O=#VK0DuiQ z6?h>(7@>(Kb5yHrw{VCz#4^e$me;Df#)Y7(Taj83hyT5>vu4#c&7QSr{%rBDL`9+* z=ZKI}->0cT$=RIxm4y6TFvy;30#4Z?0X|keiclqd8mk`JH#y7F(K5#x6~bf`Rf}Q8 zC_+|NjL?;ZwL-K&tOdNm`w;d#VInM%yzTpmIDl;sqi<4aC+FOSGGLh$@XW{CY;7l{ zkT%v27$&~#C8MV#@wUp0;dI*Cg=`?51xce}RCqYvvW*HhU$9xtYPLPAy+C=q>Mn)y z(RPasD=P)7TMmD%t;j!oM@j>2ZaPiq0Qpb#px1`g>Rl0EY*1pC&hwE`Y_3JDBWPQY zq#g8K%$6%%Pz4`htvIE3W@6z~F`s*sP0%@zZ}-STtnDN0+^h{D$aW0ia{10usCnLf zBTAzv+PU_OT7!M_s1|j042=O!&5HQaxJ1=ZX%R-Y&xWONA6=LU+t50g8=t~b`CSGa zUej9}R3|8NR9arRgyqcS63!o(N$n=g7GeC2?cKVepYu*&Cl^xBS*{@?dN^ z8WhAihY)NyXtdJh3W4G{Q&Tnw%SNgg%@{vab?c4Mq0~1SlFYVozCzPy&O%{X z%o$xAH;Q>w6xCMpphxGyCHg$ca1}+9^)~GVSwS8!z$O>|T(QMt0${HS9{606xq(nC;A$T+ozP*ZZ zuNP}Mb`cR2+(hJVt40WvSj3ugLY0(Ad9|{?D6>3=1f5#Vw~nS%kY(|$SyJj}hk|9YeOmhzPDSS3+Rs#(MH3PM%YNP^62ayhfs_Q6$lwV~GWjd4yEi z(a+S&Yk)g3rSuLxrN<-O4I-_g$FoAvz>AeFI893fioo(wVeB^_Vx^&nJFP@+!X#U2 zbvR6h%++MojS~Z`EfgYyd7*y5a>5`vh_-w=WNdB4pvGOg%BktZzUfhHufQ3|%|VD} z*LO&c&!B4p+(r12fD)I7<_r=EyF&oCCynQ+WZWX-g}(c`f@VaX-q^;lgg zrZRC>6+AAeefk2*u-HaHUiRc5yIqnNBk&T^W}=FOs@^Z(p<|joMTX*o zp>~>1sTxeY%hObHr!v!GeJlxu^RDYtOr}ICyWLbF3MQ?S*+Ug~@?j(YPeBDt3#nET zNuqDKi_~CL)H3U=K(xoUXw~)@-GD~T;l98%LF)TFPQry{sr`oo>np?>#g0JEVVmsDe zf|CY=Ni~{3n+n)H{6uww^O-tbXnBV>1DTwj2wAgGVAvs0eR)F3O|yi?hkH33%Z<$~g^wnIu<@2yLlc}dW;@t7kh)20EUxW%Hd1bJo5&7KJwz7c zmfGG)0T50WryqGTG#JJc1FX2|6gdpu6f03L=sj#Im8K|1Z2yC(@^E|&3bn7D01-X+ z1EW)B@phPHw&vUpz>$H4#4^2IYeqL;#{I^OmAY16-|W}8`kDwfsL`_8#q|P=qbXewxvaW#U?4aK%d0rYfGf8$yN!tdzN@F(_rAGfZ3qte1`jglG&obQD zDkH%D@IR-OSJ>_U%F99(Blus#@)^|gnJan_1BJ*rv5dkNJJJu_~FLohRJvs()NUZyzxWuuR`&B4x;15U(n-w3NHJr3R@)pOQ$eCwf zAO)QMGCr3EhnG_nRS3^jL=&nNj@=jn`iK17rOn9p%M;f}y_fhjpGb>{WbA2nj%cC~ zE|pwl+m6u(O!Q*o2y^kM)p72lE8A2;U7Sp9k}5`wU{I}Qg?Q7Hm$d@BK{-o!PU0b8 zka!NiHcN~ju@3N#<+VM>tc7x@sA6@bq|gf4VZ@z@g#lfkJ69gYYbypG5XJ|sbtyyc zUWa7Isquw0-uCXYXZVs2Gyey?_(Tsqwn`{HB|~4o>`HwGa{hjHxhEIP+)ec9%CLzF z{oq@uC?HvRgrB#iJW<~BpD}PGAsf>3f6BDbw5;>LvSQ@?ACAwU5?=&QO9`PW5B^+& zf!}%)sg)*S*r8OMLMDh{u93coh@c=ISzZANG?vS-#mFsvO(UwypszL#!nR<)7Hm=B z!A+*$!UCM`o-R*qmfKFlY{8BsQZ5i5{HbaMZb?anm>sOy2A$=QQ!LeqDi^^Xa91^e zebG$_5zJ-j63tw}yaK(J_BjE169513>46Zxnzjo$1GqBcGUZAp(ay$ z?%XMM+h669c@Rg?A;-o6jApu%nvZ=Y2lar4Ol2}<`LvmOvMmm%GRc6}hUjX66&S>o z{$t-!9N|NE|9BK{>psM <%K$x{&?@THVOVQXb`s$SyWKc+wl>9g*%3GW;pLex| zf&h@%rNnUUa9w)A~AeNYmj#CS`8M80b!0#Ke&}O{Lmz}0vS4> z6%^19&^Zgs4IDT>v0fq>{fmD1q5zG@nqpZ6wt*VnSMnKBZ~<)%3Wp7zOX#uS-STwn za`rFSd=N&yA_5oI|M5QAnAzGCIk@-&M^{V)`&Z0^W*h1@9!y1&Huf@&sP?#e*~qaM z5kAPQcv-aUd0R)I%?z~lND74GMMKcm;lp=)fl!r6?%AvKgjK_`r&D5~P&LwAt;nQQL?E!AXzk2n2s>JiNe9$) zPWr;mCgJ+wp6lV+7M-y?*; zG854kM<(Gp=gUsd7tz2okh(|8sjc(Zt$&>0yER>{!ar0RMj1gxEYNC;V*uAiyaifM zHk<$N=l(|w+mOb82vt^2smO}|P%#q!X;?mkx>%8z5Kw!~h!tLB2$5!icR_SVk00;uT9dXmVq3YeeE{l&?)H; z(4|LKnwkL@U8BR$Q^h7<53b>qA$6Mpn%by^Qs$GoUxN+2_t2u~WM@YAOx2Nqn|X^Nb)A?v zciQsXaD|9s_(V}M2g{73Wi2kCL7H!d_zclfvNzv!EF4EShId^-gDl5KBTBjvF-mBWOoW6@E=6dx z+!B+lSE%t)bKwFlBpoKgkva22R&hZ17}X{!Wle#&AMxQZhR7HY1I%*Q9OsO%A!plz zi#F{@gNTSYe~1;Lrk*yUvU)OZ<(Dwin2t=l&`)P8&I$!B zO-uxq3*np$6h48642UO@p|a(zcf1UcUyAUYM+XVCw(MplL+rvKnlW-~%}bmeNPvP9 z%%awI96y`8JLb)zn7$#q(ZYcd215ay5Avtp>{+HnSVFFuCO8w5RTUkwEd_YgNNG60 zKtI!@!sfNvaq}=G2{9;Swkm2s|CUmaA5qEP3@=*i32FAk_`5Gvqwuw~P%eF+7(v zitY$eBg@1)BiJ`KNuX>Mgs=1h3e_YYY_9` zORJ|}+V3WOwC-2wVID&zOnqlG++WnSL_`unq!6O~L!y@uy-h?!LJ-kA5kws&3OQgp?f zn@aGlf6497H9fzoB-29Z$K5A}ot=wJ%xRtI@1`_XwYMAkPk=k#8}mzcrUrLJ#MV@{ zjG7JYFmZmjz`Qx^?xn7JRPdL=Q9^p6TD0b;0l)r|f38g;F=~ZDMT0fGa#2o{`IdG? zQnW}vjf#T_r=#ySF4^PmjCb!y#DjP2NmNvi+j(U{=W;YU$=Gw+w&dUc32um*?@jpC zyG08`S3k|vI5{Vd1S)af#@_ab*8^*u5e5 z(C_UUPTub2gOPP)1?WA9_$bGX*&|e8>=xzw+Vdi_gwgPP$6Jv$X~51wnnlz@%m=o~ zZMp^OWNDFv9~?gU(CUNt+cG3)@zp1GrqU5&>Z*gJDNmlq3epTL$R-U=3#ENdbqnh| zjNiUHX2*SQiMeObW7Vm2*X}=Yy=f_TAyHVW_$1)fFVpXh=w}wZORWzKc;MCp*iVfz zIg$E9Pt?@le+<-0{~JpAqJ}x{pZWOf3Q;FujHyBBPWleZ*w0KFo=mnheN*m0oYUtx z6KBCE70ZVM-Bb?2@oG`8c^o9ZM(s_S_O?y0c5n~ftU7U1Q?uKk^~;xMZA~;e4sxIs zG2~-J4ooDP_dH1GqY3|e$?p^Nk6spSvify5lSk;?A=w`q8r54}$ossE`Uv)>_5)v4 z`^Uozk&gSJ-gbTMPsh&KQYG~28d!L9KL_8etob^uzqJOk@g&-yE*@%5mowHM)m%kA z?l6@!s%3smV-348r)fzj=bL08Y7~m6CrQG(VdZ}(`IBlme!U{kaW!B%)?LhPJyq)b0Wac766pHNw7w;jy2xdo56lYV3;f zHR1cmCJkXxPvW4ul8u=~c2u>}h!c`Oq`(&i*+TVfNuQrj~WhSZ52CW^FS3lUW5bkRfba~vC?_}`?IKMS&Uk%G| ztjojBRT>|qUyE1N7y9`de@fN-opvd^V5L;nGCVZC?-YCWRBM72})6q&7WrX%}OaWZTf z$dBH(wkxQMOb=^xoGraV_w)8IFYlS@Kfcx|YcfMPAG{RTakcFtUeLH=cUdM4yheBe4vt<7%)1L4ZU{U%)xY^j z3@Y_-FEfT;$C`>bbgioKa(ZY6TEdekm1!(>_@KY;$TafcUvH2}`KfdH+`B(}WgHq9 z_F@;cflm{YYbqw7$s6ZH%35LunHC&-wmdP)ND?be-8rG8O4L;cgpwJNNEM3B*wO8x zb@dl&j-R6pIZFhghEjITJzEeBOsMfQh6}D@(~cevv!S{3Hp_nxzk5TGO2oVJPLE;ICi)biN0EUW>2QK}VPXN~Xf^wu8T_-;*4=gof2m%pz1ga3x68AVP(4O+Z_426g_flTard6gzlufXTISV9&s!@Oaiu4Zn zZUj8ay|q@Dvla>)xcZDP#{t~)CuMP0G0D zUS+d$|GJhWCNpxTHZz|0Z#aUGZDW={9I@4=!b|n%+n8myxT%J1)dOvWRIU5_*Q#%I zn(b!qz@6VIeb0EUm1=kNGHW=GYC|k@$DGsY^su7ixu7_5tp96`+k-OcH_hx3(X%^h zAu$_v<&^_>?cZD3<(>C6Jd=KBX(DHOtaIdB6qHd+1HRVy&|>?Gglu6+?XMQ)$oH5- zXx-fh?GL`#q0<8U8AV*P_V7v9`OZ1~6jp~6Gw&ZM-eFnF6=rsl7EUcwnqy+TP7iP2 z-@VvXj(x4%Me6OQY#(KJSd$LNp=3lrx*p|uU76=KinFouSUxSaq$Y@SrG}?^$dWYoMLADMuz4PATZV_(o5?7zSBj;e~ z=qr7VZC!Nc$F=KM=+%szmuMb7m~(Dvucj^S+TXg#YKQV(=55QeSdyAcry4fY#2cj< zG%Z&m?knMXR5n1? z(;m(7KG_y!k2~tP1)k5)V5N@FYAz4%T>EvGorx}Z(!e3=1}$V_5lI$A++(tBK29VJ zSCs7#K7+3XdH$w;^i-j3Iv?7=5{4)w@q(`-6+%5lx7A`k{3x@J9Kqv3U} z8pGccQStH8!9e^It1BH9UmLZU_Q~S>^-jiscHIqh<-LbPW@q6RDh|UMkG4~lGYD$# z9wHuhgGC1g^CfFE#KV!#OO=@R$LAEP5+^-Ja{j#sJgvGW4A35Ri7yz`D74R&Iu>r9 zNTxY%N(;=%4)%Jk6E*j$TFmZ?Pd+v;%|T5$Tu}43_FOd4N5|vv-(x!|r;j%O<{8SI zohpDXhpXbPY*TtN3hJ5#*Hq7%>phMV(vt-q2OwU%m_3@27h`p)Fll-Jr9HjpVXj=< zkh)sUH@`Fkefr{Pd$2>7(aqN#1(H2+7()PfQU^}9ineKgIA1OIBh1bkKjB-~kT40A zGOqM(vc4tSenq6%$Jov7W#7tLwDv`RVmYUp50A_@v0~ZJm7k6br4snLsaD2wQW+oj zeZ4#5CG_O0#iy$<>hvE5ofN}ojQ+bUUiQ0J;U3zl^>X)mqU)jf z(;NHOK$at3A^x<@`iZwe-&Gn185Fl%xD&OjfU=xrz3<;VNJ;v<^jYxd{Yr_AB}Fk+ zOUB2IY$JYyY{fb1+&4~-z z)HhEPB&oq9)Gt>Z_kr3nNk`)TnQC27VZhhL^>dFm*;$W0W27Fx{PIF5>cU|TmEzC_ zR4X(O$-*9T5i#hmf35It7Z}3jv3A4>Nxr$e9JCJ+%p_as^%ur0BX0MHyZTE~C17Kj zUp%g+5-jBxf&K}z*Ea|)=_|POSc`cz@=l#q=}B8nL-MLuN}jm2%0Zmbl6KFnk!DU=F0;U?8K*`|2U|52=XvId$cvsS;pF}~y= z?NR!U1+>XPC%f|q5~VVraiQCS_U%3@~pg7{_g3JJy1pMMSfD$s(C+6G<+O* zs`FuIIP*aS<74GeV>$sh*&kl-qsukGOgZ^;nrj`RxP1Zqzy`@q6x8dY6+z6}fpHD( zY!Ep(4{j#o2ulB?78Q$o(%A>+`d?er7V#YHOAm1nXu@Vl}k zM4H+20tL@MJP8B6aENP*L@iB=grxc9+I_jYTz>5qtZZ-#fqR};o-ImTGkROKa3*5w z&Fpha=2MkouUOUFOm9E^cfw_gkAnN1tBOTP^(h(x zsrZu-xBg`&*8QkW-Mu6OtenbnQ{Gqet66+nxHU(d7u-55`E8fS4bT|L{B+wbqn9E1 zpEOlEj5-t(aPbR1-@`)FH{Rb@t^Nz?CeHu1D5kJ#THcxH0zv@{(M@IWYeb`4XzSY>3pQa+k-mIC_&2hyG41b(7N42Uf6a=gZNr5}r%O zmowYZjGn)+$AbTQy>=SGjQg`x-ncvWCuc>QPKf@-t%l?WHeq3d+PZbTSe8Ni$vGFj z904+S^W;Qo!6<9^AMUjK*_yf&kxzX!k+vng9ObAHcv^;n>aB>)?(qj1d2wtM%1r^* z88X)g5@hz*twIW=){*B-rwe;->JwC9f$3d+{cTV`-s2fHCPlcm{(4Atuyv)eZMmS~ z%=0|Dj^*PG)mN-9GRWS;yDtEKcto}aeF#OyoT`S1xP*Zq;Tvl{6upPI*S4+GdLKSM z3C`P)y7%98y9}B}-<4+Sh>faiYZq<)*UI%z-IONfI$bF;0mlcFxN_x-qj4yaPd_c6 zk|q6z!jT>Sz-1-^_Lu*gGLA2&E?i4UQ~?AJaZoJd5BR~DM>*P`ZtGK5 zZc_H!h8X#8xF16F`m@Lo9wN#;@NZzeR$c4Au=!U%Bvy1)>k%7vQIo(J>R;`IE>{eP zvRKvE`bs;Bb-&`Fd-PUSYLDZ)uOzT+?y&jy-5Z&zuFHNI#^MYfo(ypYSe5T#BGD}0 z*6s(vO23s}^JGOnol(;P?5&syJjMGLhDG`>E1Hxsa=8F)(WG0G8AGI&ECvvWWTUuY$^} znaE%&iTk-~x$WltU^BZJ=4{^mcGJ7gj28HIWi^REkxAUE_2Y@t8oe1mjRjP?^y@=& z?q1ZIY@fLFI6MZ2$o~!TEf0>thK+qLA2lP~3lZK&3RTaVvvZ$1{SS>)aLSg1$#h0yAW5=p!AM zLGI#;`I60?1<#$xnu`mVEcg#eD+MG9@FLo*2H)d0s@6CSLQ)=m_$sa(k=!31oy+PqPZmLq6<~Zi+TE{j8R=UE|LC(tc zAF)P=r@$%qQ!~?w(Y_XD8RRD1v&i*82q7+w=k`)dTC1`byIp6#A8Am3Rj4)ZpajR8 zz~;dtcx_HK4(_ZFQKAcORLY-tEfDO1K4GZhq4t{oMXi{stoAR2$ zQ}K2w&$*TrJ4y0z*W?jN(kVK*huOcVkzLzt^LGNJh|QBRNd@rlzh@$5$9vpLOMrK9 z!4RDl>{<1CzP?oppntQ@U3Ssr`cer{F^p?u=U;&VsPxH>#8SJ-HLjbGY!v zmEWyP@bg}>`HIUqt*>s)2J32nsoht&_oAj-5GH|oFVnVKq~+`HR7{)*bSG{wVrq|btwkNrc^0?|L>Q7igL?XRs9`FqV-SOta%MXGQjHy4OZa2N= zE)1{C2mSZ#k0)#V?U9JSl7e5V!mCVxm5#F$7-iO<>M&>@P;-bVOwxKZN@46rYEks2 z7c0~S%wgA?b6lkET&b$22|4?_uDTg|);Yqku>NDW8tlT~Y@VXke8@@Vc~XHpj!<8D z(IR}K`sWkMf-&vj zU>Ud8+iyCP$_CEDEPq(T6E7m~Wlt{bNE4g+!PIbQtCqPWH0S5W zZzgV%7UlL=GNTk()vtR(m;~{&>;B*VF#az@ADuBHdhJ`LsVTFdNJf;6wNOdHyP9t= zHf6eBS+(tr=cl!zulqOF*4yW*lT+A5q|J)hFMW?b@#JtSl7*xF>0~o(9<0JI@6m&^Sy`tbKV%M zbielzCr?sD$XR@bI0#?&RKk(pF!oWtp%MLNB=_=F#=_6f#cI1_6SjIZt{7hpJ-vbK zuzxm2(>|r)nwP{&kU_LL%_`oUcTw95UA{7NU)`apX^kpFILq(3M+|!GwT!sf6~9l@ zb4+n*cXaQRJ={0>CwTXlp8uED={`D-o1IzBQVdc|R5xg+jrl_n1q+|#|IVdu<-cUl zyV~io;UIbaU23&4{p(jn63QD^GLxjufa7dR)Vj0t&K8C&;~LdPNznq%{yPTC$OZ&Qq@%%zVtmu0K z0P)t6eC=4F&40hjeZ4)N-SCT^zTdCs?=|#k_wRG!4vbSVM`T*1-S{e(;uu7auZgu; zF~*Va+wo#@*)!19W0=QLY;W3A>$=V!fb3}79?fBLk?<7<_%(<3sd=U(oPGk2$EJ7v zP`R)}y1Csvrp3bx;=8&TdWIQy2{ed$3>#5YhHv*-1f>BZo4P1ehu7zWwnE|QOOuDc>72EN`&^r ze172<`d}sXx4$Z4)ji&xKQUSP`bIByOflKQzW%MUug=x|Z*Qn%U*-2V+3@+dwAV`9 z7WRJomSHCRh3s;^*#4^KtANPstwmKd_C0Mo#4SeDf1WbO9s!r>X|mN;XlILs(&Unk zC3D@1y(CO+@Wj9!9yl&AUEW3B_re>GytQbjr0S$(hJYr9$AWI8s`*PP$7LK2P z_I6{`yy@vonL881L_{>_(swqerF3teW!#}nN*;na$oV>>rKUtJZih)qN!K4n7~Kyu zxMTDFU*{If3e4#VT<)|_85bs5R}(Yqz81a15mO#JBq(JMzJxoPVzrohbVaJWb!px@ zS2#8hVZHDo`tp71W4@)5B&aS=K5@^3c)z&YI{*uA%WQL+yx1R}Zi^*51LU?5x1Fm_ zy-%Vk^4*aX`OBA#|3kgvCn$aAoYqt?^!w>mZnW=tHi+KJ(eyjNdZlmONx1!6?KVP^ z-Fk>5_VM5C%O>>*VyBmN$y?hPe|^aHeS-&&NX1-nqqyJwn%U9EQXlZh#SgY{J>z*pv6H7P^Y--&Kp;eV)_oQ}1CEd`j)`*qKGt zbq3*PX=b6PXPd}kpe?MqMpjIIJF=(o>7%Z?+qEfywK>LloCVL}_h=wZp*)|8)4Lu8+TU?R zBIJCccot7NW+I^u1A?0KY&t-S0IG@ug;P4TR25{plVV$M17RsYI}5<+*m$mV@Df0e z$p8wYkV6f)OY{`$WNN5HajUB;$v==WGUw1yH1gf6yN4r@w+ojV7rSTxCKnl5xhxzl zge^TrUu(23%N}{u07CdU9L+hu7QDz+GJ620{^QJOEbca)9_Vb^6S}J-a%)=51>%c5 zB3OC!fI%pqQ_aG?X=cP)F&$eiG{|>4rrtKrG(e3gW|RTUvZ^BnH=#422PYUMt0s3C zm@-b-*3OM%#~bX=wFMnRt5~=w({l4|Og-v|k3daJISABym*HlBfy`#1t1a5l2<1VF z$Khg}{Ez{{wZE5FVQyx`ka>vi1+*U>7}PrxXoh%*Z=io99dM}PG?WR}mbH0zd~}{P zh&QiUT!YnH;zZ zcsgyxMZrJP2{^leCbu1W4%Ve96f9mWlI#Z-K?Bf`d5W`r$BdC?_W7dU{F3Kb#Tq(x z)=&HVyZBl>$`LcG-g?oVn6gi4FtT!O%-KPsvl@;!(Qs1vTE$I8h}oZV7_i4q2MGi# z1csB5HA5DX9$k&}4OX7LXHikNv|4;;>BHl=06`N)x+!r%poMXD)NIpQIoi@x8b1*T z^xxb`PWHmhtSySCEVKakRnX=Wl{wa~MIDG?A1NVF01TKRG~5VW=!tzKmhLs6xi3T7 zsqRG%0xp?*8aeZ7aE&KJq>9G*M_L+jZ zcpsuDX>&W?XMt#5wzfIUJaA5oBtTlb%GZ3rUo4M)>nssq1xWi$rIl`n7IMu|_VTC| zr^jbi)vOAN#EAKOY0qPR{{xO0iN9Qpze2*KG69ea>lOnv>tZ6bqHW zjXejENBg=UM@yKykKz|`r&T(yD>z7f7iJg)zvp!Q&+K3byTU~q8c5u=WXa47z?5Yj z7*{U>83E1*P@Y{N{Csm%;lOVw&B4uR!~@$wo9RbBN3#ThRvUqo^$3LP*(~Qc8|Omf z@%NS?dBWZzZizrLGv!>^kKBbrhOrH#L7tWfa~;#wD|`DCUB zP73kya;wHP1Ok;72`jYI(@;3xZZ|{G*~px{|6GrT4^?aQX`C+7R(av1x15E8)a3V? zw7WL7w17P+cUbg2?Fe7;IQGV#s0`4Bm*GquyWhlC)glPh-bgl2ds%Y~b8_%#@YOKOz7@kxW5G@^+Rb4E3=oJuGx~7)`&*Bpy$}6eOnnN-vZ8gVdV5AhrpQJa> zMVbW!l~JnD@Pq>gh9Ch8+2&G=gBGZ4!Iwk;K}Ow=P?n}7@@h{{&&5T$c!qN87Qia# zw430NB1|EJ5RaP9n~tNR!ly9g#mfkl+1!oahxoWpz@u3J{soAp;-+)bJvb!90kx}c z0V2mN;Vp@~n0N;|&)1*2E>aFm1IHSsxWw^Cw$iSxn3&Z^OB(SPr*);9uFVJay3W*z zIurtg>`(LpQqDV^87pMh`+AT|ZMlJkPrVbR1N<>n^FyhZmybhIz}ZSTgovPkf0hqx z?rP6f27$042+E314Z;^)A|y&&&W*3PYT4i7K>4lIkFh?#n2A0|+}6sF9zs%};x)H8_ls@!*bMo{KX#iRQvL8kWW%9ftcF>nhyj~OpH?YahA*Z`MqeyRPu$E z%w?Q3`VXSFo16FPddd(sewg#kfg=zIP`#-WX*5Ksz^4^L;k&s2#QB993ym_V3&=&Z z(K;1@z)UvqX(zTj@Fz-EiJ$FPKxcd%wysdDP@TiX>8?bA}_$y3ewf%z>w`{lmS{infIA< z9?p(OU1E(@$EW(}i9>G`!gH()$iV`~sLxa6E9Wa(DzXryNC3g)?SJl@p)x6p*z++G z4jekzvs8*|a$IcQ$6(rDMyAHy2_#_V7IhM=VPkLuI7*YpOY@m z?NywKZSj@?M~A^xkS2LK|D|GD_{GI8j0-yp7&>V5>-ifAYs0tTb(GK7>H0hIDA2;z z=H}+*X1hXG{Sar}%?K7|=4^$o%$d56=v@H(;xEpd04Le$?bAHk#~hD_04JlY z^A&APUdKfqk2pmYSHtHAIKZ<=G5Fck*&JaQiYV~9fDgCgk4LRq!E3QH%18Y)t})k@ zYRY20*M@W~P1`n$axLYL_jk1cfhi%w@^%E3i*nGWfP-uV7rZsH^glHVU(lUA z1tZA2YAq0ah_2luZL5@G|KmEELLk0ZgoVpLnNp4G7K0i$l^hic$&mkBs{aJ_rlDo+ z@c^>ulTbywRxK{5=xjNnm<))#O=RUYV@Gf`ATx6j#8ndbV4HAQCnPF=@sCfmyk#XD zrVPbSB7Ef67$D290bZ()}ls(j2pU#+uf83S|~`CC}3#0PuL95L*yAep)8m z59dcVYdEz4P#g&RMu+27&W4LY1G?%YY#+6DwBpGT=cGZRAarRPh(b7IOj|A3n&@7R zkswZ&DstoGcg|%h;`aQGc+}lw`R|@@1cob-aq9D#68LX+{mHSMN*8%?-h~puEt_j- z`NHgJ655%OETWJ$q?E$+3)AMkGf>DQ2EVY6q?DupgGeEGvZqhiIa~m(WLmj9ch4u? ztd5+E@3E{xdFv?qE!m~GwxY3b70O8`HNzE+A3JQ(+2U>3s_0=k^%k+#=`wn+c-A&t zsTR@|KeBIh66Aqt9KC$3`*>0XA)ZP3yc`U`qZ3mCi9=q4{V7mMA4E?NcxG%ysneIL zUcm@*yfmyWm+!ln3bEHSeKE5b zt!&DlSzq+;*qQVLTcb8u4Ilw7s{7^JUWn<^PybwWL0E=P7My> z9B|*tldW-W1y?i|`A|UtZsIp!WJO-*1Nfb^I*u1;FWR}e?9jPvXL?+0NAm{ZtNY$> zMNky@YWFT4sQbc#d;)Y==&IB$!6#8`2-3pIBp1}6?V?Jx0vm$>FE;Ah{d_=VPw4 z^*9H9G_vp-e7ies1ty*HU1p5cxDx~5sqnlv;a{B*w1FI98^3^QlC$DCIuf^PBjfT@ z3U2jqU7Y;NRX~X>dhDlCm&oLeZR?-_{&SulQBs4IP zaBgN)LB!V4?p?&QK%B{ITom8cNWO~Zof0%x(0TKGE0#FVJU~Kg{rr>k2t^pT1wnmx znlqf-EWpUdc?hNc=pwpi9Jl};E;yjyy(OdM)o!4t4s1MLHL@h2tx!w0@uj$Pbm=52 z4Ze~&5>u=PAR)Y1T;@(jPidFx23p<&D7}2p%LE;U6wL;Aek&B710vpbEbnE5h8!C| z#?Pt;`tNthP(C5K;12>YPN<72F}Ux3*)XaROuFbERx)Zh(8ItgWNRG4WCW z`}0V4uj%e-sQ6~NR}TW$fKWO;TVs(?dN_yq=0U(Tpco5!vXvVCV3!WP3@}T_!~$v^ z3R(vNo>j(Th%Q~6bUlhpart6!f}+>y%s)7p7P^QJ%>@LA93^JOogcmL&C9?^~ zlie|l$hPC%nNbL!ocvv(p9SEHmjbrwN%#+hMyjcyX1)B6qvKI_d-Dn@i;#Mp91o`D z05lhb&Z?_9%0(kd$LK^r6K+IHfyG6(=p@+z*9^ohAbm~_&?xuyi+)S;aa}zin?%Or z)7^U+<7cXN!l5KmOtf?${HWN1D-$w_?}5tO9NeU2`t9o4I%z{?aFfp&1qi*>^-~bH zncR5A|DNqJLh&Kl9vk@7H?lys#o^1J#C@_WS+MZ@4?E zp=EQwW>AMR<8#hf3ZS41DT0cKrlGUR@p$4C7+ESLir84D4!V;Lga@6c>yVH8^)?5T z^LE?Y?Dt7sn{!-*l-fE{c-7}}5LfqEE*vRVAs6^^cfS{*e2ndl;Ud`horIQ(DH02M z#HUg2^R|da@9{@E&zN^_q3RTBh3B^W7DbgP5oh(V`|Pt*K0N}316Ume7-70>SW9iwNY84{YPZTBlx86 z&{_;H$!W1UWixw1sr=x=H9nh!1zKF(QFu2~eDTyaV2E;fgye!?i-nZ^C>!8FKCEG_)^O=d?u_Ckkw_l*MjGvd`O;h#QkWNgzzWY>T&K)vsO-MA=##85MLmp~eSk-X^U^-h+6839Ymg+{luvdLYq!n?d0nCl;2aAPPTImgdR@ z-PVs$Snr+0lcnJOq142bfI9bq?;)K0U~(b~r%0G+aj0nB<14hxyh(O}CafU{xiujf zhHZx#81lw1sa@5d@nTci@}-|>r>ZQF@unAvLa4xH65*0*2?(5}7YjU|8St9UdJc5$ z+U7GiWmU{O4$*?Ld!3HOVdv2tK?A9p74VB4h0E^O3IhHdzO(O;k5dXVZ6u)R!NSJP zM+YST8Tk20$Krt>5DmhaG!R$`z70);nrYGV@^cH)!aYPAo`x@8ZnJS13B=p`FVzUa z>s(PRm?8eQ=S|~wv=SeeYIpN4avgA%zUyE_xdmt@ND~o-!k0JErPS8q6fd@N_bfdp z8MV(oPbFL?{X?CG!P&Jv;B?SQ%3Gr)ud(lhOJ#i!RMB%4A7mtb`q!$BuoRu9i#Go< z3dVC1;!%`!B!r)0*{F!!!$N{~Q@QX9%h5{brMdvZY!C-W4H5;g%kTg%kS5Xbneyb? zwbzj2wm1a`We_C>4{fsNQRpClu{j;!p^$ne0xOi(V?A@d9IwT&; z!xyMvLzJsR%zWW;bdro>v%^0ygm?=^{uqYezB!IgR$DqhukKgKWt0RUlqbAg*9XU$ z2XF+~+))Y1 z?0rx>*tu&8I`1#?n1_>(s2LZ04ZJ>0%;}|IJkI%&G!F!n8j0KK)Kl4~hxwS(C2TkC zqabOILM{<@1Y4&4ZyiQ#(80i|YnFeVk`#VTBvdQJ*wL}q!Yc3(nNqs+(3|uJsSrn= z9Z&$4i}(UBf|nS{mR67pQ55OGiVfm);Cs=WsO?V}mLWQ3R2QImYPec9lEbaG%#KFq z;!%O%hBm7uTNDp72eI8T8kg#`(gkT=sl6!%$NhsUrQj4#&#^ETb5Enuzma==Cuf5f zXVhGcJlK(WAfVZ8#noW|vfyhs92~ZN(v3px2fM1WnETnObZnHz!ybXhLbzO73)j>M zRu6*+zZcP#euVu}OUPa@2keb7WG&akHW`i}uO}iXmxBrp^@}GPTwLcJn$F7SxH-)V zUem#%Xe=Al5ng!TooNYZvjjdAm`Y;iWbKpTA5j?Dd1%OR74QNj)RU?7%4# zz?|*iIEur&pOa6Kcn}`$3hFGEv0qZgUsh0?R=V=MQgy1frZ6m%jpd3`HfTe@x9g|eC#31;4_?ibzLk>xce5+92x zoiCltOkmUT0l3^|9A;k*++6~xV;Lk7J5}Lx_Vyjc4w78rHK%=R4NAmAD__MU*Pd*S z8O&0MKR}+CONg5%Cn06pj1x6T@`uQGyyK+F=TCD@;|41;hK6yen@#(hV$%2T?**Qe z=sN2V=ZmJG@VP|xa+3S&aq2bYR*xMEVEq4Liw-O!Z(Ib`*~LgaiqT-Jb^-aU|V1dAg$AN+gnrLwUtlXE@8&6 zi(a^N??y@+80c@W-=Q$fc{KBMp1sPWK^M4y-GBj!gTU+-Yg}HP?R@`mU=`sH9nzdQ zCk;?K7<1MP0xjnv%KFR$_eCh#viLZ<5ac=E6y=Ns4pch*n*_G1-#URPgRsMRORr6a zaEpNc;V8~b4`b`?F^4ZCG+++hXC%5!T-renE!IwlN!e!4HhRo{qjmFL{#I8iCi|pq zC-&*uwDRoH6dCF=4iAEEVPz0Ol&vNG{k?{sXEE1*%r z;t~<==Y;HBe8i7(?V_hJo+lY8i_g%2njubb&(>Pd$Ad;pFBs+3gok&7+3T}8Mi8Vy zU{KAzk1Y@q&-B9QM@{J|Dn7`=b!%t0nG1Z<3?yOaU<1K=eAn#b!RPJtAd!bH(-d2b z+49GQW=i2pDbbC)kvopu4ciq2trP)Oynsf6<7P2yL0Y<|%;Q(h%lu93Y6o|jooVo>A-r1 zrh-zDt&^*PZ8dS;BiyjV3LPcfJUi};{UidG>X>%+>ilCeELK1AV=wP=%;JnG%j96h ze86sFZ-(j3mw%>GPh@Lr2;Z!x5;A|*2B(e1J_i2TsF4`fO8p_!h*+76sS*_I4+vCu zR$I`X%P_EYnK0xQ`bKx)!X7)%11W7+W&(>O2i%|AlJ{)&A9!d`{;#Kzo|pHL(ToM|LCo)2yI0=QZoLH@ z)$UhTK3Cj(s`Ms7_k&am{520XzP8R&tYR-cQe)Ma?Wgh7PrV23da&vZ`{Mc%wJm3* zI;P=GxVXVf2ATX|elXa$D@)1#H51SY259ja?5T%LL~yGy>=K`Z^-WrUl&Qd^vh!qm zh9-D_*0_OZAadJ|rW*KeGcag;B2VL){ub4 zYM=7ph3YEo0xx?rr6f1k_E9*bYtE}p@)@&aRfd^LBlx%0lL3V;Z7SeiVI+>|lCLgj7 z$@uc&cBR^cm!tA#rn~_1DE#__gIu*`}=iYcIvyQ~OdRA)b$8X1#$^MDf zWCwpz(Vv+2+Azz{ee?+XTE_$aneB~yp}lhrfZJM7bg~o8jqNBK<>{Hbf55DW$ohOL z#SNs8{R>(`{}v2NSlJ;V)jNJ$LJmO%Fh{c{K$o;v?uxMMoOKGo2=rKYT|cs zfo(_Um!_gQu$^_=g)epWLyV}vRa>>w(<9!hc(U48;djvOs{y2PfVOAdT_KjNh z@qv8aGbGug1-Z>Cn#>DylI4l!YIS@V$HN8)da9D}M4R1YRqA)9&9hQ-%G>N5kr2~``PyC@bQAXg9!jlGswHb^?*2yO z&$C5Sk=NoM9FF}ir2;>|gaHVVXoE$Wt1Mmdy4SA%6%EMpu-;)`NG2=G9RR}#VmrT< zU&sEuZS~W}qg+l+OV!cV<$nM=K*hf-EwS?4+aLoe+~zph_&8Zf#^R;#5d^n2+wEAF zzLJ!DgxfmpQq-^uiQQeUTHyx;MciOEC;)UK%t#y@+^1hXi9$oG%nKEb5NqM8m z;ccUb<3P|oJc3Wc;T%&Re+A;+J$I7@&OwH!)z>?DUwGpiX%$7dvI;UM+PytdS=r9* z(>URiCEfxh*)T<6zHg4Fr{@m$?R%el&MT2kji;H6mQ)*q8?P~H-tigb!_IG*4RjvF zO7Ak{J!`3Sv?+;Y3t_Jo-)V4Ve16SZRb=kiDkKe%tUdY$jKw-B^Yx9 zXIO`Xgv_76`SfXy^rZvs`%d%cuDm#fU|=v;Q>m-foou_9;K+u+9&qGMzGO#2teNS@g? zS$}y+Vt9U<(v}LpFI;nVS`)AxXOF+yM5F+5`8YpGHQH@LWRP6UwBG{nC{1(jzNk98 zG4(@RmCMpe71DLVizIQ% z7N&Syccl9=_Lu$+5Pu{!C;T>T>od383L7PZ)!b^NLL9H<20vRKd0yTohUlO-#p$OPQ`!-wmGOQYW{?|-b}{CfY+ ziO-fq9Xyi%=!Q?>mi+omDWwh4a#}NI{)Rr;P~~&8Us`o)#+X9h{?t<3mUw?RN>1%+ zV~&aXjMVh_A|R9%6-Bs{k*gOzlO_{lmg7n}Yt6K#U3c(E4wXFjMC)?Q#@@D`-8?OF zYt#Is&2{yPO4WTECml6?6f47}PC79Aau?`df<5kx2}cnBSgOAI{`!YI;$19zn}M}a z*%~Js`!UsooRP8pW%=UeC&Ml%jQpagd$2)!tx07=Lt(9|M!+aXjh1ueSxfUgh9fCE z9+v7UZ2Q`|P5-E4hR)tL(uzqhcksM&THnmrchhxbALG76ba`6lFkF7xn5l}F{EJ^1 z)f->my-#kUPdh>D|@9S&pU zIBzcBFa@z00(mcLXQk1q|mTBlodgFBo!@WuSRQ4oy-OLksKY5}MU*u0)rRi(R z`qb@(dz{@=yJMErwQK#AXV%?(ZpDAK!rIzt=~9mO(Y8nZA04dXKR?}2d*XzB!M^Jy zBg*$A8}kA#T}3J%8BW=fbbs@x5iR!}^p~yDEcMT>s`63hJyWDDNHJJhvN?S{MQzcY zR;pst>c01T9FLNdHJBsga%_C_Gxjf$+Y}fTXBcXxY_Ou~B5%Fy5(cv4kLKphwY8r2 z_O;c<;XX8cJ$=gOTz8~ZenCX@%~z){e>$>%|FSddDcRF(-U0`}FRJtH^U`g-A75SR z%i?}~JKCnqKT+}A-BgqC@_l}|^W8-AkjD9E=DU{N%J4ed+$3l9naSn)?R6UaJm^tY ze^gzbddx@H+ww)JHRH$ky=XqEx96~-T>A+tLj!|??uvz0U%(3M>D7)+mnzP`dSLj) zWq+ijk_G!de^~3XBsVy}wCQ*T`OEv7jsm$U`X!Q5TT)WC;0|V;dDh+1F~g<)-G?jX z%6ij0Ja2_B^hRq`zr1aqb9yR%##AMC6^@>5s#9_#Jpk;WA}MCq9`*{#{3n-FSWX z?%hb**4o_r{1=YJ^#zMhoM10!`H#ZUbpJ(j^xjc34O&IJ?_2F zzQ40EQv1qhuD^fdrHHOt&9xlabV7f1&Po}z?HRA$)UDs8z3h_Ziih?Iq>!g$mBwlqnf!Wcyb42Sf(!QNDRX)U8l|_DP>GWT} zFU*d*3vtrDVCWNilHa*w7Ujf=6A(7g8ZMLbu*W_z+wW`S>#{u=@dR!gTi-u1^)jWJ zdno!733*VOWo}ttF|R-KX1T|XqZyRs{c9pG`c>Ndw{MrN{n}?P*c5brWr0KFtROSjGqNTp z4%A(WpiHm|emSXe>p{xcv0rNb==V6LzIBT1*LKD|?&N7DjG908+c`+byI+4(5jxDK zEa2P{l_S2#xHn`9P2|RmSym7!u(4SmyN0wd#E$>@ z?i+^NJaX2WzM5w7uLVq~o2i}tNz7k&NG!6Gq>yms)vT&;*!kCBxi zF+cTp1YZ8wNUv<{Ax7brS7rIyZW=`K6suGf?& zS!d}4laxvZ^{4G_hepg?psx1zn$B3`5}Vg^$4r^H`cwDmfIAE1O}9zE27%yGj?C+E zlE)cnqSNnlXPKDvK5(%bzHREUt)4r&rs^QC9%oDMi{dIB(W4pK%-?Gektf|FBcT?f zYj))Q4V8SeIV(v~QJe!^xah#w>M=@6N+&WiE5AnWapI2DPc!p4tZYrA9japkd3t2J z*}P-%4m~%t^Ko`ktm>E7MH~HN5)~IVE)56^8l~y^VKT+|f`*3umEIS`WBIk!IpGq^ z`#<%J*zoK?tjfD(ZyF>dqo=5NbbYEmvQCMU{bWZ^n@hpR#_f4|)o%#4a~?_$8)n&6 z7L&8mAwg!>dqZ0}-lTK&e+2ogS@Wf7n^k@0;?rZ|zL?F6He^2iRNQ~@_eGPG7I_+c z=`Fuu6lBUYtde@A`$%nAnCYGK#dmI*=x9hiUcFjs(MiRg=44vs$LVT~xe;cMC#|i^ zra7?LZ(1ueuU)(5tDlv(0k=e6JvY45f7!D7&%Iq&pN(Nv1g%Agj0~> zyKIdz4%bc4&)GQLbR=Q5+!Fl6#}WvU*nCy`fy$b2I-MTf)Htd6&Wj8!W$&FAI1QHU z+T7e+M@5^01jF@EfV zPG)7cdT7a1RqCr2b;A0Rt?foM``Yf75H~kX^8Hh8a{Hc4SgN<9;7NPlUfj))2R^>O zb(=;{si>#`qJO~PcEPO}*Ik-67d*DV2O2<2Jv?-6?E&cY3R{!_Mcx32E&rx7u$W@$RJeIX2~m@wy8U*2~tn z?iL(uo8%X@eaDUo3JTNtQQCqLLG`hZ6(6#P2j=EQDL1mH|CC{+xZB9;4PcKfG1OtW2v}aqjjyub_XQFx~EW^FG=oNa` zmG4I^eKsZ`-EfA+`OV$k-5@Zm%MUX$FvwUt+<`B_biOTU`K@}`sX3>P9u4^LrfyND zpz?%g`q;>2E98~e2#kW~?KL}-dA|MN^cU3mr{veU3Isii{Z^+WCy$>zIilR+!}a1~ z!SIr_^pz&_%p$YbdkiNpSDQ1ZEx+S({>y!<4jwv`R<_a1GD5SSbociaH{#utt=4=7 zY6Yi%BQ7siIX_jZI`v9kSwcdB+*D&%508gHG29N>A31hx%BT^ip1R*3mPXh#MWt} zHaN}Pk)bQr5@*fIICUzgru{5YJ;r|P)Ql`fe%+d;lF@6|u2of4ZLdpkjvM(_N(c8W zmW*RKNqI)C3NEx>>7G+|CtK~SPMWG@Bunn?sG#@&O@{XLiW4WQRdZJL$c^uNyWx5C zSF2#3jJU7sYGS`inOJOgte+dV7YEa7ki7V|oFJHv7>AI9V3OQGl#Oz!e3Xv(M<67M zE8@W5@c6=13CK)38p@=h7QyTwE;VcxKIMT&4m_VtCOO+>*(_iG-*x``ug?E7*>p7g z-%$G_Z$+ieVQ(JqnzOA;l zorfLbg%w@W)zU#Id@hs5*VZOE6JX&V0)x*FHr3V+3k%Z<)7Ro~1GPQewZmaYy0E3_ zttJm^rbXw|36?`s!i&lWVF}=Eq4*)1h%JZ95%8I86mj9gU&I1^apiD@nfk1G5o{WR z%VBc_JcI(PEzwXOmchhPKow__7k0{GvR5Kplx0ES@grC$kAb3mf~ZE(Ai9O}AI#;f zKmmzx3P1t0XgnTaQ07l!vBUp;d zoCz5W9{pQwg(=zzmK5yo&$Xp)z9?<>?fbY zjUZUg7ryzq)-*0kXYv67w!$|**&1pV)FE5p8{|h!G}j(j^@00CIt-$+1ymN+Bf-)M zyBJbV^dF1Dpw{Y4Hds*>=!GnN!(<2kjR_6yfiDzvOn%9Ou70wkFa}tX#f%8R5){Ey z!0IP^5byx`1WQl&2N5aJPjvuShs$9JR|mXd{ezDF=^}xDP*^|@6|IxI_Ql( z`3Q~5M*LAI!qB(Id)T^alU)&EzBHZ|LWT;D^6)>}C~08R<1&GK@HuQPlrGR-LuaCa z9Ju}g!d%-_7UVRK0~Uu5#M5(vwt0COg6Bb>4@Q3(P@4`tF}&Q4KPE^OC>xmsaz9xTl$n30H0Leda% z!hWp!1`lRQgJf_~UN8r)CnDbRIl+)-z`#JpkRI_&b|_~hDx47Du&^Z^Dx-)9z)E{q zKnD!PVj&>HWT7y=!PXt&1b`2OW58T^c+oT?I09^WFula;g8UtCMLV1tN(DS6Sb7QH zh?xy~Lc^(WWD!pxQwO9afQzDl9Rd6>Di;-VNjM=M5IW>9gq-zF$l(~UGLeCnu=k-d zE8d6Ulj6NtEVH&);Z8mRMGo=Mf9|EgzF51-!=9E}!5=3Bp7IpixJ-V+_!#YozT&jev9-{2ZOYL)Tn&^8GfA5vwp3s&0%0a+V0RaQ%@f#02La0EQW4NiFqO-P_7vEyABz7E zg1d#-Eo6|Bf`l=cGzOl*VF6_V^a7I}9KmG zTRShL%=-bOXhR|ZExZV$<6+txhO&URqiO@j5AQA7zA(E7)P=@CIDF`fh!`$5>)e4& znF~!9w&e_6lYeZK;UtDw<+%h)cn?|=7L&&p5-XzXJLgO6Vu?Jj?>@x>-|w6e#v>@o~5`ZTJtda%6*qDH5TMA7`u!zh-CBeQ$c384HJ!4TlFcYBZ zh_1e=uCA%R4p=skjtwaZCUnHU>>TD zWBfDxSI6-C`Y(n?2715n-~Ytxe;EIj9RmIiM4P{W++RTMzaPl`GcrgJp}Kz?)Agh{g~gr69o4jJ5D&KCI1%u}2tF3gIIr+y)`e`@=B<*#c}Z zaYOCEV6jl1B;>+(IJ`(g=qMM=PlyTQMQcGH(9CZHVY+Ye?|31i_*jT|auIDy5jZB| zoCai~85XKzbPtukZxp$r+#n`TjG;pw1C9i8;kN*EqELK*h(TvO5G7(F0c8i}@;Gcf z#~(W0a0RK@nhAxG$s78m0F}q%(3sdstRc&UhqZ2C8gxJ%fg)-_z)Cm*eu5Pcsh#*E zv3TMK85-gsDH2OBiy6cetq%5;3}gpSqyt2ZP9i>tLuUp=5D{Pr;j}Q#<}rxy>n|Y; z2X68(b%!fSg!9k_qQ(=Jc?|{z4KGqWF?B?tLEu2%fbm5v!p03_!18s2XTs#+0|Z<) z7!t+W0M+4fuo2k#~HamAX% zfMx6bQM{0EV0dWC24)5I2~YvNDmEY6AwW!lA(G$C_M7~8%qJn@VpRy4g1EZ7EF#;H z>=1%A1zZz|$YQd`d>2m-1U%tx?d;)=xY#4s&fdsEva=l#Px5kgCs8Pfi#tMga&;t= z?1%{2+1An1j_mA!*noDDTWDjp5 zVo&yPhJD(DPOTAFYj+Q_t*4{4JBYX4U0o<7FuWb!*~OXcY!8c}kYJrCEift=3Lz~5 z7YJp(wWA|86s%+A;*Qa0>*DI|PIj2@fy{Stv?IAw@HQksnYE20NjMakl&zyR*@=kQ zSvy%fkg!%Rpci-SF%fl(=aaBoU_5JQytS zCsQCp?A={J_mG{S1>~7C9<*~N344L8Muw~icm!U1Qb^xuu_IYKg1#t_0&oK_epu^= zXx;xgymK%XCoIn~SA=*PYs0s?rus(UzyA#4iT_mq;{T`DU*W%l;<uL8KDpvLf&hI}sm0 zL{N4p6WAz-Zw)%oi6?)5Tv3F?eLHl`f(HX5kb#+F;3%Jn_zQ$MZV)vB38S(hE`%2Z z2Xd)&KngZVRs@2fp~AjI2kW#D8x)~pI1>iXVn`6|gGPmB2M`Z-`yieWA0KkON<2TF zfX09)fC4W5RqyKVnMnc|P}lUQBea!lfoU_kr6}!A%+ZW!MoLMsO@D*%6K+WfO(QQOPrwYSy z3N_Xstbq8;UNKAe0Gi?ztEj(6xQ=iH%Bcbvcz;6;a+%dR>{vFIG&ULswrRr_?WD12tn6ob$({Vpfe%2;NZ9o=t9^EH z!6D3y*3F=$moZ^AtK39^3fM{ZDp^rQcm)87BW8?}09 zC9epmj9(e_^#XkSVu2)e3{YP$P+O8`RCqsk~646K?(YudDOSPfaG`B?-0AR5b)6OSf$Wf@S-Q(|>wyhEY|(&Q-EULaAB9IW&h zErMk%C%Y+U#Zkr2k_3L1}I_1H`J!K*n^jCcz=RUDqff3cj;RITRd%m z!w&&hGLn;92q={*Fza;I02?4HPzUfOr%$-v821&!)}D3iG1{Sd+|sm7f`6C3K)mRSO9|`5kGujBqM`bfDnW_7m6jcMR^0I7Q~D8-~#MW zym08ED-GZ^@Ezigm<>grFQdddF_8-JP}TVu;U-287CWQ!Y$*k+L`PhS&=T~_&$iPT z(`&-bjsecYr_x*2Dxbfc;sxQklTn*q@4vPdBuB=MzzS*vZ`}hm59_s1o;CVs~nEE_mv|D#7@% zCindk{#W8^HK-v|O|9}}a(TkX8Id6)5+{x$RO%EA81_S9R0YQXXGX~hDmVedg}Gg( z_wdX)tkR=+1v>_vk!y3tz*M+PF#w0)jbND&2?EuXZlpsx^<%vRHOkTkL=Og*P{Ms9 z6PuF&F-Blk5xddSO)t2x+9KLg{JIdBoZ;69M+Gbg9)+f+ zH6j@3ZL|C9(3YudWRzq$I`AbwKCrp4-cD z;+m#|O*eUY5y>+f)y$Flj6GxCHkELbDn{n9ftqcbA`fL!amd-AaVke2?(jeMF z88Hy?RDukMGH3q*lo;8K*o>@H01p}3G>(+H7IJ)$YK1jh6v8gSvU&}bj9paVq7|X> z0}je3;Zf%fC|bFl+hobalnp!JBn6#qVIdikmZMxk2r9xw6UGeA2xvs?n2J<%RHC)1 zl!a^g`&>w`TE$!q4NDrnrqrB@BCM!lBwiG{x(Ee@7{KVBQ^%-iF{MeU@ulkN043gG zGLwO4KoH}u(V@@fdTgIST%#*R6fS&e5m1~CpjrfYa*2=3OLQ0xxd4|I&Z7W2uW35h z;43L1Sc6TKaj2uKn^Fx}1iXOc@_9Q4xQc}gkBD+}NW%cwvY@FTg* zG8Hp24F)wc6Lj&+2Zj(|Q>-;`5?s?|W+D7RuU9Y5hEC54!>stZ4hTBh4P2`v#8k>f zFndJ7Y@&RkG6B{uwmI5`u+hOB33bPbsuKFOYQ|-x9;rlBH;W|1K9JaCMsUfO4TmgK zaTrAcNtb7S9c`#ha-qX82@eG-8i%os#~S9NEmJf$M#Y7?S-~4Kb}Y}UlS;|0nZBNa zykU-oz`l{AmPpm%EWvNZ$Asw~0NxG3&V*_sj9g75wuV^K62+@QuOQO}KndQYoA3&K z9m5vc2?w#HP))r_lp)#%vIN9J8N@JTv^j3T<~|+313<{h??L$mDVi26DM3?06cSC{ zYAq~$m28Gt&5Qh2wQn7^x( z)FVaxb?SwTpr0FAlNKoyjXhHC!K^7Dprn(f@k*3nz=uBJ6r+fcT6^pgog_p$VZRlF9fss*m?!Z|6Ty&QB>eMaHQU+02 z15>@8u@8#6z$sw_5rimiQaVH9oXNnoYN%5|#Ca2jHoCmahATvB0ov`ivjF|AP1YKp z27GF>|1=v?{JK8s@&8ZkmJ%Og|Cy4IlH6$jc{ZL#`_JFn{)5r_k1+iJ+!dDl|<3>fx(=GMSlX zaPSoNW#kL0soB>itoDMTBZ- z)}&9>V>SwwIYQJ%qwrmu7S%u0POhHdI2_Jpa|8Ms!xyHz@G5}ZP;jj%RekGvQB)Zl zuYvsrYalaR1b$FWI9_v+vsvLf12!nufaCfi;@mB;D#8HBU31uVI@6xfYZ4djF0>hg z{yDnN4nt-Y;dYzp(#%6)+A`XYXp-1Sk_Nd7siGq2C7}?BfgQi+<>qUV24sd3zm8#V zY3K_N^ok(Pj?F{l)`+HDbBKnF=6&2ShG8Mu4Y)Bp9@RrfM71d5Vu(e5;B6V~g2W|^ zqTBVj1A1)S$YF#Xj8a4n32Me?cE1NdT!6$5hvO6wm|x+Aq9sE|fr~hKV81a8aR~eo zY^;?(4%CQRlwn6bz$!q~FJq@>&7yv>9c~Fr@D3|RnxT>2k=atMELz@}O|&A~z3~S1 z;Lw@GKnv%j8|rXPu3~7?F7pV+Ol7O@Lp?GB-v>}ozv zimUStEMj~_8v%{-0HJ2gl0FfQUZ9iul$?YHb!XGz1X4eOBiTnYy+0Fk9jDD-lz4(# z8M)P}8y$ONIdVL*b*b_rO(_bZd4fX@Z!+3&wlQOKdcOs0LRv){j=LWq5=QDoWxPCd z6N3pP)PPc|rYT4_eDt0IzLB6cq`^q`?s$RV75p8y8#t9c8}Y)mZeZn;_0{k6ln`VF zl=b;tJV+65lwQA(Yed0p88+H6_2H426>p5EBSY{ss}|PtCzKhMX*Fk{Kp;3J^|f&LB9%t#RFe z7zD+%NY}^Isvn7;7IKvyW|nERc*~QLoLtNO4|ziFf0E)7lPq#_1CJx(^C!RmiMams zw+8Fu)Ym^bJ}JI&{m;fz$NDqoEvWq3KI)18la!dyEiC?fx5oHCXXS}$*hh+qkx%;~ z7c1lcdC231_+Jy_P0AyotGhxavlRFQRckBeVc0P z2GiNNxtph{JGlx?{_*|wX?o?5K>$c)Zv0543YNSq;-HDODwMCPjrlfscrwn}RG(=% zpamjSusl?{peYBv0k_BKo`XRiJZeBSw?iamXr+rwtprG*N~8-j8$@>viEfqjAdJAT zrILuRswvc~Yzp;C_Z7>?Luwe4@yMr?j7JjNlm+P|Az5QW0nXy)Jc}qMvRRW5r>3dF0rc$6hkOhGpAAllxW>}nU!Pils0@HP3(SA0MxY_ zHY6{S)k-JiC$kw#oHj`nJ0KngFtGtiiH;sG3R05*C`;%nY{d#6>_n(;kH^+vtFjWr zbJ}XPvVK`>@D~-N~q-?<-k*rd=;$6swLLHl9Yxqc{H_q@b#VH!i@hXY+I zQ9PPTM{1*A)6&ShXg*@o%%C2fSwukbahRYbN6QE=D`26|Z=)UC<+!kU8>;A21_V&4 zZ+QA}CEmBKq z>|*ZN5>*%_73wiwWteD`zH4p0qH(_^#gOf5-n>vRBeS4aes+Hng_YDh#lsky7?_z~ zfYoKuHOXPLtrk|ZhtXSAMTQjttj+jsdskoJb6@5 z4XSzsjM0iGsB-5njhq_|I|+)B0`p;WKrbwm0moLPEGlB`c*ARrBC+w+DE$R|MYA)q zR=~W#F+5f-EF@+vSV-v3-Cp2qupvGIT9`~b+GJ4x$cAb&HkzTN#BgJ51^uC$k2YOv zd-#Mj#tBlX8X)5^SKtvF*zb19aIt~g{A4CU;l#mU?ml$3v{b|ihK(D@Usxg9SHM>p zN@&Ao#yZ5Jx2G|bi`cKRZzw&ScuvA7BNl{ihLW!Yu)fN$LPmgw{!IXEwZeau$djZQ zXfuIrxms-pjP=E2%SXXS zRY`yuJ`^K38Q7s5ZPV}xVT=$KLkwRodNdf93(j)893Qq90&pOhrfY_+n0P2=gaVzN zBYuNnLD))=-^Y)qV_+4K7LntXj=PZG=%on~LfwB@Xem{9YjN=^y6>*33L%!7TugJ* zVn7X28B6n;c;$D0R?1nS+C#*c4rkFc9~r zvgL0AX)}y%KwPRT^^a+3QB>rPiY6$8P2HXr6(#itIExDv@s^I|RpAPj z&>J_bXx<8(depiV$W0U*6n8;1tqex66Yt2*OOxaELWnDAa-2l2&L0$`O=$qSS!B<~2%GhYUbH&s7iBm|ca-Sd@l zHN>Wf1#22jLCBHB27G^+1DbRBDs1s_anW)Q`C9l_95~immy!XQ4x2ChsqAe6je0T0 z&`l(a!AK)oxcY;{S)v*cm%i+*0J$_a`jK0yPpVKXp%f-gYdg+``oVHFjL8WdnG-zJ z>zg$;MM@CPBXqvx9$TNR^&~sCK^fT7JeB|}r@Eq|Ig7-4kEg<;HDoXXjwN-OUC1_F zUu4iBQ2Ps7K3ZQ9rsLAXBI?fa{8re8xNqm=(oS2V+ElR$(Sq?P4-{4qQN$=;ScwkK z%&U1yc!)b)r9g_2Zw@*lQH1h-2of5~F1#&4QmsrAfUU6MrKRcH#Hx1}asrt8HBe~5 zfQHnQYpEdyOCc3HRO5tc31d5k>Na&k+y7hefq zIf*u5M`@yPlzCNDEm)!IZBl)kOf{O=0yOU{XVx)Pbxj*#t4IDw!YdROb-Y4m zBZ4KREL5p9Y*N@lFiS}CQQTPRXipE2u$W5(>qVF<;6bcb!3mj;-pJdB8tB{f-mE5s z;Kz{F8WY3WOtviIh%z04EX)=M1dFQ0*(GH3sj4n)_5tV<4evP36T=YQq85RCH15Di z%?u)kY*;&t4T#)MLvJ&@@S*BSD$B>}HnMKN9!$vKnbFWA5HLBJ+fbPY9yA~gKhj{w z#5ss2g=;H@(w~U>tSS5$f*!QYnFgN3VMroK*lvxIV7sykZ-UmNeogZa3p~ z3?-Fk3VLWQsoOB0!Gord_Cz$?p}Q3U2Vd#74`}584j7sTl~J@-F^_x;6k7>;0(5^P z)q~OwcuD?-#s&GnvxRjz6v_}CDu%R+L@ZeMj9mQs{z*fpG5}i4rgL~+5K!$5WM^#Y ziGLgEg2WoZh^~l>gsH@X80jSWL*pJ@0qsnTLm`78w%{a^EETqhlOEs$jTmFpdE%G~ z1MC`v1(Y$}9U#XJLIArgV5)@hOG+v!;CHv&mFOP~Vh!-yu=$sS#G@WFUBBV_?utm@+F6r=ii?uNUI27b_u&f}oT+yxfPK6ACmxeE5 zA`)yv)4nsnHd>PETo@|7npcKnOYJKopVrcJZIFclqRSy5&VLRz!?zHy>0itMW0b-$ z=jd<_gvQF0g((j|2Z-=t05+M9-3UPThAAjakvI98>)H&%;mv_0G!JKDw`PPyfkZnb zVtU>|kc|Hj27CMSj3 z|EI*IG}`~3jpu4=$;Vfny0uU{zW9XLxFodWOX!}Oa4oQfS~2Ejz!yA+WIkCBKUCDPofy@sh+soTN(DigFi7xiL`D#_B~=l#{H*m2w2L^9Th! zUO7e!dtXNtd?`uA9#!$CHYP5P@YK5h9aU~`1NBkg{!d5{? z$66y8Tsrb%at9C)qYPl76UUrMZjw4el#CJ|dts;tgbRmQ6dM|0meNFx5atOL@Gd#V zO`#owUJc{wWx4bc9Yqi0qV%=mW6Jea5m%+o6$(iLL)NHs6bGn2E4)D~@deR}fF*h2 z8A$P~jhHh910su6|8!?obQFQ?Z;jiHPyJ6A{STm=->@Fwr{Vvdgz{gb|L>W9YFYnc zAJa89fctNK{C`4XQYio5EhV9m|352FL+kAt!vB{xfZjGF@G_(xU%~|}iu;fny$|d2{Q7;leMJB}gE%yvo8B*z`!aBc zFvDy^9me8_tC+6J4HQ?Bi%qROkj7RNUg4W6W~Y{BFg%1el65?}$SCA_5bH8^s}i<>dLvBbC` ziE507hNKvM10yrsd2)MRVV-GlmBd-6xg18LY-2ft$tn~i@3_^l=#80ALMuG4lIb(e zDr^J_tP2}5FNpo5@z)&Y%%aLv$mmVO2NN<*a)U+}N4JS&Yeeo&erp2zJAZ09|MA}j zIs5UcPyd&akPv$Q!@I`w|7<*HT}p2Dj5+mq9`;NW0;#bAbNkO{*`W|WWRxdGhD%P? zm}3YFABnLMRgaf>hm^6P%Sh*l!4Y~&(3F<6MG_s3*pc%nyx2U={VnlhSDd;bx9op} zOyoRXL8N?pQREw*1W|T8;^X3g%AZuqa8stOQ(J$-{>PZ&02Z2ssUao6(}@2Rm(ZmO_wMbN3Qe>eE8asAK6Q{Vct&>GsWNds07 z|CgK+7sCG~#HA!Q@_%RL`Hk~`Sy}S0oS@PhaIb*i-XATISHorU5|JWKC#9DOhAgX> zX-|vnUZe+}%;r?me1$C2X{7tY>N2e_=eUdf82Ot=x5xXW{(fJnU#X}d>B|*wX;3Lu zPb<@xwT@I@A=AK=UsjUO2f$fx#xJXtm#wulN%Dp1y&@(0s;gdY3BKy8Q&(cIy6V-Q zh^wwzwI|@JvsPV+x3FF;gFbt4Qu(%OU5HankX26upl;-770yJVI%bG~Spb@PNV71$YZ93}8?#vY~o)T2I z=sr@=D%x^ltdlaTAHmjH!!ne1z-RiE>sOc(g_Oa-4GtOzMgQAjQmN2~DR^kKmNJK< zb8KgagIO`?4|Bzi8WzB2N+LxG!x2L(I5GoBY$0V~_QbWA#BsrL(bO9N?;E1RqDEl> zM+GLh$3kK?B20s{&0!YOCo{J&KL|}kBfB264qZewHYfu~Bf!B>F+4O`J#oT>5{u}n z#F$~V3<=!-?1=zOA`vl`4*5~_ffa} z7ayM(9~UbBCB!${|DBbmQT}U`{~G1L5c!YIi;8^g4=!%Vje_5wL+~R$3?!v-PxjmI zTVmubnb?ykgX|HO4!BWxG`02n5gv6af{p8xgy&5*(Jz|%HqwCskf6r|l*fiZFeC(5 za;YFE`YLJqV;a4$f&~krksM15@$pG+Wm=SoUK9&J3}ta4S^7l4a<5DA6C;0&utKFQ zXhBGrA;b3ZEFYEJAgxLv5d|>Zfu@l>i$S0yeh+ae(8XP78a8s!uj&${F4Wc58vv=q zuVVa)l0cQh>WW;h7`9ZZWtlztGGk;@oL;gcp7HcrH`C@186$$HU1x+0&S8zZSF zKs$1F04A=<`kIhb!M;El>ne^Waj3mp{T#rK^|K%{wrIYfzZhhF1uYL{UYDnG1i~(z z4ox7x5=4`GV_8BPDlrJYoLxe^KxoEo3@Q_${UWzl@w-*x3nuy^&Glqo2>1aQjs!Vh zrEUlbk|Ga+vj+1rkOry+bZNML!>rkKi5~-Ci@xYs3_Fy`U@3IX;1$Ou4nZ856u5eF zPEm^TREErf1KF6!atn4s9(qG;-=H@Z1;^p$yn#{}DMccrxRgq^4Xb?qaKBvq~m)TY-q);(!ZpA<_UvaL`ok1{M$JRPf8sKhu} zsA^oOA8%hdqh^MtQZgs)q;)n#F8<~z$nytA@X$E6C-&dsiVRL4y{-CCK+!b1JS+!ll z#6F!=1+z9?XU^~A^i_0H=m$;i6Lf2e=JP0c#E<~bG-YWRv8+W9G~0pW@a+4) z!rAWExYeNV76KZ!P%(=x8tGg(&sIvsAj-YOCm6kDXa^#E@`kiU?rm@AlRr-*Nq(EcgK zic76<7fUG3pevN>CpnZVgZ@e%DlV0PtQ3LF7{s)}vKKYE8qMH?>P`6H>y!MxYB(F* zDoGX7CwD-M2Q$T@2NfKpB|tm@LB|O1M@KPb84Gyi}ja4_qx) zPmRe?HV+EP1*8-~F+OvLlntUD<1eYqhpK1*GSLOQ17#8WEcFJdPJva7Ev@9Vp-=xD zDoBQb9AlWU#E;DN+T|l5kD2${>5JJ?xvEx%h}RMtaCwNJ?*cZ%?V+|z7wAapXgv?7tH zNk=1@bu{v+>S!ncLz0v-EOV)T%v46T>1;V&Vz&#;iyzs?${xB~eiGOmTe_vLY1qpc&K6 zh@xq}VmG<>F)e~bP7ch83{<3m)rg8Fow!tzkCUuB|HP3{GSC^j0Y^BF!dkc)AW4Qj zgo(y5-cH78#~=&t5?C%Egg7m-k+m|re%S;sHL|-A=yse(ECw-9Js5Dm66l!3wizFt zo$h}h!UpUNuOFt})n;8YXl($sjN zn}Jaxj18eLF8c(6CrqJ8l_=bxd!$@qR=8VW6nFtg@~q>18o9X(nXO?1Wo60*dA*&3 z((^Or>;k!ee%`?BjLZxwJ3kMaM{q(7gjucx^>Q<5D+p@Yv?5Rh{~l0~sgETiGd%~| zD!>uI3yBwQ)I?HEq)|^rbdlGdo=s*Q%Eg4srIp?5vD@_&E{(Z_yO~%^7xNuEip6%g#u5j@hw)UiB>nAFcZS zqm5U{9Tn-$Rvo5w`D^bbHo3dpV$qadn>I_qMUM^~|I!-mQSG*GE5?pJeoMvjtpl&G zSU&PE9}ZmbMT^#Q(=M_+<2|`xVw(rsOn&e9@#3)sQudLJZ@vHBp&y&)eLQym@*jtM z*Y5Mf&sC+zwYu|$*{PKU|84Tio}Z&9Mt_~xBqx4?G~#bZ3oHfiwa>A9^xW|E>(5Yypv%m8^XB)2wrwH_z_)ptH+)@SJ~spM(GXdc&NYPBU^B0`7L4Ng~E!SLf$*kq&AGMwOfA7Bg?x910i|X@5%yQ}E%P+tDuAUt%kI$dqAvt;L#*N<3Rt0zN z+?nG2w2gFEj~+d=Z#E9FUFdK)nl+uja%J_15pt(alQW{y+a#54yu#=E?&+tySSIFl zx}Zg~)vH%qt=1P`d{I%9ty{P5*|R69UB!qIUo3p=_S+8pYpt{Mj~9Kg=-is!2S5Dq z!zDvsPMH1PH=7>Qy3bv-$kyVouf6u#L-xUMkASThNFBZ)|Gd_%x9mCe=%ZI%(Yk8i zwwQjcn%*(7=X{H0)vK>=9T|jHpUG(3;zH?~`1s9RwzQqR%lGDgSFBul*@hJ-ENz;(A35jTJ8vE`WJrE~&xId!XtDH#7hYJg;-6n0*tTt(W#S!oG)bNJ+`wnn zxt1HC^<~GwW+=9?xHVMe9Dc z3vYd6T=n6-TU%b@a4vQpJ$m$_i!K`avUly52cA6V1=qT^^ZP$MW5(4p`zn`CRz8N+ zdgs0?on2;Tb^P1fqCtZO4IMgk<*=*Tw7Ick+vy8OjvTqj*~RiWG{1fOWmC_ayz9B= z9Q`UD=(`|ldd<3Z>t1AO9Sc6|Ann-WfVOBZ%bULKXa{OylEI#M%z=BQC` zEK1ujspaEKmh3;cd;P9myE=5}(EW$BrGF_gIhN1qEw%`}YKnz4eyG^49wG_hfb4xl-$# zn%eIEcV2$!rC}@m>YB;tW!=}jSu^?m^{%BSPTXEvTKZMtRrfbv^TMd6U;J?Q3eU>h ze)J}etXY-1ddKovJI5vd`>S=AcA43IX49HYo4%>+K7aoFN0!FI1q$MlP2AB zNo;Cr>bd8f<9>V5*1etc9_@bZwH?-6)U|8Z7JqGXbn~7=2M-uM3wvn^n-sGBx90UwrZSy1|!DzNT&V*s-tnU2yQwp_i5}J$T^2;1`S5 zZkUs@fB*jJ_H!*awt*esyycdf-Ts+$|lt z-nwJkwt;u`-1XI0uF}%x7I}JB^YgFz&^5~Ei@kI8jmOUY{`fX`t1GX(vSZtIt5+*O zFPYz=+T(dTedYZR%=lnca34^GZu|Dm?L02(p?UL$JDo3$+}fqf%pIFIZ~pYt_rCdI z`mB80-&1yuS+jQSIg@uCI&=uoeERh1Km9buH7+43De&FS*J1m$yZ7t;`>(w4!bz@G z^WTcI&+MCgu>1I9FFp2HVOCbnPY=wVJsT#_q)8LNj&9w$J?Y#3+1MYxT37UB;;#Rj z`tR|_Z=KVw$+T(H{_&501cJdPmS>kNNlQz+_KN%Nx#u2dm)CDQ{PcnayXW}cu%vtcVJbCi5W4F!DIoI;muFBlpT$pI_kXv88W!j;^HcIzdN($&8X=~S3kM!P}ziIi-(mL7oTYN{>L9b{OF_iP5V6h!gr4y-uL=z zuK}Ko8g<~c>K`7M-KEtU*y6B9wmLP-#9QnGVK-0Qvu4fRORm1U#CAbU%oD3p?|AI7 z&mP`aa(&pg-(B_Xrz-<{@{5Y1=H+hMv?(?=w(ylopyN+J{q&M06-N*5 zex$?V{Wy^yPJ+z`|?cc7s=^=U015MgDO9$kf6i+H3syHCJEV zcd^rIdA$Gk7fPEqZiE58z2?r8sFp3Yg&*9zXSh8kyZ7}AE^65_X67eZO`L-U zY2B}o?s|K--`cEa@7|M#ISOAay6dsW+Rs?`-n;L@AwLIBTFZ?K@(&yxmy(jwt8nvY zX=C;e*|7DQSV`J(Z`a8^=O@K}r$X0P_mOH`<0@a+ckJ*9t2J@nJom>}ANYR6rL!`3 zJW+Jtn`P51u7vHMy;^m7yLQ`_3~g>{(W+I)wo?Z^e=BetH{X2o<=s5EPrP17t2ND< zcDUh&_LFyQKGy!fwwZfBdHM3&f7-Qu|0nnMU9e-=)LHACD_1Uo|C*n_bMW$a%Rh2> zJEY0 z^A{LIOiTZzx0n&p74`26r!FTQ(Chh=dIv#0I2;A!XHAHI2P!m&MTwhi3eOnuogZ1|F2 z4nMyDyD7N*$hWTt54xsLjXn1DoULPjbX+mvGfR`V;^sd1VAQPjFZ({fZ&8eL=|$=*?K6&$((eB0DCx6nr&80P|w_l%Xe{XpC zV0ZZi$B$3A?)qorQg0tLXy1+<q+OlO!>83|3wlB?G_Tk;ruB`BQ zmM&d-?D+B5Uw<8b|JXBHQRd%$ck`v=7B!!mab)M%!QZ{6-L!A-7T1;!5)XZlx9QbY z9Tnx<3*Y_N-)mvPl#HKWAN%ipajSmXv+$>hmWQ?ty`_9&R>#!fUN{&YE~)u^`}V2t zd#IE-x)L4Jv?IB?C9tNH$61% z%4Lh4dnZkL?A`+D^EB1{k9|kX(k8 zyze>BIp;agdA4(&=XBZ#7W}DGKz7-m^ltbozjOKwl|i4k&I9N;EvQl*Fu-2z`POrP zJjw9PIr`>q#1y^RQ@x8-fF8H_^SuNQ47_Ci30|24X<%} zzOlwY!_{?%g9A(1xN$_{+l%Y$tfEd?fk`btId(|DVQ*MoxljMfpLe4-w%?i&_YesG z!-sXcFPn8_Zt~8ZZyrBBwYWKIxry$Chm)L~UQ}NkIz9DR+Pm)Smt z{p-8#uV3jDd&IK=&wTo#VvEE2JM#mYRuuH^zHG=49lx?uN=hGZoedeVweV$sG3U0hWpVwJ%N29|hS%4a-9MjGT3kGDl)@V2(Y*(I_TRH-PcP5GFQ&Vu z8<{sw;PYR0+1IJZ)-mOckCVEySQeh0Haa#WkE&?-bg{Y4+wHeo4Yl`!<~r2v_gSMo zVS4{X(a}CWJ`V0r);sK5Rux%&r)YI@-?|33c}C2qWk=jk7AsBpE8phx*XA?jJ9GyN zqno2zcE&t7m}gOe^;5Wf`Lb!;yT*L;-qrP=jZzg2Yq6wDK>P!dICA93Cr_T#KP|6J z<5-71yPD9~MN>QCYH;YDCyz(O#%22`x~M&@JX}{)9b#s7B<)yUaYF9>KaCrC!pug;}j=ppArZ1bF&oK%ayDcrP8gO$rodHGzuRDf^ zSC?&1ou1Wog}u5}1RFDodxH?q&?&2?^_3KGnwluzpX~{W!*hwwXa^VNXOyNyOm-2b8*N$nZ zgl#TJ=zCRIGghSz>teGrCihWR<>CV?)@0E1I0JDh08Av-nMdE(S%7W-MzgxTwUKc z;Zu^PPjSh)PhTExw=mA^$8>kUyJQJqiyAjJJX5$_Tg#u=dH8_UfRw&8Hv|5oJ76{7 z3IlcAcD+nLG&^8%bA@7!iG4k*CF{n8u57(Zv(Yy-jZgC57Xfi_?V9!({`TdKkxovE z1ELM0dd@RSwX?GeJ@;FB`lZs+p3enfr2?Hy^xR@(pW912N0e;Y8TasEzFY1+#Ts3} zYKO+uo&R{^_~G(i2@`cjGCUcFW*-X=57+3E5FH)OF&e}GGX-p2)gBpz@%0uK2V4t> z^nVf?^2foQ$)n6hT)WlDOYr7O%U8jUbJqQvM}fwmNVD0ne0d?z&Q&cVH|*Gqf9*nlE@%`3;#no3-}$f@Na^HZ^~Gsp&ExD=VS&okFzSvuDrz0|KU}d!_4k z?%X+X`wmN00WgZQ=l`Cl-qqH&SYI`@YeYox3j2}C+Db#CRy?T#iX9Lx&r@H&csX*% zxEL=F52xMJEG;d86%$`5ucWko<;pAdE5{prDO4&iNsdgrnpei}m2J}NX<2g2myofm zxv?Kc-T><7hY#VNab}HOjz=}TxN_x6O-)U4aq+!-9-KGlQc`9I2fy9i+(RX|srL59 zfid%D2~Qgyl1n?b({j$2aV>p!w}b$*?5CgNv$M@T<*rnAvFXJL3IZziDRyDp#|H}q z*Y{6#P49Pm(vklAT%#M`-xwIf7{4%Qfr>w4$&S-sFAlprEhQQ24y=guLx-+cD6ofW z{}p^T)!5J8-u{}uiD%I`%>(=P*>R3;+*)wbuO>5d!=;TgXP(cl4G;gBTb;;aS!9-x+P9B`8wd{ zFTE5C*Q;7Rsynq_Z?Ef<8!8d=?J(tpRoU~NZRi*G@J*in=Ql0IFH&ni*YC);F`IuJ z*g1d~)Kz9Gj6X6<-7D(UgCoZVZuZVG4>2(Tm|nDh*RGyEk+BmR%3~f>oqXEugUv>d zqZ#QBUn+IB*>L{6)y`uhm2dV`v9-0;PIjzx%Q$i3rzs=C%*~k0?w>tfug#oxg+Gn2 z;^1&`eB`HdXR5s3K8$D2{g|N+^q!>ajbEGQaJl#6a`%90qG9oC*RH*3_DUeP;qns$ zMfKXe;&@xj3(xv6>_@p+SX@4qx6Xd?FzapO%;XphpgQ)|+_A&jGkfv*aoz(T|1~e6 z(8fSH-$ioRmu|4`T7y$t%lKabtjNLzNb9Qfq%U^aDK3tRec;ct2 zjN01TkdTl+veVpj_(4H-r;i56-MW37w?=r;AT}Vc*w6qQth^z0)M!e;vG5xS}h|}a;>rPni+T+UWop(1RCyej4>*^#YjaYm2K}W_E{JJP{(u&AA zs=}fBd#sP)k-?5rPOc<%)FXU4opx4I`OvDwSIb~*m2x|zXP^!07}^gGRKZr^nu zq0z1A!ly3XPWYP`{rppU#oNDj9X@g5V@+w?uo#^u^*#M>W{!yAaQ2=)J=)wnszg+O z_R#P|jl!0LDJictcTQw5K7AQ(CD&b%GdzF({7-Yc9``H%qV6#3nt$G4*XrP2%WZo0 z6e;x-wKP?wyt<(gU_H$fRYha+5ap-eSMAg`kN69m9|2mSd+&s=_ za&AgWWi;^PS5k7G&z0zVz)Vo2WL1% z58hfjzNf85Qdaf~y9J$+F5SppW6&)o=6z6)>r3O6SgR%)F~)~vI$xJ7-P@-rv?kIe z_?As?#`63tu$*ngZm0gUkKXV&=bAQ7G2Umn?un|+#uq<5PBXCqQmnABaK7oP+~8ux z08Pz)>gRbsFI`gqo>P0YJTC*WGR2iD$zK_t+UvoBFWGyRNSK zVpY`3BXx64`*qsodp>Su_YcD+FlNo#t7PqVV&RzCDV|5BjV<7)7-STm5S_@$8N3X; zaIQ(YWb|^=f}}qlS3l;6-grGKNzF6<{O0x0K>ud~|7XY2pX+MBc=dAd(Tu2zzsUo` z-7nK^Zo_BazDv%WDLp*rLq)}+>uE;4t(Jf6G4Q7PIi$2P z66afY@A|G8n|1Bx&6*c4GP0s=1#Dm;*x42R(LMW2+1kN=smAJSi?05%@UBrzu5jXo zLp6_XWnLUUeBA!MmSaM61%+{Q4n7E&r)*!+nDxMJ;F7sV%1TNuoTv`HyvZz1^^r;M z;B$9U)=#iyomi>C-3wn4vG~f!SM8k(Jr| z{<{r@Z2O6kn@9F-u-(^3lw}NfppomsIX;x6 zxs&DTIW)sBru(u73;c#}>b}-CeNl42tXU&GGyYT>r+D)8O@8+7Ox9Mz!nv~zBZ7}x zhE3WTpLzAw{hTXdRW~-9vtwdf4j(>TQ{(H|Fv-?q+p#lef^0iyKb@&p$*ZzT)_~H`pS39igtD?uaRhng}IJ_?_JLQ>E6aDeN+sNu=UCYwb z<-NS}LnoSb6zKGm`vx_5J}Y+vgBd~ttfNZ#(9 zXM^0M9RCzPjygD7!!y~hxFXL^Y(muiYqOOb^ zH{SY{nx`kkI~7+}zHu-~(M~qkJ@W2F#lY9Ey^RLFdFpq@cP-0fo02NfGxvryj`BOn zTJ%fst6M&qZsuPV~(#9HO(O{Ev?~f+2|HmwZxSzU+RQYWcZ;;E` zez==;%%pmtgD?F2uHLWg@X)H6KP&!W-Kh2SQ=O*HrvC3X)#V;LaYDt%+cmGndR?jN zq4T{H_5$1V(;ta)=`%i8%wC`O#mLpAY4Niwp*oj0Bqt~L>N5P|&gb3})@3eZkJWx5 zx2b1f@zO$@DJj|U@e3m(4JM7S+&S*ct3mqeX#>($2g!9BIOvkRe27q#Rs1m6a>wK6 z*UNxLVeg)LY)RCmh=S7H41gj;{x@A7{0oRV^fVX;1!q8WgZ-O7p3&!{vi?9xj`<<9;4p6;u8 zV;<*5A4@&4V7^Kp)!MrJpH^qak6E9y0Kf%YrlMs95}FZS&!7R z<8HH<%$KE)y84-Pa~RmW_warShC43RKJ#y=FW*{hv7)8WM(v?K>w!U3U`Bj?zRfGE zL-}&RRLBW`U9k8;&7-2D$Q}!9Xe?q34&hjuU z=JS-_Q&{%iO5^T-dUf(iLc&tz&Q*Ca!x&4>FL93hMVIjxFurG$>s?O*3$pp*xCsUW z&H`)i*I$1HO8qNM?=2%3`&<*Y-B_;B#Rg#K*2BV4U)_SP0s*KI>ySY zefcur%7Q;MN>}K6{WeK0@pw~aJo{5g>WMQ|x$MT=vk7tIe;+zdwfRh5>6n9=uV205 z7$|SrwCUC`!}M;yeYg`abLPxj7DKu(3$NW4QD3tup}w17fU=^aeep{{-ud6BiSkyj zUTt$u$*JFx0|%a7+c!mUKRb4t+qy(x%@h?0LeABM1p0@|b)I8qmow|w2SY1uoy~XT z<6~nNL`6Nw7G2)8zvOz-oN33Kmn&^@iZ|u-?A7JxA#U$K)j10UVaJ}T#KpzEKO15j zlm7h9wDcL;NtccfnKgDtLBWSJ53;>H?+08sSyNPAUYqmAyRg7gG0JiGv~A;JRM%hB z9J%|YLzdC-7yiqEa$mLB{r&R;N=1*-Z@+X*OSJxC5ZLmyQc)D1?wY>%>*uHI)~y?A z5&kT6MBJY@dN7uj4{Ln1dfDU0k1oBB;<0V+onQF1swKBeMf20h8}l20k*%Vl(x-1< zky&QJved3uZr+?Vcdp97fqobAOBqWZJlG9tPCu|};llVekwYxP!v`$>lpwI&IN!dC#>cc-9Q;#{R0Y@?!PAy?cRbm;1HxW!%rJE?%h|v#8qs{_DGI zl~hk{ezdOO<|dWi`RmqwShcpHqT0ycaq|Z2@mR0D`}TeQ{P~E-xobMTwUb{oHs)Sj zZ=tOnm5~v(b!+VQ?VYptU!SN}R#dd5)VE~EYXiS^)j%WzR%*aMV>@*=_>5;{o2i9s zWb{>4Rna4MGvhO)ftKUF94`9-E@7c4bynO1}aNe>d?8xBYX)Q~a+8a-vx?%1S zJtp&9OiON7R>Kz401r=3&4>H!I~N{z(kRS5=&g`6LpfyZy@J>tz!pDw^5oQE7A{(g ztXuMz|J2;voD=b8w2$AR)y&!ziDz8;CU)-vw^;xD({aG+{(}ZRfB4W)e%R=u(h$J; zgMxy91^amKtZ}iivB0D*jO+RJ>(`_YhSNPdd*v=l-MaPewQJr2!MKQ8551H_mrb8f z1j?I3)B40q9AH)T*|Pnr)9MA|f&Rhc@up5Kt@`?5%;O995;_mMW@2J8WA^Nbu(02n zYIBm9@9La-bixkK$hc~LbqeiLsNwBuIKIvNu%w0q0 zkN~~?iHu@kalid5fBAz4UdfJj2d=BDt2?|21BOkcrD}ZPTEXF&+R1J@16CKQB_7Pn z+nGNv_?$=S{Y{$&WX*kDTWdXazxwq@>ZcyPh9BLeOWE1kk(LjXE#4UWm38kTr-9GBOKxof!vbXfMxK_SskHyY=A)7h|L7fF+CX+`T)pPlA&MuwNbb zg>kqrNG8||F`F&=GdEFJ%6JZAJi=YReapMT>2 z{(p}D`~Kj+f5QI$3H$r+4*MghiwyLWO279{(zk!Y1pjv?eUqeJ*nlMc{*(Nz!^z+1 zXcez$hz0SgCebMsPv?We+Pt|KtcRj{$OKzZS_!B;YzmW!{98V3Ay=q_Ivhv{E-D-i zb`h!waHx3T6e;tGqm>FvnLn z7%)?q+0F+d956zJcoZdzDUg(nr%EC^g3>Dy!|RwDs*i{5LMadb>zd+e%EU{bOwxz9 z1B0DmWGTdUJ8AnAv}ifk0s{&9Vq)xYHZKry4R$-poZ3xSNM$RO#XD#+85W_*c|e%>?V5bVM&bOUmrOnMc(N}clwc^OjP!zF5ySXnJ`t9TBAU_KN0%lL z3Dh7Uhz*W-M6e=$RWNv}g@P_cc+fSn1=)eL+=a4mO`)2phY(G2QXn(J2<{H?N$?n; zIzthPpg|snx+&muTlELL1!a?zWvM_>ZQjfy7(hNI%ba((QtTxgOi#7tsCSjhKV%ELIgPj>?^co z$98~g350qO9+|O`_({vxXpV`MHV$2bqvs|>rGdKB_A(%s0^mI}`MgMsP;YebNZe3v zFra&skq!>H@_n03%!n zWB@%RH9Yqs3FsSR1wHyfW5vgYcTd*1@Jdj;^95ijv-wD;>R>l%1o@4A;#4Z`7?n~$ z9GVWedl-?Q6J5ljMXi1zrO1h4QVfe)uLOmVvR3LjbUaBt!msP4G$%>WIF||L1xq&o z9Y+N9NWJk61OO#p0X``>`#Cw#hy4CR?qg zHdw}jV6G0*{e{6?l*EO&D+vG=>QU{>SY}f25T^x;t~G0GXCSy)^{t^G{tYk(^pY@) zEZz=Ol#zkwL+HF6gpKaemaN%MGhqGj{o3FdG8#a*#a(I`S+$)OguJM4!pA{^LNIp) zP-9ST;&x!7wf#+$qVJL*!YZ!$AI%iJDBGeEpMcjkPvv#jznfUFO1OTr4a;23BWI)8v+z?i`ElOHwq%4 zJrRbdCc;%5={2UsecK){Zm z-UAFixQQ7C{sYs+FU;SwJ=4z#u6NKa#0X#pDJthQ4`mR8S<1*H;gGmcB4tZ%kTuNs zg}bsW^}$aI3bTZ}2X>0)(m>+QmxmiExMC3s#S3AIkWqoYo$~~Cu3Ws2UdlkhfBrLKH@-*C#fUZN_ zRR^<_6Wq;L6lejM9)ciYZR^n2P+R;@l4G<>#6bbyU>xWrrUm}M!tDtKWIjV;<#Quw z>j<}rX|4b`a0rjIra*DYHUDE!DAQr_??54WXMs!-p({5Ca9q3#kvw6Tgs5mA zk^iL#{1)!ebp~zW4!xA}mmvuQz68N9?Xu75TvA0w9DuIOB3VTUG}wYPH{}U&#sOWQ zh&K?n6wSXu6~?DVl4TMTMDbkwwojUyj4DX@PT4fbOmcdO&cjzyt{#70XlocjvS73t zHBQnKAp63R03AxeL=Wc?Da-I43NbC|9S8AIE0p$;)EB5-C8-N51VHxyrO6ISI15|# z3U*fz#0x{I@ubF1>mBlDaR}n{#hI{p6cPYPt&4;XEB<#ajdpp9i2p4u1Aj}`GrnKL zn2BI~ua1FNZ$r=cE*%4>YEsYWxLBt|^4}Ee=q4oy=RYCV{|$6QUXSvBJ+BaOZ_Yn*RQ&xm zzJ31J*x1xW>inL4l8v^J4$1-1`mG&s@;SZ}F0Md#N7A0s-Erc_ zvWgPAkw5Nxp}io?TB+iMr6%>XBQ}V*G^LRFlbFPFp2CjfQi-^M-q1+jzyvciH8&b- zZfXp0Ec5~DE8m}#O$yrj3JU5(8eyPlg@*D4dj8h5M?!#uR*#T!An^?8`;w&=2=$@U z9XGP$ZfhhwI6!f*RiSW!4 z7t;jjMM{_^zClFoud>5nifNR&o;srkG&(SY1a_TWSkq^?+PS*AxGJb~aA+hjEf!N= zjX0Dd;-ljTC_^`XW&roS!g6ZV=x9B{J=gzAe;n*)*v_6v^#%u|6|5s<$~(_=a*}$% zLS2wovnR~}s%6*;Wt({~AbO!j&bllp)W{K0GsUw;6rMQQl{M9FhRqC=`dLlvDuN;HYIxEEf559fzd(QSVkMzx{qLA=J`u}+yKCG0VP6U5$$Gn+Uzh~-HhbU>q$nlS*qt?43Y%irC| z)O3`QCowDJ5=7VnZk8 zF2PucdjP=5VF}8O0MSLFkQb&$LyrAqu&T8YZL&~N2@L5V@Gb!{S;Hwt{!`e0 z9D=qlBy=s}2UAS(BDC7!s1O)6SVCKkBz{;+3a?H$#!wZtkwSA~CkS>L`cyX!XFFQI3$sXV+E={bSy$Oh z(J$z{fivKZZ}pJQykI==2*|V`E(e|}f@cWPo+R53T@d37m^Efd_%0zx9rBq0R5H0i z!C^w3cAG&MfG3ryy-LFMqDKzLd4dxf&)*wPN7`{k4NWJGlCa3OsS@~m$r2FRRDqe! zcnQ+SC!@1E81Cam2iyJG;qdkwu)Kpqx#2v4NC=RO_gYT@0d?j2p)=lM{}}!nKP>4D z=EFA-KTa<$fh)zZLHsy6TnYHKCZxxa8_ApX}HC9kwK_09pMA|qB zgY_qj;DtebAFUO9F(Y4{W~in)N$6G-6w1wyiL*Pyz#y-GbMr z)gYJzsx;kh1}xx%cb&u~ZXWRku(}R0GUR_|QkoK>jQJvF<@+r}LlpYz1+t(T2imY_ z&32WA!%*pBt`plrwM4Oh1Fj)_cn-k_wm_oE0)LK>2jvv7k6B?%^pkjnBc6Bxeu(jk zOdm<4+C!L5Q*qELpOj4Bz43yY;BSr~K>J%j~~!E%CSN%<+O zj0sT&E=an(2CqoZ1hvGF2qyZ={0@D%wf_8VO&$`pnhqvqh_%)j#grtuNz`Fl`hKb~ z{uii%bh>;eT@YJq9i42W4otT3wS4(Bt)5Y)NvE~sW*wGJ(05PAqJ&aUnr{oV~K>CI=VX+K5hq_e~a|L3u|JW zkcS+l&;lJD@KtN1NUZ=uDFU2=&w)lOAZs7QHpDbUd9SoNP+1WFga$7wOaRaBQ}!-= zBnn0r7>e!3v<#U9O*paGp?(PUsN`^tt~G9u;=GVBPAM{gTv2+t0{nwo$U_FLT?05G z448lTu^0RVC)B4=Nm@~Se0VANm~g8BRR$j{6L~sx4GG&>*3?RQEYJ|hNyX^1N}pCb zr<4T%Z(WbF!s$#F(gax@j*-ueY&AqQEcAjJtawb4LxK<_kEUW)*0@K2<~&1?r)=D0^jz z7bK>kfl>30aMC74NDr2pLzxgEif}utBZ!NZHZlz8mW4f=IKA%MLEOQ2EMKD5-xL;Y z;~Q~6J~u)F<1k!8;7b)ljDkK|gH{tl<6Q<$B>(i|hEW?32(H9F1u1%k(xr5bNQDp# z11NpCK*Ox1wl0`5yoLx7VFCeCOwBPQ%1B2o;UyFX1Js21O7c}8^z^mGWeJ-2`-8x# z1t0~U`JxMFQZ}Hs1S60!9>NiZPK-gTni`NyW=@hH$xM9Ugu!$Y5Ee;NvZOS*w29-$ zGWL(8^%%6cQE?W^Hr1Lw(NF+kwSzpsyPwQ=~zFM-&KyHmXf`v29fkK5Mt4{bYL=>5A}KyA^FG zwL%woBx9`LX&WFWIJN3CcqFT3;vYe`0)99*lpeS&9XyNjPLKxy#k;!1tP^xC?d&ij zDNn>FuH6>;3qUiZ`wiz3?Nug>FL5P&*k~6-iXfQCz#-^U4Q+csn}^yoks?9K;$lU# zbsaImFe&<1gF&$}%F>8LvH?6kSVj#Rb0~tZ;>zf@2!JrgKwnW z2B8Dd6DA0T8a!bc41rLJ4rHKV?^AZ5p19}831%yBR58bDP zCx!@>ru%D91%Q?IYZ&WbV&JGM-UAKrRP0qJ5Qft9V4%Qv?V(E#lt#NUV*K0c2)i`{ z|Bjwet+NTH*Sh&uX#m>fEkC9wL2dS=b-sYMy5jR=y5d9cij33(Z8Z-|{aE6F5K%`+ z4U^FJK)<|+t(jKY3EJu%QQ?R74~I#js@?PjZFeo;$K#FwildJ>Y)BpwM6GLSBRDM5 z{9?A>z6IPX!M(TeDX<$+l#sOM1ocKBvn9c!(Spvj1%vqS?g?}c0B<3tM(jJ29|>U| zt%HgH=0PhVAz+CTfSt)I0RvHK<}?39w??`MHu)93hJ%jxQwS=IAf`izWsa@K1HmXGO567u3=;As%0+$nc~} z7mDXJeKBk8VdA}ie5H6o>U}{=;9+vFfA~Xw9HZ^wZqx{ekNSHj~gUKF+FZ2J?DYJnv`{l|n1m8k`E;OaLzwy&|PAAZP^N-ZfJCSGHGB8_L- z33ObbHXIMXChm1F)X?NrN5D~L?4}oj)}@`+a}6UJkML9qhJ)9q2F?J4i@i%`p({P# z6Ckfs9M}5g{UbEk`0K>b{4PL-%QK<6DeNMJ!8_MFMNrgl28~wGZ-(D*2K3ve4-<*Z z)YwQ`N>?BdN4dtmYj6;U^E2%bvf;X`h0yj6d<~|wA$lT7ED4}*TGf6dOge8j#aUu= zFnmAioW7aFP84H#LQ|nkGmB;@d)z)KZa5T_Uq5c#P<5+4ZjL&`NoUaCTzPlh8FClh zy$bW8Z}D}^9_s7(;Z6LdJsLltdF4W-P`;&>h^hsrSAs$l33l`uyL6#r0s$cEUo;m| zeBv|0rBg0qA|TQOLn%4uYoqfwJSq8AhQA|qlw7E7#Z$SHkX)b>!c)25i(EtvfTwex z4!Owr5>FS(F1e`I4!sGvA3P%WBbCgRf?o=z=B2ygn_KM2z8ie##!}FGd|aS3R*2mx z&V$00)lD9!d~XxKTdzCqKY>AgYaO@Sf5Jm~KVkoQRNC5qKF!tb9FH2K_e{80mLgO) zL4IUOkSnA^Qv2O-Fq({|$a?y}J<+#U>UHP(pMQHDcdh@!%E8wD`#W7vYX2QrEzh~t zvT&ubS1gxUWv{w-RNbpERRIZO1`<$cu^h2YCAs8lOjDb0@LRS2*;E)SW_L3AayFj2 zZj~zPyq{5O6vif-)Y}D-+EWtJjqBeJEAa?*+_nCJ+b7rm{!wYW{-5I7<%`lEZCaO= zpYG{RK$_HXIZMCP`QAio4*DmZ(>f~@d5jU9>fG}Ed4|8sO44}L9M{pCPx1Mrpa5Y& zp1(?i9jAe{6Yy*8AIKUV=97RyRI`VGbaVZBCkFn$Mn#$k8xzSr(g zrjy3#v^}ZIyP zV+t=w$7M%duEUCF(BdgIW?C$N$?`6X7Mc`X=nWM=(^g?avA`@Fko<=6zjOT;t_|xO z=h&V6|L7 z>m48Mi{HZ){~@~K3o5>Zna@{lQDwyw`}sekOZaD^3m;PH0)1R4!j6WaDQ8twhq6G? zUU}7cIloxAE)xqsirG%*1muYcYrpG^C-Idm>_U?39b_rCR$(+tu*x;vT+hi-6D`0a z2yqLf@7pDXjq9I};3LeiJJ)}?baa^H|8Tcm|4(u4vS{F{K&{o#U1?VY?0o5lak(OT zubFG|k1awtg*nh)W)MXyD~0pC&WbD7LEk=#iRRQe;V}9ORD?&Vf^tZaCX^X%rqTUhe7I>LZ)5^e#)Ie@8V{mYgnrrX*c%%Vnwbb^B8FElEQ##pDkr! zs8jrkvRd+zJw=5o-bs>Jl6B6S3(tSS+M5*4E82O+74+SCV}vyfDlC7FUmWt6!%h?K z@o_do8tUnJaY&dyR~6UGE2c5ShlSyy9eW;CuWa&51c{aoBcbJapfpT?wrTb?+>jsZ zJpc6IO3+(CT=N}HU*IV#adHV*XAmhQD3}S-pOm<*0Q}ywcYA&7bqD=_1nKV{@?WX4cK%!5?*E?TdQ$qYRzD!wE|fn&_Ir^1Fu%wp z%J`v71?*@>Ku6r7s1zsKc)ooX$u15mf`}IHOGH&OK|=!}nhv;*=z!}0h3Lvr^mH{9kAyj^`k_mu4!ct%J(RZh?B~NZF}qQvD8P=BhUS8XpJh%kuKp4 zCn83=BtcF&cu66RuwQt8;R`em%p1HH^E#8=KSSyE&j7@qvfsr%s6L2$&dOph@pJi0 zQnaC4zn5RiewT!J;gR*F4f1V{!7@kJHGX7Qe49ZS%a!NHm}SGpAo{eK^p@%(@5|NHO1?ihdkive4|sg673|AWe2IVt}i9_(%T|5IGR z|HHEtlmxi&49pQzn73Fm;Ce;)FN-8s=SlwaYPlqBSef{{gCUe1oiwB*G9zah{Nn5D zx@9FPP*_L(vxsx-oxs8X_>u6wE$rGgo9orm+yBA3WMY8fGb9jKMmH6N7Mj?RcbNhp zTquyCBD#&`D9InZ`fDt9i6wuo%h|9bqQ&a#-o+`4;<{)?o56#b48A6fT$wu%rW}AK zrWd#`uzJ+$G(d4DXgY@~?C!auE)VI$)oGz8mWtuHqAKc#uoaP_G%5H;fAJ6g zO8GqZw@Si@FO@{Md%W?!(PW+ZEseWJ&t$VAr=y$PZeQ38&)n5T;Bz>~UNW-M+%|Mt#UxNDsMu=E0HR{)OmWI9qZMNB4yte51sQ-KwrdMoJ42o_kGWtai(Vbf8X zv+@+cD~UNDTwl^e{Y7$wNvhZj`zn2;VM+7xgByQn0N*J*qWCL^*@PxPFW_gzY-D~N zYpigL#k0mofMnG~6gSzQOnjl`&{yfgou#Zk0Z}52Z%^bG>q!{BM(RQ*%#qTzpd24z z4*IQ-UsgX@@XTw>(jo~dhhY~`J0l}n4-L5nTraESIUy72@mM^mSXT%a{{e&_5BE#u zVD&&ZOaa5hI!m;e`!NcjiZTUJBg_sn zu9zf%MlwQ4LV*PhWPpO~gDg)HN{SpuLnh=GzcBy*11pD83duF{;L|gCdjRn?*T((d zm3sIc<9{7g_P6{0r?_q%|LpN)&F{uYis}U|NFXq{YO&@ntT0qb=;-@RZhnL ztCY)o+wcERa`pV^7px_0WgQUxR+?e6a}3J6R8*aDC$uMIThD&c9TztehlNr}+GY4X zywg9evetmBMYcK*`^3G&m?L0aW6>{<|$Q*x)#pa zDUdX|Uih$<2$Olq@@%N6pA^{64$xIl{pbDH0Es8ne?E9Eefjc*+`C=qGYnsCuN+mU zcs2NK&U0*25}vk0;FMC}k#u#8SCUfbufP6^)U(g)p~Oe;ms8WeP|WIjv*I}H{hc^` z?HpE;mi|AQ0lI-V%E7D(YdD{5)e-onkRuzG?DNG+!6b z-WoId9^hr_yR7W5lk>P@=!g`x3>(YRT6RJxU(bxs(Q(JbdQE7PIl-5o6Xbsjgy zZFc7B)80ul#5hQ$UYm9U-O_lD!OB~%ylKmDm>fWkX6RU+?ufX4w`7|r4tg@748fZ< zq;AD0ib|nC)(yZw17Pcjto2bbiCSl7*^WNtWCQCAYfB>BXtj7tV7yq-vQ2wtvtn<; zisyT*c=`^tT3N9La}FI%$#mOqwU5tE`8_(IY7NfE;;DDs^l#6`qgJ=eAG&7^6yL}1 z$CGw%Dh>eP)q8+{(qctbU=l~76-S~&{R2PTltD4`i-ahJAj z(gO^YX3oSLMY~d#el~Zmn?4-d)WbVv<@w-OhQ?F13)Rm6x9U(zAAV+A=L{*CzMe0XACWJ_5qku#pb3h+;8giv9iYrw zlDbYGow}a>Ya@%;fYIaeiodrtsr+L4V199TiFAH3y`5i7xBQ~0;TlTP-KBPc-_NVA zzV!YBnMi7zQh13bm`Sv`4`MAq$NMcH73x9C~TKs2P^|4Sh2IhCZ1;tZgIRz1JKtRJ*3GoZ7`=S%XCgGob>%UJaH)&6&Bi znQ>YBeK~_)o&Ly)O7UJyZ2sVHwZHcf-QRje&wrJbrOtKdvD7|->*4wzdq?}_t^UVT zTxsL~PPtM*Fr7Hc=SP_fUt#}KDIIOc|0%A!#-Hnc;O)5ewg7zgE9$uY`w!gh9VNg2 zfbhEg{__-9vB+?6JF0Er=vG4yiu@E^xD#)N^MI+Q;<^Q?ScD(eAN2FM9TvJlB9*?L zP(JRH+ay<#*N#G}riz0msRS3KXU)EL{b(K@!gsyZ?m)VJR)S*I}+#F56 z&1XvtDW+9frOd|q5{>*zAjUQ{bPRc_doBCi(i)Z_A`#>P3IE=<%+JhLK~8bed41R# zguCHFN8jk&g<`Q>qhrfVPw}AWHEWxu;bsdyMg$KKz+nOuMku{(h8x&nL0f&lT@)hs z((fzSZ5V2@wqz&lvj*%#(C<66^u)M9=a{P*_sVૼ(xx^1jG=vnE;X=n}N9VfP z8hw)5jA;92X#!dfQym4iQQGF5ymrSI7-8%233ZUix`*={%8~KZ4&!5^XRC3d+ZuF;(erwu; zo1Gmf(7xd_&4HC=e$KD(a~Q37J~hq-L73By#>J2a#UL@d&8Y&GV$%LBs7PV{nzA?9 zXk|^%7$aIBlHc_-*xh3GFl|ARjuL750)yAb(mV_T5=)ZfJaR6F5mV{tMcO3?Q=|$t z#Y3gQNk4`Y2~vOktv;oj>9iK~BHBU_kZHet9{7*-1BW!m9=e)3Wb22^*hZ$s}1R7h$Wv{2I)KDxAV`s z$J`YjR_dA@mK4=ZMveDSwm)rl0Z}%cWMrQkHIaLuEdsFo33e`drr7CCZ=0JDSw#vySgB1`6T3_s_aI+~nn;bfG|OcU1Ww2+R~+5W-dQBA_U zYx#Q04RScoSax-52HX#_AMV$P0Q#(Vfoz&AwF-qoq~i5T75CGH;_#@(T8~Wcs?`zf zzag8$*IiF{U1g?cXmn!vWem{x=DZI`CjifZ{dBA=gFez@;GxH%Ohg7P9@YYSzu3}) z`^Tz6inS#2kjYA18?a*;o}s{$0|r7tH#U}d)9H^VjefJu=ICW9w?h>0jY4kc(4;e* zNZc_8(pJu1s8{D){J?TMVj1vBEx4;;q8YAg=vO+IhN8laE2Z*Cng*+;VDVyXbN=ih z9S@)VFZfHu)J0uJ_`f8C(jj+;&B+)hw)=;Wz{22H2pRDcQXI|RbRch#98kVo@>Q(s zFvo2T?6lU(6NC=B2}C)O0%!(ErGq*i47%*%jRCCQV#QbWlSX&kepSo~WOzEXh@0Hn z)_<*oxT~v1!A%BxTTQVI?qE1-91aJXcd>&hphPuY6|^h`Yl(g!FYdXxd-ZUEUj zABk6yfNYc%F%O*${%LdXXqq8uX+n#DcvPc)FyeLw4pgVp3SgNJJ zKmI(l-2leUV!FT=T4E+rdB5WE+`h)<4^cL;W+A>J156ZR&GCBYV+F9KZVMPZR5#}* z$iV%=7}EfvDG0=gsmxqay^x;x7e*9>rf1{!d4;08v%y$ws5||W0iz~;@jKdfv+OU9 z2kiBPwq*Mz^TKw+-UrrQd5eLmac4dqb{mtE!KlY0%}rq)*6RSZpj{75#lxU^&_^#` z@T8vdyY2W&n6K;XfMshU$Uy?Q=qMr8!OU+=2EF*q_eBX3=aLK&`5mr@9bk4O0k+?< zYgNC&zQq3p^!+hBq^E0{LXHy3bS%;dZZ$|CbsBzBz#D`y^53S>Fv-@^j z6Q#`Mr3J$@bZiw$BIMy{(9Cj?2UBYS4o%Z--vFz?DoSB8lwMB`+J&jXL--aZ%uc*O zbLF_U6HmKvj)8d1=$s__!d$w4;8e$NX~}fzVeuj^SI24}FGN+*!1b|F!l{J$IWZ$1 z7?*H3&HZ2Y{;s)^BuNkiqiR-ej}V!=ZjpODk+DQ(WdM;N2!NkK1|thWf)VHh2{r)c zM@NRBLBL6R2M9;Ofrwyb#ccnE`Wf*9YF_*Gp7y=-W#;Z-c2?v>cIV_o_MzqC^ux^D z%-jL+E16kU^h^)J-Obd@)YR0})YMd6;l>tOrpXynyh)T6%(*|B#ivce$&<|dx%CS9 z+$nTg)=Ny4)3VN-6k%wnH5L!tZ+0qi_R7328lZ}=Q%pdZAW*TPR?v@EMFt+v{L?cG z=oo{Qi8x9oD?S&6cPA%VWCAP9StvYXlq1V1`9Zgimzx>tBgu>mGBYLu9Wz%*v?i@= zwxjhZ%`SN$7Jn$=s40{nAAo}m}RM0R?{UlvJtwF%8udo(v*HCt@2G{RYQnKMe(QngQ7n)aak(Hu4|4XxShL(| z9A*>91SIW#0CvAzFpIW^^dERkWAlw9IBQsAuR1sha?WZM2;AtPSp+i`q+I8^>)y3x z1F#k~?D`u3UKTLQEX*7azb`yAa>|A(LZB@urc}R-P8Q7@ zUI;62Ydx>TM2Tz|g9=41R-)WZw2*8cpazrF5x^xt6x)Rr0P7koDoR+jn|*8P6F!k; zDCAJrUAbSArX_=O{DU_N1XAzVWbnw^WmNDmV5Kd_m>vl{49Qwr@isuWOe3%7hr@p7 z!USr-$~zRmV=ZZzMZIsX@H7rwef57#QgJi#s28+UgHJV(HuD&)Xr$gVnsBg0yk&Ef z^zy-l6e#6)D*JY{^h#NeLat$%KpM#N&cGi|*uQ_0F0Sc~_k!*u%oxk7WXZ&(NRbgp zlg&zNufB8CRD>zArV1p!Ufu^(wt@z3-OfO;?5A?Cr`{$4)88c^HPR%xt4{bwrv#Iv z)!J=7f0{2=>MG0~z4p|TID#YofmgyLV+?9@v|Gzc1D6>yhfFpNuO_-AYUk<(oyD+Z zb52j_+E{8$3)O{aC?%qiU1=m>awQime@}DWX^f)JXN%PQ6xd5NhtE^)Oloz0RoT5QRw+ zNO<#6!FoF)hiekU!h$)F-L_t;0ZH9>x$6IfJvpykBE{9STJ~Hf%L+32k?k;;oMKI1 zT0CY`?o`eqc9i@XQ!Q0Pu{R2`3p6O%0kmP5jQXe=Fa1|PFOrm1F=J!bgT?&5-|zcPRu`hF;h35xU*I<1 zVv)D`7I^Y}0;DGSQAb6HB&~rZJ6MIhpJnVa-JB7hjl~4-4f_x5W&|N&S<= zRMR$S@L%wY?0SD^`cyx_*za_##WwgQ)+dftaY>OZ>} zd#&Ibzvu0o!Q8rY*e>rJlA)kQhKt2{h|bAveVzdp3=0>v4Q=H&U{51$b1O*VO@p{) z<{}UI?8!4$o5TXo0<}RUKf^+-JM!sd!zS(EViG(s=k8?(Z#eO1jG;Vd>m8{tx3dj(C>-PF;vUmc%~|v zOfro3yzLCeBtAgtT&*4{yJW4J@>HL71`tmXc1BnYyQ(#c zs!M13LU#X`a8gX~J;SO;nvqXSg*&jD0{2-)Qkt2TQaeG$(@mW@iD@T#Q|yd<7^P5Q z8NLWZ)pz|-myC4AXX0Br^(E9^sYD2fXUA;2E_b05`WOSL;JFxS^8=XK>A2NN+}Ngb zM4|u2Q^eJvK@u_|k?UjUg%gT1b291YnC%D-%5=*o(XdQDWOsalzC_PDUSI4^1_R&- zKzD=&JOy`~MNZMa%0ZhkY!-p0XImQ?X=!8`hJ-Wou`Qt*20~ockdQ8#FhxW(%92pX zy{^G@6|X&ySk{EkI)0z_HZgdw_i)4~yP$I40Fjlx%3BkZp(BoiRS>_1<;DpH;=$;% z!_KI4?xB@jJ~Fzyfj!T3+ZW}ui$H8D$?sakciqQQ?-4QOaA z%WhBXyQ#Ugt&B2~QC(t*#g{UUNj7JR>{uMbne7M#%3MZFF_zjAOS&M*zB zv{B_po>?q~pSvxmFpM&|v@^g=2^%r0fac^_mjT@^A2XDVPn$?M@(X~1o{VsT{Dhb|=cpaPdmIwYI$l99cYO1UMgYHh{7$kz^uMRHf%w(@y0rG0La+UEwX;V`C8 zWWN?`2J@9;)xF7Wx{Hy{9Q2I551><;rAK&p`z^9>Hl0QnSnAN-Tk_4|J?x>wSoFW~ ztn$2ipqOfVzkHZ6py$L6&94hfOF#Tj-ut$_-+b<-fv@$0HgNe?b-&WcP~!LRjl_{d z7h}|NmS&~Zf~DHdi}JzqN+xSsL_vZERIS;nG%CBQei{<=VrXDS&QZ*PxM>U59)_H$VEAuOF@HCV#CQkJdck|3$sjEn*g_gp_jgCQKfK(%18 zXlPQ({qZ5j$L2%Rcxw79?}Ch2GhctzM!^72PiKna$rJ5ItNEhdXk{O5;09t=SuUtX z*6OJD&8UvpCZWFe?5NeM9~>PbLov$C8v5C(nHwsz#q)pA+>Sco#xjzEWQt0{xKuwG zM%I^>n{3#T__XkYRYaoHqCPGyJ(DXf;5jm#pmLviCwT6ODILfIJrhK=U06tF0ufwZ z#C6XCSn~5?z$dSizzTaTrict}lbry;nTKO;QJ8ZNm^wZP4cX4D_%7?>h^fOUMsJr; z>0vO0@j;_Pr9G@8rx>D)m9Q#U;H?VD<%cAqNfD6VKoyBsEx@PzI~?GZR{PsF^W{vG zO{ck#X}(KL^QpDI#ML1=&cISWA0}c$p7j}d>_|hOMp8Nnq!J@>3sG^1Sg?>sTi4VC z{&PVuBA%p8luQ&qJ9@rX{dQ9{Jx`<$8_zb0=6JKt(%_Mqo7g2SDF$2>I{^qC-EsdS zZBz||wWvjKRR0_fb9MAxSO-dz>S)buv!*GdQ>U@H)$OrdReloN z#VcZF=G&yoT%Hw2WomYOxnk8SFH(sRZ=22eOp3;98dc-?fgGzr)lW>5R!Mdpy?`b!IThvnu@*-`F9 z4vVB3nW`!kN7CueOvyO%M|MLun-a=2SDSfUGPB_a36ME7QwUgr4(wr>VoJ)5Kg+A; zP#3kWT#`j{lm58)6e+iJ;=OoF+H8=o&XOcXlon15q)F>Wg(`(3iJVBfoa(GCh6whu zhFyLVNZ)LE84()bn5}^tll{4RmC349Z_hA9Xw*7v4ox#Ef$p@+;(_E|e=zZ^F@?P@ z*MeuAP#oiCY~+`D(dy}tw{3@jHQYqRKFk}Sh!rYb^Y(mCqb}!={bMvFw!%y99Nm)0 z4l&w=*#I1v#TCc>t71R?kaZbNQKK8WCyU`i^kZNN*EbV z>}w4lFLG%dNJ2*$BMg)jkvIALRe8x2-;nVYzTqP>j4&?u(8Z9GD^VU|9>wLoWsdXV$ zO47rGYNOndicaCqKUi+DXu?LbRjt(oqd;=wv(6hlmB8C-r-2xt1^~H);>?MMy`xjJ zvJk0*oOWFF*0ss65W79@quqehakX%kU2SC^s;%6Px%F`zQ=# zr+{2VY9-W<5IMZ|ydm@sF2)tzqTNmRe3-EcRer*?$w4|xi;04(S*;y5DmyLFA7Us3 z)YR|`#qc8OkHk_Q$(U5Ol=H9Qrt={Pe-Pd-rJH3Cxd6Z&5V9RBQ4P5ng z(0{9z0X#*vJygV@-+u(gZl8})y1*zJth05(Vq`CeKdRg}($o44F-Xa<4Fq%^W{ z4eUajp~~Dy3>$*x#a6HniMdX<8;o#>_9Jg8*j5cQe;ka*Fg~8hdM`fZ7mKU7%tafr zZ7~A0LXwk74`()5I0mDl9k;hH-}ctq&d};2!oZuQHEh zH`2?lWC0W;G74!Ut%^8~&HzSksGvzn5|9bsdmUJ-?fczP5C$h>`Ax2>fI|e`35N4Q z>+%TDCt1-9u!RaDp2>t(68l0!Kbqx3zo*$#2s5=@)|k6T!C(LgAr$4sHyYgQfpSvs z2JC@M9wRDXXgo}m5jziDE>qWy%Of%Dtw*-E7{e5Bcp3yfaXP`}2nr>%YQ-fhO_{&P z-#l#}9zH8K$gN{%IDFO_?RLf;?(pbYdUxEG+WP2&LA%WtWqPe7*YdOd_H&TfdEe`> z-pqY&|)bmhums9=V5nEyu%eH z9CkX=d|05rIHR7Uu4KoH#e$=7QrTny)3U84=R!`MP?*iY%?wP%u?+Ou&T$M9?`!*2 z9FMK~VFGra)myFl{#DQ`2iLW+3$L$%)+^zZsyMy>W+67#eGYCTonV~DE9Ua7537I+ zV)l@^j}G-m9%|!3a_vu$uUC;@4}*{$=n_-w;L3N@!=nr13ufC29t>i|>y6MdYEsCv zN{|`-IW-NInQxHKO7FtzJdc8BjPD$tgyH0@g0iMsHC<#lnweCPhbAm#PpHof`E*{N zrUGIMq=8HZi&E%Y+@OHjK{IA&KJ1M1=<$fp<`AM(y8(j+mm~SuEW}bChGXchE=*r) zqTso(hh~xdaORn0%`+3uJ~%aywRv9~n#)OM+3qY{BwCH^;i7|~k%SDLkDN0n=Nn@l z_b`Cl02wJqG3yL2NQ}?(Q4ud3t2wF{U|UIIJ?;Y%AtNlA&Hj+6MHJ@HHsq``32PmzJw^@VpL)9w3XURz+bdEL3L+r*DG^9w6+)kn3IWGN;>_U;_cM ze6A2P&y^QrtBW}jBLcKJ%c9Mno+gOL+3D&ymf0Y+6pgV9J$pt3zy1{84;~^8H>gXLc8vDl`)C0+J)@73^;uLyJLnqU3 zUaTDI<6d~yBZHPN&m+s1Tp`D8iuP8niEwLXyDX;OOCx`eLqLX}rv_6L!%-{Bdw$3c z@$3kR;>me_ocHkOZ;$=clOPyl5WlC{1k>DDv`DG@D<4$%%PkfEqvMl`rQ^FYs!u4I zg;xzI7v%vV)z8W8V!6}=(Eh$JE!Mm*apk!w7p9SY(KN4#QcKT%(bOK4p~IAZ=;g8W zL|^ozqBKsaI1$9OD7~=Yd_glk!+Cw>U8ax|=_VDGPVik%@h2SD@>hAJ{Cdw_{vadS z1*vAWD{feo#1GIky)nClSDIrdvu)a^ExhAP|9#dGdaZ!tj+vb>#fSxKn?QXU(fCK} zboO9=&(W_|U~CdNy!RWe*}?P%*L5@#pEDrB8h+j#b>2$KqXeM@Row;ZZSRy1iGCx< z@+Uzsuo)*t>2`LZsp?q^2B#AE^KWYHX6w6JB^Na#>2p?m{vVNizOFW_&&cK2ECc9$ z*3f!b&D-hxuxF2e=RNA)B#x4y1!`*VLa!|)WLik*+)plM~YrBogfqb*qDDPK9%rm{lJtV0f zd|j?p5s=JNX_RT-KygWQ6AV*s7nbgwx6(R`>;pQds6|JEmH`{GDM7l+rY?HFRuj`) zMk<+4xjTj>!jzO-siahLNXbtz+Zp*;50Rfcy!HJx=ek<__p@u2F+2Wyab>lz=Ei?7 ztghV0f4_@s$%y}cwuvt4yb-K?BTq0>BfsA`e)Wce#L?o>TPen^MYjqeuQVa+ko529 zfdyaSVjFoQnGt!RKk`_if>2J-Vnza>^XB7`e>}l8>tt{q^f)&B@dd#+_d2koJ#5s! zuI{2A1E0LxAQaq557}yWgu0d!pHF0}!|$C5{2qnkt!zE6jVa!l3N#<-XQcYur|o&a z%Nuzn4AjJ9xiWlnk1V88Qm-Oom=ju{3sS;ln<*E znf)eF<)w9E&x8Iw#iL22=;H%vc9o~=FU-Qd9+8d zg3Z72aQEhEYC<+2v~xE^<{XZDTdDEI(8HeLL{G>s>r;XMehspIy%BkEv*VPtzb>|$ z)qki6Wi*rgSz0SdWhM^5lgU7ym{%kacO}F|-|BnhXr`d4gLff~X(jbTEUtIYi0eI^ z90OD1O%E$p$yV&uHA7O`!n*0WX=+ePCl4PAI&xSpC4<5F(RWyX}?lj^erDkfc6C6{uP@@rm2 zm?;fwD#LDOCo%xDPn5B?=_av8?Ve;W!k36Kn$&-{)p z>xt6zQyRUNgpr&@`{Cq7(s^aFzskAQG))=hnw3jU3azk}@I5gKK~ln)V|ORfJU8~U zl23unb$9%*OO%kdNJQa>Oz=_66{}Dk`NMo`1hI%-#sdoRdn@?Rmf;L)hF`mw?>b4z z$?6S7($i>p3K64eBauSnD>~MLmv%ZY12e`m&v#aCWxcWs?`=VjMUBGU!`bGiB(L4k zK%w(VYHLNGQ(~&Ql4AvjZZGTmLz?^=wUG|_Rq1GLt^#a`WG5waN5A7Ki6|h+HBYE) zcXVm<9Bat|h;PMocTZQXV9b@1Rj27LoSfRk{4C9^#}tg zo#JE1Jf$t{6D9OrMDuzE*F+Rjf?R>gXcAHwz;fD$a<))M78D3micntQNjBiHgtT3x zPDk0&h}=t}!7+97V=JC?x_TZOY!-kPy>ci@w;!w#ndVB$606jCt%Oqx@+cNb9m*J+ zJz_}d3s%}Am<;q@JXz;{(Ebev2oh1A_2h(nR7R~B0>kybe_(eXC)vBH64Or)o$!Kmf;+WNeKlVF) z=xfD<_FqC?7h~ za&<6XAZjv$Nksl|+GG0YdbiP;95*(GpiAGQ*bULlLLa6awnc;_eV5LhBHE7~9*Wo$ z^CNpKNv=Woo@JL{JIUvnNMq2Lhs;zwTPC=b-%5rhk`6ptX?aLGdv12ss3o|eS^5f@ z)RfI*b9$S30$?i%w!7yXIZ=qr1;u%1m@o}57_(f0gD1IEjM7}eSx;hPjqK{)7MFEBNPM z{^eib%}4tG!N-sM2mixY_|IjoU#HXNV;V1EKSnQpEuYi&XO%#ImI>Tv{PEw74EW>Y ze|Mhwg;3c)$`{5ny)d6Y&i=0QyYLgsH|saAJ#PC={G`nU;(>_*OszruT30o~di*&` zKjry>^N1Ir=077P{D+VK_TYc~_q(3;QYJ)1-s ze~DL9UjLj(=Sbs7>sO?6i9Fr0|6LLk^fv$fm^Pl(cb)!$jeP5s`Rlnr|K6F|sou+YPJ7^7yVe^Ey59uba}^h)}$smtxQFd*PRf-e@4wJ8AKQk*+`K*csskHPm|7nY@!P-$&iGU;dWjDZ_#Zt)Pkp zeF}Wxn|+E(+hz@w^f3QLF*+vRtkm$}1p3jbAGJi0I^j9{xca&?@=+fI{pIM;wie`t zhnVGA5nn2?QZImJYLE~&N}3+5I?sX;tcgtvG-a!{m4a5bIiUQb+Exmw^BvQ1o4nL| zJxCG^PKEc*AGgP6c+hAoh28i_C+r8XCdW9^;*s$aFvYrtz2Ge>U3*@)-%;UAf)hhC zs_eEn5}CGP3wo2jx0ynPBDQq@;xbxAsTEm3y`_2`C8dogNTofzN;e-1uzJ_(R@SsC z4XavHC*>+12b1yaJm}(@n$ww#1Jn+5>1<@Afj+(v$Nr$y6^n~vw~m@jQQ57w#G|E@ zr4E@4LjQDtr_TZRb|1Zbwf#d%l-6@%eJxik!r#YmZxnJu6yaVm?lrhK;C?Lcja+e~ zM8AtG>p7S}a;4>BuC%h6OBGA2Ik5(J5fc`odu=6GEETAbVsS(MEx-+h7ofn$tMGf3 zp84Af{Z5G$Ot2Bv&;*)z1Mu|~`(1Ha|4z9tZu)#pfNl*}T!5=if_cyDQ=e1w5?u9J z0^D#CIM1cxrJosKspKSZpI0yaECD)AxbpL37obDb%Y|z{r)~;>?iCl{%Jc-6dv-fz zr8qUgRi7^jur%k{9eOLvQxjbE`H}!vFa4alTn3k|xy-@s<;Tbmi}GI6j1!qAGf#yx zhhEp0V+Ezm7s!d3^R8SPfR!Ker5K28;_~X%0Js%^{HfUhoZICxRDj)z6wfC`##I4J zEy2CY^Gu;=WV8!oe6Jec*Nsl0>MzSCtjWIxp6yhIqC?Ek zOwwi{iM*6_VFConff5x~H6Ew+Bolqn8UU&#DeR00@ea;VenDifDg3JEb;dQ}A3I}} zpEt0E>S0=MZfvmZv$4j1vGXuJ0w#cK40OGynjE!1YEp@NlxTBn}7lhotl>{=`{ee!$$hA2TnGosmLN(Y^? z91|KNV&+8DG1CfLS&QzXZgNt`#HG`S5*$8hP(mu16p-d{d>5Q?j=v4sOrYP?rDzR* z6X11zXA-jly6gp6(N_5-*);`JaNIu zz3KRH2eipCY0*6Kpu8F0a@HtQRc+F@VM8W#h%NQA5sH zq`B7sKuunb(yy7%FwtW#acxu$?HZSgJSudJEu60yI4?242* ztQ(Z?qQE2}^*xUB)K!r_59g_?BAtiY^a`Zr*Pxh-I8agn4*Mc=4^#}6``&1rF%^as zOp*0dq?UT*jYj8ap|ik0&|eHB9|s)XI8%f9zzDm9{{0sicEjuWXkJsFjE9qiLj04A zp>E8Ilac3HZvZN0I`zgJAOOose_Q^#e9)@2YxU=8Okrd|AFQOt%(C*Dij>j8A?so> z`vp}MUSYUuBWEtwCX7UcR^JR3sum0ZikT(d`68Xe<7UBROi;b?@#G}KFO*w`h15c4 z@@^gkz^n}cUPPWGdXr%()5cSkgFu4M=7jMAvzw8x$P)_o06FWayz`ThU&RB>=zP`d zRo<~{%*^M8P8hwnppzENJDh}P$3f8dIs@I~9P2XabHO19=?9h!P1|J_$J&f`= z6!HQ(<7tn{aTs<0`2pS*(nXJ@Bvoel%AgezLJ_Hjnxs)exTGTd-9~>*nVR`#jJkOH zl^@v8iYCl==biDH{f3TT+OPUS2e(x+?43iQsjHOah$!lpojv&`OQTVdeQ1$=yIiX@ zT14?|0`85`BdH&rX|4O^%Fr~CT#g!E)#hIHpxS&<*-a}nW04~{rmtA2%?grBZd7)w z+SqNoHUCbic`wt1Mh7r)iN7ftYKB=Mzhx$vT4;E5 zs9SIRWbA#Q9I|=s2Bz%|dOV;qhF^VZqiiAv+>KWhhU$V1S-X&miq;OEqB0lS$KEOM z8!l9ja_t7nszxxhYB8S)5wH2Cc{`Y4()6tR1c73Tj)4uVF&T|f=(wm z>9U$TmJh3ygI41^+)hPr>`B{CQx0|+DGx{9n>nd#hfQgL+#l|o_iFxNT1u=IUjs;p zHr3=S42iT=->q+o!+uA3K0uGY`P9OG^SR*p`9*nWr&1GVo4ryC63XLqgm* z0M<1bd+(UBTCa3h@8gr~X7sCt11H)BPndJ*Obe6rb8n1C&nlx)Fv^hE^h%>qZvgXZ zRLZ;GwJYCNo2_Qn2nOUba2X1SnQoYhZ4p|>4KVMaHzMx~rh^Ax!K24b8D-eqKNK09 zyX2~L6oR8UhfEgu%nt_C`ytQQ|lM;y0XuVqS=qNDx ztB`0uGLj8uVSa{>+qnUnZusxQwB#c3^!aZ!bdbeW%OT}470ab9s1A3Vo5k}(O)Fsn zvV0M?Rg@-(PTsGeK#>vGx}}Baj_?Hp)<1UaM(cfzn7n^yrMlF-(w6OWSr;v46jQreL;yA$Lu>Rt6obzhES<9rhEkGy5O5j6i zh3Sj7zuIgedE4MgDI0()sj>@1Ws-L*^Ox*e{}h#?|CQROTTbCTmL6XIf#romyq>Of z6RNFspjI`Pa*gYD-sDMIQ8E0JtnRlarEfwa*nJaA?UQ}};z)r-_O;C)H}NTtWiIRP zQF9n70@c+jzX2P@@blZ3(ac+_w}1?xd<7mnXm3%*-h`TA;BdPB6hfix?M!@%GEkdc$qxV74?+2 zOr7Q6Ub~6N`?UppC|tpcmAu>%J@Lh|n)RTHA@unT@hmi`V&nZZh!TC&A(#8*KPmqm zaEul6hhPntOvt56if#Tg@qU#I59Xdc)m`VpBIh7Yi`oof!iw26@|2$h+pX*ld%HZCPF7af+< zp`{r&{p)zFON4}q^Qqz=sn?~?AYXX4`&x<%tdJ7N;>a#zV<8yp@?bcfiJlZbDF$Sl zXPmI|oPHuWkFrL>#2xbG?z}2tN1Teare!uXAE? z2p6_XvA|v~;#1G9Xjr}GtL%E`z<4G5ODEl@R;&>DM(R>sEVp6%TUPo+F=7c!jOfwG z<}8tF9Mkgw7J^(|i2X-s6U<8KMtJ4#b``Gk8^Xz#VMn&MS)xS9 z4HbA7K~3gueItU-{n6!-$`=!}ku9WHfpoF=%v@%H@)r8Wr}0v`-S0NfBXP(FLhShg z5v4b+uhJo^0R8n~H3x@xI``E0={$t##tEz3rJgA%k*Uk&oWw~P@!EQ(Jke0iBQ}G@ zp0cIfiv(RWU)&UXd+0BtVjmc?H@P-AXC0i?R?f@E`)yuEe6PmEJLv|tF0f?#imJkS zbY`ZApdYY;9! zn;8?d2r1 zDK-_&grEFhc4+)v?K(iX0e1?YHQ}>*aZi{rW12vM*klCG@o93Yf%2%0vde{`9MhX@ zJ|MS&1~<@^|7ON{#t&0HQtaeY!>Fq9a~JTrg0Jh?(h$<#dmF6SopQ34+1H*vv3mHR zrt&4Y*|;X?CZYe(KK@GRTB9+H2fP_->UWw1itcR#KeBaYWRwnP^=_h9kVA+F*+&v{ z2(e1K7Ju{`+5qB~HdLU}2!Nqe%X7b*wuklV-i5C^{ycPiSv+Y!EDxA2jEU;0;b%6f zy)~0Vmr|W!I4o`Pbo&>H90{#3S!W2CWyt&R5T~*|JZPS_ZVk7)hV4B+o5X2AmH0IF zj^Z64W7O$nUu_L2L~gL7o`MdI~{o7Vy2AKvVS~FEsaCZ#E#FfhI9cMvyb-7#6Zk$|Y2qgX=6?tNZeOT(axT#hc00mpq3?2e@)pEr z&}1f_`(bqjaUo@^A4o|xOVHjZeX^vCwkdPTvGMV=(}-;YRx?Hxs!vBMq@rF>4V zqR7*vA!xY=TJ-3v!p2M|yMX&fX$3yOoK_}WxCz#Oq@Aw#0l15r{?Bl zL)(VPBi|g~nK@_MjC>v%J+A+>ahMSGkDFIZDWK_|g(R58d;TEmR7Z|GN_vEj8LsZGtkPy3#v{|pEszpq!2d3>KbRn;6MZ{Gb3X6hnCwu;ZC!SL^ZJe_n|h$cNMv{Kw7ogidruvizR_Ha z>qjU^Yy#?SdD6kjpC_+4SkZ^jI#7eA=Md;OGV*jZR?{qpcLVNnUbUY59v*vs z8tL^!aeoL-3@y330ZUxI{c^t49`SEWFGo` zImVvWWoKBft5muJls}8x*BFy*v$+}{Ei!C;r&_go%3!wIQqkm?=a@^^>rk^>qH$gr z7jtwnBfg4A#$bn5Nf23At3YC;Y0~zwUS}t@tH)rH?#M}6o_`Uu;;hU`Lws>$(G|r^ z%W9t6W(+)(gTD)EPUfg=454An`O{{&1bSA?g=hh5C8M%{fqLGnUAJb1eSNRmTBNz2 zTxKQ5BZGlb&`6OzcD^hX|5J3t$;zjTi{2H1IISH`K~JFc+NAP6XmR>fQl5*P-3qK^ zmo!J)8dzM+F@lPCRwmkXTdk~1-8xnhqb{xAC=N$Ul3>$4y3L5(>1Kl88~F^r+KPJM z3E`3zD>5RFPHAGSWa}mosvk^t1s-Qig8g>kbR}uh+}fEDr@oH5CIuUB6J92@c2Ias z|Eg(RYB&TLwN8QmtO9szE9v-{XgePB^AtRVGSlS;i00Kg^#J`OR`iDaT8j-nU!N{M zUXhm{d_F_J+m}1S>lz!qhZDc%vsNi=jT~U)h0Vpw0}x-&@6Q9U2Jmb@HPSP5VShPt zI#hG`u(O`42KJ>z;gDM(F%9Ae1fNz?$?-Ge176Yd&CoKc_jp`6ZrJaSSl{jN)hga{ zB0n|^0&D0hM{)}uRdNWqV%@*cXMiXk;v+1=KA$^4j=h>p`4a^Y><=$N;Eut01}6|V zb8dyfB<9O+{@u@`%H_Lz=*iaa3OL-e41mr#@%s>(dH`Ag3?1K2PkwF^5->%2-D2|% ze1TraItZ5bvu+aZ0$^Uig*LwjcL8CNpQQg8d`10V>1WO!0OVzauq}?XRnXgXI~bCn z@4pZPw!!0BRlv7ee@Cjuavv{pT5}tnE)7#<_Y)! z-y}2xkKO&omax72zlW0K`)??6k^h1Eb^U)2mHh|ezt%I3^gobwtb&0St%AK@Kd+(H z+(Z8BhWC6Okp8n&0L=eN5dV>UgZ_KModiX~x3YS_lu#!BN40|w|6jcaI{ydsR^opp z%Kw%Ak1YgQl>SHG2}1v~LbBzV|0q-#{l9G^(Mp&#@PCXMDEJ?<1`785r|A=U4z8xRH zg#qyWp$GT#P61|LdJV|-`l&JZ^tP*z3Js#x;!F#ZY6F1=80q;?`+V;Z)USpU1Y8hq z^_!ss+|xf*8Vry?zSHd8*Tec{!0#FWU76TFYJAyWSNyVdJ{#9n;E&aIN79E(Ak9y5 z_4w2b|J?ayrGIJkWNbk`lnd5?0^e&Ecw=jNGS|Sr#fD5|n6yOTit|129Ww`5e5KG2 ztbqoejSvDC{L49Tf#F}k3&HylK@$J9uUtt#@F#Sm86!}sM_}&a2#_rmfQtJM{?ifg zDuV+Q2ecgsh6Aylawq%}UJZhJWNv#P02LoM?FhQ_$mS~&7oZu!j1+?HCv$LaNVdsEP{BjMH)d+kfOwbi@kc3XdpL!Cf*~il^fF+9U-`N*sSN5;; z%Z9{a`lpn}lL{8?J57Fi7I1D;|Kl^v!BW6b{zS>*D`N) zs)f|=(rg$sv~9Y#f-b}1e9au4jN-V^7qP z9OV;I`C6nB4>G||MaoiWg!U=RoWhO5A0Xrtg@4YWy_QZkdQ}S_p&p7KA>Xt@1p8Gp zcyeC92%w9vUpQ6Zd!E`Y{=Qzej3N_nJy>6rZdND9B7Mh9;jAr+w4~m8!c(LeG2y^# zS>nJg1s5_Oz8JMFg`64qDKXZc(f=6K_cH!j{ISwHvtadHCNzxkm7i zSS&t62Mm9Ba+-oXJPKA6C8q&TyuN0(bX%l%=3Zk@k1b3=68mZwd=LkM{YG0T`%XIp zQR!}Ej^4P95w|UqP%D>L_yV@A?EFxAcA<9I2YT%=;xL9WMQ8TmEPBB@f7U@c2a1>q z)#l+vrkSY}K6uDy%#`#H##tM%Ab#@VKoUWwIok=!+~*`#rJ=m!GY9=9c*hE%HAH+ebPa$GZT02@khd-25jbHxr?{#~gHZ?&oXaO( zS{LW{%s=m0TebQfIivmdyBu(N^J)>d{ul3n<1;9nxJjkp^7F&PRYJg3g_m)0rU9)w zPI3&s*HHsxse>*{ajfaQq4+(hr{UJC1**s4Wv^kGLj4S~dr-QUD|iIodvmQKIal;t zY%^Lh_a{<++y_Qn8>A2mZxdagm9X!oivHs-p3i|7#vVVbG(~UV`G>~ibwku0hfK}F zKI{pm0_0!P(plpWodQo`_&@pYrN0=tV2g)-&6GovR||Ik^!uUYBP-J?xZ5`=)oRxz zV{+CrG`+utWtmO$^~uhpR0rdeq4YXDm6k{JOHgD0?;kuL^z(TW0PJLc|JO#Yi@6OUPyC;X z`tOw;)siB(pew7xs~dAwP(kYTcBMvhJ2H2`b2XH(vuj z4esr6BRQ&du4~#id zO!9wDP3)wp9NX)E9WM=RPF$rjW=lORRcLI~=vs<`uuliA6>@yUpUm0^Hztp zg${pCe6yD+IH*al)nv-OE*}Y}hZI z-RB;FDYZC3Y^(ddV1S397%<&n;n?p`aZ88BWcss5Su$!1j} zz36WTVsI}$5YH*Dl13d}UM@ZBA2%jR$h1t0>s3tvQ&D2b&=5A%meOPs)b4*haq9d0 zHBD@xQ02yNiPs&eUkobu*3kHt&*~vDHvfm_E54RiTDUpakiv z%>d9G9oY;XwWp)4H_&^!co`xgt`$TZOm*Jlge5=CZzWJYSC&9@7MIMK?u?oj#k;lQ zF&OGX3Xuf;B|OW@<;+nB93s`k0>o)^nO))7Z-AAE;8n?VQR=15=_MHPK=$mJqEUCdG^=tW8%%3 zyB5SFXPydn0fTa+&ftM11{4K&Ru?_O;cCe|DV};5;#ynCYN~c`C*2>A+sVw{8#Cs& z6irVuo>!{*L{P+SBj^y8n43oT4Q#|860@-ISz5Lx$rvOF3HjDM=yoiQ#JLIR+{y4* zmIeK2EXra^2e}`7F#3+dI=?;K1#hfP_Qe_<@qKBe>J}PbDriZ?ckcWwi&>@ zrHSjuPv`Gi^i$kx5-Gv+wA_de{PX*n2ygLJp;IEMw zp?Sx2*Y|G~!SLELMuoqc#We|$#eF*=8vW5|E8loQ#h8M-W7dLJ;=n8qW8Z>vls(>X zKdqt4D$8=-$^SI`ie5B*()8ZoR0UgaakO!nBD5b=W6XE%(q*DrYSYD=P?%54*9Y;B zi2OcQb_z?7OWxYfwL82W{|@}?DOB*5hy*lC0PWNdk`1@%sO$JQRtugM%Aad)1i$z` zgX}pgjcDQ5uj3?wzMHk9cdMCCh#2~I?| z*cA7TIkv&|SRdVWi8dTK(IDIM2kH>#88~4x-(b2Xa3EJ%KjA zfjj-!aUS;uoxqiqn=8NT<975msc?m!)(66bgeB}a9s1L0q@+t>QUv0OM6E z&>o1weA6cxuJ2#JIW~S^M>w=Jp7JvScq~UhV9b)Q1{GR&qjC^bPGs<@jVxEVG{58N zv~*Kero7?jo;7*@w1;X$1x7=I{u-WUaM`5CqsY_I0mEsUyzBA{u zwmp;+e>T#dqXi+3TihH7>GDJR9BApmzA1S~^1q+XJh*I;z@266e;&^}Mf=j`EeoKb<^fT3!Ds zZ@A8@J48n*Uy9Uno7+9FwtL@%Kvz5$(!Ua9dfe2Jzv?HDw@UY??0UuEzizw6sxnWZ z$`+$m2z%Y%E)beN#Iu<$nOVoXv)RPP{$l1j7)>t3I9N=Mc6fL|l>c)zq~PcnosTR9 z-KLsRDc8v?y&Iwf@$UT4-!pu{@&J^Z@t?{BuAqGOBwarN-JIljflZ$cSwJU&+qN2m z&psypx(7z9ln%QI3DzLu4>YX+(}EowFxi?N;2AlVKxFZT!`OqR8n=YxuStQtX16X> zYmJ|FSTsZkfIE2(azH0)K_RtrgjzFs?Pq<=z*arXV;L+2Os~do^dV9lfd(71ja3Oxu^Z27Kh~m3uHH}?$ z{-%o`)Fq}X)FmbN-BTp*Bzk;c{_F>t`m_Uq&Yt;pH+7JiL|m<3Xmx8I@Smb~OPWLDR0+#)xAEhoIxC=qJYP zsTdd=gi_X_gg(sI6TccPlUxz1zk6ITifw-%u;CiVU3jvoz*P7n614CQBl6fxC!0?Ja?5B4Wat#MK|-FLB1kyZa0?3L%9(60G560`zkm@xEHJBWGvhKS{xTEQ?9E zud^Z0Ru)Lh&{o#6uiXPee#be;1PLQ;fZRwBK=1LrOoMA$D1JFhTMW>k8doF&B@>F#Y#izV9G`l{ms9+NcqwVktXHXdG+6Sn>dr zhQbSsf;n!A*QFk-k2fg-9VVMBlDxqnq~4%ahbKjQK*^x=v;cStjhs9=$W!+B1xZ}H z^ierUDAnp;{4zS}4Vr>wRDxvEoRhJ$)qb!i;r@IoY`?`>V23nfMVQ678m&w4r4iPM zB}56--(-GRe`&)8EtYjw#p(~z^GNo#>cv%0YT>T_`=6qVD>o{z9;s&fg6?O>4rxS^ zuGWa`(N5{`R1}JhZ+JBeM$zRtib|Gz`$o3TaMV~qn^y=9hDM`0=7@_#Cewp(P?ilD z;f0|J%}SAC75k`PDC0C(&epfuQ^m2BpqxmPcj}YcCKsKop7aH9q3XddTY)QeZwk|- zD$HR`eJ#FRFiu3dsyQahIc#=0e@|PQ0Oy{POO@4*3fL@rcal|H=FV8dh;%e}TkqD* zc4Ec}dj(R?LHvlaBp2Egx_>+yH20XK#Tdn?- z-={l-Ug80N_;{l-*Ar4mWD6U7jEPgO>ESm?A~5T}(_m`Jy+t-^2DfuFWyPK)SS8Xn zP6-cx;w>OLanvHx5S|tPNGwIFWv*OEHv~0bK$VijG*khv`ujrB@0f*Y50ukeS_iH%0twEu(qTb0;pHPU}vzn*R}Q z-9%6d_0W3nEtpwC;jGI3B0(1`M5;I{l+7G0r|pArMVJtlQ|a#QhwHf~UexJjVpeN5 zKYP}s)x~9IM;LtyF2B4%5+l8!4O20cI0+lO8(8pVku2WPrXnyJKI7G>8xXvNym%&k z>er_08QhVrbG}tT{0Q&ei%AK(Xlx@h({HhA=C7%_mW9@y`f(=9xGot7yd8z3sdL;6V4I^7_^v?2i2vZSj<$`}q<@WXVqhGWM3VWXi_PmT{ z#e_D{akfCtxr>Q)M5VChYHD6=qr!n_(s%yu!zjSq@G|(I88d70l5T$(udt5xCnxr- zDCV(WWbku=QqYr|yFzhfv^d^K+K->|-q&G?a#deZ(}iIN^iN=^DwYLNMZUgSa;F}P z?M);3J>+LXbFgNFF`dM@&SRsS%A)}kA?d_FNs~MqTSBiT0C@p+9D`&cEdOq0WM)g7 z5Zkctv~`|}S&T!nNpVrzxSa!3FO+sF+_)~sy`1G{)RhrXS}!%W1)NqKV_dlLZT zJM?|v-b-MpRzq>NKJrh9C5UAcTNcYY+8k-RbFDJW*#H?k1V91iBjGk0x>%qKZ)x&X zkY&0#xL|O|ECql3xFuZ)`D>bmFjOfFXzSrQ1W%{VaN7tp{|K8gOCLy^9j5n;5jlMFD+-&tgH=KMYp z>_^F|8*f+m=c%1#lnr01F(7TL;+T*^0q##?_$7mnBCA-y)z578ICx~Kh&Tjlg{uV0 zZKgQ95_idF3O9APJwb&hf#(V`FKmeopSSE0@4>w`B-gITh_G}ZG=;}PYAtF3YsA8v zU6R_F{Osn!XzLu^9TylqJ5!)AimzJbW&XQ2>$iV>)#gu_(Cli7NsOr!E)7W?u*aAv zSb~sgDo(L#BzTF%LPm%Aof-l*oulj;p%f9;)`#g`66;Kq>ilB#H^@4#t$g~Bme#Pr z{8}m~1Mi>o*2%gRiw%L2*b~N~Z2+|f==0LI7F9Nhhr3?QEAgg@M>9^JGD_`husSOy z8c%db{h<+j0$Z8d0f?)=TA^vL+`n`Y3^4SKq6q}PW1&EY0RE{z`r@)|)1%!lV*ify zHY$0W?Sqxi{nh5jB4VNT2NL8CgGxVs?1Q%HCl@1vZx>8d7EV8CBZCCS+;p~eO*WZ zv&u?ho4fMj7a^s4;>DmXH5I!+L5;!R5{pM!n@gA8O%jh@w5LH?Gw3NBMeeGi#+2&L zACdICjEGCRvnRjKXmHRh3Vtt#XxK9AjZ?3(i02?|D`^winH(~D~hVW zJe)*K^=hIsAH#uONCZc{V_;8AzZv{!rSq2%|sZSi=Lz7Z$Su8^=YAd@>hulI)Z|ALFLCnNLUJFtYtv!uj3B3G0w2ttCB*Zy z&UaPrDZ0ZzC^J@-BAcmy&m^-s3ZgRTrj^E^bTH?0o1KqT`bJoqm)U$SV*B0Nv|#?& z^vfWlKXmxUry)%1)&}wQq4-SfIsZ1}6%Rd0?FKthdcv`Gg6+0l-a?4izwp4O$qwR6 zF5d{xc!fj#5M-lGu34Xg`vLQ{&TTzvkQ})6qVrq-+8Yqfq!@|G@{g@Hp6wb+LHrdO z1Jg?U^rLD~wg6Vw8-dknMFtsr$PZta|oJ}Qn9$MD$JgFrGDR(xr_m;z6?TC zU4^aRyjvEXTbOPC$39r=WoqATviVluEX$7M_MD0QC}n^yZcJ;yx#{K8M>^_|>Or|o zCXrcZd6|oeM)-h^S#cbNPK0a$An_vE?2mIN2)MwSSPL)F3qoSdAMP}i(SM-=&oDQjA&nH&z=jP7=0P99o2Omtepjg zw+sq9Upc`en{$Ql2K_OQGp=?o)tftN8!38)>b&sjIL4d$W&EwnTQS#=Ao=EdOe!jF zXa0L4HFT8>f=I$nYsDj{@1cFA9XTM$)84j~yHuc#xyr%OI8TJ*X3#df|1Lb(_>k@q z#gFTXr!IrNh;{vHfuV>0>Rcm2mwfzi;quS?;Ft*U`aC(Jy-0tr7w?i`f*60m-w*zH zB?2ji;&>WXA##xd9FEiAXNG^S^ObTe<~$y_C{^GEOLD5EP?&boHkpFiG>k@~sl(3a z;M(y51h7OUXqueK8cJqbKFbttTj2RDbTw1Hc!{#9F2GTrMlObkxnCBGdhG#|%oU0% z^m(>)A*8Xf(2th_0W^@dk=BMojRI3t$1=~+if~_YydB94P9X66bfC=S8l`jt8O0f6$=3S)W+Jiwi%&+S?p zGGO!w&-r~V_+h+)PsY3ICFGayEyhcuQli{+K>%v~Pv$=A2$oO&GL&1Qy%L(;5-Ic4 z1EI3-^s!foe!fS6WmDJhkU-ef-5Mx7s4~i>M4xOTnma4&J(W5c#39nSRe8R4>|JUB zfmG259_zU>1N=Y4Rf+@-slz9tlRcbgFGD}@mq1Wd54iQ=c{=Y!UB#Iq+@xz8C@v{V zR%(-1#QcFxg82`bsu1c*$$QA#k~dEfWm0+S6F!8q5EnwGLo!YiLV9l z!+yY$D4@EwR_u@;4PDK*qpG9zH>Ky0>j994=a^Z>quk`KIWT8?R8>4Uf#d+2fWJ4I z2tMhN$@E2_-XB3g(#=Vn4ka=yyvX|yA?0?MXJPcX3(e561s&&~ zqznLcM(7h5dVA2M5|a-BdMGyjJehm+&(_hvRda=0Bk#5^mZrF%>R_Fr6%jlmc#dI= zRr+<^EP74J0WQM9knhs-5l!C5Y9RKQqq zcM`$b79<`AIe0A*P0+rszY|z2yOTEuW6O*A2tV?Mo4w#FSuA4u?G`^ln=AXp?U%RD z6&}fO7P9@Mf8UX#56ZkRbxs)>nVD+0Ka$P>er>>g($-Xr0QKlAE4M~~U6D4Pz#a9+ z+_#G!l-ZC1pcei1h2PDgbOaDp$A{h?gHWe}@zGX6m4);=7Obq5+VeS|&(0-tncX+{ zZ=ATop`Omy_Xa|JcB?0;urA114*;t%5 z?^&pQ`_-d z?eC;hH%Bvm4Z6xh>4_m-D>L>~niO?sW5jC`FzR0~>u_Yc!2#-J|BUN?%@{+%G1~q@ zXL{((b}~@3Qzy{5sfAj0u48)QW@r2#PA1n$+aVa8oLukB@5B&wK=4_@`D$7_vm85(!G9p-MULS9+Vrk*1buXa1d%=s$JXnWpK42? z{h5uScg%zg!tR)DEqNm?|9;d&_S=NRl|Bz771i;ftO&BysIGUk5IHzMevTNif2I6x z>+Gzb50ny)ZGFSGxCiO+;1y(BV;-Qe_?XY&^c!QEi6_+fu*w03&L z6V6Y|Ig;hl<%tDev0?@4_K25ynZb!Uhs+eHOgx3dm<@DT%k+ifK0x65#){~x6?E1;Q1QQ}?-RweMzrIT;I1Y1u$MvTa8k6RqqU}yP z)ZJb2feS%v)LEo*uA5S1VgD#(ERiBF87?~Fo}pzBDv_E-!1ViL^STOoN~Xy$>A^7N zEe~rU9VJ+!e})ahBWa+Q`EXgh;{a04t#X{4yM@EUSPi&DX?`F9bUGHDpiLpF2XN0^ zAZ=AM@`7Yz8Xw$6=cqWd^8GozzPq11QRV9!N6+2T|D!*cyH)1;>`c>)lkw5X{J?$G zE%avk{O~{5*c!2NkfR+2p~K2p&#SjOd%6xB&BlCI1<}Kj77ebGIP6<08$=e59qng< zZBp2HXzfS-LhQh3I?unR^q-`{%#`=zJYGqmQ~rWPCgC@k~L-oZ!?D5 zq^%@~BFMe6!2}JZ{X~EA#Dzz*q56U01hV?*qcD_+%5teGw7uE}2j(Eo>7I*N5B7fx zHN$YbQV}U|#jO`CTM5L?$z;*uk)u>QAq%G2N>UZ^mHbWW7ZXlNj>6R0v&rD`%??ny zsgc=;ZL@h|NQHW#JI6Q@`+Vhl>+QDEQVH>j2gl1F zoV5P<8{S z^YMX~Vu)39F=FQ7@EVl3h`2bu3A1OwZ6k?N^X;Izk+yT*-F{t7o^7r`GKXQ63w< zNrvcq#J1vk@+8YkRhnPdWN&>l(fT+lg+wVSvuxw(NwxcF7Cg+|!}+)x-Y%S43mY1n zoxy+`)WxtvjI>geW=_OmHM_y?s^&j;Yw}!la?DOW(#jQmbNlPlY2clH0CYNY=yv6 z`&4$9f|hS_e{!%JRkfH_o)t@?kvei_7FG;17DGrQ+kzb$-nq$fD1D~P1J?MxpKLQ7 z#A9qILDY#=7k}__TV7A=FzgC{wO^e^Yu(8{6=TW*B&6Wtj;??Cy=K42Q@xcpHcM&G zm>ZMy+v&nRQ^6qALaAqEq&+hDum%l)$K)J%$LPsG#p>gd7|g_3k1=;? zhBflVqLkCbj2#vON}1j&-|{E$Hm_tgm~&MBZIIZWMW{Hri}S-z z)6O=*WQeq8t!>%=33k`W>L{nWWY`D;i}-{1mecT7!`gvUnqcHp%Ob&?^G_<*%DJF9 zu6QG`HSz&bE>j7|?ZnY_;D?unF+aU|sjM6>MO9$7wvU>LjUK1oR|y&(byrc|Bj!U_BqVX~%N^xc6-vnuw?C$%+UDftM>gcQ=S0mm$unx3|*yLHnu zkrJ0tBNIwsrvPQ8Dg@PUVi%4N-3rCImo1L#FfAB3p3~J~#NxWA0dZEcx}38tgQ6SU zf$dOfvesz%7FeNDMQ<{fkaS}+5B|R;*qAtbmvWVXBO9=wX;Q?pHB;T+-0Y1~<%Vo? z$##|0Li6#%;SgN*cKaD)iUKyc)7g`R23HUFf4tYsVEl`FnjUmgZb z=pJ-5+)Zh@Rbi^6w{D2RE~_#76indh?opXfI(w*8r~Q3Ne!0kg<8dvpdxXI4SX|0i?@d4E*8K7)3PpAJ;SWFMb?dWaePM|kz!S5#SyyDIL zww^UG=V07qIXZ1UrCy67)+-&N{%dNEt{dy2UL~Ib(wV#{Csi21kpqs?-3k-5@v=%L z>aocT-f%JCC`<1zdYb_uy+jsHwK8JCl7E{3^^t8gD!tDXT+zPVW-ZDp7p*j2CjK5+ z)ZVDKdN$ggB|(I;#!$T8UoL6o1;_nomPExe!^l5F$*Y>ptY{i=^3j}?HxHw9=ob)s z5$(kc##+)9Vg*8(ABC4@7xk)$lUUdfK-&Kod9-K8#W-CGts`WBR}YY%!LS^Q%o zC0b*sMeGvyG(^P~+3K`zduJKstunf9EBh$Rv($D-_%`e4m`UXP$|Rd>4-)l5aDIu- ze*)&Dtuw@iHX(~N8&>?B{+7AfAJEEr!R&|Cha850BIKw6k}59eKqMDb$HjCUDrj{?K9gV{5$8r_bY4baabTZ; zrO2d0ysjQ^;z&$Pu!5fA)UVG_sMV7`1jRFR+K7(v|Od#>Ad^5wmQj5n#`*bbRGK^d-(c*9dVW*Lg`&{SX^haNz%;PLemjW zvnZg=U$T_t)Ip8L1wDTyi=svbq`d9C&~sniJZUb;wBW?5nJbpu!%h)&dRE6Rqp`0^ zFHr}79ufwL7qVAwCi`A6@bW{9V+Db2|a5ud)J<5{LHvS;7Kiy<6VEM~C? zLe50Y9=T3=j-1rXfT&ueb_tf+>%dTJ++*l;E2B-Of`WEPGUW)$h^>pKVouG1)M#jq z{vN8SskISG+!nny%h|>@($Oh^1yM5lhT3b#eJI{>lYSD6@RgQ7g_L5w>3bg%nWh7w zQyK-s4;Qhk$6;q%>7tm92*-8@{!CO-56i13im-d5h%aEf1x&H@Jf@^I*S(w;*4$OcTqPbGe=B&!50v7X8Bfi6j+eNUuKqOQgNWx(@oyQz7 zWfLx?JN*G~eXAx~-kHGy+2VV<3a8o1W#o0(gcWhlFO}ZuJY4#}GzHtvSBkMDJDYDi%+@6{7pwc#i#dCi)pmBYt?55<^77J{j|{`{Jl|mUTwA- z-?hK0d?(V)@0zX3{`cSSOhzz3$2-AbJPP_vZ~XoD7htJiCyI`GF(4)vAYYpEZiD3!;Z(Bs(J>WvI#Y`*dX`&o?}^W8aA&VJML zjwencj5|Uhc#Wv!t;SKs4NP9eo@sa-M=M_W+4N=xE*Fm`qdvT0WT7O40m&sX%JB!E zBc=h#<3Y|razaLu9?2RBOmz+uAV%fs2pL@(+k_=xaF+3??+p+b1wfC$Gp%yOs^(-k z3`XNU7*!aEN`3dV?N%nAKHRK~b=_Tw?Dnx~guHEV+X&ZMVg8p@j98JydYJrwKq` zc%7a%3LSoMncgAZjjei7DeqPq?aH_9>cL)JoP}pTmWqG#!|?Z9qiG@MDOI<7rc-68 zk0lcsOwNy)JCt-{0Lhh30J&^})TyR`T+xY7zVf^w_826VbK6Ynx@PxdkJk_2jm8-E z|H9{32Nj5WYR{i>N2Rl~dh{EL(sSj3hD6tfk@jqI0#8hjVn|Og3gNFrwHyzs?+k=+ z8b!+Sp5_*HMyHc==>eGn3hB`ojlD}Co?5xn_W_cFZmb6kBC0YYzgllMzdP8W3IMVt zQpcmtAUyZSWAfS@h%Nz}j#~;NPc;VKcRGEV$J*p1$0B**H9wN!r>d)JUE=i(=E2v5x>G>WN$*IhfBtf*22^4gl$r(mdG~1udEvl6vO6)9(je zN-Z1O#i(|Jhhsrsu)3_kpzw7=Xbj4LQ#u2sTEcV#c-y@345D#r0nngp`xGjR>{G1* z`Vpa6suPAmAfQYc+APX8@cS&sEU>t((rMunMNgUQhghok5=3_WsmIL4L;)w)D-)7w zZCbEpc_4>YFz)o9U5vdjrmXACq#UaEt-kl54EKPRrRszTQX2{nPVDX_BD){lptx zG*y-a5JrNe{4#vpzBfJ#rc{EzWw+d+&%EgC&d4Xx{k9mu0u2KZ{{EnI4r23yIjs35 zG6xU%MSt&8VtNk>C zv?E+bQ;L}kzqdPTR^XJ@EFu#}D}z9PWH!$_A`~fx`i?tk~X`Jh^$avr}m{na?k9 zC9o8t-LFx92n9iw+*C!Io=C5SE+Ik8w$;6oF9x?QeS z8Z9%|Fc_+(Q|eRyWPpJks|P!^qg@!bSQ{Q3u|bz%VpM%cF{k+oO%<6A21Q+s+X1}z za5j4|GFckF4SN1bYH4Y~;(x^E(ofFD=l!Qoj)UICQ*1zDDp!XFqQlgr=_gAB?8y>A zmM|l|h)e}U>zz(KUvz#q@!^rgLlA+unWPk1kP(byWh+5~gBaJ$rC5BkXyLs;+z`O| zndGRafemAswCi%fCWQ0LV9u{A4I*MvY(5&oCmO5x0~M}r9%#{i`KwB;e(*d~%oRwE z9ghax;YEhCp!lyd?RsGsu*Lfbatl&_Otanri3P?|d$(3=BZ0STm4hUuJ2eIXfGpei zPVDykNO~FZqI|GhtBA9GiZ7oNn&O;`xtEyqK^*9W!JrM2Y#U>gP0u3LJN;q9BdMT= z0_MVkKm_4;tA-0l2aO5{*p-8w%5J1V$;gUjr>BVE^Hg}-`@fgj|G#Mjzv^R8BBj{s&t19u>nFdakAEX3^9{?GGyd0Bm)-ck>!sq#{rJC& zYw;GZ)Z(JRc~{_k&Wp4>zN?Of_s;81P&+U_^VHrgEZE}-JN+;~HA{%fC2?49wggJn zsJ$1Yyz&tktnxsPg5`(k!h}7JRB^Brgw>r-;1D7iFBz0f#!G9LG+w$@+}tiSXj)V1 zq7b9cIw34|fq~~!sFCZFjSFt&2oUDm(Dn>0Dfx?37qO0ML2o;!0VSgTRhm|PB#LnY zkUoa65JMg552%G$P>VnHOnMr4zyPuMdxTMBpx00GbzsYqjFjw6;K%DUqy7A>SszI8(d)5rnhc8?!cNSb;Y(Gqg-r zE<{zhq!xb^j@!JA$ha`RMU)gN8Ch4vzzE7WXiF+D{8%k`JB^xMhS}8Tyj%H;!r+xj7dbQTWrEQ=}45vNQtq< z6{pl0y($i~$#hT34BY+RRw1I5h9jj&*U(byRF3vK;){l^)=F%=j}qG&TPwZ&3A3n7 zR3I)eQTtOcP)iIIGb_crh2KFm){O5oumI}@(5Ks0i&Y=Uh3LTV%iUi)*B4@d8{bZg zRA!?@NpRuhIAh=>XTvHw&s6yZtL650qlT)i#A-gd#Twd>coUuQD{JVKv}gdpw5aA7 zz+3e^y>&7LQ}=8nI5uqX!^v2NYVQj_ntK(&@d_R(Nlxadi^Sc& zTIJw*>&3J&kuy@ZzB{bg!@=0n!GxrDCiRe+O7G|BB&|mIpjj)oD!cK7(XI|A|NEm# z#zkn0MA;Nb142k9-#I2(171X;3eTfZ<;?4>sf~m8 zFJHfcHwZAEA;b(Ie{dd7OyUA(pjselfk>9_pM+`s&^`5Gagk1?_(vWwj`jTIYf$E| z|3}{G4a=CP|0^!9#Pomb%lGU5ySN&a=at=RYbBL>8Q;MCUR(Q1WB=8B;Z@2t<=-Y1 z{!zKTTWx&*yItzu$T7;oN@#go;DC5WYnAALb->v z`gi-Z+AKGoS6bWYVj;hr-a=SA1d-Z-zi@l9P6}bDSYQ4Qz1SS=D; za9gq1#j0B*Yf)TE)7hp$l+jq30x+V^Xso25yJ}1`Eg*={>xo5JsD^*|{^j@Pa`O9E z-@l@FpJj} z-YEW%;GqJ_hjM?55Q*XuCUY^XL6K+Pb z=a0nVP;xp+^FYc(CJqsrDa@RTUuKEAh*3U*rpCS`)&pK~0$BFH6rZ@f<(1eX9f08c zwS=r&;sg&&cKcpu00cfd7mFw25zxz{d>{V_>EC`wbC`YZu*+b`q~I^_7bNj(s{EJl zdBgB_%9v~a6O;c}S4;Q%|95gt?SEnew^PQ|*MF<4%WL=Rzq`0*_dlxeZ*BlIZ~U*9 zV)lQq{E)`2lg*8!J+bnHtuB?i2aQ+k7*_@L}ZJN}O zNXdCRSCmR=Wj`9*i_FOTT~^x>s*RT%_h zfdUqqbywPlAQa1;FtT02O^Pe@|LpNE_t9?10_N#|aLha7e|`Dh|JR*dw>tLJ_&3Og zSilPFlM2P960m@c&DE97<&B?^1@O*bCq%Ow7%==py&b|EwQna^r0E2%p&ZQI{&wy3 zeS1|yW6!>Pgq!EQ3*Q;$I}_Y5=e_sXZho|h&CE@4H^_(E($c~SKjN_qX`rLkAuiGx+!v$&D81gt16IOmI2>k!y-{j2Kq zJX0zXy!N3ACLBIq(YP9*h6hW1Z=@la<_?e{vU3n<|M-b>iO}=pS>dJ0*zdQct!p=x zU=#u1Py;)l^Uqg==GaUip^Q$^kfTxAufrr!-rbEi-0Dp9{ns9O=fT)(cY3{%O2W;S zU|yg(?zX~|OnnxF<0#2ty&;pJDlK|{)Fjlydps;h?;Yz6_{8QK@R8?JWzmV5M*fwN z0wux>YXC89GYHE%NmOYgiLAd$(x|uUJN24u+b9?Z-JlXO;nsVGwmf&5^b*uMAr)W%(lMh^Peq&a`2Rj0APfwE3pw)fvED z2qg^L?2)K_4E1=e2csmJofk(3UsZPb6kM9lwL-r7S8VASYrHl)#0p>mXXw8mUP4y< z$8AxF>g2Gxgc@P(~$_es#>c9oz0^ut2?{)yPuvuv% zmnvb_F^L6#Q>sx8kb=d>A1#?ay)VKgD~@HbQ4boq^!_HGnLmw?2qVsmN`SI>7+>#3QI@_q96IAY9+& zC_Na7QM}1mZyb;0!f<>kGDBQGk>^f!B2ptcf+v1V2NS8vm^M6b49OdXL*R2N2dPjsmL(kD74Z+KnLe*;-Md@7jF@}z7>PMu+?9T$0K;{!z#3xVt) z1(vl5!c$Hl_ZULyy~!{$T6{VTV3nU?uUM9QK*3&_vj$EI%107YNeI*!c`j}TgZ>3O zq(?F_s(3wYVTlS^$52VHGf2XgS$G^#%2AL6Ky7kywfNM4VYIfG+*-wxf1;*Nrwd*1 z^ky187jLD?Kfj5n@ghf%cilu?@HLyL^3QJ~YvS&_fwI_ZHt$?H7M;^Ll+;I|*K1Ek z{+&0`D*T!aHDO$$xj#oMZ_v2Qv`H)8@1D)*lCR5W6oC1yL?!;6H;@XwX4^3DCHN=% z4ZM5yDa*Ys_vGwJ?Gsk}ESVy?k>YBN6v>TbZzl+Y(kb!N+=kNz%;)eTxLBhVfwT8? zYn`$g?Oz?#+t2E|-=(K+X^CJ2a28@;cPsQOO{G-Fa_2f!Yff}-(hYiEQvWCIs$FZ{ zG`C}UVU!aEwZeqg-SZ)JX$%F_p@ppBbDRC-6OhCXp+%Ylh8AJu33FO`30sEOFVzBe z`Lb2--BRfioGw3Q#dHu>a4M4(I}{(^47~{tj!~k!Uw@q|RRNHsi0=fzb^@r!8`|_o zGCc3}I_MTUgtuaH-VtxS-{(_x0kswVvURsW+1tQG84MdTa<8 z5TC?(=_>BND87<&7gf0Los1Qu3Wj5RFIkkEQB8TuJJLW!l?WyStHveSt?t!vNRkl1j<*4Fl3<6C5wWC=E!;>zs2k>FL<69Y_MQdaOu=v5xft#DYw9 zHW|D|NV1qXZ*=24m|}zq^uWjxgsij`M5446)#?ZB28jA;aa&T5Rfst~DwIo)(3Fmd z?29jCYzp`v+U4Vrg?|Px8pE(Ny7-b>gIJ*CY7$|OVJwl-`>V_e_Tnt+(A!;}NnwbY zNuq?R3%(S~q(lewoQ+H28rY>6X3xiy%{}cl2+90r3(+~!SWYm9d!9tLcPOi`Nw1L*`CqTo_{L+s+SK?la+GLqF!ze4x8;iKw zxz0gpH=Y1`|MLt>xGY{4JcP-L>fcyytF zP*{y=39>?!v-lK&%ZW=@0S!iNdd0Rb=7`jM*)pI`c~@)Q{32RWf=&X~xv%`A4JKCC6t z$eK7ip0mi#1%knqqeKQ{UFO&CnLn$crLd)D0-E!f?hywaaSFp^pol%fvyG%nVdfLF zo%T$tli>QJ6MD1;F_LSGAcfLPA;1imq}u&Hb-5X(>5Y+R@B;jHwgr1aUyB-wB+Orz;Kg(_l88>qIlAz6~PFjI&r zW-0dzBPgeSbBIbB8})jBcC4Y(>)ntwpxxsyq9>suH)9P+z4+(F7_Qu#zbwX(XhQo7 zBd04f1~0w|^pY}xI$k^z$m&(ywiDsatJ zWCB{G2F`*#qW#l>M@Hs3fhK3La0K>%YmXEE6czva@SR+6&L9rizJ73e`vf0@JqvR( z)#d2LMvTmQCGEE&9Q)MW?Y3V=eGP+?@!QVG6Hy_Fh_I`2B}CX+GgoN%?f1HD^{g&8 z%D&aX;)UJL5C+Qlyf3sdrh_A*l+jga0}pooTqq*{ayLVftqgQvBPNm&Q9mAIXdYu6 zR}TfA^!37PY5?c32@8A-C-L*fw?#J=LnTcxmf;UCjhEY}4;%1ITudPlvPyjQq0GYnsW1KI%v65akf9CoI%Vmsgn}m~~ z)?dc3MOn4V;fA!0;KUj8byjZ-7<_ppC(u=@3bRa*%m(w>mi=<$s~p!!?F7<*WOkkt zQDp5z%^a|sk?*~cENVCkaEnm*J#R4fPkcW5C^CoDT@IAyk3+PCfUggkA%6-4|B2*g z89cb}_pXYx_jiEG7({ht!-*8 z)1t*;0!VGOtlG|ox^7C-1X!kYEntlviy6ntEXuw!0kPV2R3>Fx#ze$QGe?;)Zt+E# zrr7PNOmTxD%r(sp$!xJ(kkR6VEP5|J-b2xzy-b_5H=WK+-}5$V#q@5K;q2x{*fNzs zDo4`(i;=@o9cff0DA^UY*&18399NlZr2hRD8e{{}u1?bZh)fu_gBKSz?lGOo~UF|qon5|fXGXXRbxpU}$WezY>} z)f>;MyStSGryTpEmF1w`f-gr0Zq@9MRu*N9|4(dK zoDv??q2`w~s(xF-Ip2HsyY zuc_l-$2+=t8MDWKsj#vf8~@8|_x_*n2XWYm#?X>s8<8L`~h z97Er*=vJF_nC<#_vLb!RE^1NTEQUef?_Q)yfQ&C7BZe)+BNXPnE#2_y!A|XHw}OFm ztd*vC6on9u^rv#&jl3Qpjo#n_^t>;Z<59bI$J$%!|8%H(eo`Gpj z6&Cfcl8bI=YcYoJ5Ut|NnEe!(k&GI-aJrk zU?e(qp{NkQ#%U8VVC^gOfF6RJ)0@YPri^QxBK@(CU=#zf7}(Tt9~I~lBeBr&gCW};V(04>lVBNjisvXL zUvl9)ROk>PS)?OI zQ~=h8p(3w*Y#Udaitr{M&}rlxsC(XPLr0v4L?h>+qK7JY>b(Vw> z%@qj#YV!p^c6)Z)l0FS4DFsi`22&ISGmtRdTw}@9D#;%2}#1^&x};==XXp z7I~U7rX8jivY84eL)^TBN*-S*4q-a+kSGk!VTAOE@&JK=c(qHGxJW7=QbgKztNc}^ zm;pLTgN(Be4W+5+=<0XkK?Wp9VVU&23TojOA51x+8Q#=OZylJ z&hnqD=Ae;EHtM{EUhsKOsYDKTX?ToIUlx&oM!Eu=k`iJ|pV#Wo%C%{AK}kK(!1EEOf##45QbCxj(`zWy`ROmYC)%`nUx&0xcfDlz&f0aP+JDTdm?yE$!y9;Twt}#8nNW4 z94!}fsuWFBR5*P%zBr{vEKqG=a)}AD4`SJzZR6w5@PD&qDvKV~4Ed6Kk5$KQT%O0I zRenmAmy;%;gkvwx%wx=E_>=S!u4-fof1`{Mn*XST1xSFIYjx1s`FoWSGLQb2> zO@Giuo5M}vTiO~lR&%MAq?+RiCE_ZC^@kyA19aWFW94!`QZ!=6)C?yUmsL&_auGz* zNt^(??6V-T$!0cMBayefGDSTMLwiPNm^<&GWIM?m2eD@KcUJu24-o^vj|Ki;QVRq5 zWV`;=t+kisDRi%bbuuf1VS1)Fe<8L#Xd2N%r#67;M{CPRG>=6K5DmQk6?PRtSyG4o(4`NnP|W&h zcz$SD#4HxI8xU(Q8V7cwEpq!|c(}S``wah8yKM6b^9~*o*Gf;_Y>wGxdMHbFZZwhx z;nRm&rn&qifq{BYg5$8nx0S$>whZOl!p;2kW`Q7 zjJX>EYVTsooNKS}E;Av9^VWFgq#v75ev0a2oLah(H!6B|R#wmC z|Avc!*b0cpFsA*|6 zUs&p%`uJ0=1=4!yD1j+Q*Nw_fy|GI(a9Zj#8l=RELUzTrIE1$I*%ax&mN9&jYu5OO z`6tYuzrJx9^Tz*5vEYvX)%AP(zdN};O?}Eft>AwY#Fhr0*W*1BRMeCY%R4VBC2>3f z;YfrRFjJnVK24=y;NgNDbv8WQl>FT0BPHj<&UkS(UnD~~nn(IDB0u{<=G)xPhy4K7 zh@WMeFWR;00Z71~Wp-+KYN44Giz7Vx32y+H_s;90{!J`OiD;1o$3=Cj%!G*`Q@hn> zYo}HzAGBNL#`8+6$(5AE3_>e1qaM5zQPom^wX9<5_@{MaDUYJpP0N@U|GQ9HcE|tP za`Arr-^KMQDY4|xLV36>mwL7W4_CMO6f%pwpx;;FE8lg_hkXjJa~5c;3&E$4(V|bm z@K6J!gUkXPjxB4D7)6&|#^|zZONEuC5(b*xT-n$xtbw#X0vR2axEx>>cc%8ay2dg| z4sb2ChC%8{^<-avWK;I1sfAB@OWx-Q+$Yp9@_H81a=+Z`$$eE5dY-n5XM7&U0UKzI zY@C9TTVS-2Yd}P3dy{^j!kmc=ty20O+{VWJR_!Tp6a?cemZgw@`^S+^lHh+T_oMOm z&hsiRiFd0FEqtY(EGaZSmD-NKT2}a1dClYhKqEIUV;=usEyVc$%6j3R|KG*6c#BtR zaZ&8sJSdOvs$+pt++=KW!H8G8BW0WkMk}MnsgV0N-QqA&VmDGJzE*DG5v*JCU&u4Qf zwXaWboG%Q8K84mN-h4P_O(Hz>0-6@MR`7ve<11yrBRGBj)Ej4BXSEVs?rh+3>esL6 zEv(uTGlrNkC*DMPITIB1MrXu3rSQQT0fnpJHCl~eJ6UheU-LM-Wm75t1kEexBsNT< z8AwQbWNF^JN+W>{QnIq}CxvTvq757 zTmS0Md%jHK|EP8Cd*h|sDg&AP`s(V`^*>w=|6g4xtv(Q|w^e~z*IzmRpVj~0RGuwX z5B6?M2UqX^wUyPC`~JU+>oWb{_m6Kx16S|=b@+AP|95d+rvJlH_s;u&W%<7U@8Y^_ z|I1CAYn5^3{x20)3+wm&e;3yk`(LNIN*P!0|I%`?aNqxTab33mgVE`==YVUB|HAV9 z{C_9cRr;UP4oAU1dEKk54zDr(*9-Ua|D9ad@BhnB1y}F?mDR%i`tMGz>-YcVwM5tG z|K+uN`R`7yoA*ENDo#30e#-w-=S^(G2s?QC{!ekWuvT*Ve|>Fb{eJ)FF0Nsx`x?(v zL;vQj{>@9ZyX@wzRLVam=f~K?c|XYS`RKjMd0DMj-gP|+0%3i7r{Lrzq0CE$hSd2N z@J~~ff2m}0kL1#+dEX>z9HN0$`?xEx@=y6^ozU+_XUc=o*3_i6;Plj+@%?ZV4876# zVk$Hn|A2hLDh#grF}}H6+9sc!OD#R(8@86;aa>&{`^E;=3I7GksWamDd9QW~TeZLciPF=ir zV{gz4h0z}=JnjM&$7mLWDhjDY5x=DgI9X57(Tw59e?xA%_zc2{k5NaO>>3ykOB|LP z<$d0M+9p@s&;tx4y)`d;`RHKh1s)kFw_Z?oITjR$M6-;!P@a{W6|}Vwx)Kt~aVNy^ zk8=SW*6X!)v-%Ge7XY5AKsPf4L1K)FPXt6MHiqOU>*`Bd<;>7AY-$qV#+LT4V}p^k zvM#95A>;#cBS5&j$DWcRcL3ta@#rakXgGvMX9ScFC`GzCI=Q0W8b{A{>JCF2c_-e; z8+1JtD~Ef>a72K~s0B=fblwClbTU~;KSCoWml;7~K5;c3UC>{3{%UCnyJ$2H1yPcG zD^Ws3Nr#~%JRaehEbgHqHV)O{mW-y%?3RRq2jU38C);8$>Gz{u(>Z^zZ@W2%Pz`F9UOqvI3I!X)8N5rY~x=4WX3sv2?E{O(ngy}{|bmI8f z^+%V5rN)^H1}oWwQF2KzdbDXcs)O*%eCHhzXQ;j@`VhtmJ)Hq*7EAc*v;Q zXz1_dUl?lLvkb?t*$YPJoroHRmz`P2V$lT_brI zMbTX*9RrZo)o1D926nd}T+fSsA=BXqiDR+A8m*rIG+g5#%|_4iK) z!3f>{B~}Y3ZNKYf;sxae_#q zK${J=^U;POiZi1Sffl0Cl+cRvZS+*aQO?kxoIV#A<_IRUCe?H~-F4U!KQ z0%IzWlNsSuHt-HnYS$iS&&Z|+Db@NMAs+4X6)$E{@Z~E(0gtxD4-t^4hu&``60Y_c zi^qC#u9?NnFwGR2Ms|v?BjP96Ts6_JNht{d(5#|9WzvlCw2@Dz&XcVVwkpOVNh<2c ztH^#KV)N$Iu{iSj9xxTId(A24_PL549Xllbvbc=~)98-KcFrT|mbq^Br9f!c*o71^?q+VXm|5TrEBn{0}mF_LueBm#Aj?1##LPFl_B zy2-C<4YM6pi*avO?)YNt!AKzj2*(`x;k9Kq!`Ids4Sk;ps*hY@Wu^~*R zr8@@l_?L%jcKTtJ=9V2G{tSV$%=#h}=cS3TF%pnEdG!NNzQ-m ziS#2nR-(ZG<_T}m8Aod_H70{#yi1O+l+MXodmwC{KpRj1wkeZdGN(gojf4?v z5mngW6@5laeEiA}=KQR2YGednHSBjlsC>BeFegx-2YeL;E?6?|oOMQacC1=F4cguU z;5@n~DUUOStW#axljD3iIhJ;{MH}+_cr6tUzA$@FeRn!lb5p#aKf9d)(i8|oLH~`H zQ`{GEX^v_K%KO-0=7Y>P;iIvBh=2oYYkb#kwi?xg=huM#_Y-e)!K9D`y;0e(w<_%y z_2#A7v;n+9q3&M5oH+w_d3U#QZP?{rZ*hsQ~r+KW9^l9 zE)Nn! z1}Ew-B4<0_vU@Z1a8WF%&AcW|wa{UxQKmqiT~EaoMYVMzY_rOgO2di*PRaV(TY}zL zzE>Hf4v<{B!Rj--0FE*W2DlAl<&^30yHv196=Bxc(^QGcWi-0}3P#S(rcrODF5#`N zJ=#i;JD+Mt!Cs@~?42F06pCwYL$%?8^^`=fgd_TgLl2;HSyO%)6$1F%u6H~+wO^q(2uN-9MlFwCWYJVX(iGQ5=L@~@b8=Ff zN%I%I(aAaGvdTuKm5o_r8&jmslBE-Kj*x$pr=E3Qd;6 zJkWFrsW)K)gNfDjg9{74V+ zEN2;TdYLlX_FPap6NMSMp=7jAx%&=jN}4qvS;S*aM|%54H&`xA)I4RB$6riVMw-*a zvUHoH-7GZ&n4(2$+Agp$we>Ri5Z|jO&(Rsx6=CIkIKIeaO>F??%fIdTV^dY9e@yEZ z32_{hN23lvd|7xE<(3~ga)7bRWx$mPtWDhjyUhNVi6m$5%jgfZrgP!gEINjK& zr>EdpQmt|&t>?Eazn7mSb_c=OKe^BZ{NAYN`=49*{sml@S^tgOa_`}qWz1RsEtgi- z-19%nc>d#l{rA&fPrk%GCFx9WJ6+5d(!v{b1GK=~PFI`t#f^>C$BV`EmrqkqKH07B zpk5L8q82;Dp*TExR;%ua^y1P|b21S7es>hGlfW>CL51^6OS`RIvKTEJc7>&UX=$l) zkcLr6fqplamT2V_P6qjIaK7|UCC^*xjeFseET~;-m-6r;4V93u(17I0CyR@6Ls@96 zgJ!gqV>mEdT%-(=w8{EJKP{s2>?sR%PnN8gb~;+%J)O5y&RbjD5kSrz32{{W$jui_ zin1wc#|cek)S#3NfLth5Es|NxQ^}N{(39B;%To2plJVWnLK@kphF>t%1j2-whRa@Z z3y&Hi>rQigzptZjU9sNMHuefto?Fe-0@be;Na8~Qi*{B+kqKz}>h!aDy+X(BOoLQW zl*?bS5qjfxZZi~zRkU{{j2~!Sf|@%YhFXPyQlXZ6K+a?zbV@ZIUbRWe$&zOEKld#8 zmwU~U|MoktJsb)*En|-SS6V3*UH>1D{$BpOi%Ysg_R!tlD!SV%EQ{jG=1OU^ zRI=RdrCO0CNh+nHGkuoXsUPfBpJ!94{noY^w?AuZF+ResJ^ferH^@m#ZS@farAL|d#j;giY=o86cUYJV#UHR)W!1^qMKiV(q z`<3j{u|FU=v%vh^GU-`S_LTF+v=1cjW6^x#h#Ixnw}LbcS?uaM(wkk zQBwJ+3xysm*J_95ov+HzE6r^Y-~E&RKoku$kDh@n1}R}BJ{$oly)!BTy_U_vvjH-j zYSxb$I~C4kCtXTRxd&~;jgHSUP((O6!6KF((S{?!j=*KJ*nLg-xh?Yeli~twORKuY z&oVN!XqK>-`mD7n;0J(^e4cLtwzJK-oD|$g#=94Y-F6|`VNl3k8CV#>OiKnV2QQfc(dJI`ri6r7b0G;WFtb`Y3 zLa@J0rJ&85sfE$GSR9?ih$gjg{u+h%_LOH3^u={1F!Ka-#J?B#?iV`)e_V{56%;;l;MfCA(N?3%6AXssKZ) z^!zbL=y)R!2HE5s zYt-v4oqT6=>2MUB!rGk7ki(^~h%GUQDFB{T57I&b`0NJ*?0b~fX6A*-@!EM|+L)Rb z1lE~(Q9e#j$&32Rfrx{rTo^}C9hj^Z7M^(Bvp}4CVc0p+4P{>#Fg>{A1C3YUaEQW6PZ#}a`i-+rGa zJDoUc1uBhs;qc%0$)B{$ELC0RVzZON+K6IQ7G@fU0QP(G;aZZN4OvLrvOBf zw<90BcRZSSER;A9$8BR%-h^hoPKJcQwNP~>-MGmZvr=lF4A98N z6UW~8t>+EcYFC;*p+_HWkAc6+bo6G^I(w57yPbjG4@7GMG<-WTz*4sxN(|dT7CCH` ztlht8QzU$gk-zfFVG24JkT0aaA&ROM{v;vJqR?I5xZN50BEj2JYC%UPTUan6js5UG zM=z9{7Jin&%YG1~tvMlwW~7?zj5}zy)845ce%Gizf6<~7uQ1V#{L{0s$n0cs*Lh_T zx1I&7|Ih;-GURlQa_(06M1Hk?fO(Ywnm}d0ogdZCMy$*rH~y@Y@{`;H#ILCGrk8#= zLJ2a@5#Nv9ur_yODXp0S`iB~NoLrji)UplgS0bZC~7ZNl914W=ArvYV78ql1f4 zhAag`b6}s*p=A^J8HQ7fpmusad9e8`_a+ep9p6A7a0Za`@H8urC~VSqev^>9%crt2 zz?uo58=Va|Dihj=#;rsNuty$isZGF>QQrbM=rv?2{$zsDN4tlBNTezQkjM;-E})c~ zruUyg5-9e%qm}CxG(1%80(89ea2g%b?skSJ^3Bl&Il&CbA11K{8AOqIMjFH6F&+duaE{`dl(dhBEq?b%eU?A3e$y+yt8$-m}mz6iYctn$jLM4iq{BiV%|le>-k`=rKlM+-^zBa&6f#p29d4Xicj7n6>M{Hxv_@ni`p)WzluG$(#9GV{RpXX_hC?6z+@i|;^%Go4^8fFHp?7P+ zA0J#N{@2QSaqZs!|6N>D`@a|5Ea;nYUA_NTSJv+1zud_+v;U8;7Uyf)b@l#VE3Dm* z|2w(n^?%>m?uk|AoV01U*IMltn#+gxRPD!hGF_?YGKlcwSONL(TkK~5mRi6o*#C_ z`_z*qdWlCnxV+SpqUb@cG<+qcenzF>5k ze)_~eKTSdIab)`yj=HmRDYIz!vsf%`Com!&)w3HMz3W>U!*- zK7DdLt4EFjDyB-gfKd^CjM#=>8jVA-6e0Jl^t3Mie&UJ$2XsgY-wfeJcUoCu=#9=% z?E&41uSfbIo&1h|Lq}uWSoXx^Tpb4N{MY|iAbNo~K~LW3Y*Zxm05Tm$JQj^P(QQ7?7Ch1tB1-A4Ir>W&kN6v=Do#-x+sE^MrFG!-i$vL#?7?nZe|If&$szwh_e85f6n{>zFlO_Ktl3ggzp#DDxUBAO{GAfM> zRRySmBD{Cr`LG{k74C;m%clVp==G4o164aLL!E)Vz(R83eA4R-pdJD4LjfdcDQb`Y z%NwtcsfS!z`y}YYu%~)aOU#M~1E?yj(*Z#yA`BGdg=l#G!0#fis2w@zHGn-B2cJab zaugbL(sa7@B=E(thY0LKt9sDzH$nG*MQzZ3LA(wEXdcxT`ex7}uH8W#%6DNhJ~y$E zlH99?^(nR#dUxdW*azrlPTWz>i?4P0K&JoY)E`iJ`lL2g8c6nk#mZH8MP`78Lfy$| z9AtC&Zv6iqPhd zGGGlo=pN`VfZ6Sw`-8JU^|ajY$n?D9j{lCS)~rVscOh|L!Ute4uQ{KIuis5P?k#{6 zO!DF|B3X1vJR>bO>c0r+cEA$TAP)oRHCb~eW0<`?!n3AuelKez`2e(-So4z1t7f>9 zAXqx?jBsaA_|TsbmQ>>btV|%sCNSFg_ysup*}+iMC@&m(UH`=I0vha|!GQ>TynhNU z?TknM@q`@eI5eB7?&cKf0CwztpfDpq^<6yhJrV=2-$Bg0Nu*O4L`0!P#Y0rEqO+af zO*(^dCyYuA;gugEOQtD?cm?&ZRW$UyPXUb3e@Qf;cSipW7*G&SpOA4>lgKf~p%86+ zU@4GhuX7BT-S33Z9^}0tItn`{$JU4;pZL9J?VRyM``>8t_L3%pDH775tOd_NdF1~_ zL$K*%a~7j6>-gkR&gZS6|N8&MbJjEidt67zB2v11NZua@o0xj>puX5VEblM2UX%~M zYW_B%K9D~My8+7%I{{+lzW|xRh=n#IBYXqXQV=rxG$o-YAxz641=CSTW5q+KA(x}m zkQ<`-cyncAv$z5c(Fm4jB0;!iDDVrVT9R@}xc<3i{8`t`_1`4?xz_*1;(h$*JGtid zKL#ZDsn`F-_4U~L|33cb-CT+5f0}2sF$eA<-Y@@u*5&{74!Pm#A9uce?`Cpm**H*Z-jVp1ANM_d(14>ZD6^?1v@2l@$`yS};cpN-T~tx@jG&_4=wYZZKr3?!25OKF=ECzJ zI9*=k&Gk7@Swsz0u9h`2-U7|S3LPMaKwLQjMGm1u50`o9Yf-iVdk~9+x~MnEYUeG; z(fmvTvORG68ctq(XO@a}wB4r-(I`Va$FW1h$b16S+e8M@Uba~RZ`(M&M$fhn29MD-N zE@Yy_bpRdb2t>gS@eL6@tfO;$vRPU_!3vp|$j;K)S}!Aa2xm=TIKX;d2ve)qlkuB+ z@ay;@X|4R$2l_el`a^adYcG?lM5(w;)(qxy!h~(ln6y%cv3z8-0%`9&z-U~C4dsx% zsa}6|OvOw>y+GzbgvhtvdVQEkyg5r_V=+KWu&A}&Gv!o~N`-O*F7+2bE&tD7@`x#NE&=KpEs ze*E9fHGBLgj8Y_tD-Tn3V)Jt<4Pz$vwyrjIV-P6Y)^*2p4BRe%&;af8#DAG%AFtWt zf8_n{4(9(tY1tkB%cau&_`i!QqFWhm`+iOKS9MJt|F`A*`N910zY-h&Ys;`)ydVE} zaLw`mJX5WcYHbUol|&EFJEjNdoyY^UcB{KnL&vr|?9+DVF8u0JG2~Tu2fgZ=USv<8 zdi-Aeb@9Kc?X$s5EW$G_fay?Gh4$A57db;Hj5zj|-~b2pb9{x~zs zpOaA^11QL+au0ZHd(Hfzbj!ISbn?}I-> z&2`ntu(mq(&h@AK3rHJ`E>seJ^t+vYD)p)I(@cB6{opOOvhNRUXU&m?fwTaSMg~0A z^p0i9wpkF{;$d%d37flEm7AtZj`_sHRLbCh+p5)>hf0nAFn7vr#{iU=^n3!m96;+n z$bd+M>|eskgkJw7C;Xn=*WG^jFejw?gnrBQ;`Tu>@ZJ>+6?NLr#&)aX?ZB#t9+qtA+;XdbLG);(2m+4HB>~h4XF{>is0R50D%tQRd_29>NQr z2Jp>!(4#kRAHL7I+2nxM8O5xeSP5i7YVG0jpol-nA)byLf}>d{#Zc4njBfdCmA3s$@iY zbPPMlho1L3qXJRWchsY|r8lF53^;FQV(E`BICgd48)R%KGAaLyPG8VH7eAqy-D|X6 zvWk%|s`IbC3z#7^0|oy2F#nJkE97{+DLzH>KMLN9W`a1$Jw&^pf!EKI-4u-2_Sios zP9!e?{qprIw_UP8_>xj3ncrVNgg=e%+Rav@dhq<=D_tXm_E08jA2q5E5i-4G=V0XY z3toP~FLC+bt{&{w=~ep6H2jOR(5$i~^1OcN*~Qw)a9VzN^J=A{{PecfC?7Oy*t996Z zQEvhm7|)vzF&K5!qnvy)1g?^?P_$oZy{JPAvlzAg;UVU?alKPNXkiU&m4oN47pm}# zL;O>_Dj~b-ECRt!yxMO%qmWU>-?U(q?{vvAk{Wcl6w(3|nd(WT88DGI80BCV>9H%5 z?vdBl%tNFj_2=JW}0ZK)2Y;S{mSmt%Ta_SS?6#escUQT{x~#DDuJLUGmPp! z2_+bQm;(uNHDxAFZb0MBYzd7Ya=iaLAE8lw zbaM_dbc9X^gwY-cut;Q1H+`%{+|bCWC4o8l$Sr4-EnonCHr+`e3@-W-6TMRM z+wmA>NfheQ(u@ed$;HQDm{Yw77Q8quE$Ho707+58}2t6D5M1i9&C9K}Y?sirAmUIUO; z;$zhSSYvh1U~NCT5Mh9aCr&*&B|?=Sc<;s$GeObJZTQQF?wbRs4v=s6HB5-x+Xa(n z01P*^mYvMm{pDiu70snf56$d&#mlFB%~pBmD_9SAhUgDF^YCFdH9b#anUO&7Pk}$k zynILk&g|lHSi{Se8^m7A3Um3zrzT`A5fHeSL}qecZ>x@<{j zKs9JVFNcTAP;J^JBW;6p<5U|=Mv|f6G51lz2tq2=fF-qdPSN=!8pXf$Fad=WI~`y_ zNb&&|&PC?q<6p1VoRTg-;E!<2&mVAGa5bT+3(rS%$lM+UCpy((n!-otIOLHB1Z~gb zxM+#>@>wTr!x|@J(qwjX23^?Hiylc|%}m{>?AO1pB&Da$q-tV_d1*nlq|Z?3BRM>y z=ctE(xuh;vk{ZT@Vgm{A_{p|OTbFNa5=aRa(5Oi_-}zk|!{9mHJCoRLke@Q0z4b%# zK0txJ9-b4MPm(R|$z=+ar9S;hsZ2trDLZ2on7GPK8@w!yRDoGkj#&4jq&-(Jc|F=82eiCQK(cxJN z0Z<()*VXI=UpguFdI<@Ed;^xJko}=zfYvr5qfW2-2+R-1A-kjQs^g73P4oFJpTHqR zGH!`Tnao>C(!6DDskkl*#m&{iW^v65Z+@#txpjZhO>aC_r(K_QLcdD~k*9d{&u9nG zyoL#-BY$2kq5pe8hNyp)Mj!XTR9F9Wo^QUNf1T{|PW~}gj^X1UTEZ*7@NzEkVG$4b zU681KnU;?57t#AY@%d0XJD=+VU+@}uVSz~1UKl5Vh{XsH6brzp%o&#dMrNkKYrMOX zTF@@R@oaiqMKVBC7~di~8ua86Iz(ck2;i?_DU37fumd3E>Nv!(-h|>4@fw#RX{NC> zyMq_bMeQ^e`&9P@RGCaqDp&GYI;X~_@xS!XydVv-yP$$*)1|li1sfd{{sCXd5WuBU zrKAcVxr-8FFkl6^Iffd5qX#I&8*6^S=5={j6`+T-xoeO--qUTX&I+4SWEuGV6nCqg>kBauPm*&QHBtKJ$#F(ED`$f#I?q() z1*^UGccXGfn>^XuS1#OWLA+$+%V1gMB+ z-dSNJoX870BF}ZhG+>m5Ysi07<^OQ>bNYW@Ev(+3|GkUL=zknsx8v~5xvt*-%cZq@ z|8IA4#rppi<36bC>ixe`D6QZ3|6N>({eMe-AJuh@{$IKG|8O_gwEib8T8bu zcVV>{JO8z^x_qzyyNm0|C%g5X)^~>$LHpE)N6%{29g$vKTKZ;rXK87-wJW}T(b}(x zB8cWq5Wu_RrKQRN?X#FpkKQhm1H@Ki=^X+pVov#UF{Ety-nf@WPm`v@NnGAbr;`mN zzfG|}>5qM&Nm>`62Ehxp+eu1Iey~Pfe>+XyB*Qb$8>cVfg$XG;k8Ubmx0OriGZ8In z$sN}sirR0sZB>pkO_jN@30vq8YXq|X_EBqZaRZ?!x0X-X$5HA@&wnHQ9z}~DcW}cP zU1UbDr6CZ$blADzY{Sx|3Rji(tkHv!OTQ=pIZ(`WM6B{P~n8qqL?{_`gfuI3h<0k{h48rB^2Ge#JyqsFo(i(E)CXB%2o{D*jBU=g% z+#&6Ng2bGxQ6qyVU(BfbU z?)wq$Q=L#qHK^enQ{z%iOqf(nP704HszwxZA(~l~Ru&cq`9g|{$taEOYQC7|Ggog# z=S|1&lb#yB8i1myt!GSaQTtP0>jDb-LQX`m;Q>1qJ3|A{rxF?#6@j3m8Pp~c^gVj) zY4^%(4Z`kxr5+kd0j9&$RhR&pjD+ZFxwD5!2tVv6w|b%-0#DFL<&t3G?Xf?g2*gVS z_nCYm*VYZT0~e)Ssw2L^NEUC=f3Jt?X&-I5RCfg@B5F3_@ECh$g06VSny6B$-t5~q z0k@hCuy`$HFlKvwK_}ykR4l9Z##-+B+9V$>fQgr1E`7OFf)(K_;1Oe$t@pIt>kM(U z;5kVQ5=J}ulGLDjz22-63RVfl!qR?clvD`0;}%0avf5P$lfdEMzKa4aE+GnHu4Wm_ zmV4Rb3(*LUy%98`>WwC0r|+MK-LnfC)UDwB^G*kMNVY=peBy_lFz9!1=-$|+EDfv_ z`o6Vy$f&5P8p@m-`|_ykt* z9$JWOr-wkBQ2JmYLCfOP4*^Cwms1*gxn-vm7mi2C93?cqVfAVm3_xblXm>GsQ9j~;ESuO(o)+uOTTol==)1l^xf<0 z?)7!|`Z{A+%GI!*Q1#}`ZD{E<)R;ET(q(O;xxUoCOz;#As(6lJ(Ih&sT=dRi5zYZw zVA(b5`kj7iI2jECRDN~FLLKhwU*N&bZV+v3Kzja(PjP1wSF^B!8?bUn$q*nFdne=;FBnMvR)<8QNvVjY zREzT>RfYAV6rXt^sSF=cmFSPp5(_;YOsF)Kap`oZSn2b_8m~?@j-@{iTvtj}MlU#5 z2l?P_VhNYhA*5b=-Y}%-K3!$7&jFkI-f5=~OI(m@`rNEzSnR$v0yLpwY3Pr9t;vvW z!5ZT+tCZ4-5s8cgimAqJLbAY^K(hC-^JR|{#$Zu~v4fEWu?G9wgihfkw38=qtIw`grm)DR13q~bDbpHEmKVh0*~(JxqTcctC1%8Zhp?SeCn7D)cqa^lu1|V(3&C`PFBBQFJ#NYz=`0n}^MJF+ z0i!-?!ZLV7&gg&j8Sw4P66ov_q9aT(_2#IaIdLBJ{1g1^QL~2Z5if^vFXidZ9EQx3 z_@=O6OF$%{*YBq&)?BEDjH(@n4nyB@h|sY_QOHi@$d#Va5xgX+N^x(2GCYn{A+V&SEzd<{>c`J!B_VOgp25mdi{6%^6=s2BCxZUtUG zt3cJt&uSGe3tF{PD_8e(Vz<0seqNzmb%4@HVKT0s_~u0gUtxJ=_AJqh$CYW5m&bD5CO}mnL7p)Lkdz}$abMJ zK|dAqw(%fg(J&uO0VzP;EDJ_E4M3<4SQm|cWmr2X`kle)1RJSHiXynPuMJi(Ap{C6 z?}h$Iy0B5joWo)Qs-B9x`?E*w{)IGNG@E%o9QmXn7HA>}mEBP$iC7RT@w5VoOr11c zr=Flm*Haa=>B$m3riLSL$Q?t(idKPA4;!^bR*hWbUAy@_JdkbBP zvFocy)s7m{*I3y2EL2)75Wl_A0M^RfC?7jcwsj<2G6=; z&+I{>8(<+)Tgn}K`@yzS43P& zV!f*_;U2+YOi`aC@l!+2#6*Uy$<%eW9Hos5jF=@ZG(sL@<}l_#Vo=&61rHLQ-tfCM zvC`;c=OkgOGf*Ci(Wj~x!h}!pU*x6|XRyJsNu`{ledSj*Wy~>Zc&qs}7^salIW%#) zl^aAd3lf*|PC^#nv{`n6G=*C=oCBtuu^_Wfdgjd~;7cj#t*OIdD$qqHQ8 zZW2s3nt{u}X;J&#>x_7&&|Hh^i#v_D=QBb3#4$#a=@S_-MhOL5DaJ>X@eHdrCZld? z%}N%ieO9tW6NA_ig+=O!U^F7HN3?Uo zA^@{?2^up43O(F!gE?ZtMz$G3@L+O&3}lv*?p@%=aS&i=zQ~G}JnzVQ@P_IDxPqLN z`lyvvsn`Wfrw<}qsE80+C?TS?D9Ud*8NEI82(euMo~IhuG?0^9C%hZy zy@9&Jz*RmO$t84{q76(z9-W}kVQARY_xk!AryRN1%=SPXZHbw+v&IHVAd@vzFQy%P zLpKeQK~2?A(4$ZqwI>z)|7Y(z;F?&rhoe_iq9`ghY)eET2!T))M5KcvARr=$AtV6; zfy5Mw2rAe+BKGdJEB3C~t_6GV;>Cj3f&wavpnfy6yU8X5y@ls}@B6zyCCTp0nKNfj zo7p*Mcp|Y(P)E~!1&RGo{l1pqncdPNO7O{ke9@(!g~_pXL~g#i|Pn zPcpZlG6^8TmK08BDd#rmMVFEVmEI;U+enzWXzaN%B#Ejy(O=i<)+{?#A4b1qE|A<< zB_L9ZLOQ6Dr4m^aQRoZ6Jq__WT-QPG)ClJX7f=9ATVyRx}pGl+I z1W`$QH<;fGl%|LsDva9=RVS+BNV?|7eiD)@A zDJF*o|BWv@P-e$kS02!=7Bzbd=TK0l>4XRYgASe{SwMRs_{vB$4TO;~rR*0$vy(c# zhd;vwcqchvzE;QB6Amz((3vI((!OVjAd!*0AYFmB)&Q*olsTx2l)6^qKwu&J9u_hJ z3-SntI*N*5a|FT!i>Q0ws^vzAwra_doY|?1 zunawhGYBx<0e>JCwcSyQ=L;siD7`gZo7RO8an+>UzX3HU9*;*L#^|TaFo#5kK@Y~9 zF{)=lrxSS&(=oQSImWgD|832&3_5-eg=sLw3P(iHxr$W$6e-BnLL&dC5G4S`OaYd7 z_D_7Yz(f(~a&TLbY7TQGCNoiHJi=xulHgPaJ!M8lnk#=JCC_BSbh0QdD?$gMWlg6C zD}50-8IlULQJLsEzIa9mDk*Vb&~fh6q7VKG6^S%`=zKC>A|GV{q*L+;G9n{cEb3H_ z#fpevV6aoj+lACq&aUZNQVe1m*S9MYswy&)L<~4INfgY`Pn64&6lMm#c*j9c;8pdj{xBY(XZo?u{&BfnzOA#JEKO&LmOR>(`jqWG8GIC6u-Q>ao^3*<)vGe z7ZeqIxLZ&?YRk=ymkiq0q6}$ND%n{Mvs*NJZ+QapT5~9ZT!ht(&*^Y5%c2K6BNYHBYau z8K~c=)fA5$pIy->r_P?OZ&TrrbpMZ+FLMj|hBLfYUlHBj)*w4=$l^6YLWN@YrcIj` zFJ3%B#%S$TPR#;pr$cIr3k)2Gki4I$?35@sK6yftLZgG-m}*g55u_i_pgje2)pRq~*L9W4u+;q?pc z=&|f3!NI``{bEv5KIC-wwntr<_9!C6YzT+bjYcafD*E(NAP_`v?`>{A{aBQK(?$cc zZ^Z4ob7wav<9$Tzy4%yk!WNu<{ow7jtH=B6uXVc}(I9BUyR&({I=7hAAB(c;V3v0v z^Yf@Jq3LD6yXFn>Tz%zDg=eaIekr$wS6^Fz)P(y>xeX!gIMJji%q|>C>maYp%}d z?hO0TzR|I?w(N z`tBe3c%lbmp{+0|JbY2;rU$zdh6V*)-6g#C&bs=;8Mo2h<1?H$COTr!uG zZyDTqB9McGTlqbVjr;4%U*5C`2)G1B!OP35=x}<<)n9#6Yc}QUPCD`a-8(RTJ$m%; z^zv%aqQ$86^xzF4x66NdF%~<+x6aPWGBh+iaPZ*!j1&2hDWbv*8m)0-gGnu2K31Ib zXk+QQrg4A$>o;yZef)U!IlBpNgCipDUAxw%b?erxS~Z~cA2etX;F-|Sc{_K$y|UW7 zWAjt1Jf}_ec=WmY1CT9W<2i0C!*<8#EtPfFW#rtyl`_k3?H+dL#@Q9G?i}ej-%S2# z?97=n+nD$R44;2F%imE^Q8961`* zcMy-@^Np8Z+M7_oSbL~ue<>J;{t27bZ}5#9-KC4p$Eqp;pKsNn`IgXTG};6=-+=>z zO%3`MZ8EZHnk5tp<9B}oj3jr=czJWnzMSsU(_nAkqt z)p-=3VJbJEWkt#5yMi|Kl|J!FPj{lxTD59r-VW4_h%VpMarMrfvY42d$jHdx;5Iov z3(m+ z8S|DeKayM;ZfUtyr&+tQsv1samEh^wyaO#PtgIv_r?v&Ejz%j>J+x?%Azo-y)PmPH1ytI5;qpX!hBR2T0opy(7;$mjID^L7FP=S% zPY=isTygo!AAx3r8VLj@&0PbB4IAd^IpOu2&BJzR$+Z|Em`Gqz!-1VoOjNfgTeAK4*`t|Em2M;UUnxC|F)63T{bB(4O=e;m!>p5-4 zQmcf}{%#GI`t4bpcW+<$tu`iI?=GnV1}6PO&y1S#=GoIiZ;pNO;>FpsXRlumaa=kg zGBV@Y#id7&_V1ZH}O1 zBMRmYKXf}R?BlK-J1!iEzWva0D?n#(dGv?Z0~oD3wSTsJVaM(K!cGMR`DcF7ZT{vW)}Ly>WkZ9`EuPg>y#>RcYZB0yM$1|O^f-Ir`Hvq{mjdllSXekxp@`fa-?qi1 z1d(X^RT+)w}o^8DJmOG}-Grs!m?$jWLMnGOWzc+Af7)X`w%{rxYF z*KJdjS)DjuZ~O54ei@(23o?dWxZq}7Vc)v5-{(J8@7uh&uw-a2fpy;2HzRU;?YgS$Sv3yd@M#CxNIs2{eR^HmeaXHC% z-L<)~kMSI!gOU}BHEY-UFS6Bb7oL4l_WARJ-b=Pzyx4Q2VdXi? zBOYD#$Mv5)b!uz+guUX2p_^{l8kVkGo>@^|UU=rrWxH|~i*@D7mH6F`ELPI}eIrZU z+e~Xa=F8jnE&J_@$xJD1Ax~-f`Q5cQOP4+x-{?SYZt>Cae#yrlZ+8$g9!z4FtXpoq zYE@iM@vv*UFHf)V_xI;p_vzJZnvZd~;hDqfrEdz-bIz5z_pwaOKDMHyBUVG$5Q$%#uscYutSUS5IWZ}9pUJC;z}qcn7xLS)h6kD&0QF^KbMM8Q z`D=b%vSDNV-UQanCEj7?O%rzke)$T$FmE7n?1)v%{xxc9x_v`{KmuUaJS28hpAig4ek5lVFitQ4tS+sJJ94JE_(+$k8$(}h+t%t{qut@vZ!hUB&j^j*Jh7uq&AJ zG5y1XX@+`NCv5og<;#v8*5iAmUvFD>!C`MR`U~%Bi|)mbACIa|4jnbBw_95K_HN0^ zpT>N3xcB>~lhXo@)KoZ(A9seoW9n2oYyLEk+dCF+TXTQkl^vNGIjdi7jf~XYo3y2? zknY$TYueNJ^2z8m$5M+cOWT9)E!gVy^}~pvqb$Gi8YHgVOj0jzUvUA5kkrmja1DCW1yUj&r!y1je%u3Xt5^lC#LV34m| z8MjTCjm5n!=@l8-IzoE6UCae~*x^xgZp?aIe%pOgQ1e&1It`zHdhh8ob?&4|-XS5^ zcgB|4bZusE^x4~hCB2RGo6c_9zMcJ-ifMMeOybIyf9-SclpeR;IR`tt>%T{jWIMQY z8$5sBoH;wo;yR0~V>~WBE47e$|yn?#)T<1eEOgrRTOeF990sRQs3P zp6xZ;Y-}OF;Qh@AAOC};MUj1M`JYQ#nO%N9cd*_7*3dWi(>fJC2JUO@rDb+DQrC?% zvG|QcQR*+Dex`F*2|RhtNAlza zJKI}I-pAW)KCIt3n=NB>&S?m)sFNEv-p#pZac|s_&s&b4I^45`cVO7(E^ z2F0dF8DP1Ez*YSG`7`&I1DS_U&P!e4KXT+Wi)n+yEp{mq*sWhib!yXMHEm5$$IhMo zRv)w6uy}iGi9siOgYwkSMO{n50IX!*FTGc$I|*CAfB!J!)*T;a4W=#h8v)$GO}(bO z9v+^bym{n0-|=pDj!#IN*TNTQ*33gCN4{)ozOv@ck(7bP1H!hiTD1!3=*KVrIRDF{ z#S?-yJbuPGCE1^06T=@G%1B&0#Owm+OVEL|w{4$fo307EcDw0LkCs_0=FgvBm^WJ9 zBL3E`l38*W{)Xq9H+yhbG#r>-9Toj(gGI#Jj4x?fg*#t3Vol9@rGF_j zxwS>&8_0S1xnyx>iQxW&2i4WpGq$c?O&cEyytc;$)vRG3(r@KERSpJT4Pb!kH*Y?F ze7ySn`KC)FF9V%u)j>ZC%Nua6_}#pD6%}t^Cd4~#X?A3dPQNN((zxTg_kBp{lAS&EnCrRe2QKvNmid8+VMm|H&ki@)d?Vh@P_Olo5hp&c{oIUU z5WakL2c5Xx;fEvI*i1gTK5wlHV^2s=89i`A2#xl;q^!$sx0U1as>V#WD0EmyW900U zKMyhgL(m;-y6-^i^&uuhhi2UfHTRig*?P*wWzM~FIwa348Q{=$*7DvX8FM=P zUS25~2S)$K(hhk8hNM^C@8WB2Hg#T3s}{7e{V`|hZ|~OT&7c4F#f{vcAU9rgTz~duDllz6QEY5t(rLJNY}fwS?Gp{mbDx*r7%HOC z8f6*T&?iq>`TRG-PC7l?ZcBT6{lUR!2M>I?cFe7L<6i@P%FEw5{>5J9_*O+~-u*(~8 z_7cailT!ok0-u>;)4T!tjb=DqA7i2O@#DT%_xl9IZnL+-9_}eMoKd-D-LoXl!^12V z$J?_@zsy5kw^p=idfT#K!HnKj7q?kkFKj;PM8{drxdyWrFRm^#s_B>BpVl!n#(eg& zuK7+M*WYmK*fDm@$Kry_#=p4sch8Qxwzk*9F<;Ma6qTH(jsLPd$9Q=mzr_cu{3e+$ zM{iGA%kJ4_`*hcy{-XsYp+jzjhF0GH)h{V&>FY_;nvL^tyS|s*!62+7BPZ_a=5{4I zA!aw8*k?6p)vD}tyHgFHKDG2<=+I~_yG~CX9_X^cBWd`IC%s?z95o&5wsOIJFRPD8D%n zv&>U8TGY;tW18yh+ozxWYQcVCn`vG)k%H=KLC8j()i3(Uehz8)t-ZhRNUDIp6 z#BJp}%Q4I@LcNY@t^4bT?YE|n>#$(q!j6W9@fEB?4JUi7I&x&pz-EUUjF4F6U1;Ia zqs;|(MzME%>=}M^(46NxyjCCH;hR>u`Qh|Pmx?|Yrg!|}bGO@D%<#$hNt1w0-*Cg~ zw10p7n%}b>5~t7Zc>TrD{UwjwItVvZyuH-s{(V2EZP)H?9kk$g`yh5Vm(2SYmzMOM zuJ`Oj%ZIxjIM}W7@6BL5`t<%~->%|cNBwGIVPS6kTlTpLA3hgGSBV}>^@-@wqwj;g z)560)z2j6>y*@ZWRBq+nZ_FybC9XR=<)4}JkH0|qub8O>(oEb;64 zBIIM~-n{C{A$rZv%s5gkdE#@ntr%w~~?03HFuP?9pcp~!P>$22)GuqNKm{E4)x=x};&Ztgn2h1PSLe~Orr+P8ACxFnXp z#ICJTTdC79=Z42-e@RI!J-1&L5F2Z0{o1TaleV1EgTa)`Zbr$f^l97QYy7jExnV=Uz_o8zl=2}@yw@Bqx2hf?|xy%Memb> zj*VQKwJ$O1b2O$)hvvQ0?VZ_dE34UVSQPLfPfUuOZzETqe^fKmWI9mpp+nJ5jnk_R`wk+rPY@=dO2eN=v0*YL-v$a{OyCroZjkMT;)| z?Cr8W7_LP-!#C5+@(yrMG&WuqEI+@XczN#5Gp`>`@L0$@eKqD%3l9c!{<&FQox>v{ zrdjb5%;pwazFx$ws#x!wK4BZZf zUUbX4|T3)GG6EgGR@`ew;Nv^5ATi?aWpM zpQe7kb>yP!g6i-smA5!!^qMtu2Oeyv*yB1nI*kBrK$5>28rj&i;Tjk zOP@XR>eRV~?Dzf^)o%iJuisw!#~&*KO}BNs)N$q@yQoj^o(C-J>snMi7TcHkdG4m6 zLuW2?NDWyLxP-;Yj6F9`IFI$Ax~gi}-0HD2=uPSLMb7D!yAy6XI$8AQI*rLJ%Wl$X znEAm>%dUOc>|NC#91gt?U0>>IbnK>oZzCfkQ`0~0?oMcDCvbJWe)jC1BsCphz+ zv8JMjT_c9)$q>Hgs>17{cB3|s&3@Vz}FA8*yua}Mo0 zja6K{?DWhvJ&hZMLzCs0@yWK`w8))}Gc&FmSANWzm}WqKe=PgM*H5=9#x*#-M4?dh z82u&f_@2aT7K-EzSK=-%cX?P;RFL$*(b&7=phu}Xf9N-zSnzpIMOkr^%6FrlzncDV zm+%GfD>@hYU1<);`sn1e;jEPRFK!eR-24!0+H35kXD*}OnOa!rO_>$R8#QWTi*A{c zCug#kEi>xX)f+f$Z%Zx&?-ea9dCYqnzA|V--;~$G-P{^3_21j0r)jShTeg&fd0m4B z4bIK8aF_m8WK5rMVEy{%PYUl|y&4*JdP%!+r+K$Urxw}eT3a(j97gBDn&XVi;;aJ) z4gdjh?%TI0?OB(BO-?p`S25E{%V!N38^3$c{{4G5ZakcyUtO5nwd>X+t9g=NpWAkwRsL4SvodXC zGIQ3<%9%5k>UVuTrEFgp(E&#%r`4-|ztAejCVc6(5VIcoO?_(o!X^z^(`w3-!-s9WMXbmJ9;>f}ZXGeB=5`}Bomb#h3$-7mT8kVXxUZHd_X>C-3s#Jl68W1U*Jcs*Vr z?$+I`6@5b6wr$_Pe{XAO0ou2+y4<3bOd=Z|5pk|q^61f{SGnPD?;lRzyJ=Ix^Q&uG zwQ7|-ZF+XX(P`~1GpkGY-n2GXmUrUwX;T9_FrJfQVtezV zyI#I_?d=~|R-Za`>chh^%RLMqJQ(m`_QZ2f?QLy$?cF=3ru=ke$bL4@t%0Mh;e|50 z>lZIxGznPNs8OSj)z$a*t+ibOrbTz}hWG8-&Ct-WV@K#CJUDI{VOkH|Anj8 z`~P}8_mjN-&iQ}f@z3+$e!!)5{PE2nd_he8wDIlzAK(YO*7>jYwm;8*`yrQ~uUn97 z&@f_~9A6}&dw2%B2l)n~{7-l`5eA(&YZ>kWqkD!01_Xr!(?tp{+=0wNHGl4{`X9Z% zA^*JkYU4ZmzwF>)pBnOSWA}6a*AKZY&FE%kSlzjo;8V1bli&%pG-h?~;e@q<1p-W! zK++#i7${6qONvG}v!v6z6UhTH264c99D{lj23dhSYBxl}XpMVZMJjO<)I~Ag0t_bO z3+9Bte0u(_gFG>E54ZYrcUN~GPqftHeV8x` z-+T>Pgh5iEIE;9K2|&~7x&TQIq9A7G=S0uIw;FTc7I!C59_}bs)1R0rwE`2C!AHhh zAjgQYAmcfe!RRsQFdG>60m1VUFo{@(=ct8rg)Itsl!h_0Sb-czUcEJlFSVEqbB3Wl zsvAsD+>e7c7c20YG7{Gx4;LGIHaZMHr`6yQ>hp0#G9w=*$QGNqJ z=7=Oh{6j95AOgUk0#heUi1l@b_rSMaz0d<)S&C53i^G9J?gq3$FqrsbT@?HV;~ql% zhYWJ_401%-c}POwA%I|#MdBeBleb7PPN+gO7~BLWb%1UG0e+sY{^}6P*gh&q<-PC2 z3=V<9?ug^A3wONBQT{eS8hpr{37E=AHyk7mQ6?M(_y`jTl49j?L{U%>{MIN)Vk;uS zAZ*E~IlO)?EHl(m9TMyrjYg`QbrDIUd4FF&)G|uf4$^atchBCKJgwzMcHjx?zXm32G2|kBo73Asd z3mAKtufK<97}E)}1b6~4IK7DMJODQ(e2R90O=|;dVU5ETv!Fy)ENc@GYNC1IS{Z_T_SSVS(D^s7tkLd zRWL4-5t)c5Hz9aQNlLC5N)MZDi2@ZpW2~ zLoh^-t*92Qb`UVk`mH=^QDxmwXgk%unPEbHDyb(>20|5IPyuO59bcQ3uiFgrQxV^4 zNF&K<$mpwE0#E^v7}kx3suH&WP;?-h6B-c|>eUMoP#Bv8V-9f#jSS%=!>7qEFqNXE zsWM2b!Ni`hm*~#2avt7QB_F zrj{Fk@McqxRqBd>fdp8!&Z6=NOE`WIJ)%V%M37oK0~j#Ao^kX8kcYN-1&2zjWkNq1G* zBZ7$FhKw+;xR4S9E*DUx-1@sxu9+J~J&s*nXo<8$T4gtwsWFWj1RZqBZ>FY$6O8v+ zAwe|7b%!b5V*-0sLxX@HkGlR>xHgc;5j3tX|-n$s1gU)^0jA2f6^^U5~Pq8N9!%6 z0a8tw)tHtFp26WH0%9|$lPb063CYT5>Xyz1Z%Ek$3x@&gJ0V2QF`f?OmrQAHFqEGE=kG=z9W|Q_K8OyIA7`PLZElghdksVpTCt%*SPgSWHC30y><076F}jIOj@d;F-M4 zsiT%*j-Dtv-CV;Y;m>hO!@ux%hLbu56eUeg{QRJf`L?FOCxVm_$)L(LwPREzfI#8s z5Jix$qfwQsQC*wih~=q?HBW7#N}*7l_Jdw0Xyi+%LD!sn{Y8LsZHh<(W3|Q0ztM(j zfx1p>I!vrEK_{ufg%&&o7I1xG#vgUQM;U!;E!k>8Mw={YdL5t^2OiJ;Cp``ZM|n(6 z-5pWAXE1eV;-^%ppHTHJoVB+~c@0{3yLG=e`G%VUF6~VcZ&|<79G=Yh8y%vo!@-m6 z$h1*NH+}EL1EGxkh)h$;d}Ue{5&}R`M=+zIxyqHPOVuEqQio>rV`@?Bl%*u9UJz+T zvX*kucnf5X5m_dYmQlCGxYbbdXKlOuZ@;ap|4ZxpUsdkgdTHZ3`#-GNwrtJ(A6C{s z&;R}*mqk5ZbPEe2?Up0qOu%F7V7@~5$_cR)9WO=E*F2=JZ7sAYZCDb$dsguydi`wo z-Ph0c+AAWnmPRf_XN=4nrTze@Y5a^*l%)@gQh#c~!eH;BL4VT7V?5RJ^)Z;R*GMhF zRx}9+mx|R_RJ3Ce5y8PVtO@`JPqhaSuk#UbZ__g(BbjtMm^&*(%JgFN`X#8!qQmKV zE!(Y?7Z`M^MTYgXa~LQ`ZdSs}K%zl=S_2&^L_N0gz5SmKHk#-E**aL;|Fr)<;_8lDSaQ^neYL^uE8E)A z$`)hWJ6f?F+1AkP@VHVzQk>Gt(nE;!iu6!td{#nt5AgT$^>)TsmiTERaH|u(Ma$R} ze+JVs2Dt}2W0Z}C^Z>U3YInqRI{aa5>gVeQopvVX2mruRKurl!;aMKoAXoQ*;4okn z0{sGp!6R3Jk00di8RE=fTd`~yPOwE_P{3a=KUeQy_zghg1Rw*##4OM|9%>V01LW~7 zj&$9`1iny;Sx8{rA+8)y)WbIjpum&VuB={wuYSh~6D465F_?u6qgD!G$;7oy=g-v4R$Q~rOY|L{;;Jd| zz>CFdwV+l+3&>jVG=P0a`uPG;?KbgV5uJyNAjDUoHnnJkTJn#NTfOqwcjTXKW3M^? zx3#tV8UOJ^uI?E1WGdxpMnZv%-W@Gx5{FW$UgN0_JTgr|6J4#PQiSBe@G|_sEGB@5 zve=WSZUJs~he@;PDj{*kEEO`TC7MZD0$A`cCwQs`fr{3ai8IswV#~^gHCsiwuQl2w zR2rr0sH(5OyINJE7_4l^rh~cx!5Cj40h1swbE2z!4`<*7;0Ne+N5|0#lN71+?rP7Y z6-j(BZ?ym)Xswfv@zavHi9#MnBo-$qBzVn1Tpnm5j7}${-x+r(SjM5Sb$q`Nby$VT zU{r^?2Ei5rtTBtBaO;jmOrWnj_zr)@#zO5b7g!LpPm7^Eu1s#h6$xYEk3=ELNpB&M zisfSbTo8+)Ndho4v+O0#M{DTZ^F*u@L4Hw}6Mn#Q}Fmz~?5( zg*-Z-Bd`S)zPN@1znFAf--G^`LUf^4gN49-K=D`}4|WfkEnHbq7loj~vV%vfTiL>+ z)oVMg|F*#WmtA$}|9bTPzOVnSY-`2;S=+LI>i-{c{g>%~p5t(+K3VMH0Mvh4?Nb_4 zaQ}p^SCuD95p{?cQDjG`1p!@%uh13KW)zf)8^&IKPi2T%aadEEWSbg74=8T2TobzT^j3I7cZTMXBy`fEIL)0)ODaOPDcnH;OJ0$pl*K z+OhvcZHPFEeh`c0wV%UUQ3OSd$zpJe8iPS03EpvJHPAU@%90G_L-#mtQY@qkPA~WX zMlo6laVlECpx4o=ImBosh|vs^#3U$x;8eqX^Cs{BWfQd56n!PBY{DQ(qQVQlVT=)j zS%f(T#2oGsB+q|_PfZ~Vi9$}ET#G^T$Ydbe{M&r_^ZGGYE&VSC^Ep}lW`Ow{`Cn|| z{*RyeU;gt~9pjH5SXWOwfWEi>Zwtm;WB-pW+v=zN{}GpRi;Z%?smuT0*kV)bV7&k2 z`GRm)L4BPssCJehj*KZIV4xA>&%H4F|Lppv{NwvS{;?ML?)s0lwTApV*jxSd|9{A( zF8`_lM_S;!XZ6+A0@{wp{CQaAfA?XP|L2w9|KY0+{SW`v>;CV${eQNNgPo@S2j73L z|NoGyyAkCLCR_=^SF7u3yD8esjFKr3hoR$JW8u1kJWeW3fl;z}77bwxJh2_EqoAW` zS@nc~D#r#=oYt7BAXOsZ$pw63pRPHUD2rvHs1&$b0)F7jJG#2?t21U|Lf1v>D&!6D zm&Gy}o&@g$r<2^NODbk!^RF|eYzME&Vlh(SiRAL?|SmKr>Au0K`!aDsI)_T~r6spFzg-BCkRH5$=cp9E3?cu@t^!p#o;$ZOWA^ znsAS|Dzco??B9)`gFHbEy+)V;bZ}Xa2&9QZIokivMd7?C#}UHML`F$Gr-`PlE;M7f zfPu|1B3B1BmK&u(NY7wuP+5?Q_IvXX;?$PmFtYHxVL~vRVD6>#)soO~5oPe%8nGuH zzXytg=Mkzh5klaS=~9SE@&JPvNxU422&c`GSK+A-DB7meYO3X* zau6BOBCaV^C*LVTErClLr2ujuO?(7E1hAoEsfcf6f(Np=lN^PUUP$Ucx=_qQ`$J3_ zK$+21u@fA)3P6EO3|T5evvpXQ;fdrWB@X7rQMEvt8B?l?<)o5&QwbAwr`u*cQySBSz{2 z4nOqBDdd27uo+rlDql3f_X@%!u85MBf?`r2SU8ywCkc#j2*|K!0kZGlfD3grgR6D08AYs}oC{P>b+5g0-pt4`9=&^KJ?Yq7_3W z`PBv`It^3Ea7{v`qQ=O?u!#(3cpN>GOtXY+3s($e2ZMx*vHo^3YoeIVw~N`}#mIF| zx^99Xjg7pV7{IMD*5JPlaBj@e18e*NxIsPy4>BkWlz_sfV$`?@Esg4uwjq%#k7KBQ zih-Tbh4)xeU<1U7GN4sV#WI#$m?(fog5W>UHcEpdNCSgGDQ;@5ECOvg^@)vIJX=gH z-c^RO!LG9aSO6RhE%a%H(2GR|h2&Q74DT5ouExT(SZ=I~OVGAVVlZvv$(L+Ljn zHz9#Zrr2ZwzXWsxlo*O!?e1)~G+Qd)Uzw6K76=?k0Z2n50VrsV(V~$2GA|VnuV5ZP_(h8W6(m*cS^GV4Cr%H09wB|Cc z214udKidv^`^54eTKLoGCg6AcDQFSZX0ceH206V#y#kM@emqn86g-GvN5V%v`0979 zwcfSSde>I#T|0CarmU>>q5+^&`$YrM4UUowDycRFJtszi9Z7t#CcoH_Uu+|p%8sk1 zILO^5b2cL2FfqdSH8ar&z)RZ;7KAeL*_G`jo8!0xE>X@ku@ImjWHADyn#lQ8o!)^; z399KdFvKLMfw2XuLCliL`C^3}gG5yRQW6m9bY(|k*s2HCY7eYc;|1$vI>QoxFu`zV z2Mlf@W-_3=szx9Y_(GUeR6yqIkujL$il`S?B!~Imq|m97VlWl047z7P3Zy^>Cxb5| zfea=p_}oMccoRSx#8Tu}DcP7q^i9d=u`)$87)=sw6)FJL9v*N~%24l!voi?M2r+ZBPHhqsu**)98Pu6Q3?#LL&=L%Bqg8~dScX+xbp?k zidZ=JgZVOmgJu$A!el|)2*g2+57fsW0aRlY>+cn)#X%aVVBf?=MNgcZh%MYv&JPr& zFUL~E(gc)`hguSF5H!~eFVX{uQik!vdUzgJH1~%2pAeUkC83N_*$SW4F|{n;Gk9VV zjGd0+j27T7FM^Dw#1xQr-vbG0W>+`O)EEhm zxz{=gqV^jOp~h<=rn;7|EBahx35SUB=ZO^}KEeyn=~6p0fOafYFOy7>iv%DN_K%8C zUAVB2bLC9d(T0u;X8t8-IdvdGym_L$_=2cV03&1&nMGn`kL#M6P+sfQv1Ss?Ql+X0 z1_&cn7ZHKBN~egEOz?pG{&#eRhd)K$*UzSooZG3P47u!xV|BIcy_0RLae#kXQ$dig?;utyRAxIX8fHX^i z7pLG0(Tkh}8SttEm>0|pgL&aAG@;Os0aF}%mK9J1-7y$)hR)XU2*C3jc=(230YR9D zr=MqtCl=!48;lJN2pSk1=<4o?dHMQz8tKtN#rnMeQo=py7*1!zINbedV0DZ9p>qb7Q_mZ$XG-4zJMoAl1s%R{4t^S z;8zw4{}d$gwU^Jx$WUv?mTZT3@E@RuH(I!N)ZRT!d~E*n`25?v{`0DR)vfQOGBL1qHi1OL_QrfTph( zhB06YE^j8jzEn3+@t&Y2-CTn`u^}=6XONdW1y$v3L^F<`GJS(akpP8UqL6bugivfFkqNvl2{~;6=RlzLNLprHkhS%7|aQQS$Y7T^Yyo}W}vVB z9-eMPyz%cGaNi?fXfW|>kefUCbx3fKho2w*15c7p%3ONa0A>`wC`O!SG0Qkz25I>akMM?XB;fVt##?jZNw>^nEfi>bK zRONpJe>~+NWO%r#p0cO{{U)eC;A;xUy2S=+7*dDhrXd*GcCLtUoI=EKQW+dDB*@*< z8K`I9B%q(5dS`+vz-Y=*F^+p8U*^o?V=6p!M+qg6H}J_TaQv+-5D&A!ed;P;cgz!* zd~J;ao8aje?D;3`0%_R)wpC!)Z52q^-?j1?R6@ia$|ByQScK$5L>9S_(3~D-a+}g)8Al z!@GJ!i7PzaJVh%DA{@DEoZ!(jqk{Hp~_#KvPNtsAxSw;=*(l>Ehi2f%RUTh%&h z!&`_{wJ7H!;PL@wzDv0{Kp=@z9H3lWqLVO5^v~!NR~Mb?Ml?tu`;&t#2fxj{S zwzfaz|A$=P9DklTNd`PxR-8Oh^bgwj&i)U3D{Ia3KO7t!exCpLL$1C?9s%y?Z5kY8 zEO3aMpRYT{u&@MEcy~)nj}Q+m%qL`!AKdtb1B=cnNM;k@UF zDH6GuYoISC6T){)G8E7arfOi6#Bh5p@ET>{3txZ%Zp8$NFwnKHB@PB{!RU+50g(zs z&J3A64M2z!2;>YbPAZ6TrlO3qKJgY0VGr1z#goYxCDig?^hlF@p^oCIWAA8pV-$a%51L7_O zSt}@3usAJCmwvWMpS&6>Aq@~{o0_zOMIO^+nodnJVJ2yLDxV_qLDlbL5fOFm{t)p2 zDxZFWfQa(Y1;n4CqKG2GioBGEJQftbbMBqVOdc)82k!1K;YX91x%b?2&pr3td;W9o zy(S~Awy9chPXeNPlbf$+c=y0G%+7+_CxVF7yL5>`Fb&I(x;G9z$Fw37+lq>%$%5g1 z9)|S-k05Iy$Op(uV^#ENcvQ&1G}R7d<>dA=1mJgFVu$Op)>|DwufTfVtwCsgSdV@l1+ijW$Um8BJ?59FH`A#^`m&wE%} zHfUr{1nY1K{DweRJ9Ge*QYB4JgC;gHt;pt2=UG=M$Q8PH0c8YnYT8Vm;3_ zq!r!9OXB`(7gUl86GB{&YauxY#zG-%#ow(Lk(YOIeo3i8 z30^79%xb7m8quapW09h)mps0Z;h{D+EOCa$7*e^yeRvuuvMaY3rN=P>qcj%-)sYkv zYhbK+s4P5TB?e6~R}YuC)r((ZJ$QP!o72k%*MtF$Md9^|CL_5vn2Z5ZstAmDSxExn zQ3V55!|UPX0mUHm)q6DDC})F+P>#s}DL`%{f+CTJ@FH5AnocfnfT>z!j73bkRjye; zkR-(j*K=N|1qp)TT`+8fe1u$pb&IN*C8LTQmx+@K#wWlq=n{M&Bc_q3q7OghI3HP(`W=4yP!%Dn1l0)Ax@yOin>3zq z<;6^tRFr_}O=X`&Y95$@G0l*HDe&0@+%&Qs>6?=`3x2NF=1fbd$rCx&zbla?+Rv z-W{wRnAWdf8l%jl0y4Xj4+e!I<#>*;x20~sSzye`G3NA@59rA0#{@%oEHc@C6D%po zPRK<|ib^HE6xG?L@|;dcO-4F9|E;}}#OHE-TJ-0S9_3YpdPJr*gaMX)%eLs z(#^{5HU5gB9=3Fp_@zMyw74l`BqLh{4uk=%i0+4BGV(>4bV;Tw5R86;`~QY-WRV>+ z)C{9B2rP!y82T&#Of?9iySe9(wZ4VixbBBMqnp5KpScAbj+)C^O9Fl*`dDRHeyU<3 zaq>@V2~9z{Md2uR+_8j1#R8u{P6Nx}1k#BjhN6xk2IF~<_p?F88y0yXK3N9UN#4~( z2$4x2RFw15ZIVG?iekY?gK&*c^{_>rm6Sb|nr9E&HHN*A6w-1=bd?QZ?V*$yJ#C)2 zq8L#Hn4zEfYuTSpmnu{Y+jyII;|}TqGa*Dy&hW$Bjuj0u9@PpYiaL@pbwx6s~ z;e4a10LDb|fB>~j1@n<@bX$XC!wfNjVgI@qwu%@g5bS@6PmB0(*#G)@Wn2XR#p8aW z@!#D1MEuuf`6Te)1pb@Ae-rp`0{>0mzyCD&uZ*^aG2fQs#S$T4oU$FgHUx}~eH!6Gb%T>(1jflRel>B8AcH7T zSO!}ylG6&p%}&sD6#Ha?T5TS-y z5^>W(*P?MBAppawpY;-Yc+x_A1=b=rQRoV`FP@ZunIWIz;L7-pqyZ0c^Zxh}h&RWA zNfMbdQiEtLFk~Ae3^ZTO3(_PojZ^}HWI!RvwI^0mmMuY%2tJ9gT7+l?RT|zVNg8EJ z578gMrHo67JWF*Ud@zOFZf;%!L`n#?lXl}J11ggcjfg{L6fdEt;9#1*qP!9U&CG=B zdah;ZM?hNUtX{sXUhW7Ci|(0;8EL&$Q$>I^ZT=vPRlOtwaL`HsJAnaS5(bDS^CA!+ zG0qxrP1_uqOuS}pU4W@tbOM?CwUD_mmXiSH5+C)`BL1iPVLz*ki{XFSePh;t=I1BQ z|Gq4r1pb%6|9(;YPxjTdNLtu^|93$GJm6A0kHK?LZ(0uYEEAC%@N zJF}}s1!>1KEDAcPS~tXy{G5wxVbqOpaSeJB>co5ejKndx^)(NC2r*!Z;^VOaJUfsK zvv4cF4hLJwsC}10ZX@RgeHnVz2z&{dn(>Jd(4_)ir4YuUaU`ILKo|s@FmXOr@><Gv2tFZliWmX7RZKJb;f>J`y$r4vz~qZ#YS_uxEJ1<~wQ}GeL2fBqqY>%K z>}xeg8BFlGGN35BVrD?CG^zwoSxwk43o}FbhiH(*`RfI5J+Gjnl=B>e-U{@isD$&= z4d=8d3^uA#X*MXb^-5X^>#c89#g*Md(Z+-~v^W>oOQlA5(S|uV%kHTzkgCiX!J>z47!R zJaa-OB4fs03Z~Y{b2C6UNaToy+MH>ds$`nEN8j7G^=8m zxom`UP#jA{xCsi>z&p7R3HAh{5%9D|MR*?xHU@c1sdD8KSRTdl)KQawdHD$D^)Y7W z8S`=w%qz$rP>`Dd^Aev{d|Jf+w9}KHQN~5^zufFTc`^IH6(r98yDXms{+Gc267heD z_`d}Dmq7m#=-)4c{wc3OqTrm!D8`=|{1;6;uK(LSBsGBHyfM*K2)xvQo-(Y9b*FPQ z4h#CZq$g(pa-xeTTgM?<2Gb@1#u87+XJE=y6IQGEHjF4tf}sY_%n?EewFNb64Z~ig z9!e$S5DnXK2>}?dYvjdU7?3x#tkS^5uM>%CA;CII2#%(faZw^Xs+^urpp5pCk)C{r z0+-v^4vFLg4~XyH+ohO1H}4VTFun}%U_&hQyNFhZa9^WwEuQ$hVUQqV^5pS{C@@Or z+mg`}P*iScc?tEHBZT0O1EgW3TjbK%fD$HF4TLeYP+%hAKs|KlphCb$*3E_(H!pHL zHf{*4KJ<0Qj-xJEt6FGFFXurOzy)|=4!kfd5EPZIX8DPNijJ5;aTV%3i_IA+FD;1Z zrYLE>;F1*&G!bu5097*u)N90m0>vfBkPx1rEyTz%)KA{;5=0T<5)4n20-VGW^cF4= z>mZ?oz=TL^$xn_G`$)><1><5# z948(*qu0*42(F@u#zZ8WKt!&H(GobXLkY@=kdLE_ipjA_s?uS10s}(faO_MXA`1)) z6QY2~V`iv7wlSF@0afUlejqEjLIiJ$4M!zXlmY^tI;jP|%uF>8S|tQI7aIk8MuA;y zJP1nzam7B*)N8@EW&tn8tRWN2xnCOtD)RM2#T4@(_gojsL<&P^qLEh45|&b7F3 zmHaHkSfcumDv$DTqhM?szL@X>LmWo71~}0NYNVOwi7;p5gZMfith}J0l0c(W5skw= z1aO^p*!Bdl|B$e`upP(lE@{F&TWm)#l>*k5)%RA6ty3l>N6gVa78Icqd%S~*6c`hFd0)J6;!JelWb;C1^4OzMR!}?m_6cqpdzp!^Nx-~=CImug zyYQA91FiY$5D&j4a+kCpXp<4NxSoc(Yvo1W7AX89rt6m5BFKw+R+hL#8i9+dDs(ma zS`0fP#-zeP<3qS#?$23XtZ1kXDuQ8&*viV52$EjnJRpi7Sqi$w0wlYgeC7$s{NtW13;eNVB zma3Tw#-6DM0@~sji@nt9u-MEcwyHSE8FR4}7>aoSR;98OvR7CgrM5Dxoqh0dD^$#` zx57jxoXl1>#1Wg@fU>aI9G1#5XGOZ1C`%dez?e&hR+gF>yOS|jR@fa@Qdzr`6jVlT z=%FZ!z5I5EZRoHHsHsCO%VIBc+KR0X;Ks>7(sH;?H&Y?qX0y%oh~u{#{;R<+(xsY<6EzrqTo79EE_2DGZw>MXSz5|DocYbKi9%L@|KKabevu^IX^xT2-yF7EgU9swgRntd}s%ZSC+C00$JU;cWGZ(fS zJh=UV4t(E}^YilFxF!Ac#FbfnQ&SJ0K5}l~p4WC2dbVvnw{6XdQ|8B|Ggp7#-t|9XMF1O;&w?Zzus}r*(DbqW=@{c z?fg&a!KBW^-cIh=*mK6NS5}&wqhIN~hllRWc9lr7Tl}G+$Uw!btl%}QrZT($WrT(#~ z=Zvj2CpJCM{lxL(Yu2opI&IpB;lmwH=lb>QA09f7dvN)m7x%o&+WwlsH{R{|^J`l^ zvj*Gh{&#Cq+rinokzZ`-zhvGOfx$^SN4L}6+H7c_>}tzxp1$D`{nH!XGPn2beC64u zrtyE9+pA5RHW$wBc;onq6LV(Ierx^ul>Ki^J9p~%adG&w8>`>1&40*reAb)e$2YQ# z-Me?s%gg)mhab*``u5Dze=2{m(ZYTo3WfH+_vGo*r|rXsr_Fff)mOjX zw=eUKmDwiKr)H*ep*eY++fT6VBQ@8XXRojia3e6s8Hu`iB2Ui0!l-ny@2 z&C8#9`}8d+c%a9?$#33sWnJUVt}ZvP@6zp)v77tvpF88R$FgquA#ncOcar@tOP^Wl zeYGk>_f2r&(ZKE;SK7C$jg!9KI%?Vc^36$Y8$Um}``&iteWuuK9X5^H^GDtEoNb#o z?_3pn{*gyUTCE#DeAc;t>!aI0{BT2mV0YwSN=J=;lS1!&m4w)xNuM z>Fx`6-92eifv)X;>)Pwuep&PK;+KxrvFtxaj!Ur*n>F#=5x(K`hlgdjwx)FQx9d0{ z@a3S&%8%w4*Y@sue$V>*3%b3#-1T+BEN)d+xk*^i7j%_r5U3bIk{xzv{Hk=P~IR-HfD7qt^G| z_xH-JPn`R7??by+O+K0Vz|8DTW8QE2eTSws-jA2wURqkJUwiQ2!BgLUUfA&Mt_2H{ zH;t;Q+WF?azd!xm?z>Na-f;TRj_(eC`ttgjotzu4nzK6MR z+Z=FaWBJajm4 zWVXOuH@

    @@ -2773,7 +2844,7 @@

    FIGURE 15: SSL/TLS protocol handshake.

    can result in major changes in the set of (x,y) solutions.


    - +

    FIGURE 16: Elliptic curve addition.

    @@ -3545,6 +3616,7 @@

    FIGURE 17: AES pseudocode.

  • Stallings, W. Cryptography and Network Security: Principles and Practice, 4th ed. Englewood Cliffs (NJ): Prentice Hall, 2006.
  • _____, (ed.) Practical Cryptography for Data Internetworks. Los Alamitos (CA): IEEE Computer Society Press, 1996.
  • Trappe, W. & Washington, L.C. Introduction to Cryptography with Codin Theory, 2nd ed. Upper Saddle River (NJ): Pearson Prentice Hall, 2006. +
  • Young, A. & Yung, M. Malicious Cryptography: Exposing Cryptovirology. New York: John Wiley & Sons, 2004.

  • On the Web:
    • +<% for _, var in pairs { "SERVER_SOFTWARE", "SERVER_NAME", "GATEWAY_INTERFACE", "SERVER_PROTOCOL", "SERVER_PORT", "REQUEST_METHOD", "PATH_INFO", "PATH_TRANSLATED", "SCRIPT_NAME", "QUERY_STRING", "REMOTE_HOST", "REMOTE_ADDR", "AUTH_TYPE", "REMOTE_USER", "REMOTE_IDENT", "CONTENT_TYPE", "CONTENT_LENGTH", "HTTP_REFERER", "HTTP_COOKIE", "SCRIPT_FILENAME", "DOCUMENT_ROOT", } do %> + +<% end %> +
    <%= var %>="<%= cgilua.servervariable(var) or "not defined"%>"
    + +

    + +<% for _, var in ipairs { "script_file", "script_path", "script_pdir", "script_vdir", "script_vpath", "urlpath", } do %> + +<% end %> +
    <%= var %>="<%= cgilua[var] %>"
    + +

    From db9b72d4dd847925b6b639490085601e4b1259b4 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 25 May 2007 06:04:58 +0000 Subject: [PATCH 079/301] added lua bindings git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@98 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- bindings/Config.in | 16 +++++++++ bindings/Makefile | 11 ++++++ bindings/generate_SWIG_interface.pl | 12 ++++++- bindings/lua/Makefile | 55 +++++++++++++++++++++++++++++ 4 files changed, 93 insertions(+), 1 deletion(-) create mode 100644 bindings/lua/Makefile diff --git a/bindings/Config.in b/bindings/Config.in index bf916b13d6..12a696ba8b 100644 --- a/bindings/Config.in +++ b/bindings/Config.in @@ -86,4 +86,20 @@ config CONFIG_PERL_LIB default "perl58.lib" endmenu +config CONFIG_LUA_BINDINGS + bool "Create Lua bindings" + default n + depends on CONFIG_BINDINGS && !CONFIG_PLATFORM_WIN32 + help + Build Lua bindings (see www.lua.org). + +menu "Lua Home" +depends on CONFIG_LUA_BINDINGS +config CONFIG_LUA_CORE + string "Location of Lua CORE" + default "/usr/local" + help: + If the Lua exists on another directory then this needs to be changed +endmenu + endmenu diff --git a/bindings/Makefile b/bindings/Makefile index 19c896d2c0..8874159435 100644 --- a/bindings/Makefile +++ b/bindings/Makefile @@ -37,6 +37,10 @@ ifdef CONFIG_PERL_BINDINGS all: perl/axTLSp_wrap.c endif +ifdef CONFIG_LUA_BINDINGS +all: lua/axTLSl_wrap.c +endif + csharp/axInterface.cs: ../ssl/ssl.h @perl ./generate_interface.pl -csharp @@ -55,9 +59,16 @@ perl/axTLSp.i: ../ssl/ssl.h perl/axTLSp_wrap.c: perl/axTLSp.i @cd perl; swig -perl5 axTLSp.i; $(MAKE) +lua/axTLSl.i: ../ssl/ssl.h + @perl ./generate_SWIG_interface.pl -lua + +lua/axTLSl_wrap.c: lua/axTLSl.i + @cd lua; swig -lua axTLSl.i; $(MAKE) + clean:: $(MAKE) -C csharp clean $(MAKE) -C vbnet clean $(MAKE) -C java clean $(MAKE) -C perl clean + $(MAKE) -C lua clean diff --git a/bindings/generate_SWIG_interface.pl b/bindings/generate_SWIG_interface.pl index c5a7916b71..e21873d5be 100755 --- a/bindings/generate_SWIG_interface.pl +++ b/bindings/generate_SWIG_interface.pl @@ -121,10 +121,16 @@ sub parseFile $module = "axtlsp"; $interfaceFile = "perl/axTLSp.i"; } +elsif ($ARGV[0] eq "-lua") +{ + print "Generating lua interface file\n"; + $module = "axtlsl"; + $interfaceFile = "lua/axTLSl.i"; +} else { ouch: - die "Usage: $0 [-java | -perl]\n"; + die "Usage: $0 [-java | -perl | -lua]\n"; } # Input file required to generate SWIG interface file. @@ -313,6 +319,10 @@ sub parseFile #endif +/* Some SWIG magic to make the API a bit more Lua friendly */ +#ifdef SWIGLUA +#endif + END # Initialise loop variables diff --git a/bindings/lua/Makefile b/bindings/lua/Makefile new file mode 100644 index 0000000000..771c1acb88 --- /dev/null +++ b/bindings/lua/Makefile @@ -0,0 +1,55 @@ +# +# Copyright(C) 2007 Cameron Rich +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +include ../../config/.config +include ../../config/makefile.conf + +all: lib + +ifdef CONFIG_PLATFORM_WIN32 +TARGET=../../$(STAGE)/axtlsl.dll +else +TARGET=../../$(STAGE)/libaxtlsl.so +endif + +ifneq ($(MAKECMDGOALS), clean) + +lib: $(TARGET) +AXTLS_HOME=../.. +SSL_HOME=$(AXTLS_HOME)/ssl +CONFIG_HOME=$(AXTLS_HOME)/config +OBJ:=axTLSl_wrap.o +include ../../config/makefile.post + +$(TARGET) : $(OBJ) + $(LD) $(LDFLAGS) -L ../../$(STAGE) -L $(CONFIG_LUA_CORE)/lib $(LDSHARED) -o $@ $(OBJ) -laxtls -llua +ifdef CONFIG_PLATFORM_CYGWIN + cd ../../$(STAGE); ln -sf $(notdir $@) axtlsl.dll +endif + +CFLAGS += -I$(CONFIG_HOME) -I$(SSL_HOME) -I $(CONFIG_LUA_CORE)/include +else +CFLAGS += /I"`cygpath -w $(CONFIG_HOME)`" /I"`cygpath -w $(SSL_HOME)`" /I"`cygpath -w $(CONFIG_LUA_CORE)/include`" +LDFLAGS += axtls.lib /libpath:"../../$(STAGE)" + +$(TARGET) : $(OBJ) + $(LD) $(LDFLAGS) $(LDSHARED) /out:$@ $(OBJ) +endif # WIN32 + +clean:: + @rm -f $(TARGET) *.i axTLSl* .depend From c69e63f576288ed1a31e62ca95d9ce89fa24a25a Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 25 May 2007 06:05:53 +0000 Subject: [PATCH 080/301] new tweak for java git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@99 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/test/test_axssl.sh | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/ssl/test/test_axssl.sh b/ssl/test/test_axssl.sh index 37ed0b1933..7628eea216 100755 --- a/ssl/test/test_axssl.sh +++ b/ssl/test/test_axssl.sh @@ -24,7 +24,7 @@ # if grep "CONFIG_PLATFORM_WIN32=y" "../config/.config" > /dev/null; then - JAVA_BIN="/cygdrive/c/Program Files/Java/jdk1.5.0_06/bin" + JAVA_EXE="/cygdrive/c/Program Files/Java/jdk1.5.0_06/bin/java.exe" PERL_BIN="/cygdrive/c/Perl/bin/perl" KILL_AXSSL="kill %1" KILL_CSHARP="kill %1" @@ -37,13 +37,13 @@ else KILL_AXSSL="killall axssl" KILL_PERL="killall /usr/bin/perl" else # Linux - JAVA_BIN=/usr/java/default/bin + JAVA_EXE=/usr/java/default/bin/java PERL_BIN=/usr/bin/perl KILL_AXSSL="killall axssl" KILL_CSHARP="killall mono" KILL_PERL="killall /usr/bin/perl" RUN_CSHARP="mono" - KILL_JAVA="killall $JAVA_BIN/java" + KILL_JAVA="killall $JAVA_EXE" fi fi @@ -67,21 +67,21 @@ sleep 1 ./axssl $SERVER_PEM_ARGS & echo "C Test passed" | ./axssl $CLIENT_PEM_ARGS $KILL_AXSSL -sleep 2 +sleep 1 echo "### C tests complete" fi if [ -f ./axtls.jar ]; then echo "########################## JAVA SAMPLE ###########################" -"$JAVA_BIN/java" -jar ./axtls.jar $SERVER_ARGS & -echo "Java Test passed" | "$JAVA_BIN/java" -jar ./axtls.jar $CLIENT_ARGS +"$JAVA_EXE" -jar ./axtls.jar $SERVER_ARGS & +echo "Java Test passed" | "$JAVA_EXE" -jar ./axtls.jar $CLIENT_ARGS $KILL_JAVA sleep 1 -"$JAVA_BIN/java" -jar ./axtls.jar $SERVER_PEM_ARGS & -echo "Java Test passed" | "$JAVA_BIN/java" -jar ./axtls.jar $CLIENT_PEM_ARGS +"$JAVA_EXE" -jar ./axtls.jar $SERVER_PEM_ARGS & +echo "Java Test passed" | "$JAVA_EXE" -jar ./axtls.jar $CLIENT_PEM_ARGS $KILL_JAVA -sleep 2 +sleep 1 echo "### Java tests complete" fi @@ -90,13 +90,11 @@ if [ -x ./axssl.csharp.exe ]; then echo "############################ C# SAMPLE ###########################" $RUN_CSHARP ./axssl.csharp.exe $SERVER_ARGS & echo "C# Test passed" | $RUN_CSHARP ./axssl.csharp.exe $CLIENT_ARGS -sleep 1 $KILL_CSHARP sleep 1 $RUN_CSHARP ./axssl.csharp.exe $SERVER_PEM_ARGS & echo "C# Test passed" | $RUN_CSHARP ./axssl.csharp.exe $CLIENT_PEM_ARGS -sleep 1 $KILL_CSHARP sleep 1 @@ -106,13 +104,11 @@ fi if [ -x ./axssl.vbnet.exe ]; then echo "######################## VB.NET SAMPLE ###########################" ./axssl.vbnet $SERVER_ARGS & -sleep 1 echo "VB.NET Test passed" | ./axssl.vbnet.exe $CLIENT_ARGS kill %1 sleep 1 ./axssl.vbnet $SERVER_PEM_ARGS & -sleep 1 echo "VB.NET Test passed" | ./axssl.vbnet.exe $CLIENT_PEM_ARGS kill %1 sleep 1 From f592df2e1ffa9872f511a7991752492c7c46e615 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 25 May 2007 06:08:19 +0000 Subject: [PATCH 081/301] added lua work git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@100 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- samples/Makefile | 4 + samples/lua/Makefile | 31 +++ samples/lua/axssl.lua | 535 ++++++++++++++++++++++++++++++++++++++++++ samples/perl/axssl.pl | 11 +- 4 files changed, 576 insertions(+), 5 deletions(-) create mode 100644 samples/lua/Makefile create mode 100755 samples/lua/axssl.lua diff --git a/samples/Makefile b/samples/Makefile index fbb31149a8..fdbdb99709 100644 --- a/samples/Makefile +++ b/samples/Makefile @@ -37,6 +37,9 @@ endif ifdef CONFIG_PERL_SAMPLES $(MAKE) -C perl endif +ifdef CONFIG_LUA_SAMPLES + $(MAKE) -C lua +endif clean:: $(MAKE) -C c clean @@ -44,3 +47,4 @@ clean:: $(MAKE) -C vbnet clean $(MAKE) -C java clean $(MAKE) -C perl clean + $(MAKE) -C lua clean diff --git a/samples/lua/Makefile b/samples/lua/Makefile new file mode 100644 index 0000000000..3c90813cf9 --- /dev/null +++ b/samples/lua/Makefile @@ -0,0 +1,31 @@ +# +# Copyright(C) 2007 Cameron Rich +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +include ../../config/.config +include ../../config/makefile.conf + +all: samples +TARGET=../../$(STAGE)/axssl.lua +samples: $(TARGET) + +$(TARGET): axssl.lua + install $< $@ + +clean:: + -@rm -f $(TARGET) + diff --git a/samples/lua/axssl.lua b/samples/lua/axssl.lua new file mode 100755 index 0000000000..f1d9335868 --- /dev/null +++ b/samples/lua/axssl.lua @@ -0,0 +1,535 @@ +#!/usr/bin/lua +-- +-- +-- Copyright(C) 2006 Cameron Rich +-- +-- This program is free software; you can redistribute it and/or modify +-- it under the terms of the GNU General Public License as published by +-- the Free Software Foundation; either version 2.1 of the License, or +-- (at your option) any later version. +-- +-- This program is distributed in the hope that it will be useful, +-- but WITHOUT ANY WARRANTY; without even the implied warranty of +-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +-- GNU Lesser General Public License for more details. +-- +-- You should have received a copy of the GNU General Public License +-- along with this program; if not, write to the Free Software +-- Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +-- + +-- +-- Demonstrate the use of the axTLS library in Lua with a set of +-- command-line parameters similar to openssl. In fact, openssl clients +-- should be able to communicate with axTLS servers and visa-versa. +-- +-- This code has various bits enabled depending on the configuration. To enable +-- the most interesting version, compile with the 'full mode' enabled. +-- +-- To see what options you have, run the following: +-- > [lua] axssl s_server -? +-- > [lua] axssl s_client -? +-- +-- The axtls/axtlsl shared libraries must be in the same directory or be found +-- by the OS. +-- +-- +local f = loadlib("axtlsl.dll", "luaopen_axtlsl") +f() + +-- print version? + +if #arg == 1 and arg[1] == "version" then + print("axssl.lua "..ssl_version().."\n") + os.exit(1) +end + +-- +-- We've had some sort of command-line error. Print out the basic options. +-- +function print_options(option) + print("axssl: Error: '"..option.."' is an invalid command.") + print("usage: axssl [s_server|s_client|version] [args ...]") + os.exit(1) +end + +-- +-- Main entry point. Doesn't do much except works out whether we are a client +-- or a server. +-- +if #arg < 1 or (arg[1] ~= "s_server" and arg[1] ~= "s_client") then + print_options(#arg > 0 and arg[1] or "") +end + +--[[ +local build_mode = ssl_get_config(SSL_BUILD_MODE) +arg[1] eq "s_server" ? do_server(build_mode) : do_client(build_mode) + +-- Implement the SSL server logic. +function do_server(build_mode) + local i = 1 + local port = 4433 + local options = SSL_DISPLAY_CERTS + local quiet = false + local password = nil + local private_key_file = nil + local cert_size = ssl_get_config(SSL_MAX_CERT_CFG_OFFSET) + local ca_cert_size = ssl_get_config(SSL_MAX_CA_CERT_CFG_OFFSET) + local cert = {} + local ca_cert = {} + + while i <= #arg do + if arg[i] eq "-accept" then + if i >= #arg then + print_server_options(build_mode, arg[i]) + end + + i = i + 1 + port = arg[i] + elseif arg[i] eq "-quiet" then + quiet = true + options = options & ~SSL_DISPLAY_CERTS + elseif build_mode >= SSL_BUILD_SERVER_ONLY then + if arg[i] eq "-cert" then + if i >= #arg >= cert_size-1 then + print_server_options(build_mode, arg[i]) + end + + i = i + 1 + cert[i] = arg[i] + elseif arg[i] eq "-key" then + if i >= #arg then + print_server_options(build_mode, arg[i]) + end + + i = i + 1 + private_key_file = arg[i] + options = options | SSL_NO_DEFAULT_KEY + elseif arg[i] eq "-pass" then + if i >= #arg then + print_server_options(build_mode, arg[i]) + end + + i = i + 1 + password = arg[i] + elseif build_mode >= SSL_BUILD_ENABLE_VERIFICATION then + if arg[i] eq "-verify" then + options = options | SSL_CLIENT_AUTHENTICATION + elseif arg[i] eq "-CAfile" then + if i >= #arg >= ca_cert_size-1 then + print_server_options(build_mode, arg[i]) + end + + i = i + 1 + ca_cert[i] = arg[i] + elseif build_mode == SSL_BUILD_FULL_MODE then + if arg[i] eq "-debug" then + options = options | SSL_DISPLAY_BYTES + elseif arg[i] eq "-state" then + options = options | SSL_DISPLAY_STATES + elseif arg[i] eq "-show-rsa" then + options = options | SSL_DISPLAY_RSA + else + print_server_options(build_mode, arg[i]) + end + else + print_server_options(build_mode, arg[i]) + end + else + print_server_options(build_mode, arg[i]) + end + else + print_server_options(build_mode, arg[i]) + end + + i = i + 1 + end + + -- Create socket for incoming connections + local server_sock = IO::Socket::INET->new(Proto => 'tcp', + LocalPort => port, + Listen => 1, + Reuse => 1) or die ! + + --------------------------------------------------------------------------- + -- This is where the interesting stuff happens. Up until now we've + -- just been setting up sockets etc. Now we do the SSL handshake. + --------------------------------------------------------------------------- + local ssl_ctx = ssl_ctx_new(options, SSL_DEFAULT_SVR_SESS) + if ssl_ctx == nil then error("Error: Server context is invalid") end + + if nil private_key_file then + local obj_type = SSL_OBJ_RSA_KEY + + if private_key_file =~ /.p8/ then obj_type = SSL_OBJ_PKCS8 end + if private_key_file =~ /.p12/ then obj_type = SSL_OBJ_PKCS12 end + + if ssl_obj_load(ssl_ctx, obj_type, private_key_file, password) then + error("Private key 'private_key_file' is nilined.") + end + end + + foreach (@cert) + if ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CERT, _, nil) #arg= SSL_OK then + error("Certificate '_' is undefined.") + end + end + + foreach (@ca_cert) + if ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CACERT, _, nil) #arg= SSL_OK then + error("Certificate '_' is undefined.") + end + end + + while true do + if not quiet then print("ACCEPT\n") end + local client_sock = server_sock->accept + local native_sock = get_native_sock(client_sock->fileno) + + -- This doesn't work in Win32 - need to get file descriptor from socket. + local ssl = ssl_server_new(ssl_ctx, native_sock) + + -- do the actual SSL handshake + local res + local buf + + while true do + (res, buf) = ssl_read(ssl, nil) + if res #arg= SSL_OK then break end + + -- check when the connection has been established + if ssl_handshake_status(ssl) == SSL_OK then break end + + -- could do something else here + end + + if res == SSL_OK then -- connection established and ok + if not quiet then + display_session_id(ssl) + display_cipher(ssl) + end + + -- now read (and display) whatever the client sends us + while true do + -- keep reading until we get something interesting + while true do + (res, buf) = ssl_read(ssl, nil) + if res #arg= SSL_OK then break end + + -- could do something else here + end + + if res < SSL_OK then + if not quiet then print("CONNECTION CLOSED\n") end + break + end + + print(buf) + end + elseif not quiet then + ssl_display_error(res) + end + + -- client was disconnected or the handshake failed. + ssl_free(ssl) + client_sock->close + end + + ssl_ctx_free(ssl_ctx) +end + +-- +-- Implement the SSL client logic. +-- +function do_client(build_mode) + local i = 1 + local port = 4433 + local options = SSL_SERVER_VERIFY_LATER|SSL_DISPLAY_CERTS + local private_key_file = nil + local reconnect = 0 + local quiet = false + local password = nil + local session_id = {} + local host = "127.0.0.1" + local @cert + local @ca_cert + local cert_size = ssl_get_config(SSL_MAX_CERT_CFG_OFFSET) + local ca_cert_size = ssl_get_config(SSL_MAX_CA_CERT_CFG_OFFSET) + + while i <= #arg do + if arg[i] eq "-connect" then + if i >= #arg then + print_client_options(build_mode, arg[i]) + end + + i = i + 1 + (host, port) = split(':', arg[i]) + elseif arg[i] eq "-cert" then + if i >= #arg >= cert_size-1 then + print_client_options(build_mode, arg[i]) + end + + i = i + 1 + cert[i] = arg[i] + elseif arg[i] eq "-key" then + if i >= #arg then + print_client_options(build_mode, arg[i]) + end + + i = i + 1 + private_key_file = arg[i] + options |= SSL_NO_DEFAULT_KEY + elseif arg[i] eq "-CAfile" then + if i >= #arg >= ca_cert_size-1 then + print_client_options(build_mode, arg[i]) + end + + i = i + 1 + ca_cert[i] = arg[i] + elseif arg[i] eq "-verify" then + options &= ~SSL_SERVER_VERIFY_LATER + elseif arg[i] eq "-reconnect" then + reconnect = 4 + elseif arg[i] eq "-quiet" then + quiet = true + options &= ~SSL_DISPLAY_CERTS + elseif arg[i] eq "-pass" then + if i >= #arg then + print_server_options(build_mode, arg[i]) + end + + i = i + 1 + password = arg[i] + elseif build_mode == SSL_BUILD_FULL_MODE then + if arg[i] eq "-debug" then + options = options | SSL_DISPLAY_BYTES + elseif arg[i] eq "-state" then + options = options | SSL_DISPLAY_STATES + elseif arg[i] eq "-show-rsa" then + options = options | SSL_DISPLAY_RSA + else -- don't know what this is + print_client_options(build_mode, arg[i]) + end + else -- don't know what this is + print_client_options(build_mode, arg[i]) + end + + i = i + 1 + end + + local client_sock = new IO::Socket::INET ( + PeerAddr => host, PeerPort => port, Proto => 'tcp') + or error("no socket: !") + local ssl + local res + local native_sock = get_native_sock(client_sock->fileno) + + if not quiet then print("CONNECTED\n") end + + --------------------------------------------------------------------------- + -- This is where the interesting stuff happens. Up until now we've + -- just been setting up sockets etc. Now we do the SSL handshake. + --------------------------------------------------------------------------- + local ssl_ctx = ssl_ctx_new(options, SSL_DEFAULT_CLNT_SESS) + + if ssl_ctx == nil then + error("Error: Client context is invalid") + end + + if private_key_file not nil then + local obj_type = SSL_OBJ_RSA_KEY + + if private_key_file =~ /.p8/ then + obj_type = SSL_OBJ_PKCS8 + end + if private_key_file =~ /.p12/ then + obj_type = SSL_OBJ_PKCS12 + end + + if ssl_obj_load(ssl_ctx, obj_type, private_key_file, password) then + error("Private key 'private_key_file' is undefined.") + end + end + + foreach (@cert) + if ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CERT, _, nil) then + error("Certificate '_' is undefined.") + end + end + + foreach (@ca_cert) + if ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CACERT, _, nil) then + error("Certificate '_' is undefined.") + end + end + + -- Try session resumption? + if reconnect then + local session_id = nil + while reconnect do + reconnect = reconnect - 1 + ssl = ssl_client_new(ssl_ctx, native_sock, session_id) + + res = ssl_handshake_status(ssl) + if res #arg= SSL_OK then + if not quiet then ssl_display_error(res) end + ssl_free(ssl) + os.exit(1) + end + + display_session_id(ssl) + session_id = ssl_get_session_id(ssl) + + if reconnect then + ssl_free(ssl) + client_sock->close + client_sock = new IO::Socket::INET ( + PeerAddr => host, PeerPort => port, Proto => 'tcp') + or error ("no socket: !") + + end + end + else + ssl = ssl_client_new(ssl_ctx, native_sock, nil) + end + + -- check the return status + res = ssl_handshake_status(ssl) + if res #arg= SSL_OK then + if not quiet then ssl_display_error(res) end + os.exit(1) + end + + if not quiet then + local common_name = ssl_get_cert_dn(ssl, + SSL_X509_CERT_COMMON_NAME) + + if common_name not nil then + print("Common Name:\t\t%s\n", common_name) + end + + display_session_id(ssl) + display_cipher(ssl) + end + + while do + local cstring = pack("a*x", _); -- add null terminator + res = ssl_write(ssl, \cstring, length(cstring)) + if res < SSL_OK then + if not quiet then ssl_display_error(res) end + break + end + end + + ssl_ctx_free(ssl_ctx) + client_sock->close +end + +-- +-- We've had some sort of command-line error. Print out the server options. +-- +function print_server_options(build_mode, option) + local cert_size = ssl_get_config(SSL_MAX_CERT_CFG_OFFSET) + local ca_cert_size = ssl_get_config( + SSL_MAX_CA_CERT_CFG_OFFSET) + + print("unknown option "..option.."") + print("usage: s_server [args ...]") + print(" -accept\t\t- port to accept on (default is 4433)") + print(" -quiet\t\t- No server output\n") + + if build_mode >= SSL_BUILD_SERVER_ONLY then + print(" -cert arg\t- certificate file to add (in addition to default then". + " to chain -". + "\t\t default DER format. Can repeat up to %d times\n", cert_size) + print(" -key arg\t- Private key file to use - default DER format") + print(" -pass\t\t- private key file pass phrase source") + end + + if build_mode >= SSL_BUILD_ENABLE_VERIFICATION then + print(" -verify\t- turn on peer certificate verification") + print(" -CAfile arg\t- Certificate authority - default DER format") + print("\t\t Can repeat up to %d times\n", ca_cert_size) + end + + if build_mode == SSL_BUILD_FULL_MODE then + print(" -debug\t\t- Print more output") + print(" -state\t\t- Show state messages") + print(" -show-rsa\t- Show RSA state") + end + + os.exit(1) +end + +-- +-- We've had some sort of command-line error. Print out the client options. +-- +function print_client_options(build_mode, option) + local cert_size = ssl_get_config(SSL_MAX_CERT_CFG_OFFSET) + local ca_cert_size = ssl_get_config( + SSL_MAX_CA_CERT_CFG_OFFSET) + + print("unknown option %s\n", option) + + if build_mode >= SSL_BUILD_ENABLE_CLIENT then + print("usage: s_client [args ...]") + print(" -connect host:port - who to connect to (default ".. + "is localhost:4433)") + print(" -verify\t- turn on peer certificate verification") + print(" -cert arg\t- certificate file to use - default DER format") + print(" -key arg\t- Private key file to use - default DER format") + print("\t\t Can repeat up to %d times\n", cert_size) + print(" -CAfile arg\t- Certificate authority - default DER format") + print("\t\t Can repeat up to %d times\n", ca_cert_size) + print(" -quiet\t\t- No client output") + print(" -pass\t\t- private key file pass phrase source") + print(" -reconnect\t- Drop and re-make the connection ".. + "with the same Session-ID") + + if build_mode == SSL_BUILD_FULL_MODE then + print(" -debug\t\t- Print more output") + print(" -state\t\t- Show state messages") + print(" -show-rsa\t- Show RSA state\n") + end + else + print("Change configuration to allow this feature") + end + + os.exit(1) +end + +-- +-- Display what cipher we are using +-- +function display_cipher(ss) + local (ssl) = @_ + print("CIPHER is ") + local cipher_id = ssl_get_cipher_id(ssl) + + if cipher_id == SSL_AES128_SHA then + print("AES128-SHA") + elseif cipher_id == SSL_AES256_SHA then + print("AES256-SHA") + elseif SSL_RC4_128_SHA then + print("RC4-SHA") + elseif SSL_RC4_128_MD5 then + print("RC4-MD5") + else + print("Unknown - %d", cipher_id) + end + + print("\n") +end + +-- +-- Display what session id we have. +-- +function display_session_id(ss) + local session_id = ssl_get_session_id(ssl) + + print("-----BEGIN SSL SESSION PARAMETERS-----\n") + print(unpack("H*", session_id)) + print("\n-----END SSL SESSION PARAMETERS-----\n") +end +--]] + diff --git a/samples/perl/axssl.pl b/samples/perl/axssl.pl index cbfd58fdb7..cf04254dd9 100755 --- a/samples/perl/axssl.pl +++ b/samples/perl/axssl.pl @@ -58,16 +58,17 @@ sub get_native_sock return $is_win32 ? FdGetOsFHandle($sock) : $sock; } -# -# Main entry point. Doesn't do much except works out whether we are a client -# or a server. -# +# print version? if ($#ARGV == 0 && $ARGV[0] eq "version") { printf("axssl.pl ".axtlsp::ssl_version()."\n"); exit 0; } +# +# Main entry point. Doesn't do much except works out whether we are a client +# or a server. +# print_options($#ARGV > -1 ? $ARGV[0] : "") if ($#ARGV < 0 || ($ARGV[0] ne "s_server" && $ARGV[0] ne "s_client")); @@ -494,7 +495,7 @@ sub print_options { my ($option) = @_; printf("axssl: Error: '%s' is an invalid command.\n", $option); - printf("usage: axssl [s_server|s_client] [args ...]\n"); + printf("usage: axssl [s_server|s_client|version] [args ...]\n"); exit 1; } From a3ed2cd3e05973aa46b007713d032d78831a8df8 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 25 May 2007 06:08:54 +0000 Subject: [PATCH 082/301] fix for win32 git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@101 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/Makefile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/httpd/Makefile b/httpd/Makefile index 6aedf5f067..7731323e5e 100644 --- a/httpd/Makefile +++ b/httpd/Makefile @@ -51,6 +51,8 @@ lua: endif else # win32 build +lua: + TARGET=../$(STAGE)/axhttpd.exe TARGET2=../$(STAGE)/htpasswd.exe From aa4d1bdc09bb6e04b019506fcd1d73e3c610aabd Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 25 May 2007 06:09:44 +0000 Subject: [PATCH 083/301] updates to make git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@102 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/.config.tmp | 11 -- config/linuxconfig | 21 +++- config/makefile.conf | 16 +-- config/makefile.java.conf | 16 +-- config/win32config | 242 ++++++++++++++++++++------------------ 5 files changed, 151 insertions(+), 155 deletions(-) delete mode 100644 config/.config.tmp diff --git a/config/.config.tmp b/config/.config.tmp deleted file mode 100644 index eae93ecacb..0000000000 --- a/config/.config.tmp +++ /dev/null @@ -1,11 +0,0 @@ -deps_config := \ - ssl/BigIntConfig.in \ - samples/Config.in \ - bindings/Config.in \ - httpd/Config.in \ - ssl/Config.in \ - config/Config.in - -.config include/config.h: $(deps_config) - -$(deps_config): diff --git a/config/linuxconfig b/config/linuxconfig index 3f8bec6000..220060c009 100644 --- a/config/linuxconfig +++ b/config/linuxconfig @@ -42,6 +42,7 @@ CONFIG_SSL_MAX_CERTS=2 # CONFIG_SSL_CTX_MUTEXING is not set CONFIG_USE_DEV_URANDOM=y # CONFIG_WIN32_USE_CRYPTO_LIB is not set +CONFIG_OPENSSL_COMPATIBLE=y # CONFIG_PERFORMANCE_TESTING is not set # CONFIG_SSL_TEST is not set CONFIG_AXHTTPD=y @@ -50,18 +51,25 @@ CONFIG_AXHTTPD=y # Axhttpd Configuration # # CONFIG_HTTP_STATIC_BUILD is not set +CONFIG_HTTP_PORT=80 CONFIG_HTTP_HTTPS_PORT=443 CONFIG_HTTP_SESSION_CACHE_SIZE=5 CONFIG_HTTP_WEBROOT="../www" -CONFIG_HTTP_PORT=80 CONFIG_HTTP_TIMEOUT=300 -# CONFIG_HTTP_HAS_CGI is not set -CONFIG_HTTP_CGI_EXTENSIONS="" -# CONFIG_HTTP_DIRECTORIES is not set + +# +# CGI +# +CONFIG_HTTP_HAS_CGI=y +CONFIG_HTTP_CGI_EXTENSIONS=".lua,.lp" +CONFIG_HTTP_ENABLE_LUA=y +CONFIG_HTTP_LUA_PREFIX="/usr/local" +# CONFIG_HTTP_BUILD_LUA is not set +CONFIG_HTTP_DIRECTORIES=y +CONFIG_HTTP_HAS_AUTHORIZATION=y # CONFIG_HTTP_USE_CHROOT is not set # CONFIG_HTTP_CHANGE_UID is not set # CONFIG_HTTP_HAS_IPV6 is not set -CONFIG_HTTP_ALL_MIME_TYPES=y # CONFIG_HTTP_VERBOSE is not set # CONFIG_HTTP_IS_DAEMON is not set @@ -77,6 +85,8 @@ CONFIG_JAVA_HOME="" # CONFIG_PERL_BINDINGS is not set CONFIG_PERL_CORE="" CONFIG_PERL_LIB="" +# CONFIG_LUA_BINDINGS is not set +CONFIG_LUA_CORE="" # # Samples @@ -87,6 +97,7 @@ CONFIG_C_SAMPLES=y # CONFIG_VBNET_SAMPLES is not set # CONFIG_JAVA_SAMPLES is not set # CONFIG_PERL_SAMPLES is not set +# CONFIG_LUA_SAMPLES is not set # # BigInt Options diff --git a/config/makefile.conf b/config/makefile.conf index 77a341be3b..829d3bf345 100644 --- a/config/makefile.conf +++ b/config/makefile.conf @@ -32,24 +32,21 @@ all: ifdef CONFIG_PLATFORM_WIN32 ifdef CONFIG_VISUAL_STUDIO_6_0 -CONFIG_VISUAL_STUDIO_6_0_BASE:=$(shell cygpath -w $(CONFIG_VISUAL_STUDIO_6_0_BASE)) CONFIG_VISUAL_STUDIO_6_0_BASE_UNIX:=$(shell cygpath -u $(CONFIG_VISUAL_STUDIO_6_0_BASE)) -export INCLUDE=$(CONFIG_VISUAL_STUDIO_6_0_BASE)\vc98\Include -export LIB=$(CONFIG_VISUAL_STUDIO_6_0_BASE)\vc98\Lib +INCLUDE=$(shell echo "$(CONFIG_VISUAL_STUDIO_6_0_BASE)\vc98\Include") +LIB=$(shell echo "$(CONFIG_VISUAL_STUDIO_6_0_BASE)\vc98\Lib") PATH:=$(CONFIG_VISUAL_STUDIO_6_0_BASE_UNIX)/common/msdev98/bin:$(CONFIG_VISUAL_STUDIO_6_0_BASE_UNIX)/vc98/bin:$(PATH) else ifdef CONFIG_VISUAL_STUDIO_7_0 -CONFIG_VISUAL_STUDIO_7_0_BASE:=$(shell cygpath -w $(CONFIG_VISUAL_STUDIO_7_0_BASE)) CONFIG_VISUAL_STUDIO_7_0_BASE_UNIX:=$(shell cygpath -u $(CONFIG_VISUAL_STUDIO_7_0_BASE)) -export INCLUDE=$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\include;$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\platformsdk\include -export LIB=$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\platformsdk\lib;$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\lib +INCLUDE=$(shell echo "$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\include;$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\platformsdk\include") +LIB=$(shell echo "$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\\platformsdk\lib;$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\lib") PATH:=$(CONFIG_VISUAL_STUDIO_7_0_BASE_UNIX)/vc7/bin:$(CONFIG_VISUAL_STUDIO_7_0_BASE_UNIX)/common7/ide:$(PATH) else ifdef CONFIG_VISUAL_STUDIO_8_0 -CONFIG_VISUAL_STUDIO_8_0_BASE:=$(shell cygpath -w $(CONFIG_VISUAL_STUDIO_8_0_BASE)) CONFIG_VISUAL_STUDIO_8_0_BASE_UNIX:=$(shell cygpath -u $(CONFIG_VISUAL_STUDIO_8_0_BASE)) -export INCLUDE=$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\include;$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\platformsdk\include -export LIB=$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\platformsdk\lib;$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\lib +INCLUDE=$(shell echo "$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\include;$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\platformsdk\include") +LIB=$(shell echo "$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\platformsdk\lib;$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\lib") PATH:=$(CONFIG_VISUAL_STUDIO_8_0_BASE_UNIX)/vc/bin:$(CONFIG_VISUAL_STUDIO_8_0_BASE_UNIX)/common7/ide:$(PATH) endif endif @@ -58,7 +55,6 @@ endif CC=cl.exe LD=link.exe CFLAGS+=/nologo /W3 /D "WIN32" /D "_MBCS" /D "_CONSOLE" /FD /I"..\ssl" /I"..\config" /c -#CFLAGS+=/nologo /W3 /D "WIN32" /D "_MBCS" /D "_CONSOLE" /FD /I"..\ssl" /I"..\config" /D "_CRT_SECURE_NO_DEPRECATE" /c LDFLAGS=/nologo /subsystem:console /machine:I386 LDSHARED = /dll AR=lib /nologo diff --git a/config/makefile.java.conf b/config/makefile.java.conf index 2194ef44bd..2e51b50da3 100644 --- a/config/makefile.java.conf +++ b/config/makefile.java.conf @@ -18,26 +18,16 @@ ifneq ($(MAKECMDGOALS), clean) -all: test_jdk_location - -test_jdk_location: - @if ! [ -d "$(CONFIG_JAVA_HOME)" ]; then \ - echo "*** Error: JDK path of $(CONFIG_JAVA_HOME) doesn't exist" && exit 1; \ - fi - - ifdef CONFIG_PLATFORM_CYGWIN -CONFIG_JAVA_HOME:=$(shell cygpath -u $(CONFIG_JAVA_HOME)) CFLAGS += -I"$(CONFIG_JAVA_HOME)/include" CFLAGS += -I"$(CONFIG_JAVA_HOME)/include/win32" JAVA_BIN:=$(CONFIG_JAVA_HOME)/bin else ifdef CONFIG_PLATFORM_WIN32 -CONFIG_JAVA_HOME:=$(shell cygpath -w $(CONFIG_JAVA_HOME)) -CFLAGS += /I"$(CONFIG_JAVA_HOME)\include" -CFLAGS += /I"$(CONFIG_JAVA_HOME)\include\win32" -JAVA_BIN:=$(shell cygpath -u $(CONFIG_JAVA_HOME)\bin) +CFLAGS += /I"$(shell cygpath -w $(CONFIG_JAVA_HOME)/include)" +CFLAGS += /I"$(shell cygpath -w $(CONFIG_JAVA_HOME)/include/win32)" +JAVA_BIN:=$(shell cygpath -u $(CONFIG_JAVA_HOME)/bin) else # Linux CFLAGS += -I$(CONFIG_JAVA_HOME)/include diff --git a/config/win32config b/config/win32config index 08806d97b5..ff5c3648bd 100644 --- a/config/win32config +++ b/config/win32config @@ -1,116 +1,126 @@ -# -# Automatically generated make config: don't edit -# -HAVE_DOT_CONFIG=y -# CONFIG_PLATFORM_LINUX is not set -# CONFIG_PLATFORM_CYGWIN is not set -# CONFIG_PLATFORM_SOLARIS is not set -CONFIG_PLATFORM_WIN32=y - -# -# General Configuration -# -PREFIX="" -# CONFIG_DEBUG is not set - -# -# Microsoft Compiler Options -# -# CONFIG_VISUAL_STUDIO_6_0 is not set -CONFIG_VISUAL_STUDIO_7_0=y -# CONFIG_VISUAL_STUDIO_8_0 is not set -CONFIG_VISUAL_STUDIO_6_0_BASE="" -CONFIG_VISUAL_STUDIO_7_0_BASE="c:\\Program Files\\Microsoft Visual Studio .NET 2003" -CONFIG_VISUAL_STUDIO_8_0_BASE="" -CONFIG_EXTRA_CFLAGS_OPTIONS="" -CONFIG_EXTRA_LDFLAGS_OPTIONS="" - -# -# SSL Library -# -# CONFIG_SSL_SERVER_ONLY is not set -# CONFIG_SSL_CERT_VERIFICATION is not set -# CONFIG_SSL_ENABLE_CLIENT is not set -CONFIG_SSL_FULL_MODE=y -# CONFIG_SSL_SKELETON_MODE is not set -# CONFIG_SSL_PROT_LOW is not set -CONFIG_SSL_PROT_MEDIUM=y -# CONFIG_SSL_PROT_HIGH is not set -CONFIG_SSL_USE_DEFAULT_KEY=y -CONFIG_SSL_ENABLE_V23_HANDSHAKE=y -CONFIG_SSL_HAS_PEM=y -CONFIG_SSL_USE_PKCS12=y -CONFIG_SSL_EXPIRY_TIME=24 -CONFIG_X509_MAX_CA_CERTS=4 -CONFIG_SSL_MAX_CERTS=2 -# CONFIG_SSL_CTX_MUTEXING is not set -# CONFIG_USE_DEV_URANDOM is not set -CONFIG_WIN32_USE_CRYPTO_LIB=y -# CONFIG_PERFORMANCE_TESTING is not set -# CONFIG_SSL_TEST is not set -CONFIG_AXHTTPD=y - -# -# Axhttpd Configuration -# -# CONFIG_HTTP_STATIC_BUILD is not set -CONFIG_HTTP_PORT=80 -CONFIG_HTTP_HTTPS_PORT=443 -CONFIG_HTTP_SESSION_CACHE_SIZE=5 -CONFIG_HTTP_WEBROOT="www" -CONFIG_HTTP_TIMEOUT=300 -# CONFIG_HTTP_HAS_CGI is not set -CONFIG_HTTP_CGI_EXTENSIONS="" -CONFIG_HTTP_DIRECTORIES=y -# CONFIG_HTTP_USE_CHROOT is not set -# CONFIG_HTTP_CHANGE_UID is not set -CONFIG_HTTP_HAS_AUTHORIZATION=y -# CONFIG_HTTP_HAS_IPV6 is not set -CONFIG_HTTP_ALL_MIME_TYPES=y -CONFIG_HTTP_VERBOSE=y -# CONFIG_HTTP_IS_DAEMON is not set - -# -# Language Bindings -# -CONFIG_BINDINGS=y -CONFIG_CSHARP_BINDINGS=y -CONFIG_VBNET_BINDINGS=y - -# -# .Net Framework -# -CONFIG_DOT_NET_FRAMEWORK_BASE="c:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727" -CONFIG_JAVA_BINDINGS=y - -# -# Java Home -# -CONFIG_JAVA_HOME="c:\\Program Files\\Java\\jdk1.5.0_06" -# CONFIG_PERL_BINDINGS is not set -CONFIG_PERL_CORE="" -CONFIG_PERL_LIB="" - -# -# Samples -# -CONFIG_SAMPLES=y -CONFIG_C_SAMPLES=y -CONFIG_CSHARP_SAMPLES=y -CONFIG_VBNET_SAMPLES=y -CONFIG_JAVA_SAMPLES=y -# CONFIG_PERL_SAMPLES is not set - -# -# BigInt Options -# -# CONFIG_BIGINT_CLASSICAL is not set -# CONFIG_BIGINT_MONTGOMERY is not set -CONFIG_BIGINT_BARRETT=y -CONFIG_BIGINT_CRT=y -# CONFIG_BIGINT_KARATSUBA is not set -MUL_KARATSUBA_THRESH=0 -SQU_KARATSUBA_THRESH=0 -CONFIG_BIGINT_SLIDING_WINDOW=y -CONFIG_BIGINT_SQUARE=y -# CONFIG_BIGINT_CHECK_ON is not set +# +# Automatically generated make config: don't edit +# +HAVE_DOT_CONFIG=y +# CONFIG_PLATFORM_LINUX is not set +# CONFIG_PLATFORM_CYGWIN is not set +# CONFIG_PLATFORM_SOLARIS is not set +CONFIG_PLATFORM_WIN32=y + +# +# General Configuration +# +PREFIX="" +# CONFIG_DEBUG is not set + +# +# Microsoft Compiler Options +# +# CONFIG_VISUAL_STUDIO_6_0 is not set +CONFIG_VISUAL_STUDIO_7_0=y +# CONFIG_VISUAL_STUDIO_8_0 is not set +CONFIG_VISUAL_STUDIO_6_0_BASE="" +CONFIG_VISUAL_STUDIO_7_0_BASE="c:\\Program Files\\Microsoft Visual Studio .NET 2003" +CONFIG_VISUAL_STUDIO_8_0_BASE="" +CONFIG_EXTRA_CFLAGS_OPTIONS="" +CONFIG_EXTRA_LDFLAGS_OPTIONS="" + +# +# SSL Library +# +# CONFIG_SSL_SERVER_ONLY is not set +# CONFIG_SSL_CERT_VERIFICATION is not set +# CONFIG_SSL_ENABLE_CLIENT is not set +CONFIG_SSL_FULL_MODE=y +# CONFIG_SSL_SKELETON_MODE is not set +# CONFIG_SSL_PROT_LOW is not set +CONFIG_SSL_PROT_MEDIUM=y +# CONFIG_SSL_PROT_HIGH is not set +CONFIG_SSL_USE_DEFAULT_KEY=y +CONFIG_SSL_ENABLE_V23_HANDSHAKE=y +CONFIG_SSL_HAS_PEM=y +CONFIG_SSL_USE_PKCS12=y +CONFIG_SSL_EXPIRY_TIME=24 +CONFIG_X509_MAX_CA_CERTS=4 +CONFIG_SSL_MAX_CERTS=2 +# CONFIG_SSL_CTX_MUTEXING is not set +# CONFIG_USE_DEV_URANDOM is not set +CONFIG_WIN32_USE_CRYPTO_LIB=y +# CONFIG_OPENSSL_COMPATIBLE is not set +# CONFIG_PERFORMANCE_TESTING is not set +# CONFIG_SSL_TEST is not set +CONFIG_AXHTTPD=y + +# +# Axhttpd Configuration +# +# CONFIG_HTTP_STATIC_BUILD is not set +CONFIG_HTTP_PORT=80 +CONFIG_HTTP_HTTPS_PORT=443 +CONFIG_HTTP_SESSION_CACHE_SIZE=5 +CONFIG_HTTP_WEBROOT="../www" +CONFIG_HTTP_TIMEOUT=300 + +# +# CGI +# +# CONFIG_HTTP_HAS_CGI is not set +CONFIG_HTTP_CGI_EXTENSIONS="" +# CONFIG_HTTP_ENABLE_LUA is not set +CONFIG_HTTP_LUA_PREFIX="" +# CONFIG_HTTP_BUILD_LUA is not set +CONFIG_HTTP_DIRECTORIES=y +CONFIG_HTTP_HAS_AUTHORIZATION=y +# CONFIG_HTTP_USE_CHROOT is not set +# CONFIG_HTTP_CHANGE_UID is not set +# CONFIG_HTTP_HAS_IPV6 is not set +# CONFIG_HTTP_VERBOSE is not set +# CONFIG_HTTP_IS_DAEMON is not set + +# +# Language Bindings +# +CONFIG_BINDINGS=y +CONFIG_CSHARP_BINDINGS=y +CONFIG_VBNET_BINDINGS=y + +# +# .Net Framework +# +CONFIG_DOT_NET_FRAMEWORK_BASE="c:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727" +CONFIG_JAVA_BINDINGS=y + +# +# Java Home +# +CONFIG_JAVA_HOME="c:\\Program Files\\Java\\jdk1.5.0_06" +# CONFIG_PERL_BINDINGS is not set +CONFIG_PERL_CORE="" +CONFIG_PERL_LIB="" +# CONFIG_LUA_BINDINGS is not set +CONFIG_LUA_CORE="" + +# +# Samples +# +CONFIG_SAMPLES=y +CONFIG_C_SAMPLES=y +CONFIG_CSHARP_SAMPLES=y +CONFIG_VBNET_SAMPLES=y +CONFIG_JAVA_SAMPLES=y +# CONFIG_PERL_SAMPLES is not set +# CONFIG_LUA_SAMPLES is not set + +# +# BigInt Options +# +# CONFIG_BIGINT_CLASSICAL is not set +# CONFIG_BIGINT_MONTGOMERY is not set +CONFIG_BIGINT_BARRETT=y +CONFIG_BIGINT_CRT=y +# CONFIG_BIGINT_KARATSUBA is not set +MUL_KARATSUBA_THRESH=0 +SQU_KARATSUBA_THRESH=0 +CONFIG_BIGINT_SLIDING_WINDOW=y +CONFIG_BIGINT_SQUARE=y +# CONFIG_BIGINT_CHECK_ON is not set From c928b27cd9ad8fc32d9719b8b717936834579409 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 26 May 2007 00:21:51 +0000 Subject: [PATCH 084/301] general checkin git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@103 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- bindings/java/Makefile | 22 +++++++++++----------- config/axhttpd.aip | 27 +++++++++++++-------------- config/win32config | 1 - httpd/Config.in | 6 +++--- ssl/test/ssltest.c | 2 +- www/index.html | 4 ++-- 6 files changed, 30 insertions(+), 32 deletions(-) diff --git a/bindings/java/Makefile b/bindings/java/Makefile index a1933b92fc..59aa6203b9 100644 --- a/bindings/java/Makefile +++ b/bindings/java/Makefile @@ -35,20 +35,20 @@ axTLSj_wrap.o : axTLSj_wrap.c JAVA_FILES= \ axtlsjJNI.java \ - axtlsjConstants.java \ - axtlsj.java \ - SSLReadHolder.java \ - SSL.java \ - SSLUtil.java \ - SSLCTX.java \ - SSLServer.java \ - SSLClient.java + axtlsjConstants.java \ + axtlsj.java \ + SSLReadHolder.java \ + SSL.java \ + SSLUtil.java \ + SSLCTX.java \ + SSLServer.java \ + SSLClient.java OBJ=axTLSj_wrap.o -AXOLOTLS_HOME=../.. -SSL_HOME=$(AXOLOTLS_HOME)/ssl -CONFIG_HOME=$(AXOLOTLS_HOME)/config +AXTLS_HOME=../.. +SSL_HOME=$(AXTLS_HOME)/ssl +CONFIG_HOME=$(AXTLS_HOME)/config JAVA_CLASSES:=$(JAVA_FILES:%.java=classes/axTLSj/%.class) ifdef CONFIG_PLATFORM_WIN32 diff --git a/config/axhttpd.aip b/config/axhttpd.aip index 0a3700fe25..2bac4caa67 100755 --- a/config/axhttpd.aip +++ b/config/axhttpd.aip @@ -1,5 +1,5 @@ - + @@ -8,10 +8,10 @@ - + - + @@ -63,18 +63,17 @@ - - - - - + + + + + - - + + - - + @@ -140,7 +139,7 @@ - - + + diff --git a/config/win32config b/config/win32config index ff5c3648bd..3e0b4223cb 100644 --- a/config/win32config +++ b/config/win32config @@ -109,7 +109,6 @@ CONFIG_CSHARP_SAMPLES=y CONFIG_VBNET_SAMPLES=y CONFIG_JAVA_SAMPLES=y # CONFIG_PERL_SAMPLES is not set -# CONFIG_LUA_SAMPLES is not set # # BigInt Options diff --git a/httpd/Config.in b/httpd/Config.in index 11f6b725dc..d7f8aba59f 100644 --- a/httpd/Config.in +++ b/httpd/Config.in @@ -57,7 +57,7 @@ menu "CGI" config CONFIG_HTTP_HAS_CGI bool "Enable CGI" - default n + default y depends on !CONFIG_PLATFORM_WIN32 help Enable the CGI capability. Not available on Win32 platforms. @@ -100,13 +100,13 @@ endmenu config CONFIG_HTTP_DIRECTORIES bool "Enable Directory Listing" - default n + default y help Enable directory listing. config CONFIG_HTTP_HAS_AUTHORIZATION bool "Enable authorization" - default n + default y help Pages/directories can have passwords associated with them. diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index ee2062b292..3e3d47fecb 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1647,7 +1647,7 @@ void do_multi_svr(SSL *ssl) int multi_thread_test(void) { - int server_fd; + int server_fd = -1; SSL_CTX *ssl_server_ctx; SSL_CTX *ssl_clnt_ctx; pthread_t clnt_threads[NUM_THREADS]; diff --git a/www/index.html b/www/index.html index 7d642714d1..989ebef0a9 100755 --- a/www/index.html +++ b/www/index.html @@ -7086,7 +7086,7 @@

    changes, notes and errata
    -
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Zero length client certificates were causing a crash (now they return an error).\n* The client session id size is now variable.\n* ssl_version() just returns the version number (and not the date).\n\n!!__axhttpd__\n\n* mime types are now greatly simplified (let the browser figure things out).\n* An error with CGI arguments was fixed.\n* The axhttpd version is now the same as the axtls version.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    !GNU LESSER GENERAL PUBLIC LICENSE\n\nVersion 2.1, February 1999\n\nCopyright (C) 1991, 1999 Free Software Foundation, Inc.\n51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA\nEveryone is permitted to copy and distribute verbatim copies\nof this license document, but changing it is not allowed.\n\n[This is the first released version of the Lesser GPL. It also counts\n as the successor of the GNU Library Public License, version 2, hence\n the version number 2.1.]\n\n!!Preamble\n\nThe licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software -to make sure the software is free for all its users.\n\nThis license, the Lesser General Public License, applies to some specially designated software packages - typically libraries - of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below.\n\nWhen we speak of free software, we are referring to freedom of use, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish); that you receive source code or can get it if you want it; that you can change the software and use pieces of it in new free programs; and that you are informed that you can do these things.\n\nTo protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library or if you modify it.\n\nFor example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights.\n\nWe protect your rights with a two-step method: (1) we copyright the library, and (2) we offer you this license, which gives you legal permission to copy, distribute and/or modify the library.\n\nTo protect each distributor, we want to make it very clear that there is no warranty for the free library. Also, if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others.\n\nFinally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license.\n\nMost GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs.\n\nWhen a program is linked with a library, whether statically or using a shared library, the combination of the two is legally speaking a combined work, a derivative of the original library. The ordinary General Public License therefore permits such linking only if the entire combination fits its criteria of freedom. The Lesser General Public License permits more lax criteria for linking other code with the library.\n\nWe call this license the "Lesser" General Public License because it does Less to protect the user's freedom than the ordinary General Public License. It also provides other free software developers Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances.\n\nFor example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License.\n\nIn other cases, permission to use a particular library in non-free programs enables a greater number of people to use a large body of free software. For example, permission to use the GNU C Library in non-free programs enables many more people to use the whole GNU operating system, as well as its variant, the GNU/Linux operating system.\n\nAlthough the Lesser General Public License is Less protective of the users' freedom, it does ensure that the user of a program that is linked with the Library has the freedom and the wherewithal to run that program using a modified version of the Library.\n\nThe precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, whereas the latter must be combined with the library in order to run.\n\n!!TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION\n\n0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you".\n\nA "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables.\n\nThe "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".)\n\n"Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library.\n\nActivities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does.\n\n1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library.\n\nYou may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.\n\n2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:\n\n * a) The modified work must itself be a software library.\n * b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change.\n * c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License.\n * d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful.\n\n (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.)\n\n These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.\n\n Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library.\n\n In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.\n\n3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices.\n\nOnce this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy.\n\nThis option is useful when you wish to copy part of the code of the Library into a program that is not a library.\n\n4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange.\n\nIf distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.\n\n5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License.\n\nHowever, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables.\n\nWhen a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law.\n\nIf such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.)\n\nOtherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself.\n\n6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications.\n\nYou must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things:\n\n * a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.)\n * b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with.\n * c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.\n * d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place.\n * e) Verify that the user has already received a copy of these materials or that you have already sent this user a copy.\n\nFor an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the materials to be distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.\n\nIt may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute.\n\n7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things:\n\n * a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above.\n * b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work.\n\n8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.\n\n9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it.\n\n10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License.\n\n11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library.\n\nIf any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances.\n\nIt is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.\n\nThis section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.\n\n12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.\n\n13. The Free Software Foundation may publish revised and/or new versions of the Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.\n\nEach version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation.\n\n14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.\n\nNO WARRANTY\n\n15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.\n\nEND OF TERMS AND CONDITIONS
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    @@ -7096,7 +7096,7 @@
    axTLS Embedded SSL
    http://axtls.cerocclub.com.au
    /***\nhttp://tiddlystyles.com/#theme:DevFire\nAuthor: Clint Checketts\n***/\n\n/*{{{*/\nbody {\nbackground: #000;\n}\n/*}}}*/\n/***\n!Link styles /% ============================================================= %/\n***/\n/*{{{*/\na,\na.button,\n#mainMenu a.button,\n#sidebarOptions .sliderPanel a{\n color: #ffbf00;\n border: 0;\n background: transparent;\n}\n\na:hover,\na.button:hover,\n#mainMenu a.button:hover,\n#sidebarOptions .sliderPanel a:hover\n#sidebarOptions .sliderPanel a:active{\n color: #ff7f00;\n border: 0;\n border-bottom: #ff7f00 1px dashed;\n background: transparent;\n text-decoration: none;\n}\n\n#displayArea .button.highlight{\n color: #ffbf00;\n background: #4c4c4c;\n}\n/*}}}*/\n/***\n!Header styles /% ============================================================= %/\n***/\n/*{{{*/\n.header{\n border-bottom: 2px solid #ffbf00;\n color: #fff;\n}\n\n.headerForeground a {\n color: #fff;\n}\n\n.header a:hover {\n border-bottom: 1px dashed #fff;\n}\n/*}}}*/\n/***\n!Main menu styles /% ============================================================= %/\n***/\n/*{{{*/\n#mainMenu {color: #fff;}\n#mainMenu h1{\n font-size: 1.1em;\n}\n#mainMenu li,#mainMenu ul{\n list-style: none;\n margin: 0;\n padding: 0;\n}\n/*}}}*/\n/***\n!Sidebar styles /% ============================================================= %/\n***/\n/*{{{*/\n#sidebar {\n right: 0;\n color: #fff;\n border: 2px solid #ffbf00;\n border-width: 0 0 2px 2px;\n}\n#sidebarOptions {\n background-color: #4c4c4c;\n padding: 0;\n}\n\n#sidebarOptions a{\n margin: 0;\n color: #ffbf00;\n border: 0;\n}\n#sidebarOptions a:hover {\n color: #4c4c4c;\n background-color: #ffbf00;\n\n}\n\n#sidebarOptions a:active {\n color: #ffbf00;\n background-color: transparent;\n}\n\n#sidebarOptions .sliderPanel {\n background-color: #333;\n margin: 0;\n}\n\n#sidebarTabs {background-color: #4c4c4c;}\n#sidebarTabs .tabSelected {\n padding: 3px 3px;\n cursor: default;\n color: #ffbf00;\n background-color: #666;\n}\n#sidebarTabs .tabUnselected {\n color: #ffbf00;\n background-color: #5f5f5f;\n padding: 0 4px;\n}\n\n#sidebarTabs .tabUnselected:hover,\n#sidebarTabs .tabContents {\n background-color: #666;\n}\n\n.listTitle{color: #FFF;}\n#sidebarTabs .tabContents a{\n color: #ffbf00;\n}\n\n#sidebarTabs .tabContents a:hover{\n color: #ff7f00;\n background: transparent;\n}\n\n#sidebarTabs .txtMoreTab .tabSelected,\n#sidebarTabs .txtMoreTab .tab:hover,\n#sidebarTabs .txtMoreTab .tabContents{\n color: #ffbf00;\n background: #4c4c4c;\n}\n\n#sidebarTabs .txtMoreTab .tabUnselected {\n color: #ffbf00;\n background: #5f5f5f;\n}\n\n.tab.tabSelected, .tab.tabSelected:hover{color: #ffbf00; border: 0; background-color: #4c4c4c;cursor:default;}\n.tab.tabUnselected {background-color: #666;}\n.tab.tabUnselected:hover{color:#ffbf00; border: 0;background-color: #4c4c4c;}\n.tabContents {\n background-color: #4c4c4c;\n border: 0;\n}\n.tabContents .tabContents{background: #666;}\n.tabContents .tabSelected{background: #666;}\n.tabContents .tabUnselected{background: #5f5f5f;}\n.tabContents .tab:hover{background: #666;}\n/*}}}*/\n/***\n!Message area styles /% ============================================================= %/\n***/\n/*{{{*/\n#messageArea {background-color: #666; color: #fff; border: 2px solid #ffbf00;}\n#messageArea a:link, #messageArea a:visited {color: #ffbf00; text-decoration:none;}\n#messageArea a:hover {color: #ff7f00;}\n#messageArea a:active {color: #ff7f00;}\n#messageArea .messageToolbar a{\n border: 1px solid #ffbf00;\n background: #4c4c4c;\n}\n/*}}}*/\n/***\n!Popup styles /% ============================================================= %/\n***/\n/*{{{*/\n.popup {color: #fff; background-color: #4c4c4c; border: 1px solid #ffbf00;}\n.popup li.disabled{color: #fff;}\n.popup a {color: #ffbf00; }\n.popup a:hover { background: transparent; color: #ff7f00; border: 0;}\n.popup hr {color: #ffbf00; background: #ffbf00;}\n/*}}}*/\n/***\n!Tiddler Display styles /% ============================================================= %/\n***/\n/*{{{*/\n.title{color: #fff;}\nh1, h2, h3, h4, h5 {\n color: #fff;\n background-color: transparent;\n border-bottom: 1px solid #333;\n}\n\n.subtitle{\n color: #666;\n}\n\n.viewer {color: #fff; }\n\n.viewer table{background: #666; color: #fff;}\n\n.viewer th {background-color: #996; color: #fff;}\n\n.viewer pre, .viewer code {color: #ddd; background-color: #4c4c4c; border: 1px solid #ffbf00;}\n\n.viewer hr {color: #666;}\n\n.tiddler .button {color: #4c4c4c;}\n.tiddler .button:hover { color: #ffbf00; background-color: #4c4c4c;}\n.tiddler .button:active {color: #ffbf00; background-color: #4c4c4c;}\n\n.toolbar {\n color: #4c4c4c;\n}\n\n.toolbar a.button,\n.toolbar a.button:hover,\n.toolbar a.button:active,\n.editorFooter a{\n border: 0;\n}\n\n.footer {\n color: #ddd;\n}\n\n.selected .footer {\n color: #888;\n}\n\n.highlight, .marked {\n color: #000;\n background-color: #ffe72f;\n}\n.editorFooter {\n color: #aaa;\n}\n\n.tab{\n-moz-border-radius-topleft: 3px;\n-moz-border-radius-topright: 3px;\n}\n\n.tagging,\n.tagged{\n background: #4c4c4c;\n border: 1px solid #4c4c4c; \n}\n\n.selected .tagging,\n.selected .tagged{\n background-color: #333;\n border: 1px solid #ffbf00;\n}\n\n.tagging .listTitle,\n.tagged .listTitle{\n color: #fff;\n}\n\n.tagging .button,\n.tagged .button{\n color: #ffbf00;\n border: 0;\n padding: 0;\n}\n\n.tagging .button:hover,\n.tagged .button:hover{\nbackground: transparent;\n}\n\n.selected .isTag .tagging.simple,\n.selected .tagged.simple,\n.isTag .tagging.simple,\n.tagged.simple {\n float: none;\n display: inline;\n border: 0;\n background: transparent;\n color: #fff;\n margin: 0;\n}\n\n.cascade {\n background: #4c4c4c;\n color: #ddd;\n border: 1px solid #ffbf00;\n}\n/*}}}*/
    -
    axhttpd is a small embedded web server using the axTLS library. It is based originally on the web server written by Doug Currie which is at http://www.hcsw.org/awhttpd.\n\n!@@bgcolor(#ff0000):color(#ffffff):axhttpd Features@@ \n\n!!__Basic Authentication__\n\nBasic Authentication uses a password file called ".htpasswd", in the directory to be protected. This file is formatted as the familiar colon-separated username/encrypted-password pair, records delimited by newlines. The protection does not carry over to subdirectories. The utility program htpasswd is included to help manually edit .htpasswd files.\n\nThe encryption of this password uses a proprietary algorithm due to the dependency of many crypt libraries on DES. An example is in [[/test_dir/no_http|https://127.0.0.1/test_dir/no_http]] (username 'abcd', password is '1234').\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__SSL Protection__\n\nDirectories/files can be accessed using the 'http' or 'https' uri prefix. If normal http access for a directory needs to be disabled, then put "~SSLRequireSSL" into a '.htaccess' file in the directory to be protected. \n\nConversely, use "~SSLDenySSL" to deny access to directories via SSL.\n\nAn example is in [[/test_dir/no_http|http://127.0.0.1/test_dir/no_http]] and [[/test_dir/no_ssl|https://127.0.0.1/test_dir/no_ssl]].\n\nEntire directories can be denied access with a "Deny all" directive (regardless of SSL or authentication). An example is in [[/test_dir/bin|http://127.0.0.1/test_dir/bin]]\n\n!!__CGI__\n\n//chroot()// is optionally now used for added security. However this has the impact of removing the regular filesystem, so any CGI applications no longer have the usual access (to things like /bin, /lib etc).\n\nSo any executables and libraries need to be copied into webroot.\n\nFailure to do so will result in mystical blank screens (and probably hundreds of axhttpd instances being created...).\n\n!!__Directory Listing__\n\nAn mconf option. Allow the files in directories to be displayed.\n\n!!__Other Features__\n\n* Timeout - HTTP 1.1 allows for persistent connections. This is the time allowed for this connection in seconds.\n* Daemon - Puts the process in daemon mode. \n* SSL session cache size - The size of the session cache (a heavily loaded server should maintain many sessions). A session will save on expensive SSL handshaking.\n\n
    +
    axhttpd is a small embedded web server using the axTLS library. It is based originally on the web server written by Doug Currie which is at http://www.hcsw.org/awhttpd.\n\n!@@bgcolor(#ff0000):color(#ffffff):axhttpd Features@@ \n\n!!__Basic Authentication__\n\nBasic Authentication uses a password file called ".htpasswd", in the directory to be protected. This file is formatted as the familiar colon-separated username/encrypted-password pair, records delimited by newlines. The protection does not carry over to subdirectories. The utility program htpasswd is included to help manually edit .htpasswd files.\n\nThe encryption of this password uses a proprietary algorithm due to the dependency of many crypt libraries on DES. An example is in [[/test_dir/no_http|https://127.0.0.1/test_dir/no_http]] (username 'abcd', password is '1234').\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__SSL Protection__\n\nDirectories/files can be accessed using the 'http' or 'https' uri prefix. If normal http access for a directory needs to be disabled, then put "~SSLRequireSSL" into a '.htaccess' file in the directory to be protected. \n\nConversely, use "~SSLDenySSL" to deny access to directories via SSL.\n\nAn example is in [[/test_dir/no_http|http://127.0.0.1/test_dir/no_http]] and [[/test_dir/no_ssl|https://127.0.0.1/test_dir/no_ssl]].\n\nEntire directories can be denied access with a "Deny all" directive (regardless of SSL or authentication). An example is in [[/test_dir/bin|http://127.0.0.1/test_dir/bin]]\n\n!!__CGI__\n\n//chroot()// is optionally now used for added security. However this has the impact of removing the regular filesystem, so any CGI applications no longer have the usual access (to things like /bin, /lib etc). Any executables and libraries need to be copied into webroot.\n\nMost of the CGI 1.1 variables are now placed into the script environment and should work as normal.\n\n!!__Lua and Lua Pages__\n\nThis is a small scripting language gaining popularity in embedded applications due to its small footprint and fast speed.\n\nLua has been incorporated into the build, so simply select it and it will automatically install. Try pointing your browser at [[/test_dir/test_variables.pl|http://127.0.0.1/test_dir/test_variables.lp]] to see an example of Lua Pages.\n\n!!__Directory Listing__\n\nAn mconf option. Allow the files in directories to be displayed. An example is in [[/test_dir|http://127.0.0.1/test_dir]]\n\n!!__Other Features__\n\n* Timeout - HTTP 1.1 allows for persistent connections. This is the time allowed for this connection in seconds.\n* Daemon - Puts the process in daemon mode. \n* SSL session cache size - The size of the session cache (a heavily loaded server should maintain many sessions). A session will save on expensive SSL handshaking.\n\n
    From 0d15b8be5b97e0fb4d244b8eaf64cdb5446013bb Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 4 Jun 2007 02:53:39 +0000 Subject: [PATCH 085/301] receive side now works git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@105 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- samples/lua/axssl.lua | 513 +++++++++++++++++++++--------------------- 1 file changed, 256 insertions(+), 257 deletions(-) diff --git a/samples/lua/axssl.lua b/samples/lua/axssl.lua index f1d9335868..68b8c7706d 100755 --- a/samples/lua/axssl.lua +++ b/samples/lua/axssl.lua @@ -1,7 +1,7 @@ -#!/usr/bin/lua +#!/usr/local/bin/lua -- -- --- Copyright(C) 2006 Cameron Rich +-- Copyright(C) 2007 Cameron Rich -- -- This program is free software; you can redistribute it and/or modify -- it under the terms of the GNU General Public License as published by @@ -34,13 +34,13 @@ -- by the OS. -- -- -local f = loadlib("axtlsl.dll", "luaopen_axtlsl") -f() +require "bit" +require("axtlsl") +local socket = require("socket") -- print version? - if #arg == 1 and arg[1] == "version" then - print("axssl.lua "..ssl_version().."\n") + print("axssl.lua "..axtlsl.ssl_version()) os.exit(1) end @@ -54,81 +54,144 @@ function print_options(option) end -- --- Main entry point. Doesn't do much except works out whether we are a client --- or a server. +-- We've had some sort of command-line error. Print out the server options. -- -if #arg < 1 or (arg[1] ~= "s_server" and arg[1] ~= "s_client") then - print_options(#arg > 0 and arg[1] or "") +function print_server_options(build_mode, option) + local cert_size = axtlsl.ssl_get_config(axtlsl.SSL_MAX_CERT_CFG_OFFSET) + local ca_cert_size = axtlsl.ssl_get_config( + axtlsl.SSL_MAX_CA_CERT_CFG_OFFSET) + + print("unknown option "..option) + print("usage: s_server [args ...]") + print(" -accept\t- port to accept on (default is 4433)") + print(" -quiet\t\t- No server output") + + if build_mode >= axtlsl.SSL_BUILD_SERVER_ONLY then + print(" -cert arg\t- certificate file to add (in addition to ".. + "default) to chain -") + print("\t\t Can repeat up to "..cert_size.." times") + print(" -key arg\t- Private key file to use - default DER format") + print(" -pass\t\t- private key file pass phrase source") + end + + if build_mode >= axtlsl.SSL_BUILD_ENABLE_VERIFICATION then + print(" -verify\t- turn on peer certificate verification") + print(" -CAfile arg\t- Certificate authority - default DER format") + print("\t\t Can repeat up to "..ca_cert_size.." times") + end + + if build_mode == axtlsl.SSL_BUILD_FULL_MODE then + print(" -debug\t\t- Print more output") + print(" -state\t\t- Show state messages") + print(" -show-rsa\t- Show RSA state") + end + + os.exit(1) end ---[[ -local build_mode = ssl_get_config(SSL_BUILD_MODE) -arg[1] eq "s_server" ? do_server(build_mode) : do_client(build_mode) +-- +-- We've had some sort of command-line error. Print out the client options. +-- +function print_client_options(build_mode, option) + local cert_size = axtlsl.ssl_get_config(axtlsl.SSL_MAX_CERT_CFG_OFFSET) + local ca_cert_size = axtlsl.ssl_get_config( + axtlsl.SSL_MAX_CA_CERT_CFG_OFFSET) + + print("unknown option "..option) + + if build_mode >= axtlsl.SSL_BUILD_ENABLE_CLIENT then + print("usage: s_client [args ...]") + print(" -connect host:port - who to connect to (default ".. + "is localhost:4433)") + print(" -verify\t- turn on peer certificate verification") + print(" -cert arg\t- certificate file to use - default DER format") + print(" -key arg\t- Private key file to use - default DER format") + print("\t\t Can repeat up to "..cert_size.." times") + print(" -CAfile arg\t- Certificate authority - default DER format") + print("\t\t Can repeat up to "..ca_cert_size.."times") + print(" -quiet\t\t- No client output") + print(" -pass\t\t- private key file pass phrase source") + print(" -reconnect\t- Drop and re-make the connection ".. + "with the same Session-ID") + + if build_mode == axtlsl.SSL_BUILD_FULL_MODE then + print(" -debug\t\t- Print more output") + print(" -state\t\t- Show state messages") + print(" -show-rsa\t- Show RSA state") + end + else + print("Change configuration to allow this feature") + end + + os.exit(1) +end -- Implement the SSL server logic. function do_server(build_mode) - local i = 1 + local i = 2 + local v local port = 4433 - local options = SSL_DISPLAY_CERTS + local options = axtlsl.SSL_DISPLAY_CERTS local quiet = false local password = nil local private_key_file = nil - local cert_size = ssl_get_config(SSL_MAX_CERT_CFG_OFFSET) - local ca_cert_size = ssl_get_config(SSL_MAX_CA_CERT_CFG_OFFSET) + local cert_size = axtlsl.ssl_get_config(axtlsl.SSL_MAX_CERT_CFG_OFFSET) + local ca_cert_size = axtlsl. + ssl_get_config(axtlsl.SSL_MAX_CA_CERT_CFG_OFFSET) local cert = {} local ca_cert = {} while i <= #arg do - if arg[i] eq "-accept" then + if arg[i] == "-accept" then if i >= #arg then print_server_options(build_mode, arg[i]) end i = i + 1 port = arg[i] - elseif arg[i] eq "-quiet" then + elseif arg[i] == "-quiet" then quiet = true - options = options & ~SSL_DISPLAY_CERTS - elseif build_mode >= SSL_BUILD_SERVER_ONLY then - if arg[i] eq "-cert" then - if i >= #arg >= cert_size-1 then + options = bit.band(options, bit.bnot(axtlsl.SSL_DISPLAY_CERTS)) + elseif build_mode >= axtlsl.SSL_BUILD_SERVER_ONLY then + if arg[i] == "-cert" then + if i >= #arg or #cert >= cert_size then print_server_options(build_mode, arg[i]) end i = i + 1 - cert[i] = arg[i] - elseif arg[i] eq "-key" then + table.insert(cert, arg[i]) + elseif arg[i] == "-key" then if i >= #arg then print_server_options(build_mode, arg[i]) end i = i + 1 private_key_file = arg[i] - options = options | SSL_NO_DEFAULT_KEY - elseif arg[i] eq "-pass" then + options = bit.bor(options, axtlsl.SSL_NO_DEFAULT_KEY) + elseif arg[i] == "-pass" then if i >= #arg then print_server_options(build_mode, arg[i]) end i = i + 1 password = arg[i] - elseif build_mode >= SSL_BUILD_ENABLE_VERIFICATION then - if arg[i] eq "-verify" then - options = options | SSL_CLIENT_AUTHENTICATION - elseif arg[i] eq "-CAfile" then - if i >= #arg >= ca_cert_size-1 then + elseif build_mode >= axtlsl.SSL_BUILD_ENABLE_VERIFICATION then + if arg[i] == "-verify" then + options = bit.bor(options, axtlsl.SSL_CLIENT_AUTHENTICATION) + elseif arg[i] == "-CAfile" then + if i >= #arg or #ca_cert >= ca_cert_size then print_server_options(build_mode, arg[i]) end i = i + 1 - ca_cert[i] = arg[i] - elseif build_mode == SSL_BUILD_FULL_MODE then - if arg[i] eq "-debug" then - options = options | SSL_DISPLAY_BYTES - elseif arg[i] eq "-state" then - options = options | SSL_DISPLAY_STATES - elseif arg[i] eq "-show-rsa" then - options = options | SSL_DISPLAY_RSA + table.insert(ca_cert, arg[i]) + elseif build_mode == axtlsl.SSL_BUILD_FULL_MODE then + if arg[i] == "-debug" then + options = bit.bor(options, axtlsl.SSL_DISPLAY_BYTES) + elseif arg[i] == "-state" then + options = bit.bor(options, axtlsl.SSL_DISPLAY_STATES) + elseif arg[i] == "-show-rsa" then + options = bit.bor(options, axtlsl.SSL_DISPLAY_RSA) else print_server_options(build_mode, arg[i]) end @@ -145,168 +208,168 @@ function do_server(build_mode) i = i + 1 end - -- Create socket for incoming connections - local server_sock = IO::Socket::INET->new(Proto => 'tcp', - LocalPort => port, - Listen => 1, - Reuse => 1) or die ! - --------------------------------------------------------------------------- -- This is where the interesting stuff happens. Up until now we've -- just been setting up sockets etc. Now we do the SSL handshake. --------------------------------------------------------------------------- - local ssl_ctx = ssl_ctx_new(options, SSL_DEFAULT_SVR_SESS) + local ssl_ctx = axtlsl.ssl_ctx_new(options, axtlsl.SSL_DEFAULT_SVR_SESS) if ssl_ctx == nil then error("Error: Server context is invalid") end - if nil private_key_file then - local obj_type = SSL_OBJ_RSA_KEY + if private_key_file ~= nil then + local obj_type = axtlsl.SSL_OBJ_RSA_KEY + + if string.find(private_key_file, ".p8") then + obj_type = axtlsl.SSL_OBJ_PKCS8 + end - if private_key_file =~ /.p8/ then obj_type = SSL_OBJ_PKCS8 end - if private_key_file =~ /.p12/ then obj_type = SSL_OBJ_PKCS12 end + if string.find(private_key_file, ".p12") then + obj_type = axtlsl.SSL_OBJ_PKCS12 + end - if ssl_obj_load(ssl_ctx, obj_type, private_key_file, password) then - error("Private key 'private_key_file' is nilined.") + if axtlsl.ssl_obj_load(ssl_ctx, obj_type, + private_key_file, password) then + error("Private key '" .. private_key_file .. "' is undefined.") end end - foreach (@cert) - if ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CERT, _, nil) #arg= SSL_OK then - error("Certificate '_' is undefined.") + for _, v in ipairs(cert) do + if axtlsl.ssl_obj_load(ssl_ctx, axtlsl.SSL_OBJ_X509_CERT, v, "") + ~= axtlsl.SSL_OK then + error("Certificate '"..v .. "' is undefined.") end end - foreach (@ca_cert) - if ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CACERT, _, nil) #arg= SSL_OK then - error("Certificate '_' is undefined.") + for _, v in ipairs(ca_cert) do + if axtlsl.ssl_obj_load(ssl_ctx, axtlsl.SSL_OBJ_X509_CACERT, v, "") + ~= axtlsl.SSL_OK then + error("Certificate '"..v .."' is undefined.") end end - while true do - if not quiet then print("ACCEPT\n") end - local client_sock = server_sock->accept - local native_sock = get_native_sock(client_sock->fileno) + -- Create socket for incoming connections + local server_sock = socket.try(socket.bind("*", port)) + local connected = false - -- This doesn't work in Win32 - need to get file descriptor from socket. - local ssl = ssl_server_new(ssl_ctx, native_sock) + while true do + if not quiet then print("ACCEPT") end + local client_sock = server_sock:accept(); + local ssl = axtlsl.ssl_server_new(ssl_ctx, client_sock:getfd()) -- do the actual SSL handshake local res local buf while true do - (res, buf) = ssl_read(ssl, nil) - if res #arg= SSL_OK then break end - - -- check when the connection has been established - if ssl_handshake_status(ssl) == SSL_OK then break end - -- could do something else here - end + socket.select({client_sock}, nil) + res, buf = axtlsl.ssl_read(ssl) - if res == SSL_OK then -- connection established and ok - if not quiet then - display_session_id(ssl) - display_cipher(ssl) + if res == axtlsl.SSL_OK then -- connection established and ok + -- check when the connection has been established + if axtlsl.ssl_handshake_status(ssl) == axtlsl.SSL_OK then + if not quiet and not connected then + display_session_id(ssl) + display_cipher(ssl) + end + connected = true + end end - -- now read (and display) whatever the client sends us - while true do - -- keep reading until we get something interesting - while true do - (res, buf) = ssl_read(ssl, nil) - if res #arg= SSL_OK then break end - - -- could do something else here + if res > axtlsl.SSL_OK then + for _, v in ipairs(buf) do + io.write(string.format("%c", v)) end - - if res < SSL_OK then - if not quiet then print("CONNECTION CLOSED\n") end - break + elseif res < axtlsl.SSL_OK then + if not quiet then + axtlsl.ssl_display_error(res) + print("CONNECTION CLOSED") end - - print(buf) + break end - elseif not quiet then - ssl_display_error(res) end -- client was disconnected or the handshake failed. - ssl_free(ssl) - client_sock->close + + axtlsl.ssl_free(ssl) + client_sock:close() end - ssl_ctx_free(ssl_ctx) + axtlsl.ssl_ctx_free(ssl_ctx) end -- -- Implement the SSL client logic. -- function do_client(build_mode) - local i = 1 + local i = 2 + local v local port = 4433 - local options = SSL_SERVER_VERIFY_LATER|SSL_DISPLAY_CERTS + local options = bit.bor(axtlsl.SSL_SERVER_VERIFY_LATER, SSL_DISPLAY_CERTS) local private_key_file = nil local reconnect = 0 local quiet = false local password = nil local session_id = {} local host = "127.0.0.1" - local @cert - local @ca_cert - local cert_size = ssl_get_config(SSL_MAX_CERT_CFG_OFFSET) - local ca_cert_size = ssl_get_config(SSL_MAX_CA_CERT_CFG_OFFSET) + local cert_size = axtlsl.ssl_get_config(axtlsl.SSL_MAX_CERT_CFG_OFFSET) + local ca_cert_size = axtlsl. + ssl_get_config(axtlsl.SSL_MAX_CA_CERT_CFG_OFFSET) + local cert = {} + local ca_cert = {} while i <= #arg do - if arg[i] eq "-connect" then + if arg[i] == "-connect" then if i >= #arg then print_client_options(build_mode, arg[i]) end i = i + 1 - (host, port) = split(':', arg[i]) - elseif arg[i] eq "-cert" then + -- TODO + --(host, port) = split(':', arg[i]) + elseif arg[i] == "-cert" then if i >= #arg >= cert_size-1 then print_client_options(build_mode, arg[i]) end i = i + 1 - cert[i] = arg[i] - elseif arg[i] eq "-key" then + table.insert(cert, arg[i]) + elseif arg[i] == "-key" then if i >= #arg then print_client_options(build_mode, arg[i]) end i = i + 1 private_key_file = arg[i] - options |= SSL_NO_DEFAULT_KEY - elseif arg[i] eq "-CAfile" then + options = bit.bor(options, axtlsl.SSL_NO_DEFAULT_KEY) + elseif arg[i] == "-CAfile" then if i >= #arg >= ca_cert_size-1 then print_client_options(build_mode, arg[i]) end i = i + 1 - ca_cert[i] = arg[i] - elseif arg[i] eq "-verify" then - options &= ~SSL_SERVER_VERIFY_LATER - elseif arg[i] eq "-reconnect" then + table.insert(ca_cert, arg[i]) + elseif arg[i] == "-verify" then + options = bit.band(options, + bit.bnot(axtlsl.SSL_SERVER_VERIFY_LATER)) + elseif arg[i] == "-reconnect" then reconnect = 4 - elseif arg[i] eq "-quiet" then + elseif arg[i] == "-quiet" then quiet = true - options &= ~SSL_DISPLAY_CERTS - elseif arg[i] eq "-pass" then + options = bit.band(options, bnot(axtlsl.SSL_DISPLAY_CERTS)) + elseif arg[i] == "-pass" then if i >= #arg then print_server_options(build_mode, arg[i]) end i = i + 1 password = arg[i] - elseif build_mode == SSL_BUILD_FULL_MODE then - if arg[i] eq "-debug" then - options = options | SSL_DISPLAY_BYTES - elseif arg[i] eq "-state" then - options = options | SSL_DISPLAY_STATES - elseif arg[i] eq "-show-rsa" then - options = options | SSL_DISPLAY_RSA + elseif build_mode == axtlsl.SSL_BUILD_FULL_MODE then + if arg[i] == "-debug" then + options = bit.bor(options, axtlsl.SSL_DISPLAY_BYTES) + elseif arg[i] == "-state" then + options = bit.bor(axtlsl.SSL_DISPLAY_STATES) + elseif arg[i] == "-show-rsa" then + options = bit.bor(axtlsl.SSL_DISPLAY_RSA) else -- don't know what this is print_client_options(build_mode, arg[i]) end @@ -317,49 +380,50 @@ function do_client(build_mode) i = i + 1 end - local client_sock = new IO::Socket::INET ( - PeerAddr => host, PeerPort => port, Proto => 'tcp') - or error("no socket: !") + local client_sock = assert(socket.connect(host, port)) local ssl local res - local native_sock = get_native_sock(client_sock->fileno) - if not quiet then print("CONNECTED\n") end + if not quiet then print("CONNECTED") end --------------------------------------------------------------------------- -- This is where the interesting stuff happens. Up until now we've -- just been setting up sockets etc. Now we do the SSL handshake. --------------------------------------------------------------------------- - local ssl_ctx = ssl_ctx_new(options, SSL_DEFAULT_CLNT_SESS) + local ssl_ctx = axtlsl.ssl_ctx_new(options, axtlsl.SSL_DEFAULT_CLNT_SESS) if ssl_ctx == nil then error("Error: Client context is invalid") end - if private_key_file not nil then - local obj_type = SSL_OBJ_RSA_KEY + if private_key_file ~= nil then + local obj_type = axtlsl.SSL_OBJ_RSA_KEY - if private_key_file =~ /.p8/ then - obj_type = SSL_OBJ_PKCS8 + if string.find(private_key_file, ".p8") then + obj_type = axtlsl.SSL_OBJ_PKCS8 end - if private_key_file =~ /.p12/ then - obj_type = SSL_OBJ_PKCS12 + + if string.find(private_key_file, ".p12") then + obj_type = axtlsl.SSL_OBJ_PKCS12 end - if ssl_obj_load(ssl_ctx, obj_type, private_key_file, password) then - error("Private key 'private_key_file' is undefined.") + if axtlsl.ssl_obj_load(ssl_ctx, obj_type, + private_key_file, password) then + error("Private key '"..private_key_file.."' is undefined.") end end - foreach (@cert) - if ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CERT, _, nil) then - error("Certificate '_' is undefined.") + for _, v in ipairs(cert) do + if axtlsl.ssl_obj_load(ssl_ctx, axtlsl.SSL_OBJ_X509_CERT, v, "") + ~= axtlsl.SSL_OK then + error("Certificate '"..v .. "' is undefined.") end end - foreach (@ca_cert) - if ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CACERT, _, nil) then - error("Certificate '_' is undefined.") + for _, v in ipairs(ca_cert) do + if axtlsl.ssl_obj_load(ssl_ctx, axtlsl.SSL_OBJ_X509_CACERT, v, "") + ~= axtlsl.SSL_OK then + error("Certificate '"..v .."' is undefined.") end end @@ -368,168 +432,103 @@ function do_client(build_mode) local session_id = nil while reconnect do reconnect = reconnect - 1 - ssl = ssl_client_new(ssl_ctx, native_sock, session_id) + ssl = axtlsl.ssl_client_new(ssl_ctx, client_sock:getfd(), session_id) res = ssl_handshake_status(ssl) - if res #arg= SSL_OK then - if not quiet then ssl_display_error(res) end - ssl_free(ssl) + if res ~= axtlsl.SSL_OK then + if not quiet then axtlsl.ssl_display_error(res) end + axtlsl.ssl_free(ssl) os.exit(1) end display_session_id(ssl) - session_id = ssl_get_session_id(ssl) + session_id = axtlsl.ssl_get_session_id(ssl) if reconnect then ssl_free(ssl) - client_sock->close - client_sock = new IO::Socket::INET ( - PeerAddr => host, PeerPort => port, Proto => 'tcp') - or error ("no socket: !") - + client_sock:close() + client_sock = assert(socket.connect(host, port)) end end else - ssl = ssl_client_new(ssl_ctx, native_sock, nil) + ssl = axtlsl.ssl_client_new(ssl_ctx, client_sock:getfd(), nil) end -- check the return status - res = ssl_handshake_status(ssl) - if res #arg= SSL_OK then - if not quiet then ssl_display_error(res) end + res = axtlsl.ssl_handshake_status(ssl) + if res ~= axtlsl.SSL_OK then + if not quiet then axtlsl.ssl_display_error(res) end os.exit(1) end if not quiet then - local common_name = ssl_get_cert_dn(ssl, - SSL_X509_CERT_COMMON_NAME) + local common_name = axtlsl.ssl_get_cert_dn(ssl, + axtlsl.SSL_X509_CERT_COMMON_NAME) - if common_name not nil then - print("Common Name:\t\t%s\n", common_name) + if common_name ~= nil then + print("Common Name:\t\t"..common_name) end display_session_id(ssl) display_cipher(ssl) end - while do - local cstring = pack("a*x", _); -- add null terminator - res = ssl_write(ssl, \cstring, length(cstring)) - if res < SSL_OK then - if not quiet then ssl_display_error(res) end + -- while do + while true do + local cstring = pack("a*x", _) -- add null terminator + res = axtlsl.ssl_write(ssl, cstring, length(cstring)) + if res < axtlsl.SSL_OK then + if not quiet then axtlsl.ssl_display_error(res) end break end end - ssl_ctx_free(ssl_ctx) - client_sock->close -end - --- --- We've had some sort of command-line error. Print out the server options. --- -function print_server_options(build_mode, option) - local cert_size = ssl_get_config(SSL_MAX_CERT_CFG_OFFSET) - local ca_cert_size = ssl_get_config( - SSL_MAX_CA_CERT_CFG_OFFSET) - - print("unknown option "..option.."") - print("usage: s_server [args ...]") - print(" -accept\t\t- port to accept on (default is 4433)") - print(" -quiet\t\t- No server output\n") - - if build_mode >= SSL_BUILD_SERVER_ONLY then - print(" -cert arg\t- certificate file to add (in addition to default then". - " to chain -". - "\t\t default DER format. Can repeat up to %d times\n", cert_size) - print(" -key arg\t- Private key file to use - default DER format") - print(" -pass\t\t- private key file pass phrase source") - end - - if build_mode >= SSL_BUILD_ENABLE_VERIFICATION then - print(" -verify\t- turn on peer certificate verification") - print(" -CAfile arg\t- Certificate authority - default DER format") - print("\t\t Can repeat up to %d times\n", ca_cert_size) - end - - if build_mode == SSL_BUILD_FULL_MODE then - print(" -debug\t\t- Print more output") - print(" -state\t\t- Show state messages") - print(" -show-rsa\t- Show RSA state") - end - - os.exit(1) -end - --- --- We've had some sort of command-line error. Print out the client options. --- -function print_client_options(build_mode, option) - local cert_size = ssl_get_config(SSL_MAX_CERT_CFG_OFFSET) - local ca_cert_size = ssl_get_config( - SSL_MAX_CA_CERT_CFG_OFFSET) - - print("unknown option %s\n", option) - - if build_mode >= SSL_BUILD_ENABLE_CLIENT then - print("usage: s_client [args ...]") - print(" -connect host:port - who to connect to (default ".. - "is localhost:4433)") - print(" -verify\t- turn on peer certificate verification") - print(" -cert arg\t- certificate file to use - default DER format") - print(" -key arg\t- Private key file to use - default DER format") - print("\t\t Can repeat up to %d times\n", cert_size) - print(" -CAfile arg\t- Certificate authority - default DER format") - print("\t\t Can repeat up to %d times\n", ca_cert_size) - print(" -quiet\t\t- No client output") - print(" -pass\t\t- private key file pass phrase source") - print(" -reconnect\t- Drop and re-make the connection ".. - "with the same Session-ID") - - if build_mode == SSL_BUILD_FULL_MODE then - print(" -debug\t\t- Print more output") - print(" -state\t\t- Show state messages") - print(" -show-rsa\t- Show RSA state\n") - end - else - print("Change configuration to allow this feature") - end - - os.exit(1) + axtlsl.ssl_ctx_free(ssl_ctx) + client_sock:close() end -- -- Display what cipher we are using -- -function display_cipher(ss) - local (ssl) = @_ - print("CIPHER is ") - local cipher_id = ssl_get_cipher_id(ssl) +function display_cipher(ssl) + io.write("CIPHER is ") + local cipher_id = axtlsl.ssl_get_cipher_id(ssl) - if cipher_id == SSL_AES128_SHA then + if cipher_id == axtlsl.SSL_AES128_SHA then print("AES128-SHA") - elseif cipher_id == SSL_AES256_SHA then + elseif cipher_id == axtlsl.SSL_AES256_SHA then print("AES256-SHA") - elseif SSL_RC4_128_SHA then + elseif axtlsl.SSL_RC4_128_SHA then print("RC4-SHA") - elseif SSL_RC4_128_MD5 then + elseif axtlsl.SSL_RC4_128_MD5 then print("RC4-MD5") else - print("Unknown - %d", cipher_id) + print("Unknown - "..cipher_id) end - - print("\n") end -- -- Display what session id we have. -- -function display_session_id(ss) - local session_id = ssl_get_session_id(ssl) +function display_session_id(ssl) + local session_id = axtlsl.ssl_get_session_id(ssl) + local i, v + + print("-----BEGIN SSL SESSION PARAMETERS-----") + for _, v in ipairs(session_id) do + io.write(string.format("%02x", v)) + end + print("\n-----END SSL SESSION PARAMETERS-----") +end - print("-----BEGIN SSL SESSION PARAMETERS-----\n") - print(unpack("H*", session_id)) - print("\n-----END SSL SESSION PARAMETERS-----\n") +-- +-- Main entry point. Doesn't do much except works out whether we are a client +-- or a server. +-- +if #arg == 0 or (arg[1] ~= "s_server" and arg[1] ~= "s_client") then + print_options(#arg > 0 and arg[1] or "") end ---]] + +local build_mode = axtlsl.ssl_get_config(axtlsl.SSL_BUILD_MODE) +_ = arg[1] == "s_server" and do_server(build_mode) or do_client(build_mode) From 9efcfbaf812f1945d8bfc9bc20db55898417286a Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 4 Jun 2007 02:54:19 +0000 Subject: [PATCH 086/301] server side now works git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@106 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- bindings/generate_SWIG_interface.pl | 30 +++++++++++++++++++++++++---- bindings/lua/Makefile | 8 +++----- 2 files changed, 29 insertions(+), 9 deletions(-) diff --git a/bindings/generate_SWIG_interface.pl b/bindings/generate_SWIG_interface.pl index e21873d5be..653829ebf9 100755 --- a/bindings/generate_SWIG_interface.pl +++ b/bindings/generate_SWIG_interface.pl @@ -300,10 +300,6 @@ sub parseFile } } -%typemap(freearg) unsigned char *in_data { - free(buf\$argnum); -} - /* for ssl_client_new() */ %typemap(in) const unsigned char session_id[] { /* check for a reference */ @@ -321,6 +317,32 @@ sub parseFile /* Some SWIG magic to make the API a bit more Lua friendly */ #ifdef SWIGLUA +/* for ssl_session_id() */ +%typemap(out) const unsigned char * { + int i; + lua_newtable(L); + for (i = 0; i < SSL_SESSION_ID_SIZE; i++){ + lua_pushnumber(L,(lua_Number)result[i]); + lua_rawseti(L,-2,i+1); /* -1 is the number, -2 is the table */ + } + SWIG_arg++; +} + +%typemap(in) unsigned char **in_data (unsigned char *buf) { + \$1 = &buf; +} + +%typemap(argout) unsigned char **in_data { + if (result > SSL_OK) { + int i; + lua_newtable(L); + for (i = 0; i < result; i++){ + lua_pushnumber(L,(lua_Number)buf2[i]); + lua_rawseti(L,-2,i+1); /* -1 is the number, -2 is the table */ + } + SWIG_arg++; + } +} #endif END diff --git a/bindings/lua/Makefile b/bindings/lua/Makefile index 771c1acb88..d256c7ddf5 100644 --- a/bindings/lua/Makefile +++ b/bindings/lua/Makefile @@ -24,7 +24,7 @@ all: lib ifdef CONFIG_PLATFORM_WIN32 TARGET=../../$(STAGE)/axtlsl.dll else -TARGET=../../$(STAGE)/libaxtlsl.so +TARGET=../../$(STAGE)/axtlsl.so endif ifneq ($(MAKECMDGOALS), clean) @@ -36,11 +36,9 @@ CONFIG_HOME=$(AXTLS_HOME)/config OBJ:=axTLSl_wrap.o include ../../config/makefile.post +# libaxtls has to be linked in as a single object for this (TODO: see if this is completely necessary) $(TARGET) : $(OBJ) - $(LD) $(LDFLAGS) -L ../../$(STAGE) -L $(CONFIG_LUA_CORE)/lib $(LDSHARED) -o $@ $(OBJ) -laxtls -llua -ifdef CONFIG_PLATFORM_CYGWIN - cd ../../$(STAGE); ln -sf $(notdir $@) axtlsl.dll -endif + $(LD) $(LDFLAGS) -L$(CONFIG_LUA_CORE)/lib $(LDSHARED) -o $@ $(OBJ) ../../$(STAGE)/libaxtls.a -llua CFLAGS += -I$(CONFIG_HOME) -I$(SSL_HOME) -I $(CONFIG_LUA_CORE)/include else From 950d7ae488c1fd5ca9778784af0e6a29216e0565 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 14 Jun 2007 22:53:14 +0000 Subject: [PATCH 087/301] speed improvements to the rc4 cipher git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@107 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/crypto.h | 2 +- ssl/rc4.c | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/ssl/crypto.h b/ssl/crypto.h index 9bf446f246..d4e4bc0163 100644 --- a/ssl/crypto.h +++ b/ssl/crypto.h @@ -64,7 +64,7 @@ void AES_convert_key(AES_CTX *ctx); typedef struct { - int x, y, m[256]; + uint8_t x, y, m[256]; } RC4_CTX; void RC4_setup(RC4_CTX *s, const uint8_t *key, int length); diff --git a/ssl/rc4.c b/ssl/rc4.c index 7250a669b7..83e4363dd0 100644 --- a/ssl/rc4.c +++ b/ssl/rc4.c @@ -29,7 +29,8 @@ */ void RC4_setup(RC4_CTX *ctx, const uint8_t *key, int length) { - int i, j = 0, k = 0, *m, a; + int i, j = 0, k = 0, a; + uint8_t *m; ctx->x = 0; ctx->y = 0; @@ -56,7 +57,8 @@ void RC4_setup(RC4_CTX *ctx, const uint8_t *key, int length) */ void RC4_crypt(RC4_CTX *ctx, const uint8_t *msg, uint8_t *out, int length) { - int i, x, y, *m, a, b; + int i; + uint8_t *m, x, y, a, b; out = (uint8_t *)msg; x = ctx->x; @@ -65,9 +67,8 @@ void RC4_crypt(RC4_CTX *ctx, const uint8_t *msg, uint8_t *out, int length) for (i = 0; i < length; i++) { - x = (uint8_t)(x + 1); - a = m[x]; - y = (uint8_t)(y + a); + a = m[++x]; + y += a; m[x] = b = m[y]; m[y] = a; out[i] ^= m[(uint8_t)(a + b)]; From c8cb14d9de7f95b196a605750e813d4661a5ca0f Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 14 Jun 2007 23:36:01 +0000 Subject: [PATCH 088/301] improvements to Lua binding git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@108 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- bindings/generate_SWIG_interface.pl | 25 ++++++++++++++++++++++--- bindings/lua/Makefile | 3 +++ 2 files changed, 25 insertions(+), 3 deletions(-) diff --git a/bindings/generate_SWIG_interface.pl b/bindings/generate_SWIG_interface.pl index 653829ebf9..b1fbb39817 100755 --- a/bindings/generate_SWIG_interface.pl +++ b/bindings/generate_SWIG_interface.pl @@ -37,11 +37,17 @@ sub transformSignature $line =~ s/const uint8_t \*(\w+)/const signed char $1\[\]/g; $line =~ s/uint8_t/signed char/g; } - else + elsif ($ARGV[0] eq "-perl") { $line =~ s/const uint8_t \*(\w+)/const unsigned char $1\[\]/g; $line =~ s/uint8_t/unsigned char/g; } + else # lua + { + $line =~ s/const uint8_t \*session_id/const unsigned char session_id\[\]/g; + $line =~ s/const uint8_t \*\w+/unsigned char *INPUT/g; + $line =~ s/uint8_t/unsigned char/g; + } } return $line; @@ -144,8 +150,8 @@ sub parseFile open(DATA_OUT, ">$interfaceFile") || die("Cannot Open File"); # -# I wish I could say it was easy to generate the Perl/Java bindings, but each -# had their own set of challenges... :-(. +# I wish I could say it was easy to generate the Perl/Java/Lua bindings, +# but each had their own set of challenges... :-(. # print DATA_OUT << "END"; %module $module\n @@ -317,6 +323,9 @@ sub parseFile /* Some SWIG magic to make the API a bit more Lua friendly */ #ifdef SWIGLUA +SWIG_NUMBER_TYPEMAP(unsigned char); +SWIG_TYPEMAP_NUM_ARR(uchar,unsigned char); + /* for ssl_session_id() */ %typemap(out) const unsigned char * { int i; @@ -328,6 +337,7 @@ sub parseFile SWIG_arg++; } +/* for ssl_read() */ %typemap(in) unsigned char **in_data (unsigned char *buf) { \$1 = &buf; } @@ -343,6 +353,15 @@ sub parseFile SWIG_arg++; } } + +/* for ssl_client_new() */ +%typemap(in) const unsigned char session_id[] { + if(!lua_isnumber(L,\$input)) + \$1 = NULL; + else + \$1 = SWIG_get_uint_num_array_fixed(L,\$input, SSL_SESSION_ID_SIZE); +} + #endif END diff --git a/bindings/lua/Makefile b/bindings/lua/Makefile index d256c7ddf5..69c5c7b154 100644 --- a/bindings/lua/Makefile +++ b/bindings/lua/Makefile @@ -36,6 +36,9 @@ CONFIG_HOME=$(AXTLS_HOME)/config OBJ:=axTLSl_wrap.o include ../../config/makefile.post +# there are a few static functions that aren't used +CFLAGS += -funit-at-a-time + # libaxtls has to be linked in as a single object for this (TODO: see if this is completely necessary) $(TARGET) : $(OBJ) $(LD) $(LDFLAGS) -L$(CONFIG_LUA_CORE)/lib $(LDSHARED) -o $@ $(OBJ) ../../$(STAGE)/libaxtls.a -llua From 9d7c8e79dc426e7bf204e0afcbdb0d8dbb8bed5b Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 14 Jun 2007 23:36:26 +0000 Subject: [PATCH 089/301] improvements to Lua sample git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@109 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- samples/lua/axssl.lua | 51 ++++++++++++++++++++++--------------------- 1 file changed, 26 insertions(+), 25 deletions(-) diff --git a/samples/lua/axssl.lua b/samples/lua/axssl.lua index 68b8c7706d..433a622823 100755 --- a/samples/lua/axssl.lua +++ b/samples/lua/axssl.lua @@ -248,7 +248,6 @@ function do_server(build_mode) -- Create socket for incoming connections local server_sock = socket.try(socket.bind("*", port)) - local connected = false while true do if not quiet then print("ACCEPT") end @@ -256,16 +255,15 @@ function do_server(build_mode) local ssl = axtlsl.ssl_server_new(ssl_ctx, client_sock:getfd()) -- do the actual SSL handshake + local connected = false local res local buf while true do - socket.select({client_sock}, nil) res, buf = axtlsl.ssl_read(ssl) if res == axtlsl.SSL_OK then -- connection established and ok - -- check when the connection has been established if axtlsl.ssl_handshake_status(ssl) == axtlsl.SSL_OK then if not quiet and not connected then display_session_id(ssl) @@ -282,14 +280,13 @@ function do_server(build_mode) elseif res < axtlsl.SSL_OK then if not quiet then axtlsl.ssl_display_error(res) - print("CONNECTION CLOSED") end break end end -- client was disconnected or the handshake failed. - + print("CONNECTION CLOSED") axtlsl.ssl_free(ssl) client_sock:close() end @@ -304,7 +301,8 @@ function do_client(build_mode) local i = 2 local v local port = 4433 - local options = bit.bor(axtlsl.SSL_SERVER_VERIFY_LATER, SSL_DISPLAY_CERTS) + local options = + bit.bor(axtlsl.SSL_SERVER_VERIFY_LATER, axtlsl.SSL_DISPLAY_CERTS) local private_key_file = nil local reconnect = 0 local quiet = false @@ -324,10 +322,11 @@ function do_client(build_mode) end i = i + 1 - -- TODO - --(host, port) = split(':', arg[i]) + local t = string.find(arg[i], ":") + host = string.sub(arg[i], 1, t-1) + port = string.sub(arg[i], t+1) elseif arg[i] == "-cert" then - if i >= #arg >= cert_size-1 then + if i >= #arg or #cert >= cert_size then print_client_options(build_mode, arg[i]) end @@ -342,7 +341,7 @@ function do_client(build_mode) private_key_file = arg[i] options = bit.bor(options, axtlsl.SSL_NO_DEFAULT_KEY) elseif arg[i] == "-CAfile" then - if i >= #arg >= ca_cert_size-1 then + if i >= #arg or #ca_cert >= ca_cert_size then print_client_options(build_mode, arg[i]) end @@ -380,16 +379,6 @@ function do_client(build_mode) i = i + 1 end - local client_sock = assert(socket.connect(host, port)) - local ssl - local res - - if not quiet then print("CONNECTED") end - - --------------------------------------------------------------------------- - -- This is where the interesting stuff happens. Up until now we've - -- just been setting up sockets etc. Now we do the SSL handshake. - --------------------------------------------------------------------------- local ssl_ctx = axtlsl.ssl_ctx_new(options, axtlsl.SSL_DEFAULT_CLNT_SESS) if ssl_ctx == nil then @@ -427,12 +416,23 @@ function do_client(build_mode) end end + --------------------------------------------------------------------------- + -- This is where the interesting stuff happens. Up until now we've + -- just been setting up sockets etc. Now we do the SSL handshake. + --------------------------------------------------------------------------- + local client_sock = assert(socket.connect(host, port)) + local ssl + local res + + if not quiet then print("CONNECTED") end + -- Try session resumption? - if reconnect then + if reconnect > 0 then local session_id = nil while reconnect do reconnect = reconnect - 1 - ssl = axtlsl.ssl_client_new(ssl_ctx, client_sock:getfd(), session_id) + ssl = axtlsl.ssl_client_new(ssl_ctx, + client_sock:getfd(), session_id) res = ssl_handshake_status(ssl) if res ~= axtlsl.SSL_OK then @@ -456,6 +456,7 @@ function do_client(build_mode) -- check the return status res = axtlsl.ssl_handshake_status(ssl) +print("RES: "..res) if res ~= axtlsl.SSL_OK then if not quiet then axtlsl.ssl_display_error(res) end os.exit(1) @@ -473,10 +474,10 @@ function do_client(build_mode) display_cipher(ssl) end - -- while do while true do - local cstring = pack("a*x", _) -- add null terminator - res = axtlsl.ssl_write(ssl, cstring, length(cstring)) + local x = { 65, 66, 67, 10, 0 } + local line = io.read() + res = axtlsl.ssl_write(ssl, x, #x) if res < axtlsl.SSL_OK then if not quiet then axtlsl.ssl_display_error(res) end break From d2141a7b549f0898ac0c65e059692d81f6df9eba Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 14 Jun 2007 23:38:59 +0000 Subject: [PATCH 090/301] some improvments to the samples git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@110 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- samples/c/axssl.c | 118 +++++++++++++++++++++--------------------- samples/perl/axssl.pl | 51 +++++++----------- 2 files changed, 78 insertions(+), 91 deletions(-) diff --git a/samples/c/axssl.c b/samples/c/axssl.c index 7e155e414b..999f3f8ac5 100644 --- a/samples/c/axssl.c +++ b/samples/c/axssl.c @@ -199,40 +199,6 @@ static void do_server(int argc, char *argv[]) i++; } - /* Create socket for incoming connections */ - if ((server_fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) - { - perror("socket"); - return; - } - - setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes)); - - /* Construct local address structure */ - memset(&serv_addr, 0, sizeof(serv_addr)); /* Zero out structure */ - serv_addr.sin_family = AF_INET; /* Internet address family */ - serv_addr.sin_addr.s_addr = htonl(INADDR_ANY); /* Any incoming interface */ - serv_addr.sin_port = htons(port); /* Local port */ - - /* Bind to the local address */ - if (bind(server_fd, (struct sockaddr *) &serv_addr, sizeof(serv_addr)) < 0) - { - perror("bind"); - exit(1); - } - - if (listen(server_fd, 5) < 0) - { - perror("listen"); - exit(1); - } - - client_len = sizeof(client_addr); - - /************************************************************************* - * This is where the interesting stuff happens. Up until now we've - * just been setting up sockets etc. Now we do the SSL handshake. - *************************************************************************/ if ((ssl_ctx = ssl_ctx_new(options, SSL_DEFAULT_SVR_SESS)) == NULL) { fprintf(stderr, "Error: Server context is invalid\n"); @@ -284,6 +250,40 @@ static void do_server(int argc, char *argv[]) free(cert); #endif + /* Create socket for incoming connections */ + if ((server_fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) + { + perror("socket"); + return; + } + + setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes)); + + /* Construct local address structure */ + memset(&serv_addr, 0, sizeof(serv_addr)); /* Zero out structure */ + serv_addr.sin_family = AF_INET; /* Internet address family */ + serv_addr.sin_addr.s_addr = htonl(INADDR_ANY); /* Any incoming interface */ + serv_addr.sin_port = htons(port); /* Local port */ + + /* Bind to the local address */ + if (bind(server_fd, (struct sockaddr *) &serv_addr, sizeof(serv_addr)) < 0) + { + perror("bind"); + exit(1); + } + + if (listen(server_fd, 5) < 0) + { + perror("listen"); + exit(1); + } + + client_len = sizeof(client_addr); + + /************************************************************************* + * This is where the interesting stuff happens. Up until now we've + * just been setting up sockets etc. Now we do the SSL handshake. + *************************************************************************/ for (;;) { SSL *ssl; @@ -368,12 +368,12 @@ static void do_server(int argc, char *argv[]) } } - if (res > 0) /* display our interesting output */ + if (res > SSL_OK) /* display our interesting output */ { printf("%s", read_buf); TTY_FLUSH(); } - else if (res < 0 && !quiet) + else if (res < SSL_OK && !quiet) { ssl_display_error(res); } @@ -534,29 +534,6 @@ static void do_client(int argc, char *argv[]) i++; } - client_fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); - memset(&client_addr, 0, sizeof(client_addr)); - client_addr.sin_family = AF_INET; - client_addr.sin_port = htons(port); - client_addr.sin_addr.s_addr = sin_addr; - - if (connect(client_fd, (struct sockaddr *)&client_addr, - sizeof(client_addr)) < 0) - { - perror("connect"); - exit(1); - } - - if (!quiet) - { - printf("CONNECTED\n"); - TTY_FLUSH(); - } - - /************************************************************************* - * This is where the interesting stuff happens. Up until now we've - * just been setting up sockets etc. Now we do the SSL handshake. - *************************************************************************/ if ((ssl_ctx = ssl_ctx_new(options, SSL_DEFAULT_CLNT_SESS)) == NULL) { fprintf(stderr, "Error: Client context is invalid\n"); @@ -602,6 +579,29 @@ static void do_client(int argc, char *argv[]) free(cert); free(ca_cert); + /************************************************************************* + * This is where the interesting stuff happens. Up until now we've + * just been setting up sockets etc. Now we do the SSL handshake. + *************************************************************************/ + client_fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); + memset(&client_addr, 0, sizeof(client_addr)); + client_addr.sin_family = AF_INET; + client_addr.sin_port = htons(port); + client_addr.sin_addr.s_addr = sin_addr; + + if (connect(client_fd, (struct sockaddr *)&client_addr, + sizeof(client_addr)) < 0) + { + perror("connect"); + exit(1); + } + + if (!quiet) + { + printf("CONNECTED\n"); + TTY_FLUSH(); + } + /* Try session resumption? */ if (reconnect) { diff --git a/samples/perl/axssl.pl b/samples/perl/axssl.pl index cf04254dd9..15b0527986 100755 --- a/samples/perl/axssl.pl +++ b/samples/perl/axssl.pl @@ -230,53 +230,40 @@ sub do_server # do the actual SSL handshake my $res; my $buf; + my $connected = 0; while (1) { ($res, $buf) = axtlsp::ssl_read($ssl, undef); last if $res != $axtlsp::SSL_OK; - # check when the connection has been established - last if axtlsp::ssl_handshake_status($ssl) == $axtlsp::SSL_OK; - - # could do something else here - } - - if ($res == $axtlsp::SSL_OK) # connection established and ok - { - if (!$quiet) + if ($res == $axtlsp::SSL_OK) # connection established and ok { - display_session_id($ssl); - display_cipher($ssl); - } - - # now read (and display) whatever the client sends us - for (;;) - { - # keep reading until we get something interesting - while (1) + if (axtlsp::ssl_handshake_status($ssl) == $axtlsp::SSL_OK) { - ($res, $buf) = axtlsp::ssl_read($ssl, undef); - last if $res != $axtlsp::SSL_OK; - - # could do something else here - } + if (!$quiet && !$connected) + { + display_session_id($ssl); + display_cipher($ssl); + } - if ($res < $axtlsp::SSL_OK) - { - printf("CONNECTION CLOSED\n") if not $quiet; - last; + $connected = 1; } + } + if ($res > $axtlsp::SSL_OK) + { printf($$buf); } - } - elsif (!$quiet) - { - axtlsp::ssl_display_error($res); + else if ($res < $axtlsp::SSL_OK) + { + axtlsp::ssl_display_error($res) if not $quiet; + last; + } } # client was disconnected or the handshake failed. + printf("CONNECTION CLOSED\n") if not $quiet; axtlsp::ssl_free($ssl); $client_sock->close; } @@ -518,7 +505,7 @@ sub print_server_options { printf(" -cert arg\t- certificate file to add (in addition to default)". " to chain -\n". - "\t\t default DER format. Can repeat up to %d times\n", $cert_size); + "\t\t Can repeat up to %d times\n", $cert_size); printf(" -key arg\t- Private key file to use - default DER format\n"); printf(" -pass\t\t- private key file pass phrase source\n"); } From 013b3c1a7e8ec8c089b8c9883bf425a446198062 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 17 Jun 2007 00:59:02 +0000 Subject: [PATCH 091/301] Lua bindings now complete git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@111 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- bindings/generate_SWIG_interface.pl | 4 +- bindings/lua/Makefile | 3 +- httpd/Makefile | 2 +- .../kepler-1.1-snapshot-20070420-1741.tar.gz | Bin 782154 -> 0 bytes .../kepler-1.1-snapshot-20070521-1825.tar.gz | Bin 0 -> 768249 bytes samples/Config.in | 7 ++ samples/lua/axssl.lua | 84 ++++++++++-------- ssl/os_port.h | 4 + ssl/test/test_axssl.sh | 17 ++++ ssl/tls1_clnt.c | 5 +- ssl/tls1_svr.c | 4 +- www/index.html | 4 +- 12 files changed, 88 insertions(+), 46 deletions(-) delete mode 100755 httpd/kepler-1.1-snapshot-20070420-1741.tar.gz create mode 100755 httpd/kepler-1.1-snapshot-20070521-1825.tar.gz diff --git a/bindings/generate_SWIG_interface.pl b/bindings/generate_SWIG_interface.pl index b1fbb39817..83e9ef68ef 100755 --- a/bindings/generate_SWIG_interface.pl +++ b/bindings/generate_SWIG_interface.pl @@ -356,10 +356,10 @@ sub parseFile /* for ssl_client_new() */ %typemap(in) const unsigned char session_id[] { - if(!lua_isnumber(L,\$input)) + if (lua_isnil(L,\$input)) \$1 = NULL; else - \$1 = SWIG_get_uint_num_array_fixed(L,\$input, SSL_SESSION_ID_SIZE); + \$1 = SWIG_get_uchar_num_array_fixed(L,\$input, SSL_SESSION_ID_SIZE); } #endif diff --git a/bindings/lua/Makefile b/bindings/lua/Makefile index 69c5c7b154..f370703386 100644 --- a/bindings/lua/Makefile +++ b/bindings/lua/Makefile @@ -39,9 +39,8 @@ include ../../config/makefile.post # there are a few static functions that aren't used CFLAGS += -funit-at-a-time -# libaxtls has to be linked in as a single object for this (TODO: see if this is completely necessary) $(TARGET) : $(OBJ) - $(LD) $(LDFLAGS) -L$(CONFIG_LUA_CORE)/lib $(LDSHARED) -o $@ $(OBJ) ../../$(STAGE)/libaxtls.a -llua + $(LD) $(LDFLAGS) -L../../$(STAGE) -L$(CONFIG_LUA_CORE)/lib $(LDSHARED) -o $@ $(OBJ) -laxtls -llua CFLAGS += -I$(CONFIG_HOME) -I$(SSL_HOME) -I $(CONFIG_LUA_CORE)/include else diff --git a/httpd/Makefile b/httpd/Makefile index 7731323e5e..da173fa3d5 100644 --- a/httpd/Makefile +++ b/httpd/Makefile @@ -43,7 +43,7 @@ ifdef CONFIG_HTTP_BUILD_LUA lua: kepler-1.1 kepler-1.1: - @tar xvfz kepler-1.1-snapshot-20070420-1741.tar.gz + @tar xvfz kepler-1.1-snapshot-20070521-1825.tar.gz @cat kepler.patch | patch -p0 cd kepler-1.1; ./configure --prefix=$(CONFIG_HTTP_LUA_PREFIX) --launcher=cgi --lua-suffix= ; make install else diff --git a/httpd/kepler-1.1-snapshot-20070420-1741.tar.gz b/httpd/kepler-1.1-snapshot-20070420-1741.tar.gz deleted file mode 100755 index af37195b5c8605a9f928072e563ed782ff84acdc..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 782154 zcmV(;K-<3`iwFRXB`HP#1MGbXU{uxBa1sH@6EWZdD(d4AOa?QP1;R2AB+G4uOfD@$zsaSjTxnV9q>?PT{0pOq`=yLzFd@rXU7FDqjHWNwU;e-8uiNVX zxxsF=LyM?K90zppvPA-|8C6^p=N?d;b;r%a-v;CxTa;+LnrV^?g z(qkQ3XDSg)YI@9BP|{+dNGiBL*@K=)pdd9vnyB% zs^5rf1|zI3@nEPs*r^(FVGy-88V!04H6BEaL6k-`Bk6JCjHH4Qy|WYAkNz}PMBpEF zWgO9o{#d2O+X2jG;AEA#P^7fTG^{5yC}bk5R70f%(#a* z7DrtaOB$?d3YvjNl-#2x3`DO_UPPF0cCLXy^lGSYNl}%-A}!Z3AwEiK{k)de%7z9f zv1#gA4L|^>45=W07MuzUAsUZp=wFi+kcyB}wCy@-FhUm70T)PaFp^M%;Xb)5*nt@@`XIb5v|=SQ$Me|VSY`(tsK=Hk`!3fRN2ZQAm1i*Gn;@Wp8{O2gbDP#^Xi*8 znE2BK$ubE<{3QUi@=bV+)%8;;ye>Ve7VC*%D54fOCW3Y7vy|kU2v})?fP4k!Hrg{2 z;r6Ie99E+`DbqB+s-eExy;MBa9??RQga&JUE8ib9!NhG9AlT`*&_KS7)x?^rY7Q>` zv|2?4JGx2`)F!v4%F5!B9s+W>|`OXk}h?t(yqm9ePU+1*KjQ@ zNRIV^3%4{@&k3{+05Fm^VDJD6Ha1lbkkZ=vh5+JxYhdm`%2SJ^jSPlED&9Y{SuJbS z4H%KV%D|B!HCT2qn1u3`$VRFQKpLrOea~;8gH>8oxu9|$)_DElu$Sz&5%vmn7}i91sTj0ptE=lz|zZorM@z5xU+P*%vXY{xZ$6z#?%C|hQLD8s4DM> z1Uuc7cy)C}XDB2!HB`3NHa5>~tFCRRoZV94T^K3y2CU?U8k!!7%HBvgBB9x+4U#In zXc3t}iw18;Q+>5%*qNrAr$~0#b+%~@76@K(o}#Vv6dQ>UOmC)6m!y zn8zhBkg~U)Gd%hEz<~r2+yV>`JJy4H5B&$s`UtFDy%Dr(L34Z``YRSnB@DDY@HTK* zXv-xvVyK7QmV={@c8MkQ4K-LwtppA$O{ob~&7Y0=<1P#y0UW81%2F{#cpH%j$B|7c z%s#A~gG?@oLi1!oju=9}@S4s!^L#;wprq3Z_23>B?N|F8g;JeNI^y)1a~@4Jfzo6~ z1)E@)xMk>OHWUR{02+(f7r+LJmD5HAaqePBv+y~}AskjYfm|xC=@5g%A{}1n2X3(i z;=c<0FBFL-jjl8_K;!vE7~!|LXQjXEzhg*AGj~q6fnj;;_lY7hx#~ zoS{CR^jvW)4*TtzaC;~n33!Zf%SNC8%BR7P1bhCx`bAKI^oO{p^l&xvC{h23GP1OBsgu+ zx)u8uU2G#B+Wh8*imqfb?k_Ix?d^qSqfbwC7I!4$+`M8dMAn({gnj{9MdRY&H`PPk zYEr6R&;kk&>CM@J3UAmSH`D~OX8ggJ9_x$hDZ@W2)MEf1WJ7kUzL=Wy7o(Jft|!5v zxoFWM863sQF4a(pgBiQ$yvSaZ6KX`oe$`;7WLvDYB9pBSP3=^lnxACpXMQr9-^wRz zNb}p25>f<1AuPN(rP`^rDnfNa0Cl^*E|~ z%2CBqjKm@wLo36HjP{-~Gl?f3V+r%Rvgj^-Cm74kHULp|z**O2fqh=giRRevR!^ zFeI3_yy1sy+q1D=8z-X`Wm!np4DcR<`yA0l-8*68Nk`HtA)IB^6@Uj97a_TEt_d|7 zR#CEnWIB{)DP>w9xXl&VGj7@BMwf~PN_)`g0=^cgp)Os{&%Y2&T8o%`mYB9_y8^p$zMP34xE*9dHEI)7m;Ii(`sKUASQ0u zuoOx*`KCmZ4>yv{Y8=6CrCrG-1qreEZ$j!Efz)mXsogeGyLnQ((~{clLaJM7S5mt< zQt{s~E-S-fYapsClZl`?N?|0%cnw1oOQB-})FZE!k*yu)Hc&l9cxVL{wKi9pvXAI) zAlX#@%o3Iia%EWGo2797i)9GQ%@T8*B}hw|8aU|oz>+FWThN4>u^o_~sSS{yo_@$Z zOxp3*bvo(;keQKwQX*3eNQv}qAo+*cid9-XT^r8R;u%{2`I+d4{PfgA?%~iL4VSwT zj?Ag_R6}N3k|8qMi(-+sH#c^6YZj= z&M&kkFc15p1e@QOLi1}5`Ql-4Eby4092Bmh)+d1@Nw^Ju2PHgAiMG)1LZOIE!aVRh zDCa4Vx`i@x+{waQ3Ruw}#w>I&bC9XlL!BC{!jfpLOr}~8MPsi?3 z({7We&KkVkL3mmlXsxajc-n#80~SxoH{~h$aPriw#PQTwR^TbEV&`dwT9~J{YK*7O zYJ{gIVT`9%^AJy6kTIT`<$$N;196JK zTwk#zDqgP|3${m8F9dkxhT^ifxz1JzOPj|9k}TzRXtA(cjyD#Js&e&$7G%Y&3?`5) z5MrfVh`IHKR=JU#p5Ia~aLt=oF>rgO z=T=su&$b!_ym9f|z&!AkHG^-ew8S?NVVzq!CjdhyS5C7Vs94*71eW4j8oSvQmS^9B zR=nXp#BD9)D8RPw6t){}f@ho33TjI%j8uph{exq4!!m`|7SZ+Y6kjT5$KO_0+0xcBe_mSyY|?hbbcltF>M zf>?#6a|Maa+l%47G*+k+0%Rck)WuurmmMtq-@*iz)!NvUuGSaFGln6sD1c~Y3ubRr zhJ#S{LN%4Gm13dElP0l3Ev?PoOy?C|17|RAu@)xzK127p6~Qgx zmpJ}@OlGW7Gvuey%+?O6sh2YV5p{F_*fQ$pfmA0VlWC>ks;4tl09_56v6i0Z_cHtf zSL{04p4@Mr42*tJ?1>UM%gxR)jfol;Q;0?RScUBQ9))i&uUB~%91_u-3T$hst85O4 zxP=f`9GD2bRE)a8MTg=jzx353TD!e6ucmnSm8hgLHONg-4Uhp2{lhzZMC~&WiMKRR z#=-8?LTpc+sUWg!#;S(?N&dm1^%Cze@zW)?B$0m+(V-p#yog*dgojp_(Ha^pTo92^ zz}(08m@xR=KtET8A4~Q$zrD68oIErvnUo6Gxg9(jiV3}cp)=)%cXM(=LvcBT!%2fE z1iXjOS~s&Mx^x{0nlO6~JRPLt@L%}9wA(CqmY;Y;P^ZB^>G}*iO@uCE0U91wpWCDL zTLpyf5|jL5O{=dgKzM1NwjHv;Ws!p$oBa>w&+HX+u|YA#j8<>*eqftv1AmQ6tx8^Ji~dC;{2K{#guDB44T)*mV4{F29smUj1{)a$Q~EIrq-|E_;*%9jL<25IHJSbI(W>VxSjS&(I$rdl{t*3nwRDwe-mKY8UJ_B_PU|W0*PB zt1tlF^_t6>RKb`Km6c%kMw2SmXFN5c%5)E)a1p43njfsN0Df}7srH!x65&5>uuSLmKg%eyD|ahH zRO>iB*~W5?s6yv(hFpj*>sN{M0J_{Eq*L4l#_IEZAnFZxkFY(}(V-@M6Q*-YoX;t2 zC@Mr8Gm>%$N&W;+RcVo-ty1-l!m3hFk>ZM3@l4k`3Mssb63>NrVn`WX5v{WerKt(H z9|s`!=vsJ!C*hfHpFvP&Df+(>&-68`3(~QVc5<5bccqaEw>d;O7wDKn#Ok*6U_6LE z%3LQFx|fLtXKSFX3E^oDoI4+_-cUM!i9>-RN{&+C+SRt1ffrEwoIw3IwpjtUQaG8P zZbrak%Q+obL(W~<*{=+6RhIxnRDZZ7t}6I&0CHL&9Ym2A_V$OkHE2gVO>$7G$5kjH zIh_u$QDoPq7MX6U)I2uCTsJgS2Rm)(-)(TCTGEC~2)Xi`w{J=Gk2HQ876`<9Y`Bw4 z9t(~Gk?E+hlk8y!!WP2yQc=A}m9r@=syO9hKunClo#{kTP3ZlZ8?h;SZK*D9_q z(w4<7?7|9{dUVQWg;_Sf0mh{`yAQ@*eqo@>tvI>R!ciJ)9lO$@W!!}WBBL^jPv%^o z4l2XaPvgeot99D7Sg{)G0r!qelCWKg6ji?%kQU1<;<=$NG-TwnR`yfQDWOhXD9CRA z!gkPNb8tP&Ty>xZGxt*l8Kf?~vAB~m$R2}AgVKD|!;dK8Jb&i=Fc3)7nY%E~%O4Ma zz)-L+(KX1Kb6K*kayTnp`q1X4bdB}3JeAhPgbsa7k9sm~i~}xlC*i-qh0aB^`bj{h zB;kM3s9X}W$tzs*IH`x#=Z<~(tpdCY+?K>JgGdtu4uNj0I;W*V;Ye5d@ohUdX8B7G z!1pbj`f?*Q1398Hcih+GP~|KVm<~(VD#Dnw`@^{ic}}PZbqw?V|Vt;^_9aE}S2fjiCS=gQc_HuyA?0v6_g@HiOW%Hj{K zmZVV<;bWq4D+Dgzm`896GScvU%5m zhlAB1oNx3CC2cZoOXVn{j3iiHRSAtEX`45HZiP}_Qkqs?#QRCoNDO}|iCF}0zOV54~V{MgOLkRyf^YlT~`LhR1}_z@1_Bb7gEYDx{ed&`t+DhbNu< zT{dZC)4IXNA(`AETfcZH_mBy+%cSi-!+!OodE`)(EFi>9u51K4q{=*PC&(1;K&M3E z%Tky)MZ@J-me9W-Nan#ZKfXy^LjOr4KX9aq7an>Ai-*)RPZ0ZA7B4VD0>K150U!@Y zPBK{W<{d>~!gD8>{oGmSLnA?u1lxs`{V66#@yt5OJe|r34G`>*7+WhuaWT(hTCzf} zgm(xE^}3j{0&-%%xL4v29s12rv+r#%aQEBO$aW8$%RBfmev$uf*Q{pl0=F8jy};ji ztccgM9;7G4WRfX^Jkt(?7or2t^`>NxtvSt&jc_+Jxi28BCGgogyTi>R*2(0QGu=D9 zSB1NzRv`xg;Vd9MgjqbnQAFYoT)PSfbtUtMi2b%>+75C4S3ipJAN1qie<7Z+F91j8 z_g_k;Oe&pZfB$9T#IN3e`BHvI{JEAikF{7YZ5-BXEp!u-ZM{`+zR?Viwpfp~wD-vd zN>>l%!4~IZEfstv`dCY2i}|ibQa03N61(aOLx>@rz!%+6;l&oYL5rnU7NO#cWb{Q3 zx#GPkoP*y_p{a~UskW)Ux`NytElZq5CDUuAxie2Sfm)Xvf1Q^EBYbm%Aw={d6U#V^ zMj9s|82AZcaz9`uDqIc*^OX=~)LKn@v|53))yj04wxBU)vWkTB8b$c+mkvD=(R*=^ zf+Sn-*1!p5)IW%0H4SjCh1{czh=2$_tvwM;^vQUBErb+ybPbXK7!o4HgkUO?#20e1 z3s56S7|Kh~zYtBF{%Ht!Jq8n5U{G8Dnw9923wzOUQDuB`wT~+Sw;Gy{)p+3X2xd*m z)|(ReaSI-Ux>60Ll5n;^Jq{#)Mkt}hlR{}1eAHs$@xjgbAhU=~4)Bm@=&3|V<(h#X z^=TJC!@Z4~0hb}B3^GQ6t4)=ybrLiGc$B=&SHh4x*yT!%qtt+@sW!=RXS$spdYL0f zhs1*U`I@vCU%L_qe}LXgp#f)ACxHcJ?EM1@1!1PqBE_VJVS#Ya0OH5MSd=gtC>*my zWmB_jse~8PiBz$Z$$X@l8*^z~p_>TRB8~3~(;mU*2Ddf?;5qEtPm2k>NzKn;~t_oJsf8|0pOeuRjbfC2cnwy#ftzabJXK&cDsu-(j2DBQ# z`k>;+gQ{IhhEP#bvWn;q#F8F0ff3_NSv{uqvu>5OMxK@gQwJ@$xq(b>b+w_wuuNRA zKS<3N{4NEWMd+0zh5W^~M6!{V$2Z)X7~pA|x%64A3R)k(-GHx7wO+X(6%Z`Y8Hk%+ z@&ty8Z4dUiABo6>RNV?pGDygbFNAY^W?#c}FWy;?U+=^5OLAO~XdyJ)#8_`4Q4S?k z`r-#tYi4~hz^$pdu{zMwBBd`uL*NiD+JXc%X8bVmcM}7E%<5ozQB6aX2A%#%1ob%f zrd~LK*pfip5?(+QHajY0_FmpNWJC3#46^{c5uK@MunC}SD58N?=#8v0i_+WB>jfRl z0dB-^jmdCdy%W6KYh)B3cQ3vJm1{NYJ+gj^u*b-Nx+Zcle)_g!l^O4Zy+}e=e1&_{ z`I7vLTQVvM*Vx;@v)kyjP68Z#*5TmDiK3TAtcAh z?AAKrBdQq&Y#YZDdQwmJ#o=L+g)tSGfnl$TU;KjvWIKiRUi3$A0!`1%xB}Fl;@XX2+l0T|n@#4mReiSqBnA z@SPgyZ)~M|B$h=>;e>gWc;aitS2iqwA)H?y_S4JHihATy-=s3RtfXXeacOCB*(AAi zs=uV%UougS28|FhBx7AcLk_Hr%lZG2ZYPKTCzUwj4*+L=|9Rr%Nt5jUpGhT?%f9me zd>OxSV{v#SnkHb~0QbHlwPRfjN7sd*xQMX<{+fAUZ0Inn24iSO4aU%{PTbN)GS$%` zW2+sR2i>X~mpgSmEZQ(Wi8z;F0d25{5i1l+|0>)IhZPDwb#6JGE0m?yi-^Q8t(cGT zR4CLRq_{Y1l!)-Mt|C5vTcO}tSFv7Wtx&>9ZHJNy{~~LJ64Mole`Tsd=~EF2`~#{e(aW}VB~xP zt4^NLB`-@zlF_C2wjp_q7kcCir4TaEXUqsR)=Jf;*fUv|yk00LyZ*470J43k7&4zb zw3QWzOnb2=oFkL9EM1FQo+#`2VaW{#`_bV7UWt4n{0OJfXTV5BX1pD*fKzzJ8yoD# zVG%&^<9ABEUiN53KQvS$Mg_yDL3H@9mIa3Gt64_X+h9bqyT6ocu-m+ zYY-p?+kt_L@YEtAvh$y!bie&oUot5MZ`g}eQB9hLtXtkV%PnL>B>p7&=QsAJ( z3%daehNUEdD|D$=!E~cpWue2Nk64nK1A?m@JcGnb&z$twN6$R*1ErSHg=mEbPrN#H z-&Zh&4HYU~pIe8eC@XHc`OTe)gKY{oFA&dv5%c^P5zjw`AVH^$erV(oyMd9$9@i9T6K0QQ_WUOJsGjXtbe<1E-9c)8-U{R9Rt5PM6H*g1_oP~LT z+WL%Grkc}>J@u{`he)tl{V<5;?QcdnnM!PY76@;_B@U5nTKO=DwiZREV4!I)vtZ1R zX)CcK@DPOqsveGT&{Z2F7*F9D$3ONsA0oA+?qQH?uJRbY)Djda7U%_M`yrCcb_SWr zdN`6mHaRm1FWWplG|nPR*ot`>D4Et8StQd-*TIzB8gpk9`b^j-HVzgSxB8Y~?Yjn+ z$4$WmGLu*wh}7E!+dfOsqNh}mmq}qAkn{v2DYZgbPF^f3rI$by7{$H`6-x_!6P9|4 zmzEY6ELWg#2;SAi)iwOg5Lr%pD6!@`oPMh-wWM4^Kc-J773jix0;|N_MfsQz#a5bI z5}P$z7Pru2o%UK*PFqW$6*~z;aNO$F1joBZL~vG48gSf7)dVMmin_LmTRNJxcz>9C zEzz_xD~fKa^i_Gght(ClUNPMbA+cLbY@7ou1C`jGFzZ-8vJ6%5Om9}P+-PDI(ZL6G z++dj#u_a@?*NK3nId;F2$psM=1L=m2PM?-|axT0~KGAyCO@klU+)=>tI%~d2g_F}>k=Vv!q!rX2-rU{&Ja&?y) z>Xs2a=5S^XAxVNai`wD|y)zMv;(Y)F4b5F$0H?CG4mTg^+bA=2lzhllEPH2Z;ga+H z%aFa}_f6nT9sHIp)~fe+KUB;wMEItl=6KnwuK_V%)mlOUr9Ez2oE)| zWGO^*aA2r(GmjG;RBia=Akzn6n$N4oISdc{YN;d1@od=hWhsp5rmlRMZo~ zSaw&$Zeu#FVz)6tP#Ugyh(7KQhpE@?@bQi&ZG=;v&^Wcrl7g?45!$3$ggY8OALs&Kh(rb#uPyP*~`a$y?+JS}mwyh2ie!%{`= zDgunfdPR2S zg2#f}AO}vgb`s$0Gw`TEwmEY>YwSVB`usu@yx_DWL9BdUyt|XjR@}j}>njlG2C+KgIRV?? z0BdGN;ww0~oTcSZaxSXQ0xFnbNM$7KcGzJlIV*764v$~%$(+6y8{#Ul7Es0RTN8JZ z%pqbn7mbqvbh8@_IZb*oLrrBnQy&ZUakRKIje{rjvBezr0LqfMI@(X#eNUUfEYFj9kl)de8sYj?z z(FstHI7X84Bp$6BX4z$Q%C-SYw$5f&AZVI_?4uPaEun^OgGhFcBUv<^WabJLWZcnM zDnuTailzWNDuD=j4p{>Uz`j@|gn4-c^$&)p2%cwdt5Q5&!z&z@o&as*sHxbi2uj2% z?t0<}&f_Hd;_!FO02LBVqe1A#uBASlX4~ruzh_}>d-Fg|h}g|&T2Is)jtwWe-{3?C)+605R%|;Oaz3|{ zVd7&?4KSSG|7UuY(~QK4-;Z-jSn$!^S*n2e6<>M<3P)>8y`lo`NJS!T)Gx`^EauBH z$eA>)sO-!m!ezcPPE%lULP?yU2jgw+TC5FrK=TXpO==KxQ8E}jLQx1;Z6g;1K=DHB zni>m^;wd)Z$N`S@mc0wuELGRq+Ehait~z02{B))h5h-jc2+IXZ0bHwI#sM(>Le71d z%+rwT&JIV8TeP}aIgQrh*e)!oGYN!aKFuT%qCE5?5^k+#B2Xe~<%5s{H$f1(e_$Pd zB>Mg!y5Ef#0~G?>`FoLb{G@OGZTZ{>JYp#&HgiGf3N~eU9JM%GL8uW4gOkCaHUs`A z){Rm zeO<13tp8~lDSd~5RpA66yQVU*X>$`^bCBA*8O#x`4zWkz_P`nxFWPHZB5e0q_)YdZj3J>sHHBS77vhy zaj*f3xS9fjc}9nb6K7hKX4S9`m(J*LkB}OLA%W!ENcs+=d&H5}3%d^pY&>WfmSbK^ zM*3(}xNG!-&uO^w-btA=-p0ub;hZr&f+R_FivXnobm3qUGLaOVFIgwDI^#Cw z`JKR5`v7ma40@}(~N4eLS^~L zB;L4poNsiT*hsU(nC=LL%Vwe5aR$kCj&@0u9MiHb!R?5oTi~Xf3&EKt*&PPrx8&|` zbN56gFA$b&^PD z6eEkFIEL&Txs3ZD6j8V}dQA1ni|I~GOz)KwNHY`wm;&n{8C6LC>NDD3GtMmU~#_!9YQ`tFD=Zq?z&$rE{B=}PdKCy?L2$Lp0@=d2o z>)<>;TXM(g;V?5d6S&+3!_AxUZYV!r+O8w8O_~6Un=A3BIZNU%bAoie1VEfDaRqLU zBmmgth`;!G5hvK^Lr0>$^f(W;VB(%>Ast+hk^+xzbEkE|b##X`Ou} zf1Lh@;8!HtzOv#Yj3e{?FZk!U{}=9mDL=w=xc>gb^}lQXBQ16$W#HiZe^P1Ll&|{# z%lM`3e+c3!Ju*1@yZ^gn(nNdzPnq)7{oh~8&$m<|7p6gfM}skZV_In`xiPJzw76ul zTsqlbGSNSAk{s#kpf{!YTI(Q$RxX7tGGrh6UCZYylCPysh8x=8fg5?LmtKu)UfzlG zTNcl2Y-*`*k$hD^g|tNS)tiS9myu6mZIZu(iB3pghAYL+g|3lQP^@ZQwgA$gRh!fs4_-7o$j0wItk+qQ&H-x-yAuQ+Am#vTLKVo{%)W zqNSJlh1uo8kn58Qo9sF44re`;jHi;wphomI1HmD=2x8$dc6KwM&%;^+>(h3X+(iub zx!fL1hPs3sP@xU@ng*O0#8-Mo`h1eFp-E~*fblgKJW~q|RYgD}dap+Uk|+bn4IbEG z$mn4^Q5v~8i0cZ?z#OEN7zCe)5O)<|umYKrItK(bh+aVm7=m(VL~loY#y3#o3%J9W zNeGOL`m6(JGgSD*x8oSF96`&A7`fBkfSm^&_Zhq^j`#p~F5;^z0H#i)0`4ip{Em_6 zP3tP66)7EV1TSnyy%R%!!X@@eTnXn`mqjO3cs1Bu6Jd}Z(sGM5Ee1V^z9sxlDqI6w zQY4Yf^eNd)PJscEuen|>VE3&R5NKK~tgeIrS11<=8c7pA1fLj5J)wpPBFrOSOtw=& zZaC3m?ApmFy>Sw{9|g2g;ay1 zNhV@gNf_Cqq5*>WQ6v!pWEBYPLS#i4UY^V%HVn)$N>`yt+&oI18tc&#dJHqB2aPnK z3ll&tv#f80wsnAq8?lYvU(e);9B4+6023<@(oJE*a3-BI%e*g2E+7&FlFZVeiZu!v zK@58}LoMR^7_bKo19c7F-)g5P0?1Xkn0S1H4i5)-*GTX7A#wx`c_6i5skcDFBOfs_ ztU@2QgG|Dx_DRgMh13QVR#0hgfg&NShSmxGG{Uy9b(4}okRhhTbWVT(Iu;_%z1PQOgk|{8m>{6@oes zsd+%wCllhZh-pSV66_*{h zEgU9SKnF#7gCr0hXhE3(l-wr7gOv)^l_52bkA!Gp1S}OnEWp?1P~{IDMBijErc*5+ zMV1+Ut0AJp+-L1gdHBx4gTi2=qFFAeD3C2t1(~6pVOWD5k8Rjl#)DuboFp*t2&0Wf z`aKA$H$im(?m?g2YAekM6kZp>%F7^XIG)g=qG0g)27k~APf%KL;q}}msdog-BU zw=u`~frR1E_b512U@#zA(V|FAC*Y_J9vCjddN4GV$yoeAe#{3=R0<1OOop1I`ZcHzJ= zIBU@rB)6r5ETK`@k&2LG7Gzc@OlFN>KnwK5V)Y2PiUoTbn>umwF{IsCaYAO`&2N5GEava(n|+kwlJLakd{a zUSV1tkW%(h0_qV3h)_Jd6*k{mgPm9k=u0M@#iBGY7qLkPd32gJ*+&esBFgI`X`mLG z&*F+E!AmU($D}|+M6^h`iPLOT1hok!Xhi~P!ih9&x3GZNI0YWl7{T?iIcC{KXfXH1 zsY4u_;fPS&Q|3)*9JM|8c2O4hhlmD+PByr4rzHM{|Ox-2T=e1pHiFur@VCHSNnfo%8&Q|giHre+0=nKfT|D90~BH|Am-+9 z^Z$fw4j_36zsxey`h7yo@gw+Az|)gV1Y<@d2*yA2?#S@|LDE_pbG{Dz#23<{ohhVY zCH&3_^X%Zei}9>Wy)pna;qC`v&X*`&L4;w?6KiZ__?S*3Y-x0*V%_B8Rvgz(;lU;- zEO+3}0(^flaXp1#;=}8lU?`-)8*^ylgq0Ar#|)yw^^OiNF^`EE9-?9Cgsdj>sTY83 zE_bvj97m-z(3wz=p{X$xv*xNtnL;>1;1{C*9B&)fhf2s6dS~P3>XlFBlW>Vs7r&+P9;>b zoFT>#*e7tr9Ie||k%xJJM`(Q*2H^&*3^Edya0;9+$Yez%MNCg4<{Y)im@#cKS^}2B zT8Q~JG2wW{?~|&`hwg}nk_V_6oP!Q450s16EMS7O6VB!uL9?1f%p_eR$ahk^3R262N}^ zW}*u~(vdn0hFPPj)(~}rPbzembzq1o-vm6-BcQz@Y>lQ37O7pcobM1qq8}kyXaRDe52{i6(wo2@8~_r|7uhL?upE z`2-&{GED9&XQ5X3O%)EKPr~<$!WfN^i$861I-V5p%Tg*49;fE=OEAr);xLp6Vm!c+ z%(kO>$O`i!?mB~vHNpoZlla;fJk!V31nGw$%-0D$)k!v@Iur0T9pIPsn5(|6V#1Gm z5aP|TB?T56)Y1&o9SW0lutP0ko<~EC8MK;~By{5ocHjytyI;sB)#<&UzwvaHAd{3X zBTFs;A!ihfk-}RrVe08c{7&L`j{y^?a3rVmz`sguJUW7y83ZW1f)UDT9hHybK^imk zNDs{FNcs+a5CS*sgK(a1t@p9B-}Ek1*A*5_lc%b!OE}pxByexV(eP|fb@ILmChfg6 zGT$ckbiM?=ivFu3lLY&9V9?}Du=hW6W1h5BBE-e>2lQ{u7E~fGSd>QT^S7(piCnSI6{rS)PWsLvn zN=73`07rlRpYrl4cK^@h(n(+Wf4+?0jImzt!3O}zUhhn4MqTUN2KXmXS%dy*t#54z z%!H^Q1O-h;o$8EYk|xb)sGm1SZVoh5C`PgmX_qclO)7Hh;-)}_0%lur$S@SSt~pSP zUupBfC#qIVKua^K8fzBIRkN!b8ycG{lySBAr$A0!*-Y>*p`v9oagdQS#t6zV9}_7z zqiQB9I-|I1rnE$wQ9qL|jAj(q&%^;oD2e#~aSHy1NEVvE3`67`P!6E~HW5gK<`59= z8iT~O=`iAuW;D&@!h&r4KJ-{5v6uRfN8)?Y5tAeW8$etVVhw@@tob*LOtOd{V02P} zz@LK*Pa@cSF~Y2a3{VmfAK4Hkz6(J{4?ReU8z%=JsDvuBxFa$U`wvyJRk4RF70g0h zV;*zdVKgMdmi)!UECDNBVwMoi1>OQo?tsFUaCurGbKDXj>@RK!K~uavvR6|W!wx-i z3B$6(p=7uPFLBcGRRGhM6~F}IGo47!zf%kokX=z=PRKD{c>b*-nGoGHXvkD*{|jQ7 zEULQk2)se344Q+P!UmzUr*axpAj@lqBqmjBhueaA1Y{|DybsCqeNnFE6pj z|4c5M^i}-Nm-2IW;vfT`Jwc6!?UD85V80Cv^19OgM*58UxwGY#=4u2?@6>&rT8Dx( zM{5P#Nv_CMjmW&u_pim}wGi?$W?GQD!!)I4U3n8;-G5FhaBvUxB$*70`K{r_7~X$SN4hP}1is zhWiHQ25?FGw`(yq84`+G->$`B^GGPqC6Efmzz+%UMEBE=dPj$bXTDyw9WCXOq#fqm znTm(8*(vl8n&s(y8Nu$1j3@}di&0M@YzdccATtydyq39@4T$sx@L3SteyKL0$#an^ zD4QskPV$#d^G}>CS2eeSBXkOCDy{OrU!xz~FTMYtj<+L#BeVW5Eh#ItpZ_i|FE9B@ z|9=_3+4Z$krv%q#t(_7Ev}xyY{EMcI~?5mRoMU_0~J?xZ|FC?s?#W2OfOz!G|7tXv2m_ zwrqLyl1m=D^wOVQe)$vIw?BE+RZs2M@yxZ?{`}f&e{tiDzuL9ySG#xbzvY(aZoT!_ zx8C~v9e4cZ&O3j*XAk=S7w^08_doveOF#L^OOHMF*pp8_`OGuV{NfkC*t_??o_p@O z7hZVb#TQ?E>7|z*dE~&8PyYGICtrQ~=~th5<}c4a``W&JfBp5Z-+1ALH(z}5t>6Ft z?U!D9=jE4Q{>xwfa^S#!zxn2y@4WNQE3dr!+G`)Y{`v=Ryz${X?|l5;d+)vb?%zN9 z=%Wul_{ZP>{@FkN@sH0w`+xuZ=Rg0|g7kmkR|Nlov5+aJanZOI#V&UJNrcK__s(GxHD<5PQXdh!andfS-#yKjE_>cW=WmOg#=EkFN8N$8pD z>W|-b^S7^#|K{G&mz=xHzj^2>r#xQRd`|uJQ%^aqZuYvCK`ldTE1Pb9>dMN~M_fBL zQ9We%Sr?p=Tl1}ZcaHP7TqQ5|Uov7$<)&eKqMx)^I_sNv zt(B(d>?nU~P~}LE;qza${&CNat=oHs4J}!oz2R3kj*7(Mx7kXZYx}Nlx^hd_gMqW|T=oZJ?TKYCjXpPTaQ8EXxtIO$ zz3I0Oet+=KANzbuXWrh~&wit6_jMglcS-9D2R|h1^Zt2%;x9Qb7R}S@?%O;2l#)^B z8$bWunR|05Oe@=T@$|7LZjKx^d{JApcW2G)`J3LJ^7Jt|HH&WC_-gKo)9ahZ zJ5Fyux%tE&)PMcYW0yabw>+3Lbl;zMt{eWu;vr>gS3K1{V_xp**XKz49=U!<-jw~y z@|*W%1@GT9d8j-RmD6eRk1ZTb_+wv%Y-*hCq40 znzG}u)x(Qt-*D1tdp5sPS$FM~?>?&h^^dQtxgl4sJbB#Z_dVMC$4~w7tm!KUZOVD8 zJb&ZPk1xO7*bx}z-Fw`SdS%0-SL~j?Bx_OcpeM6aQ*SQcKX%R?_piNS-GV#Uy!x}f zODdP;|MAxEZBXNzKcBrxjxVmh;<{NM{(j@H|JohfoZ~+=`s%gvg4?z&+W$z$+A_In z)Z$e&TaKSN>cgSAMWcMHj1AM8s)pAreQ(3CF_Df*eM(W4aYiV-V$(?-g_GYqXZttr zdi(X=m!351=%t@5*`B}Z)qS(J{BZEBs@HD){fAc_^Yiails~-I4ac0d( zdHLz@*7V%?et6&5ZFgn8QB^W!(@(OqhuyaIgwwYc4LU!v>GKzFY98El%XjO$c3t$L zG%N3v#30Y|{E<@EQPm&MT3eaDfA&$z6@8-@T_=r>W)J%0K-C}jPP%O9ZY_85BM%mi zuK8@}-r*h7Uu4!h*RpFB}}R_XV1uK4!Q<{#z#Xz8CyN`aYrfPUs%}}Z6>8B^( zudhBa_m=41aaqT2t;rj@a#Yoa`)*tC>Hb+)UH0evw|73eSlU^2Okefp{HnpHPsm?$ z%v*t>ZM;cA%tUuvpeZ;vrt50};=&;exe&g(_-)3!JJVO1;=5tQk zetp%=I|p4dH7EPN&(EnlrRX0&({A`6boSl4kYyOO;2CaR?nwiq9<7a$p`|QZhn;$LMwzgu7I&%4y_n$pPJ9p`f<3=rirs(~Z zFMoGT<+i5#ZvFMe?|-;(^B=S1SB`ES*SureA0B_Rdf2*+V@`Q|(Cw4H_42A|_x<3N z**WbmHvePD?yV&&mM8{zM}?h`*{9agLe+< z_}=`KO;S_pw`gfArR|%WL{3SC0DG!iO&y_p4FQZyRyh zf;)fu+$}$dR!=@~@5yC9-n?h$-ly)_d)3NMt{<`LuC2cvk}Wmuyzi)OYrpniC*PXA z`oNF{FXoK;*76PWuTRa$?pjg1`Kq?k)!&?1cD`OPcF`ooJop#{rzz0XK`{RM>_dcFez4YDR>Vvbo zUi^1ZzLsr$!9yWXjc|Gwj&Ri8Zc(bHGVlA}NLH@@=hjLB~%*L>rp?D)$wN@pog zC$G=TuN!e+u6(;v^|$jr^L}g7-PhbR`He{D?iFi`{8_VBAKjGoQf~0s+6`;p%Nvmbm z$^PsQLvMWOJFoxqwqNeQXUGG0toY^BQ|BzdCc0!+)`7z4^8G8uN>#V7|NN)N{<-+k zCDH6B6P;(C|IjPXow*{Jf6PO>hD{#cImq)_G4N~ z*HvyiZcpLb4YzH)@9Pi!^66ze61jWEJh8rg-RMu3pL^8s$^*6Cdsj>;+j_ir&=2O! zedXEj{!iB>#|%1p1z+YbnKJ6^3HtsXP7ykcO@hdhiId=WlOCLDri9J&abGiciCl4ty>OWm~ z!dp{3IlF30UK?}m#uFCA*WUP1*2cT?HY^{s;o}iY#xE>;BD=gJq)c6ZLRR*@uO@vj zR34R;6})Nf2V=8qo*$ewE9(yD=Vv#K&%5ZZA-&tDEu1wd=aH2;dwc7y9NM#Y$c5Xd^=5TlopbYyj*zHtU=d4Hsr>t(}NpgEqgBs@%syjp_P5(h@6FFXV`uiF?`ALClGofc=;Zf?Z24KC+Qkn|T60Ew z@vD!_9X59GZMTfr_ITd*tdh6qub!(`yb=C9kpJtMXT;~`UO8y=B_l6-H!JbNIrsm? zd*+#^95>6i^n~2syf|X&lnWoedE)Z%C0oMAS*3MdA6)&y3uQNcRMzyyh&gL7{-24t z3rlu9o(jD4f@i{}`5w<%x&NQNzm1h7OVh)!+1(lLZU8oBcV(EMEGzcT_Ectf-dlC+ zqkFpURP9z*S9h1Tx~o}rduE3YiDWjhVWc zk>{K^pYM4;pZ9P6%fEHwU-{$z?<;@*|M1>l`PFaK|GRs?_Lm<1i+}!`zy0^V{lQ=P z*2lm0TVMX)e)qrjm%jDc|MHt3T=~^6|L_n0t55#eH-B&c$}d0ri~sk(@VD-LWBiwY z@X4S1?cccbi+}KMKKuf9>9X^5=i*Z%JR@ehCQ zkA44FAN}(`_YZ#ludSwk`0+2j{~!PAFZ~by%)j@y-uXv=_ls};&FoL?eEWFv<{$pS zFJ1li;Ftc^znz`m|M_qK!u+v{{;mK1U-;+$!$0$*U;CAB{mcK4U;Q(G z?i&xk@hfj1{o?g+{M>)I^X0$rpYJ^XwQqd;w|?Qjb?H|={)2D)nQ#2sdimKu_g8-D z_uS(D&;AGh>tFd3|LE#p`S-7me*POj_xgYFt^ezHf93!6`CtCq|M_41`M>f@({Ft9 zwSRE$-}qm=@vr=aPyft2Klj=^Ou*u@SA^d@a6CP;Ko1x_MiNNf9t>b+6Vi8>f6`8*$VaYI7fBMIM>G!@_{?`BauYU6v?|uC6^z}dg=+AxQi+}xJ|J6@E z{$`SXYyBtw+AsXwU;3Z?*-~91E{`Q~$_J5GLD*y1W|MC4_`pM02|EquS%?IE9*5g0;tAF_MFMje{ z-};k(^PB(efB40tzxT)f(*OQH_|Eljef)R6`Tn2#z5mXC_uu^J+kfLf`ak`R|KuP4 zjlcIN{-^)hKm3)S`?+r%{FEiXe`^2R9RK}l9Duj^|6YHqq5p%Q|C#>pYxpnl|Lq?D zzR>~r?oZVNc$`Kt=3V~3;|>Sl^ojM86R+P5KEGq@^!u|BeJ(DyKV#A7(5;W{`@ins zbGu-#EC4+i)mIjOzA^k<*1IeG+>ZOzhM=?GhqnIH3Pa~UK=2hgoNWz62XB=U`z*2O z?7{idjYXF&|0)B~nP6~?J0F%!f$1<44QE{S#l3K3dS74OuOc+vcYWy3$wed6BSQaE zj84b%7Q5MXhp4Mpm_3|7(^2Ynswqe|I@+Dl>N3_+JmBC3czyerb@Q|{YCU>i6t`}U z!aogx>oTcJ@51@dV%PsEja~0|G{2G=*IL#YpzRX**chws`g~ zSKgmRPu>@Zfd8ZA$oqo-b?Sct&&HQ~$7cP{jr|)puE+krZ@&4@;=jL^|2qAD-A+hj zKgx7hN%~7`b{-%8=)t|X*zLrzBtJ=h8MwP$Y;LzcU*ozlAoyWfRt1o+n?RE= zChH*i5*#(5;jhBwIQBP|S@KT5AL1;{yG-plY~W9ux#m_djxj&!=t~KY0A{oxAsL?E`H`y8O=Vu3_Uf z0VMzEJZ;2Hq;2#!^`zESdq68NO7Eei##_PlC%yaN-knFT@@$5R%V2%M^BCH2!dN@%O>5p7boQ+qYzhe z1c$78z^qs6CFpPP%|?CrSw61C%UN2b0djp5im}#rAr`W%4}8Jz$id#Z?T>hSNu0Tz z+xVxW%w`8|#~o$0xWUsGzVwZ6_FXqctK#^iPQMGYb%6U}7o4$E-6w7{Jc$yJqs3C;H?;iWKYC&XS^2Z>G54th>Egr|<0V+}?MT_Wq(qX`SLPV*h+w z;p)!qtF8iwjt^LKOcfg83PG(s_agTXsLS)`5Z#r!&O2tGRpA@oxCigtgSY;G;!t5T zA39Q9^?EbEo8Er6%vWO_?m!Z#Up5U<~(sICHPX zy+Mn60~hy>lNV3sd0mXthfB~VIEimt_ixZr-@v7Qlv9RdH--x|aE%(chT}iR6L^8z z*QqwIKd56DSr1y_s?en2v?0yN7svI9zIuE8H>o~s05E&x6W{{2S9^=9!EzrWk#^m# zaL4u<@As(s_Zr)7d)2q8>f5&JyMV1xTwtr=sA0@MD5~P9n1OEM(Ygoy!EwW=Nq+r+ zVMMl7!|}psKg`{k>P6{roG{9J9%p20rTr^-4P0^6-p^J??(%R8Gn?h+;@NhOT;Z$a z3Z5ozW!JZYLvZKoq@48V4jnA`>l*tZsLBq_=(jD?K6QmImQ@MS%>Amm(|C}^6V@4gi530IpHtut^UW56#hLZu!Ihr_rwt3vwV9?ia#8^6gTzs+RNL>T^aSf@* z$5prf5JMtXNvR@<+OYd|rsA-#B%A47cP`L+sgLWMUQdmdD6cemAj z3+ldQ&T50Z=&t)csQW#h_jgf07%kl9P2lF{x@>~=b9czW9P|LA+|PR~JhBYLFm!f) za|hf^-=IxER)Pl-Vc+BJc&E{g_D)v0%S`*QdD`$Qql-+B3rkFJGQ_87zH7@kuhU3rra#VVFy{4}Uf9Zf_2C_Kkzu|GRbf+qm;nY4Wl8Tp z$!|gRw~(_(L#f*q4@sN)UN(mNq}V=l--9+_f75LZllS<%avawM+ISnF!4BU% zgKiSuWDlFi9^Y>BJKe}>++v>Qo_Z$($48u^)#(SMBI&UU-hw^w7BlDQeWLC(fe_SP z|0>kK+EPC}bKMPGg9ffO8@TiF{XSFa7E?&oT|qf|Oa?MC9@{AEK;C2#{Jx0bENLFz zdFR2s^oRG~J^bL-&i<7vuYs6(_$d7W>vZaJiBCY&_rW#a+*GzONxf6Mqg~V2Znr8F zzO$T6cb~q$bNlK0STNA`H_H9s-lNC&AAaOY^QY}~z#6owcW%?)?d8YBa2yl=0g4R! zeS7^$i3sPn>F@UPXyri-264@sOCRU;G+&(V+~yCxYRrZA!)p3%d);E06)U%%^mluC zFz4;uhJX8&rJ0gX{pt`J5!Is4+w0BoM%lSdf47%kuXfq%D`bNa|HQe7`g|!AAkfS3Ngs+UHJlK!o(FBvlMA&$hV`HkdUTOi z0HAAK*+%HeMcO!9WlP%ve7{Kj^CF*3YySAkIMXOO=a5buy)wme7);iHVRu`VfdgWyQBP6rYgY7K*42~^$>2A>&--a)uSFDwsAH1*t1rZ=g+tneC%DTK0R7bwIY7&Sr`2b zxh8(@!OfO?ybAKER~=pf`P8cpdNE@i{M4%sub6!5RR^3wu?l?XR|Ay=R0luysRBg$zT`UY zQ_ninSqTEX|J=8plSZYQ``EYE%J&gJ_pEoa24#kR>{)9z@o&S=ee0FSU=i}4``7ce zde)g|&$*8K)VGcvuX*p&<<@8_mE6akwU!0fSr&b3lxI?{-iELFpfS>|e`Q+FqxufC~YZ zQa<&nGeI$%KlH0nOs91*=UV)wS51z2#ESg6XT754N=1)3cLkkjgK~;~>{W|Wm0&IU z*s~V6y>l(XukKMx#22cl-+I;6+3!8`j{nh4^5;If$nmr6INuvD-6jN`r1{#vHpRX8 z>h%3$^=HLV*noS`zlE^-7wi3Um6IAedeFZGN5@D>8+`AfS47?39t5<3o1}i}T@x_g zwI+P&U30RYFSRCo>0NVLEGAkLzVxq&p&!03e(hcRcn+DLv^IV1U%Of#`MT~)@0v4^ zWBlj-^~$r{FAjd|T{j%+#YVcy{ldD>7pMn*;<>4d-+R}$6MT{RT`!krp72`_Z8wIE zjnM&Z=eGUUw{Ec@E1&(=x2|Iw7g7^G_pK+FkNwuSZdLl;R;B4{tcAZzcHmAW{A`^) zy)$!H5u$6;$IYF9Vt2*gfNJU2?KR&ewX%NPUgHDQAj+rh<-yhF81|6)vc1+vY?kq# zx7T@;yNiwM(C6)S&^48+;K%JXeh3-{ehYoxUMH)U*`nYzJ`uum(C zVkUJL+Z4TA%-qKEtxr95?lIr`)HBd7JJzI)LF}uhpluGiKp0y06^xyl{jk|l1-rD2pzxS(au3i1wvu0zXoc7)+-o4R& z>s1e39R26MbqZT)i}{8NR_0Ax9VC6Z!dB|@CUhl|eIwuc)FYLJ|JPdDVn5kKG8MGMQav!?&Ny-r;QcdmZzQ!~0R&4WI*gWFEO_Nf`% zPx`e_O?%7qb6lp9OYELj9ALTyx#4U6kj+M-rMk&rDhHI0;`N7k7)&LlaP0N?9-FfizQGU!- z9Π!BW{|LMAc$tzSKRRP2L(wE?5nSFJdTwnx3_r5Aapr+xlwpPH*nx@)~p z?1LV)B?QoX=~XKj?4<9d`QWKN#(mE)YlJ=j8$Rmag69w)TujaEildQPKlZ2r+OH#f z_xJ}rYnzqn7k8*dgVpI9eTan@`B^+u_EEnUygu(ie}&$Ir{J#bF7=9Q%GX{sYfm-l zOYd5SV)_UDY8z_F-+I;y*2h2SS397R`n_M>_{F{7yL8fYu$%pZKDF1?2}ss6StI|T zN9|QUxCa5e(q7{3;>h44t{R1%a;!y z;lB_dfBOQNz^{Do=Cx}#_up>G1P<`9RF5#=Z>IBNQLfT_Qq&1R#{QAOjP1mKHIw|Z z@7Rd{`qs6pR~q?$-n@3@+CRg8{W|{p{;$9L@GhXRrm)iK$Dh3O;QrloXZP~uA6~nA z`SQDm@20SMQ@|#AuUKTW%a`wc1RxSn9QOE$lk(lyx~OOQ25eCJJ^B8uSUiJ-2q9W5 zfiliKI_#!myfY<35OpB={!uwO#}2KacL4Lc0qk+-_Vgl@pBK;s=tcuUqc?114n@#e$+kA|Hx^!K}{4hV8 z;FsJrn%^bNw6qsMMQ;ZZZLiiq6(#)bTd(9lg7Ah;!+)?l05-<;1g^7NJNp2oV$n9U z+q|?;=K*E$$QEh-yat?o%oEVe*5uX~&>QoK!Dvk=Jptw`80V8Uf7H4NfCI7#R35Ji zl+Ti>V)prD-eX1Bi-GP)nZfTr2QstP@<<3Ws z?-LZlT^#YcY9 zMrBqZ*F&*5EuZBcxd#@Fqds88irf(`PDlgUBPb&fCH#Py0aY#js96LslNUBE{9<~S z<}!E(Bo(4DIU*>nLnkT02J{~iPq|5Su3!$UNSU{wV-tw? zFOD$7mz&-3Y(1fzRvB#8cmZ$*z7JyuCiMH4@zW?dJ1NE|FabU_9B*yRxdMYpGtC|{ zqTDb9s71MhY3`PpfiTpJl6@)~djaMW@AtP7!93Ao^m{h`_>DDT<(&*9_8h z2=S-PNOBkn{*cJh5f#RyCv^QHMU)#S$t2T{8&feZ;Klio+r%&^nig}}@bu`2if5cS z2J)UXFy~>3-Mbu1iV2|Ly%RTo1!mV71BC?mT3j%<`jUBx()o-F1cY@v?4(#s_#x0} zJ`1Cy%5%Ob$0rNi3kc9{#+K^XWJvnPyv`)`oZcO#X84GHx&jp65KQOV`x{|yvwEvO1!-;t3qxXQ8W8;{g2YZ|R z1lAzK8UB(86uh^hk5_;a&mp0VFLkNHnM$7cN1vLC2=>3^E7uo+1UQRb;KqQ3rrCjX zEDOve2H6et$5HYuKgWrVOMU<7_A~h5`%@iQ)spJ1E(X>%|-hzuqT%$>6Y2mipr!F5Scdr$gMy zdWAO^g&y8aU<_asb9WFX1Xw@{ixtrB+43YiLNMy1^OmZT%nundU@;sK*ZG13PJZ%m zCtx{8m0$=qOAs7)BygxTuIyQxmXH$@<_cCr_9HPT(4?Exe07>ngh!zHRTdE^>n66h zaxz~E|3OLmkFsCEf0L3QrTNS;3Hqs+Qk`7uOfx9}EG0h^BF2ur{V}!v7qN;XbY1d{QfpXh7bh%Q&t;IB?TY<-3@Mt9C54 zZjqY_-G3Q`=iw(RE>nm!b%e>(sNfx65ax^@e)KLs#O$5*S?PJ95z$$i^}XZ{c1Dlh zh_^20e(<}0VGal{Hzhj6urC;k9IJGIImg_xQdc~DBYqtwc0=IuXl_MvtucEJHwZC` z?c0qGwY%YSw_3T-H@s192HWWk{C5}seI5V3jQ_rd|Nbui`yDFkq(ArHpT>W`JF5@q z!?ApDPf~e8<*C{L{~hALKf!;$#DAaQzn@Yes&Nzl9pS%w^zR=1yBF*gI7|;9iU?>m zjg$x=pXf&0T_pbQc6JPnyRAQ8 z15@Ru@e-}$kA+RWln##a*=#t{UyjT#+4vbINi#oB{m&3NnogZSXMSGzpBMQV0OFV* zSN_LwwsQO8IOoG>3e~>QiIZ!;C^65lBUYx&sV{Ttm@2$*!V*7@Mls8(6Z7+q{~0Ef zxZQcSdX_%1^Ze*!jw(oAxKXNL*zv`Ouv!NWJ4Oqg3B+4;qpH*Jqxh zgtY$^$&CC^1Y3^COzxNq1IzIp2PW=2bx%;%4hS@f=dL zHTZo07CyTG`!uYfMf9em}%}&)qxeO2({&wPZpBQQG&4dr^ou z8O{;bAAzJTsZDcA^q{<6{@hInipuz2dfza4%#?%~2bdx`CvfwAZ}-Txi8C@{@eUhf z`91w2UzL>zaC|)d)H-4)`{9c02PJ5Z{|9tuIjsZQ8bjI}Bfq-A))*zIDhWFP`AI?k z1*y?e4RuV~^Sd3E!;x{xLF1FiDDslNu#mPn|#VW@+r3f3z7mRWPb;K>` zW5}O4=ENh~1m!xUY?GW}vZ4f^lH;*LxN1tTX!Ii_i7y@9if~^f32pX1~3e zTeh7^3Yy6UkS5a4l~vrT5(`lf7ctBR`1*OB~ z9N!2V=L8r^r>klo>{EP$v$p4WQDUA?v#Dhibga2Mhah=JDMH>B-C2Qi14UU?Ny0czYPjVqA#@Ti3w z@hwOI_(TKlJidGXelidNU+A=Fc2L?Q9U1MYx8HICqJMk%7{H|{&=x}_1exQ|8Peh{&;7{6#enrZ@K6DSAKlu z`rBcJCr?}r`U*{b`l|G z;cjjF(Ou-_!U-vorP)!EYz#Y+Ob^Fy>z%lTmg3R_$jl2C1xHPuGbh8h1})K*=Sl|d z(Kf+z!7@@~Kqw;z>u?SJzjp=y-M_y7CVbexzPJBozI)YuzOr`>p5EJs&(Eh*{Bz^Y zme~V)L@rYn5Fxp=PtKQcd-CZwJEzXJKlGK)&o`CyPR#-l-gR_-Q;RcUdlH=4t z_GrU$KZ&7(j#npOT(aF4PRP-%ipAkTF_a?(+e;n-6Bg%xt|Yl^vsDcU*Dhu^C#h5S7n5)MtZg=ch(TYp7k0QN9j|Gvz~q59ld%Dj@d@NVD$Qb$(GKu5ppDV-%aGOv=Zr^i6Qyd5 z*@JzBgVA^peIh<#xb<+0v!j=m@L?eO$j2dQH3@3KGN_(`hvW%}(}kK%?hMK_C$z+J zOmONzlZ!n*!h_(L)D)~)eBsvTUKsKQFU&sbFL!L`0OTUc7{1CuE~1HcFUpQ8k;^hT z7SlDa8};!WGew>Kte~T)dV{Xgc#m#_UJSnPCGV6#b#*LKz}J{(VA=s%OQsCc;~gZ? zIItXKj7OatPoiHjJ2aG;2Sh%1-BYsgq|;f62Ebhma~VpWbSI|VM>3RW6`I_R*2QcR zo7Q+|qn#32a8+RGi`gatEE_jHN<=M2f>+!b(AOa0;=8OmKoby(Kx!y-6EodAk^5?h z1ApvyrX9FD)!8}TWM0;Cr-VroiL+=PznO@j)GqUCb+Cf8%f0EKA>9t0fa$ugz8jQ1 z^t)gLI&dF>P!6q$67^C*D+aJB=8|N|$*10YY>fLziX7M7`s3ZC@or3nByV?Lg7+WF zUTz%Xz((q}1H>qvxv6#Yf<{@kQKLUbT_yo>3#{Wz7x69r(!x{ggnGb(gq2!lXO48v z%hfqDK`QCyyCMsfl*Nf@IvNUvE7we*c&tdn??{7_?cF8#f#af4yL5EUd@qc3ZW09| z$zm=Z4U8b@XA2Q`&5L1E%PjG^Z%(+GZkg;)!aBwdK&U+vvYt&yWg^4Fi>@~A0X*k- zKEBVB>P^-7JD#5v3>_Q*;C=2^BM}0AwuboD4PZ#NJx}0g1oj!2U@C%#i+m=)2M1>z ziH9&1Y8g*8uS3;xEbO_EgYhoi_;B8V%)nlfmm)`4N;a=u7H0TY;*Hter?T%Y7kCv@ zaYv2vQJcf7*X?txmr1zH}BII(d%CX}uL7E}r1N(_RZkQV3cV+|7am!5< zyp_CS(Dgv5C8&E?PGCkS9q?B7H;9`lO7$p>qVEgP=o0*>$~A551K$y~D+{6H%?Q_? zn;zm6HoXYVDIk`)`;fL*#YuEgvzmi%Z&A&8|H7MDoIdiFHQiQj$2)QgltgBXOtNHX zbKR|Suur<10uAY@+qBCQ7{v-4Gt#^s?}7f%x2Gjx8>k-%8tllPM;a)c`@PUiuA2sR z5aCS*h907WNIFPD-Xqs;Ha%6|LB=(8oUM>faM33_=oRi2E}l;ljfN@-+_K|VDVZ$r zT=0apk@mMNX@4ucTEL`HP?}33Z?u(=%Q4nW**~lh!L8o93+^vaNG- z9J@Cg#$;W&eexNkH{WauCT`V@T}V>CKzBQgBUTeIE1| zzH%2U<7xvV^j3{xu~9hEu_O1xqbrchTF=$Tnuot$0K6D_wH4z6^jeeL-99UDxT$nP z8aKvudvjjboAW`qE_w;f$W6<&UV+E$gl~gr8Py?-gAB%FGQJ*p%2_3T5>Q!5$|r2K z*~>S5AKwh_w0H7p$;=oTT#N{Wr(60oLc2Cy{6%H%b7|>uU^)xEppaD(W}&(Cq*rz` zk6v?6jMrQ$4?i^z%`SmE1@vU>l*SW<#IxZClf*|uT_Z7)Y?7W9S?Z-ZAllp@&cs5Q zZQV+IQ9UU>HJV?@+vui=CNRlJAg7Xo@c0zuhI&wsilH)dgU4HhKl1DMl+=VSXsk)g zTVhJd@}3e-)>W%)yuuFCNm-E3&=1L-+{tC69bcePX+;j8i_B58^K`jhEu9!tsR8*= zom_eFZr1ibGR&@f@n>KvZ{c_ot?^{%Bg^w{+d6x8>llLK6|s$7F+)+Sk}cuJtl|U; zjI3HUevpSWRIx?`4jJ>e_(r0!|%hl)Z;GZAR0+6L?Cm zCvJ>TETYnEf)2dc9`TH@Y2z`uRR<$U7Hkw&F`#Eiv2dHAV7;fUt~asPB!QLH6X^Zv zPG?>>YSP(67Vd#bh&)2K3OYu?MXmt6y6*|bN-uAb>)`H9!K0<4p(<>sYH4WjBdofh z-EY|Bcn~c?7m3xpU^YBqPY&WuVdM{$K8AXWS#s34wW;r7hf88gB#wlxuY1pphY{Y{ zZjHbbvq8PAg)Smq(9kH|dA>6={YD&S095AW_tXoETmII+=)n!?(PD#wb-IG5~1p_4@XRmO6=3ToG5LG3yUYA5T( zvnmqP;F4J{iaJmtic>uhETYrD7I_DMe70> zIVRd#L$x4mdT)4ORQbFZm$P!=Z!_u)+-E<5cG4$snH`wR?9(qprpKEp^ZBwqH~r;^ zlC?U^9UNHq3D}jh{5YFgyMg0>Cdj1ntYmatA-0#4Ip8O?IG>kmb6yg*s_SyHfCv@D z`q-vuYE`h@sZhf(q7GD6X&y^B$toY`q#xzCSc9e)t61ux5wY&j8x}G$3YDQxr)Q-j z6*pgox@lx5jF@XCoi!L4fGkOTQi*<6tMyoQ{*E7XBoGumu1nx)%wc4;IP_?BG@_d~ zCFreYEokcD7quv3rxO$SsWv-!M63=-b7U)%@H%fUQ^E<(&=`H?rk5kAkh`eL^=eEZ zjoLUgNHPHSm{@FBzyoqT5tRy_57#Pa#=N^Cst(bG1s=Ow4|%d-Po)98DpIEG@|X)JPV%C?O9(S+XhQViR(cbp$qlsLNqyIjCJYWC6T#vZ`gX zxXwV8{YEGn?M3$sicwUCE2KYx!XsPQJ^eEIWvPM%LELHf`!H}1x_;Vf3fYTH!3!S(j+^97ij2l zWx-%j9i$CzAX@sso4{zIJmsM4HiwR7pc%wB)|H(L3eqHtH;lZohulS-ui%1$IVE$^ z33;sr0#A|NO0V%pcO^V2K6MX@H}*&A)hlM7gLP3&bk|f94p^}LwV3H2pi>?i2h1mbEB1jDOk!=Vr82e&}`h1k0yTQ4i zpPP}n<;82evd&3vSA>$L379*Ng3M#>oLPYu1>Fnj=R$4eMjc%W6mHh3sZ-fMQqhfE zk*`8cSN%+=>6&xcrC122uc=-Lk62>04MEKd=^UyKodZT+zH-IG;mgSM{iogVEU`=v zY|dR~&>pK89k8;8CwYscowzHbn4)hZ+#VP)OW)W%kfLsp4I>X&wHL|(MNhD7j=09m z@Z6-%HknXuA6bD7Txn3t^g#=v8?v+%7N_yZ8-SLZsy~63VAOJVp)b=XT*^QDw4G;G zXZRCj^TD4IaPutFN{BaSWjdW@r{$`}3F*4M&#t%JXx=5$Usp&Nlg5ftzzT`9>b&Ef zKO6p`>J3U}R0(Uxa)GCE`$ zf?e_5#U!gv4uV}VE6XMEOvPfM0>Y%s=`iLVFCnPL(eva1g-4P+^=rEd6y6m)V(cAO zjYq17L=1vfPXHaHUfGon1tBB&RK|bF=qnQPH1_nKE)i5W4AiiS_7YzRCi6Y-GXvtc z7x}sQIq_|%xaK>Y%>{u}Q*Z2ZD-AGZpNMo2hO_WQvYzV}ia3siX>#juYDlxqjI#DjWHv=Ct z{}Q9SQv-vE^I>Hi8jrKe2e$Bt&|Jd%&&dbG0D{A|Yh{sxz{0>sn`Lui{1cMMO`{?{ zEL4FJ97KbPfe=S5KNORqoL9^QOmwg3Z72)wX9B12zj~LjMR~Sm`jo$i$+3FSVv&$Z ze1IJuvJxZG8r+C)U`N8iVMTT8k>WrWv~fM)&4JegXufVHaNIcXDJ6jfP?Y(|YBo(6MaD0hNEJz{7Ajji`KLX{rfHi&F@!duE9K*)99avG#t=#bH- zN=Vx@0i?o?pMKg;gLTOJ9gC1JlH#29g3^{C>Fy3*(@rQ!e0&SjVEAv9sO`7j8etO}pR8pY~OrM9N z=<(I|$JZECh+kh!@d6*%4rp+X?}I+lZVXARM`Yu{5NCm#q_Z&yJBQ*{tfp&AfLm0 zIYh+^#DCRtXX0~5IZR|fT$EwM;#UB-U2v}%G?-+1TXC{Zi4 z!a<4$YdE~iv{Cs&;LEd}xDpsBI+c3wZ0odxk>PHUCBpKdqaa|mrRNCQgp3Op3*BBA zKhzp)7WtWS({)KKC+k5$Pawa>u5uj%!3BJ=YZrPI%uSVp)^yzwr2P znQjfbdNtg3Tkv~*F?ZjFC2t{08&WFezqj2@FL=#(a&4!vRh_N33~;I%nM_KAMR1a7 z7~V;Yqv$Ek2TYh?AYcHuATb$O9N`M}%nOy0sN&YkYT9*GRhzD<=!*NQZmCy(nN;Bz zo)(Q!Y`G?;ASym;G3}+_@)yB5~{8l_^Z|&SBzxQ{I8$mEtv0J=gUx{K(AvhF-i&Yzk zCxLSUR%9SKfMK}K8~Qo#K{>}`T$Y53(ES2u!t>2|W%x9_JYTE&~{h)^&pQB_zfdWz=YQYALih><;o!d$vVs4uUf}u!Eo_SK zT$;M*Qom=N>iuu<_o!I7yCUfCTAz5&eDN*${eYCYuh9OWO`9}qMtjfIg{6@qLOn94zq=pHk}?1;%ni;)cAnIVa?KQZKWCIy9a@4+3MJC z*-=7)SL`B!5RYZ;5h`#`Fhs>DP+ChQ;UckchD6Cv={+)Rj_SVf#Ho7_c`i~YB@7)* z?yCZT7vn(7R%_i2yC-faxm)G4j9sKRR=#R0U!}^9@Ejw~)yA6FY|U$i%CaSD?05mf zW7l@tnz?S95s$b}y5SWE_cvENUJZuh!+d{0zCdg-5>#HK9~XKaoGjU zOLV1ofc`+?5dbxn;R_>3>*-*aM*r>Z2CH#JgisEH8MrE=^!YHT0L?_JxX<;Z+Vc^V z3acGMR85sWPnWZGWt65B8RuPjh7BAYjmA#6r&srQX*w8F(~f!YZMYWp2qfE&l#2QJ z<74FGdeb8;;#C99=`z-n0lKOpu8^w;2M{8?K+{mLd*r5u(8VSKq>DSm!wDybCU?Wc zTn$&zOz7rSycX8uQ)_pPtEbQeoeRkI?Cdw{VN}DUG2Zaa&qwDYGg4^*9Qa7*(A|fh zxKCd;rkvvP)QOo~NW0r`Bk12o$54KP+t}@iFKr{6j!@uNA9&Ankern9EDXRmYnF0x zr2)s!5i54wnTCn|VmLHPDQ-d?^I6@Cm_LPhK?*Fpu7m(iK(W6-u?S&CuQJ6;+3-4h z1fjHb(+%I1knvvRf@WXTJtlS_Vh1!5;BUlnR>%U}@yyf1rRvPB2ycVSyc<~?({&Ts z2M#fzKE5G+9Ap#Dv?Gh4@R@^ZeN+Qn8ve=^U)Nvx9(RmZQ2nwNm=vdo38!^m^L5L~ zdR7jtdhU1iN5MudsNsWzQkwYA`yMXxDvM9^y@HH76>dX-XfMb-aF#)$A7X@y1qyNJfo|(Y99V?>{v$6M zv>%N_>`sgP;8g&@u;U~d_)t?~glRKE_XvgGL7C6eIuxO-o`8sj$B!f`dJh26L2JS= zxVLTz46XogyXAKM4M8d~7@aq|2gOCWFADL{>?pOw1W2z!Sj#}I6?&I94iooevKL7I zR_d1$;(o+g*g)m^kU*Exfq;PtI#Yz*q*g;pt)eX+MOaIW*8z?`jOP@)NfOjN-ZsSY zoU7^w%>?SSLiODlbw}wOae`3)&468GVx%(3fPn~_-A59m4uPB{%-6&-*Mu{5JL$A2 z*VPP&fV;9$Vb0y5{UMeF^1a92yZNL;MHvTWd-%jg3Vf9)KqA!J$v@vgzkPz08!Vrnxu3z415`Z^^v# zNCz#ikW?!1fGYvrLs86-$ z1_`->Hz87oqGllmA#A)^y_2%UyEDsok_&G_b0J)dFNAAg>>zbd_ifNr2$`$E?Wc^) z@#xx0#xV8RXJyMC!SB_rZvQqlm=Y%K~nnd)X_SN zxY9furHZPxdu-agNbmZ)=EuEld0C^g5;`Cw<2Jb}7-|uLes{dq_&V0o63dksDWC7> z7Slbr^@-Q1*-oPs_so}pUhiLNlyN_? zJ_vK(K`H+_E<*<(D&;fXb(I42YAw`w-#&R32E*qvL6qS@%)OGIb$9nRVRB}|lQXBK zc|_bY5X`hn%VGG@jX3=128SPc1$2X+aZE>tmYQi>Q3dt`NSha057cd(OBS0xD7~dGgFw6<_q-kAfV;vfd=?;xG;9$H@*oCi=*qjKOZkX5yq!@pwitz@{ zNu)X_Y06k>M9m(t4&SkGu|66)0D9z%WsKf&bPlPk1{Uo%3Kc`}1cF(l_R#YU{OJ;t zD-F|)V`~8eV!Ke=5KY74h?qzKeeS+VBsmEo$x#i-c}Jk|*k5727B*NGG$AoDm2z+F z+miM^m}@dQRj|}gI!ceC9*JKAX!0d-@hU$?Ktu#79!ZYq#V!yB=6{gv?{gF;f|!QQ z0`OKP6BuxUI&@!@#B`V~7TnMRz{)Qc-LNm{xv+Cmy0fxlmfg%4caI@YS&JX`UGx&X z>FQ`AF!#WeRR;(pjGgvYLLyf=2j2xRwmIi(LH#AZ1yj<(;>UHw>OrmpiH>!+mxkx@ z&GI+JHhW^Rfl)eH~5K}y6o=F^LM_2b?L}6Wk{e$sjC&e+$+;UZvfUO?h zgOVRL6Cb;68Ue36xW(Bs_x6H3o%AJ0)X5hiCT0B&l}ZOlH(0^@yVl*4^O*~78u^u3 zEh})_UO@Eo!b!30)g!!|xi?xa1iE=crIi%>T`iRu-N#ChGYoV(1w1mMNNgrXr!|1( z2r2}d;;nd7yyb{AF6&)mYY#8SPE)*EBMl5*Dk1Df_RnnXfV1NCg}k#o4j&@>`uEuk z#UA*ZVlf5Auw0p+g#IEYr;bF#t1-QBC;?_Y8g?!l*ALEp3$MYKJZ>GwCpIsHC4wrC&ZRe{em zd9_&VuE2Uh0FT&HriYlGj??_P_V)p&!2P|d8ifg^xFB)=OxFw$J67j}!u2c{6*aVA zbrGEUMt-}h+`ygAULZg)_F)TFf&kJ7h23>mEC@x3Q5>3YFiqnjX=}R(n;oS##J{lB zVV_~p=xJ_JjY$R=@XxnNnD?QB0`-ZyMkEsi{OrNl(RY&_EK6`j18w?y=u}Es@ETd< ze&ROcV1EeRK0Y9jf}Qi7gB0Ko_Q5>)d^k#>Kd}Exu1&(@=TeH+Jn)G^jqe z7S(I3urVFKe{vljxXG~1Uv~>-s=@TuvEw<%kx#vM18ryvVdFz8TK1m0r-V)u5q=Iu zVmF*idcf)gR!R*!E(nNGcI>PHQQnzn2i%NL%YwpfMv`fj#uxNhygVA69ww2MwE5~y zfIKw6ID$E{ji-5#W3XOj#SG(C2%oB4jR-p1T)g>)`a@SHN-Y6$iHwpjy_32M4JeQs zHU4l|`>YP!vp3^#rFhL^rU;tZ;T#}4hy&{3xleDxX2X~pXoUi84B$<7ZkAI_<1#oM zwbs@2Qbta*;d!mmFYN4~s&lpQcJE}|cfyneezhK;q3K@ht2G^g^(XcsHnM?P;0-~e zCQ=k8S|_~86HI?X84=-X#@YMQ&rs4m^V312o=kg~u*mmTUG6j^f^b!vx_2o`U??f+ zF*5>}*@?UjILmDVk3ZWWpbT^6c8}{4J;pn(A}J)B9~H-ICz<3e={GrE z2yim;1~)dPkAvgk-t$3bp`zecI4jq)38K*vY`U2vgZIP8Ysl4bJIdq&a!kP;$bexx zD=lbns+r&k7!xpmcMfu3X@*irfv}9?jWJDWX<@1usL38SP){lK>H4vnI zZwtBx?NxgXK?TKM;A21PiNwU(sgN#`Z{dF8kvwDA(%yqU07 zlxuRvTvEB3)J2+`%gy}w83{xhDdI|p_+Ezrrss+Qy;2M@7Z6Ub1zqIig{HkHg;k~i zxnn#u7{g^!1Dal^?yR9J+Txs1--`vEC*0;o01N2enKXOK@szMLO>=lToMg*ozEG$~ zlW2v`=!l`v>XR6E2KWq6$nri9xh0b__JGq3(UGSlp=}eYpf03@OvnU51}L)zX2s~# zET9v*3FR&m+YtFm=%j}#GJYet&ke1Vp;4mNcQB}OHGLgLlgO9SiYw^$OD<`dx<87O z@blq;)M|MzyC&z8uz7UNkQa1zQ=}Qg`o0~rzHb}W_gx=#(qbhr%9)lp6|1AspCzDN zSFr z?%LK$kDktC%Tn>EJ?BhJZujPt@Mv1zH;*+rzm;o}t-8 ztpDTO1L_I_zm@S5&J9>a8TvwI!2^7D(1BF1FVrVm%?2gMCV{V8I%QCN%9N+D@(Pkp zJ}0O{miN2S6p{|j0@2qcy}t;_#y&w!lip7|xG=tYAD4BxvC{$WxqH zj0V0cd%p&S*Q=b-7Sum`p+Ev<9C5RkysHiz(wts}m5>!&LJCY`ltJ(Ifw8Zc13N|@ zq8jr?^Xt7#;>uk7Dh57(4nY z>&ByqQhzAgG7hnBLRDuryF?T&K!w!0Y^(SPgi&JRmh782k;Mf3*A>0Q#w)T)M!*;o zalYsiBq_LL9LWr)!fRKclOTCU@AF>#G)Aly$aV(_Y%_EMg%soNHYI;lU_GBZ@@F0I zz+-lexh8Sw^F*XPpQMSQA z0yn5e@-at+VpNNgR%75K29@E6e2Jt~%ySEU*c}YFC3Me3to4n_Z3evQc_u5ZLsWWBg?V;ZAKogI5*L;r{6A=vtEnfSVw1Q+drZf?6U^ zX5HQZ&149kYmT>fV@rf%xqIiq18dp%_|Bs{AKp8>_vo<=GMf&rg+YSZt!r+4x4hHX zzf=W`eVF}Y1Ig7LqdcFuk z!iYBCz$F*{gNWrYIe?g_p$4vkumn+JkE5Iz0YUg7ZWI!J;Z8r#Yefe#zTr_L zDCVdGi$DX({_(kf2=7_=b~MOlE>&t@&-{EdCppgw=&ybDPX9fSdZPD08-ykJp0@JY@WO&PnHq);;I zQUSNWq^T552bmG2!wfb)?RCP4+iE$Pr`3rB^r2KAN4uKKCUPWvYv=Yoh$=`wfP{-^ z#|y3+IR$d#I4*sDlusZ*6ry6G3?Y{eDOfO;h;MpybRyQ6Q_w<>M82^J4b|pgBrDC^ z3r%u<+L(o!t+S^~^dY#d`2p#HNtQb#%@C?_G6rf+%Q0AZ(#aZmCW#;{W|?F=(5*g7 zJTpejlA|4WMf8LtUuTY*IYD4mI+_WNjPpF>4T8?VSw+N@vYK!Q<`9!|>|N2R3zMAf zIGUVKd{TT($g#%L1?HMCbubo@*}yMmCd>g3zzxB?SHtm!@)8mjdf6gh8@wr)_jt|& zQli^0a-sR&&g~C1eNwdb$Ptx8kw~lOeSCz`q^hj_L;YFv2i~~NB-+HA3avuzW)3bV zJ}xpF^u8AdsS5N$24!m{3-TJkxiKO02o{|2kOAjC zuW`rVi>8hv^%=oI=+{xk(eh`cwL*7z2J_d5uKGk{nI(}bo0tgu#>pCE3COp)NM;wo z-HM}9pFVXp)t{i*CrbU`=5~TsK5m}vmR8XTqB3PaBbqspTqv{;ewh3C$!GaF$EWIx z=$1RpC8@dk(6JMo><25A>`Ag0i8}VW2V`hZS)surwd2(0Lyx6MapkrZ5229PN*E%NOxY_#cN724s5|KALKnHTe+pCthSM6_4{M&!zy)=xI ze(+{ua4CQv>A%}Gn%2(?*g?+n;eq!<5K6_@&7F_$Grn%7f#ioR@!?2SK!18#Oen5M zs8TY>W*}o98zo;`ggMNoUc<%8v@ir@Kfx04m{T-Hs$#6*em0g|NRtAQgFtIpJg=^4 z2~NXpDi0;TInC>_cfIhHIe-OkxRde>i6zDABcbAu@EA>nG=UVnZDQ9)VMxU&j1t2q zCb8-!p}i$p^XJ$?8Y$HWj5acsQbSbiiyGVvB4F z$6FxdrBv1t8Nq31&YJV#MJ6UW;NE*6e1j$D5GN(H)pedWfDg5$9AADO)aVfcPhmfh zvR0)5sqo`abBQBB;DJ8~Db-LInF`k#{f-K^K`i;z0mx4A7j%%R*9;U?#O~FQ*hsir z`4MCJCJ;H}?hX`W;FbtS1&}$%<7kTIujzn_rz#Y@8{MhEfGh{MQI{F&kEUWCy zU1M^m&^L3NjG~K3GP+0w`5sgOx<@D~Jk@dJt$~`nAyK#YqqK6EGip`jr+Iw;qa;i& z&qOz!XprkoWK26&vem;raCL@H@Mwpw88D$I=oWZ{E7rg$qRAQ9TOS((;pHb^j)+`X zM?()*giHx)C&-#*Mx#c)VsTnNlV}vfLU|NT-+~~|h!)x3e!jhFR?Lz?QIjvtxjG*a zJP-#UY23fkZbJ+`AEKS8yP_Bad7g${4xhbpkT3ZVd{ERQ6v8;`pR2NfPJc z3Gu=~)E>U>Jy4zoNFS0qy2^Bs&d9hA%c zk*jf4Hv?-#Bp09GH_Lt5glV}7ez>Z;vqe4fj>pw8JUuD!Vrh!j!o4Yd1NvmVsauEQ zmYuS!`e6)1B~J-Yui7k7FpQD?dex?PD)%Yz+0_)M7gVavP=6Mge$#7Md9q6E_f=BG zUV7tFDjXR}65zB60biF~zg0bpcqFL0tsNtj5gKR%Q;PMN{N`8*d;(!qc3I7;@|9$g zZ@6J1>#(q>mVk&TGL-BMJgUL)Z4DmtNptGWpcbXJmYurO4IAbrZ0`(UA5_XU%@Tw~ zSLPA>4zIHAP|TSu5kMrW^-+UJ?6wh!cVt%@b3Rm|d*76dUf`~_#tUA5l`n9@N8<&T zU+DqnE!S@lv#)%N@=T)9Ka018OF<{Fe~<`&urp}m-fdrzObUc4ynYkgBd`F_@E z9s|L|Cq&)6(m^1L54UeFD&KkSx(OZtFN60ifJN?*fJC5X!4J%q57TgZrTW#b>Q|%c z;d07V?0AU1J?I*)iQkoNXh3$8Uhr<^3Ep zfDHjgVD|>`2sEj2+2x-%wxa?-2K%vHU;~|EB(ZhNYF<1|2n9s+ksfA6G>sy(qhCyrKit8ml>+#(1s zka#(RDLnE)qVfIK{Ro; z8*kp`d(mGBJS&zbop0}8hB|l9>}%zO4lcwB@m53Ev~8R1h~_Hm+-Q00Mr*yhI(VtC zZKvJ(X>GMzU-4ecU+G@E*w*fNp}rER6}$s&F_1S z>K=*J2h)X*Ipzcog1K(UgTw2ifgq2-_PCyt0$8C$GJcckQPN5ERKv$4TPG|oPo{3O^?sr~QOZFKbUq)l#}Z@e>K zCJ4SAF?sw!wlaLDIJ|hS;Fn(01wRikk}ndoFdud6rfAdo;QQRpu(h_a8qMB+EgC+P z9UQ!9BQ%b;cW&SFVb`%A?K?Sm+Z)$R@Y-T=vz)RUnxt+~18(5lmT<5ZJFXGjXT#?x zpO0jVkP95TPWg@rE)PV0n9kUcaS5m+Tx#!Tm#FKV^gM94BmIkMM{^1VO-DTro&V5j zfxyH;d*k-^UUI)yADRd<&>gGwirntlfql*~CHfWxv#ra-yQ=l-8Rr2aEK!Q_fVt#I zn><)+_Izd(dK=3tYD627&x)yH<=^3E7d?duUC6uaFr=>_=}~zIcp#t9&<$r+W|L{* zeL>~>2G1QR!jgumBxqvZc@+X#8Wn97>*$XfIY|UANZvLK$A%$9p#;}_%Ghg~>%7Nm zag%1|!uKaH^ZpC1ES=A|KS{Kbu{ZF>!C6PO%6A04p{jCrnkN)7k0Znb5XIw>Pf!s> zoi+ktPdeX!9KQd!<^6{xWbY`J;I-E}12nCo`W*ONU-2dziB~g`m7&7TB~6d) zAR=V{N_d&=U)j0+KKt_CC12h`(|*XE7Wm(0>$(I8v#}%K^Aa?q*}~P9ggD@}=mXl_Qo?7NYzxUq$WlajYU2pxnv@ zf5<5IT*>E+N~<;bi^KirS3{TKX41@cXLe4I_Kuy^ zZBUd!@xw4kcdp?Zm@2Z>vt3tfw>r!7rJp3cx(SQ#tQ4nsjB;WRW^l^msofpxE=$Mf zW6TCrbJTlO1a5l>hvO7(0P4_L(A}m>i5Mt2pxXNEb~GJ&Xv12tAGnk{%b@QJtf)ZZ z1jmovce^ZG!3uKF0iZcWZ6H8Lc6^L}sgP^n2UN701GBLrkKTPeHu2lRT^!Ul&<)CT z0}+0~>+g7|m8<6HwT?p!Wp#jVQAkBqS?xzx|CT76|EA$c~ z-UJU&`=h_RLCMi%S^!tZ);UF|Xg{av5fYQCr2U$~c%X}r&H&I>D5v9N;!grfB`%8SuxIcXdE($EmPHX zyH=XBul>%1$j#%ijpIBXTSm~0?QYWG2DzVnoTPU6G-?HTdrUqC_pZA~#;^vilgqLo z9w;>Pvb4}C;|h-F zSLLWapxTExF}4Y~KWJJ=b|moR1;T%=M8J7ZAK+Fy!wE%tPGOxj1_@tkgaHXgipMbn zwsq}R++0sSNEd>!Q35RRwp!#hCZmMK0dX~}Ft@`ZA8YiJG6Akbj!`;W@QF~-L3kOR zCB{j$v6N5!PG?1Y5J1K^bDd~xle-e<`2^T>;u&gxp#+zpfN>$ew5IIXa|)njjIXJn zsrv~dJwJM@BS+{J_YI6x4Pnu!9UW%Daggwy4lDlgSd>C*s1oZm17!`B*n^qcV8lL& zT53_NaQIt*euh2oVh0%0&u_qB&wCLa;}|e8FD9ZUhKqBXPI*mHBEc!n=5)1}l?hqX zNmCMS!Zj$eK>HB}#7SiD!YXFGZ>x_|WRVDQz6uF~MFmEX?7)$ds}16Eb?5dE0oD1? zhHDEYxr2j0gWsdjYgU60hGVXr9HbkS8Xh;2&-Jfe@pM<7ZExE#TN zP2``JCSq4b2UGz2u)PEr4TxhV*s<1v^tR|F=;~zN?quUN&-u7a}RJ|0Y zXW$ljl{(twt%$@OZc32BHMdp}YD$+q$C*We*~->v-mSKtHj;as5%PN&`x8cx>N*uw z;-g*xQEb6JU`&lvOAxa<`;ZrO<)m~0JLPeqF7Td1@I&xn*qDfiSiT~NsRdz{|HU9!;M##)mHdt#ewnsHR za~(bpR7&?D({DL5c&$MOBf*2iO)&=;4X@r3kxW`A@Hu*=eUYgG^CQ4KEEVe5Kr|A- z76~$dK^EX@ru3gpAe2G?*MzX!4j^J%L-vRP54va9n2{>r)_~(gS2ZO}=$KKE*XAuV zO3$s@JXwN0nbP32Cun; zYltVJh#o-pSvdBuChijrmx_%dn-~*%zw{!RwXHa9h;D0ue>0YBb_gE_q?FO8<9F!EG#Co6ZuCa793{Y2@{Zwq zMY4S`a$ICJB$oiAW@dQ42C*l$HO#)F`VRzY&~JQS^Ogu&8R}-0-N4u1tJn_6EcDv8 z+lg84C5Iaia5PA_4|fT5%v-s&HbIJ%04j!@U_fJ(bw-sIXR37N@r}TBdxViKSAWm0 z^Gp%I**Sr^CSM7?SIYn*NWPkDuB(}|Rkmz40#DoEl~|3X?1)(^+U=-~foOq@Nsvw?YG${nf0|%gv|`p1q%1?uS>v zSZNMCg>7(4fRH&yrQ=|g>O+;GGV-tB#V&x)f0b9sN6o0Ot6#4!qYuHaZHt zt@*X%au-mR;njfuZcC6ZaRum~WjV;+*xy`#)mC|wRzbID5ZN0??tQykIs}!6Ev{s) z?v5M$j!r{Rh^K>FgFA0$l*U_XFfK=s$9MnAaM-*2&T8i(r8#Hti&cs8Xy9$O1|Ao) zL%1zES&s!aMfaR*ak-8(#yp*x^H*``OTttRaOaUjaQ|^|ReC*aW7S@2pWEJjJ1j1s z(B~c17?E1{u@sOHGKRb3TO2L&I&ER1t^M2Atd8T_&TU`@?m&hNvaF>abDp>R0L?Vb z#yRUf_5~N5FoSZ*N<&abRb<`~_qI_gTpC&Qa+HM|&P*DYDul$Mwvq{EK3^{|@kk;r zL*yucFY^tdC2K}B37rnnSF5DtI2FS)39>UI#Jc%H>*Xx>GlM>0?j0w_RJeE2!XexP z?iH^~1IGkXnei|kA>DM7NpS1@Ug$YkRgX|Rep*b(0STNp#;a0pavCMtj_^6cTv^1q zVrA}C&Ps>LR29)s?BAhK50|`VH32!1J%JEld8iQAoEhBU!=9%n#bn|J4Agu#$CTlf zq4}VEg5~2?CJ2jyHQxA&aLxD)2wc|~5cJ($%*6yI4zEdfiMWYbjL%K_!SmP-jF@Pw z90X|zL3bH~H<2WQl!?)#hmwh+1&H@T@ibc&*h{k~{KMe#1^EH@lazD)p6dSD6P@F= z(7JjJOsjApA46it7KJ0jH)E=rVucB0Dk@6pxsVGJMg}bqtl+-On0bt(+zeDxwZXRb5bq9rQan^aJIbPqTBc`OX3^mdQ`lw85tHX(ppG>2h72u!tmC z6v=v~3}wJ1wP8%(m28LBKS3XcSkpA|@6nMEpW#u0Cyx+cEkvNFIDFdZE@XqlxaRqR zjE>;f0_?rob!%{uBqUc(-GyAB-ASB^6x;*}sEaWzF&F|j=gs7f6B8?Pp~uIOiW{>+ z9989PU9(w_xpm5#HGt(Mbim2(C= z_GH*D5ZxJ*cX9e)nOem}z-e*)Fug6r)&()7`2mC*4)6^_`tC|g?&-ZG^#-78p*8v% zn4*yor;m#-@`xHMvxyLvkZVponbo_6!VExt#x9QFzp$v*V&U@_SqKA(ChM*S#JGi+ z-Pk*TfSt|&NecDEKZ@YgJ?KS1YX~P68nDF1Kegb>;BdWS&`^3OxR`Au{-9mJv1-aa z!KMqY)d!#4dHUh~j~*Z1x%=DF5BtoDq#-?EpB`Zx_ma-a5$MC!E29KccVytbN$ICy zvY9Z3e!Jv@%VSmM!E#Aw77=vC{UAKOigoKrv|(Jw$f{*{4Ho0v z=>AL&kHj;|rca*9*2?RpP`G*ayqK@&X5GAda)ln@aj3-wcgJ4xc#VFB+->ixf+QWs zMV418!P^w+?9>}3az(6Mv{d91 z$^s5yFZnolZxHMuNUz@5XaWVItf!4%R{60br>k=h9LuR{*oz}(*BWs#*L_^f^?=7Z zZ0%1vAXcyui86ES#SntgMXGXwtd1FO$(a7V|KQ;}cOE>x|Ixeme#g>4`@EsQk3uMF z6S5JHR0X_bYgg`l^n?449)8s5ihbT910U+zp|suN+!4=GnDrxw#cQIQ2dgc9I$<`7 zaQEnIv-rg$$l(*@Fa{6cyhg{9!Glp6PdtPKuV9jf2caefj`Q{KIJ+HmH@(ZLcG~!b z<}NHW1P*UZP^y;xT=_6RJczuV8J!%q{hF(DLOyqfb8mqQ2JGUmAJaLgSE66cubZ8D9|qSHEEoEjJ8EIr{cCiD%5E57z9`yr7N z$KYj?1hJmbSOCYXGSRh#Zu841Am0qfK5raT;(OZx^uv_Da5hEMX>WY6FX$BOazJjaF#4N1y*FdULj+=jiT4-f)m4pCz(MgUCL*_x}CIhmU^Lpt8Xa!B)EC`ztA`&~+aB z%%0F#;PdW%faf{fUqv-{Bt}BQe7S7>yqFcxXYRYQ8!HYU@=lJj-+big za=lstmSC{`-we0^n{l!<3`vPj0xIVhH0P=pM5UCbJ6s%pHWxY9tDbAYf@F){UNZPm z5H&(u!xcj=xsVrqm}RAe_>q<${I0XI|woqPYz)+xi7?e${FB6fbxf>GGxn@PwiEb=q7I@oJf zo^=HGqc{rrz61Fb9&D%(1oiXx4x4$elz(&&N1bZa8pqXSrSEfk_6D0Hym2^d-2rVu zHa>k2y-^9yTOq-DYv=ZRf&J_d>}C= zk&M}*G}A8+?wk+AE1MD|#o&6BB z8h(Y8qDY@-Pq90OsvE+65!$?sT&F*g`uM8hdU7Biv3d9H^6R*$I18^|HesRzYyzOg zu9$XGJXQnOQH$rsCl*eCKK-&CRE&%A?ik>R`EE(LUX;%ZC0gD&i2=;Sj=(EL1%RfD zMVXQd2iw%LItlh8)}Toqnsd~Kv`NQhV2e8b`lHA9i50UChhhs?^WTQNfjOiEHes!$bZ&ZDNstQ%rYZ4mLm zw&fP1eD?-vFxw%kZMFuEM~cMT0sPk&j@zmDBYSX!JK`>{P8{}jNb!DFq1Q+i>*Xz2 z{&HN-ZYER8?G|WPlcvb7r$sNw{rEKicQM0ZU#$LL!X99f5MMXiBno8xp zFiC`@4)pUFyJIxlVzR(77CJi3Lg-qXe73Hbui}Z}U-i_oiMjPxWH1{R^iLifKDu`p z7|`ia7&XaGUmR`)MpjrUa@U{^>SVR-B4SBElUT7TQMeNIaAFPd6ifr*RH6O!!V?_r z+hpLkt64|`@aaHmDC}Usx44l#jJFdMQci8uykJA0?){OlD z$Lyg09pBS8FK8j#neGe^fH7*PV!|bf?T3`X&=hvdRqgoCwYYBylWk~Ak7{bxwIJ}A z&>>XFM?JC)?e3#%x$lvy4?UJW1G{AJc{;d?R=HE8<~4zb2|3jxm=m}Ec3ch6U`}>!f~6W`%@*W;DCEGgj^yu!zp5M$s^{W( zE%_3V3nsh<3^;Kseq5Fl1yQA27<91Xd=qcc+a0q-DFs{vX{5BmFl0I+-4N)7K=_Ki zTD`K6Xkg?G&tA;#b{79Lu!6-3#VxFeIDSa#BPey|h|Mxv0fG_&A`wKCr`M?Hx!LkA zP;nQh>`d4WCWsAX{lC+al1S-QV1?nfi(FxDz*S&Uli=T&I~Oh*)r<5sENim|xFtwkb0T zgpn;HGT?OuD0#U1I@lQpOjX;qtJgn3m5-=|d%J7n%7JaQ&~HFu28AoIe~=dJ;I?od z-*_WXT7W*|*P+p(;zXYyBn^Wytv7nHz?ku|-}*aY_7OEtz}Wl`U;2+QfH!CsG|ec! zy{RgZ4){{8^5sQv9R(XcoUuk#bJOBQhPkjCRr!EkZM&9(m69VMRlf{fh}y*2{(hI{ z(t#xo%eBe37=s($I`^!HE*i1PyH9;}S;62cswo+?#LUyr%DRf&`|kUoVv0@+w7HQN zam}ncc@rPnxM9|BRwr&}J*%wf8+hZR`vth>ojZDq;F;cYg*Eo#ST)P1?hag#ciLp5 zPGOr}u~n-8Wj5XL@8<59lmxeB;ccO>$Hgfd%TX(u48+byT#^N0XhD!OK!>B0FQtS+ ze{urZN+;)TcpkjiyFO58Ozo!sAwV$#6`Q5YSym(LF?n==+<{4Ua}rxwo(fX2ALZi= zT|Qv(yn+na%p$ZiyJ|fPBJ$v zgs#rgv;4@7V}&S3bMz*WZu9Heo(46m5(M0e4Ar8pCm7{XqP{M$X>lza>BddAaqmzv zSG#%e$+q2tg<7>zkq%0e&N83IS^_zq;tG?ZW=TWvZ1*>+qTp7jBX;h-o}Fhwqz-43uaiF+W@t zpddZNKSE&;*fwNa(1*>KHt@zhDi-L3da_=)g?;1&s0TqViT0y}yoq-f4jMy-5J6SJ zISbrrj~!7NC8|LW(41m5D1p<$h~f0ysR9UyCDJwl0ECytRA|fOvehjjvNVCR1zY^! zX`*erKeSaSrHp#I5-Uh$VKt1mA-)MOZ>vHkAzaByVM!V)*kZslP)sC($b_mM?9M@Q zg)R|79S6HGyNJrWEPJlR&M_3&NU-psc5~By#yrG<>l!@RyrZ#58_`1b%D(x0HQdXO zm}c)wNH0L-d63g)tQxNawQJlx67&43rQO&yaLBY=N5F5$Tu}>guJUqaxFq1aah(i< zKeS|r?;u*XD{#$tG%qf-DI;)<6!}WNK`1i*`FLdT> zwC}TySjgdt3Ok?#!<=%Q=Ffz--FJOFptHMSxssTn&MOj zFVNcEhYudyyBoIVQvkWCa)+@C!hLhQpL`Ve(KE9WNt4aXHHGuBm_Bes>9>#0-ANg8 zz7kcLZh6-`oiAJEfF8tv@sr}Tn5dqi(G7exKy3s$Q$zvl{_J15dVN!09v|NOxMMQI z96Oj*1>yu7nHBbY)|DMl=j=3*xSN;dU>0Ul0hqNpWp~M!G?^K4iySEiI*IHY1zup~ z&N5;sB!@;VJ<#xJq%`?+H=Ke-0Isv^MHKbe=vc!59^FUy5=x^2tWWYHd+qVP!;kNL z^7vkOy1<#K(VfeXWQ22`0b@?EFX947PDq-GsFBR3AvHr*EfJdculQUX%>g6f5PX-2 zoVXWm86NDa4?lVEq619r0NXMs!H)kLh8n$kuPqU0+trcRD9TKO8$=#Ryv zZxxaO8fu0|W+)qc)+yc=*;iI6s{Tk-0pg|G@BkjM_Oo0OFGdAk_Z7kG;ng~uZ@izw zw07pv7O|R3b#kZS%zjL=a^&@b{CgbnESr-3n`$F0gdvq3qp=99_F0edASQ3ufJTI_ zhA9ft*Przr9}R=LQ$Kko`P4Nkm41la#ahO$fCp+kmxM81I%^3DvmJ? zo#C*R{BcV7l(Wb5NISG~0mvgFS^;{veF@l|B3c7G@f4zdk-29o#7&FFW$qou$=%x^ zr!X>IXxsb_!*&Ec9XuGhTegRzPBq+W5_1h`_J(Ns^!XO{*_3?ggXvr132bi4q=^A? zU&Sv1IszJqTNl$i6}BantSKL|&7x7aTreW%8Pyx>(gQJQ%kFHO-9B1GDfZIS`t{I* z#On>8ZECB_B`^}0L}Gy;=g7@;uw2*bbxq1E_@*8cph;iO08{2?h(@_#$9tgMqFtmi zo1}fqJvqs@+W%X$Tv z1y5=Fah3KkOB>+-fMG{#gLy{~0V~O^sG81q&NTyc!I@<={Egmis1t)%3X&KpSe@`$ zfm_2dYGmat*eSe2vhfMrnG}j&B|GDC?v6B2((|2-d#_^9@L>DN!_6mEi}l=t4P|Ky zwT&-2H0t0m`CX)0toD-_fES&Ka@Aa8dE94C zu;9<~#5BZ}thUU>%Wo&--l7@AXIrO__`a{23W#IyDu6XQb-bOTwh31D3k;uH42Mt8 zwhf>A@>LI?UPHr|8IN(~8}mVxUg%IY1XF&rZ8|O@mA?3Fuw4EE!$LgCXk45aaLd35 ziSjES8NTL4hSq+s_r21;w%c4@q#O+z_sSJr^Dn^GK+GmM9|r(K{A}~6rPM2NY0wF1 z47<&j0o;G*h)18O<8-eUuBr&s+t&et4Su%09k$>@wJlxQIExVi1^o7iGK{S7Ph7w| zUd6vy{Vw_|HI=*%N=Wxg4iW5(bzgEXl0$Qc!{wHtnz$lPo{>-3K`Z0;C4rk)Lt$p} z^%feY)XZ^scp?ic##*qOUZ|^XoUy0D6*LO^(H}(i#0Ku|qeqW_^wHs+5cF0anwPP$ z(IC>L6T))`7eksUG>bLgXp(Vp>mT0xFnXVR(s)@Hj9X|eY-%Ube|N_F1D7t$HcMHO zMCWnADPPy+JgW)zF`eW!1~Z(UiU9$GV^7XLmv-L?mhY-`3i+^|oF z@qvn_MHJX()XSN8G_fbNS)~w-wvX926MobrB;@~S^jC~j8JtgYw1qgr{AdkGlnB_~ zj-UNKkDt9=+1%4a8=0_~#sE-2ufN*DM10A%J?-?9w+_n)lCOzo*itRmXe)LX2QM-5 zA=5aB(qX8@8D?P+uN_`%oqcxlj?4{Be5C_~S0L9kyanT9PfC9Y*hvMrKQI}vw+scY z`Akod6@Cn*F?$KSb4T`t8oSr%T@5Brpy?teZ!ck@^qOuatryQkZ@`%QypHa!@uA8HuR8vyBL5fOVFpT@`0 zQKa1wq;z^g6Z|Q{@;MfiZ`!dN@8jRj~QlC@oQPiWrNlQVj{V5OmF) zJVs8l&rKVd?HKh87y{049e`C(@Lq{CGod&=m4RSj@Ry?5sx?K4KuVN`ui7XB3u~T-AxR_%@kEku9g!<5mCwj8*sgl1hVw5Xm^vC8Aj*|j7pn(Oxh+RlII;pSCP&z$#qZ9gc74%nwET8 zR*_$zz^<@o#mblEd#B-+MUX{1*mtVpafzsyYjN0=+R$4yHeh=&*F#uER};DUORnZ6Hzs-A?$sgg+Do`b!7uwm6T*)QXg3l8ieO|YoraOgh(%F!3hx7} z3N%(iH$)MP0b>+Hp4Bhh6QKGOX-SCh8@(eB$Ylh8f)pzs=eU`fzQ=LeM5R7z7%)EC zV7?HqhDo`GW8{l>0!Ne5-Cuv+Sz*K%4Yf5&fk(2*FBtj2d)Lld(vs5aM6$?3XeC1Y z50kADC|t=Jy`1lx1;y{zf@&naX2{5?lhIKt03kRV1x0r|I~LteCp~GOPG)(0u?wn^ zkyg8E$Mwlhw|`$lF?tgnvS^D|?8GJE@MM;uHV?>gi!vYu#SFk0IFMjzRg$KIOEmoN z@Te~hsU@{Vhp&ubstq$2hS}O%omw=wJ{9jL)wgyp($-k(mbu?%MbKsqUr`Ny;C&mQSr8A`7`d041K^CJ3h?<=V2*U@M&;i1Wt1Eeb@Kz=a(;eTp%L46`1I zjk(f=u;v4;N|MZmNo^pNZ{HSrKl+46zE|dGF>xwq@vT zzU*=}SDo-Ob~JBANJ2?ILJ(3xx<4=h+*~crw&wA+-ujYly*_G_$oeKt1Y zNG<4%+`^kia)CUIU1O1=Ti}Wo?TaGA0|jB2qp~AQ^4F0tGwR6pl&~$SG?6-9G+id* zeEQDXeztfOla3^Kv!*O*2hL6g0)X6$m(HJ%XGn=l<0U-$Igkv zSp9@Oh*vj8F!lNWLTj2H>^di$JVoq@=O>A?Zra7!iy6a%Sd{LDOmdfv;DH72Kn;P%!7{^52?^*-(p|U{?MHM#1wod2uDBauJ z>k~_uQBL_9&O7_6cG^JMm`*B5vIm)bX>Ih0##)i~SUupx7>Rd|6OAB}2T)l!wW_-s z0v;4nuB5DsB^5)ddKpGU6Xgu;r<;jU5f$R@#q$QEdl2SjXsCNIa04Oga{pwc9t2H8 z<}lzLk-sOW-U@B244Sc`8}RdWf%abL5Lvbkt*T=>%RrxVR!r&>_t%Zgt>IXc$96Ui zDn_)2IU>&buh(7^1sFi1Ks+5xhWx0%sU?EFj-^1=RvYm9cHM@U7mLhqnh{+VuKTD> zlfglsO@q_62E$|DLmg}yT(&hRI~Gs*N&Y;WxH+0T@gI??vze(sX{o&$FL&s&2}F8f;RN9%@!j%??g48^Ms1&oTi#>=VELMtmm9?4E%CWiwT&y zBl9^i$yiYh$b$?WTh5>^a?&gSK;(2h4>lNh$MJ(ZNmoW`)amkU7}tZ1Yu|q5HEmO! z>%IN1tJH5}mbY(dV^wHN(Wu&M94S&S?yee5l6bcu6NLB20JAiLiEK!|HI!%Cb#bX) z)dKN?bdvM@>V;Fs-C*MrrsPbeb+^#-c|HNQ9PEOiu4)B05b!4ovjLkEfy}14+i4Sk zhXnGyb>X6zEPm8u!5YC>T|}msscQQo)T9~huVmAO(Ldc{&(m@}P7FG;P+`4b zESB4Yu6-DVyP!n_n_=6=oP3S&Q8^X7>Uv|~4)h!kK|E}H*kk|7E!fM?NRFW0QWAFA zg=Es$v0DbyA)B3ESU5Xvm(I2%S&e14EyYi>r<7KFbsTX!_d*xlhOVZ!3_42l=U}oY ze+Z0vRTT!+9PK&P$-3_is&L#_hK-rneY-(ejNN;GT zamy@Ljg3?F**Mk9Z=9-S<5Yb%P6co?K$Bi#^Hj~vQ}xBG&gT2V^l2q=lR4>vR@%|r;K;-V6*_+ z(2s*b4B9M6ZWJR)538`Bj?8bjACX^OxGL~u>zZKt+`cZo-gj@Cd}ZMCCJ@tO>a+vs zO$+wCInI_pJqSG~Is<}aIFI;f>qKIyR|!Ta{pI))xDyM=Cn`*cPOwRra_<_o92^s*<8}BN26eC z7LU6C#m{5#?DGgY8&Q0-_9S0;`<9dQPOp<56Db2QHN}bVNB8eNc-Q*y;R9Q@m_{>) zy{|^emF7?F6RD?I+;w5J)+^h(ZnA58%jVtc6gq6p6lZ*viB_`rDJoy%%v%Ih07#!D zIbF5omBC2MRu-QVFn1i) zVbzu=pxT@#KyQeuD@6c&+lID4L0ROt)qpu@qzUlR_tGh%8ep=+%r?z*f*S`N3bQn-0=>vlsB^zU z8u}#xRPkW)uXNgR_%z#xPsNFoKT;YDZlgszrr|v*Kt4 z*<*2IQkHo)##OecZzkU3j7h#&aw|&7Y{TfXBM@*hey3~g8Q6=9g?b57M?F+V(~%e| zN(xFZ19%4v4PtO&0s&~*sAVX}gYo9-7ffv>z;0s&i+Zq@q2cka#w&=@-FVtu>2(#H zHhi+>-oY|`^MP<_NeDumYv=-EV+^@C`_x>)O9%4!t>&nU7R1^>Fb$g4)OvwQ;WE?IKhP+Q&0x6{*+C?QUzf1M zi=g8&QQRMLa5jb|IvHB;jY#WOd?dZ+S00+Uk! z7`1naa%}7kH}0#}xFYkoeQ$+!im1v(_u0jFn8h*7BsNWGYNM1{*paSbi%;CT60h^1cukKyl+xOg@`@(8y zvqUi&=sEWdXCVbxFdAfUN8tt}KGfaZ3xqrYYJ?#=Es0+@?U0^;L>pY`wD<;vhFHcM zZr?9WwKc*?*hTLN-kpvUCJ#xYNv!(1sp$RaEx=9p#^PcoZ$Pj!>K5?vhBkrfjo}zK%!$GRS0swLQwzg+Qe!((y${0CT~J#;$ixs8etm zk?0lD4eyO6=5zmd`CvNYxZT}|bcs3Q#7vKyH%%m>EGQdzB!G>uRuIh-E&2*~^y4cM znKVoY(gN7FS;l7zc(gB?E8Vc`-p|Ud*lU?u?!@ke=Y1MB$qzT(U>;^xi@(U?_r9=>^F_WY z#tARKzLM2tt~aks2qP^PFI09;>*Vp!1oO~mGNILLU_w}%3&spp?q;};wG}y_bLob{wZRV_ z-MjOy{^Emu@Ye_T-~S-4zHLv!w|L%-X?5G}z@^i+jao0ecPUm9^)c+&d=ac}5QwtW z0h4xIh#erz87H0>-dvmJ=!dH!Vkzj!W@`!zpM3PG^hJF1Jq!1Gy4+Y&5(Rv*u@tow zJNv+yJj1?ibK9S+=Yj1GzHe~bU#`l@8soiU&;3@f{VlBhm> zH}%QSu`=2;YsAmH(By&;nn=W-pJRy^=sp$CV?XfcJ>0;bH@v{%{Uc*@e7!DPV~*}U zXAKRX^rO5!%iS7#j=bhnA52m}B~&3511tf!0e#xF zc^p^AM6B#Vkhl7)wy+6Uq?P^(EOI!PKSC!`>m%7dC5*(zNIn`#f@5SB339RkQ>EU4 zF#;ZDoWOfJ%0IyMeg826LHo;oHXGmsi7Z^u+m|?@3?NC)$vss-Fd8EJtW@_u88ifX97pJASVId z#Y$6>XT^dj3iUAu99MU{0ha!%qCBIFmR~v{mgXCR*3unTo*E&2$FEM{4bepja3bw` z;Dg>S9JCIQbprv|!G{NOPQM7PGgEG{URFT?Q*J#pr(?b3^PyFtZ59<8udrPKjdfeuU}!KXM=MwL z(`q$-0(|)WcOT#XQ};eS2+Fz7%T;j-^mz$B>i7_LDQzKiJLG&AU-~5sU7U>DjUZHy zvz6n$jAlwA?~)cD84OhdO;%S#!*O0C?TCWk@mat(6hM8|iQWz@DW{R=%?Rbl8AkuD zArnS`QZRQ`a6XdTA(%j#kd7CHwBzMp224r&tAO%0+GnjTmDq7N?~ZPZs9^=B^uWbj z>#nWCI7LmAV=fFqY0dKRCJa|YqK8Z(i-F!NcBjsYSyc5b3zCE2KAwPmErr6Iz> zbps+Gy{?y|Q(BH1_1*pU9vhX7V&3OjRW1ns2DB~W+#B}P+fzLQ#qhf1!n&&J-Lc!v zmHI@vM$Q8qRG=Ks-5G?}+)U6_!#Bo89&^!!zS+LF+ovb|oedBvkCW z4&>P;=xtJTzaZn2eEh6Jyy=(-CLZhBoj%xO)w-y4;*fAs20<7x7omW0Lo00tU%y^0 zI^wS7YaC<9c!`mYUNK=`Vur61+u9oYUCKe_kPjuI{21cBnor3wTpvpt6d)8AW=_jL zSJm>49&gGTgDGDX=T);w!;H19kfN^-U|(t?Fxw0{0P3kPmqelSe2(G{_*k6p4cjN* zagvQ=-oigd6uB>u>M=}V8S_-|sN4MXf%`QzCHwm23UR_Z7E^mm=f>rFQMdFEpKsPb z*pe^QO|03YkMpc*n?!irtA|kVg*pfoxAbp2U)kO-D6}bl3QqCJNOZ4ftM*Q}dc>2f z+}MP0T6B=bDFaHIPqZky+B<{YDaN3O~UpWlz;D ztrlt~ZhGEfiW%Wa4p~4- z46wc+6JrL;8c}sH^istrktlD}D>uw`pz*d^LBG$l)q#I>yfG?oXS%~FNnu%-p|~^+ zvzPL0KnpuCfsc1a>36gF@&L{g71PY36G$rRda!5McU4KUK01RK4PBW4x4gNgNtIKI zU*e2ZsN^~<(Z}b9WE(yjZaa&26Ft}LA%5jz$?{UD&%T6r8;kDTV+z)7vKA(_UdT!u zL>DN(<8kngr1_4jU4Cnq1a%uX#3!lIE?kXFzqj{!)^lE(?083m>%J51*^Q2trr~t9 z=i>+tGn?cS(Psx96SMp@pLM+IL7!I%!+mxF+14$dBiI5YMX2P!bQ8sj2Pi?rpZBTf zNCt#lPQTLJf~AK2F&3Oa2@i}(1Or_ic?h=53SmNOmPm?^ob>aIyf^lekJN*KI#(>l zv-L#yM|uWZXI#z+$YdC?c1`Pu4?K~iU&&w^&`orX;L$II;x;zt#<)pGwTLSZFFSnJ z&pt1u+t47Cqi8j`y^le|Eted%r_ibf6{2y&x0^HmNoElaPsA%JGA7Cuz*lHEhu|2v z0B)^L2K%Blq0mD=d0^%x?QK|_s9xm+p9Q3J7BD#Uwr;I3Y|;Am*=EMZscl^n|Fae@ z$GTCG98Ejx2a3v@0SXf`L(1|nSsJKTaZoOE)E>Fjfm}`1F!4zd6z5wN2+3epI*taM z$XBIRETnY~30~ayoNYI;NfF0eDWCVK%gd`Z6MLdSN9vSj5$__AvUOcHVn+7d)a_CR zQSlZFG2RRt<%{=QS>4EtrRf!eBo-mTr0Z~r8f2sy7gecyP6;*&M2i*^w+BGL$*jT@ zu9XHMA;U^Tr79XaxGyt%Tka(f;Ew_thf<;3vR(&@SCFG4SQ)#pcw=9$wB}WPqB;#* zg>98T3{$|V8%XT%+?UX4Fy=wh5+zCR58xU7%|FSP^$Erlnc&NfyHs>QVW0SE?@Noz zx9wS&$ZmAn&TES^WjTVyZ95(W1RbmRhImg=_Aqzj_6U=h=&<@=66-!yiK75>KQOfX z^EL2~=fZYOB%Fo21l&fvu6<__WS+{9o#@s<08SaOCUu75{H%k1k2(lAv!}8GUbrk4 zqnzvA^P`E8-B`H#IWhn6f$=^a=CBl>c4V-3J$I-)*-1uw z5QQk-gXq%WnX6hhpX$5_w}cKUL7n8}zyq(Q)FEr^J)WYfj?X3{_y_~7Bg z-@be2!2=62AkWOCkDAy7Q0mdW!?>b*Wb3uR@$k<52Q78^@%HyVxc||;xH3Eo-i-2e z>v$i2@=@d6_%JY~e^{>a5>wQp3jhdfG{=(1bd#8k!XQVo?upthFe7=dNNPz1EZsz; zq$Dja2pcc%74TjuPMbP}mYv83tFHB=?lA5J5#=;+zi%#KtCf>bRWR$Jqo14B7~>WGXsjoi!x2F?Nl;~qsMRId zmFV_Oj?@QkON4WG?IK=Bxl(X(4bNzhk`M1ZZjerSwwVM%sfhgXqwV!#(kIWhlRoTQ zO#1X;a1Ojx+S<_krB<;26uSk1|B^BruqX+0i&fhFCZbAtCJQz43uUn1;S8W58I}l8 z#$rYBp}4g|O;TR^>V^aI@*bU=%0^Sd zt1P&1sK104GR5oNZDDB96|+z8xognA)i@-p#OB}4P3j7*KqLJS6KP|FoH=Z^1Z>-mzYY9UC?6DN4(2!+i|74V9}poKAPSRn#n%)Vs)OhoU+2Z^j5F1 z%U&6LN4E>#WVp5fSm&8|OIqDTZp(R4wP@k03n_c67gqM_4dYp>i|Khk*38;XHs0Hk zJP`z~KC){sqKIt6SMOQ1q5JGP>zoOu2i#+#1b`>5U6K|6t1VEm{e)I%Vhhs>LpY>ZJV`4y8|P9=$k zlkDHVZi7j#Qz*%u_48s@fClFQfh+Qs+UIRR92O{hwctz&g5GtxDo+dGpDMT}Fc;{; zQLiHB4ThIPf~FUV3b{+7{{zUZOcD(A{V1!7F(T7zlj!*($@Gk`qv&W7Y%}Ah60LSu za=w!o*yy)!|D-r}63{NGX2a&eB$|Ms5=1+9!>D!za4}6$*_4g9B(T+t+xH2l@qyur zb$$KZ71qFM1QBLOPj?Kbh3FaGK6>!fgtaxh!TY&6ROkf80J$4EF~?CSn}J$O((v)j z$et6I7fIhTDaB%pGM}q1-FeK5-?K{`R*|5$Xv0DjWV*=GD~nHOwAz#6=i zkH3}6`gNT*m@yiC;Do!%K#bB5Ps#Xz9b@#b%3Z=0V4-;@US$8`oC%~22Ln28P#Hxs z$oG!-M(Gaq>?oUf@#H&_P;zHTUOXHQh-nr#EnOMUw;%T6E=*M?NC)}j*^2VU& z^eCq8n+D&6XR(iaOo2tq3umD{Q+mg=^v;q_;B|7c{NyEH$>bgSu34b6-YLy-ieTvR z1e>&Pn`W0{*W;<>xm>i(<%V6<;@{A7A`%Y@I1N`oxf$`$n87S9Ib!4m`nvTtSa0Tp!R9(pf`Nr>q z5O9=(8o`&SfL@iz+!mNWAU5D9ipA#9EBq7>P!wGqQw;aeNJX71+lMY~4D(k?YCgA{ z<}*S>vE+)KjZA2{|4r}_cnVM>ToY)+gyCSJbVcFj^E`uKOh8LR8zripaUQD(07R`0 z@1b)e$Q6@(JVOD>Ys^?2F-|N^Jkfr$w`Y{ihmsNz18lPyFjEj{N?uT8@bpc=JU~H+ z7{EY*BVAI{W}=Nc`mC2ch2V$Rlz{A@$$Es?VV5-x$&0C=R*>WSfl_MSWQyy+(iKJYMZKac+y{}!b{ALLG z)xGG7(v0$)e=(;7+RJR5A6TJQJm;Bua>_F~W?zwp0CoT*iwfG1hg&!iDb~h`lt-UM zj7Y=;vbEVKs){lR5L7RmC+h|2o(fGRjB=m!jC?eUD)En~i1kR)Fr_4P+!I8)f<4l( zHN;q|g5HqnfRc+aH^a_6>~|A61p1sQ#uHKeG7}&4Lt;T}Q)WbjDLW1mBC#Ky;{o_P z&0stzAI~xn2N~#rTv_5I>QC^Ntpa?zs~Bz-ez@(dNx6QBog)z;a3jD)^?KWceZ~k` zl^iUPq-n;PA#5T|i7g>;n*VtFn2SZ-9CNWHhT0c<`5|Ya6Oc{bY|<_S{=K*p_+}nM z*a*S7QUkv4y#^np1qpv>p9C1ONy`#e`PrF}7t7bOZOVYNXwDZr?U*d!M8bkUOH)MS z@V)Ob0WDfO`$I2#a#*EX+SObwuWoMWmCd=K=LbnKjn&g#sarTihMvDJ#giyu%cV+F zwrrc)Mm~bzdG}%TsUw04Kka?CeZUlF*&HxE??Zw)QnMFW?`GXrsNHgMd!J(T*=^$| zpT6oH%9&uZ)fm_c!UFQST*N54T4kb_cD+!gY6!awd)6qo9VcL+GuR2hHt1231l<7D z0_%liYv)7gz^a=qmoREkz&NtYN}AlAl8Qyab+uN92MIlX zpgA|e!?!@!2M}eYrGg+gL57xy?z-f-RgPe;Hf65k6BI|J*~h&Yzs_LA>WffHXlN?m zUkRosD;Ge;<5L5d%k+&@F`qT5>L>w~F`bZb4^k_MA&H3s40i z`v|!z^5=Ln9;25@*|g4Yr)gc+5U1<}D13+B*S29+R zEl4j(+p9OnvyRee*vA`2_Y zhza8G2JO(JE!R91+Jw0Tzc**?K?(5UxT)8C(=m{qE8dcTKC+NBlhKnYbmp3c7C_Ie zFHV2|_t9y02|_*ma)p3zKK$gt;iG$p?)y;e9C+24=v<~&BF)nNc>SbZjx)3_skqy2Qv*L@| z6p!;7Xz4V9!ViDgvcYW87tz;#+>KY%qF(j(V7&z7cG;%a-HQ~!sy%0CRc#O>UW#e> zmZ-Q_==uy$SJGxsc%SKS-f{MaZETD!yXl;_-0j^{Zv?ABD5#9`s~!p=i$}JE1dTpHkgvcx5# z^5rZW6W4q$1ZgqOy+PAdlngGhW=N=r9*&Pa+yj~7yxnOG@5mKDbpq1}X-v`0N#xUa8Lf4WX7{+ApG58)>J@8`y58f& z2H<|fXyl${0@mkvfmqvw!X6_2(>uTO^=v+6q}YbXUXz+Ds~Mbq@6n_8?mq}3yZMm~ zkSZ*eH(-lh#@wDV2kH=Y(e6gZTr~UAO6bZTfPaTF9ZtsSLu^}QF#ov6ndl*hwI2sj z8-E=KBH7?G9p08-ImweKCXhFN7WTkJIjpvQV2fUmp=1VInZRrY$K{-~U+#xz`FRWP zXgFw_IW-w8O9V0LwSXT=4v)x71MU=`l@+DGLV!^Q!k(~qQVEHzs{n==uNsnY@2Xgf#bf_Q$*2Y({cuv#Wwx+bq{S&e0E zFZq!bF-S#^aL!edMQLGDzshtgvJPNf18%HQ-%Q=6nB?Ht^T4XWFUr*1PAY zJ*h3+v47lCbL1<06^A460@+fw!#(Mut0{@$TCJ~N!-@s&7hBz)Mw~7HUED*@OLcJH*h{jjy4wTm9Li=VW92Q4^ff3(j}=OSDr zI@&ISUjScpb11HGy5!EXVqmk3A`wuPjq1oq1>>6g>YnxOB1wSJbL?}1)Yg3&N~lCm()vxVP5ro4!7Calu;Ioivcr#f|_;(8_Pj~!b8 zRp8-){>6jD`?x!a`UOJ5bAy9iQQ(RnaA>PdW0V2KcU(wj-C=bb@EtxFx<1Q(lZtIrhp)TYAw(Y^ORx*uSt(vv{! zIo#O9M-N>U+X6nYT>)p1b+&S~b0)>PNs&%SnhU#0hcJdy=)J;frQ0k$i_Es>)*YFC?MXzy;O zhyg*C)Qy)yzj-m(>B{de5F+c8!WDY3J{4p%rMn(M+drEVAl&bIPlsAqfS0~!j(Ub%nh;<7?<38 zJ;LBkNx7zw_M2agvd1FXGPqUFNhg4saP#W)kMm2x_b|cbA~*ID0!yzVlxBk_zA+J>^O%-p2VAljq%eUa^w(W#-R{KxElH*HRzy1no2&JLTaP?p2Dt zuygnOjxAd;Yij{pGBtqAif2(K&d_BRm|(F|AP;;q1Z2TXMJO@@%BCX+m*5Febob#> zie8Is8G|DEbI5E4Sw4 z2ypz9!0LRQ6^n-6GOX!`*Pn9+vtXlI51zdtEc6g##G_!VgX;D}(z?Isc(!GbJDv6M zKvlgC=iE`PiySf0{EF+ZB=E~>NsvZ8KK1%!Mypp4sXbuO0q1jeZdG>bs^I<8$w942 z_RvE^3D-@0WYf~XLqoILQp7b=!_9oD{RSJ)h;hgvwO7yUal6k;Q3+Zt<1#5YFNi3u zUUvzCE#I(6tT%RUKUU+f7=9z9b*B<{+tD9RCcS~AI@E2xdpH)RqadRMx~9#`cmNKz}{ z&VKRZ<+ZC?PN&5f7RoO#4jAh2RH465l|zQpTDQU6UGIoMf0qy5IVC%49%9{*+Mxhp zjDVzB;yN%$TFgkd{iGd)P==Ed z^5Cw@<5e~n7;4J=d(z-L`ufZSsXIYsQ8s;Hv^N0JjY%K@?cHt2gd9k*4s>FUDY4yT zkq*}DF2nRgt}jsIDY#6T{^>K@y+OEMye7j@dyBl3aijdWwcY3xbhX^D`I)D!?eY=Y z(roO_=pVK=N(XOCn{fW(CgE9Yi@{;t(r{76%@$>AqmHaIvQ(Zv)Z_b@j<4>fVM}f) zX?PN4!SxSYUr2{vx{n-iaBULOKO=-uww2(W2=Z@UXF>nbLWdCi9{Am3*~(3RGYRZt zbQ(~?^tt(fd`CfVj?~~yGFx$w#`o0yBag;OIeO`V(t_*#28FcWG7L4oM#HvWoOTg*GL9bBw%eB0Q>U)VDD z*ot$JZzrcWCTl#U86>z4V#jFwsO8TJw~2p!hgjmS*<;c2I9nYV;u=1M^yD?nr|WLZ zTz2s7?#cu;joXDj_lS5}a=ZK*a0s|x3s+Zp%ZokbW5~h8wq(ka3eg=hfx^$Zj&lFv z{BJu|T`qSp_f`TQtFE4esk?SoImU-@P5#!mGXKJrb%2m}%k2QJFKd9Xd*@>a&uBEW zUicn(#a><3jR^%#W(XK8`Qae@Upfb(1I<)J%wCL2a!JNGNzbx#r9fw3#e@8uEFRa= z0eHWs#h`Lq6-Yo(8eT8*Hg&cIw$qG1N4Eh`n-Z~2{R;?t7MS*Q>!MV7y@YHevZr#B z-B;dtdH>24(XxZSnR6-e%?6@3HbE*xM$FaS6g!7s-P^yibNjoM`|$uiORBF%w_qsq z_3Y(3hVwCpcuGg=8A$nMyGZ!D8>mr;cOfVi8qwAuJ!Eqdjpl@-+aMlKvgct6a<`9A zJdDG9V$%&~O!cw;wijxsl7>ZpgAIE-fQdp&2P|XOj&6A&^O3m&_<%HEE~$I>W1Iz{ za$%R;g}Tg+GwBo-O_)mJ;M_6^dT(n3VWiFi8mv*>=nm~9=V<26H4DrDtk)Mcyt^|{ zGt_cx97+sS#i|XGfB3}#4rx9KLR?yJ%FGPj;|_VB3Ew-Z5g-}}hw({;;?1b70>1I~{ zn1QmE-YEc7dOFP5{PIX1jR1+Nb1Of6U-t3S_Zu7bPQ$o5Aj~!yD#hd^C*_R0$mR3J zX|XC7xTf(zeER<0)A!R`slIQ>S=&(`=1=BYfOO^M2g&#(TO12WIni$qtn3)5F=c-? zZyzNKH%*|V+jU#NaxDMglPZt&g6_JQx;iou{MAZka5KZZbKAC{rghHkao8?@O$Se= zEyTfEFGYE7r_u8|q2C8PUZ^#l%qL;0Q_7yrD2xPjrUxzbpsh)BP0D@Thd1pJXezox zZ?5BD>J-L<0hJ7=OxwuzQJ_4c@wl>A;QCE9mdm!hzvXajQy4ob zfn5DM1OzoYQL)D5(||Ma1mD01nmEhCx~N^M(irBN-nR4fsqeN@w-5mZ>52D*zq3{Fc87kC`PAnz^HewbD$9bj_|0QaMsCuF|k(d0;O5B$fxD00Qu9{s5ASc z`pLeyakvYKA76EkubRi-ofnfySs%oIN6C6AvLnfT#{E+q(?h%JmW2p{oFPzq05b{v zikindC0&Ufr?_rX?My>P!@7R)#SK)Nl4k5B_do?rs-&`|21+-KljMEH@g6M~fR~SK z6NTt%z66dL*+UOotO^p4*Gmit933~&Fol${8ONi5vzr(siSe{9pfLp4C{04g&G{1a z3_Kf|O_<)Q`Y>J6LH0L-~p_wG#nJTxGz^<>Y~9>{Uz! z?>AIs*6~iE!SC`9*hT+{Va>^W=s)I9b z{KW)q`fvpR_A*}b6HU!4>N__LjxWfOv4wjE3Zmi{YjYB=!J*x*-t|*TRh zJd|uk%Rp(^O&$>pB?BdA{v2FofkQ!HKpSgAF(i<%(uw$}kC>N}VhXsEt`0I5c%8#JXZA8Bd%m(k`vD-cw=?-bp!IthPXyP-F=}z0Wu-2rAUmRPDR-659 z-nwhyDIZbH*Q(ma5yr&ds;V?a11zYu0~I0@05lPSF@ST7p?ZR_$QR&4L}GPQG6hnj zO3uka!v5T%Ls=Tjshib$d=h9v!{|4F_gGg5u4OMrjt(poSzQXHgDgENOLxo`Lz}sD z1u<(=TqUiFHO>-()T( zwNG|3;hT5b${?WNmvqp7gFSLmP;r_Q!mdx2XEg8Vy0a4fVxg8K6_=`d;wD*r{z(XH zQl&aVcdnbj&c;o#q+|lCnk@W~7=Y3S2-kyMiZ&)(){6;)1Nt2F^9)-K)nq2i7>TPmvRJNvK^hSs^htLzLTa-- ze`Cy#FF0nidM1J5E18K=+e~<7%D4moRkWOfk5;gq!n&YRZRWXd0O~b+w`IyHUx-(c zWA=~%&-FzwTGfjNLvIDjz=WH6)zXEavIG;-W?O+Kvu(feN*K>JR-JxlN0->oG7Yy) z_#<}&PtYUqbc&ru(m&Zc!EHte65MdBE((vv&Yid;72|aFWa~pDu43#0|$F%(cCT>(H#$885YnK&rox<_wi9vpw zpAdr}_5M_|9<0>08#;n?|4N$&11~RXOUPC@anlO9xj{2Bf)o>HIoy!Ay>%7x=gV?| z(N`HbhBh3QjK31QE4gmaA;;i)bN{m5dY^U4A?{pk6p#ECvPoSb z-v@7O0gLsaXA8vn$SOB>CUcJSCn*AKHEtvLxHH!%$RLsl4F<&Rf=cfdh!_S*Bp__; z2qGsgB3?RM5$y`jY#_*Kx?*&0cALsAIXa8tJ!8Rat;3L4D8p`DOKM}*1(Zg*XGOF~ z+?&@r3d3?T(`E+;3CV6GQXZiOf)RtoZ~^3DSymO0G*uOpjMrt*zw%^<^-qN;0Cqr` zA*Kzu;=H${Ne(>Hik2$w=;L7G{bQEQ8qe+R;h#!Jo5hix@Q-0-_$NV0mLIpQ!+Nna zN&4tpIzUVUu(ZHGpMAQ;_e9d?#a1M~jvGGD5R2v}l&-BnRVit2-0PndpN{y$8~dMb zuzFLW&ptKk%bWt8R5gmEo)lHgwVtgCN9q}u8*yCR@prFGO6m+u4a37iip-ZT7*n&CZjSOPNjlKPz`}ldF)_v~v zx{iVC?TlY_nNyoOVMErB4^0qjONbN)pF(uWDxYPXoMtT5E993} z1)3wP_0g^bL9r8j7-0pAJ0{;?+=9l^6^7ez>ps$k9|WA!kvPQ0?X*c= zjaS7|9Af<-Hik}Vu|2{aYIKU9J95)$CJF$HwBm?P16bjr)7a3qctxO9x7c*caDIcv z6A!dUht4PH+#v>HC)h1LCIGhFyk!FDc{&)Ez%aPGeS;~j+nI%8hL8mZX=g3O1%nCV zHA|%rI)+2_d#j5%p>=YGD(>BdUc)v zc)}X{WxFrX7BU)O?$3dNM>hd{A$8u<0`7HDANUZwm+fbRc3~ePp~UwRlW}Sch!C%; ztH;eSB25{|y{F!IjrqCBNtg_Z`2F~EHALlwZzK*33Ff+`6-_JyQC|VlR!ojN2lSGb zL346w54IdB-kgK&J_laSXtp^;Sc*%|nQ`OcS(<0)V?lb!p1q};w%J*}f!+D<(_1dR z=`@e5ICqm*V@D=S_3e$NE&QqWK?Fq!FlRtVu7w>Cb~_+`f^;h@#HNZPPbXVY2r^@e9nl4& z0R-`4wjOtLyTW?XTFU*}wUPmsel6tEukGCakRWhc*zyRp!($g9!<~3k0Azu|0hcV! z6GDhWY#VBv!G$om9JIg~w|!PBzJLaoD`XS<<~1G4ZziGG%&0?Zb*Hb^t)z*#M7@$K z^ey1}@15qWb3`{wa{w0rg%WmKC~}KH5uu_q(NH!D0Bv1L2k7zrzEi5z1|kcl1DHMSXk^P*&EehFHNN=ET-{iFJ-B zva`o?@r5$Y_1@Eu?tFM}|6%WC9NsutrYSS6$BS-Z~4Y%*Kqri^A>=g*^!;brO0D}eE| zO`q&+hzugoTscra10s4B4-?$>L~xNQ(6^CcsX*lQF&)U(5zxbI?`UsqPPm$LqIGo_ zQ*O_rCmc4ny2eYD)5JbM^3TJgmqpVZ9wo3VvU`d*9)d3`eIYM)a=J-O*XS@&;4{t* z6{lshzJqsH*=C}@|Pof4j@zz>GbFK(U*MBld_ zV}7ltr}j2+{G+%cIQd}0$uh7e17Ik$mM$EJ5pj7c3)!AlihUh*`SW#-FA2N1T;))= z*}wZLiFj90vMa!72c!sQ_$B1{y z=BpvNGuQW_ks+yy0dH=(?&6o3%kFf4H@fel)D{?wa-=9A0+aZ3+{G6(HV%l63wGei z3~cRr3Q!MO67D}fRn%QZcvQPqu+39L^qA-5J+CJeDsl689I0*dCLHjpEb9O#JiLs; z=|o)~jnSL`LZ+dpY1XJ45t%TfjBk85g;QXlMwC3he8yRW3W7rrpi5mJ>3_98qP~L7 zFa_+p{CNg$G$W!KXF_N)f5?wPWIJ9Oa&w>3*EyhYNt|ut8jTfzucu5i7mX})h@tw zeZ1zm+-j{arKmd5=(7$;sZS5l8=k5s~JW-NFq ze-Ag=0$_M5blais5o9F4SgmPoYsoKmOyHRLT2;}r^*MZV!V)@YmnQiVv33@=90TaA zun(~PQP9mN!*(r|ATO+!{;hXDdVD{ezcWf7mos+*xL@9R{O%}0f==Z8lZBI;Xsd7(H+RK2 z$4zF_@j`EWMwZ#;(0PGN>npwIz1~AZI@r3syIxY7hVUA;KAsvDAL#%4U99oF8eOZ7 zH%pk~zSxzjz67n^;Qhp{kU5a0_k#nG+l3d|I;vPouYC{)_SR>C#lBM_>KxLnQo?0S zs+G@Si!y9TsLif&cTtoxBo6P1GFmFc`B1j6JxY>-We827d#}552s?6~t)3}d2fxG{ zpd&aX0uByVm67a_0TNK0dAQ|j$6XPC8<45n@MXIka1MtD#A%C6T(3w` z1c*l71&VM%m^?!EnGvD9#YzliCW|WYT;JKd{F{4jQyt*n@xkSFwYm(M%Vw8<^D-O- z_;JVhs3X_fex&e0zz0oBag0e?#{fOAm>}<6cBSEM>ctW~S0#brrc7sD8SSojgJA~< z#GdI(p-5HRAX4;r3-gJf0sw_g6T+zX6dyJg!*!f(tk-VtOJH5o*5x~RibjR?mN?2R zilS^Y;UFO_)I9g}X%KNt)*4E7#*psqW_ODN1K1(7bBcw#i4^s;N_=oe8}Oycfo1~3 zP&3*N-m=wBAGkJL4_zCsL#inp)JE@PqjXjO27$}>ehIiYn(2DntT1H&L0r5a&@E$3 z$#m97j9f9|EI1JT2PUq1Ov%$wJi#>~J++S>!)R8o0)-rmu2oVGWj=)&2ZtmSOi?pH zFFLnDmL-g$^UzTlFuuW=8?-_n61A>4%rV>0 z<#gA_C3+p$;Ypm&Wm8h1*tls`|XCr?s!!gCqk3u-*vKNTNujOsGJ06U%DB zjjk!C^(fL19=Xf0e-syPuLVI9FsK-mR@ipkFxt^4h1cupqc;@6bW_Zh6#vY+YoKzEh@EG{25BUAcOS?5GJ<1rJMXRR_&;e-U>-w6+Jyeg~8iwN5S^l3q0 z{-QO))U7W93G_w2DpO<vn3YMhH-2=W!~g?;c3?m#0e@GuqU8GjI>JW4Qksvi(+1nEghFHgM~ zae$m;ND;&EREA0r#sWIyts}3#&AInsu+A&Rgkn3r--t}P{E1#auY+Sp@t9^ zBoT!<`sebF?Ri|g!3Z#iock*w?-#j_)K6ZK*Erl)yoXhT(sJP>K7l9Que4;k0U+`_8e)lD|!*?4FzyZ zICzaXXK%R6h*?>S>M!lx&iKbRtSFQVVKq_|3!+a!9qptgzs> zOv*L1`T5!%T829WStEQ5PN|TR*?r307Mnm|4zNdD0bXA@f#-xA-Tey_!tq$KPrKWE z83wSxDdmpD41LYP27%%yI7@>|uYG=LlwJxMupR2^4ie!XFVKw^x_oIEL#}d4d(+J@ zGxbi`@Q=CWA9K@GNZa2@Y&PygzbzxzP|bG~eZLod&!g{C-Hi18IQsql=z9@;FQf14 z==<+jRh7hI>t=WB0J+V^wZ}9H&`R*4RH;fgvw>)nN7_sTdmfk+yfp^FY-Al+xndZ^ zco%ZajpjTE_!H!F3;Apz!XqlM<6J*Q7}1LxalwTyjQOfVYM9MzVRMXJxqz4|94e-8peL zdYPV;tJy@M%XU1J@)^7*m~fcyo!7EAb^uqI&maM_4$g-3y$`%H4y{~Gcsg4rZIocU z=!LS#!Gee-YBxzg`O-`n zG;j;&%S~{3E1a%pqx7_W#s;sQy)nFn{{}NxKY8}4YxXprIa<*7N&!_+yzERsvwoL{ zbSdR)n0RDF`WL25&T-;8{EU^Ij=Y~h$XmviDsoqYq#=k=1L8r=d}z5&4!*+81nl{0uPYWU-4cl%cqeH(p98n& z{`GT=fL!`q`680$-X0N)>ZRwv@aXI9Lg0%?7b;tYZrP~cl`eCSt^~$u{~AMn+bh1- zQc*l0+op5-3i77X8$hGcC`^FX5d1>VS>!hkTdbj{2@uxb5y1no_zGpX;I(5Nz+H3O z2N3}LFCw2Ay=HkBc>QJxt3u#>R~*?42fn$Sl?go!ReET&d)dL7#?z`aj;xXBOIt7o zWT54OwK@mF5GAA|p4yyL3nDvG<83tMO_~*|UpOo#1ZxOD5&URZY~iUn^4Y9M;zvehZV|o?)IKLibSDO+4Ew)o_7*EaBhZ;(CQB!H4B;Q zNJRBVz$mUdb!*-+LB{fdAuec0drlHSdGE>OnuTJ^dg)7927QB7(E^{uXr zEpLPgzLoyQ2M<5IhtTya`1Z-;dynunzaeidtG#2ll@_PXAyNyM;qT>D>2^_FYD@fm zb04n1aRXk;IDGEgZ}7YKc89OQXFaroYA6hwMeehio(86bW8)g#rI)=O^a#BWh{YtX zYKGI!Y9+88@9%us(fQwi8oR$Ch;xqj+dKXuoV&Ww3D^FvYg9`2NlnEso#l&&$8%3$ zUb^izO5v>YByc2Tqv51(m^dlK7~k?QXCS(Bkj*9!zDt;8jNC;Rc0D_4%j z@NZi?H~R6k2zVP07(s9^K4fdS@MaCU-Vy}aMK}sV4zUD8N7c}A&K()d+C0?7lh5*I`XhsLeB&F_~drcF9;21h@L zjt<+uSZ{-500n!q_*mV8V&O4;u;bM3J4w^XaB@fArZfq5+so5kog75GA&T)%x+-9YX-Nv68#e!G5~d^O=h@?Iii_?dG6vZz*<-b(^~ zm{Aw!$1Em0(Z`OsF>t;D8(SeDQB@BYSM_}bo+PhWpy_cwXhSm6KAMJjj|;=$}W#?p1p zcae55w{(+|4`<-@JT#dCNZ9xD)z-#qSE~M7*_$^`<5oENy!mXPer{W=lsHI1lKy-aOyb z(utGfB`w6JCHkVPk#M&o0gU{iuC%x44@S84+fFDZzAG2I?c?rs`t~&Vi_HOK(&yZA zthy!TOL+7t#-nuyr2|aiidHa0#Bnu;;?B7QaGZ%K)-Q#M&PxgEYMQi>XapJ5nNMyf z7*Akmj*jBsKDATWm<=F|X}}?@7kr7pT@|^}m}W6KI!1d0#9BBQYZ*v55W@$@PHYWH zf`pB6SPoCgu1pEthS*z$dy)Av+kweH=>HJRA3B331n;(<7<8xRklL=?sFYa{S90!_ zUR3%>1$`7wp|VzPOk@$^++9JP=9h|_pMJos}!tnIj;5a zT2>3{yf%Anw@*EMH*$kb&PBTwFPQJURd=FWM<$?_WT(J&C-*p6-#C!U_+9h92bce6 zxz2O8`-P6g&vUl>+H3MSL93P%A|Yogn(tc=&hPd=IT$V}`DAQ0L9hxoO*0iW?oi*2 z%Z@b>%VlQvy1tg9wivX6=YJ60?y~h>^IjWyJ>DBKHy?Q2Hk2A0N2t`I-GTkJ$1OVv z#sQ?caWk4N;Tcz?1k{xgU8dyH5go|%cvY^KRT4&k#(Zp)jp@9#Z%4?uoQJ(@aJYD9yAPa!9sNho zN_RCwmin=Y(5l+HE@ofJqPe0h4{Tr8w~UY{3x7H1%M3bT!l*X(470^&Gq@Ng?TO0K z<_ZEexP1m{DAXFGY6FdDu>;Uo+K+9%o;csKq>96@E08~j>kvU0D3Vj=2ks|#&%i0HLN*}2WjZbxF98K{ z-}d?e0j1OJ=_o%g2%ji$eIhp}h73glK;@I5JZnoaZ-_WV>Z^Vueia8A_IQa6NsODX znH7*AM0Z&>$L8ucdLg`@q;O>(kd=0A+`KNqUA8&cHSm!O=MwXSNo|xjbxScTE7C}r zRmNzva}`oZGsf-nX~9@hj!4n;L!(ePUA0dTCDNsuYKlRVJmJv{%yd{6Fsoz7IO5qMx>u~|oCX^>0`pr0ek5#S9AvK#_J*&W4PL8W9}azj1}eHz zK2zg#IWj~nl%}@NNKhp_z|5Xz@#GmWDly3qlwtwL#ReOS`!`pLzH}#4zU`3n4U>2Z zGcgTa9VLQ)j3bGgaedZ?;!a%KkY~77Q?HDO+Vg}));h6lFwdZd>khZQ{0*(Cj>&Wm&fL`7p>=MgSS%wvs;HOs~<9-CWU!8v%?3zFBex^T`T5 zrT5bG6GdHB%~Q%b$TXhZ$CTd)wb(ayZXcqbQEN!~MFYyoWy!{qV_fnDf}TU{k{~^^ z&Gu-~=RX8Ary$VSx27qy&>Z9=O(?+Hie`}4a+RH@j5Jv>{4{Ze+B*9Uok0t;XCSk# zslgqxwd@dCr{>Rcq^#_CWfOl!X$v<7D^sjB88L&Y;Afnv8q9fBzO<3cEylg~DF90b zOBXw=ie{rE3dwYJCHY&u8@uVilj768J@?MNJ^uQ}{-@n(luW^%@yo7;G4lD7&z`A4 zEOTqrbGq-TP_y9XjFUbqcC*=IL^p@cku75TT@W8>`@1c*E56SihkO++Gd}XI&hCrrYIJ>=$*^5Z@dwnDE5Ze zancWqPhWIm&BX!zw|55yN~?di56F$PX0b;Fu#4d+!)&h*e@+H6&+G%k=5`(3Pvofu z5hBSzQ;X0zN&;~lWRxx1{n3f`>?$OI^)b}2IK%GIL6dfbf&CC1dNorsRsZg+J}}kS zBqS>DsvtVBC9>IZxpH#GT!9L4UJeptU{gXT0NKlqDq9!6r-SEx?kHEXoUQ9dMxy8as0F=kTt=^V5Bk1;HFo== zDi$s8P6q`T-X=x1sJ3C9(R*DxVMpA93v}dFb;E6vup92d1-eng24{=i%lG7JqbpZk zUqv^Rv60qoP>u*d8;T0RRV2OjiXr)mxnPE{?4Ma1l}@Bv14(ZFB)IK`)_ z|6%GrNTK891$U8a_9X7nNzX2woV%;#sGJqu$GlG$Ci!vD1NXh}fkOLEJRb_mA@e|P zc}|4fib8_#&z~=Y{|EN) zuVm{^=j9~qmwV8k+BjA=1IcJ5q7FFOMu1lz)yyq9`-zr`>e9~j$xJuJ0+9x_# zqZKkE8w~{X%&+3==4N%p8z#ttwa}#ywMf^kJonWS)~Jy~61?)smAxAfEJmK50}&)m zNZoVuR`{*g=|5TfWRv=!W3~?c=EmPY_~iY2Pk(Snkzf+eXw^wA!I6MOI4|O2jXph{ zP2$zXC+T4Bn9!{Y3_i2X1ry&Dzsx@Imabc`d7PCY33K0j9@s_ZK11|nd7Kfe{X#U< zRo}l7cVYiZ&rTehh%VI0V zVE;5I+4CA)mS^Eh%CmlV4H@O(jGqTL@8Cy_mx`>XfTnuexXi=vD#wW#LgveL&47AD ztNJjXt1P@J-S=0+(J&V?G~7*}$#nO~q?|`xf=B7#$(*1)I+b~igaxglGh`yklVz2! zC*>};jRva_w}(0azsuNIrq;{{BzoU<>-ABY9taz*lJyNE}83-6_A;|(6-DZJA)Wvichui_Jo z%&-^2HZ*&%KT7AHT5G-SfT0ZCe9fYFx8li3y1O-pZPfdGQ*%|G$0tP|Z#XcI^A@`R zou3_SF_D1OjtzM;A*KWhD=t$i&&ZJl#ao`qJ_Cx?6aBRlUx{4j8a;{o^8#|+i%WIY z=U&UK5BkoCTZt8C8*F)bZ&H2*Y)>ys%wvU5e|^seUC&Fct!wur?$QgaZD;o)mFruf z%Jr?C+xHhsAf=9;JY3iC@jV4jZRlO|^#0|CO>YMBAS6`EnsCXT>ePIL?U6gxZl=ki8SMw5cu|zG4-@qc>G@=Y#Io(x0Q6IFZ8EeF_ zCNdo=Q4QIMZZwXgf^aBFy%P^u)0GvF%4zML_t?OB_hu5!?p{?-3Ofh*-AuwLUJoeY zHdR=~JqYUH{oSmWuU26__n^hV@W}!VR2~Nbm?uQ*b+Zje)EhGxBgLa5fYTM^QeLle z%?HT2Cg)&lJG!mOBBBSx(2`qFc+k3Ai3+00a^@-^^eoqG%?ljg@4?4+L|3Y0t3TV1S^mEH>w(!ZC#0VkCfl7!%WG;sg3=lP7 zMLMZC9}*G9TpPgqlkq_Kz9uzq;f?vFR1;I&aRxYEU=ot1deN_NWmW1g(mONhvkut#7)X-jcq3u_zM^dtPfD#JkEiP5->d} zZlIj7`+Xl6RGKVv3Gue5Px6+LPTbBIb66XDm=kBw3P+O;$dFc466I4ahs2)*ITj6l zvAgN;B*4wk5v!}gKtSqs;f65rKK3k8`XNVrFuWNyVmK{WHkzKwQ~?2U;=~fJG+GmNp-55-_qGqV?9b>)m*#<^&njgjIf8ly1!Kc}D2TjBM8xr~tk|!)MZPcSc;=x~Z2KVA$+{rU`J9lH|m`sg~Rd!F-qn!|Ay| zQmbwj+gy>*XzwFX&zG=Xsss0OPezxm5ex%LD}PMbp*-?&M5%5^btl2 z!Ht;h`rzW{_mPIJ zBlT!%osu|O)>};>FVcv?mPmMEPLJ6IlZTs1leX8ZA!78*fq_6Ds;1OpK|r%DG_j~9 z%F?qbTHVW4)Qfh7i;M?EXjG_YHsoxc)#BGL^W{ihvEuY2u=YuiTEL4^%4GOdQmX(v z1>}a;7dwK=lVJ`&ngo!FJ&+fQ1z~6O7?GXWsBwH=pAZ;m=k+XjRjpAyD3KDV0&0Ki zK-(m4^?S*~MWAy?BlT1mGZ(*n)_A#2U^=Lt70abX)dBz=_sdWy242j8*4Bze0qR+} zcnx?YK)S#=Gk}RQ_ZHxCy;P>uBh>p1*|TH!r@BJqPsf@Xc%R#~Ck@2SMHDI-?)bR* z7;IrP<#5~dSwK19fs>Sg5RLOsLEb2*(<*O6Xf`Hu=oNztG!qAlvNN&Qgo4%Awpe_0Y_YH6@-G!zv&GJ$ESVjYERodxzI)Eia4D_7D% zYo}wyg*zZo6Y-IWD!8SKDwxGQh-7=C%4Gw^D3+9A`C>;4>MS^Bb*&6Y?&q~dw{9Kn z9_6^O7a7=Ys*Y5jql6cUm&4$fs4m2j^Vh;9;d5nhX_ z8{exjTXgJ6ID2|oU}O>MIO>BKSJ=0VyGxs|#1FRf3H*3*cL;Injqx;_YJca3ePA-L_K$)5J8#@!)AdYl zG5BcT&}a_`O1^?SD4*c{?b$u5mg32BtpM+Xzk%LG?Bz2dgn`LTS;r_=dXt&Ytio{E z7!u}9q#@x=+#HhYCOvfHATaPua!{gH081t0C?z>J&qYCxiQQ0-$XFmKkh$)IBRrXH z^VJ;5)g(VH#`&-vN04F?s+uu4DoB6HG|+7|9%AA#_Q@aW3k}qz5sZ}fg^{`>$-5n} zDwiu*``)J^kfr^Ti*w^YglbWQG4juxSk~rJM7q-==^@XlBir%qPo`uL>H!Nmtzl~%sn=qOND;21D|=4;aTUeYvf!RN(1NU_eU1<=T& zUj&M&cR&6F#p?tW>&ywUifzlrbv*+0o#`NI^9D~?z;N^%TJCn`ZR9>6-677ONeqgu z;@#z18znwxa)(?Q@NvODiIQ&dR&=eZD~{yB5Yx&6B~C9Bh*IWAWHHDVj6@V047RVE z5GZcu$Gi%+tY?UDL&nE7Y=O8Y3Kda#x(zP?H?{K7+f`!IJr-S|7-TkXWKkeuC zmuve&QPeuN&Nq8yclYWw-=I&F4!_)ZTYqsU(f;zLZ|=;#>CACx?)xZxyk5A!KD&w* zKexr92p@VF?9k#I7uBSyZOIt`3#L_eiZeCKFdOAj>E!urG2F6)SaE#u#nOG1nM9MD zj&?H(d6Zr})$3tuj#=Qk*zJ11X;(oqWVeN3YXy`j25v`viq9p1m+J`tQ?dOh>w@Mr z8S?^4>g9^S6~e1$rQFVIW98hpIqX86VmgfolRQcX^;Ji;_j^T(`E+}Hosb*|%`jyZ z3?E!X^ZcrJLs+CAKYV=ucSh+Ci^ar=*CbFNt4BNq8;+R_YX(xW3r8&?<|W~WhF#b` zE&20&ybi82e&TMlaXFv6e)SJZ372cbcE!J~xeFGN&;+_SXN zDoCCed3b+mJ~bE_@Z10h)_oF#?opSh4sV&>gw5NEs8o= zh@!?-*kHrH>kjuO!T@ck+)wUz3x7SypeJ5y4eLfSMNPLm9%f~YHt8NrJ9@2=>ZOk( zoaQMsGe8g0!D+Ta@2DQ!4aY*K-b^Hw#IW@|4VnF(BBML#B z^nrJR>Kf9!`7E!EPZ=oiWlyXhG_;qz%RhqvC(;WkL+JpqN%<>MOl_M7 z_!`Uux_}MJ*@V1LolLxWiQ(6(WiH55l^dqk4B?>X+_)z=U;hkLc}@48nFM{74)`y? zKDmQ;>;|@70TkY+X3x`6rPt7pfwery*?mqalBk$uCX+tIwt6NT&50n|D%CK|2Qh?% z`P^}2%KNg2PSSCzAW1czqxXWINPgg^)=8qNo{YE<1w?m!l+dH@6_3!3K>*MqRsZ%#;T1{}Azl^e3QLCC`f=vZD0Dv{f zEI_rFK!`5GsW|y*1v9i_0!0CawRvH9>s1~U04)<9l?A6ae?E3xk=wT9T0va_(;meK ziGOfbJ%hu{_6pacn|$n;!d}ZP<`3!{~vEsYt5S6f8QK$waSVu>jx#MSQYR}g-*o)GKp&Vz% zu7~kL6t!y{A_z?^p_7m?r}so}Ur1yYL4=zf2Ae@vIWgdg!HLC{mBWf(EWPF1D0~l& zlRdoINenHJ*@V(>S!Oc4{DTy93Dsfmd2Os|eWENi!9{$sGEkbWln95i*Bl)^+7RBi zpaiT7pT+EyBT-Z?gEbx{t2LRY(Gq179ZM1Lg+hzcCwLeMzawQOL}ij*QJ1D_pdp3~ zn;2t9fcDqv@vJ<8ywa%%wQHcWCv+zRoi&^VJB|ysa z78_`7#Rf~ddHjt+*EgJRU=LHv1@LyAoufE$Zi}f;V-_jI*pk65c%>j^+Tz4aR_bNy zmBEQ}_k4Q;Du`j`+d3OROG3Rig{pt1`93>_HT*=qZz_~pB@@XY;xh@sgpzcOB3Qt~ z>nU*5`)RaO%_Hkoop`_A(BseBwHgW?elbERJ-^8%Nbx!D+TPzvjXA z*U(n5KJ5N&GO{EX87+P@e^>)KCm=b4{n5_CiGo(Y>4VVPR3e`0qK(2B^sqE@%~MBZ zjlj626HB*q6c;~fwLxR@TJ1muTa?-JsfZn;Wu?v}8oL zd_VhELj@&s7ML7Dwjp6652+}OqA#MI`ih9u;^(L=l32(^p?Wh#JOIUK_SyZw0T?DNy;dF**7R1`Rq!qZbsX zRtgvZW?-=yAslUSC>rL&@z&a0-{GwCq`4=ji~}ag?r?uaX>b<4roWUUm_o#`W1@4e2HUGNQJ#-)pw2HaV(NISTjE zDBYMPNUda%ShaCuh8}gSDK$BB_9C$ApmN`lb;>ICdV=pGl#VDBjHA`t4T2nCrndcrtE-E)D*GRmds`ZxU9|C>l}kRp6T+rI zp%=xs{LtQz;bMhgT@*D{H{VRTZRq_i%@jUxwCd|m_7cK5&1pHE>h=m=+U);`6uJ=$ zWDML%Y^Xma#b8z=Tja_dAER47v;%Fbv3lHQt)^wySoDFhGCO8B4S!Y#MT!t;F^KKp zWP5}2|DU}l0dJ~GH-#=XrK}Z{0p6u-DI{qVXn~e?C`)NEEv1x2YN<(^Hlb-!nxu3C z3M#8so&pMtfC$PC3L>JcvdSh1SU&_&6yza~ab-Y|Ir}~L=9ZRmp7Z%WGoM56xo7$B zIsf_3zn>%;kBh)`b1R0Dkg$L;h8LogkK#{o&Nns@&}4+vxtIcI)#VaKNl8#eTagp7 zjZ}<7*NpopDiDBFN5GWe8YMYjaX3*kh}4w|qP;|S6ao2Fa=8;-OVM_(umsY~Mq0GH zXo?uOy$GeXB$$C4lJt^zhM4P!&m=kMKwwI+TnCl;4JG~x(uuns=|p?~D-Weyf!U2O zg%KG6>gL24vP?5=|`b}KN(|7SblKglJ_Ss=nCHw>Xj9}Svm4`8~i7IUub zEM~<#{mCM!%}`J?LiUD-vyi&JD=2Pht}oY^-}Uzer(GT!NS_NIM{e zb+*u|2|XqmKAD1=Ss(12n*pbwCcb2OP!hLWykY`seiR-QyEE6}g}xF5$#8pY=SKPx zT!A@SA$ux!t046CfH`aIC@5A;lLBBBvM^4$!Dhe?OF|Z4dfnOCTw0V&raMMyDij46 z9Zt~?ozk(dJ}(*&_jZ;9PEu1zw$M57g*vW0-_F9}lG;nG?r=#R#cu3UFtGgLW7)>S z0%i9QaA+#(?zdFZFH-Bep^pZ_SdN=iY^;+sc6(gKB-Je1_jsNa8!FE!@l50LKVzI_ z`Now;kjq>+!i&{{d^f47^+9boSG-g%n=-8$Mm&&6AG=3Z5uz7PzGG$x!QE)nps*ee z6pPh{Qy#fRFa=$yz}8-r>)F;J359)UE&|I~H1L>k&61wknd#v|AK(NIzz!_Tvgj    |oZ^4Ms;2cKBQx~kK&jhLWBM;(rUkc3)@gp(V6iOEd1ZS^us67mKqg&w--WUv=n zCG@N_qG&p6H*>t98~9h~hIXdL9MMg{=&1)4?BuA9gn~J-?m}_1DRqc@Opq2(LZy8VI_N1HoLdrVe zLigmG7WI$fB}8kgJ3?LHg5x=@1=ty#U8yd`T{=r(8kCUMVHPY90|bvj@EAE9l>>n% zfe~O1jm&zU`9OG^3s_!{l^HQ51A~bW;)O~fOJ~dme}sd^;ac!yKu-Xma4oJ#e_2uJ z4Fc2W9d6|@z%Foq9%HyLiTe=QCh!5@!htWr3Q?djr%N&KqY*Cfi-F*V7HpC0v)Y8Yog4YO8RH1w_xFwrD2geO^F`SgihT~BnNIqRhxt4~GGz1c(3>0HMu+#|#)*cd{V*rp^17{4p&-3D= zN?`?{oiS5P6NIlIMy=U3VbqtEIxDe2V2%vRXn^8j6;8e{zFSc_9-?c3Cr;=V4mcQY z_aL8nzzYFnC^p-Xqs|1c3+`!Pz1Y3;W2PUl2~au zbVO0&!b!4uIH??`rW8dYT)|`qWqeR_-I5s0Md#+uB5K4i19b2@3yHOtPr`sf?ZneH zid7IQ3=l)AB6A)Z&_$Rkv^(e`!Oe~x+lfWP25-mhA-{kT3&Uhwn*0GV08&7$zlB;g z@|cjIVW*CfUUx|(Qr<;c?9NCjhol(>Ei~Q|x^522d=dQwQap1LB8ry1HuVF6F3&p>?HM0gni@%6X+bj4CcnzcVQ6%btJ{v^0Npq>o4inzHndR4aT=XqULf9UZ&yfnqct`4KEJ<&@L9!TnLwLeK zL|qwgX(BooF``7w?M3bYMdvaJm#4IuWw9fd^fA^^&V>@ao?4b}1OQ!PmgHAbW&!|r zKEi4x({0rugC}ve6UDWGfLJAF=8Q_rNX!@_8Y1hMbHJ!`>9|O;vx!(4<+XSm^Z;Vl zLgc!NndX#U<)s#bI>?)T7MSjXC?3dRC(x96q(X_c*a~$sd>y?U8WbBu4&O-hH$3>z zMQi2YY%ZhHbygNu_TbD=;LmKzpGBydR}3cD(4ifL&pgg2nI~pJS+DUv-Nv(i$&^48 zh1tL!WN}O*GBX}zX=rXug2zTF9vgk}nCk2l5jn{x?+Kia0>Cu0qzw=QaCmv1a%Qap zAo}OBL~oKpiLRjGb220;C2i1y;w#ePC<6%4R}LO1;<-B+!*7;&eE>dBjqmdkwJVUA zT1#nyqWhUCuya;E;PtKO87vBPSaXscMz*0 z`v}qh^a1c;aAw+rqJ!)U9WHa8!)~b`sf*3Ig-|(98ZbXvY4N{^*rs8LgG?y{e&e^$ zJGJZo7*sPKRFzz;nJ>0|&<{u*_Q3m+0`HdK8staKj6iUX9Fo_J&4(&H9)EdyZN|yh zp_eDe|3W#0xsWsG61$|Bpr+4BgSabnKcfY*C{{$aW2MWX|a>ci?fOYtoRDGqblvaM7^j zoDw6J(6s>2kFLNAV}u8CBsLSq^U~04(vW7D1pF{-3wd?1)&0n**PO#$h(t&aI?NOz zX#f%X?~G_px?XvVM0jGQp( ziW=)ON#ZLSk0I7n07|WaxwKJ=Ho6;8Em5qwA8ABT@~5y!7SSv2L|1DVJoJ@R!qgl#tW5j;|N(#0tPq^GQVBT&}=StS$>#Cl;>?fHDqP|?IStAw2cLE(Ot zz}%5qVp+B#R8;IvgGMB!xk80nd101PX?BC=fsP0f6e*|R2RrGv;H7C$KP-&Yf)7Sy z2ZMjWdvwHl#HA8ck~d1LuK@!wt4=J+7695YJcX!-mKtta)J2w9u?oJj0AgQ=l9#K4 z8PKp90;UpZ`$7SV&Fl;U5BL}ZQ|9Go zOg24`V7WY`5q#fCGTqobgxN3RxSE^+guxN1i6&Em+5}^S@zs^F>Qu1bQUO^p#s~&u zY;@mP@W+6ROu-lx)f;p~n)K_a)8Td`8zj29shs(ZLSv0lt{vCtY_wzzaw;-r&cDK!3RCm4l-v2>==)|oAB9_bHDv1?3 z;Uy8`0C6|x78aC1L$8j$OhP~SGT-I&=<>})c1L-v;5IwmIv}mu^WiHG5c+gxhrPfV zi<~0h<%yuU2yhp6rw%zq!~!~0T*j3;todRgVE1eWtza{P|9XP|dO`TmfD^5_wG(=W zIv5;oPq_ooF1rVenu|Ly!|O5&;!PJ^QcN1=rfd&Hh9e3!&`h3hjZi7YOhVlHqKX z8}Xes-0?ITh)yl#~L*%2n`Lnckf<8LiDQj#Yc}Wbh&bF{`}R(jSJ?@n{wg8 z&bYXFdv>opdGf8RR}bA>J^I(lp})MKzwxf;yK4t-Tzu=N{nHK}yzu?$B|m)oDdn0F;xNgmUXSkvoEo&+2DvXnuHUcqR-1V+~`+jd}(TNvbOE>hgOsv zKKe-0XImCmuNu3tc3tU_>lM3Z4o+wDZHBzsvd3nv6MSpACq}*Ov zHFx=nprFv@Yu{h6{*||aRQ^FLR;Zud>j>Ul<6r52$iHc`psKy6_MMq@Jm^HI{eu6+ zFM~tBR9{eEQSI9J<_CLEyc%-IUiF6Khe^#osj7U}^myS%{r7YTIMhTvX5Y+{n!g5y z4w&6_x8GZVN844qgF^m$-IUPQ@#n0^QsWCJx4X9{Y{Blusv%8pH)-{ZHf(A}?+GjI z{k65JOP+tIU-Bir>iw9xXUp7;=YIa-WWQNEsy1CY(LohF@^WVD$d{v*h1_X=zVqHy z2bVqZ>6pj%AFvNjO8=$fI$M#xcVW}O@%wML`Xn{zEnXEhjAFdUScV#ek#gy=!s5*R#TDrSmdnk6>j<%;e6>sqCXNwApj>>!1@%oGZBg{Lpy+~_X74^p6 z;^43fYwWt%&yJAVySbn&xTQ8TdDrv-0U^!%tCm$dA*}tW!+HcAoZ|#8@1s%6N z7W201qbJ82OAnn4uDZ6m-sgSCluU=VN9oYSw zWz(jsRB``-{rG$T>ZJdpD1p8I$PkMWFf<$ETYORTCf zqo`A<&{J=SG7Cb6wG=Rs#ze{q6eV z$BNq>EI&Bqe9z6Bn`t+d<@z=6+<$IZ%J9e!Tl}PcZFboF|9ZIZ>XLOY9tk@5^_q57 zAEll>GbG3JU6;sPbGK!#&I~`ex}@{|*|tU9=Y*wv=a{Gl5KA``Eg*2{GvYkh3yu$8yu9~`uIEPhNR%xz6vkxV+~& zyEpgLH)}C=^W2pygO_!g)?AgbDXvEK=DO=c6Amx`WmuaVVPA~eJ~v{!Ibx%APXD(b zT{R)T$*i@Tp3OM8+!OS5N2~qYpr=o5>u@q^!@=6H5AHsc*k@+O&h2Nvykre&b3Esb z^c9=un>wtw)d>C@X4o%Q_&3%(cj?sm11pDD#JyYbV*HL;KXpL3+4NNA^e3k7xLZ4_ z(?2xRZ`;&srUa!Yy6rcbuO%wBLS5%OlG!rWejC@Y&?J?qS}XZ9Iq zO)S2dU^$uZpV6qc_0%&z?;7>~vX|cOem89GhREpFN0yF%`U^*+Gndbe|K{O)GiM(- z5-=sX*Mdzi46B_tBiAhC4P8Hc>>KS)4Bvh%W<*V!xyx61PJI_!)Kjn?|Dj*%@e#dS ztD6n{NB1#@55DkL?{*I*pB%sVW{7k7#nMMI2COYQuqVuRsB+Eut?HpGXOBy~de}5v zKR)fXcNS0Ha`wefE&UwlO>O$$nC-8PnAi1sMfvD1Pi#CN^Ks4hTUv!YvgB<0t$l0r z{(7=Q>AWQ$_T9C3Ty4wIDIavdq%+^Wd-_b9d1vtCoPG1Qb{zD~w{3T5ias2E?YrQ`-{0D>s`^dO zWKG*fx)uQ|Hy$krdTr0U%l{Jca_-eThpNWMUdep4yvOCmugBZAj+s7v%+8pTl z%-j8*pMUM`>P-;=FK5`EOX~65Db4z#f%+JYX1@EUm)@CY|I)mMlZQ{>ByGKJ(*`;`Eb;>@rCa_b53ZzDj<5-&W#mSx9_!&tJ>PT z^dAn_KiRtys3?wZt;VSIi_s)1h7f56lo=cb7#0;7PUPzw@4Nfp+~vBf#fNquE#lm|UOIPs_yTgH_ZGKvp7Z+&PG6`x)V-nBHE`gcfhPnr z_iQQJ=GMwsZt2t4OgN$BX3Qri15+)R-R@q9Z$J5EsKPrq*W6;Jds@w+yoc{zZhxoi zg5>-qAJ&e^H@BRgyC%PSQBYS^Nz<>Nl}(*DDs=PNl4f${q;45`eY}qqSmw-*{>{pN z+vK|kY-?S=FpJK14*PNS(jj@A@;0lmRlb?i1FBtH7KpQ-4Zradd8NL@%JuUv8>c*X z52@*wgrAaoufu(ow2v<_?{*ZoJmNZfaa{cq^LhTI(-yS1c`w;AFQa?Nltzy4bJafC z@FolAD@*>kmT9>x{!*{q9zB2H?vJ&$|GeP6`=WHqjTujJJjuwGAxw{KMd7Sj11Fpa zY+MxMol{T{A2KxR^5cH3jN9yUo~_-wE|3>|?_`~IPK0;wx*%@Gvnn@n&GHdTj?_&W zJ-v%ptWvqCCU~Mpi0$6HO9i%qILqrt)I+|Hsl0lSxv)#Et)=bdQ|qh;ee(Sez1Q>k zz4+@H=4C#=x(zrwrz!Ym%UyfN+_ZB}A;=+OGr4y{fKS zPt2TCF?`PG!-=GKL;BX?SdL&_@e z)E*9L?Q&f5a8OZT(9Mr;RlI-t?2%H(O7rnvb(c91K_yD^DQ|4B9J@vSKyZ)!{=dwps4V{<%;1J0@UF_BzntCd( z!nLq}(GVr;#Z_K_tXqjwq2SNUm!AI?k!4d@fA2zZa`okJ%H2;@w=XPzJ{0I(zMy)C zypbbtsyn{8=RCJFw;0mAaOLdh@4V=;+_JpoK6m-T59W8jlF_g;_tAP%rP>?BvOIn$ zqv`BQ@a>NQ4xH0g6+SVyar^HLP3}K)-}CJ;YsUJ(xmPl8F1)#BWaYK@+Mj-+cz5>Uf}k1J zt=GC8n_T*^$Ajew^%u=QC*79?wzf!5epT$1ol!s6yX|1?HYnZRAKS-jd#PuD?X85W{w-(Buw&<+W!&C)Ja)p$@fT+H{o__m zPE*DwA997LsZ7BKW&WhHQZ&nTdnnn2fGLEI>oapM+_Mq+gv(0Db-imFEC<^%Va%dMk z$oAvakH{zLJq6nbmu-*tUNL4^Wz;J1l~s%hTbD1j-ZAk|^IsS4_s5Qfgv2&p*q=Q8 zX>G!Q1=oECg->}rU`w{lBK1aHVQi00ne8=`Ec|S)Gsh@Xx8!B*`(TN{``NkjqS{ic z_Lh>evZ*YISAu8G)AK9IGUd}pk0pl|UOCoWkTieMO`$Zdew>R{S4XcIpK-eXx?*{$ z+A6wueRf$3DEZK{Kj$Bv+mlgP|KEP1#6-`^Kv6v7c+?UV;zrKUijN*7R5CyqKOI6LP%Ph^{3)KELz&reyC= z*Zy_MzWc14#@~4EU3_z<&x=$|X7}B8{7MXe&+UhUe*Zm~eK2waG4ilYR`)+2Z+x+%R;Hcr1wR7$F%$RAu2JaVl zfAh)FArrHYgh!9$l=C9iH%utXy?5|pY1A6U%=k;5IlF2i!d&WpUfeS~jsMG}%GgDb z(i?3z7cZF36a|$vd49Tm;rb0`=YO2KO8&+9l|G)&gBG?Hc(g_j$$#HD{;!DH-){Z- ze%pwt-FAR#sdVoNN8#>!SA`EX$1zJLA=5 zc75yd%*Wr{A3Pv0`@!uy-@Ql(VQ+J?<%bgCgNJJ$+-sPWP}P6sH(!d% zj!Zpy&hb{t=B=EZh}O@#?!WKsUNI`25Di>Z;dSuBz?HVkcGhmLojohN(SPE|FsEI= zg!#B<{ZV#s^5GjTy$+sd_9If8;saQ>?_H~$$jwZ;nc7_DHm737rR@7FJ)4;`^6oZC zKg0*bXZ9#wm$K5EjB{P*mv=TP*E!zv1B=!54b=xcfAZO9DH=E3qKi*oY|s9D^R?F= zoaUCKoV-Vb#n(4h*H~_j+SGHn;|JX~wzgS(UsW6!QXJQdz4-Y%?>%u@nPIHWiuA7-M5)sH|W5cBis>tmIW2~<+(&v-dLLXxZ8%quDcw3 z-1mJ!;Qsw%K4QISOwZWjr!Kad>h_&i;*^$@fvlEW>>W{p$~jl_&L%1@t~k=1f;De9 zAMP4`zuT^E3%3^aiuTOx5-tq7F<^M+n#*B>E{!?NKJ?gsG%xb$4X$OPVrj%$m%6}Q z^L=Lu@@p-k!apv1Yi%n7TdFHk@#(a(zDK&bhn8W~_d?pR&*OjgOWsO|3R7 z_x>`EJ!#4_@L|$Z6&&i{^K7sF9}WAsq}MhZ_<I3Wl_|@U}f0|IH z7E0g97T{~X|DBwjoJ`k$-QIrxcgB_Cg3wE~TWp#=J>70r4u;7Ux&%sMngo2^JGl); zasPDv-(G+3dg=QwQHdSjU>WcoALi!P;rs7o^8ULzyMXuK?G4tU!|VU~``=;zrx7xa z_|25@+WkLQ7vuF`C-=Aef1PqU+GF-O>TBG=0UnPbWCZlBFakvYiQqv+2y2u`(3G#} z^ok}ub)rE7y~Y9QWuy*5L&N7KBTbIQuxUz5oI%ly=pDzgcf>Fo8aNR5ge8-l6feCn zi1))uVdw`4)fqrA48)+5H6ezTps=r)@K8zwI(TExXJJ_wijwhYJ{}b*XYyGisZav^ zgg6BLECp>vF@c+=EEDX$pIE2Vx5?;4RHS|im=`+W>j{t%QWVGIaZLm;KqTX3nM5Qhl?Y|8Dpo%U?u|2`8#Dv= zz!}IrS|`;ox5r>P62MP@r%#|mEfPS>l#{5ZwYubBx|We4ku)N+6EY`Y1E&cI856=k zppMY*8J^}y7!ziMH<}|jKtBDDuqmD!*jbeB{DefvTnTFhPrb0Lc}^@miLL~Aa=_!s z25NxX7`MKIGfPvBSV}4-)H9%8-+%fQ{a?L09RCIWqy0kt-$)s+8~=xy`u{m`-|qi) z%7rkQsiU8eZCwjWg=kmRN=cGhieObJvP<}>z`-JA=#(dQ^b3Lg;2e&lQXytjYz5Tu zJq?mFeSlT27D4a4L=wLF91LRUKm;fHa9f%%6%>&qB&2KzGGj;ao{EGbND@h^v}Cvv zTnQc7wdYtdgpvhOb=8D45ka!x5fT+18p99viGXE?0?8DNs8~!YAi%5?@{J3n;M*26 z3s6f<<~jmUcM zAWuzpfG6&WWQ3Kk@&85%rYboip$apLpkSx;n;KWkpt6kd1Y-Y1V?OOrK5SoFo*)XHwq(-1Jr49qagUXU=);W93Yis7=@%s(u_hVP6gvY zIjpJDC{#0G7zCmd{U%`uS;sJt!Xq&XGp-F72253*YMg2sfg0!~-#>=wAcTNvXrjn8 zj38eUCL@g71){!~CZv#Tj02UXVW3@117W*Rfkq#AAmpEZOa61O4#$6u-Sh^^c-{E# z&NW{Db8{Q^cKq*@%LbX=$UxSd`UAa>VdKKb@_<#30W+G1+cLo|3tISCaG0;by-#qM z!F`0lFn(ObIPE>KV^tXD3lb!Y#h7mZe{^634|fRX;to;p^s+;+EfdIRf%Ks=b za~y>nNbRMyT0Qj4R83KOhN~?T^al%_+H^9j^6`?(X zp2TF~Kn%j^1;1YSd&@AQb3`6oOV0`j2Ce+k?i|wiU)18x$TE<6)*Ds(IzJ z)9Eu^hvPr>ZTLpYc&+`<Op}h9pt7hGIS_AI8%51!+9=xS)J9WNpEep8r`o8{(FQ`( zgfjTgS(i05+)qCNcytsJ_)0n2W{uC$Ci68)28z%n0*xXT%19YOQ_?9hh^L)EtE$a} zflP^n0tDzqQ?;cPqGFA;#2_Ms2kKux2?gPej;fB9;r;Ka!m!l)DS-=KAJ6ghqah{&K1#B-bv?{Mu%jHr6 z(p0EbBxDN{BW4tlL@b05iiolRGLq0pu!!IaO2c%L@T^yE=Tb|m9c}UchwsgG#?|5b zuUn%2+hx4Y{&RCNKK}>)f4l$JDVKu-1}s0l{RnVJ6TAHzTM{reBt|n1*FwbFX|mdB zVPbW_vN}Q(D2E9-qxBeEWQ3GrVn`%e)S@%oIiyKSXx=N41g3<0fKY-^mYI%r9Z8LB zYHyIxFm3BxOMu!KMfRJf!g&zWSj)J}ObBE_iX#}oL$!c#i5O0$%*p}3l!nRKAc}+U7#Z>2kE+lj)F1g9*Jes0f&hTKuMojhQZNoDso*DQGu@M6?K>$U#|w za$wxlD^4a!r-;IMxW zEsihkF@jhq>`k`CnP{tzjl(TC@IUoPvDh@TvjQSYDmFe%f;Lzf4pu`2*-JJ^aWoMKs1s(>)W zR*NMn@+1j)Qo5cwFQmx8?k+XcvaiH8CQ)>Z|YivWXEqQ;K^ zs4HS{kTSs(s~68DJDCe(5Dl~2u=uy4D-cN%|P{|6X5Jyfh=jA|w3$kUw9J ze$KH95~yYmGQ=d%%diHy*?4SlIBq|UjfaZVkRSlJhkw~P0{?_ii68{JKpGS?4S7z| zH!!{aJxUGlVL5WOGDS*2&sZt)Xr!v3={+#PXj4*i5^_k?Of=BD5$R(?B!PC-w6p2f zv0-aLmrEcqG6D6YPF;JPuh9!Ni#-nXgt1YO+);t2vr$9aqXj`W5(8f{xq<2is;2AT zz+C$GRNj%W^0>2M7vXw7mo~Hm>PuP+*8jDwWdmklA_=q-{o`Nk{atq(Ns=H6X3w3o zGvYb3cYeX%5UNrHM35pNDYJ@9Dw`r9B|9lnO;TA|m8lB_fdGjV7=c0rD6+ED(+_pd z?YI6b`xE+Y|HeM<<2>v+(@#^^?Ze&8Jv;zVQmU$Z5>+Vz5&mgzZf<67AAe~g`&ay# zrT-y&toQF@p8R+J^OF7N=b!z2|NBusljK6@sC`G%zW=fWZKx9k_TLz)tiT{wf<<-HPu5u8R2l$>CN|kr$79cB@94$4@%w3rp1Pt1ysTUKk2~0 zZbpxRyGHA`d{gH{ck?`d-TmqxO=JIg7eD&Jf7;~_-%R~U z|NcsrHZ=c9QzU;pV}cmEbz z|L5J^!#^GV>0fvM6?!ng5B~@L-qpW%zxr2b(ER=%|K$Gu=RX(bw-|u={ZD`5-}L#v z{`^1w1i$s{{@b5b{jbdLuN17X|Nkg||E-xm{r*QgU#u_S0qsAP@KXK%{ZGKV zzv2J>KY-_e`Ozm9&z(U#pMQK0JpU6R?4Jm8|1)DOt>@qJDtx7vFZlPL|8*D3DFnuP zfBy5|Vmtr*um8yH7Eh@kM0G?4`dd8x?_cij{>%UV=l}md{wFnVwNjt_Z}8ur|Hmh4 zuhVx`P5svI|K*e2um1b`pZ^Cg%76cV|4k)Ge*XL$`vlMb4`}-fpE>9M=MNtG`rn7^ zKi~gc#gQuP7Y#E_+vNkHddH#&S0y*Tb185*z_9UMjn zoz51`4JF9gj-U7Z@m3TMuN3;{ z!{{`Jot7l<_bf@1$*>2?i|LhG+g_Gmf%W#;8=xJkhT6DlS#qKlaUs!R>Ew{`ULnjc z>#(biUp#rT_iY1rmGcCO;ub*bC$a0a@l#|hp1>kj*yce^gr9op_p=tmTih0<$NQ2bqTEN9sAlLY-A*0d$BHP}^i+_?42I)JaSv_xNy8>}~CMirDi+u{F{Ng7&lL#Ure=6WO zZ`Gcczkvoc+%DyYX`ok&-y{4C*MTj>b-ZE0&$)HHvBOVQXB_ENO)dOZbn&}<)03}y z@b2PLmeu8aba0CGY`GHNz{uf5sv5ZmX85`E3-F!5&F@d@o|!Eh&Y+(K;gF_#^1xYJ zbLiieBC!f3YLP>^_#wE>pqmPL_teGs6`-Uuw^m91C!FPl1 ztn*~UX+rM@`|#LfqfE+N$wIAx>m&6KCyAm^aB>gu9-gkGVSC`t)NP?%R8P%fRW$^b z+L-d^@OTL~%m%cF17NfMaXg7Hz>7Cug2xsVcBCiBH^hANY%3^sZ33y%N7tB0n-uMq z)pITnet9I|0pH5>U^T~qz1IL_=NdPH-Scv*HHo%(am3n4zRW-L%cax~cS^yIFPBn# z+9?Hlyj)75xl;!ST)B+_{VJE+@yqRm%fW7P$|2D!mxB%Fl*6qb zf|Q_&S~pFX1-6jJIPKalgU7zY!fC;gcirgvfNXWhu7vPOlYHX6Kz= zA*M;rJH0MU<7(BL4eXxDe5Mcl`!rSCAIu&R!yz9qI=3WOU=4$ZFY}1V(1Qh{;31QX zadE9JU6w{JG*(w#2}KM+dw2fw$WG#$&e8GSA>F{3!sdP-y zWai(cYf4c60~_=M_VF(9AJyxh<3E0cPv!c5H2?qBgY~li=Vz^-?f*Z@$J75I59ezC zl+1Y(1)y}=)TSB#wse2h0SaVXf^8)XE5w=froI}(1{ARI2&@ad4QL?Z8R$R;KYHx*)KI$)dHNck)|3#zGh$8l=zi0R_7=Wrj5RfN} zzF)ef1Mz^3FGt_WwBay(qc}VG1%vBk5l7U4FVF@y!bXtl*(E$f`_T;6gT_hvluTHo z7+Vx$i6ZP!j1`KtLBU?M5sEcI(UvX*u@lvo2QGYmh|jsy4j1c{%I$DLfD@V3s2adx zAEF8mp$_shP7A+4+x$gUZeU@Izk%zgi=3DuCsbtH7O_DvBBS16We+x{erEc|A-vN+ zwowm6jcf#l2V(s85h#M9Uw*kH<^R9c6;H6DoCLJWK_yl*tXeml#-A|Hk2aZ^--d<8 z!cFdk+jPS|Xm~^x7X4(bSjG)xm)$rRtIwV})=^8I_+2HM?vP}%Bc&2*lb%!a_T4rK zKig9JAvlvzL?9RMp3(DX;+dvT_{PvX`JSQ01vKoO5)gcG%ThgL^m{@TtNDE*#$$8` zGwRt2J&lRNq6=0jU6vHF6KW%%+=`~xu139D#I(1DL>=ws6qW5hKRn+1R{Y-GKYZRf zsBsucReIDP;jdj?{d7`{qSaF+vw@Odb*X5p*QX)$)b94d@!rysBD+<^YBv}UhPP4O zG9_Q2Np&u~_||Vh#KuvL@p0fbwzPz&!|b`44$AG%4Zx#1rjuuW7tgkL4v)VD30iwy zWS|A=MTf`Hw^3_-?Ez{QX9I#75x|8=w{U98E5p*lQ?c02o> zla9i3WM4KSidR^^j)BMO5A!GL+h}+(EOPipoX)vgz({i_=g5wn6YFtK49+>SLg&l^ zog)i$ZaA59&B<^(+K~f!nDZsWwQQIRq0k`ts%XiwHXD}BnNh)9H!U&$w!w^CpbkDi zC*Ca#5uAWKbIr}28*WYj&IcNS3BiL+F<_Q7m$sq#wZ&${oalz`@Mf#a)5U@Cl;3x1 z*p|iuyZ(d^8Vh*cfqUM-dVyh=dkM_|dk(Bg2pfZwF+-HAQASZ>x;L2D4-7XnI2S&F zQR-fnSajInAqU#mQwjA$)1x*kH|i3KB^y}!qky}#`IlIP*kD;AFpAQ}@RAl zBa6`5C9PN3&~5xA2<2~no_T-ckCd zEifqCvB8zn;JhI%v4U?ytB68VTlBaIL0e4AfcAftOU|D^m7mJ{Kazq!NFTHB{~q4| z{PU9kU;AhO?~n6=_%C;(U+(p_-lKULwbvd#jM{3=?!o^*k6P`G`=4*LK945ZX)-CY zsB<-rehKx!pk({`9(;uhww-KzJsF;z7tujh40{P%kt<3AaX>^aw>VdfTLH=3>@(o~ z-6wg`k0)pTGa|{4M9v8{?rv{(m=Ovr=qIH(4`iS?_cKtOm(xw0`{^dmOUWh9L&+u1 z0~sUyXEeP)#)xx2W5jtVW5l_iF#@K&v?M~8j3857KS_)4UPfE$w5a`3t>Q*hBd-9q z{HgKpox|t9J=%Nv)rtE3%kR?~mfxNh=h-CJb+%uee06wqEK9sN+TV!Yym_;R%+TZv z-)zD_^eW++L7cfX86_8aeIFuc-7-(%cRg)HUu;G7{nbZBHjY*!^#v4JjYgoEOT|s~ zF(4RJ9r{fT8_{jFgg)%1LtYNA83naTmy!TRQS_rzpNH@TeCZAGM`M$puB>dng_&`> z!IN*`N;$fVV`<0zQg9heFWA3o*i3@`tLRa*P7fl}Ko)K38AmHrYBg$Mw38@uMhCCH z*b-wCu-eqY-0E5MXp4v3(6Lr}abDDQhfNbj()p$ zu-o}oPo^|ZwF>KC2fAtp9U3tA$8T4ls?&A;W?1yjv3u236y3WUjq_yM&sG)O73Ikz zMRA}Zu#GJbZ^OiG!_};2y9Zj@ZB_k(E-oV zt^nqIM@=C~FPj*oPA$-y`e91)Ah--Yed`Y6>Hgv4?fqkS)Mth1&fM1CWP||wty1%9 z5g5#3Y;|5IJ^XY!CYy-{m$RQQqdU437y3?BUTwWBmE2ee@!sNszZF{xqkr8!OA0at zz6?cu0;I&90EQHdRNbE1|9~TD79}a9c?1&|9X9YwjVnB5UOWV{+T~CW?wdHqB@$yy zT9#f8CmDvXqy`W%X&L4(0{11bV$)1lhql_r;71%2%%dVi&<(Aixhu?5rQ5kBSg5v0hdy4FV#glvDbaJ z{q4^2$@b3I4TeOnAhb?^rrxv5WHNwAbUs{Fce`SkFi&jSQaM2czp&&33o#ms5?gMG zO);L9CO0s{X)5MuC`ax>QLkF}3SGG*1i^`m!fNq@A|sfl7NA27KlJ!gxLahJOgn%s z?1IYkle$RVcl`7z{%t^`PoaLWP?5>w1Af6bb!1SRP>5fuNB9KOU%6|gx&F0Yh9 zMVKnLwzAR`?I@z&2ml%9C*cb3cAn@EpYSU##&N3Xfrq4SK`b($;ka+IQ9ppX>S+Y< z*>9{q!n*KK{8TTg$;}x^fld2^=Mlo!G*yHzzEgP9a^%dJN#(B6(LvC zu`Tl(1%Gi0X=1S73R8o?jMRf+SJAx*vZ=al(}X^tTQuJ#k|Wf1SCFDje4(HPh8<|( zhy1@!Zz$<<2o!=n=|WbQ0GANldU>ElkK+nZEaYLfEC*J>T;a63Xs++GD{s!h+_5g% zM5cVuujLEW5yxx78-nZa3wmTLIvh`6Xsa;tl~xs(>@>Zy6=7i_v#;{$X#ttJmm>nzA07q9pF(KvwFFmuB%GtgZk<+ArS_SjgYyA*s!8e8t(p&g{rv}<8q(I^oAYTi`u!vLXLZ$^;P2J{ zS6h0+i;3$kAKKd$>o*?7y+sx<3(QiXRB|;Q4SU0a94*LF7`)sRG6BPc;bjq{^p4xw zD)HGM7=(B?efB@?PNpe`d2B{C#m)6NSb<>1YQghSl_xl5H(Zd+ArpZ?Hx}mkoXuMl zO7Oq{;%4VUCh`bN3bs(SbS`Oz5CZW)IE^QhA?8NMTFuBS<`ED=6P#G7sGa5)CEw_*y&Bkdx#@0t^R^%qB!T`o)R&01CBhZ)0wyWDB5X+ z54+-eywL8dLQgG^Wq^a8yre`gG(kH!Jm@Ils(`-gJ|88c*XjX5T-wl}ic$n!JAguO z0_+a@hK-0TQ;YB#>%_F3e^P}iY22$|N)(OD^5MPIY3}Jy?gyWMV@BsMZA0x3aFP=T_99511xH?Sm zHER?%n|&R~nQm7t0ggvK8i6)gJg*qjBz}|p9s-SqMg-lq#P_y?8LiUDuzbTF%UL^E zr0s62R(W5+B%pF=zpY!P#sV~x4UcNkX&469NYUBiJPs3ye?RbAlDPDZnf1+J z=SZCgMC_1=WIqk%18%`1ds?M~!%B&7Ar6W|ddo21zM#C97Ri|z^N@digh5;Fk{JW* zw;~BkRY|q#%!=MqYi%BJeFBks)H7Gr$1T2{4-3OGWT#n%*2^D`P~RS@17HxV0nBF* zveC@biga(?LX}R^g-&aL{cSiFs9iV@1n8Ze`3mZF`zf{~6xM~hh zwR{7eM!4S~$0(Vh%7MsX$SbLL97zQqD4DfI$Ab3>YG(EHCOV(ss47?^$wTFaK{EW& z{2LuLXgUg9os}wi40k-xE#7)IvC;RP#R8MCx9T~_F34dRUW74}do^sW2P7UaSeGYh zJ@=IWKHrIozQO#V4K9kNmBMF!E*03p=P;g}jV0Gi4XIrl&}j!2M-_}%e3OGj-K!c5 zH9t#G!=C2NeZi?mYinzjbCDBXY;LLs##-Jn=H2cf zb*|5i=DjysY_37$Gn64mG}$Mx*LHX;__`TcvlFxn!P3adKn6ZMR;oND;2m(^8?_a+K6gwE3{ zLVM~G+WILPdTH~SB*pbXPhZIH3HOXG;)~yh1WVnbKU!jE##Q4TyW@SA<5ElMFqGMs z`fk^uYxxDcw@e-xCO~Rd?iy6T?i~e$j}+|2{xqJ;aKME;nm5g7{6ZA7xZ%}Wq38IG z=@}o(>!Q-t(IVKPS{n?LQ58Gw($d$ZX|XQlb#nc|CTWg!-2AF#d!)mY*NsY0P~rDy z>L^3)Pqwn|m1fbXxP7A~)#A98#tZj`@P>05RxYyuPe8E0I3ud>uIFC}yK~E`=4R&w zET$1Y;B0xHg(HszrJ|Tg>Ek zri-?tg-ThO$$s&j9sA2tRjm`G1m>1u*M^o$zCl144=%I~ZeYnjfQ2N`=aTvE!p0`= zX2CIEAz?HP4A3BCTrHL~=3WQ|f^7;-=G+EZ$6=c*5h1V+x2lgus5uX{DzpbBq*`qM z6Zet3+=nrbP;5vQ_mRIJ_Yq*~+waSkL6MT8LlA5y9mwC ze?kVP(lY8N=WOz7&c=h|>Z%3e4MC@Pg8ZHNocF+?SqxB7-{-ScJ%H~ezGt;haGGmxrrDPKMr=zJ!*V0I&EZ?B zjyJ^wZ1Ry0Kt+9=V5XN0_n=v)DtqDzlSJD<*bwpUjd&_^zZPbwR4)WI_z)LkJ&ka! zRfW)Ut7Zh>;v9FLOO?37(PIfSWj7fM3`JZZ%^gk2Z!5&wIRo&Tm}5d|xUg0wdf$Wv zV{TiseIJe#gjlr&k@DsoU5R;{VO+Z)L+A2tH*c@R&sp}+<>Q)xmKWgd1k+#Q=K?5v z*0a>JqQ6Cu&anQ(48DTkNz2Fxy#hOjWyu;sTJU{Nj=-#;am(%hFwG0qn3@n^l@dks z28OtZq91WbrZ_(`dwlj{|KzB1!barmy(AoVL!Muo(Oc0UBAw_iRz2$eT&%3a3$Ncl z{?TziTNR_g;;ZUUtQhj8TOlbQ%s;~7{aJ3LdmNeEoB+qgHY7H*LfGidQ+HxIfHG{w zZdSi88yKMJ9jGk3+KKKoW6`GovWlbMf-{IBrB3$k@V3pW)1LyLXAf|>i035 z^`Pdr$f8$+F5wlji7sd)=u~H$)}IuCKL~=J)W_34`&G)G@1k)(_^-N;l^oYE1E;t8 zh~T5X2p~A-dPb9c100kt&P&E6 zU-eL7LZByQH4v32g=spEFB9Vuni;mFw^ohDu0sRlFG>*C5;g(tt?8M8(Vsz}h#^WB zMZ2_UxD9a4;cBPp4u=NOppA0#?P0C9cqQM?+%7xi4O6jWcEpzP?$;PU^ezZ)o1Mk? zP1VNncaC?FS9u$^KKnL~_Z$lq758W)UrL*d$_uITeUa(`hHTr&($O{Cg-)$IcvxFv zDT7odtXBvjy&y>_FV<|p2WWw}^UXfdaO9OM4G9noR6VpcPT_8mQ5H(Tld`up{9>skc zPfp{rWVM&6gTn4V(J%1t zz4rgvTDL~JvV z;%7aKLx3?Xc8ETa+}gB<__E~X==3w}1Q6Jd!8&8_nEhbeN;Q8u=W&O%pr zO!h8@c`q4_;xqwQ1tYwNJzdd3djVUR%Clqyp5EBXMSeEN5{Bc(D2_J9Q|(PWNg*>L z%rSIArpeX9mjm$pBAX-u;`@&G0ni$qd|%;6f_ihE(iXlzWfvN}K%!3B z9rT z!ToIRH5a_v2KOL+kB+`VgRmH8!~t7t5Wr=C1C+cwwGnWL@gJDq1NKUqwG~4y9js~& zk5UZF7ht?0>OmQi#2pm~E)|NUvV)0QuPUQKHrKY1u3liNyVC&F0$4hwt&J!#)m{S7 zSV&w|P??r30nA=m&=7D6jw(#5wR|omo_KoIWh2w5&U&#S@6)E?^zW(yo+<6Xh(18X z3==;XHcaq9eVv3NH?!}9p+Ttuh~vY2M{jFvtlom-KLs6aiecs4m~y4IqX@>PI=C}% z>}6M5Z1=+DYc*$UQ;*M;n5DK9XnO}JRcuxdWURP-wNeX=1e?NgIgVrX(WNsKNNS_V zfof1UhQ*iw%rgE~HO*R;=_;%N9ytz~m2H6NC{O=kpH|V|aG_=k@gm>!tj!?FaXNj{p2IK7Rb?bBzDohVai1@2x+$ z*M1nae!bCtu%Tq+QuycX>D6#Fj3?LPJ`cke?%yOX^e=`3wWkIY$NAh1>wLbn6po{e zgkrA?H@t?^xJkUsP1UXv9fyPe#pB)2*#Dek?EU+gz5gGy*YDr=_y6Y)KmU3Ee~gc_ z|9Qm~2~ha(@Yfsz{{Fpo3y8q|*2em;7bF5+D(OhIJBihimESm2d=IQU+!*l5WRhl! zgo^JE%f&F4N<~EZB_*7lKw3%6Uah2roGx}C4nsB=40}Vx0RnT94PaJlIQ`U4JnARC z5oUWlPbLuaZaV72wIb-UizJ1p!Lj;x43Y9;M|r$Pl+chqTnR6z{r=wLc`@xdRZLCT zG(0)#boTd-Pr65)C%4vb!JX$s!5_T?)ifr_Kn*qJh}j4Mij`4BF~^=DD^|7SkT()S zLqbVoqH&scW!Uvwb%?e8C|XBzh#|(NEQQ~WzQk7>knj>d%={9oh{4Xu0pIAKeym9J zJ?DdWq@YJyoh0LIQb^6!-Kyl_^BZNQ7vwb-s-^udB(yB+zU&pgYqpzQ6_fZPKeGbw zE+im`;)xNx7%t{sZC!DY@uXp5S=0IqR5OVm#2N==LnWTZeS1Cmi%VbGdex&+`=xg=uE&!#U?b@&qeiilY7MPU!J$Co+LBi%_{^qi0I%|7 zG+36gTc9Y{MGXmpQEkLwNmOq=lCA#UOjJ z-Fy~CwsEK{2L0de8yx@Oouby+v=Fx-jK`#!DlkLyBdZP_LULZ164Z4=eFjiq<5R^$)DSNf6Fw=r zii^ZwqIGktV*{I8YgXOt2rho(5h+x)2k|IZXrf3S3}tdbhi7~l4@a0AWo=F9`%Bm# zM1^X1df#`x!ZY43xpQ;z4sP;Rt=;xeUXu*MIt7Qf?{;QIm1h$z)zrfaZ ztS<2TC@;Qy8CJ`{<)vyCLe=1y)Nm~LXax9rV|KrGK5p%XzRN)+4~4DYTHnMG4PR2! zdb1n&bfb68h$x}8WRoHH=Fq09!G?B^cR#0(0`7kXVNa7cm0k)JB%Nsm`WK<@&gagW zM3n{Y&{#?fI&3P6^;#nz?gQ!x%)iLigVj}?ivnI zTrYiAz4cEimsfxlle5DM2s&~kPT)Pl+`H;BQ!ytg%Q)^OF2-CWB4!V6Q7>T%RB4zP zK9ViX-RvtYBS3>QxE^f1D!R2`w(OuZUu6h1U@W`V7}m|w{$g(Lv68_nI-k|66UW-Z zqs(R2XbWi`w^kmIcU!^Znh`&f8ZHIUbV4tgoj&r9Lnv>gM77)jsEH7Zj!oSBp{qk^ z-oO{)?R`D~IEV6#_0p(wBukTQ!lwxd0OINpDsZ|C+kFp!EMXss+3b(EHa7d1uPN5ze0Q;+xU^I3QYR$#@_$*UWIH%u!Ujv1g}0c>1tQB_w($ zm(P}vW2v@vDsdt*?x|+@?Ea<>^gD_jgSIxiW?o*PS4* z!p;RP&EwBzsp~i<;>wdrW0nXs8lIxEY3_Dmc@-KyO3qY8LsItCo=8&F5bg_ZFB)0@ z4OT+oN(@iotc&Uu%^~*&1=wB|B4c=B~^4PrD{ie!RH2?`hyF}YHUmkU+aes`b{&}{mEG*RpBA8zk< zc56=lKVJ+1p+S$)N*-MGJAU)h4GXFFj_-aqiNdr6=6momD|_IwB*=js{sE$ zxz@=fFXPFOM0cPbEV(K+2nM6X8x(V(V+2v7Bq9X>C3E%&93_*s+fr3+fGrX#flv#{ z?p*?RT9zaFKv*uucs4$XVJ0JY?H+={rCn8pjM z)D`Zov~);9tVXwz*IW%<07352c3aj?I=DG4)(>gMR<$(zLUqRZ5Gnlp_}VtBIs%y$ z3{y)wRSQShY8J0$a7?5=+OO0t=71Y#41q;>+>Tuk<1JQ~pp=sr7U1u30|x=oRw0*YgK!o z4TnWnk+DQyCD>*U8f)|luIp4AGiMNNe%@+uPTLIcP$JEyXu49V)PT(rL{-PSvGAES z%iQ_^N^1eWw=meEw+Ai1&V}jT0mYEfB$+6jB?k9Zy8NXNFuzNaJGqPvLqRQupm(_a^_i5-gxC%1ENye{0P5 z-uqT;rY`I(pU&i_bNA=?U4?P;abkIwb%Kg^l1nxRmWR*>r2jJ4iTmBh)4@PdnN#!N zR6Q{6$){M5UGwVDATp6r%Ziov6p%v}-wXW>WDaLchs;f~h{oobfI~ZO$yu7L? z>P=*6PC80P9ce@vNV7pSjthm{X3K#h6gyjqMw>dFPcclViYg6&p1v9{TV5^DsWU`O z;F|+Pt_%Y2BL)+%US|k7c^|A60ndVYDpbRkSA|$x6iu94YGUP4%=!aRu`+rjo1qP< zebf3GFK9w5-aDVvxzXjdWhR9f!NVA}U{NdsInoK!20{QZ)JWWSvsH>h4ZmcG9?WG{ z@@elpa#ablNN@qhdxB$Ooq~;^%T`qNyEsKPYsJd76yL@GRjon4Mg##?)zRnNWX2&z zqV2qs0TEXp=tD=zsCEQuRGB*jl81~3+YFJFs-1(?p@L<)N-bWN6Sr3Awya)D#9)Mv zcK9M;h-%QC*(6g{E|9ey#}l+L1X0J{8!sl$8S&ZS3kQ7Znvm0zYD$wavz&70lIPBc zkzt-DDe^u{THV~{?`cY?O(}s&!~S~QxK&sGtUkhcHSpyWdu=!+!HScL(pk^|2}sfY z7f+saj)4DEm2HcShV5s6@7dnTEfkoZ?HwGSZ0~%1uibF9SLg&u-Lj^EXMXoFM;NgO zknP1tA8g9!-u92Dh4FUGQkmGy(~8RN^?3D>!jH!q21=IY9rPIBvt{3yr=!aesmwy^ zQYm&(6drrETACwFg&K?=0bguKs0lg^fc?Wrm^{OT8SH4wwo8NuhBi3Cvs=>6F?>mm|S31(_H0oDx*gyDzH3 z;gX`WEk?te;xrk64g%N;=O{Pik}f#=eNhBw{@BewS>7)*v>00I2)KQh78X_#A_y^_ zlqkEwo%Ns05>iPnbHwrq852|p<_q2*&RKLDeh5`dPY(9jYUq_}b(xvDX*&G9S|KID zBz^0_;fD3#+!#2%rsD-7?m`AbCH9d+2nUVOHcQ~tZDem>(Wz$ug^KTF+fpYGobRwG zO&I_OZQT}XC$Q*|!*Wzj?$jo54ISzNjdvIz+|UT2*82H10G145j7z-i&Pu^ z9lnfo^%c4o`ov<74PZ*Fh8T3SKL@%K$P<{dC%+!CDC`5#tQ(OKQ-P=6wsC zOjC3FG{E?y_{_b%a2k-y^tZS&1}08B12E^P+x4nVYEo;4h4c`4l^9L2X{cQ*EhmP> zg-Byb(Ze?EEfDHZezC02;1}ueN)ex=w}#`hN3aVw-o9F)?6!@%RuhTb=>>)0*Kj;2r3zxkbD|l=k%V7KU0VFO3BX+EY#AQS|B;x7XIz^kvtAF!n*B z;2l~xW0W>cv9Vq=GJudlI&oLSz~R_XqSI*53~9xgSmu1e28fpsZ7O-v0!F@2E& zk7pkpLWNUtc+mMS0JEq$pY=AA02oog-+V1+J*NIi!`CwsS3zPg9K&A7*+(llvAUTV z?Ub4JiFw%q*TMuHH-y#(@3b^4`+l;pREgdlbt#})-69XW9TgJ;_l#ni@vqck6`_tq zqfCPkoxBAe(QZYBi)z|6+PCS`MWj(9@!$aKIG&V^|2$r89H+xx$e2c>cC{Oh8q!#; zR57S40;Tr9+WF775B7F86p^$s*4aHh#Zc?e&_2bxL5~^5zXp-Anq+Fz*nllKkAK9z zeiQ?hrV&zzv4sv6tMghm=^)aJpg;ko;sT+BH^TVM;q^E;)X$%P_n*1(e?CA6u-Wl{ zTKC(nho$&GpFQ|F{?Etw1mgdkWBi|A{ffi?Jh<0_a9|Mrr}gloh5ykZ!6*>Uc_}oG z6BrEQ`l$C6;eP@#b7otP22XJ?+bW&kq#)j`a7)N5t7tpE&81)90cU2Xds1|H*sy0u zJ)lh-HX3fdoa;4zXxMsqRID4%jBI=xqxZ1wR0S9gpLY(_e4O@;bHS|D z`Wdm{LpvX1Kr!0|JfyfxJ}mjX)C zx}4TeZ1ti)&IrV~WcvZqj0Q`+C?J)6-^)xl<}qSREhrG0qAZA~w# zqcLq(8Fukph0|zNp@-KiQ0-T>Z+r@=eLSxn8OgwU=g1T<>1!Dn^hm5s1L+~S&|KP&>i zlBQ_J2o_T4l*tp9G`j*N^#)7yo7Gmud}im<*?h`}Fh_SS&^PA{$yhoEapESX&hw0& zk%i-n+jqQcwRf&}qddF75TAqTD7uJylk9yiac#pgiYGH7CLM^HU%$!Bhv7GFK@3dh z)9c_Ythlj1{?Sx6&Y5+p*ihe0-G(m$xY4iD#;r2bLTxozE9BLek+;%jU)Q&chN)fe zS2Q6!JD`6pxVUFAHxuZdYhvHFu04R|0D@hQGBfu&e7{NOx-Ru@Ygcyfwjg2!4jUNM zR7MZfzt#8puw1#H>AQwO3OQ$Qxg=A+Ak?r)_|}^;2Q8)_DK%`DF85k?-rT%tFFXU| z+dO|of_(}2s`S7jofi)V>Oj=kJ~&wp_(9{Z+^{<+!*WMIY6FhDvyS@l@-ipruu2rd%Vhuc3zCts+Ca(Y!ip2opz&S-&)0RS+4o%g@LDj~<4VR4QIU-@-jBo|l;%wZ?VD(kwusMk^_ zb#QppdBXfieYM?iUXnege%W$y3Ycj{m>}DRnrNN=eraq=gT#@?3tNs-hVbgt+yp=BaX47+L!*>?U|PQHpnLus!eMb%3!ja*y687;ZHZ<3td z(mE>Z$@%k*)5rf*-~T`=wGWd3Vov^t^#`B(`CmS3t+#%@|M?gndH-WpoDx9%x)t*k zkotc+YCYVz|6pT1kOt;)oGT8BgQ+Zd!!tX>!_8AS81llCc#qr(PBD{DLGzk>gXlV& zPW0hoLiFU*F{T)Jr3RW!i{&O1i+XVyfy;#Bpem9+==P#Cf!OJ~3XdE+f)E+6&?sTq z)Ks!SHX3DbFma%25_5EB{bYnubJZE1p24eE1H}{N%b2@iS}=b|>|$I{*7&hHh|%vF znyAOf1*oG%9inMJdlNyZmS~inp+Qy?FLZ{AO^DS=)ZiTRHsaMZe%!@@hHNi%Y?YBT z*z}oM9TPvdEbmZX?x;!>H3?5fZAn2EksNua1(A2QQVzUBCMG4Ts#y_AOn`Na1%&1u zN#D0iw|>=7%SPA*DC6u!`BFGD@@5|eoXSPCWf?LGgHpRm1}d@&V2Gyux&Td7i!KQH zuz0MqT0*vgS!x;G5>BV4-3c+F_oG%LLaeISzAqsB7GgV>pclFKbX0Z*Q9qq&VvHqj zHFaBc&0~CY)4?>WFb=2z!CPn-qIOfKMTR+1nJsw4rlNr0{dm&nR4BR0nJa^g$LTds z$y$C+-Qbbd0mx#HeM?B-l-_jLmrZMR=wV?>>|k|E&(I5gu7}3O+VpFhLNa89)}Y^r z(oH)psjF(EPaHtz&K>%ze&7ELVOPW7kVya%$S7KqXuIT;EZd80I;!X3W|yntn3L54 zNevh5KikID2XYxeOa_R1Mq$wV!?U3bP#Q2(YXv>*2hg#zWU(#~4e?Zs3hHOuHPWFVF_wF5d1 z8D#|ylvvZnKxA=$8&sxT9_s89;Z0zy|EE>VLX86+C zFD6R@sU<3?une-~r$l(`T46eA5lYaIYN?8tTA@8$8Fke2>jbWM^wlc*Vf%3jXc#<+Y7oUkO^606BX5i7hjSqsjB?JN zF~}t)#09Zkr?(dF#%RlD9)4_A?NA-x4H%1{b;Q_TpE^h9g0*9am_~Kkf0u5 z)@l=sV)jXtSI@RgK-wh&A|SGE_M0=aQm|&hKjHaQ;;I~rbBsib8(*%u;$yV>o#5gF zmYzB>=3I|^^Eej(Yr98;8wI**t=r}%#%)UM7YCCCQfj`PE2044Qaf+bXG8F?p^T}u z1y)z5S3O+ia?~ESGJbQdzjTvC$^v6K`&Dxb+0&!C#UgQkOK*L zH_>;voc<1+xqqzXYMM3l$^z{j$e}fEn2B@^hg8FyCJ7c*Kp4lJusI&hg3NbEd94N1fx7?V}U@bLVh>zq4~f{p&|B4$S-Gla8r++&Ou^ z{o=SIe#7f$FK8s#xg*q(wU9m-&0KMa4P8Y$#Clx*x+$Q*r8O`}V)X>Gmykt}9RJ=7 zi{5!ux37#M1%y5^uMH#GqM+?GEQ&pDnw%UV!3l=60@o#0emcF^T5ms?B@8=*0l;mP z#B4!VCP_ZCt$s3yr=z0WhBL~UvUyN7QA&w3k4}2GKO@hkAZjhL!BQoQy$8i{iJpv6 z5l8J*WUU+ybaKEvT_)k(xMhye4e3e;7nNsVJHWeEN>r7w9mm5-Rk-AZX6djL@PNZ! zQ?v^cC7efc21WvLkxiNvAy2hl3(dK_LQ=SgSbA`SJjB@VCJ+yIbHB8rL!4+ly{Zz` zh7Of50aX{3*M?eSf>yZL;DXe(mSeXf3dt%Dk$L4n<+1NPBdVSJ`q6bc!TwIsC!-G<|KuWq27R+vF^36-c}WhQ^lMY?Xv+ zn$!W(LK7>8x+ur{7*vj{B|I}{4b7T=iQ&*?)R7WOk_n2eXKcvyid=29NUkS>YP}M_S95W$tHwddYvTW9OJr^av!y? zwD`j`ilHXxswS67KgvfLa9R1VpIE~sd8OpKx8vlxJf<5sx*M0|Sw6oO)r_K|jdx5L z7=&Fb>X?Ii$T+yw!qi7z;uzI}p&-JnP8UQCgN}_pD}LBr=}%wjCmqzAzSRr`yvsG8IGrL;l(qM30+M&Lg)f16GOYQ>a4WkWE|Qt zi*D4m>d<1NHs?fr^5S6UWbg1GEQvW+i%lEcgG`)}o&x*iZVd!@MHmjb8Hk7|f@R{z z1ZW8#En!MVmZu+vj)iY|mxRu?Owl;-+sM)Dm-dV>MRjH=JBn7l^crT4aSjLIyIcko znGhvBX4XS+4CNEXBkCVL6Js^`{_UEd-CTkzG=ph6F696fe4s+BCSB$&#P`j(4w8#( z&LPcS;!Yp2?p=cfYNZ&Lc~!N%QVxFWM##fZ5OAGXiV%$9E$K$Fk}#)0m^oih7M%|9 zHk*JWYyr>^AQ2gOF!Z|;UcMWyt*s?athpKNYy~#u35ef|TR8~oZq~#mm7ye^pu4;~ z^6Ubr6vbq67(Bs>rY1u2pL#t#3d3`;MzJN6uV!DeJoz=*kEW_v#q#nW76_*4p zSk|G|-eU-^z%8)`E}+W{84pj#xwO1u|2mY@n6&%UqE#|+uh308%(y9J+3HsHZkGHr zx3Ut!)N~M{ilgl6T>&s#f$5CdNCL#qo1=M}Iwy768YT>0-(#S4GjIytFx9fNt9! zksiOj(v5sY?Z=0Q`fzJ_2Wa%AqTiEgQj0dC+8|cMr8Z}f2YdT|7f$knf$XZ+bz>vo|uk`?{-% zqvjl;!3VOvE1GAX;0X>cvm;KOs>EM02Cub^zPeZj=hyk!z@QN3OpPb6u@;6lrW@a2 zN-&RxNOKW;$x*EVdZShh+x+eVgU?Q;MsZO(DsdD9<}J;fK|uTUq^%e%hDT`oxwn&$yVDo^%oYTfCO9#A80L z#7la@ML+?pU&42Oj7PhEjz9DZG!4}+;0M3ZH@Nzp{%v2YX^EHWmwlBxuX6K>7;gQF zewkMeRC5Qac>t<;8LHY|Ko`-!&1)BU`nP_q&JFWQedot4lQgCH#;>j%uwDtck}Qu` zl1pzlKSZGFoou3ba5Rm#2Kw*T9Jw`$^DUlU0n>F+iuWsi^)f#lXbcj$hyONwj-PD}|-c115hS;CLAN_W(v%f2|(Wc^>*UZ#Pc|Nc~goOLe3NtAK zZOvYLu$Gg9f$Qc(n%!$)h7-;rm3vGv6b=ZirAAw_#aTBN)$0(pM+jkXDY#-UGiRG%=P!z*Y$b}x<@C(0XJJnS15_71`8%6p1a5@IDmDr9s%Q|;Drt{;7Wc9 z-sc3bmMSMUW9t1kq+!aVPXSD0NZ(u9oglhZKSXgd4J1Qi>TB;%S87BF* zLz)jNt6-$)eWxPV1|FPnj>7MMcUUCQt+Fn%%Pt!pv~FLx>QDA(Fn+Q;wkB>1R# zXX1EcnusB4;b?=?IdmdVrfF&}iUfUfPSPe_R)z@iA3iyW(0~A9d`UpDij~!Y%$Vd>4!*T7&@}D zBjEe2kLV)Y39vj83dT5iG3aqJ1~QPy30>}mL8{Zq8FMVWn}jGmOh|h@wKMv%{vrdG ziRl*7*C@d~t8YTt9WTx!08zUp%{)Z1t}#Y)=Y;@{QK(7a>YU$4Js6QGaQZJat1CGz*F4QoQ8C3 ztL>_FtG&LgRiZ962~bFvTE{R`&p-H$gX6++W(Hi<5$Q3fC$bXAo#~8^WuLzY&~qZ z{P^z=)<6F_{>R7o$oL<$;?2vbz1DuHV}IPg*KS3vUvIR3wejHB<=7uPuS|Bp2Qj67Kzn zV;Dp3JsrmrCAoVKk$`eUdY zeHyp3C6a|2AswB8gye+fL2!Sxh25rcueel_m*EBpOgbh7^+pl4;t{a!*HI7ezMLB~ zA#_GIQ~g$S2f7%nK7!T%j)u9~dbuga^0Wi7^>+?;J9Pse6vPgnclQsscMtaV8$zT6 z(2jBZTal`|ee|@uEh=uh1&hoUdmJvNhCuCou|*0Ewfg$Es=w0G5QP{tiib`?b9JhO zdQTeFa9v4PTWUpBRacNaE{&oY>GEPc2L9%WmH|s)629&NRJR}R)B*b}xSEWGx^;V3 z&T$mL$7y&m{6nmbaRIlPQTVzGDCgm}y`%U6&Ca>O zvs2MElvX8GsU6QEh!#&33W!sK;Z<-5xKDcYSCPviK(>Ck82ej!+2r$u~4%37q7IV#H1 zVv>zGhNxns(e4pqw-Bq&dkwG&2H)f{I&K15wXO;4t8s7H*j}LK32iSBW<-{wx;43; zsJ@^Txs!5=vIuf^(wlm0}l&T=@}Sc_qbWmrxuLf+M5;BW$oJXxq&e=G7!O%(LfE119Ie1qCl(& zg-k@PP1~6&5UKKu`HCSzv=tfvTcf~p9ubP~F@%Jif_0FNAM4t|Iato%(YQ4WO75XP ztlAuKwDjPdZNZ^Zs7-M4OucuGy!v?vWW$SN1~Pn?B=!(spmWAfvNXog z*d5OgwloeR9m7icY?mMffO^YeE7(h00mdO3%qyCF(m6g+yT2jShmL-8U7LJCOp9sS z4;V&{t_cUzcOw8p0^PXA*phM-+@~ibVFEm34Xa{7?F{MH{>>PEr zPdZ&Vx_E+3XDE2Y^Mf56+vZZ0HX11}8EvsD>jR^rW?uyYn72&^Y2akV@=ykS7%PTE z-!6%08|;~t2mlXcBM>Z^h+p1(94iO#SPjg~?wN|Y!Sd_rGov8h@~F8PaobTYss~J1 zOJpe1*BAO6)%J_D4lroir9NQ$!yMGrX9;kPp`%bj9tXiJW|NOVy=eM(qk;`}8AH?R zoW+!D1F+QxvObXw7sE{!8D45TtKu0GFu%kteIbV(m@N%Oqm-ViSgg09nb9!j>>Y;< zA%-%*ej9M}eB9osWU!;VqZaqr7I#Q(hmWvwkh!f>)npMOGb0T3=ljs>>A+Dk;0cCO|F2Y%gJ;g!*JuH zE2g-LuW1tV*;g@>%!;s!ihp2reNL;N<>ygAj; zGHmbo>pDK+v(!_Y=%l^2$JNzMe?LRLEoaplVTuQD6<|xl@>N+dGNZ;iI6OG&>>uvX z`f&#c4OL{imal=uOj#(6`~5P?oqR(__-p(1GMH5t=7Ns4y4bMKkygIyve`KlId4X^ z#?L32ItcC#H1Znhanxtz7*K}n*BY6N!UVEXZ98`N3|95^(Ad%*p8inRT=?tn5Yxb& zE2S$UY~iIk$~+USU^&e*5;-CME5iuCh2JywK`oet%-ufvI4*KYSDH=+t&}dZUiiYWn>+9Vo22)RQp_f2pr;S>6D*EKqeT z{{D4xy@@ghSZ}~{c3~g^9}Qqx#>X1u!lgu0cYPSU&%;wuZ*d6jagalj1ya^j(?z4O zLxbD^mE76h-#1o>_Ur;1#FTFR&FKcF=SI7Gtc4TBAb@mFgtgH$eX+XB2{>SS{bu_} z)z-Aj=z!<6C4@7-q<@A)r6UuIwt@#M?BFyBDL!W&Fz*UFYQP>)oBF9fl%x*do#^|6 zR9k%NLEs3$+1m)z3jan~4?qBh0{IXa7%u|13qB){sDpnNE^-_fHok)aI9`k2z(Dq` zom?19B`Ymm`^EEbyxIbsAw9JMG1fs@TNIZ;$jVTfJqR+YSzr`bViZ)#AI3Y60WEqu zyLJ!()<@f~%;t=407;I}>q9co-A$)Mc)cN>z`k=Lu!$YacwX72u^6N`q#xzjWIC$2 zItAj(csQcC$6!{-*+0YP=6LrU(n~v+7pL?Ggr6!=k_VIJo`U=$z6P@$p>ofiE1ar3 zFYvj=D-qQ<_FLxn&DL#)xPJc_F%m#|+Y7i?Z*cI=b=M8T*Fa6s`Gj4FB`Q4G-aqba z=wByCFFIaxl|aDu4XK2ha+g zkUbj@_jbV>$~^cxzHNh#yx3RF-8pBy=x4$;*`!r)XyF8s#fJ{6>TMRM*Ryw;$7kG@ zf~*zwsyLg--O;qF4tKOFSs*z^HH4cHfnZM>RUFpj@3c~?q$vXv6L0sJI1`xv28rG< zjb0VY;?fIR7sfAA*E<-d@yNB(h~fcg<=>oV6dqnPYT8l+E;qUZq4;!bL#~VE|8Q9S5_vgs(Pdj>cocj&&q@)}0u zlEc?Hk|%RoDkIQkTxJ$SXMhB+rJ#0s#ahWw{8cMjLXxAh&LxN-Jm!VCJY;ahZ{*WT zTwE1fsO|RB*I;S(Z2MajXO6yZ_!`H-5Y0x^3?MOCoc0~VGk0qXBnGoNMIS*81k@+8 z-d*m;HHYNvoK>t?Wh>n->Mo>TNusVGg32TSIBDxRL&t%E-1V92Px{I|o;^=uf}mjSg$D=oQ?VI~DHQ@T$hvWCq;N%m zb+6&VREZdfhIU5<+z(4wSlX7E zDS>+bNfVp$1U!GqV7R4$z{4`zrYAFB3L{glpsk;O=#>TKfaQ`;@}#9g(5P+PYv6sU z_slhOQUw-1Ow^~kEot(}g8c2eunmWN>80xtn4^-q#~} zJGb!>VqRrrB1vGaf*3}Q!Iiw1C2O?S%?Ev9GLd^(lNXX zLg=#|R&$=ZeLlg`tzjo~np=#1%+<)tS(Y^CGtL(Hl+PEQ#GG3?bvAyOtIkE(T{e_B zkH>HiK8wXgJXKzr8$iuXsoC4qWDW{!vTeJyiFOe? z^rmd6iNT+e8H`XN8EnGc!bl7OL4-`c3I;UGFCnj}yclGoKE@Rhu26Pcwd9YsHAG|E zoJ;lovfZRmW2mMR-k&YhE6XSCh6t{%YFvWlXwuT!4SdvwM{W7YX8&?_twOZzT_u!F zX#PXcn8f{loyMfF!;jkwV!?~YZiRe$I&7S>eUOGq=Jt zy-*dxh4(uL8ztWnp)q3Y1y_URQIam}IT+I6k&Fq&&UG|G96txgqOdhi>yyTOz-iZ= zgP5a&SVRULzhK7$UKBtv;|X}H&G1N^y$xa1atGJ33Y2U+&P-ZmE3U3G*kr0a%W!Hz zKv*=t70itqQffEakervZyrFe31$5fZ6ptuTo&M+|}f9zsskL2Xj`!EO=l&OHyRuk&X3; z!n%%GYOtmA_wrVh4n?|)(aEeQXB?mtBk2RFdG*CIn6SV4V#{n;K5nztCe0>mZ_==B ziy35c*aC#om1smFxrDpgjvNfDK`S8^+bs3p1>8_3$zWJ^D0-0|jwjy!Bnar=3Hd^_ z*9tt#)|?w(^_x`gic7>_hGeYIJnW9T&-M;p9G4X9e0AWNJCt>8l3Bugi~{ebFh@3= z&pNnQY*L~SfSFEd-cHd96c_G@?H6W3VaSRT+|bOs8AzGR9}$@sT;2_4u*j%Y^Ycet zab%dSFZs0)Vmuy}G2_xz=Lc4G`(W3bxmLa4;4c?|^5IdS1>|ZMZer)~U}yUzumtiN z@{-qpufa^7^^ERMUZEGr@;o^fCk>37`Gs7WMe`T?;+Ns4?E6Dm7r76)B?P~DNr~zm zqBjE=A!%c=x+OQSEMF8sf=Bxe(8X9FwcHpgyi_QF>ve*lS29*%m9*@{aP{Q=HfoHZ zw}C08CIMbvMD}iks&e#$k2Cs$Mqj+k=qq=Lxv{pLBYAF@bk&|#-qBElctpBr>PUuN z@qlFyIpJCCH|E4Oso=Z-Xh4_0stmZ>jiz&&%1h%id*mOyB*3|vDd*nUnOMN!p*@?_ zEc>J;K=TQPh9&lgF^@R;&8erht>76(WX!Lpp3bR91kbOhp3bQUq_JF2J)PIzVQ7Bp z>705e7zf4^Z^WnHWD_h{KQv)(}`TyK3&z5SDNz5SE<{p|<(gUi}^^`2Jr zH*cIzEBdRbw>W#E&YlrO?FxGsr-=ea40bHf?%%jI24MOq^DBT&efaW zQ^@sDx|UmYIL3g%=#eZt=y020jsaeNL)lM?;8XI&B)&FUX2+wCy`DHOi1kWmw>x?$ z#vT&Po^5~I-8(oz=RVaNI_|lCeQtOyfZlL($%ba?Ws^ygkCo^FnhIPQ0Qls>gnybf zaJ@dI!P^&*0`Xl3?k&GvdM}s_xC}Z*T`WXb%D#jIvE!4_vkF8;V0Gpkj`8}MfU#uW^_{2W3w&6xIn}{1dxPAgNWGI3rrT6xqK=kwD?(@!3_sRZ?L!pP@&gV=C@j>g?~q->6C>rNCfXV_7Wez$ebU4mP7I`nR6)^|*HQgVHXZfpJNS!m zEEN+ij)LLonQI4+x)LYNSkETOII0~U?RJiUm#qPDz0RhZZBvuTVH(qm9GZdzWB^on zptT@CMOoTvYVoP5<)Nk)aGF|TX=)Lq$@N&g<6j4zCd(T732@-V)i;?-=f53YV*7ww zJv=ha96sJVP+ykb@-QLWnKOFQ{{CncvQ4e%)ZHEECoiC-=q***6w!2rppEf#75i&r z*I`UuEjzz#h|t4+kj|{R-2_J9mT&F~FY54SMMiXV8-n=jN}6Ct)`T0ep8nb_L>{*o z*L<%FdF7)UazEQ1_k;XPWoz@eNdJHcU@8YZ+ixY@-_4Ar!)@HqBqZF(B1W7QQ@E+$ zLM13}9y+A5rTL*Vg3B0+r(Csx7mG+7u6@I>bu${77a^{Kj4T%JEeNBkfVUNcT=-`6 zvJ$-)zd@@Q!{T==m-3F~vR#c}?#_&H(IT-1h@xwo&zv8 zp%jVJn5CNt({4oD&-dOX8^|z&WFVmgA@Uh;UvAP6oP(D&WPk7RoTMR`Nb1xR8>cZp zb2an*Qy}4_2bx@0rA92J<~r&;-8()x`mN2)Rhfp4da#+C!d>hWGppD^J zZC-SfPFQA9)%zC8Y5O}TqiZ?os+YN$Ypy#r_rrFU1;qJ8`53Z2WTnK4@>k0R-2ihN znwek{*Zr1Hc5D_qZ6`3o#OFE#@9KSL3Z?|7=xym-;1!E7C?{C7dloGwD)y{Q-HLZe z6YUFY=Syym7TR}oj&=zKf*U7b-|woQ7GG8Q709GF7^TNkH&wlf|H{Se!b_S?!G8e? zbv4KaEx*7{s!8c(8;7#|hik6T4-af%Y#}GYi$BXhzAStIK*1!k!LD=)a z8O(G0ffd(^WU6Y23LV*}zy+QA)U*O(#7_^%_ss=sQEmEp?tv zimqbqxuE{(mK|bQ(Ag0K)u+`Btb4nZN zhZ+(Osv$WIwv|rDIW+>`s%xhe>j1Qe>k}0Umaucyzh=*SUys$N%^K}%aSsykz>M=+ z^{5AP+kwsC9pCJejlT?gNJd-%0*kSGs@TCBQBL`51S%K}lQ0bd9LF6{+64#GZkR=~M`qmy5FQHxY3y9z>eII9RAe;qyRO8+O)1DPq0EAJkREmMYb#PK}+QrfgdT?*e zXsCpi_vQH9_H{x&H;Fvrz}KDMcE372{8~YJ`FwfPWBkvv?DZhT?b9~BtJ6P}+r3NQ zp#cCZCaA}4_+t$sWUHgDMnkPJV^KphxoHZgV6BLi5YO-5%EcOiqG+mCrmsYEm|7jj zdAD&#PsA+XBz|*7X&AzamdYmg15K>9JrtK1zFOvTEmBzsAaf3ZhA=*)&MAOd0M$dm zp+H2ub&-q2mo~lP+z?Xo5DgzW`64XO3V=UGo!aUnduF{+hiX zdA)OZq}}b*GTJi$%d(^?co43z+ylM|%lwgz%eIfdhQQAipQpXq^c~;)-OE5!u$-Me80Xdrka=LiW^NK4Is?HBWh@)bi!?_D??#nA)%VLoK27; z`C#aVt9&{g48D74^55De*Igm31%SSS?r{uGFgeIvv8f=9H}YmcyZSUSOqNa@8U_5aGyx9kk2lYA;Q}>cy)R^WFyeRD0gk z37ug*8V)uJZb85s(H&+iS;hMyl%ZR?0K!m8$xY)HsnH>seAj-s&UwuT<7tuC;jWAt zdK4)(BQN?&<`P`b0K~dFRc@kpL^j}`4J3$;m;~$wB0#0+%yBM2VmBGo&Dq1tycRM5Epbl8K8A5TGK@1cv9#m zWcwy;PN{PHR%_j_oG0k>AFS;m5sKJ@(<-`y0=K3iI3{d#ODmZ20{oCplL0spm>IuX zTU%SUdDY)r!4Oijx9!1+N`b8zign2gIDCkES)to87a(6oEez%%^zQ3A{|Cmy&)$fv zLM9eI?`A{`M0%K8B^?x`Pq0z$i7e!E2D}nh^7t&V(YJFpXw+G#gMEE36xjYd!jNJT z_mWffZG%ecbgm^04?tsO#l5h=$s?E^Y1D>e!r+bFf_!xiSW}$GY4nPbd6}MJBe@7~ zT%l&dL2y;6)HlnigHygvl5upFIWg(VKDGgPeP1YCu4z6iQ)7nA)igfoSvwm}?hw5+ zo#nDXzizY$jYQ)739jvW{b5PS%1!<-WY#i$B$B4CF)0!tOMLu+(pe(Y=d9Zb;u zW8Z4?E?;oh7x6G%s6QyEPTgtxx@Jxin;lj*y|WBv6V9VzxiJ$Zqc1f!?nLqq4An7k z=D7&IIB>pD%lm2nQEg`29l7`w*Gm=wIjVr=Z!C3VzsEs2w)%@Rxn5Eso54 z{lFG6b}Xihd14E(w$K#e-&`P<)5@J`<#JlNGp*bid+v@sFAXd&4=ncvmiq%UM+&`X zj)Pv3C=358#t1Z~4KfnL8{pZK{IQE~k;?2vbz1IG9Z0$eWQR}mf)~`1n zepa^sBre-nfxe5ar=rd!V^4J&R2q8$nRFq(|L%L(tmd0J-EDZja8+x4h|?aRJhM)p|M{?wXhFwzIy2k!po>5yRC- z5bvRn0hag84?&>Ey`yAQ7X{VShFxeJ#;NJxfQ|5t(hkt}v6%qjL;nK`pL^16cURO~5Lsf^~m>6f_#=NV^<`O_9Df z#aK^jVhQ-IUZ=hDNtQy;{d%%?wiflLC<`i~aCnx+qXz6;*kIyR4ePg?Ruf2RA?#I& ze`y5DAxuKS>OjTEl8zArs{R!la7q<-!VWDT8--Nx&sc43#J+mDL zLY0lN4`tc>0AFCYoQ-pE-+^?EptMp<515lLK;Se1p2+3Af? z<1!T*DA3x}Rs<7k+Y6Vz!!FJpF%B+E)UQ?9oK!oB-oLQBh8}=+X@FVPMML@Ww@fd&9%LJC|*UjQZUzTWiv_bYB0fCOK zl80$OV7KHSd*u9EX*Q$7Dve3us7GBF)Ly+)%U-wUU{8z;2hY^|W(3hkyu+f=&{rYO zL4h4>RRt%-gET`!N<^P}how;1(H=N1UhhHJfr}v!Ip+jbP*h)(XslqTUaYjhBc2H) zV=`7-#chBgP#$eXDak-p{en4mG$ZLQ!8D^>J8aO z%_K7xUebyI5Zjvl3wZ1(ia3QtUA>Wr@jX&IWNnz6beI4RvZz**uWfy|^Ri|MrBGU_ zx2uALdX~@LTT;?RwVj$nVgo(mIXl5&DO#srG^&PR%8AFb24%~;uS!F$m-<5X?8~SI zO3IodBsE2i%ybl}54)(j9QLuQqwLeuASKJ*?(yF5IstDTShcP`guUgX<$BeTH z`Lwh*>5^7BWK|pV5prc>Kq!y94Xe8Cnp6poF7xHAnGN$UHbLE7t9YChhc3hWdK%$o z1pg{X>hO@=W;Zevvkp|!1|D{zxZ0~EYGLHGP~JM4d9x3h`%#ob zQ^q-6OiNwxenHeuwPo=_ZKdV5EbZX23WbS2>+a~14dyy+XWF#Ww&Sj2uqQ>OOo~*L z2;9p%LEhZX-Yzo7{pAhk_dv}VIy;Zm39cyI>9xGQlRZ0)nnH6ANEWr8) zWXN~eYe7lU>@)!?kIB)G1DwiTb7}Tyx#6(StW&VuiMiAqcH{BTdN3ElN*KOqD_h!x zLV(18%8yJiWz5&kWEksFwKD(X^7)S7XGFH!LS>@Fv$C)^o7-~(I?5RV$0lbbM{V9| zDrE4)l2ZT?EhUl^M@Pmcy!0Afl!Ot0AcqwPmX=PFLJvsL{ed~81ko=!T5;FL%c^wP zLX(4;thz*V(zN}!^-dpDo?l;_W+Qbbb*_@$6c-)h%3)kt#JFSv#on!hEegEH+HykR ztH!NcsHs)oq~C;F40C&oi{`l3xJC8WA-?Ch2XY~5I>&{L^xN=iL$GmGS^d$q>+oIG zQjeAVc@bZs^a%AEUc80zB*7}$2%Tl|vG#Jo=Ad)g2*(~hKH1)}_Q#CeP!@70#gq6V zU%{WlysLz3@RPn1eY1T8f!w~@K30DkI7zQ@zrov8Z5(tuyVQy>E2GbxZrK7;PYrrC z&NDnBwy( z@J4~`X;(g{#iv+&s=!JMg7EPH;gpQ(PSk5Rb%RVXYv_kgY6YhDPF9QV$@boU`6o}wm6O^`#`;s8 z_R*^}nHH0Hv@E-5P=ibfm|(*0vbuD@Xe{QGgyB`T+T%_WzA z8j0*3Lm}4m?28@u1&&MZH5|lgGqO?A$BoAP8a=GB6RJ_oz(YXts_|brv>0 z|GL2=I+a^#!QS)A?(;?aKXRoXG!;$=<9jQumD5e}Qm_4Hbt-EWhtxKhED?fh=@pUrCnMEZX38V zlxu7{uxdV{w_>@6zk|F(Vie^pOd>7i;r8z1!^3@vj=a;f&p3xCwFQyDMGgFg8A*nsiq^b8B2(DBvj^1@?L(0uXyo9+D#@A?Q)7b9=j?*5ZflZMoujujSV~n|{j&=^_Dr;$gJpzEWOH?5q43vl)0f&hZl;cxyHGxfn zH#3V)TF<%s`1w)CJTA@QzF1lCsLB+BG|8rC=YouIQ%+{?nMa7$qfIfP4eWW4nkhkg z4q$o{Px|^YIT-3+q!SF_}GRdRn^#?2i%@)?EK0+efdI2&B|o-4pe|>?qi&(OLCq z;MK$Kt%kNgVDlVYW>QNCeIsOM0Z{Th8b+scV020>$V|}BA%&ixIiuZZB|7zB!`XHs zN*%ONk30K^$1jdL{^n8#Ml<@s=V&GWI2L`Y(#$H272&7j#;*$-0t;4hawwhrK+a%4 zz^+oI)i*1c(8mZLEm!&w42J6IhnEhIrDcm2^Bwvq1)jk^eRlXwCy1~mN3*{YD;7C&T2MN~dws&q+v$MmJ4XqLmjM)NgR z5_PpLl?KUai6$&U2X4MSjP9hA1Js&%>eUCT@De5dUraHp2zKZE06OeEP=f)5ZS?lt zbgAeE>8Y!FA(f14&ZM;u1foKwN7G2gd6X(lnqHF?uWsJS_XW!Xs+1nAdF1eCz@D*k zrPp}r#;waqd0r|6F!#+(YhTtXhjxaR9`mh?`2wf+dYt8RGjx|tlFd|wT_0V11Z{|o z{T7fb--68QBr1)0J>3XBx?5@KHEx=@LGXgH^l#(wyM|o>nz^R*Jh(T%dxcobn?1>e(6TrfG9dFBWX z8n_N#o=MuS0Y!b)sz@e~c7M=89hH9R>xsx`54Z^u-%d$rK}uG&+JIxa% z#%QEqyMStf`>uW+2#XS715_3kw`j>MjG>7mRos*D>mW-;c|h37KoxKy@I5_%M%NX( ztDn>Kb(*~~3hbegOZ=+j4H6*W%mDa=`=y?ZL)&!H=WVi!3cb_Pmc6qJmSW-8nR$7y z3pyjB&iO}bQ%WCGuMFy^84Ei%`&kq4D*{rC#H9ZReCydBMf_U1UOj8r$vKAL$Y>gS_KF#6( z+FM?`+RZJwQMhOJWgEvx&s5)CTXN72t}dfi%Y18FE>AEE zV~AmaBH$PUo61{wuNc1;7zKld9%?*}RQ*>g4H8psFMxsLR_O_knSTRt^pdHDzUdYj z2Ooi|ci?ryShygF$8DIHc8|l@EjlZ^B9(6@nGQS=m={EuR%O9gEW#Uhf#9fV{~J7D6cJ zqIClt){T71xm`b{7Sw<3Mwwzs1KqgapJ&T4|c2b?wIGI6=A z5%Ejbh4uRiZAQsP*l{p2`S`4$BaAUOHHfSQGj!9`jF{*6V$9J?*38^UAn?bh{S5*u zH4L3MBLL0jlAl}sDY^Kom%*q)kYQl;kt%{ldeZjI#`Z`f!g92El+1*ICD9t)3S8~b zeLj(Sq}u#a$Z)qE>p1b0f#YRAI7@rwzuTJqWcf1#V%ZP=(08Y9&eg*oHj@ zG&*V9@4vL?{a?ptUi^m-kpOy5{^$1kgH}2JSL^5a45)_OVm!}j!QI2y*2YvICmN+&}-- z&!5l#kMVKN|BQn_-TxJw{-520|KsU@|FezOgYxNrjG9AGPk>Y#5di^LtZV>s>&;_9 zCB+XH<9AH_ncX}N)VqdwI`bb~Bz`ca8$^K`$CEsn{G_3wrfGi)fDOcp5)b|`%s7J7 z`@1o9;M`iBBt0e1O78G|eV3NVs1+~>?Nhg zcgK_Da+r}TA-eXdr>dn0jms{xQCti$^+w1iS9^AH$Y9HkbDg8+9Kqqss@#hg=vR( zALVwV{{JrB)Ce#`U-wd5u-oI`9-M4{yHR?6^y0u7j@5_g!IV@fGyomq7$RPg$}56m z=58-=DaS2sanq&rKe*7WD(a%Hs7oPJD$-=If*RtKQDLxPL-jvhy-;Wt>$|oZb-q10 z+U}zFnu&_RDlaI}rRYMy(LLM#7A~ufO|UFfeZ7fubR<%HZ!pT~kWB%A!*#n@bFy>(~~>gQ%q8((jVZE5-< z9w8!<3oq9sWWbd>`ReHKH&!u9ZEP-;B1i0tR&3NXJravuPt}B1AC2R5*t1qAcKx9z zw^G0f7e1mL^OR^ya;2c!`F8K5`(%4>|HV;9ARP-ryO8NYiE5zP#?+ra6rbZt44Q4j(&?V??*q7 z^jg0=XkgL^ilN*n=4Jp6O{^DxBl|>0GhtG|@EU)0nLHqwQtOl##ExY~Zecukh^XD%I{6=6wk66~Nxv zn+s{Xp;Tjm)3kEZT!yAiOi5EWZLN>YteI^wi?u1vZ^MG%5EzNv6J4Fh-Esg6(eSEf z(ku|p)QMP)ZuUS-dG}erVz%I(Li{6Ks$m`_Dfp zO|V0DZD1!C0mH$W|=kP{1WCqw8XN_yux%7$a;(&&71}y4)_@(v*)>YB~MGH z$5u1^1)oMMD|~0}E;g`Rp-{BQ0s&jsG`HWDGnd(_OcYj;rRvTdhjY_pd0b5T!@;0S zqQq7NA%^9W+VCW{WN+9F7iPk4Z)csvHJB^`#}5n{{54PA7)$WS!kuf7nLcE=1FJSL z)n}-y>L$)7$qhPO%qG~NQJ{QjKoFlozTBa?k`@shZCmq23R)^k7N+T5wRU&GP(xqXoh=Czep4l#Tf&2o5PE;{Fd)wUFc+ zQVKTb`W?hQke5W-OMN`2gW(lcN3&iNZv|d+T)FciJ{9(P)Hk3@Gg5Ua3?T(rW-#%eSng;Lm@toK#KO!1{aZs^FmO<*6 zTFr}VH3_Qa$k(ZQ2Jw$*$g5(=XyAz!V4$~B%;Y3CrXIOOByFreD?*IHo*mjxPj?JT zF<@oPJ{Xj+@W7Or(JR&NvYVYw#^-}N6pxRsON!E%)qJy1Gg?K{PT6EbM(=~+Ddbsk zB7Y*(Rw7L&bYuJ%qGVX|2&%HS4iD3N)DIY)-Oug(Otnt>~&GqBB3_B6NmDN)&FGD-NVc>VO(bWTJ)| z{s~X|ni5$mCf6XJoIDHPN24K>Fi+GXL~)@_4k07Z#pyLGZYVVU$ul$tZ&(V1Vx&E{ zq1ePfwv9zt*&eL8Xb6Kv$3~NSq^#IjTfzAdV*S8Tf;whASZt!bxQJdsrDd`3V}Ubc z#Z+PFW<_FG8}7P;qY(S~cqU*Kwr)64ZAqrJ6?p7Ht~w4Rk?RD2W{2l?W@_r1nK+Bc z8G^0xP`P0&)6_n)i3g;jfx=K@{&IbjqsFed2gu^|y((8{&VuAMk_j+cBeKU(Y6HvR z1$h5Fo{)G10WL6Aqpyv$EUTgl%vd%WQZ)p@bW8x+5X!MM!A|(BmlV;31K1Qs9JV4< z;NvwnX)#J>i@btnLs*m)F)sk@uXNRAxh8~6Gx53yDGcv8u?bfnjf~7zoqhx71%ZVr z+H4@)zJe&4*+RGhnQ6?|?CAZNL(m=8;JTiCs+VykTR9Gfikgl4hJC&*k6sZ}ky#?4 z;$|w2?XE;7mMP0Va2`C0INY^lgRG;NVbB7l97QHdUpNrv2z*OVWpjk?N4thWj&q5iT6 zL(M26Oc*94<^PMBroO|^^=HCPIthIR!o32H3 zh|=K3`JfW&d!qL&0u@AfQ`Zoon+nKtkbWk%&OxgiB1AxzPC-j}7c?H^{0G-Py*0S+ zXgIM}Sn87JN=f2om7mUJaSdXH8_vPv*l+hb`@5Th0L!T;M!jT5pBkjLjqF%D9+0-7 zi3u5vmSk;aGe8J9LU_{-75qf`2p5GJ?Ud9ui;=5bmZQ#zSrwT_huNgy>CQ0ZM7CN_ zp@|=Gsm8?sRT@C&%&n`RT4yHGutv*_PzVsE-7|50pv=-O2yc2kq446+#+w*OU6ZsO zJ~^r03`PMbdcdRFVnAsLmu%o>^p3?@=3>X2n>^r(%MxTOFLb0SgeeW3>&sodFYk`< z&OhXb7iR`DNDg_ zLdi^9R6N?U7YW+*MIJ)N@}gAEQWWpTVJ8aRIf#H&ZufP!UC3nPK6&)$exu=>dcivt zVWng*W&pA@8hYdA7!x9?mAfs#)SQVi5+O!{^cnq8IW!R`vM>97*;y0aDJdHRmOImO zAOhEFLXg<)$r%eOb$n_}7iRfL3eytd^oK|ZWF(s^+)U&=Eq}vm1ATp{DG3b2>SE^gd#Y?-8wLl;t-(N5N^x` zBlw!n!Y$~?42H$Bt7JJby-J+w5A^n9H@^VN7QlDR{r9dI3Gm zh1z06)s`P`QHbY;olN@fEzw2sAuBoNuBH$w!iqnpH%hT#p~-{@=V$0o*iMj5JlP>S zo`5bB^bAp)N3Q_T%YstQGRSnUL4A2x5@+K6^hnI8W+APxh$|s1QS%VKI%;Bf$*>Zx zm@ZU}$c7owXj-O{xwkucb?Z-uo0qO=_D$1ntcYBA?-9JEo&&W##on<(@Ej=I!Q;{P~4u%3B96|ctx11Ii zoL(gNue+Sh{~IF_zR4*Nr@ad^Z*Fwm19F1@!iWqysf6nKcZy(Uuj6xdP=E==A2c2H z4J8UlWL38jj*s`A9&DeyIO=@2{t_+~Rh1WA@|=n`;MZ??f(^c3`om4Vmc0*zHKaf& zV@@n*uHJBCDRyd~_X}F=3@F5IGvW*PGr%!U6*QuB$XgM?(`Zk?N+9~e)D`v|it8_i z@d$L*W|x}ids-un&EnJiyWvYQFnq><45#1fjmkWrOXoFKhtY;mwpl_v$M{|&!dT;g zrR?LiKdABkVN-qKNMJgfGvWwLpD-T{w8m@jBf#~HjbOp64~3gSlfP2D80=^;Ns@3! zfvx}1{Xb{=|9*(zAD_&P|8f7}gNJ4R-_L*c|NR&r&;OT#e|*ltKYn$u{UB<6w$XaH z@!;1#k^8R=_K`V}J~BVdN6@1-54g!1H&)YF=}Iqc-1?rGqdHNRhHHMm8j0t8D^^b% zcOi^O1Mc~G*DqF0 zv8vS&I{jMD0PcB-Rc@fKL5-VZ)T8iEcR}jATesG4nWGW-t(Y{Tm_SG>QoX7>w{Eqd zVt?pX*{Q04Qqiq8)WI@XM5~UppEDSb!CtcLpK+sZGP^c`0HN2>D=7jX%LjE~TOspR zzx$kwKdLyh&82dDkas_zLy=5wW}qJkS8{VxtmWO2*1}r$eB=_|@ z@MXG&lVgRBv4g=fa+Rl-pNJ#H-?5Jv#5FrbcZR#G`k7r5NCvA7HHHP=Av#H=$X3sFnSl_u+L8cJz9+ph zZC)g6a;Vr#1SjYildD4Oq^t19rqY9{ZD?Py7%f&IZ6S6ASWy&w#X}gS5ehEs(7+7Q zkOqI|pc_JvZwWXg4_8Dqu+>6%5DB({Ja z#&m6jp)de2XX@uAXp6NaDY|{b{^90d(d%UjIb}u!ZSbf}6Kne6rdP=6lF+tX$-ELs zS=9&>1vHnlkz<1Qp=~QQ_R|z*$s5;fsZ!vg_a4FwK-ixet3|S%YPkDdIbFD};ZINl z8>CL&lwp$+j^1`@qTHlFlFTL*07UF6O#xH6+u`GWgW+JD7F_`znB+KY9%x5T7ish8 zszVT~iLABDHKf&{nMf53(Uir))YB5}th~`&=jLI4Is&~>*3dXphO@bEv!mNGyFY*+ zP)wpniO@5qJJ2{OPX5IVO}0M zk|>*039kLldXp?GT##71bG~xZECzDsAr^zn4ZITqA6Ii21I=JOKRP@)Bv-@LN3R9L zGvFNLn#)qZ$K}^!@fri{l}hl_b@52YWcD5lj!i#?YcTOsln}ib7c5cI`eNH>(v3(w z7NhZo4pCI%iEP$B5k;W^c3hW571J4hL#Y_byyYN73j^zJ-1-NG`V*nTq(ON7MT^mt zYtWSWqcmca>y1sNvFWF}^lMZ4wG%ogSXcwP>Ei)P7c=S+(3{?}H1)mWe%AYjV>Sfq zYpiMdh^B^ojA1(cDPqM&XgMmRBP#<5yA?vSx)$5un%a>AU3qP0Mj=;las?cB=t>qw zgF}+Fcn+jE*w;QB>1uIK*$hn{Ys_{HV)-lhcNtyywKkkwT+#mgh?DB#8N{}h$a|ud zgH$e${8Woxoa+H=kl}Tg0xdK-v!iEw;9QS?;cZQ@3pN&0ewAscW-htb-`fDr+W~P}doUCGh zX*JZ(pTE#&j{f(9SOCn+|IsSv|9H^;`TqZ-d`kLXvH*DS?&&{1p!V0;2B4nz+|&D3 z+6RaWXGcfsqyphf{2e}K8xVEw`|8uORFOH8yLHv>YRkRmb~KWqUiaUxSH)Y%e#M>D z0vx`)DSJPa^~{!Tr1X_7EuaUjD!z~!GITAufRr7sHlLlYt~a0WtFAjoogpjUh=Vd$ z;0_bDxS1n!TWF;6bN-Nj1E1>i|LgQN_3c=)GZ*n|zJoezUXkHsRIgt(C@8kM?y)VG zUf!_-XheT>FNS1K_^f>fY8KTI#({6ELFRsg%?Jm&u13mVTQGdn4l0`6c2qOvR?Nf& z?}n=g1?sswgj`iF^2<3x5XPA~24hfsTfaVS+`0uepE!zXLtm0LBfVz3&iLW2Q+d?Y zQ>d(%t;?F{+_p0|c0XuBTJVUoj-~l9FOsx( zUC-F;l~nOPq7ASQSoN=i0G{=zoeXY4(WvYi8mA4XS{Ls(qqpt|Od*KS!9BV6q(uWQ zb8p=Wv>b^-*tA{#qyS&T{5%`=6>=&>KU;nDbjLgc<(qnr zk6HP?+u7b#3$4TAfZL>czp3v{=&rczxbMP9P13zWYRa3Q()bPRaeZ$)_b+_wr1v%5 zALukU8STfSC?&c%IX*esJ9uhyzF3d?Qrei47ss8W-R+ZYTbd<{3%s0#*!-$vwQ&+P z9eAS^Z7`&^zLp}0P0@u4!d|3`@1I~1_a6U3jn+k{i^5#@xG!wiNouczW=;jJ((OE? zu?OcE$eh0PR`hP2>{aGg=qeMX9oN<%01CXkH1{JGBv{HfIS5Zj8`;c!3TBFzZ4;;Yv|Is?Hj8adjoeVN<-_`RD~ z1TCJ9iVe9>*V!Y{-~NC|#l^I=>uFbt6dN=YRTMUfCQ?(qdHb2YGKG6vn>E8?tYsy@ zL6tqcufddEpK7YfQ8FmJ02xnrB*K*``c!MY^%eINE|=|K#msg5A$BFF4PTtcpqBs} zdpdYy9d-wo;1xH6w)Ge@v>-MnhhUZpTGUEF*P(_w&+>`egW)LtQ{U=Idnh(jxrkMZ z=n8Lbd2BJbOBQ$hb@+`IGYx&kFRv|b8>$WE6kGO38mjs$ITxZ}Sj60=<8a`SSYS4t zNtcW0G=n5m6e(MMyKwH*F^-tx6brmk60HmBj8S=??qJvtIqb+|jO5tl0Lsf~P$x8W zv1vr0mJ1BnLE&(6HBcvbDs3=Yu9YoZKtup{Nb?8HCCI-uFe-b^{|a6&>zGSP+Q-N& z1}o)#KdrAteG5ivO_hXn78m2<+C2e84R193Kt>OT&_cc8q&FQY@!9R(F`kIZP1%mh z^NoUUb^q04)vw-$?!9=aN z6NmbOQ)yuUZGr8yt6Xa4yoX8`WbtsuTgNMc8|K;JZpSc=SYGjBz*&+=gO3{GQj#*o z#W-wi-v;k9a|3_t-ua|X5nrf@X0-fz*^-n^Q$^3cqS9rl5)4%LrO1wHLkyBgJ-!mS zdTy)??`%c?pye7RSsJOu1R+Qic7psCs{BVsXw@V6;)_TKN>LzSk^I!{%vD84YBJmV z+&#&m#-^n)5Y`Qb3EpNHq3!7oCWN*l<~qW_>YV2X#qtb8^RpRbJO)F^33#ssjDTF2 zEBp{J=e^R>D0Ew{2d$SH!8zTPqb&q4y$PhJ&j*Juy`ySi>Fh*} zmYim|JC>FJXjHBli8LZsb`mmBL&x^fVi4d}P`aWymR=bS!$@uQ)HUlvx*5T%q4ksZ zV}lx_H`9R@-6Vs4n-`+tLQIz}73IZn3-ic>_x+*GC9OBMF(&BbH8J<#p^CP%O5!+8 zdLYdz@}L+mV9?GLVkv2WR!JcmR5y2fuv3*p46$Sq4Dx{|M4zHmST<9WTfQ(Ukz3aU z$&y=O8MKL0LuzR3Q)|?*B~3bBi+BeZNQiSmn1ypu6|9dmng&|aqL4NLvCV2DJh)QH zr75B?6@rF&McpaL0(yf4dLNg&O_Lmhf&kq7ZpWfO_i)iKXY|DeCFLIRT4>eSvxMdw zFh&VZyTWLNc=RCNm8ob6f7amkD^;X`10}d8H zW`>Vc)C8B3a2G^F^e(6eMc)u!CtEts2U#)lrZ3M`m1uG%*AQj@IbwUSR zst9U)5ntJT-orRpMvGjPLdwga^Qt#QtFoyMNsA_OrIu7rBG;b|R}b+bRU71G;54#8 zLbd7)YOD;=F{#1Ms>r6jbL-NO+io7*)f4|hrm|D#a{KP%?c=?j?#^BpE(VD?G5BT%s}pjYl$=X{KHcF91M(C}{VnF6tw8OdDcO8WV=j zW(6IUvVxAvSwSUCCVGM#I{nNMcV zNi4pFP_Tui7a5iH2t$2@fO8B=^%|h75h}Te`ZOchSFq)V7}E}QkdFQ6tKU!Kv=|oG z%chb3nqWajU69s+JC4uP8Y0b`r|`;L-J7HGW_31B%vGK)Eu`S~w3b@dWJT|}(DPb# zpOGXaZ|F#|C>pX?8Hu%uH}k}&NM4X>W$)`G83SxxeYXx##MVbBk1BfL+CW8j9kC!< znJqGLJd_qYKk4=d+*KyY`%F^lmm0oDH|vIh|27F4y+ z3MmMTI=pGi0u!zvk~gE%X@QKhdO*Vyr#MPVxrS2RRk4!Sk9v13R|h&o71+vS1KzXab_B=;L=E_G3_-3+h`Cr))o4#GwVfr`iiSmVx;8SpRn^&er0nZ#Oh>9}vM@4&Ji6LjQHvp!bpm`U?`p%MqCOrl z%X#t?^LN?XY=fApi4OKp&-EyZb1i7WXNDz(Z!|<5DN0=^t~*bxhn?@+n30DCp8?os zj^uQKPRrIu6|KuF;+bvFv)!=fYHt*By@BMhfY%gQ5ufRw&1c)+cK2UA>pT;NX~MF= z6s|`5yO`Ypg=b90?90gd_O;r+0S*GZf`x2YTf|7nxFFRA3xGM;DQ9UC_6zn_xiE?D z86}AXCG$8f-zE*StovKYSO}(ODNW!d>@3n15H(h-3mA zfXxy@^9fAHBEgn1G(9fQWQI9}UU_IivE>l#;H=jWSK6F08yt)vu7X-{cnGWN+d5F) za!;K88WXlqW2PP-5vUtQ02}xSj&595ETZ1)xU37GXBcF1`J$MN+G-S$&g1;tYLU+b zg#%3=_>8Fyt9IS}b~Dm%QHlDXVfD1~h1y)07xGA*1E8?I+cs+1V@SWEiXbhPZE1z9 z(K0Dv0rj#v$(uWLjxujXJ%ZTS@RDO=gMAZ5#wLwBnZFks1r*oe5Nr{h0M+ zsg1)a-G;CXaSBg&{2b(q$F|C<>|bz(XG!59FwXG> z8oJ!o_AW{q(T50XRlRiQj5*97Q6&nOB8}K+6*AsP+DeX0gkn1Y17*kJMn{=2xl<~P zcKFHk(#Aw`o)9ofW^Fuv5|B{c`^pb%5~!xNR}LX05Md5@Yj$P_QL;HR65)k!G$#^! z#31bW`8*ILy%X)&y9U>-~)yCt>}Mbve2pthTwKPZ$s zBR+RiL(+_^CI_%|%iFh{8P89qsQz;RhtjR~p4`FFR&8KrM2KtDTLK3LHB1Hr+Zcug z@q_TrBL?QOSIw5=|IpdIW!Z=5kAVYHpXcfT#hjTaSmK0vvoah*+>ALZt!+bOvO`F^ zF0O?!FcL?02YiIqEG`8*!DiriqTAt+q47o8yC4{ygD$NPUOelbY(G7wVHw^FwtoSA z_y+g-`KB@Tg?k>DJ0N)EDLUXKzPr%^T6M9egPsyyJZ8f!{iHlvR|wMl8guF+d zwA7CQYy+q#L*)54jc(J8(q-f%IaAA~#OZze@}gjd9Nk&a#|>t^b8J+ep_GqMlPm%% z*3}73hHFdi4CR=45Kr#58;9V>i zkC*QC;*5wQlqcz2 z!&Oj^K;ol55S~REMqTY-4V+M;;n>8`qeE1~+B;dTp|7KU(BuwJGer+k zAY7LZ@rgY@L*!9cRtUwfwSOQp`-VAF%#qyY%&Xqr|q)=Q&=n z83A1j(}Bx2PaBbD(FL4{ub_ctgEKo^6v`ggWzCD3wQPqzTlW{0%d34N?oXU(-f}t4wUc8+D80a5V}^& zQ@1IK%Rtve*n_(d@V6fc@CpQX=d6JqacRpMt%1GYF@lnQz(vj29(j=p?3ORh!7aGy z@6qty{2(CWo> zq!k)i*n|<}s^)fJwbi)S)}a9-%wK7_76QRa`7A4|IE)J@bg;T5j<34(`jM+)mqVk1 zxeqbUoY2}MRw{V)Z;SfkdccnR3lU(WVKBB~HjR$)T-9Jq#DKWwjvzNU?Z zx^=b5qFs5h=8Thwf!;D!k0V1Egb;2p9gWUzD5ZE{|H2gvHRwrEqXccDY2;j@simu` zsMD4pE?i-=DurBGLnwpFY}ri4O!QCIDm@*T#?@Vv1^7xPJS2zAm;v0>gx_ln^EdU|C6`N_F(zlD1{*5j zuZz1Zd=6&Z)5{;1b4jVZv62zWwS;-;2el|Y$Qpi2l}iy`bcBi51o^eyAu9vx*M=AM zMpXoNRAjiDqEC*|*N2I$L9Qh_#>#H=HikWETTQ#vED|N_XniqEjb7TcZAhpS0Dl$SI2*8u#SE+6 zvc;|oIP@2vwLA1pMllzFneVsl2*KtCH4|m4(|;I)88B2XLZe_v1gVf8P2z{^Q5^c<~=8 z`g7~yVhNz%IsPMubv|=~I-ku9=}ZHCp5^%vj!dL1xwh{K4CI~+n25CJmJ>tKkmOq} z`B?D5x7wu_x9-bFn%v!bV8)kc7o>GpA{N}>MyjRW>s$^;ha=4ESIrB^pnTPUFc#Wu z2TtZ@^bhq5xP1~~>AV_$RMPu}D8ZIuPNQxKeV=@)UbnvZLj85#wdrN6dD>P5OkuF= zwN=}qj)_Tl)l^N|5sHo)rAbp^34&m8ZTE(y#ngg@O^8NSnuaf0ugj@LFad8+UR7sk zvns==yt;Crp{h1(Mtq%33%m;j906ev(u@)7w5(*lWYph4Zwd8wJz8a@HoEeW6(2@j zSa0Yut;#YjQ>N{dLC!1m({gl&S1Ic_~PkBouGt6RL$WRqRaT+Bo&PN_tmjoQD(aOJ8P^e}ZnspG{4glS#WZ{G3tUyX!Izxo9M0!+|Xwx4qJl=Mt!KQTC~QGes* z+*^OFR>~PSFLj_-0n1B<9E(v-R!!Zy))%QpYylHn_R@k^fuw zKQHHhy8qeF^8d&9Nco>uym=WZY~Tb?t@ge4uOlV?-*0cUT4fEuo~kmmaaNT$J{q1* zVsbKuYd0nI_ZHI%*nS z4$`uNX7~ag zQi)+^UmqTqUT3*|eSC6MdQbWaTjtsJ$ycR97jbcJi|m$%i5>`40&Y5+c;ESU>Fp+E zm{R4t+t2sRxv<}bS^&M!MY0FyyQ&=B2|xv72)qgCvib-jB;Z#!#?g41pZ9e11Yki; z;l`#@h}|}I36TI1jo{cnp{3mte%3tO&kXvX!QS~02f%Flf4|lKyzSHfho3+Anf`x_ zk3;`y#Zd+P`F)cDXdSWvZL}V2v;rxB)UHqaN_vd;?j1&Tun5nu6&HQc;Dg|LQQ~iM z0wt44nn6k+nI@<|EI&fh{%B4%A)M2V4-o{ma>+UPXXblM*bM+uTZ<5iQu zJu$+SFB)SAM5C5*e;P+X(;>nuDMg~<923@>2oxv=`c(Ne%SK6zG`Yo;R)!A_*e^jX zh&Cauz|26!)gqJ|SbARjG~b9m%@t^LVNB7i=8{e7iHUn_{1B@esRgU)vI<7Y8QrEP zsXL$hVLuNT4Yn2(TqkFV^tJiSmAu`6h>$ZTt?Egc2MD66wEG_0V1 zt6qPyx8I5G-fduGs17m?1T9J;10}xNKG@ywG#V}<4zn(*l>;X}!sYI?Z^nsD$LY1j zk}2B-sL`6ZHs&QfKT8T!extrg4dkfvbWbrnzui07?R;Aro4$mHW;tHKAO9HL=7x;Z z26bUxP2xAn@23g78Aq0uf=4z0LkqL=8d~t!8|{AAAXF_b3W)v!)PVv(mqyM*y34uc z`A*|E=ZeZ;;AaZ(q(+8OQXwUJJbDvf=OS^yD{6FEmZRuU=-dX3CEEo;%51e*Sa37S zGt3V{q3egx5;-?SIR2&%OpUFo*RXn+O9UEpqd_u=(&Wt?AdUfwa?fB=Qh~i3zKlxH zHl<27+qRe`42yNOqiYKXL@rzjA9DjZ4}-|PVykVrHsgU4QxizKi9!ZSyF*@UmgQYX#q>|xw7s!kWbYGYZ*5oT*GT7 z5L6!~c6ZDm6$Y4kmgZE%ASgxejqj(1QAX$D_E5P`+7vIsh3| z%Ti4nR~4bI@p3quvQE_1k(z+O)x%(^90f;c=nnHVOPPXN;syZ-l47XQvvcsx-qGO! z6KTW$kmr4-L28ZOFm|UpxuzK50JpKFusjh1ql%G-&6jC0Ve{Q}7Zc)xoTWfp1UaLW z)Vbzh>5*Z21~Lc@{s1;KmA~K;SNv2&h+yOnUOEhvC!!DT8%>AC7d&(XQ$duCCfukv zbq1yKpN<>Ahg6?FJaCMxQz`koj1TQj9PksDXJ9k`God3S$B|kg}ii`0g2WM!E zT(y3q0nrP8Fw_;$q5v;M%sAu(Pp+K(q$%o5GRE~#RRtT+VF6tJb+t8PQ%c^-keW|( z!=uplgdIl$A@vJasxKvg2Bk$f>&}>TvxHe99;PMi*#wzgr0&`Yv=W6K8AFSGjvQx< zTdPq3K6AFIZdRfMKaQ;6#o~(TyKMZ*b-WXZq7q@cw_&jiXAfNL_8lJ0@p=SQG;vW{ zPCtx9c{LIluLc{?M!PEu8GAl5&ZWkvK?vv$EmKzsW z_595c)8Qo;TL4mDXm`hm(2q+l!XhF9x~i6eo}bw?Vjti5WSvcf!X!wavX%5_4)t-? zhro$Qost_0o3ktniX#&@(F79-T@Wsn*%WK z#p$3vpk+UJ@$7NusC&G#eb9{Vke;OFD-)?F09ii>BgO;6L^Cms)h3CDBjY(FCID7U z-6Sj7JvgJsyffenk`%o<5!h*pKYE(r8r6(NF1i_WHebC5{D0^0Ntq5HB+G=a49ETM zV+w9}YSd>Ci4JZ;F;Kv1!`_)~TK74!rXirw-WcmmF`gu29sllB9@c7#d3}uQqk6>< zd*GuAbM}4S6$sr}mHS=6m_f6ak~#tY#3JIv75qkt7DmaFS5QA45gpeQEU3xTUSzJL z0KVMHSj=XG5;^Gh#@~%rTQ6ZHmcLJz8*w#2gp&U=h>U+0y7e2kqv&M zD^2_)OVk%>;YQb@#==+&T}N9!zHy+V$+Z~=9)dVBiqSf};G@qtl`n|m*x@4p0C%10 zYY&W0kDXB%2X(+kasE0nUW_ROpdDcB;jvNeLAQ#6Lt~mU1aKzR@jz2>{?>q`bVV3$ zU(fSZy3A0e2zJ_67RI~|`h*n2n?iRwCwZz`(Mex19xmh!00L)MVlf=ln=&=~reb@R zr41Z=70!{QHOUK0TT{hC5M97Wg!-1PkGOSY6=t{XBlet@V{X|hSna2@B>zy?3%+in z@~d4BVM2grcTXhY3Jp2!ZUCG*5q?MNfg*T$VNOyJJURu( z8QjzrQuIuj+{Db+3Nb0|vkX#_R2Od5NUlMVw_3{gRoOE%Y4C*IpHU4~*NF$|xX`DC zqiD0}4L1oR7{oPe)xLCSu+_tbOA{VZH{sn@jYnPwp22~=z=sy72RGreIB}F9Av3BH zkc1Ya1fzDt2<~S|3c|TM9ykRr0>+CspYvgCqx1&UC{-%~ALn{QFdDbcKQkF?CGtNW4k9pX$4&bZ?ZAcRNBXdD3o z$rqLt6!HcQ&!&+BwfBa$B!Ed)qhQ7y;{4y$9VE2UxsbvCSLh z-kjxrr@qVzRJZQg#G`4d@H`-Ej;688AXEGrHcyZ7D?ipIqx$ZLAEWx29^+Sj42o`g z3g7fYGB$168y|i#w#CPyJa9xcbNRs!`8JoH^AG(>9gqB6edC8nD(NYHt#CL9gKTgk zhz%ToX~+y5!0?;~a!Npv@ELqD&k(iwF@E0BBowb3{U*~Xf- z`_Wa__=Q@-ax?o~3QJGqh9CkDIv3vfge1LCX+;Lz3vGHsR3YbwA+#yPsSQd+{jRPUF$_ACd**e+ieZ9&m=P7uP6LEhh6l zyVPhszpkCbqs|=1u72h@b-|q7CpPGqcsPzHc{1@HVhpmW11N=C|rJB+-@*2l#Fa5Aio*0(?n_^d}=9IjpES4s|l>3Uo5S^Wr?AzmqBUgLkL! z1#ek(`L#88v_^lnw&34K`0p3^?>}tmf?tpZ?Ge5M_Kd#KGSl}Y8$9CTz_JqeZi17= zmq}N_scTmk9;t6lxhRdMS^kE{)k5*8u67!;d{7f@SBUj{rf(b3zdEN3hMH{!XXt1p zYANpZl-}eb9<-Y{(cYhnq7b@A-~OE3YYVfAZ@X&ikbWCRR2wlV(1{D-IukTLHLGT} z85(5|cdK(U!gLf{aOx*yjC2FZbuj)l^<0@lro#;(A>E|LZ$5*PVmze&>L@EELF!{Bq57BvaoES6ZQQ$V_?~Z`Gn7AMIF8^RL#` zOGz2*XxeIgAq2&j*5VL#d9GP4){IlxL{$)TvMBpv1 ziW7vxY{2SkYw?J0eowycf)uskJmLJbMY5Dv0Wuw)%)A?Oj>`hFnN@ct| z+|v93Nw8fBFn5b;dg4#nv1HHBN-)4TFqH2IXn8X5KMH2T!TaM_2w;2`t3M5G`1&s~Vf9DE- zn)0eMX>yHJ{*@{vQs5TFFo!$(jBj)ytRHE1GAjUEzcs3jme78PO2@>i$jiwRf%`KE zm^`S#Cw8b+ zXph?cJ{2vmthhTu^A39lCuS!&Xi1C%Zc_A0H5O2$sx4!5QUu%_nvsilzuP;E?*5@^ z5s5cDVVxRbKk1FZmPtW*d2M-mQ>mdmUqLNTy7G;$O z@aVv?>vjgY@DlZ)!xzo?R2_6^I3b?VsNqrtzc3Pn86-`Mn{MW8Ubdl*(d3!}x@$}J z)R>Qsw(LFW-2Kj$xvlnZ z?|f3nyGF@@JC}@jOJ3sLOFAfLcLQ))4_X=xj03V5^4B7BjC0dy%bu;s>dC{^v49Jo zzuJOyb=9WG9e2Hm}!{DBL$JU zqw2ETLU4{{#@xpTHLDHKW&f5$*Aa{qpJ8Jt_ZNMc+3Jy)L_olGoF@z`%;clc=3x0dRFBd3m&=Vxvab`-c}upn+?a)!5e;f(MGJ_=DaLIl z2bq<|zY*0}@f#bbl@o4*Sz?x+b;E48zsE>iQecySvT&+Hqm4Q|VsxSGOmAY$4wI8d zBoNGMQ}j;3EHrT4Sv+b7+9CE7RS

    Jxe4T7~${Pr|e!x176#BF9a_SGD z1t2#J${P&2`iY`A0JV8-4$5lC*HXx7h&E)=ci*k8t-X8+xYtj{>bQghS^-YYPeF}C z4(q1gdSG1AkDYP^pO-%Yd|ockTOyFQ0+4EZKwVwktbiRffE)M`dRp*2Jvc6~{&Rq=2KKpNy*5vPF-<+gs4e2cx=@RvK%m5|xA{OvD!Xi{CMFolZhLYJn{Wp$zNweQwh1{q

    Djq=idib>(Y6rZVV2x) z0TA0m2vieJ;vodmOIZ#>Z3WO1cMt&rhA0A*Gbk2$WTWD2(sq5{f8UJ0S4jN5k`cg! z>iaLwF+d5Dycdrl$<*(sN!m;3UK1SBDky?o4Xoeu zUcGgGg>cE1u-}5smBHgT=O2zvdx6tX`(MoBa}=$I?BH69_|E5FYoT+m`qV2MZi6ky z!WxGv2IO7jh`Aio49=)($*7%Gr1tW#JA4qnARE85Tg~CZFFr z$;<93!@?!#sRj2e@p&G%_exh>#xTVF;iRAxUViKZJtXLkm|vH`_>wWA9~lt?bHu4$ zh4|%@xY=l7Ka1{K4e|Uun-rl=nT*|Du5Xxvvs_4$) z!Or%HDJ;tdHgT9&H7m7NS}C8l@YR8$x_>B>6bH=6l>Zo58o14^V3Rx@!Z1e_ zgf}BOaG_N$({g9@A(pm$oCM$+2J24%J*UrjG(L|Pxwmje0(Z`R^>R3X#O2u}WNoHD z!rViSvm`yt*dNaQ&%!q?vi^;D*G2f&Fx%?%iKZvMu^u`ZmF)9MqM9)=@v5&zEyY>8 zCT5%d&i3Hy@bB&-IOwwdtTT__DK)P{ta+C(`V(489VC+_4z&`aWR>sC(f+u;qNaHd zs8%CHie%sq*LtLEC16cLgaL+Yr2#|Jr;l$Ga$8%4=;#Z>oFmi6CHoK?i2~M4ccUBR zd)u6|Z)7$I%zR@M5a#>C96)qtLohhTh{A*mdRFWcV)q?-Ztv!d9SDNT*tK|8dU`ZL zSXx3D9Ql^i!=c#YMl_J~{wvYB(USv#Cv> zlqjC3Ptg;Ro+reWL0e5#?`)z3-J0unQv<+2IqQi7^c3zClF0?+V2|?ai_>fbx1ebT zHcF@0zBd6&pX>ET=%GR^5Tdpo_y8eFGnw^ zzZVB5+{ACb+S~6m2^5&xy9^LLZ4y+PTD+mD{C$%|PZ}ZpIp_$xCLRuX92=2MUpb*O zj}s5G40DY_(re^a9i11@GE2|Gv;ALbF)BszWD;MK) z*DVXYj=-A^cGffnH(Y%pbBtbOW*mO|t=5k+x0PJPifixX5uCJO*2B)cwqZ8kBi96N zPl7{$#l5V z92(GQ-657`25-}b*@IlA5Veg#4j@(AROjNM8G6GJroQyve#+)cSm*)!tZN4~PI*sTrNd`LGwkDW8*t0R(bqmhBaU zJB>#pWGGhq$yjaw1Pn@%a~h(R`%Og$?ADPU^b;9hKu^g_9joeKFo8g@0K=#tm3y&w zaH0gC(NvvN#r^iC|N2?y8N9qmF8o*chF>6;N0D>Ub~etV`~pHqr*Scz#EOTl=NZL6 ze+9*m8!(I}9M*;r%8>!Ge4cQQg@J&ZuXH~*zT3A^2~CrAYhht8I#J84r@;8YjWNMd0|M=Edpbk#hhp zKZ`i>oXKD~qzIYkagON$vUGI4X;VR_nc|eTNh;DKMiQc6pR5xG{}gG=9cIos6h~qR4skw>!OX40J_`zdruFZ zbrkqcqW$g*RSPR@Qkxu07=_kX(;QM@nv8iCV#}0;MKJlLuC{mBPh-@b#=Qg9YGNNa zdyu3^Wrw~d0O4V}dJbWEBg_bY#<>{O*2A4=RD2>11ztQQSL1rGnKW+Qs!MmpMl-4> z3Rb#sJRVX^!ukjci?Rt|BdRU!ww5iamdRdyy;0qF66gwh8Ftlg{Am~vOHf`Ms72W| zHR)&ls-b&SUmLe7ZLw{p_`C_x#5lyt8)dbgWDsDJLieE4xpfObv>bR_J&0Jc7yR8*APSVADwJJ2Ks5c zl232lZ`-vGb;=!DOBUU@mRiYLubuq?4CEf9?2;)O>HS# z#^RuDe+W+I5EdJva>+KF7rMV6oyIricsAck;2;Xcy-5aJ2(COQ*@%*=Xwr`i!#SkK zgCJ{g4Z@4BIvs(43Cpg~Co-e`YWrvx7yhJkd~$5jK1=)14%WuD#74$R1Bsbk`pSal z-?gk#&HrD-#W^IrfBzU@v-$tl{rig9_xS%-tMxPg|1mz2|2Hd60>I}a0IdJ&Ui&i; z0PcSlyaPDaNiCsz0!l-;5#T_NHx3A~icZtO1}sTcoifA8^}@L!ao#k)^X zhaNpsMW;wtp6{7&-#o4}SH5z4abibQ? z7)(-I?nV`SuU>+|l7roxzk5HuY(b!@g74MKg0q2=@7|BvG>dhk3cgn_3(f{gzI#9M z!l)L%7p}z%BSHLLSP(C~Jn?(257cfi-ch@vr)Cs--d+gbli_GVd{-skeWrs^mQ5BU zdQkK|db-Gh`D_9msgfTaqN>qgrhtAn1+im@?wI^z04CT_p>h~^hGQq*uYFtjVlbA2 zY=?>V?A@Tds5`i zNapX!QGem}#i9%B7tsAwZI%G#3LoN_J;~3U`O{_6p`y8LR9A9h(jaSnu&>$LYS9G}DD{)15BDXb zJc~|~UJOdZ>XzO6gbzF%K?60uC5lC|C=5KRXWx{yI z!#_=mH%XF4>j=V@ttp(N-`eh4x;wZ{iKgQ*+$O-CnXL#5J9Q9>sftc|5y-yT`eJK} z3DRqL$DqIutC?Jki|d-K73BOTcc%>#s1|zHb86w7UQL(h&8n?uHA2-c)Dlz6-MNis z&#iL$?ds`|aQf|coqm0~Is)skl~Di)uSUxYfWf%3g!2==nSirg02gZ}lEbk?SWug~+RsQJ`>A9gy?jxe*Wb^BiM{Tk%vs2Qdl~mKpI& zys#D24}K0}k9iJ1^z#gJ3`JILU|%@T`LW`v>|^zVAFFfRK2|?W3Zo3eoLkvRzfjVG ztpLCDiwQMlSsR`As4rgN5B&m|QS$Ak94KUl0P-;~OcSRFU-t(Ym^2eruu}{hSEqLw#o4|0EY5 zCI1Wff2^1MKOX*k|MO8k&ixOpINtqyzHW`bK8srSH|{^&c<_1o?guhPP6jcCMTwpz z7un=GdKRbg**m0y5oTHTo+r6@ha4|pwc_3Jl=8m7To=guVp6;q0=|8kO$!uU_*&Xn zBy7NIv<&8+_4F zwa^-G8nYQvPWEJV)t^n3JsdzjRZ7AEp&iz^njLT*MoMSbdNaCe=%i;9lQBAlyM4T@ zhc;eaEr%NztE!Oq1D+-{QmXlCyo~cxNPsq7`8eqf2f+U+zP)L|hPD|@<#FgRQm}|u zC^S`a+~~SlF=W+gKT9xBC76j}Z*R_rN-P5w{P)wL;>O9A9|u=wz@*Xk!SPSXVCo$aHe?cd&dp#3qys2ix!uBx}hl zjOEG2Ldi?60XPZ~CTRe5qA&yd(W(lOQ3g~EcXcKiZ0=s$NW?T_tr#zCw9itdhO7WH zj*`m+B>T~@DEtiPPrH+8YJ?p#V3Ln)5*lonJzok4)O8M_*0eDbdf@_wL=@56ajRvO zi*1XB+qm1d3KsqH3upDTy2VzNZ#mh3G$S(oY9Ny=`mD={g_-+!m3f7^?WR~`ocvwx zQ7;d99a9)yl>af-E2N{j#=T?W1s#6vq&Be2{nkarBFj#PRmx*`RcaS>T8PcT!Nh5j z5N1oY<>dXtK>F2z_C&n;vqbfzsETNPqR6(|N^7vQ#E=<^vvhwR%wI~&0m`D`T0Yi+5G=U z@&9gr-foxq|IdHs|3AjZ=l{w1<9>^6zaHFcKa5(x-e^DAXa$@<-kbk7cBjDUpSz6z zd8K$D(l@eyM=c~0Xy&Q&3~1f)(_4^1P_f4t0hG=k=|=9Ks;A8?ZKh2{$i82?RVRmD zqWw*Ex`T=u60q6qcwproeTnDON-KCoK|{BkV+V+F{S-{(v$S!y4k@YX^raDP*y41s z!exRtTwqYtOzM;+FK<+}o;RA2Fq$`Yv0|fYQ0(@8SN*7{kFLwyd)kbEPb+gL*j9?% zIk#ApCUQZn{C=|t%)v1CSkb9R>GxD6GH_R1ZqsW}^jWTZsYE_xNK(}X!rN;`&ch5N zbsKeC1@6=|d)Z8h$Hp_eXc9w>C?z;;b$-{W9Ax!-6d{^5+(Kx!-PrPmrJHUw znz5PgN`utX(&LOSn@Yw^H5e*-lfbydOe(1lj7Hhb_Z=9mQ6J$I7EBiU2q~xR@H&HA zttfj#A#2{ieHpANq^)^%gTmORb!oX7{jWa%v$+3Z%)jTH{|_Fv%K4u^zyI_3|4}~j z{MRc^Az&WF90TU_d+Ybr*NxU^8xMY6<^guE)A&NkT6~{@&2Wf;{b{@a8-OD?0d3Gl z)}M~hBcq6iX^y^w7h_5&OHv#JZJ=Rd2QSj$m9_yOKS3qFqZr>G4SH!a&;nH3jVEuw z*5z5;iw=*YZyQh$>IcgHW|;P~H|*0IM|m-&uF12N`(9hbj9nzLw#1kw^T7?-6%R6= zs0OcStZ?b1)s*OvwZqFbOq>uV(E0PjC%10Z^c_?U+p=kSZrt4AljF|wTeYs_wAB2b zA9bGWeS536f4IG?er`m9VZ#ydP-LC%lkL6zTQ%sO=SblS(6tOlHX3ySqA)f&4#obd z>bGvSRR_r8rDthJlbSI=L38@1S?2t9;Vo7alcfQApZFw&60NHOaZ z*yXJLgT`WTZ$Mt9wUxT>>sByn(5RHFuUYTl%HhCIuY;V3zXFOuy#35k@A)m71^l)veZe~j=O zb)|mQN3f|Bj$vL>stK858V!SqT7@fZxTYymN5zVrB}L>8gVg5Yrs6L40jUEwZChvg z^ptI?l`v$Hd=-p{QAPZ1XJ>csh^EspHI*!PkzFQaonhjJ!lNitJRSvS;~+{lv%Fj} z*i;;9sKWdjUm}3_6*cbArrVUunM}TGwSV=EPF;tF1PDX4v(IJ%}M9@c>8Im zyZ7|q@JRhRIPM&s97lhQy!TIz4xe?8e|vn=d8P$0T1XrS3jNe)Q=&#PX*5|cZeZim z3ofNs!znee#cISy^0Ytge-9Q#_@g0B#pjcJI1BfQ5wF+30$=s*gPl&}L!1DnwTMoE zeN~gY+O9Jz6F33PQuB?-Uy|Z0YeS(&F=NDM}4B~3Vbk{cnl$dz{ucLcR4yu29W-C$HscVc!3_w~?;)Rx7ZbE51RSJao-wZq+D5?t24~`Wd`nuB}5ea_qTud zTlMux=cuEI-SK-L1tmZzF7j+M^uk3zC~}XZIlalIqdvxyiNFDb4S-Ik1t=~q(d(f% z;ZRRxc5{wYBG(CJ>$kf=N4jGOl$93shIE91eKdjuF!2b_S15^i%B8g#zO*b@GKTN! zO z`)2#36aBGDM;xj|fp)v5ujFv|X%nxi;*D&Yr(NR$tJ9 zD^rxPW*e-+GD-yPFenGd%$pnzXs|Gn#s_0G6a)HRJOxyJ5|2iwIwX^$1bq*-f!G8( z+qI%Ep!thWaqkLE;_g1)>-HTT^pMQ|q6A5Af0JFWuCpnsq$3%Puyzv)Od3I8U1wV% zy*p*49^m)PjG_S&hmiQmcb0$veN}Hh+(_RK$4#&)7yhsS+F9Zzx~{uplu^Pv|I_?a z@bWQ=Y@*tRjRWUDz&&kib<}yfcYJd6+r5L`&bKTv6H*%XCyi*3lj|>S%JkdN*f39r zBbLh>UZRmyA-Sy*MPri97;*15NVK2k$)q0_F*jm$1KQIN8;P#f32m%eMGg{}Ke#el zx42L@Y4S$)qm?EIVJfE+;N0cvnjUI(L{eNNYH2j!YF)k@s0r0W?iE^XilEEH{J z9Rv|t=oI>qY=Nt1aODQRpz`}xhhEf3RxIKy@w08jhj0R!>$z!RIe8pNem0KYE*DbXUqaBhElnqg~mxt&Kx%v z+)(>q6a*35*<@wh1!)wcp$JG=*yPQ|PYy`5pdX6I0CU<9g|f3Yb09=R>oLs$W&)pJKR!Q=jehui>Y)~ER zz}W$?_{mkFINGZ?F>y_ zQ1dq&=1T973(%|Sk!lW&E+63Tfp(eGHC08jgBc90C4lL7BreQUTR4gpXmZ4tgpPJ= zWYM3x8%3*3jyc~A!%?0kqe}3@$Z(-&fE|&fN@NawoHeru=r1Kq3$tQux%VlIlxsC& z9d`GQ5R#TRG|sJf$#U?`-qGO!G8PIZ*d3I$q}9Ki(G*axchwaUN~Qbt+E~#nMH&Vwfk)Q=xc)hLU&a-UKic8B8P~Pp)kyLqhA>!TXLn?4jrUK7Z*-Q`k2*|a!(*d z^RX41Q6Tz&R4y<^XD+%{z;7e6~+&cC1)C1Gx&k z2p;J-MH3v0a||tt7WJ^a89)!l59VEr1bTZ*%j%6Pw9$!mM|`5rKl00m+%Wa{fGU2L zN9{5RF0|~mx(l(HVV@Xz$CIS2%`T(wTy&hz3D>wQiv_F=wYtAnV-dF3wBzu;*h(!p z7KljW(vF}O)r0J}7{P-Y#?CHh+js*G_NVAxuQq>j6}2tx@bSRWwQ5~u zXE(f9?Z8?U*=d%Ik~lT%WfF7`3sRjsu?B)#a-cODiVdl;&$6)_kxw$K@D@Tlz$Nxj zH5tw1UL9%0-K2~vXr(#Av>W=AF?$t6GSFHfQsb_Kcm^oAfd(Hk16eC-+P`@<)Vo}RF8r-t$6a9QPddR5~dIoz@_M7_Y@-iqMooPUyx? z*GaC5Nvuw|+S1{x_R#DbLXLN~8^kyP*AQ?ccJ{Zd~Yxa5cCX$&wBk+mpCPK6E( zwZafU8NBz)A(Wkg$zy}MiRv~5S)&>;H9eD?xpr8j1P=9b>7O1zb)yi8l1_LvCgI>x0L^D;SVSE>dXDvk{Y0inhk zmEx_L0}Nqx0buYLY5`^9sLMl`!;f2?)NGcVj}tE#IqI-Dm@u&4*}!AaKMXfcoeT6Z z+egz_e)F<)&^e5yF--}ISgxR<)%lv^b`K4{6r>PM>J*v`>7Egk_rlhNOiXp;I8yL8 zJoak83mlYV7V>oe@bUKkF~i27Ma$lGFyj)A!;A~67I`ol_6pnqB>_R=R`tFv<6U?q zN~?g;z$6N=U_r9ZoAU%M{OG-wL(YNEiEx9nTpL6l4D2e%z#M}n>LSHU{$V^C{vjzb zt0nHwv0~a3RR#ALFkfN<>(jBfGYF?SmzbjQp<^Mf$UsYq@ImvJJb@?}l`(x0=wSEG z2L#~2$;tNP{f-Mj-%_gO*gg|ho0sdfQ(#RA-C@B^^_jetL@ckvN_hFZVg^y{A}KOw zPqD^N6jFAdhHQyG0P_{a)2rcV2ufR2?bj*cEhoZNyk|o?j&HyC7H$V_-Ku@xs+FA% zOYxcgTP-zRA_$JtMtZsMjkI&LCxc1@9EA~po!oTzhS(bWT@EK1WhU12u*8@Pmsi!T z<;>a3p=9@jbeJL~);2e5(do7N%ivQ#f!Y=jU63Ead)<`PUUkexC(gs0?P}Nl`H^t4W`M%S1 z?oGI(O$sv~7&hMe0E1-#gahWo2aytQ$}D{p_AtAhC)+RfPq;~tg}5=O z5@@L>n%c2#?Rbs3ZS_QB7)cjQ%z&jGo<$)2gD0LbvJB{Yt%VfamDC)9?L0v99()ug z`NCn{Rus4UL9o+6&6X7NBCc*(Y{wGwUnLo7bJpsG?uUA0Drma|0>m9wx98lFEzFI% z#DyrhJ`EbeE)q+t1No|B5~{;=fTm{GUAjTdVyr5dZDx z{0|@JnZf?X`BB!@srfwbmj1_k;Tz4@2p{Aq|_3w{3%h;q9a1<05J_Uo;%- z|IOaJHnedh3&ZCt{uN`+6QcnMkg%NujB_xS9gewp0VmmYyz(FoFt#+K)r`1o;`7_z zy7hHt1lZo}bDlTajge-$t8dlSRn>J-kplY2l=<<~2GQiK^eo9rk7k8lGm+P*W1o>; z;!9IWIM29W&cln5B%ELd`uHbKUN?;ndTFA%jSM?+-k(HGu)niwr5S>%umA-|_~9&+ zjjc00^kQ|Gego}gNl;F=w*^~9Cl&b4?yfMI;ST=W18m48M0^i=E@2OL-r1G z)icgeao=d*Xz4< z1?9gDm%gKZHDY0Nu_L*2a%I@(_6Ezn;j{{_Hdx0@aK- zH~f!)JZ^s3{|Lyp%`f}k*8}oh^UMDC{}vG3Mf$D*@TNs5Z0|%sC{*ANgQd;jyNv*` zoxWI?sqjv)@9G^;EeDA~bfOF?2PYqtJCM-8#iFfLY5GY=_7-fRf>fskE8pcuC$vl# z)s|8rP;><+5Q-wFUL+48Bvz3(d(XOuUMUzsf?;0be>76&!V5HLRNuAHhXM2K;9$4A zweP_>(Up-doapLI1m)VCFRGPQO*^=M-^nFP;CFXk{&@W6sC)Q)>v+p+Wb8CDHjPj* zFQ5tX`;sIg$@|%G2*(f!Cq-KgN&`OYJCOBHr80BY8xFzFz;*n}*gTV2`W ztYxDS^qf}RJ{XfcAEO3_;&|(00jIF31`z`C^EW;r?I!PgO)BGG#O7oG*atI(tONp# z`XEdy=gaCu(>fp%40)E`977)Qp%oW7VNQoGT6Qtb$e2*$NCLm(t+Gs2+Mo0!@v=Id z$xvKdyRtKN&Z%zRe=}HU!oPj^_nTArZ_J*P@4v|xBz_Pnha5*e#8wio#lUl>@_$q` zfm7-Y$x~=@Hg+>b6E%^!P$q9m6Sc8X*z;y3}{Oq=P_q-dWZ0!RkBNjSb!xPH$nk!qBVGe&>Wz^txw-O1zWMOMMWg5ZhpHI_|335NwpKR)7+sm`*q;GPL;qndR)Udo# zfS7~L1x1#jUul1Q-5_vW0vANp_B=!Q8M&Hbr6|8}2nyEKL^cZSjINgI=)#Z}20S2YQ{ zhMRF&14SK?we@XmuH^sk61Sk6K^OB;zlnzcV z18$uUjwHh9jC)8dMjl)w9O{5#2w<=6>?K=A$GzjNmvd}}_v2xA>$$l<*nhK!FOTLL zsvPiQTL0c9hXmakI&E-^_ZHpsD95i44~`F9AkOJ6m3|!vPQRN@WAOej6Any+|+M8aNuFN3#YAVO;gSg{l=yS#MEtSYFe6F z4fTgL%~&X2Zl*sp5YB4=n1%FfpPR}jHI>a~aaQBRn#$UC)efjwigP=UC3?F?z>o{p zD{4e3Rop&cK5X4nzGn>;adqs!2jtv_3S#>_qW+;&js{a{AHvOVJ!*0NuUWIQ*HdGqdMlAA7mZs9p209M{Ro4);-SJ(&1n;$U5?UgC0W{@d?T@ zwcX3w(mOt{1_@@Aq6h;(=5rK7kZ?4SlglO)WCV!y062Eh&62=?rtm1@s`#}*BPaJ^ z{_WCp=zQME=lI(_4(-n68sv{ja8QX!55sb8Q@KRi_!WOIqb9#SFTE8U;n(s*52;YG zk*QDG%Gm8v(J9;k)s*v#p?gRs$W)&R^u-^c2#+wrM7tc zr=BQu&q#U-508qEI|JM0S1)7Cxt?-%iet1oVpS^(yR5Vj?JKojmTixv28xlpy*H!i zDgq8Z4F=QE=-Rz4fOpAgItr)&xt$sC;(;OJDXZ088JraMBIu)y;^ZP8@KeXm?L5lQ z<*HiixaqbbKJJWp?s z*Z=%kdOyti(QqN4;O)1XD|vm)2(BHNs$RzFMfH?TX~wAQw&Fv(alM{oMMm_eLZ3n} zE0igLM$M1f=7y|eFuf$K;>k7L=D191g~Of?X-`j zfKVG}adFD*s#KR>CfAuMs_p@mk_eYeSGJzXyi#IGI2Yc3Trk7Mhid-RZ#@Inv#|$b z?7>h&mPZIerdvOPt>itnm0)<&%Gxj9)9G|9Gr$r&wyFlFJWW)|5eA@Z?7VT!1=Mp6Dzw6gJKD=)5xs5Cu~GvW$(wWBlu%yj+PfY zNBjjdNPDmLyWQtp>*2kU0!}dJHyaV4brr!v0x(XBabHE=#_Kn>)n+qn9l`)3gY_w) zpI#ue+ro;ssEUFgdE-czHZ1+-*eEpp{=XT+9-g_mFT{fl+s)0PlaT>>0*|uG)Q&r3 zRHYh*a7dghOnwH9OY|S+L=!qPgQA5JpLt4=&XV*adidduK376lCS4_Phq8!qBQ`4E zkiwbo?f4EF2qV!&d~NB)p-V`?9nGvf6lM9Z_vW1Gvaol1!`=ysAe1%?f+!L1(&}tW zv%Eld7nHu)%1vP{nl$_t)8c;8P&O*icV+`FT_zp3OeHmt3;f**_>2V(boGPO=DOh_ z_0RyYn5Elkby4wQv}UcR{bg8$(1NpjdpP$i02!@4(tKwR3Fq`Gz80H&>mYYk@fI@f zWAZ$?{Ge@(8Sl@dBsKYUgY=`dn8n3M;&-5#iWMYqM)wb*(nUnbP2Ea*AFNx?dI_lKfY4t;ohn`sj`otr#$nkp>@C(S;gxL$kfpbZY*dS08Ch{`6#>gz= z?2?bsj&rRx1UQYnNja&JoHUHym0&!ee=#P@=H_aXonFv=1@n}kuL_q6u|Vj^Da9r1 zcM!bi8nEIhfE$Kc*0NFHPNHJ)we?glvIEC;ahjWJJn)>JLUQ`w>7lMDnB^U{VX0H& zWQa&a{nJh|4fu)S>xjK)pt!Gt*`72TRV8bDmnzG;PC=DL?&|$e3FOu$^>*zqGIiEg zF?akp7ScEN<}Sv5Hn7h&xMKsMdpft=zuR2ntAA$L|F9hN6&!$P+yAUSdbGOg+5f=z zM}OM?{1G3={zt8N^CD<3uYHRKK#x}1?UmK^J{-ce!T3m<&FNuQ55t~Qg!pMBlqQzQ}f6vy5IfTskr-szimB#E|1;MM~+?{P(zf zbZovsj|IlouJqw}YiHN|;)KHd{l&rI?!m!p{p0mvSAHBjuK?)oj%sCl_u!~&zP>q> zA1pu9ck~6}U_uH}vhj!*iDuM1Y4)2VylDhp;>nY5$wRjh!Pm$9^#r~?!1xI4WJ!=j)Pze|2~u7+w?EinwvxQKH=&dF@Ms@Rf^trFy5M+9m?PR zW{_+>+YW=dImGAJJw!<27@OrvubfK2xJVsB-MUI|%wKBBu7pTlSI_UET@SXyP0jh$ z)W*5%*z^{=sh_XP4bq#g3<;89(Jt2d1BsAhzIgMLSkYC3w;0xF_$*NH*$a?>jK zb$}4vwF;1|yH)|>cGoIE2JhU;!JWqfr1h@b1c>lms{pya^JeVs-&Ez$tHMV>9g;c? z<<_=<)559Kz8SH*f4OUo-Qzpg==wGM@%!5b&$7>{1KaejI~32xyVg->>RqW1pT4)k zAA4ElH2$1=c&67a*M8mTYTENh=hqWHp|09~&7=@Val4c1%Bcjr$6XIN=2A#iv+=)Q zAiP=r`*H`68{$8G`?%97$$t+!f69M<#HULBJ16-ML~!u{SzBp8L;-O1;rhc050C@7 zFjbBp7s;fUMnm)fI0w%CwvnHd|A&Z(=Vht!yvEf7Ma0icfKZtfAqalP>=XGE?Mcol zW0Agu#ta{^u{_`_%X}H?Y+;DS`<%E=`CC2?PO$Ut1$Q3wF@6MAqmtQh zm|dc}i*E(i@6Em6S_syI@2E2TdWOHgSHHHMU(c@aXPe6g4J=FX4WLw!ol#it5Q^no zPKNXB>K=|n{nW`!D9fpd5CubtugGrv)rQPa-lRVBeB296j3|7nr;DF*nEhAF!7D5f zUq$_5$anwB27(P|I2;1O*F92UzYEEMWiD=Net5m+i8!kXz>(D8&EhV;8fi3s_GkLGOw(Y%#&eMB6 zQ%pr@(JSU>F}RE=>~(|JK4ia|43H&F#+;{!0xO`3kh(fFFZQBOIJD=DL&?HnKN z>>szWnL+_@zN$%1)hq{3yefJidt1MtnE@1$PXq5=q#E98_$70zsIL6`rden!aX`!PH5y2X3RPvh5xL zLm<>K1K=x4-TN)C^IN69Oa11wzUNy_1~seSQ|b4X(`{X|qSMc6JN?Y-^s~xNL;dDS zeW#x_8Pu#!pGc>lIi1!uD>}Vh+v#nu)7zDu-k#m*?Iwe|O{ce=PV1UgGksM*)mQ#p zUsX@`)eW^Z;ly-3^L9r)Ypq2R&@4?JNpOpwQp9^82K3Y zC^pWBgTq&7ZVmEHt_<(VNCZef95ieUqwHRT#;QC~!MGh`dN}zp^+=;l@je-CC>jnQ zGvt)367*x2{J=L6J|PBbXq9peJfyK{P0(e3GIlq2;m!m z`X2?$I*O?zbiG0EsLK*871=8ToSUR%LQqVb1S&{}ueP|`)a&1MuVw006go9`EEb&N z5ew{=$Ve8r{R0fxJ~yX$4-M#$qq-_M_~=zGp7+|GW}By(d9Uy&y2dt*%+uqSU-6w?SN) zs^U~OXa=5aJ`J{=Ue2KrtGPgOn>^$OO&xn0`D`F42;-hyC%JP@7HvTjx6O8|6RJJj z;C*DheMTwuc;xDa$$*kLbTg`|S>szKg(p@$r$PtL<~)vZX5vuIn%w+w-CQW)(k9kG zYekr=Q7+t;f*V-Krk2m?2@{<)djOrK z?ebJIJOEg0(a7BgP>4F1idn5G)Z3Id?xLEDEsw@Fwqep2U%Y;?lqkZy1dKayih!S# zp!S*Gig?Av)#u0wf}+nD-y%^jv$MsNGy;vMn;{L3Cs6LYN+(pGjp-Y&$Wiv~v#WPa zf2q?@FE3wzSp=jRSg6E5o>69K@v5Qq_!O|3!M5nJEN*N`O}C+}bHBcNe;@EQ$GFyw z#W2`O)fH}&IEQBvh@V#V8D@jd#>>IB(q$VbCEgV|^0&(Tm6D1^DMl+@UDr3m1PT2? zgZBUn_3z{()ngl6jLev40szhYIrEOK;BDv*nyqQwmWCL7n$(m8fBBv>GM>zev0;U% zPggZ&P`qZCH)5cCVq(;Ij)TT9`AD}IYFMP$+GdDeo2rkcHieQfeo}AUifWrwuLM=F zBLQyPC1~#6Tl2QS_X9A#ZPm&Pbe_o2jV#H5n{VP>$2jgMrwMGKOB5jbsPLy*$JHhw zOG40MsGM;jtv4w2IzXckBxd}03-lf%Q|1dn0|`Lr+$2#S?WHA=?Zb35{_2+rEMypO zH@nsG1jW??2E7~{lTwjx5E9rFP>0l%tF87rU?SPM>4%-x+Bz&b`pP-aAGRK?!wPxN zgU9PmtB6TjTH8{EzFimD8T*K{fpZQb59TG83z4nK*&eD=(UMc$$+I(uxu3$*ncPUp z5KrCU`=z`RhvgEH=^}*~#9wHtv&zacy-hN!cK|$n8axckV7BiLrsIRbRo>EY$~|Yb z$78R?@r^aUCGCtq%eS-^R+-O8Q=uJkNqJ#NB>5{OMLbdgw5B6gyNgp$6euee8~H6w z#O{lo?(XxW-s|pR@5Sz$qaWuUtr{PLKlc8AhW$s5X_US~`mdYpKh_?%+kX7d$E$09 z+JF2JAIJWKSDdUrbokHjSK8kP?X~qs->$EIS7H4Rv~3Vg2C)ChIW0X4j;?|5jWBf} zuoBm|j{m75d&ZMV>ZSA|Kl*Yuuo-E-%(EgH#a`ks9H!@ju)Fi@hO}SN^orW^B8$p1 zC((D7le3bf`tW>}CdCmIBB3di!B_T$Eg>o^e-DFJwWqBdw>g9&eu;nRx3B)9#k zkuOU8grzDLnw13IPHST#cRRHxO}m$Q-U@m?|4qIge3Q>N12qE5$HD3C<23YYN**$- zslzTyC)T(VpGxx>U&Z}tQJKuQ0&Gs0*P#5C*|;!0ZF7!GNnPM(Cvh8;sOS~#Rjrsx zRZX6hR&#bU4mRLhNg-`k9eG$YhhcTMsJWZEHOWRdcFV3%WHX9)ZWsktZKx(O$g49N zd0si1Vl=KDj!uO@&enUc_qX<*y?KGRAMcbaEg+b3XJ<%~?*X2hR6p?D#xNQnVFczmZR==#qjwc`Ry}ha`cx6 zLcQ`F`>Fk$DR}g6!F3!>Hoy666J(3DIN$tc)C>mE_2xH&W&n~Iy!x?;Hf5XN>;Vag z`j$8}`5-Sge*kI&MLtu$q9e;rYNWFA&T>rs7+*8>Ct6)g z!}zVjJU`tp0O1|wwT|@tvwDDgg%6J>C`eNvnp7gU==k}((i;+FBW7XCWG-H`Q#)HH z&E1BA9Xq@INX%h5iF4J4pW>X`zyaivAdI7ga-Q0l|f06Q2E!@{>Cf*!x>&*e>puw{dL3&WAd|6JGlK1x) z+!QHRO=52C%9P>)U#XN>cFwhdo!6qwr_ow7fJuKe#-wudi^aSIy|vgoHd52+%;CiT zUJjb?p-)EGWz%ClRtrVvfz-|;!#8R@Ek>}t`)cTRA)w1vA^25Q2&uSL3V&7=0}^h- zf}fQw;vr#|%Tk>s$tj4(id7DOF15d3U9Bp6>9&nOYk;~1uf2krx=~>|i>%W0JFH;H zX$SQCIz1Gj^0O&Mg2agNRHScmMd1%G4;0lv&IR){VB-%?q*t7B4)A>gk=CTP5yZbw zASvr%BPWf#$wWv&yD~d>qEe<#oZKtacr+N`Fd7d|n$Va|m12#O=7{4i0G+V1!Z`Wc zR#!z$V={xCBxfo+7^NjhukAjG9A@PFUcFf z)piSJ<(7p$Ap_D>C2mxYdC%FqJ!q2348?K*dj= zCm*oV*c~_EIjga%2JU3%#tQwYcuQdjcDH+U@dtmm4|aFAj=TK*_^+?|+up%G8h!q? zZUUgl{+qq-;m$S{Ki=8ve%kPxwAJI#G^@s`{du4jfPV8Bi8i8C@$-G$(({bTz(Gu| z=cVm=%zHdZaR1HYe9yDi<&&><7}jxeOml=YhP`gUzo>IGx$} zT{9TotO1IzlA>yj@VQ1GN^3}c?*6iK+&g-+z1=-Ja)3*+T)ZM6DeW?vq$=R8k$Uu% z#BT2}K0^)GFgbav!j}9tPr^716+cR*|J0;c16~jH3V*6MvTN|IwdLfk=+vmHQL*Wl zNnruSpYn#a6#PyrIOH9xwDddvso#+@#k|9x@=mW1rU$h4h`d%~kgC=gM1!QpAV2vf zVv%4T-MD?}KE}(W-JNGW)VoTAExe)cWqAz^+wG~_KT5g_r{2L40NCH!>o#SD%UJkt z(*M`r|BRza9#6i;1<=gReg>~>z1tbe=HfrgyayQU(|a_Gue>Lt zc;r1%x$@>~!d6*NWm?^bNdEo)s_AeZ5)aH*OeSSdl#f7U0Q%ARNLKwHNhte?%yKa4 zjQkcmD#w6;<2N@>^Jai9Ch#R}Jw0tbmAKAt`9ah#;Md#a-8(zu&NTXKPcjsY;4lOj z7tLXF6tZFEMfkKaL}Pc&LWT~@%ag$s|5Npn z4l1guV~kT9B(iYdP=s+HQ50NZ3($NBrY+A#c3ft*I^xMexhK_O!5u(JuG@0Ky{D=R zY>%Rb@<~sU6;*VsL%7p=On?aharq*qT!oU_cW7d&<7(JCXNsd3G`c$D_fGt4Fa5hQRIu2xhJ^VZX1nTr5^AHVA1nTi-+ej}L? zRCHYxYr7ydB9+eL5e7eBwq({{dTD$q3?%l~BnW7N#6>y2mX$p3Tvzgl5%DpeDo_TH zuf4Ie=kQ0BJ(ya{uhSyBV#OoccGvFI#=?k~NJ{z6}6>&Uz1X2lgri@q~joXV2wPeb!AFn{_P)e%GJ9{l}l-8SQ^&MKjkF8TfE-DjR^~)DeEQZe>A(hbp zN~8K@9cvtqSQ}tsrG678H=O&8x_ZCShvTJcSrZ+fvKYS88}Z~T5CP|n%qJqQP$9Xf0?XXgn7fk79s9@u~SF1OIt+t zLXnp@11i38ErNzVgOj~kCKY*hun??EUq~Rp$BHJ)U6=*vjOjZdPPg{s>fhn5dt8&&a23~p6J@v6e(Bz zqM2r^9kWb0mt|t6L|Wo|fMM~6I%;Se<%# zo}dm-b@PeWMrifstrS{XdbcdI67ZcK0 z2DNCGb^=WaEkVVej0PX3d7+BtRi{wOcr$yrR@bCoBndR^=Su>L%JZ#W%IS&dPphSl zE>{e+L9_(KvLvCA-8t@8bG)qRs~cF64daV=c+=2iN7>zYs_Rztx7D(WhRc-m#_Fd> zx5&v{2~j@R>mi;co@fJ&=9EU7GNennVn+wl`LrQCN5nr@TfD`#|6d>MXFfM;=F$ z{yEX)+P&dz2El7<6Smrb*qDWk3K!i3C zNgkXHvlHu3bWQ$L^$L>|vLi%O357tkwrQx+_GILR8X3z0>Za}_njI3xSOzC<$7$;T zd!y+V$zwDrnmFjir^YXI<9N(pCc_~bhmgxxWOQl95JZiUS~Ap74b#Ite<&M4F}Vhi zV>FaXV*{4VudHP!T7j4Y(?jeUDhr4f@Z_4|lqVfOxWODr!#dG;(g~^zp89?X<7LtV zd({LhH{g)UFe!4A50U~BwV?K5nT~OdYMGBsQPsHXHGk04%Jg?^cH@d68#5V)iiy_j zuuOEjJkkDiI`WkTLD^knDU-}jwhMK*f*LWqhsOYB`K)91*J!ylDG=RZJp0 zmx$?VF%UHw*1Z4iEx84<23C!&Y6a;lyrUJzXPPYH znxK^0dTQy}7B*vbpOD#Qj$KVm-VXCicT-6J{vdSYNv~EG9fDw@_ z_C&o@r}V0NppJ8g9pGEH_|fcD&BYDeh}FEyZx~riE1sd=Tl<2P8tgXAEV~C$WT{FgLlxY zV$o37D&a7E;%%=Xd@T!$UqRJ1R&SEo+ODw(?PD!B!8d88N^;VnTgi~i4q_GnN=;6O z+2w3GYD@yuxK?r+v+88bFK~WjnDuHaDJ14zit_`$@34!U3x=1nk@w0*UW{TwPG;07 zS}m63ZH8VUb#ok&AfpQ`DpiudnIS~?5S6EA-Og;YQN6J;?otUPG7xHWl?gss5@DrT z_?8>qlKHWL#Zs-u8l z52$qpL%6LQ=qoBq72(t^q6u0NZ=y^mk3Uc;i@>{^Tvty&I={xwFHv$j&-4+X9}zvZ z&{gt!^AwoW+VI9s91ZU~JUfQ8tgf^v0KDYdWSGY5LB+9hYU<>(0=^`KE4YBADoOXrW@ zR0TbL1HQgwQ4^QFaT@vzi6R@D#wgh$bWB6>A#bOkWzh<9Am@GVZf*35wt{pK0xOw` zFW@Jbl>L&F6-X^O)dH~NXyBkNCN?;(Jd|aUk`%`AACC&#lEz%J%Zig)mo3tKSH-{W z90ZI1YzBKL>{ztOE-bd;hq>5O`M?!f0BM5`j1BY75CVOi&@@WPWdx6WF8qht=c!9=x1Xo+K~3>^*hOZFTwhRj+$+#P2lK^(xuesfWa8 zxs9b&rIg~H%yay$pw`3EFxskP1B4Oj3!|~YoWNAQJlxvb+d2#m-|Tje0($m^K;5HD zd~s{7&j^R>(gUM>0Kr=69xf{EU5ra8 zsYNo16$M9prjf;HzW|Yye=UJ0yY3%XEdGldI-?b?V2S_!{G$N>LC(U_-0F=yP)3)mm6V3 zBl?DIY_n`E4kA3q7nUka$BJU&peByjLTpj_s8GR|q4U~kH9c28B!v^C@BIY0mB|2> zZ5UJ55vxj6U4`?@m&+Gf4o!*`X>IXwOj&SH0eXVR7adI!(9F9K?pJQTiYZ&{_cbo+ zYJiRnw&@Jszg>WtYQG0`K~o&~defdX3Oj!0DDA8bOOXk5g^#j@>kUjTgS^s}Xdk4# z^xVFYSY@&f{=XPp2u+zqQe*;3eMDbkyTN~B81Ry7_uQ%cJk z$qR<4q@W>&fDw#v8dN@K>SmBpQEgrcKu}Ut0-gG@3AP5jswenf=}JPTEcE98;uArdvK~QwO-}%I(M-mljfFI`5esh;5{<=mmV4?MCZVd8N+(J*ZQ@wipP_bZ`U>1Z~|Ne zrfs#eEWp}#UR|d5>q=S^q-+sn#J~io(OR3KM+X+{2+crQow{o~ViZ!<%s849*o>h! z_MFZbdPPHY@u_Ya9P|2xCd@M6l>2aFAv971+w${^PYZ;tP1@*8#q6WZ!6}_UOT0XA z)4v_}--(SqP=wCuNrN^s23$jdCoX6|Ccs8BH%vNV8n@1DbtANM6~4^|#|*y$_eGHg z{Ev7nJ9k=W=bIN*DqLt+y+siie?%i#{`buV`Ti+*cN3|tyWL6&f>F)8x|h`|mK%3k zsDms4U-n+Qw?M~tJQ^3*df#aRrRYUaO)#oS1`iKLZG?UGDOo_5%u0T4{g6WKOm1HNB5l$K6nt6=#!S#Ji~4_0_Ry%nrPrS^d6|T*lq<4 zw?%hOLnDj%rY6n}xyaB|!h|o!L!R1?>x8S5Y;ZlxHHEE|;sKfnH8oGAX$MsY1PB zs+Q7N9m&8Hui!NwF33|<@(xQQpaaPnMTr~r&oxv9??0!%FW&5LAMYIOTSuIw9hTNC zn+1C=$@a;&Muo-2v9xcY9@Ir)fk`{a#{zx*Wa*p8>XmOe(J&HaE3}66t*kt4VcqfX z$c9yHt&*ZVcrfWKc39@aX<6#Pd870eb>lz1$(BQvL@4T{Lz`5+`EQgyW*k<`=`}Q` zr@M=%1njZ5W>wzNMssXVsm1%!q#&L-9IB}0d^9>q&ZcMqCB|S4?MqA6fmh@cKS0+AE4o|_Uwf`swZd=g1{_B|g5NATO4h6yOHO!`NGyYt zUr<>L-eW-v!%E#X;(`snbRHY$Y?UIr;utnMBjb?bI<&CVxqq-vQZrS=ZO0e9N_Cp-d{=cP0D*0hr_YLMh;HE^b^d)x!Oyy;7V znv(96iNDvEa{XJ9q-m;M<@4*&Nj98Ch)O1+lVlW4u5Y`Px^U~M-UViXfu{n|&s=yR zjNtt{yor9lE-&-}@Voi?=_a9EH(|{gyM%5iESV`ZGYT!6v(8ug7=_P;bqL=|e!!Pd)#e$|W^jRgK?e%8>&2 zOhqjd<0?tZ2iL`CcSi5Zn>SaUjK;(Gc6-Z|MKbwj?^*W{wurDuzX$s}yYMf?Mf#nS zw839YX!v`@X=Jl+zXwX}VgdJedl%n|^dbeL{@4WAvT%L{Z;kXBus?6gz6mb#rs?y| z%wjc5crk+=tc3|vSJQLMplo%#7Q*r2n{EvVe03`rFSd4%>VVL@TS2ikZnhN{e(K35 zK`2L~Q89wF!lo{w(0o5iB_Umf8cM|si&T#k17*%3zoFp4X7E40eod}6(*@Sj1Pi40 zGcut)V=4<|6?drKtx`bK)$sNr(5=Lt+no4n%Xvq)PegG;D!g88`cZf8z!;bb+#dAql>|K`Yk z|DW#r-R}N|J4grgn|=7Z;ZxgZiR$@Da_g=yEV(UjJ%2u<-$!qr*>4xUQN7u<->$fC zpYQx+zx~Fmd*HPDclYhEmx-Y$MZS6mI*JS^>Tj1c(d4F&?3t67+RALL80LvZtZ}&_b!eM-> z0xH5c+*R2mDXxjtj3YoHz%JNkCc&o@#gJlz(q$V*3)R&rW}*7U!H}tugTv==$U_f> z*!=dm89e^fG=INs2H#fvB{ptpA$Z?{|5o6?ZxosQt&N#4u;`;^@bFW!M9Gnf&o1K$ zr}oW&?}4Kh^V)|$Z@LX*E$;NpK^);Jg?LImQaepW*$K}2oDWDqNQ z`&$RZczh3(yZx!$Ap66gCFl{~fEHJ>NvJIMl%waH{jI~l_Ff(Eb z2zvH}nE5b<`7pUH>sEsBN``3@9<0I*Vn70GK^|PdR&$0xWWZULEHCwfDoP=OX+}f5 zh2vz6PgTObvAWh{GkkI@n5G5g?HM=}wd6!TJMtW9N1au$0HS) zgVwL~bWwSAd8Yh2I8KAZe>6G7OjCtTX$F*Eom5Twbd`~C3|2Vm(Ac<1hLfq)J<1Q^ zMH+1K(41!o3JsM(&SS4IJQ5{(fd!4cN7=wATn=_HzH~Flk+=idIz#tK1f)Pq#Fq$4 zoC5hDMtyc!L$Q^@z|ix4HojK#t=e?wc)1)MT4d+bVbU)}hpm|S;rU%0>g_-%wwXVl za2L=c;HiLb%Sm#_DW)lKXVlzb>wYRzC61jpJjegA;dA!)v*TLfGi3|8v;VyNOZT~( zI*SXKI5U3OHYGn(%g$Y>)t$DbAoSqz1Z=1qgAyiC_#<3Mvxd5jPnG?|2vuLPn*{F5 zd#QwQGP;%~9V-D(nSuWLO&cqk_K1uzEoGUq8>}?5Q8#U+I6u~wyA^VKfgTmE8;cfC z(p=gol7*Z>Uxjn>n8sgoZ1qf9Rt z3DS#Y6<^?-pLn{K2T(%sW@NQqb281q~~sR(=P?N$&7bDYik$3bsqI z-r2?mL1Fy<&Tbfp9}y|Fx!QZWu*erA*2IvN1_8;-W>9BYa*7umW>6Ql1aYA}b{)=; zLiZF=r9JR1*g!vA5zdzrSILQ{=m!B(8-Z*5zG=cTF?v)6K2p>lfa#b<6}P(R!-WYi z&_@y5Geqx8!XZfo)cYuo*9svd`gF`9f*fpxJ1$K}dA=*GDNRYhub+S1+3hm6JwFhZ zy~3WdiZLQMxOvnAgo1gzD%kltM_+E98q?sEzYGTRj85WVL+mvbcr*hml(zDfH@IaA#<9jo*Xu&gL)Ft(R~Cw0`sic;fJel&E2sJC*C!AO$) zTv&BUv{Leh9fP!ftJSxP!tx(>Uw5~TW!*_OWL&UWR=uV-Im9C1-mDe0kfM$Ipi{km zZIhyt2F$%zHW;9!|NyQ|(U3C^Z96A>K=$`P5Yj|+S%O5onsWMr9;Kb(tSYef%O{y&M zjcKu>7NroPloH+qvk*8yK=h$OGviVH*#rZQ-Z2Q{=>WjtvnuQOHHD+%3u*K+6&{6# z!Xs#k+X%f5ey|SX+{AZ#ad7w=wzRTVRO+H&-9?BQ$|#HIpd>$t`@;z16?mPjbl}kO z^DCu6^V&VDDv%E554BM@ccb#`!HJR~;xb^YI$7%aS=&80sF<~C@vw>wI`&|!mZqa@ zBC6#20*70i!%lq9omoJm@kx<;^sC}jZzyb#p?d2a@?=or@yeZpm2XHzQgPf$MP*>g z@gygb=?)D-oSntyxu#6OHKuwXAwzA=IhES$?4{9EELc?TC2vax-W< zCx{m(a`#~C`72Km#1VPPSmc$cckJt%I^|EGkb%0+yMxIwvqV*BS$4U!@RAna#L{AX zRBo7rkiRwY&!=E#-{>fAiIJs)E43pes+}+!cagNyMN=JxpN)cNamu$-h=;6@S-KVG zVyLS-Rgv!bl}!KZ$Zlz0=rwU6)jBGPBIp*bq87B$!ML-}ek&12l>;1y6M}*eAPxRq zA%A!q3D>9Xx4ffjm)HV2l*Fi`3d8G!l=o0s?!spUt{2V|FKzXOgYm+>(RhDzVO`EB zmuSneYX?%G@=eRscV~ZHO{rbktv1_>R#_}=vc011OPiz>uC$+KOW?5F_42n7D0y)j z@2Q&$lA9H9m9C;F1b*F80`!?h3i`sQa z0gzyl7?d24)mo7f0l*eLj*>Ni*jMtZl_ONd2h*EUe!J6K?LsLABhsy;N1iE*^q+MP&4MrXywLU8THB z-qsQ?91GmovSFB(y}(9Q}mRh`b~D2%O(@p-h3|cO`uXBcxZ~; znT@7OLviysO!q2#Z;IZe-`jbiiAyOy5}wU<0gSck9!|U2V)1Q`dFJEIrNxCwVPi2@ z^|B>1oAs{f`ec4^QfK?@-gNMV0G3xQ5#>Xt<($AovJn(;0a-e{4)U0FP5Q86oG_&K zKCkbr)N$>qv~iV7Qg;D?Xerc*??0It#_LGthu_+_cJC}Vbf3r7w|EXatYe1Um2s;N zSW|Pgx@lO%`ny8w0xtHwpH;n8b-v#6>Ts4?!#g=~W0dow(IMYVuJ4q&(-;vQu$ zhQwh|y{~fMt0vzI%L_bfzI$1fXZiYq3G|>F6jKDhz8w}o3Rg!5xE&{}3L-13oQ3oh z86nM{3>y~}#i^sp8m5RUdUUD{eaYw(1{1Bruv^vlpN29xx*e^3HToU05@z-A`}1f# zj?;WW*#j|$OUFcwA>u8zIuYpKOBc8G^tfz&aKY+D*U&&23h;%ix^hKd=&;B~)&LvPr{5y$#AFuDDt%P3~d$ z_|2i#BHUSdKno0b1&#T+5Xgd-HxV_r_6XL(H zOD5!{+T5Ab5sSb|@e&z!)lTZ_+_^OIQ)^iK*ip{>+OT*T^kum-bZ!q*3K@W@`kQpSzW$lG~V)RhE>URl+lGfxnA}pYXVEL z5oF5PJo5%46S8SBqo=7y?gL%^`IKN7&OE3-Rk;FNGwlTnsgAy&7F>Et;V;fI7BVpi z2C7XKsv0ll9I}S}9-b!`zy`bH_m)JB+YRVI@V#ZQ{LV}o3~M8nPjW+ysiwz)%PL? zeR=OnKD>&%tei?dS5+#d%V?6q@!}j!Wrm6!B5Dl(=pD?%Z#*M!-)}6uvjd?eIdxt{ zp0cl)iZCeU*f_3+{n3Wz3Z|YCGuBd&RITXIi9M8|q?gv}X(>KF^hRT-LR7DWRmtTY z{DP%&^(p$Q{GYyhG}Qn2^E2!7F&+=&NvplwUIEl;Jz8!rcUJOAe`Ux?f|k#}yp2`( zJbw5P|F*w<)VBZP=iyqX{U7bs$L$V$9=9L;$7=i0x8HXDBUt_Nrf>dCQDqeb|8bt= z=h3LX+)eNQmwwnu>Hq8u)&srb&5NMD{OH@D1IxCuy0)_VebD}Hz5Q@~tsP7t$2 zcCW_4|G}!e(*?DFkwe9a!x`x($yaxntjT0STDy8ld0Qy}H4wcfeOH>;mO zAx=^p%n!+mAYVS8w;yIFAL4%DJ^W{q;S=R}WkvWhxmBnOn2Za%fNU^PT8^_mw_=4@ zCjv$BPVg@UEx|7wcm%(_YR=8ANP1|=$!(|g!$H4Sq69~LA^2=54GqVWr0?2Ph`QK< z%B+SCWyhr`2c>c?ujql5%KN=C|5N>tWbjoTC!ev6fW3C~Q#;+YGa}`FVu9kY)~dHI zC_RP-NEQG^?h}6c@4eUFJnGzh7^0sGnLznBmDFAWRzV3R=glHT#JdR`2S%A$>Jzdd zA7PLi2CqatrF1EB*MNoCh;W)>eLmt<2vA?e7ht|eiKdu+oedUZ3UfrVY80G-=$)DvgizJ%uF-a3cU8D@ zQRPi1lQ=cG^#Y9huaM-J-2_z^ z;5Z$}N?M3U{Euk@3oZVv?^ArL_IM&GS2zXi1{1CKwy@jkFRHF(} zRU#X07(h@Aa@$^@thaHvPD>~M(a(2Pxr7|WerD0JTJ7^}0)bg&Dx;hnd~TXaU;dc+DW#;uK1i_ne>X$*zwA@b{}bI^y=f07piIH#A- zpPE=i+=*UaKj3^9hh0Y~Kw$IE6S8ga1cE{4J)pF%?xQpR0UWj7lTkeKp72EZ&(JQ> zdq_Nk|7^rkiW(pf7&SAEt8lJ?U$Rs98Y~4wR=d9(A8sAJ-rDYlx(;R%rh1JbRKeU5 z4Rw$#Hi6)VVbH3tjR~8$F3?g{Ta)N!;KLhM^(EAT)?P%H!Qx#tI)Nr~3_`(AnEi;z zKOk1}M9%0^V%2tEda1>U-{ng3ohOLU>GJgk?p~u=!T2JXFe^a$jrUG%1CPQL>8uA!T zdc@0GxbFqj*G@Rp8Cg8N?q#QG_Xs5fTJ_-%>rN_X~UUP|UBz?|{|c^s01 zyrJ3=dp)c`3yceBp-0ok4i6KnD^jyfcV(?LH*t6<@cmdkd7^?Y3;PiU>;S5mO|Dy% zw4IH~=-M#%L&2Q(pbG@X8zsG6oDO(^&K_SxHS)^_-)+Cye{bfa8w~}0&#>ken{4#AYsAb z@zyikFrHftVSGk3kaFyr;4}c_SjMUr^B3>;QI8^yNpf`MAb~A*_qvCNdq}W%LAbm8=<=fP0JQEf=pLt{6s#qb*^Gk1}rAb;-!8 zJR`LE@6p&Td7fn-%TGp8{?V$6_>Ye{ucvvANO>s`h<2c{WuZ&T>_I`qOBKDq?xrTu z3SzpA<{7#51gB-1dz}%=EyUl37+u5zvWv7H!pMbSt@@;jaJIsrmDB%JEXhr~2+F?b zQEl2cvJ{T1F`6=HNl}wRImQ(}ZZk0%4jXFk^)uj^;Oxfgtd})bK zAfQm^te^1!{bH~QiscjujGe3ABVjlwDS95|=gtEmWy(!NLHHX%V389+JbcdI@+-2 zC$v4dciX&nY|f0UhWJypY;{Mu-idAN48HqbR2@bT7A0dEqehkVU^CG@d5qmu<8@KK z?QS$U+wrl5!tJmQuXrvHeYRfj1TH=!I$N}A3o$e}^^bnid~bO8UE=!}=~&^KNUj@; zr(pv(8V;6DVt0=jvtd0WY5_F~w)YU9lJMj~1F8ezK#HP{GE#dww7XEYaI$ISj1~PU zArOYLNs10)ZR6)3caFQO&vuTR!Hb<=y3gU8I)g^h?CgbJKzR8iD*Km<2;pMJ^}?lU|Ctktp4QHygkCjm}W%}D^?$5EQt z2Q@r8>vQkmINd%PBl{~a)S+gbX{uwFaXf~W&-!+6@gY5Vpew5;P;PS@g(uM&%GS=~ zON`CoJSj%gK~zNEL+iw{4lF$&8U>^9PVeRR>n&iit;3)ZWxEm*BF{Do78T zuj-q%!IU_`DgfvXWJO=X@XE;$L5wg19?P=|n-o*O>nL=BC?KO7TzpP<>CC?VA|F#ckX@bQ?*sr7F6s@2#=1RqbPz7v}9F=Cql!qY-=2cCQMOc&!332@C)=p-5 z01N;!I|Jq5&9@(9)}dw&=UpQSO0}GG9I?5tu2amNOK2_^`w5rqCstAXRVsPfOY+@m z#3k=r^#Ja2l5d-mR=J``ay4ihEE?2X0L|^>d;7|9p~-3|KnIc~gfq?AUJ3)=*IZ0G zs)*l631*NVg;1Vtl0^9-2Q-=(uLDa1A`-cWVg4{it+;5obMU#{0ELM8m%(9y@Lao>lDnl^5y});5;Dpm5 zJuoCegk8s;3l~6IVUlZWk1c89oz^0v` zh!hps2(9vl*FGSW(OnoMwHIu>)nGvVVT_m<`jv&5m--ZMn+YY^%LzPW?A5ZLkaR>) zluZ@>5rPzt#@Ph1L|z%Zlyp`AIWi;!a04(euoO2N=BagE` zMKaPD2lA$RfFOKeQ6IB73@P;l>MCqNtc8$0mt6*2w%jHlPKw!?$0k?M!+k z?T3U54x?dy!;r_ux^BXU&I82JAMyT4Rnz z_O1y%tKBAXKfAzSQiv1`c3eyb$?0j2iWt_~tw&OiV-erro^ha5q7xeyOZt*nQ4+&m z8fNcJDx5(LYk>rWy)X1wS#lAx|Fb@cEnGxVv?4dp-q4{tH4nCdm&PXb2R2A7b`komO>b`O z%~AL8`PT84Zf@$eHgy`Ca+wRaOn-QDL&}$1H`E_`EuG&CW+WKh}#|Oc*pd5a(hy^Ol{Q68=M}ExDMW? z*W{m)Ik;fHSb_wnk(j;H^93?=^5|NaplSO3c^P72`fQ2+aArQKQSbb|Kd_4fDcj~`z^yCW#H)(3J&{r ziLXLmGYZd@a@1BKEfyz=g-p~{IV+8|?Ex7dC=Co$<>GUmeze~DOuH_h}?S8~!s)lnol^dMZQZH+g9^S9Smub&-qb8tTd$=ig}5*(^iTfljQxqd&RK_<8%C z?a-N61F?$W&^4TZGZOP}EAo_Qa;X-8zf~Dos^{DtCAz74rjw2#g$9Af%Ya$_RX7--=f=X2A<6(HWn`0(3bqR1Qzkw%R>x`$KEmOk<9YB{jAEiOxtm) zLdKMhd4BtyM5!Gpy9FSj{qc39$d}p_GZhBn^qLJ~8@ym4l?%hSLqxfSUso5D`!l)m zt}=2~(Ux;-BPqOc`Yd>_$-=pV_qf~iokn1nvP`v#T%#@CPAx5|byrVd@s%eOU1C{X z!P^Fn?@u-Z#F3r-%Ys^@XwrV z<6Z?FqoLVP(a%d6;i!HINXfU+7(RXaC|r`5O^NncKntG?v+t#6&0vtF3k6?_Z!P*3igEd9JVlL+J~$XT&V#=Lnw>v+0{v;6KYiK> zm)rqin}nfn0bu(bBPKPNX|pJ8Jor}OnrBBIzEfl}$k6=8gz2OwfJ=r7t8>euEf{>l zl8(71VVJ#(0n-tk8o0Ga;|49|8HV$kAc~Ur9ht(LkdvgDqedil-#}YesTPtPpV3}# z1{u_a`AE-VF>Ln3Wfi$g{&l2WLOix9$F1H30;rt#={g`eXZLgk1f` zB8pSn=5hL`ZP@?wpBv@>e|`L~_QOXN^8e#M<^Mn8Qz8Fz{I7>=tN>VjxYBtPfb`#a zxZbV^08mx{e7XE@nTV03e_oRP&+pxv>BT==u(zD=ftoYOMsA$%9sNHr81Sz36ll56 zqlYdawq~CCaQL)Yf)@nDs-#X!I-a1K&F;}NI(VTDbih)@R(N|>)t;Y60KeWWD5>t| zo;=fPhkj?#*%aCuV#Mo{q~Mt`l7{8oa<4+WdK-m_t(E;urosmCg{<`d^MPe%(*I#{ z@~_wbK6>=<(W5`<|G(+u(SKTTqW|r+P9!G4Z~|a7nDvM4^>&2`Fzlmr5KYj+Hf#yVg2~MV3oZ{0)Kh*Tu6>GyrpKiR|0PvIE z(2ude(v_lRVv(@RX>Q~oCEuH7@L;GNOUBb2R;Gy0*gI}$3j}RPcW3VP$5}p!hnR}O zd1mOS3KmaFU?_<8Re~W(E4mIRz!|?8#S!4k3EuvbrE8qJYLW)jdAhlZ$#CIYux>RQ z;wcRem)aFE@+ZA~dUDegIcEV2gtMm13>fJMX_aL%8m6W-pPf+6sbv;LgLJ zj>rG&hEIL|yy2Iydi<}(XyTZiVt9A7tFk`dfbeOn1q5Q%oeI?s;l3g@pR@R6F88mZ zvUptFKrB1xPFkk2V>-w;}y<)*ojrN*C-W3u!^)7%D+E~HkTqS98{8#?!PS zovVU|&e>j(P|Hc24-@i0VomiCly- z706|6h~8OT6xmq2R$I|jCudX7<*1ta+(1s+IJnK!xv!>Fu~j=VF_{@)pH0r_of&?g z)cbuX2lJX>i04F-Y0WzoEn1~2()&-Ju}d!}Nl^~W%6k%J^~K=C2-bAf%TJ&2U>o== z+|?6h5s!v7m5X8UtQj=ytsV+oyL+pZ>pZ}az|}EuDwc}o6h#9e8;-4?W^Hr93zbsM zUuBs#2~$8_z`{IRgahn@UA2d%sR|EGJ$Hjr&)=SwiXrQ7pO^3gtG?bkKJFgw2YXw` z+duB?zr<&snLk6MFA+<&w_f+&?7!IA-#PlR`+Tke9I5l}^}*2&&Nsa2ge7mmJrwzj z#lCX@O!^d)!-^w>&OO<5($`{wWg2fP0V}F+l!M0mUso5xnwmBuDauY+N7RLEfl=-? zq3B0rSQPZt(eX)O=bLCHq2n{b1iN10xXVH zR!iAbL2ENuXfJ5&2f<>Ma`0i^mk}ln!@0sI_(Kg~_)gtmx~O4WCfWN0>+V`qPIZk; zyd7y_SfUA1wpU~-;DtLLE7ciw)#|pnYQ|r!)&>`Oif5EO3iZ{jGd_G-H%8r6)x^!? z743%_%e))k&BmYp5Y2)Rsr^;6OO1uElGJRAV{;l&Dknl4lP?K}hsIQFiVf~eF+|4+ zj`08fos*KUZXCBA$tcMw_P!a%J8u}$MuR344V!Ty@sb{zy|Up z2k*amw-B1%>$o2R>D|H&b63iGrHa`%_TFA0?OKm;h!{rVF7VIL?2<{$rcZ)9O8P@{ zcpHTlqJ>}`3&Vy=@@P0dkAU&m;GA9?R=K`iuAdf@VRgBIU2c$^!NFTuZfKX2zEzbQ z+vUc1-d2~(?Q-O6UtMl$mt&EzvfQORFK~2Jm%FmdUCkKqKTW|#UxFXnr8FWaC0L&V zoAoslsGjTT8lr*>A+87a;ZInise~sd6X5IP!o?Pc%D6w{zCofqIkROT+%WA>?`lRP zE+e_^+?_%xH~%hs`;!q*mzKtG0I7!T4Nn`<7{XX|gJ`$G`$k`}$v`DTvsq=5pi}lH zBNY}&an=x83uNX64?5f%yWP!>-LSOO7z5)IqU_bjntl9cI&s@R=o-AdUU6%s@6#in zccv_=G!wU4&C(g-ZvW+lb;F=a^foAn?z!o;z*s4rI8vi}J!poNA*(qW>^e41Vom6D zJZ`l^ZzpJ!_oi&aCyMrnWol-ftEFRhV+N>`Xc(pa3jWH4XdM@|pNg~Hpg!?q20hDC zh&u76sdPyndGlJVSkt1miTjDAiO-F%r2YDh8NJqT!WZoP3QW8F~<{b%; zMGG{E!g8VPD4|IS&mc6&?iuwRpmvzzby8Ny5XmA0z`bE+t5)B^yj(4ck_KD3LRU38c7*`do34 zy>7vi^p9L{5=b^SZZlnZ)l?~SRCTQQ6Q}n|ehaL~J&b_!KpoULn}h(EqMO3vS+gyq zpW5;WN-h1RtD}0U^zKyCpKVfbokwDj>rJd9`};y7iN5sWspL5~(s@`#YEkn!qJvQM z1x#rxWJpqKh$U#9h)KOx1yl#=?~+k7LnE6GYK%ke)ft)tIyjABOAfTgSA$ghX_|th zrB=bdT%CBa;2q>eum7*Ma#hD2E)5y-y3#%jHuSFzWHqZ45}qQL zeRuoGEp@?F7kt5_3m0{}X}7gH=JK7ik2tNiMu^5Jw>;G2@-Y0%jfO=^T0pHaDKJ#k z*@MM|y<+D1N(s#X4DX^3dTFUlM!q5oC+L*`+lUK63V^e$z?c(oX5cl@2o2LHNY*6o zPbay_%2&f1Hx{fM*^|OuSVgKWfg)T8-3Uff!AT*mCdH@^RdjqIr9W?)Mk}p)+||y z9OY3^7Xw^%Jn?$(@&p_F4I^zQ z*)(@L7A$QB9e+TgK6>lup{f;NC2iMR)OJa@mie3Lv{Ch)Qne&?r3&>S2O*`lq-h$5 zPIwrYSUlgzmBR6`q(RESQTah@r3ekK1*$Pn?DJ7XJJS(qPwKY{>z{WSLt#7^$JzTT)ioap2 zWOBRtn>UVVL+-G3I-%RWPu6#WGB_QoqZ&7p%uUtAeJYVIz!RHxQGhSj`}*W7xAYkt z_bb-^crMKU<7=)BO{Xg-@em?)*8f>x&*Mn#ZnI&k=)8;VBrpFEpvKOKuXJdu!Ps|N z_@QYwlV){YV-&tnQh7h(eQ&_TRgC{ zG#b_uRV@jbbsLdB&u5|WM2z_;QZkiGRDID(uznLO-DU6N**NRWSk$9i#oIL!$$LhmnUI?Jsr=~mjeZUtuUhf-5GZ`_!m>x@QQHw>)-(l@FW!s{;|41&{NIsYQVp+O1(nh0Fu!5*_0t z7ROa)fGER&R8!`l==Q%#v_iyo*M@}~Yv6Lx%nxnSVGatYN=g)`^GJP%=y`dq`|pSg zB0-7B)ImhU6*WSWwJoqvt8I$_iYv$_6ZHJ11wn-t&1hLQ#vd4NYm|=Gh(wF633RozFSIUn-Du-bT6BjR0vf( zPP`7=Fj{zQr0(dZEC*yX7yv3|!&rC=OG{?p+`%T|le?oVixN+0Pqff(Wj^xF7AkKH zw3UlxnoxqGrA}`)ltrI_^Lj*EsO2#9+GNq6l&Z z5vGI(B$K#ULCg#?YHc|A91WsxE-7OWNc9>+wku@Ke-b=V6)f{fZ~xFalrZW!Mw6<)-(bN@ zw!iIAWyz%tjuoHa78ek!THoZTw^-Wb15c5D%VR>rqq7^&2b`!PJIP?PN0jL9AxfAk zeETrzCunK$k7=A27WWUs9G^@+Hh_y!W?V+is6;!!h&1C+j=<(>KcQU1!4w7gFX zf-c9Yx{P(00}7_X90y*#@D6IX_{*417_;5;jyc0BYbJ{-sHf=;HN5 z_K$&%%Mm!p^eog!6;M$r=~r!I0874jK-^-R^~fa-!QfKpaH~~w+U8lew2cmtuyOK^1Q+``oC&OSns>WG>aNKNmVuR2IP2m zOyf!ulW){xHDsUEBlU$vOsRI!)*os{d74Ia~_%u=98E%(Cq zGxWQ$W~rmF{*z6s0sD<*^k^UGdUt!9l(uNBFM1eNC;gf|irw1bUIv`Zl3eZLR&H;3 zip~c>LS05(pR%Y$P5l7EWf0+g4C;pPI<-0=oVSk^M2F;p?2M71Z<@Fnn-fPITe^Dd zntZilpH-rBt$n_5K>F}6xsvE(zQQ)&Jo9E^)p^nHbL3^pb*Xn3Z~(JiAI@l_VvxYo z89UlF?pHc+aTg{Kqzu1|a;SlU>@l=_y)xYgK;50M%I^%aL$88!wY?q|PrinfRKfh} z(0a@Q+a(YQOO!{L+coW_<#Vw^*Fgp*9N}PC$otBa&lZT3i^~ZkJ-XmowhUUXc1#G- zF4qyD@4E_f1t|2)oom~&*h1A=WKLFQi@Xg+RBFS?8R#5>Hwuw*AnroI! z{yqC|_MUYQ*S)74!_eseXh+d>pLkO&p;IljhJm7dhb+ZEN`yY!D~XU4)xi(mq`L%H zDS#ac-lr7mZnY2jNY5ZPJet z7kq2C%o&WS=3Fh-6nI88Wy&EMB@rCkomk0gF4C}>mYr*AEY&sX&_tpt%M zeoBlbF=VOBPa1^+Ep}|3izf1~F$6>=+M0>Vvln}_$V|0$_FD7;A&HP?9)G%5J`?r0 zOp7fXiC)LDCu9}(Tk_$Bt&kT`;hXQjU;h64(*@l6@!INlctvkTbfNgL$KAcTN9_)_z!c?l7@bif zmPnxM%pE!*mjdu&ckAWR+(_|MgO@e!TTO%G5b$NX5ptS)@hTBV*27AO>3W2wE0 z^oI?Nk$>ZXTm|Fd6fKV@Ktl;OlEd(xH>4K_hkIMcI@}p`GBjZ}@!;CoKYnqzx7*#v z=k3+7%!mAAn&GULlPx%02oaUZ*=I%)fSPWo2#fz)m|rLb1L19}@1k?Fk@-GzeqmkN z8~kd%rVIA9W2qe|TEX6_*NeIJ(%NuF_ad!KDqFEw(fMD0oy;q$eKWk(TfkdgU7bhe z<_!=lE?@6DO#U}#a`~xtxjt3f7WX4b5_&^~x6{d}Xv$BlP_`Auvrr0J$YK2d=nkNm z;6)&zeUpp~wf?|$bmEO}EKQZZd5la8H$ujg&OVySjHpp^;__H%NoYJhJi8%ug7P|b znGA|^)2W#i8l8aN=BU6JWqA>rigLg&YmYDOm36y*j3+>J*}eHxKa|_dB~M5; zv3jIJTgb#N61^vE=WmS1JgA z6jG=!AAJ>7WXx5k6LWc36wd^BhY#Nl@p|N)3_$fCdPC1y<6$Vb>O9n{qwTGrgR#}I ziCdL!>xl4`YTJrEY%b`4m@B^{#Q>j{j{=$CnFj*YE9*MBqT&_#*OIhwYmQVYxuq9R z0t>9;)~HI%)QB)wCS7qjGlH?Sq(^%fD72Tp`Nm-sf0JAqIQ^b+7|sr@t2z1K8EcLL zO?uGsO|9MgZHd`-M|_4aN!L#XYN*;u{f zuhO^7^lfUsUYW1Id|{7uD8sMb_1JW>tC_OXg>|pknSS^3HjB~^GzMa?o*SV;;xXV_*I@_oF{pTU*##?4K?+ZuzJdK(X_Z5d2=Qeta~Z- zhHr_~?Us6)Pfr96ewC*%H}Vj^sb?4kLOsRr@?3${H{0?YLcld|ZJ7;svJEhhBi+qP?auuFVp;HyjpX!kUU zhXXDT>a~d=_(cj+dt>fOy7d!hDX-cj+ z%q)QXqBf7cZtgV6CGLib?jHDfC~0LJGV<>Z*8MN|)W?6PS@;^^-*1TjzV_|o_No{E z{n4Yx-~Ji@{g3$A@!w^|DgEbKM}oh%SK8kN?e_Y^@7Gs5<>2qT(};6_dY27x% zC%3yZ0_?*ZHP%ySry5rDG2-m*c~d3tZU&SmJU^F0;WC0a<_g3OqDm-cfSlm`68Ow$ zQsnEvWJfmiA?kD+mC4%^nhzP#mfy10WK)FsHD23YBY;pd%at z7#!oHelbPXRP^(@lyVju;sq=4Bk$9NfHd^vj1UzFg{_3nqaoMJhZzj%BrYyvpuej$ zfRs80%}?`~M(`t!XNpW;6pWH93S@|Rq|k%5Paa>AriB7JJj3kk3wdx6O%j@Zg0aQP zrH~bb$7vxQ&ttVR)b|KvY#_@psWRP?Aqyc;-m09zXbY!CvK%in=d4)v1@o51jg@Fc zFm`5+kkA#U0R9oG@f>4D_k?l>TFpv(*=6ds$x{+zn3ouXab7AY!z>yErxE5n1@azI zG$RmGzG())un=>GbtW-F%Y(Bl8!Ss!8kIKy4wv(rGYQay-91a~AU>I%d5HuDnfIWS z@a7A0+w!)TECq70q>LDf=2$0cuq%&4J)gvnW+T`_*W(!N z_GvC*Gt-XD*p(`P&Q9^t?F6QqqQ}GR1E&)4RydEZg93$2D1VM=YRQYBBY2!I+gEeg z4IDbo$()%EoQmKZxqgt@Xtl%N$)UJ3rxcBvMmJ~R1v_c+8ecWWp&6gKoK2YUk{ee< zjMqNBvwH`nvDn<4PI)UzVpCk_AwrECrMgg+iEGBb1NJ=7KYF1j;q7A*VDnnZcO-~> zlJLO$JNPx=+t{fv>%W!Ch}`l?EK4Y*D9JE9cA{9gz^3;(j#j!u9a+ReFl^;VCW(rQ zrd27B3>i+I&giX7);nb^L6&(b-XZ{8K%>93m6ayYE6ho#R-wVz)LIPL663z;?dm)1Pb8_Cg<-aE21|rabYm_f9@9u> zt+OC=j}^Qe7rBs6iJZ;@_K!kXh;{1ZpoI)e(~m8flgM8K`TY|k0j#ha5w9Ql0_v;%{Cmc3}rpN={%*elBUQQ z=Og(u_@b8?fvo~bOiBbnxsbc$|PTOf8W z1)F8BVptS)2c(z=YM8keG#Npj#hEhYX&6A-@apm$Hi365%&axFU4h6WC;(x^Y_H$vx!Xj zSR|JrIxmXt;gvT&LQNS23l{u+1w(Di zs0nX%p~cOh<9HI`G$rpSjg|5BKtV*_DD)wNWhkZ^P{=%Di<2m2C7T}UcoOIE#R=Ag z1GHz{8D*oufFx;l=>)H#`HaNee>kjJf|R3~R8OrT@Wv!O!qZBl1z!-C+t49K(5^Su zF*yQN6ZutjGa|B~yuk(7#LmN63jaPajajl?8kN&?U`zO=%t#HEpwQXo0#=O;z757*B^SDPuhXQGB1gL@;u;H+U$ zO~}hEN@{cJYN8Y!a)k-nhU!321NGy^t0^I67EQ07ZB?agjtiU&E$&53*9orne^2m-6*`7^(PStFPCkEWSC%!Z z944;D-A6fOcoJF!XO}}Q{iZgky*D*qswuc&fe2v@#*e1a?1~tGiw~UC2vG06erKYA zal7ob<;5P+D`AT114AdO6Y53ppPE|;*~TT2ip4*bbWw#;66nN6Ff4gt#z@$Z#+L>Y zc*XZ=q=xWFc15$ydK;JxWUup>+nl997JkKJi%ICpPScu zg!o$K7)tO

    t8?`7~gA+k2pA$Bzq>{0EqZpdQ!MtIDfO{^@PE^QInSI9PY#F#z- z&R9Yn-R|1F5j9Ofoqenzo~xB``})M{>u;64&Ce%E`qAF3HYH&&8|sLi#H}PnR?}>G zO749TVdycFP1HVNlT85v*seNr%d^%#X<6JXI)%i`_z}&4P#EV4K#{ys@Yd`B4^+l) zJd6mD{etAOI#AwlrZQN~b2)TN~E5QUc}HbUh* z8J!ECr&L4ab^5NxL#Tso-ruwcw3#d1(lj^Z*9iri{&*CnlepP2ZzetKNDGJvP}i6e z2=je2Ik2+C%D!%B!fW?8_#s#g)_qom8*{c`lL1x4@R$e-R@W(4LW)0HUDFt&=nyf5 za^ftt-)Z@r15;Sc8S(kbJ_NYd1cP0pm53wd8~uUiXxuZ!hy%3COiRM!p>SNN#54pp zRbTvS+r1%> zU3`q%!n1zXKx-fq4nuJl##GgCHt?9eE^VIVe^%AR7V&7Dq4BE9u-zbAt}Gp1BO#;f zvk}pDO7@Y9Zby-Kw;}t~TU8v7#T2P$H?XqzYL9%afT=#eaZ+t*Wy2$tL`rMOk#)~0 z9lQjvjm4){R;UzdtTRzpqVg_X<=H|jUw99kV$g8=FQTNyX;OxJ>87nW)TbYE zx>otnziqYNd9t?^nmwBi`PP*#A|gJtC`^btuw=9GG0)+WFXhSzResim(FWf`G`*WS zRCb9q9a$GDJBB2u)|P{vQ|y6X&6vv3q8dB7G9-#LS*+vqB+8Jl8H_-H@u6UkRSXIq zC7v(@Y+6_&D;ofAm}_{{P29F`VN*k;%V(zp%FZvaE{D~r3bnA(Eze+m<0SSX;~7_| zWgcpTk>fBm^4Mb~9A*rMFClR(DNSQEUDO~>!J`r)DdbH}HU^ddA+5wdOMA`SNa^Mb zB@O?g(s%`VoL{)%v8x(^5lrgB`J`xuQZ1)0N#Qx*`KX>}W;AhH4cjW^0n%t}>4H5} zlJtHh^t0weU9VT+Hw}qru@st5NDK?n+?!B!M-Rq%Yh6+5{3aTl3kUV_GR1?;x^^c~ z4$XscEQAfHS{se6t8~I6Kv_kR#@91PwH(020$Id+Sn?IaeHHrs!a;31;k_@pS)n@a zJ*T4~Fw17;HC1uRYxaG~cGp=hqySVw-IdH*CQHeohobUmU<(MWt`?742l*m0;6<^b zV*|>yp0d&4CgQ97*s$Ifg?d#KnwvR+LodM{VQs8?&Q>YW75iLQ4>zoa}r?<1GyQDcQAXy$10zw#_093uTWdLB%@< zijxJ*h~HG7w7!;}&bGGtsCYWEl+u}_mI#je$feW)FgZ!&zGW$$={#iL_{g$F#FRpB{NRAo=H=oulPbsZpq(}CCw z0=yIT4;4wA1lTdjrf26a^HPdqbQ{aMFQ+lLwTrVuk=~M~)KZlSx-x^Z*x^JS97nCt zU72n7u>>Ea^|U9}669AE|4mVt+}=5d37tF&u!_lN-};nnK4wAmc9TiTEI=UocV!i>i?R4)RZ?6b6?x0rpkn=FCnOD9}j2@Nr}aSuK= z-J^WQz#n{^F>X4s>c(9@zv>6?on`-$!ROk;8^>=b$c>}6?)scpc zqNQdJ(LR`qeC`^3{XiyPMgaT}Jgwp=DVEUwu}PaD*RHO_CvJ~X9-K^*pyAO70xuZ|W!SzHaR{C*wciQt#h{~uU=;^b zywy)b@(a+$#W*luGwAMys@q<{Ez0UszDWE)!OAp(vI*@Z<}`}V*c~T`^`OD48QO`? z%!ypukP=e1Zi#PNWOtcO_eZMx)++n!>?QR|tP4siNO!#ztLUQHXpD_>I5 z;`uHR9}EXWWun}KyReh-x#W+jh}>@Y@gkmgpS^h*-n+*<93jeQIfUsnfK?3OC(Fh? z$vL)%==jmGPm^|MQZ`_kmCx(H%m4qT_z&k_p^e$`A67e^wTI>S50C$h|L{kA%JCo0 zDgHxy)x>{T4ccq#@c-4vUoHLvY|<1{aEO!qx$iZ9ey`e<-FN~kJEA0- zAh?q{Zo{hhS$zJ+jV;eo^vr7h_U!h}eVDBqnbnKCNSqFwyWLt3)eWnG@cCva)lg>M z(Arh*>_}Bv*<+M8>Q7Bm`3sKE%084%Ngaym-+m_k|LHUP{7+84MgXYU=YRXr<96FW z|G!=9{CWQW5g-5j#}x+#puN2I9Wnrq;PhYVtOf0F*Vn#VZ$GMF05}L7$u~>{_M$Wy zV?Gm7iQg(3lpRQC0A#2fNGCb*BI)ezJi8%~PBgv3;kdzWrja}|@Sz-0#KtbgOBw3O zrz-hS>KGkKZUU)6Zu*X91||YMW|F$_)!GIRm9bXar8H@(`A*Z#No1S;x5Wu1b{$_-a1ztSJ*oukd{>T3sIM!N6`7r`PR(|^WMOv86;X3(=c;7SVr@&PQcU3e z2y&J*uFqaH6DM-ba?`%CkQMFbE3Z+;v4s9L#dx@kd?lv9+Y^gqQ%b6B0O5vo(v zVhl)el4rxXh@FU^r9IM~J;Xw+pK1tuT%zZc-oZjSHe7SU6ktW*rMVPe4r16lZU}`F zr?j0K?@Tggy7$DLb!{3(;ZsP{O=hhfO`t6^B($Z}nWHLNt%`14ouzKgy)I5RoE9q9 zuj1g4xQJ!@9J+=9Ku?1>q$10mc!I-j zo{l~LMzdGF6VKY8`h8wL5ev4PFUalFcj&%N3cl(X-Io)Ljc)Az&6+yVJ9sJQD`RC_ z+e%r+Yg=_4GRz$mOqm`Qe8+)ZD68`tQeFs|y!B?;FuS3gVXmX{qv>?JtD$Mzy5m9r zaN1@IdMxgUDF(UJSSAC8R@)i&S=F%R1lv^OH-0(620VBIs0Dvq4y*)g$xdN-;{?-} zC51Z`*{~~DD%N0Pau5MN$zG=lq6YGMzdG5<(9d?F(^AJ{wOR?#<|rrQ04Ie&Jhm3m zN+E!;m**)vbv&-&uF8jaQbve1%`an|RP$O~mkhC??1T=-E+^TrCUuMB+l@o>IqMP! ztlm(@Olntp;pdm63Uc3%i3KRYDBgLAMb^9ntCW*~{oU_#xBL_@PTswE+zj*#-#SSC zmxW8gs(+a#{f~H$O3CF;;9M94=#;xPJj*6<5{<~@bMN5!o87I}+CnopBykc%#KBp7 z33WHHVz4zBBsomW&v8D)021x*zh7Gpo!}|TExA*ry-S+*<##2Gu6!L(D+v&S{F?r|`e(TND+S?l0R2cgfVi3&{LVrRnyHS@qL}>^N_w+IvQ!zN^>@MkG zCceO?8=tm@c&xUas4~Jh`kWEcV;OzjxRTlt4{Jxobylq%y-H&zgC+0dJW9$LkAeD~Jr4bl zMh&wEr{QbtCQJb`v`^?8>;vj(8go!W+9>40JX|6IH3eE@A4l>s z_vtkB*>IgIXEFfh$hEEpkZ=&sYfPApm`R0jV8+&Jeb8h3AhU7v*q~NvY-=jnwllU5 zPlo@(v3;l*8@HO+9kD87O0R+}t1%*M4%E?mOMrIS{2y-`~>5B>yMxn{rPX_Tn;j@PF223zk zB)u5gun1vWbkMb|N&c`2TQAw92&2QzWT|7%jzdI0z+2QRZ%#LY>E?%)Q&J9GoRkk{ zN{~fRr|3ltY!)Y#NzG52aOHFB1e^BC$PV*@;DcTj!}+`qK`0I$FWA9*4=j;7Mf>6}$aeef}VQ|YQ0Vs0Sfq|Gy#tVvTo^Py4SwXZ_LY`s!-=>i0OJWM}8uApeYe-im}Nqq}EIxpkHk)nIk%6Z_eSuZQp1`YcWR zj_HagjYhGdd-LcV0!NF;!uWLx1ZfZz5q@W7?L3m0dG5u$(gNWZ#bEi>igOI&$<@Y_ ztjMSUhT@-R>ZHtvj(e!Vs-i~~DblThU{;(0N5TW46X)RYdG|0l-c!eyPA5m1<}5zPT<>tSAwR45W}j&xKgDs!4#HN5It zm3|@N7XU9MbrPYA(&HLKdd*sMHmPZ@?rTO-f06-aM0rt+=GQsiEV;5#ESZy>vKnQl zl>WfpgcbgW$8=F-3=C;Rc@x(7i1H%Y2783pRUR_M$a9fVP`HNTV8n}=ULvOpGv57+ zR@*D<^kSs-VrgdeU-L{1T={+dZbxuwPoF%Y*P8Y0V{Dvr^h=NWg{MVQF$AIvY zcMz26?VxxGJg6!o^r(2Ndi_pKp3GYViv8f=0Vdma_5n=@h(znY$JGC;2^9aAe`fN3 zU&HwSKW^mz+TT7d^M7lrfAW8S#K+_R*!cf3oBkmS_!w>f*H+g%6{df8=KqY<|Hv`< z$6vJu|JcLe=dHtia%hKx-Y3_j)_~&%3`g`TKtNXZz>NZTYfy@VqNuyMN)tVRZLs4loJVg2(nk5cSaz zfe$38vi1DAR6ct1OhJ6JE8m{){A5~@Z?6x2mTzzN_vG7dcVB%w){o@N_QC%4mU_Cq zwX0z7&&{n=#`G7bHJS%hxZr`dVJBNVV+N#g){KiL@CA)VT!bnF5gY{cXFd28+M!qK z#C{OaIo-gZTBeveUZE^-4$Yu(W}O=tuv51z4G+2DIn|MujbR8iv34kK6?p#DF}N0| zzA@Vk08KB`;_DrJI=3d{O>`VYJI50U>nYmYkLmgxWLpZS0P zkdICOamC5@yZu;sf5HDdLHp7A+QUi>!0t3cAu}Dcq9LoJi+C~yZV^*H-c=(&DZl)* zs)HmeJt7P4o3gLs)%6z|h%3dXwTaH)Xo`lrI{xFm3K1KG^)sXq0o#ARK0J7d+P{r^ zp7p{oFS3$d0seZ98DN9OXu?uM151a|M1q^7Bqv6bGdBzTd6toqo0XWWn4n6l!R@;p zSenUnT*QO>^I^A~7Fi<)mt)JOr$@HysxJ&(p{ zQ2??mYIAvfH_uo08IVh_;y#9pWgNCl`0zEFubL`D zQY4@>_K#_T6D+P5R?;qb@776Vo?}YTLCcTxiV0-V?}~GeaUZ9wM1r8tF*d+=;)_lSA*V4l)u&ue9qOc3V* zbf>7^JW1#N@!M;W-Ja@UsTHNjt8b_?qaoh}oiD&6AcedT3VAgh^sMyNZDIZ~8H*~+ zw&yYvs{yz+UFHs#Q;&NUYAr_x8C9zGo;~Al{b8(*F@w-bLyPu-f}q-%odQ))&OFZ- zDczjB(QK-oW^V#t5K(-k>RPC`EJ zn(DBmrIoG8qZz9S=80&~EJ$Q|I*;D$9>eJrs@BV(^+_xJ<*Q7uzhY-mH%_*3!yvt6 z>xb?S!C5ppL0l63G|w%o6j3xpe9O(nw+!k&SzFUG_4V%C-agpf?QS0{Mx%arTW72~ zGptkA5EABG5cpwtx4U)J#Uo-~E`nbF^$_zFm#OC&hRlWq^2IEofWSkYT?kIvVfH6F z6PNbJL(^U5SR{ruSQ$_C{=1M~yXnLH^hn;VJT^i}&H!u+L-#J}y;ftrPgWDmOBmC2 z*Mfn7E}`-Be350G1Kxq5PHpS%BVCfb-Pjc?Es)ws=47Dp$~^~>3Cb>_Nhl+;48*-# zaiDwtY}N2f=C^45hw+h8|GePUD$$MLAwvoY7ZEU(YTU7BCje8*Ja;X33In`?>20Mh5*!g9!0gi z*T?ffrPcQik8oViM{$HW%|l_yh7DCjK!7F0UjUn#t2CbDxpq$AacLPrYE^{&_S~bm zC3X)FkN&!Uy!DIPugbXtxVVj(tmM$119asue4kyVpeX7&(km>1L=c?LG!Jn)$XT_W#+Ud+U(~89P-At$ zL0=W=3|la}fm&JRHa4XR_Kc+0sEI42srQ=;fo()b1m@IW-nI?G1`Vx{N1Pysm59w`!yZg=*rJWG|pf1@Eq)XD=g$H3 zMzQkQ2=Ci4D3d9I6H>y1mJUkj9x5Or=sFH>vZ`g@5?fLMMWX0h65&&mFcSG)am56D zBALQMjxw7wg#{t4(5zB{lqr=iUh|n}As<_I6>!pbc+&VL z59ebQJ+aWo!m$#iBsE^#6WQht zf?72?pDOHCvK*hBC$HpBtqK9p;=I7PJfhd6ZLHS4yIW>lO8ZH0NF*0d-3QheMPM8&~1n zZ#W3}^0xC1=M5Q((4zLGbmO$DEcll&XmOmVFZzj}15^hEfOA&lQf!yk$C6?x={mnh z&IP;HT2N;c20IqrbX9nIiGiSO!4w$u7?EJbV>iqJ>0to=x`reZV##P92S zdH4yk#;PvOU|~krYkH`PB)4f9W;f8O$IB7)6|9Tf!Md=cDtm4{3@Ek$!8+ci?V(l0 zUcip9w}@N6=@Nk*soASy1UrxOP-L~D+d7hi$I5BHDreP8;z{XxV4B`l!BxU=RM4b# zcx}drKIut1jSX`p7M<1(*yJ7Xd8iF*X-&Liwn6IFO}!VFg3gAshN^^GKc~XdlFAeA zb(~Ad)(BmQ1M9G)a>(U2Fpo4jS)t%H@1Oa;a9LXXPd*~nj29`qeb7`6*%VTv_N&zn zToBg$z<*F~lk6 z>7;8s;K>wtk|RnYqc$xmP_^EGHnw7Nv@EdUsVWFSrQyHTz#?)14fj#V+@kU~Fzm3^ zI%*3rj=0qi;^5RTIO=;8y1YqWFU(h+^wOA1?5af}w1o)RxYkeL>A)3bfNohoEikcOz@`7!ZetOKcESfzv{P9{z%OyMjBEF3c}F*hh@yr zP*mFLblbUyTvfVuY=D{#-J6<5Y1DEY8BSYujKs7b)Bx87clx)Q6*IoD)MH0_FwIKw z+d`+gW#A-1%W~;`uhvCa`umK=>f42VY_f6$xc6R?_YjojRb4T8ev^*Zt)VGQq**t~ z))2Wehd{Ls5#E{rdK@_~5vv`Xbca2tlBXPMpp{gLh={5e_eVp?QJiT$=MqY_w`(P& zWS&9G#IlQl{)rOEhOkb|bDR?MHi}2tESGeORMLYB zAsHK zzsu2Krv2w1V*lTH{AlgbpZ=f!rjKX;c~179o%VOp?F~R%!4~Y-E8xNM1nu4AE1bQ% zQF=B7Vjv}#Gt@u4ezV;=OtNP1Y!dwwGrOD@#dv*XOhjVdjb7&ElAON(zhyAVTWB~P+&Jt-EhIk7yQ&cJlZ+fpPR?=!=9OU-irBxe!JY6 zud3bKf3r9DXtnLRyo#m6+`JilV>`qcSPxsUCf}B3(gnWt=J>~h!=qqs{%|?ii6_7b z43kmbKfeZ+W;ytA85r~6MRGQc6G}GwAozJX*p7#B&dwHal1x65@Hn2tsNYX8jAS2; z1sm_5#CiWIw7(EqTAVp-_Gstj{?;*2!@2oiSJ&2{%sfF8IS}EEKpIGZ+6ZYS2ZZ-p z?J9YtlzGyEttPT;X672LcBnll$9X&*WUV9}0CJH3qq`0-caDw^|4MhgSP{uh=oIPh z|Fm;>uy2=WyCv-VVkyxH9poaPT$oO@QEFg13cp$lo^qc9cIs6JF(x!pGKk&gUw68@ z&*xmk=pG&(zS*Da_z(FKcW%vpzSrHGd+0xe|Ia;wo+uv}VFS$BufJ`WLdZEZ(5<1j z{Xz_k!m?+9=hK?AUJysSaydz$*vT;Kf6Ot)X-anrz^kterhs3-v*Sh~5j?j&bZk*i zdTmvp$O)dJgQta2KT)TUa<`Gbrvie;XGQ-FSw7^{-U2N2orWL^%k72)u;$$NLBS z-8tDP?u(t>xw%#M*|UQKpjP{H9=aXxA`wy^rXJc!NaHyV>m=*woQHSp>N*FA=R8&M zPv+(xyDxO3bKiP!emv}MJ)fKV?w(L8kh@0Hk@7<5e+(jRbdA@I!M0-&=TMWKeUR(6 zU(Iz^^^~5)X*_{RW!<$p1k~~3C&<8F_I?b_X<;6kL>9Q?5l`T(Vxuo2de~nJGq560 zC~ZFu4ZUI2wvswq`^$r{vwz%uDIj*Z@P>)$$b9?AiOj!pkIswNJ2vkxVX!Z$f@~AQ z*5K4^Gj=(ms`Q9I4b4KA$-|76m?TzE6uXY5JX|a)#xRtAX&bvmsmy6<(=e*k%>|N* zz>ct7KNuc+!`!Ns`a{at!Buq~ZTEY(YJ6dQw>o@tbk}w$kHBU?1fd)SwDMqm91YL0K;z$fZ`ct-U)tn$pIm9=C&pxeNyM)E~-1fSjl%IT>1Tutkv|`8J9B zJ`By4*DjxyjjI_k zRbl~Y=}aGR>zh^XXF6K1t=w{kN}#W6cS_yTiLi;$cx#ugvW~iqD;*PZO0cVA%W`#e z{9?tYoC6ct3SY7^@bzTc62MoKX-CL8Pf3O^-s~UyN-}x;%-51(v)$LemJFVDk6&-S zIqLdqGJ1nm_TKEyeOs~KXJz#WzPmh+BqOc2#3K+!2`hnSC`r_<|R!r_|{|df3w%rlUf4CDe|qRc((d?H4QOaMnIAuCkLfCC^3_ z{PA=;NZDGD@TT?9Ozqox$dCwJ;%;DWCR@mdTsph}r zsNFaXm3xV8eGPpGJ$QcA({Rq`Zv|kvFWPk_k?ynTN#zs2A;*1R5`gMFe%LXc$WKS? z_Ufx?nOT{$8F@7wM)@WPjz->x#E~EvuU{`C=Hw#^&3Y{YWq@$ zvoyZB#|QhRIdj6WS2p})vxE_zlTaSc{d!O1ljYDjKacLV%26>7SL7QWuwi+h*hrj* zYG=*xHwBRHc+ScYW_zp>1P6rW^pP+G$49e)c`nFC=bm+(kH%4voFp(O*FtpYP;|+@ z-3l86A^2T=KhW@c0zGFkfOe&3zv|!?rAygz{j)xK*Q@GozyXTj<1g(tay`sI@n&b9 zs$7N{94^B=&ll&sDpTFXfTK6T`SKO0xPiN(yV|Aby2wbEZvK8eIG`X%9`AyW@#?%? zdb+!_-}TrQfndTbp;K>uGe_^R0-RwK%Fg`}9 z81>gJhmXnyc?4d|_$;iv{N^>&-^6_o<0SEoE?PoN27#yI++p-+%q^yZ6Z60M~N|^4u?2*SFh9PaJ zcy9h%L^ECDJs*h+P1G**`3oJ1_=RJwE|kF-5Jv!FcN$^oZK@I_DgH$-q>74pHl6fi zU3F3A5E+L(q`NEgA4+?2%nVmVN514GEx7NG9s=a|PS zpY$ojz|QldoxgS8Q3O6+4r3QhkXFUPIGR|Qg_B-Cv51+QCGgY6m!yXAKZ-bh)z7`f z;I>w9%R#V(X^60Bj!wey&P0{1bYFeXo@Z) z0h)!=vF?qRvFP~6Zg6z);`ryS!)~y16udq>_-W^P_jxeCbp*fXo59aJ$3GstImT$! zhg>^1Y7%m4PF7Wi!n^X3q08HDW z20tF`KJUWAXIU*%0KTMb(_J~;m#3G%!|VVXaFY`>KqUlsJY)|I5_FpbAX{& z2MXa>Kv*{YdEVUuUh(A-R=1ZDrsAu9$P(EPv;2SUXO{gx+dhAJ8?){IAFZvG?f<`h z-1*b~|Bv{%_W!)%VzJtN+mIGt zhv;dif&IL*zt(YKz#|Q!!VN;wZWVkC$KTE`rKit#4_1ry|-(NE9tD>?rm)!9NntB&v$#z|GN8}`Z~yBj>SvacAXB} z4ca)Pfhqaxyp7?;q;>1uge_Ff$wclTbGp6?uO9UuR-VisX_OHbeI9_+vT zZ-iouv(+@c-U1c^8A<%H&A&M5rljr?elSiil1Y|QpcBeee1fb!Iy&H7(fu}uM9IiH z0mu}{W5qdaNNEUtz$IlU$MT*5m>npPjQ*E|TFJ!{-0^QlMWDSF6p6~-<}ldP80A#= zNqhPW4B(dI{UQT3L?THQnXLqysI{``tdK@N<95>EXE=?r%e+YvYkbuoMjVNqy|@|+ z_ZLDXUecT-C>oPpw^COkAbKUJs7Ix7lf01$Bk6FL$D$ljVf#yHwflVMaBlwoufM`c z|Ld=2)fB9n*OgmM>&lE-oi(W|x1LkzN1k~zN)JjCnxms*nRY{wqwZ@> z05taI@i+pW6ocTLvY0>022-Hd{>kO z0u)V)4EH786I?Snn*VivIjq~>4hKNvo13T2Qo<(ncBOJ|aJsF@(c!ox$v6)KX=6MB znotl;0!oMEVA-MFds~OE6cmYcOdycT$Wv6KB*l~+Z_v(}fg!C`;5E$dFI`+(ZcR;8 z4Sllc&q9vS^g5VR^`+`x#B>j7?pccQBUu4N=}3}-eGgBj!vPNTFb_cuZEE z34}(-?M>ncHG?*fBQXvTWs37GC#q_qp8-a6m(P})2nEyR5DA4+c7U`*f_IMaOjnN) zOu|CdioriV$HU+?$YL-r*L2tnGQ%6f_)UVeQRRtGShG<!v*ZF<;ovOG1~63_3Z*LaCmBb=Ii00vvO^s%hekH1LAfFt z-k)eJq+G2eC<6B3D}A}HFjprRFV#Vn*RA!b@ivzlK164T^V$t>ZN! zvl1Q<3{K;-H#@t}ds|06Yz*q25icE9iVb$zuqbqwaAo}BzWCnSDD+Sl@Kzg%BToY(RyHm2WI%a?@EBdzO;8HH z+9o*VPUy)?R#Vu{Nj$r$*(lF6pI%g8dC(o6uAKGz2&5sAdGcUwxkE=co=cO^0s*J} z{CP4M#3`wJRO)5%G(;eDir}#hW7Yu@NJJoRZBVNv0SX5b)9X9P$4fNFQN7$3+fz zlTkUDa`NCG(~L8U!Lc*a880gtKc-NTB_?AQGdO>NAeK(fzwBbH()oq?;3|NB-FHWG zb5dshn|wZWPei)5m2(I8@hG|?-*vPvqbWb{T9jo93H+Co94>q9%eDlq`U^qTm!n zZkf-OBbei_6Mn*Ngm;s)zG6e zqJXvGRb*w9NA=))0>4M`CbI^;4*fH>qGFpZ7;s3-n`6Ka1~qJE=xZ$AQ&tuDD1(i1RiRzib?~%o)vr#6s1BC zC}KbB){qv|461tD6X${wMm*sZ1EpT7p3FUJckbDAOXdHN-O0xvDxC3eq!5#>BI1-h zi-L$dixCw_9xqY1Wla?&Yk?1a9$(A@AcCic9wDogqf9!lA*c)*J_NF|k&X}$5dqbB zX6_jj=tnR#%ywocxQpoiq7jpDeS)eLGLTsefb|LVOyOimKZDb#kL*jrdZ23ZsV;fK z*_mh+{1rWf>ete=PaUm9E+@@#IM?8$XlSwBI0-lP>oKQYU<+=CN}3E4=tzV5G!vdu zIY8hGipsOkkv=`uGcwl!;RqKV{(ciQE+ZHSNAP0H zv?(4cqA^6jH5gS`F}r(jb}Q!=1kad46ILWzoWvMy2uT>pywa)_H|!46ZF31^$vB0% zL|Q0fgEUWSNHd8+<41cPc&__dG|8RG299JE)v#zp31Sl~A&E1+CVm&DCXQgKV3Ehz zUlc$nM(vceT{UYaDpBtAZPyH)8*#;8!2rDgw{qaYFHv1bhZxTG0*<*nnY3os(Y_5F z&en17W%qdBSW&osFr;M3h65xDDIftb=Sk+D;C0p%@fEQ8RRD#LQ{b?-Ily0`MkE^8 zqvcf|{gfW)m%QMD6UzZ#yFbe`_ z;hq)dkL+44sT5-tCx8Ve5F3D87)Sk&h|mf`STk4|RmFIJ+B)1ie0k%-U4Yy^Ia3xZ zw;%CDajZET!KB0MU}1TAd4Y^mb(kpukJl!nn6&l{)SV(XBl`|Ju>fVDB6;4I_&R4i z6$9Nncz)w3M|eLo%8a+xXAg9NK%I`zo}RC>$TA_m3>Lmw!1(BVgJunKK{dWmH#8VQ z6~Z1JAKo}HQsmNRE_Jc(&{EFgv9~2*Jo!n@*Z|1gWWzDj0ec;bf=0V$t9t z$&q%j3W=0^(suCnE#SbrcXcDhF`+wn1(kWRvw!nCF7Qy7&(Nl9p>*$b!zP_@eg_W- z}unfafp2Q1U?j!a9kQzD)JinMjgEhk_GKDRD9_sO(7`{9}r-RmFRp zkeAegXNbPr9JZJ5&$J;IsjzVcQBe_Wsk)Qc(mo~1i$LaS`Mg$Gf-!9W*xi0*3rnh! zBk-6B1pYX4_+!agl7-A6dosd|ik~W!KRdl=JI6;m`^OH0W*l@*61keDt3G>`iL-$r zk|7sg=(;!eTGLR1mz`>4)t8XBx}Hr~^hfE6>@Y#ZotzHwrVaCQaG)yVy>56X(HLX1WaX^m0sHUFNh1SeDUhr1gE9~^%K;1Rcyg^A|_L8%d zd^R|u7yS{{Q;Y+{TRm?Bx%Kd@_UFgQPsurbKOTY zWv%Jt46yi`pH}QVfQFvgN90<$b~*ToXAOtWlZ12KCuL%!CXC<+3uBHaRuE;UOc`iq(0lw}K3C9NJ&(l7wBV};$<5fO6qH_ijBlX z2dPe}Zy^1bdS(`jV;&fLnXwi29sAZGrVDs~wTZ}dsPkyGq;1fRRd?gf>z}rE-*jhm zMLV;9VINdW+P*;S-+Is9ym*1xQ2wUx7dbIGZxnkk45R54NPYS}?ODGu8{pg=e1|Vz zSI7P}Numhd68m4qU!5<&yB({cm2@z8dg7C50+PCT<1rts7MPkc*R3RyvIcyaG`G0F zN!ukfv}K|$hy_duI)e)%l9k<83|^`0NRdA8fFcr(Xia0QF4ZFia_i#WNv z1q;)B3R_MmF(!WuVl_yqfdoy@S{c7JY~8S>QIXCbZEx+XrrBPHh!Ea>k+O>yd)ce? zV(+-362>v|D_PSIv{eRBY#Rx6cCnG63h)81E@&Ltr;;_#l@r} zz^&$#b$C`gVfK{F&CP!^Je{w44P(c*%k76}^R_m?8fGKM@L@US+&gVF^04Uv;CNsq zYGlR?LTy0oI&6cpq@bA7XK9lS*g49#JG-Kr|RMBEE->!X>_b^@`-v z6H}yBS!6UFnj(vpMFz=*DY8-xCA0bxv;trcvWYHU4R)MeN*(pBTxOb%00`!~fj{Nf z@jn;>HM_Z4+03x8$~>tq65BS zp@(*lid2G$y6Lzg-BC_XX~=sUYqn){XM2raa6o^I%|1|(i0(|`tm>ok#yX{BQp8Du z%$(6HHXg-8)}z99=2$M#5KT$>_BA1u1zyZeu8A7r`2s}X069A8KoidgD8zIOgRp!I zDz>6?5|L$XwP&+_+Up%1bvt6Q%T~Az^DbHY?y+sS7&Ll&y`5j&hf)q;gr?hj3DTDA zw9pKFQ)_QWC&-`qo<@5|+n9&WkNc_7s*yAYA#|_Ti}Dfd*Fi8azmmKFxxA((A{f+G zkwzVmK^jULG`U^psRiD93N4@}DWK@Q*JdG5uY^KGk)R`Pe;DN;Ug69MFY}z-Vtxsd zL6QO2-k(IdSOt<5{xn5}0d2``M4#Uj?hJc_4Zd(1_J$k5r;V8tfot_!aFO8+{t)G9 z7wU8)m@WfEOtcK8mx9ONK6f#nz;cEYC(-z9HwY9tRavuZP^p3?A z6nR-mIron#;Dljjq9L5=$k)}GBeM9f>*?~jGEgDmMsdcC7n%5Fxn46GP(B@_D?`rM z#np19Nw^L~av}}bP$?-%V|a~O@{ov%4-FacAzhaJf%aDxOzVP)@bRwNRELN4CUuT6 zT<;b@a1MW*t4)I_?5xZ2kB0|8ukhEyzbZZlZL?5~MqZWiRX=8IrKHYGeJf8QU_4Lx z*g`UfEq)k{SMs=kKNMn)xBvFil4vfV9!fkb1K`=U!%`6`QB6|{_q0NlaMH}$T z!Lw_nKW|dsIRkYrXBW4uhr$^R+0X__FCKDHjyw5c1_!@Fq>Jns|nn=e9v^Rq^R*(obL;hqER?Rpz0bG=p~iT;PbM4JjVVsA+~O z#|eLW@b{j%8&Fp>Y73aP4n6?aJ9D}2*xAqTYssRXwCJxf!RrilQ9l|}02-wzA4dhb z@Q9Wi2-09m;-S1~k$Hkg20Z0Ct)&87s~E4cpH}^y!>dc1?=D8;G#Y8iS{W~CrRc$t zcDq!eBg7L@yEA9>mMu19hK~1M?{Dp~&Z+CqkrJpQwoqqq+6J0CR7VThMK$iVS-Tv)L zmuh+U#_wywvc>`W-@rubD5GFD85voIuKD(;F+ZfEu$|(KBP|=*mgM{xAG-YMnAc&q ziT!nK>E#VQmqiP!&KPoVx=j~)cke^5wiC9aa9x}7r{4@lXz`A5ILHo)*bx;T9lZ{z z@_ZP~6W=FnXgt7Bqm36kyWPcbb!Lyf2GIZ?pG(Mf&DHD38@s(l#pW>)5@X($qMpJK z(={ryu--+fZE=IwZ-AjdM@BjNE!M|`v(5|Wfqf@JYXuTOc|h!~ z*t&*ck{&{)jDwHCp+6k5zXYm{~!tMZ3$^zk>h(=OEuBPWmf*(Z`s!XJagE zKXH!((!o#wGuht2WqiZ~n%TjSd!u-ALX{Xzwga}zaJ{F3pz*U3LoAc?k!qWIHK69i z>3_;$7pUX(>bctIJalwRTa-CgG79^sg4nO-Sk_pb!%btwiMPIV!%B?**u+Gzk1h_R z!j^V=-gk+!-rL&71O6BH|)Kq$Okwr%op43+fpq27#7Lc#D*$K-b%P0l&y_QqNte+%)#UsapF`^;)z9` zCvR?|zPbhrI5SCYndu7?o_hAdmF4&&FFH;amFVxR~zsbkhK(40v z@;LrwWLN02GGrwdgfOY8<$c3yJ9FPBH?GMEI4m?=LV)~7gj^^05L)Ny+c!j`$ z%oR_7A^q75QD_dHMm*bQSpV+ey8jD4v*JIa)6iE4|9nIIXZZf@V?X}$(b=CQAgu5DjO^|_qi6v0I>qHY=0ee- zxg`4u#fUqJaz95UCPQ(=`>kghBDsLoL#xWo>Vw-c{Y$cXP)T+JoP#3`C(G;MWL4=j zZ8%5AhZ+!{#Pz@`b6NWU_qL9I)DY2>p&lN-y#d;DGx_8OQxA+@-vCYA5gDHNFxEqq z0@Z1&0}|*^b}@X19WB}d%88+DPp9&t1ozzC(_;@BN4OWKnk&tSty)G1Izd4_{l6G3 z_rDH}xgq}lBRBwj`rlsrGyeY{^0DbZt~e0?&hq0m75g9l|0rlbT7UH2`lIiwssBYX zDbRXO1iD+3{uz-q;1Qif?la>1F~q;d@{3Wg?~(JvZq=D#J)w<{5AA1}_WjPM}q%sOPA3=fCHiOyPLe$zh(7C9$t zdv+}wX4yD*F2nY=emUL(G34O&T$}8JIV;vNS$b2pv!8lJCigoH_azL!sehy)<^Qq_ zgrE{80YhDRQ6#z8%R!|u1Qs8ia4`e9T|`2TU=g&A0ayoQYBy-)oIn!aG=m2KD&*z@ za-`>%X%m|aH|Vi6km9dT@E^%Y)(h01Z`{NCYsq%@lMZ>}CuKV-KJE+x>eO%2+57&0 zY|yJ4(w_8?Q+T~Cn;yR7uG&);YzCkd$Dz z`bpS&I$RzzD9Ruw<35asjd8yjj6>^Pd`VGhHc?Hqx0+3Ug*VH=2`7sLG7#zn^UCGjuB+nVs7a-c!d&8Y9ejPV8Sr|-Pu0)+PDgo6 zR0xM9J7mU8-Y!>e(Ft12xFqUSkFxY}3y#}<)p3Vc(}WBbgYnG( zQI>pNZ~*X>x(lcU8<2M*EOwE>ESyT%Bn)!wB;Knkz64zux1~lqFN`sIU4;%*=tzYQ z=A>~d@Klo{y6Wp%D4Py_#g;aMwT*k$k{HNAD_BF*0(_0ry-A7avWYWlmqETCcx`sE&a5#e!J;;R{XtgW#AAh|Zx^$v9nT67M#_NDZU?5eMHm zZw4@=kWy+6GIHxucKH|`OgCW8{$$v|jgJHnD+y_!u!I4;v^qr=zQqWdL!;_qgv)W> zdI~IBRItg!@m`NpVVj$M80iWbwE?)}JqMbNFfd3%fYcd>N4@&}N&aF8VdO~Y&Jiu9 z$j>O!hS~z3i&II>w!uiL_b^$U}Z7tgnF_-_*y+G}T?4Clm$w zL~Vun(k99Of3Qh3XFnXkE44#lPsJD_k(0|o_%Dw$03;^X;Mq{s&B)y3TsAA1(**c38 zJl;FvRMb2V{`RR}0&I*c@yKy)Pm>AMBnPcjmeyTOS*Ti=oifZk#ss&sfjR=ELltR! zxRlskWG?R6GM+Wh?x3MtJv31+&$tkUQPH-(*Uz%`xnY*u&VDBNG8GktJ6ail_0;~h zC3cBnirXx*w;IV~1yzE6>pB33tK?{MsYwZ({ZGv!h9lX!p%Y$@J9dw`bDg_)j&vE5 z=n~VF3=aS=pli5dW6n$X5u+v{gCwns1O>8{7JECf*~E-IW(JJEDz&!!>c$k6(?>*d^2$? z5{t62p$-!4IGVwt2n@Z?K(;{s(>{Xm?R`?ZD8z*)8|D~f=7be(9FK_BCYX-d(eC}P zs|)4`S6z!!ZW1FJ4~2@-@rPIcOrEJC95^RgajxMzJPAR8xtZ|VlglKU8DLIwhi#Ca z>k7cW{1B`L>#RR>PIRjX!W`ZNQz14LbOI;9M4!YQN@JqJn=446fdqA(5lRGc0`VSt zv#^0lV=^5$4Aq&@X(0&>aFQ%wP=0Ai>%dTQ#C1m$YRT7$c{ouIEk&54KLxs)Q$J?X zo}vF>VmM>iU4|?Gy8~;D$i&|#u9lTp4x)CN>Cm|7GF+^t9hRyq-(OL<4#TF>y-vb1 z7|~7pU}PINfXIk0mH=5l0T{6Ls}8^h%bzyIRs$dwaQ8S=M#6S$GCw!YfKO{+VR)DQ zuUeV-4_TSbyDm*vFAeQRras8h!S-A5jt-f&n}AOUzPs**?`GJA5BvUIut9H9!h?&O zP@yO>2t}v*@E1*!x@u;GDB2{R$&U`NSq_3j|2!~7v|JnIVmPtCv%BuxRX8u{-elcJ zllUJBO#r0E6V<2<;Mu{!Zg*>6LpagZu(Kz+qGHmGiEGdf?%!9_ZvgJ@y!`PP-6kW=AuePbEq%_2ksZ)DuM&r$kNE?Qu#|1Z)9l6;+u^-Rk_j=vGXvy$o5=S3- zPPDWO45lODno*(gOV=IJxih5myAA2QdPwJ$L;8%Ki@msBy|cd4Tm7>Ws+&X>0ZJ0U zs^(a=5~7A>g#VBURftBnII3GWFpx$Y1^cic75*+J1`Pv9^4DRM3(r2tWJy>)E=cJF zpwXNuSfYaPr)}Ln!TXL3NjvwcEL!3YJ7D+Y1QU1WIq(@Ox@Jf77{rC!R2pvzI;0M= zP5^#LPw(4_C-8aOQezM_qc%`QI#N>q0yNk@*x%kd)*2L1QShu8Es9lHUGQ0FiyRaD zy7g3eJxQdY1$c@%ff+R{evhqfyrBfGK&`n^gDKqt%w8TSb18vi-63=G4K=^TWu~I+ zaB!{-Qd39h@Q$G_U_r7xPsE#+>kBJgpmjA%P=osb>_OWW)4B;`>XeQZe4v z4Ux=%=mV^73Y-s@dhj6dS2iUNxzs2)t#10gO#OZeOONqC_qKlNp(oujOmG2wNm&^s zb0s}h!Rh8LEnmUhudn8lNMj^!{*7$0$XXeJK6u&KMW0$I(Zpso4I2i+Qs~J@Hi3Um zo&tqPS}moYl?}|9K0Rrrb{Z0Y5=QZeoENE|O9kwEr!?>YHxJUYBB1Fub_8gpf{(cg z8me^{9?0^7Xpkz|<_sj4_vwNjmhqi!)7`QRlW30AL(l0NT0r{Q0_NSA$bFv?5BSCkPTV0`URs)joRjtgbc&o4TR)-kaUJ+8BrGhT6|} zeyXdDA*ya_`=EB*7`^I-+OH3OuB(mFt8S?MW`D1)Hb%HgPf9g4=VGznt8O7>t)h=K z@9;zfM4ZCbvauYNL_RT-%(*6@Tu$BLv%MhsLrOq1q;itCx`=X)d;gxr4a(ddFE|nW zCb*YJaZd$w5Bi}5lephN%oe`wlc{mI)kwm*268J)FT2NEhcA2hgaScOrdo~@$%+nr z_Hq1H@?o=5!f2S!5GM5jx;bvZ3Hod=8^jH0pm*?k``~#Oo4_OgV7xUsI|LeNwf~IT z*TA+*z_#xIY}*C)>W*D|)kK%zougL`yK})0!N(=KN%Eer&ldxc-sE2Vyunf)&GPHOC^cwe@0QI*9ny$h52gNpcZ?UVKxT}R5pRCGgzy&N$ zgVKKaMry%tR~w%;Xds4*=3qFgKJ6c17=XSuixHmrzv@HA96V5)*LtJsb)Q~ud#^p^ z$>fAgCG98u&~2~wY?%0m1MYFBqDzoqIEIRuVxO$hpvi*=TXbaYQ*5Nsyb>#TOcuk0nO zZEh5aP4eAoB-VU%mR49b_K|OU&>!;DQQ6j0yqQJz4GVav15eP1vOjD+9k-rRKQS{n z`nS zOy4w%Z|O#wqCUCHkWpPS18P1!X^L9q4p2#rG6U*p$`_7M?ha5%y)pypAh~FY8s;v2 zJ(xYOqm1Vj%H07fsbgk99b;^0R@>YGDyeC1cQBU)wa_`K>xHrntJDoDA#=F9BADG! zy$Hsb1!Jm)bR!WuIQHp}*wyRXE8+C`9tn9PI6727Aj%z6$_DJ3?^+C*Yvz6<7uDUj z`{t{BD+r2nJzZL@+8fTQWx^=sxJ(V@V34XyP=p&g3mmvwJ$D7{c8`t^clKZ2vSDrF zaKbkRcWP5>7Jt*`s=i61`6%pi9#&q}A-d7w0Sqd8&N3>JQN_M>Ri{2>vu6Y`Px;#A zD(7_G8(3I5rrYB*-y43NW7Ro>_`Zjs?YX^m{s#bHR zmeGmaX1Ke@RqUMCX~+JJR?Ow>{=FlpWJvuHC>yc=+j@W8J#x1rc2=J+z`@}~n4?a< zd*ANfBVhIK!UtF#J}GtBm)~7oiN_Dzc1WK-b8wil>`v4#<-6G2C4#O34yWKm%z~BH z37Pg2%ezDeMX|Lf=vRcL>otAl1DyOG0h)4s#7R`0tUA>YuAd#caxochzq2dL|YtmFNp>e z_ff5hcUF@pw|e)~T@IrI^f-kIHEA6(`GYcygi}rQu{1VP<>gKeomEI{*SIy_BEJ?Ttgc=U#?yjB0bufRyp`oV>vmeNERB6M z*@n71>1h@$_7jB}w4vEcTGeErK8j%!*XfmuCoIMz?ovPmz6+@;GL|xpezJrHKUB_Z zRqX(_|F6Js=r1a+NfSiYKrebK$Z_DQ)U7oYJXZy*js{DZ<$yaxuUgzs4+dSxz|h&7 zlS(Y%&nJR$8#pg$>_m4vKptcQDbc$(4DTFJu$l&}*SJ#OZyNMgCB@1R<6rhm$n4>* zb0r|Qf$ADd-Cr$_TTe&Pm4C5d_r&ZE_g>8FFW{-7u+&FHMTzx~fi1GU@Vm-Hs-?&- z&7#3?udqX?Z$WnNMr-}n{%@p{KsnwV?teLzYC)}ti zmkh3WDUE@cs)BLG0Sdc}Cux5oX#sr7Z9(H`R(7*(pO-eCJF5ae_`&uXfetkpPFbbk zf7b1aRHump^3L0tf-_-^39jSdhpU}Iz+8Mfri)^_)W;kgG$YH)%k{M}D2S;KMe)u# zzOw7vm2a=`03>*Q*nM5EEW<#&LE|jlj=IOYJ4YpLZu(i;T;)(>sW&B(ihDjOClUJqNy+IiFM4=s zs$(%tB2Q0p!=it3+UZL>eH%6zeA&@Ud{bK!D#pG1w8Fu-m*Qxpzlj1+s~s-xzCe4d zquy&wuDtu^=to39-zNiWJjKv0C>=zTNpu|wU5^JjGx+31;UO2@l}ut?Nusfk50ggl z7MorH^^7oAQQyHZHi?7Deu@%UO1>6W1L`Q^$TqO`(~S~tbF3H@^#*TJOfLYQ9~|a3 z0c7rQ_pp0#)b+SAi?hCyEds)Nb6C>+Vo*W@M4L^f{h^EKz}q*250-}1m?w_4amAHu zT>*9Q6mLC+FS+%&FM)(!phdxMpWDO%Q6pswlN29;n2EqP+{OK{2@Ct-2~>nXOG{0n z2kt71g_h=^$9=^uD;p-4E0os6Zsfze8aon%^UhxQ(lu)>4{v&ahH;*_T+uvD)hQex z^iauEu+f~(IB=?Nx&VK*1*&L4`!-&FxwXbmTZhn}8^lXb6AT3`w5rlHd5CCJH?5p$ zY2^&U7sSL%{b&-6@+#%Cr-7@yAg_q5=Utpy)|{Vl zoDk}lksjZrp@)**bpo{U!6?CCo>F{LgG!Y+?${SbGiu*N_H+P=e|Pxn|KERR#()1B z$v^(%#{3_h&gxnz{(Jk+{2zbF$BX}dPVwI#aqf@R?^ZgUp#9zYqlfDczh?Azow?v* zWGDTgU-xDPX0HsoUPwT61<3L>#=IC})suzl91v?7ayf4d?dabWD=-X08=vVE* z?R>AQ>)t*x#fFuHE)?NfjL|1-(HQUaJ8&i}Rc+Nyv4cOHNH=lTCfeC+d|R-Chc zwS@zCyt29mU)S4@);kp(Kop$CX*{7&V`y%`iK6*x<234jPBNHsmKW&O-P62~mfg?8 zGK&3NDpi?Ta2kl8kkjOEAdiE9*ZAAcL9qBwi6qYl)wZ+D2)*dd9juL z)}tFQ@BHGCl4`JbNQ)HkS~dCTTg1iUQRC91GDGH=i=l{5U*stz>fNM#z1H%qTI*tB zyu$cfU-qH45eQC?iYJfRO?}6QvA`NBdbHx?;2m!otkZXfGD_0r;3O_C;}~Gkr3=lXsxFanXeW&^aXNRG z%Ct6B?`g7^^v@GAKBCj9; zdpP$=(X7hhvM*(yb|F_yH^MBv|ng8z(`S|=FXMgP|{_oLB``e)X{rbc2fdwq{ zf6r*g!-33<-<|WmB5QZe%C zgTEyip66DoPt6eY!#TWdXux;&rfN)6bXbcinI0VWOuJ#HYx-^<7bSptq{3H7L!?xU?J9Vf0r~>;I3v zZ|`dxNf!Ov{uI5smx%?k$L5jTg(x`=mO z-FkGlS`R}q$uN8FqL~=G)m>fvs;aK8u9C8bBg|wLBteiXz>}~jXRQFp&Sy2)Mn!hw zN@dvS;k%GKF5*C8+)T(>i(-j$sXzq_W4?%bHOTblLb~<14*VJ0(c~Lf?jDBV&_LPb z1*xI~xtV!%M$@2xj9t3}&vssk_canimB!{v<=xL#G#PTSS#PEIxhkaixhhQYbEih) zB4i??usD+tOA5cLeaTL}AU%t>)9@Ob_!jSLR7+rWgG&6vTz5=e7=v_%dy#oexUsWW zW1~0Op{)LVO0fkdNg7I%b>&e~dlky{EiP^D1lkvHh2C&TrM-w!v!ZISWWGZV!;M-y zJThd6WP$W)r%DT4*wa2LimM-_!PH>HKeVv-2qbJ;Y~zO z0Cu)y0Ok~yd05?Cm~*pKqBN{&Et=sDF@~PJ_C=;tNjq0 zFW3839uQV(`Q|Y-7mF9!F4blDD4gG;MgH+dvs-o(0qQ9dbGnCBs zpb~;)$Yz-KCKxvcPVA5rv1ivX?G@?w22LZkR~sZdz?)pDAH8W~f!Re(0r_s>bO=f^ zYAmQg&Kqt9mw8l?&9W4uv0N1Z06G9w1$)XLo9luUq60iju?pY0gKT>5 z3}pLQ<(1cCDga~$Qbc(dSSiZk;e@xWp(9!- zM%Ry;FEBd0Gh*vh`YuB^hHrV1xvR`L_gYCQy#&l-aKlo_GjYbq#9mbJNUExO^VER6p_W%mX_XmE+T$xX&jtQo?7CU52+Rivzf1*nTT*P^4W}*3k3Ab;%c} z*%~6v+@Nd<<@yDNl_}t`{LV{fmG5blj@W3sDplIlmS2VG1&o3>y)3^nuLm1%6-Cy+ z6%jNNdH#=<_48{!AFY-LuFilk>|VU?b@zHF7!l%}1-Ew>S6u8$)xvz_$|>YmwX#Hv z!eQQf17ADU!Y&EAD8|Yi^}7oy(lA9wH3PC4VM>yYAwxQu2x&|U+|TbJ)~!SLkp8lC z<=)T_Ea*xJbgxB)T_uI$ZxYJdvemNlzSEtZktc^Vfc!=t=&0h@BY*T3$Q535w?#l??q&vck(nLg|wAY}w_Lu4hg6T9)P(6@S8HDAeC>#{i$_7Qy&d*aU z7zy5dL9ng6?UU(F=zT^Ol)F8rxZX7vT*ZJbN|fp*yZ@zRefv1D2_)?&KUtaj~XVdage6oWk6!VXadt=Hfq33 zhb7@yE9tgaNk7DvqiS?icHrf~BAhjPKOdZ4>~{|i-<|ZzVij+Ea`oL@d9$UJ$&J!V zDk`eRk`DKfg9os5C!LnA{h8>@5%s05M=iywOmN*N%_q1&t-=zIW_&;jBv1^}M&g^r zSL6G_TH0Ntx%k39F66EYi`sxi#2Hteo{KY_FjzD_ZviC8)xGw@i0r&&CJcwX&F_S0 zs$(>$(uc|fQoC5cjpSQgb2>5M38ki}B*3cOhYbr~lTUz#S`A?;K0y0EShj{TQ5C}; zE1-y5`c*1lEm?~?-?hqjmE4HyV4CvjS2<%-1573yRS@++vOloH>v|zMycF-4MvAH( z^c$&NYsmPoutT}Vog1pM+IEhB4HLY!PijH<;yZG}QHk?xpDi`IvK=H&<2K64gJ^#LgKr$R61dAA?|$nK^0|h4vQ#ZMT|D z%U)8Pf)uFYq}N$n;~SS)ShmoHMEP|mSIehTO-n1nIMy^{@5VIJ0El^T-nBK!S<3kn zoxi}BWNReVrjCS`o$IE_7h1o$suEzRnB=H6f_1>$q`M5W-Ks9O)2!;8 ziAFYCO0tQH8Mez!Om(Rxt4xB(IAo^`j_=#W*;YhLyi{(@RUun<;2dll%O=5;kn|g8k(AVTu4$>AWT9MUL2j1-eIrX z?>Q{4y?uXz@prW;v|65o6$Vhws6_wW?ryK&m&nWgZD`UA^oxc&^v0nR+M;2E?tvF; z=$V7Aq-W$Kx2p#kcmO~O8-LR4Ypw-|Q7~^=dsZKZ9?f*-tlDE&SxRf*s_XNz5UXl~ z*<_XlZj=FLNA?c6TDpKAGGnGxid0ZXR3XqsG0SaOA`|~?OO-HnI6T89zPr8}vx^_8 zM|a6`1^{ZSnThY1igZ=I)U~_ZEYyaUi^dK&*DN$~V_7xLpGrj|uY9Rtb&Y}K2&3{P zR)2=>0?ystlV10ZhuXkl<2W(WJO$FrWj|zug zIOeR^sZ<`Zl4w#mBjVIK&9HYz@A|zx9&cGkV?+=e6Fw#BIF0>-!``YrxBmn)k(MpK zKxQR{Fgp6|Q`jlV`iM)hc5RjU;tpAp7-&y0e-3Lx$b<$&2+gWYnQ3ln3_|o?HH^Y9or!E+)aLj1vHywYipJy94eRZtk5>qDk_7EEZUSw zl`!W@Zjh;GC81PQ2@pBFh!SszB>)dq&?X^)(c!Mp*H1CzF;l9Mt0;?XfNY*5w>B#s ziC8v9j!b>gQP~tFX7p+F#h#nzg@`%uX-GoVG8&Z0*N$~FurzVqQ@Q1C!NQzY)vXk* z2gSxZJgJ>MM{_G(CU*k{>lpEFVb9KLq2d`9Bld-2=AaZSPubZpKco-?FgNcI?+S1n#VDlKYUE1JX8)RvK4#3Rtm{P+BoMB9jRgRglo$pah5v@5*ox$;ETTao`Q< z%J`-9Oj=cgVSR^iq@_@)F4IWw^HA5;84QcXp(5D)b?*$S>Tt53!@V+DN~(IKawyx~ z^QuYR{QV7{@bHlhpfD$Lnk7rXdMA&Ta8#P};EuOe%e-MveCx^kt5Pxtv_G%S&pTJ}Aj{eCsiHF$0i`vj`xw>_dvuk@UougKgz9 zD`URm$d(jRa%3}|R8A#THL^+tB^Ui&S#mSDpP2=g&%-b$8%6!bDXWbAmb4Eo|FXvE z%vFoD+HBCSu9a={mQ;F}_&`0)dS&)Iy0&aRct=O`%Be1un@BsQY|`v7-=abuGCR!Y zsGL;Fa&Q^dki^R92wmcio-phY@0n|6&O)<)BT>cKwnQu4m)86_y|iL%RoZD)Ak$Ch zab%rOW)Ug1BRXM{O>k+}Se}M?v&YhVw0d+6fl#GNtH<&yZS`1wmD8B#-)a`y#~!E` zc#)CFD_tfaF+)wJjK=Ph{iLm_+mO{jx^v0dNv2?~pd-=%uv*Tmw4S6l>1Wwh=H-<_ z3Dq3*$}yfat}1e{u!>D%sFrDqS=wf5+en6%8l)qduJm|ORCw|beh(3dp*^sC84}Li6p1wQjowd)6GS(oBz3Hvs z-IAqcL=z?st~C4XxBk=pPx?D>rNbU$K)>r7qHS&+f7f@a&U{{4cGkOM?0pPmr(=(* zi@|Dm*&)iRxXMI%IuMc`R>+DrYo=lixkQ@}Vy@QQC2!&7>ebqsywF2a<42qq$43=! z_K#2AbWigyRvAhAyTwjTpGb#Z9HZ$3ioHf&gL&;#y{Y~M?S67uN*NbHEwG#O`l&AjV? zZ^t`!sBVLh-d*u>63c)Hl~Nhgu1H2g@#YBadRSOW|K$LGi#qPJ|KBS6f7;w?Khpn)cntb4 zN1QJJYjUwY)@nN&!*HqC;cS zRVtt>E{fCnM&X*c!Z;42ydJjd*0{{9?~IF=!h+paV2N#EQT+5}Fto~9g1|&hyV!qo z>gem_ONwi~v$+m)m&tPl^-wOmI<8v%Qef}6D?`iC{bT?t9mU9T83u(hF$TlffUc4f z$d$(@JG?ia_?fc+nM~`ROeoI*nPE2XD1mvm;)++7orDcU&*3>a*rq7>E%&|tH9g`{l8*x*_Wcx>@*LK_If|# zZ*(F!$ivyaAC6yu;}aYe!n#1n0Qtps6{0Rz@K@Vt6;lQBX`epmqd;c<8Gulb?*FxwGGtMgQGv=nP2me{tL*f$e% z&{tB+VO6%F;>XGPQaM^NmGy&j92_(&y`%ac4v$}z>o-zM2&Cqj<6v=a-v$1(`|7Y) zfPT224HZu+3>tY~FJ?1tM}~eXSJYA-FcJ%*lAel%bXIrUn>VM&FLl6tM* zFeDk<^xCxAukhN$lZ$3m#weg6beJb`PNQTdze<9Ozbr;5b9Z7M^}V##0DB9^)y!in z1kHm#+vzKBDg``5l=xmGt5&uN@~7$bh0DhKB{j0J1G-y5H{@d=9_5aVdHXil=5Aigc0tXszF^@5d4vJv<;(J=JBMAfw z=uk|;7LfNCuesS`m`G032=Q7RQu#VCwEuSW@8A7dzW$?d6g6pL=sqak!kp{ocgV+z!suDzcKybq-3(1HBk=5%Y z*YkaOH%!$2dSAJl^!S&Q1tIx8rnh<^mN&OS3xpvSGwR zH%VJQSwh-t9Y(s5B|Q&qRS5rO2z5_Ry6@Nb8aK`rZrB;vOt|77H!h^PSD$3%w@~>N zkzaUbXSe5=hgClKdI7I*)N9Ugwm5g&tQ#R*`BS-~U_35%dxwX828CmRca_B;oX)Or zG(2I!YJ0Su(LT{%wcew62;R zg(zdLUfg6a(9uOSIzvAk&=7>Rw!jus#YYN&wi0JQvX$L<5j_-F2HrL|1rj3*2z=%ME_np|rMyV)h)s zkzXgBHB4xBj2R$u;{YH z&Ca!3m$b;ymP}`NAdqhBCezLv)n~~xYa=x=PlbHwy#jgiTeQUC1@{U6q!+wqvN!yj zUSY>&FYs4JhkS(=Vn(Yvg&7`lC~WK`eQsJ{#4;gZ-Ww zI~@6GK$G+);mMw690$Z4Ac%lZ#YDh0TzZ*gfH~`1z?I9dae$mnr?akbMTRhsXJN#8 zf89JN;&${>u|BldpPjA$#jp}U=k#CsV z8x_Ac>b=5V_2<(xndWNJgh&@XgsvA&qqBwOU@fF&rHt6fON_#x4p-pEi*+0!8V%|Z zO-hwErHK#b)&n4-6=fUKo4s9m{8#%thR1IS+O$UOoog9dN$ z^L3&w^;%6uf37R5Hg#nU3pG3T8h-&=T{ERK8E4*$nv?kyHk*MUO}#`>S4}?~BPc8- z7ZWrvI+8Jiqo=~M-LyfWiH8XNFeQ8w&fMVy`nK?&NjEm9d(-}zNAR(=9 z5}8I}DS=i@xsOr@H=GehGT;R*e*PJX&5~FKTe0g5+OixghJREF{$fkuPXNDDU>?*C zYZBpUt^=U#I()dY$MGj;poF2!@kdYY$LHSX4*Kum&LH%nujT^x(f^HhQUCX>-QIen z{}1sX!O-M0O49i>AXn64lH3H-(LCav#njVrNJrr!7&a#f-3pqZoCySn?gS}7nUC{v z7+=8Ce47c1;%(qfBiOG_fM$qJr=1B5 zzhZe15+Y}gJ86`4qUUqot1A(1?2f(JRci_~C>b~A%|?Vijo084cg6lyf@%X#@Ov={ zuVK57x^gdu+M-r#4v-dS(YdoY8=t%Q;o#32ZK~57Zz9W3V3jFIG?OGHnK)CPyRrb5 z;LNm{h74mj(%C{cBK0flkHhEgT&a+uSQuY>ApXR&ZA50R(`t>+#d9$e&s|6uV?x-J zr)tm(qs9Ww4`;UO3w)p_)|A{Q+Yw@mLT+2uAWR~fjmfz~q|go5)DhWdcZ-M34M7Bq zJYSvws5St~&n2IS-4eUh~uxWrXLxK#7$RK|;g2KBbJ=r2VZPlmBgMexZhV_N}59==;>fH8& z0erskrtsOFOzHbAeEww~(`SU~^Go>b2NU=__EA7OO0MB^FYv8T^?Gj5KA-+C=l@qh z6nz^5(EIH_OZ>mH`Sg+hKg1)CjU`8uk?DXf2Bhs?s+!BOw;Keh^;>hYQVW(KA zRHiKgY#nHC00pO0;JVQ*YYd_^smo%42UG=ZuYy2e@G>kW$x;fUNb<2&ufGle9&SU> zD^-&$*3ZG3chO`r=%rxnX1EKR^ z{xk%9v)0g0il8_WJ?x+qh4&!U$0)E{F7zisks2BR@_Ac$D8u(SGBoM8BQ60h255q{ z7?D>vS{Hl}ZU_t)x z>W?DC!#vCRe?~RGwvPMGf7jbZ`=6&9oyYqh5AvY?|BG2-eHcVD&+P=wr?}^zB`}4& z*bfXH0t0P~(Ep1w@|@8?s}g*-;jInq@7E1AMC@3QZaF^u^<4DrVu=C#9VpYqa0KsN z5A9sw?*RXjy3ZS=4X-({pA$;Cqfg%%G(A>#kg7t}Kf=RapJ9%?)sg=^e`IQ)?i1=5 zA;&m1)$e_5nvYG(nUaq}V0F_Zp;OS2kk=(b6c?_c`ZMT}^Og)TJ8F3L>Zk$u8`{p4 z3`nW#Y{b2-F#o#~xcQES;tm!!^+)oEgk4%H)dV^}m<5y6Vaz~!T4{BjT{2stI6s&G zoM7bQU%n>}^#Sz1<9SMECqJ#S`65k`(v7Ubf6Ya+lkbtg2UCoPC(b&~`gvWo5q>;w z7yrO#IsIp$_gmC)pZ;favt<9dx$(IFdyogo_ixzMkUfUqcAM*MXRF=B`*38Jk*SGx z1(59;Wpn+uq|Ivf=J3hMbfxogs=G9a8S2e$q*z>=xxuL|9!+4A6~SZW$f&jg$;Z zj3cuQrow8)w;ZcwNsBd6SN+6));drBWy#3$^>1wBzp{?|*8kJZQv8R_XPw9O{}2ye zU4R8EO}}Iman{zcN-kZZlOx9gsH3{MLUpXCvcb**m&q(3{V%D7z3E4#z_L~?G9$S}A%(PA{6g!o>UHxTUXc!!sgQBQO_H>a&V>^>$;7#I z6#;?$3N7oimFCOF%5c?QIbTUv8)rZC&u!&rv(?;LN!J>!Rr`O+4QldHSz+LhiR)T@ ziz|g6&~n~I;&)4$6lj`q36ul<%_16d$E&uKzwh`jU;ia#-fynsUi<%zqW_;~TTdVD zKOf{_S#Qrf~xRP0*;?`!k1QRY-c6>X`trz6n2 z>Wg}#UnoxB@N8aK>WZ zv5J#u=)}Q|;h@9i*aMfr3}YiUHXN%TS=oE?Ts>>~^C|3{$i1bx=x43;3Mkq|I`w7S z$ZfUTF52#FOUKnks$p$|C_tSm znO6IkXr;NQA~-;-Uc7jb?XJ|0j9%I-W6iRQ206M~rkVzIb&!JQvODN)n`u)KuXV17 zkOwA%E!QlDn@gW$&&eFcNNskAjN?~zsvx__G`@spv~GZV0(kO{Y>17O)fyCk5CAJh za-QcMinnDMp{9y#gahO?Q8=7?vL>7iBv%9PL^BGY`b1Q1lj#tK*na>#rUUhK6wp}~h@9)fPonuaPDKOX zIaJ10?4Vn*H;)Q?^XRU<`2}pvL7>a+%OmHB^|Enxv2t_1W?L_DUygh5Ck)Q}r`u&< zUDwM~2|QHZR#ZQy%^NTQDbSQZdT1WxxzqoPH1GP_I_|yy`K)CBy|MnN|9g-p6Zptl z0Tw&y>9nPu7U@#MxI?}L4nL4L(Ur-CvQLABMaPkM)0sqgcrPf< z{NH7eZo?oN@*W)@&kT8mEjVp$GpCWkl$u4Srm0B06g!8t0 z`udR;e8cAs{}1Yp!dKUEpZ<5VUB3VMc>eb=kG%i+TW+9Kp5u#VAdXye`Ku?8_%Ep? zVAt|eDkl{Kd103~hDbtK$J56+x7GNfEe8ANUw3dTQQAa=c4@Of*2xiCNSmlA95KqB z_}k?Z2WlTDWDq}|N3(E(#1XpcZ<8mc<4c0mm^k9{^ARq15!SwzVUKg!P@5j*+pE%+ zO64GX_;E69#EzKQ;-A_TSg{-8%;8tDJC58V6vS}+*qJ1biFr${zCgr+xN*czf%Rwt znI1!@%qKX2M>)lh(WHg+B@EN%BkcLOzoj?kVZz6w#kQJ0iJ2M13}lS)83wp_q{<~U z^jCpS)MzxYFBW!9IwGS%L@idD4dcJ8W!A$y%jv&)r|s+NxL5z%F4})SeY*81|2@c~ z^uNomD=ri9=+X!}e5Ls3Q+eQ1vKITB)oO*Umi5GP)|u`YrUv}=2Ukmi1pzS=41X{! z1W-y$Ws#0^SrQqi-VMA)qpF4FY}oaMyI#L_*$+?w-M`&F`8QtuOVJ$+Ii zIavS%9P#$uZu2BepzgOABrBymIM7$95d$F{*V|s2CeV{8-wqRho+;y5v({z3_}Dx zfFXv#!$cY=2ix&I-ct>ts16XqKu<}9ox@fl3HA-tFT04$8*i>atj)C~OhJ&J#!w{( zAcNgQnoy0u1U@;nAh!ca1oIl3<|i?GL{7Ks=mCSn(NJ4>n1RcLK6f__z$6=0`3mR> z?0^P=?63fXY}YYKHD`*|Q{Y;f^~qFU>^D(|8FTu&C;G?xr$2R1dg7oj-ku!)c(B*o z6IQnmzb!}nba49m_}!`a2?O~YoxT^x`=WdFUi|goXwMP7pWmMJ`h9VHQa^a}_VAzw zX$MEUhwt_dj(!lYpxn{%sW?1<#STDEj|EmJK^^q^2<%PoWcM}v?7liUJUD&t)b|fg zj}Yem@rme)x80M|gWY$B-4mGTCvT7YJ*a*Uz#bhO?Vms`y*It1)0Tj0AyM>xgkPfn zx_fwtb=AA?0R0n0P-xyHULPOs^&s(84^ZpAI_z;>(5l_T?!g;J>~-ICf9O%EV}No} z$83zA_~~^Ild!%n{J(p8aD0UA*gZZvJ%OJNH1p(C7yap=-*ZIwurGs_h8?8|GFJ>p ziH?a#6hYTI#n2o5&TEP9fP zn_vK4g^ICRm52gj2}7cdPTq1Lw2H>f#cvW<-K^*f2VHD18mkuy?9Xf^LyfX4z zP8JkPWI;p?Cu7DQFynoa-Y63kTM`Q?i4K#S7#&OFB&Zw?mBDD@fw4}OHc=n7a@SAr z)-^@>+I3XhCM1Q;V;v9`@}XStF-|DR-UO<^IV6SZD~!_$SThs_VA=wFK&pZT_bv_> z%_xLjzAovoyDuCGkaR3m0dR0nTEQ~x-V7zoSxXe@0rwc;WzquZfn&Pqq1&FddWaU7 z$%K1T%e)>eo+?A68ZJe>vFSs*Zd3|Fg}FqW*7lbNzAu{~(XKuC)NLDqhXQh_-MT31As1 zV_$x9Pnb@9U?J$$FF|%RkgEstP|#frp)84OU63QeDQu>c8*tJqB$FmtYKu2Oj_4vN zax4=Sv>rifCeqt<761VRJ~WR|-M}%*K(4rLiG6Yom(ewkjt+47h9hx{9&8jHWDN(# zt_Es3q8%RveO6_~VzGeT6JK$K??^k+0tmEMZwcH2W^`HIG`Iy~I+>8SU%U#tO=m71 z;P1t0C?6KKW_vO1JD_HK1^ zr2H&GS}Y#gS79JMFJfNqBj@1}qP~Oz7lz=RrZY3z5lGWJJw5pbsI;iB3 zcQUX#y~M02F~YhI%Xb7^e%u(p5jq6;D+wcokS$JgRQCQb4otI6)+KCJZG?q3(cKNR}Xt z07jvL?1m!A2?6L+ZTQqxfzLz1GWx_CfDi82c>W2Bgu~<_t9sZwst2CA@d@imI{Pn^ zs>&qL%1mh2z;4AT+n~S7GAfuWKpEpQ8wy|`SGoAR5rv262QlLUfxf~Z@UEA&f~*0h z?_h)x8<(g9ewr9JUU8$!;Kf>E5d9y-67a7t#45mqz#45cK#LVyjH-ZNSuGq*R*S~U z5H3xLdWkH3pPSc*eB5t z3>%h?o;0RsE8GYS=(=%p1kT{>Ez|i+FZH3Kw7<;-*`c2vUl@KbQxHx{vlP_#0M3rF zzHV5@a%i+v2rWiE)6zaiKBju)!+97K=zw zp}DSLQ{d$CfZj0W0wB^b4+B|xTfZL*(!rKwRLGR!Icz!begK98>q5Izrzkk0NhD!a zh%%^(d#ccuk7}r2rC5A81fh>O`Dlq}>MMup(%`@kdWqbI0FRA?g5_)`85x3#jOPJ= zUkRd4=c{7u6yyx1x`O8}u}09)$eN)e3FC^ONr!dNkZefC;MQ(K{lwFXPZz7jAz+;a zm8X&xX_+t``#Fw`;>1soC#u~m3FmSRe>#6?%VrPcrIHZ1dD#b0Kpi94*i7$G2tH~W{OC*eZ~ z{~rs4;a|A*hkwiQ|9)k>%M00a158W-D#Gg#{1k?YH2BCAc#TPt>=Pz)rw`~Sj;~T+ zA$u6bDq=y=)HwV;K@Cwkem=5C9wr9yk3J9opoaJdaC_n(LmGY%jnG5ZwD{TW6E6o< z)@cb%0s7?Oxr-BvCo=vlrqTKvOa*!(Q6YZn0DrnjMM^4(#(Zi>b`2~jC2F}-}Zd&Vl{{ch^aD-R3?>XqOv06E?FDm$*gSZX^%A)! zSv=fehb<>@7Z%OQ_7SZ z>IRK70ui*MD+4wa6sh&t1uGH17y;4qJhuHS;f_DX7!cQT^~ahLfIDt4$;I3>WRmA7 zFj1@S1ttpy)63caOa-cfQTO!8(3lN9vJxGqM-eCFaoF&H4aor@h-Kik zOOL`at-=uvr2^Y82aX7JF}@i=JCh&yCOeqHn$B8f3J>-fUWDYDAVh}(l;8k->F{t) zr8?LnC^D*@(JS4(){8PLJ8~kSSa}68OLjV0LdJ|y0rOSMW8`upYu*Z0NFJxUWs~?1 zWtoB;q4)iAxjW*48#^yp1hI80<58kfE~}#<2C{nueQBXGO8UVqk4z>JQ^C|olzv&Y z;4dSSBq9S85()Ieg>f_p1AHlYE8J3tYu2elnunbw0k^jTT-`Z6xben~ixHOc1KeJ@ zs6-x01@V5+9q}2yD`Yq$6&*AIabP;QHNZ`7FJNt88w_>-)M~e32eAz^4r3d#$-=7= z4V+96iHki%g+q7jj~j$>B*VcSc6-OTsi%Y)z>7!S<=``lhA32IOuGPOQg=CrmrpFl zpF2^3WGZZg-%9E=P!mj|2!jinTlEuK4L!zuFGdb?CTO8X0#4o_hj4#XzOO1PRBwgQ zml;E6O&Ocr@Gv!X%PHs|waQ9V2o%WhhOdlKs%XswBB5THhwZ;HI!DQ73pH$*>~gu} z5hIL3!s-iw_WHw0aCbKk9IIn$iNd-KoFtyl$#yIHj-3iP${eX85=&(02E#Z4bMfc2 z2xaubME1fY5E;R3j^jVmouJ=OZ)wS18_sCEJSbLe*f92;??y}r4tM2XeU7N1h#FPJ zpzy|xU#*LAl$qkq$ylk9!?EIGnyUVb+cn-*mCZWKrV~OJ4zfbRFrvB~DCL4x9OGD1 z9i3BCU5T7oc0|>Hk`6JbOeGA2L7aBVu^{XMhzS`RQ^C&+SVB7|+O4n_oy~hIV!<(F zd*zqOo+_?(0uzR3UFax@x%-b2iHwB-j-Gg8a4#>IW>k1sqW=STe}EGJfH#~dFQjdl8QgB;c9(4QDG$9Kx+NW#f)rq6e00hjL&G$e^PR-8nFBg8d`QBDW&P zg{qgcBRRBhK!n+fcyz2&X#RmyF@K+0x3GU3MI@5#8>^JIlyV2rFq^ zSiwcr&oFUPDO_oV4Ifp|GD5dninuUi0$c?A6PSqS1#_N94T41A<1me>;uPl6DJwz3 z4U-qZsfjnlQxLOd2qS*KYQSHzgNzCx*iPGa{Bt?( zrXRlOx-GA7J~YtaI6PT(L)SM+i0p)KKBp zDhN}n97LcBq56h`X*~7bxMXZ4t~jG*JoveS7Zc}*aea-efxdhKj@L@;#ZAFNg~A2ztdhb_*%)L?G%&pVIL1V5hOy3q}R z9c1IjDbCD5vgIck1frn$#6}nm#r(#WO9RMlp=jZD59xhx-HM3|5j89{d&C#_I|QA{x~D17dSqrNXftbM zRtLU*Nc!b4yTH`Qa6sFE?h8X>v{X5OR3Y@#QOLq|N@v>!n=k}upd!^r!eF^V6HJ$P zaP7pJF&)v^6sXp4sB0!Bi+yr?(S-kAlT;O>Q9H-4RGA=Rr?lR(JxYojexyKP z_y~3*yHS%GvQ*=bX%$$9qKvWEL=PE64+m!$V~nO?h}^3nuXJ#6K{lI`P_QZxifN{% zDc0T}($He<0Q-qO7A7`sH)$%Q=ZMQ)QUeXc8Jj24K*ZgwFm*8HU(pS1*jCRXuCW#j z>?ukkJ;B`RBnYi_>r4}6Gd8$R6g4+Vx`;^a?@m@8G z78xOi0rVlNiq1FzNobqyOHt>9V&${O9TFgK=R-_AI<`(@6I~6A!2@Sc)_Qa2e5)6hpUBT?TQUwoh6d< ziFD6h;T|V0un|iX%JUtDsG}6vW{CT;Tri%}k~nI_mgfU(N$t&OB#YSBS4ewh+jCQCf24$58}=QY9%^$ zv|;Ks^q>u<3ZYNBg-ghp#uBmi*pW+uEr?kfx1V5M?rLn?z_<+!7~XLRPqb9aOJHgw zrB#?Ytc*hU{Iyz&tCGlAcw+F2{u(w#2NXzL9S?F-s38(3C>@0{9-#n|VF$45NU;Kh z6p&oY$!vvgIeuTXotG#$&5;j&E zcL70$?(t#vQ+&*>lZ*YR&X7Z^R>Kr$(G+($$SKy1Ub;^TT~lcoj*1h+PfYUD!cEG} z>)hf=`jRkTDv>heP3XL*i+1RC08>fCkVJre?X^=$HdfkCvugXZWhMYts& zC_8y)fJLr4eH^Yz&i~qy^ z;{885cIsr4J07(j)bRH|?*CE4`qNGRQD~#K`0vb4@%X^Y{F<<_x+u9F`@x z{OB=_;*G_ZLuxHaM(H9lVPP>iU^Mn~!O+qirX-aV<@YNn9d%I-l94o^a6ke3l8ImV zZzV-JL~5=!4)#_m`$xQ$D$^URNI(rJMggiPRT@07a47s53##M!ujY=CS0n~saFc=% z?^qA}56&wbn4gnYm>$z2>1ZxV=Y@g%J7!3&Ybyf&QATU|C>es=oZ+96|jj#vLR z($V}@X($XQ6nZyOe@%hIt>t3HPp&5HNt8hK)2JuTf|(ne_;=EK{iQxvDOD&Wu~=kwRN&76Xkm5mFDGm!}|Avp#}NyJ#J1> z)a18$V^HOZVq!}6v)SK7`Fz$*7XS z14s2Q7|7n})jzLyNsipcL5rO#rxmtw(3+*Pr>rLSD6IHU%aYTEfXz0oC`(Q&3x>eD z5P)Us-;=6I^Tfa)Ag2LB62({X%f?X<>mFTbc{DC^sx{zVr9>s6Cjb5Qf3>W?FG#=!N7P0w@?WP8?c?!( z&d`Rm%MXHkCX#e)juKBWWt%Yz2@=wFyG+tbq1hqTX6Pw!dUlYZ#n%E(Ml zFBoW-(ROAx0bx|OM;wgO;&h;t4(S91=ki5;_FSneJj<2Xzlz((zJd)J1;!jZ6VUKd z7CaW|ej*sfY;+`sX3ISXmIxz(-TLYnrK&O%@oCogoQ4eRgqNN2KqU&cVfKS?_bD;z zi>gt-lAFA}uIcov)D;e02r`6pvsHdYt5B4vU9N~IWjS`;+T`+TtS?|N&9TEZOFDdK zFQ?O}rLLZkuL}Ncm6j&MGj@!hcO-vuS{hX6Q^(0(zgyFCs8X13_@5UnEbxI$bQ~ne zG`Wz!HH4E8$?Y2TkylX;f32&Vk1rAJ1YS`Cfb8dsR^()6UBE^IE{OQigWec98LT$* zLfS!G&9Uq3#T5=>J?ZXTHqAcxUnF@?z=jInqM>juUrLLCN<={k2qwu~A0@D3AHsZ! zJZ^Zbk1Z4+5FmRle1zV}=LS@tFBI*Pq*QBx_hZi$pQ?GqEX?x;%#W&li#$6mZyArO zdCMR`dPV<^<=GsBVIp*DK-x%WL?cL%vG*gRLxU76vSihl!z#>W+lUc<7Hgl)eXcYR zE_)&h!gM0Wq;A9HR`IS%AeYTf*L3!;^9olIYY$#LaPo(A$be%(fd` zWn*e;MpMyT@t#l4ktcTbuvs`a=+VMm=>M2-GDq&J=6c~OUiGHIldkD%t}~%5qer(! zh4Et=Tz4lgs)nhY8cuWje5?mXVJtfdNHm%&cTG3-mQNWa(dIA}Fam6h%0nf>#I6Lw z(JGf1bt}YUkHQrYj_C+jRO}n9i>oqDlswpT&dXP zldhZK@#YHK5?fpMqXH{7cWac*gN=rcc&yb8)~GsRtj13c7%5*|_CxIh&nGV?Zb>g3 zB=eWSkgkv46<)x9u8 zq=1-fnJyH_g&Q}9X^r@wtIZ9+5AH{f~p_8fJ>qG0t4%<*O#nnD=D%4de}r%3n{7LBt)c! zkC1$f#bDH9to`3dKC-@%laLI>nwaY>Loh+u+zIp|9X7qlR(g?+fL!Ec*8Bbm5W<{HFz2^SM%ga81^oN!bGRRF(1&6YwkC9=PJiBek?5 zCg+7Ca#n_%k&&I%F+1aYxu9n$`<~H>RmrQ0mx_cylukl=*K|@@{(oy`f6ren`hQt8 z{8#J$Sy>%Bou8opXC1r$`CI<}V*Ot}A_G9L(m{uB0AMd4ssX^%-ap&`a7_O{rvD!W z{hzV-qpSb33Uk>mGVA}asbohlxC<(cxPuz&p$s@T7;2g-6Rx)&dnywW7RHY1r3uBx z!zchyAVDzITnJ%@k|b-BWLdn24!aQ}xD3M`D?)@>AY6@Dt;iNAnTZ}OtNW!9hF4sO zA>3dQ+Hy!rwl%z(3nDJPN|Y^~;)|tU?gQB*JyPa{|1vsv?Cgq;XB?-vSH8@?z}gr> zdal%mZ6KL|PYv4$hH8n}3Eq9-J{uq(Pq>EU;1dMEOn875)m3Lko(AV~x`YN~yh=71 z_=aSfiNQKL7AwGkS@oZt=rB!D0g78w{Z#_VhrOUiB#68>T8H>}irzq5Pq2z?J$m0w zD5+ecXR9O$l5i13GuT6%Iy7kfDw)(d_P^2)MASk2mq!UIWolHIkRTlmI^sj9ba^Pm z^V*;hf+I{MtTEu?;Aruft5nCR>Af(yoK_NwMcAM?3{NyAiKh$!iVP)8d5yQ^)N4voKom(F5GAtXu zK@22_5Ab9}_Yv?2n2MgSw{i^F;lb+5C&< z6Epx5)h0I*15cn*jB{jWA&;oW^2~z_plm1tWzapS_9lj5XiI#t5sBplRm7J~QdGp+ zA55)4MOcmkCaNok(FO-mAK(a^XDl2Ggb`f0x)=Dlgs+Gr$ru(}!b!E--GrpU7Mpmn zZcYMdY9^P;1QLMK1D7d~C&JH&f}&@Mbwdb2HZWcxMr!)j!VnTXl7Zu4;xcZnV#UD- zE(s$zv}3}K31Ad2;A7$e>kmcgfJHBKzG)E%QW+oiN}aL6{O_}RFjD%d96W(;46{_!hfeFhaelEGleJ3=jUD5x7$#_8X*hUsSY2bO-W-;po}4(gM>A zABnJl^o!Omde1e0qfTa}rp$G5a z*pZ?nik}AX1wEiifJ^H~8J9cs0|#1$@tW39@Da|;2Lt;-&Wd3kg2{-3MS}bpfavJu za$HYh{wOutxdfE0p9J0YPcXsQguRR26V8`-%ccCV6x<4%jOr2=&8Mk337cbkjz(iA ztZ2v^Adup5*BH%lLxE@uSsg_()^uiChnSUV)JLL)UZ1W21t6YF&IkA>K&IxAMc7-F zx(Y;q-`(`x+J+7UiYO~M3MQR6HTAvb0$FE}EMQ^RyR z7#P6%2@!w!kxBPzarY#M&mbjU&nLMlAx$C<(}<2tj|e8kAI)l6wTcRH7^Zj#HNAFK z1YYeQDu;2Scw^Vuf}QYtkdo{mq(v2PdBk1j3dg)@5jEuUMC?w=7wkhs0`yV^>y(SJ zOIP^>I}xPr&Mn)+F?3|ca4L#+b4g`R8Dt7BggWe`Y$R_lomY@XhP5t2t~&ME7=K>s7XkNs!8xv&vJs3z(MK~iK9Mhx&+eyKS`S~ zI`o(76X0utTi;MAxGCAHYI5->O!|e3CgzxKaYVX>2GPgWXciDWeoV7CN+fReRAWqxwVM?Jkne;- zfW6Dc#=6J#i>KLUeIS>L>MK7uE#c57vlcbsFPUq181v=mM@9gAooV9x7xlI~k%I~y zGA+$w7^TZd92I{dKd*lpycRe86WNS%Avv*!Fx^~g6(a)Zag%^5IxNYuNh^V#<1<~1 z$>Duw&vap%D=PTa1>JNo9T2ef9j5L&WqZV)nuCO17-(AHNR4&q@_YT2j3L`z$>h@Uxw5@hJ?!w0tpYpI1$l@e4JgmZ}xcx>{jbL3a zi?^FdAR(I46J}d{{yp6A&Y z;wk2XN-7RhuaLActkPsVa+HyM$w@w$PK%o+7=IAwoc1yI&%>Dnn8~Vyt*2+dG;bC1 zFxJ6t6Rln*E|v~plbCXy^J$57E+A6Uaim!C9OX#9=2MMmc|c*QNO;4Ym>J_BD>H2Q zGD{Xxo|fHhqymLsIhZbDwL(OoM`s1H!IaI8%lV?)^0_dAE}#l^NCSPytU$TsJn(6O za$tEv!-3C5I#pf_T(q<0u6YOTIBL%|)osLz@pyK=Nsi>mvc|LX3Uhnvr+Siu%E0qv zdXs>C`@HMIh+3JW7ZW%W2mRv%p|L7qied((qVI%$AEvOmehBTea%sqoN2PQrwu zSM=0$h~mkJTtZ*)D1s&%j1_qyKxG+O$dgk!-w!6gBuu7`)(_<2y3N(h3(3sO=Am41 zvEwUUWIr~P&U8Zvm-w%kmY&Ey3X{(d4@{^re9q)4DTbAVEWEe2X&3!~dGEnLqwlqZ z9H83vO@rl$kD)7M@}mr*8AN%4JL8p+v02>m*qG`aBSm3J^bM;+0i?P8a8Kuscq`yN zyj#J1YnW_>p9OG(DVh8b7zcM(q3Pb6JzOU#v|uAQ45EYvzl%gx{7x@~rc+5=MjC*9 zz?-Rz$XFrX9+X$wNB>0Ax3kZFkf>^WtEM3h?}RDGw%)@f&`;prpXG z9f?m(l#-pfAgQ#88dQDTg)z?!XDYe??BwwEI9W`B@P(4zB_8C=680mfURRbZ8%LWX zKUL1`+!@cc4st0u_c-N2gY(mh)sTd*!&Wm4=)%ShPwi9yGqO2QD1<_ceH=`P1VCal zX%VF|6Qi`JN@;0WEp8fq)f=Kot5iHRW98t04}j}D5g(H%*e3T|*0Y-Zn`xE@f^9Jf zK&obYxa7W=Bb>IV0q6mnSTgTV(+}7sIx6XeX%iT;{QpZOM~O%v{Xg7(1#p4TOpi3XRl=4EdwYlZP5T&t(nqeQYJh#z+N(Er?u~ zRS{tQz@)l<#f`ulu;ys-(4w)jGJYh46b+b#28$L8!=YE)E1wBRas5Q;g0-9Pj`%|w z`-jnPFhpGi%EIbBYB}0z#L+2n^A5-(O!QOB;Y3%0;%9EjArlOjGe8)ZixseLK@OJz zDx=jwaPa6x2AC8~KY*i&hC;2Ftbl!F-9w7^`&(IXKfr#a!E_xh@?v$NHH?wWK&8?` zS1P8zxfHl7n~zv|TA4aNJr;&sv|wm-?$m_7Uy+apdcr6y;P!)|g)I}t06Ow~5tSYPB`V`30e5Pb_EqKFKTLy8q{SkBG$bhGmt&W>_1rN;_4`$K zKrUqx*BB*|*sW@ZtB;fkoT{IDj_|#T-aU*%hJhooVY8*k%*aRsJ%VXmik=!pa#;4E zXuTIW>s8luC0?@&e+o!Uf;ZTFKupm9KUxIJZAl5DssMT)!Uqaf^16|A};6oA)^tk z5!3jLuE9xc$`)*dPos`o1s)2Dlq``AfV6RgH}Z2!VjD*M8Y9PlEYi`x@Q&qZxf*1( z|EpXLYPOcIR|JXJEKlqyea1N9IKiB+dm^h*nK2F$z3i-vS zfdhp5%F(9^@)4Ipu4Mxb$Up<)Zsc)jKp=~cr@W4m83r+YK*pek^J zbeWp~I}(tBc#8Kps-g>4Ru|l+a&ZucA?uf}vO{$#E+<-$nGOSjlqzojD~0ijMuEtd zrjEuT*rZaRL>%~#EF1Vkn6xk?QWvs6=u0}}VZ+3o97xxBI4~^i-0ft*u)w!?l%i6+ zFh?92%4K3sS8R5npc%5>CquNgT82~^mC)2cKnEUnR=9cSLN8(B<;tQY0+&R-IIb<> za%>{&VQi^eq^^e|#<@%w=Auk82y+aAOUq0%pv=V+jOa-ox=BT{ z5?;!x{iXH^FSW1fC6~)pO+~?kih@Q(W|;J(XL{mF^@2KRQ_&46gt$ZE_n@X?N-YQ6 zple`}6bhJeXA$wG@>I`$Qy9FFU05c5fOVD`4MFT9wade&pkcpK2Dc(Y(@Q{F31XiC z=sjCbATKq@GlWy9Bnnh`I-=9EFz7-5Mjk1L!!w46WzY76?V z7Pcx$gf!&@KbYWagTt|+^d$}Hw%Taz#0YmDVyotkNY?E`jqWB|JBY3eyDXLUghG(2 z`!9|e7o>Ht;o=71ltc(qhP4?ezIQ>XB^Y{8Q3-#*R}k;n;5+{{|6WHSAwSz&hA|(1`vF8^1yEXn?V5z84$+(1OoDnVR5kJ5CF67V{ za3nZELUdyR*n6aCu)1^Vb6`6U(WW`$Rm9J}WRf0@_KV;ks8q4>sA<-%3rep_ z=2s6UT0d^y;692+vRcCP(Q}NE8RP>GMnyb69Ai>^hjnC{xUl!56cTI!5R+@g)8dvR zIKK1Xk`}HTO~j#hnjeTE#^57N^=4{;r;4W-g)12ZHZWZXkz~M^OYBiPeqm;pjYsKu_X)&_T+LO4YSuUxYc=?{G`RtF-5`yf6zmu4N4OT08)(z07U<$ z;C19DVq)pnxX6A+`F1W0pteQliXN_ArF$^5?qF@=Q{p09N57wiR!ss63G}t!V_7Q zI~s+|L;7?<3FrZ1addaz=uM>cf1IbY$yWlGcsY(+h=5nzUi`!xZO5&=-&o}U_w3P zFa_1+he>34art4SxO76*!?)qFZpLn7N?MrpoGl99H73Ep+=!(tQ_rF?4XsN~%P+cR zK%B1eulUuV5+|g^4_5>#n9ZwBFuE$?s7V;$z!9kD>fR~vGodfZnX*Ih0;xQt==;TT zqNFAWZDMr_#-S}&tTU%SSST%?8OFl`aPCE3DY66p2fhfDbcmcqg|{dKoB%?S7DLiE zV9f-y1ulxiZMezNqzF&~MBW2u2W)||8o`#4fz7c`Xdh$*@5ii1P(dnKp+hnzMP@`2 zp+i?P@Xw((Gw~40IUg8LcElHx__t5t5@0VtxsfR;9Lxnt33`N#FiDV2JPO$CtQ$-> z0m0n~5NQao4_4(vabT#~YMdZkT2z-lV7hP<-Ud4jgv-5g=Ej5aAB0g9-$NTGnIX8< zQw^DIo@z*kyr|h6dJwP}2DFoogpq8%>;lCXMJ>(j*9^5FiUqP`d(EC9`ZYXNh>oHl z@k8@bA9_lfj13d%j+RvUBk)HtTICQWiCBCB;DUMqfEG2(jv0l6m=#*9O~NRGtg!B= z;}{=L2Q%1s>Hs5jxO`&cqv-rF_bRJ!*-8T2IM;PlsL@OV8&oc(iXT^%O0IC z;I09DY$VLx9(c`R$WM zV*|ve2MW*3;hHL&MOMRLO+n^v30&Z}N_r%ts(}wIR>@-_%H6SYy5s>8$8`_M zW5B(WnB@fhYEtw9t-ii-5bXu4mt;H00Fa{_=Inh6@_HhQO(M%kf@aF&@Yr4#3!cdu zfq%0yc<4_Bzx(9!f+aFTC|lXIOLACW*aunmkxk5A8e`Lvc>xn{!%$%+`(Jj4tn92z zx%Yrl!WR;^yHGqY>}IEBdZw$ri?M451OunavZI)7$3E_8I!3~!ir0qO897ALgjL=? z0%{ln>UKs)qrr?$*_oNySsCUAhuN)46TX_+u~Ww^a{+FNrh2{pkftQQUs@Gbr~tZ% zAj^R=lM*)qDC`Ix%61IXR_L~12!%6I@UdG4Ly?evoC#+qXu3zoqgDrO!j?dsBnM@* zssp+vzvGtBU5J|?d4LJ(r0yWUIc0@0eT;ecni9_>yD5Q5u(DBoI!b^&>b+hkjk z;u;plC0&AK#N1Pb5C%Ek48@BIBxwU86t4f3C_8Sz0r+sd6EZp(cgZq*vwA0(Cj#by zjARMj(}zNS<}z6f&3DM8=jnlc@fXVc=U9;KkVsXS-~E^gMi{usHUpP+5M&DeBW&&1 zi<-L(LO2J*84`^J8Owv%1V*d+?GzW{VRKnLLCD3V67-*d`_fPZ+$tadgHtyKrwRuc z;l~oy=Yo$MfDSNEl(;X6N@^N+f`=`;x#x&c2CXfzr^Vak{Wi>0nMS=0g!cu;~Vw3Y`} zEk-$vB?0X~K$e$BR`SRwv%QaVZ@ktvbrZ!1lTDEEFeH-}5=DbrdJFP|$!8&+ z_prK%H0`p>B|8u)!qcgP!)~4xdul2>7fmPQKg=cl|2#O*k$bLp`ab}Y_kZ}W7XSYQ zf;^lyYQg`@?9{%a)&D;$46rnRkP`sB5@P_I zQlW{&lSc#;T3GNuIwIg$NWeciB;X%*xYrO8VD8vq6Qmv!kZavRBJwgWSUXeJ-5emq z8UQ80+Ddpt0xbuC7tmva$-210JS39`tqQLKFk!?Z>~+-8c+@mqe;97k91ssuUYMSO zyN5S~#!oq{xV>Ps^H<3nLwYQP=TD!~L`pjA|~&+VzFQDVbj+c^e-zw9|p zLQ#;A4LKf{v-+X)eN!1ipEwY%8h%3{&gy;y z^vHzY(6Erue|T#2-VAp$kkB&8v=X-i>F%9gBLB`x1D`1DXJ-YnQ@xlL;>2Ul@m&}s zhkjj9F=J&3@EbQBZ=3=U!8Qn76=R;~I@{fhZ>1H8soX@zPX+jq?VCvWwQrudV06;bHPYLgg?J6Z<^KubUceduH z>NxjuKtzOCKyntaBvIm&B(BVA;OmDCRmYv>60Gd@R5Jz{XZxcrDkv@~EE=c-&czAr z7MdskpkO`%Jy21N=pu&~DcbCH2nQ(+*4XE`i8%8Sn*>S-`!uhON%Wy$jXdY*K>5Yr zK~w|N<~V#O8^{8~C%1yHB^|@SK#XC1r@ie9f!&%F&nF~xR3Z3m zn=ImNx+mC6s7U$GF=>?F<-Y}L)ns&{_Gq9bD`7|+h*E=8V0**FL2%O z$xpBlds&HkUFI>Fvakr7p5f#OM+ua5dm|ypRjZGbkC2v=!b4a$s!7R^H>gm6;R3KH zka~H@?MJf$(-^?D5sW`hy0^ge*?^@3Rw{k5^RX6ioWf<&beMKUfy}}I@Kd9NCRWwk zC6y?Uo5U38qr+Ayw5Oj5nqJ%~2 z2d+_bxDUkX54gd_NHdL1c&q6_F+>ieoW?YY@4+tWz`*4YN5=LH4GZx*bQ2!Veo;_& zx)x=`hEhd{7sVWhAyzU1QDBh_xLmKqy3&?jX z802*Vg&a8?b4xOaHg2p`Ur;G$XS0f^BW7b;9=~ir2lXhQR8N(F?4TGa-Qga6856?~8F!|@LxrdKMzkVR-X6Uu zA1#l^#Lq^Iq9yr|{t7Vna1`I5kH!n!16ShI#8#LuJ6$O8#l=p8%>*XSlzEF58c!J` zm`ogjegzy<9cme7&S;hDlKX@z;Uh&UFvdieIdlP*WJ;oZCHTaMuX^Vt>b#T37#qC; znkI~$Dw(lo1uk6!DzMz3r2Dz5Q7i|RHXJ3L*T!bYNJ8{mkA|3Z#AAthA5xu`y3Dq6 zs1q4&5X1Wbe$7-r-sTmR(9od?a*f9laZSKRLd12*lwt;|2Tsd~8Vz1X(i*HWfQBXk zWLNY=At0lyZsZXgFq5L3?f2nCdb8H)YJVG4|0)JqML1j2VW^UlCtTFB%i9=P~Iy zutdK_iI{whDVmE-L{tYiG^QG7-aI_(HAbjh0oLl|M<@X%Y7})UL@0g{8Q^eh#=Z%_ z8AIVCAhv?loMV0c&DM1mvK}R2+ z-EK_+=0kDeWf1`5;LV~_zo#k+E7lW=V&^p0ASgXSyg`$cCld-0~3 zHU%A_3W#{66(XJ%00TS_QpZ66i9b@;qI{kN9;Ut>-LRk<_iQ28c&jWz-Yr}>WL?#n znsNR!f(pj`tW|)%%r?XTit;rBkfZDZa~<)hQM!7e+>pS2HH@ORV+UekQ(PnPG7?_qd1vLq&fHK6=iD5zDkj@qrzhBvHYK zczMSPrC_coiSz`%I7$%fqK~E#=OeGwFcQKYH+qQ!_Yfb{N6$fBc_Cd9;vGwDo)cj% z2TlnJ_ze;eC7!lTOq@osUi#cclmMdcm?qCcCPhK(awIS!p0Y9d)YK|i0@6>VTjhXv zV(iAg0>2iB5|qt*jS+&Pfz}5*2E;qbI%lNe%ACP+%C%q*@~9$nI|yz|d`p)wbk-mf zK!YAdC0f#zX-a93Fn+ixVqx_VxHn59{iZtvJQHT5q)N20f;KeYQjm-HH8D09{iVdc9LmB6c%?#>X0N5g3zjE zJ}mh;WFZL2nyf-jMs*xn?C>Zd>1$yHR0ZQT@!h=1|0eoL@=`@C3U)twg@3UU+#%4L ziQEcE9~OXHR*+q$rHe>nrhAK^I%k3n2$xW}wgI2lC`Giaguy40NeL3#<{Tj3=+;^A zb`6S?F2Tx`3PKM2!jU>a_=QorfsJX2989C~ZbB4wQFyew26iSzO`YcU4>YA1!nsUb zTNac{@uG~2dfZ@Ofms#EZwNZCR`&@(~`!SyOgiB6##CPq+w zxTKC0&GAWU@Zv*zU=ceIZGfA#<4N5H=`=$D~(@RNgXQ5KiU# z1kvHn<_7CBV1z0$BVXGnw-cE=f+sN5)0QBhB*9U$4c_C(%;1%pK@xdsj)Q|%MyAxT z?(p|{S*DT^1M{lRP0eCLuVEWvaYd`78wl%R4=)+>k|Y9 zEH|3aAkiOQj7fOcrDJ)*gDe)J zevxTHH*9kS7!+~S{fHxI(QC<5k#NV&7I!EnlB)q27-d3`M7lLhsHS4l2-Bf%Sj5~S zbr`EgpKO}SfSUuzfeXL8N|U&0h(pY_L`~%_@0e$Q>3inoRC;lBc+RX34cjM-OtL8$%(c!7Y#PF*>Kbn%b zk|~5Im@ht00)Zac92$=`bPR~Ng=VTF;5nidF^%UYlr=xt>48%Ks+Xi2hppQQMM*2# zq-?#%2CWxK7^l=ebm(n?Gc;9SZFZFypdriLqFo^jSPO!$FeiKRA4j2^n}vE2Q=stqA;-CPM<(!#RXkatI$>d)|bT6i0DT zP|zi)Amt&%;YtMUty%BpRyW+$T!G>C2s(Yt$bI0gz;?4_)~LCbYu8m$rZQ)?KU|HT zUke&ntgKZvEGS-At`pRCxT=JkOb5J~YPAkPpf!*?*Po~k(2C+KVb2_?q8~6&eOaMa zi5F(2vgs&s*cppJhbuN_q484%mX+gcWT2X|u>b(Jq=sCT5jCnfOjYZ8XKHFqTHOHP zA4gNGgB#>r?k6n#{Y*M#Dq9%-(Y*mt>K5PQq)~0QX7^qP0f&9$Fmv z(Dx;3+-gb6IJhtOIW6vs<~VNL$~+4nuoUrInfR#}|HX2zjRBVUGq^1h?zV#NK@dY{ zL~Wz~ApG_OfET(Cz|nv#mS$K)o@JZ=(tvHb1dHFUli|h4DjjS^jAy# z4~2yvVFKt{@;`S>lK(lg)3N-|f6L!LIsS*I^g5&j(59dtp8vxsQw9+BuNoZVlm^8D zVFUh2HwW?$0B}?Mg05^MEp?JgCn9uYc6Q4P~_avvq7WIhaNrfb6hIi zcoZSkr?@p80?3yPMEDTW|46Ja8JSr+f8cqBcmM&EA>p&s$kjlatbsy=-7>s7T{6Ff zBvc_IM-ad8^C=4WKqDTq#gkaF#_H%!peQS&=PF`0)tpN>*$f_9GGW%!tW0a>jB1l# zSYy!n3?2<)K}E|>HQICe+6X196)EHD;bW0m8jH`T$(way6O2Mg>fsN&dUEkOCfB5A zUA34eH>sCWdX`1cWNDaFcDY>Up9a!TdP>e3bEFjOIccZ{Ze($ssDhWdL@iePbdXHCyt3@EJZ}>7OC2%M53S4 ziXG7g1lpt3s8fou?Hg4N7xcQ8{YF36fPJl-ax@hTtSa2+0yE(w zRDF8F7Bi7MApZkgoD$Z*!;S_NUmDtAF#B|>GrkCbi*@Q?`oX8v@!QXB{IR(btL zYOASjQ$rKUHZ?rQO${`_Hmo-~-bt57hq_5Cn83rc#GCgkwg7aEI}^6==%*HuqjrQCUQg8kqp&Ap!Sw(7mltiFD1PaPWc}Fwl&e8Zi7G|e23(8z*i}2&uB)lR` z@r!10rA>|OG!5k8O#~AnwM(g8!0Lmo8&VL> z2K7nLq+MYxlr)!i!W;`Pp>pAp3o(J*uZt(HJw)v)akRP~$qg0;;hVaQcY5drz#~9m zgy`=H?zm2hkxnEh2yc!jDM=?OIexgw^}NFP%yD`UKl@$v!qqb+!9zz`OhTq=91(-m zGYK%dgRCgijC87o#?_E36y}j+=A_Mki9G2Ig{wGmm=97AiNMR6C>swuJ)b6Y&SB@i zMt-!9rlNk8B=;tjg+_R}cqJBSvoZ~|x-GHP)Ly;U_GLuAPR3s;p?_V{t*Qyla#{CIG> za#Eff)fX9MKnyQ-)40efh(89yj^B+6vtsyaLMUx02+6F1=tL}nTgm&9(rG7XneiOF z6dKccv+y#k2>E^790eT!RxTyw+ZG|v%g2a77nMOVkV95IbiXNn8Oly!+MY(VJc+5RM*^SWx@)ViQTG7oQ)5 z=#x|!2=bou>i#~>laI-&dm3Xpn%bv{4g90^PeUe8G9yPz2d#l8MhT~|?Ek7lY8pBP zVsnAdVhog$>ZKNvGUA!R2f!)u0PPwS)+7{oOlAECsjPpgUPt{-)a>-FZPo4QbUSkG zj%Y54erFt?amp>~Fh|8LtlCMyCX!77{y-CeACD5hub#yr%i(Pi6QY{|CivlpWA5Pp zMtATInaAA0|H*%~`G1>TG!M6pTKvB|ouAbqKL0~Thfc@*zyFTE>jn+%-AFne_FALD zK0S-szf<79l)CKy{fGZN$7V|_DeRe7I)44vld7Vn1#5p@_~<8NX0Gb>cHgFN_gMG( zs`}UNk*1!|@{S90WA(@8-Pz>wZJ*D`UN!&nRh`?fnsLIe6IW*Js?#%U>()lPaMn3* zKG~-66>WO->G5{ol)|r^pY0zxc>jS%e%$uq+;5^i`rNVk{fYa&h>m=9$f8}F9-SEa zY+>UaXI?(-K)sEd&-(Sxvo3Gbz1tf%)&Hve*IR7+Pwdw8zI(UyuKQ#AKl)6${P+d0 zcKIMby!jP*+P=jlIamB?tNX}{y;8=mI_`nzT0B=dePT=RuA-DyUr$~7@i`x!YYT7s z@U&^!o2E40dgf)9o$>N6yj5!WTrdKYQckZvL!0TY6h=du+&}FTeO=sB`w`pMPGb-tj}7 zr%qjVUm&kvz0KD>T9DJ~toPUZ`wqC_xp~X4Xe^!Bp=ZxucSq~nT5g*$cGTM+{ORn| zW%F};dd%K__0?BTpFaJB7OpwnCSQKwkKYz7Sg>of@8V8(_ODZ?PD}5DANEPP@Qi0S ze7$`6@^Onl3%)RH;o5uu_@eFgEz&PKyL9Xojf*=EzP&@^^D|a--Z699uuIPDQh91% z^T<2y9aS=HgZ-UmwiAyZ5sh}gtDt&}iSSwo7K)--#3y6bv6er%mD3wvThz~4{Iu)7`{Wi~vsS$MMeLI+v*(tqZ*twgcDBa*RNj-*YHRB zrlhIMTdz9rOmFFkz|#FcpM1gz>3wH*n^*U{d)793tEKnE>7Kdm%hx` zAK$p|M%ynbnr%)W{-Vt` zcI?=1>MmF~;GWLf8y`NX%=}`JWBOMQ{_;W{dG3vGfB*5l`~9y!ANVD6#o%)WPdvM7 z=e*nZ9skq%^j)ttD=6&KXXujg-+jJpYNO+)uI%6ajiD3zO>U9i{LEg_UUM&dp#3!` zowfdHrC)x2el+^*z4zYxYhnLC%kTO08Er?yxvuUPHnXj1{&SbN-)MPjn{7KkYSE)d z-PNm)zi?&dxU*Ib7*)sh!xQu76)gH>_fHdId5;WhyUh1&^yN=Kf8w**vu63q$}So_ zc;5W^o3;0IuKelj&c&UpzMp7&==VpOKIpyw{uNhVIjUFhVQ*%CaN{=*Z@9A5>78-Y ze{%NidTh}>xsy)sFz1pFdOg)mK0K)9#zk%E$AbUz_b;w_(75=l@f5(X_@pZfw%pE=daLFcws%{4P40`!E`DfSuRbaFS6=t&U3U-rbWOCmcl9>5lWZ@yFW>e4oR{hc zufOm1%GWPBr}x~xua`DH{q#pa+5OxnljdLX!KPt0ZEC0E?)~}+_1%JPTj$j2 zo|l(qd!yw`+R2-*Xxwwbws-IBw_rgN*V1nW)U7z@(RWrkva)7op4(>OMX&xiuj8t` zb+(LN(?;8FZ2a?qXYZReXiM{}rZ0WuzUf8BXT29_kv?+i*j_g@t~>g++lDNA@8(To z>VM$5w{h{%p%tC(-nMPq;Iy~jx^B_(#SaX+B09L3F&bt2$B#bxSo7xZ{q$3SZHYkO z={NG~bYIl=+*^aM*-D1qvH8BdD?a?NPG;t*w-#R0_|%h2R<`sGY`X8|`hiaKUKr$i zq2!nAmoBM$!H#J+KiK=G;HD*=Ter?{Y@4&B`I1X7XxFRRRSo;4_h{Lwbkt@xPgTEu zyWIQMqpRkQdE|-bi+9-ub=}=2rMtc7*{7X$^Q>lBV?964N}alTwdeIW_Gf|?2Wooj!UA9`cx-US!8>Xxdo32ArU?pOCe-+0Qezc=WA zSF@#~^HyGYT>iGLSH3AdIIGG&^@GiIU7oM{;Y;P6**E+r=MtsMhzCZt{4}#y%hne^Jn`pQkB_?d&yRzN~qmbCn)`BjBYSFLP!XO~|_ zwLBx(Go@a*ut)i-Ke9SkO=&!BX`yZ5IlEWhcHWRDh8Onlzh~yo$M!Xy=V^WQh7H?q zIOBv(<6FP*;)_jfwiBl{o^sOJAKg%|Rf_GxzIFE4*gP(s5L^Go$v6G{!$*%zvb}d{ z<6hT3eC~#Cw~QHc>EkIsjc$9QZAzx+-CVVJ&n>Ob+Zed^{AW)N@49OE+_zh`YSpk| z!&gR+s<>vl{UQ5h-!8kZN$X9Mwq6%lzPw}0yHhe7`hGg~=Q>l02c{m^ecBxvo#u8K zvN*DR{u|f4y7=-*|Jl(!<)UUQ?pW(dng05fSI)Tp)J6@S{H3Dpi35M0*Y(%WTYlK! z_IoG3Qn%}An~zKX-sc*3@2}UKJmm39o@<-Fw`-54D~^vfh~9et8?U@~$5idDuRhG* zG-1r9A9sFt>7q3`4OTqz&=)J$J+=4QX9vySw)~g0HgC0Te{S10)8<_8-8)lklNK$s zEsR`z$t8E)efMKc^D|x?_|mHvt!sMah7GrkI`IAVKmPd3_usEf`7XatQR>&H?5St- z%qZ#GWM;~D>5fP4$n@?%rD#tu5W9BX=V#V+Nd5YsSoPiVi*14I5ifkOeC{I`9r$s6 zRh>F#%~*9@T28Ae*`H>vSh#TE-JJs2mEX+SThwsNxG(x_|Mk1wnu0XGcT%TG-)(L9wEyFsZQ4c_ zw{-RBGyjcQmwfX0ozIQ`F5LID6?11i(YF2v`+n;bSpUV29WVI)+w`Zl>Fdg8l&p+p zf4{0r@A(5K?cMWfc8@<&n;-w-#cY)8BJ<8+~@GA@!QfYv#>avAX^H zdxk&1r@cF`>B!isy!oyF{QcE_m+#-*rP=a<3mUb$xlNC2pA1JYOUawrv+>qh&wEZ> z^y({LeO9@**}A>&J(4nb=AI2Nq-SJ=U!T_S(Ocd+Wpj&rZdiNKZ{^)K?Aw0(aWk9U z=Xm_?x?dlEMLqecuOBF#mVWIO-Wi!IJQFvLy}OOO;Hg#j~4}FzD8nSB~!M$=rA@bj`zLk&ZtjS{M>}Uc zQ+7_;@H-gCD~&$8+`sn1m3Q6c-?3`MZ$EE%dh(x(pM2<{(_1xcmE&z@Yjd5W@9sCR zoBGVtvyVUSwB_Ax-5-0@KFxRM^Dms2a>b{QYa{Dld}^oWH|_ehQIqb04=4Jso$!qF znJ#-b{`%7=SIzul^Nw|I*`ysS-=Ca&VEgUm4?T2Zc<(dQ-}-vP^&`h`*}Z!8={??^ z6|uQ0G6I);ziH{oXPkJ}mYmN!oZoQfBeMpjH@!0R)Z7_Q1fFG{eK(}ku|4D{o%zQ}|M|ncbM;xfb`2S^F?+-{SM~krB=?MHcJZjmJ2!-W zIbqZbr^e3jX?yPeXUgCIX8m)IEnWIqzmEp4eZS$dMXyX4y=_J7{aL@9cI$%=I2)Xt z`%2h7-C43_b(5hVU7nJceO8l+uBlh}*FE|9Z9~2+x%7>eoz>4@jqQG_#i)(FQywn8 zZL)3E{)catc1;h3LYto(Go-Mv@b-1r1eYIoU8R5hv#FgsSFL|my=TVURa4GBxA21Y zKkV_|^!01&zIyhGALp()ZuEfzFE5>V`wgd^((0YknNQA7dwJiY4;Tx7Z%*eI=N0_- zznyzun{k6}#nts1ta|w2UN^PO9OU1&^p2OVoH}*U@Ry1Q4Z3;u>@T-|8EtUyMN?k> zX5gF)E-Wc&U%u+hy}z6gTlnz9+plYzTd(_^%1@?69-NX{H@xJxFXwK1t9R!!OQ+44 z*n655x+!JZjHf;sdH3D-+|yHC{N%E+C)rk)6zvZc6g<<$o&Iyv@1}1Ey}I=I=R2jR z7cJk!NZ~4N$EpE$WVkPj`EwhTJHC0XB@=7U=yv&%&wGqm zvZi<1+y7m=-~q?_%dXkIcW1_yzD+khy?xE({hyTe=s)Y{=kBc2>dlvO+G{)i`0c+B zw11`Ti3=*`&Fa^5)!XZy*2?R&I`{r&O|DE0{Qm75zn^{i_{X17zPWnZN$;-vdR&id zPv7(P&e$tY%ip!|?&|X9?t;-de%r@Cb^hVP59hx-r}NPHtsfoyQiHEkCQaV8X5D@A3Et9ci&u4S zwQuFheck^2?dDtm^TgY+-UH`f@Z)W^_2ZtayY!h0$F9no8Lq1OsLS3j>bCs-p5GqH z2oC@8hOSRs(!Ie+KNj_sjvF**Tl34?eAMm0*e^D|bo{c7*^`F<{z8jRo*7Rq9QMNO z*|Y8CbDp_o!v(g-NBllQd*-&rJA1vJGU3EI^=#MO&}hxp2g>EEPdUX~XY~4p15(sL zVA8f5&iu-`?xO2EOdC{H_1oHo!{+wdJn*$M>XhzZ@aUtve*JFS%r;d^PifO|$lwwC zzkTBr+tmlMzSCCKx%op!ooN2I6DlOzYrfSZy50JwJ;T4gbkN96ZBD(S#i{9qtH0a! z)_Lchw`^+eu8*W&5B$E@>+yKJ-lZwg%oe%(zUt}qp3-Xddjq?CTi-tAtu2E}PuwK0 z^H1NXU&|)9Y)*~l*`Au{Y}fAe?5JaWa}?7vDsT2uDLJMwrec;l{hPd&PF<#{PP_bvW;TFW-gFMZ&v{*`kF&dMr${kY?vV_N8G zwtDmC_D@|^$GhN(CsNOUq3M0Cr!MRF&OICJjd;iQMg4ET`lGIG-3yDFb>G?H$9bVT znJb!PO*-(~&cKF&{hD6X?4~WJ2kX5w`!1X9{hZs+d8bo)lk2Wr{rk^zf4MTdMg5oa zThy=c`<*V=+O@}h^-#kZHo5JN2NplMt8HWDjE8PJuUoguC)nx!bpOGVXTMcGXWi|} zxrM*pG`Z`y>?ldetornW@Txj*S8g6rddufq{xf<8BfyhyxZ#G+RI&^#D7|$U zy5aQgx7p6Lt-ANsy00zy;=9o^T6&u_IS_iKbJ6St1A8C%W5=F1u9+;qDbHAO{!PcH z?7UzHI|=@Lc zJL!fqPRY-md_WpMvd-3*KlPt_QdWx&5@ig=MMk2>Agd5UcYiyYRQ^8C!Aba*S2Qu^S@p&DrMQsH5aaZ zqA11ofOl50t^c)mYBwvFjQH%UIondE^qKi;1PCjr#?2U(V9nk)SuG$Vb8W7XO+3?TRa(y=-&8-805s{7t>Ri{Boy^Nu`w|NGlNx_IM?uAB26+vk+ra`K+x zr`^$b_27c6A^!hnd1p*~dUjRshhLb~yA1p3Vw`>e{*wwoARF9{J-ClRVxj8$Ye&E^gz{R(n zvh%aXZ7zQ~vVA41jj1>z8gEZ48996Vt!;}Qo;UBRtFEg0?ke|;Xjkn-4wo!E4>?t?2WGG;7xIPZ$64M}xD!_;~HeW$V7U+k4w%V{f`AWlG~q z1A&~eTc@S8TVwy|j5=)!v+jOx)7WA&p5Yigb7qf`LdPfK2Y{CJF0HO$X1(PF#NhzFiJ^ruSzK|sF0%NZGCwO{|W zW=e*uyx+j6@u!~vzf^SYVQu}{9t|t9r(4zerKwGNAXAu)OB)q*J}=rXB>Gx@$1#(NYh>hTgr++Zr54t)ySLHmz~R$G52& zBaK`p9BleZ!g;8u*i@gaw_mx^*kXF}qreR~r586wt(@`TV?)$hJg)yp#s|U>){y=- z2aMlMZ)ny}OTXov`tDn+d0A?eOzxVnt?}HWr%%86aKoI**fTHLK|1Kei^Dy7d`+4= z+~Qe=fr(K`T-?=>GH-V7+&OCP*MR22gQTxgz$9A8FDu!&weekI&HZxUclg|}tunY& zx4??2PY#;;j8VV2@5L6Jwn{JDi}5j0gZ1ZY^jf>tG)RBxc>1(Bh44U)eKU@2*&^FK ze9Zf#(2qPno4;E>RodIztKn)ACPNlVq$kG+iL&3|Frb>Dnmd`QZ?f*OT)&Y=M7sbJq9gjKK(opmQ z7qmU1zckJ^{;*g7sxVH^*s*47;&+W%xNW0OFAx8L6~o?4JKQJU=DdTx=d-xJId~8n ztXZ?>VC6vT*#QC5!2hF1BM0nc&I#?`qe5x8+_Yei&6bDK%5E*v4k8gQD?!=%;<#v4 z!1-iNVntN$b(wynM#vYOi=R1W&gad4S)@04D$2wsCoj%mmW2$Nc=g&f(+>vr`>qhe zM-F##cMm;tD*5egQ>lV!PJ`Xf?zOs^=2+tItkf2#a;g};29{b)OXUR zjT`qwMs6ErTB3K<05>DXOzF_K+j7-C=Ew$+Y^~jz-ntq2J(x<)o+g`~kw0h7!@Rr% zDmC2a?v%IXiyhRB*)MhKucTS4OBddaGE_2hJyXF}!X2BjZ{XxQ=eh*nsg<+H8Gc%P;WXCp!?RGkR^+tH;&HSuo z*Ba}XgVS2IhFBdd+|;)@V%X$D@7ZBCHTBO!)_#5A>QImaDw0C)JxjY+ZuQL_AIv_E z&K+^s#yVo;aP@Dz`#6KDp`l~d)Z)*dHzE=}U*6nNbvNeHvJaIT`zSWOFE1}F+`eZq@M1k?{~kC z$Xu@cfpk1Q^Si=jsndV&BvGVdX*3;N?4w<8{A%;He59uDJTiOmxKiD#`nbzIZR_w> z`!@xAs2uPvI$*En<;@Bs^YZg8W%~}BF!%lI(npAnso181yP1aitYt(ZVhF< zdNnU`t}?~WYRL)x=>w(w<%bVFshnlo$0TTVZdgmei?|0prjV9B1%qdAZ*LH-gE51H zL&UY`2FpJld9%PNoe-1gUP3W9QEuy5zP90>oS*)MK|vhlSZgQu;#r!GqYH*q#d+gm z)ig{>*Oq3=;tnh-cWRloQ&vSOwo(7mImTsNYW%pm9&?v$cGD*krzYQs;@CNlw%utp zB4TfSec`-C=gJJ1K7VVPAE-+kqXFoUn^tPeu zxR%!UOQbG8kG0$sY|`XflJ))_WyW2lfhDR{+BE0N-0$k?45P}Y}xC|FLVzDjgU#a;G1qZDqV_&p?f`PCKK-?H9cOm$E4^VoRYy1vko;yk;z zQ_0qemeq-Xf!mKySbq>lk-7XZ@yXNsmD);U+>Qa4o3zl_+_-gzs_m$!7na`}88`-a zdGYuCpYkTQuHO(IyVdpe2<>qU1|wnKTJ;n|ovRE5OAk%>-^^{rg;EuB%7vnX_km;wIv+J@)_Fve7Notfk6a@z}9V2>}Ih z=6CMYXql1IP%$YNpOs0*^rYjzW>;W;Aay=DGvR5|W+BH6A~TBt%CnxLCSBW^vZa=6;QheU%O< zQwlN&xXFu0oY?3RX7eJ-(5|NDjE>IG;8~2M#_D@-5)*gk=1x>PfYYW#^z38vjN=$` zYs{QEZr>Y|zsAM62agHvPpRX)KC-H@*tzZseS$^Lrb{iAp*{Nyt>zlJ?R5k!0oL!! zmldf`q7EJ;6{r?FFk@s1?@lErm!Id=?i~A9@VHv_x$|U(D-J1kjB45TaBj}lEQMhW zmuZLR?i&2vu-~*Z((%)xEFM=E*V7v{na@ot1Dwou7#g1blIalqiWqE=aYCgLw_Yv?oo6mP=+uq%j_UT6fBE`W?{YM& z>Df9`)ANWL{qgD3^A_!s_TcEqZ&~P=VMZz=hXp7ED~-Js(_c?z+=rejaYnV1@5U93 zvMo41T@eMhh6XB|3wmu#d)MWmZ{IL4o0Ka>IQjLv`Jz96)uc)XveOh~mlKilo z?4+cb3)M>O%CldpD_(8M-QqB)vdYWq`=QHnD!b2?tyyV5_u=H%s@pwMpDbG2))*8N z1b8PuY?7=>!yWzd5r*tBW5*snbLO6Rs^N%;W5bALLx#*$s%_1h%DsC=%f8Uorq|2Yr?!Om9c)?jaaTzRl$nEu9PjGFLwyuU zGC>*7R!lT8G11m8^wRzO`LnY8rUwrmIP9}+_IwiM7L}HsKAAwctk?Hcah>t9`m0ff z!@b-Z@ohf$VqY{U1-s6DnDQibbEaaRbCoBs7w^il{`%{$8{0-Nc5*u7ab^9>mtG9U zQ-^!S+4}?H_J9F-M){igGUvJWmlS*s1P|Fb^T5yy@--qZE8cBcer^)iXu*KIo9Eiv zn%_s8uG|uTv6|%4)5_L1*%kPVkRgDr#l^+F6-M~dXago}*iMRec*q>>6WSjyCug{- z#eeqfqWb68iieizSsGLYdsrW$+_3r5dZ788>C7$PR_u8_x0gcD7&)hsFE`Aeo%5Ts zfBM^+NxhF{XSb!^HG6u7V(a8|?}**5W1v!l2F-SH*}Z2EHRCCTLa{cPd)&>YOf{%* zInQXJtLx)a3$sA@AhY;W|NSA?4Q+ORY-n(`XeeLBvDx`e)wginYHQl+=Np%QZ!6bJ zTS-#9CQW(U)?Ch_(`Pt3KB{fpx^-(0a~h2XVj^?%wb!={7`IE#q`IPPuT;eYf3t5b zFMwO|iCI1L!m)alD)l)#gMo8)L{Y;tI>#NTy@1r+MZm6zHg&pYN>yN@-95)xO5~y~d(*?6~o76EdGaI}U}P`S z%Gb?xb(w4k#+7ku!2hu#-`9Q~Fm7llwZ7sCY2b<3f#JJ)x$dobv2EM;kNLL1wC_Iq z*G~VFr9@A+F&_uzmPq%Ik6C+>`zmj1%8Z4llNELu-rXG<5^^#=-j~4`vg2+@Ts8MR zu+pJN9+2+(znvnLmhH4nGhpl6`i3oI$ZlYiIBtabw+Gj^ZWwZOWB=-!&kM4{R)^`R z#Hwjha<7jv|MqfW;MhLVH;Qm_DxN9ZMjAh)Pg&dYd~=+0LguHBuk!uYXEiGZ&hN9n zHeWYHE0VO(d2o)G?sB7it0GpSng-wl{fTQpmaKKQk5nR1{G$eQi8QR(hU_wLp`HNYd(U>h|jr0lq3q^j3-SN5se ziz?EAHumaKPo14TA0=hgen~Ag+9bQbf6w4q6v~S)jkW4WrF$!AOq@7qZ`Jng+qEuz zO^J=2x|a(4Ht@_VfiSsGteL426jBJ>_{9&o!@*eNuSinQyY@Sp2F#h9@^nw&GsC7g z39SeA4{HsPe{|@Xr`)PYt}7>t7Wb`Q^}VfGP9;B5t9Q`ZvuC%N zf6Giu;})Ns0|u;1v$C_ZO$mgllh-d*e)V|JQ0_>n0iI#X;ko2%o9dpVR#oPN9=6@q z^vzS#c%V($iP@A$&Eb7w&3Pvayi9Jx{AnxVhllZE-HEUk)nOKxTcQauv z+NriDL3j0;6lIE{)}q9uq{dI5ifS8W4*`Q`y0S^bJxxtbZHu#?wo-2R@OcXsta^QW zpWUu;11!R9RM`jFRi=AwFNYr-pSX0AiOH(ZA77QPX-&HJTw6)Lf;Te0$UZ6W z-)pTs*Y@a=!^-#B7aD6nolK~e!cEnZS(xE)rtU58s;Rm|Zys){)%76T(IYcFbAqdV z`%p@)9}V6xL0$dHInME7zai@xA1ZTBoH$WAZ!+UA*RN~86vdoceCgt;QzR3U1!~_G z`Soegl}dXMv2EMpv-EvN@>lFGL>kUo5`ovSvTC{1a6fGFl4D-p2V1KT?`mz1OiytDDO#t@j?OFuZzIb=ctQg1dLW zzue{Mef#en2M;>P-nxBzaE^BmY3Uc0l^4IfNqBy3^B{}C)>1*Su>^}PWz62;*;j1K zXD5%WPCT_B=>q#w<@134tK3W%xyi?#FF7B`x^>WWtf8Ue#EA!R*VR3)TB@5pnp`u9 ztzBhHZ)k9Gnl}5G{C<6{fOnnpA1QjVj$`~E58X5T*k z<;xfS@>O~&D$lR<9{r$(D|-mY=f{_~c3o<#W37&9$)17RBmbzxT1`t!i%29I8J*9s z%QRL|e;kW0TH(j{!=KZDQi5iK?i5FJXI42ap*-mxij2qSCvQhNQ_sOFT z3bn@N>e5|Z{rp;5J~&<5)K_~S*S+WMqR)Qok9zs|j5hGE2)xu9Z4^1cLQ_*SJw1Kg zE_Lvvl$4Jf`kBodOa&?u9v%(^Y!!&Ez!0!9U!{^%c)%wwONn;r`?prc)3ciM&uWYv zYrPPEF%5@%Qt-eR}>yeCF?_Z%>oSo-!cDO$755~taGLn#JC1D{^s`D?F+@?^i=dt;gsv;0`5bG+sp z4ov&LG-Gw}EHH2b14#~tV_|Xi`qn|#llHXG%FgrFty>3favE%1_NpnUwOpe|W>M_X zqd6YhAn5D+<-y6Z3zy`rmUCaSEno3@@y;(yF*P4!Op2BWNv zx+iC*4Bj-D*IaRH&7;UzKZBC&iGkxD+)B9}?W1VFlM5mh;1EHayJ5CLdBs~`-4c7I z&vzf`u;6p`;ceQv%F4>pz2xhi49dq8?&nR@dsW=iecrrgAcD6Kni@}@-1w$Ap|z#YFtW9?vkM)n z$$s)Seq8CIoY2CejdxYr2CoYt^w%<#)7pFF_-;_4t-P@%rLHNIB&6?G#SAz~18CW_% zQStcd^wyO6vb@)-r5ef=3U8*&l%Fay`=rkush~UF^Rt#F<#_JXCR;c=?=)arBy9He zi3+`Pttcz4dBan65|K4gN9V(#&7%eytJkTL23ics$<9)1wUrKd)Fg8anA*31+jnEk zS?TUY_wVcK>aI9_F3^eCbCSOPyt#9S4jmdX+T2VWi#IdZUz{)H?jPva zBWR2r(8%Ftt1{!%stTex1Eg&uMgU8xJjr*KhevFVr<{Vq(BXYF``t(uq;`00ViHWknGfkX#O6EBE9N;jBDS*W9*s;UnSSgZKaS^rq>@5qz>#d-f1=l%Z;&N~8Z`b&Z+ zhVu>!G=q91gz}E(qrAf(#X;V&3`l(RW^^yMKZIFFcaJhyOQ}fmMHUl}DY+miECIn_ zr7?XtF#i!uS<4|*?dOV`f))kOex(?FK{5Kj zrx=5d`RjkKC<8%JhT^&Hr_t$zu8{Sq!uFnkM>p#WryB5QQ#nv`ygKc}KagvnYlQz! zwCCpl{)L+hpA55>V>sssvKj&a!08%moWDIEH6PR4!I*#9d>~*+5Z&2qx;VtM2xbzR zhM2bE*X)+04e^4~L9ZcEFT}*)UqkWEfG1r-Wp@+!2+h_9b2xCgm>Cl>A!uP(oxLMMXP4bgD;w*#Z+MfE1bbb9bHmd-P5P{=Y0naN^;r{OzR2;PAp z@C$1SM9}vlv%P)}v|B8B0h$O^u<;*ohl6Bq?i@%1rm{9_PpHadAqBw1(SjVu?O9Y= zz{WF31S^_1;sm+EjK=dBjieC=eXx{9$B_JCnpb!;a1p>n(8)eLDri2CKA88L1LF*+ zC?uFSl-BMsG$4it{6PaP0f|kp%7Jo_=mdHaesXIB!~;o+hvq8&fk0>wXe25LP?X{A=*5eyIcgs2hA7oXMiry zvW1iyOHKean4h_Tuh9sEL1%Ow5*hqL77w&sjtJZ}s`i5D1`Bua{3u5h*oyh*n1z-t z#4IfL!w;DyOxJ-~5Lpg*pKd}$cFr~Q0T|cF6d*+iXtNMv^N+dLnHj|Zd&DC~1npap zGK7slQ1a7k2l`Tx48j7{qH*w0<6)v8pp~99CNkgz29%%NLEy+i6EHL-1m}c9AR<`f z;AZ495!{bQE}?~>7fHyyGX?hw+jOz}B_vD{Bq;S{K|mofMzsgi?U}@Z(lTi6LoLKs z(5Xxxt}n_I{w;#=-HU~wx`XGTsP3JI)M}tWJlP9IV%~J>GMXn1hG#JAx&@Mng(lwZ z6uuip86tvLj0OA>`yB~&ka{2pQ9{+g00uEr1Ol-Y)UJS(uv`$`%A?XD7fK+T?B9M_ z80V-{hX)ykG!k+X*ld)WSfUP;87NK^--kn|iWg7Qji$Lr>(pghn(j2MJqqeZP8i9} zMG=j7-rj!D0WV?{>YVEe_=YfkljbD&rvD8B_M=l@tjUz$%1d&X~9J@kE@8Ko* ztvxljz#HRvDEKywKUgM+jgnC7U1HqQ0VHx9>gFy$LkMs!f&yZ0z z3YrFg|9@`byGRU%+WM}Oe06FI`Q0NV+UO{W;MLg>PH1GK zff_G7Suh)bLI(2W~yH{Yv}w1=mfJFV(G3#W-mN}oBc&Q zD$$UFvVk3)ra`a({mi#~;38u9ETJK_>R#+E-U2AYnB(JzTY{*%gRv7S2`cS0k(miB z8X;fym;NTFE?gv%`c;E>G6jzlz!#vRYWONf?*8ts50lp-~Ux!gd5peFiK zIWR0|vv?>ZJsw6KeE4ic*gP>;ftWlm8nCQv6m^sXhPr})3QdC4RWOQ}5H&S^nQBC2 z&esTzqTpg5QC(dfuc*AdoHh3jNa zfyG7jjVYvW;3A5T4E4?8*YypFEd{|QGHuIj_Yi!PT9!ASAAcfUiU}CX{Qw?Z5h4&_ zq(Fin#2?QoiYhJgd{L!s*EJGhJp6(}(vC-l;b>;u_8B07d*z^09U}EY0vHZVXoz`e zVDrVEfJdIdz@C6%5Ob+e0AWd><{C(K>%SXAY?{ZiOx$x!=Zs@Wq_j^vY?M|8Bu4%I^?d&i;Wp%+yG5ezd`A$P~29tr`WO~tHQxR*` z9-ty)a%}<&PAUe{I8s4d!X_`-ok2-qNksNW9w<>>~A+8f~CQF#OW z|A_8(7}iM+o4c0Qf1~CfMa?c~f)N(4J(dL;ML`vUg5H2c8e}Bbh(Dc7X6*mQ7vbPXgRoyC^{2~&O6L3{ zvz8zMvhd;snTxI>BPGy9#3dO>F#B~anIISBaU<)jGKp2k%siLgb5YsgVc?qEA z@UT2i$O;yJ+7<~Wy`f%oYiba#*2DEDH0+v2=dd*Jq7P#++b3<&UP51I0}luG)(4$7 zMst{S=q{1PT^{o{%o9mc4y5poE)co=C#H&!mF|Dw^UxLYU-WtWLjH))6KdH%@p*{N zMzcI2E&xfgDpWJRCIy1_z&B0MkQ@qad&7Rud=d8Mg}@gfgY<6B7yWY&#AE&eAB2iA zv9p;WVYehYrzGl|V7>mF@^uz|!mGbU^|1G4e{M+uk90R&Pxx0w#Z;8c^I@Q`fc~$} z=StSk|4gj-M>G|U7P071G-RxLA*zvoGFI#~Qv5S>WDp;vQrqu-Bgr?QNr5|R!{Ws|BX3**KPolie8H8puW>YzUM^KZ6*OuYi zlyEW))RjW#d7+95#RGdkli#8LroQ?=mHKMZ|AEw3KiK~%vd`_GKBMdXpV~T8rcCLO z|4C=kzxzM`6aSE5REDw0Wj5UHCw$!-#2K32WCo4C+=xJ& zOJ#eJnPj2{fdk?YO%9b!^9F>g@pvwmu(FdIrZK(9AZ(e*VzP+v{a_{w+1Y~Ldf;yosGvyQv|$|p72a15`~+tZfkoBiviz~?fuH=v?-Be!LIQx5owY%7l^|`0 z=X7KmQZZP6@_cA$7J|o6SacTKh@c83UEdq2f+roQ8S>hUcqR4tm1I*%Sm=cD&XY`8 z;)4Wgpezc7Vk}%GN!1Zt{h4MWwD6T!BLZTxjFJ9ecPb>Xy?8m1y7AiyE+d;l0g?YQ zK!olV1$BboK#4p$D3MO%fM>zowVH4Xtq~GoA{;>X?a`QC)MbEu3fZ%;~yKzNN z>(%3(G^4UFYcsZd7;YF*x=%4N~~iDvLq zY|pw71%%asRs_=V&m~d&P`T~oLSOj%&qZn@@(mlfbAQ`pR;La3#@@Rkn%TI_>ViRh zI@lnjAz}>{{O->Kzk`qNHV|5X-!y;TX~kjrSPQ4SblF4!r7GOVPUUc+v?C|oZ42_c z{GV(L`aV9|ni(z*I=Wpnr=3<6omwQCp+|U+Q5SURi~dA2o7RVva^;ub}mkjaDWfS*4gM3xL_-pgU5(6b-hfbPgJ!}iSl6BZ)d#=!HC zBf>^P7lb4V8K@fg=%QX2VfR>$5+jSHfa&n?W8&`h5K7#wK0--G_S=Je_v00Mw0$0rp6=I|52oh|d9H9|1szm_oG^3gKu7El-H>shya=IUhYrB;#*O zM~@Q8unnNdK_U^l=@5Q)Umx1JnR|*l59||~p9sExUxZn+R zq8Z#p(S?AwzpIYD?@lzsPQ;ok`cgX(GUR3U?&&icvi_C@o6Z}74wSG4BVW2|ayvE9 zKTjSoPm8UrE#}xt3VXo`kX0r}oFhWzfEbcX!=hp?twRJYOv{n?=2 z6c~V_CtZ+osC0x9J$6MX5)eotS^|d+@Utr-Iu!{`;GrwB4(?NkkW0Zt3Y-8RP3fv2 zgl8QY#`D6804G2Py}Bv_dshQ=_grh|*>;W&-IZTZvp=b=d^QlxTr6jGbBrfo9hpL* z`h%`VkCGVdNrO5IKP6F6=qwHlec?eO4U5S{pGsv5#)q_d5vPN1Aqi;V z7fJLI-fG&;1R@X#gAVt+E%7b8T@B~hbqT7x(jIZC4PC$ph~ zAcrn#u;;d)OQPm6`A_Dbb$bf$f7pA|_O`8SQTTo}o+tkSW$TEvDN3XUCz9nHS(X!> z+Ln(cH|@1uU5ErF)Fi+Fpk+06|Ihm`-!<(C00)gudc-ys3G8w0wbx#IjaRq5xih`F z1=E{HzXQ{o-^6Ez{#RdnuF}Vh`0uNo_2pvx_fETgr~kc;&u>}(%MlPR8~+_^H~rnk zmq9d8(coXA@g=%7H@*1+!`nmnjVpQYw7hp(-s{lvUZZf1Bg12ZB8StF;mH`rZ>_OyI@Jo-;iY;cZu3mx=yVB9RUqRz_{ zfwdtA#US>=m>P1XED=a!*g}JI@)bstKy*yuuvY;`E=Rl%DR4BjMnM?TWB~WjK8E+B zpr6V~C=fr7q!%`K`g+lh_ zd-%nC__n|vpThb@h^pu)gRVP)cZps)PA?t47qF-IN%ARF4g`DHQ4Eyur9^Uhjv9=- z<>_-n2YdAEsQwRilu`=V9^`q@Jw*s+4RQ;>DxP=?IgzwEctbH|fCp_{E*k#2o}i~f z{qsJP__o$r>mOsN)h0|l=`m{2pv14K2;U0?yY~yh?!C%j_w*~L-7hoMngp$lQnBiz z%oBGQz*U$@A9f;d2@br;rOw1j3}J{Uo?$#VJ_(}K_b3J*dG1aPvR^@mE*50p9@5Mp z`$S}|Ap3F(;^UefJ?{ypm*A5;Qy~m=dIF3qLZ=;{=`tPMwR+gjjka*~J8eT{-ICz~ z$j``AWw!iZ>B9AGe4LFo`Cqu04SI|1MKY`2@*hV})DvK zgAnKev2Sj`D?27Xhu-&S;|W?y0I4A&l!csjk_!&^sUla>Sq(sd!&)3evyftVs)Njm zFA8r@gHKVCswhF$uG`Q(j0eP|KVi4e{g>N&uV^7R{9Zy-0w@}J*qx+dn2S4O3j1}_ zRC~Su=1^6VzKO@AsygZpD*|AxteOYAZ~n6TrcjsLpQH96EXe-bV%H*Nq^ihc>@Ds4 zn5BRyTV_@Nzx%ItE9(0H1g-}WVLZ@$9x^l6!{-%UD=F@m?~(8T12MzTUv*?&XCtCJ zD{Vk!AyKu3)9xrQmcp1x`oW^uw^UW;Lx`)BnU$|}aaE5)B0+gq%AQti@Ny>RY zya4@8&Vf(>sqT*lz?z)17dPEBteb-pTV%$yb5hJ`1QB2lOp5ay$gv@JmY~-Iva4ep z<49Q{gPaT<6cSGCO?Q-AZoh_Upwk8KL@*qg2L)I&3nuq1>54;$tH>2m%;%gw6(}q; zHmB=LcxN?ZEe36>GQJnMb0)BHePW{tRv$NAM7N%r49LIunnX+AijV<|%h>v3~ zqL2lO0&QSAJ^*J1)UObbQhDmPTmHTZby!^lPZKYhWGWqXKb|xBQ@5socwU#@k${QdjC-od(K;{^fPSwi8l~c(aP{8~@=bt1 z5GVg7m&F#q6=PgT;QC5(P08@!OR7n=Ax?rlyp<)6ssx&*Prn_Q1pui4?2}gEl^3R>F{KObZO%|8I=>XIRE({W3mrFkFN>SA`?7c!#8W@2e zc$KA#xiBzVX*a-`M8!;D9C_b^g$25oj3~VVO&GyTPz^ti>=ainSoaZk^x>FU7eWgu z3<@B(!~+m}3oB*^4nu7L-`{mlZ4PF}_ajTXX~MBqw!^WIgFzCXm<82qg{KqB=7?p3 zrGQ=!&3j5i6Q}?@DtfGQ)}tioRL7SkQMMh7@g|OXYnL2WLl?!07MggIMoz1M+$mjA zV>Z!*f^3VmX9vZ20vvB3@Xkw$rUa(E$3W?F8vD0A&Yu zfTqSMsR=2fI!72(8wBMTsK+}4Fwq@el8s;kqX0nCa0c%=2Lnm6F_c?EoEb^sc^_K? zM>0mz|6B!8j!PIggu8?wUoXP=;+%^FMJ?966D4o~&WpAJwd!SnZM{?_oFp<6_% zFqSiteVf8KGnIG+Daa3<544~ORRMyt8Sil1BpyryCOo7hV*I>xJpj%pONJrddpK~{ zghejh+w3%7o)hz_cwx5UY%~9%FN#J90h1t9^U&tcCGdqkve%a@8$xbK>WzWbC(w{M ziPb(I%1yHQk%(9cr4rkjAN9H z##l%I*d5R~)dgUW)@D4CbDT(Xucw<6Dx(g2eXBf$6*!roU5f|Lmw#L#s}ap3#kAkEhx=gv^cb`%n1$74gZ5kO+i-qTsjN*tUL`yqcHwM>Hfeweh+SS zqmacn@H|DHNRl#V**J6t3b=|w2U2a5F8A7$kKSc7QdgeaGa{&?P>W9b{q~clwk1%Rw0%li@K%PEqsgDEyf9H zx~9lg>F92nZfX`oimk}GN|cM(%`l=3s3;Lq9SOXqhN7E*1JOUmua}Dol z+6JX~RjYZPNS-kSPi^v@uGUoVt6=ArsDK{#^~FOL{6uwUY23)*3RVur`<(jsdx3ut z4L$|_j4}Csw+q!4YENZc{_~dq3T<9%{Bdz3Z7 zKTR}7(*k~~B;%_SEE}Z3v%*QLeQ*Oh4<#!$Y7aFON(zL-xnRP z33^UMSff28Sw=lJ5l&OQ&}7JbWqCU80yx9QeClx8fAUaOEvmxxCM~H>%$9u|J>ehI z6jQQuD%4VrZc9Dz;E7&~MaCzsr?wjB?3ZrA%Hh6)eGv?Cu5+l7+8?--?zcj9)|p+V zN*VtSwOyoPn%zY>iUtX$X|Epg7s>NFug<;#X`i!lgSAA)AZ##D+zutyL17JDb;DeR z6P4Ac&OK%0Lb)_yokizxXfadHDS*X>?Q|srV~$;A z$5J~L0paOQMzo+$(NIZkL=6N)R%}xO4a(7AOfQu%n>M&YMHA!|pQ_cCRA2>CqovM{ zN+q2{KCc&Ij13~d${Ycj)^i0Wq1f@cFFHh_V@=7m1TRz)qo3gX#M`LIG&O2DM%?K87PvGsPrFvGTy8aafSimB$Dh9UD_42%eu^rPYdZ z%7k5JHNLD6=qx zp?Cp;hDg3eVFQ~Y0-~tasz~6!e)Xdd%qwE9%Ax}>M@jtZ#W*q^k{QUv!yeMS`a1u+&Ox$HTN1OXIvONd7 zmbqh*ALLnECroXx&+>J?xBE&hZwwIa=9)gGsq|vcA;;^I7~B_#-m3raf;Ohy_>qNSu`%L)Fu4 zDeQQqIAJkJ2F(EqI|3HmVwSCW-ZK583mYF5V&ez2n5Z}m8psM-piqEbpK~C%NkU1A zDJ@w`q(_p7-RR(4kgDS#Rf(8kk($hz0=L$%`~tyj381$rUOM!ETs!1O>DI)}E4j(J z0Yd>caSw#^wPLvuaVr3WV4O#2fJ1dFtEshHRBJ|+YfrZicGp*HQsGO}-B%pp$BtlB z*G)U`aP;*kX~CHu*R2^e{aSilYc!gLYQ?nN>f@y1mOS@XWjhgfLqApDoLykC&NUJx z4+&jJYMEg`{_%*#<0gl8k-p;voyc8mydk2z^3HBft=T7(T?z}{Oaj=sF2Rm< z5D^8}H#q5=U2nS@Rl53B^>8s~KbeT!gq6&TAC{zEwnraA7~_y#(eq}45(--;86|O^=*-P^8Yc8#1swHv)N{ zxocso1g2%%4!cGghE1D$7Gl=CK=#!W;@^jl$rD`LOMX&Y|$qi7KJJd!r@4CN?y=FXu) zujNE4&YhcfCeM!ue@W62{WDDGLerf}EJQUFDr(}Q7K%f9BCIH^r_dD7_;yfkK@;GC z8X1qYfDZ-SpOx*s2hjJ^Aj+x|16%q{wvK+T=Vcti+hC^KqSOj+#twwW75`EJP zCMI3e0Ai1?1enllkK z29|+~v1?cURx`0qcZGa@CMe@;HDUKOh@))iS1z1y^A#K}{6_c+Zra)N{D`(Z5U@{q zlN2b#7E5%8`MBYq1G2UtJ0+9xnERm{2m;`Q;)>+s3S2Gjr8hVjvzdUMP1C^gi?mwK zF$fd!BB#(umxBBRpMq#W5+!_rS2bGI1F27&Zola=`#3!zj-c7h;ctBC#mW4M*g->!Jl3Sw;bK8R5h@ z;k~sA>M~%#OWiU&I6}#6pG~ncMX?G4ZTYW~cu~X=5*P*vo_xin^AQ4R4d&_PuYDI%s_0h(>(+7q`(e-q_`AdZjv<}S;D7!3ePx)GsClh9g{#n60c z2T|wZ_SscZBQ$JfMC=(foZwb?{A5r20OBJY;0Cmbw()Rs!!-&P^5-bVP3RL<%><)3 zKLWAuiQh**8V{z8xIl=BfF+>~gS`;006oxzhzDxeLFVC#(5jKWjB#YMe8(LxT(g!E z{bQ2%~2rjCaE*|qZUZLV_k)$Lms%z~^Mb22p5Lqr!0ky(0{z$S!tcf$)lQC3^ z^Drz+hPV!$Pb&R@I-w< z4@}0NzY&r%Z~#s~vA+#S*+z?*bZdzvriB;j+r5QIP3<6!u4@GXL8mM#ORjXrPCR6x zW%r1M2W)N+m&>M%|AKe->#-B{Xx0*?1~{EC7%FhGENb?-{E|`~;o2(uTCzMc@vnG~ zVU{o6rrKaM5l)_{kvg6$Bbv|@7s;$B?A63^l-&X-wgoa!xSJIwkZDLT8gVd6JljaT z!S!u(s2&++!@DM7ld|fUb|~0HFNtl3-5O!tBEDM0SMF#62lS*9BK}B?YQS5v2En~tlODLyL zPTTTVAx+C=e?LZ74fHx`V?xXB#)Jp7F?-1F!jK5es<+ws7RMcs47;xlX;Gj;z zA^~E1z8e8PHSI#59+lVwQcH#LNq#yXg}HuCLE^~W0KG(`EXzyJU49nshQN{L2 z9Asv(3W_Obs;16yY}RHIj?Wi)xk>|o-lNaZw!z}#b6hDaKo?sFu=y*J9Tk;Vv=}fd zqYx&29Q8yUIs5~eZZEPhdkP>l3vEojiRJb%&WaMivq6K>WM7$wumewAj*Vb^yZ|GS zUqimqNgG)b3OYMkp4I1frlqSlj?xH$kn0$*Fh^)rl13*{tTu}`jw1{i2K(i27(Rqu zB;fGOQSwDaM4Y0903zH)0>fwXfHuo_DUR=ul^-Yy(%MiJloDgP zp)iO^o_UYrG*W+%mU4_YXRoO5P-+`?Pm~OlMG3U4&cJX!rP`WPy{v(2nK% zp}j$-JApWT-?@L>xqtjGaR0c5Wbdx~2Sy!-oupkojE_m{N_|a~{OMTd&Q-KKnk_Hz zC)n_!N_+^Mk~Z0I`P=RTyo{l72FtaQbf|pugMzKUzAK0-*O;kI@iVB4;!SI-RhBMF zY)@4v&vX0qMb|xK>;Kptuiwt zffskc$ic-`+_^`cPhI&t6+&l_;0hg`$1X zf=Cs#ZD9&%48YK+J~KgqHa{v{gjpOlP4TA8TGXzwJh1;LR)tm$2g?wHE_j?O48bO3 z$5*fgsKuT##Y>H~nPn8C1n^j$Ne$APlBo&GyS!=}nQ~#W45_q)@r@;n5VJWfU?v*C zc(wryi`yw0J=?hOFa_B#+69IRc4ZIO;FLGRE03ww#ze2Yxx}4MBZ=thkUo*CO?RY| z{V!Tnls2{eDe}l|yD=qejD28;m17ebPwG@Gl4t0(?rw;gfVh&V|CDM*nPrjL<-6rp zYkl?4=ry<3FHHj-TWEhiP-!8Egq_3ehqPv-qeNWgY3amHnK#z9AXtCz)%LSzZ;rNK z{Y_>hax02c>cR=STz2|#0$+RG(xx;!Cmf_=9S=_>|5$8%hDm!TXOlS$S;45INiv4(?Z?!a zv)Eeo&Vo$bY*EVzS3uud8y%6KthiK`AG8;S^-uYY$t&p9S;#F+g(|@^b~{?T;pYUO z8$Rok1s{{x3zYAV(!x%|M+vEJ*?rP=0ofgb7lT*_&yAZeV34yG6Xc|Pp;Jj9+;izV9C&BA@7lXzlK1XhhtoEvGRy45 zU=>G|_PoWjqiOC;VpPW$7tdi00VX^4?@V9%RbDi6&7ka)PR0n%_pA$uiu{RiLipVj zvl_xA3VYDm;amT}I(gkX!Zt>R6^0q$9XCH)?8_`A2 zHWeMWlDqb+E{qkuw6As~+81V5pLex`QE{n-gRwHTSstWxHzT&+Nb))@;9opPojn`b z6oV1;`>MM+=j=TO z|EO!hg)Trv&k;dSui#H38Ho=qJ7KY4*Uk)9LOkm#>jAlj*HLy_uyVKd`lU(rWD^)o zRxI|!dVB#(m?-8vcN7-#I2q^46c*_*nI$FG{ar^pRb+Ukvgbcj3jajF(_#9 zM(zY7Oes0SuH{6ATVd4wLrfG&rooY*mQ9r@!7;xEWC7=u<&xOR1@7U8V(aFw-!%{3q^w_ z2H<@$g30p%S&#PpV^{%F{#8N*}Z+QDO^I7 z;t`N)=$COgM&r7G{a4xlG5r*wMK)(+<03v;kYc(u@^F>wI=Aix>V{={5h=JUamOqG zct@TrrT^^+q;PX8oW6m*scw4~5mf<1aE$Lp2vcBO-!(CUd_Vg9VLrptH(}6ojlCUK zsYzrt?a8L4-K;acqG%f3U_I%asI)z|hd(|wZFF6@RClT?#v#yP=)##jSqfV!#eF!R2d$P}XPfovL ziqB}Kj#v; zwX{1h=`^FbI~a4Ach6Yx!fza?n-Nl_Rg|T+JSLb%iIalz2Df)Q9VtQ2H%{pi)xfIh zdnI=Y1v;;o&aZ?;w5#k06FQN(Fm@bxA5%#K%wwBfJPuEyI2J|&QO|YHbUa3;X(WqT z$t#!<-LinNN{3vIudMi_E~&?yvV)$HQLj?LioY2%@=8kF^0o(A(zN2nJM*281wQ9< zHjgOZWrnDm^u6K)CPxOS3V`7HES^~b6(|=F`oxEWbD_0+EObX74J}GkX;3x2tfL+M z9*1O%DRX)jl2`yc3Iog!My)g`Vg%+xjZA72Kv&6;{o0vmrhRpetu3u`5aX%kondqo zTW_wa%BCNn*{&MErzjclofkft)WMXcm!(8rjvgjyg3I3)$| zz3|2qrX<0&&TES4Mef76>EWP`@SlIoc~BpaZ#PaEtDE3;=+`}6x>522*7c1imZ4vq zv4bpS6n)bk8B{%T6|?^k4LO>ysT8V%=%XSEP%KC}42ih4X5(Y7LM(w5R3^~O0*k{$ zk{I|NR4I?~YIG7~*L+qi03jlt3ncc77_;6*xHt;X0lNkqAJ^T4gMdJRFd>ouJS3tjT?0iW*Dy^~3&N%OD$St8sH_!#V;&Ue(l6`?j=b4-qJ1N* z5M@q5;4Qu20yH(PCm;zY%}Eh;)+H%_9C9$Dd_%5L)^!HMl>`H&ro>y#0SZD0zaj-u zWdy`wcd;ifZ-WJQnA}eQCOZil zM-TXr3gm1IKB@pMVTM3}7U@{W@PL-PW- zk#^I_1VI*zaGK(*aS4U^;*boe1uakD#kC|;Bt&lO0Fpt^1YY)><##NYSiMEYafA&F zZiRwkSi!O-zL6{XDMllLH7p?{7{Vm@>RvH$Jmk>lk_>VCo;&D>d9i*lP$nYKOxUN6cx z3LehrRd6y07w`Z+Nq|nD4yzP+UP*Q^MPbmkb;(*}iI$)hf=3gmZaFWfeLh^-P5i6*UR-$S^qP%ytg?`Kvic{ruIY%Sf@Q8&oh= z1T&?q*cs5b-#OcQ2!kAyM0l8P9sm)0trVf-2PVC4N6YpPhBE4oRrbMSK zpsHfNZva)5dd5Xoc}fVx=O%E97;@#qWK5m2j)SJN>r6M$B;kgM4?-6d36P-ZmEujG zo+}}1(?jZu;&{tek}VHa6it)^0Br{(Xp-1c6Kv~7kj*q%^XIi$qXeIG=Nyb2wh79*?3LvYt4LrJy0Rahz#zBAK9+$6$J8SmlEl}9D%tc}c3 zxErPLFcNAV?TT&##B)f*6J{OQjtL5?PB2K8KORw2#JakcO5Li21Vz_<b&2T4b9o z4X7ZP5?G;mF1!+Dmyr(Gst!-7IuJmckC$MU4*R0-NH|#%6BQ=w&UMOUNn3=Ib?3^v zCm^wb&%~r0x(e9`kNLC~jnSW~Cqdk*WMm9J6tGEHU7G?CeWB5LZh+}mDr~iCOh}wg zHAGTp7O_obn1X?X_bs->O%2gVL2@mVCM?P%9FOtH_69+Eq9`Tre2)80>P;=LMs6IZ zgLg|Z8+QBajYCgVM7$ACO=_8(Y`2KkswiX98S(Kw!`k`#2W(GLc#bPe7c-axrsefn z!%;}h!d`&dW;UayR3>X}^G)x_R(!xg`@~Vn?3ZH|o(GD2;!W)h61>{dHKRcG96-$E zZj(VpfN~+&5vIV#RYK(f3$AIbN<`@??FpGG08nv50G%N#lN^o=vaBZsGhd3NT>=I? zrZ~@@ByNLdU~b3gk?>J2_z}f*ChSG^3M(^`<4;jCF7Vo?AtkuzK36uI1?T>li+ zbJ#H=AzGZ^E}-&+C>!QTplIlLq!2RHHhjFd(e+UIcStZ?atxK2c1l(ydXg&5Gm&G{ zgXUx=_uw>YRkit>s@juAHTg1W>jlf^-*=&hen+8)9^Hi=y3Wsx_&?*`jmQ64X}8zc zOYwj1@;~3s=fd%SZa4hT+h^Ah`v)4iaO@we@2L6Et zpTIV%3jA}Gz6zXt4aq?b`>UD8Yfr4uKk&QSp~WFV6Y_VW;?U?lkt!&8;9KkYR6F__ ziTCoPrX_rNQYGW7DIs5NmS?Iii8ofKG(M=VVOizZ<}uT+89V*jY(xE;WvO4AVyf?y zSMF=NLfKokP{W-;RyhMl7FuI}fLfK)EC;W>;E2ejQ`zq+A7}Rx;^G)%Qf*ooqiPKE zrUWyp6ctShX5>w^yuXHE3zK)G0N+>+RK-=WravRNLUF@#c!j{(mWQXM=nCGn=n7i0 z?0T`GWLHI2@JwU{-;JzL5m=!ZSHV-aR!dN)!YYvX)(NUm8B@ViF%{g93Vt!9LJ3?b z4XRmQjd*FdBPy7H3S-ku=219>Tt!nrNt_C%U}7n_p%m;$3TR*M1*JF&{v2@>ys2>% z{3&r1ys9_~*X*A=8O={@%HbmWOfTI6PQM9(eGXB$QSGUVjd_+^rKCNpJfbGkBHMej z;7Vz`;aU#6vyp2)m)UXo)VyxL*{SPfPLR?%Rd~l1NYhLg+45pu#YuMZ`c-I(tG#5s z$zHOwvNN4zy(#WpGjM{gP!gd<5fUb!Y)_+r;Tg^21rK{MN1cz;vc%q!nOyD-UO!5+ z+++!5LPZc^)t)uzLc}L^c%WXjx7ZERo|;tSy4~9*W3}cQU5s{|+_LDO1vPpBwI`RJ ziQ_u`3fhHHh9a#j$b*&SFVLH1!~~p9j(Po&p5U1pXVc z)pZaTx?-~u!(WJdh-#Hxk&ummy)9)inoyJ>5^^uT>17~xbFnv9FDhKW?u~HV6f+%K zJZir%12h%m6uIIqDnQbJA!sRXy3V@}QGz=sX9(sKm~-y?chX>QR zAmg2v2`F~qc$eWI9pWhWnR&elN+B*LhnuXR6@;=kMJxE;IDrP>%Zt;2pOf@sru|qX z8~2=7TNO{XDM>Yu?xqfl;+0qwH20u{O>SC~x&+xF+$WuUHbAKqq7$AqVZR@BQPbBb znDbrPnQ4k#0vaz;XUC-pF>OvTvollRkQYT(DPT$=e9I(O!XbIew~59v*|OcxRhGDB za)qwm*?79*sGzC!)j#_{&Bqxsn}gsShxsW?QBc|Peu6E6YHvgO$wI(Vev{ahtBnG> zV^9YYvd8PE!3mNDBs5G#Fi~+2Cl@6tI(pcC(SRRIl&E|V1;^1K%Fm~fj+q`&j(5Cw zg^*UW!ZjB7?U<$7>awV{ty&3BFlD<39W#TDSX3oPY{^1aPw(E=nP}qjZ8y3kPKX*1G zTyaO!zCl;`ody=?Tu? z?l=vD3gsr--7uo9SAfIgXF{!hd>J_|I8XP~Z2QkmG=GcC2nKTCcqCYs^*h zFL4m$l(D^H<>L@<@+BlzSq#u)nrJC`StCI;)XhZp*2!IwYMsPMS`i_s^5V$E^%D2K z5@DVcowOKEsT`fuCE*8=Na?G>E1H~?XqW4;2!cKGO2)4H2Mj534XdILnMb-MSO5SX zZZ91ilMIJVphjgZs$88dUsFCt5c!Pj^mv4$Sy{gCoW;15WoN4!6AC+$#tKrcCBBy> z)f}?FAp0VE>&S#}WFJ@WQYWH5ucI4K->V9!Z@K2`q>mMm^+~`rBcT4|5cV3L2a>U+#0vXaVxfUu%CingS>T`ei*Sb)Ey$r@nrabs+cf0>P9)gtCI3d zPS==p2cfb^FA|5V22Yqu9Fz@2iRGI&ghH95Tq2G_>AqPJNx|m+tVjyplt>Exe32Bq zsgV>a11X5TZxt=OKo|vYVi<*)Q4|WEP(<>26eD1q>p%+gcs6?lhi%Qw>d*L4IYlW@(Hzw6O1Ee+&yxE^ zSw-;>3ik3-^^23-uP@92P4Uex($)FAv%O01?CW-Ub%}yDbt+MXl1J(cS}?Kv1ulRE z=cuCRs_nX3G)v!xPn?&lA;~#}l<2rnao6oW~nA$aL1PxqMM8 zxg!BV(W6y-5Uusbn?}jG*f=11mvKOxBD$J&Z+AiiQ>nZ+)jA-vC0~Bs5v&4O|AA>R z%sq;)PZ}c#qt(UG%5~NdCtu_PZJAqM<&}rn6DJE})L^z-NP^z){B z`uWp5{k-`+{jR|a>-L?nexIh`SMDe>{$W z~Kl&i|e`Nqns#8!@72kO9!7Z-z^CvKpN)e2lz(pWPn1{jgCFq0FXJ$k@_)qN%A$lG5o=m% z*^FVFg(=$F;qapi5s0 z4%*zAGRfJnjZHf6(QsYh}U4p&KR8kb$ zX84;u5bVu1JDlIsAPc9+h;`dZ>IFTQmG_{H-cdfv$f zCa;IjmhZ!N@5J}@Z>P$M*IGK6^y*}3QmrLV)pFjQcuVEhPP`w^C$#g!xp$&omimB~ zf6OLSq?!IP^G;NWQf++s!#TgMXc}H`exA_y=4bCjy)0Gbm)vs2OKQ0_3EBYciEmn! zZ{YdTq~|9U&rk3Lw`ITJr%TmOPl}7E4>cs9%pP0|H&Y~_)U>9a^ovL*)1M+-- zb*u@erk4?Fbb>U`=1I<^yE7Eh3QSERRU#!Znu8kmnB#Lxq)&rpi70)w%!*zlXBZfd zG=-)eOxR$=%T10mrP3au`3BN4SQoenNL_mn6jD#v72ztTXAPW#;vyJxhumreIKo5u z+M}MDrd=$cM}!J;&}XQ)$b$aG&QUtGY>qa&A0g+=G~=&XT(1|vFY^28&Nu42bA;v))*n|_wCf>h2_wDQ4) zqBUUjq{!Ajtv){W^qgj7<>RQl3{wl+1pq4RgF%T&5b*>eViqHd!xs@sO(j9Tea!n) znIJ^N%q!&U8iaicot})lr&IFo(G5r=waKzqf!Dsrm^}j>++e@FPS@(suh726ZPzr? z^KU|Uk-*HCC7uGAn`;X-gEN;#Q2!;@FP-Rn7ahzgxeDfjiBUs_sx2rm3ezrC(s|a3 zSz0ivDpfrN{-XzkYe=b>M!1s7nGBE!Nw3On?o~%uETZI&%z9!G@2uQk>EB;DuDJ&* zof0>5uu{_+yXY4o7d&Vx1@>GRMn|JQSdmqY8Chg;#M~LhMb?2C<(YL<&0PGq*1@Y# zSs7ZUnQ_77%u_OYP6WihmYF9g*c3lw6;>q6RVp62(omiUAY1!rg~LC5sjCv4(+w-- z(-(7?16~%ijyO!}*o`Di>P!V)&$1w(m=4t0MXyA5c8tM51INI&N|5ka$g}V?fQ7&E z)td4p^1uB2aU=<`9xp{tnx#T4c9>mGOAKZgr4ww9QeoHobF zH(aPcF>Lzu{R)dRjs)-|+LkuUUFuG4;OO zUNv%Doyi84egcy{g-gj#bwxE0X94cwLH{1&L9cHtuiaT8UF9>y{wK`4OV`o|TKPO$ zTbp42L!W~E&)Ujr`~UcB*V6lp&;N4!pBd|ayuONz>DBs}ZvVC1URhZytUr{#v;Vr4 z&*F7{kY#=m<@tb&IaC}B-~oX9${oj3RP3&=Qh9BLl(C)>14m}~W}B`M8}>PXkKgPZ z_i(ZllxoNzdu;ejfRM@~(HXY-TaY z<95fsh|&YNE%EDNL{}sI7JuuP9QP7lQ=Jz7Y#{*ZaEr@w;Fxq#G(FP=;fGx;8Rx2; z0NacD=Gsx%8I ztwyAk?w2MKRI&rZ|;%6Lyr8jCasZoWzUDbBuC>eTo9UwM7}+*}LS1LXyDN)sB&y zITof#C%J^0hh0oP(}hs9SkVqi92=f0-a6cSxx4@N5K6X}J)9i|<7J;*3GI;jA7k{@ zI!(^-Adccs$wz$Q;VH32XGN0wzkb1kgRQ4d!aT0S^M?P}Z<|vC&4}`P?Jc@;ZoH3y z=qs|}7l?)bZZZDg|N0p1K)=Wd5q^&HIum#t=E7pU;19zfMgvX`C^?Q}R?)Z^fZ3(w zP?N)~wiwsUu%Iz`TS6KP*)6WJ=#7UlF4E8fJ_fE(uJP0k&z+?;IQypG=8>NQUJgid zsG%N*XY#aO(+F%IoIEJTaC=xhkUp-_#DUD{FT+X2c@!W*5jYuP;`|i7u~1;jm~ay2 z$|E@+XA&mp%?m4-gBgOS#Uv-30eGC%2XvB}(_O?|wlH}>cJ;qna$wkdwJ%%?03f11 z^nP z4C$xc?Ps-SsQ~X|nqlc(ml8%`A3U~J-W@rGzBs=C5-F!=Ll^+BN&xVIg+qm1SYLRb zFEqI;f8l++;7$#ZYC_o!AHL@ai?Qn6hE(?vE$k+$K)h&y7|P2og^Gkzme?%l5yOe% zQZ6K7dqe{*KQwQ7C9q0Uyjr(#^vNiUsZ`Uir8SKq6fE9B2jMxB9x4#<^#%^1UV9MK z3|#2BNvhm6u6~_VZotKBC5Cz9ws*USd2`OHK3P`EuEaauS21^My zR51|)b71y*Z5;Eq?y2QoxSuW5n(hG1CR1of_S07X1tbH)N(W?}i(v7FIxCP=r%{ii zFbzqI;HlY|@ttJjW2s%c|M>nN?l0b7Y%Suy_n*MBfD z@b0J65AWWjAKvYTAKpFhf4HAL*n=@-eR$BQEts6Bb(HxU3l#= z4>pmuHD@?cB~5c0GiEzsI14bG1sD!4&h-yx{&Cb>i;X8YG6umdUNRS-i05LAQXvrw zWTsiz4MgUgvc)|qJRVhOsLmCh3;(x+{UQfZvys?Ex{0`s<|Rjbd?BM3je;m;P9tmh zy+nhoiVHDxn;S716;wOKvq~!#cpO+0(b%Zz>J4F{I778Q9iRBiswKmJgd^c#zxLhj zIzDsV|A)X1r{|Xz0L-}mFRvE!KX#T^SJv+C|F`jRxt~ml>L~rr31{P}+j~2}eceUF z3weC>ZZE;ti_B=9g$5dT|ChWRdX36|3TYKj-YF^1+?;N!PE14K59v< zJgR_F1q32j#9s)&rZ1ptG>W(IRu<+oB1F;puhe`#`qJcKHVXGBdf1Y2Z=9rInAe>q zt&wHnpbt2?LCkTz(^+mzZ;i_(ju@4tI3kqYn%p|na)v?mjGP1KnI{~RyRKN7kI|^! zX=-@}45H2*!QJ)m_j~w1zka_57x>1Ek;4THNHqZBp1#?I)uUDU!y39QRAj-!J-$>? z-G9RtXw~peb?=^YA%@a)A%q*^y?gU@g9E=OVBxj^U%G*`ReK-TrcaK;9n>+t8{d=h zXkuWiXDEGFUjgH4f57zT_o@~v84lrsSg$?XeZKc<7cQ2jBJ!}z(^3azEa*}cKbS8x zCd=MlTeblyBAk18=Z%m`s7iD>y?4*4*=|$-7uKE%sTCFY;cQIZ4)$sx8`hf&!XfGn zEC>S11^L{7^tn6>dji_ifE=?R{Brwn=cfXI0lolUZbkjFfbD>%qX9c)YW3wp*p2PE z2))o+u!R;bKAHBawk0+Js9L{&@UY?6TeKsKqEZ;;JJsd~me074h{)P9R%h*$CwD6CZu#Q5+Lpqv~GQ}IRV0X5u6z+dkhRSU_?Szd0bMM|oYzLB&Q zS`UE6La$={ zmZcV*kk|&r(FOuF2+=P3G49(ZIHk95UPuFZOS);oSDo2nOHYyt$z&}dHYv4hf8VIT z`}@X+hYed`-ETlkLbdvq2;7D=zMgA%GkShd?%6sl6xNzSpgK##*wyx2yeD<;l)F)M zwA`9%>`$fEVra?b#OxLohf=whayXCc@L%q71=u37%J{0q{4#wtOfwX6*i?WIl@Odz zs9B*@WyTEa3kO8?%&|p3%@M9T6Ebc;Dym-97-EOIKriq3@du;SvnUOYr=a93&7`>G z_5qF~VMe5CBEphfep1#cR~$L1lQq$i@zy31&I}jZp_@1=n1Mr46}}kEptepzi^xjo z1!D$bPza#MxOhI|m2D6JZ3dP?`?dpmv=>pt$&JXAbVvy&EKM#W>ErqRRO0q1GLN7wt-5DX<2%D zVu_O^{&3tq9qul>o*}-{5kY>R&IZVg5Hvep;`NEgFUSA60R&3)e{XD^?=pxA=&>PD!Wxm;!gRB zD99Xn^5X2HOmf=X2x5r3Ujzg=Aax^ChMAPjPEA0c@s^Dynym84I^?h_^aq6;1|jSd zUv>Eo%YCRfs(Fa;7q)=J>n<~*4%>haECX8ubUp42SB%qdWQE)ply4CbFJ8#mi(_wT z-%L%7uVor_Z{WtfGVj{L-0sLoENSp0>*9IPi!V2HS$`Rx1VoNn{<8!p1y>l>NO3$A zU?0hU_WFB1qcAJb<2eRUft{NsS*Bo~=t#C0GV2VPF0$&xFfim&-c3G_u&iszjoFoY zG!3CFL=+_GE7{poj#ZaMRKDvHKm*k~NHY*9W@U?9C9bN4PsCxiS}pgELY%kYaf?l1 zm6(C$W0ff(ckYH^`xlV~&grUv}qy~&WNl+&b<$C+`15f# zqTGs=cUucsgiv)GPSUM`m9{^(W>8h3FhKsRFE7`=Cl2VSz}!rn$Oo<@<1VHGY5Dv0 zHh>H$JI7zU?hRR>p+KWEeQ#EHiRo=aV<{>47Ut&BMBNf)y!+MCc^PCQ87xXu)Hb5B z6lKXZ?-q=ealGSXaAgZwBCfW0cT#&iV5hMy+pz=c73|9`0Wy4VS_p)jY@Ru&RD%o! zxA)>?xm4x+O2by-$#P$LGAa^-(!``gEc)*)9(HxVcHdAMd!|uV7KCoz(OZIRGAb1+ z8s8V-%je#gn-Wu-qqp9mqkKex@luH|te8~G_2YVnP}p(Zgd9OlcTHpw#3t1-LPgG@ zAey!<_OT=e;=y!Wd8Lz(pJEOIKR656{2v$!UA0oqYII#?WhN)C;Y&mMx2xRB6ZcmZE_){g2^!!C?3uJo;dl)aS7J zD32(==zXF@Io%O8QZJpYC497N>CV;J@Wsp)nS5X(h&?|GIDa?rRFtpqEG~Ir{a``i zpJ9reLqD*5q{NRV;6+gBO9{lB*qhRX(Yyu2(vt11YV>iB)V)p44BPYvL1xig zP8Yl7*ZB+V7dY2#7bBYsw7p{RQ^hs%2ZpZAA299=6 zZ=~Y@6&*^k5sbr#tsoS7nC!DTVJtddALiXVP3U4OIe*7l@w_WCaHi814igrFNFpkR)qQ5 zfg*CGVD6^az%fQFBa+S0AqGj|K#f!e_J0?lqo7eakE%1*+76=TzTl34iiy5OOYayS zEh5AYdQJBE1Z2>Tr#gisI%Q%T?ygemc0hn{1sN4~@V1)0+6J)KzpYw6oEAw_T>lDqT5Nz07=0+JMFPY)Ljh%8 zT#z&ZY8EGDB--q24cs8<0LJi!Ph?O5Huu!!`P9>!0k5K z4UEU8L4>uuBF1B5Cp=IJ+jS}1IWw(-}a@uG2*lN3zDe0CSY*tu~DT71NGgno0 zhhMQ>0+{vaYP*G-u+-#y+_W!v);P$GkkZIqMm=loR1WCh7Ixppu_MygK}2!GZ3Hc? zhzxiF<1}e36<2kqx2aO2GKV$fl zkMyMkPh~IPG#STvrzru_1bIKB9}+fQue=5HD_Urgt~v|tmU32@eoSi4MqZK2ov;+3 zUKYVv>IB_H!wBUyWIjgd98dv<2_sZE=uXqdXSe;c;A1!*Rra7Y-MN^lmHJcLU&9_V z(&tF!$x^CGt>f)tJW@-?<(yTSI7Mrt2wqg^lHj=(^(ClSK8w&Mj0ij0QYq9*S?ox1 z9F_k?uSBssBGg(CQ(hH1F|Go%OF*J}?$&uy@S8_DP#&U`73!UE{A#i+5IUV%!37f6 z>RNo?1**(c!MWc(RW=B8TcJ2caG#(+*=W^j^4MFTP=|ff@U+G#H$>lIHb-{|u%$=F zcNWdp%0G(ToYJf`KVdkBjMaFxT4jBV!0x}#s2r}hWRdD?6AxY9(ULNR3OZ7Y!M0VOsx1Ar_ifB^;O(;bq44ym z2#cmQ_i9%e{~_oR(~Y{v zq|aW5!yx^LA>*zd{6P@Z1OUIq&<}G&_?{IVoZtZOF<|42nB8{a6p9ml*I^cOdP6a{ zV+>$7i2fPYxyJNp;~Z6cN&xbvG=G6ea~Q^dI=`vmotV?F^Vf|5ukw`5)lz z9sR$Rk4mhE1~C2L6Z}C#pzb0 zy19{{?q(yw?@#nCK=oVvjgMTK6WFcEN*$wf(b42@~sac6n;J4-tmeNq7yT;)?qqd-MW$)cvUTFnU) zFt#A2@C4L(l8W^zDZok>XB>J_ypJDjx$-$Gt|woYMJ_@KO7n3Xhl8g06$E6tMi}9aY}jS=EdWD&!(IM?G znk|NfhRxjZ)l`hAm^;>)HuGXpr3$xqLPZr;0Ayp)unUwj0h68|+vyn!Th)%hbkfx4 zhAV!EGAorPHdijDefJB)2>N-*vrvdDJp-{sp*K<*L~kwSnmQ?3DqL6^OQ{5n6U!(C zY)SK4DN(e1zt}{L2b71SkqY=P^s%sq{zC)Y-hHNiX7K;Oe%-kI=h35;PD%c=vUUE2pP3%v(=+(Ut)a3=-zqUXaOOlwld#Lf zfRA1ZP=kWFEQE8smvIK@)A2BfjlvYmTRzQEHzXZgW�{s;1`M!xP?r;;&1BiF@}b znxVgh{^s}YQL!NuE0=Q%a>-LHsfxmas-n7VXO(_Z;a-i{q~UOg&nOrm|4aWsBLjA< zEW|uY0r>bl59bAMhT^(o7rajyyvG2G z_OgKnhR;3*Sl}}S;y*tX7#9l{OLOs;PZgj`=u7Z|I z!dy-e-W{hYa(ZaV6H01qO+Y+#KOF`UCW$(twD9*cWtrY<`uDS?Oj$OJ(2(zb2N(Fh zm{3z$sa=!i!a*>?oc7q5KeM?^l`pbuH7mzQFg^+ECrOUM&jxsz$K}N>C*$aMV3!Kd>zL#FwC6lzqg? zAEQ|Eq>M0IG@G|8{$(NaVY`j-CKwC`WVI1~rsKu3Z9xpn>bx+xepd<4eyH$qEIJ{$xMhQKo{T)zQW2mWnox6g(p6+j@1UHtRV=~bc1tP z)!w7)7)m`T~2U2H@R6->6OFQt%22$rN&JrpDj zDXSsfyKrL@eiKuGtd5fy2%pma85>%`smy#g&6EFYF>jeL2;(nAN}L2^W-IIPbf@oX zWQQB)i?IAB`DyJ#VRI^yi`$cubD4B;G;f=`y>N$ZTL zWt7qx-H|L;62r}vB)Wb-412VPBMf(wlk0CL;T?L)aLCRfR?!RFfQH4z;wE6j zj1+SIuL9|&QiM@&3hw`Q6T3Osl~J5XK_-7rX!j=ryZ@D7je-!MzGtEMJ);PpB>2aX zj2XL%vWqUvgr$%ec~(qO9yv$%GizWTVtfzW8d1%$H)N4EO44CDP3XIOY$IRDeAJk_ zktrIfn=O$Z(at3=VE|i1URtN&IE{d0c1hBe4AAX>LIpxSCH_T}8YRFP4rw$DZzEQQ zMXoI^0nX46$2c|kiNR3EG|GEZv(=f%v2^G7Vgl|unauQDPsomwS1pWCw}Ek}Xx9V! z0PJX)$aXLDAETwz69*F5DL%Dvvd_+sWLAZ^qcQ>F1DM>|aZOV^JzN*4$RJrM-&Afq zcP9{5-;)@UmAUi^WXe=f>LVcIF}iYdZ342L=}iF%c`tRxy-*6(dpd=qn?hCHW&Ou! zlbwf)m^IaZ_n3gPh>P*$106#5Y;_e596`?J0u=T2T}PtN%y<8vA^#bSt}gzW75{I2 zb*&ixk5WS4$$xI)bG4;!7OHvBiwcl>ty(f8hm53ZWr0176E973or!BJw% zdZI+jfr=3glguudWR~qw?r8M!w+VDOD-+C2xz|K_R3VScU?egs6<-fA0AWC$zegoU zS!=I(2fJ_nvik;|CNd&wqNeDi?Q`?XaD8vw}-oL%*z^$2$fYe@AaF# zSBJ&shV-4{9NSVx`2Wak$xmAQlmY!wsju@tjYn%Jz|M_b*C z?&kW22zO?T$8B_7q-*<_3#0WhSBiDAyR)NcOPACpDtO(?8oG_s!vuH$Yp8YhM(+l3 z(JPw%mFYa{6hnQm+yxja>&7$+16SRJ<8~7fl#H3xhu(g46tycweWmUb8-=o@#7}dgTG6ue_><)^8bh0`Imq28vc0!Of~*_?*HpTZS6=@amtOn=*ee|w^ z$8C7_nhAi6J67H`P>8tUgo|SC?6+vbgazns_mAXQ#J?HMZ_kRcP*sQ$B_}|I(Q69N z%mE&9w1MePMzN-_A*hpC(WkIMsw`qte5RUIzSJ39?prhp45XTd*$7UWQ0^q#2RnOv zNaMp`C=Oh`Fzcq#v0QLQHUwI#6{&!tgD8g6OR$qeifP|$!uzb{`@0AuvG^s=Fl-05 zV$=;VW(5tNM*@qeyu;80DRo4R)T=kb%D^YNe z#3vWWz||YVz|}hp{Ex&y;N|pnS}dS~E?zDNVUK*~itI%ic0V0qaJDXU6#N>cF_hz= zg+y8z0FtvKJ|ybRvI6Y9zD!{UDCk9v<3w1YdrIRtp@G!wc)c-(oFh^awtFehMw<2+yT9x~OmKAqIlUEp#otJt`{vwyp*A260 z^3*aU73Jys&i(9td%0#cG9; zqnT5Yw(KF}_Acz{QJSC`Dn&WMWk|Z+af;v=XQ(Ge!_L&2UV&h>+*Ku_SJUWIV_K0F z$m!wEYd2(3Xbl$+0gU$Tiykhk0zJ%Q9~H(J0Kj@p#ZinTZ5@XphNwkD{1lBAY~rO! zp0$ivK+uXKp#-@#bz1Y|5FwQbH3Vpk24PNcEuBEsBzpq9b3PA7NkqJ%rYvkHtI3L7 z9u--!-(HTUtlTI~S(%%rIP;uLP%0*Tcxu6cm{G-q;`#I)t}%zvqpSviF%>jI9jDcl z0^1a}y^>Be`4q%3Dh|3}WDJw$t~&^WluwxD3d&-pz*Q7+D$$M}&Dv&O39U?^GKQ+yw8jh{DIfB2qZGa7DYJ25gYs|9k*R6JbhI*251>p0Qob+s zBGVRBp>(MnLER4x?-+Zjw|_ zr`RYgml#`xV(&OcE72la76DjXagzxbde$-G-o4WS*JwG8dVQT%w)Ru4)sjmBCc0F% z$v_WDGv98mv>UBfjqf4yK{L>V;85GSTy=`XgZ2O0t&d=nir;@PHk|x4yakIpIov&AP0(QM%2jYvV)L` z`in|^oB4-L{{^<0UK(;aFdxz|HuUy#4ZV#AX!BJ!yboi_7b9?u!<6$$dxTQ0U|Lif|5ds^lN0u|)gL5DS}z&yKJeSi%gbnI8~)O`kKctP zD~l+E!x7#fGNH!DQ5=w3ZDFv0QK2wSD*o!zuMrkoNccNN0U6PE1z32H(u09%AvI4E ztF~2{+xIxb-C#s<&3Xd2G za*F1c>=LcxoPV04iTO(7;@@kyei3G&@1=_^ufY1PG+K!)3k$znkrul4DM z4}_-$;|Djv^b~UjP3lTA3Ec)B!U+dK!#&e*M;?vbapy@iG9Br{YJ%p_FoU7fN4H7` zjZ;#vfL^$Oc=7tp+XFG@U@(|>_@dHmMAz_ZL7c?r!(@z(EAA);BSFD}uoiBs_g7jg zz59z;hd|RbGi+=c^czw(Fl+O_Q`k(;K2VPM!Gc*Tj#^kTaef2E6~NWk3g{g*kDA?l z(2olN3mEHL58mBhy8r(D2TXNOm{TZ=z49Y60gVQV%TPv}T?UJH&o4seCjiO&c!&P| zZ~FH&{d>RF&gjcq`u7$6TWewqW)ie`G*5aV6Gv)}%cPB?Bsd@OEc6Ya+?2KA2ljWG zNMn;ZtQhuq0z`Ktdk|hKG{=Mn(j)UFVt*@hmA|c)zwlzAMQGS+Ex<{(ApE^mUzo{B z_4lB@n?K&IH?dvh5GS_!a>3!ooI0BQEH+H|Nymf4OQt%+p-t@Qu(~6zr1-yLM|Mw$ zQ}S!z{OT_>>|qc~*DzPO@=$)B0Ldm-m0`#gOs=y9Ya%^*&e#H@Szl`?NhOg(*5mN) zTV2X5y^k~?S{u8fBUab-tsT@I_9_)YaF;d&2DgdryF>Q>6Nru@jZj@QyosYyRcsjn zci`4B%vWI=y~)#9fob&IX*dV$JX7dZPr=Ab{jvzb>7>DDw6V=n7$8qJ%`I9+<5c&^ zkWQqsz%Ice0}t^l4tA?aE50Q<=YK6cSZE5N-vYG$*FpxrF<8ph7sLvWs!m~|C|)d{ zq9d^?|Eiq9s9_&ro+9wbUHU431U{L&uL*o1wPDo`-$NyXLjE5ARE zCMuqPdMHikze$aM|W%VY%NPc57X!q1~+|v_*zB5 z^QblU5%V#C9qB$ZzH9+KN+L7S1ywrH2pmvS^u!dX~xMLN(QBX5)6i@iA(zZsEd<;v&PmCn2^XZL$VNdXKxsEPtoqPg(j7>p~e9G z>>OKmJYxUg`v)N#3NTE(uFBh((}+_VvKV)%z&B=(3owq?SFs#@XWp4D6gZwf%|7Go zvw0MsD}FxXMID7HUd{cdK^CsBHoYP{Pon`=XEEt7S^@tBrx4FF8HRFuuUHd%%ZI5@ zh5=tM^!)-J;kMwF;K2cuGd50pE{N$diZV@0%rZhvZR$zGMKX5se^AmF#S%o|U%uQ(gqJoJf<8a6jT+gn|f}rYpEL zh7p~f{~ZjY(Eq=|865T>qo#*vB5fSB)awV`2u6T`hZSAZcXJ_+n%=-0Pxx7p8#|)%k&S7&vp#@8Tc$kRcu}xr=2(EP?aRU84^bpA?Og=v^FWAOdlQc z01p5%K^!LI4Az0i?@SDnx5;{XdSHvijn?x2hA_iGhU2)&vB3Crk>j-xb^p8N@0K?J zgFm0QfXHsFv^(GVL>__jpu>o8O$$I|@N_<+t20(tA@)h!?JelW7I6DfDQs1!#~6;$ zR+lD1Ur#M4#)jx?b6q@kwU;`vjXH}V92q@4yR$r{7E=lrZ)p`1j2qi?SVxYe`d8-4EWgf_YeHP!W4c?5+M5H?#HG_a<0~`T+L_P{}l6n zr9P(L|Jv<#DgMi&<<6b__f|gFD+$Fr9Wq^43;;7l%&QQRqq(f#a?IcB&$;{p*)|ah z_q4?OIyEcq_3x$3{_CSRZ~h0Kw9SK`=|RUlc(#4GjjC7kWP9h&sD3pMcHg|& z$A~y<=F#4(zo1oO4cbRJ`p^6a+rq!l0{)?TwJ$dT{D2UMLd4=}tuxEs$RcR_PnfNi zjw7>YLglgVdQ(8&ps;W(kbrN>@gBaC&cZyZbaMFlR(gRosuP1}f=VZ6P5(4HImHK< zVVBHTp)D@g^gCA z1)o)2Mas|+c!W)MskS{XD{t`+U-!f?8*fxN(IhS`aC56uqoTfyp33fIuw@I7#V zHD`f-Wcgz)aa(>*F_bv=W0~z)+22V9G~x}70Wie97%MIj zR|*|#i8SCAz17!cYo;S+f&?K?a7)n;=sB4g0W|-bX)@iu#V#}>jtB+j?Xj^ zqhwCFKKCRH+P!U0PaE--4pJfOa)#6$P|0kEYVi85W4)!BE|@odi5Vu$x`S(duP=RTT~HP z(4t)xQ3r8)aWp8rl2fZaX=daiqFk^AbILn#nWD4{MW`YPG;oAcgLb^y@*L#Q+T-=o z=&JU3ag$>+Q}?&M!70k1i54&1hipf7W%5;gOT4l)Ez($95@Sshm6~pF=z&x?7@c6> za`d<-loRJ#1|X|rmC9RIBxvf)auJeO3$(X%N%&q{s8zHiC#b3|C#Z!6d9_lDEu^_MHg78T)3o@(1Ksd-q^H(J6(Hd(PK`e z!*_hP=T*F#+q<1S#|%sb&W2n1*OqqOeTttc^4}MGJG-wAu4?@Af9A0NeN@cW?V@j2?w zW8xnA7@Gw>swgIRldXTx(Q+U|^~-V2*^B(Z>q1woXGEoC($CM(>VR~tigWA%Bi0=o z?G2kw)bU)c9Y_t}kV*HB*ETVJP_KyNM5~ZAL@FjpTcfx;8242ADSSPMh7tEbx_Fv@ zCfZ!QYK_iGViWc8Z%ES`jgJR_8BNraLDR?M94#yHA;GbUy11nTbNCJhoUKUfRMqHM zfk?Sc0id~ni26M{<(PM#o(ah&(ipmAQ<5Ggm7pH~A<1DWDi1}tk>D}Ch{KGtMN4qZ z4(n=pf#-|5%6tR^o0wIVSAh3yX2Sp@gCH-krjug#BqWU_Tr?^23e#*s|3B^e2m8+t zf8Ktx>+c=-uixzdW$)SUGrzWd0Keg2{(0~4r~S8wK9qQ~{p#><{{C}+`_+k)AoxO*p;{a7DoRD$LH_tzy8~sy&r!% z^ncoa@oX0!KHY_pZ9jdn%U!{wc3y1ny=?l=wqI`lxJ$M6p_Mlt7UR+RKmW9gkFdXO z`2Wt~-u^3`#?Jn$!#D7=3A222sH^_Gcd*;^x8Lj?z)-#CZ}y>i1Sizkr$(UOt6gpd zLG3#$0!8rm+k;&*mS?-$FQBahtZWy)9qr`Z=cYeX&VT*8l?~#n^fBxFUt2Gp|BqId zSMJXL+xWbUx@m%kuK$;aLLnaHa3&@|wFhH5YM)a~h3D+v_ZKk|{jRmV{EhcIP4LjE z*M9x(>CX2%yHCGc{O;-M_F}vJY?k1jbGa^h+7Uwb0$&Ud@tJ%x(xN6^IT zch8}TM~~Wz-*=w2ccHQG9<^6)Y9c=llH*_i<@k$gS}o{K5|f#1AdxrxQ5vduQ0d;Y z@OX>@d-{tH-h_jYmB;dphv2kc>P<#d?hIyP_cq^>w`ee}?Jmaa-RbM${p;r_Ug=!8 zou}hy&}%JUx)p(gGah+%>9)+6$}P=>O>@BLBJE6u(R{7U2cwI%H5o=T@o^U|x3cIM z%^J`7RaSwI7i(v`*V~KdYeql$<~PPSO*#KD4G~_nuH470^S`}b^8f9uuiu^jxAFO- zXeIy1mPlQjV0(Y`8;Sm;{+~^XlanMMROcN zgL|(I4&l0Vbg;kk=iS32xI4Ys-TG5qJwDuj&CeQ3jEltzFZP}mio=sq;g@?acc-z5Sa}rFTW)rQ31_PM!;l4B3 zjV=GZcaKtvqLD0oM=`d1H4ppdYc}NX9yX;X!R@eESQV6vTKtQ65>?Fr1nSuX-s5pv z7I{Ipo1~m0fD%U}!(oVFauh;P`3=;W8DI=Q_M+5Z9Qjqywqd5;q7DjRSGQ->m{Gf; z6C1Fz`fTYswW{`C;r`Qwxh&8pc2D`#gF zoz%drj%Lk^8{03nUz(GJUb~#8TOB2UKwq2S-F=+TwDaFwYOdDDjPw7|8eH}Z=l`SC zM|bD{ZG0a8@Od~;&YxSgc5AujQ$z(g0JdttU-y!;Y_Z*0>(qXD@{RYHr35S_FjrFf zc6dGtw`w9t*m?L6Z@7O^O+RY2m+=7xx!>ZOv#I&x+r4L77q~b7IXpjuQ;J5o(!oY* zFuHq>Uk`#DEyptaWq#rh>6j|imZgnewvSssR<{ zHxwv-81_(+QT5*GfP7NsvGaA%;jFlebi)*cRy4LhhH{J^q_#Ozvnrh~C z8jAHyl0F049ph99=v(>;>9K%7`uN(vw#Es zvHf~)>*%N#b_eMCSnmx6;b*e+k&a$M)5Bo!2H*|1zpdKgo4332>S>Tg-8X2;FbsFd z7jCPzBJbq!3-(qs&);U@Yhr2;TD_krdYJ*v&q0bxsTUX--qd*(qN;p-^=Xv9hLHt) z`vauIjNO?tBtnb5n2i?!AS^fAs;x4{RWBZppkzpwTUx!zC0|7GM|X({>5%E%s{N_H zPx!}7YYPA=g|HT^b;{mP1C3o4DhQYyRDgvaM8{I}M+vH1oS!p!F`0iB0EpmrUOB8$ zPc?ZkK0Y|l@^EMdv^T_+*K1a&YDRO2D#iRIdrSk-ngX(yd(U3Xfa+_wyc6_yKLLPd z6;8v8lttLjQ}j*9hThILo?QIr@c1B1KSfL zn%cPpOBQqJ}8P1p}p;MK5U^=>yt%degNmvA+Fo(!0ayCbi6 zMU)%5IIhRq%ZM#eZ9Q2W=_=R1#99zAa_?mXIFTU=dvw7$5# zyuQBJ*)_Py0xYmzWS5;ra`ZJoshGk}xO%*d znyB5Ui|d`W=TCRnI=fGwKNYCV7?j#QRl`cVn^8B}?2gmTH6aH@0OPrSG&uohkdlY_}$9Wr|nLA zd;8gPd(yCZH45w6dJq2x;>L$2(r_YmriG9(S)=Y_(GT%s^W*VS#pU^ucwb0@}Ks~TFL&iy?ST=aVwvnPlJ3R^IwH$g~&aD4_wJ&Kl;2h9`(?9ClxI$ z2ithyzoo~$4L?rKd=(VMP|r31oa3kdb2NZMb?6_$xd*Ic)sTuaHIocKMFR=t!m+fZRf=UE#W0vO z8KvYc)du>fGM)R9+6(~V1OqdjKaW0_dOo8Br;_g32X>GHsYv2D4*KLNM-h(60v$Xb zBn0xOXyKZcdXV6}5^d!)==uEsZVIuAJ;kBX;9m4GleSfKDZBwBBMQ7#e;MRZ?#zE3 zrrqdMFer6n`F)=0h(g#50w_2kqhQLD*v$v$(oq!qN^e#GQ_KH-lj$4#OrihR68jTB zGwA!uD}L?-SW)u`qBui01(!=I_Z zFPL!zH!elwBAqfhhoLtB95I>i)zO!>9|rjtIKx_lLOUYu9U}pUo$LLCnL_*HSRx~_ z1HzpJ@^yTs?0*UHx^(3}Sjo3GasR`o9RIiTfBdy;nBUCL|MLAm$NG1Bz2hsz0Gnn1 zwZ8nQX#c&wa%cZ_E1x+7HX&PC5t0cXWAr8Q9hbxf@>P-)s9&8A#xxn>C%tpqFBk3CtVC=l6v+e&Q6Q7W#{2Yr>?9fhyvoN| zgK9dd79@U&&Q`44EIvk~dZ+2cO5s+pkNZ9RU&H4lZQ4~=XS$-u0O-ZtX)n7@@Zymh zM}wx@wP*XQJ5glB0~y0(kT)IA-in4G6DcI`!+d#u+qj^^__{cxg+FpWG5*n7C_CwM zdmlppC#A8U4wZobeai-h`sn&r+zxsMmEKbdp_*Q*`RcrXPnF(Zs1o@&yw3}D5WeqV znjfGZl`X{$P=BrDLxpAYZKR)(2}(+-Y*V%S*$>@eZwvAMA%+5ect3;xe|s7Z2FaFY z0P(5$0ms3&6vTRKz2-z{b3^q|A5GbXO`!ly+51hOV}eLn3feb(56zk?yb#@8$yGib zFi}xaF*?f@N*hE~aN)b+R%z!7S>gaMHpVgi;c9ZrG#>1_6k>nW{Dk;F3ZgWVFca1; zpiYt&Marm0O@Cp-UjPJ#FYn`pM&;6ykG$1CyT^Yu`aj3{-wV!B?bjW|`Q_MvS@OTt zV*aO2yR&+C{@=>ydShE*e&%PdMMSjW3+Ctu_$p(;m6JUcP?CdzwsqR4PTOBz-&lUM zvG(Z3(>@hhC&f8=LYV0faw6@{BiL53v1*lUYhe5$_6aa-zZ0ZglQ%GZY+-kLI)SMHk zi36jMv4DD~B6F=YJPu#Rv1<4&oZ&U)B>>IA^zm)3liee2Y-l!*X`~bK2AeSC=aJl z^TIJ9*-U1h7W~be7gjvIdz5Kq3;AZefB^NrC*+%6;Ej_Cz-2{(O}Pa8o-=5?3_@`X zipJDm&(t{~;5E-fsQy>wxqnNaIq83veoAkQ{;#)}OZ5NF|MPY}*Gm|u(tk;9axL^< z;Um-k&Ml__xG?>n%==#t{TCYjG>Vnu=EeE>`OXM@S3V=$GK%wGgE!Hrsm6_OPplSn zHC0BRH9rSYPO5$m$BIfvI#i+&9Vr{LP8hi<6#90f;NqcU?hD>MIUj1ffL+)(hlJ!3 z3_gHr^(ZhPr#g-Dq+aM9V`bV>CGIC0HH=8;D;`F3(0|n1qQ&Tq(f`#)74-iu{@<;9 zu9q-k==2>!|I4|+d*k6qlnJsOdz`8b19itt(5`$y*a&NhhJMQzga@UA0n=YOXT!bf zgW=u{o(fs%OgKjEi$nS&_y%+gE*}$!JG?Iuc9X1(~N!DujT&~a;QWy4a~>={sw9?n?Bw^r2_NC!UnsO%(H?N7k~cJT*Mj7jakP#kS3l2N+Z4eLEKO$*EvZ`r~JpmTe# z{h-%NF-&}2g&(&hEe+@iXoqg%mvJ}_RU7n!h^6G}rHmA&8F^f41c{z%gNP<8-%ZW6 z_FA#d7zoxD@`gzH@CS8PD8xF{t#>t`ut9oW^Z(`7^6+y`Uq%`KN$C$1#cUO|57v04 zRP$qJRa12`(S z3J?F092XzqVicbd7U5avf{x!KdK!}o*2PaWfRSsRlvlfl>WCg$Wka$8zw7iPsIh-{ zKfB+(Kl<>X{_g(ShX;+V`n&hF4?n<<``OVS{_Br_x_|%g-#(}}9zWUG{O}Opz5n5T z>xV{7TW~~}5v(ae;o*>u>oB-R(@t+;n=s(WqYq8&zo|EV9l<2F84VomJKo-6#b8ps zC|$RKh-3Lv0!5*YfDMxokUc@oRop|zEy{nZ_#k8C(hRo-qZUa7p_FBVlC-kC2lvqp z*8AiMPqt2~|FF?Cx_alHCJoXkF4&@_{?};|fJx0I-94JpA~VYrvt|8Z8l`qM5j{=N zE?hy;6s8RpPPg5r*fwNp*I)aTy8GPJXAb`F%6|7*AJ;{V*rhwT4*D(V4V z%rG!N#^DEkNG{)Ue-~dO&(4&7N~e5}E?Y?MCGl&hQpnp^ao_p?HOy23Sf7b0r!%38 zU@2iXmCt(^)<2Poz?s@@Q~Y{UnKB3*V@!X`Jq!q$xl>w?OpL>JXR&?9!(frsDC74<_3m4>-Mj0&wdE=a}YxNJ$osF**ijrRVIm=+lC|7tEOK zQDJqmol+yyP{E;D5;acK^eL1)>Eo0jK^~j1DyU(lOuxtru&f3BZp2a=n&TWCF{y2o zxmJ&sT9D4xwih6Wbx6e{V^qbJa%NI-ljA-F)}OX&v8^Q;A=+IcnF-G+6(eQp@DiA+ zLU)?2@}~?k|12B~WaN1ipGRr8wCtGcEbYSf`WX7hX%h6hn0(9(O6?w5a2W~uYQjw< zi1G~I0FxBNVKUAJgdX`>;z>c3M4obAhl3cc+qJk0cg8N1lK7}m?umRURJCY= zG#E2Zj!%x|BaCTE$iGTT$8-LN!ixX)p( zK8qwG8hV6=7IcXcvZ{Ur|G+W~5zET6_X4K6XF*JqAJ2-6M4i+Id}+ht{g@;@e=zQT z6o0QfPp_N%%)$Se)9sRd%(nksFY13fojd!lTlrk8-s79u3Lx@xNAZnlfiNwUD1US^ z&~GNIfWDca1Nx?<1Tt7lDxmLYX@I`DUKP+cGj%}UOtBLCrb-+1jjay)W`aKGn+Xb` zZ%_*HjZ&3t11C5f6;&}8RuFyTXk_?=koFuU(KjU(%^#GbFfqcUqVelEq;t0ZqFX^S zYHVO91KV2c8&TQ}Xj}u56xHavQsaE1O~krlAVw-A^!b6>_X@2MSibfy{Cb~x=)XDX zFW1Km`oFfax>ltBtDQUj&#io}mFOW6K44x`odCj5YKlM83amA+mfu24R`Rd@)~&!q z$=?>b-qvb<{MC`C9eUdSu6;qnuy%>$xAnV@;}c6ySSZbl(VnH|Z#NoJv@@${M;C3o z>Dlqxg<;_RY>WvRkx<7Ax#X0NVxQIds+&S;cjL8DJCM8HaWam3Ex@N)s9WE?`1h2?seG=hS{xrbr8eJa)R;u7DzCq!= zF%HjYAmnzK<>|PKfh~-GF}#P@jze&Y_c_Y3gqo0+{>h+h;fnNkyhYPS=QgU{);N_Hx1z(mH1G0(4`wSX^^<-iS6-NoyN9o-4oPv zE7%FM;d|5aTOMMr$~or1;8IXp)~ePqpU0l-Mpi>1lMF#DrCd6_*;Gd@};3D03wM-No%9+(J~{8sKhG~VIS=| z_`9L;fOdPuvktUpnPnQ_DXCP`KQhj{%H5kbDz7wVTi065BNP~p#u(SjkJukqwd45Y z;x^4_>-vsF<_Fs=om<-4@)ZR{HL3foB9puUjxuDzfr*@^6j0rxJp!8~q4>qtE>WW>d9K^7ORay)YE7n7 z>cbU`2adjDO{`UEBi`Ggo$XJOHLw0q(A)O57-_11l_w=MdiM>arN)u zGwuFo=jXgiAJgxD?eJK=2B#Q)Avm&YWNy6%UmOczM;%AH%_5{*GXvZNcA15zDq-c zbUP4uT|Dc|@fZzHFIMlG6W@fNQO0@kda%bYQ!BZ69WCd$c-3UYMtm2p$P&Jb*UP)3 zOH^WU@x?2Sdza|#tN=_dU1qPU87!$|lZ_dCk2$jp>k{_(u+#^)48P3x-Q{As%f)o} zF`sGj-?V%6*#G#sc>Mph6)1ie|Nj;~GuGd*B3I~RhWvkJwL<>CdT0N2E1#tYTi5k@ z@ZNjiD_-AEfde56UsjO^S>~U@sS>2!({pqWh(_Z9Tj)HnEWvU(=RZcd_W+(c)?Nk? zU1P81rR7Kd^6JLw^2VBL?DhT{XSU@1QDi6nV{w%}ed0WWQwSfKXEivPYj=Z|aA3Js6Y>h>JR(LcL~$L-f@c(O!brmZFFN7AEprPjku$ zsbo!cTJEVSB_=mv!*6O6Op)I&Hr|#{v`MD= zScja~Bt_r@RnA^z=?Bk``X&*&#V0s+{{HYG;M9yER)fp5)YvQ)>uOs=U6SzEEonez z8hf|=0gcBNju!kM{Kd5mf+ic=T>#Y1Dkmc>+HTwkZ6e2BCdO=TDaYgfyOqv|O%))d{s%02Vq3uyj2iw)g84PkLTYn1HP9uXCEdzm zr%~u9%FN3-`%wFN?jB6t$}TeUo$1#B5YYPlQH^LTKn_C*p^dT3-yKlj8qxi1!@r;D zdQN}nu-tDrM`3%@qwY5*%`l2TQP`&B7;oK{z4U_N(l(BCPYX6MsAZ(Fg&uDJ!Py{E zV>FEK1ens%jh>M~uh*eo<~tjou7)(q-{87R|9?%e!H}!FdZV!%s zCZS#voh8)q4lPLzB|OW|qU^dEdfHqM+_k#^4_aPOZcvh(>2_h0QLV8er&b$!88kj{ z7AWItLER3slXt6Y9}JtI$Tqw{65Lu@%lz>3h`b+b<$bKt2$h~iG=er9R>DdR_S-=Z zqB~z7J!Vl~O&%|V9#l)ChtlDR><7)n6 zf4Lz|EH0Y!Fe|ihlhpag5S>>pvHMzT=e~OT;stKMTiST;2D#+ko5DXL2AMbHA&>Z-$_LfteP{-Pdr2%{)w~@Ikmic#wjC}d6AQf$suZUFEp?t~R zZvg&+kB6}fahDW)`QN8MoLB#IdWAk_`2Vj~#Q$4a>)h#oZsYUEs2}&jzQ6tUuX``{ zw%;867qq%j~Q7gX(X6H5be6q6dg8Gst1aYZc9%Xbdbp{QQP=jg^@<;+UNE%iLS_l z#t=H6qMj&El#DV!%T{P&gJ$IW$_w3S8=!)`33@&KNQpx9OY{Q9hIx32IukP0DpF30 z&Ku7-NKeqvaV3AxA*LVU8$ z5EK3EA2aBl{Q8*6KKat}Uor+jL%0Nj=N9}i0=B>i#nfgYl)}mo864*H?)OSWl>Dwrd5U>!&vn+jP8$SLmrzC z{85-vtUnYxEYiZEvuZ-`qg2aVGK>QmMiNQSUbt2P&<61pz;LKaA%kyO`j4R!jzbD3 zD1PyTz&JG$=br`{1xD;g;h;zRJq)_1qB<~vLvdUhjG`^zI?$3*h0wM#2#Z+2!={xA zMkDggMkioPFC!|3Zjz>9HcB`iyV1}{07+;>MPpD6q3W%NL+8+#12_~1(Q(V4qNP5y zgHGL=lG@TfW7N>on*BgVjoRoLdeY77RQweiyQ+k=)ZnErh@00aUaD^Eae+uG)3#HpL}Xni&Te=$o!A2nfy`9O`>*XEM`b3Zfqe`Qd9r9P(f|DBb!m6am@ zk0yb4{QoU{uA8&p!{`x9`zi(na6f%C)WG8&xo8zid_JQug?)6Gb{>5#ldtKAsd*~H zy$O4-J&ts3CE}q#+{olzx8+xcfwQ_qz0q(BO!1JN? zL?@h-W^nfvnmLZr{1ij)Z}~C`vfha>q2Y}HpJg4CIT0`*t2fMB5)__0@GRJw6iNw=t1eLjvcKpqgli+Qa+7P2-ToS6^RGb>gX<`MYw)?4 zjB*3gPHA;~(}1A-#L6qqqWMJ~nJ%~5Xw2R)u$HXovg=L4gtoiVH)9c|S32(9>MCQ1 zw3#a$QAz}iDyfVHQGY04v8kd3>tT?7By-!k&^)Erj44(el-%1tdba;+S4;_+@4!Du z_%PUW=vS@g5YOWzb)HGw1=z#^#T12tpQ2=pF{o2)7my_z5Av*GA>j*xAhFOetZ$F) znFhU{8uGWtO=^X2n`XqaETkeF1v!cpGMkG0p?KDJ9E%tSSO!qe;ZS=ps9F0JTOBFy zhzAS)x8M3Bj9`vG2MdZeYEc0ZM?Ee4a7fT8tprXhC_T`P_--r8hK@)o4tJSHtW4S! zbObW?GyrxdWJ3c>3G~Bg43E#z#j6fC_;JQT#EC)=IAE!)v;?q2ze*-DFn-=wz7wo#WZE7GE;+72J1T5ZUFOPP~$urV#MbheqWFlx1wO-&7FEtMhR@{RY#nF z#gb(_v4j}{n(LE_Rf>#%>w>ofz#?)2p_C9nI%oy!LNP?)P8M7nwZVl&V>gJ{+nV{2Tu$PDympyzd{FLYSVvc+N(R z@E(%)iU(HHk3Zw8F<7hpVnOvFWlEsmqKm$2nF2l>Eu?m+cygM~~n=DUM0^ghitiDDDpMq#W zR>Dy%0BMrJG#|8H%BKgZwoV>c3$HCGI3E$1otEr^4%9Xe{OQ~0M|j@=Itx_`mj?$^mJ81XX>^Bjtx&9`DYIy`!$p-wOpn8VSSsU^ zkFRaoH`ixA`_HR*f6es&T3Ic{e_Vg`X!Xwi^EN)pPz?8!as8rS{tbwvu4Wwi0>`G6 z7LssPXdcGoBW9T0T|%ODlwH9OP-;)&(J20u3_g(q5V9RZB=8wUw)eZhO|jPxP-(n% z`Pm>jbDgksYSBziVKYp3Hk3ncNph+I=iF6!ua$FC69uwa2wVU#+1!wxzBrcbak9hA zR~NgMuOJ5;A28|<^c(*;>;~g3w1oa~A~{i^rL*81xr|{zu0Rxa#qdZtCT^C9+F3Fl z^yu0Njgn^8a;y<3;E(uhEQD?@G!ojQP zFT~?%#~u~K`qV(SHPJwry=~f^uWcY~J;5p47Q=czWE`v*0~M|tbG8eG;dM{bI=j#= zv=$1+&)V$7ME+4CYBU)wTTEKkXxt`tv*=euvaJj`s$NR&>*A~GSV%0=Fr~lR+!X^@qTfaEBjAgE)xKoV-!dla2B~+!tGgctn{!ekrot+}7<!vSa^{5a9fIYMj zR9DF6qcf%b<~&yC&Sjv$LYI^ z#y#USl-`ldG>O(vIFzWB6>bG*YArw2@+}D4aDh|nYhOg}K40Z?$@~9>6oNDE|I2GD z>!tfYyuQ2t-@@kx@Bd4c0sz+4d^i97pY@YF`!8Q_A0GX5!|b*GOyRRPwU$P_pTZa! zG;176()>Fhs+ZjVPfnTImKsJ$a532SX&d240@{+qR$=M9oB6h0}c=P@P35xMDZKYl%_9lGF8+LL*JwrpO~oNCfb!T1D)$p zxYJ<(J)H2*lWYuaz&|W(K^ZK+P(P%&{5)}9N@e~5-#w3UFd%9UoN0QNM!9$usym92 ze?|F%ajqnL2duA(ZRrZYo&WkpCIRcT^XKg!cg<^0)o20QoWgUpnpiK%S^z^71Ju;x zS_59VXGgu(TKWO;cC+TUT7`3^wlvPtCF*?%=tdeMbzNF(Enlk2F*R1WD6l^2;XXNK_Zi4Ykn zl6qCU->NmOg9A!&W3p`&DS1b2eDLlu@%8ISGwWEWf!+l*Mv0mtoj@(rr0!?_kQ^~W zn1wFJLxSEYC;-g}N9|LSFsyff-~8|pwq!5y?%nI^L3eS)wN}eHj6|dj1qBX-Y%M&! zpawpNCF^s*=zI6>^*6|c$gks@dt$@dh3~+_di;+(L@_NagH}O!_);xSNpwuYn8@IT zU|4y1=tX*@kfJW5cOc6G?MlePNNdMI&!iIjV;h-`|0k4T0b{YyMpgNBnrHy*-_IH~ zKI*vfMzKqUklZcdI#j6rzXEnHSj)+U8X91#iFb@FHn@-%Qb1w=Ooj}W{fbagoWLNI z4O84tHAGUJw$e|jqJm-qjeao5Lcu6$vnlr8ibe73s;SB-A(t6U zvm&RLQo@H{3ukZBI&t*(ou;$OP5+C-M7}vFx2;b(QsKhrkdw5$s8q3PVxka6N)h3k z)sjPWFd`dQop5w(SXCU|WWTREC+l^(EL&|74`x^^DOtC+qS=N9AFM4^Tzq@EHFG6v z4$G}p8qKSLg&zpa)KApeKC+eG7s5XLbJ`M&Lsfw<4E%*ZU=r26@RgDw2qEtvj+~U-= zwWI)~l+)56Xe#=Jw=#C!xapeemn)TFUeR!#jzjkVDJ`$!hKZyz(W z4LUBEAQcG-ou_y_J!~5s%~dlq#?F=OMajJaxlj}`3qy1-S4-iN54i)YLUrCl8mJVa zMTiJL*URS8;|dZ|=)ca(?~)N*Pyu2BQ4MrrT_wC?+LDy0~wudR0Z&3tC)|H9ARaFpL@{+H#omF3k^{+IU3o&N7O zKG*Hydq7U7KI08iKXELaFX4+qH)A8PwzT~HQs;Yrd3~eZ-dJtlhC8QmHMn>V7@5Is z=YVP5ToRa*L2?ZIAoc}kaMAy;ToBDS)AK3iq@}QTG^G$6Z4_2_N|9c21c%LORUWaW z2ZBmgjzlvnZPkG<-{Aqq#(%%oc(1`$Ln{Q7esKK>0oBz|V%bz(4KZ|F&Pf5nJRF=;a2B8lJ&NmsarP22GhrH) zH6%t+lp(GB6!kC|jYPCT!BAGXl~Qtf=(OcO<3RZwn5Y+i3J1xE#E}x!=%>TO*Gtdg zzk`>DuT`5()I?y+rD5m?qaY1Qz#HHtm&I&4?>dHJ$~o>*fU;XOO{2sf!H{CkNiW@` zNAar;Ps0ocqHlO7sN93;(*&YE2V~8IjN+r~UZ~T|&VY_WuwEE&vW39D24$xd;mNY- z2~e?;Nz@xrm_Cr~0B5LtiHNc8nM@KK<0n-?5@piEFw0OoQitzUyMZ%F27}}b2MJxZ z;9&8)Xs?FRbjICom~kX5$_OPX3V0mceU!00F&Z>6ZWO%bWf#w-UV>RFh7=IY%wA7C z@#8QvbC(cbI>b~BuX_5eMEcSaT=9i1jfv;ZO|jOtMuD&}HAV;+-IGKFQYXS#V>I=B z9Qj$4g@io}yo_SF%53N<2TYO>U^ttRVn&UNsnjIFvwlp=d>ozzpP;GmGqA3JHiPJ6 zD7dW)nrTRg z%FYtqTa%3k!yr4y6+?5w&_Y+577fIEVDH~Vqasfs$ORiHTv$3D@w~Z-Vk ztSq%x{pIgBmRC30YtDwf-q~Gqb1=7OVRwM>twrZX(IqgD*?Rpt`(>@8F&h`9 ztr(e$2}ixA3}VFCMA^FQ_o8@L1;pB2zaFw-mel6ewrkT9U0|FJ%5PinRF}v{6$SE< zem}_LcE>J458$=92C6E3s&oBI`I@75vg05ydDp#ai#q!f@~+HkWGW9=&Wr*L04?D& ze>}n?GO%(*c!zs0clX~O0*uy|u{mJ$0}Q~Rw<>@J8csh&-Oziz{{~BT$XUzI+ofs+ zaT1>oIaghloh2zSEfl(uSjITfkC6pJ+ZpD|DIO@SYfCYr#}uhGKEVJ4iGQAqQ$Jh; z26oW$-X83}LFX=9GVk^F!NJe_Z_quUru+Uc{SE!jYB#W~FMtCY;I)7V+xF|d8`+Fx ze?W#k#>(K=Fa8(LSP>9EfUAR{$N3V%mVX?n!rCNiZ=~mSpq7FFPE|CA!Ub;nf)lze zyD>D4K`PO*4J7KnawqW57dDc}xsKzMW2G&@kdG=yNyN7W#l>+L1stduwTPOvh`8a4 zdjeawHEiLJn4}u>Z5)lV)7Zd?s>yS;EF4g8b^5{p!L-k^uj&GfhE-aEepl8Ex;T$| zqpESNSKai~AqUx~iXoQ5|K>y zepQe82>Kfi;jF9Iuyn1-Tsq(+Zg>X;;a(hKsM*orytE3~4&Kmyt#w*x)xNUQ{?bt5 zVXTO@M(~i0P?YF)@>p=pH8XVDBSLemXfV}dsM8pv7y`+b(9T@)O7tuY?NjZ-fN=(; zotRLEj5M@G`^}AQD0B5NR5th!Lf^FtIEVK1%lIh;m>snW<_3N>SP=G>awn5zjI^fmsY(pFWA4?I*nRSD9aPM)tg=A6O30$fJ(qFzW`RuNoa+@x*ItzWCamuqsOPB|l8gdJ5EYIzGzZrXJa)kKbAw{(PxK z95&1@pbx>r!Y#&0RUIc%fnazkvDZ^5T{XJc{9hHiWKsMP2r%3@x_tGfw3kX|pd+7LBfx8BYcw8?=#f<%hfar;z^m2$V#AiC%iN;ocC!@DsVx3zNTGJDMJ@7} z^cE@wfVGR*AibBI#p2drRQh@-=ec!QhXVu)jj&1Lbs*ceYMd*)%SRs=qRdatAXXa4 z_HhR@EKJMAdRzr-VDPJ6ql0x3FOrLx6{6NO6hb4I+3bUXBx%yfPm*C5@vUV-n*muv zTKlG8f?g4`hizttHv^%0!=Tw5(7>y<&TUbke=d{na1`Pgf!R6yQ@DjvvJ%ckaE7}E z_k;~cA!rsi*0$ibp+oOiTyGTPpjni7IwPWD|6_)x>pN~PM)ymkoCb3-QqEOwl$3K9 zHYo=n3n{+>Rh~kQ+f0r-h8$mCj4^{xn)Safiy@ zlops)U;pN;-g{Fv$8;{Nd)BM>qI4D)2*m(!Sa2#6*jZb?2n)#GL-5b6?y-zG;>{Sq z@`VO)l7^v@TwESkuVr258t*UTs9H8;0}Bh)u9;c4aZQmuLN_x-8z=RwDsHA#H`2;G zCyrLS6`!x`lw-na^;2|mdZV&ZBMXJOrcn=FWDx$AEZ9`bR+uv!()u$6hjHmU)~pvo)3xVD4)V?Se}qX46XhTi{b zLgtMn#l?rM(*zS1)rL`)p;#4v;<56Wt zn1_D1_>}yt2?6^|c=S_)etlcK<*+GzzOS0;_U+BscQ#0gE8&)uA_ApB_ar(`ZK>Au z?q#qm$-kd92VY8yz!))hBpi=g^`d)?w?V(^wSEL#m@f|;T-WCdNRY!JxhgRs3D5B9QQw>b$idMy3 z9lzOB!@RK;4j*2OYFIVsD^m^nI-6=xF{T<^xkxqWX^Cp+rxU0~Utc!NBpq6zbV2Un zRzxO*pR?ZugcB&iuU|BrTXI1atb!jLk4>FDg{4u8ibYWO)(!Hy!ZAz0GXc-KLnXe$ zZ}t+KH`Ws4!x>9lEUm8=x`I5ZMhUA2`YMV?YH21)P%%acuI!)$Gg9uo#~C60D%^lj zwL^uJkSliDA#ThRXxKyEjKLIgk~P@+_hJpU zy3}6rmmh5`FK={K@2tUQ_k3+8S`$sM#K z8t0icF4g}JPkx;lCe4&?uyraC^(v!{9O%Cx5e)1IQ|&+ zY9Aa`a+yd894c%&HB>QoK+kSQdqxwc&})`28_7>EO7ru{b?CJvlm61Q%(sq?(38rk z>>#1+OPV3&p9e|;6vc;qiZSSt*hOlK3Qr`Q7sYSWF!rx(V)I1&?rnXdY{|{m16Ck5 z{q}mPQ&PoYOJ#DV#Ajx@wbD?~rY2CK5II3T75|~w5B2fHUv{N}Rx>=7rUhWaS_E$% zro$)>DDeBvn-|YZ)s+py7}atVDs>d3c@f|^ghr_@-r=b`R$n+PRGKb+R7i5&n^OV_ z!G!4nkN{RqvSvVo0U)7i#wJJVTy!av`p8>_MYGTUiZ#|f%!6Q61oexEjV#lMnLGY> zw9!#1)wCA1a-&#?Vs}N#gWB@@^nHx~)yjC|?AW3a-(RVcW=aMq=)#T~?iflvQgd(; z$*}Nj;_fG|-Stv`#~%SN+F#uvL3B(dcLWocSnic%{6ZHFVdgCdP~e2wHij=Sw))uB z%1D!FSE5be8;*MEbb`+UHqhSh7>A@W0^eE0TxwMxZ?grDnJ?r%X~Q`WKqeh zD%wml){JOFZwRw#b~k=Ibr{OZ8Ju3!S{Kzpb$!xkTQszB5z)Oizo9SMfJRhX;c$fX zmdlE1;uJ$0J`&GD@ss`-10`WI$bW|9nbZ3e#596178WFAi_%lr>RNtxjDi6J@*x{| zxW|&Zpepvfh9--^uPp+lJ;_gN!uhMZAH#68h~%VJZMZPmILNjd9FnOBuSi4N3e920 z#+H?|0bC0vGPo=nuXGKwQf25e`PR$r0hdSn<$mwM{TBS=*YEf6e~p6ui0;(oHnAI; z9JV#r?9_ItZoSCaF!bhXxPZRKK#LJl%sTOpL0r_H#ba2&xv^GQdcvC$?>!N}iuycV zP+5&GhB3$709-`6eTrsq<0{0KL#gJw@;IXY3eVZlJm)C?7@{P~&ucD@m-mN+e4ckk zZga=y>dpLH#+AsoX;uixzd^>1ZU zC&O#QN9AzSH};Sd9k5wRl|U;-zLjd4`G{n>kwIeI>@Ss3QtA9SnF!o|TIv z+owySmgG0BGB~i>2L&@4ruEhkJ1WCQ`Az?Dw`P~hLw>7n*G${KSepS*AA{2P!5AT* zN8Laif0&D;8vt4c;B7s?KtO7_XjH7DplCzC7z+Y-5o!MKY5}PXqkjf^%+77D_B6<% zE^~K&9hFb54msIdhPU8a5aNTDWeSQQe!VlwP_*4*vS5A&<+pE({O~;QNtJ? z7B&kN(5XQba-fn9X-HOKB!`u8k#V_X4aGN)e8Kqv(G4=A!=J{Ij?`!srgV(3a*1#e zmi7~ki1!}3|66DqV`+tbSPYlhY((|g*x$J-lkoFs5OpJt5|+e(TA5iHs5fIR5cE6* zvGBBwY-7D!ZIgfdssG)wxegdA8(TYGlUV{fTf@m|FIH)$bi*-_BUWQL8s|8X2nWPS z7Eo9wHA&t8vA`)Zkc<#e=D>=bRSD>%p&^l%EzYLm$gYo$dOMUP0sUX-#Y(=RB2Ag-oL<}J@!*b3vVD=)I8xW%&Q-I=jK zR}^D~%8aUNELeuJh&4*(v{(9a8<)uZ?3Byu!{6Me?VpI2c)hNA{?qREGfO4~A6#kE zVyuRm>Dtz#$Nt&`BRT=O;rhS^g% zLZK?g)*MJ}Ra+Lp)f2LA1WFh|rR4tY+!ypaygL}dir(w?*0&t-OKe-y9NQLFZpkil zad)}lKlIzCHIe5@bNq`L68O)YOIfC;C<6q--2I3V2m}8VgRq?$(94-sq99x4M|7<7 zcN^uV;zHqiRehA6VWP8SBr1IPg*uxv40;FO&w@B_Dt|Z9B}*Z+C8BUFmM1QhrZ{`p zKxE%{)oDEGKsORL68u&l4eEPA6igB&h43UwB(ajkGo6-Xk+DTdn&y;iSjC-lqg5df z6rl_f340EO1&~3yhal27aS7!JqU>>FRncsMYz>DcJv9Rt4`PB%s>LX9 z1aTEhpzqMrR<0PX7CB~0C&eUddL4k}*qy(;@yedeEvbeO^2}J6puN>>^B-#EMG7XC|aar8pzM_Im%| zu;wh39dn_~FcciST?#$T_h9NuE22Ev?440^g6j)kq$V1_+hd&Q{^Cr;n8JT;!|4Ad zpBeW5a6())``1kSf4B{;7vsOKu6OS2|8L`SGfApKjK)k+$aN&=`4WIJzHvBa$^X?} zURr+SFRyN_E^n-Tf4lj=>_>D$Tq-9RP3k`=BN)!-NK%>PNi>?0qsuL-eA6aWpo~*g z0~4UYttlCN3VTjrQmKx+EWknq!-Lb&!a{NDjV{iKQ0$yy*SEr)ngMxhV7tw(y&02k%3oBKCT(VZn~7=BoSaM7jQ~Fq?vany?*#?kScw!Yosx++ zESU*}oTL;VIi@=*@V%6a_5liRU=s&DxQ%7m&E@;z{mmP@PJTle`#ALJhU87C zkGzWFBP>mWHQBJJIRsd}A<(cnr=vI$E1)E3+yh{S5X zeO7}+ZS^Rq?hRz9`u#2Y^g~bzWj+Z6uHyTi0nLp0zxPlEb`dc8nsfhsa0GCjRGDqcG-{)i#f z5!noG-3l&EWTzEMAu{3Hcb&CI9~ctya~-+ph4;$~1_A8W*mV$N_4<$9G>!8kgUw6( zeY8gD)g~hXpJnBKOnVmHvFfV?n6$9h&VM1}#UjGr0o#Qx#h7P}uk@oZOm6}gH4-9R z5CyTL5(+l`(UBTRrtncVGCs$>dlbbq%1v#wF$m)$9{CY`C398cd+f(=R zA#VYJbj0z?AP^0+h(YwwMIn0R;*jpw!67Qxl)u-2MXHypU=fYwLTF@a%*3PXqiU5R zu-`i2d>v$2$b6*c6>WwxPv{gNQv`NSyt(Y|myosDNBx5b!5|7Uhdb0<(*x^*iaW5W zrrWEQjOf?Qh1xlkCm=gVxtjF4ba^OBR8)VHJBUV;o3GK-)q6C)6V8C1qYj;UM*J0K zQ-ncC9H^ANH#z30c2V0kJJU&0#u}q6ONxhdUky z)*X%vuxk%6(zBHV2+I7SN&;#%&O5n49wtjPs)|(|ZR%s9O-vSr8u^Dk@S+^V-3BGm zhTFhJ>8JX@@^we&^&)_pj6ZrU-DYh<_{C-_CoJ;YR|l_mcSLe*!$%{r#Re-xa00i^tu6OP78c?eK6uq)UVRv=iDt?*^%HdZu>!f@74CRXK#+SU;RySUe3j$NFLl0 z)f8qD1@XWA)~}=*#oLcXH0B@}Gl<2-3B{F&#AOJCA`UJb=A#W?%DbJ>w|wKR!mFye zN;AC>dQ8rtr8x+Ke-jkpAc0$Tb`DEF)VB2^{%2#@Ea61tXQ6(M=}eQexaIF*l5?m5 z?F@tTQ#eS*8QR7MXh4ld{1~eyNk3-n3EBt5Y+W;L`D4`Yg?%4)#?kiS{wpIHp$%XY zmF}onLgXmcw?9p4B1+4&g=FHG|8)5e-r|-Gd5QU{>;qjLz5TciMpLOl$dh%0xL?PC z)b5X4>i_pK!o;@${C5ohb>Y7r{1;p3lcG7|vj4AtVW(RtNiiC8EYltN54Zf-RDj7A z%g{B$f8ux6*07;t^R;Wf_V{a6T?CayHE4FwX~5S4|MBB3|GUl7>*MLKyVGCyEQ%4s z)-DiM+N2dynKmAtl2-mJgde{9eC5wP_MfL$>|?t9=W=Itty8l9e6)OL|9Kl9I22-i zD*WVoe}o_Cprd|&ef!WuJX$3rax?^N9g?dr>OV;+Al{sIaE_#pr;6PVw8OX!dDM{@=#u`p@^#IA7WyV^$+{Q_s_Y z6P?cI{*j3Dha3{i-!FB(_m|f<+UFJ9>=cKllSvfMN{ZPxynKe(B#PYq1}6^UvzK9VKw{4RsRjP5qGC;C!U! zA-A=~t(nKr9)=6eKi`O8d2eZ7JeOJLc-@Ae&Vim7!I+47wK+NPv)xk?x7o6aE~eQK z+1rK^61WmhRb=PI{=x1uU8p7rVao+2z^N%I42V@!Lj0H_;}`=}#tf;NSeT;K-Pb0V z|6!lm=l@l2|1;13)y`VU|FaFn@6P{Q_~`rp{?Sk7hJ!!8I%i;C{CQx-+b>DmP37?O zhyuf?fD_OL#rq`9(I7YvQx4?;6fqc*^cqK$(1`fX4R`ebFXYrPCjO4kokpB{c$C>P z19E()0J-CSKTKO)N3;=)^8^jNx)cQh1^p<7z+6}A!Yvau;)uyzv3O$4(2#n0chowC zrl2IogZ4A3Uv(8v)J44g8}hGJck>AsalDABQxl^ZkTx-l$3r=}3TsE+ah+^+T^UwTM zX2DKm&q)+{%A=h)EugOP2qOiKF;tT7md(OYh<1FQv$mgSg9Jp{bX$0UDYB-tKpC_! zYG z!}#K`mXJ1_kfR#hCrNH^=wc(%LhpJ&4kV_RMre>r$4yiOw#bZfxTYKl;nA?(oCBYi zY=B#LoK35yyPFjFbsc>bvg;@~POfHMnl?>Wax-uc>kCb9Q_mTH`42|)?D}qNn=@}I zn~o4}pG9zY%>T82X7K+UY3YgyV5jr{?MIJF^1nyRD|h_=t$eOc@_-*oP;>aI-SHRw z=g}ay5?e@$0M3ktLFuzACV$nKNzCj@TW5b=ULj_7ZDY0bJI?-kBhl<ps@=ePFaiV2fHArL)>GwA?w^`e1_DI7eRj{g z1N0NZK;Mh@YZEJ!f48V)9f~!5V){bNM96U;C{i0b9HluHaI>H5r1O;e%D8w*BtH`? z7QR!{=$Vt8)u|Jex6AZpHLWV^DEAo9`ZS1WzQ@q-DY9@pd|ZFDgM^7esXELZsRZD} z&(YA|NycYk3@qPCqdaYFunt&aM39TNWQI_gosXN{@?re%sPu>80IcSuFh!rJAbE z1WhHN?Sb*%#fmxGy}Rpd57>cZbx+pX&$B+NLTeviGZ{SKqvD2$tnzq@eae+3tVl7ushvm5#0@XRWv)^6L%*m#g1&tXE2iK?ExHe#}Bta!ItFlR!X)Vng2hpdj!949^clfRj@F`8_7mVjDzuN`YAj$i$)& zj%kQ&F5%+@SaOLO_*9C+JcDm3VTUtM1!m@;&4zbujI-V; z>N^>U1zx&?640#!dqGj0j8Bz6EHwR283Op3%3#Wftsz(QBzpSduv1z=X>aa4*}72% zWxp;xOiYqI87x*oX=HMlA{b}#JqzUl;b$UmiywW|(qs+=a&ygFi#LL53NRkuEF2VuA@p`Ybs?!5QaOY@(4nC-pe@&q7Yc z+=Wi!0CT#`DQr+@OOO{u4a|r+M-j<#b~zLcB-DPL|Sp_6;0zg1wj3hC_K z6|3fQob}L|s%)q$d}{jnr0WXKt8iI?M}--gi;7~d94<*ctmGpL6VrmT;)NytI0+D( zk1C&bF>yeV5kFeE?O5D-2~?A=z-2&O_4->iLu-~(L_zL7xAfYXliqw5FD>;+?Ow0I zpUNuiqL>+8hX_T9 ztEqo7ED1^icpZ%% z|G16M4MZ?5nsWQE!W=E0Np6gWdTFlxq0!BF5X2|r-~`RJZG(>oerJ8D-Ck;c|NZyI z9()iTr$Ks7&eZ{CV8;U%(7WHKtbhr-GKX0feF_IqEJjWuql3hcc^uvYZKL}s%Flgl zLk~uersb1aHa#@9nAn4A2j&A!87Jv}G8iOhY?aM0$o%csdp=wL4$d)Y+c^RO%}j+0 zCz_TA*+(=IkK#`p0W$*DBFs?+A-CSk>NeVy-DJLfYlTzb&kOaLc<&gWT4xez{ z(0WOxYix*UJL6toFB(j2)yceW{!%o64fy zea(1VYl>mL`w|gY~0*CRisFOSw|0r zhX2CE_s3|ZET(h7b2HF5fW}8i31Pq_Hn{ExfV1hX!YYiJ$DwReCW@iixrCkkMHM=RJ4qPC_SR6Z)8GsPpQ?b~!Vg(<9tIynWRf$I{IMB~4%tLJ zeK(Cpc~+QTX>h`nRSnM+GqaWA(?_db6_V7<&iPk);xBsL)W z(87JPiNWF<>Ive!u3^V#yuthb-146*gaMcp|7T@or7Zusi~n;gALajV@ZN+0u%G>w zWLh+qsbe={hr@3F>Y2do7F5=?Yt6SB?_S?gs_TL;(k519+j{#2+ zD1vT^VnrCnXE}pH70e0Gh?}}YmUkxfRs{|iL--jb0G1Hv`UX-wgDqD5H*oekZo(G5 z`p*s6cg>#}=RY#NDCWFUA2ZJXmDT0tlK<~o=kEN!jn5x>_j!NxU%;&xC070DWXxet zygz#C^lG)1_!aCoUE?R%n;b_aPAJp?Wy?8*V;X&K&ht||$&W);Igsuq4xvq}1tp8a zLh*^xjW818X2;U9rT3ry_rb=N|K7W2&h!L-Dyc2~5NR!aj}rc?1;F$x8L`HKi^RH> z?ufsj;Fi9KgqXgI@Rkec&Zp002;)+dc)9m-S7rb$;2Wwwwf;DcKKpfL#zDc7C4_MU zT73Iz@2{psd)iZ`>wrpuXKVu#J8dPN2d5lxP<4U*!F~gN&?NAy=h<(payXubckfU2 z7tgT5i)YVYZ2x%B@D~&RPybac=9v~ZRO_=EunIwSf`L@m@R(NJDrABFMU;^qu@}No z(+lHn6lMTn1IG<5o^5r_*HceHeZ$0jQrZFvv*c@qf~SyaLqxeyRB0eQMnVaa+?80# zRv;*+C0{KU)Jv#Vf_2>9tR3Pg;%s))1OmMqvM9JzS@s8dga&pmTO^Y?3iX7PWtd#~8XbpCI> zv$C>U%Kxx_m;d2bKG!YR!7XW|H#3tvIKmo6HkQ+TC)OhErOvXy{Ai=IywO>?rQn3* zV|x0;`|8FR<~<*uHxQTlSrRYg{#g){@l>9ojdhrHgHcGqxq@!amPTj>lwY^)h6*yK z^9N8ou(vy#t^%E&?!0;Nob<)D_v!n%R#jy8e@vk*DRuJ+r!8ZP)-}V&($^sZ9Ek?= zES+X?VV68!U!Ak$IG(@kFY|Ukj^{4=%V_>tg~?#flD#A^$%~|@L>R;pSgYGqPsq=( z$*Rex5|og69@7s+vIBr+sIjfT-GLJ8s{q0v3r!(u58l9?BI$)#4!Xh86nWP42!CdD zXxbVDJxOM9#fEy}r3dAJ;g^wt!Y`xlAi&fh{G$jFDgVnj$yLYm4EC4N6~^sx$P~)ZGp9_cAADq$DEH&^VhoS`n=t_TA4K2Y z;t1FTws7E4+>j9v;E?R9cb&EM51Y<&++KX%Ew?)>t843zzWaXr>CUs==QXz=??h>V z11JB_>!a5%w)b8&efai2Z}$&(pV8NyH}q%k`O%B*gTtEu;8Pe1toe{rRf;N^pN%C<#V#_K$0(AoG)7LtA$s9#7DmIf+v@yAMto@O;x0^`rH;=d7 zlw$4&gLD5l4TF#50m?W)p4F(r5N`{4+zrqn_ftq06sgpLwziuTjF7n6rvDTU{V+bs zPaF6Oy;lMtQKNH|O~Je4H2Fx;_f!|;*8;q30z_LfN-tc zAwlbAKr2oE(Yo34nh#_)Q1AJW<(AyZ@gV4aTs%z%p^nzy_v?S4mj%mA2{yt@hxrH4 zw~%rWz_oQ4QS6H*CJn~OqF9D7*0x#1rU|T%70Oo7FGP0B4iJ+iV9brPC z1FzLE86&Eu;%MMl66)s~P||tH*s!CF8x05%b`+Bw*G%)%_?lfa>kP)n1R5uwyCgw+ zPy!__IXaFlyiXT4N?ykVwau#1aYbnwB*0wYCqpbjQ5R>VW&o65SM;sYCsp}W%VJV0 z>|aX-=IHMdGx$;s0)R1IrA&2!do>6a7iZ4h^g|6jd}wF5mM*i?G|T`vbr&_(%)Fmd+63l-`CR) zp|J+)y~FYkAL62QH;wNA9n@R?icNB`N9g(8>Ibudwd5DA9{f+iU~C=m_~Azn<+y#f z{9#ibJqFzTZeqFioaH(nHf>=KjBW*|qEMAff9o%QUg_%=pFG*}*Eii-olDhfU#iw} zsg?y$MW_`!qbO~iWmpYrqUo<%G}q;-oG_Bi+uXob+>JSn6Ye9~I>ffLF}gxWZ9v>d zaOU_U_yAHst-lv}ZJ-W5?IWb;O-azzByO6vTR36EE#LU2nk|)`XGcxl4QBhG&<{Y- z^qqgch}V*^G{m|V6FatD4ng&x_7-dwf3?8XTnbO;!_`aTD}D-m08OqleR3{A@GHvx ztD1UrD&}?J{r>xbWhF0Zm2n8fS3Rg#=RBxYISL!|`#GrRQhLloR`6PQ5+^B!vIe|~ zdPcRI*%wN~hIK#qPk@DMxaRjL5SwD&yr;#_NneC<=}DO7;)H@vcl=h%e+SzS{&* zrRMXqL?yB&dg@7Ip>)oy+A+}XGekDDHVH6TPmc!=>>f&pxrg2u!HUgeD-@81BZ-}b zI@R9|`b1B)oDfq>Lye7`!J2J^sFC)X#T`O>#o9zRU1vP19JUPKCP zF9wTPGoV?R#|&o#TbE+8RY*OnfoqKzuMJZMsev<5iluw0Kftxg6EptBcB9d_u9ei% zUA?9hUC;u9TFZ$jdLzp?pN!91RekJOjoyaP&pkdk!t$KQhl+N1iwDT+6%LSFAyjqplT&|v znSNG;ehv#Y6B3-9vJ^ys@{)WiFeg=>)A7Y=0KyT zo)zlv@^c4FVa2oO{Hz4KzJ7iK$J0I~gp?re%GU-+JISVzeBb2OpJjw^n@uXa4JErn zQQzj|*J794^`AWPS3k^E5`~$|&#~-{s1uYv!6wD5LlDj|8>0^481p!xQ5_KJUKk8G z?*p7;LzIi{$KB8_-;|7=D%QT5lpN08Bn9eD#(2Yi(dn6+9L04#oPWN|CWqZ-hBD=fg|Ri>TiENL(}3(m7iE6Lnic_FWc zbk2}sLApKG_BuhQ2Xv(Ib1&D=1`CMAk1_@M8|437eT+iEkt5 zuPYdalNmNiZn+)6Rw-U6jSTpg5s82`@j(ZC`lg5}$trlajWfQQr{QRT#NRnHF?+>0 zrpy!Dtt$(ZF~bInEmU=p69Wk!ALs1D@Y@zJ7af-Y$!#nTj5s-R#mPkl;q8c*%N(5w z2M#@$4ptnC?cbA3`l|BilFU={%o9YOiZA}nsSTMx|4y}rN`!p{@%1&W1irj{LpwiY&Ao72fx zB)1$=<3Yr(TSg>b_S;fz&UX{4zK|F*KH<%QS%Ce4+zEv`DPA6E_mvIndgbSx41$sQE6cn=*YaOP~1y#VOJcpZF_ngE(jz?zcOS8s%J{7rB(( zO11!-n`R_(e0XOw(~dob7$;tq{Z-Yk&i+zMw`pHd!2si`{YLrU|K+Ugts7Qcj)ncY zT&aKCZ0UcbO@&Kgb&v#`tOCI+#Y`{}5hT*re?m+IvXxF5`_T>>b@^n!jIk~@WYlc) zd>onyQDeghPIo+gID@GYlx+R=uT7E5lQD-9*&Ch@QxISt&Kt~>H6t+F|K^|!7d}en z3a8+R8~=ayz6CI@s!TY2H{sP*5CqiQDM@D1$z&!;TS(f{v`O1wnuH{!yu;1RO>*hX z-09pqNdpvHKm?y4sEDtEpt!gSvg>ojq9~~UDlDk1Pf%7-R~ONh^>=^#&-a~k?mg$; zJCCF@X@QKA&fI$*-}%mWzVn^$d=L1PIaY#uLxR)KVO#il@9!!dMxk(=f@#Jm$lLb@ zpRUC?3N00gqu?O`{@JJakF)Hd6yU=T3*J7(@yBL${IfLtmt`c0?XX3lDV>V$H3_3l zxj0StkBhUoEdhtr6Qo=MHll={K(9*J3^5x+1I0r`*#!-mIl|0{6xV>BkGSP9WioZO zX2+it^l3s&88vBu;h~X*MA(>In)EX=MKxY9Qm zX8$T=mpyL>`MDFaEC4*6@KOa$5NT8ed4({`5pqJDqVghjJTpejc#fiVf(*{deI4fl zM4Y8#a#TSyy*6XLn4Ozmt<&=42sxn}In$|7p_EOUk+dlw7!QGxgKLP$(LZkM9z;Qa z)M0S*AgQ>W;tjo@5s576=dmUsti%P2d%u)k<7VS#IaCouK&D&KbgtyRIucKwL?2F7 zN|SLnJMl}v=+&0Q^ZGniL`Aa2?}{;(*3s&$tFK3(Z4_~t*bYH=4HVj)yGC10!mce# zQIu?^IufcNfrVpN&85}Uh(4Ahiy=7`QRq}ZV>Mp`?laY-g4k|a-97^^r- zN)u09V!?biZtYbHBJxOf`&}_))aq*Af-J?3q@~?Lu~_ zoOAN?N8A(e1dknxAG3~mH2CQ}C4&eZY&Nmb*-A6y!d6^$Bc!U&?GCTk94aEk+lIA~ zdSNs0)!om!5}mucn<*d;y=_HsZ%Sk92O8m&2!&{6B}0`WZjP@;^7n-1#5Z zwyv4W|1&Eeo@EvTQg2u6(<1*}?x@gP;1n$;3Cf!qh$i2~=;6SVCUm&Tby6Zg#`+YY zUD&7cJI}*89%LLi+^7~hH$nz5147~ACN{8ji_#ozT@z8d@kowVlH_=Sgilrkcvb50 zajFgg7|6Cau8)C2AgN7gz#_?!eH08T(TGNOU{sU3H3df~-#kY&A9d`Nn~xeNd3Lf< zi_z3!7YJbAF*ye{7MgMTX&Q0<)s=agN7;8F!JBV-I^p=GjLnS8%q43+VxLm>fAZq6 z`Y5vhx2{>U&XfPSc`pC+tbEGGH{es#*yu_C$S&O>#8*;HkLA=cEdr%Fa@M$!Z4-Gd zJl^8on@!xD314nK3*LLTQP`s02?Lvz=$UOTEp5$bNgHW-hg#<5$lyA)coME`n9KuW z3z2XDjZ$Xf^7c#fOM{^%Ih+k|W51JDI@U}cWVJmxopA5~J_v-^YrwqtmL_f_tllo6 z8{&K2uwO8hv+$BWAqD8TX=~&spoCgQgzeap;0u^lGh{0qGqSoho?@9$YG^??ZC|;s zhL&bOpgj8uEylAN-heqtNtix*+%Qb~Tu$uL>;r7?X1awwq1ARUQapH>ax zyO4MaxG?NV$50!f^s?CoO4z+%1uT1(=#B5EkA# zh6L$^qYj{OlR60NML0gPLIY_%8Ms7*2`q3?fuB~iY}UvI1G)6>v@w}hc572gFaYL> z6mD*$MPVn81EBzz+RBy;93epg2R3N%FZ>77!vqc6^9bW#;e^<8d{I4(osXXRHi{+0 zBeh0oy-0j2PN-^RZEIKw5VFFa?55n-pmL*xBDG=-@5w;BVSBt-36y?;5j{;r-#`e- zHn1VuxgpvSKzw6v%8=inxtXUuXhzF38#G4A5{7LzR(ROOo27$ht-6*2J!%CpaASxo zt!NlWiJa}HfGbMsyw5;=eZZH1SZ>y&mS*icL?o0#dd^2y7|#Zo2uCq;h>PmsqDaOA zw@$;g!%c|T7c!0O))v9jWH!T1a~xAQ0EzV|OsNC|f6o@SPXS)y@a7RsyTI}Zt)FaU z`7uUmMTQ+RC1{WtGFw{UbwSx8TWTRje9j9-j3FG0^B6}K@-hR|ilSXW8VD?@UqM|G z=!j};p!r)Z$nPl&BSABgVNenC(i{tL$Y)1!9_mS5&C2<~`ADRPgnL<7yYgA7O(89H<+4(fQ4X7$mD1oY#vIpWL*cNJ8KxXX z$(YP^2pB5;iV|bHPirHDIy5z1j;5yBhG4*iQIZ-a)FdyM4$WouB+FY(CNbMe)*wO$ z;FYcPaU$d<%Wk{Ir!u8k<1nAJGtaD&$52d~V15}aUdZBsN3_BbZgWHJbmGB3WaM&w zmWq%Qjcg-A`f1#V4b|0wJQ`1Bobw%hBe={Z9cKuKaN0tAq(cxE_FWXq&Fb(lbP_xBI<4fPEVZRrmy z1-r;Ud%Mh7!LMty0-qh9A-_g^3UYD!8gpszgM$Rg8cb$E`Lj!#~ zhq@>g@ZLtUhMI`0W&vh8lioHD^mTM@=@=Z6d($(+DRSn~p~K;%VHDU=rZt1z{qTKw z$IhOiZs>Kmr?0PH?wTAf$dW1EA6fLdI64AB0M(@4uK0drMnWTjidG!Zk8a{~w6F^? zs}$I>`NC~Mn<#t)&A_9cogKqNLmiuYxd;7Hg+dxs+R*zQA%c}TyfyLVgHfZ)Pcm(-~#oG}_q>Y)NF z!m^UZ36!PLDd>XLLianFNTDJl(HRZ|1tvBU^4&WWvQrF~A};zbZlR|C`X)QZ@Q$t> zo4W=Ew|Dn@dQT9sg?C?p-a7~S`aRv3TW0KF=Z%WVjOCQ?WtIt~oYnRKar!aMBgrvw ziGdh14UQxGCl}#3?Bb)|?kFG6VJ3c>HLO}p)^)i;hjE=n^i+1(ZmnqlJoT3dfS%zJ zUH(k<0s9PJY0TIi<--ggv|TV_0zU!PJWf!R40iW|#5mm1dw~EFlhJ+g7-$F(rd20h zv6PH^8;sI%FAUL(dw-V8Ruo+m#TYGHx;2M$1ok=k3Z6TpMQDID9&E@D9@d7M%6d7{ zYcWezf$p51lu?x&y=*cNa3$HUdM!g;yK+p#(cvo`Ji9H|1kt@#5Oi8XGP{!*9TY6Q z?M{mZrlzcdi1}|Yv%O7v+?1!UVZ&T-F>}-!`p3RFXzb-*Ae@g zf~uGlLTUgKPte+oZo|}`6XNSYu!<>g4#j3nWoKtUUd)nHy`PPyP57vZZe^P2Xj60@ zT4_ex)|^#AO|;ic(|JHg$V@jm60_PEk&Loaz(+v#fhlD|mxbyv;8ku_7%)fRUcm;` zNEHx=31gw{wA-!IW*ai}DS+ZuP)TZ{QgjyW)6zM#PfG>WK27aV`?Qoh?WHRbW(xK+ zj)8e9715@&&*+%eKBMCmB^V+W8M~Q2FTYAzIZQpUZE$+@UA`U#pCbFesU?XBet6fv z#qNJw)~xZ||B?!G`~Pfw%DuM_BEdMW8EB+Y+T|~&HEPe{G3vR>ym%+~F>^x&S zM%OM*2TOPH@{PmyE?Bq^^s!3Y%hgTjRbB?71=JCBC+pc3GfZ08$gAT}pG%1KPtEkH$k|ox-2u#c9 ziT6rIy@9aY**;K<{Va~Zs};4#*Z=;xGSggFbw`T^2{rO7d^Zs z(+i$HI$zOj=|v~=7Nv**BUNW>>cM!m^fqj`yZ5|~p6*VLVm3sqOEHZGuFk$gD`!20 z0gJ4{MkRW-5{*RL6png|_+fOvud`BQcM-75-+~=0ZX!^mF!*2=!nP#_wlEV}bfBPw z!D)<^UL9jFvkG<`1iL>_6hnP71c)u=3`kT3JNsvk-Ja6{BUSuM>wC1nyy~QHRZ8(f zOc-$+?V(NQeK{$=bO(|}V{<;p4IBJb-1#rFg(h31CJQ!#Hwp!ss06$AnibBz{K&9k z7ePXnmtEewD{L;`y;WngK(5?~0PZE&t(A8+Ce&n3uFBs+^eMKeW5O#8n^@2~fwEe- zs^Q4Dk zn0k2$Q^2+^qkEq`X_>zPBxN-CMOPgRnPbgD-fzJm_QK!X%lVKL$As!o?yY` zm&tGb-Alt;z1kzV%#558GBV&pmdci%0iUIEShU6u1rDuMT+`v*-P!R2@(1GdMB5cy z*K8q>AKoN_1RdRjBJU_=cDSmga5-OgFqVI@`%R!9JJ{#Oa#1ahdyj#90_sSfvy7Ve zEaSJs9PZjIxce9HKrB)EvQYgIU%ZiJN{l{QePuG?q!TiI1aAa?Yy43hM7)wDFA#kvgQB9W56mE|xnK~C9 zET1)vmIQVsaB*xT*j68+F}>Kn#uGi6@vNS)Kyzn!Iv_3N2%56VDX>&@^%hY&(kw(c z_7Y|?LWpcd<3=vYH&B4X%H~jWK(l+0<4uAvAO+KT;Fbs9po<_2kAacPScphS%Z-sA zBYE%6sI|&E3})37UE35}t3+dM(dM@3x=LEB6jVJ+0iQTk&4qkAN@SflqUOODUqC5lqeMgrZ`ce$Zz|lVT!K| z(`lB{gV-!Su?tuk@5_jlvER=ic9jr(inRyiMPpEv6W?T>`?JPaR!vb`Of_wldrCPfR^uxsGF zt^o)#g~%H>Oe-MP#Q?7TeFM;H^BR0(fUzxYjr_a4tEUg`bb+AZKd0Ap0{VbD-J?8( zAPQNEs%+WTO^%t_DFA2;v;q)>OG{7aStAWHV@+q@j*jkL(yL)cNCEOH7@)uo_jc^) z3WPAul0VRZALR-Nfgen1YTBfkb0A3@gt!XTT-ev!1w(Fx-6>F38bF?BOtQE#$SNVe zW*K|1S2dAERg8P43=iuBt$Q&B8aawO;cKu+guQMX%W9exr1M7|*ojCt8X>a~q+c>^ zsC5hmnj?`wC|?me*TF#7_MW~#n9~E94LW5ZDOwI+ZM*eMFcvP-A&bqE2Yeu=AkaxM zzz7sQ1hBx?fxaDW7|9H4$#4}Oc_BEm@r)I;jABp>Z0R2YD2Dnd45UW6Ab=x9kO*%O z8C}a11EjNKs3ZSu(oS0nOt@*}vT;r5FJCzgdV|Pk5gPuiT*D=N+zJ*O<+(e%hsxJw zJPDDid|J!cuL@O98e@7oNLXYxjK|DLBbz8T00=z{^wQI}t-JSd=8Lz8F&jtLwjvy% zayDoWsciVpB-K0!V__+BC}{-xdtg(*^<+a6xHyUrpf<)QWWT40c<7>RoVtY$PLhu;%MQGg&p z8(O4wM0%mt^Uof%ZdbAKi8+M>fFsC4MYE|Q7HkKT0IM!U_(QQJrI{uCWuOFv=R6XQlt|_lL@PK z>tge8azJ#VXS$_QUH+BWtCiUort?c{5Xyji6+$|YqBjE?H{{R>m`oz~fp94i2_g=l zc7_1=Dr6L{u!>kv+6f4zWCp>BvwWf*#8(D?9!$T@shv(@`OgttJ*q0>WZFk_kPIl7 z*7xKzdWae^h`6q1r})85+mnWcb%KV^+ZW+C*)t_JZ2&wL5AD>q8FZz$r75C9K;>1*2i*Eck#X7P<;a>|&TB zkaRVvX5nlCXK<>I=3{b-VZAAIOb1=YxTYo`uOvj}S0T$KtRvm3Hh!JpCap^oP*aB*~U0t=#m|+zD=oze<$cR2Tj4ZafvC|=lBQ?B{=Tj zgpMucp|24Gl+!c}viGfTNMwpPUX~oQ%rU5L8(AY@hPA44t7Fe;cQiCafP%$5u1Xc_(Y{izPs)#gP@ulXh4~TNy zgkobmx+{~7enUVvjm9(2Tys`qtmIYVpo1X;UQ+u9yoeJhj;TH&sB{=&p4(%CHiRvo zOffphgA0;n54sHciFnJKNNr^VKxl6d8pVowM<| z1S!`p#(9c^KKUFVa4^?7pujfB2qS+p90;)`@3KX5@lLYqWMnbbr@f=Ps68Kze6gNAS_2R5<)14%xdlp4 z+b4+Q$xFNAq@SzaZ8cuaJTsxs`pq1m|2h8ar7h99@KS;KhSCJD0QLH~mEq;q<%r zC=OY(Nl#3IKbSxJVf9hO z{%>t`%^Gk1uhu#HkJ#Kp&|_h0S1g*118%#o_lkAxzJ2i{8vaBRpS=5 zfg#(O00NXFZ8=G)oLE*IKjf@3saxaNm2QxxDFl8tfUG+jKO=gi;%5W^$_j+F=w~yd zm>DgukLqzR36*_Fqp&oFcXju+Gz$Z?CpJ*C3U%_%tDN|XCdVu{9)`v>Zq|Whrp7^c zEkt!-4^-O_gi)%VCADR2pEMx8=576^vH z3{R5k6;mwMzbkwiOeh8!9qgz;7>lhoibk{~IRXedjWNC*K_-oZ%lVQ5msZpu3=Nxo zg5Qq2R5;;(oEmRN`aL(V2z4NN5C$##B&_$0e39$8%P~m`n#f;Wo#O zNpO1=x&iUiGUSqCOgp&iq5(07fj)C-OYlNsj~hrM#STVo=+RJvol0Kz?eNsjb95h4N5ISiX$i)SjMNvmcZ8a_kc?dZdpk(g`UP5L( zc=9aA!Y{nEOI_B|YIZg0gFM}!xbqMIL!xnR2AtyPiMdq24x8XSVIb$ydY9g>zh}qcxoqU~%;1^7WfzKycu&|-|5R@hl=61w zWcOyGC`;DBt=^LM?<72s)b(Wi{0^C0!NoH{$+#1qOSc~U?pU+ie-Lp$$I{++b>r6eN2|Ky{u7(0>QDXpr zl6|e&+(XU@gWVT`=TvjF^~@Uj_M!mlh8icyJT)eaG`-QcsSZe2qDLRQUVDzvd0)zJ zF0Oz!?%Pi$$*~6IA&&CYVUGItB<~9gp+AN(DwzbXmK+TWMnWNp@EKA1q`K!H%0UH_ zVe!MQ`lS~lT{51P=0-!(!m&rd%vu=sA$dU~XzgCvcoz(;@*pcOR%4~0k@GJ=q8GEY zn3KXDOAz+U7RyC}k*P*+L>sNqa ziniK>y#?7uZZi=XD{@`QMi1f7YHjzR8jp7lTJ-dyoQz8PuoYBQeUoQ%eGGyPJdkWx}+l;PpAcp%Job_Yj1Hwr1hl@U

    y>%J0a=t!tWT3e3opax=wlCS9VZZMB>&Lw&Ug`2Sn8r6&jb7HU`}Lx} zD=Owr(m)%PiRHM+$&y3U2RzuWF5XKiWvc2HW2 z#nS0_mWdP3e7tP*qD70&ojTGz`TyDb5_qWk{r|C4ma=3?RE89?N7f=D*=3Eg48|5S z%#0-xPZU{G)`*Z~i4a8_l9HlA6rzNXo$UIbb7n9kPtU#2z4v$T-+4W+9y4>!clmrj z-_PljfQs|QczHEaQGH0YUBE?@y)w;Q86(*F*R>eQq`hShmR=pj>E=W zDM(l(R*Wy>ULKo? zYx2Gcp8ZAVsJDC&7lD-oGWkp0H4omt^@u;ZEuMk1{+)Q15tbC@$CG-#-$veIcXxO9 z)~#D*Wo6gAwOVo_6+7J9NQ8uhzN(xI+upR1mNqObtZN%ZX=J2ERrG*xEV)Rr zu+Mj8d;1Sjg4=hgG@>|LcCX{bP%C^L{Pg79xpP7fM=#~%2*Dg$A9=M`gd`;;g@=cW zTEA?}wFDlr*VEGj76OSxIyht%Z@8*CK3c2Q)!E4!QlWBrw~~@ldW}|^*zLaFY+6&t zPjqQwFpA09=izV9pFbSDDKzM=Xv~{0UrxNLOy42S?TY_$`BHXJT;i)eDdUfSf(7q*TOu zGq47(y0zjUg+bJfO0MWA@uFjOpm&x906gqIHG*%ts@3@~lKUVt8`%N}5j_ddCO#lk!)TvV^0l}GP zRSEE?j*iZwiO)eciC%?fkI%rIK9!yG@$m`YsoekZ;c<$w&A9JMF8Xi~*RagbAyjkSku%N9v{y@`9yWEH^|C}_Ty-fPJ&ks2@8 zqlA6@c%`4yCp!9ac6Jb~Y$gtve|wl*DC<7^&X)i&VlxeHdGw^G^*{bGS8%dnZY;+e zP+}L0&>a;_=wK_ zBmyJ8deu>w<#5=J?d(g6S>eMX1cznM+?CuS@rh;@>KA(jeYIjip_I-`Pqv?`Q>T+y@?x&siua2I#DZ`Lz{_pY)iD9sekU`J})LgMFpo zfR#O~+XR207oh_ag_S=&CuAnu8Lo^P`u=W@C9EDrcR1ku`r5WqzCC-c&~cg^VyXxb z!5V)kNl{M3jXrZRrq34@hm`<=C^;p?_w3p7KeFD~;-p)O0Ns{wfG;bC&mc?EsjcKq zin9O4t$WcQ_pci(bLCNq!9GH@bWitBiyxRhqM^Z8;en{@h<8bus_?mct>=X*XcXFyh)e*kVcL2-tVa*FhW8aM~}|tTAuU!THb!uOQ0eKTZ=v; zdTR75g)&yV%hkt1!q8o!Vge+PfPmMhb6Z9|4x~oVVF2?5urx1M>Y19(l~D`TH8ey= zMV&u?e*L<2yqf07H%Kc+x$)-etSmJO6_#G|#BTAd`%kGA0z|00qK>03Ois7jXvVXo z2CE*03m;y$&gF@Jjy;O`dzWUcuVh7xNbfcIKhiW0^z~-CG?QF?O%_oQCW1P7vZ|_z zPf*Z0SO8Ejbi@7k2TY4F=jbfNSjWG;XV|QXiE*+5g0J|T(P1}dkZ+^F1 zZg%whP`h09i(>Tv2?b--?oFk#FnEPzDkH}Qx!fB>_?hr4I#=&fR( zR;+(CH^t~<5OPD;p5bni@m!Ue_0&|MXmK`s8C8>%_uS0+O>8WddHjIJuDL1$cqg9# zGCi-VqTaYsj5P$)V_i0l={YF-+Vm>S_WI(xW!oIG9x{1(@H8Fxpce! z!^CjaU7*#zh{DWT6K)?#my`DPAH9FfR$k@~W0!lBn=7(&rzN0r+?t)Ay^IwN3JR)v z@xt%TCRm}vdmTN!(Qo-RXJ6cU!4l2&z`j1Wqw22C3yL>KUq~0_c>1k}1<#B-*OS6FuzTZeV}udTv&e?%*4D z3C9n5`uYXHrh4iEn2<$)5E3-L!?SN66RbL33JVCS!otGh;^JLuQ2|ekobAam6u5M0~7Et2_cNBA<-Cqwqi>u~zH3%Ga$inoV*+;W1)t|fFE=@u@)7P( zs(m$#8~9Tru$K>~c=z6tN$@@sT=Iyo{M-Ozp*tVA*`UKbWBa*2yGYkRPW zs{EzXvOo4)cD@|Fv74IXn9<|-C#`d?(@BT4G-K#$q#`@4RW;(PlKHA{MHE(IL@R7R zKB%irOFT0-DRMTlDEBn(%DU~cr`@Zf1OP)o2Uw7Ek!mS#zBSz)0JMkDgTb@LC5D=( z>2=J-u5`Yf9Dbb?bm_~^Dv3*d6bW$t^VTq$Yh&NV-A}1R4ByzDUvE!(kwlE;WRe$x zL!~UQIX+6g{2j1`7`P9=N=#&AZ#A@y z*3^F>xVfY-s#}@eOAipW?n4&4>bf3|e+0PW{z$b9lP^!>#(0Zz4UMQ+(FUY7^N~w; z`D@vV1|6T+*4vKi-Y9<+7Y!(;WA677qodF3ynAi_q9zBJ%CK8&2Qy>DPA-n?$Y4?* zE_x%>)_r?C#`~4YNJlL=Vb_@T=@kt498X@RClwM3=~KIHd`=^^ou|E;{@`f+yLW|% zC+EL?`v%w@w{PG6_RT@zc^ zPeO9OM)tTc+BDgTl4rl79rq({@}R-XHVN? zB{SWrLlpY@`W>B}nlZwE(7pXc<7BbPWwa*!O~wRlJ?)Nd3=Apt_Vr1LJ>KU;dP5{= zMybBjmjxR=DVuTaKke}K^_&486Xs!_x&FvHzuVf{IO#mszUG@ZeOhNx8!FaU9E?im znsjJ%+Ao+rkT@r%ul_>ttzNf!8{myN0<4BWASfv*xA()i3*ke-Z){&ySJTkY7?8%) zhe`+M@>hBPm~N%y0F2?=qKU)sec@~&y4y+nWAI&)dsD**k}R48+e)15B= zkslz~@wkkIyUJns%hyh8DN)fxIs_|8u*(LT6Whf3Pd~pnrx4=ScdgTFYBW7FQwG@N zfDK=V!%#KaZGma)=v+!jm;+plZ3jH`+zU!}djzge(@GR)4Jm8B@$yw6-94^Pfq|W= zY7!*yYMGM?MW!VzB*#8_dw&n0M=(<}akTf-Cy|%ZpWSMSetf`kW)@Uy5wLeuy<7g^xGA z^+Q3LkJ!t664!f~?mRu<>bSC$5?17>1Z0nLTl7u)!>Gx;F6)XL-Aq)S>|ud{#emRUy zm8sH>sxbYK-HG_Xo2DJfY;%{(*i{lg7#`~lAs&_ug6<8Pw) zKl0EtxqXzvO=6fhKClIQHMxJOyqvO+HThWN{nuf166l96<_CS)E%mY-s--wSynUMq zd_(8peBSk*Ys73lM~UY8Z>IFR8+v>kCF<(x09R?_cImq6LHKAya`O3z2>rt;sfIej zl=2aU*+$sb&rj1iV>3^ZYZq!7f8c%=w#B5Eq4VR%FTl{xK9xd|%6v<&f2+yXUU!r_ z(3p;q@p`;~)2%@=7@xs5an?AB@NDkjYgO>%@C`JhhGCCS!f!Cpf7(z|M}39v?c2A* zA3bB+_!|wzBo9$AF)=wd-j=^EFS#y^Io+7Of+a{;bYB`nmDwdHBct}N#6;59V^LR) zu4{fB;}rTPeV-I2%p%s1&GkvW-fOZWHaU5{N?GAc>Mpp-+Y1cbs%mPb=l1u6!UEOp z+#=FzHNQpuD0WHf>1Cq`_u#zJ%s@x7pE+pbcwToN2fU)g_70TFdwS;{b z>#Zp)Fglm;X;kTR)x^XEV4?d4eHjj=G#8I!V{55NYvCImsX5nGW5{{E?^cJ+w=2(Nn-8{?8e|qEC6#vP2vS~iN{Ek- zrzb$_Jj~sUJJ!U?nWdN3i`T zCjTHaEV&i&naW{!9js((%*K(E&h0e4k84dr+0>M{Gvj?yg@97?uYoLkjH4qXl@1?1 ztHI>7Ej#ARP&+a;)rG>&}2*O66)om~y~V&(R!_PtRfHV%zt?Tw5*`l7%%&tq)p$M_Fdgo9He3qQ?FbMuv+9_HZi zxb&TV;tq`$T^R`S#hRe97!{|(_PPWt0JQr5$oKi#osA5u~@S7 z3Yuo^km$dB$UpF$*5PZ%zGjp9v9;KzmR;}@@ffQ=P!;7^evB_(3)MwK@#*~esIzB{ zoxI*s#3|a^+Pb*xyJ^8henha?wLjWTngS;2{b+rOYQPs`&ciS<;n!WC{GW+bJbZ8+ zXk2tJmFMtlRGPd|tn=IJ`?L=1>n~_PQBw}(*7nfbx0X{RC3-)a8LqmomB6pJe|UQ! zmSv~vt*)AeU^a=@vx=l-WLGmtt0}LsvSSA7zx16-cY(ds*g*?8XUv;FkIYSr-ZIE| zbMfv+>4@-fJ$?rqol>#78;lj*#;UwfFD*=Y~1y( zaUb6v`$4YqfRXQvW+CTsh9A}Zc|ONGhf)lo?DwXnv8!mwWxR18>+NzBJ`y~1em&O9 zOVnqpk9n5=cT&NGh<5FZL4kp+CFe?wj7ohs&@wBhEAt}HOH)Uhm-xOOs?l3k|R?rN!?qnOXR=b?(>1HvZ0FkWWnK^XX*}#(G9_Kb7$GT#FV0pyu6xTL_XUVLQcU^ zee212rDiv?JpTOQ;fgRh*(CcXB#IwhPukkP_MSC-vE8k_;_2AfcmpC>G5esrd`q@T zwCps0W?mkRCGDXX_co7z4TMo7MMXvFrfF&<%5Kj-KqjqSUS9OcfWDoA<5tw@O$lVP<{%11moYv$P}4wJ;*7;X;>%M=cvBdt(Ziw^bfy1G?X z*7&~48T*HLLiRVb&CJ zyG4R#wvcvqy(EG$IEax_LYIj>TYpHgL$h|IMr-10ip-dY$}yGW$8RYqZJL}cU}Dnv z3@iMAMuzUQyn>u4v^)fshQsN8VivA1I8 zE|{=|VoXj>m;itErollcxphpMZzy0xLqlrOg7voF_}<~nH|=8$0Stt;GX9MC;=(I} z4?{Xb;k$M*!X7*j0}SSmMWV`=NF5>*>0!GSH(dMCC8rfsapsIPJG+37j4QW;d@@Z) z)&3)Xl3nY4IV2?;hYX`Ve7)y7LLXdR4Z`yNs{ zkAu?{Ox8zX%^&u7K8jP~xK>^cH{`(t_uVAZQ9oJ~bKf!cE8L7SaE_oI4dIKvo4 z-tdTtFK1WmnJ0D@=-`Yb#`>foOW*(xJ%B>MXsd0K~ZsH-G*uMb*JnK6rB&b zG{$Mm=;$aYR&uA2)0xyaGX2!q9l@%Bs)XpM=V zZ-FUOU{Pa3ZywGJ*F9rr-?5`V&6*;x-$=iHGvk+CDhc0^s9-Xi( z(D4)Vb62@U>to93(MLhfeY-mLvX2O+{T;J|Wr+_7;PSLN$h*z#4SG5})?h~MpO?wQ z^rmlS(sx&7Rd>sd7SbLGnaCm%Nf@)*TN-K@?qv)G?6tkhsZ+J=bGO+JUgARgart~7 z{v%JF1nNmZS4`KOG{-x>mEI7 zqI;RiQbqA3?cf+i$0%XKx>4IdtKBzg}ua{g&iLw+@m5#Pf?B z>(;F^$gB^kKR!77G)Q?5nNurwmw}J95$dQy!HHRC!A9fz^mNnZD|(rF6Hp?Z6ft`nCco`rMK2c=3$-WvcUTuY&>-(_kU zVf~?4A=CY&C&+w4z%HXnYsJE|^K6O>=n`gPW zFb2(vSd{yi&Ds~|xCZ=SUTE*$XQqzh%!5p7z+qb=aYf)P}5E?eX z_d=BZtVk5e%lKZ$gnb+_<`w*ulu6^wqU8H22DH_}60UI8X_5Loe*7a@DJX)@#83bk zYbQ2Q)Kwv9I-2IQX;5 z<>Xh^QUU@qUn>T^^%yuKzI1bE~zA{4N9IdU?N#_F~=b3TjH<<5AHo9^Mc z84}WWvfwQfUq8zM>6th*CL`lYf$?5j?Y8Ek3;8zBx^X&QUU8;E-D5}6E+?Gvn3*16 zx3kM-3EACrLb4)8XY#$xGpe++nd-+l1|3=-wU`U5C+s)6`sU20p8b^!u8G|l#z^=! z)|A6u?%%T-$@|3U6q?#f5mHiB*LKzxZ712`HR|uu8){o1%dFP)Je+L2Z#pt8%)nvY zeG3)8HbCtURj|o*bqI_PzfF)ekvctLUurFKI5^h2W=Eb&ulEJa^W>i3V@Fjr-&S5` z0(_>~yRCxT_TPK_p5HQ9jCHsfD`Sw=DD*-Q?k9DZYxj4#Q<&INxYVn1!$%H|j$R|L zBnIxahYqzryU*#9R$p76TikO}YP-ZA25M)NWMXCgE1G z>w%uTj#UXFmMzNcEldn4%~a(|bvO-;D!|tH=rwMx7UbObLDze_X=Cc1K&N{j+$o$i z&Ah$xO4~4#JC8em61Aze6}u9?Q~7Lf+ni=YFgBl!5oaFU^-`s^P{5x~X^;L{mSQJ% zQj!wYgJhQ0DwlR^245B9-Me@1!4!^t`);La>N_;K=4NCZ)-xi#9r&JvXY%tA-s{N? zy=fXjY;tGJ75&&1Zsz56H|7qv+^6p8?G+Y>0UV0$+TH46m|O~vjNIon)m=H##YcaM zP9eBJBQ9#9Rx2!U+bO4t%SE?JMvkK&M#jY08XisIBiFuYs-tt3PKT4}>Z9Y|I!3y3 zLRrTUYC#T9Ok_3{n+q~o>F1kQOLbYpb_M9F%V+x8@S&Y42I#|rhA+I_O-?17zDsdu z8HQdVJ}%;-2kcgezSF}U+oguT2;BAKsXu6Pt8Qv)YOJ?G=-6#I7gsq`F(A@%vm0{E z%uGyXXGUuHw4_|N2Vsl`9>q<54vN!z`Xc+8P5PNAGI;7XuExR?0m-y>o=c%S(CBOG z+U0f^K0ABQjl>(8T{Snn_mXLo-|TzdX9gv;I_o|^xnozGk&%&?pKo#wc40s%yn2f% zi-hNQZ6oGfmxgYU!>)%(lyZ{CIFO60o$wJKlBIZg@P^L+<>^S2sQ* zQYg&>y@e81=&Ka*X0t?lk%8dF|Veum+B_%cqrw*SW@2t?Rk=nwW%&=QA+r*RB$0%Za z;%>6MC(q8VPA%CY&z?G#qh4>kE?#@@U|L{bUwN6kG~fKa=52V#)6&vXRiE%Hy;6nI zT>Mp|pZw92y=DW+cQl$m52F>xXneRRkA4{LjLYBQyH`$u5X1$$NuoU8t84YO)V)^XU5r@+53gX|N;) zaKmVT9anQ;oMq#B330)FxYUdo%uHaDjY%v|Il_mIle}`T=j_;pA0u*Zl^DK?`-~Yc9}EvX<-R(#Z@+IM#fq3 z1t^{=I~JFdgX(>!94)|xEYOi?G|WHqX7`>wFIrn$pWI|7G2!r`!)&z#3}S5O%lEet zhwSXqb;_DHZQ`OlehXI-EYGdEf1kbH9exQ0QVIXS5)o#HG^t(4whIi86GXX9pYKQA z9-nhIjMhn!&(dM|OC{jMe#}Es-)nJxaZE|7=Id9V;NWLwr#f6!Zw1Fva%i3$ zZf2?5N$y8i!5?89C6ws#<@u$1_Z}&9lEB6rl_~a#iyIgk^8FYSzVcIk1y+&Wv6K4Km+A{*y`48;tha^5Ww!YT(PI>OM zsb_X(#>~_4Gqxs#eurSklkJx7y zRpw`8OkQ=P@tzsVy|H_z53}Vah1V^J8-3QA)qjZa`8;iELRVfon)6_<=8)ND&bO~* zN*+zP%ubC-NlDf0A5pipy;-Y6b3hZeFMvK?&RbSO!fkG5(p+?dt8IQq#(f9AJy&Gs zBu~D&k~KV>34>i@3QxaU{PbNV7ky)YYZ8nZMnOqw{6KQ7l3V$_|8!B&n|IwYBrp!E z0^`Rs!&ObF`vL$xy}Xr#7_QyC`Sl5{oVupwnXgIy`?p@sYpy$HYnSWL6!jR@(mgvZ zbhl8P1m?5;ppMh^FGcqi?n+WK^^iXQydLFS>Q?4=Q+Y>GN3{%tV$^j7&!=+Vs0IQr zro2?UHH+Ic-J$|R+UXe>WSc&e783(DEBkkVr@q)?xP0BOKX_o*kbU;54E0`7HB~h> zSh;|C*&*J!?C!=+8OuVsq_1{Q%1A3h*o3jx--5U1($n|JziCK*wKYjYn?6jw{;>509W5B+2FAunV{W{!NK83ktzm250_tu?$dU|>h zk&z+Wq;x{=2&O!Wqcm40J8GrS%)h>HHi_ru4$b2icIJ)1_f~`)zWl~koK<7@W&S<- zwqnO}qGx8u&YUUsfjw+_%j`CO;kd3$fpw(j@W_bV>}ajL?|K2#2lq~Hwh3c6s6jTC zF)*B<-&((`8u6*e87q?_t$w6=G&#QHx$C5%O`2ta@pxa;UCU>oyt+4D#)@`Hp9RQ%7*jXwZDF8MEJAZWk{i> zqWV72`lHb@>;hX*+mxosG>O{)jgvIHYPU_IS5$Pg1Q@Wzup4J&(R);T=DeB(+hp+xC85oQ{!uY;945XLei@mW00rCtK{7ZvXq0dLw4&lWc}3qf z8#f=1QCCA>D*kO!m@mLa%(s5UD(Q6XYVqs7%ZBYHPyT5K0*_M8@FcuiwRn4@G z6;^xc6~tIWK4Tw}$h1|^muzwc#w02#Dg-Peu3JYYIzcxteQ2UeJzHP0E-dq@h2O2J7Dmty&Q^fQh@bth2X8bpYyJB5D=>I&F0Ozo`Te=cY;Ac21o|3sTJJfxGsf@Uwd*N# zQ5vLthnv#o^h)pW2w#^j|BCZqLB;Xo$NBj9sHv$L7#PlR3Q!EbQD%>fjHK-U)X`C3 zRk>M6NGR83&z?Q96K!OO3vcZUfZeAW7&XPzQ?=FeD0Pt$#kKW@)tY0`KnG)EW6VKM z?F%^l4u@__&$11As-vsh-rL*T(UJP7zD3Z91Vy@z4y8$2QXr;AHWL(q`Q~#!{b`c^wFFRW384OK(!Vdw_q&u`!47`S zvj6H#@JPphXC`>~U&!W8wKSXiKb%8;F~(G%?b~JEP=E@{&Fx>JPXqTNH$MIhu; zB|_GGTeJ&Unsj-&Ns##fc7VF*cGz+5^uQ2reB zLW-6pg+&Rf1B-O9UeF`b0P8@Br_c)`m^cOc{4-Duza~t_;vR5rP>EC8-AsMR*(&gS;h!ycoq}SEaYATxW(QDpdL{bM=X@cA6#V{ zFtgEL&E4+^@R$SC9w0K%z?OwFvMtm^5aEXtQiP-Vsla@8P(ezNBKRCM_&Eb20sj#y zcuAC$3rb=(pCAtlCi0mtI{>u{w??=E|5AaQ0FW$5h}bJI)?b+tvGxSowYIZy!4Q_@ z(EP`ry8s5ZSj7NRuuh9<+kcs{9gam?V37FLAy5K?&*w#`DGRz&jtj}{TpWlpVG%LT zg2({+U2bj6Gm5_B(oL`+o}nHHtb;>C`KlmZ0FyX@+nZ2(*zu>@!$g_2AZZ3l5P-$3 zR%;ObQ~6lD#9G)v_==+oNe>s2Z{aI);yINlZ5RTO7GO?4fZtIzSV8zv7l=nd9SLS+ zTF6?@Pqk7%#1$@3fDFUg;nS~yq72_8ak{0IM@|qM`1Tf)H9CTs;IPYdiXAA69S~5x zTr0#PT>$Nj#m^AABtIbn5V2T%kpW0!qA^x@*^1A*PZ$l9+s+CJtP<7|3Drh`a$)gP zEt6nGc?TVrMD_Sk7<~nZ%7|QEtE~vMKeGIfu%nZQTP)l+sE^R|a^RU)DeUMa3 ze^XRa&{v-Sk!V?oXs{?a7g*oQVZK}{J_8WS5;^ZZTj3Vv`O-cX99-ZQ!o60&qAsBj zsDKE!gW3mgFaaFr3MriVZHyz7?gi5=LMsF5$i)$(u~7R^t%ijnz#v_m@yrQTQUI7&Za2AAYj#da@WDxWG>4=nc zbhLDSe@KMeS7H@Hx$T8|*uX*q#xr6exgGQaf&cV3?G7+l0OvEyTNdQ|F zgISye@Gss95|!0hqA~!zCHmL4IuaudTAVzPJchCpf^5$F3nJ(cq{>pO74K%CRxUUF z=aio>i45oYyLyL&(QkAMZsotPS5R*JMyGBF4C?Re6x`px(J53+`tR!%+QPrltu+D= zY=2+3(1!bsZm~$5I#gO5&(^={7jgub*j$TF?rJswWTHZnh*&Rxxi#^H)tBntB^#E= z`doynK>KqMu3AiYjl_SqVDCVlFE}=WDGCk&FljJ$jz}sVFcBtR)`0?Y1xx!E-Xq>D z!XSwSU+5e<2I|}K>1B@F2et1CtlpnrK zR6!*F`dSGy7Lw^wb5>Styo(%=ha-huz|5Zfv9#paPH zS3Ah=fv}xbOU|R9RIPA)6)H%BU_t2J3XNG-QXUjNgr^qoA*fgsvF(UYi|n#WMS7y= ziJn|A*h($nf-c2Q{UGF3-?=|lqoB{KZ+(8|2l zcSI95+n=x|T+0F+Gje|GV$pz_B~Io`l)D{|!&sqLvkq4_yn&(MpuqrkKa}$rPPK|C zA$HW4c@)IP+p60NybJzY>q!O4ZTMeYyTwJD7hOc)Ap~3CB^wb?4#_aUIa|1qXz7T` zpe;}H3nuKI&xO1a__t&=mt$DJ3B><&|7t+|PdEPpi2wP%Re|`QZeIn6CqlgB!Sa+V zC3FXc`|_HFP=UUAU2+&I=ZL@;xLmmf^wR2rz~hU)F5Zf@p666cV60SH^SH2x%74GK9sz_4gBouhha^T7i16E$2CybO*(tFn`3jQx% ztHys33Fv>OkJaP9ge62of2#i{zIUzu-@oNri~m}S|5~g6w-)vFKNj`1R{w7;{A<~L z1ax!3&sDR4FW1#0B5bf{xj; zuE64ah+mHcd>IM;2De%{_5+8sw80>(1)W?h1u%AKL43^#d;^@IG}a}wH6Qb^>}?fr zzbsr4>4dg}#tDT9{4^C}6c?BYKNVuETHAkJ59pf(BIJgf`Y4n>d@aDKVju- zP!1l-A@bQFC}%GSqLo2u0c6#7yeou|8f535C6gb4F3@k5flFD z{GZ5L{ilD=wTAz!;XiBm&l>)-hX1VLKmVQh&pfVkRQ=B|o&U9if5Z?FH2uY>IKc66pl^m9B&VS)hS^g@8tE!cXP38kY3aq?dsv+JNS@!y*W$UJw{N!r39h zK@_O96+FIiND-iI;hKI%$&S*k>4#7JZI0AnZ<4=)O!9M|i@M9qYfB*|b4;;`+h|kJ+*8;Eo zV*CJI0QN^O9X>EE2#Le<{_h~C|Hw=ffua5WL>4#1UziCVB3yo;^7m%+SHU@8Mo^sU z?@x(%`~H>X!JqRX!e9So6Vkws@HeNlAZnIPM#&M5L;n{1zVhxQgt9M_>8s=N_|v~o zgR5fm_z~(Np>y6YL`U}k`C$i2GDj$omO%7nNTADmpHYv!x~8apTB;M|GHp>{-!>lAisV4eii=*Ud!;`ePZHbF!;W|ssB~4|IhK? zRo9=`U;iii_>=fgaWP=cm#jY^4A$a5|2^0LLHu8yfd4{JFb*`?78EmJ(jfpXj|2~x zui^f`gZoob5~2Q!XIG#`R)PCLZ0g?t`2VG){!e55N6?PQe*ogwBK-BA0rr<0)4yy3 zAE<@0v;%=*MWRptz)J!MM*55I2B1Iw;yZyu_&@%WuLB6s;6MBd0RQPP!v5-nEISt9 zMqiC+zk>bofBmare*zl6fb*}8&J%(ChwWBNb%&IW^aaWVsh-98acSp^px zxE}tO-;@R`wT-oOT-NR(1KpL|!&7MS)9<|&!6N^@_aOvEgD>WJn|~oP|BD?Kj(^Bf_H&$LI~&`mTKWJq8(Zgi?ae8&PAZ-FT89ZSkyen ze>c|iSJ8~nZSrs@{BLke1PX2eObm}sA+11VN(fkl+oIi|`4Hv;5CM7^oGCy(;wVKu zTMz}YMz}cOKm^eRA{c%goWBT5snwK(v4tQ}cqYvjVL8*BHE{iu@-T)M9$hi!? z;UtbQ4X zM8v?8ry_f$#Uugt#$b>(06(mOL4WhLs{g;J691__{w)4)udvAS_&+gGu{Hny-*K(^ z|7-sLn*YD%|F8M~YySWL!LYx7D-uA!CkW2}azL6#sc3$&OYdj0&XMd{R8v0vBhVV6NGD_koZ5T7F}rYDI7irJ;KtK`0>962te(^ z@d1d|7_{S05q|jC21_U0@?YR!R;T$d1fUQ$q7X$FEaWz?7%d2v8xB9tPQ7cu%t;JfkR;){XMNz3%#kxOh zRot~wsSEB1O4V;>?#)erAogotzu#+ff4^Fi+?hFZ&Y3gk{O8OJgLF74|H2$b$TuhG z2t+d|TH<6nLO^I{GeT@U#R+n|k@{eop-Bft@3czjyCSloa8x*85CL3YVCA!MG=Bkw zgU5`czJmzalEI!X-Y79pkWPq6gz|;zr?LVvj23hjE@^zhZd^v_PU=dq>BDcSk5&>V zwJB)rp#dnE0EELcxS|+X$qp#7i9o(h=A1R$NleoXHLSlN9`w#tlKo==42c8sJH(Xje6?rEwaVvB9^HFROWs&Y`0pfk6Y& z2h?>9?%-fI-P}tLoj;^C%9=*cdd?f9f34RdGPHagS#W5$nSjZLe8OWdN76a0uuvnQ zDN3ybfgBLmZ{9clUxT#%CZHABt;S(i`?SPNJusru4}yx!SCa-`ILk28m6KoWhJGB) zWt(Wh+r#LNygxB)m+Y=fj>9It^jKn_z*!{bsu6A4xVXomW%=K^kyb%9o1F_%N zMicli{8S(R4eH~%|MgFKT==gG|8?QNF8tSp|GMzs|8M-4L0oCfw~4LXt`smA0PF++ zhPvYv|0VEr$DitBz$opjPR1AfR)q?|nNNA{395o5b+XD)heR~^q7Ra)ENxGl7qhJvmNmcT;f0j;JuNwKsub( z#^l~1CxF4!9X9w;xDi79phXBnp&Of;1auvE>y%HRUpfS9k;pFrF)xc30cup11}g># z{K=;GP}AU(4IVoXOFplR~t>>e?cK(p$+ms`?$`3{8Jtm{^!E~ejonF1nQ1(8XLR+ z1&~0dFEsead~hLvE(Fkp0R9CtKwUuKUjPWKbAhzo3d6eXme__2I?RbcKBILS0$s!U zvU3q1lUOL`VtYJGMd4{Gi1?7k1_xoF+@A6gl&R_FW4qon>t`3n$76CQi!GjO5k0kL5M6U zV0d+jo-{G2B~5f7o@NC^Bf9AuTy?etPmJl7Q(3*#S*dh|0%$hjAO4^@KC%{0x@PwS z;2U;dfbE{6LeZ#~tqAN8Oy~l0a6{c~%8Vh15S`|VN5dD9P)!h%bxLI&PXkd}$J=l+ zHXVzwcpU*zS_>dNE!)Ocjr}&|zD&y+8)mMtIB`~S5ordR&u$$D+FNH0fpYL>K?O`r z8VBQ6*G@aLq7EQ0%_AT}#GziS1_j_Iy_IsT=QrqvqiW!CLQeo2gonZw{OV0ntXT$~ z0ext|7lnP~*G;AWqu8LP`0%oMHDMu*d_rRtOw{NIEeVw>ouDWLzB|1F3J-!;HP@eO zn(oj$aSqEte@GV^JI&a3nDNU|3jWpC9~Z0#4U4m0G(8$LdK&=DzSW?!$WXDp#D@ij z2!vLx0K$py*X?t(4yK~3fY|~w8fi76AtX|n^(2LZB3246iDeLGxL!nOsQ2=tr#Axp zjj91cB!Q_^!x;$;Je1B(ZwY{Ng;Q}r3IiP|3=R~;tIWTSSjnP0uYDt!yTGB?*op&!1hH0q;}tuTAsf%Yy4aY;nf-;`7{g2{(0!ooSd_}B z)04Oo9eoJLp)y0K(vo-rbZ;>D1#(T$A%*#e`(~Icv88 zp+cjEJ>Vbe5`wGwPRu_Wydf6Z0yy>-cC`8gG!L#sm<`C+1I7{AG>2$Jr?-%3vBF;} z^H(GYPH zjgnw`G2@JXVe>D|DQtt>$GD-;cN(S-CXbAnF7q#>MZE44_EhvsI6mmCj@oVK)8pi)G7^O(5YdJ zhpA!2XjbcBW~kK+b1OmYXTeozK$ER7*A+LyltBt@REDq#j4Z)dW-=ShyugTJpxVLG zM1Ppghy#jEz&}X`vlf`&kaGmOMe!Z3Vnml*FLAH;uIYR*Tb#ZSQ~R}RBN=-h!;~*pf%YB%HRYv z0PA!DaN9^)FdZEmo2+S|9L}5(0Ym485i`2610_^L9+_d3h**m0QCOz|zL-u=6PyNu z@GJ+!18pHU>C8HI*?^&vKJ^obD;os%uq4s|#@nz{i=ixJW42AgP{52-5l29{h-UyL zgc-^tkjhAiC7`TN(x}h2Wn)5Mfo)Kij@s1JZwjv55JvPH1?tsnaIJ1Mfmtb>o)96v zqBE-XRyH3R7+o`IGQ-4bJ7*wsK^K8k4Fp2#Ag4j4@H#9sHNi|?$V;FcR!ErbNCyXw zIr@aUG_%T_4XJ+-B89yG2;$X&qZ+_M7z+y_zOfb2AP=oAplx_D4YL}-h){#Enrj1; z%z_Ad!G`5VPso^l5ElsXhu}ax)pAgk1j204QMUCR$T`pttr=bdq~X!(0aOTj@$ke0 zC~c?~V4fq57?}qBb(HmvBta`1JP^il1x!VODMyDEC+aXCLn|eCFDO%A1yjP;4>h78 zfQB<;#rBg;^DqZP!E?|Jn_}v91|7pjSR65gVsxB`=;UDrQlm@H=HbAS!ET}9NM-PF zjSg0w1_Z=|8}%8M^I$&&K!GSi53lwyAuE<%hdLfTib=>D&_2T=)NWP=kY1gh=qN1R zYBqu<=?rTyDkzf29u2@8o{>)K!LUZ_Q>0OYY#FaBDP!2+Rd4fzK2F*udQkhgDjh2H}#PMRO5=;Y9&=f9y7kt1K zF~Ybw)RZt0P%lUHiDU`Ma>?KrB_1P-ixSHfSfm(GCX9>|(@lX+iQQc7e}$PM1|N+OO#j`2kKHl3cweb?Pa@AT?y)qg0GG^ zpzD<0ztr<${I>x#^nYsO#rSVfpODbt`uG2Yg@n5B-#_E|FhM%F4dw+0RU1i6lpOqj z68z7tIrum3y+_M99R8P*D4}x9*~$r7V-m$@Yx)IOd}E2k-;l>lo8&X7m#?>QkT6RB z=@-3c_U=?zd;QsY?d;n{#a|Uq8ah;&^Glj=mQtANvts&^mXVQe*WGn}s`7$^za7}K zddyb;K0ZFTsw->DuWUQtPkZ!m?a>_%9toFGHEkbuyL_?RuIJX8w#~+RJ`+tEKK(hj zV9}L#<^zo`UCyL$LMRxr_{_(a$=fsxgoXv;1%_9RiNf!@=uUXK- z6v^ety{f&M?RE1|Hzy8G+Per_z4tqzo8j!1wFL#K2XcEfYu4=flhfbcfAC=TtXbdf z+2dXD?S$G#_wSoy*X~O@o)I#y|NWV}Q&V$PIbFJR2@Vc^`s=Sx9$xRzv155f#hMe> zf9y9Xd-;-p<>?W^$);gBF+1nzi~`daKCqFOBHj{->44xg74f$=uH;ZtU!aul`5E zh8&UVq19@wIQD6Eb+s%u)_3ZbZ@#%!Ue0@OYe4`0%j9GCduJ_Ju%NuW{QTIP>ue;hr9_pRLHw?d@{`KSUrnO4{`iwrTPiW|zZUe^dp8QH?PH%OG-g`QDl?^`_ zUXeR>=~DlJznY%a-l1fl6n;^t|0czc^NVH4UDKsNweRiig6wODhpx{{ILK|DbD`?e zl$Hr$<0KOI(xF%0;!FxWdhp=cV(Yp^i;~3ReLt>MR2*J>;>RENh68ewK8YVPLEjB7ZnwG-^>rz&b`{@l@S<*rId^huQ;y{OG-)_lKXk-{iDnKZ5Y0DNnTzjPtUcd zZ=USEQgo{Yr!?cplEO>RCw`Ef9m;9`5yy?w{Bru&t2W-vRH+^(jqsMm%p6l&smr>s zFvd@P*t?CfWvjlX%YzaVPtF#U^y>8N%AOgaUPm^m_jmG7>DZwIb*pUCoGyJX0!{%r zauP<27?`??6L{+GUDLXgDN1FC=6h~v+jlx`c%n}bXzmHuoM_Ya?SycTeX^%dsq+s=j&p&aE?F@0s34vA6Z?edg;wtnv{}FRSv4DD&Po zdKt#KHMjfG?99v?GuyqHl9FPks8+37E$kN6Vta=}(R!&HUqCL2c>3V{`Sz0gD;B&H z+w9h+1K~489%}#6v;P|T-1>9u(>(vSUah^(adypZIiSb%f3}(;_ww-Y@bW4q4&@aW z_vPdVs3z}D<=*eHN;#hTX|MablYPN}C@d_bDvr9BjHn&5|EE0bs zHD}+HOuw0d*D5Oqn9IMfy}ezw=7gW@jn17%Y%{;2)@Suk%}E)yKI_uXh(1Ni-0{R> z^HJ|j8@e@D$K`E{zWS|J_UO%d`i@(!ENfAAXia(bx6daOtsH)4M?uQxOT!Fbu3zun z*YbsQ&B%<5?~fhp-fwhazQJU=d++Lg|4xVU1J#=3i(7Pxi4&h)+&RwOCs=#5|Ja8a znVDbi`mriw*sQ369L4%XeCq4n`qxyQ9&!5Asp&Ijj2ky@_NOhY$K2bu91MlnmG>4B z$)=^RUwW036DavXs~zFq`k{AlI%ic^b*=Tpk(L`38Sy<&0Hqa)L~ULbjTuvOYW=X4 zD_7P&s_f$7QS;!~z!@`U0MW_v2ubeS72~RJgVJ$kvpF^vQ}cX$t{m-mXUkCD{<+>= z28`XZJ9VqH`J~u)5=i`KQDkJKUVm$Guy*vVvg4;t<>lx1%0G5|<*FfzjL|WJ{i-=t zqurWu%)gE~AZmM|J-489$E0JQ)h2(mxsd@#{kkJq)|=v#nifW}9++%fFNi8V4={*;bE zy|gt2!YQAOyS;5%tIlV`0y(>8y)h%aC^g61GiC;Pd07YFlc&N8ld0yMsl8TBzpWLf z^}K%lx~HdSL`1}^Q+#^&UMKrBqFuXoEnaP1Rz!9$eYMat zp+$EB7Pky64w&?4aAxM&Jid1iNtx02LeE$H%&j7SxqD^Lv}w}>J0Iq5*dXBOFO^KV zS~_RNiWT$c&ks&NT((IK3S}ylN+1Y=06}wM@oUSa)eld|Dz07gno}zIxTjbwUVBWo zCS+sf&9B-HH(cSa3E{Xse)|3VAEr-_&S^7uc2RKt@$&NbjvQFqEsQrcQ1wN|3}dQr zbV>y0y<&@>kI(MYr<3xC(z3$juXA&AOP<{5{qcd2iNDsAOsJg*hBN2xU8heMm6UW-`u@AJ=+f|E!+PJ1ATREysTsrJZeAUf zUFD?>;|@F+^f6JI&pp{p&65mW=_7sqmb*HqUHik_!gs&?cZ>ePv%j3vsYj1FlNXL? z`x!TqQ@CZz@ll-jwZhCzOStmk!%Gb3z8QCCXCE9-E!(I98us|{<58nVZRV+So<4p0 z+Us5OmoJ|HtN^gH(PHs7uPpRq43fkxl~7uwL<*Hqgea{@S`-yZA(fI(_B3(cFS=577;VgO4;>@GI0 z&!rcea!S;{lv}f-o%*-10qw%HD78fzC+GwmrM4Ju{>0 z`uE|&4Nr#qa>K#4=N1blm{#wD6)Seke0nuB81&cr^~q`d4XKM-f{gtF@&Y;@UolO> zF3@s#R$I%e!xZ&(#j0(2kNIB3lhe+h&pF@Qel4sRRetN1s*KF$uEz3WGOy@jmhyKm zDqLf^UnMi?SX)Qjf7Kj_Ef<(kvStm_3v^}R(aXDZRaI55_dQ+*b|_)(&1!9p?h0YU z-`eWx>aGLI00%e*C_Z}BS59DM+@giT!p>G!1*F!yfV=G2zMcJ*)PRoHE`i0_2fG^W z&w1Rxb8O2}xx^z(auL(rL}Trjw%FZ5?_rANaZ8rxaGBIXPoe&Le?NugMgxJs;mniQnH*M;NwrKZ7 zM*A`Rm3I$H199ot##ijPtwbX6b9Xnv%j+vxmtb;j{BZTlu&bVal;w0(mvz>Dv(J#&{rT}yH&h*wdu7y)=`}A( zrI#)}!Y%5!g0CV8+ zTGD3@OWU4N^M6tDFx_zH%=rp_&zDW>D+`h|I!wMsY}x?&Tqwlz60 zeOOw9RVUJm`%&#?9mjS5$S~9D?8pvmWIFnQ zCB86Dp15H{Wo4x_7V8l!1GX3Lp03LuoQg@?xm}e6zr26SJ7*55TI&m-#Q72>6L5Sm z-PfF(-AS}*e7t1&Q19pNmgQAN%`_H>*?|g|1LLIag#C_c2A!XbDq?0?NBM z85w@PXBW0|^SCG8teAdnxPNYh?e0@n-n{%q^c;2h!X3WXRjRDyAAFlG%FAid{cs7TZw}{v@*xfRNBgACp+V|T+KQw)83YJh3 zT%LV!)4ADddaL%It9$mfr}6?QwKKjbyT(x>LM?EExA*h#??ZPENW=**zm}ILzj(15 z*m8m!18&_*RE&vM*0*lL~e8YMl25flTXt3(?a?6=1 z+^O~40^HCDqeqj}N zgrx@M?E|nAEYjY*matN4cU08IH;JBe-^b{lFT6v3bLRW&1K~#dXP;C(-06?v?p}sM zm8fMTTcP&I?-vt2voKbEweJ4S+TWMCy}8$WY6+*vTKntCH=2io22xj;n;qt^RzKM4 zvD!4bGEKVbY<$rjl46C|^DDJA8OOE^f0N&OusCls<;b*!+M734CddFmz!D6|_JhXh z58pRj_yBef*()EnI+WO%ZRW9bQ9APG-nX6ysWJOsFRoPG-^rGO#_aGwaUJjbtg^l7c#K=Dkcx0vl4pa3V%!`Hjg5DqaJh4Z;Ql%jcGFn#Xqk?$YlscXB2siW?a8 zt#)|~mJqMR%KOKT%@uC8^EzZ^a|Ju6q$uH?p>UWrV6_{&UBzqLu6}tAX2<1ERhoR; zBJV`ke*CuwPh zRi~^s>M4F%e+#A1)>F29@$ko;M!R62ff<|A`L_eTz3Hlp1_azHFicE4saq6l?eZPFRk?aOKJ%2t+TSP}4C>nK^Y+28tu!C$YQBrjr)iPr zEG#G*`9YnHr%y*T4-scnOs~*M$Q1kLQ}4eFoAcq=u#%0*UF;+4cP1}@HsTAW8V-kJ zXJ=p7g_0;jcgH^Tx>r@j#l>aIe7J6pMrU_0dTuAP1YL=OO|Yk zo}OWTOhs^aS>vgD_lvkMioJ}Eesj`Tl?h#?xk0bksYHNj?ep;P&rv)$eoj7-mM)%D z)>59W^WFTeYq<@6Ra@Pluf)-YLTmNazIo-EE{0S6Jf}PQT}_6at*r+huWOh{#GXwp zEiILjk}51LT>gEKY-`IeA|@uL-+6PWJv$c&YJhQ{s(&)~SybX+yPZ(nA{nuA|81>d zvGQ)Gq^#zE+WAl3lb>^9g=v{YvEv%(Cuc>(^(+?kn~dFLK{En&G48T`!VLNZxc z_*j2`|FdV$UcYuP?6|X-S@KN9ty|C*2b3In!QDU!)7&zshU)#$?3`Vfq8-)`7XEDQ zug9Ho?RGn@8d|^q;}hp&12xCCh?d7Z5<1htvH77*c2{&vhqT4JkX8H2^rTw%?PKz+ zwspK{v2xXA-(>F2?VKkcKGeOjbLX17M;A(5FSjYLsNkBfP`*c1EhIfuYSp`(q9WS| zIvF)hTLwCB#R7%2Wg^8`E560_vfM9gzZu7=>}>XdIJK9Ofav0)7xU*9>9t}K|g z_Tc3QaonnYR|8#iB81(n&-hfSi#&VuC>y-t_6gV#bTKG?s7|EBZ2EgA9;+Gc5x%Om zwY5N1nz>M;w(29gH$E+GM|`}^%Jh?VmU8U6@kKfI058A6PY#NXVyJ36Kbhl!x`nm zM5pbW!PRRQcYOo;6fe)q86~xxN4Ot7derkgH1P$d-nLI|1sfk9pKtv+-4nWM)8hCu z9fT_cV&oK+Gk7bV_xs!1x3nEQ#{8f!;i&xyv$uVsvhOu6Go$1Ll%C{>y)>x{`_`J6 zmNwm}tmqzR8`|j6E?$Y%#>S=Fm$mOfMVkWsx1md*`(Q+7_dVG`;4#p`P`1R2LQ6Z%=vIYw)V_>({S9Lf;nix@Ql& zi%OD^P*ZhAlXUN=>g{dScA_Ub&$h~*V?jxn+pagC7p=2qU4w&##SESI9_8vTXNoDA zfX_3ZyR#+7<>QM|+w8*B)Y5mkSoY)oDapynvzHG($nn^=!VMMScm4kKqjnEh;LiwenERpr_&6jWgC4 zlWqc4_C!Fj_hO@qnRl*)emVKPbvdd;z;G40YyG!BSnNv9#=qk5>6wNq>F@LO73B`z z%o7n*ol@4{uM#l#GP7P(smt4Ffu#_wr@F!0OvJp02J|A~j zjL$Vqz@+W!7L)xS6BQ3OhaF;hu}n3NT(UMR%Ug|fVy=(bG*vC>`hpFQnV60wB>{;_ zU+wyaKo*qChv#~zZyJh5msq&n7Kq$s~KW zHMiLG;khx9n~lpTG3Wsk=YG7py1IR>bU(kJs20|{et*x!Q&WM<^qx~0hbANoW zV)m}3Tv#WRKsu0DlaswsUtTSrfifz4HM^xF`eHC=Sr(?QR_T7?0jKpobCoQT&vS{I z4usYn zbEHs{_sOzdk@B1R>a;2oe9PBLCz})7xY%Cq*paYxtAl^oBeo=cFE6jaK;_e}e5|Xm zmx8(u1#7UO)WWY#FIgS++Cg+BN=fcP+smD|t#I)qsan`SD$UGeiAFB`d~<(nT6$O z7IPK*aY13yhq~9DA(?@wd!~zK1Lcf=&Z|$u1Bz#DvmWlf@LVH)-#)`AGlAWqd#1Ay z)Y_!&y1oy7I`HYutQ1w*fUh6-zHkvfx<{@eDM{v#tm)H_L4p>?&i>t5Wcx{)m$GnaiJnuW^e%pzEWSmUi@*rvh-5#k7DIfpFYoZ-o1lj z_uP1=J#5`XZ-tBuVI%Y9Sr0e%b+q})t%~j5F`XP1rWi3l!sX1)&&=4A_!f)3 zG11Y2CEH8w?Mt`Kn9XmPX^2^cI!UQc(Q>*(P*sUPbb!+qYMVtJ^i@voOEy z+r$&yp>Uo@1a&%BRekLlqKZWthXEnmc}bP}>3SEtEZy2CNhs81Zm-%>>!8+)C07@r zv;4dZ9aMcI2OAoF-gTnF&G+F~tiF8Hl(lfz@@Z}133cUJt%F@sX|g$ufJzr;pFv zf4n1GknNNScu6jB%AGZ9R#X(*O!jV7f%D1hpqI}w+jY8T={DL*edx%&4g{B=D3ZjE zXhH2g`UNbp`{oSRu2ACcM(5=X35O{eB-n?AHQYUTYr$?-Hj%2cH+C2_20Q0t3VM1f z;+AWtdf#Bue;%~K%j-e-klo#d!Q~Y<`})2-!Nuz5=;-P;8Sh=X1HuUUB#0 zoG)*qQEaIR2?XTVsv6?P_gc&aCFCajtlu<=hZ|u1S?^sA%@kbT!=E z*qFKOs#bi$IX2z;t!6c!s?EQ?P1o$(WVF_3-MX^|2D83>E9B!deT6Pud-~Y1t|Y&% z%bi8Kv58tQ3>vG=cUl|yo0Yoe`B&BD9c2bBYTTTDM5evr392OY(v~avl{e>iaBO+n zG{-jl&S7PR{O`iw)wYw(*t~s|t`GNL+bu-i;O!vQst3(^l^=Hv1#&L&*x zx$6rieRPK7bxzb;m*dZ8MYEnif8Hf_p}}1)k9=a22G5*!hwAAlw%K1Uvs;=rF;%dY zY#Qjy)7HLJq%vQG@_nc|XZ<%T1A}c(F_j9w1o^f%30mFdb|0>X>t~Cj#M_+k@56c|QZBp1lF!r7s#$k+>>~1lJj0A*rlGhNE@kH4q%%;#=dlLW z_-twDwIlp%X|9`z zRNz$>6iRe43-}*O!~M`zHc=j@+=pM^_HAJ!NcyIqw@FwhpvWZW>>TFf^O4uw#PMoB z);v@nrL$OcFfDx`VnePNO0GgsNNAd1r&{srOTnzDJ9qB93Yw-W$bZr#g0-s4$I!17?8C%QM^J3A{&@}#Ir<>H;O z3+o*V-Bj5k)leqM0=xGPpVFEhc~BH{&#$e@a3@!%>={+I)FPD)_V!i;LJN?!=gB_q zYIfF_(%eL0-{|rzEuP6s!hFw;prF^Q&9|ndr5!(xZe7G3$MyiX<>XoW(A~MIE4Eo# zt;o+`opbqGQ{PsH@0KFWsISiogJ&;%*6hB&ZcXNqd zB4HSEJ6xb(=0ZV@%^M}pKQRh;Hj_oi$tmSyg_;JxCYSjIhqIp5DZT_kK#k?cq03#X zS@$+=+;N$+@x&FTj}I*TF8dj@zQ}V+_pFL7SbN$@cBs>D=dHN!AG34!I9^-tR%jWi z6uHr8|Lh2-xtluKSS8L?B_4>7C$&80_i-zUU;--73m@I!L4}x`J$+A{Id|q~OY%MJ z9Q?LT{7&V&rbSK6?W&pwi<#6={Kk*CI8l^)huKgMyp2LaYJ`W+3F+(?^NSRV_}ueH zz6sOC7pE8gv8v{Q>{>b2^|EZ!n!Y>_^>cLAlAS*@s4MRCYV6R!fO*P-miW!3rP{Bo)~s=~ zI>6^>6?whxTlc^$wSLtP|}0&zXCBvqczXi>EP1 zit*^l=~NoaHt~ZQm1WeRYjwb2GaGw%owt13`u*{@_KEStoK#o4_yKUZrXuag1Du+2 zHr1>^^ zl1W^Z38p|F>0XT!R@Oj$d|Gf2<&yW{@Zl11>x&>m~PzeYkQZD>n9( z(Sfx49_lhOgRk#o*q%|_f6zvx(&xc(?HHhuAC_lBJFZ$PbvpNz3U}UM=ohD@ zlBaj??%YuLh)=ppKucpV$&Zwkb)?Wi!OP-BWAUy6&s*;(mSJH@PO|U%R%IMW*|KSH z;Da!MkSDNvNyB=zio=%Qo_gNm$k>`~vR34yPxG}V7dexZW%frOZkg4-><(|xv3FSx zc=Q6n^p#;7KcA^*?Ns8{Yj{zLQ&+D%zPP4%A=9F;-kpIRd%Oy@`HdTH?_>GWIdCv8 z&emtzWmluf7hv1(t`J(@)++O*=TVBbqx$Br-lZP$D`OKqsu$%4c7*RD-A-$dUAtzr z*`qrL_<+tdbfFo$VA;j%Pcd$>N`gI&WKG*M^|E)d=t%VoVoN?R4yGXkH8JEIx!>TbN$v7r{>PdjFD+UhGjcUsvv*tT4F^FZfS5s^RU&p#Q~ z|F$~i?4=;B_6xq1De`VjhQdvJyy=Y`pTzp;$j>V(D}?Ne4t_G$)(Z$ z7oTlp^EY!256droLHf3MUBF94&nhpaBl{K`ZtZw6Z1yCUTp%=;;u70-XbW+%77 zQk$&;m;8m9nMzjcu(){`?O$RRdsInEK|w($T|`;=Y=)VQPeV{%R@O>ud**Y|PnjgY zy;>!8BJD{>hG~q@@+~glMa2M-_ivRjib&1$jN$)$;+{B`suJLjV=b{FsQ&59g)Ds{`Yq{edEs~hJDHCb6%`2_`z z+flnd80@Q>=OmyS`q{#sKQHjfJNcDC$D~?C8}z=t=+<&xsQvu8&bNa=(%RSh_+8D6 z>;3Jl0WY^%C1)L!&Di8Oj~!LC%^?2a9MzU$TkPJn64QqnPhO zO5AFAf%M+q&>394^G-%NZtrA^R8m%!YF(qDv^01RD*01MNr`7l$jbGsZz`;+)#pj2 z@h;KNaSWXuVITkH>xDGkP|3w@Z_KreL)&Ww)`UF_+k5<}k5i#{-JJsxr3Efe&Ca1) zZlMM(lVyWRXoND)k*%QBY z`gvaa{ERh~TwEHfMgnRW7g%xCT3-ZaPFGdIDpO8o9VQJ%H+VWGN|xgyxJ6m-D1;96 z?fU*{dGH;QbVb^UPo~B!d$^adx)=A&4nI6pA!Ido_YLK` zium#MYd9aDU6)bwuIu{uEv;cWwR-!cMT}k_FwalfOj_J_nA^0vn3ywTK!CUEY;uiF zc9&C;kM+*_83)rGtgYvAL(hwqpYpeLWM!)cy{~V%73Yb^vpe1(2;tvGx?~^J?k~fx zP#4F)*u{H2MNz`(_A=tR4_@=FLa$wNp6#zM?dH?-`VLTHpXcK_FE$0-U2C9T{q}7{ zZ0s%Pkk+8pXJZrDMa(wzGz!!%W{u>oz{EQw$R6AD`u6^d7q98PVM2YWH)K;*QL(kN zlm6Z(cjWcFdlZ?>Ra#r$yzz*+IY&U?vsanaq}!z|J5wFX6JnJ&MCfAkd^iAXfRj!V0YfBC5t2Y-Dc@MXu_T9^f0UXLtZ-K zWFLQvp^o$I%RGAN=HokJJoR18sVIIF8#}wh z6}7%Q5{5f=4ipzZeEjY(6H3Ir(Bb-EPh|t~vJB|Yuy6xe-s7iFzr8Vgxrv$Cmba-p zm(4$r-&niWi;(BjkZ_&Y^loTC_Ck>g6Dnf5j-~&J*Tt9hE~s(xwKLy-HJ!MvG`KAC zwBe%S)+$Y2{e%;Gp*NSm=lBr4H~pUR*&)iTfhHpqo?vZjo8xp;>s1mlbo$bH8~X&jaM5Bp~_`k%2r4X=e(daHm+b*$&2$ZuRgJxA$tAagzS((Z zxD`5l>1?>*c59E6)v0@liftMpdlqgKocCHpa)-UHgey(OwKwEw3hEHE-@Gu`n}3 zY^$%y@4;EltjcZH#)+}=1y6nC1ZsuS*10b-eCxsgn&PS#y~^0wc=hUM=LuFDHe~lm z*I(gWbx`U_`U(<x_pUZ~}iG@*ipp_^x@9lf4^4{-OO&S!z&dRm8v2I2&j zm&(YPX4GWPKeTnp+d1+JGEWyJ0@{w6Wz4K_SK!f865RcYe3eP_MFmgEtRO&>qN1WK z7)HuFOU*+mR{5FTUn@;=Y}9JwvTwRZ?tSQW53q>4cR|9?&rdx&9|ijfNW8~0*RwA| zp(_`UcG;|;C?Eg?2`rn7VN+qZ84@e*QUQI)#O z^3uMr_I{oJf}?h65_+3sm`Th{5}>`nvzk<;EO@`Mn7or~VV2ypyp`zz@p!y_ zPHwKBkB^U+m!ynL=aby#ivcZjlb48#--I7_+w{+9r`fq38jCjVo0h42UsR{CV%@rR z($dnLoSeM8yxT=(*gifq6h3(HAbZ!#*49GzJ9A`ZW%B};E?uhq^#u!V*CX#ju=-X< zC-n2RSI!Sz!&z+4c6_>Bm08~*P(fc`AAihE??TbYm3tOsp7DygX=!EE($Ue;+IsR@ zT@%)yiO4*Sn`p*dQmAB6e?f?4!FuDY&&5xN-3iahhymGc~nAAQ8Yn$*) z?QB1@_cu&0vkZUGkzN07K-l8O_Ze3$Lye9HYg(gFsAUv`wG=l5>IsE5@`a*zc;bn8 zI%J@snGM@j(PPyp})FmxK$J;^>dz{{*?n8yT4C=jgd?{eS1A{|`Pt zz5l^*?f>u8@eBMPRV5{bvG_kKic|PM|H?Ck|1*XEGll;@g#`4!f&@gJnl$X6Uj}rT z0sxu<0Ga{-`o9GKKN@Uy^qPe#7`<-)191S*lR@$4prZKy&6ok$@c@Ql*dYiaPvZY`T4j*eLpIo zB@$wihz}m=PdYOkDGQq4^r)CL?#PIDLm<-vBSL*fA%R)oM*H9Do2ceFR1v{Gcb4;usb26KNiV2K-}8RfagFRDyJgKPh>HEHGqv2vW)u#*v}J zp^OR!OWnxGcpne?uBJf`rApr`M%F50E;ugbIN4xH5&1S=HfnpuWTZ!pg(Jre1e zkOi{2KLt;cSH}9gdx&a-Rk#77))!101PhQMtOJbG1WJeDs3|n8CeSJx*?4zREQck8 z(g8L1PsMX!+)=?~^dNW!l4wFH1DyY;PY8w=9+@66ga#6y)DKOi2N?js-5`)52r&vz z@(F=Zp>Xs#19)N(0gM(jlg16sKwnj$uCZbUZ7_64Pb$DeJRl70(fB<;Z}ReUry^m& z@s-J=0xXX#0|@dPf!X$;&LAWwjPQj)u*2x_c#+jkpLz)A@Wq8d!veuHfjtWezl!02 z(4-)2E;IsRPsXC{AlNM;SXUr7DP;Vz;20i6AgWUkoFW`G`)J&(u>?_<2~q?VP!8gU z)F#mwAsO^PSjAKu6oO!84Sxp|Be-V%U{^uFwZOPRIubQ3GSHPM1i(-Tln{uyL*Qa? zXAy`5-#}kvokAc>2sd_zapM@dEY?of(u_tSj6XK|vys_KbJ}MJ=4kGlUjl@5O!`VU+paCxiq6rNsZNl&YqdV=VL?cPY zrFk@&Baz3U72`$l^zwlLu4u8N!Fu)tbAygc#Xu^ARp;gh86D_d09Q7dCLq(|r%gbT zjN1f%KS=B%0NxXV_QH{Tq5dQjD1kTx(r^;>8(3PJTmFIoYMOB=Kw^M1j4@aeP`8mO z(4LHg*b%)88M}-cghy-hxT^Bk94= z4nrMnJUP%8@C?Ax@HqD$MjYZyu0Z_5j)_H~sBMa{Pr$Af|J*XflQbX(EeX?%q0L9B z2^tGF2l9wegMda-ycol1PihL%LQ110|3ZB*Lzr|u&~p1r)j&&l(zOKRNW{NX3$)56 zT?;aG{z^6QTAFk{9ylOZ{H1!}MKI}l$asngyi}0cH&I2f2#?4IU=dN^N=I#gkn}df zNEt-XvFn6EC5D5F zZwR3by5mUh)TnB32&iC?8Da>CqyrT)q6E16;mJ~T(c>p!;L)_8?GuN92kMg~tzbz= zQ^26dEcG9(0;3+7w6Wab=UGU2pd|xlMGD0KEFlnaep(R6kF$hf_o9cN2meSi?#vjp zD48lf!AkKDaqcOk5GtN4)shG%6$y;QNJM*RHA{*jZ_(}qcUaB=tl8g>2mwik;3*?% z;WbH597u#?$3RjaNCHNXgh!^6jX$IwZp6C^ zPQtA0XPw4@aG@W&YNVrRtCPVVfy4@g7cYb55niU&qdJV92bT31VLwOp8y)!+lJ?M4 zmHN+EE+=QToQ%bC^47}9S}GZ|Z5w|e6~fB^2GykofTFRtF<(c8r~(P02>=T%cpNzd z0b?G=;zCmeA%N{bNEjT!lg6Tf(6{HH0ekN>vU$5i~M z|4sLgQDLpe#u=LO`uMMTebB;})6dhXrU9Uo(%y{<_5^ku$UZd6GD3Hdz)?LYupDEG zg+vTEYzT4uAW0Ow8_*<29YK#5(Hu5rAaPIt=i~79bHy%mB>}yN12GUm2cisw!Qp0z zMC#!$Xb}_u3JO=lc;*h%`Q2R1H~!+BztWF7kyo7~sD~7HDd6C>#suR_J^V z)|owE3n`?uQ{58a5=KnTh~ov+Z0yLK97732_&8+12f0w2d?DimLI~jUc!;?ok<4i( zBNA+{SSOFgswf#tOA~xrUNvamnch^U(a-7NGIQ?uyk`7yDBiek{pK;s*0h8>+AO##z=#HtFP4oQl_|G=rR*dI);@INA>&8!o~bD4_u@-yQL zgU$~dUsR`TFaPD|=k}j~zkm4$HHrA&3O~gEmRFXWvj6-W&y@XV%KkHD|CzG?Oxb^? z>_7i^>_0TS&Ki?n8Fi*E{``-bfYz9dwf|7v2N=JMwF1HJ>7%^U5zlXshXd$qIOsMH za)AYkoDF3oPtw~Tvit=2$Rc(h#72ohbBtUofLzw;HBfK#An*i821ZJM>T>g=@g~40 z6dsBZBajCUa+C-G8u~JVHZ8+4S%NkOPPh(kA#8MkQy_lt@OMWf0Vo@?D|is_KJGtB z16v(_m5AEYKTQTj0|z>75S1WTKfpL}FvX4-jK)0C|2e=7-#1sNRXl2*Gu^Pi$7A56lEcEO^YQj%3I^ zEBd6S8qMhTO)Oe}jL8V83o#pkoy8jVSQ~988sE}Ip9+(p3K`~6RKXT1@OiAI6Y1Bn zR5DPg4>C@Qz>#_Q*C<4+XMcr6*h_IzG%_xOzeXj^Q21BqG)40Mno{~o9EV0DA~Mk@ zHdj-fU+Ii)wE23JK^J_YnmVb`#V0ajGZNrIyUs{L2jhrHhHCd2Kb1MyoC1!thc+X8{K}2CkA1lI{}adb>y?8gqxo));EOq8>>$O z1d=4ACN{eU_@E)yKOWTwnzzXP*8cKVnBliHJ_veRGkJ~GkkHCYQ&X=?6VS> zpF93Sj|9cdUjl=ckXKNYK&k^hgeOrXY4ss5sXoHsB?s&Y43#`~ARul(fz22+_IDVJ z|L5(#0Sq2@>QhGF|B+{W`!AS*vcInm*vU^>c_RNm=ow@GRhCm$MWK~{9|;pb|Ks-G ziN~Mz_usGM&yT+fm;h7b|8G3M9)Ftk27LaDb^OBrS6)GR%=wRkoCcKQb25+a;xbsOaZ4P39sXko_n4CdC21 z{l8u+|HPS;25cMx znbr(<*kgpw;zvp*x%pEjQ8JY5mnBcQNB)g1k~$^~=C#qABefZm+arIz8GDQw4lFqk zxl}r;UnY7c$omVr$0YyD#813;Gj^jd*%J^Hik@f!V$hH&2)rhv!+u&EH5=J4kmLs0 z2%*)1r4lL$YWX>_lc1D@LDS2He8lN1>}OfQ2*NkrCpTb>6a1&>2*2#ye_HaIGRggC zpI^&=us6ov5&wQA|0yW^DF4YTPU-*u%JaL08k+n^n>Bw*{IkLZ;m4Q$US0a z_oFxmwNa9W7lDD#$mw#$59R;}0x-mXB)t@RixyfGaib6&y$R7FC_sXdg${`=qXjdD zbX3?wWDpo=qDcr0v`PKMKJm9@FAqQq!4C_a-7-)iiW8mGX6*6jH{;O_huzW8F5+Yf zv>S~736%<=J0fSv@bx4Jnh|t4hTeU@Ls*(v=KKx9rU%vH^9zZ_Ljyi-m;4*@)Rg@3 z|L5n|`#+sk{6qGCc{xRuANGGJ`PBaZFFe0{kE8AX46_Cn0o2BN6v%5RtB>(0fHG6D zx*)$huzR2>eh4!js;7Dyr!0QUHOf=DfNF#@IW>cNLIigeMZ~lFjSWu4BDCA)mlGKNK41TfdEa@ zU2!0EJM2Fg{6^&wUN0QlErwJYf!`K0p%u#|RxG z@S>x^fyb%&XBfetw7&om%mLR9h=Tqdp=kt+bnR1E(yQZoYt>7Rh$g{mJx--XKhDF81AQVXaZ{)6t#XJTM$0KE?7U|$ChxFh%> zj{(1+o_0ioUkcDKsI%Z-iqJ2(1yD*Q=oeff^h+6bfcx!?0b)sXKWB*F`Y_%s`R&!w znK+~vAins3XRy=M80s5XiJ>K>sxj>Bqs+myiznlFZ(~I{*kM~R`xx)Y&@ku~^aG2` z2rYyG&;?KGM}!LS75RgMo{J7XI^so%W>jjV0F_h+M|kYl!EYUZ&?f?kG>CSD4oI~S z9pS4~09+}kIH+_wwa9X1A4L=7aXSGy42r;Srwfc2V^Qd3)Sn~tI?~3CI&k1Gh;VlL zVAF{EQDtRkAMpm(8mXS4HAqPe$|jzqfsED<=(MA|3t`KQ9fo`u$$%bRDugHt&k}|d zaP8CrVE|n~qQ6M#KU*LIO*?*pFnaW#Ef8WM6BURsxIbAS%!MXsGJ**GCkuob+1LU{ zC4=?6e}uzXAi6V|eiecS$^5(PqW8$ylNPF~?oRn}X)<_W`@qTJGZ6$O1dQ8+I3A;X z=IOQ?Pja9uZJ_`*DK0Jw{}=pAbN8lJ!I&O-2`7Xq6NLz!TymHyQ9ApZOcp9}qGQYy zBU1q+{O6{^3M8-x^;Qq{LIgvM4~{X(;JYx$oeNmF#QFGp;au@>91bu%U;{rD#{i#JeWJYe(LHFQrZeB=!%!s{^04k>0o!~b3 zA(%Xp1h}CDsnM1_q%a^gLmM5fE(}OUO~F9OVX>l6+pyR%CDIc(j_u@8eMs*$EEX=B zmV&V}0Z$n{I*elwCc!}~n#y0m`zd?ksOQ)AKdS%9-#7vM)%l;I!VmU8Wx1*IzklWV z-P;$<{x>pf{@e*5SeKnS?S$hIHg^WWO@$Axhj@$P2-rE51Mgv$@FAcGPe;e#>P7+ja}-cs|z*c)TA zj)Hp`_cb*$f{HOF_ZS?Q2|iFupy5>@rv}utzfpXCQ zD~2 zF9-ev%9@6}651C>cEgeIL@ykfsu70R^D!alxWAR$Y@TVhP&7BB@TZJ#zzD$mGR&0O5k41{+3-}js&&CMQT zx1=Q9*V=CIXhyel)6qH7QKLnlT3*m-7V-ba&i3^D5C2>7 z|9vFu4EO>=PYc1^&{4Qed{IE_PoAh(Y3WqW{~)bL@-m4&%mQFR{J&OfYnuO`v|vfF z;{SU{pFM02WdK?`%#0)U1FMg6T_B9)C42KMHBb0gQ?Jq|Ya}g8IOCAngXjjQPK-~D zA@12tm@qTr3K#cWVlZB6N?+**G?zu!V%_J7J={gmgvg}HeDC-{dP8K0ZnpDeQj zZMN*=))J+$<(PFHQ^P|D8|&FSGvJoVNdHRsZ4J_~ZV+t?ljB%KvvCX%_!(_#y9p#q`JVzrDHfWQG6x zNY(fsMjw&{{sjJ?v{w9oFKI6R%{}&tE(O0^8@KC!t<5Jh_}|%Tt>VAmOWJ#Q*zXL! zKkG8YGdp|r{J7U)cD>pBcB|8D9u5xkd*#_h97!i`HoK>Eh`-{F`oVcqUrmoC&Cj}` zVhuNT?Y6b2FL~cX3!1s}K9;d3+Q$jM_~v*QgD>K;|4O>t6%76x^1#7}+6*#6MW-hj zXCCN{3BMFRzM;6++~f_K zjUzGIw{P9}41CdWl(H$Lz`h-e_i+=Sn{DgCo{vG#v3MQz>8pLagFz>PxITc7ZHib8 zPo@+?;2Cqq7>qmKe>FI&KgC-1ni?j1cn4bBvi4kg#iYA$V`+@o9Rc_rH)CZkk|&x3?}2EHfsa65zx1wNBOtPxN6?CGZ&y18Wt#mbz} zpGc%c90mU5fxB#3v!Rx!9l@tr0$#E*S~vqH1`&^e8w0wHfa2WWhK*tkF4=CO3T?z) zwwMU6B(OL(`Bn#zx7!E)5U*(!O9L^r`DQhs40!*CkyjPg3@amliiP{nwO!dnp4 zB2aj-f!#jSnZ)Z$)k4k3!A8Fk=^ho!Xtth4rKY)58d+5zz=l+%)rwN|i}~9Oh`2E}686J*Vy33+s;o z3hzYJ{P$%PCX=@ylUtj1`+0K72KvoxpO>y%IsR0=o!1xD^=ZiGPZgl`qyxAU2DHcc zlyWpLU{TjJJs}n5nW;I+XcBr_8gF8IIOp!$slE=gFVvo+AHIR&llH-o%lBc8U4_mg z;mF8&hWB7R;u_s7@!14a7ZHR^=(5ZWnUj)(D=#S{Q6U?qg_Oj}n6sfAdNPcK!y8uD zXG&ZqFk{zPm;mWz)!`*6FkOS3gnA-DE7&kc{N8>2n%lNLOiS5zLJ&v_Mee^%CSdVrx@{*VgH7 zA%|2Sr~$x>XD(8m$D$BSS>d8v%XFizZLL&G1WiW))e`fe@VJF>@JrEG?8Ec^85C-c z%G6s2*zdJMaZnIK;jynm4v6#fVm{?Je%AS4I((GCqKB@tQg%%!=18c13Rt1c>`@WOgtvN zzkz_R1GE6t!(j~SGBBW?DJ}R@-4pwwd)(~|n667>lD26WS|J=te-cR_Bk7}79^!>u zmlEe4g;9|}&C}Yt0D;5;P=Xbbvje;ZSdPMLB*-M%9f{Z(v$fxTH=|YuI1u+nX$iglb5QW71cw!70KOHD*|7sat|F2*nr97TSH8u?6A7aH;swnrWi~NoQf^^u z<+AH}==uDZL+Qo~U8yECdV>^(|1Z!?7s(_WbcXjt5fO1c;bM$S;tD-#HfPw=a~A2T zcJ-7*?{GevJLlN`&0BW}d_i)~tr;<4Vlku8%b*Jkq(HViG5e<$AZF30?DYbFvoeFT zHTw%?c)C=zkz@rR9Wc5c4#8fr_UDcSRUzkmC-l%_1BB**R)l}?FeB2FMZAqOw?<8a zbwNZ-QkwLIHwNw8rLsQAJE)A~ZDH7MWI^*7ZZ1&inhQ8YD(E$Uog@FO(FKPf6hSj! z8KE#VxlBL~8)a!7bSF*SrZ?g}UOXoCf=*Gd_ zla9GsH!9JzrkU!KM$MdhOBRqR4U`W-uOp+=WJaI9;vQ&zcx8jJ2RdWny!&?&$$j_? zI5+~NV!&rpSjj8w(8Bx^Hi_Y<4Z(c)V{veQL92 zTWi-7(?jLM${MwEigQx3YEz(-Cnh-Ue>a1FmG2m3}%i0CC9@GpXN0iX*l28K*k?a%!s6&j6BkKupp$W0z-^zTf*#F&Y)K{v5+6+hWYXs_ zX($I5&bW+D&FYN!q_H=QU@b?D9T*ca`X7A8Bh;{uSpMDA4p&MCghQM zSy>~w3@FrDg}&fsT{@OQ^1grgyi=^C6GoA|lnHhUuN4lm&!PVkjX{_z0z?>^Zg7Fm zPUJhm&d_C{M6h029h5>dsWP=G_7yZ-WBpF=DHH7AuwN`S5DIVaPR$abD!x1non($d zB(q}_zX$vpoxGANS_P`u*fdn}c#0~rVWjqaoOe*+hNiFJSB_^5&)b{aC=%i(h9j+L z@-)24Dh2QWkemq*-> zK;LLV>BjPzm5<=<19tt;CEHupr%-<{6v+aiFkR~ z9F{d#;@MQ!U|qgzX|t4`k#G(oj_^zJ8L*?pBAJ?vOx)Gz05R#1mIl40jFAT_m(-=N zg!e3+{}$B^>sg+}A<%{|W79^daEGX-P&N944TWq#>p&;v@5v6AI!5q&SHg4$KsSca zgb7^cq!}|k%}JkVk=BnYUqEW53K}+(4wcq3G7`e0V5la~G<0uy`UI@1n&dx*X_f4% zMQb6MRVi}(hE^S(u-49Q>*?;+<0-ppYE?Dtd%J0Mfo1hmGpzni(p>v*zB<2i8w>2e z+pU@S4^N(~;=kQbTG@YB_TQEL_b;&jre+l~`I?87-FId8UD4 zmkhx9#DR5JO&(|jM)QW5;`5zkK1ZvOh(_EIOp$p)F=!&v`=W58HDu$SBF-*h!5KJ` z_M*+s$ZLnsPcGKYrYYQ)4U6<&5~?7bn6b*D$%0^J)IL$iO-xYF%tD=Ppa+Njnpv~g z^pd@1Oj8a7WlN}lI#b~&zUC3`Lc5C443Y0p^98Jp*&I^xW=P3$!_eYk$bc)=Bn*nS9NIsZ@958U3b&wB zWZlEfu*M3TBaMwhNzp>kU=9l1x42dATGg}(9t}0z>0hw#;8zAnr^={g73$n+V9BSA z_l?we(=Xb8=d{Vz3Rcq#;4SzZ+LsPYsDL+i0Pt7o#=2siM3@T)a(nj~R~jw3O>w)i zQGc%K%^A$X2K${Jd&&;Zdb2eftMS~L|MZYHt5EXQEhsV8!ms!hrxmGy zufK+0+bOa%@HJ9csao_5%)^PPw$neMtIx8!s&QTBtenb`x^wM06}Hd;lQ(;!W<*!h zyBW`A+e}9SlxRjfQezp>Cf|fxla%)^Wq=oRSj)`AO*Ia$(GR8?lkucHxk0l>_&xC@ zv(CtUrdXnqX~D>rYK!LlA#^U1LN%%W=jMq#eve6}oC|%A$fku8Pg(eAZJPGi7Hqc_ z5X$^&hzBDrOYkugk;Ydk60@ZXc5P<)q8+B=?RG8>A#=NJ`~$CN`~yf^P$T*X#@H+L z_ML}A5dk85B1#nZq_3Ru4NPN!n>EKe#w2P9HVFOfKoWbANX1p?nIlt32}mk4c$l-M zH#!&lnqFzad;1>g1>Bn(>2aiv@qL(qR`7o?S3nV~0GDUdRRsbiT$c?0^h_bETg<1EeCuN+gGgtnk6OB&^3A`hOnAV`!Ax zJOqtO{tE4Z+!A3x-FpF}3C3YgCK=jWMYNkd96!N2PQAKk!i``6(u3ZzbL4>VO5)KG zk&=K_A^}7N9hs5Q0&kE$F*gStFeC7Wb&|;Vc5l=Oy-y@l5VYvJ3JP9sJU9U$OdD|V z8ywW36acPMG3GrV@Lp&X>6pXPpk7CikSdDtNme0%U2Hr+WBIjI%-j&SO zu0?orSfo3WHUUiV&`u>Ej5sKDK$P+lhU(#ol*TZ!+ec|1=`9S5UL#Kc?e$K(XMm^9 z>De#UVj{IskeEpA6zQ=_Ei=h!hJnu_zXJX>qe=_kDlGb>7l#xqt$y0CUz{DB)CVsQ zPQSkRvVxhN+&qFLA1ViEwG$$sN`kr|lKcc`kfHGFS2)Y5hq>AX#CNMO$G#O;K^xns zaT*sdkc*QjRa%&%sGXGLO)gCE5GdCtQ^*{FGCRV_*NlmXIm5l6qeLJIXQm*KGaiq* zu1GhMq3i#<_bs=mk?-wk$@TVhck^Gn8+UTO{q0UQtkSY+uK%yN;JjlSi_U*MZdKg> zv^xKBFXJ$-kTuDg}z?!G;DtAiUW2j0qow{qaE9C#}S-XC$`rSspE zo248|>uzqlW36B3mIO0<^luU~2WHL)I4D zaw{T7!uoEKM8F9`F&;BMRG|l?;N76x%E2pjtO4E3jb10niozSv9VC1W)xJ1=Rrm0K z0`zqP3f2hbRp2L5-;kCYsRis8pm#aKQe0IUV!{awE=(dvr23a?x?&^)i4_@A?ZZdx zg1#ckN{8IAdNIZ=AOI=qskVX1p(p4fz{)l+gM=DO3pOt&>HPBI>{wesb0Fij)-u3L zya8ZCD8t+kwFZJF0u3p7hX3q z!wi0;CNctyha>8m84Gqe9`o43`_!=@kw}d3xC&OX2>O1Lq93tuP);C&#XK7WZR*?E zxq1g>b+^I*sKdkspZgy69SRs&LGZ)S0Oh{WH^ry-hZ}_s$q_;5rbk$aZc30!)m=G^cyz<)SOIRi z2OdEjW@c4*hEClHr7RZQ*U-wXwG_?8P?9Tf!gY0I6N5B25 zELcQfP)+87MwoG>LI*MBmH|)q@+!85__Qxf345IyaRv7*!%69@jN%H?qgJ4c^tC5_ zXWU%FB-Y#l^TO)iDF;F4VssMg<0vSBJ2fdoIy-tKa8l^>Cxu&V+~$**+u_o z@a@5Qm-Q~#*?IqU@34Ew?1Kw!wu zv-9r71?!(%y_2)!UKjFur=8^YP>?GM;-@1!??N(X(04VtQY-3zSjqoU_uu^<`6-Yox14)V zKlhw~Aj|~|bP3{lyAASn3Bm#g1qB8Kdw}lUL9_ne{{4eMFCKm#{yZ+sg$6ES9wFcx z7VPEX>kIp0y9@%u4}t^4+yVlJ26=mW@i4CdUw031(bWSC4JEBZeSulI`MP-faWHom zKNn9A^i}|9C5R0lBZr3#_VR$2V1F*)pBv9Rz#q=TEx?}_1io^>G=q4WR|k6sdvGw9 zAn#xZk^VseejGN0CwLEx-xcGv$!20;>tly91 z^Z6sD?|*zYA4W1CWb|elD3RIQ{zo$T{9TEB{(rG}S8xB-n2!E(AK$V6_O!Csum9Tv zmISS_|Na*~a{~Q6e`2?R`}ZerFZUqudouiQSR4HG9sXf8i`72O+uemX=2lT+-0k)M<}7V++94D?LA<(U-cFu^%sQ$W&!|9Y}j!#dk{wCgpX>w~bw!L@f-Z8sQ&k2E@ZJhSQK8F5`$4Q%5L*7CYFV6z<@ z9W4?U_MS27nL$~zJ{@xMi-k5TmMvSBl4lcpA-TomtcN$GG2_O4IdbLJrP>ywgu)FO z85x^54@l*KH;DtoTg*-QJU8p%m8)0hoaDEeAO7sO6`cxrEUSitdA!Gkg?Z0Zjb_!E zIw~|Y)X&e)*Z0D&KX>nE{Qkp-daSjF4mtJdb0>=T`Sa(jtgN8a=2J1lsrzKNXJ&o9 zv$9Lmvw52WieA2aSyYs`diC$TZXM#2QrfvJ96M%+gN;enLsq@4nLc}uKkS#xUmjfR z%C&0+PoAV~*x=s3KWK*4PpMQ!M;9l1#!IDAKA&&rajNiLle(;|9SI3PC;FexFU~tR zxLd-$ef#`WyLRpTwmtc)nxyjL@=wiualNh2fP*t!=X^M@YSoDGeZFM( zoE8*3!N`Dj*RfYb`)xic4rAYoM~!-rHfXb5%65x$2V-A5Pbwe(@zq^kH+xIV?c27= z?;oCUtBtIURm1KH=N>-9S*#YEA!{d$95SSrv-7LhuXDn8dw2eAXRhnQ(w9T;MI<>r zf6=z5@rC2qQtbQ(hRqtVWdHI|y|w z9$v~~+4Y=zZQG$;q5%tdX?E?DuQJxonPbFanKeIm;fPcwn=pR-ty{O6HfshJ=*^fu zNjb66(Ya;a6MP&U9G3f6GFix)56x^-(&QIXK5^^>_1Cggj2w_LSy`qLxo z^6`EVg<|vVX-=O>h$5m2ive{rSkc+ zXSG;I&z(D$oei4IzI!(@r!YM|{bNZ<6T|86->ZBL)*icdEvER<$+;~p%SBB-K8)&R zy14i5`^#7Jwv3!`_V>%z1BcxB{OVv&#l7*t_aDrwc$ZW$PxkD{_|I>T&uHM}n@Z-miNsh5x6B842^Ev&nGf&=6d*HxDJ}JA>)8l{rmEEx6bPQ~*$=TrmZ#p&Nx2m0Gm6T&?X4a}*yM~P$hwUAm z5N;9}YTr)X!KI6=m4CafDSX z<$={%55;R<-~AGwk?{+`UwZzR(9odqnadW$^KaB1)yjFyn^EJ(j|XJogLgzkgiKa+ z#-NlwQ)*Lwi$fgG9@Ts zMe&ZCcFq-zZ8tYxI?c*(YQuWT+qQA-?06|b_TXno2z!R>xN+k`LvMS=cQ7)TI&a>* z3l}b|U%&qO^U;2yi=*XJ9U_ov{_`rUX^Y;|C%9;Ax zZ@=x@y}NNo=Z0CJ{aUqZNhFdrYt~?fOP4JxeDY-LkeyTeC#P)Mlx4LgWOH<{JMBK& zo;sdiBKUcbT3xZF!O`2d$DLnlF@OI2=Ik!Ldfm8q(f`Y`q@=KsBkzIfhA01IaO~#o z^~V-&+h)CG{qtwJO@99Hg4Gj#(pThwC7k2F9w18ZMOjvNuJ^o`Yklix?{3Dv>={i{ zd0iH#vRFHI9SebTBOtG}b-R$g(Wd&W92`*KL1I<+KGp4XcwR%-lB$G&r z-@gas^V;K~>jE1#YBc)83cS^}?b~y5asqsOcJ15OqeuBp>$vFR^OrAg+Y~TvbY%Tm zvvTDfEoTbv)wjKG{WWaLn9hsEmld^Ql zlFnVbdU|+F!G;VQR{E(pA7C87{I{RSJ0~SAT(~x|{W^Tqs7D3ar`q-$xnya~s*s;N z`wLH=w46IPtb+s3$232A{gAdj3=S8caveO_@%^GPak&>P*H?7>c|w63v1y%!g~j!4 zBfexSCg#6*@ddO$b?Vd`H*TCb;ofRy$G#KG%03e_TpzxA)uCCl{8z6Qn7StTBrdx? zw!nAL$dRjjQciVyH|))rHzn66?33kh8(B0f{Pd?|(>^?YTrv0Trh^$Db`7~AX`KD@ zQGmN6h7S+fHr$BS&&8!yQcg#JJq;S+$mDG1vIeety1HL&g2WP8Jr~Q7!G9x%cYp)X#Ye#rA?Z1!dbe zZSpi(bm#Dd+c`OncYd7oVau%ZPU^BTGkPDK*J^!8)~0~LGiD@qvnX2m`Sp>np;vD0 zt+nxFrXp<5lvux;Kb_1kK6dQb-Me=icjz-2n+>Q>uU_vF%a$zqD&KeD|p%X=z|-dvrVA z-f@4}q(he{r%ivh8*4Swepn-3H}%~NwXf;!Lx)Ce4Iz59t23@4yY3#MFg_wDBuAaw z=IrZ)v({fTm5ReyYDY}a_GfVv29WBhFN>}PU|VRTe?JL zZ*Sz;e*AO3*7;~EYJbzxV0sGeW zk+Ms@8#ihkdtg$9Q~mnM={o}X?^~@6H0$6z{?p5wyB988c;yPOd-v`g;s=L>>>~>O zCjgl7fW#5sL49%b=QagEdUF24Id(rxk+e1_b$giN)2IBYEBLb)gx@_NvodaaIkkDJ+T5V!wXH*^jc(f8dfkoP zU0;{Q-P=I3*f zo%%k9KNqx)c_L}Y<;KjIu}UCt8aT7-qBoJ(KIIqhKYsjTYED?DaoW`=zDZj@Fpy5^ z^1Dj4+9UalFe7C8a4wJR=K(^?|-Q7)KSA% z7k=8$zcqf{hR32Y`{z#am!69)GN|q1=2mCfdHWGP_he>f9zHyBYe-weHxG{0spE9x z!GjY8+36PhFMTaob;V72Y_}BTnmm@z&w9uizTbFf1J~tsk6HBrvd6Gtw{G0<>fE%GiOEv#h|!Ue<6hp_ z`R2`=PoKslD(1(ZuT$s9iz1J!!y@WfS`G`n-C@b%7Ihv!w%ZySE4t+t5plbq;I8f9 zGaIKwnKqodcJAB({rjJK^CoKO(4ld0pMkyrD2mAD=5JjFyg#IV^FYvGsWXe!eQ@dW zFd*}G?n-!d&UCHiH=&oE-RHg)!DUaDnJ@4Bv#eYDcI_@-zFhuhR$q5d&q&qaP0t!f zK6~A<@7VX|rgLmpTpyX$KjGG?nXQ^{aEmYaRQz@u*V;76YTL>{vn3lgY&bOTBRA~u z@UZ1>vwXUCO*nPpSEn^=_6(ixV;bDPSK!owl2@-@bsxN~)zd;h$tI!A(4?{PUY&ar z8`+yLteW?bh)KSbUMKpYYxV=|ZM&RXw=%#6K6o%Rj5SYo!ap%>*O-#}R)Zq)e!u%{ z{KT>`bsxQGSTF15%>xGx3=Ly(>H=IkQgQF?Rj{*P$)yfr7OUa=62O2q&d;$0h@O+P z9X@C|ox?gXoV)n!rI$BXleFKuCj|QYFa8{NYWmU^xr@8rEjUd)be;c@)wle{RI$;# ztcMMUOiymgYP0v^u3a78k3CNu4J!|lZoDQ6Ui{$H{Qg<^sZ)=;bQ$sVQQl8eS$4w; z#0F8XN3QDq?C9#u%zd}h{S=Ev+h>l8?a-!Zl&$RojFrlJUQ{%{Kdasz1J22PvI9j$ zr&5c>y`$DXJ~l1J?w0{R3vC-^MMXxwc>46|g(JoW{ZfJe*4#~9+TUT(Sze35maFG@ zbsllR=JpM9^M;Ulm0zFq^ZJGrWuG6Mm|oj@h`+!8fVqu=71C?9EG$gsoOt_U`-(mL z8hLsqT}_q!-YlhQXs9mM^^&-o-hF6}} z?d^E`Q54oN%O@ox)q6 z+Z~qIs_o+V`Db_jy7frM&+pG>!H=MTaGSQ{RL3-<}a@}xqLBr4qN2ax^-*u`xgasRxC1_ zjE#!$T%Wh~vTxCPk`ligP~cs^?Cs()F0ZRgH4;NPS&!3D7Uddf5Vt+29b-TRBNK`oXQF}UNZ zmFGuYSo*bg!T3-3<2lVFw=NIfj4$%Ke7`Suk=fqc*HsxMPtLbqwCMNo-C3;3r^dUj z3!IGg%8Mxu8^Gdnm(-~rBEC}hB>(0br@q!JX0>nM_&`R7b%BQsje19ys!}$(0S1;d zF{7PmPs5o%@mm3<2r~}9C^j}&n2?YXEsku}xN$fB^3O+C+Sh86<+-=b$Rp+F((f;g z9BgIP(9X^f$dg~Pd-jb?IC)~s+V>UnOuslgI|n<>i*#{b*o3|4P{MQ737f`7jmn2+ zZ{4zG+)AUFOSfzpmfe^=Lnxa+S}NErnT-Pp!{3cPz44`Is>IWVd4>($dxS1;-2CT5 z?b;{QVFeCccYS!^!Qb6qKd(E#cbYT6z~o$2hfcm(L%KH~5dC#*e#r~N)0yoS`ySDzob3y(ojMLyU zuLbAQ-E<%snszR`Gh%$npqslyg}ZjGSrxZ**`g-X$Hx%9HKdUNm4xT2z>(p!s`zE@2O3+o@* zeb?&%?sd^eIq!1Dq$4AUasEK?IMp3+e9!o8zP_2gimZCr+CEB-U%v<6xK0gr-sp5$ z=%>`+yq>MY#$}gWPU*REWo)xKV-wywIi)Hx*IoB88ha^YvqUU@^ZxynIHRj}7n2GP zRZLuP@kpn7K(-R}N4 zOVvrXg2lSHI`!V+#0IQ>f@I9>>HZ!aY+B#HyvuVpVdV1s{IVDFJ7aS1T9_^_u2pM6 zba-A^<|n5|F3WvQ9hHy0MvqRLva0pYz5wxx zCw+~4TUs(Wyu8a|^V}C_M>jDv-FqZ1bIOJdb0c!LCHCemn18nK*FA4;?A+vQ>hUgN z#o_I*?nVw6a8OmMa#-aw;bXXp2arQFt5L!^VcPa1+%Ip>H?Q;c%al6a;sw9Fc>cVf zaYMF^onunM!OnQAkq2zr&absf@*wKL+b3&^i${(eY1h=q(%364t&~u%49vJ;Y8+*5 zzFKs?&k)YIc8#vz?_2(IsAA;E7d(r1_K{_Im&X^qJOfnZn>Y6cmn1E-{K(jt54{~FetPzE>TY?XkdW!mpSPbf<;?CJ zz+<*-*>b=9L;B2;vGW|8ak<>XK*DP?*SllKS(b;r_Nb!qoJ~omlFgB+_13l#2aWfp z&1=?ADt&qMXusfQ-EMEbdvMvt4N)9k;BHr-5te_=eVUa#v`ee5tgc-*0afYvaaX(f ztoYL-GWXxh&Yu0nwZPWbv`hEMI;JC|Hu6;}BO@cAcUX>Gd#f~T$7E&EEyc#TQRVio zCJ(od%wF!$)Bfm*69%P=u8M12diGv+dtd7}!M*1{6<<3*L>7J&$eSjS)}_IhdS_f7 z|N7qV73Hs|ANbs2-}txQFHd*0bQ}6GBO{|*_wM!`5(l1AEM@V!B@AD1u176{V-;mN z`=`|(T$WL~9x%yIW$)aVq-+n_{QAy;{MWDJ50};n-!^^Hr-${M&e?-!)m!2{9sl%l z=)H@HvDxW!SIGP7O_; zS@9{~ad+WQ9h!;lHm_ct4y2{*8$}a)_UxJL)6puJb?@H2^UEwNo^47hEuFVxho64| zk0&iuMtof`CeQFE(b8p#(7oq!%6`8z>J`?mWy`{%qOW-YeOq5m0K8KStz;^>XY*J(aE`E`b>Nm{`l*_#0%$Q_6$7pB<=O#?iFS4Om^O| z*|#kwWeD{$iLBQ#33fAZMvXXuEd4?}KG=wZz7Trj0vtoub$CxravH zx?vpqa`vbEj)M28=56|I4Y{8gw|nnib>2q5*=r0MPTt7^%aXQvb6#Ga-@$F;#p1Uo z=KQ+2YxkKmP5s8ScUrKZ$BGqA9Agg`JmNnZxz2Un{;?&ahYw%9sq3v5y;W1e+XoL? zj>vfY@Zrwr{Qh>%jZ`MfHY#?duyO){b+^J{0K2BzNE-8qa{rUNe7Y&SDLOk7bq(2>RI%m4ON$dTW^L&^1h*dn( z<~|#O5>5r%t?=Ek&(x|_54)8KwN5r$ERo9(t6#KOeD=;BNwcxLjob^)bHvVdTmo?% zmq^T)ogZ;P*=66}(cFE>cq?wVZf)A^DjR*?ZrHG4-MV$Vwl#Fw(xo%wR;`)aVlA)R z?%lh`jUCGu2$ord_89l|GN)G78-RoBU;F1RPv&}U4H+B~(xQ3u8@F$7AG&+yNq+V* zPrrII@dLvbln0({SMa;dqp1B|1}y#bhY;|GhD5&PMSBI+qLN& z;!=^XXyleUGiS~O+oo;XwtYW6s59ZCEj}aMC-2s+TbC|f%FBC~>)A0oZ9XfR2v^amkDJAuBLBZQGeM}ZTEi7!=y!qq8!iZa^EJ7}Hs^y!! zcW=qVtXXbuZpH=!Q?D#pvLtnBBle8i@u%~n_OD2^H*n$a9KvZ4zhFV5#*OpDcHCu~ zzosWAyKM~tu)VnW$(c;A>HgyBZfyiw zvb)KmLx&C}BqW@S2$@|rtnQm5GkYg05AjWD&uCd+`ERkaKN_U%0j#r+%43Mi4Tgov zRV>U~hDV672$39CVk0BsJpBh@o?-=|qAJjt2}LmyfygOJE>q&M=Ijd>_RWAUVs8(B z_ie7Drv4v!sB1p|$xpTMAB>>(zuL#Q<3H@|t!-@d<3D=#u&Rmw_-}mvLFfN!@_*Kx zA*?w=SaXK(hilx^rv|^9UA5-uV9n9Nnxlg?M+g7E%KfRErAU{o!49e?ZB%BuKb{3t zh$sWhGeqVBC78)T$&6e2c{|B`pjeb5N-f1IdJ#B91($&7b%hAnaEY_IgFm1MG6TuI_irQPxE%(29u$Qp|=vc^`K`b;C< zkjc-qB97jvWzEnkWs_5o=?m2;;n!$2C7Dn~+z2WIrW!B^%jEM(ay5JEe(!md|fVyr@4?wp+atP#>LOCf><6O3z_6wp9 zC?h4Ex>A9`X;KA>V0JTwUd=kazS*e#2(<7Jq4^TNRH9Ic1UMH%c&ojjO@9g1SU3nx zRVW-5h_3=YF}6ZYAA*8|W|mLlVlG&?T3!WCe;eiL)n;qv1J8ShQ8Y&+bCv^LhXhX_ zOYl_-{O{zLRFH|{z#ggctS;yPsp6#6WNFW}w$u^ggy9y{IcBh7QI~LB7Ssu0Y82$Y zM=Y(XJ+CX4lZ>=F(VRwtN<4$Y3PKd22E3!1WQEn$RI9$Enr=BYU!bFNATy#L(r!f) z4Iwt+LW2s-T@8>9+^ce}|IqL(^<;OldLpG2f4iC@S^dkx9##^>scMY`KxrjOBd9?m z9z;zW?0q>i4YtBIw7lK{FkaiUm z168m9Z9tO0tKgsTAUz>cW4?o2!rTH~cwSo4JV-B3A)TlgBC3og@H#WnkO^j5Tm4+x z@L0KizF%P#Sn*Ba8y(u#P4cTfOAcWVc!rW50f~O3`~_qcl_Xpetw!nC!7m5>0&}E5 z$VdhbL`}#TP%}Tao4_DP<1sjyB^V}jW{TRVj{s~m`NX2DTUCR^S2$gB%Zu%9M}| z4VenLSR|0Z=S3<3mqSw+f(=N0~?k zuS(=G^v0D+5SVZ^VJbq8K&_FDb_G+~=Fo~*rFZpUi0Qx(C}Skx*g6V^M$yzfSiN~z zgd{K-^(aF)06PG(SV*?vDv-DkgG(v75I_?adL?v#uF>!;E9p|uzKzO&!ot0pEE{0r zXbr$45bGfU0%#uvK!uWQBY-n9=~kJCo;Kj2H1xC)Pm`y3kW6=jYpQcVKq(;cf*LJ@ zAVD4p>lDk#q|22sktSkLWG7pO!U$6ep`}g*B$pIkRHdB)iYy{6Re)aLk}(QRs$!V= zhpbmkS+;%aPNv zYp_eC@UB3_*N&Q|WN`L0DZ>?r2#DzP;@XEOt0-mLVC1zX3n5dOzyZLLP^3vg+myf@ zbc98O!+KRIgc3M%KsN|>WnMuR_kf_HggYoULA6^u6=e~oyfs`d#6{GudRsl4U z5VR5nuTYO5J1)RlS^?p*No_G&jm81_85kpTh#W+>Es!!vK-rXrASLNC$pOjj$@&Ef zwjSH3-Lh3~0UZO#XaGkI{bj6#!w;_nYymTab}BByGIW7UGCvc>3W@EU{d5>HS<`{t zM<}IxAjy?nAfmIm!}8$_{0I|B6@-XH3)%rm&Ia6cKsU|IH6{j)x0_k8y}t-x2($*# zyF&B61`5HnMyf?FKBVJn2uO0_Gy(?@ZwQSKf)t~)G;FkHGpZmkU>orLa5x0?KHMM@ zAWI-SP#-?bOh&gAgyc)yff}Dmsiui72PN)@qzjs%)UYOw!jY~kj!OycbJRxDPFB;p zc4V-eM+_=<0|%vGR&lRp2}l!ewTnRBHX{=c!q-AMY9NS^f5B}Xt56C@jQGwnkzof6 z(;8K!hvonbxeSN!ph}->I;Dvbh4WfB5xPtdNZ%ky50AbM-5SvU!VqYI=qD!?3cUpj zsCEp4qo<3PvuY9Y9o_b*ws}0nq}cBZuTcBFcN?sA*eQ z8mq+r-GluZB#sgz^qzwIUm2sR^#Zn@sB-f@jOLNmSw<_&3caN;fz-mmRH||m0u>c` zl887c<(NjO9DzEma|c2dUN_NfaXtTorg5}CXci8(iK4OrS$FwDptP?e*g0rb`yX*l zGr*vI?;FnO>hN97^d0=D!$ga;;3u?jR4SjM-wIVoMW-dLe1YpbV4%xWEArxG(m#lY zl@-oPpw~!DY#mOk*8@^(2@ylPsbUzq(hjbXc7W`wqvTPWOUIL?rCbb2i>6nk6^3L0 z+WJF(iC@8%t7lm7?jPY;l|Z3w<_|J1g_dDKXP^kC4MqMiKI73|ew$;Fi=dDJExY9!VXH5jMueJaGCy47(VU)kSw8T5{OXH zOIjHUay_Rlv_U9ENZSDW0~+}l<{pN6p`Dfx|A8eXeZkdZ7IohYM&O}lzqh)iZyBTU zO7kAQ^N@o83P{y}R)PJHw;5~0y=adB1!=w zYHg4dTm1oWDHT#F9~VSc3orVC?_q(vhzQ5W)?mRu0}BX|3J1Xb4t>*k%8aj2NJY5( zJL~KM=r|gvP(io>A!i$RxO9> z5=JD0Qlf{Bb&IOttSfZtS@Eli)}e_iG#k>zpefaZ3Lb*gQrm&P@eEd6l!+u7hfG!G z6Slr+smqVFqBhNgn4%^7FRK}B5##x9Myvj9a;#eU4KY@&{3B8`WbuHL2ZEnKT;1f+O|wv-ph`ud96&ixvUPdHcP$)LRdYyKqm;DZK1L!_X!t$U zwKY-$Nw@je}_sg{cg{MA3+jlEE49Oa~SI5`#-2igLfx ztF|SochZAJ8;kY&#dHb|M@g8cNhs^GNb{$rY0V5t|0^UqnAVuj(b6t55K*nA()t!s zMHFI9uoeW#*=SFJW(jF`0jZM{qG(gKS_UWq!*|MHGXgMl0T9nb&}}LN3NCH%UjCmHq1VC!}~Ynmh_lRyt^n5kkEfZ?wOuEomY*(cPYKXKDte zrKZpkr$HQg{BV|_cez?anUzS}H;clBTF<#TiCWc;0RQVFz@_21{wQ>NCApF2o37!G z^kaW#R>-vtqX3k!Oe&N}pyNtGR9Wzk>- zQ$Y{V|Bt%TBNQ$)C^h??+UJO3X(BHP26U?qN!FuMnht1c#l^erXO!7ShB`vQd&ej%!3{Skl(QjdI3`q8oO(uW10;-SG`6f-GR%W>j| z1_sZ+erI6lk-so73Pq|O7$x451uH1$5JL*BCaA4S`4&FQlyPZ2z(uN+{e@&~4@tq$ zQB(rsYl@yrU=RU$z(XQLWLa4$7M-IFj|imQ&(xU^0@*Pjvg$F3JCdOxJaqFrS*1Fw@n!P3Uy=tM|@%5I~4Ty`L(Jfgq5fr zkd~B+*zZ!hZ%?X9lPwwXU#-Dc$6%{#sFgD`HyFLaR}+Hon@1{p3t|71$M8Q+7D=Bm z>Bss1hcZ$jXH|#~e}*bz`tIxh1XZj-zyB8c0dxWaCTIe0#1H=#LGukc3%3p(*<7t{83(s?12akS zjbOXFyF$s^+ut8Z`|#)yJpH5-tq6wdEOZsbMU zg`^);qvL+iFu}@B0$Ei7)m2zH;ijOiod0p6NGVFXRFN_bGkVa_Lg}9&h5r^b0{TR> zT0&HbN#81g_lIiW8U5pn;2ANh;2EJZc#P9{s0yC7m8J}yE%?*M!OGUbzET-Hqra;T zo_--b>|a|6?|<`Cb^bRsVfi=q0kgdIw70J&{~P+~<$ts5VQbIA?El6wRQvfK&;M5K z`s<{U`D=ZAr~adjwT=Gz_q2uUUz7juKmYmX<^OZ1BW`I$Ax5H#L)FbyWYKT>5T6W| zTbANv^0$9ml0PcPU)4$ejQ%}Y{`i_Cc>F(<+wae=@}EfHXY_xZ!7qUN>mQxB5B>3H z^7RQ+nBFkInW2m!u9|2P_mSO1VmvH1`65}ckcuxWD zDK#$>Vwh+K{J>zes8WQ(6hCrC<}nG3*arJ2OmljYzJd-7K@Np_BMmLEZ=8w{VMnV) zpnKAu1ZHWgoh2G;n3@jBbESt4=4tC(&6!OAQ^=I)s0IBa?=*g!zz3;`Fen#B5)JC) zCp?O(RAFX%@0yvLqqj-A1R(-XZegT#AEqT@yvj8HQ)94Di3pVm*#?Ys0iCLq7>ZM2 zLwBtcY?+R#G;t3K2*h|UuD%{vlt=;RNIgXNz<4+`6l_noAP*Owht4ZzXxBoRV(@?- z6co+ut;{*-vIvMSQs!lF)to(I1R5VM6hgF+yKmZYJ7%m689|s;AN3D~O0v>3> z3Cs<~{1YY|vQa0K(cnfu0lLVA`CvHM1P^gsDdwZV!6M1DugTDL?r8FQKLH-D zhVlPZwg8V7!>-+-1(4YUxX}-#iqyV0fenQ|2?vY9ByubYmnaFaxL`i!7>XUP7O-Yy zunCvU7-ojxjA7pX!5%?8@QW8f0UBKnaq%7G5saC2?Lu_rVDP8;h!LPqE*vuajfRN8 zYz{V>klY8L0~kMt(?Ol!SJh)NA<+gSTO(I5T&a-J+XJmz6d0}w$lp>7T3b0J>OmBa zm4It}{~~7(r;p~XCZNy_$A>TgQU;PnKwoyH;eZR&cqqW3pj?<4 zQ5mNagO=EgNL`4En!gz*rw;? zFa8`e(|y+*A+$=Zlw+Fy%*+vnQkTg_snBM42kt5OpRqq^Mv7P;n5Aag5_oi3BqZmF z{a_jvBo~@g&0Wwv$XcppASSZ7Fd-l8eMH5C9Et=08Vz6%gF>|M1V};viVe6^HvpP*vbcz8M9smW-2V9*I?nkbuNGgFLM{)$M2wcgBwO|Aa zDI5&)L6IoShPSB*c?@hc0flI=Jtb&Y2%n4qEF4@@LAeB}G%(!;OdUnA%_MSxR4t@w z2g-n`-8N)LqA@T}r9>r-qsWA|PqrB#e8{^3TZk2lkhBATz?3Q?6ubfu2?5lccG&%| z`hG~~kB*U+bpP0D+&?zGF&k?KJ3H|2zvlj_@&5eFKGoX)nTqIN?BhH3e=9pXTYdXK z_@l=D|KIr3*#B$n|NpmDerh}cHJ*SPPe6?);D5jqP;HqW+ElDpriY@Y8ZUs3p`I@)J+94uTI(G&|2~qJ}&G{TSA?5?sM6AR0wANiuD;v0;_Im4C zX~a4Js=je6X5+S&HdQuGE{1l}2nGa9tjGUz-9j@Ej@dH$wgw&B!oKbF`u3B^!Ln=m z`EH}k-EVD8?SB16HPC|R@MGys0%zr;9Y459NxO1IEZ8+tDYVCdNs`U{k-`@y&QXA# zLE9NTs4vx!Pq?G0svP9`EHgsHNR{#9vI9ntoD{W)Y+XVC42cw(yS@o9-8Hbbg5a{H zz@ay5}B6O<(Fh@sj8x*=^_ z)|QBXOHxI~29o|bkkbQnLjX^YpkC3HaH(jF1f34oR&3C=RAoFr*&_1=s-zKW6)p<7 ze)`S2$C0IQq|!L#o+MozN@TO7F9SVNB-9@ZeV`ex5*?%udZH*PrOpugRUb^{d?Lz` zG`M}^+dsghN$#@$3%e#VYBDWPq)pR?vS~s#h*|e^ue_A!~ zFZb~s`=70~mA?J2M-SVY`rrSRPmTSr#{O4h|NEBxk5SjEF+hXMvrx*K?B?MpyIl4C10X~ zAIjT4$u$5oX;qPZ@7mgc+nQLI#6o6t9BOTTJkiCOT-P;fq9aWQ!CDVGI{lVU&aUO62M>q~!q@1O#J4 zNZSp;Fn6$HB`Ptq*`8eTjb7X_T-x}+(>3^gqfg8Xv=I#UGG#pUlL(XwxGI>70Om$z zQ%uTSr){Q%`CE;{7PWKInFogEL4jYJ^@2?rc&v1%LRw^gtiLLH32^hqdckUCI<4wj zp#PRx*yyc+&yTGEYJ@78inKD);5h*NZHJjLfvvj?48!jav`$qB1r6%0v2NRXB?vW} z9MvGyY;=f65RHOSG(HB+cC^tHRU5?RFv^gA8w>~$K;&Vd5QzOPzGeweLZD)|+$eFB zF0)`3zr~_};=si)?{F+mp++%C0MwNbfW0CYqq12-wmUADNEH}QErlg7QU5?r zjDz930+_{kD*c6N&yo3LnyIKsR=dL zMd)vnSvUu#pl@Yo;ta1LqYv0F%(U|V>mCxVDF*pRY^-(sBfT7KdOKLv_(y6!Kk%v6 z|HD+I{$d~B@&8!c+V;?o|F#CVYy3a|h0j0D|AT34GXE}r4(-sX(x3D1ap(LC(z(=x zaM!qUYFs%ruACZI&i|$>hmJU)6jR(SkEm6^yJ9y$8aXLQG zi!oe)3q>-C04c*TPEn*3NPrF&rB;HS51ltE4CfOHsahqH#*wvo2o)&C zqcht|%+r66g%rj(gRw>d;U^q0Mx}_9so>t_(%uPJjam{8-@=J1Ef_#cmy-!mXxWIc z6pF$natVrKCbwn)cnBj6wP;JxQ|7Y0RRl(91*EM&&j?gypAm93>WqHTG9rp*7@mP- zF=~dJ2ik@tr0pO|%?IybLIq^|2%3M%lE{t}iJ~wG3SfzZ2R8(h}gfw0YncZ;U$$dGxPG!eHr}SZUWh4tgo0jg` zd^`%kD@rMWsdh8~f#3&IW5clEShOD{s8J!?_#nu8ERxn;A zTb6dxfw1TlK~UX7sDXJ!z?x4YA&1-&VB0{wAwtAKs|>dT;QG)Dz=tXVToW9v0$Y>n zgz4#om8J!f$_EcH}rt#<#gd0rk^ za6o_FV3!~d%sUth3_;CPXYK7$86-B#;CUv3Jjco?=H- zL=Ws0MXXp(1rf1hN5O`QiUkq=yZhctUP1s-&%68oe4jftuWXr_otd58{myVNZwDVA z%+s6h;_l_<;sEZsc-XlOwRiDw!fe5J9-bV`&Bfh?0}ADMVz5G@C>IAGSeUzmx1BTi zX=Cf+=E51lqC2{9JYboQp5B-Z=4Io}aj_ffX5)={4fXc&^l<>y+k;{~Ts$1TK`jpM z4jvr1u;u}7Vh+CG7v|$^)Pd9r9aMRWSG!4OG zp}Ih??A&Zz+*z2tjk}GL1NzDnl;TZ?ui?$ZhB-UHTd+PG@Sh#W#nS`!!_L!#;|+eY zKsUWPvQLM(_&BgI8*djMND)VGPj?m_(i42)i3$PVc{t#uKw4u8ECH{;-$Q*IWCddO z4mNI}EWjTR1^#_WfVv^^>3=;Y2?de_MW(4y!v^4ye6Qg2Pc)K-UbV-6Wf7!ruA`p# zueqUF&Hevo#y{h~KjNC}<>B-Ty)zsszqmNtdxO8H!2i`7gFoFyy<0=0bxn7%x8aPt zS(+3#%4gV}S1)tVwQ;tc@>d&d#?V1Cym+mHTkA1|r}&nooV%GroRV%jCC6DzwD#QW znY=LNs&8R>%GJ`Q+bo3Z^n3iSK1bJYk^6qyZo4)Z>xSsXC#Q-K-JS={&(6FUT3MBt zmwT{etz=T@z@v9xPBGMMvSX)qzrnrl1tbk?ywh-p+8D0C#<3GwZKlkO>qTo}lAyMZ zqt}8?x3IL-Pg>M}=9njHm2C%f%PT4iHeR`W`SR2P(_EWO&Ul+v0$A3C{`R2vO z`eTBFH)dvLZrL(8jRU@v930htUh2nr+4nDBxia@uVCMxPPySfhqnJZ8)Evg)JS-_G zcp_~%yUDaMetv%L?(S}GIluqfXOPz0cki0f)*U`1;fJUr5`JYBbL-GVOWfva1mapHU8a_*TqzWnL^?Ag^-?~e{n^?n;gS6h;n zcEd8}meHsR8qL&v-qr1gck>1>$y7M$>I~F6XEqB4Xl%2{&)vY}2+a zV9={^1CsM%qoVRF`y{$rT3D=b)0uwUa9}4cx|S?ivTfV8($dmk<4%v}O`KTd;?iOD zsu_=uMpsR64=o83z7R3n9d?iKRl}B_j~n1G5*f_29kDxDBgy01QezseM~@!w-n}yk zh!TsRK6%oJcI@1_bGf;o$lTkvlk!S3GBVzmm$z1*@%F9MO>N!rt5;*n9-Nxj!JvxQ z`u+XLemYC~@435T4QH$W#It{1y5=?f`o|ZC%td!5_}slWzxqvb_56q@M<;xIePU({ zD=VvZ^qF}jKrUy@n)S!o;4WQOzkV%lJoR2tk%?KBbI(<4);xdlqW!#6gO{_L(#8k` zTQ_Yg{`jWEHT6e^BzJ2@pR98Gsnf$PL z|BChzl06sm^Fy9^$0k(=4p4vp{(Z7#ESte#Fqv})VShb(z1$$6qM~B#Q;xsCe{^*D zg(OR}2wOWB7ndPJ7Q3eI&d5mk{dc;i<_rvo)|A{3Fm8IZ4D8rA+b}uLKv%b;wzg)g zRss9QCWbJ)d`yl#TI;>V-9T3_@z$l?XKvhxDGunEF~u)K*x$lp`{+ZyCT2ag)HR#g z`ON_hAJA>bwr%=`hF+FUqGDsacY{~4_+ZzrU8NRDrvm$1TDF~g@*oQc&>$^oWTbkl zR-uL+#Ru19-w#{+^7f~M%*@{;fy>VS=I7@-KCB=By zHG@>|#Fb?`ZTQnqhro0@V`z0JU%zP|LCw(;@tetv~c3Eec* zrp=!}KPM+=!-fq{pN>uAxUTnV+_>?El$7X&Id7(J*x>PIaCh32g$whGLxv2RQna_E zW8Sns{`h0}o;|I)TWe;6@*6d3#OL$Zu3d|%FI&F6-WhwLmb(q8$v}f<$P7V%JvEd^}R(vQc0wWHL{MR2RSSKehTC^^y>w4~(F%OD!Pj@l*U%D)2 zweK%Zj=`r+8O)m((9MG5s#BD*VR)CmYDdaW+YTFM`F8QRxcnT04b|O$omgxq*}Ps~ zU;o(@`7wC^~p`@l(+l^-QDZSTK$(XDOUq8Bd~>ewc_ zCM~}|s}2s(Szfps?;IjBv$TymkTag(FxbFwVWQ(Mt!$pd$XU-PW0y1UkT zG;dwn2*0*><3bmIOfJkc8xW{S*G7VDJiA6q+odFp))bh543F^mHy|SJ^`VxURHNYkyP5Zn#ZfI`oy)U zHXcGtN=jPwI~?JyTj%HJ|JHtl*;nMr#3rK>)^Jo?%1 z^38pXHl4~61?-&~>we>xQ$=ORj~~B%`*y2t1EyeefcELv?`?VcukG3`O-#IT{rXnF zjD>?PS{|Rt{qUje_l&zo*jmo>KRzF2XrXuh+<1@mix@p_Z@&7QcFR$FP9IHA2dwR@ zccQE1fq=<}FHK3G@njFyahBQ0mK?q4+nLdBI(rTu9=*+1(oefdye7TrUP(zpXr6Cg zbbjZvFDG>vUm?v*ykd~P*tXHT(-gdoVUwB=8_3pxl1C~WY$X@AY^efy@H3r&|T zm71ApI5}>_)GaIv*`pq}>;7_IRFKwcce{hljJG$HMn^w-`0%gb-B-2@Yp$jicBGNb z#l=0G-o3mly0;{7*Yomgd)8V#+c#!?QQ4S4M*QcBV~@kyuXfMa)5AuK)z0C-J?n6K}C zNr}fqKr;^TI1;)=Ul{wbb20FqtUs}i-whBYuk%jZ5g_{Tp=jF5z&Q&;ZXc~)yK-=& zi7Wc4$Hv5rT{X=ysb`NKLHAG0w6L?)syuY}cIExqnKzuRIzN_fY0=^8wh`0Ew&`!Q z{`#KYFDv8j>@5MB#{ba%)(K8#;oUoRN=r+dn~>mC&|>8{UC)&K6DLk!>fXBTz`&|- z1$LoHbJrsui#x?U;%l?nF*9eb4hpgwGOPFESK(Jb6qOw~apFQ+UO<*s`jyB)Mi+O` zkRBPr+v4bGhm^m9Gks@_Vgs+StgP(9g$orY9+qT8++G#VjGk<1c`1ALYFpbCj)$90 z8#8K6$%g}hHz%y$_>ed5z`Us*f^)H@YK?8|?3ye;Z#LR|Z&p^;kt6=we7mT>x_7)u z6RYd@?wu^o&Cow^@pJL&%MSC}uXx2!pEmjPv)@w(PmbE&Jo^|J{&PmI?+jeBnYLU| zPN4Jc##6Wl4j%kiQU2`i#P_2e9AFDgNo}7^NApdsLsn~(Ae1?I6!Fn&i zSCeiD&21Jrj&Na zs#EXA`4#TmVGxwhcqm+ueV;YzfYz=Swkw(*Hyi+bkC7v9Ucc_#vrP{MV;Ot&*zoZ9 z=ht_=diCnVhjB@w1qtVyG&%aL)Zxm=&?W{3BmD}yEnU*S$-{@H+x%jAH|;`03yX_y zn+*GF)6_^E&1viA%^U3Kc>2|=$Ppt(#KnCC^97($c*ZyW=r#E5;pkWQf?6!IrqTKg zt5^{LeBPeDCC)vwY#X^x>}P8FabUGi<)h`y6+M5A(CezLed*Grs#miI+B-RgONVWK z(klGP%kBfmzh&yoHCcJhKie_!=IL1-+ikQN}EO6EF>Dte0T59g9W8CQ(%i8BJ>3zHSjO4!Ug8Q_ARoAD5 zY0S^QuQ_~1N*h||eHV7`?)G;4dC9SWDsRE2t3012_f9Wx%;ugx{jgWB(T^V#{4$MZ zIi$oTt;x#TUzp)8T0GV)D?YYc=h87ICJQlI8s}+g=>kVuv%PApQ~M(h zmX@AQD+}u%x$fcd=`p6i4R&2*(lR?TJp9??$B%Q4YN-uM^#-HncG@yWi^XR-?S~nx znd{th^g-jo>rAF5G+tHLCjYuYv%2!*y^}K<8x8mH@EAO=rH@E(wUNF)WA4e<&vvZb zyT7HAQ}UIxh(Ft=wy7vcrW>2Q+>mU~Z08k}axAi=mKvD1sx|I?o83R5wQDY zZe+*i&1WxOym)2auGWLX`=oEbnxFsfaXu&a<@Dy=^A^x(G_SPFcPG4g{^{iwbAkHh z$4&cN7Cwl?G_ze(Gt*p#dtIFLQ9PQ*OXinl?E5V=*>-(c^vccCuqh871a|M<-QKBF zQc{m&Sx$^0A)(j6e~oElM4p?xoIB4Ba!oxr%PZ_^wRTIVl4eJKYjn(T)X0&pDfwDW z#~j}iP|&fxCmCD$D{sf{c68QoS{@4Ldjb>ycLAit1A_+@bTiy?c5TMXnq9i>KRP&z{bj zRJp7C*1@qUIh!vA2k0gCH8V@yw8&>T9%Yekttgu3c-vf0HYNa)9)i3$q5TG&Jti|C5$lBbuRP zSohVd&X37i_PKHKgb&<@bKCN7UK+NAyV&{C-GS`Iy88;RNi)kIo$s`G@t+g=&}dUm zPq16>H3jQe5K|T~n8s!=ZPMH~>~hmnfj8D#4K!LgyKC202Q#~^_d24k(Lbs}n!3pj z7_j6?ncBR)nzMch>o%VJ1KU#Gz zOv#sa>*1C?yidEqQJ=>bl|NHIlcl{d z-?cPs@0IeY7n_1PtZUCU_DStxW8*t?puY;AHRxDee1VBcj|*!@hhLu8vgOq~chs#6 zHM7Co$|6xsYviCvco}Z!Gg-Uk{NDp_XU&ayAc#^|(_a4U#G}k+YW*rc^xJtu+W!2V z)2G`79A3Qm#hmn4z@@vsE2uC-bS-m6b*QW6(YaOaXU~Cq_w`Jn;_w<>6R8-szT3zV|_)gNjaL ztQMCz?O7LZX8_Mor)TA@(G$vt-q_76*}Z%1>bPag7q^}79J? zM&Yw}BQ{5t1 z0vyBp?0)IVzQ%hmzZdd&R@W-o`nTJ3{ru+ClG4&1cPD+?nw2$d{glRy zweQ9oNKes4G}?tVX?Kn!wV(|OO2Kp=AL!f7xYONByPft(G;E%pU;a#ZYh3O03x9w?BLK;G-4kZmeawS=sj=p52?1b4{!5a&Px5 zrqirkd$nsL4qP>Jpl@UK7Jgowx05$@4dGAaet7#N9ax2ojLH3cfcDF(%JdYzDD3&i zo$;gnEO$l~-EBedd+<)+E6Rt3RP|cI%zt)vY-@F$eMjT6rf%FgFEnp^Qh(0E1!o6--uvqMuFY;b z4sQ}y9@+8YcKG1Iholu!i`7;W--k#!U~uqew@f@2oWA2I`_t?5?V5c4G_{FK*uvkQ zJ$*VzOOtMFYMGpPs3*6h|3Tv}3mUEF-;2EW`qA35GJk)6(>59gTF&X|6%z3(ugvQ@ zT9HiV8s7N)+L%G0*JJ$BxBzIU%_ljHN-P61Ba`9~H8f30xzD~t?#eD-779$`yg-x*JzcAYx) zuRVFd#%$fX^={R>j9KO5=UcXAv)M<0hu3+YOZV=x4URbPl}2&%HYcA>VWLp$&F!NP zY3)m&-*%8d@ch`ZK|XEu3b))ow0zUXNEXLyk1d!HR(;NYoSibFSI6G8-n}=2snUrP zwx$bc31>!U9k`R5JLi*av5A{buRh^Tbo?VX1xlqF8X92UVc@^+W<|ixDdN(bqD^sQ zs?2N|_jmZ`uCOpSJ9hGp>yJKnu%(;Cxg7l&Q! zpLuD*%R7HoSG}BZ@MHV^6JEPKKhxd7Zp8h}%uKyLeayNg4LL1ZM&sxuj#_xGZzHwi z)s=Y%rZ*o}nOU&`7|9QnZ|s+*?(p66^47tkmoF2JR5S_MK4bES`_0?T-OJ5xw$x|WzCul;4S4|FP&s=Zl2=W-Oz`2=gyt;%MGfZY)-DIn7?zU zyGJpHBPbDveqK1PK>ZiqvgIPbedqEj|GYTn1*YAhLrH1r=K{}xovtJTTQYd?-MdEz zhFGupExeJ+|{)$819})BfEAe;a&D~O?~~~)Vy&6CcO!H_<2ZD&bgSqL;iY{{_;ql>dH5a zUDu8GZ;y%D=xIH-a8GF3t_$qn)H7pBM|yhZEz|eY)^>aA6A{-aOiNv-Rd=>k)P_Lz zVgH-gwPK&o`B2n7=xrLa^Pp|MceCR5?AsSzu*rSSS~blnyJ&zd>07oG6co50+CCvH z?DfgHzc1qt*l+I|qe9^HxS#f0* zF9$SttM4&xHphMgU{Z56wVu6u2en!6nkwYCUY1yX`D)9n*IMn%NO=2h;S)cPwsZTL zo5%NE-Cp~7R#^VDzntGsp*bxrj+yiE>9c1oG;DmG?DGV_oM9f)4RIOZ~3xiv*K2-o!5RH zM{m!bJ@Mnm2L=T#*Z1oi|M?QDQT8h^1~`|#;gNlD4-fw60csx>~IJ-gNH*|TGxU!Qt^ z%$8OyTAf(6Bd_gZK&l519%N=(=qy?J#~%+KJu+*qu_rP%r>Jbzs#RbXUaXTbEAI6} zm&ubSJ32a!8FOz=?>#!dJfWM_)5nh^#bSDk7DeKN&0ah_tv%D$=*r~zqu9OM z%#~a$b>sPOZ8B@tEFd;rx^x-%;a-!8?@hQfLtG1P-n@D7;>Ci3H~CK8b5s8cH8xON z*J#?hwD>P{J5l~L%VhlOG-j-p4Rux>Cwn7 zW#7K?``NSY?CiAEhNN9yx^!vUvX=CjjT6okMIKn0WTs{lxNA78eZsIBVpx~Yahv*Xrbph*9v9NA^qNhYn=)fxFz%A;zdw`*iY*wA)ad06Q-mj|8~XfoqDS-lJm zR*ncNhY;r0gPEu7+9742hcpY4DTl|$0`G(`A%Or8&aE$B3@rvkIt~N2 z8c(4I#3HOl8B`Qq;?ONTfew)!Wxf*}?hww9s3C?ZJVJHh1RymeVqG*u2-}JzR7Ehl zN{UH&L7`%92s<)5NMFnsu>-{hlYm+lM?uN~VL@~wFnK9Rh>B{1oMOTkl&6^_1h3o( zjg6MTyju{B0=n>M7zwy>uye5K(Bec3p*H40uwZE{#0!Qh5*=VE9q?u# zaTf&v^9|7;5jKVZLPbhg1df4(1%{4pfh z4<6^1As5JWxB-z<5%?kSP&!~Vt|x?ifjna(RLf8Y;h&-^fO992K%EQItMP;71=k?1 zQeR_X&;%mvg1*4Khb+iMNHw`D1`qb5L%xLPgm;-mr}P&%&D5^4=(vxG95WfZJi$yn zRUn2aA?EU-Z;ylh$LVp;o`gC8 z>_eEk2y`?S){J-?tkQ7G;v@)vnv9jmVBBpKg$cHWNCt>TGodbscOZGtz~7o;3 z1WMSp7C4dVAx>?IOLl59xfL!fX1M@7yg zBs&N&ge!>U#z`pbB%K*qkQ%t!M*&NwJftKfKMQ9b z?x#ZR3ItZ8D%K!#QV`q?>BAtFqRyh05_1p~XCtQ>Y|Moi&OylTN=ayzNRdQ>{9r&2 zGz=6(hzgS~Ywj0IsVc>wYI=;!BxQ>1i7QHqdkto>HKx!AejLqOkvfC=lmykm8`xW- zG(Vxs<|l;V!$ShW_4b5?1N~AbT4=V4$W3sPOoU_@Ih52u{C723a|v5pP@&FOr<9Nfo^{7KTskg*+avMxoUv z?$J?TOvoj}L4^N>6eI3+z^{RWf?9_Fbrjmi!srxYq3+{C8v&i5K!~v~k>HbYsSNg9 zW?#v%uArgWV*#0D=AE3)QAuv`#T17{VY)Dcz(&Id-C*PPi$UQ;n5nfpZZJvkcX>8x z9Q*?)8yJq%KsjP5!XFSM5J`Br%#&*{cyGW%3-nNzDVwUwmhoWvSPhtJ*G?cJ1140q z%ZiX`9}Q2)XP|3fu85Fm0mQ4q;c-aM1flAXxJPiRCdC2bQ6qwJ+QXd6a2?Vcc~lY$ zq9Um{nkQF-xK05of~d`sOg9Tuz3eq86?6^QZu#)#3V@UZ#}PFWsdY6}5e;v2tz^R= z>*664_?aIIPWAAAL6M3DvxU*4>m)2*hJ=`J0*y;XWF(QiAPDD%^aPRqR#p+&J$%4{ zqR>yW@|y77<(VMR4O_P!xO^1gvB*!9s}A`K&98ti>M$hQ@YDD`~_Tz3t^ zzaw6DRZ%o(u2f8VBm@N*a3osj2&9%uKDkb))Dq0y6rRBH;e7@{EmEUFjgK=ks78p5 zpt%nZ_fRY-DTBUX-HS!n&_GOK(lrtrC>KJcI3NqE zX>L_TlJQ*;6asRkMCcTsl*lJRP$IZ=B7RRDNb*uuN2_Z!=!Cvk2(rs{0!0s!ng9=K z;9((rW<$x`@im$omRq~(hEE%&yD6QQ7g4|NMj?0=dK>wVD3K7MyooR&wI1Z|K>q;- zMZZd~Q`DG(YNxyz!sQF15vm%Y%2m=4Weu;LkmzyUltix(q{P?EfLp{BO1Ol0X`m@b z2oNS10*W9p_w7KjKnC>S4ar>P9C&@@`Dyt$UsHiG!lyhfG28u)i9#>cw2RN|*7`|X73c;Nc1}p+2 zYCtAeWsRc;DZamZa1a;aWO{sfcN#Umbyjgv)Gb(NqvehD}gGP%C^%RT!6yeW|Jg zUz-JXT1b?Quj$C#PN1Da;o2=1$0S#57;FJ08VPqV0hI!W16M#aOio?0b@Ct(1@0Y| zB$cnBk@H5rFc|G#0RIfb*Wf8bA8!+NnOO)viw;6d8EDQ8D<_MBl@W@?0x}eCE5tA) zI0Ua5LWUyWA=gz^iO7J=0B~S-p zxaQTMh8cJf)+*jc3va}xDWH}33J}U6e4Zd!wmR(N;O1b*p=-z#DKWu^CD+y%YVr7T zphD5qIEa#bpzhWb4YYj(Ck3*-GA`3KYVHCf$0F$x)Lew(V$ni=R5U5wFl2xdOrl}K zlMrDAx&{;yVBo|e!ooIvQUIfyW(WWFSVJ z1s)=TAs^I&IMUz(!2~r)iA@s0yr^gx5k{L8Q8CKifQwMUIaLH}C$tGAM={DQ97o;M zf{$P{7meWxqEUteVx&mu8h{!Co;>IbKUataNyrAncVND3c~ff`0cfvTXipYI21l-c zjkR2bNdllJTDpK!0?<|Y0vX{jp@m`GT_Ji=qdc?&3}36oDPO0p2oed9%+_WuLV=JF zuhczrkk61{dPPhZ2^$mNY$k|~5aL6lzP2DT*4-BL$~U%!;Ff|1hl67i(OQZNLfQ60 zb@5cXH}GAG=sCz9$^AWB9^8h24^ZG{!x$dnMFEyc;}jO}x$+IGC?^9c))M)OvxL}? ziVB3A4aNaSo17QO;OSNSMT+XVp@C>W7Ch`p+!KkVqes{3LcofGt%-44BP%&eLAbfW z(C3X6$#tdNRY3c(@l`L}Hsa%yYzH2}6N%AkD$xlx`o=~8@%&Y-#ZWAx(!v5YMJfxG zg0uwkpb2ZCls`c>y1j-F#RLZ`FX^Cy_%$ej?^r_*b$RSiHb%gp%b21Z8`Nb42O>d) zA!B6s$i0X#WQ?|m$sWn$_{3udg-@s&CWdP+Sih>+@t17}#t$FJ3i_sKFfle&i6~SB zzzjnbS(_Tb1x{5@>I&M_)_xVy8iIqss*2+j)vU_-V9hW(tO~bE-(5*4EN}l8H3YQ- zKR`MB6!`BU@IY#zx1x{{g)cKyDw3?rc7d3(4O!q1d{;0`yH1>7z{LQb+`!OE0*ZE! zTRGtS_zT2Xkf4P}$X|5WlM-!`#XIP>_O{RkbMf#1t{v_UODJ0nSqcqBS1p?qqhz#q=Hv+rhNt^Hu zc5vQA>@hQjlx%?P(BXVRwmleasQ`Q?`wvQE8$${Rz*rKi+#;$XVgp5r@Rz^4W>Z{~ zRa9+gZx%(fHC(a%H-_0io~-;I$x}|(K>1)O8~gE8<;JpfFeZkWv9X1riG^8>bTAq} zla>Fdt0w*jkQ9UOTL(n>FgG)+1^)wGO86h9#wLa|%-K$xr_Oh^uz~ga6^tx9?C#-S|Jo#zscQ%K4v+P0WAd|NMwc|9f0?V0~@uJ!NwT z%F3|J-L>;{r+=Ty$esTT;%F58JCzGMfe!)7Nulplv_J$GAO!qC4>+;4BF`*L*9wcD2=3vnutJj--2f*);=|EQ%nE#qTE{?>FUm9M_oI(dfq)wvG~>Zb3>E=L z7JmZgviQzpxZT(etuW(j+`0_#mAx%nzDJM2lzj%90^@7)Pn~#DScMC?sS68Ld>1r} z=m7l6f_T}DAE+yTj|Y5d3Go(q-vT&)U^?i4R%}p&PJ&*B)5CBU76W~4cph4!i#}w- zLm9A8_yH3`UBqM^_X{5lN{&&y7X$BwgL^zcJB$wgB7c%j^s zvW9#SW`w=1yN|paUk7g=#WK)r@p}#)#bXZmY6n~~N2-Ami}_A9%Bmx}2<#OS7gDcmfox5#ommbr~Z> z(fIicBE*1j62LpM2qJ^2SPM~@jPY4!gsGQnDvk*1h-YP{xBi68Tb+{qt=RiWYK8ZK^$^3g;I^O zA75$2s2_`fF#!#Tkc5IFBH`W>WWU&+Kvr0&XcqQGj8R1fG(f{^6*Dlv$ja-bC~6dh zf8#;3U%Tj{G8rz!abJ0apP{mb+J-+G{|a(ly8`F~6u=h})s`2^7jj^57bh*V)?q{V zKx}-|o1A~TI7eiPky&$W5hZ|;h1>M+XVdV;$gG%rA>ex(vATK>B%A2JBY2%jHA{#q z#P)neQ-AzLf{hD;r^+cdj`Ec}5Ka}M+U*-^oGu=7t;5LS zeelEI`*usGRGbQPMWgq45tJ1plkQP5!|2@EU4=Gl@#{(s{R`|Ejuj|CHRkUTP3Z&xmO>t5=Ivdans^}>8Lz!`6 z;t(MCn{bqnK2%jaG>=L)7B@nOEy%P{Op~IIM>QVc^%{|$J^zy$vgVvO#HO5fEafO8Yr=_4i?o;PGpnQD3 z^L^$bDyBR5rU;-T;bDIuWz4^M+C!*h1&v%|&ZBY)LvRakuoXt^F2nDNd6dZ!$yPxC zzV%-|3y?pN645&Nq~<&bSqxRNK3T8eHoYGf<@yHiUo5G^M<)%V3NQUTMZzGN@Y7Aw zKo%xHd-KmIFI;pQrntD`&;Th~=m@OAAmW&rgQuf%jS6ua2Y6(dd>cIC28Dt8>viK` ztw=!8>0}stlLq2JH)46HhFG9>5`&_+{BA0fkgeMLGSt))|i(86bmg#TekdKR$7ePD%a?bxMPZfP#i?6DJmVgrI zB#q)tuFAVYu1XgA@%tD-{}a{B_JxOG8c;v?+v~?G##bD_q#4wI*J@F59=eNScpkiQ zQc?`QVggjJPo{^y5W-^BkfoF+7!|E6Y!Wp#zb{eX*1`v!Qdl(vhKo4}Gz=SLu@2FPDFyzPySy8G~?mbE`}=SjKnkWS54fWSDA zsUT`TMWHHrohqA#UWTc`9EoVBW&N)MNv&CHov-72%D?Pgv;hgU+CWc_j_HvI4+vzXUPuT(2F_92Byl#4>>`G_SyFDxxQ&S=@ILqtQ2+xqIx3t9f?J{xSb`fr5COS>sxbu61S%)m zz!&20>B?$zV}frG)B=@#;KO(ngmhy^MoYq|f}ktp#bOFK+?erXfSG6-hMH$b?sib< zG_j)$KfS~!AZN(d!i&;Wa%*C3ZG>06ES5?o6=sF$%6>CJH$r(*T-qGPqKKgqo)|*W z=^8UFYsR|eeJ0L4z#db(pzFp0RWMb3O9X9=$VYgnd?N8GUHO%XI7flFOL4Gk#cE_s zVkvZvDPs>j7RPpzg_W&v*&*%&D#-5R!h^P*%ftu&a}Zj5kijd~1`3L)!~~Tk@_5i={AHARr}^_zTbJ1O;9f z2q|4@B#|ZtiwH(S1cwoMPgf@Ye3Tjw0twm?TU{f9;hT2yd-9jzYLG7c0xk&|S%SX? zSW&+Qclz`pTP`2m@C&%Sq*OSxWx9OoNHoxseFBI9n97C#ngWSSs1T@rJFW!ZXhBet zx-5i`d;EbewGy~&2r8k}qO>%Pf9ZjsYhY_+x{RV3B(Z#GVsv3AXB$NV`Pz7+ zd#Yb|^Ym~c-%u#V&C}L`uA;SsAmFVfe$>`l)m7TMc-VN4P;Mh}x6W3o_|g`&vmOd7 zwAnTeSl=%oaBYoOlr>vVPd5h}k9wP6i(~qeZ6JQ}nFBE+%mOp~y2jYsa2%9G&b{Uh zAC8T?SHoxo6d9C3wp2vi{%Udb80zL${|MjKiLPlJKM)wEa`xl&PwbwYE)IciZGj`Fpj5>L-dKb&X^% zk+0B|9}_o7{{R+_e}jJ!#6^aII%&fQ6A@qMrxU5(oD)w)`YznAO4tex9|`x2g8?f8 z64&mYC~T!7J#uQRDYFLPGUG%fsH5c6Ku;A4i|n?pzKl>`?0lfNRk{!2W3DgYKT1aXEl6 z{|&*AP7@or@tI4*&hp*jTpeVXv!2Z3`NY6B=3;N|V$=rWv&I`((K z#3>%UgRx{g^6VVBrUCP^L%=phoohpEYDAd9!Wb}o&tU$9KO^AJFqGW;?}tBw)#%~_ zk2oy}W~9VGB+hXuY$aDbga-HOvoRZSC`ylk^)QkFGC_wPb%B~ZosA#qQrHe&+vy%s zoC5j6U^@YVQ6ig3v{Ln6cU9+lRP8@klw=2Cj4t!uKnk5 z?(ppIWZDrNQw^pa`S+7wCE35Cc$if~`5+YDWu-I0$^d+9)n{lybL6B|spcvCstqSj zschK~TpQrjcIOJYp**U0AXDeM4B5sFd+NIk6$i(uHX=wQr1pap3$hn@a(7%nYVDb< zB$>5QXf7UHAwelvihW^GNKosU&hJ-+T=3y|?cG~0{`l|u$NQHZ38Rwr%M@(`K>unK z_668|bwl?xWU$vnT#Z-6=~W(jUkukfk)ncr0GJ@|NBoz;1Qk8LFL5LOpF{rrW7bP9 zMPFjP2xLCehUqfDKcpa0g);uh-v|EpUm$%wU_y9*z79yJR^WpMAnMgEA`K^pDnCc1 zu>9*;CXwQZc1Wa=I`ttl4U=;-W&ZLd-aax0OQdWb3GOG6el4&cEV8avig^-CYN@CR z4MD+^NFh>yY!ytGiMN)bx|Ohi;Ppdr@$i-njSNPX3@xiEyak>Us>ZTzQTtl#y#J1@ z)~a5}9{n%{qY9Aj{{bCAw`@SS>=d*$3sVWW_e~`IHrE(A-QUqQrn<#{Bjz0872`Y4 zzfbY?tYoI*(r0bxx8aQB*=)hP}& zWt_QxZiwNu_@?MdgJA2Fy-T?jP~mU_GW}B^cK-p6d^?gHyr`NJJy(GCLIfhwb>Isu zxG7%Ikk_d*F2?k=8)&eYGo!KxF?W zSM(?F*mt<<*#G6u4d;dM1-x&rqwf7*hDN5QCN=i|ng2Zh{X?!EXvY@a)qb!Q)>GHj z#@8mm+0)&DN$-I#U17m|F&(}V;Nxv)g^`#5^d2z5qwJZRi>(#h*+lOV7|j<1%OBVd zb#b$|!UFk1dJp&=QXxR5z++IAonoB^;5Afw5P0gX@|hS^j4wc9;0L}t3+NN{9{PrO z3Iy6P(3Finz^g=i&|m^Dm{*c+=jra{;^yG##j(QlgJDgw)-o}Dw8sT#x-jwq=pWOd zr!J)?Kp^tyJZglEo12%7-C!Fh2Ole}PQV1Z&rn-?7jN(yH#j&_42IY^vKl~QCJX$a z6vm|ccnX!PI-L$%8-S~J3%Z6l0@D|VD3Xe<5fKh}t$Y&))Z`0cjd*97mKZjQt`RK4 zbP2ZFF~L9NY+%Y-hq}PTU`9_NkFEjV_J%x(L3QJ8hP|h>nF$$<>Dwvskxkd22f@=_ zwYDDKt*2P}|8M*91^S;I%NKrA9rfyeGiCj6ZeniqQ~&>ntKs^8)ZeE6M}gN+=|OPK zq^1oZo{Q1bf6NYy`e_G#+JXN!R~`Bv4Q2MY2*J13QIGyNGd3|*_W#Yz%zx_tA8`#B z2pEjP$ve=8Rt%sn8DQ!kBnsvWL#-G?Iga}M7z3^81Af!j$E?23h5a9UUjpA)RW&{; z@~3eD*;L%_WMHNl(lqHd&`t+BZDyv>jkdEnGltjXwS7#Im&r@oDZ_}%hlq-b_W7F6xP0KJg4-to?uy7Kf`YgriVK3Ee*Dk5%X{~2N!q5J7Lp%ylK1X%?z!ild(OG% zoZHaA8{9}Y3zRX)ygp`wRfUlAY|7U=dDuWuguHhKfhPpXm}02F_&S4;;D$h5wP2wA zv(|dET0v9N+PSJh3_YWgDJ8F=HN+^778yO&h7FLDQ}cxxjvZhc5f(I}jRgV5bP*m# zB8}`nz8MD_OVtE4S~bn&bDnh=XR=oS*}$`GN*yasnB{cuLMRSo0LSIZrBv9clT?JT zijI%7veiMbG+RS?En6_qZ*;tvCQP!Dy@@FRrRkuWQ_mX%c8Rt*h7bS;3BPW=nw->0 zMl}qOgv101Sr6rq1NKJ;DaxGHC>>1dG&<_U1LiO9!st$G6*hmBXqknsPkal0U-qdmE&${&#g#f%09ANCw66TXJ)T{xU(iAi|qZ+Iks0eKo)O^;U zlg%D!*<`wyQaK{luB94Co~<){-{`EfzL9s&U~9Aix1QMs7o4g#t64RVVU|c%pb^Y| zH7){GQR%~^C_!VKqVlK|BPMZU6!C#rp-A26qKom^w+VIR&xR%(*TmMTNiOdYnPqG?)l-B>6Th_I{1kqI??H2G)vXwPDgfgQ3yP)Pv8vXt=)7PDngeRPrgEoK*ywRMGL}h^i7Ro_jzq zXh{smCTaK=SbAi#kV#{?6MIwb#G;nRl7YcQcVBOOU^IbQ@aUhwDqz6cxCCjC4RbOmKZB)(PoxJ* zaX$qVAC8ligmsZ3Xj>G~>WP7^{ULJRdBpLItS7C}nA93Omv3l|#At&YBzylRP<$}_ z6h1z%t#^2EpdUxozY}La$cR8vG=k1b-Gc)I@oo&tx7V>eZQWJ24v!2DJBqWM0hlsb zaxdV11)%G2s|0C@L@_%QBC4J?U?QWp2XN66jYXp&V)n?2jP4wYC$@DBCq_nxdj~ed zp1i3y-q+)L?p4jKLhRK_RN<*CT~)+$&u+F14v!L#Zs>Eb8c1@)qXvEMRe`3?^r*m| zdk%!=-*ngD&;6h>A#*_G3t8{LXj6*^WbCs?Wb1-`rNNV0`pjU zRAA4&YW2r^dbjrTdQvU=+*~sDbr~P^#MjooKCj~V+~T)% zTS)MTh(w6g*H7tMDwGI0N|@0nCCW^U@dR?y`BxWVDZ2D@J|Ss(`jb;cy-u%{mu zoYfIHh-^NQqB;62t5Jt(@AwDmb`Zx0Sb1I@SMzE%Ni7<(y$X1E9oqo#vo&h1%* z0{@*e7_^ZxU`R0_2!&KTTg)W&w9(HHLn%iE%^+xCfQd?xu^C6| zA|`O50LPR2bMTRL#}zHj8?gaTLobX1Nlt<^z7{&OKgfi521Trc$q%zyx*kVdCmyg) zG4s6*81Ev`J`Wdjzsra!(0@`X;3JVqkvkqX!9%jn{4gJFyLG<#smECt^vp3Dd3&?JfPJ}80~ z?HF=;R{LP5n0FwD)$>M7F)!m~2o^47Tl6FZne{4-U$%_j3q?#2me;3cOyNdJaK*Da z4kkq3u7xULlGd{mjB}}3iak_6;0;D*;3z|Zx;lv)5yp;a6sz?j%|kKhjU2R9XiOf$ zX6ok5)0ky3-wNlz>@oqKQFj7Zc$RM`wrQu#k-3h;D_RBEMKMG0PlBRC+@+0a{b3le zoyv*+abR^cOSq@n#8a5Nbfb1O9`Z>Mu_zrLE!i{tJ9QuTW0ZZ{J=$Sc0Jw_VE(`F` zNW7Y&3WmE1Y7y?IDEYS&d9X|{@EokECb-*?bOA4zOp)JRQ&cel7}K&!e#RTyRu+1< zJa20R&A`4*(A@RT(giK!UBgwnWJ#U^-%%XMIg|6OgF?Co^~6W*6sQ(FYqOm9w%JRk zX-PA4z4Wq}83_#KKjvZjHyIP}rxFoE>zvhkfOh=%xTZ{u3^_0mnAyY^;5ISRIJ%F&qensODpXhm5d180}k5Ze>sd8=8uyfO`Q zsL?_V&0(U^H%1Omz{eS@Vo8*OCq62zZXZsgZUy6B^;*9NbTv1?IwEAE+#t9c#K@Hg4 z3#@f#??6wS3az4sh_@x3=$0qxF)YSe zqBeM4%o^GRnl|Z%x|U6XVbvSlPJy)3Ej+2`#OmC3ZM4PJ0H(6(?D8~mdlTYatnC<^ zJKnjYGyar!$a=&MV5RdV5GG9_zEw&}iJmK%GlSnPI&Wt2tw>7P7`#bN0=lqJn5@aJ z2?7AHC!bG6r5%P>lpq2DU3tCNHsCWY+M_E13t2MymTm~NU! zl0P}dUIOaq{~m);T!XPdY!sp^O)JAmS=~=LC?C!^sdrF14G>EV41)TGB9^Id+ZZU9 zI2m*t@(BUCYjuQ)t&dPgBbOb;69mS49(=CUV$fGS1rmgmoy0h9k!*89h-HE+%@BuY zA9W0#E?^=`Iz3~RV{^$MnEm8(YBr}8`=F~y&ry*d7t@fQGpq??H*nzr56P-j9#SaW=pMiekMd;dg>jQt|-)u?3x1g94wF-6;qvH z#5ko&WT%)pLBwUF1Zz;a23t|=hD@zM`}2@)T!JngBi}bm2)SWmXy>X4yb5NVY1e2V zMuc{g(Ay8$y~qnHKC|6w@nhC-mHq%T+0zMiJ8;Cd_vXG6sSWBPFC%)`eq_ z@!eZ!Z+tGOv`3G+`RKer2$=$OnGFfyphBCl?3-wV3dwLLMCudvM=*Y1-}<<@+M!S= zWKztqb-AOsV#nH03@>?4N*Lh5WTa{A3tKWDNLyhdF9k2^^@YWy8`)uDvp8#5#2WKm zN$lDw)1r@e2zdbkCFu1+ZU9VileK|R&_e8Ho)F_mXmMfnWe82i)k#EPR1VQzc9Z8Gn)+)ySxtkQ@l(Ym25Al8WzR)+ z{1Gw2QvrxI;IRYI1vZWsn1c4?r7{V|AGK5>YT`B5uXrx@V|rJo;h{jeYDnss>m8dj zya9@0NIFEY1P8Hy$Y7P#(tK!u?(_<=Qnhjta7{59wteLSyCJ-@lo`A#R&a-K;A0Y} z0)k`%ueyXFwarC@3ifAONzG1$Oo@V{mA&DIlk)LVMH_dVC3}RWi?@`~+pSf87G&~8 z#j(sab4|0d?0$=VMKwPYW(hW?HFhK?-Qa7nGiv6B8sp>aisrEydvl&N#FJ81be!Ti zfT7eO>%kV_d;xGd-c*OFR$#XS7zI?jX@18%e5p6v5ER2t!&N1npqQ}FOV}D-n70KA zdVp#(?4*(n5Fwz|ZPoyfv&cSi3x=~|ggM2vlVF$|4Ok)>JDFIff23`fMTAwP;*}}0 zI?2pJ5KaDbqwPqEiYE z>UT^}!xkA3!1o3GA**#XH37alh%u=bVV8&93a_I+&D8PhtI{hVx7!?OhBljOp)P@ z3O;ap3AZ^KwuTzzHcJv7l*w!Al$FM;a?(QpZQ3Vw4iN%-9+zezuVf9ybAnrGOgA2Xzp z!GXrXO`E)iV9Sj<=Wz%dWkHv>C1Is>xd}O#CpSIezyOB90he8-Tmw;V40r5}CAUVq zpzD-$<|^#^cm^<;mR=ITT#nYV9ZO7gWsU=WvaTpqPS|yeRiy-8yBrhk5RaG}h)qV7 zXM=7L+?C2hOyx3;+*J9~2haIqsAgtS#@$$s2rAp)C#U3oF89B`RZstUa$gV!~unH#m{#d6!IsE;76e?9Jb#sYFofhvpbbwyvTb<=`#E1o{G(5thZG353G>=4KcR3O#deoOhNvTdB zJxZdZuk;d%k7koskJ3HL6T((-sekkf06?}(z)>_j^mEK)l{ zM$PCTlm*R$nw65E$jjF=9)Y2Vr(Ze$CQ^G}r2w}}vU?7sjVBrVnN_dXQ zVuJ}K=hqGq(7G9fNr8M9bSkDYfq3hsbp83Lr8a-IMQ~@cQJBj6<6r!Ju)`Aqi`vQpV3|2=5OAec6yQG{KvD@UEDN=^ z0z&i?MZ|AgA)AaQO4=TJj2o-^4V~&*<%cZ}eQdx;c3NIWdg4)%8ntXC=@VN?dhpH5 z(C@al+z`s&^I!fW77`GnOs5d!TE$^6S`3wI#wkmMJ?N=?Ba-zo?3fkP)B}R2aQbz- z0KvkRZ)Zb!L|pZ$xh*Yhsm{yY*GB{ug~~{vUM#eP2x{kQ(UQ!IorpL%7(QZr%iy?~ z&8GYP|^T^svomMC%e8{aUjIY}^&uRe#zd0GR!C~3Bzv&rFMZNU;HnQ3VxJ`80= z7@Slby0Z>S8k(Kkk30U;H~v>oYNu2u{I^W}Z);0a)S3UObzMs>|KFl~?D4;Yc_j(N z;}HNnN+WYO7c~Qvw6p@`uj*ME5xg05MNQ5rBAC$_3kY7fbOM4!)GUB!kJ{Dq3Om8H zKTT>%F7JAlQZvgk3V5))_Y@N3lu%(5u&qw{C}4YW5d~a2@{4!}e-R=iy&`(h!%Ju! zc4+<%_teQ8e@b;G_B5Y|r>KdoT)7f=K3gDM<$%~9r}c>mHKk`=FHmgcvZxtn27O2A zmYGqqMVc3$+5;U?X4n}Dh34q&@8%ML2bdU{N_H3aQ%o3BNyLP+1z1~CxOgXF6X$MQ zWicoR@tG(rX3=DDzych-y{K-Dop)d=$Rh4nB*o$Y(c2|KjaS|iQ5S^K0cxNSX>6O$6;Y67FVA!|ug2_h3pg_jpP&>yS!0 zmeRFk@(Fsl)M0}G>460WK}%zJRHHC+3nxfUDM&XSIH2SN1F)UznoFvX;Sj7f;Hz^@ z;gT||RKBR{q)8=c&T}A^wXEdx%8UcGwn)+dRYuTYf|r^(?BvW&iO>}R^CmzH7!V)@ z3-1~MsdE(MN_BrOi~*G70Iv$tHazPf)H_(53rhWACp_kI>Bmjt-c(gPQw1@U{w*!* zfJ%Q<&e4;klHf|;mX=qfWeMEP+C#U3s7udADh|QK@JAY1u4L_T;uLXnXFfL9J2S*m z#4oa1QUoJZPmFBs?v9U)vAl2X|TT>9AV<)pp28=fo)xVy*-I7T?0LR z@ybzcujh;MkpK3(E{K?R*Hm0`TA*{^{Vl8`IeW zfjTC8QW6zKDSx3YF?m~N5F?}gqdWwIaUht2`V@=pUmIFY`@n!sxeS6~@20CzU|fus z$M$<@`$JvBUHx*Sq1E-2>=^T+zio7aWwCnK=;&~Q8H=T!onUyC8ve$aA>D8gFNc%q zS|KM)d{fjo`=K51?*PHcF;-sS8RQ&uUe-23T?aDI=)mT`iOxU6nE1u_Uy9cFrmn4h zqaGNsZ!NTA4Ai$h*wi;_f6zNXA0WdqpKa|OXy;;BwNbU&nvGP*JwvIGgf)P5vGCMQ z(>ze2%BHb$O0%h6rg&0Wcq?}#uJh5_5(QnHB(n3NSmp7vvb#J5+~cIOMDyZMwaI%` z7|FbrE9iN)?J>6uYPoe!3R_%kF07>wIEA7tq>Rpu$?c;av$BAcW+1_UTpZ%$CZLyS zt(yT`hS(frS0S09tSYCrpsF8J$=vdtmSsvVHJF~1BCAeH1vyv2McEO?BD10ndx6(TAeWZJ}{w-6*?AT%v>Ds__cMls0ra$YHlENvEqHW$>=m9T#|xU za};_o9U3IT-jWS8@Q7{Ubh_{b;~<^P2q22`Fd&>AB|~{cr!`IVm3b7x$1$ubsnR2G z55XqMuVx)tmNH&R$Oyy&R+QloNrFUF)IzgdJya5J!lZj}U}Th-KcNBq6AOiiSqY>K z{DrN@LP)CJBZ=Prp}yYkUN4EmGsB$>B^wbhOgA6vEqi*9nBgX#%PPpZ{=vCRIK`|m zgfqKz(C!8uJA_%2WXm_a=0}K|SZg*ZRF*hn!jiBlKH9w{F%aJ|8n&q*!Yy7j+$mdz zO?EyYQYB%ydL>MpO_kK}%1+r(ZZ^!#_mT&@{TPrN`t8(ouuRS+Gf7Oc%E_0QOi^j- zrAqUjF@RzCP}C7IPPco$CRoH~0fC8y*djD9wl7#~%$btOS`%fGF?kQJvV2BmM_8dS zVd27`X-F1Ur)`yEslEg*LzUsrnf1sPCbg6j7nQ?&C8Xu1EIVQj29|VsBgJdc}L` ztaneR{9vXrb?*qZZ7^Gm@so0Z1en8!*p6M7x$l_r^)G+$Q|H&ut6%TEf&sch+0o+sExo2^RP zGn$CTL+)};zRv-zWxgnRPH&xrWa()&nm6Q=T3CmeC3vLdnYqV|W&Jj(>SWt;TIQCl z*W|qNZ^^YSafMpb0&st`j}f}{9>d-)WgKFXv4w|$GrIMcMwrUNLEl?9AFU=CvxuKp+cN| za>wkmDOy<*r38y}OPOc|UC6C5rcd*{WeVaUrF_B|nbfr5ctm}`Xok2{F~>aiWL9r& zo_fe?rP4HvW}-M2jgeo7_KeLbx2dxQLZNW%=mFXP%5Dp@e9p{@bdRU5Td)gm9T+X`dS)XQ zy9QzUa$24~;$?`ewF!lM@I10bFBWpe0+~|sniWxG9eN_$!2?h0XqK8xXK^^|D(`VT zJA12-r_*P}R-b2T`pWWRS#{D`%I7y7EP^nHk!q;CGX95;FmhkK&gdz%gM|*#xJ4^& zOoWUD%q8gz+MF$8qM4D{d5V)Sg#z-S89elM3bI8Z$#yXo)G!MVFu&M0UuGyV881&T zU@Bad;AderWy047%+C7U+-=0g-Aos+Qv6L!Ixp(xY=BmJR!3DBc8Hagm|H2ZkT{0& zY7T|xdh<9?79NEgyOj-9Xi)CNs`8dGFuE-WtE&UsUuM^J+a>F zAwnw9#o<`J+IhGuPL0{dVD9itycZFA=`2X=w!n>iF!MivSo1myk$F9x|7i@-Uy+ z0CO7#4rQ`gJN8GhGY*8WnjbF1;9w};tDmPVcFj5M6=2Vo=rj_cqhCVlZ#~9f0rZ?dBFLyC#lUaHJ7v;b?XPG-qIP5>A%|E(-lG#~g ze0Amma3&9M3;jzfEiC3{2050dfn){PX2kEzF|zjD`6ldCF=1s8JXWe+KpG;ai7M8k zb~<~!62iwT2~ed<)+1J_QN$^FADWjph*y$cxr9xtgt5$RPB+yf&s54b3$x$)bDP2C zEX~63Yo-Sl<@k+LR(*qzTsH57pHe}@{=Bw3J!pd39 zm!_+PoXD8+1psV7lfO6nc93|~%dk(a$1XySmAcumfk8Ea)=a$&gH5~7u7{i~VTZZFZJ@DYP(@rzVgC)=7 zXK?kvza)B*v{^1Gx`GeHPYge>q7OK)6~PAHg?vlX=UzpvBDNzB`S=F~!X%SU-cU}C9Q=+ScN z;9dIW6ld^wW)sI(CGv>l>p5i*_a2s4?r__Xq^#liyj;F;tBil9a4h4MBOISsnjO4u zR;j^}InFyXIBUdB2<6+bPS@v_7ktrjVPnqR3f7-16E@acI*G8$WTmcs7VG1m|2s97 zT$KFZEiLfYk^j3b8f~rR|6YubBmZ~L#%{0d-$QCDuajYAOv~z18a?eC*2mO*K_|Ux zz6jcfmNAl(Ghx!BsS`RGP$!kKFgD@H8$PEj;gk|-mhk2_%o5(#7(J!2sR^@$w=}i4 zp1OEh!V6kPBnclE$-3(k+j|F^n?h2tX)T*VXIp!F`_iDW(`Ra0s*dRehx>bXNDTym zQSMKsS@v;T;jII`J8+WZ!aS$9?SV&{a?!t)8hqJhCP(TF(!Z7FCAVr=LV<5qa;b1- zImx|pD9g$kyn*(&z!>n&q(`=HR4XLq)bfs)MM82c-eN0=cM{18$(N;+#Fb*bquoj`@wfFBCsTR}Kh1Z{DM$&Cdi=Apla}L- z4%9`!_0&p|8X^F&TY5$54|oX`Vv(2Ih1ZUypAj1QZ8a^7?uMQ<8KHeqImg%r4^+z5 z?xmU$8jH*&eAyp;tj%iVg@$5tPYn(4oKZ-q9OsLw%~I}`9A zQud5z0FEQ@fQJ+SN=N#;`uchYMu|vA#h){-%)1bXz=SMYx`qjDXjj{w4)GKkh;NP$ zlK};N0%-mX^PSm4zcGR5$zcpz;O~axqg#gum^(1t?(l#b%I(6*?(f=>=m*~3wK<*u zrGE41mObVjQ+7Af3?A2p@)|iVk{W?9VVGv(TjFC?& zq1(%5wa}v}6T@n9CkCASrpWC{I*%NmI)YuL9muu5!qrLr}&qhYO`iHz) zax{XAWO!RwpWH^N>V1O)n+2RUl5z#>x~gvM-Hc(uaz_I@?N2~OiVyd8d%_*>?(Mh1 z$=A2^L`;rX{Y`y?U2<2$aa&_OgIhOZ)^e{QnNi9fLmKEB-f5pg*E5bX{@k;NF)gd) zXM!DdW*&YZVjUd;G=;ml(32<+07iXUWZQxSv>7@r7iU(0`lz%DrB>Kc8C{X~`0Bi- zPQmU)_hY($;Ih*ag-J{9w|Vd7^=Wf=v9=c2XIOqddfbPeSf~Ch?23AOzQa*zc5<3@ncax=8l^3R;npG7v`Gc zns#~#XPvmi3#bx3BI+cmWI`{9M?&C8TKhYmsB=2PT^;ud&Z1zihSq4t?$yu+i>KGd z`L)~i`DDnJ*oewmfT2ki1VY=i>OceL{tj!M?eGCPAC-_@>a0*;hf6dKC@*GM8Ov|A zj^_)te*kG?gL>MHGTlTOT>)eBM;EY06t0#8rX>H)u~LXa!^bF%rg9;uutwU|5RJXK zWw^^}CL(2N#o#N*3?qQ{(0`GkiptOJCf;zL^20x4SS+TlBOtO2T5_*rimW0okrz`J zvTEFmFPB$y>`A>S;6KL(6MaQaMPMcX#nw%m(AN6exO2umXU~yeQJO#7?6540GyyHW z2t`BFVMa}9i2mecF}qhJiQ`f`0_|%DVtopjHgq~6N29R}?OzGh?%^afE)>LNpO6LW&i<}*Sxg-e9((rfYOYf5=RFtEsGu zd&!EE5m{Lrx%6$NjkQA=2NxH zGFA^n^dN!ZoxsVFKvd#7-U&qA#4AUgEJ7yH>e8QIPEj5zD0z)zasYpZ=;ti%IDzOW zooz*m;Hkiz?y!a~jqISaO|@wnPAQUEh6WomH+ebdzA%rH^6Fr~wu)BU=-mzh!nAo^H64dA;4{xqI!Fq(%^YR;d1AwB=1OU|*V#r$$1F~bn9{MU zsTB{7Y$`L)7aFGKA%5$R2TRm=)(3-KLuZJzULqAE!&4&OXEItP@juMD7UQ&ek&$KJ0>1 zsz~RCi(nyAx>=?pPYbsD&`TtVszebh5yd*YylzYu@yYAPtzolD?Z!7eDb|$_M$YvjeMv(GibsB!SM?jO(d=TCZK%4W+bO_Uwc_ z@eBjo%(>-dev2$=e3xKru5+pLgS?El|8#%4N9-KyyPHl^ZCN$JLHQ zF_$Mz`zQv$t+i@oA_6ndlXz8_uZs^*8lRl13;I)phq)mwX3^Q!A$0!Xok?eVJW#Pi z)*XiR>272mGET7&vkiM7wH#KCMV`WZS5?<)JXx$mohC1i<}ikoo|I zSRwO$VsL;q#eZBuzDa!etnBKjzyMa#LM zSlXb1i)2N#jdP7T=FflT@HD<6Dw(Z(R6_4}DR!l@x4Sd=lukzFm*Wf2e$O5z|FgI4a;7-;0t>UEwwFjd zlduKgsU-7RFpUVJU%N}C`}D!?V#!M3wV609d(eUDb2-1{b#mC!JTuu@N0rG+QrU^) z@>%7wBaUQtGB6+FyEU zE}ZnkLeuv?opT8J^4?DceL79NAJ_4)mu+VjdBsZF<4Q*XE@BYia!WJjVK@SM1{6sv z&yND7n<@nrx+~V1zpRv2uB$42#o1bVqi0KcBfqpn?vzH3d`9lPNcN;i^GRMLcA$AB zFETa3IVLY+_2-bhXn}L;by#T-Ce5EtS>0xwq};*uV`c%7xUGBhm=fE1z4Lkt#t`Wk zP*jm)%!77|CMXYp6jU65&k41LX%2{Kk??|T*vLrMhOofkHu}2RTVaqk@-ITbc>DNG$``v-abg|0|~(g^9dsR3Qgg>HJ^KnC;7%|7%@Kw3h#CF+TSE zUqfutaif`67O-w54=f)3F$^f{kq0bH;;EvNPwC{WBJfy6pG#sei$rO1Fq#`|U1PMl zF?uTI25W6=Z;CEnZm=YcvuDY{%)D0GSZ-g#xXLnHEwgl6Lz_uZB8Uo8ZaHd|PrK!; zAX0BtlqPDPX|m>$4NIynT@lbBRgY5XBco)CN?MqyvF6ZbYW#-J+T28fCz@HVxv{u! zqR_Esn;XlXtBhY9+F=6%Z#HB1i9%~*==!0gI3C%NFT-OVy;1E+vji4->S!uR>G@D; zf7uStx9f$${Tct6#KKh+8qr5)tG9gNbXm%E3vZ}Rt>VKW(ERB8D*mcsNY7d=-4vPj2 zsja6)MKSBfP7!0t6*ztr?BP*P8{^=(+LFgx-Jn$$l{kYcY{(D+s)B>pnYa;eqU7=QZ$(R;lOO6A$XK?IrLp-%!KEO5H-|Z;;B5DQ!Y0xNVHHw#+)z zsR3)CN9C?qG)l8B*>@@o9jP;Nz<3Jd>>6fZ<%XI@lRY#?nGj7^1v5ySpQeYaC>L~+ zlT!3_3<01X@^x(M8#)V5;_BI0gf}NLS74qrP7S&!X1NuB9ZWDWfx$Jx?&-yGgfI|o zX!CGms1N=bJdhyR%^U|OMVg{8&XZE1APa{J zn=M&P+lt-?V6qYlS%oGxmV=a0izS!0#cX16ze9yIZ2m~FY$;1on>m);w7e&sBXrXv z&ekh-(@Ei;0+ZHZ53ZbL5M`Ndl}(S>S)I~BLz5X$SP|w}^w@kb=MmaFC(L;y6A%gM zSnf5-2W$wQO{h7|4#&hsXGBp*NCtk68Cuq<^9F@Wo`>4%9kWz5g1{ynT$m}S+%5)aV_TV#7gmT2p{ktifc@s2J3#U~VE5SeWgHj2E-ql}m&X z(qJRSZnLr?QMr6z?&L12q-f$OEGx2*aPUI;!FskJ3hZ49jHF`w2t`Td_#n1$W-0RvrNBBqrt;pSNDRU*Y+@8j zC&QUA?BMkY`$Iqn5R?>M8_tBFT*#3(z|DUAGapE9As*tXG|PN3u*@2Lp|ETPwKI1= zsmK>N-+Ts=Q_Jju6Nx+R{L>FO)A(VJqw|7_2dH>JWDjQH8wwXeNWBc9rL~tl*cYDc za!BA@z1V%D#=S+#O4O68#C}r^rj+-0r2*b`j_7VcJ==TvW*)Mt&Nj~5X&#XQVG{{Y zST7x3j^$!+oMrI0oiJqnOWmR9*-E`*J7+S0C16Y2Rgn4f2SeWNS$CIL*xW_{cp!+0 z(!81zK6A5aQ3U=75M>2iaR+qFDo}lin!)E4hQ27V*dP;YSq=D&eY!#&v($=3v?-MH z3xUQ-w(&Y`+!4P@!z}j|)%;A@3NXM1^49KRv2f0MYXX zdv%y?39`Y$t5*}dT1<7j&Q7Kig6hlXvdoUEPlm7?JiZ1 zooxHXRn9Zi)QhehJm1bdq{DbLi9|!_m}%$g$f%{Ho|0fzE=Y9VF`|CMvF#Dn8_(8yl>`xB@gMYM>ugfs1S9P&fN{ zQZM|Kju`boB3+$cXh&Q4)@(|rk>yjWJwDiJ;`eGe+Tk%bw3=gsD7ilzg5XW+*esb= zfp3fTUYW>HQQT%lVUT6TV80+pzhFoA+}ju$X1^3}I35x!-}~h*%B!>f@@kg4vn5~| zV)zttZ+3w5t9T(k?BdTpc**^j|4T8eS};v4mAqgC);W^M7wV?yVtX-s9{C> zcz^>`sc2@uI36~fuoPfth0{&y248D>-X$NEj@(RE8iy$fKGvxQ{Pc+K#05cZf{ttH znHv?*A_c?Bp@#$kD8jq?#A&S@XSk+QI%>P7U6NjH^NGjwikGZVFOz${G>Fq3{8NDE|h^;IDmRZ9F zfp2i545Vj>qg9|pprci2PT`JN)ow`x9&Jb>4`^4IV4hgVk_wvRLL#9 z{0;x*Ki0}4CWki9J6;l-aMMtw(UP=wC9#r=8Y)>jI!}_X=MbA$PQG@B<}HbMJK=R* z8C!FO-HGZ;GxY9|N8b6yf5BIf&8raoRX+Z!rM1}^|J4$W)#ASv<71EifNM@1YB;lYkMrirxrI{JMy-Raed|Ib&aTXc=s+3Y z3X|2WG_{#B1kJM_jLBkqwMUwn_n8Y{fKHQ&dIksL zu6|7#G`%xzwJjPP9^76@WxohEPQSB>VzULY*}}m*gV+RY2j&>g7Nw5Lc0XmSRr~Vu zUnej{yR<#-@HQUZcJj$)e4A+Fpy$w(Sq#lTSnTu{1 zO2#A>Fl+qT!{%hv%_o4)O_Ws*qVq%=(m=o!V(1wBQVF25v(128?&_G89I^0XL?tnG z)eNaCxtE&SYCk+4IusyXP-B=oQ>E zIA>>h%76d^tiNPV|36ZnGlsTEa#Ce40 zU5s-cCBypykCIn8d9I^%-XmFQ2*{k{A<9ZlWh_>+HCQcpM1-%@w9psx%_G{Pf?x|I z63)rlys?+UuGbeUDY7dbx&P*#Eezr1eH}$Z$2-e_bIl-eY zE$y63DWJo&smLZb%R*EW^x4}?@ZCaJ1nMDG1DtMqn4+s-GYTSC_LzN zKBtx~bU+n1xB=riUNZ?d*(( zN$u89lx#QWl-ar^avcG_}kloH^gh-C4B zlG3PHO}@c&7Cn?(4m<|G)RHK@EbIW!axql6ASziDr5A>H%kC19m+rx(7G~%dWyl?+ zOdqMTO88vk3%%XN?Pj+H4lxvCclj!k(z8Vi;R-BWr@2ak zxaJ!~E87)d3sW+xXj46OMX5C_&gw?MGwSx163*FwSg zN2tQh>}M?&Oo|0-PGFMzS~yrO9IO@&RtpDPGT~s7P18Fltl86(ymT-ahgVo7n-lDT z*&>BTZZu=5Sf9#e}(UTPuM_4>UdlL&N4kShaYuWfd>xv(48+#cH8q zwNSBYg^CFwY$-*HIbf3EsYQm>BEx1KGgVelz>exoYLm4-ha|eJLdD7sJEbP+tj~Ms zwYafb+?e+zJtoD~qQ*?uxN?5Ryj(S6$1D?zyV;6^$O?*<_O!3$@_2iInwV-T6+?zv zEQ=t+hAMD~7YxYHWapwHnPV*_Go0Y`)eR_zU_xgp5i?eeM zS6tj`Nu8aqe!K*%v>#It`;*_otQZqq-IIWqMYqvEw-)}TUU#%t6pqf z^PGe0nrqQ@wU71jiT`5}N7cCeZAH2Gzi3NS>pDmLU+cPPE&gv&K8%a8kUT!=EF6zs z$kx^vJ*Ba!2`^-8X~K9s+l6eE-udQ;*b||6OEbcbA!KwWM;&#=4a@vc#Lx;wdTi#+ zrw#iZ&W;EKyG|%v*h?LW*p#3WM;ekh8r2QC#e!`gA-l3aqZije|5+WR@^o6ChV@<0(cr{91l`Sf!Qw^hJ#3n7(yl|;^`dtN zxl;w+=?z($*eOj@YMfvd9OP_`!~T*^xCMWgVH7i5TxW#<9ThB42gF>6b#X!O>FXXG z+Bw|2dCREp>;c*?LeLb6Mw&}BU(*t*{wXQ{PgbXo zGV*_{r6uZ?|7-U@FUrR)|4*_DnPcXK%uVpMxjhE*|2nUH9JA5_#31>uQLk;eZ)n0$1Aq`33k#>Tp27(^MnxjT_q$d5edf85Y4SLmgkz1wH*Xlo2h@6 z4d13@Fa8n@QBz%sMwlb2)PN($1nx~d$Ap!GLz2clb1>MonNk}x(@qvnp6!^g@KCA& zue}`b!Aa~;ug``4c=P|v3~~aXpQ`jxhW~@G)8@?o6m4y(@&Cp6#CHr04v&sdiAy#! zQwn&-Q-AH_z5ey2c1qQje+BEm)hYkAwnl5~e=$CO>mMngw)~&@AD{J~8cQD1^^gD5 z*8d`WeAhovKyCd$^FQ9}Kc^doiM(o5hX<5h|1GZkudS^$`_H0${MNsqfEo{YW`Dfb zKXVnTmIP3K|9AR-v|&o<+WKFFkKg)d6i{3J&-72J_1|1222g(gcb@;WHMO9dAL<%S40h5=^m|Y5aHvsoz|;f$ z>~?VD86%xU@;1;3zk1}vQTT2)FbMqyMuxlXg(u}7NwPao$19tvtNf7KvuqF0z%4&u zCtmUsE(0e6fv(|B0yL6O76Zdw1AV<4J4s$ak2nAf{)tqwsIfa4$?o0$xHN0e{T5`_D=;P{;agNP2YZTM1|cmQOm}9;nOgO=)@3 zkRyyb02o@F%}}5&nR8&tyIkNLn5hIi;)X_(DOw93c90A(CV(dpNMc|ayv=7w!??3q z{JGXiKdYFBgJ5mc!=cr>aU|M?9u6&S?a>ww4~Ij&L>Khq&;KLSS~h|UXWo63%lGugfy<{wt|ZqD}6V**#a^alP3SZh{(0j!X}ke-fdS^hOb zdF5y)H7W-o{k}XabA~MJ9-9!ckM@f7~@5rc~8}b1Y z##6msVQ_qIhFEZVm-1w%yYXS5E=&0-Fi?5H+xTlrO-ntn-vS%YY_9n1`MCN2aJ;Lh zKVHo~%JF~X`F8%_(%e+@|5=oe?E8&g-oSbDN*;4hDh13eG^M35(l<%73Kn$c`41vC z(K0B?D%nCn1aBxHFV7HVO3~8HvmTQR&R8K-86~SssQC!lguaTHgeRq9o<>Y;rzZCX zCJTjJdt>AD^mK$#WsZ5hNA&!JAkIKw3+5P|&{gWJo&in@tr*F?mSb65m=8a)GXnv@ zA1Mt(FUE>AZi~iH0nd&UGP$$}@FoonB+?V#L<%ZARSGPRPg++}0IpRKN>LQi=Z>yYzS=u6J042J;HATQb<)OHOf?WlD=wwr69vqfBnXDnZK(G4;pMvy##q z*AikY+0`>B7fI>K#-bsWf+9V7vWPyeEaVLz;?`kn2}+&e1WPDoQW;FT2h$@+#gGe5 zdK9GoubNd<>``)2^BKmUY|U!>i7{iqtgsq6HBXaVW|L|JI%3GNp27415i`P}R;pO&_kn*DcCKC4I%^Cz!o@rtlOVFkjPS5stgpl>I?;vmcO zhC4${*|HA>R*iNN<}!-ksPh>8f|4eFF^`k+2R~aH?G#34(9e6BSj=+LGLLgTuVDo; zLRa+~gYQl7&@3=R>ZfVaY0x!r*Ro1r7HTePV+g6Fwh&-*`Np)KRML%59?8BDbQD`h zu*h9qSi7T7`_9IJUh=BcJT}0UD`^A)p@GR&c`>Zq8Vm5cfM^4;!xO{SvmCz|YHFyk zXj9PUgjS$AbAY5V*pJs>;7RtnP8uH#%?^$Lr_HI^6ij$vm1SM(Bn=e$6j_DLwNJ|y z_XljR$BLNRl{6HyA~HKQ1B9U^6KP%FTg2u9$Fb7zz*Huj@#AbKao_&hD(@8y}HtMuQBNW^MKV!V-bK(DFI$JO%-JN{jh*)PoRykMzzLY1 zD_G0YY^FKj1j{Pto*58DN{yH`%(#-h*`BQfy*sFYWgEEYA+Wt`7|DJ+ZuSk^Gn!#& z*@*^_PzyS{lE8Y1cO3xPQsIR(C|N@b2-q!~M1a{?;o)EtDAm|}h!&7+tv2HXwIhgs zK~@DFyc?LtL^5fbH`&fj#f`Q~ZJX}>AH^7>v6_1fZu09|Tm8>}qt5f+mNq>9X{{y@ zexGOg{_i*c>V5?Sfl=O_cOT{CzgVorY5!f5Gu)k`rj?=cOzlk3)pLbNuEh(u$9l&~`ZkEN>6P`k+2$zf|ERB&oW(bDo`cp3`q*+bz|QYoU4adn!gX?jh75un$Iu{?JN zXq%nEGcb>23V3z5UYw#i>S&{#!E@ln=}G!90-@CA8+gG+ZrDs^=nQt)`SWE4ei+jeMVU9Xf8rQ zq-YM|88f2;=s=ZXWCQH(E)Q6OBk{g?_b6elvDu@!4>)XiLsN&Kg}ax+f!1X4VhWwY}Mffi9|?{Ao8KD-fULy+1L@J(r5Kh z#YmDH!41+9iAMH=kWJI#(KKgNH5Hl9tBfx5nw?Iw2MbN+OOTo|QzO@e6a6~@Vs5Bs zmVKrN7{#%AuQD{xe{%?Le+t6zg7m(gKwX`tN2c={C|E&bua?W9v~PAv38bE`KJ!R{ zq9zoyazdJkH4`>aaenasL(R2npK5*l_J8WAP$dPRoc!MwbM61J)|&tSqI{~u^DIY} zSqK1v#OVIt%=iD+#^xAlinX^ix5r%m5!C^A3I!!Ry_$p5JR=6VzX(A%@w7`$tF@b)f9w zcVb`zQG9~}>WG?0w+8ku;NNQ}v=;E|mcFc>=sb!-qCU<}VAugSbKj)qYsnF@T2iw= zx3zMEg8<45_f5dH{m>L9n0C{&>I=gXy9uM;Da-xM(u(6;DyTXZg6v5|0yE|ShYt`s*G*_>B?HPv!(>g@ z#_pc@8q5+7{ZjzC=?!n}IDr}IEmtho983yp1A1oK2Rr4!oo(<;Qg4I6P}6w2ww4`k za2Rl`tR_7vQ1f~3a}8-^L6&JWOsNA87((opf`B~wC_9-L2Q&n?=XJmtcV5b?IXt7| zuBG;dDGK=M#(0xilOw%EO}yolS8Fz_;as}vP{j7+^_-LmoH@#hwtUuE)IOi}!4x!N zr>zSI9>U0bwf|67!gm;FCbu~We4;AmH0Vt8=- z2=EKo!mGFgv5PIKZ?__G+QK9rZej{%dLfH8jyG&*=<84K&8*gTWNtbpLlAc+h8Zwn zf|pWK;|-dV@ODgYdtn!4u32N6P}l?b8;Pvhon6DMD8eo#PNLZeJ3Gz08N;k*Bodsa ze2m{=u`3vfn75VCXCWxEhx($bN(%REC;@fNLZU$|hnq@uZEXC`2kIMNZQN6a$~(Xt zVd#x6A}2Iu;gm>lR}f&pULd~t;Ugi$dt+l*EyV7FGJjr;Z<7l4Kzfb{zAFv%s+RiR$K6eCRH z1KYynz`>9MgX(^~oDL%+%sV$(--vB!o4R=59iL%tU54Rg>9m-)&ZKm_Ih2YK>=_id z-tW@(z-tSKVw$C?*~N;6p9EtAXU*sHjU(s9wH<2K8K)n4fRik7XG76wd{PPvkw*cICo zBCofUFV01oqmA7S254rh0V)VN$sp^Q_OXHNS}!??!Ot*Rk87TN%K^24K9<_BXU`tM z33eBy#HAY%p!Y&OM-ro1o>;$=FtEf^Xr8ss-!$zZuoP@gXS^tO%4-o`!0sW3W+|PY5fH%%c%$@kaVD>`0=w8S_Mo~XdCPI(oLw5v%1b_U zq~024*c?aL1lelJY=E^T1Yu&6gei$8m_HuU4!mPibvcbdEF`de; z5tpLM;}g?sYM#u~Oya(h%!LfMBqjk|o60G5B(%;obTC5{}1cXO&fvr-I|To#54Z=AZ}& z95EXP+xZ3O6j?DFInx*XHWIdh@j0|S4h>|GG80%D6Y88wKEddbd$9bx7VPGdf|xzq zb9~IEs6eZ^UdoeUp=r_PgPE0-bZ%0C@u_(&N%pEU#xr=D!qleaF;)1E8N7Ta%qk*J z8^s<)+agb!m@#UNe0EJ?w&WaUE11NrYZlWBH-~huqpIFAV1pIzXf~wMX+(4~v`f#i zj*RE5I=xUlPL@~8R<`coG8?c3nv|~Yj&lhv58E$(eC@v?jb0VbfXn%Rv__kp_TN}7 z|NG*6s-w}{6OYW|6j&xR&y(O->jIqwSIr6JP|x7}K7Q+;XTPk92S~a6PfhDw{$I8G zUl!?8oz;W~Ml`H{Hf!G^G26CPk|v{~oUcIdx&%Q0WFHVO zF|kEjEvV@kkj@l?mNR{`$>}t^1$&U7hQkqd#_gGEMXJZ`#Bym{?^QpE!HnQ^0K&7| zg4r@#JB_s|6^G8G){_jvvZ%y@VIo(i_E)nXdK$4cyEm&(XM1?wu=@DGHg;BlzRc`k z1&Ir*9_rPz{6D4nfAeC*|HqnL@?Tq9E&u=Ge5%7J=E47)%?%({Va}53fLz-HDjQ&J z4|qm@{P@2}c36!*O7s8LSc_Z!Z?5J4UYw6l{P!$9z&7>9`+Cp^tR-sq32TXxhK6Fc zXsD^O(Gmr9f1ym61S?X~M><-F?$ClnMhI4RMl-iXX6#aUdt@Ghr+#O{AEaydUh$?hUoP+zL)aNX;1#|AR zTAJe4@^%Y07Fm@BT;vT{DTvfS7o0JP=X;p3OY9$2XNb@tsL1BBSrEoZ``}JcQqcEOXz6&&!VF(wGFB`Q3LBPWWD9Sl?G=&aF%SuBtgm4eFI}Wk zo*f0{C&Zjk*YUL#1}1rX+UUQWw`ZMvd>#g=2ATjQu31CH2$U|Y7P!PvC%6l(<0csE zAl{2&tTDIS*Zz{|YV-F784}}Q2b;4+t9O1~=vn^%{qoEaw z3Ln2OL#$&_Z?FZ!_B^5F$Iz7;7;~DTPSA|P9C7O8{k~p-%|4OH=qa@`I2AmIvm2>^ zWkirB(A_yQJL=<52_WmeA8{Np_D;LN%~0ZQC{gixY%_P%K<8htTARz-6ilZ5!~OR9M?MRt|5nJjR@D@m04XiiR}>X>K47nqmVu1#@A>6ot;labD5(eQ>juB{y)lXB#0 zs+Wg9hlpz6l9^Pf+Dl^-^~P&5-=R~al0|pH)RU%#+sMQv+jgjLR zF&?tq=f^M^Z4&+CS>tBPS)8y60$#_ zDD+O*c)Z#5NNUq#FSnAx`nlrS0<*;?W>s@c1i!$d8uO9D`B3?M%n9uv>EQiNn5H*I zTbV7&DMWOyZ6Zm~AtX%#bXo&rm@1u=N;*x=rBiijQ9@qL=u;{u07IsLCKmV7noE(m)| z06g|>hA$P7Vtfwk3JC)KZ;{rQf*9sZ&%$*zS{}#tCh*TB{?UARDiNqQ@jpi{i`|!A z@?Oa>P+GDUftCBhv&-zOV!b)2L#($lYr>TT>QIk;+#Ipf*6`WrhXqUvJARsHkg}@z6OKR6Q`S`MmQWI3Q6GHOh+`qf z-_U>=NqzlQSilht5MbLPGWG_}l+b4~!aQ2hx18PuonxV6NNECos3|4TVOL7<7T^`$ zx4{~jo>bV)==y2%=3UPKu2sSQi*IZ_s9Epb_t`|x7(g>iNzM@n7-WNT?!SvPAz58= z6dT5!w9$ka3+Pkd?A2AD0bthm4C&+DJG5NpK^|rhfSy|cbiz#?`b=Oiv~&3;0d~%Y z?>dQZ=y(OgpbE9gbTldO8rBcUZ(}OEd%^k+C+MW2-dg$Bd0&%}|(F^YEAdXgBAI_htTO zCGpCI3gU^9m{T{%@aPUDDqp{RbdkhxcsKM?y1Z7HA<8($q)1_tBA(1_P7d;$N7RVC zX63}grBsMm$jt7~F4Goz5xV3u!OYJ%Y|m}X37Zwv_X^JnIcARzoPmb(FPbUJ*AGZS z8-**MFJk<*#LP^x;DjY51zy6e2d~tST)N8&*OklGT-l^Ch&oUO0U21$?kg%d+w^)z z@uDFnGj^ZcDsFZ!U5mHG**lU!f-a(ZiKHYHJJn5(5a@*nHo%1+-(OI(^!EBHwQXgv zMUEdhXyHLMyRu@&scZ+LIC{=#IYrAGat>TB-i_OChOa&jc%ogN4I;vBXVs{{LsMp$ zJ^~1K828^y(V*L}l1i~$8Z^9GMx`K49gA_Qt$tD%GgmsjTC&V8?~)5b@`aS3qbB9- z>+Gex+0h3L)_tYaW}#0cXdWXSt9+z$YCpNa?WY!grdpgcRp&KLJygm!iO(_D_5qdD2yCO_C8;AUOE0OS zWqx{|Lu#&+_{6ACD8aJ!iE6IMQZ^qz%ddU;oSsF$ovHDKh%7~AvX^Zo0$zxH}|-}j!^o_pt<`<&}sR~OzX$1aWe z$74CCXajmWS(yRkzI$uA)9Atv2APCfj`dTqSD|^#HC=zlH$C6{&X;y%g7DGTV9jIm zf5>o@(MBA9Zex3|JO0MRQ0$IO?iTU{(l_KH?BLb`xiV@j-=$qvQQG^iFGB}fkPYH? zdPAI-_2N}YC(EwGqxnpx0i@zLNHbmJ#lg3bFG?=$@@f4^Ds=Ft-p?fIB+srl|*_OOD%Q@%Y?Uj@ntTI8Gdf4$eV zOZCP6w#<797UelUjP^v z=_pX6)e=An<~ryT%`2kLQWci1BOszX;|#H|Frz;RG}C9dt;BR1bc!SQy+Xa~yTjOu zzrP~_@&Z*a;s0a0XWZxvxQxy1SQ}3u8oT$B`!k=H@kQ3HjN^Iii6P(vDE~J(y_-LD z1#z%(S_U52M$P=Ma(q>5W+-xga@(p=!-hd}sZSv{b>e%K!6-_|`M#BOx}cJCRYbAT z;*`Yw@B;2fF=UzvhX$R*t;FezileOm(La50lC`47FRJ9V?t3yW`rq<|_=h@bs%$a- zsc9yTbT8aG*A4CeG@j&k4qcAj0?(70A&P73h?oAEq~dJN2GjvHE(HM;0YlOIo2!C< z9%dr-grz?psO?)w4a*kyu_FAe#AFhUK^2YJ9|6sS-wGM`gm&`Nxkj-_Dgj*@U!m0-mm`G|8dWc6`5la zrR?9pZaUA|n?MXv!lbvC(}mre{O`=^kW21sJ3X(c0!i^t)QTO6niQsl#z$9a{jRg( z|ND5~rZ?lt<*D);@Srqw_SZ?pwEDP_yw(X`OcKnBZ+R$ihmTU=l||Y88Igr2)=x3< zHf%&neCyw=iwq0yvHp7R8;YgSp{rO^)T0$2N^943?X}P@*IxUOs%CWm9;-^Q@ZFqA zUD`3C$8uBn`?@oWJGVh~2k*b2#qN34N)#}LhHh_d7L@1iEQ@}g=8nz+7!n$rB{fw7PYa)!!m#^fF6NJzP`Y}x zA|>A=8gseCeiF^jE#z;O{;jJqX{q3y4;>2Z^t;Rq`$~mxAznGq8kj)-@42|OgrgCk zL_f;Xn{u;Fox2!6bP{>GQ@)TXvN?2Ae#nMm=dI_NNJV#{(0_$J}qV-)u&P ze2h!xcwcSaC=IF0*%q+*)G5ONnB;%*`>=JG3elHN3YI5(@yJ@q)^tM3rfx5^H{`Dz zM{w(79ZA?rdQ5wHnM$Uk`^9<1t&W<6p3TH24Ms`-nO2HV3Bvj`onIAbnPj2IB{Ys9-7Ki})V)utIj$ z)+gVNS(x8#Rex%_(Sx7Io5tu0|Kce$dU5qLZ&{?~V_rgGU8r>dH|({?y%cq;;QJjR zOqfDr%-o(*``^k3tnTUada3=lehJFnV*5_ivT$HK7HcG%*duu0%3Ucuk;;!e;ctV9 z#C{hMagF^?acOBcFqz>uFR9>q$e|7x)&A=XOI=Xw$iM;3Jo%5p!u0g#MDJYRZ-F_~ z82~cVx6Vyjg&?B=^}TxpIYs4HVroOFUnldJB+GOWKTX~Xf~VBaqaviuq+%+fl>hln zuPpj}VhoEXmXC;;@dx&%_`@kA8&m2VyH+`3yeh|H&tp<9bR-HB9$N(8H|z61CW0?R zL!L#w2G5vg8p}$C%^sIUV`922JMdUHDftzavn_nf@9{TEavbaE9iBrYQd%4Giu+C`j{sOBF&yVUPg$D8it<9Ry zIw7&wNK+R>-facPV6ltb?v4s{9`m+LmVYn3`(veTXQuwxO#+??Yj)>P7Za9BGUR!`;LD}L)$^BSnUX9C4_ox*Pln#P*PYlEn^<-dr0&Bj)&Pfu7_>yolyM z0`e^fxeXA*oq?aV<@`K!Gr$7}6A83MgQ>-(?XdGu)35~sx$|Id1@Nxdpc>#Y&jfVL zZYIRzwRA13D*-Qu9U&Zy4grougF$Gh)dAdPg`Af8o)8YDK2L6g2Fuk%nF6kMj4oBc zmDPi-sF?%!=kA;Dd4xtJy6}t5is@|6Y*wKWGa(qjpuT+m5NIy901To>TMpo5gY!VW z>#r-Ij>iQ+%se8%4PC0@|2OswxOh4+QFZe{3jm}3-~HAz<+x(8KpnFQfYAKT7x6j@ zLgYr-VnJj$@Cm5yC0c6YqiRQo2$PdnU_uS6iM*W%=2o}R%S1Qw$R1M79sf*oEp8jW zZhk*ZG8FFiR;m3c#*|0c2*jP|GoD825i#elml8_tI81g>aVwH9)qG(K8)Z$7 zE}qpdCO6x;=(Zj1v(>mD%}S06(Q4PL^sFzs(KR|?1l}Yn&zk-b3OZ8PT;qDX`>%jU zR<`vyCDXmCflz%HMdOp`w@GhI+b$NW&rUiEQ1exLG-XQ3iLb9k36ll$yd+7JK&| zlCIkF_d<;ddGM#VoUXCc9fR*&ZKt``-`+sG{o9ATj?#v_3SV4iWsv=%Y-gK@ZZ6;$~48j+g2iX0~V$$sA z(Kq4y+#_tK*G+E5!V|HP7Bgq@Bi^Z2|DcP1DD0n>_Bot)xq|1W3@eoDYcf)s)7Nmj zCD_IeM>{8N@NC~kZvXdsqNeflh^4mQyHL%9douB6Nv&~QdJeRMT-J*`FJ4X^EM|H4 zpH?}gtVKm33tLFgDYEUR!wqd;(W%&iBJH#r7?sj)pc&l^){|;cO;#8?(WF9Zo*hx= zsZpS9hiiE;IAwP(#OQmtaq-F=2m=J;U+o;;GF%`ap4i&hI&VQ8%I5*PEdebYT$XWg z^a|3^R%!=KIP1qIL+@NxEh8WwX#4h2;|57~gf?Owep;yYGEaOfoW#v`#xFgj=iiib z<%Qk@mdJw9QcP%J->ZbVCQ{*H@7S8;CuXl0RbIax;e9)(Ap7#6T;w<5zCqjK+JDg_ zgvIZ}`$rv=>PlguQOfKqN?>nxW{X|wjXCEkWt+%f|(!5V<#8zE2eP5S{ zmbPHI@`K?wy7D!hADSVQ9H*w_w*?m-)8!dk(Cgj(&VI2p^g%j9{XY2zx>s|Nw1wtE z=~EiylcxlIzh?_fycR#m$Bzn3-rTLuIpiUt3<@vWCMUn;BsX3~K3<+BqbopLwMW`s z-Nr}6d$&}~{DVQfY%hc1gYdJSzzUX`R40%cT3!+&7Yir4*@OGT#jDq!??W0ZSlHY76`z5Rt39(tS$iL zZ0&kXSdiXq?er;>XP^k?zTr4~Jks<|YHRO%4u{l)}>K*X|y5QvA{)8}O_m^4-I~1-4dZ-)&Vm1U+5B*QQXI`OAT(Ldw(P*mg82iJBA1_@-hzR?LthTlX zVkn8{@Q-whU1PgF4`wsa$DDc?i{1-XZ*$tj`~1QZw3NEMcHPI-WhD^X43g#xCAneRXrojToaGlm zs}3$dJ-5$Ehutop+{i}#Dtmr?uRnPe<&XXo-O)~B?Ab=0^rzkOF}X;HqM*_-Ox1J0 zn%E}7zwkTKcRx7sXvRe#$4`~Eq6HhIubO5Q_WGNXAgo|2IuY^t?Ush~1Kmj?)~5*XjDN zq{be{16xlTl>1ZiG*&2Cg=`CGRG6gCjUNR?@G*7)r1AmOZ_r6UV@SHx1sk1E?R6aj z8YO;lD(?4Ne~iw4oaT5}=Mkk+l^ zWS|>=I-T%#@CpzT5yu0%y0!#R)ahG1F!wXX9q4o}@Z*EAPuld2Qa&J`ZXrtP?6t(7 zr4Rp|l=lP>FL$mW_L2Vw{4Tv1Mdffe6LK?9RblS6=I~Of6(o2hLjsT*Kmp}vKyuy8 z4S+m4u92`61sXUZQk#jR4#x-?R&0XIXQ1Dxhz1sb^h_L7&*if{0RE{uOaNB{vj>0> z4$waUWVX3qlR(sp$L{gZ1;h5au4nL6X~?31vTkI&K$QV zd{J3hYVx;MPT{it)A4Ty_W=7!+M;U~+hQ#6W}v9@q&*!Dn_p~vjIGf#9|BqO|p5LbF~!$oog9zQ)KSV^HIWOyADc=Az8TgEODj~+hn-; zX(bHm3fi89xv@0#%+}Ujl|wH@XP{?Ib=x!rwF~|pzFAvHge{?4*>ZY6p8|*zs_oJz zu-M;3zIi@!;)-5So{F*`ME5@C-FjdreBp4!?lDhh5lcl99PMr*=}i|Xzp*dX!deKi zO|b?s&MmOqPc*W9@`-Fiu;ncUN}76-H($2(1-#i8zX^S>C6GxJaV7;>3o2?J%aTvm^gnb<3E-| zik`fLZKFGG<4n&foARwcz+aN>t~4j1di!deXq(PyhEQv@nY7KaG=rYDz=owfzN&${qFn>%lfN0(~`_sZ&v;iE08~ zexd$#xdr5DHs2o{*lTBwQMAYfeIw)kovNH?OwaX_T6zL6Z}EI;jRCk>Ph}=?T&9266rCCsnk#?tz{zI zu{ z_J%(=?hnO#r46J+TkDYe>AY~PbsCpd4!NCtKCZ|RCC40mS3Bz5>lJH5&y2#<%tOA% zT6BHJpXyL{Pc2@qjTaNtfLC;>EwGCaEr|m9p-&msC&Yu3vu`?s%BEPIpRs zJ6U4>o(bLU6VSw=H@1KN-yAW;$>*tw_cf$eWYTqky3xaTVh2oDVVJf9`73{`e zK%0Yv2Spy?rB2UDkIKxx8ePiecze$tx8J=rWv_M2Uzw4nUPa2S=$3w?;A~;?9Hzoa zTKfz}8;LDFG*^FnpYoG#dIf02>broIzi)2NhPiF%VXa!9ZGRwQvGo3ChK-SR#UaeO zDfG@5rSxEkqW6y;P&p3mZm))F=Ge)nHB!iZx!X8-u zqOf0{n_W~6q>PDKOmAjn^p^APi{;MG>FRy1#{c1WR!`3*(Z&7yDzx_-(LFtTdwYG~ zT|SPg3dT~29QB5pX#arP8~syf|E54HLNc=$TxXElkLoUb46U&+mo(PYeQEO)cR3dMuujLH7EtA8VZ&;LuSSKQp= zzvZ1&4F*!CKT?T;(X8)1%LT$;`?3)nK61Wa`g&Ir@&!XvTRdV^Pi3NCH^z5AB#6D= z??hMhA5~(;M>d&U7vyeXs76K7MU34LviE#yC{)_W_fz_F-M<3iwKVbQGykl2NT*or z%9_khHHjhH)1?Z-Vk4st%EFJ0hJ#8EUQjxwS+FcTSg;chGQrC`&)*Z?mox9YlG|M% zzrA1FV2n={t~8cZs>sUZ<8bn2gI2U9w4rUEzYz0sNF8jMbejj6;RkMb1Q!%!f}+h@ z;(0kieXlhZNX}S3I!7z6c2X17-!;?Kx`l@$1vSyP_x1-9!pe3cuj-pc#W3z+L=C!LL zySwuR_rFl3Be+V^NzApmq`Mu^zyIkr=sOyGujZ}OMKWS*PVUsn@qeoOQ-Hm`m}L2F z`Q>lL{c~YCou4LNzrios>qLzH)2+CL)C!^GD=~NMd{Avj#Sbe!?c6DOJA!es_Vil4 zJL*9n=(t=dr2x-TpVX9p2}HocHxf$mxsGUeULew=pDA+eKh{{) zdFK0`FB-LmMY4ngFmf-9jC<397=>v$`Z&EeLYvm>V$6ER9WZqdQE2*=GO%IzbfOI{ zOv9|t9A40Gsw~?0tLyhuiWrpG&mv`EV^CkBc+dws;%$l;y&qKOIc5%>oE2ZA|FP~9 z*zKN>@)s6fSl_l)dzIs7q^lsTQNb}n*QXIzYQ9fkK?)6a1M0N2%M@9W~`(hRG93Lamt?2d+ zX;%5&0MHobduv3=7gqmt`!p*ZJLZp^(|@QFeyZF}G!F3cesq;umt0-*I!SoXe)TO+vuj?KN zcf=q5%$Py{{jC6TZ5j*cm8zV6976R@;wNU8?&NRrxKGOX*=sI;UdFP>M-&ZK9yl{y z-a-vK$)C5^&Ad*#b_0ANc?iZ!3>m?2-&{Iuk4q`gu3K}<@3k3CDmPPW?|g?&Wc#}E z-)h$;s@kmA+L!kA3r@X(BW> zZkp&Y^S_Ke-C2qs_a2x(rACo}rTzZB`k7B+K$epv{fTksR5sY|&GV^O&s`pWfMIF^ zq@UzJ;jvx%m#xRgXXkQw@1E@h`3u|67kydHVn0otj+p{9{uS_dZ`UW1R?X;U8Y0cg zYNRD+l<49Q+2eovy2e&cs|kMH)M=paNfLC}IHt6U;SA8%Rs8$I>s@!Nx%usw_yiN4 zJ8vSmd#uM_pE9v~H=&8Wge6V6ztU%9P5r5tTu!J|eMdA?MTeV+AL&U4-pNeCWdr#IQ-AlJf4cZn&@rv)n72{)B!;Q?! zh*QZ}L1fu$+ILM~$LAH&oy|OYQt{COZdM?>VMuFYJqI5reWxd<=FtA4$N%fdgTSU| zt1@{m;IS6HO6V8*__V)d#PNz#mUO{~@^9?^P&ktu83w~VTokv)c|Qt$>07l|FTG{2 zlFI*A#*j{3jBbVrQvC4WvtBM!uY~_Roq1f%J}KJ1B7MMfVB4=K)QG7ux%s`kM680Q z{>V^@I=JZb`kPj0GNiucVK5`hvA-PRKP;n2RHO;g6%QJ&WOYpYYFs7YG4SgBL_@$H zrx;ak!mZ~4sHxd*i|2(ryk$$du*S;bUmx=iD>cTqUKDShkO&XA8cNR^506=7Dwy0o zk;^fE{TTJ@t-YjBlRax~=a7!yr#avTpDcmnv;^X6#m<1zsOh5{r*?DvfJYw!$sNU2 zLH;`PfHJYc;azF|JpK|8peBHyRRU;qj&AT`WDj_B3+L;9`&qCqR4IDA@6RZmilxp< z=)FVR{I7>Q`9&=C!7XA##<<*r6wJ3(BLndYZuoAXzZRRdeYCw?>AjJp+=ttDB}|zg z&Ji(;mb~sLAf5cvoU2&Cc>pJS-6l1sq&G*w8M+4>XpXOBOXa7fiPkYHY`*(RWyU#| z)Wb^2Ao!fNPp~F^J>rS_cQ7Ndy@u$h`WMf7<16CB;;DF@oVEi0zeKL|R6h>esox&u zF+VA@+KA14z&+|4_$wxSE&pCqtQY0Kg%^(WGb(FoCRu0P#b)EjFaAdS;)vhM63%dQx+^9$ag1YFeMzkR9_uZ?O;Y<-YMqUuVu=;)H}k zf0Mju+~25s6TJ~)U!{7STJQF4hC1JRnak?MI>T*=H$V)IU)b7v%h~mW0#MC9`Wqh6A{U|!EGPu1`L|9#_yRnZXpO?(yUO$3jx>$=WO^{Ap=uwUHQ<#(!BO;VXE*vLKB`yu4gK)s zV|)vm_h)J9)6!a7$0lD2f5wC;DeAFmWhvKz{#*E%EZa|sG__$q9xK_73Qe5h zmveT0snk?ed~Nehk(S&>K1WacBEB_x|JU?=Z{zr3+2Jn~l4YyE?lKGAk0bKtZ)iVf z@7c-Sn{7WN(WDwJ>s`916kX9k9sH0^>^A-Jt+6L>z8HTU|H#`DlGNh(sciH~CTw(H zY{@c^apa4|-DnI*o7u~NUJ}t`Tic#`<#+E zh>}gl08g2(*F-k*RBXA^tzDd5i6(~R<8y^3bJY@S`uL`au1S@-L8s5(j)_F6Nd)?1 zkQqe5oIgc^eOO!n$|KpoPU#en3l`^bI4 z{T%IQV5&i$wx6E9pqIY6JC&A1_yxQ&22xxLJTKIGZjRb6-9WjmwVqZrz}r(~0f2kZ zKpFrY2H%%6V0HMy=MXy#p$*cE)C zoA^3g@$1QH>QLrpB=)K6@6ef_Z^sVan=6mzjDA%YNv(?|bKh4{I=!O!Jo?z*LWJ7R zK8FzV{_D}?zNn+c_vbPRL>lKG-!L9X<$Sl#*uLabI+K@PS>hYz990^wx62CvlGQH3ZV_ecb*~gQ5A-}2c;>9k%wTd3kKR;BSvdieZ$6V$4C(b7IqnuFF zds`ibop`R;_uPpSPM9^Gv=uaaoc&_?oypvTZ_^nmx$MfreE%v!*z(^qCHNP|o4#Tz z+7g<4(is-?K%+?1*stiP`dD#X2|X<(^_MDvK&p6(%cboFhAcc4528Rs8N}JV{t3}{lH{w zw>A536BPr$)PI(2=4vH;SDR|zhwLlLGqqzn4|0lsGkgguGMI~a@uBn=i~5=1uX{-P zgj?-_d?Aiu^LE6tIW_NcL-)?tBuYGGM#;|KK2fsvzeyz#AXh=HS$dn&ctU8v9G2atx^rcPWkee<$?$36=EHlEHX&8 zpIIuGvtkvabLll?S5%ZHVv83p|HL2Px*soDMLIBdAu;%Ko4%}uwyvwcZ?$mz25I9o zAs#5QYKJ_Gz{DHP-o2&@?MJVSa|h|k-}^~_#6Z8SNG6g{9+0^?v=WfTSNNIXM&~iU z!+2s5G&ReJy7$=a^9NMBMb*Q7N{ZOTwiUvPn$`F3@kU`S#Vevyi%)jrsNEp}*#?Z> zI4^nk(Eh@e@mqE-j|CTGLz_b7y_@UNu9QK9cM^i4kHU_;Zxf$C&o;(J6i2HqPDs7%?6FYsy-g<6>q8H$GzWLY4QCzYAatM z@a^sGqZXbP)sp2V8S6&N)cbzUkP0L;k=-^}7EBOc4SpFDmTgSGb^J%i)th%EYf5NI zJn-(kpv2u_ws*N?>vlvgRa9L%T;Vn*=?^&r;q|dy+}d922EJo6cRvtO-_AQutPE!U zlx;p=DodGLq|Gy^HZe7|GBv{-Bc-RG{COT|xCEi32C#sfo&gqEOtU4xqfU$G0UIde^YiNY5}RcBi-T@k4$Xshm5M}Yl6|bAFTw~Kjzw>OW4`YDYX9Xy zf_&6&pS1C#c>WF_3JrRM;#rQ|UH70H!;z4X{*Hnct@Lf}EzOUCtl$~h9I2_!_lz85 zwFwPO_A~U!11g!?r&m8iu^vgKlcj-28A14|rYEUitQBgw@eLpLX&!nF3R<;%c!W0{ z!-nfh?HXBaI8H9319Jw`Ji`EYpa-yPYfR1(jHY2}JughVCd zb0w`mhpNPjagpUZ2u);+5q-D5o5Mi-;r5$E2Bt{kfwB8TJiF{vcZ1hD&gDMB)vJ#i z3JW!!M>Y8#lbZh%GqYGX^)s+K=|YRf^W}#7Q^_4`s`5dr{{bU=qLmGKdnCalsE7GEr=$Ii7u{&3QqK=#2t`EZDT_$yyPT8zW| z{cYpzaF&R!!!yN9^4gY%(j=zk0j>KKFBx{bQ0KAluVqh|p5?!zyci*GxqTm5dm^pb z-2(Wpe@X4W=kFi)Jh~4>q&z`JVQcuOHz#$;AG7H!@M=9tnOD!C`tx)b{}kVhwskDS zyUcS-ul2HT{)-vq@FWrVcsWb5PLTc$$LANV z|3p2VpZ%cu7fBvsXU)P%rK1EAQaXKAq??pj_`Nh`Kit*1eaYNi?JvbqrKBLZ=h*X0 z1Zn4yyYhj-k6CdaC9pfTCH7?2dGJmdti_Zg?f1Xtz~i4nw;`(`+$SCWQZZj`wwXJs zUtJHUyc^`@QFpo<+Kx!>&9aZ&CyrJ}E0w`e;!hAR#Y!7kk4vAP_3s}aVehZ%P~{wvaYad24#X~Sg1%_7c^V-2(n(IfDz zlwX$$C-Am!@WXElPOv5v>Ba0HN!~rrm2@eWUYo5Q6s~?Uu4y9@$Lu?+ih8<`I2#9A zZ;q368tnkNNjYVoRCAPHYVG8Y>Ueg!fDyig`8WeYXi*f5#j}$}6%E>10>ius5Z-1> zq)QgAr`n}4HyaG#ca|e!bNc+0+HYq&-QnHdA2!WW(e(-u{Lu^OJao`CNXu`v zYS7SGZM2^w+vi*sa9f=Fh|dm#siL5OwQ>h6qjjB>SAp4gM-3u{94ChZTRY_;{I;_M zd<)=xc@zgA!9bJIMi2tK+H{tEwd`8Y?6FSFa-BnfXRE*DKwM2%L&Q-1`C6sgz&}#MN#TL}SdJP)FGre!O#5-*^MAP}N0lrr1hB~Rc|9C|7)Z|JF`giAh)IZ} z00a4$Hq0Eba-7&sItzy4U9!$He$@M#0NK!oqZW{c(}8U8Vw=AP@*bL0Sc)Vmp!`V3{qhK&o{^6^gq=GoloPLS!Pk zM&Vb}u$6gF9woI+U*6q!`KnKUy!OZtnJobwrK8MhwtB&NZ_QoArcLb&cglgWj zAKzZvA?zHZ2s{7SMkO|)f$#&*%e63K5Ky1(pzFJbV)i{3;)P<1?d{XcnZ1n8z|b?v z%caYHRl;Ee2ak^+2D^Ool4qJ}buyL8hM;yEj5Y?yg$X2_TjfZy0Cp;5({5grKZ94G zWh-`$x&^>PfnHFX>%!x!&skscc=d3o!+OF29tGO};Z5a3n8ejBK{uUxRez&^_N^2E z$(D`n8R6jPTEUc|e9qE2G93Tef>K(qn-EJ4b;xj$Oz)#cm?0d%fdJ2q6A0)q8@exb zHY5P}%{1;vU9=NZ`)sUh9n81lRc{8$;g>dYm*>aEs^Vu3SbesNy--rVd zsvz*=%j_k0gfGNE)+)o3y7WSsS-P-S@@gt8do^qsrJ zZZ3qZqkxSCTj)hHUF&+lV=BZ~=z$1$%t?E8`DU&C;-YfH)~k*?EdR4P4Q$t!s#4-_ z@w=nCrj>Vqmh7h|Qy_xV#>lAO2A3rSITriwpfDXGMVK=MU#`=!_{|w-&tc~~p%Mny zi;;t1xc!AebC`<6)jqP87x8^EGtQpyuRf`x1GQX($y#o92M#WPzM-YFND+gJEKJKz z80dN}fssH+f3Lsjx(8s;`^#k3>krnX28AR?>D^Ksc;2h|AiLjx25=SGR| ztz_d5Eb9?|%QseZ&%Fn*^a8H3m+>cu5a{A!dE<84G{Os2??)=JRaXx`AJ6tX@^)Xo zm>>1A5cTNCZ~#bdh}hFHUu1HTs`yojC2*DvEV*?aaj@V=rKO<%lu=&S14W=p`(9N) z@$09~T_O%}d}>tNjRn9MNS?#p5e7cj3EBG2{V!77m53Rxs(6=btS5;P4aivW{l&#m zJU$Ne%jT+I6614ph4faH&~08<=7p}_VevZ&?Gm~(3#?H$Yk?Q8VZ5zpMK`&wjb;RH z1qQrEG~nPa)P9H9$B*IIEnW>j zMlb1LD+Ew<#|`R;L9s|-7UH1iOE)Up)&{PCc-v_btmP~dMe*NW-Iyy5ht}&N(Bs;;K7w4F3kn@z8*M3uK)b$CM-aI1{C5ph(@ zY#Vx|W0G(I_C`gtTp6I6530mjhHCdf-kTkFU~R^`H$KSs`g2jbVV&jiKri$>pRVn) z51w`Ln_CNhP|Pvv1>P)V0~@s*_wB8|;I(VrIE~_I!oW@-a*K7cv-_8_q=$Z}XwWh`kogZw&EFUl-Brqe@ z)1l>wonebP#iM9_tYtiD=G1QK&Yc=O+~pY36pO>>UrAFfr0~s*kXCjQjgUeEm2G!UF+`UMjS6~RK?^!!^ZtT zZ2$WcZ>@N|%kjlJ{eVDeyPL@&Dux2=`ov_1|}M6|G7@29ld0j6;Lt)Z^B@+|m1wz#F^COyz` z0CkHS4oxm1DddA^1ALsz2)p@gozQEvIE(j4WdBf!-)T3;OES27aUoMZ+McCh^Tj*_ z-+RV#gzdudqC8eA?O|{XNK=36tP_UnT(b}7J zl7>Qgs7#t?U+&67akb=z$3@gF+tVmrmwws@<_;}{D{)in z_iUxE*AO%#lEC#@Q6V#YBes6UBcDoQ-yXi;)|F1i1Hznu5QLATLfP5Z<9Y;n&z%y? z6PC*XY8iLwVPxH~oVaqIOE-~CQ+l+;t<)=q@a%4b?AKXu#LQ?)83{$gCN#zLf8^e0l334aYS?Osh zxQr7bMzy~CK4}cO+J8}^Lg?$qws+==ED4k0(3y+i@)kJiCdtd=*DLPmgg;FIuu*W| zcj#3;!q&IPL~) z6327>i&8+W>Y?bqGFSP{ZtkIh_-qUd2sAS=ls6k6pXbZTry&58JFths)p4*~5t!s# zwkyh8y?K34Vc8U9pznL$Bk6Y5SKEVNugTv2{m;C()jOl?^7zZ1;Bw?mP>WmyyAZ^A znykRNd{>uoP@Gzo*F_lUB;s&K1P@m|3@`Ux9EQPNy$1EN-A@X&&wvciLkt``6(geR zyZ^U@a6E;`^4f_4F6VZ#Zd@%3)Q=#EX+8Y`_g6u-JlZYLDhEfxb%O4&(JNGjw55w=sxuWS* z<{D0t##YdoMU>g|iG=zjc^`_qyLyOs+u@yV!9~nhJ>3<@*`O z?s|LR46@s_cAhU)qXJ(a1QSj`B=K{u zP_Hw<`^*(1iBEyx*V~p$K*#(K+@WW!T#sdBHYbu0xQm6dqS2ut|Dhb~S*QgPeAJ3r zNryOy9}&3PuBJi2TG15>ZE(>+opIb<4R0dI!o*9Fs#n-%sqCh+p12mXt%m?^?^`-# zAHF8Tg5Q;gwO#EOWxc~7QBoTXlb~y2BM=me1S2leCXHOc&_(h%=tX)Kbk6vKEyp4F z!=x&H10695x)^6OG+J^$bALp=T#foEU(PZwa;mVbIsw8RZDr#+Kw$ymZG;OLu*rea zzSxH@p8Lg1SQ1XNMV5}&$$_FZ*ZKqanIwnrJ`yIn7Ch>+Ef5E~I_p?{(d)N|PdRKk zZH-&Lh^=P^UavCuw(L{0XsBM}<1kBJ$L(Sw244Ly00RjuZ`g7T+Y)U|R#w|_DZF)$ zo6hj^l+NKbtsXVhW%;4}Q#CCNwix6?R5usHh&ZnWz4*ZxpvElfI0FYRt6-jjo^0jVbJxcigCXKQxKHeixn62>Svhue+Aqwl+d1@h+(0n1VrP9&vEowq zt7hro4YoUxTAA1FY@mBfSLZ;h@v1mT3|GxWCvg&Vt|~>Eoep7!Tw&a$zBDkSLwZ@f zW;Ij+q!^bUu2&1u>iT^&OF(MLkC1X3H}dYZqMR*G!ujI&EOh-cW^sk@=7{kyOnC)& zd=ryhZfJ-s#lzQRdzmmHnQ$-b)dG{ZrBuwK@t4yOO(xIDtC1UaauEa}#98Obm@HTVZa^2l^Oe^UlQoQ zuuLbf^)4aM=#g)C97`i~dRr^I4xrqLzCO!cM0tqyeai-}&2JJT?O4E#hO-0sc8#yw z-tJuSIbu|WTU^1wxMjc+rMPO^)D%}{-h{3BT5|sDi@@9Y$Dg0~g+7S*6gczf$1jn7 zQ+|O=5t-*ETwuLsSZ(kP$y)6<*>8v314UNc)2{=^7E+$ez9P8$qS}6mD889S0lue5 z)gPFnX3Ubys3a!CWpv%@WM?HVh>qDxB65;6%hq!l-%;HWXZ8_Cz1ZYxJ3hZvxnZ9k zz;N-Qyw>~X0r!4>sq#c9D(g>K+2kI&mYc0T!h`?H{IFnjhXVZM!sFuMO=7G0Ys=N4 zfjGmPn-YLmkep(Su)df(vL3;k&FOQUttv;_qNCenah?wLOU`VnHZzUb-j`>*g*vK4 zt~=wEpp_q2@4PyHo9Au9;%+n#i7=F~Ix)ASfshxwmLixLha zF7;Y4U79cZBF(11)4s_drI@Z*!c1Iw6y#?P5jGPgnLc zw_OcVrMyf#r(9lXS?F79;A0xGTKwnsU@viN!`bi?ZxM)_fpwdkkIF*LcV9i3%*!;k z#cz>Zd#)8=D>j_hcI1aHrOse_Vj8FQl(Mto%wdTh%v1TeoV;KS?nVe^*Gni?oYb_$J@6L;gctPJ67g~H)T6(I*%2Gb;&5b3$U!8CL~-CzPx^(U%h&J{M&ciaD2qvxg&1g7&^b}`Y%3jW$Axo(ZW+xhYVS;XZOsFwWAtL zxOsNjuOBX(aMm>L`xEu*)=j>!i_>xb{&U~2oc~_$CNFhd);4a$vuiHC{L{@G0`iKKBPaZzo4~UD7=Zu;mL((^eh{LyU z|L6APk$j)--9`7@-k-I-eAYibcFL3~tr|SF>!oiF&CD^GG;6-ATeokoUOK&g_=)cp zrJYF>MgM1?9r=9S5wqWVtH!8ym8&=Y>L>W~?5OB zeY@R#9;-HO`q8KAYl_#-NSPN9wA9~!uqJU_pUCNp-UeC%SfbaeKRI{VKdi}PXPlom zufNrr{9>zp&4#Yq`^yZ&k9p!{2ly|(%ExQg49t16d-tnzY~hEBi#yNjT082@4@H#^ z7Vjt={K@GvKksipuW>-sg{eV}HvkRrq$5rmWXGcOEx-W85!|8vk*!>%{3{_L)alH4fR?EbP+M(??fd=(usi zciHAOJDq{{W9?qtWO|#c{(cvo%{KZm&C<$1OFnmC#jdko9$d-~U-d?d9aUYc#%;K< zZOYA~wZ?BOxp{FywQrA4+?8Fa>hQpxe|D)_<>{xNj%n5EnW0Z!EUY~I$dMyEcaN|R zJ8`<>TVq{6zEv~BWFDE;?fZ!xMxM<1=JxZGuaD{6vHzJjHLHh|nx;>z`Dn!N6Z&;= zJJ+mPGc9?3zwfL0`3>W)mAo-#dGbU}qkm<7VCgryd$WxEYmOF^KHMjaIXGm;p_w0^ zZNB1*W-XoO#^08nEneND;P4M0K5w+!F93pFzI?g9X?y3aG{5b=`lO#gHyI1YgqHM&Yf?R6m?pdKH%4mx!r!;cK-a!l`Eb3l`ooj zr1py!hJTawWv@zaB@D~B_WMs`FRW`?zkcoHHXBQ}7k&B8JKUyChgT1r(4o;Ik3QP; zvDr7$-r1D3aModA)PlsE#lsTE9FG}Pdgz^R3@vL`oi{Jzg_!FfEIRj<3*fuv)5iwf zxYBda)jr!6E_|*-$LkAc_noo!=Fn!J55AOiYsKMP{VI)bH+Rk8KN=p5o7R@QcIANG zWHME${EqF_A8&TmKKaJY1BbgU${d<|-G6x7v4>K+Jvk$$;rdTMdcMb!qeoYYXXZDb zytq$|Ha9-`ZPQx|(m&GwIr-GO#pjFrzcps{yHo0<&h7l(+7f5Ap|=Z80pVzP+e=s1 zPaSf(^XH?l-~9Ka+Bs7i0aVW7UTgXj*6G8)9=2_2bYen_ z=;*gE<{4(}`1r$<-)|KXPGueV$`8nv&(}GA@<`iFeM4^EH1Yh}{QMnnFWUZetyag5 z9^A3Ldj0wbJ5BBP(t$R?ndj4cd|7|VACtG57o^Ubzbhx8+43r<1N!FVbkIHX{>3fD zyTjHvN{Utr%RYSqC@zyHuU@-$Qo*cVLCyXBkDXg_xLfW|a}P~-y!P6~_o4^xJUh)L zh6CwcS2(8A)xlR@sro$7kHI-tQe}O{qiLy?woM5HEI7xSu>5Mj!|NLFFF0G2mXOfm z#i(aSv~D&1e3t6C0dF>U|5G4<9DUKu`pBG|Jp-oDm8Bct~8uZCIv`HCj>V8+)y z?SB+r?p!+dF=6wyOWSH6_#!ajxi4qW_Ve>AZFACEcW-6C-*&bCdgv|jm$QRAt$3mJ znzMUSH+H$@=-s>b_p{ne7&k65BH_%-DNU<&XjE%X&Ao@J?yGlt*W9L=i&vc-6Rf>` zX{zp>-BY)kSFT(+bLPyGLx;BAHt9E@C|}GQoRy{hwozP7*ZE$1XT}Wt{P45Q_W;hG z^6r~AkG$S?dBA}~hx&vSJ^td1v9%U;{OVtgJDom#dS~+%T=nw@pL1M2Kc(pMBa5H@ zw|V2c@9rqLQgvZ;u{}F`!IaWUfwhkuJ-T%8AD3ngy|r?2>bUw}04cw9!53pvRwUm3 z*1FWuaQT{6`8%F}>fGG8*S{F&$jke3%$RN8x4HdEw~XUQx0?h5^&)plRduQ3_8JRCe}vtxQW^ipZ-UGiAzVaBKo}{k$)yMR#4Tw?55W-=IN*Pp|(Hl;HYg7*I~O zO%0BYih8MW<2e^!n_Y8G7w3&;;W2AJnmxPsiUsFN9Mk^YVLuRK&-_%-zfIzY+y9IU zbY)ii{p!_hv$;o)9@ax^UMWtw_{=~5nK$r!$mL6~HfU}AX>!Fa&nvy~&&S;s?M@n5>#a`~3Lk#{`GWbD&psW$_s3?t58UYZ zv*YO}X5Q^xQ!EjYkue2V z&W>w-=*=->_T(4M99N60GbXtAsvq|3S!VrtDNx3WKAvi+UVQ}EivK7a*l)8TBQ~t) z>>rm;RI64kK^xkz;n!b(ZLHJ!qtKdFYmAC39TTuWq*ELJM_zwrP2Q3P3$lj{S$C!I z#B-x|SlSG}1}HM`>iOa*t9A066Yc8Wy8gn;HQv~$4+{Ep(IOyQ@7lHNyYIeRHZdfo z`<9H1jB(?}fxef$-4jsaJEd2zZfvsgyH~SHdsU8#jvh05^!@_}faF^z@YRF`dnVWK z*y?GZNo~Dl8X4E{$v0+<>X#iRX1(xL))GK7K!0z2?MM~>xkbGfja(hEW5m&@VU=}ZyAR@e`J`q4)lN*sWcTDNWu z{+-_W;OWsVKNzNuXx<#mXyP|nK=`lq)-(0%$K)?~y+fl7Sxf3ZZW+V}PVU$q{jBVD z{g}xe|N0NTxwQE-BZT&2!nj4b>w=j;-xeGPw3RcF~0+i8!5^A0U|c z7>6y_X&k86Y~TLHD0t1Cl$et6XH@vUmgER$dN{TmRr5&e>3d!VcNI2?F)N>`Q_h*)FxpEB5hU|KA%GS|`EvvAo2EmPrYKc0wL7J< zzRKV}7>-2)iv~bh2CpPUH%izCSA&M%N!`*qDJYg#!vHMUfW+gr^%o5^&z*FTX8|nO zP_&+Chne{m1=*dvi5CWtNI#3<6kW_k}WT zx=PZTQ#_Dd063>0&3g#HlUG(seyC9+Riz|_&ox$>VuR($RLr#I6GDx=5-1s-8OQu% zwg7p#fHF@y)eDljjpz)-l36ey^k9XMX0`-60N;R>qD&CcKvX~o$JH|EPQisPSZXAb zs#sFcV4ScNioWpwfswFw5nG>xR=UFDKpy25adGuBYG3K(BnD=yl~S)~a@6}*kxS1R z2N(q_F7RGXfsYE+5K|`Z^vydT(E8)$M{27?07^=xB0YRZ#Ckgw>nRmyh;AsIpkr8> z=|V&@7fR|Voiem~3fRLy|8k%#uSR+{qYzCZF`6rO9vIKnI2LEN^B2 zr)gRvpgIaB?S`ZTRxv_Z1WuZYN*Oq~@ofA+9h7;cj=7!&dg9ofy^-LnXACQBWinCzmIs5ttbrum zfICwp(d&dc(X|4{CqM*X!#PHW2v=C|-BWj%)0(JxG{-Ug90+-CS&EmnQ?SHVlrBjJ z*(J8Of>QZF28BAoP4z*ovS6lY_#~a(>~tf8qX#Al7OWgfi~_bfiP$Gy(}JUT z&$&&2=~~=YE7s;b8w1JDEK0-$vnSDEEPw_W8Wf}8kOqXnTrnG=5dS452*7`u>{jv@ z%sh|Q2>j)+i{z=SE+gR;4Vw!Sx1gleNJItFsm-061vVVUi{0wZwUI|ygeQsXInb>@ z&px?3!b@0nH^@gxMoMA!iqJ01xg=o&kuoV1OO;Cqx`Dte&)*B$a)1%Z28RFm0xFGn z$>tT<5Ysfy$|Y3-@Ug354s}Ev`J#)@fG(+F%bzGYtd_Nk112pt&ewB^z&Mun5|Ww7}T3_@pF~>_Ut0Xbkw5&}Ldp z_1dJg)W8-kB3lNAYQ0a8c*>CI86u^PXLuD-l6YAXL1peN>{h}y3^W@Jl+}^khEGdD zvFA*(cp>X}M)Lrmiy2|%QFz6mDNDKoxB%p4LeQWT$+)msgp$w;xx9vE z-ok8NsgZb!L4bP-CQ^a|$|nFgi;KtjXL8`+(hJhZQGmmvTB=~nN{QkUjIf%k#72p) z1b%{ACh!&`U_DG5@+1*SO3d>_n>ikKmqt^cNqvAfi8Q$o+dPGeT?s%gX4@0nLLy)g zuKcdNh50PS?n-lkfsIx>JpeT1Il`vg6>8o^GJGZx@>hbE2F-omU~|$t1>o{0Dxgc5 zYBFqS%b79wQUk@Bit;K-l*Updqn|+C8Kp$C2qq5Jk1&FhfroZdu!&*%BV4P4RYlmn z4y^+e z6T`u*hsdf4XXSRGgmWTXb|l+@MU$0m35-O*yYs!3TUnVhvi5PP4*{(jGYqsg5D2OP zBIZf%G>lBDKc)6AG6yTF?t)}szybjVY_gmuuL=dWVw#eCL?}2F7b5|nqskG<$mvU) zB2se>lV1vdiAe%r$ewKz2Juq5&-jGc^jIvhqn_#BRh3W}I5FpZ5D=R1P?D7E4X3JF zBg0B|*8PVy2VF&Yz(k~JCpNE8p$zUnCX*N0`jQTV<#n{>ZB6i0(QX|mh)^6L(vUfb z!-cWY1U50x>=Bi@a<%!}fcLC)Ec$&%5 zwaParJtx(E2j#2di=bcNYB>YUBo@UniMK)hbhx`ChS&Qi&?| zATiO9eTZ#GN&^yNDikzXHk9uLsHjSe!)Uo&IZQrbS+0V-kKQ5Mpd$j6XFLIh4e=!n zR_BT0Pi>vbi%UF{AaAf`!-gy=35?~E6t}~s4s77?W!T`7kU37|QRO+Mr3FEoYeaIQ zO|Yr}LRZoUFka(fD6py^8@CD9#CH!^<3#1>fc_3dT&It*Ded?en^YzgaDhD=RTHGs z(R)00rsWa7Ldp9pcs5C_&6-Ssn2(J)qBOD=Un_xK?|_9PrH--ngWVOdBpQ#Z0veTD z178u!=)=gtIqMY=z(WwJ8Yr!;3-&q z9V>xg(~;1}%p639XEVT{4j%5(|GZtQYFkkwE$oeAKxH282LZ|6Z0K`A9-Z9C;(Wny zQ0e56)!%`3ru~={sc|q(iI2`oa4#>wYA_>US z1oD3&It7HPe3WBz)n6{qB9A+7;R>t9O3}6)Rg<-$l_TI9nAH4#;Up>`?s{!ABU7os zYooEH2XLl!c)hBuS|Lx3n!vzbLlL5W4EKUXzLv7v`{Pxj$U$1JG@xWQF}htj zb|+)+MPWdUi!f7C1iprjbViq~BFl@RL(8spIH9I$)e1up@*%BT`5h0HA0Y(8y8}DOugNEjg zR~a9?#K4!`0Y)BdL$L%NqFMRqmnMp@7)yMx+9wgeq&__bnX+|H308&dgN+>~liNw_ zGDv$`l*L7r$xyqTP-94U)KfGGcL^1k*^ zW%%fA*+QmL7`+F>DK>s9L`-4`bQ541TOPiZf$YdzHX=F$lFhM%Pa))VDezR(<7)(8 z49Y+mHgZWXgBvtVOi52le+9+WacQrlr6+dgv;quVh6Po#?LpasMa!WfflO!d-2Lc0 zlQ4|&AaMjO3f42I2(7dUR)D;QqZeCVQaRH%Y#4;TZ-?%iCl{$e^XSp)I z)OsLT5hNN@*Apbbqw6w+3UtS!6y~Y7GrYY*b;Y1mD!7yoc-_=XZkLQ}8FV2-4nAt$ zW$b;vbcCq1^nF9G!DeUTx+Jx~BcC;m5BQ+WB0;4i7hKfL&47da8L>tRd4@cos7L$= zd`Z6oD5P%ovKJ?bYGC1S(krCNe@tx-OeKFufeuujgYo`F6*|IbiH_#MVG&$NNK|-O zRAd-XV{-v{qxu~GiPbsO;{O3UgYRF2IgbBt9vSH){vZ8##Q#S`Muz!uk@ph_UqAoj z@&CTo-`!Pm&`5(f=B0cMWhlPbc%>VEpeu4uu0RbGYH$;{kakJ1!!p)im zhlO%sp;6)C9^4FmC#P+IDs+}$!@guBwEzzFg6-0Ho{P6T@|}>$aw&F~U_vS|8xgAs z2-avc{#Y%AF>N9^#9To+t(j+{%M3yEcm{7i;WPQ6mIRt=*=I0<13Y0K7~OfOJNVGT zHI$A+U2;ZjX1BzyX-TOmnJF2a_1xgWoX0b+6&D#2%JgQELUK@t@OI0hQH+oA3xU#T zc$+(y>(K?q_4B9>82BAXfd-BX4xk5kKX@b)8l5UPW5B-?&u7n3oV*d)3}_`)_-$ddMuP<(NJE)0_6QY( zh0_8^&%~1qNQRZ2LvAq)$5(;7p)}4Yeh8Ad$bO3C#xucZzhzFii*`7*1{G>>r@1 z1`Z7ExHcNYik+TxijM;F9B#cA(tr*Io(Hz}!XAA=&`3UWxWybG1nZLZ>=V3Jx?}_D zArTIqh9AMd+w(5;C?3exI)`4b_!Rq3(@#NDQr|Zj?35Jz&QY;1;*o>1^bOaP3$4(1 zarrJj38sHwKf?azTx7JSP{ywko%m)FJOg-U5K2(&iFtrdkLA$AuWbB4`UFBIf_-SW zC>r9)qotrk3i^WFqHAKil%!-#T`)Y_h~0b9+KWL!L6}0BMFiiaWF#j`{Uv)oz&kO9 zFbj#2vw0UxP=khtP+}5+sc9qxiyln^!&o$e&J~CpUP^jXIfV-8L|L z*u4TBXfv3046Ge^P%sxW}P&7n^)Z zj6YZfcG_k;YT~^&4QT(`j816KLBBeoDplr&#fO-VUA!2~!S!_7i2UJ@5O1h=NaP08 zyMYVQa}8tQzqnSUClw%C!WB9ZB}fZ^(c3;LExqe2Nht}5J=E63dsR>;zPiw3QdR_C zU>Yt&h{tG;hngC+>LBM#>9*BD+&$3c2lll^cotmLkqG%}(rUb3t0IU{4bA4svEz$% z`a(GIvr^kh_WsgFf@}zfYTzES&Z~!5>!bAT4QP6-P+6}M+ z2UNvfG=TA#5jzl3^70 z#B`FJiKYWzK$(y0+gNNO`}UG3c%#IWvk+-)JR_cccy1cKzGX35!P@%_lf&!_^olj0LD{s3S z_|=XwLi;Myqp(zLdfvPl?{VgU%K}0>REaPgRMN=Ovpdum$C7(7n$1?3Yk}{9WM@Da zQAH?m4flahBm~|&C6G}nhA9soNRfd+DdWge&WpN{mocwxCo(v`Zi zX%Zjo2Rm6j=mVd!;>ys+jBV%&k9`sVZ^XqroxE@10V2~Vx}d8R+|5|2OQVicvGn>q z-tM-!6w*Bx%!Sb&1n_BSS)86s^RD(yGQL=rBnP1F5y=5P!X^(Lix&)sz_p5z=BAhG zxO;1|Ler*1lu#R+bj&so8QCQ;oV+U3l=ZzdM1>lt3{dDnR$+*&5c-g0A*oNu;DW=8 zF!dmbRCWb{mJzj+vjUWOe~!|7p#{3#B!Vb=r$O2Tlfw?A_{yBqvGy6|9Eszzfh=`J ze%Q~^P5WJbE8WlE<@b{7XoZ)EZ1oHgM}6rW`Z5`XhuH>fIy2qQMG*ooN2pzIkAd?C1jI$VF zt|~37!KfQj@TNpFaMLU!$k|>>sRQ+CixDZK@^tS+$5-W&D5-$@D@tBIUQ5*Dxuqhg znuXUG1LmcnNu9Ea8MREoCun}GEsK(jk5f_UeB*;7IRJWuygS)2$}Qt|3it0A^>OYg zCUUo@AD*a>rGvBZT(z(=6r?*q?fqf*_l^R}^cg%@P#93_wK>LJwoY-7@2H*{*t+fsai? zLJjVS^Lo(m-RR?Yf^60K+$|yF`T8J4RdwDc2UhXl^nql?hx4wFxI2|d?_DNU=Tvv! zgMx?rh4kXRE_X{T^1A)CJg)-$mZiu@i6X%y3h&N7%pv$x_Zr=G4uiar-rp(Drh|6HsOZNEyU9$`hpQTPX z3VUa0P~OU^j?P{`Df?#`reXm4iF$wX9gVU({9M@)ex}+Fa}}cKhdfvGL!On@k9^Be zMsK*0qEGzD_qws>RPU8z-YSMA&%Kw8yf7$?!m6WtTlSPAcpgZKu@p90-;?t;9(YgD ztBnE-#ar*`Dqb5@OeCtXd1}YX5t)~Y0ofP6x>ah3p8d*iJv)})sP^nr9a4;-+Db8! zY75m7)dgzBaNbQ6V|l-3MZ3_loC+ahRXeZn<)L7{1Jjnw$lcVx5PYxZzL%T{)I`*h z*n~+-t-@Ir`~f(o;+XLGjGlG$b0%vz$|9^S%PCN>(UCH-nWPC_@ z&;>Y?brWEG$+Nugtt3ZYRWDxbdx(8dz>}A<==|X|E!I84DtIfTOq48T8%CxC$*Ly_ zmP%?B4KTRhr3aG&e?THtTxs1;7eKB+x>!aE2YT9u`v2VV(xc9@QR*HcTYwRfxngz@ z+a1|r3J)Q9ie4*1gCpoPFzOUKA=oR7UDU%@FqDo1RV6T4$zhg&B$*GSFaQZ_stOWL ze049|NhVmN8L%`?rG219Sruv&)>K}iPA97CDTR@|^b(+%h7_SnM9I1~Y_2sR6VJm4Q!M;S&MX_nH5RqyTU)&h2Y8sKq585<*eV6U8V5c}8dez%vD##qLd?H9QzUhpn{nsa;;_n$*5S zIwTVHHge3UE?y4Jb7+WpxB`%b289NNlraF@G>B!mjdllb%k&le21y2xMtMPF zo`-d2CMv_MRWy*SiGi}D3Pd;n9OGh0qzv8$kc7a+)F>8$c>2O}s51tZ#~4P|PB z(uIct@OKAQ|3CUEBmO_g%v1l|eP?qs` z!}Rdy!Tpr6|LHovl(dJk za18ucqsg_K-B4_XPz8Y*Y4sE|Dbxj0g$w3mg%?KP|2VlVw7cMjI8Hl;b9hv;3_>rY zWfu^^NehQ`p2Qqyj zzX|fFr>!@-mC<6$hZZVyIJ3Fj0QAEA5flUgCKg`QlFpr{7u;k*aMEbv(v*pzQ)idw z3uEI7lu15gB=YmLw<)TPU@Guz;#qJ>E$m44kU})z_VVPUi%?KdSg3eaD8Ws36RKQn zQY@d#4b(K=>12>?_km-kHCl3n9*iB1*6t#9O85=c@=#4t_zkZ4AuR+|7Jwtng|1jzN#r(gV{BJq;V~ldn z|IqNr=HB_=!XKXh58?+K{VJTF&7TxBm5oI;w8%82mES2`zG~E{q2k3VwPhT*U`tQe zR;eB1$OYRe{axi&l6w|vM0{YS*Rt0Yd`*2~Jzq=CRB{{QEUTQM?EWOpk^0TD(^EEM zoNMJqp3Y9NotMk4a&S+_BnpAj`Id!42iC3d_9-j-z+$l z&%k`a8P4|L`Cg?z_yRUpbVwg6d+bG&f6qo56ZC}v=r#krPys)E5P;X(pCg&GW&VPb z%|b&$^Wc#1;IJ^5Yc?`6DkKy%6HP`ZZ_AM~&i>t-<-hPpjsLrN(Iwu;4B&TR{{?5l zL;LT8`0>5|@ZZ4uVgfGD{u}9a{x^>Z`9JoawySNN+0Xb_sP281um^0C0A(Rb4-neT zvrxD|x9ma>>)0moHnCINDPep1-|x&wvSr74p{2CFOHN;GS(+J1qmgDL%{=OV5Au8Z z#2iMUNwymkW^CjFX{dwFXLY8UaLHJjm~oL!=%mTQ#YN3(+srE0^_{ZLtP1>J(HkNV z4jK{vg71qp6aH_L$)|nZ^--Gf-q1a$)B_Zk&ebT@f3ti*R=&+5Yoj1CSQWS zMwULsLd{CiGSfd^`ub90eDVWyi}b-FBh5uiOSLBbEQ>DUZBL7aX4Jhah7 zv=T^S%$o>RX(4HvqkOWRp!w4rV~v&6LssnW)%eeQojN&3b%KgtqMQTp80P}eG0si+ z;y&7FjDMFC{+0PA^QZm^vMvZ)CC|oPrbD)+oTZz8=G!up2Ba4lHyBTjGR!fA1r7~I znuiC~F(fn*pFjvT6PzA_~z5|n>yVPEi@ zKL6j#_V0}Ozr0>8SI72$%a8j1gZzr-f6&;qyY351Zb>(WDR#)}COmFc*YdGLiW9g=z291-eDv!Y3aUErSgGkV{+LPwd-q|0=`>YeXZj4gx0_1B= zMu-~?M?LiqKbkvU7HJfI50CmJN7FGH_%BSH_;cXr1pjnSOk9dWI_# zQA~iQrMnX7UHoJ?I{u|>KxHJpS4U?%cp8?Sou4K7;!&&@08T>h$$T=wzycz+9X#f$ z()GHYpa#TD&+>WrJpuXY$^QSoZk_Bmq14-k_V%q@WuB)~O2>`KJ$}hBj3suCf;;T6 z?6fmVGTF+$TJo8Sj?HokX2Um02ToUaUnMk!$+LUsxGE{i#dj?wlP`^ZL7tCs%y|LK)3?C# z!0{uzU7&Y89lI$lb8h&ErbL3DwhCbd3OIew4$Ij2} zRhhKCRlouHUHdz9^^8u`p$8jQB1%UwhN-MQxgb$;QLA;W28g|esC?3!#T}@^sqwOE zWemJo;_w>qJ4B3u7{|MZMR-y1FPU#~tP_gcAApP{Ca?!#02S{eV17Z0#WyfV z8O-Wg5ygi@6Qal!%{fMt9-r0Wv-(oXB;BU_Q)AnqY8HOQDz^`+X23flz!c|Pi@gut z7@HgQggd$(a7OxF8ARvQUeyf0$e|eNi3|{YGf?tXl6K}zQqpik}*7IFL7CmQ7voF(a7EnZkSvh3^1#M3|_+kBaP?m zIod-oJFZx!k68dljU|@?=Ska6#c-#F8xwkB?>*O2(vyB>Ol(gcFtL6&P8V&Mn2t0G zp;@z-%@H?*3v2xT6N_&9?EnN4#?+)F5>njcgiWjER)Yns9xE)I=jy7GD?3hj$4I`< zjRDEh6WN$SulZ?E`tU<{n zRO@qMO$SB991k1c~T<|^nNm==Cj|&Kz@(9CHrZOpy&yeO- zWf@l>&?Eh`U61PI)8PNzkoqh2XT|zRK3i^mljk1_wP&Q2yx(CNHfvVld(Q(H4Ly{ZWI)pQmHZ0tAZC91yU8>U4Z4ZtbJ0b z#xz}99cu9aLp9W3(xC@h)#I0B{*edG`%!0^^*o*x{Ih4s&w5)@43{uA< z=bT{N7XuL4WBB+5L6SX$hhz+T`0|SaibOO@Xzp|o@$!E;tQyMBycJd&RJi_ir;1Fe zge0}BlDf{N<1P0`vCbz6HV7h*q;c94*)cvzXH&#DidY(CKw1!$mOhd3?~`^XRRokd zZoZa*A^!qci#h$RaQ($=no;F8GGcUNi3}h~Qx5z7GPBx|k{wwNT|fkNDa0X6uX{ov`Nq!T#Ak zJNvbD%HABE{C0Z0v$xM)v<~*4Xxh{J{b`!;1hpkx>gjdeFfQSbE6ji^cnY090jvMA zZfxR>flJBZ105!nV_3!E#Cmk&yJ5Yy)&QtHsa{)eXdgd*)INRsq$I8>iC?ioawJ|k zy`Ek-F4cFW{ktRmWiM!3y{%a^RKF$--+Ea6FuzIi|73rsdANT+IA-~O+E~lW|Mlwn z>ZAOBh~HV)ja+8oHc!`OzkAUTv;;8$Y~Y?bN+H@j|KK^?wJ>JPI^feZoFO6@@(b#^ zA$^mwN=f0a19>86Hjo@H$S*4fG}mMBe7mi@1p`33U>GKdar{eX)4g^s$;qZc9vAO4 zDet-OPCmmJ1jiUSZH}5w%gLKg>AN$Y;Pu{VS~Ixudw~VoAYE!>*J04#(iXaLJlHbL zo0}Vhk44euMi6$=A^Fw%f7bd>_S~1?m~sBIys@^CU;k~aKYJYi5Al1-rmO(P@TT=2 zEHlu?UC*vZ3Kt(!VWwkzcZgwZr>!l2{yDR%{P}0RLU^`w@{*2K>Tf*1T4ANp=Ef3h z-uhPGvsVuAGUkEs#K~4itL4>-rtQ6WSy$->vU%aA+a7kbCx`o|r#mlUwTc@~@CWTT z7LQ_--d1F10c#V@{KSN4oFSQTULEfIw!fT08b+>k4H|?oI}|`@FP@@i!{2b|rv=g{ z0>#Yh?9$HwI&`Bb{~y7S*_O{DimZOiaKqof_Bunpzk#MlA948!ooQJR=XA{;KOwn& z3p$QLb4k~xl3uhj8rV(D9a(*l8C!QG9f4+kml~>?%VIouSx*g9?rqieF_~huA?eu!V&9NKqQH7iC zz{UFzHXfo_m3dBW8zZOujbjrxewE|{wD=ucaTn9~j*shh52iO)J3Kq6_dSQdoSg2} zLz^D8C#@HZ>HkxLo?6o7(V@w0s7YkIJE!~Xb>v${EzLSss{GYX{1GbCTeh?+`|N{X2AVJb|3jT53akC~^c)$xPS zz2X7@(WQv;wC*&Uyb{n$%=Cj^&l#^7*KP8m=T_b^arabwKxohw6-d?K1NrAx>Q!7`Zvh9ET>g~wJd5FfT0+c>VYUGDZ+Cl5pZ%`h66yyu@ zPwX9ZkK3zOaHWgWRwy1jjwha=F3}(edh`N4<@7q@i{*T<1~OaJb$b#{&~wu#YZy!L zL(k!P=#o*#acx^TY`x=;~lxy|(m z;36mqwdrn69zH0SX6Mb1NmV}a+2$123!v@sb=Vm+igtSR`ebjv4s$@u2T_QV$C9qW zEF4p&tG&Jx)oq8RlrQ|_p;qNGDGLGRs!?7c{x{$wlPc0vJk3yqRC}_2aJoO=+#{9> zpE>iCC(b+q?(})5Ak*j1I_3MBb+R26 z1KCWs2ZL>U+a8U!Lwg&v>FsbkaC+OIVQqH@e{Z+ZIbt&BrVzDcw&hz@T<~1tMiqZt zLC;yXE+k|Nn#(RMjVaVL`G)${wH#=Q84cBi_84q;p`p6{ZO`w0 zL9=x4+$@>ub?;Wa6E~WR6FfWEwuj+%yFb{5Q49P~fxq!KjGgVU6K!|A>+Qb>9r)|g zKY9)+J`1MiFVZ0J_3VE$?Z2s={z?}8$(f<1&zb~-=a?bdEOu(l+ z7**EzyOuNliilM|nEh7_!XMNGtWck`0vGkh*E0m?u+6ds=lH463S3x$y90b^6Y!i? z-w6%&X!y;w(3tIaK4p7OVxR1s{IRegx9Kz`HgXzy7{rHg%*SwluR?zNDR8K!gxh!= zjz8QlJO2Oi?l0nJ~e#QMiywC6t zpVR*vYpaj_{}8{4{V#015xM#OG90t^f7UBw=l?1G^W*yO>;Furtwd=aE&bpy{UDu~xtN|uB>?qR7F$%gi8pS5Qn;3qg@5UCx;w$K+`a@mc zLl19$yn^u#b?)!Yk3}i0&Nf4TrjZ-hU!T2L+0@B>4zFOX9XPk>4chTOFwd#$SlaS@ zH^fL6X)+M!4DFc0U*yuR(3qk(64yXAYmOS~jhff*Fslc2@|I-;2E#GY1`M?5O1ZLW z4EzqzTQe=uq$Xf5A_BeU0MNGAY1E)Y1HU7BtY(VWnn@og0dU;N4!r?+tZ2;YWP-u} zW8}k8Z6k8nm^NJ>nlsy&zV*TDSR4~@S~;N<9)YqU@ZZ7$Fi#_CN{loxB2lL|ehvCA zwa3DO%sVmn)8K;}e(>BIy>TR-uxQPM>{H8e?;v{Pl>VQuj3aK4=?!_8Y`$_Jy5bv%DcxW^ynEQRcie7wgWGNo#!XnK*50n)epq16+8a7ZuHdqFAi)bnG` z9MtD6beof*YbI8)R@y}&`_<%%LMa-v0udh~)1a-@QYd^!XnS4TQY zPSJfJUn*F7(9lkYgFz6v?8aqX>jOUua2?=gu9SML>$#y7+TGhNAZS44&_#C7ilPKQ zAT}+kve`~*ZsW0PNUu;zyJEmJRDt&@K2$Zq1C$8>hc1GqYC{uHStjP7h?9lHERw^$ zMcz!9QGjLSfKdu&Sx_Do;6?3<=~QyX1u^p!Z&yvbYC6>%gtQjp_`Qvi`ZI<1O4{6w-;-veIH&zeVn%iU+}vRU{{M5^rXf#02bHJOM#1==mJS7G*2( zAUND_6rEd<;6(HsK!p@A-a2#;g`@UjLGg7tA(!BCf<v2!c1P$e@0h& z9A{L9`oIV2(u~7UoT+p4#Bj1soTWuXo_t$j`O>0gwoTjQY??TS;(3=ervQFMMIc9s zKv9{1qhhuzX3Ed#s0&J^o)kqvKv*fjSXD8~;V3XxCt$3a8U9~pA2~{nx~hLlaaSeo zYJxi%-#LjU<(3dU`D<#cGq* zmg7o63&@E$lohTLV2}q~nf^{EtP%y|39Q{+j5br(t7VzkW8<118>lSCnn zU3jM0GZ|Ht0?@3905nyzQpEr?YwKH;GPA8PbUV-+JO&NS1{@55%{LNnkm3eR*YNT? zU**?G8)&c}$PPYH|4-L+UyNhM{r}a~XO*$|Pt`~L|3Q9_`v0T;|1Z}61?gPn7cY-` z|G!A@rvu&S47sr@p1yB`frOM<^XQ5JA+I?<+77URaLm`C5@G6~87bt|X%Cw;f?1P$`5V$A~ATcj@4R!{~<<4;nkpo?~ zEb{tZ57tLe9Q96Ma^JB+M+0=MWgaC+po}4{7)k}MLl+7K*YOQ{7^Bb&k<0b?2v6=! zX#8H<_{@sX^)SODW&(lQmQtKzRw+_tJMIl(xet1+h}Vepl#Pl}HCQWVHvrcW7gHR% zP0$YFu0XX)q)tJbN@PTwO66P^id$oNGo$S?SqSlkK_B$(NW0U>q&}jq##9# zJw*ktgCX8*iIe_CHX%wGQCZNC$rOdClWB@KqtlZXmLwNnqBwCfam(96)UnA7&Muyt z{~h`!DuHid#Ky9q)7WvWLCnX)O%T4rI~r3u9tvnvaaI(Zl{NFw3X6~)dOjIzMrhLU zlN&|CjXmD%m;+T=LAAOm>$hHr3h(g}x;fyks&HZ5?%D`@gItX$!8)YUR z&)@(d5L)_E#rLlRT|$-oH_$Ew>-yqyBS4p#2qcFrpN04@J)HKuS;l8BPBUVM2^R)Nq-9u-FI?oE(tQZ;FuN zgIT!32vb;16=d^Z`!6hV7{K|Tz8t@e&r$0+oM0G}17Ruh;kZl)hXx`k18m4A;06lW z@`ZDV^e3~nEaABU1;JcCH}p%U5Wm5Y$89)lea!Nz8gGUXA|3 zk&pz9!}8}d{m_sDY@g__E+6Newf z6^IdNSY{ACh#1TrTBr~ZH?RZg&p{(|3@ZbNFMuIdUva)16B#iI;T!7aD@>g!5b#)B z09Yl?sw6D59g20}&5BBa&0mMP=;1jkSh>k=W)G3V&!URQK z5%E;GGeOvOXwZJ};S zM3Nl^qJnqClW6)NL>77o;@3iVAk`l0-~iJ?Vd>EDDewS68?uutg-Eccf%aqvTRij- z2Ol>i*9I!-3G-!);#1imGD>Bpz1qFXiI6RPHkB1+@^svw$8)QE-#D@); zM592rXoyV;ZL%qYNX4T;EQLsgC1OV*JEBprJfRk3q!Xwe2`}sgmNod*lt5pB@99+h zWQU+F9_s-01Puct5zWy5j z`wAlXM>PH(|1&gMZfN`s{BvKR=D>cCjGFWTtly#XY< z2v0rEawpoZZI0k_bzWaRe}2E>1)mDZi>lXuGP=STv{A=Mi}c7WBamzB*O?4aSdJH2W2 zf-`4yw6!nAjDOnpgVGYm!^S>00QrbrC%}aGty?W31{N$>fKE#UGU~#gS5C{Q^SjuJ zo?o+S_^FY9{ephI$K{H+!>5MUNZpUc)SIPic`*DZKEHeCUiRvUsj~-#lA}ErNVYT6 z*AE>T9ND2x%2;W3#|KO`OaNHk<7MNhhTxmZjV}wAlLPMFR(rin+04RX%zNS!!^OoV zUElLcc)xjIOVK&ca+%5kx7W)v3eKK&NYQ$ml{GxjR?cg`Y6g9pkRW~F&fG-X2So~i zY{j$R!#fqWn9^u8nOHyzkcR zCYv2IJZWsh4%f2uufQWLn`!nqc(MlTuPuvhU!>a2L(r9JAA>?fJ4a%LI&1Ogq& zCKbmHJd49v#D0269X{u^3ZEwT+N&AsKKlkog;D6${~&vfi_5|7`?qi3PS0P84M`ZUts$W{h(lhs*@0OKrM{ zx@sZ6S7Pk&__UpKCNd8QY*KLA^Ad+kH<(r{vz+K_?Cd5MTEzG*uc?=~w2lyD2gr{d z&h`8yD$>`tvr54VeX8P@=rI))6^L$T)DZFQgT0oYa*K=KXQz8TcxP(drsp9Yp*pl< z>~MK_zY3tGr4>-vWbfr&n5;Vd{QgPCVjWvLJG<*I zxA!mVAQlp2<<9YR$31Bc-d{lf z(6?wyOT<2cGmVI9yJ|Mp7ID$Q4rdb<*EHKY=ZJH12o_tBN6#hZ|~;z_>hr**0nyDYuqK;66S0AE2gV^TwoI;BS(jR ztBL4q(MV9xfRq}w_FOGa+r>Em$mL0<8Ul^Ih3eYqvp;K{bqxx#0j~Wbz3;`Zd-L<4>wdtgR67EJeAGPb*F6h~M542^Gc?0*(!FCM-@U3E85wEJ zA*ZLO-#co-=q<|bnzOg;2=F-n)+_X-ILr-Y4rd;X(d-)-?%y7}<5!87g4Y`|Ef~vv ztdooOm0T}fH!bn_#Jgh?D?_^)QWme-KI2D8!0+NA%DRiK#+tj;R+(#PFdI)h0tTDj zcMT2>c6N5^GS1l&2+KUL7%y33XS6f=WXoj%fAyg}L;Ug1lX*1ynStxc58TJ{KW>a= zH@MFOf_rFkK-DGs>=Z?5AFGISwb2GaS<`Oay!p9P>3Y|r{Pc!<36b2gCm(`d)n!07 zYGcQZxT2z>=T$qN1eT7zdwuV)iSEjk9&ZPbhT@sm}TP(FDfE61amU_7oWF?B?Mb(FQ?_P(+1~Hla zA9_tz@R}I3ht18p;TF??t#JqI`0P`o=gQ;D!+Pf`DXFNdLsmf6Y~`6$!)j#>b!1JKaYqW!xTk;38p)>Po0<8WxG#`||eZS6!w z!^okR1@2`tRhOeRH7jp*O$X?l%Elx`JK46Y+`79(l4XbJZ@9%54vu zEe+1{P24Tt-)7<4)o^M5qH=k4HT8uHpYv3mH*cPrni}+Cnh#BYl-~R#rvwkDy_nfvPkWo!hY!?_cP9N{ z_1VeiybGWW%u-KaC(E}h<`4_w$s@~}7`65nAY3734uBGUWl?h%+^W`%Qv&$;1rO&KP!A7aCyrdiZ(0AT#BCv#b zy0};y2oBj)61~zojYCY)&V~%XdemS=st$GF`b13JrfYd8b(|sdvrp@3Lsno*a8Kcu zx+}rQA&)9KL0T$!_2opKafDW7U#MlG97Y1n*c~(e;ZWgq%f|AErw_8L)HnAHbofYR z&xoD#;HJV-<71F`Sgfj~Bt6;vY5g~$@%D9hw~f8u8S1?*=-9kC%uIRty4u>$FAtDk z-8;4gvToGXZBiGNS@l@@t#h*KTcR#_U#BN2Z3%yl!&Lj>YJo&b&;2bA46{Z&N`{P0i+^J3ozm?AML59jM<_F_O?xwWIL*VC6txUyUqLSv73sX7`Hc zKeKAg@e%3z8Lqkia%e%QU2uI`6Zv;v1!T33JKho`ddB=PE z_T?d;N>@qTxEzzTYgb?RW?$bE79UHB@?`tQKbAc^>lUUQJIgoxa8`f!+)m|12?p7_ zfv)Zx!spR@KQft1=o~jw#*7aIWxq_+@k(p>0fNsV3xHYi+CeQ>NAH^nC_0?VYx%r~ ze94Ut^X?O}iUVbo`tp|^;0#qMOxtUDrN8r*Bre{R(7$JslA%vREM@(@OwZ=RVk?cM$Jy}P8Ro_;;zFCKeqCX1vi`ro;vtw!H zk)`sG8-uQ85sZkHdFu`tXaqee9c41@FdKtL)hwgNA2Eg}#-1^NK++SZ+IR^kz|Ov5 ztHSB4qpwCDJ}iI#gs95Kcc~V-oY&OW4tU#n%W{64+L(#S?#9#6L*v6ri*-&#pMPV$ zij^!-1*RKFPya9Wz5}eOWotAP6=K7N*kDtX-iu0=CZIGaq98;F2?Rp|NvMK?*g>&Z z6h*OM@7S?n2UM`4*g-`U5v5q(%r40e1oYf{?z!)Nzxgc5-ZQh-tXXx+n)Mm8G{zmj z6z02PEM>r$;`@|dr3*LNKi(gD`pl1(TL!^5!l<*Vx>!X-3{3seJmaz_k5%n_Aggfxd)a2k>0j%DkFwXkF8Mq+)i^Bkl5NtbmK!&$ z-KY~QnBBevW~3e%Z#>cP`nLKP(@S&KS_>lY6&CK_gskYC02)+HwTaAZJj!ka_Zd7 zZ!hk@eCe8y6`5FhqVe0beX0CcDLidV1aQZYi%D7f7kjRy6pQ=eR%H_;uxzoy+SRN>v^mW_jk? z20LlEY;tS$zBXV^-&xhAURHeO)#YA`w;tZ8Kp9goZn$<+)z6aDZ}rjZ;x%7q8n0sH zz1dmv6j{dLH83BX%b53hC*5|e+mDa)>||{<(`)9>pASNrH!oc3b^yPz-|Iyq&jcTM zK6Tzl+v;)m_J+28H5_U>!hXUI*Pwp4x-Qju(G=_&M08;o9}mM%|k1Er<$Y~Ps^ zg^{-`vOGLhTwC9tpy+8hJvmgpAYF#uf6hXqL5a_m-k+V-qu^TcqIVMlwlkR_YEFe? zDfAb|szQbuA$w_OwVs{*bf6A|TT_5@{I+~2a4A|n^rmf;yKQ+}Q&2dv-`l|0*vHQ= z(I`mC`gaa2{i#`$THT56!>kK;J@$0IR>*Z4b?2yp>KfxOcY~IXUG&z2mGSXhY%j{~ zL#3RvGft0Pw!b%bW#Xla3;K;8H}2q}L+5rLKMYL#g@t*Qg|Uu>7O5i@f7<^1wtCK- z0kf4xalNLEZ#p~pa`uPTa^DPX#=)%bb+Zl36xP2F;(GALN-I=nDI7n1`0erPGlI3- ztc;55PQ2R-y!Yx?ubNX?V|2%y+PQy!%*}P?YBz7bIC<%e;ntVib2mOX_{zm$*6ePD zr$MOZx?}X&AC0FUE|FGA8!O|_P#-IpUbERRZLGtRkBj>CJxss+rtzIu-&xvm9;fGS zn{XcZ{D9$xoMJD(sh*am?y^|$?ykO$&NVB?*plNK&)&W*z8CVSJ91>^(E-Ip$8AQB zWATgqc!BwsO^P!Z(PxURcH)!DC4>YhCd&6;rT zK@Q)cN0%-mR~!B;aqAsJlQrn^wy!K(S?aLa0f3=`L(A6>A5zEV@Rw-ha2- z^N*)QQ{KFZ-IFxsN{^BxKR?$GPl73a)hnEbUOmOU*&Db@^TUI(v)}!U-lIC=@G;IBTwfiRN46W(p8Mt%| z(?%qYJ6d5=qTtZn+`Qf*I&VetwAb?}>kj4u&u87bw~oyNYH5=uwSGODD{B`M}lsRL{*(7S}ySyXi^4(9F%bR=V%Yn%KSF+?Fj?u?z9`ri6T+K$9)wB5KD< z=e@B1c)q1k6Zrn}OCMU?9yDsctn$g=3ZwhuBH4bAM=j{5Hd*h8%FLXePX?wJ`KQ3o zw+DwJPB*ITP}Df}`YCHdX41I6M<2ZbfTWkqsY?k`sO_yFP0=}Mq`KeT`-AUTiua^R z-JhzxbEZ`6kA3lGZdd2<{X%mQsBFIM_IZ| zKuNBl{gtu_wTAm;D4L%Ak8SI&-)qW*3Aw8S83w*5j#6OGc&(CGp%Q7gl1kk zn(*P(;+1xkA|)4BTmH71N8EksUiz1Yj5=mXNn13;%gP_A`=Lg;FtTdO&Vs0q+p?+1 z>@_!;+(+9DrRU$BGiT0%1q+_O>c3QRrEUD~{hK!RRXx5XbLMPQ16%d0y*R znv{1?(z31k6yxGPCLb!3z8oqo8P|8B|LeNL^(IS$T>4R-t_=91Gj2GI`_ge{(kjcLQ&R%V4gViLb~`1tsc6Mm}KohIy1EdJP% z)vtBoc@6oq&99H0jNhPsvG&5IXE`!U)Ll4{t{-oARiXoj+TY**CX%N3E&1hAms8Qm z(;FLi7etLp*xRG%SWBtYm}UE$rdAeYP0vNF*ZCwJXFNRI^WMIDa)Tr714phbuBZ7k zR`4>?cZa0bCY*hgap1w0kF1tWE0+6)Ok@u5WUE}M1aZEnXRksxUhSa-yK}O89<0<| z31TFvCfBF&PCNaMc%~>Fvf>AGyZ2P0D-AIW(Hk=QQ^tq0XAQzkq%WP1AAp=c|D3XJ zYGy!4GxO@QXr&=aGF2B|3{^N^QE~T_^*)2-m==vNI{o^!Yhza595Lq8?IS{X-VIWP>VXD%FWbW3vvdS+it-?g(A#O2)yI=CAX5SN9F;@A=}9i_GlslIH0j zhPAX-dELlaYsqJR+GKBh>z3+R_0X()6%Y1>?D_Ha?7q~NHxIVB?4wXr&!unQwNM+# zi~N&-v?d!ZEmzqq(w2E!>syai%~-!;MSm5Q4}0>mB3I?ohPf{6Q@vRI%t7~uA79Sl z_Kz(YQ3n1XRlIvQBiTUpuloz`1}L%lpNJlY2~AzwO%jX z*VS;4<=}4Hw{4p{Z=PeCnkyy$^Lp+Xc`9{bcJ|k~Q|eDFTXurdJV!y#ZRpU5)sMO@ z>9=Ri5+s&axMRn)t1slzTz%#@^!IDn?Ygw5pN~(sCv#@IP8sj&s_=Tn`0;kKMr+;A zojYfnJn(FQzxj!z-F0SV2dPU(o!#z|=h@@v*1=Bx{_2Gr&fIC7xohi!@uLksMtAcb zr=8z5ASC5eVqmU$s>hvqpSULy2bD9;VxGnu=GZkC3!~0 zg(IzxUmnr8_0tjQ8_b4TUAl*bg;7#2eKAWYdvBKE%qg;ZmyCO}~gkU4v~L z_oORa^Yec<>eyQMx%cmXY-*anW{oHFP&(fkJluZMvfrCWeKdafO`hERW_#}4^72CD z+UmhkW`mvkKN%@?QEFPuqpC*=3Jy8D+}tK)+u3^iPxkk}0C*xUp)WFfR6y4r^Jg|a zGxKLSJ0F>LPx;=FXB0X5#Yw4b_RG?lwja~GEld7dcYEjZ3FZ9`O=2e{t(^X4%8#ZO zwab=`%etA~W#aKwUuzaouR?- za|WG^?>WqLME%IK$G`5}e&+s(#{R`4s>~D?Ps>Pe@_#$3+TPxNnT9>0R&!VRy~b{C zK;)z~2Zqfu8eDv-kGzWS0NT2BiE7pR>n{y-Is5ZR#)#z_r?xgWj+-%~F@OAkOP3T6 zEPeRiOz%e1gNWW$2{glE>Cw42FPzV6ag0$u$2rC?=_2*{>1Bn6`b^Hz9peX@j%nyy z7D#!hGjRIuk%dQ2#5JB%aLCe@m!AM4>y3O*xq>}MzW?~z?O616ZNq)rR}5LS)g`;6 z)NW>Jo^!_g_$Z?#jO%r+btiS7vp#%~rYQCa{gkdIHF4JfdhK4HmbF(~8sB9Pv+8=L zmQ6_mfq>Q19Xkz+l%%x2R^|5Z8^(_G?&Hu<&7JY#bn2x`6&C9Y3d*C7yn5N+_WNhM zfZbP2l;kKqlq=26%r34~td>cfGG)zNYIdY-nr&)}UdX9QtAcg!Hr3AsEYg4Az>I;% zb{u_YIqihNY~A;BMd=49Ab6PB`o7}v$x=6;!iFq$>7v<6Qtm%n?q%o2PFiEEagp+L ze5E{X$qvUCjYBmYa`=ZH3>`M?{f~fs@o6;%Iy&PbJ9UvNbr$`mll$U-sRe ziB^=9pQ*NK`(=i94=8k&ib*{^xG73;PTI2N>ZdomZdv%lQ{E=g-|>>nvuDrLwqH8A zMMi2&)tRLwrXLb&be`tOTmd$@@>KIE3Zl_3O!lcJ-=U3YA7$x+^5KtqtoqYuxuF9Z6 zJ1g{h%%{vK4X|84x^8Ywm7S%H%?PX3uEoWR{pVG_GtJ0wY@VlLTYh$?AAL)diQBy1 zG}@uplbEj;&6*YHd_Zc4k__EUU*C94^My61Xa2lzpAmL$g61W&Y$A1O&Qp?LS;UE@V3$Xmh^>GN+1abN=R13?DU&HucAcf>AV-;&6liPf+3$_w8uw)nYWx0B7`?$v zr{E5tx6Lv`OG~E|U>Ofj>Yp`y>7IP^B^uIGz1-eNAM2r|ayL7=_Ws4spZ5kz4Y~K# z+~$dNNM)ncu(Fza`)DB{8}qbmPd#y{Gn_KYX-L`!+tC4(w|*4``B6!&F?FNVHFGu< zT+7?yc>4~WGPq|~HJy`geN|;;Cef1LoVjuZnc(rTi=Lv3P5qiR-WgK-lHqRChr0DW z@aSFMmXoJ`v^Z(boR18Q?^p2LidGn7l;~D;cVMQJp^K?()2&&DS1f%0=osx(;sM&( z8BYY^&lGZv)$?cmEHsT+Xl#-AXyK(6CF{aR%e_2%^fYfNJdti}v_9YP?5V_O4%%sg z@5zhuyz85Oek*;Ml@*qmKXz+;tmo)?!^e*}_3e|^p8eU%!zfLk-}I&If5a-?*e6r5 zC+$d-9ldMulKF39dtI12Jo^5}C0YdzawBBvyQS}s8aY~hnuGDVtOu=M7HzOOsUo}N z$>w{?GI7o|xw2`V8!T;FYPQ72#y)j6bU1cR_4&XMr2{d~BIE{1P4V|B8TKu&fc>p$ zk3wreNzO1N(|qXP3v6Bg#kMfMnW;`L|N0lA@O3gd#J zqVDmlSEbqAJKkMNdFHo<#&?H$%vCsfI`qntx^BH~2lWk87=JE*QeV}?_YYriPsJi5 z6Ik9$o?TWM-?e9;{zbjw`3H)3`nJBWZ01v3O3(MxTr8U@d#Ru1!hw4CPb4**DlgYs z?=hfpW=LY_y^|l5)imb&%vE?@xiM#G-1Ccl4?Squ9Q^)rOH0ehs+5NGZpupLQ7cAD z%LZBn=I(lTz-iS{xgK3V(SDk9N^-m^m0cPeuO(CkceiHWP75Z~&{wqV-)-%36 zY^qoJ`JQXqt;hVkekR6iPFOz5{qgy65chrdf(4^e3ODg1?!38^@6mkgb45Uerbpn< zAFX#lR9E}b+Th@}>(}>uIGyl$L&BLufzxcieSAs#VdADc7LnfTIY>I^PSwvDIS*=A zeqY*Pd&GCU=hcIH28#8oDyy=LPE=KF+AKr2j(#|I-x}48@1}!&>XFE7J6zVPi^r>aJW+w1v!dR@)#mr*Lm_CPO%1ScT_bgd>HT>F@8k;D; zuT4!xv%TFGysEjCcY1n5L4l63h0N6AT2tm$kKB!Hi}7>jtje~vjQx=!@6gv_{(-q! zSuaytmA}Rtub-<`eE-v{>&urfS4pl><<_cbNttb}DvXs;-OA8OPB}K|dUa{lP)ot0 ziUP~n>P`0DEAs=*-RkWQ{1|miD$*?{jM`P-CTMzQP;z$Sloej#p2NMbxXGvSNnUBdJ}nwDvSh8P%amm@PmY#Sew+J>;;P$CzT{Pndr5t+^Yag}E;7-x z)V#(on_qDE`x~!2AxVtGYc_otHsSv8E0YhOo#V1%%Kn_COD6;dCV#1&%+((AJYmAt zhJdq!N5@6Y^dE3MZcmny`sxoWc(D&1TGf^eni^oMl3-T$F2kA6EeZk_z%A;bQZnT+Rv^qB3Y{;jK-pu$9%5JR8%nw!a$Y;;# zYZ84F6C=;h-k8^t_d&yc{mrAiSJ(P!dXAZT_25kf z`-hoZwrn{ftA4ti&oy+LD2YE|{!NOilbnzL zm)5H6<_|wN?k#9k%3M~Gpx1Mh!x{zeiWXoR-wxqseGQrw(wh3{XtYe%9>7bwV^I64 zyZ$MAM}?H{EsbNh#Qyl!+_L_LO)t-!l}j`}o$L0X)cVjOzWe;jx&it!>xLH3=Fj1u z;JtDjzp6)LW@_1>g68IC;0@;GSsy+w$D7wjee6)Hcs(ntN0)wxx6mPXM)JqK z!Cvuo?7YMF%bdJl^_on5j@X6nRy8XxfG^=vV{N`=Cxy=tBK0J8P z(_c;n(75D;)Gn+a+ zy2s*a6eZu$TzAj9A3)trspBY3Os!KLZuRC5HMyK1X;uXG^Ez3|k*W6Ie=kb^~ z*LCqs*hI_SGl@Fu!@^AcY4@1>f>sCn3HnheJ=9Dq4rl~Y)lz#8?b5xLqR_A3@tDvS z)6yObGQ0CbzRi+;U~PVPLjPCGy=;$vIMcdp*|Jl?TklB8UMVf59b$R}20m2Jw(fgn zjamF1`njkhGaD=N8{f^e7Su$gp6)`Sgj3uuER8RDJmkcskR1~Sju|jAX8q00Kxl2h z+<)BL_I^Olvhv7%m*$;*7VOJAob+Z-?yAtU`tq9&jCFIn`nF;holYO9H%Xyy-@aGw zzVz%`?>b>Aqjck`$0r+1Ou7C0`^n4?Dsr0bld?`wo3+8X+C?dO?%v=FE{kg|l6beb zy1CWYFWy?SZAZ7N>-{TDR>(Yf|8PBJmbOuGMFohF_j!7G&1%;K0bAWjgaJz zPxoqTFJ&Iu9Z)1aa8ya+AobZG^c$$C*lUo9Q}$uSEoT)lXN=I}zJV-s=<&5umB-WA7t zb2}ey8w%JL(tV%-du?&jBl%6+(>J~gI>mI>?iZ1q@A$d<@n`qO47lyi?)uPUTi%7& zo-PwsWOVCY_wdNHZ%y@gws}m;zY&{mamF`$)dxUgqyday>lj0o&rxgWWWR=)8tP$03_*HsR8_K$SXGDJ4^(eGUVrBZ{{P)pe z#ww0cv*c!9yLPRYvUTF~iwg=13$=Z>X$&9!xL4N6qW8g4Ew{S&y4_zRea`OPyH#d> zi@ml&`|-(y1ml4ZQ$8i1%FHppxp=@9OWw;Xudc7oO?)mNo3kTz)r)AFlyddH14%%u z1H-pBFqLEeYLq(0~&1`ii^i?xwWI`Hn`7F?fOAQe)PNn zWiwKYVNTQg*WSlXY&s8IC^-L-fbWRg{-cIU&%tvO0P2 z;HT#5+=S6*9&wiK&yatbmq-CV!)%3{t4c~s?P8xhjT<-a9^m)$=gmIbXKr0yT>j`7 z*Dj?gCNeTITiK>-&%x!#xU|^Ou1Lt|M^eX9dw=Yjyxe2SxqRDgk2zq`uqC_1qB5M2YY+R+zU=vG<3Aj1r~t#;mPUg zU+eUp7TM0aKX~#zp0!|;-0h4Ir?kbF-@SV`e%!ddQ;sjo$KB7&Q$EurOSeR-zig0MOElLTVSHp zfcJLt@m?*eL*$hus)Jn~z5nv*)2FhsvQ3+iJtdiUGoF;akC9QRbC(|DJ2>+Bqj@sD z)-AhcJhFOjN`$4Itl+-#(;?OinKm_s!*A~@Xi;gL-nd~wY9T$K=%-4gf7ElYvg9T^ zDW#%;@fV66C=`mdzkn-{gW@^e=7ZJo1}l@JPRR+^X-2o4J;LA z1`x|g@tYZ8-2_<9)^;iUl0hMOdpDLaf|O7ce}UqG9leH!pW)HwNO%k%p3oQNiX{@x zG7@3(0~9NGXrGjSHU>|WDauF75+$UK5D-aWiL3=!2|a}Rt3(A7(n^Yy8pKbe*xDv7p`&>q06)MA0)q4~ z3o4f<`elrE5Y1ge4+WfnW|BbIp`3^~80ip69N-W|q8HBdah8IKEnrardT~3EHkKL< zJZ|iCJgPGp@cJ2;M3S9^pNuA9$YnCo?2?EFIb|vs2L_-gmY4!&PmSY=@*U_=tzlLO zTOzM2`a_SJ5XquP5~(i$bZF8rcH_sf1Xv0SvQ7tOm@xMyFOI`uMc{41#I1OXSPBlD z@!)VrGZ0a#6qpBP8q9hth~yKj3PqB~0i%vlj0GtP6Qr4A4B zoX8a{A~>4-03~=R63*fQ0|Pt}B74a138t}_V8(`9p-7q6H@RIyltu$#@ETh7u7B3DOgpbAE8} zUn8Id;{C4@EexjOfo+NRRG2IX_AQ>p69_#5eiC26h=$j=f!0u(zzRVAlTbay107-D z{*M9LFjQ~QB?81i9gidsGjpe*aVkvGgcDN$zQN>498}xrVHRD8P6QXo7f^3;K=|Te z2CujnjIx4A;HgGLqRtSkNEk6LP)}NFhHBbkz=R$cMoBcoI~WyU0m8|0p+~e$MgeAh zLKE{aqVeoOC_JEsP*KEQ#l|uC0=)ZTv}FkCBpM>bnh|X)VnS;}@Dp|fW`)PxFqDH( z`iP3**`k5}!$Hss-XMVRI3AH<3idZH26ZuU#}s;4JS-m%4-8KX%*ul$z9K9r=G3Ao zv#?yqP``$Tu^DLNXqGWi(_~!uu*X1KbtrtIYw8fK-;*)4FghA&$02bsCk@xCxH#hs z-zi)?Q&UH9eF)(Nofa@qrV*im`j_Im5v53*>lV?*L>Z6BNyX9B-U1fTH7qoX7#(#E zEUE3HJ~U!NdqZd^ymOXVKBYKjCCu(9c zk6pV==wJ*Nq55LS!Et~tCrR+I*(YLjuzFZ`gjz9_kK1NGNhsvSZJP*=B?bYeA0$vS zLbN1yLfZSSfeC#-p%2yxU}zNnMlT<=K0=VQIUX$uQ~{oy2Ojk zA;Y4;SlApZ))Dlkap+7Ts7gR@qQ-(SFu+&`0Kwwn9ZGCAg7uv&j^g(>{h!W;Nt)M0 zlVKVg|LR_!KdCVPeEyD4`~6=)1PuRP7;u-@NOSWJ_J5(DHv7NKOiWEFi22`(hUCxx z@%>+t#~=G@K>vGSbiV)3)YQn-qRsf5k2E&=v;Xg(_!#O?iPa(fUu?YtUc~R*@(6q% z`#9ik@+`#?_frv327N8MHYt66o2vq;2$mokXF<#!8nv~DCYEO6_D}}^R>v2(5Nq6L zkF*tg77iEM$j{W^LKwOPXAr4IdW-`Xe-;{-h}MS>nTRU39t)g7Eq8x=+C*m`UpFsL zny0^qHjR;6bsNpaWQ&NT8edST}cPS9?zk;}Mw`Z@b}+Pjm>q9xrp*jlrA4S*ATes8qNcjYS6| z4uZcpK5(7*Fu>6QWT3$fY79ijT@QWB(!=~lbRq%K5l(j^(}C*;sG`Nfz9Mk^Xt1p? zE|<*+>bX{fUs2WJH#K3GjXaUMf) zLJ5u7*dU(%?(W(MS{Lr!KzmH8sTLL*E>sI@XjQy3Oe;wp0sZ(Fx`B6I1XzfpjtEJD z=I%5hmTI8_0i4w%u2~7iLbwhv)@hG2qzXoS7A{7=jXhpfGz!>*UkpQgG5(JY2Z|5q z+P~AYHiY?S1_;$s<9P%Q3#7ETBis_q8ZU})dTGT8a%^huq7jGA`@P^gwG8aKugqKltH}Sp4RR7 zK1PE4(m++XiG^SsIK9DTiV9)+Lzv>OVq+4&?H;i9t52&%=J{+@Ow18IjqmUFVq{vX-dlagw?&$(QSZ?M(g(+nI{kPF%WK9GvgOEeL2EG9dOA z9SiszW5GBk*`p)zASkWf#-F50;=;ekgJKLQVn56Vk(4`Gs((kZ0d!FW$pnNOR7`>- z`sKRD!4Lt$?F5MPX#zwCt~%PF)!H@opVJ$ijv5>b*mD-2%q$|&0Rkbi$=Jpe(b_b& zA{I(4_3!{@a7rIt^Vb4CG=s;YhqASSY+zU1k>m)VgR9>*x&~dB5wR@xf)|$Q)wmfbHTCu!SKL2eFkL@nJ$UT@>(;eKP@<+Xgyc1X&FyXetH; zE(>U}01`%^5AZ)Lgara!4){-3w;dEX1QGZUfDvHn65*g^7ScD?CW1Yp5tKYwXfDKw z4`O&$j2gj0Lagwl>hS@w~eZWhc$oULH|YoZ2Wt%Z<{`$lN22U zH)v5dy5z;iIx8ulX=mTbH6+G961^OPnAwJO2mP@A$MI9znWmn+-~O=w4rj*pQfeBhR!Uxl~Mo_;!T z#~9%$xA#u5$KW~o>lZFJd=eLf+In>IK?|of>}4EDl7(>~jO5u6(ImXPb|ecp(KmX%I31Xd*`leNAR15!I*?-4+SoN{3TFu5Afqh76hoe*=Os_AV4e|t50?#moL$^}{d^|7c{({y5^IPKSuu`>!X=9x z;dOS@t~;~GV8#Vk7sUuzZ~!an8{-jzJm!JY35^Q7sD-y=MU|I_iD7R!egVM-wXz2%nOIfCoJMfsP?;fe0ngn!38dHn0Y) zE*}P zKmn51is!NbhL98RuguPrAWAN5!}f0w%bn&B2M-@3VOGQg=$XL-xUl0R!qA?h+-+q= z5C}3iO@Od5qF@6XLj>u-B*uiHZEE4Q$)kV@SqwS|0JQ(uv2g7;(3uccOr1=LX zCkkP)wndr_wvA1?pxP0GC@N0q2-GqPc)*n6Q7K{z)i_oYhD%67Bm+IZg$^7%-z9<=kQiyNL`8vV(S|RLp2D+OPh=-aG4;L0GhysBQ3v*&qs)rLiC|_MKKHK zq7fvqiawRWWo!Psq%gL^XMsRBL*Y_RC^`ux-gqiie34ejP-xFa0jIG#KQD(o9EBPi;cG4=p80Ky(wVeRSbLxv%!h;V?bBUEq1 zR41IuLJ>gKJ4C<_v%T7+=}y9)K(8D7j(gG~3(O%+CyKDsVhcSy!nR^VfLM~$7Wzn} zhDDQ*VhUM&ks(IHoF*9uVwVC+X81A&(jq3vC>Ua-siO&s0}``1=w@pCs4;oMm7l;8 z0Br+oh;cBP76^8NM3b#)iOmB;OHP`|{SD3|KDevbw&hT~Wi$+F({eka&Cnu7#7JA4 zWI^CmJ5;AMKe9TJgrYIJR*3IfARf0V-40Xy?1^O?uj9mm zJWL5f+$2S=SY#}D!m7P52qy>dg3zHv<1_rshJ>wf;fdH6RH2K!?Di3VC;JF~H}V&* zX#uEWFGy>|7#<`eV+gG)W^PcPh6j}3Rvi{Uk|A;$I-FU6J=a4_B}K^+h=LJ7;_Ly* zsl*OB3pCMO4H#pR_Gq9e35kx+)px%1-N|4|n%(&2yhOWcMHA7q;(usX5qFZrHI}wm zOhqz-FdoJs2yF?M#0Bj-V5+T6m}@*MEwEYGiY!Kb@n8a-FT;f0NT@B^v0+DKf*-M2 z4U)^l5{L&6qPVubZw+`1JNDUrM2Q&+)F{ESa1lEQhU(LOot?+ie4YLD5cHd)zYqS+ z+0!Z2s%>4&pkd!(8*t8$k2QpzeuI;xaXk1RJe-D28Kqja=c$fn%-CG?SR6dzM_OZt zPw_1hkiP%&R$_ccPUw82nL#jS5a&;K@HGahw+`9>k3a7R@HcfX*6;O{9y@=@}6dd6{0}p&@*ZP6~n-EG{w;WNS;Bsz!x{7aa&K^4vHphq|WZEz(ffAPnVk+7%m8~zZr zA=p#&t9S>{sa{F=lNK7`_~@XdU<3Za-l1RddI>yW=CQ}<*Hk@}_u6$B-@Izi=Ywd1 zPuf@l%mI3~HHJ7BiN+=59i*rm0)&GG)3vnMhVpG34g@tdG)FJ*$v$o_u6|HvC6^%` z#&GQTFov)`v50~QS5Z0u?d0t1=;P+?2b5LEz&k%@^4Edl+OcDR?$`+zV*?Wd(@vUC z6?gwIBZ+2%mSBfa&gC!?I@>x++Wmx{*cFyV14r`yWlU`mUIn%=#~1g}$lC>IG}P>> zNp=$9HWiWMEdnZR4%-by^c!1&AxatGZ39VcU(+4c96(aFa1Pf)RSag!Iw6WA7r0Z} z5GGYJk;LErPf<%mF2HU0{wy?SCG$i;<2bJ#v-du0u4O~0LR_U z!PDNuSr0d3gr7pF7x6_X)YJZNpHBPp`A>g3J^vZ`_rU1<{HGB-`PuILr_sni=Rg06 z&;Re|KO@oepJw>+Pg6q^Q}ET&%*@i<6rqRmfaeIT0Qm$c6KG>5UYiyvJo_koAb!dd z9=;S-5^3YMM<&4|d8kCuS8dK}iYr%nbUW(rD|TQt@dp1pO>pNsir!5d5(2+u|W(BvBcX{ zDj{YXTG%^n@QBHXMbtFf&2p$AYUV~pYM>DhZ+kzQmknA8{qE%Eqisk!EX}3j;^*t* z=xc-E#!AD_fKK&t7$^3GD{93H0H*?%#}a)F5Ws{LJQe?K397(mw5jqiAw5rkc-T97 z`A!01jkmkkWDjRgKboJtkBhUPjhe9$h$XBb3=lwpf5*DpyZFLypfQ>k8Ubk|`rI}U z2>^&b8%{$|sU7#!vSTXHsqz?HeL4v=0H!gfvr1Gv|8+Yu$VX2LXYmmI7z7&}@B-GR z%F|=o<1bzyT>Oa@!sa0QOhliLkSqBa@VQhf9ZphOQssHku!x3x2ekR)cK&mp_WIw) z+1|;+`R|1BEC0{Lv|aueQ{zAW-#_vpZdyRkIfL)*Zw~n@w}nu>;r1B@0@HwobLo7z zp$6V3C%PaA?veNnFY=EH_=i623 z#o$xb5nnWcz9wIEWeF(PrqgxZ0D z(9!FlK8WfNFJB~_0iwQe21h^@IfXXBH-h+uBkFLX)1AeMOQfocy$_2+m&5hrIK;wW zcoHWxnnkDKdF|1f9-(vqViFbaAaUIXu_IV?nwHN1G7Z{bMX>NYh{SH>!DvYG$88Yc zjZ<;2%m#Db3^XQEMSdml^9^v<63!Pv6dci;U&vg1hB>F;mp1xCIB3{UlBZ0?yl5DDK%Aj73flnB!2n0l z(LSP~5~d%~K*{2langTVynp#=um9nOG5+700q|eQ|7T%j@hAV^Kk?~k{PF2G@b}+` z(YgIMHXdozHvgZ6g_-Fe`~OdTyvNJP_6PsVQM9)_FnX~q&npG|$_0PBg1=ZSIBbzs zuk%I^^>MY%esZuKs zEOC20Ed5R2!7r>+%0IbYxzr_aqc_8;%4p-j7`t3m>ArUk@0fP(@WvjAGDphJn-~_^ z7-z=cc;R)<203KCS@UY?;;x3x?^SOm^qH;xt!h=spe-TX_ZtrRS(UB`JH5vz@blE& z8cPKML!awSNA?)Lv7HrHT^l&4qD?^{NnO|S(|CD_;?Df3; zCp`L1xpQ>yo*f6wHxD>-Xs~0>Xcd#;(;k}L9=-G3{v*XhW=74qut~8b)1-gm<%zzO zR=;%-Q>=p)_>=^_{LC2MWrU|DGyipgZkM$`{vUhK0np^}z2GAGx$747GY)2USORKD z0t5mef1n)v8sixUH?$z5m~R- z&eD9}eed4AdpF+QyL<0K7IhYGdDSLtmd`&e|5)V79A5v>scSD>!p7{m5v*u4Bzj%s z-aW^fKcDW_|Mc73cRN-N+)|+0-gxqagY1*P299%)dA~^Le0T#zJM8`YJ#^h=$%M9w zjUin*zl^)>&0Y2T5|^#JCiSebWaR%IooXG%Srp%3#@4y}eeCS{NdxT zDG7UN$=}|uPatmJ{-&V5>-##!7ND9ml1e`|yHR$-8Z~MKqAdU$rzF3&c`vvU{vv}m z+-FZ5yyPiv1T!*yN7wc+;RQwZ+#w}*i60u ztlONX%dYNFU4NPXcI(i0nLD1o>bbIG?DD4MU;gYem9%nsVC+fH?+8)sdc$Xg{lz<( zT5rVesqI6DJ)7-`yZM?u@$UlK)afS|-q#LPH;HJm?ZDjjN9BJs*#6^?37h-8+eXj6 zRQlw1Rm*307vVP0TQA#kioE0Fu9B6wIrENDqL$?ifA-?nbD6K6-gt8IT-<)XPn`uD zic+?_FJ4-@<;L+RH;&cma(3ym?+4vH+W&ZI1n2&!gdU#DkKH-Un0+{eG^XyMDST1X z#M7&yxAaV|C6E7}Fz3zAd!t7{Pck+WmF>GXA>hZfSe?;9?I+$HS(5T*LS4@{k6g~& z-n`)MgnK0q+kTinpuaZPG1~=>^_Iq&Q&9Qndo?aSrYQTHKI-e;+iBp23z5Zs-D4iYQ(eJoy zUI%{6M3;s9TN$16v$&oOMknvxA-bLE&XcMA7QI?NHQ~uG>$8%0t&XR;yN@p&xU^^Q zv*Paiq^FCQ7yoZKVMI`qK?N7R3lAP>k~?Dl22uF&#h3RMZ52%G&!Dt!Bknyc^+alt zE1p_c@|4qP<(Rbayp_{5-#5x4#K&&!_D%onJJ`PgW<-|KfC z+m;u7xW1Csm`NJB>DKh-<5w@@iBolB+6&(X)IM{}>zdtsYI~E#{6KFk)h(UwNm0c^BTOeV+wT$mkY#W^8S`sb2I!PmkaQ1Dl72 zPPYV^%z zvQzGv^vRly0$Pm+d+PcoE?Is;?2Y?7_fOdto%oNEb?X+t+}}+5*l+#R=EeNfHK$8_ zxly_qo*vUf3zn_Fm)aQ8vi28Gs9A7npI4i@_d^Q5i=HNpl(%2hbpD*BYl&Gwxl{Z8 z?K|ORR?@1&F>Crh8tHxEexr*U^5{(<-@doys~J z^O!hEv$&z_&d6`vuD3gXlQz}0yKbhaPm+|JosZ_mAV=wXrT>S1#h*6cR!+NBG#2JPO`dG_+T&1k2jV^(Br6(7x* zq?6QW9kDutlkw{1)q&S@2ke~q>k;>#(xTR%o!KY$dr7k+-+FJ`@?*yKA8U&qkKcGN zZAR9S)|v;|^h?*m{CBP;Tp3PYeLkK$XvWq2A5)g*pA~Ky5SKCeP3XzfBWt-wH1d8o zXRb2jE%Ac?i+OiO-Q3)tpP#55Ir+mNYQvuzzRkZos!oU0KDf1RY5nSNciY^iA+^5d&Zmu2u?W_T< zelP9fQ~!@Pk7~9oDmq!~3huf+T_y=1? zvjQ(Z>hGR$?|q>bH{}%Fd)%rerSeN1_i0bw{W+-h6#_Lre`(8)2S@|{oW-Z-MMn&} zQ(BPTE;f1NlEOoeaQin=qsLzE_Q0=jdn=Dar#GiH-}tiSmQIc0IFyo8V}9Pgh=0T- z%(KR-+G{26KkU7?WPhtO(x4cRwF7%R9`}gCzmT!S^Jv2iW=88aD!*d4y9rxsJsNs0 z^VGFXCw}0peDeG1dbMI(NC`_$j-J_Jmah1R^Q;l)cK`I`_~VsJOSa6oK4prq!SI}( zwKEqzUGQRi=r89V_`G_0chTQj6exS%VcCFYl;z2Dmc8aZ^lvk%_lo2bZMznZd0n`k zrM)658j`$eR$ssSq_hL`l-jvxcs~?Rs}m@j{eDNQzt^Oknwwe7-kKY?9k)BcQ?U6v z8Km%%Y>HsSf2gPE6eZ8}zgDup_}J==zf5e}ef*92$v0b_U(dbNpnrbJlW;%3es2$! zmel&8W59#P*%$r2-sRpt!|3DYIzQspj5g2lty-vF=FHtQ;G`I*a}UoA9n-LpLa}(n zw4}ws`)jvpGck2$y1##o)+Zj0+CL(H{>MoFK`xo4FR$0GcdP&6EzyzZwl~zkR2)-L$&neriqr zByR6cgF758E*-dGxO?FwzRQd0Y-lWX4H;<}cB;D+HJAKzTu3W#}(4NBZerrd(BX_L7|HI#X_qHxv&~9)0{>gV1 zYomFibZf#Q&t-5phfXgf;g|1OS$l)TO_tp4$<$Ttp+d>MyUX+9zqu%waD8P;24`Zk zx))xxp4oNk(ZsvZme(h`9lG*fJ88~6P4>97RR`jF_3$}AX7IH49rod36%tC9H(k6I zN}f+1H|MbWGCuIrZU6WqC)DO>eSJacZ&wz-{7D9`(xP{nP# zbmzeN(ao==kWaRX+8G*%R~>KPqO?u^@tTUDyA9%gev`MBwvW2?dqJamJtN+4r_H;+ zz2hqO(N});7rhuV<=eR3J}x~dVYh!7M(1tZD0j^{G;?)_TH~1>O-_HC8j2%C>Dq0( z{;gl!LYzT^2Mxl`n2Gu~+ory5oEzXHoo*&KlJ7Fma4aF7;fioj9Lj zcS@h$Cw#bV|6CE)haUfCztBB6Fr-ULuTfowx{1yUS47r7z2ri(^A}c9cZF_CJ>M}* zF?44Q-^i9vwvBoHq8pMN!mmS^C1i^>@uz zMlMcS6SnxThLWEqXD&_{!B{Y0`u2WnpN-;#c3(@|8};ji6{nYet1 z-4k1p_P^i$SCNqYm(ML-;hK)ZxU>60ia+$-oh{pXaooNs)Kyc@EKn!C|Ei7>Eou1S`MOwWP;t^0`Q_iDZa4X@=Nc;M`Qj4N?!y5Sy?2oO+ShA(aZA&i zd6QCqpV0DuZMCjP2fEaJ3N;+-2pSHfi$CF)i z3!eLgwK>c88sE6#Lbn}pBcY1) z&y~aH&&aFBJb&|=0vSspL#i*`C_+tIJd=OW?)pK$qSpTZNB25hj+k}pEhm2 zv})IbpLDIBl>C!J;;xHRO1j^@=3j40V9bTkwa4GAe4dgRdbiGw?fKAF8l&CQ=UuuS zT|O((SH0=F@}cHte3yQ!J9iR%n0{vBsGE*=wLDslpL~|>>7TGsc{uI}yWgIAPh9dF?O6HK4RUG8jnw3`B?SXL9?0|F{iEEt zaZU-bd&eeI@s_D+oMS`d0Q_Eu4ot3B@TeR6PTe&X)$2mCqadGE_B=rfbY;s`d zp4hEQ{=)$bdb=YYp;4_yjJv<-2>y9do1jfUE}i~M*G{urt}F1k-*dyB(;XyF14FOn zTnd~&Cm?x#!vfbSUSo1*xZNByuiuq6{53yg--xPR)Ao=sNNXDXH^vE8Ct zl(tY^`;e=7R&pleR^iV*e*M^|bZ=(C-oC2gZH5i?88$7o-rY?*2EF08`o5X#d%y8X zPwy`7ynCN};g5kqgY$Er-N`%r!DI35$gBU5M(+w=zVBso;g-Lj+<16nV*Lp1$D!X3 zt$%Z$C_23}{r$qd3$I0;&;7kau?By*_uc5&@`g*LrYNFJTvGNtR|UYzOO znDfZ0cxz-VR2z@N&`G6MHZ32s^gpPsYbuS^IOF=Bhu8UEXnGuSRV{ zZu9y~R9*OaiEOic&BEk~ksen%Z`Q2*`1j~^?&Nh18`Mw9cKo&2Rm6&pN)5Cd-lpr|ykNdfRQ~nrFjn8kgie{4mPF1$~YU zhu`+sFk6ymmfns(%{v**jS(DMeZqJAnLlpF*U`|P#@`sSI5NGjCRQG`=G*vKc~Rf7 zP1yB{PI{c6L)WPLzgg0-%fb8KJaC)I{WH%zT~K^>xsjT^etfV%K^2 zlGWeMO)jdj)q5Z0M{ei2e6h=|Lv?3&nzhV3^L1vgQ8C}n!_|n3c5!W5qio$42re}s z>GM|6XqL zdHTPy^uHoHNtUOhe;#ryI6D8q@S|Iu|D`$af2o!Lx-z;;wWeS&)$|M8%TgJz516_(iFgv{HOX`+W+~}s80KzY6(WsJqZ?)3+Mw?K=y$@ zASk5Vk&_V|4)Pc{$D-wKO6m@N_Y1EY6%tS{|l?O|Jy>3 z2B?O!|5sHgtN$ZzgTamy9Q(O>IOzX$s@48a0M*ag|EnbsiM@LhD=FYj8x8UTNx%h@ zz*r44>m?HV^r^J$U~CX-geDiu6>{AmV|JznaegEUq}Hf%<%n+^KN1xZ%Q8i|a+L-z zPsi?bBmwuCkf+`X4s{s^QWCrn6FT5YS1poci86qfdYKXr?i&G-z`87snGlJ^;tcPh zkV;F+km+Q~Tu*{N7RCk>M<9{A0~Q4n@Hm-L3hovekR#W~2u5cO@E0sQk_3**v_{9W zz^7FOgCD6vf&LCs$i)QUECY|n(0h8oHQ?ce$EW8gC5W9KQeWuRv0iu_V!#LuMlTeS zX%Nr*a9tvI0(uzjfnW?cJWixV?nE>~BeBS(Xr6>{;FV1whwEP~%aAJxUg$kAhAYp& zLs!IN+|vt^s$jOE2|*Oea2p`T94nl_qEZU+qdNe+=vULs6W~IDibiumJYE_Kmrga5 z%<$FI1Ks-v<-$sZfgxD2gfv?T^_%jhNoo3|7&%6G$0Tbo|4ZUQm=&jya&SjZI<+g} z>zWG3qSq5hpkbkiV{L?qauo?Ng7ic#%dt#>GzDYkSl0Y#Q<4xE>*j%8?dD}gFK}6D z_?|7wkV^)%hZ|D^)|4^I7G z)d$=4j|n!Zc3@@X;b8txrBJN)f2e-`&iQ|Jgc!L*qtdFDr~u8wG+S0xSqb_;Zde>2z~ z|0~xAoFn~jfS;BBU*!CcbNsLRkdP_U$`GGQU@?~@*XF=02uuL@LzrVWEv7$#m)-Ev z6aZTK>;)1+3y)(s^8wfJj=I%1jRKPkJPvJW@IZ*(OryUb*NBOvl!y(_Dm9!HjzmJd zMin9SHwFPJsqm-nUiczw}a-{($%mK?dsqIL)A`6da zs|G3+D&(fk91XbIPNT~1ipOED^3)nB_FYRt0n$~P3>ir&(~$?GE~@muL<)&YBL%`s zJduVZ9!%@5PiedU?au!+l1gb~4*EYMfMT`(1C|8N{$CA&Otv!v%rNvyjSOp-T8T!k z){*dJvWX*Y{a4hRHs%+b87D|cWOMmK(8u|)yi}neH71PD6ToRJG2oH^Ad>+E?m5U9 zmB2|!;Ks6eiEIu;GnBxBbWwU9`~@Mra>?q5IB&DVg-T}w6sOYYax!wjfbJQlfqSsR z%TR1B9=&P`b13J@3{Qbc67Un_SsWo7Txm9B2xR&ZxH%TaC4_l_bf6@{WNs{-hUYP3 zBNCYr90)uJ*T2k^#m@ z9vYF58pi=}*elF(ECx;(#);s@BDYzE@%XH0h#)|=Hh^g6D$`X2^pgR|1P~pD#T0_^ zgBchINlacM2izN!joygr3lY*x5}1RiMan_3qHJ(E5`im~iR9WcU;%M#89Jzdi$D!` z_1J;ODiFY;*OY-v0?UBsVi(2ei9rQh8NfVnnSkMz0swA4&4E?}e}8`VQYUCcQdzbL zUO3xf5Ff@bhlvWub~=oNfeAtxiQ+W!TzGs7%aJRjc5uU_N^>MSeR=IN6N9Y?KLu); zL@rVosDQ~P`jIFk8hWdm$^63<0VkG?H~qz$U6M#+uW@2o!Yoy4QOA;Sj&Mtd352V` zfDruYhY<+5YQ6(9cHs5>&oBgYW0UyN9CnqADkj1P8Cj@i;)l%@u$b{|W*CnHneUiihT(?Mt4@*XG@ z_fCX>Pzg0vu-eq8+Qn$>Oo#}vt6BE;Hq$A4djl7|U|Nbyc?ijJC7lL&<^}qDL2T4L zGLa`&WuqAlZUWRpmeukrL7ZshmCt5@F7Xb2O+QX5_+WI47lnN@H5_AauH~ z-^b4u!IcKVtU|7&%rsI9F3%)^DuQHrqHK7y=vpDd0ZP+GW6pkpEnIObtyT{1(UWAV zZ3QFiGuCB>-I zGa$1j#K;`7B~9E6rAi|cqFo+jX3WNtQYM>?76Gmyh^$m8R2eFW9FqW%lj#sSA_XGz zX%LwWHz}|pCLoWo$QlxT1}kMYKUsji#e}i+kBNeKcqxy*U^kF)QowQ?0Hnf*!`Tp7 zf{|dJJKH>WF2WJ`Kh)8>NI}HzRq~_gUECAOf*K4M=@7_#wO|To^eb;&b`zF-A{*Ey zce;fNg;JSB0ftXcxKhz8pS)l;#apursWG@C8F^+(T6UIh5GW6g0yA+S=r&lgil;y_ zf;%ZhR)EDn)gK~D4e2nLGCzk2Sae#bSStaN3+dw~NRf|vYV;q>;&|NHXgEDQ5v>GGSTOl}iuw$0)~$M%pcsVlWU(;NdGN z2Siro=(-ZD_ZHw51g8W?L%WvUQ$a^`42$$vDq*X9Y>t)yGXalk3PWL8!BxV8 zCJ-`S1UxLMbqJ7A1oH> zOysf=Bi(OlHN37q8zvcThmNL=`N_(FBXL)xmHt zguqG^Xpv)t$b?`cxGrsA!w z+}LHBs>F_H_^J-QT$!$_LiB1y4veD;GXQ6|st`S5vQ&lmk%7!McGJECo-uKNzUWnR z|F(v{YJ=VVALFUL&&tEW`L6(fI>U1R2V4p2-2bVD@X7l>XxsR5wtxf(Jr;l;&zT)Vrdkd&syFO(w%enDm z#viM_pYo~E%DK5?q8H+E!#;W623&q@L#Jg^*X2;RWu?oi7{&kYjz*Y?atI=V1N>$h zqA)82W^qP^g|*EA!GVg}_BiL%QX4vwIZ+kpM&(yTm)ST!L&sdTeXHW+|GV1Ps_9=+ zQpHquWr;5PU|){n?lYBkb`^I2qT1~#w)H>8bLo|lha>x6e;fWEf&UMu{-^2#nVg>=%ZDceaj>A}#Im>?!O)@L z*n7Fm0`*o1$hZSiC2CO{VdFj!I1>+lh?V8(fVKgQz(Bc@gRSP3vVo9Fj2IaMurh5n ztd9I!+0*Im4uvp?FqV^&V6<;TElIFIrBH3aviLDE%viQLC_ZzdwU4r|I{nnSNI`S3b+yn^K0gH|77CwYRk?cf}03%WuX_f&Z(35%*`9 za5Fx^EW7;H))lg~F0;_(x3uH$`75b~PLJ3q7g#f`qMg{I63I%7G;c29n2o$!2?%nVq=p+H1BN(I)_K+}0 zEejIze;^|T5($^?K0xw3clxNEa%e1Wc9A$z$TZWxIPt<~&1PI|wo`8cQ%@k=w5||Ky zOb76RLgGRY#|t<^>5^D19?${9b3hIFgrvmr)jE&|LXMskxKO}KARN0pij$`nDX}Jn zeuoE3Irt({a8X5@zU1(HCe-?1rLXmwN?+^al)h#sDUp2QG%|R=lE}1Lm4=O2Hz0Kw ziXA8pM)n$l^~U(YnDKqEx!rxRBb$3PFI43o2QvogEeY|7C~t8v?{!Ar8+gP~io^;7 zk9go*1#l5%kr=L3xDXPQ?NaoNo&kl`7cf7!-F8ezakV59s|KxBmJJi3;mMIZyg-*h z>(M3(tiq848g_Eh)27PMh_cxtohS^B1@LGyvXdrRqyhFP2rohjbd0Y#YIqi^)e7LD zS(l>@6DfgZkqL{iHp$e2mQOCL>B2+1DjS(FAZ@oSI8X(q&D+>gP3PRmu!R`8!@uy4 zxfOmH2JsmCkP!i6pOv-%g#kps9YZ4n-gQL^L$`6r3L~{xYb&E)VFQq9zcLVLQgLFe z;>?FFgjTf_1LtOgK456vR)7Y)=&80C)czk7sjMo9;j($g3UJVcQJ|PCcqD{rU||

    $S?u2Crg&kY<011wfHed{$4ikrv&E&GZNrK7Z zsS>9M*x~greu6;xLM8yh%AWwhVool>ggq-$CdtwoWSHd?fL=+$9jW!t5$z}f2ZG%c zsC;7GG)0&OUNj&(%Rp;rIt%f6j$~1C#Rzb#CL$&}@K&-#wO?h}` zI?wz}j!`O!V`WUbDvx6r0d{6$Wz0t$u(}*g+HgwVvJ)UraKE$JN6n2cP5P*no#iL> z$jndZkrhajW^&-WBBi#l$uudp!(!U8!gLNK&Vl4VFp$_c4t6$jXCwa)H*(Bo-Py{W zt^7aS$}v|8&Q|Vh<^SPUZt(EoZ0F8){vU4VnBy5|D|fc?|8OhU`$KXzb7wRE4>xn? zo`kcJe{GH2uCCqkx)GdF*YyV+p z!}jTUII#bqFen!O|7aAN)Bj)fgn!Zg12dWYj~jDX`i#ffJg&+3a*k_$E%qF!_{L^G zh<9uR{tL9pFmD1DgKI^OZ(1O-bB5C*o63Qykh?>{X8P?rS(6>^$k~>;<3Q3;w^IhIKXs z=ZR5gOK_g5bhZTN$wOybsLHnRwV%#&wgl%1HfK|Cp7L@wgo-IsoQIPt9&Dfgsn+{H zss1#E_5Ght|L@fj%5ndv&0FEhck`$ILO3p4AdHLWN5wK@Oz*%n1ggo!nOt_fFgb=D z!{bLpaN=#jQqAzfa6$nm3BA(GBGAf!O=iZ&TEo(8!gAu{`IcnRD0C}WHZy^fz_l(P zjl!_T8_%-I3L3@F43^Ca2k_wXFDqEOMcDvs3^V2b*n1Y}HmWNXNJFX+$Z{4IXbLZa zrZ(tf$#Fi8A|lJOt;DumSF*I-P{BfTITO0Bh@gP`-|IbTJ2l(Ju{@VZZUqf?4O%vz89*kF&{3T61@H(*n z@^5UM7n+d&!Fbh>f64g2KmWNQ6r7O%!Fbh{zXCJtI)A^JR}aJ(qsRZjhB=|?^PlH} z3QWZR2jdl<)tZdaQ)N-wq^GZ?GZ7;mUm&o&F%}54rd!F1j&xTi3Hlod)>eyVAQ11S z$6R{&DP@C$gZ{xrzozE`=~Q4H0t#YJ{?TX9Zhpy>Jg^AIYxpJ$QiL9s88#IY*79Ag zP0b{x4;4+Uek=AXBH?v?G(7Aq3E=>1$$F_uVJ#kay2xXgL$K`cmu1sK`gJ+G$cY$J zaDI>-#SwJeFB*o2n6wbngm^T7-|4LbdD#>QcK69=mz04;o|slJ<$~$Ms!b0O**D$` zNm)q5enB^6b5UQq%{L#RgaeGYa7L4cB5rqBQU-`3E%IP*0b)WOb1>!0MRqnUz00BM z+GLJqJD2L#T@0E}5{=z@@! z0aQlGMZzFLt&l?*g#-L^I6!|Hskh`f3^+1|SSbkhM#8gvz6!1opU=s|JTS15eFb4a z$q8&AXxJZQXu><7RZ?k^NL6eaI<&lO6G3xHtPO8vF}UmkPtpdkhE5*zM3VdyGA|r} z=A-t*eTb6biS*L<@%6Dz?ej#elL5!q58M+LA$uYn?8EqaiMlK)rhx*YAI8}W)fn|P z#y*fL;=%#Wb$+1&PF^UK1eF5vM7rn~s){2D!qMR*rC>6xpu$c#zKw#p6F>&5I2AB} zNDKco&W=g}q^a_QkYVKVw{Zf{t*S&%#4b>@ZLs=9IZ^8e?)hpDp_YWzLQ(NVz^Gt( zoG4?q-=IVWC^j}2ChXx?YwAMHak(o4?8}E+S_hBPpu`j5x!Pg;s>!D@ft$J@u9fw` zX*pdh6<31~2{tvMM&wAE{WLPkV*)qCd^O??rIUSgs2l@P z?K>SVvC4h&35i&^sFG_nP>`6 z=D2H3RCs_2ot~)E7b2tyVhW)k!F#aT4IKodpVUc8PBzSXlI6E#d1(`Y6a__Rg9ap- zzWaghq60kz#@1z-VAgUFkF>>(B?C~xBWn$ylZ?PuwaizyVBn-=!*(*sa_HF3a_Sa? z5CMK0CB{nr5amNgGy4&oO)C2wL|hBnAQ1)xMa3J?uyvVfj%h%0OauNJIF(ysi}IvV zAvjSekc>>Mwlsfhoj5CM5<7O5zyvT%ZX;V|mezNoEZeXFS;NaTgJvdsY=Qz5$Hj7|cqE$11r`0H%u z4_aX$03H>&U?pKll)=P$< zDtSZfAEFJr1h73-AjxxPYl2uZ<%K$)x?2LHImho#gRY7t9fAatND8i>GVC;79I%K} z6y0k{Yx&s%>ur$sl41yk1~3tRoApBmz;+3S2!IQy<`jT#qN$)ojB`OzdEWO(zQ_&? zDZ?DWp~W+>JCfJHFDT_(j!2Q6BkPDm6xGz4v5Buc>Fe!@cKOmB(e9Yuw zcTCG8{|)MX24xj|ggnchCsu-Avb}>Y3t~S3r3A`2ffC+6r4@0OQ%gbeWt(+m41q*Ol$@Rl8jX@7s zy@Vwh^XGdATX0f}DVjze;^)Z838|TsR~Fs@01^xm^eTa1C=d#f;JoJ0+~$S`kQ$gn zPEbjFU6Gs&22KG`fYm%={HV>p@)F$ooh{PCbTJDyij%i zud%UdBL8)-mFcUQ=$pv%eV#nu{-^ndC#*a?=QmoGX(HYCRZRCy zWbG!hcH;tmfU>2d2ao9?m5mnB!u#sd{Q$Z_1}_BOuwO!rXTxp%G!X z>{ErZ==BqK0#%a1F?F z2a<-<6J=yiU(AqpkJ`+gieC77CN%*f>r<# z>lpg56DF;Zh{BS0l0Amk4G0zJMFRk;63Hn8s9S_hCzyy})u413fGrfk5fpWNI!>7x z$VDIu+Q5uW5}xN1_;z6Wh<~_8wW5-5gBT778x`r*$=|3phPj; z*^*v>Az9WE^xx3vh&YAe6>Of>R4`p64SX}Z`@v|o1&2x`WFUMTru7UHltZyBT>cX* zD?uAFvQ<)zxp_BUvZ&G#3y53_CU|RtkDJ9|tEu%n+(}2A^d{TV%cH3{N%WGQRB~CO zHQq`*(O&rO@sj0I3Nd=i1#9}u6Qce0bipniOxiNrPtk-NOvR5 zwq%M#Nl!GDPQ>~;qbV?oR8O)u4#T$s*zQDkTM9;rcg4HYU?_=hxJcs5;2Y`fh<0}3 zSng;apr1knNi5m3GL>lWNRy6aXKNfTw!{H7tW{=X0adZiXrjwYTBBXj_Bid81Slyt zHe=|Kx_VSXSKB*6vEp~mJpp}$h9uqspd6-gA<&i^?U6$fC9G4g*+^M=)b&JE6;H{_iVR|2L5qJYZ?T@#Y05(t=;?w4kL(JP|l%73M_o-)Nbvi8SI@GmUt#i~lMu z3kRsQuD`Gd&{^v9WhwD1`v`1V_7j!mbTkbHOLlBclLHp1K(+lX=qHH+OTCH$py*|p zJ)w{*2{}yh(P_|)6!g=FJ{mm#g1p0~CT4g{yR<70p(@K0Q2!%Km^mxTx;j+NB`zX? zbO~!^gvt49$VEYCSvki873ip562?Nn2>T@*pkKW1K@e-dmG^_OaeiP45~HNBnmVi| zQpA!f=uGlFFTs&7TIV!ma$^JzL}Qykz~_LG(dTI{xH=V?He zShMng*tRT&;mN=X+j7nw%(k5Khpkw&=F2K*r1ft@j2&g}(~J=1zCa}Fx#OT*6bsH# zsfjbxZRJ--tHtFjy+9ML{~S|5QOf$T&I~IgMdUh82l!6yhgS0;4+_-axZ(f<&M>s| zBvoBy$<($BR!GGup~Y96FEx=H9<%f3heu-elT2BL-qw4oaF7jz`yZITMjSaSt4c)6 zg}1^OrCehbz4|Nj_*7)JERfHf8Dq+k%j@%si%AO^Z^^5sUOGY&Y~u(^m`3(DmfPB~ z1-7)~3ur;f#$-0#i{RdzZF1;x4q{M%iTO-Jk$}-H8XBP!6?S!F*mF z_BF(qp?q{4#P`U=RIKQDd_*gaIg2OtaI7LAF7egPO%G!`_9mX6Z^2y?o;2AaF;+ z24l745CppYRDhxEw(n8bbs}g=k61<1V9;gD(EDaHXM@jj5Ncm50a~Uf_|mY9zGd1=K_)$7)ze{$BMEt6;d98Al<*~8?HXYS8DQlrnTQ>xBodb%78~C`*XgeZ0j2*eP@yY@| zf>B-*jAVjr6*tV7ykw9%Z<$px*u4P@Co}47$5aP{QI2>iTk9Ej$f8ArVuAg}Vz9gp zu&*2m-{~2IvfOW!yF_ih{Nkm8lF33m#f*bv!A|q9qnOvR~Ma zI!2vkba@>Div%#iD)ZZTY-@MoH=rrt8l)ythZ~e8jeE!`w(Y4J-jpF1y!;0iM177( zbM)|%{R-nbCYwsXGoJnoN#}e8fdl$#=EuRY%fKAx{7{~uK-bHf361go8xsS<%n%Y* z2aze7g;8Ha&n9kHajd)O9`yY39(0H_gqjZ^Ui4MdDqigK@KN=dV zpa0SnYM9vnJt(g$d%D}FyN^dbnx5!rO~Lzx_;2bI`2Vqp@HD(l$t-Peb$y0^Ha)WW zdbslSV#i9u<(iblf0G_RZDSfPe$$MvFs*VVSG>1}wD)U<$@T%sJb%NyA3l8RW|!;8 zYZI-}^tz3|Uv=s~z0z^aBhRnAcfEV*rkkHx{Qdl<$%p2Tt$Xa!xp&uRe|hOKhyV1o z#nZZ1Ov|pAHd~$C*m3`+vwr?k;rzRnoVaw$-UX45R@|`XuH}1;U3V|nzWXm*zxlIi z@4T@3wQHV!!|$4R%|otN=f8VM@y!RPZN2)fS@@wCg0!lCybC$8M}?A}A3e&d7-AFf-m^T|KY{+4Ub+ut}xcC|eA$vW3tr%D_C zBX{FdpFF+oo|~m3x2`v?dEtSti@$k$;rF-xUl{zL?e&3r*NK_;CT+dv7k{^VpKI34@7%WY zS3i01%&7y9$#XAsEnc%SeCWL|9ev5RsjkP#PS-ITj=Ou_olS2X@uAE0oRpo>^5P{k zGe^zc_}`OTW^7n?Qt|ZvX`j0Ox9bmm4f>tp-m>h^&)rgg$HfbFCudy$vpZh$zI4`< zHBTRV?gNKxc7;|gz2fL;PrQ8bw)4GLEu3-vUUT1)de^_#?R@eb&moKF?woY(4a-m2 zecqw>-JJQj_vZDkmZ|&hbg!Sh`_%>WzP8bL==bLiuK1{Q#Z?#Gv(tZkpKHm$qw0>M zrrvVfbsv5<`3K8Rd~4I$+gDxj%PWr+UwQt~Vv;;FC49@~<-c09^1LHwy?wsN``!Qg z!|_)iw&}TdT=(6z>$;P+Ty*W9+PD9F>8ano^rp9eORl@&iud+h`^@w+rcU2-*n5vJ z*mdKs+n@XK-ff3nV!ZrT>k)e=|Ks`L#hrh=YYz!Nk}%`tZ(e@Wd5bsfn9|}pHF(*Smlyx&)zUu?cAmQG?=QM~-vvi)44wJYbKkmt zis%(LK>wVs{-dXX1-?jVtGf#j0g};4q)|55I_C=XjZhvNV%a8V5erLPuvbT?a zzjV$MGa{fLx5oZ;-^>|zeb0FGhaV1{a_hdCkDMRd@cNDiXH463^f^bn+&gaH{BCjk z^3d$rmj^Cc^P3mk7i_(F>SyO9^z`~Y_bmOlE$eUG^{u{H>E<o>+9n zy-%(u+OMVWoxJdv)chqg|Ka5wzuvsN60M z@yKS*EJ*Vv&Pdtp1i0;rFFcK(o25b}srW5+H`zg35s|RA?V^Nft#F68tKQCFd+eFB zakC1bUaqOU!g8;btya87)DF?c$I?y>ixg#iRt#mnxgz}}yFjy^v~#;`PW_1&hOsx= z_6<_Zi=L>elP!ft%)@)NlYYl1jZ9H?bvYbi9&yMlTC;}arg*~Kli{D0YO4PXs9NXH zW+OdcS6Z=ZBz)g1bsSS7^+jEOe}aDIi`;q20;hFEo*4_bRG1oiJ$>^vNh7G%1~4^k zED^FiYSK3ldwqdIi{wUZo=Qqo+?&g-$0RLWyK0>TX}cYpzU}fj=Oz@^%eQE_W=4mV zG4qM&q0j5*S4rrv>GiKu(tB#{EIhv|wsyTh&0D*^Lw~pyigmUK?43QJOsA6YJ}@iGV11!~QKRb93p)ml)g&$R@+@{`#pK<8kR|`F`B95Q znOw*++;U<%b;SHVPFhI%?ro;nO~J)&p*0>1AvHqv9g5Djoo(|&n z=VaM4ka@a!TVZ(P)7+GrP>ZsPo@u%`;DB&f`f#V>`C<3)x_XNvDYFCp$z|r33(*h0SW@Q8W%^6Sa zyX$=}oD2&0z7gnSt>?X}Vm+XGtI)NQu*IOD%L!_-qth`v-(0b`o^s{(^L+U*K_6@H zQV$h8xN~E}2MhPBv2BLIDzDB3b&=whCVCABs0#wb9m`72=TF;zjsCT(a$qE{Bj{3b zfb%TjX!6Ib{Aa)Q`#d`_@DTsHTxsey+oW9$vq-Ub^`wE)c?0HhFtuM9OW0;bZi}LFQ6+fGPcXz_F8j zrfKu(XTit^gfgJ&kIdVjG7ArNCHsgijc@#-${d(__k1DgLFQ76cG)_sJU+p!5R7hZR| zSlZ{yxvmz0t-eS2kK?)*i)jOlhMOm2@ilM0Q6zU!&XFzm`F$MLeIA?=88Q7R;oy;M zquqydfuTXBsQ?`M0<@ikJrC{W_p-zbAjwS(1Vu1d}) z`3`IWa3&iKQ$jD{raRkaj9AO&X&hU%y!}YstUAqX;E`$!`NP)_?acvJm$ZXsFdZv% z#huG@Oqhb^M)cZibw{E_v+D_pD+OLo$=bHc7KkV7^|WrPrka17DiKEW(ViZf*HnH= zQO7#&m&M&?eF@6K8v8^spM*nR4Y`LO?O0bOo;~eiPx!^2xa9{n?DM-_I#jElCBS_5 zz;-_&k0G#5xcbZn3?{N^QQJLW3cgsqAr>K7A&8g>0$WeT=GPUtka5P0MMQN5=@O;PXulRf@qtAl_S2Qn+HIa)1=r7ZCh>rpBzM2~<_sD?j5vzlz8iG@-oEBtZ z0lxu-3TM8xZr2C~M@gi!!S1=vR-zYV?uutFt_ztq7wk3}+OIbQXw0%`*=v_WJEkpl zw(;wW?l-R2e-k&Y^!7cj4dkw*`yb&WxqVu5&--wGQ@81djo*{(8FLgYUc&?H{r3wO z58!{7Ce2-_D)e%(#p&(~&%1|~ue3>3xJ`CabKCj&l{x9l;DvQt5QSe?!%Qt z_cm-(-z@3o*}2YOwrQ@Ig88Foi67?3KAoMZ9w8v)_%>?Ux8KW>JD*10mbWy`oL)4A z)I@i0d9-LznA3ODxSm&gO4dzt&^7e$vT@llqi2dLwMEjGIGZ#tK8q3KGRyB3UIlg-Vpq2c8jiqJqKD?1Yd8teDB8%i+L@J1qh- zQo!pLStku20~HmQ<0&t$ndphi^NBIGevy8QS5}p1F8wlBzgs&nx&Tu)Ul!1;7!f)% z=$IJBCziw45A>I7x2pS_2VWzsN_ScidbirTeU_nEs^~}MU-t>zyL)@7EWQ*k9{;Yj zr1-I`__aSa8Eul?9%lLb>}b~!xwohJ-+khvMMtcfxk4=^A#?XB{dk#0Q*x9^=M&XQ zwbfz9aZ*(+3Ze#zb&V%&e-)I-f?rc&w-GM%_KI1yZt6T`z2&-R+}519MB;Mue|7qzh`~@g4ClSKT6F{4`K1_RzwFW}>jBvs8HR^y`GnEg6#L{$<^+ z8mreh@k?43Wt*LNlH0wg?2JW!(}~dcaxP{;R3i=ZnD!R+Ds##zV3C%6=L)&1^G55A zh^*BF9Krjqw@VvX#krNeZS82sVz35=hRv}7GQeRe{Jhg!&-w1^?9c}aR5LK)SpB4Z z#HfQ;v$~#~DEwly>L9S_(cL~!LkD;2_E|TrRQ+48jyCyDd&9V$?=iortMK~Mld`~! zy}CX%^AUJ$Uiak4J4^p5#& zElB+P{G-p9^*;vv|Ht|72JrdM|DON-fB#G%f9NxiwnoSIZ!6oUN2V%%>78G}zWiIwhoG4Cij#w}v0vrgRYjQI9XoEf~EU#CAB6Cc~$ov?zoK1T8o~ zGbC#ciLMCjH-$uocyAH!D38Y$3>N`WhbZh<^duO0!45XjvFC9wgvFjX*4%2r7t+dI-cLnIjQ!;h|v+|52&nI4G?V86jXbh+rZT$>pPm z_7b`dIJqld8+GNwP&AfPel#Z;gg;>-i;Ora8H%MF<=KZZHVgu<2qwhejZ1?9WQce; zDTtnsfFNzw&^XYPam_*?!;nTYLgDS`P}Z>97CGCMpv@qTl`?fR1%^e87c*O`keC9A zV?_(q>_<{1V8rG;G$eG;Kh zZccDFM1AHMRz|#ikHu01R)AC&LH|s^S7=;8LTQZPkYFlYF?}o)1A@9ZHoj{i2+0V+ zc|d~}Bm-s;#5@GG<>W?&IzB=Rj|bj#sDFe6X`)agR-y@%27?L#tHBJyBZ3WCi(v+# zt&2pe&%T(-(Za*QW`!`((1;UcNnT>*0AC0uOfVARwiNC>Fl*NYhWG~XHWbe*dMb=k zLq-(zD;kWXK# z4$J~j-4CmRXD2{LB5DwW%ETab!-INwZsXa}zM)&#(P(RsMvaTr;v{6DmN+$KbsG%C z5G)+XrJSH6h4{gTXi%Z?<_8Q$piyid!apY6-NpNik^@UVqhvC%F8)BDpn@Uh>!GPx znZxz>s{-bR-1Xnf*{u$1Q1%du~>uo&bnVS|GLjEk>7>F}BttSHSCb2d~ zK^FX9K{q2A(f&hFGLDT|n-q);@|a7mKLMN`W7)9aw3Ayl(C9GEWQ7Kn9~m}KJa)9n z%SL&Ro$rt-iKCJx9IF}r#Z@OQbms9w<5@NX2DNMvmQGR?eYh%|X$P755b_11rmKmj zKZI!f{Kq@TL23(wh!I-E`h>r*ZBlf19}n1?B~wJb(e~+iK@~?#4lIX3JaZ#q{MYp~YeZqf2bl%?`k+Ud@f42o8Y-G&mB6`-Du|UO%Qj^X$}kZ!gCbKW$TOI6 zs)m+{SRIqUcT51vW&@^2W4iGiwvItTb991@e*PKcGYbgH)oHGlkT^hfRDD_5!e%LQ z?9`-?@Sj72|F6fO(YlR*`r%5C)nX1TesVqLws@>6jv6t3q}5!qamo#)5FHdeDla5&I{!3YatO(E!ZK^l4he@G~I6CX6U zj_x~%@derP6!^-3@x4cwGvLseR5~>CAp<0Zb8;BWr-^B}XZc~Qu;UN%<0OR2M(YZv z($=3eKZ>=Di`6oFXZT#O$xF5T;m-QMUMOqbYVrb+i${Kt?sCq~vAz~H5C` z(a3P@`ajX|-}C?fk!Q^MKWp(H`N!JVK!pB4B7sDJ{)o^x90bkmoYjAxb!>P$49}`Q z_srE0?qREV?qa{r_!WNkYW_rP=j>Igpx$O%)*}L+>jmEs9~R6y zC>F7S;Z*uW6Rr&hzq#?e%T4l{Mq9(2cwHE>l(}{nYBrCK{vY<9wV{n1$eWn zJ77?&-z3f*;T3j5;DDRVT*xx&mKvPcZpM#5a=H2KS0$+*egT33D2Eb*#Z0t);cQQ+S%l}x+U zO!_tE{aS*LW-~R#ilWXD*^A+)tNNfQlCqDal|@U99KZA3 z_wE0lKjB2LMBsDo1|c+)S29e3IPiSDXD*`w71(@UC3Y+lDdmD$D|(fBK|)iWVrGC9 zBtGMK&qIg0zU|t`kZ{VHCSGWQ!?DeOofmS3nZ#(%5mS;)(A`k9&#|8O44QaJ~?T z@L6h8Phe)sT-SCzMTrQxE&Wgf351izNw^RQv!$H~sU(s(PCx^p?o(HIRD^-5j^}aP zg^v0nAUu+ejHssyCNkwts+jBteoC2$6k`SBZW1o84hVrek*jzT27#TLD)=H2e!+0* zIU!9JQ{u)_a@SR4$I$spxx$|MaqPyvVsb2FU`aq1^CXPoKqiV0l5?8{sZuuK%G9Bu zswQ>A&=yeTh0=+HE2yKeOJBrMBvnB>UU$*JB#+{ig3bcKbUWy6ot^%zJ`4ZGjjI&o`zV{`pw z80kc&6Ql6u`sT*=mQHkZqD>v?4Z#ihlVa{Ild1YB`ReIM1ah!`bhK~lc|Ema@Bvp0l)&L9-Yp_C8-UsmP0ctGssR%d6o%1x7ai z3g$W0bTvM-Y+!Qm{#g}BRf67a1h}(6fPk=p7;~h}9P1LD!0Jq3MJ7hKk?YO^xoWg* z4%*4evI(?G-tKMWy|X~x8m}`4FPp$?PvBL0KyRZ5&bR8ps|9-CfF5|Wdf+&V^?|b&eMJx6y)E3$(y7N-&L;O<k5Dtd}9gwTT2** z&2S7lho^eFsLHK;=0~!s|6!Gn|uxDohWIMJ{}&}EvB{_>A2e^zN2P36Btna?h*W&@kbH6Zj`Qo>7T}3oF ziB+s;bK^6}`)6uNeb9kl;IvsjHGVU>XBxm*QWOGPeOFC~8K)dTTT+bc!!-AsQPe?B z)Pnj6qqMGzOjO3!X&1OuiUo3`KJh8zB-O>JS*a$jMK(YUTF@72&O&9CC6w}o*0(=6 zZK;@QWGLPlp5tM36Jk+?JNZ*}BqgeTPo~fhKrRnUePlvqwNsXsI@oqMdYWQU4^b~PM*cvwsQdCP~9_{zKF*A?s zy|%yR(Rp8K0t!~-O5eED%4c}H)LAa*UN*TaYE-HaFr{Lc3=p(OrWw#2HR)oq;Wc%5 zmNyor63_Am%hcjo-e{U?7&35SIwvt##fhndhFB)WME1YT(%ijV3)cUHOz#fI_3MA| zV9%`odEUeRpL@Ap@4h@-Km3KL85aVgJO!++pAYsAkB_YB zb@+$x^3QiI`2NrD630#7zw1w*|K>8!dHDYCkgtiGQ5bGl`J*f2w{R)Kg$=W* z?|TdEj;{sZKh*y2aNO|y+l8`=e)IQ=n zrNTlFl&4Z~&H7IA|3?3O?fa{i7N+Lcb4^bxOWr&GhPsLFj6swd2V+xP(_n*z6{>iQ> z`=1Alx>FoC+JENE^#A;a{@=Y^kF~|loZl+AOb=*cfWc}1Oqr#2- zH`}{AZL+eeV~C-zw(h+>Y3O%gOFOCjjntmZoUu?NHILF70NFcOKR(@Wt3v92bN8^h zS~*`Kv&`uV`!D}?)Fye4B_oxyOR}=~e$xVEm5k6Z;e0$i0U5h5->mO#HOU$jKzL2- zk-WnAU}SH7WB=&q)6K1e*ZaRcnw|=Z9D%jCW^0RUomh`F!d6nj30R)|`*npZ6J~2|iW=)t@1y7pNb7=VVZaMj z8b$gjxtJw>D$}ZNIIp20hYBbB;`t_Psxef2nJM{a?B4 z^zRJEP4=Jq)8{{V^kM$*ey%C|k8)RSfHU0&cxzs8V;fMIeBA^fw2GZRQFc21kl!my z4UeUPJ}C|KN`mj!a8@t@#K38V^WWE_!;lWo$w+nw{x~4N8H*sd0tisrT zZK`N)j0#KFoHU*%RpYt4P2TJuldYe3kB(<;Bhe;tBK<@g*6iXlnL#|2?W8cRbI@R> z3HZj|BH-&R?)Ls6`AY}alpCg|O|rR9gzQ4H^$35b=u(fzDoy?mHXPnV#-f$E4RVUY=O0|joOMf@BbJx znoPxvwyH6s=ZB0|uF1)Gpu*PWC(d<-c@uS9#Gb`{#jiX4@zpBy^jBXVZ7!1wbS}|h zj?L*>*p87RhBBn})kb;C!q~;?PZ7#i#eeOhbINceFG!Dn&L@}9vqgu*13*xZ70Wu% znAARSg-T?}xCbQbn9O`c@?bpLl?G?CaIY#(ui##_JCgs@_pj@FN3iqjrv9Jr&5Zvk zV-Mf|eO!-8H5_#jjTk;h>oGa{42s;V56cMKm2kxkeMX%*0HVyn2bI{^YVd73H*Esi zJXlrJud9$B!z^PYV?cyo{S0JG9A@J|A}i4IhOQ&{v|IuR)%)GZ>auQB4q&r^Kd|ERmsv&tFWwgd%d~tO(@2!btlC@hDv` z;Hzi5crH@3=qr;vZFOd5IaSdnD=TKU0@t08ryDB%c~uoLh@JIz{Sf)K&q(Vn+U-_) zu)6{G_;_}PBa)G9nR)2e+XO6di+4L`_|WSNF-&a>nx#>O8-s_C*oT%xik1!_j|m_# zkzK;g<)8zg^7xIdw-*^6RWfK{aQkx$bOOdHtzF&0hNq@_sLZ}tdT@f%S4cGW#jy~i zgEpNds*-BJr48-WberuFJH(+Dh@;1cFxry+^J2;MAM*Xrwf}cI`oG2euj5bKf8TzX z|Gk&%UhRLfc7o<}#Xf=T|7f#cK?Z%;n{9oW-{i_kufBrXnp+$gPugbmp87Le=9}#A zD%f9R0#_?0@LH3Xbf+v{F~OuLATtyW=)uDEJf)S=r&&RX$uBj4(w z`Gqg=aJ*JWbFn2!ZTPhuWqd6_e68gy&OyC_4(edsCv}{2sH@qCdUg7tUdvfh(xo@z zz&N9r*~q6p@NENO-~o_8JBVvQumNq>6mPz_UOrs+b4}TQ-2XGY>j*G^ApT3>2M_UI z?&F#(fBbugE}%Dz|2#XG9{+i+|1ke|FBi1`S$W{nSIUG`BWL^I-%A7Oqu+BGxydkybC+ZmytAv6@SD6?y&GE9LS4C z{e*d5y-4cHK9n+Eh1L~mPvpgE2G{e0FskDwZc1mVzFNLg)J>qECOd7;E1;=WhlfoU z)U@SA^RlLZ`6>A@!Ph$#AiM4^)i=B695ILdn zn8#V_*qo=fZwtDZ7#N?Qop(Nb?DqQE#cwb=AAh>M`uxSfO`J3ljtG1^V$y{cPNcCL z`ANe4K-x~c0PgzBjm@p?omabm`|3rGLhPj?5>AjN^D8+G&CQ`DQbdx*p)FGu$K0o05+|NyGVu9AQA|Vga%iay>J68nQ5^ZsI3)6hO-byk>TIJ7|G{=6fuT zpr}td=wIl%G8PQJg}_Z6Pe#tIp!vBJVhZr=)QN1*5xx!8q(1dy$)dpZeQ~>*`neQf zcnu%1a6=kTwzL$7?3 zHBnKd%r=0u(-+wG)>okU7Mb$m=kF3Mqkfi%Z4p!0p#4-fzq(ys#W+LLWGF~xyGB{S zkfhOQ;V3lE0qoO~4>)>N=`SFCwMfS>ABGy$5ioqx(S_<)b?|WQEFFH*+%!b7J0*avRyOkQG@vp9>G2Wy$*gVqE0hA5r%%y6S$RKi?jFMfnr^5Q^w;n>xaFq zqoehmtzsP+XUp-pbBv|Z%N^p$aYkZAt_q}M+#AUly-LWNz4afrmP<(Ep+4Mw%j_XC zK%o8Y^;CBS{vV9{Wr6Zefg-CZ$r-!?B-B>sW&I@^6X?K@;e|{(>1UuhU$)aLx0mRo z2x$5RiDlXNvsre=wHn+?ibtyxV3G>5a$b_!?ewJ%Y6Kl(JRWxK_EaOhLQy8UUYiHy zAR7)l7;+>z&pL_m1f8rCAIv9U2FsyT3mrAmh&e8`K-rtMrFjiNP4*uJhidy0V`$|c z6FeUr?jMl#Za2F;kb@0X%}wJ;mY}l(&GQ^3$tf1Y53eAsR(<;#yLShCbWUoxytZ+0 z&`!E5@=98J$FJMHj?fQ>M;q-yqHe7pcDD&`!2=mJYidNYh=o>;>E-&-7RJ9j-P_(M zsVh@$}HVbsp=&Ou{#~pThbjmozUGOUX08;8vJ)@C!l{#**Hh<5>2_4YS6Md)pRS9iyj_56MqzVF(!bx?fT z*wHE9ZW$ct>g(eVeOubs_4aiSo;Ntuy>VD1=z*WkgZ|fbnen8UNpKQf!AbNIRN(&{ z7-wac;mtfU2+Q!th}Oyv-HRN#1rR6!xBXS;|z<|ewH16-#d-j1Xk@ebDFGk+PH?ZQ6 z=ElPAzQOJ(DY;;|uab^8R;A;j-^rBX@CZ;_(S#Qvjya=8=)JM-3sY_q=ka#0Kd{q2~pjr;& z9@|O*6sLgkD1b8GItnlz&9*wZ%xi$?=xc!J=%KA`!1ktvK~B1 z>Z~%vS8c0TtT8UWm`g$=NB|OY55-Mj%tOJ=aA}Uz3i=z186t~iXwyqCy;SRcIrmOq z9`=>5&$tOI(^9#Z;2fI&m~(i&k@)EARlhX)KW^=^az*=3BK~7#!^)%aA4lR9vj3QN z=CF=&==;CCdBxHApCj_Bvj3&Sc?s;$_kTr0L(|dyKN7F%`)`kfEa*^1s!VLOn9aQE zF(#M)m#=7UDvSSWYG^*1|NqFmRxj+@)JZW_xW(q?EggNmon~ZNJifKLGam06>N3ym z8QR!~sz2qSPZs0x?tZ+;Y(})?Z)44r@oi`zK8_tV;*;VnrPE0kW2s^)vc_1A-{BwI zO06LwdUeq$X6!YXJndXYLAss1)lQg$c3~GNB;6V+nj0xSzqdNhk8u~2?XzHK+9FwuomJ+qMj?Teb>&Ssmw<8mkj-Y63o|oL#1qYK!30mIJy- z1b>v@!rW4&WHBPvRrd8T`Yj@BR$J3pn(V^Kj+j;kW+{P7ePB+{wum_Lu@NU7G2?4i z$1U+t90sm31-vK^Q%E=?YgWU~y19`xqUY6d@p*Neex0O~l2b5R0*-vqLuTMrrGxjnyKtK~!GCu-_89iGIu1>z`83z)i>w)> zzlZvC${ovPTno-#mw0!mJpk#$R5<_!esieLqw~Ve!AXHN=z(sB+7IG^mB4I~Fqh5# zheMuE0rNY;WIFlHp|1x{E}qd&eq&bKl+|$^MfmqJEX!KClHjkAH5=)}AtRdB$9qM7 zhsYX{*2&3@Olx_1A0k)9nobdc`D*$Q;ir)`1N>(C019+12+E-KL2FziFBR?N6f#cI z&Uv@oA1|PsDrwY)2~&{j z!%2wXv!hKol^jJ?>(W+)2yr;mgJ+Cdcs7rV0ha06lyJ*3)ApFDcOnXMc{1l!im9rg zdz8auVktbCwwyv{LR}-XGSDy9@Xb=f*HLSijcKPQ%mP*DwNoQlMidj0((f2D?b&vg z+mt*zUCLnYQc7kOL-^#i`S#|_5sCrNL~(qWyPPD3Gbe29AjRR!n1~N!lyk5w$+$)> z%$r#7Vx|c_WhYD|rqFF2&4QCICMKXyuV|h{?9fa}qo!BS#ZR52nYTtTO<67_SquWu z%>fXwK5^bEK%-K|DnQR;)`W*CZGd86C9p9&;W#VE-Vdr zn0OS!3SbhjUKiFo;#wIm3O!Q~xKIux7fX!tm}z+?)kU(4m?>Br zfrI944_F8Q&`r?ki~`(%*1(>P+0;Gb6LcKGM^~dYc1<1h5QQh}SI6nIHbA5Td^kHf zDGQFlgjlF&>+_t3CQsU|a)=OM+VYYjk&xr$bsDWzcv0yrlo;Sj;8-Z07=c-+9_22oLtYa8qyNw(hh zkY`e`WUNfC9t*aIi56@P=v#@l$nC#S;tYa8;e`6KU{8H;pilgcQ~M#N6*a^k!F*A2 z2lSI46{F#Va*%HB|qtEw9aJ?#VBMOeNFAiTaNfg{MAUm>Gf?HX)49lVm zozk;NAS}^qR9n9QT{#T6Ay6mrd(<3(_2#G-6a&<1+Jd8lOqsDmiGx^>=ueV+;3dR# z0;@v)Nz?U2U5arJAvIXS>@URr^7m6AH7kTHon z!8B9o127C8#SConLXsHOixojUsH-GB$OhDHBG98P#10c1Yp^II8$cjEQmBw@hz~y5 z@ImJv`V2B2oEGmWB_u&oNZZM|%z$E`e-SuePM{)a4ho}@pXP|aqLji=_YnV>cg0XH zAP|Y{@8#5k+Ve~SKmsRe27*^2XC`fw@PP3Qej@3>N8zlU1vLo8khD4_&7Hzv%%J?E zHx(@f#nX>kD6Qcm1BVGu7i$8zDW#DS%I1u?f!MBiU@7NZC@BbKw-ZDziY)=OP8I=< zJS#a$`2<`{eF#jOrfUuW-rzaJ)+2Nn1g=4MMDpsKG(KH#iet%>4lK9wpoLNv!Zq>y zpnPJ?Edg6k;DS&F<~BGE=ZVFmsbkA7m^QIQ$3rqqvMCcHNrBZ_;jU~DOaXcc5092E z_Nm*2OmzW1J3;pa=s>@eu$PWYj;}+8lgq6r*y4C4LP)>^mZAv-@G$|Us1n_#4LzL{ z!z8dXAMtsi%wbbeS+GH2JulpE2Dv` z2}D~d=tOx}kzytheV|)rQFzYr5tIutn{%;9y`Zimlns>PO^)`U36NAPb(^JhH+Gc8 z*)cqMEN_B#h$qd1>4HwDra=cxjBBELli}`ha?quK0W&-13>l{ug!7-0f--qW%6=Jx1c&>oD@=!YX(P1jyUjh z#46dFKd73wEIb3!~--T`I01 zL_Y3<5oxUJ~EtU0ENg--P|TuKm{a28&=;?2_}G?&mq^2q&W1F|QRNGB)gA!=^2 z-8SOaZKG=UHH^|(wGb%;P7tgKQxsN=mbDDZvts+$T;TJ37q58a#Bc(*z7AZMwlct4 z_;NdjrUO^DGZ_y=ZYGIR!SP0kt@>aPa=Ic?Q9&aSVBz!s-)wYGTSmZxSfd!pH0A4e7kzvBNQW9b1tm?w?g63L}yBX9@G@FYs{X~X` z$xkB2P=|{9gJn48Oh>@qS2?bt$hYA9s>-)n7bz1=BlSk*Z({NAn=A%y6-Joc6-Kr-Zl|n@ zlwS{~y%eFi)buS{Ox=hL#$vHJc@D6>f-nQ#RQ4$?4HoVtPd7%!w$w0ea16htMvgS* z!~hMd=tZ?i~n@J=)fnP@8-SQPH;m^g}A{(voW$hz&1XGJe zRyIT~6;ErHFZgBKHf8-^k}0+-7dAPnH5Ybo_s}}_Vbd>7u?F&8FBvJe20FlB@k@H& z-QE>wAR7(!4)t~8FP+Q*@VmJBGSFXKc7h)|Hg%mB+F?&4e%<5XrWNdk{2+a21lnRz zAbLRgS)78^NUOk|q31086b(G4%9WKr+9V#eivFW9dYdSOPEg6$Cr9i zFDG;e^cIASga)rxzm7c6xpVC#-*p#moqH zp2wbr?HLIRym$umLxkg;fxCu}*YqmKV@AAm7bToQ23HW8ZMESKc?5J_<(86rDu+@k z;L(UVVHX!xc8|z5y{^OYH^PtW;E}t*m>j^vrq>k@-vGGip_T*W>HU26QJqCKA5=iQ z5VCuR9XHik5Y_{%y>r;mk{4$SFCngt(EdnbWmBYrz9MZk$wFx%b4T8hq*_3v5u3U` z9L0ywu%xNXzJV4RV84P@1e_|u@&O|ZC&xh8qAc^tu}D4eh;p|FS&cms=A{0@wempJ zMq`|E?Fea=B`PJNO67(`5&v7If)I9Av?kd2Vy^FF5UWu?#nA9eaHCrvB(Vx}tPq~Z zhH>(`N}YD3J((;VC^BxfI7A5q8J~Pfv)>)5uxBR9#P{nUVUGDh~9@dxBl5MJp{# zY>`kqgX()7s>P^hMe3tuirXn^in5ed?7UE&HJ_y(oHi*A=pinXHe`)t`pxOI99r|H z={FaLD-cjqTj>o5oNuLUQGA21aiK9v^A%}Cz&A2s6bgBsWTcNg$->^w_=T1{biL)s zx=xjH=*x7*9>?vf#{dtu#VI|?MddGRe1a(V;=bj4Zw{g%+Vo4-X3~!^bt1=3v|_uol`KYuQAsc> zLgdVZsYhJ!6H8S;K)|h>2gADsVICrjMascK-Zpy6i0P62-14U?#D~O$G9m?-zQ6Sx zf+WE~u5C-1{v@kNYSjp3xX-AS2hrH85K7Qd!?6z{-hoW_4#gFvEq3gBLg=c9C#&3S zzpx|$O;CB1SWtG6>z#syqBMqqh)P_>FW!&UD5cOSvvYG`O_-HR#^%)fdNh-RsF_Xf z9Cq_46IKSSNSeV4#``N~fD$`5VH?5wD};WMM7iS@eymMCL5($eHSk<1BLz_!2hnk7 zbQhu`mTLFRIx%fbBwseH>>}gf*U&}{EXQn`F;Ykx5LYTa*DaQxFNqGc^f#3jd5!u{Et3AixIz)f_?4H0n#xB~>US1|bml zm~y%apT2p@l6%hKN2Z z`9s7uNEervCAYa`BJ4etQ645xb&O5~&?yv(YSN{+qmIFecooD+VoR9&QWuoD!cvV2 zSGYU!0CVQTpp1{PU8Vdvwvtz}x~PanO`#w~ehxjXGF=q2n_i@wppz*rG?OH|v~VAL zqfvUtAm=bziUCnuPm&JtemY{P6-|ShE8;B*GEC6;jZyio2`E%4m$#BT(P2<;yg!T% z42gge?gK?Uauv}0>~X-;;Hs(w6|jRs1QpPSvVa0T@QQ>JA!yNHJ8e6UM zD2F+7lri>MDx$7dl=2-axkcY;2T)6A+%dr24Y;x7=^|GeDeWrQCPDQjL6>3=mQ<{8 z6o({}u>wfUPEiU0VljRP6$)!L3Q+E>z@Bmu9)1lCF_RA0qH6w##ve2>?|i0|d>m@uG=ZvtE;qV*?2soKm5 ziUF=W8vuv-w$ zQKg0uudf%u4T`GOX;BB7<9m`2^LiQPFYOZ?$ffXFnl+F@)usJB>-ETsk*mm%YGBD$ zSs+BH+7LK5ew4Z(a=brvBDBU9VKWt!Rn1>b9~qX^>}c;bGg#1ZjO2g<6iXgm@=7VI z6pc+9gD2QoAYN8FfK^Y#Sw+BtSIWvuAxi0?lPuv%O1K`yT<7LgSV~!lEpw)uZ%jSfyp-rlM05wo5Uus1MNqqnq^B0j*a=kZN=Y`=|9{ELcwR zNsjPqt%z|WAXE691~WMV=Kc3ZL$uCb5zZG7`^o|hX$~|;+CE2I{1_FHB^KL|Mf^`h z1RNtR6M%@w@LN)ksayH1Xie0}Z!MPwV---;4SOVnsK^dDJeO2Llq{KT$Or_Y_zg!sdAP z%+S2i;Ub1NVS;3!3t{2AS~QF_LMLn)b0X9WGA1BAT9NYy2_&B-wLHmr%CrnV8vu2# z55Y7=2hu_)%p7EzvwLqm%e~0h2%%GH$6(8i*-S zslF1mavWP~rV4aTp)6jB7bb3@X)z~+&MIUlKy)POE@PEt*dZ{LSDJQcj}(hgX1z3p z31Vk?S*gPkAxlC*L*f94+fCu8^p$7pU{eva0uKb42uS?VkX;VOh6%nwl!zz5huqSJ z(i{RR?kG~Q)6mUmgrd8gw2y-d&UR5#KY}}{Q*aW03#EW!Tm`gh7J`f^oJTGw!_a72 z{?8OVQAu`$Ol=1vpQ@c?7Dk(c~Q*;DqhY_dKs<;8%oMe(yGTUH&clw3t%RhrY>)oD(3 zY3&IUYs)S~^GnRE#a!%}b&I|FYSA^aV;Ny1wgt1YQAvYIe24)95)#F!EWoF zQjgGifwn!49=@-*a~LwHX|Wq5<)j^X%OSAeR6t8{5udCuiHNF;j!8?oeR#Mk!WRds z6OD4RqB;fMH+L&I11pRnY$59N4!OnKeMcjZaNOp_HH-7n6Lo3f*B z*2$u{LhMJ4hp-|E(z#UL#aJ#?3<25FM&A@ENW$w$VD>Aa2}qlDT5p_J_55#s!kgDR#uW8GS2i`5=YPhs>qqmy9f{W)A^+POHPzen zbG_BR#zb#|PERY%o1ngpO{;vWj2|k~zg5oaP;l6T-Dx=*rGth-3pfdsq z=$K+*$3E4|I=tm}|IEUvqPTxAuKqfQYv3qv8Pg0cbH z@RosIP=oTA;K0A=sse5}cMFErV6dSIepIF(O9lJ}V@?dgIJ6tYu1Jrke7z$59QEi$ zX(AM|o2RG;j0Bnv$BpxKctAxl8M)t`B7M#-QR)LG z(->=FOAb!h&$a*ykA-yZvmor=XG0YT6)2v;VQBJM8JY@ozG7Den^O*|JUd69rINN@2LaOFTgKLg;S2w%QYSOP~TR#Y2h z)=3v&{cGE^O4uNVBN|V5MLWy53?B#SV>qm)TtbjM9*IRTnbfIdtnsy>%%OwjPSmKzoCe7f^N|o@IvKYh8s=M~S%o}@ z_mLD*IbUetLni~!6sq_G(M6QXo(6>ML*W&6j`HC&H#CV$?|P^ue&1-;VTMhWQ;v$< zj?`Cn+X-X=1qYM)pfjQ$cqHVq~r~IYff7pMl@RU9d>yWC#KH z6l#y3)1BKT<)(64R^G!#C+A|YIbMbwx4o$zo04`;kA6rnfnXfb&VrzM>O3?y#W$2P zcpg?v>pTd(DHKY?JYxW(d>v(?1I^JLqX=sm=q*Due7lgFk5%a{>5k_qXrwW=G8~Ch zZnC5jDzY3XG*|vcctd2?E0KnoZ=@CrB~k=Ju#e0%cB zW2Eh*!Z4=m!Za_Sq{z47167hHzH3GS@_f3@0w*7T75mU&YJ0HGPT&SCpL7Gr%t9%> z1=Lg0&BvQjUwt0p?ZXvLB_HqkaTW~hhhF3gxp zrzRSOudP93Hmts~&~=E|Z3+n_H~aJ~;)3pImLd*0Bbw+WN*ugK`sIL~vjD+53m`w_ zT$)&ym2)z#IaDGug1!blwKc5AAeq4xiRZ)SmbMZFCuyae5eMrifs7VQ6e4SUWWis} zF8-NycJ#l8^n^^yQyrk-LzE*_Y*U6#!gtNssZf3$rto(u0EPpe@Zjg^ycwEZ(8(0t z7HqPtf77zT&FveP4fVA5pEbBP1m?+rQ8i|O1ef)tQ9FZ)UKVP&Arp;S84sf)D0DDz zKhsa%FRdR1k7HtO!B}M7&kBGAXd*5{GsrbIERW!Ia=roOc*Ou1Lp;rBE(`ZV|53c| zM9+?x+nuIK7s}Qw>P@wnzPUWQ3p#0TGEr`iH@puhx7pa-(%9J2bSCVZIG)|(d2! zH@XF{?ddh!&={O>@$LcWx^~u~y8{MhX|)Sf0ViK78 zR+C-MQWEgulvmK9%Vdn0n=tn#o8Jhjo@n2@~L}@(DLQv4By~ord)~{pLTdcnEAt?j1LZ7smo6kklnNIC_`!-7Q=8d zyr_hYX&rn;oi0b@or0rs=8Ki^{Yr~cYtWNvu1`RAP`M(!JBXLD1p?syi%lnxfo>?v zNTBuF!xX;4sg=u2$kg0fzCX^RIh^Gq6&NSVmo})l5MQpN92+IiU^YQsH@W~L-15tZ~Yd8>2*#*zd8EyiFYMHkrKf!2$dx>Fw(7G9&GS@HrASxAqS8Y}ztpLW_a+{-N{CP3z3|{`1VUdi%SgM)$d! z2f7Cb%}oPl@5ar2z1>|=v$wyqZ%bEi|9Z0np6lN>Ywmhc=lwpy;Z%8=hNd zZ0sKB?17K%9ld?ML+3@!b-hFV*ylRvwB6j?J}}hVxuvgt0JQ9Z&6@_hVfZeie^Y;N z|GEJfrF&y{{}3>lei+K^J_kOSgFWqieKb`27MT42&98IQ=JN)6*Y^yWJ)8Qvx(5c0 zj&7J)dq-b44+V?r>}&7c7&W`vH@2_url&SRF9Xy}%x-H>H+==;wf7tCokP8w`Vl6b zoBD?a;A0e4IWVLi-P$|Y9W~nrdIu38>jpMK_XtjS0%6u~z;pfG+zW!*4D1Lr!OvR; zyZyOzb+`9HUxPRU_`;BlV}B}^*w@7fYt)h%R=2*9A+}K(Vpqi*SC|dWEe#DV%bUs! zu_y}uaZIsCZLx38S9SZZrUt&oF($YFE^lgHUUC1cam9+G_TMA%dPCTMr9tJW`S+;# z_m6uA?5OqksP%XH)?b0{l03bdJA+4!zDJF|e=1kN6#ik~Iu2F@%CSj+^U#GcCnuMV zpg3h~PdZo)1U-FV)~G=ZjN<%@QqaYZbjN=MdUwp`4*fl=7(G(lrB-xp{U zDeux0sZ`YR$;rvusYuKiK#h$GJ{-c0mU!i{5dn|@7%lod@Dtzi65-dRPMM?b7!EDw zqm?J|&}Nvo3z-RnQh16h5P`a}S~%2JAWjHV4s$}|x-8zFFWAdeK4p0)%a6BP8giGw z(C!kL)$bC>fOV{TI~hI)FH`we7iG5ALx3F*Cpn=?Wym7xbp4Oxx6qu&VeD=JIEimf z;>0tH`g%KLI+|q!H?hEslPFjP;yq;#Y-tZZP_^aOZmnxMf4UAJt%9CrE%kHF>O;t> zPiP3K*OcW_MSM?VGnQ@?wK}1T;mz$sJt{?DP9lZOT_p}fEKt%@wrZ?5WOAxXI33EI zI?E^3IlWmWt4s?G(`eh*wp4nDFsY4}e4Mkl<}rh&KVc^=vo;%k&hx0uH0_%otwT+#!ZT=CTS+rG}yWA=d||^ zbq{OjU?k%vtc+O~nryN1*r<(Tbfnez#nRZ{5xh}Uwl~VUO+?hg1i#f;NmcI_k>cRR z0<8dW%#g|8EkA$0g#}D(y4tE87xgqWUrPD=caay1+(tg&s_veZ1i&H4@UE}F;z0H- z>Guc_O3vp=c`C&PQf*r3H>(WG_awqC>fF@7P9homH&U3@iqDK9Jlfp2D*H}bqLY{y z_bRL5s9d6Y{|5Q?+)_>?B1Qikx^a~Z04I8+U~!!kxyd-C@_T89^o^iOg!j`V+Hlr4 zeYNGdqwbZEcan}iBb z(o_pT!!4f%`6&}w!XVx|fwc@kP$j1iP<_d6QhtV9fQ-ng=qgI6*N#X~3CQ%e~|Cth(HKQGk1$sM%S zu*Mr4j~h)sqI%TFFVy!8{{d+ZklQ%zX$oV5#31?OrOuV!)=_=u?8WW%N;U_N4mhC5Ag4U0JT-{{W#yhv- zXqxKAbMR?0S(eQ<>}fV_1|Q`tBY{UNw@JXMf^1AVqI`&P6tpt+E8Dg+`ANH=n#+2d zutw-2GXpQ3MibEzPU8CN3qnU!l|CvSl4-z^skfs($gx~yOkG?#CvmBgaR+4rq_o?jMA&4E7gi|biiGPHL9ev(2InbOpQEN-z|{39 z86Zm6xm2|gbc(u&rT|3hK{zfm*H^x_ZG-i(7=M15G{1d&y#WkGjZ4vy(4qRGuHF#k z%N;l76@l>*VK%mbn7 zNfW5+>H~Ye&K23i0y{mWs>1iwrLjxxlri;AA=2@=B#UgG3@L`JZIDZ^Xh8V31t5%z z!{4@VM^t9%gP%Y-2{ZXWBu`#MEHs-5PYz(Q`Ov(VND>lloa%7})vb)oQLM3%0Xf@OHo&dxq$4A_1 z+H;_(g*YKe91sBk634yq?OH}H3W1$|65l1=P0-e}5 zDaqAND#D4zn(S6PsnAC4eQB+B3NcNt7aC3`n5kwuGt;aRM0jJvj1Hc*L-zUN7}LV|Wl4gadUehRj3DAjD> zdGfHzs`W4c_oU%v!pTYhO_VOYm>hVXqT6eX_Z_|c)5Cjc2wVjXakaIz02wLNDEnJ& zU=6B?grE*Fmi9CdrGg-mX4*0{^`WgEI+@PueR42001&%tps};*FkHoB+jp+_8Q75;;%-F9h#QD3I~OFbEV!o4GY8c_15rZvHlvW zwpJ5{{pJCsHC$1F#ufC}4~fU}e68pJ$^tlyk~j6Ef|kX{EAQ?Wu^a z)m^BII=f)TBX%JFce(Cfb)mSP03uCs^i5XqmU@0@l%}lKv9ewsW~FP^cBTAK9gcNNaXk9k!;CX|?z(LAKhAwbC z)Z8*a?g*0*!*B`c5*0=Bu&W}*s8B65TtY8Un1Rg$-SFS?4&zL9p<6%A8JC6)#D0{8 zq$#q60&ZKlc#C~14kM}>`jI1sMySI&D5F`}*`{DNHZ8b|V~#XmojyG^SJboH%tdwj zkM+2I)dFSkkS2)kWrVuC2@vQihmk_b!j6r&DP6EL#8J!itS#*-yx5nxHJ`SuOzFt_ ziGk1@QAS=@_$Vd6zt!YEA$tWXhRr6P+HY^Vx|f#k#joIcH!HR|y!g)AWif(edW zE`MrLuv4W)UMH?WuG6nIkM$lo1lXYEP`Ze09&a$vqD1M2$s?*X(nEW^+Rm;4W{cGa zM?rw{R>$EB-+JnSWW{o=LkB=y5QuTTXYE1K2}G=rB`SGS=OTfu>=kH?LC@m%up`Cf zD8<2H(=7vivfw#CAl5F+dicm#Stvx_$j}RhsCyYv!*5VtLBvl|ix}aztCllAw3bMp z5vV1iE-{4`1yP&Pju+9Kq?HK}Egg?k*$+{gm<-C3G5d14HHK3ZYlu|-%2tZ%ze`}L z7AS*u@h%gqWriCbOs(t4LXrg9-Q}P@p^PZA@(w#*K4VQ#IUmkO zFDX9WeRpNf8&&TFZ|ZqL4QW_BSmzh;rdB)>?>N@7g;|11iSOzn+ZLa7Og_0z$4v1(y;?|hA2F)_M z_@}wukp1{UvO*M4wq`9q2kT{mSD3_Q7=QExJ``3+7kPAZ2W^BjuPD7aDJm8qC;}?< zWR&r6Zms^4&OFt&leHs)LF~vtQA)$~&5`Y4h+teQ(I6<*sk?Y6)~Wk=N~9Cts3Ra~ zH?s>?c>EgxQX>YA3CJ^rZBxW?s-jF3{abKLBgl(`&&Co~vE0U?!b>qR*aRkHVzMn~ zq|)JNPKT=2EthR3Rbs-0OPXqvRh<`G<+O}th&DKm5+__WX$_(2zDiK)71vVOq9?=B zCy&Tn>$~{rm;M&y9eCU{93k^g zq5wOHG>FGl7X_3g&56iGK`;?8u4sv<;bZ1X1afs9qEaZ+)<&jswmLbUp+7J9CCt7Y zclBw=+ZSG7qH^PekzuE@B?n7zpuCFdumnkwLN_{Qf`%o&1C_H#Ww2H31cBQx4&vMWKg7+F z5%L!L$RP`w_~Zpi3m;ZrB`o6IgM?KuKvc{)Nf}FI6{VWMH#s~-0ZhKdq|F>_w!`ZD z%Nqu3<0SZ?sbA$My|M9Qwzt%A(&;QfZ+|+z#W&QV~`G1bc>kX0rM`Vq7v#0-|h5gB70HWD&;+@cm z9cmt+&`yq~0(x_$0{Xuw`OneR@6`Yl=vt5hLBfN1%PYn|n*FD8fWwsir)v5iu`_H^ z8f{+F0ZYfZ=TiQa0%aqSjuxcIzGWdaaRcV_Ddf0dD%!nRpp0udpo|KmOvq(t?8-`6 zdGwp0k&?RN#OSmY)rwetG!IK`-_U+8MOFp7eb3ES*g z?9xHoB3c#LQY-7_8VMVp;4mv2tF&>@pD=yUb#hD#0V1Ryg6yx3HzMWQUT$eoBn=>%o2h4N?SSa*J2;mQlyUCL#qm2wC)Q4H>6-xYvLtJvM&u%Fa!v$!v+d8yBug2xw`B4Pb5u4fw2TY; zx=K>wa{UIL4;uelCNmE&$rM``6Y*EBSE7{>_CqS)85OzCXC~^#qvnJkDlH-$$Ia8t z3Hp-a9PtgS@EFolSFe3xkCTnEE+RXOL{;D1&Pj`=49j7L`LLh>CYBn;Y71gy9B=WG zkz%WEw`T7FVzLY}usAJP5#!!0AKwU7B^rBZBPP@m=3afq$}_l7e5y)%V;lL4ymMy8CXGyTrfJL7b!~-ZQJx}_csN_3Z^0YiVzeO%FbT?{* z)WG%}d=zwFhHj2Zx+N&GKrPm8jUWLp<9JA~{bNHsfQUPAE0?P2BxM3ZAM+{MN(dFE zSTNa@$jsvdQ%doAgD9?#c%S zDJezqPlBbu87gw@giR-(`b&Tqrg{<~dQ{9zC-i>N1wI7)P;sAoF`^S2{Fe_Wsd zPI6~kBtZRI<=&;OjAyq-e4?WuRz`I2dr4Y2IB~=dq(~xZUY;L$8@r4e__Tr%mb{P@ z5JJn59&dT>s-AImf-qwgDjQLM2E@M|yfNru)IgDL^igOrs%^VaNg_^IF1$K2HXB*5 z!5%t_TOrj1b3zuGE{Jm=l?kfcMO#DeIn16KD6j;A8vs&3t-prIcr3yxs|xDNJ~5vL zYu7|7uc)0*O9>XZR4qQFOq%sszb<2-k|JV0u{sfFzY`8#a*<-(5_Q^}_M=@Gd0@ST zk_dtka)z9nkU>(47G+R7l=cF-_A)-<5jJ!5om6W)k%)6_)Jf`Oh!+=-HDP0MU!`~z zl|h)2t|}q}s=6~CG98v2lvXIvHw>5@Ae@8mMO3zBa)=kt2(cs&)QE3}F*BBYfEw$# zCunob+=P@9C37_co)Am7p6GFEFsj|r_<+EYJe&y`o)F+78rrl9rDn`6>=chx1p}g# zoNZKHVxi7Lxt %J5jK+Z>j%+~V+277Jt(5gnf%RC0gF2BT1BrBfR3{Fa zuvXAzu2!N1B3xxMG9;0U7)Mlg>q$bI1N*DO-5YnPZ*JokAieOQ@3Mv5o`IiXc z6bfjD%B1QzAfVbcS}oW}DPJ!7Mg=WFBL#9myzWFqjoJxt;*xMKf$qc3n!I4CTbs)4 z4B9TqNO!{&kf4@|I3TvBNahis@##&GlEM;)!O02~RTSGWH4-C8kDy;kkzu5a-%;vE zzA&3gd8#EHSq)Dlg36__1uIIF#0&fqB9E%8i~(9y0aIZeVS zOF{zjg&lvk8p-S}vekmnOtxdW!^biOX2~)zr*bYub_to9F(dL*D=mSUH)nw-oU?`T z37`%gYQ#icq?S9a1PQrOtoQL%3lU#d#PWGL=(S?E)%>-cmZ(~0=H&^r3hPDSNd%?q zIcQ;z29YpoFT0G{2~QQ;RPn@4k#9~|m?lHAG-MlT%*S*1IK%WAgFJ;=BJ4Z`@r#55auW-D zT@?nViigmnG^Mw!PEesu(+osIQj9S{fITfP5{QB@g2XcUIL-*qj{s$PFOxATw9TWB zVpLvhu`*+LD^nhQ8R@2A^`)~Mb*s9531qIdX?v*s46QsSrp4f zVslYZQymH!FTvNG{ew%!1bGR-kZK&MCt}B21u)Q>n6EaMfw2{aGaP=ZhC#d;00uEnj}aiWN7tw%*dwacg(??He}i9~}JrmMwpI z{`q%W))!N$FJ&@+ec^?FQ!M`N#TVbRckkYhee7eO_{1k}zWL_eyZ_;;tG>B^|NcAg zyz?tx`N}=_+;hbh_kQ%F4}ARN|9IVX-@fIRM{c|Ad;9l4cITZx_|lht_|>mIb>#}6{{JV{G@SF&*bw~NH{%au?}NY3KX^*b zqwsIh>bKR@JoASS$!AtU+b!>TY3!wQ_}QA8lWR_$&Hs>m&WC^aejfatf$isX*wOa3nhf-Z^TT#M z@XwsV&pkQwB>K1fzj@xLig|az=l(N!-g9df)SNoQpSS+{-F;m(S?F)|*H5Xr5dQwu z>#4!#af}P@=ie5-Je%4^@jrMb*3LaxbM@SJ_S}8jy?f`LeERth-F^H0SI&R$hFf~R z^qFt{*}UHC>J~n~ZqI35mz{cd`~EBUoYZl}z9-Gu$@|`I&Ra7#zjpT{pIYfXyC84w zo^wNOTYkal{RienI@TAZ45EdTteiT|AW$j$F7{p81g*<52p z&ac0-yJN808N9rJzy~gD|hdSk3Hiy9zS&doD+Vx;J`HpPx#W>i}rl-A0Iuo^TR!l9(U4@ z9;kUs-xHf>ePZ*vtM?xNzP?Ad)y%u+@fcf%$Rq~oX761`F~E_e~a7p zw+9|QzVGc%&Hw1>KYHS(Pv5%Y=NEh=z2)=!YL9t%@kn>){(T3o$wa>X^GiPV(Nk(> z*6;u1wP)`=CpGh`PtLUOzwoAAfA#1Ii=Q;>x)(>g?;E@IfBn@j{_4(w;@%lc7asiC z(`%Q^&o5|Sa>b6zYnS%CxaZh+-}9}f=f^f5sJZ&sh8;7GpV|AV(_xUB|2Vs2e8+uj z+s1c0cO3hNeFwaE{OG3Ju8v*1dF|ZBiH7^ve)ipqW*_&KU)^~7tbY~gJ+Gh1GKaLM)U@4T+_ z*ps8T?Vfo;-@chQUDmPa3-gaT{~P;`oB8Y7Q+FI(cjl+N@A>3g*B*ELU*GZD|JV4| z{1+}Bd*$ZyvTaWO?D@vpch-F6FCKh*$e`RMX9{_gggcNA~gcl=M= z9=@O^8XfAGyRc>7Pe(dt-njp*Dpk{gJvGL`zXFdC=t3LD1*&lfFg3FKl&XZ5gn3cL@>&)X*&vbs}5AWFi z{h4i>W-smRnYm=q*7w%j{l9;G&kH~K{_I&RZW(>L{`kku+~-fc_x|lyzj$5Ech-FQ z%G3Vo)^*o>u;Yhcs{hv)x46H#^zU!^{h}FvGiTzu;m#)0+;QYIv%;?=S%}0N;d+vgV=53gB`41L7zi0l(ZkxTd=U$`# z?!vET?wQfCWB0sg{(Q@y-|@`6o@Zu!eeMIZ{yuWw7dNck``I7w*tX#IJ;$7|d&z$l238M$Dzw)IWb57p;7Y9GJ^&S85 zgY5dbH|{p}-}vRdv%gU6YTmZ#3wy79&ja?VcSYBxuDNRO^P_jB$1m@HWcCX+Prvhu zV`t@`{Y>$}-S2JMU$^XiGydh_Q_lE9v_Jjv+5h_3hUWO)&+jwOKl?2&%>3Us_xzpgx29`n;@x-s&-Y8O zeBin>oG;fL6MbgeRUOy&f9T}DyW*=qTlmZ3ZSC)OReQ`eP3z_bk}IduIRs`d>a@Z2tIndgpX{ ze`U?x`L$Et{%?1*ogLkFqB--ExvNVzolp}ydFFSny8Bm`%zbLl4}bC2C%$>`dsnVb zcSpC?POQGnSTy(4f4==gOa6P!jOWb3l@I;0{oLobe!Js=GgkcNy=!;fwr6hFGc#92 zW*&FW-<)%gSz~wAJuxe?Z$`&4x7XLdRKM+vug<@~+J9_(*+Xx+{N}f}d~KlfrJoJ{ z<|j}5{gM~2nW+8k_KnBve)x+2shRzq&t27X*Ol{^%>3QTp>O^B-fOSF;qsQR4&M6J zzifD+XUHJ$v)%r!Ai-f6j{cKi}E-jh7ETlE3CFxBR^C=Pm#8^7rm| z$0twt^3^{-_RE=LUS7E8*f|}Ez0dvP0q6Sf)~5IUxP9??$9CMcV|m-!Wu;Ho{F!-U z`}MWIy*+!=?%8KPxxD?{yOU3)?ws*Lr+M|r+Ri<<9GEq8;f#-7ePG~*xeGt_mj7(O zC$jS0KmNei1{RwK#=bEA7pMQI=G=F`w0qz`l9&I@b6aNJbjoPWlfSHAHDNCK;x%X0 z&R=&$_Olxvf7|VQI&S}$4Q9ed@r9=70NS z?T-Jr_U-?3;F#mz^4J$o{PKG)c-vQ&-tpI)zVVySHaLGU@2#!9@3>X-o4)^tx1D|5 zjWx&acs})!{O6uI_}PZsNtc~?+R#USP&l~f`eS$e_dEXf!0wr&pZZ+>KlitFo&C(5 zZ@%>dKRD(`JD>l%E519YrhQ(+zwLYLlXF^sH}msb#va&xih0EukFFel=)%tI|6%W0 zpyMcx)N19=t`8$w4mg12(Hyd7<<)9eAAeS?Wl0vcc>c?lZDeH`NwdOMn=T@ZKG~6JYY-E*E~`ckf=fuIlcY*;&bg zSQflP^FZF2sjjZBuI{d>uCBWFwu3qU&^r9Yf!DluEj#<2xkbI-kKT9Z-#mQngGJB( z_Br2?${Wv}vPBqLT)$!6qkp+z;FhPayX)exe*3Du>-~X8o((pC;JESJ_w%%Q4Ikh0 zr;hC}KDYOpU;O90MSFI+UOhIyf8T*AeaV8}vyQ*KJE7OlIb+jL&%g1=@q#DwT5s6( zp}2MGIXyW$w|}^^^uK=dZ1Jsscp`G}o!tW^fB&o9cPua5z4Nn>K3zDvddfL3I*)DM zy}R^=nx9M`{@+a6LYVa^P|px zs(ZM2ZC=?M!+D2S#!DW!y6pjP-fv%<`|kaBZ9StvT{5)(Cz|ufRr%*F3t#f$*3Rmn zV>or@`i1gP&TXG8`z&wg%#~HI7Uo>Jz2JE3(9-_=eZNXCdwpT?fz-X9bU23RJEs** zQx@%4a$h~8pgN~_hC@rgaoGp&%g=8r2n+|^vubBKa@|+vR|;$X=-he1w2s>w3tlU! za@^4VaiBpf&3~$^U)YpbS(x*Jvp}954+SotajfU#!>zT`mp$&R`%~e{ ztiABDGq+!z|H^E!qq^v#DVxeZUH`}R`t+p3KkQsxoVVnL+`UildhGQ%FPxos$?0;A zw>!V}gH3O~v1iF!p^r9()14JhzOwU;&pYRNJFmz++?!vu?X1>4`yadVhlh%me027< zXXZ8tWit-1dheAzyQZwa_Vv0uJA>Y(FtmJl^Zv&IpX|v$I<;V4a`&|2*1=hejxTOe3a)?YSwSfts!3kZdG&?Q9V-+g z^Get4axY$&yLIn|{=Gd-Mc=!*F*mZR@QB!WaBkU9!DPvY2d=GLw5{h@@R66+x(dn) z3vxeOam|tAH@`g;NL8P=_U-b2KakV$QrnJ(ycyBjy2Ja|Hx<3v;@NdH|NRZ3v)K9V zCmovtKiKq?Lt4Cdv9RLt!p@z8mxqtm<`3(259zxK>Klg_E^PFj=Fm=mZ`Fc>ITug4 z-o4K`^U1+zLHhWyoc$kl->=Pm{OvkNYQ?OF0{55Z`rgYeyTMU+#o+CSimK}!TME8) zW>OlccX;!^_4voNrxnkBt6`sO{oe0BdrkE#=dHTsz%Or+hJIak{Am6%|E+KR;)yz=>9xEdVlUsd5)?V-`rU~_3FMyzZa_i{>;05r$4;stgHLy{eE{Wo#=nYbMr%+ zPd}Xdz++eb{Mc26Wp}*PTK6As&)U4_4(C(Os@DguKYHa4|F!VP_bCkz{&?z;v-n?z z8q;k>^XJUGNIuPx`)*$MHgUz~n(zKwcf}P$Ip$)(S@FU`kiGT=FawCcl-z9 z(pv+AyY(Ia?CZ%p|F->3@4EJx2iNAL3SGlFg$ErA4mvA7o%MH%?>=MwJ+5Q1zbsaY z*X6vtx&GI;ENfWSHS5pL(yQ*t3ph_(URUB@aLL8_Gyd!-yZ@r<{M?()I8?ZA`7iSh zY4SzAUAf`k7dY-cE+cuj9n_e}C1YYFqq=N+K^+llK3KxXQ=#a$E8`G*ZcN)2H?6RFA3! z!7Ts|%&kZ(nkKtxDvLpk1tv(H9@uKE;emD7Az%0SQfNlEq~Q>KNli(L;Hn6bNF`Zg zJ`P%UTcF*8aS-dlr%M(X2yPvN!$~xy)WU0wkV+4vX86lk+&-`j?zA)i4pPnq!K=J! zErvm*gFIUnMoR|=8Q2f!-XH)TCot4a1l=aA&fknQfZ~;gWj&nI6eWmmIp|r8bn<|J zBhY7!y{j6#@8FBEnlT3{78uE1A?_9I)p^`5QeWH`4#!#izyuuIVLOSim)+$f2#vUt zc8shbK?7&XT;Q$H>+J*oiKHCWbU})Hgf5k!j7D7GyDvz+9w8JGMCvgt;&~L8%f(_u z>gf&w;SG2L9^o-oURKNzO3()rDR}^jvq081-)?h=mD={)c znAf$npm{bGeP2^@XD>sd#^X`+pAP_bIB6b*JIU(4WH|(6LFzGwAaFk1*)K@Qa4$fS znaKrA2_b99FbTME=ux=_fK18e5=YB)E2#+lLO_BjrYqTHX~R!YazTKNQ#Tte5g07s zU;~FsqpA-A_%WhA9uAb$)NTS6=?TK&GD$3xMe>f^cE(g)k;re$#O%|Rl$uUKGXzN_ zJst#S%rKlwhf)lewLnUf6FL=Gc5e07>VVTcIi6#Gv+Y+Q+ z5m}7S7*klgt@%;d*#%zvGE2=+IwEAwFcIij!VZbg6~J9|Q`I@E0fctCKnJsnlTKbh z&p;*=80p|*DPZE0tPwxz`ah=rr}jc-np3I&Rr_oFcKwfh0Z!_F6LF2Nc9o(3q2!pl z$qCg!qVy!u1G8h0`}Z-?`%08VIyT9=Pll#>CLePH`p8q!J-WikhBcp6V3G^7rr;Dq z#wPjerU7S^Jyn!$i7(6>f z)F~mWRpP+FfM~&(#RI}7-P&2YwQI39_A|Sef&I3g1%!q)0gqttP)an*7m)=W`!+I* zGhM_OG%SCF)Yev_hr|+HtZk*|b*iqS9wWCdC68I8-TE4^+vNB4D9Bh2BJs!bTsH@Y(h%= zkSG!QCgYQ^LsesnoUqX8%4Dc<jP{V9NNd}4U^HX7_-r&i;%jxlVztm`~<-xLF1!1GYg`aaQ znUhBd8UqfW(=4tC*CQCoqX?KQg>wr4P`psBC4>gEg;PDY$K!U5Xyp@_!e|b4RLGD3 zX0_yC#y6S^-V^PJ+uLaY%L7%jh%#k^AoVaMnh%A{GEjp_4b`W!heKu=k11S+&~nnz zggO%KhO)@mp(%RCc7U5&40L+-S>}hAbr!0}-gnUi91<2Jlx*mgQgT~ro})w{y(gTq zfMAD{uXbZk%jgmsVnU)wiPlQWd4Za+9E%xdW8Nm?>nPo^5+0=7=FG!kNZ+t=g8fDy zp|^mXHuxge6x_~fXI2b&jfd`0|A*UAZ0Eo{Km-LWVq~xvH+oVAbmmTtk#LZXLIUVv zpDN7yj>yq09U%}s;uph1ndXBNwn|qxt;KxMG&X09#0?~sPFygpVq-9uA+j5O+6i%+ zLc_XX@^j$-&ozer&u5lXssC42+Wmis{=abY{O5#R! z_I7pins7_=at#=&a;^ zDMw81jTW_$H|^A3Mp4AU5kezOP~(EcN|@FqTqg+N2)0qq4k`%Z_461SnP5l{qqYcze6~zp5 zCd5gSJi-D)D4s&9VT3_ zf!kyFugP6q6eHY3$mD7UI!Zu7V6xU?l7R#ZQfJnQxPnk#BHx)2V~HfSg)W7cA$Uxn zLlI-DkK)>14o+5>zMgI@McK|0q^R%#v4(S^(1&xruv9R=2Puvy{OllH$=Dyp85IDQ z3VvR|zOTdTfNwtXhx}xoTPFf#P!_*GXgB!)mQ#@E^Gh%=q4qC8P>F@W>Qpf*UV_GC zqM@L4&j@TLAE+^d)ka6hBD4#vt0RTUq!d2wqunQ<6w-4FY9xih+rZNRl8&OUD<${K zQJS;~g#kq6)D@xs*qUK9vEQx=jR3&g$C{8-w5SR}17op4J58x5nD;z}*2X&)ERGlm z(O}-vP{vy-eU{x|^4!?r^*9p{;F8eQW(1^6B5WcFp`0rNd= z8-L&2V7$jlqaB*84GPKtSrm2V7jFikq;VmoE(mgh zYRI6N+|vr#g&b5P)^MF88C*=W|3H$6&N{*w2^!-?#(I}CwZD?s;yT&VsOcq5C=NoJu%H4{O zvBlCKhWvS%w0bPyof+`7frda5^#)W@fo>{GB4&XyCl(sC9V3zADJFv^r2ea(3%`li znCm|*k0+@BjJf`2`~Or0Chh+da{X;_MOxP?I--dRIBY`td3^2cbTMrKA<{EqUqhN_ z7P6YHxGh9w;4(z=?)u3X=_o@=R5tOG(MmnC{EiZ_sTU4v4fq(M42? zMz(5?xCc>P4hwzuM#KmTf-z30hEQ#)2sJ`ranN5Ctf>^@vQD%FB>_?2sg^L_%m&IB zxgDySB8!2XWJ{BAZ#}LA(=vR7cas%6(I<&~b#GqNyir6`xw+!Qv-WlmEHVZzzL*#f zBx4DPsy;o{MXCxy(o#iAsdQ;VA0*3i2*zSuyzDzLqWe_H;wn|~l*u1)F?WTl)6|zo|Kf5#KfvBLcSFhZ$Ol? z2J8orZk8hA8K}tkka1*JcJb-;KjyK!DSm7YmeVZ5$U?f(Nw5T9`g0PrbW09GcG!^o^C_JGLOFd`$QPb4RF;z`c3kG~@>U@FifP}*`&s3wbyy2LY zoPBQkDIFDzu&Ay>k}a&or~|D?=r%`laAQgeu?g3%0L^|BcR}6v{BO85%pwS4UXEoa1>l9*>cLoZ+#%GlO&gh`#r<0>&@fnTM=e zC?D8&hJ`R1>Ba_aA<426I=-TkDW4NAo`!VdfdPXZrra`6$zyb(WR)vmjF(QN9$|9h z?;CWDqW@tMpz(?V`Q`Qhni_xAr2an<*9rUI$iR1Ub(~oL4^)A%*XI9KHF^GXVlJ*X z8eNS_W0h&W3 zA(HE_z5=9+A~h! zFc&QgJcMvEj+pUeixy8I7NRQND|hH>ES*vywv1#vY{faV&{Ji(V4(4dL>Nncs@`<(k401}Y+AgyhH-WV+5mwN8_}<1!`DKq9*6Wft^Xqk3%D z23gn`%Ly`?JD7zR;>YiFq9?NR4K%ohriVdU&k7?%P?kG17QmSkJ;AxDxECz7&R?S7IzYcKD&tHX)8nx-Y8+=L@s2^0v>ghELm z$%o3=k@8V8%-lqX-N#6Mj9dk*LKN65Tcuj|#pRZHkd;CnofA3k_lQ-+ zzVJyy9aLzIWY_a237Zv zeM`|LMY70}x{7NqfaNs;!(SjHR}$KXEo5YeEMg1;tDDIL*mTO3@lL83u9^!5n=LJz z7EFnE79`gvEZRv`kplCZ!%zv-=%CYtMBc8Sh!ed~HIf%BPxI_J zRjL=7CCMvG^X%wVsu!w6^MW>-XGg`To`i!GsYvtqTvBEw0zT2CS#hTweBE(Rlcgdz zT^CM!$S$cj>BN#vkLO*;I@;u=XElRr(Kzdq+$(UpOKKiuRCRFJFGGl3>65%A&|+fq z3p&B|d%ddDPYSQP(seH^U@PK40$(15aC$(C2wW0Pu^b(F?E?>_D`-!oHMs3hkO|G- z>46)aBC~6JjiJY+OeU9&A2VgMhQUFCHX7xTm1$INkSnLDrXI}&m4l=r1%@r87qS_> zIG#&^-anjPgqxzwdOW3%l*Zx!1FZuVZU^nSWp`)61&aD~F{s_b7D>R4f}STBn?2y~ z>+gzbe$dE=LL}#;6Dufn#d9Mdgbpyga&=^_+Cb=QbR^>EhVR&wjvdGl5QYO$csts` zCZr)^})EUWscSp3(^-!b9{i3csGL{ZckX4)83Yn{-S&z#fh?Mg>~-oADH;)Ttd-4m~*o zm|_gmmfFD!*%ZRU=)j>A2!a~Q09rI)0kAZ3S#2~A9d!i!d%M9K9CitIy2#9epO6_4 zI_pVt9HXhJBnG{Ob4h{e2txJ)Buro{>l_={9nQHa=t-Tds}yb#C~oF+gqIzF%|gNP z5AIYHdhZaw!C;eNOaL|pO_hg5EHIc|<~tRtBj2h4PbG{ZI>KX1 znwg4Dvn4$|Y_}&K&rMmRR`wYUM}eIVa~C!)@XM|p={q2e7~R3-;HyV25B~y+ z2q}WPaAuHiesCD59%=S($V^LoNjQv6b`Syh%_b2XMe-zEj7r_^B;!=+#pw|X`=N6V zC ziYrO5lNT4Dpp5dE86QuW@ey6m#sO=Vb7-m;;P|n`WP-ATlCOqiT+SlA$2!ru+K3)A zLk=bs4f|YLqjJS$_l{;mamib%#04{{jeA|vNMwcZk<&)iqv$a+=x~|~BW@c6`&cX4 zb_8fz5a1O4Tnp3x4}QwL|4iv4sl?gu=-RM!X_Tr{|b9ctMFTLBb%j{czRF!R}R z%lIHYIt!OidDsyZ-C`gFJXJDC#VrQZHAz^mENa*{WF}HZK?~>6ny|snmSAo?uLYQE zKbk$2NKY_C^B4qs@Sa2htRd z!N?H~p4aCZ+DeQXj(dzS5U>Idf$vE%fXsjq{T~!^xnh@5h@cgu@J+a}?HX%mlAy zm4KToa9&wEuceGAUtW-?+?z+i$qA4Ba1dH)JDq;3&lz{3$V}_GfERdqhie2 zRnY1O0d#G)>E3J>tHNpq4LQLEGH0sJGOF~%9>+m!TxVfrxEvv~s#Zp}_0$MHxWFi& zd6gF6J&}e*9f?e0f*$2C3gFEZ_X2!Dl?wbKBGAy^ycGgKB*0T+Z%GQ zO^oW>hk}I!bzJZTc8)%?;{W>ee9kn0c%2dxSVjM<8JzvA{9kip^Md`yS^3N_7v<#t zkl!na_47x}@;Ur}W{iw3CC?@NmzgUSl6pn{kb(dk!eK2AQM~L{N5g@r4u}(#C2GMu zIKKM`ZC1UmS*HyXq_~yh6$JqF2uM+tgDhp36E2JuMp2Ylt1>JUFKr#fg4>jpBSe&f zP&||$#pfYeQAD)Ne^Vf`DH;UUH@p$_{#2&4UFFB9(XYfkY4f>bWPZO* z5DwXK#lBvMye1n5K zyJ7&PXN!fIT|V~9Op?8`i~P{1lj)L4ut#_8jLLZ&60{Hi5N`k$5GMQhFBN&2st9va z&{OkJ4}V*63=0`I2#}bOb!q2q#ZjzDT+e0J9p9nQX!pwDel25k929D_L_Zmjq}a~U zU4G$@lLPoA!Gz0jFcr)44YDn}P6|JO>Q=Ou<+0M&xw+u&H%_=*8u_rfG+@pHhU&J_ zQr4IbTR?1oT2vnWmf7jNywmF=fx(+1!<&LY=e-=9{>wCAS&cF)2g7V?g9tXv;Hq|& zk4c%X0(Wcgr3Ge^!gNh=9;VSvQsq)@7e?g?R+C3LWi8TiTNv?6LMbcmw9v0(VkhPt z26nJd4&#I=lF(&a({>td72LmIUU_j7=1cM>E8qyPM-o!ZSr8=#ERjkn12!@Xv5GW8 ziOp1oG8!{=eS#1hQVo?WF^S4ZC25Li1$S&NDhDNS>S4z&KyoromWnnl;ZP^xy02Pm zbE`%JOR^YV(y7L3tgx_p!09dF6!g5rYK%d}in~3r&B}2j{I`h9L%5TaQQ+CMLUEhG zZepFdT^hw+8N)3rDaPBwoH1I(xPGQ+YGGnN zYiY(igtZk=y4))iRKWk>;i^c6#aiOwOdWM%nKBY$w_PjEpnBt@t73FI#C#_rVs4gT zwUdA0|GG~prwZb96Bn4VQG)@~G6t9(oyM!OiB2*GlN=~{*}&C*G4 zI`4DxIe$}h6S>pTQ(mcPbUG3tWh*t%di1dhGu0N0XR5^Ou-5|n^9Cj`mnkRX=X&626w>pI z%29tQsWj1DRelB>?4ZwW8uXnzq)KG*9VAVzRges^=L-oVjUeOX;$h|!N!_jmLQrJL z!4Y(-o{u3*qW*x>v)f-(&>WpvNNPk!XC<@>evIuQG(0ed!7H7c!C1Y*#c@^-K|&U-Mf%B`Nt5?{rXvt6nIlFM++8TGz(pgkmub#}O9M7&46`v~{4d1} zytajzB4k&L%2h`xs1zj!W8reMUDlxxbzui~@;I6a6IO)0>0yzu1>(5V9FJq$$rrIz z%oEJ^-m>9mRfW0m&Wb;Tk>2ncazebZWSQ1K;GhI5#%vA<1vp{#UI3~$1Rm7YQC7Y& zaMqQQO6n#6V)dfRzZfs-3*JQOI#MsPCC9+=d)PFJC3%dH9D;D(8Z0d_TGUbXDG71p zvSaqqBO@2jnz&O^MzUxLPo|yL)0K7+2b|W}(gkdIk53jY#TOcS$i%e_#wJpqa@c$T z2M51kxM>kNYRx3CT)I!_@`YWfk0!tfR^aoAdn$_pNt#Q#nl-JwV=dzO|p<6u@|yK4zdAy#orT(@w9X(6>OG_i7fEW*Hq{V?qY7)Ph{ z1{0QsPi>sNVYo-xlU@*weX%*X0eLe7SrPIpr}PZYz?dIufG*LUFM#Mt$*Lm7>EZ&+ zoVKx5rc?}b!7AqXtPD` zHXq>_3W;Kl+L{qg0{v?OUjbnjuu6=6m5}KZDF&yhq=Xol12xdb4!qR<47!5jku*m_AFoc9tKt>YAhHPiZ5tD$TN4~|h0OY|~fgeX4 z?{d454)?sypEZ42wfWPW6R6Bp`G+9@2?;>ADXIPrBww?@885i22i~1~tWoE{Wds>q zr6J@`x6W&g4Iglpc)GY`6zx(z4NMHx`XD_ag_#%VKt4x!#E~@eW*7&| z;?D~DD7l1Wle)ccgtPHlU=sg^nIt3T6|^Ns(4@n0$EF3`IQF(^q z!i_THsS*MzxNyAcQg*xEYzO%Uyy=oroUAO?pqMPVhFu(!O3?=cLLAt(x1J8*+hih5 zR~`FdF8QlfLAl_T> za?cEk%HqN0>4t1qy}2_={sEMfQ*exhy)Ha|`F!N)LW>dV1863b3 z!rx(Q*_dUPi`6sKlH=ufK>(uJ0CPavMs8PS$h{ZOyXBDCtfnee8dYm82kD&pt{C;l zfJ;{VfW?5LU#+uI$Iz(uaJI#hN=(K9o+-~V7lR?Hp&uXN200`6%xE&7?HG5fUD^Cw zwS%Q}(Fpe=z))c*>-X7RTQXVJ09S8o04^;`DBlh|?oGYe?k^Qb!`u7~g3n?a9X+=|oxxio-XGP?O!g(*sNXfwhr9dn|pP408K^Y3G1u&*FBj+V^nHcmyrE1?V=xdx-Ez@JA4!j6%W;@1pipx+8m| zl-X9xi6bZgJ2p9!Ym#Mj6?A|F=4kgfMH>C$yyTOlT}2mIc_dx23@i%fUxXfUUG1os z=%-~Z)n0o1vUYLB4j4dw*~4OdsrnhQ5!MbyRvH?IeiQC%X}ZL#y5CaN=4N;jwMY8I zT%3wFMtBdni6*p%Iv(cV;>E1(9!FOKX$51dWJtMhHf@x+bpqHBas-w}iq&jt8(C3z zf!(ZOMe!0S%%+=N(M1vnS*C?g+9--@%_$jE&g1xP_sbEc&374e3yl~@$ zxbrHFvF_py#_>{L$aBCrUeHGwXN6w@t6eEAK(Q)(wLmJd)fG;@sMU6Q(6JGzSVB51 zu@EpA^b|;|+%%R#u^>Cp(p)cAb=1thiTfkCWv;{o=Bd-mKRzz-RGGXvb7(dO?UdQG zKN{xDg~8(di;!KatWFi~i{#9d^3)YG<-wAfRGiAN@tc!Z5zG%IhS`*oFTF)rm@J0K zdhSP3$i3eIEs=;TD^`YC%BBQOg$PuSnEbC+^GnFt}A-rrSMLF4qL{FhCtMe3u8P(3NVC6@)IZ%1|+EMZ7 zsC0Kx3HTW~W2zo8b2wq?b|1@cMm1C}w*_?aP1D3&Fc|$aKVQHkb$H2*EoZ|^F>P#)Oj7nBzlr{L>Wz&sr~D{3)ozvfU1i(<(`iES;(X*d$xp8!pq_R_&;!YFUyc zN@eY>ptczvUzmZNdBW$VF(6fJyR=3+BN#1F&1r4izJ;nTji9y|{zijB`dfvkB($t` zoSUi_L4#!2-a++un6{p+4VRTSiv^RJNaoUKYsugmuy5U!wNP{xEp2XW(mD|%Z=QG$tI)d^ZBMQ+Vx&@f zmX~5PId`hejU8t}nCE#ytI%prs%71)L%jptF{*n;F0|lKpQ&w7nQnNLT(F8vvS_E7 zOrYrR$&P}P*%`lht5;1t-ONCp#+|2dkFu{kH%H@M?<_9|6gK4|piOZBE#>nFjNmhv zcz`4c7KeSca-_!#@q=NC+EGD@%9*$^O5DEH7F~!EH_jzn%g|wz7DRo>f!?lOX`PoH zdU&(b7@4F4PaUGW?P%vj&t>O2YjSpnJ3cw(O^v>-Pi0>mXpUTegei4No?(dK5YxjEL@6l>XLk7hi-1L0%FW2Poz z2yw%ED=IPfPNXy&^-_`(i7`E5>Utub4oZ$H;RYbPs-(Wk=e6l{ID0aAZjaF4ak%G9 zR3Tf0C3A%WT7t2lLg42C{dJ(yJglR(NF$72TcpXM568*`vOyn2xU}ol#;@z{>nE&W zNb@s9T)9?bAFlHahP?hrgojuq2qO{yupi-&CASx#tqeHIgg}2k$O@{OSQusqgA|dK zK`t6R88J~WIy$vRvsl9{#mB3KW@d*eAIFLtsW{VeZPyz3dK>gNkaEMr5fQ5?&_r4{ zI0$x14gTQ~y#fQ-9474*MNlRVitS;SakTmbrRupvV2j;Yza3DwB%+0-e7PM5Z zd>qt%tJLp@`azl(=TT2xY7MDPX~x7LS&6I$Yz`7t96-keQIA)Saj_Y21pNKohq~fj z9RnTyvfb1nhEzH?X2YgAyV+pm$OV^lsX#q$xpgckk0(&3EQp>D_x2BH)Fzfyj%yJ@ zf|1Kc(P8hJ4O-G7N1yt-JG*jqVGM@3_LRxh9hE)~2GY_=-ZAm?RkWwfFh?nCMz zFaX%Bnq%UR!|6bfn}aT6GmK5P)D0LWq}WIv*!Gq7^{l8PoW~%)ig)%NB=_sKCW~Ii zL)w8O9dVMn505sbD}LcI4((ubUKwNfT)7Q9qKs9VI)by zI2kAa+S@VEeSOCb@t#8i-F+NE2T*yK4VQG;j?CC|(l}H)r>p0YZfV2?hK$hn<4Sj6M`c2S~ z&c2?*17*6)fk-p@Zix2}^z|It>x3ekyD&rBd$4z)JH8Jn4k{u@i5*>CeRhjtY)WFv zoG5}&GOz0e`UDPcIAZlF?uP@gbR2<>-Eg?uf%pg+N-MFmm(0ka0S@Z^>O|d$%HRjO z5A9{!w9+#bJ-bm=qmmE_Ntw0&265`+WbEDCkd!d^B_V(z2r@|i#Qi}yFDJ{ZrYl^q zEI)EOO)Td#+HE-mZEppf>8|{~tBKI{=Ahv1K+*}FxCI834l9@v1bnOghuwM#TLjf9@YbMfR$kSFsu|mc&+&A3^}J`%4?;-0f(LC zQ8brlcJ^sKfu2^WnBJ7f6J2;xxpTQm1q~x+L^khNoj&QRw6C=Hp&xV07pR39qeLkPcAJL3>L5O->TMSnb?xo1lV!Wpe61GgvmfNfa z{P4~Y#k5E|PkG}(ny8dg<-5uWceLZW4#M@uukYT?iyN6SwYW4AN&)cGOMtQ7lkkeG zjsaPQ5R4Go2@dtPHEwGp3@u;fWNneFGBD1LbdPB*gy=zy5Fn z!W%=yHJWBlj)B^ye>yyN!pQqWzLV#A{;TYNiDaI!_|IF~TH5UIzl|*m@&C@sXMPvH zwErP)UDG8BBq}2DxT~NdxbI`l-WT6e$G- zP&B7TuPz(s$2G(cIE6!CcTt`rx{t$65Lk~n{JTOogj1k7b&Quf8=bS}WwxDzn8%4i z(LhCOrg{JYZcNcXt(XHq>YAFl*n%GnTu*6eEP*?dJ=1geY>9gp8<_#wt0)p-Rgad^ zQoX{17HOoz>0FW4LghPw$b_uxfO%N3P9JkGza-p`Q#3Kn)XTiUjF&2B?!&o_cy9fM?vZxvRx;wh; z?#|s_Ys#BxvFBe_zsBP4s1_(yE%#hcE%!3r{1}FEv%|WL{7T4-=waoH)UG;|~V@oMipBz0-M2%Cz>Di;{&24_Xjt$YyH-zGh4-cn! z8W{+eV-k@FkXcz6ZP5-hmcV9#QgwJlMS^O;gQA0A3ovM(65P+SWpP;1xmXgar@g?WPF2oJ+N#qMNS5C=gfB0NPleXaOBR*mfaUwRv>a{s3b`t+WEs@(sZ8=G3} z`u|(EY-wA#|DTP|d|rK(`#%t$vwQy+YZY()Ev@v$r>QyGxLs>(iM2Gxnzj*k#w3@2 zJqsR)&xq)+>K#8E7Ri?4SvX8J%_QBkaM-DR=F}ahPf9L2E=?y0|X1(5(qtRj(L`B&1C_&K1nCc-(`DEEzkv(cr6PR%g+C zGKrZHaz%zXNz!H7?p@lPC~7e+nMOy}bf%^5S@=kECxH1T6PzGNwO;H7MOpEJg=({G z!yvB)8e{~Dnl6$lFDCP0a6OYw%#aB$7D`rBLbEVQmH_x>CF4#N&!8bp@ys&2KF-tz zseT#-hSxGu9)1ukV3bPnaD6>&E`_Eor~cTXFI02P($wL~e5?e^vadkfnzU|Ga8Zh9 zs3AV;<;WJ-)Cw3u1it_K9!=5_IyAe`?C9;LEZV_A z-_CtaySn@Odi!=p$v5B5JX(z2w{LYIs=wtG8G@_FmnJt+#qhmQRnKdB7;{aaPXXA zxuI4fsXpyE55!_{9B$la_9$EMcJd9hA{LF-n;1tynm|L=XE|2h}4CI}vjyZ%E!W>sbhcNFZmSWqWz z@?`pUpgb<{S#Z!+GiHB*U?G((hzJ~oV!qt z%jG6$s685;PECgU23E$w0;*inAw9Gu0Aa9sn`9zHR+gS8l;2a!2AOe*bQs7+CZ^5E zgiG*fxO0d6jwD0#)YvEpOHLH>|DfdtO>LA*cp1jo`jwMPio#;U;O7jp&$;s2aoO## zy|HnLClyeqF`h2v?&!@CfjA2EMn%^eIh9QspUA!=v>h&6!t2EcoS0P~{H(U@Qp_tH z==EbXPr>J54w*7)Mk&X1k(ZzBl}jBA23&4|TWgoLlZ7)ypKX!kcquzUm|{h&U2z_d zvN@EW#IQrbpeq8}S+^W9!Q#cWY~eCTwCgofTwwX_TUZalAjvmp`U8@!b>(^_0f=M~ z+-^HLLVWZsH1^35Ak0=)Sr+tSue??W#$7i0laCiZadamz`Mzwm>>ns3vgW8>u-?tc zer3h{>SA0zm#I1k>ds#39$j#`?c6>8s!3M>@bMK0xW_0+7VNzwhN=Lxp4Y) zPtM|);teaaM{RcoMOuJ|8gDw3fINa8)K)||UF&M4ST1bW^jS$yLT;&c5ENwy)8q zxnU!SgdP)sfP7-Qc#lQnZJ&BuLz7RoI-n-f*8OA&g*#w*!Nzkki4?O`Mk(TRtWmz{ zr7f)F3MD0Pg|%0CX$e&tbdf(PyU16Hq#%NyqSr7PwCT~<@@7A3SU)9QQfYW|?#(PqLf;1PErcMp`CJ zwBZF15pMbe703+> zJf~sgx!DC_@M92$@nR^ux;5g|bV4WW)kC1FEwhm)DG4S(D0hrfdN z;IlTiZf%&`AhYuIR7nr?kSG>(!NkUW)+4P5foC`D!Z{DSk~p-k6a}HmeqCD{n;qN1 zRb$BB1a9etE-~m6n5If?1V7KDIU4r{9$=5WBStnQm4{1+^A*Ni1K`d8EVT%emHTSoqBDQ$_zrw$nUiHK1zt->pqs?Djv+O$+)zXXP`$+Aos+53Zb9 zDFC@@`&3f&u`f!?%t}&N=ka9$Rwz1p?iC0s9bnvF=FuDwq zF*wW4@yUlH;Id3rP9qLl1#mu&TW9zPH)r4uT~BpX<&l_;y5?-=gk8(d^=>@-pDOep zl;KZT{j-|?-{#h>&366Iw#JqP`hPY)^GgmT`hT$JU^iZ|=h5!F(xJdtDjo(~ESv8p zwE1p|H8!4Mn{U#P?&)G7k%W6H+EsPr6UlKfB*eDyvCszK1~tk90Tps-a-SV1#Jh(K zTOq3#wG5$`2|9N8d}%r)+Q7i0-ik5F&9;QGV!#YWG_7ApqkF}>u7%erA16&RGQhtl zP>B(8XS9iIZb};`{}FIXKp8$t+L_fL_v}Ku&)S_#kc+fIvJ2XX4zCkrP{xy9NJl#lPD^xC)yaw{9gP2X|o?d{jvc?uUgL7%ehkJK147H8mA664^u~ zR~UI&yR9y`1<=tcKq8+{8}#IjCSXTQh2iQ|^oIyYqDU5$ z9f+iDp3bBZVEp*BJwKC3hRJPoT%T@jM3`j0=mvv6Ig`bFA%{?4IF?B}0U=dXm&zp_ z5GJVAVlJuGo|_~4q8KKlrzbKL1IimK!=%R()nQJISB251^{Oz*G?}`pP-d=r$I_0$ zbLsq8RhV4L+4)q0W{o+EkBwngJ~e93B1v=&8IBxq;*%^GdAi8-ykh`t5LE#R&gw~$ zST<(H(FT$v@*D#vGRF!D$ND!5VEeN3$lgDY6mi$V`_U#W6c~!bqnR z5t1!1O{X10fS_hrpHAu&Chy#53?>h{Z26p#WuxWj6TlU+VX_F)NIej2YQ&{~06CS& zM=+CuWzvpKDWFIm2Qn)`(Yd6slWx`KjHEs-QG$_V-f(P+=`bc!EXkBJI|*u@6Lhr3 z9K?d;kLxBGuCXj5Ty9l}8j_}i1dv>FoNl#b!I{a;9w~%T6=J$7#H3?k6NpKJuI#*H z7^lOdC2~8_Nmhb2bPO0#2NhvcN}liVN9l-bLlPoosdATr5KX6hHB#~yi%`Bf+@-J|Et^klB zfT}>aWEXOybe@WCEf=})rBZ$-;X=JIJDg#wH{)PF1cXijTy`D6khlCOwy>6(#gDaq+j16b@%)|W##F~j6Yd^ z#cZ-&<$Us!@n|EEOwPCrnTRx$OpVYDJ#)gALsIB5o59I5GKn!gN`6ohG?uXv$q#yt z(1D?eV~oQwbSaVipcJ3<)Ji?ZNA_6WJymx}&1WUpe0Ge{3n`KOu*ebff9A|7vRR`! zMLsn}!!0#+Y_en}1M>nYJgZF3lrn-A_r!*>kT9)W!aZb4VUkqT>Had3IXRd7%(Cuh zC1@P%cJS{X&gM2tyofFC^7nOHO@MIu=nVG|4&AyjY}^_or2 z{tF<9>lar8w@mqlD7BrO|GH>hQ3 z$0sPh<^(z@SkTF}+?XWoCgKtN4vF2?(pr#ZO)gbqYKM}7zy?DzcvEb6b1aI@+)P_3 zX}MZH6r9#F!v6(Tg`MS_zT5g>TDMKZf6njubNy61{|TWo&#?YiYipZ5{zp@D+k*f1 zv+|kW^G-VbL1P$K&+L!?J&6$`ryaCZw&tuEW?!y&@;BKu!y328+RlPz7&^=~P@6ho zg$4|Rm$;N>6m@bn%N1hO&a5~d&+CPJ33QK(geXE0B;PPBGt`QhoX0vU?&=A0kaK;e z2_20}i)bwB^`Z?aREZDs;EIrSu16`Pp3GD%@;>}Wpb4WJ?3{ZuE zQzB1mPbWxA$Y~(}EN8RyP@_IT!E=vPpg5I-Y{LbqR}Zi*28j=;+1hZUd|J7HHi z^grt~78ZIt3APcqlWfA;bGktHbOLMyzj@L5>(2aKli_3s=**95tIo zmt17g!@>eOC{X7LieDb)TgmQo9(Z%%BL$5lEYIT7ok92mX5MtrB$ye!QL6~&n9|h< z7yzp_m>;GqZd~z^!~NgoT|InRM%5Hf@%sv!OS!c$U*#McFCmdl(IBk)Fm5s7^Vhkz znpBf`f;fmaZt#U!h+6(soW<>BH#b?15spXrth8(6Wt4X1vzVOSbRL*(BaR=;Cz{}4 z9&UKq(Sy^id&P@EnThA~%ch;Tht%!rv)8&|j62--{vYw^I=4?1{@)7YbsAd0)#QIo zZT9#tjSKR>v-Fu?rq{;*10k6m|37C=UtO581&9^muQArtcqT*qIjleEc}i$;NXuKq zF0artQ`l_h+uQwRXdQ=DI37a%k=u!0#rYkuFL!T5Ic|WqFhp+!x=R%1Q$0U5X5+tb zfX>?iDuqz|6FEN5HL+XxI6hU*ejo;y-S6#(!&V*}8E4pN-G_9*ENUKWP+- zB_JKJfX)mL;8>jJiVbj(ZZ$e?fc~uZv|*823a<^?%{PaE@bXMQM8i7m+e(%F&pUKl zCV*A;|JKIFRy+T{VE=uVKJ&U0R0@ERqv%^V+qL^xYypf70fKq%QlH6!si!g~GU`OX z7f|d7q;>A?IZ#SaSII?mqONE1pa4$Tn=ue?u{!#7oo_=adOb>y)PUqEy_hi4W~3rb znm4rsX(J((vPY+AZi%&?@ka^L9=q;=o34QrpMp$*OZZ6^$K29xpsv`QfU*q8CEFJE z90uzknH9yr&oH%oX(VkVH63K8sE#1sFA`bJANTv>oxO)|=%U|_u84$RzxQ=d)pg_P3YG~Xq`_JRvSLw;0!aU2}8Y|0v#8@c!8P8KKk8Y$u1cr~g z*y0W1IuZ;Pp(Gz>G(*#@i;}<-kYIxpjtb(-mS8~WtcHFRCt$V~%1*#E>EnV}jzX_C zORh-4f`J+WevJO1(Fh@oN=4B46o(rq0K5leClhHSr8PiZ4b(Md#4jP2dPHY|-=488 zG%|~ALIRlT;zUtyBu8_Lg@<`^<`8Ug5Rx?^Ee?hoF8Tl@EvrF*M8D^@b;6PIf4Pc> zRg^zR%r7a#!vbQX!u~2jum;?r^Ine>>4sDkXVpMp3v>;o5(koc#(LYw-CN-UFQsbA znRw>94kvzq)1Ed0mIxw7#?$6PmvSf$mqFJQ8~9k^Noh}zz|^p#$<&o zE{hHnJ2Wh}w(7!C4yAN1fzBhWlL?g#2~1F-)C%zmsBBKP?DOr zI;zNj+FBcJ_8(1c&20<*pU%o>0~Js3Ij5mBTb%Bbnzz|)C48N|hxYXBZPy}9&f@bK z*<`wu(zT5Nniur>2IBn#9eo23Tre3e#@QO92L~K1zM~!2bsQS#mcg7r1M!|iJq{$~ zprF}SrX#Df_vqoyjspkc2aa^~YZQow(-dD2vcKb+j-xV|nK+i1rhk=|0*F#uG&yDv z07($7=2}uHIhn@`cVtN6g&lb!#;NA!rA@11x}}v7?P?XDe6&gqLACPQB3dOyaxt28 zrD*MChRk<;_ii%ULaTO98{8}3*lNf24HChV`N9rB}{I7 zAX*B8(CpTs!J$F2n09yccegbS4G#@t%Ekami+A<(1u@Al1NZE91t#gP@bVZ-MdW1H zO5)u|2L!yCD~p%RjSE_m%CYXWI?P-AcjR4VF~K)0SPX zpdg0~gF-qTcqHhu2yt66Y!-QSqGE7m@vt4nFv)b-iA%t`Vk3K&VF9`lbmo;S6(w|m zl?0OGC`t3nmL_z9l?GzsEDiZSMmE$H!HI!uV$~^g0dzxCexmFkZlx&pi`Hrc4%WV_!0@C$ce0c}HDN z0G`ecq;t)MpSw?m`(I?r$j(b0)$V`Itv36=rY$6K;r@3vKDPTG%(-PQU-b&eFMNz& zCxz7;-_Y!Cd_xs)d_$FPd_%Lj@eT3QZ>ZvpZwSx0p$a!XUfYoCjnB$eZhRuye&Z7v zE;l}rr`-5Ns(j-UiEcMO6~J~0Q!;J$L6Poy9~8N6_d$`V-UnT;d@f^VUHOLOE8mdg z$~ROphtw+{q}Z=~kY>B`L6UmqgA~^*-w@%xUacgYAQZ(*1CFc({F-lpgYV zy=5`*E29GgyEM)Qi9B%%9)-)9Wpm(iNs%-R4yMxS;o*i^R!`Q2Ywf^!sFiDercn_* z%{%C6&!EhMxi%gvs@D4QcUkGu(6dK7)H|ScA0;;nnY*N{oP3ig11YGZqsWkS&&cIx zD%~_B&~nw_)^pauFCnx7_iG3TDu;TS>z>(>3ub>$Z=Y6gXg!CtfbFgl)Vg{#texb$ z;8Yn~mwO0XGYj)@hUdXvt91Vp6{^=p+LcNdM<-TQN@nknYwqlD3_0(Mwg#5DMq1TO zV}WQl97v9!|$TK|k$)H4mHmNrHT3Gh-OX+Z?0FyP0Ckxih73l5RM5FW_2=&7L3;zirFXvr)@ zQL!aT;G^U+5N(SzsWp`n&N@IRw_*i$?BHr!cg3$y>&X&oB$e+=uAot$mIl2Odp|%-KaThh0eKG8s@T!2nwZ#30ER2u#6eV?yl+p(B7)XrfTvGpYTc zH-=jGglLyAIElE8?dv_*tsoR~+6`P`8t&ExsOnLbY`Cua_IDpX(A~#w>CV#5mst5W zP40dc!G{I}qxK7;3kWPypL7JdfS~Y?DS@?v7Pjy3{=Js|S$JbWXoztEJRl)JK_7qL z;Rz8!7$RdQeEeBQq@OVIe=;XhS^7V3(!W{I|K>J3{cqdaxiSg&n&ICs+%8Dui#@}Pm|aSlvQZF%&*H0 znImlfAOH?}l7=zrsa{r6e#Bq&e>M z;q!7>7)9g?#+Wv|gR6;WCY21P@&|9qdU8Cc`3DL!7;iAAQSv#HD_Im0NM0lo@na=Z z<3@5E2)e*czQ;)`+HV$FH(RNoB-4H~_ZhsArQYmgc2&-@ZB4T%4Go7M;C9TJ52bEq zBeIc$Y3tD?oi!x1<3P>9&12Sr^oz{S@dQ|>^6`QURBJNmC{pz%i+jFRpt#k~hnS-} zl$+8DrL5Kf7H18pfR11JC^z`|kXY>kRsT^4%p2m75czvN zY{i)LeMI^WVUwU!svnW2?c29$`}C=_UMz+WgIA713Z(~$?2N}l`;4E}Ft!>QVFN1CL8s+c*;56mt7_KRzA&T1}t%t~{E%iZhoYMGmH|CnGSR;!_o179Xj;2%rV@f=g-FkyQrwgw9+xWl+Z_*>aP3ip6Xnx~|D*&D;OrSsRadF8IP) zPu+h$=2^66xu>JRMrNSi5 zgKg8ybJiVR)&kdfNJW0>EC*vu2raZTL zUg){qbEoI!p4WKZ;CYMZ?VkHQ_j}&&dC2n-&nG?q<>h7((zwY6>&(wXn?#a5J*8OJDl0|D4X^X;(b}ZVr=*XhvqT`F6 zx9BB{-mvIhiymC`=%Oz#`re|a7yV)J%EjvzZ(bZ*+_U)T;<3e3i*H|i*W!09{@~(I zFaGM{rxyQm$&w`(EooS?b;-UZH!L}}E@;F zOM90lmKK-ZzV!7=-@EkVOTV=AsinVOwtU$Y%bJ(%S$5;H?6MavyKC9Imwjy6mzMo- z+3&m;ckbme_3Keh6^D}R07n)4#(^_-VF@A>E5ecprTed)ZPo$o!r{``*fZ#w_P z`FEZFf%Cs`{!cIPUU20Fofjl7c-{qfU-01zzJ9?otJbV)TGhKMv+5FO(2cdt&ZzHRl}R)1>s57yMJ*|4T_O>)g&taagY@rsQHH{QDOJsZDS@2%ffKVJXZ`p?w=>dJ;I zufOuIu6*dqA2nRu(9>|D;XMuC4y+7Z6*wNaH}I90){ z({`}!ui74I``;~Fw-mPAzvahUH*URo>l?RzecRe?hqt|C+h?~g-oAVL^S6Iw`)^`f zV#V0|WB;`yykla=yLbF(XTwf?=i7Jwpxxh|XuqfZ$z9s6n|Hl+*OOPRzbbLny;ptz z>J3+?u71bWKkNv09P4;*$Io^*?k?>9;O<{_#yU@Sexj?cYj4*bU5|IK?mp7}hVJj~ z@$VVi^PW9V?`_+A%id4yTfA@ozE|w~de3D&$)5Xqp1x-5H7BombpML|{rlgr|N93v z9Vi@l_+ah9YYx8Z;I|LeAIctjsMpim)BCF4?;LJ8eEje~Uc2Pl!`I$@?Z5Xm_1)U{ znf^8X@&0%B|8ijWz{>`{btG`4bmWoi&cANxy8EvC)%9K1zw-Jgk4BH4Jo@j12-?e`TCpR zee>@Vy@`7h&y4hpym92|WM}fV$)BXIPQ5zyW4&E}rT)Xw_R&|4{%EXy>{Vkw9=~e* zuJNB5oyHrCpC8+I>@CNBHPJiq&WUH!*QX!IEX&-S`EYi1b|U*|?(*Dp?uq>7{O$QC zkH?O`=J?Zv{e^d!HRiDSq2gM?Og&Z#l>V~xy~$mZcTfI$>bj{9Os|^GPCquYY39W< zKRmJL#NXbs=$7OykKDTc))(ITy^|d$?|EL$^G2Tc$n!Tm|F-8p^@6=Gc-ISkFPwPc zzr3jNMX!9(|NO=EfAR2bm)-V)+kWtud;ju1x1V==;r6fp)sDY<%U>`0YvZpUe{su; zU;pAi+>yHDpYLqE^R7F8|B~cO{`qg3{^oUm^XyAUU;6mVw!G}kFJJQV?90FQimP7n zu2-&l<%w7R;8h1-_28?uSKsmK|9MUPHJ`hy^{%(P*7w@dYoC1Gf!BTL^&4OR^4I_V z4dZY4>fO8Ve&CJk-uU7-{_0JsH+|{NSHJoGw_Ns?JKyr#w;FH##yxxQdGOvV@4f47 zOWrp5wts*7b#MR7-){Tc``&TsJMMhP|GqQ(&L`j1_pV3p+j`%9?_T%rm%XRzs{oRM|58r>!0~bAT=leYGE4}YO{{H5_|JwWazyFaBZ2Q3d|4{!AZ~Wkz z58m-$&4V)!KK;=6Lr;F_h7UdQ;cGtp$iq7x{@_1G{_&k3S^tr{KYHOuU-mKI$8P)B zvmZb4@n=4f|HMx}IrhmPJQ9E8Tc0}msjobG?W2!>djF?C`%ioR=~JKS_{_&Y+y2>) zd@lC65C8MFe}3rmTR#8bV{MOp@L$^g<%5rJdHlgIZ2iKAzPSC14?nTQet6%H znt$|>AMg3`7yo1MKc4zY{wKft>Fxiy>ObH3v%t^(;lHl_ug9J~`t(yjFZ}%3|9;6Y zF8Ref|EKkT9(m^QGvEDX=9jis=C{}X_J_Zl`u)=1zwUp7|NHPC z_W$AA&t{%|_StWFIz7vlELpl_@iKBUdA-YgE7q=Dv3&W8OIEKrf9++LUUB(lm#$l< zZHzQ%{?LYX>jGPYp~j}x*48T;wzqF<-Wh3WZ3ZMYUaxn>@)Z}aTzPRbA(qW^{yh5$ z&#GmfK2Nr;#_y?JRa3XB=GjL*>j+P?816yhv&2)kXz|jTWwj)??E+6tU0q%6;@ZV^ zi|UX8s;yh(S-fh=`li(#OV{|XO{{(4hUVSJ?-_Z;-(Pr9-xDo`Pm*Gn)_Ce_6r{A+ z5|X!Jm8Z70W>IZzot(L9(dzY09oH^i(|r7%XTRxLQCCBnShvb^mFJ%4{o)-DT)*Y1 z&(HjS_PztIiLC2;l2C&{Xo`w3M0)Q%2!t+DLX)BpLVzfckOTn*4NVjk0ck2C2(F-r zps3gZ5wW14V4=9kVs}>r3$BH4CJ6|*tB?Ec=kxx)&$}C$%-nO%y?4%>Ip^No^KUyW z9pfkbK;gwP+>_q3=aOeTZy(uB<0YZN&7`@#+dK?;b35m~8r+e0EQmmpZgtLDr+ZCD zWyvPbk-g5xlfbo(mvcuLC)W)j_M7T2zN}iaE$!K!Astpv=5wDRJuYjugt8$s^@0gD@9eDGSd(HJ$}-< z)~#=F>+9G7j9r(j$K9_@O!f8X<{z|j8gdGw{2+hZ$YNnNb>k}ZCb7PE(SY0btz#c#^+%VT>Nq_nSbuX4 zE^yR%uFKxV>koMq;#4o1myB6<vQI@A;W!>PxJ4F1#LF>zi}g z`o)g@^%SQ!%lxaNoWu_v7C&nGsJP+sb;P2ZwdKH$XPfZCg)+X*5+@9m^?Ggdj@=-n zrIlGIE+oFG-rAz>5>5^Bef^X;sF#+y`L`0j6)#$@l(+le4K%$Rk*-M8l*!+>Fy_6F zw-Nc)v)HVR-K#wX+&^4GSest@*zigHxR8bxO7KeEiItl_Hm~s3)a`P=gBAp3B+fkq zMHXeAt{+>&_mU(&4$S4VaxU`ok<24)d+t{I`?Az%*P0FUm({5sKDuz$$=yydsA437 z-=gG$M|*Q1PHyj}$62=V2U!I-OnQmV52a*Ag#1sNANLzH)?%mzwp6JTPHsv@^GENh zq`KcbNVr$fwe+%HPmuGbEhE)K`En(_gWJyPoS`KuS;R;mK3lEcRY(w(<4di%9dR-% zIJ&QS(7EWb=Y3^)hb^qWnBv6SN{u~>Sy}Co<3Pf_lJvQ+l_ZwDJ7k%yBO0n4b>de8 zr>gq;fD2De#{rjY@$(d|OHT!DFs6-i2ez>G92Bg$b8|MWpfA?-Y+fOuM%I^4qs8$WTzOT2h}a_$&3!%l1hBMQ;5X zw*o?zEk-9Es&T$mot;ulG1`ea?uQbFFDv`;z@jZC&U>EH0_pB6#^Ov14(}v29T$7rWUl?^iea@~e08UU=euM+ zxKD1i4hiZu`R(IEfl;H#l7wqkm31HH7PYi?Y7urv_3@s({O95|#m}v;bstr@SylE{ zFS_B;o$IW^^#QBdB>Mh?}e2bZ^Hy?5;!U?(aAL;&XjRNa%VQCNqCEpKJH_ zUl%^@_Z-^W=9DfKJ`T*gWs_^~>YM@m_U@o}H^N<^A^li|dWsI^{#xPKk-AjiM8uP= z_wG_$O%*H7b#^&e5iWfwFOIoX{!qiHU-l-SsO(zSt{oW?f?Qlnx{ZBEb~ zGV0Yhu~qxZr6*1N{1&-Ml`B0~c-gEX9of!2*-I9?p?~9Sd7tn`=@2ByygDQVsxP7sSRr!kQ#c`;2>owv$w3Jq&#_P&Ddj0Qj`Dl^sTdH zucTW_H5>1m?dhs8EPn8b*?^;|;e*PPXG3WfwSV?B({l4kQbwYgzIPTQE~#bTqZ6K7 zTl*oi@s;u7&CH0BlA_bCiEFo7UD=WMsN3s?a%xVu--kuwrGa^v7lCoQ+ip3yCM8$7 zt}uDDPJdya_sSbfXq{&>pZ4Y}xSm;&EUdOw%F*jwM^BdiH~?8droX_H?C(F&-Y@Jj zqVo{htE{+i93a-2URbpzd+6T$hB$=|tgzjRn+2M0j^#-{x?1W<&oUv? zi@1uyS9(#c3-ur9<&`ax>UR6IUvzoJ)<59vZA&g$y!y1Lu-^>Bea+1SSFb+k=y=rC^`yW5kD;NV zfq@s#pFbZO8hQTw^((l%`}FD4e|v1dyQnCR#X&*xxWJ#{fR4{toEP-TMtqDjh5in= zN&y|vN5Nta01SLwH$h_p)%BJeiyQOd&;o!2AkD-1z`x?bKp*&66yVI)oA64oKP)cY zgv@N{`=%P-M3^4n*5wbsA2)Ff%XEhV<}uSb00wRYR4kwiUJxBzYRAQa!Uw*Il@O0{ zZi#fobL&a~UR*v_(Dw)gB;#(wB?ag^NKQ=$z!vr*Q!s805DD>v+XvTkggzjGLw5%$ z&i)v@=d@dz+iqLvyQ?v$-2#9lAdUFk?y2Qfvn>z>@v~@<0%D-Q_Zf}=Ob^Rgex7qp z{vCUX0)W>E0r;7)5*Pz2)s~&lz$|nwcC6cTVUws+o{Idiee!(U zwbHfL6&cCmHfh;+Kps-FEGTLzK(k`C?=WHvO42|UZ=oQLCK++QQ50)qDLLFh$BNF? zA}~9wyzv>5TC`#5keA5zou;w(`l|E+G&WGRM2AMQM~E-sZM7>(wFXLp&p&NHRT#PS zoXJYQ2o@^JS}5+q9}DKQ@OC){0-qYhB+51%GFzGZ`at36V2KdZ>U8yq@Qn310WUuP zJsH+D^TpSFI@RzdvIG$tTx~VVdI-#wego=yI3jY1EKf?t_x2?v08kU);XztZZutSy8VYGE-v}CPqt5^2V9OGSULTNbD^s)} zx=E~afT}yo>pZXUE6K*Jap5|v)yer6JNWVGjvYecJuQHU%Pn`*Hh24tsk2O7IsyRE z4L&+$n02}N$mN0QISY+tp%Ls;<+sA8w6Vb>g2^2`3G z`>P4eRD`np_=A2cB@9i{S}83!MNrxCO)|gi=?ncBE%!!XBfm~CViwYAhZ-aV_}#-M zKDgNm7tf*`;QyH2$e7o&y>z2ij=PnBZi3Evt8!Td9wCwEMP(&}S&Dap)lF7rV}wlJ zVwdA^V2Y$4pC(}UvWEn7zS)4uVKJMyrKtsdJMnK*y`+m3$vZ$gH$ph*VPWT?o|v_Q&bbdpCJdhQ$&6suHHbq(&_g?0CTvkZcom=1u8V7*57)F6B{nY(l%%(w`%f5jMdr z(SfbrTMrC~Iu0Nj1X@sMu+4{@ty0VTf&(PWlKF&#o7eL+InTr2YGtKbR@SVPJKHJU9UCa$J}ybtH@+m8 zjzn|`M>G~>j0N*bxbGg{;XCj5?kER=A{M%$=x{1eCDT?vz^yVhN3MlzvOvQsG;2fZ za71-je2Qy3&nVC@lg5vt4envKvKH!9sA!rZdap{Uf7Ead%jNmC(^+4;b~qah^bi?E z{?y)_Pu1&qHb8#WVNa^S-^GxX^2G%`5gB- z4FY6am0KumHo}IlOjUJEH9)-{vz%DLudUf8lCpEI*)als?1ATtd$-Ogy~#=t99g!6 zk99Te1Hf~6?*_-342%-;m66wlC#g9Fg(+tBo+b5FI-`04H2Zj~8p$TSW#et<^wKg> zk88I;rS7aZ4i3>#ZK8ua)#ghIVl6RETj`a~8$DbQ3$oR1JEWTOq*VnhI;^+Rvr%%P zk_9zpg}lPet)d-ctde3qo9MNn|oGanODA}~wep7$|aG>q3h^=`bKmUX1~ zk;@~q-gnmy%*z)(yzvqL;YhxB^2z+XHX*4)Pg^JjR|Lbd`>YlH_-$%}4RBVPvAcjx zV3Bo!;7D22b{3EE9Rus7wWPbD)re6%xG~%cpIqFCLdqjDH#QOq1>|>#ytF=zHInV~ zKSodl8{;bDcdPXPOJ&Dcgx^Ui$A`R8+od9aJI_>25uGxj#>;i0#n+0>_gddgA5Sje4}L%I zL?a6sv12doWd+XGV}SSEZ2xY)o|VHV)2{FW)}lI(vuEGoHGhTN=N;F=k^P(>mx9SA)&%$CpPb{1 zS~gd#2x9DV$@0+AJ=SLCG=j)gc*#STvw8E&A0aU}+OsyEc=|#%BUP}kQz3QKG~_GSU*0Q2!Itc%2IxIrA>av!?R(fPtxKQ51dci zZ7Y$+dWT~OfESnW%G^M8`lh8RXB$=v417oyh-%&(uA9ND!&+^wP;g~#=s2DSmm`XGbP4I)qI!8Z9<{*%o;t@U#hMKPH5xou`xm^}U*R`fjB1+fQB6lRug6$e z1+Bi}M=~%&3^3<-7!i|!;m=?3*oS0IU>3&|?SJj=UsZ^A^(`Fhh%*izATebc`P8`W(e_<`3D07wcEl zM`SO1qiaJ~#x#Y-f!@)M62Nto7*R3`r@Kz5GvZC1kGX)=Db%7rBpiq80J$+HO3cl_ zVNT2j%xy_*h=FV{ueaKm$8!&c01crtfLbEYW15Z3YDsOlFMWMJ&uUR3pb?Jo8S(yY zFvIi#?zLA?EJ?fZHfwO4B&R`2LDsFr=m*a8$tY+@-&rYZ`g(rgg#|XCnoym~@a>FL zUXM-p7nPIDG}gxm)dKX2G{R#Ow64vIW0+s0U6Jkqls0J%B#)$`{{T|vx&qJd$CJn} zz0gE)Ulp-U;q&_(c_Q|0bgK*?TW^W41D1&K%&P^?CIcd1vh9FxL4)qw49rD7F*#Zq zzr0U^xbcvQCs}OE%{GuMpKM5TCT;L<@07rX$tk<1qD|b9ep!ULtOz^V%zQjD%tfLZ zi!U{a$e+W@Cs~rGkBiUYe_)Vt!4R)vR{v5(tQ4V!K^^qPblx;vzt@$IMwYBY9e0$y z7O~n*Wy`wqtV83B?>M_ ztZ7I;(z#wjZTC%|MZZ24_s!UiYC`GXkKb}JeP@?MSryr)wu~v5_!zvsNVSe=6f!`@ao!^=8ih=@{z# zod5d~#X^w{N6p3YgOfU8VXWxSc;K;-ObRVBK_y-TOi=v{I2sSCfeDj{+?-^3@OEGo z)z9C_@oY>c73>5Pti~iiPC8p|58s zr}-AzlLLpg(B_P@MF=%C0Uk+8G`wLD2Cl+k;a{<1+0Dm6EdnW_>_2R2IIJEPWKdQ^ z2l`luPVFnC2^`XdNmBi3q`0q;uI7-go+O<{IgKnNmdS)M2RVeK2r_BqBo&@(?Z}Ys z3sR#YMI^1nVW-_Y^9el+BStdF<`8=eZO)iLL&Vm||Mrvo&&uDe|8Ns;{wp%RW&icQ z$p2xaqxWQJ6CukGl-qCBO^{~bF zx2VI3Jm5^8?7iy|FxV_HoU8#_Ky9W*hg(`G;y_NWUoOxbWTh!^3J?{nryaq^ju7PO zX7A-|O|ZkNg3!xJn@fj=(`1E^q1P89mP8^m7-6xIkqJ{a#8bIjt{LoHBw7|Bbasn5 zf9&bhC~$HYJ&6c|pi$!(WcFLbf(S;?$zeDwoNRpx>C*sYr&orYB__;x62u;g z{3pn`Ai^9#SH&+a$}|Hs-S&i7;;E2ZLy3mH8^|75noW2Tig3eJ;$ht6Xi6k^<^T?% zb=mmq?8A6a9sbI(CU)^O$Qglb)I{vA3rU6@JB|^gTe4ee!3^cFjtAGmyf_#;oUTHl zrAj~m7!nTe{H5ctbaE(m*)mnG088$`Sd(Bd=1D1#KN+vc<*m)+jJP(F?E!J6Pj|ea zF56S-Q6L*(9`aGyokm-P!RMmbptLwFjmm%mVj_FOVTx0S_GWM=7tBCzB+Q9@;hTU3 zqlod57g^oXwYdaH<+ezt9*^kwCI}=8xlofP6piW zY~X6<%vy9Zq&Jh52<&h0(7@fbMEk&}8D=2dFLt&j_HceyN9cuu#VT5AfD;{-J`yWVgBY6EI2@u^^xD)I= zyzM-_f|l5MIl9??mw@S{Uy%Xl`+^44-tD{CPf~r0vlqeI)zbyKZ{OGa8MI%!19*ay zyVpO^*Uxlc;SLQV!7s?ui{Rwy@LlYu5`Og#FL7fhxAgoz{h31dZSK~#wuFDe9j5y> z_wUyIDRf`qZtV?gfS>#K-PK8|Z@1eUdItYVyJ5O-b9b_}bNxrd!Y2F*f4m!H{9L`h ze`ux>{s;VB>|7nZ9RHC74(S&%zI1OaZHY|sbRP}}QW;vI&}kLbzj~QEMG?cvT#pbY z<4*tKu+y?tVZS7_rO>%)f)l0-gwsUAX%|7*Rfr5@XmLVSCXA1v!hNly!Kn@()`>}` z6PfUAAr*eJW3{wGwY0Dtj#${Wh2vT_W-BF{%@X3J5~>PEw^P|DMTanG=2QQLII#iP zJ~Lyx$Wz>v|0{E3Q{q1uJ@sGWI=y^<{x>~iy`TBten^>d|0m`E{#6$ta;m`a3 zBg)_0|IcWA|ALHf%>U@?8_t~nHPZk2`;Q+}H2>X#*3_I#Oh1uF{BuHiEi|WwSH#S# zq2w@1G?~F(;F_Q(N3WvLsqDEPm?=tcAew#fS@x7+{2R$? ze=T|n;Y_h1LT{t-IY_4P#48aB zR}>kO3dk18F)XkY6$TWmF}ODdWXsV2*|DA$yz~bVv)cj<8}z@bDl7vEYgEybU4Rvu zqk)`|5*}-|afR+Ubi>&~pkosq6CLh|v;W~5G)GQN4g?4pGW(@{igljS!Vcu z6FA`is*G>_{!7=;;7kAir~mgu$_)H>_B+*N68%X>AJo$~)73LGobgUYd*MKi>aan8 z&}bMSh#92d#X)Cx!GYXE8z)yiJPrm^(j#%OTs^(*?VXmYa&WU@gijY38kAj+4a*FD zXP<^KK-pLsY>bS+fWXga*n!Iem$A=GL5GD;VW(D}0KT44nG1XUMSU)w9Sl!2g<{It zzZ3z3Sx;7HP`{`$<>fnt>ogcu4v7V)%N&Gi7xqAKhQy3Bc3LDDj2e%J#|m%nV(s9m z3Tjd(2X3;`Bp&q4krm{?zG^~uZ=zQOH#c~YNwmqjQ$YQuQ%r}`rG1t={n8|)D?JKE zl9|zj|F*9GEMJxx_MfXp|E`R0*nd5EZfJ)6*ZqnA`eTZ=8d`1Ac&NcnC**@Mxj`$F z3Pp&J&j&?pu!{6DmQI93Ghp@5VOg#)2f zP$e=V%!)}Sh0}>)TC`Y_CY?gn3W2=f|HIz1Ku1+%S^a~~$C&UFF)*Dbk!}o~bRc{Z zBA+CLumJ*r5#-Z$I-PV&r@QG-0NFsGi6llapsf59g0i#B$SUKPL5^XAhTkBIGQ+yd z4!YnZ!m?r15f>zTZ&kg1uO9)FaoydsJgC&Wb#L8!>-%oqdi`oJP%Vb(ou7x7X)>E& zff(?(ogQ5YEQ_5wgCC=tWG=9~(GgF*0jTOCrwi6R9^V3;)#dk4RTS>ASgQ8hA$qN91ly9{DCr%B2RKTOEC?PfXBjDd7NdsvS6jxfF~pj z)|IE?A$~fyF&a%#YD1SB^qd$i`G776%l`^olG_~6;l`(w&6$_8bgo;U>NaNceFK9# z$DEz*e&``IlbKD6Tx~fO_JGY$Zp>!3FTUzx%gM=~IsxW=pWV73TeRFkYRb@Hsy@|b z%nlQ~b8<4$jj+`51_LPFFlerO5O8znq-X1JO;jyWdak=Vd#)Q40|wQR1umy0X2n51 zP;Pfb!FgrmKxw>ow*jzvUnww(ib@--tAwGZ!*pEX@Y5A5Jy5^UBuvlpoSZ2$i;Be3 zmvg0{0qj0ss-AY#Ec9~V$ySt?o|n@L1RfuV}_PO=%FFJ%*xGX;ve2iBx=l z##3&9TVv{6Sa!|T8*_4?>F`)EFD&F-kV%)${u{Gt?}2|*_iB9h2VlYKbQ|!->Z`D& za;@OLYRg?PD_OZEF_8@ zogp?MtxgT-e515-sM9><1m zmMW{u4qRY{!LmUPK~Fx~oG{vS&e5nb#4zf_=89}DlmQig`v%cri_pq;&ND_TFIL-4 zrL*D1v!^<5O-w5>l2$s3s|9KNXG`hXT`z%U&;Ni$V%7gh?*H5R|1-=(<^F$&?>_&3 ziVFree@@~_==2m=Hl(oIF*huC>=yg%UaOD$=O99_^T6=iWLM$QhpC_4FcL!?Ln z=Pc#8TnPq|2C)o&hbQPNqi=1(ERtsA6nT;j3Bh^3$X+TtWfx@@TPyJ8cQ-xc5=n%S^{Y=IG`~*RJ#C zaSC2BK!g;+(m7qkv&s?he6@^tQK*>-mC7`KADQL|ndTd0nj>VI1)1y>4RNc4c|5s0 zl>JajXDD+)-vA2_EFz=G7V-!@aY@cO%8y8nXuycmhG}L=!c7>sJQWcKBNt6Ah|CHJ zEGxfgzw(qz#(^$kGl7>N?76is_Cil8hFUjZO{LOGH-_I+p(jY^u(wj2?4(xO^XSbo zdOT_PrEE@%kqLdV*D2x z%V!kxNJOIq)~1*cDbRIm^q5EjrUd@bocpt#P+0~GKPNhs9g+%zOK%kFP1yXxpP_{B zVWfNLOTTt^l|e5gvlo9QEfyYfseF7ISu>%n3Ik;_WXd#)4HSOQ9#8lR41wXMm$Zs) z0n95V8*d(I#f3+%kskPZ+tQiE(g|!MxJKx1=DM4W-%|^-F?{SSHNf>V9P~6?;W>h9 zGC%GZE@3+v!gLm1pn-a?@WEjzr?!-X!#r#Sjle9|Pvc@6{rnrfmisgk(raR}d-}@k)r20iTRG z2!{a1(2dK$U;ugp$i|=pSSP_vJ0B?PsxE~5X)w2?xypvXk}h4Lyn9pQ4Yyxlnuoc*F8#6XDcLN_CiKZ1Zw(vQQ3I4q2n z%?bwp6@+11)LN92K<*>Lk$u}ZUeDoCJbxaC&v5)~4u8e*_%7Z^3BUOqpTY51p&RQ2 zd>on1@sDwS!Y88shSN)r4%Fcvi>0E{FJZ3}@Wuwm5?C){U6*vghLKM$t*3H2Zl zOW{-tI>-of)ez<^BIS#G&VZeuABa$Q6eXltENEDQL=?g$qT7TNfccnf!BZ23yL8rW z;y)GttDrHVG4_jiUX}!>^B!#FTAmh9VI_Hn<1a#g?H0${Mx$nRs)2^T2I<|gQULA_ zjMW%JXVGE|9VHfH=qT|RL#OG5F?6)P7(?et#27k`4r7p*j4{ZWS${rsQQP({aBeFG z{%vzW=;0R9nfVn+>`b`=e^IZ_6x4toso8!Ozl)rLnm7>GeuBcNkpqj=-b`WC%z>w? zw!cPU)X;%V*}k2^sHww%a3h6LV+Yn}dkuwAbH_-8y%fe0IL0FU7=^JUj)@2tQy5F+ zz%wY@$I{PSv&;PN^Xoqio$Dx`G2L-uHBg*|Khu8hSofq_+x7?$e%06rbx;zzsBT00 zIV)O7A3_?Qy#~12lL1ZJ4!D^$=Wt6Sy;yzKk#Mhn- zUid(Rcm-r)^i4XbyxQhKk9SZ8+(fmilQFIHgh11`AwRZ0FIf$UtuRj7j$ZHVY|W3w zCU3~s)~l1-qCk=Q{A;1=Yn_3NhWu-sx*4fo0P0Y6Y_DKXNWrIBDN0sDdv-3o23e+s zE+*GcZUc(EdZ1Xu)L4%93#iPt&`8B{QxlFNR3B>tWj=+K!(qs<0y8`TDz(4K66!F) zh}`n8V4*JP8}hFlIIC=!*`^w=ZXjH(V@Re4vJj8~1)#H)fBi9FG*1Dh?V89SDS|;f zK**!MS8|*0x-9>x+vhocV;*&~7G(xNChcUQgUPe!t+8I?{Z_c3(&n|S2|P&FygLZV z0Dk1>C2creuV~RgGlwoFw*B#HXXl!bj`p_>c4N%%I8faIx^%#xc*xvY|G}EK2<@Bk zp;m>YwOEhn>=XJxJ*v7R_=nKJ#5waV^I94blUtbll70Blh5^?^<13wk*w6)a=ZOXt z+y}o39aPVm*CHE}E_f!i)j-*1!$?%|dG+?&C(#5qJ4keOb~N#ok}kFfh~VRgL31Zg zczufhmL6Xmi+AoxCrb%)gOk75w~f!yF1^;bD}gSWfFjj=KJDalYo}z6Rq$sSPBv#l zYAxC}i}|yDBG^}G$JDKa=Nj4o0ArnOBFvV-e7!jzY}XFx68PMl1)&!{FCpLo0d>F^ z@4XPCeSi-ZoRshZ1cSjd7Scf_59-nZu|C9}TR-$l-Yn*e0~>b$1QUdZAxwcVAA%dg zG6-uSya?g%SBZHNF@HgBZkEmfW}s0w%*5Y89iBcaW2DaD_1S%PmmPf@I>XG;pgRzx zH0B}Zp+O2}f+=^G!T$yZc;QhGO0tgd)2YchXzK@gKab)4yr;DPPO* zu0#i>_Xwh>VQNgLYP8&;8t%Vb4MlR|arAMAn z$0~ahXCoz>(iPbctr|jj6VVQ*QDS#f#VC@}l5!qRs;Edydo(F2NvQx4fW$$d8VJZ7 zrG};8a8M29(=kUmy2=K@Glp^ zAA}-o4GAusjzlbTM3QWX|KRRNO#UU60c$D50UwJU!krVpl;$NSux#w6apMbz1gsUr z08=y98m3bR%^Z6LrCpnn)Qmb26kWH$DT9Z0j61}iL9pVeJq z_Y0smSc)Im2*XZyxhG6oTI#b`2@w9+M7YQDec$T=)(`0vOMOua;cz2%2|frMh21$F z^%*I+Pl8{ zToO98&+1gnZd3E}33NfuAMHP!GR~@)O((BEuY~Rj&|Lw#W*HrZr4l;yLpDR=JK_P! zVPDG%2^~&Mi$R&hF66EzVn28e=$-?*D#eX-&q(NEVX+k(E#jnfn>Zb+M17RetRCca z+a+{;fv)dO=zbxgL#Ki6CURflWkovb`;2D(KaGSA`M)XQhyJFEUGT&38wnlS z&B+=_7}Nznp^ple8V2tP4YN7N5^;WslJWZ(3=OX&A);<&7tWW2=4VufFw7)R48x4! z#xTrU8Rs(wv)(DJ*HqkNJ~j+@r?58+vsSGO!%-AI8;03F;gv8PL*eFC0?c|G&Ib%; zp7`g&a2$nkd^7l73de62U^ct-4Z{f()`elVA(9-1*%Rer816;kjxfwtzc_9f+=s%$ z!mxCvM7XaEzF!9Slfe(j;6xeRUj`45!9SD1IvJc4(NEOma%ZdzHpt*K8Js19@d++0 zbCl3tD`j|G776X4fcDrz#P(1?d+Z`&dnlki&{0MGu@t_Kybp2u76IRf97BG!qP))_ z9$R~J`IjK>C6RxX@O3|zkAj5$qk#U?M-i!y9_@lUk-xk?Mk*pXg%9IjJ{{ZXOpN!BUE`XkEAojVj_e^e-YlXqnJqY5@YguR=STpwYt z=^VhRygn0@eaK~i(buk__*me{=!LzgUK|$oqLP*3`0WAXcd#;YZ)&ts9KXmf7wLh& zlfxxSalFJs{a64-|Grtl@MT<{u(!2BDULTCwExo_FYI-_s1)ai9xy+=%<;nB*IOJG z_P#!l$^R|Dg+hL1EI9}8SP8ye8M#;XpPZktR~Dm++$-zH=VW28ELA1y9}oJE;&@^2 zY_eny*Fmt#U}7zG4x#IW5@Ir?`Iq?1>|Q@zYo*y;ce6UE+%wUVkrw&RxS|)H`3t~=>EkBnhanUu+>2aoVXk-TW)OZf zgRk!r`Vud}w{wXlZ}yaNlM8b}9M-Xg{*1z6cb5@MLDAIl zIZ{H41y*z%N4H9E*gTao!8IT!X1lf#5~zx7uU1Sq(~a5)Iy+rTLZu8JIUHZUvUqKl zfFtN$U@BcqXf@Kcwlojj=an**t;pG)u&f?MWrdyO2!csfmg)8iryrKzxh|{U4=YyL zUiJUwOY;7YBT(kC`TrX}0rkVb|1)%0#<08J|M@Ad8`~d0ruO5?xP$LMWkAy1_Wud4 zuG`<`sqo-28b6MVTmSyUoStEpw}0mFjJv=8_(`sU!U-csSn;g$ZxDo~Srs8q5K`T} z`?9F07|JiUoI+oY4YTq#l^pvG2?HiP5Zk?9{JVm*}r`B z(O2fq{nh;WyB~Y(Rhw;3Ma3Sc^YzCcf8FDG+vR#=;lj78s`do}dzUQPw{+?L<;&k& zwru~(l`Cs&YwPOj)~;RK*x0yX!-g$ew!HAd3pF+GH8nNu+_`htu3fu#?|%LD*WZ5o z?Y(>V?%%&Z6gsea^*_|tw=^`ozjo~hjg77A*B{!j;mD>lOcwr$&oO-&!}*zu1$ zcb?p}>!V$}KHk0icdx$s`#pQ$|LHg1{AAz0Gw;58rlqB&wYBxgkt4^B9cym>!^x8; zPn|k-`t<2DXU-fraJIGe-&$MG9X@>S$dU8MkAHsR#2-KUsQuKbFHWDn@X03^&z!mR z>8GEbKY#x0+5h&`FS3??`hi1s=e6qPvfwe1H&+Ma{w9(t{*Wp(_(Nn0oG+3|iu z-=UBH%b`6lwLYWEeJZi=*DoJ_)==`xxrcwf^XT*Gwj)~$dp5ni2XDc^k9#W6%Vf34_)~`Hh+)&q8 z6{}5uOcDBU+kGy#cjqeuq2v3?KJFHmmp4$kc)*EGZ?zqd9sXX;u%SJ+4lJ56Vac<_ z>sFJ!`47E1@1OlOy)(}AoffZIaKsSx^gEZccWM5lIofi4bwzx0!SUydcWf;`?1)}z z(CpWFrgXmLJFh&QI>kBh&E|rB>G#d|AN{8Xo1+Gg%BWqQoz(kDmnv?SrE<~syn>mv z7e^e9QRdCsw(4Be!U2WT6XP|DGV^!*S9{+9)U!H+u0-`@ZWE2R5a@<{hd zZ4@J1l-y`cedLXwrY*}bU8he*7U1j)rPmcoW^+k1DH(9?)F))5SRpYBN1xGnRDyo5 zK`Rpv5}^vT*q1((47`X7q`}br534hHdVNru>9H4A8#`mfcf+v#-MdjZy#Z2SeLp~J z&p}mg9?Q{9ui>hn$|2b(4uYFu79W~`&;4mu=Rs{#t8xh=3NF36a?O+RU6;~yBLKqF zu?t&D?x_EiR(Q*1RXEev>H=6~{b&Ohg84SAU_?`imR-P-wUoftbT_BPtJ(s`#jS(x zS>`<|{2Aa%9aip$8`pgX7!Zpo=!tfDVzT-vt6M?@rsu)BN!aseA-H%@#ykXFD0UVm z)TQcZx4bs9N7zicb;Gsj^2{IuQrX#59yQxa!R3c?$Ib0_6ixMzCPv58DltTJ5vi?h zJ&B_q44HsY5+VooTt_;)`t8>Jab?y*DqXxNds0?UL9NkBz&jCf0Zh=Z*BOv>JkXwA znc;ab?a}$JmFE7^qfL!j3})_U+Z-a($Fg7-`OR?l&56~~xiG_JQIB>IJ)85q2f9Pj zHHj8NJ}Fik__T!HpfSoqswr_<1{4b(E5DanTw;+S+Q}qki#Q2-aBPlXh`jDghr;cx zFP_$J79?}{&8#exPI=T%-q3+0TRdqRepAeOd5?)sUoF1S`jS2YVTZLU5n6pq-)1d= zYQnWH?b>ckASiw^RHdKyu!eX#kFp5$t%Y3%{=j7}A&O!Rcz)^pgIB6+bI z$+csygMeLI6n7xEIUP+60cu`M)<|Yvtg}PqO zDG=mp-pDV$Q5mr+GUxN1Ix3RVu-87UX5AYs87Im@Cet0el;+aOflzBuie(Dm6=J@_@2Is+C+Lst`=JK_~>I z=8DK_@G;LH+QX zq>_Gf*sMXii5PXMgS}$rd6c%Mo9kb_@yZsEKm=CLdOtmj^jHvKFea@nT! z(ok3q$bb5ljo}&+0^^Znw=A=+P)EMaV4zGTszE`g>xPbd^xBbWuBO}^x*dZA!k+9qtGUbqsiP##VHj_EKeE(m99Ob@2cX`Flhz-Qj0*e3oH-maYcX?ry03stjOs9S z8NX(%`z$_f+dYu^z*vJ!>WklvleWXRVTk)l7C-xbRH?{0Tz*7%GBUI_HeJ~eAg6Lr zfO{C)HJhyTmpB4O>XEBtP9cmYcc?itulMSUY1gCS{?&)>e=vgKKxx6EjX+xYs@I+Y zNeE_CjxY@TID)P^z31s{^VNYPsAC6Wuj(&z3@ndYNe0H`qXGwFC9xL!Ge4iqdg*hbFn;DcL{2|a4&SO4iv$`u*Pje%m3Zli)Y5dyWPhp!l5gbW8 z#fcn;H=1~7@Zzi1d_+9Qn~RaRk)wJxEc^UyWABNdy#=?Nz9-`AqSnJ@meh?tg$B-L z$yYy7%I34WkNa6UnAaff*goqkYckN4`?$RaPd_hvWG~F%B&hQbqHq%jpZjYk3)jJJ zrQzfXy(AT~e|ak6PdsXoO4ut=h*c@;|5Vm$E6D z(yHv72@sgLS*HhR>GQT=oCQrEULhai0#Pc_hhD5O#|7jxU4`#)?55a886LVP$z^=($C}vz@v}i zRfo*s06?ote=P}G4I%+DFhT&t$HLK%fPnhg0 zCp7+bMA%0vcm{q$ln^XL zrgtqXPDe*n!!mDxiq$a9K^@o>mk5^r)5REb*<&fKs>Z^ zR+Dkaxv}N`%oeUJF_AHFIZ=2&L0(u(n7bO3=mK{JX&jXXC8|O1y`cXF9F>9)d5PL^ z9%nG&J0PqGQ&`vg&iUybmD)E_IV}I$jIEsnz6@k!OeahcLU~+b|kY?4iCS?-un7;m#7RF1x>|BENFGC87 zIUWiMN|@I5WStD*x9T?sZE6TW{6%ZN9WD|@2*-Y$T@8}LM^1aRihBn#q77lEPDm>$ zdGCQj1Zt>bR+l|4K5h-rt35pm9i`1V(zgYqRD*#R-1)PuuN8p;1P{KxGHvth?pq}w z%9uc129CiRSs^79v~3>&U6)yT++w;r1=mUwCE-GYbxYFGnmBp%@d{e9Jq!nrn%QYH zhG-|@Vq5c<_t4M0DVZk7lRo1@apuS!$%L$QfTE5MC+{9%Si9ZWzO{JS$xI(UJaYX6 zA+r#00q_Pv9NGYQl9aamE-8r*z>(o%a(GHQkO}Z5FeCVD(1Gm9KUCF$7oFCusnt}5 z0ifa(@}VsLm)PnvcgtWk=nw!QGiJT%h*Czef2IW}10X`wHy!rDU;D7XU-ZC@XLu0&`gzzA{mb;{&;P!FY5aF|{KfM>Egik@pa1DDegFHf z(CnSrF#zXaV{ZfP+y(5||A5(XE^m8FO9%rCO6Ub`z6H4KR)j~#z;FN%6&=r_+FB63 zeSC==*8muR0Z`D^NE$tk>EvbuZ9)X>tu2Xh>`LG2dV6brE6Gh2I|_Tm{~qD#OjbMq zfY63ZtzbqRon6jmmm?G7nb2`)gC&2^YN!l@Uaa%8*bQWtq3tyMq4QsLKl^T7M15V+p_7~{O1}52Kq!hMq(r*K3;_a8*djfDS>ZpR zMfy}BabJfA%Jnms-31yq2+R?JKUF{~_BSXx^^b#8>|r;15s*aM$?(_|I1W1Ro~=_p4-|0l&`M3XJF6 zR%b7XiFv!9qd(a|2!l4!!s5b1=lCqC?hwSmn)!19U>cw0b2|f(02bf{_yG|>9FPL! z0Tnltcn(YfZ-I|&N5%nigM6R}C;`fVN}wjF51NA3;0llm`hbC8 zC>RYUfT>^>xEU-4E5I7C2|NTI2fM*OZ~(juJ^&}dSKtR29L5FXhb@Q6!qi~;FmsqA z%pK+r3x&nPQefGzt+4H|TG)PAJFFXa88!qPgFS~$!vQ!aTo5h^SApxpE#WS3Uw8;xm#PDTY)+8Y1nH-pEj7A~F|Qj@*N6L!L(tAs-{(qEIM7lpIPAWry-XMWEKA z@=?1{2T@(90n|g(GzSNV2!|4f35N>@jU%2TmtzOVevUI7H#i=1%%C~Z5@=1d4cZqS zjm|`uqnpv4=o{z>^hXR1BZD!-xL|@Y$(RC6J>~@FI_5FvBNmU9!~?Gm z_B?hJ`B zsLTJ<=G~7DePTXIi2E5BcDH zQhb(tbiORUdcN~~kNHvja{TuE5&WC^5Aa{(pAsMlXbX4>Bnj*kI4v+H2p5zUv=@vN zED$^_cuVku&~hPjA%@T0ud+jJ`~m%r=<|GVf&NWW8iJ$R3k@Dkm&w zFP9>>Pi|D6Ti#4QR=!q#PywZ&udrHSw?e-nOi@QMOmU~;btRaRu2Q(tZlwWbq_Tl> zv~sQTZ51vRbCoqJ`&1sN3aYM9%~U<6`iq*hny*@s+6A@G>N@I?>hoCetn95zWzl6q=ALOdV^C2?+tYg;|&iR{%WLRwA!fI=&7-sF~hjt_@N2Ogl1A> zGGe#Ne?XpAKIocK3-L_wDPq%NfpK{Q1NOL&n$mQtf zSm8LnLU9Fa#R(^vlY>)<)2OqIbF}j@7r@2drNrePMUE0nIq8aWrMT{NeL~fsrcy7s z@wo-KHM_law{S0TAMud)Nbuem4lWIzWSB6D851EUA;lq2Lrp?ULMOw_!pg&5gjQitx7ua( z-qo{_UXcf*&{2U=$D;|+tE11wh{q(w3^0|Lxy-Rx!`QOeDV8H^PaGKMAJ-Aj&t6Pj zNsv#-NqDfvbj{8+Gl`ywN0RVK(Mea56_Yn5Po&tSG^|CerLXNtl}yb@eUN6JR z+O+H4?%>@wD#?{CRm-b3SAD1suf9`bThm@ETU%a-s#{a{q~5dsLW6!o(;m@1oA>;- zH+t__Ben5dlU`F(vsiP%KG?p5eUtnB_V*vKI?&Og(o%C!@ZjcFpf#cO*`dHgw+=fV z?m41=q~)m0(OqqPZF%irdvg2Kv9M!f9X=fc#~qIMoG?1kc2f1^-cypNcAgeEUC@c` z%@Pe9MeS?{xh=UmTSJMVb@Vy{i_*$d_u&RjIPc&g8^@AxJC zOUEwjUT(jlbEWO7&egVSy4TvT>s{~YH|RexU_8)y!|X=)O{<%|gZ6`$hn$B7Zh73g zbKCFs*qz`zPwz(FeL1{l_~S_WC~`FK9`0WGeX;wsKPmila7=gX^aHC0SH|7OM;_82 zK7SPV=+oouC)`iUCnP4Co@zclHEA>1|7_*6$IqG1KfcKQ8UORHU*vx|`YZX@D^uQ6 zk6*H0&c4cjE%JKr8|^ne)0FA^Z=>FRe3v&PGSm28|NVszULPhtCVt}hwEZ`Q-%fmX z{5(1vH9I>y0$2iQ6p90dM6>Tq7z`TA#m~*f$;l-`;N#_AE-E3uTvSYqD6J|-Bq>XY ziOK6JD64B|Yimo$8JOs68mnq)YeGUm35$l=4IF{w0MRh^Ssfez!r^cj5{85$=JwozFgOB0;!%t63U=%xGka`MH)!m&QwkEMTYH<=viJd+{lu;Wz~6G_Js z^XVcZC9XQi;sMb&;}xat0aT`Nufx{$8rRh2oi@9@YH&D~MqFoisrXggiS>`bW&wL66Z`*^Ae5EYe2~{n} z*Zc^^sjbyiGm7~8x{eRULopp@kx#w1?;cEH`CUkB@@nlB_bHAzcYKde$=;x&mv-`S zlpZ>nBfSeL#x>sb!f;0;ue^O;&S9UYlfCO)M#l@L_aAK_v~X!mw12c@5DO^31<*>~ z3RJors#R(~U*jJX1S`(ouV$2=|Mto8Gvrd=RAfpV)jsIj*)=ljJXvZ-OuOP!4` z8k|RaF8QbG3-a%uDmJK{H1y@uUDr{ys#N$hi!S7_gL-0P-#h)@pR|_~lp7P1+$vu= zaMsr-81sMJ(rWhXq_T?UO_!%WJogX0eSV6eEuIjqmNq!-R`n{@=0o1~z?+^kPdz#f zUW*wuRo8h9N9f#79Sl(8)-5|JCYd`T%vEP#aBV_g;=Eq+&3Bxox4q;w6w(iN2Uk{R z{NnP`+L)`ZJ3+~byi@9WLaSHNCG%e^nvaItzxDTRin1phI810WnAp{E={jh3v$YPW zc)r<^dz+Y-1K)8SIn5EP()JtF?Cct287bP^{RQWgR)od`cuhZ}jcaCS}OrD8vNdgwB4Jx|!Wp(@1Pj?Sz_y`&Rn0TC40VY`nfe<{7>g-h$t{#nt^ zEgP5lA5uEpCdGB4%03pp3kGr+SAKH6+T&*;(XjdHR;#1~>E$={M`#XD1jJr(`kpd6 z<}izOT?@OA)0S=qDyxRY$OrmmRyrfh8G&5D! zI9B*@=YFNZZB$+fR94IFuoGJYqepwj9kxGpdmtxiyCr=zc30|c*{)&7^sQGTXMyDV zl{q5QvV2bO51JOL^9IXB9sfz&zUk=EmFJ%s%mOP431`Dq`<`Jea0Xox`?jRl9>CP! zxhcpjA5C!XEZs(JA=tKFc(>2-MNW5n=W~@N=O%qS$F#Md@|N|~RbFv;jlC^v=W&K| zpj~7Y;q2x~D$0oO`iltN%z>8cr)^Vc4tJytOQ(^cX_*_MGR$HsT83I>Z7a*JZdtxT zTCU0IXd&jOm^&}8M*5n$+*7`_GRWT%n|iRt;nx1b%w077U%U2<%8p)CeTs3h6Ncw8 zdNV&3y;5{&HK@7j)a-q;(t<0LVYgOV^WvpUTSYUGu8#xv-GtFOl!%!`gYv^W>D|Zh z&$^A&K156@?nWIt$-Qhv-s1<1Uh|-UA^nHHNugisMph?`DryvY z;?f7lwYy%JUmI$ZzS&gsPBXe=qV}NE9oM~4Rpi0rn!*-m(5B`pdk@X+SDRp#JKJsT?-G@mym3HfqikL=)X|>mpYn};DNL=Ng94#?h_Q02oFA9fwwz+dxj z#Asl!YZkb1{LMYnH73jbLehUZVRB*A`u=lc166}(kuryl^?rI+d%)*Wy{DaTsQu2% zF8A7$Jx)Aq<_vG+>oPzT{M;todwOM=K+olL-3xUMQn6d_?9ZJTXWSop(mFi&&^(ED zqu4N)l{_lC|L{)-h1T8;xl?*l)m4!yCMRN4#&;*yV`arfE&eIt=TWO3WuFt=R$5-} z;tFTkM#gznVDG=4@=EI{Gm#C%1fM+aC{-{bC->3AeVJ|li2Eu|ArD79;dK*c5-Zi@ zB-h&QwXY=4EN|n>aUF3rJ4R{l4MJQx3TRm)omo55_i9`C;BgQ6(lUTrZQG&!L7F$^ z_2}KxgT6KKA3Qv^Toh0_meF+Sipa!Dt2b_a0?Qk+s72I75xMUB74J#A59UxlZrbB{ zy&@<$S1dlhECuB}wBskKXZPG5HC(jM5eS_HL~mIX+c-OH03Ny`FMfa<-W;o4i4kuw8qu05$+ai=tp+MpBQ1_Z)n}b!I(BVpw54CnQBYe2_WzuQg*DDTm?(@`TqG((dzQlRPoDOC>B$Fb|J#BT>|`p~{L?^nki7$Uga#9kXM@o2YKX?(W2 z^!}6N&$>;g&sk8;Uvt2f6c(OtEUOYYcri@Ierp>NKInS!0zcBB{Zgaj(PZY}O7Z%u zlHzLjZj^U#l8_`Hur#e1P4zfgsnf`xX0lgUYTuPa0|}ZB&zhDjxAOA6W3@vgk1I2e zCJiytR@4TEYn0YJ_q^obG7|S&V=wO}(N(@ZcotCk%p!dj5P0;a!&bmltfA&yWnG4M z%gj?#dbjV3oB~1d%Q>b3J$kzZ-JGST2nQw&$LtJr9ygxo3})81ei-gy7MIZlbb0f< z?l^*diiP)C)X8h>KIL`2(R0j?538))eyTThT><%WMd`$l`wh9Qq9LD8W`t_LQrxe8 zi5exhY@O3Gnw%r_C)R68je4xU;lv#1%zHLcChdGWB7CQ-T(Qy+`miTzyG1rBIyZ{wD=g7Y9#Z& zqT{dd-*hy-!~fOLSla*nuaL0}7V{O8G>#TQOCn)0Sj^Xq-BAgV@!`zKWcegzVzL4j zgIP$|okUb5CSx&B;%0XBImWp}BJv8q|7Il3fj7#Nz6c>Hf0f6s1|_bZt2h4@TL3*W zoDm%#0JVk@$7Y+)TKy$I_`D_=Q{%Ass7O<+aTtRZY>LGg$A`y9GEAN3#fCFj#%l9N z*r(>fQK6E|mnOx9#Uutq(ALoA&&ewoVKFkM-}E>*Cg4jW1L#5WDGJ23>~4R7T!lVF zvyNmyMT=znV0lssNkMfEX_#n2Okqn)`=5l#&kIshBeF%zrL+%;i4112h)@<3_K7uY zGlT}2ErTrqlf;(yKPpZ7q7 zlcA9ek7g#YTc6Bin2?~iSfsh;o3L9%3=f|BGpEgjq)8$|dGt(3S|m1~;tyDp=UJ1# zvTA+9YVrftlzG;audLs2e!~`&5FZ~C{e^K3T;eO2<$}v&ux%d`6U{b6`f3x>H*;t7 z#STMgk#P(ows>Q;`7vP+(VRv8Z(qs(jQ-^P{{m9)e^19>;(x0D5&um`T~}wx|Nk3g zENSIp>Fz_ZCPG$BqO{AARyaLgP0iXF zLMkAV7QK;8)KZOMg{rwz)si4V8W86~Q6+AUO*J?^7`kk}@!t#X+lvuNkBMSH=`80l zXC%M6@h=|eiwiQQLm==hb|E|}lo-dNLwFdAzgZ&@)gbX2e=3xH7;7IwOpZyIgUn_z z<}mE$vu!eIp$ugR?2Q!@9cpSUW3m7XtvU}(%=XXW5U#O2$<3PTX-y4qbFp#vGN)RT z6o~BGlG*|vHjEZW3}UcvTyY6>IwLMFBmv3>x&X^L51gDl_ojFb&_vZZh&9*X`9C(S zn5cQ!Z>Wh7nma3jEeYy|F^w3;VuU~rFfJZ~qBeyJamH#iQ&r-(Qhwi7@C8y`kErsy zfJM_bfB7@#an_+3B$uG5%`Tu`|zIDe$;(|lAw6%xOSs+^=LT=_ecl^a0Gfl0N81#gA2m*_^kSQ^SsXPze z6qF1lZ>A@(pv@}D#07uFWV6Z4!DofDeYb`(Q42Bx_F9zfMzPQ#qI7C_sx;f{sLj=c zAe3a5oX-Cp`u_S~xV`)rb^OKkucQ0j{!eW^ohAJDe}%rg{$+m0rJ7&;&|_j&hcn{l zR($iQW1-=y?8}?=JCYRy>-SA%_L3=2_-(u4KOVDBn1sZ+%aY zsbx%bJS{vLif`Hez|`=|(nMx1^*K9cHX%lbM=m@$fI?`EIaJZPViHja`Z@1Stdp4R z)eYN6eTm&Q*qWi`-MkZIna;J+I6in@bP|NFHjmx)rK{}FQhw!1Vo)fw^N(dhVljeA z{{9LJ3QQLU#+)9XK#TmUg}tgwl39?g7C%4YYVmVRss-)euH@KVwuxay5$&KyBzZk}*{#e(AuX3Q&W;RQP^~ zE$6Lvu|<8aWU+aNGU9(XZH0NkP!RA(!ESSr1JQFKbofTYytxsB*bQZ{%}0Yoq%$HT znY3UiA~7N9kiJ+V+Xzkn5OU1f4s;x9TYSts{+s-N8m`R8D-gHZyrKU=i?g}YKhgm4 z{Xn{{xx2NOxle$-v%59b#@zDn>G+QOulqrvy12Vox~%voefh%sA82u*y8j~$Y`z~z zr&_yuSi89gI9a>fxmf)z1>ds%KnH|k$R1D|m%k z1C~^Kiu*sX*WdYmAe}vkRG$DhcdEU!?cWl=nDK`*?BwEZ9bo6;_V?^(5#L`+H@C8) z{uAjC-(O4r+qS=m?+4P&Js=D4q5QpB{mS*%?e<__ga4%65Z_-*x3{u({ztxeOO-M&u*sn zQM6FT!io@LTX_CwLR$RA8tHpJt8f+s5e#7qf2;2+tS+=thzyBSosU%GgV_x73wL!a zaq)VOWFHS<`aq8iW1t&5NmVsiRh2X^kp!)5p|JJ~Y!4)oElWOF0Sayxi;;~Eienlr z{+}%gVp}9^ZiT#PweoHF`@bDGEYT7z(Go4u5-rgZEzuG!(Go4u5-rgZEzuG!(Go4u f5-rgZEzuG!(Go4u5-rjHJM@15)U9Gk0I)FtbP8{Z diff --git a/httpd/kepler-1.1-snapshot-20070521-1825.tar.gz b/httpd/kepler-1.1-snapshot-20070521-1825.tar.gz new file mode 100755 index 0000000000000000000000000000000000000000..d1caec5a53f93f043a32ec04807dff259223c32c GIT binary patch literal 768249 zcmV(;K-<3`iwFQl4pK${1MIyEU{uA`IG#knZ`2af&6&r&Gxy%zBtY%g|L1;RC3hZY&YU@O&Y3f3W>%^3h??-0`^rnR{#m~=^gE}r z68eW=2sU_=YcdK?fp{Bo#AE0Mc{MiT#l(5Wbq2ZDXUSW=amsuwP( zZ3wiTSH)6L{T5s^7-4;h2SclZJ*puW2T^aM(V*8*<3U6iglR-Gk{)N9kyJ3E_w+#j z(VxcZ2>hcC#1Wq8k2P9cj)p6xme!8OmIc*Kovqci^Q-3t+Rv-9DwaSA1bHzgSU8vr zb_EU9B$(Wk3btR+BzNlxmp(@aQJW>Q9@5T5{|$GAO60h1BzqF7Q6i%(4f?*Y8Ug66 zYinEt1i)3G!FDw%*DP#os_R50pgr{egQ)jfH?%1my?P2Y-=$(a5Zxm>>Se!{?4|T7 zK`?@`Fryx#SR4&eENQT+Dd+~8QF5P}Fc7{zc?luDIk*M_(XXMgB}G*Ri}YN_i1;X~ zjSJd4s+*de$fl`hbpQdNJfs5uS#YW_glIgXp?^(MKq_jKHru764x`3mI zV0cjO4fY|1gr;h=STKQLc!35H4RsMCKpVvq%O{!e&w~ae4h@nZY2E5-xwx>H%kh+; z9FHW+vW{q&(9kp#(3I3zSnHPDrgvZ6pv&}b3sl!NH7*Er)-@vL zC`}m&E2*im2BlUN7W0KXr4g;mD$}^2wrOEqz^xpW9Fi1R(pufYH9)>i=w>znO+E#< zTnQ8Cg%>uqaxn3y36fXeR9udpDr?fX2)}x;CDxYJ#M1DwzjG#6p~t-sypgi+L}9S>zk_QwO4r;M@qZ_E4itT zrbnW(HxiCWNN06IQk54iH4|uQ;q7j1thLNP)4=nT$PVkzru<+T;T5$R?WL#GNQ6KM zq7t|O)g>NZFfBkqu(mF)LrOFwcxHXtkrHbV9qmbji=c=D^@tN2s=Rejrmdx=qiXr` z<%&~VL#j!yh3$b(W_NNVmL7C_xtTcf#)PkCUbvuf2~;5CA+A|HoJ`~R%r?86XqeX1(46n64|s7#m1~>O zN!|m(l^;fnkZ1Rhn6_Ek_Bii|S$LR@*_+MSGZdc{_VEMwyd{bIC8$Hl=dtA|#pNvU>GI|x7|H|GVa zykURbP!q@u@&{vjY%r>)4FB9vp8@S4#UFpETnKsnN(omg;L5Pg+~qd1xi`i^;M#ZG0ouy}cs4%fD4V~JHDqeW&# zNY)H+JA>aH;YIyIVd8>Ed?%qcD{8Bt9b8<5T+S>B}g4DZ4I1x=CU&H%oS7D6?sa+!9>3n!<4c?Y-wNO zB~a=5Ax_cq^Og-R>)wqT?B!3SBCamD0=X78lFZGVcqC=e4#PeU+mO;@kwMo*7aQN& zmbL)Jn0N7$Ee3NOxl%U8=jz7K43rh1RfQsK7ffuKm1Lx};GbPZH$}YGHWHSD^c!X` zVqWsG8~~cXT0I^#tZMaIL~S25l4{hobQ7g0%mZr9dT7BmE!IN;Nj$n1Zmd@pb}WVB z$3ERKC)WdVz^%2nqL?xYNT@DB9$kB27NrP&TV^2)mVb zMVAyL$l|{Vs`CX@S2<8!WkYopkLs$lsIGEB)vdINYN$tJl~@wpjm=ySc53Yv=`Jlz zCSAsV!~Cuehph>%4kQynbGE~bj`5O;2&iJm4y;FBD&h6lOO7Ij7Ea_;gHs=uP ze-p{3d~BAmc$q81c*rb;`A957hR!T8-&un6l!=oO_XieTY5IZ`amIc?ex^P^etP^N z_b_qCd*|t}4?t!{{7H#SJs>60_krXeW-r!g@pOH-P>W~m0pw@GAM(><54nefdo*0> zia4?v(_;;pX;FsEH26XmkF4ZtZD?7r)K9nZnRF&%k4OSA&SWDNj2pekXrm%88BBDE z62Gw6QiLA%MG-c?F^1;XeDcM^;7H&xKRGB|N3Bl+N0M+K{0>Zbm=f)w-vvXlF$vSa z@4%eLKw2e~neUDk-mSn2<1n<@NOYN?9zyQwAww;!9768O!C8&djSh(`h%d1*K`IE7 z%wk`m25%M+n$CC7bcAYmBue+tRPG2Au9K##>@;1))6}IgL6Qoh$(r|WG+kxUv_8;L z+aS=i8#@pznv!oyQ}W@Ysac7msk5v=Q(DDN(+ssRO>NZ}O`X*UO-;lYO|9-Bnz}T` zXlj-NnvxHosj~*9Db6tW&FUK4aV$+0jS4ll=h)I!EQviCRV-|jh5?#UgF;-O(02Nz zv26NeNC9zw&LcoUWJje@BWNU{9^hc$F|?L)381FE?V-c+Sa6_>R?sqyW{^O^fDAR~ zw1<9RX7t!pjwCT%#Ol-zT_-QvCz~{9gW>U^Y+uhBmmDu^!@DvZMChJ<=F&5xXNJ9J zHk{eKl2%Ix6uLT6h^P+Y00C#el$VIg-bA+xFx2#_u$GX$ZY@c9zEX=-yk0dH?24#f zh%m_u#bs|>gRK(gHjfJ=S<36yVqv!&Z!8#9<=RE<$ch;VCJ-+WWTiX^`t^p^xS^e% z-clY=&6`*~e1euv%|swqSB#!W2D`L~mK>Cm{c3QPn=8Zglpy*ySJ$G?&N>9VWodI@ z0r=S3z{gcy=9`9EZLXdlfT@!wr`a!5tPMf}OK~lY9q|gwv+r&z-tZuzwia>}U>kf2 z+vqmIv;A%b^(7WYBE*aS!9l`dnL_J~==!P@B0AzV^mj1K;U;W9D!jm8TVHq=ptGU6 zy|aDcg3cz`#_f*j5R4hsV@^m-byZ4F$m{`iaMdSNwWht!r1!`u>b?b=iNYjKAR`%V z7-sgCcLdryVDb#ZC24aMIuxuwgY1^1^m%kjVd8=Nm2Qvl4t-B);oM9hIKmIv4w~L7 zS`B!SOqeULT`R+6Uo+4b?;cLoP&ku6LhGt*@fOagJF}KG5o{qEB#y&A{H!=v zpG*aNF}w-K3iUup4ur+JI79uigVO(7Xv4BPT3XZ98V)HBjb^Ncz>)yMnXRLdg7!vb zIHP4RS6AIp?I<^6`gB&Vy`!xWbt9QbsVs@D_l030t5hjZ>z0?nyv#5TD`vqyT8u&) z;g}6)*Z?Y^GYh`EH4)KO6wv}~DGW6%mQi>Qr#fMoOv?yYA)cWE2y)oVwS+joVd594 zVi(}{B^JfkdWpCVP|_obz4Ae zTL`Vi0g*6DrDzyjBq@$AOkX{sb=fQPVv6@|i9#wQ0J^EX_MJEf)bB zFc(H7aU~`nf>VdEA^r>hmolN{x$_g}4`M<1Cmjc3|B%3dEQZCy>T}!Leyf1Md}5Mc ztZ8wc1qgdF()I(7js0YZo#PmIIw%t72~2uM z=vTv<-ug^KaM2aV6W$U0f++ofT~w)-B79In_@bVy?mfEcx^?ZO_%ZvIAMVVwy}2kvgOOT6L8B{EMI}s zxZ^2}9Uh#lAbYWJwme71hOeW&kP|J^7#_P?kL=aKtSy}FTDjM)b_gotfG!WTyjHgG zMvyz>AvDBm(Lg6tMwOMIq(RZOgRrtwI18RS>~f- zI0avEy0dLI0an53Ia#_q4cyEQZP7y^=5*0gam~RZpIdSGYpK2OcBo4 zc?4Le9Q0hJyj`9RqrP+W+@wAO zXi9!-mdX5tGX*Id7G6w>Qqeu~!-Z#DGz5pv$hCwO^1!PIoNCt(kO=?j1TO=x1z1Lf zUBp`%qHxFQ$xfDYM8!JSX2=EkiXlZg51`i_LOStXWURf&2MphY_dmN*-Q8-!H+2># z%K4n)rjlYrF(WC55dTm0)RdPP+8R~wF0Lu}lqjw(E1p?ecQJ)mRpz+_tA~`)8_{}t zQJR{7%ZC7RpRR?cdJ>*lc0GbJ%hCUpd1kF!Ta=D`bdb~Zzc&q6xM>pMRHQ?bh}CWB z!FUjTRJf`ax=)MdZ%3fB6}8hAxL_e#uAy}PhKwRbNk$}k zT$vJ*)5!oEMs|T~p(#pRNFQ3%nn$geFNcOHVJ{B-yA!UnOWJS|!p;2V)n^j@BaI`6 z1wrvH9PYH2$AaT%$n@OUQTDLoa*N?^uc+Rq%33U`(?BT6rGkYnP>kU;grCIaf)7^@ z3FiQIt>WqdZeQBY?g4SBN3}jH%(C(IJ1)gdkF2fy;y{gCadJg0sT%78e~(L&up5g6*^n(DDVLeW^FqC7>d0pg3{lR> zp-x#T@b1veHe$9J*~nVk4DlhxDFY8uA0OM7NXvT+>acevhJ<9>n{a_YY$$kp!ac&9 zb7Hcwa=0&D2GQoYbPaU2e3#a>kPd-N&&M)xjH6BQDB-`rsm_J-`bjjZB;kM3$XpVz z%1d1H46cXO=g!XgtpdDL+?K>z2A(DjI5@hc=KS_5g+pB#!rSfKc;@ef0B^W(bj}UY z4Csi`+;I<5Mp^D!UYL<~_c(Vpfa55FnuDJl7>nG*#l%}ILFCA? z!!(lsZgRc+YKYBS9t*a+#w9s-FHH1Z#}FT4=fikbN66S2orSh*F6d618OHCYVdx}^ zW_2X}utBW4ZOG{1d5;OBi95&V=gQb)Qus6z0~W)9+HnxPg9TSuJxL=W#49!21Vs~n zhlW{zzwJX&%&rI#C*~2we=VwxJvrNjYD34Hu){{SU=!3GPTm|^ADy8k>=cf`(B!6H zH)f{SG;r*Uk4F%O9*Co^Q6A<_ocPUC6qt|kU+FoS9JjFXvUxj%hlAB5ob2=qC2c%y zOXV=4ge0xHiV_+k)45<_bCptAR-Tq$#JgM4a14K8i&+FN9ksf{b2Wc-^)OJi^Q7bM zzM&RC?sbL~qulv8k()^;+_sY)-E;6PcR)Kqp7xyKopgMZ=Ytm(ah! zNam3`Kfc6WLjOs_KX90gXC8XPj)&AU&rbVU7SAw30%-|G0ze)PpJXuM&HJ0ce&^0^ z`?*uzhlYZ{3AS56hZ0PV;+bWVc`lb@8bH{=F}7Za>|&lowRnZx#_wPh>T@x91^C2% zXR^c}xAdEz=Gfa{;NiEYk^Le#kvQ^`3L^d8?yk)|1a384M}fa=S`qKO9ibn@B$CO4 zJkbt=7NYyk^^$6jtvmR_QFc>8SWDnjg?4wFN34^{C1*N!c%KS)^RGgVK*A|Vdi=C> zs-uWWAZ|C&MiF*AJu_WQK-60;9AW36W^_*ftKTvC;&*62?)@L)ockxVk@@|fvU8@F zPq)ASGi`eL7w`Xk9={|0Tu++EdaRdL4(qiZx=+e>2dg;mY=%dBtjBt~24w@KtB3Mn zkMpsfD!vkZtf!^jd{-qY8)`C%{e{ILM35e!i*Bg!VvpRU#Zm($sQ3~YebF<jZ&!^Wo8M8}=zc6{iaoE#n!J7B=q zq{aB!)i^!{oWkJ&u(wEh``(Rd=2wOoHF4>9G4<# zUd2H(q)N6HbkG2KaEK-#9&pLG>f?ozJ)Z=?6_{_N@jYS7r-qj1fW4xbiCUGbxM&P0 zOq%7x6I_bmmbnF+OObvR1P(dxC17TSG*z+7cgVT}uO8`9Fm|Y~xz#LZ9$LfYlF>Mu zQfRPaVR&l}$Be*T&MNw^T+F5^C69+rw2nYqYg?cLj0F7b5nJ1pVlmBt*5da(RQz~U ztxL%eDoRS$5ZQr9(x)bH!}xApk174E%Ym(#rzOGEL92dlB9qH`ZB1cVW?QgHNzE7h z;t0|r^hTIs{(fS@*+|Oci;B$_;L)LG`Yc)%t&d;jz&GGp@0XAY2o}f;L`^Sw+(gB; z2YcL+#Fav-ZpBU+Bx=VO!Z|*3tU=w2j|$+|8*zx09M>aS2x*%b8%@N@p@d4`azSFv ztS`pkwYIg?2HM-D^d)GN9%_sBAVG~8KPdiH!~h^#9ZWAOX^7CE>Ys#q7qB-K!wE!| z1frJk0;aIzQYEwZ5(|(GHHb3I0_@6qCZfS6fU=>823Darvc@b*ud8nqWGn}`1-~^X z!-E1&@NTcs(e}893mi?kRiQm@gCR^C3wYGyLX*0$-lTJ zqmuB>fDJr*et^)ZuBJ9q`=n+3T!5`@{*?fyR(85MhW+DS41%Rc6eN{_nGftzlS^Tu z0f!>_BQ36O14Fx|LiWbhFp^|iNcJwq*KRC^KY9?Md(fQmBC(fB#86TQ@i8*HwI2A0 zYK8%O*YSj&)RTj8csXWqOhsm3*sJ0fA0YwRPGP+t{n4L5aokY*;qn`?+ud;Zg*cwjNHh<4^7?CU`Ol8}qen00|=a?h^Dj zw$eQk%c7-l!h&k7_&V^V7>i&E7dD3d^zONmKDpdCy+W=iE1OYTUS3);T`oV@UsmZa zn_vEHB|2L|GD;r~e=mc##(N*wVApfkV!J#9v1nce?09esV_|M@(A1ygW@ zCQ=iyZh-6ik=U{B<)iCD5M0FA0DsK_FgA41s=*l2sKFT0>cls0BvakpGPc^0d9X@V z<8qI#heaF4ClTioET9ecFlLov$zO$g;j&7>C*dv6ca^f-dJ&U2#})Inq$-8_gA^BM zjS>-FR#wF4kE;}{brtJ1-YO-G#C9mD@GtUKDKTA<_-DYXltC4tz&~(HI-^*x+p+}q zxGei-551yqH;t=E=4(D?C05X#NctEn`{o`{Wl8+0hcwCDgKr9Nnuw*?mJ+jb zVAl}8$izXVA^Xl0?nOomLMgo15@t(TxBjCx>X21m+d&Tl;Kz<>3T~WFVAaVp%H)9% zNiur%{!YZN@nVmBi4;Nx`s~?(mU^kyWP8TzlGh96WY-^d6F{~P6+`B8w>D6P(6kq8 z#W^xr%hI)|<%zPMpO)O(U_Uxtz$;Nmm>;!i3>q*~kr{7qS7=js#vL2%#$h2q+Q;wI zdcExJks)xXMT825QO}Q9^UOx`;>(!~BzF+`iOeu-(MKaeQjr26mEb{fjjTZc8F2F% z!){zDv_z947ei3Hl~5wnmkg~WU(o0Cc@UCR&!W|G8ai1b7Om%yR7-(_5-;qA%@~%D z1gg-bS{0LxW|hSbhdv@nW(o+da_|fiFFkY8V;?>9#19u+h8MyW-mUTK)O}yY1U6Kt z#;#g4zNQC10{6V5r6?SEaaaws0wK?2)LmX=jS z>(IgAmYkGB*;76!XT<%%imU`)x+`H%%axGzQVDxAZFnQZ>qm*dqSs!Fyt_l(2Ik8v zGWcqGNKcqR^?Jjakp@bgF2|5%L9Y1M6GMYyRIMT+Asr}GzXa2?$-3uH?oQ}Yxd%}^ zCKJ&;eEDlrpBy4g8d_6)F+`lC3~Vc57YjZtOHhK%vrsUG`ex{|5m!T6_n@pL4Z&}F zXlPmLo5v1GCsFtu5_W=%{m{@Ob^}9=y?!d-CTNc~_C6~3<%g#*7Bb&`DmZ)`c^i&m zr>Bx8f?OrS#1>*kDvo!o`hlXD?SQDbaVdaT-$+uieZdfBKt17HK_by%=?KVOc%c?QG~7_d;bX?kX;XzDk(U`UFt`r^F>u=8s#Hkh z4cuV}XF)GeTc07zM00w!r`|Q=5D_-39|qFA{ml?3s>DWT0r7TR;t`nLLJI59NMA6LQmd4eQRd3kBkN(Bms;NeqTUBj#|9B5SV0>9;zdCFL^uF>4m7Ko{0iStaH! zD#VB=w$j{^*sRgMw4I(Twb!z8I@<#s*hwIQ<5ssOINmiPg0phcfa6xGCO9E3)3s0B z($TEN`@`I8iKdlVQFK$Kugcp!tghhois^0*61&B0jdOryz!KXNW*y5%mZ1vP^kx;y zjV4wR9ehy74VI~hEgs{&P6Q;)vHO)wDu_)nkZ#RU^=Yvu=fcZ`zV+a?gBYOQEMk}r zz>LJO7J>pSCdf^2g8$G4k$GL&wMs7Vh$1tgaqdA8mf*olLshaZ>e2`m>Simv&(XCR z>N>RAVLicDlca6Il*jg#1Yf4uqOAl72I4RlTQS`=mS8Y_+8O47=u_Z@3h&v@G?AFs z#o`~Q<2*A0LbIY{S**x;*1?HR5*@yE_eRX6wQFPPWwJ{tciAkgl3g1y4^X6S05&CE zfpbm|&tVY5a=^Gi;h0JQ<6t(kb6ABdfkZ-2_>lp;DyH|xl zf>?GKy;^q?nFTQw9#@s8U{gU}Q2*&7pBdXh?VU0-WlO2HbrlZ==lAQ3@ef zvFx4Y#mg@8uR!*W-#3*rc?b-*I^Gym!Mv#-))%D^W6F=Q*caLWCI)6g z`q;IZMQEsjB}*ZilLJGgn|U1b;Ccv4rAgOukPux8F(;wV=aVVa7!F~oTFG;bEV}wv z@_nHd(se_uNd^fvC6;5}L(|U$kVdkuWT%kKk}Dk&!PIWNI3S4*;@J=a=cx@TUpiFS zymLxCv|CI}VRc8I(lstr@_+u`FKPudA5zoB_-=QRc2 zdL?+KeKNeCC>yZr7!=7L1u5@oo}WOeQjc7wija5$uUX<7CHAF&~8I8aEqu zaj6TP;fBnOKpe=-etK6dfCOAMpWLC#M7cr4qzbnTgp!d#;VV1A}IJAa2 zT384md1O@*3eixsGAq$kCl>C7_+ME-hnNlw{g^0>OzGn%RTVDR&2*{7x*cjEBN(IP)PPvrtxN%yEAb4*=Zg3_ zY+uh0QLe4^Y}jE2 z4hxTi0`zd20!|Nw_lHu}Hv{)5wsd!H(iBnl=lUdZ5B9$_WEYod6d5yi7*;rU?f)|{6B*>M|i?8b8vK4pm z?2Zitx=E~#XimU3Il!7(k@#v3E@z23gq(}0vw#XF8WI@^yPbAeLe2{8w!`C>gEA-Y z#g4dgtOZoD``*NzCUc6I-9__c7{lxaLr#-k%9^IUooS4P`Z${0na05r#@Hed9tmqt zk8bk&xvujaQrxSdmV_z{PqzAz@kGa-vLimrv2*Uwr#MFH@Mk#z(?>$PstSvFu!yZ_ z2I^ZVm6W|*a=AySPMZ^;Aa;x-<>`F0ZY|3$vs1QBP_nf)rwT#S3}hdzPH71>Y@0-~ za~{c}=_E5(slelo&Qd1wxKuP5*ii{s$aBaNNC5WF6+)PnM^OG?c#7be=C(4$(>J`p zaTy7aHjbK#y^0`2tm3XGg5bPPVlWPW#|#i5(KHf-Zv0x}!-<~aQh^E%5iwC}kR68f z76;v#ukZ~h;${ZF(Q1;BWDz(ftT# zb6`Ev-DJhK;~^JvI~`_w>_G+AChQL|xyngK;^ZH~c_l3P=Ug?y#R%yx8+_@ zfOe-MkxuHjBNQ!a^3mi&~b}qH!G)+S{&JhC3Pl-aOl%a93k?<5G>)=YsLa) zqEsFM7q~HkF#N+C_#-j)BN%=+S`3#7Z0GYu%JE9y{M+)$4|~Q^Ol;cpSAj zTS2H134@ctpf&^kC$ODYftN-Q+H3LRuuO(W15&-em1EDh42ZyR4 z08C9m29gigG4%xISzoVf9vgpJMoK?mU{yE)$gZgjY}(v}*PNvGVFq)At3&J&xS}u; zb(kUXWG}c)@C_;GKLXrg%^p`i6=#fyOS%a|#*2;`<_Oz87k-oc4r53tPfZ~kRh;E$ z`w-{scMF_SB#Q<}!Z^qPMO;k*!91f=#Mx%rCe5m09WJHO;hrHi3R42{w~_Q6#_)(U ztsizD5ZHLoFf7NsmW&M2sBzcm2%pn%<-LXvo1-Qjem_@IKL?+=I_!C#_gL`zc2_+SrytMw-t$ z3QHr_6f94|YBH!r44-w}&^pB8jGAyc2qK1M*v?m2`(~E+RXBObZ^?)!5Cs>id7_dX z6yx^DxgB+h+dAVm?fIjZ+>RiB0FyswBp!Pd1L&>bFD``KjPA06x6SA+D@0lhz!HLx zxo{~yywi+&vO;P3$R*ymcbtE8oajii!|v=@!`O z=0b3$Np^>U_$|5n+uXfYlGB0a^i|=2Q##j$YqChJr(ZUAlt~%(LWkcvG{&-8949DT z4qz#g6opMzavkOzxfEFpr7>jZ$Q9fN!HB}G(_^YnUP^ajVtT)vK$4*dz!X^r&8R^7 zSD)cNoS)|rH>Qp88TsVcM%&hy%kJ5CRWnK?=Cau*Dz7vX_ZULV@7Bd{q&fW_%T{Ap@I{ADUY z*Gm9IWr!dJiYq^_?Tp-gBbq+*hvstARPJZ}-ISGGGo?{Q zE=uR$S|)#r7q zkN@=YX%%0L|L5^bJN^))Q+{OH80!A-vgy-o<6ntNd}0569zWl5gbb+vhvch8FKjyf7vwuwCQrBx0~LS=IdyH5Lvk#w!n~m=yxq&s7Su{1{rQ>gI9Ls z*UiM2`o4kmgaeFd&u7ih0-Ys97` ztB=fCFjet&pgvu4)6{SwU_+Rt;Q??yVRllBy-)eiSVxC)I%@vQ61# z#>lRX%6dZ5@QRgQ<`-s{3q!6?DsHvsusfXfR5G4QB7+*?+Xe`SzNM0ev3U z8(4pKspKwVu+QbLU^3Jz+<*#wz}Gb3#2~)XGcxFtd`+!V2Lg<*x!{RfY^W*%8qxbb z5}-s0KyL8B4nc+w+iB9s#X;OqXa=Srt;8Vs#0K$DK?_!(a#H7jpbpV12%&|b+!N8e z5S{T2)c6AKFeVZLBcn0v2HXr4KJo211}sO=@*+m=bT?pULC0eTPoEI#6V z6Rv=J$}qiSBs$Z&ifDC8ha16*yU^&w(4TOLeG*r~Io4&-2^AhLHrGTLq=)p}LQRXo z2%>KZKh+A?z?PLr3Z~GD>fpgyBbw3Ip248ZD8C-4Cu;D2{h#Y2zHbmDmOp0gu7O zlp21^Ijn_LgTqNCY*rv5bQ;0MOeE$nk8%+m~)h_LX)_A6gxH6 zrzP|lCQKiiX@D0-fLvzT*a3a(1`jqO8@<1t@e?`Fj37ZvtUPcxg$>i049;Bhz9_kf za1d}ZOM@!bENB5X?AHvngd1aMJ!lwcXz>137mfHQSK(sh@eMjW9H3nbz1xTI5jfld z)uQFzA_>oYM8vQPW7q{e3A5TKG0zne8&Ft5rM*RpgjzMU9`KhDvW2ailnl}sB1%l> z7zm(aCSpBCz?OUakSx~}iR({4olx|a<^=F1h&d>Nf1ka!>zgBUNz z@M{z%7a(yIjVB2cpspcaguN*PvkJY_$B9FUBnWv_APSPyjLilRm>Ys*W|+GwOu7)U z96`))4HXq3Xz-AjhsFkFf*fWs&4@>WgG4q;1Uc4{oQfs2h$~E}3hbuB^+yr{J&4*L zkX6_qB6+D8!n9p4!Eb2v2M5VEC?ZxO6(=(cngCWq;~K>GP`kAPe1IAX0R!@l_@!VN z*A8M1n^h!BRCGkOaF|>H9Tf2ml0bLB1!V$Ia+?qjRw`BpLTVfz`Ov}$SSo@@fUnJ= z!XE~RzR6(BqEbGJEHnI8LqrGNXYDwpfUiDpil0wm1YPEuZv*eWe_nOPiRq*F?e}{Kd8bJgce+Q z-P}rLRua5(qza)nrWikwFdX_G1=kc942V~>C=$~NI7)*jh6}Tf1g8oavmfw}`JjnP zVIhmjP?JiAA;&0)RwqPeonYvh8aha9i&?Tsa10Z6N5SC< z=aWnu02yr^j5*SpxIpro$u?+}H2e=&H z097K9<5ZmOhm2QHtHTn?K8ipi!T=$Pr?3jZo-K)EVsCb*f>QV(-^_^ zu{mbhMQAb)#;HRbo8bsiJW}ROXdJeE_;yhi*N2b>flfBC@t`a1fq-1y)ZU_4=6`WH zvi7?Y68J;?rKSD-{c!2NPfzrek~L0a^}Gcw?H!G^?Gla_kfTTj;V>7=dNtHYHx`n? zSP<@rA}Y6dYnR%5a-*6^8NrAaHA20JL7IGWgAehlT(9+{R0vYmv7(d~`{Y^` z9I~)9gq^y7^%C`q-#_t}$^R2NLJpvz{XgY)|4;e!FZTaFmmlx{37HO{igSnO0ID6C z2Pni`K+MhI=Kl%V96<6iewk&Y_4|aF<45qLfTt&!2*!*^5R8B3-I3w_gQT@I=6oIa zi7zBYds0ZkO8A`<=Gnn_7h|nUy)pna;qC`v&X*`&L4;w?6H9Dl_?S*3Y-#kSVyno- ztvGI-!h=mvSnj}`1^E7A;(7{!;=}8lU?`-)8*@l;!b*tRV+N7odUv;%n8(Bn57Dr5 zf>x{f)C)j1mpfV%j+;^(s3z27NHvCn+?~l5zQ}~`2fNyIa}in%B9wKwy_D+IE)`ng z2t!B9AngU=i8g~ijAvCQ_L>pw!*Hp|gLjk(%}xC5T|(tK6ro=+H3aH1p`q4{D4fDg zkoO6lrYfPb&leXPdQwfzUXNWNb_6ZyzN9*=A z%$PO_EdfbkEyR4A7;(Jf_enM8LwCeO$ph33&OwKT2g*fj7BIot31)MRpjllaW|A(E z`E4%wosJ&{B&rQa;DBW`wK~GRF9%F7lHMxD`)CPkzyO<1yuo?^)-!sv3(pv2Ipb$r z9JQ!Xjb~q2>+V()um;9!4)(r5MD@tX0!xC?XOs}(VGf4_BI&$~tA==Lurn=~VHLm) z8J_jSbo5BY=E4C6o~(B9s@?SZFi&TaGH}qKWW^L9E2crwA=O4Pmp#^Gz$QB&L5yIw zz!V0GvaK*lz_+ZeLhBgWT4?qYcS}sQjBE2o4Ah5+8YBx|WW^eI!3RX+d77^Ic^^NK z<-lmx*w9JEt$L>lSBM7T9OUzlR1Y-2rn}Y_65^cBD2l_w>9;u0~_$GC>^b$ z$o&sg2w*>c8<7RT=|~&~!>rR(YKXGICl$N%IuOL_(hAn=*x$;rgiJLXo&^@gs5YnC%SG%_(*cP`%b@_6q5;woYvPxcFhgm2 ziq0F3RpMloPuhb{hRI#!EYu3Wslv7BlkokbFh?Wg;!m4S$4UXeETt0WaY`<~1Zpl7 zhp9{&#uFUzY!}i)R+txY*BNB45jr5A#MioDO&?biWE_H^uM>KzhipXkB;aW}XkXT2 zuJX2qF+Uzbh$qLE6j*FfOEXM&C@AS*w_3tHkA@mEXf-WK@WvPDz!g?@zmQLA(ECAt zV|A4vN=lcJC6|DZGYZB?;Vqaj_4FcoC-J+-&=QDn#HS0uze;U9I)j)Q1Won^Bb3rQ zDj&s@G-l|LKG5oj`wo2)0yXTDaDi^E_p!6z^e$7^6=qD6rmAg7INmcPaBs!Y^z2IY z@V*Jg?fo?J-p2J*UxHjk|J9L6g8e!$>F|zD1ZfV{)RNc<*UflI4~0?*!cmD-EJnS< zfJU70hqWC?ecfhv@o^u{6OVhF!gmf?xMN+EGE&$<6V`oFJ$pPL7D9Z4?ci7{+6BHQ zpfO%X;MWWxz|V9~ve_?CY$$h5ePdGqd+_A)N?|aW6Of}~8voDd;r?-T_Sk(w@)zEp z|9iiT@jt!EXygdAF_izOvhp0e|7S+|IbZmHK9Aq*DPHf$1At_&caAi>p`*D8{s~mq zp?^9WJDLJ>ASwt!LF%YSon1=Oq}ff43+Bshfu<_ONDd+8Kb#;BSazq4_H?M9u-_0Qzqe zfkbc)0n)B9NL-%|BMxbH>l`jD$VTr&k3|wkY3O()eiR)sNg}Xe#3dopAZS3Ef5XTm z3;AJ2Clv|w8DV%5Y0VcS#2R6MlF;yx4N>BU5P0;^gOs>=GV(wrRGGyck%>5TsFJOU zJzS}1E}|OqnBxJXArZFZe@@I2kkTb)3E^DiEyCyyD{Kjurxh~CEkT1r#VsLdinmYp zY6>IRp+_!ZSavuR4Y%MWjyt{xVEViQn1Fp|5$^eSieUn@tBOp89OIei-zt&`;Z1{v zOriF_AePC(s)ES{soR_y#jV&d_G1417lk)598?*w z0DA&WeyskSK~7w*TbL8gmWlE_QlU-^L5&y?nWCK>Hm|650ZN2*)70`f?g?eluqVha zF5(Kf#XkuR4JQJMHQz_9%CufHyc(lEFn-~L7a`yZn_bg}(yHld(8VdH%yCJaU0OYd ztjjEK838{6ml@QjE;Ca1P{OA0iW)8_!E5AFSi0h+EM6@CtC#zZUt0eU=;5e(L|i~a zo&T>av&a9;sHprR{^xV~xjS)?fzO_x#?$u5dUCMe1}1q!`A{=`c4PBAxxK9x0n>YQ zUys(UAj#2D1$T}sa!pHHU7)S1Y!06Nbv(wk^pg_LF& zjxAw3%y?G#5Y`KuFbU?ENSnJfFi(^@Z7Plm2*HM9EES9psl-=cZdCp%myL;hpFq#!>I?*0AR5SG&+s zE=l@f>dsU=jLlAAgpih}`Z9vu85x@(^e#msg<4Cv3z!ppDG(zr3uX+)-$Ow@?56_rHJo>HqhSfBfTL%}D=$_?5taU@m0kewI~~H@V@y zU5{N44kHSGV5& z%r(`gkH2wBqIS%pb>+wBV zRUzl*&i&8()=RT;uCIJ%RP_Xp;qza+@k!71+jsVj%`ID*z3FGSPK?Cjcidfo7(Wqy zam={7x`Ld6)A!%_?KhquJL8Azr%#)3Q$bTl{or-2*KEsrByjeW{x1=-LzpHNE!Y%Kd^XxG>bxUsD{94}X z(;M3+=a25M4D6}icKS(^UfFQg%srbYPki(C{mtR#x`v}3Y%c!&ww&Ibp{2Fs3ZE_5 zK6%13Q?}1;du_@14}+&}m~-j5b4OpD-?+2z(w$Q_k1dS1ZaC`LwXe?|J$a|RDL?da z`D@qZ{=GbS{pnpNx1IQ{#{c-kl$FoquMFno?*GHC4db3#I;LX%>StEXUXXYC%{kKk z$8H{zf6f7A^>YL_%@SDv)|I@12)*Sz-(bsO27u~gE z$$`hZ*H_3j6PK>3+jji4i67+Vl}z-lF*eO?tr=Ih{Jl+MCr7%c4=N=!#u=gT>MbXA z7teU_{GI=K-#c&Yx#Fa`M=$?)+0Mc>ukD|^?K`9A*1Ue_Z$7y8m>++ws`A-A<97z0 zJ9omU2C444iK~8jZv7<_+N#E0y6*X#^Hye`{=FXW{^Ra1KYjhUl9Ss$s%h9T{*zBO zAOF))SE)bnHgC-R(75VJ>EmmPC-0te$-xU=%xZWjdhE($t3$bM-C4Wed2{!ajn5ok zKlYle@n_XdkXN4mZe8E4?}ztK*>PXin>A(UZ25k6_Sn0&pK$v2l2I2$wtV)|ZEd4l z@A!IS@9s-Kkmlx}k{IP#SvW!JJ*xJjx$CR556nACxq5KYlAEMS(dX?~drcf~@1W*X8F9Osx4}|6PkdIWYIyEB{dV&aTIoO1o-~8LZt} zSTp+csfFu~dHcdMei*p*n7Q|E|LoJ?1f%u*jVHXKkG~*i?FsMaj-B-Um(Q#DRo2d> zGfi+AV)go&U~R2Y)j2v5#&HPDvCO)UDk# z@y&ZmX0EL(`o@@@*@N|?Je}+FpLoVNYQwijXD8p?UO2n8N$Xm@ZjLnf_}O3CIWMy7 z_8(M)kDheywylY}^T*ycp>k8t9cA}_FmT=e>YRVfTwgU=ov?DrZH@0$`p+AqU9f!i zaT8ZQSMvVAD_@^ny`%M^JAZ!J`yVXc`nxRo)uTHK+OD7Z+b7?u9lK%kF|bvd3Sx|EN(r zK3e$p=v||_zcHmcr+V||m%p}g&))Uj$G)0dxcS8?@v@xYaR-X$jXpbTW&UT+D8>7K z_V}+;H;m2wkI`LoHP6>WM#E{DX@N zem3#N9pkTDbng#exZ_*V+8GBQJh|d~TlenT_sj$Pt{wRJ=J9Lp+y1LD*;4DShmP8@ z{!9OL@}1dh4~|*%QqIJ$tlYHl=G5%$-qrP6uk9>f`=4_vF4BueuOIXK{r5ih@PXPJ zdUwsq{?6PhpMGFd?p5!U{G)(8$;?$bam1h@@>sS}ve#ieb)IRm=ZR7om?!V#0tW$5AH{s$*ImfNv zKl(qKU(LVnv>UU^zL8&e?tv-M-oI4Gf7AVsnvWm-@Y$>9%F*xmTV8#B_KdfZ>%RPQ zcKnsu<#Uy1lQ-uVHjIBLPrh5J`SXRJdcU&e{u>^c@n)oF&+7Fh{;auck8aI+IWPEp z{igNru2m7^LqX2y~osz&D!_VuU~bZ@jsi_Px-;E&zySYXY21SsK4&rX}A2~03?vST-HzvAKZpW1s)aZYdG zz>F~^M&l%7{7oxIZTe{ZvNIP~Je6J99a7HS zctTe8gRdohzo0`oB)eu6uEG*4(V$PRKg_pqBeuR_E=jPgCa=95{Mm$MiS1 zoNz_!=K6unfk}CNJL_H#o^Yw0^J!c5569$v_o!sf&M|*_@2J^I@x=U5?{7X~%%sH+ zR!6+AY@Bq%vc0M9`wO#M&&oKKi~5?;k&^<)iGW@f^?o9pCzR$G5(b)4KhPlXi|?zwgv**XLfmD`(>i*;9Ar zRJ>T3^KSNzoV;tZ@-~-^Ia4k^YVN2TpBQs%&FR5SvG#qJjNLHm4|NMl&pdz23t#&E z$6p$|Y4XVjvrm&J-94dr(zHp(?#e!6U-nnK${#GuK4Vw*lCNj4*p}bcI_l*2#%%jh z{>(pJcwo}h9M7ds{cXV;FM0QTP_QMjV$X)FelQ_x!PoPz+?BPXcl^9~zD2X;L(j+Cx+plLX+&uVMD>yWCy7ZsdUVU}=t8WZ1{-o!&tM~tJX7`gUg2eq!5&zgxNf)3e`u zWZQ4F%O6cJ1n};qC*wp8uk`F}J;YNBO_Mbn>;%Z>GC1KKDl-{dWF^pI>`p&w=#+br-v* zx*p%y^Qo&Hi-SGR@h|_2J-hsaFZ}VNANkgUckS)zy8l1+Jos?OLPyV$+|H4XZQn{? z`RI?*>w7!8kMH>HkM}HI?Rct>VD{FU;fywnXkOE zv+zXMC$8=odTo2}i`xhM9iO;*^vds@8-26;j;mkzt(#8|{eJhzt$WLU$HL;5#=o}L z`u?$npLeES+&FsEu2&xM?Ta^^?0D*bdUh`^_Sp~IR#^M`3qR?1FL(PFzS!5Z``%wX zwd4EO?YhwE9skp(I(N=4E?m0hk)?+_E`R1Td(JL)ri`xojZg1*Y1f}Uv}gHv*E8RF z`qyvjntScKgHbDaKwf|5hM`^eO>}?iYUg}+ z*Yee;t}X67d%Ww8=Q@Aq^~*~yU-$Swd}H58*W!zvryjoW*+2aJneJ!5{m;*S@6Bgl zzVXk0@Osa-Z5>D7Bnzg9c|86Uv>l602 zDWJ!C^^WPEw^Tn@^Szb&x!&)$R|Q?leT1dIS8C|84WN8Q0%wVe=pe1)VVjjMx|HC2 zZ*|cX$-kY7=#pVb9e24{S}CT(NHhuKhO)SAYo>E$dEW`u^r-0vqjl1*W_kmoe-E|O zalJK)*=?<&9!iDji}QW0rLGS(Dakf0?Jc#{RbM?N0S6V}_8sZ0YpGjmtvA%yptr6q zg%5(_x*AkJ65;$%cl`sZyUtsh?}!e&BEvu`Eq$oQ&QN1-MFieB#%%&ves05P z(wi_g7KRdM~z^;oAm$CT;$zv!(T<%OCp36KRHyfiREm~g1Bo$W@1P8Bra99uO zKD^&x&D!(fy>`B)q?}c$)Io{IOEIGMgD#|3I~rx&rxtcP8!hq8bK=OQv-oF=Jgo(^ z#p%ebDKU78$W339&7KiMRCS7_nz0{7>nPGg9|&U`A*C#yo#|V0;HXr!;qV=4eAiLw z5e5hJz?61$YSJ`Hf~jrVK-bB`aUGkrZ#0c`F4HClOpqT}GT>5>d>BX&o}ME$fOK|7 z8$5X?Iy-M5$2ykwNjr7IKzh@~?X`K@H!96bh{lVC)>F(A6C=ZX$i>-2n^3?C)~;86qi0{So;sWY=Cca$b~6eo8|+!sq_yXNGL1s`4$ z#Embh`J*(|qd3(|HhC}>eQ2YA3>A>U{ugltwt*fYw48rLsm zYS?S&^EoGQa*hjc6H9dl|G|Dkuj&4JTAC3_f?d+iK)fLP7G01VlNG2?nc@^+B{j*&rrv1AuP zKXM}pFb06JCYpz*wwWaCIAF)Mwc2#L*cy8nu!rTipTPIQhKXxU1Y&GP6cN>0J=o<=*`v>AxaENnyTVZ*JAHnMQZ zz@^Ud>n>wU!HtZzvD?X)b5i~h$WJFSv`^7oS3*BWsHZg2i)IZz=JAFXNLg-uxCgb< z%`t!iQQvNY4Ic86&L8A)fRE$J9zT={vRI(k)RSf&_7f+0!87NV@qeh3R=$ymoX zovN5m`kR~|KIf&g@SB&HMoNWv7_vr0C<-Uz%DAJXv-CGPf5l!G6a&AL^U5J&j*y?n zr#<|`$St}j8iIe4b63qZ`=UrmXH|%W5hQ^K@t2i9kof~vezF#nj?4xnAp#qgTRKaB zIr-&^2)HXEh^>gAtrb!8=<8`Zt3n)%qFEJUV8l^R#;&8shv{5 zKvzA`3!#*D%2=zKzFq>v+re)*wrlAHU;<+Yg40+({ubL%6yYMnJth`y16}gGRSgZ% zHqancprIk!1{&oUG&siFz-yeLIjxOys`8Gj6;su&z06YTJ{ls_3Xv(?GJ^PAvUy~f zU7yRKy}1k;W+P~GHiAuNqdjgNVj9LVXnP!MRdM&vA)9STNG<`+HWO&PGo6jXOkBaO z2PKKaFcXL7Rwd3=uU8BlSZtFp2r^NDZLdlc1lg$CrChxb0x`zKqMV^bVwiE7_4?&3 zs1OSyXF!Em7?fg042D=3Ib$ls!hkR+LLk6H;9~({FvvprVMRW>CZZ%6U?FN{pKb(E zn1{o|k_@mAl6q8#af2{xrG7If=0}CNn7kK)M39RLoQgt;AQx3LE5ix~;Wls@jETzI zjw?|Rj|Ab6VM0ubb*A`lmI5gz}-AQL6H zplTlk`KSn#jPU|Eg}{+gg;*F1uh}xdLpX&(%_&QijIfYW=MjN2%)~i0333=?E;5R% z4c=42APYsVN)SasCJMyfC5r4}YZ@#>U3G+Fnnqb~Ldf+y)Nh#BB|WaW-Bb;C9Bh?)%y}VT|$GjcQ|g z6hKR7^%xiHROl<89^+!gv9Y3%5a#04=A*~B*uaZg8+ck<8(-mP=sWP1kMM5YJU``% ztq84aQ?PX-AlrIHXD9h;+>nrrrkzxUlJmE|2b4dSt}QxMQbeR;44kLhnS7OnTorpQhz=?$#=>bssbV~w zHke_Qg^UlUmcT);*Ay&CSPOD_xqI;f7=@ED+7X0#0`V0y^EsT%uLq?VZ_yHX=zN|e z@FTcNVdCQ~CYHo2p`b5ZErEx2^b^09z(a4sD0B{lZKZKoF@my{7EO5>DKoQG{} zZab~jmunQ~VYO{Hj53i;gmQ^ZDUo=i9%JE9#4!qUF^&#O_`4b49c;uN2md!pWGL z7u$2gC)bZoZ^qa0*xe+r`9J&-Bxk90)0mQsUyoS#I*)U2M9eKNI^6ikY=&BjuF~OZ_24{z ze!30@L$PQTNo>yi`6at3AxlXTIhf0|Eczs-$9On>spttjG}x$(pn=q)W#AerZKuwN z_eD_-vRcGvTZNQS9x{50jG_!=PE0tcy-TEuGLUe8f(=L_Rg{B-UYV5*g_Kb)(y7#R zWTHMzENjTF<4N2STrZ@FFwVxtNJ>xQmY}izSPBSjoojr z_aSrF;#_P!+)wlb23n~AY7rJH)>(_YY0jV5moaw@%NOD3{2Nc=mk^y0=i7T`7TNJ5 za~NbG;Poq~?>$ih6Rph*Pwz0y8k-%i_914j*lUd=r6=)9h~D$&`44*Y=RsUsZ0dnT zswfLti?}95*eH!-MhQH$#w}%xiHprol)yvBxMUdTVH+!E*XxVhbc~v#1P;0$l;CFV zsyT`h80e~9kT4Nq<=0*u=J`(!^YQcYJpaH(m49prBOqLi7HyxJ; zR+jKLD9C5q@B}`1cp{UT7&@|vCvY$iOE|ItKVg)eidQvk%c-TnWbChm&DbsNziNa0 zR_kbK|8+bwJlN#_XDlQBd}#mmUHF;2>BPbeSYb6_rj5n3)AMsPM!Iic;Lgm z69y2k0k(-wIu+9$7??c+MkF9R(0EDQ@@l64bjn2|sOEJuucliA6RA0LZE`FWMw4<~3P8tvi>E({`omT&&wo)=y2>vde<_qzzPGG#UNFyg!X!%BIoy z`Y_U}yqKxzWJ98x!{hxC$f z7&53uzJql4ATefC5Io-qyh3fwtlBhJ4tgxQtV+i* z;P<4-<~&TXs7oA4(E$|HYl-o5(7R3^I3$>_#R(I$uRJf2JDz+BH+To(uO5m{^_k$Z;K2Bo7IqsGR4m_TtK3 zY|3jKShmI1Xc@B>nkPLd7rxxMhV_kWIGv4KeU5Eh2+k`bX{#D`NW0N#NyJIQr+o z)~4=*IWTdAuMmTRdIJg$0w*qmLzyVo#{(Rx)ZJ0iJsJ>={rhsujk16PoJt>@#^4A| zqXX_(D(FcJyc>l7>`krO8#vI7xh8YjRrtr`KrTyTN3)`kVkXNuuetOK0(cBS`%Tyn zj?y|;Tt~TNQo94qQNa_3NP}iZ`DoKtzof=tX+J!oN3hAasWovV%wb8GFfeDxx26cC z4&VVtaZ!NtB`;USyEvG2h8BsExfrGr5Jn;{7 zx+JzS^4o(v5g3NZE%(#BCs@2==@tpC&^|EKLC$tWE6Tw5!~LW`bzr3_FSSP``eNYV zq(i5ZdKGsrQazkVK_B3wnAn5RAwUIOSX6;`yMD>cp)u;*#wJkZ%nuJ_aKsQyJRC1@ z;1mrWQUc}^TnW0MdkKQ&jtmZ8jRSqH6+G~X31bDbq3DqgCs3pqRJ(e~w$vGc#y317 z;$Tf+c~x=eGvEhu(hqsRf*;G1Nrvr;LqZsG3WTvkOud=$E#BQs+b|OMxk20ifDAeJI>Bp2ZWxu#Ulx zhxuY^rbn6GS=m)3se4*A5~$VcZh?A1s-6XnMvlsis)|--Ms`MKExil_w%I-AvjH3P z9*oCevxAMz!`Q55HJibJ$3Gj4H!vUO<9UDBVBS63z31Mzk(ni_o54Q|rlpLyarb-f zS^o$BdmsMyZv5|i@xO1TqDJ~Nf8K}xed}PlN&ncDf0!q!JfZURSquN$#{WK#|9uhv zdkz14oeI$xXYjur{BM{3+ok_@y}bg5=`utS0j;Ky5&`5B-OmTbu%L{sDaIP&oNyLZ zLs7~ZoY!Y(W^NRN?qwCTQ+Z((iNCp>4MSsY>t|=cRGDc!LF@P)VN*|}t?hg;Xm{+J zZS^MW-NYnm>h+F$4UwbijuGh8>ydjs$`1e#N4=c5m%VIa_Qh__hffunxlODJCX~3{VK%v$Ueoh@y-gD>pPg`@Wn-}O zm18sQ*LacmlWy|3IaiQ+$6Q9KZCxKUBmt(+JVgm<|0|Li`Jo859FduvR~H7B<2w-2 z%i$FYsnEuT>opV|+W_W%WZ33OK^fu(vpjJeQm{4ne7^^FX}?b*tdeAMW`pDvkum$R zx%Xz6oCf@Ui1!|vHt9;ntb|j^gb1Rv>lOE+5OLCbZ0rOE!rAw+8Z6Wy5834B&aI!I{^7fLH-4)QBw_bF=F5z&QY|P3Nsetl!5pS z75j^AHj|aO+@|7Wqy1u%aC%%>G| z!polFl*Q>j?uU)f;dAVxV2Nv6H^Rml0fy4)TD1@MDZIg1+p{|= zG0&&k)G`V>*4&*fkh}x(M>%8j!(Kj~s%Z}fWsc<7)kB97G#|uV7CELRJ&=^A(P>5H z?lA8c879Z|X}i!t%wcA)yo#p)HE#Xd707yc)WUW679;?Cq5+tWxogMt^^!<_91A9a+Q|1vNxwQ9=#&CRE)brI< zCsU1%h~tvfmYF>Pmv&fTc{ugXR<;8-cu|d5+5_W~?!ItBhHh0X z4tt8B94S~gc@ikkK~cfcR25>IOVkIMzVpg#3uMM(1lMd9RTn8Zb|y#~fngC{N5800 zwLxjS^WnIJgbstFt{4C}ID4JaTy3nJtLL)w)K*s3M?Uz-do#yoIX|qcgk_lunlBECwm<08azj7!AJ+X>D-Mcm!uqs>YZ-*jG3h8xLZih))=9J>25#=w(Z| zFcAC5#Ua?wB&Y$)pn3)#k|!We7iu=SGbq#S(Gtrs!KnjHF7|jE4}xJ*Q?O?7g*!cR z!jLm~VfImXxnn(>AQwr-@JSAG5lysdDBG??F3aFp?96!GsE-e+DQfIz1sz4z8+4V% zyL}GyV(`10JX8YJwPTS2?u%gtrX8TQWXd2t-ewYv1It0ic+|P^B)S#TLqnOlMdWkU zJS7WHx-%%z0Jw@_E^Wz^Zp4&JNQUyPLX+F}tQhn|(;Dw=v{NDrZWUOzVYW#C%f?lA z5>bnh;1zZT^fgGh_%5q9(FBAdkTn#ViP`Dy$$izvfnRkyQxDvn>g)(_GAC=9Q^F*P z#91_tpGibeip#wAbFhNM<=(ValWyBaz%<>rz8jQ1^sQh7+BE+JLfO_PO4LgMt!Tlf z7)p{QBcD3+u`=!>DKcDl^yP)5);1v;iIXOZm$V$5Ts>nhmWpQGfj)p?v z%55f4JXWOPH>APH_U00N%y7}DUD`fkz8A(iREYwSWHA?y21XF{vyq6qs$tmFGE02! z>l3b~TPFKy{~KioAk>~dSP*%69?#DNh7Jw@(4M)~ zNQ8jb+7KVz0E%Sm^8|iIV4r~rrXqN_$Y%n4aB$Xrh3Gg+3Q@Fdn8G zAI>|F8Q4qGC~}0QWb;~OVTRulZ_MsKm2S5j;Z;n<4K>R5Q4WK<1gRPG7~&~p>x<2h zy}#TLA(v}a_6%pDhX7!1|G(!H(>Cq=CY@@A_tPyJ=7d;ooFn=pj0Yq=O{nF1dEI>8WxK zGN!8CY=U%xi(XqnuW+YuaeSI+G^~=qEIV$MlF0(k1y5*AjX5@LE7PfW)7npAR%Vq9 z*XrnrKWB1H2~pwXMdsl_Jr581R~+vr#YyuCC$_X@*u6nJBrj_@LkjeJdTxjn~4ey-REHKZx$q^f*-BtPr{B^wtYAGE{hZGcZxj2f5IwA zPn`jVePG0}0_79jlDp_#$$U2oo+oYEb1ixTGv(5tqtJO$37yQdm=d`NC9* zW}i~8^_+?3k zoNZu4oZ-5!LX2>;NpeOkNd^`6HN#92gIPR|8wWRv6odEv*aBMa#xD27L&=%)z z`MqYfpg9gzIih2V7J)8nFWK)!Y!_grOTkBp?-PyiH8? zj*OEv4bBd0&!h&Cxb|PU)NTl)X7G`|DyafdRQ` znc6Gxxb5?85G@b~_ z5%~nP)A}CG~TiX=_6tybZ5@yU+oIrt*RjbNRG9T?1lah~!6Z~BO zK@yZ|Vm1}4DU9aD%#cvKHlVwJQwJJl=b=rTQPpn*p3>=wYa^!AO#M8--O2=owOs%w{N9@2NkxH?jSa1Xfm0p!cUao%yu(C7n%V;V!F$$Q^X6 zpkw4+wG%wW;r7hf6|AB#wlpuiZoCVT58Nyedu<9mSC9acU+*R~ArGw4N?WOD*Sl%I7>! zt(-$VbtW)1lbO{-pyLiYP&@xr@P#3lgUZ%ns0a;@hyv)eOt+uPD&R~^4=;2jw81(G z7_m`_n!?(PDo2aTIG5~1VJC_BtBmD#E2y0c1+`NssO`;0H>*HQgG**MDyE(iQJm_5 zU=h_O+hGrCV2cqr^_gE#hJ(I*uR1*~bVkq|MzLLeE;=oMkz=B5zpz>mHoez8Fsgi5 z^vXdwa<>_E2JW-xp`P>_TxOfB55J&B89SXA z&rh}9!EIu7K$;_4nS|FlbD1Ta;0%q?S7v%Sf(p5ds+>)F6w+ubhYCpsz#bEe4GXwQ zjwhm0!Si8i1muTdry3Ox=grP}_JY3|KsEifFc4mWwbV^92aa<@YDosN`l4CXDR;o(SV-0g_ zrb)6slG*KZbPTbNpt{~Zhmj}v+mT3irGVh{0V(as50i%#5wcHdA^Vip%*a+a8E%D> zE9aahG@{=_JES=uv%$20=u&r=v1%P8V;!wWjE6170=V8%j_Kz3qd~r7BpgFi$RW!X zWPfTT3tW_t2cRt36mqc%naSD)n?HQZVP-j~T{vU`ymGQCvRO=L;FI-QC>rfW^9IEz zD#IV7&qLvkE^MB@n7mFt!Ga)e)eD-ZFZ$ci4iP%dp`vxI&1rQZXswM>O(-@aA-^Y? zZ*r@lIPk0w0;R-(i|=$k+67zRPVk|%DU)j#U#LT;nFFz9gmLqt0R>ZrHAaZS4rH_J zAUg^w+Q|=`D!5h?b_0n!2TIaiiu(7XR4G?ZR2bTYpIR@p*d{{HS-z1yrVAS!X%8an z`Gdw>=8{qf1fN(RCvSeiLgSVKCmHv@*mkTpDprKjBs+l@Xy`Fz!C+8rrZsLLSbEQ! zKxv{J<)G^}hmK{S8N?Q+m7WU<(j<#FjJ&po%tf6~;DUlVC3Ddpd98T@Pm!KYPx3#_ zm2j=NZXOi(u6NRnHMP&dx@b*wC#@#PY`=}Q4lYRvkqJ9H5W4FOf7eb)QEUHlGDTqp zr;#o1E17r#`f1BFbh0fg#QuL3L1M6vY)x>%*cUz2!%li+24`L$s*#!H#cR9L&Pirh z_>!gym^%uB%tP&*T7igy?w0g(zP56%jxGfXH)zzT}qn zSn#H=u3qquSfaHJ-j~PHIaCcg2aLYFn6m^Si7h-=IY&l&1$oe8z|BP%e6 zEA_roeXs@54OwdPi_>_d1)$~X)90ZPj9P9k^kRCAOSxy)<2{R4Nb1s?gxQD75P#WmmI zY%cJmn(5p=M`?g6drhPRKb(apA}Rp7d0-$7QKf4wUY7W@%-by;mM`U?(oU&v7UMDd zNl=8-p=KZ5E`Z`^;?&J{SP_Wx{z#DBw!0FwtHktD=tMbg-VA)qTq8<%XAKN0&WDw8 zXgtm;7udohLURf4KO-Ly0|*Y=rj}6-0t*8l&6mxI@lQx1SCxwRFtQ2^?;t8v41_ph z`Jw0+<*;HVpl|nj9z$6$uL+#Oy>%{Oqw-+E^jZEMCP(W*i%~)*@fLQt%}R_wYj8Te zfei@4<5 z@ieFl!*VAW)FXx_(AYX}BUI_pZG*^md%UF-0)$-mk<%dELWhi)Dj|(&0!W1&KE1x2 z25XD=I~K7%P4;liQ6v=oWHvK~%&?Y^0HAb1 z5Rt2CKDKC%MqZxyMF@2ur9gz7l!wv%0l*L*a|^@RH@q>{wyr{8@(umtB=y7`lVD2B zys0^hGUTvj{CLMc#~%t>3)H!vO;m%Zn^eDH{M6vtR8pa|RG-_O;PFQM@ks_1;^vDT zyue$!12(wF^}#-}-Ds0okI2TYHqHW9NoS+wcN!5!)@(JlDFP+&8*2ku48O;6u?lu$ z6}b788I~oM58ZozJ^kml8UN$-UVk#=BRdQJrg%c)U+qzc-7rH4*+D@b5#)3x^dt|o zc23cN_fm=B$4VW9#EQZ!CF&WO6!b8Fs4}<`Y+%sa?}JvUZKD2qa6cxjg}3AmlZm4p2>!7Lj>N(g9#tS!vb!wr{+1aFnPOn&2SCgVi72eY8>e zLg33YPFx8L6rD<)ceZxg!N_p4$P!`sq@f^Swx#C?*@TP>7xUd-7(Y}SYexBj<))`4 zv7D?21wDbh4PE6L27(KCYu7StX;jyO#5@vVm~{2?1ateH_+Cad`tbP0kO^M$X5)i> zLoPN!A`buV*pd<#IgUUXY< zyRMkIZ~c;I5v2_&mF2$|-A%W6%{X$cr!lI|wzmv$sx~s2ln5j5B-1dQlNd+QQ<@K$ zFu_2;0B%8IQm{C}71}c|R7#?XqnFiA(^XZ?yQYFG?xnh=?)YU=`D3_I)JC!RZXqd5 ztY%HuOL(K`kQcg6>0&|ODI3)8`gsdCixLCx55>UyjTk6bzyBb$~p3Te^|K@cvBU+#S8Y8DAp_lhXvtc)yCGI=bV5avKN{@ z)GB(IhL;zZ_i%e1T`aYz7&xZ@iB<0k56j#@kv%6D|8Ps z;_8qB?gwIT6C6v;FJHO35!_3&lf}AjpQ30j-c&<`f>McEg{6g00URaIg@o48x}9K9 zSy(aI#2WxlumP<SH(C(bipd`n*NNSXNw^|xZ$q;@^pgJ$>%i54?kVh}*o&0Xa%G-xwf za(k#Vd6GV~sYm&CAy6%w?CLGsNht7&T|^M# zv79=D3fvP6QPJ^~))GlLN;I4yQSyCiM~2N&-N&9d>mEd&ixf%;LkE-lqyXT>Fwin; ztvjvv#A!?JCix&^7wNelZ|ILV=wm~8b`j@l?w2R^mnRjKWlL1g@B)O#ZtICvb4phu z9&t}M%?a9j@#U}>&6b}I_Z?88lB~DK9TZo9;cw)PHP$?Qq&n>w6c|#`1R9*nj?(6cSt_G2V-av8SLOZss-%#*q=l!zGJ!iw6#S6=N zf{E`Mu(kjPW8MEa*#>yeW#|MOWAzq{#hOQ2Ec`%6+tLKFC=sVJ?(L{lPG2da(f9MD z#qp9$_D*XpQZYAwe2iRNZ@P^| zoNAyxUCMgWLRVG96*3>f0fa~|&@>e69yzZfbg>Bl>B0{2aQum($(=JX8~!S)37x-+ zC;jjE)aqShzO&E-jSI-%>DjM+hfxjv+Ianz4?9O4HBzYo9Qa7*(A~n9u57#QZ753sPX&?Mes~ix6h?DzkVga{xs^y1$y!M-WPDH(kH2 zgpBth7u5S=-D5%rB6dI{0seFtXN4@ldB;3GIkq};EyC;IGUrAXW4g{D`@kV4)W>_J zkFBiFnRa9mEPQ6Gnr%-3E)C!EhxgdGe2*JO%lrI3TcBU;BPN{v_HOrW*`E!{wpP!* z*S-{N)PgGBOem#^>%8mXDBsQ41&4259Q26u#|Quu#ssr?qG6jf&_yB$7&R`#lUg=3 zOUAdU17L~!^kD>t8WNjHBte|Rf_=n;gl31&_qJBox~J_H1y*u4wfJC&C}NSADfWL- zmeaa}Fj&Z8)-@b;R(ZE@mfme{i?e6VKUN_J!(Ml1P?nQccHegUo^8)FK(fzG<;+ZS zfN|_|vR}cg#7*$CmO_$#uj!b zB0o44fH&+gNd`W&DKY%C8NPdjh2KG$Pt!USp|qZWh=s$CBr19l0MS8f!Z5gJ&k78# z0B@V+HvRQMDlr(HH@XAGMYt~t@vzxZrV?ISlm4~TFD1nN zh_kSP%JWGAT}oR51}5lC0d|wM8d7Q%TjO?swZwQG;ON76PNAD5LCxcBLoCmcRsEou zz&fqa_vVb6qjZEgL8$*`z%DW|QkkU1Km_&fBZ;vNft)4GeTiqT4rgk1(tc6SssRuI zb7iB#oV!E&Lo5m8dyl<0^GSz_G7if2aEXm9@Ks^~65+d*{Mi-s+b8I)I-QHa9C|*p z9-I-9Aik(QtnAfqS#er>4{VysD875?JWo_l`SwY}bfhOcZXE!hjw-Q{i zcD?S`Hoa!5vdTB*)%_>OwdfUI-__*g@)^=G&mI5K>ox*-sgnwOi8^jLbYg_=DL+vHX zjh*ty-d4mf&%LXd06b&8qE&r7b+#h7n;61~_ghlzDA$zm3Q9dLdNV2Ac50}dMO>+# zjZ#Gw?H-#pkJG#5UGu}+og`7we*-J)lRgHSO9Pav2@st-Niz@IKrxzaG* zIM(JdAi4`v9ipjN91#-Bsuy*a^4XrJoZ;uuaORx1x-juOr_kt>$;@A z4~90GoK>()uQinJ1U(YJ2GHb7;^IlZi-3p-QrwXo(W6x$4$S``*Said_py$HMUTMzCiduFxW86K4JY_Au-*?eV@TQvv z6M?x0c35?QK*HE*XC)+Zm2>c&*RakxKNZwp;#)8!Ei8WcjaWU%bs({0ZFf`uJl-Fk z$NN{#Jw<&%X;0BVIh)c~fC^%Y$ILT{!|dp49&{+I3$TAMo@}q!g_#>qiW0EZ{d-XI zqh{h`w@4%4bO&cSduF%m<>{m!UZPIE2r((^o2gXVLb|~U-uG&EPtIp9xM}29rnRiV zZ94(c%?l^R(pQi0a_ZiQTnKdY`bsM)_Fh{mQM!+bAZIA(bP9N6M3K-;j81C+%i(?C zZHfoNP4R#s(zvV_l&#&r92-sX)*7i`@KOn3SF(SmzxFsQPG877%i-`Lvaf4TXDD{S z-xP}}Foxwsy%PG1oSbzeB3_MYhG58Azhz8#ZNmn=@v1n%(51wBlRU4zJ+5KxU^2Ll zFJJT=P3%i@TS0*F=czyWn0~*=RhS3Y`2*Y1LKM+>EYk~f;+$R}#}?ZMY0C4NCa)Ha z-Q`&?2;dQW%JdM^({Y+VQ~x^P6qvs^tVW?vDK1FdKd@^Ch#iw7LgBiZi;5a*(7Fgt zeIxHSEH`kzu@?vsjD1*ul^}rhUSV_H6(d4XVibpZ3#w{7B(b^+zuHc!L;MTXrN7h1f5DL3tlaY-1BBL zw$|Iw?cGfRDOfpL*-QccU>(ephwV;!?c^F1*f_bFo;sbrILC#3uH*U?+Ivx+Oky`Dwy-U?H_(RG5H>EPBC_|ady4Ng5#Z-gBzDcY zWC>Uu&q`^-jtc@}lpQ;$L6kS<*#S4>{j#8Nn~r2!rSW+^7B7!lr`t(jC9O9-50HoE z7e_EewsAlAatux#cRUvl$VDtD4un6F~w)NlA~H z5xC4sP)4%dr>@AgYeAXoqETqi-(owhS`UsrP~T(P?lI2p3tJQo=frD5?txWei-hGT zVBL-m@S&{hn8uf)$kd9n+}3jVvo!+BFjr>xm@d&{yyGg8LbBm@u{$%8NgheR$?-yf zlabfBu^swnYq#A!Y-JiM3T}miayIBA8Xdu=t2t75Ka9MFTn*P_nOs1QDYyd}Fl+~< z1`SSaCU^qI1kB%61pT#Ilqu%w;X&BsKU7(%$J}j9W)Tf?jeb;r?27<)* zwxDa!Ue(tSd|>ex_}a-heOWLQz)%glW5CJ96~QpA+@@x8V@OwS1edZid*E+Cvv3p&cl3(fYP6jqr9 z$nD{w!5A);8c_8*HD?W7(MCs%`d*CaJmEIq23SDTW>W7d$5X=2RMp|-u$PU;`N%>& zszfVvMmr3JHr)$xXMoQDg)HxLpIcHXV>db75FL3+5*nLO3+h5j$b?J~WPnm@pjM1d z%?LVSH=*2RVjCh~2|MY&ii}$X_qn!~GHjHn_8s&-*+}m}(IoJt)Zz-d{gO*sX5Amf zN%*k6DPKj}W!L1q?^lnm8PY&wH$|FJtnY&%>-(T$eIIsFClM=wQqDx;RJ4x9zLtP; z%X)58SS`SRQ!xYrk24ly29T{Y7EJ&zn$hz(8FlR;COhQ&sbZsu1xdyRfQk$^l6V|o z_~8@&N46e6Oum+ATejTX` z?pjpK5fes6U8e$Mr|!*dpMWKO*DIm z^}m-pKwUxL*D`*>xdE#nL!ZwqIDpRvI*{7y3-yUwvq8zRN#JXiP8k%RGUZuVc?*(G zJ}0O{miEnP3Q32if#|0t#Lf;&7uNwm?h97|xG=tYAD4BxvC{$WxqH zj2gZwd%t>xXOo=K7Oa2v$N~wJVZ=>0dDuE|NOkrqtc0xK5>j9iqYOH?4~%`q9M~c9 zAmwvros0XRo{C7Ay{D|tJ@A%rzlTAw#9vJEq!vT$2@#~-auj#05ySl;>Q1O#_hUz| zvu-?yD0PP-mT`!66IOMmvr7cw0#wLam-Qzu0-=+rxFy{ZC$i{+|GGsl(ea9`k`XY* zM4T^{36d0CGLB@1Q{l8L&`FRygZ7*kKaCN;@?^Ws1hyGEfkKLLbDNSsDzKi1hWu&A zJMfsDVXjFW`Y;hG&n0PM=r}!gx4DDSQz*FyQ798Y#v*k_d{wBIf&p1i6n(-Td)a8z zp1=)iBl(!4LNO|$q_r_{5`)TcM6N_qTFi3|eb^ifw;*&+MXW6wlgGsuHGC(c@O*in z>=@3N?la^ub}QgjT3ILERtRkN%`U#_K)6%vHF#C=9IkgZIw$Ka0Nez5OyxDq2x^Hu zneFxlXeLGQOm)1yYg@t}%Z2loFKf%jQ|GUofBfRs#Vc2Jkl9Y_q#q=hojqyBch)(L zwao8R?OK6T`gJEg-EMe2fq1C(HTQZQUW;oRzSkY#_Zzy8yUl&Xbr7erv;}9tOkvx8 z7w>u}O&5P>#?(pQ)}Hs>=`?+td}0dgp=4)I<2b`lHq!K@CoEi1C_vWC;vCGIfNPgc zBXViSy4Fs>i7D5C&RYnH|DT#7bEM zK9>oO>pPbaA)uRthqY8&9-c?w@N@slxpz1Skt?%$9^Zs>i5cP?Y>KY%8sr91E;0y?j)I{$>|qkMQ9&iC*|3DFjGRRxgq|+~ zpD?1$*K^5*KM=9(CkGJobXby0gJvE3=9{mf_QSB;iNh1@6-T^-kiQiCrAE`%VcW0V zbN{6tAKq)t(XlRphDYZa3L)FLimNDk5;`Ygg@FBn}o7>v# z#n2xGlE>JS$eD7qD&*+w(Y@N0jcNugxa zr2=MuNmVJD4l*T5`x$Ip+UtZ7x2@%5m{xld(1%ie811Sqo4}Fqft7O?A*vvK3=%G) z9nZUJ z632`Yvt($;1ra^r$WJpv&5R&0DGkj8N5)~E@diO>;H)BIN?A>~14D>O*>$ey)P;V| zb{w0WPkd6`mylzPrwhzAe(GQ>BC~-%)J&)Y?tvSEd2b5G8_G*anD1qae681#H}Bz` zd!)o}zrcm&Z7b&Q~%H$nATELEXK40@}{B8t1(t(?RduFi2IP7cwY2wPZn>0h}8ZGLK-v84nq7 z-t#H$7;I?AaHK9HI0*fAlwq{|0cow!9iGAbZA8~}&&D!KB2_jq5%!IdHF^?|uXT~k zE`qxiN2T7lVZOBf1ob{q>IXBoeYEm%^=!A)icS!fDf=1G%)aD8p?&bq+{I7c%#S!e z)iy-8+)-iSPB$ZW?S))s_2+x zn>;&1XKSv`Wg8cC3@=Z2E!DXFM&%numbU1QVwIRV?tS>E1seh5OT__{g&)FsB(&1@j~RwOJTG;?(>|Legi$$2jeA;Wcn5Y`sfb1t&0uFPE#z>ziE4Z7DF&DB)fyhB1S{Bc% zsak^5aGT0QiEmExY0tS{xQ{u21#h^$@&Jh?#p)xW;*jtVO@%ap6uhls*E@blMaPd4 z!zbk3-!~jJxcumz^e{EJ;odpZa^_KqZEL@03MZ2fa=Ve$x6N%TN@wtJMCWLa*;2$7 z*%XeqK*q~bSwmz5r=2-#&W9J6nB;&v?*YFBP0k@sN@%O;JZ%6MYD+o3+&oyLhYvi3 z{XoiEl?tT7jl-Ht3;_ZU{FYCt+QP_GxX$QzRG1B-$*&!N>=buFdzpIGKtV-pnuf$i z!rjVCjOFV?_LJ!XFhd1EjBjF7Mby({;&u^L7ZO-@VS`dAqVFVDZ& zA#$M|4INk!G9{>;AZwNyjWzNWqy6%xM58Dc%Ashw8U%Spw8-xEbM@_H#UN=FQ}U%b zvd%{Y55&Qe6rJpl`pp|Wkm$yOdpAJs@(zS^S)E+kX2q;fIqz|i6We%H}VD?wA6JakmZoy^%aCamr>iw#Hq=Rl;^X-i^ zZI$Eoj`?E4ZU)wfNG?9NZ^rAg3Da`oz1Xn3Gol`O$l>ZJo}LtVp)^HnVOmP>g+3{7 z>gZ6+vQw5-H;lHgEUoaqo##I5LtXz-bc#zD}5aTlFmBk)Y~!Y8au6&_HXLQmn`1mO~}*9)wZpWmT)n zSCUG;VTOsU!$_lA0wSWwP_j4hsCvWKU+|ds>Qk=$~>ama4PEt#hl6#0YsvjZP$pzYK%xcB)d|X^WhV^_f^TD0duw08o1|9HeiI0 zS_Ajp(Giq&I(qkQG|+JYKlT|1OO^oSNQimm`hDd_`<~K;kA^3vxyR%3pw{C?bi~^n zLU3i6rfox35y?^|-~n3UGdae1W}~4RPZY>8VDRc>(bVC{Vn`5uTIkU}NAna`P9w2f zEs4ynHj+8hk2;yt>Ls75bzKvt+!kd31teZ|4azig4KYHfFQ#_)#tqYpTcv%`mORS$ zkxug%2qrus*3Bzzd9rwW@#doPjn}T3;1=*Qc+Ub@##-O3ZZ=z3jrS-w2GVUUk%Tj9-1lNIxIgscD} z7_E!HUeQ%CFHJ32R{q2mhZI73Rl-(Ctr&0Q&E+@^{&if9@|Xh+Qm zpwf}LkaUW~50fyPkhg(_f3(hjXk YXxC^qAC}G&Q`96+aR{7@ixnC?xYwp`@XY^ zXyWb8+YLaF)cVtg9}d@pEx+yycCO$?P;etGXu5&boyEesX?Tp=JJyxDWgU@Nt-Zxz zF$;cCgQI8u?7S;#-VDL1b0&7w!Pl7|g2@ZY%C4xNFW|1mI2&*wQ8PYKLLk(7JD8}E zSTcp&i-jZ20DA@5QruSemW{76wT=9{%*?c&q>#2X-(f!W)Kj$Re&T3VvkKcyz%7FC z0*RM1n8IxrBpTjtbxsH1racF|u6JS)a~jjcB@LybFV@Un73o5x~>c&njn+M><2O>>nsZnQkQ(V}-(126Tm z?X_EZr|Ie z?v7Y}FkN_$V@}{8sOyG2IGjEj2yzE(kFy~ufGw0r#x1EHC5=>HPGck8M^iDM$gREH znvTW%z=j{-Rj%F4kFMK#8d)tYD@T-J?9G>fGG#A3vsiMDgu!lwhvdL z&2`M1YTsXdUp}FxjfjGS4-UrJdSw9z=i>1#gy`E_mI-NWMVK!hF=xO%c=iV0&g~=&u&B8ui}4EE+zQ z9UQ!912m2YSI%8@Vb`G_?L#?u+bh>h@Y-T=v)o}fG)diJ4Y;0jTf)Iw?6^j7pEaMO zeAtmKLN0LVI^{YhxI7T~p*o{O#wDPRaH*Y}U1DADr01Ty9qC_GJvOJ1S9Q>1-}w)n z76?onv^Qpdcauv~>q8Sj2AX3vn~>WbJFpKqro^^l!EC2x;#}31>KW$&A}mpg@qoGH zNSoYSYxaC*6nY)YD{4d?lFy2%V&d8`vx}a>gf8SlP zAnLRh2pcA~zO|uyyUAFzyZ$D{lf7fq+H`4xA3E4Y}F?j7oXMmnq%39r0==veLG2b4lGJ z+lvTUU-K`s^|h6AkFqcC1@h%BY}yaG(>(v%Y&IGX*M!nOF|s*S~P^6 z(bAw>q{uHJ(Ud7Y$_wl{!JnC#EFp~}MD|l{u)AFPvdR!kDGO14n6F~$@Nu*v7ognA z5#)$~ARF*VrXUvRT_x4q-eVZASxjDDMzssvnk7LsnaTmA9sC;1-vBSbWzgpv^Nqpw zF1lF(HrMbv!m<>)d-nb6+ z)~02dRs)RH=qG+s`Jg04Jpw#KwMTQu^S0$~(@wh4Xf$8M9 zEQkm4kfKYBk`tICGv@WRHJ+`EJn8LzUx!FjmWHZaF-{Uli914wP~y+Cq$?(Kpo~!QiOdr?rZyrG7(>9{YUC%D;)37WNI;C8} z@%&mjY8g=NEu0u#1>7GrEhIYAtFxe|wYAJ}x_8K&++@h(9D<3fIEM%l546hO%s zUps=P?k0@%{OGNY9HCR(*Dz9T2#bx{vBNAl4iegFu;TCbL@6|bPePrhr>vn8U6`pk zM(n+yrifaF!{0pgGwgX2JHVKJZUcII-ihcK$AF1>F%dN}T%6lJ4@;v}+nq!lyHx79@{vPgtDUxft0q5{K9c3?=!Mvb^^tekr% zpgM2qaBZO^=W*}{@IDB=W;F<5IOdj{zrQwH7pju1=~Ya}-q98e2~AJNt=L4VfrL zaI15gT^6dQ9Aanle{dMO-STw04j|W?VSoz^Mk6fozVioW|1#iMpo=45Usblg!bT1tRcHatP>i;%Gk~n|p*JAyFfQXo-v+(oLQo4JchQ>03=Ds-d(x zGFSA_P=Y&66?MlPL{OBxkeJ&3pNtZhIv;!+{+w&OopS&1Tg&a+vr*sH&T^dQQ0hP zjR*=P9|Z>&X!b#wLeB9spiLZ7Zn^^jbM;RJ?_j{du!kLDwukbolV)~E%+^u59EkYX zr1a?9t{LKqD53|DeMW};n-celhD(c$BAXZ!df)aUspRUCOx^74!K`v%Ct<>}Ig5B{ zgdIali-<*cxQjNexpdKoY>KToZHQ)TfNL2`);olcJyOc((_tI-WGW1WJ2!eIS#}cO zDtX87y&~B@7&$Jm8j?$ZQZq9=Uyaxk+v;cEvHA}LX|TWezUD3A)zY?`Rdxeke|KU# zAhWR4wp~ojmR@qW@c>7Ibo+3ZP{*8=+kQ=uA|-%|At&h37|S}NN{cg9n)28paNQ1J zWWm+HWY>A72;l69z+97;gx*`r03t}#L$x4b7m0%NER<3%ei>CQhZM^3O(q!IRI<(mYwO*EK%PHCjDt5&@1()CuW+EUPt&Mx6h*i+he|r$X9G=#e z^BTxH+n%>IH`^;$0c9DQ2K;wjf^>-!K>sYuR(9|D{O>2Rk2`7Qb&Cd(-MektTV2p0 z__!T$B{Scyn8B~uY48g1bZ~8O=dE|D$HnXrW{dV`J%LTJd(PB2o&_3Xo=%(d*W%EZgsJS|&Lf9l{%~+rddjb35-+vR zb+10?7Z*_IqlV8Ik=pKKDIg(a40p%3I9lZGwE2m)*3X^PI*yYo=YSbF4;eDZvX(x@ zdEPDoG}BJj%USQSF1X-?8I(&_8iG2i0`rczw{=qC(#WEhqbyu=X0maqLP#`fE16)1 z!`TQEk0jzUM2-U3n5zgaSp%X;=yZs_S|ugNsTiI~kewMJ*31`LF9*4s8T0`&ZR{yi zVRtXWAzTFR6|YML#{^QD@-Xcn-87R)aO>PI^c<|J+o&DiFZ$$w1kM}1NhvoujS_7~ z_#9!bG~!$_QTHlmrNd;Z7ST}b-@Z@}m%Pnt0&*gI0wKV1+d^D(W^jcMdz9`K{k|D6 zQ1jIsQ-)WH=7aJHmXBANAS?>jcw-a(nsEyVTvrn28znj#T== zqtFhFm}smV1ZfFDcNu~=ktBkYiBYA8l8K@P2=_v9BO4dkOSLE5L+|nh`2qKnlr#O_ zvHPbhI>(c~b@e2eR^dQig~W~#g(Jf^W2%~Bf(c|QDoW|OkP8z=1}zY*;J(0^d6IRd z5HK~&AgPs&xIlyp+H#0l9k!}>SV7HjXId#`^H-6__Jxk)2$bx$n@>fFhHb0dI$Fs| z36}{r70b~#i%611k*sHyq4b!f7{>Gk$#$sy6YN7DYnmqh5jqm$Gu%n=Nhff>b zg=}!>O?iGGqa*mW0DEukx>InGBqUc(-GyAB-btK_6x;*}sEaWzF&F|j=b7ZZ5fdwN zp~uI8iW{>+Y**!AHf6IOb%{PQYtV9@Ia8YYbryOwDC1`9@ zl|gge19srUz>?Y7P za!09gtOEUy6V;OHPSB*zw6v)|SzQ;^Lu2`d9+EPaYMBDygaul~X<3bT#2b4T;FhcG zhz~5!nk2GAYEOpk0@0l@c^9V-mZ`Ov2skaKAF8*7*t#HwG~a}9!xpyCrr)NtzIK5gtmj~3?GMflt3AyI1C$sf#p)dnbpRtQ0_%DpAnOOMTMdrgm zqRG0c0x@nOW;gZ@AYgX}fFy-_;&%sd>JIe6qcwyR3l(T$X2`*-H zi9cu;aI7}vo?z2?*Xre`&)<0b(i2y=&R_UU>4$!%MN*$0uuqRLj@_j3;{fzwW37{5 z>W&P&H!1xzOg0ln-*1Lr;QkH|bt zd#x1HH*8SQtD-dF0l`zN6|u^8Evz%30<|_&3hB$38rF*gP56eGo!1RUsSUNUeaEEbPj~C*E=C%9Bsjx}u*)WZ*5kb|`H}oIAo<^0R(;v3PZK zb8of9Psh(j;qM;XY!)`$fgCj(z@J9!-e&to!;%c2vVE>4XLa+W>eFeda3 zhbw;SQ1*QyCyv46ItgMup|Sw>CS_vR7P`%iQ9!;Lj(%P{ro{Kg0rdTpzi>81)QMN# zS{L*R4q}14t89j`7}*VKwj|zPl#^SSJ&ue;UssBjbcxRV zAW4id0fywj6t=u9b6-=8tisvFLab4+?qp2o)&A2&HmMQWD;FQVbam^>yK7X|d*N-R z^RB;=q6%H-vCr%YEtWU-xWh@GiqjqDj_P3~bIFKyeYz+vy27iCqWFrL9x3x4cypa8)p6f#5!d1 zOt5cNF>=hfzOq3ugJ>G<7Af1su^oKgoe%IZhx@CjhK9sQNSG^^%?^t}0e$AaTXti@ z;X}^JQTCgQ939UlW55#hw*US9_P;+&mWClI!AU^n{D|h<>IG3LWz!vwcApuFoat$lEis;ke5#<;p)P zz!IRjwb8Y1Qb8)N5L$SW_mELRHwbMbg%+$%5jAtBC@N7GAl1#Q?`? zN7(T)j->rrF6kDc)5{lAExe*4yV)ppa{&&xz8dJr`FBRA3}d!uqc)4!`4J07evi*2 zKBq9s576qMuT^>05ZsUADCGP0tLlI{{B^#Y ztU->LS2@h3O3{iL$(SulGn)u4Lwc`(={eU;o~aonHUTaxF&v5u82MN`!w5#w;5W0r z;zEtEmOVRT4=|u)5f`juobXL3~X`*4S>SBM5I+G*V{`0TlSQnEW{y%SP^ zlj_)AfQ!%G9<_Eilg7qi$+5n~@rW>MYJzFjaV@tcfq)z6+@9LngWg(4$FQeKFhj*u zd>VEN_RgB*W}iVc;S%iRkd%ANC=cx6+9q}<^iWS$AUPG|(FNM+fov%|jA zoH^x}V@LmT?CkrX)$kTliXwd;+`#TAs;&t4acJ`*a-BXe-(yqlS$|XhiPf85_uYew zinDOfeJV_}g;fBw*qW**#bebn9o2Yld}84Q*rzYXLB+Tz?~WFZnD3T^zYFqtp+w6& zCsBZz*b!(_Q~+qY7?mlxaIj4+nsHJV0{xQIk5;Ji zH0MFpJ=P7erq+viVB2!UDBrw6YRtCJYOAe*PeK{wI5I_&eePuTB{D zwng!NTA^1<73<_JSpKqC4$dSyl-teIu7&~EQ9l6G=#Kby4SiSKHU+&Veh%(P6zV|y zw~~qLeqpLre8IQ~Y$Xli&6ZdK%TvMhDhlFj7u7JJYtU45=;RKk_)<3Z*io~t6~teFNF&1`oHVdJtt^drdV!nzehTqy#%O>XN zTVyb67WAhtZ(X^#>^@GK$BRpDp9x+>*2&2 z;vFyz_)~@U(_>F?uy2!=+pdB|<8Risv+cWpHH&YG?k(=aa@0s}P!Z#N-K_z>=FjH4 z!OzAA*`!}3EmrWylyM$)bYy|ucY zO_+2=3wkuAYE2CSj|m+@g?!K>UD4_~x|X{hneU;;vS(nIbPv+g?QkD1g;$ z#KvUmq9W;u>4|_U)#iwm*HD{Tuf`d|T2D^;@i~I|hZ;_rO1KVF98bfEofD*7KN--{ zbs4L!sG2|7nLlF)=tE}L6WIxNU#+r@D|4_(* zVI9fe3*TBf9#qf8?o9F}AQwz{4H$4@R(!WC`xZo%Zeh^D_VRhW#nSGW5v3Gx5u}l_ zAGCd@BhU?jUI>J*(5uxc3yB5>-tg?jY;I@qKLaaRs8C$MiiqQfq&|XD2Zq>;vk4$5 zAs`Y#L^*nmik>r(wm`*Q?6W7Va^z-wKcMOGhHm44z^ARn{79Qp)z|M{3b5`d>nWh{ zm*bWbcr@1@<2|_V5j4-OdcRtzv^Z+B^_E;J*4bCMqRYm^Cy+AD9YnB9f$Fzj+!#ku zpXg^$@kd_AQ-ECZFVD`r$!)wnL)oUr!;mqO>{;TTrj97(J0_-pb_-(JY`cw`fRnMg zC9Q&!(VBf6(%67qkS@teBON}Q3_-TCos31G1-rk#V>9a~!sAZNxH;oV7IK|xmLOum zh(;*FfMI?%JQGu96bK_*24ukL3Q+Pe_qDe(Hkqo%wyV=Wz$Z^o3Ddf%V{KE{TG(Ge zVp@eMu)diV?BF&s|Gf8JPiX=Aj5k50Ma79eK}c$QWuiBFF~XSfp4<8>e)bV-o`A8r z7caVh!T|22S+HqFvGuyDL^|L~nUC)qdDoG*;r$t_eX4F+yvQ&YcI{I>pc}Dk*;^?& z0`lpLz6()IoL%1UQe8T*#D2M$e2X!-{;hLSd+4GOo4ot1uP!SX%!k&L3|eC5=?CSs z3f%iHxu9Z-PV=<6ffwvUIj422x_NYIYjIk=*TRr)++=h24kdHdn+KmP+C5k(s+9_KP&Vl-^J%OlkmD&1adAyrCmDmII&ceQ zyEZejpI7R>R$nUAFsYs{Ah3ohdfIsd;}7ef*tqPA zt^P53J&x%jebqE20};bVOd+W(?m>c6_^BX2ea8+lUg|=OQG}ud+TvgeRiu|?+(F0) ze6^HwS70cPLFpvN_L}h6Qp&|)ffMjFAJ=(mRyxZVyhLpQFg{uM4TULZeg2uzzM6 zY#d}wbGya2GL;466KVy~XVV(*(V59=j3;hlCfSh!_OvEf=$;gU6eE5?<|C5~fGX#ax-e*H%oP#k_SQ>)xLY z$NF>lJ)g)xi5Q7_=cE7y=>h&F6b6B9eYORC*pz7lZ`|!-gife?vyoZYD^7sA?B$Y( zA0^~XoU^c388U{36w1u@q?#{*7d$qe?lo`tfwonf>ah(LwOrwOL%!}6*39omaG(-q@jW> z1Uv)9L?VbxsOrJ)Y$j`Ti4f{I*oE0eRNB()xg~anp}famwUcSOKdtE|$0V2m3@ptDj$K&)d&+UB|uF>sny zH^Je$*F*gKU7;6t=BH@iXC1MS!#ykPfD#OI%5j=M720;;>eiD_NioDgghT|5-SyK2 z>UyqRyt;M%%9d9Zr!u&O+AchK`SQgJer+xVkeMoT7@Hv6=hyr66JZ}6Gb@oa*|3~Z zI3J7YEkl$(bNk4gls4xpu`1IAZ9UZ3*dzz^AO?)@7yCuu>KSU?z@`Ce!^@c>3Rv^k z`r5{+d40LMb@8c&$@FvVU{)1~6Rc%c=(?;cE1=F@(^4q8eA|u*j0}|efd@gnCbz>GAO~0e;I}vG~JCQ;*4D#`4mN& z9q$H_hs|zr=oz1Sg~MBgWPqBQ;ffl{9G`WHw?+1qRf<-BWK{v;rCaj=?y&Z=oDeTY z1@3Vlg4e^HbvB=SKl^Fz)T0GrHJ57SPW_pEie%-$>jnAuFydJ@CHpr`m9XH4R5px8 zBdqFYON<9Gd7B2*A#^oNQIOtqbJ_9HFsM7zYd0mIx{XSu7lFH2Wb793z}i)HAa0lO z$SxBSo#u9cxt>mnT}(r#IBZM)I3;|_*<+SSJ2ZCz$Ri?H0eZN23D}(?SOY!r6rz5d zxo0ZGRg1=D=p4q$-CH52FfyHQ+k7*_c6dE)UGA7$b_qwFs=d%8W-74R8-nSx&lj-I zs^o1SOji?6V0}|2bqtV8R{SEMBcOq}buqnDp=+{|HRVIrSv01R3r6HTrFvssx+exL z*qyQ2T}F#2#cq3AUmkjpIKAP`d380p1O@_=NGuTK9Jrab#6JT`B zo5oAz;i%`4AI*2H8&4;IS#X24AAb@Lv(y3pml<|+sxa>eB48r96|JW8p(C3Cy5P(* zHvEm+R@8~XD+Ni66s$)0tiY{d7d5id3U&(bkgT@{cP546SIJ7R9GW8yl=Nt2?%t~y zG~C;M@^Jo1wZ)d)gEeJogxZD|9U66TnA{d=*7&Gd1KRu{_AG9$H%R+<(J*bnmvW%E zD*~(Qtqe9k)@6tKvW?Utp|&{Z+J%$=p4(*mJl>$uax8{pf8^e)MZ@IQxROmZb8-9I3Awjm2JzX#=_9`HrKSSn7(DS{ zjrI+1XHnY(EBh9PPc{0(r)P_X&wY8RhfmGW@MXqB9QoRO&_}m)sA_^KKUy>$$B{~J zeKuGwzlC8To@6jCP7JtUV1z{Zl8+3Vxs{>C@AYM`^q1{6mxe4ygT}pbLf8B)ur&~~ z3C_nJzz{#1KWZs;M_d~01k{Ed^JM_{-y!1BC)RO#sTww{2(+}X0|Xm0WPm4~V^Ha03my0lMt?%-lbGlgccdW$L<7uWvy#m9s8%#&JUO)zf0 zwXm+8ME~6Z?+;u$Kie#2NfMpMF{gYsEr;2ZU?0E+vTr85v`I+F|553$ z7^%`bpX6u@afJB*OF*>0_6(3H5wJaupZzw6pS@VwyrhXXFkv%|)rE=pl5KmZ(NA7G zEF(z1O*F%nYPm+E*j*gF#K?zC;~+|hp%w?2g+aV_c&+X1vy*pVZm8ocZ6dq^xu)SQ z7#@34`b)r0D!~1o$$-6OC~(bXdJ3%Y9e=x7d^Na=fwChs)Ddk!i!0)KZ1w|qh|zVu zV3n8gcaEvcrPw^n!mawDUlOB14Z#T7QjYOpvs^R(@4|EEkG00s+lR~U=@@rEZ_v!9 zdxLdD^}~5RAiXRgVpqe{cr`eRv^%`CE|~T}`rzFAX?yx!$NFNb3_~L@=Fn9K$A_m1 zHa{DsB}&dB#^S0}ZGtTXT{9<-k<;vQ(*|ZcMm+p~H{d|wEK~OvY?_$3q#n;XCietIL-B!;&0;u|dO0NWLbep4 z|2Zebz%!jfD#uYnE>(bnR2{;Z>SZA3Fwh)okT#=Km z2saCcCj>Kvh%|=mT5BdH>P=fSbl03@2lT3#9(h>#jQoQ2S}#?9{zU|{j>byJ(#T`t z;6QJXj1IF2$KTp2Aqfi{ShExQjEaaWs7GSQNdX*C!3Z0om{gcOKdx2QW!_;qocgEa zu)*jm(itYXUeYt6#3+}#C7+g6!7J+f%-+}M-0mbU7SB6c^O2iqM&9ZV+xXi%Ad4a)K+<5a>T`_4ZWU#IYm z><;S!ux>(dn^7?!U;`VS57REC3`;84K8ynH;AuO3lMkzCzC>>Rg!%G>8Iv@(y3xj6 zdji+Ud$ZnFA^ezQcBi#+ca^TDcUSL$9G!K!9W0r!|5_X}1-}{Kr+uvQ>+QBfFR(yB zm2`8{Oh7)C(d;0)=OGxMIT1<-TL8cii0Ko;3J^(v`Qrs7WIojVw|%{=N8ZK}!IqWvaAm}wc2hQ2qza58?$WCBdErdyW>GGrlZ8sxar{1+{naC3)XE8&z(TO= zv1S#JLGrXt0SuK@8uxHDFCTk|#~%V4GUb|{D!*Hc?-f9s)qF*5@B{B#56yyjxZ22_ z)a(Ig6qSe1Zw2N+m#$RqO)a}=x2~Ak2=f67UNLy2Ii(aQYiwN_dA3_z7Itq0^-pW5_V=kyx86yAaxZU_T{EX3nJ6kjfWt3wuAhgh#Gd;mld3 zDkxj}ePZZQjhbjRD$CE_$U3QmwqXzHN!H7^adUC9O;>}P@ZAiLZ(oTRJU2C)$`a@p z=EU}LcAwPq25Oht=%6%GX|qm#@e!*9O05Cumi=KS05GD#&j37y_%>5$sSf%hX-SBJ zW^61|)2>CKMvOmKo_->*#F!^FOHAf(+gg-bq~hB%@nDie+zXNm$*PDgBj3COm+7DR z|Db>7|7-oD`bjVo9HwR3ogc_H_Px!=O|IrvCp-=v&7%lOD9Hy1LROGo9+&`bu86a( zdc3H&u4Js&+tJ8~OdMw|IWweB$3|>h3wkZL@Vt>6BM)QKSfuCzxS~;fQDk_aAoO!o zHe^YDITB_D9a)?bHj+vcspE0eWg^a}>#Xi)#H*NeBwoulWl0=3J822T8nc`nW|~{p z9{Z@0Q`SLNx9VD^WA3EHju&<8oH&ftPuPQSbwdPGm;cYVrrCo%%?T&ZBKCyylZ06} z_2P6x#_)LKBluB?0&@aTd=lwUP|eS7Os?kM z)WRcE&DToq8PKvf803_+Vaa>&|f6NxR+dGO>gi<&>Yod1qhMMjI#_(@7;s_8^rnEk>Vc ztQBdGtp}VKBk|5Lq7g*$04fWoRy9|H$Ad!3m6Ua{q+%$oUWO6TL^(tI=}e+jM1{C} z@w~z4F8g^IYU&;g+(3xB+&$@74}!WOv+ePY$lsGwZ-us12F;kz4fyP=KzlEAh%8%M zTGg>L$UvWSQ1qvJ=5I4HvxYsJJhriFP%)xC%n)(bf8BkzD8K+31>)&oGUTOwXDt!z zbu0y{*w=vHw`w-Tuoz`-({$*vFx^LOnhXy5tSa1zRp=l4CDg&H!f~uZ*|B)a_wvK6 zZ{}!d#D7Gl&IaoHe&qX+b=wpbHaWN2k9tdeM9ss2%*-NB+Dmi!E}KC}D~fsXe%|#a zxqKs+8%F>(Go0k4USp(3x5h{}hA!1!E-|dR@k^ZHtYKII_-34kKBf)buQOsq=bdPc z=RBceI;W{-+qoE^J_1hY1j=mK4D7ERBAU1JsjqJ zV9UWS27F2+v4CM!cI?IVsm2M^Gx z67(s-?EICiyD++^3+#Ee+!7}Somr@`yAU@#4`+5WMGv;DYqwjjxBD7!5v zzMtKowBnQ9fZMs~yXe+*HA~B&oislLlRf!EVAQKsVbHhS2_X@N5uWlMswIW-a zi%E7+gSVAu^AD4h`p5*iHRA8En40MmXGImo1y@Qro7zP6cRrYl#L6Y2xy&T)=F?#E z&65QunhGs>oUf|<>fZKT5>tu1bQq5oJUmI0oV1E=-gUF-&*GvX7xgh0OAWf1gYwp_ z)L)3^GhPcjZ;N7PPNR&sQ_*U zXwq$Lo~piis--qhb?nXaaLIgtio>vwsjz3#v+4dzvu_j%*#5k_>e*A~qJS~DXrTPZ zEo#^1PHxjB;?5$ThWc{m42ASr`*@c;-`$PDtMNZ9+ujokN~p!SSpcVF#rt)Wix`}Q zhWdi?`Bc^;aa@?2e{K?hMd5_bQ(oeEAx;Wau?Q$$#DHj>&7iACiU9^}KM0H|f#+Vr z#z9O+UK<1MXdpf;eVEy`R+LgX0!pGS`OPrKz`#EFhgHhj~ zPhE)~U@f+;8(nmW1LrSrpp{^}qb_3?bw8ZuYmr1FrXG)^@v}uVjf*XDC_)&{XrZ}w zI7~H<_J%OIgbf?4ffxf=_8o-ol<~GMcSc|vdXG1VR?LEAM$wV-Bl4^B zR|TFdToX*6yR1vE^W9q{Un%&!KE(8>Z{h%YI|X~*>}KOXI0!u>Is<~FKacom;Y4Do zI|)W8{pI))xDyM=Cn`*conVz#2V-M6AKg~>tv;ZF!WSs-m;nI>Q4 z;HXk&0ZE5DWLbV<#t26Vf#s>g5EN2rL(NZyI%qfE(Fg>oCA zy9ILTHh-5>mN-5JvSGpMSlL!p5s4XDVy@YN!#Q0GHKSNKBxo^_dTWpG9Ba3=83Wx^ zSF;MjJ|PXXK;~0inGFKv*ff`{OXreiJsJgDvv}MDD1H=zXCDQ~*@)ts#glyD?OXPb z8of@Im`E9b`cjvQ~c;pGbR(#a$OhtG%+d>n6Ll zM>g+5r_gpZQ=IZyCR)kfr>J}lGj9=40U&*r4A^NI#AtK(t(&}!R|4@7XP0_vv3=*;buqPLFDi%mffIQGP^-_i`fn62*zdxb=U3) zzO-^v6{I}y_U|p{Jg6FS9#l)`Jg9CV=fQlc7MoJnL^Dl`WJ8!c@MW~04IAk=qx}P< z5}o9hNW`Mt1OdWMl8Ffcu_)t<%IvKz@VAvoABPI}lmX2D6ay%Gk zuD-?8Rs!tSvtUt|XEHQA-c@e`QMz+an<+i3ywiqH7Th~nX4!loTv`%>5a;T2*Dbj|b_)i$-BC*BHXfdo850_reUZfP;w`J=FcV*VMMmXRPc z`*8kT+hR-7whM&IOjCc^Mq$hc%caN;A}QQl!VWKjj>|-Gz0JYd7?x;cXnSu2!pG8M zRtXYusTo&`(iDn&{gkEa?Q=WX0Fo7Mb4htQ+XhP$teJg>N`O>HoEP(`zjh&q#nojmT#vB zJ~{3_JN^#SIEI}$syU|^D+?@HrYG}1YAsJY5?rY9M7GObXkewZcE0Fk5 zb90Xn@&u?6hUi2Rzs}nsO9B$jaiz1x=O{G9GG250zHO>)Bbo*7S#TMV=q;oh-Wzqy=jGdS!F0rNo4XO| z5_80fnjSN6Hj#*BLD|3~0c?b|f@q#-(YJ6%?^%<`q;^7(7QnU*GCo@vheXjKBiiW~ z7#S3ySs(?dxXBkKpIm;?AA`tCHV7!bpq73zZ$w zIypQv!8~-COlb9@oMX5EOHS9kd+K2;oCt<7o^Kd@>I4_Av+8;X#Rs5PD`kgygl3y> z9|WHj6eyg88a7d&s}nRL6jDH#sv)}1-$F4ec03m7SP6>edHyedQ7P{O#k$x4!DC7a zb;k>N)=WMXy0;X5Nly?^FYzAHku{m@Qrot7l8UNE^Qe|vV$$YKVk~slJ)NV;y~i)P zwn}?o!^76&=PsCnb-MVt=iAQ5^ zw$49v`C{zFBTqkZVe8V9(dwSQdhyD`=eN#BD}3zA#q$r_H!j!*-(J4-=wspMi}ob^ z3g=y!Ru|n4TsnsqK$muH7{=8x5i6G<$P4{dBWwZ|iPB$z zMfT_N-RMNBeI(;k!boh4RFkDP_Fq{Fm z?1m&gWR0C6Y}>P9FkO`dWxKEj=7VBjSVl1NU!pK>jIt|tFwt>F7*pAR+zFui#N1Ux z3C$$P)*v5$AOL%i0fY6tTjblpAEJBffxyv?$Vq^Av85@=&0<6ph5DESj;p!d084*T zQJzso%P)-(OY;puYv~FrPnD3q;#SA=hG?P$IFWii@WIk99JCIQbprv|!G{NOPK2&` zn~F`i@1C?Z;#3=9xdSt_%?0Ij87X%)Qm!gzlb&i>mxInSRJFO1yzXJSfhsqejVrH! zDmQDZ(=i+K`LLft-7G59n$TSVjdiT7H#8WOp_P;AjcU@n27LIXhp%4x?2Feoy>jN? z<4Lg(^mzi7_LDQzKiJLG&AFS;f4U7VELjUZI_vWelnlx9jI?~;g*42CL!CaWo; zVK<*5?FfS3@tMar6hM8g6TKc-QtkwvHyxBC2N?Y~gH*g*Dh^AJzK(Xi@D!xtac<;) zecU=p#4jHLJHB@V2Me$IGpo-Ydtfz2zw3%~o#b_l# zvLORny&AeF@XoPz#Q8M>Wt&r9MIlt|UBR}VPZv`U4^;{1fI1D-qlRZqb<3IYMxCWA z2-1kYq^Y0_+W2y>LmlS$3799yP+P@YRma(Dmz=mp_Esgo(J2O|fb)^u4&DUPgfukd z(~jG3449I5Q$TrZ^|RKNO01Zhcg1dtpkfP5>41y*s|)%Y#wn_!9CKj^N~@QLmM~lm zi5@bEECxES*p+Ek41!M&GA}s@?&Ch#*HS3V2`o9e!2nQ0Cm4Rz(L4sxmO35OqmR$1 zx`S#HE2$K40o}@xc1=$zGmmickcl-t8c?XA>k!Q7z8Me!=`}TuPH8!6)K}NzJyt3k zi+P`CRXHO38_>3hbFbf1XHRtu6vOM13+tqsuJ+7suB=a#spQDRK?TZjXwD!sb0$Go z4ObZ(d7M%QLgNM1I&|+u4bOnD1^cZLZ6{&^K|;l@>p-4$g5EkscMHE~#G4L@ zVB)Z@&FO4*9S|lpjO9SN$nDhTF$d2L%X)g_+ZG&#h{C#U5|U8iOfcEzYaWCJi$d zTOo_S-hzE;6M^Y!$N|uv`f^MZI?snF?tqWQQMVnRe8WlBj(LQC3@GxlK&rbig=NT7 z!J}sL(_`jss!A^Fmn*~xztNc53p&>;XQOGPhxmNH{y~?#rEcPvOZ0J=Rk2Bg$4m7P z3f@u&;ll;}Tg+F+`vryO#ZSR0?kI`wo@^5DbkrlBT;+Nygj1t~jP@B&T7|j;fL5%k z$XBF533U~j&Bg94lI$4+qDLk;^ya*aDyB*}PGTD}4Vt0t7v-#KP_!&7p_G$^?Om02 z-v=OOJWh2_lgENH`j~$}+sBzD8@yjjVol*E7^Uo}x~A1a&BRU5IZQFb{np*-rtsX7 z;0bdDR+fW^+=DhGF^pWO1yZ*$c};;PwO)=qHfDz`ASDJ^UyzAWgJq4Vbue^NMJJIc zZ`3Q-%yyvh)>=Wg&$G#uZ`+Ii>g|&d3Ut{0&R=;rSuihL48X z&f?uf&u#V)w{oFmdBWFcpTN6~MR)Eo1?$#X3zb^WXC*d+3zXZq>a~&7+o9NuAOlYAojY|mq2kniV% zhNdnr)08mW2YZlhUE?`|EkII)N)AjjQLK1?5=8uYpE{1DMabp!mgW{LHSCWu;si=~ zU{oR)=xWD7uw_~Z6H+rqQoL=XpPS^p(M_JP9t_mEV$>VV`ocfbGuS%4a!5cX?SQqb zTSr{ri6s3>T00)yMCS+|{a7e&ZFA0zn>195xN`rp!)MFc=cRNE4Z?C1QIp%F7&IKY z=?W?s_X z`d<^(tBl|?f|Skz28Z6((GS`Yt?x41OxZYXT_?ovW)a1sOVmA7d9r_paM3t$tPSS)GRdgl(1Y^i#lDH;~Zbd09ed zgE2RgNR%YC@4+*=o4=orr+XMvq=GN!?o!bK`F-N2OJ7=CKDK9JBAd}^8?P9NwoV^C5{5j{lL)jXJ^1a9tqpgmv9#D5^x*g zx-L75AoEm;>;$(C0&vQJZBl0_&d(a?cc+1XGkYp4;DpO!L|z4WN;oT{j=VCH{j|(1 zs*KI123k<`W&oyaPAGVGk#orr&K#4-sY+>2*aD7+yjpf#c_OZC$uj>x*)FDtFMxI1 z(5X90)dM#S**lc}HMm}?5QHPH#SGM?37SEy`X2Zl*Gls_T)?PAd*pH_wdZydtS4D`448L`q81;)1Yo>s|qml;X5$ zhY;C`Y_MutPwEciUJy}EJ@@%?hDc@JH*9+iGluw z){q92=>`I8p>6zJyF2O}*;Am5SNKv{PiziH1lc4(l_{eAT!LMRZlB>uec-l4I5*cW z;&qf03odTMGis#d@$*+}q*I>FCxK8ZAb#Y4k+%`sw0y$xhn@B<-=%y98NRX>eg*e+dmT#ap`D z!qB2C<}$tKu0i()c_wJu?mI{bE9@+%Ghsf&;>uFyVjoqw$@yeU{DPJqQBjFRUM9|} zq-fp_BU59w5QBjl)N(@AndAG+Y&d4BS_o2e-w0kgLSZvg1^g$}&=$Z1;;wK5?`7k0 zj!4gnQ|?3BUh?RMdt4A&L_ z>l_oWNvoO2ML7?uh!(Coma@0HWo56uVH|69JU#DIHnVn}jd!*rM+8BukL=p5C?aF{ z>PvoF(|s;E>zoN@3Ao3^5&)jKxFjtARtunFmlIl{j+aXjSw)o-)iG5()orMFVw*Lh z-GLcC?xIPbZfnhIXQ8GqnR_Hqhk2{|poXKd?B`1>zmKuw8kHnAoMipnDIH95ib6@w z&kl=00UDgk1g^+iYMr+Maaf@2wFL)K5cIC&Nx5GD|5U*>fw@3OhI$n_Z!o+Z5;VO? zRLBJq{VzjiWs+c^@7q~b^bnceR*9Z3l1xweI*N`a!8$X3D$!~eBaC+axb$!4I|k~DlgGqUHzcA zqs(VMm+oBU#b2^Z99EH_w`k2m@az&8lA0H+LckiFl#lPq@$?=$Z!lvt zdd~@Wl7SdyLp&wp19ptjzbbPHSAd1)oOqG_3v(urHXID-xItwUNh|N}c01_`^=v!q zJMrYrl2CG`OnL6Yz`7HZiMQee(b2UYN3yqB2+2-qsD3U0dEF5k%deYm0&nY7R1*P4X3+G2Q{ zUB2-U1tj0|P>1fkUVv5H?^l6y7c;SnU&PZu_0Y?QL?>LQ@zSE#b9xj~_j!Y_!?Wne zOH6@A%kyU;o+-UyT9(d|PT+NNvfSh)FUjO>xvpuTvZYg+;}pTr!wFVt-{#FO#jb}_ z%X2x3&E=e36!C9Zav~B33b^C1faPYyLt_B5H0F?b@D<{&7>b!iJ77K>Z`V8F9v^2r z$9MD6n|Z0d+^~ahCA;}cb>@R@+nkGh(R_wHq!jbT>Nn1a&ft3Kubtx4N0Av-a`Jc_*;FFa8`y@khSdsMeP^~19=Nk^^C;jlW}4x zM#t>z4zW!N8Y5!NW6sD=4gt%mDmBvIq{uy>#-0V__q~>VzUi%l=_ZUAyo_PJ;5XEb zzgzH2MhZ_BW)#82z>$P2i4W%*A6&7f6nUK`mf*@C(h04*Ad&G|QpzFVCU3z)vg|n?tW~Q`|yPbh1k^+-)TlHLmP3bZKswzon$=-*MA?Mu;eyT(Pr} z3N3f<1RsH?05!r>0&VCs94wTsDBOIQXAq1DXlZDpM71-{V-)~^SgXS$=-dc$ML+Ki zP=In8GZsgb6H6UWbh+8L6a<=*7Ze#hT~#m-P!J*pFi>FIE~%-HR0 zixv*%PALBf+Wk4b$z(Rb{szZqS$?kDPR{R4)ea6hcDwC-j@>@iT6Ayt3KKOUO_x<9 z@(6J*>}fSD2BtcVZQcUi&&G4ftsH5upYm`KOC;qYwv|SH_LA*-m;Kd{Yax;yKUMlT)6_F?)$L1h4}jS(I0YJY2wuNU<0vQf@yJFd_jH$kt|; zs4B=LKv2DKp0pRFc`7uOFv?xhGxE_as>D5_BHAO#hAAb!GX@G?8*Ko&C;&T)pF9I(a0Q`H>m5kC8t#zcVA#Fh2zHikE6; z&Qi$Gipm?CP7CTQoHK#7b0KtK)y>9Z7_}&14B2HRO>Ry}#iHP>npuYj2|d1Sb8do% zZ-K54Aj(Qj1wn3t3@s7e(~{#>IfA*Gm${BlP#BS>A1}rDH3lnI&-qe9O;h>kL@+&B zxd192mm0Vnr}w57^VudJy7G?O2vkAHK0>aF z{19)(UGy?3>(=?jG_C1+JpS!C|8jh}Zp6hS4#3*g)1~%LQ`!XL01%h{j*Jy#3(`x{ z_F9_bnFVPy^y4`ryeBBSoKAmQ&%k~=Yb!}IB$QT9fCdnWDIiAqK`b}A|6*xnL?3Z@ zy?W@;f@_`%&BI)R_w`x3Tmrl}Zt5A|bPS|tiboRA2NsfgGI}zF4otOB1L&D;!|4kz zpwsRcgnD?hM!+|ZKYe-Y%Ec}7yDfGOyy{eRF4L|sbQnCo*WngGy@Odidc0tUBebVK zH+hhndAB|arbgifQ3VT16f$F5XR=P>7Q$+^LH8WN&jroWPCXTrdhE&2;&%%^ z8KN}b&UXunDq~6{V<7FYU|s^#JKbwSTcy!sT-XHE%fg^FA#}!(4PFwn;;q^gck?OG z(wzVb-+!@SgXyBTqOX0b8Lud!UUl|hdkM(xvPiGn4HUpud(O_PwnB_}DR%r;g5pl0 z>oP#CrS+ijWv0J=$LSY~*ce@Q-Z_ul?afoKl-~|d33Us2Q0jMh!Xn(noHTPNk6wm5 zeYcuz`?F>qEXm?R(Iu1Y_|AySlxj}Hqe}(X*#&fhr%W5;BeHp_7=P=@XsGNY9}lt~ zam`0UkVd`S88p?0lEEd^3<(vnhvO*+_dupNCpdbl{2<(6?h?UO8gbBbj~CDuS8%Dt z($fo{H56Nv2r0~G5am0p?}OlBV;FI0p^M}PhB4`T41Rl7&oYHa?D1>rWbKG}L&m%U z;g#p=ioz`KoafX{&sdfs8)$(ae;%u|ib#1)HnJ)yu;r zHr8!%_QW;3Y>SW0CD0qW5T$qea*Mt}y-`$$g%O>|?Rrs3qkcAlSdZ~++U3Ls;C{ns z4hScjL!mj)#_;*;Q!^k+x5Zj0h<{mF`CYF%H;>SVM#xKW# zNapxV`?uvwPVyv*3FM8BggtOv4lA|~bkSonl+0jTCNLYoaXBLGmw9nBKZ@{#MTjpF=VplqCf#lG{dcr(kMu$zzeRpXZ&72nL zPOLZL!k(~qQVEHzD-VVkuNsnYFIce_i--P=l2Hvn`r)Le<7}j{$|I4i*%Zs@Uh*R? zVvvd+;hd`^3(~@*Zk6d)WF5e43b?UKeY0aW-5_yFoLT}?GqE^7DuJ#x<`&8m2R8Mv z#M3ii^mI|e%-JJwISq>K%G)FIaFGlt<>mq2KZzg+?1W9T5g3W&Oo$qe^C!;f@-%dS zp+^e{6cw7UweLp>(=lz!jxa6l^l~X;wac~*Z%dtwg=85wMypAh1L_k*h0g90{-{)w1L7QtwtYB<9^DU86cZG3oMQ5>$4OM|BxxyB6>3nM2W@npG z@$8JC?|`+wnICmQFDb!j7(Gc@7>C)&?I2ZNL^u^z>G~Y(<@r;c8c}gJk@d%pjesif z@Ie3KK;m88okaZtA>p~fK~5-e#SPfET_v#)#~YLE01#)vT>}EWojqKTWI|dn8-;_y zCwf>rlN|LVt|zcWh&<`cq}21qprhzg2RFg-CR^(>1wOT|@V;{KktZ&B*s1iy6MMGi zR`JA><`Z25KG0nOXOLMoF<<9QigT4Boscv~dL?yW(y>N8mk?aZea^%DjuV1dl(Z>~ zxzKCr&l3_}FW3zPJi;a=;Kt7yqN%~FIY>G$NS~nm%V~Sp7oA=Pb3hN5v%5K`6ZUS2 z2is?CQ=AAEjzb(hKRRNs?9eS|(InF~n2#Ki1#msZC?5c}E5R+1qd00;>tl#_H?xQV zUY69km%?)M7`^bM+%g=f$G;ZaWbSM(X!lwuz_FrDaH%vNz6TD%!=aX}pYpTd%Nu7MUH5_On}VUkbj52`)#uvX>B8dKI8FD>MQ2+iKnq zji(t1HvIJVojhDpu9V_2&adbnHs^W8kF+l{|Jx!EX?D-lv;0aN5^N$lL zdM&bL42tB3kl75feC(F=`D98CjmpDTBgfQwpl-JDr0manQSJh(@FpFfcs>QL0o&o= zhSfVl@;y1Ma(9KPaRfEsKGM~Ye5ZoI=WL$EENk>u!$MKHhyF5e!$V*WFA#$o3+^JG ztP9Cp;U{{J%;)qNlnl8B!Uh_a9x@O+ZB`s^LyA8Z8<_8=oaW{@3b#p3qnh5*|I!U_dCnQkg0;_<;Mr@!!V+SPcoZyjP+fdTqWg=EXDox<{$Lpo zRIAtFoI6(QB1cR#zvB8U3H-9DBuJwk?>l`mqt#mwsV*?+fb%&x(keUas^I+7$w947 z_RvGa60S4&NT;QNhl*y!QpD9$!wp=i^%@(`h;hgv#Xrxdy|~XyQ3+Zt<1$%rUJy~D zUUvzCEuYp%tfyDbUA4wvG5iKd%UjxB?pufjmp2GitP-064cJo*v@>1p7ZY<nwNf(tS^w520cHxQE!f+x~2E%w{pI^1%+d!@-0; zJA+i(JmF@I(RsZ$DG1`$un)MqNfI|@Cluv~J1yzw&=u6i*p@O05WOJXV~?wH;w7mS zaA&vp;qvNLEq8W`9xRkwUK}ud!&8O+K2;7GPN#Mo49)e92=o{D;2lx2qxvDXJJNQ@ zLl`3<-C394aF|SfN(y!?nYXe;Fwz><4UTeK ze}W#FxBuUVneJZ8UoT#hb|+pVFJ)LMKaSQLoPwsBYc@aiG+Hko zp#{~3-i+>Hv{E{F3+jaP7gh<+qBVMlbwR~N8CF}A(MkVY=LWK)!>ZH$!UhrZGo_0RMcC9;iyY^T6*=Q4FZ^r+rlU(|{`f5FQwdEgvAt zZ-qxnrHKIEqX+4pJf-esNCsh~0%dKH^zq1KN<9T4{~6*p9uGJpu?L(_fVw@i6z1L@ z9NF+|C^BM+M0kkAznop-2cf5m-ZM$9ar>~ufJrv7mO=WJw)WF&9pMbGw`-jLrK*~d z`atvtjB??WVLCAva|`=QSlTgi7T{}jb6_T{5d;OI?Q{4Rv9_3ZVmr84;rO=EiNCOB z?y(l<0^d$fZ%o#BN;61s9mI~&_)*KB6=oB^X@ywgrrBfBayOf7E8^-uh4kc8m`~H) z$Xqt??dHk^HI3PYF87FdT5`SI3^)W_nhIA}Im?SaWrYmDXJUIq3!1!&D^+Vo*97k`l5z6 zcLr*PBDcnt#6VT7+93Id8}@KW^S&4261^!iHF$?R^^wLB@AI>!ybeb;1U~Xysp|9asHk%DJ#$NKZjlJ2cY` zwEi&zWi7QS095vLsIj@_kvtk65>?|?zVWE+;~S6GHthMDakWL5Z8B7f$w~Ig0e6wh z=cD~%QjTyr1HGWRE_Tc}G7rdHJ!{SeyUT-p3NwX1axK(n(sk7CCxP{_i-Pd(MO=J z==Qz2cD<>yFdhu3q&Q{TM!JszlwFf+$*rVqZd>Z+BcLEXah`CT z8b|vttAYw{S}&+`pPMs>#W*u!i_9MVGBlxS%G@!S69+NxckG>aDbwA>dUe;ONg zX1z1Lwk~cQ=0f7f8|Lwbdi>U5(eIbj&G7F|G8>ERNOGTY{}jh`->$k~A-o`G2-I%D zOai}R&0~#{uEdU0TsNt9c6>%dyMFP-4OE(vW^|K_pn@hyMqs4m$=2LabcW^+gFO9{_rE?LvgCVIzfPudJ;@wC)VLb2_r$(f;U zRYcaa2KuqY_VO@3EN;g&5oQ{<*VSTJ82K5uhIccEd)Bk2gW+sfat70Y@Ia`HrvbnQ zTrmy!8Aw~riaUrgK}%a=+<`V-p)>H`OC7R1I}46XJA6*I(ctN4I6j;Fn}cI)MioRj z^9UvB*;)#8uWGkjI@49-B#rVztFDB9n+pKx_O%YVo;1$MdCFImSvwJs#7PFcTuvT% z%3j4(@KQ}xrXBCZ4crLq<;b}|C5-FlK#s+i&U)>de#cl391ndb4rgdEi};)KEnD{w zbp(R5O9Z{^%;^L68WWOGFOJi&6+5;haH1|cbEzJ7`BXMC> zcz=%=QV;c|W*be3M0xcX={%cEi{8u}4pO~K<{#G)$50Tj4mx?!#9NokiiY9bE^^8o zn_35F-1wtD+VtTH0PJPFfxbe16l@3!>;m(U?>?VIrBqsl?4t3fdO@_4aJZ^!b&6JqdsC-_KO|BoiyJd zV}VCHTzCrDg7mC|+z`oH>ACdBo3C4ALF=m!61AuqdI6KFLrIqAR&Nrwdh5(85KhBJ zzSZ1+)!rtp9nA_*ut;ZJ)@>#F9b-0l7x&Ee$w+rdiw?GQH$i=ufz0l-MGLD|jZ|1F=7M}7Eg?z15+Ze)_xLegKP0;`gYHd%2$OHgQL|_cy9Al`SAT06`_z;m; zU6)LO)L12Fe=}i!ZqcEPmF3jT>a@4#X+r(zH-Pt;RS2%7FGr3JEG)9R6iQoJx?Ps$ zn2p*xbLj+P)^?P09%Na|`<2xr3#iH^%)mxCJkcJbzos?}3apctLb8)cjv!^Du zGa7A4T};+K*~o;?-)R$tfPz2L*76(dijjhf{hSbXU9vo-c}LfsiRc##Ye}-=QZ?j~`W;C=;GPQ1<7G-c3In_sE_0o;+EAEK1rJ`1SrythB&>Giw zk{w_~j#MMR)7HKrCHouoHI3%5-CtLe6@>WgZ`jq7BU6m_%bSvnOXoqeCKEY|i@R^6 z0M&UAz+0?ULhi0UfJa4a03@f-hKQeDBkp|pZmVxS(SF;qKbu?zYqn*~_SnuHC$V_2 zl{eTb9BhZB{@R$Y9&^lU^;81IJ2DfU*i1NPO1T68Rn(k#nX&!GE1^8wSatg5 z6}!Z4mT9;#;g8%A96=Aj(Lg1jmdJ$j#s~HEIoHLu>Vsih^K+fvqNvc8}5u@kRRIxT9* zMS@Bdu{czo#eu1ueX?+0__&L1_E;Kgz1wBtWgAyb8;9$=zn%N~Cy5r#|!vY#< z(;n>5r@juL0+B&;tqY>fVUx$C*hSEZTQGUVk&NyTVVsse6p{Q+Td3XuOF*>00teuj zD*!s$EB4ECy(2kVqXYSgvjnU&vy^AzwB}r60XisE5vyDLPS($sg(dPd*$x6ClGy6} zh|@@^Sh#>vY-5ON>C`-=IYZ^jpex>+x#k1J+#xxgH&9+ad4Gr8G$FY&p1^I4cFVTS zc4A_)Mnd->hn(f<2^#Tv9_k5n6Uz(S(X;WGCT~z45F%RMHe1tl5EN9EtB)&r$W~G- zwB8Y0zBy&nJz@~#yU(tF2P<{*v>idZz83Rf;N?Ya3E2w!W?CUPH)uvWkYeH>hZ_>N zw_Sz&a9oZs`YHp*(3-=N@>gPaCDRQ$>7=fZ?}InCfW^Advk~HaWR)2^lR3lrlN15A8nY2x+?lBqWDv=O1_R=HL8W&G zL=1%_;t@7>1d$UL5HCAh0qye6tS89Xbj9f0Y&MlyaOdq#uVYKI}GP=?()lhnqn z3n-Oz&x&Y~xaY5R5Qb%BruhyI5|Uj@q})Lb1S1BE;R49RxU4E5X;xKGGG3QL|H_jU z);|@Z09XNKhL|?sigVtQDmie+eyFM9ihb-&ynD=&S?#&LJ=|02XuUYH6Yepr48IbT zWO=z@9cH7kO43Ka(iUP8fTacg^UU=Hz9*7CFSH`@bzJj#hFCN+p>%C|s!BaZp3jh$LG-OB4%BIFXvHp zlZTFk##+h1@hHNsI@bRg#lX<50_cQtQlPg;g(Y_tbK6pC%svY>5`4OQ+7V&%L*-Cu zcGY?ZK&?Ibgmu{B-?!mD@LfWc!xqdLZ)6ZFPIuRr z+{cHWTKCZDbqxczv@?FyWKON?j6H*@-fv=T0{sHPXOPO!@X7r_KJjhthk;gho-(=S zaw-Zv>n|Af^0e)q5A?_p8E1hCIqYqqL+&K*eyR1zc}j{A(X!_ZyN#YfosR%TbWK1z zd>J&+(G4+Q70r`Cs-9rJRg^cxMs4`9Q5!4gE|e29Y{>fYxC&y8gh+AlDMXh{@KP39Xa+mFZb=xoku^11u%10ad|96ss(i8>o3i6v+<0 zF8zdQuT$p81<8yWM`)XczV&5K3Gx zF&U?g0TJR=HTAe2Mr2b)a_^}(PGf$gauO!3B5WUDS8Y^YxJtsn5O1y{wb;Zm5cTCD zZH45xaX`0e8B`~S_F&{l@#btT_Bn8BMzzf;!ctsv4wM@Y&(bhM9}Ch;F4rZ3# z+hU|e@Euh3{uTFhPF#hqKyZZfzU|{tKDEt{Ks7M1(tNDxtOu|IDOgK65D98Yypcjv zv~9s*k2Ey45{4S#7W?W7sJFL=&<-5wCnU1wd(SOGtmrs*aF7bXdWmgyFv-UCO$AT? zK<`v#*1#F2X{~~JLZl45amX)C!hi@}Q?3C==scqadRXPmu_vJ^$Zji-4t4#*1dgW> zLKyi_2`X|^T1#;lMc0W2%q_j5M>^?j@c1}R5X>3Sk&Cbc!ft!SPmpe9h1gWF?dW6# zg&^p%;<4fw=1kCt)<+rO)Kef=_h?I{p8BI#|Z)_!j=c19S*wy8SccP z0w4S!o)1%OzW(iVDrU%Lf9 z*AXtN>Ue0MKFX-Z?_|>$*Qu=8e*P&9(G&RWIpLfXc!YAhL>o&WvZ6kI2~bwns`^;L zKIX*2c?ornD6+H1bMc&Iny1|xPn>`J;@rX8l8@Jl$wmmqNkNHi?F?W(f9m{&&piKV zy)8M%&|1=>yTLFNTsQ79!>bx@34N|X)-@z-otJ0SFIF5>-!_?fVm$tSvm&TI! zHl*+**DVWv9q5U@(-2%Y{8Vpr3i~is^>Y$R^T0Qdd#`sn?>VXr?~a0Yx!NiInezN# z==|d5=|l8=^cZuqj-Kk<#PE;eieTh}J}1k-FBt&CLTlND<1ivFPh}z7)5Kz52VH)4 zmSZD+_r{YPzODD~l9fc9t0>tOV6-h#1T*{+a{SJ&AyyjflfKiU{i^b8f@*KlEFuIZ zewkYD+GLzTlJ05gptd4gWUMgC^fQksLB;@lz!9xBD+VOv1)X4C_SX8*i*=;8OivQK z6EbpVH+Rr#Fn4wz{{mIDiVa;89iF|T zv6&iJ+e$EGDXJLr)ezj7>3dtrko1WHZ;o7dVPopD+h1P|?zMkQZTDz9F%~M76nCIj@Z%-(E#MR?*q`Fm0 zIN(WHPCcA(|1$EY6LonsMrZ!>nTBFYvqs$r$b=eYc;lNX+yMrvL&@XIo18VMAUFg8 zy0q&f{jX-*)K{<>rht8yA7ET)}dXfw+ogH08k6Do)R zb7-=*=_b@7@k`c+Gh1 zY{MY5xj^!-Av}CnXP@XS5!20#(mQYxQDC?W(N*Nu= zocdhRyr~e}0jo$&7sVg33e_FUGzB zlS}>b0I@Bb8{G7~iM$LzKul|_ZHMoCc8IH^wP;`r?WhyDRaSLQx|_7FmYsN2WQZX+ zcT$Q?%4yj%JE)#d#3g9csKEB2n!I+~(_o;c!8EW+IV6-RerjEQ5wROp_?4%egQ4=i zBn0+u^7IIyjgPstkTbJbP7EuGcLd35NJ?2zpE#Vd*|cPUYRc<~)`ffoeswnLGDsDs z!5c4-&&V>196FD2X}zTPywiKwkPfzPug=Dlroq34wU4I_ zi}&>Z%U!JDy&7DrhBr%?<38S%YJCZ!-QfMiwU9ZGrT5KEk=unASvaatN}swQ4(zSV z0*ig8MASK?S*3)_m{cnt!WL!N5MP^J<>sO&2S^+q5oNS|5avT!y!I$b3YH;Mh3>uP z&LQl`VK%vG;X1exXMhgil$1|q^oDnmS|1!7v??Q6Ap<0!IP-AJ$%?rm05>4BZo~KK z<$!b8-Xu<2Wa8B*BU=k_`u_Xc1m%KNupzbo>xqeyZ4#W(3N%szP+btRG2M@qs)RR%9sfU31MN)b2n~y5yxb$p=4(a=^i(`YaAHB4xyb>jLc1B zQBSMH1!u&7FI5gS6&Qw^(KvX^LOZ?Z+HlHuZ8!y~rf^Vmy^odB)%rIGT)y*5z`apV z*JEadDFX=N;{AYb89hp-Guvk5iVkPNf#^RlaZP)aJPpMYTock$yXY~DW_2o1$iZl8 zCG}9|QkZdYNJ7CBQwHco=QhZ)gi&-3Iw}JO*e0YK<-3?=CY4-C0pOMG*S6W52Znd3 zI&O^>TA>SxnpGU;n9b>Oy6WN*oepekFU;pMFDX#y-R&n+@q_$oP$S5ZqnV+Kog-ed z#DOT!IXr^CT&jY8NSuvPGPRlN^G>SK!j!V!%iBtB)vM*CpmbN&^r)_<)y;Jw$v_LN zH$pU$AQCAPDo~xlvbNw{*A!KI5NQaH%;mUz6c=u<5kV6$s2G&CukGCQp=%(_|gysEeWJ;eXr#TVMaLfeeIkhrSVT1(W z-w6+}Hz}*ii3p1V^l3q0{(?2a)UCGy3G`e(DN|$;m@Yu5t#(}GO?yC?=NMULk!8@6 zBZenrG405E!4e2bxYn>ksAh|$??smCM5izNjQ3~5aWLcXh)`_N_`ASaITq)ZrQ5{_ z=%0RFzX2aWMFqd_h&L$*KPpaXlB<>EYT@v3cSVQXYbs`P!uGXD@HeL>H zf&-ZiwGCsNLEjBDPA*b}>MSsj)T~@Ficz4;R^jAsQ@nt|UqzTNtj-?kktWOBgTN7h zOnw>F*m`A6b3!=kLu;(7lM3+X>b|*gY!_y1UyW|dBz=t zAdeEvoz)KrHiGn|q{dSxMr&W`aTjVtk_Z9D9 zt3ioeIEhQ(Nq4ym&ZF4{c=b9kuc!(wHKUGmB559zFl{A)0b3K%giH}SNEPAgT%zl2 z2se)*J{Igb&}3KC5b6yDa7#FN8*$FwaQ7i*Wnt!oY1uu2P(BELUk-kcg5P7ya5?W% zQDNCD)T%uba@?doi8Yfw)2WA2@3S5o=06izkhe*IqJbLhYF1dmeH*5FCr1NH)=xk> z5hWL?1#N8jnM4tCNVUSOu;91!%Nf-9?93cmhC2jV!+#7;sgRP{{3|zGtPg=Xz#j1j z(0pYCo;`AOcMT?l<1t~McC-013}As%${h(A`Y8t+c#0qIEVWMD{p^WOdctSGR;a5h zNQB=rLN{9I@`-i`xymW+RX6?2)GL0)@8O!?!&OruTmMR;vvF^^Z5g>M)Hwv=Y21tyE<$_LPnH{mefD|cu2t^lqwpFsj< zZ5_1f_cHLxIJ9!o=jn`2S|`DJ(Fx|tuH^)Mhs zX_RPGfAag{U=*JSP0b`d|Du{OsNgKlmzm)5tUp~hJL!IW##(nD+}l2j|Mg~WdhOCY^Px+gPQ${6XVW~=C$odr4UmmSa}+a9!V3fvE33ouI+4U`YoZ4WV-2^> z)tY#g6|u7r3L7oI%Q>lH3CEUQNu0e_@n9W`Q<{1n1R{~b960*zU^F^G4g>4KT}R7A z*`S!t=pGwp{XF9SY5U2xGwvLlfhsE;k-~ciBRlL2aP*)^8Co2?+bZtO-l=%=5a-}N zIFo=q-`eYnQKVZUu>~L<>J|^e1Na{WJ~Q^3Mmu2(zphk;kD)+k!9-bB+lzmd7Nw6}rVRcTxEq!J)aX z)iu}BEYynJ^ze_n*VDV#SC}VSU485BbTd6X%f&U{MW0f+<=QY!;9qO$-D~C_>x&y% zx_ZY2%2@8M?r~$nTAq*_qlYU)_fB24hv^evA)`S?YIuAjiKr>|bTg3Y`|S}d#X zuGvbX{rV88hWp^}`zEE?MbpyO#J}hF;ncmSp;5-+Gr!)#ZFg7Ocf-H!p>0)dVc0Zs zpU(8uQY8!W1SYM-C4VJ*&)VABb`Sm=tLOA`JS_s=h66?r+~W^f8!nt#L$0?3L3R<2 zf)IHtc0cNq)5`(9>_Vz9cDPeYVVHzLzB5hDPNlD`Z4q74NI7{xsa4XjDIkI5fmn$P zqJ%@^)?DQG%M%lm&TGQC7)X{hivUN5b=WN9w`m_KN4clx=E^oVpa zt96^QlEu&aoPI}pl5%wmvm8+4b%|O8YIbj!@7>_!o|-I;T}{N6XZMc0Wza%Fq%+jD zkWhJXGq4Ft>PklIiBQ`*_F!nd*hro`!+9f^6RFm%6@PVIoTdw9-^jcPCj#HDCBzd& zb{fv7na=gjGwpx|U@k=r1+D8Lw11njwz~Oz`H+1m!Oqc^$*MP*?#X^TJ5{L*RJ1l z@9L-VuF=5%zKfLC6ym{j4P$9K=ekHcm}@#i$%ixWdTy&s0VM3Z`HIzXcji?Re9Rj$ z{$+38mlDObsQLc9O8Q1>o;G|qnA`90D8=g-&#Pk$vdWAu%SEH8=2cXUjYPb#irKs> zYAkKMj)Qr1WP`CG44emaQEv|C)wE~icu5N}Z;763s>I*zNB{$WsI_>F?qK*^KXyVf z@m)DujgNb&)7Q1ZUu+H_lRoE`W7RDwU;Lv_F&@z!l(sO1D_X%25yyPl7I)4ufaCN< zv3|l=be>31S5v2rL?g(c&U|v5U|fTt89IuCyRN6OHXA?~Q;$QKjrbCQyDD&_QPpB{ zbd2`!h_!Gq+A@%EAchN$?dvZj2@+PuVL3b{t1=~Y8)9!Q+>6YY+73+qLH~zf{?HjT zAvm}7M4>y?hZMVVgHmciOv#~HlKoslXvBcX%W(I>4I6CQvTmo>ZrpuvJ$5LH*j=>I2sutK_Y3*_+zKt644h=I+7WtIK?cZ6h~W=Ui;J!Uc1E*XmAm>&OJu zlI#???&KaP>l+4ADZgvp_u%q>Gq>}ctv+W*;^sM9z58x?oS;?92$7I870vh2gY(|y zPY#AlN#-0rgV?si@q`Lx$< zGdJ&f-PV*Eb4O^YMcje??yHfV1mghGT)P?7mT-(KQUdBqhb~ic=?D&Fx;rUn<0|nZ zKtnz@$norGo!uL5#{iXJ=ua={NE)ypU5QmWC46vtX_^m1W>@q!g?UGdPc%`ppNYl# z2$)o7Go`!9T>jM=RFR5EX#~KXsXR#4>p6L%FwUDC>XdhO!zC1@Et0Um6ZUudn&^I0Hpm zwg>Kl6%({OIOI>8yAjuYlawddH6MgVdpX5_G@8pdDIN^w!ks~-7xLmGnylyKI;c$N z(Y|dX<8tKpuEycwoo)WX8Q9T(^q@3XGi0gnsR*qq)^#!aN*2utWqDxxx^1O{JemLI zh%YnffC{6U+cV4-pAFz*=*JV4qsIW;>;-BYP?PigSMMhKn75zS4e-`Fi4f%aU3ge!BwsAzX(D!a$Ln zGCy!XnR^CKVdb*{;Vsi}!8i%Xi~H8s4+toYZcp3!ZbA4&p6e62IWc4?5&$Znc;#7J zig`oCA<{PWmar)fG+d$)9g-MUKV?=xf)LGRSs$DEzSaxj{Un7e^MI_hi*fUI2`;eB zL9c;}TsV@LA53avc~i3#gR&xxlv-tsMmw@X3Tei;em*T2OUe-`HvLe?*G*UP38F;0 z^rbb$ph=$aXj-Z{I-G6Fvpz$Yml>!WFX->c!vL7oo?#sE>=4~6CUj1{4IF^^jXXaR zHZiucds^N0-3P6^t9#mQm!N@)PAs2k<8(PPL@bo*YnPFrN_c>oKF#9E(_&O&k{>9= z0*;FfHWc@-t`ytoim!ZIA?F(=@f2pFD%$8If`5!739B)EwiSh)I5{WJ@YI@mWkgh; zBQ&zsiDrX&25q=*OFU)T5!l58Leo8pE?GOvT5h(9+fID5^Ufg4va!pDLB28q$OyNU z^zlr3l7?*NivDrhgR#JtC1)_7EZ3DLCOFl->vyWZkrDxXJ9yR*>!?IDb|{d znBG+IGtN{E=DaE&>&WGZaqm$Iz>>kz#SW`tvr!U-WV$+${H@N7U3K7EalP9$ZFal- z^WOFA&1sZW!6oCD%@@kZ=T1I*rh2i=(WvKi-BF=>!TA{{T~_RRwY!LJ4x1wzh4woy zK2rC0QEFFg&m4z*5-c-4vkA$s86wuXPLtIXihBt^sbp2TkDmX!1}|V&gR*kuBdwpg zPEzd^J5y4XFzaEr4Y=6>3@GaJVdP)72B+ znsyG`ik{+xhT$}pox>~ukpvD)t@%NhEbK+w=v_?<$me9#YYS@E$l_k5lsj0;E&`f@ zXp^G@cL!yPVzi3hxh(sJ8{wM8-f%ijdNI0ws}rj(4(PwWJ1|h%`e(a<+%RhvdsG0s z=#SFR_6qUmWFT|QJ}_)%*U|k%o>~wglC*4U5gJEHAdan!vPGM}>_j_u6_UWZ7;0FY zcJt_xRM~Lni`&ru%(n`u>%3k7pn@6YOLv_?q=p zREnjh@M1KE?0{K-b!lNB^$_6GEE50iFx5kaf;bE_7R*cN1R#6acBQ|C-)ZY`nLEmq zEC;h`EhEw4a@2xa>y<(C=E1VB$LPisHaJ`CZoelRwXSTKzI4)~Tkp<&N3jld5=iDa6Tn$QKsO(4n>*PB zjkpXIAfg*G(4S<^b|-nITY{TKDZeWf-Hr+bPVYzkvArRz3}BzS?ImW%(DH#dIq+b~ zb*hFC;Z#ipv51&G7CykpE*kjbAE)p%Eq|Dr50dYAdCXm8s@)5Fw6|oJ_KwWevRw{} z=3~B07y9|G*8}r=*#m|4op3%ZD2L1gx#bxVav=%{wx1u4z5bZrOZLa{nZN|)Z?9%! z=okFO+SSFa?+nUv;2ar!q27Y?5+F>(A!-6`57I+&pqG9w!e1oR9yaCLLFy5bGvWx*QRr4Y49 z)2%#opCznOBZnkt^4ePWGz5#0r)Nt9NflCes9J@0OP&6`nM*clA2iI?mfPI;{;{VY zy?Emt=PeRU!Wpd^sUN60o(}rq>f)2MH8f1M>8L`^8L_^Kz>uX^b*4LKo#J0I|S54{L?8GoT^txbv zBYik-8eQEr2{z^IF2j;j;n>*Wr8*X{jzi=eZ?j{?=nizO?C$4C9lD8dEhrv9xQj)kWn7a_>p(> zw%*NnsmOW?XsWY~%RIc-a-5hUWH_Ep8BmXC)iTWIB=c`d^ZU+lG|a`c6?e1DWSV=V zUk-yV!K1WwZAj1_jmo@Q!h)#i44FvsWL)L5e!0qZqru9@?V%39dl?(c)Hd@0iQX5? zdOcC5yR!@gh#X`Da$9EDO0XXS3XhLteip zxkd7bUBn%}g}Z55Yr#Q0`FFZa+3Kd=srUpV)9;0_4fP(Zchcc?ZLQZGP?VvWuNf`f zt#ERZ=57sP8!dglsk$o9!;>P9=Ny=;dBiS2=Vt|LOe7$+VMCrth$(@>7MCfNXXMC& z;w{hQG6M?L6U%ESUJ|*^RJs@T=N9C;TbJspXPuVWK3H}}%t}l++hC;erAhf3*q&~e zn1>3V<@G&tbUnAVwx-^_uuHeFwvF8jRIU&BD%S^A&RrUffs`70^5kp^|9r#(r`GhY zd3x!-C+pq}3u@%k(T`AKygb}B-BXlm%XD>vjh!QY(>53YMHgikjMA=t z{HYpI7fVpH_zjHGc_YfemD611ed~i3RHKa;+C*lDN>oEOq8W|hs306lQtyNVw&}_W zNaZwh&U-$F8V3Dy@g{)@^7Op&R7)4eV(0bF=9W&Q^s_XbWZ5_MQ_?`8jlYI5J z)Fq^Vs!K#a7tCgaPqs;n5P}@2geXLYatOfyF$JthBNgXuBEpz!19*Qj9thu8r{)pf zm>Z=pF~uEcP{c~ftHKpHPSvmhoD~GC)=o*{6B(;Y+=r~)1J6g8s&JAOvXSsTAf}6B!_BZGwyp*(0jakO*M^CA zv1f^;A9BQ7?K6HQiqnE+qv@#}b@ApWw(~DBwjgeNoo~{4^t zIYCHsg4%b1^JE|k!K2^^)RoDK1km#dHv7;mUVD>5M5Ocqmj)DanvkGC#s#u5#z{s> zOz!0(vvEJ;N;-szFv<6e(u~x)FxHd(ydU;r`6|o~t!m$A_xio`s%h>;#}F16 zI77lyc215f^FvN>vvZpgVmo)iY{)qJ%GgMBL8R3oEhgoct>n0fEbt~NQF8$BK#KTAH+WQ?_Wdtkf6ywI_TeGlDCM}y*L~lUr-e@R+8Wq6DsQ5rC zZqA5HTQ_wQ0}PuT&};(Sq$D|U*;Gqrg1XF51--%aAx4M4`^YW&ZPT`%}!9@Jb7RG9q+rv&EmTtKx&3pI)F|9Rm zS!X>$#Th|s)fryeoC&F9#EA^b?q-v1P)2Z00l1~NF6OLG5N6+z|6Foz#a0!YOU z$P2{+zccn2k)2qnaa>*>9~fxmp3G}%YNL8kA|+4-)c#C8ZIigwcatYap3Wf+)Kh-U zT-f-a*0`O(v{l_K#$%1D1pqqcOR*OX*>Y2ZIHFzXIy1+S8fQd5q8sKs^ zwoIu*sCOH3$&Ovxu`5LWbgZd?_ROx`t08WVf>23+$A{I2U<>mphuNk#J<0(OjHCpF zsFz;{d86Ffsqz>?voe`Oe|Ph#A|A3uI>|84DvT?)RJ{haK>80RDK=<}Xp8mOq<&cM z4%Awpe_7&XYN@epG!!dzWCGJtg*pmTI}7aFs5h!ySJu*2w9}#D!W@vGitxw;ADE>J zK2VFf8OZiZmCFW-PADnE@`a8T)LC%MYFZhP+>fRj-8wqjF6Fq;7a7=Ys)kgborD*O zmqX!~T5WTHmKBYX^A=DEd@$MWW*YU?C;nb35Zxr?BAgb}ZhWW4jOf@CfA;KUfssY1 z5xgKlg&COMQEit2=G1U#xO&4I4vuPf*v@Pqw;23Ww@|AO2uePIJ1Fnt z{q5L2`YgqhWoiN52j79-MeOARA%vdE&9aU`tn@rHpIU`>yEY`un@B^#o47tC(@lD4 z#zA1R(eDSofi~`R+q+TRHb69X3Nhu9B*6j{A@wwpj=sB)CrPP0HEs zUd+M81zD9^zMJbPP*&g=(7Wlrq~A+P)3^l>i=mfdomC56jLue^)!mt2`bi^ z6JizHf{kl>1nN80LDc58uCah&=r`2d?8;lqeL%WHoIjNq6l=x1%hc9MT+ZYMxzgj~ zynPZR-QuliYPGI7k_SUfD;!~K9;L16hN0T)OGS#gbbEZAkQ@lrFl7}CA6!KBe8agRjMAr` zyn5+fo%Ef>sBgq;5-5<>Bc6f{$4rK822!yL2Q?z*CE;#nEZ6jIjoE=XTXJ0wObYi=gsHA}T=cS=wk7B+m;xJixhfR-qeK z$AR02zK}kuhi*BNVn-?;l_LQW%BXEDZ4INao>;)TdM>jT#nfAfVv4IU$A*2u9PW99 z0qU@FKe^wH-1Q`b?mMkDtQ*M`Q@Y*pFk9AWp6)@_W3M$*y)5GhXY&-Q8K4JgYd@Qy zchnN+(*qb1i@m9&n3N;raZFu>a!BT??f7dda;lWS2?6OBjmQUavJadSRMU_i&IkEa z`IG^Z*e?K|p)@?Wz3hqggNnMz!~7ZqIFVjR8A=C;P0BBkVrtPmz)x=;&;_hj4*KMM zYGmU1OAK$T$Xt-8DpyRkDZ)X|xpGHvUj7-V@+sYWY7*?Tw8eh|?2|coyJldE6+r%d zs`fk`RceM_de(9;XZI1MNTOnrnN0c++Ul8X)F*;yt9*uGK8PVC%;$?qu^J z=oY6ndhLlJ7d*zcxpDeZV4GA5v8dCznkEmaR~S>~d7R_t2>oH=OAzps5^+d$Q5Jde z>5NFM=H^AoYM~q-il3y7Z05R2-1k^%p(Q@2T{G1v6hpSzG43o-dvsGIkxyVdoWvKC z@j5CL)rnCgG+B%=uRkMo5d0Bw78?Xe*9PT6MEMd^E_kM7n_=8C z(l%i@*l?@dB7v){ct;>36R&t2j@`3)B5b@C91Bivxe7-|*BR&oJ#sRa6X34cA>JRyU3(9^z(9DB_RDH6#T|IXFW&`n-Slb2Devpgia% zkDCPq-y|R-<}ZX{^`Qcj{h}P8siMR@sMTyZ<~T=$wuWhhotU)p?ryh3+e^fNO7f1E z3cfONmwbjok67_db%;t>PAF6Z60D=6&Cu{OQ>xE>tFRZP4{bTlj9m}og(zxMIYbbu zSVAKqV@~hBy?r5(SpX5Pb{K31S>;55CweCqS5^)y{?PQ6ZzI1Q94C8tvy&KFAhSND z-_p#afBAbU=o0#dz2|LZb?Xylsqrr2y@`U-j8Y;TO1C~bdNe1zZ$t@LM=p!mK1ZTh zxeV60lT2o0o<>WQPIN3qz!wTFN>AfqB>aw)l@OImdPQB@u?8Aq$gqkYb_8huG~FGP z+mP4Vd`COf?$}O38w;8)tjQ|P;U6%sDm#hXY$^CGohJ_?WtYGk0-c}AN#9ETBdZ*x zc&R)HopXS@Vv5JxQPL#C*(3!IdP>nmJ3mxABTm_%mdcqia=Zrz`62tMjtui{b~Y>v z`0|gATz_Pck`jajN-oH*39shrre1(Kr@ci(eXMf2y;NP(2-D;=#LsHr1J=_NANj+N+_tARN2my+Yn8 zX=Nm4FbnLngEX`%HeP<%$Qmv)i^XWCtj!`kw6oZ`?&Oqf9dzPc!tSRmHc;Dy4VHBC zxEqD8Z#dt;9;TWL;O#m%LUH0q7qdQ%S)dSOO9t2Al!BCLixV?xsh6o&1}Dng^YIF- zAcmQ5r&;f2;$yDkJe^6f3Q|$7*#z~x+_p(Zg5z1XvMHuJZExy2)@{xv4?UWtu2?mj zi6U#48m2>w1|EW*uli@2@3LcP!%xurxVKw9&kL0x0J1Zk23TpkP3qp&jL>$#c8-+6HVQJ=?cMO$P0^@>CjLpum zxcEub293#Ut)H1%{=_AX@u@ggD!Uhd#HjYNL>uqz8r7!TT#;?0B^|oum$PrxR8TT! zp2@*y8xkh+kcvVn`U2W%n+QlP{yQj(Bo=Z}SiPA=JOIU~-#liuz}A^+D&DS>kUN_7 z4P&C_*U)XpRiQOq=Y)+T^nGG`5SS{kGYsTUUYxT`LA6{T0%Mu-v=>nDo2{i^-Lnf zNHdyA3*%Yf7MPTpgSWa2;Qw(QLz5p){X+06I|Ww$tWA!6gF%Ca(O3$K(|+VJ0L;K* zH9|OIaVR#-hvThnb;}NClJ6GgYCEcpMqVsdFOklkOGne{oODTbPI5|}W&1Z9BcZ5u zkDsS4SjSE}8{bKC#Ff|S&}`g9glgAkgEgd?1jvYDXMd^Ls$z0fW#uT`OPzFXmLO{- z3&g6q8`JlwV@;{bnbQrxs=bew9a*ESqOT|T-9hPyQo$Hnz1Seg0cQ3#!2o4b5ksGO zs2HYZt;$vWt%&rqQOFpom^ zP;>-V3Eqmy`O)T_W)Rht5z*e$9kqd9<>XGXmdsV^0r-tdux3gYw7u(00{#;{dGYo3R&Axm%3!gn# zZ%sqoP0rVxP`N>wZU==$fM9t)iDj!tEt@nHtJXXFd}U5^WDCXCh(*BfmEA9Nl}SsP z8P_}h7Jvacj@o|XyQHHt!1_5aVcz{K=ioNF3NBNt*`OTdJgMvF#A*w?)$Sf%TEMJq z=YUd@!;U8OU7&i0(|m-Qx`82PGc$SUy^CI-oGBXttk8j%RRwH8$0&LU{I`sNils*uhE{W%wZsh zrSzI%daLW#6)eh@)g2>DMO1)UC5V1-N+(}^EgGtGLPN$E)7Q)wCQl)GVHR zn&;?;@i}GBG==|6d)DHO$6E+xE{gE7rGW3|lAYSthPl#Gc`#+21R@?d(x;dP1z~#; z_)cawgvw~MR9KJd%67g-kVlp4X1cnc+O>Cby*)Y%C|sYpHpy5Lc+6b0SF^n{rz-RT zCh#G0V6m3P(UIr%=^yDHVUlrNd)$Rz-*T6qK7ZrV6PLE+dXwMk-a>m1ij5SjX$6Q+ zhglb&e0`og%buE2yS1i!g7;91RctCQcN?3aoTH8+APlI5B%Cw)vdJtsw%x#zgx(f!3@tvFU3Etb8HOO z6SFwm!Y%9D!#Z+_QaZt*dI-D$K6W#Ol*v2L_RSMl4I8D-Me8w_tN1OUXETQAfX|ev zCVe;fcG3^jQf(`YbF1d(-D=hQfX>7{qwYkG8e^VOa#|Nn&cL+n$3n12l(U&Ub~yT1 zTd&Q>9%so{55YSFRRBM7;9`hhU1N+W-P%MR3mH_P zLifT$i}ho?gtMkr?PRxv_D1i*u9Su)cQ+q8o$-G&{IPS?}vhT5ZHCukBZ z0an{6>uTl$_ifLxywltoF};S(M5Jfa=hJJe8`sT0R?NpM9rJ4)f0+)gbf}>GxweLH zu$#4a^wo47s-XI&8!PFHY9PTOsC9o^b>G_+POC>Q_OgRqitmnkxZxf)0WBn%0!`RV z2q%pAMRAcrcWt*-Eca%pGt8T^B=d3acDr)m72tZvYG9-^XsZZf0qGfdJ3>4ZWlM-( z7Y7*=cGBn37od{bh9Hk>MsY4qIm)EKkB#T!7{6d{Jay&C$DgwI3;)zgOm^MS!M#(8 z8&olz!em2x(h0`X9UOHebYz*HYy@4|SkRZoZjknneU43sk`~OEdEcMWRTWtQurqEs zm>^0)j9=R{VdBdw&Pp~ASdqbi21GBb6&~N&6T>5F;;p;W&Gf{I;b7G1L7#cU3z^L@ z&I)wYd3IL9*`_dlcMr(!8A(wtV1$`AdQ`EupmwIlxKq?A@Ldqw1r|ILoip7XXs>Jd z5P9s{zTb505_L}yUk}jl`Wf(7&(XDdK*HJtBiJ2q)TC%qFsK17W^cKY@y8H9;Z20n>{Vopn@HPaA-xLApyq5mAwn&IJ^ZMv))Q0xBIM zohwoT!YYVJt~8R;&C(%KA{|RF&63OJ{rJwg^T)mC{`1~BGw+-`^FB|_z21tZIFX)y z7sY}6QV+!t^gm4HAU^BSjO&g#mmxu1hzjaP@KMa;?(=9CbZRo4v<%`dkwmbWkVrRr zUTOx&01q@=AXGF#k!oa^TC!)_U7bX&%7?T$^ixqrx`h*b-*8V`C>D55T(t z74|eDs+F6DJ>ZXSpgL>6Awt?vyiZu(=Gd#pYd>cBc5C^@KSPi0sn36Ms>n^b9j`2c zZw$!jZ9Qo!@H!Zp5q2`A5q4;#I=Q8#Ud%e5W|2bGy1(M+H+xN*Q{Qt79vP|d^MEP+pCx31#VP)x0z1kI|pL5WC4Ts50BDP3TM?09hNnVC#bZCwuQ ztT>mWf5iTP@)%eVvi02gqsMpO-cnHoaY|)n!8iXrLX|$#4i(4jq`fLvOnYe;PrJ7& z?~R~rX8cbD^(Ou1Yktn}n;WK3ZLf^=1mzqFo81aj$o-IK67C$i(jJ#vWsgw|KL4U` ztP-|FNU+Kdq8h!VZ*%5%JrcLSk{;jhMFrDroxNLN7c9nf-e4P*HvQ~7le~7}i}&Q9 zxHUs*2~GZBI@SpkWOw)7)Ym!%jkx2C~4vm&KqF3Q1;$RLj_T!6vE69@JcKY{+*0Q=gm7;zMj* zw>~>@|0Z!J|JbmvV*4jBG}~LUb!{!Yd2ua6=bmei;N2LvTHKSGal^u4_cZp<>_zp3 z3)tSbZa1VwSWzL}*nrnKt^edpsEcVu9!Dr+1FyXH+x^^g@8#46Yc$?8orhZ|)UE3a zWnx3{&TKx@u-rEbCGL8>KX8s5z&FP2JD%XCj z{+Ew}K$49b-`GUbb+KjS$oXdOQ=>N1wrIi=it^QgLH%-Zi3N*v zALnWD-Ploo3}x^)B&&DQR$d@n%#G9Vl{8AZu8O{yTVzXPhiQv0ansW=b!AS{&tZmP z@Oy9An1ZS`-1nC&_imE->z*pTFvwB#l?&%*FbX*| z=AjH?{f=mIvTs~$Cpw1EJHF;wv6J`r5YiL-7uk>@V!_4#UXm^odcoGIQr>yjo+ju_ zGqe53|MF#iIi2cb@VP!|#~{a_<6E!!&bl}h=APVoRUZUR$7&8&H!{VN&0Bd)I_k{Q zCEUB1KQn1zX4__e>^oSrRJT8A7e7ZJ=lbI48^fr)*6UtVGMk=B<;pB~|6z%Jmk>9t z*yxLkImy4Ctz44~l)!rxrK($PFEcgQbc`Qiy8=$EHpE+VGd-Qr4?I+D+!X39`en^g z6hRH19|?x!62^AU%JeV?=iIn})>ghC{GA5Ky)Xvnt|Q;lUi^=T?P*fR;KCF?nO{Ym zs~$&eakV|Ojw2DaAUb%dKdV#E*mqE&k>|7G3R}-Y(wfT4JLl1QFJ{w*@E;_kHpX{f z--G80!s|Hymfux^tA`&25N=z_<@|?8LQy<6T(B_`{zoCvn8;kH)^kT1Q?grtd->mb z%;!dRMyr}&ukyHdi34W^FLTA_pZ~t)H%ga&|9KM_c<7c?p2K~4TP-A4cUoiqxS@cW zDq&=8{=>TqhEKuA+Dc6Pq2KL0rUb*x)%%tEyL}SsXmq$N_7=ZyDjhFdPv%o^%*fKYhZf*lxCF)PE?pbzGSa zt^~D~5O+GU1?U-pWm^avzllN`3V$ugaO#jzQRNM8=M}rY!sJd5!kza!B%#uwR2c$( zNf{5acDZSbsi^-`+=8wWvO0F}oiWvb51O%a>_T*Q;duPk2r^}aNyy-*==fb|*4btA zZBbry$v&^M5h!Q?zmX?uy*se5KvsN*xOwPpWm|O2Mb9EF&u0mLE;-|Ix4e8vu4kT{ z;jI!m@uUj4Ktd8g@<|F`jsKf%+qajs?PrHqgD+Rjo6OAu^OI!HkVMmx)#D2)qw0P5 z+Bg=A{n<7%dxTK%cRM6GL)*IVml%6`ETvT~#}9B4G9rtV4UZQ@%Q`&fY`i9Mph5_0 zAbjPc#nzAPY+Zzbeu@{*dhUhSkx|z~+d~O~ZV>8S$t^?kz*+|>1*O#g=1Z+)|GL$X zRTpdTSdUWnAMMa7X{nz+JqvPaPP{%UXvFMH$Hya3RuUC9s48=?vJxV)yeJ7MyAlI$ zV&mxfH_tDq+n-Q13QV87*t?iZ$yQ#LexUpNW`&OGvN1N2y+Cye_wz6uv2^woNxi_c z^#U33oLw*y1W`^?9~?Vi#^zL}@IP8a$b)U#nqz6#-0m8)+X~~VN|gkHqd7T?xvUqp z5!2ES4s2bW?G)*(T-smG2ZsN)1>uJS376i$xhS{=7c1XRL_+}dc#blG9-&113B#7v zwx5835jgSso!=6`={P10jOiR5l>oX0uCOp%3mn4>KiL2-co7)T3OW`bBHQ4Ez+!+X z4>@mwTzC_a0+@CITn!k*2uH~RCkO(osqVyFRs_ z^T0476HZIx)xLTTMh5_8(3sPOSPPFp=h}K$!q!S_ksS z9ekAs1J=M{C(d@bI`8`tTV`;q1Q;C)$-wKK?gxegO+XSHcml$i+W{N>w2*L=02u!r zg6}zlAWz%8iM_@^w{iFd6!P-4N`Tk{a}Qr|UqMZ9!Y`=oPUOL7rm$1uUPCniM2uVq z!a7cz!j}kuLeIisr#Qsq8k};whun5Gw(c#;sxW zBSx1HH%0Bv%8qf}Fx(P?SeaJs36#v2gK>KxV%2|_Wl%VtXdX6pJf?;(0RO@j9~1xJ zfJ<8dWgKxiK!gHI<>-j3jVhoe4t|(ZjVU#TjJ5$6Fj#=v6)VKi`S2$i?zqp_562_~ z9)@keF~89Vz`!#2WX~AL8ONQPLxNA-!42ry&XZZ<>1tcV#%!k&?zg-xzO)I@JlO}3 zYt{HYSO|d@*piPRxFdkfP~sug^_Vzrbw6WVRq0%U@a#euzt{{GEH8S$A|b$mLQG&6 z0D21y16lw$83aE6#|rJdjd{Jgyz+LpCa(HBTp|2364F(*Q{!|KR@u~s)?wr%CMQPJ-35!UKkvH59u?^Ca(rjylh##}w? zVhR-d&S8<0cLM|i^_N)opVhH#Jx5_Gdx4FnPOS7G?DUlm=u#0LcB%|Nd!>Z%nG5Y7 z?A)4yA0(x#?RP>@K7b;o9E=~Rz5?(yRB)eDG02(-821X;&QjZofm~fl5Y`LiucxUa zTm*8YGjyM~>A#2rUJ-B17l{?z2s&(-SAu{uw+S8*RU?W8hOgMd&esGmoy+h`V=(Tx z5p+Ujhgma+{QVslv4a}~p`-ymkEYC$(Li__E!hsb5+(Z*$ zA98-;evC^#2DV3uCB*I37AnYAAmkVvwpsw}9@_<9b-?^Cl$8mvt3qdBejL(&PF4*J zf-g3kj>FMuf$i)4kP|XQFaa4sIF4|+xUQ9}1Dp{r!jZ#AgJDa~5M+8dVHSQA6$n`w zT=CyhmIJ-L?zL|S>?dE)NghDl6d_#l0{zOJ$dLs^Y6DyqNHGQ$fkknBuDF^Y@BKRwf?fa-&Jcv3pr%Vt(B+yuk$}JzAQ6`_=AFl(5xZbwIsO86E-g>Q znu5_eU>}Sr-2a$tx4iR^HUS)dWCkg`a0aHwfm3J%!CAEl6PSymb%vvRtDo6*q}UQo ztzkg!`1Qxbp_EtfK)o6OKNPOMayBN8TyCv2Ma;@GiZ9`(0Rh3S7~qgVx%{AoIq=0w^3;9&z4wnF7V7 zFy`<_%w)K0Va$m~u;yPU4Ir#7IOzHhDUjIPD-i*364t4JKaAdCligSF+(lwbj=62{ zRvhTW7jgm*1C)s?RKPl-6Nz5A8bt&kc8&4F)#2O5Kw`Hj#AyM%vH%tV2GT>|Cv6~NkF;|{_&!9r^?F*xR_83^ssh7_NccXL+Saf! zb}|*R?F}c4hxdCE577`E+%#nO_X;e0a|MJutMulx+gU-lg=<~FfOTMGCGEYePlJ0? z*`Lbk#)sctaFgnNxUFvS@~$Ax@dmFthlYXX`!Ap4Ey>9X#r?aj)GKE?{u4XmU7xv` zKYOz=;j5d^;Ck|Z%$z1)fo$p2n5X9uua0vyz&}@KID1QZ@sA=R`z-vp&0FfEyd~fq!%^VV02E`{BSo1fuRua=yEw`AR&2zY#ATRcyV7o3Vudwl=3ctaB z2hN_bq~9ybVS066+i|N)TMOm=aRGc{>r1T>_G68|Fq@R)qvFUVW}JsU0)KNdhoaGg%c3(l_nFL5GGEn^B_o}GnEtb;+DPo#s3s``2` ziPb#!;BV=xj$qNSl+ddF4$h_|QK`cKHhIwcLBsv3qo2Dra57V5Q$vXOii&)J4r-G! zd7O6IZvLaT^q^=W(EiP}Q-=8B*w(8fV)H1mp`MVxO2Fm&ozZg}`z{R+ZRZ&@d1$Tu z$%q<&QM*`hZDg35FbSwU+B@AKihWu<@I4Y+ZXHYK#IM?C_!~u|ca%V0*lW9i&qeK* zMCd=G^URrkq5po`Sn$boi_L|MFAI~pYh+_Cg!b}4eJ^cPhioQ_1{RjEr#~CMMS%!w zgKGO%_!YcA-PDU?gbgKs&N7!@9j2->+-pHG&R%E5=kFP|U?r{0JLG`ZJICHO=&(uS z4S$;XHJ*J;TtI4Z|LvV!OIT;o_=MGXjyrq9Z1K?&T)}B)lCv%>Ht3IluY_O=W-giR zsJnimmni`L=)98zWtWGbAgCJRiROHuC72me-wj(4zvR3CmhO8{&D$}s4?ZIER zl#qv2OD%8JCryO+x6E?k71r@j@>Z)y((Um4xo^xY0*^I)-c4_LkJuQSHHh60m7=R} z^N5%Z2qx26H3?Ktg?C{%Cq7{Bn`=`AEqZT;-ff0Gpobntlgq~D-QMAB1 z^cWOzzu@HH=II+#iNrM77Eg}K^uONB@^D>#cPDP!=Wp}Ddl&)@V)&iebWu32@$UFy zM3_z~e(xUzj6QSOid*h>lf$CGMN$>~Edsr(=!8dKcGkx%k#OA>{(EWas^EGR`!C5Ku^c$@$5A zY=>*AG$#^_P2btmUQa(zO3Pv%ZU2W-Dj z9*S!keu zjiPxEO#*^)Yh}D=`Up)_q>RFr$8>5;W#OL$LSu?Xi8V^=Z-)u5cs zT)N7krD0DOW;UEM&M-pdt#9L>M;F?j4j$u48J^RuqhXa*(u4O+<&kd=32$q<&M+;t z`I%%Ko}gkw$Z6t=AqDCm~RNa zF>IcsLCf!?_293Q$!Q)EGODap!ddX^2p+B#AAgki@X*)RslMIW&VTE_o%$DO-o?&b zY-t1_F&f{y5&j5$*D&*L*6TL?hTGo$sbCukS8F@MB}v%jLLoAB!%l74R4(*IyKVP> zrp(n3PXku&wzr!!T>LiL0F-L( z1UM9)YwwS0os~#wMHVF;!91;hd36k9V8s<*A;A$bO}NA^3NZ>VvB@WAptqkOENc60 zVu&SgKEr6$i= zrS(slyJ9ZpY7zH@a{CRaIUI>g->dPQPgL7`r6&hi+zCUy9gPaTXqYm-89`ftuf`Ya zKcD~dQ)GM|p*LS2lghes8ax}0=Cd8qDPhgmpdC?Vu;Z%l3E54~G?cA#a+1F?8B(3LmM(zA6+H->)=hs1=k`i875 zYwzk@bzS|*?RPi*FDS)l%su>U?B15rKpVuRv8<}o4UQXM2_4m9p8C@ogzgPE9+9{8 zJ?wV%()~Rg`qU-N_K8^ornoezLwgP~=lMjxe4a6_pQO9rr(-_R&JP0ooXWhr`zaPG zQI%qW{hIEJ9Bmb5_5K6iU%RKoTDNBcB#KfLL;oY{&(m$Ic&_*!O1)=)zfx>~J=uO-ygKGHka^ksjNa0axk5_Hf$ zHMZz~oKAiuFSz|`W+e9f(`e_OW8wpGMCe^3FC*?gx6b|*e&N#Z;j+gb`RnVaLWU14 zrsSrW$0pHjhX;-J`p=JD(0{}odb)VYbY53=-cq{y`@Q$z36#(t^kv-Z?I+?V|IGw7HDh>>B;+x>EBdF9x=c=_vY2~K(pp*ney_D z7L{{n`!<(-!{gm?x)Nq4AHmgi9aLc|_|%jY>&jIsqtD>d>-Sc21@I3-6A;|y39OnD)BH8AW9NP)mWo{W%y(Gs$NywO`5&)7 zChsRqT|fc}9s6m=@TbC!ki<7#fnm*w`frJKuyyHN24jmfO4GlblINMw{eius~;AyIhI+BY1^uCdu@&~mbv){|;U)u5HhM0tQ zbD7--P)ho99;(9hFG|$(^sw|#GVc-{roMhth|1@l^c}2e7?c#{QD6#;6Hd)$W9*Rp zi0;*O*rB4H=2n-a>-+IV_I7OAk6+c_CmsmjQe2rkwY1=f&3~l7cJSoAj9p)-=pJ%5>vAJUibavk`zgJzfLW@^>Sphj)sGl zRL$iD!}G^;k}(PYj7iQk$--1g9&0A72dPwjxk35yb^F8Ak9Uh$@(%p__e8o?eJEw3 zoL0RQ$TD>H3meA|<(?*!qga2SX=F;ZNL@1Cu_V(%B%+ijeAiH`}cl6$i zP^sj4OwgI|_O3MfzIOf1tgl-X9YT4&k28kn1Lfv%XYj7^5&6F3%C9HI7)Wys0Y-*i z#(+y~s8ciE5u!cztxO(1Z7cgvFXi70@^Z~Dwmrra3>*)h*yVoR=Oo2-E8Yq%()?3A zck@14l|JS1Vb??R#2@~4cW4k{43tuSf*)89m%iOIpwPNYL-T<5!=E{m_L4h!)G1F> z9*S{Sk(+Bi38)khjWwwiEUU`=eDBUP4i%gHo+pl18Y^qR4wwWpJ}|Q<>Qaz@Pt)x5 z$zuy!bi7A&`#EW)lXu!fTEw&Sj1|n{+@JRt`%EYCFEKiec{2tKlpmt-bc z>gJCc4vVEP5cMX@S?kK~K{?D#%u`FnX9PXpO3a%Q8B(7z-!Pa%?6NR3Bw@Zz46)Q6 zb*W{NPW7}uvXF|Aw51H^Ui(W6#8R{WbQ9*kp|Nq zlP!%|4Tcbn+)NKD)uZ^=(P`B+fHqC>eZ@O@H>GJx>`Ttuc+5xaUvY0x_YrxkUPQ6; zAfvHb>H?b4f^r;rky7ef6mHaY#lBFAa!QK73=8DjSqh%df7m?}h*X`5lq2n<_UL z8%)rf?^<+>6u3kK`ajN%XttCjhaZ0x=*|;;1P?eLPOOqKM&qZvhapGP zYxwHPtQAde?@Yk9B^Cz}7w<)k0y*z2Z%^|+7~-i0Nn*J;nB~4v)rZiPPO2D`cww#W<)5YSdbM!d#tokoE*O+j4O>C4N{L3DB4^ z5QI_ujq5X+d}MHz7#9T#0~;3Kf3P^lSnx0Gt*Bvd#kto`5K5Z)W142QHo32x2u1Hl zHNS(x$5PScW{w}2_^WOxrbvF;X7TAY(AMvJaMw$k!zG<5N+RYiv-sDWkB!Qge(?M> zJ6shZsf4aMHa9p%v02EoS|v6(VSn74r0=QJ>23JtJxbp2CNe~w+IG&~BACNTlik46 zmt3##Map_%&Fi_6-8Zis@u=cJU*}m+j&oDa!^WCuqC|Jd4<9J5ppYpY-y~90hxg%(DWn&;?Ib zs**J7zaF6j6fgsK>cw|-4LBJ31hef>IRAB}v8cS~+Li3l@8$9-H7aQcgEjr08qV&x zn;W0#>1dODq$ioC+b`#L&(o@UF)*xLnCP4K=K%5@JrYuNrVNZ5wN$)y`;m8vSd)9t zj;Ai7k!5C4_+BB4CHZ9d-?Po;(P$qP-e%^)B<{f|{>|2)NR9UQI-%e9Q^;dtb%IVX zG`AKnUAvd45ZUS_h{Yt@vz7d!Bj+@oTgT~mLR>GzK`O{-`qGH7JszMI&T_M~2k zT&5Maeo|d=T017Ffi?5q*KSC1YsGDcPApAVLBZ!P^WQ5)x^QK^sAYq0~f=9(HoLgr=?+($ah z<{Ad-AhEbK%1*9=B*Ly=WwO$zCHn5t#=AkNNZb^RdqF8jUSIl=u$ zwhbmi8E+khuc_vrFN|i7|Lr%NK@x0;a=(L835=Zgaj`^T?Dznpv{la1fu zCpork+Z1`Y78$UW=GJ1Pr=EGUAtBns!Ljetos^F;Oq$HkIn=dTcxX77Z8TiJ8?oeG zENs}g={FPztpKRHma%4~Fu>pXAEfP*{4PY?D3%DR5Uby(X7 zygDqBvUjzm>1H+i7F=oC6B*}RVa>gf3FuI0aCX%)pnT|Ji- z(J$o1(a!HpKA3#VNH*frP4d|D_&g!$xo@DaUMH1sAa59RCRkka%_lvBsp|uqj^u|p zHY`8JUbQE`D-{{$Bmqk305{-OjS^ z$vG+2_-HGT75^AzVwt=bc8BT>MH1Orv7OIjT_r8HfhqQ$mo+}zys)19PcK$qFITy3 zygA8qa^3sFaN0|1GHp`j7skVwE8i_G?Z*>;)SX>98gCi^GN7DZ{#AF8%ONJ8LLb%p z#YcgTmy)-n!g6(12J8M(l%GNDg{0xl7)ieK#wx{^_oq?jO;~?J?Mih|8Mm9uOdCoY z(UiZwrWCl6*@E1n)n!w6-ToT)fC!F2*8lVKkQrNzhx3B{Y`PlpSXS?_Ub5pJSf}oF8G#X|8+YkN)XQd?l zh<=chx{Xj@^ij{|=VZGkSLWZoC>yIFIgH%qdQ%9(@JZEZj7=^DU?cSu$2qEn45}W)8*Ehh^Ee%c6~<= zzmcjGC)};@cd#?hq4Ue_R}NIx4YaO-at1YO)Og9>g88rJIaS46Iewa1MuI~3yFrit zQR&E%O+$^|BU6JyH;i5vadY!seBJ z!t{lQg?zOUCBdt+3S)Z69Iehe6wq&=^)2!Qf_hLy%$4oB(r;&|{Vx!t-X!uU=Y` zKi=>iOy&zco)g%6FD1Ndpc(ZveB!;o&=``lH}XSytS@G7E{5Z~O&JH+&xh~O&pe+@ zRf2p(uW*~j8$veBCo-9Jk2HjW{ez(grQG~nMyvF+{3+GH6!_004mvfr7JW9FtP$`p z61N*xlEjt?Y>ZN592tc$@ihHjEuZO0Km!$xr{YO<$l0%k6@jEoycu82mA`6> z(NOgbXy66yW?$G}(^pst{SLJ-GlUk&v62WVKtrasp^53J^B{_ z)O&zIr5fFNOFsyRS1+600J(lX4aq<_=4~EBiLW`CLH|0hN{Ij-3Jk&kqzlF}jJ_*64L)EaPMAI~Y@ya+2kKn`@r_WxPSsR;WK?)X#Spa4dcye(8yih=c zNRElI01mj3OSY{eV5t&Fc^F1KQAOd6qklo}{2`2gs;SR~jFh8_>^fHw5aO)rqY@^r zeFA12l6Z(egA;|CtW}C4n5LPzcf3!|;gFgpv;=S+KLA|8{xwhQg`dN_ArPW~z|RgN z#I=CO8V;mGFFWzayw?w#?*jyYAfG0P!JK&?u&Mx{ABPfQ+t~n2HE3raBH)D&1AwV8 z6&$$nXx(pLAO2CWQYlMxnDlGm+o9pNf*XSAW_QwM7c_GY$b)tDb`lKfidiLHlR|Eu z&u^g^=Qu1#J-v0>z(=>#4xg5Q1M*YHc6W(uQ>i;X$kiSB$=&CEr;dOO_HZ(Bqty56 zf_O5yRyVfxvy2_D9tEdh{8htKv3JRGi!5~q(>=CJ!|*D5>-9!-F#7aDIH(~h51V)7 zjk@>6i_u}AFu=bUn(H*s{oL@SURy8+`wxf1{?w0lFL5HWADNWhO}xL@LETq6@Vk6Z zCz&*-h(Fv--zzF+1RuekQsLrqhHjIzS%#z)J{fxGdS7EK0N;)@ZY&52s+<4`Xgez& z)ZdMSBXu(kVpUD-463IWE^F~T6;0!a8;2&c{|3xPQdk>4(#A9Bm*_;JZ#qO+#@YIx zt`DaYym^|-vqenUnr>Ku;%!TkV0T`fkaN`Z$T7Oz!T-~T!!Ed1)*J74xTR6mtbDM1 zzkZzXO0oAF?CuWmt4b`mvb!pCV><^tLlTx$B#eFc_hbDVmED#6w!rR72(p|ZNcE9e zBrv$0Lp(n{b=qZs(TczQ5$$)={;ij`&9Ez{q^`rd#eu2h7AI&v<0%s}#*}0*xcssm zPcQRhE#QH?0a=F?o`21`nZe_B)doFn#8~A<5?@4_(#EqAH@CH>{6xf7R&LmIRA9P! zZG||pAj-7Dc_a-*sm&nrVtPnbvUj`){Qj8SD+2NY{l{beEhXU*b)3v{D%BXa^$F0( z9&dL4dE%|#{fyn7l*=!N+DZmiR0$PM{E=EWvvc2%8z(2j=H*{o7Q%W-7&>|VoO497 zj95cJb8#a4yl-A?>v6d8*$DiEDCn}qd`Jy_k4E_k(=U<*7JJbi=7+d(xR>4j^>5%S zNJm7!*+DK(_12B73+RS!7>!*!hDD|E$1fpOt($reJpDq--G*#sK z2BSt^kuYBUS4`!u$Z*g>DX2W#%zTiWZe6KcKbj~sqkZ~@m3F`xV$R-cr^0>>&5jX{g?l*^*<8 zAdrRrH(pE;Z{U_{TF=#<-}ly$88ataU(LtyE`y~oCsyxszmU_LCz`|0;($BPie4q$ zlLo|XO+R1-=6(qLf(FI|SE%ms69Gtq@fH?%O#~{bc;5iy#@3)k0Jtk)48*BqmlI4M zBR$#P|8+IZa>6hEC74m&|Lj8(@Kv&c$@y;<){TzWq-#LvmpDr9N90H6A7tEk>W7~h z3)XIY@pi@;Sxny0&RG_^;2jWVLTdhR2v z*KRUHADLX|t#Fa4*j`l9`oStET~(^qt>;vo>b!H*yc%WB<|w*D9cc?jo@)`qV}~S1 zkLRC+6Mj9B`tSY>B}M3@_Wc=hE$ddMJ|iaDQuxW&X#OU>Z1#UMI z!=oRnL@N!AD~RDqJ-R9h?e_Er=bh!ApAXWl)hWiGNHy~0#0=!tX&W0g&G*$( z>O?KXFB-f?ebCh%wlqBM_mqi(&di{W7i0`m$sf(vH(V{ETFWGZ^b{e zx7u^;kXrtr?H#spF^XNBOujYLYx9V^>dll5bqwXOxt9L7hWUDru}?R*TV3NZO@>aJ zr2Z%j#fg{0$5ryB40o@ip0~cFZ`CHK4XF7&5=iO_Tj~u*tHtDmwx7!T$2D2o=87{! zm*6{1dmCjq<}O6SCM>%48J5oO&Ct@dE$O>Z&iUFKYR++Gf8x%!NqU^XGSxBM9%0{{ z*WH4m`Sb!^+n3*ak5O@=Ggq%vAd|nrvgLWY$)owczaW}s{VYhl)Pp+cAu)!_1JDm9#BF2-mCO4XFOSToNRr(SCyw#t5*||<>POtd1I0dN zmLBnz`?Wu*2tp)(tnXDq=4HyhQ|Ray=2O2&z_2C9#lEVXb94ImV}AZFV?|7C?9E)m z^>OE!(n8v^c_Ux(h2@PTgo9%GCsNNTmG)&UOWkJfM``(JMkD2~qE@Ztfg-2Jzk#pZ zzV}K?jg|^$NTX``cx@igkMaIx5xtUYNVqT4pasohs_(C-a{TGo5yoysfcI51&7X%7)_O}TXAb!BKwatdN;@#`v|s0v zk|UgYCsAp3V<+8&kxnll_qf-**?w_!Kt6R1qs7eU)c-5}7kf*-3=`GU&3B2u{mty3 z|BR}UtsufvI0-@TjzB^w_-C8hCL2eWPI26MT^}M|BqXX+CeVV&`n437`(j{T>-k@8 z*6;kkeU|EhXiw3;{?v?;*0za$tZj3}Eo8r-uYbpHnEG-5MQZ)k<(v9Sqr?S?>4#q0 zvZpugM_@d_ifRaPaf46-&Mia0@#2*Zm>gH1FNW`Ioss>!={kcVwS9>jQKLJfS@Qcs zbcSOmqa1Wkt68eJ`!e)XpTEnPWfXij!*|9OF*~JwjtO`PvIu?odc#HR1z7#dv^C&BCR^}BZubRC*ZqWuw|i$yYH<=Bw}~zuCsWhY zl}(b;M)E;eS(^tsq6*&vmLw?ByU#xm_G3ry&cT!UwRq13AJe~{Y|Qnk*DIRI=g?M; zzvJwO+B@@K9BOU!Anh2>eWGTzcjQ zY@S~=;o?Gbyw6|jZM-c1MH2ACJzye_#211OU@ud$MS90-9h0`1+iFdAq`72^Ohq&n zuU6eR=6{etMjz?v5ge3t&x^O1BYWvBHP7?hQM%?U##={T=DOWe@uVCRBn|5JsS7d3 z#U!5?f+7PbB#~`yH+4g%`vm>nB4?%YwG5HXe$CaH!lT|-_~tvDdMUjtK}_0~Z^4Z!O2EfJ5}LrIAz%MtyGqhH z%?tVMwQK>M@;UV_?ay}#l94zi1vbx@6#FatOrszA5Oj_g?kSr}M}O}}9eSR^zU?$D zbiU-=?TbLqkIA=*lqk1>Ww}^dK1@)OWQL4ar3~M=Gl_X?wtN`x(4$i0s=r0fj9*G& zeAMT1U(cgWxUnzDDs!oeuH@(Ug1lQTv|1f*%kF+#DNN)d;y26t852I)XIi~yki}1I z=&yNwaeaJvqxBc)Zq4NuM65kL9YSPh{1 z`tmQkw&_~hUr@3;lr1gnxtZ1%d<+q~@j4q8E!w^qp8q7Qr@EPI@Mk_1e@ZJw&CvVU zjm}|h!i~MM66P-CkD5#B{hlW$rX7X%nw$hFItLRw2(QX9>;`&*G5s>!12HJ{_=8*f=q_{L1_ z<+pT>SGBj?@EvS@&6;tl0skgpqI0X7#+$kdBDnLVa_6l|WL{CC(JDx9yVefAq>BzPEn&jz5a^dDKVm_vDnf#~CW>1R*clSB`ZyZaDS+p@;ub z4~+jhvI0F3CJXnUPQg-67|zQ#-#v3wXFavxaz& zl~nGap{uY4S?>>UbKqL|LN9TzswvFH+q?o1#D?au?0O`rAM;}PB1q&xf!K)rHC@vZF|?rApp*$sP&58UMx<2q)!t6!Jj zX*`ZIAg5fm_>T0I^L~E6n~dyZRt{~(kkF$CbDGnCV+y%7sr$&*9_1Rue&^+Lmldl1 zuA@$E_|~x~KOhs99!<6mGc5FULecNr@PEpVcx%$M{H2TbRY}wB zP`$oC^a`h?M$Rh>1ujj@Y6l5fCz@^LH&q){zL7A5oTjjJOpqU?>uC?VZ1%NLq+H#T?4GT7zT|c3FX-HA+d!_sf8j#DV1Lr?Xpnkkcp6GA!^6Yu zx5$E6WN@n26Y4#s4}Ii(X#b_Lts`ILmE%kxz+gEvoEs-N%HRI2A4U` zH$A;{eV(%@7mlyWG3YqH>_bi#tuNH6J>SW&&!iFjjPhdSqhQM}R&$q8Dbp%(;Ia_X za!yQCFt|%3bh+!U|DAQ3X^P4b^5CA1(_xyRJoUv*7x6 zTY2Phy&dswG}p8@}H)@Ab%J<^EtiBVktIy)pUSBAJd|}B$66q)|OWK=O)XmMJssH_S zDx=>xkYB*hz*06zLSy;sjD(*U&>5F;FZ4@(-tC&zaFdq}H*}ud(48h(HMGki<4w|< z@V@IazC>YJn_taVmiANY@;3Jgc2HcD!I!KsS`_vr$I&~S>GSFLy+?hyo${AysGn6_ z3Q?w$Wnbbw)5w~sC8l}XkdbieO!cp`8apwGj|w>=2HDj|Nq60IDDI2*EavWX+C)n6 zch*5y&~`ThiY%5hj)pSc@JDqO6!qua&vKglZT5k?h3w<9XZ>p#o2r9vd%dq zI}(Kh_MG(;&z4n_A`4F5??|u*QdDL3nu;MbOPG)3hotnJO5X{-<2u#bR=-u0^N}m?%X6O7W8j z^3|}c=@YkEO2383{^t}z9Ei>T0aHM%zaUZfss=;N&l1$Ir+ITNtVN%Bw>wCk>vN-d?~N9lYtZ-%Wyldt_6h8@ zT^s^euysC0F-2zIE}2E$}j#ZJ4l z^mS=ktV?;F+G0%rqY@NU`2CqW%24~Gt*m>cSu`qc-)Kp-IIgAf z!o4B9<(!6<%Ph`_>bvXt7sBq`vZ}e+c>#-Qgbz4d-e=)RrBJyq(|9t8Z}|Hp>D_|S zEE6J}0OO=?7#n>L`Y3a2hbEw)h~N)uGta)q4M~Qdn1EZ$R@Fv`kQ2;XQqxC3G(G#i zQaEMq68qKbsfsJYt0$z@F=uL#Ue6XYxt-~v?P#G=R%Wtad~3)4vQ$;;1Sx^JW!SZ$ z<&tj@P{xBxZG#(F@(*Ak3G}&SzPqro$-7x_%vVSlO#=fo2pLz4C5^ckLV;kLLX$bS zLDq5D=1N2eti!G9qY-M(L#+z!K?$iA+yBIU$nh>h^Yb5(fvL2N`q4R?yqdG|;JCJCfp|;MDV`vI zXFlgWaA+0-RMZdnY*i27dx`H^Yum4e&o%Z`6?Mv(cPkjZC*SlQ7Iw23DhF1;NZF|q zFSQ_?vM`+H+M8*%CBGHhQpK>`3T|`wma5}TF#%hAv)~U*#xWXjS zHV`&Me0wXN%G|Go87kEaK@C2{#aK@xTx(S!wA`v0!M8Zao##>|u5k2N!c5t1#sWhT z7f5qQQ}Wviv3AY?ye8(DP#P|*Rf*oWVZoT&)@t5HkIWvQy*M~M?wqm_IeRY& zhux6p*H-ja^oK|%x{Fnhx<3~y>+r(s_m6*c+|Sm;D6sgN`V%XLeCbX|$_Mk0uy}u- z8|fZLCO0R*aj^}F4XqM3dh^tsm=2%}Td|wfugeBT=!d6lmXyr59y(XRS^!e%|F`7N^O)u2mwg>0e=8VNep*_QPuMc@yD zpeOb5w9kH(vgZ{v?g#%>_py@W`eoqs)*caj)E5B+$6U{7l5c?o^edT6p!L8g&D3G8 zQ&f|Ti%EYt7<7vt5o=&i@}OXQY|wehxa6xIDohCUq^t&_@}w|L=kZlyTtYL$mh{%E z(b#opfc!-X;#$HcpuKfHGcfuy2oy0y>7re_!ELj<_`a#yIR4J@F7hgG<2GjB#_^tGp`zj*jpR#d zlTmpgRlYA$J;0D{8(BKKfxFPDbq5b?ODtuO%7l#yA*2^13FXC_4fp^p@OHl0CmL?O z^(nZ+PWv+vezyYSS&7tSBeq2lx@7mAm93%R*Krc}(L5La=xGB|SD6AxO-b)!n!X0V z6oS(4_K%`J%!Lh_mWrC@s{%;viyGJXT^E9Nq7LK_O*1?gSR(*Jy;~`Qp{`{+c~_`G z2$&Gmelr<@J=YujBcWzJPVD@REPGo{-*So?Zo~XQ8Ux}INl?7N5hIZltodkNZ81Go zTw6vYV_;(1XuS)hNC2WHs-2I?rS*K_dy54zUDbD#mK#D@pa7he$x_feZ^xR6C=WCCi?!vWkenC#}&vw4)9=v$g zc{X2me!6?yIXT@qKAq9rIiNuikIrriZA3r2$=#!agU+sK5(SgNbTm4bQA=hw@#0W4 zpvdymT~6+TsRTKEq z%x3RK8`t*-gM}JCIqf``km_D0mx=*UG6o*4^nfW(^!evW<0Y!2L};aH#_xuy5>2=Q_tHJ_`|aDGQp;X z;DT1UwOSL6-e#>9kSypOdsgd_X2k{cq%gRj&AsM=S3BSyr0>zuS7;Cx!;Cm!YYhUp z3~+#wD^nW*hZz5X`8{B-q*+@ra=I|)RuzUf=8=@YR5lP%pf#6c1SSmZ1sP(Ec z8f0^A8|mr=mRgwxpccT=DQ#^;iK+GyfW|`Ns)EY2YzbiY%7TV~Q*cyaQmy54De=V9 z>n{D_SH%)FcNGE%jGzZwMSRZP#~#|A_uBL-53^Q0x-+?Th%mcRi>-326*H+WLCBT zqN5bxR8s-OWzkh&M%_8dOg{}Ivv&bE452o%bJ+Gom#w6JRd`H8p9P%!#{rJs69GUC zhW;UMK{Jzo2|yS&-7H|rOBETUMU{7qKLc@A?9OvaE(Gm)@t-d~NQ~jx@t-#~9&D8I zzqTKI`g8o}pW@@kf4;!@&us|*{P5n!gM00VQR~;6?FXAmMlOYa-kDwxN5gn>BkuDs zeBr@u;zIvoI8b|PKyjQe+_26UOH1K6%19{oyKuv6IE~xH%iL1!D$#K`_+LEU{fzz3 zImX_=e>UV)kk!CFFFm z192F#!C=@MDh?2slWYL9TF2?9cH&V#>5VYk<3%!on0M1rAFdTamt7<&L=BGBzhj7$ z7dy)1b)tlZ^x;Z)LG2IrAJ2ze{$MA?mW4(aR=@^Ckp=P9jK-; zNd{`DDM!pk2vDqyB8oZo1X;1FC5OC`5E>Fn8WWAPyeq@5->E~a^+(YLnnMgRHf1UN zcJu|l+JuCc@L}ecSVatWP7e4+|MWveqVG8$ydwoY(%K{$XOlu|u2!m&htF@6m0pn7 zSg4i`x{%PatoyQ8_^#P*a$QW~%lzC5ynB#SW zeh_OMkPVf17WeJ-p!Sarcs>4cXuPUn*xE?DqJvl*SMW&R|e4O#OkXbNVK@Kf8C zG#Wkt^#;==nvtEhG)^eu^N_5t{fDUF9TU~p9kGHNc96&@By+WEM(8~QE>l{^%-etTmJM>Kp%QR~fa;M0xXH6x;g){;$z+?zw2ssLDC zJ_@-18H7De-c))iRFHJ073g1tx;vjcYZ6r!v_oe}p|j0IaYp`x9S)k&T1zt~P$NjwJD?ZxiPWaYtl*EdgG$GJPyNAYjYM(*&Z(ZEpi;T0eyWJr0J(-8|fH?%01&gh# zBM9?wbrbpG&~PEK?e|i$xpxkU6^o(MssLBhe&xb(NCO=i)`>;L26V70V;cyL$T)#j z5%W0GRlbl103(E%3b&`L_cJ9Ms3YS7)+)9$_6~$wqEs(aheEIL0Vv0$1FF($ssGyH zF#&^UnkyU|0D&>>hI99MmK7Ja^V~HYptxT8ta|I8QZBCmD<)@$7Z7yhNSwfXgt>Rs zWu{_IQkHStOI(b(Ohn8c+@fB>6sXcLF?=Ljn!DLoSVn*bXK+2(dR265!ED(15gto79E?o`9oKS(7b^!#M}FP0B{cF8SAA{=SY?&*@RCM5&*>2 zAynXQIld+E42osouu{Y!n6QaFUG>zt7?dZrTp}N|9*kgsHlQw7tq!Vd5l>X?o8{!- zvkrTrW{5#tFgcn&Slx1Tx)SL?nU7K}C>B)B6H|96$;()>RiT854Q^pHce)BAW>40M z42LW6gU24JCfKplfu7{=g2NCofw|(0xWF#lbyW*^9iaEG8}iPSfg_wf;l($j`*A?D z(30^$X0DmxOqrvobYsuXzW4NDS4v3qPA;Dr~=IWZYBD@Y(%M9q4xyI|g}+ zwn2n4Lu*WuD)NoqUAcq?t+O&%VCKpgR$O<2yb3!Pv^0-Do29Pfn20M+CXHDl&}evu%BH#7 zh2>Rf_&7ON6%9$*S9>B!RYSNhxV>m({Wn+%g)1>UgR?HGS2Ty*8x&xBS(HnaP`dUA zZ|9>CjaG2LMB9)J$-uV{vR#Q|6SmGvdkDwKa&*U@4LbDkUgj zM8xD;EnY5ESqI&LLO`?W1JXpTdvLU~*V(H%`Tu+|1cU}XMk{%6)o=ODOFx8o*Z3Q2 z62NE;S&gP?-&cegfmCi^Bh!*&m#qT)|Kvs|le~&2LlWJAda&fG*dQ2;5^qqV+CG-5Y6EPMPzi)uNG?Ab_9%zbW!9gn;aP=*fv2Yn^yO;(PRiD6 z_x<%Kt;IG5&UR?t+Xbj4x8qjCwZt@DSf#FTceSNM5@I#FmAv6<=mH3GkG9*gcGAJk zX|aAtGq$Rw;peI|&WA|h=f^j;S=AB9tYDa0(y3ZF!dA0*ErVks_0fK%ZZQYkIAaJb z!sB-Af*5bHx&)=1ys!X&j~h4$h_(j7JT{3u0GKeg*n8i?{X*>nx`$K~#%$Hkp6{G? zpLR|U8xAqn>`O4$Q8v!TmL{hhq}|Ah3ZebPI;5y{8A>R&2?qBre5rM5dsV)!0NuX= zOwbu=0o6(ko}KLfu5(hG#mMNx`4#lF9J!oRH6?=p)S^(8y3O7x1StY%9mJmB3`Zll z6(1_1pS?-TTn;0$!}&3j7QQ8TeO0U418q1gx{8b?`YORTd)Qc~S8!dY+L$?mVDs}< zgLB$uc!v^cHbv8wN~H#DmLRG+){TYFtXbyP2T)oI@V$k>7QH=a`E@Q#_YNqAj3&uM z;Vdz@uhQi&e1Q2~n%v1{?2w|E04_x)vZJ#+vuO*lC^xsqdh3oV|I#pC@0QB_Lc-iu5fli$vVglbBAaZRG_y94Oc=b9%$jSR)wFr0?%u}Hn zw!A9D+M;OU+)@)Ok7CvzfQpsTBiRaVNbQ@}&v-!-TJhe+q|S{luP-wx#0Vb7s0E8+ z8OV`Nm^KgsfT2d>zMHL56l(Y-OY~qavyxAH7m=$pMFy0d!3+ohY1YNeGs;}S_ z)vOgO*HU~N15~vJ{TdMjSXD=#bDJ557>Ty?P6k9=d!P>;C8OFAs8MC^5J(;}9&9s2 zR;qRZR)-3f=^C|oRZiSmq1&>0EfIqeKHA}ngdwUycV?4JRk=jgb{tR8!Vp9qdvCm$ zJZHpbhc6uPrE5Y?PpT{fcolBlOA4Z0Gnxx44Fllvjo4=PVapO*1 z{j>H6+mBF+J8@PtJg za_tDD-iU+xZgJi!dNH1bt$3(el!gs~T?!On^ktM0XjLhtS&qo>v@#D6jfTN9(uqNI zYf!wdDzD_LtF!LB4RbT6Ut!!RxVOhu$#}{gS*9oqRu`n6Ih)zJdhN~nR_OBeK&_Ks zsl$rB$Kbu9s8RE-&_OMH_saU=sWE-NEorJfKMOj4X^Q5|yi6{8;~SXZ7-4y3!%3lW zB?-)280nPSM^_`kF$I|y^qdk@(Yr6I!r_vlvn@u$o8l}PfDQuK3g;*{Ik@fmlhUQ5+VpOo|GuN!JUmC%@R^cE_1~42^kYq2<8jkAI@2H z8-55?OHU5>*=p#OYIT{JxoJB5y;>n9!6bd_!QqDW;M^EEzNX^^BJM&4LnZc+LkI_r z&^Alp)NN#MU(u;&0ELQgW!q9G5S;I@C`}mv2W@>U)J|a0BZuXvn%t>P;2JvA1sd_X z)$*ATsrz$**{SAVHvA2##S=Ni+%BL4JXdkS1@x9UGS$$=YKIF|u+4PSYx! zZfbnC$0HPdB%C)YuzWspRlwUW6T!3!b%J_2J?#Y-vb>HkJE50*e}Uit;?sRFcOtlJ z0Ba_W+Xsz5F=PiVPQZE|An;`Wpu^D_@Q4Ev`K`zKzf?FuZHTCi@>o=B_oOOvqczd8 zVK8VsDrf7OHC{X3?q?b18jCs zj>(`~7+|tfCJhc`r^=^u$sB-$aKT4m+otRtv5Awz^s) zjEfEgxZphM93KPzRU7?4)W&&W()~-+8d10r6NZo?DB6&Oc!#II*zqxRr0bvwcm=PO z++_fnrG7f?(O|uVm56Z$_9ZoFN%Ou9PNu23eHvi=QGDj!UN{ZNW%^rO83PliodKA0 z)a`oJCN-%w!$Nw9yh@Cw*fi9xm6j93;zFdcr08KA_7(_rD8E?NXYh-3c&&&}(p$&z z*(2D68*g8&P3E0;4;QR7-sp^0=U9X2@W$azd zJEt#>JKt`+gq{#IAM--!>6{HybW)a68NiKtVq2a8`m>thGTaK%gLLAqhJnMep+u+A zpc&GNGqKRy7Jx_;&OtJ7X`BThjtCx*19lz20D#8Od1^CbdwD~$jk-IzNpq$LE`W(H zoTnfN>A=p&C%)2iT=rOScg^B{crz_RJY^u!z*&D%J|%=$%QjzBvid|nx$TL5qE7T& zpXeu*CwfkikzAFYe*)`Lc$%0Rgkt(41s=~nI)nxfLb3W^BCIK*_fWP^A z&U#G!lZLNnB(8$QUO0ihkh70gaAI{cGukOL?Gy8|1+Ik&I&KK94c=*KR`&g5VW|>b z8FeY3THPWKyB!r11NV$#n(?pHVilo|M59cD5S_dQ9?@<^g^Oz1HQKl7(?z6FBk|w> z>o}g2jsHAeZ5*e=UdWh6qjt3$jvCTftyD3nD*~nVzuNiFcMkV=Hx-ezG1l2VJ;hM# z(9i+JyFrf`#lHrTvYKRS)7XG5IFEnCzJ3$~m8KC=h_QtZ7OV4GHt8VJi=aROrQ!mi zgg3(Y&EfSpIMmOdfA^oc@qa!*2(a1le_Hq3t%v3KKcD>^|L3Rp1mgc(VEmt7{ffi? zJh<0_a9|Mrr}gkB3;&}-f>9uxi&AJDComYq^-=FD!v6$f=FGMn4W8m)wpBX6NkP0- z;g*nBR?&8RTT8#d1J2A&_oV3Zuwl=RdO({vY&6_@IoE4`->~)YsMs)`8QJ(_jNZex zQx#x1dfquy^KsfY&INZy@!*x=WR_*zAfZm6k@5re|5Xh9 zvCE@lJAIho2bH)AKQ6ls}i4$n@$i(%br42 zO=*9l_iRQxRR^1?ic(Y2miFNdw>7=2j>fcAW!S}Y6;7j7jqkj>QyzSbi|o9ySV!Ft zG?Hp>U3VzZ*P(R?bv!y}3}sFu#>+I^#7@A?bgR;NQjCl55pFdww;Ah%Sv|B{fLV4> zo`oO{)^R`BZ~h0*^WR5bzbV*ZGj`YP(@cBXS2p0y10F|QSB5E>N#_Ean&eM0hAHK? zSU7k_C3rD-Pp}~}SqM^=Fj)yk6Dq?)%z{F_EJ*7X3%XMscBg72cmsGVo(As}XE8OC z5<BUnhGQzlPb((DS9)Eg|(Z&h0r^O>Db zXY(l^!W`YTK;N1(BxC6u#EILOI?pq9Mi!1QZr|~))!w-R_BX6b6zOHW>4O6?`uV_Mec0m7HaBfI@Po!* zxnXxuhUJca&;}eUnqgC>MCY4 zQ~fmRJzix+J1@s-RnCT^VR1vzF@!dO8l4tqaCb_>Ezbla6g(zMLBn6&M&zvG7qvlS z>8O(nyYko*+r(jMr`;&ow^lJ+)^fL0r`pVTMq`V$HLC?Q4_$l$)`&P%=l$=mO33kM zSX`jNSALTh$t9KobJ$6;#=0&q>b2BK9UdKbo-jXBUu!pErU$$JF0%lqfCdjs- zCR(SzUl`lcATgvE*xcY~>PM`pQSuIVz>v-`JIk|CQY5toohv#_XqiY8!>$@bww*tg zldmGtP}*xqQT0+wBi9yiMoaGQnsHKHK5Eb7H+1TGVf zgQ`gSpxcYm1Y)P_Dm-%R2ts7MLZgIbQ&Y(T*=Ur#!Nh^8NzBoi^^*}s%~fZ3dJeB% z4HQq5FJtb8X~Fywm*AV$AyXrdk?7od(7b%>_@>`errTB1>Qjs{sxywDjc zHX&9gQG;{L+lW`w_;D8p8nV66u~kOWVAE%2bxi!+vb;lmxuYsk)FeC^wIu~vL~`Vv z7DV3JPC4)nnV6KUs%AwfF#*;w77&_uBz@m5-TGBSEgNAMpp3H@a4Hwk zmSxB&3`*@L8K}rAfFYU=>H;)TExIJ+!{V{dY6;l}W~pU#OE{gHb|=Jy-j7<12(hYO z`>ufSTZrvkf?nj_(^1(OME!K8i7}SA)zod(HIMPpO$XDg!Z@G?1aF~Th}un^78&M5 zWwzlFn~DO0_v1;QQ=#N0XRZt~9;Y`vC2RRPb%RG*2Ox_*_AMcSQ+mr?UpB4Pp@)Sj zv4hnuJwq?}xgHu9Ytyf33dxWaT7!NgO1JE^q^_!sK5+n8PHAn_aGoV@_5JBsE;H|7;sqAIN0@F&QB48HGXb56_1(kTcu8 z4s(oMT(6rckdUaRro=?mr1q*o8`@$L4>A7-RuU1OVGybcSr~5^b7xF0K>eGl(0<%2 z6bh8XN;_*=w--~5)GVXFkbzjz)DGx4WRw*+P-0CN1Cho3ZBUtVd8o5bgg1e){<{o8b#*znCluq?V|l!ZOH`pAzA%YlZ2gMJPc-s--Go zYK8W2Wzd9NeL<1`V0* zF@`6^>yv$lV3W^*4c_GF6N)3CwQXn_bB)Loz^G`aJC6@Kwu~erg$Z5#vqrJ5EsODo!(lw8>20sdHAtawL^7$H()G+ z))8YbF1pCI%a~WOPdvX8nN!By_Noh!SVM<=!tK0SQrXK*=&mI1`)yDQ1DxqMvKMCw zh8Ibb^BB^D)w~n2BDIZ^Rikv>(GpoPu#$}MCR5!EM0%tQ1rAh=9n3*>BFwO2L{1 z|AgmLiK}uf&M^`#ZhX1sijUFicY=!#SbFNjm~%bu&Es4EtnD5VZWQRMwQif67`G|0 zUmQ#pNU8aDu80DFOYOW#pAW&qhBBts7Fb=KlH(SqYUy#?S=X~nNtrUx@bG5LSWR5ExnhV~oswd_OSY`*Of}<$%k?s)u>PDgu#uUfEhI z?_pLyo!EYM2fa**)V<<7o}9(!K@KF~-9+Eva{60v=Ki6Ut7+EID+{!DAcxktVJ6Zw z98wK)nj~0M0bv|Z^Mt>{ z&)uVggU;?L^{*ejI5h81PCKURN$2$W&Wn?d_zkb0y`Yg`=Z;WE)WB)m)5`_iPaO#UP2Z@a{PNUEP5AF-M%u46cGBvyf%$!i-NY(uqgJpX>xLe z1Sc5MDqNRX`RVLlYoq;OmN4uL1^~BN60-$enI!qlw))8+o{oxg8_pH>7JFTvVQc z?EvpuDN$9zb{r2URpF8snx(^1zyl6@P0=n)lyDx&IT#7VMK)HQGnVHy)$sgO%5ee z1|r~m5p5_zqaDW9;lHJo6u{Vc#{~tWn{H`6nY^O)V^BG+mhjA+H8gAfC5A(n zQO8OsNhT<=p0gp-D{{5bBE_b3Z^w-0ifW_%Bjt|93mpiys}MLZ$Yz$(6HKUWSAK9R zt8-#K+E-ImC7Td->2;EfbByaw%6-(n(&7)(D2AG#tD0OT{U{%0z-8sbeqs%m-gy3sWC?iDOg?hJpyQI$aPo z3_3RYtoUIo(x1N4Pdccz^`ek*$Yquhh}1z6MX^j`jc}Q9rCh2&LblkK_eCNWGaOIh z!i#4h6S|smgwO?2CWdxp)mdr7$vCuQ7Tu_A*P+EmZO)1MHg7SSQ2xt7MnJ> z2bnk{Jq7m3-5Ln+iZC2j?zP_F~vF2v5 zvlZBsCm?<=Zsj1TyIB*PRECmtg6?u<MDFnEF$O-+zsS8j5HhgQi7^7?uh zeGY3f#B>*{I;)X6S%%RgNIinDD=rCIu&hI^y~hw-fm>n?TtJr@G9I3eb7^_S{&gs) zF=_XyMXO}uUZIXg0@E3@kpzgJH%Id{ zbx!KCHB1=1zQ;i8cHk7e$&Ua}y{~S02+%9`aJH9>*2u=(%;-EhmDvwlG9gYb(=ylA~G!^hT{1w)yQP2A`cwjpCwo zRN^QI%-fndfzbV!!%_iDv}Ftdrj3^XcH6FV172ZJ;$JEShtDOQL6sKW%exqkzU&15 zHibI*k-Cl$XurBMu zNyT?Vs@f0CZqvrr%>UaazH%?1bP@L{7bU?+7olJL3eQXZ27mAix{=S9DnE+Xd0?tzz=?* zZ*cWH{oB4)(-JS$FZ(KYUghQ$G2HqU{W7l{sOAn-^8i%yGE}v_fG(nco7XPz^l$xI zog3zr`p%D8CTU9XjbB|mV7(S_C0QP?B$wW9eTYESyV*qX;Ak3e4fNlwIdW?h=UY6z z2Bzz>6z^C3>Scazc9(rMg0>LzpbjNowrh&K_FsT>ST*D-I7rdl? zJS)C0Yd?9GeXtDaX@Gj-%o-oD%u0{qbC<+j>ky%4b|pE5x~V$_yqf^94Y5CgKl<%{ z=U`7}qfNy%ubHWp@_b-}2nqL_6=qTf+M2!gU@a#H1J})oG`lyz3@4mLD)*RTC>#)2 zOO3W^*Z~z-(Jp#r_!3!N^z?J+Iyw3?pEkx6tLb*;_4To2T)T@Z~=?_UN!?$Eii?yyOiNu zVEkgnTQ_79UhY!pQEs%Yw2$B6N$^qg&cyN7G!aA8!qEn&bLd2#Ow-g{6bbqyRVen{ zw{n)zC*XOhwF2Q&KcD8~L{W*pRV+BF1#WG_nhb@EussRTvNjuR0R2c`?4uK*5{WKi z%m@@KI_&tHR46{c*!rFq%7z1*k zE%7jChaQXcuA%iJa&9jxNx4KqtO!fLwKPRMnt4gT^-JDFO>fFtY{LCx-_mb>3G~Rm zf?xasNsE4iKf*H2hYVP*=p$xhm=P0eM%+xOBw~g(y$4g*^3^$zrj>Mi;Q3WKx#&f# zcsUJJVw5LB{c}!Ow$txEt*~4woBZ1`2*=s(Q`#M>RqRkng@F5+ZeOU~MjWaE!;|XD zO`&mdU?4Uj4CQNx`QqM)%Te%aO(Nt3`4x=;GM|x=*fMGhU-5VFmyXb9+Yde*=Mgh{ z%u6zkV87IqMpF9Kv}SfVT3OyH&ZUixM8olwR`JrXfYUPyLNOd+3Q|f)teFm*`1jSD z<%)$i8dNCqW;hzbZGVj58&wDURuDvIh$))#%gnR$t7{-u$Psi~@N$%c5B%mCTo~L;c=ig5+$9X-0 zxMWFV?NI>+QuuA)W$8xmHzeLlh*DklAiB1c`0B~pqu0RcfBn_ri)SEQC(s^5lQ`=B z-HT_>`O!c;V)jI*k^HI)M!$7nikOlPa?Wz6L}DGt9y`s<29QX3GWMepT_NMi)5ijNJnQNAvs}r5ZoVaW4CGCE3TB} zWw=2Cla5J2y-|d%cm%BbP1M7?FXzTg2%VA5RKFeFg)Rnbk6`t`rD3kMUT%r8JncYi z{oSLzPTjx<1+k;&-Gif@y~F*3h7c(Mv|}9qcBHEA96#;uh>BZo!6LK89*2vmAy9jt zZ<9hpt-k)P>aVsmL?H%^;-OQ}T%9SQ-jhZ(TvyYzmReC&)fFU9N~35-y1W>Vfxmg8 zWx!IHgs-{))t$$?b-+Fgt|nulZr$FMa~uWmaT;C@{}5|qT)=H+6u#;L%6YhL?(-+5wO{fIQrBz8)YS*&}qQz5%0^-zQcpV%9?voz< zRphb=kge}8$Np9x_g-pEaW)tLGrEnn*XrZms^wwnmbngZfMCnDg#8kq<#nnKil1jY z-@p!0IAE^0zUk&SX%SzOvKFaij*7Chm}Dc4A*vW@w0nfuEySwxUIT1`!8dt~j+=m1 zt!u*iYTR2kwil>*LfZ?38Ik3vZcVNysxN3o?xdWeEP|Y!^rqnTk8zg z3?U(>U>&66$GUcK4wf@`G;Ym;l6$BRt2PH5Ej>7ATX3ipY7?A3Q}3N4uRb2a^@yu4 zgJ)ZTIgf`DgURyd%|(K7P!Lj>3O&7Hti6cUmd+6GlziBq_7XBCno?jhGG3v_5Lx$1 zZB>0E+3@0+fehazi9G}u=$x^WERAtAcE|IBZH)c1}*!?r#Y7p`+j2&?a9H(_)(T1BQ{~xaeKLVkrqYIN4OKp^oc+9zckpou?c< zR5SZVqCjcz0o5trx#QTP3>Vy?Eh78pIm7+9gZ9(>z%oHY#U6LWdMyrA^=2n0(e;+Hoc$I1abRs%D$ zd!}M;u>5-Z%qWPrJZf%6+;)_U>H!nh5*f<$^@To1wf!Qk0}PsWsSnuxFb8$@c>-Kx z=qQws$3ZZQ+2kWoFPi?{s9-}~#?Z7nXEEj40BrSvtWRXa#c-2FhL_sTs(8i(%r9|E zpUYtfW=liSD5a+=7VB+jW;BdBd&glzh@lLy-v-<~AGbFu8SH3f)Z!l7;tr|p@DWxH zGPiZAnk+(OW`v>sd>?u}9XLux9G5_E5&ESQM^|l{hO@~~rXH#T16VKZyd%sITwD%q zjZr(eCf4dGeAoyd8cdC%$`OJ=o>(C6tK@lt9z?nXX%rMcav5La6YKoxm)r)v`{Z^H?Hjh~I{qH>WyUhV7qxRmUfMmU?OvowV2XxVEzh6eV)350We{H{B z1+(hHT+q>07aR6D(#n@zHamwR7tM&)`1vGL2f@lfBd?JjM}0<)0cFU3t&zDXOdu=O zwqtkCU{zm_j4kca+4ptLg}?q5F%8_gQo16-7GA2O%rn6XmeV{VkrU#-GK}zBSk7_F zHTGB3U~;4B0c4#t?KP1#a%HT-AY^GWvRD(MwuSqNh%z@@L71|oVb!rTIj z&5y51Fs5PBb(i9lCWBG-M(;`{c^c-Qn;sfC33CT2ly}D|#-^jdV2liDNBTvXfN#_D*e9NE-h*?BKMs!pI z%e=S-faG*mW$+*G0@EqsSGiL_GES*C33kiN3$0G(_a}B8m&TL0#x9Ui( zrr(d#fx@aQJsGp`SNi&v^mm{o7lmO=ap?5i$Qur`caNerlX3hQy{*Iha-x63}%I#{WENCj(5)?y|ilc`#Y-DabG58!+1uD)-#E!l}CR0-syF5>b6)zh!>kY~6N<>-UclBLS4Ry?}f5 z1_$q4cikX-4b%jkPuPW6qQaA%gOkpt{&jl%qT@AJ2?T84kV>d2cX>s3UjR=<*|YIze-FH&%!9w<+cx;fi+#o1U2xWmekNR# zOzc zHo+JaY!f#ykH(`QQWgsA4^QD!WE0pK)yS`2%B^ti>MqpVdD;tyx(n%7lBjElpfU*n zPTD%o&~acOcYUV%lfHJ3XOGi9G0Km`8^i*Fk+0>r{Wz}0IJEl1AIQ8>l=K{>VH|(8 zAShUS;laWDRBXm#N`-(7vSAz>DO?d?-D|ioRU!tWq1{md_rnqv`HIWYU?#(EzQ0ax z?2Rd?B@Mq3JWR^G31%g7?&>NzmbPVPN}xV?(!{1b0ncAD7;b4G@UYCb>B-EO!pM{> zXzS-6dSyX5V7cUzJZY&AG-@078hBsoJ#)>RRDp#L6ZNTXOPYMLApdb)*oH&C^wRYR z%u&f_nL^Ncf*=$MXvK}%A!x#u5GYG32j6fl(YEe~N2gZaVN3ZnCs36!tEbW>rcPTK zYb5lnt%eC%TYZf4k=t5ZhMz-_>q#~}zp(KSe2ISM-kC9w6Nr7NO;nsM!NYMk{CPGU zpy)W4c|@~J=6ZW*G71J7i2T~;?p;)PiiMDBtdJ(ou_2-$6{9!tO^!0}7F%9kIG*RT z^?gpmt~e{3w{x4(q!N$ifuRY4r~bm8O2WV*lpkx_O{7JU$|F_yEI3*bCHoo!ev0EE z77+9y1E~)Q3gD>VqRrrB1vG zaf*3}Q!Iiw1C2O?S%?Ev9GLd^(lNXXLg=#|R&$=ZeLlg`tzjo~np=#1%+<)tS(Y^C zGtL(Hl+PEQ#GG3?bvAyOtIkE(T{e`sh{tdbK8wXgJXKzr8$iu1soC4oWDW{!v2DAxiFOe?^rmd6iNT+e8H`XN8EnGc!bl7OL4-`c3I;UG zFCnj}yclGoKE@Rhu26Pcwd9YsHAG|EoGbPIs@&7S>eUuGq=Jty;K##g%3K1nyyTOz-iZ=!rFe31$5fZ6ptuTo&M z+|}f9zsskL2Xj`!EO=l&OHyRuk&X3;!n%%GYOtmA_wrVh4n?|)(aEeQ=NzCDBk2RF zdG+}+n6SV4eA{eTK5nzt7R@GWZ_%)Aiy35c*an2sm1smFxrDpgjvNfDK`S8^+bs3p z1>8_3$zWJ^0E|F$zbJZ<9*rm7{v-(K-wF9bwATwf%hsJ6U-g?*?utvqUxs9C%slLl zyU+FyU!0T_>wI zLSe{?6Wr9yyBSEC${!P%7hK*gX0XVpRrB*lU2$ZXtuOht5Mn$YmNDbXRp$p*b?0!; zo4HoK;NY(ofb!9CpatY=7j9zr=x}%EG_VBn8uE(QfUm(!p7o6GPhO!H$nrcn7AFmi zoB4%YnMLy#2jZ9Er|kP9Sr@qvxg`X@c}0op9ile_7$Iq6vAQKUuPk2_L4rs7EzreS zAhp~WD!f!Efa`UFpjR?hVU@J(#BlZG{x)iiptpf3r6vJhUPSh8g{pG&gP&&f1&zLV zm(f@55_4m1J4f=|F6pX0t-Pb52Jwh=(bSO)yW#=M9&*C7*l)~e8!)RyY0r*rCc{(jT2%DPtP@6obrX1&8s zxZcK`dIzWFdIzWT`#T8q2bZ<;>OHOKZ{9ecR`gd6x`;80-X1;Je5aVQimNl&GwovSy$r;zKRbS<~)aEt+i(IZ)Q(BU@090R=khO(a& z!KdVlNql3p%#KGNdp&Vn5bKrBZg=!hj6EcnJ=^)FyMK6!&V8ykblh|O`rPnZ0KMVX zk`2w&%O;Z~A1l!VG!?iq0PxAB3I8-};Cg*ZgSRgr1>(C7+*^LT^j$&= zlzj;aV#g<;XBCKy!0OC78sqgf1%Do@CjBdJRpzlS0wU*lXL5cBs>L%>ag~ej28;J> zao?W-x1R`=p++C0H$#s-zD6AL2a!4mi88xag2Xh^aQy^k$WR1LO79&!f#~Na-RGU- z?vsNTCtqS(1}=UEsw!?oXBW{aS2>M4zx4p3>wK&i9aR`?e}*1~j;XkBsdKOom-jR$ zL{Q_y+vW%x+-+>z=Bm_Cvvw)|YrFMx{MVo2Q;Pq3(Y%UU>koca4*$Aw|HFoV{l##QDo%?7y->6C>rNCfXV_7Wez$ zebU4mP7I`nR6)^|*HQgVHXZfpJNS!mEEN+ij)LLonQI4+x)LYNSkEWPII0~T?{$uW zm#qPDy~(DUZBvuTVH(rR9GZdzWB^onptT@CMOoTvYVoP5<)Nk)aGF|TX=)Lq$@N&g z<6noJCd(T732@-V)i;?-=f53YV&{-sJvuhc96jDYR9}|f@-QLWnKOFQ{{CPUvQ4e% z)ZHEGCoiC-=q***647*pppEf#75i&r*I`UuEjzz#h|t4+kj|{R(*#D~j&JS?FY54S zRYr7l8-n=jN}6Ct)`T0ep8nb_L>{*o*L=SVdF7*9az8sB_k;XPWoz@eNdJHcU@8YZ z+ixY@-|dX0!)@HsBqZF(B1W7QQ@E|)LM13}A3CJ6rTL*Vg3B0+r(Csx7mG+7u6@g} zbu${77a^{Kj4T%JEeNBkfVUNcT=-`6suH~yzd@@Q!{T==SMrYKs$Gp>?0zC-fXqX65u}Ac@DtXgi<6n(MgpbpPb^__sDU zS7jPH>cM7m3U_fp%&cPbL@rvL-?uvBydE4xY0()$)6CBsH8V|~8ecwVd`Po(R!Ak( z*}SA9KOKdF5^^n{4+=g1|{uHf&V(Je<=r z#;$gI1Y7oViu1T|m!c0yx=EQJy`GU@w0Y4@I$@bbRqtCUr|s{YjIQORt6t`2uDRjV zJP6xa77*tXO|&npoiDjLT4>+ZIoc%{2yUE!{h+IUT6|UI zS0R($V3eLr-Bk4^{wo)=3omIp1^)#o)YTvxwEO})sV1eDZ8+9HKFJ>?S4srQrnrA6 z_5xU-NK0B>d3j{ryv^=_b$0_h@!F$LAd4cyh8Ny}R2MjWkwkkdj5XBLmX8(+D_TDG zd;0_r9Ygf69WTl=fux*{SOXu>2Vu_xXE4w02Uc7wlBudaqso~eEeTif=v_?ernlvj zWdmbPMJeHKHl6e!)oVOir|%3Qx70;8DY}Za=YsmDTXu+LL1#w{RG&(V2f^}ukLK2K zABM*C<{~brFnlx17o7cQnPKhp%qeZ4A8JTEsD|V;*j73n=hO&%tFE0^tOL*?ic~_ogL`mT7`e*Cm>WmTrRTncye$C`FlI5~yG_Ou{q-a2$6*X%`$!yI~f| z9+{P=T!`-x=v95L+GM3Aj=(z*WbsysFR*;-kGH&k9ZOjfs-VLC0GsVT51c{eCF2Gb z#E;ohgOXNtO5p%QY4UUg_YCOOG;bn1ZhH{W5=VU_?Y3vhB`w@R*DEHxC_ zw09Bh+Put0Re&qTTL{vCe4#fI7v&+O4GMY(AoSnJy@YnnFCc=m^nIMMfp8Y+QH^^C zOnX*c0T4#DS}6tw*TG4_X%|Z~=)t`;qoER7-k0NZ+t&&C+$8dd17CH1+x_zB=qm;3 z<%{JlkMY0Ave$zUw@=%2MW=r#x4S~$p#cCZCaA}4_(KgMWUHgDMnkPJV^KphxoHZg zV6BLi5YO-5%EcOiqG+mCrmsYEm|7jjxzf0+Ct?fhN}49*Rp0 zUn_ID7O5-*kU57yLl_@Y=M=y!fa;;(P#_}ShR8+YOPgMCZU`xPh=z}xd=Zvs1;C#m z&mrWm(b`JP21^c#Sfs&dqetMXTN=gDi^Ef~tKhw}Q)%kc)Ph7$ zxGBM6VKJ0|z#4a*IX5D#@a=GQ6)Zs&a4HI;^_^RGQdJga>lYqjVSa{BzS~$9Q_V|r z#f_$r2M~Ie2J%DiQ^N&76i}V4-rI3>087@WEJFE=(}F{stE7nErF)R3tQbILLs&If>xX;T?2JNhD;s)dLI0u|x(OR>D(sXtJm2giwhH zZs)#Zx#@8q%(0a@kn(i!0BahOrKti@DE(LS!Vz2H!q3`ETu#>#h*i0zh9v_c#Wp zm@b0xPvPyy#HfLfmi~<^*kFg|BAGyJVR&Zvdb>geIvv8f=9H}YmcyZSUSOqNa@8U_ z5aGyx9kk2lYA;Q}>cy)R^WFyeRD0gk37ug*8V)uJZb85s(H&+iS;hMyl%ZR?0K!m8 z$t~j+snH>seA|Aw!FkOG<7tuC;jWAtdK4)(BQN?&<`P`b0K~dFRc@kpL^j}`4J3$;m;~$wB0#0+%yBwQZmD6 zor9CsomTq}5Epbl8K8A5TGK@1cv9#mWcwy;PN{PHPHV%joG0k>AFS;m5sKJ@vnslS z0=K3iI3{d#TPv9I0{oE9k^wjom>IuXUteFgdDY)r!4Oijx9!1+N`dVeign2gIDCkE zS)to87a(6mEez%%^zIuv{|Cmy&)$fvLM9eI?`A{`M0%K8B^?x`Pq0z$i7e!E2D}nh z^7uTl(YJFpXw+G#gMED`6xjYd!jNJT_mVU9ZIepsbgm^04?tse)xEI5$s?E^Y1D>e z!r+bFf_!xiSW{fYY4nPbd6}MJBe@7~T%l&dL2y;6)HlnigHygvl5upNIWg(VKDGgP zeOD-4u4z6iQ)7nA)igfoSvwm}?hw5+o#nDXzizZq8gQ)4Sa#|{hz2tEY1Va^GH zVpIh=5wJrYfu)Msp*6ZPKk+sF4kqaSv2V3`moK^N%XpYB)E^X7r|vX;T{9<%%?>M@ z-dzT>3FlF<+?a`y(H9yUcO!WRhUyqN^IQa995|n=<^81ps5Ue1j$HhT>m`eT996*b zH%t-NB2DZy?=-(;P^C&j4e|}g$$5kpM4-gNwfv!mEP_Ha%`3fa;$t@QpcnkZzCv!a zDOhs*3U-Tm1wZU7)DD|>_{+Z37Dwj2eqf6jI~G&MJh6pXTWE^#Z!VC_Y30teayhNs znO5$MJ$J{Rmj;%X2bOyS%l(0wBZb~G$3ZVil!bp4V+5K_wLuT|A9r`2?`ykTNZnV> z>*C^T*FG)b?>$y+9PT{pGzlll81$Dm-unQb8TOw5te?RC^ZsY|%l>~4Kl}7&`_G@^ zQbySo);Zrn(w#A=Ouv)U0k#fSO9G_I>hM)p|K{?wXh zFwzIy25yQ1d5bvRn0hSNU4?&>Ez2jt57X{VShFxeJ#6f_#=NV^<`O_9Df#aK^jVhQ-I-lV;YNtQy;{d%%~z8>|bC<`i~ zaCn}^qXz6;*kIyR4ePg?Ruf2RA?#I&e`y5DAxuKS>OjTEl8zArs{RnrOB>!la7q<-!VWDT8--Nx&sc43#J+mDLLY0lN4`tc>0AMML@Ww z@fd&9%LJC|*UjQZUzBKgv`O|J0fCOKl80$OV7KHSd*u9EX*Q$7Dve3us7GBF)Ly+) z%U-wUU{8z;2hY^|W(3hkyu+f=&{rYOL4h4>RRt%-gET`!N<^P}how;1(H=M{UhhNL zfy*HfIp+jbP*h)(XslqTUaYpjBc2H)V=`7-!)<^eP#$eZDaVq(CRM_t z%X~R&X2ZOTO;9)2DjsLWq08{To<_J8!M_TUdc8TyF}}3-XBZ!I`DEFK*^LavtOJ#_ zfrp(auJ$U4S{OMkl(&v%-t0r>eiY@`756lOh!*0{8MxkTau`<@F)o=vv3KiWn*#5#www_7x^d?YYHHOt={MmP!`vR@qB-t0?ohoAi0?V> zfn121&T(NQ{WiSX5NupkR)2KuI(%2P)MF)oUdGobJwpA47jI!aNwA7GLT6cgti4>Y zIp|zA!m&qBPIq>#{V^jql!e?$@g%;?SMldC?<(OM{G{(jU+)}4Ah$1fPSl?UPSR`K zZ}8))HV!+TJ!(ammCOYOC2`>eI#6fb;np=Xc%wk}v@4&};!`X>RbaIRLHPK9a7spXC+fAE zxN-a0<5LFN zjt7wVJWe4Je=3YHN_OQqjGf8(GYk*z?Fth0Az&E9P{i28&p>y43ER?vn|-3EjDd_d zd72ZRTsfdR6nn85etx{^?0AT87cThKrUTUdldtL%V7$dXghK?ofY%q$Rx?wabBF+s~R1dnt#$*RimG)v;G-3 zdeRUtH7>>ry8V=&D8QCc5<3?kC zjULw64b`Y-;2|J+)%dTSal+XxM`S{hf7Rd-oyo1VVDEWl_xYmzAG^{InhGa`@x9g7 z>e-ffDOd_DqnHZ(>#-HG3iOL*P$w;WlCGy1kx*@;IMPAq=nBjcwOr)yOXP4 zHbt-EWhtxKhED_gh=@pUwOv{UZX38Vlxu7{uxdV{w`#eEzk|F(Vie^pOd>7i(azrE zqoV_fj=a;f&p3xCwFGZ`<*gFg8A*nsiq z^b8B2(DBvT^1@?L(0uXy>z#v5@A-*-UIL8X@Puj=vUV~n|{j&=^_Dr;$g zJpzEWOH?5q43vl)0f&hZl;bmSHGxfnH#3V)TF<%s`1x_iJTA@QzF1lCsLB+BG|8st z7lMp%Q%+{?nMa7$qfIfP4eWW4nkhkg4q$o{Px|p#X z!03!vkeQ&LLkc}Xb4I(-YINqohO_NNlsagk9(NCpPF@^${LQ5fjArz`&(TW$aV+{) zrI}S4E5c95jb9fw1Qx91z!Y7bd0)6pByD{hyvSm`oS+&nS>{9y<2;%6vo#^R zEq=(5il}_VROyoTPv}cS(JY65jpl2tB8oJngR2tz6F`pNmLs1db$yMv{Gs5HEx=@LGXgH z^l#(wyM|o>nz z_q7tl(T%dRcobn?1>e(6TrfG9dF}`f8n_N#o=e)U0Y!b)sz@e~c7M=89hH9R>xsx` z54Z^u-_A&UirK}KNe?j0$RKThpE zwy3!IBY^4>Y^=+$THqMN>uG&+JIxa%#%QEqyMStf`>uW+2#XS715_3kw`j>MjG>7m zRos*D>mW-;c|h37KoxKy@I5_%M%NX(tDn>Kb(*~~3hbegOZ=+j4H6*W%mDa=`=y?Z zL)&!H=N+<(3cb_Pmc6qJmSW-8nR$7y3pyjB&iO}b z-Y8~UfiZ_N!W)O(0vCIT3!y<(M?30fl&O>Qi)!Y@MFy^84Ei%`&kq4D*{rC#H9ZRe zCydBMf_U1UOj8r$vKAL$Y>gS_KFQ(#+FM?`+RZJwQMhOJ zWgEvx&s5)CTXN72t}dfi%Y18FE>AEEV~AmaBH$PUo61{wuNc1;7zKld9%?*}RQ*>g z4H8psFMxsLR_O_knSTRt^pdHDzU~$o2Ooi|cj0xzShygF$8DIHc8|l@EjlZ^B9(6@ znGQS=m={EuR%O9gEW#Uhf#9fV{~J7D6cJqIC-#){T6^xm`b@7Sw<3Mwwzs1KqgapJ&T< znV(l#-}lVHTM}o~s>4|c2b?wIGI6=A5%Ejbh4uRiZAQsv*l{p2`S`4$BaAV(G>EJP zGj!9`jF{*6V$9J?*38^UAn?a0{Y?TZH4L3MBLL0TlAl}sDY^Kom%*q)kYQl$kt%{l zdeZjI#`Z`f!g92El+1*ICD9t)3S8~beLj(Sq}u#a$Z#J!)^YlM0|vd<1y%MN9YLUT ze60R&ZIi7Rgtk$Wo)1>kh$rV$%&no_w8~YXN;5KphPc$slsF* zPaBLwdk|_}3EaX)p$d_G)k>1~u?>3+XmrxH-+yV(`@fFQy!a0vA_4TA{Lk%;2d#4c zuLnQJfA}dr<@gU582{luMSs|MaIgIk^FKe>Y;BaIKkQ7ehofOUxe+exs3`HmLV)?% zbhKb}2$L9^!aH2}@g6RgmV!|ftnndv|AV4z+_+Q69PsMsYl0ONgafLN+3c`^l-EfY zj0fTX?G@|w`k-N*S-?8Yc>tDC5ZO&MQ1T+bQ)ky~?QrgUST~lI0yz?IAqUM7=vV5M(2i!xstNVRz@PWN4)Ske7Eo`>NkDwv?)bZ6W^RF@AM*lzut zX7hiI&y4dw`yj!eKAIc<>A|P1&;0Yh)oT5G{{Ivo=lst&_|yGg!Ri0$J@`MK{`WuK zY&|HS{wJt81oZ?+wGj~zaK*|7Ah+H=7F1Gve>r}~#Gl#i<3PP@h^KS^!DZqHW4c8Y zsBt{WlgW=78fu#MrvTVMyeRSD55tTjNWH%sQwPqiwMo)b@~q?z-`96(iHuqSgFtQs zb9>N=p^X&83`28Tz`H+JfDl{Pys4=bO#a z^WztX&TyrxabwynYnNpD^ zgB8>er;G}N1skgW>FR|-vsmA?wW#yW>G4h%z1K`s3|4tTi7rJK0*>z4&Npybbz*{L zq3Y{RoTDR=+Ixdh_T~$z{~M;$Jdv@5Pz6~IFT^TIEUh3AeeQS2R`$^=MP0Jxa%ZeK zQt%y(vfl1KE007IR_o_Mc1CBUi zFL-QYkB@=*Rdl6CzQwswyE~g3nxXNC=4b@zF5Q>1n~Qn^P(aId3vBv8Nx~pJL9CG z=p`fs5i~QI5YD+Pf0ufo#W?;g#=IYWPtt3BWzfK+5fnqYQN|lF4xMBGQ4k1SsBfJ} zPtON&?tKmB+{h-1BKN|Z-Do&QeSBZOK7k27-9181OD)TIOVaMTIS*_DtA@^+D{M4j zRZl?-MiY{)NIl|^T=;!k{j>JyymzslCf5aBMxFPv_Vh|sR#EY$Yy_-{)0eGGko%XHT-}3}kEj`oIxKcRB`O~>#(`lk<#-}k^??>Cq zwkacDb=kmO|6b+U(N(J5FUcDqk;#Z$oW@joD^4^1-E+BugAc11PED{wc5PrP{$e^OdL>(k;bxgNxs!SACk)`VHU59hiWO-an`oqDXOQOVf1R;jylG^Yjwq$SE4Hss@Zf|Fu#5I^K z0mlyv8T>U*-55*o$HJX!keNPYxC5&;Fx6+MtLi4sC&>*uT+9~Opi!WFX+RL4LB8Cf zxsnzU9Bo_kMG9IfN*1R<0FDIvha9SdB)1d;`dkjv;pOy_vku`F;odFSYe7` zzR?0_}~?WI1R)4}i>tD{-3iMIl; zIj-DA5uXYBJn9?Jr5UNZ6o!z4no%!G1l6r>DKfxaFR@0ziw~rjs4cijj5wxWopgfF zp6{HpBTa*M`gl(4mLCuez&NN_C(9spOs(a`jhY12a^&k&J%jj1G~_igWHj(Z3oy`I zDQ0pK8&i*5B9b=NpA{j-V9ze?r>DCHr5La>W*-bnSa@K{%;=SBciGKOC*$)$9g4@t z)+I%0%xb<_s2Q!IX{T(mA*1)f@D%c_I*~sSYO9f^6FRa6dFv;rP(n-e=vBHb%wkeE zJ|LJWnI1ygskGK;uoWhZ26}DqHsJd%Vek(~7$Mpw=v8Q1 zU(uN#auGViA|(np%oPVxBy~UyB{ES%4gZ8EeNBlh6_Xo~PfnkO@1xNWN|+~V5u&)% zCWnv_=<@7_6*m-`{`46dgEuS%LNU^w+fZ!cAKS(vtZWZfTsDNkqGO{;JyKR|tgYaD z1hIbLC_x=F9xOJ|UR*@4pwhBf__4s5v0|z)bh9F{YYlhZ!BL3)d^{7d3R^dvsJ0~2 z+6p}OAXgm+lE`%eK(oVhJ2N$P%}ks}qc&OYkmT77q*~9}<(LiCSF@L$f$x&lh z+yi8B`c9RrGiO2a8p#A0tr6K{D7A^@@B+Ml5l=`wf&dqos?pa*T9#E&1!gQ84XGM} zU^*rMZ3yL9nqVh<)=P@$!U1dwBMw^;D)8}|o3t1uvqfG(vmq=>ikKGw_E);5{xS9ZN(Y*X$s9>@K^GR z9r2t zPEp4%CD}&-NO2<3@|fsTJc7)tH+aG%z@a34@AgNFU*O1ECLlocvII9q1y_`bC7-} zw$4GTTOve2mQF!SxB?mva{hzsp58j#cQl+>D=c-%bEPD4v&v6rvbX`U!VTwOaqPGI zorAqCL4f5{6r*0UqfZS|+eUUR9S=y`(8Pp{MoY3bvl$=+93#AGhYEh8e1wa_jCM+D zo5jdgF3WM})U1lkqr+@c@N{Pwaw1!;r_jU?xK!g}fGQ23bLQ67PpvZ(X;`CWMkoY` z((akKK2T=q7KArFo=|vkXyZ)`q^?QY4xgMq2GmZl6zj$drch`%C-V5zcOeU}+ER`6=oAvT2W2KW z;M8)WWg4^sC9P5hm}`tW%DY?v0gdk{zHA{{#mc|ANKzfysEKiupom_aa$|o znQ9%d4%#xq)flLHxEFa^`nj^yv6Q7?H=$&vEh-*u+lvHk`XUb@V|h_3XDNzzN)g zLHdmTs2rMz6WN!2zwE4u?v#{`0n43fIS_$sH6cjs&g7g0l{!8(rVF!tB!y{-aQZ`} z1TvCM6>cVSo|eC1wSm4q)RY8OocKo{8@M}%e}Fwj5TP$3c*z){ z37L?SdRgpa#H>1gk?@$66u}<#$K4tmYsFk)+lASp{?1S>yBdllzs5%p?IdC2kgkImF@5h+6XBgOMJaf zI%!Ni!>K~TWW^{uLODS^rr#wTAIq)e9v-&DhP#y=0OFy+7lS;wzLJA2{Rtf)l%hi{ z(yiK0vve(==3tkYlsaPc7OQPjC)xw(}qsVc|iZL)`rpi4zDX6`nE+H#9=B}m? zD#D6CrZ-BlVWG){2(P&!cX+&TH8cy7sWO)uc;F$El z_jcFtxIcsFGV$c5rnz0`W(pQnO9`y#Lj=$|k5L9;V-v70F=BxMq~2w-0J+xkWwQ{I z$TpbB?=VAA_Sv&?aW?9AkuKRs$sj~1rYU4MR$B@awLv{=xoZLKD)FIlWK7_Y0{sr# zaqxm65@R8AbI+}r-{tnKy|3Myyd3sbGFWI=5|pO1wxNlQkoC}vr0<19V9WQiB8mZP zH8sMbnjIN#VNgAL2kZ9q4z?>}mq~1IJ6c*3TBefH%sbCKLDs$AFa@LyhP$#-j*JagsI38CI>@-4~`&x?^{lb3r;VR``2C0=Kqb62;bxsh|}JMnKw7O?g2T$ ze_=!hom4_~{X0c4v)A#3Iw-(|;t!gR`i2q(B(kd82*)S;PY-uaUmSP7-FOL?imJ+s zE_qHxoAB$mJi!LvFa6=RUd!GG!WvQ_lrblkGgoi8u@pOX!21O)b_Nt;w;Az;`#Ink zrwSTTI^^w$;AylcU?mWJZt4nq4#o8s!*~QbYqLvD^gXSS#%A$p{_XIk7#KcdK!($A z^+shL(53SltHWqRDBCO{o@0Ek5n-%xz*6?{`XAJI|FEULa3nCD%^7h7rcaoU23q5F z_z~cG#zwH<)rZ2(pvhk;UJQ0Lm?TNKqrlex$^AcP`u~22;2$5&jsJ1~;e&@||KIk{ z{=YxP$MgTC;2)oH@Q+{JYd?rupKi7uZa(<+kL3PqgMDO9q>s!G^AYr@%>!<-#*Ni9 zR=Uzl8+X2A=BQ4TrQw?2uSMcH--^}K#tMWHX}~>SHmI{%KUtdL=~wWci>jY%65G>MPI5_@jz5+gd8e2YL4cIuyy|b_V)^a3!}l z#i}00!Z#4%alEs9TJ>>6!LryI9>t2N$9!7jmop>Q1KbhE+=pxXzBDf;R_bA!G>pSKVD z@&O~d82(dzj1EJ~$h$n(Fp(T3m+Ba2Ul{F-Y1ANE;bERM$rJMuX)kKY6phtA)Ty~f z!|FQJIZ6sUHns0@oYqsIZKwN3l)JYFW>mv`SGyMB?<57E=EVF?jaooz>A6cG$g=Hr z2@VH8Ivfr@031dPhYj=Fg~Mn*9N4CWo`9`WPpD7m=}Y19_w@q<)+gdf z@ptSaM)^8)3CthDS|sbqzcR*92M5wC-%fnIC4nHo4%OIkA1<`eQzBJUFS6+sylkLv z{-bR<9N*vS3R(cY9798x1K`_jTbu6AF*1Kl_r>`*BPBQEiMVE`=+1C=RX?|D0?A;t zp~kSlJ47d`6xr&zE;A6~R$CGP%J-yKrp=3FO%4@%iQohsV{%<+opcrc*i?EjwN33S z7Nf-~q%Fj*04s`uuXqTfG(y3J9U7P+8q(m;9dtto@+|>}b5ncYjj8 z?soXN-(WZxr$twQ2PQcVn+Mv_(?!}my6OGuF5Rgyd_pd5Fc} zas%&#z{k}b#y~R|&ySBzkI2<9tbF8$h+e(i+L2^Q9X zZu)qD(#4E=1oWo2EKPl{c#!qJ=9mq^`WkDRKBB21pJ13ye~MVK5n7H4>B!1J!fu7o ztggj2xTbdGKv!OynNi3UoLm9N9lDZ*(cq9|EuI4@4i2;rN4i#AP&Px8#~QO;gIN9w z{#`~Feyt5B7gw}DKjx&mcm}bpCGwtV!(j>g510GhH63r~BL3m`MJTOmpN*rjG0EJW1oucTZc$7<88qFt+a zLl${vDQ&hfhmG#V)Zl&~e*>TD^Z)z<-Tuxy z{~vtT`mCJ)W8>k^=l@Ufk>~%pzWp`%KOUk1;DgQk4>mUfm%mTr$r;4f-_1rN3=O;J zu|6x2$N4+l=>F7+JVIuNx6ICAXZ&>cE6hgPq;49`Bzv{`i|O_fI?O z+lgdnF5}mH2X)@OCd0|7UcYWoP;7JEV_Po0ylV&0i2mqa49TAGS^FH+EUF`n1K(DI z%>4$N5e{@ijg-H(VECpTR5ZKosAkHon28JC4ObBg)N^+TxvE^`S969Sj5Bi##-RAN zetp`wa|dibaTL>rz9ef#dd>En@xxoE@~Eq)P+i&f{8i_-zv=9JWe#P%&ivfz>g%0@ z7adVrmo?A1ZD(xke$a%p;1OpXOY>n~Bx&!ap0U|0sp5M?8(<%>>R$%|JnvCE8Qg-R zQP~YNP8&|OF5YiNZ`~1?LJ*;Ydvfndiw0We-nkQKITD4iX}kPM0ltR$MKN_=5%$&@RS^2)#+1XPIt;6Dg+oXEGrSDDXuDI;D z@4`q;(!D}z%A20j_zmoFeLr^YU-;HZ?`yh0&}nWm+K)w1N_2C2a(cXf_|)cnu^#oM zv@xeIPCCbXJEuFgG)oqjcsUEP`Blei<0NW2@J1`zU`TC!EkzKUq6-y-y+{?`KfxmI zJ^rN{t&2{Vg}Lr=U)Zjb)LseAoC;i}+j&T156&@=IeqD^=-oQmtIX}tRVGS1uB|}; z6nJ@Q?nf+0u#|6d5T1@UvavIQS@cE-livDy4=<|l0v!fm)`fn;m7;!Boi*t6bm#Fw z$L-+)JNQ7&e|fC-l-qvsAv?hPGPnKldpEBLT09*Un{uCSut%c5{Q;4R%V}xX)2`G1>zPN}%F9A08bnwPH><%u$D{cmD>oI0%L2OJ8!7LTD zsFi@OLk)GFSY}p@asOqoeT!?~U5p$Q0!+}R)f!TB>T`r=t43bb$q-^!=(z#Q|IAV%ZEbvN6 zv@WPKM&*6Fi(xI32J-zajc_$s|w^&_&y&_<+A9O_F>rG){s1-8?!a;cf~9x7du#ltyo z9j^#(m}f_O9m66+QQgN>`;yFi_o>B0HuHF-Riy_)6gFg|RZcyB+<5mTQz`X`~htgdkDa3G!R0 z@*f?cRgdKJ&m$oyMS*}t@>91nR}~$p$!zZn_auiJTb9N^ST`6Zc$;B_wx_$85ZaEI z>j(p@3!Wbo%QFnk&t{PE7z`mN;Jp?w0&-!l@I%0y_ex8n(8qE;XuZ@3F6gctZ6SE+ zO&~peJ~({oT~z~1e>;3>0wQ4W4Ao4ka04c@QlaPTLI<}7% zg8;9B(iP3I^vZA;Mry04u2~<_%?Mr%t)ILf8`K!RnGUq*CK>dPc_A7u#B|wGQCu2JJ#2mXZc&l@y{ub#u1| zJ5@=<5KAV(ARl-_^eIY(WivIomwMHG=(xl_Hhnj#8QA!wLa)SZGXpf^aM_i?$~G|4e2 z2*Aznb}agH4;TG%Mqg}DQtlD2h1QHcOK83UW0c^uD~wi%M-SqSxiBkXjtCz@$m7l! z!dReNi#Z?Z3B{ij*cR@5n?}B=iAH!Xqj#B$-?)hfQXx)SCv?E2ilD}q@wMIOJ&c28w8&K{q`V9|uX;nY zDx2z%v}ht%YDx7Za{cLW^$;&owLxA6P9qB>RIARQ#>x;KlN#)-ifr1uur3X`?dHLX zp7`f7m7O}5+bfTEPWE@ZyZc?Z7;xU3h+mc2Ebg@%Ivza|<>5JJuQP1LLg_K|;8rQ_ zfF5%$hir^r@7`sMX|L32>=?8FhrcSK7&N?!<=F&7A-wmLOsh0}FGQk4XV^WtL}dgT zk7O{@OuZUj0)YHb(C$%P)JN=?HpHAXCJdd;3OXuf1s#>Mf=Uu$gSL+XLEF)gP<3V! z2Q;{Ekrcoj0a;`l*@`k%iANY^I@f?RpUj?TH~tt2|v=NWtxCEw!x4irx#M=e6oSBS}c!(2-(MG-R(b5^EK2=7~>{ydcxc z-T-$%h`-lKG6vYX`feSfh^>!M9#!qPa!YIbK~e=peelsO-@(2VVrvn5?q84La`@Qmc#1L0ZFJ z2H>~^KPj`ojK>udCg&JCS?L*}MmrXsD~s(9?I>X@j~A?I;XKw3H>=S?HNj`XRx@5K zi*?IB6QVvF)Gs({<2PYjFubZ*;EIb4y&M}Qo|M(=hVo<7lpx{fl12s3ItfM(C3%Cg z*EvDhvz7b4lqcCKraikZL=67~qF27TNKii>!@Vp-`zO({2a$ZNDhO^rpcU57ksV2N zn5AptMwrh=c{fK|3aXD)@lb`r`FcbUhH$MH3ac@kF2Q%X32LNrD@B&A!wCdm2*5GxVzz)#dwy0>VFH_0|;>os#<7;6a+>c-n30y+@_W4_cAs8zD3tT+wNQy-5F<*!1gKSj z5tq&p3^aP0-vMI?9V8t`rD4Z+>o6Hs-8uFp){?^Erbz#37Racr40aG^_=*~=#!7L^ z3^C8ko5Hw&mKYa(nBr0dRfbZ1$5t^H)~v-*q6Q+y2dW5#t<>(#Y1`f_m6eY;GmTbo zX(ZH`_8Nk1Gzc5(3jH>i^`brfM(r>Ie1`!mamP}{=y;;aD~+JyG(7ql%2SbiQ0hJb zr^q!ZU9(Eg8*kWRx(W~51yzOw5_EH@U!Ln18;yp9shqaaU6v>B#p<7>k44iOL})Js zt%TdiXP(Pi3oxq=1b8ahy)3}mGw0!2i0k{#F_92)VIN|3eJgQY8yVfI>TEnx_H{O< zBULq77#TqxUG1%?#gNK60X~&?wP8_F9}k%2Jb8-wyX3c2QQv=o(aP=VOd}bSEKz3W_Lj08Iv*lGP1sXt+sD~g8;8! zAsf~6Ng}~GHP40#(r(A7jKh2aHe0n1$LKEO z9or_@FbMW|5kue$#s4$12DH&#GiRGXv=rmT4UnMC=8Q##KEeE+!1nVSvilTf2Ew)m zThQh;uhHxe-$iwF*2Ro)H$4#M-_P8X320ntL8%!+52AN#GC?=z}8bzdwIKQx3cbuc8OeE(C0i$Hr#^Wae3Dv!?{IDj0 zYFc~c5JCbG=76_mXLb-Jn=>O3UiwCJBC$sd!j7NMBhsfN#Q&s;3Bz$J;boH8(2`^} zj?jgLv+VY#xXqvLma=w7UbCu^_6h($E8-ChkCU{-jHs&ZWNfbUWXg6OrXP~F>z7k6 zi2rJfVPymJU?SOVv5hFAu9E|`-Q@g1q0|}ig_|0ZW?VHnfTdgBzU9n#elkV%p946Q zZngL1E{?Wp12ZE+T%+C+I54PTG8ov#Ff524gm)e>Fqge*wjBS5&gN~)K16>E9FY1v zR|hEO%tXNwC(N6b;TYm(%vot|8zPe(Leh0{EsTMYII=t7BeZ65DcA`%1IH8H4u=el zFU#Hq!RQ=xX?^(OS@(43=?M+X@LsU}3+Tf)xYy6OjHxf&^T6Bz!6Q%60Wb00trpO# zi!~kel<49y8*b?*<F>!aSk^B0;wfl6&TgVN6QEOP@nkXt z4R(sDf|g}7%v(rhyKR}rX*JrpIm~%OY4gb7=5d83*WJs*_eOcM9T@rv1Yw%uWwI0m z?G~`*&J;k=^gHJ9)^U$F7MLZ@h$upNlFl_;1@#EDPB;>62Ye5J0&i&5G{2aGIqde~ z&iK_BoE|4vkVn8&r`U_sxx515k%?(zVgmEtww5Nj#to}ouJanZ8a=D7)(B|S)ehFc z2{jsyO$5ll6cA)()5?tt`{b{38T6UaT7ep+poJ|yc0 z=H>&8rzj#UFP7tEA+I_db(uU$Z2Nqk;}x3`(6ulfxNP&Z5os1(!io3_8dx?sBZPe- z%4YbS?-sFrd|~pLhsN$Ik@XzJdP|+3X8!#}*Ge`*U47}O>s=guwC(V04Xs|f z0Gfu-P`ePz`&y4O;&K{lMa%K$8Z&zyWCZPnDL(S%D6i5DKCdDFu5dmG4u-UFXAj{E zj_Ec~cJ{5*g^D*#;acxNc}3PX;@^VMwOXFKO;KD1x+cON+jW!B-k!SC*+8azbsImzaYu(%FQ+4|(7?hbj38Gvw*zaf#=W)<4H#kmO3Sqn z2v*BySy{zlTtK0NwQX^H)uq>uTn)P%8Wqfah;inG)*i7^!K?qVs4uPu?6^M{0X7!f`@a>YnXaQ`+ThY=R15g$wm|2O_8w*w+` zX#quxx^V`ayDwPp%VVOxXZ%lV8%VY{Bbpxl*$_`8KGQDm{)#K zi_(Lv;kQ(|6yZfjn0QT)U)x=>GO&Jacu{XuMQ}$&hPx^H_%^6 z*ps%^v`ft*QL>KKm&4TPrG2ftl_=w!MKioogS>dSnzTcCIdebmy;$Wnlvb*QnP3>+uVcz{FKrGxWQja*Y)DO*yJCIyQ>R-3Y@Zg_y(`hst=J{Z3dB&;4dBi?tl5u z%=nK#P5$RkTkZRP{Kt*Y9{e2t@u&EB@gFJrbL-(^383FO{v(HVK6ipTpU({GOapzM z<@pefOr$Kiw(kiH1C^V)>Z{fVX*79RokMDiAi|fR886uijEqkNmF47f?#oN z_lBj#)PjXgh(=YKhA&#L%c(^$0dG)VRcC0kD#NI}x^keQsy1sze3MNJybA>!0bvl* zj1lX!tYp4q)ZavJ3H5d(T4SX)y7G|~A4Xl+Xy`Jn$}%lertOqL&O^VtuU<(}Zrvn!x;SAL{fr%Cl&v|yT$c@?jTTDo?;+o6sH$9^qC zvMvx+R-wI}{~a%^=XEeD>a`OY*Ab@fxMziW;=#?Gwc7~ZQas(QU0TWyH%8M;4tH7mEaf^P7P`_scy&}+!swXFyQRQ$n+pJMNRS0rBW2&NwS!1Bt z(je5Pztu2s=GC*dxd?6@IWd$0q0)vgTsUl_7cLvPiK%Ebq(KiCy^T7ix`kULe0UFC z>C9$kYT|y*`0#J@Q!W1w(_!&pGC<6c|6BJzE9ZZD(E3^a|0zCF{-+ghUPTHUI000v zeXsrNNQwXV+ncRcSp%@Istj$MRV9v(hG&zQoQ&bxO$q(I#k2zUV1jXYIUo-9AJ0hv zF;$~D^D-^O(`$Zctg6UaLX|$~9w+A!Rm;DHwCtdn{h?OFI6vU;)rCkrZz1{34>*LQ zojo;-!<}axTV$+gVtg)2!TpS12-!SaWdEpCVwl<2M<=D%S#DpSoF13nlfJ^1dA4)< zWvS3*TwK^9d*xxG2LhFVo6aWQcfMVEyG0qMRQc}C^L=wJ9CV=;KreKW?7?|Om7_ZW zs9+3%w*Xz%9zlcz{OZOy8c*|!o{pXXET}2m*m4T7+omod5+I@x9Q!A}%zDWVJ0oi~yTMsr{ffPV$ z*Qb3YJx2TYj-onPgy%Pki@t2|L2$Du@i#evlF1~^ASIAY6VxA;A0cUfG$)%7&gs^N zi9I+%CyY3&_K&*zhtFR~y^(r!^x_nrwf$pA!v_cKm!K9zn~+vuW}xC~5y}lLJ+FO|Z$_Ww3N*Sf zrf61k$tLy0#Jx3sh*gc$g4J|c1*7DgZc~%gozMNSp9hQvTMG)Vlk-_Ca_ecr!Wm11 zgRW|xUZ{%L6*O36wzajEjsjzp)!7&tR?xpwuRqy8=tL_k4Qve6LB@fgMM-3!#FsmV zdk39H!$rhl)YLO+jyq5H z6~pt}{lmS^H>I)ZOL%CO;|2WjkI~26ka60eF3hV*{3iMRl;UEnwFz1wG&L^!F)oTQ zfI&-P3&&~SW-4$R;$XwLzMYC(O-Z%Pyp!C$azRBoLipnG=6iTs0;>vrT|ZBWEdqCQliJBH}Op_ z5(m7ZMwewdiVlU&ZNONvT_B{)R*QuNx1v15{2&y%eh4j*b3=sVZ|cC**s6LBtB1Kn zpg}hpB!ehT-pm2w7@#Qk3??NN*vsL|s03|Os${cmi&?_3SXVo`v2Z}-!jIfux%#WN;S~8y6vn33WA`WGNVBHsR{1cM%cQ$Tc{7nHq1eh`O95 z6F~F1-uoRyw>y88YR9&!^aTCHdyk-JH^SfdEL~>1>Tm3 z*5EzHQ>V&xh)aSN)bBeU#a)E*&Dzre$e>!5YTCG_2z8B@!`YN|qOOkA1O%=g2215A zI6^~rn5S9F6x0$o2tbe&LyexD!>{*`j}Dng8~%qp?=uZjYxIV(JJrcG#RvzujV*=c zi5M7Fj67_|KqB`D7SrB6UwGSg!}4H_ zXfr(Z@n7xSaanQx2a=ck@E|BI$BP`Cp)qpR`mF{;FZ{t!S3rvbybv+tkP|$)cJ`B| zs58kJ*F#kmY(R$vaQWA@){IRlc`HL|KFJM_LfaE|90`QfFI=g@MQJ(xFcRg}NMyVkY(N|Bt}JBi`N%kz8lwgw zv>UmS#ujK_D=jox3D9;_LoD7L9r&ufH{tfc35F1- zV9&V1v{@ll%&<(JszO&3*4FnxL}0EK5a7)P**p#N3+*LuG|?gwqnMH+&*do(LeroD zzbiT#*f^@}StwCC1edvUX@GVC)a+SqTwK-jH$zN^mtbrGNPVH*9V0?NF1ZMchzRJa zS_XQ4X48m$eCv~SHW3PwAbrYK(w{lh$5|uh*%jladacrvSt0F*?RWZM287Pe9{hc` z7Pd(ND{u!;yUS@-yp6~wsNH*qRIG0fz`PfygZhA${qV)J$DQNu$?nc!GrCK9l9sPb zq@Dm|{UD4O4-6B{#57i$Bp!~8=a85HSTS{ztYr7#j2`pOfG`tT)AYl8klyyEA!Mt10I7F|Lp56+`TSk1EXB_jy+!bYoQ>bOmDu&00$81o#t+ zh!a=v8zov8B~M;K{d7chTvM>1CQo~jxsC$(aw}son-NOnpxYaNJ6dbKgq2wSE?sWO zF~@z3xuFKEcBRl5%XqC`DKu$wviRtGfLBR2T7F-kv;-2zpre9_dvWSEZk%LF7zImR zIwKjSnkF8i6Vo0bN1a||Z=y@gNR&l3_>HbK@sli3U!;W_-G~|sV=Z(YZTtAffsQ6O zW*m43;>ajQ>+q6~KI2rrAc|v$j{pGNb*isDFgiVUMqwP(0UO2n>%@35rVxO3fU$?i zMzsgsDhdvbY0415nN-IEO~LtF1Cr7eVYq!g&sXU(LzN=fXQVeej-RYd< zscJFaXvnbm%z}1!xv1K-6#8+z^ zP|$InOH$NUQKYqe9QR252?m8!iQf(tm!5A zd7HUuX2eddMGx>CFf-bs_SV(_cQjC=)Y?*5jt_l`VE_#iGMSEOCqz3RE1>$M?=16* zYchRH<_?d^F$nPb2&Oeqg1aSL_{dV?%8(tB{1Wn6j%FabfR70EEn6RP z>&Pn1ZrexfIW5QBvQ@C!Piaa1p{^Hv!$##-yB@-X0L|{6O2QQyqS{;#eU$Ed^kc7d zX{0)4iZ?jioTVF2xr}NbT*if5#+^UgW zgCcLWl<%vuXK2#k3A;a|8mz7p57Kd=PYXxUX3-mN5=JnH8`i3Q;m}~KhYOb`Jfd#G zyR90Jybe5r1ABoFEl>|`!ew#dC_zGIR3#t@Ek+4O?S>KD&yy5{b9Fp$3SI<^7jHi2 z!`MdY4X9D7RsufG^@d_ z7Zbl7K7+9;UHIbmlV_*eD8!ybFh=C4Hm#xD)M%*Klx z*~G1*NtU(LaTQI1e;q(BHX!0vN;z-UiYvv`-*Vx)`$vb5pEM)&_X+LscOO|G^ zRN!p{f8jLx0Bc4%EN{uw%=QUBQT_+9Y658YOG+ct-6X+1PjG_Ow0*!@s@?ks$3Deb z!wKcK-f;G|Z@@7E)~R|Ax-AZ{c)enqH_E*^%l%G$nH8vR-Lr{D(^TPkK-L^hW0ygu z_%&>v9^+SjtW8Gs-48!T^)o%julyJk-SiZ`>4#)&+O#)5{9;AosUq`K9f%n(_fcx)3ay{(D zqi83MM>l^+7L5NTT()|^8Mq|QU)eB5V$7-pU?8N{ZnkMf2(;BynuMKK|NK%)eB_6G_gW#ibW zGW+>q@&?tEs_GrLD&2+SEua5*vfQBjNJqzeo#W`ZbJ98fy0ZtQyDXI|Kz^gx)z?Xy zM~3~5qFRh9gc>UJ;Y%N-Rgk>(-=X4|sVu1*YJ-^Hs?(4}TRI%zyDdD#--rqDB^}bA zjC|yHWuO5D2%P8MG!T?MDEU0ryjzBT2dG@54l8y;5+#iP2~ zY0UCLO|)Gh*6*3VZAAa-oH7_{wiTSAqt&RTxYsj!lZ$xJZsJ6He=dqb=pKFhb9%2W z%qqU=s;xu%Z5UB)#H2tcE`;k$(D>A>n%QP(ls&9e=VXNGD7N6tPskYQ29n9QFvZo? zmz?4SRf~$bZ@A%Qzv+TaLeLhjD(RTs5u6W=Aa;5}w)!gtD@0E~?qYqp-XfHKjAwMx z9SpDQMQ-CNV{V=3O*ZN0B2~OidLyonIL<0x&wE|0wjc=m>Cso6!|p-nkh?4t$cp@G z-E<^V-wan

    fDedKz!lqMsb^T21q>Hq=W=8SH4EA>zM;NrmJbFUrC zpUS2_>6u2Pp_&|-Tr&K#=Fa|QKtDv_Ev}1Ggu`sW>T7H9h;M#Rzv_Y%wdp+J{Mc?O zyfn~IFvMy3yNzX|)wk36U03W)OsYy{ygS^|`~gX@T?sIEi)wn}Pua0#&(BLRz&9|I zZwYB%vS@MC?OjaM*Ta6DlDdN7TR{WQv+1OlD56U>a5$=I+S3)Qoo{~9XD3~158lAR zOD9AV8ZbI*8s5@u{DBD1YUnj&UjF_BTTlSvl^4*`!qQ&1xR_*bbPFgh9Uq_k_V5(* z*tp=#Z_*-O2%<)ds5m;3=zZ{K$+Qrsk#$Y!q}yatnsKO#e8z1FI||# z0$)WE_e5Kc=!CZ!75fq-NiGGA4b*=Z3V@pOsxxVFgH-;NDkW0j7R4}!JNk@obRn!C zX?8Lz09(H`s*RS=euzrP#Hz^4$r6G4GYI3t%brG*8AR{~T2f~6SYrAR8k&1xtFza` zar6p!KbY@#a=NAJa78EC!;dj}P=inGP^-`$wfkKvT3%gscZB90_76|ZPH@nY7zf;> z=#^?Lph#6)#^|I7xH&W<7w>+ze-y3!p=l9`H#=dS8eu=_jlq^lL3w$7d5fO{5+3Lu zqbz$JV{S@5jDS#fj!tZb993WqOVAc&l?U+Xz_IIg2D$JO^`OHS&G=LubZ9ssp3$h` zQU$*-5`-BfO^cgu=4@WJp^nkyngY6OOZL>5kB+wNJ?Y&2&X(m$MC^RCzq@k~?HukL z{PuU9?cd(Tq>guuk^^@x8S$39#JiVtP|ofK;IbaH zG#VHOWHIEgMdldirqQ-NTane1hpS@&7e0Tr1?k$FO_4kPHbvt%=(Z8jFV%5*+=?!m zE#Zy(B)QyA2N{6ya;U!0s6iEvmREG&x~Z*rr{g}xAV1BP>*e^ynXAc{ufd23LiqBU3>#pf19wku{p6UNN`lkO{bxT zHASWw^vx8!!E5iiBe0ll_v^v+XhwG#T5FFc#;wkSS%ms`?O5+XY|~^kq)S_43*t{i z&Y?-uWozMnrlYyk;lQIFFOxiv&uxZ>fDEU`0E1KjAR47u9m60BmQD3xtxf!t%Gv-D zVp%MPPU37E=KbOMu&6ux5;`^};K4mzqT6h=pzCy&Ti@P1i`RGH?Q*DX)lGK%fAAHDi^7U$Vu z4+)$GsNogMk8}}J%R(uGP!8wpb)?M>eeWn1jh$VmZQW4#?Hv8i3jbwtST|Ja3s55( zuTZpZ;*0#b+5`NQYWK2BP?8aSReYteU?%Hm?V{i<2BeWtpd=klzfMZ;XU}&|y9Y|N zZ^+3h%(nSD+3=J%5OV#1bs8!3XW`}4A3zI0ZWxp|7y(QIsR*+}-prxSySU3=9Fm5inZL+q2 z&qJ-Q5E>EU(n1Gmv>Mgh>L0+c<{}g%s*n%V8PQ%bO*JZxi||PSM?pUsRk3A@9)llm zLn|MQ>PlK^tffj+5_Z5aohCB~p}qRf zA-*#KZF>a&AMkQs{w`kLs&W!KGlkBo3k^)6L3N?j6iTZLO-!Llb)mu(Dyj=znL=09 zg}&3iTjv>MgvqAo7v3pmshmgKLVSl=a=!&YY!4w&O*n~%5J)d&ISjQGKu_F31PB--Agk}YAs1)D2_$8XL*9G&(8r=j-0 zn8oKPS`XR5wHEQ6&%f3}=U(-xS2o-RTaJY_4pj`uyT}o9Ii?w$QPq-BJ8Moe<_&>b(YpahE9eg5ff6EB^(Grpz-%xfxlQTK%liV zun@~FkqQ!N7c$%Lu*bH=9^3ZE_=8~NEC4!xzvX!+>j8ZJo&)%Nu>l-(ss`}rJqPe; zu>m}-9Kb)k=K%g;u>l-b4xr}K?`3C1LWuGWw}fs}6c1y)+vj>osIHJtLt5(fTEnBm z6@@$ssRy=qbPAW5K%&;y*Ihy=qb;eTyGMt+JEx|wEF0LwVP4g&)Ou;9eA>cS2d>&U zNK)wjp-fU7Fe6j`Ltts(Hn)OJ@^lEp990nBjO4(DR=G^eozaI_+VXJ{fNL16KLYfe zKI75&B3|U)!WjwNIrr7e;Q$hsXOob%nf?fK4>`_~^e|(8IQKsb-?Yg3x8hwF;akIO ztJ5c%p7_Rk=wwu~&nt;)#>B*{z819+A2gxUl`^bnLaMrhuBCIux7d&-5}rF=A3;avq50y8>4_Q-yh}xqH`O9!7)Y@ zCS1_7VxJJZ@6vO7H)rfX5LCvl#k11WqY1*&62jofx1}a8JU4fE_PwQMKl}cCz|U;| zpNkLD$DI6s57ZCe|L6Y3#?SsgKgGxQ|GB{Qe-D3U{D0c_!T+ayfAfC(L;3&wVmL?@ zuSG6A7p_Oo#nN0~9OF4-b85>2?@s&SXK15x8D9@Cr`r9|;OeTtrl^gJQ14BBd{dgl`*=+<1n zn;HNH%2`hwpr>%BkW4Ni2YZy?T%KhkxCKo!uu(d@@x2L<@+$(nbGWAnsS6d9gC8Gv zcD`y-p}ixzRyjE7m@oTJ=<6XBf3l-rJ~=w3zb_7VPxp@wxeYGAe~5n$j&^qr$YN-p z{~n#r|Z{k=Fmg-erL3X_KJR z)Zz_Igc?HmRWihp6&l? zi%}_xCzJSwEFb6;e1&m2@VW={@$T)M?gWB`xNceCbp+mYu(PHqxZ&y(nPc=KGvn~v zZ?%4uxvk_fR$O~8kKm*QvmSQlwGFfR9=RrHdlDQ1G_JL+d{#pTr}VDWg5e!>Bbq-X z?`h`MVYYD(l+C#Jz@~}qNkHFgxiq$O1>0a`khFjGk9Az%pT+_g{W-|asa8? zraBi7&CnZ;F!iPP9tQ_MqmorH&-jTVC(JGla#nqsXJ}i)p89Z&2tcsr!?L$# zp*f4Fms~pNm=(%GeM{@_IWn4W8!mf%Z}*1q@B`vUxL_57T~Ye>PBRtYUCdp?9ml&k zg#DZ;{IBUVgZ~E&dj26qfO-7?gNJ_p?@v{QpZWiv;^XlDyy7SVeEMsf0sOP5_1R{t zy}7Xw5CO1KGdhd&VK0JHJ|_zU2;|Nz+baln8jnWEP^|TnvD*F#7?dLCG(;=++lmg@ zts_0?Co;Z(o|2b3R@K2^0)b!whEYK(_hSF>R0%$#sXC{M`|U0N^|Q`1czKyz`mgW} zzd$aJBIly*Y@A2=C4`Vp<6=6A6%Sj_Gm3xy3W^~&U>Hp}tPLZSBLiglJmDM*0|7T* z>3(i}x9^zHzV&~wL4McT4Y%w8%t)1`IYC+e#$}zt3N}$){R6fX>Mc9UkF8$5rh-f} z#Xn_dqvVn^M9TUc`TYXCO5oKS^(`@d;aHahC%>N-&(U^$tR_{rF37-t8qka>7z2oC zkP#KlEzv_zgCHKMTKdY@MH?jnbaxK+pB_HzDDa&|2i+H{7FO7zHaV6s3aziEIi$ce z8S^Z}mMII1VDd{{?d-Cj#;7}udxxym#6EELAW4zR4t-4k!ozg!0>bh}m=XS*b1|r` zhda-x_(U8Eym(5k$Ms$_Y23L}m+p#ilUtaRacJfxU}^$`{pWfQpFu)BYF_Qc!8WHfIS7~X8{79jeA)? zQG~d$BrsHyRkh(vUz%L%T||-hF}^;gtCm5gWUvB=qJO9Ta6?yD=L%K_w?`CrE)s1W zKtbo~dP3vu4T<*c2ID!dA%^BZKHYf?^wV}FpWeCOwrd~ilsmMREV^;WPtyrvW1c#V zn{!VswUV`7JNpA3K)gEmFuKA$l2c}y+ETWR#X;Nt5S+{*EH*^tl5IFIbbmiMjc>{E zY`vAhK@^I6lMJ>HTzO8i5hYd8q#qfE3rLR#LDt|Jgco0RIsyR`mR+GwWJdet&hZ{D z{AuUp^u(flmiD0?tc`7njf|595;ME>wFS+;Ygwh5|G$ij3rKkX{xQI2^Z%{;_c!kQ z{C}(U;Aj5-r}#+z->f(Z0H2Wnu<@&V?N31fxc_PJ4&X#5wS?*kC=KC8fCD|=Iv|*0 z&S3}+!wwC*vA=kvUi`0v{l{~{e^H7S?><2tdh|>cog!U%zHi!nz8}@^ueTnw9{#%h z>BIXEfA#Cneto}v|5pz_wa4u7&ffmc;Ys(o;_CJ~PmepDsQ!HaUh7vI>l+QvV;x4` zjn9I4`EF~tdC3-XZxbnXq3It{ciGMFiCB>8&&YVdI<(g4t8_#?)~(#1%ajt zzE>{`&IU@pdp~N^EY^)G_+Gs%I2$PW?)}6Iqgwo4xE3#r1o3-eLA>zt#P78}P`kZ& zN9~H9no;O^dm(&JhNA`XU6p+InGQx-Hd&D9LDBc<=`suEvk7#hN`82Vsz!sE0{Yn$ z#Ev1lWAcvym|#PN%3<6cj-7bF_HE^h!B`Hm9VXhpp9I6<1&H?VC&jxjhLWuo>t+mL ztv>WpjI#5^dRGPCeU7SfYh&SlS{v`)Q=)jTh57+?$UFDaPZot*u!nnPc4&T|lW-2I zMf+TNmp%uR3V1?^q+)MPszIwZYtnG`q{y9-%-@rv{=(~vMHkpFp!=!XECI?DKEyG5 zlAk%rPZMgA7TVz7IyEpfyIrwxTTA5-oNWlfxt%(JH)VSjjSbn36wEdI(dXE&HhbXw0_}=(ahbtgpvAhkI~uQCf=$=CL%t8+B^%6J4PZ-E-dS=KvVv zDk#xFTL)9F<4Sa3e}#?BK$258f1A516UH+h{#jDINs=_$KoGWUP2n8<)^^v@-N9{2 zG#!uOHUaL;Y(-euse@2VRdmveK=#en=i5_EkY2+(1_gdt&E#@i+|*>PAm=w(nKn$I zTIgNRsfBZTHC>)JtG1ri2vxgKOH3_y=Qf%>x60|atEWH0>9^l?`t|AB2&}_aM*$$b z8Z9pX2II;S&QJJe0?u*)T&$T;wu@}?Ty4)_QY_pv0ia6qu`w$*5-WH_uAle}BCke9 zfx=03K+c2bMm*HdbBrNw#Z&zp#3)EuX2dV?!d6f}_&JC@<~jV(&oj(16j`-_ec?Rk z$BL`6kJS%;tj=-!Sp6_5j4}*!Ze=I^LP-m@0{qf1Ce)N=ZFJtFzIcH@^b24{%?tQp zU)V0x4}Pr3zkRHJ=*I+T!$RoCN~#gh)i0A=>WzJ_e&|F@v6$Dy&HsqF$)eqbT+G4wgbQH3+H)7J}1(&9zhlyC}}mM_o{OJ zV6m!vPk!E43SgWY@<%_4C?$*|*It%-8AlwKR?OGx&MI`$Ge}; zHmvd2r%~(v=KY784?Zj3{XoXZ$soqCDABXzGMn5)&*C&be}_~s!Ys?)^CXw=kmCic zR=hi&Qr;Js>jHUSOo|snz<18FX@P z+F_lm*#XyKq;z&|G^6W=PI^W$8KX0}+sDg#XyeuOa=3x9stS2O;Aui5rJAqC%Q!!U z1ZdNhkCWbT0Q{fg+nW|_Xq&-Q9)}Ji1&ervLQ^Hjjc%G1Lsp&kvjhWGf|(fh_U2-! z#4=#Pe?J{6Zk%lSad348Od9PRp6o}v8jxlrG>9BK0Kr*_Mr=*SDc;b(nGF=k`$x&M zG4>0w%%$-HS`Vc#3MCPMc?cK*Lc&!5Cbv3>hog@h9O_zHo$UXvvvYjB^V>TQv_B@8 zTtDlcPqH_Vk=wV6ry>Y;GQVDNunqq}vX;EUSe{%gl)U5`fTIv$k_J#G3Nx@Dt*Q_i zWkA)iqBF^0bNAXtBBmK@#du+(eU>UUWCfUUlw2hs*^h=r;b%C1+MP^OBkY&~lYC^8 z&|t&t`BFfjt_ujYrj41<3l}gXqKMv(TP>?xY+E$k#!A~NSoF)!oz>Io7F$)mflRXKvo0eRX71xv<`w3)n_`V|@+;h)Gq0?5SxR8iPIz@%$91)$@_>cxuCJW0 zJ<=qoQCB~J#_?!)82Y&2oK3PZ2p^Qv{?Wl!M>czi%^dQq^Q<(=bp9ySaEh#mM`Y`# z%D4~KXoL{tE7fFxSJ0x(Uz+dv`9q)C{Qpnl|K0wq-7fL}pSFMI|9^^)&;OJ2$Nd)D zem%I?ei*fWz1e=S*$Oy+yf^=E>`sBxzi=7M@`loFh_ zI=|~w4zl_^iV)2jZXq<=ZftwQ)6741b(iWj&DczLr9tXx>2XF^O(kQd8VnV^Nnl)I zCY96&Mx*TJ`wooOsE_ap3nmMFgp^Zuc%8wmR+PP^kTq}Mz6{nB($>7XL1Apmy0qMm z{#T#>S=|3H=HGM9{|66S<^0c|J^1G4SH!a&;nH3izjcu*5z5;i;hmBZyHb#>IcgHW|;P~H|*0I zM|m-&uF12N`(9tfj9nzLw#1kw^T7?-6%R6=s0OcTtZ?b1)s*Ovwad#jOq>uV(E0PD zCwK1D^c_?U+p=kSZr$9`latQ#JGHLlwAB2bA9tSYe{-jHaI~|her`sBVZ#ydP-LC% zlb!v8J2mK@=SblS(6tOlHX3ySqA)f&4#obd>UZw6|@l;T==&1ylQ-vRCfRZF&}i$1~_YFL+my-zi89>(ol=IW~F~ z4@c;zr||1wm`<;o5gPfZKiNp3n%a{4$NS$jqbG_FeSEUlgvJh&0=`B&``<(l*4xeK z%jYk?iCSz?gdW1G%^O8&K*NVy7-`60q?q*y>~dEBL1QsaExDYM<9alTZ@^pv)VO1q zVyYf1Qe$?)`g`Oy3_V%zsW{`z3R496(mu=N9Y{5Fb zY(~eY2YcPaqu&@!6qeB!4*D9IgKB~m*@$$2jxC6);|%aU_kyvSv~3KuS(ka#=#Ny{ zIyOKXh{iv-_2>sUc14cfzS~Mitn5!lq3wI{f%ophJ6D{3(G((a{-_A=q5B)^m`_V` z%d!O8#bo9&?=Fl?(6{Y?}FHE&Wp zL!RZyaFiUzm&s0@gha~5>Z)i{%HQCRDBiK|5$1pD`)r3qjjfTNQt-_Ty zT+*PWXPCI5@F>a@k4M4TIEa$XEH76KHWh~&sxZICmk8hkMU6YO>9*u@CX;Vl z?O(mr(0zgd%brn^%bog@qvK~_bJ96E*?HRO?ms;|I#z!UPddk^C($1x@BNeGqi5Zd z-=3Uyo@oJ$77_=7LO=D{l&FzR8co)V8`!w?f=lVua7qnqu^RD_Jnc{V-+@ID{%A;3 z@%bbl&cXv?#Ow7h!B>6faJSR=5GR0XEuvH4K-J`~cIwQ^1Wo|6)O;iIm!$X#o1Ray z-cG+iQF!73sPYu3n8A-q^?!S?_al(~L!#eW?1}DaNoe0W1b#fK4zVTHvU~lTQJ*Ng z0w0Vf9z#eVFfw@6U5?I@0i?g(wXq&B9wKt|?4T#CDw*rp` zimJl%!xP1azV7sgM2~XVp<9+4z`K#*HF}bs3!M-h7$_o7t zBzOi9D5@Wx9H9{l90U88iVhwls_w$eiB5v8jnvHpHkvL~-cQxCOtSH0s9*+9b&dqy z05zC{&IuYTQU{r)YFjf}+)*c---uQlaC9HCOx}I|0t1uGY>gHixe=6j{3S7y>Jl_ zirnL9PH(d5sE_evB5(j<1E8~M0g8(&^m^z`IMfrF-CQ7*$aO;5`o~?MBi%6s%1VoR zLps91J{my+n0SQeE0jb$<`1JsYOWbk)9QI?HJ=~vf4y_siT+rnBMw!fK)YS_t#f>Qbj%Y! zJlRVWX~}N9!PfPRXihlBs)NvgPnGiBh8!YhX%teOl1;~lW&{pTPB1pG;<0lAahAQF zj_Kik8s0$i^v8O7+AdbPTpRX6XV2fCs4r;2l_^SCvkg{Z86|>t7?i^k=1q-kq{i5Ab_tM$rI?LrDDSJ4---zN$AL zZlv#r<0jaY3x8Mu?JRK{UDwJOWt8yF|0MqeynKuzo2a&79e1AYpPU~5 zcK>j%^9@VPgp`K;Nh2EM@qA|&4jJPWe678pX zGU>-f%#B#xfc7-RMxq;aLK~}Ak%I*053Y>XEiTken!J(yXr&24n9At{I4fLT(?hL} zNQ%ouEsX|Tt;?4KHKBUQy+Uhk@$wd{WB^J)wZAK%Z)mBheD(^uRD5itSt769?s+dN z;`2xi^&;zUD&}T1%Jo_==g})kW|pm-Lowhl5-17{QTA4#j=}-&yjKL>Yc;x;mWI9X zrg~{wCD@|DEs{Aou=mZ2GLZ{G=WD8t9gDW@i1(n~o zI`sNZ2t;B_>OEYzZQR^p z7;h`_7+;?W9dTqMnq>HXMcshv1 zeSf}hc>>N8lf+W1_vQB_#z9<3ipnVw1_W?W{jhFx|DdCuDdZU7{gZyHsM(~(hbkOn zYMamvHK-@dQ7ROA?v|jkN|M*~Ye2VVgX&lZ&JKXZPp%8a0gp$pO%`G?oWS|e4=1qW z4W;-QRA=p+etFV)-azzUT@_iF&4qk!XK3nzn!n*NS9*tBf?iFJRC8!_`2cqhw9A~X zsVb5k%wS+G0ZhLmabc#~!cnY3lOw()bhKL|i~iKzC|YB3%=vB@j`A!SRe~Qzh6_Cd z?1&^)B6H~DteHhXe<@*Fm=$B&y-#7JT(1%9u(yAVkhHv^ac;#+mcy_2kB<(Ku~0C< z?x3tCt^VbVrht0AtFDMpDm|#z#)@Vs(y*?Wp@x!CO(0*sq^ZeXL&_7qxrorjz1|eB z#5E2u>hf?Re?yq#wgDOQq(~jw>O}1HFCVg%H&uYH-Df+;UlH^dx~szRy6C1AIYf*M zg<-ZE{mKy8l553w=pZG!xNt(!$E==|djct%kFD5@Dq;5ZyY#yv&8V!_F*Hr13(Yau zkAizI)-fz7iD19aGJqnU<1EjIK#Sc2&^RIm2n#DcLh>(}gOwEU&EV<_|8{%PNwuLJ z&;_!Mn9#X^Zpj5wRNDmD0rOwl_C5*$2HBG&fMAU>AB$7!f+}GSdnB>ir${r|Cb0oD zg%gwoFxN8fwybx+wRE;4VpZ)jY41zi0hW%#XprgR-t4M;ylwo5^l~}{oRiY&lzFY3 zbfAOjXmsOYiIb`3H82-AnHkukP#{c{b!8viD6N=Nj;r%QxBnE#h5;rNZA4rIg7ZPu zRXG2n$c)XSN~S?W^3mw6QLf`}@#jZRYAB-WVul7+Z|P;|c3CF~kf)@bei&hQ=b~!` z{N|!-2k{M}GN`8>Su~P{q&ks9h$(g_gZmcOf=2>=PsJc#@R0*=6*d zi;nX-;Tm^kv4FLqR`=IxEW-Ahb{yUpTd4)d0ugCk+7Z;k8t8qo5EG{wkGvs$yZlMM z{IVu`n;~xE-h`~`X)@|6*luhI%Vm1ZHp|gUkbmzbG(icqzSQW55j?12 z?Cf#2jW^(6e}?Y$YV#-8QQOiE9}gT|tJYO^_QH$R4y;v?on_f5iBq#)CPDYGAl11O zYapm42U??{*pM3gEE~HK`6ROnZy~e;Tw)JZlhI7>)sa@*P0FZ(R+=MByP;1RvsXbR z1FaPzHSS7?XMlnmXz(F3khP+w{hL=q-P?U!{=IjfX=m2%n=Nr_38W->ax_c@u~H<= zN&H4laHu0l4Y@%um5jBEiiZKt4iB$xnJyb5uo;v#EJZGzbM1zZ;9R|+C*HyB0qgDc z=7L9&jnZhRAXUJIQuT*`8l=UcDF|7WVh55|pQcyA%|Ky_2w{421tku-h_EGOR;@To z=*H;?38H$56EQnuIT^T%dh1}&`900mgv3B zFy3DgPvHGvdiW?RS7gT}tvmy-QR*(o{bj9wonls$>?lVeD;7~7@{^4aBf5)KYVTY^HT&6|z>dk}aDiVsuWzg1ph)atCTG9b0f?HQv6^>lT0Yl$2NPNB(=?ioROFKk`N#8gL)BL#oMW3LXnz(F}?Ax{sE9`78SFl-E3wCr66 zGcMsc%($Rxkq4t;ufQEp5)dSARqyLE-i249v;z^;M}%rR)9E>gVYAI78MACeNYTH^j3E2b?`RdA01^Cc#*J{@~IgK(O2 zi76T%Iu_E3478*OA2ff-6NrLQ8PgYm4tDQ+KmZP$p6)z8=(qs%Eu~tH?K5GudAUJ5 z1=f_%9TwbFpUGQE#PT|2>FkewTy&jH+ptMER zew`BDaw1&Cdp4xw_|A)O;CA57o!WP;TG{Ea6rb6@)l$__8(t+>Cue-or<|6Vvn_?*j+S+C5Smj7h=nZ|Z2tFR}Ox5x`BZ^Bc(svzc zowSDZhJP&BnY214Z4h(_Rb8cWQ{1eY@4HRs-h?~aqA)|DsOg%=tMDuxGHWP^A*Mjq z29f40I{=H;Sq7#Q&k{74AcPc*J`5Nyd>91IGPWz`3dT8GBi6>thB=ARaEbI}XjrSz zY>naMszX_ixUpsMbNEs-a6tjlS#n!P(uw#@F7=PA?vYu-46AM>ozk>`VdJe2Fjy8q zIAA_}5GnDd%+g0;53|>Kvh(8Ll$!)uh#P|{ftGrrsa@OFuGg5`R!=mBk#xbt3|QLX zc?8lwc;Xo&%Yd%eT1dfNNzEbH&I2^>!AD_||9`Xh?hkDoN#gkZivNl+cQG1}014Yk zz&MAo>~QAc1)OBp@yUZUz}V7^Rx{$UiSKX!)~la0Bf$1%?>^sXH%6N2u6|WlS5?=; za#%MNt=s*|Y3GjWEoqI5xw-{wJC>OLI>|_xv(_*4psGcof~H9%K+<46Jm;3|*4&s& zT$qBZ(;&3$BGCjGsAi_*CvST?e08P0?LwKl{TcoBf6-?~{5Ot=|4)zq*6uv2i2wFy z{)a#2nYyo#jqP!oPJ^+N+rU`{CO9qpI}Zn1)To+crVL==Kr#xPXD?w+#oY zA_er3Df8o}4Wh|e=~yS65+E+zC|93%N8(@}SYi_rYS&`EM>xtQSb02!J1;%?wF@4Jt|wqnAm} zaoB}zKLD}6=$xJejcJ-EXULx6n=30E4B0!#RnIs>$<;PJzQQ~K?Z=8sLj^+P3gh!W zeae=5AgZ!X_>&06SHY9uJ8eaDrFBWlEw>RA{2*9sD^Xp=T(9ra6_o!rT>6gs)rf`7#g6DkhuK-DdKNvI ztcUB4>1cbMw?KcD{1*U+-EMZ^e{1r;hu;4l-S9sG^0@hB|05vZHoxqDUk}K4%`f}k z|64$C7wNkOz?&AKu)Pxjp-_Q843;*7?=}L&cKTvnroubHzN>dYwHzb{(TOso9GrYm z?m$8V7mK!1rRgUf*;}xM3R0aGtbCUrozOB}R9i}gK+zSPKq!iwdXYSYkXS|D>^1QGM4&9|p{`gM;1f*1iYlL{~<-aH6X-5tM6lzNl7KHSOU3 zeJ7VFf#2PE`Q!1MqweAJt>Z1Pk+IXr*fc`LynrUi?@N-1B=2X#Asj;_oD^*}C=K|m z??Bc+mCDRnZ#V=y1K05@XL}jRX}ZWaI#xKh#W)>|IarUpl>07(B`NE246j4Qv^tc3 zlFfo|(8`27C#Oxz7mWO>Otpop1&r8cKlx=L6pz^J6S}`RkFP+&>n9^PDQQemYBJlH z-qMi*U2Q;@i)=cy`rE{_%y_3-joFS}ZFOafvzCoU&~sXK`(RA+e2f|xisP-11)RdB z8bk=l&)@ijw41!|HK~k$5u1|%U?0pBvJwa|>Vq(;oG+^rP3wS6FyvW!a}0UJhgMwV zggG6$XxYUyBV$61BMJPDx5_eAX@Am_#LMb*CPQ&;?aI#7Ij6dL|IJ{b3IF!t-)~Og zzcG7GzW*j)koZBQ9C94>5L-#S76Z?j%KuT(1Wu_pBu}Bq+1Sk#P1Ho@LYcfNP1MFl zm4{SpjJ65(!Z!<+AF*W`Z6$-fVFHKJIKhis@JH=rXEq6vkjzEmj8y-G&@AK&>-ve? zYmC1Fvj7v&z)5JzV@)u`lG^khE6g|2>2Mg%n?lx1QdkBk`4mdd1qC} z2dnR7H#T@*IK74C3PZ0#`<)X?(d(WSD)ELM4xApsQpq8qR!LKca*yok^H=JIR!={x z)nRWM^(Eu=m$W{vS(S&2qQ@2cWnd4!d&jEAa}_8`5_b?qqm2^5ZXH`$kYPAu*p|hq z1ks%T2J_xJ<8T8}eD>0P;|#;z#^21}1VN`}u9}CnO6-L8s&J6^qW7lrh1kjerpUWV zGBY3x05V?cC;`fXha^K(ia%NAoas_qFo{w>6Ka9H0$(s3w9(M3H)x1uj*Z;LNK4GA zq{X)-#mmdf6*e_Fg)OtmwERY`P$5X81_`B^&2UcvO+ksuOMN&&8~V2jlZCD6lxYN~ ze?Cn=CdmCzf3m5UZ7+vV$Iinl$Zt2-pBcq} zE||kbMm9Zr)U2 zH}|LR{M&uP?a~;w+!;o*Cv8lI7FQ*2T-7A(8g3FgYFhntuUx|EFBd3H`CHi%^WxwA z&NQcHG){$^$j539*jGhIQpj=dk*6}^2Qmvu8qc0))$Xr2j9;NyZvvsXHHF*<`B^#t z2A&Iu`}-EEy)!H-PXNh6AQd4YvaQW!Pq?$#3}~(Huo9Lf`iy1qAi+$`TMLHL&%avh zYd$yX|Gz>CxY_#u&g#QQ-0 zAEWUEY0wka{7d4OyD9!nA~?}+pO+N%rF3v|8F1@-a3m2%XWT<#G4kLd;ZO$@LjZei zXD``0I_@2By_{n+ydMv{ThGn?!Ty^)e0en2Q00IZ)B5)=IV9-T&}oBPytnA4M>&3d zcyN5+0&(8IdHvJYuJyj-y?+k9de!}_RbtI_<4r0t{n6^s(%G2BS-FQgFr4`*m3_I* z0YUW_bEmM)N`@a}o!_ShDy4TGMg2)el5~@OGAO?euL*f^bL>c|658{^4RJejx9BV|WFB=4_ zDDL@V#U@2{ik-9TW5dT*%NUq@lI6H~MU1B^Zggvvih}KUvv5unsTnEzl=?JuOR`d~ zx-cnH-SWa(SC&6IKHS-V>6T|zWMy$Spmj=X^PS2H=**3wbKN@1RjIOyC~@5y+E=Qw ziqgq?<2Xkf>zaWO33AK3K5v!P91U>jEvi?bRh)>PKEt9C%eQk>g)EYaIF0)||$UQr`Tsp9ql^I_|r@;z&)h^u4&Js{^c zR1n+e5%mwHax|Dq`yig2eBdmZ)}6?GZv$Wv?g{N9{E6wb@rymAv;O&V;iN;Q)`rPN zoMMiOv*sNd!%~e~wuo~AUyJxKd9vSUNNCPSMHVc4ye*3fK<8^qV-ja}y^OO~`rS z16P`_=1t%^GpyCfS)Y@&8g>KL^eXh*<)c&8cTo*<);FPa==W;+&+e6(>pS(UIR9sN zj8EJN1ooeGh9n~?{{2=R4 z@9p3ZicaAUsHU7>4BbOAL9SBS zw0@YWHB5(Osk0e`VmO1Hvl@TVv8&4aEVaekKlMbRdq&bzcz9HN+!@#|zj_&C&h?bD zQyin!5vy8R*kz@KXkV%IvTS=SHBgM)?Y$XAR}paVX)u_MM%V6b0lZ5_(@{VL$nDI4 z7Y_^(Pg$+*%HX817eOCw6ekz)fS)>cZs$>cE?3oB$4wVj$h4De%N^dZCYWLuOd7!9 zbJ}QWMsV%G zRP{1WFRG_(N;5`Xw-q1SjqCL!D>9-#75WrZHp~ogLyL=JH>_E%oS`t$M>2>jpi-uGywE@o6&2Bb%=9E1b3S3*E_}Cx z1zkMd&H6vlEo26w@FZ8e%y_#*CwLV@Yo~oI1%%o-i;GicSEaiAGP%x7QFRZfltj2( zy0Z05=9Lml!nyGNqo{c>iV-JQJvOGc%GTr(SY$flptpvlHR@Q#; zo=&G@nE{sIu~juVktMQ8LUqU{qzE%-4<57MO761$Qwtxv|;Ht$3~&) z_y5fp_VCQjeIXuf*lunPos1076L^$ergq#Rqbk)fghS$7Ve&I*T%!LlCz{Za85Av) z_{>v^be5za(ZdgK^tlqcGU+OTJCsF?8?jOOh7`_xZ^w7gKp2TG;%iGU4qZYD?r3J^ zp(x9Ly*KAfmxaCC8}?361fjHH5JZW1msV$6n&kzuyP)*VR&EMw(WK$Gm=^bwhO$wC zzB3ze=`!iKWh$wGT;T6kz-KIQpsOFGHrEXgsfPxD#Vp-UtBZ;cqcv+i?JvV3gch9L z+rznE0mx|Wk>)#lNI0ig@wM3GTL-zTinow)ACu?FAnt#Vjs9 z62Ak@RIDI@GrE5el`bMeZt7Oj`-rtZQL&2JjC)nvUm@}7Fgg=@-hT3A9E{>9#poVq zoC~Kh4pquX@i>7o1Xlea((Dvlm(W0G9g=a>d4#VPf@m^{uAL*fir-NriAqa=IjTqo z8B|+lR}M!0g$LN_B$ggT>2-j=FfKY>abo`^MJY!jR?i7w)lsL;POBe!JoL;O&?g>= zMULOAfL}nyCd^(S4xCGJ#0G()Fp-zhHAZF`XP118cARUqA;4+mP0C4)YsL!X~0hmUq|dc1I2wE%=V<& zs47|GyHr`$bqcC1a#!z%N+7p3skdu?k*Tw`in-&*v5>y8H+M1ivw?lK!5te2-P5_{ z{?+ChU;Q(~{)gqDuiyYY+x}&;I9edu{bk`=3AJnYy?d7#^(E#Yt zO1r(X`d!fee*NL2^|i+p4#2lC?$M?^+(M<(t>Zu|JyB*m2ZztQhrz*X(pcHsRmYfl z-ODJ6P5u@Qa}Hi_A3X0KEwzzVnkjIgm214}Rt^Z}#^D z?7^`Np}Wstwh#8Vx8&h}?Y-tN-M>gFU7G(McaM(EH|Vjz*xHpo9B=LHnqQnyn7_X` zINUurc&&fDKJ3bmW9JnB-Q7{GZ0{Z%b9#aeT7sNN@Bog?N?I=M>G+YZKCle0tlyWb3wt!LX|FgJ(z{JMt-NgQLdT5chIE!mY2$?NL*J+$k=cDSiIzna=OcO9GFVmI~kRk=ahQ+~bG8yY;S zYjE|35gyfy&~MQ1=uu5aZ(2Y_H10YvNM3GQ1-}juqPtcBl6BWAK-}(H1<2r?TRFJ% zSb((Nb(;VYzH1dA*LU8G-Tj-Y9C}sw2&h9+r=i^17I0cPb=o&0cK0uLt+9K2=NetV zhChCP+u&LDIdx#0-gSrK*?8AF>P)>W_2JX^R`_EttDMH4QxDJdy5-uh8(mF%{^ zo<|oH5Q4kUiR+ZV<>TN4JMUg_=RqIiM_@H7nGJ{8C91plR$%?!-21JCU_JPbD#Nd5 z`0IQ1Yuowt>%?oSFzxFqHU; z?8aYh$PDF8>NC&By}-nX!l!z=_$i0kf3+OE!UFMC)Gvm7_pfXq*l>o!ArO4slSZEL zlNOZq`*m`SCj}03iQnD}{P&$jctatrlKwf?KaYl|PTSlj#;}|~#c`IRP1QZi+C=qb z`QBGVI?|KGFnzF{_UMWR4;?w_bDwCX&8 zdJTS~ARoLAof6wpVoMd+a^F9b_quD_-h1dgz1K6vRD>42Vty8b%b3DmH+bzs_N&PN zS<+<8d5S0ii>}n9=|>!muh|>*l;gOPGWyxh@zKuyajPx6626cr6aeR|n&ec?a`42f zq6f0K^$VIAKoR*g@ZLqL;jM;WGPjEA%1@uRl^GME6;lG(5Q62{8*+E8Z5AH%pl35$ z(i6GE|=S;avZCTVhQ5~8Jd7_NZ|MBLLiF~6=t`H)r$dt z^s3!Rn`88b`5*khMYY4#@X3=jgn!22%yw39)y}H4^FO9h?W^FP3L`enKaYoF4<+qm z$gxUz**z8|S0jNo=!WlLybWmIggHyXr%!qR;dLLkFWa!W8d}$SM;4eSxdzleVy z@E}w@frl!%U+=;0)YV+|)pQ+dG~K9QJPjw|k_E`VecwLpZXE;uKHF|&tYi;w+O9O}If;+y zmWuS|m{G_evbHKmmb0A~)CkZ7sy7zUUw_4D3 zx$J7LEY58O&*lyru+P>vVLF}xM#6`S(A}1lxzdGj9!X{Al*8*RDH?3+vW;h1HVmI_ zP>dKjo5ua6C8yf{&aU5y<>h777yO$hLtR5%WcgLdqH!9(efCZ|b}@ZTLqe_%>Xww-p-rM_%Vmrz^`=^acCyOh99Atj?$lsdDFk z`y}RQo58cDQwJ}jobni7S%$k2R1RKhZasfqF-zDv5c2G<@m*A1*_K~+?@a{`aoI(` z?DL(U>dLN^;2zZW_Zz?L>w}-`%Ko=s_RapDkBTjC5A7cu`$f>uQk9aO(B1b74de6- zgcKnDR?&O<4yhVRVdpH3h$~Z7oXQ5xz?03V!M4-OIW%H57f5cC zhuom4V^1TW4Fm;Y+>`4hch1S8EokDl*=}`0wTBzLkF2-PD5V~cT-`7kP!fl3MpZRy ze9NTp#H#01=)l>W$1%=K9I9E9n;)*53ng6I#2RR=2y>O3@(eurfrf#UfTrcQKrn^~ z!qQr}NyR>Km*ghOh1*ha0}I*I@;NaR*Kj@RJhMKGRzfueiAS963Qy^cmw@B~ed855%D#Pe^{(kJbsFmBTe8*9`MU43tkyj2h2z&=@8k z=@vr`ixgYi4AE;-^|92ZP!h&Z>aAN*ZIkMipbB;*z-_w(&E0!z-WK?N0LHhiT6uxa z6B)XZB{^{OO}y(E$Nl6qfh}~20z@Ab{xs{j+9YI22wDu4GcKg{28CV+XcU6Pj2~}- z-eY9Sd?9Ec0SKL&BqAnxLUxVmxE(cD$)%?0-FNr zkeYI})m{foBs(|#u+v&whb2c}Ip_Jq)}wV;A@6zcc-?6gF-c2nTdL5v>moa2A8|Ht z&OzkCyyS8rvNbu|LscqTa;iIdcIGhmQ+PU)8z~v$sT+L1lvm=gTp}`Eq!7cnHn1^H zvGb zv?DGlFARw!e}$xoM=F5Ubi`_RaSDn8WyNA6zom)TeX-NseSXw?-97BR*nM;K5h z)*pSlzWQB-^*_+IK{Oe_{wL?O^ei~K2EsSO)PcZCT;DqWr;6+uPbR6C(u@4)%h|wY zr1>(>iewafiNA1|o(sb6&a)fRenrzOYR`)-D$krm-&s!1N|Nfs^Hri8w0@pw5Wp!M z%Wv9`8zZjcL`b9r;Pr{xpnVM{yhVmjD+-g`_NPX^DDe}Ps#s`N5_CJQjfvdt)S@)) zUgmi#==uCN`Fik8KHm(~2q+&1r?-#O(5oqV$grjkyDXhp<4$}k&0~BO_oqc=GT#cY zIbmLd@>^!(!t}JwIW8r2ft#JgZBU}3SF~5PVk%WNc~V-<+08iEfNv#*v{`lJVa*(d z)!m}zZtB(~8{OC~yF!u8DBihY6j-&Pn#3Tl&S>O$SzVQ?9gtV9K4HAxXXmcy3btz;_$NXn>5Fh`G~LMGd0Vh1i1#-LwBbjrBsfDOJt9 z=o|{O@Q4$#&%#>+P?EP-FIgz@*kMqJ!jyc0v<{2qL_2O5K(5D_P4zvHh?%>1J8FDG zL#o#Z!xj7C_U^&m0Umghc%5&_e_H(A-(Z2=PaWvWd=C4hV zEz;tA^P5pK7(~~b-wc`oNM`Wr$0pj8ZGN){Bp~i@ese@tI6-hp#V%38zNW7qfd1x# zyx9B!s0|ePO!Hw!I9C0 zEDys%B^icwup_7et+c2ys;MK7gfnRW$?KL(1KxXaW5 zsUn~^9B#Qfru>tA{+m9NYGn0#MNn7;iMa9e(9l<&M>ye{RHwnbffd1|7-1H&k(&KQ z%1^a$U#FRPbG)rL2b6;b&qf64L803xD5+_RK45A3To;`h3PD^O4IMKf+43J(C_Q?P=w0QrWgqlBgRvazR4AZ zKfF9pR0BB|%+r94KRA(IamqQs_YFi^liEfQ|2~1FtcQ)9H1Z}BAqDNq?A(b;nL2TD zuTbOBV1UDDJUD4WV>(reHAh`y_Ih z)gPE1Nuaf~WT%tkRyi}yDQ!t+EG5GYF@8YO`?O+KJvBbb=S)N7nhep)BlF3uh{aRO zf>=pXE4e!CRu!pK#Lqi1vNX;na^&IFppquz0qO5CN*(I^^>QKcG&IrVG3rkz9CS2M z*^8`&GgPz4Ep#JVOW~84P+QUXjbw;HG4(+qk@!Bw0mXVMbeyw-wei_l_cLE+qJy-z zOqJ9o=3+p0{9;U(++s*~{BlB?+8q}lY-_(HZ~RuE_PU2V+f@8`XRrHd!*9}7 zk3-X}8mIQ>fmQ(e&0{3mh*HJR_i;C0+9jeN8=+|^?xLx>?bnI!K5?tTkNPD0|JiU+&Imf0lJvLm$3Ep zwDnZtI=|%yQNMs+ZE z^C6hFJR8|@nc3=yCkN%8REGt3042F@%LVtIsxGiSiW&E@|AtNsu~LH8J00Fa)-PJ;jE&kE-sZXUV>aXeyefQgm*O_-m#U3}OQ3T2lsecOMMeL-s*AX;>RYD1#1rdk?7mt zE2!I*idodC<&CiDz+bTI})(C<{X3`n7LB7 zg51vry!+`DEy1fEgLy>=faE%_BJX;lYg<#KT=k1)nyq%sGT~g7iJ1~zz%q%L_ns+9PxT81A)6uu}8O z0Z~Q&Ir&91IQsGMxVN|U3#zU%3Z`)Fr*C0(>g9QYIy}|QCte$&)tk3cXld!)vdl`r zcX|lODra}vE@~wPfuV2rKG|%1&xM?1sBbf zGo0D)6%q2;qWSsYqRF0q*(vb-EAkDwgAfC5G=ntskkf`+i#u#dglLf7gg+I+2#=e& z^`&%)Zya`TRY4FsYNCKvv7lH<#2u$T>fl@t`WzV4qFLGrG$phI6?-xoe3<5iDwiqxw;V~PvAA@IZDhGD>4uWP1ONud-)?W6Bl^MJa`cJFZraQ_v+vYZ3aSRhdp(w zVGT_nEG9Cs&u+fT#bkG>7BwsO7mosOfz93`KjSxD++V6yZ8_&q>r+jwRXGi@>Cayk zsn(0tRDp$%63rya3S4NnYLR7^9P0woD|}r?e@`|2)pKjD0IeWuV0I6-w@4+UpU`w^ z!c%GzF~Hj1SZzjO;XR!48a3<#fh(x9z}g;p98LP?M3ZaxhPN36udPkkY6D_pPC~?W zLuL@cNu=@BPU?sYD=^Z!|3F8BMQdOtDRSkR2hFRg_zj$Z2j2 zf__t$7bM|QC(RAM<{t^rPZBmj!e7W0JMaP#+C(IIa5l_NtV7W?`BT*^Oj5{>5KSc% z0@2#0p-S76kr!%YEC;BYx|3*jNEl-ooVXpQtpn_hrduSB(WGeNpckJSztD~2F@Kp1 zhiDu^E?<$+r5QsIHAZU5P(w9L5BL0`Yy`#R8bFTGP%4cLSTet|mYrw?Vh&6Xv1_O- zAX>naYlc&vbo}53b0iJxMB_;(s4{r!`z4H*Ne}E*6Rg~TLn_0h$W1;-3P{v~+KXj6 z#x<&CJ~l;F$WE?6cTC>A4(e3g?`_t*jR~7_ica5b?GCSEW z)Zq$h#Oxj(1DNHrj@gs1Feeq#*^Kd`?fX?RiSS$^rmMw3)MQxq0w}0zRRvX228nXD zkdqk@Cgh8Ur}nnw7RVY{HMXi1q_6OfRve#cvWRPfQflkLNrWR>M*Z?dLU}aLW1Y0P zAD3Htii<>`CA%x|*8&^gi$RS~eXu&B@qN7JIM{hEAfV|E>H`1uiifxr*y)buSN&Hv_zsGoKoBD74%ed zV%vECa}?g2bJdh2v9Z1$wW3=1(5y@v3$EG&KnRo7U( zNoH%i#v-(jwcG^Xq?IbkNr!GFLoPdrSpXrE^;myUdl$^D;s$+iU~QHQKM+JSdzCHdWF=@aY%xUF0iOnN&aSr z5Zyymo}P6(v&}~J#>%)$C6LHKsLfR-_+&|hm1f~vZpK_^>3kBIsOmL`<0)joD))@@pwr-%Ws4P{4Q@4mFXhpn< zGMzmBK&31K?{0EkJ^kqX8auy4$>}`PM}U4r^wdIE$?MHiU{Y(t8#{3{yzlVr7}B!3 z(xw3Ll53NFGV~Ok^9uZkD4R`PR-)2(jf>GFmR22WySkJ0dwu62aO z0{?YR$koZox~%oI$b=r8%Vz51HTqaqAIgu5stV=8rTYYAnktZUHa6ak4qB%gV*RQ* z7?8PQr4vu0WVA+`1QA9QmEY@Oh!;czCX-Ae`xFpE$d~*e%xu~b_d|scQpizv*1}e4 z)6M;Yc_3||Kb8es6}TPzj~ehtp>gn+Q-0b&KdPhf<4kDIA)$^9SqdB6Sb-bQ9(>K+ zig)wE_bSdD=&fp(oY|J6Cv?<z>cGVgSMF1 z;JETomPtxd7{`A+Dr`#{bIC3%PHJ7YNb_A4|F&}wEdHYz?47V<(IUIB*oGhGVo&7* zS7ZUC4LUG3%sWE}^l?JdC?%H>Jo35lM<)LllrEEWJY^3hRk9iUgLr`>MOW2jOJI)A zhE@83ZjW(7{aQXnjObq?!ghi(^S{1WMiiu5})NZmR6NgihDB8@wb9n4@<*ntBws2 zMx-x{#s+f&Q}yz2Yj1DsFgSd(+dT^C*%tzJk1p}Wt+hTQ9HtWm%e9^cZx@yqg5QIM z^@Vo<8I{r6)t_Yw7NtuMjPd~lYo&X*sIYf2E}^6r$tYG79Pyb(7Nh+FL{|Q_1fKMM z@ql6Lm;RxB%~6$a9y*tUp)b5$U}L?7cMCp>m-~#R+5ZcwP%ke+X9h0lLYd7JE)2G7 zBN}KW{0boh{0~KAo({#FaXXVkKAYrU;OJj&gb|JC8@92{vavXb@El)QsxTcZiiv}o zI9>~}MdhPH1z(2FYopclT=|d`PLRI$6W~@R16a0UOj$>)Dp7S6&M#jsUt~EnDORMl z#m6ya!9fM+2_9c`G)X`+??Sj=x%DchY_Z?hxTvcEIyTs*GkE`Y0cNWG9?%6%ap3Ds zd(tTE_?e@$vo`$NkoMAZ`$m!@gTWyp0pS=6l`me+2G{CM z!W_33ddCH_x!tPV1H9TR?X=AWrsOz8rRl~kddP}y4MK0_2bOB4q&CuVqN&NkDAAkT zLbKcef~!#A;F8oRZYpIE+(m*`o?3AhUg3gbPcKBOXEm`M%c3CjJqjLZ?Np;a^0mni z2%MgE0?cqXtoCF}VVk8$Zx$+%Dji$Zc;rkeEo&q%7^0Gbh8O}yFv4k2`JAbnK}JQj zc_jcrNl^)O>dPkB8t|%~;CrPj37N9cp9A&Yo8h}m5?VR#z1clJ>>jIqMsHdz6|{sd z^7`2nZ|}TYfClhqX?B@fCknxOH`nY%cSU^+aS!XTt9++C+N3a*TyOyPg1^J*JQ&9a1ofc)y}d2Yu|ZwnclA}X-$x_MUW8# z6QD+GZH68lSg<2B17&sUuI-3XNL4fAXi{J^hThn7I%DV+4bjD?x@mCC>ld0Z%Yakv z!;OW|ND*wy&o4eL5VkgHqcat=k1_|RbOJ5$^1x01cHDm_HugXfI;STM+RPYm4F#UK zp#7Kt8_nD>>4a(AI{0iI`MH=uw;<4=9X`!8OUR0@YpvIKnDd+FW+9pCY2TwLpYrwNpz z7eO__s3sXaJQ%eR_SL6k0bMdnX{y03Em^qkVY}H_rU%atj*m(`c)z^7yx>t2*RKK7 zLW)mPgWX~GUT+<%F!@$JwB*4s@G!>PS^(@yEwo-}*Xd=|qJe8&$R2>jFc;8sigyem=AkLxP{pUXIK&)e`VHCG? zXz&XfE`MG29Sf=H3K_StpiLiCSJmFH#c?cTMgOT<$*L=7jPf^J`ERBE; zBxe*QZqz^5P!+uYoc_Lev%h`3bFgn6ah7&iTC;2x?71Y{C*K+s78l3TzJ+>F7lj2T z?I0fu^!1aaZz8K#zTrf}NR+M68q&A2^0b9@$G;;RRikx@I<|nS zhh;si=yElD?YUmn3cs-%a2)vvezW8#S+iy=IpIwru?$jvL1i&`j|D9ZD|Oe13pV)D zd2F1sRf_D2W7z17j6;g+(85yZ{=q&;%~TP$9bfP&)rn4!?wx{!%leMgQb{q|NzgOH zuv+RQl@TINEhwHYNRan-svyPz-zZfl5|Q~feX%vCz%Jn6mdxR#H3o1#|HLVRDlPu# zjYFrM25AgD)F9~W&x>F|pUSG=fZ%LA-sdkmmuSX}@ za26pdnTSr3Q8c-}?NaK(t*3eym<0x&3PeA1;e{}Q_wVo~`u)1R&K+j-U99t`>PF0}S$$`I zi|($Q?v@tf7JV*nrrN7NtG6hZ)O1xfewQgn3g9ypwM>kwBrP9Y7oXi3y(@3tTzN7Y z598bIEmIcB~6JX22`4zl1(r3W_yea!8xXhcT&o?uR)hyw~40f;bfx!Oz@SW6QuklN44g!YW7ERa>)p?bGU0ZmuK+lxTA z5_@iQ;;Sv^9o;?=#SN+OdbR0C-MIr}V7BxPT@*>g4_PEc>rHw9JlPr4Ni&Rg#&K)K zLQ<%N`fcs6gJVSuVfqj8_l7mStp(@p-p>A;Bm4coyYF|q`y1{c9nf#~;qQh|ZJ#Bo z=O@XnyS}jGw!HQH`HX%ay?JK8UGzrvX4ihZ;=X;p^OODd8?Wwx)9!z}Z(kq$yx~kY zC$V2+&s|GB#+ z`_J712Zzr4gTqTqa9safV`f%sqaOe21bKfb^#jNGjSw)=`6Gi5HdP0IJTJ9N^?DqgE zqI!updPHY*Y0AFD(bL}38xC2SUY9V2vJ6M2JLfR>FnS8>_nwSZ7OdEmLf2F?wOnK~ z&{2JKC!D)3 zw)qf?cUq>NqC?MxYe=Zq!aCqst&e!e`ggOS=g~#1<``2USIjaaoEkA78>JyD2SRJm zOjGbOP4DPz{BD^D##4LdEeqNXk5$$JCyAG!a@Iu9vnRyNhcV2D$!%G;5`bm%5?BlJ-~zUqGXx?7&az~AsTWjH3K2{*8saS+Cu@AF67G%FwH}+{lUu%UwgctkQ&I{`|oZ3$DH~YsZbm{j8N9ztls`7;R$M$OJtmcbd_B*e%_~3VVXF<2L zHz<;{pE`S|8xMchW}`FzYWW7#@$6o<9Qw7xCl}K`@{Lo)S<9)S11MuGOA6(T3TGX< zO+`vZD$+VfibfI@TCS&9p963pe(>SI&PqQXsmL6(ex;|2%B#yW<=4S+8XW$k$suN% zDr`zKp#18jYSO2xjD%yb!cm9D#!WJuOs(!weh4qpV3UXDJVQ`us0?x*dxhbVDA5Zn zXyiT021em>u!HfXn?a7m9mv)hx=$h?1zIA$L{Q=s$p0|vv&$NatrP}^p7*oywVH3$ zraQ;W<>=5NJD(1deknR^#l#QK@8VEz2STyU{P~2tfF1!)1$Z@O@TY3<_=r; zQ<*Ap?7ZPQ{)Y{pv%jAm*9xC0TgaXL=iOhr&)w8nT)@Pc@x!($`I%aF?n15Zv@Hdp z2ahLUL){pZFoD7!;X;}<)NOpK>?cO3`ik8oa9`d_C4`gFwKVBi33$p3^w)3NSkbgc zWQ=Jk%aq+Dpsnv!hi87koW$286~2XaH!mp4Lm9^w1w=dcjDLUM#El0_Xh1)3rQ+5{fq?tDOsN zRLpS~eEl0OIfo)WcdMIzDacKpOi8ag%;QzT&eu8m za`V)f2B-XGFqmg_5)T_Za*f zrFVd3MM;CPy#zd|qb63A8kh2;p({kam2(V6lH}*Ys!O7kk~i!ar1e{^zEu>K|FHYI zyLBw56g3Yq(HND9p76JEWt)PVzZQKW)>h)`z6rD6+?j2LXQsIu_v^Z>-Rk{xA zWYkvF1l#7;U0j+J`o^_v6WI!ctRluB&y&z-^)ECO8mLWYnJI^fx2ocbm<-G=E~zLr zh!_mkW-bjnYxg?oYSUgO=fJhmtHjXsGt}|H!sqcQN&)S16f{%uYsIre2SSm4X!37n zB{{X`q`>M_sN8ee8-CxdxTAQze#?omi&oE#x82JVgpw*hHIp-=*@{gnCeiJxv(Vwt zvEWDdglAmCgF9aSsEJ6G$?^jyHvh*8tK@7_Wr=T0ixssfg%G8b@FtjrzySiH4-J|b zkLu4R7;yBCK^RX501ls3S;wy_92H+kqnD}hC^QrvK~vmD=ymXebr|O+zT1m~!`HB- zm9?T$7X|AsLd;M`SwsgV`9a(tMi{Ta>tv+^hmN0LDGi#}?palVbTEIYjk>uTm1hr5 zlnfD<0b|w4QrFMg?!iIDtW}GLRcz3)2V=D~9c2?yCD#`?+~OQ|;(PAQ0ve4^irk}L z6{mVbVS^0STj!7`gA$Kd?i{RqLn@Mr<5nsv151uC(Zqk=(!cNYX1WE(r3{hXfD^Ue zC**xg+QLvfq0BDKmn8Fwftp=7F93Ju(YV(y%gTN=Cu>#iEF$9K6j&#O_$^wA=)7vp zs%o5QOdqIa)dLHmP94tj3vJ;jY-4Lj#G{v+LEAY&yf~4&2V2iyd5R#8$VL~nd6g-PlzMVomWQEMqtuPluUEQgQbkDD3`d>$OOZ!5vi3_RL zQArd*w{R7;pp_2BoqZ;+b+*}MebHL8q;}FQ2JZuGgM9r7iPcffYM^|KI)1!UL9K#b zCkbI$gXJpL_*yB;ox=88i8!hp;5eKR6ode2@b3!w!`n!>K5f6{9aX!;7SN$2Mjcfc zUMHlyhstsnJ}Yp&aGrQ+t1ldk7w(P5`VSIB&~3z{WMzwhvlx9zl}i2i_>^d-CU5|tbnU@6-6QV!wLo-w`LFJ zmfoyePrnrUyYIXJsr5WFiQqrWp9DJ$kyZgwGo}7rySL9vcp_9nZWkubBS*Pl>)&-Q{>KUG*udko5x|gSJ``0^d|k@&I?Uk zO7W5KY_1DntX21L+RYY=Z*$BuA8#%#E=&p=i@Bt6Y-03kXC@p-z1N z$;>cbM>0SB*1olSXSt#KJg&aQbJ$@WGvuy}TYbQqnyb}K!y?w-6aD8t z^_EwMv(y^i$%z}IoR_saPO2)Z1r%}s!vzudD0?v^4uk4_l>=Wj`CeFF;92wC%c?xf z*B4Bn2i>5UBKY;~umDoHIy%7ZI9XK?Sy|;Qq^HOTY4&8;xTq*j9aYvaMO4wFQ*G!= zMxQX4XdQ;#s=og;l)=&MXzi=f?~s)+tB2p8N8@pv<_pRmh&fz3CTa{3Z?V;hK>uF4 zxUHwhW$S|rRxi4S2Fg%?FI?4?EBZo*<@V)#)1jS!&~a#R1<42zBs=M#2xz`S5hU4X zIWK7~R5N8O3T-N(aubwI8ZPQ>P$qH3)lzA454*>24z(8H&dLK?V8APA%+G~D7PP#n zNWM1r4D}a0)EBK1vdt@9S?KrQOHoiaG-;R+|Ak#LAurYD&YX@|1XhZd$grz+Qdj5B zrHP+f%Zg!H6L-S3;)pHG!&`Cg$|mN$VhkywWJp-$7+3)+_6}ZeA3X2c$Vl=&s%y7) zb_ta?bOp=m@+G73mRB>ZO0J`fF6_zmvL{&+Sc;7xQ^w|*HyD|aO^X>lO+9iS=ZL(0+cq!+QHSG8BJh=ci*d4#O zBx>AlKnH^FEraEEX3}6-8?k(n8)8(IHLTY8-wvKAmZjvmgL;5q6z6$#riOD1pI0<+ zb}637npTt=xq9@%1=z;SzGooa-ur-!t%QcHAKeZ7^8+7t+1^4HvXZ1hX%iyFz7(QH z>V=l)2Y2Y?3v}Xgd#RLZx^a1Mx6$+6xewd2MbO~Qv%9rWcI;HllLe=A8vAY6!zVGp zAApfDZd^YWGn_a|4kK?3Aq+)Tg;vDMW!IrpTHLgez={5;duErIy+U|omRG2>JVg!E zwiW2-L=5;0xo}9eYV+A)ck7kkq%j=3aZahe7dhz5dsp(|RorFeRPwp1QYl?VlN62@ z=V&T3RO}E@WB5n!U><(s8F~ADW8s}02rbE}^CI$;eZ^FSK`F<^aW(9ZHZ)f-^^};g zmV%^eMUPJGp$sLxv{p|`@$sQI8bcMLdL^t%F7MzMES0NI(O2dF^wp!G{@b6QS)Y&b zcoBy&4DqfmL^>QSh27;;$pv<=ff# znmwfVGoY>HVg$Igd`|9l|DK$tK+08Xy>pXqRzHD4oTNCIACeV8zI;A!Kg>=(#Qnm1 z_>UyRC(7~4ituG}t56p(85ec|*36A(e@Yzxt8jdGP-?ga_b+HANSq&Y^j!RJvO66K!(E}@$_j_gj zr}`nu;Hx@LK4TjJd+q3_cDie4M9Tfd0>xpiRc~ETdJGMaEC7n!C;aqZd#}BD)VcXE zL_ZfYf%0!Esl5cOf)Yy3n?;I0hZ4-&25=U+InehxF-0nN@}GjKQqPD|hAvNZ_RjZo@yM2-lWDwQn3U5S zij$G^f*u!kA3Yhpfe}{ep{ZyNVgxCPoiQ3C0MSJ^Ox`4QU2ka@*`-ktpuUPPzjA8!W^W=7?m~C^!SrJ2f!~p{mziqwT`(s&M6^%9~CmacXkw1sL~VA;~ej392Ma z^b6{q;zBmq`gEGdp-Gcu?~qdC>|83wfoR-|W(;<>%SrWs0aej8u83OjeAs2}6n@Gk zb9_x3`aCA$T&`m~b4VTXutoAE^Fgesl_qN3mlPDhaXOBbv=EK>@6!YpTKrkxr}$Lu z@kCOta0=KBCR*>u{RM1~_}lk*n;GzX3t2y?Miru}L^j$mfS?%Uw!J`EZ{u*CmQMbo zpYN)22|0@W%%Wqp+UMB>3ag}+v#LlLoobCYjKeHjdALZk zoreMN{_RKWk5^edL0-JZ9 zkZpq}5DYT!0i|_yAD#IR;HdSUjN*~^geS^>hIWbGL*g0yXCszU)Bt(FsF`V8g>w!3 zlAXfWU@0K7+WqDDaO>#x)^<14bug1K)oTo)3g(t*sDos&2?RF`gI0ZQOxVPAftIS; znnX7PAKtL4FQFE+_9D6r7VoOj2{e&o5DI?6>_XDtG4^nOD#_PE?1H# zXUJCWQmPO?cqkrD?C9nkIqjyyC0Pkj$*dh!V%yPhxPvS{XZoRIa<|=jidL|_e!`be zdzgOMo2q>>6^M&884~-`kjH4!BVN|ReJ`NCcEX{~$l~dJKUr|G zK%inH)=z0fy)k3PZ%cevy0b6yQZhFI=9Cx6tO|2U|c{8J(@Olc$ipS zk(zC~D{HN}iNiyI@5kcF6BTq>*pDz^2T;Xqa^0e&?QBd&*M_+t3g)y2T_7;tDCzCu zbif02_V^;IkzY3WZu`yto1^aY1{7q|54Fi@ES86gomCxH{an_(8Jt1UkY@Eql|X!z zW8YhHoz`{a6%bg0m|V|u*F8MkJCY?vxp)n6#V|S?Z3#nslyS?hOGZ}Z8KKR8jmB=t^DO&Velm*kk5*O0 ze|*e&Jx@utA^tYR z=pr7FU8MC8MlJ+v)hAVivlRxdoc^a`Np9LjQ1(TSYSX@vrEpx0(Ud_;ikcM4F|P1& zn~BMA*id_~p8?MVXE#=7y{xeUQdd!cYLhH0&iZHo0fjne{fr0b7lTbuET>3d>|FI8 z3By52(eo%jcOD2SQ*I&(!rur2i<}7J0knm`=)I=ILQ_h;GW!I(B`n&mY^?_FBmhCA zFvQ~1LDOQ%NV zq%=^y4(*UVK8}xnJnU{gSFXBd_cxG-dZ`x7Cc*8QG#Fb*6$!>x1g-h1_#7S7tEn#@ zOxAw4cE37q{jKj)gAEIcflx&Y+WvYc`QM(+^C>hfjHL9csn~CnpW9+6HuZ!|+cca1Cj*l%AZijVv#dCq^v-Nr> zaPb+@*`ifjh@ru$fAo{)d&9%;65qc_#|qa(a@|-w4I8-8aIka|yL-%-4eJ?E3#du3 zy@&XegeMOgP#p*dQWSNRk=oOt-G#D+lT9OMtmsb(fiRR!Qgje&8$bWJbKG5hwsYJJ zUhMqReGcE$88nI}A2~G~Zcau$_7ea+?Er+lp-Y+C&EUuZ?iSuBZa&U%tV5_Om zEK;rxNB3xOpWzu`t&V+;TAZ6X32>rnP6GHoj?%GshW*VuzdM~$MZvm5SjW!;SrbF{uqP5e@K|FRNB_^A&u*sACH+#L~t(Qme9V9G5tm19* z&gvHJ#%c7tH;FDM({wz^3i2T&TBF2-rtH=GluVv4$q;Es+z5PeW1Us}D4`_o{YYT* zN)2TuyK8mFcU7_|C3ZyWD577%i$Q1L|7ZQwI(_&ksbUv)h5fU4_=d5$MRm-`R^3D?nqUz)>x?0r#;?so z<}oHAD`FZM0@MDv@xRe|{qh0HY_+Wjp~w`xDje2Mf8J9pUjRyuO+O)E@n^YV1nq z?F+!Ff3+6+&(FW=bJP9LS1|v&>HeqvX!T*~{-@LV^Zw_L_>}K|&guTA^HA=8IxDM> z(fq6P?fRqdzsCKKHUMLO{oKF$Iltkir_%PT@ULjJG1xuJP-2*+XCFr6vf;@fvy4uv zL{im95@6>V4}hW%duK&R6>QC)DrhmDP@Kv1u&18#<%x>PK{B(B%z@F&p?zQ~_{5;# z=Gh2(gkjydj?*VgRSsv(BkO9(xnQvF&%g7FSjv3)G&+m6_8L3vU)Hd`l4pz5f7=JN zG{NE`a^zwT1f0iOCqTBn)+$09TOgl`*E<$u6G+|iTZTzF$)+Gd&=ghNBkB7b?AKB8 zac4jQO}GbiTx;IMwZP%B_-sRadeU1qV-v4OOUpqO<_eXq0U3ZA&}_7@V_A?bidIk= zbEV=zr~rgX?^RAHu zrCQE8j@aB+*D2=CB{Y|d{e(;Q6RRlxDwRC#CHd|&;*$5RdH{Dh$+t~Ot6Whexf-+$ z77gkxfaZ4cy?y1l&}6j}paaPg!kOl5FNFc`Yc3`oRm5+k1T)BwLMYERNuvCa0~$?? z*MX%05sBPGu>xI4MZi(_D-vi%#EA{PgP~qDy-J1&=E`AKISbw^z@BZ9t(35h^hB&R z?l(;JqRB~g7Aw7OX4y>{p;qh&l_413Uf?@2aKh=39vG4!!meY_g$p39Fv+#G#}+ja zv3XXT48GJV%Fu3`Bxlz&q$O^*iYkqPg@Hm(VAD=eM2d=RgjRXOYabBG=q?PB+6y+` zYA~SwFh)!a{mR13OMQyB&4iNd~ucGx3e3x4{R)n0y1>jN|KDTH-uv7sgO45Vaf62nyRUv_UonglnO`9~!cE9o@&eR)Nxt*u0L4w@RNQ#(*e1 z3j!kw!6BOT1Ei9w@9M^-7@p(~*nO_SvXFI8URPB;?2&zn z=0Xuz2K@m|0#RNA+S=EbL2DbOA$ zvn?!vk6xy*%I zra!#7A?3@h8|n|emd}CXAiH)NEZ?AX0!) zWCSGm^_~kyX^1ht${oSdBHw0m=sMKk4Ni|nTnBH{Yw}OY9NaZD$Y8CyT)R-VuBK2k zfTtww85e}x+Ei>Gm9sS8=#?RaDY=_Ro8i-W{hpyoSoROG+Tal+c zlS{P#{H@B!Qa$JHDA7&TGo5q{DKrQ)UIxtax03DY2d|qf1_G;mYllI10U5iDt|G77 zh-j*^)DE5ojlHd3=w{?NXemP)sULI`Fhy&}s_k~6t)FYwl%_!ix6Gw^IS zv9WN`hPLFlC9sIcULImlJob)Jk7Sn5?PpcCW!jEY6*8u5%=6ptBuec-*)0GG?T@b; zMZVOgn5i%jr`K!{+u#KYsazPo9U{st{JOfJ+@Hyfca@Q|ing3v8%g1n(`UhZO%~1_ zyvN<9?=%9tlx3<_xi?2MP=n~873f?woe1EbTAdc+pAFp&Y4%o*3 zs^nrvxg2D`22ZlffzpqPkx?OL_!>{NUH@IShJWT{8}};c7!A#Sihf?o2uJlxKuW%i z#_;LWN8yshY)Z7p0$TWFn0+rjYX*ZXT`2e>gp^%?{n*Fc0XS^y6J*%l9B#mar<>Rc zerwUUP>jn*<0)!n^ufW%aUT3PpxOD8C(xh9`O~MJaLFAIwn-TJ767*2F=A4KnKp~k z#)EGau6cIk;X6epgAC1YOqfo30=Q(TusXLa+JeC+Ea{kQ5{B8k7%&~tsexN-G;YvR zo?$qz38E-@-;pW22{}ocIch{=_YJglm1-f$@fq#)W{^Q$n2+=<7Q<#gTvn00ov@DppHn zrwXS9T8YHw!IB4w>!F-GgHSTA=R9Iepba2ovbm}upGu2iz%rT6t#*_a-QtY+O`M{U zZ7i&kKEHuo;JM_4GOT2^%=SXND?$~0qd&G^M#$A~ETTBIZ62q8+J^l<|G82A|L4d5 zYCn8bmjB!BKjr^F;!`32bNsJ|YpeiReYnzj6oB;KdAQ!L2mnx40DQUpZ<&aZq<>zL z{m<{+o9V?rTd=pB?}3^#$VP6Q?;ZU=Fc|Qz^%Q8i&!dMfAhu?n`f&KPS%Mb?#HyrD zOFEvQn$7OfGdg&o4s^g$#a4KGR@I)LM*zRxEGVh&=AJy$YKMMj(b*K*8e+ujlceC8 zF_MPm-Eyx&yLuaiiLI6WOs2vH@rA7P|MP)mX43y*a`MmD|2}&3@X@0`>Hojze^R*klugg>h5>$x2%k z5*yy%SsmO*ixboaR|S!Ao}vA(_Xr2)J*!kMLpe{myu0)42HkQry&~}QZZUc0-hjPl zDRlwuSAph4eF;vcTAbq3MnBZ_*%fQUMxSoH+yL;C-q4S+z|xhXWnz)A%V}=pASK_M zX7FIB9ZSa399E`?&)7R|XbS{wM|WrL^~YI0iHDeq!g*%ss0tQON?<66_Emx*N-Me! zC%_rM8O0Ic%L(58lcj5%x@wXJ)OotOipg-{Td;058{#Pq50}~%G4dz9e0p-z6gg)B z3xu<#%nTUm2x*mNG8(3)HJ_bO&8cM;kq%1rFe8Pjwbl$;ZC#UOWNPgRW>HWLx79m@ z_tcq`P};Dcd5|`-h!(C14Xgp@OH{1Yrp(YS`mxkDNsM$A!;;L;*Q1VFk4elI6SqOz zXJXp;8H+@((f(1z4Ux<@$_J~}3b{-)7|`CsR66=Y~&x{=DIruzLK@#%SW0 zonm-*w5zf{-+=IGs|5sN)tw5}4&lBcHJ`KiWG?s5qOy2g+(0Zl=uTRuvg3@rG;biY z2;UG|oaLsuk)_6;kYlp+L(|*_k1nKEo}$uL+8a8RpVDI;i9noIWZHV4kTol<@yH;D#R3~Rs z&*i9^`rJTH+Bmq))VZ&wRIyb%GBKGMV4qFS=$#pUpVa$(CmWmIzH|m?gx8Y$J;;d?7zfkpP4^Hq%RRmwzppQ z-t52F+21+(vHN_k0UW9G?)AaZ4$e2c>4YV3!95iDjK#il08IK6lf#N5gw8$Lbkf&i zf@KU@Bdg_`eC{8_M6tcyN%dRQ(6le)&eY!R8~vbR6%PqSZFV3><7VOm2&W5 z-j@+34a2#@C-_4RVE9hmV7jPbTPE521ncfvR8Dn`OuQXwVOXLGQnpuQD&U1X9xK%u zb=B&&xoXB=t=0w?d5UM0JPP&ItTR4*SvN-ARn^4J;}z|P8q2&J-_6FK{t(TA5UKrD zvrCPIuaeYki(_*dQ7R`w8gY>E+Ty>La3N6`?SZDZ4C6e=aTnmC>l27MB*hqG<(0?EOy^yzv9HzIi`I)TMpiT^KKzDz1ML+1k$^O8|JQ* z^-2}9Z|uFjLfW++;Se#5#9iQ@q1h#qm`$Gqca-#p=I}NOEkp~!Iu?cvmE_TId>#Sg zvB5dLHmq`eyIemlCd2A-1H0THIfH|@vfR)vCw;3bH@3@-@w}}rm)qsY*S@;k)Go&& zVP&~XcV6J=s4jP9m%ExV;D4BcjlKjwv`cA3P)e{q1vcwzCQv=s(=|i|8A4nS?!%w3 zL{kY*PA0(D$Ayb64wZ3##(jfCd2(jUK)7Mrq2ASuMqEa6+qpZ1Qf~gY?CnoRJY8BE z!vUlkvNt?!L}LhJ(G8;A2Jahv#U=xl49#YhNrFzh+)*R)(zRXt3+pIEgi()A6{~4!xbAQQn)f4WB65BbKR| zb*`3<*^L>XPNHFy_AB@+7ov4s)P5??c7yuFj~VnVOCjpSo2JqwedNt+v1T#HQwM>2 zp%AU)x#ZgzV5trL8x*laouq(o!hwhnA@l#{-kRP{N42(1@3g6W^ zXp$4_Ey7?x9K&jg26)D6G&0*(ju;q>8iF3?vS^Dd^=NX1E>6)+JlJhk_7?lkhzW^_ zWk!yqIc$lmWHcQG(jDZ9Kp-9Q#*=w(`Ko%{~Bnr!gvZI71B|L-BAiHlA zlWVf*$aph~<2FT$t87$%V7ChBv=LH4=@Ptref!AT(5*tpGfm#&WLrP8}oO@FpY z!F3*qL9REkj_mIXi6r{ci>H$3+(_qP6{$td=ZFqM(HAhKt&kx}sUeo2bs{G9S`|%?yofI;b%YwO40o4(Q-Cf-O1F8ea`k?Wbu9l9pNp`*L;S#e#Q`7rp+!+R9ZO zcepfU$m>e`Fxb$)HjveX^%S(mvv}+8QAmqulaPkITdGFE<(%DQN+<#-zYdRc8+t6ZVRk=PM;N12DXcKIo;T zG8y@bES#WM0&F8L1StT{vI1jHz?p&9KqE9vqaaz6xIdlbCM#bJZ`@e0a%4{mcVQK& zwgifBA#@`cNd+f`xSAB3N@{Fe>NFiqtJWPjImTy$Xg7ULR#{aO>XG4@Q5u&tU{M1L zd>NdlhSJl?f`G*ea^okuam~jv2j|Qaz)_o3idnN{DRPuYL0t@R^#PIY;RazuU?_!+ zkuF_WdI-|F)tyh?AWrolPA9;lCh^4Uy~`79@HdRKon+J8=~%F|8Fc&siTdcRqlc4rSnunTuiVmSaNMt0`{TJV|HIc@8=6j6PU0a% z>a71*V9(=7?QXMSs_49n?IbV%5TM4+h_7^LtHIcJTKJ)9Hj`#`U1Jo!P*al7{)_aS z7&($g>(Hdn-Or?1L>}x;f`>vWeLBSB^3m{vURyk{vospk6ICqN@kEUI zC{i+&OH_T)O0a$tE8S)9}?0n#_B7Q*U5YSH}WLDmw|`=eSCM#Ao0C^@4{^=cZD#3FDN z1B;O;IE%Eyv$l=FZ2Lw5%Bk5gH9JOeIP7>TwYF_;q&##m3lExMUSFQaip$g50|4<9 zdgD$VM{h$T5TqsAZ1?@Jy` z%w;khQaDAVi|kqS9tDr{iK#__7}~92M}^D-=n@^{Bo@b2W`HQefK*fFpy>9$O0+`6 zcGrf58*AWl(aaBR(qRq?s7gu{r}IdChv<2Et^4nY3nD>@$kahZ!xc3`leI0dP^)c= z0E#QfCKL4hrUgNT7R_i`HO3zpZflc)V015=m{bT=JWjk0+b~*qY^3h!rYr|!G#CIX zWy4r_3rkC8;M~C`;*-0hEQ=CPXiv1zZe>35%@!(e478PtWtvceqNPr6Hk3u5fb)7p zTd3tQ^x9<6pOmV}tpKOg7Nv`CLNa5!a|Z=MZ1hiw(h;VF2PBiYSV7DTGHPu&`5XeJL$)hq&3_U+Q57unNpJtqIg~K!IYyJJqHFl5XgxxSwa>n1a)&2UFPdIe zdFSCfSF1#n$=AuvHsx)Xba>;s@*OPS@ho_S8sA{SOSZr5P-V%b4UQF`;1(AUt6JaW zsJB?!J*!=tks&j*~SB0I@ovqzNZ?jcH;Dt!Ae=_hDu@%L$*7Z&#q!yKPX zJ~n`hQD$65&8S2>z=$;CP>#UnYCoY|!@(2=7%^`=M1n5Isk)4Hm;(x?!W;))z3>id zxA@DLP8hS@^Nu;gDr|Q1PAgwBB6wYiq0zwzW_H|LI*XuL+jOL^eNv1M*guC!*mNv~ ze!%{uKuM-km%y|L-vn>j>{1^$n-4KNEJ{~Dd|^j zV*pFOctG4@oAt;g4#D73=y0o5bK2%vx3rB8qg+u1deNd2Nr}Q$oV7zRxx1214^w_y zS|`I`JF3Q6fNX^F0imn{+TJ}M>FA~2I(wj$Ol zQbYBWS#Sju(Kp{3%xW3T8Eaok)Rp0sc7P(Xc@2RDqGJ(Dd?0asiEU^g34AatUzv<` z?HQFjVW}Rh5MQ;J-Bhuc{GF8RlMNozrOZ;GNGO-xs{#9sW%Ott z=z4d1o0PU_tS@>PRVV$LJ&N7h;a&!u%#vK~;#O{Nd5X>lKtf$cU7xb3MNRzx!etQQ zeGKY`@H(|RAe^_46-0;Rg6xcupl_PE8JiPF99z12>zaJEVxLu_bFF>8a6tO-FS(NF zW4^*R-#qhXV%2%k?{nm3%5|xC7jOWxT_4V9qhgT2(-}M3HSSkBaB&wV5Tp#hjB==f zf$TA~e7!Q=2SDAOugdQXvO}+ebG5x57Eiv0lvKg|>d<=30^21J2}_hmnA!z`?2Ik1mlInCbmVbesfvGB4Ybhq-s0umMmU4ci6vYr84&{}_xsb)bV!*t_!7Xf zHTE=7KAv%O@IL_8YVgh8eIm(n{#H=|6Sj#@&zftNO#VIlZ}y&b57)h?9K+D)|7b_i zbf0)rETK~^wT6MBe1|N>KT3o?+bfBX6xG2G-lV$(S1EuU3f`v_>f}vlxM|DW*Y6O; z95=nGLZ{V=X3!N59h2NXmf9(4O_j5nrh#kP>u*JQHLY;WAC;#HB-x;5W{6N;Iddr!k8GVN_$CkMWy>I{;!&Vr(QMRjV%e?s9_Ca_6%6Rv?6?JRn3tVuC;eHn zI99nq8uw3Wwiv(aX&Ij-Z<2b6p%{u>cn9H4d2P~<5*K`Hx6B!gspecQ))aU~HD$^n z8YK}N+nrd+YA({SnUE&AFZtZhpime2ZD1J(eB{5{F%TF4G0xfoIor@;& zuQ3EfCfb^b%Ci@Hv&c-fb@p2H0wIZzW*&dKS3VQ69roN^m*Qn!QzSv)WUYID$5MTmFDDwc+S$LY2zuHGd1{WW8s_czhD0T z`_l#7`tjQ8cX&l_MRcL~u*coKxkv2|w!jqSbQqmcB9=&?>&zWGA(sO1Vt4E1(cFA% zDfsu*dGQgQ(M=CfBggz$z^pEO(^{pT4i+dBTVtuciu8vKjgf!jfm{XS;S?>8CqP39 zHj=~eo;Rcy2ZwuG$2!~@buu(zHu2!v**|`9xVPKg$LHn0#D=uH}I!yjIXL9+ecDX)P z+ZOjDNfLTPgtyblsA$ShtWdTU#l+Hey$&9E`a^mt>Xh~>1Jv_T1bb|6ab(su`bJMAr6&js@-sY&l7-e}8 znu>D3FKdr4?Ui-AevBtTs&Y#W^4Y!lR6ms4%q34qHnDo7LR-khE)u;br%)iJAoeV(rA9_R2S>s_Sx9U99s-x|#po6j1v58xiZtIBfm1^6HJ!~%MfS4=4 zBgFupmX89N;F$*k)GO;cxuW6~`PY)PaBGfKDY>N=PXY_9Xf=sUMq;sy7t)T|cn0!sVcJ=mdI76uIlG#|jC_hNaE~lNMWlQS zc>du7?|RQ~H}}VBvCmdhcVnZ~hjb~z3GtK>D*)^fxly%OSKZr9xm&OfSxRtU$|NC4 zb2UBKaA3g4)$;g;vHU6N>HHb?H8euLZ(M@+H!Oi`)$HklX$>lHE%(~?(8-2bW$?(V zrD2YCUceO6;^)Epak@J^U#PtPtzn4RxYmjD@lBsDJZ4>TsE?||D>olD(Q01^HXQu+ zj&W@!t91xGLBi1B4+X%=Rdnm%SB&LU<1ju8IM(Z1MMm9TosbJ4W88+mgk6|8$H^@eYW)a{mfnomyz4t|xVFgNlL zzNu#z1wuW=@A6!M)i>Mn97G9u3g7fIiqEN^(=T~vI%4`k0W;(&edp(FQ-J?|;zXu4 zN83kajZI>V>Py8Q7t_k@RZa zuOw$qp_8)cju>!Sg)JuZ#gJ7%NINQ6lqGXIm|48{Gv9Gy>9L_$tCWFitZlx zcqnOQ95V8+4%Yoo_|(ULr&;(K;oonF|GxI^KgR9d&q@X77&i~#%aMve8<*{OyVeT+D} zd)`#ZyPE;!3D3`^P`HdBj=2JHgQyaU86YP(zXU!rniTmuFqx7p9)A$MaaN4D~$%85_tl zOsY(`WXM7Yl(#BpFxtYYku1l{%sDHTeZjn?abqP~5saOgBP4XiDS&^3YCOl7(LJHu zfmXB9UUr$fZSs`F80IC$V4Rl<$}o!t!D)m!Pl3Eg6wL_4ly8~=Ff7EJVVy~g(DL9c z%LdDml}6(KLFPRuCA|59+_t>!B};)^ENP^*HVw>m z=fC&1etEWYd_*@vfB}?f1s{L_UqGP0Bp*BtI*;x9A$&eJhtJ4pwDhK7*T$HkDxtPj zato8d%{AJ=lP9WTXhp_Egc)a-okr12C0|1047unA+BjoYzeXCea}+-fSsCmAz>M`r9w6+maF zc4sLI4OW8VRL9_Syv(39}?F$u7Ft>ilrL_SG);Qbx^8t`rGRG9VO zN@YZD`6QMllv0#r7#=%OEL>pI`y59r-Jy;wVj&o|@*|T(MMcx96i9{)Cr@YeRwnD6 zGL|6AycBN{+R923=oRK9RIAWnY-+8BhP{^@!!oH6g{YGsDT~vR*EMPe57K6!3%X`~ zZE;TFK8bN(^mg?f_9v3m%)&5RID;iZC%Q405szskv({OVxyK4#j*DE#r$kQY0sBWG zEW|o>a?nDCrRm2O%t_?0f&Bi7kpNcMjfhu}2^v10ZGq;D9K%5Z=#)h{s=VRV6+5+Z zU8Y8uITQ#_ef?(#2fN*^{R#kvG6g3y0POC({86W@tN>$3Krk+WQCg>&)z11}y-$`P zY2yG3rif?nq3i;(7V;%0#%(;FWMkw~V%mW~0*B0`32C%XDPgn-XHXanGWa>UOo&HX zv2U8F5;xtbK>|wFS|qvXd~GbSw=V1rYpLb(6I%FaEY=u82g%(>GHcOSK=3xf*YV#u z2{_`;#}LbSvAwjZjr?v23E-&$&Xi2HC7uBuH!!GyHZY$x^SI{(3@!riH^~|w4fEyT zMKXcuIm?i>91anP!)7}xApDwNz%bj$8zYDlkp9z@vP5C~x;Mb1# z@3M04J-^x3N5#jTL10!=d-ka%O@^|b-gKVQSV>c4jPsHF8GO;pjKEfbBqpfurqmDx zr+TKcIx>VHvz&{1rnCi@a_CiExQ>CkBDq_zSE(U>y=-j09hQ8pnc7h(CyV0YPBdt# z<12Gm31EtGdzkHph{KNHvTh_n811nff_CCzacD+WZ6Ul(_7S^?IkXd^;qNg-gr$QP zyg%pxm5culLejy>2b|PS0o#Z;Hd;6@Sc}l&GkAyR7TtCtC41i8dj6{WS6YJ{WdxWc zQsEE~9i2)(iYnP)97^SQXh~LK;!^-e0?kdWhT7WnS{5itE%DS=xUUGGp!Wm{ZcGtk z<%rH`k)^Q{f8@%6e{FSdloGg)NZF_>VnO(S1~M#x&u;712xQC3!01| z&*Ds;cqQoghP>mgGsH4Pxvyx&0{}rq$elplwxCgF3oVxke{7S?xG+aTGtiVhS+Z_G zpb#cr&T(8&488rGW;WadzzPih$?#>ZO@DM~ZeUn^ceqHJH7Twf=oxN7jpm6JZD{6b z?Sargyq6t7GsazRb@t$WUnPzyqBodx;C*H?4V?sIF*uBI&b}a%hK9A`r8VIE_LPQ} z<23`41oL^9Xdz7NZoqr?253v z&nS1Hze|h-w~os*QaUe+?ctR-K0-|y1Pd1YeFZ~p%cu!&b)m)0pyPNF;WQ=hD239<7@Wlz%gafo^+!7m zSqlF?F^yTWT^g0sb6`vOrOZhyRG!*NIzGEgC3sg?OVWi*}TIu zYxhnmXP9iJd^#Fw#rS)KwO}Q#3bYP@hePpQBF?9X*uecF1-99F!?R7?c+fm1u^OH| z*%YN3{-Es!uNF7;F2PD3e~y6Tr;&8v*;9{0R$EufI|muN z%6yo@ymCT8D3lZ~7l|p=;IZ+}v-U*kRDdbsxpIQM=^3;|mPwSJ!QSrtH%u9&-o%A^ zrz&#vX6E>zb;r-Ko^PNGXS$=qz8$$-uoc??8aC|n8^Q0XbH@^zd> zl!!|sC#67g(9chbWFM}dg|0SJa?eB!HwO1cfWcYAqMDGGS(Mb~)YU{OI^+ryv<=mP zpa$y4jaO4b$}E~*J=>~E*&G)*8Cu+nn649QIa^N6@DD%C3>4q%0m1@>>N5ypaRp$nYez2+l5tTKY|G zPv!i8^~g% z72+$|FxYe=;Mv%rWa7$qvgzDi1HB)reXV3=G@Y`Bh(+M>=_HQrj`4fVyeM@A3&&L0 zb%rEFoW#s?&B8$5#`68VV%Oo9Y&eM2l6Zo(ygoOt^$78`%rTVUm-L(oAl}R1b3$Zo zrbFy%B-o?cW!;d)@{RDAJDXTpI$hc#vagVB?1(Xa0-UjgI=bDpc_V6?fI9nFK|EJ0 z;r8{3)z{xDdz+t6lJuj!S#3(fU^dhdJBeFKimayD@|4{BBEryPCYz{z!X}#n1h8Fo z=9XuzebTbHS#%1Cm+>Q-1EDa^6M!OlrQogE10JZ1-*_g^B;BgNO^uHh;r?`Q=A3u} zx|W%kcqrWD5LW@kwL^m7pQDVSh^R|R-60AuO>Bh9c``Z|K2NEJ$m{f7jfYSN+q}PN z5oj}4xTR@s$gdL$HvRD^N+)r%W8O@9){zzv5umOyB@pKOW^!OE>>Y^unpB@NNt7x7#ccTGJ^(vp~K zF`jC-t23cE$4m{{2FEeVaqBK^THLQ{9xpQ^>zHx-;cYS_1zdp`rEYrl_-x)X{%En3 zE;~t3NTowWxmFEA>H%B%)9^a12n0dU7h1?AAzZ0B2v~6>UeFadswb!gkK9YxPhUZk zB}gr*-OH-TfvM0#K8?|gg3w)U2aD}#s9mD0Hn)32AiMY&wS{N>tbx`*CLD(1E{v(F z;cVbBdtKT*$^WdXi7n#MI78!Am0`O{{yhcJs*JmT5?Ud{z7u}8`?`}i(skf>) z9*Zeb&u(C4@6{gpS^-mie&eLt(#nQMDv6ZVkR$7!Q#yDX@-1Z@!y1cEt*lTf(pYDr zu0-Wsy2`VKR=)5aIK`mh_FqIvi_@eG_tH&UZ>Uc{QpH9rCR! zT|`8DXi=CDbzsS6<71w~C11*w5vu&G3!@FbhiG~?bExbRYdW$nRCWwWPOU8mJEzzK zznU?XqeV4#a%D&qX|hJW4!a2-vi+MpiZe+%VVhsGGQL z-@>MbN|(=02b7&(U|kNYQx$4qrCXlC`o>A@MaDC(P|G~j2qVW~YUHuUN;u3I4qrmz zSW=qCXu7CDoPtLsL{i9`nrsXz|3g}deU|o`xslS%8A=-dMWyiy@;JY6!(&%90wb8z zh4V?#45eC5U6R6c!1GZ(&&+7zv>LWm$^)d)*wO`is3htAO6X_Jhq_*`!fzT9&tfSw zpO6?9qPaJr>W&_a^VYhe)cH*`I2R7;<7J8mnRV?>q8yqB<5&nAP_;H1TUY6XM}V@5 zB8{(Sj%qo8i3PHV_pszEhWje?`-Owrbi#XIa?hLk~se(ZCiESY0h1wGQ${WWbAJMaKq|YdvM7!A-70*79LJHpyn_nfU#qAT{ft{!e!SDPw|zJ%oBpcZPaVy9>-f4_*1fL(RvNyWo(;88WzePPlAef4iqN~m=V9JK52a|J)LcB^-=M3 zWGSUBTMSjTE$}{mCA$~T5=CWzY{jyg@L9~x_UfA2%mWo}g6Z=p*BHv{A zILqGg28&0>2n!E*HmkyOqNvKAWYIH1KK`hSI0>+0l1R4ih?g6krvT&%X63*?`vF;%E$nqUt6`2VU_kgYB~bUPNibL1?o%X1BB-?a#Xu zo`o5YYp7lXI@xDwLvJzrYByN|&zDZPyb>B>Y~vn$Y`RDJjDbJ+IAh#&V%3eie16pr z-aE_wDTB|ohc}MjP>>r(ZQb=x(-XAC?8y;ioiC0D$%hKB61++Hz?33Eg!@N4$pT8l zB(_h2i$pv=XuT#0GVc?~DD=U0StKy3GQR#GY6ONM^hHa}9-@6P7x~;Z`uc%PzKj6) zA$VHFQBo|S{bQ3hL#|z2iBH@fqdYj7CPTR*JBctY(FCY@oa0HEXOn_`3(^?FWjPr& z0x`I8rNO!(q5Y!Dt8T4qqLPvrfkK2U%H(m9q^OaUhLtiO4hlEd`v-u6W-o0uYtHJT z8BHTu`Vg*IlULKt5q9$fo@zE_Q@<^hS7Nh1#}hIY7NrBBA$B`adVu%E!g8<`yjO3O z8;4TgYu6ovKm}eh5X!K9DdG@3TWY@(+KWL)2f->1rg*ELhU6EZjf-($zGl$f4OO?j zf?Jf;r+kt4fr6E31Z5N2Nz7>!ov}Mk5bHsMS2MH|otYE4v>_#=Y~2#yw8-uTP z_pMd-*V#+zl~@;)RFLj^D^}aPKrzQ+<-M9Vf>*wzq{Z`HAU+rlhRQ^_33p*9<8#R$ zQxUn{@Z&{1?>>9;GQ4+>c{oCp&vFRUX#lGjz)zNqdy;c(57F_XW1lAN&ZKO>G%KIi zf0h6LP4OSjzd{?c<3Fr+I%^Nh@gLfM#((%DKIQli=M?{;y=vk=tOo71b@>14M9q(pd}I->$EHx88nK!2oa&IFfIe2<$~^GRAx+q!PbXG$=ce&H%_zIgn0r z;ziQg-FbFHAf0G>g~M@!-Ap5SX5d3PqKJ)MikC9fkxy0fq0})tlH3GRgWU8T%?wNg zddwts;j6U`9x7w4wo7T!RP&vto0G^k{cnpCO6r)!mLdtNK!W-j$QZHu88?#9+F+CEua6j#lO!-`TSwG~pzsi+fZF*!iv; zmr!3(#}=Mp2gahP^Fl_`w`?UXNH;i?by@N{)7Yu#X0WI!b5uX>I>THsQr*E_{)pXN>A}OaROXz8{*7j@dMBQ>KlS^(d?FTX zH(!w3r|-~xn-qN2F}g1&7#rQ#{hKv)qId98&R53DwzieBjMuj6I%JqTD3~%mEclKC zyHHl=HKe={GI{IGvSD^ZIm28>}^1W*h9xExps){>pV@Wu(IFG~t{Dzaf$u2ihS#N;3Xe3HFR z6+{i>^?r4-m7$;QM5m>W$7;0_pv_TE#sN+Wfp}~!qLo4bV=vEBcItRs!(EjR@uZ9p zYnoriIH~5fxGouDL)i%(j$KZ&VNL25$G01Y=5y914p_aRjG5G~^uo_CNfqS29}^2u zfKj~j5{s;P2UaO30sFh(=Wh8aUYxvp@wgf28NPLp{4Wcaf>r-AP5K}49+i^Ioxr&; z2+%2aYj~DT;3OK6$>-j|^EbO&t+j<_a7f}Lh=_x;_!8=FV8vi-Fi3KkmY?H%hyf(p z-+#Zh96G^Mlv{GAN_&?y?aS{<8eREZ?vQM*2FB7uZ=0%SBK~t?d?;L=xub8T6$`Jg zyRaTCg~dX9oPYI;sHJEZ5G{&kFdD~cj-9$uN;uKsgIB- z65H(SJsGlg!se(#Pl6Nw9uPqc;ULE-DKv2Czq2@;3~PEtm-ZEFGvq&0$3J8UO-=34 z7O(?Rj_gkz12I7%F+@QB&&+nwjNT64VN}b;aA_K@bl!0^>9^B&^M4F|>J}fU!twp58 z#pH*<(ozzjXXcQQ2ECzQm)thW!-iTI7`k$)f71&`NAA;U=(FKERnBAp%#mwd4Itql zp4XT#8!?j#;lPZo)%u{v_CaRj=CMJo(%9BivTbKY;B2#5SYJ=O6u4>2+Gj*zscS)l_d+NU7p$e^O#=w5w+ae_ z8kLi!wvEgt%n{~pLem!&B#c6nv7Zd$f5K-Cv|$m#w&6SiKm zNfAbeo5@ngo*jpXet@^ARoy8ATsqBBz`hk&VtUrG=-*u@&xkBAtlXR6jZPgV%!9Vgu zbR12km(w|`kow?b{-)AZF~rSg9H~$w-W=(uP*mnLxoUXTwJQBW!Y=?`O6nv+7p2EFhV+`X z=4?{aT;11&4Q{>c8fh7`XEL z`rVG;(w;tfLa#OJ*~i#8=jfLn^$Smnq++yaeUpmqF=B;h-DI6y16lF4N^arInn5R` z&4_g2t~X~^;mb+dZIwTRa#@SCo`qIK8ztdb;*J5~C+{FA)7wGu5_nKmM(9!TR`vRw znmn1e1{C|j!2?XT?d$`Z5DbOm7Vt6J{;#dBcPdQ(?#%xgtN)Q>@{hl24gRr*!OvTV`{d9L2g!9d zMP>%$Go#vo)l`)B2R(++ubeZtH1A=Un|K_|E3Rf9dx5kKJAoycaPReY_MdluY4Z2| z?$7qmm)r7X@8Ee?zIOk@iNomb(HvkBt_6?ng&^vqAp##rP-W}+bE$mv=9z-{W>>yF z-}%Y3BHvyg{4C$z?C;69-R{2ncB~)Cm+gc7?Jf0mduvz0-k+OWsf_6_PHQv|sBpmp zZNpBscE$`y<`jju~Ks#c0A( zLjy~P(L{oqq$DRslQTC9{CSp%P`}1KrcI`0gOTJ!| zphb&73)4uN!O_mk-t!k|MvIznOw>pL%JNVuKBvW41!in+8K~bui`$2i)9?PO!)9Mny;EFLsBH5H1_vtf)gyR7go|Pc<1^FmerAk$ z#;gtT&>)!qCSMQco59$$UoP=0-Bkdz8~Vp~K;s%C7A!Q)O^^6D1}Z2U=PLz+I~r}L zr^VW}0R z$g6LtGovBj1f4IyBOrym5DIxU9rUd9)oo$^F&T?0%(mw;6RQEZHeKcpms5{>6>2R< z2N_kW_MScCZ~bAcjxmGKN<)kGfr6mgn4JPuPtH8g7b_r*nt;AN>AK5m_NEwBSC7NB zjiWWA8$&XSgHGsLl)rMCqCnX{pJK>=zS9*sPEJBT?wabbq@|Uu$)g#o3Fe7t&@4z~ zc{-2Y>>k7E6sp$Cp!G>B{pG7nufJkvQ8!Mual;_JWb23S55ZY9IYC?!{WQ-ls}xZ* zM10H5#kUOVK3QASGWGTD+ulCd-R*84D@LP!cUxzyIy0_5Qn% zUc2eT{PalPtvohDNzMRl3q$uV>AhBCy-!vX%u5*4b=QJ{fG(l&^L&wIoCDs0p-ye< z?jv22yxrIpD=m=PNakdq@yb01kqOE!qDd$tvkb(&TXCR!{%qCoOXjy|{fF_9QvbZ* z)hf}R)5O1ncaL&&m0<{vvJ)R>(E#i7sIc7czY95QF!Stq0`UQjZ{$F(=#H>&Gdh&t zt$!zEcTbICyOUv@HuCVR^;hwZx0*qr(9Cy}93d>|yyIhMR$8-0r5-utu`Pm%+d;bz z&}t7DjM2D~KO(Ox4A*7fSqXEuaql*4gN6Xqc^*Zzz1PR{K&9394v%nL&qr~DIL$+0 z$%YM8L_mNg#9siLnX5FO=eIoyM2=L|@dZDo|r}!9iaY=?q&iyMbC+ZM7oS8RlKfi+_!3^2Zd_lm1HlVN(Jw(pl2^F#*}Ozj5o42t4Dp437mDj_;jt! z5e|BSDe`1~lVtOGYoFdXFrY&fuVlIrV*rAD#x*$D63FesBLf)i50gO(0T z=pHH{BIr5}Z?dXo-x6C=0Y#$dS`y(?lQ0tbU2(+(d?J~`LXI+CtYIK!XTmcS5e2wo}Zl)DD zwRah7Ye?0}YK2OEWq)0bWcM@2z-yzhMyay2_5E~ z92T?-|9O;CT31S#PB+;2Dt`0}>%4(AOSiqN9=rF7%8 zsx0`IFlcd{s4x17p953}1%Pu_=?!6b3sM-E>uWdWnIc zY{3*5^cay~#bYgU8Bgzba?dOX5lCdSIH~Rl!xla8%Hwb$D&Yh(75_I*ko;B^I654%p-! z@Oh{WYiUiqW41x+)=j+^mx9iQvxcgKT0f`4(vr#(?sc3?$<_#6hy&}eq;kmRHZYGg zIa#6LHSeGKzHnJu{7*h2){GY^ynWDA4%rk^qxP%S4qO+k8@nigSkUCMRf#3q>a@zn zSdp}Dlo9bpXFRyFH0ih7SKYy&$#1&i>A^J`?%1w}Dl%dOjWx zUU|W*v5rFX|6FiHGS)ege<2i-U>^D$)rAaFVKKxh=INwsJmAR`c#;_X(!Q!k_ z=9kF1^1o{QeKrYdf*kTOr77x2e$6JT`mIEe4GgdCHN<U7(=hg?;GdDH!6=eYM`YiIY(VOJq(zATq?id52r3n3XBo+Q=lYjOSo5lZ;0{4OgL z5maNC<*_W2Vz33|@4rK9N~8XR(>=g-`g!zbd%Jsd^nc6IVW$1(A7cOCdHiVY(VzaG z|Dum)|9MXKpPlx1(d`XDTfr9W*DK(`@&xVOJ1!5p2mowBqyneIYI!v-= z@N5$O12emv7sYseW##hna(T#w>XQgqY6NBRkCai_lIlQ`wtE5naxF;FdeXNlRbhu+ zV^Cl>Pu+0A$QS(7Jv`bu*q@un@xz{(cixKmf_}T)nXjtd+kdk+_h_~4xx9*{!`!?X zd}BMr7+4QmuqNM@X3_<|_2&4;gTtd>ZvJpN*oh~=2@I1_-ao$vmS#ElaTyr%;6-va zjT1^X`ylvvIoOVean8;baFR?ulJGd5#Him-FpOj$jRhO;pTv3pDYU;3T3VbrZ1!m9 z<^I+&P{X+P3RQq?*FuNc(8AmXuBos`(i242_57j zpIn$uv{7ncItss93!ZYH19s|F2QelzQZk6$=3jTZyU*ub#ONL#9=_S1>-Z1(5_fLR zf4Kf#=hjvtAHKyK*^6 zpxDVU>wnBK#%W4-3c#zc45olzz_a5 za~`@K?;;UW9;P1JNl4>459=iB=$wal?CLrPi03?2@lWRF9=k7eqjTSSaDF`OZatry z`|h4lDv-NI(~p{u(N;M zeJLPzxbTLF>BxNh$cfCqa*xi7*E=@vFJZ7Rse)`1!q(u_Y%_K_qN?Jq@-wV5r+k^Wk}s{H?bhWU0Pb#ea5vZN~ihAe0jCb0HuVxkX*;G{(=OuFH0U z74?g;z1m*eRGxAi*R|c&-#Ya}P|@$c5+oIK^mdRO5+x!1t$EFEja(Mdw(ASg|LlcT z(OExxb(O7O9RR~`4dc{;CQse&WG5f6)a_=&P;ot&yKEICEpyVi8p|E_iFxlps649b zXH%bzs{WW(bk=%m784y9EULDR6piVseOP&?38qB7&1q#aMpT}lD!Y4q0?O&A_*_rz3!o|qC({|<)R)_K1x?lJXQhu!*mP1R z%I?NGP0e{)18ElhIGM4&sI{owZX)VbGZ0w4mLt@RdSUMk(m~y@JCKz_x!`Urkg^@G zCx7Zd$TFK$61a~BIV-v{VWhXwg(VL|?tups{oEXePK1=cd;pRo*X^;<5(d(`EK z@{SdE)}r7$&Hy!Ku^07-b*qE5>oE2#*C>nDpLq@OxC;pW6;CGE-x_JA8lXo;;Y+1x zYyrY~s073MEK-xj69r{(hqI<+Ln9W0PA{lo)U{RifmLDwY3WQKaO;~@?q@n$udUp2 zhDxBXYj;ZB(uuH%(Rgc@uCk80jVm1!a!RnPW6N@Nbo^q)rGVt|e+7iH5 zlxauEIZsK3FW&4Q`${r-{LI&qVYA)WzLpH0c8_0gy*cXoYBG9*RrcQO&V5_4-e+a? z2)?^Kk0c|lx5Oh5M&scyN@L)Z-DR#qX);@$p|!D!Qo7_Bl%$FlkePioKKOzctEbfI zL3-HJ8m6N{cO}%0t5t1}D(x35=Wy0OFRrqaG$qeQ6#VgYI^@WY`BwqF;s!%u8(++I ztxiHV`fXvpYFkq*=fAjpN_o!}l+5AXDpuIzw5jI5^4V8O|ZG8=W2t9ay)zfg! z=WhjIxi8vvC6Vs4=t<=hzahtcUlM@oJbu_Qoybo|?Dp!bX_;A>vl)3c9Y*;k2#!YH zhs2Q}D3y6Ffc>3aznV$kGP7y9Bq$A>81)-RPHOv7hqE-kxyJ|lr8#rLuva$xWV3`3 zo|8}>&i#5%w#rd44_D+H9-M(3V&oR7v)k(?wjC)YxB=umXYzTFBN10ncbeLv9fdICLXGJtla zX20s-7Ntwsa{aSDdDpAzZomPG;NvgtHgY}8K=Ed0o~m4i85}OdJkJ;Byed=O#ekzX z!TItPsJMZXc5aT5AjV@Y3Oa_6hLh!;|a#Q4H$+daHnJ*}c3I$sV@^RcxPVr9hLirv!_rZJ{ z{9~4tuS-m~Fc6r;FSJt;a0uQ~z#K_`1q}|%Kq^3B_@-IvCgvCG0NEu4AYOx)qQdB? zj0Q?seD#6lUlSPgObj)u<_qZ_iNm+*)!hJ!hrSD{UTSV@jCryX=w29)=-psCaJvTSPNm;yoXU3r*B6^!W=N ziTH(MtuB20bKB`N+zFQkf!c{ZK&V_kJo<>l>9CleS9dV=uFq4hGI zj`Ix)t=gD|R!A4Yjog&P`eHdyZUaNe))t`d<>#2kDWCKy#K6w;qn*EX-%$iUT@GUx zO^{Z_!8n>&nT3;HKe33JnN zEZ;*IuQAAA&e7`f08{AzsXm)TX%P>a0s8#o%HeFE#Z59DNw0%(JjtO#c7ka-ftR|s zNZ$41Yi)U$XQ#zwG~pcQQJ!c01eO3@wEN@?Db_&A5U`;ECj&s3Kax80AvH9JfxJl| zUiFFsAY@ZY5D8oytyfd*QMezfz%Usl(h4P1;<01ewVVRmjjx*+<}W$LzcCGNJUtmE z`8mc$9w4KZoJCPkPdI9TB{15x`D?ZIGo4k!h5zD^5x3~!?o^po#vbV$V_ z6nlcJF*b`Vukv$@Pj-UyE=D>7oa@LM*93b3r)Y{UBLSL))3NT2m$B&h$8KNjJostndG~oRzjXw^=bORLJI6mByg9~b)rVXA$A1kDUIbhFe+^y%vx_s{ z{pIyx_vk1%I1G07UhnR7pErY@{q5a1&v*7;2G5}8{=spuyR)}*3}BBBs7V2~(}j93 z0LWhVaQjDiu=Q+bcjx%8&EUn(@jgO*0bsX+*IS3jJKJw|w+>-v9KJp{>OvQu1K|Cg z{TFDS)!pmvAH#^CWq2BNe}bRE(T^BA6Pr`^qX10Xq6R-6>^|?p!)IOS9SXAC*#2K} zgYIta>@|buTYFnCyHxK0;2csx>EX{mcIgqcxCQ?wAsXjq`(Xe05Pss^93LDW>&idx z9Ce$)*5S?(PRxtL184vz7U~=j7^u15WjHwL*mHoPR|g8=SU^}d{dwNq0$%au5mvXC z5~kv-e#jEp53~Hg_A|@=pKYJNyp7rR|Bu$z%JKid{q|4$|3Bp8+W+&4lMldm9pwV> zkg`C1x8C`7y|Y$!0oaB*$=P&bPCGJKg!B2{Z9_nd*?ylO*{1vYiDjx!hhAQ9zRx52 za)yR`A5Hq_G@kkY{Lgtjyr5$PIYMOIXl_a!<`ZlA>ojj<{{Q?>HtgR&B4MPMWJ5|i zh^IVRmS$-yO7kQ*jiX`;Oat`*&xn^@jD*yX*-VO1rBAqo1CQ?Gkk=te)Pe`h4+8MP z;$bOH!^^%wY_Er=zuU*u$zIQu$MKmliN$L7Z9`go9ipe52KMvL{#wU{0gp6@3QOD` zQ1&;!xK;2m9Dh5%l%77{J$T)fvgynjITkNv+jTl@H)!LG2C5jKoKROu0T^?pxDL=f z1w)GG!7nQZ=o5Q%4G%{5{u6ivv{yQf`cToh^)!Bg6}u71fVCnp$o~C8sLMLXVO&BV zr>o^@*?V<#+}(R!dcJeCb$tBSidlr!Ej@j+d$9lVzYvNs&Q{a(dJ9+xWF+y&Hvi(J zo07Uq_`x{6NG4fIfleq>@d>i_=;(lRMfckr5+x(+1Rzr&j}_;zA*CVo0hg4a9LswK zV0NHDGWwqqY9$v-aL2zH6@m6zP$VjQo5NsFW0YfgEX%&0j)p6rdG)~cDcZKm%m9sZN zz4$o}@0>hvksbp1MfC=49hle&Ii3@>JWt{Yo)yoYS;;&pteWtZTg~^%jOm^=+bg%8Z0JXxc~eafN;92j^HoG0iX3%cYs#R}I*-Q@Fsm3H z=al9DQ8t(YA@`3opA6{p7x|?5m3cfcYd|9)JWnKezUD2tM^UGn~zIRvy8sFSJ?IK3AinlA3bA!`uO^%M!CE3S$7)UhZ5fF=lh!v1Pq!Y^y zQQzA-e5IgB2xJ0*>aZX*LN;&`N2oHi znI8#$fGAU(XE~8u6BZ3HqPu*y+(amtKZj^5l(HkIB@)$hgonL)j9?O$wpI-O@c|zO zuR%zIdAX)jXpkAE5yo#ar;RFE0m7P%3Oa#PIXC}<`$iTFh`GlNyyW67ml04-YJxFj zMm~WvkKEiSuMMoNx;7Rg^A*0)mS67tN3=`F#RQq0o=H|QKzEP=<}-D+FmJ$7mKO*` z9>U>i0GuTk$Rh`5SvG*F%1~NWF+s^{5)SYzJ(C^kus<}iIStB{-SA>XV<9DRB?%I+ z4`1n9cZIn+>v*XS>M94(WS}{Jt8O(Ds1{y2%lKt%H1U=aahI+tVJR-7Yl8HGSWRrM zA2)rDMq+s&%Bo%Ze0P^4_Yy(LSSyZz@V91qngnJPU29OhGi>Frk)@SXfnabNpS{`H zecszT>S1G0_l%hAuu`6|%Z6n!3{y*U71n{39$%r7IIN(! z<+900l@(Et>iCuB=0KE-C#lvNl4~nYV0KziDB6fL+G-+m3VfI0{Ty0tI#ccq>C%#7x%??<3?$Sx`5Z+NE~?@7_qWxktYL6D1^u8vTlNM^VK%Nxp+cPkg}S> zc245iP0dDmrup=u0?UK$@O0&@-$x(~3E7heYs(!vy763^gcb-m?dQ*v!5~ga52SK3 ziwhzGp;H8pbr`dboItVzv1@}`^$Acon3!JQK|WrhIS%*bz98>t3=}jP7bN>5YB}nd zm-}zFdp%OCH1yBK_UdY|6v)rLo&AGDEc0|TSX=E-*ud*!VpE!5UkFDeusf7yk;V=Si=z$eU7<)qNbgTGHR zPBjL{&Pb=itYrL{LPeJRjOoqb`~`woIywKci$P517v_Vj0RDB~9nH;2nfY(>`OrNP z={{G^9o)yG=!%@$(eRA649m3~p9*QB$X|SEje7)Dc6O>9Hb4oiyj-^&A2wMU8Fz5* z@#@#Kl_K4$l{c_&>yW>u{?yxLu*GbeZ}y$62pf-@&|Xlo0N#qCRuH*mK39%l4$Mvj zZUG7};3Y4sf)Y6BRF%tk0Z7_pn&Krgwm@u;WMLa#S4$nid31q^dw};qw%j@r5hYM( zK)SLO{3a(bf?=k!tT%8qW>(OGC(|^60h2b}F`%`>o6RM8gkM%ekIsl@)`nM+u2CM< zgYOCa9tEPz8uU8!&)ABJZ8mMl(RVg{u*@1Ru`C;j4={!-!%)a|<)k%)qVO z@oP)eRMxxP1nO3bItGH$!Cx`gafEl)xy`!Y<0vFpC>UG=+s_hY6Xya19Fk%(iN2Tz z((x5FfHL>WFF^c%8q8O`=-?ZCTOS)3rZOAgmVv+dZ~Ic_o&^uXVWc}7({j_AAhKc#=nt5Og5K@Q*t>9BJM1PS|EA6 zMBSD(Rg`oFKJAZ%ZQfv4S$oxh+LO?_WRO6YsXHcLY!O$=b znw|MBqKl12Ov3dEs#eHyW-$QPC(tv6lOg>KPNP1uFA3{`s>!Fi{RwBMs8#S+^bo3F zOVd7ev@*P$G{@mwgR`ZfDR<)}+|;kfoR5J`yB#WNQcs|V4eHZO+)CvcfiEazCx1D$+H7DmCE71n0Tv4-WA+5dkI3#;O_#DPmMe6-ofc{wZC_}+m zrzdE7$q6_;J7K=yJ&))VZDt!MO=l-H`RFi{$zF}ZWUNiw_L4fz63H-b+y zhF_|2LglrPsD;2!U(N&t?j`b0@8vdmlj%+9-kP8=uGAf#{~YG1xbB0{g@l6W@i+zs zG%cXa4E_?~zuZRDKo?NV^a9+A7WmfF$Vg&toVOq@M=k= z7|b{UEHDw;0OZ0r>VHIpRuICP!OEyA#{1LO;nv~H8yD^Z4XzMct99m^+Q;#{(0?E zQ8z2PkCrtvsEZlE&3@eX+W00N}@S?9CY7@Wf-1vF<#JeAF&6Bd~SQygObkQ zv!$k_7mX7(+7Zc)^JlP6q!#1x1(4&`HeT1*L-0V9t?T3zWbLz9@rZ0lh8LP(Bn4;i zLs^V2h4AQu1NRt@M7%IT)&~giWvZ{vM3N*r6r5nLiIZtTWl!SZ?^6uADsJV3yrdR9 zL-gI|c)omprY*ckg^eqSii%)M)t$ta_9;>B1u{>|=e5ETjA8r7?)EENSW=Z7fyYcB z@W+|MA4@WmEMyMZlM!ZA{8XX*+37voIX>FiKXw>2{KJGzJ$Eh^=!hTKT20*pa~-GG);@T3CBfSvZkZy$cQ_W0rI?mfyX!CAZ_^dba)9iZ`0d?rkR zTT&oTcQP)pZqJX;9aCpzTDE}8zaRt+_Qvosx(2Z=n|#a- zO}a$c4>)rq>13eBx9_|Jj~}*R<`DuO^|!WRNQ|o6+2DAk)p4B144X;pwcZ*JuI)GMNOqa1!^YlN`le`-CItuqEg)o4_35Md=2a z&=S)4cyVcA)}D8$|EDZCj}FC+oH|KlG3HgG$mN^ zz;3;Is#Lt}hu?kGunE@eG_b!T^rcsdh_Kc)B=@Y$$p)A2+7SXQ1q}!-ekLWG6UzpQ z?1D+#gb+mi;TfpDDm{80D+Gxc?}{u#KTJ5VWeI_l9c9|mJCE7(I6?v-Tr_Je z@Vb|o1!_RWlSj6AGC^``^P*y1K$1H zwy?I#!B0GEICP#Qoa;U*6C*WY1V>mHb3CzvC_81!Kr@4G<^L=n8b)L$XWm85ARfy- zj*zr%nUMzhUx#$vgts}@X@OU_7?wavqVl{z=hGA~+t^T2UvpJ#BqlmYbxM5$>A%!7 zvsfGq!Pv`;t$6U*w+1m?!27FBM5aTXN2?`mgKn(48*g6!w6*)DJEJSw%l!-cpjy)Q z1!Di!d-mqV3rv&pH+{dz8OwR2*n43ZO|L-e)9-1|`i#0c zntq_IGJqnt)*2IKh*rp^0o+mtwR5C^u&k0`Zr~U|MOtpnh`A~*CLIB8HK(k@v)T!> zr(|w!{+r?HeAR0hJHB0RKRlbawE@;J8#%@m%PAS(X`_*cO%DJE3M)|~GiDHK17g=< z8=NHt1*1Mon{2?&;SYXYEnN-jfkOwz(1Bu7WCLy=Z)^4XqZmc{3n;y)!f$E&T(nQa zBO6a;*0k~-Mr6}VTcLCzlU7UFLJC=5)dB#b!JrZGJ!}*%@%5`$B%hv`BCX0Iqv_BT zS*$EFNG?o~m1-!N)t8_Z0DF*4bn$AiaC9$y53&$CPYH6`hlaENiP> zp7qmS@93!85sO{6!flv$$=Y|1ZNtT&(cA0o{Ng^8asVSV-QG)(wq&P;X6Tz*dpkNo z{>=9@+B@3D1a*EuP>oiNq&Wzod%a$ik6^zJf`R#!VOQ=Q1YY6 z?K)2_@ZM8s0X0bhh3&mI3xRqi6e5ZQJ#_oSC%quFf2h#eZE-m(P`f3JEugGj6=d#4pSBn$dvr=@?xZa>g#MmMcxdbs&-x zX~2d`Nl6;RYfPVqL{xle$bb*&vg{AEzp`Lj7fghYch#mkJghgVbBy77w*Z23T;yDB z8bo1dU50llso7 zsdG8IxMe*QPIbtJHb{E$kc)Ec8Qs1$xp=83bX6DSA9-!WJ8INa9;H;t8#d{AE|a_* zSfSVJkB8G7|3jy7YTW9ezu2@=jooHHoTGEO;d`XO`r+#)urqK-0v1HUr=X8l$qmd% zf+lvqQDSJQX;OGoLT=|t&}w^>F6qHYK!l&8xZxP>0+_>V6AYp3!%XGrT;v4RWiBPfwG60^2y8H36zJ59Op8wCm>rM=Whf@lZxhGgLWF_|t>G_srdZ zx|&g2z^rxf0l40o%XP=jetus|7WJe>e~p=6XQ+$%(U>CBC`I`=D#(RLwB$gL22&Cb zhBz0UD|wiF&d}QNK4krcu6Zo5013krHUybo{-v| zIit61u^}^by!U#4YmaqKU4M?0KpnA#I)l?T(A=RqTF5>ksl&vgAq$V9!Df@>iI4nh~Kr0#4U1Jmq0RkKsxyt#ZkIojF0xriyg^8C0oXL%?mog4a3a&Kz zi09$B><5?SFu(OqI+d|>I5^B~pO(@x%vsliW}+J>%^1xHfQ*6c-XCA1sqp*?yd)>& zU+6O*ZeW2JsF;ic_6)EZ&$ih+e_#sK~>La z7nAvNl{K-2`-&%twzM>}^LS94Gl1@qk`;_x(uj6o?#Y*~qpe=g0Wa8?JX)ckBN{N^R^WA6o#0tQJIDHE=p~S z8@zr43)wUN{fzI}utdkO0a9VsFLPH4KyV5He*P zl?)F3;gAL1QxPW$Aiu}V3UV#lUAF!m1OPY(`5tl7U)hU3#fV`2M=dmNAsh9aBE z_69EFBOcJq4u;$t#gh}N#Avb|uw{npJrx9vpOqM5nVgSQ+tjN8H78F0Qx3a89j8~% z)jsE;qg&dd%(0SD*hdw_el^Fk#_Aky8Y@n`^`#qDV*JM@CW3u*aUd18wA1sxOPuxI z);1pSzql{|y8FDAJaMD4{~uCug~V1+VdQDo{Bm)X{X zU{Y_$?rvC9P^k1RO6p84yY2AC!sL~88>l=a$^UXg*=tE@;uQ5_!@M}$+wJP>F!8OV z0M-d!Gh1oU&9xKxBLUtk%Vxe0TUd6%_Vj(3f;Y zp*B)nrGkh4fj%2*%C9+sOvyc6s0vE6_+RMWZR*)U@6@3mdXI-VH>caJ3^wAxm<8gV z6IrGOQ%3CWX0fk{4Z;NAl7%_!8#VxZ=`fI$F?1^wpGR}1ded7cmj;|&t`~1 zbMQ3c**3%aS4Z9b-}9Lj{~3LQzC!rt8{$91_isz_pC7kZ|BV0qM||A)&$Qwc{(0>& zIzm2LX?IpS-v;e(*V~=-)zxzJXR(B|V^SsTN^qCR&(yLV_*p$LQvE#DW3T++Rea5{ zn1^wTm9R|DJzWpVHbAYP@1jpX2|8Hcbq(3wc}7nE^E$=lJmx~t5x6A#359|?iE=+j zB_>00r1-688X|dm)kCYw&FX{OG5t%jdQeGr1Dt~+4JXU%;bc|mG;KIX$A=maAGr0v zDsx%;0Qa_zf7B4sVxb-$zP$n3b2Itm?NSenUf%#sybc+jxGL5|lmgXhs{@kTP((58 zg&i&00?LV@Y=@@uq6GKc-P2=78ApZ}-?Ik20B4OJ^jBJE%(0;jkzKI|06g6 zeEQ#Bd-Ny$|06y&{l^st;@??*yryFR!~Y)z?MLg6zFU9veKqyJNG1gu$%)){Ytla> zfCfCGlgNEW>^+9~*I0fr>h(Qxe%P%#Gpr}H@$sSkEb|_q>fd{G=0C_NdyW5aOo{ot zrz8NCp7D5`hjb+P&qm&ZixHoLNLKj5gQD$l)SKw6B~~{5bKrz?GOA|}vSF5ubLY-$ zZ|j%iEs!=2UeC4344AWG9g{&fWjp(+S7dUH({NwH@SFNa8dCl*%MJ)CVG=M@i5EqZ zi&-303Pa%J(bpC;klRHhvIrJIBN%{nKo)g_M$QQ&@l7*$0H8u{E+Bt-ewjA0$#8=n zO9LtX`UL-xC}h1rHTlLpyr!0HXFuu4CVo=3qvGSvAfQhDCY`^U` z+p>k>JMOAIWx-~UnxUHaj$tFEl#{XZ#B_4h_0oDk=_Aa}$vIBl*=X}@e4^xSsK(=y zrkH@Bg`sq-v+V7NNj^nR828mW_sAxJ63J}_yRD}xt(-~x=2XmvgK?irV*C{Nfd$Pk zc*T!!ehKPR;SMC)b)1(-4DJn3Q&nU6~!4 z;^&ln9$zZ8xlS0_q$?XL`bp49ck+SXNhCo547=-o=*`d}b51ksR%(i4~;C$|89uP=Fem2hu*psJ@dc9d&uxL|=5-paw(Cz}DUC;U|Xyzg|B$3%s2Sh7QA%rs74 zQvnOB5f$ql@8KnKr3D87PpP|r zTCf3mC&FSE8O*||L`T9{#!lkBs^Uw~g>hSIwDZE)oYz(8K!uJ}=wMD7rvgtk`J1c0 zu7$Gc&?RhXGg#ZWXDx|=9JGQpv>?FOINh6+h%TErqlUS#z_nUt5_0Y(tp~pinbuaU zW;M+*>sMZ<$`$q3u2gT0SMz_}Dpgc~sfX@zg*7x}ylGhY%M7b9Gb^VU;f(V~JaBaZia zoC@1q;KN8)$aW3D9q&2NY=nV98Um!wI6Ugr?@#g-C^CRFc>5oUc2@!t9h`<}oI?oek6xC>^Ru&zAA5 zd3Fa4-Rhwwa(TvuD2$4>^}T+Utw=Jq0?m_(PDm1KATcmZ9* zCG3Qu+d=7#reoGf?p0_n{QZ&Z1KlhtRX74`e=|YGjqhcr^TU>Vbvq_ zi8B+=3G0Wf7eIy3P~=YvK@$w=*v_HZ{9<_+ryE|yiK#eoE8?4pTaj3ljSY2>V8_wg z6-8j^eFm}x@}Kq*gm3SY(nTRIJlQbEATuYdXydR$v^K$X%>H!me_dTLN4V-*oN|*G zxOga3l#V~V;b-zp72&`+$%=Cg-{DCJ3e3%f*Pc8h(V75rk~?gJ^juc}_T`6QHCSi; znRB9BMG)rjCYTDbsh|@d0Vet+=7<>+6~$aZ3JoNv>x@tWg%gPP(3^z~%ng(2_+Y5c zj7|&5TY!^f0fX{OOIinpk|VA=qEJh|PRzrJdT1%a9Q`TK)tve@aRz)^0}I2u?Elot#DB=jY~FQg zx_W77H!}4>mJYVxf_HStwA}=JLh#*nH+(n4E_~Sc?}80_lM)_W+=L26i9skj)rY@m zn$%S@BSg_A@l1Ync+GMU9Qx;hDWc`tC>O(t{hi%)=dQweN%tn}KAOaTS7-ttHJ+$O zZ2->>4tBd+`x?TDu7;gG(G?YwZY)`Yc5wf`ntlUtcjx7g$LJl2DTy@Lu>*E&zQ!^TGUPRh396c_$sqDzj28#W77Qff){zXfMCzCk($aA8lU0^UB3D=AY zjbFO%kj|YUo!@Op=hZ_xuN=~6^jyrs_3EAVo!;u7olxB*vItO;09G}}s+ABmEF=7f zOsGOMy2Vl5x`BZ-+9=qE{iyJFF)?TuCz8Joqg;6QK_*MW@^L{*CjgD+Ou-TrggC(|&1g}q%Ibp8I$PwJ;Mc9E!s|)C3@yM@ zXbDW5VexxxZQ~6kXa#D`jT%hp7GU=BK$%Mk9P195b8M*jEiN+^OowA|ZIGHeLcey5 zXaNh7<#{4bvs_o-rijiqGISC0INJ~AVAS4^69}>o2B9e-Ywr+@I21FlVbyMJc zxYUCOfxogTIl`qz!D)5V?`7)uQ&@To^SQV6OAj69j$wie;7iKND48qisfs~2Z)y1o z=6-!Op9B;mar19vi$zAs2=u|r#xA(Y-N93bO{ah+w-#ev&2e^5Vo)rO2x3MEYD;0dqP0&!SyYN7k7es?p z$u?&oxx7yo^stPJY@6Bq#lx14qAxDDhTjt(AIl})Q;1%NQNB6tgZIXFg_){ zvwu&#H9;L^^&N3k;&M+ak3z3dpY@4Ai3wTdISRKYP5RR>YdPS}qBd!0oG=<0bD9RU z96TTpCXEkl6h%Y&@3z zExQ_=vY{0?Dm_7vnD~beSg-ccn`d>kF{acFwfEla*44&vQ#aIpzVlOEZHz>9Q`-l% zl3{rJN?Kk^-b+s{&ReDmYsW}&m{a$qoDQgvdq$?Z|%mLZjs^wdR^b9nprEN)PO?s&lo)HlJsJc@fNZhO!V zC1%9^24c4GZJ$hy!>vXV&NYx*S$f$$-a35Q!zUE)ffCYkI7n7>=(CT*w34fumH9=( ze1C`T>`d!2VmPS zuvd5N+N&md{_Y&TYS^6%eh5A;(M^)~e0|nHUfppdrM90U0-1uZwMguNjaT=7}%QsRBe!JTE zv_S(gTr|hLQT1v60K)+EwONet%>Pv%GUnic+Pu~qRj>Q>dfR*LDNiORWGZPt>4$E6 zwP(Y`KOAt6I~84m1j8{@%oO`%eJ4s|Lr@b*M>5fp$j}|U*=`ll=_JYz|oD3?omPXvLi23 zmps*cd0YuVgs~|FuVR0UuD)RzZ3Yj5hHc0g{I2a9$pkVC4PyeVNvl<|vP9v{1?U(? z8ZJXyo6?<4U-PG8yJ;c@Vg0}Eba$UCmU#fEL8gwhWgYdpw?#n`&`O26EBx{rsCTF@ zh$fgq_5OX>0w6A+w<3jt#<*#6pr}-t5(zxPjgkxyP2W!tdsGlqqkZ%+S`=5?pOE8i2xv{@Q3LtvnyedO90Quy&BSh2(dO%MMv9nJ{ zSLk%kGumLR5crskIdGw6q70|aX|NsIsCt{Oks{Re%snxlX=K8W*6ip(q{&dxcMvyC zNiAUk7!aE$(H-Us#!PX#?Oq{u#12_AwNbl5NZTl4c>ea}UF+$^-P(S+d+=>Jt@Txt6MOm9Y35i>Dv)%lMR&nM7@4OpozVoXds8@q zyS8+6yE**qX_5_CH&wYeRb2ct22n!7H)9w?usFSt^HXrl!pV0&QnIETaIop_0oxXg z%QWw{Nsew>PJ0@N4!*M2^e$7e-~GAN)Xe=z1|sI=cKz-U(ep>;L_#(crzaE&6d6YQ zcfW4QxA_2hxebi{Q&PpSOodEn@nnS$s=3(iHW{ zU51S6k{M9*=}A-6DtCZNYLppJM^nCVgmQO)O6rvvPzT9HQ`9hb>FdGlc^zduuTbs| zP)Qv#1L_zGv$Xqk`8@Z_NzTG!pjdrk&G(#t*biqDVsebh}6H^WMP1$}!y@ zr}^IS>l~}j8N~NJr0r~-;BnPwHB`+>>6~vQKZ?fiB_d>5wvv1Aegz6Trz09mmw~YW)f|2(7hxYPoFcMBR(Z|x*NR?YREuZRk;MUIW-4OMUKtM|~;_U>b%?4@f z_^^9i!F5(4tzF~Rc#Hg6l(4#bJs3|54h4WY#_?8`)2Z9pyRtO)(PSIy?xd$#u-H!& zX3&OaFKJbif%+(h!CI$RE}pO$kGM+#5%?~os>oQ%H2TRB8vIZ>uT`}J*#5r)!=b;Z zxF$^ySp&W3saVE=r&71pRPbCCusRwnVKM{m5WQ+~KRp<9Ap=8aZ%!()gg>7M#%x5~+g-KPQp}-%>Sej1dR}i@EprZAwwIR_4%{aQ zlWB@~cENj$zP;di7Ta@~X4>4>Dr31PUB~&lUNlOp%%^(k1g9Ch@erMLdt6b*x?Njr z=(sUz7J&|n1q3r|4wPz?uS1U)2Z!iqZsUigl*)^EY^kN9rB1j}RW2D^@lqNCF;xY_ zi31dN8BfywM56!ul-q*F(X8xd+deOCJa<+Fe(;0sH3A)KGMutX!T+q=6{$`W2jrc% zGX-bD7!zE_!4FqEgMhjCbW9h;bg7T2HfTncmzV2nV^9!NABy6gb9`mjw=3UX;Q>hS z`mp=DURj3mc8Lyb)D#%2HN(ZKEhOlKcvMdvjGhpS^L0C=AyWC3tRZrk0c9GAy<~;H zyQy4DV3iF4&T7hqK(T}=p|TaXTxTb>bxX#CPB%Fgd?6gYQ?oo_cWn-*gj(y|tu>nY zS&hvw*0grAe5Y-6GWu#|i)tOnFk#F1@a>!%wf+~!y@D(Vg1q?ld+JU=+hZ34*L;qGDg;Hc|y zV-{z9CtC!B_2#go`Ng1w28cGBO#4F@(Sf&b1|KX9sWDF+YvYP5*SZ4g;3?jE3SV;T zabE%ny+DhC-9ER81ENOC7A7e^0x=VTZMcj3VG|bi!xN|of0mY-L=W6m77H!SL67^2 zTUItqE>|e6iQUMDcQtk-2@TF_kS{~l?01e|jak-*-nyOPcKzKjPdUtKY43Izjup^+ylaAAZf~?>ckA#mG+jLBH6K=Snq|vY1gWLIDRoA_JWQq+d z3CW+If7z%0{QpOieWe62H=O@#?X^|^{O^3*`Sbk$BR=-|Pb<#ZzuLk9JYHE{gRkrD zN9&ym4j>B7;xwL6s4+A*;C#@0wQ(BtKPMSXIm-)l>+We@NXzc$VHw4KE|sdxEI19s zPsnNVH;~6cz-#<%=O9@8heVR+5FPjjB^#UE!8!kr*3(^lY=>UN5E`oJG#zFrVv_WP zFSrgmB(wJk{J@;8&ESE)WXF0|EfQ?0ri6|F4uo>aZ`$z}y9a;6!T^q9DB^n&kKqwY zo~l<;9=l4u9g7Vt0FtH~LhNtQh3sQ=jww!^`M~aQE0+3GF6?;z8vh{11$v}ZFm4|` zffIo#(*UyueCt1uz&V(MWP{9HNN1c_76aIOPD)?`A(Y05g}m5Gf9uhWmv?^gNJ%x= zJETPlc&(az^ey6I@u+d>QJEog%*9Z|r!Vr9^6_p`T3%~;R;_h0F-?HOJ!P{s`oV6OZw*t z86VMZ4Nrn4_1M&~uxOQ5=gSwztP*rxqPsfbhJ0MyldwdK9DK-KEWUzxO52*l6A}He z_9F&mB3;^c-Vp>2!NYZfq+yBB5O8Gdx+zRw*TsL?a$BcKC}71 zucH9EiT_*eRPcX)=KuRcK0g1)*_P)KZZ6sOrZ~Ig9 z>Rcuk$R3+Vau%ZG5HJ&V3FKljk0tzAS(ZT)S@KvmnAwy4Hur1Z->pY?tMxEWCK+bW zT{IJHx4NsVUscuB)m3Hr?-i|hV8|@^eRkYe6z#6_l3r!Z*Rl+k$%nvcYK>;cuGMPf zy<>n(MGB%=8){0hGPdg#e+v`j=SHYcEfDy24Nn^y@SSf{HD)nhSPLka9x!{l@|qR= z^(vV9$nQ|W^Q#TKrP;J!w1HXW1Sy*(DK6=5yuUPgXP;a`V0D8^{KH&#OkEg*bc%bCSxmUGvsYuIH{PMF{%k_A1;$Al zN|SZvQBr#q%JnTSZSDlx7jT8%U_hn4h*GnnYOrL!BM!rjT01;4WQb&e^l_(33tZUK zJ}Tq>U7yAB-(WTxe;ozj68Z0Gd$V-@w+Y!F<-Z4bO!<#ToCLtmmJ9&B{%z+e1%Teb zBf#i-mNCixEhK{Oei#;S=S+T)=1Gk$JTrV)OZWzsdu`DlOkErsiVt zf*b~PUsKps(&XUJA0{EXU%RCbNHa)vov13RF30*i`Y}VvY#%BiNQP{NX>Wp2qwmBH zNfG;Y4bxtcey{H|VtchgvID%ymHOVBH0GFH)D)0!=1zy8B*Vs>3go=uW^kED71=CH zF&fKN0RW%_P*t$6{IR(%NFh4Fvs7NfTh>Ho*&3_xojb^;_fB87k5yiIJ*EOcb|6KR z_kfk694_uEkRv`jcS%)a<5dTAjG!fyieJi?eT;6G)!#x&NrIcBvV^Q&tQ{e}){p%`61Y`(zg?9Py_Q|Y^0 zIfn1V>NRwrLhEsFk~!t7$RgCL-W?Zucc)@*V+k*wrX^VAals2SPV7pIKkSs|g7h(t z?!}*@qjA`1)=RNERz>1|128_EhZm|hX@x0s2HDGbHz*0+G$7SsK1xTumU$2 zGy;#-B6<`6)9*yV>x9=3O$I_zM^8K5YN4K6zH`AX<`41M5+7swAQqNjr>( zi6W1B38)v6c);Wbcyb2Z2M>0~-X#5u8E6a*R?Fp~A6oDkdn0pcBe;AXx>P^*@67`{ z7M0`Uy|~ZDGE%}Pk6nhhDvJZSVAy^uZBV3LR@Tt-!*$6Qr`Z}J&D@}D3g!9*hLtJc zp#08DrzZDTQ5_$d)7xnXNJ|C@? z2d>Y7Fzj8v?(Xh)Pcb6I1q*KPF0Z-RwW@{r$hA|*uWDt97=^>U_XfUps)bz=bWx0z zJL-3rRHR{wj%o&EGs2W49Ycn6G7-|47Pz0^N32^%?h$>mbmiXC4=m_P33R_jgIVWA2k4?^K5(L*>iNK(KFA$)$}{zGu{#K)aQ4O0D)i>RkmS77WKQ9j3zu%yd{1jLX*~f+4 zbzxB(u!uP4s?!T`juQrprWY-M1i5x^yf7j=Zd!~`1YKOf>YS$Vv{wwTIZgA&@ zs;su1BVdCBukDjs5We`1oN!d)BHL$6jjn75iPJa_DO>yEPp*vHC02Dx+s@X%Ow4wg z9o%VRedbP?CbmTNPc*S}#tgDYcEpDu7-wdVT1BD#ML^rFX4A446sI5ssyOL&*4FsO zB^H(~v>{P`-O1JRu~gH-iZG5f&Di@fjWhsa9-Mb=O>&lU{zT_5@Fm$ANwujXp=B4k zY4U~EZ?38Y7%CqWFgN+OIslrX&l>42!)&*zi|sV4I%lkr&6bjEqGE>aauZWs zYQZX#ATkcwDFeC5fS5~A^{+9ySguy%ys({((HohhmzM@~(tXu*0y7rWWViQkap zMFBiz(`-4hb1fw(&1QI^_^O7crXClP6cq@Qkc1aU=d^p&-R*T97T4bXbc*qJwJEe( zo`e+!P|m1C@7>;Bx7U-%%l&O=(hT&AhCB4ekrUdYVTA617i;L5gRZ1!*9Yv8Ku^Rf`DYJ=%`ngwo@0cMBx4!K&o zgdZ|vrc{blP)AfD&_yxJZCD}`|7=T@Fm*UQ!^Xb5z8bTOAE`%o$#Mn&YO9&C@0f~o zRlU@;yWA|)hL(%Q4mZ~l@!A0=(9&*rzGnm zF2&llRpyI3WKCkAJ;wYwtO+3#8W15gtIj3aSYnz0o0y>b3ay=}OI59STvV=Irruy` zPOY|MuxfN{gV1v~`4JY-Y?iI9X_9cLT)wkH+f=Kl3@);0QzliyoGZCOrk<6AQc)#9 zR302EzP$pkH)@|R?#C2cgmb(QDb6QomQnVfv8|(0-cJ>|3t#p~( z4H&Fr$h(DoJFA6?XIKo`7mAsKQmi~>XT$uELJYv%yhpq%9P;OuK&s}HE5$^DfrYU) zVlr;HL(tY-HSsX{c_vd>abiv}aTVUkZaYHyM+STiHC#ukkL4uAT~-h$v#V>o%#cj( zXm*kz1A$0ev{2+Kp0laD@Xg#W*K?$Q6o zU&{h)iT)Sf7483@w%d>P{}1xy^uMuT0rs@L+yV?)+gGyytI*TNzs&}WHcbVc=~vX$ zF44(W+$3FUU`9sJcnwn8Zm){ImU5VHq1b@-WJl2D+MX;NB2+rZJUe~YJG*>!c)WXh z*zM^aJ3MIkPHNZxgSHrj)LM;P$=U2*v(dwhIdz=$Dygc35p_gfRd}a3>B;4ImR=7f zKk1?Im(-k*=kemfspUWxsWiNkjA#FnynS+E9O~}rY44}wv)vy_MwJH2*<=8;&a9%owlOm9CsiY_n`T}1TRquZDT5(U-#@Be6&L9IdjOG)s{E7E9B?x zOcA95n)y!7aL#vhm8Bj_*Zh0pYAbr|vcE}VJM7HE1JRfOuXltsi-Y+Xu!4?<{1G+MPB|Vc?)nHiPAslHb zRI1A~()%>jwRHx=VsWSlHh(aW}VC1Xn(f3(fWPd>G^(gPT~YJ5qPvOonuxWq*z zfT;tBRsX4#qKxw5DpS1Nbd@+^X>GfZ$2zmLDcap}GnL87lC~<_s$z>jENCtp*%>YU zK+UYOEiyf*DT};&ji{;(_{gD(Yf!Bn(|T`_*&d|SOazie)^*yHPnJ-2e2!7$QiHzC zu`rjDOLlQdZPN!O*^X~L<}PLca&Z;`WR`tMQ96>I_;RqVTxMm=R~*@rLQ0NorjyF4 zq^d?%si5Sdzb{K}2KO?v!18$*=47L&-#BHJvEPFBq2*uJIGwp_kye`x+SRqPjoyMv zj}jlKr&+Jeeoxnytq1SvXkIzhrE(K#r<6^a9p+n9$U|m_`5cv#N?8srq8gG|86BZZ z+|v_=J>rtNX67t3`!^C*oNWuV(miR-pVLb###W`BRs}NsbRI|6`D7N6Qahp(#@Pgy zW{u@(m^XVYy+^A@*ANI*s-d|VQ+4L^(z3JO6(jFMAUhpgHD%F}_6 z^squ!v{^G1Yse+qd=PWJ<}P>(FITVE*5rjAni}8Zyf`_ocyn-a`eyem|6-Mqw7;3} z)bxpT=*2ObPN3Lp})+;h!7%`QMX9r#~#Hn-aw+ntTC zuK$ycK%}bgx}^NOUVgh%Y1zJ&2qomx1CZDe!$~sA^qP6s0bh@I>`>hXA-%ui#Uz#i z5h|rdR6+XcR}V6!qBN2vH|O}ih!3SMZW$LUU5LTN;VeSWqe`8JfmA?#m0ghxh2)KV zX4Y(ScyRb1=N6DB!-7?qtfE$H&$l|C0S~>jC&OXrV+6@z2(`8$kXy zwl~__?X5id=S8lqxIg#E$H!xl1xEd!WvpLy-t!qY_EqNe*fJ$Y*D{Kh<>;vcfLeoO z$%+Gk?@tc*8)H0XFfV=EkW@GUpxUZ0Yfn?&qZuqGb>$W4X-XSzR!!qA;c0fu8eWWN zQ!LPUVm-N6!$@(D+*E27l@igUr|NgxN8#GZ+;yro)KA-7*WhO6|$*auM z&*kY?<{9Sl3@h`*xjb=Yo=Gmxq%zMmmuFg;=O&luCZ9(sDe1&5OxbED?_SLIIkFpU zVARl|%}=dHdqYgsz*pKEGs`Iz&orF*vHw^x-IM~Nl0}Ecq^ndwS6mdQ^NqqaafNXl zMtMDK)va-vS>G8KFNFoWt-uo7!lL-;i(qJ#vjl;OoOXHe=FHL8$rlvYdS`PT<}Q=x z3hJR;bah;{`lZ0$aaRVGqx;DKR62^0<1z>eV`2=3u>oBrC6FtRPj+~3KK3(b0Wz7^ zJ(*C#TU_}RHHpW|04G9M8Zr_YIH3!>Fz7}sBeswvgDO|X_}MiQ`)(nu8WWa6I5o;S zcg-kLDml&4)7%Tx;UUq(&&JRh^Gw&vVY)JaB?-wgoF5y>#lZ_Q#OF-sD}xKngz2y_ zWz28+u6glZ+IVZzeQV?@q3cGh7AcKJ5J!gUh}Yjb^8Lc)Z{J5r3l-!G0dj-f}p80gg{_ zR0!(=Ap_*++f|6VT)|&$qg7Oe=K$#byx6V!ZGXO~rqrw|fePMU{^iYEJJ)ULJ&@Bf z=#Rz-CHY|i=tn2J`+v<3&HL$&Kw6!rio=Ci8?nT;&BUIWn1jBOS`MqS4HZ95&X>y3 zim9ycU*O=NS?N91e|L29s$9R3T0$T-&m8;n3;RCsXS=VCx&`P*2iZ{Zq{5()%X%@J zaXT{fQ@O%kRfW6z`*{T3y~_Q5^Df`~{lo8bzu%txko(>J-?^VhXZfGqeB=5Q8%8#h z-q18E%^FV3O4*A#pl=r^u^!-Ty_Nv_ivjwJ0WRuiSX#M8tC*{WGzth@nnTk>$kn(8 zgm!)5>`|cy%ad?yIV2I&Dd@d3P(|+4L*l!xLCXmm;6idYF|9Sg=|Y0b^@++_rgi$% zxI{g4*;rZ@8y7`-J(Bq6c%9>=Wo=ujmA%7PbBD52Fm|b}U&z`E!o7JY%%=)zb`Fv1 zLx_|jqGm@AY4y27>ROFHpElUWaRVkBsaeZcQt^Bx-Ch|uD}xuJv4ZwFT2xp`9q3f) z3)7pz$l82auU7Cwf}{4*Lfd2LDdk54=8#jb6&#jS_$aB@dJRL8u}!Z{tGx=ZO+2}1 zR%MI=8bXJ866Z8Zrt+&KxcJLrgfe$0=272EYYnisa9qtiwnET6__Lj!@}^S2Lqv)1 zMY3vTn;?Ixp5ePrM!V&ivxG{9CC2x0-a4i%+86yxE%GR(uvBQJIN&x3jw@rllIp}} z=Pukx76r0U%40)%P4;1k+!csNqHtEBt8K%TN|%L94N&c}(L)kOf=>=(oOz}8L7 z+P2VVl2#E{v=Yz!O=3z1<=M7rs2fD(3C+Ta7-ln4&MhNF_xDiRbW|Bux2>Uk`=F&%e3;ck%cK{&muVv@fq? z$@y=)Q`Y}K+j{z_|9^<5*%Ua?c#C<2QFKrQ(-+^PkBD_HmOvLkj{r$ht-~(@O-vllA`T~O-;0=>$g6DP32qBG4y-spH-$^vX-*;W>|5&yC?(V*8{a;HZov5Uy1=LJAa~uSbch|7d9^m-oth+6GKlRSKZ<_nv zx839Y?(vx;yur^fH_+{49H0*#Z*o^>Cj_C}aXL72feNCfS)F{@Fk+#bq%EH;A?>ve zBi+c7o`<$7g#R*xc27@te_G#f+&b5|VP{}d;fjCUx{&5xf0UKqLFLy(e&Ly(-(6rH zR{7xTIlR7AuQ|i{{K9RsZiH~#sCt1SBAWO|LG;Ry>S|2VM3 zZ8*ISW3rv_gD3({G4bxQRxp_DbnM;64JzV9!EowKld-MwZ#(p+b=~YJL>Y7S;x>DM zjxM6%Ir`y%h9Io9IkuQGp5Lv?0&DZN&PAb#)GmyEH)DMFb}3BUc#;feen3eSSA-&1 zl5dq#JA#`ex(OPXEgO`(QOCJ+?#A#pbP+pjh{InT^`))?=iPVB6@>p0P?Q8Zqtb93NLJd8!mpi!7n?M)|ODro&z}Y>$tOq3C)f%14M3| zAg}yNdG9!{IZKq+tm}a1G*0`}p9Dd9RtzTIZ6lixP|~$5qyV1p&qlKd4Tz!iB%paV zj6(lIFfmpy&k#ABYR&SXXJd>|;a{uOfd0@Ogr^4BD@5CFf>! z(rw*j+Ige;ESY3&q$cL6kPp3AAWwdamN>lNKH;DAg4ay;hJVv5?6~X&{>tc(uh2rw zXjP{$!$S^*jh%!X0jZB*;sX89PXI0yc-`GSJwwtZI_#ZA{)PW`#I3sl)N=!N^WPmE z?srcqU)#vnF6Qh0`1a^zzbi8uz;yPu%DxHN4-R{;b>1vzTjo~ZIw}RrZppH*-kqIw zPY;fM(%82hv&yys%D`5oDNtL2i8fAN@?J54aRxa)8`Y!3gRUAo9QjE=lk_&>$)08$ z2gDp8h=5PUM8Gv%dYOZmCZmAl2~LF}f;EM#(x9>_GIPMpL40EjAsmHhPDhOXu1PK~ zpt!_D@)90AXUo~NOYh`>IqO@%mCLVjfSgUIv#xMOhA@k#VZ?fW-8?AbcJxxQ-nZAE zov;7JvTIO=q!&L5@InMr1x1`St5UTZOap$}<~t|rLHW&*Zy~bYkXOlFU z|ojM&I4jKZJ}SK!BsbsQlY4eAk1N}5e6C)E&_IAO8L zq?|OdHrviRbo?JJ%0527;aR-@8;1R_v;A9Y|KHgt`G0=ee)RwRAP=l-80aJh*(J<; z-4mnrJ^wl&#&Q!(&|6kO*3uZ%u3RMJHSn$hWUqGY9s`v@gSYtkI#HK;t)`+s*OgV9 zy0V6anjL$MzW}YSnbMhzGw(&s@oWN{%|MW*UZSY0rk{-=6qb^U3)>l8h02BJvo)FH z&hEch}Q1hA!n>%4)+cX@cEYv2){0ontA+#pv_t9HelNkk&VeOrx-rKr1HPN2!Aw z&IltJ@PZaU{s_gUNi2h{*mVYNS&kLMKPm;E*b?{%;CBklgW6$@BRtJ@0F+&aKd$U? z{K*+8VIXt-(Ube}S^C^V|2^CpgkJQ;Twodf-)I;0f6v;T_9Oj&hzALVCZAD~&L#o5 zq88)iHkb@&5$`M}o{mF04Cle1IZo(S&=}=RAUJdv=vfpcy&lz*XZaBVXaiCXZX6} zr^bOTXd9KK%F9$VF@&5LLvcWDjgwnqfn}bE%vC9H8*|6{6F>*Pp`cJ; zgu;-p3tC&%GTdfDA)W7$k6HOjJJ@ARY<#j}?9J4E6h^C`#p^#!CesI5|Lf1zpO)_b zZ$94te~<@-yW2#BBbWwg@{y@%J%KYI+u$2lr@dGNa}SG9Sc4Yb&A!HyQsDNU=+DAv z+6)bG#X?XP2?W6$gh}#8NHXKwOi&bW18)++esv5qLv%XrOkns0%Y%>*IWyczqpTA> zpYdK@iEtx#|ZCSHt+<$7vt~-w)?0n_hP6mYPDtn zX?`AEIP>$-g^Pb2{8^(-b$aWKWf=;rG69KZoTMZZXUcO|7QhmmnKsjqVdO?STj)ll zer5e}_}rZ-6*3eH;~NjepLn{B$gFi*tnT7rbq9g>SVhU6Pdr<{! z5@5`bAcG<@$X|@0@UBQtHqTC5^{H|{pqhd~eeV9l`iqA;w}YS$f8Tf$_`5rv(Dys| z`GE0NuEFupCtvZ0XBM76wi>H#sk=0$oPO(s_Oj`ulI?&z#3Qi`# zb)!4h7({7Om&F1Ps0!L%1%bfeWmrs-r4&Swir?b%rJuv~I zf#+YVBHL*4A^Ks8zF=T}*J}J7`S~cAUMB+%tCB=FxB-cin83k=2!5IIR){X94!Q6& z7?Hvo+XG#p0;{o+Qo|3TG@NnhTj-AXIta;ZP^g;}c@675R`(=`-;|1AVmL`+%p_== z&_};huW-X1tD0~9H5<;6b*J^u7eCypkNyT>_&*dYw zP|_-?ny3|&VEC4AxG@OW@#eS42!=D%Nj>ikXeUgWY0?)5Lg&H!X$bgct)ZV3L2)R$ z*g+`@??I}MQDC=R=ud(oH8cR^)3)$XhVOA?Xwq*-Tmf7R&;)BSBCl|?E(kY|4zz<2 zm4>Z*(8Q=hJZ$t^(C_TEIj)?+OVjX*rZz5)swp}jFizLOoc!O_A4Q0Vc^32kjB0*q z9m~#t*V{$=pQjt0$NL`-@}U0zvsq$&5JXeY?F7xIxaXfHFonF>4-6dw18oe^|BEy9 zoMB(95`4Get@Z71*9|p9>{yU)IX--PF8X${L?1r;%5*Ut!h6?4I~Vxu<0q;6ynfp7 zntl5@p_DuN^qqdwV|53qDpdVLJnZ!u=FnRm`p@%6rUvRhp^g!9j8jwn-p8i-*tDD} z`7i`lH%SsY1sw``T_Qwr;RdQdhaS0T$q=){hG(x18-Tx|?M%sll)BDF+}jHCU!B0s zcPtclu(+u|l1C)$(o(4=(D}hM7^eYs-2XkugXH@+>}tp!!*9FI^|rIsZsL77vdhTSM0*0rc8#*Re%tZeYn?XV z>#Efjk*bxAR(mMWU5~W?tQGXsH8bVlo*IU3mcdk5t@xH>wJd3| zChDr6_+zc}^k0^YEMEV{HvS9iShoJ3ZkFOdY(Cq3T>lU8;ME0Ku+sEPMiFOi9joNh z1v)u$9Dq8i+iO(EdMX?2EO41j1JeJJTG*R>Pzo$-)gnWZyK#sFBO^DyXpTiQ(#B!p zzljJLlMqr!o5e4*9;;qA@8K2cP?-uDH{2vi``}zUk&}#_D_0Q^*ssvCK3{3RY^)4c z?Ujp_bhUB*UGKtHel}apot1R0(OR|tm)xKxACwga{usNi)w8%#_yH~FT_k?Dq)CCM zDOW%_(BCYgA$PoLOZoeb|KjyuQs({UI+oi1ZxsFiJllHuX#e>j4;%L{*U{E-bpRQQ%|cA!MdQ{>&17f7X{E4(nLh$zS}S^KA4581PE`>wc8 zuFmn}B6}kfTxt47C1sb11vfzi+d=tL(~IjQ`OtuO@l>n*OSID5QxO~>Rxe(> z$aYt1M@BDgma(SUMS~n&EmKW{x;jWfbJ-pAw#~Guh}Sw-M92e^!IoYV`b*dn{$TYr$X0&dBdjfd!j%~1X+rBj>)DUXYP7qC|(fL zA$*s>+#`tRn24x4)`d_EtI~j#$1%l2ESP=x$Fckgyj8RGk6vv5g3mqlU+u8IxQ?az z|Bd4P->038NB!S}Jm`1tGwnd=mI6A<0+DlF_(?Py#i?lEJBP~HiXH4$?9HRX-aNW* zZ+;0|a}elq`|`+nV!dpfU#{F7Qwcm&-d0pUr_Jj# z0V&XwKYC~$retpJOi^mN)%Pm6S^Vca3# z0*CL*o9N2qLfNOmLh{DOEqvQ>e+Ua&xT538yXj0KJiHeaXa4UpNOxfn4S0`^kLL(1 z-gktz);I1fWmoLUMJHMs7-%-o2^qQGlunD84E)i(|HnUz*MDaI_@#9$TmS1@Mf>lk z8=H^*pC0644a-8?)@;qocn_^sYq6~nzLbklg@@qVA}cB16oF3w#la$y6t`SKd}F=q zbx$o4`O$4rU|c7GJRnd!Uf=%xo_qZNvjzHBsAK8+e_Hnc_Gtg}FpoU{TYR-3Bpv>p zxW!Yx^09!_`{Xpmp}r=m*SKQ1%M`)Gk9JY(tJJzkC7idrXRjY=!B>3l@&BOiD131p z%k;mS?ehK4$Me63dF1`i-*N+`@*H0@199w<%U?Z##D7aI0lSu$QaPy@$P2r?F+>u= zI-Wkpxvj=$Z86wC|GI-)iP9z_v`d=>vQCcBLfS+{;fPW0#NV%;I8gg2A%pnQESiR6 zB#zKke;+?F9bXch#@G>8pN??Bi?H^!411ibhT8Nf-(HorR4NDA!;g|dBX-2t7XQ?) zz>3`vXAZxL-Er(5qacRk$Ic{iOw3zq^*JII#EoNi3am#H$n*$0Wj4kEJkBY8j3&*c zFJYKAA7IbN{VlyQ4-!5eEw;VZ>I zpU4BBlC{|1tyU{+wX7$Wv(9wKFg4(>-?>^6EC`61VECPBA%Ie1DvNZStCGk#@owQY z8dc3LXTz?~-SzsN%YJ|g=>Glg$-nXHU$Fl7PTu}>didSzv#(Rfvitwfo|WSNJ$Knh71#3@y_U2hK0R30=K<={FXHU&{~i>?6x z1iA%C*;-5j9Zmvtf-{`nqJ1ce7O*Ullh3dw6yf>_$eNz-4T4eV*C_`GA;HAQd+X8% zI0YZ}`YDK((;<_yj)4t*v_f03Zy2iiDB0WcAoBZQ!t9f$4O-{q486x3|dKTFK<< zTiJxx^>h>ofZ%@Jr(WMn#&?tO>Ut^~d$#EO`Ollp^>+IiIavS%9P#$uUh_0epzgOA zBrBymIM7$95d$FRaG)w>{ z*V|s2CeV{8-wqOgmMQ+w`Zfjn4g+iTWC_crN(O-!)#Y7A^~&%dfQmrk4j94Jk7fhJ zLA{Q`Q7CJ`;?xgmox^-Ngr~#Nzwk4lW{qe42v(dU1|fp(!w|#ZVImEbgYEbh@2Lh+ zR0jxQpr@q5&S5K&1p5Z+mt92Wjknhz*5+CgrXa{qVyKb>kiqUDO{m771D~8)klTSI zf_aTi^OKl8BB$GR^nk(PXs9hb%)n(rpSzm|V4RJrd#`edRn_M51~j5&MV6}^*#vmbU(yW+4X-kzR(f4JY>7uIeMep`ycl2)m@c29N3d$Xy zoQb1DSnL4w>_lLN64YV0hrr%+PxoHK&)rvtM~7!WIrW3XvtxvLaB?bk#oOJ}v%|f2 zN4uvm(NEu=^tw>}K7c(wJU%#uTDot#$7d}8)k31^ehk}C#y~J_bl+tvv`YT}^<4kZvyA_5mF|CRu5Ug1 ze}9mNhg$jj5itJsdJj0v;c@Q_SDy;P2y}@FcqoI0At`E6*4KwUSSvqKR?qar11u`O zLgR2CaBLJFc_}iBDDaTc%bTV!<5$HGC>{Wr1SDRP>qtWu5lU|Gv{!lucnVP2=50X4 z)^InkeZT<6O2eyI3KYS73X6aY%!M}|0~=vq1}zOcN)u$R7?2Vj6Okx_u62r`M}R2+ zNgg!4i1ih!zE-7l(?SnKD34&s%qW;5wdd0^;*~dH8j@J_Bo((oAG!(^W78@T1;i4D zL>ryJpG`4FqwMa5f(?b>(qfI!o?81s5OW)Wr;kvA0QNf!&^{7-6PX^y0Z3-VzXJC6 zrZEs?&qvpV7S;^FQ(f_@*u4R9%{VbRDp9y3f0#brxmbfCCV2Q_2lE=@pW3lPtBx8z4t?5fnL=i3(beAT<-|T{;bb z00JMHMW}Az7-b+=+_l63Ifu*Wnnywk?2(WN?07Kkw4uEUaB_kyb4owRmdL$Wzzn0}cVpvK-)QNQc14Fx_OGg@hVk{h! z?1wN0&Y5a1mA0}LiCgJE(!UP;51GbD%Paqnz3%{zs%rjTiW07(fGF5rFAK^BH=Ar| z5=bC~0HFnwASiXqO>$)$dv^&DQ50;54G|l55gTG}fQkzGqM{-q0)l{u6vbXp@H;be z&Mmu}gr=YVU-CT4?%i`woik@<&dhHTz$2Z;I>C(vB)cWBBd>{MTylN@)|F04gph&3F*%GsA za3H#c#$>Y4lIlyfY_!?CEyi}vw9}0n!NexlYh$oqjExfL_Y&IeJjwvf1lACZG=(OsqWSll+RFr~? zT394J5S$Pug8IP^HDo^pW~Q6SeQ^Ci%VbOf&>FbTA{aHfEhu20L_;uaSUP$#n4Yb0 zBQT)rCd?5ygR{3x=P$j~kBZX%HWy@ver94}_`O^~I4R9iP~QVMJI4BYe6ctz4PWRm zy@8htylP>JhK?kRD}p8+)2;8o?OA>;v;c$ubrWLk=1|M+mpkx^G!6X7Pft zpa?2_R9c8NIOS|jk&g+=LD2?JAM|A5MivLeT(F4*1Y^!kL?vKCNhceKXcDbxsy7NY zAD~3+A(MF`QHA~AsmlPO4ky^K%!d_!nVlw{i0Wd5fFR!NUy7cD4`KX&JQ#t0;npAi zt-${Wl!-1MWX}yUF$JgyuSf7x1S-2r1&O<` zXig^o`jkja9Q!aR=mH;@OD>L*G9>!Vs$`E*c)*)G>;PIw`P}GYY`7|<3)L3h2?GEt z7C(FpX$%^MDyb$o-ce_;YzJ&QAMTSwup0#zGRBQO*!_`LZ_8)hb4jmKYe>-;Ud?f$N-|}a^yfN8-3i#Cx8fOF|XeU<| zY$_;H=dlY`B7QLfqUYIc`&Ypof1EKOuI1{FH6;jl+&+?vxoOBG&rx8aR?`bi77S%p zu>Y9~REJ`oiJ8`NtU^z;!c@&Ow$u&WU4hJd00r=A4;hau&ut!j2OnakO zx_hk;Wmb0NM8ollN@AAmbh3nu8KVN`t5(Fxr}?8#9~}lM?(x`_Xznj!sV3ogIgY%Od_U&sgWrCvTDI!MkYx_1}G#F z=!Fa8SP%yIQu0=~r4HAubH@xXJ4=EdUnRJ@b9(ULjT;vuEaeAzd~$KAJe&&R{h%l6 zH+)yfa7HRRXaeHEbZ~2chumJk+Q2p#>i+39Zo`gZ8)hBEHe{29S0x%anIIAudx#2$ z?%1C&2;)eGgFE8!jq^}X2{V8fk9jJ=7c8HI$^7Xt0| zhgIP2ZXP&R$J7#qbsIQIBA=7(R`eY^6>yY0(nTbe$j}XjaRlb#&uJ0L>4iz`g~=c? zg4-O&f2KRZK!D!TQoS~k(RM{htlEeX>^t9$m=GN9%E9^^Rl`v=riww~jT^sO7vm^5 z#ha6{QYD9D#l5bvaPV1*s~8?Udso*aZ+1GCrn?a6 zV>=n+B;0?Uy|N7!3o{;^!!<}$lkt>PqNEmR{1tYJK*W#MjV?48dEj#zDdC2au#XkN z{)q|=nei3hIMW%-roj`7ctW%bm}0;v)CZ&HCh`G z&ON5bHGxV*@{V!tGqn$6W8$1iq>2QU2M*02Q#81!3{7TC-_*e3Di_6om68RVkz7w8 zUa;2N(M|;^z{vRMlsSkD?gwDaN}xP>hEb3~M;*FzVB7@zN0voyMNSA+uV6=Vh|7(p zTw2`tX{<(q-AlKjfb|hhb+#`V!||}Cl`*^Q1Y{$+-HUgYk)IG&GPtmUi>jYt;-pfz z(h3_srl4hnZnYF~Va5cwDEKEZ5zhzaJg*u8iNMcc8q>uo%%xLSf`l6;FMv}MZ-}QL zX3G#k{C?Gdzhnm)6+*C`cI^Z0((&NKa9~py)l>{Bcf<{0{hX*&N#V*=`3m27ENO9a&YF^wgLl2d)Be`^Zo5(k(V?3dIo;h2X3}~Syb*qLx z0C(X1$S>(zQdmYENEYiYVxY0SDF%Etzii{Mrn=;8RDkdEJ8RRCJD5#Be9?7*46Y1t zmnUH)#U)no3KegU#JjYrtcIG77CJw`_Dxyma_G2Xj}nd$YzC;I(xX)prd9=rK$SxE z4Tmy#>b(i6*h)fiM$35ca|JIh&JpAK8dn2-`2-xVmDr7KQ;tM$Ruo}z=nPMI$;_bL zoh@pS?5KhyjS-XCc}0 zlMDh;P<&z|jD_O?W6Na#aJz@~zPD-3#D%CD5t=>XjRP;_o%Of7@^fqXl@fMa~XEXR_{T3bY>W?hI{akIwGM*AGd*0%jMO z8W|2~JJ5Y$c$}6l2azg-o;n6uxK8P8+h7xh01Z^6`bik9P-ueb@(!+@STm+08k+*u z8V+^M#ALBg9v`|80g=rj+&_S)zni|Aqh3}cMZ6b_U76y}!=Eh)@lQxXnU2g7mA)HKD~2f`X!tQ}xK zvBx9C#_c9eh4dV8xl3xGVK`&+L>h>=n-!)Gru-|qp$*&WUCcGs!oj^oX{0B(`vS>c zY!`^PhC4eB@}DD5!rR8EKLh+WyWs^Pev~JRdiGN@L*b2v$aE>DrO~it%r54t&UN#z zVW#>)F7})X$3-GQzFY?bhghdLW2V%CLp)Enh*NM|KzpC^*)ra%#?T@o#4vz9L{-t5 zARq~C({mxpoPN-En0{NqG#Kt7g@QjE2^sN7H-l}H?GrC-=+02_sV0%b=mPF;O>FO2 z7%XIUZ1QATTEw>t`v;7aF*wa)SmSGvQV4==74-mxn=A{))-uF6_{K=iZYVQCkVcV5 zuy%gPhvQ!1DuCeu$ZgPB1GJZNCZ5MI@(C0nd<$Lr`0>I$=#vC5lc>jJhzwo!Hi-Xh zU41Yv%*dXF7j7Eq9%$kLwFOI&W&kcDdXi%3Hmb`Y&eQhED4^2Oc!XxC0sxay_^6p- zWV<>M!`MGrnixhw@!*2OA!Rv?e;HDgo#wJE*}TRCl|aDDlx>9Zfpq~rB_pW7ysKK! z8WzF5DP)td2Z?gQe-2$n;1*f0uaXI?dcuzoUaL9Hq8(OL6^@RRF(i@hxhp*r#055D zi9&h4!w_|p0^1C6UzQ6eQaTdaX6S4HH{zy_aQ9DaN?1B5>cph*r{Fvm&NgX;GBGkr z&SjGkaiWQCa`JxCjU>8CY-~wGkY)sEvK{dYhxFvy^yop{nLw>X$Bwp4y@npN#Z)2m zNw;tbIn!7o)*d@@Nw5VmOXKzv%*$PaZ5tT3p#j4?4&jNGZg~kzjij^+Gl!K?=$^k; zOL27y84FJge$ijcrs#+QiL29oZVEL_;sm9mFvcSkKr-wAb{#2JfRF-`YXzCD&@Ct6 zPk1p=#o?v}R)wkuuP{+5tQ+ct#;y<6s&nDlt!Jj-`fiOE4@|!TUAJrLhXw_<&;%u7Yj{7;qy3tGbNug^h4Z~4!g7}F^ep?=1V17 zj=Tw-_jJ(?-40+%DL{+c3z%$1JjSkX`4lEv%kI=264BO$-b2KGQoM+^5`%QHgsx{o zAg`WHo-Z(n7I@GczU6S!a_p}jVRRk{4Wt+dRZ@HbxX9qPdZzx_NsO|ScLrGGYSPEy zYE=h#P2^G$HBw9G-J$3(X9vq{NCY69Bi zx+=0@!;ORAZ2xb#aUArY)&E0d8h{eZ$aZD1?}x1o4D#vJsYd)C_Lu1Y(W#5uCU-h) zJ*egHf8770mi4Eb{KL>jUGd-U&WZTHow^+H|M`3V+HeNl1`f+oTz>SJM)Aht%OSOq zB%^dOnXs@J955RDxo~({E>n_9iwg!6mW??t7s*H(R5YlNeR1O#{#$8rE|Hq6t%JRl z&i)Z^rOWgND-u+Licx^-NtcEWE*cKM#zX2v{;RoTl*fkX3)1{dUJ z6lKP>XeOFVGI?Pj|4vy_o4SgCf0WT$0ZNA8HfK2hvv$ZBp6kRThrG35DK` z)L&EJa2vTq36QG^d%056UBp=_)vxHmcCo0Uu%=Am31dq8<(CxZnmUdi4$$pP@D?!_ z9az-MT#!wYUaZZ2SLwEvt+7rvWujc~{IdL9Uqt_2IJ~d`z9-Bnikkd3Zyc&TF-%O! zem48tu<^GkD9Ekw`J^_z3;X2aRRpJ`-i5t}_LVbwBfa#?FC9}lbnuvgg@f4}eFoEe%Uw%g3aO)D4NTpMG&h7baZa+=Y9fL3L5j|)lqs*#8M|7Lhc{w#mB zoc~O(IXp7pfy;lLIzaxPBl6#0|5wNQ`$Gh5a7b;`A^&ym*dY=Brwb#2Bl6$h@z=d| z@8W{8^M@45{mKRnl!pxMHL$2awr6B!4(m{mnc2InH~rAjmF3RNEF5f?(ROAx0bx{i zKpc#+l1!kKj+q1n=kmw=_B^ROJj;{Vzlz7tzJd)J1;$)E6VUKd7CaW|ej*gZY;+`s z=E%JVmkJ|+-TLY{rMfB{^=sDmoQ4eRgqNN2U?m2&VfKS?_bD~%i>a}Il9#%@?wRzf z)Ey382r`6pv(*7bt5lSjU9OBO<+*m<+T`+StS?|N&9%cdOD240FK5!IrS9IazZ(8+ zosl8KGj@!heJFo&Mg~;pS0~86fJf7EsZyA4_@56fEbxI$bQ~neG`Wz!HH?!G&FdcX zlUGqLf33TRk1rYR1YS{tfb8dwRpz?0&tanh7exH%MQ@DUELNL&A?+Zp=Gt}k;);Z@ zo=i_3n`S@!FPge1U_*s(v2Y}hFQvsmC8D4N1e0X0j}q9i4-q~^UJpFh#}*C}2#`Gw zK0a=0`QYMV_6Ow~R+Myk!s|y`q1|@@x(w zFcCU6AZ=taq7kIX*!!W;p+Sn3*|O@-WfkVJZNvyao3+p8K2I79mpxGhVLB0GQnz7p zt9W-Mn8#+PdnWtWa;ryRmL`Z039ErPNp$KW;^w$P=xs$KX4?&}vN1I^qp4V)c+W5A z%9FZ#*({tD@@kQ8^nXk^nJaf!^L%g>ulh3JN%u@O&zV$~(W6JB!uT-*uDeqgRU=eR zjbwQIe%1q{FqWMRBpS<;yJwnu%cqQzXmgkf7y&j$<)IQ`VpoEZShY)xx;5gl$KVPG z$8?A*D)tT5#n#qTHCtQ0mq9@2?#(m(=16BF$`gGOm6(`)o>XG;N!LyAcyonqiLI^s zQGpekyEV$@!N$UeJl2{9YgC;yR^ulJjFc}f`=RcE7mybdx1<*hk@?GDNY}^jN~|K{ ziGqKr64iiB#`5xci%1SY3Fwp&GS?>yS8771Nvx4}ULFFM>RuQkQb5eLOcx5|!i^il zv_^c_q5Ca%%46!3lSdr04Tmx9vN@OlJ)kW6T#qSWg(av}7W*6kLD}#C1_du;;QrA` z+dZ+@Z2qAeAvJ(qz@^Z8fr0hb>q}O(m6X_iJ!m4TgOt=r3L;V?he$rgVle74*8cA! zA6ehXDM*H5P0V$cBbXp;?j(AV4w_zME4@gEKrV7Ba*=d$F;h!>#zGro2Rr0D5r6M5^Ws;EIJ(ELa7|7Yy|@aq4p!aTN% z%=$lUD%sHo?t;pqo{+|RCV9d2;gt|#2sc=Swj7pHZ4IC1 zf{06>5@SoJ_~V(E_(3+wjF$W0zpSpEy1HT$8OJH zR{duuI!sekfa1~AK(#>fVK1mr2_o-})*(KgqBqdi6RIX#kKT6^N-CG=*(ynbBwPg1 z4E7MG4h@>PN+xxV{jV$x5p@v%36W*3V9V^WcyNBVMlOVs#WQjg-QKSC*J9h6io%z8kDcU{NSB9~5bRhkSy$8;eLR4YN*L=vf(I{LHD4#n;3ziEs4cOC6^OakytiGQ4wpuKeYlCVL1wzsHq%A z8|+7YfFo?4u}C}^L2%)kUf|~vz9Nn!V_0knC)a6r6Osm7Y~sbbISHVtnOrIpNB~L? zT&6&t2tOkVik>Cb10e)Cz<7lisp(q_LrCyQ29Ae`%eb|Q6$c}@B#hwDjtM&^h*7+N zkBJ9tARMCu7QN88B*v-27@8*2(`?uh_D6dfg`z0%rlOiYYsPd3hW0tD~5RpCL<0O3G!zEqN9(?alMK8qts~U5>SqQ z67w?Y8jYQ>q9Jd9K#Ip*V>HJN z1)?ovbri{1+nH${Vz%3;k3}>_hA%tIRqKRQHkTwN(@RYhb$VpVy-bx|LA%tyA*He3j1-)WZgul(wON%U0$E*NMn9unE5 zWGV~uPQCG?xQ|jy(q$YZpopWIgbA)<##tglZp>I-a6}lVhUs)LFo5+FBJuLWP4{XE z_aunVASGYVr?@F0O(Fr)h>lFJ2qwiJ&1zYViVATUrg#W7y>3+mUL6>&fN`UEW7pY& zo$z~*lI$R)#S~vf)Kl(?#C;i2HSF?6?M})U>_~Ojf=k4+$+#aj<|aT9x;oX!p@0^1#3?MFngQu=(qz*E=r(J` zh2V^$Y{X^Aly<1Z&L49L8M}^OT$CF+W^N;DU5yC+#tAse0SFOwIviqKlfBGdz|8OZ z^n*$P5eJ8{nRCrM}63I38epjk~U#<=r7eLz}Ez~zM)cZ zQ?ganWSi!hfe*#34Huy3hGP;9OXT|DV3lhtftJ`CmGB z>6jG%=k9zY|L@=O_m7MJDslRrnQ8z=*05tjlHbb`uFCL{oagY>UsI z7Uo`6G_#1ttplKAMpABEBtrw-5#jt9ScqUYn zaW}|x89Qzi7hx9UI}7A2Imj-DEfCBku@!iL{;=shN38BANfu&F_Zww&$tJ6s09tuU z1!3wnkQhl3OQ1{vWCLl00RYi(#e@JWM%5}|9b#@u6?1}%T(g#WLj)%r7@#-d$Q;~p zm9e3)A2X3Sjq-3UgvE!J3?v@q(9@n^8cl?IWxH8ZF+PmvdG?2SiusU|j>FU|By9|< zG}(?EDe#MTZKG~b+FrHtCxw3WdhhF zrd;QIT4J3Gij;I5DV97(Ig+pWR3lm*R8%Gs-f$;o#yH5z3|qe3l7*C~W%n4VK;c&o zri)mu5E1CrS%GXYWwYaQf#|k;7L1@9s6rhxKp!$IP%b$id|IF!Sf0>u;CGQul^+Ke z?Hsv#{(d`-+Vf0x8?jefhipB)gh;t5 z6c$QN2aAJH<0k5X2{ne#nLH)Mu#%94_trJ-q8~8tz4&MJy_S#z)Y!ghusrcGbcIZQ zltDC$C{J)_yfQL2i$@+GSAFB87%YjtVRa~g3{L>=={!+iCA^1sE0}K$ldbTx0B$fP zlOF=(;GSwU-TQJz>Li60Y~+R^l+fUJk;sbQ>4njBDv8TT1F#QxGnEk;E5zGF^2_?^ zzewU~f$l`7oz{UJuSamJ6_AX*w5S^ zE`K0UODSFmsxmwM_o1!riJ50!94s*bo}Vb?!2~jX!;cq~6qvRn@u`VXvNIPXl{Qg> zs&Bgp=DFcaMHhgb9KIeWi%AgvaLT*H{hV3Ce&p2a%9ds0Xmb>#%kHjS@m%XDmyvUi zQywz3AfrSLOZYl$HN$`|Z0zvVP6aR{n*)VHD8$&u{)9*XBsP;4Q7SVrN_)DLk%86X zrr}q;VVblm#Y;0*0S@>8xXu&tF^Ph0@_=PMYuLYTvpf)Lhd}^R4co&d_s1OJv_%a- z57@+#d4HOAP=RF&C2uTbACgHV@#6iGznW*2JFvAqXv$AbCN4Lp6L(Ei(izhxFlPDx zmr4#3kwE%~kWMCk;LS|eszygcyfgL?w@VcLlk6PHW)95&At$&O-0!R($N*J9s=p(` z@t8zu;$@RQiB*`7b#@?{VLX_OGwyI&EU3b~(um?yp>z1vBm|aGR%D29(T_MLGO$@D zx<{n)h!VzBERdI0i&s>zl{FOnN+rOiU*aIfw8%NpYQ*h-9#lL`o15V=YMyo^M;L(i? zFe#XR07nxGhg&mQ0sF|hhZG+Ow6@@Wfc;8?={j8G#p*(97$cd%N|lAKR7`(!A#hhV zAMuKea&=;6JOa6B!Qc#;z+B1kUqi8gKL=G1V(M1T9qoiXwwp}li+G;59P*$t@gCi& z34On!VK4NAQCQFu07DB~CX4}em#!G^p^lpjun*5k+XhOF|fJp@$nbF^* zfGqnNU^dS&+nX{cW-xx30iDQ*M+0a`P{=RGE^+I*W0)EUsGgu)#w4zBN;J7!H4axF zDHAx=0QVf>dlkKV7>A4iM`FWfOX1GS$^borX;@9)N~bIvkQL; zNKAq^*nB`t(EvYNkw}isd!IlUC%zYC4v!`@!LuEq2NmFC`=|{_+yki=(4&Mxqd`;i zMKPNWwZZlmV+G*|TEQHHJTX?HN*nT3OS0`f*pP$ANg>+*ns zM8}eer3kJmlwh+K+}$JXckF8oM>gxDJx_vcOBf<9=LaC85v>u^_>8W>No>j%Y=lpv zj#~{L3W}5}kqv;faf3JVb4y|yM*JEh$A2u+(ZBGH<#4$gWOw+hTn*~F|BoF80H8YX ze>!J(=$Lr_pY6^*a{vE#{QcwZ|4mo%aCLHk_&@N9>B@iDuwhQQS2SFuLE2y4B|ygj zl2bSUm|Oja-}4{2=Klv@^B>G%^8e?W9}N?SbiyYHTTmgt_%v{Ua9=t4RYN}FGRU=T zzyTR(K-`Ty0SyRb@rjhzQ8EKT$^sGyEE*YJ+UIm{#vN1zPLM8h6JSRYQV>t^oQCpX zo&%;Zcq6;8O#A@rEH@g0*hgxYhfhJn0i_&nMTDl8gtQXEJ_FEuj+{hZYKUhDr%*{0 zsPJ@PdoUa&j}IsY_7-5fY&L@IU^K{*Takj~<)M>QlIuz;gsKAvq%tw1nh>e#LYFdP z*fe2a!uLvwho7JLVl+Ily3RKb2O3p=-@?I(-NwKXCS-=j1ICW?_fdbSO^j#xtRf-5{$_c(d!Pf?d zV@2sp2GVVf(b~xo?mWa+%^Q`f+XoumO|-TjT^Dv)D(el0AyxNZ95XIRYk$MV4Ztah z5T*=kGf;fr!ZJ%R^pN6G{(!F_-s5XLtF{Erm^dX`3OFjZqex^0xrEq*rH&L%D*Gp} zCCY32gJ4BS^r>RcE%tY7{JFqVQDc&E3C%boTGXQfe)nC(p)ue{aDs&B!2+=NNYP+* z=_sBabG_!kb{?WlbH=MkoPEh8JsRy7!$DA`V&gH>tXmh9UX{$R?oYIS!o0zK6pv)J zgy*B@7$Y;t2Of%vczig;{ z5W|eYN15u))Bw zpygXDDfO|lp2;>4P;R)(x3M;5&jXnQW-1+UZ~^8@Wr~f=r-gEuGmTy<31W@uVHYj^D+5JOPphhga`hhhe#WgCJ+FmS`h$<{!PK_$WO$?(ys}T{fzSM zTo^!Yi_R52T)SHLU}oLH+Qi8t0{C@rI^K+_G83vq&R-4R5Vqhph#>=a!F56@P(pSE z&&X>Bys6A@GU7E;r=4zt>1s8ggeo|&gIyBUbGsyxF@}UEvno$42APNS>4Fl_1IFU$ z?$%cs4~-LdvWzanuuSN=u2c!jjIg$(Cr9FAS|fgzo2UNo1Q7^=GX{~bEFCaZfXhH~ z01?7Oy>Rd%#v{oV1~36eLYNyO*?wZRX$FLt!Rsp}8J%y>a!){0^bJZh09Fj{n4^yn zy*hvog@Nz*5GL7B1Uh87VbMEeWsAP)vW>XiHg)LV283WjJ>xJ1HRXp%W_bzuVWfm~ zLN&v;;jwPUZevPXg!P;)3g0y*!NA;zr7Tm=VsQ#o;mB~P1J^^q+y#PRqT4u+L!a>Xmt<@%B6hT&4chm`tk7t4zY$A1l5jt`K zuj2DSKvJR?^=u_HmyFCkj=6A|jumukKNOvVMK zZ@YPd+3eaytL2s%#T^8y9Qbh}XHzCJrs9$~wqokp)LS91bQxn_*r7=gAWEun*(tG{ zV4Zf;?L#Vdkq=={+}a5sL>w>6uw5jDG#(7UsGT9eYbE^l$)d3l1$cDz$%zAnXXbEC zmCYinVW_4cbGHO8@LMH4l2O&b2NtX3u@DuWcm-YZ0Ey$ehvjkL-bu{zBK>Mo^a8EE z{s|E61*?~0JIDZ#qZ{Vz{R;DYBZ^Hj%SeG{%H#0ZUKb1QW{tqV*;zdFr;^`&a(TfL znIV*|9NHzhtS{_?Ec?kOW-p7gX>p&!gxd&I=w|=R>6o39?UwrvDkFR$ak~q}^CKR1 zT4uUk9bAlEJ0KW1U6vgsY&-Vz#4<4wE?vAf!p_JcmLaV2_EAv7Fi^L%IvEXSb>GLw@x0x0YV9?EtM z(^lxVU>JonQSh-x21AjMew;~XCuq8d$D>vUY{Hg6oFoTjw5kKTCcopB&|Qd|AbEfZ z>ZG0!zd2=vF@21A_nH#Vq`E1ANwBg}eL6~kJ>#V%Pnp9g)<`6yMs){XJZFuJ5@LS| zZ+mczgle2-(G%}Mx%o&U@lFeqnJAI1L&S?Y|D~?3gJh_3OB5Uw)snuo4Tygs-Psw} zCo6FcoZp@-UC~t%dO7G00eV(l9?H!mK(Gua^qI2&EyrYAk`fvg#wA^XWW?NCg%Acg z(G10l3M6R*A{4Iwl^8p2zybJRyc4oI8+XYve6xBdm?r|}fsABH-P4Cce&#Y+49$1Q zr03~@eTf&!{O5Rx?T~17gx~#`2}T&W$us|fAo6fQ*XV~>I2;%U*b%6pK`^G2EQRp{)W1LAf1<38YhC*x3|Io@U*S7H zn+p!Ryy-Lv7`g#J8E7;XMq$dB28*SxE?Lw94!B=}DYTXkRxL(3j3oi>KtPs{M^^I4 zD6_qfb8o!XHgyxl2$M~bEIdFQATXqo7LrASI(iH8gvn*~f5+cH+5f-D#KeUD0dbxO4hC3OFvJM}Udb^4PN~R5;;AD7iYzSn9~}{J zBqZRU91`#kJKSpt2{3o;pb1is3COeVAQ5?)5UlN%bvFkHu?9d1u(lE&kwD7<;05&9 zV6rZ*Fb~P(L94>608AM1D0>|>G#)ig*B^$PGzY|klozI_;O^lIqw!OYC>|de?E=*@ z2lS%|hIg0uv=CD2-OAJCfGfffSwB)2@xj3eufF&YHZvSdV)p`IvmWI%CsJb0nGQ|@l!=J9R z8aQQulp)p<^pddV384EJPe3eCR}9=f8Lx<{6dFH*^KrC!#WIN&FejIATQYv-fCNFt zn86GcC8QZA)J*qYV4LFjchC!PVu@=ULsCOXCcLW(Rm-Rc85Unu3u#P}MyfUTHK2}D zfK~zoSAsFN2sPjdX;okXFwiP0JLL7&(b@(na{E88NhvQdr%bZb8GJ7CnNtZkjfh~L-enV4aQ#-P-mK5|Z zDlsf2l7M%Cp9Y$La^fX5SW7{Rb;%MK;gIQsAQVCk$-!#Iy(5f900aZ9h3%lC%(xcK z#QV8Swqr4=7NZ@kvK=C9rtS#zBk_GE&PA14YOwUz1W#XH+(iNnvA_mzlq_rQPbQk2nr$uSfn+9tL|J~L zJH4dG{9qQ(3#`vGK^j9qofI$8^OVX+dT)li z8BA!IWLinsfpqsyFOh#|m4Qzb39z#Q*{NPk3v=Qz=lCuPkwd>OsF<;`1o(}IjyFyL zh+rE6u8Ofw3ZyQZphm+XyzQC5&MlB=G~M@$-1o`lgB&+fmB)KbN<);;1^tSwCQLLD zc@zVBjmF}U9Jyv1G$6}rqegQKlDJ#Y!Ewduuj3=OwtyqT1aS`n$;6rk)APpF09=Zh zQfeecLh!o@#zRw2E$}ATZo&b{1e?GoBNmo)*f)PQQ%zK#Nvgo>P#vOJfQxc3QIo;W z%)JRkPh2QieM|!iS|jx;wc0GMIx0TAV?8)01;09lr8f@oRYdL(U<{0a|DXQ;-# zLc9z(tX~(=jNyx2gS=Mk5|euv(w)A^T*iqxRG^fVa)3Ymv>c{SlNTKK82QH|;&ii+ zH_m55&orS68ZdQi3n?D0S^%IL_@{(-#&(sGw0XIRs5@J8Q+0xSIUpiJEFd`xSdu7l zN)lIQwea%OBlMQ5n;geg* za~;%;%J%QIg8zGzLkC=h~C(OVm@;@|EL@Thl!~YWrU!Xon86u}l7eZJvDH4P9!ROWt zAX179AbRQ#%5O|oygG8sNc*2-hV*bV4Zs5F7SI9-tsIt&5T?i+j%HD+hv)G4RMv|L zs)s`Fy$DAy5|{WqAxXzDFc4!{-)V3A!(g{&#R~{Y9aRWE+vZ4HSV_|=Qnp<%auP5l z21RLnx=a@bXw26w*ig2#bRauNz+5Qx#T_5{$Zz%&MMZ3N?w zlkP1reKug}fR##L>;kL>9H(%ZG##d0Q6RH$5d73Ap@~)Xc1fiQ#3|n9Gz488rzjDT`hjcI9PR^g`hy;DG15$9 z6W(fiPz;d+DW`Fb;(M@*Ixuhr#F4Q*L&HM+4&8)@vtJz2ovuY0v7uBE;zcpX5r~zH zLeyErL-rzogWWNiq&wv1-Wx6r*#*qg7`U3LZ3I=(dKp{sC$J~+(qD>ep z)fZAK*x9Ti>WJCcmd`I6&_O+hv(J|kZ_5G(MhAx;k%9_9f2mr~CFdh;7dUn74ik6> zjRK|s2-RCHAUh~VN_V(NU&iF{L&lvc@KE6?z7eg+l($DO%16uNG4Znzqi9J!q`v~p zJrct==%euh_rR4nHL(@u%T5lI3XCz)We#0{rI?Z!UkN@j;;Y_yi8}A(F~&x(fTjs!r&?z0S%FK}pb9KE zBVeZTqDF(4k+cSD45Fb)KskuCGQ2&!Ig<4(S-`Ia ztsBTe62z3VJwgHHV1{D9ahL*Q7xhs?WI;3HcE~*y?$yG9ICpqPPh=EfJW&i!5wU+V zbpyd0Ojt)izMLXuqEt!~Cl?I?(T3HnaZXD?JOqDKgi8)lS(5%3nuf$LA->~u=;ZNn zg}iX#DIIL>G~R9DK`oJ^E?EI#FBr}1@sKVV{QqTBHWIYGvL!P2RTB8+dZIhaB|w?^ zTHVhi3#9y5Sfwar_+V^Ry3I^33}c2N^H;=I(~HIg>v>Fi4=&YjQKBXvV~XZt6A{zF z4UMVBnKuv5dW{jTP=K{M`4LKhi5f+n3K5E5LeF{-8->Zc0c*Z_v?)XSYX_fca2dczG1SIC!(@ z)bFj1!HV^UqS!f&H3&*i2yc*Os1vE5y}}kZ$hz$}?_RuVrcFUdr~)EhS*3`l1;79= zgw$~mK;nV~jG#jC0BaSXFLMkr zfTDcO0OTmUz+6YYYK*R4C^saqUk#(E?bv~M#1z*Eyo>}FJDvP^(N_@;`^`d1jd}Ut z`kbv|T-7RxsldvBEe3Usr^X(t*gY;Hz);a&f{&haVZ<`6ReWHFCP`HAAyMA3LMfOlN+CUgFOCwz zy6B^6#0AJJHH?JtB#d6-z&*qV_0e-sS6)b0gm}l2o99HB$AMEq0)B%8M2V+u6BDOV ztd~A_Q6-3|JEqCAkV$dKx*SQ2h^K5!JvDU-mVoqA{sSOB6*vYK#`bWP#Fr3e3|oSjtK5QW7ZkUAs@gdntPnGZ{T4p|67vL>sLQ&Am9 z7CSgfNcmbs0ad|xO?)?R^1q3GQoK|dkAdBfUg2M?1a|=RW+Jyj(uW1$mK9`|Y3U-8 znCadksLq*W1HvT~u5G~QHA)dJD-rOCWKx2JwmApLH@bBeyj?@$q)W1LrGt94@INMRRh`wW0IZV&4tOz*ffeJM3gsb#PY@mMY;LeF14gI{GxD{I zaXXQ@BX|N+J?#hrN)jA3$KX8kJh%pkyJC~5rGe%lC=WNOBBSZFd*o4#!<{m`RiVD+4q#o1ZV2lud zVf}-bYrypeH8t)(%xWsDFmGsYvziLGNRFX^8VrgbG95!jOiiCbUW&#(=A;7LaMuzsxy^adj%<9;Q9SxL0WuQ^D)%r-bS!LUswn zu4>4Ll~@iIkmseUp<=Hh89K92kadlfw8&UEsQSpAU7sK@V0qAl28sUgVobujE*;Ag zCRZ=6V^j(rkAN9rVG6U_H{f6}0d#Tr1`mk6LJ4R39AvQ&^@~gsx?!6uz@Uhm?nfLU zi(X5fiiA6Ewzxwvkz5VHz$g=fB+{*6LNyhWMwkwD!y@Jpsl!+``ef5o20a`=4qW&> z)tbajL-eZ#cSvEsOz9^ni+u<>#h8*B^~HnaqR(gr!MmV4OoFUr^hntlBbd*@XSo&3 z4-qL^v`#o<`k=mM#jMurcw1R#@MO=HBBj)f(@8x5L-&Y6sxNChay z^fQcpWIG7Q$X28HB>~yQ=>FJcVAHUw8_#gvMK{oqyouvG%plE&&|;~$i$ z2Kha@v9b(#Cpcq2XJ)YfFZ~lP|NDp zLfK}$;(%6`wuF(JkT0@+=UVGFOQCZn5DIP}Ji#R0C75#JAQ|vE7gv~xHl6*WYl(P0 zo+N^Zbh?CeG!=Ls#15NsJs&!>D{Qg4k3@&8Gc7zF-M;;CBM);bW(hap!k8puk`#k= z3JN2^j57_qezV-a;awA-kd(w_(Ui3mnzGEV_Rxey%#vF=1@07+S@k&q7HUEw$6Ik> zfRwB_vt*!_xteI`iL%ZD1#iagQ}7D5M25_uO7VH<9|3bp^%<&+sD{xE}7%AupgVP`A?9j@4z zg~m@6SXPd&k%4N;#sUD?k{WhZMb((%FjcMVo$2YdX?25ue;iJ&4sMY1xSz1__cO&F z_gWM}Igw`72duVawL*JK}ajPXM6X3qw@3got zn&Y@}EAuRTz*59-<>IG4{1?l;HU?PY&)~L5xZ4W42SE&-5w(r_gYerE0AA=m07nC| zSe}82&j*+BMLSl{RKqcqqvKk+&5?MQe^I>45x}Q^(_bC&KNJ>zhzX$U$p73aMgC`Z zmm~R~|CYaha{LcZ>2*K}piMzPJpYGNrVJqLUo|w&DGiASBL@7F$Q6yTE{V}U)B!r( zjzs(%iTL>+i1?wb2Zuz7)?Cn7p~$(TXM;wa4?TL|=Y&+ai6}yp&k$kjlatbsy=-7>s7T{6FfBvc_IM-ad8^D7GYKqDTq z#gkaF#_H%!peQS&=PF`0)t*Z@)eIh3GGW%!Y_~OYMvciYtTE_(1`h|ZprU1`8tr*} zZG@85nv`+%;IYUojV0#OOUZ;K1pNL6H39)$z$ReOHq-!MXIqWk?5zaGDXTIydSP4P%=LEHA9_; z6m;suL{6Lvxv5z9EhS`k15^s?7kNDB9m%T%!c{s@m>-OiWVAqYwJCc6IniQ9L61fY zf%a%M=9J=W`^J=m1--6gztPXNU|;K|98CoSs|xqIz)biERllCF#Z2T5$o~Krr-b$I zu%iLRpMf?Q%s!p&Oe_N6Vx2phe()=G{E%F!l)yoJ)xN-?+G^_B)X+q#O%2a+Qv(gK z4eN_dbkgO~fo{@DCh+hq@#g)CEdX8P&IGf4m9><&S^`p{93ixIF>@Xv$pB~}<#<35 zccKvyfCm1$H}b%6m7cfO*~AYMtdIUJC=hK&W}TDrsh3| z=@3~1`hLR)Y&)@MxYsnUi(xjn{n=&MeY}VA1h^Br5u8AYZcQmU>Ds`OZm#B2C`HD; zB+B#ftVOt?75I!!-mx&`X~uw`Xk1*7cqt<=ghD|)A9sVQp<4brPuj@er^c*F0KuKo za%o|&UVi%L;19VdVu-qdl*b)SJIYsKx|w zR*@PXr4XnOfPxB8-qB3Cb2NUBh1u!Mf-)D{qWt(Z39m>~{GwT0X_Hf|hfB*f&>GAc zE!$r>XV^f}oZ(ZPGfpvwFkQw}dA#8$sM+Srbv-5qo0KRCGc}2`VY!x34_SVzeKMed zq`APfgE00=HZF+jKBy@%O#^v&6TyT@?NaI%u=-)^h7?4zL4DFQX;)ecrOc(BG{?eA zs6x2pLQEj{>*9%P4^X>G9<8oNa)X6I_@*x7ogR7t@CZ;CA^LlQJFb&rq?5@B!kZIG zO43P6P8@D(J+CM+bDSQ;&wf{ZaP>?{@X%2flaQ$zN5mlYOahGV5G%?wBb}B2W6lk!nsH=7SVOBJi>%%ErS^&!-8UbJ)4BQ2_0u>8M|&$h}Erp%Gp# zQOOF$4_)G`b&o;=NqZC?Iu1mOGN_2HALGoaEge=~%+WWh4`q0@4ox(WG(7PG$w7y9 zdT~b?oB-N|j9NS)Uv+KA5E=6S!c`@eJ#pOl6bC&5KklEdoRa6p^hHJ)5W|Z-G%j)q z;*Y_w6Y!wItQfwU5K0>kK{BflIuVQDR`R~2blOQ;W+DeKgT{2;EW8XW!vQ}xM?nXG zl}jo4wnYf^@i8LMMO8=)JKeC@Isc`q7bgL$@?{W#u6_vxp6f*i zzNATt`u^)*5?8_`-nUEKl!gN|8KL4 z=E1g6hyQoyF4-Lu^FL&n|U+wdVB|4X@rMO+BX7ZRh628;;Mv zz1byOKA(}ZV%{Yyx^`GG+Sw&MPE5T z+dF#b-hB`MxaGsUzKQkfciYDIC++znHu}|J3wCUHbW-@U`AxT-cFDAT4c2cw{ntNF zzoc!?9&g;x@T-bnZ?f$@wny`O@7dJ1{*N90=r`q(qaS&-+Xn@ajjzbl_AD&Tz3fk0 z{fA%dlQw?EQTIRB^0}(%lUn(96sNWRdg|hj&;0N#TV%tBCr``SFs13{(=NXF)R&K{ zdVR;YBcHr@>cmyvua}*A->fzbr;WY!xBT=*wq6&{-7~+REpvG3tGhmZX5Q0J&n(#y zIVYC$*&E0A2xQ;h%GYYkW5X7F`NbE*owGmx{PTJZjvnqjY3h=DgZTp*Y`o^t!ra!U zzrQxnf6#T$&0Ts~Q|Z`_y?g(4b%!gArwoCu`?yV(DmNdh^ zEz7REcE*e!mFFLA@!YzvZ*`5D**3j>`~FQ^`4&~YfA^j}dx~y8i*@Ma>-vm2XXftc<-fccem(&a<8|KX|m^L z+Xb`j??ej=3rCKe)3#`HyT?9WyJ}U76HhEm8-LT{_MdiKx%-s8&#v#Y_XXdxXX7AWOPVwZ9^d^*-|h{&o2~Rc-stlg zqps?)?czquPO~llerxHU`+oT?=k!hMx8!{F=ZPPzTJ_^+RU282>C>OS=%*d`-Yd84 zp1thNFXEqEo^w~}+Gf}6ZsohR^N0~6jydL-0RslKbd7wte_DpRw9SgMPxFL&d5mM*XQ|Z=Z8|o_yE!Z-4*sJ$nPMKOg+Xy=>^2Lnob4y?ySjdyf8TZRU>GS`-%b z>o|GPTLkQ!vQ9S?Q5$%@vpN+lz>E};;Hhb1Ae|hxnko>L>PIuQgiM>fVJddd|^$J$U7n z5B;?Bh6YoH%pJM=#p*U?6|3hCxb^w)#?hlk=T&{P{*lso(o0o4hlg`MyEg6PxzDf8 z39MN+XwdWjDL!vn({0x`Yh#zB^QPaWjagtjfA*h0Ex0s&`uDq@d4I(nod#^}vG}UI z7nhv>;DkQ?((bFe=F>aw9P#O@*onTCTi8yrz1*Q<$NO_$Y8blq-dn3)zu?TiclCe0 ztm!GIJo?Gb=RTP{@3IdzJi9FOiyyvsdhyZO?*&_Cj$S;z&vi}fkGD$ zY}qn2G;y+t$c%#&<}5mK(S_%<@6+On#se~YwQ5~9W+R)Y>R-QI>U-zj{nV6Bl8Z#3|Z7K_K`FTeb#f-Rdb ze^Yv3R<(WV2OI0jd3pUFzwMiy_kJ?PecY5STc*AilzzVcltMD}p0EDlOXZ!} z*Zn8=0;Sui`$xC>)ZM35oAV!<^z*F8$K3Ph$HUI-JmMJJ(I0pQPIJGr^w+JYH~gsO z_cyyGxk1*{CE=fUO?&GMN#t=%iG`H?UymFP7U==YY-{wRk7la z?5@>Qnoe6>WSf8H&gHk9J?x2*MFR)!nz{Y4Js7}Od;Egu+GXzU-mCetqvMTYH{bWhEAQPlReS5J4+}P2G;YI>+rPVT!K&Ow z%N~C4i{)#c+WqXaL*{K+`b$RJw_0^Lt6ke^bI$qhohi1-3+CJAN6)|Df;;ZK^Reay zSuYNL>DBYrG{1b^x?9HV`~KP=fBfb9@0X{2SJ1CG{p%BUHL!VSl=g2nGwr)f$HTX| zeS1$R-W3YQub%t)Y4sh_fPu$Wf4B5}TQFzT3m+`K>*4eE{W!0>UcJ+2tT-woxAl~q zPuw{ch)m$yGgC=ghcn@Ty;)il@1co>elV$+WLF zUi#yPvkkN)tIj_5P}0BksBA!Y{`y`0PIK#?yP`j;vSzzT0oVeePVw9$mMzEqd~S!Dmii z{m6Chi#A{L{-r-Xc4>pLGk%&i{XI{Qv1ha%)}Yzk7QWnND?7ZuYvl90I(YJ%kB+a% zpV#Kk-(MYY$=;paS}Yy>NR!q#w(WKGlabiPY56mIH{CqzdGE0cUVY`O&#HE}ShM@R zhtr16+_mn7%&e@)>(d%Pded7cY;1Y=b*s<&t)j=eJzH-*YG#Xj9gp8x|LdbKYal=M z_5EejGOxbOH^aTmJ8Av+JKK5+pIUKuZuG6|f6q8+>Q{@_xcfEFyZFV;zis>F^zOr@ zu~pwRS?XwIJ8JB-+jhS)Y0Vjbo-^*(Z?g(L8y=W?Q9oO8>$K5NZd@N&xbulYpMF|# z=6_!eKeh3)iy}$g>;r92M&s~4vbMHLeq-VVkJda;>T%()r&41^?qQ+w` z{_ffjhTPoh^0EEBIoq}l-M#+&IX7!hEn0MLlXv^~OS?TUH?NIvcr^O(DX(w+?3-0h z>c2QCW6{pv+izRa>iqfFSO1W={J-fpwe3-O-{h{}-8Cxs(e@e7l%JU~@;1it%3{wh z4Xi$Q`5kuzwyhZT+t2HszVy$9Pd@nIDXkl~&h@phwY|pCf9IRmOnv6**+(CB^3tBR zo{v3hpXR^)`4`SkyX@1)wb2dFKdJMHH|+SeNwc284<`k#zUUd}Gu?Kt|MjO&u9*47 z#%*ifvPs*Pzkg}ozOA=bJowq`VnV1fO_CVtUMyeS3c&H*Q?Fw68vXIsMtI`<}7) z@i9-{;Qn%bvsRUBUix9v{1GkNwY#ch`I{4l{eIu9ce2lH$jJZg(s}3QegAfg{_E1} z*&cM1&HUrI|NP zGZpWDv-Y{i7BBv6z(<2uzu$Ptf>$mYyJcCMz1hE;yae85=vdvm(JIJfY>|LxlM>a6Q*%dTwD zXvISh^|_&ydq`l*;@e)jeCpH%BVQ^RGUUeDv%lQ@WvtOX=S_L}o56F=Ik&X5L&b{I zcK>oreEvfZZM~*lUW1-+(ePD{aeq_;aU*5Ilt-f7PE1NcBQr~G>_=dD4GoJcn z^qqI!eRpql;gd_oA7@)xTD&)0Solm^Pv+0fzni`;{OaQ8pYNQRS-f-uBZVupZ7T-d zmgV{UwadJF7H+(EZQpvIZ=Y8+Y-p#Z_itO2+2!Te_bGRF8u!)rTeqYuIj4V9(){HQ zdZw*oO&lXPZqRt!jHaVTjoPx{lIPYbw|(LEX|1AO>$C1_(d_c{;P2nQ@%tHy!NUZt%#vvHSBpN^i``k0>4_Vp(>YSm!d^|NMOy)ImAv-NtS@xU|kyFGi=e@d6uT9=F^`lMSe)4Mh zt+#yqQ`aBP{czs9bGi z?#JT((osX^Y&r3gwjcG_H~x$DFCD#Pea_^OzrWD3vvGnRar(JaHoCdaQu4}St^Zga_l_#9wt2cIS<3VX^FgSV3b*FvhTyx&F z9j6VcuKsQH{1JEc**N&MQ|p!OedN(ccl`R@mYHp<7oX6!@vxzz_I~@u3AQWuWq+rw zsCVOsj(V|zZ!fBpY_IuOj_PsqoA#{0+Oi>|H?%$JvX&=h7Onhl%UfrkefE;6c{@Im ze%<%`ZlBld_4yX3#oR6P_I%ab=R2YG%J&9$`?jHd%3GU;lpVW4UK5zUZs6u={m$F@ z@$q?YH+cWro@rBWgTGeIZrYe0%eOr>$=SaBDLFC6#HMXF-_h1{)zr}1GTXg7kKcBG zPQZ4rT{_|7CmT*Yy<7b$OyIP+7LESav-ivQHoow}J2R){`mSuyGa8Madv3GJ*BdOD zG~m{~PhK#8`u%D3Cr-KkoGZhxq-V5$w6NdCF&~W?+sO9)592})Hty8*-uv#G|KJyr zZT!j2woQ5Jn?HUVaQ^vcesKPi*PL|a@n^W+iI$d@&Uchx3ve;Df{-T+EMn?Wer-s z_So#rjaS|4wyjz8+oXBYo1cwoc<-NkcCK8uY(nv#hi$#C{;&W0FHZfopDn&QYr(qn zJ6*qH%~OvqUw(Gl_B{)Kp4O`Ei5K4g)xfH|2G7badi|)Qo?}|*$+iY_?;4oCqMq-O zC!R>}@2FP;5X#hf*_DrXh_dc&pNzhy^B zn!Ebb4#z5U__nXnKC;=GG-|8<{57rp4V8~R{8jdpfmeTVew#kFj&0xk^S-Md z%3Ahbd3v{no4?((^3L>UyHySu`f+#PvOV+ezT^8pet4m<_pb{lW;fk2{LQrc7)6hG z=B%@OygIAt33ETcw&n4@-j9qdi&Zb5HGFpiCWdd1o&CX4^)9^d!amoXvh^0*X|@&j zyjuUYMPGb3c19~-vu69kuXHV*{m9_H`~KLr>y4`}mEV+SEbDT^(P`Vy*~U(SKi@e1 zhnB9>*a^wx=4P8V?K`@GXT}T9p0j-U9moA=(UZzM+aKsVpx%_GJ^D|+?$i?s@-E#c zO&ncs^UI$GPC72TWycBmQ&c8B78d3Y+w|qut%F`U=aX}`*|U1jYqR*a>P@E?&grnC zS?f#Adu;NSW$Ujy^@guvUp|@D;Ww^bJ}bR+)tqCFuc~ibwfgyA&l!`pWag@KS3gmlX1m`vtHd_& z>f5y&l?z6F_SKv%X;b>me6{J(pEdbU(+_(-_gu#3pZ=I}fBBZpn>TOSGU|h!H`(s! z{>b1*cfR;}3)?BD216%3HloR@hkG@g()8udk(<)zE}p+Iqf6(tw%6WhvDh_r?cCE^ z#Gfw&9slFFDVKJ+aqDS!T(JA|3nDM&gf`xJg7e|$K5l*gn#l|Q%=vcN z<|vo zTkz{UF1m6@lgl3{DO5MD4|Uwprp;8Zx0l^sf6!UE+n&Dv*~s99x16y3v!-n?c{#du zIjfDSIHQ_w%_to`d+W{ZiXWOg_lhg7sQ&H>&x~oCKIwb&fa7iK?45brIg#xv-P2z` z<FZuo9g*U;|Id`0*ZJgZZ#4Cml8#8(L;w^VfI%moNQb4W0+v`Ht&N%Jc&!_q> z+4Iqx4?g(8Ydsq*>-U8;Yu3n57yj}`qcgtvc=hNdYreSCcgthrZ@4>cO4AF2!QAni zr=_)DW&h~ZdTooc?|g5=`1Wg8?)>kdpX!aB;TSq|X0Oo`J^zorD}jfqd;cRUCTS0? zW3*6=r6PM-<1Hc;+Ke$6&B81xT2$I>?RhIAZ3-z%l(bV(QfLv879^#zmDK;7d+&^y zv81>9{eS<@|Lv1m?mYM0bDn#i=lPyYO0IXBZVahe*H*iD-MUA(i6PkohYizQ9&`dsr# zd^BX)9{rRjYG2=6I({-ZbF|!+g}u1ktO1dllX5JAgQ`eNQtG@kD52BS+oHcuVU%6S z470R$vVL0f^5e(joT?Gt-U+5V^hXuBY0;mqC}*UP*L?lgTAg$!S?|G-6VE&WajEe9 z!`k|Dy&C+pW|`M{r>aaXk}Al;rH%=_kQ-$k9CbadSe;yFk@GSmV|~&^?GTQw^acOo zZ(}c;`yD-UCGVsHTBfWZkO)|K zr9QY96Qd)C>Mm02vu>SHpzex^^qH}8VSZ}+XCL3XRl0fPxc7-6A9>!Ef46?Bw6U>K z!PUf1k~EUY(T{9QOq9dj$|v<5*cvFeX4&5s5c7K1{dSf0Yn6dZfLJOUT*NNpJ5MN#xJ8 zAL@K=|6K{n%?V*+MjLah1Fvob2CD}At7MPeI@5Yz12ZcYOB#!DGip@7WGEO)k8cd!V}In@&9IPLd6_G(H`XzSrnYJfGe2Iixqox` zh-n2L^Fl3a>YoR%`})GkHa{CwB$?iKu4bQ{>RUTM7=Ij_GwO(?Mfm8Es^54IaMP=X zhm2QIiMwz?pGb6jd246Yz39s;KU8k&C*SnGyu6@b$F5z26%}PjYq#a^nCy6GPgB#1 zv@td({2X$}%an2KY?dxnG_?#om??L0+`(S;w`Q3{#0L><>UK{YuwPf>_VXCaBMs@7 z*EAn2e`~tc_w>A4*TEY`%VnxGlnmQSl>WHHuYb0}wp}W=Hhw-do0>>Hj#SRz!Gkx; zDiUw7DU>5m=zXR&7x!!GZ8sa3j;(FeyU0NiQ?xgKzxRDq#wx`Rq!Vcw-{r1IocVhf zi6Rk0qiNw{9_@bPU7M%jDKTr;(Ro8Blxkno#a-!bRfjh}u-W%R<)C*_zWda#Y>^wC zo0n%M-G9VXuQx>}iB~30o$9#vQ{*R-p_|LiqbGt)UMAetW4pJ!eX>zv)FmkuVi4}k zh!d|~y(lFvkvw9ry?=4(*wN0Zl70K+N9r9dydSisHH7u*)xv}YiWF<}De*QFM@L+%q`t%>M=itFi##5aP*` z4p8?8-~8TiVio6gkyGMbVrmE{S1)0)UclW0+_W>>hpXaRTHi01xbi&4Y;%xdlT%6N z`*)Pt_Y?+~C|7CH94d3dnuB8}1-Y7P=HLUPI7iO8jyL^V>t?~>ogu@+aOw4O>yITT zCl?gV9n{D7?c=jSK~lJk=4S!rtE!@a`GRp(TG0%7sksyfxiN;1OG{Tbm-+d*9L4G7 zDZSyYEIxI6yYYqoN*gm(hHt9QRy#Cp`K?GjnWg6puYH(oopI?>T1HFkxX*3%W@XQ> z51Zm4d+zC8>)o-RK1I7^>gZ}DS=u|9n$~Nq)$(|D(H!?U<7~z0%w1+?ci-%rd*kE# zr+$}?9#zuPa@?U`BD6*Vn#e+hnuq1fakjCnjw;gri7Z zd6@9z>4Qp5g>lZuLC8&9Vqjv>x>MO|%+rgj?vM5xhr6=u`+-lnlUp}z42#+3^m>%$ z1O|ffMaD(ma@0rI59f4gbU`uurXP0h&M+!2FJS7au8 z&v%($JY|51VV^6O(t~pc9BbOMCyttzbAI-^#6#Nj$C^j(XMh37#ful$OZK(2vXZ<~ zQ+Pu4SY@Ui$+`~U;jp~iT>VuaUoz6mUf))mG<^M1yKnVd_J_!`*!%Nwafx$4*x2ws zhnVB!8gusCx!${SeyqveyLB3uS6AHCy}WJvc0+F5 zHTuISeV+Bxp*cBs?i6yW)}}JcjLbGm8B`6Fw=ay)NWaw9bpO#ZlcJK6i{$IuF1ImG zyM)e|zBuY?|0{ZHK4kBou)DTl;VRyuMF*eI*S_3orNb;$X|c1lwVg9(4wK2WwA_5v zwSYY+x>BaMd`VV7^X=UeqXXXQ)jiq3bb7bL)UPZ}Ysx2CB@fS|(Qi)ITwNtCg^QQy zANpjx^#Nle-<;5lj0{3l_~J{Y2cnl{1~d<7Z0xUaP?3_KPQXoDHtOUi$56``k$ToO zHD|T7h6l}MBsNyxf0K}~D<@~N!a8ooK(-$N-4H`6PrYg@wddTUU8|+kVD*y8Gs@`p9T+_RCw7T0-75d{dXBIBqFX_tB zlHIz*F5Q?^Mh^9r3sM+=J9^+0r3oK;E5+*9PP-SIKgKHm#Oy~Vw#7GPv`&U8kK6Wm zNMMu6SMtN^`-8mi`$;r5Huh@W^Pr-l;>;P%oeHueva=Es=PXevu`bVgsVaZ1C1$x9a@`eqYqfpzLIfHxe ztcFd2m1UoouTO6c>p#@2@Z;{164+-B>2W-&3l8^_CrJgSKl7h#XlSUZS>Uey`SWK* z+08{oMYj8`n%$m6I!C6arA;Fcu1x8Fy133@W&O2Cy^-$Djrcat`!O#X6oQ-N$(NfZ&(3?#KQQZU&D6ffv$EP!?ioKlOR=)I zzkk$v_i<3EAw%XlI_}xKmzw^RLZMg~E;!+AS*9FVu!^U@#L4OL=_Q!}K1eP5H1I(1 z4L!>}9~&B+OdHBqb1Zj#Q}!xYzs7>L=J}>o-`mQkqy~`WuS-(iwl$Zt==9lkc8_Ws zw{6?j%Y;Uw0Ze3KvhK##K@)b%7*pebV6q3>HvW;Z)-SUUY=_-KQDd-tY!+#Qh?c~~tk zpy{o(o!tOAx#N2-jLLb}tIXimoTmj*e$Q6D3Qm7JqpmF|Ft(t)jbt?LMygx3T)vjl zg+&g!uM~#lQ*CMt-m5J=&yJn=Hh%MtQ>RXW0Y=tRjXdofC&y`eU|boi0^%Pl;(hJs zK@*0DQ0ptMk_Mlg=NGoSkJG-I7u&ag|Cnb5T>GALf9>))RZ4Vo9`|ubPKjhM+30nb zxUX`zCC^@RCP{9$-n~5`!NI5E;=CA)VLR^y$5wMM052VKw1{-i=dF%JYL@+Wb>D4o z>l?O?BRhjp;)GEq-->Q*+c@mlrh(NppBHC^t_jsricwLg1aK6tln)j3!P z`kK}DF=;M|_wV0Vwh9LT-*{zx%+jQYajLqy&EQu61eVR6yCXujJUoXr?&Pd#dzg>U zT=h;fZfhu<#JCtj^>q!IzMYyKTz0}PLfQR>6Z>@SB_&BeOB>b5rw$Hoj}kL$zoeAv zZ!y&s2{v>_tjH{%lcQZ{@&Isqm&n+(KqnixpUi1zGbAQa*I#R2Lsj>nORv`Mg+o) zX&Y83zIr@lICr$fAh%G(upILB&2>*wsw%TXj#zDP`sSu?Fxax}Y<2L~RLBV%xp48~)vxdDx86NrkZGu;GW!s_%4na}m9Rq- z6IM($G+h1p%5pZF#7be%a=}{CK(zoR{6HnyI+I0L~2p^_U+5g(f8}iUbVg$ zp*MGVI9|=%yybGkgV1TqkGp#uYOOx9yR|tYEzKF!pfBO%bcau+Mu!*q$nCxFdwT9E zoX>7m*OJtiTgHxA(_Cg|vF~Vw-nDDWBZgMz-@Ety~xD_09`f#(kJML4xLsD9AoZRG6yZXdv(Df2Q z;GZ++@ZrP3v3nvS#_F+;W@J3}NU^s$F?)Y97y)}8S~UT93osy3Qc?n5_5GFglII5~ zE{T#oFTXGl|EB&Dz)?xyu7(@D``aks+@mA9hH1*zW|%*}D)&&MWwZR2xI&Ayb!v`t zKF*aNUmVr%bX%D2GuP1Z6DI77h|rxn)!f1YE->EOp+u!ppQf|EXM@4SinotRQR;1G zIQ8b63ef-!e0qKNuYGEY)4ccWi*8ED^kx~&cb|X6FZKJ1^ff_q!N3g+Bsm<8sp+*F z+lE+7-P=MdyTDt&emywJeyBy+tERx#aE+?!;rX|24NR`<(^`IA`EJ%m{mf0;r{*LN-8_`nTycBtqlg&q=_Of{ z{U#LMPQDZ6DQ~lj3y=y3hydqqoHxC^;w|uQ3BA)6xs0}5{JHwbcFi0`MMcRzvi0`U z%f}TQ;LV)!s<^ky!iCMC3*I?oWH4=7o0PI$t}|C}0H`*;-p$hYVL|KY1HBp>*kqppaYk-_?=rFp~V)JgB&t_T3|f9=|}Yu2m*H(<11=^%Oe6Km31lk3ZJUn`fYDOSk6(U~JV zLu%eB&$|+VcRdzmu1L&w+pkGBb#T}E2P()Ur5)OFx$-vVvli#B1UxfDKlpslU#f9AZOJ+b#xUEPHX z77QOgJbbK)v69kEs{f?S+GNu=b2eOBB;n%Y=iMuCoHek>k;bbtVpXd0qd0>kt-?nE zPpLT7Yp$znOtzbhoZRq{{nTR>DZ#OGZ7jl+c@r}zH|3o7$tZ#D1SCmD_VZ(m2Y!o+ ziCxF@k#LdgXKQ)*RTkKeg-r|Gl6gHKM4_1lmxB_ZW?B4tH<0(C*?*@q7o#24$kUcoU4 zMIT<=9AsLFD~ySWdHmQZG011<@HXv2qpRxXIJ=k&eyJr&ErC`MMvMpv$+lkKC8P$% z)Ons@j#YOlTkc+-TtC(<@cY8&#}!_zl`4P!z1MSxoAZi)UQR&xZ4nkBn1C4F#ENDBL$`r5-PKth>PT{8 zBo`MG-GGhw4w^7OJ%dbxxdUlTLI<9DXiyXm2{Iy6s9bP5)t#rY)*bGo)L?s1;GeeU z)M+H{O5mv+EX@e;n`m;kpDRiSEed}6m11-S#pwQ?Vy1V@U;lGOO&1iUC!X7WCY?^` zj#-~7?C%M9bhEy2ssSH1l>;ruz0-U62XYN`&+y-g_52*czi@Nmm0{L$jOQF-RznB? zINfuN^S9@t?qgOv8S^i@4}>fUvO62k5~p|;;Y>o)5YzmB&2M$JAzn~AxN8XNg`61t zV<_Jlh@{J@>>d&yq1pOi4hIewb7LYd1T759bBJberBN_;0Q9#X(|ycA7q z9;~3zF(!YQ<`td{LIiLTbh0Op3YrgkAI$sBfj9#i3JK;7rL{*4HOS!se^5h9K(Gl` zIZzIQPGBVAC$~mOJdmV#Xs+TPbO<#9jYK7(x+hZzcJl}-W)7<8eVfmutt6<-wgg}C z7zi>)1;8<(pv1xQveSf!w7h^{W6)ND3U#6!F(x~tT^z2Ub$(PjU9CN*IE^bvnSd80 z7e{r9bU^`07s_OWMpL9r$TpAWE*By3LGuOt8KMicY$2n@k`q7+=4US8TQovp(3xC^ zL(RzR?I)AEVOJPWnsA=eyA*Axem&L%yJ<5^pGmD zbFHBlz_doDfL?@JjYBoq=;R6Ce%&m<0vmO*PDY9YRYPGx#>y-=m_PZ7X(cNW6x4z7o? zx_1t#RX~AwvO7d#9(3wTni~zmGnjSV6v@Ow6Tj^gei%g+BEnaU0sb!UI|6l(dLRr@ zLe;RZYv>z7cIqEdvL4_fWgxUl?8`UP3r~_37 z$`i$p;V`J;#nW`7Y3|WFb(@x^CrxWdK|RO`({*!EMkAhw#~-6>gM|zEF66sPyRZ6r z;-XIR3sNkWdI;vo<@3IAx-dQglIfUZS19Q{JOsbBr{)$!V>}Nf-=^^g%LI{}>Lh|Q ziwDWgKsbg}uSn-WxFu;=#`slW(1GVOJwpC7WR#7ProrF%Eg-Ee& zu|#uN`Qq*qgcLlD3DaT2{s&QCr$Y*KB8ANYO@*nUd{`VBh6>TNK!{SsVu`K}f^)Gd zq8jb0k`NPe2;Mw^W9hWzSO#{qAp8$oi1bKI8oR&PmD`DwL9j(;YmoDh62)(xQ0Wl7 zl9xk;Pyoco!yMd#DIHX8*iahIq0y-b*BC(F917WoicIjZ$rL1;5CR2Y%;ATAJfc;! zjs(Q|AbbWAKv|vJI!rhwVElu2h$ZJ@iU&+VWbFVvx{S_9)Z&K+H5hP3m4Dj{& z=N`VB#9*ke?>@;_r@oMXdxW|+I!YqAcQ%9*8ri6!&I?Z#%m$#8!Fm&UBbb8w%=diYAmaGU zpd&T!8TJ-$0qnzA;N!zB0jloc>_kd}MmtkvW&%Sa1Z?2X2VrzF8^lgX3`hm`1&<=< znvqE67)>x{lt^+vejz;2b~l?5kGs^ZnvCwOuV2rgE1 zx{LO79g3BuKV^#h3JSyCNEB+ivwodn9W}U4<`h_5)ZUmv_6823{K(MWOn=?p5Ns&` zo5-{+vpquaS!!7xcs~9_ZYkEmQ0@Ej;EE7|2$2E_z7T&rrzmQ)$n`~yw%yi9go*GA zN=Z8r8HS^oaocBr1mTr~PIZXX3jr`3n9vZ5(7@-5T>+0=fq`8C;~?fzVF!dIftsr! zsXF=L6m)-!!1u5#zc(=t_LB6r2xo`s1lu*gpNZE z&B_2rHDp0?*tn9u3PlkfG&V5W_IB`_;YG%%l+jdV+TA8|z-$9cYvIY^xuJFfd!4o# zfk;}+Ud)`w?=9T+#vwnTFCcUii0~5;zJoU*gCdc-I-N;E{(cbB|D(ejykG=F_5>YX zj3k})=h7R3vO5M^a8M}Fsu6x>nV>rd(8=UHV*1zuGXX`Lf~28hbGT4fNJv=DgcB?L zU<>D-`8LVVLM>`Ep!>q!34$$f4O~84?pPOaanJ*>JlUwb!1J?&iY3RxaumCPNaD_? z{zWN$2{V~!qEitcgBOqk!|@LX3m_1CBlr$!GhFBp;|1=SOXKUXqgOM>yjpuu=C^C+ zJTq%+%uZR|s8Y=Ts6oBc(44_!5I33bG}u(cTeSmJWK6C}V8Ka6KN^RM4bx0T9Wm^J zWR6hXL>(W6$A-ZgkEuj_bx7cw5xsSCH(`7cUo83oxwt@)e0(kMAeSQ9j?RFT}bq$-l@2&r$<{zPEM>N3* zi`R~2fkjbJgP@=%AV`CZ;e5fK4&*fG8dTsiLY@6SFl2c{z~g@UT2i$O;yJ+7*4wn z3cF^~IV?52=*3vf_DNgxE}@UJfr|rw>xoVqqd81E+%A#DT^{o{%oBBG97y3ELm+ba zPfQgdE8YJf=AkR(zZmoQh5V72C)Bck67vwBjb?d5LI9FvRj6isOY#Hlflr#CkQ{c} z_J;kQ`6BGe3qdSG2I)PVFZ$;Zh{yZ`F$nF(#Li}hgu{~PoRVm4g7x}y#@8AAghzji z>0!^y{@juR9=Y9cJ>g#y6*EyX&y#^Z0{Xu?pWC&4{%5e_AF)&vEn?_U6f#!55VgoZ zi4{9Vihl+tiZA3MeF_g_)}}jf|WXCT21gxXj%;%`eD}F ze?eytL8s$CL3y1k2+e5BrgDIepd|~hEyJfN;ba=9D}~N;M-3Hr5A69&{tf*%_0|8W z)K^pg52U{O!TwK?eQy8s8r|>z)YQ_^(dm%?NlW+N{h$Adf5_5T0J^CYI2%tIQyqFu zeS#L1VIXpt4R`wqANK$_L*0YSpwU<96Nn3_Y-P}wvOAh-sP=W+=F zot!X}=}rc)We$tUBEsi`nJi>y3wn;1mKwoJ8~jZHe^WsPMe3#r>j0$iUQ@tNa0U^0 zRCO-P2df_V$w&Mg!4D(^00eZ_hOVmwWjkD_qtcLy!TOUIK}WL$T!zA;v)K9sW!Teo zJ&-E6(SeyEkIjfzatgnaY$^$ZPMGf8$du)t2v7rMQ79Ax;VN}i9l_C`X(l2IABoi` zAU?|gxgYFKI|*zrUPh#D{C0xF$fi&rLZB401i-)g+%^QaP!2^L~0^( zbCKJKHMIQz(k=B7Yyz6k<-#2xcrWc99GN0=r1MSz;sBPXUX1`hV^O~Ip8xyozsLUn z7f1lQ_y1bcrfO@8`~QFU|Nn>n{WtIbw?+*cPHtem5RMvnWctsO0U$-G5#}JLs}Zm* zP0@CV0F9PNGpSzOwq;lKEg}(6j zpNrH+^_}zyGeg`i-Z6NdjziIxw z(~86Lu@=s9?6!#lNoBZ?oyy_D-j00eX!IqkB_=+q+7 z7=4H5=yxNBKIl(0M&873b0@;9D0I-Zk+)9u^rOo8@EAU@$1r@lt{D841pFJ(7`${{ zB}9zFrGoO{>p!XvWLN;FgV(OB1ApzImJm@Yo6Q31N8WxQ3baZ^Zj`u35f^0gpgQ2| z4+N1V1DeMw*eLYV4^BXLWEf+6X8wr^k!@q(ddNGXMnX4&Bnlar8hGiZUYKCdRE`QG zi={y6@a@OKJ-b7waF6a0D*98($4)_3ZD0?E?>%)rzmc1#)7vW`bt7VgJze@8fuu6z z=K$D8K+qv(Q0;<3JQ_mF6C!$Q7v^uyN8h^?<8Mnx-@6pUHh>~;T?(O_4&iIh?V*;T?%{vF`Cj{L5R*eDvalj6#+f~8+7lk2<%x6 zaJv^+ILx!Qv+ZgB1vUGV*2-4{(b&;!ZV$(J0@aZz6sixn_2_$73U;GGn}x4kNl@r4 z4urn&txFjelZo^*>_b;_zzBS(RJLH8$p6xfJZ!N*p8usgc`ljDL51O`t|YOo7jW={ zeCSF})TebW!DXRSb;g2^-N<6~lSENl*A~iUXEa%9woaofHd@Q+XukGqWBq*UK0R{jqtEu~c-hcV7 zX-@z+Xmrvewy{WHk87{J_S$QNjd7D0taf4T$=hf1VzA!1Q!r1LnG>Vz^7CMnENteYRlgdxTE2l)BaG5-rT*{h%Hhcb=J^yU>{O7=KyX*vu2wT$#@zE3JWj#ba<+uS0&tJ~h(ncm!j>CL0xf$7a};xj}4tFJv*>0?Ix_tnn& zaxwmUr@eZo|GkaRZ(0A#5fCmL{~c>L{oTcvK{Qa&;9sKgCAu{?z4-#e+e7$`D|zp< zymwmO>(KIEqi~KR!()RYhtrYa$r##Kp&^Q);Y(54If^%i+Q1MY;o=bXw2phimeocy z?Qg%{L$Z)XS&17?5#1`cF`7aE^Bi9rScy+$^-B&dU^mwIK(^AojwT8giyA5lCa$LW6Vi6-JXl zbWGu}R{=*ZN4yUya5S_=K^W3x0Qb;7hWDeOpUO!n5I>Kk7dEU&f1@V|!b0QFjznzc zP-6%5-bZ@sA1Y^)*J+X`-DGgNi16Qa+E%E0_{Dtqw!j{r!umyss^}<#t~-HuiC#KR zFCD%Yu&4J)@+njf1bf&~43zMtL~?nK8jQT<>2pH|d-Ut5{ttDOQVQ4}2AE#ILCc z-wOo0_Y1-9y~<$s^ed;`FEiDe1g(uyvFfAD6L%QERhUU1b|P;H4!p^w&csO!VTdT6 zVLUiK38K{ZC3sY*d zZ#qI6&i&HJEnli}tZvOygI1K#3vHrDaL%CzApx1oC&4~R*B!fv1Y zFSqwz(L!$cy@aR)P&D$eJ4wSZ7k9=K_Uopp_Im%#p{gW(6OTz%b<`bJ1i)HZH4k>* z{AKq|p)R*SN9{vcko~vCu0_g7RguToTiW+AO94@~%&Pu>_h0Q+)b;-fTn{3`c%b<_ zWM;01&nvoCQrs`!BjEuCVuqi;>d3s#Mnrd3+JMSJqG}7L-BDgFg)x)#gGI4#sjAF} z5LYKND_`m2s!G43Xz#@leJGbx4&?Kcm9?LzRm3nV$G(h{$_X0J({~<@?8&29mCpuM z)fFUUEmK7yL|B%K!fJk*=?8lN>z!Hg@F+-s3S@5-Ayq-Aj}~x~Xh@2vfh0h)RS`Qv z2EaWqyBT1-4!&G*97O-^n-?l?!gJXCfCy*|C_Ahe2E;(ozgqt zG{$ij^uvaAE^rYU>H(MMBNmS!_}cQH*?A?1O+^Fen$?I%!LW(fNU5eY&{?zUF}aeO z&zN@6Suyb(cG|)Se3F|A5EFM24vbpZ^sOlpRii$x328L3G)tyNjEiigaKRx8L6F-r zPo!0xh|gr0ps6feWwS~b3^y#mq*$i39c$z?qv0R{G$xcM;q@N)A~kuVIOp31{N`w! z`lq30XQyE-Ov!LKjs@#7WxE6$Tk;tZAIDroAqx}*+Q4*t0L~1kUm+l+^3-p){CySb zu(}AIG88%h<8#mekDmy;$T*K88?^2;a+oO`E{kw!H8g|CR66Q@JZJK!ZcPF4ye_>X z0TaO)_f(Ukbzmd_{a#TtO2t9p>i;yzHvs}cocxzu7Fz&UjBz1>>nq7MCBuU+sV3Ei zI0^RfR+c!b8gLZ5UYPi1Y4|khJop%zctRAV31veVzaQ=pmEe0Co#0t)r{M}%YS0TY z)lJ_YMj7mXG`wMICXm$eOhOO%f?OhJ>7$CTFM7C`?uzk%0y`Wg9ND4CKX*6-n>gyNU2<3rT@))?XyQ#8IjsV6r*uV)>HG`gbGcbnEcN9?q7}kQj{+f`F*}s5ijW-0UIa_&a(;EbJ_13N{GtBG#P9?%o--NZbZ#$46kPm&s`;p ze zHi8X|0su+F8NBBl3?#|MP;LovW+a8@eQXUJ$rwrha}`86E@9vh?h=B0y$Iurb1o7T zwOI33bj_VOJk>LQIzXia&)=i@Tf=vTZV{=%Sk6fHZ3^SeRN@t+FrVOnU_OZj`4d|b zk%V8`I)|*r6U}7xv1j7ubcuIQ`C2zhg_qP~OQgwIou%%8j~oseAHyj<(1IpZ1qjY& zyu)#mcrXo^@Q{*-@$=I4063p48HRZ8;lN!J7P)k9v(tQePRys`h1rU;&HRVHC>kXM zOoC9&Lz_RBz!&z&USFGri?`s2O#vQGyqSH0OL;xdtWgKQYL5+ zL+_dCe!It#5!JQ>K9Z-93>sP2ctElO8m~v*R1Pz)dtvM?qymt%pfq#Q;?TM>Cp0)W z{0|~E1zF{D=`7&0@-!HY!uSuR`vdRzJ-F44LKfe^^Avd^Ny?mM;3^6oNVQG6 z+-p-ldY8>eU3qTLh@g%_Ek1cr9VFNKximyrdxx*y8SBOAMsHo)nK>v+;)tKZ>b3F( z1<(B2aX7$Gg2fkDg;<6x>Xu%&@GV}q7$>CZnj%-Fqq}LksaXsuwj$>$Q7&RP!-zJZ zqC`k_B=DLVif#f9ME@9%w_-!ZLr3J!HN2;38$?mdBzYtwaIt7T2sBRf}LBU z0(#un7Y|wR6V;uiaU+8(SUDK)bL!vk1^z)a_!Rgv#^n3mE>v5nJ(Y3!&s+X0w0W)h z(}ugim9z2jKTx&<9lt!6pnS?r3JQF|QgmH_0`~5u{BSKiVkA>=)87-S2@8q@LK#=I zmzS4ug)=e3MZ-d!42p< zl&sjOJ=9PrDG(0lf(Zu;lF;k99VsCd9otMDVkeCyt!NXI24)f7c8A*Zp$;1=0(?m$ zyab2gs4+X?VS!Omf)XppsS-nrEkrT>4Cgr~=s6K#jrNda8THsiI8E_FlOgk!<>|N! z;0zn{sl#di$wO7Os0!Dcw4^#QTlR7Egnvv^Ov%ovP)j+wE%m^ICweUw8K1PC+G?D$ zU%CY=hx-opMKHv<&Y?zXf8bKO-wM@PXLgw?W&AtTc9Di@b{F9&8YGyey?V%BB+u)- zI{ONwea^}a))E-2E z6q6jq$^(nWVL?V$9wTgYY)p+Hcz$-3Rx8RezgvXo$z1HKXmcVmztLszw|>d-SFE@6 zKv>_dO4sZgr3*0^fpuBI8`fDu2q`wA%)$_c;sppABKa1D4Qz@Ch@x7nB7y(<)sH?f zuZX!Siw?k$^W(O>O5UT2eFLV!e-jQv3Q$bAW82(3h)&`p4SNp|A2jdNVpDs?|I`kc zbp)jH_Xn`^qLdlHNh~EZahK&BZSK#=_8jP1=8i>vkY{b3Ftxot%h&nd?klytF+jAN zYxF;`l7be|u2|OL#7~4Czf#UqwG!6B~Q2s<;wFfwr9%!JZcmBigTYyFPJNjG-*tDgT8&yD`ai!4ZS|f z`c?Cgjm?T{O#TN5|05RoU0WLB6qRz zhKTaYJG(ixW}i@Up`RsSv2XhHrCGe)-v!41eR$`tweP%he=DC^{=X)E%;o!-?*H3) z)Lw5F{eRawD|i0CxAFNc`~R}lD5{o~N6sa@faPx~;`4OBU*dIH_pCd=^Z&i`|NYcsz-8hlc{rL;$|r;M{Q31H{C1UuG2L=;@#;G}PMz3pmL>FQV2!^NEaWFm4C zRx&SsSdx0#9(@R5j6-%s&zlKKC~TQzlmv#y#}x966j0iDpEk<7CM6Vs4L@IIv%_L) zx`6G@x?{2R&;mJ~5)R8?JU7uyCnQYrjycsFI)pIHa6M#fuJBjenm5U9nfxd`j`F5t zNXCCEYx(;kPad2%J#ykfkviXQ$iVX42;_O@u7#}LFbP~!c`}`Y0 zH)-6#IC)l$bhzg5jK1Kr8^=Du6u~|jTi8=BNkcSQAni?(DU<6Qt(-{@ z5Y0;3_F$o0%9c3RI9g~6SEx%t4PfdL#x?9QAmHdMn@vyG z>9PI*E^NsV2G2W2564(}&rIkT^+KQ^0ox1V&<4su08N&)$2A=Xg_sy*D##Hpl*hcf zGE89|`bk1kE9P_=4s|tP5!_j{8qFz5^i40Am~>48h@J9P5!;%sQfvCForYG3Qrht=~ztCMkNe%haSp8vn-J@&?Gh)BHLDk_~825BlE%g~&`GG19U_V-yY$kpZaAM_-Z{vze7QtL#L*3o}*=1mv*fxIaXhp)X{b z(+%?OY3S6Y*0h_c_Ju_(rP)!AWX!IoI)dA3i16IY!RKf=9{Rx$?wagHgLWnqm6_DQSp%Cs1275{1z=b}VCHXol{w;L*ccSb1p|-_ zqdZq!h&>L9#G*Ji9FgO$ixy~P83oK`gcIY0_tq+?%YX$hb<6PJ2qm+9HpR*m#VQQ6 z<-bbeMG;3xU>GEL@)eiXi=hOdPnZBqK(oI_T^vr-MOQ0XEn1#TAKDqJV$r}~%v2__ zZ4)f9tT+QULh-d8o#X{;nsbyTG~hrGy$V0zLrrlkoqDafL^Z^-KnGPpq==Yy1!%UB zYfs!F{Y{h$f;c|vo4YIrVl)6G=|+SmO+sr)7DMx)9Ymdr+h@u_n%FPsUIw&cm=Q8R9y0KB@Er>WC7DT|V#( z5d&)cws6E%#KLDMeJixMYE^^4E}Js`3*OzY$4=CvSxb}} z;B>-ZsKCjxsM+W8OGUgeY$Ndo*SF1~dSsXl@0x^7%Bo-5p>;}gLw=l%kDs(3FX12apu-RFM(^u~ulV77%<(grbLKF{R(u~zF2|?Bke%CSUN@gP zOIX!526=+66))$^Po1|M+ryoeVuwTFyQIAf3dZb)dk+iU`jfhy8a1UPa|awngE~Aa zKP6GmS79{~4!!Ykcn;hpU>mYQGqh+YD%1~gITVXloD~u7InXwun^xQw3@(Ts$07=2 z;!bhRlvz3ASEs4&lo)omj<&K*zxMa~{T}|WQE&awKv9sRilh8ZH?#?`X?GXk6WRup zBWoUfex8QmKSSk3nVbM#!hJUEj@k5eoU-Sy_>DL>o@rRkV&Fr{)K!Vua#JFrL?G%D z^>DB+PvIM#nu@=c;|iHjQK!XWz>#}_gE|R|1c>eVZUp$$vTlx{45-KS5~D?UaX=j zRq0U+44=&d+AQCtIKD$xexN8wYeQ8~N{r=(!XPGj<~@qjNc}-t$}!%Yy`sKDscqOj zQ8G{#CD5)q1H&Z&Rqe-KA0>F%3vW$FzmqxnQQwZAdyo3xLO>N zUf_9BYG1H#MwpJS3baAyg=KWBB$dwMdo$FxCTvI3|8BX+q)Ot>n}}K_1K|txnOKzdKG-JX4LWsdVffBzF!RzY_~|Bu6+*Gqd>$pR;Tp&iTjLwkcvcLH(xzH|S$bN~2X;Qnz9$=+S} z4~#kvJ4w5G7$1|?mHL_}`O~q^ovUbfG+SQaPq5)dmG}@iC2g|b^0(awco{?E43=vp z=}`IR2L)SyeOC}wt}#=a;%877#hcbvt1MlV*q*9zZhNWFkXWeLy<-8--FsI5x_f2I zPl4xEetT(;@6U8&W|gs0L_3)Xf&xfHT4iQP0x#}>lbz>|A4O||oNCY9<|Vj18j8f> zS-C$YilKn$jtHPx8C2e?(wr~CJYuid3S7q)DPpgf6rg_xV$B8&njg&}>|(<(qJjV) z<=tRJiz>_mH|+`3TugVdrI6Dpuw8B@si-gsKw$TZegQfs02&d+QI0p{UbEDnvw}Xi zRAHrqAlR)tm$2g?wHE_j?O48bO3$5*fgsKuT##Y>H~nPn8C1n^j$Ne$AP zlBo&GyS!=}nQ~#W45_q)@r@;n5VJWfU?v*Cc(wryi`yw0J=?hOFa_B#+69IRc4ZIO z;FLGRE03ww#ze2Yxx}4MBZ=thkUo*CO?RY|{V!Tnls2{eDe}l|yD=qejD28;m17eb zPwG@Gl4t0(?rw;gfVh&V|CDM*nPrjL<-6rpYkl?4=ry<3FHHj-TWEhiP-!8Egq_3e zhqPv-qeNWgY3amHnK#z9AXtCz)%LSzZ;rNK{Y_>hax02c>cR=STz2|#0$+RG(xx;!Cmf_= z9S=_>|5$8%hDm!TXOlS$S;45INiv4(?Z?!av)Eeo&Vo$bY*EVzS3uud8y%6KthiK` zAG8;S^-uYY$t&p9S;#F+g(|@^b~{?T;pYUO8$Rok1s{{x3zYAV(!x%|M+vEJ*?rP=0ofgb7lT*_&yAZeV34yG6Xc|P zp;Jj9+;izV9C&BA@7lXzlK1XhhtoEvGRy45U=>G|_PoWjqiOC;VpPW$7tdi00VX^4 z?@V9%RbDi6&7ka)PR0n%_pA$uiu{RiLipVjvl_xA3VYDm;amT}I(gkX!Zt>R6^0q$9XCH)?8_`A2HWeMWlDqb+E{qkuw6As~+81V5pLex` zQE{n-gRwHTSstWxHzT&+Nb))@;9opPojn`b6oV1;`>MM+=j=TO|EO!hg)Trv&k;dSui#H38Ho=qJ7KY4 z*Uk)9LOkm#>jAlj*HLy_uyVKd`lU(rWD^)oRxI|!dVB#(m?-8vcN7-#I2q^46c*_* znI$FG{ar^pRb+Ukvgbcj3jajF(_#9M(zY7Oes0Su zH{6ATVd4wLrfG&rooY*mQ9r z@!7;xEWC7=u<&xOR1@7U8V(aFw-!%{3q^w_2H<@$g30p%S&#PpV^{%F{#8N*}Z+QDO^I7;t`N)=$COgM&r7G{a4xlG5r*wMK)(+ z<03v;kYc(u@^F>wI=Aix>V{={5h=JUamOqGct@TrrT^^+q;PX8oW6m*scw4~5mf<1 zaE$Lp2vcBO-!(CUd_Vg9VLrptH(}6ojlCUKsYzrt?a8L4-K;acqG%f3U_I%asI)z|hd(|wZFF6@RClT?# zv#yP=)##jSqfV!#eF!R2d$P}XPfovLiqB}Kj#v;wX{1h=`^FbI~a4Ach6Yx!fza?n-Nl_ zRg|T+JSLb%iIalz2Df)Q9VtQ2H%{pi)xfIhdnI=Y1v;;o&aZ?;w5#k06FQN(Fm@bx zA5%#K%wwBfJPuEyI2J|&QO|YHbUa3;X(WqT$t#!<-LinNN{3vIudMi_E~&?yvV)$H zQLj?LioY2%@=8kF^0o(A(zN2nJM*281wQ9fkft)WMXcm!(8rjvgjyg3I3)$|z3|2qrX<0&&TES4Mef76>EWP`@SlIo zc~BpaZ#PaEtDE3;=+`}6x>522*7c1imZ4vqv4bpS6n)bk8B{%T6|?^k4LO>ysT8V% z=%XSEP%KC}42ih4X5(Y7LM(w5R3^~O0*k{$k{I|NR4I?~YIG7~*L+qi03jlt3ncc7 z7_;6*xHt;X0lNkqAJ^T4gMdJRFd>ouJS3tjT?0iW z*Dy^~3&N%OD$St8sH_!#V;&Ue(l6`?j=b4-qJ1N*5M@q5;4Qu20yH(PCm;zY%}Eh;)+H%_ z9C9$Dd_%5L)^!HMl>`H&ro>y#0SZD0zaj-uWdy`wcd;ifZ-WJQnA}eQCOZilM-TXr3gm1IKB@pMVTM3}7U@{W@PL-PW-k#^I_1VI*zaGK(*aS4U^;*boe1uakD z#kC|;Bt&lO0Fpt^1YY)><##NYSiMEYafA&FZiRwkSi!O-zL6{XDMllLH7p?{7{Vm@ z>RvH$Jmk>lk_>VCo;&D>d9i*lP$nYKOxUN6cx3LehrRd6y07w`Z+Nq|nD4yzP+UP*Q^ zMPbmkb;(*}iI$)hf=3gmZaFWfeLh^-P5i z6*UR-$S^qP%ytg?`Kvic{ruIY%Sf@Q8&oh=1T&?q*cs5b-#OcQ2!kAyM z0l8P9sm)0trVf-2PVC4N6YpPhBE4oRrbMSKpsHfNZva)5dd5Xoc}fVx=O%E97;@#q zWK5m2j)SJN>r6M$B;kgM4?-6d36P-ZmEujGo+}}1(?jZu;&{tek}VHa6it)^0Br{( zXp-1c6Kv~7kj*q%^XIi$qXeIG=Nyb2wh79*?3LvYt4 zLrJy0Rahz#zBAK9+$6$J8SmlEl}9D%tc}c3xErPLFcNAV?TT&##B)f*6J{OQjtL5? zPB2K8KORw2#JakcO5Li21Vz_<b&2T4b9o4X7ZP5?G;mF1!+Dmyr(Gst!-7IuJmc zkC$MU4*R0-NH|#%6BQ=w&UMOUNn3=Ib?3^vCm^wb&%~r0x(e9`kNLC~jnSW~Cqdk* zWMm9J6tGEHU7G?CeWB5LZh+}mDr~iCOh}wgHAGTp7O_obn1X?X_bs->O%2gVL2@mV zCM?P%9FOtH_69+Eq9`Tre2)80>P;=LMs6IZgLg|Z8+QBajYCgVM7$ACO=_8(Y`2Kk zswiX98S(Kw!`k`#2W(GLc#bPe7c-axrsefn!%;}h!d`&dW;UayR3>X}^G)x_R(!xg z`@~Vn?3ZH|o(GD2;!W)h61>{dHKRcG96-$EZj(VpfN~+&5vIV#RYK(f3$AIbN<`@? z?FpGG08nv50G%N#lN^o=vaBZsGhd3NT>=I?rZ~@@ByNLdU~b3gk?>J2_z}f*ChSG^ z3M(^`<4;jCF7Vo?AtkuzK36uI1?T>li+bJ#H=AzGZ^E}-&+C>!QTplIlLq!2RH zHhjFd(e+UIcStZ?atxK2c1l(ydXg&5Gm&G{gXUx=_uw>YRkit>s@juAHTg1W>jlf^ z-*=&hen+8)9^Hi=y3Wsx_&?*`jmQ64X}8zc%kh8i@;~3o=fd%SZa4hT+h^Ah`v)4i zaO@we@2L6EtpTIV%3jA}Gz6zXt4aq?b`>UD8Yfr4u zKk&QSp~WFV6Y_VW;?U?lkt!&8;9KkYR6F__iTCoPrX_rNQYGW7DIs5NmS?Iii8ofK zG(M=VVOizZ<}uT+89V*jY(xE;WvO4AVyf?ySMF=NLfKokP{W-;RyhMl7FuI}fLfK) zEC;W>;E2ejQ`zq+A7}Rx;^G)%Qf*ooqiPKErUWyp6ctShX5>w^yuXHE3zK)G0N+>+ zRK-=WravRNLUF@#c!j{(mWQXM=nCGn=n7i0?0T`GWLHI2@JwU{-;JzL5m=!ZSHV-a zR!dN)!YYvX)(NUm8B@ViF%{g93Vt!9LJ3?b4XRmQjd*FdBPy7H3S-ku=219>Tt!nr zNt_C%U}7n_p%m;$3TR*M1*JF&{v2@>ys2>%{3&r1ys9_~*X*A=8O={@%HbmWOfTI6 zPQM9(eGXB$QSGUVjd_+^rKCNpJfbGkBHMej;7Vz`;aU#6vyp2)m)UXo)VyxL*{SPf zPLR?%Rd~l1NYhLg+45pu#YuMZ`c-I(tG#5s$zHOwvNN4zy(#WpGjM{gP!gd<5fUb! zY)_+r;Tg^21rK{MN1cz;vc%q!nOyD-UO!5++++!5LPZc^)t)uzLc}L^c%WXjx7ZER zo|;tSy4~9*W3}cQU5s{|+_LDO1vPpBwI`RJiQ_u`3fhHHh9a#j$b*&SFVLH1!~~p9j(Po&p5U1pXVc)pZaTx?-~u!(WJdh-#Hxk&ummy)9)i znoyJ>5^^uT>17~xbFnv9FDhKW?u~HV6f+%KJZir%12h%m6uIIqDnQbJA!sRXy3V@} zQGz=sX9(sKm~-y?chX>QRAmg2v2`F~qc$eWI9pWhWnR&elN+B*L zhnuXR6@;=kMJxE;IDrP>%Zt;2pOf@sru|qX8~2=7TNO{XDM>Yu?xqfl;+0qwH20u{ zO>SC~x&+xF+$WuUHbAKqq7$AqVZR@BQPbBbnDbrPnQ4k#0vaz;XUC-pF>OvTvollR zkQYT(DPT$=e9I(O!XbIew~59v*|OcxRhGDBa)qwm*?79*sGzC!)j#_{&Bqxsn}gsS zhxsW?QBc|Peu6E6YHvgO$wI(Vev{ahtBnG>V^9YYvd8PE!3mNDBs5G#Fi~+2Cl@6t zI(pcC(SRRIl&E|V1;^1K%Fm~fj+q`&j(5Cwg^*UW!ZjB7?U<$7>awV{ty&3BFlD<3 z9W#TDSX3oPY{^1aPw(E=nP}qjZ8y3kPKX*1GTyaO!zCl;`ody=?Tu??l=vD3gsr--7uo9SAfIgXF{ z!hd>J_|I8XP~Z2QkmG=GcC2nKTCcqCYs^*hFL4m$l(D^H<>L@<@+BlzSq#u)nrJC` zStCI;)XhZp*2!IwYMsPMS`i_s^5V$E^%D2K5@DVcowOKEsT`fuCE*8=Na?G>E1H~? zXqW4;2!cKGO2)4H2Mj534XdILnMb-MSO5SXZZ91ilMIJVphjgZs$88dUsFCt5c!Pj z^mv4$Sy{gCoW;15WoN4!6AC+$#tKrcCBBy>)f}?FAp0VE>&S#}WFJ@WQYWH5ucI4K z->V9!Z@K2`q>mMm^+~`rBcT4|5cV3L2a>U+#0vXaVxfUu%Cin zgS>T`ei*Sb)Ey$r@nrabs+cf0>P9)gtCI3dPS==p2cfb^FA|5V22Yqu9Fz@2iRGI& zghH95Tq2G_>AqPJNx|m+tVjyplt>Exe32BqsgV>a11X5TZxt=OKo|vYVi<*)Q4|WE zP(<>26eD1q>p%+gcs6?lhi%Qw>d*L4IYlW@(Hzw6O1Ee+&yxE^Sw-;>3ik3-^^23-uP@92P4Uex($)FA zv%O01?CW-Ub%}yDbt+MXl1J(cS}?Kv1ulRE=cuCRs_nX3G)v z!xPn?&lA;~#}l<2rnao6oW~nA$aL1PxqMM8xg!BV(W6y-5Uusbn?}jG*f=11mvKOx zBD$J&Z+AiiQ>nZ+)jA-vC0~Bs5v&4O|AA>R%sq;)PZ}c#qt(UG%5~NdCtu_PZJAqM z<&}rn6DJE})L^z-NP^z){B`uWp5{k-`+{jR|a>-L?nexIh`SM(HPND}94>>~h z?kG(@MHutOx{Xm754fzLItL5nC>|xQ{&*Y##|!P_brNolAqF-IGOI2*=nO~b;(+0V zG5$tK6+Dt29HT6QeZ2$cHhIQ>6mkw$TY%~pdFy3}dl_?rXpV)U%o|=fmc>MvQp$9{^ zqhH1xiyfs=e;VYQ(DI*7@=bqZW6OVs53(*wmhsufhj&X$_$U~|y&;7w1wMs`_-qv9 zr~Gr1f1ZigD~l3(M67A4Wiy6x7N%%xk5B*W13p3J2>yDvLA?R_ za2v8~P&?|ORSA{>Pae0Tng><-l>iXxfi8V1Jdju-2s~hpEqF?bd4;c6-;AXc^V0Ma z51BhmFfR`zR}pSCwI$|DNsT*^bP4t@Q%O;1o8fQvK(II4>~MZhgDjjPBi3yvsTVMr zAd;Z+`}rIaQ0AiB@rvy@gPInduM|Y2JSH0kGsE*x+)q|npP>yV7hiQf3fAq8O(SvQHWFdHc58%X;8 znG?zshu4}yx@2U*((zJvskb@$;TO+)=y@j_n7kf7TfPt9y%XQpznv;4UTf)O(yNoD zNwtcs9%pP0|H&Y~_)U>9a^ovL*)1M+--b*u@erk4?Fbb>U`=1I<^yE7Eh3QSER zRU#!Znu8kmnB#Lxq)&rpi70)w%!*zlXBZfdG=-)eOxR$=%T10mrP3au`3BN4SQoen zNL_mn6jD#v72ztTXAPW#;vyJxhumreIKo5u+M}MDrd=$cM}!J;&}XQ)$b$aG&QUtG zY>qa&A0g+=G~=&XT( z1|vFY^28&Nu42bA;v))*n|_wCf>h2_wDQ4)qBUUjq{!Ajtv){W^qgj7<>RQl3{wl+ z1pq4RgF%T&5b*>eViqHd!xs@sO(j9Tea!n)nIJ^N%q!&U8iaicot})lr&IFo(G5r= zwaKzqf!Dsrm^}j>++e@FPS@(suh726ZPzr?^KU|Uk-*HCC7uGAn`;X-gEN;#Q2!;@ zFP-Rn7ahzgxeDfjiBUs_sx2rm3ezrC(s|a3Sz0ivDpfrN{-XzkYe=b>M!1s7nGBE! zNw3On?o~%uETZI&%z9!)=(WtPCyF%(!53<|!FHCjw$$%ghrLY>J<; z3M-Q3Dix1hX(-PFkga{R!r>pj)Kv-2>4uf^>5Dnc0WS+$M;s<~>_!qMb*6%@XIT(X zOb6=hqE{k2JH}w3fn#7>B}jNIUAEVu&kt5k_vwD)XC}y zK(2wxIf#S=g{g^sC6=~ZfR;<$lV~swmMEVWino6VwmRRE3n|k@7ccP%Mt&ANqeg2@ zerjV?tw7b5zPaL{scHwcT)m~)2(?cyQ(JRkmnZC+wB*@ zQtnRhmMWP}G?v!vcD_`ceK&KbFipD$pt)1vm-+4yX&8K*e2;KQu^fd!rSbHeeUq5h zFJDR}u5h)$jzH%el9P@Wc5i?y1zuter_FKl4Hxc9l2jJmV;|?_+C$72Us*hKRv@Du z>&TpW$#M=)i7{lNyUW$XIpXB3HdnvgJsr`jCG#}1%i>YAsOhtbkHf}~~cfg>|~vrSis4f`Cx$8UBH{Jm!z{vY>x8@}LY^ON6heTS#O>eBN1 zQhVKBUft+?x6x_)r04W^Kac!Bde=KyHnSMyal2z*MCk$CmiYBBqN|a9i@)_tj(Z8O zsZNW3wh#byxW#2Ta7?-=nx5%`@WU>ajB`~^fbB(nbaob1@yWaP2Y+kJUs&uda2PP* z&1hY=Xpk-DhU&FrS{fK*ILJaO$Sw18Rhk8qR%ui4EDc7g7=Eue3f=J}VEmX{2blXP zu5&X@stY~GJ+C}rE-B5BP5MWeHN78=hocr8{dESRdik|C*YDsngZ{(SzWZ?z?H;qs zp93@K|N3gt{6i87R5y8o8na7P1sRVGTuQu zaS|^o&oRmk_9+VZ))r-OXYZ053P}Q6S35>-=2(~}o#YZ~9(FPHOcz4YVnsV7acp?1 zcjF)|KCA358e~i&r>ohsTgE)#mB_HvHho{6AofS#y|M~?F z4z`{;3G=uP&l~<@zimzpG$YFEwYTWXx$!;*qOZt?UmzC#yT$l}|LbG41N|Z=MEE(% z>rCKrmD~w z69+P*zYHf8=TU$NMc`zFiStwR#zKK9W5P+8E05%SoJp9VH!rMU4rU0R7L%NC2H(F_0>3(i@gt6GFr=S$x1ZITr2@Q? zd3WR#`r`ZoNTi&e4PgMhDgnR;77i75VSV9!zR={Z{Dt@Nf;%-tstIK`eE6OxEXJyL z8&cgzw6L3~0`Z~+Vkj@W6ea0Lgokl&5!Zai;f~RI<#&?p9kEM3){^R?9xW9OR zv9*Z*-hTqat2uWuX1TWTV3$rPXfCWJy_w$p!n>bNKfHUBet5SVet7r1|KWc2U<>}M z)!+TS_TfRJwqSCi)=}nbkdKeiCDu=_cYjnwK2$@r8_DGzy}WIgPC0_Yw`VDlWv(ZEnP5R8Z{@&nm50;BjD0 zL}R0-t2cy+;tbXLbbR73tCkG^5srj|{n~f8>-fxd{~rQ7oSt7=05IeJzr0$^|JYfE zuXp$V+xWQLPo_k5lz!)gv+>mJy&d4b?xNv^JU;sIUG~AcqRwvOxYz`fl+16n{MyF* z+^^xc`tf4Wphq9g4F@^E!c`g{8Ih|gpnqzKt5un9&(4!H@Q+qLt!KqPYwR{R~$fEj_OnE&%=?2gz|TxNd;| zw10r&*%~1$S|fU|_ut@?&U)uNuPDF0&YlUQRK!Q@-rs(`cO&S8u{m({fAx=!$flJp zo@j-txeSv3plv2c(6!kDT6wkL>3KaLwIo&^RY0i%0+B1?F9cxI7tl2t#annQ3v(I~ zqGrRu_$g*(I2b|m>=D6PJEH|dN#^n-6jLK3R z5z1~&ZXIel!=QRb&VlpH6OPGUSFFs(XjJbswLAj`QRj}}?)vxpJ^Y_vzu$ukd}GGQ z;Q|Jv8US%m-|WKb(W?Am4P6#0vf$w!U#h6?zhMisYIvu*ch9*HLutAY!VU4>z4^Mq zf!`Cba9e;c-9Xx^y^m|tC&%Fq>KNaR@5y*HF|gG$l)kI4fN`}yVEXfWRg0Ajhj2lx z*PiV@-+Q$S7fVwSd06IYse>{WbSa7-%oiGyWpA%7+kg}i&ON;IMo1-8CAys6yXVww zH!6S&YfpvLiVFO2Hl}U|d$o`a>rDmW5cLKY1OerOd~QJcT%LtJ0qto(j#&_XxqZ0v zQvtvLUjQ$+qJCMxcEHoofE_Zm`f?%c#`au2t=~U**zoHu z+L1+3DU9-+YV!ljXWU0bWNjI%v-VC|wKVq#1?S#n)3F44n2IEDmLn~_S6a#cdAoNA zdsOXVyNgbH21&Jq{#JErUS5fg@j8z=I7)wtPEK#*EER_=^0FWl)+z^LeE0}ZP7a2t z_@eZH8g3-uulJ3rg=FR|FSpbpB~?k^NZJZ5iXy~0yInkT)Fm<#wH2)c-WKBXto&LO zvyZTnxf9*gC6Saa)GAsMm6EDWx+zRBK%AvTZ->36&l>M3yHYpz_oaHPf!p$rwes+x zEgpFd377gc#7R6B6n~;4L&Hpl3s`QUS22FeQj1PVY=h!x1A!WZXczq$_w5s$(%UyL zq=CF8-8A8=&TO%zCrO25vX&5=l-jkwZ`9xYedEK!hApt}H=re`-HeAQxpnZ6pP845XUD!_+I2u>)}tWc^lV}|vG1EPB7*rK222v?m68Mhx5 zRj+Ccu|r*;mv{X5gHh^Plm^FBQ1X>#Qe1NT0LPIqBT_XHVM#7ODeIIgj-1rVn&`-Q zYZD1)hKudcO&k@>z@exLUkqkYTPLAKWF_>1F@rED1kht#JRkAOHVA-nk#`m*bCJ)U zndx242Cmv)TUK@Vx&F^g`LEa>T}1{wBmV2^a%a65|8;$>b0`13jnDP+t|+nfPcaQ- zuWYCJTQt)wNV3FtH4ve877RX$mV99D(?ppe5Lgni@Dq^sj2a`Or!1%+?ZG9U0ayj9T|xw4W49O zJP&&D<%TZnFT<07$WhCGmf)n|3d0&Hj)wy5Bl*u>f6r$WW(9gY#{ep@bJHZt6wDJH z$reLqogvdjR-G6IhFr?K$>$N4buGCuyHby)A(VxPf&_gfJA2Bp>avK+cU=N#pn3;s z1_H&bY>}(PRkiSmILub7<=#<<^A$)Gq8LNlNA}kn3(2L;3E=en#%Za7}mQ9 z+X%JBF=i4bJD$cDr@EGxJ7(I_s5aHsqBAM(+#Hb7B5N#_-nBmvgSx+D)EIC zlWMtsT<;JHJFc6MBdF=Fi7bNHq&h~Z$T<{5)3(Jvmc&3jn2sy2bQ1DY%t7D>X91i4 zLxUSunzdzZZLRk&!G+kJ5rwqC%(>y2P6$PL#7Gdu@Jli|ZO^om51+~ydM%B5p_SIM zWzmuTWEGYalOp$Zw2bPbN_|XKs2r7LkftV9}Q<^Zk z*9@YMA$cm8%NUopx)A^4UzPt2vtyj@+0G0|d>F?OqUkKFG-pi;|B3mIQ%ZG=QexGT zcBjL6XEP>FmGmaSaoMOyq^RkeYl3V8CQ-l?h=Y)T4B07{>#$*2wT5j+qD{8}4((dr zG>G2Js-jR@vb|M}KJJmax5=4doBklkEPBi7Vz>M{e}Vl1=eq4;WOISGR}6ltxJLfK z(6#vk#+{+OftGxM60n7IH--cSQ!yblSpU!a@*9WM)uhmz;DyTEb^lbmCc~@D^@9(oum(SWD5= z3&>Q{UF?VL;&L09iuWcE!m#P{F{9jyFkd@RM2-~9-4q)*#)xG^vN<}$ASoQEk;=gS z?;>;*G%Dv&b>>>zLDbwA+!0VQ(YI*n9mAtVgxEo^$v&Te4BGKjr;tRaOl-s5RZ86s z2$6?r+*Hjq3fo3`aFiFF-xJ}ux$Pvw{2lBl9_g*@DczOxQb@ZXqrwi}Rz0QUN~ zRm+FdB58{2Uja{x4bTCj4@I>|fEZ^epv;RaQZMh(29BDWnF97oaLweNt(`1}f>%1* zY-2;)IuSn=$Cj+-v|5^KO~=0(+p$G^kQpH#EE zoLAUD>{xJ|q$M=?+D9FNh6HdJJMtK~-6p$%@z^woa2H7)>;Blqwu>&bOq{DxVtc*p zR&rEM`|KWDZFe#y-Liwt3d=ENa434_s;chrE4E7jvmRY-w{R1dnw*cD_65%x2e}ba z8oA4;XRV#e0sY&;?%OzaMEW|2C~mloprsX&0Z(9@CXJ=ys_yhQRcch`u!fwnJA=Suopu)DCyMji}D?_iQeX;7K8pk!`CL_xR+(~8otW;CnUbe@Jy;fYO~OSv=Q z3NLb3#)u$tP1mnqXtY00Z%;Oa)On`60Gj=gzLemp?B$y#<2dg$B|w@W?`QNw!lvt$ zw}5^{3oX)BXQACv&I;3yNzK{FD{{FLmIBnvA{a}ZpqpqIp}dC7#|WJRD!?#dgbD}U zY1;Vgwtp6U49BC&9<-)A7c;d|e`@<{*keZe9H~56N;RoYy%UaKO_l{hr!yK+ExR5Xm7 zsgNE!q)cBkMx^S`9+AVMm&P+n1`)7P=YEi3Cgjl|=(6z#2HP@*1Q?8=H&6%#Ff$B+ zaHz;Yb0l?}$CMaW$=M`QNg{aE91vC2v*bzg`0<4^O}y%MM=gr6%{*Cm^egi;Uuv}U z*x{ly`9yh?m5&JC-DN0EDpXk9N=B&=&7-v8RIsZmDpFRz>w?9Da{_@ZQhjaWq02j3 zQif1LM`|(Hw(3)rrN8#RjX4gyT^2tSo*ot9T%Zt&ixsg-aqGTQ;P~}Rp^iNQ{pO3U z*_8E}I2c{xrib&zWr!`Fl2mx*W3R-d+Zw+)c}j=JPi)@uYg;AWeQxVB!~Qo+1~(u7 zyS?5n#(!Av+{J&rmCyBF?JDCx1U+K9QTLei+3Ro^q#rS4+|`3W2!fgb;I|n1VU7sj zv!a6&9N;|$Y@89Z+b*0!aiZ@!%wkS&DCTyI0qh3RKf^lLm>zAMqiRnHK;D$*FA$0R zE++Ty<}-u-1HXM1q`j-10W;|T>T)Un1H8SX|F`l{iS^I`rXPHQKWKp`BJ-<+- z>Z$RH8yAd9eUT{CH9Lw}4ZmXWX$y1x#}QsPHxks{Y$W*oiQj6qq+){k=AyjbHfHn2 zKQr-3f=vdiB)~@31F<~H`TCuZeNe&TjpSHaU)ETlSy}!VCslh;let%x!9;jrTwm!l z^w1S4Q1+%WPBH95D}+o`kO*;HF-xjNjm!-8Jwe-OYsU;+WTZ+#R*=_l8Ls16ik2)g zG}gIecCk--mnk?+%oW4D07O8qFq1Sor2R#+#jwz@nLECkiV+oa$2!wyUM#9q;r33b zsKN?>Y%Cgffl?-5((_|GJwsuu+7Xyen)=*u#Sc+trP9Ra%Eh$reqk6vKM#2p3UQ@p zAeJcfMoNR|t)*O3Cq+wz3rk}um7sBA8Krvt zzl!u{rbqbn3_fyes4UXAO3V(NIZ@Ii?D8<+qn85Ipdc;_;T-Q}oB{fDJPcx^Fvaqg zPjl1_Ne7piK!BvGsd@MCg!iBL>ylvN-aU$D=r5ta`MrBoYzW25<=lc?@)S#|qOhQ< zs4m-CrJq!|S0grQI2__L3I@pk(m&A1fE_CfF;Cni5BJwv%l-QqaJX61A7HpM%Z{#G zwquno-bYFRK0eRGdBK~ZxbD~m?^6cvF~Fj|Y@mVRvyTB5_)LNL&rb!$#lpqXT>Rxz z1?W=wQU$K@ruUlu{cI^ymJK5`sP)Kpe#*QB{{5R5RVJvQdgY%Wvfi|ks> z%JC75Pr~|1l4J0*0bb^DdG+F^oHPjD1DL4*ZzCu}vS0f0WJ`%V?o~tAf`v zZG@lcc(H6-5W})MFAT1q)^Mj*oF&)zKw>r}#*d@uB;P$9t2`CLA8F`-M7}JF4jzVIm438cEeW(_85UOFr`(lGA)CprU6QT*w z1vrDRuyRgW7#2_Ai4Uw}wSg&X2*Nbo;2c)9_b7aruvsd6cy;yuV4R)SOV=TD8?r68 zWF{nLQubyS8&N|AldbAYDdZ7?B`H-81xZ87YDo7k+}MQQ#1tT_<0J;cr?h{@hE{MY zGv7_~AM=);l}wQEdNP!`VR5mz3D__rg`EGZK)R_EVbq&~`@h}9ZVq;36em)U z$)6M2{mH=YeAOxuIStx$bD8eTR{&6H@#;&65q6;%&DI`Xo6;qT)&e8qM8kmO| z-vhTsRCDYNS)`4UbXZOk`tBav$QLpnHKuN4ibm>YOQc7%bID5>z!s60)@e9SBOsYw zl5`~lbUUC>flyD0e-Wid32=r(8V$qSh?QZHYfDRjGc?38P7QuyFw`-P^4`>JbtZBw z-8sIPfV)m6Gdqvi^?*JAJ6a~P-OK#PXesr?fdqDnPi>s+v-2aF zRUz&GeL#Z0s7!$P048^KT+waFO)*{o=)NDrchOPS^qKGWar@`W=-|qJtm+m;$l4cK!?yh zTU~_%N076*07ZR$*OBNm^WFbv$bSZ-tBZeT#s6DhT`R`_TVH*2C;z#X&-KbgP@?nt znV*eEq#aWVpcjDGgCIT`1H!vfpFBwhAEUhGNPK|0^!%se^d!tk6!bFbMSW!Rfeu;X zAP&>Or6aOAhSMbF9vm?dBQZ&d+Ln~4?JqytSYF*&UA;jm(cxmLA2P#H1OftJ*l3BJ#xuem? z-zL!EtV}R7V(%%vmu?PqU*w=; z9d#0uonN$6<`N#TRZO(UQp`?iVzY7|ZFMiYo9i1Q+?g>Rx6yTxuI*zkjMm3oDb~sE z&W@rjT~eE<;B_x+=r&Fd6W{@?q1M?Oy&J?uuW0&Lrt_#%4E4cs7htHY8`CHZTy+r+QSiAZHYtPhte^_whl?hcEHkip4 zV_MNs&JO$b^>Q5NkqzP}{-YJsoei;%%-&j|oTo!occUO$;o$5>cT^2xPmGKBua4aa zbWYQ;wbqKiyy7qV2Z((@>Bgam^y=9u0bb_t5Q*eNA(r+J{w}5dg^m5o{~v1SU;e>s z_~!*M)%fSR|E~+RwIfl*DL3+>zao$K(Yp#Bx8d1qCIB+-Sb5h#A>xJ;E{eIc-=YZ< z7NEP`Kayh+|7JA5JuAjSRUt~0oB$O@uPHn;2YATQ2Bte1#hSu~piX8*pTY*IvWQLb znQBt`QfF|vZ_y|)kZKxcBRFY7xsz-k?Ck9!jSqvNIB@mCteZy1a={td5NN4ZqymZ# zq8Lsu!A=e-rhT&s@3WTg?;?!E;+H(bupQWnQ8&Pt6*PDr2`r-W4#y)r=%W2ii#z4o z!{D3(S6~xZ6xnaC`_o}nT@O%j)n8t%M8QE4pIjURS8oUdSMMzEZ5@}@sNY0MNQ_GN4l&9}I_p|ry<(k#d)E!o}tt=G} zmMCvBmio#js&Uw7n+O%if>1e9T)@-y;*Kj6n7VDIZoVB#ZYSsLD@4vYHsWPBB_6o1 zN?QBUY~4yYZ5kMD!m4TW<}q&=(~raQ@u!sEp?zFQE9SI<&8yBTIha`8S2j4{EzONb zsv*LOKq9_#bVi%(?VToiA@NR4nftuT;;f8)v0x+*1G*|%#{S>D>+jH z3?ngUIu)Hnxy6pSWl7hB*Jm0T^9ZK_VIfD3W==)gvWJY@yRfH6X@X{`6y*q)A?bF< zDS~61p`I8GJ5y_V1%lObSCxofO`}hZX+>5br-wVQ-H=70HC#LdFxs~-dbq3#^e~To zR2X9b0P8gsM=_GLbsUBmq81JDQ#4wziI*mM)-qxNK`V}g66Ds@Y0ZyAgj6Qf5TG#{ zggL>rbOKeA>CZ$n%rv@(Ip7^-5^8Z&&Pe8|U* zQuLaq%*KTc%D**7rlt+k(aJn$Y{AOR+bQPCNolr|ShuRdNq5&h!1DO)ql^aV-WVqi5K)On*FSA4`z+CI zjQgJQ{b4IPe_6RNz`N!U)+;!nTm`2ac&Dg;*Z#g^^5TvAwqQ3?6QyjP_JpCJ7AaFd zTl@!&v9x?u-fM_Zxh;Pg0ig#tjIyD)Nm4zXVxzEJVr&(Pz2g|IM2l!y1YmK+O(tCE zS;vTb_f7{~qvbg2^>td=+E2AsOD+kR=u+7x13e_oe7m{QZnRo8zK6&M%|H`^Lv81B z)hQAW*8gv}K7vgue*b-`qNxu=T|{EF7j6qEm#Xg8ZGrDS#{p0|^nyI0w)UVcZ6by7 zcjA0nGpa2v3E&-!hj?p1E~CECUmyt@u1f8tJIEny6BuN>^WBu@*~VbNF{oIM(Ic_j ze<|R@FD94Mk0Q6rI1BDVkrhOSF!25*nqskS?nad}1{~#gRDK zO`N(qQDuonRcq-nC;B#y`1t%tcmQB3vM~HuufgCui%PQ* zUBj;haT1>olQBB3xT6@11O*GiTDYy=UumuM?k{2;0!`D*u(4^-Z%Em|tj+&UVKY7Z zKsn+E3udV}YGK91`3)3T09Ritpm)?fYIgHMKQ06;V61OFcz1v4{`>bIFx5R_PN6LJ z%8$qdG#V%_Lm6#$87$sCzX+M103`3@9s2jb>EGA%@BLOgqc3mi-&gc+t%)s|Nzmfa zJn4l@9H}`jlQxc$;C#fh&^Lf`Q`U+f*xzX)jZNmTV%Xye5Z#gNL3pXq91|KykIa{d z{jJPZ{S*?} z*f8NI9S;&Ond%USHnF3_>W;XQ;{S>r**zgn$*+O)tH02&he0e|!(8FYL-~0EB%54S zh9Orlxy}}>iS+0>V+)LCeXXG+l|&9%kHfcbbt$v-KGJ|_ZS0DUSY6k*c2IZNt5gKR zUD^;B+$Of~4%z=tAUcjTLUqybCXPx~v1J6@fm_EgUxjJ(CQoAprqOe!;T*8@Orcjj z1tTx@%OV7)lLnvB#x_e~fIQhWw`duSQ{5v&I+4l(y9A32JjAa!*sUh5_?GCL|F!U7 zp(%uZ3()#s3mN>zU@2Q)5Gy>YI)#a%c(Hhjj>M|`t8xaThJA#25^Y`Y`H?I$onA0e zATOL%HIvwNeD1BVVH*Ef6>3l^fhl^DcJF8YeZms{}}_h>n)Ns4Bq>$9t+|ZW8}YvHvX$i%j-++M}DWhvAVv|>D+iE zh*_aNr-ca>5S2WMq$;P6FT@5#I=2YSFS;9Xi7kF$7$g-=UE+cIr2wI};rcHl^*)U8 zW>T;H!izLgi&V3VOO{QlK*6Xd6<5oz{QfwasCfSAp){fYCN;`#P41+QOOu*ov`xRp zB9$8$w>wy?EVbJUCjrn3+Is15tkT(CJl4C<)ju=N|2Mna&tC3cv5y(&|JwS>YVrK< zz@xkK{}w)EV9|pUsY`MYF)GQ}w1xEQ@P3GylgC-uAET{xKxQKzAJSQiZ8WI-gD88T zod3ce8-M#bx?7`XYgr0 z9b!%89^dlz@{B!mVXTzj4|7c`|LH1lHCR+6h{KL{5bUb$r!D@a+&0y>F@c- z`iDJEGfv)6GAIRt7KQx>$I^0M@w?d=?DXmDN~xc?!nUW}uE`agwn8o{;6e;%ETLs;@& z(qeF902a)9&nZB}ghY-Rvh`(eFb)cg2gfiP1gR(SZ+|+3MIg=uSA$DMVb)|wbpc(D z344U~!>L5Ehh|Hf;`jl&9bS%e^e9JRGS;pJ6jTXD(}#(r z7&A3j5rq*EB5^|yKhR2fJbJB)L9&W{Oba4a%J^tmFe}+1dAde`P0Ggm8QWo-6(Jx{ z+Hq1zQaCgy@HUPL^U{YVJP`vT%L1=@r>| z8V#^Ii%Eac3ivNLg?N_9FqGSS#hTb#K1_u&4ETDX?-%e0w*{{R4-TN5v2ogSK}?TP zlxbRGmJw=dQ%@Qu_X!P?1=)YY+2Ez)*!R49RWADEm0$4D_dGk|9fdN&vfOZ8;wfMh zg^i^pWZ^Ls0eo#>jwD)AWw>Rjyu_AGO_|(K7>9VCp6SnyRb_`BYKqC9N=K?{ggpGv_g?!5)PWHCC`A0 z;{2!@p%R&&@*U*=Plj`R^9v5B{%@F(k$p|A|DV@jS`s$b?SC9_LjEe3k|F1v0)s=B0A2_wfAS z40c$1VKH9tGdP+6`EU|2maH;AZqwt~JQ}sKrZ1M_FW>I`1fYXirhj03wqwxGz-K9{ zV)NQK?YuFEswDBvkT|jkL5I+$wMhYG`sk1ccmR+I;xHL!uns(aXJVMVP1e)X16wR^ zw3h!jgc$}h9LG(L1;(d~9Iu6_``;~px4Z!u{Q0~EM0R7P-TBTZ@(7#<9Y%y}S^y%0 zr}GhAow2$Ku}|V|Z$US*BGiz0`?q)L9JS z$mrqOo#iRTsFO_{enuNuYcmjA#sTao=up!42<|vEy%~5T5ccC~4=lp?Gpn^?z{jq? zf8hTWrto8u0MQ?JKQ=v*bG2^eYChxsr5nl2E+U zA=7om05DU;yb2*Xn#=kv$NatioXaneZ4;qzPfNV7vyA!mPaem=hqDmGdtRG zA$&~EQIfBJVO|UCMJ^x#u-Z4WENC!lbmjOR0n%_syGqjEJ*l9__vQ3tA=Cpna61|IB}|E&K~D z;2)}2`*IV&4+w!ML@b`xIq3HYWQ@8K)y zEX<=yCx@SJr59MEIx%=AsC07H^iQLcQ+$9KcFBAd+TwCezq7Uug|P&@*Rg+)cJ3CP6g}A~wIm1kMkj8~>s6u;av_Nk+;g`8u({ zAY2d!gYyg+##=(TYy{UV+M)_RvQ`Xy7d|Uh@LAPW#LU66%8(*!2Ek;Zl|e)0TG6g9 z45!N)$P0{Sn4Ng{(CiSu6|4@Wa1G53-vb9&bH-RO{opKAG=TeX{!{#Q7UM$0jT=G- zj#z@)Lb#sZEDGc%5~gKNCR%sTYX)&W;$XfND%S_w-gP5 zo|BmoK=bcQ_^--A$2Bkj>o^XxZZHb#_)HTqO6G*?b5Fvc-Mc3qcVe1E=1+N2$D;^q zLfhmCS!*z zj8@S`H6D)#gSu`*Ts%n*LE~Yp$-H|N`NgPDqC;E?;4Wm*J>l-jRNxhWOtDwZ5^XgL zq04V=DUJ=6eH?Q}CX{i}TM9bfaAK=Q6ws8&a z3M{@B-+0LmTQb)l~X_CXDU z!cPNQbb*D+g-bdKE%=q}jZGW4)3t{dJ?2C@e8*>dUd5}qz1zui%)nIOY`CR=ZE4rt zr}&v7|9!Eyv-|4cs>VP6XAb+{N5%YaYioD$zi;PbB(b#U{vhgxaTa=+}*l3DLHMls3AXasJ|r(qf%pQG+PChnn+v02cgiehp%+4}b!EeA4GzZ~bB zy~q!|E_B6uMpRlR{rn8A4oJtUIL96^V%@RP-mvLJ9naO;fz$vFnRM@XZ4=`M^@=!7 zvq+*h^HHy1~aZjb6!qLW#qRqvt*65rhHc=n{hBU3w_;>)A(L_BN zG<`hI(XtXB5*(YTi(5)Chwos(*^0DIRgI1nh?LtD0GbPksNb_wj(O+lnUHKEjiF06 zCFx;O3F`45k{p(z@=$~u2_DmnILtU(v;@cOu&$ODc)qBs%ttV=iCI;71$fV9HViN_ z2=W4JIw^KfLefaWMUx`0FwGY9|I@C2u>bt<=j}JU{@#KA`py1d_MYuN^K07&@EZ>1 zpZ5-b+JAfKLy0%ruMYp_??3mqU;WMh^WLjxO@H^Vuixw*9QgZhyuFvNU+nF|v%Ob4 zFWx@ed-bFL6zaX&KlEShz1%y5Mi2LW>`Uhclx`3Zh*Kizw=clfua_k8d0 z6}I_&|Bb)xzutaxxVQ86#r7Nj_1ibE_YZcV`)APXtG!px-#{%YC(`|+nk|EK*I&vxPA(_I+Z_R|-;+!ah}=f(Ek z%clQq`{nkJyHsl*T6yDPF&>@&^H00@2>aWH|L+{`?Z3il?Ciffd;>q5Fv~ZGy6Vq+ z2fIyw`_0|~4Ap!7W*?eIa6*lJY6R-N+T~Ud)V{MKPy~O!J=is4dA7U#0@^yj%68$~ z(N5ldZu&Fj{MWx**&x13AG6N?we{lp|7ZpN+@1fo@Oc?^(*zG)|1S}RLOjUfOiX}k z55{!VKBt%p&)L22FJdJ6U2A#y8}D_R;Gt8m{rcV0o$q&cpMJOa-P6_W#diDI^5S>T z+U>>Vr)r*BLBb#zpk(EuI%i#R~NtgZuQyX>h|vT z;`h%x%Zu%`?d7Mt+t0t-S=;_n`^LK`Js+^mNL_wDg9|izOn2c_!oDyVioAk4yK&F0 z_KjyAU2-zy#M9)z_C(s9?{>d?3KiRrpo!J*o+0?>ueqLSx@OYOmbXM1CA3 z$H4%~@fX#!TF{*&CNtSUB5(MkG*s`P(!FQl@fZd6^cNqz2?rr7kL4Q=!D+qJn~bL1 z8O+4)ZN4RM(O_EJU5wYe)7QiM*UwSB(z$RuPsh=q*IK@GD*^{+Jo4<)ZJ9BZTbc`- z=77;f+L;Wa`C6F|Mi*;qGK^;8<1SimWzjL3HJ;|J!-gzB~VKC6a^2u}0GsS;OM&v4U z4%bA|;IW-?5T8(bEA;U=flDJ=8su!z9EZ^0-m8N{xGo(X?C<<}_wWerPH%R%{#aL! z5BFd5v&ItRVzI)Dy{CoZ@T64u<=)HPX>H?q?G~QUE*0dN6!!@Jk*`B~cC^#53Y zx&7zehX2R^vZ3;v1QV#)M602}0A_r+?@V@M%YX0Pqm-g(Bn#hBj4fZy!@l{N4f(r= zP3cK+J1iDf1tp^v|0145RWksAdiH?#c$}6+UeN6(Ddz~F#1YAG7-E zYZJV?kMo&!{+mn9)%uum{y$n^jQu%gxJ_@&LB1qVI_z-Wne^E_8YPFZ~0S39> z;+wOn`QzKYXImGzH~%?2KZ8?>M!3?!Mrts+dyiiaf*dW!GW=zJ;t%PVD%6&!^paEj zv2$CM7My2RGuExBMvwQ&De0N=vfQcx73DV+D1I3BP?1sf-syrtC~fYjbW#Uljt^-_ z_Z}Z6$$-AeSpKrJ^I|6%j)1_X_>L>z+aKl8F#0DoyH#73r*LT@eLyhSW8O{;DGDDwPS zkKos{{htpukKP`D;RQvA$3E$4qMr04asA7OZv3-cJLKT^1?`m>g7q zg&#!6QuId&s#~0&GkGzYe-;3U;C5a)tWi%jc`!acIM4EMXa=-5#Ff`;R;X%5bBHR% z{3Ux#1JRlSvX^_$Ud({%Yq-1<^mji2fMyj=!;6$f*w0h+O~{7c&NiN0{O9oaAWT0+ zT|nmK^SP`}GOOBOU%tS_nYTFf@(kF6H z^~XyNot#dc9r@62l|J7NC4MyzCHChc#YLLhxdcsJy*`?{{9B@_?Hi)06;x8r_3%yD z4^!aPuwnIXH%7~^o&A?^HGG~7n2Wn3uXp7266Ce;hjA>kCtJWQjHoKeM&!0DYVSh8}4K^eA?{xH!&Ep{746-5q_nGUwjWLGJ9tK9n zI2lm;*VX4ck5(Q%Z!hjV+Fn~+U3s*=xV^l-zS!Ab={$p*!PcTea5vBE_|Sw7RPL64sy56gEU#s-hNsg-K6<5fjfU7@Yzt*fBEKd6mO;{+2%>q-~7ku1pW)@pUpJPCNJjtqi5Ue z+fUaQpMST!ytvw3Mm_AK?Zxj_o<41N+S}XDmfMqt&8tyZ*VcRZKM*%QG?9iAsWUBv zjL8~xAB%p7ADbVKmnts5Pkw6(oeO@Z$bVk#{(L=s%#i=ISJq1QpY7E<`;S}s{CpbZ z3z`2aJS#-*34Gv67W>iXrSYhT&O51SVL8~w1OF{O?rr#Sa^|a`D294&s&c?}q{$~N zNJ;=fP8&F z=!TMHGLUv_JDh=T5e?io?9gLNpBK;0&K7YLi{o^_kwtqo6XYB}^`D~w9I8YA5Y9bd z9jk^^oT-^)_$eAlC>M^UC9P5{^C*VFq{%2HZ>cuWKb7g+m(*qe5GNRz>HK;0xzzI+ zB{-FI&pxn&97shH$8pdnPdSQkOcvoDy`pMpWD8_VzWOh**LW)MKZ2^j@bp2TiG zIG2v1*jIY90+?F<@0(2D*k=m;zn0ja_?bcfmphM&@jusA*Y4tf-pWVOd^gA!A;6>n zMn6aKUtc$M=pr(4=cq<4-+#@bIP6^SC(IPuAIB0Ii5(E`ERe6`GiCovfY+rf_rXfOwTb&5KIQno zYyZbzyN3DA{QNK9|8uN=x7RzqQVg(J_FwDEkBau+>#KM6U$^p^Ghh?4l@%eG@G(YT z65nx2Tp(X1NrC#+`CweLDR^nUX5#-U9P=LoCk`Y&J%8dq?nPO5G3sH6RpywVd{EhI zvR3#xqNop+zpX?_q)Z9#Ryad~#8*XcH0VM8BjW z-OqmL4traO_YW}?@WcBV{Qpm<;b4$#X$BCVnjdf+{E32CZ>`sy2yJet9_phhyRaz~ zpecL5>2pjF2}?oyhVP+SQ-v3zyDPcMrvoM`Dk?^2*+OZ9s0uE8SKKP?Tp>#w;Kjx` zraxRwZkfh|U6(@akD8wl|3^WTW)fz?+6B}}(xONi^{DADZ1@X+!0_dLywIpzTJn*% z`e*m}uSWmpIRAUWIja4-gE+q&8!$`$w_42q)MBUf(1}gm;bRJE43Ar_R*jl-A~kVf6fzc2?^I;2m4?UR%Q#jIzlAfrro058 zIha1a&2_SSq>T;D<}rNB?i*bG;<7K>rbQuAlhZ_{fxhnZrOYx0jYXey6jsy1D@j<84!Z z>(X4L{Z^*c0_}fvTckh8fHBVtQ61&s6lz{LCM285%+rFune)Pmr+1Gst!yFRj294~ z-uHxj(+j+DQUSQENU$lFfZuZljh8_vjzQ6w`s!JTbqn}2xa@@Q) zKR@3Yf$z#^gj+^&{%i0i8a36p@$HG#g07~@=(FbMAj(PA&*4~6=}3o4G@>JAW7Y{H zH-$pqZWLTRbj*FhyC>&EZ5OZ$`{t04T!O&|P^}&X2IN$yQJ&Nby<@CQTdKtUM5Bfg z34O)GXb$?1dRw#@y)pW~`lw9**YD#0-OA^B2_uG1-!b&RoC~}+9*#trAltFWsoF45 zcgzIs$_Ipvu$E}(w|qf(P&ybe{grbz+^aqq?%m+2kd@AaW7NJlq(6dhK*!+nF@d#xi2cD+$Hi5NheAgP!2IoJkn;XgwHyZX@{!bx?N+i?3eBAGEpeD2F zX+NI~*quXzMq!500iQl+A* zmFCBAC{#F$dim)V{mUg8GH#u$P^mkBqhhP@@E^%>@ewXY@fl$eo^>wh_&uVhF{xl( z{6qs7xzofla0*}5AogmAKtfqXw6zT}rFc|^a6VzPAJ#^fn z{I`k^GDa@VaBDDXkwg$mSvDw1E6aOuAKhTRPoD5(>!kV*8%?9DckXG@AdTXJEn4b- zohAX8)LhctqbV&ivrI8t)*q%(YF87{(**6p6%y+ii+%L#B59wNI(L&rN;i z;Qy}d2QZ8O>y-JwcIPhs&#ipO{=cW99^l0c1M_1Xe&C1X@-6pw@g?%?OzEd|%J=B9 zh2&lmzlJJ>ynPk-tq)McOeKKznV51q6S@eN5@u8RyoX`^6R8NCsogfkuQ!z`gTOJy z^tar@fRI_vUK#lrU^;7};=XuF*@@u&H{%#O_q=-xL@%ulfl0tFeR^R!Uhq6%l6z5~ zyrN-t7)?J0_MzpYryb_%rfxY~bWAmAz-Q55;2n!)SlGi9?c5!{RlpooK!$+>uath( zN*&%!l7W`K;4Gm%Y}xURqRa!>tH)UtjKkOq)Wf|N2KiZl39+>_zlls)Na@5mApm95 z9&*e8m@WE_P(FEVNDdk|1$R@jG>b)|UX@lo|ycyxNUp!3la zcYx63Nl7MlZC_jl-OjUTPfM`lmN1bVrn`fA2g=3JD&F#6QNpZXFgW*Mvi1=I#0diP}R6H_9Ra_}&CKWe1 z?n7YxX{#37T9Of>-6fKl@SIXHQl<_sfvGBVr`alh${_R4!ofgBo=5R{ly*zYj=9d# zE^M!lp?{nvL9dI+$IPJA?vVwTk)W?8+(d#X&+rW}NkJSY<7`0ak)I`=6jVv%Dfe|a zh|#)Ti@R`V>_RDtj~eBk$d@u+99l(HizY~eG2`Sot3DEva{+{E9vvbDFLCz~mnq~g z9AI(~eTm2X_StE2mia2PJ!RSrOOuBC9Omk?NFt)4M`&n4mnb2t>PPSoEW;47tUP-! zV5)l-#6Y#5X=!3qQpb+{7r4ZjJRmnDRg2Pc!6?0()(Kn7phEE7- z&ruS6Q&Q3VK{*N&BTOn9zm7vXXX`Jz6(pm^26i&At;N0(rOklGH6Te*jlL^2&Ntdb ztSbg$q(VZUAEDf|YwyCZ_nC+Oo0I->eaxW$Yb&d3Mf$(Ga;N{fmCv;jJtV>h z%xkI>K=?^b@n>3rwdU3GTWHBj{?*^Q6__ab+d|jdTFsBYI`XtbPut(MFK8InE|L7U ze%En)V(AGBrFk*hv()_UMnj5rW)F(D%o>UbfSoYGP3vpQdO zQ%LP@yf$hFa@RXf#&M7QI1w}SwIwe|8A$G4aRurnVTS#8jil%dZ+Msi5hqC3EV#eJ zg=LW76`8D0BD~6<26$bg>tn!56@0}vD7-hu;Ta8t+zzum9d|LXh4C+j_wd?r2u|@n zM>&=p4Nw+ZN+FeUH_V4&9&i$1_|f!#Jvu^N-DjP9nRFB}E)qP_3LGlS`Wx4OQRV%n zA-tm!AIc88bfYE>5;r}uJszvm*p{t(f_iQRJ7G3_Z(4rKL(Ek<#~c`33JPxT#mRE1 z%K4RsjrzS}AxYDmjP$g4oaKp0hgkIAN>5hVuiZD4#-3@El?9=jcl4Ivnv6jZ5<9hiK`{Sy19G_g=rWtKr-;v1tV0)!=OIusMqJXF-b)Qva zk~hFnhD%z9i)Jz&rdb6@T`RWAq?D?0Z)$`|?-9eHS>$!7(gFDcgI?2+eO8$nm^i*EldUb3I=hF}7|)AHjxi0|%>vF-fCfVRb|IvJ@{pMV zs(Z9YV3Q;izu4L(Y7`~Ub-Q(`^>10N$#hD6xPtM((RZwgwTg6!x-LE>TWM=$Unz+& z5sh=nNrZ^>hd=xQyJMfAd-tlS+}Ad){vCX#-T&$%Uqp511!+xnQo4x4%6IrTmo`QQcDckc%9Qyox4~U*gX>Ej(^{HE+N~1*ndxILMaDOM-;|<; zuQ9XCHB#ss$}Dr^6#93agyxP^-;wIOG&D%J1A*7Yv(6lk(eU(Q^{zSbP52pQoENVL zd;BuBl8e{Ta*m5vO-5|Qcj1aG;k$UfygRx?B^DQ7yyCcbiQdi%z~s_p_Ntn}k~%io zn8Ej$Gt00pVUG_>eQ?Y0%Y5HmE~dL&Om`pinI`{DyH}6>kDrUj|6f~KU%rd~e;c0} z>u*?*EA%l#{=c$XA^%^yv;Vr4&(edf>-s!+?>+DpukWY8fslnStH^^a^H1Sa3DWNA zIl2c#qw#<(bRJliU^$%gAEVrR08brjFN27#vDfm_@*{tFbz^mTW6d@8dVh^GTk^gY z*@^#HT%}K+IM3h|!bj#=O^^7r=6Tl*=H1WiW~WVKvTL62(t~R=l%oOfpb~y zqcGkD=)xox??a5#-^-xjOaA7cohDgGAqg@}Ad%)={OE|>q{K3fo#h6k3@2DBd$86u z!xI5z018u}88|@25d3kL``uI6^AG4fM+$&KFOJgi#D9P&s$fq~p&?_!hApUCjZJ^) zfj`WB=o?GJ4{=OVCT>)RJckCD*iQhc%HzOBsdumFF$xYbso7zNEm$Vy812X=C zh89;!bFZAao;c1i7!33}kdvH^wWHcQ32+SX8)B>Z(t8jzXB-YtJX(Cihgqmo|@woqPrSoA^1qiAC z0gIm4Rub_590lQCt4B_mTA<4sbWE*gg@Sh$OX zlyHy-Gz8^MeH^0OgX5n`sMkbi33a?fOOitg&+@Yv36o< z0AI*$WbTS({@o!XUw$h{Mcd>nB9(P0Uvl>wfWP45VeCTOB?Vvp_vsJk)&HDcp^q8< z|Em@8|5n!4?({#m@%c9D$Gx!cZ@>NP-iy8MH%C8t-}cZ9G_)W6Hnl{49fPf@Aj5-m zk{+^QWscG;4v%H3vCbiDkalU?dLbeLlGCGb6n-ULwCL?IBMT*s1QQ6NT^E|7!)8kL zKoQby=?Q}lGPxyc8=tE%(nwwV++HTp6?xDYLg!P|6Xl7LQ3hz)3QcU#jC@~tp&M-j zRFF48ucsd=QHXwtUclHe4=+(?LZ(_p%1P0A<5{N#I?}S3g{z)O%lhE4fCF{iemHQn zJYyl`2q-wr5yg-X92_tLcSN4SAUWe1BrzIdqM!X^2HlfiA5+;UUt0c4#sFvtmq75` zf%!iYeT*%FtsNtDc6@{n2d5WAlMO3R8;phhm3CS~zr8P3V1;YI#eBaUjD; zBI(%+*D3(oAie?^4pk{+@GVRKF;v2FNZ|yr$*xZ(;%b3i2W!W^k~0_LHATt z2PSYRj!T14v;|xTT2iVI+ExZ(5es|45}eiz4dVD92#=~hvFbQZuwKR)TegPsasQ0TiR!g8hTo@AIPXt8$Cl$x_O<7 zzhYxom5`Piyz~We^BToV)ooo)7Ex+zUQT%a=B{vC+q{f8b#orA&nDn6W=ZIyCd@D& zs1f_xT+)B;X9oYT49c(6$8`R`v$D3bQsn=am+#^~-pc2?Ir}|~9%M zJnoT;R-we_Gx}24M~7+W(bqEhntqs?r!w4|u=m>INY_>(9ty;bOx|@{eq|Uqt4q{7 z4ZEMx;H*A6;;H$hgU+IVhDSNY@C|!%-aqB{4~~I~7aG9eAcYoYRS5=z3)J9pc&rsF z*@qbk_4U{vbdzzMn`Y>Qly)dKOXZ9Um9TFNe^Q2!-LcazwO~d8wXr=9Ek7a(%M3gx zMNv-^GHOz{^Ot+C^tBwm*FQJ?^M+rqe{T4X{W^U8!T;=Uz%w~PO~viMnu^}Yn3ba7+Hb)|(Vp*)iC5>}gmhP?jZVgeEi*cb5`Ms>BGe z-U#qn)wCD2+B{ayy7gHU(}K5a;uHT z>%Gzl#uxj{DXuKgU#6_u*kOXP(*PyFv?Xxu|HuOYB5oc z%|^e|QLAlNz&P+zim#F`)@W(DeNxUBx~k()9@4{yb`9)+$~!%AX?XOos`YlM^|ssK z6ZM?t?>3E(N=AM+zaYnp3~wR6h%wR6PC1`WI0#1ML@`cDFg^;|I~c{+l&c7t3!y@67hSNspMH8- z&v;|Po`f+9cU`an(3>19CZn6Ac{=*$t&u&|<9w9Qp;panBZT(7@wh|;%VclFn_tl* zi|7IUs?}V=2Y3}}=2_;>stJx00N3^KbDokCs~>&#m9Imcb49VvGl{zZn>e7DqEPTt zl#DS3b&Bl*vSi~yo;55ad_fQ-78-{2r(=7jL9eHV{HNn4wZgYeGh$g5QW1`V9K{Nm zO-24tJnK7-MT`S111RTks680eto@3uj+A%Ag9ZOjfAU8d!5n`M78GsNq5>k0dRqA5 zkf2jq37l3?dY~Ke-By$h9g$QV?lO;9nY1hD2xRPO0PIf4h6a`r=!el59-pI&R~>Hf zWr|B5;N6lEaEE*Sl4k@KpSTvDijxT zrkX)~PPob0+VFgY4vs@W-jE7Nwm5rsm_?9uj0ufH$?@R3$*u;_$uRvp$FpTEzGUVr zxbM6mvdcT6?jXiBonJ)em0eiH@m6vEq#-$=QKi)>C*AC^-<@ukJ#z4L!(d;SVG%Z< z#(6Zvh|f9vz921bMZvsjc#c;HGc4|Hyir7 zbz;*9k?_*xS5siR^H8lObpmG>4xs64h7CX5;lnL!aBSHAK<=wlz!KZhEtB z8}g6{2v;ZY0yl-RSJcf+;SSu+ZcR#SobTW#gt&wqg2Z z%#P5zHJqENo12bgf=-i>r-UvpI$aWZt_LB$IQ%n@f9J*i!S1t$LI-EE#1GyQCE~Ps zoNijo=mLM|jsM~~CDBFmzJFi}VS4`JIU6;?dsI3?8E6U3+&B{u4%k@Y*=b|h7B0%V zLE1x|9-7!04*zB`Z?+=&im2xv$98Io!Z2A^BUHP(Iy&pzPgY~g*pU=I&J zd^?LyV!VA}6ovQcLT2BW6oM97N*5aHI+EjT)CQm;);MLX4xG9s>)|XZxxoVL(BY-O}r~XE1taIa>XFye+ zb2qhD51`{r+e;U@2HH&4O$F17%Pl73=W4s5O>G*)8D-@h1m`!k^Dbf*QK_eL&rR$0 zL;+>@kquH%gXX}-BSP}@B4r*EGh;e7+>EL1IA9vn_4yK{Wa77Yh|?* z|8f1%qepl4pSST*hGMvtA2Gx1?h+EMqwETP zfKq!Bk4EvQWbla`fRODNB7x5+vc2C0Zi>BrfJ)=7%g+YMnd^k5Q;TMD3Y%fNv!NVn zOOjI!IOnd)d##+CnkbOXLf`^`$>xUi^u@7ckCPo{zPi}8d<8k+_<&J=px^k%VK*3O zp(XT>6Um7REu97D$Yl%zas{HWD~3nHF>$j*)XtLephwqEXp}UwmSc@T0f!U~Xkw_R z6P9alY2Ocy;eHiJhE+nP9wnknTBnwOjXE=i6b@cRe<2=EJNBp;)~5!tt%(N0>}}KT zd~E|^>j_TTwiwp)A>&}h5RfGXvJ}JsS|Ukx#IZ=ys)4GNG#OZSdQc0^fN>M^LqC_3 z|45G7UNT13McL};xMNG`b(SW1j+t}W{|W}vPd3<%kW#`&=>8#Ww2}^@W17}rZBjct z0e*uE&A&AtC=Cb~QHrkz4eagvy);6!8>2LX)j}HiO#_DC*mN7HK&pyH?#UeJ&~B1C zWK*@k4sC$V%so(g`G9WBIF|&$o8We#eS&QfH$}H7wOk)m06r`V!|=0_A_+1ERr!lv zrA@tj>WTkgq~A@q7Tvs@S>@)1ZIsG2=1}jKE6rncST(o{)~eLRIPOJ!z}llJrCnrGae`n`R>p zvuZ2Y*80+NXQ{L7ciJ26&c^B^;K9>0JP8KEtvMdeCdT&EP~1~}wai0nM97iZ@-8@| z$lbico0S8`SdtVwT%-M*?LuLA-P5$rF0>1+g@W<3Hajtqf0T$CO-9QWla@6aw~5^> z`W2CED?^T|my-Ls_^LV<5{ooUDe|Nzqt=IQOK3A~zF(YKyK|ToCbeR`U)<%&{*#x> z1iD=FCZz$m~h4S_Qt$gRM7*hwjMj zn5fQ(D}tp8cD{JK{bKJaW-48sQ?i_y^Q_O=LaB9<#V@iWB2521)XfZeL1P5EuBDntQb4=n`M6|(v0Old#)vSJRF;J#6&(VEUi6w#ZY zPzQ?l5Tl-R+2>`tG7}&o~XGcO)}SqV*FFC2D1bTfv!H%TKj@ z3&J*B;MDrs7m>TqSNUA>{(m8b;EenK^4iLJ>HfdAdUyZ7jn56<|CcHS0IaL|ZvOi} z>nC^iU%uWxJo@Q|*=zlo!e?)4Esc0Tg)uT{);N@;`FB86FS-Ar?EHPq$p5#xvi_*J z{~xvQ;=kU?XK~S6T(tK;{kkUkAGEdI?ItPdzEqXVRYG+z)~oq&nbq^{S`*%xFyoyGQ>GbbNyR|m&0x|iYlwh* z79cKEoSLsGWEtuNLQ3LtmZTpgxgt>XxEG{7xe-QTW}%3>?QRvXzl<>M!&Wam9-ly2 z`dfU-IIQ=Zz8r#Zu zwIg2aZ$I08R)WG@o3S-YLo7b$rqso^N)5Q1^vy1gs$9%dqe5{WhYCl}E9m`V^{RHiRcl%Y2bAK*WZNiG@{Zd0;N4^5 z>(`NH*0E3ny$foL5;a9Sfm*0Z-Ov0XIbwt`3tfzd1ievE0Gbhw+NUOASnvM6`QagK z$zI~!yVuo&?&64Rt(J2biAWm?3LFU8T6lUv4SWtu*5`oH_wL>6Z;%U-U&lB1#D=vC z-+_nq_#b(QVp>=Rt%C6IrCOYl=$M2tk--bWu=4WIi}Xk#MO{YkK$ZpCm5_yz){cXo zNhS7e8<~y&CzN3UW3kXiRrz(AXaMZr&l)v8>bUVnu}g)J+%4fcRH*&G0(LG~%gKcr z8epo4cZ@7HxR4i8KwSE?&!U98P!QkmP1CHE;W6{%~GcQ6Sj<6{4{~yU7(Cg zh+2R5_tu98jn?8Hk&xbR%W{keJ! zP5gTcW6VT(?fPh$Y*M9>`+vL=P=O91ml;g6BBz&9!iQfAXK&LwarF0{rnAaT|BJ&! zzBwqjtxq{p;lk*UleE03RIzGeq7X((5#gKFl0$SbA{$qoaCB=}RUF-9zppwc>vg&; zTWt~#W>_mJS+};L*@gxmtSwbse0#Yyb0upI%dJ)#&8vZh9|+9UPuvs=e07RRr=X89 zo`jg<6J6@)$CkP_)uHbyvaKH966Ho(A$O8@()9YG`pHiB+G z4h9&himrAo_yYClFFg2FjT5$_R7gYI;?%XZqyVIp)6yVlD*A=DGIrg#>6+@7E0tkh z(QuxQL-znFEwAE+iKH{ps<^lD9kUK(r(eX;eq(FP;ARbXPT+GKFHSPUlpS~@op7Sx zXtipMnj!SKf&1{RRa1|Wk3eRD^vhWTm;|T6LcO)vxZhepHM)0??Y@$aHYFejLQXMA zqdl`uaNyXsK3t#hhXQZyr5!d*zplRg|Ixd(X6$uHQr+7R)Y#SWSRWmcj&Xw#% z$-M%(P!uu?Lv$}!OW~3axdW?0b>2f7s1%|_hzLK|%jVMK3KCN2zs}3=k`Y``cNtN3 ziQI-I#k58xt3ZVWoKk@nBCDv?q|ypl_`Rhv9+9ZUzR4ljhHgftBDIy*h8nb5Ej@TL z=&2-rOewP}e4t9!{y6&45HAbyvLab@B($(M%H}My2x7%%j};No-L{TiZNJ<#gO%S~ zsy%u5QYzCABcx@nQ3I<+Y$NfEHMJxnx%TTFGEC9OcHcg+0k`C|?)!Brr5LBLt#2=X-y7eWTspSZ&{iJEw6qxOfg2nZa%6fN9-a5}1=gat!<+_628f(f_bq5Y0E! z^C{(|rLcE2r4Sr#6jpaikzR5Hhs|kK9~PS) z$C=KTrj(GuQxO+3stBe@ZYpgS{`lg3*}VP`C5P#`-v?ejNpC2e2x)-M(qL4Xprq1J zw;V*YeKo^+%iyz9wzqFP-XN2)rkG$nPgKG>YNX0{Lyr?5h@~X4e|2r6sf%Oe00||G z|1Z4G#7f&u1Ws@*hJ6(y<8r?6WhcOFRfyFhASUe%WuiYJzl>jKX3Cbf@W4#bj;Ze$ zkRz0}QLEaM_`(cyis`Fb)>}#w@tQaE&2BFQ?>L^gzYGK&tMsXH^ozmsr+R@+ialJh z$$weUm7BA)m|~o6H?i5xw-*bM}J2=(kzt^78GA!#BH!xG6CV+OiEkY(wDx zLi@S-9m|(U;)P%5ww!jB7Jy^pzk%m1?EuUPb#uwD_-LM-{K__~#Od>i%Es@@jRMK~ zy#!kNjeh34|J`W(r_TENTIv3`(z(0;-Nr}RSMUCHXZQ7?6#_~>xc-EI>S`#lY^tt? z7&9A~5FCF!X~_kcK4S4e*l7 zVm6(39YZnY9Cs-|*)5u;QDTo^NHOQ6mu}Ld_*I9eVTJ?IH@p*6?!okF0#Tm>vgScX z@zHfJ)M;jCKt~~1FAO-@LSSEmvQvuiWLfkCs94D)>WwH&A4qn9GgQ7r#8~%CCJB!5 zld2$zGU;KMWvCsg!*{CPz?me2L2`zJgsxg}u=riHSHoyJ<8C+1I1(0Rgpw2mJPz(Y z%2=Kl4VoA?3f}Uvi|0}=!7LR+3J7LquP2`PahRF8ONcKWVycE$J^fZ9eQ61<_`;UP z#B=ASSZiCOKvBLs}@Ng@KN6Je||n)*JD{4B~s!X5@*MloDvHuRJOCP@e|oXtov zqsGNlYLehtKc;0q4o`zm&{X&tSXV%sLG&>c+|~t6HyK7%B-Mo5R4)lL1S|%JIN6w%cYD44s2Kloef=)~_pN-cjkm`SYQvtJV^SygAzQ~FJ{hCsJ=;FI$9;=j zMaKDQl5Y6VXve(*Qg)1woeeAaNc(klRa`|@mfEZS^7k9ds~hb#XTx6a?5?>vnA@|k zJHYtXqI09@lS2ZX;&!@hy?&kjvewaJ&jLgM^qh3=6F=A|@Y~A&HQM{`HV(qS9 z57{tFYV&H_wdsj2Fir>Mw=H<8OXQ=90{KY4ALMbnV;7+Z@LF60Rh2%~x&Ebm&CxsA zaS)ii>t3}*oqY*;S7tRbm4_>5Mu7%^mhhQB9^nxgSh*s+!@ZZg`)>~cM(fMi95DI; z24K)z6+i!_;OG4}=pInh zegBvKhJI(Y8(7vCzyS^LT0n$t`}N+9Y(}y_Aj2MGW$^14|BGj=2#6oR)xpr?dgf;{SAk3*41lRy4GYa9dHsiyn}*p zFAg!(>}YUaS_NzeZ)m^PIxVznUs-8?X(;h9RzzDPc*sU5N_0DUEI8(x89MC|p*dDG znCdaqX$(>ffn-Z)XD)dqdKQNEsdiz&ID^toOsGRf8d|^Kd)T=DZ04VuRXu>)7Lbaj z-vcomTm>a~b}0Y?hv`!xOAqkl(j{?m~OTGa>{wZ4|tdSv;a zl2KE=cE8tB|Az%NgKik_f1-k0(A9&^+PeP`I>GdWUvR(Vz+) zrth(t6s?YxXg8LjqIwi7tZ3v8UDd2Y7@*Q3jjK2C2QDfaU)77Kucud}M#s3|*u}C{ zWnz~C!D&5l+37S|!B(()AnulEZ&&9t5|-E50LY`#D<4>rL1PKt+X$W-cTRFtt`|`& zYu@iQ39o2wr%h}{Io8ygwV7KPx<;f-Pb$fA<=&l(kWd6?{3ow!mr(>Ip$7VBG8@9F ztT+NJ!&0l7KGL0}nm)H8PU4uFM~t8;|6YLP@-M#3R5bvlDD4!Q#S;67XPKSAEC#Mm zpG3~~lirY>#NY1esFxo4P;FD{6%6;RZAyu>SOe0l%&$2kd*0FyEQe?0QO9wZb%Rk@ zcQAsgkUJ;<4Rb=*{{C+1{reAWpQw)@(~EX)v3o}8nTx(MP(3R38+*Zc;x#p2eCnW73 z8eMGuuL@nVDED6aceLteLa-(+&Zko z0fL1_*d*~fkZoHv&K2I}qYn&G=BH*5D-C4(xPuuMrsZNiu7Wi%_*Jjb!McbS$wkZx zQEM6sp%Kh%_Q61sG->1~$*_y~)-s{ZfUF^{eN!+&uZY>hHZ#MUfzZ5R&}>U0n+(Ic?3Fjg>!(D@W!iJ*|G>aQ+TX5UZq4z7UH;Qr4EJ{3` z5mB-KF+(zTvI*SX0 zVgNWSIF$+PtSw)J1!V6b_-9u4SVkQ2W(;8YLIXHS!%#^sE|06%vaWND_m^>0EgQ0d zg@tO@%&gnErpO+lo0+1GlX_MaH`A&cY2}?0M=RZm&)0RzG2yiODLOg5QCX>xg~D9Z zsE4j{3M`~7aPPZgKs+SHWXuA~ zJkFTe8p{YU_qB(1!KD#1ZPnpF899DK?|(HR^Tv|m;=|Tyf(eUi!zjy8tcpMJ+FUD2 zY)MXR)u69@7pAYa(75mH*uIGHsF=v{sInu>L%&;mN`BUafPE%B`l&&`zAfHz*pxos zSIu<$_Gaum8>GaQa7#)NfzqIR5}l{ERBL+oGT4>m-_M$ZFQr9bj2JtTb60R~@Mhdp zJvB-T1Lu--C4IpHouz2YBF`5vzLl?w!S~uit)iKE7I#D%g4*8^#9Q@NmckY0JcZ{=ygnF7=VMc;~wp6}v-HPhe>_h4u6X0o3Df?V~FT;ZNP%xz{QVosx zj-Nbl3x&3-BfGvsEA&Vd(P)&Z1}1bxt75K>-)yR3-dGEV4=+YFtQz!{sRn(WO*N<( zQw^?Mq#E?JL^br&2~?x6FB@i(4y{nSAop-9A``;T+3y0v36$X1FB;A*xu6PG!4Hnd zrp}(i(x^qnBB*=o26jK%L7r5jgw+Fm z6~!a9G!rGL7^4JNc2I&DDfiyvjF5g6Za}Eop+ZW?6+7(^H)aYnY^0ijGqCAS!f7G9;N$SnF!WU+2C0!O#qR24{fi+iVUEfg!GP{6n zNRG1@FNZE?5oa+9vz!dDwtw7xb!d*oqrdFFIoR8Obprs!ex>%9JUp=yi^!z&;8KDx)HecTG9+S1=R z_AR~>ofJC^U>n>dHO9gJut&`ZYbFHW*~|v%aqyv~c~HFp5hSrKK=T;L??-ALHE$fq z6-%=ciJt$P;hqh?zTu)MnN z_R}cOwKfa}sF@GZ8D#|fFjVucIdU2a_a|dOhlNz4wH4+Uho5-`{5sELNMZ1gF%8!M z(9FsTrB|nVdFEXr>723JM->nEBu*i^3@=U<6z^xXlGI8q0{?}(x5g@a{F6t1k_Se*=a#p^y498FCAu7;=EV)t|$e++xI4~{CiOr!)36*iq3s+c>VXE&ogqX|>! zHOrTceH|4{6Q`gr0myHY``86Hd10x)4Mf;SJ-VH5`x_s(IttRf z2yh%iqf{5~@YEfvFPs%BO&32ZB)RU*DS?Dw!t?-00IMchGoZl$kkB+^lOuI5x)e%% zmTAPy9sfJp=%|!xT8mn_Q7lBUyCUU5ZTWrrKF0rQ zWxR2AY|)7CuT)7hB?A<6VMh&j45c2aIXH=ASa>#Z_Y>Fdda1wTkAN5LukMf_I;N64 zf{9Bk_ewH;p$msF^OgfBaKdaG!xtD^ee7ywq)D_Z(I)T>N4<19!Dj&*>Xtngq(K#5 z28je4%$?5iN;oZhC6Hxau5W7MnxpP6Vv}{s6Paw%stPEh3BDV9v)qFczc@k;Et6>Hc+96Vi$|nus-}>Nql5eaU*2v^5gDd&1%ijMk^(H zm$#PmF~i3Iiz+HyasMI}APs|Mz8n&=sN_`@ZKfG(MzoxilCT-%KST1& z>3s@f8bKHf3lg$L=_zb=Ex$WP!GHnzkPSTCV@X|56?^{8inL zVK`bua#E`{T$pSeWLpgm$y9__q@itv<}hPp%Sze+t_2erTo#R2x`tV)GIW`I>*e-< z%cK2rzxUvN3;yxz_j~xiM!|kWcj|JR*bPk%+nQ^3YP(doUgT^TdUG{gKwo2^#Rw^8 zo%qKfE^5!>F)ZNRSSu_&;Z2G6o`_#XeV#6;tVS2Zm}71LE+XANMKic@6=KVwRP$YV z98rIT=WJ-6bCiD!Q4;0nH5bRr`$IxL&pRWxx#M&7X8tW>+wj?&r77UG++!SbyLk;ZId&(`Qh`5-;*poeY@aFpRmmD~6=W+8NL5n0=1B27M@ld}XFzfxcj*Z}MTo0yOw zt+YGe>HS=+MuXv6JT7$c zQZt`CLq(3w94+y_5@T7^5e1qK2D~HB%0-gx(by6L23M8jF8WxZXk|7%tg`-04)RXwjN+0AhldHD%Md@ zw4q;&1%bPWH2-(CfK-OjKLb5x=QdY+8e~zIxjVm(%BR-x`fA_pI6~^EVT=z8n}rJK)F28uP)Ub0B&#rz!^*hGxLmS^ z;+sdl;QWB-2AR>}Ph&|(YP1SdI!0KzM7Rh``-w)xdym}zEwqiXw8B0thRbX=qIzuX z?_8Bh_<1ylx)DbSOJYE+%&ZL5o3R!MdLDvUc-ls`vEHq=$-n*7|8Ch_2Mm>stsSq) zECHRZ;pDUzt29%(;TXsft1%pnbDT(o17ai#C@hnjByWIN;1n51MhGZ#V8za=1a#8S zkjTpxXH#)xS#9%doXOjSxX^r$+ZRN)l!;b@S{LS$JF6unFQbFC(xQu^N2FmdO4*a? z7nDE{S5qbPmS-(&h4I#v7uizWVp;U=%vhi+im^gvMpZQyEJInu8l`gDD}A|*OJsg_ z%4PN8Z|>9fPee<+UROQ;X?OdXC6j^=uC!?}RzuBnZR^ove{F&hoq*hM{|4#}hiDha zQj~$(TTKC>v%KoUWOZh(CtH4dd0Cu1F>X6rfK06A-pkRuDoM{UOKgwKE@-J0*;E9r ziQgD777Lsg&`u$WD>KP}WED`dX)cwj2kX$LKr5mD=J}4F1?QQ#a0*hree(kMKgLMG zbXCV$G63?x(a*AE7}~9{GeAZJj@CTG>?s_fP!(fq4y3lKEsNml30XG+C5)g_a{qSj z3;G@29gJW_?{$0YTaNf8wykN7Z3`>6WS6}`fbyi$n&H*{>2Ol{AbRkEYnkz z0Rmy}e#8ibfq#lY*v<^-<;*Hkkgf6~I@bBSjdD|Qp>VybK1$Cp(OEJQ6+Zkzoy{2r zy@T&(L7X?0zZ>b2r4ZT@Q8*UM6BkNToIPwHvhTaq$ROQA5b2w^gmMH?_PDXC zXf{E%hQpGc8VR2>x~5Y{|H6y5Ut}|*lNbfaXcGW4SVW0H6r)W7M_1%guw8(nnmAL~ z^=3ctHD3{((}^N4cdMRO3y-X^QBX#VwwlOpk!ViL=>vN~kvG|MoQ!xlKBn#B4VAh9 z@-v#o@nu2zd{Zzfs-}f~ye)|bF~KI)ViY)nxQZpvcj##=R}AZ+>~#xNzqtELFd}4< zZAcmhfCV}N7YA(4Q)|qP;;1U6Zn2@bHYzzIIjs`Xw5L*|;=!+|0lH&MFqPMu0yjL1 z95bbpVv;qz4#0Bk&fi|H2_7B|x3IxxM=;`72&1=bMc}b339-tP*CbtbgAramXw{cK zFP@#9E#h5v5hhDwMJ3@g6VjtnoRMF9y?=06a~8^uxlm>p3Xa__g`VbnFm^X%=r8@4i01Fii4^Bsu zdpyC@wz^A95%%oW!Nu}}`8Av_#{Mcmz*ot?u!Q!&E0$9)tkTv93&pKBx;Q67v2%)D z-wJbT2IQ@Q?KZpidXeZR^3+6Rx|7{px*A%QayWL+&DSGrD6CJd7iTpqe^FJMw3+#B zCZjgp!RFM&p>FLE$@!E0mM+~Ws$YyZsR&Z$|JFQR(kqO_v>#RNcz>tui z>&QhfykA~02w=Cyu7en>*MID$X`CM!Y+l;$qcuveHW?B4EGze8+Oz16RbM5*q=mh9 z{tFo|77_jq*e-M_#yo3$r5}Z1dK0*)kr3g6D2N@EP_XHbj?_Rhg^#k4@j33@qbR0P zZfc{AK^PzL$dBMFnX3}tgHIX`rs_@~jDV8W54MR}!lzCCgAH5}c~u_;P*sv_m9&K3*hPcu`2BmCQB@}|#I7k@+xc?$@nBaUANfoPaT45EiF3eh7MhjhOV z4pG6T{JjP&QoURSi)bttLL*aSCLUcMRjU+%{niQR>mbWQ<|8$)Xfu>~LZ<+kBCvDf z&1HALgsjaz>K{A^22qeX+@a>09#|Jt+<{Fs-Cnh1M89S()Xt$i0oggq)uh*@%R^D3 zqWYWMK{T4&e2u2A-lOrIa0c`ob?D49;;%59A`C*}K&9+0&szQZgVKxYJs4R#w0gMG zQn^^Aj7fc>hYvS-Lhz-a()=xrO^AbS2fs^(S&RMb>6XPh(8;Y}(qxYH#jD4{rSmx4%|+j2&hTL7eZg*uR| zlq4Dxj5v!}nh&RNJ3L=Q#bHVK$1ofM2G{?@1z-`h%#fcn^hFqd z5o6E~h7skFko7AS5ZmI@9Hv7lTA+=4xZ`19-QmapyY>JhJzF_|pv)htB%oH~yps#$ zVX{P{s#w+0ramUx#AH#Zk$>0&FUmpOZBPpw!Xm$Yb?|z3Miv;l0Q(j7HRh#bZG_NPfrL}{6}kW3u&pDzEw zTimiCFEKxreW0tOw;#8`Xeu=bd9rR0_v<*2+Wm1${r^5jnD|ow{~g1BUHGpD|HT&i zq-c(~?EmXu*y$EZQjEqN%XCNn!!18H6=1T(GIY)GpZJ}%HEihEeC?XAJ^or%7eQrF z4VoQv8t}EifBbmM|8BGN`gr>5?)29^i(hS z{paZw`y+$2AFbTkf8NFi4ux2s3P1VYx9|fUbky&!Zy$PyN2`QHj)s7( zLvr;+{U-?p#GBI&&XM%-RI&Skb{MyT4X$$Zh99Nh;81U z=%>1?Id7cP`oW1`Ms>S+DSh3hcOBgAre09~i`QJCgMde0n^ND*XV&?jT-p0$_W9pg zFXn$(Z?CN0o&UG-x&HHgG|rdy$C%X!-PH3m;6$hMxql?${2_=u0&XH9(vBYE_z(WT6rdP`_Y?kL zr(gQF$y)3O-Tbq#BH{$qKj!ZME16!gaodHQx(~Hv461pOc$z2LfCRa z32b@#Oi=6~2{_W6I++yBh-f3>q#^8akFKDs;q zZ{wry|NBQjnHvuN`0AX2eevgk6>q;JZ8w#}&m#&9qXJGq8x-%8G)IHrJWM&12T;Ud zNYZN@Q9>i)J2%|b1H6z^!J`~5I&bsf=0FwPS+@aj?& z2o&_A7y@%$sSCGE)QBS{cg5m~F+)S@<=s*16qT!&U2-cG-njF zu-I;vs^eICKHiy44L<&`LZ_)ZB%zd%Lt((CV-&OS(TJ7rLCv?X{`_kH=T}&DMf^Bz zq)ud_66eK;mY_Py2XMREhkX5ka77KjPJ`22k%k2gj^bE+&Lv|KihhVwk{K!Q4f_L? z49u}$qhhesNYxmzMI0LzxYE$<$zodUCRd`^GnfTCkv%6-f5!fO#%Hf)FB!ox9dUFnZUa|ph-ElUpn(l5=;MaBZRmiTR;5fOO zb!pl(UCGVBL98z{y-hu5{N+Cw(X;Ejt!>V{rEEGvxP2DE-7){y{+Yr5bEKs!CV-vJ z|F<7KD#`yIEw9}1|F`nFHpv5iC_&BPt9Hj<^q)tA+)8XADFQe%8V04$u9*B)Vy1RSpP6KJVp7#&4px<9Rb_bf`n22}4^GEv!|xpL4Zh)` z^EaGrXL%j;NFayTq`dd$xKe>NuQW*#k>Gs(@?+(yU2m^gD+OJKlQ2yPbl65H7^oi*U zF%u!jeV|Bf=x~(gSisGGu9MDF>MP^oC6WA0tXTL?O`~T{a#p8KRNgMrm({eYtfSmx zKWqWK;}zo*E;@$hl|(GC(O2BqpSccc=46F)~oe^p4Wp+MpcFTwHzoXJ0iUY8klfo348qEx#QTP!%q4=mwsj{RXv68GQ;PBsv0-<7^ z(nI`EzxeONawQt6Gz}%njTY14Rdq56D3ofdHWM_JfVKz5e-|s}Z1?W2vprx3lGQy~ zYd_EWsFusiQkf@_iqe*6Ub-gqg!>?YS1=l-$taCbi5^FTio|(UnFy_Ye9dI=fRBnB zBC^WkDfTH>marnl@TPViEfY7q5SO_k=a!VEN1DtTx~_xE0x>6>UKTWFG#p%?a^u>7 zxsn8x$gIjHS*Eo#ZyZFQvIg_Ci{0V7I*{AmAZ+5TPIru%yXbK-2J58p;K#}cibkhY ze*+`=*7YGiE5oByvJ&e#6)LxiMo}xIr~^)(7}1DvOzaJuEoi4hu&Fg1z^S$C2XR-S z3yUWLk*H1rCcTaN=XJO>mCs)Na54;w8C8#x6#XSpk(qX_a`1~amZ|_sw9~HbE>N8~ zQ(=qLGZ3^O$F(Z9y+$cvAtynBy(lw{M_Dmb3r>=}LNA3@5`_`7G@!v0{QsfGuEll% zzmQ%6t<(jI*vF0j+vN9{NQ-R{*(n8PAs`crN;sw=vblth6JW_DX5dpP4)YAYrGy>M zJQbLkgF+vyPdYO5O#E`ubUJ3Kw@z{H6_`YvVJ<9YIkl>WW)Wb_5W+B;e!miA#HaOb zz+w92qbP3j7nBN8ZXCq~nnZw<1E(K`lrqkGr>O5_Bo=t-4oX0`4(tU*aWXzt{;<&W zJ7oyqXDWj!BesTI&6DWqi^EQ71*N^Y^JMEr8I=9H^e{0=@?@}B1*MV6Wr|>&$@eUj z2ZW!Aye)n#)}XTP1cpqFA1C?m>5QmGw2(4y*XDtT{y|Mw4Z<3`8p!4N@3|M&6r90$ zo2kqw=|IQXhNYQITf%8LQmaiuipdN6zXOA>2cxE6D=e1P=9^*4y>S;FOAP)DFB6>}Fli37~(GN-UXoh?CL6g4m-<{Xu9 zGsSRuGfo61-B`Uqxr;1dB}sPg>l05`DLOaho-vyV%XZE8wF49u-soMB5G*3-0eWS5 zl7^XL@HyI!S@}|O3Z#6wm4r_2k^WYJ-72KBcUP>M%W>92XR5NHuJEbp=aa50IIqHG z1s)YA(T&6z-sf8)vz(n>)^4qsHrojx$oB66eEfYm#gU`;_o6hwkar z>U>MqSm`hx@am|@e7J~kWH7<4qv@xk7I7D`M41>Zq*EsEM+!yMZsgfw%setYqR9r< zR0GLaKF&}$6>vs*HSNOuDH*y<-_BTHB`nYoDrBm6bJSOFBKLHZ$_2nz?3Q^sxQVAj zdpfUO(Erb}|4`4a;s!Ru{`=AT>RQqMV{N5#Xa8{{{H*#jXn4vI!=T1oSdrz%)pKZETDJ4PgwyI zc4ZE;Ecz4$3B9bU=zd{8821VffC9i~6>o-XV+CiX z0lT@(0Fo4d5>if104Alz@gNC$Q_3OtRUJOzx}o)wOxM^D(RRkYzFst#*vMI@6B{Ny zJDZrs%v#e|UkL;%-EGdiNzFu*x^)HrmDXX7I23 z7_b>0!@urh#%XxNU!0f4TxGLztJM&ZYGUkf;g;^~NRSB2I9TQOC?7jX+V!n09RnXR z7K+~w&(IQSOfFhqVV5a~XXFWn=xgC*Z-K{l>J}`87mPw^ZGTbKT~uM3jRl|o1mmdv zKwmd>zOn0@Cc^S9Eg-W@!r9$8D62@30JDxB3Jw2-iSLimN?AX{){&YHLd^b+p<1#LIWCcK(S%!q?z7`A7#*^Sc=~P{jqQ%1TN8)47ZPb1NU^|8MZ#gaNRh{g&lK-#cQW2~r4ldhe{x^b@+_`~0;N z$enSTqGU+rQ4;znC)IVw5H6vHa>#*C%`9q%y>iOMclKZZ?akhgKOI8xon&;LMklAa zU*Boqx~wkZ;@GQO)x`GO!=Luw98ix=(d&-^PZ21BZi-?>7{+HggF+R|3D1a|x^Qapn#R{b|{_Bw9D7QOn<4cK?hpBd*rGQB9~yiy-C&i|Fw z<>iw9@7mhk`F|UqZ+Z85-}*1$R*Vv>esnVCuqWQPo;tl+ttEa1`%TyQ3HBz(QHc`@ zbwJs2PT`nFpPTdi6i@QwkW~((yNN?+(`rG<;;>MBqI4sSgt*zUv~219r~iGhvE{$_ z?wK<^!JkTMOFu+fOW&h}|7rm+{YplxvEU-HZlycoFDSUBFCrnP?;^bA0=o0*Ga16T z)FfW+z1)=<|Sr{UfEWBtW5tnlL5^B3Dc9yI*L#Q)=e6^nVM z#SPW^tOl$?P@P~P)ipe(RksRRpnnl%q(|(9aMbj|xEqBTK-j=>LyKoyUGw$SQ&8V9 zF`tySfWj>KTA|=6WZDo>E)-Q72#=9af+Tk(RN8tIEpx% z9kwQ-hhlZ}9xkEoWQya`1L4?HK50CBrRMM$$v0>lK+p8&)YIs=;j6DUNcF?X^T&ai zu6a=%iQO(J|#M$;a%>m711 zadYp+J>1)hk0~8+U;F(1+MikcAMM^N_A#CRTkou_td{aWtl#B-xRuX!%XM%|8tKi< z@Pps=qzt^R&FUcA^Dh|KJmV~F@|~1$L9^irGA#g3%P$5 z#AG~`r)XmxX5C;EQgE)Io3o`6ngQk4ZM&g@jOqLV6c6m}&ZetCr>8q_UOXp#aqWHj zKCV?2+5I0=XiG}ne8OqV*rIjK@UirDhyX{T!8}W+SzOp9kJne{EIE$nFZ;{9-H+qB zi~cg2e^y~Kn6qRr$xHGgDJl^Lu>{uYHq{gIGiRy`>u-0U z#QG|LFvvnvNZNxpaHmLmA(n$~urx)UH9f+g86BFoMnO-KSzNK9UU=z2Ibir@WT5cN zs5=NSH3U@jQe5WpstH7Mq%DEwqBu4pTS`(vN6GIbT1xP8WnK1&#!2 zUphX0LklL_&-gV!|KJ*?WHUV*B9mCII*ph5~DTqhQk{60l1_N$=_!!|2DK_Wt|NFJ8XdfBipi4i4Y` z<>$Zt?f(YHUEoMgPNRQ(91P=R^h=uM<4?U`WKL!qFJWloZO9FN$tN{>LD z!20yHPF^xcQH+Ysq!evTt{rQCr0wk{lKai$Z8xQu`@!JcKTgBoBYA)_4v=RxsxZXc zLLPSmbjbY_(gj5-wVQu_QnWuteKGdKRpSND za1fTFX;WQ}QbBQ@;SDu+|=2u{uu@3%d zD7ugj%;xMgg^BnRc35hFK(oc!Bm9RnD0@J-R_>6Xbu*xqrvGT&Y+k#ZKhVp9Wu^oh;ibd;1L#{wISAm|I*cgxMH7<-V`Nb*Ll|q@ zEMn6H*2fBEE9e&@yJZK6$r3Q;##xjBdwa&oA<2Q)YM6`>Ra0>^a4ZS+a}6lzykuR_T+fe5z$JDHZmwr2=#GcZnH%sRjYS7_U;My1=~} z1dEF^=WhC;h8{k&Gh9oT*=ZVP0Gzsu8C3|^&j3h3x4+$kv2!D4-p?s*0`tIpu>~SN zx+xMnO;q7~CDT>gP&GoV>8!1Zm8#)$qYq3!8}zoSp1;0Ys--yb=!34V>}7SCg{_4T zOyO?;@Y~(-a6F*65`5rAu_CZcgU4|m4g3}BIJI)}qCFTU0>TF9h+NUFz^N^F8qDoW zo<+e3mB}V=2C@WiBz6VHF)5zCFcekrM$q7b!YJ25zaXm6SOfLmVflv-anZV)#&>`Y z>Mei8COOz6^!#r1gW14Z@{3jv{-uqlro18#mdv0Qu3a-9#G zwy+0Aw}MkqsLG}PFXAsJlXQsH{DvDOVw&$s@8I;mIY8ns1-Y-C~ci(SPg2T z>91Ne*X635Fp|vM+`v}cjX8}I?jzYc#J03CxaQ~`+;R8FKLx=2*g)C zs8{Das8u-%8}s`)sOM68%tKc2T6hvCDTcBJyoq{7wVT-&O2dYAKlo38g=@Iy0F|pg z^q~u3WrG}mY&EJ_fz<*lz{PuT-Wt?HK9mO7oXiSr+3cd)+s=MnFIM^2R;fz+;#E2q zud?#tgT1eK!X3^1*3I_s_Z#;1|E^rEeYtAOx*8R8uIxEVI=i@g0K4&wr9;-bu`{x4 z$^Dr|zJ*6k!~X$J>J9aL#eUv_=PR29yqrdqWTZ{*ZK87_W`9Ey<6)xG&&fc)6yn_7 z5XWN41_$RzH3pH(zfhLYK3hv*tWuvCZLw)qQbZOEK4n5)-)Z{Kv_KG>V&1%`#m`A! zgmLLfnC0Sxf=_q+R?B}Tc}mf|rWbvRvIr&A$LIb^3%Wqz4_1az2T@F>*hIi|ZMc48 zT)SkPKhR@sNjB0j$Rg~KZMe^p@t}uEdeFYx1W~2t^Rq-HvL<@!Nn@dO&aB!o(C#xt zHncVgFj!BI2M_EXN{G3K-Wb7(&0{MRkcK0PorOBp-wpaiPqmy7S_+g4DV!!-LX0ED zL}S!hho8QP;IXX*kI_7m$H5|07q`zoM5@!n%XG-Y`&kLeC)%7S%FxRTcp;f#l z&fz;U$y6^R!_!?WaGRU$1Ca$aX{BUAij7`G3T!V1i&!(DS(wKRX9Qc9VzO08J*$Ch zjTo;DQwFJlGf|4Ad#OLbwaF7R{>65q(YUUa)Y4tOrW9S!0)tx1i70v_%Q&Bm&stS| z>{yN7hS1MFJ~+bioX3ZXc6f^i$m$gikXs?o73OLM0=;@ipnr1&T5dGAN1!iEn}1`} zw&{@DG|VQf&((?UMV97wLv%})TAHS2-BX~(Pz2q%>+Ju;8hq4$ho1pTsMrUVck8cz zMJM|gZ(iUl)TUBq=OG$O^J^}#vI6UpCgYP+e|?#Q-C+z$)y!xBG!%-hcXY9KXMJ+H z?}?dS={V1u{x}{WHi(j5l*FvbZAxlxYh;=i?}=4`dKV`oV&q(tvHxhDLzZJGD1;6I z0z*G0eO4qdvXU6L(3ZSAOca}sdkPN*+GWZMGz(S8O@I|#5lAZYbAnWcWOcAH&oHR% zSx80Ubi;^2O^z)II~Oy7;>37KF#p4Fh^OE69xm4&zzJ?Ix&KQM>nv#t>59loC&WYd zHQZ{FA?!HZ+<0b_Dv*?E3RQ1VD>&P7ccy;O@2sthqEA^Vl5$X+6c%c&tcY51eR)DP zvPmq|TJK0L*fO)LsaFf{^96Y;#*8AC&;|VB`$GLxz2A8=d-k?&RI5exd>Q3vGNK%Ua?EA(xX-T(HcD}^}J4x*X@#z=+Ptl(RcLdyJF?<>GAh=$!#9C zGnGI+D^!2V&z(6QS3KL{XQhdE)pP6FGk)ekqohJP%2TWnbv*-M*1iQX|egntT zJ|%>dAnwZ721q-}rjdN#gQ%vBPFnaj_y z?2V`sls>^G#jHaR&M+IJ4&fN{IH6G;5b0hR3^?xtoMS_ji|xnV&@SJUjGijizM7OA z&fO#h>Q2UZ!<#bhxM8n`>56`m`70nHA7ufTWqoWIDNL%cqQr7OagC9b&QcR~CDt!m zETMTW1q?c7_G0G^^FPEUWZ^I45ZB0(VAE`o;UFSjZ68G=0$N_7?I;#i$^(*jzmFFt zT2#5_QVKH|))nSX_;JPE_D3Y#YR@X@sL-wz?NykF*`O14i?}V40MJ#R(y%l0qRj{a zm&rK8F1wbTa+si2KL+Jao|(p2&)YWC$CJp;Q#4Q+QehlYFz-Z__>kA ztt5|XK=ZAz0FzglcAm4O!Qd=7&nB%Tb8F>=yc*IuLyD2Ztr%EgL=$ZpuLz=otsra0 zjK1F>kTDH11PU-$nIqnU{`;AI_W1oM4jkfo!)M7wJ=a_t?Fsh;+WX8Zn@xxt*QNPn z8)z8%#_xAjkWmp?zi7daIfN!`W_BgMjiA4-U>Htj*d)2-b^u$Yc%d{h;9o{0 z0@lO_9q{R!BBms(;N3RP_-dYpqX80s=gh?H72}vPPi(iYEKtS_8!Wa^)kRJWBz%0F zvk${>Tfkg&Tm~e!u{<#1QbsX%#x$kS;*Wh=AtZyOtF|+b`08D*l=x5Cts1=a!8E_5xZ^~k$l;2OSL)QO{n@p zV$Ar2HwR_`_6Kq&6zZgSd7#}_HmvKFpLafdD0QW;eL<`&6PrK?Nf#l*sF+_D7`OHs zhSllOH^akCGBFcOS}EKSCf~cD5441C05SUi+4~m2xT-SY^xcG4TR{*|Z>J=gNhgz; zByAySOVcK8gJ}|yl=2QYGdIblGjoTzcajDuwtxsei=ZOD3WDO|D#)(S6^o*v{;RN{ zvOYmsMO|G)SJvPC@ju^p&bjxTd+$7w&ZGr0N;-4zd3@(P-}%mWzVkg2u1a3K zmcAlwDr6382T2gwDq(n@m4TnD$muQaA-k z-3XsD$4YQ-NO1Z&Yzsf{{avNQC=`xUFwGbRdHder)3q2!p``+G6g&jLKYJDbah5%l z0(|&k!P}=e{@ARJf0l;-vWz6L9kvKGrBl(pCSkNG7pLj|ad8&6CE$>Hf|N_ZMwHMK z=v4`uA!cJ}pm>NVyPzR6N0=Fr;u_HN5w{$sOs1~Z?D&&{K23-zqb3b7JT$V92pf}2 zlYT~~$VQ&f0YhNNPD(()B(yUR6YwrhGx!LElMo7n_DlB98awQb(6y;(YJ8k}5J5~= zY$B^@R-D#0(varc0llVyRm23|XgUaoH)V$!SNaCS>|cfKvghp}KX*cw1%Rg$UaFu8 zB8{pbuMlQALQaTNR9>WxXU2#b&r!5akij{*uj5>Rh_iG|jw*y$aE{3&Xv4ZN8-to=)X)^9+Cw>VSz1os^UZ2N`s7SW> zT`}g;I$E7|_4Np}jUp}++ac(#fkL};*J!Ir*tKOTijvJ#M?w`OuyE|ExwM)Z(Z_OR zF(juVO1)7pG>;dV6g!l~NNWc*F3Ds>lH>^sV-;sfY2t}XESS&6tvyPC1ifxA74NMc zmyk<7uZxvu>Ef`66zLn*tf&N?M+)}tx>4ulbj9C-2YNbn0xNV5^yJmy-7h)Nlcr`v zWEfI+!%3Ri?BmXdsfJM#KZ^GITB5?2J=2Q0UC0iVb54H#hz|K~7LKjWuZ{^#bHJOAU_)-`kae`e*wv&>>Z>g|esTI9dW z9Tj>DoT9}fL3vXH(d4@rJsfz_gbp{kPD%vGSf3)a3;R@l=Xp5CgNy@*8`VPRM#unW zKqy??#0Iu*QJSNzYa&WF9?8*4k{mCP@X3k*uSz{WPSpVb1KIY*^)XNgB((_*SR^^J zkAguZ8qw$ujA~N1rr-$Wo9Bq;qmI3D^HJj@&rUXKF`7E;0s-thCg-5WLNiW3O(V{~ zx-w7mDElrXc=Jt9Cmg?&v6*q1xn#{p>{H7APhK2WA4T^6)-`L^dGbFu&*gufl~39D z27GE78(j$i*`+&#_)4njv79=lMW9qi&KfteZ6dFQ$6MTcvx%EC;mfUO!F%sE3R|>0 zVPLZoJ+rN)rLFlaX(KJ~P|MsL8C<6pPr{WAlX*aFArcOtQOZnQ-hOF*X)x3zhqK{r z?03>i$C}B5tae3CCmcM04+0_f8Za-urHLB}tG7$&hWK7L>=#VsEWD&oNC7%-+8X%@ zD4|vnVLP@Y_yT6t4A~0DjI3^rr&uPG8d?xe+gI(ap{3amD9^q^i}9?6H(*Xu5~hzH zHw=?L*OPc_Go_?eGE5eIX-uDh913VLNJnDVr&WXaE+n2pd5Iu26ozcNG5p)?=oZN~ z2)K_x`amoeQm)ycaGb!}NlV%vcS~eo0j4GjgoU?`AwfFfr~@e6qz=M*5sr_n&_G&G z1}+g{0t;MJ;HMQWn>Dh*KrX#IZA_+>-P)8A41jqeg_|2`QP|1jKqvsFwz4GyM@Ue> zfejk`3;)6NFhRriJi_=_I3e~NUsO+H=c8x7jbaJ$NUafCFA|@M6RH|n+Zt8^gsiY9 zyD7IdsN5)_NUd1IS7e~wusvR^1WLcah@K{*Zy4 zEwvCMKIa7^#t@Fhd5j|qd6@xfMbR!G4Fs0ducR&sbVM~a(EP0y*)9J!lSgy% z|15mUuis0h;QAlwMo^BGmI2%*H)V=~hrV5syfN{sD3t&I@s(A0D} znwn-Cf&mjoNotr-le}O$G?&?vEN?ZL#B3{Bg9sgfSGLl}iIAHtyX_jE%9Lh}!+g@t zJhMt3LosQB`DL(pA&Und(F#Yn%?-8Fi3k6Xk<0m6Dnd>)vW*Dor*R`TR96S`Xgrm1 z&Uf^U;3h|&aZ^&fy2Uau*^;FK0GBeyE^1vP#vDPZZZt?Hqx@j ztY_ywxAQj`Ug6P=UR9G;q$n6nT(RMSVgzZ-=7h*wG{b0C%bDozK!toYk;uZ`urM`P z0-onzYkVr4KE-8@9fy^{zMkR1zAbO+8iMb`16?}@yE-~M2gtlIm=d~4fdYZBR~;Jz zC5f#F5J0lxnc*~%EtBfhVFK0N-#^ed)Hgh|r9Z5YKf}F!on1X07ciiBhr2Z`LuAeg zt-LsRQ&(4iM^E>8U9RpDM%v06IjhXwb@ufR4fO3C>Y`M@dmG6bY9g+h1(@kfdfPnE z*U`D9V{l0BP0tLc$eBln4u_M5QD8@z)(m#{!}sAGJ9~z@q1WM_zP^6BYjU_COQv{# zWYOp1=m-P>RFitU;`@;q35^6QT5&)>x{1%x!Y;(DQeeyG3%3PrqVN$k1CM%kb_@>< zb!_hG3b`yIgapJ!T1-7WrddKa?QReRjDeq>J9US^M+i6pR$8ey()Hv(q$Lw@DW$~; zW3v0yBgtVSZH$7dDVQ5J#|ht}ZZDQ0_m+1AmY&iGiBDq~jzLHXqhM}c^{ktMBViNm z9g5UryALhqA^o22-fdk2f(u_=Qm3YH#%M69hYG9+%Ssj}P?kogpbJ(D-S1=~g^G+s zXE+cPnAk|jckfWhPBC1HxahyQg_{2Bo9r0FJGypk?iv`}-reu%Jwe14-hBmn?;Pms z_jF%wnX!YNH!3DGmQ%i$StgKjR=Wa-(~oH$Nsft248)jea2(k`xd_K$7a#R@NBMXT zGx5``Vbx-?uFDlVjO#3-r?SI#YeoC#slP-3^bD8i@@J|K*k|}kW5(_%A7=QV?Sc^# z_zAG)ae}I3u)7x|#^H|M3j~mujP8raKtq5qtvcz7rDWXOV3dw~VTfMb`?FlOqUf3^ z#%S5ntvQ?{u+Pa?@Z2FSLIb4nU_*ZJur}0G*2|Gzi&?4)bm#P>jH=}5Ws`w`E6H}% zYZ>a=m181~4qxHm*=@Ndi0-w5pwkkP*`3VjpkU!`cUm+sJ^f#a`rpGc0WD_#*|Mh9 zqyKG*&gp+=w6?jmBbg`~Pfw%DuM_ zBEdMW8EB+Y+T|~&HEPe{G3vR>ym%+~F>^x&SM%OM*2TOPH@{PmyE?Bq^^s!3Y%hgTjRbB?71 z=JCBC+pc3GfZ08$gAT}pG%1KPtEkH$k|ox-2u#c9iT5f-y@9aY*i$HI$zOj=|v~=7Nv**BUNW> z>cM!m^fqj`yZ5|~p6*VLVm3sqOEHZGuFk$gD`!200gJ4{MkRW-5{*RL6png|_+fOv zud`BQcM-75-+~=0ZX!^mF!*2=!nP#_wlEV}bfBPw!D)<^UL9jFvkG<`1iL>_6hnP7 z1c)u=3`kT3JNsvk-Ja6{BUSuM>wC1nyy~QHRZ8(fOc-$+?V(NQeK{$=bO(|}V{<;p z4IBJb-1#rFg(h31CJQ!#Hwp!ss06$AnibBz{K&9k7ePXnmtEewD{L;`y;WngK(5?~ z0PZE&t(A8+Ce&n3uFBs+^eMKeW5O#8n^@2~fwEe-s^Q4Dkn0k2$Q^2+^qkFGBX_>z zPBxN-CMOPgRnPbgD-fzJm_QK!X%lVKL$As!o?yY`m&tGb-Alt;z1kzV%#558GBV&p zmdci%0iUIEShU6u1rDuMT+`v*-P!R2@(1GdMB5cy*K8q>AKoN_1RdRjBJU_=cDSmg za5-OgFqVI@`%R!9JJ{>Sa#1ahdyj#90_sSfvy7VeEaSJs9PZjIxce9HKrB)EvQYgI zU%ZiJN{l{QePuG?q z!TiI1aAa?Yy43hM7)wDFA#kvgQB9W56mE|xnK~C9ET1)vmIQVsaB*xT*j68+F}>Kn z#uGi6@vNS)Kyzn!Iv_3N2%56VDX>&@^%hY&(kw(c_7Y|?LWpcd<3=vYH&B4X%H~jW zK(l+0<4uAvAO+KT;Fbs9po<_2kAacPScphS%Z-sABYE%6sI|&E3})37UE35}t3+dM z(dM@3x=LEB6jVJ+0iQTk&4qkAN5Tiar5=7K*J>(@W{ zQ``VUJ&*x}C{6amQX)CAC{Zc~OmU(_k>B=9!xUc`rqe8?2eDavVi&M7-j@+8W51t4 z>?$Gn6l)L2i^iZTC%(x%_h*f>m}=T8_mq+@_yrxTI?_#ALn)}tg3XwN%m{vfnive8w`v#!Z z<~8`n0ApL)8u@p7S5F_>=>kE+e@?II1oQ!Qx<`2mK@_qSRoSwwn;bKg zFsBDH8+6J-QnVbt+IH)iU@TmuLl&DS5BNY#L7m z@$aJAQ9dmGP;&221sYeP)GjRq@A`Dm~hj` zW#gLAU%ql0^ahd7A~gJ2xrR&lxD_lm%5!&i50$UWcoHI2`Lvd?UlppJG{*FFkg&*X z7>}8gMmAAw01$c@=%uG`TX*l_%olGFV>XVgZACaj&b>DaB&nLKy8dq$bL@~@z6!t#siJHh7*RE%67Osh`)#c6TS)Gc_}GMUd#@D zr;qZ;c%!6)AZdwE3IKl5r5C3!SPUPXrh`_ZkHU1duxNH6u%*G5xO>QSjOraKF@{n43$uu- z;&Ma@oeSnK?TR!+ z{f)WAF~41*CuLHwHMTG zuia5QSRZmI2TqxhEMeV7Di{qbXTb+FvCvgWVi&_4fuyTRH4A4GID=DtG#`^w4C_sy zV>;+E#x*qoc_kq#zY19{VIApKy{U|*kiBnxLn2eW z@v`KYWsdnRNU{LO)d|9{b6K03Xi75R=4`M6jz-`<*h@|ffowuHDA-+u|0amMir&ky zCl}STEFq1+$T4JUzBi<9y*-Skl)gtx)X%V~NW`A8`gVJ?8v;0GFfy3IKs{R@`Dlgj zbQ!`HQ-FB3FVP{xOhx!Bc`I_yyHABs-oiX!u}DZ963EV~AVrv3238Nx0Bf@chn$s^ zXDhV9kZ9T$fW}4|cRJzFx4?>pl^RU>gNpgMB(O^8r?C;93BB0^&*(&M%K1$Je^v4n z@Cv0*foswFELFBG_^nKKW-GQVRYj!XiZ3;1eL$4sCKMan(OsEr^cw=YX*8aB=9;q_ zV|NyWTN3M%Hi%gLcx{1m4ly4(XTyq zgfQ8>0yQe|4Ub-6wrMIp-`S@2oUf+YrpPF~=$wtuB}ln;G0syQ^vUM{frGiu0R^@} zMi}{<;XsHjd6zAci+7S;CnJlgKJ6XVMI~zD@|9}S_l#Zlngi*B&TAYTozDFT)s0FGglkDjz7NdEg zn$jX-6e`kC5MaQ_HDI!>k2_Qf@(w38y%86yg@k7ok zle#sIUFimCnnK`b1IW6g@iU@FDt<-)psYYxi+(mUikZ>k`lufFl2F-)Gzv>&cvp9C zOS3RQdtw7Mt57HJyvm8MXmZSQ<6&rA<7OR5W@;RC*FsbW_CU1_K^Ud#SyEdzyEWbgF{)aMNVj0UO1kEa#xbB5=D%fmZ<*=Rs7>f%pb1i& zND~@b*O~x?K01Z%@px=#+?%7BhEfrwV$>-_V}W28%fm->OD6bjxdEbbS3 zOeH?{9GzL%i-bn7XiNp=cwAx$b3A7yjLCG+6K-?dm;|?1p&JlCEkiCT#HVQf38rO7M!Jxsnr_%J8PfjrWz7M}nWgA0h#yB{<1 z^xlxSdl_Gvl{V5NM7rM%=lueR)vP?F#PLk3I#|SekZ(>F!U78iU^{K49bd5QXu@=U zO-jEs{AHuWJxr0H*ma=<*L3Dgq8oO&^$e08gqVXBS@rZA21|+?NqNX4aP?g>I4%H^ zx@l=XBtD{&ipH4S6J_6WVdsY`cI;4BDP$xr71kHn#*r0DgB1e|puKGOE9p}T*e7N5 zz(F&F4WW~Ufm~dWSrm1I)K=qykcW_S0ZR66;3Z_ngD1~&Ed0VtyVPYZt!7t~KFHGz ziaQShFhmMajDZV@X^l)_U`VkoH?83uvrP)Bz=qJ!FrJY|Ww(dX(0$tTZ9w$cVCR52 zkBwL4r?m6`;dy`*IsdO)*Wx+#zyV69#fF zt#|4D`g?X9p36o)&kUaVTXvzSi1&mY^-uLCK`C!%PIhl5in3%4-0Cf9|4zaKNnKCI z&+m}A6 ze*O5OLmFDq4g}kO*L@cb0z?sxWiB9>9lJOdCy;c&j>R1aqiH~>018}CPIvHfW9(=k z4Rpqcq-KlEUNIyf_LZHY9>Md?Q=d0Y{b6OPFDIV?k4ef`=@l*2ZJT;}H$CHk&Ifol zIac)y^~RdZ-#xoDwgbR|w$9WOny{1G?`kNJ7BvO{DB0JV%{}CtFxY(|cuqA(ThFYa zZ!Zd$T?yo%f~u=Hd!ynqmoJBYRS>CU?dch2%iz9PpW(Vp&V2&85Td>s$Y5`(k0_rX>K$mEgX9U z%&diBACea|g4XVpjd#JoDi5;qVl`F@8ae+0BziGRi#aLmu>@hiY_VJv7@2A$r}Z%+ zOL=Ai(}Qa9XIj9nuUDN7yvXfJx)%Hn^CyFj;IE zdAW@*^|^`0p&E(r_>&SZEwCS2FjP{=sUrFxB3d72@{g)w`k&^tYuCBsf2?h3UNfiv znT=1`Z>P8P^Keb2W&J=3qftC!vz%qiC*_ASgPb2+7m+VbmtYx@c0aMxj7bSY2ufx< zF-YZd$g(i?>=G`2Y7orr#MKK$im_93ky2DAQn(C?h(*efZ4@4v#oH>a+!)Pli8nIE zi)J*KwBkkWoAe^(_|{sa7`uinHea|;7RQTE!Y==U>?*AUycEnc!<#E!$TuSmUTwxR zoRiVGZl+&q6jDmcj50ht77v8^&hFrd=SCp~xH1BY*(pQ$L%STsKW|Ey61xPDx2r37 zWWUFL?E*fau*JrTi0jWTLIZ$HZQvuj0FAIN6~ISg0Zzezu!pF{Vth>q#rPws7%VZ` zqqI8hGN!kT=`KSVh=g7G$S%Q_iHIEbNa)Bj0q{r!#ElzM!i~K!u#mh~#6oTax@XDs zB2S_OXI()@uBGObVhlvY8++u8Tp(z2^&ipU>Wiz5s;juNpwe)dlow^o0f0(@(%&Z zy%8W;qU0uS=&Hn%5M0ybNsnzNnARro6-}BE&s>#4SL(f>l#gdv=-vFKY1Fw=OH(%r zxwH#JWh`stGF~_d;WgtcA3*V^nx5Jla6{m&sk={ry?nhjl^~chE|LMphSJFfC5S&luFT{4 zR)s4$1|8F|(;MdSA#8Lbc@uJH9LO&_RuV4WVR6v>h4f0oX7^YeIRBGDWhXQ*aFtsn z^4?$Z1>$?Es3{exGE+q^>cOZ_&f%UgO)*T7iptxHV3mc*<{?yPhw1nntIC5Gd5(T`+7)q&Q0r@}K@TQc63Zj~kGpU~siv$kTHpRRS&|Lu>3BcfnY=9G*qNR=8 z*tp_PK$RJ+Jt$9Fryg3{!9ug|j$6VRwY<|JBv)F=xQK3QsSN4WVIKZdR6cTaC0n$e zn87cK1r%oIan-T_IJg&g0-W+#@T3(UWs2z`E4ya=6eZH^Flb6+?v8NB=SVa!2D=Dv zox zv12{c9+{L0NkQ0cOLyOJC-~e8*GLpE@nqT(u)E>?ouY}V5WFu1W3Oc?NkTisQdZ+NxS zCG+%rhh#pzZZm%v%?3r-fSgI-Np^B+Qy)u{1CBWk;s(kbq3U2QInTU<(-iFh8q}N2c!%EO>f!uNx=sb+Q1WO(v!oynXsE? zp@t+zGx$WV;dpfl3l@?|`bfg1uia@%OGOv6d`2qDiM;2MBSegYESB#cnL5j2VzN4G2umbLjTg7wO%dr_q%YkwRb=g8(m6X9z)&tc(f@nk`V0yuT+)%W_dR~y3W=|vO zZvazPJueD@p8k5gTHcaPc`65<-JcJ5m78)RUeDIOm%j~ASrKZV6I?yoC`D1f5_g~O zYuTgx26T%ZnaX>BtsEf~Fd1ZI;G^LzaI~ZCFx@5uG#DNn8tCfS;T-2!t|>z4MjS(E zD&`a!Z^}olxso2g9L*M~Zr2mgBPbR9h;|z4PB5;~AcwYzVM-L$bcu9ASNSD4NBk|I z8qI1D5(Sf-9=4KHyavgmBgG<>RFS$*PzaZ#A!W5uA9#Hx zYfONfD@#nufB_hT9b1RHd%K398F9DZm+=t>YF2Yh+2F#NA}`U#xO12*%xFdnI6p^l zfQ)%lm7#8uwp4K1CPSnCEwMl|quh7<;hlid-b^$lYC5M>XmQGlFg zOjZel#HBQzH;d{wBgz(0vxjwS8l>8qj)=B9v>W28Ud&w$Oo}SvFfb;vPFZf$&$gs!xjWMO*PPoqJB0If`KgITcM&yU(16U;g_nKIA>05O9fnw;{Jh6q>PwMG}F=;}#uGqrs zp*lWyAe=Ir?5B3PVI`%fQRYagd&qzBtbvC&F6r&)?zQDS@;$gGtW1TJU~o@JS+4}i z*Rz#9N*j5`o3tx-obOcZIA5%|(YN9&#DS5Y7hxM6qq?F3PGw?gGpT7A&-Po)OGF8< zUcfcM+qc3!Mu@Zl?Ym0hGpCGW$)#|=lJcPm=EM%kWiRu{QLfYK_OS#jvn~q*@k)9I z(NF=hV&@>JGpbJPUxbj=B)_|{QjHt&H6*)CI#MEejOD=C0sgIs+P709>x^&_a;||J zs8lXKPP3--Tv17F)Z&4@$nVo+O7D$9z!1sUQbA z@-Gam%@bPOnH{o4P*YG^7COaC6gX3)ObQNxrZL7k&f>u_ZBVF_dWvi`<(*+ZXKaqi z+LWf4Pa`M{ovB=}L?cn9u1=Und?a4jF;!2atU~f>N36u50jjW@ZWN(It`$;N<9jrX z@o1NTr<3z0H0|4WVSsJu@~FPb10vb4?2f`B#34sDR`%tP%y0l$WXn>h&0F`cbxxWWl`Co&@<)H&qcnwG9#u z*$51i-jW2h)cW%rHJyX&+*nwNowY8i1a}T?2`O$~!t0jXx>r6!df5fy2(xl9TyE{| z>4MDa$|xgQUWfi7BOOEz3y1g)bE}@z;9Ib6)N*c0chLhX*|1n=WYIeNqKJ^S(HKQY zh~FJr3WN@`B8kZ!W3rQ+h@knVSR|^gBg+Y2K=wWUrXkqcd{*mOYu7cOwKfu^oG2a!ERHbjhcf)-igvDn(y*4A|`YonAs>}4nL5)jLEyyW== zVHXn=NLJDqO{i1Bx`{B_8}V|OkFp_zM>A(ohdq*sh&3^6YH@;3{F)=*5p!$lfcU|@ zd~`T_!3Ed^cy-!r7K*sGSKdNukh2P4VT2HJ8uexC?sGUY(}Gd%+lJBo=mB22D2xWR zm)J~$GG)bX44H^V=srOi3zTkC0wV$Jgl>qecewMXkLd=+RZmKgg_I*bhblNng-m%| z88g`A3Hz?E32vjGeI#JO*FdrbY#QCxkyyOAain=PeLct)+?>FEQm zV(}U_mkF~KiA%DAzB@%VkTqB3nPQK`G%F_BsDcFMWAm$WBc}vSYmLNL(wt4W9Eo5J z$Z`}^!Vv_~At0D;h()6)xKnY!wckTFLWS^KW+`m({g?X_r0H{V(%N9Z6pE(Bvca^{ zpv0p5BX|%vWjAgROGu5J#XqzjO>`ejt7(Ixrw+mvWJBPJAf2oPn6nauZYZ<-JLfA* zo^WrhNBUB0?o;xo#QWdFvH>e<|J5Ax-v2hw-T%(U$F~0>$HKmyVgg|2$vk(sBO(NEK9#sf$j)#aG9&_(Nnn;6+>(}AKggRWYRXv74MMb2B`cg zC^Pk>&UR&N&(RghO;OF3+!P*1Mt!v3Pvx7p0rTbkvkN4xbgWr? zj}JT<0V7tXB1r-Jv&L9fO;N?5nzqV~Hnu&I0j`Z!0Q_#A@tv9xl)ZfrMY!30mT>zi zB{*roMIi`(uu75o$V%nYX&cv#q01Gi5sZroYT`yh3oG$lHj5dRO)Vq5OcE)CC+CUV zX2QCfPCg6XeVC3vjAS7kg zgO-X8311`HI8| zm^oGifN@snzmbR%xHuhvf2CpBgVx~mfH}TR$j}E!wF_Z>8j5FvFa{=bf}uE60$A9U z$B@o3w$C%|DR$B$q*in$WFAB;VJW-^(@ABR91{}S9!y84>=kk!Vvz`Y-9}aE#%?b` za|}3C4{66D@e-)V#tAR#BupedVY);Pjw|Vqr!1fc2keub2vDGhl?l)~V=XRA)( zB@B;Sq&_N90UhN;$Up0mFb^zaBGZvVwGf{ccMUg9x_^6+WWTjlsRf~hk%`zY5j0Q6 zC3%8GNX4SY?qL27LQV$Ae57ThQYwI+N`w_P>m>6e-({rpd|OCgEK6M~fvZlzMMrAj z63miC7_#9krM_6D2)vM{E@(mqu8b-ru$3~bIjqVq#k(if#hiQv`vMrj&slCk7yx}) zsExdE&{m|^h1y|R(R`ZVZwl3B`O$o8^EXBMX8Iw&CJLhv(|WP&UclhBjFcCbrXb|o z0L-nBqcE(9%#3fu7N2Ak*dm!+DicwYNv97TCKq}F(>I}z(>a5mw`DW#IE~K*_hvZ) zel|IUDyzI}N65Fv(8(WF+levlwy75)+kfbW?SzX};(UwnK3)>gv)aO#7e=-!f zlVPa<*v3N>4Tt1R!*QRz+7VjX1pN)y*O1njKq<`y?K0lx1y#-oEHje0CsCaQiQg{k zlTHw>cH(=(bV?Zg9_e%G+-G(^Mf5+pMCJ4Ut!rNA_5W{anbZHw#;4qOJ3Bk4ng0(d zjH-3cn#=!(4*@0YQmMSIe9DY{`IJ|RGvBnb5tfo15Xx9anUe0YVxw6jb%c@#mfosa zdaJMCEP-ULmXIZol&VaYz@j<+jB<g) ztO~r~b(|^{&K*d2$SXQ`AQ@lTatD&OuCiklLC8DupkP8ks6Y_zUu8yF0X-ln^jQf> z{(OL$PE~iWCT5bl3eNg7>DjOPt31!3=z;)bYX{|K;la6aEkuS?>TyF()YEvviU9(> zA|RQ-sB%+t2={B*F|{UX&@ZanX<+fRocLN+mej*LON?H=v7Ux4undC8Ci4XAs`D6*KG%fSVRQxuRRmtGNIfd4R7Cvbth0lYn{ElA?=TBeREjU}^>jgei6-nxDH?bkw#L&xd5qQU7?o1&dc*;R zjfO^rPQo0pIumaf?W*MpWG^k45~A39of-hJS@C1=5URLrXO&dlC(IcVtBbeWc_#`` z~BLI&cxhFlKLW%)FgZHKpTyGz&)Qdd*NYP5>~2 zLKdaztbIaM#a6#`tr{Hc0FPCM8xb+DYBn)I52q$&6>vr+yFTbaXN5ZyPRU!0J;lpxLiJcG3dRZ`Yz zull8gE06L3$|9$bH}WhANvNZXVQ!E-22@~XVs917X_ z>*P7u%_S@@->P*dEOralM+nz0&RHPwZRMHfVG2?uk@S(ty`G;{jp(k6C5cbX4v#uQ z;m%(62_6M8%I^pT1oAC;3!A0HjiM$&PTVL( zWZ^QJPwK>%T^ht!?WY9)k4oo%gh0XG{EzGA{6A*n!yN+PdcukQMSoS!H>6YTA{0fMHCG{r}}4?ILz z25Ad}y~XRz@%Wa!fZrmRxt zMOk|C{kafaWhCm5 zT>d^%Qu=l@`obbr%F6@Qp z)A7sGACDjb&M@pegnZ9eQ#)PPJkripRM(7NcIm=?c~F|(bC+70-tS1IXXd~s14@6F z;({lGJiU4j@ZNeD41Bkyn4sH*v%XEa7>zHN0pC(gh^WSQt7G6!27&YP_~Y>)p6&!m zq!(`ZAaK1r>uK$JPaiJ*EnP6eZ6HLv#;8N&WuwautwJ|46>|fuoCOUv zWz`apIcl~{Y4ZESQHh7$ZIB-Y?kHv2cip(rQ4Kr&p$Sd8aU*%*Z-`dJxuFt(@h*$P z<}a*P7C5`lqR{z^$d#Vce9*mGEcl9H)y3^+V8fTLqzT{AXZ?M62+eE%ojy9vzYlM; zd{iabfBX2~Ps;$jJQE|Be6M7jL^rim#sXU+#z1DnU}%@BTQnfH6Gzf?TUaWpWdUp$ z$kM)M;deKr70I%w(l%XwiX(Y?7&xV}ct`ZiW0UFi9IB&rmu1Su^5QE&V zOszJU@rD!1L@;M;!d%~Gj#MV`jy$rP1+eYvGd3$xJTIJciC?gb+4Z#Atiz#=>?Vv|z$LM8 zKU@*!F(b96oZ{H_ha}7&L)S`fjLZ?z%91ZZrW6%;fMfUv1vlC*lh{zi%%z91juWi} ze!`Uz=_)tm zx0a8I_<5uVR~@tHk}}iVotnIiEUTpqOY>n>#n_sMlhKx@%gSgik(bdYE@tLxTp~E( zotK@7d$Si;Qo!cxZ74gHL$@!d&d%+59L8(XBMSr*tGPRbw@7%6K| zUf+iu7-yOXv!ZKX*2xrK`(7=`5hBOIaZZndt_iN_30KX6E+IKpX>GT!rPGYb(#uuF zO=R4d@%klA=#cX^G0Cp7-kQ<7=dg2(AFMfS@-xWmf1mUJnU#<2|B1Rk$8(PUtfY5PQBP2v8@GZj z#^oTDscA*qqe8xHutS6+1BkDCEQr(X@()!Nvai6UJnhZT84^hw9gfaAQvOCh&XAPl z%AP^R93;ICji8Jx9Cs$j{xZ-*ewaow2k)SsXBUXT(~cZDe`nj2PUOYC+PFFbk7Y(qX%snm z%bARow-RoSe(h`8TAL+SUfvOxxj8bnPK}&c$a#Y~c9ge$mMa>?Y;qvUYFFg+tQHI~ z*Rl{R07-($>)~zeH?{H?%F`6}p&ANgkZ(q0D#*j~<75Yw112Ef7LrRj+aEr!YhbXu zua}H30CX7x?iZ-QD7w;+P#*LOYywb64F_7yjH_gCRmO>UlhERN3e$6E$O_TYmdck% zcRG`^;0rl=wkace8k8!mDbmmg*quTT30xx7h>;fO?aOU~5XGv~#>zZo$3F$T51Mky zbLwh6X68nM5RWl<(WM=Y7pjd{MjOu>z9hsPQ_%c5?#XY>Dvui3lxhV7wY9a;W^l}6 z&qt;#jntym;7HALhnI7B1hf5F!=iyf@UBxawXqb3k$Q#S66Uly=r-7E?pA0tgQ{!?y21)u}OlFe2fw( zK8TCXGT6loDIHc~Yb(zrH|KOvoU#?l(uJUefe%0~R2|6>p1CFv$`14Aie1!xBu!u3 z$dYNx7&PXrI)XB$-E29B=32A7D+DWO!yK034RLikn;4i+sQ{T1xVQmLd!Q*GtyQTU zu0YhCA{fkQM@Cikps(l~ z=W4>+Co5@>mULcd!1ACYO%eCNVW=XPwFfQ@olUTC<*c>P7z9WgH9#PMmt$Eql_E!a zvU|j{`iMr2C@|M93&O@cc0kt0mZ6RH1dxqNTiXU@y%`_ZQrgD0rl$2O9zS(!YGc!S zz{bXQ@(*d>+<5l-D{@+PYU8T)qgfSq*NxbWQ-d}JS6g~|)Y!Ob{kUOT8{5`{YaK0X zzjKOiyoeM~O>>frbmJvh3i~A`K!{q;cJhr)d+o0-W=Y0@x=q-@@ra$v#x-0l7GxhC z#WS2{veF4{RLv!=HWBOWnKGd!NkR0A($x4ky#Vv@TcM&Q%>%tJ3zJo;5qS;fi_8J@ zodUralf{m!6B=Xkng()@h6Xr^Hu{ik-Z&XVp5u58D;#a~8(0}qe1#RjFpGuG>vKa{ zn6$8hb4Hd7n=&ZWH)68R0Q{t;B8AmA)q|LN6`S_Gpn?W-6+MA&*+4dcOZv7_q5zx< zv>=(#FrO2;JPEYIT_v9`9HRz8t+Xvw%-UN9`D}Y4Kz7mm~RG+Y! z1nC?d^l;_sChvi)skENtn_Jqj@IAzWC;z}+Ci5UtRxtAbwSm|H*xwRSfbesRCdlS5 zurY}*B6b3`rm(e1EX&7DiDx4C+nM1 zZNZ)|4PI0`c?tQic6DuIZRC=MP%Swr*zMc!m>~`aZ4?@7mv>O9YkQ#-?!Bpr?jw=_ znf8p`ZjH2(E^+X<$XK7`{{`WwJsT!Kgy9Mg479xs$`vK{PZxXPZrk16W<1@}W@BL~(Xve}?}!CJ0sA7n5@;0?*aox_=NN}5 z0P%?`wk(q>`qP9-nyACtV*f;C4O3^3N-%HfDTQzIG+7AOF{3WNnKzjiGk&AIscIs1x>r?$~u{te38@rn=gv z4!ovnE0GZ(G-7GzJ3!VZ4GbzEVAVy}yVwz~Ee2S%e;s%uBAP8)UP-KFfAzx0szD73 zCjATBgv4{i@k-5Y!scZ5RxM1VYg?eR7-(v8RU<#dt;ZP{6E%d&@(X83{`GB<$%lwm ziKws(3esOmLLTFJ%2!)w>AslmX%rTNh!K4TC|+w^(e7| z9Llf+q0MQiDsd{~6r>s}dM`-V1K;hK9*P}A?BPqV1;!Q>$}_bH_wDnxMvq7~43ZXw zD~N2(mQ=@gSg`Gj9r$YBIPd@#tK;rOtS1ea)p3=V)?1(|ejr z$@ETG)Ir%dWA?)kyC;^fQ}W%SFap)hVS6VfeJgoeVAk+?+DPbGa-=bE-Lghz;~XYm zrrF0X=OpHkuuZ_u@yj`3xlIk6gOziO&geOpHq}wB4fvgv&1qr#HJ;Ld1v(v!Xk=0~ zTO9&x+wv?Bc-!U@ZfL)@&ZxY2lh0w|IV;RYC#(>pe^?Ck0r;zUsS_!NR^`IKK+WmK z7$sk6joDH!p>?*ih zhT`9Fnl^kGV`IzOXVr_f15NBW!fsTn-FII{+Ca0ypJMjEJjKr8^id@LORTkJt;_y* zU2`ltXa74JpK^P6FdJUjn20<#q9^q$sr?Ld<-mMhX?;(@3}9fG1KUU1n51TN*<8kI z1ZEpyB{EuCO_FnnF^aCb=&478mx43ngrSqIC}&PJPO7>EEg9(~Xa>pSNnk?_DAaW~ z^-)LPQB_a!;Mt>k)+9SxQjKd7#m8%eF9>RGyq2ZWiZwMiE73FCT3XtgXFXGm@K7Hk zcp(pK@@3L0+oo#A&BQ4s;&cKw$)-ti48$)^Mm1A#%VCZsWp<)v@r%I6wQFd&zptmq zl|(0FBpFtif77mx?xC%n!vp**0(H83-LH3vulsfmx!-T$?}N1d)vR0yJz|&(Baq-I zgxF(v$Pm#CUr&am2%Fr=7v7Og$d3F39z6j6XhO-1CRk+7(L`hvag8E%`3I65hR`4fvURuhKIU$bdgcCqgO0MAWp$OGl!Ij!%-S)fVsjZ z3<5dXszKey!;9EG5TS`QoSlL`8e$sc4z7kh7B+4&s9+s|5ruUNqG(0WR>-*tT~Mp{ zGJBpNmfk>~Ds^?>>zp>=XIFRc(0~wp#4crz1dDnKMEyo;7cwWIj6J=i!=Q-7I%%f6 z1_nYB;MjHgFJ!M(fZASbwn z9a)34AOt%?95zVLpiy_56%66b(j|z3Ef@)sVJ9m`JB&fvUft<1->4htPR)N!O20Jx z<=8kC+x(>s*0a$&DChfp@$JXGpD335rMQ_WWH(V7omwHKL2>UW5Wa>B2t+u9!x~Nor{tmRMZ7Gz^q2VH9JcfO6~yr5D;Z zwzwVyA=(&6t=yIv?Z|GW(7I@)*ICaA;WHQY1mHJR;cVr(Pi^j~o$@5`iec({puvf=*wMMtKb>b)*gk zx{nr`NdGOK$z!e;6}@^*fx{%gGs+yGti%>@Wr9{m=o8=KTBTjqLDx*FNQf?|w6`k~t%&T2H$Wg#!7_;=$HfFf zB}j@6B?+6Y)CHqo${z6OMh?iDw~W26#f845ueY~jbKk&FSEsbxdl zcUyZM)|#$|BN{m4p;H}Owa&PA_P(jNZ&z=Hk^`m_v$P;EIjFQ8#8A-?DKyMebHt4t zgnMv~s`PP#iBTY=@&^8*ag}_cIbC)aNv9;LcwOy zXDE2FaP`#+=LFDZzDZH4B{KQdMn0j=v**iWR%Ppm@ccP z0s0D!dNhbM;me-<`H)9KfE<>-1n80mcpt@>*shls6SIt2WMh^wJw_(;FMAqFllJ{M z+_ZVs%()F2s}H{sx9xVpB6$|M$xK)KjAVqF3j?LEquE(312j>TZ;18Pz)noV0pnd6XE*~EzrLzX3e*L?TTji&A zWm@E3MD|sV1ieq79rf%HJajiBqA$2J!IhdRNi5a3LPVLt+bg$WN)#wXjSLp1O48Bc}B z($&$~Indp^bFj-92hZTHCc!3t3fu~ErY4Ms*6bbx{jpGu6}QdiJvBPEZ0Q$?*{%LrXSGx08RmuKehm``TNdBMZSj#%E z|5t3z|7$ircK#oB0u)jJ*-wr-A2DB#ESkz^9dpQvHbvKA{)cGWno2rkl^r>o2Rjw+ zyELjNwelxR6wDg%M$2)PLM{t_QlO_tqhZ@~S}K=I>!y`p1xHDVv=|2&!s3`@QoxuZ zK^5L=+H!S;Cj-_36Bl6~@iJNVbDJ`oz+}+mg(*4s0|tdTIfzYj%T;g7=PPSo+8J>9h$Bg~X zW(=~fNC`H^LQ-xg&Nt@LJG~4(MfU&6S@8c}+tS?X-TzzW_W#-V9ErVsm!58EF6aP$ z#N4}WdZ+H)YaI9PC?p1KjS*|<+GnOnB%(M8hQ;&J zq~}=N{z~&g+cntH*)h~X=2PudEtQ`3cJ&Q(DwF5YBvJ!33_3 z=yC3DYKzpA=F=2=hKR=>VpBnv`yfT8*DrkrK7@rl(q(USo3%NFl(&6;| zSYhJR>>k1)^ueU2WrD#@5K2fBF>*|5utI*@G9_I(p^rnnc^zG4Ki4^*bNb2Sg{Ii* zFtD5jD-j}QQ?nOB9bm4#tGl_{&i2A6{IrbGA(41qn-xYiQ{cO&!vanxe z!hnM~DjnR;BZuQVqMEz8XNqOm&Xq!g(|47Gm`S$v0Y*5c?dvAEFt7;ruAc1Ea6U1I z9eYU$a-81T(}|Wqg3lDZaJ(kH#?6)Vk<>&d2*>eZT+L*(v{?xU$h4(M9(RsS0fT9b z8ds+Y4>ajkLU0bU3(N;y1HmZ`3@CMTEN5Cem{tm#43!dME{`5^{z@o-y~*(@7&db$ z5$X|H21aObx4OZ;o?%Lh@O`*zV4!cnaoMCEn|0KDU+jpq4TduSZB|2f7?n9LMF2VV zr2l%LrzkoUVW=NEKh9pL1aj%!X|e^-dI9R$qg(YR3$2cRKSmCGhryRs4(h>Z2P{U< zhA(ZRHIL#W86ly~#fd0?oQOO;;T09rpd2A1N4N9M%6d-Q6)NaB z4Iz;rKDL3G@Zw2bv$5v!>MNUnbxE5}KH8PG6zYx2D)YdN&i<0NMG^x9-rZ#Tl(OVXnS|>HU%%|Ae*Xvluj$^^bi_~Qso3?F3%yA=^Owbess)+#!b7L91f%o&o*4UA9Z* z-E+&~h%bku)G0eRjQ6B!b}S=gATi=r(zzTBD_gt!dN+6Xg_Sxe_-gdDmhlujf_QqB z`%o9W`#efqpxKLAx}YuO!u(2bNG4c3Y@g&wxle9&cSM|$VTYTsUozK=&cJUNFL$Tw z)r`PS)3Mp5yDjE<>_I;I_f;3x%23LGQ)E?Fa4X{3;RT4fPFO z&@WW$XQoZcWEPF@rZUu@C_nhUeb`K2zl+YekreZy%-er&-{8*ve!^yafPj6$%w-^M zhySnv^+P@_aGxgtzi1XwT{>dC!8%1W_I5b#x0%VvCvvP*f9KZ;?c)$4>z^LuAEHaz=C7=+&%A zBfA?6S-@5?Po14)d+FG+-M3mUjq2@ue1g<=ZB4vxB5Pza)P1LPCk`5; z)+F3_;9aWJmO4V_r^MZIi@5z`o;}E8uVwug-R7NJ1*X?)@M}ObqY@rkm}|Nu2)0;s zhX@MF5`+fw)dxx_Sa)#yPS@Ns`oSA1b=1;0tFbLtOA{Xi8`0T5AH)Wc>+v?y2gJf=88yY8cGdJRx z9~RzL&+8gs4ADjCyL8;fB8g;DnV?Q?XpmrxD&*)g=GPW!sJpj&sJo-58&U4d+6HrR z7!+JkJAQyjOj97bX<4!ZrTizQ6N%XYaa)#r$qn%O2+?*HMhh( z{{PW6bN>Ic@!|1*c6s9e>^h?He+tJ4@b%fJ0f1Ux?g4jtOHc zV4a{alpYQ@S`7Qb49=y$ISYt0ROkhF5Fa(K7h%uTeBt~|A&u@|F2oICR(Me zDM#nUKCg2AUu^zCV&BnqczqPv|D&yInqBk1wzXw0{@<*8hQMH!oIxgZhz19yy9zlc z7%7b11{9!}@vNQ!w@6SQSO#?)bNt4V`bbvIPSucR;4BBXsiZk_E=o>CYHEhY*#^e@ z0FABIR)exSG;d}nvJpag;?b+Ik@c))$w9*|8c(LJd_}3HJL!)cU~?Gh2MoudeU_I8 zoT&=Z%tMOT+sX$E)stGnwZ2=L>16UqaLp7L`YJ-CRz^gM` z&TJty?7Jc`xerDnkr1w6))Cm$(9l+(H&Lx%E}c>1yMt^-*M6J0RiYNt&Tv}^3Kp9p95@BSG zWE&dkn@S|Yh9SPoQhQVn9)ZyW;ZGj?OwXDCMrSLI0v29ajUjH~I~%@JVA_qlp^uMi z@!i~nFKDI6945nxmQ*t)#0WzdS|gJQqoq+;QIkpVKM3)Ae=DV|CpB;{63x&^6|jB_ z073)uTUG)zcwjVuyBN}9AO-u~2zPVQ5^Mta2TVvvMdrF}-)++taLoqj2F{Hted^QI z7s#cxJsBFPiuxVY*P8W#FuijI1W9$=paTTgcp#uHGtV8G%huMJhZHX){t(N(v+qz| z#4gMQ#erd|Nq_vZDO5JX93g;GiJ1?@(@d$O5$BKrx1Ix+4>kuJoSH&?8@u!L=R0sl z$ayg13qfJ3@ol3Rc)Uy@0P;*vNuA2`krx6t(n?tXg&^@6w&Epf@-Olt#thirHQd>? zdFM8VC@AXtlNu=HnQEqIX9v@`(83@MgC0JWfi&8-=8ZGEa{+99|u|&RSMK-U!$%RmO?3zAsx{+1dKD$Kt?*j zIeT6L{Jx8+rVzxAs8SH%n&}Z_{*Nr^41+hKkuZZWCL$EjUvwTo`#l_1CNQiTeW4@_ zk)S~DiZw5qxFm#(jW-_fVZ?|J)bYlX-~W&{5s zQvKVcDQkdV(b=vP0`)ywA_%SsY~jfZoQlSno|jM#5sJqnMC?pLg{D@qNG3+!lPyW# zqaZGrgqtOTe_&4_Oq&Sd0F#7g5{@HQZidPU!}Qjj@~NA3)oy{>S#{D|`%1a?$P^i~ zRJ9eVqEP6nIa#FUNG290f12S>3;b!VVN5G1A0h(eC+P%NHJ90I6QMv@rY=?~3E?ne zq1EEgX8C7}{IfO04=3o_NS8R{A>ch7i$pTb+G9d{#I>f#q)Ds_Ppa_Qr`#lYk#Y#EyONAJPYQ}XPmR~Vu zL1qHY_G3{Rb_J1K!)V+&``VlVnF={V1kukR7Ukp&Ex3xS7mh^Ys}ddB*}UFp(lD~f zjl_zy8e7t_s7=;BOOcVY|KcI#>HN-U-H`t4FTOZk&sPk`#Z1T^h>g?-s)3e;GbT() zURt3qXO~b2BQ7(Uu&-d19c*0}nhwc`Rb$Q3aC0oYZe6%Fye1qCuM4-V4Y#(2W6@~H z#f^`8+IrQJRxz>~SCgY$QgJ4*S)x3$bD7N^s*CyXCTNY#e6#B{2qvWIMp|ULdq2ho zDnuQzQl>6X-R7BX^F?UMMtteyM0Q7lH-VzibuTYTvA45JQ>e3I8VO;j;Fb!?$D%9@ zRgxKUa@N(PBhv?J!Cu>fpo6tUl*dlE-h)2MfE{swdDqE(`H+$l6wbo@gviyTgrw|u z9_CrE)R z!b)=kjGsCvCJ_-K=_D+wgPD#oR70o0S6{*KAkU4hMRwD5bAwIUrD&f6tX{x|MT|P+ zNTDzh1a+);3?a&Tnk{NZL{FQPv4x|Ckln0vR>`#h2)<-1vh{+r>$^|`Y9Oo##E6B9 z(6GFgN+Msp0`a3=I<>Pyrrd?Q(tOu;OrK-Dhs%0rk*)GsJE}OVi)1UoT#o>?zJmDc z4A^QV_^Ly^v&~uI8enQzCP2@H&2+9&Dtil4{AMK(D0r{p(wm{G+}&^Cs~UQnSY1sU zkQ0~k2-LQrj>1vQsSEE`u$jsoQFN2~*9YT#KG9_--bR2OO$0+Ubq=sY=~1xx(w1h( zCn{T4sBv&vVkx`w5{TU=ATi`~1rO6OqOq8m?wc#IaW-W|8_d@jB`ATD<`NlaR>=<^ zpvlwez)Xr41UXN0eoYBvSjmlu0VZxR^vv!sGp5q8cOQbY`lN1INsZBNz3<%90kA;8 z;3TRfG>cv&2Bx{?5cUby2rl_UM6}Nw1JehlOACNWsuO})RY2jS$SMkZ%z5=*l39<} zj%3WREb^kB;

    @=p+Pl2R74UBM^_PJ`jnJB7_apD|*_r0Aa>xzQ$l0NMjsep{<0T zps_n?fI(g&tC_i^CAPvQXpFl*@}78Akr)fkEne2=n_Tx~7M-+wrxo{RYVXLoF_rv3 z0GeC)g#2gA#olQ!>ozd@fe@F>6B_)PA-0i9_%j!#FciYd0F$)}Zw7+I1SP16e2FnTVC{GT#%@McLX<@sxoU4o^(l-xix8uy z$+~N+s6_&m4{b@C@db~KkvBzx5(E(dQun6EAPA7fV&8|_6p3bJO2BL!0WiFcLTFME z6;M#Dm|xE*9ztSbl{o85mU>zH7(@Y14UTj|i*aiaaY}4j3cC!HDKW@NQj}n=2{#NH zBQ!tAA(5U$>B@Sg+0(dX7`tKnr5V}`J1lvyb_{#4_zi}%-WV4&j6~(=gl%ob2!*Fz zDuq&3x=AJPjLWl2OIY!YJil?9e&Qm5*ekB2KC-lrc$IUuo{`KBDkO7p%@J9QDAiF}J+ zLJE{(fyeUBbh~G&>5~M^H93RXXR(m;n3F)W&kQH>@(Ai$rMa+-2KZV56xcz7Tquyo z;%u5F52Y+%SC}glrVwuczJfTim!9LWL-tOY0&sy%f1>2bA*De9bt1YMVViP6Si-YC z0a*q?oS&N99MNtSAvBF6nS&=|lPe}n#3htRlTrFo5L59>@7 z+D>E%2^pzi3=e6};jg#?0FhrnX*1iaXCSX120giMvKg z&jc!mk>gP~$X11*_0^-R_Zt@#$<+g?IFcOiVT(^>OiIhZ~)B>P?{P&Qv+LWNaM1jVdRyc7zlN- zWiMVvL?dfL1uBlvijI37>YoTi^sltzQT?l z>XYx)ye6qhrXz6ZC$BrsNLEvKdo0a4xmifk9t6^9bJ;+T@E0L3Zz(iS1(v`6{P7s^UPEpZ1X9hc#YR)0|`V=LWe^Iv!9vDmPwm z#NwO^)_a7HP*((eM!gXxOy-`z%oa%rkI-J`9jc}VcccLGj-b8}G}b2R%j3Agck(a` zrpr$F>;^3W8!i8ihYtG(JJhhB2|a5~@gFF)3O^voB1jX$BQ9Wwk6;_%zfIR~damHV z?E7k7*a6ZM`?kdp;ei_%(+iA46!sGyD=}QNH&o+`MHJ|5EHYdvd2w*K2y?FNrQeYK z!hXiCMV%j(A^gNHm2x4<#!E23QVrVvJdElj#V0GuwFE+0uYSROx9T}-u*RrZ$j_d# zK+KBJOE`Lcgr!`!avUtG8WfHzw!R)~$#+3^+o&4jLt)LklxpsSG^@+WANO=p&n;bY zxW?5ifmqApg$xJ8@eYW2pRDsdY6h9o^{h2|mbdPi(b!pM`8=f;2c?zvZP*V2A3$UF zxY1Ec;m#K}8$8F4SIX^0Okx2yu2`l!l;%N#wU(VsxG(g>fQ~ZcO0G)t_I}R zrH&n#r3@)<;6>Rv=J#x!&qJqM@u>it_*fi*{9G7oDHZax?+=VG+zw78J5sQ$z??JkxFZg;U3f6#r32|U4N zSLVjIpJ|&9^o5EwmsU)GzDTjc(7Vu|$DFkI7z#{6k&^jGQfMk%H!K+PK~F2Sk>*h| z5ca#L!BYo0;2i1rMsuISpHkv~@fdA0?W0)yzqQRRp7>u7|8Xw@>awC<3y9c|fCt8(|P0&>YcK|XPu?QUjYgKq2Od4u}sXh7I5Wkn> z)-$s@|0S(|dMh_$7EmnycZ)mzXLEGzy1Df~D<9z!Oie(f&LAi$LN(P?l?Ohlx)Fhl zNkJO0Kad?E;!8ENdK;yhLuTH~t*EP=$aJG^&@c;5P(5njzT1hdT&BLJp3;+QHb|Xa zg>uY~!kE;uTpXcc=+KH7Os)g9CXGdhHcq07I#11JZ%w}-gDG>2DjvxfxMngj-#s(z zqv~^-Zi~D@>Bxw z#m17x2o8(mB8YZpVP&^A6;>wHBt+P$ra|lCVAw*SMU5|c&lK#MaM=4Ca5$nz{8qE1$gcPkuGVn$L`k>7$3+M`8It z7G1Np)gAx8rFky?_pE%jb#Fa$ow~1TU)787Gh0+Hzu^t#cOhxPAM_&N=5}J9gaN)AOW@7cBM-U}}HhYK(K z)TNhx`r?c4z3j5jjEvkrHg>5tOnlk0zBo1Y<*Tmx%A4Q( z)oZT#%3I(1*8ThU-+1GV?|kPwZ@u-_4}S22AN}Y@_wD=Y!Gj0yzWeTb@4ffapZ@d% z4?OVs&wu`lU;N^O4?cL^bq~GutzWz8rmw&4ZQpp;yS{ngz$5Q@&!g{s@3%kjf$x0a z1OMlvAN}4PcYN>8J0HLM?tlB_C!hG_C!hSsfBeDy_y6$z`=9#ffBw;zzx>mG`InzQ z^w2}!_{KLLee}_P{nvjzbm-@gJ@(iSe(-}I|MleRx z{y+ZXh3B68({FzB=Rf@6FE70C!t>9+NIrl1(_deF@o)I~e}Dh`-;Xp2y>dQb_ycR9 zYUxW=tEx}me&4}|u3P$=hKnD)?~bp(b=j(OKD7P*JHPSvQ(7+n$)opw?2&gXTi$kh z_h;|=)-A!of4KNtpS}A#?~m3tzpdN+<%a_MFOOXRaLYj7hZmkyd*g~fKCWyse{pQ! z(dW)RXZxl_ThEQY=9!P(weT6G|FVViPP(>lg>vrvuH}zx(Qf?7f&Cw=xxH)t9iKh@ z46XXs56xe&a@;&{&Wcsl?};9F*Nx{6Uc3M4Pwjut^^YC8x3~URH$Ss!)4uP#f6>rW z&wS$U6Blm3{q(b*9zD3?j3pmlzyFv2Gjed@*4qz#@<)$7{;qlR7Kbl8^uZVB|Kzw& zead>zrgt6Mmb!4;+ss2>*uFXaKIOJwJhtqnsxL2j?guYjv~IyqnofV|j>N`CF3axU zcKdBZiTAAxoG|afzklSbd;j)_s&N0tg1eMHHeQ@ueuc)u8QEEST>!#GQJ^d?|d}?{M zGSKj$eNQg@{xS0(U03&x z#^aaWvFyarhnKF{R`skuJ@$_$UvuV-pIq|&n(8;k zm#*AWefm&UhjIMSp^ob2r7IV|@fU3mKXTg>Z@Azex4!$7n-6yEKI7?M_AWT-g|{5r zHBz^)>N9KqL%XDpfD*LLfpCpWZaUN`yR zn%nOB&V$EQ#TGQ|*}wGunw(N~chj$ae6Z@Tsk=@-_uXBeyxcSLLcYagddfFYCe?9Nv#rqZ>_nv(>9`nbQ3+8?C+}p4C z-uf3`S9kXpzjfbRU)ntSpX+l^Y0{ZNBl@s?UEkVqCrM!JmC= z{ifq@IOB|Ke?IW0H>^B%N1J;6{I35!?bDks-G1P-1=iP3op|uai>l_G{M{8pTR-x? z`43()?>h6(+Y|3T_EXjwZ@K5bD}Vi^`V;;(@$*FoH;>)B`MnF?KJ@uh)YnEjcHZ#Y zPyPD%FTZfh*Tef3CKjH0@-fGbzGMA&=KW{YEz6GmVdLLl{PVq^d9dp2Qx@KI?7crs z4gcw{zgxQUJvSWqe|LW`{pSU5oSb;#v>$vWxHRnNiSWuDmInCR8_Jle5f;#VK8y7kb73%~Wu;&s`D+t=K+=(1z)JmtT)SA{$K zb}szub$|TQ$#)$5P2bM!)b$JB@`I0Dzv=EJQ^$U6*>%CHW1hNW;uCLw_=Ni&_*&I- zhgNnkeQYrB$3=@n#=F%I9s0qur#!NK+5THzyyNw&S3PvY!V@1oV=A-rcVDaj=6Ch_ z*KfIb=;7;^qAXT*LbM<@$~$ITe=Q5_xv@ysj4Abz2dk3bl}0q|M3Gq zUp==OM1V* z{PDo%Meh&Xwfy8w$^}yweDw3@J-qwpH@|Puo%bwT_v}5v>g_|DzkBeB|86|*{;%Hj zSo?x2pL%%fAG+p0c5vIT4pyaqk-YM?sh6I+> z7v8&S!=dy3{>K;YP;07Qv+t^>jyrMJ*_2uRFT)(UD zjsN(wGyWRdcijKZyX80U?0oHiUi8t4`RBbWv+VqBy_eGF)A!GN?gxLl^So&18=tS5_ut2z^7XG)@2mdyz8(AjXaCZF z_+9VaZDaf2(9$*UyZZL$UpugL*S~+^@_GMr?WPqS^N#!8(AVoOzHQOSriD#ccO0`J z+Hw6mzVx+lU845{^}3hdxh(L5MHe<~9(dQn_l|w%(v4qyT}#b%KY3x~+4HYo+P8A> zX?63z-S@MeMq=EUG=Tc|~H`XU;yM@zd##Dqi<_Jt=-YL`}5n{pTBDP3-ir4HoxVbk57KS z>T_@S#IOJNv2)iw_08>@)ta|_>dQ;N)x7e$OyltW4Zr={!ykC6=K88d!Ka^%bzS!3 zn>YNnYGdZQhH>?no_qFx_mpGrs9Jy8$~T>V`qqOhZrFaq#8V&X{aM$)Dj(VL*)O&4 zx$m{d{o9MD&HJaPZ~MO=`})$S{`FtBeCLYl)4%`d?|=2f=XckidUf-P?Posn&sGdiouw&gta^oLtNQ}^?;<_EqQxc=FBpIiIv?|T3H%bySa*OT!>pR2uZ=g${zx^w3z zPTjiU&Z;Nwp8VyHKK!?D{AtmZ_cm4iI2j>$koyR$qPTq3ar-oY&BQ#aBKx^ucAFQ+Iu{@i=FEW7g7f2$h3VOjTMji-00|5 zn!j*SRp_b9|8U~@*Bz|-!6%ka9k}GhwQv4Z{jxJoNiKM->LhdOQ@>2#{Pc+zD)W}T z=IjNVa`PVD|J5s&9P{|%t&dGC?O3$@{mZ`7y5`t>VvpZ>#?Y?ox7|7Kk~?$TZtGI3 zs($uN^U1mEjvv`^>_ba8Jhd#jul4<(>&^Y8D! z`9H?zJvP{X?xMSci4&Biftwe;@V;e#|BpABkIehg=Te7GdB=%W^UnU*h3~v?-ovd` zRm(Qr^JrkjzTS(gsun8i<~=>HxF1zYL-*10;dH>Bzf3@db z&yBz9-J6#DzIA2qLrYd&cGgMDCf;?R>&p77u}v$_e!Ahmr>?2@l7(fgNV5{o*OW#M4e8Y-v?O?P zwb8%m_$QTlmn}GU`I4noLvMWir6s*}lk=(;f4Od1@8o&UC6+xN%%1aTY|Vi!BhjkR zre)VGOCR%C)mLs=_NGI_fq5r&RBe6Z!TG_1^Us@l@A)^q_m8KndhNbNZ&u!L;IgIT z2j?IA#JuymcdTDk^@dHcUp%w)T4izFq3D853o~~uj=rX9-d)Qs|GKs6ig&E4YdPUH zw_O{$?XxGn@sy|My}oMRFAXc> z)0SWN*eS>E-+RT9mUm6ue(h72H9UD+*1Y|l=VdnHhZkl)KnwtG5zV7j+JO63f zm+v`$vTOHe|GF-F=H{FKw5#Evl~H}!yY4&d1ylX*^~vLN$%(tqQ106my!j2sJ+$P6 zmo8JS#k&ulH@5wS(@wZ=-TQ7_o;hGGI?{2Un{DORm4z z`pbtmPi*+|`xfs0_=llsrSbEN9j>d$`Rz*X=2==@*3?RBr~ zzb^Xvz#U6>?>q3@6VLw1_dmS&!p!-ZTe6QWTv~nml1(4Ic+292``VXZxbri=eEs}Q zRU?^O>hIWbLr&jwaNhiffrXiYdb< z+`q8qz=yQU-*d$mTb}vV$DVz-?U*K!8Ko4 zS=GLF`GWVn^@o3b=fYLXtW67+J>Po8(huF2?fC4L1z%XV{Q6BF56@d#{q(IX_Ad>7 z?6%u~`}zkTYP;{$mR+l=mi4#Xxa$)q#FlQ|x3Io#{rvq)wW@`6oBF@~m*}2vMo+wK z{-*xL?fOk$xqZd;%NBj_xA!i1eCbvFi!XS7!I{ezG~PFV_4D)BJ-=Yr8SiXUXz`-{dIp_xcK=Uzdh$o+kfzx`5lWsaL=dT zabRWdrcYG8{oZve$JgAy_^#XUyY7zHr27|EANcgL4=&3ppE;vr>9**Jr(Sh`&$$b0 zltuqmx8fa}7S$f}*~Jen-5nh}^)G*3{*FV77u@^V70Z`=;GU&V{KK;Fy#!%Z4{m$l zls}%lL%DB7Y}10+(ypf$W)3{C>8g?B(+k_LJ!Rm&#i_>@C%(P-oC6C3f4gtTX)87c zmTcP;tUh?>?#C7mKDKztzyI^)U;bS3$Dd38?Q{R{)MZueNA!&A`sCIB;T>9J+)5=6 zyN|;9zvfs=izol*nl*Fzzh~vMer0FhmZ1y!yA+serGMwG z<^1hKJ9?B@B&rNrSv_twHFfpkwRd3LvNCN=O_P(8k;#^bksWIq8fe-B4aJ})``Tz? zwMfEB1UA;JhiCAQrY1JxmF;>rO1c4;F@&IET)NL94HiMB#pOzP>~N>)p52$vS#5NK2s9=B zOxCzuBk%$Ig!m(I(+ps=lnnt(+haAs@1~74)$8H9S%K<}U@JATA+W_rTUy#`93q7S zXn#b0v05<9b_Ki+OwHP`b7*Vhnb6AmCOYu-BSvCsV@=Kagg&9@i4EY+VX1mr%Mu(_ zJC6x)iCo-*hwf*?Nn^|iY+SFFFfdX~PmL*Rl7QDks#$u*01GIJ^nhY!;{*gpb_lDzLzq(6!0H#`AR386r@4lA@PXEZ72gvgFLb#zFkIv^wBy1$JhE zjh*aUY4r$)vyALiVB>c3rOu#ZCM(w{t-78@^AbxR(UZDGn&}oFBvdl@r8N}K5|XgU zptoe}GztazZIoIY))6e2t!h$(HEEcx5v*@wlgu7SEv3|SPEBG{fsH%x2UN~K-9iO| z0zw=xa0{r>L)!%gAh$whJ(*-Q+Ks=w3#G)y2m(fRvi!H;zd4^3S7JkKQ3f`W#i9(- zA0<|WL|(scOjkl90Srl7&zjL6c^d{BZ9>U^O0^QbJ+HTIE&1t5> z-%n>YkfjAS)^*caNGJ5TM)vPfb%ZlT%gve#t^t~-UDr&u1~%&>N!_rtxM~(Af4L$d zU1PTnG_r+$DKH{eO;aQEmDH~!s2}8Cr&HTBks%J!FQt#%R5Lmo^k7GSw^-5DVO&d_ zoJaJ)FMD~5!=#8XEydRB3Jm- zE4h@a5OT@lGEkK(a+;FSvMC6UNmw&E&}8`X1&dG$isu^IB}3VP)LLVrk0*Ck`ubkZ`2H#Uedw@g;mi~AWTMT zYIYJ#CI~hrRD#GcEiLdm2i+$5@&DPo7Wk-&bH53Jgn*hv5Jc3I@Y?8-2M?ium?bPp z6q1kx@C|2oPm+b*JRLLMitH|uiq=jmLoiT)X_!JwJ5+~~?j0gt92?r`K`O?%Uk(Qkb83>>A_%J@Q zoSc$m;o}fe9JdUEYF=D%?NFe&CVxqpG^0EQ3~J9alglc~*c(Oe=c+9<GBrBBIDW+;*tGCv`ipufU{&U)TR< zRTAaw0;X}(3IuIaC1?(`fkCoqnCGEu;?N>h8>iC=hS_B|n9%Pk3r%DrRMPJ&(m4|* z0^cr85={kunNU$N`8*=T61*3F8&9%+*+rTxMi5XiLjGjPW-A(Glr>}$at#P4$-aVd*-nf!vh*Puavz~_Wl$=OJ#B}b%)3cSm%e5q8mzpT?w%1dURfxj?vf{Zqg z->)Ba8Ft)3_G!7OhU#ZC-o%KGg!~OtR+D7Tz&)Hue9r}C+;Y8mAyK=0(GG`MRIBm0 zVk-*CjwM}@F@YchtV7D*3a2~aQVYq+iV>M|rVJuav3b`F(2r(Po-GT<%5X`8io0}1 zIew$BwHzQ@MyAp%;)l#E1t+bdY+_Oi){_qfbWplCB)F*%?n=;jP6?C`0ylL=(@uvfICpu|YMQ9X(7M6N|zh}>)y zJ35%T%D4)^AQf_?!lvZ>rKRJO^jrcL0%@YaCsV1AkG7}s2yjT|y^33_l4?BhP&iGe zIRbw`G4t6m56R0~9In#;Sqn+4F$l-Q5C|hTwk%6_*jm*t4?Ch1vAcT%jls$Yo{&Z<-5WKV=c5iQWZ(j$4JL480{wM?W{8ywkEiyGmS)uftaNRu@+ zEPG&&stDz$WGtaeW;Vhff!^JFbRE=tjMyiLz0w`p<= zwIs<@;VztV3stSFMkYwKA##&|r9yFIL)KOhykv%@@Dh&vcgrLg_72BNX$w0U)X<8sFFT-k79-ARtD>quLP zEMhD{WUEf5iDeV$re{5R2yg4W14205mL&IeKrU%lQ2?87Zsg1&J5URlT9bQ8oZR&I z!mCuJ(V#dpSwzrl&3DhJ@hdEujhe3#1`M&?mjP+W>DAM&){^nIP?ByrB2Ebpr8*Os z>W^v_k-0SYSJY+<_Tz$pT*wF;&LOIs5+YQc1$R(jT(c+$^QlEcs@)A2c!J!e+TwC+ zSu7bCPu_(L*`id}kk9BQuQyBzF_o~V8_qLXs{GD(CYOpNrTTINwNo`}>~BJo{4Gh(9jc8j&(t0R)!{) zRifH6L2?5_vdt4w;*=)|8z>q%%XOZnyGB#m;37_ThUpQcl$pn=p{BG<@}=@Wyg-I? zpPnweVp#*|u_Ni(#ZjoeQM3}g1yF)L7`ao(e{9f~6UP^!rG zNMvYn1x6(3EunBiod(a0uWuON+~}P*zNOY%e@1ha%{hgGNvM=}o0TM-5HMepiBlj- zi25MlI#bLII2L;_xB4<;u;p9yOIz&3N7n_XNroHN(?PnNh(@OJ%F6PJiBjd%X_KZ-n>07dW`f=*Kbs%X|kutatPf|5Y)0(qv2g*OW;U zru4;seH%Z0@n3!MUxyk0Wm0bi)%M>f5-c^$sKgo;md=CT7ZKJM5!M$G))x`h7ZKJM z5%y0I5ylQ^Qvg_xQO$i(U|(Mp7}!CaqP^tP?rAf9?jBo}`BAO;tn$S!U zV5-Ge%NEPSoUwcbSO^x7)ZolA3C%7<%Zj5lR1;t4k^C|_d+4_qGM0$jSSG38gaOK$ zyfj3D24IB<8l-iXDtSmI!d-*#E0af-4UhLA?4_iJd=36}87-~}<{F^H zl6=6xt%6V%WIXd9GDji$pz&EH+7Y60ivjBiFV(iRG=isrww0Z)uX?y1Es!qj3tewC zi?cP4QXgsBb)^C-leNX0{Xcwtoe2*lLnAix>_}*Ep#6*uCqTKA$F?P=v;I7Qz#NKr zBw&Y>MGGo1HKeidonUfR2yOETxy{-uXl+8T;u=D0qhYzVWdLG3z+VxhE}uhQ#UPn+ zLdjqeX+ye(nJ=EN(>OkQULnaHG%q%~pJ?08&Q8{}w2Zk|($7~91|g)e#(f$J0ET`V zNO8L}qVe%i!AoD05M2J;0Kw!CeUHHz z=&`fqau7@`z!w-EB8PQJFr9Tr2W#q05dUf{K$cw&vvVLO2jeCQ6AIe;)OqKW0GW1< zjnj22xlzcc% z5o{0ROVyyKfnUoAz0olCMw4bJk(nHAct$z-gKTT~EJ@x0_2}qlf&&tweU@1-8PehT3u)`6mjo zVDMB3au-xMBV-T4aFekG;#V=#z>*9*GMw0?r28iKw|jRFo;qj(uTBlG$e57mAebCr$j1VFy3Vcl3b&KB=O@ivKi)wC{`m`8Iy~;(z+$ zfBNvB`l5dNqJH|Ke)^(*`l5dNqJI8Oqkj5upn8e`VrGDpkRRPV@O8xf%(cMeq{RF< zBk@cF2e|=PL%nZcHfRk&USmKGat{?@2neG9OI4hRH2^9ASQ~QHQK@6COf)7KPPe$a zl4yv8)L?gY^1SJZ?qioH)x`9G8Y3EZYl8j-rjVNY1p*Y5k<{VHNlb=h=q~@foNoJ5DQ%aXL-#DZ> z;f8&PPIp#)r2b=Hjmf*o~yLI!KJo%+0V*%ZUXcP(K|19FB% zu&iL(l>`(Ln6V5Q!Bq4%vySLrrIgzfak72G?Q)#imw6-HH%=1X!vasqjoX6_$+Frx zOFZbfqk@Hc56NBzT9Mh2|3;Wz1;3Jee;9s=B|*T!Z+b#B`CY?LaSh4-E+>54p%5O8 zo9KlH4+aT7MW38!$nXmQ(Y<>(Ulk(0P$l|tGtTs=J8>eXmY7S5d>kC$I4_` zJAg~k-H1M^0C*2-eUtO(NFfGoiX3CJwhFn-2F2tpw8 zC4zAP22ooS>70P58j(n4!oZpv=CmyGHu0=W;Ezx~_$^ zX;>iD&9i*yk?QKJ=PszLpWQ&aoLe`Kd_K0CQPoQcL%t*(m|j=iFwfUiUFV%!ceZWw z**-F$lrM;6Sul@0-r{STS62_SYnXMqk4%hAlPE!Yv%2~@O{q_p0WGTQnyMGnH@A%S zBD2(!F-YFIH4El>rG{q7yP&0^$%m6|XvP=S(+|k2sv8>5YO1TLZ6PylGTv3)P~TiP z+t)-!(=3sujpXmKUP`2ezPe_qv7rg5Ti1-_ZSvJEB=oAQHpbULyYdlo&i2+f(6=vW zY4Ym*d1uwlt(#4VLYhE#^L%v;l#2DFSxbZEK^(|jZ*^TmJ&uZe>;tk@H#9Yk^%?Uf zlUmT+0RPb$%6PTS_$0zr^L)+o8aOZZxu+!2v(o3B>ihYJ{y6&o1nb-3z9YT=Z_>mG z6DqCsU#3jx^Z$J-KYjkcKL1}|{(qk*u+J0dkS5E0e?4Z%_BjCi9Dscez&;0Hp9An; z)dBb|LjcS$P_pr~fS#RCj1)&909@PYej>azx`S9!B5b}SPn6I>GljY#sAOeYJx1_w zslcv;C$%K(M@0;X&*a>YV#zqG1=FiTLvojeW2I%%0<7f1depr(2vtA^$`Zq9k%TsK zhRCe+3r$Lbqy|V#lT@pm<>@8niXXHbixGg$>Qw~7So{D6L(ytslqOfM5aSQm1M0Yq z$nk&;o~7i58<$5qlU%!$M4+scrXhd>j8Is%pxiQE0Hv5GO(N1a_{h-tOJP0Pr-IU{ zS7MMgivG*i6IQ}JYnG=9-Y$Jki~_+F8W=`rO;{LQU`?lu8BLS$C3B{=^7jUmknU2z z5veg7hn|YHCm^j08pptC0Exb#2%KPS>0x>SGQ4uJZlIT<(|3b=3b8BofT9%vepIfVv1AMvQ@{#8Y<3*llv8I9e^sc9H1 zK*kl(4=P9j^%&mXppov24kQkl8|3H@)~ZdI?}Ys?>JNPOaDHp(W3+(p zJIhS5k&}QF{ktfB5(@H)O?@kJLWP1M3hEn7;)aRPiU18#RK#EpMO(2fgD3|WRdo<^ zEUqD(EADg$a4GH!%JgB_8DbZNMBMEKX*Rrk6&5cMq70BnTV-+t(R_1DEi8~8tV8al zCqoW|sLW(QzAE*>iSBI(nUOKI$JCi=@mXmYvP;1m9|MDZP%TTXuazbr^ReUK_^Erhz^h8 z(-uxyHEEo3rhp_G6rew1yx$JF$9%t~>W|YMH%0vcw`|5?GS0PP=yo!S#YoiIuPMvN zCXgAnmUP>zGJ3KNNK0lsJhN@SF zq;o{jW@*@{DY8k$X|xE>$|QSK*E*76&f+PM-e_W=KupeNhLp90dI(&LByT%VR+XPH&`9zsqd;y^(j!BXl#W>UZGA>0?u{=p?MlO9R zS|iXMEM|*ZzZR;zNN)XjHsgLc8Y+^69OPUMMeW~}^1b*nrH5{*ik7ZpQwyn$h3b(A?sbc@Db_4<(E*qU)HTJqSfYp@*K< zRZ|iXxib`vL1=&_0a*VgGXm2Guu>z%C`#>(e<>CLN<$PcM96{SMPv>@rs$?GTjKY6 zH)u)6b(B?#Rf82DK)vIVH35~p)XX=HIgQ=AXUsY6nGiV@>crZo1^2`tG`q~&Pgu~9 zI7SO;YlknO=s;l^0SzcxMAdH@ED#kC%i?jYkz$1%U=LbBeT1{pY7~XJ*&0UqVOgu+ zl@i=y?L-A0`Dg76M#{Xb!qvbQqan@iz>(XF9?Q2PFX-4}fX2k73LhDwGI?lGW4qCC zpa{Gh0LOyo(~SIJUK6;tSYHBp`%tkG&>VPlpA-v`+a0#B=K&pz0$(782V)(YxGI3r zF;$p?d)XnA=w_NUwM@_^0fQ>TiJH%vn5t*@p_>*mAgdPFK zF9(+C@C%2@18Op1D{qA_Z8*ST=y2o&AwW}+_#Yi&SzcQFD+TLC@`))CfYYc$lIa#H z4@Bs8FxAU!iX(i4!Ia{2z(Npws_XA`13^I}3DQ3n_= z=FRv8l7hT4<0_Y=BQnZ1A|z-xbLk(@j|VSX%%D(u$m@ygMc!dqN&d08hWe$OhtqOE zJ0NhJ0#`6GYsNJJLhE8kG!6iKrfqd-Zux-snyerC?ZMH6X2ei)V{0meTZ#$Q6xYX; zc!j9YVTOi7x(%uc8pe%#m)XkDrtGj4;f9T-4SGL}^WzuIk36n6O2fuYCThXD0^$0a zakURqA?Oe!lg^%Lp_f4m8Bv6zn$y*Wa)qGm3t{pGnjzR>S-iT66E}?59%&K$Q{CLm z%-JSdgFR3%E#SUa{R$BVprRtZ)i?m^fk8XYjscb8t|FBg&L=e1WTP${H3Tc6IK^+} z2Erb_xha4_%!vY*VK69qnC9RSx^?W;@bB8VaVbV37?C*PY%E83YB9UMv$oDJi4g|c zOs7&p9U_F>1-zfIOQo0@ji{0sM*aZt%Bt zh=^IMf17WDu*JV1^i1f8-Z$)eD#mAx?`dE9(5t*?Fopmuf4r{Sl zZtSZAO;Y!yu$j`Eg27zCC*WihSVcS~88Q~TTk9t#-7s20^bkPO8klv#Se?#+#Qc8D zI;`LL6a=+o;>s9brlf$`2^56oKyz9Agb8;Z;~*s31|n=3pj(EXZO2AtcQsowL%Jptaf2%jrz27E^o<=+3FFIf zJ_Rv#r$brg;Tk+vIo6$TEJ!D=hH?9QQp*zqXQ+63(fbIblgZ>@NIk=QEj02&trGdX zEG$#^zI5uT(l{mB77l6c0`J$v7C(5~TrIM8TC6is_OcHXO zMGB59E90*&D;sB)ftDvt64B;6F5qlmXh=hwHws_cywagxlNcRmlA`q%(FwW|E0s;p zOSnyoYlk;!Zj%i`tPmAU(9YC`)gRV0;l3njVLU&($5=eeJ~qc;d7vyUum{r!5X>Jf zUqs3z!{Tm6iRUIKJlgw8@roov@Rf+04W3}5c7#gX*Z5jWg=iF_H?nXp%mj|e2_6L^ zQJ1uh<=zxe)ycAj@9CZJy-IYf0)ACCV^VRYzO(xMJ%z@?R zy_KRwHLf{Cbm?1DkMK}U0Upe#VRDqxG6qD&66tG=Zm~;h=kI{3BQOYN2_c_iO=qUL zIz_tZK`Jc7g^UN2H&gFt#(fezlsZN;Rd=1bcZhaTSVC&hTz&+vijYDSrg z)5w8>az4;bj$JC`PZP>kI5-v>`Tpgb!ovA!?ca&|kc`Cj`>4fMOO|K?!NCYMS zgPcwixE2Z<3t$bL}lrxtqg$`EwjMNL$_`!0W5l5(=0x59)Fh6$`3C zz?$PGHXRTuEwavLV042N>Hd%sCBdB8^eSG?ey)}zse z?K{1*G5o{cSZ?4~cI9yFE;H+mcp?5{k#NIouX?jLult z$kIz-NT05SgH)9LYCMPzB^}p2C_-={zB}FedIcND&>`W*cH!dGCZu&D>UX9b_d5BjS;Bk z@E#-DPJb1lgMVcLEm&#$b?g(a5_$j-+#`g}Q%YyhN*Ubz!t25SfEW$Ur&=o)285|1 zkU=jnhYfz$vj3fDg*(HkigfoOCSO+(mFt48+{wBd>sPi^y+uhC7SXj-p|aVS8eRAN`y2#bI5zwj|X#4P}B*C=b z2S@e)?Z*-S$sD6`Snuco|7l9aq?GzElPV|l;Xi#FKYjR5efUp(_)mTKPks1LeU)JT z9{@oy;gpK|)FZrCANW%r_|rc>_){PH)4u}xli7f-ixSM6PZcNJDDHJi0I-Q^F@+5= zh#xVt-M%ogLi0_)4n^a^s2@&CpcTciXmaO<&a5SZjZ;7afcffq1?3JUdQI&lHz?j% z5dePasZ2Y@5Mf}UW%^)L;@UZML@kjl_Lv)#^s48m4J-Ik@*69+>*Z)KdL>^|oD;L2 z^Bg<+l9a0GT+g-+a5{U8&C}*dHW<5y52F-xkE_9#f&LdlnZwCLUxqfacN9ZyOji{g zRxB#0AZR(}7GWUPZvdL0>Z&8as4~EEjCa#1T zmX#h!99288cSbhBH)YfhchjE8j9EveBKQ#uP45mpRp5T>Kp>*Hv4ez}1yz(UEX>E9 zGR{(SeR4J(HHHs|X{9BV>!t`BNMtE)U)TtzQs$}R`#OvRKe9~rYigJblTbd*CN{N`+%Y-P-oqxY zj)!Q%81M*tSZ4M%9g_z7;X5s8Y+1J2O>BuReFzD%=|odx85t_PAnmkR8_7*?#?m=d zLY_9?ALeX~J9f-p;7y5&uY|&+UmO9fQ@Lhc3W<-zF&5N#W{jjsy`7v_CgohLs>P6FIO;=-#FEinj9R5zH?tMO0dj*6wk=#7kp{E66 z;iw`EESAIyT0wZiu`>3BkRwb%FBPZL9<>*i_hN)2*hc;yqFQE*)rlm=xHBe7W9k55 z=W`Y?g45hWa0of}>3fYZ6LzjEI)RM1;6vbh`<<#O32NPqs6COv)Kqf&RW+>0(H>~w z#i(`Qbd3hELl$t59g!xhGDdbnlhpIHRTkrwA}lI8lL&AH4;vZ6VfD;U+`5>GfFVB= zN5&k2&VunATodg^EYeyL3~-0HPHHj%A)Y-h5^G1ei~O4byUyky zKlDoEptVsm17klS>Nj05zOfFNJgx`hGBw8@H3*|v*j8W@;3D7HE^at%*%5LWR7Dg{ zm_>S`>di7dwiaMwU5`XD-Hc`X;5tMDOGzQ1xCaQ8rSq z21Rn&Cy@ZEPq{E35RuXEjr;G+L zGb4lv@$>*+NcI>z-_0V?=zZiV8TcNIg zPD4hU!15+%VwoCBZt`0ODwN}a$>Q@Hg&I9FWY6Xn)*{n$iN%3`3*6LP-Bj1uvbf$m&u8YRuLTA)oe{wf z^3zasXw?P;hmI@MT;O1DjG$?oJ}+X*%hr!2|Gxc(Th5{^DNUH3=<;QRMd z4%y&TJ28f}X>VA=5zyD2vbd$Z$WUBgLUR(7Gg!xAZ<16X@HE5_TYihQ;CRhn3mI%l zU@ah!h6bjll3VFac%*NV5;k_CIE`;$fVdQH5R5np&<3!4mlc(W^-exEd_vyL3t^bb z(v2ee0n)&7N8umap^CC$i@;iLeF7<1w56s}NP=U+&Kc3e>!>X)^<^=g5QoMzcBLSk zxF)4-?;@g@r!)m+T`#r4z4DHp62mg82GQpJ(He;T6$wsXQeW})xGCZ_G*EA#}Yg5+% zc0)}oQtiumq-PFO>wgaR5P;_XjhVsL3{N$v9>P;}=b()XQ=a*CFcQ&A!y$hU7AxLH za+7~D_2r}*=@iLtL=E>)2Z@?3L_`(tbEJrMTz|EeK1%jPTWp4f{^CYLvhAnBr9%fq z5pE5KnYf;4%Xq(FI6Zc7(jsebwOHb4_Zry7UMg?a2s@<2RRn)`~z8IMAH z5CPB;YE$8oqA4sYRQKvzi?9d*z5wkZq7Xt1CfphT#E9t_hTWZ9HN#4WeAwP_p(0Uw zw!l_j15Yq#v}tKfD<{*1V)Z+NBH#RrFM{3GQ%~^#^4q6mpt-B3{Ev*{@11)|HNf$p z0~4iq;FQMRD{NK@5J$mp802Sf?P+3oWIB_oHDHpc7x14R*peRV40Tu66je$-48j)C zB{=9IV_^tT(}SboP~hNk%=}Fm3=eJ~3!WX!SIc03%2UG7WCriS(LbDg(FRD3DO}DR zCCAschaInI0Xdctd9h)JcFP_~Ymm}p)J%!F)13(!O$OmL60IR69L!)wLTk7_wE=7n z=_a%60WXWF)_olA)TsGVLGP4Rh9k|OKJ+rssI#$$;dlMnG%?u>{D^kA)F`oq=qMcH z#S8_DAsk#!HG_}PA`tqy8YQY`NKD+KudmdrEux~?p{8#>K_4oj);r*#$N}Y9wad{=ntT4umy7OV2bTPT&+S8ulMoy*kAui@s(z80lQ&BKZ zIZ=x@p%I%IgsS^kER~Qs;|_8mWrSr4u1lhN)hMj)82CDf_+ZuS5Nn%5M6qn;&Jd_h z`bE`{2J9nDtN^xhaHpr=$$@3*g00EdlDn*|tQRh9%x__gj$oFAF;*$S{2bj$IB4|} zAZZorSU8mEDNcd6$tb&kj~5~4xDtki-ZUyQG`*&X`6kRt0r65nY`xj1ws{HqDVB!i zS;{X=uE(@r%I^AYE7e_*T1k_T40ojIDYIEWrKG3rGZs5|YVF+Ar)&(NHf3;~p0ilV zZ0p>nK5I!sHT`MV-Vh3gkvg@NNuf6B%S^tO+CHVbwTHm#Tl=khsSk9=Cr^AXbp z#d2P$Ep;Q69;F_R*}l}I9GY~$bVIeI2bun~Z?6Y|=)c;vqf#q|g)QyAHMA2^`AADt z-HTv24pLje_x9i5ou64Ztlt?)j{G;fR;KVwQxv9STS_TYw3~BVv=f>F^&H!Fh;2K1 zXloiohvO(L;WeqTL8(ueatkc^0}gDO5_pkPp4Ryp9tU78XKMQdH@xb^9}tt;y>!qkca<{^!SexPN|qU#e)BM%B0H5KK#dTT5C5?b z|FIAMu@C?8{{jA^JpGh|OTp$deFjjxRO( zrZaFXo~aoKgBY?2miTZxnLXB{i$V>bR`5BobP-cU8H}-sBq7EIOQ3)pF>1_(JwiwT zJcq7-lr?dq4+h7?d|hy?$+Xy}7HXrFs(8>2uR=}K85Uk(Lu{t%3jN@mv_vSXiY1|> zh>8MFD5=YfWkCTs^!H2Nm>g(VJkq>SfCyK$H6hj2HG8BMH9|;E=zpe+Ay%v&6k9+A z7s3N+el+QGj;tl{mxvl%9EOsbbvRV?t9OKz1j|G+W@8kf@BpW_c_s?FuWT4dM#5ddgBkP z0hI^jnIhmQ03{%uSc+`v7+n}mV2O)X&BeDc1{dP?D7#=BxKPbWVedDG=9-FP(O7Lo ziYn1|hl*b;$SSB}gsdcZ@m1D8s}ip}^)au;)_3b*`A@R|*7Rw|C?%fc*li3i82I52;!%3;cw*CD=BH)7=dpzr0KYrjf?9^NtR><%9!EAvL@aI z026Umqt8lsX*@CiRKOkEskF zte*3`u(UkCqqkzHKL%YU2G0S)O!q-%&M5D^nTCyjbX z-T_o7j9=oYWV&1t&1JF1D`;67%MD`qR)+;l%9<(7S!E$t zr?FrwhDnNL{*+bJhbmZeAT1iVI0peimJrC5oC$}L?T`= zglf5Q-SVYMb&V2ENK0VFP6pgSZefxhoZH)X*P`ld^KK6Cf^SQC4Gr(sH;k}&RM$|_ z3kO={Hb}E>1S(kh0KZpkR=wBrteZ^^@g8+8Jb&4BFRtJBbV!>Jfb=;qLerdT={plE zJ+{L&-4S#KrI&V2Xo~{J7MP4A8B^j6GD1|OIXXj{9iiu)v0}gaLd1sqH0hN(Q%_ahw&m|R8Nt_54 zgD|6wnNMIxbTJRR2GEFpFv}*?@yt>{YanMjKwr~BUz5`SEmBI@AYi>Ahp~+I^Z<51 ziND$P&5(IuD^F3YQ948Z(APNJ#)c*bp=vfZ$TVv&rOtrBBvk$C#TMm5XliI_sBW0+ zOf|(uyB9BVX?0C;L%|lb8L^?$>wO-oX3yr-+%TtQk+&%gC%~M{3L9q5w;<5+Gw+1&YuL!CTK9wf_RZrWoP33!21b(Jz{ zzOKFo$ZiiL6s$vm9gNpA!rOHVfD$c*K{!@x5!FFNe9&uDq;#*3)2$`_NGULqk+V); zHnbTjoq=#N6c_aD)S64MwnE;S0xFsTE?~KKgJsa0Oth9q;o}hxMI65x19J`?0i6l6OC=5UGs(HeW^Nj=dB{?eophx@SsFRq zMxMo!p905k z>SZh9WQ~O6G^v-_X=xUwmneQLQA#$?hU3lYRWGcx&uq{c4fq?akCnnkw)KGY)pizU z7P&z=s98yjr!HE~Q4M+(AfZoMn<@>rMQs?5CTYWMIO!+aZz5@fEy=Y9Cx1{68<)#m zDClL=(nzQ11)pZLhi%370?)0LOEcF>@8M;>{}QAb^R#1ZQY3okw9 zn9B+aHw+!R@z`T8KmPddo^ZmIBSu_NTzu7-F;|zAY#K9Wb7|={rKQ(-Jl9U1d}C$h z^{1S2b7kdC)27`rZQ89fXWlkz)*Z8F-#%+rcWv#Rr=Nc3ym{N^&b_m-@$QzE@6Vrq z&!R=!&pPV|XPSDTzTb{*Ijqr_rCYNJMOq+&6=NgcXw~wwr%_N z?f2h*|HBVI{OF^PKK9sSPdxF&+O@kbyX+SmH$Hj!<-fe@s;4(?dghvIc3*$}b2s1o z{LMH2=N)(addrqyZ{50g+qU1_d+&?)-uu!IfB4FS55D@~gZqB`#x85#vA0T{m(q}&NI&(c=p)?&pr417hZUG z&z|>QeDM!2zx=_zeILH@#-Cn$?T>H0_11v{2lns(^ZW0=|K~sd`R%t4{{Hu$y#M~E zfB3^^fBMtspM3Jk!Gm9rpHDyi@{2G2ia-DR_rL%BAI(DlK0hA#2lj$1?5CKSTSb8<#pOSx0ZA*EnD~0#HNPZa)yrCQ1tO$sY-i$aLMlX=bv6%)ql?Xilg7U z^RAq?q{byVSwk;rD3a!9`wE|_RyO>0Q`epOxA?NRJT!8&GVr=vv-=gdYnx6l8a42m ziX-mYFu(bduKo9QU9)b_&h7Q%-rf9GRn?m3Z|vW)@2$JH4aup!W#o7Ew{{ne&b@6$ z*E@glcjwHxW#_%G?b&-(R@MN|lAYiCBKx;T+;?B%nyRaI)E}w z-czvA^?2_4uY7gRlzzW0ANkdm;LK;1#Jg&4xv3?1LvhJbSx@}^_Mcz)*FU*DjWY}9 z7Bm+1Ys&l4fb8dPo1Iq_9(iEa>Op(n>s~uJXaCxUF{N96SJgPux(w#?ksK`HR7fBx-a}} z`8Zd;H0F`(sv-rQjYYZl6%Le|Wtj}6pxGrbN{8O8PYcCk_ zhqtd8dFt|YH}sz`uPIvopS#u<*2SLN(~$r1=vQZ7GO7E#ZC|aP>0UEn`}v=3$liAB zQ*-KcJ84qv z*cDGqzUi*#pE$x*+3%#zuDl2Hlagy&`Ma-oyS|LvHEjOXzK7Ol?>}bruoI^@7Py`q z|KaBop7`|Rv6`#s{hc*G*!#_N_EdTY4 zFOD6%?XhQfT=vzh)<4cj?n@rMV?|APWbCOCvDKfyJ8Q!M*Q0losjH_v@w;bdR2{i~ z^yo|8Y&zqF;=%K#$?LLxe>?8}s`G0%9oH}MT<~pMLpaUhy^SH~sIn zUq?UdcjAhU7ms`8XYN^*?-zN0(mm~lU;gKW;qJ9xPRQPRZslEt?!Vmf-68i>-FsoK zKmYlwI!Y4RKiNOHaKZbo=#Zz^6vlR)tvtNDsPV;3bFQme_m#iotuH+9xQ;%sCU40u6224H!R5ca_z@I9k!+W4-E_AE7#>*`pWI= zs9DHZNTDNP^zAYVhfA^`Qc0BwG*ZVt*>+<$AmweoRK&g7QeCy6v4h(;$wxH|U zFSZAw;&3Vh8%!<}+o_yxUWe>b`?XN%hqC2Z)e``_K>Bmg{!`-f&uHviDtR8i8 z{NzW*j6N#otM+|=`z-H?QNH$B56{gjIcd#|z%6$j(IV#!y6M>QI|uHKW_MTnx+l#2 z(o^L+sbXN!2S3{M#NHp?{N~AR{m-3Rcu%Zr)oCZcSv#aFCsKM>&P7`5Ksm9u@XVZ( zmM*#TrJRCG)(`gIUR2!u(LVQ!n??+5AKta_z|>O)gpM3Nuw!ste&XzwO;7LMG<5z4 z+2yOU*Ebdii+8R4;s-yy`^JGgzkl?VImd7KX;s#Bb;S?7^>&T)Uq8EW>os@0{;X@{ z8K<9KF~^--|8n8pl3D$4EV-+2Se10v%Cqixbm3FW-rRgc|E>2FOgV6mdthzLtQWdp z{O|D#AN={oJ=6QG+V|9)Kl!rvbl1Gw?TWq~UUf|5tM|`)e(7CrE?M(XVb|ruc8-2M z?+t0k8#&uYow{@3-#`9ji=6K|dd&s9CJnp;5nCH^!55_CwbnbAH{_@2suA zan`goW3qEMygbjy`yMa6XWgQP z6My)-(O;IXIpS|w*Z$$k*~k3xoI5(Q7hV-BIJ2g{YQf^Mq5BSe=6Pmx!TPBsacRR% z-npR*_7-_Y7vxu!&l%a3_5LfLZ(Ue1`^1B;tp7e@_>(^$xMtvUYvy(Rr7Q0TAJ%W1 z*4A~xL|@hmq1uDTH03S&ub(W<`pYF%Mc%9*6+iuj zXKb+kD0%HyR~D4K(*Nv}W;I=vbA8+M=g)lX*opaTfBT95z?tjv8j73u%d>v7<9C1e zt$c35BOiWv)yc09m|U^6-!ZNcQ;YhKnL42;Sn$AUM~#1P_PE&I*FI{#^OwW79C`7I z;=exj*^M8(Hg4*u*Pc_}7&EV7*`qbn4_;9CNw#+4giG)F{)$IkkDPG#dw<(Af6Bh6 zYiG&%m)`ey-m?>m*T%*#?mG2@zdm*IzWjBr{_gz;Dt${{-+bx^u9>m5C$-Ci=HAow z!tlXcTr-XIp@)Q=fS$x9hh%uN(HW?CP)1u6SD-(7if7dQi>p zmMnIkv-;P^t{AiHqlbTd|ApgSle-H>@2SW+!PPZrdSymp*x$w>$D)+%|$W#23K z;|F_RzU}GdliNmrdhxQm-`V_^&YwJg@_XfPuXLT$-8gvPm(%VaH#&b-e8X`?(o40H z|NSFAI`XBBA3c1N`nTFMU;Q6-sx<6)*Z#fz+*QY1y5!GqR_(uHMAqzO!?sR5d(q!s zzWnx|KHc`a+xoTL=50&PE;+LD-u0C`|8(60W8eHvcFAKU>kec+a>{`Z>;L=lN8NvZ zDX{aAF*_E#nNziO!QCU~oVwNZ;^Zs7Sl*N%TF>!ilzKfABxdj+#s-t}z5 zpAI}f>cl%=x$Gj>?nS?GEi71n>i$QruP#`1-EUm2>kI1kj34Qh|2Ss#>uneB`uw;v zFYEXHNhe=;O2NiWxeK~;ul-`p$bf&){G4016*lh5sX7qfUbFhhGwW~2J?rOkmiNXy zAWvax%j?u1*3@L0mtErCP`PN``cwLSHDqftyJFSms`wk% zR%Wlc^s!f?B~vauvTJ$OKBJBME}#Fcg0oo8RUBkQS2E>}U-J-bVa z*3_Tta^*-%}BFi=4@v#NktV$||0Mva|#)X_IxQhL)vLr)yOKkIl`)}ZRrK`*x7 zu-7%>VAja)2`fLDSadLJ#GcC^{^a7ktp2}H3fJx#KDg_`<+&5D>bT{SeM?Sy>87}L z%asdb_dOe4^H^2Z&WrN9h8(-MeCv-29>3?z6~1K;eK{pQb=Kxj7oD`LxFS?=)sF9c zqRB6;3m=&bcWfIi?O5dAe8LgCa*z6IiJTa)tb1Ww?I*__wPVT+8wz8a68(n^y!GYV zUY|VY-YH|V8?SlvzuYIwO}XpNO?-aatd3J3zaeMY_lp|k{$GSzf^yk%=PeK6#--@bg?fU{#~#;%R;$;lgdOK#O2 z=T;BMSu?%x>;(_Jb9{D{%OAUT+?ILklcCP;tn7W~`-Uznyd+C$x_wku|A9NZ@4hxK z@XT!=tqi=d@woA^iL<8_U41a8^W%bhuf5`m&u=Zro>$Pl?5JIN^|5X9-}0=N`hEAy zk~hB$Jv-J_DJ?$g!JPa}w<=4oS^n6>x8A+;z*Ex(P0Vh|Eqto$u5lla|Eg&DfE7Pz z`~2uzuWO$ClVaEOQwsZCbJ?q3UYRqhAW_w?;NYa?dAII}dmpOq_me4w>#Dx*$;unJ z|GJ{CJolY9-SWZlPwbkuW5mQoqg(}z6E`fn`>4viIcsvpO`DP3m8ZCJ##S{x_jyI< z(-lLOWLGr~m>$~rvs;SR74-l02iyDY&AXs+z*z_TO)cm*enteQ^32wXZyo?d^Z_J@;R+ zskpxCZr69WPbqGn{NRAQZrQPR%hA!soPnF}FZf9v=SjuzAvs zqROg%m3hAXIk8O-S6$!_@6VZj$?&Ef10s6{1fLsl`lg(czwVfKT+z&u+?p!)!0xTf z_T)708Ib#5KVJIyBjMK{iT?GG{~b}_n*I;H<63?k?SDoB{b9eO2mBYX_FCSH5L}oeyB1-=*&n?GY-wP>{gcDAr~qqy_~dBP5G~aC>MlEMd799i%|7^y1ln3bYmWyYaAO`El&Xiv8h(zolCC_hACJz~6_4 z*iuV>ITV~0b}C3U3X$eLt>ia=$ijsCLjK92CfTP^2 z5g0HlUiRBciNjX+9$Cd3jB^Le}R%6l%@@hH8&{GJz>snP=zK*?--vHI3S|vFM zI3GAA@|Qsca$GZbl>mP)j3f#9C*hS`ZKF^OW%*~RNhu&l^%2PWoQ+{1MOE@v<3XHr zJQ;;akOp#erKFO##PfwFiFP>w30RP4qOop05_u1Ks+H&lFcet|hFWQ^ixig0E^miV z0RlQKPMM7f1`5RhH6=(XL-Ws+#7dZ@@oHRT4-Q+A1MTcn4?dG`eIaQMftvgeAR(*Y z90HIE=mhA8$TJ2>>4@@y4DhY-ZuZ(v86X_kEGe`Kd9bdoS%MU7in#)xP&Aja{FZjb zfC)BmA!PIWj3JX@8bt!q-izobDqU5mi z!^Y0fmo+T9I=QSue}%Y{xdIJsxf0Fck*bq%TohP7m@^p=bW>^5jiFORM}}Ulcg28! z)MPw>WxN#5Is8e&Ke*M&UP+-MSs1c{ZAw{GNt81}YTS^5*xq=`&w(}w_W`?_j?z3# zU4@5Mx*E@`nWQ4tEMzlh)8+|A=S-+5Z&qUE6DlfBInNxmYY+CZ09LIU)&B95%POTN zB~0XuLi#o9chI&PxK9%*<#N4}7tOGFre0ZLlnzGzWZZ7oxGq9S*nzwZIl0J9y*aZa z+GeFq*G)=<^i203jeia*{-j>I2C4^;Dba;S35bc>?79kx5`?}mE}O0q21A$Tq*JLi z)CqNj;|dTb2r}DvEgB85-UWX*JIl}%Q7ZIrq-e2N^>j=ivcSah)01Iffyo)M0NVk< z5Uipy^#BVKIyg^Xk9=3vFiHcH2l2m+K6Zfg z#4HOh3|rJnt&O26gKeXtZ**eA#I+C{nz5+B#6b@Gh0Ew<{AV`pN)jP;3Yu#njX=(k zCpUbwlKn2(mWso8a4VPOKIIfe1?V6$Rkkexj0zpsA(#4EkO@f}OMz@|63GTH6qoYA zodIVZBVmdA+-A>m7;bh(l{V4)Fd~_7o98@^K{=)A3p-R^mrCa^%stAJL;41zVVA)5 z6Y)ubGjcL3xMIQdumh$V+QODyRdAJGFbi^E6lI4dBX{Pu7=V1B;Fza$P%cGkfcP?U zBghLyJ3=DEFFg1F-Qlbt=4~;x^_Nem)NDq~STF2?luf*Z3ogtSV%o&Q0M(I^r6}Vc z*y))-Uc%8%XrW|D*k#9}^C-g3<}Nb|POntdU}R(|A(qkFA=`kZ6mCb>!h07DT^H*W zoC*BAX9H#d4Ni7|CIG3v6zgCiR(CQRj{*RA(z{tVXvqeL5gxBG| zU3_z6b9fJEU)dL`6z@U~DdNq~nW{yXF9y9@m3;))1o(9(<1rvUH-Khhe~sp3hnZ%> z)L^EwRyZE(u_E350rFW-L?sZoF;}=k!B%KZ%6P|?u^=0>!d5aK7LnZe{nkE|h4m@K zkQhto8C{4VJ4~|U<`uIHv3=Q25Vvun7_4d3*{GV#JZ;5{u>|ZS+)}_Fii6OCfvHP` zG5;a~(f|lY?B24N-C@|JdA=yLBbGE4hph;^p`kB7G-6&j5sN2{)@&Ru^iYa69sFL8 zJOZ>9FScyq=Po~O%sRszX@Dk)b;UAlGqDi}b^z?LYz4eE=Fw{yzd-(?VhJ-9>`L~s z64+rhzoD^y3GPAG^1PWMiPRC4es1HEBRKiWdnoYUR_9%vY;fHN)(A(#Dc}fs5mmuT z*u=av>QvfPAdOLWr|jW3N*MWYG)lZ5JJDnMMTgBSTa+={`r=00hlmNVU^`>16>+vZ zG_G_IJ!EG>;r$0SbR^RW*c-qpn7t5;jY|-KVGO5PrB*+9;)|7`RzkCxfB>KKO}6(S zEcG0?;nEVbZ_c<3Y0Fk)IFol8GiIbK9qtUKvXL@?UW7H&YR+B2o~cb&m%*lHVi4#T z(7nP&X!`Uiet630b07Rk5V{{o_gH&+8NtR~1T6#9-Tn+njj*&nM6gKkt!j0fjOE~0 zzVRCJz`|soiLx4~8g!7h9SLhd47n;1cPU#*3juTlgh|~=BDS!h&~hFpJV63%KO9*UFT z$sq=OD_e)QHP{!60%b-i8p!U9E)bT|QdQD4S|ygl*iO+1G`5M{K&qpl5EfhxS|;S4*4` zD|5Ui-x31OaNGhXWe^9Vq*BbVm>v=uqL9FXVSzEHgTliPikvlWlN3QO%4c__li5^z zELt0?sP@i+XTS!JYt|pS<>8_RHHA)iHqmSH+Y{r~TKoYL-4Gft0VL_^1Hi#K6JGN>-bH&ymgmejKx&uZu3G6fg_(rm6 zlgj`F$#m$WKv@JrV6zhhbx;8!(euL-#cCFufUqxkA~g5QW>Q&_8nUvvoue6Lbtb_m zu!n6Bly(byJ;qkWKx{5;jkIN9YaY}VwNO}UUtVbeY-lue!uB!}CfTE)u_tMOWG-Hv zW`oJniW0yEFJ_xWC<+yL9nf3eEmZ^oItGvw`jzIe-$4FU8Rd>b@^*(7yQQym+Y*i0_XcbxZ9tW#LEljY*Y(h> z>8J?`;Xy2EN=Peu@Jo3f=5kVvyero5v5t}PH`@ZZ`e=p(a`~!Nt9Vj>(2YbnmIWr+ zJPK-~o&yf9G&_N04&z$IDWZL?;uZ(RIJnJ;EYk4dh7LfRVG!8F05_e;urCDp-Zn6? z;bp0Pn9*z(xTQ3w7*vaR#kHBX^NUEeBqV$QF&&NT3|B3up8Wtd7#ODUH>iWn7;-&C zXAp(w!oEm<1it4c+p_h{?=G~O`Tb>+nBYh}X%(V5yow;EGkgQA;JJ{>(oBhYZlfjK z3%!rW$(ApcFkEY)@x(V`38QU2TLEC7$JO#3CafY{9=@!VMKb|h{a~bvN&JK2=hQ(3 zCjdXrMeGy|F@bHbgGGfZR4`@e3-^nrv3pz=S7sR3YXFbU~x{dB+JeoV*ILBLd)XC=Xqb?R5^ywzo z9B^9#K3-6|sK#QEuM)LbgpM-Pn>oD7*`i>7(Dr%Y-YjCtEN=Fi#(<5R(<@p>g?bj| zTqv1>XtM|GKW7PI8ZJA?3CK(h3@kuehQ;+j*p9Bkx6y>~PAfP*EY-k7MzVL1dQdZn z)**Qk7ie=bWhMsEXh=3-tD9INH_9k_gBCv8l_3AV91ORG(iffGlJv|@=g5EyY_SwE z^< zhKC&Yvr+Q}V<0y$=eiTlt?LN-vMCo~UUD>+9!!Vy^o9?vi33trFi^CUOHiaF(RYMm zL?qMw+*Hj@nV@)$Hs#8+U{k6h2FnWluiFOMMc8N`R5_j72klcH+Q+D@s)3jZ(?{)t z@_Y)||0rSo7S=HU{(EJ0MWxgJClngRe;<+0sQu5V{m=gZ{?n+{YUsMXJ?)z7Ha zYUC=S$!TL4L`C~op2@7F_N_ajSnn*BInYHGmNK!*ha*WQjKNFgF@_xEsgCKTqR z!RgME%BE8&#|P7(4htOQz#A$7agD7EiXcHhM_y;?WItoNKo8A|UC_9+EFN2F8mzG? z#+r6!ydGWSBH^MSJ}b!ISRL*lJs<=kbQ;0ATIErYM8r@iPlFCJHKPSn;Yt%-4jK&^ zh~hm#U5PAKCNh?HrNk+_V96r%PSQZ6K#dbiAcR#4!XZbvw%y=>M}xy2 za&xscR+?rC)vhp#X^;*O`cWLO^5l3vIuI&=O4?vX()d6bP5eat&(&X?Kc^SBh91|m1>8xxYDRECwFeuUy8|F}VYR&JMy{S&w!8|_HtUn%h7RP!8@DiW7sNBfX z42~3mY{QGeFebvd%m4{cRT+qZunzmeQe9tSrV&7d>V>gmz3WN?_6i_^!NOpR2kv%V zW&r0J76oGyKzNMK`vgk{b$W1_v0`kXSYgXbMq+4BWE+0c(2=vIw}t2M`U8aT#wZV$ z@`_h--Dxx=psfz^8pCN*4JfXLF#*xDhb_ARwle_O9ACE%`j8u8}mJ+QC&`yWI^lU&ge27rw-Pg?lm1Iv)Sf5U?DoLpwO)_eQ zHKN}nS9Fqw1-cdi0WH$Z8rzx;cO-kYZD8y4JC`K`<9n(K{*7Gp_s(}4~1>gO5Wx)%1^8!(nN zv@UE~+G?;A&2^2f2OCZEjk?Bzjr|)M=LJ0V2Q6u?Z)q`_nvI6VOBOZM&kGn0jdK?* zo!8K~z?j4GH8!;xiy9U;w6a25n+&Ls7u8VD^3C@wu5X^Zko~Ni)3B(a_27UpzoE4e z%AC&%tuvO?HMcg*UAm~Q*;ul)c}Y`CJ*$46r?IKAp>cjQtEGN%ePb&-B^p^(M*V^8 zhtaaIZqXvFs%|N3eKWRiZqt&3n;RA^Y&8}(Et*%~+~S#2&stVDXHh*>#X2>2QC-90 zfHALbaovJ?%+myGl3VpN{Q*AdM$mk{d& z^#eD&FovRl9#W(SZm}4X!aQ;}15;ViMzVoqh4ezT;1c8M38z0J0)^0wL0(l`>Ij1IVu+TLw1`M1h4-P~g^b6nJB;Y&=8o zv(zkVzJzV}@WxB|kTx|~f`Y?`ddwrp3qu6!$Z`oPyCEc#WJ#P5uFE~1j<6Mr5V)h6 zLQhsMxP|)!V}aNXwipqzl=-pV+Muzl8wLhqOQ;qggdUA7G+f4{$QO)+u=WDlg0MWY z9CjwM4rLq*n_{Do!#u1o4*m=>Yct)0tp$YxW5(F7V~aiD=|Isn>O};YF6b9xoftKw zmp$xBW)rBZ!Ppt#Bc-gb)!^3&sWAE2XZn%`V??@>(jOOd_W;a#Kuj}0ZN|X+f0-j- zibsRO1`Q3W2sN#aSW%{hs~T_%!ybuGtlfE_JD6Eg3fWp1d0e$3 z90F`4)~Q$;6;YNBojgdgke3!nbxHNCx^$#FmN9Ww7%i-})55U!7L`CT7&sJ@!$`-& z{b=!y3b&E*Tfb5zj^jpz+X@qDEPd zm9m*pV&rIOQDQu@L9m3d!~b1zV_F?kXW520%jqH`gAz#}9VRkJ8sYQ;zSaX5@0<`o z0*jOO4nOSdfr~8e0|&ktputnS$iqSH@kr7w13Dx|nJ1+%kNkwYl+R{H}py^2CvWN>DbY_rnRa@6&vdFyIV~ z%Yyn=^2TwLHWv}^Ir|}N*St&ej$+#E0?1*2{07fnustEKUU`=)m>H)V6!lc2bZ+56 z9109TfkvQLXyI1y4tInjD+SM)Ovk!nz(&Y!3yAw( z;dkFG+d>d*Ez_R@mJUzxJ_X}XJ(9KA#ulbBUq`_ZAeoMWLt2tYGSJ6bcTp3U@StZI zjXU7c+mvAz;ekWT%6c-gYCT@0ZNcc$9jPy6viTAe943f zOj-IMeh?sSpu@4^Px1=A0&rd-$#XWzqXnm9EK)Cb%%eMq1Tseq>NsN~1K4t7@qu&8 zIzdF$mrSozRHZ515zDy78nesu=+dam^qiMQqJCChxLOTCi4vID)WFPma#aa34`Ns}H}^nGcfRA| z9WG~dES*u~U`fQ3aI>jcM#GVz$|uZiYMd|XwO5eio9dxT3<>WptoHD#i|7`x{MpEh z0pg(V2AVEt*y;`oHq~szvk;*xEds8{H%fMj2v(uI7`Ip^TtKpr^C$U2MhFHbAEU3J zq&f}BU6GrpM4V^r5RhO#`H~~TnHUI3fsR|A#}WL+`Pv!&#RpeS#JkTc+y&kQBi6as zkn`SI1)gsO3#UV@Q1P}D&I(|hwQUP5FXrNs2|1b^o~Jt#&}U- za|zfc@O{3LuNNF9SldXsY^0TJa^(d>T|Wo47;y~0B82l&} z$;QJxj7d_P&Iq4Qd$Y69O^T1KuH5K?&JK(ghvZ67Uc3VWx24Kb05>_L7-fgZF2dzY zKZcfwkY_T)i6)((kgVb;V%$Uyzb-Cc9_P(R48O)T$1;f9Y4&6(Y#0g(fPdCl41ThD zP%@VUc@G8ZSZT_uZ3=|0gfhg(g>g~t3)1kZZ+=fPPZUkE>%Py+yW{nH%tX`=rKe4G zHe&!AG38QXg-|MC&ULA4sRmPE32xmVkZeLUS-A0B;OVu)CU`xCU=+ONnVwX+H*d#X z;6nVKJew;gHNLeE3EY|*lNo+#Lc*_ue;I?I3myS|B|x@-S9C`np&J{mvko&7CahN- zTuDxeb~5C<(8IZ#dq)~fXgs_i=ajnP&IxJ!4q-OQ9omGRY;_0R$fSRKvD9s z%DBIhaG9YNAwBcf&o^Zdw&XqSyV3RTY4!vd_2zYSy;w1=u zV1SYuY}2s*fC5|1ypQ^wi*$u6#Dn{&gWbv#36AbUvA=0&;X;ygN%DBwNB&{oGuRhX z+`VfJH(KF<+mX))yM;_p8)(}I$T`H+vg}ByoQsFsg#FSFSA9FzkE5sQRy^HF6afRmpw@(GZs%+t!Yi?1AuAF_1sdec3YP4OrA78mXFwl4RZl9>`3*LzNVHF7X&o zTJuY-+`{mfP{Ik^YuaiYfSSgWAQWO%w6h^>2gI3L<0wz@a&I}i3$Y zL1+!-4hBohX9Ha*W#4A7KY9{RF)T3q`DFv^6Y4CW3pSOOyx-fDtN@|}(pmDE;Rckj zZP7wq>Vo<5LQ7EC(Ri=)gxQ!tAw)2}>2RMHRi2On)z(}D&dP%@Z6;str2Mwu=RD#* z2a1@q#0u7^rc*zwcZ193xg3Gxf$OXbV3H>+`_0zVs^L|Jd559d;wr4E$^*tS_%pYq zg_Pz(=D<}Qc+QdFij#bHP{1BV{81@mB#TQE6}SYB8DImSwlatg%g+ms5aZxDX$6E}(37_p><@LoaS>22 z^xH)y=@Fxc>P$?)2wd|x#Z|k%O%ee_UZh$&auPD(Y?J<0;IuYtLma(0>^Oepp zkkceOFQYMw-Q@cP^9W_K-gp<9Y}pvglIeJKyjO_16jZj9^DC{8T6lwEk=20uBtyu$ z?OVRwgP_UmHQ*h4bOdE~KZ2iV4-UVzMj}YEeBrTSCgU%#%GS!D>#L)X@t94$qGDuD zDwH>@t#|w|RaM+6Ij#xit&TYD?F7RGFA|R$y!v@S2G~V|D-2ZBxQDgtA_c|F zkiZeRJ;N)*0edt)5vU}~*JFl-s07NUdj+G;YC%Lq^HqIx7RLKM959)SSHQ427NPZo zKy)f(rcMAm049%hoHM8tRg&E?J$Svvo-b7T*SQR^AaOAX+372$_H{=!8p++Dn%z z^OS2NFr^Oql5imS zB*&&<7%O&UP^- zUr^ubmxu)6Y$gdL0}bmuQ4_k$m4K>kVD+ObOu!ru=xJY!-Tsr@fj+OPpR3+VGrtmy zEjPiEY^~D(64_cAvL5f&MCGs<9j<1J9w&4>H%g*N7`aB5B6MxiB-eUgB&Nao$&dKnF7gxe5cXq5G^oc3E{Ghq`wXYnxqK?3rvyOZiES=iT>w`dGOfA zA)xWo8Y;fMZyH@zR+x4^+Yo$qDwoX$acw`AEsnCZhwxiTH5Zl^ym<5~k&ilKb0R0` zVE#eRQjW=Ow-Ln^Pd1d63?5C>M@6vLoO!gZWxc;Gu|z~P1xF_b(w$q93VoO@%77&< z{GPDBsd3fe_-TmwJd^|Ju0%()rnJ({JsL*MTwJYiZRQK<*i=}H*qbj+oEJ>~$#VK}4EG@k9Neq5&gv=%vuFIMPLo7}XI~_+GRkU0M(nW2N z9Vu~ETcSt&kO8Lo2p0#)%lq zjtU&06v8IVgYXftOxCso#mGSL8MLs4vkxzYY-iKYR5+G~4JNk?V}^uuK^U#sV!=rJ zcRUTdVJs8ZUDYR`2V-q&cfLn)3%Sq|BeE=OFRPi)Ds!I;dL`I{&iuR;Upgy1ySCByY z2o2H}xWuH{RRI*GFiBq9^mzSjaJ9WW7+I6piTVU>-tJaAcYrcCV~Y!61#V!r`|#u; z8&73#g{l7I)5ruEwn*}bcJ17QiE5J#AH$YnEY27l z#+DD-=?8EsSkBJ8@fhX}1|d^0h|kLTLsG9fbCk>K^a%pOrk&5&6V?Q|4N5B7*Uqr4JyQY9pS z13boflnuC#M1&OwT3*?O6i@ zxn7fm6a!Z>j4(w6Am0N5X52T*Dri4zAtph6`OnTEEdU>O_0zIKQLdX@o`ffHD@YGjuS`Kp7X~ zGx1ufHIVDB(mjSxDsmagNtK?Kxg)ZumBD?<=u;h=Dt^L>&BbU8?qM{rPhdE}Rj{LRpYT#hvl|oo zlZ=pg(Q1jhiZY$J5J1PB*bstBE3%O32EKW^kA%yK|tlpekV2ibc8G z2s_^D_Q6ptXb;L9RD&QPdjh&p+tq=jt++jGhL_!8%Y%1*TsmpE4&ec=mk5dYxg-uE zC3CVe;Gm@Bw;sxh+*cYnWO7Bt+ZWm|%c^-?G2!lx<>*R1ygK2smfp@a!RMgoA1i68WIxXFgu z<+FngsRgH=kX2yxDR#f)PF-o44Tia_hn=jRa5M_iAj2nX?Ka~nI8&XjHLQn>Zml#k zaD`wK!J3pXGv(-d-GVPrS|6J~= z;r3cA1GUK#QF3+!65mDqCU-~DwcjGS-PTLP0pK^Gt|YtQ@UuX27#?$jQ_kd6jwg|Tp3r(*KhNkWltO!QJ>#^YW zf7EJEF)@F1RH?T!I@VaVek`UHjSAW95Uw&7*jzuqzPY{`RDT5v(aaoeLktXm zJ1@iw^|+Mbp0lOC`M~<-_Qtx!_3V=8DK5^FY;JSIl2%Ga-2g9c#kRZF2%vmk-IkLN zGIS!KnR{A(!zDL+iiUNC$0KP$m_*a(&(mv_GM37d#LJTY3^xy4LV= z2?8=P-hi>1?T})Spuo1k&XMH>?_BAMM5&)8S&i*%k*Ybz5@%5Ua%N0mS_t=bun4or$b)c^JhqW31d)koyQ1 zdIxKP%pyoolohBI%Vh1Ml>c@7Z_QYU;J>Fy`0vU}qoT5=B2-ho&nW!&$b9nRf7@>n zTU1A3{O{^1)m2lS@jt7pt48s^0AxU$zenOTivK-||2>NTJ&OPRUyA=d8VU4&76_b^ zAPx6>K=k)f@b6LZ?=1lT9!3BD>Y{(!6_|2oL*a6F3za2*kc)T{bznE3$%sU65~4*4 z5{h`3MzT}cwhJwQTvlGq0zpGJgCk8S($eNcZ6Al4#0LJ0G4x+|-okhvj>P%ctk+{?() zePQ9v49ymt_s2c4OWn=fniF*83hKsgI$>V|1x8p5E&UsyAsFP)qH#7O5R_M7zzK03 zcm0I%XDy{+R|q3yAgP=U-KQym7UJ-3Q8L2M6>a*sF#$~y_DoNm(m+B~1dq@l?S*O*ZPeWGz}wH%-b#AgFeuFJ&gUfFpkR~M2FW=^$* z2lgZh<<4sOoHJBo$g3YtihnbgC~(K1TP@HJk;L$^Gco}4Vr^=705~HFS_FWeqtY}@ zC~bc@cf(QXln-TT)@PuPLz5C}8Z<&$vQa4jUB}AM#zC5T$+g7B5%aK)NSIu{c%XV+ zN-TY+u_)1M+&we6YdX3sfXvvJ(ZMAT7VjlMUf2*sh`n=3@syRr@{iRHTX)E zctXO|#ssc}4hZScA^;hn`G|?5Y{n%p4&}oZc*Uf0b|&@?1E4~ur?F%ZmA4Y{4wQVfU(tfFFUAT$_hp(w?zV^c zSq19S7D@o@kJ}W-d=1Hf$DDd=F7vCED`nOim`_V!cRYO__#` zLpq$W;?ic=j_J9#e49JM@|6=pmMZ2pxV$0>ID)xI6E0dPH?*oB3q%WcogApd0%`2zt`nLlAJOF*iDc;r^whwm z8;=vxf#CUVp3chAISVFCXxpO9sFm9^`CZ6R2Gl6C=Go zCHZddA@R}UR~$FBiMnNG?w{6}4jwC0;sro~@(>YGU(!67(O}0L6plfTIqv8` zH*U&1tOHBlc#477mVP#j)DqI%Pwb1xO-i#VE}fjQaQJR&0vrhrrK(l1PE+42_hAiA3)_Ely- z+AXC+n*M0+;f5}@lgD$w!VSOLS(Z%slyG#z*Cv@-x&fnM8^8a{JX zhMX>ktnZp2o<}Sov~1#%%rv^UN)S>}3VUEzmkIn*d$bHd*>G^)(Ij=r!F7wr4&-=U z-y)*DLwUa3cm&vZzdd@}-kO@kO*P^atGjA=WL+tHRhu#QZn5d|O@2<=O|z<+t70HB z!pzsL?KDLhljUF_1duD2onrl1CW;i)y2nW`Xt5PTvz;Cly%}Ihq*ir?Iu5a+QC%j8 zATM|x^X4nDJ4$WIAO~T6M1fKe&vPSAo9dP*z{n;t$tr&{hY01Ho}E%lc$ zkz6{f>)Wjup;lE)7u}A*TQ-?RU`oC*VNyg57{%Ve zFpdV*1Cs>SLQV;a9tqMd24t9y2A$a>ATB_l#lpBaA^Z&sv1b!jnnEv`I6WXRK+MbEg-tu7Ld}r`e5(R^!UX zbnrteNO0a^-Q*#4W4xuYJPan-&6wO^UblI7UgZ-Jt{ic@#cSaZ8CwQLa*I!ba^(Ki zec}F1y`Jl~Z-rzms1ngqGlGuM>k6*{n0nUOGRi1OH)AvfL>B^sacv>VPiPS!Q6=1B zD2ofdoQ6>_4xJcHM_~+>YgUoE!2n5o3h06)te&u;6840WJQEB>p`Bz}k#K5IBZ&zI zDe-U{#qc0iU3y12_(Gu$5P%4(ga^?JEw$kTd$Ir)GdM%-x~Pj7$7Y2rqZUB<0y$0E zC1_GhER&n5xfs9_vLT0Hq|(B1w!otOgat;;4UlkyC`7I~i9j|)v8y~;Fx&!b7_T-Y zi5S#^OZ1cuCn;10J5J@+YZtwsrn@%|RAlV6r z+kvOtyPyxk#Vhx;8|0}3k#-9V2L<8ma~63LK!8`feefZ$^;Q#c@P-UfPB|#O{S24 znD}-WuAvGV&EXh@tl&Muv7?KPkTWMF0;rWm(8Yj6d>_nk<{bbCXIaQ#81NT;!C-LE ziZvk98jG6ShcMVdib#mjZbZlQwzlZrsE)DC;` zBI!lz3M7v*0JziS$Yw8}cXxBIOWfKyo|m+-~JgTL-?#m-j(#N1Ri#@@!a^TWjNnoDZy z6!xS`Dt=yx!>CY+qSN_%t2>M7Q9E-}N_mDfdX1-CE46X4HYT-DQytzcwx90lrFL3= zbxTK-Dup1fZf_Nc8w{%j{!oRqtkqoxt zp9}3SxvO*b^e8f%9ghLQ;i~qL;BX=KwW=nxPfhjoQE<2+`{c!cljccVUPod4x610u zsnZd`9u#M)BW9@!v-A-$wD@M)BYNyYS!KQM|l5AY7pZFp32?iUqd? zSa73IaIR>K1pg+vgOSC61G#bwc^qOhbQ@&#-0(po2_z`T)R;SpCfG&Z%EpDwbf0u( z^aw*fv=b0MjX|T%fI^j%V@w2$05rLn)kEc?$puuad?P)Xr0`4Sz;Zo3*#yL<;i>|@ zk;p#Y!kk+48Y@T@^OC_{E8JmaFv>2uWI!J=xC+GI;V1(J$ZKP9aIoVa$2>4P2Z`PudMQPcWJp*tb|@G}4b@04Pi+Hggdl9}fYLLAc>`7n=f+ zIj8~%?T@^z7)ZH24KzmS5djLJSGJMo@O%*SAOS&(tZWKeYCLsMf>sh(58Y5G9e~pT|G9 zH7{TECQJ2;^i*1Z5PJZQU8N`POBx{Zg_EMj!@YqtKPb&mz_7g~45vKdzVesD>k28kV;w^w5RedPYeWVv;a)M!bV3t8CeO_4~l51fJZen*trMuFSAl+B-Y8;5_^%h__k~vbD^)P z9PaE)dV#*qZE9?-Z)|N}RNuIub)id#VJPEfqD%VF%EBZZ3wjsj52U(@Ey*+R;8O}} ztr*4)j77R-Q52p!lMxU*5*7hW#UtI&FhqDo>H%}HWNEAWxQiYkII39RVDB^NPAsTv ztzTAmaC-ymOY{7?xo$ma#e=RlX3@bWOB2qwV$x;284=PGeWq~Tp^r1LaWXSS*{Xp8 z%0=OWZne`(+1Xli6=OBfk6IRD8|FMy4~82&+-Wim5r2h!tVT)TLxD7<;YKWNbKNFu zK;8I-nq$Mi$k;|v8o9w%V?_kDUg+6GWFXdlIRt7*(RxfzF7Ya*Q4{YkpB1wD(SjX? zWm#~`=@9n9NC9k7tZ~}8b?GKeS`KD{bLx20M7&Tn<~q6-hvk7Wlj9H&%MR_M$%+L` zS`tyRFA696Wnp}}$}-8aRCm7>!@z)yedYGHu}$dJ0ZZ$f4{mR1ZEk2>kf%%fl-MZ& zEfQ+2ceYnY9i+}kmLc{b7vVRz3H85n8%K?{OkjsNBm|e+rfDWqj~;ZV|rDHU3=lg@04srhE|FW z&?3xyp${7PfHq6Wkl+}mO~xXcy&Tv>8?&IX)FQUuUb=JLvU=jNo*4J-=TU6YiDHw7 zXK72l+qxT0<_dGeKRV+)zaF&xW08^Q$8BZxi!4!+XVhd&4Yh|m0|yynaJRqnu{Z$x3kU;m*QAVHdHAt$6&*Y z{AVYISdMp=3F69;S~p=7wLq)|kFioql7xUPZeAn1-^XKN3#?{!vV|^kjP*d8n@X8s zjE_DvOYcyl?=RL&hQmBrI|&9**b^0r~}8+T*6!LX8Pm4~(^|@PHLREOshy33MfB)Fp(; zb(wUC>JEd%P++~Qw$q41fNKnjA;T9?{`TDbL7le*)M0ZKSyKWRB+xWDuqqtI+|!Ud z%xK<;;(`Vun>t2?lj+!zDhxuv-Mcnm1E3VI>5|GNL+m6;m{3U=TuCza#zwl6NeiJv zv}TiBBaOlaT4-7<5a8_5UX(AS9!^$ReiMOj`VFh!%CP6!G-8Q(Vp?u;qOiM51O`=) zYCa-vGCilLt`j7XLn5oAYD8QTya;b9q)tJP=p5K=-Jsl((7!S$d%DN)LV>cNa&+ew z5k=T{uhU(&Cu`Bz=ipPoJPAk?e)S_f61O4H;kVu9uaI9(fsx%rq#~|lG%Y)#i$ZCq zi?>)x12uC{O&q$ADQ?s42p0jf#l5qfL`;zfZ;P2JBjuP^&>jp8A&XHwstP)S<+;Xe z;nz1IKTDfPjb$4K*b!nACP=%HH;XcU<}_Pu&>@;9Thx$E+Mce#X7X)K!x_+n_NpB4 z@Ss=UAh!rbE#K7rv4uNB(BJ=c>s)CNiiWwB(?$(*|9|-8+W)e}RX((JfR*pGDO2*; z|Ki7C|63iJHnqr@GPKQb|NM{J|GLjV|2jl!%lBua*p<7{Xq{s-8XF#x-W7PYFQyGQC$hF#I*8? zDdnMRBUD{8Wok{Rl5w3qjKN1f!ZW0;^u&{(hiYFCAlsZ;`IW!nCW!0>$cq>!?X^QC zczL>bDmO_yCEkKfOYVDkD)V<*S_1Y|MU=Re_ zsuWyoS=K?M;^lR*J9B`?YzqKa+!;$m@e9b2()bONWRm>$`^Wru&@Jbe^awOku!@1MeQ~y z-&&e*h?NmBJ6HpG;+#aedEJWT_nle|s@AdxbItnS5!SBSdxzkvSc;7(71uNftHG5nUF>pQV)?xRRS^aJF;QygDP{w> zh-;4sGPpROhy**7_pR4}8Oi&)fW4GgQ}}r|zXn)&K7XP7D-u`$>#_8UK`j=C?QrI_ ziQSav5j2rz1h%5#qrdD)zrD!NOMd%sV%k>QBQ}*znEu!#Pw{2KQQno1ZQr-zu-CeO^83$r_p(F&~|CXhfVz zCgZ5>lE7lo{zSMZ7D0Q`6oQ_@_UZ{IVkxjHrch_lXf%36l>lrhb^x>=Sl`@YuVYHE zA{g=t3Pb)0N@V02+QX66AS8A?xG|pJXy+*8K`o9b0l5jujL@0R9;Szj;)b;Kyn(fb zo7{5vMoJfIyNm`tb`FMaN|u|2%dvBEiRU>Php=Pv*eDo-ydZ_bxZT0h^3q^XrU!B| zOfw)YCwNme0y$h`qrgObg@?jMtQASs0#w&(KZb3MCTs&F13`0%s0h5QVHz%NUZkx@ z2(9Z}ix6~GO9GH(Myn2Frw4uY33F`!aLtHYsBBL$<99eqi;umBg4ooWUE}o=UsGJn zxpnA+RqOS#C$UcI3{Ox@?|>rD_6FVXDt)}NVwm6JVh*tDE|Z651cOv0%VNTrG*A{B zT8vNP!C;TDYG5^>?qS(unqHDrrP2;aO+G4$oeRVk6vdu3$Zv(z>q1dyTrv(}_Z-&p z^5Age4TpYYm!v@n3@Tci4o@s;ZG3^rY!w0sDNO7S%fvSS@V*gqVCc7PjRx z!JrqeEtSK$&E|_iD`jh-l;e-b5Hwg4(T*_M(8l{ELL1v9sMUc}#t+2^Z5=lvggYtA zi5Z=~Q!(^)0f=Hf;I2`Mmw-}X=Zn8AEE>_U!H>+|D%lpXFfELPfG~gUO-oysENum6 z8u*RH(B0L*xIyTc7**?&a0)qY04orU$TCs3GyFPxly@`G78YDFGnel&%giX3>Ms2{#BQhsAvn zNw^aoKDGgh7v1ow=CQ$p#n;Y;74aBRf~LPWqDf*Fa0#?8Sl-n}f)j}}C^-mx$rei@ z7KaI@d6rK_df+74hp48{s|W&{(=IlrrLbcQ540DHAT|X54%__K3#U~PXC8KTL#GDU z2_X)$AOvI$EVcA-V&vB;LgOU3&Aoo?DRXV&5wry)qZJflH;|0b`jJLuHlBlgZ7{Ml z&mvJl^)iNQ)!E@wF-D&tDy&r~wne#g5HLR=iJlH!4`E~^i^@rc6wA#GCkW=1=IF2z zt2D@F41IBfD-tCZqYk1#tjwRoibCnW;Upkp0mV^!5 zyXLlXX4J|&2?5c{Q5?iOgRTXD8>*vL|boC1-V z$R@xP6)ywu3=V-BM3{xWz>9F(yhFW3=;}_Pn?-yJF9x{qYSBbo;#ufNE%`GyO8;iP zFbbNYqMZmE>h5G*3ve-{Q?F)T!*lc{c)N==NiIDbkwL|AfPon+RQJ*VHvj<={F^cCL_ca``G(ZUHn?AMOc#H`YH+?m7yZai(36dMeK)g z%#^H= zO93VV!r5!_YGRp@7PQMFRkG(k;X=wIo`%&53afjvpN5GL?eIQbtT|c`^h+vc=4_7K zK^wx^luK;D;CS-z(?Uk7#aKLmsz4mo-O@6_@R7z}m7okUfZ|3;_E=ql)3u3;os#=lLPX1A z*U#aaa;f$(eAFnZ<6#X_(RgSt+QM{o$Uqy>q&5Z~o9YMDJ6?}d_cLhK4+>jI*~Au+ zXkjQ2@}mf_T*`v@$cerLgJOu;H>%Bf6VFMCK=gTX4*&8LswkXtZm4hftPl%WTVvP( z=dwfu4m}a~A1%0kWg?#dXR0M2V(*u^G&TJk1zQQohO)&W+gz)f&+ZS@Y+N>wr3Mxb zu9#zLjneW`wFc3A1-0oothCq!b;F+dyd_pmc{%%2Vu5rAvhkYWyTiyybF22|e+{n8 zR1yS_87?6ZV%6cy4isZ1Jm8`VYfCDRZc)~OaTHGc@Omk%ly9Oht`y@SkX4gKf$ZXC3qe&RnR#KT&)Zdab)rIL}fxLx1h{( z9H2N3PJxVw;;m6uA8Pm`hz+2Xh1-x@ImoU8#v74RpCa1Mwgo-Kc8e|j7lH}cmZ<~h z#w+X_LFS|9wAn8@DzKM0uW9bm#Q-(c+|<JPF_mh@ zwT8%v?{#mMgx>MW0TL;Di6F3E_evBV`UZ*!dFbfphOHI7y#8Ww$mCRR>!vuF@|IU1 zv%MBLYmtnB<`ck504WC#URsZMmO4!{bw~{_o~wv=Aqi#D%22>SG^;xbR3V7u=TPfw zfP+BZilZ?r5>7{j@F|=kT+CFEzi8*M0qx*~hB-L%*p6&=&XDPVWnNo)j+d4<2Z60o z9!(r3zKZ9X#76stZ*dH3aVX*UYCg(t;S?Qh&;gdbg16ErNej>bi!k?WL9;D+1tQ72 zh;464H(Cx@(+|aflf1Bo=F3QyQ)?WxS|eO|y7QOAAT1cQoX3rz30qTn`6wWo8Pwgk z(A8JJ`Dz#6VL6fOqEV^SvkksBYVC54bH)xW{mW2op%Uf2dZ5w0yo|E>Rx*qzpnTX7~c7|jUZjwg+sL0W|)>+VQERQ zG+>0JiJD`~YxylBH>1$_yXL^DaW>r9E$AwCMk=uZU5Jm2>W6#_M(mDlyxd-e&~Oin zG{30>t{+4b#QfRKj5$%@KHs#gb1ojajATwqr{n}BB2*>936aunxE3ipvK))l#yG?R zpaol%QQV@qg?LMXj9Cn}O}250&KZ-d1Il1MDJ}K44a3^Q-WYg8EX~4xxj-(4qS!qx-0!g|mFWnB&_D9XM zyju*DF3mE$wlH%xD-JuvhElzE^rHwA5e}s$ng?|yi!~*YR7Q(JRo%sr9b`Gm0sz;J z72~$40%V+x9yp5d>?HA2C>3If=&MZZ^5Ij)*?hZvoyw%FQ`nSsa+|VFJ2|$Qd?@Fz zPN(^pv;}EMAR+`7S|g3cjKf5UrDQh-HX`7e)j3?Y#OgN6aX9r*gM(T&Z2gP5*OrB{ z_#5Hb<9z03PoDDA8?L$2D6XX)+MIAE>?T<@zRbpyNw_38M!223oNB|6Tp18{F13by z9kBT`()c7-I>e%s%|0GtoatR|54DR4a>+WVKI1*p2w?+|j)bJ25w{Oa+^!O{+lOcM zkS}@0Pus?x##2Bg8sW|iHP4MZcFscD?21_|{Sd2~ZM?88obqNZZtk>e_#6Yw80j1% z*P&eLb8VCFwpQgO3QmR?>(1UeO$-H$vJhEzI^HdhwfPDzKD^Tna_vFdFMH`JtB9}4 z+S8+QZ`snbkMD4=ye56-aTMpmf`I=8?*u3Rj38h2Yeqokh;@ZG;Y(EuCt5U z%C*08U%1Vt1>75H5=$*|Sa+*94GB?@;pR?TJg_rwaUmC7kpJ1EO?jNGjjP|g;|O*0 zNrs~N&DF}eq>`-3K2rRd%ek<6ShyiBkJKbo!?d*kjSOc{ldI8%h+Y44#2;QjGzds5 zN56ZT6iXrulc;17!%mA1kNS_gDC+3gymEWgxvXluzYp^XYfdQAZ6!{ z^K;{77&VVNv}Up0o*!hu-lP@eL=PpaUT8`@)LQ7P777H3=K$_U5L$U5-V+=*PQe_bQEH!+l`UWH;m1HOm#DTLJGvF6)m{v)B_u@5be;{Xyd5k2*D5%APD(5_?76o`M+Q!CIWNT+1})mK7*=JQ&FbdQ1fL<&aKk)|SS}MOgFP&K z9$!9SQj1QcGGdk%J+ahKfiH6>3=d@;Ko~-Rs^C7hxCmUur41Ch+F*Hz}^Id-tyV7GiRX8TD_J>oqrVIb%Z_x zoc|bgc1sz60nY!a71h(6=l|4D#pwAz5}zTwZ;}v>mW)C1j{7~X_>XE?AwMyV<3CoH zho%DlV@0T@YB=#9^PxKGXlIO45dH?YlVMf%{Xc`HH|+CnyXSV=>v`-MI)TBQM<0s+H*5ZP%F_1+YwQFFsJ{t;CZYHrX9f)7zvF>JH!i2Nd%c%LR(tu&JwZG7>{$7R?5VGTW@b zXw3bNlf=q3CB|T2bDNs>Z>UEIB0LCHYVQm@aKr;Rf@auL0Q2JGKf!*?nlyv`4`zTf zynX^q;9$%YH`ih}IE)`FE|?jBKvq?$qYgY5urlH1V6?aMsny&ZWYxSRje_$rV+X9@ zeZ-MDJgZ@z34Z66MgiE>pKSsHa24T%fJS&%ty<;X!hO71TQZ7G6gyJeiuqXxC;w1u zgghASlox`1(aIVw(evo%EAT0J|Bt7(SoRN}!uS7BMRoO5$Nhiml&PcfA4cRe)Fe|f zHAbu1lY%JX8t_Ll?H&+<))~qILX{&d3~&vqzz*C_GtnDBZ3W%q13)3+VQz4RLaD{g z6Qd#IND;t@zt%NkLLrF)`z}n_l8FeU5_T^lJc4|#1xwH@kF+=o@**D$2K_^Sg6g(M z(WGHRix)u`7^lEmgRG+$h31innc{3%5@Ttm(p;6%88hQ-y&N{-Xk#X16N;o9C!|?m>I#7m=s@8VHHg6qpE%2`pHjgzddH0?s3l#dHq>TVE)K6oI_ng zOc06`%k=@d<#p!dCF^DPoSGAKtx*(u{eA2*eWiw>y-WLV~DT>M6VFFu- z*N1d6P8E0YYQ4VYD^{#XtSD^*{7dhO6(u1rsq$F@D-+9r?xl1^x)d0>(iNqXOW9Y7 z>z*+VQ`@%`?9UnV!xm2@!#F)hEi2MgdRjBI7Xm7y#PXGvSf&0M1~5^y#@W^#E*`Zt z9ZpzrVG^AYM3?P1F~e@l6)i$U&it!Jq=?FbhOqI9HpngrAXRM#3lCO({3jd@SBaxb zCSZh%+3f6KZ%abP>{;k#YD+tFd`VeJ*@Ov@W5NXZK1=12d2l7#^Ocl9mXZ>;{I7GK3`pNcDHlYn9ZZ5Wo53@==#cc0^w;Ll-WVpw@c~Wfmq=0&-+0g=y zJ?saMNQ74;YTs;MN#7*@a$`lNZIZ8cwjY~28=8wX`w5&BgqJZ=#u*)HGrW>^oiLU3 zA>1Tercfy6gJ3~y+w$zx1}>CEKTq`l75998V2>f#9^3S6;mttA4UQ%k;~Oa^Lu8AC zpxC_~GyvEHftAXd!iE8Q&Smk!1-$5OCM1{^1voi^O?r7C!kG*8io zAY#l(Cc!QY6#uB8hg-i}iAboFoj?|`;A~@{$B+VFQX7jh^sbTiSX5A1EKYVVk#M9N zWJ{b=f?v|@dT6Vc2NQ$8pT(0j_CdQ>(g=Vk%J!=47^>WMp8XRr zs{B-}t#$#4%Ze|A}SV)W0gU~aXZu?*!F0H&28;1$6^$q_W((uJ4--`XwoC3 zaPfX#fo6TYS?B^z3?drnwHT>9o5;Im)T+usGz&mE#33V6Mn*!wx*;sM zVj1LvGO*H-!bk=H2BD@>4hN?Y%3jxojG*>KnjPY$`<4cSISAVAaPLNrfejnyPul6` z&adhcIIr#S+Ai18p;mI!311$&2JO zX4SA%#lpUaVy&_V4xB&6?XZVAXhH0mfC~zz03@hA5|06DPY27t5|P%EL5{-%X>(wM z^56wQS_fbdFP}8t-iU@@j5@od1+N(`azY8|MM*3n_rmCPp5i3V5ESShUQxbtjpRsg zIoJ>lEIwN8D&G}!&4gs50F__LV=3 zWynQe+Of$I5As(zahB~9fcD!ue*-MG2IJHN91h4)%Ao^gxP8f+kjm|Vzz{%b$g<4f zF#qx~=Y2VtFRWf*KrpybDHL0ZF^;qX9U$pgCMz%pLLTRlFywQilj=>eOGY%2dWE^Bp zzU5GhnMa2Yd@0$=91BJ~E&K{LK><@b7Y_QW=#<$2Ll-S7o(uY+EW_v53?SMA+FF&! zJ^Hu@46jI1f(8^5yqZCT;Vmok27|H?n>##5Y~^kYj#~zu793a8Z9}1|#icJOLln7v z-O)6pR(%q0YRT4s0uu97j9>RHKeQxLV%4-w_SckHliAM|3HH4-pn@P_uY1FBvPcvN zdjg<{;F;kKuW30vfqN&*LRN{|`0zA#zh{2U(MABTWdMDYcOVR&+ks7zmZ1>~4l?=L z290_kF+9*G6h`JF7^%SKS>ixJ5r!4P3;*sx@i!fMY*4+|p2k z{9uG8n#{qfa=pDF-VnYEmVu5LwoMFRf!!p@pGw|UmgMe}EgesA#NuWZ&d0OUKDPYg7o6QB*C46{85L ztQesy2SSBtfmjQ8gZClqdD23(A$i;P6LA3BAV%M$(oW8~3uVAEDd3rpw^?l`t&n!s z4;UuC>?Nb8CGob&jNwd1?Lsz?&Vr=TFe*G8Z`no#n=ja`RxR6}wO*h+UVWEB`DnYv zhLx3q)h&m=YAf;&-;vTlo10FP(|_SpJ?OPTuzFV{7RM;DOXvB>Xg1d())BNVNYW1a zE@sP>F6e@fuu+;eyRz|cx|Gj7$|mR>D71TIA!_>wJ2$l<1lf)Q3NGJS8Z|GtZ$xPn zMLXY~(QB}89^InO4vjI$sacU&nvh@_IxWJ;_PJ;i?xPDcVH;WpbK}!kD!x`(i#~AnPARDV zLG2SP+cM3S2DlhxSfeWZYWvVakrm{{nAx%&l`}lH_>?s4xQWQ!R*w)UA%+d@geohO@@j2=QD%7#2|9HY-#Ug?L5{_@p`_-us`fm|_-#yn zUG3pY+*Chc3B|bA5kKZR+=+qvACEZprx!0-bWfLOFKFVS4z@zzpaey?+fl1dP|n9K zXQ|tWj}hk|9YeOmhzPDWS3+Rs#(MH3PM%XkMx=|Qyhfs_Q6$-uXNd)nd4yEC(a-eD zYk)g3rOi$=Z6+ez4I-n1!m~oqz>AeFI8CJiMZEZ^F!q}dvC`1PomL_@VUjIX9S)Nr zb1hkQsc7!XGo)KiMgMXUpqmwjO#o|0OQ{9yhH{kf+UfF2SSlp*}cRj=e3 z3ZP;@_cA6LR>U$vqai^SQ-Ht>5;-<7IGAi?y2I+Cg0c^OTe0$QW31e_((LEm_S>Pp zi4m5saTNSPqbX(Edln4>YM$ieQ%^*oXBZ3UOgL^Ob7nfmLE*7GVaX-q^;lmimNs#! z3LY2KK79dgSZt#pFMD#3-7ZOs5l;zeGf_nXOCON$(4okYu%n=+SeNz$+_(;URfzA9 zZP{GDgBow~;D`l;Z%93INegSICat3Ho?>14B%A2O4AXxJSr-0a`IU4;lcD%vsGX)$ zx&{;P@-&s)smxNWkCIS0@47zCWJ;v6+f5atU{amT9;&#D4;%S^3MybJ09r{TiN4`3 z(t}Y^%hXxRk3ie)P+bn~mD*{7ER1vZf@ziURDnxVT&{l9YX>SF1Gacs#o{EF%);P# z1!cx13dy-B`2;&ho#P^J$KVk`KmxXWIqbQ%HVP_%)`^q{Q(};jfT8)0C=UlcX%_9$?1uZH46oX9Rfw(kC2|tWEV1`+`MH?Sq>52+n66B`_sc`d7WoOO=sMgB`#anGhid65_rA<6`-b!;|C~c{R zF)-Q^6hQ*1z@^WF)F|eb_}WM$nHJ#)fEg553S>&WoUsvDpva-ND5fdb0M!Q}S_`YU4*f*HENoy>w?RYj)ZgHE)4NN^u7UN27@1y{T z5{uK1JQ*4c5WqHkD3Ov?F%lLDYFTz6OQb*G_@Zr;&6jb%@z_e!XlQ8h8(e)&1RK<7Iql+l0mji5=i|i&~d822VnGD-QaW5{}LWwYX zu&Pr+G0VCFhO>iyr{sBQ!pf%DB_(4U@EU{NRJ0oX!wZS|KlLeS|ECN$w#W!@ApFm1 zl~s28zsibG^(g+=hznzrnVpyUK&W6FkcCNHycUZ8e2R#weZ8ee7JQcJ;=-`z>R&tygoFT-eRgS8M z1j-5F_r)%Rx<|(l4vD%Sic1`8xnD=P2L6DwusQL;S;I;DBX4o+iJW=%1yaE2FT-vb zaCkXIQN{3FM>L^Y;nW2=PHQ!@1R%dONGL(bpNF8AbOnZJoXQyVr>p&xt;H3cLq zkMQ$0mnSNC{xb%SBxJ*S{!f_}nwES1PaQq~N8&T2#23NS(n6@pV>*{%Jh#4NdZk4e zb|@96NC+ZEYotFS0wah=$}1p=#&TJ<7`dgd6^oiOmaC0}ur1gx1zS{jaFgk`umGpK zr^{2D<+jr>Td*U^vxMY>V=i8{Z9Xpt@IG3DF$Ijlj(Wc>f@IpvpF7QN`>R|s z58((p;rKPgjwtL&Y;Cfoc#+nAB2&w ziNJ;Rf1+PDW|lEU4lcgH(G?TH{uT3J*oL~D$4HT+jlIkusy(h=HgfDmgby++UKTBT z-rgB#w*u|Gk^nw+@27AsrlD} z*i-t3%cRA;@wdxijL1tolNJkws*&buB^IS30)hQRYiAxB*wJ!KI;f^|(ie6%3D*zz zTo31O6D1p5qbThb4k)KYG@fwa+K7UmR!Dn5EE2Jt^)x&nTTWj}j>yvyA~l=4INX+H z+VtCK_iC@g8Ob@%$(|VANPWM&9{1)wodj`ZX-GHeN?M(xa0KgquMh&uOhjKCnS|$@ zFE>43M1#*j>K-YlR_Cu<|2V;SYr0;Af4DS^GJ=X&ptXu)0M|ym1*#{T%>NH?|09NN zSmQs0s;j3|<-~ue8jb%nBA+2$tVm1kQlKueQW@M#h#NeVE z>x`M{Qj4z#*C@%5x;+M(+NeS)^GV%rj19c^(30rn3G7}eq>pxsc0vOSYgWP?VYu6a znXj7|fK?_4hiGIZoY5$PE1;z%Q9*evZoQGlkG9@utXO#oMxtQ{x)@@%yQ2Q#u@+K@ z;+r}OL)eZS@bH*!FK3&6zX+(R+^hI=JqETJPP1H=?nuDRyv2~ZPE3M3ZTW4uLPRlq zA}0h3^AgApcfsnGzBwFBh|Kc@FO=3C+Qe+r{nY6tBUNW0{8yX9w&oghUOD^0GUI5e z#RW9T@J$z=VOmP|=39=11@GSp`oRTiNJCpoKp;i zPv9W~;z?wvY1ZziUN%H+}J%^S>&t&cXHFNDt@dxu7YBN=M`0&0j8U_@C!XdBpMGiTeY} zy)n>cs;L-cuX34N;v4&|moJ;dw@N*B+~#CeyH5%lyNv)#t5FJt+HGQo_X-OGVJWBL z7$fwfpH1NMu8C4YpvC>MRzA6xr7xrVz}9s0QeVi^=llELmR3gI zG>04888vI1xK>&quQoMw6~5)3xZ0ZZUQgV@1n74SqbFc+CE$v0p8w>}arS6lggkRH ze=&P@ov&+Piq(0~)Z37y+U&0`%E9cq&lcF4b8Dr1rmD+lLpmWpMsMEKfhcJR{nFwy zzWbKkyoi)!fB9QzOdVk4pFj�+2<0q?WSkfEG&b3{^wur0u)!H`f#%f6o=B)*bY;_+D;s9@b#z(s-0tC%)GAlpT;|^es5K*-Fg#duYjw!#ls5U2#of zylmC#nvgs9Bv7#j=7ouQ0h3*JjIR&6$J>(HH=-;AyB{2gQ> zB@^xCbnq7UN@baPYtrZMqp^KiUf|V7_jYs>KX*C>JesZ#C{Ev1 z<0EZtuN;PA8kIMA=KFGtoIs zfH(v73u0I<=h%|ld&Ki^c;q`yT;qy%(jA>Dc;ssvG|e|xn{_vKDoXWv#rRm)aJpod zz-8FFWO&fsk(kf(AC}Z!61b-2vj6c2YB`b#wJ^Bsn|qivz6|9q9vAUa5q(WDLAc); zU@2R?Zy!^btGV6*MR1N&BigJ!);!H(QW3j%S0NG9(tmv(^8o*iTVjiT?rNN*$lpI) zZaMJk-7i};gYl+qpL!|{ZUZ9&lc>c%pFEP0yv5pC`ycm3+dsFmq48}d|3I6x5bOGI zX3HnQ4!OG)4`20)Gdc>C6eY=z15{)50+Aap4eu{BNN7H3H10bzM@prKd|!CV%iH)@ zleh5UK)j10p3pmG8guzv-D~7djm+(&ZPt;fhU-sK*b~3Mh?0j$$aWSb-3$?UE$aNL zD{;{*DtEXmnIZi#DO~a=UQ<@5?aibA@LJ!#ef9XGT@c+YlgP{C=r&~PdhoGN^=h|; z!J~Ww$B$z|TwjOvuYc7FWD5CRez;k_sTWpLDNUCFp(w(b?UgC|3$zhPHx?pFhyoo(eYn` zC=MAN%plUnr1u0;JFH*WybA;BhbU)!SCe}WbuDjiMHJSuIC49eo6gg`2l;L%ia(BP zxfH4}&PF3#CQ1>kD4BB#jOO+N5!< z9rr6C@%~G}ufHYenRD3$`+pj|z?s68x?NuTzEeKQ2)H(ks%zA)FW_N zgqJzxF<9Sk;kTxx|9p1A>-A^qjMR&__mE3p^5Qrl-wM+lf4djZH)FmGjCS|*Jz!=G zK<4Ade+7KJ{-RbI*W2jfEg@e^g#JnPUv=Nyey~Vky1d9mr1G<5QQ%Jwr;{D#Oh@+X z40(5FHF^|A!+Uy?wrwO>G#J<~`z#Rz_4Fp?5gD};&j~{fT|Q{bf-M-UhPQ;dFF9ucJmGhd5ur(;Bwr9Q`tmDFf+K-@LzOFk{$_b`2O6ba1#Kz!?LS)w&qN{Al+$h12#h&K`u()N{0Z3jCng z?UvtxKnvz2Pb>Q*&)CpN0V54qVJN@$Nsdy4h3RbfOLYG9^F)xiIJ-RQ&a%|H#GPC6 z5c|Pvs?|bpX0{xKZY84qr|8}4i+PLJ#^S987pbhJ!3%RVsJWq1_p&g{1gX~u~peIIT$zD=6~>VoV$aP-sW`$>X{G} z6x-7;!z&&*w&|KTx?AWr6JT$S7z+ex$vwb^Cp1y7GO zO*(bYX^6VbkE?oR@th+He+W>c9`;ke{CAlaN!3)%cTA&d2q^R(vlvjG$#ik6~XwuVCQk<$F%DR~}Wd);B7WK=i zSD>fAwP1NU9uD*tAX*aD7@W&jLjFxkAP6V|j(Ri5??QX?n|#JLe*@&Yts`jvh_$^N z&-bQ9FgU$A{BSw*CZ*{sD1IcQgZ>U@<&4OMFVJFdTC33M>MV8G9C#)CbIllmN&YI1 z`l1?>N`SIx6e5f45gZ=|2RzhY?KswG-JV%|{n?di?1`&C2a&HalMAD%xh7A!g#`Vs(F*wzp&ElxMhR+9azS^+Qn&4%OauPnY% z7lbH^jPdSSOGVhWPNr6hUgmCo^(m@w=oXyhW?kaRS>Lj^Z@xO8@iw3;TU_tmg5cL~ zd6qxYEi^Q9aVYw2ea79Sb_a!ymWc`8wQ$p(rXI@NrdF-lKTBVRc^Qjqst(vp#wU6o zm184rX41~i^*$cayd744%J{P|$>EB>l8n2Yk5glmYK~b5Lz4Y81A2Y`M*8bG^S?m9 z7htw=QR52z}F#u0*nzb*-YG(3v-h%~g*CfuAD*p-_N$t+|tFZ0qt;KQ#HQ#80{^0%b zONP#(NsJW7qqiVAjTc~2JCHeWdzRwynt$2j*{|->YMp=6rN%!A)>e-ngzsN>08Ro4 zHsWV&Tk7(ZLDi#M*Rerx-y>-3n=|x9t5wzs=*dBpu;GJr{W|9hZrl>fjfB4~Sz*cv znw0X}C{=wmvNuy0IdFT}qT?A*&VugkH#U|Y?)R@H ztqPy~xkhuDF#smoK>zXua?;J$f+_MQIGxWf##_oa`N+)`qRmlwRd&{(4&75Ub3I-z zx_iCC!)B{S)DosTofvI>$8TpVr`?Qe-~*?c!n5HcxM%s*>w5{R|I)jb`J;YHls$ex zKjPFE$Ic8f9kvz~YyH#Oqf@WTd!NCaewBLVDO~PHNV)xn!QS*gHhA+{p1bT%()iANXb4So;-Ep4= z3qvl4Mn0BAp@6Mp+)izZfA`IkChMg#V&B!FHkN781D#Bk%fgrGej_;3Gw9qZmz*z0 z-pDX{)~cBP-FWD_(dwbl`^nv-90$tYH!Od zeDKLin?YBJbfu{q-xkK~O|16cyUMfo?@Gn=4TcS&^VX8|3QJ4VMC6+=QoEy*kkeg1 z;eNq9ak1W4L7ie1PuO;(r0Ytft9}lpcMV%)y0f<@OTDEVv*rGiHbI>R zgO}G?7k@>K$OuYFJ>uQpSNs#WmM;l=Rv(qz6hCs&xKjQhnfufIJL!8iU;2V>TfDu2 ztG#){gf+1V`|FW;>>m2&`g;)BbimHANowGRn50F^REN3DltA3z!`!gL4!!l-&nmYZ z9CS)cSt{t=?4rXGwK1YKwI-hmt%J1wNLHCLmMT}inwFYc-urFc9`Ef!f$n#AQor7g zca)L2BoM?#ee^xHkeVoM@trF3m`9t;d-Ocqr(>mAwD*x5e(Oayb(^+G$(%U*lJQS-sNolAXBzYu>^{ z%g@Sb{@qUh=U%;Rb5@<-Ujn`mye9`u@4rkr4#R#zK>nFBBEf# z^ys7`{V}Eo*{mxzS@<6zd zd{GDSrAsF+*_Q_YgAmRS^Yv1*1pAS?Slx_;(8T7xH-qyDF$gObP zN=^PED^SeGCiLY&iyNz$`u^< zeE6f^m+AR;0=i!O){AccNt@nBrxo86e?2?Rj<8E|RYvSgZe{q7^;RXE&z*BrEF~Tt zfIZWFUKhq6g58l)s>@XuvHb7#gxlG(69=Ky4|%Fbylg96lpMGPW{0m@J|ajYA$Amo zk$&_Ij?6O31ramC{Bw^x9oXhlRGMKYH?D&w+{C=-YW{xq{m}{#Plg#rTe}i3dC@mL zG$HjY9#MZd^dq;rLLxtk@{uSxJ3T{|xSpYp|C{kWL%|pGL$HPQs#}g~*Yzfs-rEMe z?FTD0;rVMUqv2mHK3`N{|Gh_BeC*!)*9At(2b@p|A4Tu5U14kbb%5a?O*z2yY+uN_ z@0>bD^G_M2f0TH4hc4Zizhrn>+oGvQE$23~Ov=sN?@vV-Sm57+*JY!mqONVqD0w_Y zXzL`ZV11M@OVY

    2bm+X^54>e7*eCs3InBgzoH zX~a#~Hshu1huW7Doy+h1z3-e#_$iIzR$k@%?|#m|#ytJrJUV5Y`o<@25?@_vK$9w0 zto{K-mH3tzMPhhM4S>yGn9%+?ubH_{MP+)%P+)D!Qdx_msT|!2=snMM;UDnXu}Y}_ z{nY@GyPpPzWUIAeSUzlAP3*_t8Dz_UhgLrpPN%y&lbODxCLq8_ce5sr#Uv-7U+q)z zqr><<)A1QQjdXs>-MaBHU9BR4%ZiHSHnQ=V|Cm({;vzf0_dnA^XLyTAfdlW|?vKb5 zsQSnyL7_5#6Gf5%MQ7AdeoZwh)n@d9xT>^%n1eg_s$Yn1jkuDW&$D7oBmYp>+LoTi z;(D`jezTrtL7CM@R=?)8-k=cCUy|hBw8>_lo4Zi4RPM`E5b}~V5&F;c{~g9PBzQ-u zRC@6+8t`3dNUbQ+pY}o zq4`VwUEq9#9#uLm`+#?(lX5LQvee=~G-TI{cF)P4R<*+Y7L5(PkV(#qVN zp*x}BW_kCwB-lOkrI4xCC%5az= zerJ%J(=vZ{& z3oK}7*g(gbw+Hd&`W~?+UMXA_~@F<*jsYK^7PNGYU<8HrA68NPw*p?zV zavdhuA*$f<-<=zArDeYOg&aAPC&#SrwwzInosYO-f;m+Vw`?OfU!-Uh$`vXn=-i*9 z&V_lYU>^ii3kRC1TP)VcjO*!1YZy##v?U^2sO>!>-Wj*96{29|p&@1v4EB_sgXcn047#k)jp%)`hfnzFu>qYY_J6`YfXP;@a_B*B?!@ ztedDm3qfpXCsl`-Hz+sW$ph^0nhV!6Z6nKb&UZZvo}$UQ=sI?>b)Jt^Hnd(pHQM`C z`6)xG?f2yi%5DWYd*oSwQ3F`ZNDQ)uOcG}Q z*~Loo-tLJT|C&GvDkym2d`>M8P~L|st*)$tnTTJEZTbxOAf^m5FaNWSL^SMX%h8!R z?RD{et(#|;K^!9^OIIx8*SQdtFGLuWv{`ld$sml8oYP*(2 z{T%DgIFSh1RrhOJ%G-sFuW76o<0~X-tj8>cBKnWMIK4@c98}2J`znFsexcy==bf=> z_3E^uX9M)Nmu6sE3+tW*|Hu4B7iipP+og|n6%37}S;oD9u8h*P>6HD1`t;^Mr9D@}d)9aFaeO>n z4-ZHEdUq>AZgf37Vkkx2NqiuKhnun6U4ynG&UNuo884vO8# zUWhU!{Rw3_ReFpFDjkuz{ord(xH66P2Nns97q+=Lv28xtr*Pk6fc~vZ^66x&TNGkt zs7=<{MTkRgLAN2&ea{215^q^!3TYlc)T%bV4ZkqTNVyGsFyoud`P0x1!KfIIE&s&2 zK>s#!A*(@l`RnVUNA!Mn+0`8%YX2B>-V3+Qxmr|oN#O0Nuj`4$gACK>88uQ5j!M?m zx-Y$=pQ=JhmAL+Ia<6Jk$c9exsdRL6LeAe)i(SW?nkfFXD^DwTL2yh`U>eGppN2P~<+(i^AOXO{zd)UgXFH+2!N8vUg+1&imV47uiF` zL1_L1n(6|}9&rvja}y2Kqw!ujL%lADLurtTzP_;MDztmpv?8F#-<)41^7@f~C*15S z!tsgSeXRlKE)IrUUJTO=mZ*|7X{P5KbqZ;RpK2H?SnjKhZ%dlvvU`&64L;ZZAzgLE z5S+@OXKdZ)Tjuht*RocAm_vn+`5|S+vQLh@(``o+I=-T`H9qd=kx7SaYUQ8lqqld; zdRkYebt&$WiCoK#QnqlHtEE+195y-KlztFGPg1=_vM@OHw(O)AT*L)e_2Osf<9R`Knf1!LC8qVq%g66y_xY*i`McU18hhuHPl5X1I^Pn}HX581 zbnG9KqjR1R*xu53EB_cNg zUncG?bbj<4gCTcEW%S!q2NkUpz~$3P$7PFHvK#z*J)mm2*l4L|#>#95M28+D5udC=fic;k=S@(H7P z>%*OXgQTVnCeZMk;~TBl_4l)LSMkWWJ1v~jWz`>UD~Gt7vn1qB0_fOknNRBbg*O#!PU`z8zn@)jdrHmGzbDsr@6l1gkng(> z1=nh=;+3_@DDE zd(>b&v!0D}4dhw&Pb)_Oe|MRvovlkiQBw7I^#ibNWb%@#D3?m;^F*8A#<7)FKgpcW z(I3pN+)n+6m{m=txdw^+`+WWZZ251`r}CC}QMuB^9)k6KcF|sYY1gE$L|t+W){8%E zRXcL^x3PGjvt3>;Tgv3?*rWoKZi^2-xy$JO)r`I`95Nm-%+vUO)!}I6^*UK9y}f z*79%bQr$eo7iPyoVLGQLY0H5N7<#c}tBdnaGQ2L-+S?c~YWTpYwUC>1V#c#G{S6(b&`oKVOZm~8JM(1!!S~5# z$=&}-eHH~*=K@qXhzR(k5oT^~45t{&+&fYUfLYwFynryek416#y1qaXTC2Ua=^GxY z^54T1r3i19qi(CeGDK|E&{Glx-@LVX`&r`O&##BAGfer&a=HvRMjqP7enijue502Q zx3I^d&tLrXviBa}_+W!{8Oiy~pxP6UGF1jBoDOe6MOmtQf--JBJV;*|?4*{#{3+U+ zqH#kBq73%kr{}OyYRW0>*%Jj6jifiFP~g3W(#FLNz2p$ir6*d-b~q@Xb$B6g^*V$B z{PI6c-X8m!Kt-fTOAsl*Hw9FV#6eiRxbR8fMt#$`cb3UggCzmaegeg5;qaL(JgI{e zel;Q4DO0L&8+C)~vnJ>UI zglo{X#m-J-WgIKALY=V7_yt160o6brU!meQQ?qmE1T{qakV*JFtHDOn zZ|06%?quNnPol)EEaAUd3rvXM%v3op@T!)ZJeeXPQBPSRrwIT==&e99=3n@VQQWXKjezdZPF_o^mzZ9_ z0LbNecWWABYv<2fbvJ~QkUn!~vlnDnFHOx@6N3ianL;Ow2VmKkpi%>|n$zf<8?I^< z+Az|4wK3)m@;cj|m~eK(kW_nPs-aP!}>UGWsuifK>*TcFMm{0Y!s5^-|&WBP@KvG1gUnFTO;_%V?u`5OY)rGz4#^^6h?qvy0{NIeElE z9Y+9vo=biXDu$dTkboX%d$tQHhk5k`szSd2QzMx$J81;j8P`_Vt2ZA=AyLR%v|)T{ z`+FmgpJ?o>Eytt^%Q6?;)kU=20^_?$; zLgAt81qI>Vx16lJ$@N?lDc`A}GmKXO-k*rDeeI3tosfV`6d}*CR=HtnjZTAI9UIY| zKBfCB`ohxdV%YG&$&TXMd}6--K;6=|KNE_SAS2RvvRqj5Wuy~ zxvKpfMvgNIVaSHhJ1;z9BUy--msf;~1fMw`Y>TY3nv3B_Qy0g<+-I$;aJARfl)s0? z79fNyCCy2w-hjAT-RX5klP1))6?Kd?YB>BC-B`UF{07EV@6?L2iZP;E zTJ|AI3?)D-A|S4cXD?5W(But~P5@~F&W$827ATb1c^;+C%D5SP1K5!Hh@3UYM_Z#* zN3CgE9!<52|UM9mMF#dwT*P zuc#XtHlw+xUX5R#uO7;|yxZKojtxWClhjr&pl`LlI}t$gwl;R67(&P`+2H{YVm&}9 z%+d(!C4btOKIl;wEYC=X~v(yx|fr-8Z@BSytppd&P#}*?#E6 zI7@vahr5%_cI{Py$4&cKnmHM__SZWIqnj$hV$&33CKf9c|n>iHywCiw56Fc^ZiuOWEaqW|1p z{k&Vf=ZdcwUqcygcQ9_Z2GeRMNs!*&;g~F$w**k-_qSgKxuiBM0*M5J4bZh2J_;FN&{($UWC)AaukkGvzNk;T?KmVR82;bkMLID1#$1? zHf;=f2f_#UItXA{BJGl!-GqdMIHVlr2yKTxgo-MtfUvMUxK5%B(mpWh?Q$H#WlQwN zV*2fajxQQ3j&R*I2mp0RITwUl&n@XT>nMi)I|;_yOIYRg%6l#aNOcaP@aLz6^@M5S z78oeKeh79zE(LZ%8`D#V)AQo1Djeqa_rsKn<D+f4!Ph5y#69R|d03zE^%(Gs*V9}C-1ubEmtnMclB@f_j@ zG4-Tf3X>6PInylC>wM%4i>EACOasrIJH>pcWAq|(W!rE>sRIbwG{}S8X+nW@YnLx! z&Y0cm2p{kgDr5_}#%_U&b zr`;jltG1Nmz6b$?_4yVCIP17Ry>SYfo&nFF!*MmhVHj8swOwrnlRx9p=62LuZHBoa ziW9$+$0DKRfq8utp=G!Czfk#8Tt67h=6p0fi1KkYhlTOT|0KVQ>Keq$;mT^{=eA?s z5JmK>?do@`W%8YO^1~NPD4WwI`5VXQTQmO9R<&H`L5pi^v!FETmHaMxM8ns0^mb0N z5rjGqfX}-(f_gk)_jbzHe{*e&6_NJlQ%k1s@#?Zp3l{PANK(ZonUd4hQFR2;v^i@d ztxSC~ixuu1=>&2gOvG+**3T!2NK%ZGX+iaw_(MpCJ$SHVutsK=i3ioA_KyvJ?s8BL zTkxs2I6a7Vn?dAnIaG_gg}vndwKI?Xu+WE})R=Bk0odn9Ky zsOe;;LJ9hC^~77>dw^!CAzv$cQJTb}%2+yGl1ywQ5OM!4`+K;#M9`F(GRzSD2wwpB;`Jpd2%WL&xAH3d7k>pZ4x zHO_s!`3QX!j<(%FzG8`Dp$)IcK?Xqp?|P__*HBW`N+{K%w*rBwI;)!Ge)B^wq?>M< z1t2qMhs2YBpoSW!`2j`r#X>N_Fv2b#>$P0FTvF>9I)VlUvW**o@Kk&63Y+b*d@zc- zw>s}OyVKpv3OL=BG!v;kKL}C8=@?M3Cz_K6&LefMlSbhA?u)>Ilye?WM)kT)Oa9y$ z-zb(@Mm`}z+z717UM@IR1j=!4Y{7Lo-xgFgLY`M0`%iq33JG^I-H3Jhb5(DZ+aK&YUFgy3I!g@A^e>02+3iWa2$olQsbRZOlw^ zm3zo`XSLURF^Z%eDgFm3<0QhH2yL7^c2m7X?j)CIXAdRik2l)UuNkEmF_1Z|n8fSV zIP6ypP9Vr_q%eU2+&m@gm14#*rME+}h`j1IvvyGoDEB%jHUY*Ag=O(r7W}WJVLsQR=&0wg*W$eHM()ybfAQ=mUd*RB$l6mNMz*Hoe zIE$~>SQ$*wA9qzhnN9*b_&BWi=22HVF?DwMQ?OT^5AnJg4^yWYE5aWdlXf%KtXAi&(-BEJZk)NjizXmgTn z<{^8!na6{w@ZQLRsGhe5IsY^IwW5vdAl}2#eEeQH5m+p(x zqm$4Uof$agD9n=`9aVX z6gie99^f`Kjd(Ani4o6?dgpk~;wx*YL1otVV6Og?EJ~+v ziH!IAS^Ipn?D=SSI1kCl;^=pwi0pYsZrP+E6q^O8w^+f##O`BnVyb3qglG193`OLq z!EF;FtX$IzJ{|mdeTV8Yhz;$1`}iWV9jUxVJ?V?A2f8atxzT%an+!X1--eORL=sC! z2ZgOk%V%b@+!VCTErYVxmmBC6i#8`!I)qp&JlV2bm%!OAmiwY=qoI@)c^ANSHE zZyU|F;!L51$q}YF)Q$G{AtF^G3y1qb+6bAQ=@Z3_uAYH`m1kbkHt3OLjJx>32rqLX zrmKibW`la~47Wp66IY9i8aA4*)1O})e4~Yk<`Lvkj4qQp;q<;>O2r;*rCR96UfNXI zY)mV@mPpG3s@ZX1>JykDCKaM=vo_RHB|UIXc_{~*0HV*PHWj&D%F0yS_~Pe*F9)Rx zNWQE{@+n`+*8thu$i8tLt<|h4p^P;+w&YE-@dQlF5tE7VhRs!V$wqByr)8J}Hi6g# z>x$;eEsy1Y5X#?^_1{;|0C; z%#r-zs*F`h15P>5D20(?jxS$9ACoKmIke@dSP=O%W*qxI3MMR>CR=C+nJ6>tfa#uP z31DieC{jrzm(N)_7I=O#%(hV?XSI;jF{+NNly?7kOyU5@6Si|wH^6-|=Tl|z2HwZx z;5nyG0QGE^cXBUnVBHN(PF6c$g#+HuC8E@L*Z!l$i!jrQWTzI zxjWNJ&_7dLUO@EgBD1TCiBZbjCd9vmjgXcgvG@imo{8d)#mx^=&gPh?vRgg%>UvO& z^B|e95~O}k014!#orHlGydTM|r-TW664O>FlzJZW9x)bkOWP9ev8xW^CbceLz4!Sp zybJjN(})V^i4#(;orD9izVQUNq|pf{`0vP5+%~wx(omo?h&r&sH`N&0Q0mqZMfLRF zUYO)QI79B#fl)gr10?R(d%rqCDpa|zE>NnUB&K*4He0`W7&{3lSMGuUmv16Y-^UX3 zZ;<-(gB!@B7V%(3Jjlbr@E>ueiz81cVT}l^!iEXSI0)7S8A|b~r}gc+5z`0}@l)eo zo!xwrJnoBYjm+9w=Su|~fGx+lX!+_fWdh?v^_SD;s_wT4D><2$ znT!x1@7{oUwS~f$xSahYsK2o#jdjFUDXKeV4dgyC|JwH03fmE|F33skjECx0DGa;X zqshmwH~^&S!NytQ0$3hxn-_tfpC+~ss@K}$NeJs3jeF+_H;7ark8oGF{@=vv`jZfE zCinG}p$=`HX{xQ1*C9z!#?WnDja8z*1SLV5aKO7Xo+D=EA^06D(2RuRmtmQBxzuTJ z@;DsrjGX|I&Zaig_<9{Jg-6)k$`G@%~=W2-r~<(Y?48MUiEbQHaD zJ>89m8lYBp5Bvq-1v19{x=e;=4w!j38cpG22A@+}QrCg#r6dJz>}lComq8?>I)F@^ zG{S}|O?pv?ToEeXRCjxVkwtWgPX$o~fUew{+n!45xL!P&rvjKg?bn_?+pd{)yP&@@ z$)0bYV(Kaza04O>)K(P<1gzF!*etd4+`NOUrccNd48QJ;rxs@{9f5qX`cQ|nvZ~fC zTXpHJVt^sFv-m|4Jgm?2Xg!(7vk}@JWGnBvQEW)`v>|%KbX@kxc|tSZGXYHG{jXlF19ahfj@yG=Qb!vOGws@-dgf0f-eXN0DcRt+ZlRX-s4YGG`5t1^;NE2%} zeypD_*LiyaDIGUvai_D@SKk*7$l&5;MZ7lGs_12kF{zpaTrcZ=kn?=biHWzzX`NYg z%>z7V!z4=ubPkP?f|AcUcu=Df&ot@}Lnj0pzmBmpLecoSFbvAnaJYT4T*a^zuBLaA zWyUQ#ePC3vLm&NY_v=wV$S2y6tCL0rF0+-F^Xa8k?!IJe?fH!VyZxP=1`zVqhcrYxZVQ-rln$;L17YSb5d zL3Wa}hwY;lW_qyR^5g+^H~4z(aqi$GE6a{+U%@L|wR3DjHP1z?nHe})I9exldONm` z$zW!7wb6BvhHszvV!T}D)D)#~uSwK$4j;#3==%8Nq|cG+Dsm+fn^<>{S*$L*-&S0` za2CYWI93g5^-h&S9Uh=2$JFGjtv_$BYGBC3JbVRYAWe*kh=vSCsKfX@Nr_LmQRanD zByrN~$MsZlA%_ncYbBB(Vbib16}!QC0;F|seorA;F_>dEWsXf!ca z1UPcMlf^9uUP)t}i17Ao4YZ);Mp7uGNlw@1M~RvU5jOOC$bb})>RuS>3Q>mFZ&i`1 zXKmZn+B@+co%?9P&**WK=5SvG^$d#hz9IYFe)i;DK>ko>wj+ZLhkiLoH!v5c5S9JP zIU)a5t6=r_7rZJQHXiTwz6bw};pJ7N&xwht8uI%s$lDEuCuSTS$>I;s;Y0`;PoyRR z6P+(gw2cVT48nH6AU<){g5j`eiFGqW@q=a8w}i7C3{kY-GsQBW`2wA8;*>Syw9uIS zq?uSdZ6EsWcTA6Xd<2iDq$5MA#XyC?KmUpkq^Kvq^ON;829j@aaQzKso^Om6DszFg z9FI_+Ggd$oYFhC>h%#J}T^?Q(DPj#RJ8tKMyr`9Zts^C5 zSoOMGVKdldk#tZl8kP84u7k|z#%|dtVCe5DPt@J1l3(^|c~kJS@l&63ZG$S4bJVxQ zk<=!(dQ_f#WjuQ=c2}27bbUYdKq6%IV|G2U%xZl*C1kbbH1jhB-_V0V#*c{l4!O4 z>=M~$<|}2wyhf(De`nQJx0wS?e%Kth1nR|p-&E8e|N8Gdx6!Nbp6D&@g+z@VZ!0HF zY^td1^_5@XFc!WBgM)>)_vOb^E@k4#z7a&&gKZi#qW<_`{j+me#wX@bi-aQ;v7AE5 z<2fqb1^gnee*Lx=_78JK-qD2bp)Gwo1}j27Xsp%!lu)iUFr4pMI^!HR*Ow@klT-Np z!(h@tf-V;)v0R7R=X*V&v$)=Crk?jj>r~F!l>YcpZ(|j$vzKiK7V%04|F0z{7a3m$xFtRY9tc*H`adNRAZ@}>0u-XJ9`2AN`DmE z8=n^IdHg|fa%wzQ<)+))y=#TnSHfBVJE8Tb+nNL1J90z9Yrb8iZa#ddvFoU?QOY-| zuU^!Ei*m1AW1~e_!`ZoB57gkYWBWbGwZs!G(w^mN^X4G9~?98bw9+; z5dCQ7I<{hdWr^Wx!+hafrrjI&{??>F>8i+@vaug4MzQL?f0EnsE4=T9*9MJPc$Toe zaA@s+PRCyyygT?YF8O`;Pl+U&ccT5Q*k^#7N5Evi@If&lpTnomU^cI)npcK_l<5fF zpqx^-qKJSz!cygb&WsTU|7reI^G5QTo0^s{KP;&tgnCXTT79y=Yu{UC5Q};JN09S} zUZ`rqmU7ZR^}(F8l<_E0K)GY>2uEskxqafNhb_I8=JX`i?vgF4_48-BClBSNh%=o^8XU^nKuj9p zu=Dj?z9VuWBltr3B+}n0Q%6IKk+p{?&1y5fh#U5jHZ-CrRBmK9@1puY_j4%nb^Xwh zNY(%0w$d1E{cOdfC`f-#{HMX9R(#)N$LW86PPq_8*SxF2v(aNgkN%F$ejB9$>*=>W z4h+Qdh23UVvP7?-9DX)r$c&A+Y~ zREyYcPq;<9!6P&A*7@$;nOYS)9j_Uy(MCS*ze=n$$wV#pVTk<)qjh-kCEZAq6>&KE8QSZS-R9tA_nxd3vi2{DrN<=TVrur~W&WljC7ndA(V^scR+v z$}Y!)p}080zzlG-?3(a)-6M9xIvI9;DC+9u)2HGY>Mxr2-rFl*nPvEf`mn%qegm;a z$zBX~7u8KkqHB-uR#ZjIZyDwNw>`z-tgYc3ZFSpbKlxfdAJe407aS~~zGCD{?f%FY z*dhNY>JLLrTJ%WR{{d7$tG}$CbvU1&XK$kazLq($*j?Wx2wMRAFfA*orj9^N0QkQ?uKfmCxz&(zd{oxM$J_0>-|t38K-eSP3f zoW5fv#wmI>~ra&sUpmm|c zL!Fk*VbJzt$K;FRa;IH`9V1E$vmyTnwkmOA>3Un;4VQANuP{B2>*pD_L`Xr(D*Y4S zdKV;FtH^c5g$A!Ik)lT@OQ2#2DrwEj8RLs=ZKFQc;o2@JgD}Hl|8i+x+GN#S7mE@R zGcz;nnUcbjB0@#UW{Tl5AsVwTdAvvvd28~et2{y>X#y0^36}v1#4>2Bo=?IeX!p>d zBx~QPp*)RJXp)3*(E3#4n=SE*DzZBwBFHgS*9slJ$k8n{?(z5J#OnAv|Hy+wt#D#sY_N1C=U8 z<;1qc4mM1IPMtcXJa=xYex9#zO8L5dJ0&F-;m+N1t@hab`T_JNd43emeN*U{2+6$) z21_^(lL7s=oj4&3bgsF1Xm7}goyTiBY!AzUcwyjkTYXiNltITIpDPa=qs0{rQ!)uWc|s)iW1N?l}Ss_&Z`)AY5PJT^B`90 z@4RlRopZjc0S^D|=&Os1*)*Dkqhm+>B5mtE(~0-&5?qDW=3btUK%WV56P8Bnv3%y4 z`TP4XTej=`d8X*q;~h!oIZHO=&BkhLFHu#+84k*p?o4utxYU1W!W5{ear4Ht>(_gx zyJ*U$kZ&*7VHm|93C_55$?TvngefhOu_d&2rhFllC;cXC5*n2IiFs5~d{yzQvP1YK zR+Gi+*1vcux5r%MLmvALZbo#(LG$+&Nr`XuY$|icb@@G;9u^TXXfU)~O!&gySz7B# zV}c42Wp`J4eq|Xck(+_;xOn#MP8<=i%co_r3So}ZLwqH}mG}AFmsPgw%~M#|l<={= z+J4Q<%B&}rLIDLsg&!M;6`QWyJ$#~epeJr_>cqWxgZigUp93L@u##9#u`ncOY=D7! zL!8z!z7BPQ_#?I@dY|&1myY+OcL@6_I@XH#+uY3cd%4cW_}Yhf6^#doCG;&QYmU)sUSVcXz=TMV0}r z@!HlnmC5wD(BsE9H@W+F+h)6!x=ww*dc6n%3-zBm)!)7GZnjc#}3YTxjOVj zO2O0H?nS!`8q!5%w~I=u&7Z#ydA_~c{mzi6!kkozBKEO_GH7>{mm@K!Zj&BUUuj-K za#S&3%F4=O=v>IA6)!~z*zk2w8FP!Fn({4c=ePjj?B{CN!gma`_Z?=d5!#xU#qO$a zkddt!+%faC!P5va7HQ`3h1Yt({6dVW7xbCjsAnP#HIKGEIS^%UGSC9Fjr^WS@rX|e z`h?Wf{ckE(tveTZMS9{_8O;-o>Ra@y8XJr16jZz?*{HN;S7ffqcODPNA9zx>SbFbp z_g<~jHmMp%+wtpXzB#~l&1ri-FX@iM#6jvKp|Fa?^l?x@qQo4Tt6n8&&Ic}zhw!Ahd6Ef>=RVzj_of_| zc;55MntYCJY^b_tra{0tO4BVNoujcy@<-x&?&NdboFKi=bDVuiz2f#D5yX#fi-hoeVuMcLjK6OntFZYU( z$$pTaA5@X#30>;N8TmIYyRgim{BEl2#g=AC(=Rj@%k!x1lvln_GlxR!^OeFsIoy*f zPN zes!*2L0R+JRKnN(+Rj4B*;=K-BD>?`cS9#KFTCt+?VM-d@Zsb23c1C~&MtR@R=6Rx z3SYZA7M-7inK;oT;M}EE>R{6@8PzBKI~yiGKEnk5?Q;>)e%3i7wTq{jbr-IF{d{+o z=g?EH)GdP@T3ZInI5{#~#c~ZOVt#hVHZo%Gwge0)S(C10`&6`X^7kuQZyRj+Dp4KN zQ#5&@fktVzw{LBM?keIr3tO+Zw>F85gVMz($2?ai{HCGEXu5Uy@L@P{PhIXK&TE^J zhQd{8X^eGruSpO^(-7*rs^>H@Rc3eT0%DWa;uFBaNSVjSzmA(%CMl0Qn^72X za8I4;7N&SIcBm$2gP7v})VJ^Jw;fVnd(~w96RT*v{|gD)@_~R!LxWg$O$CZ78%3S>S8va6w!@?RfpwVB&OBzc(|R_M9M2 znew&v@{scxr9HF7hdZbbS+kT&skN7nSz3!mIo*0+88FVg+&g=X~nJwIA3p6hAD-M3*l*>hdO<(eQKgqHTB^_p>@@n z9u_+%5eS6tuQM7RC?81ozVS4}ee#5xO(oG)AM>;(mbi%%ut#-$OuuxgJ+OG{L5%bI%(aFZfgprLWu_i?j(1u70Fm)7#l- zs-f|)?A#2YM8z-%)-1BPxOler{hB=@vZ_E-c31R=)AoCfH+|mkcyhx0A~Ac$rq8|Sz3(rVGT1Bn4g`X0m}2jy3ZJDSF}A-gS)i{!@YvpT{N6cd z_P8AAnWF)}eU>Gf6v~oKSxnY3Uv^YGIA63+Oh_?Y(=es~wtRu%q7C@aQ0DO-D9q=b zQn;+FY+8DH)o{oWTh>IaL__COa%N=m$$AFhr>6$Hj5=2xSnP;&Kg)`ZQ26?;c!yVb zjLeFrHQs@~lT=+k&LZkvQBkqFKJXfMrl77SCrD`B(C5Ah+g~1!kpHmueWQ?Y*lc;{ zp3gNYTVsUy#XJ$8C_I2O9 z`D^oD(}wg_=OrS)8ZHgfp}qKAGL-k*%9*k&U9`UrRNU6}HK6HKi@eo*syHst;QpnO z`*-yZB^+vZ{GCK%FN#mt(H>C z4eIte=h9lXM9G-1@`=H}{kRN;+nK)l(sd$#WBQ>W?z z8#gt?5Ih*Gajv-j!i_yw7(?&x>_2f@MGJ!7Ldw$CZTf+MZ)a>gzT5-C*A@9L9@wkU zxaIl9;~yIgmnFnH)6SPh)W7s_VLb_^WgL4z8n&Cd)I&BtK7O_iT})Ea^CBhk*s)`} z?s1D|-BNn>>a~a{roU7DPWjc9t5=J{454XLmUq*tvXlZ!=O~cgwklz_mG0@#C0o_? zw)#6dsuCV$I7%ixpT1`Cfx_n<`A4BU{*T=~JnDB&o?Tg430VKQ_PxTp;SPsX&96A` zf9*Z+;ni>N-hE)dN&E02^Uy&Z=T+|I-UYZa$Yxq!i9uq^n=_rY)w&B8!V6L>_9-4$ zva(d3yW_BpL5A?_!Xp1$WipDVKp1)M9KGev{?(_rvVDPvA-g3~c$FvV33<&A7In%r zt?V=3f9S<@GfE6_LE77W`}$UGc1V4uE>hglk^eyCTK1fWuS4gjxL>B{ zg${fuKcaOTP?WYiV}+Sg$mi%;f3@|9Vh0# zCN0a5+UmgN_O0^V6dxBiZPu*d3geHrN=mrnOB0hf=r1)4$=c>Tp0G}F(W3T(&T9p4 zk~W?=c`~tlhoMQZY6JekZ|iSIIm(%C{sP1b-Tv*!{0O;%1d*DA>-pu;(b1A~^c zp8&ydJZY73=FIF#6Ea>nJsOvY-ML6Q$Aq0;wO&K!$qmgmdukHbdKG8hHH`X@#w!0S1*N>`DomL`t{PX9}U%q^K_wLPHlMobjLdx9PJs$|-ym|8$ELecWVqthGUV*dRAT|1PoV|&Dz`MiOuMdX_ ziR_eAFrhw#{q=Y0uIQ)Z>bveP-)@6qi zo2^yqdggIn+r_98Po6&2S+e9wRaN}KgZ-_KecnCGT4)y+8{5>3zIL2_WF^J4e#(`X zG@ifhQnK`vWVdEpTU#KvJ9g}djEpSaH)C8-&wbspd-uY7ySlsGvb=We-Me>PVpLR= zZbOho(23rVO{-V`7Gk+#5L5M{&23RjggK;|J27DW7TkgbsTmnLwH+66O5s*}=A>p) z3+gvFmrmZYWs8D>LPveHUF5_r5e?{N1OcMjinxSs^eZyk;FME-KTB~~BT+#(gf7`N z$v4Vdm8w3sGA*q}A!lQs@Ld$C4T{#v^ zU$h)C1QUGGBDp>Y17VRk2nF^EhVeuP*qX{@bNHna;Q16JfJR1){TRM1Qs4qi{A1@F z^!aQ8-p(@9eBHMHuIIo1==pydgMtM88+yN^uRnkOUsH35uI}%C|F8Y4|HpsiWu$0n zZ-JIMfl*q+4ld?41Pd6es;<6D%R*h<(%BMrRMUWo92SktQCG*?VbR7vSSp9( zXP~Yg7#OG)sHMha`KUWPsRyAGX`&+qhpKGeFf|H?f;Aai5?;_gh*tpK0%bo~6}Diq zm|PBxfxz}G^cS%}UL2S#ex*J$b})lXWic5{E*mDI-ImA*n^(cahD#c$B+s9ePGf9< zSqR-2%jN{r5jGV;I9NfCqVM45^S>X9xgG%^qFVq0phjl1vENnxR7cO%O)%m{z6gf| zqr+9vx@iH%qcsnl(H}s=f}cYhfBPx4AzBlh#YQ;BF3wh}dgv@8mF@+F?u{t40GLKG z#-f8sVBah(TGV9ZDgcebC3CRo>OWlbq%(b(*l(?u{%l+5cyS||uMbS3b5O8RWb?+u zY!(?^T=07z{yurln!s{DTNSN>ik2#+`Is01(lQx7eA*eQ3(kzxd7u5!cnZSTc{C;i zYw{1M&6}S81{*1=s*XVytf~sI_zjI{1@SR>Wsm}BJ|sR6fEzVO_5hABMqK(R7me<5 z8PgXT-Qu?nkt4T`UOv!K!0+WtYECkGXBBe8%<^*6dDHrV8K85o1;<5 zLS@K;e*pgsiAL(9R3E)QWN9ZU$G?fH2EMWm^rfi*Gb`oPZokNyJkel{_i?EB-S7AuMW4+x|K zCCgxspwEVX_H7>i_#d_IcgmEnc*htupw`jC+Ca-LM%Uq2(dO$zbmDJ15q!=s=fyWq zG&WkalE(HUamZAJ1$&X$z&tP+z|0Da1{>y3NgS9=V!&Pq%EG8`jd8YcP$xLR{Ca6@ zHJE@3Ji^BO%uten(PPm7e{h%#HH5-d-%Oz)K1`JU-uznIBsz*|HWLts1NZ=#9wP6U z#|b190t5!)h_Jj#WCZ5*aYrwW00H#P1~q^%wCEc6Zzcc>xF$Ym+Z3SA_+$86<`*h~ z!Ri4t3R<&M(3Oj4_0U?aXmK81nNhGK0h;)r!6OCxdEGbIXq7Y+3>L!nW1{qgM@&A` z4}}>Z(1$u^MhuM+z}$fFHv}-uA4x%lQ2+!$r4`yh2P{RW!yv+>BWQfXqdUy>1|RU( zKx^S)1ltT|a(U$8$tABZ$Y1eR)PqO?B!E+_i7WqL1leFFB#4BrEWjy>)KPBnW+4bb zhc_pX#6m`}#NQAbFdh5{OiusC&caGTN5uUZ+HSXlVD9fSv z0N{Y2ipP9`U{Vm?A#|o6ptit&0ZV8I7WqLkzFBN^oo`nA2k8(n{m9+u%xG0wU>twP z=wmd6H;etFrU2krp`WAc!G0iC{T{h1i7<)Z)diJDI-B`jv3cH#Bclbo8M~J;-UDwx zV?2ma?D4jQ79Qe{U;{Cy2ZKNVW}$@_t7-7*44C7uu_Br23ltD)ozQnxZ2+SaLPvlu zg0*=Fn@{uRu{p|fJYzUQ-UUCy$fzHLjve)d_;{euVKSY>W`B1VUqMqiqi!g`(Wn;+ zyD!#ICnA38Xg?eepp-cy_f!7ZBJw?b5`_Yk0Ek28FW_wgoTIfPDQE|-AD8^ActQ;& z2otdYMh(8j7==?)SKXErjKZn?_uvF7((m^mqJw{e84cJR#Al<+qN`dVUO!vaipFAd zU_Y)Gko^&nLppm&!8;|X-5H5XyANHCbjkHq4j`V{D`pR)f?g1Z&GOYnD23LHqKk*OFe zlMaLlzzbBmUoea2L*ew{sDKN_CwVZL)EX><1Z6AL^cpp}fVdU{w`-Gr|~`~+Zr*AnboWXCI3w^&cm4@@6OI;^Q>ps8t~r2)t$ zkg+i>!T65Y4>;oEtb~E1~-A^6A2@EouqlR(j^;$whHE@Z=3J8*Y^)QbC(7V`vG!|_naWR4f6k=YEek4Q2;}8z>n|eaI0z+a1j}RZFy@236i~+9# zrUJ$UIs^AQ~X!9-$a_l~6mV?X2@GTLV zqM4pu_PM0u#jzSYLo5-nxNQw0+(8JE5^L z-dq*~EQ#>O0MTJHc`KsCL9d{|o~POt5gVF>?a(wv&TB5f7HP#Ms%}5$vqcW+-^HPm~&1 z6)XkgSAr9mxXjGPhPM>j$I9M`2cLz#gPRk1K(}fco_7hXXJ&^nvv4NZ+o3o?yIwhgQykc(lk@1% zRRkg)2b(z&h$up=ob18$C_2Fi6lZoAFwPFop9MuVJcc6R7WCYOi2nwQCEm;i%tb^Y z02eSLH>>?LTlar1-}!wmj^CbRi6G;tr;Z+K8ffW)fB%_`C+1fJi2t8nf0Y0IE}r|x zYy6A)-&#M(|LSP|dj9u6^7{4s@2|A+ue9;6wDG?l|9?JhEa2{uMDgEy68u-T_*b_0 ze{;6@zy0ywv5)?YiU2zG_hRtFLyr861N#s2nly&Dnje>}%AzsVyjbd+Sxhg4#bK)Z z(ddgoBuDb&AS_L7H9yLKvG*k4QB+9>J`|=wWbr;}MuZ7WCX<8^jD|IkK%ybRB!FCo zPNtI#naqUg8DazkS4COzKo?mARCEzg@jyYr6Zu&|1Ox>ISCn7T1r`s)1908Hs@{8j z%uEu90rlVXrzGiqXT5s$s_NBIZtqtE07gH&>VQXO7d?h4W)kTKp>?u03JD!ysVa-1 zsvf&bDm*?bR;K$+jKKDCZ$&sLP9Bq0q2&{qaA_*-X_=%oxiV0TUGwpf_5-F8MwJz6 zD%GH`PD0&@Fh7)4{{%14DAaG63_7LUNOMK5i8G9@eP|e1C+jmO=aT!YvO;<$QqPhm2-_%AknF(V;k2*Tn10-1 zUM1$Ih07|@GLBmVvt|rSQP!P4M=PS4DJ8=;;|;=7ocj&ip6hnzm8!1>KKTqSJe*0o z2{gAk*G<(=fX%r}%2CNy4FIQVsPgtRw&z|8eq?G| zxEk>Sm%7RiRimoov{8YL*6X|>7W1SCYP>;M0sS+7#Vy@KXo^>+qW&J~0!y5U+sCi+%O1Iyx*|jq-D9;(}68Isj+yh9OQY)i^ZLT7=S(_-L9Wo z?emKZ0by>mZUrs7jESmQ>m>y$U?=TWT2V#!3IGyEW{Xi!A`@s~o{#(RiZURK!t54y z7Mk7CD*~1ID~G;OK#X5sAW6L*sIMQWE#(>2y&~8sTspF$g(nBC69-KIkkzuvfIiP! zPKnbSS`-}^ST%>$bZAwu8nVptvxb6UG?u3mk0p2I8BncL;&o)aLt+IoWIJpxkSHhz zD?3I@VHvCFcTBB{KTTkRCY&-$yvn}g|0bjW`it}%K~GBuh^oVf0}yX4(1Qa3FHoJO zkQL+?q&PL`CsSP?ac`1&fog+Fjj=j_cRn@52s6H6Hnn9wyllh!6LeDXdz7HZ*aFyM zlK~Dtbhy$;j%^{JRJx8?O<4nMfL5RZ;7i2;-Sx)2$2j0kt~i#PBIF4SBsM$8NIIV4 ztQsaAy6HXZ)WLo@%`mi(kAYr49;tKzg=(shd1#ykF!>RQ!v{t(F06%!AT+p$Y&_@^ z%U#{=q51#t!=c%TyHQO_W+EUaSWX zV29#|Ll<3X0Iz}X(C>)(P>lICt$iT zcgpM@o;!!t_!Pg+jzMR1ZO$2(YHtMw;Lv#^SSCb*P+g4|>5xJFcrRg%v9uw*2NO#u z;l7c{<|IVM2;3^-7jh2H>>65YSc$ZAFmF5*8@LARE#Hp^6u+ zLYQqrX;?!E${QjkjKm6p5u@9PN(PN2TPQi?tyYPx)dD`o_Zp3mtpW0XehD{}X~6`I zX1J!QK4?D1+2zUX>6Y%#42^9+sPmB!_)aQ#(=P+W_}`~607K6G|gm}Vu;bwJPwUf^0KT})+M z1h+@jnN5^WR4%|e^=*!JA$)W&N22aHQB^{}R?WPO%p;XVb*o51_JL%R8N(%CHXX8D z#bFi+BtxG0WwfC_$%PHWB0LnSXdK2j9&cETwo=jf7!?odW_8|}vttE*gH%dh&GPj) zq1pbYVT9T@xS%P1SkBQPf0KA)nor%;&n7Nu*Yzb>inz6?c=yh=5|23)l}N_$E>Kcg57kT7I*h0jOgnh4=c&{9R?F z9x3WCQ!iwNgTly~T4Yc(_sF;htEPZJ$tKItOP zr#|~nt0BcN>!T6>|CByyNfGv+X(?`Zi~Z-xcv|c~e{K8E76Z@|XaL$`|Jh>y*%CJ3 z7#jNjVhGA9kjd`T;`bgkfEMG=lVSXc!nSEiB8@zCZ5^5jYHE$b(j=fBzBVA!%rujO zr*2QBL~S$+-}PxxgQJ{u^#sS^7$KXR(AONkFw=uq0dzwlw4zM)ZRkZ&Wo*6% z4w|fitZ>osgK5I?nv2e6Md%Fppm+nWD@w_^TgR#x1E9O+sOxmDJ!97-9@brCGba6W ze1jcE%qqt1HrJ(Dhr+dGtRKBevXP_)g$k*(^*oc@GMZXy0(H}%xCc7a05=JrX zdb}YcHg4=N!Y)oJVuu8^;xoVBgC8D1VwcNx90)9~@FLNYqoagq3M^oQ>$jtxY&-igeAPgim_&Brgt=3rj@*{OuIMHpb;E8 zn+&vYPKKe5(BvwnCY`c~V9Zsv#y&J6Gl+cv1vQ~9wrpOQNhlojvyk7`ttc*^1py%p ziMdO4q{96wP|duC_*;YPNNUbwTgPmELCp<3XeD)(>u+WihogPL|C{v_;e6R07o)fa z-@qfr$Fvd97!MF>#w-~V(bxq#)o0`+GN?PBjv$c65gf}tn(O_!nCogXe^KrWYn61X z)i62^#By{z@^z^VB26g`qj`c$j&3sEbhdG0b9TQ4YeKCe4aeON5Q!pndS$#k^OC^? z5^6vxRnrut8v%At0pBQS4K*0c-W@Lx{5pRp>;{f!&&IrPZ5UXEw7$ljo)Uq~fU<$0 zM+7Mnjk4<(x<=Gl5Xr!ERyRG;oSxyk#f8Q&9w8<|SO5oVH62bC(-aOIhEm2!MyK8J z!z;q9y^+(3t|`S0Wh9&ofLK6a@i&Mue`XG@apdGtldLdtGJptLa{|Gk-x@azh~ZF7 zi*too7oX%ScHQD&KDTfWR8xzskleHPcIXaE-QXurUHgIcxRrpBV6|Ls?B)*BIa z3zzb{zlDps{{h%0HdEW;!CM{-=p6h0hn|T0pWg12v^Y7nna2_H`7gi!iMjslw`S|( z_}4!*sdw*|^*vO}6imRW9vkUumZ$Twkp;=nBXng=inA=13bB&IQ!EP@7lq5cm}C>bj!qFGTafpG3LC;dxL7}2GiMi zg`20PJGmB3{_*`48Aj!ZK>$c)Vf@IX3ZA?y=Ag-170TDv$9$VSJUQoVsn4|>&;kh+ zJP(y2Xv$%K$m=t^=U|WrpBhrF?U2L_t@QM$H2?`ziS*=VgXpdyv8|FBh7km{bc*<@ zT0*_bmQb&3U-67QRKuK%M?S7(Jd(amd5}&D$(j%mkX3fXG$V-TwTUIxPY9NWCDq8o z(pOIElb+HyJ;^PPt6+(Zh#8ieo8B-FV!pN+GLHr<+u0ktgkvpKDS)$T5~oaB9zqDK zL!^*8X-OSqY^>;UNW|q5zp6kngkd#zDkY%A8^+7L9CxR5;QM&8`$YlJ&}ul4yht`1 zn^2HuGm)G&sfrU24+EGufTYC7Pu2@ElK?17bQQK@bpUoERCgv}Yp_*$3G$q_*=)RD z-WvRc#n9SP|K#`joYwEck2-2n=%*8`bCjd~FznnQlx=uk`fyd22M43!kU5PN2E%3HyU`97X=1LASN^-iGeYu&t1FDtufKw<6>io#0uj`J{vCWd7f7GZT+@0#W4 zqg~a!+ZZ5J#9}{aYA7%Wz z7gmLHmqzDC^GlNpIiMFF%0OT%QWh04cCzWU#*oBSwuetdV}c-6 zs397MwStJ)z<+m2ri%^S=EpJ#1}6aqYxj|}Wu;Wb)?X1m7tGH{vAG2wsYgGh~y%X7A}^{$VvBak7KJR100$nCoJMtj9j< z@pCAEKGed!V&@}eVRUrtGq-AlGvaIEqN(dMDKWWwGf9Z?Z-l;xH<)G_os}pL0Nzv( zGo#h0l;0(U(lbR6t7Ri#fGn#F`>Ql3HW2pfau+3bAc>Dp(c_8&@en3k{wk2R!q@@C zrLM;Kn2}*;BDX!BPzam4F~e@x|9}-if)kIG1%)_?3l;O0j^|Yo3YN$lH>_yg3W9pn zyA|jriVsS-AX-)iBiQNhXy;|fNk$>Wl?>S}(UqKOg?LH&(M#ry7z@Yi@rBcaLOH1d zTR6cis@I2t6cGmmG!g)7l^Ri?LZQ4PBF}s!Fy2i4fRPY90d&t-s?-RZA|9-10t2By z5(n`8l`d$`6R371x!v({Klw8FS3huU^)4j`G8?v7_~Y5z1dT>9#?(zLjKN4FTD1Cu z;w&)@h{srVUVtu*&3@!I=98)`mQV`QPirU6h55k>HH^gx9hnn6)Ek>MHbo_f^N5@; z-D4Y*wH;%}4k!bATEr6Ih5ci#eTsm1xOq;5&LcGp+RE0{aNfa^57dFztS$Q>Ixd?G*s1&Fe zeRHu9=|vdthah30?4sM!Nve%&0|a)~s<-Lo^T`Cy(}{PCUv2 zw=A{0o+#;Vz=59Vo_tvJO5ocK1QRM7;qAs35nry~Iicswmoo6Qzlg@zzyQ zwQ#j+w8`{sGSg^c3($O^id)Ap)irB`uO9u8E~HE-60g4`!PY_jmIZJV>N-V=w^PN& zOG-l75sd|~zWPe@;fpn8vm-rfRfsi1#{>q?bcnC9@Ct=R1Fw+Th+#=7>#9^1HYsW$ zxFsZg)NiZ|v}XrMRLmv9dOb`P@E|su&IwtL-q_oR8R$EV-fR|x5XX?smXILWOuj7o z5oI|7d6+E$2p&~SuuI73GgV#G>_gBe8r}(-rw>E#7PScU(Yym=H8Y$J*{F6n8xXsl z=H6y_;ltFEOqNeHY-GJbBbboMGo!gjpu^-?ZbM}ec+iA2;z)xX<93lIMQAHVv7dOpB2yrjROah-hN z*}}UV1!YKwiXrV{5ewcuCl|lGe`@G>2Ed9r3=Yo^0;-dP?1U{n`L|IQ6l(+{x*{$T zQ;7#L(n@2p+S%>I7O0W!WKE{0Y0#ZF=m}7j;SQXuR(Y~8Oz-Pa_k@k z@XG?ON{GIsWRe1Y_sYFU|6mepfJZM;C&1cyQ3Gvbf;4gGq?O>y9Vyb#nQZD@5c>>+ zWKt1o6Ao-WXqAw3M7+iNm;f9K@;O*mC$vJ*ZS>BB3>_~`U-XGcunjHy&IH?dNosIm znDlC08G$YJuZ-NJrRmiy3j;(~KtMnL1=vjABEV*Ru>y=!3e%k9qd5>3D^u1@dBizD z!iNdiG##fIfcy-C+-Bc*iPvRMFz;|1tEnReXLKbL{PNxQd}fqCIw6qWuky&BVR48N)`kaqy$d@ zzOWGH^jfP*=Q~1t#IqxvA(}ctw@fgJ56ufC>)NTb92%|RaV{U;uHz-%#u&6 zI&*7bc6>?6iSFKL$CunUJ^30HvUc z@hK8hT}hI}L!6{bw(2SmNVy46(ZTD*GnA8TWi@gPv-21QeSSGXi+bNc6?`d4Wj3&b*#1vWj*S17+B+?+W&fXyCu0BOsuK;M4C85u?v%u&RP=01 zPD}6IC&IJML;%XtN5f8o9Y2~jTxrSLnP>o@SRHQl(S&QGW9{2t8zBE>Pt^Vw zSqPhv0cgbkD=8@@^88OtO6}9K|4+tqN!P?uuOCir*rw(3C^@0rpap@Tw?ZCsxzI>d zPl)&={*ubQl0-S%?8U)4?gP)#IbeWdBaLKUSaG>rcIpZk`LaqG_P*Xe{9XcM$r!7D z8f&~Q0p=lNEc}DP2jy=3?O2IxK%(oWCLKd<960_F3C$ybRh2=+!W(QI^Xn(M|7R zlHFJ{)bS`Z(a}ZCis8%M)|MB|M$c{^{jtcfa@BY!Tq-}{y#aTcO?Jc zCoQ>!|34{DbL;Jz!~d5xfZax!;gk!?oX!ca7-VT<7?YoFVfT0M*{_J@&`cw*d$L^WnZLn_AJz{pH@p2D72 zH_tS=O5&_DJT9|Qwz-_iWEBe1J7G1f_r}d9p%sx=$?}JgNYa?-Jr3>F>E6F8qwX!uT5Zo<4-;3KmOY+XFooT>HpG_lOxZ6;1^rY z|C8~cbt&EKnRDuiJnY#h1Ttd7`?8rqFUTmJ_{+7hCtDm|Nx9q=%OynY7L9BdxcKU`Vf!&Em zyxR>_{+LpRTQY4O-};;OKgJXXu&^vl%_#vkA^wv)C8yLSWnyHT_tbb}+ zpO*DM8Bc@jA8sB+(DAQ-pXB7!mi0dwPh;!PLu+WiBn?<2{9kHXTAFqJlim2ah5tJV z&##>S%f^#`<%N}jfO|!Rd%w3tUd@-uOOF)Ml$2f;81k%MmOZU!_o5y|GMnQ`^A)j7 zO-T2J)n!&+&hwTAG4i*FZjbj#LxO>dpi*5;>B|*=MOdj&o0RFx)SFA)|4b`hJ!B<0d8cOWdP`&ySaWzz{{sdeN)@ms67S>DT z(C06XDc@GT3vs*&vKnlFOj#(iRe%25F;?Waq>AX-`0E%OFva^feJ^KQequb+t##L*lx_MSd0dmM;{Xl8_A7j zYkG1lYbt6zw=%YEtRhR9RhiN+%Nqpn!+zztLjnLIc&(?nC=ZAz_`D@v4ughLLJ!%a zx4>L&%fdm;J3;l;QAAOe&_fBaP?J2}BE?T5bq`>**Mn`k8cGW-G&R0*)YBNwRnRIL zfnt!9N~T!B)_KD+ly<>q_Ejimxb}t0V8jO(i=bls?Xu`%*uynLEX+%#%he;Xhs(vy zAB>0laN9?Ru$l5$;l*&o&4#5q)wy4eNu@L^N_5!S2wvRO5p(fiwmjOckSJnl%z&OxJ#ql1m>mtd=SB z`+s`|0gEg}R+g!*WM*xhmgr7RboZqk0;%aqNhc_WKx7gDsZsgQIK-PSV>B%PB_*Y} zQzGTR^^Lx>x4i{RHH`27|IKhctf%dne7h^TbH zEi#~`t>2CeXiyPs+@K^PZ?c7cvDCM*4h(<UTC`r&qE(M0v3QfaC4hL035Hw`7`g#K(l?PRfUr`>aRd`)Jmn()X zmFih$pRvps*%YUj>Piy*n3qiuaV#nbxmdCRERe3A&(DjI)PebT$+;nzxF#EGg2!P4 zy%=O4`!Ps=Y~;`a;b0j^=n5Jd%A&5w+z51BY6=OUUkR_|fmoI(K@G;dmvhU>>4PQM z#uzd&+AsC`m7rH8*Dt*xEFy^;AWt_BV>-laY1&lU)-`5uE9OS&?XqD0i=mHWpp=Xd5@We*fdzvP?J(& zs6iZRpJN)T;z2CZvokBfiZG)gfoLYye7G4~)y|VDT9qq$PQ_Tq73);criMETRs+c} z_dzcjY`zrE97>O?2WK;Co9iAksE>(_kJwu%irY<#l*GoWFI0+K;8f~yER?Q;GiDSD zgv%=R9P1}~Qf|wn+!2#XPD;E=@yD1H=J{>_gWYm}5ai5g>`u%NOu&YEM>ix=S(>-L z&es58K%T$ih;-gIHZf&%TJu)0ti^I+pi~XQiIuAc!OIbxsMB`E*wm%+z$b zHK$K;pt`%lK4|iwuvb&GfKS0=g@QV>G^J4#vmW8kYWt1DcS_9ttulZinlW5&nXns= zMfG&%oThGK(8cV5Xv)=rplUH+XHH;}Y0r6mp+GtoNyslqC>oMEIH5QvGym$MD`O10 z%pwQ4qyd3ymgy7^j9S$P6j1G|pW!3mBtfdK_%sRuRVK0|^SO&dlP7b9^E{{tOG7Jo z8b0Q54kkV^$=%!D58olSPbDNP zr672QG2gK4M-{NfQvaY{6#n-Iq+p;94i&FTIc5gs4^8l4idl5Mf-|@rh;C42$2w)@ zvMS=F@qokLa;&UG>lg7T1ChdppaZdr3l5u%w1A0$cvmYWrCwg zZ-y$fn0;3G!%Q*3D<)Rd2%<7*NFI|$qd<i?z8O)P^@I`_SSS+U8+*mng|(P zLIW-ziA)~gPrN=hyHb#GYhALWi^W(>tMLZCLS-PJfkUQDMM4EjD8mxNL`)9R1ruy> ztU#pTm_Q&z-{(reT^7s-L;r>~Ha=2Jasw~Y_=!HfO!MnuX=p6HIawrC_$+DAw9g|~ zU<#HnOrDMrRHk_SWxg<_1H%a^H2}Ywpcj*E>j1*#fQbSoRI4n$kcc|Nc>zRL1Sud? zSkE8ovcSy>1%4xfbI=t#xU_l(Qj4NTvMPGy<5l!907hgtE-!ydi33{ zt8aqHch>YX;sJC==v=Oc1W2O{URHE705C)iR(myZ0f7*N$yHE}E02>Q3m_CSx)rLE z79KG~4Qc_u6evZO7S~6i6=A3c%~-Bf6io}1dFjH)vIr8L9GFZQs7Mj7VUMRyJSrvf zq;(gc1QJRnI^#6qh`>=;3oi#GrRGDJXdL66G)^Z*XYiK8aseU4Y0*a3DxJnH6};4F zcO%f9IFCe(exUj=QhyE5F^O+8F*+yP{{e&z^v^-0vA9>TewLYdF&$da4_&fbG}s_o zfO;Hfa+o#jHsN6Ku-wAw7R+Ti^&&R|r$iW3!dP7X2_#mSLa8b-xIy!M^<>9%-IR!(D zWhhaYnO{6YE*L0h=8urC&dtwqO4-*ADaByrEgS`Ge&C zP%porSkB8GoLdZy78l6aA#W--8|n>|24@!z$bmmI`{(B67LRbs19OY>vCVaKz|g$RLXc$(hZGcLL-$!yenEb2{=h=$C3|poez6OBg|6i6Vep4sl#`j4M_pwO zh0zz%_>2G?IR$xH*@Z4aGp7VA}q=N4rHT`9~hLVye`EP&<_oKOQ{mM=lQ z{A|_=f?Bq$2o%A;hZbcUW68?S%!9Uya0Ku|5`|mTnM|E&R&bF*^RlMvGaFE6{#Lb_ zjq3j*6$nk}qhbADvO6_7(*G~1PfPr#lk-d;l0WD)>3l@H({gjN3gPEe{J&jm_&0C# z_w(Z7Na4i~ z4x9Y^8tp;thA*opPCR;T_3~}QuBcuD{v&R2(iXj|~X!~@HJ82Q!tAAk2$ZKk`!&3~MeUQ_h%R{z=iQ~cEU&kI`R zB~6jW{`qiGT+!QI^5WiqYRrc9>*wry+TG)pB|pdA{D*dJ9{tbIp0no9pC4TLk1bnf z4t&)6)Eak(%y){XIMd(hQhD)^QKRP0o!hJP^vd2lS5$vk*?VMd?GFpDo_%WDwz=Kz zE$(?5Jg1*N=-|IU-#9m~`+fO~fCydQx9{8YE<5AyHw(hj^X|b_aUIrd+_>@9TW=jR zW=yxv-o0BFe*5{xHM?s%oI0Re=e29sUbCclVPW0gt(Ts2&g|t??{}X5KX1MD)}ce8 zv+qdNKF^E0vZ|_T@ZdWaE$T5RZ_~PUiwZSNHmg^!w%KgYKKrbqDBHGe+q-vf@AIq2 zj{RiOLpR>=&Ht_~?(xG}?=C)d-JXN*z4zYIQ7i!bb0yMKGa;0~>Cn%aLsT->UcUfMP;46Qzq)w$i7 z(xpjBTefcPJZ*R2wSTWzx$?Xvj_!{XE;)L1&@KJrJGS*zC;T%cb*#8{?E~FfbvXU> z*|TOXU$NqUYhHZ#VR_1wDc#W{w{MS|decp<(&s-l?1}ZBWs4Rq8o6}f4au--?c2AHi@W>H=T@v( zv20oY(oes+{^E--UN^N`wY14K;^^|LH^*vWDw9j0(e*O9vpI=0Kl>{dbxU1tPhI}T`|p3hZsx4<<6m8zvGJDn4=-JM;NYGOyLa#I+O=!n z3p>UQ898#_zI{?04EgETem=7I-9^tm_uQk8JW|v5!Zw*#E$kdOR#BeyzT3Uqspn3c zIB{aZL;c1S6|LD5+#5Rb`s;CVuW#6JM^3k0E43c!>F3}5<_ph1KYC?QT{G>poV(h# zX(Qjg!L#h=pKq+FsQ9ep;=9|fd1id;Prkivg>U5zKloF|ty`78dgt=lyC$Xl^RxBm z_MFvsR_k?}H-Ayncfo=M4=i&Bc3rV?3=o7{Zn@=-a}v|j(@#C+6z?00x9#gu@L=D| zF6+AHtX{o(wfj@2!&~+qI(YCPpzOMJ>!5JSjfeNFz2lrSrEI|UYoB@jo?!<{NUA6Gwp+nCvTXyi9Z$>;@x_0B-v;zkY%yga_cV#Eo0mau| zyKYZ#)>W#iE}TFAqbEl^7Z_W$1(so_HX6@QjrtLm- z=n$a!%$YNP{PB9vBsd{MU+sDYw%_@8etzJ*WJ!pSEU~8JNd}-4?R?p zle6x}d*;lU0~2V~suf^IpFVva4IKDr;j2Scj_P4)< z!r@kNPcB`Wk&$uPg?HU?#~sBzU%BDC#}_W#GdJ+6E%ToK3;Nc6Il7|ai^m4feLMNe z_fF}sX58|T`=2~_+U}h@cg~wP@6}iPxn{p~!*}EU_Q+pm*J>+2Ub5})6=%-Rf9mOv zzxrhCWj}AfB`veKXZVXv^Pvk*@|^XayPi4<+vw%muP%P%`L3O(&rJ*TyYZ(Vv!b*~sgjy>`Z-r`El;E~m?RrwoRD;c~lc_PjM~-D~!l zy)Sum`=QDyN0yAPDl7Z>{C7V1;I9upc-M@NCN$1W;7`5WX7hkM=Z27yltXR=X%igwS z!KFR#YxB<5t@qx4|BBMJf4=nU`{m*HwCd6(6OeOuVo66y`t$9#zZl+s_8n_SJ~MVT z9Ers}&r1IEqBG8FlL_>4ao`r^#V4-by460e`mApb512f8%_WyywWQb<_wbOf&y==o z+5`i9W6jO0%TvaTu6%6&JT>{b?{b4H?_ZqPIqtSK)9<|VmGPfWD_qi{efyi`%D>Mz z501yXyZrISAHP;Yp+oa7)8uyd=5%}D=QnR3I`gJhBd*)E;ZJ{B(W4-}XU`js93ABD zx6V`8y7jepoV~G~ZG8Lo+M;*w+&jjZkUQ{-g=e*IpD^pgoL0rdhiiQ=lx}@vPtew; z|GGE&KtbHH8aKVi~?%r|W!#l59xO4RM+3Sl}u3QTLwLN{;h~;lpz3=k-o;>~RJHL73 zR@di8rk&D$-kT-8gWa7obL4h~ONu*B_W5OyE8MNr#Yd-zURkOa>JiE)~-@o|kbyLs(Ak_E5&sX2P`okACZ+m*_h38$<_wp`h zP5)c>S6%LRo_*5y!u^{z%dKwDdSv1cU#|W8-|dfn2Q=)=v(J7C4z=(9wIgooV~;&{ z^=ubx#iz%-boOm)x<2Plo-LooVyA5Cpc&wEDnESfKNGx5c1-(lV5f7}rQdi(y7TQZRU^DrXB<5` z0tEE>mVC-M@9~){4y!R_|Dr{oH%E&A6!A=UcXH*^#41 zUwP#f`27Rl1VveJ+ih)^O(W$o(y`?h+vzMFFB-Ga?8t?H&IU!M8a z2f+c0if+&P>6MB9-0xoXN`>1QHrsi}@5ATD6;jiWEKHjlo`kSA^{#pH> zgo!(L?)2|^dB@hRg$sr}ylK&c{SI9J>77-l{U3W@9th>uKR&HDQreSBPZUPhk;+;U zN}{VxMbj{Y2{Rajl(Zr3t|aXx6|E{Q+_(|lZlq1xRZ5Fek`}`EobxR6%ox#od*9#t z{e7=Liu0WFIp=)NXFunBPPc~mgv(pzpG;yht0!+>JNRVk^w%p_?pilZ@qAO`Q-kbP zx5WM9S>20&*y3GSx4X951p((Yl=sKDzM|0 ze13TN;zf3x!s*UkyLtc(+Fi|U<@NU~9W@7;pMHHS)zxAiTQj*U!^maYp%PP5(_XP1 z8P^^?YJ7G%{>~lOBC{dw6C4JgKWeTPJE7meZ6OtouQpW}YPz`Ww6|xg7}pJpdw*%Y zt!4NrOR%WLC&vuxGvpn6UiOQ}7v|sUiS4&yL_Yz_|L|emF3V>gnUk<<*SlxWPAzE& zUolc|{F8}}j<3rv4W5>CEcrv14Kedo4o+WSIlwS7yXNivxo_X-7P!T5fXsaHx@4>U zhIsRLX?6Q2&AYJdPr<9dH-#HuDZ(GqHTTDAE+5FPE^HFxrqifd~*4K7gF0!j+ z{n~R)%AuJl77_PMFAuO(wNRULdhOsL?{dP@M{FzFcYUHx-v_0m-DckvH7%)mex+oN z_t2UO(}(A?iV6zmk5F8zGOFi5_r81g?(N||@bxs8RF+xYc!8j@V@kWO+eR1HJ&W(c zW}CaW+vHH2FruXC%cX{D57*!C)K)$8pJQLW-*c_b_-TC?M?`pfdfLx@zQI0ad0ANb zz5F!^y{l_o=d+kEt{$0tvOszA;|tbb8yn6P@6;P8if9OL+70$g1N9G7;_%_apFe+I^P;#knQImN@_KAj6P~pFbNG z6`kp+q1JVb>4L%)7FgGv`Qe#VFt{T)lb~n9&E9UGK!m3kV7M z1nifcRuT7Z-}d5gE^t|aW40$Jmjh|;s@sp%|E5DoNcq(rNz*bqt+dmy4BL3nS23+? zm*u&+4~F;px}`cd+1}tqk?6+FRqMhH))l`1#D0O zM(L6RtD-r_J?%T&9l3mhccrebF742vUv2hw-Mw$$Fkl2!6eg{z{v6$H;DZMbSS;3h zHOqT+KIQ{;aN~x~8NrSfbzzQVK?ryni1g%1ZYO|i|S$Q$cBqO|MKNaA79^Tsq<3xI&|m|w_~S;nh-d}nG61i)97Sl zQ(&N$)G0KyV5Qyg1RdqU;VYk41H%p|msd$|Usn#_IW}^ho15dFsTLL%z>A5=Q&3jk zuxiz{npNWrzvU?x7bb)yU(dNJ=#e?H$BU~8k>3Kxtl>p{8h#6ypPxR3xJR4Tbvzzk z`}*3oYZVn01qB5U9=LJeol8ud6%g=#OG8)H?E0#^oBBu2pD8+Rbf|suv0WCkzm09` zy{9P*X zq}XzgZrYZ6(z_x(edFa#GiIF6tO^O~&h<`q&HxOb?_qRevx(Y{_6H9hyyjPN;}0&& z++6(nqrtqxtjQ;)06Wj_m9XT9>=X;t6beNqIAgPilVx>o>7ff zLt^q?&DJVCr?%8@gJ1#r0qdue(6POBiVKhz{I|{@KFrg14-fJ9a8qS(@_E6d2Og_O z?LEDDNRI%;5-XDtmFxbTxc<8Ex~bxFY*oHTy6a)!r2&&1EG%$NfW=zW`DI|)b)O2| zk?R1#M>b@PvU*f@_EO1$u(Is?u7_8gJfS+JCu6_UmI>;CV+Qq#-RC_%F7fk?TNcKn zvqE^IMi1nN2fw_gv37sJ2DLp}gQA~AM|X~!II^+d?O%H+$qq37PI)Ad>R@4-gs1)D{DWOI!evz1kxeGfS`T>Quha}9hl zK0m5!Uk1b1_e4Tpg}^cUr*6sYsd(kvuDmB})1OWFGKEo9RTUT*_-AIatFFM`-}dxT z-}ZOz-sP_qT{4XF%_%T4#0IKtOd2stO*x_#h^r};-(HPwcjw-{_356=IAL7w1dU#n zBeo|u>~Hu*y@$%K#SuFUpXwFo=C&`nkT}8P^o@`97dQRIRTDBgUzagYo6t zP|NmRl(<7LELiYmPN(DE#osjSXWsD18R$|T&|`&lw{BwPZsMl;vcxy{5*F6#%=}!y zWrcs}c|W>(W?=>M-09Q3Ga@g%88qg&wyCLIeEk9w-5yFcVZS}$MD0)Ku~PZ`f&KKh zE;Dk{y+8U{kZDKja{J$!X15OrI$;*<)9J?1)%iCX>V@g9>^pY{2ZmTJ;ML9^H}1pd zvP7(#S?tQDm&qwx;)Tmpy|~HV_ujX?17D7L?Y@9i%`>yMW# z7-Q9VV{};`zL%k)Qre-fS)pZP0-q+#xcl31fl9+z&q>*diKR!~vkHp2zs>_frM~Xk z`Gf`Hi>z)*mh}lq_scK6^*lY_XX2#PaZ6lh#~qyR7%^~L(YS6ln(-N#D{U9Hi@$s; zbFE?L$jFcWU2iUnQD(26z+#LGOn183zGz>s`k;z1=YTubJsB%5T!Zy&LiafKoptn< z+c}ryu}U$XEA&p3Z85&|Z5U<-+kHAnvdM7yT(n0 zNg16jeLQVyKThB;=$qH%hVpc3);eO10oBoUCyT@aX&$?;p zm)xo69XC=BHnK~wyt7@25a6)_{D{J6#?Bcn4mBLXgOmgG@d{+L9D}Fcc zX<<^1@z-~62mATF6#Be8mikIh=k=S)fk)HAFa53n9Cz<@*EzLcy?QS_bEfF<>`x^n zi*F{gdRngd+_nF0jdRL*@8h)wA8<-|kX1U;%jEL?`%9hf+`sR&c1*^N+qWxTzfQ}D zun}^AhhS@)|7VxXGgsFQ^iDF?SeJkO*G2bPk=ddN7Y|iDy_0@v=+LqI_gRb%)Dz}K z&p!CbcfN{UVO_=}+x|=E9JyLpc=1Ge(3Q=m(P~de_6#_8FLA?o8}_-Cy}Lv=eJ!rf z4F2;@Ji~hamCX#L3%hG8OY6UU@rfM#x(2wtB_$c@Js*D9n8&f35VmD_?^>IbUg8X6 zAOl%0i)MSK&%3*Cq=`c9om$UbH+AQ|S)I~wU3tIt`dz!&?(T!ryd%3Tf3(nh=;ki# zY*H5|_|BX;%suTd<*`a9Pu~_~?n!5FGs>GY%P2J9xJB^9T`}p`-#pB^7F>2~iy0>} zvgz>Q!xa@??zIzb+_oP(bH?AML*|Pa`lb9bE5{p|i_Q!%wLFlX&KB9dE@j*6%?(*n z=<#N!WldScXxCEHG*$bLSFfIO&#H*{{LpoH`SMOzQ&Sb@&C3zzPT1?DHLR-Y3OFfhS9j{&&$hIw)a!m}e|lifo?U1C=Y~7{C3+TWePMn68uz%e zqM}@3_QE;SZ!r@Oef#$2w0~E(^xWQz_j$@G!t?o^7`JY{_bxI^jg4_EC@pe;hr-@biY)jOu3E5lqdN(aNv9d(*K+|ZpNdSPa@_)Eo>eBEw_N|8+sCxM~2 zZJYAi{tU+a5}jj(g*j`>79H8MckiO|0(MoI^LC^1(F6bZTvluq{xP&`fZwQ^{57Fd z`{(X+d38P6J~=tL_UzSBO)lzjtD3&mBve-?o{HGmK5NI}&Q_5VYk&>D=uRZkC>oF=RFMQVr6_l(^KeA6#~#rY>MI&xm-ElVveg^c0Zch(~$)WZ2$s4R})qe%DligG|t6|AWrMbOHNbnN)-*|Yhn9m6cDzI_er-@n7vu1QyqyUt`XD~q0X@*dgQzJJf2 zL;ENi?Yvy|(xM^y6kPVl{jyLRg7I=HV{q`F$>fdO2Y#qi( zaf#i2YlUJ*Yk-|QPx3}Iy82%S3UYDXE7sa`$7UWn#?Gm#tn|IM@K4R6l?L;EpQs*p zygogK^QAE9#F?^ePF?od*ywS83?8f2a3-f{^uhGEZ{BbXRW@(ld}oMJYUkfS-SeF> zW5ylxL0y)IRBaEfsn{G_(^=S0MajXgpi-D~{*S5RoHc9KSf5jN?6dU1ffqMYCJP^C zMs0Up9|ydd{Cr{Hxr#tPpOE$)X4~3k%{=zW$Wljl%RPmdsHlbE;g2%KS9b3&ycs`x z>hXpZ%9|ZyOt{^8bnHIJ_2ZXnC!sL-*bCL@=;)7U18pKxU)`IUI$bCJ^6^14$L!3_ z{dDG0<~;X@z86nc;Wq)76Ui z^fm6f8yK=CCM88h{^bSh>~?iGh-VrbR{~L&6`7O&`wPIeXIFIzadDZt`1hPwI^*3d z`gi6uYOcCep0aNrFzvD%>nfwWufBAxboAnKyN7S@uTxe#wdLvh+}oQ~dtO+-{?qDp zwI$^&ABQa)t;S(J_NAnJ{rdHY+qoOMJ#`XZ*VScT+F-7u6P}h9zHM97jvXB`_urhL zel&t;k2BOqZaK>iJEbudqk!h+PqM6oPO-)TRZlcPDKBL-4jUV1? zQhi;tz1^l&2Ygsb<5GJ0`Rl1DtyatHoeZ3?$X__{JyXC#li&0**=)jWGyg{|KwfXt^mA8-Nh3T%fcC_m@Rl84r zeK+9JcInown}R~p*%1EnrJS&UfT>N(mf0CknzC`u5q&1}Tx3&rMn>&c6JIxXcdaKW zb{+DLJ8I@-AM{X+pRN)(=0R>$SKy1EJb7};5OZhk#a2xhR{YY?(2y1SZj`6@p*75^ zm2qdBd&hO@2)9`O`pco;n!W=Dyn6D)NMXpR{Gvc0`ThO* zIADM9`TQwUipm;4jed6VL2QQsH%5*eIepfw(BR#MTjnIEbhySBp)PEWgTcI)WT zqrin2J$f`)gx+F@{D5=k zl>HhvpK6?X`WF7^#b3_M%nY-5q+?eCv!fB)Ur z{s`(KFZ#)(-}~pb-#@qg{{Kw+CQZAr18MsGC;3~OlfTi?D&c5|1qoM^=#;q@M_fl!C!=fWB|y6?ki~oaJ}>bfFOej=R6@2fDl5+pr;ZFup(32 z;hBrzbzXRP5>B5OVoS;H6t!uo$^86?C1GNm5DwoDF%+kjoJXyu_M4%3Eng1E=#!i#$VfIE}Q zf$IMs5$R16!4mj2Z##lZY+f2tUpbkzy!J(DOnJB;S%>eJm9=U1cpWC zcqbHGLYjep$fZD<6lyMkw=TLQ2|GgB#&D1hCy;MNO8(0D@vjNEpK=#ZK@WU`d z^XuYwO@nv=fbLP^HaJZ@8irp3hkx@0@OcYRgU^N6Oa=Owvw%wDNkXE!kp%`XLKEmF zuc88*!WSdFYVwLWBsDxmAqnU^a|I*%Npr>Lh7V8PyzoX)BMO9ol{o@rZnSZjG=luj zIB_bK42-%oFS&dTqqD^r>6k52}lfa||7R9dwg^;RHrX0p(WQy>YY$;Oy9z^`` z@50AHf=Vzu12AJy3g1>>BHsQk%5m-oT3G0b#2NWalsS!X+s^PFe!i_u1Da6&B=zAW zhD|bX#_*wn#&UWl@~A;2t00>zm&&o~gJ&U@Yonr%#A{gJH%M*JV&RnTNu&}F6$bfA zJI92GLY5!RM59@u`W7BRFcU8PNE*3#CHNRRWeQ1*PLUYVJ0{O~4e%2~cMX6030bbV zV$zqhFj7bXKCx#gw?(Yr^FydVBq&or> zaP#I1O?L`Hp+6CfC*Q$M92g@YMvD*3g~LaQnMhpny_ypu=>l+MXZ1adLtbnN;ga3i+;vMYc-kR&@2>Bfh3kd?4BZ*4Q%ttx0U>+_qmo_9W zlyBIA=WhjbTH)az3j^?{IfYpwLIMXxi#Q;4=f%gJ6x^@~g6f6v;3Uosv2e{D7EdaW z!-wlZV|dae0{B2P0B#o7Km=?V&>O@PQ^EwH(p3?V&>%oe2D~s&z!A_CM@>+Eu;!j7 zDLxRE>FfkOBw}?C;;B*7QkKEc6GFp6M4$iyoN0g%K1atP9+iXXoNx%{czQDl3JH&_ zjWP{)Bw)A=k8Z(a-h_1X68o70p@$$ydE2^l9%@PcNlT1YiP+!wJAwm!#I(UbuySik z0lCkRSOvUL8Xw_4F)b7TCl29}-V~@V&GSD8g>nNH{|*$Asr}`m5PfVb3SD^qK;q&< z2;+-_rBp@hi2N@_;P-Hcvi`S(JM>W|UWPOb_{AUo(yI8J#v@H+BmwBgEYekkLW4cX zN>jcF7aTD3iDU!eOVQ#RRAqc=q(vsNK$OhI-?OBJ$*77%?36=;%p{kW7(DzW6YBBd z2Q`P`FAqkuS>q%<9*Qp<2{51pT=Wn=k(3J`p$OBK4bn?aA)&;Eq`g3GxX8TgAOyAt zs7($?Dp=TTRB*ULe||7Z{w6bb+UQU;i%Srv7cPV)vycKnT3sY`*zmuLHCmM|V!`*U z4E!tI&iHW)V+Mlpqc#TKyahYshinX-s!2Pe?P{G;$$wL=qgRI@od1Mc|2NPL`HIN@ z^~`Cs$h71o2-ZI@LHw`!Y4Q9gASr{N)CWA}Ioiaeh4Y{2NBaDyk;y3d{;$bT>i@ex z|HsdNes}#*H0JO3@%{6^#>OV#oAmmRG8tv`&-vf~#E*fFqK=Nt(E?B)$uBION|?$s zJPOlp`}1E+01`sAqXk!i_TUGIiIXP8K^lEn37J1+US`Ru0ieEVrv*SgU_X3so1ZMl zxBDdx=rLDXDLv*WDVA52FaUk<02A#4;k(OJC)`n)(zZBSlG>Ej=|f@?PhAQJj;mf) z3rR~2WmK=Cj)9`029XXJn3F+40-?T-6|G1FkkG6MnLtuy$g7dAwNPXLw-#V2DE8v= zyfF5xNlwNrS|!|JmTuUrI{*mIw^^U?gP7`==O^OPK8gjvedkIyfV~N1dh_xW1p76I z3-_T!(#5o{1i*8m;SHXw*7s4T7jVR3fM#V1VH$kdGO%W#K+!-4n*h&B@h~lbUSw)& z;oD%;E;1(=riw-x=&3_`z-|RANMP5=nLTZ~i>-@`vx}kz7l%dy(`GXj)QO`vVgWjI zfii95CnN9(Gpwgh&5kxAJU;)gjK|(~y3MQ!)M#)(+5x&Erh?N9M@N|tY%~M~bvx48 zp?ZeBP#&nqLShu^Nv8ICxXiaZAV?q zhzTYJ+%Rnn*>k6Y4Hq(?Yt z7}bFR7735R1D|qhN_m|CCrG{%hdFU<5bQ}F=RmWPSup^;rR5@M%V#dj#AF1^omdr; z1rfHu7ba$Di9ud$wnj2bBw1lPn>9nSqCzt)OIjjgXc^5mkdjCj9^d2Q5rT!t=MQEM zYf!-wh%OR^{9t_=a_lAnuGT@c$wpPBFrPYxB?#d zh87vJ48U(50iEX0MdwHt&1 zj)1l!O9Yto$>}(acSQ5~d(&x4KQ5@FX~cmUHrY2-1OF~v10tKMFvAJ2K}Is=3|1Gz zBiZQ4yALM>zG4H|J0OS`!WW7~0Ll2M^%W6N7oImd{4I$B;-B#&p&np8y!;j-?w8cS ztzy_Aeoh^70{%P+8CT_n@u{*X|VLDFM z#WcN`l(k7J32oGFs3oQcZ6!)uVDuvr$Ymb~ucG*48b-K>kMBcBePN-y!{qrBv|9MF zRIo1aw1F;bx60c}UHfM}Ztr&?)MD927ljaZV(5-mwq1_MNeu%a!%pYrOAB2^tzh$Sk^T>1O@b5hD5nfsV4wqj zYK{~c4j_yoASnb~=(GZ|_C#VsLPJ#aN{0)L1<9Y#;bjL4;SB}K--Siu0OWz8%l(+P z5tE<^M>Z$O8=)T69Lm+R!W~jv781@WMFvnR%CalKKWK#_WYF6+gfqf``-dOy!Oy8e zdm7cGRmJCr*Mh}FSPhsm_+*(V(xGQW_|Ec{RwiPBra&$#MqgF>veG4`JOFs_`ji(= z7qXBh$mVd40$y0NDWYki57cBObCRACgdlwY7qhg&BLcMG8G@{Uz~Y}MxcK;}H3K*` zqL0|{XUtZ{QpZE`m=2mWq0+Q*3|OLbs`%kOJ$Us9tl&_2u_{{ks3oY(mJNEysI(uz z6pjnpD3CcXiz9k$g^JQrc8!f6dT5v1jHN|#c$!$0W|HoQc+^NfXGs_m)6~SMbw@a9 zks@R#ORb??h!91%pVbz`MaViChIG%ujzgT$_i7{V;5W7x(dut1i zNsN(IBt3I!I>x}C0{AzuO{ameLW`5!I3tR*@#qU~JZrK+sU0X~f~Gk3r9imY+RK6f zMRGuZ(iT8CI!%@Z0g5OPhAlLk=4{if9V~0Lq1_}qXW53Ztks4#6Puw66v>$@C~X16 zc*kaA21W9ECjKMnRwxMJ1<|i(%U%&i$uG#`j*?wnV$}({mJN2WNXioni089KK0?q9 z8Ggg1L~D%+=S$KEpElYBks$~sa&QRxR7cw$(C48xO=L(=y1K*=ZQe#gFieX6)#24& zIdy47BHaOg3tCPK8gX(AyES_|5RX*o?Kgg|RTze!ECk$gsXsMYBrj&_D0 zok?kSke}F$Aunah4W6Ku-`B`qxGrp2BNH|wgykXj0{?sHVmjbA(r<&%f$9ks20)7* z>IfqyMhHu|olNe)g8mKAc#weyLE+lOoVIxhfa?Q00@eb`AN~)+r$i)%xDZZ{*PsRf zE3LOM*2N^iQB!;bnxIq?RVNUJ^7mk%!Vm4C%Q&Ri-}Ol0VG#L3LbB8$LOvi}0E#UN zX5+zJ>CHl7^A# z;n6}SH5dSp910qPmWWJH(ZUEot)Dvr0FWF(Yv~DE8WYNU@N-9nK$7EXme!z!afre1 zKXnuUAUTHSnGRYQg!j)Lgtuf6ZOCoV(y)SlI_U<{Xje`qgO&!uX)eHjU?f!U975}Ts&bmZ&=GQ4r@85m|419sS8-~b*c zJINAR$e;-z4ibJ$Ci~mBs=8Y*1lW#;%-)NRA5yEjy1La}RsETTF#{BiTZQH7C>?L1qWhQ*D8mRXD`|Uq68E0r);MRqQ*< zD|coY^C6#`-y4Kef}=0RcuELDJT zp63DunVo>~^CVnJ2(Tdm!`Z|V9^DUvog;!A>WBam8gZC|_v0n3VqgihqT5NRa2H3+ zVu|B3DY*&y%f3*@;0pe!;Yd*ggL*oq8OgF@RR7G$r&W4oQ+jgtd z>ngqh^_TAHyDRG2IQ~apU&f~Kf0%omkK$ zveA{}Uxu4_f-*LZe~|X!@qe(3|F)fLpASm;wP{@D4p(>+2s`polwJwPv+_$xCP z^Q3-SVyQF_K7xInTfRS!@po}W>2@mJ68bDkKkubcKFm(x?@6P4 z+QmCS)^Cxf6K6>)RH9peBEpRb%^C7j(vDPoFL03IYs*DMdD(vg8#@ z+RUG+m$IQXblj#bz=UFgAS;M`{P*8D{!=&R^eg+==JB5o>;JjKSG)1QjVm<%@oN(g zICwM*a7R4n0Ep2yknp`V?C# z&=2Ac^no#6hUBD)8sI8~xCQR_b=tzp@!zSHt7o+*>0=wle>S%?|9^Fq-T8mo$`xE- zOmd^Uh(MhHr+AYBZ;`isUP*RLOS%7KKvDimYqqISh_DTT>DVI!)3K#GU(F35%er!I zG?8av8@^B$BJ3dA-#0|~xr#W?CS!sD7Gk+6V8WIR-GpxP zmNDL&^br7z*>k8tA)?S{yrSSrEd7z_6bkZ2$0UIA8Jj?B%rO=e28Od}Mr2+Cq9Hne zSK7QJZV*Hck}aM5iSjKun5W6O(tL{w?J<0NcByYY8vg%XEBQa~Bu`StCjOr}IttJK za=F7D|KG;7&-}p?U4CX7wz4nezzf@p*XUz-u^S2kA>tHz5Zc@q;4-dwI!=kfz@MXQ zH*JjGG_b>Ah%+b%Ih;@%eML~-db1M9D8MlDD^ND~S*r^Y11(2@%_!cSt_0I59`RtG zV4cqU(9&UGfjsg-YSYv$4Y!=mU{jRmR_Nd zlK#dsuc7TO${j4Bm1D^ZWXj2_cD(}k_&6M*{_Ge@u}74=(1E=swXr$Ghly#U8z42oSGcMSRL77gR3;G! z(xF|4x{j5gDF7evr2J=BY5z;^1iy9n-CbXKZQ%b;F#Es9`v21U-x2)m`2RMpt@3}p z@E+NAD*GP5@4@yxcmXBy$hgY_w;vG55w|!^4l-@r-`vEq)2*CfqUrlGQGFcZq3$9| z{;$tQH;jLn&wPCu8~lG~Gx@Op@57_~ZvTHP*Z#9K44Je&QWW!w{fcYMq7wrX7_tu( zUIK$pOs)ej#Pa@?sVIg%vY6VN-|-O0jPr#%YvGG?4x=`eN~u%`cMJ!;&Bcw|UqD6a zqx2~N*_fyANE|NepG1JEh_J;>^*WL;dJ5-=CI4}G1o`YBF`llIwMe3Uz6~P z6BDDOgf67&zNEN)*e<-i@C90jCr#dpNrS2OAD(vmhl}D5RW`9i)dY2KzL>HXI6Z$s z6ZaSXnfeP=Hi<_UZdqPgpx?TS0CJT8-^LKfY~jc_=d4}sy^gEYHs88m?yl`zEBU_z zGY3oObU;=iFCr|4Cw}Bn=eVM{_DZ-u z?hB5v=Ng!SJQC3tgj6VtR_Zf-L!+ z4!9)lxmD*_h1(Twr@`aaacc@_iJ4~3ZBZ1pgI5b5B)82lrUS+OM}P4T{wm2NcehQ- zh}25_(>-2!X)|A9vZlfC7_oRYz_~B53-8+%{`40(55qP3fZo3!9o_mv*n}sLf526s0mu zIsdp))5PQJhFm;@1Vu3Nz7eRb@QcVn zgI|Dj)ljHXRdyym&=TmXdSVYFMxVf_kim~5;Kg_nJ`a3lp$~pvZcA{EkI)BYEz}o< z_fvT0CB|uxc$~wuQg}KqCTb5AxdB?Q3gkE^=4h93?OGFf-@Kr{4# z!q7Mi)tI}nbFqp%DN!Qy6v7#3WjpA*LtV}tFu7idV<}jq8dd4Y5T6@cAC?khCZp^#+z+oe zPYbNt;z#1E^&V?=Shd!u^=hp5y540Mt!Owt+CzXDB^|SK%^Jntzd1(wmm9?$KTsJ6O z8Sc$Fb8D=KKnuRp&6twn;o=PpR~3=z%a<>{at?Sol=$TBayqsywQ*s&T0t7}er8;xheW>Sgfm2o+0TMM$+25TmA|GQG1F z7#mUqWV{3FllSOf z@q3}>Re3C8?DEH?goq&t&+SgD&C27kb<;NH6{>nwoP*c#9A-wsbalOt*>Lzq=|_IJ z2Cm1qF+c=u=T_S7l0Hruw}x`oYm_GDfIoD)mC{_NTjg2(gfSIOGEd_wEjn&)U`3XB zT<+G`xoz~%PAVS7ZYs4}zu}%O4MMaQ&TQfItLB`kE@nSKed-u<5!Q7LSWlayBP#-M z-z*WemL5MTsT5f^fBFl^7Z_m4(YNNp)8s}wH z-@EU+z1mq{EC9f(cYyz-%F?=^BuGRxNJO352Y$FIgEmf*qnU;FDkDuhR38+Y|7i|7 zqfxh40cuLND}+HY}NQgIpSc z1S-_?KO73m1<}-#D98T@`P>#AyE~q~aaUbYtwJ_}M_3B0hYT_r!Na+H=n7BcT(9au z?UZioyi=)_fJN7*z@(77$5jO+s6#;g%4A@d^a1lo*!$g_VW$XAZDEp-OH%hu!FzYb zaG%vcA&4kfc~)z5YY&hPLfk)6He^@I27!0IWQYKIyj;jWplo$O6%Ztr9qUA+@y}an}4OJdpy${J45LMM@v!Y(qZ*Plpy$Cbd;=E`L#zmN}6i2h)ikF(>laL-p z#g&bz)O+~h9OOOvR^hivv?J41DdT)O*I@%ph=LCPJv8fkvF93@4^yaJ!mae$&<4;B z8(L`ujWH{Zpp{0GqB$LZMVpMiqD@8*t6Rsg@6`uP-74yfdGT^GE5aazo{)oIrwBu# zI3L=@p?OvOZ8n5ogZ`+YLh)X7Z2lmp+TVJK?oYk^>%ZD!s*jBMQyu$ouZN%i$R8aX z?9P8|*}vr{RY+Tg@a+hsD_- zkxIKK1jpTbjmc}+&0M3SrrI1$QVB0;&jahmmcg7H#BV!`tE&{NJBUde4Dgsa1L;1M zG4A}pHzo!%#zflgFb%%=&@*Su!5HeeS%G-ay%iaMOf4rA$TA@;l7Uhi&)7;E5yaZo z=p;8MQ`Y%>h7lzP1(wUQt}#Oc{|uAt7MmS()n1`T8IC39%i%!=TL++LNMzb;O%4~)kO7saSD$k{X z&vS#H%^uK})M`R&x3e*jHD~%L>Jw=%wiWK3qx9VZm3>flG6I`Gf~oSzm`>)MBdzBV@awK-on+L%>#;miM$djI8lpa)H}nG~#*JxDX6sL^B#2Bi^LlME^9W091-j`;*`z zsnO2_USXZZw1>tR{tP~N+Zn*@7Qwx=2?e?fr5P|D?t*C!#()YWsX-YzQoVrLwDh9v zlY=Qb3f0F&B{xP3Mw4<=fBjJE(@no$bXyT^AqYvoS-Wukhs(H8G_D`b^%14 zK)^wSb;%NfKApk0u3T`L5W9`Dn22zH8&Au-Uo#)#aX%J9a^9?0TGbk)lOdLRJ~ipQ z6Yibg84j}-xL9cnR4=C}uGcBQgS^dtr2&MpelMmjm752l+E3sWC~ALj>q06fYE+Gcj2*pJTY4 zKQ>5wxJXHU&1PdEK@^{0eCd~xg~FsiBQYpL4J$k(&w0Js>$iKIFfeu4dA*8!ti%pp z9Uc`Ggk6F=({541Ip(ZkOot%-0Q~TvNDNSlUi8w)EeBJnl&|3BLN)u-r8eh5?FVOM zdRHiPVEzqYb3X3Q4BOU*MvT5r0A9uTyss~sKy(Q42*gi)dTr7sJ;t4T8qP#)aLQe6 zLhGlihI{{1MJR!q_#R?$g`WnjPff?vpv!>(p_of6bG)uMyS;L=Qez|ZvXs~(4)|Il zw{vLH>2)OTm;-q$7cbPRBd&g6zCAGvc&8T9)f}T4u5KFF2G@rC%8ji=%1G)4i;58O z;@c)<@1ZjuQv6T&OQh7svyAY6Mg&D;ZnP`CE_7`BccFoKu@4b5(kHYy>b=oOUL!jo zxJ39>py?1|T?OmarTm1Uj&1@`Po((CE>Y2_j$5q;yL@eesGqX*%hE}?(XG8qCj>D( z9csi)ZmsFxmr-nLs$=9g))e(sC;&MH$BzZjJ2W_)vDi)S6Y;0`y%9QNBY;vO6c`-> zK)fqZRxeteDjVF0OvL>VU%h_P2dy95AxI;A+%*XKhjHnf7}ml;jM>b~blm+w9*rD; zBa9k(n8F!Rj1Mn&yhQYGU#H}qi+YIowh2GM{%?{9HE1H(9*J;uI6t6BdjY24CtTD8 z`{I==!??g%C&n-`x|CEB!3u%3N?66Yr(c*-Nd$C!%>@^89;AW*JPC$yz{M%in81W2 z_T8lKpj)9#f(hk-65`^!O!}9#DcT+mAU6#gH(d-HNbhydy<~2CI&hOkx>)5!mAVei zDdl6P82$eEu5H;aj=f2Lf-eT4o=Ev+!QGK{gVk@NZZaKu^a=pzC?uML<&L@SaWdA1wkTd`Pke_F6`}rlw|0?xLj|9cHT z%Z{@zoDP`liPMs`+t_!O?X^CL?%W&56~mc%zuhSJPFkHa9%!@=6Bqu zRa8I)MC20$^;2XJ1Q);!P=6QP6>(tz#RWf56j0fr|2cPg@4h8TJ5vUiK6ul-_wGIS z-gD1A_uO;OJ*SNRmjOqM7t>dR=`)lPH^N-mEwxJSE*9j*1e_s?Np(Q^p=4~(Ncmip zAmW^PLd5wF$3r7bc0>XUua~AW@;1aJ{`F=?6ByIBn>Srg=kAhtBDFl7mtltNhLTeQ z@o--}v`#u3AJ&QweLd0M=$b?q%at#V6`-4jOG*ZEBIMzCtk+FN9(>!S)uA`9hPS~~ zfkpWA*O1%#T5A`+)gJV(KroHQ484_-s+5fHMoT@wyvB*1MEsC1s%Igo<6fHiJ;5;h zV3ey3r6(p?QKU1O3tB@jAt_;c%FM_dXq0d$&ov7-Mvb0&)|!(d3=O`J%<*kwn z9w&0+6By6e0?Vay6qj3CEcv#Ljk%Etv{24MqVwuG+!Q6-wbs$)ri=6uV@3j*2@`=9 zGF@V5wOiSA>+4Z6yLf?EazzH0w-pVlVTlRL!YNrwlerfSfnm}sQ|+JvlUj)jvs5Z( z)ijeQHgw%!Dl|OoX5)h`{U{<~9g7QDl}oTx!&oVj#i+IVZnD5nXUeF@5K2vzGiqKg zxHQUlODno<0cdlO#z-W_RM;0IcO_qhn)fo-2e`OkOED%*aIkcq;zODeiOa}5JY-ew zbbF+AiPUgxcx1Tx5F%IaI-JP*!u_FpumeHt z8Hyz%{iNZ2p=3yp=fH4<Ca?j*pSIg@ZA;`P30ItY+_X+Pyi`~OmSKqjRw)W z3K7>7b&#cKG6l#WBHwm1_F_;-t^lq?bd9`Y+0uBFuN=hDi6=>$DdYT{{kH_Mc&zu(sy~7utya}Unc}fP+!|x+n z#Gp@7WyqOTEzL4d<1m{*CLn3^2VnO>pIEeENS{r|G&WyIg0qHU>_rM=ipR8C1p*g3 zs20Ig1FBQ z;kOu3758w}FGVL6&Ev8PD{#Ylo{NbL*)RqHmi2AZw>l{<5?LTIi&06+^=@ilE67ml}n0*)LRxAJhFD`9#K*isofnr{bo_BfX$WHTV<- zY14~=>Pq}QMH3Ddowsy$61}`K%>+vJos>O4T6(UmMW*IH)MGn>b^d{u%_JiXYH_q1mX!i7 zU1AQFtQuZLbTQP{)eV{!!;HL9J;(wND>PwrHfTG;Ao_-e2rsL4 ze{do+^hXUs6Ih7NWc)ACMZUR-Gk8^D#m3%{>UM`2HMV_GlTR>PA{W(FlGS;YVPZkF zaa+NHGz4f}`FGPYj2ygXPik#9eYIsR7ILoHXs#kfbu+#|Z8Oo|3)n!F2YGaZ91vB~ z*~las4+uIeq68K}c;GoQ2onv#0r~82^GI;RuV_3KjfML9!jIi4g0d zhN;JTW6@Zgpk}YMKEa}?nutOq2_(GwsGxc~LJqr042_NAKsL8^Rt>Q0#@SW>RqV-n z?UEd{dWM#*X35+VG5KNb5SSciO{)w%rjzYd)*^P4{3)g?{kf7#-r?>HeHBgfH*N_B z0S-_xowU-BrW$8#WV=3)DpW#qI;w3IvPw;c^3i*&#!>ATDCN>L-=x58C$bwt8-i|Y zMPOa^;#!mdn{OyO`(Yd zLZ^?qL_pfQR4NYeH;f1hLzPK{G>c8qVA7^XhY78i zr8hB$QHYxhO|atydyFl!eLscG!P%&u2Vs!rdZx>AQdyVF%DodXxAqRFLcPPpP|!ez zP5yd__ONYzIs-Hc7A|}n+K^v>U5&KGtssUs4a7V%7k0>}pPjMlBrI@3;Tu%!Gc3e1 zr5rig&`EZ1F$o@+Gw)?9TV*=4Y8K1xbW^%cVzLw6DfO0eFiN4qEPN4$s?X#~8DgYUo{-j) zQ(qF_D`f})@obdZuCrZen?A-sDtIo2+57-zdei3W*lui-b3|%xtIUZjP6mle5s6$M zJ5Q~UI5T6Fyoa(Ki3Vkw=aXnyCOu>~I*qZ=qAz!8A%2paGd+UMf=JI ztxK?31e&gGZ6u^6BTFzOteKD667pdnNwYO1Bo~=5C7o!vC85Ojx(d}*yvBLNU`^PQ z&gIG8CI;`7mz3zqE~wl(AhN(3uVI1`bi`J$9O7D7Zj50d9*jO)OqbG=GFr)bb)&mI zu;;06`$9O8+b{*{wl3tOX1Zfrk=fhpP}2*+=3@ISjEy+0h-Nv~YFcb@c4(EYYlCBN ze^cG?#>V2tYHd@^%to}Y**)7DZdYS9sIgemRMn~zD;oS*)qsYKW!CMseOEQNW-G&u zWO$bt#Nt^Q$Jm>*=yoh7!9Uls$wuBtOXMl7Bb9cKgCu^=Y2Q7)(v)+4YjNq z3`;@Q264-M{w9EC>ypsmFMyrCBj=T?tY3zN^ssPtQLA{0X<{WYcX{4m(p&zOyr;GGh#(DrUXd9E`WceJW}-rNgzgQuXc4g(bncd2MCx7+WQ|X!}Jd zOBzU*OL$~T&eF5xH2xvTT#%!b+bRogEVP4?Xg$kaWuvutm6a~HIb$@UJ?jcogI${b zU{HrKjih9xTT=<{Do7DhSeBb&@s^$vKUVKC13E1=Ty3i1-W$jKWNWQ~Y_f}X*&b-w zM+hgVS z_0_dtEE54p(~|s}VScy7AvD(Cm|*bOQAs=|$%q+$@&i`n60ok!|*&WdA z?xv94D5+Ufup^q?yhyjCZ*nkOltx>y6l#~vSAOb~LPSvrU-kc0Es9g?+qNs-;qji2a(S z8I-S#^6s^7)7}{Al!HzX?*r(RrgWKq4o4J*(MZ(90%LT4PgCZHx8i9iNtihKOWe&9cctbco%*5%(G=G|sj|d2 z&k&xt7b?6K4->LXMZOm*B$JvXVFT5$0chSsT`BqKIRML-6%4ewWtQ#S+HEuKYZ})_ zz9<)5c?27D=fQkz$(k0Kb|?AFd~mtsaVb59t2f!`Z%gI=b4oJ0$}6j0X_z?mMUhIT z%RYo@p&M=7@PnvD^g=}3cY&asj15cC@Y--xcW{u;Z6RPz841TX429PXhoV5dVRu!! zG7zN;(#J!C($p~OlRQ$CKIX}zMsI}k=ktP5ugL(LA<$+(RjEaSx@V&c18yRN!jwl6 z?d1}3hWcO-2%igGupS?d;7G+lc_F}_E@j!*x6x2pzO7LWP4HJ-{LngTXo?N3HY2II znJRvzGb_2w7U(&sY_3d$AyIWR?gWEfAIi!aY@BX_sGGu|o5sl^BS{lkTM*xPj>A zmJ7U*(HQD|UA!Z@iBKQy8A&E%LnFh;P=qqwf_}DY<~Yx6;Q8A%Zbv#{k7XndNfebN z;o|)y7+KF+ZZg8w#iz#Yh9YdG7XGohxreQ^fakDu5-GPw9>a4_l+uAb&@+Kv+r~zF zCZNNmi@3~$0!x0n7|0Q?l)wtJR7{avWSeXZ2u?g4GmpZY`GBd(2caO_i52gox;Vnr zVHBgcOQ>{FDZ=<5qk^X$jv=QgqKsv;Drlrz6^zRliHOETK=KBvNO)BveDZF?0Ul1K z)~6_6cInx)G}A222HP|z7}l4#IwX!Wu$09`TWqkiJ|&qt($G#Lah(KGiI6yns2D~p z7?4M{u1OQQzAK$dvQbPN8ZTtc5Rv_4<2onDe9WlHow9og9zvcSyUz^6K#?>RF`*kHR0bgaUJr z$gM=2W|azw_=apA&nC*btuo+19B^ss(3JWIl()&5N?HG?jnTOgh?ZJkGaFe`mC>oC zF>;xZO$iBG+x!H8m}GNFU!HP zx+_crUW}tn9Opo*y|KZ;&`_U;FK9V#j7Fk{5k?o zbFlsq8e&=D*>{fC65ZuCu|}?5H?B#+DT^&y;H?pb%qZFAo>e`GhGWXUS_$sIn|fr; z)~uI7T{Ca>Gp7oiFZhU5b&Rt; zbg4*_c^Io*BGg%xK?qVM=LFfTajr6KPMJ?L*E+e&%=_aqLL|J5s48GSnBtDziR*6o z&Ap$ZV&1ToWOhCw`qY|cDkbJ&g13?FNa?3=>mMvPuxNsfL^2YMN)!c*8&9OS;;96> ztv0Sm1=Ii_m*AY)_OQ2pYL*qkbdc4Ki_W_i8Urj(!h|!KL)V_olj&{jCmoAIAOybe z6N*NALcMFGexOPg27t*0Q%IY(Q$I5l);$Pr479c}OJN+Y{I!e15E62aGrR}-fViiC zR&p%7!yw8Hl-LQIScQG0Dy&mLt|DqB)Q=Ey*dohC=p9^)bGk*lo6KaEM(cyTwH!0)&1Y4}>U*9$sy3aqx;L+6 zwiuh8&YpquD2e@mEoUJ%aMhPa|E-z~AakDB$7aM|oFwCVh8Ks0nG_QM0!M18J zy`xIG4C7-3t9R2%`l6{7m$_&|)-9C)t&n7_lEs+~7LH2EYnX<3*0NH>tD z1L4T(fut1liAr0-l37uBuqdZ3osqC8!)Bk+Z=i633wz0s-AryKS`m|acvEx?h6|O+ zUXYYo@v1q4zyyi3gS^jefx;&|)&rCfV{1HQIHz-Y>I`X|&4ZX(mxPFd9EK@$t`yFZ z*+ttv$*F}UWe%@YDUfvoFmy6UrAcUqt<1|VV*w;cq#n|SSrySZIt3WHDu>1-NkAri z&!%CmHkiwl6jd23vu|uw1sp=jR4|+mT9@m9j(1B51zX4=;+afnC1GD^=tpLGHJ8=c zlL|96Th@rXM@pdp2q7r)O6xRmTMFDsy*XeHWRfYO6bg+F6K=##2QDpBs~atkh+$JQ zvAx9@rhvn7MafFz6P(oI%xMU?$=2`fgPTRx7J)t;p>zFPUd(x%8bU95sTz_WX z9lM#fUjHD_Zek!rUUSJc)H9e`4H7%u_Zp5RJd1^VHg2NU$s9GZBxh+iRl_G~FKwJg zcmiS=L;<&6j72PMO_y>Csu~5(M%VFxGMGj3in4_uPJ^NX#bqXh7JDnF!6Gig zLOtPBG~A!;w7!lbyXZ8qL)vO`&coO>)(+>GFtO8;#)l>J7bn!Slws_+$?r2MoOm`? zK(%ab_PLN#+Z1MG;9>?!#g+`@wK2yiNW5E&udH}X#)fUM+Y?JBV}o-+FB@FDja_)X z8)%&qPDvH3_g^is}A}nrCsGS+gk@NawDj;luXdvyuq7*uX8x$}*XpGr3 zAEwJ*^ms(i<`6{jb^`_lE=S~Ju@HmuP%T4mWnlW^69t_MvuGAcA0}jxtm({zvky)U z#M(Ts8Je?6CTQ#|TqGJAnZ-p1g+?S~=zQdy9yZ?y^SF!w+zQA@X%w?`VVa2XUV2nS zR?B>j$|~4aBC(F<0f~?imds**Fw`OnJ!l&;kuItd&||L5YeSojSYd4@(*jJRAhAj6 znH8W_O|v+pnPafXa;8QL{;OF#iP33pyi!V|5R%r!3r&P^X+$DTC@M}%fEc>!(&Q>F zcwQPr50J%ptMo7x22{HVPN$R#9w5xakjqZfWlknt!3F|i>A6D8TvuMStS;(Ej0n)k zS(=ReX{C*L?5@tvx+OC-Yj*q683S!HaNw18(zku_bXj77W|QA$kE1#}jIHrX1JE5f zj@SYdd0k=Li}8>Nqe^Q#YGmw>rcn>X##x4%Oc73@jcMp)@|!MJhPC5fc-F&(mM^Py z%NLK&L))b9t?VYk4Kv$pF|~sk`O7o}q$6}?c%@GvU!m9?zqvru3HRoa5 z#cZhwpmT#cX0ax(!j)$yTbSzhMb*3}GA%vzi^lh$1RW;xL(h(-+xns>DoWv$iYbDa zCQ3Ipn!cc!p5VMbyv^nFNX`T)%4y@fp2VLpxt5>HBgwDrxw9X{NVbuwS&bDJtV*m0 zXcBUnx`gMNV^e0MX`g1{ZC&~gQXQe3RA}5Wu@kBov0!a&s82&Q{?T+g{V>0K$giX# zY!aAw?>bGhgXsmXYtl?Crho|6@N-`&J;f-GBv2WsNFPvdsy8%D=vRl#ei8@*Hm$_S z+|D*8cs-*^VVnV9y)K$cBsWCE9=#cMpWV{pbC7)2MiP-8;&QB(0rVi%(8^fN`RWRe zMXfim52{XpdM8i}TXJL7YIhCmJ)sOUp)!@uJoO&_YtW)qEpSh}@@!*IQmV;91Nh-M ztuX#?ybp%|a9=1H9*SWgA$$%+qrC%>XkR=$#NPDBLxW+-;+bB;ux{s6|JEmI5_oRfY+|30x>Wz>%U?r&-JwVC6;`&!!<;=k{W zt67NuKGBIT>f{ove05JSRU^Oeas28I4v9vKM{lJVw-((hsC11unLc zHxe@O-O4*6)L6n4f~7;5Kv~uNTv0WhG}C?cSVpFQb6A zm_=qTj~gJ9P)$6Nk}j2i(M)qt;cZ2-psb7&A|o|mM@>+1g6NYAXDHL!0hGLqR-II% zj%I0q4b0pO-K{o5DJAq118r6rHlRPS{zTnC7PpuvFSG3tgdd^1t7Exs&Cn}Ksi-hJ zHW}%!OfAI?@;JOS$#<-+KngVgnxu>#@T58_BoL*Xr{Nalv^!a-xk14M#|1 z_C1Lz&#V)(GW72_9!(;OK6)TeQl}?JmAooVqCG$KazS$pLxZpB-eD5SC=d!6w?t%8 zwY->wDlH3Ckx5t_jvt-^ciF^L#xkfKGEg+t{HmIAz^k>9eRQ!eoh|JhZD{VShn7cs z6hpB2tupT3taMa}%?H`JDt+`UU0u#nLCWK-~#5CtE2Go-#GWP~}m|Z`9&z&B0v85bI zxt6XX#FTr;#(nzh5phSP>8-a1Rv@WoI%y_ zYiIFY$0*rey}?Pk8ZB2LVl-_eq@eqXw)EhvozAnsjMmKcos}E1&e?@`w?rI^3Wb{w zXN#ZgymspYg`7{~TPxZ*B}z4Oa;#vY+u8d5U?#spZJ0xTUOHNv^8g!?y_1rRyKqfJLP`)lz;LX;x7 z7kDBY(6EGLyNI8TGD;(CFNq9}s+%8O)}+Ttoav8QQhtgECEY7COX*>Lz4yNt#Su{hB84iJI2fv8VW4>yq^9HQ* z%fx7|Q|FkGLav-k=b^7T6K1cgxqk>HV}qu6+9s(JPiArk$MH{hfDDJO2k7bl?K@^s zRa4Aq>NlZ_vfakUM%_;ol`VL6=p`H&6}gRm@hH=cHXn57ZR{N`cNyzLJ&BR;;o29u zk03u7!0Af>Ne7ozfM>;;6Pjg{Cf~2B28J&WL@)zs;Rp=bcc<&Dsz6v=w65Af=;6a` zRVb#@AYIgug_&*=FsQRYWN8~Rnqh#rA7cZWxX2Y6iJ;MP6D@)<1nC&$u9ReT6-Bqc zqUR8}FvDaQjmK(5a34C%ahdH5Om3RJ$8dWvycx} z4%;F^?7lN+PCD&d4iD*Uit;1lSYlj*;JcPxg3(DnoryFI3iFVdiq4icZsoh|VM%re z9t~;fkTmVN8LLKGf*YEFHOQo@Y#xi#Tg?*yU3Rd|d(OHO1>IawnoJjMrr}0mma}p2 z#FmPBnmIV@v2CnS-W*--==+iAC|K7r&Y!mRwcf?q{j1*opYYoY=-I6@YVZH~0=_ou z{$Ieiu>ZGru6-KzZIGnH$nXE#x1nJ%{5|Y2`s~`Lq2bWi!C&|-!F>`*zaRN_-oDi! zo=5&~IPX0A2mixY@XtN>+yifB$o~y9GxQJshp+IT*OJB^=t z0_`(PV1C9QPYW6F$IR2FXZk|o*=N`b;hDS;pJ!@+=lRX>ZOa$ySFb(h_KWy&iV36! z5e1l91F^4GRUPZrXFYwD=LXXwUIaD2MM^ks=B0+$&pg-gx|t^%_L=!De7dKh;at4W zYiL--Z^&|-`4+$PJdpp#0OxhjHSD|3OAQC?Gt+Qv!_04Ag7RM3hu$-E9Wr@XWt!=^Kp5H@q_cB~@y8>D-2f zCjn!>eFMGkdA)w~cliCKGa>zNh5M2 z{@)uHh{2{VmO4@Mg}!*`Da8UF4J|6D`PRZa>UJi?c0=3mrP6vd92!c6h=y)+&>GGAdF(bSn4K=(=SGKX2JM``v46P^elwrYy zR#1MQb_%?4-5`ldo1z*j=3#!BUq2?E2uJbY1p3j5jU**M>4eqP$JN?&DTn$X=r5BF zt*en;c!-&u70EFrmSX^DCJG60qa-22s&hgq!J1gKK;yP*T@GkviUyQl8trl*b#9|{ zoFZOoji|Teul1y4;|Wq}9$uN7k49L% zYwA|2Y2_MLzNWUz6&h74<=T1B#WiV8x>8n9JCGq~BXte*=(IGND+Dr9Q z?u#U)rOgh5I;2uibK?a(eGa%c_R+@8-P;{fpxq<2w|V@2_`4kL4xdMo{BXAjcN^Rt za4%w_B# z_d$WnTj6&rd8Xf5$Zv<#f(bhG8j3(|ZvfujVtnThYQG)k7km1=n*hx(e&Up2v8pJxd$Q0Lh^^jd;d6U_B_mH=C4{p^@s1~XeTGY4}oFGqgp zXLp;%IFV^m=E-qpqSyAIr67m+0y#0|ye+c^V8{>o925v^Vz6~?0L&GD{EpfHOt+cK zkOGXYaM1b0PjThLQUh?e(s{<`7cv?PqxfzWzPAgVLaHBRO=x3(eRQ_t8T=+|0n)6ko*j&amQIs($hEaOOoEBOf->Ez}& z)zHH312*qDAqRxt#`F$rVxN%7G+JuSH-=7`(`~L9peWEG05mURB-2#dw%h~^aJk&C zJ^Po7lNXE>e``=k>?a+hmk7@R-sBErI`%uDtpIqZ1Wc26ONR-739lW?g>L~?U_g84 zpiL5cuZ=7m>AL`%E`?`;65e4grovHj(3S*jN!zj9SR+Y9NkCWuuxC=CfR^4th+0h0 zVJbD)Vl1HDZvbEc=nn>k7eS$hG^3x)y#fHzU2_0C{3tn_i%$0)CG!HzI>I zm0-jfMR&wG&ea8PEqSQDeHP@|qOMqJu-$Cck?bsVcm}aMeOikEKl*i3qK}DOjkQQUoYs z7H4{y(}Ty&luDUEmCK`*F&BNo-7+*f8q<|+^&kLdjS%34?nxqBDF$3AJXKjx7GqG*kwkNi2+nQ)HnN0f6xA*@3=UkkdbFRAIRaL8M zt?GWOmI2Z*65Mztv68SuxR{6c81JSo5~Ez^E2H>^rx?d<6|g^d&AR!G{lwx8@eEJX z*d1y*D?O3o%Mmn_$%>`>pI=+J99Z#qHfx}omBNY-y^@vrIY2X}FOt|R6s>fAZKf41 zhJNSq^O8XOn^YuiLcDW+Vl_r8XD2`3q)bNF$izc*7lRU^)|7PeAibnqOMBk5z$(C0 zlA&E$C?qiBu;W^_%b70C1R51}|AM;BKa-Hka8)*BS$pERS9j9?{Zm%B`l07V!K;o3Dcd(CnB5;T|qLF zVf2K`jDrn=)?~J%h@G}|)CjARWM;ErsRpfQ2Qo}8EF826;Qd8mHYIwl;O3R#s_ZMp zg6O0@7W%vqL>g!pn>z7v`67f{xJf9uqR9%y$C+aWBl{pcc}BA5Yn`T6+-O9yV_XLw zv_7UC+y2!qjdIdFddVGYGK7SR%7-SqzYs2CSPSN z1ZM@l6-pU4lsGdt=@dUb30HP-5u{OyX2s?zl}9bwk!^FU!yZk+HP*{&?@8j;9HyjpEFHQgi!vKx zfBW7fD@qhzE~iJ%*`D)2C>5EG8R(wmq7l!S5OuQ5<&OKMMZR{pa2hc>m6fKD`lEG+6 zNpI+}F!eO7qCAJ;+JW3aIHMoFBE-59GuOsT!3NspoqUM;EK7K|qS#)EHGj18Cp@&N zE>M%4_cweL&#wc^SgTIdXF*a)cZLb8#YDy=>Y@<=n4c0ezlL#3n}Y?V7K-2#>D)gx z^M%VX5SXz$E(FM>^fgQ|GjMb;_S!>1mu%F|oTZmG>D?FS7$nm>ikA(Jw9V0w^O^T2 zIzwhZavr?%g4Hp1HM+QmBI!_`|MZ!`?N%JYq_)VBV?sKfVPaO7o4K4cLWfCYr;*)} zMM4Ia+1|7RgZ^^V<6m9JnfN8WEUAaHGJQ<*3tkNsp7;luVfWYAX zMB$|iiD-K+ilLan9*3K;06`;b{Kt8G*1+A`{Phg<^i&m3INYa*lw zB)B{!+&bNfS_K8&)>gdXAvK9=3;YrNUSjy8dR=A$d?D!RmhA`T9#Y8T0V=`BRrX)f zMzoImZJ=u|r-S)JVj3qdRx!5hvM=NF3K&%FfL^_L}2O$}U%*ZM@d~)<_HhUr2 zrR-62UcNyMl1GA`PAFr^En$aiND^wyuf@(Q01HB%RZ5{t^(t=vz&v}FJTlML2D!Ka`xMQH2DqF6 z!O(Gvf^cq^=q5rs)m2D*^f)K6G~_YO;)81LgOw4d9e-WesQ<#k<1QTcR%BXEc5LCF zHyIa$MEW&p0yG9EV$1>W`D9|8u_iNw(7``339s5=2zGWSPPo~8N#soyFlZ-Wc#WA- z9;p|as-|zeC{6xlu|e;@D=I3h44|P&K<9L$!ccxKn579{qh5wY+g-$k^Ic9%WTghV zq}S&>uv+1EZ%l7ZS8O!ei%!Eu$I_;|K*#OXX4n`stum!IY+a?-)a^(QJ|n|l8Vjpb zQgJ4iQU@Dcg=jRg?v>cNvYab}SzeV``_G@+(qLD9vI zt6P(0rF&9q^vj_=iK$;ZR6~j3Nqd%5)-;8;_3RoXU(z3NK2k75-`-CUj!o!*ixDA`W@&G7f!}Otu{y6pam^Zr3n%4UB zq@nRw=*GIm@H&2H)|TJ2|{~1o$8B68fbYO@KD^PlnG7luwKiKx|<|zgLwlzhVo26o|DJBQbQwV zHXETqsTq_OvK4EgI_H`jL@w+h5g^uUy+xx|aU2TgETblr0803@t>sEc-BOw;$}y_hp+fDI0SX78WNJH?B@=LoxVfI@p5|{86FNu2n9q? ze1O6Nq{yN`6H;+5Q4LEa(eTd4?aS0r*O5PkZ3pUH-JpJIkTC1DCb!J#=}UR|JWgRq ze#AV>=q~?`rpI)?#fx=5HcMeB>QWK5$EQ%XadANqQjr_zbzvZhB z3{$jl{*Ep4Y@)ZFPyGT*b!S}CK~yo^gVX>YR7>BhETy)$;q-S&Lo0Ntwm}vdL6sw8 z*jQa%`s7;^YkdC0)dY%mb)s2v%7?S+FViiq9%e^!T%s?r+wBidg|iv1Vr_ z>)neF!*6nx1f!G;dUlEyybQ4=H$qOH#cmnRiS1SFG-z^DugdwLj^R@4EUp=v(dx)Q z$b&mIq6@(cpe42;3}NE(`a?gJS+SI)Lz>!*m!yWtoW-PgG;y~JId)f?m5aI1f;@|; z?Q>eZ?|vHy=qZmveCh7nQY!ODCTt%dAh*PzznnffpkePQUMN&Un);MeM~{XOX|eob z1<5(d6QKw`D9VT{N`yF5N5Ez0218Q^8ku3cQt@5kaN>)}NsPp|J%0LvzpusE(((V< zQAGA2W8O9^U0+^1x+ET-9|WwR-6U=O4KIIa5fT9-TWotE!@5(vQTj zcI}b1-q|U|DuAY48?;KCM9C(`z}3OmMZfdauu?-IhYf;4C^pCZysRZNb)dDU<<^!} zaKRW+sK_iVKe0xZK@pWu&hb->9z3YUGtNkf(nZ@;YIPf^86g^qny^7bSRFJu-FW@H zN|H9@#>0i93ME*@v)mypj2*KmCL_6p7V(NhAen}>`ew!M@mW^4%51tKl6>f@0qg6} z@|(66F+5GRi`5`WL)+ygb;`+|GknG}KRp94BRgx7s z`}0;kmXFKnq+61LrGOs*8Z5?oCc#A-pC#M=(MyUdMv<&&Me^52`|+xtOgODgSL)pP zl5bxw!tI$0D|^Pvi7n6Oo8@SQyMvG}r~Q18ov(#|&gFt>^etxS+9CpETy~MS=0>E| z*g^1GzL&yFz{_(#uko!vuKR01@aLMx)2EWrAn<;#i&=FF=qfH0ozDZs ze%fwjNN&N+2Mef{2CKQ^%d8{d_z^)@cUb=bsI;?ZudAg z#uDX1mOd@6jO4KUaq-yf8*1B+BgwT>jt<_e0Q5|1~!uDxoNZs9+zKUa)k$Q_$eI;?dIhZ6zHr`pR<-@|!{ci(CbXDICpZFKq- z2rB`#9y)MbT9^(4$?at}I!SXkVd4UH(w4Q|EX5Ozg=9EZj=wbJ?7y;sB5A2bgp-Eg z)a+2US-Wje)h1_Kfz=!gXJ=ajtIM&*(Q%hFBB~vAH};R%s2X^6WL)}jwsk(o-|Jj=R@>&?%HU3pn zM+fT__-m=H<4EYH+|cj3?OyZ)diY87BO>e#8UE)ttoq&Vt9jr`xvA1r=F`W$qob{1 z=GTB1M=s#K>)YYc@u3%?h2M(d&2T<4m;V`T>pXqXZ|#6m+=F{(ZYd4#Jt;3iKcf8W zG|MW(-q*}+rlawNqhUM*YVKMQUyHZ>@j&tYB|?X% z^<2eiNARUbPvcL+&NmImPi)Q-&mXb8uRxD$ppouZA)bD&`uxH6l8c7+zZd)gs^A6Z z$fe&9^bCMJV87;|rjGEi2HAG_4)cS4kbuoQ-G}-@-9ZWO!2AOeAvZw!A1HkL5ce+6 zX?|e05kCKL5BAp#qt3)vCrj%4Auy?fF8~5oAIyJR5Oxqzy~2H|cG#S_|^V^K10pcnlPcWnT*({o55Bu*dV-&tY!hyQ8m#HajsdMBQLK@Jg? z|8xiU9A^A4?jO`>|6PgL#ebK7!WjI&E@BY>E-mH1lO8y968sD582;ZPjj{iOJ4?TH zS@J(5UH@-Id0qcMNmC)k4f=-@u}1$zh&E69FCWAY{>M;e*ng>={=Y=>{Y#|Be>Z1S zBFY8gAO16g5&j3EbZyMP<57bC)_8{HKLJO@3CNJ{QjJVrC{IxxbKTmV$}2J z3(iz~-G=|VS2v7?ZCfIPR6ESflFZbjD!-jl-JA9*_W5~eY`hGdo(*YZG8QO&R&QED zgKRlydas3UUxRra1c|QR{JBy4`qDkBStDRA(hGM}t<4W8^!VHwO@Uis{Cv#b{Iyx( zfxS}W-wVb6Ap9~{vOdY-dk_R|!}SeCnF`qF{&@d~DL+7I+c5(89p3Y1%Uvo+y^izK z{!hUE^yT<8s_^Y+M_E4@FuL)&5rpr(KO~^1gz@h-r!bw9=HH)|T%Tbd?&JN0K-4S4 z4B*C3A;N%`g8WU`}pfbq2BujbPK)-jwIbb zz6W;+GKqVh!(tWx`1&-Ayz4{R{Z7*TN7T&|)DnJi7rXdJ&c?c^+pn;TyRSzD4&DDp zmtVlbi#rZeoL_JJ^cE%w^9z|s#DNqwMD-&bbeUmV@pXTMz7ITopR z*ky4&Q@a(3($u?JH5k1K>67T6jHG9ot;SuBrS-^PaV*r~yxo|SG+5JQx|GZFTNX2* z6m)48xwN}-=T0?{*wty2s43diczJp`s4_}dF}u`@g~h_`WYT?>%aZx?=S)oo+ib!+ z0ro}p8gcO&xF-@xb`@s0@I-FEuf}`qXZ-_O`o$hQJlmo8LhP5!bY_kG2BKPN!#Xg_ zB;tRMu>)dO-PKj5E;{NiCg`%<3<6%I13{{Er|2%}->qC|sy+1>r^D(P&$Az#*a@fx zBXb>Km47&!mb;>#Lfm{DD}zl7 zL6@pl)`~Kh1r@1iO5_&G1m2Pv4mBkqgL_Qj8#~~|=7J$}x>FjfI7m|o=PChp%wOkY zn8sKf3M#=m8VO{P*vN@Sd$X3E<)ii`Pq3aZ8Ot!(D8jy@L ztFyex5$MUA55Y90jTDUB1F3zr|K6Megj&`$Gh=zukR<#)|ILnN6!^2F{S9jlc$;<& zLA&+9NQI_=@65h`W9x_nK@NPJ6ZWNwM_Jm$GNHXVyoI-E|?A zDN9(ArY9%|u6F*E7eAJAG80P5zzh4Eq*RwMDn3+oabZIFUYPsNgWaN;v*Cx42@P#o z^9Y=~Xps(yBEoM00@-q-_w~L9YzIqh7!zHyD%fiG68cMeO9Ij3nNBX+- zb9@U$1?+R|qtax=89HH%t0xz41LI~It39K>HL)AR_vT}u@c8VLHWcgc*R{3kpWhBy ze*)71Z)9zAmK4?cz|)U@9U$3t787ZvFR-J%6$0x$z)_FmkB}ygnuppsm4W+-kfCl( z7w|A4K;&~9f4!$Zva2|DIj;Vjt^F%>Huy9}fB*8g3%j5ArIX%uA>d}YvIZWcpuR!L zy;`^x!$mZBsl|GU$}ixLl*?S%K>DNMRyg$)@!bv}0~aQY6W83*Pu$YK zgUqQ!gsk8KZB%F~ABk84eclTI{XCy+cW{icz+UHBy6@M=h86fjAYc<9TRGnuWvWMvOlT@@3k#ZUFwh0>U9l2VICEiU$=k4 zZyof`GCSo!mWDmLsc<@l!5V?OL^VP=hlsia8Hu^D8>cHyUcM}q8Z@}71y#P{E)Vp7 zDUqk>j-e(}uDCZ_Crp)b3; z^)pB91>k+!v?B0ZDHdX1yhVS)CD5J$k6_YarDVJM6aD9&ct}0M&9qbP2Xg zs@elOC6tt7s#!(9rj*a7+SnrBK!75*QHd6;HIX)=Y8H3=4)&0 z`{({&i_iVO#?O7ej3}U~X9`bYn#@hzNVPpr+R&u$<5+cbr}Xl74l#uW|OfC6s|CE{A%hf zqw%6(&y`zr+cNtxH5d#=;cU<#c`h3MZ2un!(5X>lX31&yRfs(%}zUF z&&uUuc+s)2d{hakLssb!{AqE@fA9UC0|@$CDs74kzBM0q`6l#G%?Tu1pPEs_bw2}Q z87|lWPYoM^`*fO5s^d##s=+rJGAc$C12reAP2?GifNz2nMTe?QrLkWDvQ}1dGd9!F z>eU#f?2{t3Nfj=quqL53ip|i9?b}|>rPD*=B6%_<7q9Dn6{`y0vp7$a-T9rEV?r1 z38}X`8Cuhmp*e`pb%S!_vxe0CW-M9!AWEImTwOlCSO_@G7PhgE%Vw;lrzCYj$EAeA ztSDf}*4^gQ)wRQ#mCIrI@Hkmu7zQu=T znhMppZamCyNo`B7Mtwd>hgYBmf6IfTQ!pg4jWYIt*xGJvxp=<<}l{GT&+*uKjwOnML z9BpaY*;cTphgYShuh8WA7k7tN!n1G*c@lRO6ID&#dw7B-Hu*u8?5N?qg^O`qN=yqk z&W`%=Y6?RdH!Qvx(5t3-^F2+y{mhy8$x3(;Rb9m@s-KCqo-n?MfK!R#B*|qoAoiV> zVbnNm!zhm~GB{pxMot11?p+n94?B68WDtMdnU1+!@`F@IWYgwIz<${t6lMP_MgK3>N38z#l#>Y|nsbvB4M zd(Yl31&Q;JW|f|-<%!Bp?c(#DbaHO}0|a_taO#ARo{I6u0e4jS+i%LH+sJPh4K4HK zA(1erCm{(R^FiG&?KcaZ_+t!G>7jXiu)~HfhYfDl{KMnKAA8--Y$VXmk2_ECuPaqzXgDnk9{nyNMNUD{qM~R2b*N5Bwe&7 z0ktX2X)p4Odcunq;>Y7DW4G++$n6vPve+?3gIO=(5`Izu)B1BFs8D|WONU3h)^p<1 za^xrG=W0EVkAgh&><%{KAI89McDCAIFE4z}y3c|JHe%O%V7t*k#{$szxOyA-@r z3gLf-?!Eo`L;t#e@^L=&7Vy&GO^CKS7XXndQq;eRP0W~Vgu338F&E(VrYgw~Q{3BX ziS7IJ23=?Ck1&Oqu79$r{l`fhsYsYD=*N={dIphSnY4|ZBI#||4)^>SAU*6w~}bx@E?Wt z!@oa#OQV{Ecv7@NhYlw!HvnY=Z4>{!}2ATx0t7& ztWY_>F^jJV7OnOBQmvekjwx3LGQUX?U7Nk7jE5#yOOuB;BMwdWuQ_*mV|jj-Aq~B3 z6NI9l;NDW_sz8vQ@7lnK_&%BK_UDkR+kT$&HV6nn11vw0+o87^KEG{)!9M}_I{z_w zE&gV*kHlHoIYH0@A*T$mEc||mu+hJQ+o*XuvfjUA%$P^O9mbe@sKY(n<`iywh>&qv zO#y6byC#~(X*=yV8aVq<(*4q5&l_}IBpzCXB#AbuI>c*CJw(W8Ekk)nB#CQSSCmAz zl1)&-kc7$0h~P>jiWwrW2zv*%ArYeSxpA#8;4KRrL1p`M3RAWeIW#Oj7ha`2f z!%gB477yyAoM`tH931^A01r7(u{Ib8xia>yWu0`21|>&W$LZI*-ENp&sbXUqKx$QC z#Zk>J_}XlhpFHoL&R^2Qm3kH~T2VdX$g8*mnMO+RqM|;l&Zb2f4A3`=Dm5k4s4`Nq zVKSMw{Ha53_viwv4Y7~%#Kjm0YM5f~$qX~h_ig&vqxD>=CGc}uxu}DIQZ+QgxwH}? ziYR!5lIUPK?jfaaVM-Z3twbKRdQnCt3pz9(qyZa97EF94u5w>FBfvM}g{P5= z+zxSaC+tHU2PkED8%@Oc79GVppR`F8G)b-E0>oRmC6C*MpR$pbm#Qe1l^Z6bbZ&}( zJxS+r)r6qLLzDhpajifau9mW3K&BS!>=Eikka~y_ypZ3u8O{9mx)ni{E^$i|j#>DV+MyBn#8236p7Srk*(S7pXLpsYIu;*r6`JorHPgOX;^N(4YpbpkHFFOIFH z;k9$JD(5u$ji6j!6C&mGh@^8>*s-58vxp>Kz2Q~kovJbpWCiX|oL}$~u2p`(VulTo zz2l%&pcDvCWVwMtV}Ijoo@Y5dH5MVoqrb**j=n=hC9 z$^}*%c|3d18Cy5$W(^-hTZ>0qx~jivk_Fu0SH%p`!uQKjgO?3DL~dg%o4Hl7;XhKD=5bm*N9KyTpO%k=SK51l>i6k>t)(0afUNY<}ypeCAa? zS4ty~=kMIdov#!d%Kh~hE(x<1IfcQ#CUGJ!xFx8k;jYtIYWpfsJbqTcsj`skl9$o8{W>ti!kzYAqhScj=vEF|! z{=TgcgA~I&1aLJY)ufYH;ri*nVtoysfKL&DqF4h z0@`(bsW{N`)GkczDb&!jI-d~T%ze$Wow7e|Gp@oylPVz$%I!0tM-Y^nq8W{NC-CR< z)riGI<~bKE3g;|m9To0}j)08C#1?o)2*)#hL{CJGhW#RO{n5v259HD_AHjQna49h^ z1qN$>Vo`M3d|Fi`GJE1Qo|zTr?#6^U!9L%JwMLy#ooLsNGd$+pAh1bzG7%_iQms&VRrysHqFY(`#1|y*1?z0z%*AFkGis{=L)2S%Jor^=B7@)a z;kNK9Yu=PwFpXgu<_v-<7Ajmu@W58n8|U_EGdfu{i@^t}yAyr_Y{4~*h+OmUZJ*SA zC~)2Y%iA#D&UCESfuVl_r%?e#s9 zsCcqjKeQy-S|M!pDAP7J{-7vnFyDzk?E(?eyL42$SuZ$j)nn;W?_wVZ!ES7Kj`7pM z8ucAg@F0c-(q?hBY<38J!#q$+Ycm$Mg~lPL`=@CKM*Pc@#wm5Hc}zacI*b*_!SiqM z!SuEE*Z5Nf11hZB_Q|H!PCHx-$?LX|3AKk#vlK^I!w`(G{2?zVY1687AqOinyu9@AP^M=Bi(^CfEx8tISvu}Iu` zi8rIkdZp)jdh}fA&4p3bHPVr&vV@oSQoqP5!kcD;GsP1TsP)WI*o$dI7$qCu)kznJ zo=<|^g`=|)l!K&oqTbNGgl2dvXG_0V)22L(ydFccgrlK}(!kZxILvVU<|6ydu%o4S zj^R+SY>6bUq--QIP7y)>QCn3?X%Cp9H5(k|f>O#z`$!g$2s0$!Ww$Y3rqwCO4Z3e! zUPj>^LTZP>&UQ#b6$?Ux_7(M86s1a~v2F&t3DlY`+dP?LOS2*!J2E<0Xs+Dj5n?#W ziY6Tz{r&4gFENk`dkmuYNLATF`HOd6hp@P<0t+|v}lZ7c1uR+Pu zOIy3g)RWUChRlvQbyw1~G-+j)qu`uFbF!;ZH!(q0Rq2YA>WtC&llE$?ZF%$3AJPD- z?$9gq>E{~f1XpT|DY|8xW7BCN14#$pGu$FoMdD0g$4eK`TS`O(G2q3wBjF}!LzcS3 zOBKbczcRo0(o~t}m0$_;DkF}GR=PVB_vCJjYOvyJYy371nkS$qvk|j}HKym|QJVLn z+uUFDDau*1!o|0P`0Ms8V+XCVETHBf%%cx#uG>ylh_#HH#jMM&Tim7IOd-67Y8p&Y zZJioJs+kQZRVp*>wDc_&fg<@!#3Yt0!rd|JX0GdqgV*#~{&s>?KhWty_owzbrEde$qUG!;y& z#!gkzU7EZ;Hyc=_>*b~;xm+lSCU3Vc~W@oM~cNmNk>%HK<3P z?+UufRL1&Lr_RCHUGbyo!KGuCum;jz#gaMJVR=ZIx;V&{#rc(0H^fhP>Wa&%c1Gnd_MDW2Yr6)|AmhDn3(t?z(SIi5xszABo zBs+}lN#%)&KcCRp8EavxvE{&n9Tc{i8L^eIL3Z+Wpp{P}R30gFN>eBN@X~bLgjN?q zGmK4TQ7~N0OG@h;X_-YZRPQ!=!&=P@q!TJK6VmX&AQ2Y3BGE-R(EEgs(9N-jmd>S~ zZlvL=IfX<^lJ@1#=1lg?SwAM^05pZ?u8DCX%!)Oo^1S-6{K_?0f113S29h^KU{WLt z1DGdY#@}ax-N~D?DwjBB3dbZ0odq=ztBH*<;f+L;*U!(+%GTh92T1cyRcA?^^BXWh zh2yYnzv`W|x31`;CkD-K-94xdaJ+ihTTPF&T79?kBH50rA3`_>>15<12uY%MYyuxc zTSOvXyO#y*MM9x$qaQwGtCJ!?i2A?8k8CzPDDTHJx*BZ#e&!kyX2_QXl#DJ{a}JesQ}v51o)k?4Rh_?D>d)HXSkSuyW7?k|?)Cg#JiZaZmVs+*eg6nMrt zm)mIQO-KjnOVX0P1N=Wf&x?Re&3JX%rqUZ6Kh6O)-jPB6l=fgtx55vZDF% zl8q$EgQw{`9E#d18$07=knM`go$}k=och(x;~Ub;AZ^NZMB(;@xK0h_EL>+pO5@jj zLGMWvgec_BIdfoH;+&6*^$e}Wq1kee+|NSv=$Dlt1{-&!lKn*X{k9PiJr=KhMBmS& zzZ3hozUP0KHB6Q&7^W25a9k?AXMdb5#JB_vh8y0Ps|4s`7?e~VuW)*9$hB)K?zcdH z!k($T68Se}grY8WoKX2H&_LJ8L5P~{TWMPFUy%KkY^w_u;_-mNcc4^Hz-5_rX0Z^4 zwB5_x;Eg|K0gp~2s#KvSB&^hjX|-27;jOr>(@9y&m;Le4>cC%C;|waH z6!%lt>^@u74WRJ5SF+Xk3d^pKlR)_Og4!w`X{+hU1Za-xe+XA1Ov|YV#e0;?=>QwQ zv(qttyo*z<)4dBsaXMQ~@VyK7R`l7Yopr!~>xV8dlMOgZ&3U z=XP&1`R+>IOJT;oh60W5*j1 z`3-yS%a(Hual{x^0G!A9*i&AY{z~VysuB@xO^n=d3^5L?+Mhg6r`A~!mu+{%FN;gY zNlMDCs1n>yWdKG*&L0H*fiY?4K`?>(l|onKsG#7Fk*td6U$nm^oWq8Qjn&)$@iC}2 z2%jiA!Z<4F@1;dv5NO*`Qe2q)qf+yyC=!I$i(ZVXGr~Giz617*N?0rb0Tcxp(HE6a zi39jb$8CkfHMvvsFjqenVeL9#_(Ya%8@s3^1N%8ONzb`tP_-lsBkniR^20^FXyVGfSWX1|6hYv%= zakrUd{-kF1G)X1L5%uthWYRGW4bUAq>XB*OIX1R6kszNrWThmi>=eG&+pv5~r63hRVIjK9cOzc?pqh{3TDv z*fp0M#Ge{#hr}{aTruSDB}R+n;H``824VC@LbNOae8Zhhz9l7#NcwS4(G8MxLwIpG zwxte>S4Xvrf$RuxA{$PoFNrf_fuW)%IU6(SR%YQR>BO^ZFdXE)San&BMB7sKYkh#I zJ$k>6gd=&uVygBn5nF1>MQkPx3Mcr6QU@7?ilKhucZDeJU+^lHZy9=nxty9PDQ9p< zIvTDM)~`zhp4li2?PpQqug*gij~)K$sukfA5LXnbBty;Uzb z8OT2JK}h2GQ4_X5JY|SHnW-Mop6dVVkX?USa0EYJ9JZHPudV|AS^)R$Z*LjkkH0L@ zcEF0HNfEc3Ah(8FaKtb7PiD`30XF?Y_PkB zN%Gk0St7X;yp<5qyz_jSVr5lN5mWE}SF|&@Q&$^Do>T*hxx|nOF?5Ujqzj!W6%}tQ zY%uA98k#TJ<>yl6PXJ`*Jhx59@GEw;aRRZ`xAc`0S)PW-nrDYlFhP7S@Y6{LSh`+TQ68YNS&Cwhpl|9ma|*+~Xhc6K$KIq3?t~kR$v~d^1ea z_B!eKd&Y=gGMpsYyIr(Jz-??qfIAiy=y7tRlA3vh+eldlCkG{1XnP!t|( z`f+;VA;=Vb`vh~yz>lEB_bGSYF@Ye?g3;IciagBOvu_1??0^Jey=cds4OHN$XtP_q zTyeBOdI3qKY)`>U_5@XXH_9RGK+V~*Pz%gLUpz}me=iL8|0Y5C```&4SD{qoVU^a8 z>!p=R`jHQY6_#;?1R7T!LDWV{vM1NY?cm|rGw{`g4`Xjnq(b>}*f6u9)hvfIdbrmJI)geDcC>D9 z8j@TCD%cBtq(*~#qfbTSGm@g_ngJ)ev+_5G)g_~px~Q4s_ApR5H2$Tnc6ElGqC=R= zCa65)gk_y}z-1|bkQlN%SH-u6`FeA;GYwRC4({-64Fpdr)cx(ZtzXEG;SID1bMZF? z$V?0F={HURaAEX%`gw~zD{{6;cJSb5a~stG^<&}2IoBB6!YY|^+_`tV`a>5sVYT4G zhB?>5vlcN{g{ZajHJ*QlF6nMx@#idiW`eY5mCx`9<=9&Ju>7)QGtM#4D&RYNz9DuE zArZ+t_dwrmhgJYlU@DD2^?kmn%rWkYx=V+)738ah)j4~!yE9*gzi#oisr!4=SQ~yN z=(*zOk!e`yr}~FS>uJ+iL0NaBRUTH5)A(`-t)P|XPQG``_-ujlcMiNRLU>3_oBzSc zd+A=eQi@1G9@vb++KG8M6R8bOjbDW4kZ69;)@ZE*9 z65hoMcGiV>32QF!)~;!J5R2C=3EX=7u%mO#n0wuJV{I-Q&B$y72NE?z*NOo(fq}hl z<)~twG+)>FkgTmW+W<-%+Ns=Fhv%>Zsi05tC(B&u@X|gd=O({)+mcLf?PYK)pl1>S zlA-qZ^d)b?ptIJRC%M>y>BV2Q3N>E{Fee^Z@^H+tQY?$n9+@ z$EvS)I|s*N{jjo5L?hBzEGKufmAvx$#!`6|Hh~A>P!_~!+}!8OFMCOL>pFx?Nw`ZN zfuhW)9ngM&ber+j0#<~eK?@f6SL7SPDkZB_8&NH9-Ik5yGh|mt!vtc@t4-JjixFag zAKU`kyaA$-!G2VXD|DXF88`AeNOcscYnHEjp@kk4BxaDlq;X#z-)^(Jr~Ph5T)50g zh9IGn?1OV}To(;z489;ll6@O&KWvEA@*WQiA5{+nF$lsOBJt;Kp;}nugLPBw8Dcly zn)7NnWd&Bm?Hju-Z<0n^+Z6+g)rnv0E8aL~&8b2g>6LoiWj3ZmtD5+h+e#hmpi-do zDbg6#_On}LGv{#bQI0QSR&re5IT}QnlKya2os^vqE=65DASj2)vJLr)!HC=aVtVzx z*A7EPXM(%p9#Wva&S61*10rHtfddgPba!r#1Zg`flahGNVFBOP1^{|BoY2f<@8DqS z5{p~0Mo5%r=z-(k(zG))V#vp6vipN=2ebt(#E$-91~ft9uO(n!H-DBE>`5`q%s`_J zP?cxxJaPa-R`%Mw+HJ$38M@Tqd|@qGfyiZDBsM!GAKMW()jGO@5KY!h6EnX6>(54n z2r_%cFXr0F+`>6$`1F-eAV|W{DuNG{Sl>lua8W+&tpdWr16FjCyXJYx7ECF zwv}2CoS8s>+7`9F9QZh2ZAtMoM>ad*jQXr4O|zkT-nELbu#;k8U8FOv^@NLkU{U9@ z8f(FR`J12zs%_l9cRP3(%hVo0XI}WPqV>-#P&kDF>z37(5v(VR+TWY4#teOh^Mkwo z79g`VWKXWwwFQJN(+hy}u3?165}U8=1x#GvdIlVWH~F*N>~zaBz5EfD5#NIk9EA98 z&|7a_TZRQiuD>2UkOQ+&b9^_8Lomx$w5h!*<1AK~25NB}7qMCNjLTyNec+#mHd@B8XJ-a` z@~i=|+n81ksO_y1YSL@zvUM#+Kgull3rZ{`?XhY#3pYtC;SQH(&i-1opg3ZkpV7kQ zWY~v-eT?BP{g^xJPv5K!f`eIuW^l(i=FEQ1=H&8&uj&?v^mg7WS}e~W>v`JPB8lu} zNY78Vsg#$%r&NH}ZF}z-3wPIdfBB~A#NEn(Sl?d-$jQ#;X{p-2yUERRbIs7F!DjNf$|1J8YQwfci}Xw5}l1~6NX2>*7>TugI(}fJX@H+#>KEkxdw@Ja~YvK z3PB;}z7V{%YW<$&D|J=+GlKj#N=Q41Sz-p}M!m`b7X~4HeiKW2DDXk2BcDSV>soWe>NfMf$+C{{19riVN%QOXD!(xV|8DnH(DE-ExK(@U*5C782&=sT z7FT>Zu$H2D?|`!RuZHx`YXML7?;b01%Xc`dR5e6h8N`>>z)nF}uUI`P!}n-R7phwrGz}tZ6Myi-(Rkd5$|~zXmA_BsnT+3l+^3 z35cxLD{MG+mv0fyn|Nl`L3m^(d!NmlBRf_QM*8a6o_(|PCti6hgZTpYh=FZX-q-BY zUZgE&jfRj~&$X*I<_2EbvuHDNdQbJE^tDBV**vXf)~z0Q6UT9_w51zKf;5#?P+wjpM- zE4-t)s}q)3uypQ527?q=GYr^C7jlRU+pIXM{)U`DHKPwCT5ks`E-opmoUu{6Z*uzR z#&C)(;Py&$z2%cg0e`b}C6MM)eQW9$*XWB^H8u6Rk8?^q3QXzVj>75j5i8LlB zs|z$TN(afn=jjM9F>0g)sT;GmAOO@Q2}V3(s4_DMV^>4)+L^=Y$6s)&rEKGZ?EN1At3Xu0Tz*pBb}LiQC`z*Wb2VF><&3;K zNCBpy*KTT32d!-z+v;F0KycV`0Os_xQP_}*+?gX>+_3R6jU57H1ym85^r06pPfDWD zWZiJ^n+^fv-R-!=oCzpJNbdYho0f%IaFmcWct zN~c14OQ)Dd3W-(7;_`M=Phg{!u`v=W)g{F3bocl@Eb?!U-)(dgwqwC9=pI~k{Qps3 zt$SETZU2A%wzf8F{I|A+_%D0qYF_GCx>Sk~FYz$o3M3AS1ig*{P`vn!_y-n;BUfrg=!)-4|!4@H-Ol#g$dPz4`Z4x@}2~w#&Dw24h`n&a55F{?U9zcT;cV}@K7QW8%p)Y zhLZ7EG}RN0^{!dE)J+2;S5&!_O=Cb(8dAPeB(X?IOjVcP?RE=|=U`n@HL%iBw`-Pg zG0-yy+#e5zUBz;VG@JY#E6FnX)us1TU${Rq6iz`clHs^(40xD_gp8F-9%(Em=d*5U zlcP}#bqz_(QCKlaW7XOhp?O^-3I3A0=LLfdAgL)PLeNbsX^rVOE&3@w?a*6HMr$e> z=@|+Qh8gWUg$|+LzAKe;Xx4+A6;gk{sFRWRgoQlyY8Lph|cjJ@XAu1BdHO{+4Etk+3;1c?5eVF4H(#*2>qWH!*Oz zw6s#n!yAe$l!P!KIU`0k{@}CDG$6S($T>(($Vi+eRwD^hO~M3-QF+o5i!P0A!V)kz zOSzPn3kZw^K-a-jTBQ-I5|v_6DV6(SRAC@0_6-QE5b5&}4i^ufl1hYu<&VUp@X!~D zhkKLoBQfj&DtASP*Ty1!ZYaegEyj{r0AN~K!pJ05E@aWetX6d%6a{NbOUzE8tLg-i zC414OZMPKk1+d<%hkWMlNdV9RIh~bDs)--WrgsSM##Rl4Lw(_RD!e`w8S0No6Y4|` zOU1w5qIwpsQMHisBvmFep`~(>K4wg$P?;R1+##SP29UJUHXwr{NG(+rkS$u`u{E+> z#2$mhY;LPbUAx)+*yFJwc%xwq`@eB9)`17&uG;exw4v9H_}j4 z84nZT>ED8kpgZ=2l;$6u;@HKCA%(F}h)~zs!*{h@9)|Yzq1ZHM>>~h%dP1&CO_+B< z0t*i$9RSiLNwcC`@@b;E&#q@C)A_uTA*oqIGZ@vbu%s-JFIZiwz#!r4iqII80jqQd zO0@*jao}zB#xsbp zgijPbS+4DtRMsU3>-uq-G8YjAG`Y4iAu_Fz7L2kykV8@_r}I72Wm)xT%N^Q#(4U)aHm-$M!W2z_`xn4z7K6p=kh3k+SOY7XqOv> zV+_z{Ut|8YTFxZ$^*lQ6uby8|V+ZAwid>pb@GLeUgamf^S@^g?xjdm%sRaGz?lKR3 z%8S;fOF1IC&ldw|B*Q>b&l*Zkg4o);bbV7l6RIHWZEY!QZ~{`cA{Ap;)Rf zlniz1Lm4@mA#Y-&zdzC&2@fSxJ@7Le$HaTe^BAw^7^CA}<8-sdhJo<`fbDbRbWMb> zo0*l!(~zkdKf?+(UCEa_XT#NO8);&0jiV(wy@j$*y9tlh95O{yC3#%eux;E-!ZkK- z*B5F|k8vp}?eLKAC>y7^VC)gsGdu+m4d4?I8Tm_?hiOIO1DAIAH)vr>rBq?jWOHZitGcoy@$fno| zpQaTUmza<(BvX@wE77C|CMG7P{hreL-DBljhW3*gB&Fk0pHjqR_&t^8vjRNwc_FgitEGQ_hLcI#b0bn#3rxv-~sxmtg6D zWZ&4Q+G`gwc&Q*Mu3N~6XkkEGnj)0r}b$n7o=cZ^P?(ji#$z)H^~*3$74mgutuH^Z*$={5RiLA(bQn5 zcL1hEkBtV+gF9cCG7f8C;BWxUEp>M@o}3uz?F}aql+QQPN?<93cGsf*5DJ1Uo~nvA zZ6YZXv4=L0XjN>Akyc55sgpFb5lZRB@TSlhEWvGHT<}Ne2p%GKB3;PlMSAzHr+OMS;?w3vEq(vJCL+ex6;>}bkr^yLjHKc^4m8>Sxqe?!? zR%58qgQ*q18B~pghgY)L0ku`V1$j!)^|D>cYFS7*O9@yewU7w_>p&EW9;0&CqfZNL zt%4;2<}uqv^aQJsX8K^Ow%^g)}&wQ8lSYY6@`hstDeh3Pr>5q?oIy6#3H0aYAma zfPoz&L%q?FJ{Y!G8#*{FgU&^Xk@p>mIZZEBRFP@Hph#Eab^u*`m^OPbGMN*;6|%W8 zM{{$df&URU=Ug#Sp3JXYF{)&zS7HNfQ<-&WAUae{>Ri!GfURgIkQq!}FTzp*(aPf$ zIVYvhtmNR4h=(8o(Pk2*NF$42Y$=-y5;TZ$R9uQ#H;Wo~NQfH(uzn^s>dC-{u}rk< zY{1%t^K)U&wc$7+VxrhwT7*wztl|$;xSI1oiv~k$!qM2!YM0;RBXVrHRLB&kT{H`d z|5~O#SizX$$}WSvI~w>dWVm^jy+F zXs9n5mL>*Ce0h(gQJm?b+)JwDK^#b{N+AW3YzkwPRnNlIJNaTkpH7AIz5hF#{r^3U09Y^nr!Q!Z|J&|wU5Nj? zS1!)LQ`$U|8gOv7`dU|R;d<4t>f>LC$-IYU)EWP6twD4A-}ZpNePR6XjjL%MFGo|8 zg!8V1^Eq9ldGTGOEXmvCOa-+AwQrj$zm*y2W^9v1{mSDOl#Ar`i zg{3YqaIXV3a(QCof?GKf2=gguy9<_-^b1oLQ5{pGw(aZ$lt{5PPO|DFq8Lp8(nk>% zVyGkCj#`LDzWC$ML{9?`7$6pZmoSPf6pX!wA`vWrhBw3`s|S);O0QC!F6G82%95+s zjor}Fgt6wOHG~aGuvR>S=(|YHzA#IQm}bo&LPBc`RGAWz9oFpY#EPHc+_EOnpXgK{riXv!c|5nd{FfqCC5>Zdm z1C3?UhV&$*fInjsO$jOG7`jVuy#ezcQ|}2SaAGr)8z&MI7FPvaQC~Lhlu7H4hJV)K})TrGHI`Mz9{Hw4T**KdSau-){x%# z3A6A_q(EF?qV~rppq4OH%*++<2K*NEu_k;c0}HS&0A1N_Xff{twh%4k@@)6lm}{9- zz>RNHi+ELD?ewx6RVNybA%iD)Pp?z1M; zcXcrNDI?+dhEyUMj|{Cgq!qVxh$Iq*q={r|Fq|BS8NnJibu^hq8*6kQN88mk47c>8 ztdF=c4wj&CBYxbh_tqE@LC0Kf2_`PRbki;o2ZRy^Dyb8bw~27* z#7z?_WjnoCI+wOa6{QU5Oc$BZs6Bfmrk(_FL>a57*f6=U)#Y3h9*%}__c)Stl6G(0 zD7@Od+3moA%OTNWD(NqPA(Dw#GIMR6mOF$2gSG!IQo#08px)B;HhL^5Z7Om%7xneiMfE}RYr z{ozH7V?F=%H7NDh|0Q{R56h^h|MLf1Ec(CpwuSZo-nio7)#1KKvc=)pXx+fvq*?nj zWB*pKZ?nT}%HK^?_#>fIUnIV1leW}${_7L}!eu-DCzWiVc^=EaG2Y(VT3!F|GoSx! zY4f!~3;REN=Q@F^NO^A){ir{v zDM$k?L_ylt>2I@9kUEmx5)zBU!T07DxnSkcA6X5u&mep(rxqn~E^rJ+yCwd!m;TH+ z1_#)$2}cs`B>GtfSYwPi=reyBjP;>SA}KC~5|*ksP6!RdG!+iurd79;F5;3efFHlV-G}8Im;C zbFz?B5tAxfQd08(tASROp$0SsEm$kTP%uqF%hLcG%5yk+`=g=NiDifen8b(N@HaBl zo4~((#t!$BN31*j-4t2m;&_F`#uuUCIC%+z?Pw*J&$65V$=!*+2i%MRI83Y`{uX)) z7ed?cw1EUdMl7)&${mizHVl&0W+=Wooa}b`ecqt63t{yVh@>6(3%4g@L?H|nQ-tD8 zgOzD+QBe5DttkK+xrVLiyK(Ypkb7*wdDG;STR;mEhsZ$>-4(P5ZrI{oU zgeqsHCRnJdXK&iLNnB2D+PrBqdAG|KWdY;OB%xilbO7nE&zd-CZ(n^X(`alQg0srQOUpg zw8miuX@|`QLm~yQT3C=+ud4E&H!By_`6;8W{f|ZdZ*2`M?EmkTt7`ufHZVVB%zgdW z+S=k@SpV&ft9JjR3V+WHfa;C^_JGCyFW_5P|Lv7)zV{-iw;)C~bTx^K$<}6npxM_Z z`P(`J9i1($QdyaNmF#RLiAk-Ks3DP(z2sbx!=Wkr(b!&cmE<$snjJB2j_tOgirG#j zM8sSvAkmsswOA4DQf%{ZV-=IFN0I-0L&eoRBV8^S-0_e_QT1B%P z7%=n)e_Mn%eBX|(NS!uZgFBd+|Lxl9`}Vws!k&F-1UJv=E_}M^O;>QgobJ6_cJuX3 zY|7j?cY}PmEzK;P@FO0(U?ysLxiDUyaMJy00V*qVw_uXdSx%+1*%D7eo6W!spgC?g#}rFFp{Qj&$#5*rlAtP0e?O8S zsE7A>SdP3mS#Q86YOVnv>3qs9Ix$lzH)o_ki7>+oKm^+if@LjNhvECC9i+yJEaydTj|j#4<6o`S59Ip&xrP%+;T`W=@f*WS_UwJLDU#&4zqpP zEZAys%NIsRgi7FVO&d1dNKmVpX1>XIwF_{kLJ7qb^+=Q&g?en!1|uVx-hq*!HQ_#b z3eHK+wL-qw8fxijX}o53h!wyBCeVL@wFI|xPPgRK>tteeHZ`KnV)k9SLFp{>X@;V^ zBe%`hRZsq7)|PuD0M?QJ{H^BmUjZNfS&;ws!ZoifNtge0veDhewm17)n*FVke|cxH zz0u5lb7sL@S_e6) zjuTVAyu4M;n;>h3c?_f_Er)D(0D-*nNW|l*2`&g12$!3GrxcKd#YzjgcnP(RNi;Gf zSiw1?=$nQfCFY6sY7midFt!$^kz{xf1b|RH65SvaYBhBCdc7tfC7Otq$3DNt{Cuug zRsOGS*6n#2wfTRG-ybmRf7=4Bfd&4*H!kY`TT?$-9Di$MK=^p8nU62;^!p8bd}*`j z(|cNNMy^CWcnc1<(S>)`=!2Wc?y&wT%O&FnObaZoB-^~^Vz}{Bx>#aX;;Ky^;A?e# zgzNsm?Hq?2iej7J@D>}2C#j+63h*lCPDgj)3)j*zS$OE4b;wmt0mtid?2yQEu*>8i zioBGHrJRD!6lImUhr*28o${nyLia|J6dFd~jN!p>eDw|w`?}p!Vp-hio5=ImZz9#i?ezw-Vt2E7liaaroyOsEu%yb_RHc;L>rFHi zzMBmdVa%eruSF~OpmDQllcspz`)o!ld3X5?2T;G2sKnpv4J3u`X4^3DEchq&8@Tt` zCo6Y%xhKtT*FMS6K7&kQ-$-e0jg;&gNxhvQ43dtEpW-&0CXq>2e3;Mk?k-|P81=Ek zH@RL5%oxkIMT(YWH<7{fR~ZIGRMu(64^URMl zZV_pXL8tH@sYG^wn*7`wel(>oUw9yb3Fs9q9D!0P7b`S$jM+Cc>!qF?4LX8LII>PK z?MTgAS9R*UT0^l^Ppof)v+72dq?7! zc55|NwT?U8xT*Ji0>rjM$kNROhAhp9f6Qv-*=!{4 zeyIjvvoD+X-aM7gz-i?>43QorL&z$TL7OPvx<$GtoY_K&=3V^Vxg22tN!0Uc1^A2t z_1H>G0gwzQ)7dmSi&o*SRGCamTjjI7j+g|smd4U&$>>M8l$PYJIn@5<)UvW_ekx@% zquA~@SDjo;y>6G+JpSBO<{D$4n)jmjkcY8)D$Gj@7J}|fOad7j{J?^d`d}=CV+lJ( zWZfv=JvM|4h@Q{cXjbPf^KWL86{&Du9xHQ3r4-Bfp0Ox%Mn1=JpGgHCYeK0MxR-Do z4u&UUGJDcVFeDPv9O6B+5AT3DdgtR$lc4D5Lx zrG{*4<_ZU|Akt4w-Hd_^ zg^1H5M>+EoP0|q}TegfvtbqTaT{#@G@J|6oqpGG$)2m2p5DO$ZpG2r1F)F8$_j8#O zj7v7XL+5wV#)KitOl;*=t>9U)Op<7bJiD#3xdv=j3^SX<^Uhh#nGllso-I%7NMm*d z&U&V>&pg|y!lJHL_i%bJFTKBr&HEV8uxWnD>;5cp z2ZnFGRGVSAZRZ|~xSGuapFWI2E{iM2vfz$Fx>QO}b7g!P0Ax!lz9bB|M1z&4Ecrw zK@Z*K!Y1pb6tEcJmt{o(@vAT`hHa$&9bGxdc07IIt_uW1F6)T|#u}urcToP!hZe^cp9#pEN9i7M zke0?_m=rj%>v%RIX;zpyUTmjvrqz<*`XjB%WDO!D*X)EiN@s-tF^Cdx_YTMGW|V|n zMxH?z;PbOtXwPVts5DepXs8d$0lS*Bzf8dw12uaY5wTy#VVf*mj0pPJYiFqAa$2LK10 zF*3zaa%j~=XlGB?bVfoG!CJS))!pBI#Jp9+Dr^p(3?yOd=C?T_SS!i#(}=shUtH8- z)L4__ve9(nY<^ow0TaWXs(ojwz;3Q0ZP3Cra0b{Vva4E@y&E$xLlG%bdrVz$)CAXMBsfH{} zOwdJY(_JGKj!9A*+W}lk<;qH07`gZTsFXt-f=w8ONJak@FokAI(P=w6rGEdb7O{-HpPNEH&0h zX&&0yLsn!(>?K%aP}J}afzon(u|yUlID=`&O0*Ls{IH02E`%Qf(GPp@a~?o zJWh!?H_A?FVT5<{DHD43$^Iw{3kokBxL~QZEaG_%mYN@25RmGHNvfSK zU`eSly(yt2TIsWdqA|LV++yp_lN(YQlk2H8BWYt=qX9NcizbFPAT?WN-gaufYfdQ| z2D6lAyI7&eEGDxo3%B~TL9Av_%92v!MO(x&yGEAKYVk!fRk7RSnXCpwn5&u{lGtK% zK|+gdvS@qh)*jOL>{(j7y=kYX`kuE?D@yN%GEBRdn^FC)RGzwKD=f1ucVEb+ZD(nu9IBH4?O0 z)C-x6OI1TA(*oFt>Mk+3-?ANL*YK##QY;qOgu02g!;JGLPI9=M?xuU$V*(D4TYj9<`s$>7JH=XAB{zu{ZX)5 z+kfO)L(uq0G$|A(T&9l(lJYTn683b-b_2*Sl1>p%1*n#=bt0n) zk8a2y;M2;q>ICy)=sw|YxGc--&o`6MTVAT{v`rWxa01@LSA;nmGL0ml=xN@nBvw6o*fc4n>De?bE#=WT3PfJIGr=@-YL&)t$68PU zo^qqu7yQH*yI=vpb$u$UZI;(guW)ZkM)asP`-ASWunin)zNA`KLQ69QR7%4N-6gE$}8_MS^RjTp?EmVmJ%FX~b(qHOXBA(=?Up z*M0@e=!UlXE%;W^&fSg=2qheO1=&l_L+oDBfq5u;hj?^a zz=(dnf>R-WwbCYHz_5c%2XqnSoNPU2RApS_6qzgM5DaG^1_oAj-0KCJ36g5-;JaFs zGn^Ln`i;pns|Nx=n^7&`mMudSG3M6NvsW@77>=Wb~^#~m079>|y86)voS|TWoMXR2Y z)_RX*#6@ni)wIXoW#cr)PJU*>FI^u@!LnMW=eA{ZO9A|lhN-AQm%7Nk`!vZ#6iSfH zFpw@h7~KQULV(=9q-mw$D>~lMmMZ$R!U=iSq)YHBG{{6yMv6kH5#nAUpVf|~a%ZXB zsD~gFK=07jV!Ed(VcMbeLad|IN)fl|ppv80oI{B2Iv5I-Nf;qnLV18dKs?_Mvt1;G zhDk))R5G+C>~{g3I6=l4gocv9UB+(2H)P`l{=$e1(O*uTSqX&UbTqm>+Dgl|lmTwf zzzQ<*vATt6EP#~MNSy1^?I1?F!xeSHXz9qD*pjV_(s%`?(s4E}TZ98}`TO6e)+g&f^I3J?doWO$UuH~Nu)N?HYIN|F#;x;h%` z2}Ki;p}z2XnkTgy!}ma*)8Wq&qIWSGE!C_JLMT@4I|7VQ)s9+xE2^Zk8na@97WcVI z6iJrBJ(zjhu=C*0?x~aHJw`_QntkENeWkjPl;Xph>;qo>1=^(rGM@ ztzR-=@|s%^YN3S{9m}yjK32LLHx+%tW+DNgbs+BWBm3Y5k;B@ID{1wlemPKE2EenD zvV|lwQa<7Wt0mTmN{-yovfsl?(TIu^PQD9YOr`5AkZ)De5^ZE3#IiWsTF0N@>849m z7A=hm@+Iv(sya^L^4ub=(kFX)*=`cDIpAWNd4$;ve-gcfSv67x@~oydN-xKo#1S;O zBn@y2f)%%Dz)S)Xph8f-T-fSz3c<>qloVY;!tQSBcR_q5rP=_k?zCgs za$i?8V#h=UcNMc$PWU`JM52=z19q9GfZ_` z-3jv!9tYQyo?5eM%r?;%nY|mM5;Og-J`7WtyrRmsrri2GS%W)iHgSS&Kg$0UDwVEu zYjyTo6m{I9&lADUpOh=g!w3~fDof{#x*Gy~@1n|_Yh2;YW{HtNy3ME~XHDh$4T5!GI3dlx{7F>C?KT0mgsQf{<@3qcy~ z29NnK=7DZ_1RNw*j(P)^|MzF|8UZthcLwaS%^x=GZCSrAZ<@%OcUo#fQMRZi(k4xu z^BxJH1cB)SnJ%1p1jAUm5it;ptw}{giKH#J(Bu#fQyhhcL0Jc~wtS)r2UV6k4elAV zJ@8JxQ_02~eIh!C*=`S0OI&EgP+utC7x3}qiR4IsKP=mAHX1x+DN=pQL)5P$ime)R z0)g(@%m#pYlha%Q!-inh(uKTw(Y3Qu^^Auty-;nVZzr$>Mw0Zv+=Pi?G>)S0GE^Dz z6g030(k*J0y8c`2mg?I7>;?P3pgI00+W)jK*#GQ}iwWU_p~w&ox~$o>^o9FFBhh3^ z|71u-#P1quoy`@s)J#HdHUs8Lax+jNt?>`@kLsP=vd3lA8~-hSOZ>++--7+$Ub#+i zoIt%-!T%_TH5X(#OZP}nQ4<;t^$vss(r5*QBT1cxnR3!`g2Mp=4;SpHv!TO{%g-r# zcx1AeE;qG${lpNC%p-Xik&Cvoe4X81HLt)Lagi%AkcvizKmuOm>W$+0goImaD&Zkd zcmu%XZE^9|i7*kQqc4(3_C~{@p;R&yUmZ>+XeAjjgV2i1C<`wo zy=spCT2@hY{F8NKz>A{So|aKB{w2c2?%fk5I8`lX$iN%H%%EKYH)H5pZaCPf- zAhYOK@_8PFD&efwW!%86B3mG{7wGObycN3dmhG#G(7j}y-e zY23!f{Z`E6kY&1!LS;3eP z(~1)V&>oo={C*a8JlGuYN&fcEpuaQdGlU(V*Je1#s#PLBM!HFDb0yiSri(c*sTc7} z!VUbn}=_w@-J(-#Vbd{Pac z=;p&H)g;10Rw2^@trdKrukjT(;E`y0@3>rcZEyL zo|k5VqPA)o@pf>0P>le`m9hn`MzEb!Z%)5@advY%9Jw(xuOMfxVG?ygLb6BZqmRTlm@P*1@ENU(e*x(Quy@UuUH(jAcIk$8w_0$g)?<>qy!25BsBY|X#-d@1mM zazLy3RVV|Qe0yta)%8DICjK7`w6!)!t*=5|EZ2WI|F`siR>{ma4a~j&TYSO5LjUiL z%eMb3^UDTyqyJml{0sfRH?C^^pDSeLZC>=TyXR%pmjC^}mVib7+tRuq|L>J+#qoWy z-sFbiutfYR50CUjBfXNdskwPwu(!FnFWD!pA4m>HK@9gv2@s1i<>uz_kP`(ta!9+g zxp``8$~zVGDy8w}WW0GB0`g-{_7fxaK{ju;oOP~rtiX5pM^0x~5^-=vIakihE8|Fh zozftNAw#Vat__G8in^kirl6_wxxyCIhjcsD@^oHSCuF(olqO2@ShrXqO4!Aca)u0L zW8HwVy%|+?62YD&?}>=tT_O34?eFMd`1ha@k6zj4#da&=5p% zvKFUj(K-auxFR<>E~WEOO@d5`0Fl&ErrSwR-xmwxw7Jdcl`EQ|OuM3q|FxAXMswpU zS3uV(g>l+9E1KEUie~byTK=p|mvrd(ZKZ8@l8p3^wBmSJ^@-S!nwmu1q1bOkTOqwQ zH=d^8fsXvVcJK>oQ^^xd&fu{10d$F9!tPEfYWrL8%6%DFPeeo=%$ z@|yXmL637~g8ZFbo~$xeKwBN>%0BjMcKIeSXl-fQxpIL1m|d<6#uzC>6?^HAS>{6e zMMCYRKO|G*Rx~rLvlj+9lj%YwohN{R9LNJ^uHF$sh7)pyG9?Sr+Y#ZZM$JV4WaA3G zRIcn{zh;>+hyJee`7|$Cf0`u#cp;bMLI%cCoc|;ZmuxPA3A+!B<=Gc8nI^U^nkzEI zFR_}_-sp9mGjKJZ-YSc*6Zm3&Kodm)87J`92nbM0@;2LHWEN;=n-WmpF#A=5RBda@ z*lfO%9s|ZIdkb>8nQ>Z`2}#bC!}NuvLv1^OE(A}JV#m$*~Uk^LJE6&_?jMX!fdaG%$4??|hpX{}yAhcDuiPfVDU zPfi?<4q6SZ41H$dTkNnn@cKw87<5>flG0n#xja!S;*OS{Q=iMS!dzxoAw4Cg&}Tkl z=VsCc+(zVy={BOOR7x3{xc;YI2-BEjE`t|$-~bnZu6|5H8dgk0S}8InO)C}R1HYm| z+F62yx1+fNF(hs#aC_Jjg7!Gl(mI$+anH1fhw#`LF^*hiOwt=m$Zu4pp>Db7O(X#a zudPICYJ*X&*RW7cCZPDt=A}$Nt*SyQDp_XBnv}HG*xBr@v~gAQs%G4l-3%kT%(G=z zhO+4*(l(5XDW$Z99>dfrFq^Gag3nNb-`6~tF4+~*PY!SvE2DX|GN#!*q&!tD(8mgd zfAeOvXaWzSMH70AWHtqZ2lz#9yg&_K;>xI8f`&!pQbkSYbCYUjf<}N#DwB)TY23-^ zQl-_EoSIgZd>RK|FI(k}#8a9q1T`FdaOyO1Ivzc1Y}`YW5W{vy?1G z4^WEa*ehlyy8}vzg0K)ZR&Ojl3Tw1Q1=g?!ADQ(po;dG1Ub5zO1WeAXpHQR2+-^h9L1W83`inrJ+ zIU=z7Wa2YjhSK9OIqt2>w$SlHg_OoKHjfuMD_uPtrE6Oa$7syPqLVV^NLC@n-z*e~ zZ3(l|KsdI@a*=w^LM)bWF-MRt<;m(R3o=tKPn$IgOXVqD^+0_37IUSXrUzkdp?>eu zWe3--5fUjYBrFPT6Osk`C1kyiozHrlU<|`zO#o@K;GgOi$Vzo3Bn}=kBP8k$Ru+08 z#Nx6-DIQeH7RYOML;-yi!gq;ImZ%(|=eW6F+H?`nRV)#=uNpce8uAi)d{Sn9{Rq&K z#KapUMnoVGPDNAW81cj;Hm0`D3F;>jl#wfdYN(?e)zwk9S|mm_S-Avl&QirG>z}MP zTs5Um2}RrD%3iI_i?R7#FOgHoOF2+k%vl1fG@ zA{+yDP$bpJ0@bSu zDG@t|M~xjLCwH)Ez|6CRnW>!yvP_Snw=pxNGp+*tP}Dn@eS$S{K9Ag;IY2-Sy#rtI zR+X?8BytdNcM|KE#7r`^R;M3Fav&@vV*SZ=p?Fw|B&6YZY;B}3+$T9h33zsTq;-+x zKx`x_L5g^2D7it3^-H0l4bqy(P@hK%uOE)17yMY<5g8ngM#Aupx)_QKt(JNqANm%L zMg}8E0GfPhPc!uSfy3&H=r z$w+Jn+tC{vLT7nN4>U8L)UvLNB*Gpk6pthjBmME%pvQsugd8yf1o91qDHO!DWatt| zg3lv~um(`-3x}cr3;Jis(0{X0an41SA zhHC=r8elHi{moV%x1dK{&?ElG+Wi@aJ{Djc{tNbhv$Ox>@Wm$0a#W(t8q9ms907PT zxlBTbVCV((@IhSY&~wGiN{u$2Ia8)pF!rm?k+BG!E1T>P4Mv9qIe=Q$G@|Zx zDGP;R+%V#pC|4#3&!-FH6|5pB2;veDWHPzLv_l9CQ=-1D#15eI5=r2(QQ5&}0CY-O zLR%mx(!p1EtdgkFE#-)QS3*NUKtnG#Or)+-P@SS_e~6irMwN~gXwC&Jdy9-|S2UAH zN3kRqDOwfoNuFs@^|r985f}W)30f8dM}4huV7d<$oaHG{wUVP2KOH;IVligMI%Zjp%#6P2r= zKzNo*1z6~6o>x5%*4C1w6pit;F}v3hD-d0#QbHY)0G>xv5qi+$pbUWNI;lF5D?2f* z-m{v<(_v%BW)uM^2NJ~qjbf7%+%Yt2YSHL(nxaE=fm6&;^rwZ`SWIJVtEb1a?zmi` zL$n#lUR;cyP|S`s6=7;XGtdko7r43u|I$4IU6IC(PN@+aZo=>|8~3K` zSh>}=s}PVx`oTzw#ca&rmrc+e!=Gc}E&0qva%^lec zm{W-_RGCg!jDu_8?Ah$46!yBYQVvSt16pB^-+^ATMj1C5yhg);7D@xVMPpbimC z-D0R1Q-zFDkHlg-=oYRRM253Yx?NcSuD~V@L#P=y-GIr1K%{aagckB>5x{UrWImWI zrY2;9SX%$A%o~@bt;qm3ac=HrVZscKd?Gs1tbj$HRpSaOaXPP|M8_1}ULcO( zkWcDJ(-}OYeyptC6gr^!c-DrqM=Ip^_s01E$K_ac#To6k!D2{ zU5P)G?-#8kN@!PEMoF@h?93#J@@0~;#$-#DjD4Mjgrq1!vP_bY?Ae*IWZ(DQ*mq{e zVD@=`e*eMyd7gXUd+#~-IVa(oiS5lN@%n_bc7dh@DEHa>{F54~B_DHpe?BXH_8+*v zGsQTFTdDZIvksremAy;!z0^Bf5w1fX#v_QZq3{P5mWxz@hgcOxV}sGBtb^h^Hz&&m zURj`AstBJY+J~i2YsP==6{I)HDhUiYOX~DogLk#J+*T@Tpw;{_ldpdOD_Op&8S@}1 ztVwu}ig(&wS6lwOcrzjI#YY`8{%6@y z6OWI+z7dJf9i-GG$aa+9&nQ$qe=WWv@LJs)&N00TzMzw)mFYqjvctjUk1b`j{(f*x z9I*fE(0D^!(&}%!=)KxZ+e^lWeBF`3g^Mq5*nh$LIfTWQizQ*;(r|@fUqC)J66MNlKu@5G# zi?ujy`HG~c47#fdhLx_QDoJrZ-}qFt)03(_sbsh7Q8_$(Bhm0;idocC={e6EcPx(! z=!#G9bxlu6n;4aZb?OWGYGfM=q7(#VTr()%P9L_9+&Vh_%9eauyR=(E@bhiI^k@}q*c>Vqi~eso(%lm z)ax;V6|2RA)T5CN+ftdT@%o`UW->YS=!CoE3XXLnRWyAt%e@iJ%5opsg8a2v3@TR4 zbpQrN&;6yMPtmOfwjc+s`x*0@BT;IxI`--}ZubjB;a2C7b66tWcSvch0n@tBaN;7H z?^7)>D=RH{HMU-KP~eeA$Xv8rj;b)Nt9IuKFnyL`gW9y7^<|>)7Pa_3i39ZF^&&&C zlLd|3=RZq}DIe4JBKrksBgV@3r}q~uRe^=Tc6PvzIY0MvwpdO zgOAp3$H)L;anp>EXE+8MBme?^sM{0{V9_S}UV>hOfPvjw2zmyd0a6zr)mXtOKtpmc|N^s+wA`mHiHY&u30eC%y1EeNH^$nSC z1Q=vYQI%>)cQy+{bzz%V?)c2_wd;eg^gWY;)vf>4*{gsGDF?X# zg)li98DH2*?X6w=F*kw^Y8&ed8PY^EW*iFR@D^KY2Ms)rV8QEx1g%?M&Hd$#BwhZx zxlZY#=f3~y<&o@SR+2mn)%o#ZUup$nZl_@+83Dve$k#9(K$`58a=12qO@0|Ie9O7c ze0oi7t;XE;Nr+QW*6zeoH9w2mR>1Dc2!1){M41giw3UF+dznZpLAg(I+i06+Z5WQY zAFa2ru{J(DT$Y?(T=VhH`~v>*H8K$^^kfP(s#MK6dqlgkt~K`)EjuMrR?5yg|;Q4YFm66RcON3Y-*qb;BB zlXwMDEC!(tJ>xtILUk(|#s&6GnWrySZ!pGeeR`C~Y#GdnRma;n^h&f1zc%#+a55$& zBt$i+h~7&`HD+wk@&BQzk$n&B*U9FUr*sn*=aH3s`0T=X+ToUSY&tf&?nK zqtFoIUxzrD&`p5;vGi|Tk*~6)&s6SMu&B!U0d*`oqpxar3CiA&HJTk$ohEO>;DHA{ z3?!0Hh%=K)RML!PIU?xmkZA^W(OD?4kw+d&ofyLU?=DCi)4I-r0(U#~v9#zB0%W^) zp>2n{TmS-7BBn#6V8Oc0+Gr+Qxn6*^&sxsQs<^Wy@E+;glHAK=)zZ_GUyOD zc<@?`^=Qi?gmG^Ni#~3PIDi|<2~rKFmY!5HTGKUgBm>e{L%gyt$8#91(|i_$E(YqM z_oSh=WhX@7?`&Cn@+wks>A}qbvl#j`oq(7hhH&8pZKg*H>-u39kSI9dAH^C!;nUgrv394H&@L9Mwm@vAxTv{!dY*apa(j{=$tI(L zbqO;Nl2{25!BS_CxDZ;4vz`0>OE$CQl6{!gVyD}PgJ62HHnl5{q7U(_1;#n#5OjGQ zma&$flmt^FAPFJ(&xVoTBjf6K>$g@jQ1tbH`pwW}!9v>TnkIg~P_=&DDBZ@UC$AP8 zOzufQhriS&3k3L({kA(@CboWTq7ZFKwP_goh9NBY7=8YytSXY;+Wv0>9x}!5(+29& zdg!y>#2z<(*H?kgP{*EcZ#Q!<^5cCG#D+sKbovSmag;l6x_Yq>R~6I~rS;ihX$)34 zy*JT^QmL_!O#~;?hx4=(65wFvVWipUx)f-{vvGZSS71T4@D|JN1>>MFGP0Q;GEKhO zUhB1&mm16dw+bnW{rK_qY@PaNwcXON00Y8~5BNzPIYPj;in-eb;DOCedUMV!b%`us zyoCmuIde9}(&G?^Ie=VADad>3>T}&9uz2ySA;fpaF942Q7+zWF+d=oIW+2$v!|Huq zXy$Ap4E(oaRT{Nf4?k`;)=yljC}Q^kLL6^dCG(h>0GJb*ozZ-d?~Ww2ew+uv0!SzU z#MbmRmDtRstn4rxHO&es!S zY3uFzDzG_{cb=#T&@21gsmv@$&B1q`LdgEhqAtI$i|NG7$G493!h$z6+gKVvH-90Y z?PSP!3tnR}rp>)xVw|)NMF&qw3huDBWFz`!_f~Oi+WSR$OW);1{dz?NDSM1w@kcw) z8Sj==iQee62>|bRi6z&u!rU^VPQGN6#RSyt4L1td)*T3}YO|?}c*ZOR#U?whmggLv z@*?!`b237Vtq?6CSX#R@P-Qn#E*%i+o1;Z)5D05yu?9eLKDC1U>Pr|X1lc`B(I&pp zFVdj@tp!)D=i{t!>}q+$jt_*nyH9XeZX*vnY5V&8N4c^0gMF zl)z+n%fCML9Jytp&swa6;m%lW*#s24by@6m+B{~iFMwoyNa8B2UI`1pF`DB3=6J-g z_WgLFY^Ub#`)%p|{W|jC-Dy*SkK0-++5`inB(XsWSEpXSVLj0=0QPBU_|X-{^}66G zn3f0SWkC%WQJG{Yy`g*zyZsu@!G|Jp=7et{d)14WOA^f!TcFSx*g<15E?`%>5{hyo z1z>CU-?k7Y=~D@hv>D(p$TqTkI2A7x+p-z|9Gnu*rS6_)1EYw_G&&jBv)Z$qWH%)DeC^?5&as{@v7tF&y8?=&D zuW!q2^?}hC5Pb1&Z;8*Z9qqqb`;p0j7am_&e-Jo|i6*3MxpMpcG%+h8vjo!u()X8v%sc7%G$oa$FW=9TxLrt0#si8F~2UHO#b& zkUCTl!ez5t8m&p%j{=V~s(TynhI0lQ4@HsMfZEN%TDhvZV{^wL)JFac zL@AX5|1hf(Ojt%kNdG{<^6#!mFmb-pJ!H$-M!%l&IXMH^)U5;pm(5igK2h;w4Ez)3 zdK;#WvE0#Ap_$BdS|k?D62n5u;0GR8{e?NVq%TkJQ}KoLCBW8au~%tld;y79&L0cm zJDolTM2|`zJe(#rrOq-ZasU<5^9saizy}eUE?{_dCc`o%RaY2<1UBrcH6^z$w*a z8mk3{_LvLhk-r7@nU9#=i^6>89{SX_|O0C_xLwn-re>oY9IW8PM2ZtrBF2h@Z zc+?`ve8#usA{w&VB9VcqV$^a;2jI48j4{^os5L*n94`Pxk_Zs+QjM@%AGNzSmJj=P zWhpAW3m?)}o-<9F#r*diNa;fW{h%$2V88(icx~u|X0$4(6UeJOLH{U~MI!3)HP)zw zun_*L#Ug&F2l^m0CQg0HnNUYcG`FQquO1_)c`^F%)Fu8Yf?7L?x*?Ei9JoZmK{i_o z-1;=~vz+NY@STa8{RkiD$pF?t1l&fbmXVz^h4*3ylwm>$A;PoyayyKX)k5rk0{<*+ zs4u;2u@uT&E=yHaoi(YVZL90Ao*fK}5nwG@XJMH13jK_rg`WO8esl$TWnyUbFdLz$ z-Gq<_a7~spPIFm_p|#h)TwvW>y`3|LCL0Cx{CPf0Ybc~(!M@{$cQq(8#D!}CpvyI@ zU5WX8xMg(cNxWy9Z~$V`vHLL1 z&0Pi_VC0}iLQI%*xH~&If`dF$NsBnkZ|gg-;kdhs0ikbG55i+>R-x!Pn;|cz9T#e@ zK^2#`otPuC_khl3Vi9kQNwyuiA)tB$D;)Jz_@Yszi(?WXxax&UuA*Xkr4fv%= zAcI$XvlYbZ_ohuNuhZ(O-7~dv_ye;SrI4xvMx{TDLuhjfo)L6dH$?(pGCN*N%Rv_E zmcUt+GeL_VcPc7W>sKFslGV_RV-2cet+d$fG0mVU_UC8$U_?B;r5S>gr^Y=~iYAZU zlxG~QdQ?Z8rh=g019Tk7Yo{#L8j9Q?6S`(7=K&+@N>qp+V5y&DmI%O?{qlPmv!(np z+JxCH8-Ur;8kSk4MIx>&%T6SNv=Qr25yqTkRN9serIITLA50+VAcO&uzIAwZfA5L= zG;2ollx?NT27Rt=*>mN)K8EEtv<6^FGtq*xVCDTD3Pibh?OhBuWvXx;#>W*3sg)-lXq>c_%)K=$U z>+3$@gNjO#z21yu;0%q_@YHlQ*0<0UGd`D~*D{fK3o|!N|k&p?jXF9teT@zI0Za!2< zCZK35a0J6GhTlfJj%|KE=i|kwJ_PBYk+huy61VY^fA?M<$MmNA!N99-czS=uW>l{h zdEr+KRK0wiCsCFy#zxSsouy4J6$VHhFj_S!ka|NnUe(D2EsEms9dvY{hy~0Y;r1*{&IkVtouSMz8gA zdye{G>1#7Z)4s$uTl&zWL8&YxFBLj{0?%47_K zC4nM_a}>=m&(B3;D~0^Se3v`$=p_({-aiBdSbf&LYjw2mwUBC{bJgxq$kfy&U~Vx7 zq>Pw!fkRd0)ZY=JgUzrSzK_|cn%ynco?xDc7_CjwVZ71p}ox> zQDx5md7aE$ps~>G&Dt7F(C+6ff2LoT07PLcc!4A~itt|Vf>zoF?NU%_8Y=}hjGquK zBDlqGxg%;jz-6qj@AV{5y}HBf3h#1QtgN8@#80#TDJFw`$h>H&pD40&k!raHvm$X7 zQ4S=Jfr93Wz7goeY~em&ZS?NkMz}nEWq^Q|K@M{rB4Gj;Ep~R|6x3BMc>C)r2MEcK zwdq6B*%?`JA`nWo{*K0K=vajDMm=$l0WRNCUF}7{o!JARJ9UeRn{w8^GxZa?nEjbu zx{uimIiG^)#8F>Y+MKh}@~vR5O@3yK6(Uy}fsdC?jj{KC#PDn2idI(xsCe&TdRBU} z5pzok9_$M&4Kjd!|3+{Wh`kgrySI%5sBJ6YRW>g#JdhzirNUcOQ&LpCJ_zyE0(-`7 z)@8&Ysf{SSHpH-MmQo9`p^W;#)PuLgwuNz5pLsA2YgNfo6;v6_ibEf1t10h6E-h$c z&^x`GkP9KO=KJ_*IAA)N7{~4_kGchc`E3n9MNo^^bhx5kNHOj%y+wi%9|+xe7LFoR zy(E|pqqVM6rY97ANU8Fgd*3RBgV*k_PxaaoXgvun;|q*J7JXm7j+(e^BZ1ffCbKIF z7^qg(pf+XNhrMZwHw*M!$gdPS-Mp0sSG|+Qre*bMdjgsSE%!|rn3+BOS%AW&+9i*@ zB@wU#M7Jg9<38FDN6IjeW0xjN#8e6B2cE3biv-$;*I@%OqCYt{!y2wMw_y#I0hg=D zjfu0G;E<`;=-}mLiZ)`>!CXdthaRUD#Mpk__FThk($jI1O$cmDS4jC=VUV6#kq!dW z^U?GyX5e}iPa&E~ayGU=KA4{`Yx7{Wo9KUtOcDzDM>sXcZ*z2df7++7ej&Ot1KBUJ zpxSiqrr@~$knk=g9l~mCNXp4@30XT>E005?w|123`n0@;fCj`Qdu!MlgQV-u8sbUb zA{*bHTUqXH?Ipxw(nu|yYFY|^*OQF&q2LPoH}+WlIs;If`%nh6@_$yc>Hxd~kFhGI zujxZUUW0aqn-q8JFFFzL66tOaXQ=kXOSthNG;)kcsF zW9_{mA8kk#PfV598lI(-GWl}I0rE_8pY&`YlVAzd{>oPU;sHzyxpb00!Cs6NcM0-XCzAMEP~-!qQPp%{Jt!B5e-ii)2oq%|vRHS@l!5 z2{qJs26&&TpNwV;Q?P%7JH+upz&|br)#qM`tITJzMUY!4kF`&_e3Aj+y#iJrZTBFj zEWr(Z4d&IxDFFUU8lF-WA{RJ=*qvOE-34>DhB!d#(&vKK(m&wfAweUD`m^=ByP1cT zns$H#14MrS51K(^A{Pj3yo4NbGcqzVNhON>R#oeuXECm7I|?%W%+`NIF}b3khEZsZ z>3%&u;yF>vAJkknFfM3+csHZD_@D{pftEN4Ovpm4Gz{@_=~Fl^WPK*?0-!*w*GC89 z*Co;zyF7^p2bw!|We$sieVPZI32_LAWpgw&TM4(5afq4{K|s~=r;0vc@n>_Vyf&q$ z2S(dWnDV!ww?;;W$c+PBhf^yEcPJl(W-|{(R%%%C+SP3$aIM`$r6OSQVo4KBBv|oa zbfJ-pNiJc`dImF8*^h(S^F^<53-6^p-q{LQG3NwSu+CHOoxwk}G&1Uc?SE{;l?<0> zhTx0PbBTE!5?DZ7Sp_^RMBN-bgwsFfl|jSA%{Q~-PzXj#C2RW^1n_pyVrMy+Blo6q zaLY+i_!-Jxm;CJCeRw5;$e`e;TQw3WY~U$dd!vcqmVT7!}r|+(FhjVfdQc` zm=9w4@e9Zew<-KV0bHBfKB*51k=gbKp}S-O0u;j6?0C>4Q78zIatdp9SI8K()tDSG zsa;iGgFeSjfT9QkYyxOM!KU_bOs(G=G|a(Nk%kZTeeeMtbNW((G1+im%sywO58j78 z4_?p~e`Z5T*^krOHK;i>ZQDdG)gNM}rGAwLT`bB=9Ac*n(DL7>roz-1dBx;iE*SpE z>Fupmk?J**{VMAOhSvVD=^=K?eyp`MS)@%|?zALP3j|K|8u01yqlgvVN3++HqILkB z1O|1rLDr_?kLqmTCLN^Zj~@Uq^*OxmzuPZe_+o2*=|a$Z3lDg{(W8VrudNisUsykq z{0W-+Qk3-V*Tc!kUk_D4e-Rg+>Y1B-iYk83UHXSG|Dz$~9XI&#T^&cxqen5)#TWGU zj{ZR8hL-xgT$!B?@zEV9XsJA4x3|?RIrpZekQIGa)0CVZ^>t|Id-ukd>&HC<@~VA| zfDBcS0^0~*;73?>Q3h*w=^?{r*}`wMBvRA#l?iwE?-jn79LpE=0~7<{Yk zt)NA|jYyhXa{LY2wz%{k=M6au^Hc zUtLD^0^83?gNC$-2wjvXUr=Eik65xFrWEUt^D!BhzVF#02zB9As)bh(sT2l&`tyEw zOR0G;q0+dX_AAx<6K9BX&#&He&43y?IoWM9>$oa8!nOr!4hKOpmz;ZaceZAfi4+DF zOLZF9$Oim&sU(5-&!ib!bq+6ef|n!8FaokdpZthKj;&2oEIN21*F;I+z)c3385lOI zk^PdPHKw(#Du82nbPoxD0^`@46v##iy+wsn@b2NgN+;uV@8HRg0kIEJ4)5g-Z0p%0 zG59?O#z!nUqx=0-RZ%he`SY|#e$2%YKkcD(OG^-zGTRm4WY(AF;r(@7Zb!FdS8D90>u)kwKfHgY`kxD3VV+sZuYEg{%g1B!FI)~b4(x{uSITim+zWuR?V5g# zZBSm_TZBzMt92OouFJ*mK@?KBxin+aKRr$htdxs$r?Sh7pdc)XIT4M)1TOUF7s`LK z83;)Y8iSv)OvR@tnoW7`#MBF_Y%zX47@>rvV|c#>nq?16Gspj&V*HDa^W9cz3D}!) z;Sp%v|Jb8@Vk*UfU_Dxe(f0qxc9~d+Pd;%c?P_W|a)un?wu99lp+uP5sz;Cd32XXK zgP{qFXvT|UO30bPYz%1TfV49srVqF2CpQ)x#7$eTTAns5q*NHDR`J*I7g$&F zDZX=Q2n|0Eu63h+BuslAFpDob*gUlAo9r*G*A@)^*Lu@YOEshs*2AfqBm5Alx)W`O z92e#PGA2oMAc5q>& zAX>?}M+-vkSgmcz2;SP;45%KvqNJ3}Tqh6$FzIFo%+A4|wY7d%f;+V619tNM=&d#S zzIfj^nEFtbXlBr>rZ@T^qtw~0ac}yz7kRaB%$FQA!MrpgIXe08dN_=Hmo(F(uFONb9!se*Z{!V4q-Dnj(0v?1LcB zpCtqtj+ydD)gc!WYLtfHwc8awtG!o(T^=(eB|*O1B1F#Cq+~c`%gw_BteCUaEwL$4 zU|I2Jhdd+iPnbnAKS=xA;S9gk(ijE5 zMNU7-h%+18t2A#x6+8E(EY>EuPn0gF>Y57h?)c3$6mvkeOIbsw!{0eus#{jFq>aN*kUL%V}ib;=p)ja{JU*2cYe96e9RdYwD2~>iv+3=p&@};ZD%11 z0jr9zdKdbyo;daaosZ&GX41j6>Ysiv_p2@p=aV)*Hs76}Zw@&y9@*P!5lh|{7Vxfx z&3^jpOQ>pTX^T5dk-fEnp)$B(hSel(FjX*lRR)i)CH4|_{RA?qnXTB~ddBxdo0%6o zYoZ@nQ(-+tQMzxHjroNh+>qe+k!^9eEl@pkL!|Rh=e!W1RMQ9yt;dgkf4QF5#7$=)oN{BLJ%;Ya)v zo<+WixetFXjxk4Cdf4XGhZFz7sB2aP8MYp|cUt|>2eJ|axF#4T|GObxGT=aHFhx{- z?mdYpR^;G1Hk`dTl>MtLI9zerHtU*Ae4OA&sam?bTIh>w(E_Wx2KM%f4>cmAb4nI1 zV$;+|M!gqO=T5xcG4QCec~%-y@mQ=rdc$7cPJ*XoTxRqMcaGWDXP>%ub3SDE`ILG` zt}LA2SWh7I?k~H{d@VT3g9K9)QLe2ZF(6JMrIXZIhdoJpFA9V|U6vy8Doc4(EO1m_Td;C$mFRQ&sq?CB zE?x!AEBB#`b6oAbwOZ4Ezdh%y?RcOHa*xD&?pn>R9B96dJt+hB*b<#-Ok7*vx_fg; zO=9?*pWv}Z4dT<{}SCXpEb z-r!R6*^u3~v)u37{OZP*8#1pJ{LQEe$#uUiO^-Vw?hs$qZr;DyeEbNU8#lNY2GYQVETpA8;g713Mx$Q^3%?sjQn=<+eODD#Mh2$*z&#@}oC@xw$u)02*!QnjR+muEtlzY45?wc{^O#fr@a&<7E%@8G!!8fkYOI-asm5E0W4dei zv&uxLk5jL&A2*T?8~J%o?XsS_)U&W_RlhBt30?5#Jia@>5G=(X=p}fn!MB0;`k;OE z!y|8s#Qr7mHa|;gaC&Aml7bNZK5}`(+BH5Qjc|;8_c>=qg6pK@E19TBXye@@0jIbn ze_VJgf1y!K>)n?I>XYLwdZLxb?1Nukzj^7`mtp6`(1r5&yF4%CkH^q^KNAIge=*z^JG&^IZ?hBui{MqU6ma)y7&gnbA{0~ z$*T#A*|$Eo>3wI{`_GS7OIl*Zk&0e z_||dWejTXZ(?)I|mxmrMxA*Q13!vM>89IR{h!4sPj>2_D^u8Xw46o<5)G@ojoAW|E zy=7T3NdXlq^7?b=t}Kt)2S;o#U)wVkuUh3EcysmB z!v}s4;iKn98X(ua_d}&Eqrb#G7q-c^T<}sMUezZheGhFieA)5yV)*Kx(O^AyaUU=@4%Q3|pA3}3p*h)T0jq7pz-1gG`VV&%4Wv}+* zCI)BB73^o{T*9;i&`ha|8xa#nWH=ppLh@TU6$R!j?~g7pf7CuOj=PmVb;~#FOy=<| zr(&t`>LWf}?#e$Tn==#FE`Rkh@zo5KP=bZ;RB$V4yF15cb3D0n6#VWiCf-!Wdbl&; zJ&{KurtMlfEWZ4F-iu4g#m%!Ef27xRQ^v1*>#0QDx_sy3Zuk8O%R?p2m`?-O>@>qp zyw~Koas1OO-0@Tc#I1-&k7c44UP(S}b1Y44uQ1ljm%Ex3A9*Z1^l3cnf)nk&O)c6o zRc}1Djr{S;QzgagQ|A*f3q}vGs^hbRNB-k7{!IMR9Dc5(ML+Jw@KXzjRGIP>&$EEu znM?9#)(Y(l#&iNBJZ{?CU%S!^k>(N;8GW9hcFs-8Qp?q-gBqNhT4x5y(Uxwd0>pb}810(3vg$i7c3<$7RDFmqt>_nu{tyzu7kw}hRZ+Mv-$KF7ul*?)e895`d9r_^UW={&$TftWtWtfaAW-otFYjrmpRLCoWy9YE z6FW~rB_qF_>u}Rd8awgvO@CxOb;c(UyfD_cE{jEZjMxsmGA(_DyqOf2eFGW#?@otF z^kRES;$Tj+)umwb2)a@jbn#a7t+u?(F$)IOyokEi#)IA4}(1DRcS3Vrom z-nyFqO+lm>wffWO^|F7~`r&IjYI2qc{n+2}ulD4}T+1&C)%`sGm+wSGb1mz?wZ&Vn z&q^K zebYg)D`DTTHb7;|Md%$F$c6>(*ICwY=t%Zu3uL6?efV(Bo5_+XrZKeOyHm=OtKOfk zxLnUacQYr~(*TtbJ+ff{KBcyy7yC*)w_S<*nMJ&VV#$y2$p1_Z6gq_En;S646V)Mt zAN-Zw^p1SLaL%;%LHmiuOODGIEFXv!Ja(76%5g>Y^G8^GvbF2Np5){mx${v1J&ig=wza3GGI5j$@RTlJ(_e&pYXZ7==tBb;n_=9E9o(aGg# z)SmIp&4c1^u4d<7v?M+%KML2Aj=$OTD~>AZ5G5<~_B&4G`-AoNkq_vn>@k%pt%5sk zR!cxT8MD64#H%EK0PKdHZr?@Ar~cMIQK49X(=y3>bL0#)od{_-ugDzdj?4+Dd$xG_ zfm;;(PX5W&jjcZ(?^Nf(iah)cZ|we*zGz6f=Eql=8iCk;@VxlK^ks{5)eCnzr3PK? zz=@tH_L(#ZwE$mi_S4Qz89Q_JW-;lckFRu|=pA)Du63pOQWbvQSHI$6@O@4GRM9<& zbE&7!U3&v`RF!WCxrG7yE?0Kf@2r-Pb9&#@+m}AZUS{i$Z+73fX(n)r>K7=Uty?TQb7l$o zJ@;0{e`SX#cv3{kzI)eX==jCR{Apg-jS>CpZQoQ8 zb<*%-q$O;Z?C2Vc94I6Y6}}JxVjfX(GdRQ@TSd-P-;D63%6<4cfB;el^Z>9 zTDKancly-pCWBY$X#(f?^WC(rj+j`A_un&-%D=*?A8==+g{Hoy$}Gq`x-R1Dy0&4e z)ak)NVt<6YAa$4A^H6}c;C zA#4TyjgQ`)EU|LjQ4{`jakf`fGy&eg%mWwiBkoB|E5 z8p}zdkz){<*Qhn8)IoAk!vT#w@eBBqS6&#jML)VF$)WQiywAyS!OHy0qn4jLt}Q=j zWE0}wxWLc+7~Eu((L+A2yR?2eUG0J{Sao8IsF+`%fp#kwPQ2h@1CMrLm;n!7gIzb+NZllRN8ar+TlKd~N+!Lu4|Oo5wVpn0p&B_WoyP-Z|u5S5cL)*#gJ3olw&f zj~cd=E62k4A$iRE032nN_~rUZgreGyR=WhnjUytKoF=v35Bdd_f zMI4i9{)HqVIbyYb{IMYeIDxETGUIgcShib&p_;we>8d~ma7y3(`jbjl+7;s5Qyn*_ zh6Kl2vG&}mAM;+*BlQXlf!e}$V2RlVk>#|S1|AwElF+yhU;G(3BRNSRic82aY#1cZ zIeA`<4H(W*^9A1E7Np-Zqx#IW0pS_;SkAs-au;wK`8(5wefWa}Nd$+V)YS21)ceJz zE|hhveLZG0W)$1ngw-t`CA{W#Mg=_6HTJ5Ddoxt#YJD=y^8>GpnyF=C*}&>wu5`X& zW7U)b{^8sb^HW<%-yx165;sqvzK#FWyLp0;PgL#CF-uh&<)C~X=)epwb1G>w-RvX$ z4U7ts+(OePza0PVZJfVcUuz()EcGNz^;Mb*7xj7Ox!l6X@3^>^htp~%y>(#Xek$&~=!@+3+Dj#-Jey$n__RKk@!NAV!pBRM0^z_{uPd0R(i`f z&xsj=5l$_T0hO)Z7zZIc<~fcZ4L;s?I0pLvRAin^>mIZawugBLov?e7VD-SsSqw~g z-S#fVI?`@9zRFJSPTH$&@o`rXt>=GFTNVr`k(NZHVl$GXy1vwYdU#3f`b`LznnwIj zp#$!i!HZVMLQa=OAI+)N_`E;CoRfS1=cZ@|zvAgLkGg+*j{kXkH@JPU&$LA5Bpk zj=mI?(j zUVHGX%F77|_$7tc@se^MKbCq$^r7PE)ia`&t|vW}mbNAmjJ&ifUV45ldC59bY8?V$ zYoGs(r}(WL036Z%wy!y<#VMI{A&G*X?Wf*ao-dZ<(b^R>)u-!JAag zzh;bs*Ae^67nbj%;`8F3_|zYH;GlTqzQoZ!|=+dRtc z=i&$v3|r&XGavjO#`=>`cJ12r5)-jlnVVKcw`9C*&(=8>OR=o`JyOUXx|}B!yZ^yn zeQA_9RPB!c`b4I@ySU(bS_g73Mx*;2?UMOjyxpxTJ7-jB?4t?|$i(meetGqdhWoJd zjIz?Mz1l41K%3clmg&iB>~d=L%g?vKB9EmHRpi;}#Bg6len&R{GwS`rGz-N9hW2f7 zBSOFad+{ve{kZX)lll^wd;Fch6x5jK??irPx=0wl!A>K}tj7CP{;YXaB=Y8aa9E1+ z8O1nE9?>sZdi=MdNz=0I(vOmNEj3~u(9Ej$hA9Qu)dyD6f~tcG^9Ylu@xOM@kBx+0 z!1X_7c-5YHDGg#cUsKobpMQK`TsSZN<-^;qd2*6pZJs!rJ&eCs^7H$zpZ4jIWrkL) zG!5Q-ao*(Iky#8n^ys*$kmkrav--X9Y-P*?nJTSzla-!DD=rhBL$KcKZ_ym&82i!4 zabz+)Q?K*&l*&^7ko511b+_9{F%#B-BrNMFOq&z~)hvgayI~4Pz&1HKmrF}`Gmnnv zp6QS15liL#ON*k|O_Hvh(tEP1p2mdU7=KMS-AQIS&`FU8KbHE@qvzkJ3`d`1b2 zu=u4IVm8|nza;$kMygxsd4)5iPYEuAE%~99N+plS4&;)gB@PnqJ&FTCbybr?7LF`gBCrbk8J> z@4K?{l)7}oMuJV+7ps={d%@qhA0*1@f8Q&v#vl2O;mV(nt#!$;mCH>Jb#P|{lOX^r}nK1$XS_Nk5+4r zU*wf4X?cNA=6G-rBrhOIsj)mDCCEx3MnTv4qwe^8t~NWvpbbnCcc^(P#xd;k z8U0`IBi$R{bD5Zqei>W$tIzj+Gc^3|KQQy1)s?o#1tc3pk*Eaf{bW@SCOcYs>Pd2xC z&~sc!=h#u=wUIEV*E_Xl)sH;+J`_pVl)-221rTWwf+t9pVZHMLuTCo$`uVckzmaT; zc3G=UAqU%ifEAMMUTz8afpC)t$umTeK0vAnu!5mSU9iARTah<=tht7xLFAi6sP?da zsJ2YT(Su@34I+!RvJX&qJvysASmq)1LI7tC+UIaRf;oHK_J+OUf8%nvIfu2LvmX|o zK)&;aGO*io^GbR_S;&n=!L1!kaaN^!0O19} zF)p3?7w?P{s%KTB>*~weY_~yM+QH**J_Imyh^9Owp05RUAmd*h_b*~=(2`dnI{lDvqNkxeh&4yD+z;1sL z6c~e{FLqiEE$0frbVQ0yR^fAtY*R2JMSXphqx&o7tey&>rfnMg;c(Aj#&-MZ7*M3T zc=%FB`=yUo=Dt}3_!s2kd z7WIahl-muTg?nVhPs!kyIzC!__s$%DL*kk|m*PqI?10Aa^$qeIphl@q#SuM0X;sESF6W4vitFE~sQT(xZ5#h4e z&!75tX9@o%6`m5Ev+EB}lrh1RjTOZXpgvos2A-jxrWEhJOnTj%pT4-5p;|$^h#n92 z@$OGOj;#rq!mr=Ys5_xTfhoSU<1QSFIS2bD`_%Hh)b6rBI<7v3ww`LPc_M$pA%0?A z=TcMVm!(@qzg)a)1oad+dva4H54@^@w~V9qZa#zQRRiy&AJOuqoXIJ-X(g}U8y%0m zonyXyGa=q|-VI~SrI{FcG)C#v@8a6}T50KHysc@EKeQMqtoEGrL0LNWZlWFBxmUK{ z^lpO+{bg#jre{KEJLPrYh}Bws+}_AcYO*GM*9O?$X$-6TtTQ-LCnCZ+mGD(dH;6+l#%VbEB@R7-x7^-4Q4%Ghe*g)Ws~-_^g1_hI zKj257ICq)5C?1A&Sna=ysGH2}_oQAkv595gwb4mj$UEau6IQX?Cbr+YFF&1Udh4UWLOMr5~!24Vo#z&H8pUyb$W`9S{1@<p*Xi_sCdo z%LbR5U$%Um7uvM@oYg`6Z0=vVg5JBQIDkZ_K|8^W)LU~76L*FDf8{@2N_aDLNG7rD_j0!s=5@tn;ko7o=6~ zN2%nrQ*~(0JH(BzSvKWe#e1;~n00P<6JdAugaQKMRC(dx2?s@!dr z2}2Vy>OC*_WaHrD?O_r%wpabQ5?lm=FW>RwV&6Dq$vy78ug!Wf&QcR@1R0|(6W@>? zxc#Z?y4i=n`jioiI>F{qIritQ$Mxz(PEptyActIM33$ol=m(UDfG7K0nr-ii_|v17F z+alZjV|Uyg{h2$U4#AVyZ`z#Ld8&gahx?!pYtt4=HEsPptxbQgxZDo9d8(lXYNrskSY|=R( z5g+%gIQaw=&Nxpjb{6qr&tzGuzWRzs+=JTNUL0Gr2dif#FokmP-a$rj&pgBI%eaX6 zqG#=h5LfdqpJ2!UTId0HDi>C=i(50Im?yn=C$E-YAeBu=R(o?G{7*o%wdn^JEbx04 zW_MxQ7lDZKr*exyVqy8EXQw!Gw6-?g8&u3vf(a%g=8l0!khMsHDeW}QMQ`CzAw4U% z1Iz8s3wsJLoUKjAg+IVU9V-|+6<8SrBlyc`%S~qhndtGXtUiyuD45c=|E+g3TYgrv z6IJ;S+kCXVT#y=DUN(g}0r^@5p@;58Fmh$tppoqY>u?MFrl6}29)L>alBUz3$tGG` z`{6?1dTGMDULa6LkXUD$neDN-;L%0EFRiVA1@QtfF!p&D!$w5zSPB|4&ZQtX*jihC z`uAped~q3$g$tcG&A1Q!cJRu_7-xLI~D;(m|-uRGBKmzm*S+>mMN z7uW+{x%BNk6mhBGO-HqndQhM=aYN8%)mU%nW_~Lf86F3?bPF|!6l7oCEqET(XWY%2 zZB9Lk#PTrvNDS}XFC~Wk6HUd@;3Ef7GI@W)%A-6?&Ij)2g% zzN{B6H~fgL&zMcg_=?RQ#UugwILN z!B}X*dw6|w5sd?nhq11~0p96mb`2_$M%i>37O7;tlz$=jaMsBr&g2?HDOY$7Z>L*F z`VrGTjtQoli$Qf_ZDMV;-*9Q z_NFtXQX^nw?8Y$&PbwI&n(c>E4#ie{J$(-kj@<+i$`6Ym1;~v=P$bHQZ^`2FbgI0K z%|XPREw-?yYBm*dtc~ymA44r@5lrBL+ejxwZtD6`Zf41=sCAh*s9+NTZqO4GkddzV zB$pgHsKm8pxkT?sZuBhC&2mW27k*Dg(tYCNUbH7;TnNRUOn8jce+%WyT!g3+QX{B! z^Ny*Sv`)BcGm|7$60m%z<19+^zSGD|5uy;>)hrD*UI65nOuKMBtT&lYVu!3EdFK)0GC|q`TrhH;IjGt z6!#&OoSJPh}UIbuPLH>aUliN%Wh15fy8QLlC_Ml;43$1fDJ=TR9^JFCHyJ~uk zR~71+rIW-z4?2*={YjpTLIn1}p>4@{7@JP8wIsJ>defx*2IK!`50)unMxNn4E&{92 z`XJv;fvHOo`Lo_b){8m0ao-QUlR@CjcfLS(G%M#BE%=G$>zrZrHpfJ2^8YmtO+mSp zaFipASi(`UV9sCDzzUo|IwfK#>IyON=SdK{iJlEdfv6|TP@Pm%7m?DS4=T#XGE6cE zOe+?68iZ>m`3yS>+*rp{n#~@zYlXcuPEF28SKSnA52aM}bT)CV7^MQXp`V3k?w8Y* z3RPhn9|t~0P#5g?luphFVQl9{w!))sfJ6}#bSA)s*I-X|RRry=R1Y7zY{4Bx?gh~Q zd|o>1*A^_hMnwjpm~b4g!fQR|3ZV%Nqvm3)Y(n(3yd+ESVpqa@Mb1P<5~ac<1~^R< z7X?kyn$4r?pmriYw+AdqRzTm0q#XZNEhMhqgbdenaPuyG*Cod(MQy4S4qYP+lVZ15 z&cSBKdQ&`)a%eX9I>aG0=Ys16k=KQKM1sx0f@kyi?O|i=Az0&Y02_ZkYD^~i8q7HN zzskqT^!W6j*nw;ig?xmLRe9*SX>u?3r))o^QCYtCQUD)HJRm@=s9-({qk9t^8%Br? zhW&Lh>>M#{5bW>bHy8iS=3lof;~M-IkNYX(zn!&a{nx$x8vM7xe;fR_!G9b4x50n^ zHu$eXTQkge{(7-y2^iPm=*=ZyZuNCN6f9SLMTIqA%E-3TiOwrmia|aW3B)%j)t=MG ze-N=FS`o+7c)(ucgq6X-iVxk-LwRw?`4s;`pR&Z><2+a|6kB39UN)vF%tVp2M0~CQ z8^SAS(q4t@i1@YywZW%PGMGE!Be01PK?Ww!lGD#-_wIm4i4-}Jb3>3q4f?`{9Et!A z0~tKP#Zx!9f)QAsvoKFQ6beKsVHxfqqSFepW+!y4w!kGe2d7s!5h+6ih9(MKJOBfj zOv~Q_U{*W_(aRgL)F3Aj)NnbbX*%dy8TS!WaI2v^CVF_%LcIc;$V~}d!S=C5 z(-T~U@5Baph{5~oB~UlUfl!T`}^UIPJ=aW=p;vpJSnT{GWofoWcJgUo#`WG=&U8ep#Z<-fW3Up^1JRTxLLo$UQ#C>(*ObyG2W#f>Fp~&M@?K0DOoFSfb~6 z?i9}sBsU9>);^-MjUDq_3Oz>7?badAtP%JUONM`90;g2KYn&Rp-o5QCQ zhQaSIU6^{0gA4c@!6!sc5hH+U6`P?S^={p$;yQXL+L$b$T{br^RzCNNm>~CzS^zWQB4`heAdn_d z98CdrP*f0wp1Q+B>>-s3z<3Kf;fUKIPaIW;*qn_GDVQF1S`5BF;Z)aZ zOsxF7ZtIxGO9bkU?{KL7{?MnAZCyJZXof^i}U*;_t5TJ9fjzga%{Y5VZ!{y%Fh5pk0U zY2f=jrNy2=v;a>VDiTa+u`$RyexxebV0jYD%e^Lnd20yfJ#$u8oz*sidFyK%>zxM7 zYkoKQ&Bg!B;mIw^xCa00tUOz-#D80F&i}iYUxWWO_+PXBuUY@spnnbe*PwrQgZ}AH zASF1bxQg+Xi~q{RYv;eSA*l_<$CcGo2)qnIPnqkv{sNclu%MsEEjj~`M_xdo;}9)_ zVUqw~GD;^lJIqbknV#FQNPGfUgJ0DqB!0`60P%!xK~R*F&|r3m4?Q zK741h`a0377Fw*Mm*5z+tVN0NsB(Eef%f*XBTqg=fvYw?f<)@T1Dd-(^|ZzLs&VfabdyNKhC&jlxs{qjJ0*JEN&qx!1=Ba>iT`LRbT&;YzpS z*4U|DCN==VxU^8PA{^L)?wn`>6WTYMGCzoTfQ_4i)rY>$j?n9ZwK{{g9P<&X0B*p` zI2eOlAQaUdxWSdk(UEOXTunW2u{n$KGC@RNqNEqXQ;G+ghz}%yY77Beh8R$wxCI#! z!W*=OxN;2jGYCBqMF^MR^2B(`W0%ldxJ9gkmJ$LJk*sC#N6p$tDl>><0SYc~Ijfdt zh#S)RRWMSVhR`kYssQOF=DD#j>w@cIX&omXIny%7T!gC_t1%JDCWy!@cuU~?BT7&q zLK7}G71Oavxzb^G0s|u9aO_MGA`8rg0ns!HFf-I2+n7d3Koz=X2xNtq65do@j!IID zrvgu%G=Z;eHV8ng{-3=sfrs+@{vT2?T4<4|JftFH-zha1jAce+iwa{5Mq`GVu_f^- zl~7uwluF4*qD4i~MoEj(BBfH=q=-t1i2nC^W-*r3=llJ9KfnL)`}4fM-#%vMdG0;; z+;h)8=lz^}4wFNrko&=&{lG5rU=WrN#5M4D3|bg$`zhcBVTGC*NI63|29!k$Lqv?P z9(XI40`r6|fX-N&+`(B0I5!(+qA3io=&8dPOTYEg%MVAvq`z-j{m4Btqn1q~KX zjDa0Eo_awnd3Z&`yaJ;G{|#dLa$_$s@M{vF-hm_phr+rG{>m2)w5Iul(!k$rIlyK>d!#<43uSGCJE!(PDCqbH!KO) z8!T%@BoS~HcuOKreh5Se=j4n9pK%V*A{QL|3Ga#{@xwu#z}MDT5|-eM$2vilIP@YH ztUb7o1Ucg!i5LjC*wKDAp4+$u-Wl9Obb;^={l3INc!Gt!3tZ!k+oV0-0enB(g2z=X zmoY>P8Z;o>9b`dtz>zHQSbMz3Ah$zUOB^6*zz;yHxHy2vopB@wJOLgZ(cBgX21Z2V zfT1I}4NtHl4SZSy=7j~GWZ^<^a-NMvgoOZTfUx$~E)H0T=mcS1oQWhHGFYM$(h&jq z0u8#dAUe8}@YXiYV5FqpzAT6YC%h$&1gLR>z^#tp^K2}aNv=4&6XZxFff>N!oe=ht zaCle1FT6!BeMD|kI42C+5=$U*dv|drVFm4B&GGhlOTZMsakx1L9G=MKA_3gy3>enu zL4*){tOcG(K&T?Rpm8wUEQlo1Y+UcS!Ju56i12>|0@d5~AoM{%svK}m4n&P%$iENd zFAT*Zpua8;^w-hU(So#%;0Rt_{bA65`1)(t(D?rVB=BGAV`%(e$52ndAO5cce;CI9 z|A}jZBf)wsS`J>+WAQeYB=Fx@`2XUf;9vWtU(-=2jl*DLaE^G~9339vf_vOys@qV= zF^49TY}UpqE>uyPj$Megr0+YV7Oy6g*Y&Qa)<3c3bn(&R*u{&TlivDZ6P&T$iu>2? z5;Hd!ej|oG5*Vp=g(%8 z{0QwBFS254k43EKx*t**J6fBVl@mw*pG5+$u9aD=X{5g`TSlF)7qXN3&W>w_sJH z;z_ou)Fkcl6wR~YB{yVcU!~~SUdcVvJcoF;aqaYsJVvE4WsIV-+03|`exJ)X%71Qc zJ$LTh%IIi2TU(No)8)&Tw_B%BH|1~3nz;%mE^R(7hP17y;t7r;iaK#qO4M8n<@T(? zI6GxTu(=e9B-bt{QYJ1-5vAUUE!%sx1uh=}~?e0Z_-^XJ5b zgiDt%Pj9#w-SxG#m1UcA#piB-Uh=%w_)>50Byy6xyu7ZiZuj@^onPKfoHXfmLqm4e zyZfdKBlqmm+G9RnFs@G|qR6iVvJYN>;(j!zMX{+#1@ zEXjiWB{Vd&;r71v_I9GJty0{n!ooMNUt^Y@(V90eowVZW^zf9Fl-I9c*RE(f(kP)~ zS>4pu)6*kMIq!MQv(@k9w@Yg!{Z2lj8yM>AZ=5lIMd|91fk|qViE5W8%GG$@FmBiy zw|lqxg73jST_4!Qy?KZ7=!G7tsJEP5AA{?(DM~G8H6!2LTzn+e@rIOW($luOHDZni zQFy#W`QjJKs95dF8#f*ohvx3s;fBLqxu4_Ia5Jsy{{1pzK(5Iz&cmi^wM>im zBT(f5w|3>#{a6(f8L5vF-HZ}Pi9Yu`nRWbQAesEl&1*W*CO)F8nHK(ZyNxR4=Jc@) zF-eo)=L=n2suMLYsL1rZxV&Cp?p8kKs*JkFq=^&R?`!fm${RidoC5QRa`f_A;9Y{! ze(>>QaBj7Sv$LM>H7Wh^i)4;<(j7H@KVh@0#!fSGG?u+W?Cxwk%XxRNv#m+m{L`mT zpBru)%8m)ko8Y|CVr52(^y=lymnf_Vcy)A{zx2HcFUOVy`OiZ^s5q(e#g~m=*Sp-@ z)Ai_8a$WI?Hq6F#TII{`W{j4|I7few=kDO(fWFY!*!Z>OscCpi?arOD<%>N$9+$2e z-Tt92ru}Jnd(*=Y?;oAKyl$*h*_gyDtataa6fM@(w5giaOurJAjz+!Tq)-_d7}yvu zJ=4R(gT-b`N=j~@VL9UL#0o1qL0m(Vxy!8kb8YPeeCz&{MYbaE^RFAnTgXz>%O4jk z{}Ebm+nuUDUT%!s6I972vH7#s&6Qk3l9QE{m6I!`R-_geo1k`Tkyn>`OSR6*a$d=P zStgNNZ2}fVUS1x%p;F>PNXN$)85tQ{w@%0peIMMMz=S4yCtX<+s2Z>Rrnz}O>-Dv+ zmb1j{Dplg-DO0?PSR*O)@Oj=z9!rjd*PS;rJng)7B{hvzIX(Z_3{i@GYLV5ei~hu~ zGn46)PQ6GUQB#rqy8Ysh=+l{=kIrRy9NcXXboj`T=_Z^*gzV)30oQKdRxl0A+Zhxb z{PEMPtLicpJGCjk?$1uqoK~&sd3HWZLQ&Vha^8wB0fB*sOYXM?EJ?7;NOC&j0>zD+ zF|VWTq1VF)57w<;9~BjqxKFG-;?tEqU@6#Ue%elT58gelZWJm>8-LH=-%Dc5m+88G zsH|y}uF$GmV#l2V9A;Mmp|!BE7(2=$BBJBLktLa#nO$F-B@P`!n@xjCKw zK26s@?0wDM2M2S1~bhx>^=qe>DcuQxvJ zoiu%_&3fkZ^odH<4-E3$*`la8m8^9w{#c*c@7}$eI(4dMc($XVF zjj1`!R46wxF?n1EB)a9Pwzf7*dCbvV8}Xc6;*^x5bM)s)!4;%V$J9 z7tz$ze2ZV6JpIX-@#B+|lN+Xqmu}zgP_g5KR+^Z0u~zI?>%hRrsT$K~;cFO5PiK!* zWl5U9{rKYY+O=yn&wtr^?3gBsUUwn-Rr$vK`}c3zvPIYLW=%c?JQV2c>~5gXpTk=s~~-!>bE!{yv2X6qeqZaO;NGw6j>wjN6STlcjs_tvemN*cQ< z@wD#FyRTm_y>&fjh5;r{n|vr>J;NIt=3$0fTFg;ZR4je?&@Gi(UX$m3a_iQu7dji& zwq4g-^}XXlbk{1doKYX2uNe<3pkVdoZ_=0R?E=bMV&d$wva*^-!INI?!06^~Pgvmo z=Lvh4AI%47H(TPQZtpdAk|@!-aP*e7xajfMuboZDy(t#Y*qV}dA{bTj@ZsqT7iKss z-Dy5u=ecBw+D9|yvvVCC5h$q>f9gcG$@v>dEx4hxjat4_s#=7C!7t8KB>Yg8pd?98 zxG9zAdic(WdAf;*H_FVKwQ==!uki<@%u#u#PTdVbE%V0)=I@dsd3s(5dQuqm;k+RP zdDk2#0}1=~?ORAl$O#N3sk^&-^tfp|_w0!VS^(%-D;%y!?oh&Q$aZS^LUGsBKd&qA zNHs{^t}io1{+MUbkt0DtK?NR|NvKmEK3V~*SC8rLj2tifTwz9wyz~oytpKS&|Ff6O zj?`$*KUJD$&srZePwZrx$*M3yR2KgR^p{<*TR4evNLnHx74~H_q%m{->SJI=7@3M2+tq-%v@hbN1bH=s!T9>= z6D=U11FTCRToE76xA*v%TgH<{q2itw8Z2MYnb!Wyl=Z?~6@_{$u86vH_5N7soO22Z zrHd-NvR2c}?9CQy#;30j=2B4A3@NMlb)%}Dm#WR3yGu%GnZ@Mtcx|@F zLp`KV>KdR*fFe4OnYm{5>asub?gns7o)&?~vn=6BmTIH;AcAm6V~56$dRGZ9-D7a(=-{sXzw%mwZBI~t-_ zo>Eoazcr5PUW1K!gic{;YC0@h)SXXR8~3*C)t+ee@}2A|<|^IDFK@-I*^Uiiu|9@w z5r*X*FoV?9qhG9@@@2*RtQ090FkgVBx$U~Mr)SS4NzMBYAMQv^UAJ!CsF5R83EtGZ zRNqMp+G{KG^6bR%vQ1+9-WlYby&`EIuPxb-x`eUeTUVVwAzd~r$#xN>Wi@hS=;igt z0vR%28whD@jLLUvH)UY|$R^BhZpsa<71?uVL`p%jHe>nnii!#~4Gq5}b+EliwYHr7 z;9104E9Ijn*Z%&|#0e8vx97J5O1z3WIY8qBabI+Nd^5wP_QC80-Cw?bdbObPMzMXo zp}B|cyRoHaD5%^hYm(vyseQWs33D7gPIBHQtEK=O8KY@J)M(cT{r&e z6gctpevh6CFTc*tLfzt{3YXANjAMGfuNx~bOF4l7JNE58rocOS0oZh{qC#@a7(Ka- zV3{SGbsoZ0FfVq09Wj2MR=^#|J$3sU=hQSSi%m1smz@fDbtN$?E+RzZ{fG0DYi5Rx zaC|&r;>1G6)9;^NjYdb>k6HYFP1J{{AD@QL(UV({yM4v+@kZu0TaQ;i?r5zz4O(qZ zDa@@}HYe67ba`OlvzQ;<*SF0{R#*!Z7Huvx`ds zSX5U+feBdzl#qtUDHVPF$*9V7V>VDyg@uL1#l^GiQsXbXhXjr&ITq9XYR+J-M}~ZKPsJCY-l-z)mp3Y~^B_mFmX$_=q=Y z{*&G(Vow!ZXTQn&@p@Yfe(U%w!=25+D5+2LP^c24>~ts8Che`tN_o?hv~96lSDO8p zM|pGe%b&9)6&Jf-Out;$6V|ogf=JjYb=!D*y`QZ^dc^^?$|EU-*IByd0ng6eugc!H zs^^>b>g`4OD>=JHPB&W_QIV<+3;`0DkhRjB_SGOF5}(rg=j@Z!fufs5^kkRsk0vYPFP*4O zPc;bW`ihJ0k}I23wqlC-ts8THyjU-pmNpBAYqRx!0G80iIaas!?VF@f=N7Po;Bro5 zLP=rjJ8Ok#XP{~$KKabL-*CSD8IX>%pDRr#uTiNPlkQXI;EVPj!f0o_ay#s7aizCkL+p%LE>A@ZE8@G>vp|pnA)yqsunW?OJkeVbKt1Ru# zn5sW_MSF|&2+=P-N~jDO7in`>wV>tOq(wC~H#XZH_gL$Y^-AScrS!rt)ejyNk}t1& z|NcF&JB}Ye{{B7P{Mrd>g=PA-70rp`UDbBaH;ul%cPYNL=ta#{lukqIrL{AAKCZ`a z*nr(6yXa#_cY8xj*OU2c*G`U$*r4lr$NN%T$Fj3C?!JqcT3_PFn4r8!W&cXNc)6@m zyULqN36cB7M<3fW*VlpzxD7yKUAuNI$0xaX<2U0=Rr8qVmFrIcet zMAqFlTcXAEJP<6QGS8AW=fWJZ#E;wj_de=*mz@?Tt1?o4?5+=InXec8C~{Q4885DY z^K$C65O;BLseki^uv6;~se3QR1^bK*{c=0!?%@v9sPQwVO`Mon9az18Ut`Q#?WT=} zYTclOVLHxdLyjZ7v>NJva?LCqLe6_F??J%Xl_kiVe`wav*fiOJQ)*c*m8fQx0%^4z&|^@M7~E( z@U}lr#%t7Hyd*oPg5LW2?HfO1UEO_BWI2(f(9z?TPBXx)ytcW=d}DZX#+&HQFFCon zreKi+8~#3rg|4AZK{=90Tlenm0WQY0`74|w3QA_LNEnq(+-D%S@lx%dH*Xb6ol$;~ zknkqU&QJuZG+l09+$H&<6bDiv#;#?UyjzqGVeRaLd1pkTp|?`&6B8AWAf zWy|I(-Ho}&fT0Ey_n$QnCq0f&``+j#pFBfdxh!~1eRPsGh4T~4R76%_V$c6L5~{P^{2--4#=GeuSM z%CBC9w>aSBXv=K`PMGPc??$LEAL_hvtM{5kcY=jK-mD|T^O)O4Pn+(gTR%SZ+SgUJ zZrsTryX!-?Bx-|F-M0Gmcg^XM@tEn%7EZ-Mx#w zyng+n8+)eDxme~>R$e}Cs!rJ^L!-#dC{>$xM+*yG?<~x&db+Bs`D(I4aza8e@O!84 zSYUo=e`(6D&eHmdHgQ_9uf+!w?=ea46DO{@y?5E4cR83iqmlb9@DqAotgrp{xk~$i zZh6qrmBvb!e%#NYVzHh{Aul-Wg!$I@Ocah+xp?m$=Q5@dutK z*okHn(ho5(&s4@e34dnH`No>8_*gzE`bos=>)SH*(iRMmNR=8Q#BtAGk_mrkmWa{0MzXIdEWI zN{WkBW|kXCO9Goxc+{O;_wq`PQd;hEF~>rJ$KyFylcy|en)v3~v)6$1)mMxeqNeY2 zs_zlxU)^6MncyKcY0|-T_245PN1)VPry0oY7TK^xlgtu)4HM_s z+S!$^o!7Vtm0(W`Psynwyifg69GczOBrm>Yh0?CtiBcl-WD>_*tm!-^X+QfBc~(K< z!F|!GBaa&Xu{c8-xgI@wbhPuswB2D7(=qrOpZ#8|B1bK}y!cq;8B47-@t5M7>^4tn z0JP0S6`BT2rJx?SHQg>Oa9_Lk#TVSmijIyBV4<%`eBHW9!rNfCy!_MK*-zEJe7?Q5 z;kKL7!R90Nn#V_=<`7+%5~n0AT(snghoj@@h41~!jJ@-UI5|Miiypte>Ztd}=cTT> z1^f4xzB{HNkrBK%Jw1K=g70^Z`mM2`pkkR9Z;i@OsyI1kQLRV|>R@-5rfzv{p2O|V zKW19n1}@(yYqu#{{L#lJO!m^YjE@cR@$vN)I}*S9TfdDMy|jpR1-P;YLy7`t;?Lw< zKNr=W^{jpYszlb>hTXFC+aDv`N{*zwMAKVGqDng3{DYLF!dFVihTYzKsk74{WYSqt z^Y~Klw+XUyJ$7v0je_KfR)6Wrd2ARTB23P;rz**_6Ux?C%)StzC!d2|wCnA5G?uiDld6k~ zjGR1al9A87r{hquBSwz{3f#)lvS!wU8hy37fghF2;y-_#h6vlZ~f1&8lOv^6yZY1t%wS~rRv9jzNXHP$nf^y174k|6+xrm>nr<=bN#LsQ5n?*@|c>dMdHc zoICfduv{9oMOh(4mSYgHFfQKN)nJYMzA5GDpRZlBnPu$u^u!3!w{0t=6Pk2RNh_ib z9WyjuoX0S5Jb=d0a=m6(8Xv0hb~}u{|8O@7byh0ieyMX<{h5;UGoZuFzyc4$pt$c( zYU%HqQ8C0VR14d)R~*C&HY^xP*&9A*v7=ogPI+R)gC4oy(<3l4c6N4&l(7U;@1!M1 z=7(?Y(TON6EqS9CzFi?CNcT>B~kbC7q)Ao}_Dm)T9u%2vXDKMyA-A zCnBTPym+x*VVs17NN~dwr<>UMIiuJpW%E{QQQAG%Sy`9dbss&*yY*mQuAKOv_TWqQ zNzY?r$BvDU7at?>$x!xG`V#od$2pA)TgGB*T~$9c9lHn&m#}!&oOKCuW}7Tej!4=v z;ro3HJ*iJnetx$?v>qjdUxYioJ(0<-;rmqjd} zg)I*VxD(Uuc4K;YS^1T=w)ThQB+H`MW??QauM;`>um zQ=PI24*SfeADutK#IdZb=!L8FD{;jmsb3C_M^P+urcIgB@uZG`iUk{Eb#Ah$oIma) z`SNP7sAdC{5&O^9SINn_TJch%<@R3n!qQ8G~ zsEdgiML8cOCw{rW)y`y6qfrBp8C&Tpuk!bYy`H2Te`+|cyKsE>C?oQuq{K-QhE9_e zj=FrZtS3}`zD?|Sn`zp%0>2o)WXTa6ZtS;j1(PQ`yo3rCAKJICWjC|sY;z$tDQ*69 zTWxnxqDrEQSDiaiab;=~dex(+6I^4i@6^{h z@k8N<(ONb^Jdmz;v8VIGMtSz~Ko8Y=lj$2awS0bmGIIxJDmmZrNb0%P8$m$m6S9|G zlteA|&UiL9LG0A2Q{G9_aW}^KonSmQk)F`#aeEX>e0=*^36jH8k#g~p6xIQsn7|cX*aw{o&TxK?Zd?w%iLKgEg#FB$BredV=Bjf{207o zWeMqSvA zQ_LtUgWObDNzJF0KPQcuJYGypEPkiV!*%1tP!bZ@!u0mtoGHPTB6@YJq8gtti71r0 zoH++IZU5J;*mT`WYV4ashs5OZCVM3*V;1_)j6Iv$_+2S^lJ;E{J-ta3d)3hMBTy)% znIpjeP$s@R&WkHadmg*n@wRQ1I87xe^OQ^K5?NglEibQVI{o8BqW!Y-of^a_OVq-d zO5YD;cEv6~ri{`mmy?$tDc5XN^tw1)40Zkb^_O8I4drCA?6bG68$VtZlUKHwo%#Oe zGLcGbDiv&<_4TGJBWl%8i_K9M!EwCor;x=UMP4tZ795%;K#$M##SadNUaal-cK z*$YqGR(t#)DT<;x9v6gVccWc`U)tQ+cm&Ygj`=zF&8h9M>LrtZ4C(WK?9eFKA z_T-r9awaPyR8Bp_hddrLVxgz!-jC%*CNieuh^IY{_}|_eM5BdNkv?{xZLt;G{4`?S zS;^Xi=R`ilzzJG~N$D zCC(8^5LZOymC=g6oy@Vh80)Dybxc@G@>g4p?yfH4-f6E=R+g5Uy>wc%XqnTt$rQZh za@DcQ8&He4Ztc9JiB6GkzB-Raat;jKN%^$lYm0N%;p!;|YQpP93dq+sD~=pF(lxhw zWA&1c-B%K==Z*-jo73PL>*vl`WL~heJ4B<#RX>+ZG z6?U3WWq?E-#y`P2ZNse;m-tj2sNJx1Ys%Fv%F>Bh#ztp801fxF&@677q^Xw6r!-B^ zd7?|jyq{zR7nLpIgr8~aaEU2W%iPqdX*9i# zqK0w}&+lW+O;Ax=Qa*oeQ>vifNZCoN8dbC?GKKyw*KLW$Qk5;rAI_aSoRstuzwN*+ zKVxmIyrZo!a842geqe26@;A96I*WKq~)xRJ-R~l|vgh zHZL!@H(9MkcD~8?-AvZu!@CMRbOIco*A{I!>3{VdhZG&X+f(yhn@#q%y{lGy@A{xX zqvgwPoc&~}QTa~Nw@3b0(b=nW?H4P4q}N?|>aAtJcb@y6yQ{`F&bvM_Y~Q=X9#m+W zT&7iY#MitUv1UCf^C!CTkq{PTV}knBe2v@+bSu|@Aixnp-nLxSl13TCM{lMOSpG^ z+hpJ~b)T-&m^Sas#YY%QlAc^^E!)&JuSWBR1{7y}T6y-@1(B?@QposLncD?=P*C*e zTZSLbyxR2X)zz~~vDwvC)%nGZ%Z;ZS{^4r3s{QPBNtu=JJ{koE70j3yafN+an{u1wI-%+sp&d&2^Sm0iu}6&3%OIyEc0^X=`u zM~cJdH=Yiv*sD!>YOU~e^2E$qbQ$hG$HAcj*gDUm+r8})Lz*8u#dJLxlQlOX_{`%7 z@nC{iO!SG;=d5otmxR2~^{))j+qGq;_3EbQJ%ooz?3417INnJOH}Q3a>g%O&b6r-; z76&Vcij>$c96|BJZ=Fp@+M}ncqocDhQ&C_4NH)QR{v<5_@L?-wchTbsk3>|yy|ht1 zc;I1EwnL))f>qv@aSG;#PMmmGli&LEtYl+Tla>JrNGQ8uc3r63fl_GucKztich^5R zs7Y^?GEXXS*qz!@MNCeZ78zW=t>{R}=OxVZ+js5^a9fnACg!-=lSEoAMN*o)=faZr z^`9G#ZIWvv+a=O3FEbrm?5#1`*X5*lrE!BFYF50HJvKMaUyT_e{y{o9v30}E*tfFL#HRQ+&^5{{q1GqZs#jEj$ZZ8S(Q2h%9^HJQ<$l4l>JI& z>!uk@W`@0E8EwPMkeHs&>26+oyxq>+oIEzJ`;qEZ*ODsI$d{K-(W(v~K78Wj$z^L% z8$RH+R8H}fHH`Y|=q{5V`tY5$RoFh&dZj1k-=2S(?={`**|UY;wgXFROZ|g)RiiI< zHj0J3SmTs_c)Moy3g#3ERN)$2%H0WuuZmnXHXpE9)q4HhA0yVNv?-r?_2)>%a1V2f zuJ5lD!qs#+_gWt7-m_pld3WzhRW|WhZtlb@^itzTrKH#d9}D*bawNs0g7NUNn{Z_1r+8&6R^ zFmbl!(PdHNW8G8QJ5C?KMybqfctbQRifX(syD0i@^yZ95bkBmo>g(I)l%Di{L^uxB zUnwmuwT<1ftI4=$%nE6Kk3d=Ng8+uX%Mf*`G?4Saz8vPkkHbox9!a zQ(63U(^b{k$$Re^;3p8a@Ag%Tw_J5;@$O^C7)=kXcc{x#3rL1FZYNjWojrH%jk>zJ z%ZFq{mMO+cv8GahLCk)0^U-m#1&x+Ny7Xl1SY?SNM>yq4*g1rG`hm`;FoqLF4c8}> zXv@&Ejb~AxZtjH9pudF59-E>1>26eI{xVAz@tUiPaZz}ZBO{PnD3wR|C~KDR)#Xx{LWMIpUr-R z%0IN#Vy`@T!o0q9(Xn$ngil@*l!OfJ0TJaq|f%{dnp0 z1u(+M_72SRCZl?%J(YL_k;`i2yCycY|fS=JZIL(O}hYr2HJbr;a zfw1cB{`K>wZaYzXe{ldUpZ+BEBID`1?k>&Kg$5$1*ij2f!3SR#oi#sgBssZJ^xDf& zj5Vd4C+n z@D<3^>j0MWnuvqv&e0woUA@OtQb*U$)=nN(rtW>oLbd1UyP7wql)?r3-_kB$5-r~- zuf_IzpENaJTDlo~_u+vHYeZ|GOYMJuofe)c0m+OkKeK;7xvjA}CnpE&OwMZcdo9gX zDrEM1S#ANAyQgQ6tLwK%CtZq)-0bY+b90yM+J$k=ogABU?!w~CEh|@^>h6lNw(OWS zs|~Enh_d+O2M`Zgx2;-L9E&>t^qx$3`-UY> zrUic639X+$FX;YKgt2_->RFZK7mXoo(@Yb4o7yi2 z(o3#|eRK2ArWAOzH$OQ|xw=W!>Cc;Kx(z0go2Ey|O?j=Tvd-PKxaUh15!mbpT3y%Q z+j98ySF=(XkwYA{uyvW&AFiA3`1W-TdA;oEiJ6jU^w$q{KWZq+8{`w8cM_I$iG+U` z7i^+n`_6w~bn1>BhH${v#MvBopQc5QpH44t#Y>x?z??29_}1B3d}~sp(ie=#{fVYP z)x5d2dxWScthU;oGVdIbJY2EH*)Aic;(By6v(8zQU3Ud^t~mU zY75t=?%b`oY>jx_;oMxnfpDNmK7Rb@e$wwsdHGkd^5zWx@Yoe!!ra!NG1H7$ufak* z>32)cC^%zJ@tx*vZm*V=<*Ba7ldXPndA;Vc;xF*XIS1rVPLEnS+Gx+k6E}f&4{LrL z`mMFTr@JdzPJgbtxNXTP1GJuT-@VH%)q4~%Vk^Qoi4{-}%5{p8#$K5?7x2HXTH;>HbdW7OA2{>}Ho znX+@T~q{xx1k?%cAWQudo2^C;e};D)r@V)fTbWkDGp2E32^3 zASvG}GbDvdbw7IS7?Vz?2L!07t2aM9R(B@k)ui;|kR3lh~Av#iuK@cq|&~vOgEk9z~QoF-niyn=8y}PPIG2>w+ zs{MJ2el9jzb&H3yOH7VgE|c*7vcuUCJs%coF8$V};CT7R=<}o~d`7sbGYW;8$H6V; zP?$mRiAWTL4Wb$&1-h(!)pMRz93 ze1=2h@i>CzQFHIr|8qh5|G{g>^B+Rl9{!y^esTUoTSrH$fBq)}E#2YsAOFNPod0P! z|I={(_u))X|FxN*c*4ie{q)Nu{lf{Mh7&;juSx&jH{WkxafLhhxyb&fGr?1X{>e=6 z&|k>rj_#Yy{a?-@-I@5y}RPl-XR2!;h%#%ChJKh^#<8TlMQvw>3LWz7#@hQg&u`3)KJ z!~}>Al6Z3w$} zu5S3*4m5~v=*=?5OT*Kfct((W4Mk(zU(MYg1Z0ekv7q6x)>`ny- zfhRf~CX%lTkp(!36TG~6wTFWS)E*Yftc7SZSc3o&^Bt-|=793CT#Y4ILEMU?f~1Fn znINj3Vl=IXEx4qtEjX`iGICj51g$Cr3wC3)r36+!0dyHp70c!p z89;VSCd-$rTe*4ndDI}e?R=?Vme>?3QX2uug@r-)(_lh*2ZQ?LB!sgo`u3^j$~Obt zuq1+DdlRf<(7v!R0NNORawzs~15dCb^7%tW_x;ThXYOLn|50dKg?P}bI0d5bOXrtM zf4l))lFMoF^ z+`ENG(r4m&hePI$0ZwX&By59?EkG)wf_Md{nL?Cumq_@GsX2(lvAFvt@vNOZTrWbt=mQwm4M~ zeT-x$gvDI-Crlvmv`SyAmFs3O1}``LYtHjaB10;FSMP{2`i*YkrTq8x3hRyE=ro+n zV*Gub!t47tIz@^}|9!n8OZYds^&@QK6{}m*#7K=t9sL2Q@P&>>>b4Og=yoNqA&@- zq+!v5sAv^95hhpH!3uH^OZz9@BiAfqQH3&bs`fX5sKSmJyoHbjJ`%Zaxp#r#H$-iA zs84bBU({u1P{UOK-3aib0{f>JsGq7rSpL%saEHO^uib`z1b7jlV2N^Aq12&n1pfAr z4WS1LqtFg6DDw{fqatjl@Qck;8DTWU?m@7fAxq9PkW{S@w+a=qgRo)f-IvMgS5h8U zJ-nxS@8NB+3}M@mn-)2Ah>G+=&kH>%FyzT}3b_{$jm?)_m~?^A zgUu0mAS}derqdV!LWVyVTH){dK}_Ca`-NyiL?4)DDu3y+nP8h0PUb6=yPb=}_%esG z4hJ{90Vy1W7-07!IgcUq5UNDjQSawb2pexhE-Uyh=(pw*jp%LYFV0=>r14dk5O|2d z7F^9H1e7B>3^-?k8-=D$s0>>FG{11dZhkK0!N9*hv)LcR`b{8y!2Lr3@dIxD2@pT< zz9E750k;nU#0w!_ShzgpUvFAF zKfa_=0Ig^u9~T(}JMDdv!{qQCiUHLyH6U{`oCums2P+-Pf8Vzr0fGy|J02g06h;+< z@Y}%%7@Q$IU^EQbM1??XCR%`x^1vIem&srTQH3Bs4G2MO_)KJR4S|6@fxa+kAv6xb z?zpIRXwX2m!I~cyLOx;unq_k_J0_0;CZ7T{q8bFmYCw24TL_cjg!(dvvkUjlE-Zvg z4xU_C&qQaqqTqkyHDvskkb?eq`WQO?OUqDOcR>9=1D)aefB(oe9RD>O|216yZ#e4f zzbxu&xc=X8_*cLCc<83U&+J={?|)s?7oX+)s3oqgh5#YGE-eDy^5?04xj#g^A_y95 z2$+Ybap5<#uw&M*E4Vlx`RA0tFC*dKAm71bKR8s1Ka1?A5gbZUXVI7%+?o^I29#iJ z?8Iw}AM?=fZ56oR46>vKGieB&NSMHYp$Mb6U?dncY+wLxQX>YbqKDM?BV&ZHTnv{- zzGMX9?fV=C@}q)H-j_Ti_QZ!~1$ZrYfGT8PUl>y6MzKIkFyLoLG6(qijAcR~U?2Pj zaejHv@mygOzy;vjfr&t7K@g(C6pk1e@EhI{X_Of%@ShPtA3hEPk(o$r1T-+_N;q1J z#}$oUw5A`K@TmIHh~)9Nn0y3Mh(`h$g5P8! zoI(0U+9UFUO!~Gfc!Eng7yq5*O9qQ}7J|k@vv_FyQU>=&-jFl~z+OC6E?D|Qyjtk< zW`QS*zj(pG6IlL};2u~|_?5o&ffF|<>fZNph(qN+BS6cMcbdGrk-w4qH8h3*)sepy z2VmvHP!1Q$5%Sp)C`Si|a`ZK|wKcU3AsubFPL#IMFqAWVaj&8ApOAn5@E__|_>Z=> zp4Nc#f7-+KpZ=L^82=f@e}?g&Vf<$p{~5-A{&(U(d|YRd{jV^c|F(mF!VnNL{NAWI za^If@hkm$+FIWQ(U+|A9a1W-zaXvm|1_i-Se377Z(4q!}1M4vqh%IdenO8d;c#gk$ z!UqOzo(Au1%h)M{ix!e1tj|p9bY#Pj0vGf@q?lnROB~5 zpmBi40}k*!ni>Crd73mcZXog!z!*9e-t@S4aF25!zc1t70NRGVct0AI?mNUih>!oP zn|KJokhd+TQiFkC8O9^XhY8jd8KHO?1|2;VmNa0{{Xi2(u=CQ`WZtP4GKUJ2GR-+G(UJ#gPakBgw6=U2LXc-GMU@}5~R6-Am7g+ zBf)$QfYi9qnBa^iBIgLa!-B}%qZq$LPBnf3{%~m#0)T)8;tUfs7~(TH-X)N=pU@BZ z0>q!$mwYfR1c~Fy{_h~C|H?=#0cpQKklqFH7e>N`2>TzX{JjzVRd5cB2#Hhu{UHf2 z-@h_F+;cuc`0IacKn`3Ae{)CzRnu=UxFCqb{4Mx>@YTr+W$&lchsNc(r+<+Khs5T& z6gp9nbKapsNB4mKpuw6f2nnR+F})vM{GO35R2VAm#}A--;b`dp074tW6SsapBYUVu zpsx?5FM3O5gkj)=H86hLdymQ-z+jD_Nd9LHOBNuSHAnU5pl=8rf_KKj_C-OoIXAkS z+XA?e-!Y)Ug!i1v9Jo6Zq-P`x01rLZgyG;hn4!bW;cE_u5pHL_zw0Q~yI=|Htv)A?IJ%U;j7y z_(lAufu6R0-}wj1U^xEspSk`&#Q(88{1<_OIk3ql*qDJyM+Un*6+U1-jQjr%?k^!B zg!=cMT|pWd0`7;gseb_Q|4UQ-KaKUn?`{q;Ws?DsdOf7%8&P>VsK!N9Pk z(5HXlB>@5>{l#|!$RB_4oqz@RkN?Tn0X%5%Uw#F^{qz@Me|uh*9Upk155=^f!T#L8 z{?o8O4~-Y#{6nMjLSVlYZOGRG|6-y)ek9@F0QV2Nn)qq%LdkwW_fj<&RE{Q38MB3r zDmJV6e8? zl%Rg?TDUq5-X51jy`O&XwFsN~_q`9{2^!R!=Z*hDg#QbT4RHdf{P)Wo!JQfqo&yB} zQxFPg(csj8@Llkm5FUERMhgxj(wG`-jxTUHdx4(6@UnqtQL8NZ-B{0`MKdC|VWD8| zZxDsdfPBEfxabts7v4;H0gF%oGaMNYZ!CZb$iwhR0r!NX6rBTL6vU4lO6R}`Vkp8e zE*(lg2}@KO0`KB$nO_55O8xkw^ixoZ&%l21hW#5rVhxr0p*Kpx5r#_rFdHRqT%l5* z-7%)B@{^5!$goEBi_kVBTa2R_~fa!j)|TT5N{TX z>JQ{$7!3NGuOa>a-YxOp>f=}Oe>z&){p0`ibPb37|9|2d_Wy_d|6%`s*#95)|A+nm z{}03d{!t`=hfnaF|NdyjFaq%ZKLUVE-5~zIGf+>xF_AoH8EiI)pUei|BF;YSi~_e2 z_Wr?m{R6mJqXpsAN#RV^PooKu1aLop8a}Lw{Kg0k@`1VB`tx(gFHWE3?t09LC_Hx&0uq9oau)kAY5kiCh_MXPB6EB z(jFXU7)*nwe$Xai+Z7=jo*Xg+7(@l8FVOOl5VC&(frHbGBVz|1GABTgUHqrSz!NzL zF)r}@!s15`1!OQdNG@C^V~EqZyh$IVEl0jQ{FU~&LNZ8ePF(5X0#I-O5CrGovgE-^ zy?~M+5J>5lF=qo$5_9Q>CGl7N=;;5ld9KtB(t#ycoRLUhzP9jZQQ@Pkh-|?F6?Dml zf92waU|`(vJ)j!kOsUAJYPgl3)4*FB8XV^DN*+(%aaZ*D(G&jQ(B+d=sR#zjM5Ehb`@0H0TY7XfO>oB?kP z5b!6Gdxn||KJnopV(p1J~Spf zlFhH$%VcZ7z48VkP#^*UL-44eU@#j3j&q^Mfg=Xv@e4&J9c;v8q@Ep(9tmUDL10-0 zfInejfLmZ|@MjRlqq(RSnZd<8dCxK#RKe|VEjrLxBoxq#l(BhI#Yef^)n^5%&+=93 zh3L2(M5b0ib}zigdyYd53ZBK*06qO0H~zl`>A@`fIiiQ?8zmS$<8coI_0GZ1qA9s5 z<3AfpISj`MU={?8GaN?ahOd9@8WR8O^|}77K7N7!>F62g4~YLX9M1pvk6gp}-!T67 z@8N$uM_m|B6Zr1`1xO%oEL`x9_hA?T97X_#5y1b#2+(05@V@{E>{CFxR|~^!_iAE3 zGAOhsg82!f`BITGtiQV#X`t~OHm|Tf6i#MCK4cj2VKN3J!sNTumX)Bo_U&GXDpoOTTgaQYU!J$XOc`o6AI5tKQr^>@+V4x2!z#`~cc%_nsS1MAR z1p}dZ>k@;wpcrmk2!>Ze00Cm)h#TNd28VLky@f@E$)d3#KNgh=p7G;^lUY>cDFiG< zLgZis=OB4!YAow8bDp>$L;mJ9=#a!SI9yii>*jAAtu12Xuiwc%bb5N{t~9 zA(G7%vVw0!CN&twWCx|PkEMZ7+Q-@$WNivRBEajYFiOh-g!@GD+3MR{P1%Ikvo9Yr z_vH*?tU?w{7La_w(QzQXecmCkg{)c70IwxqA?4OrPYd=zzBu)+{Jx>|e-|4lYz?^BJcY_( zGBl{Zp_;3FX;gnEEL46}HX8xo2Q2{w>AG{R(cn;YGEiG! zM`MOEkR@b6X3?2!2s{$XhF^&VP+9Q%B5s7biYj+|qk_MYX22vefvTjyI})<+kZ^YH zkpOtF7<4*d3blnO)YaB>AhQOeklO(KY0yTrgoml4NnnP-jp+S;BZ8SlYF;au@oIs? z(YOE2b)8IKLfWV@M#9qzwj_3cv}i=K5+GzC7D5^Ga+Xr^&z|todalO zeT3q3&b=*k}x9=2>&k7wtaNxPlq~m=PG3Gu^7ET)xr85Kq!{sD@gDU%Mt=t zYYd|P1UMCTVss&;#9sQ|Um9QWblx8+T?Xvc-_;Y$n7)-ipA%j|5OHauR{tm%sz#{Ks!2Dl-N78E`BQHs` zwT9o4{4Ljz_`k5h{%`d0%lr=px&!h*YUvE)|Nq1_jQIVKKaBnl zqyPUY^uJF(d=!q40QZgc{x?H_1+5O|boYm=O<>ekIJy%Cb$x)l2azdcUuqDI0{eJq z3hXhmC^R@SG?WF$Rs!FT1Cf1zB!|MWt`Gwb8Dt{|m0{Qf_AJ3yEM_Fwd4Uo|gJ!J> zF6wYJBLpZ82KI>`*tNj^h8Ra+SZocUQjAEED_+zj8~DBG0h>J>I?HB;vM5x(3B%U( zrTWnrG~_HcS9*!yCbScB7vlZ$hYh3I@X2X}Q(Ql|A8sx1wb8YKEMeN7eYLcBjmv}7ESQlfJY@a>nE75NZ{DRPa+b)vo?CEMI%wjj7a_r!xPM# zRfHqJU4#OF5W*44OfW0UVJrcO`eZWbk^E>(7+4T=Nb^Jb^zGjj{N{$rKz?I`cIm#5 zKP`-k4rN2!4H3pyXbcKHR1gmhlrD=I%z^`}dpQF$7Yq^1Y7iAc>tIfUM&WW;$kqf$ z^1{3X!VwA+#!u-W#4%x;kmkc8vm#;YheD*#LjXaTK5*0kSO_hEg%G|88sdUHTxkJ) z!-Z*hZzFh9=!+IeE+0^0X_|3g*a)~W8)l3tj0@meVgdF!CIij%f$eo9>K&O0uCT!gVT9j+k=bC&p&>6P z`Y<1jyeWZH;5k)t;yt0Hige;j1rp9%EBv4Ml7|*j6c{1d;0q?57DVH*5q=zD2%9J4 z7=%s?I*92@^NYklK$F44LY5;t00a5b;HG`R1YzKV`aG6n;BjaI0b*0>aA}`lM2q?L zp$@}c#Y~ttpno2Vkbc7h!0h!I35|{R3uQ4tm)r3@uniDER}jt>e1M#6u=e&yS6CN7Jqe-Dg6QZ@!du%o zLpDTvOB~4wZH@z!Va@Gv+^)c&EbOs(2MlD1b--HVkf(^C6%ukAk2*IS9P$CfWujO|EsQ{@!tW^(7)8j z(D<*8p`QK#{MSHVYZ(9iC$0^S1naSAIe1Zx#oJhtz<*=m|BH))f9;okO-G?L4&yDc z&JmBBqr)RyaF07obsGvf=Fnu4&DvPSg(^zZu?w-5^nHia;?-pGy59BF`X{!WE-J?<8o3ZK=At7Z=QKk2s@lsHph9y}9f4i=tXn|H_+P zmFGTx#ip}6#($ad{Mn3>AE6!NMOIAhv556t_d_aU$BPAGZ>eW;Bub2bcxfJdYAGgl z=FP*^o!LLOLv3GCkN;qAlA2(1RaP=-W?b#5(_Q5buXaymBuvlnRzPW$TV>{FWo2Es z&~sHGCWZRwXjW_K|6}h<;Gyik$A?sm7Fr})9upyB-`BELc3Gn=V+=-PhMBP?-yv&GO{L<;;#mL zEL|o2v9a;gsZ$GLV{NRhot&M|pFh80Mhazh-um5>7Fr66n~huKw7#(Hp(R@oclfH9 zpqU!Z{YjaAR?2`-GclZ#RI`*oiLfMDka8uiWFvl0$vIQukOxPzw{Q2oyiQI)K;TEq zy|axUKPDz5oI8Jhe9hU|*3XTNOzZ3mez$_Ol8qWy6#M!nk&>jPr8PA*+rE8k`SfPw zs8KI#YO>1T+%cRMy>+wNRx@Ln6=LyX8fh;R685|b5H-70W(R9)Lj2K!f>$qJ66YRQGcrndntyS8WJ*fP%a<=7 z&9B>EE23agQP=eS`*%t5Y43yHjR8l#o?9v!aO6HsM^{^W)db`D#ft|9Cn=FfDxDuG zRq1_2zh+(hmMzLtzlDBpeaCXh$laSuEAUjry=HHIA6lhOCN!K>jed1?_Wo4ID`J94 zkDIEN2s!G+SXqgb&VD9~i&MXT<;sH-;W-;Ox?5UaxRdQ%b2Y8}&Yco{0Iqw6osG@I z<6&eQo5W+sj*YL|q#3ySh4erlJRa|PW`TaqBbtu8ySvT0U8RlJw;CSwKD{|LRbuSe z?0a<;N}1+w2jEJBu5He(`mu0PbhI{3a1BlvC-^kr$nHb$gGr>X?mpukX0C{8t*1sl z-Y`>T0T{Gb;HyaL5nEmJG?y0v|<$o5mTySW~Ac6RtPwY9aM8y*`*Hayz2 zNwRddr{{y>C4-yaRV`|M9NAoV@7>$`N6s%B>Rd7;@dESB?cFlw%PN}`O)AG8NlHpeNu8jSrJgupfZL=- zT3qZa)+o2zWdZAXiAYX`0U(In++0@8b&)e+U*134zJ2?;btCe^--gyFFp$x{Nf(v` zE3Qy~RbOw+e0iz0;iN-WxuV19F=KoRnFGnRNF(1Q&pG=et4^Ef9&=f@fRe_%K0fc@ z1VOTGYT@)3X9FERPfDhZI{GYqKxJ9h%jUB`Vvl8d-#@k8bJrG~kbV32k2hfNwa=Ot z6m;pvjfsX4xtl^lL*IXRaZy>KY?C_K-{Z+qs`J8y-=Cb05s}dhylyoAQ&4d5zM?x# zL30u;wkJ97cSYidO)&b>bkFDB-Mh<{FOP|dN!%vX9QEPCRzM2YnIAS#JVLh&s~Ut$ zQn$Jt80aH1UgQ;^!rC6=gtBGlD0JUwIOs2Ipo=lXHd3N3K-O<^^i>t>=8_z#l?0ei^ zFwT0GBLk^6H#0M%(cY$M21dNCymj|(>ZVN!n{M37+- z`Q6}$5@Sske0f^DL|G#7K23#49A_Bu7T^rP`1!2}9$#CY<>0Vs$tVqlz%ScPmt@2= z6fPAV^FT)(SClY%x&ATVr14{CE@wPVA4#aVtCQ=&62!$T>|WLoXzDll&6_u4$Bs2I zF&VT(MoB5hVVjA#xcGoULn@CkCYI_M7(A!~E4tyay1F`GnUthA>=Qf8mrD&9Wc>y( z?dJN2?z3lqDR-EvUOFM_ser1g>T9cc$>Sdm89qEYIk{$>aPfu>c4Zsisig_2pHPeY zJR>;xL8{7lIjc%K;ql~wicC?n*YBU5U%GUu>giAG4jxp+(W=hGz9?O_W5I_gG#|JE-qjqC=_sL&OI@Bt9|pQa)+8%ucTI$TCJaKX=#~#!y!xSP<`Ej;oc$7 z#Im$-!e84it-ZZ$+4Q8Ls}qlDZo2jI<=ktRvnS{f7b^TGllX|rwUhGDOzOzV?+L;5_W(W%&dim1DaM-I8 z!rRxSq#X{$72Ugc?97=7E`*!)$Ev*N%u#x8!gzA(%au7zYNx=late#FV7PLx5XCtoLz_ueRghXTwL7RNi!OroSq}xw7Qfu!$#FiQik0W zT()-7?y+O#E+%iRuDO@GQFm6bz#6YIS>b5}3u&oZ=`myUf?d8G4;xULv{HE3=i=j! z4;1M)m$-=Fo;=yyK#1G8as7b^^QL++oBi3IqXJ2!o2%flTLUPRb1!t%oE?w+#SqB73d z^TC}vLem6Rd@-N7B=7F%=P9h6M~@yj`lujY}zM(p>m zH5C;VX8~k@18f5jZ`~TACOJKM!uW|3eVm<-FsrWs?y_v@QjzD1t5N>0kz(D2CP zP{6gz+ZIkyOWQ1<7B`4YNb;ES!u=w$S|CZBoUV@d9q4PYwfRo=l2qbY^?7dTZZ?uH z%!pzB)`zdkioAQ`rA98zlB_#H94JDw8gb=vw1J7qOxsh^!id2M_8X`9^IPB+?LWb4 z9Z{m}$_6DME^Ui?E<##Nr_(=w_&^N``U2<@EUu_`r<=d~nOUrG8ib2~TA(v;eoI>O z6GP@RGesQkwXh8C+{HUXky9=yPB=|m$%Un=J|?f$&Y*wze0K^NS3wt>zGB&+@~6d0 zQ>JVdBY2sQE?uF{@_bN~Ib$39)5UO4@gtf#xFW!ac4lTSS-iO9uiRTfY=g&zU~kJX zR?6L^4x z-<1r6ro{(|-M({I>KJ2cbM?lW*ab%w6?d$Qr+8GFF1n9TVXCUy&6?GgM_wBLy5z;y zSmn}9ta8Re&FD|Bg=erFYa-(OblszLOTRz_DJ#c5TRP^`eB<3IVoV^u07-NGWfyPn z@8?8S@7%k$F*SABvSot?4pg-FrQD+UkDA*2=z4Chjj)wuozS*7I=Lq=h?=cX7p+O1 zLtpu|wJOj)U2=Dl^(;hf`oMwV=a(N0rb~RTu}@o~SGq~PZoBDUS@y>DbvfaW1h(EB zkdmLQPMNMc4dZ42iO&gkHsJVR zxz9Q@yq@m*=`i-wZ7_!6Bu3yGO~a6x*g5m>_TGd4&BY zSy@@a?7^|cV&eX37fJ`6`Q9=r&TZ8m=irgYc6fd-^9g8aDbPG|VB$IaL;XeHzbzXo zElEC11UvSPt%l%q@(iHqQdybkkRe)9s{olLo3!jDmNCw@eI78}NG<3l;*q*xiA!qQ zbo12{l)a7yy||FLJ3cB*@Ib9LH zHS3B&;lY^rLAVuSw%KE4K3z9F;uA$8?zR=4C1@!jdb%cK=);1o>tuZ{e5|Hb)_Vy! zTF==wKlt|GiB}_*w%LnKyA`Dy^1#K_H6IYwg>WE376K-u;(1g-TYEI_db&OfFsXuq zf)giB$l0W>IPVb_JfP^{qP7?E+s4V36zMkrf^pn&++S$XMafAeiXpL|ZiUUe`^a+U z$*E35GFacQD8)R9jhu>`F;jjuUi-$V!NlDuto73~7uD@I%viKAspyQ-11};c!KIS?SKW)#~eH3Ay8w)U8d|Ein0EM1FPk)1JwqGP6C-rk}6+9?`nP+`)d6 z*bV&+)dALa>18{WuJ2DNxXjcn4SI6wPI=b0h2OubFWyj?w}8EQ;CPb-QDv#hKoD>O z6S8!JP3En)50AYAyNBwj_lrG?-0c^LJNasDes%S0t0SO(_L3DoPiLR1>lBl zZ~Ckg6>XK$xM%W_ieSMt0$P&ucEplotj-;Nl%A>+)cV;nwpFTRRLT4?!q=`$`SEPI zXj+<_rDc<~?_EGbBju-G+qP}g#47iojrOjmR7MmPq`sLkG1djJ+NckHa(8M@H$MTZ zjjw)Nc0+g%{Vwr+uopd$)jee%af%Z-Lx#=+L3JZ)s+i4pYi3($~+g zPaN*1w8hvk_D05BtH#1-l^1auHI3(%PWt|Sxz);*rmH1qz5mkIT(hY4q4CnCqvNAi zYP#L@Js1DQ>*R!6Z&rvcFAAWKke#KlV}X@$sia=B!mH~d0(VXvcwoy|{s<&+YyceV z(xpq;&RGdhwW}!whsN0pdmnw>`sq`q?u1rJaw$kh44g6ALkZxVOLkz>Q}GqH>v$4cKg|| zP`{z!pKfH|+V=%FX!wM2BS&Ud1Xt|XR=a4adfh7BVW04y#m^;qoIm$1qG18;_08{Y zN~4*l5Bs`)92kGd(UEO%IHLa1-o0^EZS=vVgG#5RX3Ku1RfZa=9C)|wyOyi%6_wjA zZ)~4}(?|$dY9ta#L_}nK15UmG`H*xg=<4+8`;9Shna#Yn6x$5QYzF zhD@ofDyVm(dzuzJ3*; zuc^6Bj3gzH6h3&^+;KX@1(()*H(M21zx`Eg%cty|9790lK!(4=X5uTUV{nd6PU|u< zzJnviIOF*)QTaua=O+xxa@eLLwd&lXJy)+4h#i-GmXPpjw~ejSa zixz!eAx@GI9WC>sL41c$vH0S#WX4%z^0zN~)(=`j%+JrC`r{kR%}qi^R#w)c{z6-A&Osok0mi+j^4_Qi zE7HEzx=SZdP?jwTT~ZyJq)y(W=sW`SF0uQn`iNcTQY$i*6tk-yn=|cRLCv8coA-K;ESXW z!+m;J<&#s9VG`Q{2!FWAm+jsM-B)?fY@568{XL&;t>xPm5=s(pOXt?%7u<5qX-G({ zQ*wM0J#+0jGsWt)YXt&txOp9SoIdkpNV-`4QqkSFZke86zI@h|t>fj-mbjLbmJS=M zQL2SKlo|-25|&ii!q`N_=Zx^dk}+{K3f+>_n68)A!PePZWkdjC`Wc z{>mIJ^FTT&_F>e^%j+|>rFPEVaPnrdm@eaVxbL*MiDZ{t+I4-I2e)tMfE+Pe*s_S@ z5h-mIGDY@--g=8W53Y?1(YPsp*r-t&R{#pE$wbt7LrdGZo~zW9PZUC{7tcExRb=@)lqi6(f8jT*Hp zT{(3B`vEv5w{bdBTZGphkWboPhU{EBc-SZR@Y@?c0q{V$z-x zE8Uv(%!Nmf9vxD7$aI&f-oRvuY|n|Ml8I`X+F2vZeAb0}c)Y0DwoUM6Q|eZaUG}e= z2&!)lP731GB(?4xkbP!b5&N||ZRgHGR_6+?iq;@jw^xpox3;k}3Jd?V|z(x;C%me$;GC+w=t&+4^9V>kQ z{X+(8ZqxSnH7i!Es4m->_$_e8>!`tV3z-+dQFd2YVellYZG9Aielf_36fJhH*VNq zIeq$KyV0TJ4s3e);RR*)?r>r1{F6tMH_49n+bL;Vb9$ley7y_C8>(VA4tQ#$o6IVj zy>DNz9&^_yn*BgsW2MR?^X>`=Y~Hd3NK_VjXXk|v!1=y=Vut%_plNktfEan4%=x?f z?^i8YuPiuh>w`h*b{2WXINYh0T6#{!%gMS9j`QC=v7w6z53@>(xG5mIj-s!x?{P;d ztRivR{D6R!FGv+O2q9t@rL5pp&Ani)lHlFJb*Uc%X_d!3(`29NRv8^4&sZJftWq;B zZk);7ok+2zv~N;%b@j?z83z$0biA0@`qX zzo<(%9w~ZmAF<+&*0r?t-g9ZAv>elq4kOsLE~2E(x{~jCcz)A|AI(1^NVL#xlEh)( z9zEJzTPu;Yc1!l8cpX~hnk`#Ihoz4@S%3P);ppf0&Ye4vB-aZL?;Oyf;@mZ?Wt*zH}~4#wII`S<9eA|LX~YsG`BN`!Z8TXg1I zW7$cE45Eusmu8wCNkeuysVGT4#!=!n=l+4 z&Ll=W|MO$yG6{2MJU4YLwg?eti45{^P5m8M>-rU*4~I z>N|1kYPHfWTa-7d>VB*9aX<6jptUm342P6F{21!0UTw3nwy0^CSXE4P^ypEe^!#o= z9)^n>FnAbX;L|NED&_80YAa0%elJ_H;^XI0KC70o-JjSjS9qQtwp#cDJy;_vYoe9I z)P1+2n(Aso)Mh4qST=|i8><;NHqJM9`Da0ujFcCSYZ4O@q>7dndw3Kt89ZEKM)nNi zOx$kvjSORNZ*RaW4y;k~cK5jd_St+HAseTdO|OQ^;8y%K%UVE9#+$%8e(Kbdf>LqZ zTG@$Vl5Cx*Y4Iyu+;o;mZyQsZ{_)bKnR5E>j}H$JeBCr(JfTkGsJIMn??GMt*|~Hb z$DMdfYL3t3>-u{ueckt&-nq90hdU`2bf?%QqWXBz=?Ta_MsU8TZbT!!4 z)>6!^PhPMS%3nEkAUPvaezv1cqNVJ}sJq{#LXQm~O4!)gB$9{P8~P^A*>4=V=DS8z zadFWrt;h`%!$LG)ofx_!g=KGPa>(h^Dlvjap|Q8qrC>@@n0u5{-T7LE(D8=?gO)sd zwtV6+5fOpVnupF;O^ve$v2e0xjg-Q)+ir5Z&v|IxzngpQ?y?*y;XSq>lXb-V;LxE% zSF8{oBJx33@@V=TnE4>Pc3Q(w(?@QK@9GYo1%gY&3a0$B1Syl%7DomotsU|0j=7fD z2P7}AZDOpJWvWMP?87S?E{k0N~z6OS}DmL^X%*%5qRz~V{7yr7_) zi`v|;jE^iSz0lOue2Ei=l8%ja$ej?~mt=PY}> zZ6@On7!NRTEGa2`<|h6^SZ06fr@g~*WQ*)^W5#@WSY?lk0~=#SPO_m?pyd(L`Ncjl z^*T5`)}F=}$;mltE5rm#ZEZHLUR1Mntci)|Nvp44-<&(QK;Ay7f{NYyRlbcF&Rg*?YHbYuLhQI9Xp{nv`bz)bh~{ zhvhC-q4vdod7;-U^0o?s5j|RvxmmgP;XPbY%!!4k4wqdRTZdnG|M3X7MVB{eYaISD z@rT}0mc4K=P3!FUmNToQS@VKD6{`)#uUy^m@$He!jl{8}Jjea1ry8$>fJL8><#kpR zH`{mnlc5PhM~@!$O&V``Wmv#r`eOs}5w)H-2H}K$5T2eR?n^&Wuvz8ws#mKKIk{1|Q>V0m!2G08 zbH+MB+JX2BvaG}A(iOO+?5%M(Cox@g@8O@B>s~NOJMo+KugZsw$ zajy?7`tjY2$vh|`Kl$@OM0eknY3^}(5rMHbi34%N#!nFxn?J3!bacQh+@l9mV$N)_ zl-XWVg19R%lj@Jod+Ib~^l%{|p%t4X?kyW8gcA`lEl6+P!X6WPT|ld9VNC5qh64^~ zCS}IPjoa~gooTw}bxPc;y?ceEtqd|m$wQ_EPKrC3TKkQVJWBnRf|k}OvaMqH=>a$# zVbTEbAI`vk<7r`nxc9+ZUtTvY6s9VKWFB=*og=9!pyuNfOQXFX>0s-1x<$ny#sW8O z65-p<%+|Ph2W4?;rBc$;1EuQq3SXXx6vAD;eEE6AKwT+`-L_flmkl4TNX#vn&B}ax z)l1;IX(|P5oz>Nb3!)w=9}|+76|$T$*uvt=z`?CT1EZ<=7GdV$m0KJQot(@pF3V>L ziFsArySM0l@nD-&qKK&Ik-Ae$HiyNFkwlsE5^%UpT8g!;?;M(RmOaMJ5N6SvKHNI} zt?|yqi4!MGXvhi>PH6COtr#)trJPm9TZ&K-AP>PYgf)kQbN201*iFzWo3uP>e5F@D zSywn-4`-V$xoXY#J;sCLHxP(d88z2uEFV^{nyV|kqd;e#hlewj`U1$>V^r@pRQXsa z8qQ~nMEO40nIaG*@34AVM8r#Lhs8U0?%ci|sh%K~EPRu+aQA+Xm{kXNm@jd5Ha~pW z`oPIEkDC^I{&12J#C>^?A31#dgDU@ZP4g8eWqvt7JUK8RH6>NYbAJGCEZH|{viywb zON%6r3>hzFupmm|=sl~j2SWx-^Y+eoU#e#yVK~g;nCJe$8yO)~YFN3``?iw})uKxb)R`~tO3=tfaRT7T^OR;9`AsA7LSxfCAJOH9a}-A3s{i(N ziQMI~H;*Sg7Od4Z+)yZ>hm)|mJxmnGzPd>mcQe>3I=Xz~_e0Xt*2yyBW#c|K{&m<^ z;P}(MI-gLH1+kP zYVQQ$66FOFgk^BKCDg*NN3v(0jq_F=J0zkZ`Lnf3TWhOB#<&+L3yOkD7 zG}+2xp5jp1mAKjK*0r2d#ivNuUo@gRxdaDqB7a!-sz>M{hu~o0IIA4For3YQ z;$~{o%4}30OMn%%&+4J6^Lon#!Xh6kg4Jv0u1mSNR#rT5x4z!-cYwn^E-;B-FKVdf z`XNo#+emP(knh9Yp@qeB20N`8;glEs@m1m&)r7iT=@WF%AtsUZ+c$SStGVv#n;RZJ zDzQ!7uO!Z=E%?O2gV(7y^H=TlRhv2Wd(?+>OQ+znk5?)L({V*U-!)hdjwbAxoGD!Y zJe@hLEY%L2M?P4SCTbht-rqm60q2`{bJM0GIh)c2?~A=lk0!}HD}OQW_HDoN@^`C~ z-zicy>%O0Wy)wbx0@t_6Zs}}Vcgw=Qw>8rZG-k6e6Ayw_bsN` zdy2x|Rjcaf<=-By)F5eW@NEl&xo_X*d{2!a$ES}9R~`wx_=fEi8@t6@^-a^vto0cS z=YMN`H<3!slUz0V;at7aO-^6$2VTTyEzYr>E%TmMb>^|Jnr()W$JSd5ht?Wh9vQLi z%|1^GG60G|b-zw3b9!vl=iEx6dMz=thfj-1`ub(tCzThD7nl(HX?b|v>Y#iR37dzP z)(&W{Z{3ib>_!`S($6aXDcJTuluA#nsa9@oyq#gEat*_tUrABi*7joJ$7MrB-7GYocu#-yt!C=P1+Dd` zWn}&uJ9c+$%j+8%`%gp|*B%Qg%TOmjo-y(9=#iO^@FkXa*mibhK-PH@+w5zT7*_wl zc~R@bA-ks}gdTqoB^+w+vncj(@l)p4Npr%UX$D>o(%QUs(u~D*PruvWOJW_79>w-e zs<~=aRiM0F%yNqBV#yPs69ol|tfvhi2Ux9}Y@f7MOHo5ZV_K$+w)Xxkdso`Sh`fFK zrn`6u9!j_`pz!tiOvPP0@6~15B}z|S=xY%_(QNPG!*43{8Xun&t*xt5)4_oi%Bq=M z74E*X7}>BvJGSM`<&QN=;_JlBlJf1gq<$%PNKP0R9a_4+aDUOqIgHaAHf;)WpOvX3 z^P{ zl^9{d@5GZ68&_VPEQB}7ma~|2jwx=Iz9nVNeBAz3uA!$VjMr~`seCM6p<7y1UO-U-#ozM-Po}yRUfBt*G2- z;PdlGspb3j?K^zrh}Tlw%6FD)uaEJT)Q$P<=pm68e(#O?^oVVW)r5y;U!Q(3_8D*T zw)*ay^1)|YYK6j{EpblYw?Q>)K4Xjsu3(8}%B>N)FACjM*6cK2*m(KW zUjvpXG|3)+v1g!6q^FsA>$evZBb7ASw;LX4-ZrN{d~^Fkd6vV$oScythR?mfRIlco z#b}9FTQbf#X37-YPW%y}C8kG_%>48zX7I32V|K6bT3Rn0ucfW6SUt-?Yf9v5T>8hN zqN2cz=;?EXUX?oE&>y3?bL3=;170!1<2+KDzZ~0X8ly0&=9PmW&?)B z$%@Q+(D-W0kqL{8TxCDAFSSJ0KcM7$u3x{tSTpTlIq{NudHMDCyA}%KN|ugNJ+0M{ zyeQq0nkc(t(O~a8t7ARrU+WoxXFfj=+QBL;PSRt7W7sf2aW{;cC5H^s)lt!A@7}kG z`7PmLpjVng2`NsDAaq$Hrmbn^kB?I$FEf=&ckcRVXER{6*kmF9!lvPiHno*XJC9m* z&-kN2+$w3^VbVH8eSHrvdZjU2Zu{I>qIdVt$tr)-aQ4T->evH!%+@N&SiM~Da5!TD zb5hMFF}oXu^aF!iB}ZQ0pI+{o)8Jh|b6H+Fc*9Ol7nf0DFg>0A@$izmeL1=jZ!2G1 zOb(<_M7+*Zr75rDeRDRLd?;Bl-f&?>R&vH|9jg)c8@Bi>t*}^lZuXXg2kCWpXKYlK zrsO;6R=OWqcx&>MDOakhs?P6~5b%gxSNBy%b?+v(iHp+jXw=Im#e zCYj3H8)*l-93|?G6x3awP^2zF%hH#lJY6~RY=)-1_a!6xp?5)Jony|N@EIOzp+u%N zzPt<$u}=TMy2ZtLsZY=u#wWjscn{vgwRYQeBtp{8je&A#9fx^p2_U-$+HFDUZ zZy)mZOr8`cK^|&$^D${peSrP-ztolDEDN86yFz2#2BjO}sSE5y^ME;7;8jr{)YtFPwZh@d0Y`%co7rffF(t~c-6=G?}{ z92{=@=(X8fPh7ZrSysHVp=t+C0w*jY;(1E1>9YKcWy@O&3vb3?^td$cKzW;cV-7s^JouK&(a^iX=_zIR-hw* ziyJh}DRkG%!jopl^h8J33SN3Xh`yva@?8Ah850VtuN#iENZn-?b7AUR{JVrTnOAN0 zx3Pz|KDNS9s4i}92fR-kXlVgro%k87sh2@a*(FiCPMxCOJFs}Gp{RzYjkS$5u0+}Q zoVnun18*u{8IlX8?s!c-e@?J;m9!cw;BC^_JaO@Q(_8m;o>?OJ=&9I_x0k7rnIee9 zz|!M8c95ECE3&h*!OrBORGndArcfra!^dJRklek!L)_fH-aq16Sm{DlEXRcka;AmTG%nXY!a&k?8E~83T9NM)DSz?+gQDhXTr?Y76q<9w>my`_~ zR*lnlT6I(<^UM|z-x&jD`I|i=4k~Edp>TDA{hXDP4u3>6N>@!^e=A5w%5L&{;uO~) zt=R`Rers!5xbQ?A?)2l^5|Pa-=QtbY2W+r!{P=Nd+oy8VC4-c`PaU5(A~1R6G`j&! z``$HXxK>rjT_-)O4PzN*8raT!^l4{$(WQv5?txk4e9z|khsVelS1UU2xtgX~V-UT1 ze3aCfmof^=JPc2K|5WY(WcHnnZp&}4-FNJ>NwI{$Uba%ivdqi(mW_9O{j!p@T=Lk+ zOi?`k^Si1amE`1=(uq%7?7dnABHs-QHJE7qCU9G9>c)+_&|quiWVVN2-7Los$L2L! ziJKiJ9?Q@F+R}33+NfH>C!)Zek%oZPyt=k!fS@2`TTPD{H}{L~D_i1Xla{1@i5`f zv7KCgm{KMa*o})PzaF7JE_-i5 z8h~x9eb$gte+_XnEvZ${S*HaIpO%Uj4UGUWX=-Y!f@x&GaWdSP;e0sz!u*OgB<0^y1S>@*;E*y68H-!H0RZ+HMrkQ2qa-9= z)zoBdAAX`_Yl`J*a7su@8sg(q_4@T|0KB}c?20l|qr9EXLZ7~jeTu&`Wec*zE7msg z0u#V~B=83Fy0+A{M}@5A!^ZDZ+g(tglax0-Gc1Kd@i=hsAcIDu1qCT6E7#vUSam$? z#i;bja&i~YB;uC&8Sx%|u+Ct@{IvtKO|KEA<(JNxGe=2DNmNvHwg-@9>#pKJ=0i>0;gYyCPStq2njIJ#k8#7C^&_j6pAouI` zO&dW6O-)S_i5G(N3GvfckIT*tO1$9Y?EIpxuCBUz_nC^vDxm^&!GU6Qd%>c7Eyv1Z z(gViLwb}Q%@cyuuTgt!4Y`=FM*Zed^JI6FuajmC|>!NIv9ESbd^L8f(e1A7hb?(>J ziH_%g3_k4?W3@ff&;^IX8L=&Av&opNCmdoG0;6{XQs@+(%fK1-uE-1+w-$3qfhhP> zBB*4FaVR~6Ns3g&wpi=P;SV&*D8(Poi_eJdx>y9r$RH{?2nk}){2}f;1hm9LOwuWl?fB#|!}hk|`sPK& zYSXH!vc^8Jh`K0fPxdMlyvOLE-NduP~1ec2MYi2@OC1hTiT*96ay}D&jjt z{KSR_y#aTPsmd3plmn0{{UYwN*m>0|+L73gbwK?zf!0xX)NHP=CNL^4*c5+)3f>8N>43xiTk#zDcT}(#1E_)FOs-JM z=gz;wE6j%%1zR4d3k@tjDFflagG~V7ZqUgP^cY29(xRbPC=xHu0EHew1+xWLQn$ew zcvJ=Y>MUk(C&RSkq5?c50Q$i0=)VV?n}Qhr98Xwid}UUL0L$%U09}4#ZngtBD+sHJ zdiWw@zQcI&crj|{Ej^5Lgpi`)v_LmaV9&zBuM+Xln-uiTg?)XZEiiBJjKm3x49-eyDqtv7b~I$}(770jEGnHE5*~ulDRi=gabthfZyZ0D zRdF|UvgbmG`XB4~+RA>q1NSv_^VRXKg{7J64DM^RFIIb~Y|Pson?vj>yucgWkOi0@ z8#oI&lN2L7}Xsk%LFn0vAJ@PoDm>_Ck5Dj&3#f=>e z=s6Iq4W3^rK2V{rIx+()9e5}}JL}63ux0VnAz($i9YQDrid|H|d!msb5;FwilSO5R zlQ5TtedyoP$;rW~7XUbAx`hCX0nRtafFvN=SZuf_lOQ|dp^zVCoFLCsdN>7PhSTX7 ziT4WbbW;~o+g`xsl<5{+z*qo70=Zxjb_G2W?l7F$rm(_80M7s{jY9J8GUJdl`2q1y zrBf^lO%pqeeFAo^`S-|>!Zd&kS^kI4ssh}dYS9X3EHy|pt^J`uDto$!e~?TQg7^t3BSxZ(~ZYfc$# z&*q#*VDB732qj(^*@%saK^QRb?8N~F&+%^vy$t%3nEsroYG??kNKhFv1WeL_jkF&E z{23IMB2V=ANf>y98??RW5b)smq`+-h0iG0yNGDS7q7~?nP|!Maho4trQot!0Fe_#_ z61MqgZSSTzu3(pnV zf0jh~iQwpFRSM6^IfqpXL!I zQJ9q`8UdM-L109s;BX*t(<$hg z3J>O*9*8YASQ}fhT&4Uyai~Hm>T#A64N&g%qBvJ>e*spo)%!>dW9F z1EXRf;V2qVy#*R!jL$tYo}+&vbviNypwrxO`~V&xt`Wfjk;US8Z^m=`foC!qHmwMf^uL>Z3pY)BmRVM~AT1o#PDkTYdbuS$%NBm-D`-b5sN1P|D5g z5bO!;I8Z;-K{LWLkRWj^C{*yBnuQ_;8a9O9eUKzJg$z!T9X>&K7ttJ5W?*qp0O!L8 zGyGJH{FvZegvS&_@PjBHU}(4*I-T?J7mNr7fP&#__`kWMx*9qg&ke5Bu?CsO0Ha0~ z9o=eecuGg^`4)p&f#mNGzdI4p$SBAhB6#gcVzVhsx)+~ftAjZLdM4)7;wq}yc;mk z54mtmAy7Gi0Rp%@1u|DGk~vpp#6)KBhyjM+G9MI{#Y+RQ@-$>`BCMIZols3zd8L}{}cA>mw#}5i2tpj*;)UiuC3Xx z|M?TCU;opu|LNEN^y`26^*{akpZ|aKKU}@eEZg3cI{g=a{>M~6vur!-e>mm?{BJsI zfl%}G4%X?I7MV1bddVKr7Ct^J|qCyb_w>3uLAB@w~5Un_tn>%1N~ zH+nGl1Xu-rNPlW_(^YvBMvFnGqFo6TK!S!6(cpw`L^a`7FjA$O5Yd8j&=I0a7qkRs z_l~~z!U}-4p7xqztNc=&cY3(?2Z+qk)4nZ3G7(KL%hNBotyVB0lzKx~DFK z?pFN+jS0D`AHEAm{MINW-bA$P(m2*B?TzrNcDe@yt@@(bRA~9ZUmu#maI6!t8AAK= z?^&(Ho0uMySm>N_49T#2R=h>cQJV4en<|J!CzTP_7p67>JBtfyvDQ&f)V-#Qw-ovS z6*kQsph7iN;B{wBCx+L~Q1U@&0V?(h!1i_c&mhFKXa595)Jm~WF!GbZKZBC1DEudI z+F^Bjhm=Q&-N0x?#}<0e>S~VhE0582R9|;c=z>=qRVOF9cu#6k0H_&GF_i9VSXoU7mbYD;j_V*+6^rsYh1QFf|fEv{H z*9!7vMuf(Za*$}9G)b`7H;ko9-R_<8ofn7u950vQIC$2tZu7;x$-$iwao z(4NtYs~jb+D%8))6Mt^_3zIyX94b#l2i2N7&(D@nPZw9;@t#-J#=t z1mL?N&9RYyt#ZnmhO>hhOqK!sjUL2FfegePNT?*l5sGh!0vpYnM)jwVs4NvINBaSx z6RT~`2#scozBqjwO5LtnIU=R@oO9h_W6%@O4^z)wjauE>7 z{yn@?#DjPLX;S&GOuh4eOeg-&xqq+xUsFv>r!)W8RO`S0@ki3{W^Y{n&s#Nri~FPB zTzcgGP?-}*ji8{ek*J|mXzBQ0wG&|47*+^76fs7)Z#iGEU~YGN1&U||)Ey0rvrAwP zpb5?o1`~;i<$I$7jS=AGSmVwa?IqEFr~%vp=-oCodCK^_*9 z=ktw2WpRh$k6MiISbTfSOmZl@4=uxDy|&!r9{CGfBxg?e)N36#N6s+%wnzSaGY;r9 z9V)DF>{4k5y!4cMsM`zNor?cs;CtS?`Oz4{3IqVfAU!QWA_7%GAe)86{##C%YUdf#;=Hfy~%$X8eQc-b~Hnhp^PM%=sIH%>a(Zrx%GPzyST)uJ8-;RKNW3 ze>wHO|MOVIzoh?HSJTw#vj6L7>Gtpce4L_09NMs z>VkH6VD~`S42&6fGS0)ima#BfH>e39hcj7J!2P1Tl@BaPfUh$U7gXR-K;@3Ef&nOJ zO7~~JLCm>8DR9A?*2S(<@&7Nu1KUubtU$zY#@*zI9FrU(;=@C=@y`o#%i-~uqiLQg z4)m@E#%Krc%kar=cpq~IM-L~f88cm=@WF=y^PW*a!24KOI-5ILIl5Rm*u#2%}KiY%&FMHpBa!v2`H4%t`74aYTJt^;SSP37l*<;XTq@2pZgQWWBmb;&>!t^w7VDW z=p4A4o`2>e7_{~eTm<9M-T_eXZ#zuw&Pe<2?H6>^P7`(_Fbi%#BgE|pB zK}>rg;7J2ML1dv%n(zr70W7HnpU@WJlQwDq_uCl*WJx?bXUK19{5MN}dv`o04i5&H zEk58GBHUvPCkH*maEo$|F(M)z)WO_~C*4?Ys}S%as4iHflXYZFEX;xrD%grJ#uxxk z@Z`M2pa5^NA9!9Zp7YUmD@ug_P@@Q-pW;Nauw+S6STPP0UW-Az;A~O%ou-Dh!N+p9bPZ)ym2ND{DOds@FtrJT-PJ3 zh)BCNuyK3$e51iy;yY|omA<-3B2G>8U}C!Trq!Q7+WOkTH+Yf3rc9k#%mcLoxK6_pfj`N9^p( z;$4N{x@7*{eep2T`AZAusP511N}7CD*fg{_`b`A$5(4I}M?W4NZ032onm|^#AD2)7 zo0O9yp#OruTyt+u7yRY1Otc{Ei~s@cTX7UB0+0Rmr3wc)LMJsv`%(Y}|GlMPjs^DM z-0I<6h~SIyf$vldy$gfgxj=20-WNbXojgIU zs|{Eu*L+Ag>SCSeUGKl^;~;16z((5H9;~}>huyjB>*lNBA2yKc_rm|LQXlsJ zuwS$O?sfmyR`2Zp4e(p_e*bTOB>nDfjJN-X{eA0i%>1XP%^x)Z!kk;QZ~I}i|E@j1 zTQ@H4*4-k#ns)QMaOsi-6-qo0AN;jC`E}_oms1z@z0s*^2X`;sW^*cIUNJh=?&Jri zhZmd{xc(}zuLhj5-S|1c?8!kTRPoVMxxRdAuxIeO>E&}J!R?Ay8&frlbmLZ`lf`?x zZ-WkdG@lcOp5RsB*RF83(cdi1K~(~jAv(jV2$2aLH*j#P*f#;A?}O?ED2`myw_f@1 z(kIadrryMx-yqe|F!BMo;L5=SIS*yI5M?=kL~f>moSlK3b1z11SVNfJ3hAn?v$A)# zbaFwg>|GoXIToTI2jpSwe?`R2)YjF~8BvgzV?n1Jynhu5eQ@Q`W9rOfh}|&{Vz*p@ z_;Z}~sozd)g2=`3-&^#3xew5O@Cb#@oggWwU_tyqXXrA=W~Fa81p0dJ`0t?~PMh4( z09Xt-=u_wm;`oNqXXO1G!}ujOz!|{L_ko@g#8_VrSN)eo`cvOi_vb%5(mV<@W&S;V z^m6`F)7I+j|65yEv;Y3@A4!w2;~ICu+if*dHz%;q725Tz!{z*w0c$1O8@mfdZ&NgF8+V|>Hp89PV^5a9OVI;93G&ls;-S_s2gbLcJ%Px`z}ej?`2@5mC`vpFoGM{>8Cj@Uc6 zAeOVOoL%_nmD>PHkk8yd$6s=z5w$LHrqH7Bmy@&7t-G`9V2pU0f!Gv27}%8J*?%+ z!HX=n7$O7B_4v?&4IG-2Qc)XGUP%J)rFjsEj*1jqj1f4Xp(iF|UX4yCC}`{Ek0?_y zY%5a`0&799=dSh=vb-J^5ZdR83zIz~65gLd4oF>P`OF(CIw?y6Wov=l?&FxL1Q=$OiPTA_4w1Z$GUQh@8CX)J_?8 zoRd2*!eDJaJ&*kQrSU>oED*<1^m|3 z8~soJW$$l&p#Lu4|8#ZL`|p4Jk<^*~vD0Z!#EOboj z*uj4qMgP^QH~P2xRp;Nh-sxYb^ZhSC{~G=D|3^}1`bWRV^~?a!*GNon#!8q|X9UK{ zqD_M_!=Sx&?{JBLrntRd-EuRaFZYi}twkh%=i>C9_pk zE$z`u{N2Q;cX3k1Les;VoS(`pw3>=P+n->9H^PFv8$k^kC+0ny%BE3FY{N;;vuq8Z z^F?^H262(@9&#ESP5u*_3^c+@KhVpcTF~J-aiL;acV&f7$W2#=!~0f z?CLUISr4{iq>ACh2*yA&!Q+kmsSya(-9Vt)`L85nSY50i+pGC$r!0Ma|6 zoKA|M29hw~z!FyH4G#PSg9)dhxTI0rF;AuYQ=(8FN-&wp2%$jiL9fW1vOSib#E76U zBdC-}f{7cI)jo(B6efv=O#!I*(-r_@V~4W{CeG;JzSZ$(MAB&t5+GCy&ab}JBQpWA z*`PCX=41*9-s(04&x}6yiY{=tk|EWQ*o+Rfj8r*j3%j$ytE zlc;nyHu30uT47IJ*3D0bz~2~|5fVy;D-n(Y{v^@;`&yS{P)p(h0-w4r;665n9-P5U zxG+g!K9~b}f{AH}9}Lq<=`#|! zI$vH3kOxHl?a2sdvKY+vHqggD)(vH_*f5BK4`9_4ItvCiAecB}nJBIIsTEYa+@T4( z=)TuxFiB(@r9*WGG^=;Y;ILWCC<+kY;FR=kh1;G?{@>FW9m9kj>RQ zcdU$UDqwpE0NV&fg-&6sa`qJ#SC|BtgE<&UcTj1gNd4T6bTcp&0}z3B>bpW9}ULprr7Cvz)n#4DY zSWBHZB))y7)1JhUB(QBMNCWl<_grHFS6&CZFKE4e`au~`J=Db1k3@}P5RnK5c`}7e zWs(hH9E`~%Y`T%~5F`|cE)+TgpVAes@*VjzCpN-Qeej7f+e)sIGH zuqkAc3f?jVVNn9Z!H!Kt7~x>)@tT7{Qowc%_#|kTNd-bT=o8Pw*CZ;Ng1Ytf;f#b} zg68;Rgp05keoP9&Kww}F8XIIot`;6b0)IfU5GtMI4;!bWZ&i#`L&2~ChBVtTZmw4+Y>#6HG-Y=!Q%qu~ zP#PEuCUJNn9xzH6UIP7egeY{Xte}X-79yjf4`>0P7v8zx$~<_~1rx6_|7R@@7|NKg z6>WtHx@OYRR@fvz3XOz^e(*bZUm;jHIXEINre?O5U z&`pblr%^dJ$?yw5Higy<7FWCg=wN}fLU;tgHxcW?m=MfhQKpg6Ow4oui6!z?2Lb|v zLPM+>BrtIy?bSlie3f7kL0O5SIY~Vml=s{OKMNg0rQqrMU}&wS~xCO63d~ zkSmZ1_Z=4WiUhk4f zEI2KlK>`^Zm^kPQpn#=}u)_ghuo%}Z55J2ZlrlNL0XJe&FgEPafq}8$&0F-m1GpxS z85>~St9wp_jktS4Xvab)Lg3Wuxc=Kq_q_gj6+0|@{+b<@J#VBPId50i&Sk&=3+-GU zW4}Pw@`v}4naJdDY=ms+$}fPzq>w4-ropX&o&U&?@pBg(Y>F_2y!eAO?POT!^!xNWQw5S z;UL<(Is22yR3Iv}Q$CqNgBlyK&}cv^f`8#Vd z6!2k=u%rlNCv0_dprJ&;z++VGKu6&LhbRC!gc?94!^0*XtP&DvnFLA$VgURd?Him) zgGekzj!4v5(&WmM95J)gTT}zmNdhJL0l5xUI)!$Trz1!-Ao;$H6yJ|B769LMrvAMrsDPS>0NuDbLIhqdh>o=`@Wf<0&~vU zYwf+(+H0@fDhO?Y{gTXl#m86m;^+?`7{?58SG9&2nm!1hB&p4azkKp6cL0cNzXtf z?Lq-VT!!H2G3V5o;Vc^tP>S!@vb!o>r^Ei=F65r5MwMUpZgTb+4{7YxoSr85@C1XW^uf;*7} ztIfs~Fb-TPe5|m=`8d>{!C(-+N?WkPFm!___$Y&UmPTrvvS4Y;Ft6mG6oyGzo*Ii% zfw2Us5)@I0MzTbednql=;?uhYSi;J>-%PaX9qj-jP8`GidC)H(lY6y_U^lCfhVWJq z-pVSR%@FW>JnrCt8(5dXUoJg!^1L}qskn@%3=BYoA%G{udm4b7t<1#M^U`IA$W;A$WU@ zi8t-SRuxEyWjSFnj`rfDZLfU(dp_*f5gaIcwlfK%BIIt z942LeMw$x2ZfUb8%ik9i1>T1B62ZEOHCW2)Fq9W7{4^2dx+qR8!?{tnpc|KWqI^W& zX3(zLY9QE~vrbm-d734@fM%Hj3+RKw$r0#ld|Jyw-4v;WNes5rwl{`SFs&(}V_H=W z=H=014wm9ZBs>O@9%1(I&!8R7EfT1i_leP*I>1fpNt6b)B^Qh)2)P)pbO~*W5yrn; z(T4df<*-}9Hq4Bj=iyN}fmn?jX`Bz{Ekp|3!A?A%Cpest7{SjQ7#QwA=sXbWKs27_ z2p8Ja)Mfg_7RmgPbxk0-pb8lCgAOUpjmX##hFWxNQ4A;Dn|!+qP*u+4{}a$E!BySS zLISG>OL<%s28jq192p%P6&)Jh3Re|SRlfV)99q2vvU;}xtACPDyZEnbc7De^Zh`-X z1-IG%AtJ)J|Jxt)@!`Kd{MU#7{x9Ia0<1zHU;c{^_x0hvKHS%b``#6}uWt?bpC1AC z0DxTs2d3?9@W3E2hBx>j-nEjsyn3)x|E~bG}Mfe~C z*8)+D?U03EWMNeR6+nJ-tI>sJS>CV&FH%RW)o3rJY0D6C6q$Y^EAZXp;jhkz~zFO@50B^(5gff`D$%0#2#FQ*{& z-asX>8_mc-Trw(fLZATNsNC`2c6cIxH`Fu}`W8G6{24tAsGv6_1NpPU!a8@F#4vB! zkegQ@Q7oqx7p52%D3!pEU;>j#y)=cxvf63PEg7m36etSG)QYy0dDOUF%D=lwA>LGy zdJ~oKXkjWIN@_jK^|mrW}rQt@MIHI8RY0QCoS)~_Uu_ME63LD zik<~$3l-q6wSA+;NRFmAIQyJ)nW>S6AR3VssdmOj7Wq0TagosX3K$DMm_vL!<8TmL zXf4HgFgCELu*h?81GY){dD1VDSWVJrEOM}p){YU~7B4d9>!5NrhGv5Z{doQx$@qm6 zpQ53;b3{VKc;NALK3p_S*4MgWw_YUV%&TEN@ZQoxKD5@Vvwa$?j<$g!6|~L4QYOaC>I=(Y7_%6h>`(#^ ziHd2YwVItTB%x#n!&0o(#J@6yEdiTK8$Gl$r{`lXltylGj`!wkq;JuCT_8Pfsh-b$ z@D24|a|x0g9Fz?d@f2R5?qnrF+Cqi``&VQ8m!KrD87p{pRu5w#Uac%aiIjygS&`NO zm6sqft^i|!p39hB$pD5Wz>1C0IT$ZF7z1(Eg%s3ZW3?9oQ^GS5A}VGg@B_a^TP>t| z$FoEn)DhBeY-wVh5+EE9L2vndr!@<~Zo{ci%>=W@RShP5GWpT@L;}<7DgaQKteg-!xk)c6c zO1hBJA%8qh4wHz%Sn*3d2^7mh8zt>oEY2@_S3UA~jmyJ$dGlTp_nZ=|sf2OPUESqP z!6aSJkVODR_@y1M{lG{;PzOfI6hKo=_>Gi6oy{*UNvI>a3k@T;ai0L&Qz+$X&{Kj^ zUF_XW2p9!%69P^lyjIEiOp-Li8=u+CUgR&~LuuM9cANAuCcBkvmKLB?1!Ssa83Ec9 znKCVNl$Xw|cfljrZ4M~Gqa6FFE9?T}yQwqBb#tEu zNyBi&$)|Y1T=Wi>^_ZArS6k%aZ(PmA790{d(m9(?&W5o31ho+hsnfh%k? z1c9G1QFe+W#4&NI>;HT9&4sAB&Tn?6-lC#IMnp^RDE0QId#l0sx!q5@`9Jpw=NddFM;Pv;Q11G zz69RClE4$jzgB4$&#koXENz$0#n&z*fgio`>RTI4J5xi^V#W@0Hw#SVVNy&R@KhS< ztoA}g>0xL!GkSuy;3c=TP0zsmuE=47o_Mo1Ob*2##QJ~Bz(iR94H`Q#bED@5tpJ^uRx5o2pVT~ z*z~jzf3ZOZ+Q?WKOo%sC6+DD8$y3C#geC`y6?VLD0TB>OYRX|?jLt-pg8;qqEU-8T zGofHmL6I=NB&*Xo1k@#De5^HN!H0N*z;sXs8LT*JAku`Zw~Mp#c!!$1M%sZ-=Rh!~ zA}mE4p3D=WBNLf^bM{= z5j)(Bvq)!U3nfn68Yd7~(u1+kCAb|yU_2~sGKql#acxGA+DW)RZsiv! z@FHUImC{1cpGQj=R%~?GEWnZ`WuP~(R*CaGF}Q*sH(E{5lX26)%NvN3W1~H+mD0hy zpiKwhy$!>1b>WoD-(m|PvcztmlN+#SEMj~~Xq64u0wPX}ow$9gjj(OqT9^HZwJCCx zsY=r3$TV`K$V6(5DqE2#PegvQO!)36K{*O-iYiNs;0cXPsU3qBsS3OQU;C==4N5*5m16c6Q;DlJM^WGJ*iRI5UmAx}yn&&0$s)Cj8bxx77Nw}t6XkF*UJg|wo7NFt(5i%V znIc1i5@i{(WH~9N0xB9YevGRg%1M#qOPHSw{v~J?DkW}5f=a2?z*h-0Q=@ej%~52^ zB}k@GWMYXVX;c{!F_tHkP!S?fPATW8U|Ay%mB1tTdse30Nf0H3j_#PpE%4t+X?W}Neoa#N<2Ul0` zX}WK1v}Jj~;8!}m?4LU?W20z8LJuU_Z*9Jse8uQLWOL*f)4wjbc70(({pM54*yjqK z+FK*(>HWm0ZWmfw?iVfp=%bObv4@JZmoHzgtENOR0n!3?^@TI!{ zIrQdZJ-+yMrK;(dUw&z7s$9DCuiD`Q=T_D9m(80vVRUqeU)^!h{dF&;{_T_FqpEdp zWZv`Lo;@c|oTz#G?Zl)cAR`)Ov)PJ^&s8VSHJMC0oi0qiyo3}3i$<3?qAdb(1%`uj7>moI;{U!-nH_f^`m#vQYM-rFxV?Stv@Gg~$-)&=bRp!96q^ViESH6PXv4-X1j zS6gd2`uE8P9x*>6?efIJoyU(;B2gd7=;f31Mvsn)i)%i6w!!$mV#xgWcE``V^2?Yb z1yv)@{M;|H+peQk#XqTS6Sv&>Zs{3A^Zm!KU%x(c=FIi$*E389nKU@Kd&h07R}UA7 zqWaHC^n18}|FH8c>NG#)?fV|+lO8Y`dRy3=DMPkQym;n#-HaR8FKtb$(Of7NcU-V) z)&7{0L&0OOh(uwLv-Z?}w1G~Wqg@@=-`2ck`OKM}MI!%RJ9lk0naz{S%MTnl(4%Kh zP|&XvVyhZTi;H((dtzZ~Omy@c=|f-KCVlc@ihLF~O+NP!^L&(D?W=)>ls8IZ6 z$(z%D+UmGoo>6eB(9&!j*6X7Tb9P5m@nuC#`CoBPb#o>mcf zpD5pCdiR}oPF_BLDz)aDg9l^c;-33{byjU{?Y?)|p>qe0+`^ukGYaL0ERKkX$h>jo zr|Rc_Jh}0WK4$j)uXpb@p4OCB-q6K%x^(GMRZMB1pP%2bVKYae&rkeT5j5_~l`G@V zX!G*&9FB`$RmOyy;}aAL#ZyncmRhr6)26wvydv(>Wf}t0no@6selz$XUEdCM09in$ zztXCPAb0b?Vx+K-$-~d1>A8!ewU$=MrJqglB4-1_}taW}e#uIaVtMQNw0UGA^0tqlwd)7EIh;b(TX zczXP#Nt1GO4<^qY*tz4>*|TTw+O=!NiWO(hj9;ZqeM{Y;Lx&aB)s8v4&cCo?h4Osb zAkmaLb9SFJJ~e7eY9}+>!j~yuPKf?)c;cGj!zmd>U(E795>#5;Nyb_Cw;jn;MG@O?InIJDr(ro7$DCN#mdWuNgCTTLyl8I{VQ_cYU66iT*P7haX~BX`kq6D|q(V z3(vh4XEMDUI!K46z>srf>+@BqHH%(zuZ)O+&D1a{?H0RaJfYoEDVZ+))u=bx_v{i#!@?%TKT(@zuozBK5` z=dNA5%ubI#-rPK}XV1pw<~c*-7p7KL?45WrJu5G7NoviG;pdLS6SwsD z&u&UQ9%sLPYG|*VX9b_%ZClpXV(jmKc+H|&33rPdZoWE}o14EOl=iefD3_`!Op6`f zXR}jW7t%q%m(HFQR9xT2zt|G=>#xP&pwkwlAAF=_ue|nN)t&k-T`%6w&9WRDr$Hjc zOgiiTz@@dd{J=y{*1?2%9(~J~`h=x<#AGOj2}obkuK%~Mh0JF4EEf%u}4FZOGV!1wo?9_*L@Eeba5RS0odvU z@f$Zj|5WAX%H~r?k2>gvKh9oRnxC(6=5xrW;~Q^ViJO;f7=M22fWz)NM_uM@*bqI^ zuqNtD?Zp<4dnKt#@z=8WUMXvWXFTe4t)l+&<;!JdWg0^!tfp)N+-Kalj|~k!X=&|> zhjNh$&>-1=JVCvMvBWa#nbhYFI@0E;VvAf-F3Mdxm${` zD$FO}Jzrcn=vM8j{>z#~nGwZCiQzU%EjL0QPYQZFFv@+JUSD->$ELa*$DHUjfn9do z^7b}a>bI3~rt$sD+ct-c$H1Tab)W7urZ;aJd$R0eewy2vLG~-M9-Q#t7y1@G$ags) z3Tdui_x$;uriE9ZT}t)u+WLOakw_1|>1Z30Uux6W+KWevUMIPqh_bibkK! zv)#Ky=H{vnQ;twnEG$cD3tnmI)TRb9HTTW1&FF4&vYSXOe);0XP4BbCNppHAEBj_E zSr>#4b@)_U&VRa-aprBqgX9BN)v1dPRn#wH=q_(*y7bDo-@X}X$wRF*saj5N-gNIt zE;+T3TQFWjT_ZRnq|K^FkJz-+u8fZZ4!Y_OnYg0y?W5!!J9gZ==Qe88s3Bo<+}+O! ztDIMYHFE=qBW#HHj^CF-l>j|W{7SuC?!}KeI4j|l7r(KwVr?X2)Aq$>7uya*PE%UB zcbrOaP>^5L+9}b)h7M&uyRyN;)<(1We0f>(vyGXL9IXbu5+(KQfB(e1b$)%uk3RG; zc|>jV(kCfZfYU5If3A0!gSo%Xz<~(~37f;h9Ey5IF41?1ExdB&3Poj>z7`;?CMO^l zy7q9&{!%$G=p|d5Mhn`oVIPxeH8XTXc%A?K#)|s%D_8C$ojXleUR0%V%cA@Z#37cJcXKxGv$5Gbv1P`p zXveEMlMamGb{nPXc#fB6KRa%K+7w4em6))s=Y?h6)=<)Y3w4c*j1IYieKj2t*28+o zlzC2l4+3eMl;q#i)X=0HP%)*VDyDz_!Y{gl%G^OZIz5Dp0C8&4$#;BS>$OiyJW5ZW zGGZ3$zTj=kc}883u6d@X&E9U8jVA!?F@Ju^!-tN;`V7_8-A(iK^Y>r=_Tibjy1K^3 zCDHtCVYj<>y;xmiUp(KZtC7)skJ2H#cJ}M~;)U4>k6>1bt&dM>Wo4P^oSX4$0`%0@ z9^A5J+LS5R>*@mL&6~G$=@+0c0FJ^kdG!16X&*0$>z*=u?w&{@jhfT6*9&0YVIzc& z!?J9YW~>}%X7*)L+wA6-dkppt`-wYpu(tNyyLVgbHcqm0aPSw+Ir>_||8=d-q-7rs z^fsGDK3JGDC8Fed=m4!Fwqccx_3uy8M(f2GpNw+V-*x23kqgT|)4Z}5c!}N z&w2DHBO_y;7m3;p(9*@WC+~~F$$rPnLMS|zc%^ce7i~`QgKG1Gk!y`xWjSQC4|F_{?V8Gt#8ihiiRRx8^)ko4Y=?4{1>9 zowH|$d|Y;0c*(1E7AO8bYxd5k*SAf{p)jttFYwuk=+8s9m^k{Oe2m zv$D>Wrp@4o`9}NOiCXb7^p$v z)%qahr^9M(&0n5gUEgK&TxVzJXP-?%zI?piX*mB$*4z*0&z?P%qP1=_ zS=Y*nSzq5j=-rB%oi5KsC5irkq)(p~mS-=Y@MN{>Bd@bp^8yC+=&><8JUlZ0Oz+A5 zqY_WvFD(4@s?aU3c3lsh{B0x>$u;3#`HBy3zt$#=<*3|y)or|G>GJ@JT8>j(X2R6D zt_7>U2s~M=7MuSqHivx0kw@23RzH8v(9zMca~K#MJ@itRgYL}5J`ccuT}X@g zF7d98gElgq;xa;Aeebtvt2pBNMX+I>*Zi#Q{soN*=z)IULu1Uq3%7+4vkD0iA9=FMy;mkA{ zMv9xInqxdj>E=sK#@@DTdv}8ODB+F+2M+Z8SY5d}GF){vWs#4=;i407-#Y4@H=n$- z1%MeqNx5b}o13WsW##G9MP>$+K2=w~>Ta}sFn6odus@70t~hKo*HJ~-0w|uO+~wA- zotYXZ0IVLvoxgu~W&c5cq$Cfm2sk*um&^2<)o(&qHJ@pCoZ%Ond$hpYYh=V2bMv_P zc<1HY^DI`|MfI%RGI8S8{E5?mN<`UfMp<3p8m~8(89VtX$;5Q1`e3JX$zL}Zs;c+6 z>wEvqnFHXzkY;8sIDKPzS(77;O$Ltts;R6*G8WF!*%x(tQSR=RE|n`9=`S|-WtZHY zlSB`9yjwnr7OtOK`aqP~@bdP+@bF_RMv+LXudlE@#y6$7VNF3dpu;*1>th$K6&$?0e}8hF zf9T{(OP3d!nhw2lz|;TU7IpRePoAh)8LQ<0-O3_DS#$p60Qh5kcvOhC`qtkVWm%hp zo^t|Kl(qL%UwN6?U3pwnq2<=yG@C80Mb1?!z@kXKge9)=HsMx zadT_G4eOOZow6Zmk=bpndjYJR9{*0y(nL3|XxrXjV@F484;VnQE-0LN!*$Ig@+Y8& zJfWBlQ;a{)Kt#gSO4xEPj6>J(K@xo zUFsUdDrAA5ujXEzh{yqZvwVE`1-pQH>Jsy5|Acv8o+^cuuzx>ws`t9nr%vUV1-?0w zl(gj0cB^^bhzpMzJ7{Eaeq4N@LA+`1h?uL7N~=H3J5uZ=3{HD6CoejhtD!x2jfvIyAj8q+W6cw- z#~B;fJ-M*FrlzK;Bz*TrQHYn<6#r3YYh7p$Sf6=rcQZpSdJ3021K@Fe6p;81VJD|g z&l*=_JjT@Yd2HC>6ngw2F*tdCXMwleu~=3QnrVh*eFnFD zxVE#VW@!1Uug9~p<{VnxrHgj?awE|-GM_}cvp?ZUc63kDWM(Wy|5f^!AtnRM@1Au? z7OGmmxxJ^F_jpNRnW5g!dL^ap{`ZxS9R2#NKD}_}z=)<~k8?R2r(JAHoKD@HmzDGE z#jTXw+y|O{Lu#K`<&}-AB$KS1hHLc^Frqe0a_^$j)5F#6V@Ukq#q2fo#*eQPfmBFK z3mG>XaKEh9Oc&m}(qX?pS?1|sc{;G7yeD}~#`(6QgRJuG=AjO&0!cR(7kOnhT0OVk zJ6+FG@WRp0FLBMjfoCQG!mAHy@qgdcFlTY=@SO&Q)wle5tLUX(T$;7!$dN5R`6r{t zyKUcgYf?)}-NQ3Sr|a2&h=|NS^{&i++O+ecCXvNHtCgP@i`)Qlur{hk{NbH=>LTsy z``cPwTfVO8I@NdkFV%0}Ox9E*o0wU~M4TT+AFwdPk?L7X%h1G6`AI$xmi|($dd3zJ6 z$d4YS&Tfd=WAvFyeY|yCb7JwEz9XDZKYE*zV%GKY*1oF&XuJK=!szDSDITQ(zOQb5 zNl50YySuM{^JegxH8+#KCX)L<1@?zofVpNH=okd(rK}U1q(cnTsz+HwCMHS zrlw^dyQ-_K^+*eCYpk$LuIe?Uudi9s{{3kHE#*C|Sv7X-*jOhWXmid-fQERF!O zWZJay@{5xePu%~DzmoOS9F3v3|2Wswr0czRrEA; zXjXxT8MF%vOCD+lzunYWp~L)`U@&O%3HS1>rOBzO;-dH&n+_YHF&B(gF_w2azBx`AXQ^T4{ ze(yK4FB+5Ioy+IsvrwfnmI`yTv(mIenxUG+1Tr;Rr{Rr4%IUHEvW@qqiPs&DVP z#S|yC^h#GdtCDQeeUsf`ut`0Xm4}TO!R&L$DUQePy*r}e-hK7^4>VHK!ajc5{@TO2 z@8)r1$1WeUub=kYEZ@SlHyuB(COPb?4BGVNO?7ooRcm(#yL?WsD}6Svx6>V%ez$1) zE+=1+o1T`_ky#PfXPZS%KYdQmc)%F5s0gKNeRr~XylioGzn!-pr?C4jOIEe3yiN6; z*wxyVPN%ck277LMW(bC#OZB6ji=_{sjT|{>(Aj3c+h+6U&mTE*t@T+o{%Q+i0Hg4P){Py9R zXN!_FdTLyWI+foy94yuI=g%`UE%bIq{{H*(moLqGs3r#l=T_85MMVKEyizYMbm{vS zQ$s>Rrc9Z#XwlRC!>?a4eERbCp0FWSZ(h9$5D3UUdsYZCy1#pIU3-Jg=;DyA3uq(y zY!(*OOlK`T-ZeBd6daqMfBtz=ft>O}1R93!UGC?=|RaI4gEv*+-RX!!x4c&8xDou|~ zO>KCVv(eVpR#SOq!o6L)b|vgqCvWHycB3L7Ju=!{*_v@?F126S_U-B#8b!Wlv^_~J zX|b`kC)~l>-r4!`W|rf6=M^jA&r88lFE6iKNd>>D?3ycA?O#m!1^1FBO=JkXNu zbi*%PxDXK$am~klQ}g_8br(a&M++`6^l;B;^CaHy!J9rSC#C?=IYDGUS7ZyrLU|$* zWh$5M!=m`Gc(4*18WHE<{42%5moF4y73lQ6SwUz^GV)PqfsLTxL&6 zkq&D+7fZ@iI79}_AIGB1UW)!ABqW&PAt^eAaF_vrAM=F;atQ!ZBc#SWx=IOJ9-g z;gGR6WeSMXF%%`>(wDJ#ul%6L&{LWE?Mo`B48P$ zd^rZ<0Oq5^((Z)hp^5|xogi4KWIl2YRlXj&Onby^qzc3gvz?fMiP>bIq8SI#`tG1j zN&Z;4UEpkj!@-jrXsV)#$cZJUL@ZJ9Y_IsJ1!%Hax&Wn}cBkXpnPY{2A!{s!kTq6e z>N5$vL6e_JA&%UwWy#RmWs~Eh=?le3!Y@BDhD@*`ZbB>rrY%K}=S>&-T9OF`-q4R& z#F}qRaDpWh;P@hK!_rsaY|D`?S)WJ;G`!#ug(X8DG$!`k03U#Cf9Mdi}& zZKZ!8`~k^GiKnjQQ{XhQ0!1*p8DFkuom}5!q;7{q|came0k0y!(XGGy$UC;rdileB>$ecFXNCw1tFE+&PF@pn(bP300 zh}{szMuDDtM5HM?^RloU6{H0XA1ZFPYusV4!fh(6EUs$+tn1&>R*QDu#zAhtJWw4 zBrQOB1U6_y24T|%XP-yR14#CU$rgD?-b`5Jk0qi5mMtWZh)|kB7MI;{Meqfo!BEKM2W6pTk%;|)^*}0_g7f4H zlS4|j52(LOv6` z!nH?I+qYZzZ>=*~;X(r%01{y_EkMjP1SgWl5E!izfOZ4nf`e}%%Z(+vCY%T&3&f2H z@MDDrg^q+jR`n7JF(!&e=?nk|=qM*cWVJ#WCDAd+GL;6}S^Q`~V-Udm?vU>x)h8i(z797srM@m6$FQVO?6Izkwf4EW=MYZu;AT(6fLtj@Nb~B z^9W@Zd2EgZOTf+*$#f$bBu+(S6C17F2=@zYu@JYR!l6+h{zlXT&?EU9J3?3+SY0<}gmaw>>un~E!9?Y=9wh7_4K1j-n?aAX+; zL!xL(UhLRB%t8i=Ap+8ct{$0+=wU1Q~WDe_JB*O zbHIh-L*@lFS^`6YG7{D)=AucL+fgFU#2{oxTZUkSh(d7G$%pI`qYFjaDd5N~)KUfb z1)aTwFG*DlGykCVsxiwJfEXCUqu`DSzBhxZ3%?;?VN=EWrN|Wd?Q9Ire5_IlWGRsQ zf~n)hYAKQ_lBIJ3a|gTtsaL}BLA4xXJd;10qjsCG-If@^!23W`{T zaXphpc1DN<^vx$`VVB5I0Q`kAY7u(ih-Xo*W&&BdPw3#jebN=>I9FtBfow!-$;bJ~ zuZW061*ue-6F>_f%9|lLQ7nNv(JBekfajSAdT{F$TI-?XxnUrdxEpwzWPM0(FtI&q z=!fFO0KpSDX;HsLyI_GRRulr^>KhPgRD>7?CF8}dK+>f`nT0Gzg4(x?m5;TA** zOEakxaVr(&Re+4xLR^W0Pq0@IJ1(GFTmhkxQEf3$jEn=yGcZQt5UB{?Hbj(3A;hNm z3Svl?$PQ3xkJc~XljX!d?v_<}1Y`^#eqbFX{Fks37T>)Sumy@fv{TU#DnlO7P~oRb z*dbrDi8EvbFjNU=7c017ZAUB;e?H-rgLFmf*L0K)35Q#t|- z2rnQya!?t>!n`+@lD1{hSUdS|H`|%O;xHH?_ZB?=f*?t)7jX1g?VEQZG>=%Fxwyj2 zm)iB?9JEC_n(Rc8@4ihQSf`6ffqh0wF`Btz(Dl#oe z@daJp0Rvs0Qpih3lm0&e~HwuO!i+1P|v;(lOjFN{P zE*Vdjlyeb~7S69wD-0?Cr1gjXmb`*3cPy~rr+-FbwOa~lGk;QW@udO_Is;iSZ7AXo z1B_0AoZ`#LDGH)kv>Ohc&GV*9qzQyVBKkir(ul7u2HXjz%KWy(LN|fW1zL8;yMTP$ z**4fOW{JdbAAqvQ6DlxXAPOGh&_Qe!IE|p}pP*#`OvYrxnpaY0#g#hq+eg?zL`nF% z)Cta&9}2;z{V!n&Ns|CVK`&|hRp7}vZJ`Z9z(TYQa6X`sk6`X0s29>{dDFjROHp5N z$CQPAt`8&dkY+pEUDUTs!Rbo!J^bV$4gv^}I#^mh<-5Gi;9&Uj#X-oT;KfX-a9QBW zVce0+5=a-?8wy|_=+K3P$N_{XwLxNH^*feJz~^unbf$lY>xIA285P*Egp29Reo(=G z1{DZdB05;yPWYS5Tlx$>pTnZ_I@xDyz{in+db5Od^mnx2t}bkfg7x^_n@rqX;?e#G zHko3t;M@@VP}nqRjzQ-D^njTwz(O&Ra-ZM}y2wO{^F+;ZunEGDBz<%=G|Vr|WijbI zHnfIFq%vWf`6wwX#H9btCsr{Im1T?w2F0L)zpZAFS%mk$8Lj${;aIWY z8!%QZ_%kRLAqaHw|4n-b+Jj?P&7Ihx#5sLFKSKsDN`I$<}#3 zomx1ss^*Zf1_*HAzJ$%?OXNM&wIwJ)Zn0|gg1co2irc%WrMkyq(dy@}QBX;OQYwZeYo`t!zQGctK3I9XsJ zHAZ;L#dss<8#|J^JYCu22~VbEP*QFR9dQ!E!N(7033}&=C7fA+X#4sBbZ@EW+yEu5 z4o5)$`y-%p7SrWNA=@h|jU<1`8tza(b|*>1##5acu=RGG;Rw9jiKSwLe#7$wWlHHn#R6R1x>94fBq9KX(lRzaNV2VsIOXqT*$>+d7gdK@~ zA0Py=S2{yKGS*%EvH(;(B=n2KOmf6Ly70RO2JgRiGBD(ozcDb3L=+DUgZF5`3d}h~ zK%pH3wJF56@LeLt#q|JdjuiWQqp>|G2Scu+3MmXp(Q`HoB0w*Au)PtsENB;tPL+m7 zxZ>_->`n;c$Aghrh}t0E4IS`h_%~ZpOQsXt{1;tf9#ohH0(-_6h&(+zg^Y2NJ-3!+`QP-iyUxUR z-8tFj_FMDqR$eO+$`LQ~K`hD7@#TLbZgj|hrzmO%26 z)Z2-DtV=joNH+$5#uwJvrJ#S#uceR?w&QjHEeZI+opQQwPfDT57LEAt(BLa$u$48` z@(7w6jNV{~h0M;)BkjF~uz$>B_^-1?)Mt$PasL0|j9AE-0{HM(xFSW~ef@86#UJGN zKSh3koB+TCts&u^*oo=ndK4fDxllzjnlTmpGa78ZIn5aKM}}dR$ibsgtkH1%_TNG@ zAQ2l034ve6NDjJd;nBe(n>(~E)4@lwfte_L6OwK0Y#{QU>g){AKD>GaZ$HUIE5aee zSA^I#92EUyfKSp8wf#L*GVWG@W^sw#4Sk5akmQ4EWZVxDA=utYz*Q7bt-!(w4+U=J z{MVTxrYOmBMa(oz=t05@Ie&!}{OWNnPreWy<-fKP-v7-X#rfaFLZg4M518d` zthspy`QMNqx%_WtW6X?66!U*@3?2UbAJ6~R;r`2{lKFdmbW;D(WVDI={*N_<`~M^V z-@pI!pO^p74v)CS6@?(SXemlZpF+~))VSY1183C^9N)q^eYe_rJ z-G}`3SM&8DuJ*s2t`Gg|Pp0UD7p4UiUpmkGPxSr|X6Lh)KKok<`mjeolJk9Mwn}>p zP!Y82@5;!>hnZ{ssYHC}ZG->oiTH%XUHj`9_*CUC(PA5nnu(;_jT?#_;dN*>ywX6y zUZwCCBjOGSLN*gRPVfg<#v&TodNJZ-@}-NY;Cp=VnLzSop)X7{1OB1FXi))+4paQ_ z2${#&Fk%~=A1}%6N&E?NX$VRvq&L*i0{f<85hCP3F$;8$+LOR6O{KF$#_A=;L-K6! zp@VsvPVC^$CRkG_l<=qp`77@@ee1#(v562k7X@V+*v(IP6;&Xj=*xXq-@pL*Hp-Xa zioly&6x6y8(-INBN;LmtV=xr4gd$zE4H)SHIu#2jNSq28x@)aq%Xn0!uH7sbSBjgp z&2)Q80E-Xjh`ogOKzP~10~}A=S@za$_A+15M@}tVQwqGG2Z5r#xv>EidCUUPg+qJ{ zo*IxnJ(2Ozy}hC1j};7KM&JSo$uL|FbiW+DwjA3hCqBH;L>E$QVa&f!mx?xOrRxVi zn9M{T(qKLqDrF^=@I4@t`792_iBAWc#Fc)Hi#(_Kq0c8X>Hm+tD}isS%K8z}4-ZnU&eN!zqdm!u|XfvG@~=B0V?nuNTBQfU*<-?SIZa$L0n9{}w60 z(PAh%6%arv34CK12^HykuR;!sK3a)fh;|^CnRc^SxVSx`i1-e-%2);GY!c2z3{wz3 zBc#w1Zb<0>w3_IOKE(~LJU2a9?8vM zqbbHp$gy(#4CtTW@QD%`*nx_|8u19e>aqLXph(JKw^1{ zP|`#B%N$YOwHfY!PQibPeh3pOnfh=m#b(oRbeXbp?L@a2hJ~yPLt36)$UT@^TAe^b zO3KDqEm-%-C}vgiLjWG5G4H`C#K%wENmx8$S&XM}e9Z&v60)U%a2pUhij^y9M-k(-3S$R}fap^jt{`e6#Hpk`Oc_5+ z_{x+k@W4l`D?p*tPLb6P{D6=u6med`9f>eBR4~~6S#3X@@y8FO<;*|PqWLFkFp7#y zh>5}felzn=(E9TS`?QMxOE;poS;kH9e^pFObRhm86&)GG|9^{55dRP2|Nq@AKS4`C z&=L@|1OzPse*#NDt7&=!s5l@^4?miURscW4LC_TNJ2D0MTLSpCGY8{{(&Ov^KIcsF zsq0)bqrz3;QKGm}0p8C=;eU7)J<8uD^A^>cckm>rKVHPxomM~*xcxlmdhd$?fp}L< zHF?17i}hrqg;UAmY|tGWJrVqZodT3V z`@EzT7P#;9ItWynLyx0SE<`G3DM#oH$#8))AqXwPgD!+z7u;^8uW3cJgJL~?ck*0T zk~~*Dp92k&KG2HCI>Pl%T=Vd_Q3R()NU7wCjiDyeQi$JaL$26pv}bG>9VO5+dUh zqGJOv&7ed3ullr#|M|9gw_V0f@W1FtRUrO1Xi#)8|Mze53F3c2{4a?A-3b2^HsJ*F zyJ@QFAnq5${erk(5cj(++%M=1{6|LsePcg4GA@q)VmdB<1_pOvKGT9E_crkkf|(D( zSs}=vP5f~v2W(N{4auyCpApke5!E9(4pV%7uv}tol3tM0*X#0YbFdg}VI{GA#C>d{ zz#5>d;r+VIZVT-J7iE7hAOD99f&(S*JP6)UW^msLvy_E_8zJvOW;3&P0;C1(m?ccI zxhcw*^BAh?C1C^b3V{U|+8bp&<^(J^vtp{_mQo-Ivo1U<%)Eipn&87v!lRJFhx@2P zp^^YFnJ1WOh9C)W*XN7vo1m?d30ji83cR2!v*lcll6dGIiYE^<3T zDo9-fu~FsxBo*pMTZ%B>h&WL6waKp?h_r)ezc1>AoCA1N{!QT!nOiHbg;Mk>S`-i2 z%KWJMBhdemRzwBJAoJE_K#1@uQ^~H313a_v-!VubWwyT2a)l7moGbm&LWjf}(_9|3G9fTkqdpxFUlhQiypLSz6W76!fp$!|2TMZif2lI%9z zWq0{c7SiOm$b~l!;RtDMsLbglK83{7`PQ@QT4;wE4{0oyv^JUlMrg;9F~LAF6zpZ9 zlybAkQ$GGPXn-(+IBfxq=gb*qk2s{sg_`rVZfVRCSMMa6wXlNcMlE}cke)RP%mWa1 z8AKq3fJ@B~_mIPXIk$6z6Ov~*k(P3MSu;bIutoMVJb5^*ZZR}X3J<%H&S!FpDQ{Vn z4goq?Cu2rjVm;n^?gbT_?D8WfmYHWdCT=vB8}B+ zhD=D0LwqSoJT{Y^HWx!^G?Ec54GY|fM_0B8>x#op(q>uZsb&YwIFZTAK*~!}K3*r5 zf%|R|MDb(^5j~t4skvnV;8EEeF3$m0l;Cj3c1Z?+(^^vG`XaTDZ1S8EsdDsPMXh& zB<`k#rAL}z3F5;G5(&7tK}NDop&7gkgh#@3`Y>azIw#DOq1I&?hqchniu^Y1;c~nW z=1e;b_wKEF5n4-zq%KbAd5FzB>s&-vq+bN&F~T!Jp#K~ql9loK@N z1Wh@APE(HHaUiS{{G;jodIJvZ%SEEX_PZ4eM1q|52*@3rI43im1@DWIxyWp#O6Vf8 z83sQ^%3Va`J($bu#+nbt8xJyDSSRE4P)r$@n}_ufw8eMK+3hUD^Ex@R?MCUkyf6lQ zoN--Uc=2Py6Qi5r)>NRo;evGnvQg7Ec+1STh+yDdx`PXdBCL(r2rFfy9W?P{=2TOU zA3_{ZOH@i|a=2XUVG+M8;IM)K5U9m6iydB4nDAmmu}hdR(sQ|F)DklfU_&&A9k{#} z{0_1@VcI9$ye%YAK8~VXh$arKt}-|5xH*W6AzNhL&z3aHLNU(La6iKg>!RJX#}}Q4 zv;`^*k$L0-m`qf}<0OH6_%?xF5NwbWKS-Y!Ibj*zb>qon0y#17#9|wV-{q?1bYSh^ zLlqE^iZ2Y&9C&S&7Ndld`wnuQkB&i3=|gs9vK9bL%l~Y?*@gM#a?=oMM`Q@FA2&@7 zZo#EQA8A6=jrbKAs3Wj2!2ey!DPbwf1u%kIi#Vj8XE6t~-Ihp^hccJ6h7c2!k%IY^ zwt<2KEibl#)mp)B(@>Uddr)~=KQ zyGq289t=z;#^nfbt)>`84jK1I1{}ZIaRz9Qkj0B<5jl}iYUiy%VoPXNZu7bwxJb?s z9nuXtNr_{5t2aE(Ir~G?@F;I3gPbo0iX>b{U4vkKB}@K}LO=X}H>;L0TiqHR$uTshU(2qBi31Axbn{ zYs%2)nGk-$pw^j2B7GWC>qeq1tu9rGG$V2i8lw^E4RUQxZnjo~uW5BD*?Fm2T{=p} z@9Fd=l&#ItnlMq59zlUTDXqo`#Bwx-lnne;ovh8)nno(+XKt{thPjH@0Ro}qzD zP@Wq9OEGEnI%r3VUS~4kuS(oZgGqdKxYnpqBDFzl1dgN`^f^j7@DsnGCq(djIt@n! zc#Zr-f**nJc}9&$5T$C=*_alVkIqkiw*pZA5`6l1ACp89l7t}BQq=Gl#3T7nfz!cg zB)|02I{qsnNVi?aP4M41RqXZt|FN+_{P(x`%*fTH-zR?vddhv;j8p^uJsJMDYlDAg zKXHDEOxA0aHdSq!xUZ?I>^0HRW-Ys?pl-JSQggzg?7&?3g+f)kgZSYjFfww&6m?J z*%bXY#eF*Mi{dL+7c}hHbYdy{RPke54xgT^YJcb2bv@&=9yv0mYIvJwRCe2`jW(U*EiW^Xk=ED^2)KcGDBxX4YPuS%38FZ@!ta)$-7b zwv+P~^*wHqsoD=WnZ7%5;;WOM`={SIrLdr&ASWj$JA3;J4?H@owtPH)TV~{^#od|G=yLJAeAs3VqX$KmOR%RJCNu-%JC0&#A8M zsh<1f#1RQmA@xUPch^6c`S%Zx4y&=eV!Y$)UAvASJ68Mp>#1pJn2cm7E6rg;}d5)-6gAEw_w2oRl0vRp80Cq@PP|9Y}la7&d%29R(*47*|KFX_K34A z?zGZW*7)(vA9nZ1%z9^9@{IGF7B3!EKIHO_xMvNFKNG7n%>62F6B2tgWka9R5eezK2R4Qni0{!M3AE%`#ax<%ne! zqeqO0PfBV&eY(N+wzl8Aw{|Aaz4YVAL&eoYPyNs%uH*K@)#Ja zyqeK(^OHZHI$A&d+SLnNvT6?BzU%7H`;)DZ{Ph678V&Z1*s(Wuel{MS6DyFBq zdGoRvGwzYe6kWG%-@=rXRFs$R+qbWCmo8X9|C%_Yx}kLZ_?=fCU625jKx@C5n2_*F z_JC(UP(AjbnSAEYpTB0!nx>{EYt)0sW>!=*YPEk^{OZ*2w|K9X=MB3Q0{DAp`-#+}x64RTb zD?a_(m%DRE?77(dPMq^lx$*FkS=Y{1Uz=5Oa!dKepFW&+@6e$`yUM3EoWOcH^||Nf zeQNE|WARTvx!XK*q_HtN_T7wruP#~gV{>!2nOn0e!|#$6GR&KAym9>E*%O(yU+&+Z zn3VL?H>>jM>gx8q!48pDH89T)K2=>?zae(WAZIpFgikj4eq{(Q37i zKmJl??fQ)y=e+QOynXwr2&>lQ9X8x=`rdEp-lkqv-4LNrbnn@-eTNQX{yuhrEhN_% z{r<6~hSfO{ih&Cbe7XLgd-qN_KBoJ|$psr7gA)?!M!l0C9ow&CyY_dd6g-bBKBV{B zHEY6Ds@%jo$CsA&=?$Ob?oGXV_3|WCZM6(eOzbk_qfJVzK*KtET&{KRnqS{8oxa6y5g{N2jgb1Zw>6n0OV_^-n9@^U;ZoYxi?7nhVY?b-9n z^y%riryn_Tq&BN^SjSnjytB8TeP;P`-Px=@vdOb&?>ugMeAwj1|2@&YVamLD z^VYxpc85Mm?dvi9JMOrHrs<_im!ftHD=SYNJGN%TTT{|%YFDhNSG}3PdVKtWo)@A& z{;=`qq6hN4-fM5(`~Lp@lRjG*_Tq~#c9r*!kKgn8=eo<4)zxE0k3NK(Ypc1h?FW1J zFaKa}U0vjx%TJx$+3A7vKgil&&D`m2E>pv_Q*{N5rk|j%+ci*)$gAVT4@%feG{VR*UxMt5)cv7c5BP;CQ+|*P; z(`U||!^7vU??%3s+y4Ih$DUtg?q0WcZ9_wYJ~MOuh7E%TU41LEZ2XzezWlOog?`f5 zasM-Y`c6mhFHYt^{P6ZqGA>Y`4f*!lAuCOfc5xSv8+Y!hmy#If`RG0tG#O7hhqgRj zomso^<(Kgu_3msRz8&0JXc?eQHS_lO() z^1=y=^Y2Sfvu@oQF>~ga-U+760gW}wNAwuf_8(_HP98oy@!U%j%XV&$SbnX~0~N

    +%Mc3Se$=H}jAx->R7 z|C_xhfroNye?-M3wA{9<%$-Wq7_zkJYC(|-#nobKFqn)PW+81_soNsAR4S>YLc3&1 zT9oQWNKzz~qLNT4$?`wvyze{nj_odA-~ImI|KI$|k9p5~mghYCInVQK(=?5+irQVY ztYY>rE-w45VzWknSX8^Tw!UcP1>f>hF4du)Hyf_5`}E>P>*m|XE~b4tx8OcUHRp#b zfOegooE%O$DN&|Qn7Ds3@AJE@ z%UYZDe0&bCSv)W9USa*MSI4unb2o%ApVkFrGt`91F(dnKvWo3SISBaDxpRW@tgZaZ z%>lpsQV0;8>6CKtk=%5Jwf8IU)^(G=d?!17()d_a3MG2VIiDh%mX@*ulbzWI;}$yh zD+}@p{}Nr2X5{20Hk?nHJ9loc0gTnOSD&g&0HfcVIAe6g=y1#ZQBg*d4u)v!R4+RB zB72w4#Hgs4ipqioX%}w>yiMuX$3On~aXVM9+M3p3F~TNu)y?eImai=1R{gn@sHmvD zzd{P{(mmzV1)^UE?!baZn31{zLgmL*l)OiB4rShzhX$oj!KVf*$@j zV`WKhuIky(!Jkfq-Z2q3E!{Bj;+8>&9WsyE%-^sfYP3%E-Y+$mn;q{LC&?YXk#knCT3TAFI_&4ww2grKOqlSozW#^){dY!0JbL)>gk$oysdH60Y;il=@c!i;(?fdW z;O9Z@r@IX)O;f z_q&foI`R$1no^b|HGZwRe5~Mgg2TzZ#+QH)&%S#%KqOjGbuw9bzkk>k%Yu8%h=}?H z7ZxP3*WX;Hr#y9g@l-i;^OTC0m#SWQ8&pqJ&P+;LH=bv>Yp2M_NXcTx5t^d$q!Omn ztNt1_N&fC?`{tOX_Rv4oT_hI2eDUIz$GO6U`8^dByffsc<%JKo_*7HIf4al%?A!XH z!~-T(NsAAa*DZFVFK=$V^2&R_zB$Q>!>6e+`dhtu)1w!)__T{}-b7Uu)xgx?R+FAR zW0KFWCm>5 zu+QDyWNyf)@LHb-4drzy*RI`-%XLjxi!bzZqyIPuOk{X6uT&rwPmj6fk>;@8i3zmE zy1Kf%ckeb{dr_I}Te{arTO2%T(!I>keWs>+W?bsNcCpj`%7zrT;uVLEykIX)*}TS@ z`+H!uLbqvVX7ao57&(tWpPrtck>PUE;YY>Vr&s0WO&&gddc7hiStlj0xnke_>6-`a zsiiBf4Q{UbHFj38|EZptR{;5MTy$s%P{}r!vOqs>mZjZRvrwOKGdix`Tk}qo%@?LSza3gOXowIq)swm6r8dDC8^X)!H&GG^- zXS!YNAmtgBmWt6~>Cf{^yRV_8c<0k~b#)Kff_*g@7S?mx_8AMU`W*z)HX*^Mxv{=c z!LNKqd1ds#T$e9&K}Gfu4UL{cH$QPw!l`$BUdxS7OC3wjoYr;Er@!EB&3wjiN>Mx8 z%XClot9m~J-DAI3$*RIJF%9#0$dt8CeJ7Sd3azwhR+?ycckfURBQF9P`j$7`-gaa>PX8QEEc=zAev$0Wo>W^8U|EbDq-PtLGLM zrvU`Mc+t_7vc>nhbyWPhrS(1ae(@?eUix~)s-~sgpI0gO$b9rDH8pjiD}~V=(9-4B zC+`aZX20WcjlC%p<&X7103F?$YXAs6H}^DbsJos)Np)iGxSjX*(GLRvpV{ITAru~u zzgDr+l{vq#sLCkkRrSz2xfU)?04qoF3t?q4~uewW6o<2Of? zRD1{vKF>PWecpnHai@FT^ZTOzo_TuTzLJ*aul0kc(s~^{b}aO^2R;6`F%h=b);qog zWv$;eAb-cG(u$kHXQo@9QKqy!T3_)s)8VnqeG%+kU`&-Tj*^M>wbImps(gR))f>r6~A^!^*8qU!GoH-)-yy zYisLSn^o-i+y`gUhhG&D5KEe1zL4Zo6ZL7(gCRRsQZqb%mz9JRF^66$Uhn;K&4{h(D{ z#iFuD#!qrr^qdwgvWm%9>%RDEqHDpRA9sXpy?yrAlb1EVe7v0rKkgMmvvp^(G!A@H ze@L-wKHA)i-Z%2VO0#aZ359A3hx|{Bo4jqIZ=;c$wY&ZZO6)wPOuZp;w_d8b?P8AL(bOHyK$!uQlx_HZXAgjX!AfMv2X94#o4=>yH%`cV7=JXk5hbaegZ4p@?O~#X1G>TNs%b6 z{^gy);o-+ujG<6gXRRRYHHfB zL$(=;N)!DXMX^WCfB=hLm8Q-0bZ4fYuXlkB!z10-9M?}Q>d;1JhRUPfN=gXD7 zMshhUL998ND58tgzxbBIZjVz#HSesGTtLD8H zMcq^^P*gS_=eS3;{|}echepU#Z08;-aS1I01SKpRzRqcJguzpQmcVNR>jp%D0)ju$B`M`nHTAz@qSAv!o7#Iw{d%)S} z{$>@G2Tz_Tn&>HK0^7U1iI!Zl&p)0-kgI6&2KXS6zFV)~wN?>T@uBwtV&KTaiL_h;&c-x?ds-1pVJd&kq<5m&HI*|S@1y;zYdSmLd=M#;GY$RU97#yne8VmB)w$Vm_75IB zIGp;%y*!J?=ylJ203)w78EA%@BbpvNuc-g!(K&YIxpN2h1?}1$-e>(%-@eM3BIA|C zCzTd$?|#rBK`0dFFL28EaF_0`>%X^miqpWTT%ZFPiET&x*7Vw@d*i3=`Cf7gYXYAr zP3xol_zY`ZbaeE)+@CURGTmE`_Gp((-v$p1Jps(S^CONBy;r z8f1@(zW%7B>eIp_g|5QDI>HBn_LXg8Cy2qD1O=mJ-yl|mzGyoS2q@i z@A@bTc6FWMGv-{44YP>-nP-15E%>staJe;5JhH|BiEj~hYWD2(3DtVz3=E#fgdIN5 zI(kS9FmFk+uVX`;UBURluFG@k@5PQkx;L=jrezWDO-$nW>4%D@D=o`QOW=5W*M9tX zKS-(2@NRVFrPfv3?p~gt9(v(|NtR~arO!Mz+oY(8sZ-i_X!C~~JF2UPm#zAGB0YWn zq1D~Gsh2I+72TlnDU`eWO?5^THUYcL3 zqq(C_PHvme1BD~UzCNo<$)7toqA}6<2c!%Z>4~8M|`QGoQVDK|X}T+c!qo{E}izisR7Db43=AD%rn zTXXt{h{%l7?@E1U&AKRR6dCU`S^3#hWDkgg9jX%XyGQ)#%gnFu@AQ{%{<=nfruVj= zs@}Yrs-{fUH=Gn5ad8A|kV~rmk6Y#Tai01;egE=6U7d@Ii(y|ST{X-2_(q{%uWi~x zO*KDl?fvXKKQCY`S63-2o6_=jA>YNN%3kM#kxx^>y%p7OZvhke(W4~0`sm%dpBaqD zTP8Hc7ryB?%KFTsx986r%3s~mZ#7Wb?z}YCy|rhCV~L;ltJ`1V5_u{P4(s2%8MKHJUu3a-V z+)4?%>71VOBqwL%SJMiE*_tEA_{eLz_#Jfqoxj2Y>xB?50`2L3(q>&Z^vcvB%P{)oLf2W-VL~)>3?4yFdHs+O^#%l)U+Q6VvXk zsCja{wWVf#>X!i*R=l72_NIoe*}`XOX=$U!j4>J(H8+dDi()@I!fD&@jUPWg#!5raj`HNmlRLY0TVEfGZfx9g=FA-H3VVBQ zrNFCs+tLEX-t1kw`Ho4y=QbVBTl|iuK5$@Vb#-%r&6L4~5kQvAnpIYId5Y)c{XhB0 zO?#TDI{eP>7aAMsj%-fk{{8nk-NHV_RMdq0?xCORWF5Qr@S&C$Ge3W-4jeKhJMHYy zet_Ie_r*$^F{OAsO;YZ&duX$e3?#qp?{Gq>yW?W%NrT5vr{mPT{pt{ETH5L3mZ|pAXQQuxX*wWH+ z;sm3|y1ECB{K1p74}{oir7lmNsC&BlS*D8c@m#$@50sSN-nWk~Ola<%qI^y9;IV$-LqY!+Wy)G+P#n#o=i0zT=!K z7YY=nv=pjSSH7&VgxMb1S6bNht@ zP(6SCJT1*wb4TQFzde8X(x|6WqF-QkdEMTK^!~-n;NajHGiEGa{B-}w ztZO#aTKI*~8^#$0Q}yKg$d?Gc!|Dm>YM0 z=gysRyHuzfx`o{=_e+V4GE$i4c6I?{K-jizDypgl-iFNG3C+ndF=i(n0BrB>czG+` za=rD6mGJXY5ajCW8XVkeXi}5tmHVqXogQvUQ>$It^se+`(hmzq^o^R}54e_(kI#^; z*0-h3%YwThh=XAexL;-kPyHm8SQx^yWbBI1UZ!^WmX z-D@w0OpFp-a?>PEMw_Paehb|ASt0&B5S>4ZrY{iTv7Hp!OkbF{)Qio7rIN7AcNW&a z&@8<9LJ?kAOUr{Dz;S1r`0;!NtUzsQcJ_r0@Q8TkbZhfdri<79hfb)!fBv1HPVaw^ z?#utHV|0E0!%)v)T)X=3;Dzt^KmLi&|F-zQ|1bF;|Bu8A{#T`c{2n^^pAQ|xF@y*f z{KI^j-y;UUM+|EnTIl1MKsKnF%x@_Dc|g9?*NVfl%8Y)QnXq&%{ebUVleg-r&&2lK&! z>3DJZZY)%Rodff>!EA0=0ykI}0!$ApM}bikQTK*w4`+lm!z&RZpo?JoCRC>w23oSX zoMl*W6;`)`2o0j*sqcuYB`~fHZZqBpOIC;V2*foD6*`f|&UMJ@N#Eh{MI;~S%>h6n z&5-Di)LjQWU-}iPGq6Xrb`MZwEKvbkHa{rB4t4SY)3uKsrAb2a!FF z=lEl|0BA-4w8moq$@s{W)LMbLbS`_o}CD(D2+hL}E}Ys4I@ zE2Exxc_`JST>iWP_Dv1eK-`X8l3Vytb+xVg|A~ zPo;6DGa*fRU>ih=P)9V333*t^jV2T$X~h!ZS*1x8oe(wvQW1!GJR)HDPgc+Z6I=q; zh2>3!nQO^P9O|1CJiY{ICmbP>2ms}|b>Ik~#DJNOy@9O8O6UQ!@NU-!Ig2hHbPFTU zVP;2(?gYslrZdDx2*5k{?YMJ1AvFYIS1?2wwq-%s5x}S&LQKSV_Y$x?nSNq-9RY{W zbQ9>V0&H2}4Cc^u3WC8*1K3j;21kgN1wx*f5-1lDR;_!*%hRia-y6 zLFr(lF+RcLaHSO!AzOw#2zwO`0hBwT5b|7DUX9}+?YJFq+pIMZI!$1PU9c8d_mBZM z5kgI>iow8s6y%F*PS}zeRML8Z(o9||gNo^xNHLRSm&Z2~D-}pXkPxsqP`5|OjUJOW z1<80fHq2=O)<*!2SUp@H!5#MtF7k z9&YY*_=bRu0|JgLY+LD(V254I!Bo`Pir5+Cr$ka6Y=WbNZR``O#6H0VALbJ9 z_`{VjutdLPLkn4}2;BHi5+!jVO)zMLs}wSO0DPD{8pnS|mlOt;Ni(65$V*F`Oi753 zi+~nPc0P0j8H4ceWp4s)=N^H3khc?0IZ9#zvvk#=oN?#~6=AxPx&0 z3o%Aa>ws?q1qICxCDf6bAA?3E0Shf3Lt0;`1i8T+`$8dRjEf{`&n5DepmiAz&0GS& zBoXg~HAe=y@t=k`?24uZT?kA>KIjW3Cco&Uo$xlCJO>k)MDllOHEAsQ2VgeP9jSzB z#FCKT)t$>1vN4<|&S0?BfQQEDp_aD9RFxd#!Sb<6u+**@mrpoM$lEUILc)ENY~Vfv zUIS}Ic#63&Ulo=fhtNz=RvjYm5j53ASb}&o2@eeRu%;Ez!Hxjd_=sou2M%p!zSG+*s#Z1m0nt%=aodq68M_rh z0w7C-yG}8qL}~;(Iq`h|Rt?pEy9zK!%pR7ePC-ng5PJPuNKp#A`zqJN98lh~LH zYbUkzWO2A+lvNF9wr<0xU|}X?t4zS71gGhkk6#j|w&mdOqO{pd!Q;;BFLX zzeANusR_6Dukn=YZwXmT&^3--KSF^5e>S;$a$cV zkOrH5N6J4yN+Das5{vkMzy)MlX}R(FTsDi>)ehLh_0zBeE50YDl+a-pG<+m@K_DgyJr zi-Y~4mD$1KJlP_5@6Hy79%?xvkB}n+k}GDWbZu7>wO4VA3G4-wT1a?dVvSh;OiyA# za2(0fg~Z7SkrkM9+JLQ;DC#Ob9f5#^$86}(lp932O;AUWEBu+EXe`3_)zKK(*({LL zJiKr0Oh=-20`BAm&u&>*PIB3a!5NUek?{5sU@4FsSX_K!Qs@%1lRAM&>E2;aBIy|# zVK;Jk9_aQ0_|+RbgC~(bHYf5iGY`Bbc1K4U$mWKF6J5cT`Hxyngq|p%K;CoHy z(Pj4??s`WngU#jBa=eelf&kENKS|Crq7;kW=~a;FjCyWhdp;T8FKg7aiC1s zWIsq7{6NcXj~eLu2nGrydnLO}Rce0=jG#qAC1`&L#iEIM9Dgx^-Oy!#3QQuhVGD7$ z0#ykj2@r4sJ}%#3C~Y>(KJO)Fq4eY^{k0f734!4b5-{LYXN5CHZYSXqnyenYsa|>sYWrXEF46>)Phkk zvPA<}TrsL}fK!T)ssy0HWlNpT@O2qqkdT-#Yy<0MOQ+gS2tawwKzFiWW^knXw>!&~ zF%keg(a{Ao3BXdN2V}Uygbs!=bp>BVyZ+D(Fzl=rgM62=!ky1WINO=H@B&DJH|g4P zkXlHvydq5tA)7XK*^DdpkI6XQwyR3ckU?&i2h@23 z`BGjfRTa>EZ0ytvlZ_ai67#@3czgjmO~n_%MDI-F!hHT6oyCwOW1E8oa*0$1>IHEL zq(S4-qD}n-33c1f#k=uvYkQ=FI^wj01a@N$J=9_|y_hsS4Z37g+WH2y=pJqe5uwW% z$vxsOB6Jy}D`JvIQa?Wam`>U!G>kS4<6Ln3j(o>|?m93Qd?4xQU-AaywAm4gLRJ98 zFl3RPu>lO>I$B9rPMgl=-+{LV-$5W%1wpcGwnKZcy&D}4g-NAv&Lm`xxBnYC1bG4f z0CV_`@ZSRA0oFooMW!MOM?D6%fO1!Bn5V}KvntzcMo9gkqZ&;Ukm(9lT&@^%nc zIbeIN0Zt1-bnpoG7X^EgyiF2+2i4Tv6slk|t*wD-hpEFt(p5u-%*5clkP8U6Sm8wy zY-U2Tf{QvqvV}@`YzY4!bcjjL?yxTjFD&Uu75Bi%cnT$s0B8vjZawKm;F(y_ChUS8 zw43ldX8I74e*t%>&|Z*S4@Oriz&;b}2fZ=%Aq2R9mINJM5$(WZ15pasm%lk@lRcA_ zWo_tg7KyX{b;kDJL1zE)V&(slI^|R)R1b!9u^%f{t}iJEW1vUV*EiNPFg9ve4o2yF zvGRZF(?0(Pz!cqYI|j`1G2Y0ill&j((xbiV)KKMZ~Q24i%c|3_bc>{$J_^`G<&^}px;`6oU)-{M0B(s!D< zjl^~!oeWFVT{D|G)NeBwar2*!helDqQNLgj7zvOfg}zbOTs}O2;Bwropz) z7XrIDLNn}AB3LsztS3E#cM&0) zhlk{M$uDhsGNJJ}-1ZNdkYAAh(xHuQ-xoeAygxxD4~Tw9mPd*T>(PeLrejC6^iBt|lX#;gfjGov ziZ&xk{`i|hjQlbm2oo>?U!fQ1!Vlg(LGp`f18{|bx@OS+)W&oK21KAfouU~aFkr&Rq<& z+MSXOt^+Z#OK;Ns)53N{!WgyN(-z(Xpe#(Le><6mO-3Tcqz3`tT8MSEdVtyZ`u~T$ z=KzeWIM&oy7YKx2lCVA-`_7zBcWO40Wss$lEv$x$3${6)?w+KFule4cWnm0~gb*OK zkU|MPv=AV`2SP$g2m}Za2n0yzCG-|ThYL+1c6I*_qiE zoZT%hOJr1-dA@Neqlskbe0Hm%xF`zWadS*&gfzn%7Xq(xVT}_?>56cXh%&El1UMJf zxn^19XdhP5d}CkfOx4*ecLLIk?|jL#XXzL-MPJpju4o!ubIL^`X9LqQOygXA*`3SudN!J8nkl9TQ1ET9)6=@|QA9=IfP0>u9^ zL5c7~yXs+iG_A385hBAvmNsE&GRk=3;(@bU1SL}*o8@CaVaFtkOj!qx4MSd&hL3aR zIioudO^q3oKYz@z^n4{bq}6F@k`Mc&Squ$=DoS^}l!eU^AJ#~an*Qs%0R2mfY3tyN zbst1l3_D$))+;d6n=mcc7^MHCnngzE3!{ycUL;Kzpow}nrTRTc_r2LX%!`svVT?;k z4hB=?prhY1K+Mf7(Ai>c(V({pfXgt?jXz1DA>4jWF%DWK1WLSs(=mvU z3$rYfB+r>%zma$3V1NdHohiWhh+>*Ao&+>a8sVw7m={-EfeWz{<9@PlWI4V%EW$jY zVP4r1umvMVV#`Hd%mr)ekQbG}%;ZH=Gm=+Iw|Fp)u|{4g?d%nOrKn4@fS_aszt@bJ z&IDxyq;GCZrqVN-$KL)AqMjAc0JL!X&l-PKP09XqBAzVcUo=DTQH=k*%IebiPsEdB z{7KOMv9?k8_}A7}m*)S3Jo$`2I0}uWjl#!&UUgMz{!hr0@Aw<8^eB)T3LgK;$|_%J z{!hp=y76aO^K7H=@vo}&mHdAuG=Ny0|>X+V(T5EITG9=W3IDEL^Mxuml^Cr^jkVpuwm^_RO32p9;T*1shLj=4gZtY;` zG_xq9-b)G#Im4laM*x+ZCT4;Wo{gF=RYVnPKrZdwjk_@@rzo|xB;(OORZc=EI#;E; z-m2@?`^Mhg_fBPy&vZ zOqIi0=2FC&STR>Cf{}p-)e8YMBWmkl472_wNu`Ds43pxq5S{n*gG+1#jty}mLMx`D zXs}Hp7zGJ zHb}Iur8&^ligOr>GWTG~1rGgZ;i*B#oxG=f*(JP@1-cq6SX>g;R_GH92}=GDH0iWOhOGvsz5ASva4J}RNle| z$!#l6*ohyySizCX!Z_aVuRI=dt3O+gXzc_8|HXx%o|F0>X|4q!3$M}=WXvY!> zE=T+~f0eJwr2qH%{r-~ve5O(gpGIbT4)3GMIyB z^6uf})UU+CO%W1CiG#_Yw6}G)^Xsv*KQ~fxAhzD+9xt!haUV;&z6i)2?~rz1?O1eL zaXjQL;IhK*KTt@VdvenNx!aY8xEFCjqo2u7*lOO%IXdgxOaI1#d5sG%%{RjR?hKVm~-p@Ltf%-6?@&?3q@Rw%QoL zrOFi^l)_`|i$_2~MxV~&HK7we%-1<{bn>U~x#xR+E@2{C^JBCH1pTvAmPhQq?4kP# zne5hxs~e4Rdd*WW?{K}F1Qs*_!33!sF_nV}8YRAb#E36>$iL0Ddg)Y@&*H@*^YJyz zk_S|Ce#EwN1cAyZQ{q8%Y= z!cKemO~ZU|W*%Qf?e5VASWS6l9^6k&jW)0!RGAIRq^#D9wGt2tiGru5AX0#K3g&WC zXa&}7iUkDEgv7<8ko6_PWF;fVYKC0+J7YEV*-34*vGb-5t!88|yhjtpVC(|YeF^Z0 zyVZ!h)nwq-9%LJEZ%im1n`lgg?jnlDqF6kRG3S_6OfAogQ+@6@a~hWe(S-3hL5R&K z)?6l4x+|%Q_fgnHq0^(?=ohC5S3^Kp(;yYE`L515)y#3`Hs2JZxEPc6q@b{MX6aI2 z1#ARPjHb;M#BK_V$k-#v!6R}`^4$>Hiy(+c*MSTkFp4)WYz@H_Gu7gOW|s@w4=hHJ5oD4H3pN z3zycpCg5ZY0T6SI9uJXL;OLE76eU4q$4L||1s*HHlg0k4U0N#-C=q$gZDhCq^7*T) zt1R|^^Gg2T6Y|U?7F&*knwK`9S+0W`mo)~LbhZcFj+yl63Wb%V1F{5rx|SSoYr&lY<>M?Du3SwIK;;#4NmvG` zSg*_N1|0X`pAE?CVAXUqwg(!RL6O7Z0BD1hwbwbyl2KHi95ABFQ5Ic`$J(4o18OQU zXpwf-U60UeM_D+ITx?jI-1vt+3~miN(giny8$DyPqYQF)!T%=$ zt8q3`dkD@jcMI1ef>XB93Y ziv`FSXiSe*VNoGuJe%iM(d@d0@@HYH(EsW6dN{-oP?ZAjWFzBrs1VdBTBy$!x%~9M6b7k{+}(z z&Wda$F&g!fTJSmBGL$nJ3t-v6Hg8z&PY-JO;`W(99Ef5Z=gJqB@j@LUB7~lGV1VW= z4uXZz>PjlHlnQpE1L+8&l9gypOaRDE2gMwERvBiOpqrxz!QcSlmo1P(Lva+9RTWD@ ze1N#D2Xe?pW6~yqGIKFP2Sah<9W`sC_GX_M%xU$^+FO>Isp|@n=d}9uH2Z>dXe(%^ z$7hOnCFO*aBmvwQdPc_qiw&D$pc52G;C~4@7FLC!r=lO>f_#|q%ccpyToXeV@lk@k z04ya1FvbbN92-*sa~zihdt|=@`znS&ksoe?LTbv2T12=SB$6K_LE}s`S$oAFIeUXI z{P!l(eAxnRk3(L|77!F-;LYG*#*S-(crvOSQ}Lp-9#=OatF#(i5Z95ClQESHHce7u zp-4I`GepdtOLibhI?v#Hg}Kav3f4S@t-=7@0;(GvcdA+}$K)iqSpr$%9YNuZaZ3_jsLW|3B9|d81P9@egwqD_mJTg% z?Wn30G7Kv*H6B`9Ns8eNN=!x_ox!HI)<8#Z5Tf9bKaQE00V@Lnq)yt+A*Yyzrxv6L z2~v6k0TdDk&5`WWLf~9AIN`uSa0wg_Cfgr@O zv?)N-?Mk%=np^wYSvjGUn4Sr3cCG2@cBOa$bEh&EfY6k71xUJGfsVj(y^K(Rr)O#e zB3#-vLelNg-EIq6)&eAkrcD8wZdWP*EYqeLl5RUM1KN}^&dWfrEx!8N+U&AJy3TLO zvJhk*5kWU{xz@*(usi5B<u01BaWEFBHSBWk^=bd1E@(*qT%=5m6qB{SQrw`rBcI8#BL+d>Vc6Ol9x*hpWQnu~_cfn;bJblOk}TsttxDhitlC@KO410JX_>K`$M zE}{Y#2yiU8KLZ~~cR*4itP%t8#Pvc=q0kVP#^>V3j0sUUi=YT)AoyWSiMXK0Wjuj4 z3X$&(z}RQO^)q)d>$fN`g4+*CDM;dx6q(^+B_1dZ)lEZkXf25dN#iOA1n(74z~>p7 zi+8!=q%aO4kh`9hMrd*A32vOZEf|6((9ZkBpPC}RG>$+JCQM%|zJ#ps6EG$uuqTcFf%WLQKOV;dA()TY@6Q(7+ki{MF1$b}|Be9wR) zT%!>~X3Odf*hwc%$f4!z5tB}ecK`J^6@%Q!L2AX7 ziCtJs%$!*mvlzr%VH}uVCcq-<4q_G_W6OzQ*a>r_rsMb%DT3KWI*Q;=kf4I!r43>I zaX0XCDhB$8j+K!p;kMf*7Q)=JH>v~WAsZC#i&Ae>lQF`-dGBLQ2HCgHrXG3)fF--( zvH+VMiCtA>gJCTKy9jG4Nd9$5>?{=wY&)xM6RhO3n zdK7xAJa4E3)W8|5AhGMsxl>BizJw)r)|@N^z9~B<=V-#V3<&8q)D!46QlOl&Elp$I z8%8e@Avv|k^}@$=jA>yY$0m{gG8a{tiV(k=M7m}-z*B!1h*rcBSVU_R$Dz)lSf+@8 zG-zf!2F6V0B<%#*O`y57W(*XW@6Z6Wx~j&vhDpK-{#Uz^p6(Hd?-u0%s*5mLDr9o$ zCMFM4hYa9bMB*hK0m0PvGvy-inMS`BFGqpeH8~nWUK6fj6s-sgq~NSl%KdA+EN(T; zmz0L_7%C)Fd6fq#Iru2p4i(4^kUD?{v93Vm~FTwq-a+WZzDN>Aj=D>nwTtqCg1Gyas6Ck}}EVtAkNEl?v z6ZSFG$625@{5c&{l|fK#k_B}x9RyV`*SVYkX{1}6;$p;VUUm(%#kK)-%ND1Xr}5jH z0PlQm`{~%R#!Zc}RMsGE5gNcVolOA`s&uoZQrMKl6De(E;I~faRn)%~NC_&#UqV9| zU69Fx=EUZ>xu`@d1)2g)I=AS+TSx0HPNX~9Y%kNNp^r?%OtY}8Ob~Xc6tYTLLj)1% zH2zJ%w9-6~{C`vhEBZmxIdhLxwB0DD-&`fdC<4Cw_)oAln2N zVyWOtBE-SjM;V2u5i=1f5*g9+(Xpfu6h63&nzdntHppy>Cy2-olc_77Q1t<$H*moL z4~ofT$4}bcBuqmBfnKpT>8M6TziEJ!+(e~hf*Orh^z8?pbo!P;L#Jt5?@Yznb%#tn zLnmAA0deGuGkwP))S!1~CQIX_LOUji46t_**8|Y~#1otslTLaeV>iQ<4MQgTpUu3D zGh*FtPp3~|vRyOs=YD#<5~3#MZk7fX#D#9{?y=iH-^B4oiQtBM^;{KDSWZ{FDw?Oi4nVn%vu9T2W4RMgm< z6tNskp%EEEoq)$Up-Nz<5IKSSWrGB(61fIyk&KE=B}Lk^k!~!4F6kp%H?s)29;7Nq z$U(RYW`ORlK|u@%ZJ<}H%yqk5beVMnP3}iB)>DdU6_yinZph@SaGZD%lNH9pRt(gS z1tCgGK&i9|(;Aa;Z6U3(u^`eOIqGJ;vjf4c3D7wfB!GhmZCtajp$!)Zd7^IQ3L2Ae z|1tZH4`{O;XL7qWis{xbcjQ;>=nIN!C+`UX18kU#FpO;;UFO5mmIsMb!H#+}!eZGQ z8DXKLSTHPnj%A!l^x7#+qYrlo*#Uubkn4r40BGVStplJSndr?tZpx8B<3h`e5NeDm z6M%GciDw+#;>v>X$LY02BnB?P&*q-icWV*_Lo5Bl4kyLqqr4XG01ftt zr!L%5MsBy3*;$ar7bVj)SF|}z^V0h*)}`g-h=&H)7*^j4sjo>1I{J@ljF7RFxeFt^#E!Lw%sJYV-o*xX?1XlVW;7; z6bTYc7{|q!W(o4+0D?CO4>nyfD|`q18mMB+xRUQ=7L^o6jz6w9;P&)fn?JFVSLpibts<3t2|z<;5zC9v^~B{ z?+xbU48~a84ovYF9tM*RUO0}kfoR9NK({uyoneWlOQwE0tTQX&;XFx2UayBS%b)ZBK*R2n7>96y zJqc4Ym6T$tWI1Qm7ZqA$wEVze-eRF`)_tErNMwdC1wqNJW5x)lW@M8Wq;RRd6Krk} z?Vl5AZeiMum)aRNYKI7EsI#M@v!%tZ3x?RJqwWXSQKsVJvc$EN7Be9e^JJ+OiL~ape9Fi>59dNIzPjKOtLP|l}p&Q zidESJUZWi2tLI7748$O#ilaf62xdxUBc?JLN31IM>4WX~QB+g4DCKT6Mg);<;7LeH zDO!g|Pi8hi#AZR3LPMef7Re>2$n_YK66S@WLRz2Q9Wfp>6jvFM#FG}8225mF6ZTU| z7gmJ(QY_MnCaj1h^qWacs(z;FC#r8#8U5xGn=;k*Wk?6@^4FO2LyrLqLT;P{S!>zU z)M*}w!f0~DPxOc_i4>O2HhP3ad-19Zik}!?Ml3rMjb=3w1v0xhq+IG3%_Xd>U|31Q z{Xk}`Ew&=^Mq`6@s54FU2vIp2$3mG?JE)l<2#PGfi}EPIr#&gb(V}oM3!u`&b~Qe? zo62xxOvrj0jH-jH{62EnT82j@7D|jDm-fknEQ_<-gZAH_tjm_21w}pG?-BISi2HifPf3KqzWKIj~b^KFe7B zpg4w5b|@ZJS3$&n{YLtYPSPKzM<2~i9`P%s7XF>S;T&aU8!7JLFT8K6w}n8bwwwUy zY7PSgY}3j!uvZh1L_+h3LaiYK7yWn^{%*)*kkNQfL!wQ;p=hSAlf72%Zu3JQ12BS~ zmgNyrY;qE%mLVreG2|o%-z*RLZTQL*q3k<*%iLow0a3~{3qh7y?6IRocdly8vXsY$ zo^n?rXdgYMQPEUASn%XVzg80w*+3rQSA8m0O$(i>V>0*6AcFEtIV4a!7Meu_ zHF7myR^~-dL`)nEk|^I&8Eys@6^nW#Gn8f4=wQi?DB=myvf8=_?Tp>gM!bxh=NYY? z%`Z%?)EUp|u^EXBjH}Fsz3S@@00n{11Pu2!E@~rDqWIl!Y{AgSBuFj3+DsPb5e4H# ziqQ3(4i0l`b7sj&RZBgAZk(69!3o)MbNWF^d6jwjvHE{z^#6^Al=;PR|IOk5TT@-> zGsl0bnO9wk|2H9z(f_wIDTOfc*f;?963^VlX+_1Gw1|YsUyjF!NAO~Z6*V*}k6=n; z)FF7@ml-q$LZQ|>qCGEa}9WIt%u1wgcosUwv`iuq7$En!gLH&1{-z2!P<-Lt)cOH2nCsj^$LZl zA0Sw}1c~y>ejw8Ql>(&jy`F(=besT)Q}PBKS#v>L=6RV_4Y#$!wN?wYLUKfo)thrt z3o%we1S2YKsOOl&zm;e@O5`+>RW)P<19T3BqLSAGIC`7uTmfL|w4rvbYzhfOA)*O^ z9!J1k!8B~0Orv+EM5FhoLMTTv?BRWsxo0v5vcP_h@~}4$)q%5Lao7*)Il~Q zpfG_;%}jc7s;30#(irm^Kol4(Kynt|*n_3cUMyG28xkIHphO#4Q7moaw0cCWgZa6j z&>l3xd@d)y-z2O}Mb$Iq;X|3ZrYY@EnHiO%v?R&LxiVu-Q_Isb3+@WG(9Of^(zcSk zT`kHPd#bFt+9i?o#B!HA0od-|H10zEx-jxwuvCS$Dn!%pY> z@j9@!-lmq|^48uZ!PbtJPD6cyWs4DSJ?RkcH#sIIE7S~Xm2T5OMs+sF%)H|CM_7EEhT0758^<1P1oa!dT5nMuj0s$`F^&?w1Gv;E|YM(>I z*JH{nLo}3mp>(mv#0gc z1J@j6(h#ZDC5lEM8F{FHM&x|L6b$xMWZMyslrLl_xttQCaOG5p)JDHi2ko+`93{tm zTDk|(zvhe#Xwo-1N-QjIKuIY!2-;i-3F2q2XvB64m?fNDGI`UQ+b85M_gmyw7$n^J z*_y)_b<1?q-FX*S1;D{M{->Vp-RPdp;V7fBCm~UumGBo*6P33`2GP^o-pgDtCYnW)WJj47c{k7ry-Y+3MGMxxyCY3eY6Y#4VDAqISs`!L#VI8dVTsbj5$beuxUwm zogty8*OaiVsmGYm*wSQ5SVj^G@36JYcvp@)Vd-j5>mdPJAj@#D>5FHcmzbA}90S)2 zmzWEdK|Ck3CN#oMcle7&y5g#dcp02@ujMww#1=(`u^-X^`;8&k&rkDnJYzXW8<)8i zxU2~opmd<)UrENFVvN7B^_QSE(9+n~)@y?i1CBml$F()wCE z>X;Z-Y*fwGM|T$W+i7EHzY zNg_QT^5^eAE1Js_z->+{vsBLyRV(dhg&ImKiBvpEmpy8hK{U74L7|h2j)gw;F-~z- z>QY9=M&tHAn^74@N>hPguw3kBFXsw9?n}gU)WS1wIfvhTqwjf(Sx+Sy9cS?+I za*4up-!PiFZ`jGW3MBC;3^qca!92EECL9q24JJr1xy3A{5SLAZkfKg0DFxscWHxax znsFUuJTD7ZWPH<>RTOa%1>i+8&B~s#&CwPe3v?Z_PQ`2#nm2W(V{2paVS1x3+kI5b zr2#=)PC`nIhFtDC)JHO-UYxfMNSPd%z^~OYrw0bntEA-UDw0fNgLr5jWGj55U)saw_4GZDCm?(V+>Z}?XQ`C)|lf)uA zWSTX0j+nxNo{^@DIFD?0&D>AfD*a_&{z3kZ#QVW{DdXaA6%j@)4vd2YFqT!nE#8mC z_%?c`#{3J&X{34QhGj0Ay$u$bIPnMNCQ;@ z@T|-Y2u4SW5+2c@4-@&M9fh!dbjwmWdk?H#Fi7&VX+yfEj1}TC0@8uyc^E{3AmQVs zKrQFOh4>c_YU=Fh=|$Qrt^oe{-EO26!qNu3LG6AwkZMy;u(iFbt+lDuPU5hQa3?}Z zd&Dx6#Yg{2Q#T>a-NbfUIT_dAGe&7l38F=~>i`Np5w5n>Ci%^-z} z5~rVQ5?TViO-q6uffc^qlVJfoaF%u|@qagmv62pU$iZk1ull?9jX{P1UvdSq~u znoNO|7)=mz zFi^uLZC}f0udvmHB+$fjtMNiZHEB4aYnhuaUQ3Am3*AR*(n}Uqz5&~G)yP#5TP|(R z3<=^xNotA1#+8}Z0TEmL-0}_RW01LXN!-k8LAUHHFR%Yn#I4F6g$PLy*dkl}sse)) z2;RR=yLOQwXj?W*V(y3^Pp&=(V|L znxJM+cB z>J9Ov7SBV765NyZ%-m+gVwo1H;zZjrYvv}c)#RAsZ;7RKafN8p9HN(cW*rPDR4}&j zf5hpJ5{~N3Q>3)U_R;|&x;7>YYl++mgGjnW={6W27%(dssWMYjXR%uwGRu@=VS#>^ zH8u6}S*U}MTSV2fNli9&$I(S=OZoi4=MDAOl# z-l8dN)UPA90vp2+I;#WU{KYsohZqZTNRdSfKVWBQ0^Ab#sY zNqGaYc@Wl0!T7-;nyqnBg|C0Q`H8?ibR!6=*%yivLkJ_^!#E(9HQV~;dWZKK!E_%{2&xtneNtx1z0BEw~WkCU@~@=V3?_}tpqy@Gi)X@+JG5ZpOw4ySh$;J z;+2iR@j+)|4itq)ZpN-hL*+XtYhYDz z$>``^7VKHs(c8Gf){fBxrg;!G58Hg!2;BiB8ycxePNwAn@>9EH1Hx?JRM>4n{N$6A zWU)bkA(B`mbbd0SpC=jj7J|z*l#5aq7wQqw-rm|9#5*;1_^DSVQy6h4GQjRVL$L!hW!(D!AOc$O^o0-fy z`|L-+#&O$}edzf4GK=ZYWO~Cnvt3kMD${ca4KaoV>jVAR%cv}&^^*k`ziFXkp=SjV zzLo9;!Z%bc%m7Cj8(nP@U4)F%eOtcron8En>w{a$E{0g-W=@5#a7 za98YSKMPrG8FSJqhCP|3QLmTueiDVhwdsQf$avxoHnsiopc3Oj5HsSXpkTY~!jn08 zt1Hj(z*j8b^8VN(l@=I~@Z{$uR5FTGDZfb!7BdA%Kq+;-CtJ^dwrSg8M1j zADZV@i02btIg3s!i?YnBPS>_awxN^_8s<#%&#DF&qcn5HvmuepHbJeW&nrFAs?YM9 z0UoVBYpnVvgP0+NB`M3Td_pGG6KzJ^P8dQAC7If!C=kX2` zvWx!RC5Mx7)GhTZvG{t0oOX7{`{iURj#}kp8t*=os2Um?@t|f!9*m<7c}VK_KozFA z;iHNYPAHK?39qV!DB-mgzWEiEl@KMoy0Wfj|A~tdo>HPbNcaE`*6j)|Z|$h6bPL&r zl~@>zZH@J0fQuFW-+}D2{vKM zdHZ^3@F^FW9H`St{^lE(TrZ&u1sS7~3z_qaNp2TIS=_AQFS!0CxDW7U$R=7hY%7G# zscs!nKtOU^C^7{NA5Fw?=mTH{`he%6O&_$_+kz%o?2D$+9bISQV~I&U+JMwt8rH8n z&l-(78I?%uLQrbJ8=SBL-iZ05r3-d;F~-QvIMXoI2SubK$St;&r5DUEA zD7@BB{)o`PZ;Pp6v{v+$i3pt$m80}+utBA$?VhX=p&`p?+?O+>kJed?xX?J;=tD!} zZ)Ptf*c>O*vO!a8b_a*U4clAnGO38+o1K=cMN%Rv8dg$6#z556>=y7xEC6DObP9{L z^y<+R2^vK#kML^17;#!9fn#BFo+ON&=A~cjvg9&GJj39a91oaF0Y+(0dt+N$Yez5Q z;iysct`;!K0ogx8&pJ=m&J0bS&;_2<&cZwhvEZw!9$UN z>lFIz0oXmraDO;FOk0mXx^V%92e*E;H;bzAe7{rvpP0MY!Qyy;KwH95b~=->^5-?Q-%P`qSGhUHWAwcOt27heO+3?+)1YE zEhS~(SQ0VfCN~=y`Mz%UK(`91IFxhQlcsi~B=gJ_(+K4-pVnYs$I_0@y^ZZ%b~TwQfl1Q6tg%h3BU|yd&W^<#P6J6< zoOLZl7qu=1w_vfMj+Mp~yhRFhw>H_r9cXH8H^9l}w~)dI$F6)!TW6!#RCmBoS#xLK zB8XaU*CowM*``Y!jomAaLug53C}ZiiE%YlfDLLY-FVo`iVSt~wbjfg{w>96sP@YB~hh z5DcUv5f6&RW93K4$++%_QEwBbka>~V_{fR7Aih44&BYM)|IrYNKlEvAL*e|v;6F#B zd6Q&FpiU6*%A6hqq%eHz=*iy;LiZjwXD{~?zZf7t$io?^5S*S7UrM*@3Z~+^g;qHi zJ&1b+$yM03)~#a1RfTO9z5KpMYWz%FU*%sTEU)ndGeHB`@taEX5-@2P{fG%y9Is(n zicoookg*gB#gk!nVKg`6hpd^HJM5JE$WGZjG3TV`)R9X#%lI8$m@2^{qD+uV2IDE7 z#08F!zP`hWI-?_4)nTn*EDEpHxHb~8dp53v`qL`|?AmQtGUPS{HX?Es#?TOT0wHzk zWpD-B`i|#1UEv*KJSr}`l?9YZMP<-?fZz>CdQgeh=4ba#MONKR{q9Ib0R#Y~FG&cfVAJ{Ka zR1x{PPQx3lQf1$3>41k59DJ9?)0io*CAMu$dOBmrp2MJNiW4x@5d0rZE4(y_HXNF0;e z0qBf+AlfE}X<>sIa!?wJ&~^rUJ9``3c)>FA&0L5A%{}Cjn2loQ4N+fw5Z=??J~6^Lpd3n?%spNx#UP{2p}Am2^J`bwp%b;_GJ?tdOV_s5=NIL znt(Y13lqQu$qX?EVybwiLJNz;h|DSgMzSRKs7o*9W;u;m7ea}0mTcxNCi&XWx4T*l zQGIF3F?!kKf*M86ddFx2gvN;bJGG_H5GIu8BcU^`IVEGxyn_+xQ5>1{t%r`(g>KG1 zbSBT;xy`{Y;TwTaLKbOcI%G~ zOH^3Y2bEq!r}D5~JQO3vnh>=R?1@uk9p&gWW))(K8nfoRerY_3-b~XkH^n0Yzav{N zzSm-hK zy?BtQd^TcPyjTm1>qcdf3~}9*#Heq&m^RATZ(5yv*U2`V8KSgl z+4bc(569N1w3gC~nu1#^GFe?wY?xRi<%|4WI-@TmAx~Q~nVf+@&AieSfr?RH0roQ( zX1`|wjAtfyV9?1N0dq8QOY;!)M7Z?zO;H&F7`nj*Ge2P)6AZ7F7qS)QZSsw#^6Y{s z3vZ+{s|35yawR5a^Mk-W8hXti1%?r9VcG;ULc#jxRPKZr6fMRi8OJR}a za!lee#g)@E2;9~dPzpLc4Zrn*Jt^n0Hj9>x?4}JlaZNOC-=JnJ^c1jxBg4)HT&SCc zDdYNXekGcYd3s>g(c5Fwj3CfuRO8z2KK0L*=!QbrEn{>-7I=n&t;O8Rgn@AaEi6;T zxonQn&B)sTWJfyMP12iS(dHUfer$$A_DMd5AcLOjI{) zgVbDD&4pGQt(omPvj#+d!=#1e(ql`hh(!I7j8THd7>p}7!!s}+HpgONh(u&rX4nxn z38z<(^2o4IG0m;bx|3&|EnA!v6liN4u+rVx*0!jzY3cakr3aMxfD<9s76}VjoTyg? z;-o%TOe_s=7;Y9L3Zm}0%!nhA@*4YkJ1Je!fB>*QbrKsuH_fDd4|aAi=~jpbIBspV zwD87?KdQFj(=D3QQHD^@;2WUrxeZ$$f*ehV$%{U+?4re3P&8~%%0jZ-+r~V{Oyie% z(|qaPqM&1(1vv@?X4063MTHVc{(fwyZk zskELx7)>l`F1R)mx@B}a&}=Tp7Q9Y$TN+~|JN>9Klusx-eq3HqEIVWhW+!q3E8izn z52m*4dP?mkc^gMU+pP>@ODLhkA;N!V=iJ3wY&C5|!e}5cu!sf)s`F}E3Jr2ToOaMQ z@u8+1NZ%X@vAfvrh_WJ{K@Sk7eb&C|p}`83jH2-~M#YB;<>0 zKN0lFFtK(l$HR8IodV*DW!1-J_X3RhdzoErmDws)RSn6qd*u(#RCg$Ql>P7!+wN!Hf6`G^XH1+D>qk!Ha15Q3Nj< z=a_o+dKiQu?bR%+8zaX zY#cD3*ni@>XY7t_9Wsm<=Rq3m&F~|R!S6x$z|1}YhG5%K<9duY|#uNpt zNlIcCkN;6soYy7}mRODP0zu>%a?4aIci1g+0UmlQuP{+# z43jmQXjnpV;fjEIp}3DoA5kfmmLgnD4JEr46XiF4<|YP%EYQqUjg7@@6Zsyi(AZeU zSY_c=Ag^nhIR6OaWv%F|622-EBEMR}t40&KDkJ6!cC4{Onr;AFc*H7mxGJ)1qz7V{ z|IJjWSs(dLnNc!6Y*8T!hiFC?qp_;FNn(E;V=RsSROofmc&puYFc>VV#HH3nvhr;D zjh)=bl5ODFQLv3gIjM|+W2sB*Z*iSgEmUH5sxTmfJE(FFUZ&xOe-YLNW`9IKFKoa) zjL~ajT|ymhqYj;Uqtdk`j-qkFdQdb(;yzcVHpwYwHt$n@3-~CUPKiHsCU;Xe^H~N- zm=dDOZVQ%^N=S-m7Yb7^$GrXh%8Vzy2Ew4WNm=|OH`#+NdeSTPhzQXO@)2 z8EqHZPr-H5>ep%G)`@btb!t>GVcwjMJi2V>nJIK-CO7P3<3>AWzU_w@P!ZEyThkHk zhG=tmzpRd(lV@p}aG%YtgG0E^q=AXmPfn-90&nYqm4!sh0)=i2Pkb#xFpsk+EHs4R z4MGXwrS!Z8eRdJJm`{+BJN9;AnEA>-FcN`OV> zD!gW)93Mf<|7If1!i=1Kh2a1-em(*n?g2`VN~xO(V4z0eOgIHGke?hf<> zd;7ZD@IReP*#boh@P(3Og%e`RQ7M|3(T6TDP-g1mB(CxNXac#YA%e3%0cD-;h6W!f zBTQe{OG)js7K|iD%(N6d8Ip7q@S8XYs2o*O&a9!C;b32Hr4RRW->}!sluH_XHX(baLxl)l{DENUR2IB86EwJKZc93o>!yvLt)1_t znZj)aCZ*o!Tv?zKWsYT)4i8^h&C)@6rRGqW7v`w<*jO-U@~s% z3MIWth{U7e zuK;pk0fME>K7E-)jn)CdHyrPr=A`f}R`6ht$l%l|L2M!rSg7s?4Wwhtl#9C&5@#dH zsI$^NQJH+8t>hM}BxqtN&O(smJ9r8py zcm;O_jfof?n4kpjT2IuC^SMoN1FY;PbL0cTEW}1U6-Jp&1{ztT&FvAjpho7NNh-<+ zT*i0?f>BH1!12JHM*f)zI8FIs^rN$biaDs*KxA}gVG9ZqL6A#?P~Wv@J=o`#?4nEH zXsy^YdX3wQl=*B=isJiCb}-qjzw>qQE;D&|W7N~Nmo4UQy=b9+-e&cP2nZcWoI+cv zw=*o~Yh!`V-$ud^`7betB4;Zu({fH_04C=Ng0`@1IjLR0ldHqb73-In7g+Bi+=C9N z7TMOzt>{KmHFpVe8g+PdZ!TGVJqq$+pQIY{F?py@h?_PRmz9`;S&?zP-1P-+n7Jb= z&X>tM8V1?G29*JmYb)`C5>O%T(PMFl))jMR zt+D;|(CXr31DR*fM#dd8+4eOw(CsqtfX0qyZNE(Q#0)DGV{+Ii=jc9~5(pu9#zw=v z`u>^?a=qY%%ux0b7We|w&vvlJ@N@fDo&WaMy4kg>EYm156 zExSN^=$*;sa*ST6c64Q04vfr0IHw0~2~$iM89lIUd)DID-2<~RA6tPhm-FeEeNQvt z!m!dz5^VIyDdZG<_nat^gqu@RBYNB`;iQ-B@#etYF>^fdHHI|I*rSpb7?3b%yaX6` zrI-wv3-5(Hx!NH=yBn*`2oSztH)f!q?~8@w#NBFkZk(r{{bXN3zl{-vKLB3=QIFhb zC#(u&(CN9L=#)w3ZtoBlUzkNU257w!W^wa|r4fUNow+n|)P!4v29@>XW&;BwK?x~| zw>re^TLSqAPW>>2CL{%?s1UUTlU|s*aUu|chKH1ttR^Hlr&K`d;u6UKE|Fq};(E1i z(tM@Xd^{%e61oeL4LF!8B}Ho&`a`?p5xo9%AHSiv%H~=;X_3sbyOW0Ubq*CoF8!zl zzuLH*!h|4-N@&MoA%|&^fT0KW1A@RPf(r!s5whs~IHy54NOm)JMr1wKt#H3sz#!9v z@^NG}`LX8b$ZGOqH5M8qBVt#iCSws8JKG|)S`o4Dm{P<2ZE@h;v^h)=qz*%DLOA#k zacQL7y#^NMu=fs)kmUKdVDuL_e?^ekTL+za_g|7v; zSlU6L6I)IIbcKomf{Y%QB9OLzmwJXQ-j{l&QTbp((M(;p^Tf32w&0Jcf3-SS3Mn=@ zML$g;#gH?TrzcZCvoGu|b6@j!{%wf8uRW5xoC$`v3W>YpTrtf7QO~ zlKQy0Q7$70JzxqN_!TVKg1VwrlI7f`tQkx9tZ<)KPU1;o9IGixA|_ z*Ek8gD68hE?E|d3TxP+9wGl-utzW+oi?J)MBGOUHw>)Sz%}vzP6v5;?o@glan?>{z zTJSRd&E$_}Nr$$RQpBQMwaKb0j2TdR7T$-XEJx+2%kmwn2$7paxt5=QVPjOuuRyn4 z6)R-2_;^f&_n-!ZzO2k8cowj(U9+KS+vfsE;#klibSk?D1jZdI;m&I&Z1}YMLcrvN zHLRxOgbQebPNUhl1zm5?msg{wp?04=H~47KsHnNKBVcJ)qe0C&*HBug!S2rG`4rCN z!N};h5HCi96QjW$(AJ5O!?tmh?u)2%5HK~BEWp;Tq!^#Y|^Yq%vi5}_>Xhf0eN>6H{?ZG+y0t+Y@e@3@S5p`p6ptKTY zk)0@Qkp?v2u(+6-IzL$)D2;5>VU@e;3z8$oUyR7dr?QwXm08zv?TmHu-Z&{5pcdx* zS-9`#Xk9?x5#!&*Z3`B_OVI27if+?h=AD#^#qM zW@+5nERdN}a3*pD;m+c(k?$pcWo1@?vH+ts%|?nZIT@K}@!UN${z~|e60_q&+R>H3 zinO4mDX^4cxdj_E2(JU$$B~R;>_qwpa35rS#CMl1LoaLI#N#!NRBW&;D9Ca@#-p9F@tjK<&?XCG9 z(R^KiM(y;HQ*z3ou_{zyHSTUN8KtK2zL;?gE;V_0)Buq%PEN;-e&mXE8^@Y2lV43f zRBBYjj_R60zTy#mh=6gbTB*;ZE7Mm~8+{9B4R)FnIOFJn@hDS*TU>CganDF;BA15&QX}&y6DZkJ<0S44f=Kj%whJ2KKrxf=h4*VnIKf$+^lmtUB==0}|mPmM$o-3B=%J(9<&`lUQXwKRB69g|(B8fstVk-F&j#8krcoCY< zZ8A8M2`f_C-gOX_BV{lKM^t3ZFq}(dBRieMjnv22aH9^N*Ju?Y361jEl+kZdr-xkA zfrVViHYKu83nRb0L77)ZH}MJUTNubTUIJ%|I#Ejq0er0q-Dgz+^M^f6w)TlTh1|gjpp+4mm9si+-CEZ<5smL zZ@H4UT%q1_`FX@;@Xn$$G=HbKY%6cxesP&j%qD?rTpp~iaM!r3xX&)HOj7SSI}2`N z@}A2tjutF=#ZBCk!~d(Q7!F{$?tiQF)mr?&YD@lK6Y@;3|CiMPtcrPnRWS#!>WV5K z^7-m2tLv&OQB+bxQc{i$O{5!G)tA5ztZHo7V!PvvM!d3LOj0K zl7o^vSjio%tEu+8EKR+fpf`S?&7C76;oP|G8Q zUlwOFSuOd5S#R6Rf=3%PehFQ}MnPC5f3Yd$FP34MFS&}9T*XSRV#RV5<3iYE@)k3} zB*Ihj3@dqt73?#WQ&510TpG2ByFQa7I;C92a&|i`hsdapx$7mrv6A1I{Y^|7#g)9q zG}E|TcE&7UF?`2#6^pgnyq(BWk`l4iuOyOiQA1V-GT6dW_c5p?4{LbNeKP6mEF>hd ztI4E;<7~dT-ejUu3%==#y@|IIPGMAjZ7$!kD$TjfunW(}t;{`v&SX`hZR++goR321fs+>$=iW0g^R24n`u62=eG@3#;Qp3n=c}#tenf(81@V_PhzlnG#Bcm>PY|x22UM0DZt+v89zoN1dE@Z2&tgG4I zcp+Q9cfOfC_P8tFd-R|}l z=vRMwU|^Ns=Uao>dqS1d;W%5rF(j~{8`9i1){cI@C&2}@JqeudrIMk<2y#IK9^@2U zN{HeOXGmbUQUh9!eG_=4!*Z{kBzyW1?+4CIKy)WhQ?x~YE|=e6Kmdy~$R{i}>5xI^p|D#p z>hLj9h&idOd zG@-^pTEIlkdOwUG$$;zd0P{c$zc;FCI?5z=nhB#Lj|pmmn8~pgE@(e|O`TmUyIU78 z>CHHLPJIz|HMwEsttyA*7cC{?8R|;L0kv6%D?`)Gfu5%B)-KpBW^TNVc>hy-B~^(g z04t!P9gy&9K9Gz@AwB@rqBbvT?Hg=5d93pP5WSGuuU*JoiGNnr`LX;z&n_NELA!u~7z92DGR~?6n9vfmEIRKs zN1-4|OoTUmqN^WgCw0gY!9vqeaFO4VLr@eUX8?53Oi`m7uSqe(S%AKnW{$Fvu`1Du zKTAbKTbHF0YKSUSV2UvTYZHqxp~v75q;cCA4949|wgsB*PR383tskrKkgWo{wH)Jv zk=W**pX2@5^Z)1wZ~{y}MQI}k|Hs0PCH|AIW?qT^Ps9^g(bd`A+e0KSQPWH);7d>a zrN@5$$3x2eqD}ui=6{V@{;R2}D$W0icrwj@pn%f!|MEW>=6|?9v{~nWZDr~FXF{Hg z^B+?{Y5srtAN%>Ah^wi=q^uT)2jrap)qb=5UsF@k|4hh}Y5sExDDi+V_hUc*skKnC zB!JxOzuEqyw$fjk{}b|Ln*WpnO0)mV{$!i~RYhU|xz~U5`A==-Jb!8aPsEdb{#TV4 zz?b~7&i{64tvsMacY{~+0oLvxB+=9Lh;yuGU#w{ z>&RIy`pu1#2IO_fIm=>%=|s*NpU;UaY42+64R$t=LgaUIYqz^XFu;sE*x7C8qJw%G zkYH^PN9^j6S-tqTRzW9j*U{76WXwDyzJ$RiyBZ;0*g2d82(#FK*309T?9wV7+m9f9qtQs*6k>hHzeQ? zw!N{bvu8!HIndSCxsv!K^fq=c4)iuS{a^r751nsv!{3&+#>G8uRF3g+AR<);JBc-q zn^%heZSHQxgAv3ZaT|`zn6Jw`Dj`Q1ZL>UN(`?2O0W&f18DLrtZ2oEF7w9>wMKV77m+xijM1(ng4r-m6#VM&Y0WC#s7V^X8mt% zZOQ(BVjh@-tsPAbp}N(0{PC<_&DcIzOu&p6zTkfx`kWO%U{=UJ7_$SHAbhg7fhd$6 zj8)+l+xnUV4Gw{IksMW(G{3eutmcbD|KaqNE)V^OI~?8+{0m$nf+|9&q9u-*RYhkd zs%WLW1-Ifx70tn>?%rTepsBAr5bWp#uG<}GYU~Z@oRfirdC~&HyjSBU!kDY+j60&l z)}jiWhX2R|bv%zefGXnYR2|`xcI;T^a&9DY%hndu(b|9iD_sqVjk&lik2u!*WDufxdHWe7QN|SL?Cz|L#Czb9r+5b$)Bieq0l{efIYp4szmjIF>++(ZRS(jMbx)oU;drPbtqQqtmgaaU4K}XSye4-Y35Rm?bKlabiJ zDtcDFPKjByH1I#^izyqBI-=rHp(PS>lEk@;g=8;oh$2T%!^4M(m=X@jPuZTaXVg;; zH$ieh30jpfBZU!>LIgw zj>^_1oTz0OL9SsEbh=-O!K$U_fGE^V+y)m?VcUW*n@d(i;vp$gf%5~|SKxh$p&>lU zEludFV}|<8m1BBI%0l%}0oz;&J#g?Hm{^o$gTgg_2P=yatpavfY*-f!^9!z~s*ERX z7}q(dq)6BtOw!=&$4XG}1btlt@sGyUcJ^RSn~-B+Jm8L*x^}4nl@sX0XeKb%HYJwc z;4pmdPeXK9RGyA;&+PCBCJZGMjKt$>(+OIzT?*kQRyZ6?J=1{jenO2qbcIp_@_Lz0 z2~M5>D7*wD6h;XNDGC0hxE~IUQq_bUQU(-ESnQ!Itz)LRnMCDn0zL_8!f2!N2>Bg~ zDB!zM9yvlQhQ|PkwOWet4YAgozGlz2HaZlK$`x^vqXK7Kf?xftKDB0_X2ARAT^gF03c>#`w&=CmM!-T-TEg5B6@tj}Di3OUSx z#S4d-(PLk|IVwfEXjWp@!&m7eiygnjIi%uWYR7K-AE>UhXb z217Xzu9Mb5ZUI2JAa(M0(1@70KphXC*WBINg@`*S-YLct;4?`x@fL*4t5)ItUlZQU z^#%+@T=ZT95QouvDGC0Dt{R`4MuU^1k`fV+;Kadb~yj;5!i^~yoP+Y=e z6xEAGNxJuNntotN8h}X2_BA9Gi8S3DPl_!^;lqL9cv5V6lLKTu#e)(+HVFyKrFd|0 zf7~b>ckp@*t<=beG}0uswoYc;kfg_rsJ5;!WrI&^A7#MiRz^d%y%@iVD$V;>p z8if&sMKudI>944)!9VLN=hs#F4B;k=18H`~M%Bo!+M1fG8aG5yAwd)ARV~QX)Ylzs z5A-hSZ0^C*R4g3@@eT`y#$16Fy@3wUwDyp@#UPK{Q6%Uw?iQsLEIIQMK3S-GGH`5*CkyIU`$B9{jw>=+bW5Y0z5G(WHIEQZqzqWIN$t z`$`NkQ`A$3)}89un%m$_*DlIdS)#rX%@qzy~H`gjX#dX>4q!?2mqYK$ogN!*8iG{DnF|9*Hu^5`7QPl#R0a6t9o;wrM07#-o;=ePH^pC ztq%(mSp^RkV0PliKjZudrX zJ*bfwP&Tt`F`xn;d;tNqM^1uS1O4X6+-d`^&5@~D^09cLb1w*q@d0`QLl3yA`6f|c z3x77C@=uz7lioOla~T2)n6i_4&?-Y)F7AgJE3%fS*J-9)z(NsMJnr zs(fzzUWNLV6e7|v#zZRt39L=2-HiwAPHF6K8de;}Qi82x%1Kka0+@aiIIM%X@wf&J zDWu}OJ`bAHxTvW)FbAT9{ZZH_2ue2mNDUg#%`*RJUXHFVv)I+EP4jA0@mI8;^dmlZS7{F+7E>FfW z&Y1C1Qcl1b9WyO8R!mU9PB#WBwUP|!SxUl1r>t0&Rt(0{QidS5IT=p~k-({;EUzoW zJo6dH)8!1~N{rOybR%;9G&RmcGOhn6^Vu=Ak$wI5`)jJq_8;?V{U!b1ggkcoe@EU% z0ll5Qjcvj1&gDIrU*ILYh$|4i+mhIJO9H1&4Z-0igkUBYvM2*^!-fL3{^aV+Vl7A7 zqN6bcer=+M0^>n&FC|glfI0~-$Yi<~dROM0IhqQECg8tb@0``KIaG_n^X<1A~4EvhVqVa>)la9J%AuMqOVqEcKP8@uy? z*v1zd_k^Lc2H-{*a-$262~AiyAre>>I2d>>5|>{mzg>o}Q*b2=UK*5GD4rxyt%ZVY z!A~Ve$muw}FGILGN2rzu7|;8j4H!-F;tCE3rDDu%qe?0T&FY>u*4uk50IHb)BsX|_ zP$C4T3NG=PT;92fP6JrV$5bD?8dJEGQ@mT#a)l;umda(LY?WU}X}asubfM*@Vo&sTNr@F} z7lxT88FDE(xXQoAjgHbcUyO@VLmQ(R45pbr6>mY%zA9QkcOMJUss)0P7=HDj1u*C7 zuLPzxydMiMT(f2k#tAg%Bg7R~y_nupE`}sZvn;TF1EOH@R9ro+oqefXgYZ-^7@e`K z&@j8688TLpj4>s`K67Z;=W6XUH>N`zAr7O39H^z@?2G_$PQWT9_lr|`on}}?yRing zOM(jxzTeVZb>nRqZRbfX%>?c%$Xvj1vtkm1YuIuM4e?#)oB{tF&zylu z_)`Ucs^L!!{HcXM^We|?Ic|NYrT4N->?X?6PetzvlR(%6r@Kgohj2YLnB%)zCpkBT zGerq+dmY-=*1oT%ovnceHR@%B0lz|89nE1qg|k|r2MeLsb0*R zLu*}7sW48)dSR%_%V{yZ9me}wyhk0V_6*c`25LP6^E?Cd#Vt3f4DeJ)32I3=;3tjc zS412NhUYp2SLbP+LRjGN8!%YM?l>pN@*BvRd|A=g0)rHpz~mTE^H8z@ z28-NHxyLnSRF|aq=o!)>nGR8k6tjF32SZ2GgpCJPD@l>Wkc9guCzTLdE03sO;$iX- zotDi|!8fY#$~a(p7ID}J_6XW0c-Z)e5pCpGYY1am$1s-1AjT}C7#Y7YBx@bn>P-PQ znCFUSKq?tVKqp1JkPc-;JjdkW@#1l!yqdGHeg~IUfx*!vdvU9ui*st|e&NZe|K(xy zif{&;%l@OrS83M&`b+WOC*~>6j@}q}q<~Xkk<4sQg8en)bP`-NBaqEKf@6C!&3_jC zvM3fHx#B-n&a>EmmF|C;pr<&q2@Z^iTYn*QUneoc%oi-cs;b7x0<1XI0M|>#!|4zS zMnyPZirjUH1pzGkVDSr`spS4A|6ir?u$Vqv0x)!HGa5q+_>vG{PT znZ*rr1v-||vkI_frUxrPTu^j#&z`COWas}?6XE~wud>L0wY8=A{}b~Rhf$1y|5s@X zfIrWeCB*@`v;yB}3EG+omaGJAtpusvxMm+nj2JY-K`_!We&UAjB`d;-v?5$(uq4cGN=WkoY?(U4 za!|{vIjS5Pn4`xUCFn~~1C-2mh)i7!=a%+1hNG}n6zUZ$6f?C{sP*A!>>Wh_bn8WX zi1M^d9EJU(&}ISK1#RqON`&B6H+OSZq-l|InB?V9$O+UyCY(A12Ye8+i?1I=XNb5# zyhqli&A2c|(gw4dbL*}|Hs_UiVq)yz0bvyDvX~ND-E0UtY2dG{N1_&X!^ePHo6rJb zu|#GTgxmD8;*103Fk1wM$+#mw-5(Tpu6~T;0-(V*-fTz6z^B@14Wh-wInoKUZ zbZbKD#&{1&wC*{cIdtbiF1`+VdDPiQONCOEu<_(XhMNQ=^5L<5g;o%*Cl#8w4VnR&w++ zqLwfN#yhxh7Kd$2tp=BEa2*Giakp+i-w)AfLtr3JE7xMq!hq%Bk*!_WFhs?%fRA|SN4qWgAaeDovmO@cZAR=pRB?{p^gs_vqds-EonDQNzd>Rdprcrrv zQ9@FV#@EY?0926zDlHTsY8O-NOo>Ev;IlDIN58lniiE_VR>MpV)XY~sT1;iW&cNDE za)p(F0SsR(FKyGM$H3I z-yr-Mf43L)eNuUS6(DZ_$Yg8pe7|uc*`%J6?k}KC( zI5Z?zt+C8;NUmOEnV&SmhJCVig46IA_Q}V+6LHg-z`0-zg_IX{aO9h)Lrbo-Pp-00Hc|(lZzk&C^UXvZe7>2egU`1dbHWk@ zYIFB}z`pN;_I)3+@4GT5_sr0HKPhHNe;ohGJU7Va%``P)11LLtnq&lo9TzXCSG~=_)BMlgLc&6}wRFmo9JF5od z8~~e3=bZKaIZj>ITj?>XLW$a!mc?JqHa+{Qo`HSCxEfx&f#k<};l`Z->&LV1R= zh7U@H$xUV9@tfDyaWN=SSWpU0b>g;@1PxoFaTrG(85@f`hL+xac?OZXmXothBBemI zTVb}D$56{ING;6=y+YT%xQC{blj%1|&Rb!p?CbN4o)_ zC^OZ{(5Mey7M#PtBYIg; z15IeIj2X&nty;=c0JQS99*L}Z(oAep zpji_|=DTD(uQRLj zoOW!?WqS%Ys&Oo?&l2;nD9{^8>=~`Y+_!vPmNeH6S`C4TR*(O(mpW~%SXLr!b2$BZCrAF}jM#@BMg5Ygq3bew_)KP%sN-;ib3BDn#HR5kE8& z2LRgx>u)rzlI2$lhiNDf;vFucl9Of}vN5VHeoPxJ);qZxGsh}#kqg}7g_?Me8WN+& z(~sg}M-s~Q`&NmHBR=dkUdx&FK2@8ujy%{r17uXa@)z2x)KF5EQ8b>E=~XwbR6K>T z+JLIvW9Vsr{yiO4{h@KLKRo^;Rc#)rGP_}FCQ`mee5SEBb|~wPz|b3(li2an@R%}a z{)fldrK)_1kM|0M63A;DsH(gaYhwX4_uLoF43Hjuy~w`cU*;?9%$L{Yb!}b73+pmp zRfo~o7MI8#oi(XNeC6wg3do^=GF0&U@9<_*Gx!`-)BW_qJ0B=g4t1?Mv|`QNeJkAF zxwByU?CS?n57$JCk=TDUBqc|18LQCgG?=TU zTb5TBjKIF$Bn9$rlf4pEdO$WoC&IJn5Yo@#b^JYJT65!!G{o`cQ2} zabt`^l-GGRH5u=J!H+5aYqh_+avG{BE*SRDS3Lf!{rKZ8i8qBAPI21Eb^njwZyx`e zn%de@{NIUq+FBQNH+HWqD{Jm9tWlq zh*=h-^g_!`@mp}dx{v+*XX{s39WF*2Ip%*=Wwqu02Y+o&oL7%Z|v@9?O0rgnmbWP zXDLYw7j!>X-`*UQvkKJwgqN595ajiI2>562HCETZ*Za` z_)oPjh}oI5!Moa$h)Fwv%25}VIbl22IgG{dh6U9NaZNO-VL{D8$Ht8t9h)|75)!M0 z#0lzz->wt>snv-ZyOF4wIwKJeDf5jz;3-oB{BVEB1U^fd65#Vo0*ze|Q>R2X=zTZF zPUvZqvI~nN@qQ^%mkWlf@q}S>uaIBvC!73dS}#Z4Mt1qn@2|zb4f0>55C1O7e-rV{ zL|G(2#=(gEhj~+n6qOrn1T0&&m9^rY#+XqNla zgN_;Pfu5em#R1b1Ex9uUMWwYe(dDAvI3lKM)P_F6&_u(vbhI}v4S4jL(kear32aEj zlPT2BD$zm!6E~1_OfR7SB2}S^0UN2-i-B=^?Fy}or%C)rs*oO`HaGeOY;aN)g9c+7 zuzK145gIC%o8UzyJcI}%j(ZYtpd(5QqX7>Xk~c`8nXVfR{7|zEK^e!yX;*VsTvZiN z&xVHL3RtcU&`8}vKc%ESP+8jRmLoFU1b|!+G&>BP&P`wLysD;M8EwTt@{5S~A)Au; zy{o&k3pK)hAzgB^iFCbLPROya91AHJBR-y|Clm@oF_^w~`y(-58z`8&;9SM&^*S9* zU0n^K2!u^{wD-0(M3pdo>F#N2NQTHy$Bfn%gq*Wncr4vca!`{S!4BT$qQ;&8>Qm)l zdrOlJv6f1(7NiI<^oiu?Os5j*RIph|BBxffn4vY6l9N$6tiT~h=4`!Ea!_XVXkRQq zWrars#p|tzDE-1Zs?}+Q$AYQ~GlZ>!v3ODrQtkmw>y4V>ZftI*9m2zgDq`_Sd@znG z+IvyO@+wrZcm=BHtV9*fnDkmZsw$o2XGe2jQQubtH}_#f6P~*#6ppD7|+BExk&Tn z)n1>svbKB}Xv?k$+`%QKDsTbk`1ZS{+uCZp!QAJoQ$MR(Syr`$Csml8aiIwVJUJ@JUF z|B})vUVT~#lOGxaf%#P6Rcr{aS9Psb^J^J|3^+n;qy+wt3@wF7jfd8XoZlwX==r|C_Zw}WLyF=K($%dg7HU! z?OG5lcrD0X!hS6XW?u_}U!k=i4AacaQWN2RFy^XLfU6`ec1P9I40qpZcN1;r0DeO0QU`(c$Rn?CWj{G+?Bx#{Z{G zXEjC%`&nM&^?O55Hh_20V##c^;hLa|h#I6M7#d}Hda7G+>D9DVjE2#b#8OGpzEMaa z<6<7AC9(u@XLF3w5FU&~{SY3dp=iAli)0@YBNm1V1E^b8^CBE26t54ZllA@4L_MD8 zn0zYnf2n#r3+t1EYW<)xP=9!05dSBWKTcDl@SDvB`ocH-OqdKgIRG{w(@mn=u(z{jY!g^uKmpnPmE3|M=^F?Gaqk z|JvvQ{8LZ=>)+h^Uo5w54*jpW-zEL;WZv_Ch4jDvank<^^Q;j4ukCVP(*N4={i&$` z&BXpUkN$VmYr*&V)VbJWn)zO-wZp5+*wQd-^rr?^-l`@Z`Lsx z8ts@&acy!={cp|q+yBm+S7p`zR+jX?6Y-2m|64Pa?SE^gsQquv6u1Aa$zuO&Hzwn$ z|E(E6`(N9xOfLOz&G_5@WHWjC$+SdTQsPnZSig8l-S{f^owl_m3CXK3Bo2lcZ=go-M zl9Jc3)#rGcDjHr6Z{F(N=HjV$p>6mxK{{QVu9g(KlX(lDk3ts@>SWxg=e0uzf-JHk zSDR9hJ*ut`Cn@JI zL`4h4I==c@`}H6%oor@_KS#bVqc)Z-)f26ZrSd@rU2I9Ay19*Nr_hsC|0@IuA4?m# z^uJY==KCM!)mD|_KTOCoYW*({DL?h}zYOxJrT^tqaZ2icMc@tkU)!M=Fa58%v0~|e z?K?4f^uK(jj+g#76JAUDU!%H!;c3d~e;K?JWZpX-YTevDD5-Qe-)Owvj{sTj{T@ zHOGIb^_A>@C*&Ee{?~9P=aka{i_lLgJ+NU)PDNd?r30cqIP+u=bJz;=_SZ$q=XtBW{z}kKjJg!gG9Y1ILUwHH z##up~C+bQ{>d9h~mS-S|#Jb67f0maDgOg;Dt&j7YZaT}$s@u*cCY1Eswrk1M(sAeD zixX?6JPFp93BY4XxjtFen6ZSXn4AkwAu4oEvg2#~Jc{KgFP(h$y-pr^zl^$hO{AD; z{k$&AlyvkZ9ewGsd$Q^O@&6SpQ;yjJJiGqC(qCCyX^H<_Rnq@Y$TM2~zfK!dPy4UK zKBaX3!gQR9ntv1cqTWB#fQ*yY-=?`D>HITxWYTE-g?T$p`u;4~Eou7=8X6r_Q$^RW zL%cbHKGW9AE4}l*{(0l9nz!v~DJaNfR-ELcoS$Txk-StQloX4skQe7tO`Z{*GcVI6 zt-B3RpISQitgL-v!#R(J&yRbzOA7MI!skb=AfIH+zYw)JCDZX$iW{cgXks;Ill*h$ z{4#33*~&f9dT%Z;l(gQPMeA*76vGLFk*m$TkSNa9)rQ%+T1urb8!4Pt^QbwU8kc(e zQ%PAKzlsYctvo9ZCi}+)XwWB)N5xbzHXi5*#SbdJb+w;iR%&P7+fa zlF{j4rzH+dHSvTT3r6%i_)1fB>O5KIe>Gg$SBy4t%>U|nepCDhf345&FU|jncq%Hg z*l7-GcA819J6A(VC6V$vDk>Z^**Pw9@~29ZhY0%>h)Y^}qzWG_WB_bsj|qYi2rz z5s?K8MMnebiYHU)!L+Q($h9ab9ic?rTDMg^Fv$PMM7CqZ)B?r3Z5SlkDuiSQ!`Ye3)PzCcgFgL?WFnbLxIZ8@a1t+lbk zF_Uij5vZ7gpb2r|RlgEfF2}+cu8Im)J+wv;7i@2A8W&1o_Qmk#Sk@C<7U=H5D_yX) zqootE7x?W!Ev;<uREd|gYz2FhQdo{k$+ZMi8FF^w+7t{BbR=d33M8=% zrMj>zhB+NEozGG^-Y0k%?|Nj zMuE$uWHvfw&0wU))QH5W0~5Um`SCz#6~cdWm_8EkYIQUf5xN&R8vd*P}=5b*# z!n#A4jNh;lHMjOOHFh^QE@}%PVaf_?D4>h-IVxcrw*{`YTA`M#j9nsGe<$XNU4+yK;+4gg9UfYJsa z7rsjyfU#}>?B#!czkG3I%$)XrRaIvDzv|kO{m+Cvn*ARg^4#WskPo>!lTs)myEB;q zLZ*@x;8b`r%zt*XS#jFPZU0+op8qwK)us7A5syCq*&Vbw=ReMuaoXc=rD;E<9{c$( zMou1k8@bni%lUuxJYQ-4PsF3mfAQjvTs(m1&BO=z_YyCd^iPiYUz7uYocjMN^ZH*~ zRb5*DC*&#V|4aJ+lK#J>{~wM1ze~GC1;H&UdD;NAhGj`n^FIRMYtcBJ0pzHDGaUkm z(%5*M0tiD_ItnNq1(c2g3TWv|brfJP|LX);3>h=m{=e2=ZI=K2)g}9%33)0iHg4?b z#3D);p51|trq)2urcFTKd2I_gyCL_YK&d{s(C`tg?zc|!^WObB}kH>#xB z%^fj$7{&WxX#kFZGID3j~nYYc6YX!a{GO7WsM~>1~6c*n1MlMJ@(J$7=QcuuSbwAMjN^He?H6n_m|>-Ovt0@ z|MXi1a%ul)&P=*L`n9C_n<9^K{>vL6zJ9UWfH^*|rY7V3$B$|LSIw)forY?P4T#u?|fK=PoiG{C@UZTzn^foyCK5vz?9-3%!qw=_^YD9hpJIUJT=GCI|2$>iTN9OL- zW$tRoQO24JK_;T>BW=$*Fk2yvcubm+NS&iBx;CsNQF#JUlw%MfyQ3_Wuz}x@A#6;k zN0AsRA3)_Q5)1Wu)wrb<0@18qy_MdINIdGrT*8#W5sJuC41<}BLfsaK=+HQ3qFJrs zI_(-o&w5O8RaHcVRssK?kAK!x`|GObqf|U9sc>Z?npF}c#`m$~|FE-a4-~JBT=IX- zJhT5#b#2YO691ow2aERs7<9PpR6;A-+Ykx*oJ87vmF)IXoJIfYb+o3C1Xob12-g62 zpbjRbsETK9ox@QM%HEKy@*2bOP#O*mKwXfO;TJACf;_nDw2Jy=xNsB#^WxHINQ#B= zuc7pytd&#Iu#y^zr&A~@N8`y6gm)WKB&En|J%ZM{ zd-DT#tE%w(EBy13zoriVziQs(;%;{HpRWAHYa_?}2OOE@Km5Pa{GW(tCTgW(2E92K zO8{~x6^9$~@Pgelf~QqoYWjnTe$d;4oS1H&>2FDk%%qLj_EX6?#C5wstfbin44FbC|M4 zYq7uz5ZE#m#3eg>P?%lFn{w##WCIqv0I)Ec32Kx!C6?acm}&UlpC;U|oY)S)Q9KIM z3xb1@czkU-K})tvA>70Yhl2@O4OD{j&RWL$x}II39ZN_1H$OXu7znOH&& zORhwhs)Mf!)G;> zR6?mtUt=;R=WsaW&Gt0QWSqwy+f&JWGroDm;e2hRh8!P zpI2Mb|4z)aU`BIi6R{zLQAS;Ti`rV7kh8p^VtG|lMMZOOGg`5v7jNSIULWcqQcp!i zpo3TiIfqiIL|sM2@bIvAxXK$(4p#JbS8RZa{7{npET_VfH=GJP7djR|8vG+m;f0Q} z1t}#Jkr#3`L>*BWP|+JU=^(L!$O}7fLD3L}^oSH2OiP3Ef(lv(5u6sl-Nh&=M;e@J zY6Mg7kSwR1XecQUG>Gt0x=&D}Gy*!NdT&Tooe1Q)1}ALkE8x8Xpv2;)grIo2ye_S* zZ*Vrnu^1OimG|PzP86bVtQ7RH9)*TL$&hO3>uo8Y549|)pnYD@9}kZ#bT}4-mGwvo zH#niRgr)r?Mo*cZoS?RMkZ4W|!ZpIqg$txSI_6xcNt6qe=pd3J7*0*?Ln;EDZG)4~ ze{Ui-NPAr&EnHB6o3?|1SSl`D(60^b6qQ7YuG1lWAEQCMX@x3f`A(ApFp| za7jEW1BP%Oo;PFenQ^>zTCd2%&V`-q7ey}4p0yliPN}r&T-ZbY&94mJMZ_X;2~W0W z_A9?~n8U&T7Wa()$gdQB$9wcxNXAfhYrpd=8^W7mC4~z%(I0u1g6RVDqKW=6lv+^1 zhK(f{Dv3(5v=m|E*G^utkDyRsCf>JE$|4lgD!gR@+gO3FXn_j!w>&GLT1)4`E~>rk zq*hb8yU%80fUW1k^t8bdobgZu!Mvkwp!RrJj_3_({6s9sco60yc;XJq-k6-KU~EX$ zWeW^FO(TdG%%Kn&0c3h|wvb9np|x_d;($T8H!6rHw!g}`a8Y^?_0lg^sPnE{4Mk1$ zHZAM1uaDwgf3riZ5|U$ZogzgpeG>+cR$=C50+%u|G`8jto;Fko?Ep(|aB{H?GiO}6 zKIk|P&Y4))i&-joVIX-!2rm>V)GtTk!wAnsDFx~^t{exQJE|m#^L~s;{3RB449IdA z^5C2)L=_XDQBqP~)XVhhf(qS`i{4_VI^cs=sRxk@8@X~lDXZy7O7$+NNDyE_aUYRX zRqGY*Z4y@Cr0k4rNH`r1qI|>sNyk#C0r?y{xD99{84%1mlc@kz*5gEeHh^5TpB{oX zw>EZ4+)LChF6Vy8>0!`&lXAl4gm==Cn-&72`Z)}DwY zle!Xh1ZY>ptpcx1AW6-J%M!Q9%q=JwhOxGVgjQ*XlDXMhr0G@;WttppMPQULB(108 zo6iK9tItlmc`{d+pf+=+5tHo@CQIY&?5DFMt;)c&U@{Cy5m?6YFHCDlawH;BNFItu z!pvG$Bv3EvNhcDRCDF+^%xeX{17uI;z9SxsjOY^;cP<`Mh_yXgk)ch}0otZ^3XNy5 zHpLyVnNlg-O4bR0@?mM(Co;S-RSC<+TouM_`7plaz+#~9%vv7$3p3s{m&bMbDg)#d zH8db6>46i#i0KC~<(T{^e5z?8^vjqOm3TU-PeBfgx9}+=Od9L7;8Vl+i%if$8AYxR zXXyh_IYkKU4KY3hI?o82eJ#cZgaM(dVlV)aL^G^{c=_QI8yCiM1gu_&&3J7}CBZI4 zRzb*MbrP&$+8oqmRFk~UrE(^$o4yhygh`H<`r~P; zkWMNMbl;74gG8xA6gXCOTq_1grL~k(Wt`7R6+p`%O;_#BaH1g@oLU>4RemStG~v`x zgLD3TC#qOT_b3Slp&G?Rf`1cR7lVqJn7q_5gTAVY$|~gZ)%o`alb4W`gcH~ZvwFdM z9a;^k){G>I5PJmbsxtnaD$^DarQ1SOI?OEa$)f+)RW4&}BbWZ)Uu%y4GtXbT|94`Z zlKy`R>;H9yQ+@{l1?m4a1zqU~Kv1Gmtv`Dyss2l<|GYH!{SXWT6E0|`>95ItX29z* zNO(>`oh+4(55APg2Rgfg%5|2-j}MFv19l6KDs2$gRm{N}S3q5vybBz5l|+<&x){+a z7+1!XP($Dm?TEkt&_Gg_5d;3|Tp2 z=9p+6 z5QAY4T8{Z4_+7a0M$1>RqRUP4Gn-(lBck}I#7+C`I-#!;&<%a1unaMa`4*C5p!nj& zc*qmXwJk%JWBP*Qmr7Ve3*;gQhhShBMFVIgo+exFG%WpgH4{^F1@j`Y6;j(G_JvRg zHAe2nTXjrisL~;6C}Xzje1PHuNb4%=<3K!(k;xS0985$&v_Yh{Y(l%*(n--6j&Q|< zmWxVL;glv!u&_#$Of;zitvaCMpmeMPHqvYGgii5-Va_59ybid86qXV|C8;Waohay0ccMiN6}MSdTL zsLEOsPKcOik0?IE1QJC^3oGJ$+`<Lu45@0XJp z53O=Ctx6Fks)mL}Jg6}iPR^F4P&y^oJDRvw57YKPHoIm9r2eE5l8Eb!L}zOu^owrL`l_WjnHbCqzb;?}qru0-2Lj7$t@oQk1#P5E6F?+XN+& ziq}Dw@{Z2(p039B^4=wl9ZP!-w9y@~1`*wgdL29vBw4bDK?>?zbYzom__5R)pkM$~7#h$o)RI zZRCEP`+bIC7@HXzn{7Ye-#_PZ{yFDy9*^_7KA*4m^To07^Qpy(g`LIs&o?gj$hzoD z+?SlS-f}qYv8&>25|B}FiYd%5nj(f9F+(2SBf9myoI&N(_G5-A1{9kE# zW;**Qh6vLhx_U~*var@(WOk0VZh6(Oqh_(-=<@Ff*I+_>Sg4@WcP#mjKW;oMZ&ZL$ z9+mm3(O)K*N0pEFs=rT4$O>o{9#YBmupBcomOO1!{-JwS`GkG*^%H?caY6sxeeyTJ z#{w`vjg$9!b;A44y?|8W#N9>H{y!4KgN74F$KPyUFFeR|`B zNf5SIHTVVgQG(poWwC_ckGz^+b-akAeC}}cc@-OX|9RAuEJ&)FbPO-naiu&Cg4Eij+-7=AJ9yFE^O|Y@nc;cm1Nt#kNMyvx4~=We}Nf zDW3#It>@*J#IJT3YKR@XR8cwUqWu2u^}SPH#%k+TqInZ+8~RQq9`DF{R`?I#?cHs_ zd%j0F_@m7spDf}1L$RRJW8)VRYyLSJ{yJf3ca2-9O3Ug6?}hr(Q{}@dF}&hu9X!q} ztsje2J1*WJcs%ok6K7q}xj0#Y<8Mt2P8t05DB!)U9D7&Nt+>lY<$Rjt9|i3vFZ0h$ z{7sbur(D&#A+#}R+8^UP@pZ^zr6NkkL?o^we)kJ0p$wc)aie9D7ww=%ev&feo|Jhd2nTHqOh_x{a2*Ph|Wli$8B1Uy`e>U#t^ z9dVQHCJq;jtT8B5n~=L2!Fw`I*X7o~DcqyWw+6=SUn<<@{*gPFHouaHIX*VSslIUA z%ZFb@%H34}0t_Ge--^i`Fyb_R?FejhjMK7z>e}_VrlvN3nsYIwkyBT`z zDogj{e9F*FrHK5$6)i20xxE+2OR=m5E_gSpq-f%p!sOB$fgpAH*7C%7yIDJsb@)?b zFF&ra=}0-B`;LhiM5zhbClM3Mp23Vy3$_fXYio5s(8JWH9{X^tV-v-x9?j9W&9h-U zGBshC<+<551QguQ(rU5_fh#zT#HR(-sd6=fuEcYQ{P$Mzl*buh(cjX_T1-@y=>L{< zJp60wV65KL`NJN0T|dPilqi#_kT4MY}E8gdr&K6 z{$X&^Bn@0xRaI71H;88xW!ygEc9qD`exIY`s(a%$OYBLj|ECL&V9}%gJcU*Mi!JxR z+ar~=-k-b5YsHVVP>;MjyslflX?a)?2~K^P@TIu48e`%E`ublWcJj>o~&2k6m&d{hk-^;5WTxW~94*JaPERcQhTloKjDa$J}kZnDRn`v(xB4 z<*t^2PBMbO3^4-sTwgg~k#BVlcKwv-eZ|bY{`2PF6-u6UziMd%y9SWHomC(H@5be* zy8AuHJo0~DbFq?2;119iZhQyt6p`fLc*J+=sP53`d7`*>|HkS1rMuOJCz>qeDetZs z{nPo>SV_6%F*N5^w3Hv>_=Eg`F7i24|M>B}Zwq^A+xzDpT?N@&$fnl#B{WJu6QD}k zzTx|HHahu}L(%Q2@qsavhOj3JKcw~C)^&>*{zC}d=ygYQmYeU^mpgwVe%_ZJdK1&W zP@N3_I`U9+>YsTRbN}6`Vl}&8XI6!=0(Ro}Bh{jIzC5@o>1pHnD4NTuU5@A0kFzVu zrqa*VZ#|9v5%h1oFv$C3K*WE1UYuJpD+Vpki-J-vl23m07@Jqhvx*CU{pIzJh<=AY zJm{3NdSFYk{!%CTdS~=wi{N9Ck`paW0A_G{FTPOXq%ZT;jfnIQF>pBiW~W0g^&d5&mM-sJ^jZ@2s_&gF-F}6~!4A=9MU6 zMO0sDm~-0Ip80%rFZT2D5!6A?d05oWw$eH-J!jx_`F`x;?ZAiGrw%!hrM9l8qwcy^ zEsx3)Wq1^RRo>IV&G{NkaYY(zjGA5e>fPN__W09Ttt5A^k7`xs_HNeaih|0Nu6s%_ zKNG(lnkMhrOEaxJXnZL>_)cCJbFs)hNa6E% zT@LqW+k=0!5)}sx0{mlIkgJ`!FF!i)KfXnXS$XAoqO`5OieIo#>&b1x&B`|~^{%Vx z9OL#cy7yD=Y1PZWDpOpgF~eV8uI;_xU$xNJmBuDpAnd^n`>&p34!I?MfKD`{uHC(T->-lCh_Ia{T$>(o; zPut4b!T1LqttmpkmXz|jv*z+X8UK#TS^YS-BUe`Vnr{8`R~b`Q?r4uxz3%ibJ5ta8 ziO=#78(mzagk`Ii|LL_pqP^P#?^$;(ZHa+e59g7=j{?dH(*WdH;7s~l05xD`a;q6aaO_o}X((z?V`ER2A;@uUqD1zkv@Wz)vA3-rSLCR1KT zz}KN*c7B&S0<%5*Y(rThhZfeRZQq}PTroE>lAy90u*_@V=V&0B@e3R;<&+B_D0bJK zhj*lPT}gWwqzmdWuy+VtNsGPmw%ZvEScqRR=<;!>CLFD?x7AL~VK1Ns8ka|tzNUe# znJ$A)AQD3DGLs5NAxP`SLJAHVY0dCng#z;2by?F#7~R9ZiyRn#YaP z<&mH148_Lf6rZFAl+^*k`g*3?78=T;%$l(wv>YH(FM?#M?aS;Wlsf~Ndko_9kpB1X zgYi)JnVKBa{YgH6{n{)z-6OG}bi0{JorRZz0%kF$Gkd?9s8hZRUyNtVk@Srm(|QWI zE0!I)srH6`Z7x&rUn(e<(vqk?S3yb|Ein0x+^Z}HQvjmA4JDMrYP1&NyNn76j)iFF zY%`naT#lp==X2BktH)CZ0aw(v2+jgqL8K(C_I?gdq7mHJpn;xikdQb)O-dkkC};q{ zcbFoOtxQ@ob8gz4NR-F{4{DO3hlZCg(-$QKnpV2aLbB9+T7lx5D7Ev6W#8HIyy>`l zqt`3~!c07L;k~ePL;yYqSf)c@HIZ_0A@KQM&4=@ja@JPQEfJOY%a1T>;h( z0Ubj2-j&!YXTMNdwEpdoy#qV|WWMlA9UES}G-Mw$QHBBGbKss4YcoR_X5J7n_oDEA z5`F7seNyQk6Hr8hz@+e*=s|5#^9G_0ut$_b$2kl)v9`vOiQ;oBQ39q&7kXd$EyDa^ zSGnH&P#E5+=l$=|L8!lzn;WewolT#lu@BI*rr%dJ%Ao$+`v6_G;z`_Y-K?+n!SYuD zz5RtIVq<-=xfUzI!nr$xCPKGwa7f zpr?JvS{_>G=wp-h=%W-gHZPz{Fe`ZgD?rO+D!e6dKKjb7M@hh=W z%C2s*0LD5<0_g6*rCXDvk{*^rHhu#qb09yS(W=&td#y$iVr{X)_zvKo$Y13Y& zGJ1|&q$=u%48f!n0H=cCdtVCBdbByTB7%sP1AH=N9DoH5R}?{8wUd(S9fOF?RIgPv zQvmg&RMP%nB%gpT!@I**Mr<1kRhM^c+{HyDYb=f8b3sJ33<>diZ$l1ypQs{e zc`06T-epD{OP_#Kr*M%9ld%$z`Yz_|78PBP8@|ylXm+@auomLtpb?w5_S#4~n84|< zUies>0F+W^Vhpt1-Hk096064uepqRprXr6bXKNtMbkIJwEmM`dNi0 zZ(5?CchlYk$|;Olm&{iH$Os{t_q_&GHF`~$3OnV^LE89eN7JW3nsH8!z>AK2!{Q3Ay_6J2BEJ@u%|SBj!BSN+_eHwpP83`=lNhr zC^L#HJA9R$b{K(`$qif0Y$72y=>&A>iv_bbQ6U}5T56w}7P&oMq45nB3}_%p_dg?Q zdC-8l&Fig3;ti}uLSs$=KxG#S*l(>9!N3&`mfq#CLZ_f?2G-5GoVA?etd-J(@YUFB zqoDTpsxGo4YC$|IOf(RSpl}1{q0rfAM|SA$@NTRhi?Tav27p6E^7G{D9F2|p0-=!Q zT#!R>uu(I4%5t$6s>j+lv33~N@{(C;cBMrS{e+>eFSmc1@XUvM?QJR->7lm1$rQtN zR%>8~%Y*4D7mK0aLs>~ar?{LCCQ<(ap;|yLXGhGOSOGg^Z@fzkIB6E+hgeBlx5tu) zJj_(GoAJ^px~2a?E4Xi!wf!TxjNZ{B1BcgQ*t?`yC3VnYktId10aUS5^4-Nud%K!R z#VdH1wO5g2pa3{Md)%)X(k^Z71Zh9lq%zqbK{tZ#w@H|4u3Sjy#ph~o;*z&7R}QGn zI=tYlG>k`@~fdRjoko#={-^GM=Bl^?O9m^9Ff(p&s2Qt1kj6)?KBk{0h z$ylA?uogTUP7NRdO_>L_?ifbIPc>HmcQgRHIPMrb-#F^qBw$Uf{6jeuV6$jj$jUYl z7q)KspROKrc>xCUn_47nglO|>n_F{>*0Z?ueAkta!$^AC zMHoOg;t_}eFM^>K2aTX~7)qXn(}rV_%Te7(y!BjY8y?W)H_2mayU3;!p@avpPTe8D2tWfI>?27`ppra8%kZrCSYjQK2CnDy-fUsU#;<$x!Ixj z4EKNlfVpe$hdhX<41ySYlThHYOpnLtof?r)ngaBIj5G!|Z?@_}g7)w*1iUY{Kp;0_ zZn8XMGypGFRUaxLq?4xTS9-i+$f0NX(fh@90C#FA!nEAVkn|{O*qaWaRCgwQr_ULIt1o9WHo?fijqK6% z7v`&3a%J_jT+n&KB>Zq``&bGO?P@bIS*ozwt0>QWau5JWVW|ymzhEkwqmamssmnyq!ZJFnu#o;BQq3(1Rms$ zWcnz&`T}>7At$~Pj+|wMN5X*sWpT}-L5%7Be3@F^#&SxMnG3fvss7T zZZ8yfc6H(J6*ujd-|`3X$Y_E+a_1fK_xKkQI)f$mM4yH^lHM=14xK>luQ6=H8^o>)R<`Gi;!IU`A8hB@ zQb!#O{Y{b>0g&qrm;DFE@_iW0AlA_3FzHAp1%6a5)O@f3a#(O0tAsNKlzWJNj0D|H? zY7>iP%+M4-8}aNp+P`PT?l1(G5YRbn`|yReu$F6Qlp=ad+yB+86Mej&-gX3o*PLe=utZpMF9q0p>M%e*d{T=Ex z&dm5eMbzQHBWKzjl_KhF{csd$-uKI39^w%+Qw;uCbG>4{R}%&qxT$9Ex3$qa%LfPT zkD`g`y10Gd(MqLQtbgZv0b31$h1MZoMi)%rweP$=Y?Zjeh{7df1Dn!< z8eh+nQcYlbh?33KJ-?j9^r;8&NeCP^Z|GY8O?6+L{etA2y;x}O-dNk@mXx#5)N3}= zED2ksKu@REdI57w^%yMma?$#QAMw7(u;p$kHe=9Sf+?<8gQAa@hvbgF|1JIGV;~B$ z%P1$#`48!hA{lF`W^624*z|kIO4WDgP`G;-t=Adm&tUu7R5sW8;ouPvc57c6^B|Sx z6tNiXSO?zA0go*X2BIU@y3K@q4hap$>Jj9Fn!xWs3>jO%+OY1b$G@BatunuxYPwDI z2s43`ZK#%ebKbYx*(>SVPZ({rd0Tp2J|^Fl@c@A5G_Xs$Ai`_eND=x@-QG(AMgNpc zGBz4S;t!w_d*tYNUpwGF(AlgUl~){69E?_^FKB+7!?zwG1Xuc;P;6#V>L?O{4fJD; z1`veV4BswJw$3J1th#QNXFjfLO7R3~=W~)V$Ad6)B`4BonzeBv_6O=!%snL(w;u$7e~61dG$RG{ofC;zPtDYxtN4-klDyObWQV0Mmcx()gQIFbh7D;hqklo9Ia8**s&gZj z5MD{h#qkPUI_kh=wAT@C<^1-rD{!CzuLpiPN(R`j8!{aIr`@_Fg5mlT0iR!w&p+1{`Ri0Z6n z&93TExBE~?>Tcjs;5`{kb8a|HYBFOo4SNAYgM^1{-TsUQ)l*15P$5 z+ksQrD$G8NT-{bN>;Q9w9??qF{od$EQ{9^r=~gOL5!>I=ogu86(dS*3v!snVpLOA* z7;)R_oO3B)DvZu{4DGiJo;3l4Ojo(F!{{{k!>#uu2S&Rj0-HImMMx6B(y=H&=#fXw zG8aUH1EKpY20VMe4a<66LCM3jcbjqf&P;9!@gh5vHm@n+I1@&Qrm;xTO@9;_`zz_r zoe6|5!1*`ROYgZ9*yEDM>AB=3OdcLvA4)!;!KzkjJPPEwU1Ne<*jCxWtHrZ`hJjv7 z{FPM$dv&TagWxskm~?5^8A5ND6M$HON4C_9^JSB47G0 zl*`@(uqwOeL6fK;QE?IOe zRdCyIVtIrY%Wodau02pkDO$6(&Ct;8;lCu`wW9=(g`+=HWUipoZ|gGuyRLg7Oo&uJ zyqmO`gKc7_cz{UE?*5KGV(7tCyrLeJf=)u#FsPzzzt)x+bXnt4EleVK%q>|bVjdP! z${73$LxnMo)19Fk-}AmoM7WW3sc%4dzwYSQgU$Ot<&6d%mEEa#Cnf6FrZ9eCw1sIb zXftbek}VTK`C{)k9=h-+CQ$<62<^C-gPwE_UA$F>7O3B!pB>b6xBTw_Mni*fx#iaU zVh3$Z0_c<#)4LpxwP`ZhmI2sf574ge{h49pI`~VAX%L!60D7KB=*Z~8`dR@$|fNlohB*$0Cd)IL2@iUlDVC&~Zu*{|5D-AjZyRE(BN0{6ahv3E0g{=5uO zsw`O6*eIOW25%_QuxhL5r z55>49w^@~kG+?@#cP5L&=T8@I^kaZ*mJ{d-sFhpho7iO4$}X6_t)bJz-uk^&hw+>( zACKiygm|$;vGbnATZ4(Jj@0FIQgTor#WtCDYp1r{F{l*fTC8cL$UG2KMk8@!&rCJ_ zSdEY;PN)V3wADBZpn)F`TW7fSD;F*lv8iwZJ!n~vCP8@8MN3on=gInlY zY+pJw=w-=9W&z9>^$RrFsLp~+q?ze5TmDEvnRHQhgbP`kF<1)1mXV7wU zQ7eUiYWr!9Lm+9?%hdOvYt&34%mq^>0HCiKqjiC;eo3BvfqOn^9P+{E;003o1V^M)aFycPp#eQ0B$_iQ7p4y-sbSevCo-QY(O(rA} z>e`!@;Yaw7pC60*m$2*#0UjQ5)tNGh%i4NPBzG99V)Pa?oJ9eeVOA9tVN`gle4XB( zh;e9B-Mr@!BJFEa@ghARMJE1{PYxqC;KjrDr@D`7Lgo)a$hYv#4`PgaizM1@&~}Y9 z78<-(rbwl)7s%8~)KC*8v>?ziMqahqEZJ*ZB0D_PS}Uwi9-ciNvc4$btL!ra9PUC( zKu7p|3N&9cHTL`7x0yLO&8qJNxUkmK*#?^HfAhsdSDX8=*}&1nT82y;gSEm`hq0KS z645N?4&qnnq1clO^*R425UQg`*vUJTzP?k9)&!3Z3!tnR)3L&Ohf{di12%JpwXy=G z4~%ShjG9i%>~A@a5?CV=t)qL%SOyLnp<6KS95l+OYOIY^g5v0t?$M2=Ai{436|(V{ zt@|Idqy4T78$aiKd%B6r>auRmiMTltIIcR$EAthDCN&h|K1zu*H*>5Vj97%dHdxqx z)kK{$V+P`kTBy#2 z%}ql)4$!h)jzS`ht4;5}I{9iWG2J0=)7{x(aO83d(oZ#l-d8+NH#ma>b>%oau%}~- z#Shko7-jV?XlX8Rc*n`uoInEJXp)8f!uDWdP0%dTw!EoF!+x3+Ad~#>r?S9(3F!VS zoeO7tYFEr$Vs)rtaEfRbl(k&lS9V5Rj2X15#Kl_6Omf3&6uj)*vSxdhUz|j4{~Op4 zO&?^etH!2@ZBLi8!FcZUJytIh3qyv?s`>#C)DK@F?0DGLL|6c$0j>v|TU}FBL&iks zyYe5Rjo|FVLfQ`VX0}$WVcOe+Z4of2c*=^sk)gN- zu80Ag_h^k*)Y)rcj-r@b1!=6q?P)Xdr{^M?fE|7)@Rke!p&nt2KS*c!yz$-Qvq$LB zD)REA%N!NLX~Y7FvSw-Wp{=^yq%%TyzW#8x0EOC{7*)?j&1n0r_6uVh*QecvyA&a- zo9&Ikq+ENz;m~*YKV!1D5lw12HM{vz0EdP>r%-6ZWCNZJL&ymv7j;uVF5R*2I(gE1 z`+UIK2U8Bo<2NMl-s8A$pnvaza5o_cYpM{`2%^v5;EwH1D*J{C*-sS`86Sg@av| zHzo_VW~v!Xy-Z}nah}zEuww{|`3o39!sdQSy+}SVy*U*^Oo-w9oi`xij)EM%cl6Q5 zkVk62>M=K09`qgo0XB@yeAh-3g>39^uSp;tqeQH!p4~bvLB~^|mnQMVMA|A09d(_cn%TU-@}G8n>>4SAY!bTI}wV@L^3f2IyRD zRhmTyU(#SiO_Wkg#dbG>V-wIJX3e|P6dtEJ1Z3^g%h-SUhKb=oCzSRdGjxx_Ot7sj zTrH}p<~wwT%ie5%zd6T?M6znwKTs@i`*UR;FdIDCIPG_kCU36>B+e<8HxZXCm8nVw z2LyVYrR6O@;4PhjInV%CAcc@S6JkZ$ds3B-0a4h#u(#w)&=ue{ItWxpyT;D>(cx7X9C+ej^!W+^g};{^q$kfOF9BVL3Y->p_Wq0NET@X8(>Q zHTjKI^UxyBBN+p&qM4VQ2>INujEjI8IxKqqwcB?;e(@6Ofnm~>OH=fvRQq0}9;H*1 zK%j;ID%eG)C*LPqg=A|5Z@3{9))9Ion85KN>ZNB{PEA{Xaf5)Bc({9rsBZYKR63xp zY&j+buG9Dsy7sp~NN)|gM4kogS4=jV0Gz5MBZww)dh`B`xriY0l3$r$;0vqHQ7)RI zyj|VOH}TZ3H%uC-GwJ};L0{(sP7(w+YKAO>g)ha-v52-`+$PbaIS;2*>`pxT4QQ$5 zy-dhj#RxnIc_gs9o?Fs6pI0it>s+&*Idii|0tTl>K3+VY+0Mx*@xU%V(vVMFmPmQes8k15jit2?N$r%SZ5Tg zrzPfhzlc}Ft2&g=EMeM02W)}KNF{z^*(Nrj0NW3aG@m|Mga;81H;T){wJzw);c5g~ z8nqQ3b~ByCbZXOf`z>pv4eHh6zYVW)@WJdO=WONRL=?82G?h>Ss0SMRUcD2@66Qqf z?Y14HGs%B0{=IZ589)^oEuAcLWE?TwI$`d#L%I3?aT9uAtzt&ck@);Tds7y_xWjO8 zhqkq)s^h4Zx}x7qDcpCiCe8yXHc~EYR}XpJWlYa)z5N%?ALe&+Gosgo_C)Mij@$Db z_T%yMYVH|Kr)>-sr`U`N7;{x`{)~7%kaYy>#|(4=vS-%kC6!~X(i`mfo_x1e1GeNk zHXRW|=h{>T{Pz(LGjsR6-^}8UNX8kNmujhJ&YYP-1;%*KhY_5`GqSTVP3nZw`P*%cog~yT46#`NZRe~T^+KW-*AqzWnAZ`@7k4y!t%kgee;{ zlbV@9HD8;X&ui`E1yek2c+O8bIz^st{b)7t>Xz$yOW{hFN4Bb`!O2&HF09#%UtPIn z4L1Kst-5z23~=Yf5a}V5_^0vYm8|gxa`7HFU4HKcpQ7E>NIQM|GFKyS;`IvA?n-wYegZI2G4>`;Lu8ve-tSz zINTp{#^HmdpnPSx%b(*)*9s4U1<%c0_=g*@1$rKzXUxCG+d0`$qdGaK9gfXFhFb6&uA^ z{HsQXPDlJVr}5~+;Og3q!nU&~@81cyhv7`nJ$-tq$Kspa>%6q3cb_DE;2R6?{PZI5jJ1)Amw(QNmH#E<+^ zCnXQGKHfUhp;nU03v<6|5OvzEJMD+eo5$lknOptEuM!&;IJ-EmKDqlIbQ(J?<@H`d zHttW+v#&qFCKG>_UxdwHgmoW$D5*5!Xx)yuKrwSU{;DCV`|Fo>?w+6GbDWQq`(6p^ zj^_P3I9z{uL;dQrZ^9x2&riP6aO*oO7k%EbyZQ^T$nD3E%o8?eiWCoFxttC0%ZJym zjb5zf{7=^N>DxW2W#rrGtEZ6q`u+1Z{$u&+U*s(J5-4lOA8*e;iA)w+IUC3Uypf)R z8rdJ+&Y$))Ifj2CB&*wu^8`OE+;b7K7BL?(^%o7f<|tAaC|Q_a+xKzvmN%a=LoVTF zxp<|z>&F|D8E2IQ$5TF@{4S}c+hJk$%OpMCKrS}-Ca!hU>K*2NL#ECrGg|(EyB48* zJOjBL_-Zxpjq~4^b3VaQ2A2NNk9jk7zdze8Mcw~&p(W;?ka*5h{x|BC-||IjxlfkY z^e8JF4~e`ty>NW4?lI?m`<8@@3vlz-QIUGZ2iO0deBz~+kzX=up7GfGLUqogg_5%C z4>`Gb6br{2^zpT_M<7MKn9PMs(VzT^mTkT$e|-dg@n4!poj4EmcogmAOks;soX2EQ z>NRK_?A$-r_Wz})UnipR6S2g+^ZRu9A!ZmA`q55y$rgCRnHp-&d*0#HfCuX5U1u~<5uC!rZ zzkA4`$Iw;(>h-s#7GWII4{(uur_@D1haXc`JGUPd!%gs4bIBC7(34XtY`z{%E=YlN zcD4MoKE1OjdCI2lQA9yT<8e6^4|t5RAV-Hl$(f0#H{VsD&+&yU24vYOHMdvTYg+_P zEWa`TuJr8hNt3hA39nM~=cG-zpSg9MK7F3=N)V^jpVs`z2LJP}9d%}%r*Fh~>Ad7L z)KEqKkvle;^*xLOC!**6*lBEH$%pWbFW}f>io;c>-J??{nP^{)P?I4_%(H4H!V z`R8KK>9ET9=>9tKW84#*vK;vpZi7h)H%l7|)43g?Drc{HDb(E=J&cG^Z8)a; zNCoE}sGk*OsGzcLcxvMEc=tVeAIIq*07Tv~HqU2#K*E&s;^$V_%<6x#o2uS*pE?Q;OxA>mGGCB0Y$QI~La@PEieyJBsb8&BzCLWl?4}qJ3~-5x5Nb)%X4R{_Q`m zJZf@nela=_KX&!L<{Qnsi2{vJGw1?x<}dstvsDd^bGXEAJeeME>o--c4PB9O7=pPD zofaG7;W=6vB<$_@3Fx$RROVoi?fW%*d0UYoIJTElc0h6 zdyXy5d*w0W1vtC!y3VSFoACt4C%GMcHEZL9ou>1&gdV2Tw#5gA%#Nyv%vXM8>J%l@J2#k&q~^{!!M7et=5i9hiA)1z!r zW!4g6_)rB!w3LK?h~477y#HwW+Npi1-f_wA*LLi<6yHY(gkYDku!?dZT~{{AvK z-KoxDEvcXTR8s$NJF4jURntfJt~d|)s&qeGy~^|P&gC;Ffjq)4=hq=YS^=lNT*}V! z4i1;TaBqSpYf}3mwp(q>y)Dm{U$5>&4_RFLj@Gdl&M|{s&wJ%RZ*UA=y0ck0TY0xS z(K|lD(s}yLRZh2LH;a$`N7JbXp;0P$-tZpesP22 z5?5qhu6y#Qt95Q^DToIe*Hg3n&MlnpJZH50tc@ zZ>{vNpPTnb;NBu5lL0+kO%~PxwG->73OOA_cialUiHHiAwM*J2YV;mIdEfQS$z{T# zf9B`sClQ*E|MsGlM{j}muKMVEpNqfvWbzc}iA?TDvAHx^Z`rIaqo)~frLQj4uXbZ( z^jx&WxX=F{IKs7@7$hwx9$gf+_T{qyY&KMu6&3;eGe8VEplc=k}s1ow=Ik`#kWfDU6;!Bo~?Z8^|*1l zVYz3kd;Bhc(yJuC+7p<7n3zm_cCOH`x{0W8m!|^Puij61b>3xZMoPB(c}32wgXhRJ zr)_oyBx#!Tq$BaVhkbv}bstLq2QBF-o-@j=Gh(>eub`Q^cA!WY>O=o(%S=_@x4#F= z{YoWi&(>_>O6hm5C)LQ_AjLMzUX{*@u|2Lk`1`KW2Q|h=%@4MuAIH@0s;HiwnD}#i zl|Sz5=d6(*mu}6;C;J+H?~q^m>vmP<8~RZ9VUM%vw`0>kr4Ma3q9l8~<3vgprev90 zr6V7ZsrR47`{vgx4YUns=u>^v4jth3c$umX!n}!g+Q~kwiRf#3nSvu2jlVaVuEG4j z#Cf)mx-K3YNfq;~^nD9%6)BEwTbfE*@47L0!rO;~g!2E+QRtbwvV1fwc+svoK)BrD zi^t}3pYKYlZW4CNXUgm&SJ@}EhdF}PeKW&;JvkY`V`8eS|B&F{ywPv>5@=H2GG*5m zrK0ERIyYJYKVec2Y%h2ATwAR4I%g4OZ3Y**EBO0+{EfMsb9T4Vt6x!!*9F#UyBZ0X zMgug>@0~a#pF#;8(|zhVsL~kz*(W|!J8{d_P&P;ZWMzG@-D(w2$5^6*+HA3mqA6KP zMNz_ns{ZN&2;(PV9DUE#Hoo;>LDk_GC8I9R zTOfufR#*DUapUoHj+wtN)RO{=w7L0p_2)SevcoB`rH3qnkmmbm&#%h^+%hh7{>x}z z6_eZyd=i`@HD@eau)QtPt)a?&Nl?Q(B4q;esU^v5NDuU=U7~@*Mf}@22N!`#>qi?G z^~v&raj3Gro^i$EL7NAw-E{>IiVbLz?y-}ii65JJC$iMMgO%>OM+-kFkZt$zZ`}3( zKl3g<3HfqGr}{HnM#La-6$dKn9bNLjmWBPkl&pLHOhg3emGtP}1Qu`CElre|>=!@1Y`m~54ZyLlV3QI1NfN#|0yZ^F+`g-SC|kNgM>nEse@&f3Kx z#}49l@Nr4f^ArF3zRyoTC7w<>+CPw=+tf28#zFV)N%7>q&lf{G zm!7Y7__%8z{x!S&NZt7JHS$REgD~?usFt_v^WsU^eR$t8CBlp6(bNA9xDoe!-66p} zvh1(Kl3S0~ICDCF_I3!=fB0^HjfgI6>D7WlxeFwRwCY@3+jBRygwM@b4;-D zvA~GqfBf?Lc}`Eu97e~E=lL6)_)uae^k1-IR?FM_B`IltZ}vvNO1t;ud#jp~a{eFv z@Yfl7SCv*TWk>u|X1qKjpknd`cJ~Aq=$h{KeL|&H=$f^*{cK)w%}?mcN=I9taZH+J znkDZeOBvJWuDO4~G^hW zq;ipf?eH8sAu!$m-D@vPh*!3OvOF=`EvA_cXtLN`yT9ZXDD3t`Q_pI#SEY-VW zlIVK5x^;@O8>vBz6V6UNto9!(eEGPdSj7@@&vivM*p;tiC{$B762;|lL+^4+ke9WF z>Nxop1||fn`l*BRyJdgNZC7EgO7YafNq2&1?f04d2iS{h8Ft()fNqIlaG`Ls zWRIy<<}0)aOgiSRP}kesO6AuY7K_C{tYmVJxt+3)l|Pwuq)e`XDzq3{3p8RFRYH4;h!Pu6I-OSU9Q-KZDm!0y zmdj9OfUKv;jr$?+>E3rc_8WxwkkbCMxq>KF{&~l@2RkBAwKH$wV9DF(QEHfaNL21= zjiBwx(-{^<4iz4GTgbcjftZYStpP$x9;>{Y?|!1a*IL+W1+XKUv1uQX}Et$ zE8vC=r~ancE_4&j6C`DnT4-SN5u|=r&re;Z;_1<(vW=i^)%96rSNq)Vy3KRssicyg z{`TC^U5~zjZqG!!%d@;O6(=65h4s;n@#sK|9}0<7>Dy?CrWw5Z+9l(^zsY@q<9HSR zT-Egt=<{mFcZj8Cz~Ex(J{bA>f*!@(+8SdYOqeJ=B3m$zpZrNNI`3*gZgT=#%*tJO zsC!ngvp19iQlbzYh4f1Dmh<$p1WYEjYCyE~><-zc#ai-lVSGlRm z*-nSXd>5YQ$TZoETfK1hvI+k@f|1S`wuYZ|yDWjVFZiz@DnL-Tv&H6<&!~MT+NqJ# z2vYUP(CB{&|2;hadHB-ImBV*ldT%#f0t>cg`^;JkJD=TPIf#C~X^-iX3J>X==au$R@vv5% zJlu2`h|8_b$mKH^-CUVTS#vQwXW04kH0j?*X#o;HC{&vudwBNva*UN#WRtn&gJgmv zmwAp94DEEXv_6dvGI7hM>1N4nj5ts{-IPUfBPY_|KhQ3^Un1`E`~LtMr! z+GM)0dg!DtYPHR0-Q!-X$?BJ0%9j#exH(`sgDI_D+9UkaveKx$g`%kp9tf6QY!#+# zMaf537MA)%4KD0>5#t`ZBDGyX&@$pRb2h<=8#9%zhZn?fvlycBNJHL)#xVy{wq;J* zWc!S>jok6s&%3&rM=nlx+Sgdt+Mi!zdCPUQ=`P|!{h-NCeYKT*4F!eEYy*QXCq_Su ze_F4@9q#otoepBdtJ^7jz;Bs{_+Y2$l0ku5${ZM2&koXZZLEK3pHka{rDtq&0Fo9R zwpL)X2?IuE(-^Btl{FY|Lkb&|v;|cWWrRB0TOoB&pPo%qWz=r&YIJ;0DM^D0cz+V? zRp+zCJ?3L@EJ!^u^T-80V0w zmi3LBM(fObj)tst_G1mL({2b|N`86&A(fo3N{moZ_j!gxio z>wV0i&Y zcj2t9IKbzIn%Ixp#x}-NppPZSMxeYU-Kf?^lvFt)>gMbt`-odlZ=;Gn>1k@paTgw&Y-7X$B(|}jv?c=qC%xdD5L4t+so211 zoEtM_LFDoVlJ^yrRr>(&UYV5bJJe3$^BRn<%{Ukk@>hBH%l7#I(6WGIb7>i|$a{u< z=dPS5c6s~B311eN4g{izH#~cf#tDw4I{~pYPdL(6hyxB!cfjFkjo{e33=N>MOb(bV zseZr7=G5ArlfF98^7Ptn;~)GEqp&CTTFagjgL^`9;Bwex>o=~}cu?EKnmmqbIKI|4 z*YVl!VIuLYn_D|}Vw65Q5Xv9wfpuz#Zn*YWH(>jVC*->7kOPBfE(a#h9G)1x7t{`P zwOJgvYCp?MyHF#iLKLiC^A+1X)N`vaZP|jnD*OwfyqEjl=nSZdG$*$S^PH-~Sr%SE zVmhV?S1~cyiQ-b!a2iEeZR8ZF7X_x7e0Ci^mF_l&nrv}sh4xBDVKE!o{yVOAh~N-S zwnFN4d)`F0_I|+}} zw#rw3knp-RRDD)ep>lcw;OR}fGS;mX1wNCmF0Sat>h_YUv&usk;2GIXK=LKe)b3kZ zj=Y{;yv+BI`Jh0`B^l9v+@@u^N4UvdA!nduE7~wMC0JHHYhmf+R@0A%`ztgn_;PDAoI9b?SmFo zaHvsCQ@KPqop|=Ab&TYaOMqv#34%HaW$W6KgNt6lP>fXUWz$7;hh(j6cLa12@Kq;) z!-By4-5TK5MB(MiCCKUF(e5_W3x|`lJDs^mzRf{$HiKBzttA2LzmB>Sqs`f*AK1h_ z88ME7mxg?eXEMs`#`-3XCXdHFsZX>-JSiiE&|epYoVx%V zV6@I^rT!{X76bIuT1c`hmBd{YkVlp61#xi+fMf2lZUm^y9<0*hoE5W9d1;{ms*7U?r>i?Nu#L20j!(43noxJ;1+7DLjw70)kBPtDS?c z>ilBmW<%%crku`(F|~B^Q+6v51YNacf)up{UR%k~<_%k%nxPjUnNp~Go!u>Eltj=> zdPX7OKA`~>pV5o6MlFA~x&%LAR@%Ywi6hCx$o>>EiFY3R%xK%74-ce9+VNB>xtyL_ zCj25`ap484X~b!4!tiS71E6_#*NImyM4 zuQIeE5Q$coai2AYt+~pb4^L2V4yL>4{=Xx#b^d=-p7`O3@nmX}3KStS&UT%)p3Qq2jQ4If~|iVnOw4N&Wm%Jbt|IEw!&%Dj=Q;<6cQ6@V70K2bI6s0(sM1>>>eh7tVF zg4?3qg=J*tw4s0|IP3;&@li<6{{mi9}HQ^linS4L%)4;2+U7TMg+08pftKmaSuExa_RXuBph zxOs!H(X`=KlewX@&9K{xXX8#egM3CU_H*0Y9Jh@yE^udYU%2FT?8x?zqC8No@#GYp zaO%|Zvg6aTRc}6;=*`7hNB32#pr&c%vP5j74vnSUw96@Z7)x9GH{)SOzoz4}ZRZ!7+Qy<*m71nh`-msPPc2Tl}~cy!hBADS38&Go<%cpA6V=i$z>&KBD4 zPgWa+->lp`XEw>X*3RU1cEWr$F1JqPZpS211E=$?Tn~>DHO{(LewPyx*4*L2D`#}L z6|szxYp=~Qb=-tn>$v_}1wFle0FQ@L@Jhzd-Yv_Z`|*!`oARKCMPh6)n(di}{_hHerg^+d1-}d>lF}FWkEV_$23#NXjQHTpj=?bT zqcT45lF2B>X`bc_3nTMVMTsAth@}wy=)s|Qbg*ZdP9^Q(Ku4fsdeW$tvl@lX@*#9r zo>4txVh$GWlVS>F5q6K#nk|rEmIQ~59hZ^dc$fqeJKA__ee}hF9g>D-29v3o$@t*G zWPE09d}b&W?1Gz$>hwNy>2KkiMf?hmMf{+IPXtO<5CT*4kjcTO_ zaPz!GAcSV%3#XTlpwI#yM6ePLr8O~3#>P`5emF6ivhxGsePsT4PA@ytpuI4E%Mje( zJ>cO7%)IeX4|rbh0R7I!tP*4S1_~( zjR;-go~{m(O_$4B9@GhDM>yM~s#y+F+f6W|7m*8up$3bht}KxgQ0N2{Ist`F zgz0?{X)`z5PXj}u@d`@eyV4hAB`APp$*9Im!X@dlG$Inq)9I7`o`dceEP+^sq zl~$gP#y0-TC=*pxT3JCz=RYuc8uT@4>60wfq|Njb_0)7x^;yQJqJd$NPNu05s+88t zCasOnHb;5D;P?XphR|o_oT{)`KL!v?&uyY2&g3;e+rr-CX*~aL$oB6F^M9x-5{lI9|Aw~o|4n(k=6}%I zmDTPG3vRJDhUwiQ9edzsPo&d*cZk>+X8XciO5g%RI79jr1f5BndX~awu?LF=MrumW z!}wBacA;QWFZD=Hxoz?w^(lO3lW*0)_{L>PHeHIUU26ZF-WP;-7|A}x-j`7nfeo-s zO)0Ao35wFUZD@Qjbz~w=@?}k{pj4Xz`PwILh+C{KR*6clq@@m~_`Xl2H}v&wi=|Sd zsHa!>vH_hWjhwi_m5}YjiNoFWTqin4`99_m{T;H)S0gzE(PLy1e@; zph-;b+&jlriB~SRYbluASMvpVzJg;;H(;J#0+t7kU&PY|>YT1(H`!$l2a1R$LW6=H zrZL01I&g;lT^dA( zDZL^Nei1{_R4p06`KBc03tRcJs>NI)pPdk4c|ZV2Wg}KuO_Yt);;@>*S$Z9V*L!c$ zHGI7T+*xC|$zEcz7H_re+lPksIb(r{)jWGxfIZjx|2)=iX0m0IB*_(pkU1+tG zYVqQ>WkQ51zju%cF8e{E?8D394Ydgpv&u5Zn5ysxGb+zCv!MGJVVn zi9Vtxb~;)26y1i^^m+6VH8qN2fdI{>D7?C!wdFTpJbCIY+34EXU{qNjppDM08T(e- z~;i)WXaW$ESQz@G-%$8(M18q>5F`d z@sL2!S5T2NBTxEJU6&R0sOnJu)u78(B8dZ5aYt@zuuDyFu1PxCC#NlemFhm~Bn8(r zyOAMQ#}U?*>oQBY7bzYdc8-~+SQ7=ICib~J9o1%UFsC(g_jb&1jn_pmeD-;myp+C0 z0uyf0?4ebS?o07s`cQVdt+2wN!t}3IHKai!L{&p_ zRlAsUTw?Jky4WN^N`|RZX>9j|bBx#1*(5QJB9;y^sG4E6`If2iZ&_KDDgw$JGhd5~ zA&&v9oi6>&bN$6y>QLpn9b&ZGM-3nrDXa5EKS^iIfYo}1TCg1=kX=5jQj3Zd2-dQS z&|o|?v@>s^pRU1~y&_71ElblyyOedpT)olkVLmpqalBY?!z$` z1wfyxYG?;Y6LTJKf67$zxa%`oO$P!2cD`jkU6~8a8@V>!PoOZ1YR8VcxbgB`Wieb% zEwi1_CMwKHNpS&Jw~1<#b^+J0A z-17h1jHh1zifs^v)TkN=Ov4|In*rO=6P-a)ZD@Xe}`vEFTiuQH&E2mDKQkIvOrNmAt@eDRdjKrB- zp`b;cO49r_57N{wL$Hp#$-a!Ld^Or|wR-{O^i% zMYiPsW<04m&D2O5w|V9?a;0uoK}+BhKsWB0qZFc>=O^_X3oVQpodNh11!o8ohJ35M zZm{2ktdde#=s=dpm<=R{2J$Oi0W`BU@QT@t^k$R*X=@-51Tl_(sc*WTaV6!PX^=<5 zb4}8_>wC_fp$0-OP|9T(YU(W~PCMD}x!MH1a9mM_jD=#sNP{*=54MrnvN7MIw9Zv3 zrJi7LVPPS_#v-SAz$oYKA$i97f2H-G=(+XaSi%1@)LnD_b9Z-lcx(J`#J3{!{2hX zXcw@5QBWi}>sdvR3;|P#Tgf3NVDJ*%ub0(CNvvlCP=coT+c>gax(oip^T zW>Tw|vvn|ac~-?6RZ=TxbnmIn3gEgj8~Ij(${Mg%n8?%vT3#<&)9H3HksO~Ou|mOE zn9$0Dw82AKNyGCHS#+Z45P2rES-d&rr8qWm<5x-^MT_4=x-y69gA)_cYyqY>O*xPn zjn3;i_L7_&jFz+Xr?M?EOo+Op4SLF_3fH0fG*kq#f!Ji695l6=1H*%M&8$>Pof+0} zN8M?T@oJ@1t;`JRWujV;2!zp#`kA zA~Jb`?ph`CMWd|EFadz*Y((z5#)gJiBcPW^uxJ#Fyg`BoQY3gNLV_cQ+4=P$V5`Jf zB&^b(V?*(QgCp$s45SZ@ADZNE2L=Yk&x4c6q0v$HGI}t^PM|}|43GN>UycCy;UN;t z@`^a?FyyR5f>H+l$clAPR;-b1YQ2njxS%7*BMiv7K+N#SL+YkAlu{f9gWXyg+dST` z25kv(<5U7lKZ@Fj z5013a#MtFf9^(|a3$st;ICPIzh=g&ai_=z_|IFuf{tMb-mJFjnU!bRQg*^X~&Yet` zL^g9yD+oA7L9>6Qs}%vhs^?g0E|V1*;AghPUo67XkP0vx&B46WlZfo;<~8S)ri?^O z$k893Ds5r0Aylp+(B(GMBY=ybB(!F(r~dFkxwLX#_n4IB6Ps-&alHWA9$SZ{fGEo3 z_`&30JPLC_q6nf8Cl8;hz${#$nPvv(b7nM~BX-SOU#6p0r4b(DxrFy@G}CxCn%SC-f;k*&Zb4qk zWze^#$J9!dr}`A-*+7q(D#xcPx$S3g;u11{TYPK?W(iweVj>OSnfB9ITWOff5~B?A zNZF{Ch{{4xQ4@t}PdeP2b_SB6+C%jrc8s2tRmH?9m23npAOcXWwp?IZ3eT1GER89YG;Tue z*U~v4#R`O)1A3Ht=YUXi^Syepunw}!t(q*3=FP3Hc}dM|iWBs#(VMN7do%N;UKq8& z4`KLQ>4mY=Th5!kd40C`rKLRl)#yK}3n~8QOwC?|LEy~U|5mjB+IIRi<5*$;r#rmc zwf__D=U4F^7s=dn!?A04* z&JgUvwvsK_#ZR7AV9y4u9^hu1fSa`X)*;xI;nzi>8ryGk%65~+T}ihbO$@ALv8}b% zvPpe$zQ9gJOS&#JqrM8<*buv7rOvL=b3oEENjvW0J5UmZ8}A| z8`-{j7{mt;%tvs4FHB?i(~CnD>AH=r;rNt$oa6sx`o`V*X+Nt!{}t)%+`V=FYcrnO z{?8fN4d#J0oc{}lw$A@;%H!St)s4LVVJ-dN-5J^H|IK*n_CL4rnl#Ms`f#kY|I-z& z@&BjyKX0x7&irFXDaL*#69)%I6N5x;4+alK27|$&)DStmKXqUfmwjZCMsf%S<74zT z1XVh_vJjyMR#M5}A_59wN&d5)1%L?TDmk@Z>BBVq50uk>8t$gAqE`x9KP)w`(n~#{ z-KR00GCKl9_!Sc9NJbO-f-E;HNv~fjYlWz4R+ixFoTgP&GFR4SqiVy0HNfP7tZAw= zFbak?TC4=|J&4y&%xjf2!Q$;0r21r39mEK4#Y#Kgcc`*>Z^a5Ph0WJ9%MfprTT)L^gO`ja;kf4<@k_|F9|G9GG`Ot~;$yORmn8_OPGEzS3VF=H{IM)J2tr8UHG{qdQ_HzT7 zHLfjCSP9~KR)k+Er?bbka&TWB4RSLu#`dWF1Jyi9u@81bR}I?C&O5;lUODLvjuFs) z^WY)*Y67)?l)Xv4z(Ba=iX<*vqJ@ikjDinxB#elP)CoeYj#Mf+dG~>Q31jI}zcN`Z zl?+oO3mTbApJc88vj%SF3aLltbgi5&XXloBph6{D4nt%Y(xz#_2gJcNZE`SUwLFV% z)sP;hDVcBprlByrNAO2P;XFVy0pPNRplP##1hg#SbCAiZg_YS!1Mcl)WWtObETI7y zg|6AJpcK@L3`Y;m*2XTuVR56V z---aoZ_fc#SOdbSLmg2VYQ4g1JR7pAOX0E#b81?VutFFuE!0znnY>Nig`xBqPBR4U zfe#|28G|7OQ)lQY!-+OAmgYC|xM_vu+jgddnP4`^*whLR#q#=;oCo}{j6jSMjv`zK zM>v=X2W@`FKwVJEj-<#70>ZEd#)ynj3`dSJQU_xs=-_`pImJ*i)Dd;r#vKv3BNlFJ ze7hu?kXu}wxxUf`lS|U2Ge(uIK1((7n)*SdVdWrJ`Pn%wdwgHDtVh|bSLUlty0)xU z3KCEqlR;@`Dgj>dfGg80sfU%NU~Gf6yN0*TMAb-0B@244G8a|%>`@6@p;9?XYe>f~ z{HAx$I8;@70Zk{rfF=?QNALog&aR$t$bG3O%mxe$1?wgfBZxNv?KQmk&Q|$-R2%3g zPa!*aUH#u))2$oF3g`bjI(CO^?tkjs(*HN*+0y^F^#4C&{hwEzsr>w9OYi?P()+1H zHwHuQAK<^9+y(;y$+6~9B?E$6bKbHYoORnltJ8L1iw=Ztiw|Ku;NqI;sq%|`P*dXq7sUZ2y5(+wq(HfhO(YOG)N6^D`n+C% z^$`?Dy%U(cm`j&)3ZNs2;JAeZ$^?WJLu$ZmS%X5xY-Ir>jM1wXOpWRBCVKAGA%4Lo zK1rJxdYGV#8Al+~QixN`DnzQF<6sq*`=HnI`x>!6p+Gng36MmEECAdbKbVrErwKAf zWsaljpjB;v)|SYK*p|w!F65`i@MK0tBcc%ED;x8mZ=1@hMkehe+SPapBhQS~r8MLw ziCMB_RB0SHdLG3Ka7HguKi+_hgn}F3Uns%5(7#9cSdy@kMrTT>yGba3C5xWMEaC0s z4V*Qqc(SEp^)Ipsttp|k^dO`)MImZynqp+k6@-Pw%Egu_xr#M$i_=21W33sSOzjK4 zq*@H35_l9wY(*5z^~ZAQQiY9&1*3c%&uBF0cqpJW#2J=whC71?(q%8C2lOH})-0k) zr)Zrh;$iIZWJeRILK3QuJ)(VGo~ZB~FGbe`+zuHotlPCL!tHdytplj3wW#12s zbqIS5#j8!hF3~JE`eD6nR>%asKt=E-s}lTMaC4QlghBY$GR8GHnFKKPd{N8sp5Orv zhtfs8V31T5LmcAGf$4IEo8oH5Rh`ARGd?0#!;AZ^MH8*3SU8D#;z=ud0T;$S$Fp%r zwi0c+BCRO&LdEF8EbU|C?UNI+1MR8(v9Zf1FY~BY)?S=}oCqlVJ~opIjs>ldg>~>Y zOOA_EW$A)RXOHY0p_f#M=#N5vmQ5kr%ceLq<_ZwmP|jf+qtxprctuvp)_s>y?WXU zXTDfvHUeHSm@f$-FfuVpRX>Ty7??$88Ya6YRl|dh(faSH-k9|YTl3vy;wx$bY=|9$!Povy`Bxz zO@LX*k-UBqd6O_Xk9H4skX?8`rAt7uQW+2N+a$pbfTq#w()pE!6lj_7$r%|Ei70N@ zqoc}AE3qKq#^V}GjE=$&OV`?C0?LGKjbUC})KH$&%Fv!1GwMvH><7!4(Kbbdj`Yish(Pq)X zYR>u5#STDcs(6X0Nk=e_6F;^i2&`jjg@OVQbldq&)XvYwxPi0*{G3E4wdBt6{L-U1sr};zQ+OR$GB%bvLdJ(lZ0rcRJTW%pC-K7*$@t_X8BZ#S0~4c(IHV=U21gGL zCB{a`0F=WBTce2si4*`$jT1!3K_%jo2<$*SIk+EQV*`oNMCyoN8BV0e5a#fBlElbF zESX9S9vqD&VF)EB#wX)|eh9#hCB}x6fF*t)K9&j)KnsZ^ekHt-$^Eg>QN*Rh4np;l zSV1y4K5-W5|~Q&!PKiOIO1#FB|gq{wh`{D5CUdP0eD3IxiH z#TgW&HF0zaWWo1?lW_|m8H&e70T%Snn4|x!em(1^%(LmUC!3e3C9}(R+3O;q&YrHl zJssgKm%TIn)VKdROa$w~(b)bM?&=PA*4Y1ccW>GMHsiT|Vr=AmB5-+L&kS5oo2KlPy>{@2AX*!D&LjyJTN^QH?f_`FI! z{*2gVmv!&G|3}JCzI4l;f4b|I$bJ9#%LiWm;(xgR5#J48y5$SxesaUpcD>X856@LE zctiUI=UqU0@9F(NA9(!VKlIouQjgw$)1&?!cm2<2ZhrR7Kl_glAFBT1^wh$Kr>--f zwJ-L6&w2QPbAJEI*S+VwZ`|?7^UmqH@D=K1&-}vp(;qnYyX#y2_OJFm=e@6vJ@~*m zw_R}W*Z$_(iIHc2=;BA-6Ki=@@!AW1I!&$`Z#n2-y^?i zZF$#y7rlG&+=1)N^B$Rh;90j_`^lf}&3`F$=QrNca{7x`{a5e%-m?Aa*B(3nRp0wX z%VqoDoBBn|(;gVPclsmx6F>O(QwzH8`{`#s_OUl!@bP1JJna+r+;!m>F8t2jchAnw zzV(e|YRQfB83;9C%0PvCp-f zzwr0(C)fVnt6$x_@bC*?_(K0%uWNbd*G~TU^MCQqug!kq9{*o|HTvkik^I+R_)z=z zZogpQ9Uu7B<>!9$n$XwxzHP_!q5KoS|Mjn@KK1|JwdacIWb)>==eOKAyf+Z2{O*z8 zz3#)ij^2Kj{aNaIS<_Z`tg_F zdiwO~TW-1Th8rRm{?)@fo`2VeyYBwQZ7=%r&)?oYaL+yW96562rkid$?|uEtkKOf- zuCErld#|{w7d>qc=Y%e5}y&qZ_;Kc+Z>fdsV3S zn#cZQ^3ji89gV-W^`}>VCpPum&uJGOy7lUZzID^(hY!E~wQqdwYhQct!&jzneDj;$ zR4$hveDJ})4qkol>8ahZb07U-XW!pH<3*n&kNSR=-|^YwPrv)I+papjckkXqAD#Zk zz2*o1b?|}2r7t@1$Ipj`$*q(wYcZb3$qgkFCQL$;%|Fj zG28vsub=bjmyXO2x19g@J8n7p*_SV6GC%pkv-kNwaK~qtAHV3LivaJtU;eAaFTeHr z{>N^)?Y7_C^tP+N_3J&IKWLwR`oar-^}5I3ar?=KE^67aW5?XBckjP?=GGfu@aT`f z`A>%~_6;38_^O`!jB_vh_~`R*I{EOu+upPM+m7t?Wb(fs`rhZBd-n~0apMUf-O|$D zmf!z8zwh=(e|Rc>?wh}yy7J1CzkB4zcf9(U=U(%n51seE*S+`^pMKx_e*C33ZvRo@ z){*mCKWbe1hoi?PrxKa;iJdK<``Nc|KJ<~pA3JgXonQINOAcJn`pqZ4f8WE=m;L7B z{=fYB_E&y);SD2Kq!P*xKC}1nA1r*LV|ZY&`l`F1d)dwJy5hzYvDp7-?>*qDe%r_K zV%Q)5-s8G!3T!Tv6T6n8US17KN=$rSMzGS+S%5Om zR@t78PpV}^@!$*z`uh5Ib}x>}dYrs5xa|gEBZfiAXsBi(pF@e8L0H(t$h-QG!RP!5 z%lHANX5V_LK@+ph!V`6l$aq)=^>pAeA4dG*5uuCQeSNi1H{KbrK6vmTZ2HHyB`jJ& zL057yD0KbE74J5HJZz|dfPnt~e!Uc4PG*kWlce6ptrxDmWPNSAjC;+O53K{cxSft} zB4%6hFruzc4KHsT;=#qd-{*Z-QCPd++&QO;;mxSTu@(j9W+N|6{jFP{y}06i)+96i z&>;(3Tj5V)^&_|x)%46vvA4#$x^<5-H!WMYIfg?Z0ky@?&(GR=70T1jWKYa1xi?wM zR?E1(C?g~X7~I~lA^q~Lo6I{-AC}Mfv0w>L4{9V`q8EcteY@{d`dZiHma*7Z0Qvx@ zaEWh|cDsMD=U&Q%0^sx5^Ymd|Jw3A%Nxvx2OgVFBAs~J)5rN=D2O55cG_VcPL@$C>m~?rt&LOWJyRQjS;UHg43F-5ZtnyowZPc&tE1=TvuIfwj%~;aka1?58e#4UKVY zw&z6of3Rjl-Kn%$k;=imLp|hDLzJ}d$py7{?|$#*zSY-yA)~n|A&gMbG3NXJQ6`|H zLSI+M78Mn}xwEIkr+i|xx9PaNn2L(SO8oFrHvbR&hXFXrY^@y9b*TyXW1-*mSJd$c zzWrn<%HGG z*{-d9_u}@_a-a6p>})lc+X)Q~4L_#7nE@O-_-a_R>b0XyK98VgQQh(V`@J+Yd|h0I z#s=g!5ue#wx3sm11uHK=#m63f6zFz(;?lLaYe566xVhKx@c~+ZRZ->qVVOD}ex7RC z2dbL5yccU)25Q{%hSke~fnk<=svC(tW{hfn{v7jD$iNbhfA_4={;ct_k$UH!G8jxE zhfLVW+d}(_rE3+$1q5!__ANx&;BP-o;?QM%d7bd+q3Gtw@w#H%t_(?=Rh-)~SD4Pd z3R=O8UhbN>f635GW!Jvu%0q(JmhkcNtzREkeCKj?l@`a;1}*=h&aKR>>?6%K-nKD2 zzjR*{uTS96KpCX&OG;|H)H~i>M zTBQEnd`Iy%6b7}NFTpK&$t#Yt28D5P598u87cP5`I(YD4v&)@s_XhoJY#vclvvQlu zVHu*^7S@196dH?lxOnvaz{!dj?9!N(EAP~pw0Saxlo_S4#K&@2Iy)~zRaI5-MSZad z51+gqHj3IpvgX-emz=!##x3KMPN_w?%`dNwJ}Xo%COSLeaO+Vl2eArl9_ju&1C|~R zjONi`1r!30U|p!AV^1s-_tJIux0j2D-cE2z;#!g|lV4G@h55WnszxNAN~Ks#i!0}S z1Jp)?Gi7BMlz%|@l_-@h>3D-wOg^Ca`655n92T(}zBRowHvC3Go`?mYehvzCHlOr) z?*HL(^rNf(rvQ&CIf0qU->@o?C>J7hdyuS_$cAM=XYSwmW9-=FTWU|Qg>*j2zrzn`Jy9BoNw7AaYqNg(ZtrdYc`+~Ek8Vtej;=7 zu$3VL2fusrqYTL-;@e9U<%3$U2DN7~@o%#^W?q)nz)8> zPfu*YvSg@N6f3VmacB-aE3B`tj~IC%JoR-*EK+;8F}!9x;q{$8mv4Q#Jv=yA&uYN4 zHb^DHzUIvlTtj2kkKt<(KR-^J^2%g@DO&Rfg)Sok{!l4F*TJy5=f>y;4-bI{4#jMb|~UAfA}zuEEDo4)w3< z<`GPg&fkyf>p!daeWGc#i_1nEyxnHo#bbpPH>V#F%j*L@N#6t3p_a#Ce4k&Rc&tdW z6v5xVae>$p$QWwO`B?8{nGXy1;04h%{K%bU3sTgs4t3WuYQ}BW8#)lqEwdvb#?ref z+p+C(j=Yz3$f;F{C!8g6)~3N>%x z*x0m0-d(pyH>uB1|J0pyNB+T6cdW~spvuUJKvUDk_+@IWYC{H5<{e%(?;Bs1dAEre zu-mi-yGQQPX4xZpJ4m*4;N zOw`DaZ`>P1PDd4g+@gw0Capy+lxAL-86PKPSXJw4byye0xuxzoYH8EHlNv9JTyEU_ zIr&)9vB8x+u4{p^hX;4m&xu_P4QnSRZ0uaOUUpiJs}pKGe&oqnGj54p^%Y&`+nG6T z|7bp?74dD@vE1j_`^GQ3qp+??wQ6A_lMM|j2JBl~-4}kfi;pTc!futSKl8aKqABZ` z3fZ%*va;wT`k3Wb$Csh~mhWofZ7X~pJg67b)YrUU&9eYyAW-17Ua9Qfs~ahM_GI4G zu3nBOpDSSH*EzLhiKr&WDk0@)W}W3~oP)O7n^I7ke)4@ve6?Yuhn-TQJB>75~#U&A$p zQ;tXVYE!mq%If_GzVP~A&15!^GxStn5r<`IWO`WTy>~-rbF(yHrz3`|7Dm1w+snY8 zz$N)TSF0!m`@Zwl`LxfYO?(|?1k)TfM{Oa!lLk}f4>@$ zFEKF@2xa3a`a(+{q*OQ=r4oqvNAH3 zPh0GDP~5d$c?(`Y0hE@|o69$^R(d{GNH#I$)1Ml;iV_#nepTALHIRMV_hnDkzOEG04 z?w!s0MCpkzxpLFW4|V|oFS~1~8Pc;EcQBO*n{BG^Mp_^K?jCdrp_U_)5MuvtZrKL6JtI7Zqe`jBA zXJvp^r9#vuu4%RD?-{#xaVGF=CYpI0jo(^xFXiJ@i&eY`z9jj_aDt>9N9K?{(Iilp zk)t=6qpGazLsjoh^070@(sjdE2QC5Ld+)n<6H$aMVq31CFDmkXbX;EG(W9PgwKt_s zzdf6i-CpuePctrIVdV`VRMS7Fc9tl%=B_)&{P8H%Szw$aUq)XM(3dgVQWwJ&iDVBsnzq}Umq$d}TKC_aKkEQy{ zViVS4yTa%n-Wx*=%Ue|&IW#9GCNdR#a}S4mzu$v8UXlZNKF5!L(3;>Jbl$dY>f5ax zX6fL=Imbv#V~jVl*=0zuo1XGgs5enG5NGTW&dGY%bouMifJ+MvQV;N{JDHoKoW58% zGdB~_0u@brdNe-Wo*WYfe1En>FBG1v-kiwHd(E*``njQ}kM+yVdshl<7r(+6owei@ zcWkvyB>4H>Ug~jUjPD$m(DnDP2^L9VhAYZD`T;^_wJ4yce>aPcTULaH@n+PQ{-?d)Cq`eddVh)dS$XNTmwv_DA`7ez zoNJC{vTe+f(zxGjF(_5Ugc3GgRdHsK#8L+fi<}Hwwk;0scNKStJKuCD42 z^71Ok#k97z@=kv^f;wKU6!CTNL+gboAHmlS%$b{V7Mv7V8m(+GxG)6ue^FR4q7;1iGt9(_-G72fDcPK%+{)z#(Xte-}!#0j}1 z)s}~Re0Si8I;xsSPhX96rmur|Io3>~cJ1a0B~;A*wPwmT=;5CNs5_gw9L^VbeL9oE zj!roG$eq}6R*Et4*{)r?_U_&L`rWESTu0P`FBY9Vxq`ncFDW|F!1B~aFJWcIsOPJ- zjtE75uzmmpYpCSI;X6bc8F1&z%9O+|pipI_3tv^+hgL6R5a%)i!ZJ-w#?ZF&I(w$R zIWw5shozpDKw;~a%Y5t%`&!!6Xt-jl&HLf9&oYPX^;V)@AF=%^YM7UjtgX@iV@hgj z3%bvhg|}mTxyHWS)A{+e_wL1qiK!sjB+w(pVCQlwtvvS(%082o$zs_mu!*{Nmm)h+S|dL=-aou zQO9>A**Zn0Z;J$jH+Y@-Om#i&O@EO-gj~~7&_S`3(r>C{Gyr4kokXvFg8!C(cdQ6Mro2mMy%Pdl> zmDVggd*;mUJ$tlb1oTn)Uowd|+1T0lrKEh@?eO_(YU)+g#4ZkTgLUgXGCCF>Tv>SZ zAUYth^4z(H4|-T*^eq!dS6Po<)IYSu+R}32t6d5D4o3R=9PbYs8L2Z%A2Y70sZk5( zzGZ78e>Lpluv~Kq`=QOZ&g$iwE-pX4M%%_lu=2#sr(@9Fqo(A-cYpC!IV zZ|$k+XRYnZN;T@{Zi9p{*BelphT& z;py4;Wa;A&Ng5(gp4eq0H3l_P$x}qX$zsiL)56Q*r1TN)NV9pIm&D>_Yjm;f^CxSv&pc6LRvMf%F9)BZegV)iy;@!sE zcI6F<6?b=Al#kEbrf9WKu?thfzYRY*pJvgrvUHnISlE$>uMR)Qdj?Ze4U-?mF4$U? z{;h96ik1IDYxv092YXivYd%%2PT_y=bg3C<6d&99j0XiU@s*H|iEU16m!KvlS})l0 zkwO~xxihh7-HHXk9H}xojb?!jW}y-xrz_H7?Klj7;pDj))nF` zRmZ59^XSg)B+W~+<KR)nq?tu3ZC|&3 z{m@U_%fT^ylA@x9o~Ab?-n@M)i8}4*rBcShLt-8%+^URqgBiF=FJ;{v$faqm>9Nn-8|GN`!S?X^mP`~eZVGn zUZ2>ELJO^QWq!@N{LO;ytbj|5EgLp|4NAQ`?ZAUW=?XJMUTL{L$#If@Mg=V9k~?>BC*G656r; zJCZRIZx5kz!6{Um3tJ`Z%I^PQXIAGdW#zxk{q`v*14=sBr~6rQb~GI2Wes|J45fZfQ$Ne@<&CM&KY!#Ud}HBnX+F7%%Z{Dh3orp!LyNncPemHG zFH;wfLpj(VmO;9yP;-|E%pTg4YAqINdfDrG7T@9yhTS5j5os653| zS9ic>Pv?Mae7x4g9zL~}ThZ3IJTDo8JKj$FzN`50S)sk5A$zE6Urb4!`j0PG%gw*0=L=jtAunc=>eo}OpV490 zIlZ)+p=gHzw>YZ#&7B^G>K$kuopkk|0a7tS1~se(-8{Vc4mKhv?iH6>zn)9E;~CpW#?kluD{Y8mU7svy*B2f znxZZ0gLP{`zE{|k|L|r(;jEJd4|DUho;<~&)+}KW5WQxwf}fdbn{#;o&HMM!7A7wi zh;!+wem;8CJf4BnxWOP|oxzIYj)B~~YuA5HY70jvqPc@t7IZ5+SNcnb8dN{yPGXSK zlVu)%99MRD-%v+|^YzeT=UY2pk=@>KcI@{jQSx#pk8r@uG7O-^=A%GW&|9AK)rXM@qk>)%H(g+(d6 z>rvxh`d6TeItWeK%agd4IA8Hn$FbBMOzaO>dS~|r-{+qWVhS`_H!|ZcGCtqDNm0;S z6I+wqKJ|6~3Ds+S%m-hcYU5=J(&@`#jxjxzw|ht`S5dJ9dDw=6;__^F&Y^jKCw!Fti!M2DY%|J?h|MrcEj#j45S zYs)%GW}O~6C&VNQWqI^3J1v)W7cx8XqQmoWLBSg1jSt*3b@RT|J0Gws7O3~S($*rU z)O#CScetQQU0suzQ`?E>l~*!j;3QCV$%s z{?MTpJ;dt)=uII6^Mh~h@foo!v6HwfUYA&0ciw7hsB?mZ(rdcCQuqLK5_9cJ;eFiV z&##7!UTMoSfX$6*(Ha zke5f^>+mKoapE&;8SK%kN*y^rzr3_34yEkfyE(G*B+27x|I>VviN{}B zZ9Rld?52NCJq4n=!M7@sC1>jE3qRfn`EnxUW~rUG+V@Xyoqx(0i0PskFPW}p%zD~2 zy)&zQ@W_utqiR>I&YC_b5tropoZi`$EPb`B_2elgoQm&@-Is4FofUg_Y6G_HwHh;H z%#{R|I-gXb{j1aDf_*eKH7mu_Mn)#ngp&Yo#+5)&taGnJZCPH*)ZCaPSa@*X1Gk6w z`&7NGzm1PeCzu=Teb@Im_eR8ML4hb%foVtGpsf38lbmcH1*2WN(o@uw0)9raX|B*r zEZ&`*{5EQe_ggSFb2p~$`N+Haw6rw7@IHRxARmT7?sQjW02BXdyl8l2#kTt1rml5L zl)l(Pw#IjT#*LqIbhEAqO3!QEbQ#UzYcCEifri)u{b?y zduxqikXN(~XH`&PGLK-!$HRdEFEpnF4zAu|tHu{1*ZlLLqHw}FuOD~!p1*uu#;#NA z-SV^HJ@t7nJ2V+%NVvTR4)AXFf1RxwQJoPGE4OweewlmlM_vO$QqspRHuM+M2p^x` zTR(>QeRuP|kbf!2bh!Kx=6OO^YqO}Bn9gS=;!gfyai!KP-hI25jJh4$EG0FOk{4So za)-zFxpYOuH`CmLs}*JIV>yy)b5D4G8?g4{W!T)ieEISw)o%_tYEhA2#O(G7=H}@M zM~=VoL1mtk`^=}qq$euaTfR&!)bn;icJ5^EMON9BR<9>`r{UaOiwgD74hY$ZTqR^S z_N9U`o}|>q5b-6OHIH(bw@w14@xxkT@;Cc9r>Urpa$hEv#ekReRB~`+k;HWkEsn?^ zlViGh0YAS_OlCHyE;Y?Ma!_cbW?_4iO6h)*abo8%rv%gSb#)1(U8Jjl@3f547mp=H zHLot1n3w>(!Q5PxvMScVJFo4_u9ln*4H1 z!S}@(lT3DY_AFk;%gE)a2GzVLjtb6`r{IfIQ zOX&5fs1=8IQL{q@9fKAn{T=g*&44jx41h?%avfawLizVSDA%p~lC)$`eL z3Yv-cj;jpChbP2v+&+53a_UL`%90YUvEi3GeJZHeYo}OGy?F7Wq(o-u7K3|Q=WXNq zrJVhG=C-yT6&|?CqOs}l zPe9!{3El0#sZhWpg_2EOo zR{^b+Eqitag^#sjrLIdmXjhgE+=<-Cq~w0X<<4%S49Oeg-AN~uL;TYFfL20J$4+s7 z?DabC;JMAt?%UT6y=RwHy^32Hx{5!ZYYC0hk_eluDx38bk2f%3+E>P%txmHp;i0({N*yW=eAj?EuNQa_uP2n zXcbr%)?b*D?s7|l?PRg8fx&|htru`O9Jly3juk6b+<*4gl;yL&#UXrC_Vt(7MrCA) zt5#VvCE8bOCs;-vCl4l{!1n6#gzvuOct`KRph8&SlhXzUpFbZs-FN2P!mj#Noic}+ z+J|0bqT)oP>sniZ82PfPnOTlXSjj8QGNF~4IQxK#1L=3NGVKqYa3oKX38syY;^JPE z$Xuv(wOyqXBFxKJT_V0KfhRXNuBYdYrRDG%X>|Cf*Ox>@4!M_Jw5?|3-rN|vS}*|! z{kXZfmadl3PATKcySbn3wI-8=+if?Q{zp2Gb}aROVaI#Oi1`rK$?EAgE8K&VZw z-23E=B?x8w}C&rqPggp1_6hqHMn^QYJoB_$;d4Gl@$Qj$*BpKmzbd&nnT z<<)Tmt9Y&HN+$_j*4CC5hpS`}W#wxnB_k8PIU$NSJN#0M;@Mv3hN1wUA%WvjdSg?Q zdO)|fp`l?L!0)$j%YD&EI-OS6(osQFj~w^+^z=;ORb^SSrlo@D9H6L=cKXu6P!YB4 z6H9oS$-$a@wKFgMZiNF8`O~wCy(QvJN3nU)(?5@!dwF_R^VF9NUaBuBu(PqTvA4H( zbaXT~_iu9y*}qQF@(uxj`0>?^h;PFZ+WXbwp0C;77N|l#$@(PTNjv7iy@7!NBSXVW z4ppgHS>lTc8ZqCxqHh%ynd_&VJb6+liEF`v1$*e za`6{%g$I>)p~63L4Yo{&0%i^H-mbm8gkjh8ynm2?jb6vl*O8Ht=H}*;C((tCNzdY6 zH4phSaSR(XZn0Y9+1;^+Y3cFQhuBTMyCXf6)S1c8d0($p+2^j>C$-_pg@Q@Gv52t~ zd!s6Gw$;;oo;F_HX3gQ_>I^*9+`)J1G*Kv&3R!0x83$)lL7@$N!JE)Ms8^i3hJgq4 z(0ZOk5*a=KjmEg)g9$jis=uFapi77d`(zT=D7Y8bK*v=3lID)MzjOcZFZX}boo)S} z!uX5*-&pCn`@f~7|GEF~Z~6R_|KXqf5C7zU_$U9v|6cwFgnK9%AO124??35Z|H&8e ze=7a!tfYT4c@~5)lW+e!X<*sG%m6boQv6{?SOYSgvvp1izi^-sczZXTFoG_jDDncr z13r2U9)1RoHhY4{@WB)Mv|O>2gtPciF!=$56?kZ$F8{1Qk|>jwkCs47NE<{70xv9q z?$ZGZK`8^--Glt#%oku%f?xuY)$v!^8xh(e4zHBFq%^(nD=06i0LZtL+00x52vy0|D>@SbN7(c?5xx z4kd{LI7FV%h4UnYrNG1%U{Nx3aXTe#EW0n@al@zMA)Sc_ub%;vNcw~!C!^^wB)Ypp z*(K2?^eIz;alixggcDPM*;9i8Y55Ms*;T--5NedXs?ZN{_7G13&Xbb*0)P&hG??8; zK?E|K!h&9>17+O7+?#0y6QmHpyb(lyxEdvm30Pf{-OLXU=E5Kbg1G|dnujxe;AdsxrH%=u zw@AJeIEe&3gV9J&nw@N5rlz8|aj>SMw{sMJqD$$4bjXd8E0{)bDER?Ia2K>2ArLSy zfG0x99`a{`iJc*s{%-CP{(uPqGYjKDN(1^IqBta!R91$wk|KB@J^C{jS_)2I1G+Nc z{}S?G3SKZHwGW9%Q(&_*FQaYz2%*p;UzaenAD)tb0(RK`bv25Xmc+_R$|_LL($5PN zNzn|epkL-`MiNqx&`8_t7?`iaf$v!G_IHH2MI_PlumhdP0wP1_wNUak&&|(Fx$Ovz zq25A87cbCf__YT0B1LmU7b?xTIt&zyKs-4p5PIx~523w+6hD{)+YeGuV1J=j@qvL* zG8$?ngwl%Y-)MPa(f4B{Y&KD1&; zwrIfr@k2uwynz7Rf&wWSrojFN`9m%y;+TRSRv?^@ClDAOe=sW#ocM}jL1CvBN|^=c zLI(A#i>nVFY8=WkMr)cL7ZTWGKwJG%_-NPEp)r3ZV^CpeG@y=y#D$$SM5`j=j4=Ff z;Ubxueg)T(BD_GS$#{rqXlOwGJ5%-KDfX*aB_{?VLgcE#6e+we$Ft~=1 z!AN)hb^)UNre*rKf6_KBZiGh<{Pv3x{GV7k2s$*3gxQf8a@!;NPdIFr7*h=h=!hV^ zFn5@!y{Ak}&IS!-!GlGY>b6l;7n~l0G$yAY=7Ixs61_HpO#s{|;CLYchCd!ha1R51xsWLlHXU8S zl>U&g!PUf(;Xv4dCc}spq^dJ;dKnB714&Se;-CTq4Ku+V$ukN1`QRIPoLtB*w7M`# z1ULsJ08|of3uXd@Wt^JRjoJ?a67Pd4_1s;8d?>FdY6hSWVsZe5>_-N#JM{z9ED*5( z!3u_iN75sT%wk5DU>6`52DK6b33Og(X&5$|7=sszQY9Ax3IPo9B>LbH!w0V0kfGFg z@P#8d+}g!nv6QpC20)f|_5DuPZoj20WUH)=a(u%pb(5U_MEx z1|`iP%t#d6!14fgFq~N^&Z`J#3pxG0Kv0fFm_yAJfo98KfW_4zR!C zG_^B>jD5?0#pzriXc(h4Uvp_35~|k2b|I($`Clp)Ykmq z01o;Ca0s8#1e6{Sc%K&JCIEijZxzbF=j6}tfl+-wst@)Xz@Sn14|@5K^`Y`S9DL2| z$1>#E^O{gHOf2@V?)CX673M#m|HNnR{x3iTr2exoz+GOO{ z{|oxe+W#ddBddTy%l~K5nE&(t`2Mf?#~=PGiTlsM`2GGrSy^dduxF0H{3fjIKl}gw zj*pZmJ7sl9;xD$|0bazP-0}$cJ{m!QyBVl7BXK`FnwCKygA<`kpFiuWKz1~oAR1vo z*d9vHwudrGax?9rC;(UxS>QseAU?aN+Kgvz;6fYyGXZcR3|fMd^c0|bi~yhc%q1uk zst-PNNAtt$v4As(F}Bfg-l}71WngCNY-(d7f{u(t&w7SdLCZ^H=~}~4*A$@!0S}7c z4s-x+6K!W;u4`bdqpxAAZL9=2X~_paKMNI!Cw#waGgkCfP(?Z;0$h1!=puw#i6$Z zaoBH!CKAx1)ag!i1mOAsRKXD7uV`@moWZtSi9{c~iysDP0ET`?Epn@z+g(&JE*nwlDZD1)X3h=i-98b+12zO}l z112_I4R^FE8bkXn0#r11hMe6Xa8?k+2d*hTlgA*OAVQ;6Rnew4#>OIOs4lp71L`qd zO#xRIH>z3?fT|*$aaW$NBS1g?jcy>FrvawoC`v<;LUUthDwYB+WHLCbN4aLj1rFhU zfwAaZltHS%#3vwP^vBpERcWIDKlqDbm@CHrwc&v90lM}->Des8{5=B%*eL)!JaZk0 zcOg^E6ta*_5(mPu5SK6#{1yt>cfidG)0YDqL3Z|lK|A%X8yt1jSQ)w~gy2qFr*J|0 z;(ftY52y!F@C-HsFB!oTnc$^M$lQP=Xo=>EG7zuNrS%-X_n$|8oq?+0CKd|gfYTd9 zcUmD>pNK+LL6R$@(Nd!HeWsh*^9iF-1wa!S84o-e-0}`B8iEk!Y6cJu(yUSvGW5gb z|4TUn(El~J&E+uv`Gn_pG=NI|SBUTnx%^{d(3@4z2*68(bGuJ(QGs&QbvsowO>fZ5 z5o|@JMCofm>tRT7qCc5dSOyTcKtP^A?`STkAxw!_T9|r}xpE@}LfB&H&=E&w@*n~C zpCRGDw%zlYQ+V4Uv@;DP2sB7LHjsotBTEA}(@M%vdmS5S?k+i&+C_qVI4sP zC~hZ!ILVoe76n%wRiSEg8vF0*jo*$MI2K^f2_$-Ep@|M45Hy<%Z%m=BO~Wf;i%K(*+0bw4z{ytk}(uE)p2i;es?l0}9IX4BAjF1wCnyh{{(S?MFk$lNbWd2ZzyZ zcM1VL5$bZHIt8*HW#|Cgwbj7%iXf=;4A7C;CZ1w#Rs z1uz5v32C4Y;D5?!0ubo>0so1K&4B_Afd?`Kzz7h;DB~jTA7l3D6&;pWBVT6A4Ohcy|Bn7C5!S8|b#s`w=%slNC zAWS$H@(kKT0VOEbzK-zt0JdUAw`eW+iiuHvMA65eM1T5l8Gc1;QW^n7uP#9)L47Dq>dO-3AFd(~A%53llMsYr`=$G6;-O`5HKoSuUhj9MAi{t)pbo}>0 z>;EnVC_4`SWlDfN;DP(S82oOm`6)aOYEy!T9}!ycB~rISQ?w)1qecV(!AE*Ne84R~ ze-+;9m|Ba1JH{xU@?7r}ehfT^e*J~Z4L%9-hipAG`G7%a4fZmKPLio{AQ;K}fQW`6 z-BqWv;PfVN{?Y=leup~{PU$odG62wMju7;ko|R}+W1rV;naBRj+Q13`o@Z7OJdUpB z=8OYNAO!&bh8B;?{#EOMjdTV=SWlwc?*V|t|0Mu(cHsV|eG=LEU+w_KTF^I3dySwC zo0Iul{cRwHY{dRG8>2<%3#1T+032k9CERBqPp9YSpIU)EBk(=AY+$LQXJBP*x!u52 zTW8yhhHxM&1_eTJ>BWxXb^fYbE+PAVew=0Lc@FC3K!Pf1_DpYw{Ldap06-{pS_libP1AH>+wi0dq#a?1wBi&U0a-?J zAYe+7s1&URs&Tj`7%rhhJn_)+Eok7t^UY*W(D_DMf`d{YpmRto{&ZdPxA&32I)Z8t z6fY5aOaYe(q!NH8;KI=@zs{VGm{AHX0cuwWGdCg>K~h%Hci@RW!v9lJV3m^qlV8 z3fdR6kVwKcE%Lj$|A$2=tEvLE)qujz42Y zicI=JW*M|wzmU#Z4CvtuA8h&^^TCU`fh01rMFaTh=Mv~aLZ+qwwL=DHn?yh%qqup< z7JbT3KZ?CTDnhOUtcm~=2s{gdPTx{>5>g$2KvlWW8ZmVwRAG$75Xpmv02W0wvhxHU z1BxL*)Se&c`hrJI0OdsTcfrAX@4>yra4iybb3MFMN0>BAQL1iWvUaL%7PGp)H{fP zHEerD=%za<_5}30;qQniO|!s$bkm76>@Yr5507G7;UPdP(Wx!y5ls!#CLw1il0pb%K-&N|1nWpo z3p9L!MA%1I37!WAEjisp?jLX-<%76-vs-pST86@qSuM{Y+D;5*M5IMT=qw00)efpt zXKQ+OG9QXqXsr<0wLp11tMnX9k+UaCvyg+NXU+x@dP2kgB|V{|W(;~1B5)vo@*~*H z@cXE9(nw!@iNRnN7!rAg%+8q&hDw9K;q!{f0eh-^Bd7z~8Ihp55!qZFHzUY{l^}@Q ze32_08P7jqHP;seCkK#%phF48XULh2dA7p2g~DGTg--Lb=SKX$*+=lFkw0}!3xGP~ z1>G7kj0c^OkpitNY;GW)1`jBKTXhH|Pdv?O_~pz3*mH5T?0ix3JVb#BFz@UEol^-P zawZEyxf)=`q}!tbp+qG*GFSimrSIPi=6tgoe>pEPXIfE)Hm&$ynpH%cq?sB^WJXLy zX9mG|7=b{wB}6(dn9~7S5fO^HMzYcZHVa;ng{eO?n1JTXU}2Z0YKu8+_$xAjpBb|n zbS@8pJTrKp#kF&NYk&y;7Q@!)yPq)wrj*lor3Lk)f;CIkhq+UoMVCLb+(AOw&i1+4n z7}>n4K_UUs1c`2A31AMOv#tJ=bCFP7LcfC)azg;&a0b)0%+-c$vm6dIWNMtX%*?l2 z8tCa;gEBjR8M?z5TE9MwL9I_&L_t$mQGNkhTgOVv(!ksrP*%SN{`+$#|2j}aJN_D= zF?_-WD=8x>`vo#4fcg6gblFUxw8d#jAi9 z=14PrH2UoV&d!k86`0>i1h=Ws9B&#>YIE>zC`!NK6&Ok>Nu+H+66e-5hBOBtsThRA z#UT{~+p^yfWj+`9x3r;{)cJ`t^X>mBYSG9Aa2v8e3(6Vl2Ps2nBM&GF^KEjV^5d+< zV_H|RG^fD$tlUpqH!*PfaeHU0s0f5 z?tnISM`}BJQqMk8AIv=E2_C+rR-$R+*+(XUM{J-Hg$43yBHp-y?;M2b)$Cekrn&}ts%S|mIPo?+J4MWdFz`DO;E_8%04*RiXO=?%Eg&x~EdVrPVy%3M&i?D3D*c)YICeG|t^|$_GyqI! z%kL_&Bl)lAkb%wD+l>&2mheZzg9E$(YqPWA{O967vw+*oC(39aKeU89T7rb8uVgJr zBC@mNz)4CacD6uYu!xZHFKF|R+xho>=IVb-9Sv<0o&O|^zw-ZNWas36k(K$!|NC1$ zl$#cybI!o`xi^RWE4PKPn}geD@Mtg%s2dSS0yorv_sP*N2m<#={DBwwj|%vkK6B+C zw%`9r7=Pve$;)ngf0g(CIm{5 zfLt~~D*;|gLA_u^gq`LasG_BUNP$v5M4XF{6i^;yIPkii8GwRZ=7Ip#(r??J-8e8( zfq1&+!3L;zUr?Kesv4MT&8UhL11rk|HSLfCg!9z4vjZKyU(^SpI<%P;+6@mxeQtO^ zGCR#FR0Vt^5I;AxAUM%!Oz;Z|Wfz?B-ZcnX4wne>qbv-%h55Po5^&B)UVEsfi3<(@ zv5g(+AmzFb%8p>#X<8B67ZHL1CbHGA1bbvAgO;!bw`xhan;U2W-@%_A9$@%R#!Dbm zjuN&w7ZO>*#fRVl{_rJ`z`IQ(0P8>|g6m}@;GrLMYk>rOnGW~>prsoz1o#3i!AKxS zrP+aT0fGSu1K2qQeu+RosDlRor1O;7VJ{jCJwTj6XB2D$cn%D(2M+2Z6e_{`5ek$P z{xVMb-xlw`{LIz=;D#~Me>4N&zmfk>0gL@7|KH#7`PKL%({I4v|2d4`+kY%}ll1KT ze+mk63jf&uzvE+W#KgP`_@5OelGiTXb0*g;68Mz^{AB_D!m;4`{mM&kOLJ&P7**ZL zsvcHkS|ER-Ce3XFPVd!z)~xI$k5u}HJkI#P9CcJk6v%s6@*>mYwrVI(rXf)+ELlbE z`H={|eP#lwpUshA)A3xZ_~#8kSyF7Hz-I_{fs_(S#& zIi>e%Ty?reR^tpb{8Rw^DwDdLIvG%?*G%9O6pAu!RcL8J%#`NX>2&)0p0w0G(tCA} zmu2Xyn5UZ<%USbVO>M2JGdHW#E#IE@bMhqvp-+h*rNuZn`Yr0)%L%R`)$mg%D1i|lJ=}xQjoQOjwO0AWf4!hncw6y!Oc*BeS2o7*eU8|2@5~XickiSuZzX+uD>2RdX8rp;MORH$Iy^1ERCumf{uJlU(luIH zihME~ykE#YQ9M6Tbfs=>wAZdXC%GDvWLAaV+iHcHvOezNpklw*veEwS7yO0=8%>4X z^WPVUEjad5C1-G)dBbg>bh*EtxC=p}a>UVUZI+;#npvd`K`ql@}CuHWYxOJ((H zoC^M4aW}s+F>QwBap@ub@Iysh0)5?xjn;)(q5~7V;S@}I$Y9CBUTi=kejq6_`AW>dE znY4uQ2Mdh@h{>^7+4~tBzROT3=FKn%AbJYdy7q@vhwfJonY3w_flTIho}yE2eBG%_ zO|sI@YsqXGe({z^@4nbYt#rB6b()xO6UZ$|Ddar}No*0;Uqb0?AKOK%R_W!W{SOBrUqNl)icJ`OSTnjm>$d4~KQ% z^Lo&ur_&#Ay#)1#L_Tdb;H>NHcfpt zU$DC5s(;F}wC-b}mStBpwL%t%x-Le`G(GLi+Z1YSnXMkGAh> z2>2mzQS3mJ!~ta^k&hZ_JsEn!J09SV^P8FMV>n^<)?-72w*h8pg6)k8mv^4)jPd^R zIpg^$)}NnT^4@B^`hml`b%{M8c^3A~uIjhk8VmCa7ex!iD6R-gY7@=AU9%!MCiAk3 z?t_yrZse9(9rBWsUbEKKe&_aw+qW{ZV;AB^bvVxMa?lMudnoWQhqr*GX_?weFW>wX zyp?*wNlxE;KkQCqWSQoOmY?`8d?i2kXV+PoDU9_lmff)4i=kbERaKh@m;jN@ZNN>Kv{W zIMRUxmQj@qgVkNuB^riD(k1bVXYtDI}NcTOy?)_;NW#)^V zOJm8mFDBWb&+}yD3aV#ZT(=@XuX-xm^#jA?B#!?ruf(aoL)Xp~Ex8-K-ak<^#0t&X zW}%q>rNO(|9}sjzha!lz!UW?q3icv#sz?U#MUPIStT ze2`mMzF&voxbWR=3Q^g&3$L?oj6kEm%W@nV=VjiITPX2vwBop2e!o#Z!JJ%%H!XSe z_3BGvrffk?&()*rw)Lnysn~5E@jCulVxZ*xm5pj#%+*Yb8*ax753O#$EVMAqK0-IR zGN^+^LS~E8?ri3X^5DL^1G$XncOE^#q_*c(`?K`0Yo!}9@{e)KG`Q_L<5A{%&m)

    RcN`2aH6L*_J&fb5ixa(4defu)<^q>biA8-5Y2I~f z0zdf5w!hL;sJbA~5iNDT#nK=w?PbKxZFv#R&ZPn79{VR%>lCjG1SdN%I*cG~lf*In{uj@zFuxD`z{PphLBtAz`9Ur2~c4_MvVvr%lx>$O8n zJh{2`%pGhGj|XUQW;Ptsibxc=P>~>xiP?C;NCWK`8p$H>Wci^qL2Gl{kk>koz8~2n zwgU~aqI=Gr>LIiX-XhiaK2luMA%L}v$m5x=kqj72HuXn3qyOO!8U?X@mr9*TPG+3>3PVWrO5&z5N zAd0(CXVogs;-{sGRa^CY_q|6FAV6D@|M&lW9LO&(_nmX@dFQTk?|t_i?V5|+?~9jp z_JzNGx8Lr0VeGjzNyV%^Y5aXwhkRTFyOzR`(p9!I#4GB3SEXZ^BFX!9MM?4Lf*n6* z^$eJQcU{aqyUJ~x>)pm@RMZ4B81a7|ud3+yy@SuMJ(90_yZ)8-;G)+!ON(_O_rL02 zOR(#s{zJFs@WiuHtJDF(Y5sF;x+|5rGnR>Rhm~~d-#;sEWrDZ2S- z)bzVIl`B7UQr-yTYp7H9;I0dkF5N3jc_q3R{~+Pu=N25sA?Wai z;P|2$e~}%mOWr^K;z+*@>jxbfJU-@Ot~Q)IJGC${^l~DbeeyyMiLmMLmQLGcmT=67 znkD&zp$)Rfk2a-8eSTH2;LeuVM0QrME>~XnTj{r?Ecy|&`%U?XlQ-XK7p{J+NuD=0 z{}_MtNcYM)Q&Byk zhqsd8{Fl;|Yjk_pIF_p_-OJVdz1JTetNgO}?O5_zyRZZPz6AA|!F{UwXPoJv9Qvpm z|NPtZBHB^vo)v=bT}Oqy+ecgbWS>JmtL!zy`kPl%7ti7!ayK7I34HM5G&*<34uys8 z#Y zzVyUu!Se-Mcnel{xG`$Y_2K4T{Bx0^0Z#^G7Y}%MMRacMtAbmMjSCmYsTNd`M&BRO zYgJM4vT}!~y6SblzioK^2HrSjZuhUlo}Soy`OnV%@>X{-U*F?ghSWA|ba-i(dG4XB zDBfkOCXXuhoMWCwy=-^D%Ds31W!#u@ch114n*+zuqu!Q?2MqHa?i4$Ewo|61q*A;& z)cV54E4?bOY@r_X-y2uy5U9*NVCE6pw`T90H#N1FYo1)cn=Sr@BG~LY>7?~+&xq-z z-#pVr9i%9&`&Pa3?zgn}meAbT!ob{THnJ0ol5&MJyw*=#zAwJ$K zU)XdhJ7RBs1-aUSQ07*6d1u3+E0t8{N(M>L{yYmbAzZ>sc0}_-Ph{lWuaozloFV9vyaeoM7w8 zUN_eLViU74`gZ zTwI?bdUws~tXT1QSN5Q7v&m7zmTk0oU%NFDnp`Z}t+;V5?1AmIQH4}eZEgkWP^nLr z+kO&baMzw!clW%PzA*0R1${posI@4YWZvO5qj>9bm*j%<8N!W+_tz{u&^P(kx9(*! z$DL2cZtM2ptY2Dot$SeqOFY;4J#2C;_w#2$c}c&o8SHWXFdTt)? z+O?dW&w5ZiMZe!Ht-PpMdhXqnuy5R!=dTVc+7@>snEC3EbULR`F4H%x`=T7%qTZX2 zJG=SRoY=YRdj7#*Po&z_RQ#?ZaklbRvVcdoy}K^o_{-?W_H5;yTjv!J5;6oQ>^&IU2DuUy6@j|;x4(W;%;2brHbrH&c7iz{6I$Zp%oLK&Z!-9V>A7p*WFOb$z&3l zN*u{4A0PDiX76cRA7m?DE_%J~>fe=r!2m-StS_cT`_Q5$X+K>s-piAa)(aS?1ZxquCAO~c(uz{W4G7^^|d{A z;Be#~6|Z`t7k$tvXa6v}8S|d(JVmI@>pyho58p2T(a-VgzFV`MpN!gm_=3Icg|Gi@ z-F4q}t9@eD*<@QRcAca9%JSaiwedIm^9rYaYuRo1v;UF0d6q0WHOh9gHBc+o_WLx=%ZiJM_cxp$`O}ASRY#Jtk9?t?-hW!A`?O_oT_5e-Klv@sZbdJPcZ~U> z7msp>96CB+!w}SCIlmF!r6|ma$qIG8Ib@e+%ZKM*CU6#QwdrOZn>^qL|2&O_=yIm#%LAtlIh-0< zExzTx_^s$ze2*DrpI;lF`qJU8JO&mC&OM$X`g6pV!k5!K7^dW0!Zgb9_2W)YM}C!< z)tizhRXvEhz&#tzi4dGFDEF9u@s|ftoi(%&Un6sqwZq{^E~>0|@K_67)@F$9@0 zPHOs0D)iF5x(jj*K3(-VayltBJyilpA(=G+tNTsoi$Qn%8YZP@<3y(sPNzb&AZ+y88&on5jf zo$iEOgOADf-{!5~lvEf%W-Yh=)D~3uUky#R|5khh;GggRGbr@-{r@(BrpsU2YBk_r zls}C@YcKz{fac0y)=DNoOXEM)yW#miZyL4z{7;*JVd!3n43g{Vlhk1B10OI@%JpM5 zWIUdlLd5{WzvadQsX6ioW|FRL^i1vW_o2!5Pis8`;9vCrR1p8Qz5oC8&`kMDXc{5MLi?vv8}0x2P#Nv*zfHi?bIcgeRsw=?r9po{G7w-A99F}R z^?G`a8`o;tA>1JB5Sl`&P%2U<8?rM#5XT@}J zL^u^zrMVF6QW0*5a6}S00H|mfkzfU@1WC2+{=&meY^|tqO+B@vM2_#v-9OjjIP1+Re3*yuf9p{(iC~ zQ6VE5=}g|R7NPEOozay=GP*!yq&Im(jW?=;#?){FY8ZHCM)c5-iJaC17hv6z_4b4_ z@bQaGb%{pu&>9KU5-+$ZUNEgG@#sykq?3&|q!5-F7*C8hotSAPD7}%OEpdfg<_gmr ziHw)MAX%+O`XjWo?Hkn{eU(8H>Qx_?cCRk~C!w+ZmnQRW)ziQK>ijPi_ukK z;YEcD_{<IfV?B6cv*pETC+3#rV&#U&p%;(3!)u*QG5 z*9e3bOY$Gi7(vL$$RK29W*Q}W86~#5*da=_RHF22Ne23-l;J;J1KZ(038wr1*7X6` z()zCtqmln#^!=aq{{Pd1FbUSes81y@nG-3rI%Ecc4*=c}?wC!Bub&{(Ze(f-5F7gJ z1tWwO>Bp?VIr%@;S5v*`mc_|t>eqT$%5E9gyM3|(4Q^`{>7gcrNo)i+5M)F0bcoGds zI)xTcM`^nJo3;NmvR0{MEwq0xA4;SB9}1=Y{r@%rGPxNGFj3zsH85T;wK9z&C6z=V zlZ_l{*WJauY2$venS6mTn#JLXK^x~qa^u8;xQIX=SAfvAA`sAj$fyHBS`OMr3E8ni zPGk@_n#G1_`X^{0x+EbTxq}Mcx?(w?&fA*NLaVC*;;S{OxK|K6 zz(P&o4&_{!!Lf))0$y}f5L?UwAvg^X_kH^*YWFwhmyfhQ5ia3bk60+$&X63q-@ zL*PQp=S2ylL!#LNwg)7L4s4Jn4vb=s=5RU8NPz%QSBbY&-q^98W7x0T966pQjaUz3x5dH&P6VSN|o&ZrjXdYA#3IXCr@mSG8 z!ba%;8Fe5R!4!l;lyrImSFbo0J1{!L2nD%KqjKwlY1K=naP@(*Kspa3dVxNYizNu- z_-ufO|3p-dryzuZ><~^Q8qF$@%L@vJhyrwL0}Ra^Rf3v`-O?i&A!6OIltMJzsD}nX z#Ny~GP#+~lqM95jNe01@h#WaAQD~dM1;VjltWyDjK=rYDn!(2l z5a42A%0Q67Ch$3UpqM&guz{@!WG)CMppQ}j(CeEyPyz7w$7qgPsFBFwWC=2HZbm^o zguen2Dj47CFbD<=geHji8bun?zXj?PN_jK95mDtjS!&($Hmgh=_n+ufkOIpT5~W@W zL~Kt6i9(`bQPqs>4`T-GNEX5P8?SaEiKe;AiD!wZRHelnOCmWUH60NUDF!`5@Tu!Y zAT-pxJ=%8=>e`>a3+6`%q}@=l|LS9H3_G|GIGx-Fx?h zz@Xx9yufO5J+)bmhQ@>rAaWa0w zp9BfjkQ9|T6`11FspTTNl(Aw+N{;9Zqu@G=SbXmlzAf#C{e z1(6es*Re^66hx9K>^QX!l1WsM7L3XXlOYN2oLHy9{4k>dpOKtYdMORG(#e>)U$>8+ zEI|qlLR5u@q)akM3xa2oKoLQ3x+EFtE&TqG;DDuZrKzueqA6Z{wN|SDar9(KY6UWY zpl|fle=>>2v>2u`ih|Lg1VqS1DgmJk5b~BQk8AThG2#C$M^KRi!J9Gq1vCdRvEV~Y zrBXeK4{L(Zhh^d3!)3tjIi(IqAd`s!8EB2j@Nb;V1^fSe@VXF^9>nMS%akNI9VSEw zx&FxtIrbw;5ah3sp_c@EPA~)l@*rj8N(4Lp&FPO&msKEBz=oo=us9+($RL+K71fQH zt9RI5AA_e$P0^)_Sqcq^1B!DtMnFyWWLU01x`}4cgs2a53_*XVkxUxNmQvduo!FdATvWY4JBo=SlA;VB?OUGYNa|+4Ur>+(Eqacq|J@nN`AI} z1;V6KlX{k@%g2mlXJtvYwb9{{?vw(PMTvSutE zK%>!UbOViUK>Si7;@MXs_KHMo088PFSfICEI)`NUI8$!)z6|(N=cMl5UJm*&m1ht9 z1hVE=oQ`9H-vRJxgNQOmAzXSRTzZRA1pcv&)+Ig5&sEyXyIb4~i&FiGgj|^@JX;8+ z^Y@jH*F8XzN0OltIMeOu>Pk^%9mVGdXjFFO(=R}#ewT9}KE*r` z@eaEU&$f9ES`c(nBI-E#FYFUh@$&IB3qPL>>ZRh*$d*xa(LNpkNuIf|8K9UvUW4gmuTil};vv^KiAxk+O-AIYMNb)0T!YCu5$jlGT_Mo|rhT=ns zN9w1-LjA*I8Go&Jq>us!@?|DkD7Z=98_O&RbSwiIq#xX9`zn z!FoT3dIN>hZGb-Ur(a9};xn5~Et~x;N#hAz2KCG`<|YvaY{itiM)=C9p{Jhv*Nsab(u3LH^{|4s$^O2r!6m9chR`L{WS|0?|>EGv|2 ztW{;MMZ{o-`W9X2!RK#^W^K-GYeQG9=Y&oze9s47n_U~v2;S7^0OJ`8K;Nxr1W!Yj zo)JD3WXaHjeFyKkI$#g3Y3_Sl=%4pmy8h#P?LDcC75-lb`=xSp{b#S7p8xwI*Q3{e z7;n6uC7=PtC$jic4lVvLl;76+5AT9+atSDaduSCXsU4ncAt+MTsNu+u-5H2{x@nTh~h4R?L>Q8OGmt zMdKu393okC;15}dPGSH;?|g$rJmx@HVWLi!bE%cu>qudwHt0s{8=@C7=M!wq&)c^) zNB{d;U!SLcDY?x|c8gTk@?@{aaQ8%`-BN?ycQm^_(d70xbKBM|U)!~GZP&83WlPqU zEmvE&RBhQZwQWn(o3%V8+kbq&^lg-}D*ksrVgEG56m7Fx zZ#4&h|BY_%YlQ{6Q3zD-V6ID>#R&WBKAG+$jgVqL=z-U~V^V$4Ny(7km1{q_r zg)tj3m;YEiof~&}1xc>D&96g0zKuna@T-t7B&4nPI-Od#5l%`l^eQ=Zci8W>BdH5{ zG+MNJXaRZ0JZDC)O+ zC6E7Kc>lLp{CB$l+e=-`_J2Eg+Wv31GG>o%0T+Iov-R2XUEpY|7`TEBKd@UFM7Jeb2=skaU9gr6I@~_i_Qn6Gx%x6!_&BJW@mg;`X z?Cj7La(K&}C3klC!aBU+ceL;j=x9kCk9a{)gFs2^HG7UClB)seTeW`eq4s}tL4Q*) zbas`?KNbilK?ocE?y;bJjN*XS;h#0=vjLdJ^jQnYdi2={)I$2K;=<;=qt0x8P!RiM z$GLDLC^bcC&DH_py?A}IjAi;iAeWz1#&Z2%Jix`CnE!t{)&DPXRe!yo>h4ilM?xW& z7YHaB1J5BkLSJSWM%r04*b2WMXR2(Fz{Uuk_Te|f2U9%~{51qnWuINR2f0EXo?|;m zd6~~HTa6>(uj0o>xpq)K&7PEtdms!N4`fbW@4WJ9w6Im3E5 z63`#YojA}GLAS_Ix}^POAbqH4MrBsirLFd^JE!#{Ay1!c!*)lTX;bY_)vovFv!OOs zx$pU-bNcRi~%kDM04)+Ob5%L z=(wmrr7%k1l%E~dyf>v8XDRj_gr$aGB)!E9ZEnqBJaZIxtlW+JRPM&zDR)Djl(d`+ zO9g=?tF~=e4I14*+wh1x6j$h4L&XioukhgeN;vMmvMT1DmBmc%7eE-=TZa8hM%x{r zz2no~qfv7vjdYJjZSN}R596Gox7 zJpj?{%*_*NhLJ@95^8<2#6L!BQ0i75M2SxGjA zT61=*S;h=$?ok{CEU%l(y+IR`-=`d%SJUr^Tp2B@rng;A^A<{6%9KEZ^;07AtWM}g zp~nUKS_H4pb!Tp2Gv>?t3k&(8js~iAtH~h4jQa;}(KD>2n0@WEk@wb13?)Fn)QyMf zstR|c87MvFizS(+YOM#oHou3lJ+%GG%vCX@mzNC^0+XjL4iUKX`l}xx=zwq+WxiJumraC!lxG z?-KiHIOsCaM`Ll8kLr<=NA$=I@_Y+8d~Z_gNK9s++AFKMBnmSXB&i^I2ZCgIaB#}x zDU-irCg(BhDVL{Q{*JkvZ>5lOdCKMQn9IE#K2knU`TQO8Ip26D&~sQQ|<8b@+L{b#< zd!e+A<|(Gf!@pu_OOd)^+D`53p!G*m+F~s2;Jn}J{xO@{m$4}uNI|EaRK<%3`OwfXt4 z#r;w~J^%G3u1NbUhP-_q*u4EqrGve+{a@lrX#ctW{m*~S!;mm-{};HD+g}3>d!L&) zQ+*p{EFb?D@}<4#`EUFAVlf^6zrY~^fHptiW zVW&+BxjaGNYS|IRW|tmwDezOu?(Xh#ccq+Rjm2SKyhlI<%*k)FHqDk(97TXhIKIOl zRZ@=WVVPA&b6_stY3zL>b?d=&(EH7tXfok`eRO!(o=a7crDVBuZFYmlogN9c^8nNS ziK;pRnON%eQ4lf4;QSyviX-rNPPT1{<0cbM5v>s2ej! zojF-N`=T1$+A`F=yG_PJwzx~kyWlbGL(noOs1-6w?tEp1k5eLn9xES zjQ`qXXT#Dchse7t-549fv3DwKRa&El!f{obj)|lLo6-&aNYWl?S=a2W9Mie{xC*bk}xkj;juLbBN) z4W~fBF!^TEtu~feL6C4#U}(ZGpf%U2kx19PI-DC*)vE-xC9yO-l}lh>1pa8;q7R*V zCmi?q9TKl9Lh_~ga2;Z93&#WcyIvmm)IQ zO*n>51=Hh}kJ-kcWCp0d8Vqaf_}fHYNGz9&GQi$H+|oUGlnzRSV{WUB(JPToD}g(f zB;Tl(`0Lm*=H?a1kiy;`a>SSn*{8)-UJ2Zmr%}N5&x2%uVcI2j7hRLpnXU5v(q>Nq zmSZ5IvNIqOBjS@QFeWLBSk8>v{(TvTzWResW9-uG1S}X7HC|k@pw*eJAs@8`3kp=YBeR^gj8vHG#t0kv5ZX zl}My;PxzC|61jV5dcs3bGo~M|;nCT+CT?{l-8Qh!*Tx*V#qpcm#h5T`F#|AKW~8b! z;sB=sygSXA&=QM@&F<+`#LUyHjN*z;WL>iDKq@wxQXFrj@j1vA-jIX*PySHsNDpEW zX2t&tJ=bw_^6_v@!IlFgrqYe-)j7ab)saO+mX=eAxD*X0%N5=69ROa6Tp@s5u^`sw zV?=I089B*B(m4jXGprj%!jS=gSgCp1`8Gl{pDV44Xg)Cd45D_bS++yW`3O3+OR*e- z2Y>Zw!+OIWY*=sT6YSAl)cr65upP;k0q_hNn*y*L>>St!)|@GX5At3leY_DLC0Jn8 z=h6&%8krg(2{b>Jh?wkv*uVfo(;edzCdqbt*}+AvlO3Mdy1xznD*-b(G`P%V>c$l5 zZ&QJDr|KXT)E_)W@HpP{Ft;!$kGPwFBG%jtPgEFBM~0hoFAX zmxW_|2l9{T(4avIMwGIvdbvi9e5Lc6h_aSO#+*$H&Dfyh7PwBqXc>3vE#unxuX9T~ zVna>Kl}I=jq?5n+biD;Q*$h;cP1f@Qn>T*OcmCA>2bfu_+IRwAN(BLWy@I|Lhlc`T zGf7%wil#kZ1!EHv-D%~&tB$VcqQBaf}^CTm$AzJS3Zc@|4QY2YX5tQ z>s8tRh&R7^TZTT@(wAuHOYMA5vGZ+i=8GGw1a9+NW@SpveecoSms;&otKC|_w`8^B zBGXf2o(SEBtd6884eoKaH_~n42ps3i4yYSvYzd0 zM&?FUO&e`%1ZiR6T#1s7=yYEGl0;HzO(_Lu8^^Ii@ZgcIzf8{^9H5G0Bp$wL10?AJC08bq#{%b+HI=dQI66m zP>b*Z05TMk51M~Y&%C6KA2Ic=u*;CA*kwFW%zD8aUQsQmuEI>Gyjc{lxA}HMOJr!) zy$b(~b+6!@x0J<+ugfYqLTb8BXd)Zhz=lDFs^q+iUZ~bovu%z8k_svYV=AoUF5>{; z5*&<<)m_@I$N;Kkqh)l2<4$Y{iIP4;`3b;;Y~zw`8?r|Ictg~t-n=&XfQ={&cn;wg zT8N^8sNlW8{p9gjpwsULn8E!F?V#}zFgvSxhOzN3#dDWT4Mn@gUzJvib~Jmk>s!g- zrA>Puwg6om5P@TCRo62Bfl8$75O!<<0ZK8EpbjUIO-+{*Xv|PeG&^%Ww`NczGj0O^ z+XgKWRT#d(P& zpTSpdtt`X>MlLf4q&30qX0h04ZF2!}a^56^-s$j5t=}ZA0lDb+KDQdp1`%olcoufa zm)7tcJ#-;Ozt$c8PI{-L*8QFQ*6KEPN%QMPzd0C?UO&_7T(nzFc-QLI+n0@2_l%rC zzHVyrMb(;P9IXu=*TJ6^G_ub5CYuH7Yr@cO@k&9Y?*s5Q) zYklYx{fpk93B@-6Y`4`t?L#TePP03Nj?(JFOVa!dPh@ajYqzniOzjfT?<0bw-n;m{ z-#R-VlJj1>(S(;LO+XEOm04L(t9rZE>g|V<~rCPB+&>|TtQqs4ZZdUeisKG*kN?M zi48RK&;!DPsVrQg#PvQ0z&;$9$^HBTepzQ93))C*wLh(l7H44r{sMb`WCiXOXx# zhNX`oEtvGFFpc{>Z}c(}+XW#}nh_yTQ7&%zM?J2@6_kz|Q8 zRO)vcoW9rmNgfSbW0K^F2(VA=@w?(B#Q5Jz5f>s*Fs>NCsxBiUFc>o;3ge0rWH3CI z7fQiMUN}WZU~B{I7K7diCx&DCEMys)a-lQOWFA+`}VwM+^Ra$0!gX zJ1hj&2tnB3aqpVn=ywE9X$j*H-Vbbs7_W_cSgx;NW1oe=-2py?=N7n;#|^-eTxQTc zufPg5C>Q7oC=Js1gH1}aKeAqk5qJaXVQ7QzW*g<@nF*b}}{I(qsh z+URsx1@#Tf!1W3pz*ib*m{8#^fp1<#lShkS1KSFDL^CPAZG=mlj)j{L49}(l_e|IT z!9HeHddApw8uq+=_Av7lY&OaR(D^WMdUz3pco|5Uia+Bf7-(!Df<`@Xr~p;Q0wlsC z#fe~Wg~jF-UAVz%G>aqv>JF0t06vclcO*f9id9=e(V>Vo_{=d-NTYFsz-X$&Txqb8 z5%Dk(Gb{8bna-w@5n7lIJyaX@y$D-}6&Rprpsz>ftVELn7h7u>`~|dL^N%`m2`vpm zR#LyKsjl=8)bU{44toi7GB*;!{#f|{*B4O!!JY_#9V3q&;v7+JFwlp=s%Vlx4*^9r z`Z9D1`FnfCG78>KN$?6J5?)L~WkmD&*0yazu}MIg@YP9pk2_{;sOPe_wSqOQ>C7O6 zr5%V8@<+W9C}AL)!>8~yvjb`cx>R|VG+I?TST8$*FOJZ@q=jz$-=Tw*e=&nVCw@r_ zu>YSC12bpxsJRel2UI;E5(or9Be2Hr4N>z;6CSq0Kv1;=bir0os|ZIOD2;@dT)3Wz zm+i3-Hh6RhBk&837;G|lhLnaTmo46I$%LI_w-SUPp){_YgQ6x%mq&<355(dE2b+dx zu~;uLaf&lx+@!Ica@a_4AUBUe{aHBbfJmeKAQ1uy*az@P41;M@4i(jXB!CLyHtKGc zF;MQ%qz)a17uk4({L#pQ=XQiUi9<__n z!!QA0V;G^xckPeJ=|@}Ow=8ci@`dH$RdhTYebuBw!qAB4k9v#LOQVmdpK49mI>k)FTXP;5*&d!Zv-#g^Jb&F7%2=5o@3HL7sDh%!o;eH zO9!4c3&wT<=6z4V$Vzng8f-n3g8nz<3KR@jBuATy1!81n0D6F+l#fnE&lQ(8o6C_N z&x(e*)c;-bUiV!|qJzO*DIAax`bPrBG|;P)PM0h(OA(N{#6^A@ooh;IS-=Bt{s+YNnDkz?b<;kF|| zHm=UFT@ZuK!RvtV46^Qw!gJY05HxlpWv->$%H174)3-FwlRbZD(a|_jhumE^Ep~?F z3JQeCX;dZ{AJh!Ilprf!`ou!a$xAHIOH4gj&|uz)+@)vgLt~2Vl^n|6n$G^@we3x@ z=UaBmK~Ki|eHDtQ#MdKF*7)>^xy7+Np+<-) z7w{SCZMowc0!c!<=OnR11&&S%Sk!XsEq~3kDY54?yqc;9)u%#+FXdMukX2>>N~m=@ zE$x?O+pqT5Tr1f{8(R^_PQQCnB;dx&nL8_vpO)~Wv>=f^Q=nGJAEGQg*SEobM;gSe z-46A~tUYx)abe@)InaAMmEX{&-rfmzPGEWuMlj@fW`PIlpo#Zcq^nDzXWyG#DuDcdP zN}VZ{`Ia+auL)h$XsT{k;kPhu;@h~*Q>!gn;MgwzKG$7wkd^Sj0ns?Ywuh!Oe%j40 z?}&=<`V^L&y0)Z=JlP$x55ExHAT6Agv#EDTaIc3_YwpjrKFOC-Y5j}eCT|#%d%GPvR@|~lwQTLik9M_Z9Hvi8*zxinylGo<*PD$u zB^C=yl#S`CGHu!3l7IW~+iPRu*^RApCEp5ejxo1zd|&(q*1O`*+C7EujcMELfZ#jK z@+(RP?zb7~l**r0hCEN&5p9vyAY=ti*Gm*?v^exIY-@z$bf4vGHw>(i-mSl+G^#aI zD1a1@7BVTS>}G-28V$q8QQ~~U%5{B*{ayIZIseATWC`V%w9Tyjl*s-ptPGtvF(fL- z>gKCBMq1kL)kB8bGM9Kiy*r^!S;&uFJIlX0|E90ip@F0Wc2MHW$=zYAu1L*B^&{JQ z|A2y2aR&QBVQ;ur_JG3q80)mB4X35V-pH(yfkYefi#nOLp8D$QNjmX#4N>$D8DnX)b>_6n;T8?F~! z>*+Fo>SKLXP)$ne+V-XK{<$BA6i!B0NU8gYjk`~g|9sU{XIg}Z6zvwO{LfAM8zQ?? z?0xPY)Ulm!6*%$N6E4ChCr`8~QoAj;dVa`zL*emW`#2N#@9@)?$yn(GxhEzUA0Pkx)VHM6 zp`Vo9Tz5uWL~oxJJFUjdUGad$Vs=pOCUb-PP}MSrHXCVE9cjg?p{UJ|r)qJ=ZfdIU z=}9rjY096WEO3-8df!B(wcOmu=ibv#sp=thHjue_^I>7DJu~0;#$TQ--zpWZS)h`! zI_c^8U-wE`y0zCi3DVQ%Kk85PI_WMP*3CC>utw&UwF&30*!B<0O{>Nl_;&}@E9u^w z>nvhg6<@bppyrv~`|ZEE6^p-a71%hrSJ|;*+`jb@5>NOpPwIv}4j=Nl$6vBu^~Ib| zu^%O>Wn26bRwwKJdi?0)eX*Mtbg5)dE5BH$$LE>b-R!(Vdez5{5*rwKKUv5lA?j?e zT(05r;-Ev#s`pN<>oZZ4vMMOBOw3(daI-dd(({(vtq!HK3>Pg={VZh2;)Ry9u=Mq- z9PwWS?c10&UTk4Cz3OYeResFCFRQ@ z)hoqr6?&0|``evRmghU|wF}4>f3{fmEM-OjpGHVm-F0O9{@QDmKfkf`xESAN6sq$0 zWJtSN(!%vVy#iAOA^mkOhsz4bWL{!@YOm-WDtHxgreuY)oJg!=S8n0`b3N4i2YPRj zo}5(@T4S4<_(0Aq{<^L-bbQ9__fa2j1fu?+Y$)c{5lAj=($?3SF}00?x>uz41S?Ux zPZmaO*qe*+3uxyaqF1-_b!Pg;84ez1?d)v47PGA+r(CSUJXc=&x{qUt!iH^Vm{4pw zUQ%r=vWhL6y=D?cKRV;8;ox4@&Jc@nc91!%amC()eC9h$StsC_TD?-J>bIP$?{bQ_ zx2IFZ7bZ7H4DCu9UN48_ z`$D_}&-6{b+?8S3nT43{o0oOEJ%$waQ$_ri9npL3#_!WmteOyf%C;kYm6C%GU-I4s zpKo{zKo!enRBsJ+cC4m;l=*q!W^0~z0L3Zl`7)sr5w-rI2EVa#;|}-pRX=a5ed9Nw z!0X7Gx2)8N;?>Zxxbngmjn?m=6COiI{;LR*Y*hWx5^3tklkKens{(fM7io3ai)%yd z2frMQC)GUd_mxWYJ?Ut*nbtL^(-@i&6D_evZ|kmo#%VkAp@Da|7&=Q`t+I!z!lSAx zD~FCQ9ZEO(e4_g-sb*ZFFFN^2zi%H$ZEJO@o09WEzAcfE*359D4CWav31{2vp}7+Z z)b}p&e7UP$u727+=(g%w$2Xteylh!veMUP(hBLn+U()$(-b{|5g)yt{QvI%2v3(7C zirxYbf6866#1=|+)b0E=q8hR27aAKzr)obw9UR_*83D?5%tYt8t+6H zj|V)W_PknFCAn|R>CULrok^Zse%?&GdVHYHAXk9%yw)~TuYfJEOr-kQ&nAbwdnK=T zzlE8b)W}nJY)Q4eu6yV5$qQM>Mc~COqlc?~8#|&qHsocuiI@F)h@ZSlWo>Kv6h-x} z*OBYGJF^W3<8%iED4WlFJv!X~)bQ0^L(=w(J6;HJs!NXr>_~@bw;8QWSEuL8!}bRY zWEQq8n6++-l1Bz=Pty^v;|Ah+@RM{aSAN3@ukVyy7JD#8y1QR)mK6rW~mr=jPV+SNI1V1JCrJD z5X4_UQEd#|`?0yxXsE&mh(eWmeZHs0&r#&!A3hHfK_v90)5GC}XulK^V z^Wu*j4+*dyW|8&pK$7okDphVcLTi(dCMojvEF((uuylwC0}v1@_B*teg%ze(;cqFHMLo z4tij6TwC;fXHM&WJFQs?<)tYGaptz6oZwR_-4`xs*rV3qEoRIyPDDjnuXT9$OQFmy z)~_guV5G3 z1VSnC;nNd3cV^yicb_a%9nmCu_R+pKZ|2^ad+*%2bLY;y=Suc|_R1w&R+V;bpRZ>w zyrKNQD?fPo8w*Bft?W9wMn124_l)xwA9!iUZ@)I@`SWgDu=%7fx4yZx{nOv={npXv zw>))jUG;6J-+M~z)!|DI9%yPBS^kIWYuqo2j)6ShXBfIgVGv5r% zn}5dZ4}Ek1R6wi0q4aJredYIkd!uto7XI^RUw-hD)*U0$X52aLSjn-6gNGLMEgpPS z=)Pt7qM>J=tUvtK(2Sj@y+7}JH=MNpnWrw96L=^vbNgF|?)%{{J7+%nU+b0ibFLbx z``vk0c7AsDn-5HX>%XU^uH4*x&gzT4eeG?3eZRE*tfo`$oEQ7?js>w7o*ao>GyCy_ z=bt8D@ZxWN(D=QR&$u0?DOZ0(_{j$!%&0rG{^5;O&3JoKDHwGN#n@$r+4oB)+?80H{EpR z;ax8-s6W~3*FLGADIDP*-~H^vrTY$FviRw{kGxkYZ_}?h=h>>8x;NhAX_zVevc2nx zCGQ^CiQcB1GWH+^vWW5Ul4-a2b>-`;mS%PxyApFXSZ-aBgUd2aW+ zO?w}#J@)E7L;rbpN6mn)lr7$N_~3%a7x#9TH2Is4u0H$mA1iBa_9PdUw4$HCan+gf zl51A(ee=+f!<>(kL!sBNUVB!_O|t{x2R8m=;;)V#kxITl|5o27PP*;}aqD;g?e=$` zyJycwO80k5nhrekAu6jVzyGNpt@Q7d_PzFZuO?3YkL*)-uZq6<&Ys7f|G}J+uY9Lc z{r6wZn19`6LqD26bj>5XcRfOm0?iG}>+h?( zeA^f0keIqA^~&@AWrzQNoc}Hh;i>b#C*vx@fBc(H#VZmMhT}N?Us0Cw&;OCb^3?vH zNx3S^%RS`?(WM^7_##{D#2Bx{r2KUrDCykW0qdDf5bJ9#Ub0AF$h+7$%n(+iNP;?& z>%;Gh@7wm2S9(02`NpS)sesi(kw#XC9cd5+0x7m62q<*qNvk8H3>bV-2F;^U ztGb4KEh}q#FKuY=Xl`5HyL@FUhc<6Ud1j(y|w~hSA$W zqY5*Kh6PHKUH#^AFI@r$YC)9ofUyD_a|_s^d1*`)LbYb(9RY1-sr0}?GG-ZB&L+#n zjwNig$%E($F)Xxp2}%#FsAf|e^fPu6?*f}67i<9*AeGr}OOAEmuM>7qL zW>ANU zNgRHIP-VFh@OCl6JR*TFSZQG%RQ^CEQ1e%l?sZ-YAFa0kT#yq zB-T0`8gQ~+hp;`OQRppACgq%>wpQPeFEjiR zWn$yQ1mPgj%2`B^G8!DBp<{hB27yVem_b8$aNXVIyli}6{IT(*cwZc&KVig}_&hDm zfJ6Pe%=Y!r@EamH^cEC9!=GlqP=upzLBf5h8ommps!brMtPB~r@C&~`Kpt^tX00YT zQ$6Ui8bTSrzsiyXRnrUsg3bIjEn7lTm#Rom6?51jLm$b$$TnOR8~#Y9!tu{J#^G)YQPm_bu|DC( zuu17IL`U>F<0>P7^)J;*&^k~J?Z-0TxZ zIQV!%!C7Ri)u*jq5;G(BY4>Gd!7L@mPPxX&k1ss_|Ez=TeVgoZfJ*20VsoE>dq1{X zoZl5~8e^0!r3^vY^HhZb`Tj2dBcv2JFo1pW}iS#bJ(F55msE)Q3>uvcx%Tr#CYO~pq z0XBrt{gWwrPJd>|+SQ21R=eyF;|tsJz3^p$Lg^_r6;3Lr595)KD9B#(mG^9G1NX-j}4z}^&`LVOP_i8KwTkzba^`aVu&cQhR) z!2tw+@!Yiv*JB);FD#=Na^dQcM&isEIIS<9?y-T_keMPbrZ3tvJ2_Wz|NjI!|4WYR z|CdE2l<)r+m8tXpC*{iX|1;-5`3DM5spLicpKSEN|3$2a2k^*ldjB1MY}g;<@akJ< zu4b&mRs)u^zoO8?Z+P>I`OXb5)z{nF>yaed99bR95I@?;E)SgR1z(6C8Ds~=5*rvw zNn({{!@7J#Sxlt)&Y*Vskkz}(o>`u)ROT;kK z0Eo}nsl=hC+Kwg|{t3B0-|jAGHXC8vb!;qbRIzn7oWUchnxV70!CXqqAj~!uSfypM z)R(NOxRS#uY`CV;!uo}9E^00{lws7Y0Dx^QYgUC*VzYR7SD`p&-NM0QECbXz-B%w#I17hcTVGvG?l$AwMT>j@J_rdMRJ&D83}c8_jIg6ibWGeKJbnRG zI06ngM}yBF>FEqo(`&G>`}ru9Y+`Fy@n4wWI_29BWgZN<+dVIzl8 z8YPw%DY222*g&4Pk^)wVCVL57;4(k~e>d7PHQO`M*N}I!1r8d$PS0iFyG1}D9hyIq zOOcjl3R(&c1(`$oKpg+1i46)Yv1}wNER<`gvrCbCYBm*jIPs%eSW#6u9Kplns2)j# zR#jIZnj$6zKBPfr z9uIed93nN*BC4P(5eg)%Ny&I3;tE6*bRnVXgd+(_3iDx&+$Uu%#A}f-X-+7l3Nkj- z-GHc3UDBg`h!jldNmWV`A}e7f$%|T)5LOdaIT3Mh4rYQXMP)*hNH{DcSrZg3swpPH z^^g?d6Ye#Uh$ClO)W$(ZG8MRK;+D(kCISiIAeW14+taR1{fr zBvDN!ql6=B91}`X!<67rNd-i%5*rG|L(v40jYyJDBoa|d%%q-7%3&fukx)bqY1$Zl zC#golx=j0vE+%wEC&W}GY+p$Nt)b3G1VJ4`?86}`tVam;xF)GdQ6e-ERV}QEaiR+J zctp{ps6Y*L`}NNT!wA5b?BgSvZFt5n4+s@*u?M06AIquv+l2!%Von`%^uDezSA|O~!c*+X7o6E#h_jOlPqh=hbWgRO|{ zFlz(u11QXvoCus6fMPsL6uiX1^8~Pggn;+;bAExLz&BMSw*_9pc?FTP-~oKzgfCL~ zB7-jx$OaY@zG%P~34GB8ADSvy^%n_z$%HRZ_yU7(5Qbtg;Y$X5iNF_Z@S&}uReyoN z7ki9F6C1z86Xn;^;{5W3$}u6iGOV7Hv|hgcpn!=S?y0f^v2!pq9tJLTVIW561B?bz z&cN#D9atp?Rv=<@JbYd1!dHq`EP~eASkZx&@LL`azn8l3o8py<;1wNs1qWUt2mE;C zKsr%5XmXJQ3ClsKP!1%?T@H{u9zkew5d?|JK^{^N0~^vpF%X3D$U&2f97s$I^07Lb zT0{zz@kl|Fixfyq2=cLt4y;9FKpKw>$R{cT%`P$!F7Gdt0698_1SsQ?fMyp72vZ3t zGiej)E|IE(OJaN&KvC>1KpA*ui-@$+c+8toEfLIwk$ z56;x7mcR`G4lu$koGIkUg!3#~>p6BRHEp27V_V1<@d!rkFNe zTfXE-I*k;WvYLZj0?wrmW=7WZVX4Us5N_f*2~W@Sg9FhZ#pxSEJ_y5@No&272$q-*>g!pWF&VMK zVHLT@SdYgrsufew8H?W}bQREm6U$uBR$0uTI=F@`sSl^{FQznGK4oz;Mr0a>;U_i3 zWL0G14r4(%7_C)fSRdw%xEWGAoD-yAVYkTh3uzHYV+5Ku1WTn*z)Uo>)(a|cpVMtgh{|}VbupU5>3j~hkiseB$v%_P>~T-5&^%nz zyqTodi>b-Ln~Ce~anHyQ7bRO{VlXAJN|7m)1;&6<;{)Zogg7v?UGPVC_Qm&Tfy7t=k)rcH3uBFo+TZjVk zwv4FQ%=da&2mvCI0-lCdE85ySJ3RU8@KgQrkMDBn|9umQ<9PjFR`Sn(lf{rS)&D2s z%3uHQBkTVnTl<&re?0q)@p4R#=CA!bcm54zw2`!K?Dne||L(rzAgtAc4(T&jNa<7I z{yi%Oz*rM!voP4M@_ARr#}QHl3ma@x-xtlW3BFwVKW_cR;W$qJ7eu~b|F6PNo&Pu~ zS8xI^PcUdH5-dSPmB>t$L@GrA3DKA+$M8+wKH>?jg$E)~(!`eZ-qBtMS1xW))zXE zS%wv%AL8(N7x3b!H(;c~EDjg5mBY#uKjOcCY6|s_?8?*s#)qvY6vuJ(zbF;Pe@@wd zlXA_c8r$HzU1bYmrO4ykm=KQPn>>~6>8t@g9@`xR-0OH z7y0NrtV>f#{R-s0sNjqRFY<uBh$oZL1-L$bEftJ6CBtUm@dRrz^D8{Y6I& zGAx!1vYlO$v5L2G9*oSE5f4n@kH=5A8qIafYg-#Q6vG7o9_K05N8vkWsI_)UTgR&2 z`i2!PZL8sH?MoXvYrFzqA$h9+!x9euHn!9*?SMNBt+$QLoH-Pv^|7Ha5O~~M z7ISZP!c$5S1`{@%7|TVA$13DupGk}5)y7jguvSYAqu>yt%)l>5X<%t-VyLk4d6_Ed zz>z5c1Q`ef^4P)IlRb&Ft`5dLrNaX#m^3JoU$rl~OZ-_~F8aS>eQI#Ra2!wn^9Aw$ zA%05#PtKL6|AFsh3IDFw;@eW<77`M{N_~*9!XU&pR5NwJWgroKb|bpgOaEN|6&t1J04=s9*_LgpvTVa?Ck99tTa1=UR>3MSGfl&IaL<9 zt=I;8V+(Ahl#WP>lFA<|)3<`o`@)>jY$0cKrJOT*dCF*VNp@y2G zU!TH)yY}^WittRuq3eu@;pRGbz(jLZAP%KTOWD}Bpp56oNueF-1u^@E8M@BCWr={{ z@6JC25K$Y|6gE(#thdWry1tp?r)wj>&hN;sFTLdHQOwNZRYi~0YU*tTes@Bi_9;($ zSrjp=U*+u83G(g8WYsg&-&OB;zYphlIU3=LBo$Tl9=dwwfF`c;z#rko#7{79ZxyDc zG{TL+3ET`}MiFjRCc4KP&|_|N2`87a52&()mesRqgrQ2}DhOXXu7FIyI;FZV?Q6K& zpo`Mmmx^4R;Oi?S8clHog8Lv%BZnGE3ofZ>7hbm+Er#jzT3gT^6Q00oON8V6lk1-{ z{+H_iM_v8jsB)4W1K zxAT%({;;2I^^p9+2N)c$>Ps$G1=Et>idDvMIf~!3jKvwM4`86ivyiRfyN5M;E3sC7 z4Y8(WEGg)c8*yNrk-y={UV-4#b;N-IAc1!1u9)Ejx}gzo{%W~=KAz@S(EqsqCwc4) zFkg`WrQJ54^S?aBv9$m3_anN1-m(5`8EtFv`)|{Fe*gC*2h9J)J1(>Ya01mUm6F>e zhF;@IBI0x%KhI)7$MvP8_ky0?sV616SuD4r21;}im02b zLRZE0jb#9mS_&Sv2qhcp#BtmxWSgCo(e+v%Hau*qRwON4Q;~+Z{uA zrfqXeZ#lNp5~gTdd}UWGVrymCJOjkZwp`Eaa&#hXby_X6+iG%GcRj0hKWvu5*06P_ z!=1L?@H%G4)|-yy7~M9^T)=D7=-dxmTVbkX>` zqr+=AtoHq|Wxe3En+@J<3Eee?#kKHgwT-49mvxvZ0*}M+&V8O$TR{wjfW2IX#i`@ zyfJaYa*=WyC2H=Jk2ywW{$0h}@OwJ4ngV(KqZzn8u1%Mh`|xM}y}f2>8uPIRMEf$cz;wSw|^V0tOWtpUh7UIrVFq;gRo!aZzrHii$)7 zlqo`6N|(&4Qc6LvQOSjj9?lP*QWKD9_J8FHY=&MX?8D)!_j{WKrdc9`yYHzzL<$Mazmo}>EASJ~!UCW;BUG&J zv5dhrAVI4wEBZq;V_?9rWGWory9S!G&vx>=?Ik)ZLN#GdVgYMktB=n3tp>M}VrX>+ zOrj(!1O_pNhuykA)rc<_lzFae%di|rN#bM55oa9vj`9SZZxfG~6L6!J z6G0z3G`4PY{L})lcT3C0EeIvqUy2UJ_BH0v$_5i$ADGiAO9_GJ0KYY_KsLSsXht3ajXN~z1M-*q_eBj4S%Q2S= z?4yU(M7TbvhFglA@^~Z^p8UxTqHd+9OiHarK8P^k<;ZRlqBv7uBxrvWMzJ`T!yIcW z>R2T6)nFj$hrVI;Fbbkk#OjBqtbW#D^|#-XQ$>9MQnmk~VQO^xVX*i5<6C)t4)+H~ zXG3*$_`08+ejJ_*4i4nS!N*r`_7C=kKMYUz4$oD99(eQv;D0k_r5XB}@5;Nb z?PLYu)S0S_oUydq3TBis%pF_%jgF-#S45K}5yanwe7R8!#T~zlplysQBj5c>RuJBT zVKClWJ$4XCDQ-Cx3~}OyWw|tiPNA8V;nByF{$3CC@;*kiN0q*T0DCYMFDYJmv3D@s zyHk^^DfbKYxUo`?E4;UB@g;@6T!$NfSclJ(^9UN;RoZhRHRzA~phew9O?dw3n(*z9 zE7kc5iXKm||GBMMs@u;WtlRH~Sgza8Z`bYT&$_+t;uu=gkyF=3$NH^AOw+%i!e82^ z+w{Jx6o0wh51Ix*d4Cvy?k?5_QsvJzx1DY0>S{Z7wqbF&9dAc&unlX6?eX-NZJVd1nXAB9$>*$E?GyZ$ zYU7jKC|rb~$S1K976}t3`tHd4Y%WK6u#MMO}zZ2XAF5bc8F|cyF zJq8|+C)<7)`~i-R{{TnF4{O_rNbV&;z7uUbvv}K{Ot)d&f*hIflWxQ4*^Woa_Q?0P zf0>TpN6;^Ap;A0oLqJ|+YvsTC?btv6SpNR^FOUD*Y(MA!e3Ikg@qdly_`m<4W7YUi zE+4OsyY~MX`px*?X8U>kKgDs&=bE!9{+vv?n*LXPsKFgy`ybwJ&3&#pI$?vogS}H& z@xR+2Vn&7c!{b-|J%($+7hp#`?op{IgJG+9OD?U!>_g_#k5v_QtGCnIt^DUdG9`pf z29UCQ$ZrCD9^xpFsX5#h{jJq1DvIUOqQC$CdkK3}VyByr-txCWWbw{$QGpZos_j@A7yuD}-bDKb@18>f@ti|e@E{%^L>*>A4@O}+UX|Nm)@ofm_n zKKWE(7qjD!uMhV7Osm%GXN`WnJ~$n)@86vs9^lfS;?O&3y}tJWH!?G=6#VV7K@s0h zPwH2Q$UsPSO5t>zwC1L+wp-c3d-z9icbAOlozzbQv5P^}zLz3MyOYm^&4wbrfCb53 zNfg;3h38Lp>Jm(%plF}52zpwQUc=L|5UIw-vG97@ts&|_*lSLbXbfNF_q0@8rFFcn z?^eFrp^VrFUd7#T7d@>H_B~KhJ%z%wK^w0W6t-)da*HG)?R`9bQ|%y@ow{skWyg-( zYq)m(3+B5$4WYRYYY`0}W_N)$cjly;YS+T;bNp_h?e6eZwUO^>tiHQb=L)C}6|W!xH_8JEwm;h4fu4=R(XPV0Q&-nJb$WUW5?3Tn>`&3P zOWS?5*x!`sp#OHCLcz?Y_=#2_lYiLGi)wX_U94Iyb8!NUonvdrFZ>ag)q(681<7y@ zJv{@F{OT(Zqk^}7=!z>+eA@22Xd-gvWCsDUxnl)_m(c}w^AY^M@Wmx!+Nnd)dqT?` zecJAj{yr4ijV{9=;xP6G>g=HyK=om$9AJYyc_=)7yof>=DbR+pquWFApd4@;qeTKO z$Hm2i>4`DUBM{SRnQ*HM|p4^{7bEuU<8S-EFRY|?vD3_5C_>Kq@ zq4;?quZp@Cn6K1lFykI5Oi>F(T2~r0$;}}^GvjaYdFK3E!Y3QBsFh0EMk=Oxtq&tX zL)fv2q=e*EUADF~QpC$AJ%Fiv1+Y_W3{07cpnzMPdE%0lk*I`RNfz_Um0DHlJ&Iv+ zy#|mT_v7F?-$up*z>7J2Clv5?%r686ow{Z*W#|>|2-ApSU{ZRHF4Kt+6Io`K2yYf( z3{whaRYU$vOZ4uCY(zfb!6w!Zv}Z)3JF_hifh*mYF%Td6D2LFjY~mVojGGuIHO2tb zIPko0?`3S?5g>E**AOoWin1K0-r#yy2 zvw+8d`I28J7}5qb24(`g6n5gL3K%ZMbI>u!xSjG6#x;?-U!+| zig=K00%pR14V8}Ms)?JD_{c-{OpxF>mHn3SgR^&%3pbeiD(90bfiCU8fO(6;k!=!8 z$Iv+=ktP((R%Q%JaMDF5^1#Q)xw!Km<3C`t0Bwep(kV^RxRC+ZRI#;$eLOkXB#vO( zAq=i2Bk`!-BKARDgby9O6A=R1>}f0@J^ z-$2(upIr(SL7gMCO{Mihr(aIG4eh%#LiF^6mp z#Rh1vk8+n0xXFZ1{qIQS3z!RnpwJdH-(7ck%5$pn&WT}e#O)EmHH|PZBh$=HKZma= z1)_ifz2}QS4Q`%gwTfbjk{rkU8ih&4vn;oH+$eO96Gfk4I+kijU10bR&^C<{hx+n~ z(l@wI0BH7r;u($~PYOSbifquK9%9pgrx?6gjuVhbm0b(Ya6Khp@F&4FV0WUa4}A3E zXhJPkW7Eg22YGm8DQ7Z63-Uh}B4;0swoHc*noM78w)sf-&D0B!C7@G@*=eXL)ntT zq@geOkzjlCz>R1)LcjQOlZhQim!Nhsti-nkw33%;1V{-M6$DpUH%skTtXt%PEC||3 zJ>O&_Xm3bZ&4u(1QVrz10)PUF#=n*AxYJm)KV}H z)^DmFoCfmUM6izLC>;z7mw2(DHb6lpw4g$@p)LxwQLwHU^Z`yhNS5qT3P^&gkh)XG zG6Ri)-xp!#3zaCs$|09%oKHiVU(rgDTu)H`F2I4*tBMFe;KhE4mKa5+5l({9 zDD?lWL|4wkpkOIz2X{Vi=8{i(b8aZf($E?ueKZqLGh!e@C@?thXht*rO5l1_m3Pr0ZnsWe`Bs4dksa>&47!qFvH z0@x|D(TJisqimqG=X2mJ^ncAX2t~J3N^TQN0&D#VG92eDXH4+~A`E>9lQxmdPC#yO z9AfDa4F)A^fR0q&y6++M22;aQ5^r3FpixX&gOdn#QU(KtO_)l%bHrmC-3d@+U@{f%YU|1s&>xv~ z<%<7j?@QpLs?NnH3rhx-u&B7VW|I;KGmvOC+c}*8uoaAspKcW}W)Q%K z4ND{n-Z^vuz7VoGClWXc$U0ou04`o5Zx37maJ=@23JYVG^T27Tl_CxqJw`AIXhcsS$H7h}8KYMQU}QlX_yE`|9$9Nd)|u=qx{&ao zL<+JSkb0aQ$ey7`EH2?CP?{nz7r3#$xp}d6&UqQAaXBPDi3TBx1?TMUh{E#+eisp% za~#+gKYTuxA0IC6*C0Lt4~V)2!Z9&rG%g1tnB-hgRCCS{Y&Y50>2ri|9=u$88aZUK z7|%HvXx$*Qv~##DOc%ilXCU-Y$a09YKs(zRw_wE6pwO>

    6xU0uN=`#tt+7w`dvEjCs}Tz_^E8US2s10UH1XoPjC06r26 za0(8DJwz=Q<7+}F#ve(=V2RNlrPXPdF}-C>cNxk+B<#{hb_upjMC7nXLPwqnfJY)A zZrqp>ZtR7Dh2*s&7IGudJxit+c@iZ!>k2w@Ej6bUV;~~l*duRdAN+{vedNrWJb9nE zW-OkcPg*c`dPVG3O1LP@g`=HSKz`Y=l5p`3i-YDb zq*oF)yT{_d`JW6bJE3`jtK2G)_x_465Z_ZpO{qwgnJRKo4@P}*4)=sD(05Y>#FN&S3SByga% zDdu&6?h4>Y00uW?1DwzlEp6n+#ua}8s?1>RL3z?T_0ZZ57Mgu`+!D^H<((EGxzb9; zMRZe3Wk|0M^YEXd@{yw}*`n>l41Q58pfEd+tCj`8!M(T>;FQOLC#~=(Q%nz8*)`** zD3NA|K~oxYcZ54WN1}N#*hP5r{Lwm%8}0miwqZW}!?OBNYhx#+9|PO2OfMtr=s(V3 zB&^u2LdNz{!jMQs(;Uqu!wQg&9qXC)$fQh23c_w%y8DJZ!RKDMMxuC$C)1XI6_&yT zoRBeSSr0X{Hb#SZl;h+l3CCm!=i3__#Z(=bY@VNgn9Vc9z8Hm=5VmLxAAdKCI)O#O z2SB%%xPxRIxxo@N(lWXch7p2%6%viv@hO;`+fU&~*qgbE6hqS%yBsqnCv)XMA%G@l ziKIm!S7c+%g%iHcg>vMP-7ElZSNCQeaN0k!>gSxnWyJFB=hNYoB6|NHYmadt_plb9UMZ`A`;K8NJB34a1g5YeTMxF2EW+}5|zs6IO*EiDwr)e|Mg0FM2RCqbHz7Dq&k~}<)=}On!IEx?}XGh+`#BM zAaziEkv5^Ffsl1e8HE5c2_=!kVq`OEH7Dy?|(y=b2yQF=MNxJ8W{lQfAVlBBSMlG-B%_~tOi zF{xYeaV1E~UlhGWB(ONR0M(Dww@C*JAWG6&Je7eec4HxB%z(6MKwxs7L$|lSNbl}E zjjo)C6aupt1bCS`LkNmwWuy>fi$TC|d}jzmG(QlfOQ6_in{!d4X2{gXdbaMp z{B3~BictHU;OfyvDT?})xchWp%O2%7pj+(7RNez@Kv z6r}tXgtv+6QCYVj@8r1e7txN+_^7_GY@s+xu>U{2;Ez>B<3BV*vS+vbf2?KB{(m+; zJpSX*mVP1lBmGr5-+;WX0TA2{X^w|W&`ofF(&I@;DKM7IvHRT&9s&)BZexd-FxiTY zjE5ms9gp*7$3>)}7tjPBczq^oOn{p!OH9gu0T_cFTZg-QyM~|{akt=?@eu}UR&z|* z;KG?AFVV)hbC@g4XhsV-KSywYjCoU)p>C44RB+lRL!>)ZLfA&abi9zz8eE-5H1KzZ z6b6cu-4UYo4PyHcWe=-SfShJbRtbZ|r8J&5i|RKc$`(7 z%v}vkiYnqTFectGI?1<=1&|&H<3(fbL~zq_*-enu*dn0F{R*6xX$MyJH3iO#rA(jgj|rX+pQI*uv|fIzD$GoHCp2r*^nuC8eiP=18e~$$#;zfrmFP>Fwz5 zwdFkWJ-9clOofzSaBoOiuLQ~0vz5I{8+pc?v@3R;?^NtKU#z&%x8f_rfsvmVVH+Kz zx}pM3WnyVFsc9L{_FK$LL>o#E(-(kN_qy-Pyw=H=OCyvs!r@*gpk!Fzq_$gjT`YbB)d#HQX+Yb z<-phh{;i1Gw^JkQjBpWhu7Mkk#AI8&rd3J!s$F~&O1 z;=wU(P^go7iflCHonby_Y>vs=l%|+ZBPa}=sa&r_BT=QUPMAh~BwpAtRZpX=Lh@-x zti+)Ks<4}G6rn?|6;f8?do+#lXqSMelk+At?b~-@fNkjVsJ_YrBH6F(j>00uAxAY< z_T|86j}ntfc3)r|knxaEA30#LjG;57X4(`gS)sv7u_Q0SQUfVJsuiY`&BM!!$*5?3 zMN$1qVliZ1vQw{CKI7_}LRhZ8UlDw22UtBK>DpY0aTlafJuO`7Ok-t~m#PKo^%!gV zQMQd_!MxL+1o=`oRS`b54H6F72n>_nk_5HX`tuw$orCM#SXhajwJxdzcMfd{DQ;fE z>z3QPS3W~}*#+VVvvM$8Ztd>rg3Rj5C?i>3hyEfX9YhWbhxiV2tDe;0Td;1_a&Ag@ z(E}>kuvlkg(K`F0h>*3>7)3~k-yK>CgbuSJiOC*gvXh*Mp!ud)B&w|=%L!jV_C5Zl zA=uh{R_j@7*EOHDHWH=f1V?QnJ)vdMXn!YUZtBVyd=GiOkTJ(7ut zH8E^zae`0$nj_y4b8G2<_`$qG|wAEZlj-lBw)bTK(YmF8r{~BSiHD#q3A`}T+E*A6CX=>My=oJ=>x7}@ftRl39}W6OR|E#J4H2+HCN`DVvoc$D<;~gf&}Jc z^Q&?rrvy!Fjl@^doK3hKiC_)Lauig;5d_g8Aee55MWZOVQ*pqx-$OP+h45QuDQxlm zm-`c>>2q?@+F-vFil)V~!L-t##G?Eocn~;cH*OG1NR6DuKeQfAbRSHsX@jDt4#E~> zL*R-aovZ|yvl4`ED6{-K=POK}aBr+f`ciA|Q}U<8``^Q|0V`_%)g1HO|3=r%-T%(U z$F~0>$HKmyVgg|2$vk(sBO(NEK9#sf$j)#aG9&_)l<0? z6+>(}AKggRWYRXv74MMb2B`cgC^Pk>&UR&N&(RghO;OF3+!P*1Mt!v3Pvx7p0rTbkvkN4xbgWr?j}JT<0V7tXB1r-Jv&L9fO;N?5nzqV~Hnu&I0j`Z! z0Q_#A@tv9xl)ZfrMY!30mT>ziB{*roMIi`(uu75o$V%nYX&cv#q01Gi5sZroYT`yh z3oG$lHj5dRO)Vq5OcE)CC+CUVX2QCfPCg6XeVC3vjAS7kggO-X8311`HI8|m^oGifN@snzmbR%xHuhvf2CpBgVx~mfH}TR$j}E! zwF_Z>8j5FvFa{=bf}uE60$A9U$B@o3w$C%|DR$B$q*in$WFAB;VJW-^(@ABR91{}S zUQ9=)>=SYyVvz`Y-9}aE#%?b`a|}3C4{66D@e-)V#tAR#BupedVY);Pjw|Vqr!1fc z2keub2vDGhl?l)~V=XRA)(B@B;Sq&_N90UhN;$Up0mFb^zaBGZvVwGf{ccMUg9 zx_^6+WWTjlsRf~hk%`zY5j0Q6C3%8GNX4SY?qL27LQV$Ae57ThQYwI+N`w_P>m>6e z-({rpd|OCgEK6M~fvZlzMMrAj63miC7_#9krM_6D2)vM{E@(mqu8b-ru$3~bIjqVq z#k(if#hiQv`vMrj&slCk7yx})sExdE&{m|^h1y|R(R`ZVZwl3B`O$o8^EXBMX8Iw& zCJLhv(|WP&UclhBjFcCbrXb|o0L-nBqcE(9%#3fu7N2Ak*dm!+DicwYNv97TCKq}F z(>I}z(>a5mw`DW#IE~K*_hvZ)el|IUDyzI}N65Fv(8(WF+levlwy75)+kfbW?SzX} z;(UwnK3)>gv)aO#7e=-!flVPa<*v3N>4Tt1R!*QRz+7VjX1pN)y*O1njKq<`y z?K0lx1y#-oEHje0CsCaQiQg{klTHw>cH;ZObV?Zg9_e%G+-G(^Mf5+pMCJ4Ut!rNA z_5W{)&gp+<<5TXtot>T2%>RcJM%6lJ&E@~Yhkz1xsZ?H9K4r$fe99}unQvOz2un#0 z2xTmzOiA}xvC*uNIzmYVOK;UIz13H6mO!#rOUM#PN>wIHV9^|ZM_U5F64L4ki-5Nz zJeo%KJy@7hia+|O^7;8pAN=^_=reurQ&OtFlGE@NPrsMI(`e3eh)AJ%@$45)zR9ei zCgQ4Txr^E_@+9mNihA?*>6u1UpF;gc%SzfQ{`AbS{bHEB@UM|H4Df*V)_@mc71C*A zN&~fyIj)OU$ctg;g;*t#H8OG?Rs~-0I!=`e=ME%1ofF2MO`mBT`e?GuWr>eVG6EjI&31|J8^z2vtRi0;1bU^^JwS#iA z@Zj9I79v9`^|&D?>S;V-#Q=d`5s*w^RJo}+g!{GZm|BxG=oi)PG_ZJDPJAsZOX}gB zaZ;Vqvi_-ew)FH3c6Ek0rU_>rg<$!Cc8~VkFTi+(yky9M2GqS|6j@Bp<=_IuDGJDu zORoqpz<(I46SzR$0N$R}mM3RZ9VrNbBAGi1;iJQFm6W5mcbEk!D#e%gdb%LKL=*O; z6b-x%TjS}UJjQBvj7lkXJ>r1EMnj`QCt(g)or$-LcGYqPvX>T22~q65P7MIqtoSi_ z2vuCRvr4M&6Xpzw)y3QGyb}c|a;8Km*3&amEx}Fe@H4@*mbB!k*)2>LFxO$7W_j{i zb402m@^-KeUZcMi3(5<>L&8c}iNS?ciyT+=3>iAShg+9nT2RV+C5Ler9k>W$7_+xG zX5P-In$qz;ngyeDy=EvHCjgj1A&b&<);=MsVyj=eRt*kzfX6Dsjfj|6HJccqhf|ZX z3OJ*ZT_5zIv%(z;r{pch9%Rwaoze*wFAYR_5gE^LXU9;-wtN{Ypaj6# zr*dk|0~fnTir~FE(lYOfg|-ZMn$*(6R8}7*UxA_ohIsTYpaKh{)V1YVKsXmg7g2$| zq>iJ}XQ}z85G`pz_^&9x;z_L zzO2(WrTR0@+0Hs$p26CKDk`CV|96{m1P;p(ghuPtU1t4BOnR9R7) z&mq$$R3}$d`Nry#I#{@AJ`$;e^IrFt2iZjqebde@3~=)Vk?7sTQvKN}eFF_#<>Ie= z5-OkVh^{3jCsx{uRgt9n7H7vRAwjVqXXi^$T=^`)1VSPfu?sOmjgDTFh(w~Al=`y) z8Vx74x^PwD;5n2hc~#zR4u$Oeb@CkS<`Nc{Z`HaJ7P|%OBZO-g=PZ!;w(?B#Fa@cS zNcza+UeC{}Ms(N3lEkNGhesWuaAz<31doE4aYPb4=FgBctptyqpl5Te6)K(I(YuTb z<#&Vv0{ND_h0RjpMp2U>CvKD?vTzyACw1b>E)C+V_EUoYN2T*WLZD!8{>Roi|Bu=D zaEAc6o^WD+(O;GG4Jnxa5owM`#$Z_*O`$w>`{NNs$#DbPMc;wAktA){=^MqJfaPqQ zH2gC*I_DL**%H`pM1YznMl`ben4Ttk!jxQ+06)d`!vXtw05=|GOrOx40}yEihoLf! zi9sWbI%jNKfS@TOP4N-$0}m0FLE6G#uh;}XPLYcKzBVjm+7U~u<&#}e$cyEhNfC~l zYPue>Un)s7r2ut%TA5^J;^4xvW&6(FH?3T`68&QYG8XULlrv*zHTz^{giDt~nHe3` z1Wmn&s%t008EpIw8TzzF-ip@MMsuSI+_7TMvVQ@75F(bh~iYw<#B+@#Qk$TZ#!0)%b38 z4BW{ea9$pNJRZc;ogj(y!VMq9E_AZlk#z_`zu|d3tzGZw!==Ba3r4sNgoxJ|b%?xd zblIU*=tibuZh)1uprNL$S^_dh&6X)met$SB@vyrM@}s~VrA+&-8#g+tVW&Sdp-DGx zBrp68(TX@XR01&GWl`Ath1JReXZKkYI)4$l(sP;*x>t(@Uoot@xcv-l_|la$;XC@Q zzYhWC2T!!?(`>=<^t8=mxXRpk;I;41)w=Dwl%fI; za18&T;6~eJ5*vz`x%4pBaiW#LPq;E7U8ToZ%o6UQkCj9heSE-Y5zM_aQ?8aV(lv+4 zc_q5q@9gb9-_8gLKZdt=3=R+O>>cju>UGtV+&63yg&JBBXotbAZx*CCSf9AR7Gifo!xF#qbSN-9xlV~3&+%{Z zFe{E9xm|V~rX#TPBTTnVKMv?SHcyY0;)Q;!(Dy35=4j-G9Maikh;V9$hrS*k@+r=( z^)DpG&-o0^jNS^L{)?=QBZTb!oJFJX0Vo!Y(+L;FaKl#a`?XR`SjxD%p`Q^ozB_4* z*}2AjV~eyj%L2Q@Ng0F!BV`TB>-(?+<4p5lR&?#lI+@~Y->U^VLgY9&&goImHNh1< z;i_5CB_yXRt?l-;beb_)dbz5&iHsYQJVqQLN-3;dV8pP-`5mG;sax@JB}mF&6um^G zu{h*4tRJawlXi5VOXm7Zs@RQ%AWDouLvprD6*vL%!3z}M9FmKo)pffI0J9hXXiPFQ z0Ai&8kSzuPH+Y#D4AJ~BlzukBF57r`dWm>C zdUvoqBLKlg4Hzjas_EMCh0Y3W@Q!peTi%rEV!C=LA!_Qy7@dx)UJST4Jzc#^zD7!t z9XZpb=;_&o9BUAD^fuSv70TxLIc){~k#?kbnSM&~|2bR-&|?0d%~7BH?{oe?v+}Y1 zKT-GRc+SzEmGllO>ItfI<5sZ6xE!Q1HLYlSRmhhOc8G9f0P%IN1#!Av{-LTu_7%94 zr@i?(Ln3LT!_iqs%HPPx8IrPG*)yn^gQVA?5tMO-JQ{U_Y(M-5?Gl(hf8ud?B<)Ea zk1&r78TQ=AT-a+ZEPFp9c^w7rkFWYqG5()TM#%HS>!V2i$JW+XkN@Y|wd>~i|7?89 zc9ww;BSeb|H_@`j^K~qk7PF=0X%-l#2;xPsQmtU1wzf9f431gs`N))|ky^AG9I1Kk@Ny21V75PNSTryQ-gPRbHkP7U za}0%GdIGK;b&H0`*TLbM$XS4H6j7~lSlz(BIKzy*9A}ww2q&+*x?2O4NYDz^R5Nx1 z4s`o!s=>ZiCu~}0S;+N_s%K47kO=8D)z#)j)kQ|j_$5-x`Zy^eWdSQ~VPRJJ>I$x`S1qs1 zrAy+LwY9<8y|sHKHc2p&k5K}}2XWC^2D_LcrNc^WZRMHd=9~_SQ?^1`x)78w@Bzq$ zsv{Y~GuH${*A+Anm z69e-p6(Dm07dN134>Sd&wJMdv6^Oc11cMpvh-4yw5V+{lrb`--;RGlItUUe`iMVho z6c8I^Z3VHh+DMbkY)pstV0g;aWB?J@2uvyCU?5-*0?Ds%w@tMX96%Er0UdW%OXT7j zZDev>Pip)L^pA~^y~SA*^c8*MTupfUWF_sgAJM201?JjiLD-nb4#@i0GPJRt0J2eOYuli# zH{;`4O551h)U;m3PwqYugEjgvv-IgZz` z!qG;*ft4Y}S6BfIvsmc7J~xzwNee4DXJpB+DT6|NBPQz%z)xx_QdoUcJ&37SvT5H3 zDrhiQ(G%#F4P*njq;D%F3c#sA3z7*9^Esi*lRzunRr2Y=F=`;xO4~x#M22@IHO_F0 z;8X(VO^}zg0!ZZSD-p>_^$D9vkj~LT4_B^k@*c>VO6y6!xup#Y-$N{T@(=7~G7lnU z1v3v&8;Bi%{Vfp%2tT)If^7Z*8AhesRYpt6_3nwKOm|gxt+ZZPel`0wB5CSq63=xY5H) zS)3E`?w$&9kvZkW)y38%Z&GYb#D&9Cff_H}M5tkt9|`7c66CBGVD=@#;$4vgG3l%A z5?prPzA|=SEF^u#w;wWmrza-NS~`l@S3WvL`Hznh^3wH09l(fFsOilRTo|FVn?{P7+}@@ zb>NMNXtrp1C9#(M)e9f11~n*{^e=1^63-FGD>b(Xo0HjFwJ?#cZGp~WpsC4KjrMqQWjHNPi^>d5q_gHxy&zo=e79qID0UFBhcCSr z7+X*%&(tE^x6j)eJtEmKNLm!GAhI=EQXSu6!L~1U;H!P(zynyUj=K}Fo-|-q$5mch zZ-u%OBvIc6Hi*zigj0wxK6h1_S4b+Y{6*!CWYM%pf7B7y-IZT=Y;zQQlJs^(JF>Sy zPZj^}n7}W0Xdfm@?AF;meQWvk%uhIC$N0>*1yOaF?-?ri$fr~s`zo(pf=IYTEOLRw z4>s|;9YG8hy{j2#C0B^MgV&0ECt=?$F`b$j=GQRD$}uwoec=&DeQqFF**001NyK3? z9x%7h5GjL|si@|N%abr4)n0W_wRi=96I@f>*qC4cZg0QU`R)W(yY=IA{1H7(WEYD` zwqeB#(Nhh*4~FaBFe^w-?`bY2(>q~N2W8)k*$+ePo>;z4$#;vw2vj$R?VXhLt>kTi zS;OaPBcW%>k;cGv%Nm)DbC`UYW*@tplbA!oHUT@wFXx2iHZ^b#R?aOtqvu@OR7bTo z;CEIwr-kj;cuE5n=yWimkxA8TbqK6&%dZJSHDq5axAqw?ZSK8K0ttS}p$utJdj zVKLAL;IHDPPNW!Gl?(p@HK!Y6lzgQ%W=p+e7r{Zf}rNcYgrnt zSW|Pe5s;K>XrlR5Jy) z9OhV3W+z$}zX*I>yM~7Q`+9m@Npvzsl3|7UH|^@^9@^SDJiyN)P^Y`s{d$-9x^L%@ z`~4RFK1l0d#ma@yBZj#!0tt>nh&_gf3=z%n^<-Fzu*sc#;T_q8?8r~x(F5?0CX~!* zf<@*WO+-dPj&I1A&J(mZg#)ZP={(HZPoqwx4%_|Hyh6(wLDIP$sH(efc&K|v7a2u6 zdc{Hn;uPF7b4ZCe9HpTKm@90;Adr)-8q|F}yolWc5t>ND*(vCwA*Mm@;A+@oVdEx) z3f2)AQCPPiidOV&g`Atv1+{t~v*!t7=?&zmQdbAQ&S?XFc6Ij-4G6(U>{9kfu&Ad% z)NiDAA#)PS*wafo42npslV-YWU?3zRZc9(!U{|N)bI-h`!LOdisLD%%vAopRoS*J^ zBUkY{p_;PM-e>}iUbCZU#eshtvKjJcG9wWuG&2EC0u$t&#oi^192|YEO41z10whKN zGhTpp1kOOzC|F4v1_5_Oi>otOG2C+Tr(L*HEwl5Y3-qgZQJJg~;%0ZkN>Dq)&6~8G?pC#O5p^ zK(Dyw1eb6BA<=agiHf0Au=qs8nji!a=S$jZ_j#Wa3Iu~zqg{(E_DED)>k1ZvFw|KS z&eMIOItW-7&Jv7xHDL-sZj%{19&jea{mPFD) za|!a6kPZfNg{VnTQn0Z6Ae0fw1T+IgLdobE4HQl~$OJ_Cif2`GoCsEY5mF&0IM}_d zzq`LHtdK9m-P?L+E#O+^kw#;yiCCM3QNeYUp3Yf1jY5r(lzE6Kce|py344#d%aGMX zmJGxSV!4S?YU4kgsf{`E@cCvD` z!x*IP)twIWjkK zyJ&kcmf+es75g$&-prNC1!>3gEj3TaU^Il%Oj8}JMA9`eYPW=Rh*}HbifLq=q?V>( ziN&=`!$8>*MlmJ|D93(KdZBG&i|auUqK$FX%590!j_l@~$*2hVR}R-KvZaT_d3?*f z7`Gq)Hmeeg}AbK%7H|SpipHHE4efgH_2v^Mu8vH ztjuK>z#Gw+UnkY?k~hxb9(v}(cJn9qNzGw*Y^M$it1IN*rfDu2A*L#WN>8P44wdI0 z;yhBkvsZr$yXtJ}KiB27(?kKV>j}c4>hlcenMH1x7BZ7T?>J@VG$Poc4 z5s30TJy*vk==23?l-H0_N9tgp`)Hww^xxu{Jmz{)k=5RTIf^Q&vliAjONb;bZ|8^V zzt$V_E_PBn0i_)-Noype`2ASKC4H5$&K0}HN^AjFCTMkpKJhKCRoZ18bj_5Cgy@1w zd%GghipZXL0|X)!ER!g5TudNTf~4qBlCarIT`>Bk>;aE%B$TB9HGnHBB!$g(x3$kx_G6@0)u2cJ)>$Ibb?5 zOA7*%gG$Rm3>6KLLc=^YN8HFkxCiH`N*_0v7zILF9yNvb!j!rjFA-_*Q`p4J^6rbE zjCPnbjF7Ynk$79T4Xps&!VM}tTczU;}L4|ya6$YJSAfG%l(_fd?A?Rt4J zG0T`mHf9;qV`MV_vZtXmY2S~-O`BKEoZFDG`tTcZ+in*ul4p^d%yhNSNJf~sFi`qB znw`ZmKobSb(rUrOg1lCWu97jsy~+C>c&EJt^3%Mf?na50QN44($-BqmaSm(w5jq(F z+L!L;^6_C(I%_cM*T4I?Reow$rbX^WWMAb-(E9}1QO_R1Lw7SG`hq({{6Izp>g2m6M5`+7I`5aQ>_1*DpTv?kW5j8@r=%e0YhoJD*}iu1!o=~WvP2cJg- zo1MLbux@$E6l31nI$Q^3c9qCoE}p|i_#r~*=LL&JE+z8@V2dnma*n>k|g zmhRrJAyG*Ob^UlA>O`T$_%Ks@vr_E0tCU>EUBaJ@_+bE|YWZQH{k{~rGJIIEkn2=mXPr(siP4iPeyHlbrRwj9oP_v0Lle9Q*Y+_+j z?361^RuHXrV5?d$?vJ|RPF@N{d6G6)!cV;N*xoldM7YGz@YcSay`61#s1u9|0nTI? z_9GxznD7u~e6oEyMDre>@l<#$T^*gB1Kqtl2fLhc@C@#15^Un9z^x!>YQlJE&F(?a z9}Cr3aocR(Q=?C5f#~iYv zP0@9j{~_A8rjia>Wk=5D!A^zyE{*C*t^COn1+xac(Q;g+kjsLf6zJ*EXxR3gmdfSQ zx@jd?!BJ8oEyh8Hus9}}6fmYpP=&Xewp?A|$$+)M#6_4#yiAt;+@{PXFc~y?VM-4E zfI(qS4r0^Xa@E^1dBKWGGAWKi63iXJO>QNvS&0$e8#8W4vv)Yb$^F^Rd8BA}KY=Yb zI_hqVtURkpPeUo^xth(WP4I?Q9@^56rXv7MFs+UyAs+r1L|_?D5n4CF0WahM6Pvc; z8FYl>xt!2|lWmw{h9{o>F=M~88H21VQi6@Kkd)hr^NqRmPA`K`k^O&i7W}{0wlueT z_WxLPZvUT+&ym>Mcj@Vt=7J93N6fw3rg!Szy~c6xjzVI<=4e}U%j~*$=k??UGy?jR zgrS*mr;dhys(ogPL?VilU|2jaO?r;S?XNU1v|WQ8ogG6RWIokS)l%tcZ&%+yr!sjS zO(Hcw!=Pg{q#Ye^>VlWSX4Gja;#CQGO&S{{Ov1`#f}Yyomr46jT!xV=McsnndmZfQ z+kC-LSCCbU@Fr2i-wfB&+q?4@AWhcQ+2`egZN-YU6$^t9=~Joi!^soC~YAj2`FirnX2;X+BM{XNY+GAvP6sxerogdi~O8;6qr* zBVG1Jw^^IxD;RY=(6x-1}o&ZEmP8! z6Z$yBo7d4*_H&){Ij5gIUTBJ~4gQ_@9N1u4d)Yc*s+(CAjj#QJ)LL?B=}6h3&(5HYusE(A4yGgf^Zxk z#??$lOPiH&fJ|G8lvoB2;Yah1_t^D9G6Y%u~|pW z_r;D#+h8~Y&}KDshf$g1QUs7wPx`M1dWxb$5r+Dq^W*G=N+6fsohDlVtrwu4J-StI zve4@2_haP1cNlzG<)9vncEDovZ1~b9TJtDAk`WTxT%3sV$BD?p6JAj<4ayNRq9kPd zMT|J=k^ORUm@ar8tgPp>U7>=G(-0B~;$s__2``@1H5+RlufDSRSC_QutvAIXi5YFVZ0ysm)@hPHS2Zd34b4zj7* zN9nYpPLAf117Q}xJX^Lv1!{j#2hzr z$plSNpqdzvFgK<#pdxer>qn9Qy2H3!O_MfgY+>qd>h@}=FOnfm9PxGUUQPMyRlTvQ?+y#)Pm>0 z3K4eck&5P=wT}vC?HSO&+hw~{-aWS*j`(soN}aNE!+1}sX2&u@1`;D~C7sLBu(Gwg zuXl5IUs$Pwg0DtTYZ*_mBZ#M0xes;0yU(M<1)9B>r3>0ZF3hh4hh&1q!}dv@l>6jX zcSpo28FsiC`z3R|=nVXZ@p5;%Ud;&XG##5=y4zx&$Ig&Sa8riD{+`N(9hE1i;gnv? zPq|ufQs(I>^LQxNlxE(~ZE=cF4MekX2Hht`VdjuqJRuc*% zQeV;nX;*}9LQRq#mTZJM$Q$ZcWyjX;9$^Ix8HSQl(^Cp~3sB!mzgmuT=u{ohOe2?# zYYGHTHnM6~PfjVhv^t^cNz8cf3otiyaN6l3#7%i9O>GG3ys>;E?&ujH3;6=S+QK3( z)B<5?gVH#dyNzKtgpi~ub@{c>*)=!>%w(YJT&I;z4Qvq@B#fp#&u2Dc4% zUntDP4tg&RZa-*8=U0g!Z>VqRf_|Y|KQnDoCbMXKHxW4sP52X0k=p%R3yok@ zO#vMjZKXqO#qSgs=wMXf*P=2q<=~qZ2nag3LVH$6$$J)5CWz`ducKRF5?j`D(GT88siT(0S&ePE zTAKJEAP-}nD6%Y3Sn%3XlHdgrtPJ~hkX;K9E!6N*t)XNMOp$Hi(IpRK+|tv%!)IT` zyD8K3-Bt%L7$kG!+R!+mo4FCk{IKx0dS2H6V~8$7-=*U=7D*(N$^>$qnj;;p!4}ji7!svI(3mn@z(GSwQ9v?38Q= z9ijV3`&7T2J|+79S2F%jthpuTjsMd;=l?$&A0Gc_mnZ(ut|J=%r*Mn_U!Q#%0I2ol z9sr2D^;a?okP~NMl5Lyrm@u{i)(Hwj>EUpr#jr2T;9QCvvuiGL%&dP3@PCW!!cFDq z1DO1}HEZ(mfB3lg|C%+eYpRqr<>^r&+ua6@8f3$T?vupm>wl>ej z|C^Q15E#soGsuJv(cr*zS0U#FBZaZsfC3aVp4Btp776MD%b;#!j^9{PAIYlOsT$G@ zoaNv)l{81rMaij1P0i3a+rW4qpt053YEV{(=FRLxHbN**JbE=YvYxdpIcV5LbguFhI0vG&3eY)BG`QCZg2TY%`1msSw{CuIU8X zA@T~{kczE;5%DwaqwxA~ZH=|M_K69f3^^4Q&N_6V(dl(it_r zJE&&ILLp}L5HYO;xbs0g94$yzaNy!}AXG!-M4@#srY=M40rYlkQvzWHI$DW6u>*yP z{*^7XqG3j~y}A{2!!fC5)8&9;SI0nackebE5}zSwwUj}MPQNpu$e5WM;V314+XMMa z)S9cIh*F@)rL|@Qlwn065k}TXwxN-}sYD`d7~;DuwMX^f5g1Jn{^Y^W^sEVBbhhFs zVBv+;7~&Sbv*9}hrro$3`uMmO-_1?w&mVKS^}Ni}0aj4*VeH8PnnS{j8FHJJqe zgAl*>w^GV_QUmuQ(F~1L0qeH_AT%JqWhFp^2Sx+9iyrHCkW|MFIzVu>2LjqM z^W34iY;B!+Nby4A53$@k`wrzr?801792l0G^v5roLS-Y&5dtWcnE6mV&6GMCaSj=9 z>p5`wU~|C1sVUUAu{%$Hz5{23oCh<$5EP~w-!_VY$IBD~AkXxa)Tullc_DBkt&{~& z2oj%RD_)`|{~|A9%z*7(!<}85cW!ftf}*}Zsew|Ssb+e1b})?#Eez5y=;2ctNTY3Q z-Z-->2TKk(`n(~K+xy|lC_&B=CVf2vMhqq}D2T9;k7*W66xm?Jos&n%$g{h!l-O{3 z!RrX;niRrl25d%+FLBP`TN@1`=#T^5p_Pj+64^|iI{0{llGc+FrLf2JfYQdib3@W= zvcFo?a3L75;+e)Y;bTd43O2WFj%_NJTvEe}hoz_%5snEE;=(As*`ovcaiDckr9h4L zHR?)XDU<>k(h+S#z&H~PWTX?Ev*#ti@4J|43PJ3MDg^TEMdtyu-@{>L0>i4&7fQkq2@3SCSo5NZOG3!lc;f*dMvVAC9dA4dPOw1FtYM`- z06!=2Sv?E6F$UoWP;BsLHt;VZ)xS-evIh7So$X2?P~WR1g5Zk47M{Gosc4Mpc?snZ zp?Ew(#LgsCXlfOUWMbq!*^>0V3gUuExLG3j2lfWSw22T7FiChO;W%RDW~iJnOmE#O zpSoFB?G~t=RVTf*uaIkxOp!55Ra>Dd3WctklSOKdWMX0Rry2gVz@OF{#SC3W5Dp_2S}p!;mVdU$KU+imaDuLlbcr(_0^ZZHNF>ut{%axs zwb~rYXUhaCV?ziy^+{Kuc8TFqEa3Qs&Ya^&;T~w+=EJDl;#*h7P-!i-`nD8kPy?mZ zCvQgpyKn>o>6fek*!V{P+X19eeA>*Ow&1T8_Nx_twaUUK6Ow?VL+l$uJ@Ih{if~x4 z-_syjtdt|aRESZiW?a`{`4wXpWG2vTKNh87R}jfHjK-a_ugw{dsgNT?5d92dQBKa# zf~&ZC;YcLDD$${x&FhUO4I_)(NUTV!u_Yag+GOps6d5`DFCJ2!&hL!Y4e7uB;)~Pu ze8q5F%!KTL*hqb#8faNKW5Sf=r4{;eb_s5z#g<)7Od7i(j7@#Pt}nSHtTZ>k_^E?p5)l!SPQs!(nCTcpHFOGm^%V>c^4!>3 zWH((mH`tV2iuO6c>IH0A#Hd4#6bchTP{(@55TdN7*`j7d^t4GCTR3V6+08m; z*(#s4ql&Y-NVXEp^$1YwD~P|&fUQ=7uR6p#+ng1y0j7p!0`y$iOy?S+I{y6|oVo2lFpMK`H`eK5}F6J2)V zZ3NiSL@-2C=KwpD9tE2(ZE1#lqOx^`8V8ppma;1^f!KWl5<@;$@GuP{8jFePzPS<` zXH!*OWkpmE4FJVB!Wt&+HB}V=4`M z_aQi|PwJMH)EMp7`_4Tb01E^RPNGUev*<-)V47PFVV_`);F3Q?MElG!FnwUUv;df- zIw6=<1r$z-tfH{ToLBE9ne}+>NX87yA}{JGPU|CrPC_tuU^6W?0`a)&1CaNd#<=?km|l_$Rm&1t2yW1`A!_`Ep2pM^952>Ak8Ml^HQ8j2Y+v*V^*{}Y zBs*eQx1}BG=7KRA$W*|sRP=cDsml(4H){Ylo z>}FIYL|LSfEBBRDpTelK2r+t^th=^~S|m{U(3Z3rU+~x%c~c}PK@b5Tb#HnMf&f`8 z_I;>Lk!VJy1kA<}0K?lTgeDbH0R_d1`SpzAAtWYNiL<_Bsh72nK@{NB;7BL57`GM? zr^KeEu**Q15`&y1MG4lLaKoT6Li2+h66r~luB=y@J&jw2u^YBunxW0G!;%MU$FK*B z-(X1Vjd4N4NK}qa*w$8zPHvXd(Y%YIDN+DNk>4ab!CN_ z0}{KLZ^~h;H17+wQy0;h$hY_IK0xbqxiW-F_exNDU3OrUZYIUa>WE}Kwv?XjHOi3APe&142N8np}xSA~bZV19=Dt(&E{ZtJ6*O_@?)rH+$gOlFAJ9#TA{$Y2?w4rEFI2hiLA zrK!;~HL&G|G%hhS~(x26|^O&rIdPHlGrT*J!>O$Z8gw0bW$|}k2<>Iwp=xSy zM+z|S2F2(|(K+jRY==L-JIzOUwm9Ux7yZ(9rz9=L%qy}&p`VL#!q62mq7LN&fv zM1kJMBEyxE7YB!nFz3o%`VHAH>}Tv+)cIiCSDe6pfk zOCXf>>KEL1tDdt4YmAD8{Ol+7+Wd>3T5jjAy| z6xO^;spdXNv$~x8aZe}p+|nh7Yh29|h_x(U$Z$X$?|_*1$vV%YW{@de&sw8rdF!4T zjh%It&r^DFP+DoT>I@?%fc2$KfgAYCvvX>ezu<%8=p)UX-0+eLk&l zNv#Ob?qYf1b{A{$2i>Qbz!O|{Wo~@?nYQ^rU#M7fX~hKSixeviy$k($%t?!np}-^* zDVcvHg{H!F!-63n^t4hNX&yBLVZVDCJav!*&XJC9H1{d|DJA|FkI^>MK8nTvTie{? ziT?%hALrtKRsQ3S{1xP(ze4Q=Vt=*!2mflXVR7{~xUT9@Q7u?8lE$fy08|R?H7>OV zJK);}xTDr`^(HIkbS8uX4om>C2@)0h< z)C5H841$s(R8vh=dEk?(8xhEu6r=(B1KANGzEm@-w^6D&Wahoxin`i~OgGvF4YS|` z)uZ<9yPep|W$J6{DLtuXgVfnoD98LLj7cra#St2Y4y}m6zx;*orTYbF!(-7~{Jsy?Ubw#XZlu3VwvAj~;otZ0W6W_Ez0y41+(W90Ok zL?+B80Sil4*EH(_n)=(N#I_(>9B=6A4MKUrVv~ZRn`~ruXgF%5DcC~ThJ3X1ZKTuT zZS03hw+nTWd|{6u?i_3e&_azMesvHu@-C%WD!vYGYGV2_s%+8kqk4x5mipx%r=kkN^CSWXnkcGnoH1Yv$Jf ztbFp$Kl#-dYd$kFrjH(OABE-rSai+WR(JgWmgc$m-?Q@B*1h%2b?W}A{Z%i*&umrI zL{-%lRaN_zEV;V6`pv0S$}~;OvZkh{uDa@~dGq!!TzFvV(rb@7=DOpLzvhG!-g4Y= z*DqiGme;=at;?6+aMDRPzV3Bzd;RO*{)RWa^VCz{v2x|RYHQye2;5X#dvhrCo>1u4 zaQK!rYu+D=y?5=}55!`(wYA;e*7l)|8$Y~x^G7>7KeBoA!R^~WcFs8;+p**Bo}Q2O z_kUt&=;P;}d(W<2_g-+pKU{d>r!Kwp(-&WS?`4;LW@P04v9bGg{ejCbf50$4pG^MK zo;{zRnE0|~eQ|2)%U53cl{dfnt5;wBmAAh2tp^SqxZ#Ey-ucdV-g@h;AN=44Kl;&+ z?%)5_g9i`ZefQn>-h1z-KmF+k9(dsMpa1+9zxc%mAAIoIYae>+TfcVWjbDG;+rIIx zcYX7wn;v=3dmer7d%yjG4}9kXANW5X{pk1ZxZ`_w-ud|5cmLZbKl#KbKl$W8{^Jks zzyF8#-~ZG<|MQQ&{N%ac%p+i4^?6Jpw@Pi-x_{Tr~ z=}*b4ryqIbmybO1?6!J`t04`d4IIF`EA|iFFzDGaCzjq zhg$~vKD_Xx+8b8<@o{C7`HN!%k3M(qIomfa+InvEHP3wPu7%Gi{g*AAchWU|E0lBR zcP)Qpi+00LZaVO>n%leP-|^Yg&(NxG{m}dcE62^7&RMal`aRL(?z-XJ!D|jY{iy@* zx$dz;_x9HR>gH!QZQB2x_b(cH>X}d6ed5CHx1WC2)1wDhoU!D?>ks_$e?|^2+2O6i^rDTSoP&4 z&;8(~i`FgpNz>^s-I3V%$Yt3B+it&YDDl3PffMFE`1g-|b>H9qP!;aqxV&ds|B3|z zOaE!{{BM7_bLooY>CbMy>X^rVeel|27e0M$Uv21)pKaZ%nt25S1>zhc$E z8U5Ft*4y#@uB-m?&rkjIsy|g9yuQ2l`TAui?pZpt@XhMu*RQy7$)T0~t4@9L*9Z6g zc~5;+jZ*u$TQ{Ya?d@N&NPa zc{tv?=$h+J>w9wH_m7$X=(@UhG#0rwyLk)aN1SX&t5-oc=>e;Pdsuwy*m7H&1%}4L?~~eeXY=)OzRg zl{L5Sdh8!hzWU4?KDp%kHPvs7FI~B%`t+fy4&(TtLmk!4OII#_<1gACe&n_%-f+P` zZhiMDHy`ZSea6$j>|Jou3vW5LYou;})o0fJ%YE7xRpsj^zhzV6h6SJbX4^le=Uazv ze$BSi&sZ|QukF@HPi|<UUwg*MZ*1>hR`vD9-~FZe!9V@6&a7JT+@Wp%aPyOg?);{@^|U)O|9alT zi}x=)?mhc&IOdNl7tH(Oxwr56-uf3`S9kXpzjfbRU)ntSpX+l^^B%N1J-x{I35!?bDks-G0+) z3#_l7I`QC-7gfzW`MWEIwtnP&^B=rq-nHhRw}Y#uM5{lt4VeRAKDk(%$kYa(FH|H9M9F5mfF zRr0^U|KQ3AvGTyCz=+F`+@%MRS~;vKJF zz3QRs7oPa&8B>{^zx!JKH@~abA7?)Mqhk;K`Ly{@-?1`x)j3Pgocwloz?iq9=Hpj} zFMH#>8!o$f>7K98OLyPA=KLFXf9Ag?*z)t+&}!k5OM`rkhT;P0ObK5^5j)#IleIPcjr*DltNKcjl$*zOwZ!l9eK z`RGk2o%`GQO;^mnzJFz6^UN={DgXYJ zeRsa+qd)#u)#-0K=bY%);F8|&FMm9+dC~g=cP&48lXAh-1t0zVc@OXY`OWWJbmu+G z);)VquzLH@=IYh?S22|w*9s9m)x}E-N)XU_`j=ax4d)pw=R9(pYA;Mo>TNY zKKqtmzYyAd$Bn_r`zx*%^Ng?LY2+=iTy~cXqz^KQH>|#QgK#m05QF zw%$!UhwJoDJ^SbIBWEnT{>(sDx#6~s9{tM4SA@@4R*)vPJ@@#Pd(D>`l`pn}$`u*U?zH!PO$G>@U<=?*e=lB2iNA+i}`q8(wpVsc^ z+x_`%?ayDi{Dt}E8=K#9&&MY}U-h{+eB#&t``Eebp8DqY&1%hCKK13L-)dfYZKiSf zz=q%c?conRRdZd{qTtid#=0*1@y#24TeUHBZNs>FOwTk|>dFjIFFOQ=HRk39*Zt~L)C#}9$R(kJ8!A4x~$>ZrPpdpS4KX#>_30|`1e2j z%{^`&4 z{qaxU`1=QLGyZq``9J)>#+k~=udjOg@dd$6uYJp9|Ml}tPru{Td7ZmYzO&`RUH|+2 zw|(SG-yHkdhZl@}xMM8W88|-n$?Ic>{&4GO>VAIK{J<9j*F8J$b8DadUGIN?`SZd5 zdNO|KbG7&F{Q1I7ckcYesarSPS@p!-lfV4YhyV7CKP|fA-lnR*{Nmy}Ci-tU_lwuH zB$t2t=bwDt*A_oZ>n3bZz64^BVg1eC1O^A6(Ws zb=SB0{_yN~R=x3KKX~iaRgdoax2p4&UBBV!&%JlcvMX-=x2nK8xxz+lV#liv1RZ2tZIH~+`@yvGLn&s}tPFmZyiG;s667v8t*@Bi^8^O1Q! z`dsSJDepM3YTnr&yYQX&&3m}Ds%qJ$dmas}*x!3`Rn@D*;HeJx)@wSsb{`%3elgvYJIr;H-eExH%%~!N1?%uhgKX%F2mgxOUGKoc< z%Cc~<>J3Xzdh4bom*2D`Gqfala<$RF==djJ zS?}a|&n1>U9?YKeXl%_*TSlT)p-s!KUY0)Qv8u1!vg}QVh6D3X>ZscK#)I>N2j`zR z_1^PueD5DmS@qiei{7lf;ik)$jvt(V>=X0O>)x?`Rn;3d#eVV3(rc8(b%&x0HZ9ED zwK)2ks(E)UyZr0csy**mRo8ODYi_$HblYc7dgCci&wG8nJ|(6ZwBd8a=1wg+B#^U`^XzNRg|_OVlrJ+N=jl9qQ(+*_ZD*f3j=$XaBk`d*jhK& z?sduIbIFOj&rt5$6}Y^9*p+win>t3_+J16y@ zd*?{isnwtT!cAAc@1yg7^|sf&uK(KT>jQTz-M#;&-=28(Prm=*#TRDI&)kxIY~j-C z+m~$m=*3$WFWle0{KB1|`Q_{9Z>k!}+){tXj_Y&!-h=bzKXqx>NxPR{Gfx}%$f|jZ zst+Cf#4StXk9_#|Q}OTKcv@qorL%3tyPsdU_m9gydCNQA@s|%Ro4;e(!QCf3w6r&K z_qor6uU8hl{jY(a|5g81T~$mOKH>g_H8*`oyZk+SzS#22uRiwd!)?d3%pY2^{NV$4 z)&H^ar4@S?PyWN$UtaT}TL;&CVP#eO+T{!0^VT2!^_>e>EweT)SoVDDo~0kUFWd3i zEepP|ZuxbaJ|3R8wEF2=R~%Rx{Mc=`|Mv9{KGb&KsV%!!RW0jpxnb8QPKYhtx_@DP z+xqzjmTFZC>o)a&`!CVG-;ADk+5AoYi`(@ZzjFJE>y|D0-f!<+@c7az`xjsE{DL!= zEoi)N{_5xFuX}#Mt~1{AWX~!ZJDwkFyFc-#zq}?pZ~N>1 zxN!0FJAQl4o3{VpGxIwZec+x?zvHHry_-H!_4a$$tsGx-|KhuDzwg>RUX$)$Sbfu{ zmwj+qR{6{s9ZR=GPdxR?`+Lq^SfecZx4ISY*tDqjn9nYLXzA|g*r|W{^YV8bTD;)i z&#qX$7)X=D`J}##FlnFy)bjr1DmcKNj|->{hCt- z?pvICY;oe-i_f`fVc>7~?Ko}4#=w$on}XE`@7(>^!okNDFZuU>zWmFdOaAzC>A!vM z|DC$5s{M$bab2Ih`airwi;P>TMF})EHSKEI($v&B)Tx}meP~CI5{pEYK`X1rt)`}~UcB}Wj9XTwt*L2p zaxya65;3x4O+y1sd!eBi)MQ^9O{^A4Sc$;Kn)UDu{?XLLM!d3JZ|PQ2+qh+0cTY}j zQ^vHcS{ILN2|d|fr&@Y4p|u-ILbDT*X4I^zsLC#FM9G=p?g^=i);G~sXp2cby<5p@ z$qfP1no4TsxTaYFWjw2mZV-W{#GlC;mumz*fS(Y5ByO4kjFz$?U}<};Civa7v8H-G zTsJFFy%B7sCN>1N7->sOTa81cZ~*O($S+n4hS{!w*MX^78+HzDZ9EfNS>HqlzJA0= zOl_>GS)b4+6g{y4+&L^&Pit9%qiW|d0WOh?Tkz2RY&dC*8G()K)e;6qis`8_MNJa$ zdPp@(&lq3g0A0vO*)U9tCAr zl8Oae08f^j8Q3_8|CUwYYeJiaV;c%9boeFH+PQKI`bj)Ps8l_d&(`a5| z=_7hlw@5SH;)8@r=DxIs;#oox78&%GY@J4-Ais@LYr{H%1+!I6YOp2^(=~$iO>C0c z1F5Byn$D?7Y$~vE2mXM{`KMc`Ku|!40|ssZHF{{fzyRb{$gC%mj7Gchmv^C**cd^; zs7{vu7W_Bov*Jo@h%L&%MzUCxLHeV_s*vc53`b*?`_-|6q##xW7C_jpmL+xj)oh&_ z*R%0<@+9k`hk}zz{%Bb(9oN{r4#4j^4ckh`b+zye%e7Yl|3-MWs3RK3Cfdao7?Z0F zwpEw~m>?FZ%Q5;dG)u0wGg&QD8lqhlC)BJC##98V^T^jamG(WM>87()l-?ZL#0`%V zzMX`yvKxo8szv59ZQ=0X?KEH;(Z&hiHnKp-DKJLmElnS;Ts9du5*oCW&`0&SKl*nL z^pxJDn%hfQoJyeEnoHZw8MHagRQUVp%m%Wwz{a|6It%H99@ohJJ*tjyrf9iYbHO!0 z^R(-l$=1MTeI%(HmKImd!sIVkB&2KX)`3R0&@Tl>_Eguasc6$JHz{OfdTn=Yi3p^0&HBv7K1SpUpL!*iQWZijSzHFHvL~l087-TF@R)=(lLJkLFJG_- zHBp92=xNSB3Duj5rVvi6XL3nWT!nCvgeUqf1+sM;CfMyODNV;G;0KgT@*c9ffgMB? z8%_?3sR0AeDhBuuI&0QsZE6r6l}j391SnX~8Au6gn%Gg^vw%E2h>jBnsRM;XC}3*o z2_re7+x$k&km)5YOi)-AEd|14q^4#k!DND9V?rf}9MjSQuXE6Ck{@w3LplLD2HP8f z$N)MF4crX$1VIl9ssu>=3NpHga-I=qdkjGy)?!d;Su%eDL;ws&9EiN+rPLBR%^Yr zP_3fgTBt9s){08iYHjgxwchsHJKr}m=gc{K&SnE@A9vIKFxj0mXXcx4zWL^R{6EI; zUWw31*bU@MIb@8{u}eeqg-#9a7rLd>Co#oK7bY zVwc@OT)(R97iqE>0YJeB zwkCo$ThSn+tRa(-Yd|PL_Jtf(K=7zg4-{_8_zNQ^$Y}HUTlJ$Z&5k?CKAj+{q59d3H!-3kA%DY^)dZO{a1SRE z-*W*Ow_G1yNYpN0q|;#*Rcb7z*os23V@X$JOd!Yr>yYxd!s$-9)IxHyVnn8#DTByU zY~D2!^rKmnXUjs-GF;Mt;x3&z0l(4LTK1DIBU5P>ZiUP&1t+bdY+_Oi){_qfbWa%0 zorEw6fW=Y{cY?z7DyAI5^ymcZ)lMr1)PW*Ic!20(ogpP|!vpl87+JuW22U%d6P)Sq z4$tw&1m%HD4^e0UKiW;VP^rz+3p5ld>1`T%#*u9khN8`M#bm!4r<*gNu*0XqP9~7q z!(P!6f)XS3MfD`Q6S)>?L2|QI?C41d zKGKoQBfuf)_bP6!3aatMf}s?hl7Bf|C6)U_Fy1E?(aoCH!0O`@!+MdH#kgRrO)BIgAcg`(&~nNL+*a?o|k zAwEpBs?sORq$)K6K=_K(t6`%_@hh!{sv5PibFhQ4HIBL?kuzPWJ=%$_xE$(`1G05S z8W~tS-N@V=!_Hor43Y>2S?g`gPIjEb9$W)iEo$`Wki#$%M)!6?AUF{@>GijCTI~~X zqy>~ts>o>xqMQfg#!;-|?ZxQa;mS?(g}E7|#C#5#zhq+)ScmRhGyCh7OlX&6&2(1d z3^vwxp;^$IIK52`(vksTJb+^gVZT-tL_JQsNo`ePgtO|D7}*n{U|92atn^6UNI)Nu zR3#H>)ec9t)S`wtWi_cL5!7T&4apwZqbfrADQQdSl39)L2YI)kph;c{g(hBHlUYO` zlKl-vzfnjE&fCvyH~|^wnqu%0-tmYYNIs*f;-=HwB%!@Tx1Y;xZ~h=E0Q1yDjPx{z z_uonmjCr!=Cl{qi2i~Tu$!(e(LoEq1Rk#Z$-9lCCs*wp2ZHU|?V5v~t*pRgi1TUFk zu$|~yp)xX+vR1G(=>vgprE2;$kl2%=uV6%pmbI&$qziIz&Z(>SHR2A2Qz>M>to}%J zIc;85-?*G{JXbcHSa-4`>pId_B8wP}6WOYhX;Rrly6IVu9>Uu??|={vwI|4Z9gs^p zR20DGn;SW^$PU!}rq<+M5+gS~zVIqlX*4L#OcoLJTJzmAV*CnAW~1h-gaLzW_oYD^ za(eZ)tF=U|J(!?dj)+sjL&?qrruw5=MPx3`{S~ztgZ;Q5AQv*ihI5GOrUVI9XTu#7 z7}qQcLVRkGplWx+1)d;xsrH!MRu)b8$CGy4x)6mMXsU zohhXvNvXaZM(tFM7`vT_bi=%*F#`!1YCJ(ELryDpS%-biy@ha#?@&Ua;+d^6X~Hb2 zQPn3E2GCr{PWA_*02Z9I`wdHj!F+VNxn%K12;bI{;VLl?nnXw^M79vxCW!D2z->sd z$BD+C1fGd0?$FQ^Q;u~(WmbkJl~thHGf{E_L$b{iR$`PV2^%OHIm>mPrn^Q{+TkKj zc82K@q?DP*siCH{O!6i3KfFMObDy3r+`c8ln!v=`0dZNu6ItQLF~*cynMpIWoQ>R1 z2MlBO)iEnjqjBD&vK@>d{!p^W_DE!CF$G2>=qCTTYpA# zrOi2ogNdt@cbk<2oDeWylZjIxN|5>>;5t*x4LBBiFt_?LW3c60^h;ap#N^OUP)C0> z$*GU1>12d49%zBJ{Z327f~Qg?CdNGc=*Ulw%cuh;qrHr$Q5oeWG#bE&?&##R1+FeG zkvf!Mdk1MTsiH($5e&pTPA!=>twiFH0Z}$mEi8vZvqskirb~t!*3(J4oP8$924ICS8l-iXDtSmI!d-*#E0af- z4UhLA?4^W;d=36}87;1H<{F^Hl6=6xZGuo1WIXd9GDji$pz&EH(ix<2i+<|~FV(iR zG=isrww0Z)uX?y1Es!qj3tewCi?KD2P#_}*E zp#6*u#X-4~$F|33u>L%Nz#I&FBw&Z6MGGiVHK?)hoj_t$5N-2ux!u|;Xl+8T;u=D0 zqu~T=OFzVRfWIO@T|S4riUBg?xRS;q(uQ;m(_cJamvMabzCw~aU|wu=Khd^bU0tkc zX&G~`q@J%H3_?g_jr%kd01W*!lz_BkwjG)DE+vi@t0v+AI!kC3#8o1{5G}YZ*mYiS zMC0S3f|tG~F1Y-;0fNaP`W}Nb&|_!Ii}4a-*nawwYL1UZq6Xto#Z17s3h9F9QyD9(zGU z!-Ac%R?0R`Lo0?>pa#>yH3Rh4hOs@2FIj`04t^~o^hU$j8%>(2glBQI;h7W2A7op@ zX9@BSs7FUX6C98b{TrrHBZ68q1IA1b9F2SX;_P}zc2f{gtjYJ`R^y=WrB85%r6DI$ z?i;51(p|&U-#+O%w6dDBxM8m-!*-Ipmz^?4A*+hfubO6dOPj*#%A{sF)G33PRK<8; z7W*HTY~M{+iSj5>4Y_|C<5?+>(K71l4^W7s^+S9n>(moyf?EHX5SDF1$ zii2Ve%*`UjSzs%iYN#!@lYb%*3kFXGA$LKAGeY(t3^y5DKpw9tTy1u|GX?@kc)g(8 zEbAv2sv+ph)F|L!#W|dFiL5~yY$7a`1BmLiEZ+hjonV17^o) zFp%!aX&D%V^~ffXatUMyAQ_L>w?1QcChgc(zqa>XBBx zO1~;1*+H3#K)|zQ@=D6dtLZ(HVir)2A&qH3vtH-nO>h56IA1v_F4jRF^hx9f!=wc> zSO{7;N?F^K6DpQz$d(-CjtNcDlgETiv*a6FK(|BK2+glqpu-ZF9im5$YxPNW_B{&J9O!h-c7>s{>z3P2*%Qxo7i4*N9A}&x;J0) zfFd}*RE(ciW2R8MG=wI+GD&PE*>+GeSl`$u%`p>(B$;i-nNXxuKPlpW3_JK?zM~iX z_sQkuR{W=_xlcAYk|p0iurLy;+YN(as#f0df&io&=!QeM!y{39xB2R5Jmx(su&S# z08{|5Hsq?KQpZ}EXiPAiZZUNw(GUr#!S3qhdD9c!$1YE(@fm(KN;K@YIQ4r1kJx|9uIASLpsv=HPfVy=%4J53#AbdcPrJ{PInVxkC zBsXxaT9+z_j|JQdYGo`2&Ns01Yf(j$Y4lnc+;c4c4UBs@!{90#agOf;Yc64b6*3(; z(Ib#St#k$31zo_H2I<-(5%H*s^8oiY%ZStzef*e-sK3yIP-K{Y>o=*eWYkNk(?x() zW8r?9$V}XP- zzz#TRJQxF|mJUTS?;e99jRxAC299MS#mS%)F#2PZrD)x5Ckjm>7>BE>&bm=Ru%nJo z$Y70hP@k7Bo1&QbuEmXMK+doTmK8|3l7K=2GnOGEn2O$J))D=ylyZAKMz(LLLyj@~ zGH-6Is-!Rjw;8$|*55X_d1PD0z zO;3m>ziap@t|8gq69^x7DuhR4CVJt)!^iKz6l(*7MP?M&a1j*CRF}#|bR|XxK>V20 zCa+?anpmn(1VLEku`*fKPT*2>H=<9<58eZtP!s`9&u+i^gMf*GsqV?l1I{oS zD}ppPAWJYp0y4`rjGr+Pf)I#&iC`RnLDU{WI>#ZZMkG?1FtFx^IW3F4O+IO?kL}7i z4NdjFs=De1#y|B9lCQbNOaAuFljbk*!C!R?eNFURkJL;)uJJZ`>s#u)%~G|GwDHa* z?V6;Py2b{NRL#fh6PgHJj;h3sjj|i?t;4d>IT~7+`4(>^RZQos$NPM z@+IlO^t!5sdA_EqI`7=Nvu&GK`^bQjz95oi!94PKi?3;3T|LaMVfN`hGBGkuq6F#9 z>gwk-B|lvTw5Y0Us#;Lr+%ndS%u-LrAbIE3ESTq&8k!~Vf|iCRA5ONR8DCUSKOnEF zYG^#GsjjBBh0L_ccvn?JeREy4uZfJNSt3mv$=_qWlt>GGb5yxL}b65*couy?_2rF`2RBgzfAsr#uJ$F1UjV2a^GLC z8L}A%V8#KMaR6o|w|b1=;ZlKJ2~TPX*pG@B5TDMuAw?50Rtu(2hlb=X3q?!Iqy<>X zh4rX=Z4jz}43s5?(IN@$a%oRUqITj-To7JoEhp_ko z42GiB!YECyTp`9Et_Rd{8tjobsP7KI;dL2!HSdXI#x6%w&^Mp`IBP*2h2CH!V zX{8I~8CHMbvxoCrLm#6BeBW7SijABEr0Cy8@e@~&S8VEAkrOHy2vShrKms>Rm{tU6 zkRl=mdoa?5Wf?>{z^JN&m}7Ab;aqX2I)F=YUr?qG!Ojr7ASB{$FG#cD<*TrGi4bLg zJlZCcBZ%gkTWVo}^k5xwFFhHuKS*UJ1M*d=4^DJ%L&%JbsXeC7OpDJ-!;oDH-uNgO z>;r09a(%6&F<8)q`CAEJP+1N>NLE5gmRPkG;SmAvKOU1K8qC6^r&CIpioPfk1^>ax zD4K1ZFgPu$5e1zb!5}(3hEH2KWz~dn%9#R^Xi$Lui1B_qA48XTPQ_ADc*oLo>y!GgL9=$Q91!KJ^H6mKLc9X03-EftjU*m zvUw?~obT|+VEFuaG8w8~8IsNsL7Syvqo&9v6{FE2JS&szQC;guggA>QL3*Q!fdVl( zn;DYU66zsvEs~t)LRe0k$&ntGOX>(A1@QtF7_Bzj8ydAVVnq~szBy9b0>5F1C!%c` z#kcg`;a5Ydp9Ssc`y-TSmtzJL!rTSk#f{#US`%g#FKr0J!9sYpu}y+tQJ_o)uYqD; zv&{);i=3$xh+a55=&_a1D2$TRlZI^K;ShF(P4MckpY9qz&}qJCa`6R(k{BjQ zY82y4@5{IpMa1$X$r-uyrD%;ncd(c(YW-TM@*=tQ#;k>G!bk^IiD*WDV?%R`Q|3AB zGCY(pzKE`4oc16T356bdTUSkqhvlwdBnqJcmIPq^oAd}wAHYhD6r(7)H~ytq1Skbj zybvJ=iWiYN0GXnjzHEu#=iQ(s9M@4+DOL?ud;s;1OV&74@>0{^H0CsR>z*;^w5LPl zWT+EspBCH`gV5|UYd>K@L*f`Mq^%vkfT9D1r3EygXkk^qWw1b0KrD;Juttg%c7Q!- z1@#fmN~=*6=4NXc<%eahepiZfi?tIKc;uh8GZ-oJvI zivb!FmnwW@h|1)lMUCx7!+|33ZU7t$o=-FKgLzHh-eP?T z#lMoUUL>EG5&<}kIwYBHk@7%68X0wf@nYVLUmz*SE7PuWNjf5;B3LRo-IHcQv8mD30xObVY3~kB|TM=&9XxgCn!x%q) z(fr8cY9lmk++?B_tSb<%uNhbS5EX(BK{BcAnHG8(w2%=+IHEaSZ75d=%DxaLZ=e~1 z9hSwbt2lAPi0zRU!9P{a&CHx_qBYn91=9lVd$m;|!T?lMq_-LaKs_*M$JjBTQruOf zGQ;_V#+q!@Wut~*B^aalt=vG^t2Z|ZFo-!(;4%ybMGw;)JVLjQy&C>q8#gY+NCYDi zC!CGt2v03$*LT*|`6V&TK%2>RQE3CfW#HE2~ne&>F)+Mu$#_?X++s3h0O0;? z2CBnB}?YXAW>b%frKb4uh3-B?~Mo6rEA&f>LUL&6q@BcWJ&cdG|Tzqa~~|)z(RS z_ar&7gd`#}7NN5)M#o_-Hp`8Db)ZS=o)k7ydQ&i%3-|<_i~_5OrzAthVs~r(#H1TW zi;ErtNLmB4E*Ps*Igps&k6DNH8=r!pmP}k3<4czmFgt;QupDSk>p(4lI%~jGYJ%>A zhr)>f)z@SqLfJ;4el1fB53MN=8C+65xQ;O4&SM;eMB6}wEdzAR(6jB>$n36WOJ+#d zL_B72rQviWDxSWv!zy8X8P2BwrtWkqt2|tT$12CV^Nj`R#MBUOe@}9GV&DuFPcM2O zfpjvN91O{4c%Owvey~jfV=5JyjZ~MA}0^tz(=N?@%ISo43alB@QTK+?vnNFZO7 zbmK%hH?CBYlD}lKYn(|!j3IpaX>slFCe3ZKL5LNif(hE0+OYb=nkL+r1TBo`XZIS5 zXW7T*I4lp8r3Ln28Ucd&qveZ8nM6q3%_#BQ^P z2!2|AsbRiaex*q#dW1Q!+`P9^l&HovhlnnHYw8gmswu#O88u9fQd-7t^LCG*_oc7d=RYg}9LMVDe`2{mi&ef`?MaXr}6}Q}+(hE(%LX z4VcT1;B}Ew6%SY)p51)DQe%PU82928<3;*@&59Zjsv$E(0gZk@x2!4Pg9jkkordOf z5UvAAHL$o7t|Wt^2Wya*?&VsxQ>hCwsxS>#_t;0pSfW(uC6GJWh1d^#QPLK*xlBM0 z263xEFr^O@FYy>2mAkMMhl!D)5tRcW@R`5YypzE9tI}|!gel^T@GDUbc(@p+iHRMY z*puAn0<>auP_uTBrbo>vQ*jzOP*BeMJIJw1h5Ttk*$M~8LL=Y5d{bCBKc#)#@;X$0 zA}Y0K$d+jf3aYNxO5hV^^`s-JzWV?VfZABl6C1%WC7~k680(A2h~+t~Hd8S?Ays{L zGbvBScPL#D-JLZwC4*$j+skb>NKgB`*(l2@gO(g3HZo>Vg4 zI51;8CWHz&7K+m*ud?y18ymVkq_)Cd7KrcRXCb{ez^P%u;lNYf>3l?4OD}E7XQHJa z!L`dTqWVT=*Hck$!J#LI^s`H1b|(m|ffsVcGhiRf0!jo%f*IC#u-V2{@s6YmGt?(x zJyYIql1v`35&so0IH&b$v|;;B?`#bJurHPy_?2Bb9J@=;dLv#syew3hS?ze_u&^J5 z3MYuk_#?{Stp#- zs>EqH`JfAf3ILYIjOfANFUjJCyd8)Y5L3 zO5o%p|HdFDHeyT(J{9(YZ031x$s?^%*vZT`#I*9h3Af%vgGl>BlMlw;@1@Va3JLLA zD_R5KUfV=26sZ1ggjzEg zp4njd1rgNEIFk}lNR8IS+EL8t3bchSjoy%mo^9>qviK(ZxAXL!bJEt zW|_eCG9awbm}A%-9B(v6pqj&bjA%RkRfG<$E8}RvO4+YtpKz7X1AyQjA#|QpI)hfq z;N}-z7X|>tXlOpwTDdSFOcjO#0SejZ+hFDE6ey=x zzndY^lrQmqW*)t2V{au_K#0!=Ga3i^r1BmR>)M&q#F(F^|5)bhzm^>pOw3xz%7{rg5*=}DLS)utRV27gdVAKz%#nFmlSTwnFLub|!!Nw_| z0l<9qyn+c1C3;QmBsVDDSP=kz>8(sV#t>m(p=J7DRN~q>bVMzYEcTcil=Q0Ss0}Ol zQt}%sx9jC-FM1_kQ=AjCp7R_#`jVuo=v>dX4sZs0jLp;LNj4a}hYzC^bg!$ymx2Bl zLYYH}Ltln=vUe0iZA?`a99AqMs32%L<`!Wg22{^BN^{Mjf;{=}T-7hfd1%Wat*|K% zMqDXwtWO#c57I>%>Od4wu?0CWt!1=XLNQs#aT)bSy%vC{tLK=-V@gSITWLI9(l5Kr zZhPpw2}*uU0Y%+$TD*zmCg-;Y)=fLq+0k5CHKur6Twd3{CG2Jyqa- z>qH=;n6ZO|nFUmoFD%T*oixr;bA56)9W{y%hiIiGmFuPm8%Sg+ZeQ34r&8von@6|lNm!PU-~g{gRD!gq)`)t7SWNdPxY zVTX>=SK8A#!5z(B)^sipqoLr8arN_@=cN-Wqc@x((V1{-!1r|+2Yz^&+^VS| zGE74G6r0%8PI5=(ct|vSN+jLAC=!fsLfU#xSYB#YZw)7z+$fgoa z;bml~@Pd@nVr?Why%|gAPziNjIEE$y0%M@Cgo{vs1wb}w}jgG!nDo- zE|s~bk#ma;ie>sT!XzR>QOE3#RJ-3cl-{zvS)_|@I}sjISg03Gk2PJ5F}}=%PjdJ> zox1n=RP7ZI)D_{lT2}R4;7ebCO1-(?9PJ7f|Sl){fj$j-4 zdx&b8F;*v%7~@WxD2>Sjgq_b>zz9xr3&A1e*r)F`!c5q?uIL0Z;(`x>@9lT0ro^dr zH>~zX22)eX-Kwe~MUM1B3ok~k1E*^=fE}`c1MG-2S(P!e6PhHSr){zruM}oc(dk5h zD|pz*5Du$ne&W`}R0It9p*S+;5OfyIZ)s%;<)%&eW+(6MRAQQFH)4_2ieP{{yme9& zaR~A3b&*&*!d>LwG}yJ8gZ$7dk%QJo%?ynFgs9(C!T82HVDh*gjLXy zO@NDhW4pNFuw_TcVNexOIAIp4iK;hC^VnK|iFLga#dI^4?StzO4J;{zfZ`q?RF=-W zLiz#JVq~GrEZNbBTeLe$bzB(BnQt1EeS%+-LSU8BkOOhOo^Pk~ggXyq#_4U8 z&c5svKGj3tG5lii&2ELd`Z*10Z34@ioQY*>D7ndRX{b<+2PTWpPZl1@Q)6&v`r)r% zd)W~51ak`rK8rw>9nVWUjC$ua054lv6OwKGpS~6t&{ReQJIGH%(VwOM2}}@5&`7!JV=sALIICz)Cp! z;B?(132@Z}eQThsl68j6Nu^b>0q5j!U3w= z>9e>s4kpGBku-!;>jmGxk8;Qcr`m}ztWEpE8jgUz?xe*n63qy@)o{#wXjO9E>FffO__HI>{-SKK3gla#Qr6UAtJ0|UgRaD!mPiGwzP z<-4q?M67r6vEdW)re6rdRF-ZO(GQRYmOBdn*bY^c4O;}(a_bXF!lErTl|m966L!vs zUS3CSX~{2(>V!Bnrm-sp;lwpbZTl7x#XO}+DC>Hu4eph9^pqHuQAJRPpr{CS8QU;` zriOw5uMog=&NSn4L@4PnKge1AF2nyg!_l}K1C$A_e6Shw#7j16J?KldmXzV46}qM& z8CjdU1}F#UylKo_@>ybI;u+U%3NJzH*RJe5LfGEPP;c&b@NyTDPkX~p=?yThBbQgdHn9@{zKB+LjFmwe8 zN4t5}eklzG22F@V2PBrN4B3E!C}TYZ`_;iZJo=>yg#-f#FuyK9EA7E+un-;HTkd4z zkhw6AT}d8@$4YTu(KzE#Xb&O)I)m*hTv9ZJMTP2KeQOaGA;1@)Jwy~jh{1$g1ArJY z9mBA@ldEP(>68!K8!l8NO3fD7>TBQ$=8QHijcMg%x=^fsXF%kefAK}IyL##=9zcHk zlngX?^_KsUR{XtlFUbZt9&})$6c3!z*n5S|N&(_1_zi>n?5jOZ43A7@Qndz567>T9 z(+gYDL!F`S>YAcT$%jGMBDw?zJ!C8l0cv`1G#m;XJdT;aDTCp`4P?QygZXM1?9YUx zFf^ILdvNp*CttJyQez62Ge^nswe4lcE1F-9rbS+Cn5NybSJE1!G#NFMV(xTjLRynS zc#U{lPzeRnn32#Lu21a%n?t%uFMGhtBC2&ChdViHzEsdVWtHJbGpG-}3^eL&>|yv_ ze>O!-HUmGR9WFIWY#}-d$9OSA!D0vp*Hg{lBeV#Fey&D{su>g$x9ICD^lFQ!Xm+Zp zn@`k-im3Gtcqp=;eB|dQc?j?gV!S8CSD_U#MDDI}!^tnFJAb|hfz|+^>C6y226X( zGu+6jbUwtzyh?gjr+F$0#wjOi@g_84GmTJnAB&|DGH2WYE~JdGOu=7x3{S#2i<`u+W=EMTVx=6fxg~ zSt%f1Du}H&`_wisK|jS(usloog~|1r_Dk7azilPEE0QZ|5|ZJLG(BZD>nD};w0*{6 z2T!h@oBWiGA=IV}uG4cCE17Mb+vI00X{e?@?b;hc!7x%Mw=yZzCViR7*HYW3bhoxq zT+gNz6X9Gwr|OYU%XvOxx}aFjE4ig^q|&3*Ls8q8nv_G6?w4w)mh>RgpZ4wbAQ1gm zyLMD+MX|7@-M5BzA}Sv#iK=@M497uoEBN028@%%~>xT6^Bgv8fX4lFTo@t80bZkp0 zWr}ulZi{w8Q=pz>+fK1ATvxr!#1bfW~MB06{>;$r(V#%+ELUpikwZa)J$P5UzpQ1_Kgo{$w2JbYw+%g-{d8@|EOn=>VBNF8G6j?-zgw88-_tXs*LkP)mB0@G*3<{djgbiK- z7X3d_LTm<$MxKONb9|}MH=TiF@l4G?7{riGu*8Qt$n3EmT?A_Qw1LlwrHhy<%3zF5 zH~}#>SONv)h*4uM*wO~7~RKltuGu5C zs9{2KLjN;m46$PMpx6Q`xDXyl^P@?hb7U=!zl7Dm;t-V7tiz$AU%fM=#91biF&m=* zc8ahm5o%Gv2W9lFW7IDhI1xoU_@bCgYJ^XizQZ&s9`uoBe3Z#~Xv$Y@SK3NJ3^8Ys(H>Zk4Pp`N(r~BF(}9#HoW7)oXoFlZH&M-8q#!J z%*Ms_q$EqQ0%go_Vp$XK0)UA)tI=mAyfhvo6%4UYr4AI#Ou!lEq(+%jg(VSJMWbO? zx7)+=m_>;`D7xJ2XamqV0sD;A z;zadPr-p|WDaIo4v}Pv6LlEURs>nuoHpgtC2)%p*Xdpu)I@_f`r}+zfO=m4`ZfUBk zud&;_saA&tOv;)m%~@q3SEsRHD~3smW&V^^)Q2iqb094mw>Sp@L6#86m6|~e!AZnj zL_E!GImZFyNyjbFh!Bk_`pK`?m{b#R`lU4v56UfEItsD86y|7*!sg@!co!%PO%Xoe zjp;97lW$%_i*K>Fy1L1hA)#7sOt*ZgQeC5j6Vl>Xv6BHekXx9f2j}+n-LOO5h37B3?#1-` zo(^df1du)lMrfK-C4Fa7g~xWdraOYpp!Cwt32jl}*aDN0B%(@;K}Lv*G)HGhu_N@n zGgj)NI_J{#=qVmBfi)F$go-nE3>DL>Ke0YXFVt2eWKk9nUNUv<7mz1N1d5^ffsR z&?2RT4Fc91au~~KPp__ThRg$7d5T(%(iLnCevQLzY-n;2s%B$@Otbcq>I?`>Le;N6 zY*9XhriPY=s)o7FR8wrUd+{QdQr8qW6l_785gR(a-shoe_H0hg4Rcx+d7Dyj0?f&* zuwmwWTYQBaGg%_gm`Zgvj^(D4-EAPZs#3cgS60X?ONHscnu2Lq=*VR`)+3o(gf^{gcgYkMsc!zEQP$H!;2*+wIqB@9(4|{1Cs{Y-GK zv6-6&Y#y}KWG7uIP?kmxwUcM@BinjF`f581GmG4y9Mr7D$5R(A=cop~3Xsqztxc7J+aflMN0YSSHk@cB z+HX8zgDuIm2Pc0}FB_N3Tqx*e)6z(%=mVdowdAIvQ->oqOf|@CM25A_lOQ|{LJRUQ zy`7lW9C3>u)+Rj6&Brt0G8q7p9(j$y|C2Jo|Cyg}?#Dj2j@dxh~Ajy=dUTi^JitrfG4afUR7)diCn8tTj0~-FbOy2Mt#QG~efE9lpMU?k=WbuJMDz@Ux3A{`o~0{p_;KF6-{@-mqcAl~-PQ-F4S}?|a|7 z!Vb zdV15QXRf(s_x0C5ck|89-+c3b-f_pTw`}?K)~$QDZTro=_r7@Vy)XUnhp#;N;HwWl zxbMe5e(mwc-}sOJcw^VDUBCS0FL&?W{i|R7YUj>3_w3p8$}6wD{`%{0yg|O&|I9P* zJoC(fXP-Ur+;hKw;e~hi?0N6S7yt0`%OC99_u(6F{OPsV{`l5gZyh*rVE_I`18Mi|NGzn(Jb`u z^W%YkU@y4xzH*HkII?y}&#tw3N1t@=?j2j6ysTi<>9^KCxb>Ic9X@I4Z+Aa<=QCGJ zRhN&fd+4rbuXQ*7;M`{)+V=d7MIY~#Dz&!< zm+XFj{^_-q{pZXtKl-gZ@5*^gYFv_&HT05(B58iMuke{FWy5bbb>EqPi!Xc2LnB8k z1FyR^yI*mKw(0buQ3J0jKjN+p^P4Z}-hW^BHS6~5++IKK-OX=RR<3#e#{Mn)-nx6+ zkeu3EMt*01TTjvG+}mb$zw?*Yo}4+i?7a82J$tXp${OHVvh#aiWdHVv`|gWhQ+d_S zn()~*muowJQad|xgLKo|dkQwX9?yOMm9Ng3+V8g$Mt-#=FzcBmvF@5%ZfXhKP+W3U z))Rlf{pT0{^-nHO|fh3rgY2i zDjP?-e8&xR6>TiZZ@jT+RMY6jb;s3vU-qs3{Kxy=SpDh1p7nM02gel*S)SLDbFsX4 zebL6;oyCo#M!fW1&xM~YALq)K#yoOeWw@ZLu_*Vx!hup#^&>^aZ~L+bbk>~khqpTu z@uxP#^Q9f@ny(oC)>Hoa{+FyfuHmJemj`9lYi2TRrf= z`mDu;>vD$7KeZ{a_JR?Ac>9`>r!HT2L;v~mnxf_Zxodr4UG%v<4f!9Bezp3N$vx+7 z`)c(p_nHCQ&;M*g_O@f6np3}g^k!G+tW#P(tlTuYwYK=8A+5Eeo_u=f-V=UXJaGGu zhECpESe$>|qCGzxcG0vA_vXHwKk!6)_)x$UUc$bad|4x0sp`Tnj*w;FCjq8C^{$q#om@GXx?9$4>hJFt`J^hD~?D)>j zN7sxTotxb-{kq-5PMRD&cEuA@Zo2FFCysDc^gF4mJMY2#gyh;b;oaAJTwjLo8aDrG z-$U!O_a8HQ*oiY53tUf*|M2sPPkj3ESj|=R{?3{oY<_9y)~Dq;$8CxJYT;7@*5n*< z&6*8^J}&N;_1OGdmj8O@7srm>_SmyKF8gYB+aG5p_9c$qv7#n4GWyhr=<3hkoxS0J z>(M*P)YVg;_}#NJE00`1dh{i4Hl1-o@!)yW<#pM`ee+Q8L=?~9MV^qw87-uvmeqyF0YX8)eq?b~Nx-|xFEj}DiQ zDf2E^|G|Cl9r^et*FNc4lM~1pF>KJ_wku{npY=!AwFQG;9sl<)KHL7l6Ry*S=WHCj z{nhZ|Prv*yulSnvoBns(uOpxJJ8?zli^sk4GxzL@_lvwg>6w1RFaLAmaQE6TCuVOw zx8kls_g`-L?vQ&b@4Ya$HUIgmI!of&KiNOHaKZbo$dISk6h?QQtvtNDsPV;3bFQmg z_f>1jTVHtIaUFeNP2R%4bPt}k=6f&rI&wDVy?Vk^Yxz``?&`l}@Ydn~UF-5xH!R5ca_z@I z9k!+C4-E@qE7#>*`pWI=D!1jX9DHZNTDNP^zAc@1fA^`Qc0BwG*ZVt*>+<$AmweoR zK&g7QeCy6v4h(;$wxIjkFSZAw;&3Vh8%!<@)o^s~KWe>b`?XN%hq9?0me_K)a z>Bmg_!`-f&?&7P@tQvK4?Bqwrj6N#otB!qt`z-H?QNE7Z56{gjIcd#I|1EbN(IV#! zy6M>QI|uHKWcO70dM3{O(o^X=seEA32S3{M#NHp?{N~B+{m-3Ncu%x@)oCZcSv#aV zCtP}0&P7_=Ksmm*@XVZ(mM*#TrJRCG)(>vIy{Ne7qkZldH;owBF}!=>foZ1<2p&0l zVCUev{P@`|o1WgiY3Te9vL~#{Uf)<8DBiX9iy!>-?i&a0{Ql8b<{ZD_rsBZ{%zrb?VNAfB*QCEpoo==rtGYJ7UP9rNcgQ1xNj6 z-55{K*$-WR%=vZGzO%Oe#@W-?jLFX3lza8yt%3g;HKyvylb=2RhEKPSxMz59%R`sG z_etsO^YT0+?|Z!Po^^{FPW<8TMt@nl=7_&#UHgYCtB?8PId^nsFT5&RaAr+?<$}dy zgZCZy%=66Xg7wo%V$z12ymNyW>@D()F37K(FlS_U*88t~zI9=F^@#^vS^s^+@F#yh zaLvHy*39evOLyK6KCIt1y}kQ{NxrNXg0%;aY06vlUq4xz^_NR3i@aG!{JQ1IvFF~@ zzqK-F!fNlJQ_H>UuK4LMJYxg(N6Blyy0W0;mHua+G`s1loa@`4KY!L^$4<&$``b@i z51hF!uc5ekzdZXlJAU_f-^%9}Jo4d(SDpO&fGOom`yJyNF|DZom}wJ>0tFA8cGURy zs>en5zV=b`oxdEu<;aUy6#w^<-P~lth z`sPzVaLtOYJ*h(;H20qF7lses;+lC}@fl~1oYPaZzIJ`*zT4}6=lhj(`@DyKI-_gH zF-QF7i{r9>wEw36x%0`qeZTsTs^^yv9QpF@kKTRt;IeTeR!=Odo%YO2x!u3rdEKy| zWmkQ5cKO@VfS%Q{(SvG!w`8&VoYlWRcEy-oA3glz`!5{tn$lA+dQW-I39jxzdq$mq z<+bBnOHMkFw^qq3F8f}=A3xap@@-EqpVB`1(~Fng{m$mUbp7P{li!>0_Da_|J&l9+ zeL4O9aijBR$2J^SB)wECwZ4DEM@PQ2@uP=tQvX(a=BxjsPLqZm@7lk&pS$vyOPBol z&C2~(jL529Hf-ypvlspC<;!pX>C^4MyRBdQZQk}ob;*$x_pYzl`KRk182jdTvP&K- zS$81oky8$QSpVOTKkEMTOa7gYjM=f^&78`u3+^5<=hUsP7q_i==e67Z`pZxIui8Gr z_4(W9Zs}~?F#oZ2lR|~hy?O7kzZmf1QCC0Q@XU(Z?|yaK*yleye$EXQ;|89;bM5$- zvQBDT{we>ETVGJO zXZ%R7{Kqk?UvIy7*XPHbd0D^jPd@p=Qwlb2%3aWtd+ir%M*3R^&Cj`ITVdm_oXP{S z?KP{9JhT3W+_QczXL)bTQx5i7Rz2xwgmk%H4%4H=XyzDHq>2u3+@= zP`^E{q1wv(-id79KjdsFtKjI<`c)>fc6a}LdG4US1Lo}M%=7jyys_Z<$x{a3Q?YmJ z=$1w6YPM#bw>437lTUWJe)rbIVTrXzw$2;8EAP~O1)(*QZ+xUap~wH4WGE`99PNXgU-kL(^_x4vL~y9-ZYcQs@6XVl$$IUP@Xp~^3~^X zEV!s3GH8$MXV(^-v2$@r)=;l&&WSzQ?w;(0E3ZFuet2%GFWZ#mLUb-o!-E!r^=zY(I);w03wezCKs%r;AS7Ra_n{xN66DKGEbC)`gBtggUp4mUb+1Z$9COUAaenwM32&Sk|+!z4nvi zj@mKxh7E<$P4WIi2HyJeZLd$6bMMr#*^Spc`d{vo<)++q=f*$3ZFc9WkKd59?E6KH za{n)aEdgKau}2p_KeTcF)>hYufe-y;(*-x&k^S!F#~$0bw*2^#EqTk zwgG2H&x~Fh+mn+w@Rr=lJI<{dkh5k+;n@owc<1=+N>^+2+HqUvtxp8Ida|UbFnMNpHP-=YglD51N$S zl3Vyx_g&*Y9{*L*@&PM;(Ej<+w_evgkqc~+naYmGiqOXAluvj=6mkHVpDN_<=w9DZl7A*G3CJlcipmM?Uth>jX481-Cyv%f|&Hc zXm4Ik`H&G8JUDlLPQKLtH)D&gsO&#x&_e@ub_@vb84!4G!0DTE zO8&ZI-f=~c+fByOKUuFZYBX|%Y^odshS`mzQWME#>fO&yTW*zB; z<%MDgb`UR+z?>$?ORJ8K(%L6zmtI!$+d^<*j_g{51!sTs5wN9!{q|1|)1m^b_2Hwl z#8W5o+k>;F+24l=+yZ|e8e&T={pC<_TG*)|)hI-o_qLMX03r($?hE-RhmOONVlC2z zV4-7~%|18;=oLuc@&S%=pGIK7ta#aPDHN)&5Bk}Uz1cY@JGh&G|6ngA6dzb&SQu_;9IYGoXRgB%I!3QdZ4C=AsC z3!tiPpoNjXp+^Lj;M-4ve)6GtyDmteIS#->-o6aq8Lb}aY(>|JQIy|>ygNN$Wv`Z zH-MqYQXtqyb6up6Om=w(dmmER9#=B71PyitO)T zpL+0_eCrEIa|qPre*g(t{pKKmR6r*{KSZ7}NJ>YP4`hIEjd!!xcF6$Yz-CFIRmg*N zbkRw_ixVc3mdv^> zrYJ_j3d}44IRMD@WFtxrJ3nOX{Cru%qN`KN%Jo->JDDrc(3UIF93H7E5yM4+<%2ns z0YNtvHr*IHHFRX?)p}P92uMxD{8+|I;he*tB>aP0o$Qq)Dw2gEE7-1-MU?miMo5ht zQV`o4Px(2}2H`$nSJP3NhpDUZ&`MY1c{P({#F~X{=4{$L!RVZcc`&a<0R)uQ+_$g%-Qj-!Qaz-Kjn)N$qTLs*w36*lWUdfAQ*gR9OtT0LkBY!e( zw`*J%CM4`cUWS}pX8iQ4SC z3W*YgzA!GEt`P=9m*%8XsV&$Ab%bLI5GMdK+juP+4Y1w?e>XeJ&=gTB^lzkSu~_v~ zOdztrqzR`dLcju3(qaL&0|G%<#nuEa5~~0KSz9ZJky&MsI4Yp<)klnk}2IH@4mWppt+n<)~c7nUma=sosrIPS(w1_i-Y!->(1z6M-i1 zFf0o>j`i-~)o>x9S!W>bV0b||uT!ui{FaI%2_FzGXQG)gs}(;m=Hy-&6DC+K@*~?- z(}|>k#e@3a(h72bgoB!f7ly+cr7*^dDd~>UkZ<(FhJ|aUaA?xp6blDWm@iyX8__=# zFCpeCi z7!o_!4gnHlWNB?LktLy(?3fS;B`p+E?sAlymisPHDCI5$N`Fw!hO0nn%YC#^ZbJX_ z-kX`7U9Ds%u?_v#`hX+t&V9Uj^N#QHyJTA`4&#BXT$1~gQWO=SgUD3bwg@mPbXT5oOO(ZCGK-uJj-FY*=ZHZL{Dc#GVV6dIUIwsN>dkh zsI(@T%3YXylqZMu4MxK*f$JmUlLTkvL`HDMg6UxgOeM61ExU@~D!*VBz9h!{X zncHFj@_~Y5p3*_NEK&o+mysJmUMSiT5*dEs!3XFLX9h8Ev#zYaTtcNLJ)#>uunUql z@e(e$Fk6Tz9SZ|gM@E*SjDKLKXB>G6M?0Z~k|kl69h1(Z2s@iQ^(Z*KQc(kuktKy# zMrns^1D2A%9T^kvT{Lu^tXFU*@bjJxmN%&5h0BJ)nJMU#L>N3pu2SH#cW$ExKGW=&e=ROK?qq zU#Bx31LAW7XeRboYf7~1DK<>?dMaavV@9_b>FNuR&w4y6fxxv|;R*#?p(P>X9h=&M zjA4e&L@X>Kx$*n0eJJzmQ-~qame4c05J7gBWXH|RFg3A#*-j9*aiSQkY1G-MHJLfu ziW!YK>?GV$z#oc((1d}hiH9-&A_39>2uJMRvY6dr*rj>CD74*3Xp6&Ugx%24mmeB2 zFB~^w39Tg)g9|;BqD%+B*CUSrt;LHiTlm?_PZ_h0aC-`%NsLY-%{CJofnYnp9?Mq1 zTWub_hVcvJF3O1O$zW%qhn2t%qxtm>bxUv$vX5S#zSHAHI^1#AGua2@Bs2X&TwjBv;Kn%H6BJNVQk`@B!2ndt9 z5=3laL!l2Uzl*XLtZ^ucM9H8W=di@<1h!A%g{kS#V#x?pu!}qK0p*$xN{wf_8STX8 zz)W_qGYq-@js%?5L_91`f+vR<@GWc|+SXvN5e3SOQZ$g=X`LV}rKM^~(`c2Lc2{1< zF(UMRc#J4IKOuo=q6Dd;ZcrkBbH87L6VY&#**eGHH%AH7S=TE-@LC2 z@s8MZi$PCqqMPC{$HZKH?C)g`b@EU-rw}R@Kpu{a4wPa;N>*w93lR zi2c`ad`9fQM(n?aC&n2)?29B{EXRz(x0X9)Na6V!;_P zJ?LWKB9{vZR``+;^7*{ck31Kc2Px8r~=z(A%133annMSlX+bV&JlKqn-UGEf2Qak2X$N?002~&+5Un*HH#io zxtLp`6=ruooU`*%vp^NI^+{SaO37OzN;XUq%cT=goHa0D;)exU^|C=sbJ?+31)3|i z1|g(NINcS{q6uK90l+tsN$Fe$C`hJ59|g)H5CZERAgF^15Q&~2o+wr`;RJ+z!4sjm zUnZT*kkpWs&FviZD62C8MuFXIgP^oq*y}O2$^fysv^7$eg{^r|Thv5hseO5+1hAo2 z-vQf8i|b^Mg2tYt0g}0Rb&3rpODjqM8$81{iBJ?O@Y;benT+6FD8o`o=5%f9D$426d6=T25m6VM$SgCdSeb5-mKjGd)wZ z3gsa>>3L`gyKj?lM_NxQg9c^6R>>+W9qv@NjMA?Zhy4cfXO&UvC?schXtA5>O1CXh z!@f6QGbsaVX&TfWm3Lha&YF(upb#FwlBR^Tq6fZ|=V2}<)yTPGH6QC38Go}afUA#Y zNFbN5TD6KN^#|QZlw(<7k}ad4HtN~$;7YR-NairEwKzqzueG?v0Wl74b0Uk>e7K%twhP=+no|s_MZDtLOxyWIq*@XZK7g2x#&sqy zi`uCa6^>hEintK_rl1U5RmI2;V=6^i)YZIYk&U_7?Y6Qov*t6>DhUKp4mCR*!6+AM z7IsVN1-2$zR1 zV`k7y09QX4>0%Q9fcQD*N7K_kPdTI-Y*K)SV+aI)j?!PyS zSTd8Fy{0f=xe!H0{>VVojVR_Lh%kCKdZ<1a zGID6L18D$L3&~)=25?vO$G_nr$Ng-q`GPT!8<=z5ap%@`1bx|@i!d)aYNQ6zAvL|` zgKJ{HlobpV?c@>^DGBr)p%@W~R3A50vr{H0UZG9dGA-DYRuKbbh5pxVgX|(~v=1tu z!R>>lmxiWmSx62XT<7f#Oi0n>SqK8YS=A+q*W9*`H}bQ!La+0r8>=i956LiU~8bl z0)cC9djg~o5w`ogIXV*xb5h`R=SgN#NtEM*X;8Zf4szfP6^FRSW*SA1pr0eJvs9vw zF>)Q-TWzJTCsFMRqnHBe0HGhn@G4LK*wn3dJ(lPVN>?sO zWG0Q2A$)$tAdqC3%_k_nAtNpkE}Y|iLYMD&pT?)(6HbdM$018((%@MROf3ks%#|!J ziK7uIh1+d%8WTdmQeWb)a!Gb}Nj@U4Vs#9xj$L!5@$`0o6 zp=SN@u(R0c5x`4)=Av>VOEWl91hNe;21A<&<1!N@Koun*2Esb*3(M;I5L>(m1{*RUuUn*hRNblxXeGN{vo%ZwFc1H}rPW+GysJ&|qr zNkd1@n%-uf!|M+az8j-FT*@n6$#tjDkbtr}#A^(vO*Npn8pZ@f&mOky0@%&~V0#!H z@UM>D!YylpiH!6w4rmzG97jC>{U}Xm3nN_wm8*WeZDBD2e+kj{et0ZYn zuGk@62r8lrdr+`515K=ldIkFgqZhOJXT%>OD3fyB(OYHfEUeR-8|Swyt7)p!>YKGC zO^pZE&#RlKd25>4Z*M?bR^PI)acPUjQZ&^xv>dE8&ev)h4%YUsZsjj(M zYi!c$7cW^jf>{hH8p$Y z*0Gk=%w1GRRk2RhE~=?t9MI;~EUsBlhq)SADNUG+w{F?OI()?Ht7-7m)V9<&Ho%zF zHa4_0v7Z6f%cd5YbyA9_^-qB8Ik{w$p1(De@8R{|D~D$z7B=#zh7Uw5e2}A0$@Y| zFrok$Q2_jZ=>j~%Y_4kg>^yM!C#D|JA?s02btHr0ToS%S`foVSU0dSc;tX9n@Z z^M;cMYI8x`kj$iPh-Uqhc67JcEQ+rA7A^6UHxUI@Aki&#I_Rm>xbuubX;_HZFnoEdvg8G3QUKm4BKo2R>1GiW-q%e=%&A?Pvw2^EeSs^`8Ex5#Z zy2GiJnWP3xwdR8xM?gCW-0ad3KLJu>OZ4t`aK6L<4}h#lo&S2kD!U;h z5@bmn7p}|Qp7yY5L>qg0Vns2b+utnU?vn+S;JDtP2JPVoO*pKnOh= zS!lS7Ns%iU31RI8lm%gWWI60iWF1O77Bj5#%0JUj=_y00Sz!Z-H=ZE(Y#5UAAV)`lxzziB1R1qp#9kHTx6IV6h7KS|% zpIEu`KzA^+q!hBXF!H!+MK}c5NUT#v3KdbN3Y|PavXGM&NOei&?3z@h%Sh`uD~uLa z+G$}}d5cOQ0|pMoW2J0ilo&Z0N|YFnY!ECV?C^hA+?W=})S0#+&TzWO$e={h zM~8_tl14bafUoty#XBnmkig=ky~7VXd*C9I`@n&3259iCUF6}Q_IM4T4IYz|WA+9Ur;sTeNlY2q2rz3w@RaOgZSsl0M{1Z2p=xJ` z2HRx`1P=G}LyQ-Oc;{iI3HQ#Ac!%4=k(GkyOr(rX1K0@JZ2@tgi1AHX z2YO|`Ch{#GWZ7U3$ql5QA^h%}VOt1-t)=^tz|!F<-fO}5Q;%eAwy}k&%+*ma1W2T! z;E-JMuK=7^Nb;Ob@+iUS7>m@y9rNf8 zB7w{igF438$N;unTYO+`Ne76idK0OY7FB6XwHs;ISYvj19$gw$nV$2~NYu~FY20MQ zRUq@yqf=xtQ<^kl<)v&ElWZ-7rUaAG4!4jiN~o0pA)BM~BAY$SxluG(k9vb16nzam z*by435)BV?veD5?r>S7W2%fA2TLNRgquwnX$41yDxXl>*f3wzYp)>7H`POx zXcFFCSnc6e7tt+X`LmH11H?h!H8fpNu+<$FY*w=o&q9Q*GzqvO*C^R3B3Om;V%%bx zZ~@6e&Y$E886g;$T#UX2CDoxx?uy(*CE`3|hkyk0$(I}v&P0Dm3Uu7^JdWTm&ezWH zFFv?xBHn#Y;V$qd7_rX1hOGC_D)4;ETR0tJ`HHuta8>~0tZZ9gc`+B4OvusX@H}~f zXCP~Z$bQX$K9gg@#iS|cF=j-(02BBFw8I<7>@lL#9bSb|WwWC8$Tv!VvqPb{7KnR} z;C-^o6fc!x`yCiCFvg1tn@hkpf$#Gz`Fh@Ag0+p5%SKwsCRbiCtn251mb~3p-nruK zj`IT_ylhkwXUPtT62}0xpj680CQ1Z}v$X>ez%b%(3v9p%w?cpf$Q7X!O5jXri3kAu zh*O1UvkA*o4{;#saSVQBL^8234`Y&0rZd8))86b1bd%yETUTy$L1za>vqN$vC@5h2fHh!aIRK_OYiQN*~3EPh>FzC6yGj~IT1Yc|q| z+o^YFC~O!C3V?rBSPXu$dQdW#0C^7u>R74Et8Eg5u7ong$AxiG?h8`$S>ODgLY^p^ zVAp-0mv_hO_vrDcA4*T@*4c~!Y{ZmHi4{VrggMt`T}u_10#k77{(xi?qKW*C=K@c! z9X7%1$p@q0ElqbPOT9Te?gAI$_vF}IS*h`@eMsQe)R0K?OA``)75qyZ0A271=qmxT z1-zm=@(A77Xq~m|kuYJss^Cg;N|ci!*M%O=-RwKkKtki;1tBX^j$o&_8icCxdkCJ0 zi;nsji))2Mie}`6Gz%0Z7psi>3)_yVWV;n%n42Ih4A6Mi{$2(Ijg&TA%+nq26WF=( zW(jOEhToyrtOEfLu3o$Zp$`mDQjKjI)*nz{TQl#YerF?H;R^BKK5A#T@_3x1yHMM@^n?QUqKYaWyiL)Vhy~BU`{SD(zS7D1mgAd}g=-C2U)?P?x%3zP!*96m~S;D?MR0CQt|wOm8aO>qV6(q(HSb z7lE_#AWWOimpduH?e{s4xX*ziCMB_g6{_jf&#K+vvUx5?;CSFF>jIeManpXY^|UB> zm0{jtXtuZtE2{E;?Nn9dKL(tQYF-BAxJv(L;46CgAa7(S%xd(x$g{T7+fY1RXa(6{uH~ z=#lmqK31Iwb!wz-r|x`9XBfz85}lV(!(=!4KEXUfnXEV7g*sa{+Ok9{79H;uVlE3R zTgv$@t&p|w2E-y;1L~6uA?vnp`En0}CbQRockEFSl-d0Vexf}%{8k!?Aj$HD$A+1V zzrZS6DTA)BjzY#`HtQ7?BXd%rykV`a4qjcA)gq{>#hsGlno!=Vh|}H*n(5`1X8Go<47Sb3K zj=tLBOgx(4B{@_8yH;q?36~m`mo8Q2DAz_{iXHSN?m|iwAq<@#s8m#D5U5HcMliWDK>*(4C!u>sNP_O*@JjQ%05O0P~Jp%u0%F~BkM5qSk&X|F~TTL z^~0W)dUP-g7FTr82O@LMb}=SjP}ky@hy>wGIsqgD4eLBn9lFbvfL7bU>PJfsH^Gu@t*Lq$grosBjkP2_xu|#4eGAyb=rAC&S0?B}Ur_tyTEijF^aM?!EUxNZo z(gcD9rpRnJ!i3R8|8t9Z@Yu#7pzzZQD!#pM3SG9WFztM{Civ`RHk%FN+CD5>9AzmF z;kS}%E-Wp0@#wWgKGqqV6*)l#^ACEKa!hW!jVP{ovY|9(@MxMoDuTV{%%g2BtNm>@ z;t|ml9GxskcWy~4^kKFr1E#p}d&26b##M*ory%C@P!6QK5*<;R(n2@)Xc#qfF>8e@ zGoMe#W`(tw1LkT-v%1&;K}2Yd66PX@nqi4Fs*oU#WL!imwy$iic_ zfpjfA!igBmjtU&06v8IVgYXeXI%C^`Vq_rr3|iR2*@u@xwzKJH zGHj$^gUKz!m?0ru5JqdZSTNH59Z$n9L+7z^kcFqE%~b#%^kEIhfO=Y6o%XM0S!bF$ z;A}`%A|WJdTn{5mKIEkUED{(U6)di#zXQ;UWL@ZBY5zB}t8@CjlJd1K3o8;2H|KH+ zUpWJrv$%oXQf(}x2s~tGZRiQV&;SBXtWUA2S8jG;T;F&ZvQBO>K!!k?WqVlIg)j}IoNLSdUB{^_q zJY224Fk~4VFRve^`UbWXV{saA7@Iz5rysznU^zSU#th6G3__-05TBLuhooL}<|vib zsS^Z*O*x;jC#(r_$qNJG{tr|tp4hA+Eq|A^BH|3Kp75oI>8%w(P{35co*j0Hnz+&LmhwJq@(>axhPXr_E)R?9Q6w%TXNYII+u_hQ(y}D<5Jb07Fy2jz(kxFdr;#Nr zR({#U(-u6!^i>g^V(wYj1l|nUVqDGCVdSP!ndFIpGKO0+aYIxslLP{729&bwT(1bx zBX6l)ppz3S2NWM!N2}Xi6RM%eey-OfA;rLz3?obt0lBk`bOg1b?r)JPeORP%L*``Rt}5p=zm*ypeZYeoBWepbU9-nk<(sFlHe$>>uJn<{?7ip|An z4DMkxu#aOnz*VrLai8!~NV97Q{YhHLylAyVT}7ErTnM1!PHYH4r7g0M?gGS2OXrG) zA(%^)1kK6kh;kdD)9n&Kos}p0G7XJd^t#HkfT3<21&?NP8ycI&U@o*Hhi#WJuqSv*S4jzHo&iQnYzNUHW*B)8joDL4T9 zCe)c=7aV>TNDjlpPEqo6g%KNwy_W&TR#tpmfD02k`KG$XjV*O;HS^{*d3kE98ExGl z)PpU;t;9kz%7dY)(}QKf@-nm$OQ$k=!0~2Ut~V8G9$`i%Hy$i}&1d>Og<0l{0!zkv z#n-&qoldf+B_*2Wxyq+RSekX4aQk1q##2blADva~Ff=;>=9rE(R;?e4X+fhxHamo? zj0HB;&97^!YXa3@-a-^JN81ns!{5dW@j^W=Ww_^Tu4_85uBok|W^o<6I2q@;BreAZ(&7PuRUH#;ZG`R5r_gckCJEw-+>PuOZ>dCFzk+RY8TiZb#A-SLT zPy1Z6S?kw&YuUG;Icp)&7g~hDPBztS%cwtS6|ac1*+vOWdkSP0?6)5tr|~huGSgqR zA=qi^5^gpWYr>E&HQh%OWLXr{k)3DZRMY}PBDJn$Fu+C-3c^tr^D}^PH}edH)oAQz zR|xu9WAhebyedfvLwpSE*;*_gMf6)VOdeU9PEN+?LI&%cph0mMk+)d;0}4=>F6b<0 z#ssE?a9;&g8w}npAr1;5&Z8F z{O=L`@BdQ#?~zEL|Fb~goCGPj-~FP$kAQ!VfPZfV`1c6<_cs^)+pfTrI~xj@yIZI% z`Gai4lc)o`0Zm3EdXo?>Qjk!@!_*QTmTkMx0?1|MRV)w`bTeqObSs6<+l;-rT*j78 z^8ufVLGs{>Kfkp%$t%gQTd=N>jf|{$iBiEuLK3c629*a(DS>iWg_t!ss~uu3!Xtz* z52rda78Ei!L=nnGs*8IWnW`@=yqT%kg7f~kCw8g3iCc4muH1sUv71iVmq4Bo7DG$_ z251NdIJ9V-%?JeL6&P?rT*qBMVf`CI5JFDh%&QO&muYNcw{w-Xhz#W5bHBUc8 z63xfX$NenUwEf}S4M(L@K9r?cpMgFOO-iU~&e&VRHH6f$CK$vGkqBqC~54_srz3>FBNiGGkv>qp(=8F-lTs z0ct!JMK&;`ent~Aw2Y*k3JbVe<11C-2?!YAf!W!0AzsXBPNbzGcJK~C?B@K zD<+k*J3-|gLFDwejJOR}7G5UjMLA+-7C$QEV)J(jaE1F3$Q2Oeo|q7>cytOMdA5ixo#q1sl76;Gt$?$P%c$Nshl-TnzBQ;m zC|Ov_WY3i4uZUU#rQEzUpnD~2HI$sUhdd2iWu(VkPNbl9;2ni-U=fOIA4W7m85)|# z@Y&->Ggc&A9iTw6JwlT*+r~nADbEX+?Z{oi)FXu#Xt|Fe0WxhSZwdwKcewi-WwK7n zHNL29<92ofC9bqM_*h|92T2tEw{ENfQIA+JAZ_r;2!O4V@QC5-jg=~9095Go)JOzT zc`Fg`K*>k@6)gyR4ORfUFVhrqw>`wq(f|;dtclQ&Uj{MY#?AvJKz4&~yv62ldA58E z+$oLlMz+#P(S!&p&4Iq)ToPAJO$6IkU=O#F+K~NTESZm|;7K%}up{ngwbWUr{VF&! zccFIJW5tp|{z3(NY0uCEy1NG}uHcGmB1EkKYpg9}N7DeA1+zJIYCmd^#&6V6e5|xjU=F_21$# zt!Px5MG?@3*Rd|FmF>Qo9Z0d@-!HHH9Dra8_mrupNs!*1=x@kvNi|=4A`#QW@qWg= z1zQ6Cm_Qmkxa))>%13m0Mj}}{0zK7m>BeG&bRc+so2Rqo=$ru)CbVs_%&0B5Y4W>} zp$w=|;QtOCP+v;u8&d{ZN#+K6Rfc*V$8td4TuK>I@vp!KLa2Ohx=%%r(1r)$70J;eiMIk+`)(F=2z8RGpU$GDlS9EY;($j`+n zsrn(VHm@+@Ae15GSSlr`HKN%va9*iIx8vO5HStTHOB!)+Jf^&8b zPKp@2XVLvIM+fm5BW7H~unpw0D7J{nede}uF-eY$`m>~_Wno)OQ%ytjqMDYvd2-hc zV1xi$xBn4hsrnxw3sLqPGW|UR>Riu&I>!NM2c?rexqI2OCEXm@GVj^UbuN0GZ@t^^ zZeo!S^1`lfnBO>{CGDsq_kh?EYCiUD0PITclS{Z13+bL~&-j&uj$mQGFXa9yh3Vk2 zG9_LB6etf75%nd-gBcBUyg}g@9;rOe4ej14^iuy;E-IX;!6}*IKV$|`bhEAaK!O_FqT?Qf1$ z2ae63BH=JQI5VVPn5<>XTgZdxZi(2}GW$_(DecnqM{y6=RIx2jC_<8o7z0tMUO=Y| zdnC5aqzW!kd~!`#cEp4MOqsadD^fsT*4+5{0u*s4B(j2Z2gmYkM}`$aa|;)0c3`AD z9nX#xFa-TpB-De`ao0{e1EA&UwJoXU(^sX*>2lEet_b3J!~#OgCN4=&p?j+YAr+;t z2X=Ltz%R8&%K(%O2j?A4P?sEBw|MM8j#u?9BHBBY=gW>qfQ|Rtqqps&s7c&ZBTlip ztA9(Rb11yQus?M~ILu_bNl?fuq3!cZk`IgunrM6^{gRnlLKq-jlxe=$$ z>Xs-#%f!=(45%;$qK0s%TJA9b^G~BK_17?wTso`j+qP;lY4&Urx>b`&G*+F^flQ`d ziKw*9#jr&xkX-baVRyOcfL23R0K+`YmXeV1_w4ULnJtK{*q!MX?7bBXQS%90CchQf zh=8etTGe8@=ynX=vWW}=Q}T@olOk%sDE1nLanz_Dm?W?ka!OFtNRVzZAj5PtsLUP# zaRCA?7N&P}03U30aJHAuUMn=EsvfgP7A8wUh}x{2383_XI1vWK)ivFWFb2pxD-ka9 zPbLl1X3b=dv8G|po?g7V0`{AnW;Z6<8do-^10PaBf^!b*W)G5p;}Rmwyew z)U(ExP)0$z8KWs6x)2zQYYRz!LW=;2D&ZDGSzPGlG>n3A=)hIoYvVNWQ@Gr>^g+ex|^2`2|Ml9+IS5)Zdg3=dG%rFMjaFXZb00f?YVcmTan zQfof2CktRP12fdFiMoh!Y*xrJY5|llkkh1Hf+DrVGP#+WivcVl8*&InDlHsi3oP14 zSYXuL00}pULS&nh2xLPPyULRV!!59e@oGboh;c2uu)K9mT`q;Ljkrb~&~fZ4gb{>f zK>%DLf!&@Y|F+v6CW_u5J@+aZtwsrn@>3SAlV6r+kt1fcR?S7i&yq(H^5T~BJJiG4hqBz zoZbK|iR*+#L72M=xR^I73Isne5(XF|7-rfGYFT5#Hz{%G7DH(Th1R$nbyhk(J8r~g zm9l?1LK!8`f($eSWrB#WJP3?vK(1@GB2&mcOnf^G)ldbsrm#UFD|nA^?C4@6`hs2K+@|Fc=)LVhzZ&LgYC#oq#O1Y@@+jo2;S@cc@v( zRwrXdxtVB)w=|f#gvJ0C$=k+3e+W?r!dNiCa6% z^O82Uydz~xcC$mWhq*bJEtg#?niUD!HIGB6=zQXq%S9ZO^(c2fhXlmsp<7;uL!s@b zTY4gY@YnsV*!h+KF*}uwvA6N<{4nvm=91bv3wzQf6+f@UVU({#(dpd1Rh`AusGZp< zr949#y~dKRmD;#i8XE8+8#A+Pd{mGjp)hQ z3Wv7e#bzNZhs}K0VIrJknPzF0vp|w_=MjodCxowSj+oI-gCxG@NN1Dk*?;HG!R1B{ zL6}QgY09gb>*g97>+FQub-=#m${@V!t+kY4Sn>&h^R|SO2w*W@4;6||EwgL-o1Paa-jgjErBzG{p7;qq0ZYGaI zY=&xsY(3X}&`1Ia$}%>FTr|0WYAxSLPdXv|QaP|(cXuWZv1z!ffNvzSk2f)=61~O@QpLPvu-6K=n`w-) zOD-AEM+~k4@pm}NfClnfBSvnPJS(qLs6)AbL|i$1$Kw+7VyNBll)Idn=yPUG z6&}hq&eb;1HA}%8`QRmW&e7CLgar^EHA!|vVHAEO!;-|)oOTDKRXA6rlQCf$q3!}? z2t?#hmIAL6kwmP-OzIJ%gRv#{B5m<)**fMzU)^%Jvoq;=`dZuA&{EgX(zd9sVL{76 zmkz^F#`Jin^r4l7NjMhtF3KH9bu(L%W8lH36x3P<#tk$gU9u<&Pn}K+h#d)w0H)%R zE@&7cydw30xmdEa#eLjGj}RPHtZ%UQ8E_{S)U?zst2wx>p7o_^eod`gPg?Mx>oH6^ z*kozK`BqH2j5i}fdZN!1t~>N`1~yJ+rYKugP(Z0De88=CdMP_wtFL0L2KrIULTtmF zW9q?hgNHj!q#)w2u#Z(J34AD!rZn6zQa0CZvIbO*U#K}Y{EM`06s3_HY&BLyQ0ax5 zO+*G_?UzGf4JlfWsmUc?r8H{d{pGVlRzFIxqp&OsZaMA3UKlBWEs8ZxJGU;~tVzql zOmI#eZ<>e~YK^&yuEk+_V9ew=1jMpK`)IOa0h5+^l1a-qzTRULCNsuIb>m=9Z@Vh6Opgq)v&Q63`-{)_Ui7Rn$T1jAU7&d^@SI7Y<@T zI&?MsDmc9IH2}wwvJNmXFS~(;%`Qx6gVB&B^1K!zARJL5GBJft&Z-nFojSv*DAO2Sl!c5T!MnqN-v+D>tPrdH-UW3n5Xx|2UCliB z7g!ngubz$!ys6nZ5^6hZ>~JZL#biU3;&Kc&yvTocV2I^dM~NV=9I16PMo|gGn)eth zHYG_2$l~TTu={h&BAUPw9;g}Mkv7`n7M2gQ`}BApU>p& zZ*H95vaF^l*Idi?bGF3Ud`nEHfqD5z?qljJYVH7yz58AG>4bBc7sSZ&op-k@T8AHc$?y{-SSmK2Pz#K9bAs}Iqld*6_bqG)| z;L;v9$rh?1Ts<(>u7w9|@xx-L@|HkXf?7>nm|T}ghp4VFNDKwmyVZ6YaR_jYK`~_b z0?OZ(oj<7ZmVi2}uOe$o;DQ92CI?o9qnLXda)%kkJ5gNFKx9+HsBj`>9BG9?2)KLK z25bP7;x%1Txnzi)Byk-o34<$1+TPemS0Z5|bcoVyl53<;*gy+Si3I|jJ=%-%h1AW- z3d^q}@J*j)_L*t+T$x5J5l>9hO->YccZtBD>QTi<#7(B>6xDTr1aeShbySUrOM(~S z&4tv->k*v=o2?p@n-cn024zomYhEZ&7F3Gv+#;d~`|fqR%XVi>8v87K3YaGWiNddb zgh%2w1SPf2hvSoX{spv8CcIU3^b`NRV#>72toZNc6(jcl!|^E@#E*xa z-ooS@?aBIr9(uZON+)z*;=e+7$@zuLnU~5x>zzhNh~Sef=x^Idw44IcbG~7 z_Dj5o>g}0Mb~{_5dGpniy;9_hiRofv6*X zkB9xpfN>2^&XV$lUN0={z}jC|EKlUjqCruc4a&EgCLCgAMD%vnK%O`&QFdOpV)=ci zT7jzUHaq=vbu=i#D?ZVVuGYLX3*^;re?y{bFRGWMSd_hml5wtC|J%dLRePThTosG4 z5yj$~24OY0(xsDKu8T~+H(*sn0e^Iq+Ib4u050O%BZ3Sr%q1eh4&{97)nG<)zRqJW zpjSZNO&N(z9PA3vE)OJZ=v1ngB+-*eAo-~P|r?9=c z!*L@CR>c(R3>u9_kEjxWEyWIiwgc;$n(cK=36=#zUO{2VKfw|ic?S1zWHkth9S?4d z=Qr9p3VBeoBT7JaLNX(Crn86X;i9-fZ9Q*bwdN+b9J-NGh1xEofsdVop_-CqXW??} ztX$%GR>nc>m^?P}#vsp2p)hWDu(-517?kOOoD9(nNXrS{RE0ne)!0~IBEI}XVI$TS zNmT+=S1Uh;Y>mck10(}MbBU-3ysTgvE^S(*tVal~>s*TvbX7?LkY!qn3S_4Sef0@* zZ2wTrh+C*^Pa)%XI7^F)SOf0^%GxHSjf3`=!049^|B{M2X%%gD5Q5lk>_}W zZg`bGURfc`Z($(^*mal5Lo@h_zNvcw5 z2V_k?DvF&8#1<6Ao;ApCh1BbOQDuAeS)a4R-xDy z<qX%2VIf9Hh>b`~{sn?OJ<+ZVPRZFFql zEe6*u_F;XB6Kf&%ONZPo&|0_RY~`?#r3_gGA~TVRgDEOr2H+VS0#%4G3wwbV;kJ1P zdyCN3okBN@_!eFaaN$*=iMYhGP>)*jXKs-G&1zv3G{uT`B5bI;5-}yf#h^~THS-Fd zqc6_eU8qQM>DjOhDvkpj^lVFbMWh!mUl6uYU5sL4aCSl8C$@r)0JjJL1eQ|h;8qNO zc<@gg=ZFgdyKT@FS^N-q_S`32 zNO{E5u(g81);-xz!$gR7c%Lp*94!d?C28ncn`NkdfA6EbK>B zAdc!TX_=t;NaJsnVkKi^gi7YFDmaUM-brD+*0A65Bre38I3yfO7Im{$x;+|PkVqaq zGOZOYp+A;5#C8AOYd2}@>2R&ryiowRcE!39)S+8z6qXRU5b#PDzLvI#R0wy9fJ?Sp zzq%rbFU>26C(rggiW^I^$LbQCu1!?zl-wI}5iN^dKZk0{rP@RDQKO`ehc(EG#zTA2 z7N)CR2HJ=wlriwwR6n5J@p_!Pp8>0WP}oAsCboz~3qygBA4PzrQWnHVPV^-h6hq9u zQEkqfcveybqR)|Y=$EHZMd6flLw&nvg;>DK8p94amn9-_sEN4$Xx{ZJ6Zr%IjOtVPp;}k5V=u?r9O6TOpV}RNP0<NTkGnk#6)za2@&v`UQEGsKT@GRR-FaWsH7@GZj}oF{BU?m277R2(v|Ej@=p z%b9~P)F_W4Gzh$D!$iV!-!Z7&-H0B+IGRRaB7?lcXkW9ik*?VX#fr4BV+YLz6INK$2MMW zuRbLk7dKRklpR@) zMQURli~uONR;4X&QCu#(MM1_a23sfFI7R1-$<+a6u$~kb`&)-(zEoWR8U?p z7G*;KCOy_n%e%!8smM&tYl|LdGtRIhXIL8b_CAzsB5dcN!je`#|V&ya5Glj@BfYe9;`Dtx1$Ja3vRxg_m0oL`e7ChKFHvwZ7_2+{WHm7q&`LsNu<3ZW+-UXXU3_?_8{pc5 zv|snqvy2_SDQiy+w!L*r&py6Gz498>na5GAg#`is3*HSHRAO5kD5|g)NH6ex=ojiv zXVGR&UAoRLDl6Ci%6;KB=_YV*q#!Id$q(JF;uIuAL57=`Y+?UCx`p{XZ$bWN4n?2aSU&D9u+<~LU}>yk>cCi_V7XD;W$njztaxI9vkPz}-60+2DBK}D`c7b153 z&k}!l0jMA#jTimyX_737us5QTMQA!D=#MX*>f@Jiu$R*WTnwfJTo0DhVj$$s_k%&R z0}q1-zym2e_lK{I>0wkTs)(6|b~AmD0ecf>kP|(Wta_m-F{7P+aGVGFLHHT$>l(}B zo-Op1x`2aV&0P=_(3xyuSa=ciC7`XbR2%5vE%i+WUPvU!ECfSpBawcr!wmA+NbtayYo0J&7ba2E z9!i^lG(wXke{Yoodyf(kj|$1`3U|pwy4Edj*@}wAZ(AM-Ge^z1!~NDG$|Pak2r{RR zBpbLy%IL%kq#Vxv$3l#x7zlP`@xGu&m({?97V?h#G=aI_nW&lUxS~*ffKnA4BD(p$aWjQ57n$ zs+exWYr-39w}84xphSiOLE?dd`xm5JUWoSu=aN%`$B3D=FH1_6FZb~CBAcDGwkkX0 zDG@mq$ih)d1{S`pt=O`;=nU!TFWCMgVd1e4O^@TG5-|}y_TPXI#J?hq@Rp{#lcioi zNj!9p$E{K^40P=Soy^Yt~JOyR_nao*4%Q z%$gjTZ8vnuMrT(6kVjno;OIGNyR2c)zGgZya01PlF2-3X(T2saTDIA&ZvIR#Bq9wr z%)^M~GLdDlhlS7M%Lhzq(TP+>%u=E!7Hd}E%j^lm(^~})h7h1ua35P-1g;BH3WxH@ ztQSqB=(Vt&%8`dHd$tuzIC`431>^!qCfnFcews5bXgOPMrC!j*cuO;8suYu{Bs|SH zQ7{}@BT&gClOtH40c|W=BbJK^whRYaX|b`C(u9r>xA^^ny$J@rrE_3s&P3t1 z^;#Z{{%^$D_`mS!=lsX0vs=pm^mG1CEvua7JpZSbO&K}=hvPGd7gLhf(UQ?9-f^GD z75~v%R>)6G8)p2+T&RvJ+8Lu%1VP8eCLG*QA|9eLwmJv)p&b{|kf1-V(1f}f34`r< zCQje16HS^M^AwK9B7;B_;-LHlDBuo(70_J32P8z|=0Kr15D`Y+o{L-s{U?*-#MDI0UPi7X|3ie+QWa^e`^ghcAa=f$iyriw z&(uLYqU56okdH43%EcGNpi&f}GY^Ypl0dgbs4id`L6BjDXdYy;ViZVkA~m1|#HY!a z+_@X$sY!nj#!teXt=R=%qd(I(YFGbgeKr)P>`Y=|IuO6aW7T2Aren>$>o}a6eFSi) zx@Yl!L#HxME~Sg>T58x8qSHQ$jtK-Wu>Y#*!#h{bDa7-H>tKAvv%2*(TiEGzvII`t zo@#Y!g{^0`mr?WC#R1J`l#Nk(@=X0u&AnS7?CinYtVzlXauzntM8rU=7sXhLGTY3= zXw3bNlf=xnImTdMwT+GY*ViEg5gvqAYVS-uaKr;Rf@a!N0Q2JGKf%zBB~zw48bSw{Xdr6YS}-0^56eMWtEjv9rypKQ>K=W-2aE;GuR|k zGBsL@-kpRf;tKFbBIOz0T|AeAtX5#bT!b0t`UVxpwPS&$d`U@+(({1a3) zQi>)t8(O>wy1+OE)*56Ty(lz~MD!$Q!x9)vGnwM5j1EJOvGsD;grl@su+pqov$dlp z6w6VO0UNmb!sEbmNE&(sPhwJhMTPk=wU4UyfsZIZt^M|xajM5XKjhVChQR!hXE=wt zgqR={DVFO4vdinp%1dU>?l~1F=xVJb}{5 zUl9+1;b3hdpBOakBC(F(=1fg^3ij$8oeZ!@4=XwXKzvfbZDrDA65ksJODc-V-L3;$ zh}VZyB1RQ=@@l=lhgsXV7!1`J^TQTTB+WQIM=dK-RC-FW$QJ@Ct;qBh7n#NWnHn%rw8q)i9V#BR zB^8dFF=0EM7DSirH!;I*%N0#WM9$o+Mx=Ji>iADM3a%1I z6-~eh7jxLz!QK{yv^lfU9o3e0*7%~5qLK*{AjgCW@O`$GOXk6qXwO$v1X+rT+>%Q> z7H-qSC8+5z(%=x?lISPfN13=XkhrDEcU>N$RF?i^??*6b&6QV?Dmq>R(rQ+jwM?K)vo z=|i|lwoIW=%m=}O*tX@_sSR8xiw>dI1617e`GGx#V0&!SvxPSk5jQxRoWVDeAwy(~ zgP_p89W(&g1c8;xn!<(wsYo>^BRI&`2`~r2Q*Fhmd$P!6cTZ(Q!g%@#EtOS)WwBM) z9mc`QT@Gw&C94IrS}10}BdJYhH!6CXbCmrS<)FjbheFt)y2o1n8R{L>fj4eHhw{45 zN|ysXJOnV1blR|qjAU>nI3}z^zhh_|U0V>V9?mDg+!J?g#n6D`M6=U|8@^No50d67 z>JUVciZD?$fn6+sMma5v$VA`c7$z-tc zup)WkHbE+9kg^c9lmiliOH0CRoB6Ixd}aR<97u)4f#P?eWnnUtVyv2IiqpGPmSgoy zv;aG&#$JIrlfjMyR-61;z^6D6%PAq5U)Ui}JBZ}V^cJ53mb}*4OJSAmRoO9Axsg5l zC!kgMsaRX>2?6T{ z#o!8hkPGv`OhxiT9sp{DHI;HWIEAq6du;whOHZg`W!5CIXocM8|ZJJiY$TT~7 zk$f6v6-!kp?0YEIDtq9-`D5G;dzb|)#GVOUp>Pt=gxVr81K@qyS^kxXw4MlZz#d4O zg)fu?SP0TOkcD{pr1ADf6#Qb;*(FSP&1jJmb4V>pf)2SCMz3=eCjp6|K=<&9@||lW zM|#UqiD+Q)(Hd9zuAn1dkA&A@?gdlKZsbPH+n*trL(D5e=q4zhixt9_;+ba4h5N}M zV%&BoIgA)vUi^m$&8w&5*}`4^G+VUmYNY0f7lOrDFud?DS+b00+w^jZISZoFFsT(*PkfW4B2TE}JlG`Db+YW&tfYOj< znZ{xMfdU>1Zt&Ld&SXGbShn_|le3>E~h`M+m1Avo=5c%QfO7DbB8s@BQ=sv>hT`?(^{z843qAV}Ejo^XsT z5(N~WKr$kDW_ZJES`JU(-pR6%RiZLJJdNE!nqPC25x{F1U?k-n2#x1G5A+Fzk@*NlDzJH$IN*{*P*Y$Jf*R(m$2+~GQv{L&7jdv^O=#VK0DuiQ z6?h>(7@>(Kb5yHrw{VCz#4^e$me;Df#)Y7(Taj83hyT5>vu4#c&7QSr{%rBDL`9+* z=ZKI}->0cT$=RIxm4y6TFvy;30#4Z?0X|keiclqd8mk`JH#y7F(K5#x6~bf`Rf}Q8 zC_+|NjL?;ZwL-K&tOdNm`w;d#VInM%yzTpmIDl;sqi<4aC+FOSGGLh$@XW{CY;7l{ zkT%v27$&~#C8MV#@wUp0;dI*Cg=`?51xce}RCqYvvW*HhU$9xtYPLPAy+C=q>Mn)y z(RPasD=P)7TMmD%t;j!oM@j>2ZaPiq0Qpb#px1`g>Rl0EY*1pC&hwE`Y_3JDBWPQY zq#g8K%$6%%Pz4`htvIE3W@6z~F`s*sP0%@zZ}-STtnDN0+^h{D$aW0ia{10usCnLf zBTAzv+PU_OT7!M_s1|j042=O!&5HQaxJ1=ZX%R-Y&xWONA6=LU+t50g8=t~b`CSGa zUej9}R3|8NR9arRgyqcS63!o(N$n=g7GeC2?cKVepYu*&Cl^xBS*{@?dN^ z8WhAihY)NyXtdJh3W4G{Q&Tnw%SNgg%@{vab?c4Mq0~1SlFYVozCzPy&O%{X z%o$xAH;Q>w6xCMpphxGyCHg$ca1}+9^)~GVSwS8!z$O>|T(QMt0${HS9{606xq(nC;A$T+ozP*ZZ zuNP}Mb`cR2+(hJVt40WvSj3ugLY0(Ad9|{?D6>3=1f5#Vw~nS%kY(|$SyJj}hk|9YeOmhzPDSS3+Rs#(MH3PM%YNP^62ayhfs_Q6$lwV~GWjd4yEi z(a+S&Yk)g3rSuLxrN<-O4I-_g$FoAvz>AeFI893fioo(wVeB^_Vx^&nJFP@+!X#U2 zbvR6h%++MojS~Z`EfgYyd7*y5a>5`vh_-w=WNdB4pvGOg%BktZzUfhHufQ3|%|VD} z*LO&c&!B4p+(r12fD)I7<_r=EyF&oCCynQ+WZWX-g}(c`f@VaX-q^;lgg zrZRC>6+AAeefk2*u-HaHUiRc5yIqnNBk&T^W}=FOs@^Z(p<|joMTX*o zp>~>1sTxeY%hObHr!v!GeJlxu^RDYtOr}ICyWLbF3MQ?S*+Ug~@?j(YPeBDt3#nET zNuqDKi_~CL)H3U=K(xoUXw~)@-GD~T;l98%LF)TFPQry{sr`oo>np?>#g0JEVVmsDe zf|CY=Ni~{3n+n)H{6uww^O-tbXnBV>1DTwj2wAgGVAvs0eR)F3O|yi?hkH33%Z<$~g^wnIu<@2yLlc}dW;@t7kh)20EUxW%Hd1bJo5&7KJwz7c zmfGG)0T50WryqGTG#JJc1FX2|6gdpu6f03L=sj#Im8K|1Z2yC(@^E|&3bn7D01-X+ z1EW)B@phPHw&vUpz>$H4#4^2IYeqL;#{I^OmAY16-|W}8`kDwfsL`_8#q|P=qbXewxvaW#U?4aK%d0rYfGf8$yN!tdzN@F(_rAGfZ3qte1`jglG&obQD zDkH%D@IR-OSJ>_U%F99(Blus#@)^|gnJan_1BJ*rv5dkNJJJu_~FLohRJvs()NUZyzxWuuR`&B4x;15U(n-w3NHJr3R@)pOQ$eCwf zAO)QMGCr3EhnG_nRS3^jL=&nNj@=jn`iK17rOn9p%M;f}y_fhjpGb>{WbA2nj%cC~ zE|pwl+m6u(O!Q*o2y^kM)p72lE8A2;U7Sp9k}5`wU{I}Qg?Q7Hm$d@BK{-o!PU0b8 zka!NiHcN~ju@3N#<+VM>tc7x@sA6@bq|gf4VZ@z@g#lfkJ69gYYbypG5XJ|sbtyyc zUWa7Isquw0-uCXYXZVs2Gyey?_(Tsqwn`{HB|~4o>`HwGa{hjHxhEIP+)ec9%CLzF z{oq@uC?HvRgrB#iJW<~BpD}PGAsf>3f6BDbw5;>LvSQ@?ACAwU5?=&QO9`PW5B^+& zf!}%)sg)*S*r8OMLMDh{u93coh@c=ISzZANG?vS-#mFsvO(UwypszL#!nR<)7Hm=B z!A+*$!UCM`o-R*qmfKFlY{8BsQZ5i5{HbaMZb?anm>sOy2A$=QQ!LeqDi^^Xa91^e zebG$_5zJ-j63tw}yaK(J_BjE169513>46Zxnzjo$1GqBcGUZAp(ay$ z?%XMM+h669c@Rg?A;-o6jApu%nvZ=Y2lar4Ol2}<`LvmOvMmm%GRc6}hUjX66&S>o z{$t-!9N|NE|9BK{>psM <%K$x{&?@THVOVQXb`s$SyWKc+wl>9g*%3GW;pLex| zf&h@%rNnUUa9w)A~AeNYmj#CS`8M80b!0#Ke&}O{Lmz}0vS4> z6%^19&^Zgs4IDT>v0fq>{fmD1q5zG@nqpZ6wt*VnSMnKBZ~<)%3Wp7zOX#uS-STwn za`rFSd=N&yA_5oI|M5QAnAzGCIk@-&M^{V)`&Z0^W*h1@9!y1&Huf@&sP?#e*~qaM z5kAPQcv-aUd0R)I%?z~lND74GMMKcm;lp=)fl!r6?%AvKgjK_`r&D5~P&LwAt;nQQL?E!AXzk2n2s>JiNe9$) zPWr;mCgJ+wp6lV+7M-y?*; zG854kM<(Gp=gUsd7tz2okh(|8sjc(Zt$&>0yER>{!ar0RMj1gxEYNC;V*uAiyaifM zHk<$N=l(|w+mOb82vt^2smO}|P%#q!X;?mkx>%8z5Kw!~h!tLB2$5!icR_SVk00;uT9dXmVq3YeeE{l&?)H; z(4|LKnwkL@U8BR$Q^h7<53b>qA$6Mpn%by^Qs$GoUxN+2_t2u~WM@YAOx2Nqn|X^Nb)A?v zciQsXaD|9s_(V}M2g{73Wi2kCL7H!d_zclfvNzv!EF4EShId^-gDl5KBTBjvF-mBWOoW6@E=6dx z+!B+lSE%t)bKwFlBpoKgkva22R&hZ17}X{!Wle#&AMxQZhR7HY1I%*Q9OsO%A!plz zi#F{@gNTSYe~1;Lrk*yUvU)OZ<(Dwin2t=l&`)P8&I$!B zO-uxq3*np$6h48642UO@p|a(zcf1UcUyAUYM+XVCw(MplL+rvKnlW-~%}bmeNPvP9 z%%awI96y`8JLb)zn7$#q(ZYcd215ay5Avtp>{+HnSVFFuCO8w5RTUkwEd_YgNNG60 zKtI!@!sfNvaq}=G2{9;Swkm2s|CUmaA5qEP3@=*i32FAk_`5Gvqwuw~P%eF+7(v zitY$eBg@1)BiJ`KNuX>Mgs=1h3e_YYY_9` zORJ|}+V3WOwC-2wVID&zOnqlG++WnSL_`unq!6O~L!y@uy-h?!LJ-kA5kws&3OQgp?f zn@aGlf6497H9fzoB-29Z$K5A}ot=wJ%xRtI@1`_XwYMAkPk=k#8}mzcrUrLJ#MV@{ zjG7JYFmZmjz`Qx^?xn7JRPdL=Q9^p6TD0b;0l)r|f38g;F=~ZDMT0fGa#2o{`IdG? zQnW}vjf#T_r=#ySF4^PmjCb!y#DjP2NmNvi+j(U{=W;YU$=Gw+w&dUc32um*?@jpC zyG08`S3k|vI5{Vd1S)af#@_ab*8^*u5e5 z(C_UUPTub2gOPP)1?WA9_$bGX*&|e8>=xzw+Vdi_gwgPP$6Jv$X~51wnnlz@%m=o~ zZMp^OWNDFv9~?gU(CUNt+cG3)@zp1GrqU5&>Z*gJDNmlq3epTL$R-U=3#ENdbqnh| zjNiUHX2*SQiMeObW7Vm2*X}=Yy=f_TAyHVW_$1)fFVpXh=w}wZORWzKc;MCp*iVfz zIg$E9Pt?@le+<-0{~JpAqJ}x{pZWOf3Q;FujHyBBPWleZ*w0KFo=mnheN*m0oYUtx z6KBCE70ZVM-Bb?2@oG`8c^o9ZM(s_S_O?y0c5n~ftU7U1Q?uKk^~;xMZA~;e4sxIs zG2~-J4ooDP_dH1GqY3|e$?p^Nk6spSvify5lSk;?A=w`q8r54}$ossE`Uv)>_5)v4 z`^Uozk&gSJ-gbTMPsh&KQYG~28d!L9KL_8etob^uzqJOk@g&-yE*@%5mowHM)m%kA z?l6@!s%3smV-348r)fzj=bL08Y7~m6CrQG(VdZ}(`IBlme!U{kaW!B%)?LhPJyq)b0Wac766pHNw7w;jy2xdo56lYV3;f zHR1cmCJkXxPvW4ul8u=~c2u>}h!c`Oq`(&i*+TVfNuQrj~WhSZ52CW^FS3lUW5bkRfba~vC?_}`?IKMS&Uk%G| ztjojBRT>|qUyE1N7y9`de@fN-opvd^V5L;nGCVZC?-YCWRBM72})6q&7WrX%}OaWZTf z$dBH(wkxQMOb=^xoGraV_w)8IFYlS@Kfcx|YcfMPAG{RTakcFtUeLH=cUdM4yheBe4vt<7%)1L4ZU{U%)xY^j z3@Y_-FEfT;$C`>bbgioKa(ZY6TEdekm1!(>_@KY;$TafcUvH2}`KfdH+`B(}WgHq9 z_F@;cflm{YYbqw7$s6ZH%35LunHC&-wmdP)ND?be-8rG8O4L;cgpwJNNEM3B*wO8x zb@dl&j-R6pIZFhghEjITJzEeBOsMfQh6}D@(~cevv!S{3Hp_nxzk5TGO2oVJPLE;ICi)biN0EUW>2QK}VPXN~Xf^wu8T_-;*4=gof2m%pz1ga3x68AVP(4O+Z_426g_flTard6gzlufXTISV9&s!@Oaiu4Zn zZUj8ay|q@Dvla>)xcZDP#{t~)CuMP0G0D zUS+d$|GJhWCNpxTHZz|0Z#aUGZDW={9I@4=!b|n%+n8myxT%J1)dOvWRIU5_*Q#%I zn(b!qz@6VIeb0EUm1=kNGHW=GYC|k@$DGsY^su7ixu7_5tp96`+k-OcH_hx3(X%^h zAu$_v<&^_>?cZD3<(>C6Jd=KBX(DHOtaIdB6qHd+1HRVy&|>?Gglu6+?XMQ)$oH5- zXx-fh?GL`#q0<8U8AV*P_V7v9`OZ1~6jp~6Gw&ZM-eFnF6=rsl7EUcwnqy+TP7iP2 z-@VvXj(x4%Me6OQY#(KJSd$LNp=3lrx*p|uU76=KinFouSUxSaq$Y@SrG}?^$dWYoMLADMuz4PATZV_(o5?7zSBj;e~ z=qr7VZC!Nc$F=KM=+%szmuMb7m~(Dvucj^S+TXg#YKQV(=55QeSdyAcry4fY#2cj< zG%Z&m?knMXR5n1? z(;m(7KG_y!k2~tP1)k5)V5N@FYAz4%T>EvGorx}Z(!e3=1}$V_5lI$A++(tBK29VJ zSCs7#K7+3XdH$w;^i-j3Iv?7=5{4)w@q(`-6+%5lx7A`k{3x@J9Kqv3U} z8pGccQStH8!9e^It1BH9UmLZU_Q~S>^-jiscHIqh<-LbPW@q6RDh|UMkG4~lGYD$# z9wHuhgGC1g^CfFE#KV!#OO=@R$LAEP5+^-Ja{j#sJgvGW4A35Ri7yz`D74R&Iu>r9 zNTxY%N(;=%4)%Jk6E*j$TFmZ?Pd+v;%|T5$Tu}43_FOd4N5|vv-(x!|r;j%O<{8SI zohpDXhpXbPY*TtN3hJ5#*Hq7%>phMV(vt-q2OwU%m_3@27h`p)Fll-Jr9HjpVXj=< zkh)sUH@`Fkefr{Pd$2>7(aqN#1(H2+7()PfQU^}9ineKgIA1OIBh1bkKjB-~kT40A zGOqM(vc4tSenq6%$Jov7W#7tLwDv`RVmYUp50A_@v0~ZJm7k6br4snLsaD2wQW+oj zeZ4#5CG_O0#iy$<>hvE5ofN}ojQ+bUUiQ0J;U3zl^>X)mqU)jf z(;NHOK$at3A^x<@`iZwe-&Gn185Fl%xD&OjfU=xrz3<;VNJ;v<^jYxd{Yr_AB}Fk+ zOUB2IY$JYyY{fb1+&4~-z z)HhEPB&oq9)Gt>Z_kr3nNk`)TnQC27VZhhL^>dFm*;$W0W27Fx{PIF5>cU|TmEzC_ zR4X(O$-*9T5i#hmf35It7Z}3jv3A4>Nxr$e9JCJ+%p_as^%ur0BX0MHyZTE~C17Kj zUp%g+5-jBxf&K}z*Ea|)=_|POSc`cz@=l#q=}B8nL-MLuN}jm2%0Zmbl6KFnk!DU=F0;U?8K*`|2U|52=XvId$cvsS;pF}~y= z?NR!U1+>XPC%f|q5~VVraiQCS_U%3@~pg7{_g3JJy1pMMSfD$s(C+6G<+O* zs`FuIIP*aS<74GeV>$sh*&kl-qsukGOgZ^;nrj`RxP1Zqzy`@q6x8dY6+z6}fpHD( zY!Ep(4{j#o2ulB?78Q$o(%A>+`d?er7V#YHOAm1nXu@Vl}k zM4H+20tL@MJP8B6aENP*L@iB=grxc9+I_jYTz>5qtZZ-#fqR};o-ImTGkROKa3*5w z&Fpha=2MkouUOUFOm9E^cfw_gkAnN1tBOTP^(h(x zsrZu-xBg`&*8QkW-Mu6OtenbnQ{Gqet66+nxHU(d7u-55`E8fS4bT|L{B+wbqn9E1 zpEOlEj5-t(aPbR1-@`)FH{Rb@t^Nz?CeHu1D5kJ#THcxH0zv@{(M@IWYeb`4XzSY>3pQa+k-mIC_&2hyG41b(7N42Uf6a=gZNr5}r%O zmowYZjGn)+$AbTQy>=SGjQg`x-ncvWCuc>QPKf@-t%l?WHeq3d+PZbTSe8Ni$vGFj z904+S^W;Qo!6<9^AMUjK*_yf&kxzX!k+vng9ObAHcv^;n>aB>)?(qj1d2wtM%1r^* z88X)g5@hz*twIW=){*B-rwe;->JwC9f$3d+{cTV`-s2fHCPlcm{(4Atuyv)eZMmS~ z%=0|Dj^*PG)mN-9GRWS;yDtEKcto}aeF#OyoT`S1xP*Zq;Tvl{6upPI*S4+GdLKSM z3C`P)y7%98y9}B}-<4+Sh>faiYZq<)*UI%z-IONfI$bF;0mlcFxN_x-qj4yaPd_c6 zk|q6z!jT>Sz-1-^_Lu*gGLA2&E?i4UQ~?AJaZoJd5BR~DM>*P`ZtGK5 zZc_H!h8X#8xF16F`m@Lo9wN#;@NZzeR$c4Au=!U%Bvy1)>k%7vQIo(J>R;`IE>{eP zvRKvE`bs;Bb-&`Fd-PUSYLDZ)uOzT+?y&jy-5Z&zuFHNI#^MYfo(ypYSe5T#BGD}0 z*6s(vO23s}^JGOnol(;P?5&syJjMGLhDG`>E1Hxsa=8F)(WG0G8AGI&ECvvWWTUuY$^} znaE%&iTk-~x$WltU^BZJ=4{^mcGJ7gj28HIWi^REkxAUE_2Y@t8oe1mjRjP?^y@=& z?q1ZIY@fLFI6MZ2$o~!TEf0>thK+qLA2lP~3lZK&3RTaVvvZ$1{SS>)aLSg1$#h0yAW5=p!AM zLGI#;`I60?1<#$xnu`mVEcg#eD+MG9@FLo*2H)d0s@6CSLQ)=m_$sa(k=!31oy+PqPZmLq6<~Zi+TE{j8R=UE|LC(tc zAF)P=r@$%qQ!~?w(Y_XD8RRD1v&i*82q7+w=k`)dTC1`byIp6#A8Am3Rj4)ZpajR8 zz~;dtcx_HK4(_ZFQKAcORLY-tEfDO1K4GZhq4t{oMXi{stoAR2$ zQ}K2w&$*TrJ4y0z*W?jN(kVK*huOcVkzLzt^LGNJh|QBRNd@rlzh@$5$9vpLOMrK9 z!4RDl>{<1CzP?oppntQ@U3Ssr`cer{F^p?u=U;&VsPxH>#8SJ-HLjbGY!v zmEWyP@bg}>`HIUqt*>s)2J32nsoht&_oAj-5GH|oFVnVKq~+`HR7{)*bSG{wVrq|btwkNrc^0?|L>Q7igL?XRs9`FqV-SOta%MXGQjHy4OZa2N= zE)1{C2mSZ#k0)#V?U9JSl7e5V!mCVxm5#F$7-iO<>M&>@P;-bVOwxKZN@46rYEks2 z7c0~S%wgA?b6lkET&b$22|4?_uDTg|);Yqku>NDW8tlT~Y@VXke8@@Vc~XHpj!<8D z(IR}K`sWkMf-&vj zU>Ud8+iyCP$_CEDEPq(T6E7m~Wlt{bNE4g+!PIbQtCqPWH0S5W zZzgV%7UlL=GNTk()vtR(m;~{&>;B*VF#az@ADuBHdhJ`LsVTFdNJf;6wNOdHyP9t= zHf6eBS+(tr=cl!zulqOF*4yW*lT+A5q|J)hFMW?b@#JtSl7*xF>0~o(9<0JI@6m&^Sy`tbKV%M zbielzCr?sD$XR@bI0#?&RKk(pF!oWtp%MLNB=_=F#=_6f#cI1_6SjIZt{7hpJ-vbK zuzxm2(>|r)nwP{&kU_LL%_`oUcTw95UA{7NU)`apX^kpFILq(3M+|!GwT!sf6~9l@ zb4+n*cXaQRJ={0>CwTXlp8uED={`D-o1IzBQVdc|R5xg+jrl_n1q+|#|IVdu<-cUl zyV~io;UIbaU23&4{p(jn63QD^GLxjufa7dR)Vj0t&K8C&;~LdPNznq%{yPTC$OZ&Qq@%%zVtmu0K z0P)t6eC=4F&40hjeZ4)N-SCT^zTdCs?=|#k_wRG!4vbSVM`T*1-S{e(;uu7auZgu; zF~*Va+wo#@*)!19W0=QLY;W3A>$=V!fb3}79?fBLk?<7<_%(<3sd=U(oPGk2$EJ7v zP`R)}y1Csvrp3bx;=8&TdWIQy2{ed$3>#5YhHv*-1f>BZo4P1ehu7zWwnE|QOOuDc>72EN`&^r ze172<`d}sXx4$Z4)ji&xKQUSP`bIByOflKQzW%MUug=x|Z*Qn%U*-2V+3@+dwAV`9 z7WRJomSHCRh3s;^*#4^KtANPstwmKd_C0Mo#4SeDf1WbO9s!r>X|mN;XlILs(&Unk zC3D@1y(CO+@Wj9!9yl&AUEW3B_re>GytQbjr0S$(hJYr9$AWI8s`*PP$7LK2P z_I6{`yy@vonL881L_{>_(swqerF3teW!#}nN*;na$oV>>rKUtJZih)qN!K4n7~Kyu zxMTDFU*{If3e4#VT<)|_85bs5R}(Yqz81a15mO#JBq(JMzJxoPVzrohbVaJWb!px@ zS2#8hVZHDo`tp71W4@)5B&aS=K5@^3c)z&YI{*uA%WQL+yx1R}Zi^*51LU?5x1Fm_ zy-%Vk^4*aX`OBA#|3kgvCn$aAoYqt?^!w>mZnW=tHi+KJ(eyjNdZlmONx1!6?KVP^ z-Fk>5_VM5C%O>>*VyBmN$y?hPe|^aHeS-&&NX1-nqqyJwn%U9EQXlZh#SgY{J>z*pv6H7P^Y--&Kp;eV)_oQ}1CEd`j)`*qKGt zbq3*PX=b6PXPd}kpe?MqMpjIIJF=(o>7%Z?+qEfywK>LloCVL}_h=wZp*)|8)4Lu8+TU?R zBIJCccot7NW+I^u1A?0KY&t-S0IG@ug;P4TR25{plVV$M17RsYI}5<+*m$mV@Df0e z$p8wYkV6f)OY{`$WNN5HajUB;$v==WGUw1yH1gf6yN4r@w+ojV7rSTxCKnl5xhxzl zge^TrUu(23%N}{u07CdU9L+hu7QDz+GJ620{^QJOEbca)9_Vb^6S}J-a%)=51>%c5 zB3OC!fI%pqQ_aG?X=cP)F&$eiG{|>4rrtKrG(e3gW|RTUvZ^BnH=#422PYUMt0s3C zm@-b-*3OM%#~bX=wFMnRt5~=w({l4|Og-v|k3daJISABym*HlBfy`#1t1a5l2<1VF z$Khg}{Ez{{wZE5FVQyx`ka>vi1+*U>7}PrxXoh%*Z=io99dM}PG?WR}mbH0zd~}{P zh&QiUT!YnH;zZ zcsgyxMZrJP2{^leCbu1W4%Ve96f9mWlI#Z-K?Bf`d5W`r$BdC?_W7dU{F3Kb#Tq(x z)=&HVyZBl>$`LcG-g?oVn6gi4FtT!O%-KPsvl@;!(Qs1vTE$I8h}oZV7_i4q2MGi# z1csB5HA5DX9$k&}4OX7LXHikNv|4;;>BHl=06`N)x+!r%poMXD)NIpQIoi@x8b1*T z^xxb`PWHmhtSySCEVKakRnX=Wl{wa~MIDG?A1NVF01TKRG~5VW=!tzKmhLs6xi3T7 zsqRG%0xp?*8aeZ7aE&KJq>9G*M_L+jZ zcpsuDX>&W?XMt#5wzfIUJaA5oBtTlb%GZ3rUo4M)>nssq1xWi$rIl`n7IMu|_VTC| zr^jbi)vOAN#EAKOY0qPR{{xO0iN9Qpze2*KG69ea>lOnv>tZ6bqHW zjXejENBg=UM@yKykKz|`r&T(yD>z7f7iJg)zvp!Q&+K3byTU~q8c5u=WXa47z?5Yj z7*{U>83E1*P@Y{N{Csm%;lOVw&B4uR!~@$wo9RbBN3#ThRvUqo^$3LP*(~Qc8|Omf z@%NS?dBWZzZizrLGv!>^kKBbrhOrH#L7tWfa~;#wD|`DCUB zP73kya;wHP1Ok;72`jYI(@;3xZZ|{G*~px{|6GrT4^?aQX`C+7R(av1x15E8)a3V? zw7WL7w17P+cUbg2?Fe7;IQGV#s0`4Bm*GquyWhlC)glPh-bgl2ds%Y~b8_%#@YOKOz7@kxW5G@^+Rb4E3=oJuGx~7)`&*Bpy$}6eOnnN-vZ8gVdV5AhrpQJa> zMVbW!l~JnD@Pq>gh9Ch8+2&G=gBGZ4!Iwk;K}Ow=P?n}7@@h{{&&5T$c!qN87Qia# zw430NB1|EJ5RaP9n~tNR!ly9g#mfkl+1!oahxoWpz@u3J{soAp;-+)bJvb!90kx}c z0V2mN;Vp@~n0N;|&)1*2E>aFm1IHSsxWw^Cw$iSxn3&Z^OB(SPr*);9uFVJay3W*z zIurtg>`(LpQqDV^87pMh`+AT|ZMlJkPrVbR1N<>n^FyhZmybhIz}ZSTgovPkf0hqx z?rP6f27$042+E314Z;^)A|y&&&W*3PYT4i7K>4lIkFh?#n2A0|+}6sF9zs%};x)H8_ls@!*bMo{KX#iRQvL8kWW%9ftcF>nhyj~OpH?YahA*Z`MqeyRPu$E z%w?Q3`VXSFo16FPddd(sewg#kfg=zIP`#-WX*5Ksz^4^L;k&s2#QB993ym_V3&=&Z z(K;1@z)UvqX(zTj@Fz-EiJ$FPKxcd%wysdDP@TiX>8?bA}_$y3ewf%z>w`{lmS{infIA< z9?p(OU1E(@$EW(}i9>G`!gH()$iV`~sLxa6E9Wa(DzXryNC3g)?SJl@p)x6p*z++G z4jekzvs8*|a$IcQ$6(rDMyAHy2_#_V7IhM=VPkLuI7*YpOY@m z?NywKZSj@?M~A^xkS2LK|D|GD_{GI8j0-yp7&>V5>-ifAYs0tTb(GK7>H0hIDA2;z z=H}+*X1hXG{Sar}%?K7|=4^$o%$d56=v@H(;xEpd04Le$?bAHk#~hD_04JlY z^A&APUdKfqk2pmYSHtHAIKZ<=G5Fck*&JaQiYV~9fDgCgk4LRq!E3QH%18Y)t})k@ zYRY20*M@W~P1`n$axLYL_jk1cfhi%w@^%E3i*nGWfP-uV7rZsH^glHVU(lUA z1tZA2YAq0ah_2luZL5@G|KmEELLk0ZgoVpLnNp4G7K0i$l^hic$&mkBs{aJ_rlDo+ z@c^>ulTbywRxK{5=xjNnm<))#O=RUYV@Gf`ATx6j#8ndbV4HAQCnPF=@sCfmyk#XD zrVPbSB7Ef67$D290bZ()}ls(j2pU#+uf83S|~`CC}3#0PuL95L*yAep)8m z59dcVYdEz4P#g&RMu+27&W4LY1G?%YY#+6DwBpGT=cGZRAarRPh(b7IOj|A3n&@7R zkswZ&DstoGcg|%h;`aQGc+}lw`R|@@1cob-aq9D#68LX+{mHSMN*8%?-h~puEt_j- z`NHgJ655%OETWJ$q?E$+3)AMkGf>DQ2EVY6q?DupgGeEGvZqhiIa~m(WLmj9ch4u? ztd5+E@3E{xdFv?qE!m~GwxY3b70O8`HNzE+A3JQ(+2U>3s_0=k^%k+#=`wn+c-A&t zsTR@|KeBIh66Aqt9KC$3`*>0XA)ZP3yc`U`qZ3mCi9=q4{V7mMA4E?NcxG%ysneIL zUcm@*yfmyWm+!ln3bEHSeKE5b zt!&DlSzq+;*qQVLTcb8u4Ilw7s{7^JUWn<^PybwWL0E=P7My> z9B|*tldW-W1y?i|`A|UtZsIp!WJO-*1Nfb^I*u1;FWR}e?9jPvXL?+0NAm{ZtNY$> zMNky@YWFT4sQbc#d;)Y==&IB$!6#8`2-3pIBp1}6?V?Jx0vm$>FE;Ah{d_=VPw4 z^*9H9G_vp-e7ies1ty*HU1p5cxDx~5sqnlv;a{B*w1FI98^3^QlC$DCIuf^PBjfT@ z3U2jqU7Y;NRX~X>dhDlCm&oLeZR?-_{&SulQBs4IP zaBgN)LB!V4?p?&QK%B{ITom8cNWO~Zof0%x(0TKGE0#FVJU~Kg{rr>k2t^pT1wnmx znlqf-EWpUdc?hNc=pwpi9Jl};E;yjyy(OdM)o!4t4s1MLHL@h2tx!w0@uj$Pbm=52 z4Ze~&5>u=PAR)Y1T;@(jPidFx23p<&D7}2p%LE;U6wL;Aek&B710vpbEbnE5h8!C| z#?Pt;`tNthP(C5K;12>YPN<72F}Ux3*)XaROuFbERx)Zh(8ItgWNRG4WCW z`}0V4uj%e-sQ6~NR}TW$fKWO;TVs(?dN_yq=0U(Tpco5!vXvVCV3!WP3@}T_!~$v^ z3R(vNo>j(Th%Q~6bUlhpart6!f}+>y%s)7p7P^QJ%>@LA93^JOogcmL&C9?^~ zlie|l$hPC%nNbL!ocvv(p9SEHmjbrwN%#+hMyjcyX1)B6qvKI_d-Dn@i;#Mp91o`D z05lhb&Z?_9%0(kd$LK^r6K+IHfyG6(=p@+z*9^ohAbm~_&?xuyi+)S;aa}zin?%Or z)7^U+<7cXN!l5KmOtf?${HWN1D-$w_?}5tO9NeU2`t9o4I%z{?aFfp&1qi*>^-~bH zncR5A|DNqJLh&Kl9vk@7H?lys#o^1J#C@_WS+MZ@4?E zp=EQwW>AMR<8#hf3ZS41DT0cKrlGUR@p$4C7+ESLir84D4!V;Lga@6c>yVH8^)?5T z^LE?Y?Dt7sn{!-*l-fE{c-7}}5LfqEE*vRVAs6^^cfS{*e2ndl;Ud`horIQ(DH02M z#HUg2^R|da@9{@E&zN^_q3RTBh3B^W7DbgP5oh(V`|Pt*K0N}316Ume7-70>SW9iwNY84{YPZTBlx86 z&{_;H$!W1UWixw1sr=x=H9nh!1zKF(QFu2~eDTyaV2E;fgye!?i-nZ^C>!8FKCEG_)^O=d?u_Ckkw_l*MjGvd`O;h#QkWNgzzWY>T&K)vsO-MA=##85MLmp~eSk-X^U^-h+6839Ymg+{luvdLYq!n?d0nCl;2aAPPTImgdR@ z-PVs$Snr+0lcnJOq142bfI9bq?;)K0U~(b~r%0G+aj0nB<14hxyh(O}CafU{xiujf zhHZx#81lw1sa@5d@nTci@}-|>r>ZQF@unAvLa4xH65*0*2?(5}7YjU|8St9UdJc5$ z+U7GiWmU{O4$*?Ld!3HOVdv2tK?A9p74VB4h0E^O3IhHdzO(O;k5dXVZ6u)R!NSJP zM+YST8Tk20$Krt>5DmhaG!R$`z70);nrYGV@^cH)!aYPAo`x@8ZnJS13B=p`FVzUa z>s(PRm?8eQ=S|~wv=SeeYIpN4avgA%zUyE_xdmt@ND~o-!k0JErPS8q6fd@N_bfdp z8MV(oPbFL?{X?CG!P&Jv;B?SQ%3Gr)ud(lhOJ#i!RMB%4A7mtb`q!$BuoRu9i#Go< z3dVC1;!%`!B!r)0*{F!!!$N{~Q@QX9%h5{brMdvZY!C-W4H5;g%kTg%kS5Xbneyb? zwbzj2wm1a`We_C>4{fsNQRpClu{j;!p^$ne0xOi(V?A@d9IwT&; z!xyMvLzJsR%zWW;bdro>v%^0ygm?=^{uqYezB!IgR$DqhukKgKWt0RUlqbAg*9XU$ z2XF+~+))Y1 z?0rx>*tu&8I`1#?n1_>(s2LZ04ZJ>0%;}|IJkI%&G!F!n8j0KK)Kl4~hxwS(C2TkC zqabOILM{<@1Y4&4ZyiQ#(80i|YnFeVk`#VTBvdQJ*wL}q!Yc3(nNqs+(3|uJsSrn= z9Z&$4i}(UBf|nS{mR67pQ55OGiVfm);Cs=WsO?V}mLWQ3R2QImYPec9lEbaG%#KFq z;!%O%hBm7uTNDp72eI8T8kg#`(gkT=sl6!%$NhsUrQj4#&#^ETb5Enuzma==Cuf5f zXVhGcJlK(WAfVZ8#noW|vfyhs92~ZN(v3px2fM1WnETnObZnHz!ybXhLbzO73)j>M zRu6*+zZcP#euVu}OUPa@2keb7WG&akHW`i}uO}iXmxBrp^@}GPTwLcJn$F7SxH-)V zUem#%Xe=Al5ng!TooNYZvjjdAm`Y;iWbKpTA5j?Dd1%OR74QNj)RU?7%4# zz?|*iIEur&pOa6Kcn}`$3hFGEv0qZgUsh0?R=V=MQgy1frZ6m%jpd3`HfTe@x9g|eC#31;4_?ibzLk>xce5+92x zoiCltOkmUT0l3^|9A;k*++6~xV;Lk7J5}Lx_Vyjc4w78rHK%=R4NAmAD__MU*Pd*S z8O&0MKR}+CONg5%Cn06pj1x6T@`uQGyyK+F=TCD@;|41;hK6yen@#(hV$%2T?**Qe z=sN2V=ZmJG@VP|xa+3S&aq2bYR*xMEVEq4Liw-O!Z(Ib`*~LgaiqT-Jb^-aU|V1dAg$AN+gnrLwUtlXE@8&6 zi(a^N??y@+80c@W-=Q$fc{KBMp1sPWK^M4y-GBj!gTU+-Yg}HP?R@`mU=`sH9nzdQ zCk;?K7<1MP0xjnv%KFR$_eCh#viLZ<5ac=E6y=Ns4pch*n*_G1-#URPgRsMRORr6a zaEpNc;V8~b4`b`?F^4ZCG+++hXC%5!T-renE!IwlN!e!4HhRo{qjmFL{#I8iCi|pq zC-&*uwDRoH6dCF=4iAEEVPz0Ol&vNG{k?{sXEE1*%r z;t~<==Y;HBe8i7(?V_hJo+lY8i_g%2njubb&(>Pd$Ad;pFBs+3gok&7+3T}8Mi8Vy zU{KAzk1Y@q&-B9QM@{J|Dn7`=b!%t0nG1Z<3?yOaU<1K=eAn#b!RPJtAd!bH(-d2b z+49GQW=i2pDbbC)kvopu4ciq2trP)Oynsf6<7P2yL0Y<|%;Q(h%lu93Y6o|jooVo>A-r1 zrh-zDt&^*PZ8dS;BiyjV3LPcfJUi};{UidG>X>%+>ilCeELK1AV=wP=%;JnG%j96h ze86sFZ-(j3mw%>GPh@Lr2;Z!x5;A|*2B(e1J_i2TsF4`fO8p_!h*+76sS*_I4+vCu zR$I`X%P_EYnK0xQ`bKx)!X7)%11W7+W&(>O2i%|AlJ{)&A9!d`{;#Kzo|pHL(ToM|LCo)2yI0=QZoLH@ z)$UhTK3Cj(s`Ms7_k&am{520XzP8R&tYR-cQe)Ma?Wgh7PrV23da&vZ`{Mc%wJm3* zI;P=GxVXVf2ATX|elXa$D@)1#H51SY259ja?5T%LL~yGy>=K`Z^-WrUl&Qd^vh!qm zh9-D_*0_OZAadJ|rW*KeGcag;B2VL){ub4 zYM=7ph3YEo0xx?rr6f1k_E9*bYtE}p@)@&aRfd^LBlx%0lL3V;Z7SeiVI+>|lCLgj7 z$@uc&cBR^cm!tA#rn~_1DE#__gIu*`}=iYcIvyQ~OdRA)b$8X1#$^MDf zWCwpz(Vv+2+Azz{ee?+XTE_$aneB~yp}lhrfZJM7bg~o8jqNBK<>{Hbf55DW$ohOL z#SNs8{R>(`{}v2NSlJ;V)jNJ$LJmO%Fh{c{K$o;v?uxMMoOKGo2=rKYT|cs zfo(_Um!_gQu$^_=g)epWLyV}vRa>>w(<9!hc(U48;djvOs{y2PfVOAdT_KjNh z@qv8aGbGug1-Z>Cn#>DylI4l!YIS@V$HN8)da9D}M4R1YRqA)9&9hQ-%G>N5kr2~``PyC@bQAXg9!jlGswHb^?*2yO z&$C5Sk=NoM9FF}ir2;>|gaHVVXoE$Wt1Mmdy4SA%6%EMpu-;)`NG2=G9RR}#VmrT< zU&sEuZS~W}qg+l+OV!cV<$nM=K*hf-EwS?4+aLoe+~zph_&8Zf#^R;#5d^n2+wEAF zzLJ!DgxfmpQq-^uiQQeUTHyx;MciOEC;)UK%t#y@+^1hXi9$oG%nKEb5NqM8m z;ccUb<3P|oJc3Wc;T%&Re+A;+J$I7@&OwH!)z>?DUwGpiX%$7dvI;UM+PytdS=r9* z(>URiCEfxh*)T<6zHg4Fr{@m$?R%el&MT2kji;H6mQ)*q8?P~H-tigb!_IG*4RjvF zO7Ak{J!`3Sv?+;Y3t_Jo-)V4Ve16SZRb=kiDkKe%tUdY$jKw-B^Yx9 zXIO`Xgv_76`SfXy^rZvs`%d%cuDm#fU|=v;Q>m-foou_9;K+u+9&qGMzGO#2teNS@g? zS$}y+Vt9U<(v}LpFI;nVS`)AxXOF+yM5F+5`8YpGHQH@LWRP6UwBG{nC{1(jzNk98 zG4(@RmCMpe71DLVizIQ% z7N&Syccl9=_Lu$+5Pu{!C;T>T>od383L7PZ)!b^NLL9H<20vRKd0yTohUlO-#p$OPQ`!-wmGOQYW{?|-b}{CfY+ ziO-fq9Xyi%=!Q?>mi+omDWwh4a#}NI{)Rr;P~~&8Us`o)#+X9h{?t<3mUw?RN>1%+ zV~&aXjMVh_A|R9%6-Bs{k*gOzlO_{lmg7n}Yt6K#U3c(E4wXFjMC)?Q#@@D`-8?OF zYt#Is&2{yPO4WTECml6?6f47}PC79Aau?`df<5kx2}cnBSgOAI{`!YI;$19zn}M}a z*%~Js`!UsooRP8pW%=UeC&Ml%jQpagd$2)!tx07=Lt(9|M!+aXjh1ueSxfUgh9fCE z9+v7UZ2Q`|P5-E4hR)tL(uzqhcksM&THnmrchhxbALG76ba`6lFkF7xn5l}F{EJ^1 z)f->my-#kUPdh>D|@9S&pU zIBzcBFa@z00(mcLXQk1q|mTBlodgFBo!@WuSRQ4oy-OLksKY5}MU*u0)rRi(R z`qb@(dz{@=yJMErwQK#AXV%?(ZpDAK!rIzt=~9mO(Y8nZA04dXKR?}2d*XzB!M^Jy zBg*$A8}kA#T}3J%8BW=fbbs@x5iR!}^p~yDEcMT>s`63hJyWDDNHJJhvN?S{MQzcY zR;pst>c01T9FLNdHJBsga%_C_Gxjf$+Y}fTXBcXxY_Ou~B5%Fy5(cv4kLKphwY8r2 z_O;c<;XX8cJ$=gOTz8~ZenCX@%~z){e>$>%|FSddDcRF(-U0`}FRJtH^U`g-A75SR z%i?}~JKCnqKT+}A-BgqC@_l}|^W8-AkjD9E=DU{N%J4ed+$3l9naSn)?R6UaJm^tY ze^gzbddx@H+ww)JHRH$ky=XqEx96~-T>A+tLj!|??uvz0U%(3M>D7)+mnzP`dSLj) zWq+ijk_G!de^~3XBsVy}wCQ*T`OEv7jsm$U`X!Q5TT)WC;0|V;dDh+1F~g<)-G?jX z%6ij0Ja2_B^hRq`zr1aqb9yR%##AMC6^@>5s#9_#Jpk;WA}MCq9`*{#{3n-FSWX z?%hb**4o_r{1=YJ^#zMhoM10!`H#ZUbpJ(j^xjc34O&IJ?_2F zzQ40EQv1qhuD^fdrHHOt&9xlabV7f1&Po}z?HRA$)UDs8z3h_Ziih?Iq>!g$mBwlqnf!Wcyb42Sf(!QNDRX)U8l|_DP>GWT} zFU*d*3vtrDVCWNilHa*w7Ujf=6A(7g8ZMLbu*W_z+wW`S>#{u=@dR!gTi-u1^)jWJ zdno!733*VOWo}ttF|R-KX1T|XqZyRs{c9pG`c>Ndw{MrN{n}?P*c5brWr0KFtROSjGqNTp z4%A(WpiHm|emSXe>p{xcv0rNb==V6LzIBT1*LKD|?&N7DjG908+c`+byI+4(5jxDK zEa2P{l_S2#xHn`9P2|RmSym7!u(4SmyN0wd#E$>@ z?i+^NJaX2WzM5w7uLVq~o2i}tNz7k&NG!6Gq>yms)vT&;*!kCBxi zF+cTp1YZ8wNUv<{Ax7brS7rIyZW=`K6suGf?& zS!d}4laxvZ^{4G_hepg?psx1zn$B3`5}Vg^$4r^H`cwDmfIAE1O}9zE27%yGj?C+E zlE)cnqSNnlXPKDvK5(%bzHREUt)4r&rs^QC9%oDMi{dIB(W4pK%-?Gektf|FBcT?f zYj))Q4V8SeIV(v~QJe!^xah#w>M=@6N+&WiE5AnWapI2DPc!p4tZYrA9japkd3t2J z*}P-%4m~%t^Ko`ktm>E7MH~HN5)~IVE)56^8l~y^VKT+|f`*3umEIS`WBIk!IpGq^ z`#<%J*zoK?tjfD(ZyF>dqo=5NbbYEmvQCMU{bWZ^n@hpR#_f4|)o%#4a~?_$8)n&6 z7L&8mAwg!>dqZ0}-lTK&e+2ogS@Wf7n^k@0;?rZ|zL?F6He^2iRNQ~@_eGPG7I_+c z=`Fuu6lBUYtde@A`$%nAnCYGK#dmI*=x9hiUcFjs(MiRg=44vs$LVT~xe;cMC#|i^ zra7?LZ(1ueuU)(5tDlv(0k=e6JvY45f7!D7&%Iq&pN(Nv1g%Agj0~> zyKIdz4%bc4&)GQLbR=Q5+!Fl6#}WvU*nCy`fy$b2I-MTf)Htd6&Wj8!W$&FAI1QHU z+T7e+M@5^01jF@EfV zPG)7cdT7a1RqCr2b;A0Rt?foM``Yf75H~kX^8Hh8a{Hc4SgN<9;7NPlUfj))2R^>O zb(=;{si>#`qJO~PcEPO}*Ik-67d*DV2O2<2Jv?-6?E&cY3R{!_Mcx32E&rx7u$W@$RJeIX2~m@wy8U*2~tn z?iL(uo8%X@eaDUo3JTNtQQCqLLG`hZ6(6#P2j=EQDL1mH|CC{+xZB9;4PcKfG1OtW2v}aqjjyub_XQFx~EW^FG=oNa` zmG4I^eKsZ`-EfA+`OV$k-5@Zm%MUX$FvwUt+<`B_biOTU`K@}`sX3>P9u4^LrfyND zpz?%g`q;>2E98~e2#kW~?KL}-dA|MN^cU3mr{veU3Isii{Z^+WCy$>zIilR+!}a1~ z!SIr_^pz&_%p$YbdkiNpSDQ1ZEx+S({>y!<4jwv`R<_a1GD5SSbociaH{#utt=4=7 zY6Yi%BQ7siIX_jZI`v9kSwcdB+*D&%508gHG29N>A31hx%BT^ip1R*3mPXh#MWt} zHaN}Pk)bQr5@*fIICUzgru{5YJ;r|P)Ql`fe%+d;lF@6|u2of4ZLdpkjvM(_N(c8W zmW*RKNqI)C3NEx>>7G+|CtK~SPMWG@Bunn?sG#@&O@{XLiW4WQRdZJL$c^uNyWx5C zSF2#3jJU7sYGS`inOJOgte+dV7YEa7ki7V|oFJHv7>AI9V3OQGl#Oz!e3Xv(M<67M zE8@W5@c6=13CK)38p@=h7QyTwE;VcxKIMT&4m_VtCOO+>*(_iG-*x``ug?E7*>p7g z-%$G_Z$+ieVQ(JqnzOA;l zorfLbg%w@W)zU#Id@hs5*VZOE6JX&V0)x*FHr3V+3k%Z<)7Ro~1GPQewZmaYy0E3_ zttJm^rbXw|36?`s!i&lWVF}=Eq4*)1h%JZ95%8I86mj9gU&I1^apiD@nfk1G5o{WR z%VBc_JcI(PEzwXOmchhPKow__7k0{GvR5Kplx0ES@grC$kAb3mf~ZE(Ai9O}AI#;f zKmmzx3P1t0XgnTaQ07l!vBUp;d zoCz5W9{pQwg(=zzmK5yo&$Xp)z9?<>?fbY zjUZUg7ryzq)-*0kXYv67w!$|**&1pV)FE5p8{|h!G}j(j^@00CIt-$+1ymN+Bf-)M zyBJbV^dF1Dpw{Y4Hds*>=!GnN!(<2kjR_6yfiDzvOn%9Ou70wkFa}tX#f%8R5){Ey z!0IP^5byx`1WQl&2N5aJPjvuShs$9JR|mXd{ezDF=^}xDP*^|@6|IxI_Ql( z`3Q~5M*LAI!qB(Id)T^alU)&EzBHZ|LWT;D^6)>}C~08R<1&GK@HuQPlrGR-LuaCa z9Ju}g!d%-_7UVRK0~Uu5#M5(vwt0COg6Bb>4@Q3(P@4`tF}&Q4KPE^OC>xmsaz9xTl$n30H0Leda% z!hWp!1`lRQgJf_~UN8r)CnDbRIl+)-z`#JpkRI_&b|_~hDx47Du&^Z^Dx-)9z)E{q zKnD!PVj&>HWT7y=!PXt&1b`2OW58T^c+oT?I09^WFula;g8UtCMLV1tN(DS6Sb7QH zh?xy~Lc^(WWD!pxQwO9afQzDl9Rd6>Di;-VNjM=M5IW>9gq-zF$l(~UGLeCnu=k-d zE8d6Ulj6NtEVH&);Z8mRMGo=Mf9|EgzF51-!=9E}!5=3Bp7IpixJ-V+_!#YozT&jev9-{2ZOYL)Tn&^8GfA5vwp3s&0%0a+V0RaQ%@f#02La0EQW4NiFqO-P_7vEyABz7E zg1d#-Eo6|Bf`l=cGzOl*VF6_V^a7I}9KmG zTRShL%=-bOXhR|ZExZV$<6+txhO&URqiO@j5AQA7zA(E7)P=@CIDF`fh!`$5>)e4& znF~!9w&e_6lYeZK;UtDw<+%h)cn?|=7L&&p5-XzXJLgO6Vu?Jj?>@x>-|w6e#v>@o~5`ZTJtda%6*qDH5TMA7`u!zh-CBeQ$c384HJ!4TlFcYBZ zh_1e=uCA%R4p=skjtwaZCUnHU>>TD zWBfDxSI6-C`Y(n?2715n-~Ytxe;EIj9RmIiM4P{W++RTMzaPl`GcrgJp}Kz?)Agh{g~gr69o4jJ5D&KCI1%u}2tF3gIIr+y)`e`@=B<*#c}Z zaYOCEV6jl1B;>+(IJ`(g=qMM=PlyTQMQcGH(9CZHVY+Ye?|31i_*jT|auIDy5jZB| zoCai~85XKzbPtukZxp$r+#n`TjG;pw1C9i8;kN*EqELK*h(TvO5G7(F0c8i}@;Gcf z#~(W0a0RK@nhAxG$s78m0F}q%(3sdstRc&UhqZ2C8gxJ%fg)-_z)Cm*eu5Pcsh#*E zv3TMK85-gsDH2OBiy6cetq%5;3}gpSqyt2ZP9i>tLuUp=5D{Pr;j}Q#<}rxy>n|Y; z2X68(b%!fSg!9k_qQ(=Jc?|{z4KGqWF?B?tLEu2%fbm5v!p03_!18s2XTs#+0|Z<) z7!t+W0M+4fuo2k#~HamAX% zfMx6bQM{0EV0dWC24)5I2~YvNDmEY6AwW!lA(G$C_M7~8%qJn@VpRy4g1EZ7EF#;H z>=1%A1zZz|$YQd`d>2m-1U%tx?d;)=xY#4s&fdsEva=l#Px5kgCs8Pfi#tMga&;t= z?1%{2+1An1j_mA!*noDDTWDjp5 zVo&yPhJD(DPOTAFYj+Q_t*4{4JBYX4U0o<7FuWb!*~OXcY!8c}kYJrCEift=3Lz~5 z7YJp(wWA|86s%+A;*Qa0>*DI|PIj2@fy{Stv?IAw@HQksnYE20NjMakl&zyR*@=kQ zSvy%fkg!%Rpci-SF%fl(=aaBoU_5JQytS zCsQCp?A={J_mG{S1>~7C9<*~N344L8Muw~icm!U1Qb^xuu_IYKg1#t_0&oK_epu^= zXx;xgymK%XCoIn~SA=*PYs0s?rus(UzyA#4iT_mq;{T`DU*W%l;<uL8KDpvLf&hI}sm0 zL{N4p6WAz-Zw)%oi6?)5Tv3F?eLHl`f(HX5kb#+F;3%Jn_zQ$MZV)vB38S(hE`%2Z z2Xd)&KngZVRs@2fp~AjI2kW#D8x)~pI1>iXVn`6|gGPmB2M`Z-`yieWA0KkON<2TF zfX09)fC4W5RqyKVnMnc|P}lUQBea!lfoU_kr6}!A%+ZW!MoLMsO@D*%6K+WfO(QQOPrwYSy z3N_Xstbq8;UNKAe0Gi?ztEj(6xQ=iH%Bcbvcz;6;a+%dR>{vFIG&ULswrRr_?WD12tn6ob$({Vpfe%2;NZ9o=t9^EH z!6D3y*3F=$moZ^AtK39^3fM{ZDp^rQcm)87BW8?}09 zC9epmj9(e_^#XkSVu2)e3{YP$P+O8`RCqsk~646K?(YudDOSPfaG`B?-0AR5b)6OSf$Wf@S-Q(|>wyhEY|(&Q-EULaAB9IW&h zErMk%C%Y+U#Zkr2k_3L1}I_1H`J!K*n^jCcz=RUDqff3cj;RITRd%m z!w&&hGLn;92q={*Fza;I02?4HPzUfOr%$-v821&!)}D3iG1{Sd+|sm7f`6C3K)mRSO9|`5kGujBqM`bfDnW_7m6jcMR^0I7Q~D8-~#MW zym08ED-GZ^@Ezigm<>grFQdddF_8-JP}TVu;U-287CWQ!Y$*k+L`PhS&=T~_&$iPT z(`&-bjsecYr_x*2Dxbfc;sxQklTn*q@4vPdBuB=MzzS*vZ`}hm59_s1o;CVs~nEE_mv|D#7@% zCindk{#W8^HK-v|O|9}}a(TkX8Id6)5+{x$RO%EA81_S9R0YQXXGX~hDmVedg}Gg( z_wdX)tkR=+1v>_vk!y3tz*M+PF#w0)jbND&2?EuXZlpsx^<%vRHOkTkL=Og*P{Ms9 z6PuF&F-Blk5xddSO)t2x+9KLg{JIdBoZ;69M+Gbg9)+f+ zH6j@3ZL|C9(3YudWRzq$I`AbwKCrp4-cD z;+m#|O*eUY5y>+f)y$Flj6GxCHkELbDn{n9ftqcbA`fL!amd-AaVke2?(jeMF z88Hy?RDukMGH3q*lo;8K*o>@H01p}3G>(+H7IJ)$YK1jh6v8gSvU&}bj9paVq7|X> z0}je3;Zf%fC|bFl+hobalnp!JBn6#qVIdikmZMxk2r9xw6UGeA2xvs?n2J<%RHC)1 zl!a^g`&>w`TE$!q4NDrnrqrB@BCM!lBwiG{x(Ee@7{KVBQ^%-iF{MeU@ulkN043gG zGLwO4KoH}u(V@@fdTgIST%#*R6fS&e5m1~CpjrfYa*2=3OLQ0xxd4|I&Z7W2uW35h z;43L1Sc6TKaj2uKn^Fx}1iXOc@_9Q4xQc}gkBD+}NW%cwvY@FTg* zG8Hp24F)wc6Lj&+2Zj(|Q>-;`5?s?|W+D7RuU9Y5hEC54!>stZ4hTBh4P2`v#8k>f zFndJ7Y@&RkG6B{uwmI5`u+hOB33bPbsuKFOYQ|-x9;rlBH;W|1K9JaCMsUfO4TmgK zaTrAcNtb7S9c`#ha-qX82@eG-8i%os#~S9NEmJf$M#Y7?S-~4Kb}Y}UlS;|0nZBNa zykU-oz`l{AmPpm%EWvNZ$Asw~0NxG3&V*_sj9g75wuV^K62+@QuOQO}KndQYoA3&K z9m5vc2?w#HP))r_lp)#%vIN9J8N@JTv^j3T<~|+313<{h??L$mDVi26DM3?06cSC{ zYAq~$m28Gt&5Qh2wQn7^x( z)FVaxb?SwTpr0FAlNKoyjXhHC!K^7Dprn(f@k*3nz=uBJ6r+fcT6^pgog_p$VZRlF9fss*m?!Z|6Ty&QB>eMaHQU+02 z15>@8u@8#6z$sw_5rimiQaVH9oXNnoYN%5|#Ca2jHoCmahATvB0ov`ivjF|AP1YKp z27GF>|1=v?{JK8s@&8ZkmJ%Og|Cy4IlH6$jc{ZL#`_JFn{)5r_k1+iJ+!dDl|<3>fx(=GMSlX zaPSoNW#kL0soB>itoDMTBZ- z)}&9>V>SwwIYQJ%qwrmu7S%u0POhHdI2_Jpa|8Ms!xyHz@G5}ZP;jj%RekGvQB)Zl zuYvsrYalaR1b$FWI9_v+vsvLf12!nufaCfi;@mB;D#8HBU31uVI@6xfYZ4djF0>hg z{yDnN4nt-Y;dYzp(#%6)+A`XYXp-1Sk_Nd7siGq2C7}?BfgQi+<>qUV24sd3zm8#V zY3K_N^ok(Pj?F{l)`+HDbBKnF=6&2ShG8Mu4Y)Bp9@RrfM71d5Vu(e5;B6V~g2W|^ zqTBVj1A1)S$YF#Xj8a4n32Me?cE1NdT!6$5hvO6wm|x+Aq9sE|fr~hKV81a8aR~eo zY^;?(4%CQRlwn6bz$!q~FJq@>&7yv>9c~Fr@D3|RnxT>2k=atMELz@}O|&A~z3~S1 z;Lw@GKnv%j8|rXPu3~7?F7pV+Ol7O@Lp?GB-v>}ozv zimUStEMj~_8v%{-0HJ2gl0FfQUZ9iul$?YHb!XGz1X4eOBiTnYy+0Fk9jDD-lz4(# z8M)P}8y$ONIdVL*b*b_rO(_bZd4fX@Z!+3&wlQOKdcOs0LRv){j=LWq5=QDoWxPCd z6N3pP)PPc|rYT4_eDt0IzLB6cq`^q`?s$RV75p8y8#t9c8}Y)mZeZn;_0{k6ln`VF zl=b;tJV+65lwQA(Yed0p88+H6_2H426>p5EBSY{ss}|PtCzKhMX*Fk{Kp;3J^|f&LB9%t#RFe z7zD+%NY}^Isvn7;7IKvyW|nERc*~QLoLtNO4|ziFf0E)7lPq#_1CJx(^C!RmiMams zw+8Fu)Ym^bJ}JI&{m;fz$NDqoEvWq3KI)18la!dyEiC?fx5oHCXXS}$*hh+qkx%;~ z7c1lcdC231_+Jy_P0AyotGhxavlRFQRckBeVc0P z2GiNNxtph{JGlx?{_*|wX?o?5K>$c)Zv0543YNSq;-HDODwMCPjrlfscrwn}RG(=% zpamjSusl?{peYBv0k_BKo`XRiJZeBSw?iamXr+rwtprG*N~8-j8$@>viEfqjAdJAT zrILuRswvc~Yzp;C_Z7>?Luwe4@yMr?j7JjNlm+P|Az5QW0nXy)Jc}qMvRRW5r>3dF0rc$6hkOhGpAAllxW>}nU!Pils0@HP3(SA0MxY_ zHY6{S)k-JiC$kw#oHj`nJ0KngFtGtiiH;sG3R05*C`;%nY{d#6>_n(;kH^+vtFjWr zbJ}XPvVK`>@D~-N~q-?<-k*rd=;$6swLLHl9Yxqc{H_q@b#VH!i@hXY+I zQ9PPTM{1*A)6&ShXg*@o%%C2fSwukbahRYbN6QE=D`26|Z=)UC<+!kU8>;A21_V&4 zZ+QA}CEmBKq z>|*ZN5>*%_73wiwWteD`zH4p0qH(_^#gOf5-n>vRBeS4aes+Hng_YDh#lsky7?_z~ zfYoKuHOXPLtrk|ZhtXSAMTQjttj+jsdskoJb6@5 z4XSzsjM0iGsB-5njhq_|I|+)B0`p;WKrbwm0moLPEGlB`c*ARrBC+w+DE$R|MYA)q zR=~W#F+5f-EF@+vSV-v3-Cp2qupvGIT9`~b+GJ4x$cAb&HkzTN#BgJ51^uC$k2YOv zd-#Mj#tBlX8X)5^SKtvF*zb19aIt~g{A4CU;l#mU?ml$3v{b|ihK(D@Usxg9SHM>p zN@&Ao#yZ5Jx2G|bi`cKRZzw&ScuvA7BNl{ihLW!Yu)fN$LPmgw{!IXEwZeau$djZQ zXfuIrxms-pjP=E2%SXXS zRY`yuJ`^K38Q7s5ZPV}xVT=$KLkwRodNdf93(j)893Qq90&pOhrfY_+n0P2=gaVzN zBYuNnLD))=-^Y)qV_+4K7LntXj=PZG=%on~LfwB@Xem{9YjN=^y6>*33L%!7TugJ* zVn7X28B6n;c;$D0R?1nS+C#*c4rkFc9~r zvgL0AX)}y%KwPRT^^a+3QB>rPiY6$8P2HXr6(#itIExDv@s^I|RpAPj z&>J_bXx<8(depiV$W0U*6n8;1tqex66Yt2*OOxaELWnDAa-2l2&L0$`O=$qSS!B<~2%GhYUbH&s7iBm|ca-Sd@l zHN>Wf1#22jLCBHB27G^+1DbRBDs1s_anW)Q`C9l_95~immy!XQ4x2ChsqAe6je0T0 z&`l(a!AK)oxcY;{S)v*cm%i+*0J$_a`jK0yPpVKXp%f-gYdg+``oVHFjL8WdnG-zJ z>zg$;MM@CPBXqvx9$TNR^&~sCK^fT7JeB|}r@Eq|Ig7-4kEg<;HDoXXjwN-OUC1_F zUu4iBQ2Ps7K3ZQ9rsLAXBI?fa{8re8xNqm=(oS2V+ElR$(Sq?P4-{4qQN$=;ScwkK z%&U1yc!)b)r9g_2Zw@*lQH1h-2of5~F1#&4QmsrAfUU6MrKRcH#Hx1}asrt8HBe~5 zfQHnQYpEdyOCc3HRO5tc31d5k>Na&k+y7hefq zIf*u5M`@yPlzCNDEm)!IZBl)kOf{O=0yOU{XVx)Pbxj*#t4IDw!YdROb-Y4m zBZ4KREL5p9Y*N@lFiS}CQQTPRXipE2u$W5(>qVF<;6bcb!3mj;-pJdB8tB{f-mE5s z;Kz{F8WY3WOtviIh%z04EX)=M1dFQ0*(GH3sj4n)_5tV<4evP36T=YQq85RCH15Di z%?u)kY*;&t4T#)MLvJ&@@S*BSD$B>}HnMKN9!$vKnbFWA5HLBJ+fbPY9yA~gKhj{w z#5ss2g=;H@(w~U>tSS5$f*!QYnFgN3VMroK*lvxIV7sykZ-UmNeogZa3p~ z3?-Fk3VLWQsoOB0!Gord_Cz$?p}Q3U2Vd#74`}584j7sTl~J@-F^_x;6k7>;0(5^P z)q~OwcuD?-#s&GnvxRjz6v_}CDu%R+L@ZeMj9mQs{z*fpG5}i4rgL~+5K!$5WM^#Y ziGLgEg2WoZh^~l>gsH@X80jSWL*pJ@0qsnTLm`78w%{a^EETqhlOEs$jTmFpdE%G~ z1MC`v1(Y$}9U#XJLIArgV5)@hOG+v!;CHv&mFOP~Vh!-yu=$sS#G@WFUBBV_?utm@+F6r=ii?uNUI27b_u&f}oT+yxfPK6ACmxeE5 zA`)yv)4nsnHd>PETo@|7npcKnOYJKopVrcJZIFclqRSy5&VLRz!?zHy>0itMW0b-$ z=jd<_gvQF0g((j|2Z-=t05+M9-3UPThAAjakvI98>)H&%;mv_0G!JKDw`PPyfkZnb zVtU>|kc|Hj27CMSj3 z|EI*IG}`~3jpu4=$;Vfny0uU{zW9XLxFodWOX!}Oa4oQfS~2Ejz!yA+WIkCBKUCDPofy@sh+soTN(DigFi7xiL`D#_B~=l#{H*m2w2L^9Th! zUO7e!dtXNtd?`uA9#!$CHYP5P@YK5h9aU~`1NBkg{!d5{? z$66y8Tsrb%at9C)qYPl76UUrMZjw4el#CJ|dts;tgbRmQ6dM|0meNFx5atOL@Gd#V zO`#owUJc{wWx4bc9Yqi0qV%=mW6Jea5m%+o6$(iLL)NHs6bGn2E4)D~@deR}fF*h2 z8A$P~jhHh910su6|8!?obQFQ?Z;jiHPyJ6A{STm=->@Fwr{Vvdgz{gb|L>W9YFYnc zAJa89fctNK{C`4XQYio5EhV9m|352FL+kAt!vB{xfZjGF@G_(xU%~|}iu;fny$|d2{Q7;leMJB}gE%yvo8B*z`!aBc zFvDy^9me8_tC+6J4HQ?Bi%qROkj7RNUg4W6W~Y{BFg%1el65?}$SCA_5bH8^s}i<>dLvBbC` ziE507hNKvM10yrsd2)MRVV-GlmBd-6xg18LY-2ft$tn~i@3_^l=#80ALMuG4lIb(e zDr^J_tP2}5FNpo5@z)&Y%%aLv$mmVO2NN<*a)U+}N4JS&Yeeo&erp2zJAZ09|MA}j zIs5UcPyd&akPv$Q!@I`w|7<*HT}p2Dj5+mq9`;NW0;#bAbNkO{*`W|WWRxdGhD%P? zm}3YFABnLMRgaf>hm^6P%Sh*l!4Y~&(3F<6MG_s3*pc%nyx2U={VnlhSDd;bx9op} zOyoRXL8N?pQREw*1W|T8;^X3g%AZuqa8stOQ(J$-{>PZ&02Z2ssUao6(}@2Rm(ZmO_wMbN3Qe>eE8asAK6Q{Vct&>GsWNds07 z|CgK+7sCG~#HA!Q@_%RL`Hk~`Sy}S0oS@PhaIb*i-XATISHorU5|JWKC#9DOhAgX> zX-|vnUZe+}%;r?me1$C2X{7tY>N2e_=eUdf82Ot=x5xXW{(fJnU#X}d>B|*wX;3Lu zPb<@xwT@I@A=AK=UsjUO2f$fx#xJXtm#wulN%Dp1y&@(0s;gdY3BKy8Q&(cIy6V-Q zh^wwzwI|@JvsPV+x3FF;gFbt4Qu(%OU5HankX26upl;-770yJVI%bG~Spb@PNV71$YZ93}8?#vY~o)T2I z=sr@=D%x^ltdlaTAHmjH!!ne1z-RiE>sOc(g_Oa-4GtOzMgQAjQmN2~DR^kKmNJK< zb8KgagIO`?4|Bzi8WzB2N+LxG!x2L(I5GoBY$0V~_QbWA#BsrL(bO9N?;E1RqDEl> zM+GLh$3kK?B20s{&0!YOCo{J&KL|}kBfB264qZewHYfu~Bf!B>F+4O`J#oT>5{u}n z#F$~V3<=!-?1=zOA`vl`4*5~_ffa} z7ayM(9~UbBCB!${|DBbmQT}U`{~G1L5c!YIi;8^g4=!%Vje_5wL+~R$3?!v-PxjmI zTVmubnb?ykgX|HO4!BWxG`02n5gv6af{p8xgy&5*(Jz|%HqwCskf6r|l*fiZFeC(5 za;YFE`YLJqV;a4$f&~krksM15@$pG+Wm=SoUK9&J3}ta4S^7l4a<5DA6C;0&utKFQ zXhBGrA;b3ZEFYEJAgxLv5d|>Zfu@l>i$S0yeh+ae(8XP78a8s!uj&${F4Wc58vv=q zuVVa)l0cQh>WW;h7`9ZZWtlztGGk;@oL;gcp7HcrH`C@186$$HU1x+0&S8zZSF zKs$1F04A=<`kIhb!M;El>ne^Waj3mp{T#rK^|K%{wrIYfzZhhF1uYL{UYDnG1i~(z z4ox7x5=4`GV_8BPDlrJYoLxe^KxoEo3@Q_${UWzl@w-*x3nuy^&Glqo2>1aQjs!Vh zrEUlbk|Ga+vj+1rkOry+bZNML!>rkKi5~-Ci@xYs3_Fy`U@3IX;1$Ou4nZ856u5eF zPEm^TREErf1KF6!atn4s9(qG;-=H@Z1;^p$yn#{}DMccrxRgq^4Xb?qaKBvq~m)TY-q);(!ZpA<_UvaL`ok1{M$JRPf8sKhu} zsA^oOA8%hdqh^MtQZgs)q;)n#F8<~z$nytA@X$E6C-&dsiVRL4y{-CCK+!b1JS+!ll z#6F!=1+z9?XU^~A^i_0H=m$;i6Lf2e=JP0c#E<~bG-YWRv8+W9G~0pW@a+4) z!rAWExYeNV76KZ!P%(=x8tGg(&sIvsAj-YOCm6kDXa^#E@`kiU?rm@AlRr-*Nq(EcgK zic76<7fUG3pevN>CpnZVgZ@e%DlV0PtQ3LF7{s)}vKKYE8qMH?>P`6H>y!MxYB(F* zDoGX7CwD-M2Q$T@2NfKpB|tm@LB|O1M@KPb84Gyi}ja4_qx) zPmRe?HV+EP1*8-~F+OvLlntUD<1eYqhpK1*GSLOQ17#8WEcFJdPJva7Ev@9Vp-=xD zDoBQb9AlWU#E;DN+T|l5kD2${>5JJ?xvEx%h}RMtaCwNJ?*cZ%?V+|z7wAapXgv?7tH zNk=1@bu{v+>S!ncLz0v-EOV)T%v46T>1;V&Vz&#;iyzs?${xB~eiGOmTe_vLY1qpc&K6 zh@xq}VmG<>F)e~bP7ch83{<3m)rg8Fow!tzkCUuB|HP3{GSC^j0Y^BF!dkc)AW4Qj zgo(y5-cH78#~=&t5?C%Egg7m-k+m|re%S;sHL|-A=yse(ECw-9Js5Dm66l!3wizFt zo$h}h!UpUNuOFt})n;8YXl($sjN zn}Jaxj18eLF8c(6CrqJ8l_=bxd!$@qR=8VW6nFtg@~q>18o9X(nXO?1Wo60*dA*&3 z((^Or>;k!ee%`?BjLZxwJ3kMaM{q(7gjucx^>Q<5D+p@Yv?5Rh{~l0~sgETiGd%~| zD!>uI3yBwQ)I?HEq)|^rbdlGdo=s*Q%Eg4srIp?5vD@_&E{(Z_yO~%^7xNuEip6%g#u5j@hw)UiB>nAFcZS zqm5U{9Tn-$Rvo5w`D^bbHo3dpV$qadn>I_qMUM^~|I!-mQSG*GE5?pJeoMvjtpl&G zSU&PE9}ZmbMT^#Q(=M_+<2|`xVw(rsOn&e9@#3)sQudLJZ@vHBp&y&)eLQym@*jtM z*Y5Mf&sC+zwYu|$*{PKU|84Tio}Z&9Mt_~xBqx4?G~#bZ3oHfiwa>A9^xW|E>(5Yypv%m8^XB)2wrwH_z_)ptH+)@SJ~spM(GXdc&NYPBU^B0`7L4Ng~E!SLf$*kq&AGMwOfA7Bg?x910i|X@5%yQ}E%P+tDuAUt%kI$dqAvt;L#*N<3Rt0zN z+?nG2w2gFEj~+d=Z#E9FUFdK)nl+uja%J_15pt(alQW{y+a#54yu#=E?&+tySSIFl zx}Zg~)vH%qt=1P`d{I%9ty{P5*|R69UB!qIUo3p=_S+8pYpt{Mj~9Kg=-is!2S5Dq z!zDvsPMH1PH=7>Qy3bv-$kyVouf6u#L-xUMkASThNFBZ)|Gd_%x9mCe=%ZI%(Yk8i zwwQjcn%*(7=X{H0)vK>=9T|jHpUG(3;zH?~`1s9RwzQqR%lGDgSFBul*@hJ-ENz;(A35jTJ8vE`WJrE~&xId!XtDH#7hYJg;-6n0*tTt(W#S!oG)bNJ+`wnn zxt1HC^<~GwW+=9?xHVMe9Dc z3vYd6T=n6-TU%b@a4vQpJ$m$_i!K`avUly52cA6V1=qT^^ZP$MW5(4p`zn`CRz8N+ zdgs0?on2;Tb^P1fqCtZO4IMgk<*=*Tw7Ick+vy8OjvTqj*~RiWG{1fOWmC_ayz9B= z9Q`UD=(`|ldd<3Z>t1AO9Sc6|Ann-WfVOBZ%bULKXa{OylEI#M%z=BQC` zEK1ujspaEKmh3;cd;P9myE=5}(EW$BrGF_gIhN1qEw%`}YKnz4eyG^49wG_hfb4xl-$# zn%eIEcV2$!rC}@m>YB;tW!=}jSu^?m^{%BSPTXEvTKZMtRrfbv^TMd6U;J?Q3eU>h ze)J}etXY-1ddKovJI5vd`>S=AcA43IX49HYo4%>+K7aoFN0!FI1q$MlP2AB zNo;Cr>bd8f<9>V5*1etc9_@bZwH?-6)U|8Z7JqGXbn~7=2M-uM3wvn^n-sGBx90UwrZSy1|!DzNT&V*s-tnU2yQwp_i5}J$T^2;1`S5 zZkUs@fB*jJ_H!*awt*esyycdf-Ts+$|lt z-nwJkwt;u`-1XI0uF}%x7I}JB^YgFz&^5~Ei@kI8jmOUY{`fX`t1GX(vSZtIt5+*O zFPYz=+T(dTedYZR%=lnca34^GZu|Dm?L02(p?UL$JDo3$+}fqf%pIFIZ~pYt_rCdI z`mB80-&1yuS+jQSIg@uCI&=uoeERh1Km9buH7+43De&FS*J1m$yZ7t;`>(w4!bz@G z^WTcI&+MCgu>1I9FFp2HVOCbnPY=wVJsT#_q)8LNj&9w$J?Y#3+1MYxT37UB;;#Rj z`tR|_Z=KVw$+T(H{_&501cJdPmS>kNNlQz+_KN%Nx#u2dm)CDQ{PcnayXW}cu%vtcVJbCi5W4F!DIoI;muFBlpT$pI_kXv88W!j;^HcIzdN($&8X=~S3kM!P}ziIi-(mL7oTYN{>L9b{OF_iP5V6h!gr4y-uL=z zuK}Ko8g<~c>K`7M-KEtU*y6B9wmLP-#9QnGVK-0Qvu4fRORm1U#CAbU%oD3p?|AI7 z&mP`aa(&pg-(B_Xrz-<{@{5Y1=H+hMv?(?=w(ylopyN+J{q&M06-N*5 zex$?V{Wy^yPJ+z`|?cc7s=^=U015MgDO9$kf6i+H3syHCJEV zcd^rIdA$Gk7fPEqZiE58z2?r8sFp3Yg&*9zXSh8kyZ7}AE^65_X67eZO`L-U zY2B}o?s|K--`cEa@7|M#ISOAay6dsW+Rs?`-n;L@AwLIBTFZ?K@(&yxmy(jwt8nvY zX=C;e*|7DQSV`J(Z`a8^=O@K}r$X0P_mOH`<0@a+ckJ*9t2J@nJom>}ANYR6rL!`3 zJW+Jtn`P51u7vHMy;^m7yLQ`_3~g>{(W+I)wo?Z^e=BetH{X2o<=s5EPrP17t2ND< zcDUh&_LFyQKGy!fwwZfBdHM3&f7-Qu|0nnMU9e-=)LHACD_1Uo|C*n_bMW$a%Rh2> zJEY0 z^A{LIOiTZzx0n&p74`26r!FTQ(Chh=dIv#0I2;A!XHAHI2P!m&MTwhi3eOnuogZ1|F2 z4nMyDyD7N*$hWTt54xsLjXn1DoULPjbX+mvGfR`V;^sd1VAQPjFZ({fZ&8eL=|$=*?K6&$((eB0DCx6nr&80P|w_l%Xe{XpC zV0ZZi$B$3A?)qorQg0tLXy1+<q+OlO!>83|3wlB?G_Tk;ruB`BQ zmM&d-?D+B5Uw<8b|JXBHQRd%$ck`v=7B!!mab)M%!QZ{6-L!A-7T1;!5)XZlx9QbY z9Tnx<3*Y_N-)mvPl#HKWAN%ipajSmXv+$>hmWQ?ty`_9&R>#!fUN{&YE~)u^`}V2t zd#IE-x)L4Jv?IB?C9tNH$61% z%4Lh4dnZkL?A`+D^EB1{k9|kX(k8 zyze>BIp;agdA4(&=XBZ#7W}DGKz7-m^ltbozjOKwl|i4k&I9N;EvQl*Fu-2z`POrP zJjw9PIr`>q#1y^RQ@x8-fF8H_^SuNQ47_Ci30|24X<%} zzOlwY!_{?%g9A(1xN$_{+l%Y$tfEd?fk`btId(|DVQ*MoxljMfpLe4-w%?i&_YesG z!-sXcFPn8_Zt~8ZZyrBBwYWKIxry$Chm)L~UQ}NkIz9DR+Pm)Smt z{p-8#uV3jDd&IK=&wTo#VvEE2JM#mYRuuH^zHG=49lx?uN=hGZoedeVweV$sG3U0hWpVwJ%N29|hS%4a-9MjGT3kGDl)@V2(Y*(I_TRH-PcP5GFQ&Vu z8<{sw;PYR0+1IJZ)-mOckCVEySQeh0Haa#WkE&?-bg{Y4+wHeo4Yl`!<~r2v_gSMo zVS4{X(a}CWJ`V0r);sK5Rux%&r)YI@-?|33c}C2qWk=jk7AsBpE8phx*XA?jJ9GyN zqno2zcE&t7m}gOe^;5Wf`Lb!;yT*L;-qrP=jZzg2Yq6wDK>P!dICA93Cr_T#KP|6J z<5-71yPD9~MN>QCYH;YDCyz(O#%22`x~M&@JX}{)9b#s7B<)yUaYF9>KaCrC!pug;}j=ppArZ1bF&oK%ayDcrP8gO$rodHGzuRDf^ zSC?&1ou1Wog}u5}1RFDodxH?q&?&2?^_3KGnwluzpX~{W!*hwwXa^VNXOyNyOm-2b8*N$nZ zgl#TJ=zCRIGghSz>teGrCihWR<>CV?)@0E1I0JDh08Av-nMdE(S%7W-MzgxTwUKc z;Zu^PPjSh)PhTExw=mA^$8>kUyJQJqiyAjJJX5$_Tg#u=dH8_UfRw&8Hv|5oJ76{7 z3IlcAcD+nLG&^8%bA@7!iG4k*CF{n8u57(Zv(Yy-jZgC57Xfi_?V9!({`TdKkxovE z1ELM0dd@RSwX?GeJ@;FB`lZs+p3enfr2?Hy^xR@(pW912N0e;Y8TasEzFY1+#Ts3} zYKO+uo&R{^_~G(i2@`cjGCUcFW*-X=57+3E5FH)OF&e}GGX-p2)gBpz@%0uK2V4t> z^nVf?^2foQ$)n6hT)WlDOYr7O%U8jUbJqQvM}fwmNVD0ne0d?z&Q&cVH|*Gqf9*nlE@%`3;#no3-}$f@Na^HZ^~Gsp&ExD=VS&okFzSvuDrz0|KU}d!_4k z?%X+X`wmN00WgZQ=l`Cl-qqH&SYI`@YeYox3j2}C+Db#CRy?T#iX9Lx&r@H&csX*% zxEL=F52xMJEG;d86%$`5ucWko<;pAdE5{prDO4&iNsdgrnpei}m2J}NX<2g2myofm zxv?Kc-T><7hY#VNab}HOjz=}TxN_x6O-)U4aq+!-9-KGlQc`9I2fy9i+(RX|srL59 zfid%D2~Qgyl1n?b({j$2aV>p!w}b$*?5CgNv$M@T<*rnAvFXJL3IZziDRyDp#|H}q z*Y{6#P49Pm(vklAT%#M`-xwIf7{4%Qfr>w4$&S-sFAlprEhQQ24y=guLx-+cD6ofW z{}p^T)!5J8-u{}uiD%I`%>(=P*>R3;+*)wbuO>5d!=;TgXP(cl4G;gBTb;;aS!9-x+P9B`8wd{ zFTE5C*Q;7Rsynq_Z?Ef<8!8d=?J(tpRoU~NZRi*G@J*in=Ql0IFH&ni*YC);F`IuJ z*g1d~)Kz9Gj6X6<-7D(UgCoZVZuZVG4>2(Tm|nDh*RGyEk+BmR%3~f>oqXEugUv>d zqZ#QBUn+IB*>L{6)y`uhm2dV`v9-0;PIjzx%Q$i3rzs=C%*~k0?w>tfug#oxg+Gn2 z;^1&`eB`HdXR5s3K8$D2{g|N+^q!>ajbEGQaJl#6a`%90qG9oC*RH*3_DUeP;qns$ zMfKXe;&@xj3(xv6>_@p+SX@4qx6Xd?FzapO%;XphpgQ)|+_A&jGkfv*aoz(T|1~e6 z(8fSH-$ioRmu|4`T7y$t%lKabtjNLzNb9Qfq%U^aDK3tRec;ct2 zjN01TkdTl+veVpj_(4H-r;i56-MW37w?=r;AT}Vc*w6qQth^z0)M!e;vG5xS}h|}a;>rPni+T+UWop(1RCyej4>*^#YjaYm2K}W_E{JJP{(u&AA zs=}fBd#sP)k-?5rPOc<%)FXU4opx4I`OvDwSIb~*m2x|zXP^!07}^gGRKZr^nu zq0z1A!ly3XPWYP`{rppU#oNDj9X@g5V@+w?uo#^u^*#M>W{!yAaQ2=)J=)wnszg+O z_R#P|jl!0LDJictcTQw5K7AQ(CD&b%GdzF({7-Yc9``H%qV6#3nt$G4*XrP2%WZo0 z6e;x-wKP?wyt<(gU_H$fRYha+5ap-eSMAg`kN69m9|2mSd+&s=_ za&AgWWi;^PS5k7G&z0zVz)Vo2WL1% z58hfjzNf85Qdaf~y9J$+F5SppW6&)o=6z6)>r3O6SgR%)F~)~vI$xJ7-P@-rv?kIe z_?As?#`63tu$*ngZm0gUkKXV&=bAQ7G2Umn?un|+#uq<5PBXCqQmnABaK7oP+~8ux z08Pz)>gRbsFI`gqo>P0YJTC*WGR2iD$zK_t+UvoBFWGyRNSK zVpY`3BXx64`*qsodp>Su_YcD+FlNo#t7PqVV&RzCDV|5BjV<7)7-STm5S_@$8N3X; zaIQ(YWb|^=f}}qlS3l;6-grGKNzF6<{O0x0K>ud~|7XY2pX+MBc=dAd(Tu2zzsUo` z-7nK^Zo_BazDv%WDLp*rLq)}+>uE;4t(Jf6G4Q7PIi$2P z66afY@A|G8n|1Bx&6*c4GP0s=1#Dm;*x42R(LMW2+1kN=smAJSi?05%@UBrzu5jXo zLp6_XWnLUUeBA!MmSaM61%+{Q4n7E&r)*!+nDxMJ;F7sV%1TNuoTv`HyvZz1^^r;M z;B$9U)=#iyomi>C-3wn4vG~f!SM8k(Jr| z{<{r@Z2O6kn@9F-u-(^3lw}NfppomsIX;x6 zxs&DTIW)sBru(u73;c#}>b}-CeNl42tXU&GGyYT>r+D)8O@8+7Ox9Mz!nv~zBZ7}x zhE3WTpLzAw{hTXdRW~-9vtwdf4j(>TQ{(H|Fv-?q+p#lef^0iyKb@&p$*ZzT)_~H`pS39igtD?uaRhng}IJ_?_JLQ>E6aDeN+sNu=UCYwb z<-NS}LnoSb6zKGm`vx_5J}Y+vgBd~ttfNZ#(9 zXM^0M9RCzPjygD7!!y~hxFXL^Y(muiYqOOb^ zH{SY{nx`kkI~7+}zHu-~(M~qkJ@W2F#lY9Ey^RLFdFpq@cP-0fo02NfGxvryj`BOn zTJ%fst6M&qZsuPV~(#9HO(O{Ev?~f+2|HmwZxSzU+RQYWcZ;;E` zez==;%%pmtgD?F2uHLWg@X)H6KP&!W-Kh2SQ=O*HrvC3X)#V;LaYDt%+cmGndR?jN zq4T{H_5$1V(;ta)=`%i8%wC`O#mLpAY4Niwp*oj0Bqt~L>N5P|&gb3})@3eZkJWx5 zx2b1f@zO$@DJj|U@e3m(4JM7S+&S*ct3mqeX#>($2g!9BIOvkRe27q#Rs1m6a>wK6 z*UNxLVeg)LY)RCmh=S7H41gj;{x@A7{0oRV^fVX;1!q8WgZ-O7p3&!{vi?9xj`<<9;4p6;u8 zV;<*5A4@&4V7^Kp)!MrJpH^qak6E9y0Kf%YrlMs95}FZS&!7R z<8HH<%$KE)y84-Pa~RmW_warShC43RKJ#y=FW*{hv7)8WM(v?K>w!U3U`Bj?zRfGE zL-}&RRLBW`U9k8;&7-2D$Q}!9Xe?q34&hjuU z=JS-_Q&{%iO5^T-dUf(iLc&tz&Q*Ca!x&4>FL93hMVIjxFurG$>s?O*3$pp*xCsUW z&H`)i*I$1HO8qNM?=2%3`&<*Y-B_;B#Rg#K*2BV4U)_SP0s*KI>ySY zefcur%7Q;MN>}K6{WeK0@pw~aJo{5g>WMQ|x$MT=vk7tIe;+zdwfRh5>6n9=uV205 z7$|SrwCUC`!}M;yeYg`abLPxj7DKu(3$NW4QD3tup}w17fU=^aeep{{-ud6BiSkyj zUTt$u$*JFx0|%a7+c!mUKRb4t+qy(x%@h?0LeABM1p0@|b)I8qmow|w2SY1uoy~XT z<6~nNL`6Nw7G2)8zvOz-oN33Kmn&^@iZ|u-?A7JxA#U$K)j10UVaJ}T#KpzEKO15j zlm7h9wDcL;NtccfnKgDtLBWSJ53;>H?+08sSyNPAUYqmAyRg7gG0JiGv~A;JRM%hB z9J%|YLzdC-7yiqEa$mLB{r&R;N=1*-Z@+X*OSJxC5ZLmyQc)D1?wY>%>*uHI)~y?A z5&kT6MBJY@dN7uj4{Ln1dfDU0k1oBB;<0V+onQF1swKBeMf20h8}l20k*%Vl(x-1< zky&QJved3uZr+?Vcdp97fqobAOBqWZJlG9tPCu|};llVekwYxP!v`$>lpwI&IN!dC#>cc-9Q;#{R0Y@?!PAy?cRbm;1HxW!%rJE?%h|v#8qs{_DGI zl~hk{ezdOO<|dWi`RmqwShcpHqT0ycaq|Z2@mR0D`}TeQ{P~E-xobMTwUb{oHs)Sj zZ=tOnm5~v(b!+VQ?VYptU!SN}R#dd5)VE~EYXiS^)j%WzR%*aMV>@*=_>5;{o2i9s zWb{>4Rna4MGvhO)ftKUF94`9-E@7c4bynO1}aNe>d?8xBYX)Q~a+8a-vx?%1S zJtp&9OiON7R>Kz401r=3&4>H!I~N{z(kRS5=&g`6LpfyZy@J>tz!pDw^5oQE7A{(g ztXuMz|J2;voD=b8w2$AR)y&!ziDz8;CU)-vw^;xD({aG+{(}ZRfB4W)e%R=u(h$J; zgMxy91^amKtZ}iivB0D*jO+RJ>(`_YhSNPdd*v=l-MaPewQJr2!MKQ8551H_mrb8f z1j?I3)B40q9AH)T*|Pnr)9MA|f&Rhc@up5Kt@`?5%;O995;_mMW@2J8WA^Nbu(02n zYIBm9@9La-bixkK$hc~LbqeiLsNwBuIKIvNu%w0q0 zkN~~?iHu@kalid5fBAz4UdfJj2d=BDt2?|21BOkcrD}ZPTEXF&+R1J@16CKQB_7Pn z+nGNv_?$=S{Y{$&WX*kDTWdXazxwq@>ZcyPh9BLeOWE1kk(LjXE#4UWm38kTr-9GBOKxof!vbXfMxK_SskHyY=A)7h|L7fF+CX+`T)pPlA&MuwNbb zg>kqrNG8||F`F&=GdEFJ%6JZAJi=YReapMT>2 z{(p}D`~Kj+f5QI$3H$r+4*MghiwyLWO279{(zk!Y1pjv?eUqeJ*nlMc{*(Nz!^z+1 zXcez$hz0SgCebMsPv?We+Pt|KtcRj{$OKzZS_!B;YzmW!{98V3Ay=q_Ivhv{E-D-i zb`h!waHx3T6e;tGqm>FvnLn z7%)?q+0F+d956zJcoZdzDUg(nr%EC^g3>Dy!|RwDs*i{5LMadb>zd+e%EU{bOwxz9 z1B0DmWGTdUJ8AnAv}ifk0s{&9Vq)xYHZKry4R$-poZ3xSNM$RO#XD#+85W_*c|e%>?V5bVM&bOUmrOnMc(N}clwc^OjP!zF5ySXnJ`t9TBAU_KN0%lL z3Dh7Uhz*W-M6e=$RWNv}g@P_cc+fSn1=)eL+=a4mO`)2phY(G2QXn(J2<{H?N$?n; zIzthPpg|snx+&muTlELL1!a?zWvM_>ZQjfy7(hNI%ba((QtTxgOi#7tsCSjhKV%ELIgPj>?^co z$98~g350qO9+|O`_({vxXpV`MHV$2bqvs|>rGdKB_A(%s0^mI}`MgMsP;YebNZe3v zFra&skq!>H@_n03%!n zWB@%RH9Yqs3FsSR1wHyfW5vgYcTd*1@Jdj;^95ijv-wD;>R>l%1o@4A;#4Z`7?n~$ z9GVWedl-?Q6J5ljMXi1zrO1h4QVfe)uLOmVvR3LjbUaBt!msP4G$%>WIF||L1xq&o z9Y+N9NWJk61OO#p0X``>`#Cw#hy4CR?qg zHdw}jV6G0*{e{6?l*EO&D+vG=>QU{>SY}f25T^x;t~G0GXCSy)^{t^G{tYk(^pY@) zEZz=Ol#zkwL+HF6gpKaemaN%MGhqGj{o3FdG8#a*#a(I`S+$)OguJM4!pA{^LNIp) zP-9ST;&x!7wf#+$qVJL*!YZ!$AI%iJDBGeEpMcjkPvv#jznfUFO1OTr4a;23BWI)8v+z?i`ElOHwq%4 zJrRbdCc;%5={2UsecK){Zm z-UAFixQQ7C{sYs+FU;SwJ=4z#u6NKa#0X#pDJthQ4`mR8S<1*H;gGmcB4tZ%kTuNs zg}bsW^}$aI3bTZ}2X>0)(m>+QmxmiExMC3s#S3AIkWqoYo$~~Cu3Ws2UdlkhfBrLKH@-*C#fUZN_ zRR^<_6Wq;L6lejM9)ciYZR^n2P+R;@l4G<>#6bbyU>xWrrUm}M!tDtKWIjV;<#Quw z>j<}rX|4b`a0rjIra*DYHUDE!DAQr_??54WXMs!-p({5Ca9q3#kvw6Tgs5mA zk^iL#{1)!ebp~zW4!xA}mmvuQz68N9?Xu75TvA0w9DuIOB3VTUG}wYPH{}U&#sOWQ zh&K?n6wSXu6~?DVl4TMTMDbkwwojUyj4DX@PT4fbOmcdO&cjzyt{#70XlocjvS73t zHBQnKAp63R03AxeL=Wc?Da-I43NbC|9S8AIE0p$;)EB5-C8-N51VHxyrO6ISI15|# z3U*fz#0x{I@ubF1>mBlDaR}n{#hI{p6cPYPt&4;XEB<#ajdpp9i2p4u1Aj}`GrnKL zn2BI~ua1FNZ$r=cE*%4>YEsYWxLBt|^4}Ee=q4oy=RYCV{|$6QUXSvBJ+BaOZ_Yn*RQ&xm zzJ31J*x1xW>inL4l8v^J4$1-1`mG&s@;SZ}F0Md#N7A0s-Erc_ zvWgPAkw5Nxp}io?TB+iMr6%>XBQ}V*G^LRFlbFPFp2CjfQi-^M-q1+jzyvciH8&b- zZfXp0Ec5~DE8m}#O$yrj3JU5(8eyPlg@*D4dj8h5M?!#uR*#T!An^?8`;w&=2=$@U z9XGP$ZfhhwI6!f*RiSW!4 z7t;jjMM{_^zClFoud>5nifNR&o;srkG&(SY1a_TWSkq^?+PS*AxGJb~aA+hjEf!N= zjX0Dd;-ljTC_^`XW&roS!g6ZV=x9B{J=gzAe;n*)*v_6v^#%u|6|5s<$~(_=a*}$% zLS2wovnR~}s%6*;Wt({~AbO!j&bllp)W{K0GsUw;6rMQQl{M9FhRqC=`dLlvDuN;HYIxEEf559fzd(QSVkMzx{qLA=J`u}+yKCG0VP6U5$$Gn+Uzh~-HhbU>q$nlS*qt?43Y%irC| z)O3`QCowDJ5=7VnZk8 zF2PucdjP=5VF}8O0MSLFkQb&$LyrAqu&T8YZL&~N2@L5V@Gb!{S;Hwt{!`e0 z9D=qlBy=s}2UAS(BDC7!s1O)6SVCKkBz{;+3a?H$#!wZtkwSA~CkS>L`cyX!XFFQI3$sXV+E={bSy$Oh z(J$z{fivKZZ}pJQykI==2*|V`E(e|}f@cWPo+R53T@d37m^Efd_%0zx9rBq0R5H0i z!C^w3cAG&MfG3ryy-LFMqDKzLd4dxf&)*wPN7`{k4NWJGlCa3OsS@~m$r2FRRDqe! zcnQ+SC!@1E81Cam2iyJG;qdkwu)Kpqx#2v4NC=RO_gYT@0d?j2p)=lM{}}!nKP>4D z=EFA-KTa<$fh)zZLHsy6TnYHKCZxxa8_ApX}HC9kwK_09pMA|qB zgY_qj;DtebAFUO9F(Y4{W~in)N$6G-6w1wyiL*Pyz#y-GbMr z)gYJzsx;kh1}xx%cb&u~ZXWRku(}R0GUR_|QkoK>jQJvF<@+r}LlpYz1+t(T2imY_ z&32WA!%*pBt`plrwM4Oh1Fj)_cn-k_wm_oE0)LK>2jvv7k6B?%^pkjnBc6Bxeu(jk zOdm<4+C!L5Q*qELpOj4Bz43yY;BSr~K>J%j~~!E%CSN%<+O zj0sT&E=an(2CqoZ1hvGF2qyZ={0@D%wf_8VO&$`pnhqvqh_%)j#grtuNz`Fl`hKb~ z{uii%bh>;eT@YJq9i42W4otT3wS4(Bt)5Y)NvE~sW*wGJ(05PAqJ&aUnr{oV~K>CI=VX+K5hq_e~a|L3u|JW zkcS+l&;lJD@KtN1NUZ=uDFU2=&w)lOAZs7QHpDbUd9SoNP+1WFga$7wOaRaBQ}!-= zBnn0r7>e!3v<#U9O*paGp?(PUsN`^tt~G9u;=GVBPAM{gTv2+t0{nwo$U_FLT?05G z448lTu^0RVC)B4=Nm@~Se0VANm~g8BRR$j{6L~sx4GG&>*3?RQEYJ|hNyX^1N}pCb zr<4T%Z(WbF!s$#F(gax@j*-ueY&AqQEcAjJtawb4LxK<_kEUW)*0@K2<~&1?r)=D0^jz z7bK>kfl>30aMC74NDr2pLzxgEif}utBZ!NZHZlz8mW4f=IKA%MLEOQ2EMKD5-xL;Y z;~Q~6J~u)F<1k!8;7b)ljDkK|gH{tl<6Q<$B>(i|hEW?32(H9F1u1%k(xr5bNQDp# z11NpCK*Ox1wl0`5yoLx7VFCeCOwBPQ%1B2o;UyFX1Js21O7c}8^z^mGWeJ-2`-8x# z1t0~U`JxMFQZ}Hs1S60!9>NiZPK-gTni`NyW=@hH$xM9Ugu!$Y5Ee;NvZOS*w29-$ zGWL(8^%%6cQE?W^Hr1Lw(NF+kwSzpsyPwQ=~zFM-&KyHmXf`v29fkK5Mt4{bYL=>5A}KyA^FG zwL%woBx9`LX&WFWIJN3CcqFT3;vYe`0)99*lpeS&9XyNjPLKxy#k;!1tP^xC?d&ij zDNn>FuH6>;3qUiZ`wiz3?Nug>FL5P&*k~6-iXfQCz#-^U4Q+csn}^yoks?9K;$lU# zbsaImFe&<1gF&$}%F>8LvH?6kSVj#Rb0~tZ;>zf@2!JrgKwnW z2B8Dd6DA0T8a!bc41rLJ4rHKV?^AZ5p19}831%yBR58bDP zCx!@>ru%D91%Q?IYZ&WbV&JGM-UAKrRP0qJ5Qft9V4%Qv?V(E#lt#NUV*K0c2)i`{ z|Bjwet+NTH*Sh&uX#m>fEkC9wL2dS=b-sYMy5jR=y5d9cij33(Z8Z-|{aE6F5K%`+ z4U^FJK)<|+t(jKY3EJu%QQ?R74~I#js@?PjZFeo;$K#FwildJ>Y)BpwM6GLSBRDM5 z{9?A>z6IPX!M(TeDX<$+l#sOM1ocKBvn9c!(Spvj1%vqS?g?}c0B<3tM(jJ29|>U| zt%HgH=0PhVAz+CTfSt)I0RvHK<}?39w??`MHu)93hJ%jxQwS=IAf`izWsa@K1HmXGO567u3=;As%0+$nc~} z7mDXJeKBk8VdA}ie5H6o>U}{=;9+vFfA~Xw9HZ^wZqx{ekNSHj~gUKF+FZ2J?DYJnv`{l|n1m8k`E;OaLzwy&|PAAZP^N-ZfJCSGHGB8_L- z33ObbHXIMXChm1F)X?NrN5D~L?4}oj)}@`+a}6UJkML9qhJ)9q2F?J4i@i%`p({P# z6Ckfs9M}5g{UbEk`0K>b{4PL-%QK<6DeNMJ!8_MFMNrgl28~wGZ-(D*2K3ve4-<*Z z)YwQ`N>?BdN4dtmYj6;U^E2%bvf;X`h0yj6d<~|wA$lT7ED4}*TGf6dOge8j#aUu= zFnmAioW7aFP84H#LQ|nkGmB;@d)z)KZa5T_Uq5c#P<5+4ZjL&`NoUaCTzPlh8FClh zy$bW8Z}D}^9_s7(;Z6LdJsLltdF4W-P`;&>h^hsrSAs$l33l`uyL6#r0s$cEUo;m| zeBv|0rBg0qA|TQOLn%4uYoqfwJSq8AhQA|qlw7E7#Z$SHkX)b>!c)25i(EtvfTwex z4!Owr5>FS(F1e`I4!sGvA3P%WBbCgRf?o=z=B2ygn_KM2z8ie##!}FGd|aS3R*2mx z&V$00)lD9!d~XxKTdzCqKY>AgYaO@Sf5Jm~KVkoQRNC5qKF!tb9FH2K_e{80mLgO) zL4IUOkSnA^Qv2O-Fq({|$a?y}J<+#U>UHP(pMQHDcdh@!%E8wD`#W7vYX2QrEzh~t zvT&ubS1gxUWv{w-RNbpERRIZO1`<$cu^h2YCAs8lOjDb0@LRS2*;E)SW_L3AayFj2 zZj~zPyq{5O6vif-)Y}D-+EWtJjqBeJEAa?*+_nCJ+b7rm{!wYW{-5I7<%`lEZCaO= zpYG{RK$_HXIZMCP`QAio4*DmZ(>f~@d5jU9>fG}Ed4|8sO44}L9M{pCPx1Mrpa5Y& zp1(?i9jAe{6Yy*8AIKUV=97RyRI`VGbaVZBCkFn$Mn#$k8xzSr(g zrjy3#v^}ZIyP zV+t=w$7M%duEUCF(BdgIW?C$N$?`6X7Mc`X=nWM=(^g?avA`@Fko<=6zjOT;t_|xO z=h&V6|L7 z>m48Mi{HZ){~@~K3o5>Zna@{lQDwyw`}sekOZaD^3m;PH0)1R4!j6WaDQ8twhq6G? zUU}7cIloxAE)xqsirG%*1muYcYrpG^C-Idm>_U?39b_rCR$(+tu*x;vT+hi-6D`0a z2yqLf@7pDXjq9I};3LeiJJ)}?baa^H|8Tcm|4(u4vS{F{K&{o#U1?VY?0o5lak(OT zubFG|k1awtg*nh)W)MXyD~0pC&WbD7LEk=#iRRQe;V}9ORD?&Vf^tZaCX^X%rqTUhe7I>LZ)5^e#)Ie@8V{mYgnrrX*c%%Vnwbb^B8FElEQ##pDkr! zs8jrkvRd+zJw=5o-bs>Jl6B6S3(tSS+M5*4E82O+74+SCV}vyfDlC7FUmWt6!%h?K z@o_do8tUnJaY&dyR~6UGE2c5ShlSyy9eW;CuWa&51c{aoBcbJapfpT?wrTb?+>jsZ zJpc6IO3+(CT=N}HU*IV#adHV*XAmhQD3}S-pOm<*0Q}ywcYA&7bqD=_1nKV{@?WX4cK%!5?*E?TdQ$qYRzD!wE|fn&_Ir^1Fu%wp z%J`v71?*@>Ku6r7s1zsKc)ooX$u15mf`}IHOGH&OK|=!}nhv;*=z!}0h3Lvr^mH{9kAyj^`k_mu4!ct%J(RZh?B~NZF}qQvD8P=BhUS8XpJh%kuKp4 zCn83=BtcF&cu66RuwQt8;R`em%p1HH^E#8=KSSyE&j7@qvfsr%s6L2$&dOph@pJi0 zQnaC4zn5RiewT!J;gR*F4f1V{!7@kJHGX7Qe49ZS%a!NHm}SGpAo{eK^p@%(@5|NHO1?ihdkive4|sg673|AWe2IVt}i9_(%T|5IGR z|HHEtlmxi&49pQzn73Fm;Ce;)FN-8s=SlwaYPlqBSef{{gCUe1oiwB*G9zah{Nn5D zx@9FPP*_L(vxsx-oxs8X_>u6wE$rGgo9orm+yBA3WMY8fGb9jKMmH6N7Mj?RcbNhp zTquyCBD#&`D9InZ`fDt9i6wuo%h|9bqQ&a#-o+`4;<{)?o56#b48A6fT$wu%rW}AK zrWd#`uzJ+$G(d4DXgY@~?C!auE)VI$)oGz8mWtuHqAKc#uoaP_G%5H;fAJ6g zO8GqZw@Si@FO@{Md%W?!(PW+ZEseWJ&t$VAr=y$PZeQ38&)n5T;Bz>~UNW-M+%|Mt#UxNDsMu=E0HR{)OmWI9qZMNB4yte51sQ-KwrdMoJ42o_kGWtai(Vbf8X zv+@+cD~UNDTwl^e{Y7$wNvhZj`zn2;VM+7xgByQn0N*J*qWCL^*@PxPFW_gzY-D~N zYpigL#k0mofMnG~6gSzQOnjl`&{yfgou#Zk0Z}52Z%^bG>q!{BM(RQ*%#qTzpd24z z4*IQ-UsgX@@XTw>(jo~dhhY~`J0l}n4-L5nTraESIUy72@mM^mSXT%a{{e&_5BE#u zVD&&ZOaa5hI!m;e`!NcjiZTUJBg_sn zu9zf%MlwQ4LV*PhWPpO~gDg)HN{SpuLnh=GzcBy*11pD83duF{;L|gCdjRn?*T((d zm3sIc<9{7g_P6{0r?_q%|LpN)&F{uYis}U|NFXq{YO&@ntT0qb=;-@RZhnL ztCY)o+wcERa`pV^7px_0WgQUxR+?e6a}3J6R8*aDC$uMIThD&c9TztehlNr}+GY4X zywg9evetmBMYcK*`^3G&m?L0aW6>{<|$Q*x)#pa zDUdX|Uih$<2$Olq@@%N6pA^{64$xIl{pbDH0Es8ne?E9Eefjc*+`C=qGYnsCuN+mU zcs2NK&U0*25}vk0;FMC}k#u#8SCUfbufP6^)U(g)p~Oe;ms8WeP|WIjv*I}H{hc^` z?HpE;mi|AQ0lI-V%E7D(YdD{5)e-onkRuzG?DNG+!6b z-WoId9^hr_yR7W5lk>P@=!g`x3>(YRT6RJxU(bxs(Q(JbdQE7PIl-5o6Xbsjgy zZFc7B)80ul#5hQ$UYm9U-O_lD!OB~%ylKmDm>fWkX6RU+?ufX4w`7|r4tg@748fZ< zq;AD0ib|nC)(yZw17Pcjto2bbiCSl7*^WNtWCQCAYfB>BXtj7tV7yq-vQ2wtvtn<; zisyT*c=`^tT3N9La}FI%$#mOqwU5tE`8_(IY7NfE;;DDs^l#6`qgJ=eAG&7^6yL}1 z$CGw%Dh>eP)q8+{(qctbU=l~76-S~&{R2PTltD4`i-ahJAj z(gO^YX3oSLMY~d#el~Zmn?4-d)WbVv<@w-OhQ?F13)Rm6x9U(zAAV+A=L{*CzMe0XACWJ_5qku#pb3h+;8giv9iYrw zlDbYGow}a>Ya@%;fYIaeiodrtsr+L4V199TiFAH3y`5i7xBQ~0;TlTP-KBPc-_NVA zzV!YBnMi7zQh13bm`Sv`4`MAq$NMcH73x9C~TKs2P^|4Sh2IhCZ1;tZgIRz1JKtRJ*3GoZ7`=S%XCgGob>%UJaH)&6&Bi znQ>YBeK~_)o&Ly)O7UJyZ2sVHwZHcf-QRje&wrJbrOtKdvD7|->*4wzdq?}_t^UVT zTxsL~PPtM*Fr7Hc=SP_fUt#}KDIIOc|0%A!#-Hnc;O)5ewg7zgE9$uY`w!gh9VNg2 zfbhEg{__-9vB+?6JF0Er=vG4yiu@E^xD#)N^MI+Q;<^Q?ScD(eAN2FM9TvJlB9*?L zP(JRH+ay<#*N#G}riz0msRS3KXU)EL{b(K@!gsyZ?m)VJR)S*I}+#F56 z&1XvtDW+9frOd|q5{>*zAjUQ{bPRc_doBCi(i)Z_A`#>P3IE=<%+JhLK~8bed41R# zguCHFN8jk&g<`Q>qhrfVPw}AWHEWxu;bsdyMg$KKz+nOuMku{(h8x&nL0f&lT@)hs z((fzSZ5V2@wqz&lvj*%#(C<66^u)M9=a{P*_sVૼ(xx^1jG=vnE;X=n}N9VfP z8hw)5jA;92X#!dfQym4iQQGF5ymrSI7-8%233ZUix`*={%8~KZ4&!5^XRC3d+ZuF;(erwu; zo1Gmf(7xd_&4HC=e$KD(a~Q37J~hq-L73By#>J2a#UL@d&8Y&GV$%LBs7PV{nzA?9 zXk|^%7$aIBlHc_-*xh3GFl|ARjuL750)yAb(mV_T5=)ZfJaR6F5mV{tMcO3?Q=|$t z#Y3gQNk4`Y2~vOktv;oj>9iK~BHBU_kZHet9{7*-1BW!m9=e)3Wb22^*hZ$s}1R7h$Wv{2I)KDxAV`s z$J`YjR_dA@mK4=ZMveDSwm)rl0Z}%cWMrQkHIaLuEdsFo33e`drr7CCZ=0JDSw#vySgB1`6T3_s_aI+~nn;bfG|OcU1Ww2+R~+5W-dQBA_U zYx#Q04RScoSax-52HX#_AMV$P0Q#(Vfoz&AwF-qoq~i5T75CGH;_#@(T8~Wcs?`zf zzag8$*IiF{U1g?cXmn!vWem{x=DZI`CjifZ{dBA=gFez@;GxH%Ohg7P9@YYSzu3}) z`^Tz6inS#2kjYA18?a*;o}s{$0|r7tH#U}d)9H^VjefJu=ICW9w?h>0jY4kc(4;e* zNZc_8(pJu1s8{D){J?TMVj1vBEx4;;q8YAg=vO+IhN8laE2Z*Cng*+;VDVyXbN=ih z9S@)VFZfHu)J0uJ_`f8C(jj+;&B+)hw)=;Wz{22H2pRDcQXI|RbRch#98kVo@>Q(s zFvo2T?6lU(6NC=B2}C)O0%!(ErGq*i47%*%jRCCQV#QbWlSX&kepSo~WOzEXh@0Hn z)_<*oxT~v1!A%BxTTQVI?qE1-91aJXcd>&hphPuY6|^h`Yl(g!FYdXxd-ZUEUj zABk6yfNYc%F%O*${%LdXXqq8uX+n#DcvPc)FyeLw4pgVp3SgNJJ zKmI(l-2leUV!FT=T4E+rdB5WE+`h)<4^cL;W+A>J156ZR&GCBYV+F9KZVMPZR5#}* z$iV%=7}EfvDG0=gsmxqay^x;x7e*9>rf1{!d4;08v%y$ws5||W0iz~;@jKdfv+OU9 z2kiBPwq*Mz^TKw+-UrrQd5eLmac4dqb{mtE!KlY0%}rq)*6RSZpj{75#lxU^&_^#` z@T8vdyY2W&n6K;XfMshU$Uy?Q=qMr8!OU+=2EF*q_eBX3=aLK&`5mr@9bk4O0k+?< zYgNC&zQq3p^!+hBq^E0{LXHy3bS%;dZZ$|CbsBzBz#D`y^53S>Fv-@^j z6Q#`Mr3J$@bZiw$BIMy{(9Cj?2UBYS4o%Z--vFz?DoSB8lwMB`+J&jXL--aZ%uc*O zbLF_U6HmKvj)8d1=$s__!d$w4;8e$NX~}fzVeuj^SI24}FGN+*!1b|F!l{J$IWZ$1 z7?*H3&HZ2Y{;s)^BuNkiqiR-ej}V!=ZjpODk+DQ(WdM;N2!NkK1|thWf)VHh2{r)c zM@NRBLBL6R2M9;Ofrwyb#ccnE`Wf*9YF_*Gp7y=-W#;Z-c2?v>cIV_o_MzqC^ux^D z%-jL+E16kU^h^)J-Obd@)YR0})YMd6;l>tOrpXynyh)T6%(*|B#ivce$&<|dx%CS9 z+$nTg)=Ny4)3VN-6k%wnH5L!tZ+0qi_R7328lZ}=Q%pdZAW*TPR?v@EMFt+v{L?cG z=oo{Qi8x9oD?S&6cPA%VWCAP9StvYXlq1V1`9Zgimzx>tBgu>mGBYLu9Wz%*v?i@= zwxjhZ%`SN$7Jn$=s40{nAAo}m}RM0R?{UlvJtwF%8udo(v*HCt@2G{RYQnKMe(QngQ7n)aak(Hu4|4XxShL(| z9A*>91SIW#0CvAzFpIW^^dERkWAlw9IBQsAuR1sha?WZM2;AtPSp+i`q+I8^>)y3x z1F#k~?D`u3UKTLQEX*7azb`yAa>|A(LZB@urc}R-P8Q7@ zUI;62Ydx>TM2Tz|g9=41R-)WZw2*8cpazrF5x^xt6x)Rr0P7koDoR+jn|*8P6F!k; zDCAJrUAbSArX_=O{DU_N1XAzVWbnw^WmNDmV5Kd_m>vl{49Qwr@isuWOe3%7hr@p7 z!USr-$~zRmV=ZZzMZIsX@H7rwef57#QgJi#s28+UgHJV(HuD&)Xr$gVnsBg0yk&Ef z^zy-l6e#6)D*JY{^h#NeLat$%KpM#N&cGi|*uQ_0F0Sc~_k!*u%oxk7WXZ&(NRbgp zlg&zNufB8CRD>zArV1p!Ufu^(wt@z3-OfO;?5A?Cr`{$4)88c^HPR%xt4{bwrv#Iv z)!J=7f0{2=>MG0~z4p|TID#YofmgyLV+?9@v|Gzc1D6>yhfFpNuO_-AYUk<(oyD+Z zb52j_+E{8$3)O{aC?%qiU1=m>awQime@}DWX^f)JXN%PQ6xd5NhtE^)Oloz0RoT5QRw+ zNO<#6!FoF)hiekU!h$)F-L_t;0ZH9>x$6IfJvpykBE{9STJ~Hf%L+32k?k;;oMKI1 zT0CY`?o`eqc9i@XQ!Q0Pu{R2`3p6O%0kmP5jQXe=Fa1|PFOrm1F=J!bgT?&5-|zcPRu`hF;h35xU*I<1 zVv)D`7I^Y}0;DGSQAb6HB&~rZJ6MIhpJnVa-JB7hjl~4-4f_x5W&|N&S<= zRMR$S@L%wY?0SD^`cyx_*za_##WwgQ)+dftaY>OZ>} zd#&Ibzvu0o!Q8rY*e>rJlA)kQhKt2{h|bAveVzdp3=0>v4Q=H&U{51$b1O*VO@p{) z<{}UI?8!4$o5TXo0<}RUKf^+-JM!sd!zS(EViG(s=k8?(Z#eO1jG;Vd>m8{tx3dj(C>-PF;vUmc%~|v zOfro3yzLCeBtAgtT&*4{yJW4J@>HL71`tmXc1BnYyQ(#c zs!M13LU#X`a8gX~J;SO;nvqXSg*&jD0{2-)Qkt2TQaeG$(@mW@iD@T#Q|yd<7^P5Q z8NLWZ)pz|-myC4AXX0Br^(E9^sYD2fXUA;2E_b05`WOSL;JFxS^8=XK>A2NN+}Ngb zM4|u2Q^eJvK@u_|k?UjUg%gT1b291YnC%D-%5=*o(XdQDWOsalzC_PDUSI4^1_R&- zKzD=&JOy`~MNZMa%0ZhkY!-p0XImQ?X=!8`hJ-Wou`Qt*20~ockdQ8#FhxW(%92pX zy{^G@6|X&ySk{EkI)0z_HZgdw_i)4~yP$I40Fjlx%3BkZp(BoiRS>_1<;DpH;=$;% z!_KI4?xB@jJ~Fzyfj!T3+ZW}ui$H8D$?sakciqQQ?-4QOaA z%WhBXyQ#Ugt&B2~QC(t*#g{UUNj7JR>{uMbne7M#%3MZFF_zjAOS&M*zB zv{B_po>?q~pSvxmFpM&|v@^g=2^%r0fac^_mjT@^A2XDVPn$?M@(X~1o{VsT{Dhb|=cpaPdmIwYI$l99cYO1UMgYHh{7$kz^uMRHf%w(@y0rG0La+UEwX;V`C8 zWWN?`2J@9;)xF7Wx{Hy{9Q2I551><;rAK&p`z^9>Hl0QnSnAN-Tk_4|J?x>wSoFW~ ztn$2ipqOfVzkHZ6py$L6&94hfOF#Tj-ut$_-+b<-fv@$0HgNe?b-&WcP~!LRjl_{d z7h}|NmS&~Zf~DHdi}JzqN+xSsL_vZERIS;nG%CBQei{<=VrXDS&QZ*PxM>U59)_H$VEAuOF@HCV#CQkJdck|3$sjEn*g_gp_jgCQKfK(%18 zXlPQ({qZ5j$L2%Rcxw79?}Ch2GhctzM!^72PiKna$rJ5ItNEhdXk{O5;09t=SuUtX z*6OJD&8UvpCZWFe?5NeM9~>PbLov$C8v5C(nHwsz#q)pA+>Sco#xjzEWQt0{xKuwG zM%I^>n{3#T__XkYRYaoHqCPGyJ(DXf;5jm#pmLviCwT6ODILfIJrhK=U06tF0ufwZ z#C6XCSn~5?z$dSizzTaTrict}lbry;nTKO;QJ8ZNm^wZP4cX4D_%7?>h^fOUMsJr; z>0vO0@j;_Pr9G@8rx>D)m9Q#U;H?VD<%cAqNfD6VKoyBsEx@PzI~?GZR{PsF^W{vG zO{ck#X}(KL^QpDI#ML1=&cISWA0}c$p7j}d>_|hOMp8Nnq!J@>3sG^1Sg?>sTi4VC z{&PVuBA%p8luQ&qJ9@rX{dQ9{Jx`<$8_zb0=6JKt(%_Mqo7g2SDF$2>I{^qC-EsdS zZBz||wWvjKRR0_fb9MAxSO-dz>S)buv!*GdQ>U@H)$OrdReloN z#VcZF=G&yoT%Hw2WomYOxnk8SFH(sRZ=22eOp3;98dc-?fgGzr)lW>5R!Mdpy?`b!IThvnu@*-`F9 z4vVB3nW`!kN7CueOvyO%M|MLun-a=2SDSfUGPB_a36ME7QwUgr4(wr>VoJ)5Kg+A; zP#3kWT#`j{lm58)6e+iJ;=OoF+H8=o&XOcXlon15q)F>Wg(`(3iJVBfoa(GCh6whu zhFyLVNZ)LE84()bn5}^tll{4RmC349Z_hA9Xw*7v4ox#Ef$p@+;(_E|e=zZ^F@?P@ z*MeuAP#oiCY~+`D(dy}tw{3@jHQYqRKFk}Sh!rYb^Y(mCqb}!={bMvFw!%y99Nm)0 z4l&w=*#I1v#TCc>t71R?kaZbNQKK8WCyU`i^kZNN*EbV z>}w4lFLG%dNJ2*$BMg)jkvIALRe8x2-;nVYzTqP>j4&?u(8Z9GD^VU|9>wLoWsdXV$ zO47rGYNOndicaCqKUi+DXu?LbRjt(oqd;=wv(6hlmB8C-r-2xt1^~H);>?MMy`xjJ zvJk0*oOWFF*0ss65W79@quqehakX%kU2SC^s;%6Px%F`zQ=# zr+{2VY9-W<5IMZ|ydm@sF2)tzqTNmRe3-EcRer*?$w4|xi;04(S*;y5DmyLFA7Us3 z)YR|`#qc8OkHk_Q$(U5Ol=H9Qrt={Pe-Pd-rJH3Cxd6Z&5V9RBQ4P5ng z(0{9z0X#*vJygV@-+u(gZl8})y1*zJth05(Vq`CeKdRg}($o44F-Xa<4Fq%^W{ z4eUajp~~Dy3>$*x#a6HniMdX<8;o#>_9Jg8*j5cQe;ka*Fg~8hdM`fZ7mKU7%tafr zZ7~A0LXwk74`()5I0mDl9k;hH-}ctq&d};2!oZuQHEh zH`2?lWC0W;G74!Ut%^8~&HzSksGvzn5|9bsdmUJ-?fczP5C$h>`Ax2>fI|e`35N4Q z>+%TDCt1-9u!RaDp2>t(68l0!Kbqx3zo*$#2s5=@)|k6T!C(LgAr$4sHyYgQfpSvs z2JC@M9wRDXXgo}m5jziDE>qWy%Of%Dtw*-E7{e5Bcp3yfaXP`}2nr>%YQ-fhO_{&P z-#l#}9zH8K$gN{%IDFO_?RLf;?(pbYdUxEG+WP2&LA%WtWqPe7*YdOd_H&TfdEe`> z-pqY&|)bmhums9=V5nEyu%eH z9CkX=d|05rIHR7Uu4KoH#e$=7QrTny)3U84=R!`MP?*iY%?wP%u?+Ou&T$M9?`!*2 z9FMK~VFGra)myFl{#DQ`2iLW+3$L$%)+^zZsyMy>W+67#eGYCTonV~DE9Ua7537I+ zV)l@^j}G-m9%|!3a_vu$uUC;@4}*{$=n_-w;L3N@!=nr13ufC29t>i|>y6MdYEsCv zN{|`-IW-NInQxHKO7FtzJdc8BjPD$tgyH0@g0iMsHC<#lnweCPhbAm#PpHof`E*{N zrUGIMq=8HZi&E%Y+@OHjK{IA&KJ1M1=<$fp<`AM(y8(j+mm~SuEW}bChGXchE=*r) zqTso(hh~xdaORn0%`+3uJ~%aywRv9~n#)OM+3qY{BwCH^;i7|~k%SDLkDN0n=Nn@l z_b`Cl02wJqG3yL2NQ}?(Q4ud3t2wF{U|UIIJ?;Y%AtNlA&Hj+6MHJ@HHsq``32PmzJw^@VpL)9w3XURz+bdEL3L+r*DG^9w6+)kn3IWGN;>_U;_cM ze6A2P&y^QrtBW}jBLcKJ%c9Mno+gOL+3D&ymf0Y+6pgV9J$pt3zy1{84;~^8H>gXLc8vDl`)C0+J)@73^;uLyJLnqU3 zUaTDI<6d~yBZHPN&m+s1Tp`D8iuP8niEwLXyDX;OOCx`eLqLX}rv_6L!%-{Bdw$3c z@$3kR;>me_ocHkOZ;$=clOPyl5WlC{1k>DDv`DG@D<4$%%PkfEqvMl`rQ^FYs!u4I zg;xzI7v%vV)z8W8V!6}=(Eh$JE!Mm*apk!w7p9SY(KN4#QcKT%(bOK4p~IAZ=;g8W zL|^ozqBKsaI1$9OD7~=Yd_glk!+Cw>U8ax|=_VDGPVik%@h2SD@>hAJ{Cdw_{vadS z1*vAWD{feo#1GIky)nClSDIrdvu)a^ExhAP|9#dGdaZ!tj+vb>#fSxKn?QXU(fCK} zboO9=&(W_|U~CdNy!RWe*}?P%*L5@#pEDrB8h+j#b>2$KqXeM@Row;ZZSRy1iGCx< z@+Uzsuo)*t>2`LZsp?q^2B#AE^KWYHX6w6JB^Na#>2p?m{vVNizOFW_&&cK2ECc9$ z*3f!b&D-hxuxF2e=RNA)B#x4y1!`*VLa!|)WLik*+)plM~YrBogfqb*qDDPK9%rm{lJtV0f zd|j?p5s=JNX_RT-KygWQ6AV*s7nbgwx6(R`>;pQds6|JEmH`{GDM7l+rY?HFRuj`) zMk<+4xjTj>!jzO-siahLNXbtz+Zp*;50Rfcy!HJx=ek<__p@u2F+2Wyab>lz=Ei?7 ztghV0f4_@s$%y}cwuvt4yb-K?BTq0>BfsA`e)Wce#L?o>TPen^MYjqeuQVa+ko529 zfdyaSVjFoQnGt!RKk`_if>2J-Vnza>^XB7`e>}l8>tt{q^f)&B@dd#+_d2koJ#5s! zuI{2A1E0LxAQaq557}yWgu0d!pHF0}!|$C5{2qnkt!zE6jVa!l3N#<-XQcYur|o&a z%Nuzn4AjJ9xiWlnk1V88Qm-Oom=ju{3sS;ln<*E znf)eF<)w9E&x8Iw#iL22=;H%vc9o~=FU-Qd9+8d zg3Z72aQEhEYC<+2v~xE^<{XZDTdDEI(8HeLL{G>s>r;XMehspIy%BkEv*VPtzb>|$ z)qki6Wi*rgSz0SdWhM^5lgU7ym{%kacO}F|-|BnhXr`d4gLff~X(jbTEUtIYi0eI^ z90OD1O%E$p$yV&uHA7O`!n*0WX=+ePCl4PAI&xSpC4<5F(RWyX}?lj^erDkfc6C6{uP@@rm2 zm?;fwD#LDOCo%xDPn5B?=_av8?Ve;W!k36Kn$&-{)p z>xt6zQyRUNgpr&@`{Cq7(s^aFzskAQG))=hnw3jU3azk}@I5gKK~ln)V|ORfJU8~U zl23unb$9%*OO%kdNJQa>Oz=_66{}Dk`NMo`1hI%-#sdoRdn@?Rmf;L)hF`mw?>b4z z$?6S7($i>p3K64eBauSnD>~MLmv%ZY12e`m&v#aCWxcWs?`=VjMUBGU!`bGiB(L4k zK%w(VYHLNGQ(~&Ql4AvjZZGTmLz?^=wUG|_Rq1GLt^#a`WG5waN5A7Ki6|h+HBYE) zcXVm<9Bat|h;PMocTZQXV9b@1Rj27LoSfRk{4C9^#}tg zo#JE1Jf$t{6D9OrMDuzE*F+Rjf?R>gXcAHwz;fD$a<))M78D3micntQNjBiHgtT3x zPDk0&h}=t}!7+97V=JC?x_TZOY!-kPy>ci@w;!w#ndVB$606jCt%Oqx@+cNb9m*J+ zJz_}d3s%}Am<;q@JXz;{(Ebev2oh1A_2h(nR7R~B0>kybe_(eXC)vBH64Or)o$!Kmf;+WNeKlVF) z=xfD<_FqC?7h~ za&<6XAZjv$Nksl|+GG0YdbiP;95*(GpiAGQ*bULlLLa6awnc;_eV5LhBHE7~9*Wo$ z^CNpKNv=Woo@JL{JIUvnNMq2Lhs;zwTPC=b-%5rhk`6ptX?aLGdv12ss3o|eS^5f@ z)RfI*b9$S30$?i%w!7yXIZ=qr1;u%1m@o}57_(f0gD1IEjM7}eSx;hPjqK{)7MFEBNPM z{^eib%}4tG!N-sM2mixY_|IjoU#HXNV;V1EKSnQpEuYi&XO%#ImI>Tv{PEw74EW>Y ze|Mhwg;3c)$`{5ny)d6Y&i=0QyYLgsH|saAJ#PC={G`nU;(>_*OszruT30o~di*&` zKjry>^N1Ir=077P{D+VK_TYc~_q(3;QYJ)1-s ze~DL9UjLj(=Sbs7>sO?6i9Fr0|6LLk^fv$fm^Pl(cb)!$jeP5s`Rlnr|K6F|sou+YPJ7^7yVe^Ey59uba}^h)}$smtxQFd*PRf-e@4wJ8AKQk*+`K*csskHPm|7nY@!P-$&iGU;dWjDZ_#Zt)Pkp zeF}Wxn|+E(+hz@w^f3QLF*+vRtkm$}1p3jbAGJi0I^j9{xca&?@=+fI{pIM;wie`t zhnVGA5nn2?QZImJYLE~&N}3+5I?sX;tcgtvG-a!{m4a5bIiUQb+Exmw^BvQ1o4nL| zJxCG^PKEc*AGgP6c+hAoh28i_C+r8XCdW9^;*s$aFvYrtz2Ge>U3*@)-%;UAf)hhC zs_eEn5}CGP3wo2jx0ynPBDQq@;xbxAsTEm3y`_2`C8dogNTofzN;e-1uzJ_(R@SsC z4XavHC*>+12b1yaJm}(@n$ww#1Jn+5>1<@Afj+(v$Nr$y6^n~vw~m@jQQ57w#G|E@ zr4E@4LjQDtr_TZRb|1Zbwf#d%l-6@%eJxik!r#YmZxnJu6yaVm?lrhK;C?Lcja+e~ zM8AtG>p7S}a;4>BuC%h6OBGA2Ik5(J5fc`odu=6GEETAbVsS(MEx-+h7ofn$tMGf3 zp84Af{Z5G$Ot2Bv&;*)z1Mu|~`(1Ha|4z9tZu)#pfNl*}T!5=if_cyDQ=e1w5?u9J z0^D#CIM1cxrJosKspKSZpI0yaECD)AxbpL37obDb%Y|z{r)~;>?iCl{%Jc-6dv-fz zr8qUgRi7^jur%k{9eOLvQxjbE`H}!vFa4alTn3k|xy-@s<;Tbmi}GI6j1!qAGf#yx zhhEp0V+Ezm7s!d3^R8SPfR!Ker5K28;_~X%0Js%^{HfUhoZICxRDj)z6wfC`##I4J zEy2CY^Gu;=WV8!oe6Jec*Nsl0>MzSCtjWIxp6yhIqC?Ek zOwwi{iM*6_VFConff5x~H6Ew+Bolqn8UU&#DeR00@ea;VenDifDg3JEb;dQ}A3I}} zpEt0E>S0=MZfvmZv$4j1vGXuJ0w#cK40OGynjE!1YEp@NlxTBn}7lhotl>{=`{ee!$$hA2TnGosmLN(Y^? z91|KNV&+8DG1CfLS&QzXZgNt`#HG`S5*$8hP(mu16p-d{d>5Q?j=v4sOrYP?rDzR* z6X11zXA-jly6gp6(N_5-*);`JaNIu zz3KRH2eipCY0*6Kpu8F0a@HtQRc+F@VM8W#h%NQA5sH zq`B7sKuunb(yy7%FwtW#acxu$?HZSgJSudJEu60yI4?242* ztQ(Z?qQE2}^*xUB)K!r_59g_?BAtiY^a`Zr*Pxh-I8agn4*Mc=4^#}6``&1rF%^as zOp*0dq?UT*jYj8ap|ik0&|eHB9|s)XI8%f9zzDm9{{0sicEjuWXkJsFjE9qiLj04A zp>E8Ilac3HZvZN0I`zgJAOOose_Q^#e9)@2YxU=8Okrd|AFQOt%(C*Dij>j8A?so> z`vp}MUSYUuBWEtwCX7UcR^JR3sum0ZikT(d`68Xe<7UBROi;b?@#G}KFO*w`h15c4 z@@^gkz^n}cUPPWGdXr%()5cSkgFu4M=7jMAvzw8x$P)_o06FWayz`ThU&RB>=zP`d zRo<~{%*^M8P8hwnppzENJDh}P$3f8dIs@I~9P2XabHO19=?9h!P1|J_$J&f`= z6!HQ(<7tn{aTs<0`2pS*(nXJ@Bvoel%AgezLJ_Hjnxs)exTGTd-9~>*nVR`#jJkOH zl^@v8iYCl==biDH{f3TT+OPUS2e(x+?43iQsjHOah$!lpojv&`OQTVdeQ1$=yIiX@ zT14?|0`85`BdH&rX|4O^%Fr~CT#g!E)#hIHpxS&<*-a}nW04~{rmtA2%?grBZd7)w z+SqNoHUCbic`wt1Mh7r)iN7ftYKB=Mzhx$vT4;E5 zs9SIRWbA#Q9I|=s2Bz%|dOV;qhF^VZqiiAv+>KWhhU$V1S-X&miq;OEqB0lS$KEOM z8!l9ja_t7nszxxhYB8S)5wH2Cc{`Y4()6tR1c73Tj)4uVF&T|f=(wm z>9U$TmJh3ygI41^+)hPr>`B{CQx0|+DGx{9n>nd#hfQgL+#l|o_iFxNT1u=IUjs;p zHr3=S42iT=->q+o!+uA3K0uGY`P9OG^SR*p`9*nWr&1GVo4ryC63XLqgm* z0M<1bd+(UBTCa3h@8gr~X7sCt11H)BPndJ*Obe6rb8n1C&nlx)Fv^hE^h%>qZvgXZ zRLZ;GwJYCNo2_Qn2nOUba2X1SnQoYhZ4p|>4KVMaHzMx~rh^Ax!K24b8D-eqKNK09 zyX2~L6oR8UhfEgu%nt_C`ytQQ|lM;y0XuVqS=qNDx ztB`0uGLj8uVSa{>+qnUnZusxQwB#c3^!aZ!bdbeW%OT}470ab9s1A3Vo5k}(O)Fsn zvV0M?Rg@-(PTsGeK#>vGx}}Baj_?Hp)<1UaM(cfzn7n^yrMlF-(w6OWSr;v46jQreL;yA$Lu>Rt6obzhES<9rhEkGy5O5j6i zh3Sj7zuIgedE4MgDI0()sj>@1Ws-L*^Ox*e{}h#?|CQROTTbCTmL6XIf#romyq>Of z6RNFspjI`Pa*gYD-sDMIQ8E0JtnRlarEfwa*nJaA?UQ}};z)r-_O;C)H}NTtWiIRP zQF9n70@c+jzX2P@@blZ3(ac+_w}1?xd<7mnXm3%*-h`TA;BdPB6hfix?M!@%GEkdc$qxV74?+2 zOr7Q6Ub~6N`?UppC|tpcmAu>%J@Lh|n)RTHA@unT@hmi`V&nZZh!TC&A(#8*KPmqm zaEul6hhPntOvt56if#Tg@qU#I59Xdc)m`VpBIh7Yi`oof!iw26@|2$h+pX*ld%HZCPF7af+< zp`{r&{p)zFON4}q^Qqz=sn?~?AYXX4`&x<%tdJ7N;>a#zV<8yp@?bcfiJlZbDF$Sl zXPmI|oPHuWkFrL>#2xbG?z}2tN1Teare!uXAE? z2p6_XvA|v~;#1G9Xjr}GtL%E`z<4G5ODEl@R;&>DM(R>sEVp6%TUPo+F=7c!jOfwG z<}8tF9Mkgw7J^(|i2X-s6U<8KMtJ4#b``Gk8^Xz#VMn&MS)xS9 z4HbA7K~3gueItU-{n6!-$`=!}ku9WHfpoF=%v@%H@)r8Wr}0v`-S0NfBXP(FLhShg z5v4b+uhJo^0R8n~H3x@xI``E0={$t##tEz3rJgA%k*Uk&oWw~P@!EQ(Jke0iBQ}G@ zp0cIfiv(RWU)&UXd+0BtVjmc?H@P-AXC0i?R?f@E`)yuEe6PmEJLv|tF0f?#imJkS zbY`ZApdYY;9! zn;8?d2r1 zDK-_&grEFhc4+)v?K(iX0e1?YHQ}>*aZi{rW12vM*klCG@o93Yf%2%0vde{`9MhX@ zJ|MS&1~<@^|7ON{#t&0HQtaeY!>Fq9a~JTrg0Jh?(h$<#dmF6SopQ34+1H*vv3mHR zrt&4Y*|;X?CZYe(KK@GRTB9+H2fP_->UWw1itcR#KeBaYWRwnP^=_h9kVA+F*+&v{ z2(e1K7Ju{`+5qB~HdLU}2!Nqe%X7b*wuklV-i5C^{ycPiSv+Y!EDxA2jEU;0;b%6f zy)~0Vmr|W!I4o`Pbo&>H90{#3S!W2CWyt&R5T~*|JZPS_ZVk7)hV4B+o5X2AmH0IF zj^Z64W7O$nUu_L2L~gL7o`MdI~{o7Vy2AKvVS~FEsaCZ#E#FfhI9cMvyb-7#6Zk$|Y2qgX=6?tNZeOT(axT#hc00mpq3?2e@)pEr z&}1f_`(bqjaUo@^A4o|xOVHjZeX^vCwkdPTvGMV=(}-;YRx?Hxs!vBMq@rF>4V zqR7*vA!xY=TJ-3v!p2M|yMX&fX$3yOoK_}WxCz#Oq@Aw#0l15r{?Bl zL)(VPBi|g~nK@_MjC>v%J+A+>ahMSGkDFIZDWK_|g(R58d;TEmR7Z|GN_vEj8LsZGtkPy3#v{|pEszpq!2d3>KbRn;6MZ{Gb3X6hnCwu;ZC!SL^ZJe_n|h$cNMv{Kw7ogidruvizR_Ha z>qjU^Yy#?SdD6kjpC_+4SkZ^jI#7eA=Md;OGV*jZR?{qpcLVNnUbUY59v*vs z8tL^!aeoL-3@y330ZUxI{c^t49`SEWFGo` zImVvWWoKBft5muJls}8x*BFy*v$+}{Ei!C;r&_go%3!wIQqkm?=a@^^>rk^>qH$gr z7jtwnBfg4A#$bn5Nf23At3YC;Y0~zwUS}t@tH)rH?#M}6o_`Uu;;hU`Lws>$(G|r^ z%W9t6W(+)(gTD)EPUfg=454An`O{{&1bSA?g=hh5C8M%{fqLGnUAJb1eSNRmTBNz2 zTxKQ5BZGlb&`6OzcD^hX|5J3t$;zjTi{2H1IISH`K~JFc+NAP6XmR>fQl5*P-3qK^ zmo!J)8dzM+F@lPCRwmkXTdk~1-8xnhqb{xAC=N$Ul3>$4y3L5(>1Kl88~F^r+KPJM z3E`3zD>5RFPHAGSWa}mosvk^t1s-Qig8g>kbR}uh+}fEDr@oH5CIuUB6J92@c2Ias z|Eg(RYB&TLwN8QmtO9szE9v-{XgePB^AtRVGSlS;i00Kg^#J`OR`iDaT8j-nU!N{M zUXhm{d_F_J+m}1S>lz!qhZDc%vsNi=jT~U)h0Vpw0}x-&@6Q9U2Jmb@HPSP5VShPt zI#hG`u(O`42KJ>z;gDM(F%9Ae1fNz?$?-Ge176Yd&CoKc_jp`6ZrJaSSl{jN)hga{ zB0n|^0&D0hM{)}uRdNWqV%@*cXMiXk;v+1=KA$^4j=h>p`4a^Y><=$N;Eut01}6|V zb8dyfB<9O+{@u@`%H_Lz=*iaa3OL-e41mr#@%s>(dH`Ag3?1K2PkwF^5->%2-D2|% ze1TraItZ5bvu+aZ0$^Uig*LwjcL8CNpQQg8d`10V>1WO!0OVzauq}?XRnXgXI~bCn z@4pZPw!!0BRlv7ee@Cjuavv{pT5}tnE)7#<_Y)! z-y}2xkKO&omax72zlW0K`)??6k^h1Eb^U)2mHh|ezt%I3^gobwtb&0St%AK@Kd+(H z+(Z8BhWC6Okp8n&0L=eN5dV>UgZ_KModiX~x3YS_lu#!BN40|w|6jcaI{ydsR^opp z%Kw%Ak1YgQl>SHG2}1v~LbBzV|0q-#{l9G^(Mp&#@PCXMDEJ?<1`785r|A=U4z8xRH zg#qyWp$GT#P61|LdJV|-`l&JZ^tP*z3Js#x;!F#ZY6F1=80q;?`+V;Z)USpU1Y8hq z^_!ss+|xf*8Vry?zSHd8*Tec{!0#FWU76TFYJAyWSNyVdJ{#9n;E&aIN79E(Ak9y5 z_4w2b|J?ayrGIJkWNbk`lnd5?0^e&Ecw=jNGS|Sr#fD5|n6yOTit|129Ww`5e5KG2 ztbqoejSvDC{L49Tf#F}k3&HylK@$J9uUtt#@F#Sm86!}sM_}&a2#_rmfQtJM{?ifg zDuV+Q2ecgsh6Aylawq%}UJZhJWNv#P02LoM?FhQ_$mS~&7oZu!j1+?HCv$LaNVdsEP{BjMH)d+kfOwbi@kc3XdpL!Cf*~il^fF+9U-`N*sSN5;; z%Z9{a`lpn}lL{8?J57Fi7I1D;|Kl^v!BW6b{zS>*D`N) zs)f|=(rg$sv~9Y#f-b}1e9au4jN-V^7qP z9OV;I`C6nB4>G||MaoiWg!U=RoWhO5A0Xrtg@4YWy_QZkdQ}S_p&p7KA>Xt@1p8Gp zcyeC92%w9vUpQ6Zd!E`Y{=Qzej3N_nJy>6rZdND9B7Mh9;jAr+w4~m8!c(LeG2y^# zS>nJg1s5_Oz8JMFg`64qDKXZc(f=6K_cH!j{ISwHvtadHCNzxkm7i zSS&t62Mm9Ba+-oXJPKA6C8q&TyuN0(bX%l%=3Zk@k1b3=68mZwd=LkM{YG0T`%XIp zQR!}Ej^4P95w|UqP%D>L_yV@A?EFxAcA<9I2YT%=;xL9WMQ8TmEPBB@f7U@c2a1>q z)#l+vrkSY}K6uDy%#`#H##tM%Ab#@VKoUWwIok=!+~*`#rJ=m!GY9=9c*hE%HAH+ebPa$GZT02@khd-25jbHxr?{#~gHZ?&oXaO( zS{LW{%s=m0TebQfIivmdyBu(N^J)>d{ul3n<1;9nxJjkp^7F&PRYJg3g_m)0rU9)w zPI3&s*HHsxse>*{ajfaQq4+(hr{UJC1**s4Wv^kGLj4S~dr-QUD|iIodvmQKIal;t zY%^Lh_a{<++y_Qn8>A2mZxdagm9X!oivHs-p3i|7#vVVbG(~UV`G>~ibwku0hfK}F zKI{pm0_0!P(plpWodQo`_&@pYrN0=tV2g)-&6GovR||Ik^!uUYBP-J?xZ5`=)oRxz zV{+CrG`+utWtmO$^~uhpR0rdeq4YXDm6k{JOHgD0?;kuL^z(TW0PJLc|JO#Yi@6OUPyC;X z`tOw;)siB(pew7xs~dAwP(kYTcBMvhJ2H2`b2XH(vuj z4esr6BRQ&du4~#id zO!9wDP3)wp9NX)E9WM=RPF$rjW=lORRcLI~=vs<`uuliA6>@yUpUm0^Hztp zg${pCe6yD+IH*al)nv-OE*}Y}hZI z-RB;FDYZC3Y^(ddV1S397%<&n;n?p`aZ88BWcss5Su$!1j} zz36WTVsI}$5YH*Dl13d}UM@ZBA2%jR$h1t0>s3tvQ&D2b&=5A%meOPs)b4*haq9d0 zHBD@xQ02yNiPs&eUkobu*3kHt&*~vDHvfm_E54RiTDUpakiv z%>d9G9oY;XwWp)4H_&^!co`xgt`$TZOm*Jlge5=CZzWJYSC&9@7MIMK?u?oj#k;lQ zF&OGX3Xuf;B|OW@<;+nB93s`k0>o)^nO))7Z-AAE;8n?VQR=15=_MHPK=$mJqEUCdG^=tW8%%3 zyB5SFXPydn0fTa+&ftM11{4K&Ru?_O;cCe|DV};5;#ynCYN~c`C*2>A+sVw{8#Cs& z6irVuo>!{*L{P+SBj^y8n43oT4Q#|860@-ISz5Lx$rvOF3HjDM=yoiQ#JLIR+{y4* zmIeK2EXra^2e}`7F#3+dI=?;K1#hfP_Qe_<@qKBe>J}PbDriZ?ckcWwi&>@ zrHSjuPv`Gi^i$kx5-Gv+wA_de{PX*n2ygLJp;IEMw zp?Sx2*Y|G~!SLELMuoqc#We|$#eF*=8vW5|E8loQ#h8M-W7dLJ;=n8qW8Z>vls(>X zKdqt4D$8=-$^SI`ie5B*()8ZoR0UgaakO!nBD5b=W6XE%(q*DrYSYD=P?%54*9Y;B zi2OcQb_z?7OWxYfwL82W{|@}?DOB*5hy*lC0PWNdk`1@%sO$JQRtugM%Aad)1i$z` zgX}pgjcDQ5uj3?wzMHk9cdMCCh#2~I?| z*cA7TIkv&|SRdVWi8dTK(IDIM2kH>#88~4x-(b2Xa3EJ%KjA zfjj-!aUS;uoxqiqn=8NT<975msc?m!)(66bgeB}a9s1L0q@+t>QUv0OM6E z&>o1weA6cxuJ2#JIW~S^M>w=Jp7JvScq~UhV9b)Q1{GR&qjC^bPGs<@jVxEVG{58N zv~*Kero7?jo;7*@w1;X$1x7=I{u-WUaM`5CqsY_I0mEsUyzBA{u zwmp;+e>T#dqXi+3TihH7>GDJR9BApmzA1S~^1q+XJh*I;z@266e;&^}Mf=j`EeoKb<^fT3!Ds zZ@A8@J48n*Uy9Uno7+9FwtL@%Kvz5$(!Ua9dfe2Jzv?HDw@UY??0UuEzizw6sxnWZ z$`+$m2z%Y%E)beN#Iu<$nOVoXv)RPP{$l1j7)>t3I9N=Mc6fL|l>c)zq~PcnosTR9 z-KLsRDc8v?y&Iwf@$UT4-!pu{@&J^Z@t?{BuAqGOBwarN-JIljflZ$cSwJU&+qN2m z&psypx(7z9ln%QI3DzLu4>YX+(}EowFxi?N;2AlVKxFZT!`OqR8n=YxuStQtX16X> zYmJ|FSTsZkfIE2(azH0)K_RtrgjzFs?Pq<=z*arXV;L+2Os~do^dV9lfd(71ja3Oxu^Z27Kh~m3uHH}?$ z{-%o`)Fq}X)FmbN-BTp*Bzk;c{_F>t`m_Uq&Yt;pH+7JiL|m<3Xmx8I@Smb~OPWLDR0+#)xAEhoIxC=qJYP zsTdd=gi_X_gg(sI6TccPlUxz1zk6ITifw-%u;CiVU3jvoz*P7n614CQBl6fxC!0?Ja?5B4Wat#MK|-FLB1kyZa0?3L%9(60G560`zkm@xEHJBWGvhKS{xTEQ?9E zud^Z0Ru)Lh&{o#6uiXPee#be;1PLQ;fZRwBK=1LrOoMA$D1JFhTMW>k8doF&B@>F#Y#izV9G`l{ms9+NcqwVktXHXdG+6Sn>dr zhQbSsf;n!A*QFk-k2fg-9VVMBlDxqnq~4%ahbKjQK*^x=v;cStjhs9=$W!+B1xZ}H z^ierUDAnp;{4zS}4Vr>wRDxvEoRhJ$)qb!i;r@IoY`?`>V23nfMVQ678m&w4r4iPM zB}56--(-GRe`&)8EtYjw#p(~z^GNo#>cv%0YT>T_`=6qVD>o{z9;s&fg6?O>4rxS^ zuGWa`(N5{`R1}JhZ+JBeM$zRtib|Gz`$o3TaMV~qn^y=9hDM`0=7@_#Cewp(P?ilD z;f0|J%}SAC75k`PDC0C(&epfuQ^m2BpqxmPcj}YcCKsKop7aH9q3XddTY)QeZwk|- zD$HR`eJ#FRFiu3dsyQahIc#=0e@|PQ0Oy{POO@4*3fL@rcal|H=FV8dh;%e}TkqD* zc4Ec}dj(R?LHvlaBp2Egx_>+yH20XK#Tdn?- z-={l-Ug80N_;{l-*Ar4mWD6U7jEPgO>ESm?A~5T}(_m`Jy+t-^2DfuFWyPK)SS8Xn zP6-cx;w>OLanvHx5S|tPNGwIFWv*OEHv~0bK$VijG*khv`ujrB@0f*Y50ukeS_iH%0twEu(qTb0;pHPU}vzn*R}Q z-9%6d_0W3nEtpwC;jGI3B0(1`M5;I{l+7G0r|pArMVJtlQ|a#QhwHf~UexJjVpeN5 zKYP}s)x~9IM;LtyF2B4%5+l8!4O20cI0+lO8(8pVku2WPrXnyJKI7G>8xXvNym%&k z>er_08QhVrbG}tT{0Q&ei%AK(Xlx@h({HhA=C7%_mW9@y`f(=9xGot7yd8z3sdL;6V4I^7_^v?2i2vZSj<$`}q<@WXVqhGWM3VWXi_PmT{ z#e_D{akfCtxr>Q)M5VChYHD6=qr!n_(s%yu!zjSq@G|(I88d70l5T$(udt5xCnxr- zDCV(WWbku=QqYr|yFzhfv^d^K+K->|-q&G?a#deZ(}iIN^iN=^DwYLNMZUgSa;F}P z?M);3J>+LXbFgNFF`dM@&SRsS%A)}kA?d_FNs~MqTSBiT0C@p+9D`&cEdOq0WM)g7 z5Zkctv~`|}S&T!nNpVrzxSa!3FO+sF+_)~sy`1G{)RhrXS}!%W1)NqKV_dlLZT zJM?|v-b-MpRzq>NKJrh9C5UAcTNcYY+8k-RbFDJW*#H?k1V91iBjGk0x>%qKZ)x&X zkY&0#xL|O|ECql3xFuZ)`D>bmFjOfFXzSrQ1W%{VaN7tp{|K8gOCLy^9j5n;5jlMFD+-&tgH=KMYp z>_^F|8*f+m=c%1#lnr01F(7TL;+T*^0q##?_$7mnBCA-y)z578ICx~Kh&Tjlg{uV0 zZKgQ95_idF3O9APJwb&hf#(V`FKmeopSSE0@4>w`B-gITh_G}ZG=;}PYAtF3YsA8v zU6R_F{Osn!XzLu^9TylqJ5!)AimzJbW&XQ2>$iV>)#gu_(Cli7NsOr!E)7W?u*aAv zSb~sgDo(L#BzTF%LPm%Aof-l*oulj;p%f9;)`#g`66;Kq>ilB#H^@4#t$g~Bme#Pr z{8}m~1Mi>o*2%gRiw%L2*b~N~Z2+|f==0LI7F9Nhhr3?QEAgg@M>9^JGD_`husSOy z8c%db{h<+j0$Z8d0f?)=TA^vL+`n`Y3^4SKq6q}PW1&EY0RE{z`r@)|)1%!lV*ify zHY$0W?Sqxi{nh5jB4VNT2NL8CgGxVs?1Q%HCl@1vZx>8d7EV8CBZCCS+;p~eO*WZ zv&u?ho4fMj7a^s4;>DmXH5I!+L5;!R5{pM!n@gA8O%jh@w5LH?Gw3NBMeeGi#+2&L zACdICjEGCRvnRjKXmHRh3Vtt#XxK9AjZ?3(i02?|D`^winH(~D~hVW zJe)*K^=hIsAH#uONCZc{V_;8AzZv{!rSq2%|sZSi=Lz7Z$Su8^=YAd@>hulI)Z|ALFLCnNLUJFtYtv!uj3B3G0w2ttCB*Zy z&UaPrDZ0ZzC^J@-BAcmy&m^-s3ZgRTrj^E^bTH?0o1KqT`bJoqm)U$SV*B0Nv|#?& z^vfWlKXmxUry)%1)&}wQq4-SfIsZ1}6%Rd0?FKthdcv`Gg6+0l-a?4izwp4O$qwR6 zF5d{xc!fj#5M-lGu34Xg`vLQ{&TTzvkQ})6qVrq-+8Yqfq!@|G@{g@Hp6wb+LHrdO z1Jg?U^rLD~wg6Vw8-dknMFtsr$PZta|oJ}Qn9$MD$JgFrGDR(xr_m;z6?TC zU4^aRyjvEXTbOPC$39r=WoqATviVluEX$7M_MD0QC}n^yZcJ;yx#{K8M>^_|>Or|o zCXrcZd6|oeM)-h^S#cbNPK0a$An_vE?2mIN2)MwSSPL)F3qoSdAMP}i(SM-=&oDQjA&nH&z=jP7=0P99o2Omtepjg zw+sq9Upc`en{$Ql2K_OQGp=?o)tftN8!38)>b&sjIL4d$W&EwnTQS#=Ao=EdOe!jF zXa0L4HFT8>f=I$nYsDj{@1cFA9XTM$)84j~yHuc#xyr%OI8TJ*X3#df|1Lb(_>k@q z#gFTXr!IrNh;{vHfuV>0>Rcm2mwfzi;quS?;Ft*U`aC(Jy-0tr7w?i`f*60m-w*zH zB?2ji;&>WXA##xd9FEiAXNG^S^ObTe<~$y_C{^GEOLD5EP?&boHkpFiG>k@~sl(3a z;M(y51h7OUXqueK8cJqbKFbttTj2RDbTw1Hc!{#9F2GTrMlObkxnCBGdhG#|%oU0% z^m(>)A*8Xf(2th_0W^@dk=BMojRI3t$1=~+if~_YydB94P9X66bfC=S8l`jt8O0f6$=3S)W+Jiwi%&+S?p zGGO!w&-r~V_+h+)PsY3ICFGayEyhcuQli{+K>%v~Pv$=A2$oO&GL&1Qy%L(;5-Ic4 z1EI3-^s!foe!fS6WmDJhkU-ef-5Mx7s4~i>M4xOTnma4&J(W5c#39nSRe8R4>|JUB zfmG259_zU>1N=Y4Rf+@-slz9tlRcbgFGD}@mq1Wd54iQ=c{=Y!UB#Iq+@xz8C@v{V zR%(-1#QcFxg82`bsu1c*$$QA#k~dEfWm0+S6F!8q5EnwGLo!YiLV9l z!+yY$D4@EwR_u@;4PDK*qpG9zH>Ky0>j994=a^Z>quk`KIWT8?R8>4Uf#d+2fWJ4I z2tMhN$@E2_-XB3g(#=Vn4ka=yyvX|yA?0?MXJPcX3(e561s&&~ zqznLcM(7h5dVA2M5|a-BdMGyjJehm+&(_hvRda=0Bk#5^mZrF%>R_Fr6%jlmc#dI= zRr+<^EP74J0WQM9knhs-5l!C5Y9RKQqq zcM`$b79<`AIe0A*P0+rszY|z2yOTEuW6O*A2tV?Mo4w#FSuA4u?G`^ln=AXp?U%RD z6&}fO7P9@Mf8UX#56ZkRbxs)>nVD+0Ka$P>er>>g($-Xr0QKlAE4M~~U6D4Pz#a9+ z+_#G!l-ZC1pcei1h2PDgbOaDp$A{h?gHWe}@zGX6m4);=7Obq5+VeS|&(0-tncX+{ zZ=ATop`Omy_Xa|JcB?0;urA114*;t%5 z?^&pQ`_-d z?eC;hH%Bvm4Z6xh>4_m-D>L>~niO?sW5jC`FzR0~>u_Yc!2#-J|BUN?%@{+%G1~q@ zXL{((b}~@3Qzy{5sfAj0u48)QW@r2#PA1n$+aVa8oLukB@5B&wK=4_@`D$7_vm85(!G9p-MULS9+Vrk*1buXa1d%=s$JXnWpK42? z{h5uScg%zg!tR)DEqNm?|9;d&_S=NRl|Bz771i;ftO&BysIGUk5IHzMevTNif2I6x z>+Gzb50ny)ZGFSGxCiO+;1y(BV;-Qe_?XY&^c!QEi6_+fu*w03&L z6V6Y|Ig;hl<%tDev0?@4_K25ynZb!Uhs+eHOgx3dm<@DT%k+ifK0x65#){~x6?E1;Q1QQ}?-RweMzrIT;I1Y1u$MvTa8k6RqqU}yP z)ZJb2feS%v)LEo*uA5S1VgD#(ERiBF87?~Fo}pzBDv_E-!1ViL^STOoN~Xy$>A^7N zEe~rU9VJ+!e})ahBWa+Q`EXgh;{a04t#X{4yM@EUSPi&DX?`F9bUGHDpiLpF2XN0^ zAZ=AM@`7Yz8Xw$6=cqWd^8GozzPq11QRV9!N6+2T|D!*cyH)1;>`c>)lkw5X{J?$G zE%avk{O~{5*c!2NkfR+2p~K2p&#SjOd%6xB&BlCI1<}Kj77ebGIP6<08$=e59qng< zZBp2HXzfS-LhQh3I?unR^q-`{%#`=zJYGqmQ~rWPCgC@k~L-oZ!?D5 zq^%@~BFMe6!2}JZ{X~EA#Dzz*q56U01hV?*qcD_+%5teGw7uE}2j(Eo>7I*N5B7fx zHN$YbQV}U|#jO`CTM5L?$z;*uk)u>QAq%G2N>UZ^mHbWW7ZXlNj>6R0v&rD`%??ny zsgc=;ZL@h|NQHW#JI6Q@`+Vhl>+QDEQVH>j2gl1F zoV5P<8{S z^YMX~Vu)39F=FQ7@EVl3h`2bu3A1OwZ6k?N^X;Izk+yT*-F{t7o^7r`GKXQ63w< zNrvcq#J1vk@+8YkRhnPdWN&>l(fT+lg+wVSvuxw(NwxcF7Cg+|!}+)x-Y%S43mY1n zoxy+`)WxtvjI>geW=_OmHM_y?s^&j;Yw}!la?DOW(#jQmbNlPlY2clH0CYNY=yv6 z`&4$9f|hS_e{!%JRkfH_o)t@?kvei_7FG;17DGrQ+kzb$-nq$fD1D~P1J?MxpKLQ7 z#A9qILDY#=7k}__TV7A=FzgC{wO^e^Yu(8{6=TW*B&6Wtj;??Cy=K42Q@xcpHcM&G zm>ZMy+v&nRQ^6qALaAqEq&+hDum%l)$K)J%$LPsG#p>gd7|g_3k1=;? zhBflVqLkCbj2#vON}1j&-|{E$Hm_tgm~&MBZIIZWMW{Hri}S-z z)6O=*WQeq8t!>%=33k`W>L{nWWY`D;i}-{1mecT7!`gvUnqcHp%Ob&?^G_<*%DJF9 zu6QG`HSz&bE>j7|?ZnY_;D?unF+aU|sjM6>MO9$7wvU>LjUK1oR|y&(byrc|Bj!U_BqVX~%N^xc6-vnuw?C$%+UDftM>gcQ=S0mm$unx3|*yLHnu zkrJ0tBNIwsrvPQ8Dg@PUVi%4N-3rCImo1L#FfAB3p3~J~#NxWA0dZEcx}38tgQ6SU zf$dOfvesz%7FeNDMQ<{fkaS}+5B|R;*qAtbmvWVXBO9=wX;Q?pHB;T+-0Y1~<%Vo? z$##|0Li6#%;SgN*cKaD)iUKyc)7g`R23HUFf4tYsVEl`FnjUmgZb z=pJ-5+)Zh@Rbi^6w{D2RE~_#76indh?opXfI(w*8r~Q3Ne!0kg<8dvpdxXI4SX|0i?@d4E*8K7)3PpAJ;SWFMb?dWaePM|kz!S5#SyyDIL zww^UG=V07qIXZ1UrCy67)+-&N{%dNEt{dy2UL~Ib(wV#{Csi21kpqs?-3k-5@v=%L z>aocT-f%JCC`<1zdYb_uy+jsHwK8JCl7E{3^^t8gD!tDXT+zPVW-ZDp7p*j2CjK5+ z)ZVDKdN$ggB|(I;#!$T8UoL6o1;_nomPExe!^l5F$*Y>ptY{i=^3j}?HxHw9=ob)s z5$(kc##+)9Vg*8(ABC4@7xk)$lUUdfK-&Kod9-K8#W-CGts`WBR}YY%!LS^Q%o zC0b*sMeGvyG(^P~+3K`zduJKstunf9EBh$Rv($D-_%`e4m`UXP$|Rd>4-)l5aDIu- ze*)&Dtuw@iHX(~N8&>?B{+7AfAJEEr!R&|Cha850BIKw6k}59eKqMDb$HjCUDrj{?K9gV{5$8r_bY4baabTZ; zrO2d0ysjQ^;z&$Pu!5fA)UVG_sMV7`1jRFR+K7(v|Od#>Ad^5wmQj5n#`*bbRGK^d-(c*9dVW*Lg`&{SX^haNz%;PLemjW zvnZg=U$T_t)Ip8L1wDTyi=svbq`d9C&~sniJZUb;wBW?5nJbpu!%h)&dRE6Rqp`0^ zFHr}79ufwL7qVAwCi`A6@bW{9V+Db2|a5ud)J<5{LHvS;7Kiy<6VEM~C? zLe50Y9=T3=j-1rXfT&ueb_tf+>%dTJ++*l;E2B-Of`WEPGUW)$h^>pKVouG1)M#jq z{vN8SskISG+!nny%h|>@($Oh^1yM5lhT3b#eJI{>lYSD6@RgQ7g_L5w>3bg%nWh7w zQyK-s4;Qhk$6;q%>7tm92*-8@{!CO-56i13im-d5h%aEf1x&H@Jf@^I*S(w;*4$OcTqPbGe=B&!50v7X8Bfi6j+eNUuKqOQgNWx(@oyQz7 zWfLx?JN*G~eXAx~-kHGy+2VV<3a8o1W#o0(gcWhlFO}ZuJY4#}GzHtvSBkMDJDYDi%+@6{7pwc#i#dCi)pmBYt?55<^77J{j|{`{Jl|mUTwA- z-?hK0d?(V)@0zX3{`cSSOhzz3$2-AbJPP_vZ~XoD7htJiCyI`GF(4)vAYYpEZiD3!;Z(Bs(J>WvI#Y`*dX`&o?}^W8aA&VJML zjwencj5|Uhc#Wv!t;SKs4NP9eo@sa-M=M_W+4N=xE*Fm`qdvT0WT7O40m&sX%JB!E zBc=h#<3Y|razaLu9?2RBOmz+uAV%fs2pL@(+k_=xaF+3??+p+b1wfC$Gp%yOs^(-k z3`XNU7*!aEN`3dV?N%nAKHRK~b=_Tw?Dnx~guHEV+X&ZMVg8p@j98JydYJrwKq` zc%7a%3LSoMncgAZjjei7DeqPq?aH_9>cL)JoP}pTmWqG#!|?Z9qiG@MDOI<7rc-68 zk0lcsOwNy)JCt-{0Lhh30J&^})TyR`T+xY7zVf^w_826VbK6Ynx@PxdkJk_2jm8-E z|H9{32Nj5WYR{i>N2Rl~dh{EL(sSj3hD6tfk@jqI0#8hjVn|Og3gNFrwHyzs?+k=+ z8b!+Sp5_*HMyHc==>eGn3hB`ojlD}Co?5xn_W_cFZmb6kBC0YYzgllMzdP8W3IMVt zQpcmtAUyZSWAfS@h%Nz}j#~;NPc;VKcRGEV$J*p1$0B**H9wN!r>d)JUE=i(=E2v5x>G>WN$*IhfBtf*22^4gl$r(mdG~1udEvl6vO6)9(je zN-Z1O#i(|Jhhsrsu)3_kpzw7=Xbj4LQ#u2sTEcV#c-y@345D#r0nngp`xGjR>{G1* z`Vpa6suPAmAfQYc+APX8@cS&sEU>t((rMunMNgUQhghok5=3_WsmIL4L;)w)D-)7w zZCbEpc_4>YFz)o9U5vdjrmXACq#UaEt-kl54EKPRrRszTQX2{nPVDX_BD){lptx zG*y-a5JrNe{4#vpzBfJ#rc{EzWw+d+&%EgC&d4Xx{k9mu0u2KZ{{EnI4r23yIjs35 zG6xU%MSt&8VtNk>C zv?E+bQ;L}kzqdPTR^XJ@EFu#}D}z9PWH!$_A`~fx`i?tk~X`Jh^$avr}m{na?k9 zC9o8t-LFx92n9iw+*C!Io=C5SE+Ik8w$;6oF9x?QeS z8Z9%|Fc_+(Q|eRyWPpJks|P!^qg@!bSQ{Q3u|bz%VpM%cF{k+oO%<6A21Q+s+X1}z za5j4|GFckF4SN1bYH4Y~;(x^E(ofFD=l!Qoj)UICQ*1zDDp!XFqQlgr=_gAB?8y>A zmM|l|h)e}U>zz(KUvz#q@!^rgLlA+unWPk1kP(byWh+5~gBaJ$rC5BkXyLs;+z`O| zndGRafemAswCi%fCWQ0LV9u{A4I*MvY(5&oCmO5x0~M}r9%#{i`KwB;e(*d~%oRwE z9ghax;YEhCp!lyd?RsGsu*Lfbatl&_Otanri3P?|d$(3=BZ0STm4hUuJ2eIXfGpei zPVDykNO~FZqI|GhtBA9GiZ7oNn&O;`xtEyqK^*9W!JrM2Y#U>gP0u3LJN;q9BdMT= z0_MVkKm_4;tA-0l2aO5{*p-8w%5J1V$;gUjr>BVE^Hg}-`@fgj|G#Mjzv^R8BBj{s&t19u>nFdakAEX3^9{?GGyd0Bm)-ck>!sq#{rJC& zYw;GZ)Z(JRc~{_k&Wp4>zN?Of_s;81P&+U_^VHrgEZE}-JN+;~HA{%fC2?49wggJn zsJ$1Yyz&tktnxsPg5`(k!h}7JRB^Brgw>r-;1D7iFBz0f#!G9LG+w$@+}tiSXj)V1 zq7b9cIw34|fq~~!sFCZFjSFt&2oUDm(Dn>0Dfx?37qO0ML2o;!0VSgTRhm|PB#LnY zkUoa65JMg552%G$P>VnHOnMr4zyPuMdxTMBpx00GbzsYqjFjw6;K%DUqy7A>SszI8(d)5rnhc8?!cNSb;Y(Gqg-r zE<{zhq!xb^j@!JA$ha`RMU)gN8Ch4vzzE7WXiF+D{8%k`JB^xMhS}8Tyj%H;!r+xj7dbQTWrEQ=}45vNQtq< z6{pl0y($i~$#hT34BY+RRw1I5h9jj&*U(byRF3vK;){l^)=F%=j}qG&TPwZ&3A3n7 zR3I)eQTtOcP)iIIGb_crh2KFm){O5oumI}@(5Ks0i&Y=Uh3LTV%iUi)*B4@d8{bZg zRA!?@NpRuhIAh=>XTvHw&s6yZtL650qlT)i#A-gd#Twd>coUuQD{JVKv}gdpw5aA7 zz+3e^y>&7LQ}=8nI5uqX!^v2NYVQj_ntK(&@d_R(Nlxadi^Sc& zTIJw*>&3J&kuy@ZzB{bg!@=0n!GxrDCiRe+O7G|BB&|mIpjj)oD!cK7(XI|A|NEm# z#zkn0MA;Nb142k9-#I2(171X;3eTfZ<;?4>sf~m8 zFJHfcHwZAEA;b(Ie{dd7OyUA(pjselfk>9_pM+`s&^`5Gagk1?_(vWwj`jTIYf$E| z|3}{G4a=CP|0^!9#Pomb%lGU5ySN&a=at=RYbBL>8Q;MCUR(Q1WB=8B;Z@2t<=-Y1 z{!zKTTWx&*yItzu$T7;oN@#go;DC5WYnAALb->v z`gi-Z+AKGoS6bWYVj;hr-a=SA1d-Z-zi@l9P6}bDSYQ4Qz1SS=D; za9gq1#j0B*Yf)TE)7hp$l+jq30x+V^Xso25yJ}1`Eg*={>xo5JsD^*|{^j@Pa`O9E z-@l@FpJj} z-YEW%;GqJ_hjM?55Q*XuCUY^XL6K+Pb z=a0nVP;xp+^FYc(CJqsrDa@RTUuKEAh*3U*rpCS`)&pK~0$BFH6rZ@f<(1eX9f08c zwS=r&;sg&&cKcpu00cfd7mFw25zxz{d>{V_>EC`wbC`YZu*+b`q~I^_7bNj(s{EJl zdBgB_%9v~a6O;c}S4;Q%|95gt?SEnew^PQ|*MF<4%WL=Rzq`0*_dlxeZ*BlIZ~U*9 zV)lQq{E)`2lg*8!J+bnHtuB?i2aQ+k7*_@L}ZJN}O zNXdCRSCmR=Wj`9*i_FOTT~^x>s*RT%_h zfdUqqbywPlAQa1;FtT02O^Pe@|LpNE_t9?10_N#|aLha7e|`Dh|JR*dw>tLJ_&3Og zSilPFlM2P960m@c&DE97<&B?^1@O*bCq%Ow7%==py&b|EwQna^r0E2%p&ZQI{&wy3 zeS1|yW6!>Pgq!EQ3*Q;$I}_Y5=e_sXZho|h&CE@4H^_(E($c~SKjN_qX`rLkAuiGx+!v$&D81gt16IOmI2>k!y-{j2Kq zJX0zXy!N3ACLBIq(YP9*h6hW1Z=@la<_?e{vU3n<|M-b>iO}=pS>dJ0*zdQct!p=x zU=#u1Py;)l^Uqg==GaUip^Q$^kfTxAufrr!-rbEi-0Dp9{ns9O=fT)(cY3{%O2W;S zU|yg(?zX~|OnnxF<0#2ty&;pJDlK|{)Fjlydps;h?;Yz6_{8QK@R8?JWzmV5M*fwN z0wux>YXC89GYHE%NmOYgiLAd$(x|uUJN24u+b9?Z-JlXO;nsVGwmf&5^b*uMAr)W%(lMh^Peq&a`2Rj0APfwE3pw)fvED z2qg^L?2)K_4E1=e2csmJofk(3UsZPb6kM9lwL-r7S8VASYrHl)#0p>mXXw8mUP4y< z$8AxF>g2Gxgc@P(~$_es#>c9oz0^ut2?{)yPuvuv% zmnvb_F^L6#Q>sx8kb=d>A1#?ay)VKgD~@HbQ4boq^!_HGnLmw?2qVsmN`SI>7+>#3QI@_q96IAY9+& zC_Na7QM}1mZyb;0!f<>kGDBQGk>^f!B2ptcf+v1V2NS8vm^M6b49OdXL*R2N2dPjsmL(kD74Z+KnLe*;-Md@7jF@}z7>PMu+?9T$0K;{!z#3xVt) z1(vl5!c$Hl_ZULyy~!{$T6{VTV3nU?uUM9QK*3&_vj$EI%107YNeI*!c`j}TgZ>3O zq(?F_s(3wYVTlS^$52VHGf2XgS$G^#%2AL6Ky7kywfNM4VYIfG+*-wxf1;*Nrwd*1 z^ky187jLD?Kfj5n@ghf%cilu?@HLyL^3QJ~YvS&_fwI_ZHt$?H7M;^Ll+;I|*K1Ek z{+&0`D*T!aHDO$$xj#oMZ_v2Qv`H)8@1D)*lCR5W6oC1yL?!;6H;@XwX4^3DCHN=% z4ZM5yDa*Ys_vGwJ?Gsk}ESVy?k>YBN6v>TbZzl+Y(kb!N+=kNz%;)eTxLBhVfwT8? zYn`$g?Oz?#+t2E|-=(K+X^CJ2a28@;cPsQOO{G-Fa_2f!Yff}-(hYiEQvWCIs$FZ{ zG`C}UVU!aEwZeqg-SZ)JX$%F_p@ppBbDRC-6OhCXp+%Ylh8AJu33FO`30sEOFVzBe z`Lb2--BRfioGw3Q#dHu>a4M4(I}{(^47~{tj!~k!Uw@q|RRNHsi0=fzb^@r!8`|_o zGCc3}I_MTUgtuaH-VtxS-{(_x0kswVvURsW+1tQG84MdTa<8 z5TC?(=_>BND87<&7gf0Los1Qu3Wj5RFIkkEQB8TuJJLW!l?WyStHveSt?t!vNRkl1j<*4Fl3<6C5wWC=E!;>zs2k>FL<69Y_MQdaOu=v5xft#DYw9 zHW|D|NV1qXZ*=24m|}zq^uWjxgsij`M5446)#?ZB28jA;aa&T5Rfst~DwIo)(3Fmd z?29jCYzp`v+U4Vrg?|Px8pE(Ny7-b>gIJ*CY7$|OVJwl-`>V_e_Tnt+(A!;}NnwbY zNuq?R3%(S~q(lewoQ+H28rY>6X3xiy%{}cl2+90r3(+~!SWYm9d!9tLcPOi`Nw1L*`CqTo_{L+s+SK?la+GLqF!ze4x8;iKw zxz0gpH=Y1`|MLt>xGY{4JcP-L>fcyytF zP*{y=39>?!v-lK&%ZW=@0S!iNdd0Rb=7`jM*)pI`c~@)Q{32RWf=&X~xv%`A4JKCC6t z$eK7ip0mi#1%knqqeKQ{UFO&CnLn$crLd)D0-E!f?hywaaSFp^pol%fvyG%nVdfLF zo%T$tli>QJ6MD1;F_LSGAcfLPA;1imq}u&Hb-5X(>5Y+R@B;jHwgr1aUyB-wB+Orz;Kg(_l88>qIlAz6~PFjI&r zW-0dzBPgeSbBIbB8})jBcC4Y(>)ntwpxxsyq9>suH)9P+z4+(F7_Qu#zbwX(XhQo7 zBd04f1~0w|^pY}xI$k^z$m&(ywiDsatJ zWCB{G2F`*#qW#l>M@Hs3fhK3La0K>%YmXEE6czva@SR+6&L9rizJ73e`vf0@JqvR( z)#d2LMvTmQCGEE&9Q)MW?Y3V=eGP+?@!QVG6Hy_Fh_I`2B}CX+GgoN%?f1HD^{g&8 z%D&aX;)UJL5C+Qlyf3sdrh_A*l+jga0}pooTqq*{ayLVftqgQvBPNm&Q9mAIXdYu6 zR}TfA^!37PY5?c32@8A-C-L*fw?#J=LnTcxmf;UCjhEY}4;%1ITudPlvPyjQq0GYnsW1KI%v65akf9CoI%Vmsgn}m~~ z)?dc3MOn4V;fA!0;KUj8byjZ-7<_ppC(u=@3bRa*%m(w>mi=<$s~p!!?F7<*WOkkt zQDp5z%^a|sk?*~cENVCkaEnm*J#R4fPkcW5C^CoDT@IAyk3+PCfUggkA%6-4|B2*g z89cb}_pXYx_jiEG7({ht!-*8 z)1t*;0!VGOtlG|ox^7C-1X!kYEntlviy6ntEXuw!0kPV2R3>Fx#ze$QGe?;)Zt+E# zrr7PNOmTxD%r(sp$!xJ(kkR6VEP5|J-b2xzy-b_5H=WK+-}5$V#q@5K;q2x{*fNzs zDo4`(i;=@o9cff0DA^UY*&18399NlZr2hRD8e{{}u1?bZh)fu_gBKSz?lGOo~UF|qon5|fXGXXRbxpU}$WezY>} z)f>;MyStSGryTpEmF1w`f-gr0Zq@9MRu*N9|4(dK zoDv??q2`w~s(xF-Ip2HsyY zuc_l-$2+=t8MDWKsj#vf8~@8|_x_*n2XWYm#?X>s8<8L`~h z97Er*=vJF_nC<#_vLb!RE^1NTEQUef?_Q)yfQ&C7BZe)+BNXPnE#2_y!A|XHw}OFm ztd*vC6on9u^rv#&jl3Qpjo#n_^t>;Z<59bI$J$%!|8%H(eo`Gpj z6&Cfcl8bI=YcYoJ5Ut|NnEe!(k&GI-aJrk zU?e(qp{NkQ#%U8VVC^gOfF6RJ)0@YPri^QxBK@(CU=#zf7}(Tt9~I~lBeBr&gCW};V(04>lVBNjisvXL zUvl9)ROk>PS)?OI zQ~=h8p(3w*Y#Udaitr{M&}rlxsC(XPLr0v4L?h>+qK7JY>b(Vw> z%@qj#YV!p^c6)Z)l0FS4DFsi`22&ISGmtRdTw}@9D#;%2}#1^&x};==XXp z7I~U7rX8jivY84eL)^TBN*-S*4q-a+kSGk!VTAOE@&JK=c(qHGxJW7=QbgKztNc}^ zm;pLTgN(Be4W+5+=<0XkK?Wp9VVU&23TojOA51x+8Q#=OZylJ z&hnqD=Ae;EHtM{EUhsKOsYDKTX?ToIUlx&oM!Eu=k`iJ|pV#Wo%C%{AK}kK(!1EEOf##45QbCxj(`zWy`ROmYC)%`nUx&0xcfDlz&f0aP+JDTdm?yE$!y9;Twt}#8nNW4 z94!}fsuWFBR5*P%zBr{vEKqG=a)}AD4`SJzZR6w5@PD&qDvKV~4Ed6Kk5$KQT%O0I zRenmAmy;%;gkvwx%wx=E_>=S!u4-fof1`{Mn*XST1xSFIYjx1s`FoWSGLQb2> zO@Giuo5M}vTiO~lR&%MAq?+RiCE_ZC^@kyA19aWFW94!`QZ!=6)C?yUmsL&_auGz* zNt^(??6V-T$!0cMBayefGDSTMLwiPNm^<&GWIM?m2eD@KcUJu24-o^vj|Ki;QVRq5 zWV`;=t+kisDRi%bbuuf1VS1)Fe<8L#Xd2N%r#67;M{CPRG>=6K5DmQk6?PRtSyG4o(4`NnP|W&h zcz$SD#4HxI8xU(Q8V7cwEpq!|c(}S``wah8yKM6b^9~*o*Gf;_Y>wGxdMHbFZZwhx z;nRm&rn&qifq{BYg5$8nx0S$>whZOl!p;2kW`Q7 zjJX>EYVTsooNKS}E;Av9^VWFgq#v75ev0a2oLah(H!6B|R#wmC z|Avc!*b0cpFsA*|6 zUs&p%`uJ0=1=4!yD1j+Q*Nw_fy|GI(a9Zj#8l=RELUzTrIE1$I*%ax&mN9&jYu5OO z`6tYuzrJx9^Tz*5vEYvX)%AP(zdN};O?}Eft>AwY#Fhr0*W*1BRMeCY%R4VBC2>3f z;YfrRFjJnVK24=y;NgNDbv8WQl>FT0BPHj<&UkS(UnD~~nn(IDB0u{<=G)xPhy4K7 zh@WMeFWR;00Z71~Wp-+KYN44Giz7Vx32y+H_s;90{!J`OiD;1o$3=Cj%!G*`Q@hn> zYo}HzAGBNL#`8+6$(5AE3_>e1qaM5zQPom^wX9<5_@{MaDUYJpP0N@U|GQ9HcE|tP za`Arr-^KMQDY4|xLV36>mwL7W4_CMO6f%pwpx;;FE8lg_hkXjJa~5c;3&E$4(V|bm z@K6J!gUkXPjxB4D7)6&|#^|zZONEuC5(b*xT-n$xtbw#X0vR2axEx>>cc%8ay2dg| z4sb2ChC%8{^<-avWK;I1sfAB@OWx-Q+$Yp9@_H81a=+Z`$$eE5dY-n5XM7&U0UKzI zY@C9TTVS-2Yd}P3dy{^j!kmc=ty20O+{VWJR_!Tp6a?cemZgw@`^S+^lHh+T_oMOm z&hsiRiFd0FEqtY(EGaZSmD-NKT2}a1dClYhKqEIUV;=usEyVc$%6j3R|KG*6c#BtR zaZ&8sJSdOvs$+pt++=KW!H8G8BW0WkMk}MnsgV0N-QqA&VmDGJzE*DG5v*JCU&u4Qf zwXaWboG%Q8K84mN-h4P_O(Hz>0-6@MR`7ve<11yrBRGBj)Ej4BXSEVs?rh+3>esL6 zEv(uTGlrNkC*DMPITIB1MrXu3rSQQT0fnpJHCl~eJ6UheU-LM-Wm75t1kEexBsNT< z8AwQbWNF^JN+W>{QnIq}CxvTvq757 zTmS0Md%jHK|EP8Cd*h|sDg&AP`s(V`^*>w=|6g4xtv(Q|w^e~z*IzmRpVj~0RGuwX z5B6?M2UqX^wUyPC`~JU+>oWb{_m6Kx16S|=b@+AP|95d+rvJlH_s;u&W%<7U@8Y^_ z|I1CAYn5^3{x20)3+wm&e;3yk`(LNIN*P!0|I%`?aNqxTab33mgVE`==YVUB|HAV9 z{C_9cRr;UP4oAU1dEKk54zDr(*9-Ua|D9ad@BhnB1y}F?mDR%i`tMGz>-YcVwM5tG z|K+uN`R`7yoA*ENDo#30e#-w-=S^(G2s?QC{!ekWuvT*Ve|>Fb{eJ)FF0Nsx`x?(v zL;vQj{>@9ZyX@wzRLVam=f~K?c|XYS`RKjMd0DMj-gP|+0%3i7r{Lrzq0CE$hSd2N z@J~~ff2m}0kL1#+dEX>z9HN0$`?xEx@=y6^ozU+_XUc=o*3_i6;Plj+@%?ZV4876# zVk$Hn|A2hLDh#grF}}H6+9sc!OD#R(8@86;aa>&{`^E;=3I7GksWamDd9QW~TeZLciPF=ir zV{gz4h0z}=JnjM&$7mLWDhjDY5x=DgI9X57(Tw59e?xA%_zc2{k5NaO>>3ykOB|LP z<$d0M+9p@s&;tx4y)`d;`RHKh1s)kFw_Z?oITjR$M6-;!P@a{W6|}Vwx)Kt~aVNy^ zk8=SW*6X!)v-%Ge7XY5AKsPf4L1K)FPXt6MHiqOU>*`Bd<;>7AY-$qV#+LT4V}p^k zvM#95A>;#cBS5&j$DWcRcL3ta@#rakXgGvMX9ScFC`GzCI=Q0W8b{A{>JCF2c_-e; z8+1JtD~Ef>a72K~s0B=fblwClbTU~;KSCoWml;7~K5;c3UC>{3{%UCnyJ$2H1yPcG zD^Ws3Nr#~%JRaehEbgHqHV)O{mW-y%?3RRq2jU38C);8$>Gz{u(>Z^zZ@W2%Pz`F9UOqvI3I!X)8N5rY~x=4WX3sv2?E{O(ngy}{|bmI8f z^+%V5rN)^H1}oWwQF2KzdbDXcs)O*%eCHhzXQ;j@`VhtmJ)Hq*7EAc*v;Q zXz1_dUl?lLvkb?t*$YPJoroHRmz`P2V$lT_brI zMbTX*9RrZo)o1D926nd}T+fSsA=BXqiDR+A8m*rIG+g5#%|_4iK) z!3f>{B~}Y3ZNKYf;sxae_#q zK${J=^U;POiZi1Sffl0Cl+cRvZS+*aQO?kxoIV#A<_IRUCe?H~-F4U!KQ z0%IzWlNsSuHt-HnYS$iS&&Z|+Db@NMAs+4X6)$E{@Z~E(0gtxD4-t^4hu&``60Y_c zi^qC#u9?NnFwGR2Ms|v?BjP96Ts6_JNht{d(5#|9WzvlCw2@Dz&XcVVwkpOVNh<2c ztH^#KV)N$Iu{iSj9xxTId(A24_PL549Xllbvbc=~)98-KcFrT|mbq^Br9f!c*o71^?q+VXm|5TrEBn{0}mF_LueBm#Aj?1##LPFl_B zy2-C<4YM6pi*avO?)YNt!AKzj2*(`x;k9Kq!`Ids4Sk;ps*hY@Wu^~*R zr8@@l_?L%jcKTtJ=9V2G{tSV$%=#h}=cS3TF%pnEdG!NNzQ-m ziS#2nR-(ZG<_T}m8Aod_H70{#yi1O+l+MXodmwC{KpRj1wkeZdGN(gojf4?v z5mngW6@5laeEiA}=KQR2YGednHSBjlsC>BeFegx-2YeL;E?6?|oOMQacC1=F4cguU z;5@n~DUUOStW#axljD3iIhJ;{MH}+_cr6tUzA$@FeRn!lb5p#aKf9d)(i8|oLH~`H zQ`{GEX^v_K%KO-0=7Y>P;iIvBh=2oYYkb#kwi?xg=huM#_Y-e)!K9D`y;0e(w<_%y z_2#A7v;n+9q3&M5oH+w_d3U#QZP?{rZ*hsQ~r+KW9^l9 zE)Nn! z1}Ew-B4<0_vU@Z1a8WF%&AcW|wa{UxQKmqiT~EaoMYVMzY_rOgO2di*PRaV(TY}zL zzE>Hf4v<{B!Rj--0FE*W2DlAl<&^30yHv196=Bxc(^QGcWi-0}3P#S(rcrODF5#`N zJ=#i;JD+Mt!Cs@~?42F06pCwYL$%?8^^`=fgd_TgLl2;HSyO%)6$1F%u6H~+wO^q(2uN-9MlFwCWYJVX(iGQ5=L@~@b8=Ff zN%I%I(aAaGvdTuKm5o_r8&jmslBE-Kj*x$pr=E3Qd;6 zJkWFrsW)K)gNfDjg9{74V+ zEN2;TdYLlX_FPap6NMSMp=7jAx%&=jN}4qvS;S*aM|%54H&`xA)I4RB$6riVMw-*a zvUHoH-7GZ&n4(2$+Agp$we>Ri5Z|jO&(Rsx6=CIkIKIeaO>F??%fIdTV^dY9e@yEZ z32_{hN23lvd|7xE<(3~ga)7bRWx$mPtWDhjyUhNVi6m$5%jgfZrgP!gEINjK& zr>EdpQmt|&t>?Eazn7mSb_c=OKe^BZ{NAYN`=49*{sml@S^tgOa_`}qWz1RsEtgi- z-19%nc>d#l{rA&fPrk%GCFx9WJ6+5d(!v{b1GK=~PFI`t#f^>C$BV`EmrqkqKH07B zpk5L8q82;Dp*TExR;%ua^y1P|b21S7es>hGlfW>CL51^6OS`RIvKTEJc7>&UX=$l) zkcLr6fqplamT2V_P6qjIaK7|UCC^*xjeFseET~;-m-6r;4V93u(17I0CyR@6Ls@96 zgJ!gqV>mEdT%-(=w8{EJKP{s2>?sR%PnN8gb~;+%J)O5y&RbjD5kSrz32{{W$jui_ zin1wc#|cek)S#3NfLth5Es|NxQ^}N{(39B;%To2plJVWnLK@kphF>t%1j2-whRa@Z z3y&Hi>rQigzptZjU9sNMHuefto?Fe-0@be;Na8~Qi*{B+kqKz}>h!aDy+X(BOoLQW zl*?bS5qjfxZZi~zRkU{{j2~!Sf|@%YhFXPyQlXZ6K+a?zbV@ZIUbRWe$&zOEKld#8 zmwU~U|MoktJsb)*En|-SS6V3*UH>1D{$BpOi%Ysg_R!tlD!SV%EQ{jG=1OU^ zRI=RdrCO0CNh+nHGkuoXsUPfBpJ!94{noY^w?AuZF+ResJ^ferH^@m#ZS@farAL|d#j;giY=o86cUYJV#UHR)W!1^qMKiV(q z`<3j{u|FU=v%vh^GU-`S_LTF+v=1cjW6^x#h#Ixnw}LbcS?uaM(wkk zQBwJ+3xysm*J_95ov+HzE6r^Y-~E&RKoku$kDh@n1}R}BJ{$oly)!BTy_U_vvjH-j zYSxb$I~C4kCtXTRxd&~;jgHSUP((O6!6KF((S{?!j=*KJ*nLg-xh?Yeli~twORKuY z&oVN!XqK>-`mD7n;0J(^e4cLtwzJK-oD|$g#=94Y-F6|`VNl3k8CV#>OiKnV2QQfc(dJI`ri6r7b0G;WFtb`Y3 zLa@J0rJ&85sfE$GSR9?ih$gjg{u+h%_LOH3^u={1F!Ka-#J?B#?iV`)e_V{56%;;l;MfCA(N?3%6AXssKZ) z^!zbL=y)R!2HE5s zYt-v4oqT6=>2MUB!rGk7ki(^~h%GUQDFB{T57I&b`0NJ*?0b~fX6A*-@!EM|+L)Rb z1lE~(Q9e#j$&32Rfrx{rTo^}C9hj^Z7M^(Bvp}4CVc0p+4P{>#Fg>{A1C3YUaEQW6PZ#}a`i-+rGa zJDoUc1uBhs;qc%0$)B{$ELC0RVzZON+K6IQ7G@fU0QP(G;aZZN4OvLrvOBf zw<90BcRZSSER;A9$8BR%-h^hoPKJcQwNP~>-MGmZvr=lF4A98N z6UW~8t>+EcYFC;*p+_HWkAc6+bo6G^I(w57yPbjG4@7GMG<-WTz*4sxN(|dT7CCH` ztlht8QzU$gk-zfFVG24JkT0aaA&ROM{v;vJqR?I5xZN50BEj2JYC%UPTUan6js5UG zM=z9{7Jin&%YG1~tvMlwW~7?zj5}zy)845ce%Gizf6<~7uQ1V#{L{0s$n0cs*Lh_T zx1I&7|Ih;-GURlQa_(06M1Hk?fO(Ywnm}d0ogdZCMy$*rH~y@Y@{`;H#ILCGrk8#= zLJ2a@5#Nv9ur_yODXp0S`iB~NoLrji)UplgS0bZC~7ZNl914W=ArvYV78ql1f4 zhAag`b6}s*p=A^J8HQ7fpmusad9e8`_a+ep9p6A7a0Za`@H8urC~VSqev^>9%crt2 zz?uo58=Va|Dihj=#;rsNuty$isZGF>QQrbM=rv?2{$zsDN4tlBNTezQkjM;-E})c~ zruUyg5-9e%qm}CxG(1%80(89ea2g%b?skSJ^3Bl&Il&CbA11K{8AOqIMjFH6F&+duaE{`dl(dhBEq?b%eU?A3e$y+yt8$-m}mz6iYctn$jLM4iq{BiV%|le>-k`=rKlM+-^zBa&6f#p29d4Xicj7n6>M{Hxv_@ni`p)WzluG$(#9GV{RpXX_hC?6z+@i|;^%Go4^8fFHp?7P+ zA0J#N{@2QSaqZs!|6N>D`@a|5Ea;nYUA_NTSJv+1zud_+v;U8;7Uyf)b@l#VE3Dm* z|2w(n^?%>m?uk|AoV01U*IMltn#+gxRPD!hGF_?YGKlcwSONL(TkK~5mRi6o*#C_ z`_z*qdWlCnxV+SpqUb@cG<+qcenzF>5k ze)_~eKTSdIab)`yj=HmRDYIz!vsf%`Com!&)w3HMz3W>U!*- zK7DdLt4EFjDyB-gfKd^CjM#=>8jVA-6e0Jl^t3Mie&UJ$2XsgY-wfeJcUoCu=#9=% z?E&41uSfbIo&1h|Lq}uWSoXx^Tpb4N{MY|iAbNo~K~LW3Y*Zxm05Tm$JQj^P(QQ7?7Ch1tB1-A4Ir>W&kN6v=Do#-x+sE^MrFG!-i$vL#?7?nZe|If&$szwh_e85f6n{>zFlO_Ktl3ggzp#DDxUBAO{GAfM> zRRySmBD{Cr`LG{k74C;m%clVp==G4o164aLL!E)Vz(R83eA4R-pdJD4LjfdcDQb`Y z%NwtcsfS!z`y}YYu%~)aOU#M~1E?yj(*Z#yA`BGdg=l#G!0#fis2w@zHGn-B2cJab zaugbL(sa7@B=E(thY0LKt9sDzH$nG*MQzZ3LA(wEXdcxT`ex7}uH8W#%6DNhJ~y$E zlH99?^(nR#dUxdW*azrlPTWz>i?4P0K&JoY)E`iJ`lL2g8c6nk#mZH8MP`78Lfy$| z9AtC&Zv6iqPhd zGGGlo=pN`VfZ6Sw`-8JU^|ajY$n?D9j{lCS)~rVscOh|L!Ute4uQ{KIuis5P?k#{6 zO!DF|B3X1vJR>bO>c0r+cEA$TAP)oRHCb~eW0<`?!n3AuelKez`2e(-So4z1t7f>9 zAXqx?jBsaA_|TsbmQ>>btV|%sCNSFg_ysup*}+iMC@&m(UH`=I0vha|!GQ>TynhNU z?TknM@q`@eI5eB7?&cKf0CwztpfDpq^<6yhJrV=2-$Bg0Nu*O4L`0!P#Y0rEqO+af zO*(^dCyYuA;gugEOQtD?cm?&ZRW$UyPXUb3e@Qf;cSipW7*G&SpOA4>lgKf~p%86+ zU@4GhuX7BT-S33Z9^}0tItn`{$JU4;pZL9J?VRyM``>8t_L3%pDH775tOd_NdF1~_ zL$K*%a~7j6>-gkR&gZS6|N8&MbJjEidt67zB2v11NZua@o0xj>puX5VEblM2UX%~M zYW_B%K9D~My8+7%I{{+lzW|xRh=n#IBYXqXQV=rxG$o-YAxz641=CSTW5q+KA(x}m zkQ<`-cyncAv$z5c(Fm4jB0;!iDDVrVT9R@}xc<3i{8`t`_1`4?xz_*1;(h$*JGtid zKL#ZDsn`F-_4U~L|33cb-CT+5f0}2sF$eA<-Y@@u*5&{74!Pm#A9uce?`Cpm**H*Z-jVp1ANM_d(14>ZD6^?1v@2l@$`yS};cpN-T~tx@jG&_4=wYZZKr3?!25OKF=ECzJ zI9*=k&Gk7@Swsz0u9h`2-U7|S3LPMaKwLQjMGm1u50`o9Yf-iVdk~9+x~MnEYUeG; z(fmvTvORG68ctq(XO@a}wB4r-(I`Va$FW1h$b16S+e8M@Uba~RZ`(M&M$fhn29MD-N zE@Yy_bpRdb2t>gS@eL6@tfO;$vRPU_!3vp|$j;K)S}!Aa2xm=TIKX;d2ve)qlkuB+ z@ay;@X|4R$2l_el`a^adYcG?lM5(w;)(qxy!h~(ln6y%cv3z8-0%`9&z-U~C4dsx% zsa}6|OvOw>y+GzbgvhtvdVQEkyg5r_V=+KWu&A}&Gv!o~N`-O*F7+2bE&tD7@`x#NE&=KpEs ze*E9fHGBLgj8Y_tD-Tn3V)Jt<4Pz$vwyrjIV-P6Y)^*2p4BRe%&;af8#DAG%AFtWt zf8_n{4(9(tY1tkB%cau&_`i!QqFWhm`+iOKS9MJt|F`A*`N910zY-h&Ys;`)ydVE} zaLw`mJX5WcYHbUol|&EFJEjNdoyY^UcB{KnL&vr|?9+DVF8u0JG2~Tu2fgZ=USv<8 zdi-Aeb@9Kc?X$s5EW$G_fay?Gh4$A57db;Hj5zj|-~b2pb9{x~zs zpOaA^11QL+au0ZHd(Hfzbj!ISbn?}I-> z&2`ntu(mq(&h@AK3rHJ`E>seJ^t+vYD)p)I(@cB6{opOOvhNRUXU&m?fwTaSMg~0A z^p0i9wpkF{;$d%d37flEm7AtZj`_sHRLbCh+p5)>hf0nAFn7vr#{iU=^n3!m96;+n z$bd+M>|eskgkJw7C;Xn=*WG^jFejw?gnrBQ;`Tu>@ZJ>+6?NLr#&)aX?ZB#t9+qtA+;XdbLG);(2m+4HB>~h4XF{>is0R50D%tQRd_29>NQr z2Jp>!(4#kRAHL7I+2nxM8O5xeSP5i7YVG0jpol-nA)byLf}>d{#Zc4njBfdCmA3s$@iY zbPPMlho1L3qXJRWchsY|r8lF53^;FQV(E`BICgd48)R%KGAaLyPG8VH7eAqy-D|X6 zvWk%|s`IbC3z#7^0|oy2F#nJkE97{+DLzH>KMLN9W`a1$Jw&^pf!EKI-4u-2_Sios zP9!e?{qprIw_UP8_>xj3ncrVNgg=e%+Rav@dhq<=D_tXm_E08jA2q5E5i-4G=V0XY z3toP~FLC+bt{&{w=~ep6H2jOR(5$i~^1OcN*~Qw)a9VzN^J=A{{PecfC?7Oy*t996Z zQEvhm7|)vzF&K5!qnvy)1g?^?P_$oZy{JPAvlzAg;UVU?alKPNXkiU&m4oN47pm}# zL;O>_Dj~b-ECRt!yxMO%qmWU>-?U(q?{vvAk{Wcl6w(3|nd(WT88DGI80BCV>9H%5 z?vdBl%tNFj_2=JW}0ZK)2Y;S{mSmt%Ta_SS?6#escUQT{x~#DDuJLUGmPp! z2_+bQm;(uNHDxAFZb0MBYzd7Ya=iaLAE8lw zbaM_dbc9X^gwY-cut;Q1H+`%{+|bCWC4o8l$Sr4-EnonCHr+`e3@-W-6TMRM z+wmA>NfheQ(u@ed$;HQDm{Yw77Q8quE$Ho707+58}2t6D5M1i9&C9K}Y?sirAmUIUO; z;$zhSSYvh1U~NCT5Mh9aCr&*&B|?=Sc<;s$GeObJZTQQF?wbRs4v=s6HB5-x+Xa(n z01P*^mYvMm{pDiu70snf56$d&#mlFB%~pBmD_9SAhUgDF^YCFdH9b#anUO&7Pk}$k zynILk&g|lHSi{Se8^m7A3Um3zrzT`A5fHeSL}qecZ>x@<{j zKs9JVFNcTAP;J^JBW;6p<5U|=Mv|f6G51lz2tq2=fF-qdPSN=!8pXf$Fad=WI~`y_ zNb&&|&PC?q<6p1VoRTg-;E!<2&mVAGa5bT+3(rS%$lM+UCpy((n!-otIOLHB1Z~gb zxM+#>@>wTr!x|@J(qwjX23^?Hiylc|%}m{>?AO1pB&Da$q-tV_d1*nlq|Z?3BRM>y z=ctE(xuh;vk{ZT@Vgm{A_{p|OTbFNa5=aRa(5Oi_-}zk|!{9mHJCoRLke@Q0z4b%# zK0txJ9-b4MPm(R|$z=+ar9S;hsZ2trDLZ2on7GPK8@w!yRDoGkj#&4jq&-(Jc|F=82eiCQK(cxJN z0Z<()*VXI=UpguFdI<@Ed;^xJko}=zfYvr5qfW2-2+R-1A-kjQs^g73P4oFJpTHqR zGH!`Tnao>C(!6DDskkl*#m&{iW^v65Z+@#txpjZhO>aC_r(K_QLcdD~k*9d{&u9nG zyoL#-BY$2kq5pe8hNyp)Mj!XTR9F9Wo^QUNf1T{|PW~}gj^X1UTEZ*7@NzEkVG$4b zU681KnU;?57t#AY@%d0XJD=+VU+@}uVSz~1UKl5Vh{XsH6brzp%o&#dMrNkKYrMOX zTF@@R@oaiqMKVBC7~di~8ua86Iz(ck2;i?_DU37fumd3E>Nv!(-h|>4@fw#RX{NC> zyMq_bMeQ^e`&9P@RGCaqDp&GYI;X~_@xS!XydVv-yP$$*)1|li1sfd{{sCXd5WuBU zrKAcVxr-8FFkl6^Iffd5qX#I&8*6^S=5={j6`+T-xoeO--qUTX&I+4SWEuGV6nCqg>kBauPm*&QHBtKJ$#F(ED`$f#I?q() z1*^UGccXGfn>^XuS1#OWLA+$+%V1gMB+ z-dSNJoX870BF}ZhG+>m5Ysi07<^OQ>bNYW@Ev(+3|GkUL=zknsx8v~5xvt*-%cZq@ z|8IA4#rppi<36bC>ixe`D6QZ3|6N>({eMe-AJuh@{$IKG|8O_gwEib8T8bu zcVV>{JO8z^x_qzyyNm0|C%g5X)^~>$LHpE)N6%{29g$vKTKZ;rXK87-wJW}T(b}(x zB8cWq5Wu_RrKQRN?X#FpkKQhm1H@Ki=^X+pVov#UF{Ety-nf@WPm`v@NnGAbr;`mN zzfG|}>5qM&Nm>`62Ehxp+eu1Iey~Pfe>+XyB*Qb$8>cVfg$XG;k8Ubmx0OriGZ8In z$sN}sirR0sZB>pkO_jN@30vq8YXq|X_EBqZaRZ?!x0X-X$5HA@&wnHQ9z}~DcW}cP zU1UbDr6CZ$blADzY{Sx|3Rji(tkHv!OTQ=pIZ(`WM6B{P~n8qqL?{_`gfuI3h<0k{h48rB^2Ge#JyqsFo(i(E)CXB%2o{D*jBU=g% z+#&6Ng2bGxQ6qyVU(BfbU z?)wq$Q=L#qHK^enQ{z%iOqf(nP704HszwxZA(~l~Ru&cq`9g|{$taEOYQC7|Ggog# z=S|1&lb#yB8i1myt!GSaQTtP0>jDb-LQX`m;Q>1qJ3|A{rxF?#6@j3m8Pp~c^gVj) zY4^%(4Z`kxr5+kd0j9&$RhR&pjD+ZFxwD5!2tVv6w|b%-0#DFL<&t3G?Xf?g2*gVS z_nCYm*VYZT0~e)Ssw2L^NEUC=f3Jt?X&-I5RCfg@B5F3_@ECh$g06VSny6B$-t5~q z0k@hCuy`$HFlKvwK_}ykR4l9Z##-+B+9V$>fQgr1E`7OFf)(K_;1Oe$t@pIt>kM(U z;5kVQ5=J}ulGLDjz22-63RVfl!qR?clvD`0;}%0avf5P$lfdEMzKa4aE+GnHu4Wm_ zmV4Rb3(*LUy%98`>WwC0r|+MK-LnfC)UDwB^G*kMNVY=peBy_lFz9!1=-$|+EDfv_ z`o6Vy$f&5P8p@m-`|_ykt* z9$JWOr-wkBQ2JmYLCfOP4*^Cwms1*gxn-vm7mi2C93?cqVfAVm3_xblXm>GsQ9j~;ESuO(o)+uOTTol==)1l^xf<0 z?)7!|`Z{A+%GI!*Q1#}`ZD{E<)R;ET(q(O;xxUoCOz;#As(6lJ(Ih&sT=dRi5zYZw zVA(b5`kj7iI2jECRDN~FLLKhwU*N&bZV+v3Kzja(PjP1wSF^B!8?bUn$q*nFdne=;FBnMvR)<8QNvVjY zREzT>RfYAV6rXt^sSF=cmFSPp5(_;YOsF)Kap`oZSn2b_8m~?@j-@{iTvtj}MlU#5 z2l?P_VhNYhA*5b=-Y}%-K3!$7&jFkI-f5=~OI(m@`rNEzSnR$v0yLpwY3Pr9t;vvW z!5ZT+tCZ4-5s8cgimAqJLbAY^K(hC-^JR|{#$Zu~v4fEWu?G9wgihfkw38=qtIw`grm)DR13q~bDbpHEmKVh0*~(JxqTcctC1%8Zhp?SeCn7D)cqa^lu1|V(3&C`PFBBQFJ#NYz=`0n}^MJF+ z0i!-?!ZLV7&gg&j8Sw4P66ov_q9aT(_2#IaIdLBJ{1g1^QL~2Z5if^vFXidZ9EQx3 z_@=O6OF$%{*YBq&)?BEDjH(@n4nyB@h|sY_QOHi@$d#Va5xgX+N^x(2GCYn{A+V&SEzd<{>c`J!B_VOgp25mdi{6%^6=s2BCxZUtUG zt3cJt&uSGe3tF{PD_8e(Vz<0seqNzmb%4@HVKT0s_~u0gUtxJ=_AJqh$CYW5m&bD5CO}mnL7p)Lkdz}$abMJ zK|dAqw(%fg(J&uO0VzP;EDJ_E4M3<4SQm|cWmr2X`kle)1RJSHiXynPuMJi(Ap{C6 z?}h$Iy0B5joWo)Qs-B9x`?E*w{)IGNG@E%o9QmXn7HA>}mEBP$iC7RT@w5VoOr11c zr=Flm*Haa=>B$m3riLSL$Q?t(idKPA4;!^bR*hWbUAy@_JdkbBP zvFocy)s7m{*I3y2EL2)75Wl_A0M^RfC?7jcwsj<2G6=; z&+I{>8(<+)Tgn}K`@yzS43P& zV!f*_;U2+YOi`aC@l!+2#6*Uy$<%eW9Hos5jF=@ZG(sL@<}l_#Vo=&61rHLQ-tfCM zvC`;c=OkgOGf*Ci(Wj~x!h}!pU*x6|XRyJsNu`{ledSj*Wy~>Zc&qs}7^salIW%#) zl^aAd3lf*|PC^#nv{`n6G=*C=oCBtuu^_Wfdgjd~;7cj#t*OIdD$qqHQ8 zZW2s3nt{u}X;J&#>x_7&&|Hh^i#v_D=QBb3#4$#a=@S_-MhOL5DaJ>X@eHdrCZld? z%}N%ieO9tW6NA_ig+=O!U^F7HN3?Uo zA^@{?2^up43O(F!gE?ZtMz$G3@L+O&3}lv*?p@%=aS&i=zQ~G}JnzVQ@P_IDxPqLN z`lyvvsn`Wfrw<}qsE80+C?TS?D9Ud*8NEI82(euMo~IhuG?0^9C%hZy zy@9&Jz*RmO$t84{q76(z9-W}kVQARY_xk!AryRN1%=SPXZHbw+v&IHVAd@vzFQy%P zLpKeQK~2?A(4$ZqwI>z)|7Y(z;F?&rhoe_iq9`ghY)eET2!T))M5KcvARr=$AtV6; zfy5Mw2rAe+BKGdJEB3C~t_6GV;>Cj3f&wavpnfy6yU8X5y@ls}@B6zyCCTp0nKNfj zo7p*Mcp|Y(P)E~!1&RGo{l1pqncdPNO7O{ke9@(!g~_pXL~g#i|Pn zPcpZlG6^8TmK08BDd#rmMVFEVmEI;U+enzWXzaN%B#Ejy(O=i<)+{?#A4b1qE|A<< zB_L9ZLOQ6Dr4m^aQRoZ6Jq__WT-QPG)ClJX7f=9ATVyRx}pGl+I z1W`$QH<;fGl%|LsDva9=RVS+BNV?|7eiD)@A zDJF*o|BWv@P-e$kS02!=7Bzbd=TK0l>4XRYgASe{SwMRs_{vB$4TO;~rR*0$vy(c# zhd;vwcqchvzE;QB6Amz((3vI((!OVjAd!*0AYFmB)&Q*olsTx2l)6^qKwu&J9u_hJ z3-SntI*N*5a|FT!i>Q0ws^vzAwra_doY|?1 zunawhGYBx<0e>JCwcSyQ=L;siD7`gZo7RO8an+>UzX3HU9*;*L#^|TaFo#5kK@Y~9 zF{)=lrxSS&(=oQSImWgD|832&3_5-eg=sLw3P(iHxr$W$6e-BnLL&dC5G4S`OaYd7 z_D_7Yz(f(~a&TLbY7TQGCNoiHJi=xulHgPaJ!M8lnk#=JCC_BSbh0QdD?$gMWlg6C zD}50-8IlULQJLsEzIa9mDk*Vb&~fh6q7VKG6^S%`=zKC>A|GV{q*L+;G9n{cEb3H_ z#fpevV6aoj+lACq&aUZNQVe1m*S9MYswy&)L<~4INfgY`Pn64&6lMm#c*j9c;8pdj{xBY(XZo?u{&BfnzOA#JEKO&LmOR>(`jqWG8GIC6u-Q>ao^3*<)vGe z7ZeqIxLZ&?YRk=ymkiq0q6}$ND%n{Mvs*NJZ+QapT5~9ZT!ht(&*^Y5%c2K6BNYHBYau z8K~c=)fA5$pIy->r_P?OZ&TrrbpMZ+FLMj|hBLfYUlHBj)*w4=$l^6YLWN@YrcIj` zFJ3%B#%S$TPR#;pr$cIr3k)2Gki4I$?35@sK6yftLZgG-m}*g55u_i_pgje2)pRq~*L9W4u+;q?pc z=&|f3!NI``{bEv5KIC-wwntr<_9!C6YzT+bjYcafD*E(NAP_`v?`>{A{aBQK(?$cc zZ^Z4ob7wav<9$Tzy4%yk!WNu<{ow7jtH=B6uXVc}(I9BUyR&({I=7hAAB(c;V3v0v z^Yf@Jq3LD6yXFn>Tz%zDg=eaIekr$wS6^Fz)P(y>xeX!gIMJji%q|>C>maYp%}d z?hO0TzR|I?w(N z`tBe3c%lbmp{+0|JbY2;rU$zdh6V*)-6g#C&bs=;8Mo2h<1?H$COTr!uG zZyDTqB9McGTlqbVjr;4%U*5C`2)G1B!OP35=x}<<)n9#6Yc}QUPCD`a-8(RTJ$m%; z^zv%aqQ$86^xzF4x66NdF%~<+x6aPWGBh+iaPZ*!j1&2hDWbv*8m)0-gGnu2K31Ib zXk+QQrg4A$>o;yZef)U!IlBpNgCipDUAxw%b?erxS~Z~cA2etX;F-|Sc{_K$y|UW7 zWAjt1Jf}_ec=WmY1CT9W<2i0C!*<8#EtPfFW#rtyl`_k3?H+dL#@Q9G?i}ej-%S2# z?97=n+nD$R44;2F%imE^Q8961`* zcMy-@^Np8Z+M7_oSbL~ue<>J;{t27bZ}5#9-KC4p$Eqp;pKsNn`IgXTG};6=-+=>z zO%3`MZ8EZHnk5tp<9B}oj3jr=czJWnzMSsU(_nAkqt z)p-=3VJbJEWkt#5yMi|Kl|J!FPj{lxTD59r-VW4_h%VpMarMrfvY42d$jHdx;5Iov z3(m+ z8S|DeKayM;ZfUtyr&+tQsv1samEh^wyaO#PtgIv_r?v&Ejz%j>J+x?%Azo-y)PmPH1ytI5;qpX!hBR2T0opy(7;$mjID^L7FP=S% zPY=isTygo!AAx3r8VLj@&0PbB4IAd^IpOu2&BJzR$+Z|Em`Gqz!-1VoOjNfgTeAK4*`t|Em2M;UUnxC|F)63T{bB(4O=e;m!>p5-4 zQmcf}{%#GI`t4bpcW+<$tu`iI?=GnV1}6PO&y1S#=GoIiZ;pNO;>FpsXRlumaa=kg zGBV@Y#id7&_V1ZH}O1 zBMRmYKXf}R?BlK-J1!iEzWva0D?n#(dGv?Z0~oD3wSTsJVaM(K!cGMR`DcF7ZT{vW)}Ly>WkZ9`EuPg>y#>RcYZB0yM$1|O^f-Ir`Hvq{mjdllSXekxp@`fa-?qi1 z1d(X^RT+)w}o^8DJmOG}-Grs!m?$jWLMnGOWzc+Af7)X`w%{rxYF z*KJdjS)DjuZ~O54ei@(23o?dWxZq}7Vc)v5-{(J8@7uh&uw-a2fpy;2HzRU;?YgS$Sv3yd@M#CxNIs2{eR^HmeaXHC% z-L<)~kMSI!gOU}BHEY-UFS6Bb7oL4l_WARJ-b=Pzyx4Q2VdXi? zBOYD#$Mv5)b!uz+guUX2p_^{l8kVkGo>@^|UU=rrWxH|~i*@D7mH6F`ELPI}eIrZU z+e~Xa=F8jnE&J_@$xJD1Ax~-f`Q5cQOP4+x-{?SYZt>Cae#yrlZ+8$g9!z4FtXpoq zYE@iM@vv*UFHf)V_xI;p_vzJZnvZd~;hDqfrEdz-bIz5z_pwaOKDMHyBUVG$5Q$%#uscYutSUS5IWZ}9pUJC;z}qcn7xLS)h6kD&0QF^KbMM8Q z`D=b%vSDNV-UQanCEj7?O%rzke)$T$FmE7n?1)v%{xxc9x_v`{KmuUaJS28hpAig4ek5lVFitQ4tS+sJJ94JE_(+$k8$(}h+t%t{qut@vZ!hUB&j^j*Jh7uq&AJ zG5y1XX@+`NCv5og<;#v8*5iAmUvFD>!C`MR`U~%Bi|)mbACIa|4jnbBw_95K_HN0^ zpT>N3xcB>~lhXo@)KoZ(A9seoW9n2oYyLEk+dCF+TXTQkl^vNGIjdi7jf~XYo3y2? zknY$TYueNJ^2z8m$5M+cOWT9)E!gVy^}~pvqb$Gi8YHgVOj0jzUvUA5kkrmja1DCW1yUj&r!y1je%u3Xt5^lC#LV34m| z8MjTCjm5n!=@l8-IzoE6UCae~*x^xgZp?aIe%pOgQ1e&1It`zHdhh8ob?&4|-XS5^ zcgB|4bZusE^x4~hCB2RGo6c_9zMcJ-ifMMeOybIyf9-SclpeR;IR`tt>%T{jWIMQY z8$5sBoH;wo;yR0~V>~WBE47e$|yn?#)T<1eEOgrRTOeF990sRQs3P zp6xZ;Y-}OF;Qh@AAOC};MUj1M`JYQ#nO%N9cd*_7*3dWi(>fJC2JUO@rDb+DQrC?% zvG|QcQR*+Dex`F*2|RhtNAlza zJKI}I-pAW)KCIt3n=NB>&S?m)sFNEv-p#pZac|s_&s&b4I^45`cVO7(E^ z2F0dF8DP1Ez*YSG`7`&I1DS_U&P!e4KXT+Wi)n+yEp{mq*sWhib!yXMHEm5$$IhMo zRv)w6uy}iGi9siOgYwkSMO{n50IX!*FTGc$I|*CAfB!J!)*T;a4W=#h8v)$GO}(bO z9v+^bym{n0-|=pDj!#IN*TNTQ*33gCN4{)ozOv@ck(7bP1H!hiTD1!3=*KVrIRDF{ z#S?-yJbuPGCE1^06T=@G%1B&0#Owm+OVEL|w{4$fo307EcDw0LkCs_0=FgvBm^WJ9 zBL3E`l38*W{)Xq9H+yhbG#r>-9Toj(gGI#Jj4x?fg*#t3Vol9@rGF_j zxwS>&8_0S1xnyx>iQxW&2i4WpGq$c?O&cEyytc;$)vRG3(r@KERSpJT4Pb!kH*Y?F ze7ySn`KC)FF9V%u)j>ZC%Nua6_}#pD6%}t^Cd4~#X?A3dPQNN((zxTg_kBp{lAS&EnCrRe2QKvNmid8+VMm|H&ki@)d?Vh@P_Olo5hp&c{oIUU z5WakL2c5Xx;fEvI*i1gTK5wlHV^2s=89i`A2#xl;q^!$sx0U1as>V#WD0EmyW900U zKMyhgL(m;-y6-^i^&uuhhi2UfHTRig*?P*wWzM~FIwa348Q{=$*7DvX8FM=P zUS25~2S)$K(hhk8hNM^C@8WB2Hg#T3s}{7e{V`|hZ|~OT&7c4F#f{vcAU9rgTz~duDllz6QEY5t(rLJNY}fwS?Gp{mbDx*r7%HOC z8f6*T&?iq>`TRG-PC7l?ZcBT6{lUR!2M>I?cFe7L<6i@P%FEw5{>5J9_*O+~-u*(~8 z_7cailT!ok0-u>;)4T!tjb=DqA7i2O@#DT%_xl9IZnL+-9_}eMoKd-D-LoXl!^12V z$J?_@zsy5kw^p=idfT#K!HnKj7q?kkFKj;PM8{drxdyWrFRm^#s_B>BpVl!n#(eg& zuK7+M*WYmK*fDm@$Kry_#=p4sch8Qxwzk*9F<;Ma6qTH(jsLPd$9Q=mzr_cu{3e+$ zM{iGA%kJ4_`*hcy{-XsYp+jzjhF0GH)h{V&>FY_;nvL^tyS|s*!62+7BPZ_a=5{4I zA!aw8*k?6p)vD}tyHgFHKDG2<=+I~_yG~CX9_X^cBWd`IC%s?z95o&5wsOIJFRPD8D%n zv&>U8TGY;tW18yh+ozxWYQcVCn`vG)k%H=KLC8j()i3(Uehz8)t-ZhRNUDIp6 z#BJp}%Q4I@LcNY@t^4bT?YE|n>#$(q!j6W9@fEB?4JUi7I&x&pz-EUUjF4F6U1;Ia zqs;|(MzME%>=}M^(46NxyjCCH;hR>u`Qh|Pmx?|Yrg!|}bGO@D%<#$hNt1w0-*Cg~ zw10p7n%}b>5~t7Zc>TrD{UwjwItVvZyuH-s{(V2EZP)H?9kk$g`yh5Vm(2SYmzMOM zuJ`Oj%ZIxjIM}W7@6BL5`t<%~->%|cNBwGIVPS6kTlTpLA3hgGSBV}>^@-@wqwj;g z)560)z2j6>y*@ZWRBq+nZ_FybC9XR=<)4}JkH0|qub8O>(oEb;64 zBIIM~-n{C{A$rZv%s5gkdE#@ntr%w~~?03HFuP?9pcp~!P>$22)GuqNKm{E4)x=x};&Ztgn2h1PSLe~Orr+P8ACxFnXp z#ICJTTdC79=Z42-e@RI!J-1&L5F2Z0{o1TaleV1EgTa)`Zbr$f^l97QYy7jExnV=Uz_o8zl=2}@yw@Bqx2hf?|xy%Memb> zj*VQKwJ$O1b2O$)hvvQ0?VZ_dE34UVSQPLfPfUuOZzETqe^fKmWI9mpp+nJ5jnk_R`wk+rPY@=dO2eN=v0*YL-v$a{OyCroZjkMT;)| z?Cr8W7_LP-!#C5+@(yrMG&WuqEI+@XczN#5Gp`>`@L0$@eKqD%3l9c!{<&FQox>v{ zrdjb5%;pwazFx$ws#x!wK4BZZf zUUbX4|T3)GG6EgGR@`ew;Nv^5ATi?aWpM zpQe7kb>yP!g6i-smA5!!^qMtu2Oeyv*yB1nI*kBrK$5>28rj&i;Tjk zOP@XR>eRV~?Dzf^)o%iJuisw!#~&*KO}BNs)N$q@yQoj^o(C-J>snMi7TcHkdG4m6 zLuW2?NDWyLxP-;Yj6F9`IFI$Ax~gi}-0HD2=uPSLMb7D!yAy6XI$8AQI*rLJ%Wl$X znEAm>%dUOc>|NC#91gt?U0>>IbnK>oZzCfkQ`0~0?oMcDCvbJWe)jC1BsCphz+ zv8JMjT_c9)$q>Hgs>17{cB3|s&3@Vz}FA8*yua}Mo0 zja6K{?DWhvJ&hZMLzCs0@yWK`w8))}Gc&FmSANWzm}WqKe=PgM*H5=9#x*#-M4?dh z82u&f_@2aT7K-EzSK=-%cX?P;RFL$*(b&7=phu}Xf9N-zSnzpIMOkr^%6FrlzncDV zm+%GfD>@hYU1<);`sn1e;jEPRFK!eR-24!0+H35kXD*}OnOa!rO_>$R8#QWTi*A{c zCug#kEi>xX)f+f$Z%Zx&?-ea9dCYqnzA|V--;~$G-P{^3_21j0r)jShTeg&fd0m4B z4bIK8aF_m8WK5rMVEy{%PYUl|y&4*JdP%!+r+K$Urxw}eT3a(j97gBDn&XVi;;aJ) z4gdjh?%TI0?OB(BO-?p`S25E{%V!N38^3$c{{4G5ZakcyUtO5nwd>X+t9g=NpWAkwRsL4SvodXC zGIQ3<%9%5k>UVuTrEFgp(E&#%r`4-|ztAejCVc6(5VIcoO?_(o!X^z^(`w3-!-s9WMXbmJ9;>f}ZXGeB=5`}Bomb#h3$-7mT8kVXxUZHd_X>C-3s#Jl68W1U*Jcs*Vr z?$+I`6@5b6wr$_Pe{XAO0ou2+y4<3bOd=Z|5pk|q^61f{SGnPD?;lRzyJ=Ix^Q&uG zwQ7|-ZF+XX(P`~1GpkGY-n2GXmUrUwX;T9_FrJfQVtezV zyI#I_?d=~|R-Za`>chh^%RLMqJQ(m`_QZ2f?QLy$?cF=3ru=ke$bL4@t%0Mh;e|50 z>lZIxGznPNs8OSj)z$a*t+ibOrbTz}hWG8-&Ct-WV@K#CJUDI{VOkH|Anj8 z`~P}8_mjN-&iQ}f@z3+$e!!)5{PE2nd_he8wDIlzAK(YO*7>jYwm;8*`yrQ~uUn97 z&@f_~9A6}&dw2%B2l)n~{7-l`5eA(&YZ>kWqkD!01_Xr!(?tp{+=0wNHGl4{`X9Z% zA^*JkYU4ZmzwF>)pBnOSWA}6a*AKZY&FE%kSlzjo;8V1bli&%pG-h?~;e@q<1p-W! zK++#i7${6qONvG}v!v6z6UhTH264c99D{lj23dhSYBxl}XpMVZMJjO<)I~Ag0t_bO z3+9Bte0u(_gFG>E54ZYrcUN~GPqftHeV8x` z-+T>Pgh5iEIE;9K2|&~7x&TQIq9A7G=S0uIw;FTc7I!C59_}bs)1R0rwE`2C!AHhh zAjgQYAmcfe!RRsQFdG>60m1VUFo{@(=ct8rg)Itsl!h_0Sb-czUcEJlFSVEqbB3Wl zsvAsD+>e7c7c20YG7{Gx4;LGIHaZMHr`6yQ>hp0#G9w=*$QGNqJ z=7=Oh{6j95AOgUk0#heUi1l@b_rSMaz0d<)S&C53i^G9J?gq3$FqrsbT@?HV;~ql% zhYWJ_401%-c}POwA%I|#MdBeBleb7PPN+gO7~BLWb%1UG0e+sY{^}6P*gh&q<-PC2 z3=V<9?ug^A3wONBQT{eS8hpr{37E=AHyk7mQ6?M(_y`jTl49j?L{U%>{MIN)Vk;uS zAZ*E~IlO)?EHl(m9TMyrjYg`QbrDIUd4FF&)G|uf4$^atchBCKJgwzMcHjx?zXm32G2|kBo73Asd z3mAKtufK<97}E)}1b6~4IK7DMJODQ(e2R90O=|;dVU5ETv!Fy)ENc@GYNC1IS{Z_T_SSVS(D^s7tkLd zRWL4-5t)c5Hz9aQNlLC5N)MZDi2@ZpW2~ zLoh^-t*92Qb`UVk`mH=^QDxmwXgk%unPEbHDyb(>20|5IPyuO59bcQ3uiFgrQxV^4 zNF&K<$mpwE0#E^v7}kx3suH&WP;?-h6B-c|>eUMoP#Bv8V-9f#jSS%=!>7qEFqNXE zsWM2b!Ni`hm*~#2avt7QB_F zrj{Fk@McqxRqBd>fdp8!&Z6=NOE`WIJ)%V%M37oK0~j#Ao^kX8kcYN-1&2zjWkNq1G* zBZ7$FhKw+;xR4S9E*DUx-1@sxu9+J~J&s*nXo<8$T4gtwsWFWj1RZqBZ>FY$6O8v+ zAwe|7b%!b5V*-0sLxX@HkGlR>xHgc;5j3tX|-n$s1gU)^0jA2f6^^U5~Pq8N9!%6 z0a8tw)tHtFp26WH0%9|$lPb063CYT5>Xyz1Z%Ek$3x@&gJ0V2QF`f?OmrQAHFqEGE=kG=z9W|Q_K8OyIA7`PLZElghdksVpTCt%*SPgSWHC30y><076F}jIOj@d;F-M4 zsiT%*j-Dtv-CV;Y;m>hO!@ux%hLbu56eUeg{QRJf`L?FOCxVm_$)L(LwPREzfI#8s z5Jix$qfwQsQC*wih~=q?HBW7#N}*7l_Jdw0Xyi+%LD!sn{Y8LsZHh<(W3|Q0ztM(j zfx1p>I!vrEK_{ufg%&&o7I1xG#vgUQM;U!;E!k>8Mw={YdL5t^2OiJ;Cp``ZM|n(6 z-5pWAXE1eV;-^%ppHTHJoVB+~c@0{3yLG=e`G%VUF6~VcZ&|<79G=Yh8y%vo!@-m6 z$h1*NH+}EL1EGxkh)h$;d}Ue{5&}R`M=+zIxyqHPOVuEqQio>rV`@?Bl%*u9UJz+T zvX*kucnf5X5m_dYmQlCGxYbbdXKlOuZ@;ap|4ZxpUsdkgdTHZ3`#-GNwrtJ(A6C{s z&;R}*mqk5ZbPEe2?Up0qOu%F7V7@~5$_cR)9WO=E*F2=JZ7sAYZCDb$dsguydi`wo z-Ph0c+AAWnmPRf_XN=4nrTze@Y5a^*l%)@gQh#c~!eH;BL4VT7V?5RJ^)Z;R*GMhF zRx}9+mx|R_RJ3Ce5y8PVtO@`JPqhaSuk#UbZ__g(BbjtMm^&*(%JgFN`X#8!qQmKV zE!(Y?7Z`M^MTYgXa~LQ`ZdSs}K%zl=S_2&^L_N0gz5SmKHk#-E**aL;|Fr)<;_8lDSaQ^neYL^uE8E)A z$`)hWJ6f?F+1AkP@VHVzQk>Gt(nE;!iu6!td{#nt5AgT$^>)TsmiTERaH|u(Ma$R} ze+JVs2Dt}2W0Z}C^Z>U3YInqRI{aa5>gVeQopvVX2mruRKurl!;aMKoAXoQ*;4okn z0{sGp!6R3Jk00di8RE=fTd`~yPOwE_P{3a=KUeQy_zghg1Rw*##4OM|9%>V01LW~7 zj&$9`1iny;Sx8{rA+8)y)WbIjpum&VuB={wuYSh~6D465F_?u6qgD!G$;7oy=g-v4R$Q~rOY|L{;;Jd| zz>CFdwV+l+3&>jVG=P0a`uPG;?KbgV5uJyNAjDUoHnnJkTJn#NTfOqwcjTXKW3M^? zx3#tV8UOJ^uI?E1WGdxpMnZv%-W@Gx5{FW$UgN0_JTgr|6J4#PQiSBe@G|_sEGB@5 zve=WSZUJs~he@;PDj{*kEEO`TC7MZD0$A`cCwQs`fr{3ai8IswV#~^gHCsiwuQl2w zR2rr0sH(5OyINJE7_4l^rh~cx!5Cj40h1swbE2z!4`<*7;0Ne+N5|0#lN71+?rP7Y z6-j(BZ?ym)Xswfv@zavHi9#MnBo-$qBzVn1Tpnm5j7}${-x+r(SjM5Sb$q`Nby$VT zU{r^?2Ei5rtTBtBaO;jmOrWnj_zr)@#zO5b7g!LpPm7^Eu1s#h6$xYEk3=ELNpB&M zisfSbTo8+)Ndho4v+O0#M{DTZ^F*u@L4Hw}6Mn#Q}Fmz~?5( zg*-Z-Bd`S)zPN@1znFAf--G^`LUf^4gN49-K=D`}4|WfkEnHbq7loj~vV%vfTiL>+ z)oVMg|F*#WmtA$}|9bTPzOVnSY-`2;S=+LI>i-{c{g>%~p5t(+K3VMH0Mvh4?Nb_4 zaQ}p^SCuD95p{?cQDjG`1p!@%uh13KW)zf)8^&IKPi2T%aadEEWSbg74=8T2TobzT^j3I7cZTMXBy`fEIL)0)ODaOPDcnH;OJ0$pl*K z+OhvcZHPFEeh`c0wV%UUQ3OSd$zpJe8iPS03EpvJHPAU@%90G_L-#mtQY@qkPA~WX zMlo6laVlECpx4o=ImBosh|vs^#3U$x;8eqX^Cs{BWfQd56n!PBY{DQ(qQVQlVT=)j zS%f(T#2oGsB+q|_PfZ~Vi9$}ET#G^T$Ydbe{M&r_^ZGGYE&VSC^Ep}lW`Ow{`Cn|| z{*RyeU;gt~9pjH5SXWOwfWEi>Zwtm;WB-pW+v=zN{}GpRi;Z%?smuT0*kV)bV7&k2 z`GRm)L4BPssCJehj*KZIV4xA>&%H4F|Lppv{NwvS{;?ML?)s0lwTApV*jxSd|9{A( zF8`_lM_S;!XZ6+A0@{wp{CQaAfA?XP|L2w9|KY0+{SW`v>;CV${eQNNgPo@S2j73L z|NoGyyAkCLCR_=^SF7u3yD8esjFKr3hoR$JW8u1kJWeW3fl;z}77bwxJh2_EqoAW` zS@nc~D#r#=oYt7BAXOsZ$pw63pRPHUD2rvHs1&$b0)F7jJG#2?t21U|Lf1v>D&!6D zm&Gy}o&@g$r<2^NODbk!^RF|eYzME&Vlh(SiRAL?|SmKr>Au0K`!aDsI)_T~r6spFzg-BCkRH5$=cp9E3?cu@t^!p#o;$ZOWA^ znsAS|Dzco??B9)`gFHbEy+)V;bZ}Xa2&9QZIokivMd7?C#}UHML`F$Gr-`PlE;M7f zfPu|1B3B1BmK&u(NY7wuP+5?Q_IvXX;?$PmFtYHxVL~vRVD6>#)soO~5oPe%8nGuH zzXytg=Mkzh5klaS=~9SE@&JPvNxU422&c`GSK+A-DB7meYO3X* zau6BOBCaV^C*LVTErClLr2ujuO?(7E1hAoEsfcf6f(Np=lN^PUUP$Ucx=_qQ`$J3_ zK$+21u@fA)3P6EO3|T5evvpXQ;fdrWB@X7rQMEvt8B?l?<)o5&QwbAwr`u*cQySBSz{2 z4nOqBDdd27uo+rlDql3f_X@%!u85MBf?`r2SU8ywCkc#j2*|K!0kZGlfD3grgR6D08AYs}oC{P>b+5g0-pt4`9=&^KJ?Yq7_3W z`PBv`It^3Ea7{v`qQ=O?u!#(3cpN>GOtXY+3s($e2ZMx*vHo^3YoeIVw~N`}#mIF| zx^99Xjg7pV7{IMD*5JPlaBj@e18e*NxIsPy4>BkWlz_sfV$`?@Esg4uwjq%#k7KBQ zih-Tbh4)xeU<1U7GN4sV#WI#$m?(fog5W>UHcEpdNCSgGDQ;@5ECOvg^@)vIJX=gH z-c^RO!LG9aSO6RhE%a%H(2GR|h2&Q74DT5ouExT(SZ=I~OVGAVVlZvv$(L+Ljn zHz9#Zrr2ZwzXWsxlo*O!?e1)~G+Qd)Uzw6K76=?k0Z2n50VrsV(V~$2GA|VnuV5ZP_(h8W6(m*cS^GV4Cr%H09wB|Cc z214udKidv^`^54eTKLoGCg6AcDQFSZX0ceH206V#y#kM@emqn86g-GvN5V%v`0979 zwcfSSde>I#T|0CarmU>>q5+^&`$YrM4UUowDycRFJtszi9Z7t#CcoH_Uu+|p%8sk1 zILO^5b2cL2FfqdSH8ar&z)RZ;7KAeL*_G`jo8!0xE>X@ku@ImjWHADyn#lQ8o!)^; z399KdFvKLMfw2XuLCliL`C^3}gG5yRQW6m9bY(|k*s2HCY7eYc;|1$vI>QoxFu`zV z2Mlf@W-_3=szx9Y_(GUeR6yqIkujL$il`S?B!~Imq|m97VlWl047z7P3Zy^>Cxb5| zfea=p_}oMccoRSx#8Tu}DcP7q^i9d=u`)$87)=sw6)FJL9v*N~%24l!voi?M2r+ZBPHhqsu**)98Pu6Q3?#LL&=L%Bqg8~dScX+xbp?k zidZ=JgZVOmgJu$A!el|)2*g2+57fsW0aRlY>+cn)#X%aVVBf?=MNgcZh%MYv&JPr& zFUL~E(gc)`hguSF5H!~eFVX{uQik!vdUzgJH1~%2pAeUkC83N_*$SW4F|{n;Gk9VV zjGd0+j27T7FM^Dw#1xQr-vbG0W>+`O)EEhm zxz{=gqV^jOp~h<=rn;7|EBahx35SUB=ZO^}KEeyn=~6p0fOafYFOy7>iv%DN_K%8C zUAVB2bLC9d(T0u;X8t8-IdvdGym_L$_=2cV03&1&nMGn`kL#M6P+sfQv1Ss?Ql+X0 z1_&cn7ZHKBN~egEOz?pG{&#eRhd)K$*UzSooZG3P47u!xV|BIcy_0RLae#kXQ$dig?;utyRAxIX8fHX^i z7pLG0(Tkh}8SttEm>0|pgL&aAG@;Os0aF}%mK9J1-7y$)hR)XU2*C3jc=(230YR9D zr=MqtCl=!48;lJN2pSk1=<4o?dHMQz8tKtN#rnMeQo=py7*1!zINbedV0DZ9p>qb7Q_mZ$XG-4zJMoAl1s%R{4t^S z;8zw4{}d$gwU^Jx$WUv?mTZT3@E@RuH(I!N)ZRT!d~E*n`25?v{`0DR)vfQOGBL1qHi1OL_QrfTph( zhB06YE^j8jzEn3+@t&Y2-CTn`u^}=6XONdW1y$v3L^F<`GJS(akpP8UqL6bugivfFkqNvl2{~;6=RlzLNLprHkhS%7|aQQS$Y7T^Yyo}W}vVB z9-eMPyz%cGaNi?fXfW|>kefUCbx3fKho2w*15c7p%3ONa0A>`wC`O!SG0Qkz25I>akMM?XB;fVt##?jZNw>^nEfi>bK zRONpJe>~+NWO%r#p0cO{{U)eC;A;xUy2S=+7*dDhrXd*GcCLtUoI=EKQW+dDB*@*< z8K`I9B%q(5dS`+vz-Y=*F^+p8U*^o?V=6p!M+qg6H}J_TaQv+-5D&A!ed;P;cgz!* zd~J;ao8aje?D;3`0%_R)wpC!)Z52q^-?j1?R6@ia$|ByQScK$5L>9S_(3~D-a+}g)8Al z!@GJ!i7PzaJVh%DA{@DEoZ!(jqk{Hp~_#KvPNtsAxSw;=*(l>Ehi2f%RUTh%&h z!&`_{wJ7H!;PL@wzDv0{Kp=@z9H3lWqLVO5^v~!NR~Mb?Ml?tu`;&t#2fxj{S zwzfaz|A$=P9DklTNd`PxR-8Oh^bgwj&i)U3D{Ia3KO7t!exCpLL$1C?9s%y?Z5kY8 zEO3aMpRYT{u&@MEcy~)nj}Q+m%qL`!AKdtb1B=cnNM;k@UF zDH6GuYoISC6T){)G8E7arfOi6#Bh5p@ET>{3txZ%Zp8$NFwnKHB@PB{!RU+50g(zs z&J3A64M2z!2;>YbPAZ6TrlO3qKJgY0VGr1z#goYxCDig?^hlF@p^oCIWAA8pV-$a%51L7_O zSt}@3usAJCmwvWMpS&6>Aq@~{o0_zOMIO^+nodnJVJ2yLDxV_qLDlbL5fOFm{t)p2 zDxZFWfQa(Y1;n4CqKG2GioBGEJQftbbMBqVOdc)82k!1K;YX91x%b?2&pr3td;W9o zy(S~Awy9chPXeNPlbf$+c=y0G%+7+_CxVF7yL5>`Fb&I(x;G9z$Fw37+lq>%$%5g1 z9)|S-k05Iy$Op(uV^#ENcvQ&1G}R7d<>dA=1mJgFVu$Op)>|DwufTfVtwCsgSdV@l1+ijW$Um8BJ?59FH`A#^`m&wE%} zHfUr{1nY1K{DweRJ9Ge*QYB4JgC;gHt;pt2=UG=M$Q8PH0c8YnYT8Vm;3_ zq!r!9OXB`(7gUl86GB{&YauxY#zG-%#ow(Lk(YOIeo3i8 z30^79%xb7m8quapW09h)mps0Z;h{D+EOCa$7*e^yeRvuuvMaY3rN=P>qcj%-)sYkv zYhbK+s4P5TB?e6~R}YuC)r((ZJ$QP!o72k%*MtF$Md9^|CL_5vn2Z5ZstAmDSxExn zQ3V55!|UPX0mUHm)q6DDC})F+P>#s}DL`%{f+CTJ@FH5AnocfnfT>z!j73bkRjye; zkR-(j*K=N|1qp)TT`+8fe1u$pb&IN*C8LTQmx+@K#wWlq=n{M&Bc_q3q7OghI3HP(`W=4yP!%Dn1l0)Ax@yOin>3zq z<;6^tRFr_}O=X`&Y95$@G0l*HDe&0@+%&Qs>6?=`3x2NF=1fbd$rCx&zbla?+Rv z-W{wRnAWdf8l%jl0y4Xj4+e!I<#>*;x20~sSzye`G3NA@59rA0#{@%oEHc@C6D%po zPRK<|ib^HE6xG?L@|;dcO-4F9|E;}}#OHE-TJ-0S9_3YpdPJr*gaMX)%eLs z(#^{5HU5gB9=3Fp_@zMyw74l`BqLh{4uk=%i0+4BGV(>4bV;Tw5R86;`~QY-WRV>+ z)C{9B2rP!y82T&#Of?9iySe9(wZ4VixbBBMqnp5KpScAbj+)C^O9Fl*`dDRHeyU<3 zaq>@V2~9z{Md2uR+_8j1#R8u{P6Nx}1k#BjhN6xk2IF~<_p?F88y0yXK3N9UN#4~( z2$4x2RFw15ZIVG?iekY?gK&*c^{_>rm6Sb|nr9E&HHN*A6w-1=bd?QZ?V*$yJ#C)2 zq8L#Hn4zEfYuTSpmnu{Y+jyII;|}TqGa*Dy&hW$Bjuj0u9@PpYiaL@pbwx6s~ z;e4a10LDb|fB>~j1@n<@bX$XC!wfNjVgI@qwu%@g5bS@6PmB0(*#G)@Wn2XR#p8aW z@!#D1MEuuf`6Te)1pb@Ae-rp`0{>0mzyCD&uZ*^aG2fQs#S$T4oU$FgHUx}~eH!6Gb%T>(1jflRel>B8AcH7T zSO!}ylG6&p%}&sD6#Ha?T5TS-y z5^>W(*P?MBAppawpY;-Yc+x_A1=b=rQRoV`FP@ZunIWIz;L7-pqyZ0c^Zxh}h&RWA zNfMbdQiEtLFk~Ae3^ZTO3(_PojZ^}HWI!RvwI^0mmMuY%2tJ9gT7+l?RT|zVNg8EJ z578gMrHo67JWF*Ud@zOFZf;%!L`n#?lXl}J11ggcjfg{L6fdEt;9#1*qP!9U&CG=B zdah;ZM?hNUtX{sXUhW7Ci|(0;8EL&$Q$>I^ZT=vPRlOtwaL`HsJAnaS5(bDS^CA!+ zG0qxrP1_uqOuS}pU4W@tbOM?CwUD_mmXiSH5+C)`BL1iPVLz*ki{XFSePh;t=I1BQ z|Gq4r1pb%6|9(;YPxjTdNLtu^|93$GJm6A0kHK?LZ(0uYEEAC%@N zJF}}s1!>1KEDAcPS~tXy{G5wxVbqOpaSeJB>co5ejKndx^)(NC2r*!Z;^VOaJUfsK zvv4cF4hLJwsC}10ZX@RgeHnVz2z&{dn(>Jd(4_)ir4YuUaU`ILKo|s@FmXOr@><Gv2tFZliWmX7RZKJb;f>J`y$r4vz~qZ#YS_uxEJ1<~wQ}GeL2fBqqY>%K z>}xeg8BFlGGN35BVrD?CG^zwoSxwk43o}FbhiH(*`RfI5J+Gjnl=B>e-U{@isD$&= z4d=8d3^uA#X*MXb^-5X^>#c89#g*Md(Z+-~v^W>oOQlA5(S|uV%kHTzkgCiX!J>z47!R zJaa-OB4fs03Z~Y{b2C6UNaToy+MH>ds$`nEN8j7G^=8m zxom`UP#jA{xCsi>z&p7R3HAh{5%9D|MR*?xHU@c1sdD8KSRTdl)KQawdHD$D^)Y7W z8S`=w%qz$rP>`Dd^Aev{d|Jf+w9}KHQN~5^zufFTc`^IH6(r98yDXms{+Gc267heD z_`d}Dmq7m#=-)4c{wc3OqTrm!D8`=|{1;6;uK(LSBsGBHyfM*K2)xvQo-(Y9b*FPQ z4h#CZq$g(pa-xeTTgM?<2Gb@1#u87+XJE=y6IQGEHjF4tf}sY_%n?EewFNb64Z~ig z9!e$S5DnXK2>}?dYvjdU7?3x#tkS^5uM>%CA;CII2#%(faZw^Xs+^urpp5pCk)C{r z0+-v^4vFLg4~XyH+ohO1H}4VTFun}%U_&hQyNFhZa9^WwEuQ$hVUQqV^5pS{C@@Or z+mg`}P*iScc?tEHBZT0O1EgW3TjbK%fD$HF4TLeYP+%hAKs|KlphCb$*3E_(H!pHL zHf{*4KJ<0Qj-xJEt6FGFFXurOzy)|=4!kfd5EPZIX8DPNijJ5;aTV%3i_IA+FD;1Z zrYLE>;F1*&G!bu5097*u)N90m0>vfBkPx1rEyTz%)KA{;5=0T<5)4n20-VGW^cF4= z>mZ?oz=TL^$xn_G`$)><1><5# z948(*qu0*42(F@u#zZ8WKt!&H(GobXLkY@=kdLE_ipjA_s?uS10s}(faO_MXA`1)) z6QY2~V`iv7wlSF@0afUlejqEjLIiJ$4M!zXlmY^tI;jP|%uF>8S|tQI7aIk8MuA;y zJP1nzam7B*)N8@EW&tn8tRWN2xnCOtD)RM2#T4@(_gojsL<&P^qLEh45|&b7F3 zmHaHkSfcumDv$DTqhM?szL@X>LmWo71~}0NYNVOwi7;p5gZMfith}J0l0c(W5skw= z1aO^p*!Bdl|B$e`upP(lE@{F&TWm)#l>*k5)%RA6ty3l>N6gVa78Icqd%S~*6c`hFd0)J6;!JelWb;C1^4OzMR!}?m_6cqpdzp!^Nx-~=CImug zyYQA91FiY$5D&j4a+kCpXp<4NxSoc(Yvo1W7AX89rt6m5BFKw+R+hL#8i9+dDs(ma zS`0fP#-zeP<3qS#?$23XtZ1kXDuQ8&*viV52$EjnJRpi7Sqi$w0wlYgeC7$s{NtW13;eNVB zma3Tw#-6DM0@~sji@nt9u-MEcwyHSE8FR4}7>aoSR;98OvR7CgrM5Dxoqh0dD^$#` zx57jxoXl1>#1Wg@fU>aI9G1#5XGOZ1C`%dez?e&hR+gF>yOS|jR@fa@Qdzr`6jVlT z=%FZ!z5I5EZRoHHsHsCO%VIBc+KR0X;Ks>7(sH;?H&Y?qX0y%oh~u{#{;R<+(xsY<6EzrqTo79EE_2DGZw>MXSz5|DocYbKi9%L@|KKabevu^IX^xT2-yF7EgU9swgRntd}s%ZSC+C00$JU;cWGZ(fS zJh=UV4t(E}^YilFxF!Ac#FbfnQ&SJ0K5}l~p4WC2dbVvnw{6XdQ|8B|Ggp7#-t|9XMF1O;&w?Zzus}r*(DbqW=@{c z?fg&a!KBW^-cIh=*mK6NS5}&wqhIN~hllRWc9lr7Tl}G+$Uw!btl%}QrZT($WrT(#~ z=Zvj2CpJCM{lxL(Yu2opI&IpB;lmwH=lb>QA09f7dvN)m7x%o&+WwlsH{R{|^J`l^ zvj*Gh{&#Cq+rinokzZ`-zhvGOfx$^SN4L}6+H7c_>}tzxp1$D`{nH!XGPn2beC64u zrtyE9+pA5RHW$wBc;onq6LV(Ierx^ul>Ki^J9p~%adG&w8>`>1&40*reAb)e$2YQ# z-Me?s%gg)mhab*``u5Dze=2{m(ZYTo3WfH+_vGo*r|rXsr_Fff)mOjX zw=eUKmDwiKr)H*ep*eY++fT6VBQ@8XXRojia3e6s8Hu`iB2Ui0!l-ny@2 z&C8#9`}8d+c%a9?$#33sWnJUVt}ZvP@6zp)v77tvpF88R$FgquA#ncOcar@tOP^Wl zeYGk>_f2r&(ZKE;SK7C$jg!9KI%?Vc^36$Y8$Um}``&iteWuuK9X5^H^GDtEoNb#o z?_3pn{*gyUTCE#DeAc;t>!aI0{BT2mV0YwSN=J=;lS1!&m4w)xNuM z>Fx`6-92eifv)X;>)Pwuep&PK;+KxrvFtxaj!Ur*n>F#=5x(K`hlgdjwx)FQx9d0{ z@a3S&%8%w4*Y@sue$V>*3%b3#-1T+BEN)d+xk*^i7j%_r5U3bIk{xzv{Hk=P~IR-HfD7qt^G| z_xH-JPn`R7??by+O+K0Vz|8DTW8QE2eTSws-jA2wURqkJUwiQ2!BgLUUfA&Mt_2H{ zH;t;Q+WF?azd!xm?z>Na-f;TRj_(eC`ttgjotzu4nzK6MR z+Z=FaWBJajm4 zWVXOuH@

    7vILk*vAofp%dpOsD zgan(9rx(nYvXB=FW-@Jp38e8b1OPA*9>}0>wZN$9^i5^xp<^oBYsLY=Xz&%6DyS_V zKBYONie-bUZ#dbCU_x1VF~pmeiC`{H3(zBt+vVUr2}PO_jt@a{6YW+Zy{_nxx355y zN~$?a!C?Z=8X-kOMMp|YCqK)tkJJS=&5uHeM}$wu57(A~y={7!kroPW2iJ5)m5p%N zVk|eIL?Pf<9Y|K~W8i$cL{ff^BLQN>Q8L16gxfMPZp2=*le4Q6ky1do(qTOb8_)Tb zYauBX=#La&nM}bCUQuu5T|V^TZEiTgl>r?13ex3*F_{oDrzZ`becpyWMK5{98;Z0 zM?jxvd9J+3H>dov%D3kAq%fu)pF90KzIpbYCyp+gFvY!K{jyUym)j2u`s` zvo%_T-H;3h0)b+*96)<{!gTPO)K4jCu;4CfxdBwRg<9AJ2jEj|WC~?YfPsPLC4@7z z6q7A^iak`PijM*R1Oo6WW#-Z(_YQjRkVL~=7r~q3YCSxOrr0Fq$AFSt@z7KNf)J2Y z64F4O>ewBQU~~HHtYGeRor$Nb7e4f`-=@!)$^JQKm1m*eGqtMS@IY!Y&&(3fdAzrx z`C{L!S|zprlf#KQ(u9qMYQ==zP}e+{Y}oisS)c@M*OS{5a~uP}x9}nUURPD?XdoIj zH#9G(gKuhx0>Ed*@>#)f0Bt0RGw<&$v+0nSmT!Hg<<4+ue&SA(taKI7V}x zj5rP2EkE})YxpH&wpVu7Y0yWSdC=RFjK{T)lCzKUf@&ymkiFCalXzq*OxiEbvLLBi zMtK%s)I>4bGZ;AR7mPkN5MqZVQGpeJvUBUqC`ErGT!`%S^y6Hx`d1*Jd0_AujLdb< zfLPcMtpLC9ke@T7u9@d6`v>PELR_>C6V3pEi*v~~+w=!L1DLKNMQEOi0GG<(s9ozd z5);yg2VfiA(3#=aL*3Qm5w}5*?100v&lL{;4Pem%DTkq_)9CGkI16Gv69J8QhTHqp zVN<>Zu04RtJD(a@(&h|qC4{{p*ngH#S>{Q@uYg-M)KKa`+<|rku@VqU#F{D(`=Jvk zmK2fMR?xBrFfJz*4xg58YS!YuQ_ZjX=Ah*Yx&YK<*q=7ju0welFN4azua z+Tq+Paa58;6~Ya&BKD_J1VQLbYmH}Pv$?j7f$v6s6#&IAo*PDeAjitpv7CACZh^(C zB6XW7^vS5<0M5xwaFdlD3>rKG78+7O5V35r4y3ShjXNuVDl>p4+c-PZu3|bQe_GX2 zF6oGZ+&U)oVq=EQPLf#$V4(YvcRek@v+z$sEwmUi=8bXIJZs&iVuFrd1)^xKdmlEF8}*K%;p%Ld<^ zKQ4zuO+mUf!12DNu!a5&w!{U>D8*K!AOTy+1YRg;c@myJ;w5u^JHZ!d^1$>KLG3zL z%E1rY!bT5Vmk%5~NEavNs3-`3U3v^JFrzvv6IQZy6QFRnjhp~l5lZ$zauOmBl95qh z0x>xu)$Fzf$S<4$y7V5iE7_$1B4&flEa9|_YZW2@+x!4g{bKQsXpQI69STmI-efjj zFwR_pb0+Mn;L#KW%gr^MhbOHBcyI__2X%F+rb0CDv(FisN(MP8g|zly4X~}xCLJuvgiI*pZGg25i5}|Db$h9teQ52KN+bu-x38XD zki>DIXi7;9{$F(qKAA>Rk??|`a%6a9+XbTaH(oasvQCriI< zyRal48pra$u>kKP_B#Lx1#S!+5hc3}ADjl&Czt$D( zY>CEzCro!(5jcYcjMLIq0316tAsxYKX-q$IqBL+hb*m6Pu(86gI{GEUf)T}e03190 z>i`s?WV@w#`LZFAe9E+9h_DGCvo>;KF=vJNU>$vcYoO+iMc~w+eYRUA)2{&;_-tDz ztqfYe1VT>Par#7fX)Lae*BG&oZM*92Si>yaym%+@ri*{Gze@ikvA{M(2Mhz`o(W$3_~R&F+JD`1_Ph_ zv`l!QnLCuw7{KD8sQ}k!^e{Me?kbB@0U0Q`Qvv>w;!vPEULkYB87-Ww(=cN2B!ZoI z`^Yc($<3L(jA6`V0%Wy>;O{`lP1r^|c4}?mXg7o1`Eapl=|WQ)3hmO_rWNZ;GFgf& zSVFLZSxn?iy5o#vHWPvg;G3}rNE2AIVSrR)1&mZLeSQQ}$hiJ?21)ENs5SYu%Pk>X zpve$DYGBY{baARGgG^%r;=LYf!WhH;zg%1ZlmGJ2yzI=2g576vKBvF6KVr<}dUUHAs8R` z3%+0xK_|(>Z%&$z8y+&c&nagnW`Ml^R!0V@vw^$wIoQ4wM?+i#t`V=#+^yRG)8`-VJ*4SKeV0ANf$$(VE0OX#FA|Y^=M7Cn& zl-9;*ExZF%XLI4WHwao&IDWR7b|&p+cx1L?2fbTV<3h=6PWai z$Bh*+Rv`&xsu@vZBhFjapg|B3dXsbM9$ppqg^Nanb{g`<7gb0tQP94xWmQer0-ZD5tf%jpu)%GgmUU6#0j2FQT{ZXLRx;zyRD9-H)_<#52!goESvXSijjZy2W= zh>2(c^vHE(D#aim{f<0wqm2#I;X&^%v(1Jc5kH(asbX+sf8$AqV4US>q&XE@N$RI%DIX$k zsL;-ljG-BUqJH)SK4moi+exLu>qFiVAaUE1C1eaZ#?=1CIFB~Nm@V|5O&X%=U^?f@ z9jn?X&7D^|fi-W>7uZ zd0|iXZ7YKB$g7>!>u%S z3`cjAgWWnkZUXwU{PI2G7M!S1`KnBf6=NJx!qmg&*<{BqQKAMUN^t~eC{%)idK_3& zF@}^&YfmtfEreZ=%}9$EZ6AZg7Gx!*P)BsZX9J@*x+Njuj0`gr&$h!jUXIULMq|B621ev2Wt!>gmAX&a)M_Lg(47LvTtPg{2})q-@z4 zF@lC0aQq;%b*GRcR9c{1kEy!vOX{2n8050Z3=%TiOcCYaxNj_=C8>ywRtQD-WuRkF zmu4TDE(`NTj_Qb`%r0J?0^-f1X_SEk#tdY^Z`0*uEQESYfeGacNI6tcIFoKN!GohE zISxg^H41c!gHpJmc?Bb_*+LDSM?*=fh;9WIFlAk_M6aUFlKv zS1?t(I2mqIp1S50MR7UX4-yYTMUZjlLU`wMMX_QC<1G!aO`(9qt)6(yb|o}^(waAw zO9e@B1v^K^d3Tu>PQ;^RZJCLX0Rt9Duaiu85OC@ADU>VBSq%GSv(=MC#>1NJ;3A5Y zA~=SpugmBnca}sr=*gXu1xIg%g%CKT=DffvcWB<@nVZmm^0Z{!tYFQUlmTgp3fL=x z^g);_C_ULz16YY^q^XqZsl-F6hL&RuJ()Oaf``d7kT0UbGp*Fa06CQCsPN35EpiUw z&Qf)+=md;T{&;ms$VV}SafGs~u>=6{}5QhKQV z=V$Ws?~woP-!;|S;B&nde8NO;98V7_%^SzQrDd~itPFpor+-Ud)xqX|OCRB1IPn|b z0Ofk)fBfG}_!d%Qxn?OHQ^k+Rf5k81_HoMYB3Uz%Yo?&>vP9z`D)C@}jcNLsc zZPjv3QCM&hvm0t`1l+>!#BtJXpz?vz9Np+o#kOesn1UHI3y6em5OFifnJrI_uim$y zG0;xX8FAk=JblhOUh0D_rZiASnjBcLoo#__Jdj~XX~8-*0J;)5EW5^PLw0mW_;3- zV>%FX_y+*&U`7jCff%E2K_d~31dLF!`23J*v_}CL+Q<~HhXG8iD8u9lJdCCID?|aO zPh`_GcKE=;r(P74z!8ZR;VFL7hvO7yZ8-Q>C<6bLabP+7GKbPX4na^s#EjZER zXR!%FlPZ=BlzuXhIrw8an9(syBIA7E9}sv4K4kXaFh^-1zbYAu!3?S(^APAsyD%RK z!x5kjZ#5%&yjQc6BWqp>q<*(^XMlNeRX+R`6C+Ym3QCiK&ZNpniaP;N8rI%T$qO*M z53Mqczbiv!!j6)Ehog`@JmAEB(HY)^fUi|$CB;jPSaDfN$;>qwK+FMNa9PWM08>D$ zzszMuH>qqAy+}*zN`@J=1ye?dc#{q+%W0+es0xKdn_x#W0`VbTKz)QMCA~)@I3@5{ zgDxY{5e@lyPMGGU;j3DRADWHKKop3;tpkhyifhg%CHF4et z-7Aa;=EIp*QpSVcRaZ;+yj1f-hE17M4vXBj`_hN4VQ2yTqy!D+aa!OTr~xPXRc5=c$~hUj_-IZm?wQP2mtg7mF~;yBI^X-l#0tzM_6b^qTp-}!H_+M zHBh$!ap&Ohhd3t27<-hrz;T{@52aJb!9=P0;@syBw2G|+JyqJlONsiHO z^sp9=-oi!0)(b^rfh?m1qdhTn8YvCT%nZb#XfP=gDiR;aC0F`{TSG+FE1rg#B2p9a zBnkoqGT)Mr$OBa7%0CI0)B+Ptt8NTf6fZrrZR>_!D9KjJt zmBov=)=wNT2qt)n4RBG45e)rtTI(^n^ zMzw{y6=c*l(xH=SeSyIktavD@&5MT2NJli2$Ok|Rv$N$Hmf0TR*6jWkgAFpSC!jSX z+#GJGOOb`b8(pjbiL?P6t%x&+Cd!2d+_E#q!gR}YYP?bAy_N9HhS_(PaUa}w8(jj? z%sx1cILAARrifh55GR_gNpfC8`LfA~=nTMW;*5WYL~&uYdc+JzwdN$M5!5}Xsjb<5 z+{iOTdE)s@YirY6<7Q9~ne8UjQDQt=pf&C})dm*$R;#72NoEK8dxnvKXjyUqV0;jB zWMtc$15~BMgaNCMd8W5{>F%3%n!HbT>@&HpsLx4fyurl9L(c)=H<9mzI{7&0_b)pJ!c9Oq*#D=MPCI1(|15s~9qj*_w0a!!1NhAR01E!?od60Bm4ExJyaAj8 zeNx|mL*4*~ya5h*12`t&cvTWYM%hBloAtf(42Q?1eE5Voh*Yy)L*YZPJ+ zn5=7bnHW3ZhAgc{94p|&lJQs+eFGAj-fBg|N%Vlnt#_&B;VcHW;L(o(-{MZ(D$Rtnnq+booPbq~c?C@j zCL_RH1i3d!{f0m#HVrBj$X|zNL{cr;M$J~CFUvS-dn8G=E8erXJti>4yu}Mp_*5-L zp!qT*Zd>7{g`(&)K4|xZOzICeW_&O)q%PJQ2XargqcDnbPz=Ki)23PtNb6t=>KGgm zGvlVrna_7Z@s&EJ*1(=^RG$F#pkhZ5I|#wp901_{`K9BLG1*X*kpS(r1u1;FQ7aPe z6{)$qD1Mw~GbzhQ$T5$ff;O&Nl`sZGM!K;Z)~<`e52r&>`ThIw8|u*J7}aiV${8 z2h1+4Jq`yM@)KY|CN;)tw^I!VgefC#MI-KLD=^g}Z%M3|z!VY@sLnI8phn1fd2Tc) zYhHi}&r;sQSj#?|g^QLrh&)*x~pF{SirA&A#oqw6v}B8tU=Fd+MK z#rx{eF&@}0tCIqPle@z5hsjnmM)sxyrQb9PHR}IEpA%0 zyrH(PR`XOXWq*78+KPte`bEo{HP)i3sGr)>kc9fKyd1W2+mBsUsa>Ks;0SNQ6rp5&7#KU zCibVF?Xsy^c3si1w9c1ETVr^SDj&MY~k|NSg}{w?&sLZNa<{d-9L z`_GL5JEZ+Rr2QSd_LqaZKu`Zj%-|uV?;)k{ze)(0gg+Qtg~2pOIZ_Ew9=c4#$&9oG zV#(mtxET$!#*5F7M_Y|}B3c|X!(~j;(qjoDUOFQX3$=Mpg>1QybpyPx$!G$~WQrFk z_fOtzgIr&XnAoK)Ei8x5whfRGCj%#AMn2c10Ot z3EWC7ftEd%Ksc;J)!Y8y*%?e_Yh9$;T6F<7Em&l)ER`XOsAKpa`EP+bkKEX!aYjjO zZ4xD(nYf^#TBM_yis!~R7&cqudK_s_N{3}t&JI~yuBcOn7VF1w0HGDM6m6-UYgU~? zEWK9&NVTRcl`5h*jm1#9k=N>EL$oZeYOa?l0wV$_MD8m77y^!xo}yK$&n=QurJvKm ztf?k-Q8j~GRWQr4Krs!vedS7pbqJE$D9Ohudut3bXxa-l+eFr8x1ICcFEUNr>PPWH zxQ{t(RJBvMRSALz7RsDgJcyL1ALRK)TR1^!!Ke$RS`(YxEmMVO3(>#yo;fYAWJ_lx8$pf$#-5%GePKvl>SW;?Snp@aLKqP|rGyyi0 z^-bMvD(uL(60}a@(E&XCJahUZj_N=&HaLAO2Ir=2P; zra`?mUJ07&9^n4@o2QU}xH(D4bQzjNp>bkB)}R`A3m{n#pIRoP4a?lwxElnAh#~XW z(XD`c0A@dDpc&y{DpK~j!Oa{dmgX*cb{J95%Vh%rrB6BOq!(vK4u&&RV4)$B74g6+ z^8=vNirpPiNEgYz*0JQfNg4MN+%D(l<#r`@@;eFX#QH@G>m)>l1{6Zv_NgWY~ z02W`46>hUqZu4O7(hi(gGh|4?(4peQNO;FwgPsYyiWyMQbc|fw1tnrtNP!AV_EZP6 zBTDX|?1m&>=X}(t{~2Xh8@@o^bK4z+IzU|GpqI&&4FZDjFUJDIiAZUg4IP;l1V3%4Eu=n`e*}uMJqO3>LftX`qs)n+g#XZ-(9=FY9x$77pAZDCKL27F z$*jzGdfL;}WW=+xH>xaCR-36esWzQmDa(kXYx*_ub4o)S1I{Qq5sWgaOnytc?QpE$ zA+YAM+9p#YFp+7F9~DO<(&9#9U-k`wAu7ulX`MtGa3JbcAPFWY=6YYuTJ6S*R1im89|ZrqIV=4 zP=4U`xq10=Ga9fGjPSE|@2-j+kL88?I;&u=c#;kXLsbt!vh} zWi@A!2SV19#-sN79Cto9%Cm<#ZhAmbh2qqOvP<5Sd*GV_prdz*8rc{sQrx1pL8NU) z37l_*0F=PMY1*(>OW%PaV2uy+NV zQi~B`mQS0Zwxq^OKINn&{-3t0;+OWONtrZNwriuNshW#;SvYATE6s-gzUR5Q5 zxWp33#HpWfYAD=k79M{FLzG*wxCEeV7%F%HMd8#ik6@ytn%g3Eq-A!QVLk50NFGu| zyA^%E!ddws9Llz-X(R*1K?3u zcFNNx+FD$i@~;2W)dvL(b{PqQ=2VFyN(=>j%!YD&%ovmZSb3s3O$RD~(Y8EsQ;1V9 zslZ=$(@)$`6{U&}JcbrlQMH~;KqDz|*=k0F{l>U?6LEs-i4nJ_98t)5L_$rQqNYB$-LpXkvwIsI4153p-34r1 z(nng+%m9HXsRx-49 zp)Uv~qU&`Fle{cB2Bgt(yxh_+O(?+xKPBKXFp$%--Jn9z{*N2DDg2Mvf@5d4fuB~R zHWX{>(tAbPOHB`TLA9p@m{!+;ENZS}D{eO&`M*Lp=4)y+zktc{S*4ZcDQ&DJ(FRb&xW-Hw@(diop=@2pG{q>kdb5im=7ekFhh3;NdRH61u%*7qIob>0(?}k78-1!fnk`Y#Z7hW zzo`Qj6V_$J+G)D>AdUFs7t1ysDw?IpS6jb*2GQa25=<$eE2z zaqc3YBgIyyE>Er%oOO}B(Cm1=6#=+~5VNvO^f<=g>h|FKGTUJ1H zBq!#_Y2#c`qaNN;hAm_`!B+BHPVLq2v16r0+9&Km?9;9_5A`0&1=x+-!E_N_F^FKm zP4UtV{d-g?s0Z)(6r<}@Mr@(_UAWtYL-p#+` z8Hdq*UeuC42V{L`sTNUm6TU|9fqclt9;*3_0Atr8PFX&+!P=!bg-0klJm=vz=lM0a zZDPf_mE+4Y^OVd}D;-m(1zws?fsR8=PV$pIx8rg$&VCM?9+vOd@Ry|SIWOa493uq) z4c3c#;IssvSi*U9!=@Dr>%CachqBQNj1RHzQIYdT);obnJaq?J=AbxoZV(k9iHPg+<$Y3UjdwTFTq39q9}x7Rbta{7r;hyl#v zwS3wn%Oh%u!{~l0lOs2dYWWP`VvSRiea%ijwu1AzTtpxA0b1Q6OR? z@r4sBANw6SF3)d5>I*UsO|886FU%4;L;#{vu8~v zKyaTYz`)7X$yhvK>tsBhWa;=P@(FOGQrJ& zusDO9m=O{80L&GwUf5fJcEEE}UrvNu$flh(It|x{os)$?Px8ufkPBDvC#{l7J96`9pc+2mg~j|BoHE|4HZQKmSkJw6bZl((At;%K!73 z{QO(w|KV99{?pU{;Ku%CG63OfDDh6lg&k}jpp1hYN(J_1u4|L~h3l~TvFQ>)q5VeOHS9a125B*M@F7}?e=WK7%u z`F!FLDwqm-FJdT*l^js+G^I?2U}qRg59u+mn}CuMhoZ#jxIL>FRLs3rF`E6>8CEgl zDW}bz5r}of*cPkiSDlU?mx?rK1&E`doX<;1Zia?TB#eeT&4dqY)!7Af-HYoNgQ(fu z5$%GSx$J}@5b%wCC^CYHk)UApR9U@|UKCsF}hK^$4jU( zaeS&3oeG~Oj9^D3$_RF^tvMBwP_`kFH34-UXylu>tN|oqVAA|VG4W$`NzlRE1jUGX zf)GeVM5SP-T4u;l7D#!c+j;sBt`ucLCc9=+CzB577D1~(np#mW*WGGB4|20Iph_D# z{c+U?hLb~D2*yI%F39%o=psTFs9FP9w35YAOq~ zmQjhEV3!=>PTr*Z)5F1J81*gTn1mde%?dQ*T)!@pltih11FZ*?|KGArM4~!nvQF=XM zK#yOJP3_D!-jvR=h0eT%V*m|G4MVjBJ~PZWX>xmFj;gmN>j6Nra5B&-Em#8l-gFz@ z5L5*iTc9IG(BkS|b;Z&$K_CQBLSMiel7ND+)N0`JXi!jJV!e`Z*m91WaeJyV97=;& z9UPcAD#vtHpwxuot~im-Z`#dA2n=-FAR*#`6~JF8*TSC*=@J-9fsc#j=hTd*xBs5R zI8oXL=xAHMB;SJ9$6C;Z6u1lIIftSx;+9*2t=_YJ+Bs|lp}z!&-a0BQQQg}R@_Nqp z_ySl_U8~T}W+R=KZ7?qlv`&v}0GO;PYgo|3x@8@^M~n@Pd;4qItG4WEaXbNk%9ebz zN<2H|u<&nr;tmiMmM8U2Wbz#)d0LE&-#nKXm>U&D>W22@eB?A=X1pAkbc_jptz^K$=nE!>;+c8u!xW2*vom1}?2c-9 z2bKs0>Pe5$k$n(zBH3>K91MQ z*f2Q~chMVQTymL;8F5@+7TV_L7zuHk+114)OdXEbzGBDB?zGcmpeX(FO)PUED7{TI ziNO+M6j@?EJZHBqVsY7}%54WUOzC6WX8h?Fr%WA7l0nJMzZ0eq#(sebgYk!8HL@>i zK%@ogEF1fnkr?n~QiKx+Tg&WyQCfSknrD8ZN_`_^#cZ+IB~i82ge20JS}4(vBa++CXSj-dOQae3SMCVbY>KuxQ zZ!zg9^9_=U2%k?q2ssH{ka$IilX&qxAoU@$jVH;J?+=qRTbQyzd1AKdz8n{VER7iy z8hfa2#p_Yo)_HJ&HQQJtu)=ro00o;ZVJOHsia*PYv;&eTcqp?te^AzN-INf!qKGKq zj#q%(!aeL5CW@fU!F@CYO6Ke5VBqCBG5|^Y{3>!#n64$dv|bbUJHt8f;zOTz+eJUfVxy+VGP8F^Cq9N?g;6kN^8NHUhn z`uaI80VM@cKnQn2q=xPIal)2hEso(cy)_YFscM^2^bE=^2~T&o#!muUO5_008bY3j zAB~M~5||VgDGV%@gQ&#VZcRZk9QAPg733L4Qs^C~ex!ieP{@)k@yRN1A^=oujWk$( z#3YvEn+*J@3}tlSqO>#R+7UuXP)QHrFXU7|NpuWHYCD7S01Eif0o_a{OQUnhhq4!J zD9lBFu&y3Mh@EVZ@0bK<-WDq034VpELTt&N>zG7ZS@o7U2V^rl_G%TB*^nTu1%jDq zM|_73W%8H>$$*^7kr3)7L~6z`&rdC-1R~y)1s-9};L0a<>TEy-naDtDanq8K5En&q zAB9?Q|FQ&>&x^28({5X?U%6=kswrw-TEHBxy>Rq|ql{W6XxRNu;C0aG6cHx%n9Mf& z0QuNZ@luDXq7eunjv^$pcVfgbiUh!3(%@5yqhU@0+Ona18*X%GuuHemYRN*I(x2E& zP~?OTX)**!1G3Qu`FK7($}o7sAYP%82s?&O{5;`+xWqVxtFno);vpMRsM5<%X~jaD zn&$9^L?2^30kX720YSvM5+o3g6~l_){qUnq9i=}a1-f~#QFMr~7CqbzQ2`F(H4tvM zY~6&yVscP2<2GBs_UzZV@XzHYpokxn3CuM5&xQKm^qXY;wAbL6H zO)12?3_YT}XNNdq!wC~LxorsKP%(=l{#sNH)-rej*$|uAZ0m(NI}KS7!HpFWgd|}P zplDeBRlGMp&&rdw-yeEz&iY)-PJZ6*asTl@+5JBiU$IX(NB{nxr6u6=nOgsG`XT?% z&*W!b!`#`k^gdUg>#y)9+u%Bv>-^!vFNj1U$z<}}bI;Ao>pSeQ4Wmb2Ja+6Q#~pXM z$Mcm*leSKoa`p7-*Ugx5!<;!cS6AO!S9ja|`P-K+y<^$3Z?0Z_kFI|!6uLhg{`OgC zeK(Q#-Z|$yx?#hHE3UZWs;jQL>86|d`hIZ9B|qH0efvH4-1Fdr4?gEwyzH{a zue|cftFQj?%{M>0ZQD<`Z{KszJulpU|4R=&^va`;zV`Uzk3aqN(>r$j`uXRdfA!T@ zckSBy%rkH9-u>I>pa0!!ul;G?zI}W5zVr6mZ|~dp-rH~g<m=w#POVeqsL2_4j}6N0*OmxY|2m|J?P*)t*1@zN+n;){m~< zxaDOnKe%hWHuBWrvC6(@Z=7kpF*c_44Y{tMA~v?;u^l5l)u)c#zdP<3c}$=wvAc3v z&8D$|*#2>?@8&*x)5*zSz52~*F1Kg3@79u7aBj}%g+rdGyM9BJ>(;f8{r=fUt_z?3 z!`YofJNojvsz!AG=uamc*H=@wb^7p+A09R4woATM-g)I;?!NB*H*Ot~sC@LE@3n8b zxMFzo&@;Zasp{V2MqlvpBM*NNzBMPb_MXc3`~Jsu%(xG<(k1mdSGrF=_swViHuKCM z%$YT;N1yGv=vO~`x_oH)?!5Ol7G8Vcz+X<-v2(}R>vx|0)A84@Yx&C`KAQ5x;p-pS zQMmQUw)*1l+|j$8J?e?dy4tuO4m65 z#EqRF6imM=dfdnJYWs#qE?%|1_W0{hi0mA-XK%Fhu;#~x9RBCAJ2oFU{QkSiHk^>9CTuIfvyo+&G0z;`-x~>YlZ` zDl2;W%)5vEeajB(*k9bR?b5*3#g)TLdrKaxynXz{{1HdIef@2>zOi}I%WF@X-MOW3 z#O%L%&a9}=wieu7H}|n&wWF@vQaEbu@;lCX{ex?Ydb=lVbLEzQ@WkY6tB$|AX4n}2 zw!YlM7i`JB;r!}}cNPv^{m7OPxqm7cxAwr?S+~?Zdd*RlBM$ra-S7RE`$vWEpVR&E zO)I-9%-E7bcjfV}2fzBnF`j4iU)|tZc6{yruU$6%r2oFnb!_71Er-2c@ywYnzrVS9 z_=NH;ueVp{UcY@$ZvGAigB@GGc7bo-f!9{JM#QwdLSI47#=}nV_TADoqjX!es$#5b zdd;xn>G^qY+<3{?ewcs8%V%CV;wLY^l9LxYcSY`Dp}jQ^{{7fB&*fGu$}g&^&z(GR z#TQ)n{pL@PzW=M|^7Cfg-0_<4u;;bN9iw(Ww&v0gu6F(8)CV>l_p@8)ZvImBOZWSJ z{lT*6JLi4>=D$wN`R{&hG*#l#Z zX|sM@a8Yi~^M`lrxOUTrYlnAxN`qu|uhAJu+w z_*v`MTsU_9ljrU6OxLQ0pFiZJksH~0Y|A;U;EfIE-~YgppXZ%kx@YdF*I%#8xqH=9 zBgg*umXXb)CY<2<`Co4xcj8UHXFaFZS6+Yi0|#yy7TFxR>FUtAqeBfhzx(9$n)u4v z`TM_k(f-bk9OL=NuD|N0dn*$;t)0sXe=zCZ*Pngx%&}d4IbU75<;bVrZz-s6um0MQ ztz(${xO%6nwzGBoy?=Wy`SBT7pJYDZ8tUJ>>XPbf8!s61-y0u#bHX1I+p3Or?Y?pP z-c#P#^Sejio4#!OEB9X-4c_b;w_~bx{t>e#SO4s{9~|Y{>nmPedu06)ACK-kXXc3E zr|iAG@|l$n^-bNk?5b763%+wn;kem{otoP-WyRy}pS$jRs_r=VYgarKTt9YuUvA@e z-yilTrd|1yh9Nc9UHb6O?;Lr|TX$D1@vj=CawshuGf2cZr|B4@1KYr4TZ|y5e|Pz#n#-v5zL@9Pl2bkOHlOc9->Q=yDm+u)KCF1^Q%78Q(=p}W zX{!0~&86@B>c#I*{$O)&!Fy{K4()qpR^oz14JKN8#yzeQf!R)ArYtKJw9lXJeZmy!p2aep~*_kA8ah zvDX~_z@@((_CR>(M-$c$8&ci6Vc+i`H?MuVpl!>mRg+c@tG;*b^oq)<$y;2PYu8s@ zTkzg(T{raQ&w6=!)#>*IUkTll^L~wXX?tbO`kQy;YJY?7JAMX3*(r;UvZ_SOZ{=zFeW=wnQnu4`|+L>AL*pZLV)G-}{5>Uh{9SJnnZV zjPLx4`OVu8d+74}#{cx0X9K&+uADgJbZ!0Ys;0%?{dj)Q^^ae%{Yx#@Eekd;DJlKV zQ{@fs@ z#vQfnzvf=KYu~6H`OCL#c;B;f=oX@@m$>7vtvP!q=M5V_%$Rkpk^AaVqo%t$N94qlZ=C<$yZTR;jVj$+?jAj7 zbWX1OqQWw*@$J06`NLXosTuX!q-i-@)_hP}9WN@}8S2)SMe4`6ewH^%AKO(?dclZ2 z9Ut7ke9rL7NAgbl)0p~w_q$H~Fp)QE(HRdPebyy~FOBuIP9MK^$g(LPE_r*2H9VG6 zvNvzxg#44YDq@cy6MjGC;#QR)jv9+TAMQB{ssGA+O%QFlFMH|?e<`~|KhVo z+~+?JAxOCB-tBk5I_uTJVI4b|x`&>U*?>a(TU%Pk3wGWs6byMM!Lr0w$+c<2( z^4`(2_RU^ujQa9(Pie-4^)q7ggO{A~?4B{6wiAmMZ*b3EoV#*!Q}^bMy78A?QPc*Bm`$=-6AYo>tMbb=aHJH~nZvjko-vcfF&wz#+d!Czd@z)!N z#*DG|=Y6++{7*a1UgZ7q1-Ebh)&Xn%v+s@d@6H*y_{5Gq)A#N>Z}?etW2*Az)oyxc z$4sT3?!&e#)Y^ zrvCCeSL<`D&a2KJVa_@2{%e=ijsMM3--ag(-)-{bO~^ZDN6xa+8wEhjN=^aG`L73Bu@=T6y@bJ~Tyx7;~?dR5NpqmDc}=IyD<@fRNX$Om%{ zpD^~#>a7J!HlO>{rPE(JWx@5=egAsz`X5i(_heyZ$&GJ*@4|1*E+6&6825of^RC>h z^K+*C{5O45hhDPoyO&i|edUO+2Sz@$>DWuUPkeD>I2q~wk?)!ZR*bwq_uhvudT`Ih zW2Sudx#g$*`mNC`Hhnd3XWq2ed%pbSMK?V^=C*Gd)%V>tbba20pRBJ*t{Oji+!1T_ z!*g=q$!}lnnYUubxxZ*HzHq(k__b#oku!Dt8NRL7?Ni>*9b0n6z8gHJ-dNhZ(K_#m zKu7-Eo3G9DFJ5!RwneVQn1a2oG23!Z+Ll-R;pnSofBmQ>-zeA<{&==AVX^Cl6;(gJ zzOuS9H2TkZMHhb~zclag+S4YLoOJe=3P=1oXUbh`rx)g4ebk*}w$^?>|IWC+wlkF5 z^5UqRJMIkZ$(vc3_voynD@yLTcG&;><~DbGPL6BNr!EN}`uU80GU)%Tc(C|WoddLd zvu4c5qW{C66#XCjt;D6x_*7Ss<>&vn{x8e@gMqBuX#I5H;Nb6nCdU6Cy8nOv&j9xi z|E@4v!3zJ6&(XjBzhv61=_&ai${4)NJf#2sEPkebnm=x(u0st$j+;KMN+vp@@p5nr zfPlGqNh2QD-Bik=7juDW-k=XmjWa}I9UkQC{&ZJpXSbwuh=Ew#hPLU8W z!}`?RyHRO<2VabZ{BUr^8eg(s>+)-<)A`&5Y`(5QOG_8e9~gnK9d1bkTXrbG29$Xx zQ%B?-*)R}ORsh}#o&I&;KM~W-xTSf!d|D{VhBVs>z;|EscKWo63e7_v!yb%BDJUr5 zIU=oOD{J8|^_Tjz^I5AF*?>B)qt0Tl;Ns7hTtK-gW0*jbuP+er6ng@JPWXDDEyZ9v z>wM6Z9Z2diiGvx`I5@2sY_J`s$R2o*^k4W7#s)H|ttKZpnc9}Zc62RabU_(t044-M z@wetx%cWtKzoItqC@S)imlbz}(yZP{Lhpg@Jdt&ZZ@2wK>;U0%`wlcOd!YWfVfh1r zfX@Ttumgl@6`0>osTfUhENZYVEyPR!JS#pZd<+x(rFF%{2R}%0?SWVeXM4)zhTdeB z5oRxhdtIv??buZGeNE`WPCiJqtII_H`BE4iBF#;YZY0{^H*ClT3R^~cU)p#-Jx?m-@6^p- zOB*~EaIk^kQZpKW1b%$cKA&h5i$~j8v$l?M2rlz_rsy8_9s4sFj#`G7{jMP9fMq12 z$pmae^Lp5gmxD8A3&f>EFFuyqAraRj76B}L>t|;Gu*%*otwVP5h@hQ}fVY|*Ss*}* zW&e6sN7%d`JYxKe9}3^MS|5eSE{NGHm6@S;o94tYZE&&dIJ^Q^!0Do!swIvZn$V?d z^q338(%BbqGf)WyUOKo~YFPLr?Zs!M{{!-W(N3sL^Uvh}rkBhpN#*}aryt_~K9iqM zm%DQCe+W4?Z_+Ot$e5lOdSJHp3jaP1dY=oENNE41D&1 z7CoNO|qs`u>X75C!RG^e4Zj= zzX+9OV6uR2Oq3)8)?s3xAJ4fd-A^%|*8;b9v1lC8-i6H}(f(L}bpNkNnYE0#BJ~Vc z*`urph+Lnm_yCZ5d7Z)*anvamim6%bB{_!eguds9i1>AWnMV{-L7#^h-Cll$)|rNb zB}~BGAhpprVZhpb2?r$b{bvFn9MuUTEsS+f0VRq~P}Yyz$GMa~avCHk_7?%})USNP zx0`807H!C)4f#bx0PleiZ#f{|N`-j!qgCRf?8A192g%~;xARig5i+n$kGd4O1}(ii zpIm+eX(ljvb_HXnw6tA$dU|?1%7|%az>djMFUwM|7H8wXrr$Cgf6C3mfD)SEjNtLm zO5%z{qzuPpBfC52MdYL5^&`BiR!y=hJd-TXoaGcJSK%r3tXU&A8mHU$Q6dNV0Qup? zZAgIK$!xm7v;2Sdo&&JW;%eE>vXVd+G@${$C~+($8kScQCr)r2CvldI?M&MUS^8`% z)`~vKBM{1N36#B|p=`p2LfEtHSs;uOpp3F<%P5##wWp1uczM4TC#7Pl3VgAhe0mn4QFc=Le(VcR$)a z;YJ5tB@qp%)WEK;8mCYNqZ+VS=rJNS+Un(`iyYI~C%qUNK}3XC`p?a$419LaCnNu# zi0y9qZ*f7XLH_G4EF9qf_r#}v8E3>tp;gn+j{U}z2~jDOR0PW|Rr@wDxdCIm|2P3L zJ3fgmk--1+$TlRaw@UzOcMLTed)tRCluAOZBrdb1b;NvlV1P^U^? z6B<~;V?e9ziN?ZaE)JnbAQ-N70{7?iYRluYN0gJk5oiAjks7BI?87!Fp7Su7r2S-2 z?X2ku-f&uPDw+(13HEY|9imNAO*d?-!vbk2a8reG4Ei1g{wJVcu7vaf+ zM!zb9hl*T$ouk2=98wwIa5$Yram8@$5)U4Qz;ctAwg3RZ3)KoPG^i|`@UiU;x&|T2VPCw8rNThq>68^@-n(QZ0)iA!$`9 z4}(E-L-z@uHv|c@1=YI@!`b}JxLC& zeW~FA2gxo(fDU?9q0)DZ9E+t}5k$MKZ+OU{xxvC#4*F7wup7EYX@=Qo;HDD71!NU> z2FEhQ!wp~c4Y8_=hEBo2b>P3}lY#$dlx27F|AmEm{hvaJ05ZV;?}<`FxFtT^AOWWMvli`*>e5<4hAH{%#*Uh?h%6r3D2bVg`R??XeVN(S1R=)kme; zwl%97s(kfT_4PKIyS#dZufBQ#$Rg>7WmK%88MEle!0<)oE}s%26rY7v1*WaQn%mV5 z&!O;h4yyrpR`h!=LyUg&9yOwzW+E>mC?cQ;kwAkGi%51_LX|Gza{>XH$VS<4*dyHt zUKpK7w+=cD14c&*^LDt6Z1^1bg%%oO({`6VUh3rSSP(0W5NZvdK+@lGNuL6eVqlfa zv8Z3eH|jvGgi+LpGr>=i-62iqivlWTt<#H{5fZ0#7%g8eBHM%;%SIV8ph>#XOUDED z+wegffNu%~8H-{ZzGx`SrP&OPK{!7kSNsq7WH|p}^~51jvd z;*<7hqh|_U0KNzgcq{pQIED^B=A=y`1Uw&5NH>KN1XcK1m0a_}Aw~6ajnnN8fu&!U)}jExb#mMeuD|9F1_?&^(Ta$x>gXs60fEt3i-QbAsgpXjPK>Jz%G=RB zvy~r_sJ8OMAhR5j5p;PgC-otGw!1*d3Wu*J4@)8XvIHS2+|XFAoG5i-nlH_j)cYX8 z5rVHRXjC-s!=iFcd@>PNP>RE3n9&6_%!is!bhwpFfp|I+7;Q`8Y9DIrrKJ#_Q;M}F zvGX?2G=QL^Sl5*_cjsCf*DVSTMAm6;EBQy)4c^5rJu74a!1_nK5SJ677&r|KhkNvG zN`^qZ=ipo$n^=%IVn>L4@aC3la>?owUV~9Of8k@2NMW5|ktF)+h6dQxCG&Grr-9Gz z{-ino)fmy>C~g-SfQN5)YM76bMlzRr6Crr-PQe>bMca#@LZ{EZPeHx^ywsNw{#TG2#z9CF~Oq)B%Y* zb>=9a*5aV((6WRuJd#VyWO<<$npY|0kQ0pefqDi6NvIsfei}Uv3Wa^)8MguUiC0K` z;&}@_-dR#%A^5~ADbf4HvkF6tYvU4!XlscVnpiG1Hm<2yRj~qH{VQu$ENpJ3Ahcfy z3P6^vte9U>Usd8&^GV-We)W8wk1GweB>agUN$y66qC)lJRVS3hFQh#Pj*pd?Bqsw7 z6)h^maQdp&Gyq1{!qrvtH7!QJNrm)-M=;hZy6ZF(xTs?P0C7N$zwS6%I<;tI?9dq} z9vINmqI%+fYJ0xf;4ELTrPYXaAp{ivPrB2_f zs=E5>niWpTM%SXv!Nv_95B+Vjn+}UGAAJ2e>1uTd-~kOh=^$T_h`j-pR3eYcb{mcY zr4kn6v>kgQ#a2wbO}OI7>7aa7)hX@k}f$tN-Arz}DLW$&^SyoU~ zR#GTM{0ia{q)nHn$}fOQOTTAE!qX|1Fv;0a=DicpEygqn&meJKd{S zR5#eLs9ZhqA+5RD0f!97#SRmmVCP3bDCSm@K~z;41TB^A$rw4Bunv-N9D=YIA71(w z7@Ku>ti@$9Ka0^|;6bT&5MHcW2AGdQ{X#Sh^^2<(kdUr4xuJS_Rn5uCR}M1}_B2M}(SAYu`y(Ejk_oz=gS!WHXa;O)lFIrXh{ z46q9Q^+_xL?~cRr=@$neKf(V;VL{1&|BpTK$u$4$%dT*Mnf!kg6dL%y67P%w{%=ow z`kR(xE{Z8UEB;o*(&6<(0zu$!G&UC#$5cfF{1OA_j3@WERkehMrUPs7dJM za4Z%l5)8O%D(rx5fq=t)7O5si1lhv1@H(&*39HSK7~D7{ z1-I}=ry?nf*dw|<^z3F`tVK>BxN13(QvBgiLt(ayj__4scLwe{gjB|DB<|GrIcqBB4G?|u-wHoXVSom+O97>?Ln2mGnG+rGV3aT8> zs&P1Y0CI{)ug(n0{ieG2qyjo#I-3VWEo2<%Jws?1@pPku7Mdiyg!b=J(XP)uzC8Kr z#0CR=IMj7ZLG2Dcg?4dW!N52PA$3Rt4}bqdpEUd*4g%C)ULbd#|1T*){|xZ|d*IXS z{PPHWyH-c<{J*!T$XlY<|0)`=|J*Yl#y9e*#!O?8D!ued-dSbn|AnQ72TsZZwS}D2 z1rzbb#C|dTFygX{$o`yCOks*BVw#mb`h_5vCz#@}V;ud8F*wTimG=!!)!Vk=-r2aq zHVJF(16?#xWt)b<^Q96Y{F25j*nn%-Sm96=Edd@}IB^p*7Hm<_6rwJwA|3t~B^FL4 zW$-Oy=c&vMAWI>F@lJmt1OsKOudJ)CZSbwASYCzQQrSHCA65^f%u6Wc3B~46{e$SN z;&jm+HF`{#pVPUY5IopW=XIooy>)Kax}kS%qVE8SHLkVb(>gS$B6`x;n}KaP_;^FB zc1bFXmhh|@Qb7qk)E5+B2NGBd!6hvK?L_)A9``Fr1IlG6(X~7l47G+3s|tvje+mg4 zRQSO`g_PGK=^a!+<3Ndx#LA3N1P1h#{y@9zswCoF((Y)?6@XMH4gl{;$TVP}Y{M8K zII;(kYXhpkq^Eg$oLZ{q>?6rbOY`*TwN%g98_jd*Xr3MwrFsGmRHRp$$L5kS zD{k-3YrYhCG@7v`|N;=lwxJqqshfE3}l1e&5c zI?B}#JdiGjK9SU5wm(58)PJW3-sl9GUgN6`drXQ%Vo~3EMKo(@Y(!{19u`@dMCAs# za+ql9kz7zY2xz3hu!ZDAG$JS4V?ogShtmsjQ-oRf1?84hn-5^1b-=>SCLLGp?o>E? zQtnPVq{HYUvFlNg^909cx7+IK7nDgh(8z~EC})!qD=2mOVl5zqwo|-fb!e^XK*(#f z+ihcp@3<=!voS+}7!Hggx1tb4p~h9>(SYov__bDT*-yduNB^v0%0olICDgcUX?LCEHzIlr(+1 z1ABVQB@Qy-?{s_$6Y5kBD~Ft%cAOGwCN0&2C!#?N3!?*vlHCDnC=J-60T%#EBa_ue z^01>0yKPYwc!R@Tf}PGYqu?i`2ZYXY03FBJ)Kn0I9>%yNd$$`y)&nF=U@`3+9oX5% zxk<!s!LNy;qacOD1l|Ov0l(EU4@;y;1&Z)S_+7+!~kKcG*jJdS3x(CVFjNtcGwss zRU8(+z+iT%?^LJ`eai&gKR6839%=e-n3)#%5|;}%*+2x~ zH=RUq6v>kCV${@aPBMNfz1THkp+9tf21+5yU;ibgRMk6wddNwYZ^li(q60Ci)@6j*BV z$YL6aAhZ2&>b=vW`-UWU!vl=e10EhwQy7L&3~}(RKGV=veAMu`mmvlMR^SToJ;?`< z8Zcu22Z>lLxgeBqV=G9*%VV2NA8n{MpZPd3my6;!p(*Kg5Cr2Fi98;VX+({MnS?6v z;9}hL*-RI617MvJ4{qibMpvglM_|pyjPq)03Anie=M~lSTAC4M%L@`U_vTh`a>8Oi z8HbpyI<*)bwbnGlLa?IE0xUF+871+cQDxNGl|$_Z0yJ&5V%}^Tt3quC2{}OrGNx#q zWn}1yK8^$5xW>Yo;WC8G%2*lN)?F?5!39PEn^#G8))Qe^v?CGmcaWnTMghFJ;=KT0 zuu28~!Xwa-->elJfG5CHqr0}QrncT=6S}H}5++9L+lPQTIdvTH1@<$2`o#a$$?=#H z0^;?Pn7|DBUxi+;-u|NyOhN|uzdi8jUoOhX|6zVF!Pn1!Fw1A~{}~BIWFdKH!hb2T zR3aev${!LCU_%(J$|3TX-OOkh5YYiKqEbaII1i5RIz*ebUf0yqh6+;5O0kOU0J;*S zsG5T;7*aY+7%Ln_QDCjouu!bDdJuDNQ&f)NQ3{+sXS@|Z4~dE*yk)jS?CxnE2e7`b zDWLbKWlGDn{1`F%6&NebBDg4D<>7pl;6Fsd2QokD&HdM*BI+!oF>z{fz)xY+*jJ~@ zki$Q?5bi4aYt7x{6zAC>Pb1Sso(zAs83R_Bu`;|@h-0xiRL&&rr9;50(FWZ4DgTe0 zluEGTW-4SqZCYr*gd3PTW`Ydb7Y=pG>=uf6I;)z{XhWo#Gzc{W>)9|32huXASS1jB z(*ALh*5XY@o>6FP^wpxq#>4&|U}Mc|CCz7!k=gy$k2qw*6&F`&cF(1yp_Eo84H@R` zBGc6CKwx)%h!!rclUr4(vjI^m4zhDOh&s~IE563YISa}FN{%KIJ#($}ml8mGXD<37 zcL%~L1!4Eho#PSn7$j&R03f~rs6aT`%6@5)r>P1tHwih|5B0FO6~nNgaf1Mf5mA@6 z-&P#K8o=v0&AMYd6dG+_Ioz*BjD~|k8!gd>1|-0@vuCc2`{QH)HbF39G8|OJGJS(| z%dV2ZH(+%u(#!N%$?M$C;H?jBG`TdgVKZsKP7fGXxAml=p>CH7ME9pk<+0x~J)IYK zdY;?fc!;}sngi&3E(0h3QVm#IqsYp^Fe_3c25Y8p8N15HBu!U=yVdtn1yfLAvL+Z0 zQ(z{kGO2a}j>_Z6B#$!6T7=^^(P9&XQfl03u3tyRPSiOJ>|m=H#tEkgLYJA|StQyj zxPQTU>BUVrUywJc0Y_Lpf{TFVq!?m)x_RYT-T zRHD+-n>2;Df;l$lm4gyE@vx&8AQ_n^RYjYWFsPF--B+o&uvj92C20&V;Z&nF_Oh_5 z!RamH6y&(TYP3Pc8h3kqo2BDM*l!+}2XQCCP=aNX3i)jUcN5o%w@U%vD{Xko3X1Xi zFlUrjQLdjVnyQ$*=`k@qhdxmzqf}L0AI1v+*0eA(hwL(to2zQZ8-%sJpftHxXix$F zgAZ4YWSFld7S7aACoYplLTt8cg&EY|_{geg?RHY%i5M|6OHkX%zOaAIr<73zep(vr zjRGkUd}Bb(6@+bQ{gr{OLEw-bj6`LgdGle_Amc;3QzOfIK!vtsv`mNSCryDvFUU99 zO{@uceQ;?%(I{z?qneAg8O4=)Kc;H2U5rkIpt`~|EyI{*;iOlL_c`&LKg2T)-Ra0F zuc@fD+wDeWduyQj=%W^}p9w{XE~WN;+FHV4vj20WQ0gn$QT{JP|NKvp`>SIA?zlS~i=>nBGd=Jy7Sgkf-lP5!QmJ5fRq-Bh zu!DVWlc4X+A(cOh-$BCYS_R1vdp_Y0g)vAwx_BsYe?Zo2fgltSbZ|I~s^@K(CDHzX z(=$(*2I}HA2i6&%Hii6915hNuD`XPdx~yioOG);C|4YVJp z1fU8wM@2)S-hEQkq@D&!!K|AQE5&cBO^Qkx)Ijp{6smll?<7K3N%A+smu9`9saDSv zBeO|1wWla0o?<=49U==i0JMLh_{P@_Ug2|E}?i%*?pWgf1#8?)0A3$aXP-57&}&0@v5CcvtA9#ue`h9(Gd zDu1Gw1)R`y+Z>Fq+YP~z8DeaLI~PkU@S+jdOE=@eg#l{}HPbPp{4c=_ytay&Af#7} z-mCTyP$5bVj)lw2c4>#4#DyK$$>Y)VE3hKOO%IENE)c_=W`hs69ev?jMcGJg?^PRq zT9u0l@6`B1IMN%whHT_-EK#cU4>$;cDx)?BhyrX>d(Q#2Hv|^c)lgQvF)-GZkV@hv z0AlrGm47~7#237RrR$h_p)J`4j^ABMD47z+2$Mq)&Z~nZ`CF4RR(%RU9Jy$le)Q1D z`JxKmDZx-6sR~cJjn>n>?IH%)EzzY5*zi3*kW>|4Na!I2uVpYc5&9Iv%?EIB@C$~U zDv=}BOybHV`-CiC*oAVdAB->c!CB}Ekf_4qx1~Uz%m=u09_(Gp97JTl2(O^lf?y?8EvDh zOj9w;1+AFjQ!^NO5r+WZ#DQd>)e~qBVWZ9<%nvLb)O%=!3B6-$9%b`YuaT2>^Ua4i zhJ-&EBerIUlfeEpfv`KPuoT|hq=Jz!C+g9M9 z?PwoTaQ#-aYFu0BNDb5J%N1YpwW95Ab_V#Ia#)U-9t3oU+X2Ab+8jYZCY~OcIsT)( zoHbk!*BE3l7_lg&>8sA9*k{@u3H!vzG*e*RCo|`PeVr=UznDl7nXcK)RZ*P(!*hpa zV`_3gPo)gOOo(4tvd<8sK_(A2Ilv)?5OE5ak%X~9+Zl5BBw*1a+hUR(@?fmMk0T!M zbi0uZcfZb`I(<^6`IC$jsF|zu4?_UrzjUT{|rygTz)qn!hj5u|Xv z4Iz8FHC}6U_<*y-r;FKzh8-kySPA(z8CR9J#UPZq?e&IZG8P0#ipY@`#7^N+pnlef z>Ivprp}(>ml!Mw^4r+fHfyO^N%A^jt$6$!yM{FX%P!V9#32%JK#tvWy@IRD^VvR;g z>V_fhA*&wZUxcElJBXfviyR5eS^WVB8b!Jk4+9fJv_4QzP+{r?+8&P~9dba@{7dKWI zSp)MA_z204ssWkxUXCau)>!75H@R8$b)?aLGLx9oa)?#RTkWvtbxn8J)E8oS7bu_` zyMsh6rE4$BqLt zz~5W&<(?W8rNx7nrx~)jdCD9Q`Ug-FPQfr1`nvG>BR)v(?1&T>6iX{&$%U~L(IVK@ z?(aq3DkS!vKkuePrn8#rtx}J+)^w1@ zsb5e={4wAq%YVRPz@wk3vmV3HXzk&2izn#s^Z`6oo~14ZokT<5*TM{PTJSTYLVdR5 zxLf6#%|An0o(d;Ju6hj6lxT|Dta{g$RF>7i)Z6lbOY$WO>&jiw59fk7|M8j%|o&gWtoDLPo76o>`LGqZroAwuD50gUR* zhtYg-mpweqA(CbU3Jk$9!WRgmgAAusnnx3M8E|V*9B&d+|;6429hhmrO39bP8>l2*s#f|ToWy$dC&nGn4{e0br;z9dC4Y8nnxB`dL#?VBCsf^ ze-U!TEhxu&i8fMJRqZ9mFKri7?0^AempxpJEma#OHr(1F6cvWXpx=b|wJ=@$Ro$j4 zYBMuDf!bsGL|vTnHo934n29E|hd3T)-+ala?jA>00%`?iszgY!Z#r!hpLzo55HbX+ zMvB^OVjJ13?gG78!-`@hurQl!c8x9)M@TbOe8NW2*nMhrfT(D@9i0py;bEE=W-OI`6 zQQJ-qIyxe~mJkk0TnHEpategC+%ztQ#e(!e3p2e~t)pi8jo%-^Epu;7V4OI;{LkY8 ze=3u=(;S+PLHo(<*?$akX2M`G{)NjfwX9AC?hEDgq~gRCGvUDkk)V&ru<{K(*5cIK5dNLCUqZ-0XcT%L2Z3y%f%F;T2f-ob~ z+2!c{k!>faym;;C_2}sB?xH2&yXB0@c*N|)3A1xY%PyQ0B%HC*hjT)u`e=!hU>06y zp-o@8V4u}ny=dez)Vb5dTXWUlMH-&rnCs1K&b;U{)nG5ZAsW1}6p-4>z{#eM;jvTd zOf0iPy;+qJ+Q=~kiRl!z*b?Q>z48w!v)OTEKEZeXtj)z2e*$W-Y}Z5MX%(bLs!mk` zY?4*&4U=gu$#hf`wJgCBrFZQuhcq1?U#NkdveBALVnAxK&6NtsjNoXA+MMEoS*1jE zsRe6`;osPxko?xd6B3%%I?hbh3!%YeSl>bIZx?AjT^lAVuMZ0*(h-P-_tcWXYe2uP z(=xI!^UJZ5eGuSF72$BKOAbkq--@|(8U6HgfmS_nDgL0IWqBFVkRGAq&_JJ_>^Mq!g)r?e&x>qY|8mh{O?isq! zfa(9o@P>kqOCgG3QlHwZ2YZWYvO5U25L0!{0a9c{mL_QG@hH= z$IAhM4VnmOgG@k6_&fx|`3x!^KuMg%pOwxXeOv5Z`e?@eI}lcCJf=uIh7dEnSECX$??jqrW4)9>hrdmBE3)hlhaG~WO1J@tt}2PI z@_ubP8P4iRoY^DPSJYPTjw(cpus|%4z?NV%s1W#h!2UY0(mbrA5_bWNUy0jm(1)XC z>`{jmB3$bAYJID!>go|I=#*>}5mT;}=!fZigCVcY?PeiX5kj}y)@;LYm?hU2Ag#0; z$~ZxP-$4s%HL-A*AsnO#tqgS0V96L0@uDLWYc!QLj1qjTT4-jpnecJ6cqr(jTCU|% zK3i{%wtQ5sx!KKQHQBwWb&ZW+r<8AN&Nl|Yk&`}uJS2GOfXOFZcy1kgoP}p2Cr%*t zk@WW_eC1wDxK3*>lytK)>^6dp2Q&`J9Qd9CaS?-T2-VI&JKch`)I`o|(!G2^^IqGE zgiQRv>{1h!#fY1^ov)q-Efp(o2esb}_1mC+kmmVV)KimMo!X`p;zS2piL?gX986U4 z02(HUc)T)Jx@mhqCVCb@uG}yaF9jdg*(5Jep%Bt#BRiJ8asHjbj$_Z?N zO9U?no32W2kn^;)Qd&_6_aW^dPypDhl40UE!0CXHD~%>&(~O&}svA&Dm||n{K)0{3 zulqzD;XDTUm9Mg9Il5n$cvX7ob4trrR`^irVtlk|x?G7 zAv$iea+>OMYKrt3G47*KIMBD!0a{#b6N%Jqvyy<_ApXYRtleq?`Kp$|XSU56@rR;5 zSWy^AG+ENvkkO!40Bxt1WY*?pQvyuqo8F)Wk8wDfHd_vqDA!ljp$YWW*DP#UT~SxX zjKT4egh;1d{sf3B7~G1AX)GwVmXlNc}>DTwnY6VXh>yUb!|hM?lK_MjJmbH`i8pd6^o2eXmcleNPCyp zG*tN(1I59L2ts1Tf(3PYi(=dqf0xpc1fgVHmJ{R&9Nch}s@zC{3Bj@cv z(g~e730}eaYqi8Hn?d-#{AA4FQVtPd!Pwc{z$eq(oDrgu{ zBeH(K>eLBW9mBo2e`_-rKnrWI7s0d2A@yM^4hV1mD?XXzf3aw5sBKrAzgaTI|MQj< z=;OZ>6ci4`|Jx&<{-!^I1dyzqR03a`a3B~r5!UTKNuVGKzo|r+-PF`2It0nN{HC1D24|f0Tbl zFKEDGf?0<+Gxo2O0b!(Mu{sOxD3q9T<$vdm8 zsGzK*WOwda0-Wk%|&^J=spHF zL0~;*@b3!U;7);ds$;Cwp6Hx9FMaJC#60#Vk|C^UO;rydz>UKDCnaM5NL*7>7hCXy zg3Cb(8%yAwNuTK%d^E+pi?#HC?3EXB)2drjVWD2`K?^m~;B+oYY9aC^HS!xt)kv)y zZPa>0)da^tW+9_ZWY#W#!&M$-GJZIC9mYd<*8Mi8d;r# zYl0RzG5CB3gBQH83af-I5Rl3$M4y*0dmJGNuZ>nb)iJst=$k+F)C>B$90B$(3O$E~ z-~_TkgtBB`1!0Y}QqOM;3OuKoECs-a>$bO2K_e@`7X^(QMSgU($M8!l_RdNnd4LYN z74E6}WLzEsa-lqkWJP1400x4MSlI|r5eRh?2}P-G6r?&ab_ZK##F~c`N4>{2b88-b z_$-b@un$nfXtCKR^Ji!nwumJi!~eM0Vh+nuG1^w&+RwG=d$9o{+9lw^*N;%Jb6huX znhUimC2sL6G7bJsjj`zS9*&i>sH(w6DT_8^aaF|vy}NU>*P8TZTJ-ss)-TccJ6a2r zjFx+*rP|gcaZ7IOW0iQHR$X*D=#tMItk3XTYW{{w zU)y>&R46L&O3P!N=t!xR6A^zDjLLdM(<*bl8mOZs1@1EK+L|3ki!7$qV``aY%{A2@ z5{xZ{P<>+bI36`l6HZSbO>gJsC)cnc%Grj{IOD^IlP`=J2$N$HBjF%@vM?%@YAH*g zvp~r>JiH=KHQ+(fK(IL&v`-V+@J9viJY#Z7jq6pDgHId;ZCA|1T`?7U}i>XOzw;7`XrMiBErCeKq%g zAU=Ec{?FGczWEmwlNTRvp{HP$R8Uk_R9NPniP#whUH;`Lcp%;_qQ8uHe3y$StBPkX z7tu5mbkAHaqxP9mcbq&andpqutEg5LjF4V!9_VGU5aDPj$&^vGY#hfM7lwJ6rq-T+TXDRPXHuhc=TjKiHAc;tUJW{{jOLd$h?;l<)kh#{5L@g zCEz|?&*Oe;y<%V_PN~aquHX!n$6fA^qOpS;4SuzZ$~2l!#NX3`uE-E4Nw`ewy-O<{ zNvTWnzJ87gpUPr+Vb$YY9RQNNtqu(ITO&0cD%1zEW#A zrL=1d!GZhfkmb0~4>2G)%hrOr)1kM96xNQoBqV!8X#@2ur$m+!Gq|OcfB=JsOC20p zMj-QG3}FFv7le604TRnW_X1F!lJc-gI)--kEi^m!c9RxuW21G>V(;9ly1JUWIUe-Q zIwy`T$m4UZ#PO}5P>6eD!&Tenv?M%pq0K@RGc3vzA~OkcED0E4{cc5hWgI{au|Wk@ z)E7S5TOhWGbrAbnh_opY_Z)05V+J=!gds^4HDm0_X(W-wtjR=cvkV^(s<6%O2LTlI$rZg~)x6l+Sqme1{lJRJWfPA%IZP3^R<8YT|AZ3`&rc z2t~|AZw7m1+GF(xYdN~&Md8fCi-XdC0lmYaL8cxjRIyadLuW%ixrm+jC^GhbZ>&Z(8z!3m z=KB8?VN+2VG4pX*4^CYpaQ04NuRSaT8$ZI?Dpnm~ z5D5L2qcj8aP78?UcHhoHY>a@}9V6p|xhL%mgOL|%95?jBas_I^rEYQV@L3f}wv(3; zJIjX63l0NC&m>IB)6Nv}$zmk|eP}_mpiFw#e;ANjm8rrV4fexSs7*R~GI=}DJT93;NjOYI=h`9EAV;H0&V)*t z;yh5B5b6zSJmH>rQMGb&`i^f((0`Lx4`H_PVpE6+%dYR4&Wb?{=gyVmVzCYqYL7&x z({_{`L3*f50K%a2Hc3T@v@AJK2*0N->!8LZ!eJm9nJ79V6DGkU;m!^6 zJCqE~)5b=@u;@fV|97Zv(6o&*2`@uATbt&j5~8r^FxVKwY&EXDa=h$j>)zOy#FGf9 z!#JKU;qJ)I5d$$4*c%mDYv@!~NPHswj*w=XY>C`l{D4!Y)(1Z`ExRD~3I}@qIGQKt z^KcHDGGaz4#&i*vpXilKI~Wu=-2zwFE@>wXXNrBcxdZK~Xa{17HDc{v=Wz|4L-9!r zcgW!|ML;@hmcu8QzqqC?oaTr&y=L+YEW3Sk>me8<@#ai^K(e~7Ophc05iEksbti|D zjlPOTKN%c^+RAE{1-aO3UMo1`E*kxb#|xV{vJsA_y(Zw*L<%@gbO6G!ypa|umsxIjxr6^HevK76HcG($vzxY ztYK;PsP4|7krv=XjWr!gKpsL5YAZaPu6i}K8g{ygxPomqHe7rQ_O_q#$wb%%p|Bwg zAVWdtP`yFu9)YwZT*N4F-<&}))ToP(o%tn8qz~q`kxfm5CTAFno%Z#Xv3&(P%?%wv zMD!Q|*u@jm#Ct3@-nMFQYuMzIt`4XPwRI_4Laqu}Ua;|uOd`Q7l+hHi8rCS=^uiX_ zmY++NmR?@NoT(qI?)ouZ3;O_3l(@YCoubUJi;G`f7eNvWg<0MqZ&oi%4xJl4pdHan9LphikOJqO--dG z8@kRQ4W9bVcTK2&tYwrPD64hz4>>5U^W^Gi-d_Z z9LJ*6=H&`GaP7&}U3^%sc|2O(<%a=Nw;g;%X(~BP1ly!1FPeu4I^5b7VWvOO3%Q|z z=Oi3?u5UpYY&Zx*domI>c;_~e)lOPaQ;AK_7dI?lCe^N-zpT1avbj8->Z*o?9?yb? z1th1?UEuLlt+36t&Vk=^=YU2J`q5C`u&ipXrkQg*B+)v@gMsGEuUW8mE*1+5Fd!Ok z(C8(utXqbdcB#v+5IqclBO!Rf$1A>GyXVvbT8t2(fQAr9qk^!(G26&Y=!UfNtvQ9+?$ zJD6$=>6^eTy|7CR@&qPnr8b}l8N8XlDG$@pZONj9mR{sPhzQs1e-)4TK zl1DehND~k{1$7E6pTl^h_%JFvsGm`iuRili67d)+`S?ZLE;azuZ%|tkiJu*330?>~ z9Dp1~TK>ufteEL`WMbQ7j zE2mEiK&IM0y(#+W7o}?E_j9THaLTK-YgTmwaXO8;MqTzn%1ZIsMs**=UrlYE#zQ>K z*kzE2!B}=DpL`esCd<^yY4|~_0ql?C))+p*%o(^r*Hb&H;z;yGU9&H9La${%_io(t zpA7ULl;L+({WFvQ-@@Vg$?2q+N?qx)<- zBHq<#*b-4WDMb*y^pml}&zFipq74i@)>{d6GP5mitY}vpZb_<_vC+N8yRM4YC?7{n z3Ppf__hThS$nB9jqOmTi9sP&E2?3?}2x+HQgUquF={{|Dz>hA{A(WkvT4Z>gK!bvQ z;D^MP9xA;?FcrZdj*CT32-F?in5fhfOC_ii7hHkjhIkiJB$kjxU!0P^C6+QDIwuz4 zGpAtwpj5Z85=65lPWW4j|IWaFXFBmJEG(EY1C1Qqg-!4gB{8@kCVF7B(1gvQhiz9^ zmpkN-`rWZan+IJ6Lv2y)I@yCuW5;}oXRh1aRu|j?$k-`>KOPT<$jR&R!;a{3!PP5i zb0QFb5-lh_5K5cg9SLKA_6^!NV?GI$^HnzfaQ(7!-U)YnPE1zXM~Zv<%}?aFq*oI zP)aOw$HIoeGwFO=MwnR8*!iHJWVIQKx3%G{c(7HUg_6h`3K??1iBBLAijzeq#|;CZ zgUASwFjkL}__9$VhBlxio@W?1p4pc08`i&)Xj5orw{gKjF0VHdGBm3*8blkBj7)dR zP#kB+Hip7szZ+$9Ox9B9sxLJ0nD= zVPPYP&JbDIalxi!tQphM<hD-)sNv2v`Lv%(vi_JF|&EP-@lffYA7{qk#vZb30n5=)4NHWc4 zmdz{r7q~rB0Lb7#86Zru6R}n@Pf4?u^IZ7STYkiELcMUdD?(Rq#K3%T2$=ww>^urU z4mfg2HNfCxGDBw5)8!8-F5(Rr18oc$b}#Wlg;;|W&PfGBF;9zM36V)vqCvCdNJvOV zKSC@uWRl!L8?FP6xA}$SxZFmQ3r$mtOj7;yNXMz&F7%UeIjw0k0;U;}qLi2pHGria zo_)%7(5yH)nek7W-)lD7u3|p=NqMvuNJeK|1WiO3N(NiVhVI#@%RwpRn2q4c3q|~G zvIqSjB&aQ-CZZqY93cZk65A+;6Ox5Q^n*}*)KfKeJsa8ear0E!BsCrtVB^s?N-u;& z^g|^_)c=_=CrM|GZ;EPFeD1e)RwH(kklA}RNCqu0*<{1G+D4~#M zGoDISmY}J|L_guFaU$aALS%I$yOSoViDWlVO@spN@P%fysu@YjM6?NQfFCT?n3z;L zc_LaHE(Hu1Aylvn>oqHk{pUae*Uzs8W|`s*QD{3l|7G6x2qh(*p`ffG-R7yXN$Q5A znz$hq3Unkx?0k%Mrp@Y3sag1vB~WiaVaiD+BJ2wO#!!Z2F;i&^xo{#~KsXc8fmpOv zPRP*!CJM1wIOz|=wPn+P$qRP|`9FKQ*`+7o4DY{%MMZ}9-x=P4_|2RY|oK^IJ9KWpt2B+k8dYMr(1}O(GR!rlQqSZXfQx8yw*lA=LJd`vX z3TYHK{G|BG^!S*+EMsd5Rl|o~>Q?mtz$BMA-hzMdY^ge>W}dsqkmzkK)diW>HdLp)+^8w-%c76yy}Jh;OiMTQ^)*jv3DwNe82NFio^mun7WmNzYJh9=Pn z#`47+l7@O|(r)OLUmZIs9O{sDoq^%-pq_-1y>tcxnPq6w=np-U#nxQ}uRG?2R2LrA z+_$yVn`dheb8SuI-NlmRh0QKu*a@4$VgIv6V_~khJ);X`Py4|}0NfX# zZH%W03+)xtdE_Nkm$kZRx5RIk7?sp)0g&LNtf7KG9L(v#p5@Nd5nrE(#Y5l)gOMYK z9UHWQYjH&-G@Kk!G~k9I73Z#|V=-bji(PV|MGp%L=paWOOKAM^P~S>=pYy<*a~~<# zNJ8~2F5DToKVa%j2b%;_qc>s|VH{Jk8UX`fl^WyCWW}{>eB?0ycX3k>U#d|xfz$YX zh0Ue8wNPK>3>sfT+|xV`SoJQv#kkL3?t2##5 z;AXQ@F14po+7-`Ybas<@ptg;8{9rz@2_DYF8(wtuV07!=>%}0=#IyOO)6Uw1>NfS+ ztKKl$4eopYpLlfLxlacEUk&563tGULgSbvc76wzX*6jzB|Ttm+kZnGUPFSn(kbqrR+@gVAtxgF0u z#_xcAxp^bfaRa1E|CUyfK!zaV}uL<+{ zQ(1sa@gHXx~Nd*ai-2cmHPcZL$l6p#*BK)Z(rFf7iWiw!W4Zf$g2JNcRE zX+tHo1YT;?n{PG);boaNh=#Sxx0MY0pLJ-LOaL?N{}}}Z#d`jK!2Wv=efo7LXej`W z97W!`>8@Q&V+-Ke5FnUmF7>G_n0P9qBBM&|_X3KogtW><)yqL}sgyoCMPX4{@os;VK<&}% z9+>GG2=OV<6qtmcq;bqu?FQnC%?K#UfK0M=Vb5W(mZMqG82E)0DV}NxhXRreGE=OM zz~3+YQOV}BS$&l?wQK9D7cFj(AcBTXn4Ze?(}T(_sH(55tFCRRu2}))D#)Uf$QunT zx7BhB_0>WbC0T_^Dh>*m2*awXx_T%rk($M*;A)%=5QIi#Me*afhAQy+FeP?8F(ft_^-c*1KH|WZ zI*B1}Vth`Vr@C9CWtoo{6$LxvS*q&M4Ha<1@DUeVtU*jig2G}b!G{^ikRSdj(`4%A?`;piU{i4a1mlp7nL z;^77g0Pg|OPJcKQl=7jjeBzqYZ4;0SJtDKfZqK+aBr=O`LhLxz#EGKVNQUMx6%X~~ z%pmCEKqRX}SR52LT=W4*SXPYyiT$4I)(Jz({$(m2YEkwa(Z8e+9~KZB74}yOf;HeB z+VAxUk#0~$K3WX~w!p5Tw8R0W?zZ06G51#ZftOG<&6&9Sx(+A4ozz7ZFKSK{=v+9o zkp&ylv;<)2#^8Row7(%tG4^SKmhm(j4}UYWfY2_1wvl5-ByLu^9VkZXVs|lM)9eJX zBrx1kx#{zUT_mkWoCMb4;H#Wfk9Q-5r}rgtQ%FmNVABBz@mGzz&s}(#B4Qg+(-VfF zPyK1v_dvgA@fWQ)NEcD3-27r>7aQd;LBss9*)=ooCeGEgX~b0a(2+vqZ6Al$;j9B{joLrVYpXx)4jQl#B*4N!N5f|& z<+xol9>V*2|4sw(2F)7m;E%S$ zN0M~XWJOL=&|nBp9|c1Th5`TFchG^)&-XEr|13uwEhtI#TOAqXKP81Tbo!s(lETt~ z_uoD8nM}kJY|csO%o6H8sl?-*Ar%&t6_l107fECUs9eHYS+inc^`dggO{FYWYbY8B zr-A@(K#{+)G{sKx99Cf!L78!=OrLj@+aS)?HGsuRl_6zCoq* ziX&2QI^}%S$gB5Tqj{wQLVHA!T~#S}KfZJ}0c_3}lm36VBZGgwQr1QFDVmKOM`MC%wLw@$Ic zI(3wx?LpQvy8MBZ$p!MW!?qB*pt{b1lWZbz^?Xxc zlx_+yjm0S?(p-s-1`Laa1kmvz-#L_SpjZjW zG^rGq(bP)OLABc2ths^qNGvE#?>1&xgXr#2Cc$4Ha7wvwPPhUaTLEQ7oo`|FvMOle zg6jGPJV(}CaIoM?Y(R*kozqA0_|=}O>JN752o(@}#AlXYsywxTMcL4P@ zd9K+dkY{Qyfu{F7lQC28c}?OyugP%FYf33i+It?P=uRrS6f$w{yGp3U{lINF*kT5w&zbnW%C_2k}7C>+ZAViUSpnm zCCqEiYtDBzmNzyEm%`@e=JIA#y2+ZGn-&ARCmJx&n_^#(h!dy5qhXf%*c`Y~5+wPJ zjlpoZxjDa&)uVM`T01Z>+R7yx)u?dn;>B~9XHaD2OdF3Y%GCPw7g*tPP`yxEQPUt* ztwA>kkx3;Sp~&v1f#lTDP^3w?560p>W>*Un&~(+{t!J!*T@gtI=2sO4ln!+_(>>E8 z=XZvMHFZ*6NUB~T*>zVQhqRzZ!nLD(6P#N9*yK7x*UZ2??B;pU*D72id4<~BC+SLW z_fI2Mt!PZ&A=BKx;b<~mJ9Q0Aa~oBw>Ba>-Rd65~Zh&dpfMs#uwq4%^mci#F6oom# z*F@c17;vSnjnG@#FVlOide;leVUwF4NgcT7?cR^c{f}^B{a8oF_+K-;`u9Ij2_Lxs z?ST)y|B*Q-?ox`lYO=RP^3E(PC@L!{G*L~qPL}F>l%yQVSEO*LCE*7z6@nIoy$c8Y zXbDCA*uw>b@Z%63m}`-P4y($GmP?+LlJH=~77v2=pv!=##O>AAl=2(v0G-@kE6`&H zSKG2Fez{u?q_9R(`o6>x67h+tf!0;49xj@iTi}j7S*nbIN0TIVc9D$XE(Btc2q>1| z09zr5K@v|On1ofwgz6DOM*u0;L?OCoLi<5)3~SvZqMgFQN%(DSan1574MHyNoy-)b z;cguQRXw7T4cArc(yH2JRdw{1ZY*tlixqFv=WFzve_rOaJ># z`q!8Ej|Tc*GGoC0Z;yO5^q))r1OH!1OrC@pNTuCs#jn&ZZWIwqgxaL$*-TA5(y7UyN`LS)EeG0T zlC2@pgX0axBtk-aVkwnM0_k(R-8NiFS9>VX4n&>fM&Es?73GKWtV7jQ(2OZRl=%#v zLQ@a5QoAZ+*%EIbN<+ip2e=(G=0mAN>4;2WVA3S)l1?2G(s7{b;N~%^LfUv{WxF4& zQ`vYy2G(T?kx?W%O)B?%I7e}~jSVqFwIbFfB~no-A1u!Du>v~&%0@Zg#)d>~7pVHT zLSSAei-gFY^&!^|IO3@!kGEJ`(XiNI!(;PvugihYp81&2e^4vw*E%xLfB5L=e{oT1 zsYNR3*H)zY{EyTBH1iM2to>HU&d+~|7yQ2r%>VBH^fLeK)q9ug$PoX#sAPtI{!2@X zyaW8-p7{Lu%8zeaMlD%bz0i`Cm1S9s{%85|?GbCLD=U4qbv1BLLKzmzh{el7(OC8< zizO0GCh8W=m)5LZCk=hZl5NSg46%4E7JopAFRx$N09dQ5DkTL0Y3usxB}*3k`+{q6 zEgJEi`-~366G@9Ds}_AP3d%|VeLog`4|gTwkp3z9KCYz$zGn}D?+MgE^nE;hZzJEG z7>0a52)+j+;FK&I+8hr?g7Ezz^!+!TDH(mwS%$tJ-x-p-(D&`=JL1kFA@uzlC>ufi zl*KY=1f(Ys%Z0wff*p})sH;TZ=U6PmMzjgvTZHcrHVHbV^&{e)HEX7{SndkT$)u|m zymBOhSc>3}_E;>W&-gP2##TauTtq^SN?L_h8Qc>pW6@xUI6jG{ zo5Y`3O!pz{8hyrI_HWBLpW8C(*>RSfzddCcGQ_2EO(U!cHZg(-zV!H zf3l2NvrmCP3cB0CugbaxDUeEZl04X!mcbUQWpB$k%LK~-mdO^o#bqh9%&^S19Av4o zEV0yB8Z2uqhgbrZc1y&Puyk1tw;W|T-g2VlRLfbG^DP%yF0*X4TyMGAa+~FD%LA52 zEKgegWO>oD!}6x(UCYOoPc2_rzDI;?Xx7NAu~`$c4$R8Snx0jdH8X2&R#n!rth%hV zS%+q|Wks`6S%+sGlXYU&=~?GzU7WQw>!z$bvL48KJnOlvKWDv_^I*nWRJ)m zm%V@X)ND`o%y>@RaH zIm2`I&6$+r%9)u{nNyRqE~hmok#j`O=A5&0F3Gt*=gyo*b6&`KGv||>ZwCz-GCk^@CkQ;{FKjgU~ z?+p2J=+L1PhE5+^KD1`2e`s>(@k7rWdhO8rhCV;^-J#zM8$Rs7VTHpM4qG=YI_&6S zXAir2*uBG^ANKyR?{i1x=H-^<*5n3rdvZ_7y)5_6+-Gy&&Hdgw+L~`Iw>DVUTaU7y zYrWq3u=O?T7sH1Sw+){){NUlC;YSWXcleFN9~=JG@NY+q88K}{<%p&csSziSxN^k( zBmO+%i;*KoP91sB$aN!=BTpW=b>tsMzA^Hfy~gh4-m7}A;9kGl>w>+u?e+X#f8RTI z@4US$_C93qjeDQH_aF9tcJEI{<&K&}mq&d$dhBTL=$g@y(I<_* zdi3L?KNvG~%+xVeV}fIj9dqfJKaP24Y|hxpV=Ko7#vU{Fvat`3eRtfDarxt_$E_cC z;<)R^Ju~jpea7rlyw9qAy7#$YpL_OsbKjhOr|w(5Z+PER_Pu%Em-hYc7yJLB;urES zPWZ+3zj*!^UyuLg_=CpF<2R4LVf>5ZzndUUsG86*;j{_2O?Z93LHkYH@8JEq_S>@G z!~1>m%W=P){mZ~FH~;eHU%omqd*ZZ-brTPpc2aY{(?t!5L&phzH13!}Xkt(FHbguM}^y#FDlNL`(O}co}Gn2lz z<=a-;j<(%kdwsHX^32Jtlh2&|;N(xI95`k9l*6Z7Gv(F1+`O52?Rn?qJ(~CR)cmQd zr~Z2CZBswUAD>^HzcK%s{MYOw?epv#?3dWLJBB!BIyxM`bNp#q_Oy~|?b9xp_U!cR z>7~;{(|!x({+vOE%(0eW$vThx4HlBnc`XJInDE^=idb- z1>u6r3U+wMc$avO_TK6Jyl`4!pzwmi?L{Mt78d=g==P$|il-OL#aoJBDH&U`yyVv< z50?C^bVg~S^!m~dXH1!K=!^?zygYN<%-WeJ&3tUu;92u${c6_Tv%W1WElZZ&T=tLI zuGt;4ub%zEocuZRoXh6CQ*JBwmtS1|=3Hs+p>uyf_sw~e=K1GcGVkq!CLa_$=!%2h zuW(eXuei42@AC`hC+6Qe|Le-K%1xE`FUVQ2Xu;+M&s2@6T3K~|)f)?K3)>c6v+&bJ zC5sMQbpPVPijhb%)nIT0gelSATW=R}J$U zPHEV&(!Mga^1)SmuWDMgb=B9a7py*g^_y!vYc{QUa_xR=Lu+qeH+0>qbyuwWvazc1 ztj2enN}7&udZ{_Txx4xCL-so)e8@e%y?uV)9}XRS=;}kSKJ*8FjsFt=mo3#T7q)yF zs0^GF_&9h_@XX+ca=CoE{C;bB>*=i@w3WA=(e`2cy!Nx(KM7Ta&JTUIe)0N?)_>hm z({W|TkKxtf8zRFZheqy*j)`_eABr6i>yAAapB_Ix{^o|V4QFlmG_f>sg_5N-E4L@d zA!h2Sls$D^>aEVXofmX|)3vJW58b1?quo#SOzSzJ=lzWfH(q|&pu+-(J$U$}!;d=r ztxXl1ENx7@qYI8c{pf!lv-+4jkKO;+BaeOO zxJAcZbNpV%Cysyl*Ry|p(QgL*CiI(UPAEFzyc7PtIk@?W6AMl}`@|nk3Y_%BZ@s@g z_qRWu+)!=`_xzTFwp@SF{uiBi z(RaTO{r;7U7hSyVlBt)Red&-(J1>3jvQ?Kodil)Dw_dT|6(?TtuPdWhzIj#MRS#{Q zv32X!6R$qyn(S***L-+w)3txPZozf8U+=p9;v4q8;lvv)H>Pg<=%zz&dg)H0{ZSA+cdHdSipSxqp9S`0)`_5bMa^H33-IMOV;GTW% zIptpKy~p1B<9!?N`||$y{hvJ0_P{$2`X1cz$2EW4{?Ne>J@fF=haY=n;Uj;1wBphG z9xH$B?#Ig>zvGFSPu%uo>66=@DtYSGr%Rr`^_kLVwmm!J+1vj#>rZz+H|M!~pP%>q z11~Ii;gRjt+n;=K#f#6qwDP4_UT%8%%~yi2eDLS+pFexG^VRQn9QoSd*EYXC>h-hV znE1vee{uZfhBr&!yyvY2Z$0&P{o6a<3B2?1UzNZ9@b0nijePIy_YZu3>j#A&-2LIg z5C8O0<45m)9RK+HPmcfF=)Ya~cl+OO`Nu*3cfX`>!{DGvS-7zMc8)qu;Im?)~q(ei-`0x&Lzf>&|~K{r77>Mt=P9#~qeR z%djCsh7K7#44q85xx=g@#*G{?eE5h7W5(`1ZvXubJYfI*CQg*5xbr2ObMnNA_8AUm zfw#E0_`v*Gi!^J^S4#lEJ4xx8FbCKL5;ZzPkAMN0yxYEAKM}_T?wm ze}4Ir+crr@EPmqj&y_oW_1CPcXB91d!g2i>$9{atUki?Wb@Q`}4|;SHqLlAF-1WtK zQzQ3mpD=92#KXg5@BQnqHlOoW>q*m(nfkuFXz3T@2FZ7y{QJ6jwFi8A>FwX0{$lL* zdEpP%ocp`&8xu{BZrZx~#zziVd;0o^?zm#@8CSO4^27yu4L$RwyN;W3;oylQ-ro92 z*?Cv(ZLi*Z+|6r0`0$YN$lrOKn~?fXhuI;HksKK~hC?X#ukrc0)8 zd-&q!mX_?(kGvEMT*G+q((6a8fdHx-5 zZ`uCp{Y{q^J~?_vgpswwK@7l|Q>}^C!n$aeLnNe|l-Ed4&VKo&VV_+jx!hUD zZMi@DR}Xt*FPzZ)_VgKBttXCt?c1oO=DbtB`Qd<~FPiWA)7{_X-txjP%A3BJF=5%| zOOL;y;hb{EqqDbsGxx>Ht(RZ%S;=ocxqQWI4?fX+_{@FBUHj?jvo86tY~9$>BW}Ow zkTb{sI}!NBlJn~B{LSNE&wS)B#ruzOUe(oIzvc5K!!NtoF=yQOzrAtZM|U}0g)h{6 zuy(IEuKViayXE2oQc=&Q?XT8f^!bK`-)(;O&=*#H^TEn{XMHho_SWBDy86}iC2t(Q z-RBuude&VNCmp|I{D@0u&3fkjnFl^RqvwUMhoAZKYP;8QKhD4UmQeLq&Fi*Cs>fV+^O##_y?^2DPduA7?}ZyLwVeO) ziIpSInYen%*gHz{3wJCybKCQE#~yp}oV>~YudY4iq3O%oV!qX1e&m0<@YrKcdS}a! z_5XP2$xEMJ_vfZrPqZJG=XXs!>&nR+zF)PnRDS8>)XBfTXk-1b+8-Xzs+jfozi$8c z^xK9z-8s2W-gHODN&k9q{Ysa2d+jUMTxsIi``(lGnz#AxTfRAL$Y+5uKUyXXIcUkb zYgdgsGjPTyH8=jP`IzX6>wojh=9{M9eCy;9cV1MzA?L#Etf6zZ{BZEo4>pw_c=?GR zoV=j>x+Bkie&!DUlK1wR`1$a4chA0U?b|clilgbFt<&r7Jn<;&(CF{3iq*bxUELdJ zZ(s97;j6wSC;s;HYyW!Ifm?RGea5{7_rwpMI%mW9oA14L`u20`_C9dPG1tG`e&@-D zMqhjI?Iq`aQ2$o`q(#3y^0f^Y9{%#w`(Ispyl!62>&}-NTbh?z55M91B`;lj>d_baXa3{3z87b{^RLOn zz93Qa$t8V&X!nqGU@|?TwqR4B5?|kCBrH5VkNyRfS-a6%ltrve?7`^@dOKw>H z%E4DgE;?xY9fjlP-#2V-h3m?j7g}Duvgxhc%3l4UYuy)hw~RXYA9csg96b4!Lrxm} zx4lc>=^o|UR<+~&*j0`%Jzs=7KN|o3flrV7aBu6Yx0UbvR{7EARXa9Rf03yDea(ia z*T0@K>;9+XoBwggG1F(=|MKFR1HS#e%YWU}SKfDz9d-K62XFuNxQoBuG5fjg_y1^l z{*HgXKDV=c|EAU>|9)rrqpwxH@$sBl?pYs&^KQEBksrRkLub#2ubJX!Pl zt2T!Y;m_K3mSz}+>u(I*|$BM>%I{xFx zA%8vgp?%Le^X#*04$es|3M;G6x4!Ykr>i&JepdO^Lvw?7-LZ7?DLeA>zhBw#%SC_M z(QwG{U#wg@ddwGFb3e3B-nu;h#s^kkbH?U*n}74!+a(8h7RzTI|NI!`$RU>NJEt6d z$&SZAKPR;Pj+OQ^&$870e$nm4-%Z(j;}@^}`JV0TE>3>8a^-Iy+sAd=QCpvQYQp=C z3;tRE_&)nzeoWnIbzKwkA9&;ZZ*9N3;kerGPq<>$v*))2kDr)Kp0#nviWkrO%jAz< zum9`ik5wPHPuq`{{a%`X`oa}UerKWLs6b-&6XH^?Qk zE`90MXKxs){O*I{OTDT6jw-C(aY|wH4~OUHK0frquMYgzbqgOKw(jC@JCy5Q9MiCH z!!xg)v2t6r>#C1B&V1v&o`08az2~9%wGThDWYig_o_fz!XI-?<4Ue_wRiAw8;GFFT zKlbRj!ArJ1an;gWdg9v~54h~U8~~mQ(M3V_kvs9XwhO_Y898dyteYq+?#|1t3Lbu+yD1{j>O#DJLjC4GiT<` znYs7;Mh@a6noiwT6uV@}hW53WuHUXM+?{)gpC7)KCtxhD{blT_(UI3>e{MW(HmBdj z@lEDZr22lKq6@L^c(y;p+Hb)6+N0I$3dU`FdDoBIIQ~J&g5I{LOZ=>xJXiOQjj->u z`1+oAd+11y+Z+G&4Np?Hgr{Oj?b96!2k4$#dj{nogZ3Mc`5OaQ5H4Hi^-3Ya~O**heYHTY>Jrdb!V2_;2ZIo z=f_A|znOdgdX;^|;mHNP92Z!J#(mpzt=z2(kz2L3Z8_W4EBuMe&&2CP9R_zHocfW+ zrcSTu_@V#)J~v1aS8N)7k3D{SGJ65j1ofGpty{2Xn)SVF6O2bTGwYTiPNo?@y9K z!h*d#ISNF9ynsJJ1*am&Ohdz2B9SONJA1~A89F)&6O$qfi`iCIW&Qilqfiz&I8-`1 zE_Qcc>fy26$7fYwV0BPX?dZ{Uv9TNC<2NNIZ{={d^LX__;hrf|_Q~Z3rcXaqR8%y7 z{`^IY7Oh;lQla>!tnAymy1K1fx9-}t>(HS?#l?+t=N?_SuzB&~ldD#pt*JRzSJ%3A z>!teo?|1LMdgxHw(W6ICpFZ8t@Z-gc7jN9S(bUv_=FIJumOB?O-fL@n*wN9^-u~#p zg9jZQPaZt@?HNq3UcY|*PwV!B6V>5m4sepY4F7F`xQu<769+yOggOMQ5{2>QNUq-IkFEzhGhWB7hH$~bTIAcvOt#JPMEO~@aR$|VFXK= z*Aj_S^6>}1GYCM&)%_>!!EcmbRDz&Ku}!8FW*MEYhoi=fS>PvYh()ez9|buAU%{Z@d$p+?iIF0fxvx2 z1ojDk!!Bfw;egN`HH}4vmX66McGMmzB@Z6GDztv>v3X`;i>Y>3{t8x5rMuzl{pOanW!t?o7yhC;=)#&Z8dTMwj{&So0M>5pGq8nCUu z#jMu{_dgd_6L=|G{hum+M*7-3M;XzfgoUJ$Gj5;xW5mR7d^`ui$bbVneqt&U|jzP$Uc~`G`|7itP%`FD3lF$}oi)%*_)9}ktI*X!$=Mk5ZL+!e5xA_ktORNHh6sHs#4Gn!>U|@UbSR2_XssWi};F3ZxA%?AR1VWHsqXTnO zn*5o$3c(hGKPwt!{jM#qnd4L$vVQWx3S;6!Bb$`2V9(V-hpKw}8=LIe^5kpMG4j*tIj>hHW-$elXfnxv0J3Y% z@xGKZoFA4W@dMbMYv;NT`&TW}PrjVNL*IeO4MxtHkeVd zb{4Ipt1SUBmY_Ohnh~McWFS?sI?IDmBMx9%A?_>#XLntlTPw=eeycnF%EUtBQ&+AM zba*ooh$g&t)~-MMO}Id0M(Pe_g%XF@Ck#e*{Pgh9(;qJA>UgZmXrq~2L`56S8;?ww z^L#OK%5P_B|L>}U%O?kZUr+n-dA#^h{^371%I>vJBB>d)GD%S=c+QB#M%3cecxl z@8)^ZsDwzk*ej!9N$JZJJet+=#F>n+wK>6O+Y`SWrcgY@2%E*hn~2{*IlijBj&C`Y#N5kW}12q3Hn-(__gta||>0TKB!Xg&9pxGDnG3qB+^idm&Di#8YKE9?USj zTJZh--j~1aI#=qO7DP`n%JZE`vNyCjUps5a?|y_1G6(DTC&Z1sa~(9<7O={71gU;14RvuW?N6k4!a;-Klg4-VFr2J ziz8z_Ms>0n2VZram6Y#Vbtn9e_w`rjw)Cs&wR6rLgPlVCS9S#kdV#4$9ruq4mYg<9 ztGE&1kZ2INEybPbKRkOiG7nuAu*B#|ZPs#yuICl^fN?vxS9x0rPg&@kbbnUCssb}LLD2OOe|u)Q&UZ;S)lkh3v&jpH?Bob5|R%&*+SeI4;S%dInzE5FdZ z^3WmM%fB!p2N!3p8-1})Z9!n|b?$Nd?J-w-mpSV--QTac9=k_YUQLuF55C&q;dZym zDCO76zJE06o0zt4H{UsEVxL_@x9o{L_-LJr;7_#C$f(KKi|l&g&py${%MgQ;)?EF{pX+0#s z%;j!H?<;yf&xjl1bB-#k(c)n(BXUnnVP(x*RfFsq+y2ecHhP_Z|9b;%GZzRptuxs@ zZ-?!BwjYA8(0%D@}y&j#r?CAWu$&+NO!^@*x7<*56hdm)Iw12EC9TfQd ztB0vm&YvxxbKw3X+tMPV8?8ffDwpa_m6&Jt>$p@bk_FiGj{iD%VN-{BgYMXhqNkKZ z{Q((>V#-s+&|glUuv_u-H)%EZigO*d94TJIwk%e>V#*BB<}rE$&g--$6c-Pz@YrhD z{zrjfR@3}+MyZ~QVw#WrlGA;8T`XN@<)9ggqeEJL{$^mIO*Qx1QM>ITbscZD>(+;6 zIczIS+D6ws(>CzY=DNh*=HihB(OacDO|!|q{*$JiPvp9L6WZl{qDOEFkX0}IU+F4L zL)~szA|+GIJH{6H<&Z0nWc%M7VYgJi;YBK;eTa^MtpVS237>eQx4Ao#X-tr2-T?ldzFLQf};eG>oEty1(wr=Rb}kaV!$3=JV3~-w4&s*f1w@ zV-i2$%iMZojJa;V9mqEYh$&jYZckXUpYfuU+^latNK$NIH#X10v%@QvZ~ocTQ>e|t0g6E(9ozNl2;Tlu{}lW zxb0qg%!5Vs-u;+rUPEvs>wKL+ZoS|!dwqnygl|=^voF;4T*kCW>X)mZT?4%(4o{cPbM;KlX!YKEA=1d) z(bAmwDr8PmN7dZ|hTPpZ^6v2KOOezIN%?`g#sZ&F^-H3IY=4TS6*ZF|$53?abow?B z;u*{18wpgeaxXOGpe0w4H)~R}54l}7YNxEoJb=|cVg$>n7eQ*)89uBAnXLCEsZz(Z zAx~hQ-O-9H`7M33bl}0eqX_a4i=B+kLy1nEM8^uksKUI}8*SYK2;)n*i2lk zOK>~?lVZ4j+0=b=nE?w-*E^Z*F6~#AGw5=$Fk6&!j8?TX!K|LRZGXwG*4dVhYc7l( z_2XTOgwi!SjXG{ObH8jZS$Wa2b`w8vN3DK=j@_vOR(6u@5F67JPA>xSk#2f2B_zRP z#aAWy2DKe{ZTG zr4tB<&qw!!Kc`QW-m?D3O_H9(cO69*+RKMBFv-a($PFxH{fV4>WJp45xMbTdhpd?Dy{oBKNrJfqEb{$ zD0DSHJSwg-2p^6X#1#toBDoqgNQM8R6o^Z5@biTs`}|105Es>tWaKLs$c22rF*sWR zU+U|Op8=Qfcemk@gQ`ff3~|n+$-vO@YgC#K$;iP^tHwO>Bvm0NaZ{<&Xy|lMZPjbl z5Z5M1$cKl4d0{*%Wg3O%G?gRFhR9OW0Jr?NF{9#)oSjj?0s|0A6AO8KDGJ{_1Q(_P zGlWV8JOBqH2x9(Lp}8udFmv9!a^`8~%$=mwob(=brQyZ*byh2mx}CJs0g#jf4V3Cz4W&IA7$Xpk0RrJ7D{M&`tm^I*5p8o!mpcLHC?6=(6`+vCa*7k27#Tr~u##vorVABN2U z2ZF407(x~T0QTIlq@d1F2IH?egY%@YH0%|17|a7k^2FX<&wyaFoOC`N^#x@Xi_-mk z9hfK{>sJXh2S#ZD30{`fV$m;@PrH!IHB4F>V8j21*YqP z4)129VF&nlBEb=Mp-E8uv{82vJ&SSngKQ{yfGT924jg|5EdE<#zg|z!6*u8=x89X zeCvN(dQ1OT-WooRjQ8O`jCeEtrzhjH|NlwS8~xt_RW1iml=B|0Sez-~%P1rjVkW7um zSI)y(=b|$qFC3}|uPSgYsYyv_YC3%LSIVSF`8>*m2{feuKc!*?+Y7&f@X1Yg?v%EJOjAuE-JSf9Ql!=I5Js|Sjy``CIP1@N@rT4%g?{vPr+q7voV>tcq$v75=Dj%zK8nh(f=7y$% zg7Sg+FeoUOFBD2RJm`xsDIOG+B?2S#>)~u*wgb<@vdP6b?f~^abyRRq1yVcXhTcO; zM8KH8B>~dCgL_CoTu?$lA|B;1IDqwGGTxwme?6jNBI6=ik>P)*E-KppKuTmx+~1M_ z=-$CSCMY^SC^l}=n4q}ONcIN_&?bF{3>fbVC^R_ogV?L7-p4sECLkg<9JJeq6~71V zyIO!16BZTsH|({W?j78L5@Ql4#m2>iMTC41driW3w(yupEYM}_huMz?-TS!*u-P$x zhdZQuKlcx|eGR&Ia1V%w7LXYAVXdmBdVjg&K_C1(<%V?c=N`rmiuhYIO%-l zj1ZD3m;aa)t!P!0HwoDSsWMb>p0+?3CK85SMB!9Hm?m?=T~#^6$Dk^2>m*cj!bb^{ z^Q9a)TrCvCJ3Gb6iRa`*!8uak)E4@+7*MM~gs}v?s5~0POE4BOyR(ep)91yV7#)&q%H;w*T`=K)rHArFtkFP1=Za0iE>jDe4zoz)#2A6rI{ zk+ch?5(HSog&7Rn61!*fIou3XCIDHa*&-3V!RH9%87ewhax@5L(ICWj=5U5s!IfB- zI6s+$&lRKzxLCy@+<=@fl7X_yoV0X=PdJ2ms5mVRl5(*8p*SbJRw%v}rab3FdY6{5 zy+XL7i5CmoXM{yl=>(gZfSFu2SDp=V4)Wkt$PQ-8mH~yPp%94x`e1Za#^CQ=0$nJ}aZS2a$p%Seb*>&EbAc%pb`RpL~9WD8e6Ev4FS)mA@F{H$KNZe*@#!dbkjVkc1W{7UFi9LW?eymElM;viESASMzYSfCWD4ESm?Wy7GD96E~m zdQNcb4-jKz0crz(G#Zov+!`85T?J^+xCP=aCDb)GxPlf34UP!`$6hX8E=rAK|0xHw zP&_Bjz({4$8us0-?SJ}C`@b{wnE$D8z(1;t_dWl`@Nj=4{=4Vr`QIl=J@DVLd#ac6 zp6UkvP**o^hO4(nk9#U9j)~%?g8>4ONDwSYKFK}~M`sUbqRPX-un1Qc69Ou^a&auz z*!bY!uyHgTHya{+hC^sjEFT8T41Qy$AqFUhm4RVoBqt?zqhTjcNS=V5(LjfVrzo14 zRlwIhGAm)P-^j1Tvx87Y8Wb95|55}5vsP!9iQmYgar4#Sss*EpllbCQ#u2K+F-71i z@y2!M#D!qgEEd!iD>ytLB$kE_7poPg&ZNeJ?x|TL9QJiMXgyV}Vj?4MMXMDzg{WQth zk>sczJRISq6U@QnN~cvW1|A}q^8t?yPEny-%gL6D!ITjAwL&rW)GQzh&lXHWL-``9 zU`jUh713bekn({$z!RfXVMdz2oX<^{a?+e6+1%k$f!HY(%z_<3u3Rv@D{=8WoET2P zL6nO{0x=p3++qPrmBFvK5Qp$Za3LOB4S+?>5eR|LBbH{O9HC5%6%}Xe0y4XJ0gs9c z?`j?-M`sdgut3BWW`lzIa^ZsqP8oh0r(|*-kka#%P>>4GK?rzQ`Ke+759MWNNvIGZ z!4XZPLoh#7L?gkeC^m;qqf(Ta;Y?nRW&`&>9lGS)3}A494!ooZ%<0J@3SC6=QSKX1 zMNEc|k7(F1I8Daqw2&*8na-DUscAGHeC`V$b>T9ZL6N~=+?Vn>nLgb!cOcclEt^iE zb7?;6%pxY!)rAIJ9Z9wvN~aD@77Yd5L`)YS6#7K@8ih_4<@+RyK*0cmeC-OSVKv69 z1Nne@i?k}PR0b2&M#2|S!BvVh6)-X~a&|r1CdES0JY{uph8?N@%R!IC4Tjgu38=G#|`*z(1_)`S9K^2M()1 zM1=<&X*!p#EEPDOnlwSXNY1dg1MRDOGzUJRp04g!sd@Og0R3ZjBo6Y<4vWLpg=s^@ zX}anJtRxic>)PFfm^xvf646~$O#_uiVPYpK%Cm2@5v+p1r)P7i`s7gc^ZKg2HV(=H z8O30z$bxWeaG7N)N5}_Uzz75D1}IeJRQ5Ij=xwOL7nT@&gI?F&T-xmgWdOy$zd=yg zBABuT6KL9n?^fGerQ_X8Nlq8MJ2R$4?Yx@3IA0}A`P!0;&tJR1J?{VVNgA{IkF@;% z-uu6sYtQ&^BV0XQKHvX8MFO2$d7p$x=olg_-ld?~;mfefh21DAU&4_p*XSXntxSEF zg^Rl^IF@7UFWEA@b4vMqd?^m%+seEl5BQ*{Sd<38hyTU?fDEOo7WCoB#phki&NO8Xw#J5p zYVkaWpV|X)7s`y{q{D~bMHt8>n7UvKvLuZa>o@uo=46lThFJE5PPVIuH^ZfeldWzX z23}a@@-0-H2LslSi6&_}t`jCGb11a}GQk{bzq$K5t{K&Jm8%S{V>0n)CA#-4@TEuP zx+MO_5=!L>K_h{w7MPmQy4eC66;J3JD>?SWE!NVc76dRxta0Kk420rzEwtkB$PjH( zZ~`Y)Cai(QX&MHJYOU%kYoK02<>yL3lSTopQ=z8ln9^zL2SzYRXD0r5hyaI7#Y_M@ zn2F(ps-KQl=7nEQa8WeP$tfwxc@(q+A5ccsqtIH}piHf7nx~vqhJ;Zo2Y5(Ff}H-k zCM0PNm&C8)v4`} zt~6SjMs}`Ne!PHc!=$OfOtEPlB`yQQSXGTqaHcPV`%roK`nbAGc4Fce{g#h|Mzj9 zRq5UHe};=I;|=^*@Ztw{O4&1l5b!z)5vI+SS+40Wy;j4Q>RUvHfz=_ z0zsjxTVQBdWNch)YFcP!R$^*8+uXdQckfbj^D=AexqbW2?bmPqz=87y4*b&2uH3<4 z0fkcG;801UEu_;Id3Y>kFseK}mNOX3yuDX=d#@TbYIR`X8aBH+Ft7#-BE2p&v@Se+ z-Iy`!qoOv%#eEeWy)hwSOJd^Y@#D89CvTZJ@#~b7?ObksdV0M;uxs+X$< zDf^~QJt&tS$jdu8efr^9v%Z}<^KfBdVM$3zSy@?md3i-eMO9VR%9SfuuU@TCd|O*v zyMF!pO`A4-{q@(ocJ11?Z{L9f2M!-TTvXIpTG}*c&XIZZj+K`muc&BVxbQ?()v4vn zPcL77X3d)KYHPn+yS8=x`T-Oq>)Z32HeJ}X>EhR4U*5j``}%tDcV*9>YX=Xu9Xix@ zURB?Q`dTZfUu5 z;ljO3m+oJ=^2@br58B!u-n@D9_U+s4?T_x?zyI*z!&|pHfByOD-Mdfk-Fx=%;q%9j zA9r@X`0cmfo<4o`;>GW;UcLJL_dl_?&!5wOo78ci5yRKWP@}iSeYSC%eB(s@y5>J=?HfzoXQc(P2LQ`wa{Y zDTvjLH4F}jsyk5`U~9hIPRi0Z9X7e25qrh%n!(<&3(-XHIpzZbN=)jrevgf?4%QjS zSRRw^bd>3e8XEd9+o2%&5UV^+=muEOWKP}-3y;#O$||Os7`mhoioRRZM<|l4-#Qo= zzLa-S-;~WBOw6@yS-$t~Ig=6JD%{;HRt*l13(i{u|O6x*y zrMA6oZWas~xwd#fpL=yJV|ZiOp*p+AP=6>TW>jz!S*G?U2bT@7IAK@j8`Ck){5MYj z0>7DF{(1|@VHNf>E9{C*>?KhJI=yE6?5{VV0xcqQUotut8NOn0s%%sH##nC)Tl|w< z$_a7`hiKUHQ%!;C@kD)B#gr47z7a;YtBItR#?|^{&sIuGT?@k5TcTe*uf1f1qSmCY zvxE}tc#$xV82Il^$m^DT_A!FHAA89lpD41Trh4knw^p6XA2AuRxZB?R<)SMtKjv3l z4xT8GjAu6!DuX&oO>`yCGZtKT9mXkMARWRQM5=AvoG*6@K@QjkrM9u=c2xX|n9R6F z-!Hp0;yyAGT^MC}XD=1ab2-Gm+{Z#PcKf<}#9!{Gk>v!3fHcF30Y`{^8l1ie9k{lz z$z~LNN9j4ylET!Hl&T{$Or1ljdk?IieJdbzd1Yr4<<5;;`PD{fK;OaTdzx}?{M%cC z_~h!A5P$KoFRpoBzExHg)Mt2unSL0hsA<7kpCn{lj&3s{+pEr_)$WV0_bRFj#%|B= zIM$F9Fv0%Drj12>$?Vr5C8#8kwP2P1vuni{?qrH)6TSOqbu356Zk{`?wJ}ZMiU#&c zoW?G-bnElX(1_m0X_~BPWK^IjJNa>u$pB%Rdme=zC>zA(O)2S}Mji2Zbj7kA5ALp= z*W2IV|Fm}=P*G(2y07Zo&_E}k$vFqf&;)665@=e2ASgKrNDd0xL=jOk3Mv^1A_58m z3IZYs3KA6o8N`67qX?o1j$CloJ7>%8;cS+{?z#rjt5+7n@Bin# zzCTm+$cqumiB>p8|5eTOr)=i?mvmGI%5a%RgBp04DU)Fi=b=X$#z*lq9n7(~;frWj zkpHHS+z4BfB0rr~mW%dT-!vY#v5`a=f}Qc|l(S4gt%aTGWm?aYAR&;p@e$`V@wu+6F0;Qy7Dg@Mi#GljtHeS089D`>dCi25L25<`qIf1>sKI9nT@M^JfeL5DkoH|*A_ao5^?Ci- zE|qjtnIGD*yG@d0xQXgwWq&gN0agM@(I`WSV@|f+>NA#6ybQ@WkD|3>+u_NQxY7Piyn%(7HlIHAY5}`FYY~EY$Ic=!V>T8H%k{uXOYdIXt zj;;*s5&;OQhFDZIr~aprTKkPrN_P5l(RU?1j!Y%`%rOQjqWW-tY0)_5w@w1Ljf$Bm zS5v=ly5Ym9<_W}ShjBKLSmFu_LmED-tN$3tbi{eROfl!kyr^GM0z0Vz0h_;@n{vy3 zz3W%B8e#rUeEtEs`*VStP^hGcVQeDj(iK^9tf53TA`^@;hDjZyWAEGxgT}YO!SLl& zQEloTKlhNh-AojMc44MTKuJZXk|&a+aUvzu&>T~aS55S(RA~AXoim~b*&@?*c)jqh z`^wEes%q*Y{A`@H**IMXWmlq~Rq^VjQJZVVkFR`kNSOr$7m&6hv^?@m?;8V5d=f8r zFRV_b@YxY^bNzw|#C?kP6;YPTrLt0yA_^L4MqxEYyDlN)4H52xY6b^D-0=}8EbX)1 zTX+e~yIM#OqL-BP^io1uBi);20VSF=Ar!0tabp{mG=a+iuGsJQge6BF_B@Hm$DnfI z?v$imbT?)lNib&LlnCOrypU0YtwHVl1DDXZ4lhprEb4vVxM6V8HyI>$JTlgd6o#Sg zqD^@c$}?3Zo5`bja)Fgns$FBMwn0Z{)-W|G$=cqf5*G})QVNZxYNI;kF3UM>nikzE zWMi7I8x`dzTHdLQYJbb(Y8a!Y$9dPG(_iEv=R_JV-TvzBvC8^D1GV|O`vE6{evc`wXJUd(s};sgS_c=fG|N(`wS@+b}~k?9~LmGu5Kmy6(a{aAdJKqlgq zaY!SxAqMCgsyd?^_AQAn)LDFwC;dCUPQ*B8S-Gfl{UH0|c)2>Dtie`~w&K|R`~juy zgGTmRK&L6On}raPw4Ws*_0$dXzD9LPh_BJ88bUVAY$KldR$U5GYOL^zw;+jVA51S^ z1CkoBiLS83&$#_!4oZEXs<(%*MgkE4ufGVFpVWf_fLl3zRR}bkfCCg@1`qJh`=MR{ z2P;DOyi7z!k#@E!OUcAj)Fk8RBqI_!GSl#t8}XPRWRnKoMxfiF;gC$k;zy{qup}oI zwvt3dkQ}b-1;{;1Am#6GjPPy}1*u}#V-1L?OtJ$72I-E5bVZqFp(48wM>EM$fNu^K zX}_#Cj{{Vx`0vRj&ghTG)4~znudsFbhYdZkO4UA>AMaMf%6TXNk`0d9EdWb{qOc+o z*$}@%fLVVArGp_-BWd;PY4z0*YN`N7CY;{IlTAnYmp~H6K{>iHAKmwAv+Ro;-GXZv8YSk(X;8%iurw-+>m%aCT`YOgX_O=lkvi7*#p?BxT-hg)OlTkGFUCo)C zR4QImqAuYq=*Pb)qa76TdLxY9PfAHA+et~upc{@;RO3mX6~-rwOYuPXJtIPawLlik zVgzei3a1h%aW4+A6u|wPVWtZBxSX7?b_kfOq5}F*-plMZBfz7?-Y(NZR1Zl%d+L2y`=6(IUqtCPvZgSA=RPYIaHL%03KDIP}HWs)_nxq;KnVC z_3>28p`(m;~Vw+||%-R8=y5F9lxHTg@s2 zH=9RTOXHHM@MlIfBt4|HD-0bBbKbyaVQZPTv%IMxDWZ;QViW1GJy`f&`lTEy(vAYR zX@K#+IYJvj6b#misKBXRFq2Hz6KQ9yuysAtb;BEVBivWU-ryJ!r2pUX$M66C&t&R< z&OZL+{hzX``tRTWsWak#{!7@J+L{Nj=Ei2mz>Y<=>GmJ6wSd`YW?--r17&AG7qDYp zjWONh7jzhc1%SYy@KBnGzTiGbCqd*e00Gbd0#Mw(i+h9xTkbX9@%aMGj0^JmE002_AwX&yIn8&tG+SUP4;lVr0m$x<1{m_nv?6`Ol zL$?obTa$LQ&#zkc$2z}i%8vF74D#I8JI5UC8R)sAd$)CJWQ5nYhVI$cDUp6&QQLZA zTZ;xn1p003^_{$dUT$Fk0K@Do5BKu$-PSt|787bqGuYPJ0D!{y{6@R~M(@Nh-Z`ni zo&TmtCTj?qdPN0zg@?;gcfOK_dhSen40a2O0f1l6`3Lx&vK8DeWHm*ynwp%Fyy9;P z>c33 zTg$`WoDauNd-+WeQ9mya`JDp&3xB%8e}mubPkv`}e<_}wu^vAL73`GTPB5>Xu&lvu z9y__bYc zL#X%;5D&@&*oQ;_`tt(-Mqmb@&PCfP;9u%(5858sx$+zY7JqH`KLCHfRY=Cpzc4?a zANdSuwmVZ?BY#c%VXg-Um;g3_2yg-XfCwN7$N@@#`u6>w0vG}2+s{_EfFp1K@Bn;) zKp+%|0%C!9AO$!DWCD3WAy5od05w28&;;B7ZUNmuA8;QS0VaVNU>pu45$QZfV)8>a1TfW9YI&n2Mhuuz*sO5JOyThgM7;h%Uq^;yGdsi9~WCWso{ZYor@8 z9GQYFK-M8|Bgc?0k?SaClmJQzWsGt{1)&m9`KVe{Cu$6}h}uMB(PC&#v^Clj9fQt5 zSD@R`5795tn@l(+2__vTTPA;|c&2kq^-On}W|>x*nVE%|$;>v)e#~^{bIc9Q_n4nC zf5qT2(ij7bGbRFa22+LU!aTvOvaqm-vrt%^Si)J(u+*^JVVPrDXC<)8vzoDbvL0tW z&)UK|#`>NO%_hdC$99122wOheHMWOr@33gBIMx8`hCPNok8Q&~#;)NAI7OT_E)bWF ztHllAUgME?al8@U6Q6`H$KSy}CqM}z1OtKxA(2o)xJ!6RL=Yv2W<-DDDdH94Fmah3 z&#uC5&mPTwp1p&8o&(Au&SAz8z>&ex#PNt@gOiU_kJF3uBxgP680Qxf4~atZBBhb8 zk|s$TT!LIiT!*-_xNdMg<%V%fbK7u7aTjsl<$lLQGRSLWgs$YGJY}_WkzM;vSisH*)rM3au_*1xk$Ooa?j*BH^_ zJ)zp8`iq*nTBusR+LF4cx~uvH^~V}S4XQ@E#yv8etWQ2pzD543siqmO*`)bFOHS*M zR;|`+Z3%5J?F#MZI>I_`I;A@Ey9IZnrGo>No3uG0-%KGw3pe8k!iU84erajqHpHjpmGnjeU$S8!wxvnjAIhGKHI3m}Z$i zHsdq%Fsm_JHdi-~Gw-#)SnRbZv{=|9y(e@}yCuZZ+%m^<)=JDO$m)hQU~OidWBrsW zK@Fkav_aTVZO+@gqAAj1Y5jW%dk^ld-TT>A-!{W`#!k{M!mh`j&EDC*#{P?gp+mOA z{JvfL;`ZHliXvUzVkEiEA;#5Z|Yy{|K*VNp{he$0S*CI15tslfo(zfphH2uhxrdjA07>s2~G)~ z577+C3t0}e2)z^rhPi~bh7-3RrXEB{MkGf(i`*S~K5{+EKI&RDE;=asL5y_F$(Y3> z#z!iT!j5_z?THnNjgNg6rx#ax3_Rw3tmnAM@ucG~=_d5*c&7M6@k0p;3E2ss5*-rT zllYS8Nzao_k}s#Qri7+EKB0A@I2D%ampXh>`DDS#?`fWCgQpZu<)8YN?vXxtTJiL` z(_3e}&kSd%WfWy1GJ`T7W$9*BXXCPuWIxZb%xTFL%uUPvly@+1AYUcF_$<@eh_mzO z_MB@i5G}|o_*Up!IC)B0RPjcMU&&OdNoh-&cv*fq zqCB$vRfT;;f2Brc%_Z(jr!M_c6;w4}O{?y$QLm|~<*m)Q47nU}d8y91ZsdyLmDYN> z`qHZ$S5Gwn4G|4*8eJP7HCZ(ET+_H#e_ibQg=Ru?S_{|`)3SWS_r`pyW9w*}d0S7r zR(tbJ`I}X@gl?VhVDHH2Wa>=n+`4___F7kP*Sl_??&m!RduHzJyED;i(>r|E;_kgZ zD;?DpgGVss4;lszS{kk2dWR6hg64}ht-B#9;!cV9U+gjk7|#0j_Hnd zj~kBnO_)vGpR}4BePs7&>ap|V`6j0B^Igi% zxSub)mwbQy1Lebm<$cR9KZbtXT1j8!TCMt|@~LNyx;FPY@bl)Ev~{la>aQAK`!^gm z7B{25A-|pbMe3LK?-t)@w*t4ewq^hW0EIvx5pdM@oe7ObF=2=-7-nV+7oNaI`15EPab;pLT7my+EH2c#k(LDtbw(w0|NQQFxEh(@C^%oq|23rT6avsC(r z+3EstD1Zh8K|x^vf&-yAaH|*K-F~Kl@B9w>3kU!TgCju{WII(A3xH546at69p)lx= z2OtO(2EcI$Aw|3%k|1p3MvNCx(hn(h&uV1npp7brc5i3n1_3DeHyiym8)7?61P4GM zAPfS5{x%T@!wV_u*}w@(A*EZ>00s(fA0iY7=mMq3Rxe$3PGD{n%+o zzn%oF6>9O~*V?LgfzF;!C%HrSVIQyiM|e!=G(<^g`J}x|zSJsKKk^_>ZMa%LpHpqxCIT+{_Q zepm7E_(_)q8TA^bQ@Gi$L4b8Z#`-sYrV~N!SZnctT+;VY4^Hy}T6^li7mdE3 zRQT|+)lt!Vi&o5;D@vubiJPYzbl=>Rl~WqGe(lIQcjfcjTV5*s5kb4+CZ_imuY?$H zq&;*Uw_ks4*GXRG)v75ecbN89or|3~xQj(C?&HNQR z?+UZiEv*}l3+nP=QqH|KGPL$n@l42|i`9pzb603{`4jsFm8K7xpE|u#_aaZAXl5a& zQ=ua`R$M!T)YMrgGjW#2CV)t+f9%_S#x-cRXTkj3>%Gq;giKD;XG1Q;J{IqqwxFLG z3fKZ-=8BTJ*2D>xU$5@YRABRz2yFXF#jNJ~_5F9>khg$6nfN+ zI?Z=NRHDZ6dM5g(!&4uJ0-SWMpUOVk@9tv36nnMa{83$I!UZ>t4_%jL#b@uyzeZb| zlAvi`eF>XcE7Il-|7l2FN1|Me(xe$#o6 z?i;u_-CDag{FkLKA{uY9@a#!@`OK?N&;8(}#`9l9P^)SIMKQya>c($e=X(1_4IPeW zItc}4QXyumq0|!VkRku4P;%E$aN38qL>Y3|V^eGXuO)JBSH!0lDCkb@-gU>F?Wh`e%*i-fENO$!`M08gKM{`%-qr@kNEbsgsY{`TN#S zn`Q0VpVu<`H50nXu#BIZNqrsr^Voat)7ARRD@8)iOx2|B@(5EQcKZwODHE4TZvzj!Nb2P{o133+Z37K8 z2?%p2WSU!Dc8F`u(-C(?d){ob5XqR4kl3`dXn-^h7Y47fci+$gtD1|m9u^mZFZ8mc>t}%q*Y}@l7-91xy z!^88AAgm?}eiC`}bnlDGduGY(K3f3yBmHb+EAtb;^RHLzCPAubYjR74OoD>nvtuj~ zD~*Xjo9|M_+!H@5vRK9K(Fqd@ZQxt^g^+>rSF&nP`Nt7b<`SJm&0E)!cL7;hU7s%} z28P^Bk5PP~HY3}XvFrZ8Qa2K*ogG(w$j0ARKhon`L3sO&7j8^>th0QU|=C?+UlMw-B@A`*Qd%mnXE@wd~e@5Kk+rhOO;&yX!_w*WZ1>m%od6f z-0@1(nG7YDZ?O{S0px|x0>4}_9zZ#jemxX+WfE^|95OtcW7lFPSN-Nt?%b=G?`kz2 zz53LAJykhpN_k6|7&NRcJ6E^qyiE#6l!D@@^F~Jl2`74Hm_;)=W%kMrZ zAVj%hu)B0N*6wDJYBe!Vr-~$U`9Ty}z|E00vOaNdety+_+2qX2qJ-1@C{q=5-Zl`z2 z865oglXtWCs9)sRYbCmjzp|t`Z%S5uS>4|08C=n@G2IiKo#(->#+K$VWdROIXU>Jv zmWGdgOY8ciZjm1DTU2!JR$uI~49fk&+{H=TF^R;iNyl%x_!8$_><8y4#hgbbR&nt) zR{k1`$CX89?GBAu29I{8y_v}qwd(MXXOYfeH?_SzGJQsQ3kWAZeR_H5Da)P}g;$Un z2{Dl^z^##dH}Yuai#eWF&RHg_DN@(w-oBUqh8a2-L9O%%SbXyl_N8eTW^%ty#o13v zfqf#%FO_mjb=fDazt^%IsK|I<>*jPieWkW+%wlA0a-!Ya&OA^0QEXQYtkk`lf>o1b2IfIy_u~;+IEprz}L?j+AJ_Te%D01(6)Az zs~Bz)H>6T25N4idgZJ5b@}Iw#``7aO??3-k>(3wjS^S^h`+uq_Dl*1@|4U%_e=__( z8UCLP|Igoi|Nm!NfBxW4y8|C8bW$?*SV_u>WMhfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM82oSMKL9I 0 then + if reconnect ~= 0 then local session_id = nil - while reconnect do + while reconnect > 0 do reconnect = reconnect - 1 ssl = axtlsl.ssl_client_new(ssl_ctx, client_sock:getfd(), session_id) - res = ssl_handshake_status(ssl) + res = axtlsl.ssl_handshake_status(ssl) if res ~= axtlsl.SSL_OK then if not quiet then axtlsl.ssl_display_error(res) end axtlsl.ssl_free(ssl) @@ -444,11 +444,12 @@ function do_client(build_mode) display_session_id(ssl) session_id = axtlsl.ssl_get_session_id(ssl) - if reconnect then - ssl_free(ssl) + if reconnect > 0 then + axtlsl.ssl_free(ssl) client_sock:close() - client_sock = assert(socket.connect(host, port)) + client_sock = socket.try(socket.connect(host, port)) end + end else ssl = axtlsl.ssl_client_new(ssl_ctx, client_sock:getfd(), nil) @@ -456,7 +457,6 @@ function do_client(build_mode) -- check the return status res = axtlsl.ssl_handshake_status(ssl) -print("RES: "..res) if res ~= axtlsl.SSL_OK then if not quiet then axtlsl.ssl_display_error(res) end os.exit(1) @@ -475,9 +475,18 @@ print("RES: "..res) end while true do - local x = { 65, 66, 67, 10, 0 } local line = io.read() - res = axtlsl.ssl_write(ssl, x, #x) + if line == nil then break end + local bytes = {} + + for i = 1, #line do + bytes[i] = line.byte(line, i) + end + + bytes[#line+1] = 10 -- add carriage return, null + bytes[#line+2] = 0 + + res = axtlsl.ssl_write(ssl, bytes, #bytes) if res < axtlsl.SSL_OK then if not quiet then axtlsl.ssl_display_error(res) end break @@ -513,7 +522,7 @@ end -- function display_session_id(ssl) local session_id = axtlsl.ssl_get_session_id(ssl) - local i, v + local v print("-----BEGIN SSL SESSION PARAMETERS-----") for _, v in ipairs(session_id) do @@ -532,4 +541,5 @@ end local build_mode = axtlsl.ssl_get_config(axtlsl.SSL_BUILD_MODE) _ = arg[1] == "s_server" and do_server(build_mode) or do_client(build_mode) +os.exit(0) diff --git a/ssl/os_port.h b/ssl/os_port.h index b8042ad033..ea0e7d14ca 100644 --- a/ssl/os_port.h +++ b/ssl/os_port.h @@ -70,6 +70,8 @@ extern "C" { #define SOCKET_READ(A,B,C) recv(A,B,C,0) #define SOCKET_WRITE(A,B,C) send(A,B,C,0) #define SOCKET_CLOSE(A) closesocket(A) +#define SOCKET_BLOCK(A) u_long argp = 0; \ + ioctlsocket(A, FIONBIO, &argp) #define srandom(A) srand(A) #define random() rand() #define getpid() _getpid() @@ -139,6 +141,8 @@ EXP_FUNC int STDCALL strcasecmp(const char *s1, const char *s2); #define SOCKET_READ(A,B,C) read(A,B,C) #define SOCKET_WRITE(A,B,C) write(A,B,C) #define SOCKET_CLOSE(A) close(A) +#define SOCKET_BLOCK(A) int fd = fcntl(A, F_GETFL, NULL); \ + fcntl(A, F_SETFL, fd & ~O_NONBLOCK) #define TTY_FLUSH() #endif /* Not Win32 */ diff --git a/ssl/test/test_axssl.sh b/ssl/test/test_axssl.sh index 7628eea216..03c0b85790 100755 --- a/ssl/test/test_axssl.sh +++ b/ssl/test/test_axssl.sh @@ -30,12 +30,14 @@ if grep "CONFIG_PLATFORM_WIN32=y" "../config/.config" > /dev/null; then KILL_CSHARP="kill %1" KILL_PERL="kill %1" KILL_JAVA="kill %1" + KILL_LUA="kill %1" else if grep "CONFIG_PLATFORM_CYGWIN=y" "../config/.config" > /dev/null; then # no .net or java on cygwin PERL_BIN=/usr/bin/perl KILL_AXSSL="killall axssl" KILL_PERL="killall /usr/bin/perl" + KILL_LUA="killall /usr/local/bin/lua" else # Linux JAVA_EXE=/usr/java/default/bin/java PERL_BIN=/usr/bin/perl @@ -44,6 +46,7 @@ else KILL_PERL="killall /usr/bin/perl" RUN_CSHARP="mono" KILL_JAVA="killall $JAVA_EXE" + KILL_LUA="killall /usr/local/bin/lua" fi fi @@ -129,4 +132,18 @@ sleep 1 echo "### Perl tests complete" fi +if [ -f ./axssl.lua ]; then +echo "########################## LUA SAMPLE ###########################" +./axssl.lua $SERVER_ARGS & +echo "Lua Test passed" | ./axssl.lua $CLIENT_ARGS +$KILL_LUA +sleep 1 + +./axssl.lua $SERVER_PEM_ARGS & +echo "Lua Test passed" | ./axssl.lua $CLIENT_PEM_ARGS +$KILL_LUA +sleep 1 +echo "### Lua tests complete" +fi + echo "########################## ALL TESTS COMPLETE ###########################" diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index b9ab721a17..e732581957 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -37,8 +37,11 @@ static int send_cert_verify(SSL *ssl); */ EXP_FUNC SSL * STDCALL ssl_client_new(SSL_CTX *ssl_ctx, int client_fd, const uint8_t *session_id) { + SSL *ssl; int ret; - SSL *ssl = ssl_new(ssl_ctx, client_fd); + + SOCKET_BLOCK(client_fd); /* ensure blocking mode */ + ssl = ssl_new(ssl_ctx, client_fd); if (session_id && ssl_ctx->num_sessions) { diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index c56a9650b8..167a57d82f 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -39,7 +39,9 @@ static int process_cert_verify(SSL *ssl); */ EXP_FUNC SSL * STDCALL ssl_server_new(SSL_CTX *ssl_ctx, int client_fd) { - SSL *ssl = ssl_new(ssl_ctx, client_fd); + SSL *ssl; + + ssl = ssl_new(ssl_ctx, client_fd); ssl->next_state = HS_CLIENT_HELLO; #ifdef CONFIG_SSL_FULL_MODE diff --git a/www/index.html b/www/index.html index 989ebef0a9..1c9b86b55d 100755 --- a/www/index.html +++ b/www/index.html @@ -7086,7 +7086,7 @@
    changes, notes and errata
    -
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    !GNU LESSER GENERAL PUBLIC LICENSE\n\nVersion 2.1, February 1999\n\nCopyright (C) 1991, 1999 Free Software Foundation, Inc.\n51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA\nEveryone is permitted to copy and distribute verbatim copies\nof this license document, but changing it is not allowed.\n\n[This is the first released version of the Lesser GPL. It also counts\n as the successor of the GNU Library Public License, version 2, hence\n the version number 2.1.]\n\n!!Preamble\n\nThe licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software -to make sure the software is free for all its users.\n\nThis license, the Lesser General Public License, applies to some specially designated software packages - typically libraries - of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below.\n\nWhen we speak of free software, we are referring to freedom of use, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish); that you receive source code or can get it if you want it; that you can change the software and use pieces of it in new free programs; and that you are informed that you can do these things.\n\nTo protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library or if you modify it.\n\nFor example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights.\n\nWe protect your rights with a two-step method: (1) we copyright the library, and (2) we offer you this license, which gives you legal permission to copy, distribute and/or modify the library.\n\nTo protect each distributor, we want to make it very clear that there is no warranty for the free library. Also, if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others.\n\nFinally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license.\n\nMost GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs.\n\nWhen a program is linked with a library, whether statically or using a shared library, the combination of the two is legally speaking a combined work, a derivative of the original library. The ordinary General Public License therefore permits such linking only if the entire combination fits its criteria of freedom. The Lesser General Public License permits more lax criteria for linking other code with the library.\n\nWe call this license the "Lesser" General Public License because it does Less to protect the user's freedom than the ordinary General Public License. It also provides other free software developers Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances.\n\nFor example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License.\n\nIn other cases, permission to use a particular library in non-free programs enables a greater number of people to use a large body of free software. For example, permission to use the GNU C Library in non-free programs enables many more people to use the whole GNU operating system, as well as its variant, the GNU/Linux operating system.\n\nAlthough the Lesser General Public License is Less protective of the users' freedom, it does ensure that the user of a program that is linked with the Library has the freedom and the wherewithal to run that program using a modified version of the Library.\n\nThe precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, whereas the latter must be combined with the library in order to run.\n\n!!TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION\n\n0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you".\n\nA "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables.\n\nThe "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".)\n\n"Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library.\n\nActivities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does.\n\n1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library.\n\nYou may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.\n\n2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:\n\n * a) The modified work must itself be a software library.\n * b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change.\n * c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License.\n * d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful.\n\n (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.)\n\n These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.\n\n Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library.\n\n In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.\n\n3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices.\n\nOnce this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy.\n\nThis option is useful when you wish to copy part of the code of the Library into a program that is not a library.\n\n4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange.\n\nIf distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.\n\n5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License.\n\nHowever, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables.\n\nWhen a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law.\n\nIf such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.)\n\nOtherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself.\n\n6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications.\n\nYou must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things:\n\n * a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.)\n * b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with.\n * c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.\n * d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place.\n * e) Verify that the user has already received a copy of these materials or that you have already sent this user a copy.\n\nFor an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the materials to be distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.\n\nIt may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute.\n\n7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things:\n\n * a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above.\n * b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work.\n\n8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.\n\n9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it.\n\n10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License.\n\n11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library.\n\nIf any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances.\n\nIt is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.\n\nThis section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.\n\n12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.\n\n13. The Free Software Foundation may publish revised and/or new versions of the Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.\n\nEach version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation.\n\n14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.\n\nNO WARRANTY\n\n15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.\n\nEND OF TERMS AND CONDITIONS
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    @@ -7096,7 +7096,7 @@
    axTLS Embedded SSL
    http://axtls.cerocclub.com.au
    /***\nhttp://tiddlystyles.com/#theme:DevFire\nAuthor: Clint Checketts\n***/\n\n/*{{{*/\nbody {\nbackground: #000;\n}\n/*}}}*/\n/***\n!Link styles /% ============================================================= %/\n***/\n/*{{{*/\na,\na.button,\n#mainMenu a.button,\n#sidebarOptions .sliderPanel a{\n color: #ffbf00;\n border: 0;\n background: transparent;\n}\n\na:hover,\na.button:hover,\n#mainMenu a.button:hover,\n#sidebarOptions .sliderPanel a:hover\n#sidebarOptions .sliderPanel a:active{\n color: #ff7f00;\n border: 0;\n border-bottom: #ff7f00 1px dashed;\n background: transparent;\n text-decoration: none;\n}\n\n#displayArea .button.highlight{\n color: #ffbf00;\n background: #4c4c4c;\n}\n/*}}}*/\n/***\n!Header styles /% ============================================================= %/\n***/\n/*{{{*/\n.header{\n border-bottom: 2px solid #ffbf00;\n color: #fff;\n}\n\n.headerForeground a {\n color: #fff;\n}\n\n.header a:hover {\n border-bottom: 1px dashed #fff;\n}\n/*}}}*/\n/***\n!Main menu styles /% ============================================================= %/\n***/\n/*{{{*/\n#mainMenu {color: #fff;}\n#mainMenu h1{\n font-size: 1.1em;\n}\n#mainMenu li,#mainMenu ul{\n list-style: none;\n margin: 0;\n padding: 0;\n}\n/*}}}*/\n/***\n!Sidebar styles /% ============================================================= %/\n***/\n/*{{{*/\n#sidebar {\n right: 0;\n color: #fff;\n border: 2px solid #ffbf00;\n border-width: 0 0 2px 2px;\n}\n#sidebarOptions {\n background-color: #4c4c4c;\n padding: 0;\n}\n\n#sidebarOptions a{\n margin: 0;\n color: #ffbf00;\n border: 0;\n}\n#sidebarOptions a:hover {\n color: #4c4c4c;\n background-color: #ffbf00;\n\n}\n\n#sidebarOptions a:active {\n color: #ffbf00;\n background-color: transparent;\n}\n\n#sidebarOptions .sliderPanel {\n background-color: #333;\n margin: 0;\n}\n\n#sidebarTabs {background-color: #4c4c4c;}\n#sidebarTabs .tabSelected {\n padding: 3px 3px;\n cursor: default;\n color: #ffbf00;\n background-color: #666;\n}\n#sidebarTabs .tabUnselected {\n color: #ffbf00;\n background-color: #5f5f5f;\n padding: 0 4px;\n}\n\n#sidebarTabs .tabUnselected:hover,\n#sidebarTabs .tabContents {\n background-color: #666;\n}\n\n.listTitle{color: #FFF;}\n#sidebarTabs .tabContents a{\n color: #ffbf00;\n}\n\n#sidebarTabs .tabContents a:hover{\n color: #ff7f00;\n background: transparent;\n}\n\n#sidebarTabs .txtMoreTab .tabSelected,\n#sidebarTabs .txtMoreTab .tab:hover,\n#sidebarTabs .txtMoreTab .tabContents{\n color: #ffbf00;\n background: #4c4c4c;\n}\n\n#sidebarTabs .txtMoreTab .tabUnselected {\n color: #ffbf00;\n background: #5f5f5f;\n}\n\n.tab.tabSelected, .tab.tabSelected:hover{color: #ffbf00; border: 0; background-color: #4c4c4c;cursor:default;}\n.tab.tabUnselected {background-color: #666;}\n.tab.tabUnselected:hover{color:#ffbf00; border: 0;background-color: #4c4c4c;}\n.tabContents {\n background-color: #4c4c4c;\n border: 0;\n}\n.tabContents .tabContents{background: #666;}\n.tabContents .tabSelected{background: #666;}\n.tabContents .tabUnselected{background: #5f5f5f;}\n.tabContents .tab:hover{background: #666;}\n/*}}}*/\n/***\n!Message area styles /% ============================================================= %/\n***/\n/*{{{*/\n#messageArea {background-color: #666; color: #fff; border: 2px solid #ffbf00;}\n#messageArea a:link, #messageArea a:visited {color: #ffbf00; text-decoration:none;}\n#messageArea a:hover {color: #ff7f00;}\n#messageArea a:active {color: #ff7f00;}\n#messageArea .messageToolbar a{\n border: 1px solid #ffbf00;\n background: #4c4c4c;\n}\n/*}}}*/\n/***\n!Popup styles /% ============================================================= %/\n***/\n/*{{{*/\n.popup {color: #fff; background-color: #4c4c4c; border: 1px solid #ffbf00;}\n.popup li.disabled{color: #fff;}\n.popup a {color: #ffbf00; }\n.popup a:hover { background: transparent; color: #ff7f00; border: 0;}\n.popup hr {color: #ffbf00; background: #ffbf00;}\n/*}}}*/\n/***\n!Tiddler Display styles /% ============================================================= %/\n***/\n/*{{{*/\n.title{color: #fff;}\nh1, h2, h3, h4, h5 {\n color: #fff;\n background-color: transparent;\n border-bottom: 1px solid #333;\n}\n\n.subtitle{\n color: #666;\n}\n\n.viewer {color: #fff; }\n\n.viewer table{background: #666; color: #fff;}\n\n.viewer th {background-color: #996; color: #fff;}\n\n.viewer pre, .viewer code {color: #ddd; background-color: #4c4c4c; border: 1px solid #ffbf00;}\n\n.viewer hr {color: #666;}\n\n.tiddler .button {color: #4c4c4c;}\n.tiddler .button:hover { color: #ffbf00; background-color: #4c4c4c;}\n.tiddler .button:active {color: #ffbf00; background-color: #4c4c4c;}\n\n.toolbar {\n color: #4c4c4c;\n}\n\n.toolbar a.button,\n.toolbar a.button:hover,\n.toolbar a.button:active,\n.editorFooter a{\n border: 0;\n}\n\n.footer {\n color: #ddd;\n}\n\n.selected .footer {\n color: #888;\n}\n\n.highlight, .marked {\n color: #000;\n background-color: #ffe72f;\n}\n.editorFooter {\n color: #aaa;\n}\n\n.tab{\n-moz-border-radius-topleft: 3px;\n-moz-border-radius-topright: 3px;\n}\n\n.tagging,\n.tagged{\n background: #4c4c4c;\n border: 1px solid #4c4c4c; \n}\n\n.selected .tagging,\n.selected .tagged{\n background-color: #333;\n border: 1px solid #ffbf00;\n}\n\n.tagging .listTitle,\n.tagged .listTitle{\n color: #fff;\n}\n\n.tagging .button,\n.tagged .button{\n color: #ffbf00;\n border: 0;\n padding: 0;\n}\n\n.tagging .button:hover,\n.tagged .button:hover{\nbackground: transparent;\n}\n\n.selected .isTag .tagging.simple,\n.selected .tagged.simple,\n.isTag .tagging.simple,\n.tagged.simple {\n float: none;\n display: inline;\n border: 0;\n background: transparent;\n color: #fff;\n margin: 0;\n}\n\n.cascade {\n background: #4c4c4c;\n color: #ddd;\n border: 1px solid #ffbf00;\n}\n/*}}}*/
    -
    axhttpd is a small embedded web server using the axTLS library. It is based originally on the web server written by Doug Currie which is at http://www.hcsw.org/awhttpd.\n\n!@@bgcolor(#ff0000):color(#ffffff):axhttpd Features@@ \n\n!!__Basic Authentication__\n\nBasic Authentication uses a password file called ".htpasswd", in the directory to be protected. This file is formatted as the familiar colon-separated username/encrypted-password pair, records delimited by newlines. The protection does not carry over to subdirectories. The utility program htpasswd is included to help manually edit .htpasswd files.\n\nThe encryption of this password uses a proprietary algorithm due to the dependency of many crypt libraries on DES. An example is in [[/test_dir/no_http|https://127.0.0.1/test_dir/no_http]] (username 'abcd', password is '1234').\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__SSL Protection__\n\nDirectories/files can be accessed using the 'http' or 'https' uri prefix. If normal http access for a directory needs to be disabled, then put "~SSLRequireSSL" into a '.htaccess' file in the directory to be protected. \n\nConversely, use "~SSLDenySSL" to deny access to directories via SSL.\n\nAn example is in [[/test_dir/no_http|http://127.0.0.1/test_dir/no_http]] and [[/test_dir/no_ssl|https://127.0.0.1/test_dir/no_ssl]].\n\nEntire directories can be denied access with a "Deny all" directive (regardless of SSL or authentication). An example is in [[/test_dir/bin|http://127.0.0.1/test_dir/bin]]\n\n!!__CGI__\n\n//chroot()// is optionally now used for added security. However this has the impact of removing the regular filesystem, so any CGI applications no longer have the usual access (to things like /bin, /lib etc). Any executables and libraries need to be copied into webroot.\n\nMost of the CGI 1.1 variables are now placed into the script environment and should work as normal.\n\n!!__Lua and Lua Pages__\n\nThis is a small scripting language gaining popularity in embedded applications due to its small footprint and fast speed.\n\nLua has been incorporated into the build, so simply select it and it will automatically install. Try pointing your browser at [[/test_dir/test_variables.pl|http://127.0.0.1/test_dir/test_variables.lp]] to see an example of Lua Pages.\n\n!!__Directory Listing__\n\nAn mconf option. Allow the files in directories to be displayed. An example is in [[/test_dir|http://127.0.0.1/test_dir]]\n\n!!__Other Features__\n\n* Timeout - HTTP 1.1 allows for persistent connections. This is the time allowed for this connection in seconds.\n* Daemon - Puts the process in daemon mode. \n* SSL session cache size - The size of the session cache (a heavily loaded server should maintain many sessions). A session will save on expensive SSL handshaking.\n\n
    +
    axhttpd is a small embedded web server using the axTLS library. It is based originally on the web server written by Doug Currie which is at http://www.hcsw.org/awhttpd.\n\n!@@bgcolor(#ff0000):color(#ffffff):axhttpd Features@@ \n\n!!__Basic Authentication__\n\nBasic Authentication uses a password file called ".htpasswd", in the directory to be protected. This file is formatted as the familiar colon-separated username/encrypted-password pair, records delimited by newlines. The protection does not carry over to subdirectories. The utility program htpasswd is included to help manually edit .htpasswd files.\n\nThe encryption of this password uses a proprietary algorithm due to the dependency of many crypt libraries on DES. An example is in [[/test_dir/no_http|https://127.0.0.1/test_dir/no_http]] (username 'abcd', password is '1234').\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__SSL Protection__\n\nDirectories/files can be accessed using the 'http' or 'https' uri prefix. If normal http access for a directory needs to be disabled, then put "~SSLRequireSSL" into a '.htaccess' file in the directory to be protected. \n\nConversely, use "~SSLDenySSL" to deny access to directories via SSL.\n\nAn example is in [[/test_dir/no_http|http://127.0.0.1/test_dir/no_http]] and [[/test_dir/no_ssl|https://127.0.0.1/test_dir/no_ssl]].\n\nEntire directories can be denied access with a "Deny all" directive (regardless of SSL or authentication). An example is in [[/test_dir/bin|http://127.0.0.1/test_dir/bin]]\n\n!!__CGI__\n\n//chroot()// is optionally now used for added security. However this has the impact of removing the regular filesystem, so any CGI applications no longer have the usual access (to things like /bin, /lib etc). Any executables and libraries need to be copied into webroot.\n\nMost of the CGI 1.1 variables are now placed into the script environment and should work as normal.\n\n!!__Lua and Lua Pages__\n\nThis is a small scripting language gaining popularity in embedded applications due to its small footprint and fast speed.\n\nLua has been incorporated into the build, so simply select it and it will automatically install. Try pointing your browser at [[/test_dir/test_variables.lp|http://127.0.0.1/test_dir/test_variables.lp]] to see an example of Lua Pages.\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__Directory Listing__\n\nAn mconf option. Allow the files in directories to be displayed. An example is in [[/test_dir|http://127.0.0.1/test_dir]]\n\n!!__Other Features__\n\n* Timeout - HTTP 1.1 allows for persistent connections. This is the time allowed for this connection in seconds.\n* Daemon - Puts the process in daemon mode. \n* SSL session cache size - The size of the session cache (a heavily loaded server should maintain many sessions). A session will save on expensive SSL handshaking.\n\n
    From 4fdd6a7054e88f2a27eddc6ab7ee6716f4bbeba0 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 20 Jun 2007 23:06:49 +0000 Subject: [PATCH 092/301] some documentation updates git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@112 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- bindings/lua/Makefile | 2 +- ssl/ssl.h | 6 +++--- www/index.html | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/bindings/lua/Makefile b/bindings/lua/Makefile index f370703386..5407edf9ee 100644 --- a/bindings/lua/Makefile +++ b/bindings/lua/Makefile @@ -40,7 +40,7 @@ include ../../config/makefile.post CFLAGS += -funit-at-a-time $(TARGET) : $(OBJ) - $(LD) $(LDFLAGS) -L../../$(STAGE) -L$(CONFIG_LUA_CORE)/lib $(LDSHARED) -o $@ $(OBJ) -laxtls -llua + $(LD) $(LDFLAGS) $(LDSHARED) -o $^ -L../../$(STAGE) -L$(CONFIG_LUA_CORE)/lib -laxtls -llua CFLAGS += -I$(CONFIG_HOME) -I$(SSL_HOME) -I $(CONFIG_LUA_CORE)/include else diff --git a/ssl/ssl.h b/ssl/ssl.h index 7cdab2aa86..6622415aa0 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -31,10 +31,10 @@ * - ASN.1, X.509, PKCS#8, PKCS#12 keys/certificates with DER/PEM encoding. * - Highly configurable compile time options. * - Portable across many platforms (written in ANSI C), and has language - * bindings in C, C#, VB.NET, Java and Perl. + * bindings in C, C#, VB.NET, Java, Perl and Lua. * - Partial openssl API compatibility (via a wrapper). - * - A very small footprint for a HTTPS server (around 60-70kB in 'server-only' - * mode). + * - A very small footprint (around 50-60kB for the library in 'server-only' + * mode). * - No dependencies on sockets - can use serial connections for example. * - A very simple API - ~ 20 functions/methods. * diff --git a/www/index.html b/www/index.html index 1c9b86b55d..3402da7b2d 100755 --- a/www/index.html +++ b/www/index.html @@ -7091,7 +7091,7 @@
    !GNU LESSER GENERAL PUBLIC LICENSE\n\nVersion 2.1, February 1999\n\nCopyright (C) 1991, 1999 Free Software Foundation, Inc.\n51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA\nEveryone is permitted to copy and distribute verbatim copies\nof this license document, but changing it is not allowed.\n\n[This is the first released version of the Lesser GPL. It also counts\n as the successor of the GNU Library Public License, version 2, hence\n the version number 2.1.]\n\n!!Preamble\n\nThe licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software -to make sure the software is free for all its users.\n\nThis license, the Lesser General Public License, applies to some specially designated software packages - typically libraries - of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below.\n\nWhen we speak of free software, we are referring to freedom of use, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish); that you receive source code or can get it if you want it; that you can change the software and use pieces of it in new free programs; and that you are informed that you can do these things.\n\nTo protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library or if you modify it.\n\nFor example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights.\n\nWe protect your rights with a two-step method: (1) we copyright the library, and (2) we offer you this license, which gives you legal permission to copy, distribute and/or modify the library.\n\nTo protect each distributor, we want to make it very clear that there is no warranty for the free library. Also, if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others.\n\nFinally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license.\n\nMost GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs.\n\nWhen a program is linked with a library, whether statically or using a shared library, the combination of the two is legally speaking a combined work, a derivative of the original library. The ordinary General Public License therefore permits such linking only if the entire combination fits its criteria of freedom. The Lesser General Public License permits more lax criteria for linking other code with the library.\n\nWe call this license the "Lesser" General Public License because it does Less to protect the user's freedom than the ordinary General Public License. It also provides other free software developers Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances.\n\nFor example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License.\n\nIn other cases, permission to use a particular library in non-free programs enables a greater number of people to use a large body of free software. For example, permission to use the GNU C Library in non-free programs enables many more people to use the whole GNU operating system, as well as its variant, the GNU/Linux operating system.\n\nAlthough the Lesser General Public License is Less protective of the users' freedom, it does ensure that the user of a program that is linked with the Library has the freedom and the wherewithal to run that program using a modified version of the Library.\n\nThe precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, whereas the latter must be combined with the library in order to run.\n\n!!TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION\n\n0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you".\n\nA "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables.\n\nThe "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".)\n\n"Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library.\n\nActivities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does.\n\n1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library.\n\nYou may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.\n\n2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:\n\n * a) The modified work must itself be a software library.\n * b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change.\n * c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License.\n * d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful.\n\n (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.)\n\n These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.\n\n Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library.\n\n In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.\n\n3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices.\n\nOnce this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy.\n\nThis option is useful when you wish to copy part of the code of the Library into a program that is not a library.\n\n4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange.\n\nIf distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.\n\n5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License.\n\nHowever, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables.\n\nWhen a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law.\n\nIf such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.)\n\nOtherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself.\n\n6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications.\n\nYou must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things:\n\n * a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.)\n * b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with.\n * c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.\n * d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place.\n * e) Verify that the user has already received a copy of these materials or that you have already sent this user a copy.\n\nFor an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the materials to be distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.\n\nIt may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute.\n\n7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things:\n\n * a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above.\n * b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work.\n\n8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.\n\n9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it.\n\n10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License.\n\n11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library.\n\nIf any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances.\n\nIt is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.\n\nThis section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.\n\n12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.\n\n13. The Free Software Foundation may publish revised and/or new versions of the Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.\n\nEach version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation.\n\n14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.\n\nNO WARRANTY\n\n15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.\n\nEND OF TERMS AND CONDITIONS
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    <div class='header' macro='gradient vert #390108 #900'>\n<div class='headerShadow'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n<div class='headerForeground'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n</div>\n<div id='mainMenu'>\n<div refresh='content' tiddler='MainMenu'></div>\n</div>\n<div id='sidebar'>\n<div id='sidebarOptions' refresh='content' tiddler='SideBarOptions'></div>\n<div id='sidebarTabs' refresh='content' force='true' tiddler='SideBarTabs'></div>\n</div>\n<div id='displayArea'>\n<div id='messageArea'></div>\n<div id='tiddlerDisplay'></div>\n</div>
    -
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* The test harness appears to be broken under ~VC8.0. Debugging shows a problem in the _close() function which is weird. CGI is also broken under ~VC8.0.\n* CGI works under Win32, but needs some more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    +
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n* axssl.lua - Lua sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!!!!Lua\n\n{{indent{{{{> [lua] ./axssl.lua <options>}}}\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* The test harness appears to be broken under ~VC8.0. Debugging shows a problem in the _close() function which is weird. CGI is also broken under ~VC8.0.\n* CGI works under Win32, but needs some more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    changes, notes and errata
    axTLS Embedded SSL
    http://axtls.cerocclub.com.au
    From a1bfbe6b07c1d13f3e177c1363d28183061b3323 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 17 Aug 2007 04:08:39 +0000 Subject: [PATCH 093/301] lua samples now work again git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@114 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- bindings/lua/Makefile | 2 +- www/index.html | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/bindings/lua/Makefile b/bindings/lua/Makefile index 5407edf9ee..30a5e92319 100644 --- a/bindings/lua/Makefile +++ b/bindings/lua/Makefile @@ -40,7 +40,7 @@ include ../../config/makefile.post CFLAGS += -funit-at-a-time $(TARGET) : $(OBJ) - $(LD) $(LDFLAGS) $(LDSHARED) -o $^ -L../../$(STAGE) -L$(CONFIG_LUA_CORE)/lib -laxtls -llua + $(LD) $(LDFLAGS) $(LDSHARED) -o $@ $^ -L../../$(STAGE) -L$(CONFIG_LUA_CORE)/lib -laxtls -llua CFLAGS += -I$(CONFIG_HOME) -I$(SSL_HOME) -I $(CONFIG_LUA_CORE)/include else diff --git a/www/index.html b/www/index.html index 3402da7b2d..cd563d14d3 100755 --- a/www/index.html +++ b/www/index.html @@ -7091,7 +7091,7 @@
    !GNU LESSER GENERAL PUBLIC LICENSE\n\nVersion 2.1, February 1999\n\nCopyright (C) 1991, 1999 Free Software Foundation, Inc.\n51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA\nEveryone is permitted to copy and distribute verbatim copies\nof this license document, but changing it is not allowed.\n\n[This is the first released version of the Lesser GPL. It also counts\n as the successor of the GNU Library Public License, version 2, hence\n the version number 2.1.]\n\n!!Preamble\n\nThe licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software -to make sure the software is free for all its users.\n\nThis license, the Lesser General Public License, applies to some specially designated software packages - typically libraries - of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below.\n\nWhen we speak of free software, we are referring to freedom of use, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish); that you receive source code or can get it if you want it; that you can change the software and use pieces of it in new free programs; and that you are informed that you can do these things.\n\nTo protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library or if you modify it.\n\nFor example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights.\n\nWe protect your rights with a two-step method: (1) we copyright the library, and (2) we offer you this license, which gives you legal permission to copy, distribute and/or modify the library.\n\nTo protect each distributor, we want to make it very clear that there is no warranty for the free library. Also, if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others.\n\nFinally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license.\n\nMost GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs.\n\nWhen a program is linked with a library, whether statically or using a shared library, the combination of the two is legally speaking a combined work, a derivative of the original library. The ordinary General Public License therefore permits such linking only if the entire combination fits its criteria of freedom. The Lesser General Public License permits more lax criteria for linking other code with the library.\n\nWe call this license the "Lesser" General Public License because it does Less to protect the user's freedom than the ordinary General Public License. It also provides other free software developers Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances.\n\nFor example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License.\n\nIn other cases, permission to use a particular library in non-free programs enables a greater number of people to use a large body of free software. For example, permission to use the GNU C Library in non-free programs enables many more people to use the whole GNU operating system, as well as its variant, the GNU/Linux operating system.\n\nAlthough the Lesser General Public License is Less protective of the users' freedom, it does ensure that the user of a program that is linked with the Library has the freedom and the wherewithal to run that program using a modified version of the Library.\n\nThe precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, whereas the latter must be combined with the library in order to run.\n\n!!TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION\n\n0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you".\n\nA "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables.\n\nThe "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".)\n\n"Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library.\n\nActivities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does.\n\n1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library.\n\nYou may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.\n\n2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:\n\n * a) The modified work must itself be a software library.\n * b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change.\n * c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License.\n * d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful.\n\n (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.)\n\n These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.\n\n Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library.\n\n In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.\n\n3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices.\n\nOnce this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy.\n\nThis option is useful when you wish to copy part of the code of the Library into a program that is not a library.\n\n4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange.\n\nIf distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.\n\n5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License.\n\nHowever, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables.\n\nWhen a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law.\n\nIf such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.)\n\nOtherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself.\n\n6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications.\n\nYou must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things:\n\n * a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.)\n * b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with.\n * c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.\n * d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place.\n * e) Verify that the user has already received a copy of these materials or that you have already sent this user a copy.\n\nFor an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the materials to be distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.\n\nIt may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute.\n\n7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things:\n\n * a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above.\n * b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work.\n\n8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.\n\n9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it.\n\n10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License.\n\n11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library.\n\nIf any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances.\n\nIt is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.\n\nThis section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.\n\n12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.\n\n13. The Free Software Foundation may publish revised and/or new versions of the Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.\n\nEach version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation.\n\n14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.\n\nNO WARRANTY\n\n15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.\n\nEND OF TERMS AND CONDITIONS
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    <div class='header' macro='gradient vert #390108 #900'>\n<div class='headerShadow'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n<div class='headerForeground'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n</div>\n<div id='mainMenu'>\n<div refresh='content' tiddler='MainMenu'></div>\n</div>\n<div id='sidebar'>\n<div id='sidebarOptions' refresh='content' tiddler='SideBarOptions'></div>\n<div id='sidebarTabs' refresh='content' force='true' tiddler='SideBarTabs'></div>\n</div>\n<div id='displayArea'>\n<div id='messageArea'></div>\n<div id='tiddlerDisplay'></div>\n</div>
    -
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n* axssl.lua - Lua sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!!!!Lua\n\n{{indent{{{{> [lua] ./axssl.lua <options>}}}\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* The test harness appears to be broken under ~VC8.0. Debugging shows a problem in the _close() function which is weird. CGI is also broken under ~VC8.0.\n* CGI works under Win32, but needs some more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    +
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n* axssl.lua - Lua sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!!!!Lua\n\n{{indent{{{{> [lua] ./axssl.lua <options>}}}\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n* The lua sample requires the luabit library from http://luaforge.net/projects/bit.\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* The test harness appears to be broken under ~VC8.0. Debugging shows a problem in the _close() function which is weird. CGI is also broken under ~VC8.0.\n* CGI works under Win32, but needs some more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    changes, notes and errata
    axTLS Embedded SSL
    http://axtls.cerocclub.com.au
    From f9ee197cffc36911c56c808fb4c46b0581b59e56 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 29 Aug 2007 09:15:39 +0000 Subject: [PATCH 094/301] dir changes - things are broken at the moment git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@116 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 2 + bindings/csharp/axTLS.cs | 8 +- bindings/java/Makefile | 33 +-- bindings/lua/Makefile | 24 +-- bindings/perl/Makefile | 30 ++- bindings/vbnet/axTLSvb.vb | 12 +- config/makefile.conf | 2 +- crypto/Makefile | 33 +++ {ssl => crypto}/aes.c | 0 crypto/crypto.h | 129 ++++++++++++ {ssl => crypto}/hmac.c | 32 +-- {ssl => crypto}/md5.c | 10 +- {ssl => crypto}/rc4.c | 0 {ssl => crypto}/sha1.c | 6 +- docsrc/axTLS.dox | 2 +- httpd/Makefile | 2 +- httpd/htpasswd.c | 8 +- httpd/proc.c | 8 +- samples/c/Makefile | 2 +- samples/c/axssl.c | 8 +- samples/csharp/axssl.cs | 3 +- samples/lua/axssl.lua | 7 +- samples/perl/axssl.pl | 7 +- ssl/Makefile | 13 +- ssl/asn1.c | 425 +------------------------------------- ssl/bigint.c | 44 +++- ssl/bigint.h | 7 + ssl/crypto.h | 285 ------------------------- ssl/crypto_misc.c | 2 +- ssl/loader.c | 18 +- ssl/p12.c | 14 +- ssl/rsa.c | 42 +--- ssl/ssl.h | 14 +- ssl/test/Makefile | 2 +- ssl/test/ssltest.c | 30 +-- ssl/tls1.c | 24 ++- ssl/tls1.h | 3 + ssl/tls1_clnt.c | 38 +++- ssl/tls1_svr.c | 2 + www/index.html | 2 +- 40 files changed, 432 insertions(+), 901 deletions(-) create mode 100644 crypto/Makefile rename {ssl => crypto}/aes.c (100%) create mode 100644 crypto/crypto.h rename {ssl => crypto}/hmac.c (76%) rename {ssl => crypto}/md5.c (97%) rename {ssl => crypto}/rc4.c (100%) rename {ssl => crypto}/sha1.c (97%) delete mode 100644 ssl/crypto.h diff --git a/Makefile b/Makefile index 568770c1e6..01c2219d87 100644 --- a/Makefile +++ b/Makefile @@ -33,6 +33,7 @@ RELEASE=axTLS-$(VERSION) # standard version target: + $(MAKE) -C crypto $(MAKE) -C ssl ifdef CONFIG_AXHTTPD $(MAKE) -C httpd @@ -100,6 +101,7 @@ test: # tidy up things clean:: + @cd crypto; $(MAKE) clean @cd ssl; $(MAKE) clean @cd httpd; $(MAKE) clean @cd samples; $(MAKE) clean diff --git a/bindings/csharp/axTLS.cs b/bindings/csharp/axTLS.cs index a59209168d..a3146f16db 100644 --- a/bindings/csharp/axTLS.cs +++ b/bindings/csharp/axTLS.cs @@ -95,9 +95,10 @@ public byte GetCipherId() */ public byte[] GetSessionId() { - byte[] result = new byte[axtls.SSL_SESSION_ID_SIZE]; IntPtr ptr = axtls.ssl_get_session_id(m_ssl); - Marshal.Copy(ptr, result, 0, axtls.SSL_SESSION_ID_SIZE); + byte sess_id_size = axtls.ssl_get_session_id_size(m_ssl); + byte[] result = new byte[sess_id_size]; + Marshal.Copy(ptr, result, 0, sess_id_size); return result; } @@ -470,7 +471,8 @@ public SSLClient(uint options, int num_sessions) : public SSL Connect(Socket s, byte[] session_id) { int client_fd = s.Handle.ToInt32(); - return new SSL(axtls. ssl_client_new(m_ctx, client_fd, session_id)); + return new SSL(axtls. ssl_client_new(m_ctx, client_fd, session_id, + session_id ? null : session_id.Length)); } } } diff --git a/bindings/java/Makefile b/bindings/java/Makefile index 59aa6203b9..0c58c1e7f8 100644 --- a/bindings/java/Makefile +++ b/bindings/java/Makefile @@ -16,18 +16,20 @@ # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # -include ../../config/.config -include ../../config/makefile.conf -include ../../config/makefile.java.conf +AXTLS_HOME=../.. + +include $(AXTLS_HOME)/config/.config +include $(AXTLS_HOME)/config/makefile.conf +include $(AXTLS_HOME)/config/makefile.java.conf all: lib jar -JAR=../../$(STAGE)/axtls.jar +JAR=$(AXTLS_HOME)/$(STAGE)/axtls.jar ifdef CONFIG_PLATFORM_WIN32 -TARGET=../../$(STAGE)/axtlsj.dll +TARGET=$(AXTLS_HOME)/$(STAGE)/axtlsj.dll else -TARGET=../../$(STAGE)/libaxtlsj.so +TARGET=$(AXTLS_HOME)/$(STAGE)/libaxtlsj.so endif lib: $(TARGET) @@ -46,32 +48,19 @@ JAVA_FILES= \ OBJ=axTLSj_wrap.o -AXTLS_HOME=../.. -SSL_HOME=$(AXTLS_HOME)/ssl -CONFIG_HOME=$(AXTLS_HOME)/config JAVA_CLASSES:=$(JAVA_FILES:%.java=classes/axTLSj/%.class) ifdef CONFIG_PLATFORM_WIN32 -CFLAGS += /I"$(shell cygpath -w $(SSL_HOME))" -CFLAGS += /I"$(shell cygpath -w $(CONFIG_HOME))" -LDFLAGS += axtls.lib /libpath:"../../$(STAGE)" +LDFLAGS += axtls.lib /libpath:"$(AXTLS_HOME)/$(STAGE)" -include ../../config/makefile.post +include $(AXTLS_HOME)/config/makefile.post $(TARGET) : $(OBJ) $(LD) $(LDFLAGS) $(LDSHARED) /out:$@ $(OBJ) else # Not Win32 -ifdef CONFIG_PLATFORM_CYGWIN -SSL_HOME:=$(shell cygpath -u $(SSL_HOME)) -CONFIG_HOME:=$(shell cygpath -u $(CONFIG_HOME)) -endif - -CFLAGS += -I$(SSL_HOME) -CFLAGS += -I$(CONFIG_HOME) - $(TARGET) : $(OBJ) - $(LD) $(LDFLAGS) -L ../../$(STAGE) $(LDSHARED) -o $@ $(OBJ) -laxtls + $(LD) $(LDFLAGS) -L $(AXTLS_HOME)/$(STAGE) $(LDSHARED) -o $@ $(OBJ) -laxtls endif jar: $(OBJ) $(JAR) diff --git a/bindings/lua/Makefile b/bindings/lua/Makefile index 30a5e92319..617a0eb899 100644 --- a/bindings/lua/Makefile +++ b/bindings/lua/Makefile @@ -16,36 +16,36 @@ # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # -include ../../config/.config -include ../../config/makefile.conf +AXTLS_HOME=../.. + +include $(AXTLS_HOME)/config/.config +include $(AXTLS_HOME)/config/makefile.conf all: lib + ifdef CONFIG_PLATFORM_WIN32 -TARGET=../../$(STAGE)/axtlsl.dll +TARGET=$(AXTLS_HOME)/$(STAGE)/axtlsl.dll else -TARGET=../../$(STAGE)/axtlsl.so +TARGET=$(AXTLS_HOME)/$(STAGE)/axtlsl.so endif ifneq ($(MAKECMDGOALS), clean) lib: $(TARGET) -AXTLS_HOME=../.. -SSL_HOME=$(AXTLS_HOME)/ssl -CONFIG_HOME=$(AXTLS_HOME)/config OBJ:=axTLSl_wrap.o -include ../../config/makefile.post +include $(AXTLS_HOME)/config/makefile.post # there are a few static functions that aren't used CFLAGS += -funit-at-a-time $(TARGET) : $(OBJ) - $(LD) $(LDFLAGS) $(LDSHARED) -o $@ $^ -L../../$(STAGE) -L$(CONFIG_LUA_CORE)/lib -laxtls -llua + $(LD) $(LDFLAGS) $(LDSHARED) -o $@ $^ -L$(AXTLS_HOME)/$(STAGE) -L$(CONFIG_LUA_CORE)/lib -laxtls -llua -CFLAGS += -I$(CONFIG_HOME) -I$(SSL_HOME) -I $(CONFIG_LUA_CORE)/include +CFLAGS += -I $(CONFIG_LUA_CORE)/include else -CFLAGS += /I"`cygpath -w $(CONFIG_HOME)`" /I"`cygpath -w $(SSL_HOME)`" /I"`cygpath -w $(CONFIG_LUA_CORE)/include`" -LDFLAGS += axtls.lib /libpath:"../../$(STAGE)" +CFLAGS += /I"`cygpath -w $(CONFIG_LUA_CORE)/include`" +LDFLAGS += axtls.lib /libpath:"$(AXTLS_HOME)/$(STAGE)" $(TARGET) : $(OBJ) $(LD) $(LDFLAGS) $(LDSHARED) /out:$@ $(OBJ) diff --git a/bindings/perl/Makefile b/bindings/perl/Makefile index 71c4055108..3f5b15e7de 100644 --- a/bindings/perl/Makefile +++ b/bindings/perl/Makefile @@ -16,15 +16,17 @@ # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # -include ../../config/.config -include ../../config/makefile.conf +AXTLS_HOME=../.. + +include $(AXTLS_HOME)/config/.config +include $(AXTLS_HOME)/config/makefile.conf all: lib ifdef CONFIG_PLATFORM_WIN32 -TARGET=../../$(STAGE)/axtlsp.dll +TARGET=$(AXTLS_HOME)/$(STAGE)/axtlsp.dll else -TARGET=../../$(STAGE)/libaxtlsp.so +TARGET=$(AXTLS_HOME)/$(STAGE)/libaxtlsp.so endif ifneq ($(MAKECMDGOALS), clean) @@ -46,11 +48,8 @@ test_perl: endif lib: $(TARGET) -AXTLS_HOME=../.. -SSL_HOME=$(AXTLS_HOME)/ssl -CONFIG_HOME=$(AXTLS_HOME)/config OBJ:=axTLSp_wrap.o -include ../../config/makefile.post +include $(AXTLS_HOME)/config/makefile.post ifndef CONFIG_PLATFORM_WIN32 # Linux/Unix/Cygwin @@ -60,22 +59,21 @@ ifndef CONFIG_PLATFORM_WIN32 # Linux/Unix/Cygwin # work. # $(TARGET) : $(OBJ) - $(LD) $(LDFLAGS) -L ../../$(STAGE) -L$(PERL5_CORE) $(LDSHARED) -o $@ $(OBJ) -laxtls -lperl + $(LD) $(LDFLAGS) -L$(AXTLS_HOME)/$(STAGE) -L$(PERL5_CORE) $(LDSHARED) -o $@ $(OBJ) -laxtls -lperl ifdef CONFIG_PLATFORM_CYGWIN - cd ../../$(STAGE); ln -sf $(notdir $@) axtlsp.dll + cd $(AXTLS_HOME)/$(STAGE); ln -sf $(notdir $@) axtlsp.dll endif - @install axtlsp.pm ../../$(STAGE) + @install axtlsp.pm $(AXTLS_HOME)/$(STAGE) -CFLAGS += -D_GNU_SOURCE -I$(CONFIG_HOME) -I$(SSL_HOME) -I$(PERL5_CORE) +CFLAGS += -D_GNU_SOURCE -I$(PERL5_CORE) else -CFLAGS += /I"`cygpath -w $(CONFIG_HOME)`" /I"`cygpath -w $(SSL_HOME)`" CFLAGS += /I"$(PERL5_CORE)" -LDFLAGS += $(CONFIG_PERL_LIB) /libpath:"$(PERL5_CORE)" axtls.lib /libpath:"../../$(STAGE)" +LDFLAGS += $(CONFIG_PERL_LIB) /libpath:"$(PERL5_CORE)" axtls.lib /libpath:"$(AXTLS_HOME)/$(STAGE)" $(TARGET) : $(OBJ) $(LD) $(LDFLAGS) $(LDSHARED) /out:$@ $(OBJ) - install axtlsp.pm ../../$(STAGE) + install axtlsp.pm $(AXTLS_HOME)/$(STAGE) endif # WIN32 clean:: - @rm -f $(TARGET) axtls* *.i axTLSp* *.c .depend ../../$(STAGE)/axtlsp.pm + @rm -f $(TARGET) axtls* *.i axTLSp* *.c .depend $(AXTLS_HOME)/$(STAGE)/axtlsp.pm diff --git a/bindings/vbnet/axTLSvb.vb b/bindings/vbnet/axTLSvb.vb index 9cec32c789..32f126321e 100644 --- a/bindings/vbnet/axTLSvb.vb +++ b/bindings/vbnet/axTLSvb.vb @@ -46,9 +46,11 @@ Namespace axTLSvb End Function Public Function GetSessionId() As Byte() - Dim result(axtls.SSL_SESSION_ID_SIZE) As Byte Dim ptr As IntPtr = axtls.ssl_get_session_id(m_ssl) - Marshal.Copy(ptr, result, 0, axtls.SSL_SESSION_ID_SIZE) + Dim sess_id_size As Integer = axtls.ssl_get_session_id_size(m_ssl) + + Dim result(sess_id_size) As Byte + Marshal.Copy(ptr, result, 0, sess_id_size) Return result End Function @@ -170,9 +172,11 @@ Namespace axTLSvb End Sub Public Function Connect(ByVal s As Socket, _ - ByVal session_id As Byte()) As SSL + ByVal session_id As Byte(), _ + ByVal sess_id_size As Integer) As SSL Dim client_fd As Integer = s.Handle.ToInt32() - Return New SSL( axtls.ssl_client_new(m_ctx, client_fd, session_id)) + Return New SSL( axtls.ssl_client_new(m_ctx, client_fd, session_id, _ + sess_id_size)) End Function End Class diff --git a/config/makefile.conf b/config/makefile.conf index 829d3bf345..4844e3e5f1 100644 --- a/config/makefile.conf +++ b/config/makefile.conf @@ -71,7 +71,7 @@ else # Not Win32 -include .depend -CFLAGS += -I../config +CFLAGS += -I$(AXTLS_HOME)/config -I$(AXTLS_HOME)/ssl -I$(AXTLS_HOME)/crypto LD=$(CC) # Solaris diff --git a/crypto/Makefile b/crypto/Makefile new file mode 100644 index 0000000000..c824facc92 --- /dev/null +++ b/crypto/Makefile @@ -0,0 +1,33 @@ +# +# Copyright(C) 2007 Cameron Rich +# +# This library is free software; you can redistribute it and/or modify +# it under the terms of the GNU Lesser General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with this library; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +include ../config/.config +include ../config/makefile.conf + +AXTLS_HOME=.. + +OBJ=\ + aes.o \ + hmac.o \ + md5.o \ + rc4.o \ + sha1.o + +all: $(OBJ) + +include ../config/makefile.post diff --git a/ssl/aes.c b/crypto/aes.c similarity index 100% rename from ssl/aes.c rename to crypto/aes.c diff --git a/crypto/crypto.h b/crypto/crypto.h new file mode 100644 index 0000000000..ad49646c09 --- /dev/null +++ b/crypto/crypto.h @@ -0,0 +1,129 @@ +/* + * Copyright(C) 2006 Cameron Rich + * + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file crypto.h + */ + +#ifndef HEADER_CRYPTO_H +#define HEADER_CRYPTO_H + +#ifdef __cplusplus +extern "C" { +#endif + +#include "os_port.h" + +/************************************************************************** + * AES declarations + **************************************************************************/ + +#define AES_MAXROUNDS 14 +#define AES_BLOCKSIZE 16 +#define AES_IV_SIZE 16 + +typedef struct aes_key_st +{ + uint16_t rounds; + uint16_t key_size; + uint32_t ks[(AES_MAXROUNDS+1)*8]; + uint8_t iv[AES_IV_SIZE]; +} AES_CTX; + +typedef enum +{ + AES_MODE_128, + AES_MODE_256 +} AES_MODE; + +void AES_set_key(AES_CTX *ctx, const uint8_t *key, + const uint8_t *iv, AES_MODE mode); +void AES_cbc_encrypt(AES_CTX *ctx, const uint8_t *msg, + uint8_t *out, int length); +void AES_cbc_decrypt(AES_CTX *ks, const uint8_t *in, uint8_t *out, int length); +void AES_convert_key(AES_CTX *ctx); + +/************************************************************************** + * RC4 declarations + **************************************************************************/ + +typedef struct +{ + uint8_t x, y, m[256]; +} RC4_CTX; + +void RC4_setup(RC4_CTX *s, const uint8_t *key, int length); +void RC4_crypt(RC4_CTX *s, const uint8_t *msg, uint8_t *data, int length); + +/************************************************************************** + * SHA1 declarations + **************************************************************************/ + +#define SHA1_SIZE 20 + +/* + * This structure will hold context information for the SHA-1 + * hashing operation + */ +typedef struct +{ + uint32_t Intermediate_Hash[SHA1_SIZE/4]; /* Message Digest */ + uint32_t Length_Low; /* Message length in bits */ + uint32_t Length_High; /* Message length in bits */ + uint16_t Message_Block_Index; /* Index into message block array */ + uint8_t Message_Block[64]; /* 512-bit message blocks */ +} SHA1_CTX; + +void SHA1_Init(SHA1_CTX *); +void SHA1_Update(SHA1_CTX *, const uint8_t * msg, int len); +void SHA1_Final(uint8_t *digest, SHA1_CTX *); + +/************************************************************************** + * MD5 declarations + **************************************************************************/ + +/* MD5 context. */ + +#define MD5_SIZE 16 + +typedef struct +{ + uint32_t state[4]; /* state (ABCD) */ + uint32_t count[2]; /* number of bits, modulo 2^64 (lsb first) */ + uint8_t buffer[64]; /* input buffer */ +} MD5_CTX; + +EXP_FUNC void STDCALL MD5_Init(MD5_CTX *); +EXP_FUNC void STDCALL MD5_Update(MD5_CTX *, const uint8_t *msg, int len); +EXP_FUNC void STDCALL MD5_Final(uint8_t *digest, MD5_CTX *); + +/************************************************************************** + * HMAC declarations + **************************************************************************/ +void hmac_md5(const uint8_t *msg, int length, const uint8_t *key, + int key_len, uint8_t *digest); +void hmac_sha1(const uint8_t *msg, int length, const uint8_t *key, + int key_len, uint8_t *digest); + + + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/ssl/hmac.c b/crypto/hmac.c similarity index 76% rename from ssl/hmac.c rename to crypto/hmac.c index 8ac6ad3c1c..880a21c059 100644 --- a/ssl/hmac.c +++ b/crypto/hmac.c @@ -45,14 +45,14 @@ void hmac_md5(const uint8_t *msg, int length, const uint8_t *key, k_opad[i] ^= 0x5c; } - MD5Init(&context); - MD5Update(&context, k_ipad, 64); - MD5Update(&context, msg, length); - MD5Final(&context, digest); - MD5Init(&context); - MD5Update(&context, k_opad, 64); - MD5Update(&context, digest, MD5_SIZE); - MD5Final(&context, digest); + MD5_Init(&context); + MD5_Update(&context, k_ipad, 64); + MD5_Update(&context, msg, length); + MD5_Final(digest, &context); + MD5_Init(&context); + MD5_Update(&context, k_opad, 64); + MD5_Update(&context, digest, MD5_SIZE); + MD5_Final(digest, &context); } /** @@ -77,12 +77,12 @@ void hmac_sha1(const uint8_t *msg, int length, const uint8_t *key, k_opad[i] ^= 0x5c; } - SHA1Init(&context); - SHA1Update(&context, k_ipad, 64); - SHA1Update(&context, msg, length); - SHA1Final(&context, digest); - SHA1Init(&context); - SHA1Update(&context, k_opad, 64); - SHA1Update(&context, digest, SHA1_SIZE); - SHA1Final(&context, digest); + SHA1_Init(&context); + SHA1_Update(&context, k_ipad, 64); + SHA1_Update(&context, msg, length); + SHA1_Final(digest, &context); + SHA1_Init(&context); + SHA1_Update(&context, k_opad, 64); + SHA1_Update(&context, digest, SHA1_SIZE); + SHA1_Final(digest, &context); } diff --git a/ssl/md5.c b/crypto/md5.c similarity index 97% rename from ssl/md5.c rename to crypto/md5.c index 39272d9981..caf21aa63a 100644 --- a/ssl/md5.c +++ b/crypto/md5.c @@ -90,7 +90,7 @@ static const uint8_t PADDING[64] = /** * MD5 initialization - begins an MD5 operation, writing a new ctx. */ -EXP_FUNC void STDCALL MD5Init(MD5_CTX *ctx) +EXP_FUNC void STDCALL MD5_Init(MD5_CTX *ctx) { ctx->count[0] = ctx->count[1] = 0; @@ -105,7 +105,7 @@ EXP_FUNC void STDCALL MD5Init(MD5_CTX *ctx) /** * Accepts an array of octets as the next portion of the message. */ -EXP_FUNC void STDCALL MD5Update(MD5_CTX *ctx, const uint8_t * msg, int len) +EXP_FUNC void STDCALL MD5_Update(MD5_CTX *ctx, const uint8_t * msg, int len) { uint32_t x; int i, partLen; @@ -141,7 +141,7 @@ EXP_FUNC void STDCALL MD5Update(MD5_CTX *ctx, const uint8_t * msg, int len) /** * Return the 128-bit message digest into the user's array */ -EXP_FUNC void STDCALL MD5Final(MD5_CTX *ctx, uint8_t *digest) +EXP_FUNC void STDCALL MD5_Final(uint8_t *digest, MD5_CTX *ctx) { uint8_t bits[8]; uint32_t x, padLen; @@ -153,10 +153,10 @@ EXP_FUNC void STDCALL MD5Final(MD5_CTX *ctx, uint8_t *digest) */ x = (uint32_t)((ctx->count[0] >> 3) & 0x3f); padLen = (x < 56) ? (56 - x) : (120 - x); - MD5Update(ctx, PADDING, padLen); + MD5_Update(ctx, PADDING, padLen); /* Append length (before padding) */ - MD5Update(ctx, bits, 8); + MD5_Update(ctx, bits, 8); /* Store state in digest */ Encode(digest, ctx->state, MD5_SIZE); diff --git a/ssl/rc4.c b/crypto/rc4.c similarity index 100% rename from ssl/rc4.c rename to crypto/rc4.c diff --git a/ssl/sha1.c b/crypto/sha1.c similarity index 97% rename from ssl/sha1.c rename to crypto/sha1.c index 3feb6d54c3..69110d4879 100644 --- a/ssl/sha1.c +++ b/crypto/sha1.c @@ -37,7 +37,7 @@ static void SHA1ProcessMessageBlock(SHA1_CTX *ctx); /** * Initialize the SHA1 context */ -void SHA1Init(SHA1_CTX *ctx) +void SHA1_Init(SHA1_CTX *ctx) { ctx->Length_Low = 0; ctx->Length_High = 0; @@ -52,7 +52,7 @@ void SHA1Init(SHA1_CTX *ctx) /** * Accepts an array of octets as the next portion of the message. */ -void SHA1Update(SHA1_CTX *ctx, const uint8_t *msg, int len) +void SHA1_Update(SHA1_CTX *ctx, const uint8_t *msg, int len) { while (len--) { @@ -72,7 +72,7 @@ void SHA1Update(SHA1_CTX *ctx, const uint8_t *msg, int len) /** * Return the 160-bit message digest into the user's array */ -void SHA1Final(SHA1_CTX *ctx, uint8_t *digest) +void SHA1_Final(uint8_t *digest, SHA1_CTX *ctx) { int i; diff --git a/docsrc/axTLS.dox b/docsrc/axTLS.dox index e4763d6f34..6780237683 100644 --- a/docsrc/axTLS.dox +++ b/docsrc/axTLS.dox @@ -1005,7 +1005,7 @@ INCLUDE_FILE_PATTERNS = # undefined via #undef or recursively expanded use the := operator # instead of the = operator. -PREDEFINED = CONFIG_SSL_CERT_VERIFICATION CONFIG_SSL_ENABLE_CLIENT CONFIG_SSL_MAX_CLNT_SESSIONS=1 CONFIG_BIGINT_MONTGOMERY CONFIG_BIGINT_BARRETT EXP_FUNC="" STDCALL="" +PREDEFINED = CONFIG_SSL_CERT_VERIFICATION CONFIG_SSL_ENABLE_CLIENT CONFIG_SSL_MAX_CLNT_SESSIONS=1 CONFIG_BIGINT_MONTGOMERY CONFIG_BIGINT_BARRETT CONFIG_BIGINT_CRT EXP_FUNC="" STDCALL="" # If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then # this tag can be used to specify a list of macro names that should be expanded. diff --git a/httpd/Makefile b/httpd/Makefile index da173fa3d5..8daae7690c 100644 --- a/httpd/Makefile +++ b/httpd/Makefile @@ -37,7 +37,7 @@ else LIBS=-L../$(STAGE) -laxtls endif -CFLAGS += -I../ssl +AXTLS_HOME=.. ifdef CONFIG_HTTP_BUILD_LUA lua: kepler-1.1 diff --git a/httpd/htpasswd.c b/httpd/htpasswd.c index f188cdd149..f4e26814a5 100644 --- a/httpd/htpasswd.c +++ b/httpd/htpasswd.c @@ -112,10 +112,10 @@ int main(int argc, char *argv[]) RNG_terminate(); base64_encode(md5_salt, MD5_SIZE, b64_salt, sizeof(b64_salt)); - MD5Init(&ctx); - MD5Update(&ctx, md5_salt, MD5_SIZE); - MD5Update(&ctx, (uint8_t *)pw, strlen(pw)); - MD5Final(&ctx, md5_pass); + MD5_Init(&ctx); + MD5_Update(&ctx, md5_salt, MD5_SIZE); + MD5_Update(&ctx, (uint8_t *)pw, strlen(pw)); + MD5_Final(md5_pass, &ctx); base64_encode(md5_pass, MD5_SIZE, b64_pass, sizeof(b64_pass)); printf("Add the following to your '.htpasswd' file\n"); diff --git a/httpd/proc.c b/httpd/proc.c index 0e4b3e5262..8a760039ee 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -903,10 +903,10 @@ static int check_digest(char *salt, const char *msg_passwd) return -1; /* very simple MD5 crypt algorithm, but then the salt we use is large */ - MD5Init(&ctx); - MD5Update(&ctx, b256_salt, salt_size); /* process the salt */ - MD5Update(&ctx, (uint8_t *)msg_passwd, strlen(msg_passwd)); - MD5Final(&ctx, md5_result); + MD5_Init(&ctx); + MD5_Update(&ctx, b256_salt, salt_size); /* process the salt */ + MD5_Update(&ctx, (uint8_t *)msg_passwd, strlen(msg_passwd)); + MD5_Final(md5_result, &ctx); return memcmp(md5_result, real_passwd, MD5_SIZE);/* 0 = ok */ } diff --git a/samples/c/Makefile b/samples/c/Makefile index 0ab81e70f2..d4cf848cda 100644 --- a/samples/c/Makefile +++ b/samples/c/Makefile @@ -30,7 +30,7 @@ TARGET=../../$(STAGE)/axssl endif # cygwin LIBS=../../$(STAGE) -CFLAGS += -I../../ssl -I../../config +CFLAGS += -I../../crypto -I../../ssl -I../../config else TARGET=../../$(STAGE)/axssl.exe CFLAGS += /I"..\..\ssl" /I"..\..\config" diff --git a/samples/c/axssl.c b/samples/c/axssl.c index 999f3f8ac5..a708fbfc20 100644 --- a/samples/c/axssl.c +++ b/samples/c/axssl.c @@ -607,7 +607,8 @@ static void do_client(int argc, char *argv[]) { while (reconnect--) { - ssl = ssl_client_new(ssl_ctx, client_fd, session_id); + ssl = ssl_client_new(ssl_ctx, client_fd, session_id, + sizeof(session_id)); if ((res = ssl_handshake_status(ssl)) != SSL_OK) { if (!quiet) @@ -635,7 +636,7 @@ static void do_client(int argc, char *argv[]) } else { - ssl = ssl_client_new(ssl_ctx, client_fd, NULL); + ssl = ssl_client_new(ssl_ctx, client_fd, NULL, 0); } /* check the return status */ @@ -854,9 +855,10 @@ static void display_session_id(SSL *ssl) { int i; const uint8_t *session_id = ssl_get_session_id(ssl); + int sess_id_size = ssl_get_session_id_size(ssl); printf("-----BEGIN SSL SESSION PARAMETERS-----\n"); - for (i = 0; i < SSL_SESSION_ID_SIZE; i++) + for (i = 0; i < sess_id_size; i++) { printf("%02x", session_id[i]); } diff --git a/samples/csharp/axssl.cs b/samples/csharp/axssl.cs index 1f1f95b584..665c72dabd 100644 --- a/samples/csharp/axssl.cs +++ b/samples/csharp/axssl.cs @@ -508,7 +508,8 @@ private void do_client(int build_mode, string[] args) { while (reconnect-- > 0) { - ssl = ssl_ctx.Connect(client_sock, session_id); + ssl = ssl_ctx.Connect(client_sock, session_id, + axtls.SSL_SESSION_ID_SIZE); if ((res = ssl.HandshakeStatus()) != axtls.SSL_OK) { diff --git a/samples/lua/axssl.lua b/samples/lua/axssl.lua index 68c7678609..d6e06b3067 100755 --- a/samples/lua/axssl.lua +++ b/samples/lua/axssl.lua @@ -429,10 +429,12 @@ function do_client(build_mode) -- Try session resumption? if reconnect ~= 0 then local session_id = nil + local sess_id_size = 0 + while reconnect > 0 do reconnect = reconnect - 1 ssl = axtlsl.ssl_client_new(ssl_ctx, - client_sock:getfd(), session_id) + client_sock:getfd(), session_id, sess_id_size) res = axtlsl.ssl_handshake_status(ssl) if res ~= axtlsl.SSL_OK then @@ -443,6 +445,7 @@ function do_client(build_mode) display_session_id(ssl) session_id = axtlsl.ssl_get_session_id(ssl) + sess_id_size = axtlsl.ssl_get_session_id_size(ssl) if reconnect > 0 then axtlsl.ssl_free(ssl) @@ -452,7 +455,7 @@ function do_client(build_mode) end else - ssl = axtlsl.ssl_client_new(ssl_ctx, client_sock:getfd(), nil) + ssl = axtlsl.ssl_client_new(ssl_ctx, client_sock:getfd(), nil, 0) end -- check the return status diff --git a/samples/perl/axssl.pl b/samples/perl/axssl.pl index 15b0527986..1eb6aac56e 100755 --- a/samples/perl/axssl.pl +++ b/samples/perl/axssl.pl @@ -411,9 +411,12 @@ sub do_client if ($reconnect) { my $session_id = undef; + my $sess_id_size = 0; + while ($reconnect--) { - $ssl = axtlsp::ssl_client_new($ssl_ctx, $native_sock, $session_id); + $ssl = axtlsp::ssl_client_new($ssl_ctx, $native_sock, + $session_id, $sess_id_size); $res = axtlsp::ssl_handshake_status($ssl); if ($res != $axtlsp::SSL_OK) @@ -439,7 +442,7 @@ sub do_client } else { - $ssl = axtlsp::ssl_client_new($ssl_ctx, $native_sock, undef); + $ssl = axtlsp::ssl_client_new($ssl_ctx, $native_sock, undef, 0); } # check the return status diff --git a/ssl/Makefile b/ssl/Makefile index 139011d3d1..ec99b220c2 100644 --- a/ssl/Makefile +++ b/ssl/Makefile @@ -48,20 +48,23 @@ endif libs: $(TARGET1) $(TARGET2) +AXTLS_HOME=.. + OBJ=\ - aes.o \ + ../crypto/aes.o \ asn1.o \ + x509.o \ bigint.o \ crypto_misc.o \ - hmac.o \ + ../crypto/hmac.o \ os_port.o \ loader.o \ - md5.o \ + ../crypto/md5.o \ openssl.o \ p12.o \ rsa.o \ - rc4.o \ - sha1.o \ + ../crypto/rc4.o \ + ../crypto/sha1.o \ tls1.o \ tls1_svr.o \ tls1_clnt.o diff --git a/ssl/asn1.c b/ssl/asn1.c index 25e30f9aa7..b248e3e213 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -19,22 +19,19 @@ /** * @file asn1.c * - * Some primitive asn methods for extraction rsa modulus information. It also - * is used for retrieving information from X.509 certificates. + * Some primitive asn methods for extraction ASN.1 data. */ #include #include #include #include +#include "os_port.h" #include "crypto.h" +#include "crypto_misc.h" #define SIG_OID_PREFIX_SIZE 8 -#define SIG_TYPE_MD2 0x02 -#define SIG_TYPE_MD5 0x04 -#define SIG_TYPE_SHA1 0x05 - /* Must be an RSA algorithm with either SHA1 or MD5 for verifying to work */ static const uint8_t sig_oid_prefix[SIG_OID_PREFIX_SIZE] = { @@ -44,7 +41,7 @@ static const uint8_t sig_oid_prefix[SIG_OID_PREFIX_SIZE] = /* CN, O, OU */ static const uint8_t g_dn_types[] = { 3, 10, 11 }; -static int get_asn1_length(const uint8_t *buf, int *offset) +int get_asn1_length(const uint8_t *buf, int *offset) { int len, i; @@ -209,7 +206,7 @@ static int asn1_get_utc_time(const uint8_t *buf, int *offset, time_t *t) /** * Get the version type of a certificate (which we don't actually care about) */ -static int asn1_version(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) +int asn1_version(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) { int ret = X509_NOT_OK; @@ -225,7 +222,7 @@ static int asn1_version(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) /** * Retrieve the notbefore and notafter certificate times. */ -static int asn1_validity(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) +int asn1_validity(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) { return (asn1_next_obj(cert, offset, ASN1_SEQUENCE) < 0 || asn1_get_utc_time(cert, offset, &x509_ctx->not_before) || @@ -281,7 +278,7 @@ static int asn1_get_printable_str(const uint8_t *buf, int *offset, char **str) /** * Get the subject name (or the issuer) of a certificate. */ -static int asn1_name(const uint8_t *cert, int *offset, char *dn[]) +int asn1_name(const uint8_t *cert, int *offset, char *dn[]) { int ret = X509_NOT_OK; int dn_type; @@ -332,7 +329,7 @@ static int asn1_name(const uint8_t *cert, int *offset, char *dn[]) /** * Read the modulus and public exponent of a certificate. */ -static int asn1_public_key(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) +int asn1_public_key(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) { int ret = X509_NOT_OK, mod_len, pub_len; uint8_t *modulus, *pub_exp; @@ -364,7 +361,7 @@ static int asn1_public_key(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) /** * Read the signature of the certificate. */ -static int asn1_signature(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) +int asn1_signature(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) { int ret = X509_NOT_OK; @@ -417,7 +414,7 @@ void remove_ca_certs(CA_CERT_CTX *ca_cert_ctx) * Compare 2 distinguished names for equality * @return 0 if a match */ -static int asn1_compare_dn(char * const dn1[], char * const dn2[]) +int asn1_compare_dn(char * const dn1[], char * const dn2[]) { int i; @@ -432,34 +429,13 @@ static int asn1_compare_dn(char * const dn1[], char * const dn2[]) return 0; /* all good */ } -/** - * Retrieve the signature from a certificate. - */ -const uint8_t *x509_get_signature(const uint8_t *asn1_sig, int *len) -{ - int offset = 0; - const uint8_t *ptr = NULL; - - if (asn1_next_obj(asn1_sig, &offset, ASN1_SEQUENCE) < 0 || - asn1_skip_obj(asn1_sig, &offset, ASN1_SEQUENCE)) - goto end_get_sig; - - if (asn1_sig[offset++] != ASN1_OCTET_STRING) - goto end_get_sig; - *len = get_asn1_length(asn1_sig, &offset); - ptr = &asn1_sig[offset]; /* all ok */ - -end_get_sig: - return ptr; -} - #endif /** * Read the signature type of the certificate. We only support RSA-MD5 and * RSA-SHA1 signature types. */ -static int asn1_signature_type(const uint8_t *cert, +int asn1_signature_type(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) { int ret = X509_NOT_OK, len; @@ -482,382 +458,3 @@ static int asn1_signature_type(const uint8_t *cert, return ret; } -/** - * Construct a new x509 object. - * @return 0 if ok. < 0 if there was a problem. - */ -int x509_new(const uint8_t *cert, int *len, X509_CTX **ctx) -{ - int begin_tbs, end_tbs; - int ret = X509_NOT_OK, offset = 0, cert_size = 0; - X509_CTX *x509_ctx; - BI_CTX *bi_ctx; - - *ctx = (X509_CTX *)calloc(1, sizeof(X509_CTX)); - x509_ctx = *ctx; - - /* get the certificate size */ - asn1_skip_obj(cert, &cert_size, ASN1_SEQUENCE); - - if (asn1_next_obj(cert, &offset, ASN1_SEQUENCE) < 0) - goto end_cert; - - begin_tbs = offset; /* start of the tbs */ - end_tbs = begin_tbs; /* work out the end of the tbs */ - asn1_skip_obj(cert, &end_tbs, ASN1_SEQUENCE); - - if (asn1_next_obj(cert, &offset, ASN1_SEQUENCE) < 0) - goto end_cert; - - if (cert[offset] == ASN1_EXPLICIT_TAG) /* optional version */ - { - if (asn1_version(cert, &offset, x509_ctx)) - goto end_cert; - } - - if (asn1_skip_obj(cert, &offset, ASN1_INTEGER) || /* serial number */ - asn1_next_obj(cert, &offset, ASN1_SEQUENCE) < 0) - goto end_cert; - - /* make sure the signature is ok */ - if (asn1_signature_type(cert, &offset, x509_ctx)) - { - ret = X509_VFY_ERROR_UNSUPPORTED_DIGEST; - goto end_cert; - } - - if (asn1_name(cert, &offset, x509_ctx->ca_cert_dn) || - asn1_validity(cert, &offset, x509_ctx) || - asn1_name(cert, &offset, x509_ctx->cert_dn) || - asn1_public_key(cert, &offset, x509_ctx)) - goto end_cert; - - bi_ctx = x509_ctx->rsa_ctx->bi_ctx; - -#ifdef CONFIG_SSL_CERT_VERIFICATION /* only care if doing verification */ - /* use the appropriate signature algorithm (either SHA1 or MD5) */ - if (x509_ctx->sig_type == SIG_TYPE_MD5) - { - MD5_CTX md5_ctx; - uint8_t md5_dgst[MD5_SIZE]; - MD5Init(&md5_ctx); - MD5Update(&md5_ctx, &cert[begin_tbs], end_tbs-begin_tbs); - MD5Final(&md5_ctx, md5_dgst); - x509_ctx->digest = bi_import(bi_ctx, md5_dgst, MD5_SIZE); - } - else if (x509_ctx->sig_type == SIG_TYPE_SHA1) - { - SHA1_CTX sha_ctx; - uint8_t sha_dgst[SHA1_SIZE]; - SHA1Init(&sha_ctx); - SHA1Update(&sha_ctx, &cert[begin_tbs], end_tbs-begin_tbs); - SHA1Final(&sha_ctx, sha_dgst); - x509_ctx->digest = bi_import(bi_ctx, sha_dgst, SHA1_SIZE); - } - - offset = end_tbs; /* skip the v3 data */ - if (asn1_skip_obj(cert, &offset, ASN1_SEQUENCE) || - asn1_signature(cert, &offset, x509_ctx)) - goto end_cert; -#endif - - if (len) - { - *len = cert_size; - } - - ret = X509_OK; -end_cert: - -#ifdef CONFIG_SSL_FULL_MODE - if (ret) - { - printf("Error: Invalid X509 ASN.1 file\n"); - } -#endif - - return ret; -} - -/** - * Free an X.509 object's resources. - */ -void x509_free(X509_CTX *x509_ctx) -{ - X509_CTX *next; - int i; - - if (x509_ctx == NULL) /* if already null, then don't bother */ - return; - - for (i = 0; i < X509_NUM_DN_TYPES; i++) - { - free(x509_ctx->ca_cert_dn[i]); - free(x509_ctx->cert_dn[i]); - } - - free(x509_ctx->signature); - -#ifdef CONFIG_SSL_CERT_VERIFICATION - if (x509_ctx->digest) - { - bi_free(x509_ctx->rsa_ctx->bi_ctx, x509_ctx->digest); - } -#endif - - RSA_free(x509_ctx->rsa_ctx); - - next = x509_ctx->next; - free(x509_ctx); - x509_free(next); /* clear the chain */ -} - -#ifdef CONFIG_SSL_CERT_VERIFICATION -/** - * Do some basic checks on the certificate chain. - * - * Certificate verification consists of a number of checks: - * - A root certificate exists in the certificate store. - * - The date of the certificate is after the start date. - * - The date of the certificate is before the finish date. - * - The certificate chain is valid. - * - That the certificate(s) are not self-signed. - * - The signature of the certificate is valid. - */ -int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) -{ - int ret = X509_OK, i = 0; - bigint *cert_sig; - X509_CTX *next_cert = NULL; - BI_CTX *ctx; - bigint *mod, *expn; - struct timeval tv; - int match_ca_cert = 0; - - if (cert == NULL || ca_cert_ctx == NULL) - { - ret = X509_VFY_ERROR_NO_TRUSTED_CERT; - goto end_verify; - } - - /* last cert in the chain - look for a trusted cert */ - if (cert->next == NULL) - { - while (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) - { - if (asn1_compare_dn(cert->ca_cert_dn, - ca_cert_ctx->cert[i]->cert_dn) == 0) - { - match_ca_cert = 1; - break; - } - - i++; - } - - if (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) - { - next_cert = ca_cert_ctx->cert[i]; - } - else /* trusted cert not found */ - { - ret = X509_VFY_ERROR_NO_TRUSTED_CERT; - goto end_verify; - } - } - else - { - next_cert = cert->next; - } - - gettimeofday(&tv, NULL); - - /* check the not before date */ - if (tv.tv_sec < cert->not_before) - { - ret = X509_VFY_ERROR_NOT_YET_VALID; - goto end_verify; - } - - /* check the not after date */ - if (tv.tv_sec > cert->not_after) - { - ret = X509_VFY_ERROR_EXPIRED; - goto end_verify; - } - - /* check the chain integrity */ - if (asn1_compare_dn(cert->ca_cert_dn, next_cert->cert_dn)) - { - ret = X509_VFY_ERROR_INVALID_CHAIN; - goto end_verify; - } - - /* check for self-signing */ - if (!match_ca_cert && asn1_compare_dn(cert->ca_cert_dn, cert->cert_dn) == 0) - { - ret = X509_VFY_ERROR_SELF_SIGNED; - goto end_verify; - } - - /* check the signature */ - ctx = cert->rsa_ctx->bi_ctx; - mod = next_cert->rsa_ctx->m; - expn = next_cert->rsa_ctx->e; - cert_sig = RSA_sign_verify(ctx, cert->signature, cert->sig_len, - bi_clone(ctx, mod), bi_clone(ctx, expn)); - - if (cert_sig) - { - ret = cert->digest ? /* check the signature */ - bi_compare(cert_sig, cert->digest) : - X509_VFY_ERROR_UNSUPPORTED_DIGEST; - bi_free(ctx, cert_sig); - - if (ret) - goto end_verify; - } - else - { - ret = X509_VFY_ERROR_BAD_SIGNATURE; - goto end_verify; - } - - /* go down the certificate chain using recursion. */ - if (ret == 0 && cert->next) - { - ret = x509_verify(ca_cert_ctx, next_cert); - } - -end_verify: - return ret; -} -#endif - -#if defined (CONFIG_SSL_FULL_MODE) -/** - * Used for diagnostics. - */ -void x509_print(CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) -{ - if (cert == NULL) - return; - - printf("---------------- CERT DEBUG ----------------\n"); - printf("* CA Cert Distinguished Name\n"); - if (cert->ca_cert_dn[X509_COMMON_NAME]) - { - printf("Common Name (CN):\t%s\n", cert->ca_cert_dn[X509_COMMON_NAME]); - } - - if (cert->ca_cert_dn[X509_ORGANIZATION]) - { - printf("Organization (O):\t%s\n", cert->ca_cert_dn[X509_ORGANIZATION]); - } - - if (cert->ca_cert_dn[X509_ORGANIZATIONAL_TYPE]) - { - printf("Organizational Unit (OU): %s\n", - cert->ca_cert_dn[X509_ORGANIZATIONAL_TYPE]); - } - - printf("* Cert Distinguished Name\n"); - if (cert->cert_dn[X509_COMMON_NAME]) - { - printf("Common Name (CN):\t%s\n", cert->cert_dn[X509_COMMON_NAME]); - } - - if (cert->cert_dn[X509_ORGANIZATION]) - { - printf("Organization (O):\t%s\n", cert->cert_dn[X509_ORGANIZATION]); - } - - if (cert->cert_dn[X509_ORGANIZATIONAL_TYPE]) - { - printf("Organizational Unit (OU): %s\n", - cert->cert_dn[X509_ORGANIZATIONAL_TYPE]); - } - - printf("Not Before:\t\t%s", ctime(&cert->not_before)); - printf("Not After:\t\t%s", ctime(&cert->not_after)); - printf("RSA bitsize:\t\t%d\n", cert->rsa_ctx->num_octets*8); - printf("Sig Type:\t\t"); - switch (cert->sig_type) - { - case SIG_TYPE_MD5: - printf("MD5\n"); - break; - case SIG_TYPE_SHA1: - printf("SHA1\n"); - break; - case SIG_TYPE_MD2: - printf("MD2\n"); - break; - default: - printf("Unrecognized: %d\n", cert->sig_type); - break; - } - - printf("Verify:\t\t\t"); - - if (ca_cert_ctx) - { - x509_display_error(x509_verify(ca_cert_ctx, cert)); - } - - printf("\n"); -#if 0 - print_blob("Signature", cert->signature, cert->sig_len); - bi_print("Modulus", cert->rsa_ctx->m); - bi_print("Pub Exp", cert->rsa_ctx->e); -#endif - - if (ca_cert_ctx) - { - x509_print(ca_cert_ctx, cert->next); - } -} - -void x509_display_error(int error) -{ - switch (error) - { - case X509_NOT_OK: - printf("X509 not ok"); - break; - - case X509_VFY_ERROR_NO_TRUSTED_CERT: - printf("No trusted cert is available"); - break; - - case X509_VFY_ERROR_BAD_SIGNATURE: - printf("Bad signature"); - break; - - case X509_VFY_ERROR_NOT_YET_VALID: - printf("Cert is not yet valid"); - break; - - case X509_VFY_ERROR_EXPIRED: - printf("Cert has expired"); - break; - - case X509_VFY_ERROR_SELF_SIGNED: - printf("Cert is self-signed"); - break; - - case X509_VFY_ERROR_INVALID_CHAIN: - printf("Chain is invalid (check order of certs)"); - break; - - case X509_VFY_ERROR_UNSUPPORTED_DIGEST: - printf("Unsupported digest"); - break; - - case X509_INVALID_PRIV_KEY: - printf("Invalid private key"); - break; - } -} -#endif /* CONFIG_SSL_FULL_MODE */ - diff --git a/ssl/bigint.c b/ssl/bigint.c index 2551f593da..8a736cfeea 100644 --- a/ssl/bigint.c +++ b/ssl/bigint.c @@ -54,7 +54,6 @@ #include #include #include "bigint.h" -#include "crypto.h" static bigint *bi_int_multiply(BI_CTX *ctx, bigint *bi, comp i); static bigint *bi_int_divide(BI_CTX *ctx, bigint *biR, comp denom); @@ -1366,6 +1365,7 @@ static void precompute_slide_window(BI_CTX *ctx, int window, bigint *g1) * @param ctx [in] The bigint session context. * @param bi [in] The bigint on which to perform the mod power operation. * @param biexp [in] The bigint exponent. + * @return The result of the mod exponentiation operation * @see bi_set_mod(). */ bigint *bi_mod_power(BI_CTX *ctx, bigint *bi, bigint *biexp) @@ -1467,6 +1467,7 @@ bigint *bi_mod_power(BI_CTX *ctx, bigint *bi, bigint *biexp) * @param bi [in] The bigint to perform the exp/mod. * @param bim [in] The temporary modulus. * @param biexp [in] The bigint exponent. + * @return The result of the mod exponentiation operation * @see bi_set_mod(). */ bigint *bi_mod_power2(BI_CTX *ctx, bigint *bi, bigint *bim, bigint *biexp) @@ -1493,4 +1494,45 @@ bigint *bi_mod_power2(BI_CTX *ctx, bigint *bi, bigint *bim, bigint *biexp) return biR; } #endif + +#ifdef CONFIG_BIGINT_CRT +/** + * @Use the Chinese Remainder Theorem to quickly perform RSA decrypts. + * + * @param ctx [in] The bigint session context. + * @param bi [in] The bigint to perform the exp/mod. + * @param dP [in] CRT's dP bigint + * @param dQ [in] CRT's dQ bigint + * @param p [in] CRT's p bigint + * @param q [in] CRT's q bigint + * @param qInv [in] CRT's qInv bigint + * @return The result of the CRT operation + */ +bigint *bi_crt(BI_CTX *ctx, bigint *bi, + bigint *dP, bigint *dQ, + bigint *p, bigint *q, bigint *qInv) +{ + bigint *m1, *m2, *h; + + /* Montgomery has a condition the 0 < x, y < m and these products violate + * that condition. So disable Montgomery when using CRT */ +#if defined(CONFIG_BIGINT_MONTGOMERY) + ctx->use_classical = 1; +#endif + ctx->mod_offset = BIGINT_P_OFFSET; + m1 = bi_mod_power(ctx, bi_copy(bi), dP); + + ctx->mod_offset = BIGINT_Q_OFFSET; + m2 = bi_mod_power(ctx, bi, dQ); + + h = bi_subtract(ctx, bi_add(ctx, m1, p), bi_copy(m2), NULL); + h = bi_multiply(ctx, h, qInv); + ctx->mod_offset = BIGINT_P_OFFSET; + h = bi_residue(ctx, h); +#if defined(CONFIG_BIGINT_MONTGOMERY) + ctx->use_classical = 0; /* reset for any further operation */ +#endif + return bi_add(ctx, m2, bi_multiply(ctx, q, h)); +} +#endif /** @} */ diff --git a/ssl/bigint.h b/ssl/bigint.h index 5a13c5ae42..5804a1c27a 100644 --- a/ssl/bigint.h +++ b/ssl/bigint.h @@ -90,4 +90,11 @@ bigint *bi_square(BI_CTX *ctx, bigint *bi); #define bi_square(A, B) bi_multiply(A, bi_copy(B), B) #endif +#ifdef CONFIG_BIGINT_CRT +bigint *bi_crt(BI_CTX *ctx, bigint *bi, + bigint *dP, bigint *dQ, + bigint *p, bigint *q, + bigint *qInv); +#endif + #endif diff --git a/ssl/crypto.h b/ssl/crypto.h deleted file mode 100644 index d4e4bc0163..0000000000 --- a/ssl/crypto.h +++ /dev/null @@ -1,285 +0,0 @@ -/* - * Copyright(C) 2006 Cameron Rich - * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - */ - -/** - * @file crypto.h - */ - -#ifndef HEADER_CRYPTO_H -#define HEADER_CRYPTO_H - -#ifdef __cplusplus -extern "C" { -#endif - -#include "bigint.h" - -/************************************************************************** - * AES declarations - **************************************************************************/ - -#define AES_MAXROUNDS 14 -#define AES_BLOCKSIZE 16 -#define AES_IV_SIZE 16 - -typedef struct aes_key_st -{ - uint16_t rounds; - uint16_t key_size; - uint32_t ks[(AES_MAXROUNDS+1)*8]; - uint8_t iv[AES_IV_SIZE]; -} AES_CTX; - -typedef enum -{ - AES_MODE_128, - AES_MODE_256 -} AES_MODE; - -void AES_set_key(AES_CTX *ctx, const uint8_t *key, - const uint8_t *iv, AES_MODE mode); -void AES_cbc_encrypt(AES_CTX *ctx, const uint8_t *msg, - uint8_t *out, int length); -void AES_cbc_decrypt(AES_CTX *ks, const uint8_t *in, uint8_t *out, int length); -void AES_convert_key(AES_CTX *ctx); - -/************************************************************************** - * RC4 declarations - **************************************************************************/ - -typedef struct -{ - uint8_t x, y, m[256]; -} RC4_CTX; - -void RC4_setup(RC4_CTX *s, const uint8_t *key, int length); -void RC4_crypt(RC4_CTX *s, const uint8_t *msg, uint8_t *data, int length); - -/************************************************************************** - * SHA1 declarations - **************************************************************************/ - -#define SHA1_SIZE 20 - -/* - * This structure will hold context information for the SHA-1 - * hashing operation - */ -typedef struct -{ - uint32_t Intermediate_Hash[SHA1_SIZE/4]; /* Message Digest */ - uint32_t Length_Low; /* Message length in bits */ - uint32_t Length_High; /* Message length in bits */ - uint16_t Message_Block_Index; /* Index into message block array */ - uint8_t Message_Block[64]; /* 512-bit message blocks */ -} SHA1_CTX; - -void SHA1Init(SHA1_CTX *); -void SHA1Update(SHA1_CTX *, const uint8_t * msg, int len); -void SHA1Final(SHA1_CTX *, uint8_t *digest); - -/************************************************************************** - * MD5 declarations - **************************************************************************/ - -/* MD5 context. */ - -#define MD5_SIZE 16 - -typedef struct -{ - uint32_t state[4]; /* state (ABCD) */ - uint32_t count[2]; /* number of bits, modulo 2^64 (lsb first) */ - uint8_t buffer[64]; /* input buffer */ -} MD5_CTX; - -EXP_FUNC void STDCALL MD5Init(MD5_CTX *); -EXP_FUNC void STDCALL MD5Update(MD5_CTX *, const uint8_t *msg, int len); -EXP_FUNC void STDCALL MD5Final(MD5_CTX *, uint8_t *digest); - -/************************************************************************** - * HMAC declarations - **************************************************************************/ -void hmac_md5(const uint8_t *msg, int length, const uint8_t *key, - int key_len, uint8_t *digest); -void hmac_sha1(const uint8_t *msg, int length, const uint8_t *key, - int key_len, uint8_t *digest); - -/************************************************************************** - * RNG declarations - **************************************************************************/ -EXP_FUNC void STDCALL RNG_initialize(const uint8_t *seed_buf, int size); -EXP_FUNC void STDCALL RNG_terminate(void); -EXP_FUNC void STDCALL get_random(int num_rand_bytes, uint8_t *rand_data); -void get_random_NZ(int num_rand_bytes, uint8_t *rand_data); - -/************************************************************************** - * RSA declarations - **************************************************************************/ - -typedef struct -{ - bigint *m; /* modulus */ - bigint *e; /* public exponent */ - bigint *d; /* private exponent */ -#ifdef CONFIG_BIGINT_CRT - bigint *p; /* p as in m = pq */ - bigint *q; /* q as in m = pq */ - bigint *dP; /* d mod (p-1) */ - bigint *dQ; /* d mod (q-1) */ - bigint *qInv; /* q^-1 mod p */ -#endif - int num_octets; - BI_CTX *bi_ctx; -} RSA_CTX; - -void RSA_priv_key_new(RSA_CTX **rsa_ctx, - const uint8_t *modulus, int mod_len, - const uint8_t *pub_exp, int pub_len, - const uint8_t *priv_exp, int priv_len -#ifdef CONFIG_BIGINT_CRT - , const uint8_t *p, int p_len, - const uint8_t *q, int q_len, - const uint8_t *dP, int dP_len, - const uint8_t *dQ, int dQ_len, - const uint8_t *qInv, int qInv_len -#endif - ); -void RSA_pub_key_new(RSA_CTX **rsa_ctx, - const uint8_t *modulus, int mod_len, - const uint8_t *pub_exp, int pub_len); -void RSA_free(RSA_CTX *ctx); -int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data, uint8_t *out_data, - int is_decryption); -bigint *RSA_private(const RSA_CTX *c, bigint *bi_msg); -#ifdef CONFIG_SSL_CERT_VERIFICATION -bigint *RSA_sign_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, - bigint *modulus, bigint *pub_exp); -bigint *RSA_public(const RSA_CTX * c, bigint *bi_msg); -int RSA_encrypt(const RSA_CTX *ctx, const uint8_t *in_data, uint16_t in_len, - uint8_t *out_data, int is_signing); -void RSA_print(const RSA_CTX *ctx); -#endif - -/************************************************************************** - * ASN1 declarations - **************************************************************************/ -#define X509_OK 0 -#define X509_NOT_OK -1 -#define X509_VFY_ERROR_NO_TRUSTED_CERT -2 -#define X509_VFY_ERROR_BAD_SIGNATURE -3 -#define X509_VFY_ERROR_NOT_YET_VALID -4 -#define X509_VFY_ERROR_EXPIRED -5 -#define X509_VFY_ERROR_SELF_SIGNED -6 -#define X509_VFY_ERROR_INVALID_CHAIN -7 -#define X509_VFY_ERROR_UNSUPPORTED_DIGEST -8 -#define X509_INVALID_PRIV_KEY -9 - -/* - * The Distinguished Name - */ -#define X509_NUM_DN_TYPES 3 -#define X509_COMMON_NAME 0 -#define X509_ORGANIZATION 1 -#define X509_ORGANIZATIONAL_TYPE 2 - -#define ASN1_INTEGER 0x02 -#define ASN1_BIT_STRING 0x03 -#define ASN1_OCTET_STRING 0x04 -#define ASN1_NULL 0x05 -#define ASN1_OID 0x06 -#define ASN1_PRINTABLE_STR 0x13 -#define ASN1_TELETEX_STR 0x14 -#define ASN1_IA5_STR 0x16 -#define ASN1_UTC_TIME 0x17 -#define ASN1_SEQUENCE 0x30 -#define ASN1_SET 0x31 -#define ASN1_IMPLICIT_TAG 0x80 -#define ASN1_EXPLICIT_TAG 0xa0 - -#define SALT_SIZE 8 - -struct _x509_ctx -{ - char *ca_cert_dn[X509_NUM_DN_TYPES]; - char *cert_dn[X509_NUM_DN_TYPES]; -#if defined(_WIN32_WCE) - long not_before; - long not_after; -#else - time_t not_before; - time_t not_after; -#endif - uint8_t *signature; - uint16_t sig_len; - uint8_t sig_type; - RSA_CTX *rsa_ctx; - bigint *digest; - struct _x509_ctx *next; -}; - -typedef struct _x509_ctx X509_CTX; - -#ifdef CONFIG_SSL_CERT_VERIFICATION -typedef struct -{ - X509_CTX *cert[CONFIG_X509_MAX_CA_CERTS]; -} CA_CERT_CTX; -#endif - -int asn1_get_private_key(const uint8_t *buf, int len, RSA_CTX **rsa_ctx); -int asn1_next_obj(const uint8_t *buf, int *offset, int obj_type); -int asn1_skip_obj(const uint8_t *buf, int *offset, int obj_type); -int asn1_get_int(const uint8_t *buf, int *offset, uint8_t **object); -int x509_new(const uint8_t *cert, int *len, X509_CTX **ctx); -void x509_free(X509_CTX *x509_ctx); -#ifdef CONFIG_SSL_CERT_VERIFICATION -int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert); -const uint8_t *x509_get_signature(const uint8_t *asn1_signature, int *len); -#endif -#ifdef CONFIG_SSL_FULL_MODE -void x509_print(CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert); -void x509_display_error(int error); -#endif - -/************************************************************************** - * MISC declarations - **************************************************************************/ - -extern const char * const unsupported_str; - -typedef void (*crypt_func)(void *, const uint8_t *, uint8_t *, int); -typedef void (*hmac_func)(const uint8_t *msg, int length, const uint8_t *key, - int key_len, uint8_t *digest); - -int get_file(const char *filename, uint8_t **buf); - -#if defined(CONFIG_SSL_FULL_MODE) || defined(WIN32) || defined(CONFIG_DEBUG) -EXP_FUNC void STDCALL print_blob(const char *format, const uint8_t *data, int size, ...); -#else - #define print_blob(...) -#endif - -EXP_FUNC int STDCALL base64_decode(const char *in, int len, - uint8_t *out, int *outlen); - -#ifdef __cplusplus -} -#endif - -#endif diff --git a/ssl/crypto_misc.c b/ssl/crypto_misc.c index fec3620893..29a28f9b36 100644 --- a/ssl/crypto_misc.c +++ b/ssl/crypto_misc.c @@ -24,7 +24,7 @@ #include #include #include -#include "crypto.h" +#include "crypto_misc.h" #ifdef CONFIG_WIN32_USE_CRYPTO_LIB #include "wincrypt.h" #endif diff --git a/ssl/loader.c b/ssl/loader.c index 717373a8ae..d5ea6cb43d 100644 --- a/ssl/loader.c +++ b/ssl/loader.c @@ -250,18 +250,18 @@ static int pem_decrypt(const char *where, const char *end, goto error; /* work out the key */ - MD5Init(&md5_ctx); - MD5Update(&md5_ctx, (const uint8_t *)password, strlen(password)); - MD5Update(&md5_ctx, iv, SALT_SIZE); - MD5Final(&md5_ctx, key); + MD5_Init(&md5_ctx); + MD5_Update(&md5_ctx, (const uint8_t *)password, strlen(password)); + MD5_Update(&md5_ctx, iv, SALT_SIZE); + MD5_Final(key, &md5_ctx); if (is_aes_256) { - MD5Init(&md5_ctx); - MD5Update(&md5_ctx, key, MD5_SIZE); - MD5Update(&md5_ctx, (const uint8_t *)password, strlen(password)); - MD5Update(&md5_ctx, iv, SALT_SIZE); - MD5Final(&md5_ctx, &key[MD5_SIZE]); + MD5_Init(&md5_ctx); + MD5_Update(&md5_ctx, key, MD5_SIZE); + MD5_Update(&md5_ctx, (const uint8_t *)password, strlen(password)); + MD5_Update(&md5_ctx, iv, SALT_SIZE); + MD5_Final(&key[MD5_SIZE], &md5_ctx); } /* decrypt using the key/iv */ diff --git a/ssl/p12.c b/ssl/p12.c index 19b00b8727..d857a9b0cf 100644 --- a/ssl/p12.c +++ b/ssl/p12.c @@ -190,16 +190,16 @@ static int p8_decrypt(const char *uni_pass, int uni_pass_len, } /* get the key - no IV since we are using RC4 */ - SHA1Init(&sha_ctx); - SHA1Update(&sha_ctx, d, sizeof(d)); - SHA1Update(&sha_ctx, p, sizeof(p)); - SHA1Final(&sha_ctx, Ai); + SHA1_Init(&sha_ctx); + SHA1_Update(&sha_ctx, d, sizeof(d)); + SHA1_Update(&sha_ctx, p, sizeof(p)); + SHA1_Final(Ai, &sha_ctx); for (i = 1; i < iter; i++) { - SHA1Init(&sha_ctx); - SHA1Update(&sha_ctx, Ai, SHA1_SIZE); - SHA1Final(&sha_ctx, Ai); + SHA1_Init(&sha_ctx); + SHA1_Update(&sha_ctx, Ai, SHA1_SIZE); + SHA1_Final(Ai, &sha_ctx); } /* do the decryption */ diff --git a/ssl/rsa.c b/ssl/rsa.c index 6f5c8a44a8..97c5e67007 100644 --- a/ssl/rsa.c +++ b/ssl/rsa.c @@ -25,11 +25,7 @@ #include #include #include -#include "crypto.h" - -#ifdef CONFIG_BIGINT_CRT -static bigint *bi_crt(const RSA_CTX *rsa, bigint *bi); -#endif +#include "crypto_misc.h" void RSA_priv_key_new(RSA_CTX **ctx, const uint8_t *modulus, int mod_len, @@ -180,7 +176,7 @@ int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data, bigint *RSA_private(const RSA_CTX *c, bigint *bi_msg) { #ifdef CONFIG_BIGINT_CRT - return bi_crt(c, bi_msg); + return bi_crt(c->bi_ctx, bi_msg, c->dP, c->dQ, c->p, c->q, c->qInv); #else BI_CTX *ctx = c->bi_ctx; ctx->mod_offset = BIGINT_M_OFFSET; @@ -188,39 +184,6 @@ bigint *RSA_private(const RSA_CTX *c, bigint *bi_msg) #endif } -#ifdef CONFIG_BIGINT_CRT -/** - * Use the Chinese Remainder Theorem to quickly perform RSA decrypts. - * This should really be in bigint.c (and was at one stage), but needs - * access to the RSA_CTX context... - */ -static bigint *bi_crt(const RSA_CTX *rsa, bigint *bi) -{ - BI_CTX *ctx = rsa->bi_ctx; - bigint *m1, *m2, *h; - - /* Montgomery has a condition the 0 < x, y < m and these products violate - * that condition. So disable Montgomery when using CRT */ -#if defined(CONFIG_BIGINT_MONTGOMERY) - ctx->use_classical = 1; -#endif - ctx->mod_offset = BIGINT_P_OFFSET; - m1 = bi_mod_power(ctx, bi_copy(bi), rsa->dP); - - ctx->mod_offset = BIGINT_Q_OFFSET; - m2 = bi_mod_power(ctx, bi, rsa->dQ); - - h = bi_subtract(ctx, bi_add(ctx, m1, rsa->p), bi_copy(m2), NULL); - h = bi_multiply(ctx, h, rsa->qInv); - ctx->mod_offset = BIGINT_P_OFFSET; - h = bi_residue(ctx, h); -#if defined(CONFIG_BIGINT_MONTGOMERY) - ctx->use_classical = 0; /* reset for any further operation */ -#endif - return bi_add(ctx, m2, bi_multiply(ctx, rsa->q, h)); -} -#endif - #ifdef CONFIG_SSL_FULL_MODE /** * Used for diagnostics. @@ -294,7 +257,6 @@ bigint *RSA_sign_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, int i, size; bigint *decrypted_bi, *dat_bi; bigint *bir = NULL; - block = (uint8_t *)malloc(sig_len); /* decrypt */ diff --git a/ssl/ssl.h b/ssl/ssl.h index 6622415aa0..05c9178575 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -56,7 +56,7 @@ extern "C" { #endif #include -#include "crypto.h" +//#include "crypto.h" /* need to predefine before ssl_lib.h gets to it */ #define SSL_SESSION_ID_SIZE 32 @@ -221,10 +221,11 @@ EXP_FUNC SSL * STDCALL ssl_server_new(SSL_CTX *ssl_ctx, int client_fd); * @param session_id [in] A 32 byte session id for session resumption. This * can be null if no session resumption is being used or required. This option * is not used in skeleton mode. + * @param sess_id_size The size of the session id (max 32) * @return An SSL object reference. Use ssl_handshake_status() to check * if a handshake succeeded. */ -EXP_FUNC SSL * STDCALL ssl_client_new(SSL_CTX *ssl_ctx, int client_fd, const uint8_t *session_id); +EXP_FUNC SSL * STDCALL ssl_client_new(SSL_CTX *ssl_ctx, int client_fd, const uint8_t *session_id, uint8_t sess_id_size); /** * @brief Free any used resources on this connection. @@ -286,6 +287,15 @@ EXP_FUNC SSL * STDCALL ssl_find(SSL_CTX *ssl_ctx, int client_fd); */ EXP_FUNC const uint8_t * STDCALL ssl_get_session_id(const SSL *ssl); +/** + * @brief Get the session id size for a handshake. + * + * This will be 32 for a ssl server and may be something else for a ssl client. + * @param ssl [in] An SSL object reference. + * @return The number of valid bytes in a handshaking sequence + */ +EXP_FUNC uint8_t STDCALL ssl_get_session_id_size(const SSL *ssl); + /** * @brief Return the cipher id (in the SSL form). * @param ssl [in] An SSL object reference. diff --git a/ssl/test/Makefile b/ssl/test/Makefile index 43c9a6cef8..ea61e2ae5b 100644 --- a/ssl/test/Makefile +++ b/ssl/test/Makefile @@ -33,7 +33,7 @@ ifndef CONFIG_PLATFORM_WIN32 performance: ../../$(STAGE)/perf_bigint ssltesting: ../../$(STAGE)/ssltest LIBS=../../$(STAGE) -CFLAGS += -I../../ssl -I../../config +CFLAGS += -I../../ssl -I../../config -I../../crypto ../../$(STAGE)/perf_bigint: perf_bigint.o $(LIBS)/libaxtls.a $(CC) $(LDFLAGS) -o $@ $^ -L $(LIBS) -laxtls diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 3e3d47fecb..d97e153ae1 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -250,9 +250,9 @@ static int SHA1_test(BI_CTX *bi_ctx) "A9993E364706816ABA3E25717850C26C9CD0D89D"); bi_export(bi_ctx, ct_bi, ct, SHA1_SIZE); - SHA1Init(&ctx); - SHA1Update(&ctx, (const uint8_t *)in_str, strlen(in_str)); - SHA1Final(&ctx, digest); + SHA1_Init(&ctx); + SHA1_Update(&ctx, (const uint8_t *)in_str, strlen(in_str)); + SHA1_Final(digest, &ctx); if (memcmp(digest, ct, sizeof(ct))) { @@ -268,9 +268,9 @@ static int SHA1_test(BI_CTX *bi_ctx) "84983E441C3BD26EBAAE4AA1F95129E5E54670F1"); bi_export(bi_ctx, ct_bi, ct, SHA1_SIZE); - SHA1Init(&ctx); - SHA1Update(&ctx, (const uint8_t *)in_str, strlen(in_str)); - SHA1Final(&ctx, digest); + SHA1_Init(&ctx); + SHA1_Update(&ctx, (const uint8_t *)in_str, strlen(in_str)); + SHA1_Final(digest, &ctx); if (memcmp(digest, ct, sizeof(ct))) { @@ -304,9 +304,9 @@ static int MD5_test(BI_CTX *bi_ctx) "900150983CD24FB0D6963F7D28E17F72"); bi_export(bi_ctx, ct_bi, ct, MD5_SIZE); - MD5Init(&ctx); - MD5Update(&ctx, (const uint8_t *)in_str, strlen(in_str)); - MD5Final(&ctx, digest); + MD5_Init(&ctx); + MD5_Update(&ctx, (const uint8_t *)in_str, strlen(in_str)); + MD5_Final(digest, &ctx); if (memcmp(digest, ct, sizeof(ct))) { @@ -322,9 +322,9 @@ static int MD5_test(BI_CTX *bi_ctx) bi_ctx, "D174AB98D277D9F5A5611C2C9F419D9F"); bi_export(bi_ctx, ct_bi, ct, MD5_SIZE); - MD5Init(&ctx); - MD5Update(&ctx, (const uint8_t *)in_str, strlen(in_str)); - MD5Final(&ctx, digest); + MD5_Init(&ctx); + MD5_Update(&ctx, (const uint8_t *)in_str, strlen(in_str)); + MD5_Final(digest, &ctx); if (memcmp(digest, ct, sizeof(ct))) { @@ -1250,7 +1250,7 @@ static int SSL_client_test( goto client_test_exit; } - ssl = ssl_client_new(*ssl_ctx, client_fd, session_id); + ssl = ssl_client_new(*ssl_ctx, client_fd, session_id, sizeof(session_id)); /* check the return status */ if ((ret = ssl_handshake_status(ssl))) @@ -1469,7 +1469,7 @@ static void do_basic(void) "../ssl/test/axTLS.ca_x509.cer", NULL)) goto error; - ssl_clnt = ssl_client_new(ssl_clnt_ctx, client_fd, NULL); + ssl_clnt = ssl_client_new(ssl_clnt_ctx, client_fd, NULL, 0); /* check the return status */ if (ssl_handshake_status(ssl_clnt)) @@ -1588,7 +1588,7 @@ void do_multi_clnt(multi_t *multi_data) goto client_test_exit; sleep(1); - ssl = ssl_client_new(multi_data->ssl_clnt_ctx, client_fd, NULL); + ssl = ssl_client_new(multi_data->ssl_clnt_ctx, client_fd, NULL, 0); if ((res = ssl_handshake_status(ssl))) { diff --git a/ssl/tls1.c b/ssl/tls1.c index 43d798ed6d..1f7160cb1e 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -834,14 +834,14 @@ void finished_digest(SSL *ssl, const char *label, uint8_t *digest) q += strlen(label); } - MD5Init(&md5_ctx); - MD5Update(&md5_ctx, ssl->all_pkts, ssl->all_pkts_len); - MD5Final(&md5_ctx, q); + MD5_Init(&md5_ctx); + MD5_Update(&md5_ctx, ssl->all_pkts, ssl->all_pkts_len); + MD5_Final(q, &md5_ctx); q += MD5_SIZE; - SHA1Init(&sha1_ctx); - SHA1Update(&sha1_ctx, ssl->all_pkts, ssl->all_pkts_len); - SHA1Final(&sha1_ctx, q); + SHA1_Init(&sha1_ctx); + SHA1_Update(&sha1_ctx, ssl->all_pkts, ssl->all_pkts_len); + SHA1_Final(q, &sha1_ctx); q += SHA1_SIZE; if (label) @@ -1532,8 +1532,8 @@ int send_certificate(SSL *ssl) * Find if an existing session has the same session id. If so, use the * master secret from this session for session resumption. */ -SSL_SESS *ssl_session_update(int max_sessions, - SSL_SESS *ssl_sessions[], SSL *ssl, const uint8_t *session_id) +SSL_SESS *ssl_session_update(int max_sessions, SSL_SESS *ssl_sessions[], + SSL *ssl, const uint8_t *session_id) { time_t tm = time(NULL); time_t oldest_sess_time = tm; @@ -1641,6 +1641,14 @@ EXP_FUNC const uint8_t * STDCALL ssl_get_session_id(const SSL *ssl) return ssl->session_id; } +/* + * Get the session id size for a handshake. + */ +EXP_FUNC uint8_t STDCALL ssl_get_session_id_size(const SSL *ssl) +{ + return ssl->sess_id_size; +} + /* * Return the cipher id (in the SSL form). */ diff --git a/ssl/tls1.h b/ssl/tls1.h index d14bb6d6ed..1d07f29acc 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -29,6 +29,8 @@ extern "C" { #endif #include "version.h" +#include "crypto.h" +#include "crypto_misc.h" /* Mutexing definitions */ #if defined(CONFIG_SSL_CTX_MUTEXING) @@ -156,6 +158,7 @@ struct _SSL uint8_t record_type; uint8_t chain_length; uint8_t cipher; + uint8_t sess_id_size; int16_t next_state; int16_t hs_status; uint8_t *all_pkts; diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index e732581957..eda5b631d9 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -35,7 +35,8 @@ static int send_cert_verify(SSL *ssl); /* * Establish a new SSL connection to an SSL server. */ -EXP_FUNC SSL * STDCALL ssl_client_new(SSL_CTX *ssl_ctx, int client_fd, const uint8_t *session_id) +EXP_FUNC SSL * STDCALL ssl_client_new(SSL_CTX *ssl_ctx, int client_fd, const + uint8_t *session_id, uint8_t sess_id_size) { SSL *ssl; int ret; @@ -45,7 +46,14 @@ EXP_FUNC SSL * STDCALL ssl_client_new(SSL_CTX *ssl_ctx, int client_fd, const uin if (session_id && ssl_ctx->num_sessions) { - memcpy(ssl->session_id, session_id, SSL_SESSION_ID_SIZE); + if (sess_id_size > SSL_SESSION_ID_SIZE) /* validity check */ + { + ssl_free(ssl); + return NULL; + } + + memcpy(ssl->session_id, session_id, sess_id_size); + ssl->sess_id_size = sess_id_size; SET_SSL_FLAG(SSL_SESSION_RESUME); /* just flag for later */ } @@ -176,11 +184,11 @@ static int send_client_hello(SSL *ssl) offset = 6 + SSL_RANDOM_SIZE; /* give session resumption a go */ - if (IS_SET_SSL_FLAG(SSL_SESSION_RESUME)) /* set initially bu user */ + if (IS_SET_SSL_FLAG(SSL_SESSION_RESUME)) /* set initially by user */ { - buf[offset++] = SSL_SESSION_ID_SIZE; - memcpy(&buf[offset], ssl->session_id, SSL_SESSION_ID_SIZE); - offset += SSL_SESSION_ID_SIZE; + buf[offset++] = ssl->sess_id_size; + memcpy(&buf[offset], ssl->session_id, ssl->sess_id_size); + offset += ssl->sess_id_size; CLR_SSL_FLAG(SSL_SESSION_RESUME); /* clear so we can set later */ } else @@ -216,7 +224,7 @@ static int process_server_hello(SSL *ssl) int offset; int version = (buf[4] << 4) + buf[5]; int num_sessions = ssl->ssl_ctx->num_sessions; - uint8_t session_id_length; + uint8_t sess_id_size; int ret = SSL_OK; /* check that we are talking to a TLSv1 server */ @@ -226,17 +234,25 @@ static int process_server_hello(SSL *ssl) /* get the server random value */ memcpy(ssl->server_random, &buf[6], SSL_RANDOM_SIZE); offset = 6 + SSL_RANDOM_SIZE; /* skip of session id size */ - session_id_length = buf[offset++]; + sess_id_size = buf[offset++]; if (num_sessions) { ssl->session = ssl_session_update(num_sessions, ssl->ssl_ctx->ssl_sessions, ssl, &buf[offset]); - memcpy(ssl->session->session_id, &buf[offset], session_id_length); + memcpy(ssl->session->session_id, &buf[offset], sess_id_size); + + /* pad the rest with 0's */ + if (sess_id_size < SSL_SESSION_ID_SIZE) + { + memset(&ssl->session->session_id[sess_id_size], 0, + SSL_SESSION_ID_SIZE-sess_id_size); + } } - memcpy(ssl->session_id, &buf[offset], session_id_length); - offset += session_id_length; + memcpy(ssl->session_id, &buf[offset], sess_id_size); + ssl->sess_id_size = sess_id_size; + offset += sess_id_size; /* get the real cipher we are using */ ssl->cipher = buf[++offset]; diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index 167a57d82f..e7860270e1 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -311,12 +311,14 @@ static int send_server_hello(SSL *ssl) /* retrieve id from session cache */ memcpy(&buf[offset], ssl->session->session_id, SSL_SESSION_ID_SIZE); memcpy(ssl->session_id, ssl->session->session_id, SSL_SESSION_ID_SIZE); + ssl->sess_id_size = SSL_SESSION_ID_SIZE; } else /* generate our own session id */ #endif { get_random(SSL_SESSION_ID_SIZE, &buf[offset]); memcpy(ssl->session_id, &buf[offset], SSL_SESSION_ID_SIZE); + ssl->sess_id_size = SSL_SESSION_ID_SIZE; #ifndef CONFIG_SSL_SKELETON_MODE /* store id in session cache */ diff --git a/www/index.html b/www/index.html index cd563d14d3..08bd7945b7 100755 --- a/www/index.html +++ b/www/index.html @@ -7091,7 +7091,7 @@
    !GNU LESSER GENERAL PUBLIC LICENSE\n\nVersion 2.1, February 1999\n\nCopyright (C) 1991, 1999 Free Software Foundation, Inc.\n51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA\nEveryone is permitted to copy and distribute verbatim copies\nof this license document, but changing it is not allowed.\n\n[This is the first released version of the Lesser GPL. It also counts\n as the successor of the GNU Library Public License, version 2, hence\n the version number 2.1.]\n\n!!Preamble\n\nThe licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software -to make sure the software is free for all its users.\n\nThis license, the Lesser General Public License, applies to some specially designated software packages - typically libraries - of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below.\n\nWhen we speak of free software, we are referring to freedom of use, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish); that you receive source code or can get it if you want it; that you can change the software and use pieces of it in new free programs; and that you are informed that you can do these things.\n\nTo protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library or if you modify it.\n\nFor example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights.\n\nWe protect your rights with a two-step method: (1) we copyright the library, and (2) we offer you this license, which gives you legal permission to copy, distribute and/or modify the library.\n\nTo protect each distributor, we want to make it very clear that there is no warranty for the free library. Also, if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others.\n\nFinally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license.\n\nMost GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs.\n\nWhen a program is linked with a library, whether statically or using a shared library, the combination of the two is legally speaking a combined work, a derivative of the original library. The ordinary General Public License therefore permits such linking only if the entire combination fits its criteria of freedom. The Lesser General Public License permits more lax criteria for linking other code with the library.\n\nWe call this license the "Lesser" General Public License because it does Less to protect the user's freedom than the ordinary General Public License. It also provides other free software developers Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances.\n\nFor example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License.\n\nIn other cases, permission to use a particular library in non-free programs enables a greater number of people to use a large body of free software. For example, permission to use the GNU C Library in non-free programs enables many more people to use the whole GNU operating system, as well as its variant, the GNU/Linux operating system.\n\nAlthough the Lesser General Public License is Less protective of the users' freedom, it does ensure that the user of a program that is linked with the Library has the freedom and the wherewithal to run that program using a modified version of the Library.\n\nThe precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, whereas the latter must be combined with the library in order to run.\n\n!!TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION\n\n0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you".\n\nA "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables.\n\nThe "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".)\n\n"Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library.\n\nActivities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does.\n\n1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library.\n\nYou may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.\n\n2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:\n\n * a) The modified work must itself be a software library.\n * b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change.\n * c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License.\n * d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful.\n\n (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.)\n\n These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.\n\n Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library.\n\n In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.\n\n3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices.\n\nOnce this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy.\n\nThis option is useful when you wish to copy part of the code of the Library into a program that is not a library.\n\n4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange.\n\nIf distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.\n\n5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License.\n\nHowever, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables.\n\nWhen a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law.\n\nIf such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.)\n\nOtherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself.\n\n6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications.\n\nYou must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things:\n\n * a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.)\n * b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with.\n * c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.\n * d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place.\n * e) Verify that the user has already received a copy of these materials or that you have already sent this user a copy.\n\nFor an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the materials to be distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.\n\nIt may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute.\n\n7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things:\n\n * a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above.\n * b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work.\n\n8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.\n\n9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it.\n\n10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License.\n\n11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library.\n\nIf any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances.\n\nIt is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.\n\nThis section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.\n\n12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.\n\n13. The Free Software Foundation may publish revised and/or new versions of the Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.\n\nEach version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation.\n\n14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.\n\nNO WARRANTY\n\n15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.\n\nEND OF TERMS AND CONDITIONS
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    <div class='header' macro='gradient vert #390108 #900'>\n<div class='headerShadow'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n<div class='headerForeground'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n</div>\n<div id='mainMenu'>\n<div refresh='content' tiddler='MainMenu'></div>\n</div>\n<div id='sidebar'>\n<div id='sidebarOptions' refresh='content' tiddler='SideBarOptions'></div>\n<div id='sidebarTabs' refresh='content' force='true' tiddler='SideBarTabs'></div>\n</div>\n<div id='displayArea'>\n<div id='messageArea'></div>\n<div id='tiddlerDisplay'></div>\n</div>
    -
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n* axssl.lua - Lua sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!!!!Lua\n\n{{indent{{{{> [lua] ./axssl.lua <options>}}}\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n* The lua sample requires the luabit library from http://luaforge.net/projects/bit.\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* The test harness appears to be broken under ~VC8.0. Debugging shows a problem in the _close() function which is weird. CGI is also broken under ~VC8.0.\n* CGI works under Win32, but needs some more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    +
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly some stuff.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n* axssl.lua - Lua sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!!!!Lua\n\n{{indent{{{{> [lua] ./axssl.lua <options>}}}\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n* The lua sample requires the luabit library from http://luaforge.net/projects/bit.\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* The test harness appears to be broken under ~VC8.0. Debugging shows a problem in the _close() function which is weird. CGI is also broken under ~VC8.0.\n* CGI works under Win32, but needs some more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    changes, notes and errata
    axTLS Embedded SSL
    http://axtls.cerocclub.com.au
    From 2bbf4cfd9276b57f890d9eccd46a0bf576f07d3d Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 29 Aug 2007 13:22:46 +0000 Subject: [PATCH 095/301] fixed win32 build git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@117 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- bindings/csharp/axTLS.cs | 6 ++- bindings/generate_SWIG_interface.pl | 10 ++--- bindings/generate_interface.pl | 1 + bindings/java/SSLClient.java | 5 ++- bindings/vbnet/axTLSvb.vb | 15 ++++--- config/makefile.conf | 3 +- crypto/Makefile | 3 +- httpd/Makefile | 40 +++++++++---------- samples/c/Makefile | 24 +++++------ samples/csharp/axssl.cs | 3 +- ssl/Makefile | 53 +++++++++++++----------- ssl/test/Makefile | 62 +++++++++++++++++++---------- ssl/test/test_axssl.sh | 2 + ssl/tls1_clnt.c | 4 +- ssl/tls1_svr.c | 14 ++++--- 15 files changed, 143 insertions(+), 102 deletions(-) diff --git a/bindings/csharp/axTLS.cs b/bindings/csharp/axTLS.cs index a3146f16db..e2e5f4da29 100644 --- a/bindings/csharp/axTLS.cs +++ b/bindings/csharp/axTLS.cs @@ -471,8 +471,10 @@ public SSLClient(uint options, int num_sessions) : public SSL Connect(Socket s, byte[] session_id) { int client_fd = s.Handle.ToInt32(); - return new SSL(axtls. ssl_client_new(m_ctx, client_fd, session_id, - session_id ? null : session_id.Length)); + byte sess_id_size = (byte)(session_id != null ? + session_id.Length : 0); + return new SSL(axtls.ssl_client_new(m_ctx, client_fd, session_id, + sess_id_size)); } } } diff --git a/bindings/generate_SWIG_interface.pl b/bindings/generate_SWIG_interface.pl index 83e9ef68ef..23343ce8f7 100755 --- a/bindings/generate_SWIG_interface.pl +++ b/bindings/generate_SWIG_interface.pl @@ -177,13 +177,13 @@ sub parseFile %apply signed char[] {signed char *}; /* allow ssl_get_session_id() to return "byte[]" */ -%typemap(out) unsigned char * ssl_get_session_id \"if (result) jresult = SWIG_JavaArrayOutSchar(jenv, result, SSL_SESSION_ID_SIZE);\" +%typemap(out) unsigned char * ssl_get_session_id \"if (result) jresult = SWIG_JavaArrayOutSchar(jenv, result, ssl_get_session_id_size((SSL const *)arg1));\" /* allow ssl_client_new() to have a null session_id input */ %typemap(in) const signed char session_id[] (jbyte *jarr) { if (jarg3 == NULL) { - jresult = (jint)ssl_client_new(arg1,arg2,NULL); + jresult = (jint)ssl_client_new(arg1,arg2,NULL,0); return jresult; } @@ -275,7 +275,7 @@ sub parseFile /* for ssl_session_id() */ %typemap(out) const unsigned char * { - SV *svs = newSVpv((const char *)\$1, SSL_SESSION_ID_SIZE); + SV *svs = newSVpv((unsigned char *)\$1, (int)ssl_get_session_id((SSL const *)arg1)); \$result = newRV(svs); sv_2mortal(\$result); argvi++; @@ -330,7 +330,7 @@ sub parseFile %typemap(out) const unsigned char * { int i; lua_newtable(L); - for (i = 0; i < SSL_SESSION_ID_SIZE; i++){ + for (i = 0; i < ssl_get_session_id((SSL const *)\$1); i++){ lua_pushnumber(L,(lua_Number)result[i]); lua_rawseti(L,-2,i+1); /* -1 is the number, -2 is the table */ } @@ -359,7 +359,7 @@ sub parseFile if (lua_isnil(L,\$input)) \$1 = NULL; else - \$1 = SWIG_get_uchar_num_array_fixed(L,\$input, SSL_SESSION_ID_SIZE); + \$1 = SWIG_get_uchar_num_array_fixed(L,\$input, ssl_get_session_id((SSL const *)\$1)); } #endif diff --git a/bindings/generate_interface.pl b/bindings/generate_interface.pl index 816dd47752..ab7b914ada 100755 --- a/bindings/generate_interface.pl +++ b/bindings/generate_interface.pl @@ -90,6 +90,7 @@ sub transformSignature $line =~ s/uint8_t \*\* ?(\w+)/ByRef $1 As IntPtr/g; $line =~ s/const uint8_t \* ?(\w+)/ByVal $1() As Byte/g; $line =~ s/uint8_t \* ?(\w+)/ByVal $1() As Byte/g; + $line =~ s/uint8_t ?(\w+)/ByVal $1 As Byte/g; $line =~ s/const char \* ?(\w+)/ByVal $1 As String/g; $line =~ s/const SSL_CTX \* ?(\w+)/ByVal $1 As IntPtr/g; $line =~ s/SSL_CTX \* ?(\w+)/ByVal $1 As IntPtr/g; diff --git a/bindings/java/SSLClient.java b/bindings/java/SSLClient.java index 02ad38c7d3..6ca43d0032 100644 --- a/bindings/java/SSLClient.java +++ b/bindings/java/SSLClient.java @@ -61,6 +61,9 @@ public SSLClient(int options, int num_sessions) public SSL connect(Socket s, byte[] session_id) { int client_fd = axtlsj.getFd(s); - return new SSL(axtlsj.ssl_client_new(m_ctx, client_fd, session_id)); + byte sess_id_size = (byte)(session_id != null ? + session_id.length : 0); + return new SSL(axtlsj.ssl_client_new(m_ctx, client_fd, session_id, + sess_id_size)); } } diff --git a/bindings/vbnet/axTLSvb.vb b/bindings/vbnet/axTLSvb.vb index 32f126321e..c941c595b2 100644 --- a/bindings/vbnet/axTLSvb.vb +++ b/bindings/vbnet/axTLSvb.vb @@ -48,8 +48,7 @@ Namespace axTLSvb Public Function GetSessionId() As Byte() Dim ptr As IntPtr = axtls.ssl_get_session_id(m_ssl) Dim sess_id_size As Integer = axtls.ssl_get_session_id_size(m_ssl) - - Dim result(sess_id_size) As Byte + Dim result(sess_id_size-1) As Byte Marshal.Copy(ptr, result, 0, sess_id_size) Return result End Function @@ -172,10 +171,16 @@ Namespace axTLSvb End Sub Public Function Connect(ByVal s As Socket, _ - ByVal session_id As Byte(), _ - ByVal sess_id_size As Integer) As SSL + ByVal session_id As Byte()) As SSL Dim client_fd As Integer = s.Handle.ToInt32() - Return New SSL( axtls.ssl_client_new(m_ctx, client_fd, session_id, _ + Dim sess_id_size As Byte + If session_id is Nothing Then + sess_id_size = 0 + Else + sess_id_size = session_id.Length + End If + + Return New SSL(axtls.ssl_client_new(m_ctx, client_fd, session_id, _ sess_id_size)) End Function diff --git a/config/makefile.conf b/config/makefile.conf index 4844e3e5f1..347bf13dc1 100644 --- a/config/makefile.conf +++ b/config/makefile.conf @@ -54,7 +54,8 @@ endif CC=cl.exe LD=link.exe -CFLAGS+=/nologo /W3 /D "WIN32" /D "_MBCS" /D "_CONSOLE" /FD /I"..\ssl" /I"..\config" /c +AXTLS_INCLUDE=$(shell cygpath -w $(AXTLS_HOME)) +CFLAGS+=/nologo /W3 /D "WIN32" /D "_MBCS" /D "_CONSOLE" /FD /I"$(AXTLS_INCLUDE)crypto" /I"$(AXTLS_INCLUDE)ssl" /I"$(AXTLS_INCLUDE)config" /c LDFLAGS=/nologo /subsystem:console /machine:I386 LDSHARED = /dll AR=lib /nologo diff --git a/crypto/Makefile b/crypto/Makefile index c824facc92..2f69f1e491 100644 --- a/crypto/Makefile +++ b/crypto/Makefile @@ -28,6 +28,7 @@ OBJ=\ rc4.o \ sha1.o +include ../config/makefile.post + all: $(OBJ) -include ../config/makefile.post diff --git a/httpd/Makefile b/httpd/Makefile index 8daae7690c..57dabb6b17 100644 --- a/httpd/Makefile +++ b/httpd/Makefile @@ -18,27 +18,27 @@ all : web_server lua -include ../config/.config -include ../config/makefile.conf +AXTLS_HOME=.. + +include $(AXTLS_HOME)/config/.config +include $(AXTLS_HOME)/config/makefile.conf ifndef CONFIG_PLATFORM_WIN32 ifdef CONFIG_PLATFORM_CYGWIN -TARGET=../$(STAGE)/axhttpd.exe -TARGET2=../$(STAGE)/htpasswd.exe +TARGET=$(AXTLS_HOME)/$(STAGE)/axhttpd.exe +TARGET2=$(AXTLS_HOME)/$(STAGE)/htpasswd.exe else -TARGET=../$(STAGE)/axhttpd -TARGET2=../$(STAGE)/htpasswd +TARGET=$(AXTLS_HOME)/$(STAGE)/axhttpd +TARGET2=$(AXTLS_HOME)/$(STAGE)/htpasswd endif ifdef CONFIG_HTTP_STATIC_BUILD -LIBS=../$(STAGE)/libaxtls.a +LIBS=$(AXTLS_HOME)/$(STAGE)/libaxtls.a else -LIBS=-L../$(STAGE) -laxtls +LIBS=-L$(AXTLS_HOME)/$(STAGE) -laxtls endif -AXTLS_HOME=.. - ifdef CONFIG_HTTP_BUILD_LUA lua: kepler-1.1 @@ -53,13 +53,13 @@ endif else # win32 build lua: -TARGET=../$(STAGE)/axhttpd.exe -TARGET2=../$(STAGE)/htpasswd.exe +TARGET=$(AXTLS_HOME)/$(STAGE)/axhttpd.exe +TARGET2=$(AXTLS_HOME)/$(STAGE)/htpasswd.exe ifdef CONFIG_HTTP_STATIC_BUILD -LIBS=../$(STAGE)/axtls.static.lib ..\\config\\axtls.res +LIBS=$(AXTLS_HOME)/$(STAGE)/axtls.static.lib $(AXTLS_HOME)\\config\\axtls.res else -LIBS=../$(STAGE)/axtls.lib ..\\config\\axtls.res +LIBS=$(AXTLS_HOME)/$(STAGE)/axtls.lib $(AXTLS_HOME)\\config\\axtls.res endif endif @@ -78,11 +78,11 @@ OBJ= \ proc.o \ tdate_parse.o -include ../config/makefile.post +include $(AXTLS_HOME)/config/makefile.post ifndef CONFIG_PLATFORM_WIN32 -$(TARGET): $(OBJ) ../$(STAGE)/libaxtls.a +$(TARGET): $(OBJ) $(AXTLS_HOME)/$(STAGE)/libaxtls.a $(LD) $(LDFLAGS) -o $@ $(OBJ) $(LIBS) ifndef CONFIG_DEBUG ifndef CONFIG_PLATFORM_SOLARIS @@ -90,7 +90,7 @@ ifndef CONFIG_PLATFORM_SOLARIS endif endif -$(TARGET2): htpasswd.o ../$(STAGE)/libaxtls.a +$(TARGET2): htpasswd.o $(AXTLS_HOME)/$(STAGE)/libaxtls.a $(LD) $(LDFLAGS) -o $@ htpasswd.o $(LIBS) else # Win32 @@ -100,13 +100,13 @@ OBJ:=$(OBJ:.o=.obj) $(CC) $(CFLAGS) $< htpasswd.obj : htpasswd.c - $(CC) $(CFLAGS) $< + $(CC) $(CFLAGS) $? $(TARGET): $(OBJ) - $(LD) $(LDFLAGS) $(LIBS) /out:$@ $(OBJ) + $(LD) $(LDFLAGS) /out:$@ $(LIBS) $? $(TARGET2): htpasswd.obj - $(LD) $(LDFLAGS) $(LIBS) /out:$@ $< + $(LD) $(LDFLAGS) /out:$@ $(LIBS) $? endif endif # CONFIG_AXHTTPD diff --git a/samples/c/Makefile b/samples/c/Makefile index d4cf848cda..3fecbe66fa 100644 --- a/samples/c/Makefile +++ b/samples/c/Makefile @@ -18,22 +18,22 @@ all : sample -include ../../config/.config -include ../../config/makefile.conf +AXTLS_HOME=../.. + +include $(AXTLS_HOME)/config/.config +include $(AXTLS_HOME)/config/makefile.conf ifndef CONFIG_PLATFORM_WIN32 ifdef CONFIG_PLATFORM_CYGWIN -TARGET=../../$(STAGE)/axssl.exe +TARGET=$(AXTLS_HOME)/$(STAGE)/axssl.exe else -TARGET=../../$(STAGE)/axssl +TARGET=$(AXTLS_HOME)/$(STAGE)/axssl endif # cygwin -LIBS=../../$(STAGE) -CFLAGS += -I../../crypto -I../../ssl -I../../config +LIBS=$(AXTLS_HOME)/$(STAGE) else -TARGET=../../$(STAGE)/axssl.exe -CFLAGS += /I"..\..\ssl" /I"..\..\config" +TARGET=$(AXTLS_HOME)/$(STAGE)/axssl.exe endif ifndef CONFIG_C_SAMPLES @@ -42,12 +42,12 @@ sample: else sample : $(TARGET) OBJ= axssl.o -include ../../config/makefile.post +include $(AXTLS_HOME)/config/makefile.post ifndef CONFIG_PLATFORM_WIN32 $(TARGET): $(OBJ) $(LIBS)/libaxtls.a - $(LD) $(LDFLAGS) -o $@ $< -L$(LIBS) -laxtls + $(LD) $(LDFLAGS) -o $@ $(OBJ) -L$(LIBS) -laxtls ifndef CONFIG_DEBUG ifndef CONFIG_PLATFORM_SOLARIS strip --remove-section=.comment $(TARGET) @@ -56,11 +56,11 @@ endif # CONFIG_DEBUG else # Win32 $(TARGET): $(OBJ) - $(LD) $(LDFLAGS) ..\\..\\config\\axtls.res /out:$@ $^ /libpath:"../../$(STAGE)" axtls.lib + $(LD) $(LDFLAGS) $(AXTLS_HOME)/config/axtls.res /out:$@ $^ /libpath:"$(AXTLS_HOME)/$(STAGE)" axtls.lib endif endif # CONFIG_C_SAMPLES clean:: - -@rm -f ../../$(STAGE)/axssl* + -@rm -f $(AXTLS_HOME)/$(STAGE)/axssl* diff --git a/samples/csharp/axssl.cs b/samples/csharp/axssl.cs index 665c72dabd..1f1f95b584 100644 --- a/samples/csharp/axssl.cs +++ b/samples/csharp/axssl.cs @@ -508,8 +508,7 @@ private void do_client(int build_mode, string[] args) { while (reconnect-- > 0) { - ssl = ssl_ctx.Connect(client_sock, session_id, - axtls.SSL_SESSION_ID_SIZE); + ssl = ssl_ctx.Connect(client_sock, session_id); if ((res = ssl.HandshakeStatus()) != axtls.SSL_OK) { diff --git a/ssl/Makefile b/ssl/Makefile index ec99b220c2..2ad87021d7 100644 --- a/ssl/Makefile +++ b/ssl/Makefile @@ -16,8 +16,10 @@ # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # -include ../config/.config -include ../config/makefile.conf +AXTLS_HOME=.. + +include $(AXTLS_HOME)/config/.config +include $(AXTLS_HOME)/config/makefile.conf all: libs ifdef CONFIG_PERFORMANCE_TESTING @@ -29,76 +31,79 @@ endif endif ifndef CONFIG_PLATFORM_WIN32 -TARGET1=../$(STAGE)/libaxtls.a +TARGET1=$(AXTLS_HOME)/$(STAGE)/libaxtls.a BASETARGET=libaxtls.so +CRYPTO_PATH=$(AXTLS_HOME)/crypto/ ifdef CONFIG_PLATFORM_CYGWIN -TARGET2=../$(STAGE)/libaxtls.dll.a +TARGET2=$(AXTLS_HOME)/$(STAGE)/libaxtls.dll.a else -TARGET2=../$(STAGE)/$(LIBMINOR) +TARGET2=$(AXTLS_HOME)/$(STAGE)/$(LIBMINOR) endif # shared library major/minor numbers LIBMAJOR=$(BASETARGET).1 LIBMINOR=$(BASETARGET).1.1 else -TARGET1=axtls.lib -TARGET2=../$(STAGE)/axtls.dll -STATIC_LIB=../$(STAGE)/axtls.static.lib +TARGET1=$(AXTLS_HOME)/axtls.lib +TARGET2=$(AXTLS_HOME)/$(STAGE)/axtls.dll +STATIC_LIB=$(AXTLS_HOME)/$(STAGE)/axtls.static.lib +CRYPTO_PATH=$(AXTLS_HOME)\\crypto\\ endif libs: $(TARGET1) $(TARGET2) -AXTLS_HOME=.. +CRYPTO_OBJ=\ + $(CRYPTO_PATH)aes.o \ + $(CRYPTO_PATH)hmac.o \ + $(CRYPTO_PATH)md5.o \ + $(CRYPTO_PATH)rc4.o \ + $(CRYPTO_PATH)sha1.o OBJ=\ - ../crypto/aes.o \ asn1.o \ x509.o \ bigint.o \ crypto_misc.o \ - ../crypto/hmac.o \ os_port.o \ loader.o \ - ../crypto/md5.o \ openssl.o \ p12.o \ rsa.o \ - ../crypto/rc4.o \ - ../crypto/sha1.o \ tls1.o \ tls1_svr.o \ tls1_clnt.o -include ../config/makefile.post +include $(AXTLS_HOME)/config/makefile.post ifndef CONFIG_PLATFORM_WIN32 # Linux/Unix/Cygwin $(TARGET1) : $(OBJ) - $(AR) -r $@ $(OBJ) + $(AR) -r $@ $(CRYPTO_OBJ) $(OBJ) $(TARGET2) : $(OBJ) ifndef CONFIG_PLATFORM_CYGWIN - $(LD) $(LDFLAGS) $(LDSHARED) -Wl,-soname,$(LIBMAJOR) -o ../$(STAGE)/$(LIBMINOR) $(OBJ) - cd ../$(STAGE); ln -sf $(LIBMINOR) $(LIBMAJOR); ln -sf $(LIBMAJOR) $(BASETARGET); cd - + $(LD) $(LDFLAGS) $(LDSHARED) -Wl,-soname,$(LIBMAJOR) -o $(AXTLS_HOME)/$(STAGE)/$(LIBMINOR) $(CRYPTO_OBJ) $(OBJ) + cd $(AXTLS_HOME)/$(STAGE); ln -sf $(LIBMINOR) $(LIBMAJOR); ln -sf $(LIBMAJOR) $(BASETARGET); cd - else - $(LD) $(LDFLAGS) $(LDSHARED) -o ../$(STAGE)/cygaxtls.dll \ - -Wl,--out-implib=../$(STAGE)/libaxtls.dll.a \ + $(LD) $(LDFLAGS) $(LDSHARED) -o $(AXTLS_HOME)/$(STAGE)/cygaxtls.dll \ + -Wl,--out-implib=$(AXTLS_HOME)/$(STAGE)/libaxtls.dll.a \ -Wl,--export-all-symbols \ - -Wl,--enable-auto-import $(OBJ) + -Wl,--enable-auto-import $(CRYPTO_OBJ) $(OBJ) endif else # Win32 +CRYPTO_OBJ:=$(CRYPTO_OBJ:.o=.obj) $(TARGET1) : $(OBJ) - $(AR) /out:$@ $(OBJ) + $(AR) /out:$@ $(CRYPTO_OBJ) $(OBJ) $(TARGET2) : $(OBJ) cp $(TARGET1) $(STATIC_LIB) - $(LD) $(LDFLAGS) $(LDSHARED) /out:$@ $(OBJ) + $(LD) $(LDFLAGS) $(LDSHARED) /out:$@ $(CRYPTO_OBJ) $(OBJ) endif clean:: $(MAKE) -C test clean - -@rm -f ../$(STAGE)/* *.a *.lib + -@rm -f $(AXTLS_HOME)/$(STAGE)/* *.a $(TARGET1) $(TARGET2) diff --git a/ssl/test/Makefile b/ssl/test/Makefile index ea61e2ae5b..deda7307f3 100644 --- a/ssl/test/Makefile +++ b/ssl/test/Makefile @@ -18,8 +18,10 @@ all: -include ../../config/.config -include ../../config/makefile.conf +AXTLS_HOME=../.. + +include $(AXTLS_HOME)/config/.config +include $(AXTLS_HOME)/config/makefile.conf ifdef CONFIG_PERFORMANCE_TESTING all: performance @@ -29,37 +31,53 @@ ifdef CONFIG_SSL_TEST all: ssltesting endif +include $(AXTLS_HOME)/config/makefile.post + ifndef CONFIG_PLATFORM_WIN32 -performance: ../../$(STAGE)/perf_bigint -ssltesting: ../../$(STAGE)/ssltest -LIBS=../../$(STAGE) -CFLAGS += -I../../ssl -I../../config -I../../crypto +performance: $(AXTLS_HOME)/$(STAGE)/perf_bigint +ssltesting: $(AXTLS_HOME)/$(STAGE)/ssltest +LIBS=$(AXTLS_HOME)/$(STAGE) -../../$(STAGE)/perf_bigint: perf_bigint.o $(LIBS)/libaxtls.a +$(AXTLS_HOME)/$(STAGE)/perf_bigint: perf_bigint.o $(LIBS)/libaxtls.a $(CC) $(LDFLAGS) -o $@ $^ -L $(LIBS) -laxtls -../../$(STAGE)/ssltest: ssltest.o $(LIBS)/libaxtls.a +$(AXTLS_HOME)/$(STAGE)/ssltest: ssltest.o $(LIBS)/libaxtls.a $(CC) $(LDFLAGS) -o $@ $^ -lpthread -L $(LIBS) -laxtls else -performance: ../../$(STAGE)/perf_bigint.exe -ssltesting: ../../$(STAGE)/ssltest.exe -CFLAGS += /I".." /I"../../config" +performance: $(AXTLS_HOME)/$(STAGE)/perf_bigint.exe +ssltesting: $(AXTLS_HOME)/$(STAGE)/ssltest.exe + +CRYPTO_PATH="$(AXTLS_INCLUDE)crypto\\" +AXTLS_SSL_PATH="$(AXTLS_INCLUDE)ssl\\" -%.obj : %.c - $(CC) $(CFLAGS) $< +CRYPTO_OBJ=\ + $(CRYPTO_PATH)aes.obj \ + $(CRYPTO_PATH)hmac.obj \ + $(CRYPTO_PATH)md5.obj \ + $(CRYPTO_PATH)rc4.obj \ + $(CRYPTO_PATH)sha1.obj -OBJLIST=..\aes.obj ..\asn1.obj ..\bigint.obj ..\crypto_misc.obj ..\hmac.obj \ - ..\md5.obj ..\loader.obj ..\p12.obj ..\os_port.obj ..\rc4.obj \ - ..\rsa.obj ..\sha1.obj ..\tls1.obj ..\tls1_clnt.obj ..\tls1_svr.obj +OBJ=\ + $(AXTLS_SSL_PATH)asn1.obj \ + $(AXTLS_SSL_PATH)x509.obj \ + $(AXTLS_SSL_PATH)bigint.obj \ + $(AXTLS_SSL_PATH)crypto_misc.obj \ + $(AXTLS_SSL_PATH)os_port.obj \ + $(AXTLS_SSL_PATH)loader.obj \ + $(AXTLS_SSL_PATH)openssl.obj \ + $(AXTLS_SSL_PATH)p12.obj \ + $(AXTLS_SSL_PATH)rsa.obj \ + $(AXTLS_SSL_PATH)tls1.obj \ + $(AXTLS_SSL_PATH)tls1_svr.obj \ + $(AXTLS_SSL_PATH)tls1_clnt.obj -../../$(STAGE)/perf_bigint.exe: perf_bigint.obj $(OBJLIST) - $(LD) $(LDFLAGS) /out:$@ $^ +$(AXTLS_HOME)/$(STAGE)/perf_bigint.exe: perf_bigint.obj + $(LD) $(LDFLAGS) /out:$@ $? $(CRYPTO_OBJ) $(OBJ) -../../$(STAGE)/ssltest.exe: ssltest.obj $(OBJLIST) - $(LD) $(LDFLAGS) /out:$@ $^ +$(AXTLS_HOME)/$(STAGE)/ssltest.exe: ssltest.obj + $(LD) $(LDFLAGS) /out:$@ $? $(CRYPTO_OBJ) $(OBJ) endif clean:: - -@rm -f ../../$(STAGE)/perf_bigint* ../../$(STAGE)/ssltest* + -@rm -f $(AXTLS_HOME)/$(STAGE)/perf_bigint* $(AXTLS_HOME)/$(STAGE)/ssltest* -include ../../config/makefile.post diff --git a/ssl/test/test_axssl.sh b/ssl/test/test_axssl.sh index 03c0b85790..44cd606206 100755 --- a/ssl/test/test_axssl.sh +++ b/ssl/test/test_axssl.sh @@ -106,6 +106,8 @@ fi if [ -x ./axssl.vbnet.exe ]; then echo "######################## VB.NET SAMPLE ###########################" +echo $SERVER_ARGS +echo $CLIENT_ARGS ./axssl.vbnet $SERVER_ARGS & echo "VB.NET Test passed" | ./axssl.vbnet.exe $CLIENT_ARGS kill %1 diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index eda5b631d9..e2a0b298a1 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -88,7 +88,9 @@ int do_clnt_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len) if ((ret = send_certificate(ssl)) == SSL_OK && (ret = send_client_key_xchg(ssl)) == SSL_OK) { - ret = send_cert_verify(ssl); + ret = (ssl->chain_length == 0) ? + SSL_ERROR_INVALID_HANDSHAKE : + send_cert_verify(ssl); } } else diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index e7860270e1..dee48eeb16 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -302,36 +302,38 @@ static int send_server_hello(SSL *ssl) memcpy(ssl->server_random, &buf[6], SSL_RANDOM_SIZE); offset = 6 + SSL_RANDOM_SIZE; - /* send a session id - and put it into the cache */ - buf[offset++] = SSL_SESSION_ID_SIZE; - #ifndef CONFIG_SSL_SKELETON_MODE if (IS_SET_SSL_FLAG(SSL_SESSION_RESUME)) { /* retrieve id from session cache */ + buf[offset++] = SSL_SESSION_ID_SIZE; memcpy(&buf[offset], ssl->session->session_id, SSL_SESSION_ID_SIZE); memcpy(ssl->session_id, ssl->session->session_id, SSL_SESSION_ID_SIZE); ssl->sess_id_size = SSL_SESSION_ID_SIZE; + offset += SSL_SESSION_ID_SIZE; } else /* generate our own session id */ #endif { +#ifndef CONFIG_SSL_SKELETON_MODE + buf[offset++] = SSL_SESSION_ID_SIZE; get_random(SSL_SESSION_ID_SIZE, &buf[offset]); memcpy(ssl->session_id, &buf[offset], SSL_SESSION_ID_SIZE); ssl->sess_id_size = SSL_SESSION_ID_SIZE; -#ifndef CONFIG_SSL_SKELETON_MODE /* store id in session cache */ if (ssl->ssl_ctx->num_sessions) { memcpy(ssl->session->session_id, ssl->session_id, SSL_SESSION_ID_SIZE); } + + offset += SSL_SESSION_ID_SIZE; +#else + buf[offset++] = 0; /* don't bother with session id in skelton mode */ #endif } - offset += SSL_SESSION_ID_SIZE; - buf[offset++] = 0; /* cipher we are using */ buf[offset++] = ssl->cipher; buf[offset++] = 0; /* no compression */ From 58212f218e22658f3fdc61a1dac6b56655276443 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 29 Aug 2007 13:38:26 +0000 Subject: [PATCH 096/301] added crypto_misc.h git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@118 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/crypto_misc.h | 212 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 212 insertions(+) create mode 100644 ssl/crypto_misc.h diff --git a/ssl/crypto_misc.h b/ssl/crypto_misc.h new file mode 100644 index 0000000000..9811810f90 --- /dev/null +++ b/ssl/crypto_misc.h @@ -0,0 +1,212 @@ +/* + * Copyright(C) 2007 Cameron Rich + * + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file crypto_misc.h + */ + +#ifndef HEADER_CRYPTO_MISC_H +#define HEADER_CRYPTO_MISC_H + +#ifdef __cplusplus +extern "C" { +#endif + +#include "bigint.h" + +/************************************************************************** + * RSA declarations + **************************************************************************/ + +typedef struct +{ + bigint *m; /* modulus */ + bigint *e; /* public exponent */ + bigint *d; /* private exponent */ +#ifdef CONFIG_BIGINT_CRT + bigint *p; /* p as in m = pq */ + bigint *q; /* q as in m = pq */ + bigint *dP; /* d mod (p-1) */ + bigint *dQ; /* d mod (q-1) */ + bigint *qInv; /* q^-1 mod p */ +#endif + int num_octets; + BI_CTX *bi_ctx; +} RSA_CTX; + +void RSA_priv_key_new(RSA_CTX **rsa_ctx, + const uint8_t *modulus, int mod_len, + const uint8_t *pub_exp, int pub_len, + const uint8_t *priv_exp, int priv_len +#ifdef CONFIG_BIGINT_CRT + , const uint8_t *p, int p_len, + const uint8_t *q, int q_len, + const uint8_t *dP, int dP_len, + const uint8_t *dQ, int dQ_len, + const uint8_t *qInv, int qInv_len +#endif + ); +void RSA_pub_key_new(RSA_CTX **rsa_ctx, + const uint8_t *modulus, int mod_len, + const uint8_t *pub_exp, int pub_len); +void RSA_free(RSA_CTX *ctx); +int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data, uint8_t *out_data, + int is_decryption); +bigint *RSA_private(const RSA_CTX *c, bigint *bi_msg); +#ifdef CONFIG_SSL_CERT_VERIFICATION +bigint *RSA_sign_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, + bigint *modulus, bigint *pub_exp); +bigint *RSA_public(const RSA_CTX * c, bigint *bi_msg); +int RSA_encrypt(const RSA_CTX *ctx, const uint8_t *in_data, uint16_t in_len, + uint8_t *out_data, int is_signing); +void RSA_print(const RSA_CTX *ctx); +#endif + +/************************************************************************** + * RNG declarations + **************************************************************************/ +EXP_FUNC void STDCALL RNG_initialize(const uint8_t *seed_buf, int size); +EXP_FUNC void STDCALL RNG_terminate(void); +EXP_FUNC void STDCALL get_random(int num_rand_bytes, uint8_t *rand_data); +void get_random_NZ(int num_rand_bytes, uint8_t *rand_data); + +/************************************************************************** + * X509 declarations + **************************************************************************/ +#define X509_OK 0 +#define X509_NOT_OK -1 +#define X509_VFY_ERROR_NO_TRUSTED_CERT -2 +#define X509_VFY_ERROR_BAD_SIGNATURE -3 +#define X509_VFY_ERROR_NOT_YET_VALID -4 +#define X509_VFY_ERROR_EXPIRED -5 +#define X509_VFY_ERROR_SELF_SIGNED -6 +#define X509_VFY_ERROR_INVALID_CHAIN -7 +#define X509_VFY_ERROR_UNSUPPORTED_DIGEST -8 +#define X509_INVALID_PRIV_KEY -9 + +/* + * The Distinguished Name + */ +#define X509_NUM_DN_TYPES 3 +#define X509_COMMON_NAME 0 +#define X509_ORGANIZATION 1 +#define X509_ORGANIZATIONAL_TYPE 2 + +struct _x509_ctx +{ + char *ca_cert_dn[X509_NUM_DN_TYPES]; + char *cert_dn[X509_NUM_DN_TYPES]; +#if defined(_WIN32_WCE) + long not_before; + long not_after; +#else + time_t not_before; + time_t not_after; +#endif + uint8_t *signature; + uint16_t sig_len; + uint8_t sig_type; + RSA_CTX *rsa_ctx; + bigint *digest; + struct _x509_ctx *next; +}; + +typedef struct _x509_ctx X509_CTX; + +#ifdef CONFIG_SSL_CERT_VERIFICATION +typedef struct +{ + X509_CTX *cert[CONFIG_X509_MAX_CA_CERTS]; +} CA_CERT_CTX; +#endif + +int x509_new(const uint8_t *cert, int *len, X509_CTX **ctx); +void x509_free(X509_CTX *x509_ctx); +#ifdef CONFIG_SSL_CERT_VERIFICATION +int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert); +const uint8_t *x509_get_signature(const uint8_t *asn1_signature, int *len); +#endif +#ifdef CONFIG_SSL_FULL_MODE +void x509_print(CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert); +void x509_display_error(int error); +#endif + +/************************************************************************** + * ASN1 declarations + **************************************************************************/ +#define ASN1_INTEGER 0x02 +#define ASN1_BIT_STRING 0x03 +#define ASN1_OCTET_STRING 0x04 +#define ASN1_NULL 0x05 +#define ASN1_OID 0x06 +#define ASN1_PRINTABLE_STR 0x13 +#define ASN1_TELETEX_STR 0x14 +#define ASN1_IA5_STR 0x16 +#define ASN1_UTC_TIME 0x17 +#define ASN1_SEQUENCE 0x30 +#define ASN1_SET 0x31 +#define ASN1_IMPLICIT_TAG 0x80 +#define ASN1_EXPLICIT_TAG 0xa0 + +#define SIG_TYPE_MD2 0x02 +#define SIG_TYPE_MD5 0x04 +#define SIG_TYPE_SHA1 0x05 + +int get_asn1_length(const uint8_t *buf, int *offset); +int asn1_get_private_key(const uint8_t *buf, int len, RSA_CTX **rsa_ctx); +int asn1_next_obj(const uint8_t *buf, int *offset, int obj_type); +int asn1_skip_obj(const uint8_t *buf, int *offset, int obj_type); +int asn1_get_int(const uint8_t *buf, int *offset, uint8_t **object); +int asn1_version(const uint8_t *cert, int *offset, X509_CTX *x509_ctx); +int asn1_validity(const uint8_t *cert, int *offset, X509_CTX *x509_ctx); +int asn1_name(const uint8_t *cert, int *offset, char *dn[]); +int asn1_public_key(const uint8_t *cert, int *offset, X509_CTX *x509_ctx); +#ifdef CONFIG_SSL_CERT_VERIFICATION +int asn1_signature(const uint8_t *cert, int *offset, X509_CTX *x509_ctx); +int asn1_compare_dn(char * const dn1[], char * const dn2[]); +#endif +int asn1_signature_type(const uint8_t *cert, + int *offset, X509_CTX *x509_ctx); + +/************************************************************************** + * MISC declarations + **************************************************************************/ +#define SALT_SIZE 8 + +extern const char * const unsupported_str; + +typedef void (*crypt_func)(void *, const uint8_t *, uint8_t *, int); +typedef void (*hmac_func)(const uint8_t *msg, int length, const uint8_t *key, + int key_len, uint8_t *digest); + +int get_file(const char *filename, uint8_t **buf); + +#if defined(CONFIG_SSL_FULL_MODE) || defined(WIN32) || defined(CONFIG_DEBUG) +EXP_FUNC void STDCALL print_blob(const char *format, const uint8_t *data, int size, ...); +#else + #define print_blob(...) +#endif + +EXP_FUNC int STDCALL base64_decode(const char *in, int len, + uint8_t *out, int *outlen); + +#ifdef __cplusplus +} +#endif + +#endif From d40747d1b16dddd8d8bbf47da855f57bc87385fd Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 29 Aug 2007 13:39:47 +0000 Subject: [PATCH 097/301] added x509.c git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@119 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/x509.c | 435 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 435 insertions(+) create mode 100644 ssl/x509.c diff --git a/ssl/x509.c b/ssl/x509.c new file mode 100644 index 0000000000..32e19fdbb0 --- /dev/null +++ b/ssl/x509.c @@ -0,0 +1,435 @@ +/* + * Copyright(C) 2006 Cameron Rich + * + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file x509.c + * + * Certificate processing. + */ + +#include +#include +#include +#include +#include "os_port.h" +#include "crypto.h" +#include "crypto_misc.h" + +#ifdef CONFIG_SSL_CERT_VERIFICATION +/** + * Retrieve the signature from a certificate. + */ +const uint8_t *x509_get_signature(const uint8_t *asn1_sig, int *len) +{ + int offset = 0; + const uint8_t *ptr = NULL; + + if (asn1_next_obj(asn1_sig, &offset, ASN1_SEQUENCE) < 0 || + asn1_skip_obj(asn1_sig, &offset, ASN1_SEQUENCE)) + goto end_get_sig; + + if (asn1_sig[offset++] != ASN1_OCTET_STRING) + goto end_get_sig; + *len = get_asn1_length(asn1_sig, &offset); + ptr = &asn1_sig[offset]; /* all ok */ + +end_get_sig: + return ptr; +} + +#endif + +/** + * Construct a new x509 object. + * @return 0 if ok. < 0 if there was a problem. + */ +int x509_new(const uint8_t *cert, int *len, X509_CTX **ctx) +{ + int begin_tbs, end_tbs; + int ret = X509_NOT_OK, offset = 0, cert_size = 0; + X509_CTX *x509_ctx; + BI_CTX *bi_ctx; + + *ctx = (X509_CTX *)calloc(1, sizeof(X509_CTX)); + x509_ctx = *ctx; + + /* get the certificate size */ + asn1_skip_obj(cert, &cert_size, ASN1_SEQUENCE); + + if (asn1_next_obj(cert, &offset, ASN1_SEQUENCE) < 0) + goto end_cert; + + begin_tbs = offset; /* start of the tbs */ + end_tbs = begin_tbs; /* work out the end of the tbs */ + asn1_skip_obj(cert, &end_tbs, ASN1_SEQUENCE); + + if (asn1_next_obj(cert, &offset, ASN1_SEQUENCE) < 0) + goto end_cert; + + if (cert[offset] == ASN1_EXPLICIT_TAG) /* optional version */ + { + if (asn1_version(cert, &offset, x509_ctx)) + goto end_cert; + } + + if (asn1_skip_obj(cert, &offset, ASN1_INTEGER) || /* serial number */ + asn1_next_obj(cert, &offset, ASN1_SEQUENCE) < 0) + goto end_cert; + + /* make sure the signature is ok */ + if (asn1_signature_type(cert, &offset, x509_ctx)) + { + ret = X509_VFY_ERROR_UNSUPPORTED_DIGEST; + goto end_cert; + } + + if (asn1_name(cert, &offset, x509_ctx->ca_cert_dn) || + asn1_validity(cert, &offset, x509_ctx) || + asn1_name(cert, &offset, x509_ctx->cert_dn) || + asn1_public_key(cert, &offset, x509_ctx)) + goto end_cert; + + bi_ctx = x509_ctx->rsa_ctx->bi_ctx; + +#ifdef CONFIG_SSL_CERT_VERIFICATION /* only care if doing verification */ + /* use the appropriate signature algorithm (either SHA1 or MD5) */ + if (x509_ctx->sig_type == SIG_TYPE_MD5) + { + MD5_CTX md5_ctx; + uint8_t md5_dgst[MD5_SIZE]; + MD5_Init(&md5_ctx); + MD5_Update(&md5_ctx, &cert[begin_tbs], end_tbs-begin_tbs); + MD5_Final(md5_dgst, &md5_ctx); + x509_ctx->digest = bi_import(bi_ctx, md5_dgst, MD5_SIZE); + } + else if (x509_ctx->sig_type == SIG_TYPE_SHA1) + { + SHA1_CTX sha_ctx; + uint8_t sha_dgst[SHA1_SIZE]; + SHA1_Init(&sha_ctx); + SHA1_Update(&sha_ctx, &cert[begin_tbs], end_tbs-begin_tbs); + SHA1_Final(sha_dgst, &sha_ctx); + x509_ctx->digest = bi_import(bi_ctx, sha_dgst, SHA1_SIZE); + } + + offset = end_tbs; /* skip the v3 data */ + if (asn1_skip_obj(cert, &offset, ASN1_SEQUENCE) || + asn1_signature(cert, &offset, x509_ctx)) + goto end_cert; +#endif + + if (len) + { + *len = cert_size; + } + + ret = X509_OK; +end_cert: + +#ifdef CONFIG_SSL_FULL_MODE + if (ret) + { + printf("Error: Invalid X509 ASN.1 file\n"); + } +#endif + + return ret; +} + +/** + * Free an X.509 object's resources. + */ +void x509_free(X509_CTX *x509_ctx) +{ + X509_CTX *next; + int i; + + if (x509_ctx == NULL) /* if already null, then don't bother */ + return; + + for (i = 0; i < X509_NUM_DN_TYPES; i++) + { + free(x509_ctx->ca_cert_dn[i]); + free(x509_ctx->cert_dn[i]); + } + + free(x509_ctx->signature); + +#ifdef CONFIG_SSL_CERT_VERIFICATION + if (x509_ctx->digest) + { + bi_free(x509_ctx->rsa_ctx->bi_ctx, x509_ctx->digest); + } +#endif + + RSA_free(x509_ctx->rsa_ctx); + + next = x509_ctx->next; + free(x509_ctx); + x509_free(next); /* clear the chain */ +} + +#ifdef CONFIG_SSL_CERT_VERIFICATION +/** + * Do some basic checks on the certificate chain. + * + * Certificate verification consists of a number of checks: + * - A root certificate exists in the certificate store. + * - The date of the certificate is after the start date. + * - The date of the certificate is before the finish date. + * - The certificate chain is valid. + * - That the certificate(s) are not self-signed. + * - The signature of the certificate is valid. + */ +int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) +{ + int ret = X509_OK, i = 0; + bigint *cert_sig; + X509_CTX *next_cert = NULL; + BI_CTX *ctx; + bigint *mod, *expn; + struct timeval tv; + int match_ca_cert = 0; + + if (cert == NULL || ca_cert_ctx == NULL) + { + ret = X509_VFY_ERROR_NO_TRUSTED_CERT; + goto end_verify; + } + + /* last cert in the chain - look for a trusted cert */ + if (cert->next == NULL) + { + while (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) + { + if (asn1_compare_dn(cert->ca_cert_dn, + ca_cert_ctx->cert[i]->cert_dn) == 0) + { + match_ca_cert = 1; + break; + } + + i++; + } + + if (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) + { + next_cert = ca_cert_ctx->cert[i]; + } + else /* trusted cert not found */ + { + ret = X509_VFY_ERROR_NO_TRUSTED_CERT; + goto end_verify; + } + } + else + { + next_cert = cert->next; + } + + gettimeofday(&tv, NULL); + + /* check the not before date */ + if (tv.tv_sec < cert->not_before) + { + ret = X509_VFY_ERROR_NOT_YET_VALID; + goto end_verify; + } + + /* check the not after date */ + if (tv.tv_sec > cert->not_after) + { + ret = X509_VFY_ERROR_EXPIRED; + goto end_verify; + } + + /* check the chain integrity */ + if (asn1_compare_dn(cert->ca_cert_dn, next_cert->cert_dn)) + { + ret = X509_VFY_ERROR_INVALID_CHAIN; + goto end_verify; + } + + /* check for self-signing */ + if (!match_ca_cert && asn1_compare_dn(cert->ca_cert_dn, cert->cert_dn) == 0) + { + ret = X509_VFY_ERROR_SELF_SIGNED; + goto end_verify; + } + + /* check the signature */ + ctx = cert->rsa_ctx->bi_ctx; + mod = next_cert->rsa_ctx->m; + expn = next_cert->rsa_ctx->e; + cert_sig = RSA_sign_verify(ctx, cert->signature, cert->sig_len, + bi_clone(ctx, mod), bi_clone(ctx, expn)); + + if (cert_sig) + { + ret = cert->digest ? /* check the signature */ + bi_compare(cert_sig, cert->digest) : + X509_VFY_ERROR_UNSUPPORTED_DIGEST; + bi_free(ctx, cert_sig); + + if (ret) + goto end_verify; + } + else + { + ret = X509_VFY_ERROR_BAD_SIGNATURE; + goto end_verify; + } + + /* go down the certificate chain using recursion. */ + if (ret == 0 && cert->next) + { + ret = x509_verify(ca_cert_ctx, next_cert); + } + +end_verify: + return ret; +} +#endif + +#if defined (CONFIG_SSL_FULL_MODE) +/** + * Used for diagnostics. + */ +void x509_print(CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) +{ + if (cert == NULL) + return; + + printf("---------------- CERT DEBUG ----------------\n"); + printf("* CA Cert Distinguished Name\n"); + if (cert->ca_cert_dn[X509_COMMON_NAME]) + { + printf("Common Name (CN):\t%s\n", cert->ca_cert_dn[X509_COMMON_NAME]); + } + + if (cert->ca_cert_dn[X509_ORGANIZATION]) + { + printf("Organization (O):\t%s\n", cert->ca_cert_dn[X509_ORGANIZATION]); + } + + if (cert->ca_cert_dn[X509_ORGANIZATIONAL_TYPE]) + { + printf("Organizational Unit (OU): %s\n", + cert->ca_cert_dn[X509_ORGANIZATIONAL_TYPE]); + } + + printf("* Cert Distinguished Name\n"); + if (cert->cert_dn[X509_COMMON_NAME]) + { + printf("Common Name (CN):\t%s\n", cert->cert_dn[X509_COMMON_NAME]); + } + + if (cert->cert_dn[X509_ORGANIZATION]) + { + printf("Organization (O):\t%s\n", cert->cert_dn[X509_ORGANIZATION]); + } + + if (cert->cert_dn[X509_ORGANIZATIONAL_TYPE]) + { + printf("Organizational Unit (OU): %s\n", + cert->cert_dn[X509_ORGANIZATIONAL_TYPE]); + } + + printf("Not Before:\t\t%s", ctime(&cert->not_before)); + printf("Not After:\t\t%s", ctime(&cert->not_after)); + printf("RSA bitsize:\t\t%d\n", cert->rsa_ctx->num_octets*8); + printf("Sig Type:\t\t"); + switch (cert->sig_type) + { + case SIG_TYPE_MD5: + printf("MD5\n"); + break; + case SIG_TYPE_SHA1: + printf("SHA1\n"); + break; + case SIG_TYPE_MD2: + printf("MD2\n"); + break; + default: + printf("Unrecognized: %d\n", cert->sig_type); + break; + } + + printf("Verify:\t\t\t"); + + if (ca_cert_ctx) + { + x509_display_error(x509_verify(ca_cert_ctx, cert)); + } + + printf("\n"); +#if 0 + print_blob("Signature", cert->signature, cert->sig_len); + bi_print("Modulus", cert->rsa_ctx->m); + bi_print("Pub Exp", cert->rsa_ctx->e); +#endif + + if (ca_cert_ctx) + { + x509_print(ca_cert_ctx, cert->next); + } +} + +void x509_display_error(int error) +{ + switch (error) + { + case X509_NOT_OK: + printf("X509 not ok"); + break; + + case X509_VFY_ERROR_NO_TRUSTED_CERT: + printf("No trusted cert is available"); + break; + + case X509_VFY_ERROR_BAD_SIGNATURE: + printf("Bad signature"); + break; + + case X509_VFY_ERROR_NOT_YET_VALID: + printf("Cert is not yet valid"); + break; + + case X509_VFY_ERROR_EXPIRED: + printf("Cert has expired"); + break; + + case X509_VFY_ERROR_SELF_SIGNED: + printf("Cert is self-signed"); + break; + + case X509_VFY_ERROR_INVALID_CHAIN: + printf("Chain is invalid (check order of certs)"); + break; + + case X509_VFY_ERROR_UNSUPPORTED_DIGEST: + printf("Unsupported digest"); + break; + + case X509_INVALID_PRIV_KEY: + printf("Invalid private key"); + break; + } +} +#endif /* CONFIG_SSL_FULL_MODE */ + From 114fff40774d956c53cd37af112c81a5e1517053 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 30 Aug 2007 02:55:46 +0000 Subject: [PATCH 098/301] fixed some of the bindings for the new API changes git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@120 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 1 + bindings/generate_SWIG_interface.pl | 4 ++-- bindings/lua/Makefile | 2 +- samples/c/axssl.c | 14 +++++++++----- samples/csharp/axssl.cs | 13 ++++++++----- samples/java/axssl.java | 10 ++++++---- samples/lua/axssl.lua | 10 ++++++---- samples/perl/axssl.pl | 16 +++++++++------- samples/vbnet/axssl.vb | 16 +++++++++------- ssl/tls1.c | 1 - ssl/tls1_clnt.c | 4 +--- www/index.html | 2 +- 12 files changed, 53 insertions(+), 40 deletions(-) diff --git a/Makefile b/Makefile index 01c2219d87..e979eb1c75 100644 --- a/Makefile +++ b/Makefile @@ -85,6 +85,7 @@ ifdef CONFIG_PERL_BINDINGS install -m 755 $(STAGE)/axtlsp.pm `perl -e 'use Config; print $$Config{installarchlib};'` endif @mkdir -p -m 755 $(PREFIX)/include/axTLS + install -m 644 crypto/*.h $(PREFIX)/include/axTLS install -m 644 ssl/*.h $(PREFIX)/include/axTLS -rm $(PREFIX)/include/axTLS/cert.h -rm $(PREFIX)/include/axTLS/private_key.h diff --git a/bindings/generate_SWIG_interface.pl b/bindings/generate_SWIG_interface.pl index 23343ce8f7..d9a4e888dd 100755 --- a/bindings/generate_SWIG_interface.pl +++ b/bindings/generate_SWIG_interface.pl @@ -275,7 +275,7 @@ sub parseFile /* for ssl_session_id() */ %typemap(out) const unsigned char * { - SV *svs = newSVpv((unsigned char *)\$1, (int)ssl_get_session_id((SSL const *)arg1)); + SV *svs = newSVpv((unsigned char *)\$1, ssl_get_session_id_size((SSL const *)arg1)); \$result = newRV(svs); sv_2mortal(\$result); argvi++; @@ -330,7 +330,7 @@ sub parseFile %typemap(out) const unsigned char * { int i; lua_newtable(L); - for (i = 0; i < ssl_get_session_id((SSL const *)\$1); i++){ + for (i = 0; i < ssl_get_session_id_size((SSL const *)arg1); i++){ lua_pushnumber(L,(lua_Number)result[i]); lua_rawseti(L,-2,i+1); /* -1 is the number, -2 is the table */ } diff --git a/bindings/lua/Makefile b/bindings/lua/Makefile index 617a0eb899..66738cbedd 100644 --- a/bindings/lua/Makefile +++ b/bindings/lua/Makefile @@ -27,7 +27,7 @@ all: lib ifdef CONFIG_PLATFORM_WIN32 TARGET=$(AXTLS_HOME)/$(STAGE)/axtlsl.dll else -TARGET=$(AXTLS_HOME)/$(STAGE)/axtlsl.so +TARGET=$(CONFIG_LUA_CORE)/lib/lua/5.1/axtlsl.so endif ifneq ($(MAKECMDGOALS), clean) diff --git a/samples/c/axssl.c b/samples/c/axssl.c index a708fbfc20..41b93af3f2 100644 --- a/samples/c/axssl.c +++ b/samples/c/axssl.c @@ -857,11 +857,15 @@ static void display_session_id(SSL *ssl) const uint8_t *session_id = ssl_get_session_id(ssl); int sess_id_size = ssl_get_session_id_size(ssl); - printf("-----BEGIN SSL SESSION PARAMETERS-----\n"); - for (i = 0; i < sess_id_size; i++) + if (sess_id_size > 0) { - printf("%02x", session_id[i]); + printf("-----BEGIN SSL SESSION PARAMETERS-----\n"); + for (i = 0; i < sess_id_size; i++) + { + printf("%02x", session_id[i]); + } + + printf("\n-----END SSL SESSION PARAMETERS-----\n"); + TTY_FLUSH(); } - printf("\n-----END SSL SESSION PARAMETERS-----\n"); - TTY_FLUSH(); } diff --git a/samples/csharp/axssl.cs b/samples/csharp/axssl.cs index 1f1f95b584..174d3dc851 100644 --- a/samples/csharp/axssl.cs +++ b/samples/csharp/axssl.cs @@ -732,12 +732,15 @@ private void display_session_id(SSL ssl) { byte[] session_id = ssl.GetSessionId(); - Console.WriteLine("-----BEGIN SSL SESSION PARAMETERS-----"); - foreach (byte b in session_id) + if (session_id.Length > 0) { - Console.Write("{0:x02}", b); - } + Console.WriteLine("-----BEGIN SSL SESSION PARAMETERS-----"); + foreach (byte b in session_id) + { + Console.Write("{0:x02}", b); + } - Console.WriteLine("\n-----END SSL SESSION PARAMETERS-----"); + Console.WriteLine("\n-----END SSL SESSION PARAMETERS-----"); + } } } diff --git a/samples/java/axssl.java b/samples/java/axssl.java index a08e9a79d3..76fb06d773 100644 --- a/samples/java/axssl.java +++ b/samples/java/axssl.java @@ -737,10 +737,12 @@ public void bytesToHex(byte[] data) private void display_session_id(SSL ssl) { byte[] session_id = ssl.getSessionId(); - int i; - System.out.println("-----BEGIN SSL SESSION PARAMETERS-----"); - bytesToHex(session_id); - System.out.println("-----END SSL SESSION PARAMETERS-----"); + if (session_id.length > 0) + { + System.out.println("-----BEGIN SSL SESSION PARAMETERS-----"); + bytesToHex(session_id); + System.out.println("-----END SSL SESSION PARAMETERS-----"); + } } } diff --git a/samples/lua/axssl.lua b/samples/lua/axssl.lua index d6e06b3067..bdd97f4b1b 100755 --- a/samples/lua/axssl.lua +++ b/samples/lua/axssl.lua @@ -527,11 +527,13 @@ function display_session_id(ssl) local session_id = axtlsl.ssl_get_session_id(ssl) local v - print("-----BEGIN SSL SESSION PARAMETERS-----") - for _, v in ipairs(session_id) do - io.write(string.format("%02x", v)) + if #session_id > 0 then + print("-----BEGIN SSL SESSION PARAMETERS-----") + for _, v in ipairs(session_id) do + io.write(string.format("%02x", v)) + end + print("\n-----END SSL SESSION PARAMETERS-----") end - print("\n-----END SSL SESSION PARAMETERS-----") end -- diff --git a/samples/perl/axssl.pl b/samples/perl/axssl.pl index 1eb6aac56e..c46c70a401 100755 --- a/samples/perl/axssl.pl +++ b/samples/perl/axssl.pl @@ -235,7 +235,7 @@ sub do_server while (1) { ($res, $buf) = axtlsp::ssl_read($ssl, undef); - last if $res != $axtlsp::SSL_OK; + last if $res < $axtlsp::SSL_OK; if ($res == $axtlsp::SSL_OK) # connection established and ok { @@ -255,11 +255,11 @@ sub do_server { printf($$buf); } - else if ($res < $axtlsp::SSL_OK) + elsif ($res < $axtlsp::SSL_OK) { axtlsp::ssl_display_error($res) if not $quiet; last; - } + } } # client was disconnected or the handshake failed. @@ -613,8 +613,10 @@ sub display_session_id { my ($ssl) = @_; my $session_id = axtlsp::ssl_get_session_id($ssl); - - printf("-----BEGIN SSL SESSION PARAMETERS-----\n"); - printf(unpack("H*", $$session_id)); - printf("\n-----END SSL SESSION PARAMETERS-----\n"); + if (length($$session_id) > 0) + { + printf("-----BEGIN SSL SESSION PARAMETERS-----\n"); + printf(unpack("H*", $$session_id)); + printf("\n-----END SSL SESSION PARAMETERS-----\n"); + } } diff --git a/samples/vbnet/axssl.vb b/samples/vbnet/axssl.vb index da6f71984a..a9f7e9fa85 100644 --- a/samples/vbnet/axssl.vb +++ b/samples/vbnet/axssl.vb @@ -538,14 +538,16 @@ Public Class axssl Private Sub display_session_id(ByVal ssl As SSL) Dim session_id As Byte() = ssl.GetSessionId() - Console.WriteLine("-----BEGIN SSL SESSION PARAMETERS-----") - Dim b As Byte - For Each b In session_id - Console.Write("{0:x02}", b) - Next + If session_id.Length > 0 Then + Console.WriteLine("-----BEGIN SSL SESSION PARAMETERS-----") + Dim b As Byte + For Each b In session_id + Console.Write("{0:x02}", b) + Next - Console.WriteLine() - Console.WriteLine("-----END SSL SESSION PARAMETERS-----") + Console.WriteLine() + Console.WriteLine("-----END SSL SESSION PARAMETERS-----") + End If End Sub ' diff --git a/ssl/tls1.c b/ssl/tls1.c index 1f7160cb1e..baf44dc970 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -1504,7 +1504,6 @@ int send_certificate(SSL *ssl) buf[0] = HS_CERTIFICATE; buf[1] = 0; buf[4] = 0; - buf[7] = 0; while (i < ssl->chain_length) { diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index e2a0b298a1..05fca96cb4 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -88,9 +88,7 @@ int do_clnt_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len) if ((ret = send_certificate(ssl)) == SSL_OK && (ret = send_client_key_xchg(ssl)) == SSL_OK) { - ret = (ssl->chain_length == 0) ? - SSL_ERROR_INVALID_HANDSHAKE : - send_cert_verify(ssl); + send_cert_verify(ssl); } } else diff --git a/www/index.html b/www/index.html index 08bd7945b7..1fdb6b0d3f 100755 --- a/www/index.html +++ b/www/index.html @@ -7086,7 +7086,7 @@
    changes, notes and errata
    -
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    !GNU LESSER GENERAL PUBLIC LICENSE\n\nVersion 2.1, February 1999\n\nCopyright (C) 1991, 1999 Free Software Foundation, Inc.\n51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA\nEveryone is permitted to copy and distribute verbatim copies\nof this license document, but changing it is not allowed.\n\n[This is the first released version of the Lesser GPL. It also counts\n as the successor of the GNU Library Public License, version 2, hence\n the version number 2.1.]\n\n!!Preamble\n\nThe licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software -to make sure the software is free for all its users.\n\nThis license, the Lesser General Public License, applies to some specially designated software packages - typically libraries - of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below.\n\nWhen we speak of free software, we are referring to freedom of use, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish); that you receive source code or can get it if you want it; that you can change the software and use pieces of it in new free programs; and that you are informed that you can do these things.\n\nTo protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library or if you modify it.\n\nFor example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights.\n\nWe protect your rights with a two-step method: (1) we copyright the library, and (2) we offer you this license, which gives you legal permission to copy, distribute and/or modify the library.\n\nTo protect each distributor, we want to make it very clear that there is no warranty for the free library. Also, if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others.\n\nFinally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license.\n\nMost GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs.\n\nWhen a program is linked with a library, whether statically or using a shared library, the combination of the two is legally speaking a combined work, a derivative of the original library. The ordinary General Public License therefore permits such linking only if the entire combination fits its criteria of freedom. The Lesser General Public License permits more lax criteria for linking other code with the library.\n\nWe call this license the "Lesser" General Public License because it does Less to protect the user's freedom than the ordinary General Public License. It also provides other free software developers Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances.\n\nFor example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License.\n\nIn other cases, permission to use a particular library in non-free programs enables a greater number of people to use a large body of free software. For example, permission to use the GNU C Library in non-free programs enables many more people to use the whole GNU operating system, as well as its variant, the GNU/Linux operating system.\n\nAlthough the Lesser General Public License is Less protective of the users' freedom, it does ensure that the user of a program that is linked with the Library has the freedom and the wherewithal to run that program using a modified version of the Library.\n\nThe precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, whereas the latter must be combined with the library in order to run.\n\n!!TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION\n\n0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you".\n\nA "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables.\n\nThe "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".)\n\n"Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library.\n\nActivities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does.\n\n1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library.\n\nYou may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.\n\n2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:\n\n * a) The modified work must itself be a software library.\n * b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change.\n * c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License.\n * d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful.\n\n (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.)\n\n These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.\n\n Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library.\n\n In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.\n\n3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices.\n\nOnce this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy.\n\nThis option is useful when you wish to copy part of the code of the Library into a program that is not a library.\n\n4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange.\n\nIf distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.\n\n5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License.\n\nHowever, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables.\n\nWhen a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law.\n\nIf such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.)\n\nOtherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself.\n\n6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications.\n\nYou must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things:\n\n * a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.)\n * b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with.\n * c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.\n * d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place.\n * e) Verify that the user has already received a copy of these materials or that you have already sent this user a copy.\n\nFor an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the materials to be distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.\n\nIt may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute.\n\n7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things:\n\n * a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above.\n * b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work.\n\n8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.\n\n9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it.\n\n10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License.\n\n11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library.\n\nIf any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances.\n\nIt is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.\n\nThis section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.\n\n12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.\n\n13. The Free Software Foundation may publish revised and/or new versions of the Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.\n\nEach version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation.\n\n14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.\n\nNO WARRANTY\n\n15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.\n\nEND OF TERMS AND CONDITIONS
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From b717f94bd0905e591a3bfeee24155e8412cdaeb7 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 5 Sep 2007 13:44:56 +0000 Subject: [PATCH 099/301] fixed server buffer issue git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@121 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/test/header_issue.dat | Bin 0 -> 1159 bytes ssl/test/ssltest.c | 65 ++++++++++++++++++++++++++++++++++++++ ssl/tls1.c | 10 +++--- ssl/tls1.h | 1 + ssl/tls1_clnt.c | 15 +++++++-- 5 files changed, 84 insertions(+), 7 deletions(-) create mode 100755 ssl/test/header_issue.dat diff --git a/ssl/test/header_issue.dat b/ssl/test/header_issue.dat new file mode 100755 index 0000000000000000000000000000000000000000..a48d23d2b937820a533bc1394d6c155fd28c1959 GIT binary patch literal 1159 zcmWe*W@Kq%Vqj2XW^_B{aBjXp>E)wm*3`MA7YKbx?VUNb&ow+D@R^CtrU!`(45kd+ z3@iZ*EWQj(j0R1Ne}Q;86SDvVivceir&gOs+jm|@Mpjk^gU02C@&>YO%%Ln?!eYS% znMJ92B?`{@xw)lznaPPInfZCehI|G*AO+mQtO1U?;Q@xK2Fh?lI2pynic1R$@{39w ziXqyQ^K_r&^DUdsvg@wz@%k`ix z(#=UO2Kme&200WNSs9qU84Ns_92wpo`5|5!qql9!X6NU%!l&1>n0uS&D5^(1N_N=q zT3#1Xo$~t3DZM?rcUCRjoTpWPC&fDJUdopHOj#EUEFSSFWs-_7#%qy;W$R;IY>2#oGL(LO(Mop($Bszg1H5j-<7 zYyB}vW~D>tw?BFLXek4en?Vzk6EF?DVd7-C`OWT+eQSgcnmt1@C72qS8d)Mz0)#t+ ze1a<>?d5STc=(BH&V_n5t}ZuuwkKi#Kd5eDJK@OGejq5*ct+H>r89oKDBiP7sKoTQ zuBR~j#nTEypxQCB{fdK$z?p#a& literal 0 HcmV?d00001 diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index d97e153ae1..29fc621dbd 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1718,6 +1718,64 @@ int multi_thread_test(void) } #endif +/************************************************************************** + * Header issue + * + **************************************************************************/ +static void do_header_issue(void) +{ + uint8_t axtls_buf[2048]; +#ifndef WIN32 + pthread_setcanceltype(PTHREAD_CANCEL_ASYNCHRONOUS, NULL); +#endif + sprintf(axtls_buf, "./axssl s_client -connect localhost:%d", g_port); + system(axtls_buf); +} + +static int header_issue(void) +{ + FILE *f = fopen("../ssl/test/header_issue.dat", "r"); + int server_fd, client_fd, ret = 1; + uint8_t buf[2048]; + int size = 0; + struct sockaddr_in client_addr; + socklen_t clnt_len = sizeof(client_addr); +#ifndef WIN32 + pthread_t thread; +#endif + + if (f == NULL || (server_fd = server_socket_init(&g_port)) < 0) + goto error; + +#ifndef WIN32 + pthread_create(&thread, NULL, + (void *(*)(void *))do_header_issue, NULL); + pthread_detach(thread); +#else + CreateThread(NULL, 1024, (LPTHREAD_START_ROUTINE)do_header_issue, + NULL, 0, NULL); +#endif + if ((client_fd = accept(server_fd, + (struct sockaddr *) &client_addr, &clnt_len)) < 0) + { + ret = SSL_ERROR_SOCK_SETUP_FAILURE; + goto error; + } + + size = fread(buf, 1, sizeof(buf), f); + SOCKET_WRITE(client_fd, buf, size); + usleep(200000); + + ret = 0; +error: + fclose(f); + SOCKET_CLOSE(client_fd); + SOCKET_CLOSE(server_fd); + TTY_FLUSH(); + system("killall axssl"); + return ret; +} + /************************************************************************** * main() * @@ -1820,7 +1878,14 @@ int main(int argc, char *argv[]) system("sh ../ssl/test/killopenssl.sh"); + if (header_issue()) + { + printf("Header tests failed\n"); + goto cleanup; + } + ret = 0; /* all ok */ + printf("**** ALL TESTS PASSED ****\n"); TTY_FLUSH(); cleanup: if (ret) diff --git a/ssl/tls1.c b/ssl/tls1.c index baf44dc970..de5597fbd4 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -1241,6 +1241,7 @@ int basic_read(SSL *ssl, uint8_t **in_data) switch (ssl->record_type) { case PT_HANDSHAKE_PROTOCOL: + ssl->bm_proc_index = 0; ret = do_handshake(ssl, buf, read_len); break; @@ -1723,10 +1724,10 @@ EXP_FUNC int STDCALL ssl_verify_cert(const SSL *ssl) int process_certificate(SSL *ssl, X509_CTX **x509_ctx) { int ret = SSL_OK; + uint8_t *buf = &ssl->bm_data[ssl->bm_proc_index]; int pkt_size = ssl->bm_index; int cert_size, offset = 5; - int total_cert_size = (ssl->bm_data[offset]<<8) + - ssl->bm_data[offset+1]; + int total_cert_size = (buf[offset]<<8) + buf[offset+1]; int is_client = IS_SET_SSL_FLAG(SSL_IS_CLIENT); X509_CTX **chain = x509_ctx; offset += 2; @@ -1736,10 +1737,10 @@ int process_certificate(SSL *ssl, X509_CTX **x509_ctx) while (offset < total_cert_size) { offset++; /* skip empty char */ - cert_size = (ssl->bm_data[offset]<<8) + ssl->bm_data[offset+1]; + cert_size = (buf[offset]<<8) + buf[offset+1]; offset += 2; - if (x509_new(&ssl->bm_data[offset], NULL, chain)) + if (x509_new(&buf[offset], NULL, chain)) { ret = SSL_ERROR_BAD_CERTIFICATE; goto error; @@ -1759,6 +1760,7 @@ int process_certificate(SSL *ssl, X509_CTX **x509_ctx) DISPLAY_CERT(ssl, "process_certificate", *x509_ctx); ssl->next_state = is_client ? HS_SERVER_HELLO_DONE : HS_CLIENT_KEY_XCHG; + ssl->bm_proc_index += offset; error: return ret; } diff --git a/ssl/tls1.h b/ssl/tls1.h index 1d07f29acc..45f13527d5 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -173,6 +173,7 @@ struct _SSL uint8_t *bm_data; uint16_t bm_index; uint16_t bm_read_index; + uint16_t bm_proc_index; struct _SSL *next; /* doubly linked list */ struct _SSL *prev; SSL_CERT *certs; diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index 05fca96cb4..939318b0ea 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -221,11 +221,10 @@ static int process_server_hello(SSL *ssl) { uint8_t *buf = ssl->bm_data; int pkt_size = ssl->bm_index; - int offset; int version = (buf[4] << 4) + buf[5]; int num_sessions = ssl->ssl_ctx->num_sessions; uint8_t sess_id_size; - int ret = SSL_OK; + int offset, ret = SSL_OK; /* check that we are talking to a TLSv1 server */ if (version != 0x31) @@ -259,7 +258,9 @@ static int process_server_hello(SSL *ssl) ssl->next_state = IS_SET_SSL_FLAG(SSL_SESSION_RESUME) ? HS_FINISHED : HS_CERTIFICATE; + offset++; // skip the compr PARANOIA_CHECK(pkt_size, offset); + ssl->bm_proc_index = offset+1; error: return ret; @@ -311,10 +312,18 @@ static int send_client_key_xchg(SSL *ssl) */ static int process_cert_req(SSL *ssl) { + uint8_t *buf = &ssl->bm_data[ssl->bm_proc_index]; + int ret = SSL_OK; + int offset = (buf[2] << 4) + buf[3]; + int pkt_size = ssl->bm_index; + /* don't do any processing - we will send back an RSA certificate anyway */ ssl->next_state = HS_SERVER_HELLO_DONE; SET_SSL_FLAG(SSL_HAS_CERT_REQ); - return SSL_OK; + ssl->bm_proc_index += offset; + PARANOIA_CHECK(pkt_size, offset); +error: + return ret; } /* From 3515da26fb35e66c6363282cd1ea919b49b6f45d Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 10 Sep 2007 06:54:31 +0000 Subject: [PATCH 100/301] some doco updates git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@122 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/makefile.conf | 14 ++++++++------ ssl/bigint.c | 2 +- ssl/ssl.h | 4 ++-- ssl/test/ssltest.c | 20 ++++++++++---------- ssl/test/test_axssl.sh | 2 +- www/index.html | 4 ++-- 6 files changed, 24 insertions(+), 22 deletions(-) diff --git a/config/makefile.conf b/config/makefile.conf index 347bf13dc1..e19b565631 100644 --- a/config/makefile.conf +++ b/config/makefile.conf @@ -33,21 +33,23 @@ ifdef CONFIG_PLATFORM_WIN32 ifdef CONFIG_VISUAL_STUDIO_6_0 CONFIG_VISUAL_STUDIO_6_0_BASE_UNIX:=$(shell cygpath -u $(CONFIG_VISUAL_STUDIO_6_0_BASE)) -INCLUDE=$(shell echo "$(CONFIG_VISUAL_STUDIO_6_0_BASE)\vc98\Include") -LIB=$(shell echo "$(CONFIG_VISUAL_STUDIO_6_0_BASE)\vc98\Lib") +export INCLUDE=$(shell echo "$(CONFIG_VISUAL_STUDIO_6_0_BASE)\vc98\Include") +export LIB=$(shell echo "$(CONFIG_VISUAL_STUDIO_6_0_BASE)\vc98\Lib") PATH:=$(CONFIG_VISUAL_STUDIO_6_0_BASE_UNIX)/common/msdev98/bin:$(CONFIG_VISUAL_STUDIO_6_0_BASE_UNIX)/vc98/bin:$(PATH) else ifdef CONFIG_VISUAL_STUDIO_7_0 CONFIG_VISUAL_STUDIO_7_0_BASE_UNIX:=$(shell cygpath -u $(CONFIG_VISUAL_STUDIO_7_0_BASE)) -INCLUDE=$(shell echo "$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\include;$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\platformsdk\include") -LIB=$(shell echo "$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\\platformsdk\lib;$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\lib") +export INCLUDE=$(shell echo "$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\include;$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\platformsdk\include") +export LIB=$(shell echo "$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\\platformsdk\lib;$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\lib") PATH:=$(CONFIG_VISUAL_STUDIO_7_0_BASE_UNIX)/vc7/bin:$(CONFIG_VISUAL_STUDIO_7_0_BASE_UNIX)/common7/ide:$(PATH) else ifdef CONFIG_VISUAL_STUDIO_8_0 CONFIG_VISUAL_STUDIO_8_0_BASE_UNIX:=$(shell cygpath -u $(CONFIG_VISUAL_STUDIO_8_0_BASE)) -INCLUDE=$(shell echo "$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\include;$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\platformsdk\include") -LIB=$(shell echo "$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\platformsdk\lib;$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\lib") +export INCLUDE=$(shell echo "$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\include;$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\platformsdk\include") +export LIB=$(shell echo "$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\platformsdk\lib;$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\lib") PATH:=$(CONFIG_VISUAL_STUDIO_8_0_BASE_UNIX)/vc/bin:$(CONFIG_VISUAL_STUDIO_8_0_BASE_UNIX)/common7/ide:$(PATH) +stuff: + @echo $(INCLUDE) endif endif endif diff --git a/ssl/bigint.c b/ssl/bigint.c index 8a736cfeea..38823ce990 100644 --- a/ssl/bigint.c +++ b/ssl/bigint.c @@ -1497,7 +1497,7 @@ bigint *bi_mod_power2(BI_CTX *ctx, bigint *bi, bigint *bim, bigint *biexp) #ifdef CONFIG_BIGINT_CRT /** - * @Use the Chinese Remainder Theorem to quickly perform RSA decrypts. + * @brief Use the Chinese Remainder Theorem to quickly perform RSA decrypts. * * @param ctx [in] The bigint session context. * @param bi [in] The bigint to perform the exp/mod. diff --git a/ssl/ssl.h b/ssl/ssl.h index 05c9178575..83c6af7557 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -290,9 +290,9 @@ EXP_FUNC const uint8_t * STDCALL ssl_get_session_id(const SSL *ssl); /** * @brief Get the session id size for a handshake. * - * This will be 32 for a ssl server and may be something else for a ssl client. + * This will normally be 32 but could be 0 (no session id) or something else. * @param ssl [in] An SSL object reference. - * @return The number of valid bytes in a handshaking sequence + * @return The size of the session id. */ EXP_FUNC uint8_t STDCALL ssl_get_session_id_size(const SSL *ssl); diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 29fc621dbd..737e3d699e 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -689,7 +689,7 @@ static int client_socket_init(uint16_t port) if (connect(client_fd, (struct sockaddr *)&address, sizeof(address)) < 0) { perror("socket"); - close(client_fd); + SOCKET_CLOSE(client_fd); client_fd = -1; } @@ -841,7 +841,7 @@ static int SSL_server_test( /* we are ready to go */ ssl = ssl_server_new(ssl_ctx, client_fd); while ((size = ssl_read(ssl, &read_buf)) == SSL_OK); - close(client_fd); + SOCKET_CLOSE(client_fd); if (size < SSL_OK) /* got some alert or something nasty */ { @@ -869,7 +869,7 @@ static int SSL_server_test( ssl_free(ssl); } - close(server_fd); + SOCKET_CLOSE(server_fd); error: ssl_ctx_free(ssl_ctx); @@ -1294,7 +1294,7 @@ static int SSL_client_test( client_test_exit: ssl_free(ssl); - close(client_fd); + SOCKET_CLOSE(client_fd); usleep(200000); /* allow openssl to say something */ if (sess_resume) @@ -1484,7 +1484,7 @@ static void do_basic(void) error: ssl_ctx_free(ssl_clnt_ctx); - close(client_fd); + SOCKET_CLOSE(client_fd); /* exit this thread */ } @@ -1556,8 +1556,8 @@ static int SSL_basic_test(void) TTY_FLUSH(); ssl_free(ssl_svr); - close(server_fd); - close(client_fd); + SOCKET_CLOSE(server_fd); + SOCKET_CLOSE(client_fd); error: ssl_ctx_free(ssl_svr_ctx); @@ -1603,7 +1603,7 @@ void do_multi_clnt(multi_t *multi_data) client_test_exit: ssl_free(ssl); - close(client_fd); + SOCKET_CLOSE(client_fd); free(multi_data); } @@ -1622,7 +1622,7 @@ void do_multi_svr(SSL *ssl) { if (res == SSL_ERROR_CONN_LOST) { - close(ssl->client_fd); + SOCKET_CLOSE(ssl->client_fd); ssl_free(ssl); break; } @@ -1713,7 +1713,7 @@ int multi_thread_test(void) error: ssl_ctx_free(ssl_server_ctx); ssl_ctx_free(ssl_clnt_ctx); - close(server_fd); + SOCKET_CLOSE(server_fd); return res; } #endif diff --git a/ssl/test/test_axssl.sh b/ssl/test/test_axssl.sh index 44cd606206..2a8bceb8f7 100755 --- a/ssl/test/test_axssl.sh +++ b/ssl/test/test_axssl.sh @@ -24,7 +24,7 @@ # if grep "CONFIG_PLATFORM_WIN32=y" "../config/.config" > /dev/null; then - JAVA_EXE="/cygdrive/c/Program Files/Java/jdk1.5.0_06/bin/java.exe" + JAVA_EXE="$JAVA_HOME/bin/java.exe" PERL_BIN="/cygdrive/c/Perl/bin/perl" KILL_AXSSL="kill %1" KILL_CSHARP="kill %1" diff --git a/www/index.html b/www/index.html index 1fdb6b0d3f..9bb2ea50e1 100755 --- a/www/index.html +++ b/www/index.html @@ -7086,12 +7086,12 @@
    changes, notes and errata
    -
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n* Muliple records with a single header are now better supported.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    !GNU LESSER GENERAL PUBLIC LICENSE\n\nVersion 2.1, February 1999\n\nCopyright (C) 1991, 1999 Free Software Foundation, Inc.\n51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA\nEveryone is permitted to copy and distribute verbatim copies\nof this license document, but changing it is not allowed.\n\n[This is the first released version of the Lesser GPL. It also counts\n as the successor of the GNU Library Public License, version 2, hence\n the version number 2.1.]\n\n!!Preamble\n\nThe licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software -to make sure the software is free for all its users.\n\nThis license, the Lesser General Public License, applies to some specially designated software packages - typically libraries - of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below.\n\nWhen we speak of free software, we are referring to freedom of use, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish); that you receive source code or can get it if you want it; that you can change the software and use pieces of it in new free programs; and that you are informed that you can do these things.\n\nTo protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library or if you modify it.\n\nFor example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights.\n\nWe protect your rights with a two-step method: (1) we copyright the library, and (2) we offer you this license, which gives you legal permission to copy, distribute and/or modify the library.\n\nTo protect each distributor, we want to make it very clear that there is no warranty for the free library. Also, if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others.\n\nFinally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license.\n\nMost GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs.\n\nWhen a program is linked with a library, whether statically or using a shared library, the combination of the two is legally speaking a combined work, a derivative of the original library. The ordinary General Public License therefore permits such linking only if the entire combination fits its criteria of freedom. The Lesser General Public License permits more lax criteria for linking other code with the library.\n\nWe call this license the "Lesser" General Public License because it does Less to protect the user's freedom than the ordinary General Public License. It also provides other free software developers Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances.\n\nFor example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License.\n\nIn other cases, permission to use a particular library in non-free programs enables a greater number of people to use a large body of free software. For example, permission to use the GNU C Library in non-free programs enables many more people to use the whole GNU operating system, as well as its variant, the GNU/Linux operating system.\n\nAlthough the Lesser General Public License is Less protective of the users' freedom, it does ensure that the user of a program that is linked with the Library has the freedom and the wherewithal to run that program using a modified version of the Library.\n\nThe precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, whereas the latter must be combined with the library in order to run.\n\n!!TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION\n\n0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you".\n\nA "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables.\n\nThe "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".)\n\n"Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library.\n\nActivities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does.\n\n1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library.\n\nYou may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.\n\n2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:\n\n * a) The modified work must itself be a software library.\n * b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change.\n * c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License.\n * d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful.\n\n (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.)\n\n These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.\n\n Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library.\n\n In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.\n\n3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices.\n\nOnce this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy.\n\nThis option is useful when you wish to copy part of the code of the Library into a program that is not a library.\n\n4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange.\n\nIf distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.\n\n5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License.\n\nHowever, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables.\n\nWhen a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law.\n\nIf such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.)\n\nOtherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself.\n\n6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications.\n\nYou must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things:\n\n * a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.)\n * b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with.\n * c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.\n * d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place.\n * e) Verify that the user has already received a copy of these materials or that you have already sent this user a copy.\n\nFor an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the materials to be distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.\n\nIt may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute.\n\n7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things:\n\n * a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above.\n * b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work.\n\n8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.\n\n9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it.\n\n10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License.\n\n11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library.\n\nIf any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances.\n\nIt is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.\n\nThis section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.\n\n12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.\n\n13. The Free Software Foundation may publish revised and/or new versions of the Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.\n\nEach version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation.\n\n14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.\n\nNO WARRANTY\n\n15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.\n\nEND OF TERMS AND CONDITIONS
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    <div class='header' macro='gradient vert #390108 #900'>\n<div class='headerShadow'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n<div class='headerForeground'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n</div>\n<div id='mainMenu'>\n<div refresh='content' tiddler='MainMenu'></div>\n</div>\n<div id='sidebar'>\n<div id='sidebarOptions' refresh='content' tiddler='SideBarOptions'></div>\n<div id='sidebarTabs' refresh='content' force='true' tiddler='SideBarTabs'></div>\n</div>\n<div id='displayArea'>\n<div id='messageArea'></div>\n<div id='tiddlerDisplay'></div>\n</div>
    -
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly some stuff.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n* axssl.lua - Lua sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!!!!Lua\n\n{{indent{{{{> [lua] ./axssl.lua <options>}}}\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n* The lua sample requires the luabit library from http://luaforge.net/projects/bit.\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* The test harness appears to be broken under ~VC8.0. Debugging shows a problem in the _close() function which is weird. CGI is also broken under ~VC8.0.\n* CGI works under Win32, but needs some more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    +
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly some stuff.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n* axssl.lua - Lua sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!!!!Lua\n\n{{indent{{{{> [lua] ./axssl.lua <options>}}}\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n* The lua sample requires the luabit library from http://luaforge.net/projects/bit.\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* CGI has been removed from Win32 - it needs a lot more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    changes, notes and errata
    axTLS Embedded SSL
    http://axtls.cerocclub.com.au
    From 15651d6de5ded84c4936bb8261a7c173f89b4bab Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 10 Sep 2007 21:48:04 +0000 Subject: [PATCH 101/301] removed some mallocs git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@123 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/rsa.c | 20 +++++++++++++++----- ssl/tls1.c | 7 ++++++- 2 files changed, 21 insertions(+), 6 deletions(-) diff --git a/ssl/rsa.c b/ssl/rsa.c index 97c5e67007..bcfc310166 100644 --- a/ssl/rsa.c +++ b/ssl/rsa.c @@ -125,10 +125,14 @@ void RSA_free(RSA_CTX *rsa_ctx) int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data, uint8_t *out_data, int is_decryption) { - int byte_size = ctx->num_octets; - uint8_t *block; + const int byte_size = ctx->num_octets; int i, size; bigint *decrypted_bi, *dat_bi; +#ifndef WIN32 + uint8_t block[byte_size]; +#else + uint8_t *block = (uint8_t *)malloc(byte_size); +#endif memset(out_data, 0, byte_size); /* initialise */ @@ -142,7 +146,6 @@ int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data, #endif /* convert to a normal block */ - block = (uint8_t *)malloc(byte_size); bi_export(ctx->bi_ctx, decrypted_bi, block, byte_size); i = 10; /* start at the first possible non-padded byte */ @@ -166,7 +169,9 @@ int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data, if (size > 0) memcpy(out_data, &block[i], size); +#ifdef WIN32 free(block); +#endif return size ? size : -1; } @@ -253,11 +258,14 @@ int RSA_encrypt(const RSA_CTX *ctx, const uint8_t *in_data, uint16_t in_len, bigint *RSA_sign_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, bigint *modulus, bigint *pub_exp) { - uint8_t *block; int i, size; bigint *decrypted_bi, *dat_bi; bigint *bir = NULL; - block = (uint8_t *)malloc(sig_len); +#ifndef WIN32 + uint8_t block[sig_len]; +#else + uint8_t *block = (uint8_t *)malloc(sig_len); +#endif /* decrypt */ dat_bi = bi_import(ctx, sig, sig_len); @@ -285,7 +293,9 @@ bigint *RSA_sign_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, } } +#ifdef WIN32 free(block); +#endif return bir; } diff --git a/ssl/tls1.c b/ssl/tls1.c index de5597fbd4..0e2ced092d 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -623,7 +623,11 @@ static void add_hmac_digest(SSL *ssl, int mode, uint8_t *hmac_header, const uint8_t *buf, int buf_len, uint8_t *hmac_buf) { int hmac_len = buf_len + 8 + SSL_RECORD_SIZE; +#ifndef WIN32 + uint8_t t_buf[hmac_len+10]; +#else uint8_t *t_buf = (uint8_t *)malloc(hmac_len+10); +#endif memcpy(t_buf, (mode == SSL_SERVER_WRITE || mode == SSL_CLIENT_WRITE) ? ssl->write_sequence : ssl->read_sequence, 8); @@ -659,8 +663,9 @@ static void add_hmac_digest(SSL *ssl, int mode, uint8_t *hmac_header, } print_blob("hmac", hmac_buf, SHA1_SIZE); #endif - +#ifdef WIN32 free(t_buf); +#endif } /** From 7cd4ea1b95f9b8d9ac46d586b8316098dfc1a2cf Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 12 Sep 2007 07:26:00 +0000 Subject: [PATCH 102/301] css + added strip option git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@124 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/Config.in | 7 +++++++ config/makefile.conf | 2 +- httpd/Makefile | 4 +--- httpd/proc.c | 9 +++++++-- samples/c/Makefile | 6 ++---- ssl/Makefile | 2 +- ssl/test/ssltest.c | 2 +- 7 files changed, 20 insertions(+), 12 deletions(-) diff --git a/config/Config.in b/config/Config.in index c68e95a664..f434bde45e 100644 --- a/config/Config.in +++ b/config/Config.in @@ -48,6 +48,13 @@ config CONFIG_DEBUG Most people should answer N. +config CONFIG_STRIP_UNWANTED_SECTIONS + depends on !CONFIG_PLATFORM_WIN32 && !CONFIG_DEBUG + bool "Strip unwanted sections from elf binaries" + default y + help + Strip unwanted sections from the resulting binaries + menu "Microsoft Compiler Options" depends on CONFIG_PLATFORM_WIN32 diff --git a/config/makefile.conf b/config/makefile.conf index e19b565631..4255dbe46a 100644 --- a/config/makefile.conf +++ b/config/makefile.conf @@ -89,7 +89,7 @@ LDSHARED = -shared # Linux ifndef CONFIG_PLATFORM_CYGWIN -CFLAGS += -fPIC +# CFLAGS += -fPIC # Cygwin else diff --git a/httpd/Makefile b/httpd/Makefile index 57dabb6b17..bbc72274bf 100644 --- a/httpd/Makefile +++ b/httpd/Makefile @@ -84,11 +84,9 @@ ifndef CONFIG_PLATFORM_WIN32 $(TARGET): $(OBJ) $(AXTLS_HOME)/$(STAGE)/libaxtls.a $(LD) $(LDFLAGS) -o $@ $(OBJ) $(LIBS) -ifndef CONFIG_DEBUG -ifndef CONFIG_PLATFORM_SOLARIS +ifdef CONFIG_STRIP_UNWANTED_SECTIONS strip --remove-section=.comment $(TARGET) endif -endif $(TARGET2): htpasswd.o $(AXTLS_HOME)/$(STAGE)/libaxtls.a $(LD) $(LDFLAGS) -o $@ htpasswd.o $(LIBS) diff --git a/httpd/proc.c b/httpd/proc.c index 8a760039ee..32127e8623 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -1026,8 +1026,13 @@ static void send_error(struct connstruct *cn, int err) static const char *getmimetype(const char *name) { - /* only bother with two types - let the browser/OS figure the rest out */ - return strstr(name, ".htm") ? "text/html" : "application/octet-stream"; + /* only bother with a few mime types - let the browser figure the rest out */ + if (strstr(name, ".htm")) + return "text/html"; + else if (strstr(name, ".css")) + return "text/css"; + else + return "application/octet-stream"; } static int special_write(struct connstruct *cn, diff --git a/samples/c/Makefile b/samples/c/Makefile index 3fecbe66fa..c1cdb4c6e8 100644 --- a/samples/c/Makefile +++ b/samples/c/Makefile @@ -48,11 +48,9 @@ ifndef CONFIG_PLATFORM_WIN32 $(TARGET): $(OBJ) $(LIBS)/libaxtls.a $(LD) $(LDFLAGS) -o $@ $(OBJ) -L$(LIBS) -laxtls -ifndef CONFIG_DEBUG -ifndef CONFIG_PLATFORM_SOLARIS +ifdef CONFIG_STRIP_UNWANTED_SECTIONS strip --remove-section=.comment $(TARGET) -endif # SOLARIS -endif # CONFIG_DEBUG +endif # use strip else # Win32 $(TARGET): $(OBJ) diff --git a/ssl/Makefile b/ssl/Makefile index 2ad87021d7..d0bfc11497 100644 --- a/ssl/Makefile +++ b/ssl/Makefile @@ -42,7 +42,7 @@ endif # shared library major/minor numbers LIBMAJOR=$(BASETARGET).1 -LIBMINOR=$(BASETARGET).1.1 +LIBMINOR=$(BASETARGET).1.2 else TARGET1=$(AXTLS_HOME)/axtls.lib TARGET2=$(AXTLS_HOME)/$(STAGE)/axtls.dll diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 737e3d699e..469be5141c 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1735,7 +1735,7 @@ static void do_header_issue(void) static int header_issue(void) { FILE *f = fopen("../ssl/test/header_issue.dat", "r"); - int server_fd, client_fd, ret = 1; + int server_fd = -1, client_fd = -1, ret = 1; uint8_t buf[2048]; int size = 0; struct sockaddr_in client_addr; From 7c7e89b540304bfc0b62d6e8e760d0b426ba15c4 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 16 Sep 2007 11:28:22 +0000 Subject: [PATCH 103/301] added md2 git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@125 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/Makefile | 1 + crypto/crypto.h | 28 +++++++-- crypto/md2.c | 142 +++++++++++++++++++++++++++++++++++++++++++++ ssl/Makefile | 1 + ssl/test/ssltest.c | 4 +- ssl/x509.c | 9 +++ 6 files changed, 176 insertions(+), 9 deletions(-) create mode 100644 crypto/md2.c diff --git a/crypto/Makefile b/crypto/Makefile index 2f69f1e491..b449a3f86a 100644 --- a/crypto/Makefile +++ b/crypto/Makefile @@ -24,6 +24,7 @@ AXTLS_HOME=.. OBJ=\ aes.o \ hmac.o \ + md2.o \ md5.o \ rc4.o \ sha1.o diff --git a/crypto/crypto.h b/crypto/crypto.h index ad49646c09..e45c717b57 100644 --- a/crypto/crypto.h +++ b/crypto/crypto.h @@ -82,11 +82,11 @@ void RC4_crypt(RC4_CTX *s, const uint8_t *msg, uint8_t *data, int length); */ typedef struct { - uint32_t Intermediate_Hash[SHA1_SIZE/4]; /* Message Digest */ - uint32_t Length_Low; /* Message length in bits */ - uint32_t Length_High; /* Message length in bits */ + uint32_t Intermediate_Hash[SHA1_SIZE/4]; /* Message Digest */ + uint32_t Length_Low; /* Message length in bits */ + uint32_t Length_High; /* Message length in bits */ uint16_t Message_Block_Index; /* Index into message block array */ - uint8_t Message_Block[64]; /* 512-bit message blocks */ + uint8_t Message_Block[64]; /* 512-bit message blocks */ } SHA1_CTX; void SHA1_Init(SHA1_CTX *); @@ -94,10 +94,26 @@ void SHA1_Update(SHA1_CTX *, const uint8_t * msg, int len); void SHA1_Final(uint8_t *digest, SHA1_CTX *); /************************************************************************** - * MD5 declarations + * MD2 declarations **************************************************************************/ -/* MD5 context. */ +#define MD2_SIZE 16 + +typedef struct +{ + unsigned char cksum[16]; /* checksum of the data block */ + unsigned char state[48]; /* intermediate digest state */ + unsigned char buffer[16]; /* data block being processed */ + int left; /* amount of data in buffer */ +} MD2_CTX; + +EXP_FUNC void STDCALL MD2_Init(MD2_CTX *ctx); +EXP_FUNC void STDCALL MD2_Update(MD2_CTX *ctx, const uint8_t *input, int ilen); +EXP_FUNC void STDCALL MD2_Final(uint8_t *digest, MD2_CTX *ctx); + +/************************************************************************** + * MD5 declarations + **************************************************************************/ #define MD5_SIZE 16 diff --git a/crypto/md2.c b/crypto/md2.c new file mode 100644 index 0000000000..7ee3b91fc6 --- /dev/null +++ b/crypto/md2.c @@ -0,0 +1,142 @@ +/* + * RFC 1115/1319 compliant MD2 implementation + * + * Copyright (C) 2006-2007 Christophe Devine + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License, version 2.1 as published by the Free Software Foundation. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, + * MA 02110-1301 USA + */ +/* + * The MD2 algorithm was designed by Ron Rivest in 1989. + * + * http://www.ietf.org/rfc/rfc1115.txt + * http://www.ietf.org/rfc/rfc1319.txt + */ + +#include +#include + +#include "crypto.h" + +static const unsigned char PI_SUBST[256] = +{ + 0x29, 0x2E, 0x43, 0xC9, 0xA2, 0xD8, 0x7C, 0x01, 0x3D, 0x36, + 0x54, 0xA1, 0xEC, 0xF0, 0x06, 0x13, 0x62, 0xA7, 0x05, 0xF3, + 0xC0, 0xC7, 0x73, 0x8C, 0x98, 0x93, 0x2B, 0xD9, 0xBC, 0x4C, + 0x82, 0xCA, 0x1E, 0x9B, 0x57, 0x3C, 0xFD, 0xD4, 0xE0, 0x16, + 0x67, 0x42, 0x6F, 0x18, 0x8A, 0x17, 0xE5, 0x12, 0xBE, 0x4E, + 0xC4, 0xD6, 0xDA, 0x9E, 0xDE, 0x49, 0xA0, 0xFB, 0xF5, 0x8E, + 0xBB, 0x2F, 0xEE, 0x7A, 0xA9, 0x68, 0x79, 0x91, 0x15, 0xB2, + 0x07, 0x3F, 0x94, 0xC2, 0x10, 0x89, 0x0B, 0x22, 0x5F, 0x21, + 0x80, 0x7F, 0x5D, 0x9A, 0x5A, 0x90, 0x32, 0x27, 0x35, 0x3E, + 0xCC, 0xE7, 0xBF, 0xF7, 0x97, 0x03, 0xFF, 0x19, 0x30, 0xB3, + 0x48, 0xA5, 0xB5, 0xD1, 0xD7, 0x5E, 0x92, 0x2A, 0xAC, 0x56, + 0xAA, 0xC6, 0x4F, 0xB8, 0x38, 0xD2, 0x96, 0xA4, 0x7D, 0xB6, + 0x76, 0xFC, 0x6B, 0xE2, 0x9C, 0x74, 0x04, 0xF1, 0x45, 0x9D, + 0x70, 0x59, 0x64, 0x71, 0x87, 0x20, 0x86, 0x5B, 0xCF, 0x65, + 0xE6, 0x2D, 0xA8, 0x02, 0x1B, 0x60, 0x25, 0xAD, 0xAE, 0xB0, + 0xB9, 0xF6, 0x1C, 0x46, 0x61, 0x69, 0x34, 0x40, 0x7E, 0x0F, + 0x55, 0x47, 0xA3, 0x23, 0xDD, 0x51, 0xAF, 0x3A, 0xC3, 0x5C, + 0xF9, 0xCE, 0xBA, 0xC5, 0xEA, 0x26, 0x2C, 0x53, 0x0D, 0x6E, + 0x85, 0x28, 0x84, 0x09, 0xD3, 0xDF, 0xCD, 0xF4, 0x41, 0x81, + 0x4D, 0x52, 0x6A, 0xDC, 0x37, 0xC8, 0x6C, 0xC1, 0xAB, 0xFA, + 0x24, 0xE1, 0x7B, 0x08, 0x0C, 0xBD, 0xB1, 0x4A, 0x78, 0x88, + 0x95, 0x8B, 0xE3, 0x63, 0xE8, 0x6D, 0xE9, 0xCB, 0xD5, 0xFE, + 0x3B, 0x00, 0x1D, 0x39, 0xF2, 0xEF, 0xB7, 0x0E, 0x66, 0x58, + 0xD0, 0xE4, 0xA6, 0x77, 0x72, 0xF8, 0xEB, 0x75, 0x4B, 0x0A, + 0x31, 0x44, 0x50, 0xB4, 0x8F, 0xED, 0x1F, 0x1A, 0xDB, 0x99, + 0x8D, 0x33, 0x9F, 0x11, 0x83, 0x14 +}; + +/* + * MD2 context setup + */ +EXP_FUNC void STDCALL MD2_Init(MD2_CTX *ctx) +{ + memset(ctx, 0, sizeof *ctx); +} + +static void md2_process(MD2_CTX *ctx) +{ + int i, j; + unsigned char t = 0; + + for (i = 0; i < 16; i++) + { + ctx->state[i + 16] = ctx->buffer[i]; + ctx->state[i + 32] = ctx->buffer[i] ^ ctx->state[i]; + } + + for (i = 0; i < 18; i++) + { + for (j = 0; j < 48; j++) + t = (ctx->state[j] ^= PI_SUBST[t]); + + t = (t + i) & 0xFF; + } + + t = ctx->cksum[15]; + + for (i = 0; i < 16; i++) + t = (ctx->cksum[i] ^= PI_SUBST[ctx->buffer[i] ^ t]); +} + +/* + * MD2 process buffer + */ +EXP_FUNC void STDCALL MD2_Update(MD2_CTX *ctx, const uint8_t *input, int ilen) +{ + int fill; + + while (ilen > 0) + { + if (ctx->left + ilen > 16) + fill = 16 - ctx->left; + else + fill = ilen; + + memcpy(ctx->buffer + ctx->left, input, fill); + + ctx->left += fill; + input += fill; + ilen -= fill; + + if (ctx->left == 16) + { + ctx->left = 0; + md2_process(ctx); + } + } +} + +/* + * MD2 final digest + */ +EXP_FUNC void STDCALL MD2_Final(uint8_t *output, MD2_CTX *ctx) +{ + int i; + uint8_t x; + + x = (uint8_t)(16 - ctx->left); + + for (i = ctx->left; i < 16; i++) + ctx->buffer[i] = x; + + md2_process(ctx); + + memcpy(ctx->buffer, ctx->cksum, 16); + md2_process(ctx); + + memcpy(output, ctx->state, 16); +} diff --git a/ssl/Makefile b/ssl/Makefile index d0bfc11497..2dcbeceec9 100644 --- a/ssl/Makefile +++ b/ssl/Makefile @@ -55,6 +55,7 @@ libs: $(TARGET1) $(TARGET2) CRYPTO_OBJ=\ $(CRYPTO_PATH)aes.o \ $(CRYPTO_PATH)hmac.o \ + $(CRYPTO_PATH)md2.o \ $(CRYPTO_PATH)md5.o \ $(CRYPTO_PATH)rc4.o \ $(CRYPTO_PATH)sha1.o diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 469be5141c..b91c5fe89e 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -604,11 +604,9 @@ static int cert_tests(void) ssl_ctx_free(ssl_ctx); free(buf); - /* Verisign use MD2 which is not supported */ ssl_ctx = ssl_ctx_new(0, 0); len = get_file("../ssl/test/verisign.x509_ca", &buf); - if ((res = add_cert_auth(ssl_ctx, buf, len)) != - X509_VFY_ERROR_UNSUPPORTED_DIGEST) + if ((res = add_cert_auth(ssl_ctx, buf, len)) <0) { printf("Cert #7\n"); ssl_display_error(res); diff --git a/ssl/x509.c b/ssl/x509.c index 32e19fdbb0..85110951b5 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -126,6 +126,15 @@ int x509_new(const uint8_t *cert, int *len, X509_CTX **ctx) SHA1_Final(sha_dgst, &sha_ctx); x509_ctx->digest = bi_import(bi_ctx, sha_dgst, SHA1_SIZE); } + else if (x509_ctx->sig_type == SIG_TYPE_MD2) + { + MD2_CTX md2_ctx; + uint8_t md2_dgst[MD2_SIZE]; + MD2_Init(&md2_ctx); + MD2_Update(&md2_ctx, &cert[begin_tbs], end_tbs-begin_tbs); + MD2_Final(md2_dgst, &md2_ctx); + x509_ctx->digest = bi_import(bi_ctx, md2_dgst, MD2_SIZE); + } offset = end_tbs; /* skip the v3 data */ if (asn1_skip_obj(cert, &offset, ASN1_SEQUENCE) || From 1d263c9ab461aebbb42fda62a0bebb6caf91b89c Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 17 Sep 2007 03:29:50 +0000 Subject: [PATCH 104/301] fixed POST issues in axhttpd git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@126 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 3 +- httpd/axhttp.h | 7 +- httpd/axhttpd.c | 19 +++++ httpd/proc.c | 181 +++++++++++++++++++++++++++++++++++++++++++++--- 4 files changed, 199 insertions(+), 11 deletions(-) diff --git a/Makefile b/Makefile index e979eb1c75..4771e6f1c7 100644 --- a/Makefile +++ b/Makefile @@ -60,7 +60,8 @@ release: $(MAKE) -C config/scripts/config clean -$(MAKE) clean -@rm config/*.msi config/*.back.aip config/config.h config/.config* - @rm -fr $(STAGE) + -@rm www/index.20* + -@rm -fr $(STAGE) @echo "#define AXTLS_VERSION \"$(VERSION)\"" > ssl/version.h cd ../; tar cvfz $(RELEASE).tar.gz --wildcards-match-slash --exclude .svn axTLS; cd -; diff --git a/httpd/axhttp.h b/httpd/axhttp.h index 8b05d3e03c..affe5e051e 100644 --- a/httpd/axhttp.h +++ b/httpd/axhttp.h @@ -24,7 +24,7 @@ #ifdef CONFIG_HTTP_HAS_IPV6 #define HAVE_IPV6 #endif - +#define MAXPOSTDATASIZE 30000 #define MAXREQUESTLENGTH 256 #define BLOCKSIZE 4096 @@ -88,6 +88,9 @@ struct connstruct #if defined(CONFIG_HTTP_HAS_AUTHORIZATION) char authorization[MAXREQUESTLENGTH]; #endif + int post_read; + int post_state; + char *post_data; }; struct serverstruct @@ -125,7 +128,7 @@ void procreadhead(struct connstruct *cn); void procsendhead(struct connstruct *cn); void procreadfile(struct connstruct *cn); void procsendfile(struct connstruct *cn); - +void read_post_data(struct connstruct *cn); /* misc.c prototypes */ char *my_strncpy(char *dest, const char *src, size_t n); diff --git a/httpd/axhttpd.c b/httpd/axhttpd.c index c67c08eca6..c594e8f859 100644 --- a/httpd/axhttpd.c +++ b/httpd/axhttpd.c @@ -24,6 +24,20 @@ #include #include "axhttp.h" +#if AXDEBUG +#define AXDEBUGSTART \ + { \ + FILE *dout; \ + dout = fopen("/var/log/axdebug", "a"); \ + +#define AXDEBUGEND \ + fclose(dout); \ + } +#else /* AXDEBUG */ +#define AXDEBUGSTART +#define AXDEBUGEND +#endif /* AXDEBUG */ + struct serverstruct *servers; struct connstruct *usedconns; struct connstruct *freeconns; @@ -161,6 +175,7 @@ int main(int argc, char *argv[]) #if defined(CONFIG_HTTP_HAS_CGI) addcgiext(CONFIG_HTTP_CGI_EXTENSIONS); + printf("addcgiext %s\n",CONFIG_HTTP_CGI_EXTENSIONS); #endif #if defined(CONFIG_HTTP_VERBOSE) printf("%s: listening on ports %d (http) and %d (https)\n", @@ -176,6 +191,7 @@ int main(int argc, char *argv[]) setuid(32767); #endif #ifdef CONFIG_HTTP_IS_DAEMON + fprintf(stderr, "ERR: fork is not working on uclinux\n"); if (fork() > 0) /* parent will die */ exit(0); @@ -283,6 +299,9 @@ int main(int argc, char *argv[]) FD_ISSET(to->networkdesc, &rfds)) { active--; + if (to->post_state) + read_post_data(to); + else procreadhead(to); } diff --git a/httpd/proc.c b/httpd/proc.c index 32127e8623..2333bc6571 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -54,6 +54,20 @@ static void decode_path_info(struct connstruct *cn, char *path_info); static int auth_check(struct connstruct *cn); #endif +#if AXDEBUG +#define AXDEBUGSTART \ + { \ + FILE *axdout; \ + axdout = fopen("/var/log/axdebug", "a"); \ + +#define AXDEBUGEND \ + fclose(axdout); \ + } +#else /* AXDEBUG */ +#define AXDEBUGSTART +#define AXDEBUGEND +#endif /* AXDEBUG */ + /* Returns 1 if elems should continue being read, 0 otherwise */ static int procheadelem(struct connstruct *cn, char *buf) { @@ -267,11 +281,113 @@ static void urlencode(const uint8_t *s, char *t) #endif +int init_read_post_data(char *buf, char *data, struct connstruct *cn, int old_rv) +{ + char *next; + int rv; + char *post_data; + + rv=old_rv; + next=data; + + /* Too much Post data to send. MAXPOSTDATASIZE should be + configured (now it can be chaged in the header file) */ + if (cn->content_length > MAXPOSTDATASIZE) + { + send_error(cn, 418); + return 0; + } + + /* remove CRLF */ + while ((*next == '\r' || *next == '\n') && (next < &buf[rv])) + next++; + + if (cn->post_data == NULL) + { + cn->post_data = (char *) calloc(1, (cn->content_length + 1)); + /* Allocate buffer for the POST data that will be used by proccgi + to send POST data to the CGI script */ + + if (cn->post_data == NULL) + { + printf("axhttpd: could not allocate memory for POST data\n"); + TTY_FLUSH(); + send_error(cn, 599); + return 0; + } + } + + cn->post_state = 0; + cn->post_read = 0; + post_data = cn->post_data; + + while (next < &buf[rv]) + { + /*copy POST data to buffer*/ + *post_data = *next; + post_data++; + next++; + cn->post_read++; + if (cn->post_read == cn->content_length) + { + /* No more POST data to be copied */ + *post_data = '\0'; + return 1; + } + } + + /* More POST data has to be read. read_post_data will continue with that */ + cn->post_state = 1; + return 0; +} + +void read_post_data(struct connstruct *cn) +{ + char buf[MAXREQUESTLENGTH*4], *next; + char *post_data; + int rv; + + bzero(buf,MAXREQUESTLENGTH*4); + rv = special_read(cn, buf, sizeof(buf)-1); + if (rv <= 0) + { + if (rv < 0) /* really dead? */ + removeconnection(cn); + return; + } + + buf[rv] = '\0'; + next = buf; + + post_data = &cn->post_data[cn->post_read]; + + while (next < &buf[rv]) + { + *post_data = *next; + post_data++; + next++; + cn->post_read++; + if (cn->post_read == cn->content_length) + { + /* No more POST data to be copied */ + *post_data='\0'; + cn->post_state = 0; + buildactualfile(cn); + cn->state = STATE_WANT_TO_SEND_HEAD; + return; + } + } + + /* More POST data to read */ +} + + void procreadhead(struct connstruct *cn) { char buf[MAXREQUESTLENGTH*4], *tp, *next; int rv; + bzero(buf,MAXREQUESTLENGTH*4); rv = special_read(cn, buf, sizeof(buf)-1); if (rv <= 0) { @@ -293,6 +409,12 @@ void procreadhead(struct connstruct *cn) /* If we have a blank line, advance to next stage */ if (*next == '\r' || *next == '\n') { + if ((cn->reqtype == TYPE_POST)&&(cn->content_length > 0)) + { + if (init_read_post_data(buf,next,cn,rv) == 0) + return; + } + buildactualfile(cn); cn->state = STATE_WANT_TO_SEND_HEAD; return; @@ -349,6 +471,7 @@ void procsendhead(struct connstruct *cn) file_exists = stat(cn->actualfile, &stbuf); #if defined(CONFIG_HTTP_HAS_CGI) + if (file_exists != -1 && cn->is_cgi) { if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) @@ -503,12 +626,13 @@ void procsendfile(struct connstruct *cn) static void proccgi(struct connstruct *cn) { - int tpipe[2]; + int tpipe[2], spipe[2]; char *myargs[2]; char cgienv[CGI_ARG_SIZE][MAXREQUESTLENGTH]; char * cgiptr[CGI_ARG_SIZE+4]; const char *type = "HEAD"; int cgi_index = 0, i; + pid_t pid; #ifdef WIN32 int tmp_stdout; #endif @@ -531,10 +655,41 @@ static void proccgi(struct connstruct *cn) /* win32 cgi is a bit too painful */ #ifndef WIN32 - pipe(tpipe); + /* set up pipe that is used for sending POST query data to CGI script*/ + if (cn->reqtype == TYPE_POST) + { + if (pipe(spipe) == -1) + { + printf("[CGI]: could not create pipe"); + TTY_FLUSH(); + return; + } + } - if (fork() > 0) /* parent */ + if (pipe(tpipe) == -1) + { + printf("[CGI]: could not create pipe"); + TTY_FLUSH(); + return; + } +#ifdef EMBED + if ((pid = vfork()) > 0) /* parent */ +#else + if ((pid = fork()) > 0) /* parent */ +#endif { + /* Send POST query data to CGI script */ + if ((cn->reqtype == TYPE_POST) && (cn->content_length > 0)) + { + write(spipe[1], cn->post_data, cn->content_length); + close(spipe[0]); + close(spipe[1]); + + /* free the memory that is allocated in read_post_data() */ + free(cn->post_data); + cn->post_data = NULL; + } + /* Close the write descriptor */ close(tpipe[1]); cn->filedesc = tpipe[0]; @@ -543,6 +698,9 @@ static void proccgi(struct connstruct *cn) return; } + if (pid < 0) /* fork failed */ + exit(1); + /* The problem child... */ /* Our stdout/stderr goes to the socket */ @@ -551,13 +709,10 @@ static void proccgi(struct connstruct *cn) /* If it was a POST request, send the socket data to our stdin */ if (cn->reqtype == TYPE_POST) - dup2(cn->networkdesc, 0); + dup2(spipe[0], 0); else /* Otherwise we can shutdown the read side of the sock */ shutdown(cn->networkdesc, 0); - close(tpipe[0]); - close(tpipe[1]); - myargs[0] = cn->actualfile; myargs[1] = NULL; @@ -617,7 +772,7 @@ static void proccgi(struct connstruct *cn) if (cgi_index >= CGI_ARG_SIZE) { printf("Content-type: text/plain\n\nToo many CGI args\n"); - return; + exit(1); } /* copy across the pointer indexes */ @@ -631,6 +786,7 @@ static void proccgi(struct connstruct *cn) execve(myargs[0], myargs, cgiptr); printf("Content-type: text/plain\n\nshouldn't get here\n"); + exit(1); #endif } @@ -815,10 +971,14 @@ static void buildactualfile(struct connstruct *cn) if (cn->is_lua) #ifdef CONFIG_PLATFORM_CYGWIN sprintf(cn->actualfile, "%s/bin/cgi.exe", CONFIG_HTTP_LUA_PREFIX); +#else +#ifdef EMBED + sprintf(cn->actualfile, "%s", CONFIG_HTTP_LUA_PREFIX); #else sprintf(cn->actualfile, "%s/bin/cgi", CONFIG_HTTP_LUA_PREFIX); #endif #endif +#endif } static int sanitizefile(const char *buf) @@ -1007,6 +1167,11 @@ static void send_error(struct connstruct *cn, int err) text = title; break; + case 418: + title = "POST data size is to large"; + text = title; + break; + default: title = "Unknown"; text = "Unknown"; From 69003c01acc871a007b7dbc1bae36cca944b5d7e Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 17 Sep 2007 05:46:43 +0000 Subject: [PATCH 105/301] added vfork() git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@127 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/Config.in | 9 +++++++++ httpd/axhttp.h | 1 + httpd/axhttpd.c | 6 ++++-- httpd/proc.c | 25 +++++++++---------------- www/index.html | 2 +- 5 files changed, 24 insertions(+), 19 deletions(-) diff --git a/httpd/Config.in b/httpd/Config.in index d7f8aba59f..512aa33e73 100644 --- a/httpd/Config.in +++ b/httpd/Config.in @@ -89,6 +89,15 @@ config CONFIG_HTTP_LUA_PREFIX The location of Lua's installation prefix. This is also necessary for Lua's cgi launcher application. +config CONFIG_HTTP_LUA_CGI_LAUNCHER + string "CGI launcher location" + default "/bin/cgi.exe" if CONFIG_PLATFORM_CYGWIN + default "/bin/cgi" if !CONFIG_PLATFORM_CYGWIN + depends on CONFIG_HTTP_ENABLE_LUA + help + The location of LUA's CGI launcher application (after + the CONFIG_HTTP_LUA_PREFIX) + config CONFIG_HTTP_BUILD_LUA bool "Build Lua" default n diff --git a/httpd/axhttp.h b/httpd/axhttp.h index affe5e051e..439fd91273 100644 --- a/httpd/axhttp.h +++ b/httpd/axhttp.h @@ -24,6 +24,7 @@ #ifdef CONFIG_HTTP_HAS_IPV6 #define HAVE_IPV6 #endif + #define MAXPOSTDATASIZE 30000 #define MAXREQUESTLENGTH 256 #define BLOCKSIZE 4096 diff --git a/httpd/axhttpd.c b/httpd/axhttpd.c index c594e8f859..2f5fd19bfe 100644 --- a/httpd/axhttpd.c +++ b/httpd/axhttpd.c @@ -175,9 +175,12 @@ int main(int argc, char *argv[]) #if defined(CONFIG_HTTP_HAS_CGI) addcgiext(CONFIG_HTTP_CGI_EXTENSIONS); - printf("addcgiext %s\n",CONFIG_HTTP_CGI_EXTENSIONS); #endif + #if defined(CONFIG_HTTP_VERBOSE) +#if defined(CONFIG_HTTP_HAS_CGI) + printf("addcgiext %s\n", CONFIG_HTTP_CGI_EXTENSIONS); +#endif printf("%s: listening on ports %d (http) and %d (https)\n", server_version, CONFIG_HTTP_PORT, CONFIG_HTTP_HTTPS_PORT); TTY_FLUSH(); @@ -191,7 +194,6 @@ int main(int argc, char *argv[]) setuid(32767); #endif #ifdef CONFIG_HTTP_IS_DAEMON - fprintf(stderr, "ERR: fork is not working on uclinux\n"); if (fork() > 0) /* parent will die */ exit(0); diff --git a/httpd/proc.c b/httpd/proc.c index 2333bc6571..e995fbbd1d 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -672,11 +672,11 @@ static void proccgi(struct connstruct *cn) TTY_FLUSH(); return; } -#ifdef EMBED + + /* + * use vfork() instead of fork() for performance + */ if ((pid = vfork()) > 0) /* parent */ -#else - if ((pid = fork()) > 0) /* parent */ -#endif { /* Send POST query data to CGI script */ if ((cn->reqtype == TYPE_POST) && (cn->content_length > 0)) @@ -698,7 +698,7 @@ static void proccgi(struct connstruct *cn) return; } - if (pid < 0) /* fork failed */ + if (pid < 0) /* vfork failed */ exit(1); /* The problem child... */ @@ -772,7 +772,7 @@ static void proccgi(struct connstruct *cn) if (cgi_index >= CGI_ARG_SIZE) { printf("Content-type: text/plain\n\nToo many CGI args\n"); - exit(1); + _exit(1); } /* copy across the pointer indexes */ @@ -786,7 +786,7 @@ static void proccgi(struct connstruct *cn) execve(myargs[0], myargs, cgiptr); printf("Content-type: text/plain\n\nshouldn't get here\n"); - exit(1); + _exit(1); #endif } @@ -969,15 +969,8 @@ static void buildactualfile(struct connstruct *cn) * end as we need the directory name. */ if (cn->is_lua) -#ifdef CONFIG_PLATFORM_CYGWIN - sprintf(cn->actualfile, "%s/bin/cgi.exe", CONFIG_HTTP_LUA_PREFIX); -#else -#ifdef EMBED - sprintf(cn->actualfile, "%s", CONFIG_HTTP_LUA_PREFIX); -#else - sprintf(cn->actualfile, "%s/bin/cgi", CONFIG_HTTP_LUA_PREFIX); -#endif -#endif + sprintf(cn->actualfile, "%s%s", CONFIG_HTTP_LUA_PREFIX, + CONFIG_HTTP_LUA_CGI_LAUNCHER); #endif } diff --git a/www/index.html b/www/index.html index 9bb2ea50e1..afe43485a3 100755 --- a/www/index.html +++ b/www/index.html @@ -7086,7 +7086,7 @@
    changes, notes and errata
    -
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n* Muliple records with a single header are now better supported.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n* Muliple records with a single header are now better supported.\n* ~MD2 added for Verisign root cert verification.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* vfork() is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    !GNU LESSER GENERAL PUBLIC LICENSE\n\nVersion 2.1, February 1999\n\nCopyright (C) 1991, 1999 Free Software Foundation, Inc.\n51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA\nEveryone is permitted to copy and distribute verbatim copies\nof this license document, but changing it is not allowed.\n\n[This is the first released version of the Lesser GPL. It also counts\n as the successor of the GNU Library Public License, version 2, hence\n the version number 2.1.]\n\n!!Preamble\n\nThe licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software -to make sure the software is free for all its users.\n\nThis license, the Lesser General Public License, applies to some specially designated software packages - typically libraries - of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below.\n\nWhen we speak of free software, we are referring to freedom of use, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish); that you receive source code or can get it if you want it; that you can change the software and use pieces of it in new free programs; and that you are informed that you can do these things.\n\nTo protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library or if you modify it.\n\nFor example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights.\n\nWe protect your rights with a two-step method: (1) we copyright the library, and (2) we offer you this license, which gives you legal permission to copy, distribute and/or modify the library.\n\nTo protect each distributor, we want to make it very clear that there is no warranty for the free library. Also, if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others.\n\nFinally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license.\n\nMost GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs.\n\nWhen a program is linked with a library, whether statically or using a shared library, the combination of the two is legally speaking a combined work, a derivative of the original library. The ordinary General Public License therefore permits such linking only if the entire combination fits its criteria of freedom. The Lesser General Public License permits more lax criteria for linking other code with the library.\n\nWe call this license the "Lesser" General Public License because it does Less to protect the user's freedom than the ordinary General Public License. It also provides other free software developers Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances.\n\nFor example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License.\n\nIn other cases, permission to use a particular library in non-free programs enables a greater number of people to use a large body of free software. For example, permission to use the GNU C Library in non-free programs enables many more people to use the whole GNU operating system, as well as its variant, the GNU/Linux operating system.\n\nAlthough the Lesser General Public License is Less protective of the users' freedom, it does ensure that the user of a program that is linked with the Library has the freedom and the wherewithal to run that program using a modified version of the Library.\n\nThe precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, whereas the latter must be combined with the library in order to run.\n\n!!TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION\n\n0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you".\n\nA "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables.\n\nThe "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".)\n\n"Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library.\n\nActivities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does.\n\n1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library.\n\nYou may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.\n\n2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:\n\n * a) The modified work must itself be a software library.\n * b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change.\n * c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License.\n * d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful.\n\n (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.)\n\n These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.\n\n Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library.\n\n In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.\n\n3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices.\n\nOnce this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy.\n\nThis option is useful when you wish to copy part of the code of the Library into a program that is not a library.\n\n4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange.\n\nIf distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.\n\n5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License.\n\nHowever, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables.\n\nWhen a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law.\n\nIf such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.)\n\nOtherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself.\n\n6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications.\n\nYou must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things:\n\n * a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.)\n * b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with.\n * c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.\n * d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place.\n * e) Verify that the user has already received a copy of these materials or that you have already sent this user a copy.\n\nFor an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the materials to be distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.\n\nIt may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute.\n\n7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things:\n\n * a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above.\n * b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work.\n\n8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.\n\n9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it.\n\n10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License.\n\n11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library.\n\nIf any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances.\n\nIt is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.\n\nThis section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.\n\n12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.\n\n13. The Free Software Foundation may publish revised and/or new versions of the Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.\n\nEach version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation.\n\n14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.\n\nNO WARRANTY\n\n15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.\n\nEND OF TERMS AND CONDITIONS
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From ab7cbe83105feb92b57b59270269a8d93a822ba8 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 17 Sep 2007 21:48:39 +0000 Subject: [PATCH 106/301] added lua test cases git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@128 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/crypto.h | 9 ++ crypto/md2.c | 12 ++- httpd/proc.c | 5 +- ssl/bigint.h | 11 +- ssl/crypto_misc.h | 1 + ssl/x509.c | 1 - www/index.html | 2 +- www/lua/download.lua | 75 ++++++++++++++ www/lua/env.lua | 26 +++++ www/lua/overview.lp | 64 ++++++++++++ www/lua/prepara_sql2.lua | 31 ++++++ www/lua/tcgi1.lua | 9 ++ www/lua/test_conc.lua | 38 +++++++ www/lua/test_cookies.lp | 13 +++ www/lua/test_cookies.lua | 14 +++ www/lua/test_err.lua | 4 + www/lua/test_fs.lua | 23 +++++ www/lua/test_htk.lua | 22 ++++ www/lua/test_lib.lua | 31 ++++++ www/lua/test_main.html | 127 ++++++++++++++++++++++++ www/lua/test_main.lp | 31 ++++++ www/lua/test_main.lua | 46 +++++++++ www/lua/test_session.lua | 43 ++++++++ www/lua/test_sql.lua | 13 +++ www/lua/test_sql2.lua | 24 +++++ www/{test_dir => lua}/test_variables.lp | 0 www/test_dir/health.sh | 12 --- www/test_dir/test_cgi.php | 6 -- 28 files changed, 659 insertions(+), 34 deletions(-) create mode 100644 www/lua/download.lua create mode 100644 www/lua/env.lua create mode 100644 www/lua/overview.lp create mode 100644 www/lua/prepara_sql2.lua create mode 100644 www/lua/tcgi1.lua create mode 100644 www/lua/test_conc.lua create mode 100644 www/lua/test_cookies.lp create mode 100644 www/lua/test_cookies.lua create mode 100644 www/lua/test_err.lua create mode 100644 www/lua/test_fs.lua create mode 100644 www/lua/test_htk.lua create mode 100644 www/lua/test_lib.lua create mode 100644 www/lua/test_main.html create mode 100644 www/lua/test_main.lp create mode 100644 www/lua/test_main.lua create mode 100644 www/lua/test_session.lua create mode 100644 www/lua/test_sql.lua create mode 100644 www/lua/test_sql2.lua rename www/{test_dir => lua}/test_variables.lp (100%) delete mode 100755 www/test_dir/health.sh delete mode 100755 www/test_dir/test_cgi.php diff --git a/crypto/crypto.h b/crypto/crypto.h index e45c717b57..0becbd5cc8 100644 --- a/crypto/crypto.h +++ b/crypto/crypto.h @@ -28,6 +28,15 @@ extern "C" { #endif #include "os_port.h" +#include "config.h" + +/* enable features based on a 'super-set' capbaility. */ +#if defined(CONFIG_SSL_FULL_MODE) +#define CONFIG_SSL_ENABLE_CLIENT +#define CONFIG_SSL_CERT_VERIFICATION +#elif defined(CONFIG_SSL_ENABLE_CLIENT) +#define CONFIG_SSL_CERT_VERIFICATION +#endif /************************************************************************** * AES declarations diff --git a/crypto/md2.c b/crypto/md2.c index 7ee3b91fc6..93e1bf6451 100644 --- a/crypto/md2.c +++ b/crypto/md2.c @@ -29,7 +29,13 @@ #include "crypto.h" -static const unsigned char PI_SUBST[256] = +/** + * This code is only here to enable the verification of Verisign root + * certificates. So only enable it for verification mode. + */ +#ifdef CONFIG_SSL_CERT_VERIFICATION + +static const uint8_t PI_SUBST[256] = { 0x29, 0x2E, 0x43, 0xC9, 0xA2, 0xD8, 0x7C, 0x01, 0x3D, 0x36, 0x54, 0xA1, 0xEC, 0xF0, 0x06, 0x13, 0x62, 0xA7, 0x05, 0xF3, @@ -70,7 +76,7 @@ EXP_FUNC void STDCALL MD2_Init(MD2_CTX *ctx) static void md2_process(MD2_CTX *ctx) { int i, j; - unsigned char t = 0; + uint8_t t = 0; for (i = 0; i < 16; i++) { @@ -140,3 +146,5 @@ EXP_FUNC void STDCALL MD2_Final(uint8_t *output, MD2_CTX *ctx) memcpy(output, ctx->state, 16); } + +#endif diff --git a/httpd/proc.c b/httpd/proc.c index e995fbbd1d..bb50b5a246 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -622,7 +622,7 @@ void procsendfile(struct connstruct *cn) #if defined(CONFIG_HTTP_HAS_CGI) /* Should this be a bit more dynamic? It would mean more calls to malloc etc */ -#define CGI_ARG_SIZE 16 +#define CGI_ARG_SIZE 17 static void proccgi(struct connstruct *cn) { @@ -771,7 +771,8 @@ static void proccgi(struct connstruct *cn) if (cgi_index >= CGI_ARG_SIZE) { - printf("Content-type: text/plain\n\nToo many CGI args\n"); + printf("Content-type: text/plain\n\nToo many CGI args (%d, %d)\n", + cgi_index, CGI_ARG_SIZE); _exit(1); } diff --git a/ssl/bigint.h b/ssl/bigint.h index 5804a1c27a..ff54bac672 100644 --- a/ssl/bigint.h +++ b/ssl/bigint.h @@ -19,17 +19,8 @@ #ifndef BIGINT_HEADER #define BIGINT_HEADER -#include "config.h" - -/* enable features based on a 'super-set' capbaility. */ -#if defined(CONFIG_SSL_FULL_MODE) -#define CONFIG_SSL_ENABLE_CLIENT -#define CONFIG_SSL_CERT_VERIFICATION -#elif defined(CONFIG_SSL_ENABLE_CLIENT) -#define CONFIG_SSL_CERT_VERIFICATION -#endif - #include "os_port.h" +#include "crypto.h" #include "bigint_impl.h" #ifndef CONFIG_BIGINT_CHECK_ON diff --git a/ssl/crypto_misc.h b/ssl/crypto_misc.h index 9811810f90..36b4d10f93 100644 --- a/ssl/crypto_misc.h +++ b/ssl/crypto_misc.h @@ -27,6 +27,7 @@ extern "C" { #endif +#include "crypto.h" #include "bigint.h" /************************************************************************** diff --git a/ssl/x509.c b/ssl/x509.c index 85110951b5..6bb9afde01 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -27,7 +27,6 @@ #include #include #include "os_port.h" -#include "crypto.h" #include "crypto_misc.h" #ifdef CONFIG_SSL_CERT_VERIFICATION diff --git a/www/index.html b/www/index.html index afe43485a3..5730303d32 100755 --- a/www/index.html +++ b/www/index.html @@ -7086,7 +7086,7 @@
    changes, notes and errata
    -
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n* Muliple records with a single header are now better supported.\n* ~MD2 added for Verisign root cert verification.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* vfork() is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* vfork() is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    !GNU LESSER GENERAL PUBLIC LICENSE\n\nVersion 2.1, February 1999\n\nCopyright (C) 1991, 1999 Free Software Foundation, Inc.\n51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA\nEveryone is permitted to copy and distribute verbatim copies\nof this license document, but changing it is not allowed.\n\n[This is the first released version of the Lesser GPL. It also counts\n as the successor of the GNU Library Public License, version 2, hence\n the version number 2.1.]\n\n!!Preamble\n\nThe licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software -to make sure the software is free for all its users.\n\nThis license, the Lesser General Public License, applies to some specially designated software packages - typically libraries - of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below.\n\nWhen we speak of free software, we are referring to freedom of use, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish); that you receive source code or can get it if you want it; that you can change the software and use pieces of it in new free programs; and that you are informed that you can do these things.\n\nTo protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library or if you modify it.\n\nFor example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights.\n\nWe protect your rights with a two-step method: (1) we copyright the library, and (2) we offer you this license, which gives you legal permission to copy, distribute and/or modify the library.\n\nTo protect each distributor, we want to make it very clear that there is no warranty for the free library. Also, if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others.\n\nFinally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license.\n\nMost GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs.\n\nWhen a program is linked with a library, whether statically or using a shared library, the combination of the two is legally speaking a combined work, a derivative of the original library. The ordinary General Public License therefore permits such linking only if the entire combination fits its criteria of freedom. The Lesser General Public License permits more lax criteria for linking other code with the library.\n\nWe call this license the "Lesser" General Public License because it does Less to protect the user's freedom than the ordinary General Public License. It also provides other free software developers Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances.\n\nFor example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License.\n\nIn other cases, permission to use a particular library in non-free programs enables a greater number of people to use a large body of free software. For example, permission to use the GNU C Library in non-free programs enables many more people to use the whole GNU operating system, as well as its variant, the GNU/Linux operating system.\n\nAlthough the Lesser General Public License is Less protective of the users' freedom, it does ensure that the user of a program that is linked with the Library has the freedom and the wherewithal to run that program using a modified version of the Library.\n\nThe precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, whereas the latter must be combined with the library in order to run.\n\n!!TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION\n\n0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you".\n\nA "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables.\n\nThe "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".)\n\n"Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library.\n\nActivities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does.\n\n1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library.\n\nYou may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.\n\n2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:\n\n * a) The modified work must itself be a software library.\n * b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change.\n * c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License.\n * d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful.\n\n (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.)\n\n These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.\n\n Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library.\n\n In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.\n\n3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices.\n\nOnce this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy.\n\nThis option is useful when you wish to copy part of the code of the Library into a program that is not a library.\n\n4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange.\n\nIf distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.\n\n5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License.\n\nHowever, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables.\n\nWhen a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law.\n\nIf such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.)\n\nOtherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself.\n\n6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications.\n\nYou must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things:\n\n * a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.)\n * b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with.\n * c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.\n * d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place.\n * e) Verify that the user has already received a copy of these materials or that you have already sent this user a copy.\n\nFor an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the materials to be distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.\n\nIt may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute.\n\n7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things:\n\n * a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above.\n * b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work.\n\n8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.\n\n9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it.\n\n10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License.\n\n11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library.\n\nIf any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances.\n\nIt is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.\n\nThis section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.\n\n12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.\n\n13. The Free Software Foundation may publish revised and/or new versions of the Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.\n\nEach version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation.\n\n14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.\n\nNO WARRANTY\n\n15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.\n\nEND OF TERMS AND CONDITIONS
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    diff --git a/www/lua/download.lua b/www/lua/download.lua new file mode 100644 index 0000000000..2ee1a71e93 --- /dev/null +++ b/www/lua/download.lua @@ -0,0 +1,75 @@ +#!/usr/local/bin/lua + +require"luasocket" + +function receive (connection) + connection:settimeout(0) + local s, status = connection:receive (2^10) + if status == "timeout" then + coroutine.yield (connection) + end + return s, status +end + +function download (host, file, outfile) + --local f = assert (io.open (outfile, "w")) + local c = assert (socket.connect (host, 80)) + c:send ("GET "..file.." HTTP/1.0\r\n\r\n") + while true do + local s, status = receive (c) + --f:write (s) + if status == "closed" then + break + end + end + c:close() + --f:close() +end + +local threads = {} +function get (host, file, outfile) + print (string.format ("Downloading %s from %s to %s", file, host, outfile)) + local co = coroutine.create (function () + return download (host, file, outfile) + end) + table.insert (threads, co) +end + +function dispatcher () + while true do + local n = table.getn (threads) + if n == 0 then + break + end + local connections = {} + for i = 1, n do + local status, res = coroutine.resume (threads[i]) + if not res then + table.remove (threads, i) + break + else + table.insert (connections, res) + end + end + if table.getn (connections) == n then + socket.select (connections) + end + end +end + +local url = arg[1] +if not url then + print (string.format ("usage: %s url [times]", arg[0])) + os.exit() +end +local times = arg[2] or 5 + +url = string.gsub (url, "^http.?://", "") +local _, _, host, file = string.find (url, "^([^/]+)(/.*)") +local _, _, fn = string.find (file, "([^/]+)$") + +for i = 1, times do + get (host, file, fn..i) +end + +dispatcher () diff --git a/www/lua/env.lua b/www/lua/env.lua new file mode 100644 index 0000000000..c4298477b6 --- /dev/null +++ b/www/lua/env.lua @@ -0,0 +1,26 @@ +-- This file should be executed before any script in this directory +-- according to the configuration (cgilua/conf.lua). + +pcall (cgilua.enablesession) + +local put, mkurlpath = cgilua.put, cgilua.mkurlpath + +cgilua.addclosefunction (function () + put [[ +

    + +Main]] + for _, test in { + { "Get", "test_main.lua", {ab = "cd", ef = "gh"} }, + { "Cookies", "test_cookies.lua", }, + { "FileSystem", "test_fs.lua", }, + { "Libraries", "test_lib.lua", }, + { "Session", "test_session.lua", }, + { "Variables", "test_variables.lp", }, + } do + put (string.format (' · %s', + mkurlpath (test[2], test[3]), test[1])) + end + put [[ +]] +end) diff --git a/www/lua/overview.lp b/www/lua/overview.lp new file mode 100644 index 0000000000..4d17002a01 --- /dev/null +++ b/www/lua/overview.lp @@ -0,0 +1,64 @@ + + +CGILua installation overview + + +

    CGILua installation overview

    + + + + + + + + + + + + + +
    Version + Copyright + Description +
    <%= tostring(_G[l[2]]) %> + + +
    <%= idx(p,"VERSION") %> + <%= idx(p,"COPYRIGHT") %> + <%= idx(p,"DESCRIPTION") %> +
    + + + diff --git a/www/lua/prepara_sql2.lua b/www/lua/prepara_sql2.lua new file mode 100644 index 0000000000..6a37c2fef7 --- /dev/null +++ b/www/lua/prepara_sql2.lua @@ -0,0 +1,31 @@ +#!/usr/local/bin/lua + +MAX_ROWS = arg[1] or 10 + +require"postgres" + +local env = assert (luasql.postgres ()) +local conn = assert (env:connect ("luasql-test", "tomas")) + +-- Apaga restos de outros testes. +conn:execute "drop table t2" +conn:execute "drop table t1" + +-- Criando as tabelas. +assert (conn:execute [[create table t1 ( + a int, + b int +)]]) +assert (conn:execute [[create table t2 ( + c int, + d int +)]]) + +-- Preenchedo as tabelas. +for i = 1, MAX_ROWS do + local ii = 2*i + assert (conn:execute (string.format ([[ +insert into t1 values (%d, %d); +insert into t2 values (%d, %d);]], + ii, i, ii, i))) +end diff --git a/www/lua/tcgi1.lua b/www/lua/tcgi1.lua new file mode 100644 index 0000000000..b152cd9dbe --- /dev/null +++ b/www/lua/tcgi1.lua @@ -0,0 +1,9 @@ +io.stdout:write"Content-type: text/html\n\n" + +for i,v in pairs{"QUERY_STRING", } do + io.stdout:write (string.format ("%s = %s", v, os.getenv(v) or ' ')) +end +io.stdout:write "
    \n" + +local post_data = io.stdin:read"*a" +io.stdout:write (string.format ("post_data = {%s}", post_data)) diff --git a/www/lua/test_conc.lua b/www/lua/test_conc.lua new file mode 100644 index 0000000000..bbb9be784a --- /dev/null +++ b/www/lua/test_conc.lua @@ -0,0 +1,38 @@ +cgilua.htmlheader() +if ap then + local pid, ppid = ap.pid () + if not ppid then + ppid = "no parent pid" + end + cgilua.put ("pid = "..pid.." ("..ppid..")".."\n") +end + +assert(type(stable.get) == "function") +assert(type(stable.set) == "function") + +cgilua.put"stable.pairs = {
    \n" +for i, v in stable.pairs () do + cgilua.put (i.." = "..tostring(v).."
    \n") +end +cgilua.put"}
    \n" + +local counter = stable.get"counter" or 0 +stable.set ("counter", counter + 1) + +local f = stable.get"f" +if not f then + local d = os.date() + stable.set ("f", function () return d end) +else + cgilua.put ("f() = "..tostring (f ())) +end + +cgilua.put"
    \n" +for i = 1,800 do + cgilua.put (i) + for ii = 1,1000 do + cgilua.put ("") + end + cgilua.put ("\n") +end +cgilua.put ("End") diff --git a/www/lua/test_cookies.lp b/www/lua/test_cookies.lp new file mode 100644 index 0000000000..932b9c5e98 --- /dev/null +++ b/www/lua/test_cookies.lp @@ -0,0 +1,13 @@ + + +

    Testing Cookies library

    + +<%= CL_COOKIE%> = <%= tostring(test)%>
    +Assigning current date to cookie!
    +Reload this script to check cookie's value! diff --git a/www/lua/test_cookies.lua b/www/lua/test_cookies.lua new file mode 100644 index 0000000000..6af935e894 --- /dev/null +++ b/www/lua/test_cookies.lua @@ -0,0 +1,14 @@ +local cookies = require"cgilua.cookies" +CL_COOKIE = "cgilua_cookie" + +local test = cookies.get (CL_COOKIE) +cookies.set (CL_COOKIE, os.date()) + +cgilua.htmlheader () +cgilua.put ([[ +

    Testing Cookies library

    + +]]..CL_COOKIE..' = '..tostring(test)..[[
    +Assigning current date to cookie!
    +Reload this script to check cookie's value! +]]) diff --git a/www/lua/test_err.lua b/www/lua/test_err.lua new file mode 100644 index 0000000000..4d6ffc9708 --- /dev/null +++ b/www/lua/test_err.lua @@ -0,0 +1,4 @@ +cgilua.htmlheader() +cgilua.put"Oi!" +--io.write"something\n" +cgilua.errorlog ("eca", "emerg") diff --git a/www/lua/test_fs.lua b/www/lua/test_fs.lua new file mode 100644 index 0000000000..566ed8b204 --- /dev/null +++ b/www/lua/test_fs.lua @@ -0,0 +1,23 @@ +function link_dir (dir, base) + local path = base.."/"..dir + local mode = lfs.attributes (path).mode + if mode == "directory" then + return string.format ('%s', + cgilua.mkurlpath ("test_fs.lua", { dir = path }), + dir) + else + return dir + end +end + +cgilua.htmlheader () +cgilua.put ("

    Testing Filesystem library

    \n") +cgilua.put ("\n") +cgilua.put ("\n") +local i = 0 +local dir = cgi.dir or "." +for file in lfs.dir (dir) do + i = i+1 + cgilua.put ("\n") +end +cgilua.put ("
    Testing dir
    "..i..""..link_dir(file, dir).."
    \n") diff --git a/www/lua/test_htk.lua b/www/lua/test_htk.lua new file mode 100644 index 0000000000..ac1de6c31b --- /dev/null +++ b/www/lua/test_htk.lua @@ -0,0 +1,22 @@ +require"htk" + +local a_table = {} +for i = 1, 20 do + local l = {} + for j = 1, 20 do + table.insert (l, HTK.TD { "cell "..i..","..j }) + end + table.insert (a_table, HTK.TR (l)) +end + +cgilua.htmlheader() +cgilua.put (HTK.HTML { + HTK.HEAD { HTK.TITLE { "Titulo da Pagina" } }, + HTK.BODY { + bgcolor = "#FFFFFF", + HTK.H1 { "Titulo da Pagina" }, + HTK.P {}, + "Uma p�gina qualquer", + HTK.TABLE (a_table), + } +}) diff --git a/www/lua/test_lib.lua b/www/lua/test_lib.lua new file mode 100644 index 0000000000..5041253725 --- /dev/null +++ b/www/lua/test_lib.lua @@ -0,0 +1,31 @@ +local function getfield (t, f) + for w in string.gfind(f, "[%w_]+") do + if not t then return nil end + t = t[w] + end + return t +end + +function test_lib (libname) + local ok, err = pcall (require, libname) + if not ok then + cgilua.put ("Library "..libname.." not found
    \n".. + err) + else + cgilua.put ("Library "..libname.."
    \n") + local t = getfield (_G, libname) + if type(t) ~= "table" then + cgilua.put (tostring(t)) + else + for i, v in pairs (t) do + cgilua.put ("  "..tostring(i).." = "..tostring(v).."
    \n") + end + end + end + cgilua.put ("\n

    \n") +end + +cgilua.htmlheader () +for _, lib in ipairs { "lfs", "socket", "luasql.postgres", "luasql", "lxp", "lxp.lom", "lualdap", "htk", "xmlrpc", "xmlrpc.http" } do + test_lib (lib) +end diff --git a/www/lua/test_main.html b/www/lua/test_main.html new file mode 100644 index 0000000000..a50dd639ca --- /dev/null +++ b/www/lua/test_main.html @@ -0,0 +1,127 @@ + +Test Page + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    GET: +
    Lua scriptmodule
    HTML templatemodule
    POST: +
    +
    + + + + + + + + + + + + +
    + field 1:
    + field 2:
    + field 3: + op 1 + op 2 + op 3 +
    Lua script + module +
    HTML template + module +
    +
    +
    POST (with upload): +
    +
    + + + + + + + + + + + + +
    + field 1:
    + file (binary!):
    +
    Lua script + module +
    HTML template + module +
    +
    +
    Cookies: +
    Lua scriptmodule
    HTML templatemodule
    Filesystem: +
    Lua scriptmodule
    Session: +
    Lua scriptmodule
    CGI Variables: +
    HTML templatemodule
    Library Overview: +
    HTML templatemodule
    Concurrency +
    Lua scriptmodule
    + diff --git a/www/lua/test_main.lp b/www/lua/test_main.lp new file mode 100644 index 0000000000..917ee1e536 --- /dev/null +++ b/www/lua/test_main.lp @@ -0,0 +1,31 @@ + +Embeded Lua Test + + +cgi = { +\n", vv, a, tostring(b)) + end + v = vv.."}" + end +?> +<%= i %> = <%= tostring(v) %>
    +<% +end +%> +} +
    +Remote address: <%= cgilua.servervariable"REMOTE_ADDR" %> +
    +Is persistent = <%= tostring (SAPI.Info.ispersistent) %> +
    +ap =
    +lfcgi = <% = tostring(lfcgi) %>
    +<%= (ap and ap.handler()) or "" %>
    + + + diff --git a/www/lua/test_main.lua b/www/lua/test_main.lua new file mode 100644 index 0000000000..0e997a2d57 --- /dev/null +++ b/www/lua/test_main.lua @@ -0,0 +1,46 @@ +cgilua.htmlheader() +cgilua.put[[ + +Script Lua Test + + +cgi = { +]] + +for i,v in pairs (cgi) do + if type(v) == "table" then + local vv = "{" + for a,b in pairs(v) do + vv = string.format ("%s%s = %s
    \n", vv, a, tostring(b)) + end + v = vv.."}" + end + cgilua.put (string.format ("%s = %s
    \n", i, tostring(v))) +end +cgilua.put "}
    \n" +cgilua.put ("Remote address: "..cgilua.servervariable"REMOTE_ADDR") +cgilua.put "
    \n" +cgilua.put ("Is persistent = "..tostring (SAPI.Info.ispersistent).."
    \n") +cgilua.put ("ap="..tostring(ap).."
    \n") +cgilua.put ("lfcgi="..tostring(lfcgi).."
    \n") + +-- Checking Virtual Environment +local my_output = cgilua.put +cgilua.put = nil +local status, err = pcall (function () + assert (cgilua.put == nil, "cannot change cgilua.put value") +end) +cgilua.put = my_output +assert (status == true, err) + +-- Checking require +local status, err = pcall (function () require"unknown_module" end) +assert (status == false, "unknown_module loaded!") +-- assert (package == nil, "Access to package table allowed!") + +cgilua.put[[ +

    + + +]] +cgilua = nil diff --git a/www/lua/test_session.lua b/www/lua/test_session.lua new file mode 100644 index 0000000000..d97cc45201 --- /dev/null +++ b/www/lua/test_session.lua @@ -0,0 +1,43 @@ +cgilua.enablesession () + +function pt (tab) + for i, v in pairs (tab) do + local vv = v + if type(v) == "table" then + vv = "" + for _i, _v in pairs (v) do + vv = vv..string.format ("%s = %q, ", _i, _v) + end + vv = '{'..vv..'}' + end + cgilua.put (string.format ("%s = %s
    \n", tostring (i), tostring (vv))) + end +end + + +if cgi.field then + if not cgilua.session.data.field then + cgilua.session.data.field = {} + end + table.insert (cgilua.session.data.field, cgi.field) +end +cgilua.htmlheader() +if cgilua.session then + cgilua.put "cgi = {
    \n" + pt (cgi) + cgilua.put "}
    \n" + cgilua.put "cgilua.session.data = {
    \n" + pt (cgilua.session.data) + cgilua.put "}
    \n" + + cgilua.put [[

    + field:
    +
    +
    ]] +else + cgilua.put "Sessions library is not available or not well configured" +end diff --git a/www/lua/test_sql.lua b/www/lua/test_sql.lua new file mode 100644 index 0000000000..085ce978c7 --- /dev/null +++ b/www/lua/test_sql.lua @@ -0,0 +1,13 @@ +local s = require"luasql.postgres" + +local env = assert (luasql.postgres ()) +local conn = assert (env:connect ("luasql-test", "tomas")) +local cur = assert (conn:execute ("select count(*) from fetch_test")) + +cgilua.htmlheader() +cgilua.put ("Total lines at table fetch_test is "..cur:fetch()) +cgilua.put (string.format ("
    \n%s == %s
    \n", tostring(s), tostring(luasql))) + +cur:close() +conn:close() +env:close() diff --git a/www/lua/test_sql2.lua b/www/lua/test_sql2.lua new file mode 100644 index 0000000000..a2f6ee12dc --- /dev/null +++ b/www/lua/test_sql2.lua @@ -0,0 +1,24 @@ +require"postgres" + +local env = assert (luasql.postgres ()) +local conn = assert (env:connect ("luasql-test", "tomas")) +local cur = assert (conn:execute ("select count(*) from t1")) +local total = tonumber (cur:fetch()) +cur:close() +local aleatorio = math.random(total) +local cur = assert (conn:execute ("select * from t1, t2 where b = d and a != "..2*aleatorio)) + +cgilua.htmlheader() +cgilua.put ("Aleatorio = "..aleatorio.."
    \n") + +local a,b,c,d = cur:fetch() +cgilua.put ("\n") +while a do +-- cgilua.put ("") + a,b,c,d = cur:fetch() +end +cgilua.put ("
    ",a,"",b,"",c,"",d,"
    \n") + +cur:close() +conn:close() +env:close() diff --git a/www/test_dir/test_variables.lp b/www/lua/test_variables.lp similarity index 100% rename from www/test_dir/test_variables.lp rename to www/lua/test_variables.lp diff --git a/www/test_dir/health.sh b/www/test_dir/health.sh deleted file mode 100755 index d5c7d766b3..0000000000 --- a/www/test_dir/health.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh - -echo "Content-Type: text/html" -echo -echo "System Health" -echo "

    System Health for '`/bin/hostname`'

    " -echo "

    Processes

    " -/bin/ps -ef | /bin/sed -e "s/\(.*\)/
    \1<\/td><\/tr>/" -echo "

    Free FileSystem Space

    " -echo "" -/bin/df -h / | /bin/sed -e "s/\(.*\)/
    \1<\/td><\/tr>/" -echo "
    " diff --git a/www/test_dir/test_cgi.php b/www/test_dir/test_cgi.php deleted file mode 100755 index feecbb1ec4..0000000000 --- a/www/test_dir/test_cgi.php +++ /dev/null @@ -1,6 +0,0 @@ -#!/bin/php - - - From 6ae00e4143e367677e0873b64df1472e6e8cf2cc Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 19 Sep 2007 06:51:14 +0000 Subject: [PATCH 107/301] fixed win32 build issues with CGI git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@129 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/axhttpd.aip | 73 ++++++------- config/makefile.conf | 4 +- config/win32config | 245 +++++++++++++++++++++---------------------- httpd/axhttp.h | 2 + httpd/axhttpd.c | 10 +- httpd/proc.c | 216 +++++++++++++++++++------------------- ssl/os_port.c | 12 --- ssl/os_port.h | 2 +- 8 files changed, 271 insertions(+), 293 deletions(-) diff --git a/config/axhttpd.aip b/config/axhttpd.aip index 2bac4caa67..5d1a2254f8 100755 --- a/config/axhttpd.aip +++ b/config/axhttpd.aip @@ -1,5 +1,5 @@ - + @@ -8,10 +8,10 @@ - + - + @@ -30,51 +30,47 @@ - - - - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + @@ -105,13 +101,14 @@ + - + @@ -127,12 +124,6 @@ - - - - - - diff --git a/config/makefile.conf b/config/makefile.conf index 4255dbe46a..aff7909956 100644 --- a/config/makefile.conf +++ b/config/makefile.conf @@ -57,8 +57,8 @@ endif CC=cl.exe LD=link.exe AXTLS_INCLUDE=$(shell cygpath -w $(AXTLS_HOME)) -CFLAGS+=/nologo /W3 /D "WIN32" /D "_MBCS" /D "_CONSOLE" /FD /I"$(AXTLS_INCLUDE)crypto" /I"$(AXTLS_INCLUDE)ssl" /I"$(AXTLS_INCLUDE)config" /c -LDFLAGS=/nologo /subsystem:console /machine:I386 +CFLAGS+=/nologo /W3 /D"WIN32" /D"_MBCS" /D"_CONSOLE" /D"_CRT_SECURE_NO_DEPRECATE" /FD /I"$(AXTLS_INCLUDE)crypto" /I"$(AXTLS_INCLUDE)ssl" /I"$(AXTLS_INCLUDE)config" /c +LDFLAGS=/nologo /subsystem:console /machine:I386 Advapi32.lib LDSHARED = /dll AR=lib /nologo diff --git a/config/win32config b/config/win32config index 3e0b4223cb..be5ac45f8b 100644 --- a/config/win32config +++ b/config/win32config @@ -1,125 +1,120 @@ -# -# Automatically generated make config: don't edit -# -HAVE_DOT_CONFIG=y -# CONFIG_PLATFORM_LINUX is not set -# CONFIG_PLATFORM_CYGWIN is not set -# CONFIG_PLATFORM_SOLARIS is not set -CONFIG_PLATFORM_WIN32=y - -# -# General Configuration -# -PREFIX="" -# CONFIG_DEBUG is not set - -# -# Microsoft Compiler Options -# -# CONFIG_VISUAL_STUDIO_6_0 is not set -CONFIG_VISUAL_STUDIO_7_0=y -# CONFIG_VISUAL_STUDIO_8_0 is not set -CONFIG_VISUAL_STUDIO_6_0_BASE="" -CONFIG_VISUAL_STUDIO_7_0_BASE="c:\\Program Files\\Microsoft Visual Studio .NET 2003" -CONFIG_VISUAL_STUDIO_8_0_BASE="" -CONFIG_EXTRA_CFLAGS_OPTIONS="" -CONFIG_EXTRA_LDFLAGS_OPTIONS="" - -# -# SSL Library -# -# CONFIG_SSL_SERVER_ONLY is not set -# CONFIG_SSL_CERT_VERIFICATION is not set -# CONFIG_SSL_ENABLE_CLIENT is not set -CONFIG_SSL_FULL_MODE=y -# CONFIG_SSL_SKELETON_MODE is not set -# CONFIG_SSL_PROT_LOW is not set -CONFIG_SSL_PROT_MEDIUM=y -# CONFIG_SSL_PROT_HIGH is not set -CONFIG_SSL_USE_DEFAULT_KEY=y -CONFIG_SSL_ENABLE_V23_HANDSHAKE=y -CONFIG_SSL_HAS_PEM=y -CONFIG_SSL_USE_PKCS12=y -CONFIG_SSL_EXPIRY_TIME=24 -CONFIG_X509_MAX_CA_CERTS=4 -CONFIG_SSL_MAX_CERTS=2 -# CONFIG_SSL_CTX_MUTEXING is not set -# CONFIG_USE_DEV_URANDOM is not set -CONFIG_WIN32_USE_CRYPTO_LIB=y -# CONFIG_OPENSSL_COMPATIBLE is not set -# CONFIG_PERFORMANCE_TESTING is not set -# CONFIG_SSL_TEST is not set -CONFIG_AXHTTPD=y - -# -# Axhttpd Configuration -# -# CONFIG_HTTP_STATIC_BUILD is not set -CONFIG_HTTP_PORT=80 -CONFIG_HTTP_HTTPS_PORT=443 -CONFIG_HTTP_SESSION_CACHE_SIZE=5 -CONFIG_HTTP_WEBROOT="../www" -CONFIG_HTTP_TIMEOUT=300 - -# -# CGI -# -# CONFIG_HTTP_HAS_CGI is not set -CONFIG_HTTP_CGI_EXTENSIONS="" -# CONFIG_HTTP_ENABLE_LUA is not set -CONFIG_HTTP_LUA_PREFIX="" -# CONFIG_HTTP_BUILD_LUA is not set -CONFIG_HTTP_DIRECTORIES=y -CONFIG_HTTP_HAS_AUTHORIZATION=y -# CONFIG_HTTP_USE_CHROOT is not set -# CONFIG_HTTP_CHANGE_UID is not set -# CONFIG_HTTP_HAS_IPV6 is not set -# CONFIG_HTTP_VERBOSE is not set -# CONFIG_HTTP_IS_DAEMON is not set - -# -# Language Bindings -# -CONFIG_BINDINGS=y -CONFIG_CSHARP_BINDINGS=y -CONFIG_VBNET_BINDINGS=y - -# -# .Net Framework -# -CONFIG_DOT_NET_FRAMEWORK_BASE="c:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727" -CONFIG_JAVA_BINDINGS=y - -# -# Java Home -# -CONFIG_JAVA_HOME="c:\\Program Files\\Java\\jdk1.5.0_06" -# CONFIG_PERL_BINDINGS is not set -CONFIG_PERL_CORE="" -CONFIG_PERL_LIB="" -# CONFIG_LUA_BINDINGS is not set -CONFIG_LUA_CORE="" - -# -# Samples -# -CONFIG_SAMPLES=y -CONFIG_C_SAMPLES=y -CONFIG_CSHARP_SAMPLES=y -CONFIG_VBNET_SAMPLES=y -CONFIG_JAVA_SAMPLES=y -# CONFIG_PERL_SAMPLES is not set - -# -# BigInt Options -# -# CONFIG_BIGINT_CLASSICAL is not set -# CONFIG_BIGINT_MONTGOMERY is not set -CONFIG_BIGINT_BARRETT=y -CONFIG_BIGINT_CRT=y -# CONFIG_BIGINT_KARATSUBA is not set -MUL_KARATSUBA_THRESH=0 -SQU_KARATSUBA_THRESH=0 -CONFIG_BIGINT_SLIDING_WINDOW=y -CONFIG_BIGINT_SQUARE=y -# CONFIG_BIGINT_CHECK_ON is not set +# +# Automatically generated make config: don't edit +# +HAVE_DOT_CONFIG=y +# CONFIG_PLATFORM_LINUX is not set +# CONFIG_PLATFORM_CYGWIN is not set +# CONFIG_PLATFORM_SOLARIS is not set +CONFIG_PLATFORM_WIN32=y + +# +# General Configuration +# +PREFIX="" +# CONFIG_DEBUG is not set +# CONFIG_STRIP_UNWANTED_SECTIONS is not set + +# +# Microsoft Compiler Options +# +# CONFIG_VISUAL_STUDIO_6_0 is not set +# CONFIG_VISUAL_STUDIO_7_0 is not set +CONFIG_VISUAL_STUDIO_8_0=y +CONFIG_VISUAL_STUDIO_6_0_BASE="" +CONFIG_VISUAL_STUDIO_7_0_BASE="" +CONFIG_VISUAL_STUDIO_8_0_BASE="c:\\Program Files\\Microsoft Visual Studio 8" +CONFIG_EXTRA_CFLAGS_OPTIONS="" +CONFIG_EXTRA_LDFLAGS_OPTIONS="" + +# +# SSL Library +# +# CONFIG_SSL_SERVER_ONLY is not set +# CONFIG_SSL_CERT_VERIFICATION is not set +# CONFIG_SSL_ENABLE_CLIENT is not set +CONFIG_SSL_FULL_MODE=y +# CONFIG_SSL_SKELETON_MODE is not set +# CONFIG_SSL_PROT_LOW is not set +CONFIG_SSL_PROT_MEDIUM=y +# CONFIG_SSL_PROT_HIGH is not set +CONFIG_SSL_USE_DEFAULT_KEY=y +CONFIG_SSL_ENABLE_V23_HANDSHAKE=y +CONFIG_SSL_HAS_PEM=y +CONFIG_SSL_USE_PKCS12=y +CONFIG_SSL_EXPIRY_TIME=24 +CONFIG_X509_MAX_CA_CERTS=4 +CONFIG_SSL_MAX_CERTS=2 +# CONFIG_SSL_CTX_MUTEXING is not set +# CONFIG_USE_DEV_URANDOM is not set +CONFIG_WIN32_USE_CRYPTO_LIB=y +# CONFIG_OPENSSL_COMPATIBLE is not set +# CONFIG_PERFORMANCE_TESTING is not set +# CONFIG_SSL_TEST is not set +CONFIG_AXHTTPD=y + +# +# Axhttpd Configuration +# +# CONFIG_HTTP_STATIC_BUILD is not set +CONFIG_HTTP_PORT=80 +CONFIG_HTTP_HTTPS_PORT=443 +CONFIG_HTTP_SESSION_CACHE_SIZE=5 +CONFIG_HTTP_WEBROOT="www" +CONFIG_HTTP_TIMEOUT=300 + +# +# CGI +# +# CONFIG_HTTP_HAS_CGI is not set +CONFIG_HTTP_CGI_EXTENSIONS="" +# CONFIG_HTTP_ENABLE_LUA is not set +CONFIG_HTTP_LUA_PREFIX="" +CONFIG_HTTP_LUA_CGI_LAUNCHER="" +# CONFIG_HTTP_BUILD_LUA is not set +CONFIG_HTTP_DIRECTORIES=y +CONFIG_HTTP_HAS_AUTHORIZATION=y +# CONFIG_HTTP_USE_CHROOT is not set +# CONFIG_HTTP_CHANGE_UID is not set +# CONFIG_HTTP_HAS_IPV6 is not set +CONFIG_HTTP_VERBOSE=y +# CONFIG_HTTP_IS_DAEMON is not set + +# +# Language Bindings +# +# CONFIG_BINDINGS is not set +# CONFIG_CSHARP_BINDINGS is not set +# CONFIG_VBNET_BINDINGS is not set +CONFIG_DOT_NET_FRAMEWORK_BASE="" +# CONFIG_JAVA_BINDINGS is not set +CONFIG_JAVA_HOME="" +# CONFIG_PERL_BINDINGS is not set +CONFIG_PERL_CORE="" +CONFIG_PERL_LIB="" +# CONFIG_LUA_BINDINGS is not set +CONFIG_LUA_CORE="" + +# +# Samples +# +CONFIG_SAMPLES=y +CONFIG_C_SAMPLES=y +# CONFIG_CSHARP_SAMPLES is not set +# CONFIG_VBNET_SAMPLES is not set +# CONFIG_JAVA_SAMPLES is not set +# CONFIG_PERL_SAMPLES is not set +# CONFIG_LUA_SAMPLES is not set + +# +# BigInt Options +# +# CONFIG_BIGINT_CLASSICAL is not set +# CONFIG_BIGINT_MONTGOMERY is not set +CONFIG_BIGINT_BARRETT=y +CONFIG_BIGINT_CRT=y +# CONFIG_BIGINT_KARATSUBA is not set +MUL_KARATSUBA_THRESH=0 +SQU_KARATSUBA_THRESH=0 +CONFIG_BIGINT_SLIDING_WINDOW=y +CONFIG_BIGINT_SQUARE=y +# CONFIG_BIGINT_CHECK_ON is not set diff --git a/httpd/axhttp.h b/httpd/axhttp.h index 439fd91273..2da364e742 100644 --- a/httpd/axhttp.h +++ b/httpd/axhttp.h @@ -129,7 +129,9 @@ void procreadhead(struct connstruct *cn); void procsendhead(struct connstruct *cn); void procreadfile(struct connstruct *cn); void procsendfile(struct connstruct *cn); +#if defined(CONFIG_HTTP_HAS_CGI) void read_post_data(struct connstruct *cn); +#endif /* misc.c prototypes */ char *my_strncpy(char *dest, const char *src, size_t n); diff --git a/httpd/axhttpd.c b/httpd/axhttpd.c index 2f5fd19bfe..701d588530 100644 --- a/httpd/axhttpd.c +++ b/httpd/axhttpd.c @@ -301,10 +301,12 @@ int main(int argc, char *argv[]) FD_ISSET(to->networkdesc, &rfds)) { active--; - if (to->post_state) - read_post_data(to); - else - procreadhead(to); +#if defined(CONFIG_HTTP_HAS_CGI) + if (to->post_state) + read_post_data(to); + else +#endif + procreadhead(to); } if (to->state == STATE_WANT_TO_SEND_HEAD && diff --git a/httpd/proc.c b/httpd/proc.c index bb50b5a246..35388e7fcc 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -49,6 +49,7 @@ static void procdirlisting(struct connstruct *cn); #if defined(CONFIG_HTTP_HAS_CGI) static void proccgi(struct connstruct *cn); static void decode_path_info(struct connstruct *cn, char *path_info); +static int init_read_post_data(char *buf, char *data, struct connstruct *cn, int old_rv); #endif #ifdef CONFIG_HTTP_HAS_AUTHORIZATION static int auth_check(struct connstruct *cn); @@ -281,113 +282,12 @@ static void urlencode(const uint8_t *s, char *t) #endif -int init_read_post_data(char *buf, char *data, struct connstruct *cn, int old_rv) -{ - char *next; - int rv; - char *post_data; - - rv=old_rv; - next=data; - - /* Too much Post data to send. MAXPOSTDATASIZE should be - configured (now it can be chaged in the header file) */ - if (cn->content_length > MAXPOSTDATASIZE) - { - send_error(cn, 418); - return 0; - } - - /* remove CRLF */ - while ((*next == '\r' || *next == '\n') && (next < &buf[rv])) - next++; - - if (cn->post_data == NULL) - { - cn->post_data = (char *) calloc(1, (cn->content_length + 1)); - /* Allocate buffer for the POST data that will be used by proccgi - to send POST data to the CGI script */ - - if (cn->post_data == NULL) - { - printf("axhttpd: could not allocate memory for POST data\n"); - TTY_FLUSH(); - send_error(cn, 599); - return 0; - } - } - - cn->post_state = 0; - cn->post_read = 0; - post_data = cn->post_data; - - while (next < &buf[rv]) - { - /*copy POST data to buffer*/ - *post_data = *next; - post_data++; - next++; - cn->post_read++; - if (cn->post_read == cn->content_length) - { - /* No more POST data to be copied */ - *post_data = '\0'; - return 1; - } - } - - /* More POST data has to be read. read_post_data will continue with that */ - cn->post_state = 1; - return 0; -} - -void read_post_data(struct connstruct *cn) -{ - char buf[MAXREQUESTLENGTH*4], *next; - char *post_data; - int rv; - - bzero(buf,MAXREQUESTLENGTH*4); - rv = special_read(cn, buf, sizeof(buf)-1); - if (rv <= 0) - { - if (rv < 0) /* really dead? */ - removeconnection(cn); - return; - } - - buf[rv] = '\0'; - next = buf; - - post_data = &cn->post_data[cn->post_read]; - - while (next < &buf[rv]) - { - *post_data = *next; - post_data++; - next++; - cn->post_read++; - if (cn->post_read == cn->content_length) - { - /* No more POST data to be copied */ - *post_data='\0'; - cn->post_state = 0; - buildactualfile(cn); - cn->state = STATE_WANT_TO_SEND_HEAD; - return; - } - } - - /* More POST data to read */ -} - - void procreadhead(struct connstruct *cn) { char buf[MAXREQUESTLENGTH*4], *tp, *next; int rv; - bzero(buf,MAXREQUESTLENGTH*4); + memset(buf, 0, MAXREQUESTLENGTH*4); rv = special_read(cn, buf, sizeof(buf)-1); if (rv <= 0) { @@ -409,12 +309,14 @@ void procreadhead(struct connstruct *cn) /* If we have a blank line, advance to next stage */ if (*next == '\r' || *next == '\n') { - if ((cn->reqtype == TYPE_POST)&&(cn->content_length > 0)) - { - if (init_read_post_data(buf,next,cn,rv) == 0) - return; - } - +#ifndef WIN32 + if (cn->reqtype == TYPE_POST && cn->content_length > 0) + { + if (init_read_post_data(buf,next,cn,rv) == 0) + return; + } +#endif + buildactualfile(cn); cn->state = STATE_WANT_TO_SEND_HEAD; return; @@ -860,6 +762,104 @@ static void decode_path_info(struct connstruct *cn, char *path_info) my_strncpy(cn->filereq, path_info, MAXREQUESTLENGTH); } +static int init_read_post_data(char *buf, char *data, + struct connstruct *cn, int old_rv) +{ + char *next = data; + int rv = old_rv; + char *post_data; + + /* Too much Post data to send. MAXPOSTDATASIZE should be + configured (now it can be chaged in the header file) */ + if (cn->content_length > MAXPOSTDATASIZE) + { + send_error(cn, 418); + return 0; + } + + /* remove CRLF */ + while ((*next == '\r' || *next == '\n') && (next < &buf[rv])) + next++; + + if (cn->post_data == NULL) + { + cn->post_data = (char *) calloc(1, (cn->content_length + 1)); + /* Allocate buffer for the POST data that will be used by proccgi + to send POST data to the CGI script */ + + if (cn->post_data == NULL) + { + printf("axhttpd: could not allocate memory for POST data\n"); + TTY_FLUSH(); + send_error(cn, 599); + return 0; + } + } + + cn->post_state = 0; + cn->post_read = 0; + post_data = cn->post_data; + + while (next < &buf[rv]) + { + /*copy POST data to buffer*/ + *post_data = *next; + post_data++; + next++; + cn->post_read++; + if (cn->post_read == cn->content_length) + { + /* No more POST data to be copied */ + *post_data = '\0'; + return 1; + } + } + + /* More POST data has to be read. read_post_data will continue with that */ + cn->post_state = 1; + return 0; +} + +void read_post_data(struct connstruct *cn) +{ + char buf[MAXREQUESTLENGTH*4], *next; + char *post_data; + int rv; + + bzero(buf,MAXREQUESTLENGTH*4); + rv = special_read(cn, buf, sizeof(buf)-1); + if (rv <= 0) + { + if (rv < 0) /* really dead? */ + removeconnection(cn); + return; + } + + buf[rv] = '\0'; + next = buf; + + post_data = &cn->post_data[cn->post_read]; + + while (next < &buf[rv]) + { + *post_data = *next; + post_data++; + next++; + cn->post_read++; + if (cn->post_read == cn->content_length) + { + /* No more POST data to be copied */ + *post_data='\0'; + cn->post_state = 0; + buildactualfile(cn); + cn->state = STATE_WANT_TO_SEND_HEAD; + return; + } + } + + /* More POST data to read */ +} + #endif /* CONFIG_HTTP_HAS_CGI */ /* Decode string %xx -> char (in place) */ diff --git a/ssl/os_port.c b/ssl/os_port.c index 9b25473897..5f3c47722d 100644 --- a/ssl/os_port.c +++ b/ssl/os_port.c @@ -65,8 +65,6 @@ EXP_FUNC int STDCALL strcasecmp(const char *s1, const char *s2) #undef malloc #undef realloc #undef calloc -#undef open -#undef fopen static const char * out_of_mem_str = "out of memory"; static const char * file_open_str = "Could not open file \"%s\""; @@ -106,16 +104,6 @@ EXP_FUNC void * STDCALL ax_calloc(size_t n, size_t s) return x; } -EXP_FUNC FILE * STDCALL ax_fopen(const char *pathname, const char *type) -{ - FILE *f; - - if ((f = fopen(pathname, type)) == NULL) - exit_now(file_open_str, pathname); - - return f; -} - EXP_FUNC int STDCALL ax_open(const char *pathname, int flags) { int x; diff --git a/ssl/os_port.h b/ssl/os_port.h index ea0e7d14ca..c6ecb6f83a 100644 --- a/ssl/os_port.h +++ b/ssl/os_port.h @@ -86,6 +86,7 @@ extern "C" { #define usleep(A) Sleep(A/1000) #define strdup(A) _strdup(A) #define chroot(A) _chdir(A) +#define chdir(A) _chdir(A) #ifndef lseek #define lseek(A,B,C) _lseek(A,B,C) #endif @@ -157,7 +158,6 @@ EXP_FUNC int STDCALL strcasecmp(const char *s1, const char *s2); EXP_FUNC void * STDCALL ax_malloc(size_t s); EXP_FUNC void * STDCALL ax_realloc(void *y, size_t s); EXP_FUNC void * STDCALL ax_calloc(size_t n, size_t s); -EXP_FUNC FILE * STDCALL ax_fopen(const char *name, const char *type); EXP_FUNC int STDCALL ax_open(const char *pathname, int flags); #ifdef CONFIG_PLATFORM_LINUX From 91f0c4bec0494fdcf7e090ba01e008847f0c1ed8 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 19 Sep 2007 12:03:09 +0000 Subject: [PATCH 108/301] remove vc6.0 support git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@130 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/Config.in | 10 ---------- config/linuxconfig | 2 -- config/makefile.conf | 9 +-------- config/win32config | 2 -- crypto/crypto.h | 2 +- httpd/Config.in | 2 +- ssl/Config.in | 5 +---- ssl/Makefile | 2 +- www/lua/tcgi1.lua | 9 --------- 9 files changed, 5 insertions(+), 38 deletions(-) delete mode 100644 www/lua/tcgi1.lua diff --git a/config/Config.in b/config/Config.in index f434bde45e..4721ac4463 100644 --- a/config/Config.in +++ b/config/Config.in @@ -63,11 +63,6 @@ choice depends on CONFIG_PLATFORM_WIN32 default CONFIG_VISUAL_STUDIO_7_0 -config CONFIG_VISUAL_STUDIO_6_0 - bool "Visual Studio 6.0 (VC98)" - help - Use Microsoft's Visual Studio 6.0 platform. - config CONFIG_VISUAL_STUDIO_7_0 bool "Visual Studio 7.0 (2003)" help @@ -80,11 +75,6 @@ config CONFIG_VISUAL_STUDIO_8_0 endchoice -config CONFIG_VISUAL_STUDIO_6_0_BASE - string "Base" - depends on CONFIG_VISUAL_STUDIO_6_0 - default "c:\\Program Files\\Microsoft Visual Studio" - config CONFIG_VISUAL_STUDIO_7_0_BASE string "Base" depends on CONFIG_VISUAL_STUDIO_7_0 diff --git a/config/linuxconfig b/config/linuxconfig index 220060c009..d1d883e09b 100644 --- a/config/linuxconfig +++ b/config/linuxconfig @@ -12,10 +12,8 @@ CONFIG_PLATFORM_LINUX=y # PREFIX="/usr/local" # CONFIG_DEBUG is not set -# CONFIG_VISUAL_STUDIO_6_0 is not set # CONFIG_VISUAL_STUDIO_7_0 is not set # CONFIG_VISUAL_STUDIO_8_0 is not set -CONFIG_VISUAL_STUDIO_6_0_BASE="" CONFIG_VISUAL_STUDIO_7_0_BASE="" CONFIG_VISUAL_STUDIO_8_0_BASE="" CONFIG_EXTRA_CFLAGS_OPTIONS="" diff --git a/config/makefile.conf b/config/makefile.conf index aff7909956..fe9ba26d76 100644 --- a/config/makefile.conf +++ b/config/makefile.conf @@ -31,12 +31,6 @@ all: # Win32 ifdef CONFIG_PLATFORM_WIN32 -ifdef CONFIG_VISUAL_STUDIO_6_0 -CONFIG_VISUAL_STUDIO_6_0_BASE_UNIX:=$(shell cygpath -u $(CONFIG_VISUAL_STUDIO_6_0_BASE)) -export INCLUDE=$(shell echo "$(CONFIG_VISUAL_STUDIO_6_0_BASE)\vc98\Include") -export LIB=$(shell echo "$(CONFIG_VISUAL_STUDIO_6_0_BASE)\vc98\Lib") -PATH:=$(CONFIG_VISUAL_STUDIO_6_0_BASE_UNIX)/common/msdev98/bin:$(CONFIG_VISUAL_STUDIO_6_0_BASE_UNIX)/vc98/bin:$(PATH) -else ifdef CONFIG_VISUAL_STUDIO_7_0 CONFIG_VISUAL_STUDIO_7_0_BASE_UNIX:=$(shell cygpath -u $(CONFIG_VISUAL_STUDIO_7_0_BASE)) export INCLUDE=$(shell echo "$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\include;$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\platformsdk\include") @@ -52,13 +46,12 @@ stuff: @echo $(INCLUDE) endif endif -endif CC=cl.exe LD=link.exe AXTLS_INCLUDE=$(shell cygpath -w $(AXTLS_HOME)) CFLAGS+=/nologo /W3 /D"WIN32" /D"_MBCS" /D"_CONSOLE" /D"_CRT_SECURE_NO_DEPRECATE" /FD /I"$(AXTLS_INCLUDE)crypto" /I"$(AXTLS_INCLUDE)ssl" /I"$(AXTLS_INCLUDE)config" /c -LDFLAGS=/nologo /subsystem:console /machine:I386 Advapi32.lib +LDFLAGS=/nologo /subsystem:console /machine:I386 LDSHARED = /dll AR=lib /nologo diff --git a/config/win32config b/config/win32config index be5ac45f8b..ae6abf18b2 100644 --- a/config/win32config +++ b/config/win32config @@ -17,10 +17,8 @@ PREFIX="" # # Microsoft Compiler Options # -# CONFIG_VISUAL_STUDIO_6_0 is not set # CONFIG_VISUAL_STUDIO_7_0 is not set CONFIG_VISUAL_STUDIO_8_0=y -CONFIG_VISUAL_STUDIO_6_0_BASE="" CONFIG_VISUAL_STUDIO_7_0_BASE="" CONFIG_VISUAL_STUDIO_8_0_BASE="c:\\Program Files\\Microsoft Visual Studio 8" CONFIG_EXTRA_CFLAGS_OPTIONS="" diff --git a/crypto/crypto.h b/crypto/crypto.h index 0becbd5cc8..4b4cdc406a 100644 --- a/crypto/crypto.h +++ b/crypto/crypto.h @@ -27,8 +27,8 @@ extern "C" { #endif -#include "os_port.h" #include "config.h" +#include "os_port.h" /* enable features based on a 'super-set' capbaility. */ #if defined(CONFIG_SSL_FULL_MODE) diff --git a/httpd/Config.in b/httpd/Config.in index 512aa33e73..cbbbc7d5ec 100644 --- a/httpd/Config.in +++ b/httpd/Config.in @@ -54,11 +54,11 @@ config CONFIG_HTTP_TIMEOUT Set the timeout of a connection in seconds. menu "CGI" +depends on !CONFIG_PLATFORM_WIN32 config CONFIG_HTTP_HAS_CGI bool "Enable CGI" default y - depends on !CONFIG_PLATFORM_WIN32 help Enable the CGI capability. Not available on Win32 platforms. diff --git a/ssl/Config.in b/ssl/Config.in index 1b6f4641bf..0a11ef55fc 100644 --- a/ssl/Config.in +++ b/ssl/Config.in @@ -234,15 +234,12 @@ config CONFIG_USE_DEV_URANDOM config CONFIG_WIN32_USE_CRYPTO_LIB bool "Use Win32 Crypto Library" - default y if !CONFIG_VISUAL_STUDIO_6_0 - default n if CONFIG_VISUAL_STUDIO_6_0 depends on CONFIG_PLATFORM_WIN32 help Microsoft produce a Crypto API which requires the Platform SDK to be installed. It's used for the RNG. - This will be the default on most Win32 systems. If using Visual Studio - 6.0, then the SDK containing the crypto libraries must be used. + This will be the default on most Win32 systems. config CONFIG_OPENSSL_COMPATIBLE bool "Enable openssl API compatibility" diff --git a/ssl/Makefile b/ssl/Makefile index 2dcbeceec9..a8ec01c9f0 100644 --- a/ssl/Makefile +++ b/ssl/Makefile @@ -44,7 +44,7 @@ endif LIBMAJOR=$(BASETARGET).1 LIBMINOR=$(BASETARGET).1.2 else -TARGET1=$(AXTLS_HOME)/axtls.lib +TARGET1=$(AXTLS_HOME)/$(STAGE)/axtls.lib TARGET2=$(AXTLS_HOME)/$(STAGE)/axtls.dll STATIC_LIB=$(AXTLS_HOME)/$(STAGE)/axtls.static.lib CRYPTO_PATH=$(AXTLS_HOME)\\crypto\\ diff --git a/www/lua/tcgi1.lua b/www/lua/tcgi1.lua deleted file mode 100644 index b152cd9dbe..0000000000 --- a/www/lua/tcgi1.lua +++ /dev/null @@ -1,9 +0,0 @@ -io.stdout:write"Content-type: text/html\n\n" - -for i,v in pairs{"QUERY_STRING", } do - io.stdout:write (string.format ("%s = %s", v, os.getenv(v) or ' ')) -end -io.stdout:write "
    \n" - -local post_data = io.stdin:read"*a" -io.stdout:write (string.format ("post_data = {%s}", post_data)) From 18cde1355dfa9e191a813ca8f73150b9cf293a33 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 1 Oct 2007 21:49:12 +0000 Subject: [PATCH 109/301] memory reductions git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@131 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/bigint.c | 19 ++++++++++++++++--- ssl/bigint.h | 1 + ssl/rsa.c | 6 ++++++ ssl/tls1.c | 39 ++++++++++++++++++--------------------- ssl/tls1.h | 2 ++ ssl/tls1_svr.c | 4 ++++ www/index.html | 2 +- 7 files changed, 48 insertions(+), 25 deletions(-) diff --git a/ssl/bigint.c b/ssl/bigint.c index 38823ce990..ef4a917f49 100644 --- a/ssl/bigint.c +++ b/ssl/bigint.c @@ -96,8 +96,6 @@ BI_CTX *bi_initialize(void) */ void bi_terminate(BI_CTX *ctx) { - bigint *p, *pn; - bi_depermanent(ctx->bi_radix); bi_free(ctx, ctx->bi_radix); @@ -110,6 +108,20 @@ void bi_terminate(BI_CTX *ctx) abort(); } + bi_clear_cache(ctx); + free(ctx); +} + +/** + *@brief Clear the memory cache. + */ +void bi_clear_cache(BI_CTX *ctx) +{ + bigint *p, *pn; + + if (ctx->free_list == NULL) + return; + for (p = ctx->free_list; p != NULL; p = pn) { pn = p->next; @@ -117,7 +129,8 @@ void bi_terminate(BI_CTX *ctx) free(p); } - free(ctx); + ctx->free_count = 0; + ctx->free_list = NULL; } /** diff --git a/ssl/bigint.h b/ssl/bigint.h index ff54bac672..5c70fcc96b 100644 --- a/ssl/bigint.h +++ b/ssl/bigint.h @@ -30,6 +30,7 @@ BI_CTX *bi_initialize(void); void bi_terminate(BI_CTX *ctx); void bi_permanent(bigint *bi); void bi_depermanent(bigint *bi); +void bi_clear_cache(BI_CTX *ctx); void bi_free(BI_CTX *ctx, bigint *bi); bigint *bi_copy(bigint *bi); bigint *bi_clone(BI_CTX *ctx, const bigint *bi); diff --git a/ssl/rsa.c b/ssl/rsa.c index bcfc310166..d58864b2fc 100644 --- a/ssl/rsa.c +++ b/ssl/rsa.c @@ -249,6 +249,9 @@ int RSA_encrypt(const RSA_CTX *ctx, const uint8_t *in_data, uint16_t in_len, encrypt_bi = is_signing ? RSA_private(ctx, dat_bi) : RSA_public(ctx, dat_bi); bi_export(ctx->bi_ctx, encrypt_bi, out_data, byte_size); + + /* save a few bytes of memory */ + bi_clear_cache(ctx->bi_ctx); return byte_size; } @@ -296,6 +299,9 @@ bigint *RSA_sign_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, #ifdef WIN32 free(block); #endif + + /* save a few bytes of memory */ + bi_clear_cache(ctx); return bir; } diff --git a/ssl/tls1.c b/ssl/tls1.c index 0e2ced092d..fc03bc3082 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -269,7 +269,6 @@ EXP_FUNC void STDCALL ssl_free(SSL *ssl) SSL_CTX_UNLOCK(ssl_ctx->mutex); /* may already be free - but be sure */ - free(ssl->all_pkts); free(ssl->final_finish_mac); free(ssl->key_block); free(ssl->encrypt_ctx); @@ -408,13 +407,17 @@ int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) /* make sure the cert is valid */ cert = ca_cert_ctx->cert[i]; + SSL_CTX_LOCK(ssl_ctx->mutex); + if ((ret = x509_verify(ca_cert_ctx, cert))) { + SSL_CTX_UNLOCK(ssl_ctx->mutex); x509_free(cert); /* get rid of it */ ca_cert_ctx->cert[i] = NULL; goto error; } + SSL_CTX_UNLOCK(ssl_ctx->mutex); len -= offset; ret = SSL_OK; /* ok so far */ @@ -549,6 +552,8 @@ SSL *ssl_new(SSL_CTX *ssl_ctx, int client_fd) #ifdef CONFIG_ENABLE_VERIFICATION ssl->ca_cert_ctx = ssl_ctx->ca_cert_ctx; #endif + MD5_Init(&ssl->md5_ctx); + SHA1_Init(&ssl->sha1_ctx); /* a bit hacky but saves a few bytes of memory */ ssl->flag |= ssl_ctx->options; @@ -673,7 +678,7 @@ static void add_hmac_digest(SSL *ssl, int mode, uint8_t *hmac_header, */ static int verify_digest(SSL *ssl, int mode, const uint8_t *buf, int read_len) { - unsigned char hmac_buf[SHA1_SIZE]; + uint8_t hmac_buf[SHA1_SIZE]; int hmac_offset; if (ssl->cipher_info->padding_size) @@ -709,10 +714,8 @@ static int verify_digest(SSL *ssl, int mode, const uint8_t *buf, int read_len) */ void add_packet(SSL *ssl, const uint8_t *pkt, int len) { - int new_len = ssl->all_pkts_len + len; - ssl->all_pkts = (uint8_t *)realloc(ssl->all_pkts, new_len); - memcpy(&ssl->all_pkts[ssl->all_pkts_len], pkt, len); - ssl->all_pkts_len = new_len; + MD5_Update(&ssl->md5_ctx, pkt, len); + SHA1_Update(&ssl->sha1_ctx, pkt, len); } /** @@ -790,7 +793,7 @@ static void prf(const uint8_t *sec, int sec_len, uint8_t *seed, int seed_len, p_hash_md5(S1, len, seed, seed_len, xbuf, olen); p_hash_sha1(S2, len, seed, seed_len, ybuf, olen); - for (i=0; i < olen; i++) + for (i = 0; i < olen; i++) out[i] = xbuf[i] ^ ybuf[i]; } @@ -828,10 +831,10 @@ static void generate_key_block(uint8_t *client_random, uint8_t *server_random, */ void finished_digest(SSL *ssl, const char *label, uint8_t *digest) { - unsigned char mac_buf[128]; - unsigned char *q = mac_buf; - MD5_CTX md5_ctx; - SHA1_CTX sha1_ctx; + uint8_t mac_buf[128]; + uint8_t *q = mac_buf; + MD5_CTX md5_ctx = ssl->md5_ctx; + SHA1_CTX sha1_ctx = ssl->sha1_ctx; if (label) { @@ -839,13 +842,9 @@ void finished_digest(SSL *ssl, const char *label, uint8_t *digest) q += strlen(label); } - MD5_Init(&md5_ctx); - MD5_Update(&md5_ctx, ssl->all_pkts, ssl->all_pkts_len); MD5_Final(q, &md5_ctx); q += MD5_SIZE; - SHA1_Init(&sha1_ctx); - SHA1_Update(&sha1_ctx, ssl->all_pkts, ssl->all_pkts_len); SHA1_Final(q, &sha1_ctx); q += SHA1_SIZE; @@ -1476,11 +1475,6 @@ int process_finished(SSL *ssl, int hs_len) ret = send_finished(ssl); } - /* Don't need this stuff anymore */ - free(ssl->all_pkts); - ssl->all_pkts = NULL; - ssl->all_pkts_len = 0; - memset(ssl->master_secret, 0, SSL_SECRET_SIZE); free(ssl->master_secret); ssl->master_secret = NULL; @@ -1713,7 +1707,10 @@ EXP_FUNC int STDCALL ssl_get_config(int offset) */ EXP_FUNC int STDCALL ssl_verify_cert(const SSL *ssl) { - int ret = x509_verify(ssl->ssl_ctx->ca_cert_ctx, ssl->x509_ctx); + int ret; + SSL_CTX_LOCK(ssl->ssl_ctx->mutex); + ret = x509_verify(ssl->ssl_ctx->ca_cert_ctx, ssl->x509_ctx); + SSL_CTX_UNLOCK(ssl->ssl_ctx->mutex); if (ret) /* modify into an SSL error type */ { diff --git a/ssl/tls1.h b/ssl/tls1.h index 45f13527d5..e8be2e44d2 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -163,6 +163,8 @@ struct _SSL int16_t hs_status; uint8_t *all_pkts; int all_pkts_len; + MD5_CTX md5_ctx; + SHA1_CTX sha1_ctx; int client_fd; const cipher_info_t *cipher_info; uint8_t *final_finish_mac; diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index dee48eeb16..6baae5b67e 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -432,7 +432,11 @@ static int process_cert_verify(SSL *ssl) PARANOIA_CHECK(pkt_size, x509_ctx->rsa_ctx->num_octets+6); DISPLAY_RSA(ssl, "process_cert_verify", x509_ctx->rsa_ctx); + + /* rsa_ctx->bi_ctx is not thread-safe */ + SSL_CTX_LOCK(ssl->ssl_ctx->mutex); n = RSA_decrypt(x509_ctx->rsa_ctx, &buf[6], dgst_buf, 0); + SSL_CTX_UNLOCK(ssl->ssl_ctx->mutex); if (n != SHA1_SIZE + MD5_SIZE) { diff --git a/www/index.html b/www/index.html index 5730303d32..505e574559 100755 --- a/www/index.html +++ b/www/index.html @@ -7086,7 +7086,7 @@
    changes, notes and errata
    -
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* vfork() is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory.\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* vfork() is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    !GNU LESSER GENERAL PUBLIC LICENSE\n\nVersion 2.1, February 1999\n\nCopyright (C) 1991, 1999 Free Software Foundation, Inc.\n51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA\nEveryone is permitted to copy and distribute verbatim copies\nof this license document, but changing it is not allowed.\n\n[This is the first released version of the Lesser GPL. It also counts\n as the successor of the GNU Library Public License, version 2, hence\n the version number 2.1.]\n\n!!Preamble\n\nThe licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software -to make sure the software is free for all its users.\n\nThis license, the Lesser General Public License, applies to some specially designated software packages - typically libraries - of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below.\n\nWhen we speak of free software, we are referring to freedom of use, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish); that you receive source code or can get it if you want it; that you can change the software and use pieces of it in new free programs; and that you are informed that you can do these things.\n\nTo protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library or if you modify it.\n\nFor example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights.\n\nWe protect your rights with a two-step method: (1) we copyright the library, and (2) we offer you this license, which gives you legal permission to copy, distribute and/or modify the library.\n\nTo protect each distributor, we want to make it very clear that there is no warranty for the free library. Also, if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others.\n\nFinally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license.\n\nMost GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs.\n\nWhen a program is linked with a library, whether statically or using a shared library, the combination of the two is legally speaking a combined work, a derivative of the original library. The ordinary General Public License therefore permits such linking only if the entire combination fits its criteria of freedom. The Lesser General Public License permits more lax criteria for linking other code with the library.\n\nWe call this license the "Lesser" General Public License because it does Less to protect the user's freedom than the ordinary General Public License. It also provides other free software developers Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances.\n\nFor example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License.\n\nIn other cases, permission to use a particular library in non-free programs enables a greater number of people to use a large body of free software. For example, permission to use the GNU C Library in non-free programs enables many more people to use the whole GNU operating system, as well as its variant, the GNU/Linux operating system.\n\nAlthough the Lesser General Public License is Less protective of the users' freedom, it does ensure that the user of a program that is linked with the Library has the freedom and the wherewithal to run that program using a modified version of the Library.\n\nThe precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, whereas the latter must be combined with the library in order to run.\n\n!!TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION\n\n0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you".\n\nA "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables.\n\nThe "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".)\n\n"Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library.\n\nActivities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does.\n\n1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library.\n\nYou may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.\n\n2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:\n\n * a) The modified work must itself be a software library.\n * b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change.\n * c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License.\n * d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful.\n\n (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.)\n\n These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.\n\n Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library.\n\n In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.\n\n3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices.\n\nOnce this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy.\n\nThis option is useful when you wish to copy part of the code of the Library into a program that is not a library.\n\n4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange.\n\nIf distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.\n\n5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License.\n\nHowever, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables.\n\nWhen a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law.\n\nIf such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.)\n\nOtherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself.\n\n6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications.\n\nYou must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things:\n\n * a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.)\n * b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with.\n * c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.\n * d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place.\n * e) Verify that the user has already received a copy of these materials or that you have already sent this user a copy.\n\nFor an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the materials to be distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.\n\nIt may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute.\n\n7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things:\n\n * a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above.\n * b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work.\n\n8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.\n\n9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it.\n\n10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License.\n\n11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library.\n\nIf any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances.\n\nIt is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.\n\nThis section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.\n\n12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.\n\n13. The Free Software Foundation may publish revised and/or new versions of the Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.\n\nEach version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation.\n\n14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.\n\nNO WARRANTY\n\n15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.\n\nEND OF TERMS AND CONDITIONS
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 7ac1528ecd3a7152dd5b8ea2ffe2914224490642 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 3 Oct 2007 07:26:10 +0000 Subject: [PATCH 110/301] minor fix git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@132 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/tls1.c | 4 ++-- www/index.html | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ssl/tls1.c b/ssl/tls1.c index fc03bc3082..60f66f9da2 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -2045,8 +2045,8 @@ EXP_FUNC void STDCALL ssl_display_error(int error_code) {} #ifdef CONFIG_BINDINGS #if !defined(CONFIG_SSL_ENABLE_CLIENT) -EXP_FUNC SSL * STDCALL ssl_client_new(SSL_CTX *ssl_ctx, - int client_fd, const uint8_t *session_id) +EXP_FUNC SSL * STDCALL ssl_client_new(SSL_CTX *ssl_ctx, int client_fd, const + uint8_t *session_id, uint8_t sess_id_size) { printf(unsupported_str); return NULL; diff --git a/www/index.html b/www/index.html index 505e574559..9516ff52ea 100755 --- a/www/index.html +++ b/www/index.html @@ -7086,7 +7086,7 @@
    changes, notes and errata
    -
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory.\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* vfork() is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* vfork() is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    !GNU LESSER GENERAL PUBLIC LICENSE\n\nVersion 2.1, February 1999\n\nCopyright (C) 1991, 1999 Free Software Foundation, Inc.\n51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA\nEveryone is permitted to copy and distribute verbatim copies\nof this license document, but changing it is not allowed.\n\n[This is the first released version of the Lesser GPL. It also counts\n as the successor of the GNU Library Public License, version 2, hence\n the version number 2.1.]\n\n!!Preamble\n\nThe licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software -to make sure the software is free for all its users.\n\nThis license, the Lesser General Public License, applies to some specially designated software packages - typically libraries - of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below.\n\nWhen we speak of free software, we are referring to freedom of use, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish); that you receive source code or can get it if you want it; that you can change the software and use pieces of it in new free programs; and that you are informed that you can do these things.\n\nTo protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library or if you modify it.\n\nFor example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights.\n\nWe protect your rights with a two-step method: (1) we copyright the library, and (2) we offer you this license, which gives you legal permission to copy, distribute and/or modify the library.\n\nTo protect each distributor, we want to make it very clear that there is no warranty for the free library. Also, if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others.\n\nFinally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license.\n\nMost GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs.\n\nWhen a program is linked with a library, whether statically or using a shared library, the combination of the two is legally speaking a combined work, a derivative of the original library. The ordinary General Public License therefore permits such linking only if the entire combination fits its criteria of freedom. The Lesser General Public License permits more lax criteria for linking other code with the library.\n\nWe call this license the "Lesser" General Public License because it does Less to protect the user's freedom than the ordinary General Public License. It also provides other free software developers Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances.\n\nFor example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License.\n\nIn other cases, permission to use a particular library in non-free programs enables a greater number of people to use a large body of free software. For example, permission to use the GNU C Library in non-free programs enables many more people to use the whole GNU operating system, as well as its variant, the GNU/Linux operating system.\n\nAlthough the Lesser General Public License is Less protective of the users' freedom, it does ensure that the user of a program that is linked with the Library has the freedom and the wherewithal to run that program using a modified version of the Library.\n\nThe precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, whereas the latter must be combined with the library in order to run.\n\n!!TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION\n\n0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you".\n\nA "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables.\n\nThe "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".)\n\n"Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library.\n\nActivities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does.\n\n1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library.\n\nYou may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.\n\n2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:\n\n * a) The modified work must itself be a software library.\n * b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change.\n * c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License.\n * d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful.\n\n (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.)\n\n These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.\n\n Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library.\n\n In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.\n\n3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices.\n\nOnce this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy.\n\nThis option is useful when you wish to copy part of the code of the Library into a program that is not a library.\n\n4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange.\n\nIf distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.\n\n5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License.\n\nHowever, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables.\n\nWhen a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law.\n\nIf such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.)\n\nOtherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself.\n\n6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications.\n\nYou must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things:\n\n * a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.)\n * b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with.\n * c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.\n * d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place.\n * e) Verify that the user has already received a copy of these materials or that you have already sent this user a copy.\n\nFor an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the materials to be distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.\n\nIt may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute.\n\n7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things:\n\n * a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above.\n * b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work.\n\n8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.\n\n9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it.\n\n10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License.\n\n11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library.\n\nIf any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances.\n\nIt is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.\n\nThis section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.\n\n12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.\n\n13. The Free Software Foundation may publish revised and/or new versions of the Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.\n\nEach version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation.\n\n14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.\n\nNO WARRANTY\n\n15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.\n\nEND OF TERMS AND CONDITIONS
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 5094c5e81c2cd0afa331ed9fe9675b50ada8d536 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 3 Oct 2007 22:00:33 +0000 Subject: [PATCH 111/301] fixed memory leak in renegotiation git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@133 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/tls1_clnt.c | 1 + 1 file changed, 1 insertion(+) diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index 939318b0ea..c33962e781 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -131,6 +131,7 @@ int do_client_connect(SSL *ssl) ssl->bm_read_index = 0; ssl->next_state = HS_SERVER_HELLO; ssl->hs_status = SSL_NOT_OK; /* not connected */ + x509_free(ssl->x509_ctx); /* sit in a loop until it all looks good */ while (ssl->hs_status != SSL_OK) From 6afb2ce28b06502dc97c44f04e87d6f4ecc8edd4 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 3 Oct 2007 22:10:21 +0000 Subject: [PATCH 112/301] made inc ms5/sha1 a tmp git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@134 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/tls1.c | 16 ++++++++++------ ssl/tls1.h | 4 ++-- ssl/tls1_clnt.c | 4 ++++ ssl/tls1_svr.c | 4 ++++ 4 files changed, 20 insertions(+), 8 deletions(-) diff --git a/ssl/tls1.c b/ssl/tls1.c index 60f66f9da2..2a32f40687 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -274,6 +274,8 @@ EXP_FUNC void STDCALL ssl_free(SSL *ssl) free(ssl->encrypt_ctx); free(ssl->decrypt_ctx); free(ssl->master_secret); + free(ssl->md5_ctx); + free(ssl->sha1_ctx); #ifdef CONFIG_SSL_CERT_VERIFICATION x509_free(ssl->x509_ctx); #endif @@ -552,8 +554,10 @@ SSL *ssl_new(SSL_CTX *ssl_ctx, int client_fd) #ifdef CONFIG_ENABLE_VERIFICATION ssl->ca_cert_ctx = ssl_ctx->ca_cert_ctx; #endif - MD5_Init(&ssl->md5_ctx); - SHA1_Init(&ssl->sha1_ctx); + ssl->md5_ctx = (MD5_CTX *)malloc(sizeof(MD5_CTX)); + ssl->sha1_ctx = (SHA1_CTX *)malloc(sizeof(SHA1_CTX)); + MD5_Init(ssl->md5_ctx); + SHA1_Init(ssl->sha1_ctx); /* a bit hacky but saves a few bytes of memory */ ssl->flag |= ssl_ctx->options; @@ -714,8 +718,8 @@ static int verify_digest(SSL *ssl, int mode, const uint8_t *buf, int read_len) */ void add_packet(SSL *ssl, const uint8_t *pkt, int len) { - MD5_Update(&ssl->md5_ctx, pkt, len); - SHA1_Update(&ssl->sha1_ctx, pkt, len); + MD5_Update(ssl->md5_ctx, pkt, len); + SHA1_Update(ssl->sha1_ctx, pkt, len); } /** @@ -833,8 +837,8 @@ void finished_digest(SSL *ssl, const char *label, uint8_t *digest) { uint8_t mac_buf[128]; uint8_t *q = mac_buf; - MD5_CTX md5_ctx = ssl->md5_ctx; - SHA1_CTX sha1_ctx = ssl->sha1_ctx; + MD5_CTX md5_ctx = *ssl->md5_ctx; + SHA1_CTX sha1_ctx = *ssl->sha1_ctx; if (label) { diff --git a/ssl/tls1.h b/ssl/tls1.h index e8be2e44d2..8590215acc 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -163,8 +163,8 @@ struct _SSL int16_t hs_status; uint8_t *all_pkts; int all_pkts_len; - MD5_CTX md5_ctx; - SHA1_CTX sha1_ctx; + MD5_CTX *md5_ctx; + SHA1_CTX *sha1_ctx; int client_fd; const cipher_info_t *cipher_info; uint8_t *final_finish_mac; diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index c33962e781..92f60fb809 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -110,6 +110,10 @@ int do_clnt_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len) case HS_FINISHED: ret = process_finished(ssl, hs_len); + free(ssl->md5_ctx); + free(ssl->sha1_ctx); + ssl->md5_ctx = NULL; + ssl->sha1_ctx = NULL; break; case HS_HELLO_REQUEST: diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index 6baae5b67e..1da3d8fc42 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -92,6 +92,10 @@ int do_svr_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len) case HS_FINISHED: ret = process_finished(ssl, hs_len); + free(ssl->md5_ctx); + free(ssl->sha1_ctx); + ssl->md5_ctx = NULL; + ssl->sha1_ctx = NULL; break; } From fa0bf09b86a0f5982cabaca2b4e05c950f67f3ea Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 4 Oct 2007 11:25:28 +0000 Subject: [PATCH 113/301] some more memory tweaks git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@135 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/test/ssltest.c | 5 +- ssl/tls1.c | 123 ++++++++++++++++++++++----------------------- ssl/tls1.h | 27 +++++----- ssl/tls1_clnt.c | 16 +++--- ssl/tls1_svr.c | 11 ++-- 5 files changed, 88 insertions(+), 94 deletions(-) diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index b91c5fe89e..a566ea954c 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1470,9 +1470,8 @@ static void do_basic(void) ssl_clnt = ssl_client_new(ssl_clnt_ctx, client_fd, NULL, 0); /* check the return status */ - if (ssl_handshake_status(ssl_clnt)) + if (ssl_handshake_status(ssl_clnt) < 0) { - printf("Client "); ssl_display_error(ssl_handshake_status(ssl_clnt)); goto error; } @@ -1722,7 +1721,7 @@ int multi_thread_test(void) **************************************************************************/ static void do_header_issue(void) { - uint8_t axtls_buf[2048]; + char axtls_buf[2048]; #ifndef WIN32 pthread_setcanceltype(PTHREAD_CANCEL_ASYNCHRONOUS, NULL); #endif diff --git a/ssl/tls1.c b/ssl/tls1.c index 2a32f40687..e4c8bf5f21 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -269,13 +269,9 @@ EXP_FUNC void STDCALL ssl_free(SSL *ssl) SSL_CTX_UNLOCK(ssl_ctx->mutex); /* may already be free - but be sure */ - free(ssl->final_finish_mac); - free(ssl->key_block); free(ssl->encrypt_ctx); free(ssl->decrypt_ctx); - free(ssl->master_secret); - free(ssl->md5_ctx); - free(ssl->sha1_ctx); + disposable_free(ssl); #ifdef CONFIG_SSL_CERT_VERIFICATION x509_free(ssl->x509_ctx); #endif @@ -499,6 +495,7 @@ EXP_FUNC int STDCALL ssl_renegotiate(SSL *ssl) { int ret = SSL_OK; + disposable_new(ssl); #ifdef CONFIG_SSL_ENABLE_CLIENT if (IS_SET_SSL_FLAG(SSL_IS_CLIENT)) { @@ -547,17 +544,12 @@ SSL *ssl_new(SSL_CTX *ssl_ctx, int client_fd) ssl->need_bytes = SSL_RECORD_SIZE; /* need a record */ ssl->client_fd = client_fd; ssl->flag = SSL_NEED_RECORD; - ssl->certs = ssl_ctx->certs; - ssl->chain_length = ssl_ctx->chain_length; ssl->bm_data = ssl->bm_all_data+BM_RECORD_OFFSET; /* space at the start */ ssl->hs_status = SSL_NOT_OK; /* not connected */ #ifdef CONFIG_ENABLE_VERIFICATION ssl->ca_cert_ctx = ssl_ctx->ca_cert_ctx; #endif - ssl->md5_ctx = (MD5_CTX *)malloc(sizeof(MD5_CTX)); - ssl->sha1_ctx = (SHA1_CTX *)malloc(sizeof(SHA1_CTX)); - MD5_Init(ssl->md5_ctx); - SHA1_Init(ssl->sha1_ctx); + disposable_new(ssl); /* a bit hacky but saves a few bytes of memory */ ssl->flag |= ssl_ctx->options; @@ -718,8 +710,8 @@ static int verify_digest(SSL *ssl, int mode, const uint8_t *buf, int read_len) */ void add_packet(SSL *ssl, const uint8_t *pkt, int len) { - MD5_Update(ssl->md5_ctx, pkt, len); - SHA1_Update(ssl->sha1_ctx, pkt, len); + MD5_Update(&ssl->dc->md5_ctx, pkt, len); + SHA1_Update(&ssl->dc->sha1_ctx, pkt, len); } /** @@ -809,10 +801,9 @@ void generate_master_secret(SSL *ssl, const uint8_t *premaster_secret) { uint8_t buf[128]; /* needs to be > 13+32+32 in size */ strcpy((char *)buf, "master secret"); - memcpy(&buf[13], ssl->client_random, SSL_RANDOM_SIZE); - memcpy(&buf[45], ssl->server_random, SSL_RANDOM_SIZE); - ssl->master_secret = (uint8_t *)malloc(SSL_SECRET_SIZE); - prf(premaster_secret, SSL_SECRET_SIZE, buf, 77, ssl->master_secret, + memcpy(&buf[13], ssl->dc->client_random, SSL_RANDOM_SIZE); + memcpy(&buf[45], ssl->dc->server_random, SSL_RANDOM_SIZE); + prf(premaster_secret, SSL_SECRET_SIZE, buf, 77, ssl->dc->master_secret, SSL_SECRET_SIZE); } @@ -837,8 +828,8 @@ void finished_digest(SSL *ssl, const char *label, uint8_t *digest) { uint8_t mac_buf[128]; uint8_t *q = mac_buf; - MD5_CTX md5_ctx = *ssl->md5_ctx; - SHA1_CTX sha1_ctx = *ssl->sha1_ctx; + MD5_CTX md5_ctx = ssl->dc->md5_ctx; + SHA1_CTX sha1_ctx = ssl->dc->sha1_ctx; if (label) { @@ -854,7 +845,7 @@ void finished_digest(SSL *ssl, const char *label, uint8_t *digest) if (label) { - prf(ssl->master_secret, SSL_SECRET_SIZE, mac_buf, (int)(q-mac_buf), + prf(ssl->dc->master_secret, SSL_SECRET_SIZE, mac_buf, (int)(q-mac_buf), digest, SSL_FINISHED_HASH_SIZE); } else /* for use in a certificate verify */ @@ -864,7 +855,7 @@ void finished_digest(SSL *ssl, const char *label, uint8_t *digest) #if 0 printf("label: %s\n", label); - print_blob("master secret", ssl->master_secret, 48); + print_blob("master secret", ssl->dc->master_secret, 48); print_blob("mac_buf", mac_buf, q-mac_buf); print_blob("finished digest", digest, SSL_FINISHED_HASH_SIZE); #endif @@ -1071,27 +1062,26 @@ static void set_key_block(SSL *ssl, int is_write) uint8_t client_key[32], server_key[32]; /* big enough for AES256 */ uint8_t client_iv[16], server_iv[16]; /* big enough for AES128/256 */ int is_client = IS_SET_SSL_FLAG(SSL_IS_CLIENT); - int key_block_existed = 1; /* only do once in a handshake */ - if (ssl->key_block == NULL) + if (ssl->dc->key_block == NULL) { - ssl->key_block = (uint8_t *)malloc(ciph_info->key_block_size); + ssl->dc->key_block = (uint8_t *)malloc(ciph_info->key_block_size); #if 0 - print_blob("client", ssl->client_random, 32); - print_blob("server", ssl->server_random, 32); - print_blob("master", ssl->master_secret, SSL_SECRET_SIZE); + print_blob("client", ssl->dc->client_random, 32); + print_blob("server", ssl->dc->server_random, 32); + print_blob("master", ssl->dc->master_secret, SSL_SECRET_SIZE); #endif - generate_key_block(ssl->client_random, ssl->server_random, - ssl->master_secret, ssl->key_block, ciph_info->key_block_size); + generate_key_block(ssl->dc->client_random, ssl->dc->server_random, + ssl->dc->master_secret, ssl->dc->key_block, + ciph_info->key_block_size); #if 0 print_blob("keyblock", ssl->key_block, ciph_info->key_block_size); #endif - key_block_existed = 0; } - q = ssl->key_block; + q = ssl->dc->key_block; if ((is_client && is_write) || (!is_client && !is_write)) { @@ -1123,15 +1113,10 @@ static void set_key_block(SSL *ssl, int is_write) free(is_write ? ssl->encrypt_ctx : ssl->decrypt_ctx); - if (ssl->final_finish_mac == NULL) - { - ssl->final_finish_mac = (uint8_t *)malloc(SSL_FINISHED_HASH_SIZE); - } - /* now initialise the ciphers */ if (is_client) { - finished_digest(ssl, server_finished, ssl->final_finish_mac); + finished_digest(ssl, server_finished, ssl->dc->final_finish_mac); if (is_write) ssl->encrypt_ctx = crypt_new(ssl, client_key, client_iv, 0); @@ -1140,7 +1125,7 @@ static void set_key_block(SSL *ssl, int is_write) } else { - finished_digest(ssl, client_finished, ssl->final_finish_mac); + finished_digest(ssl, client_finished, ssl->dc->final_finish_mac); if (is_write) ssl->encrypt_ctx = crypt_new(ssl, server_key, server_iv, 0); @@ -1149,14 +1134,6 @@ static void set_key_block(SSL *ssl, int is_write) } ssl->cipher_info = ciph_info; - - /* clean up if possible */ - if (key_block_existed) - { - memset(ssl->key_block, 0, ciph_info->key_block_size); - free(ssl->key_block); - ssl->key_block = NULL; - } } /** @@ -1249,7 +1226,7 @@ int basic_read(SSL *ssl, uint8_t **in_data) switch (ssl->record_type) { case PT_HANDSHAKE_PROTOCOL: - ssl->bm_proc_index = 0; + ssl->dc->bm_proc_index = 0; ret = do_handshake(ssl, buf, read_len); break; @@ -1379,7 +1356,7 @@ int send_finished(SSL *ssl) if (!IS_SET_SSL_FLAG(SSL_SESSION_RESUME) && ssl->ssl_ctx->num_sessions) { memcpy(ssl->session->master_secret, - ssl->master_secret, SSL_SECRET_SIZE); + ssl->dc->master_secret, SSL_SECRET_SIZE); } #endif @@ -1470,7 +1447,7 @@ int process_finished(SSL *ssl, int hs_len) PARANOIA_CHECK(ssl->bm_index, SSL_FINISHED_HASH_SIZE+4); /* check that we all work before we continue */ - if (memcmp(ssl->final_finish_mac, &buf[4], SSL_FINISHED_HASH_SIZE)) + if (memcmp(ssl->dc->final_finish_mac, &buf[4], SSL_FINISHED_HASH_SIZE)) return SSL_ERROR_FINISHED_INVALID; if ((!is_client && !resume) || (is_client && resume)) @@ -1479,14 +1456,6 @@ int process_finished(SSL *ssl, int hs_len) ret = send_finished(ssl); } - memset(ssl->master_secret, 0, SSL_SECRET_SIZE); - free(ssl->master_secret); - ssl->master_secret = NULL; - - memset(ssl->final_finish_mac, 0, SSL_FINISHED_HASH_SIZE); - free(ssl->final_finish_mac); - ssl->final_finish_mac = NULL; - /* if we ever renegotiate */ ssl->next_state = is_client ? HS_HELLO_REQUEST : HS_CLIENT_HELLO; ssl->hs_status = ret; /* set the final handshake status */ @@ -1509,9 +1478,9 @@ int send_certificate(SSL *ssl) buf[1] = 0; buf[4] = 0; - while (i < ssl->chain_length) + while (i < ssl->ssl_ctx->chain_length) { - SSL_CERT *cert = &ssl->certs[i]; + SSL_CERT *cert = &ssl->ssl_ctx->certs[i]; buf[offset++] = 0; buf[offset++] = cert->size >> 8; /* cert 1 length */ buf[offset++] = cert->size & 0xff; @@ -1530,6 +1499,35 @@ int send_certificate(SSL *ssl) return send_packet(ssl, PT_HANDSHAKE_PROTOCOL, NULL, offset); } +/** + * Create a blob of memory that we'll get rid of once the handshake is + * complete. + */ +void disposable_new(SSL *ssl) +{ + if (ssl->dc == NULL) + { + ssl->dc = (DISPOSABLE_CTX *)calloc(1, sizeof(DISPOSABLE_CTX)); + MD5_Init(&ssl->dc->md5_ctx); + SHA1_Init(&ssl->dc->sha1_ctx); + } +} + +/** + * Remove the temporary blob of memory. + */ +void disposable_free(SSL *ssl) +{ + if (ssl->dc) + { + free(ssl->dc->key_block); + memset(ssl->dc, 0, sizeof(DISPOSABLE_CTX)); + free(ssl->dc); + ssl->dc = NULL; + } + +} + #ifndef CONFIG_SSL_SKELETON_MODE /* no session resumption in this mode */ /** * Find if an existing session has the same session id. If so, use the @@ -1566,9 +1564,8 @@ SSL_SESS *ssl_session_update(int max_sessions, SSL_SESS *ssl_sessions[], if (memcmp(ssl_sessions[i]->session_id, session_id, SSL_SESSION_ID_SIZE) == 0) { - ssl->master_secret = (uint8_t *)malloc(SSL_SECRET_SIZE); ssl->session_index = i; - memcpy(ssl->master_secret, + memcpy(ssl->dc->master_secret, ssl_sessions[i]->master_secret, SSL_SECRET_SIZE); SET_SSL_FLAG(SSL_SESSION_RESUME); SSL_CTX_UNLOCK(ssl->ssl_ctx->mutex); @@ -1730,7 +1727,7 @@ EXP_FUNC int STDCALL ssl_verify_cert(const SSL *ssl) int process_certificate(SSL *ssl, X509_CTX **x509_ctx) { int ret = SSL_OK; - uint8_t *buf = &ssl->bm_data[ssl->bm_proc_index]; + uint8_t *buf = &ssl->bm_data[ssl->dc->bm_proc_index]; int pkt_size = ssl->bm_index; int cert_size, offset = 5; int total_cert_size = (buf[offset]<<8) + buf[offset+1]; @@ -1766,7 +1763,7 @@ int process_certificate(SSL *ssl, X509_CTX **x509_ctx) DISPLAY_CERT(ssl, "process_certificate", *x509_ctx); ssl->next_state = is_client ? HS_SERVER_HELLO_DONE : HS_CLIENT_KEY_XCHG; - ssl->bm_proc_index += offset; + ssl->dc->bm_proc_index += offset; error: return ret; } diff --git a/ssl/tls1.h b/ssl/tls1.h index 8590215acc..b21f4d67fe 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -150,35 +150,39 @@ typedef struct int size; } SSL_CERT; +typedef struct +{ + MD5_CTX md5_ctx; + SHA1_CTX sha1_ctx; + uint8_t final_finish_mac[SSL_FINISHED_HASH_SIZE]; + uint8_t *key_block; + uint8_t master_secret[SSL_SECRET_SIZE]; + uint8_t client_random[SSL_RANDOM_SIZE]; /* client's random sequence */ + uint8_t server_random[SSL_RANDOM_SIZE]; /* server's random sequence */ + uint16_t bm_proc_index; +} DISPOSABLE_CTX; + struct _SSL { uint32_t flag; uint16_t need_bytes; uint16_t got_bytes; uint8_t record_type; - uint8_t chain_length; uint8_t cipher; uint8_t sess_id_size; int16_t next_state; int16_t hs_status; - uint8_t *all_pkts; - int all_pkts_len; - MD5_CTX *md5_ctx; - SHA1_CTX *sha1_ctx; + DISPOSABLE_CTX *dc; /* temporary data which we'll get rid of soon */ int client_fd; const cipher_info_t *cipher_info; - uint8_t *final_finish_mac; - uint8_t *key_block; void *encrypt_ctx; void *decrypt_ctx; uint8_t bm_all_data[RT_MAX_PLAIN_LENGTH+RT_EXTRA]; uint8_t *bm_data; uint16_t bm_index; uint16_t bm_read_index; - uint16_t bm_proc_index; struct _SSL *next; /* doubly linked list */ struct _SSL *prev; - SSL_CERT *certs; struct _SSL_CTX *ssl_ctx; /* back reference to a clnt/svr ctx */ #ifndef CONFIG_SSL_SKELETON_MODE uint16_t session_index; @@ -191,9 +195,6 @@ struct _SSL uint8_t session_id[SSL_SESSION_ID_SIZE]; uint8_t client_mac[SHA1_SIZE]; /* for HMAC verification */ uint8_t server_mac[SHA1_SIZE]; /* for HMAC verification */ - uint8_t client_random[SSL_RANDOM_SIZE]; /* client's random sequence */ - uint8_t server_random[SSL_RANDOM_SIZE]; /* server's random sequence */ - uint8_t *master_secret; uint8_t read_sequence[8]; /* 64 bit sequence number */ uint8_t write_sequence[8]; /* 64 bit sequence number */ uint8_t hmac_header[SSL_RECORD_SIZE]; /* rx hmac */ @@ -232,6 +233,8 @@ typedef struct _SSL_CTX SSLCTX; extern const uint8_t ssl_prot_prefs[NUM_PROTOCOLS]; SSL *ssl_new(SSL_CTX *ssl_ctx, int client_fd); +void disposable_new(SSL *ssl); +void disposable_free(SSL *ssl); int send_packet(SSL *ssl, uint8_t protocol, const uint8_t *in, int length); int do_svr_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len); diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index 92f60fb809..8b38e3768a 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -110,13 +110,11 @@ int do_clnt_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len) case HS_FINISHED: ret = process_finished(ssl, hs_len); - free(ssl->md5_ctx); - free(ssl->sha1_ctx); - ssl->md5_ctx = NULL; - ssl->sha1_ctx = NULL; + disposable_free(ssl); /* free up some memory */ break; case HS_HELLO_REQUEST: + disposable_new(ssl); ret = do_client_connect(ssl); break; } @@ -185,7 +183,7 @@ static int send_client_hello(SSL *ssl) *tm_ptr++ = (uint8_t)(((long)tm & 0x0000ff00) >> 8); *tm_ptr++ = (uint8_t)(((long)tm & 0x000000ff)); get_random(SSL_RANDOM_SIZE-4, &buf[10]); - memcpy(ssl->client_random, &buf[6], SSL_RANDOM_SIZE); + memcpy(ssl->dc->client_random, &buf[6], SSL_RANDOM_SIZE); offset = 6 + SSL_RANDOM_SIZE; /* give session resumption a go */ @@ -236,7 +234,7 @@ static int process_server_hello(SSL *ssl) return SSL_ERROR_INVALID_VERSION; /* get the server random value */ - memcpy(ssl->server_random, &buf[6], SSL_RANDOM_SIZE); + memcpy(ssl->dc->server_random, &buf[6], SSL_RANDOM_SIZE); offset = 6 + SSL_RANDOM_SIZE; /* skip of session id size */ sess_id_size = buf[offset++]; @@ -265,7 +263,7 @@ static int process_server_hello(SSL *ssl) offset++; // skip the compr PARANOIA_CHECK(pkt_size, offset); - ssl->bm_proc_index = offset+1; + ssl->dc->bm_proc_index = offset+1; error: return ret; @@ -317,7 +315,7 @@ static int send_client_key_xchg(SSL *ssl) */ static int process_cert_req(SSL *ssl) { - uint8_t *buf = &ssl->bm_data[ssl->bm_proc_index]; + uint8_t *buf = &ssl->bm_data[ssl->dc->bm_proc_index]; int ret = SSL_OK; int offset = (buf[2] << 4) + buf[3]; int pkt_size = ssl->bm_index; @@ -325,7 +323,7 @@ static int process_cert_req(SSL *ssl) /* don't do any processing - we will send back an RSA certificate anyway */ ssl->next_state = HS_SERVER_HELLO_DONE; SET_SSL_FLAG(SSL_HAS_CERT_REQ); - ssl->bm_proc_index += offset; + ssl->dc->bm_proc_index += offset; PARANOIA_CHECK(pkt_size, offset); error: return ret; diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index 1da3d8fc42..d763917da8 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -92,10 +92,7 @@ int do_svr_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len) case HS_FINISHED: ret = process_finished(ssl, hs_len); - free(ssl->md5_ctx); - free(ssl->sha1_ctx); - ssl->md5_ctx = NULL; - ssl->sha1_ctx = NULL; + disposable_free(ssl); /* free up some memory */ break; } @@ -122,7 +119,7 @@ static int process_client_hello(SSL *ssl) goto error; } - memcpy(ssl->client_random, &buf[6], SSL_RANDOM_SIZE); + memcpy(ssl->dc->client_random, &buf[6], SSL_RANDOM_SIZE); /* process the session id */ id_len = buf[offset++]; @@ -233,7 +230,7 @@ int process_sslv23_client_hello(SSL *ssl) random_offset += 0x10; } - memcpy(&ssl->client_random[random_offset], &buf[offset], ch_len); + memcpy(&ssl->dc->client_random[random_offset], &buf[offset], ch_len); ret = send_server_hello_sequence(ssl); error: @@ -303,7 +300,7 @@ static int send_server_hello(SSL *ssl) /* server random value */ get_random(SSL_RANDOM_SIZE, &buf[6]); - memcpy(ssl->server_random, &buf[6], SSL_RANDOM_SIZE); + memcpy(ssl->dc->server_random, &buf[6], SSL_RANDOM_SIZE); offset = 6 + SSL_RANDOM_SIZE; #ifndef CONFIG_SSL_SKELETON_MODE From 27f866daac0eb55073a5cedccc73c0d28faf5570 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 12 Oct 2007 06:40:24 +0000 Subject: [PATCH 114/301] removed chroot() after lwn article git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@137 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/linuxconfig | 1 - config/win32config | 1 - httpd/Config.in | 11 ----------- httpd/axhttpd.c | 4 ---- httpd/proc.c | 5 ----- 5 files changed, 22 deletions(-) diff --git a/config/linuxconfig b/config/linuxconfig index d1d883e09b..949ac051b6 100644 --- a/config/linuxconfig +++ b/config/linuxconfig @@ -65,7 +65,6 @@ CONFIG_HTTP_LUA_PREFIX="/usr/local" # CONFIG_HTTP_BUILD_LUA is not set CONFIG_HTTP_DIRECTORIES=y CONFIG_HTTP_HAS_AUTHORIZATION=y -# CONFIG_HTTP_USE_CHROOT is not set # CONFIG_HTTP_CHANGE_UID is not set # CONFIG_HTTP_HAS_IPV6 is not set # CONFIG_HTTP_VERBOSE is not set diff --git a/config/win32config b/config/win32config index ae6abf18b2..8640ea0f7e 100644 --- a/config/win32config +++ b/config/win32config @@ -71,7 +71,6 @@ CONFIG_HTTP_LUA_CGI_LAUNCHER="" # CONFIG_HTTP_BUILD_LUA is not set CONFIG_HTTP_DIRECTORIES=y CONFIG_HTTP_HAS_AUTHORIZATION=y -# CONFIG_HTTP_USE_CHROOT is not set # CONFIG_HTTP_CHANGE_UID is not set # CONFIG_HTTP_HAS_IPV6 is not set CONFIG_HTTP_VERBOSE=y diff --git a/httpd/Config.in b/httpd/Config.in index cbbbc7d5ec..ad66e2a167 100644 --- a/httpd/Config.in +++ b/httpd/Config.in @@ -119,17 +119,6 @@ config CONFIG_HTTP_HAS_AUTHORIZATION help Pages/directories can have passwords associated with them. -config CONFIG_HTTP_USE_CHROOT - bool "Use chroot()" - default n - depends on !CONFIG_PLATFORM_WIN32 - help - Use chroot() to switch directories with a certain degree of - protection. However access to /bin and /lib have to replaced with - duplicate binaries. - - This feature is normally disabled. - config CONFIG_HTTP_CHANGE_UID bool "Change UID" default n diff --git a/httpd/axhttpd.c b/httpd/axhttpd.c index 701d588530..1594f1cb83 100644 --- a/httpd/axhttpd.c +++ b/httpd/axhttpd.c @@ -576,11 +576,7 @@ static void ax_chdir(void) { static char *webroot = CONFIG_HTTP_WEBROOT; -#if defined(WIN32) || !defined(CONFIG_HTTP_USE_CHROOT) if (chdir(webroot)) -#else /* use chroot() instead */ - if (chroot(webroot)) -#endif { #ifdef CONFIG_HTTP_VERBOSE fprintf(stderr, "'%s' is not a directory\n", webroot); diff --git a/httpd/proc.c b/httpd/proc.c index 35388e7fcc..270dd70942 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -916,12 +916,7 @@ static int hexit(char c) static void buildactualfile(struct connstruct *cn) { char *cp; - -#ifdef CONFIG_HTTP_USE_CHROOT - snprintf(cn->actualfile, MAXREQUESTLENGTH, "%s", cn->filereq); -#else snprintf(cn->actualfile, MAXREQUESTLENGTH, ".%s", cn->filereq); -#endif #ifndef WIN32 /* Add directory slash if not there */ From 2f2dd5954515de8277f151fdf35a089833487cd2 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 22 Oct 2007 13:17:02 +0000 Subject: [PATCH 115/301] changed var arrays to alloca git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@138 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/bigint.h | 2 +- ssl/openssl.c | 2 ++ ssl/os_port.h | 24 ++++++++++++++++++++++++ ssl/rsa.c | 19 ++----------------- ssl/tls1.c | 12 ++---------- ssl/tls1.h | 23 ----------------------- 6 files changed, 31 insertions(+), 51 deletions(-) diff --git a/ssl/bigint.h b/ssl/bigint.h index 5c70fcc96b..8c248a9306 100644 --- a/ssl/bigint.h +++ b/ssl/bigint.h @@ -19,8 +19,8 @@ #ifndef BIGINT_HEADER #define BIGINT_HEADER -#include "os_port.h" #include "crypto.h" +#include "os_port.h" #include "bigint_impl.h" #ifndef CONFIG_BIGINT_CHECK_ON diff --git a/ssl/openssl.c b/ssl/openssl.c index 1c5ddf7e11..3b63019e90 100644 --- a/ssl/openssl.c +++ b/ssl/openssl.c @@ -180,10 +180,12 @@ void SSL_CTX_set_options(SSL_CTX *ssl_ctx, int option) {} int SSL_library_init(void ) { return 1; } void SSL_load_error_strings(void ) {} void ERR_print_errors_fp(FILE *fp) {} +#ifndef CONFIG_SSL_SKELETON_MODE long SSL_CTX_get_timeout(const SSL_CTX *ssl_ctx) { return CONFIG_SSL_EXPIRY_TIME*3600; } long SSL_CTX_set_timeout(SSL_CTX *ssl_ctx, long t) { return SSL_CTX_get_timeout(ssl_ctx); } +#endif void BIO_printf(FILE *f, const char *format, ...) { va_list(ap); diff --git a/ssl/os_port.h b/ssl/os_port.h index c6ecb6f83a..26bb709689 100644 --- a/ssl/os_port.h +++ b/ssl/os_port.h @@ -87,6 +87,7 @@ extern "C" { #define strdup(A) _strdup(A) #define chroot(A) _chdir(A) #define chdir(A) _chdir(A) +#define alloca(A) _alloca(A) #ifndef lseek #define lseek(A,B,C) _lseek(A,B,C) #endif @@ -166,6 +167,29 @@ void exit_now(const char *format, ...) __attribute((noreturn)); void exit_now(const char *format, ...); #endif +/* Mutexing definitions */ +#if defined(CONFIG_SSL_CTX_MUTEXING) +#if defined(WIN32) +#define SSL_CTX_MUTEX_TYPE HANDLE +#define SSL_CTX_MUTEX_INIT(A) A=CreateMutex(0, FALSE, 0) +#define SSL_CTX_MUTEX_DESTROY(A) CloseHandle(A) +#define SSL_CTX_LOCK(A) WaitForSingleObject(A, INFINITE) +#define SSL_CTX_UNLOCK(A) ReleaseMutex(A) +#else +#include +#define SSL_CTX_MUTEX_TYPE pthread_mutex_t +#define SSL_CTX_MUTEX_INIT(A) pthread_mutex_init(&A, NULL) +#define SSL_CTX_MUTEX_DESTROY(A) pthread_mutex_destroy(&A) +#define SSL_CTX_LOCK(A) pthread_mutex_lock(&A) +#define SSL_CTX_UNLOCK(A) pthread_mutex_unlock(&A) +#endif +#else /* no mutexing */ +#define SSL_CTX_MUTEX_INIT(A) +#define SSL_CTX_MUTEX_DESTROY(A) +#define SSL_CTX_LOCK(A) +#define SSL_CTX_UNLOCK(A) +#endif + #ifdef __cplusplus } #endif diff --git a/ssl/rsa.c b/ssl/rsa.c index d58864b2fc..4d70c10b67 100644 --- a/ssl/rsa.c +++ b/ssl/rsa.c @@ -128,11 +128,7 @@ int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data, const int byte_size = ctx->num_octets; int i, size; bigint *decrypted_bi, *dat_bi; -#ifndef WIN32 - uint8_t block[byte_size]; -#else - uint8_t *block = (uint8_t *)malloc(byte_size); -#endif + uint8_t *block = (uint8_t *)alloca(byte_size); memset(out_data, 0, byte_size); /* initialise */ @@ -169,9 +165,6 @@ int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data, if (size > 0) memcpy(out_data, &block[i], size); -#ifdef WIN32 - free(block); -#endif return size ? size : -1; } @@ -264,11 +257,7 @@ bigint *RSA_sign_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, int i, size; bigint *decrypted_bi, *dat_bi; bigint *bir = NULL; -#ifndef WIN32 - uint8_t block[sig_len]; -#else - uint8_t *block = (uint8_t *)malloc(sig_len); -#endif + uint8_t *block = (uint8_t *)alloca(sig_len); /* decrypt */ dat_bi = bi_import(ctx, sig, sig_len); @@ -296,10 +285,6 @@ bigint *RSA_sign_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, } } -#ifdef WIN32 - free(block); -#endif - /* save a few bytes of memory */ bi_clear_cache(ctx); return bir; diff --git a/ssl/tls1.c b/ssl/tls1.c index e4c8bf5f21..4a6a8cbd2d 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -307,7 +307,6 @@ EXP_FUNC int STDCALL ssl_read(SSL *ssl, uint8_t **in_data) */ EXP_FUNC int STDCALL ssl_write(SSL *ssl, const uint8_t *out_data, int out_len) { - int n = out_len, nw, i, tot = 0; /* maximum size of a TLS packet is around 16kB, so fragment */ @@ -624,11 +623,7 @@ static void add_hmac_digest(SSL *ssl, int mode, uint8_t *hmac_header, const uint8_t *buf, int buf_len, uint8_t *hmac_buf) { int hmac_len = buf_len + 8 + SSL_RECORD_SIZE; -#ifndef WIN32 - uint8_t t_buf[hmac_len+10]; -#else - uint8_t *t_buf = (uint8_t *)malloc(hmac_len+10); -#endif + uint8_t *t_buf = (uint8_t *)alloca(hmac_len+10); memcpy(t_buf, (mode == SSL_SERVER_WRITE || mode == SSL_CLIENT_WRITE) ? ssl->write_sequence : ssl->read_sequence, 8); @@ -664,9 +659,6 @@ static void add_hmac_digest(SSL *ssl, int mode, uint8_t *hmac_header, } print_blob("hmac", hmac_buf, SHA1_SIZE); #endif -#ifdef WIN32 - free(t_buf); -#endif } /** @@ -1520,7 +1512,7 @@ void disposable_free(SSL *ssl) { if (ssl->dc) { - free(ssl->dc->key_block); + free(ssl->dc->key_block); memset(ssl->dc, 0, sizeof(DISPOSABLE_CTX)); free(ssl->dc); ssl->dc = NULL; diff --git a/ssl/tls1.h b/ssl/tls1.h index b21f4d67fe..624eaf4857 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -32,29 +32,6 @@ extern "C" { #include "crypto.h" #include "crypto_misc.h" -/* Mutexing definitions */ -#if defined(CONFIG_SSL_CTX_MUTEXING) -#if defined(WIN32) -#define SSL_CTX_MUTEX_TYPE HANDLE -#define SSL_CTX_MUTEX_INIT(A) A=CreateMutex(0, FALSE, 0) -#define SSL_CTX_MUTEX_DESTROY(A) CloseHandle(A) -#define SSL_CTX_LOCK(A) WaitForSingleObject(A, INFINITE) -#define SSL_CTX_UNLOCK(A) ReleaseMutex(A) -#else -#include -#define SSL_CTX_MUTEX_TYPE pthread_mutex_t -#define SSL_CTX_MUTEX_INIT(A) pthread_mutex_init(&A, NULL) -#define SSL_CTX_MUTEX_DESTROY(A) pthread_mutex_destroy(&A) -#define SSL_CTX_LOCK(A) pthread_mutex_lock(&A) -#define SSL_CTX_UNLOCK(A) pthread_mutex_unlock(&A) -#endif -#else /* no mutexing */ -#define SSL_CTX_MUTEX_INIT(A) -#define SSL_CTX_MUTEX_DESTROY(A) -#define SSL_CTX_LOCK(A) -#define SSL_CTX_UNLOCK(A) -#endif - #define SSL_RANDOM_SIZE 32 #define SSL_SECRET_SIZE 48 #define SSL_FINISHED_HASH_SIZE 12 From f72d53348e818f8629927d76bd00ec56ba72c0b1 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 1 Nov 2007 21:33:18 +0000 Subject: [PATCH 116/301] minor updates git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@139 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 2 ++ crypto/md2.c | 24 ++++++++++++------------ ssl/bigint.c | 8 ++++++++ ssl/bigint.h | 3 --- ssl/bigint_impl.h | 5 ----- 5 files changed, 22 insertions(+), 20 deletions(-) diff --git a/Makefile b/Makefile index 4771e6f1c7..b63c1c2fac 100644 --- a/Makefile +++ b/Makefile @@ -75,7 +75,9 @@ win32_demo: install: $(PREFIX) all cp --no-dereference $(STAGE)/libax* $(PREFIX)/lib chmod 755 $(PREFIX)/lib/libax* +ifdef CONFIG_SAMPLES install -m 755 $(STAGE)/ax* $(PREFIX)/bin +endif ifdef CONFIG_HTTP_HAS_AUTHORIZATION install -m 755 $(STAGE)/htpasswd $(PREFIX)/bin endif diff --git a/crypto/md2.c b/crypto/md2.c index 93e1bf6451..5234c4fb83 100644 --- a/crypto/md2.c +++ b/crypto/md2.c @@ -1,23 +1,23 @@ /* - * RFC 1115/1319 compliant MD2 implementation - * - * Copyright (C) 2006-2007 Christophe Devine + * Copyright(C) 2006 Cameron Rich * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License, version 2.1 as published by the Free Software Foundation. + * This library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. * * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, - * MA 02110-1301 USA + * You should have received a copy of the GNU Lesser General Public License + * along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ + /* + * RFC 1115/1319 compliant MD2 implementation * The MD2 algorithm was designed by Ron Rivest in 1989. * * http://www.ietf.org/rfc/rfc1115.txt diff --git a/ssl/bigint.c b/ssl/bigint.c index ef4a917f49..4b778a5156 100644 --- a/ssl/bigint.c +++ b/ssl/bigint.c @@ -55,6 +55,11 @@ #include #include "bigint.h" +#define V1 v->comps[v->size-1] /**< v1 for division */ +#define V2 v->comps[v->size-2] /**< v2 for division */ +#define U(j) tmp_u->comps[tmp_u->size-j-1] /**< uj for division */ +#define Q(j) quotient->comps[quotient->size-j-1] /**< qj for division */ + static bigint *bi_int_multiply(BI_CTX *ctx, bigint *bi, comp i); static bigint *bi_int_divide(BI_CTX *ctx, bigint *biR, comp denom); static bigint *alloc(BI_CTX *ctx, int size); @@ -68,8 +73,11 @@ static bigint *comp_left_shift(bigint *biR, int num_shifts); #ifdef CONFIG_BIGINT_CHECK_ON static void check(const bigint *bi); +#else +#define check(A) /**< disappears in normal production mode */ #endif + /** * @brief Start a new bigint context. * @return A bigint context. diff --git a/ssl/bigint.h b/ssl/bigint.h index 8c248a9306..b96721d600 100644 --- a/ssl/bigint.h +++ b/ssl/bigint.h @@ -23,9 +23,6 @@ #include "os_port.h" #include "bigint_impl.h" -#ifndef CONFIG_BIGINT_CHECK_ON -#define check(A) /**< disappears in normal production mode */ -#endif BI_CTX *bi_initialize(void); void bi_terminate(BI_CTX *ctx); void bi_permanent(bigint *bi); diff --git a/ssl/bigint_impl.h b/ssl/bigint_impl.h index 762a7ccbb2..3db467cc05 100644 --- a/ssl/bigint_impl.h +++ b/ssl/bigint_impl.h @@ -97,9 +97,4 @@ typedef struct /**< A big integer "session" context. */ #define PERMANENT 0x7FFF55AA /**< A magic number for permanents. */ -#define V1 v->comps[v->size-1] /**< v1 for division */ -#define V2 v->comps[v->size-2] /**< v2 for division */ -#define U(j) tmp_u->comps[tmp_u->size-j-1] /**< uj for division */ -#define Q(j) quotient->comps[quotient->size-j-1] /**< qj for division */ - #endif From 70ed44946eca4ed0d18b9a2abcc298f11b03b693 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 5 Nov 2007 02:28:37 +0000 Subject: [PATCH 117/301] changed to BSD style license git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@140 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 36 +++++++++++++++++--------- bindings/Makefile | 36 +++++++++++++++++--------- bindings/csharp/Makefile | 36 +++++++++++++++++--------- bindings/csharp/axTLS.cs | 38 +++++++++++++++++---------- bindings/generate_SWIG_interface.pl | 36 +++++++++++++++++--------- bindings/generate_interface.pl | 36 +++++++++++++++++--------- bindings/java/Makefile | 36 +++++++++++++++++--------- bindings/java/SSL.java | 38 +++++++++++++++++---------- bindings/java/SSLCTX.java | 38 +++++++++++++++++---------- bindings/java/SSLClient.java | 38 +++++++++++++++++---------- bindings/java/SSLReadHolder.java | 38 +++++++++++++++++---------- bindings/java/SSLServer.java | 38 +++++++++++++++++---------- bindings/java/SSLUtil.java | 38 +++++++++++++++++---------- bindings/lua/Makefile | 36 +++++++++++++++++--------- bindings/perl/Makefile | 36 +++++++++++++++++--------- bindings/vbnet/Makefile | 36 +++++++++++++++++--------- bindings/vbnet/axTLSvb.vb | 36 +++++++++++++++++--------- config/makefile.conf | 36 +++++++++++++++++--------- config/makefile.dotnet.conf | 36 +++++++++++++++++--------- config/makefile.java.conf | 36 +++++++++++++++++--------- crypto/Makefile | 36 +++++++++++++++++--------- crypto/aes.c | 38 +++++++++++++++++---------- crypto/crypto.h | 38 +++++++++++++++++---------- crypto/hmac.c | 38 +++++++++++++++++---------- crypto/md2.c | 38 +++++++++++++++++---------- crypto/md5.c | 38 +++++++++++++++++---------- crypto/rc4.c | 38 +++++++++++++++++---------- crypto/sha1.c | 38 +++++++++++++++++---------- docsrc/Makefile | 36 +++++++++++++++++--------- httpd/Makefile | 36 +++++++++++++++++--------- httpd/axhttp.h | 38 +++++++++++++++++---------- httpd/axhttpd.c | 38 +++++++++++++++++---------- httpd/htpasswd.c | 38 +++++++++++++++++---------- httpd/proc.c | 38 +++++++++++++++++---------- httpd/tdate_parse.c | 38 +++++++++++++++++---------- samples/Makefile | 36 +++++++++++++++++--------- samples/c/Makefile | 36 +++++++++++++++++--------- samples/c/axssl.c | 38 +++++++++++++++++---------- samples/csharp/Makefile | 36 +++++++++++++++++--------- samples/csharp/axssl.cs | 38 +++++++++++++++++---------- samples/java/Makefile | 36 +++++++++++++++++--------- samples/java/axssl.java | 38 +++++++++++++++++---------- samples/lua/Makefile | 36 +++++++++++++++++--------- samples/lua/axssl.lua | 36 +++++++++++++++++--------- samples/perl/Makefile | 36 +++++++++++++++++--------- samples/perl/axssl.pl | 36 +++++++++++++++++--------- samples/vbnet/Makefile | 36 +++++++++++++++++--------- samples/vbnet/axssl.vb | 36 +++++++++++++++++--------- ssl/Makefile | 36 +++++++++++++++++--------- ssl/asn1.c | 38 +++++++++++++++++---------- ssl/bigint.c | 38 +++++++++++++++++---------- ssl/bigint.h | 38 +++++++++++++++++---------- ssl/bigint_impl.h | 38 +++++++++++++++++---------- ssl/crypto_misc.c | 38 +++++++++++++++++---------- ssl/crypto_misc.h | 40 +++++++++++++++++++---------- ssl/loader.c | 38 +++++++++++++++++---------- ssl/openssl.c | 38 +++++++++++++++++---------- ssl/os_port.c | 38 +++++++++++++++++---------- ssl/os_port.h | 38 +++++++++++++++++---------- ssl/p12.c | 38 +++++++++++++++++---------- ssl/rsa.c | 38 +++++++++++++++++---------- ssl/ssl.h | 38 +++++++++++++++++---------- ssl/test/Makefile | 36 +++++++++++++++++--------- ssl/test/make_certs.sh | 36 +++++++++++++++++--------- ssl/test/perf_bigint.c | 38 +++++++++++++++++---------- ssl/test/ssltest.c | 38 +++++++++++++++++---------- ssl/test/test_axssl.sh | 36 +++++++++++++++++--------- ssl/tls1.c | 38 +++++++++++++++++---------- ssl/tls1.h | 38 +++++++++++++++++---------- ssl/tls1_clnt.c | 38 +++++++++++++++++---------- ssl/tls1_svr.c | 38 +++++++++++++++++---------- ssl/x509.c | 38 +++++++++++++++++---------- www/index.html | 4 +-- 73 files changed, 1773 insertions(+), 909 deletions(-) diff --git a/Makefile b/Makefile index b63c1c2fac..f6948de35f 100644 --- a/Makefile +++ b/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This license is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This license is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU Lesser General Public License -# along with this license; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # -include config/.config diff --git a/bindings/Makefile b/bindings/Makefile index 8874159435..7654fbba57 100644 --- a/bindings/Makefile +++ b/bindings/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This library is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU Lesser General Public License -# along with this library; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # all: diff --git a/bindings/csharp/Makefile b/bindings/csharp/Makefile index 87073f5e43..3414f85621 100644 --- a/bindings/csharp/Makefile +++ b/bindings/csharp/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include ../../config/.config diff --git a/bindings/csharp/axTLS.cs b/bindings/csharp/axTLS.cs index e2e5f4da29..f056df70a4 100644 --- a/bindings/csharp/axTLS.cs +++ b/bindings/csharp/axTLS.cs @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/bindings/generate_SWIG_interface.pl b/bindings/generate_SWIG_interface.pl index d9a4e888dd..cb157abc0c 100755 --- a/bindings/generate_SWIG_interface.pl +++ b/bindings/generate_SWIG_interface.pl @@ -1,21 +1,33 @@ #!/usr/bin/perl # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This library is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU Lesser General Public License -# along with this library; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # #=============================================================== diff --git a/bindings/generate_interface.pl b/bindings/generate_interface.pl index ab7b914ada..dad5ae5cb1 100755 --- a/bindings/generate_interface.pl +++ b/bindings/generate_interface.pl @@ -1,21 +1,33 @@ #!/usr/bin/perl -w # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This library is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU Lesser General Public License -# along with this library; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # #=============================================================== diff --git a/bindings/java/Makefile b/bindings/java/Makefile index 0c58c1e7f8..8df1d0aa83 100644 --- a/bindings/java/Makefile +++ b/bindings/java/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # AXTLS_HOME=../.. diff --git a/bindings/java/SSL.java b/bindings/java/SSL.java index a2dfd370b1..b53a6da067 100644 --- a/bindings/java/SSL.java +++ b/bindings/java/SSL.java @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* diff --git a/bindings/java/SSLCTX.java b/bindings/java/SSLCTX.java index 2823511b1a..311bedb795 100644 --- a/bindings/java/SSLCTX.java +++ b/bindings/java/SSLCTX.java @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* diff --git a/bindings/java/SSLClient.java b/bindings/java/SSLClient.java index 6ca43d0032..f65fe9c53f 100644 --- a/bindings/java/SSLClient.java +++ b/bindings/java/SSLClient.java @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* diff --git a/bindings/java/SSLReadHolder.java b/bindings/java/SSLReadHolder.java index e51e0a593d..91fd76b23f 100644 --- a/bindings/java/SSLReadHolder.java +++ b/bindings/java/SSLReadHolder.java @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* diff --git a/bindings/java/SSLServer.java b/bindings/java/SSLServer.java index 7aa7fc09b5..514ccb0342 100644 --- a/bindings/java/SSLServer.java +++ b/bindings/java/SSLServer.java @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* diff --git a/bindings/java/SSLUtil.java b/bindings/java/SSLUtil.java index a59de3f1fe..3d53de51cb 100644 --- a/bindings/java/SSLUtil.java +++ b/bindings/java/SSLUtil.java @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* diff --git a/bindings/lua/Makefile b/bindings/lua/Makefile index 66738cbedd..daacf92150 100644 --- a/bindings/lua/Makefile +++ b/bindings/lua/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2007 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # AXTLS_HOME=../.. diff --git a/bindings/perl/Makefile b/bindings/perl/Makefile index 3f5b15e7de..92fd3c50f7 100644 --- a/bindings/perl/Makefile +++ b/bindings/perl/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # AXTLS_HOME=../.. diff --git a/bindings/vbnet/Makefile b/bindings/vbnet/Makefile index bcd6cae4d2..7da60d02ed 100644 --- a/bindings/vbnet/Makefile +++ b/bindings/vbnet/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include ../../config/.config diff --git a/bindings/vbnet/axTLSvb.vb b/bindings/vbnet/axTLSvb.vb index c941c595b2..9388273ce8 100644 --- a/bindings/vbnet/axTLSvb.vb +++ b/bindings/vbnet/axTLSvb.vb @@ -1,19 +1,31 @@ ' -' Copyright(C) 2006 Cameron Rich +' Copyright (c) 2007, Cameron Rich ' -' This program is free software you can redistribute it and/or modify -' it under the terms of the GNU General Public License as published by -' the Free Software Foundation either version 2.1 of the License, or -' (at your option As ) any later version. +' All rights reserved. ' -' This program is distributed in the hope that it will be useful, -' but WITHOUT ANY WARRANTY without even the implied warranty of -' MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -' GNU Lesser General Public License for more details. +' Redistribution and use in source and binary forms, with or without +' modification, are permitted provided that the following conditions are met: ' -' You should have received a copy of the GNU General Public License -' along with this program if not, write to the Free Software -' Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +' * Redistributions of source code must retain the above copyright notice, +' this list of conditions and the following disclaimer. +' * Redistributions in binary form must reproduce the above copyright +' notice, this list of conditions and the following disclaimer in the +' documentation and/or other materials provided with the distribution. +' * Neither the name of the axTLS project nor the names of its +' contributors may be used to endorse or promote products derived +' from this software without specific prior written permission. +' +' THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +' "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +' LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +' A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +' CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +' SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +' TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +' DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +' OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +' NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +' THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ' ' diff --git a/config/makefile.conf b/config/makefile.conf index fe9ba26d76..ffe86c54ae 100644 --- a/config/makefile.conf +++ b/config/makefile.conf @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This library is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU Lesser General Public License -# along with this library; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # # diff --git a/config/makefile.dotnet.conf b/config/makefile.dotnet.conf index 110e27d3bb..9cff4fddf1 100644 --- a/config/makefile.dotnet.conf +++ b/config/makefile.dotnet.conf @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This library is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU Lesser General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # ifneq ($(MAKECMDGOALS), clean) diff --git a/config/makefile.java.conf b/config/makefile.java.conf index 2e51b50da3..9b22462908 100644 --- a/config/makefile.java.conf +++ b/config/makefile.java.conf @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This library is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU Lesser General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # ifneq ($(MAKECMDGOALS), clean) diff --git a/crypto/Makefile b/crypto/Makefile index b449a3f86a..d1dfd1ccda 100644 --- a/crypto/Makefile +++ b/crypto/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2007 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This library is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU Lesser General Public License -# along with this library; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include ../config/.config diff --git a/crypto/aes.c b/crypto/aes.c index 520bd01a92..038a45bd85 100644 --- a/crypto/aes.c +++ b/crypto/aes.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/crypto/crypto.h b/crypto/crypto.h index 4b4cdc406a..e1e8cc9c94 100644 --- a/crypto/crypto.h +++ b/crypto/crypto.h @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/crypto/hmac.c b/crypto/hmac.c index 880a21c059..9199ff2207 100644 --- a/crypto/hmac.c +++ b/crypto/hmac.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/crypto/md2.c b/crypto/md2.c index 5234c4fb83..bfcbd24bbe 100644 --- a/crypto/md2.c +++ b/crypto/md2.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* diff --git a/crypto/md5.c b/crypto/md5.c index caf21aa63a..b4f86cab58 100644 --- a/crypto/md5.c +++ b/crypto/md5.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/crypto/rc4.c b/crypto/rc4.c index 83e4363dd0..57136b82bd 100644 --- a/crypto/rc4.c +++ b/crypto/rc4.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/crypto/sha1.c b/crypto/sha1.c index 69110d4879..be19100797 100644 --- a/crypto/sha1.c +++ b/crypto/sha1.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/docsrc/Makefile b/docsrc/Makefile index 136264b08d..28266869b7 100644 --- a/docsrc/Makefile +++ b/docsrc/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This library is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This license is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU Lesser General Public License -# along with this license; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include ../config/makefile.conf diff --git a/httpd/Makefile b/httpd/Makefile index bbc72274bf..b37c9819b6 100644 --- a/httpd/Makefile +++ b/httpd/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2007 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # all : web_server lua diff --git a/httpd/axhttp.h b/httpd/axhttp.h index 2da364e742..de3a1985e8 100644 --- a/httpd/axhttp.h +++ b/httpd/axhttp.h @@ -1,19 +1,31 @@ /* - * Copyright(C) 2007 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include "os_port.h" diff --git a/httpd/axhttpd.c b/httpd/axhttpd.c index 1594f1cb83..bd3b48dd48 100644 --- a/httpd/axhttpd.c +++ b/httpd/axhttpd.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2007 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include diff --git a/httpd/htpasswd.c b/httpd/htpasswd.c index f4e26814a5..1a7a2311f8 100644 --- a/httpd/htpasswd.c +++ b/httpd/htpasswd.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2007 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include diff --git a/httpd/proc.c b/httpd/proc.c index 270dd70942..f27dfabec1 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2007 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include diff --git a/httpd/tdate_parse.c b/httpd/tdate_parse.c index a6cadc77e1..813bdc578b 100644 --- a/httpd/tdate_parse.c +++ b/httpd/tdate_parse.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2007 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include diff --git a/samples/Makefile b/samples/Makefile index fdbdb99709..afbdd43d1b 100644 --- a/samples/Makefile +++ b/samples/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # all: diff --git a/samples/c/Makefile b/samples/c/Makefile index c1cdb4c6e8..f0a9d0ec03 100644 --- a/samples/c/Makefile +++ b/samples/c/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # all : sample diff --git a/samples/c/axssl.c b/samples/c/axssl.c index 41b93af3f2..28ea71baf1 100644 --- a/samples/c/axssl.c +++ b/samples/c/axssl.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/samples/csharp/Makefile b/samples/csharp/Makefile index 267a49d15c..46c2421dce 100644 --- a/samples/csharp/Makefile +++ b/samples/csharp/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include ../../config/.config diff --git a/samples/csharp/axssl.cs b/samples/csharp/axssl.cs index 174d3dc851..2224f89ea2 100644 --- a/samples/csharp/axssl.cs +++ b/samples/csharp/axssl.cs @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/samples/java/Makefile b/samples/java/Makefile index eca097ec70..b10a79f372 100644 --- a/samples/java/Makefile +++ b/samples/java/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include ../../config/.config diff --git a/samples/java/axssl.java b/samples/java/axssl.java index 76fb06d773..cc6bb711a2 100644 --- a/samples/java/axssl.java +++ b/samples/java/axssl.java @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* diff --git a/samples/lua/Makefile b/samples/lua/Makefile index 3c90813cf9..a460da3c55 100644 --- a/samples/lua/Makefile +++ b/samples/lua/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2007 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include ../../config/.config diff --git a/samples/lua/axssl.lua b/samples/lua/axssl.lua index bdd97f4b1b..3f37551f26 100755 --- a/samples/lua/axssl.lua +++ b/samples/lua/axssl.lua @@ -1,21 +1,33 @@ #!/usr/local/bin/lua + -- +-- Copyright (c) 2007, Cameron Rich -- --- Copyright(C) 2007 Cameron Rich +-- All rights reserved. -- --- This program is free software; you can redistribute it and/or modify --- it under the terms of the GNU General Public License as published by --- the Free Software Foundation; either version 2.1 of the License, or --- (at your option) any later version. +-- Redistribution and use in source and binary forms, with or without +-- modification, are permitted provided that the following conditions are met: -- --- This program is distributed in the hope that it will be useful, --- but WITHOUT ANY WARRANTY; without even the implied warranty of --- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the --- GNU Lesser General Public License for more details. +-- * Redistributions of source code must retain the above copyright notice, +-- this list of conditions and the following disclaimer. +-- * Redistributions in binary form must reproduce the above copyright +-- notice, this list of conditions and the following disclaimer in the +-- documentation and/or other materials provided with the distribution. +-- * Neither the name of the axTLS project nor the names of its +-- contributors may be used to endorse or promote products derived +-- from this software without specific prior written permission. -- --- You should have received a copy of the GNU General Public License --- along with this program; if not, write to the Free Software --- Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +-- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +-- "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +-- LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +-- A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +-- CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +-- SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +-- TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +-- DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +-- OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +-- NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +-- THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -- -- diff --git a/samples/perl/Makefile b/samples/perl/Makefile index 0ad96070fd..5200c4302e 100644 --- a/samples/perl/Makefile +++ b/samples/perl/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include ../../config/.config diff --git a/samples/perl/axssl.pl b/samples/perl/axssl.pl index c46c70a401..a8b4e26d97 100755 --- a/samples/perl/axssl.pl +++ b/samples/perl/axssl.pl @@ -1,20 +1,32 @@ #!/usr/bin/perl -w # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2.1 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # # diff --git a/samples/vbnet/Makefile b/samples/vbnet/Makefile index 7349e67cc9..0984d4e02e 100644 --- a/samples/vbnet/Makefile +++ b/samples/vbnet/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include ../../config/.config diff --git a/samples/vbnet/axssl.vb b/samples/vbnet/axssl.vb index a9f7e9fa85..a33cc9466a 100644 --- a/samples/vbnet/axssl.vb +++ b/samples/vbnet/axssl.vb @@ -1,19 +1,31 @@ ' -' Copyright(C) 2006 Cameron Rich +' Copyright (c) 2007, Cameron Rich ' -' This program is free software you can redistribute it and/or modify -' it under the terms of the GNU General Public License as published by -' the Free Software Foundation either version 2.1 of the License, or -' (at your option) any later version. +' All rights reserved. ' -' This program is distributed in the hope that it will be useful, -' but WITHOUT ANY WARRANTY without even the implied warranty of -' MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -' GNU Lesser General Public License for more details. +' Redistribution and use in source and binary forms, with or without +' modification, are permitted provided that the following conditions are met: ' -' You should have received a copy of the GNU General Public License -' along with this program if not, write to the Free Software -' Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +' * Redistributions of source code must retain the above copyright notice, +' this list of conditions and the following disclaimer. +' * Redistributions in binary form must reproduce the above copyright +' notice, this list of conditions and the following disclaimer in the +' documentation and/or other materials provided with the distribution. +' * Neither the name of the axTLS project nor the names of its +' contributors may be used to endorse or promote products derived +' from this software without specific prior written permission. +' +' THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +' "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +' LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +' A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +' CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +' SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +' TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +' DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +' OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +' NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +' THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ' ' diff --git a/ssl/Makefile b/ssl/Makefile index a8ec01c9f0..2354dda572 100644 --- a/ssl/Makefile +++ b/ssl/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2007 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This library is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU Lesser General Public License -# along with this library; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # AXTLS_HOME=.. diff --git a/ssl/asn1.c b/ssl/asn1.c index b248e3e213..8bc3f396cb 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich - * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/ssl/bigint.c b/ssl/bigint.c index 4b778a5156..303c20a1c1 100644 --- a/ssl/bigint.c +++ b/ssl/bigint.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich - * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/ssl/bigint.h b/ssl/bigint.h index b96721d600..ee55c27213 100644 --- a/ssl/bigint.h +++ b/ssl/bigint.h @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #ifndef BIGINT_HEADER diff --git a/ssl/bigint_impl.h b/ssl/bigint_impl.h index 3db467cc05..c23572733e 100644 --- a/ssl/bigint_impl.h +++ b/ssl/bigint_impl.h @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #ifndef BIGINT_IMPL_HEADER diff --git a/ssl/crypto_misc.c b/ssl/crypto_misc.c index 29a28f9b36..bc802c703e 100644 --- a/ssl/crypto_misc.c +++ b/ssl/crypto_misc.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/ssl/crypto_misc.h b/ssl/crypto_misc.h index 36b4d10f93..f8336c951d 100644 --- a/ssl/crypto_misc.h +++ b/ssl/crypto_misc.h @@ -1,20 +1,32 @@ /* - * Copyright(C) 2007 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - */ + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +*/ /** * @file crypto_misc.h diff --git a/ssl/loader.c b/ssl/loader.c index d5ea6cb43d..909b5b7474 100644 --- a/ssl/loader.c +++ b/ssl/loader.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/ssl/openssl.c b/ssl/openssl.c index 3b63019e90..712e133820 100644 --- a/ssl/openssl.c +++ b/ssl/openssl.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2007 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU General Lesser License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* diff --git a/ssl/os_port.c b/ssl/os_port.c index 5f3c47722d..cddbea32a2 100644 --- a/ssl/os_port.c +++ b/ssl/os_port.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/ssl/os_port.h b/ssl/os_port.h index 26bb709689..8b47e36641 100644 --- a/ssl/os_port.h +++ b/ssl/os_port.h @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/ssl/p12.c b/ssl/p12.c index d857a9b0cf..6ed92e431d 100644 --- a/ssl/p12.c +++ b/ssl/p12.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/ssl/rsa.c b/ssl/rsa.c index 4d70c10b67..ef1e5f50f3 100644 --- a/ssl/rsa.c +++ b/ssl/rsa.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/ssl/ssl.h b/ssl/ssl.h index 83c6af7557..5adeecc0d7 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich - * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/ssl/test/Makefile b/ssl/test/Makefile index deda7307f3..7c3b885c1b 100644 --- a/ssl/test/Makefile +++ b/ssl/test/Makefile @@ -1,19 +1,31 @@ # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This library is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU Lesser General Public License -# along with this library; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # all: diff --git a/ssl/test/make_certs.sh b/ssl/test/make_certs.sh index b7a872b98c..dfc39d4f53 100755 --- a/ssl/test/make_certs.sh +++ b/ssl/test/make_certs.sh @@ -1,21 +1,33 @@ #!/bin/sh # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This license is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This license is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU Lesser General Public License -# along with this license; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # # diff --git a/ssl/test/perf_bigint.c b/ssl/test/perf_bigint.c index 74844a5e05..a4ffab6a3a 100644 --- a/ssl/test/perf_bigint.c +++ b/ssl/test/perf_bigint.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This license is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this license; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index a566ea954c..9eaf543595 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich - * - * This license is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This license is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * You should have received a copy of the GNU Lesser General Public License - * along with this license; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* diff --git a/ssl/test/test_axssl.sh b/ssl/test/test_axssl.sh index 2a8bceb8f7..acf11a630c 100755 --- a/ssl/test/test_axssl.sh +++ b/ssl/test/test_axssl.sh @@ -1,21 +1,33 @@ #!/bin/sh # -# Copyright(C) 2006 Cameron Rich +# Copyright (c) 2007, Cameron Rich # -# This license is free software; you can redistribute it and/or modify -# it under the terms of the GNU Lesser General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. +# All rights reserved. # -# This license is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: # -# You should have received a copy of the GNU Lesser General Public License -# along with this license; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # # diff --git a/ssl/tls1.c b/ssl/tls1.c index 4a6a8cbd2d..6dc67bd133 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU General Lesser License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/ssl/tls1.h b/ssl/tls1.h index 624eaf4857..4280cb2ac4 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index 8b38e3768a..b1a58ca133 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index d763917da8..26813692d7 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include diff --git a/ssl/x509.c b/ssl/x509.c index 6bb9afde01..849edded06 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -1,19 +1,31 @@ /* - * Copyright(C) 2006 Cameron Rich - * - * This library is free software; you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation; either version 2.1 of the License, or - * (at your option) any later version. + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. * - * You should have received a copy of the GNU Lesser General Public License - * along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** diff --git a/www/index.html b/www/index.html index 9516ff52ea..3ae8d4c03b 100755 --- a/www/index.html +++ b/www/index.html @@ -7086,9 +7086,9 @@
    changes, notes and errata
    -
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* vfork() is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* vfork() is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    -
    !GNU LESSER GENERAL PUBLIC LICENSE\n\nVersion 2.1, February 1999\n\nCopyright (C) 1991, 1999 Free Software Foundation, Inc.\n51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA\nEveryone is permitted to copy and distribute verbatim copies\nof this license document, but changing it is not allowed.\n\n[This is the first released version of the Lesser GPL. It also counts\n as the successor of the GNU Library Public License, version 2, hence\n the version number 2.1.]\n\n!!Preamble\n\nThe licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software -to make sure the software is free for all its users.\n\nThis license, the Lesser General Public License, applies to some specially designated software packages - typically libraries - of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below.\n\nWhen we speak of free software, we are referring to freedom of use, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish); that you receive source code or can get it if you want it; that you can change the software and use pieces of it in new free programs; and that you are informed that you can do these things.\n\nTo protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library or if you modify it.\n\nFor example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights.\n\nWe protect your rights with a two-step method: (1) we copyright the library, and (2) we offer you this license, which gives you legal permission to copy, distribute and/or modify the library.\n\nTo protect each distributor, we want to make it very clear that there is no warranty for the free library. Also, if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others.\n\nFinally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license.\n\nMost GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs.\n\nWhen a program is linked with a library, whether statically or using a shared library, the combination of the two is legally speaking a combined work, a derivative of the original library. The ordinary General Public License therefore permits such linking only if the entire combination fits its criteria of freedom. The Lesser General Public License permits more lax criteria for linking other code with the library.\n\nWe call this license the "Lesser" General Public License because it does Less to protect the user's freedom than the ordinary General Public License. It also provides other free software developers Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances.\n\nFor example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License.\n\nIn other cases, permission to use a particular library in non-free programs enables a greater number of people to use a large body of free software. For example, permission to use the GNU C Library in non-free programs enables many more people to use the whole GNU operating system, as well as its variant, the GNU/Linux operating system.\n\nAlthough the Lesser General Public License is Less protective of the users' freedom, it does ensure that the user of a program that is linked with the Library has the freedom and the wherewithal to run that program using a modified version of the Library.\n\nThe precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, whereas the latter must be combined with the library in order to run.\n\n!!TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION\n\n0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you".\n\nA "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables.\n\nThe "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".)\n\n"Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library.\n\nActivities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does.\n\n1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library.\n\nYou may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.\n\n2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:\n\n * a) The modified work must itself be a software library.\n * b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change.\n * c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License.\n * d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful.\n\n (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.)\n\n These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.\n\n Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library.\n\n In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.\n\n3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices.\n\nOnce this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy.\n\nThis option is useful when you wish to copy part of the code of the Library into a program that is not a library.\n\n4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange.\n\nIf distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.\n\n5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License.\n\nHowever, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables.\n\nWhen a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law.\n\nIf such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.)\n\nOtherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself.\n\n6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications.\n\nYou must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things:\n\n * a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.)\n * b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with.\n * c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.\n * d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place.\n * e) Verify that the user has already received a copy of these materials or that you have already sent this user a copy.\n\nFor an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the materials to be distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.\n\nIt may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute.\n\n7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things:\n\n * a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above.\n * b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work.\n\n8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.\n\n9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it.\n\n10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License.\n\n11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library.\n\nIf any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances.\n\nIt is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.\n\nThis section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.\n\n12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.\n\n13. The Free Software Foundation may publish revised and/or new versions of the Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.\n\nEach version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation.\n\n14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.\n\nNO WARRANTY\n\n15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.\n\nEND OF TERMS AND CONDITIONS
    +
    axTLS uses a BSD style license:\n\nCopyright (c) 2007, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    <div class='header' macro='gradient vert #390108 #900'>\n<div class='headerShadow'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n<div class='headerForeground'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n</div>\n<div id='mainMenu'>\n<div refresh='content' tiddler='MainMenu'></div>\n</div>\n<div id='sidebar'>\n<div id='sidebarOptions' refresh='content' tiddler='SideBarOptions'></div>\n<div id='sidebarTabs' refresh='content' force='true' tiddler='SideBarTabs'></div>\n</div>\n<div id='displayArea'>\n<div id='messageArea'></div>\n<div id='tiddlerDisplay'></div>\n</div>
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly some stuff.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n* axssl.lua - Lua sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!!!!Lua\n\n{{indent{{{{> [lua] ./axssl.lua <options>}}}\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n* The lua sample requires the luabit library from http://luaforge.net/projects/bit.\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* CGI has been removed from Win32 - it needs a lot more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    From 4a82037346b476a79e496157cde4b0a5df25ca3d Mon Sep 17 00:00:00 2001 From: cameronrich Date: Tue, 13 Nov 2007 08:36:58 +0000 Subject: [PATCH 118/301] some directory restructuring git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@141 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/makefile.conf | 1 + crypto/Makefile | 3 + {ssl => crypto}/bigint.c | 0 {ssl => crypto}/bigint.h | 2 - {ssl => crypto}/bigint_impl.h | 0 crypto/crypto.h | 56 ++++++ {ssl => crypto}/crypto_misc.c | 0 {ssl => crypto}/rsa.c | 46 +---- ssl/Config.in | 7 + ssl/Makefile | 13 +- ssl/asn1.c | 4 +- ssl/crypto_misc.h | 56 ------ ssl/gen_cert.c | 316 ++++++++++++++++++++++++++++++++++ ssl/x509.c | 44 ++++- www/index.html | 2 +- 15 files changed, 439 insertions(+), 111 deletions(-) rename {ssl => crypto}/bigint.c (100%) rename {ssl => crypto}/bigint.h (98%) rename {ssl => crypto}/bigint_impl.h (100%) rename {ssl => crypto}/crypto_misc.c (100%) rename {ssl => crypto}/rsa.c (88%) create mode 100644 ssl/gen_cert.c diff --git a/config/makefile.conf b/config/makefile.conf index ffe86c54ae..cc06e97f53 100644 --- a/config/makefile.conf +++ b/config/makefile.conf @@ -99,6 +99,7 @@ ifndef CONFIG_PLATFORM_CYGWIN # Cygwin else CFLAGS += -DCONFIG_PLATFORM_CYGWIN +LDFLAGS += -enable-auto-import endif endif diff --git a/crypto/Makefile b/crypto/Makefile index d1dfd1ccda..3ea8bdde0c 100644 --- a/crypto/Makefile +++ b/crypto/Makefile @@ -35,10 +35,13 @@ AXTLS_HOME=.. OBJ=\ aes.o \ + bigint.o \ + crypto_misc.o \ hmac.o \ md2.o \ md5.o \ rc4.o \ + rsa.o \ sha1.o include ../config/makefile.post diff --git a/ssl/bigint.c b/crypto/bigint.c similarity index 100% rename from ssl/bigint.c rename to crypto/bigint.c diff --git a/ssl/bigint.h b/crypto/bigint.h similarity index 98% rename from ssl/bigint.h rename to crypto/bigint.h index ee55c27213..2966a3edb3 100644 --- a/ssl/bigint.h +++ b/crypto/bigint.h @@ -32,8 +32,6 @@ #define BIGINT_HEADER #include "crypto.h" -#include "os_port.h" -#include "bigint_impl.h" BI_CTX *bi_initialize(void); void bi_terminate(BI_CTX *ctx); diff --git a/ssl/bigint_impl.h b/crypto/bigint_impl.h similarity index 100% rename from ssl/bigint_impl.h rename to crypto/bigint_impl.h diff --git a/crypto/crypto.h b/crypto/crypto.h index e1e8cc9c94..a4e6086580 100644 --- a/crypto/crypto.h +++ b/crypto/crypto.h @@ -41,6 +41,8 @@ extern "C" { #include "config.h" #include "os_port.h" +#include "bigint_impl.h" +#include "bigint.h" /* enable features based on a 'super-set' capbaility. */ #if defined(CONFIG_SSL_FULL_MODE) @@ -157,7 +159,61 @@ void hmac_md5(const uint8_t *msg, int length, const uint8_t *key, void hmac_sha1(const uint8_t *msg, int length, const uint8_t *key, int key_len, uint8_t *digest); +/************************************************************************** + * RSA declarations + **************************************************************************/ + +typedef struct +{ + bigint *m; /* modulus */ + bigint *e; /* public exponent */ + bigint *d; /* private exponent */ +#ifdef CONFIG_BIGINT_CRT + bigint *p; /* p as in m = pq */ + bigint *q; /* q as in m = pq */ + bigint *dP; /* d mod (p-1) */ + bigint *dQ; /* d mod (q-1) */ + bigint *qInv; /* q^-1 mod p */ +#endif + int num_octets; + BI_CTX *bi_ctx; +} RSA_CTX; + +void RSA_priv_key_new(RSA_CTX **rsa_ctx, + const uint8_t *modulus, int mod_len, + const uint8_t *pub_exp, int pub_len, + const uint8_t *priv_exp, int priv_len +#ifdef CONFIG_BIGINT_CRT + , const uint8_t *p, int p_len, + const uint8_t *q, int q_len, + const uint8_t *dP, int dP_len, + const uint8_t *dQ, int dQ_len, + const uint8_t *qInv, int qInv_len +#endif + ); +void RSA_pub_key_new(RSA_CTX **rsa_ctx, + const uint8_t *modulus, int mod_len, + const uint8_t *pub_exp, int pub_len); +void RSA_free(RSA_CTX *ctx); +int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data, uint8_t *out_data, + int is_decryption); +bigint *RSA_private(const RSA_CTX *c, bigint *bi_msg); +#ifdef CONFIG_SSL_CERT_VERIFICATION +bigint *RSA_sign_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, + bigint *modulus, bigint *pub_exp); +bigint *RSA_public(const RSA_CTX * c, bigint *bi_msg); +int RSA_encrypt(const RSA_CTX *ctx, const uint8_t *in_data, uint16_t in_len, + uint8_t *out_data, int is_signing); +void RSA_print(const RSA_CTX *ctx); +#endif +/************************************************************************** + * RNG declarations + **************************************************************************/ +EXP_FUNC void STDCALL RNG_initialize(const uint8_t *seed_buf, int size); +EXP_FUNC void STDCALL RNG_terminate(void); +EXP_FUNC void STDCALL get_random(int num_rand_bytes, uint8_t *rand_data); +void get_random_NZ(int num_rand_bytes, uint8_t *rand_data); #ifdef __cplusplus } diff --git a/ssl/crypto_misc.c b/crypto/crypto_misc.c similarity index 100% rename from ssl/crypto_misc.c rename to crypto/crypto_misc.c diff --git a/ssl/rsa.c b/crypto/rsa.c similarity index 88% rename from ssl/rsa.c rename to crypto/rsa.c index ef1e5f50f3..7fb17b330d 100644 --- a/ssl/rsa.c +++ b/crypto/rsa.c @@ -37,7 +37,7 @@ #include #include #include -#include "crypto_misc.h" +#include "crypto.h" void RSA_priv_key_new(RSA_CTX **ctx, const uint8_t *modulus, int mod_len, @@ -252,7 +252,7 @@ int RSA_encrypt(const RSA_CTX *ctx, const uint8_t *in_data, uint16_t in_len, /* now encrypt it */ dat_bi = bi_import(ctx->bi_ctx, out_data, byte_size); encrypt_bi = is_signing ? RSA_private(ctx, dat_bi) : - RSA_public(ctx, dat_bi); + RSA_public(ctx, dat_bi); bi_export(ctx->bi_ctx, encrypt_bi, out_data, byte_size); /* save a few bytes of memory */ @@ -260,46 +260,4 @@ int RSA_encrypt(const RSA_CTX *ctx, const uint8_t *in_data, uint16_t in_len, return byte_size; } -/** - * Take a signature and decrypt it. - */ -bigint *RSA_sign_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, - bigint *modulus, bigint *pub_exp) -{ - int i, size; - bigint *decrypted_bi, *dat_bi; - bigint *bir = NULL; - uint8_t *block = (uint8_t *)alloca(sig_len); - - /* decrypt */ - dat_bi = bi_import(ctx, sig, sig_len); - ctx->mod_offset = BIGINT_M_OFFSET; - - /* convert to a normal block */ - decrypted_bi = bi_mod_power2(ctx, dat_bi, modulus, pub_exp); - - bi_export(ctx, decrypted_bi, block, sig_len); - ctx->mod_offset = BIGINT_M_OFFSET; - - i = 10; /* start at the first possible non-padded byte */ - while (block[i++] && i < sig_len); - size = sig_len - i; - - /* get only the bit we want */ - if (size > 0) - { - int len; - const uint8_t *sig_ptr = x509_get_signature(&block[i], &len); - - if (sig_ptr) - { - bir = bi_import(ctx, sig_ptr, len); - } - } - - /* save a few bytes of memory */ - bi_clear_cache(ctx); - return bir; -} - #endif /* CONFIG_SSL_CERT_VERIFICATION */ diff --git a/ssl/Config.in b/ssl/Config.in index 0a11ef55fc..ec5fca84d5 100644 --- a/ssl/Config.in +++ b/ssl/Config.in @@ -251,6 +251,13 @@ config CONFIG_OPENSSL_COMPATIBLE Note: not all the API is implemented, so parts may still break. And it's definitely not 100% compatible. +config CONFIG_GEN_CERTIFICATES + bool "Enable the generation of certificates" + default n + depends on CONFIG_SSL_CERT_VERIFICATION + help + A primitive self-signed certificate generator. + config CONFIG_PERFORMANCE_TESTING bool "Build the bigint performance test tool" default n diff --git a/ssl/Makefile b/ssl/Makefile index 2354dda572..eac1e8a701 100644 --- a/ssl/Makefile +++ b/ssl/Makefile @@ -48,8 +48,10 @@ BASETARGET=libaxtls.so CRYPTO_PATH=$(AXTLS_HOME)/crypto/ ifdef CONFIG_PLATFORM_CYGWIN TARGET2=$(AXTLS_HOME)/$(STAGE)/libaxtls.dll.a +TARGET3=$(AXTLS_HOME)/$(STAGE)/gen_cert.exe else TARGET2=$(AXTLS_HOME)/$(STAGE)/$(LIBMINOR) +TARGET3=$(AXTLS_HOME)/$(STAGE)/gen_cert endif # shared library major/minor numbers @@ -62,26 +64,26 @@ STATIC_LIB=$(AXTLS_HOME)/$(STAGE)/axtls.static.lib CRYPTO_PATH=$(AXTLS_HOME)\\crypto\\ endif -libs: $(TARGET1) $(TARGET2) +libs: $(TARGET1) $(TARGET2) $(TARGET3) CRYPTO_OBJ=\ $(CRYPTO_PATH)aes.o \ + $(CRYPTO_PATH)bigint.o \ + $(CRYPTO_PATH)crypto_misc.o \ $(CRYPTO_PATH)hmac.o \ $(CRYPTO_PATH)md2.o \ $(CRYPTO_PATH)md5.o \ $(CRYPTO_PATH)rc4.o \ + $(CRYPTO_PATH)rsa.o \ $(CRYPTO_PATH)sha1.o OBJ=\ asn1.o \ x509.o \ - bigint.o \ - crypto_misc.o \ os_port.o \ loader.o \ openssl.o \ p12.o \ - rsa.o \ tls1.o \ tls1_svr.o \ tls1_clnt.o @@ -104,6 +106,9 @@ else -Wl,--enable-auto-import $(CRYPTO_OBJ) $(OBJ) endif +$(TARGET3): gen_cert.o + $(LD) $(LDFLAGS) -o $@ $< -L$(AXTLS_HOME)/$(STAGE) -laxtls + else # Win32 CRYPTO_OBJ:=$(CRYPTO_OBJ:.o=.obj) diff --git a/ssl/asn1.c b/ssl/asn1.c index 8bc3f396cb..8cdd3e433c 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -29,8 +29,6 @@ */ /** - * @file asn1.c - * * Some primitive asn methods for extraction ASN.1 data. */ @@ -61,7 +59,7 @@ int get_asn1_length(const uint8_t *buf, int *offset) { len = buf[(*offset)++]; } - else /* long form */ + else /* long form */ { int length_bytes = buf[(*offset)++]&0x7f; len = 0; diff --git a/ssl/crypto_misc.h b/ssl/crypto_misc.h index f8336c951d..b311b50ec1 100644 --- a/ssl/crypto_misc.h +++ b/ssl/crypto_misc.h @@ -42,62 +42,6 @@ extern "C" { #include "crypto.h" #include "bigint.h" -/************************************************************************** - * RSA declarations - **************************************************************************/ - -typedef struct -{ - bigint *m; /* modulus */ - bigint *e; /* public exponent */ - bigint *d; /* private exponent */ -#ifdef CONFIG_BIGINT_CRT - bigint *p; /* p as in m = pq */ - bigint *q; /* q as in m = pq */ - bigint *dP; /* d mod (p-1) */ - bigint *dQ; /* d mod (q-1) */ - bigint *qInv; /* q^-1 mod p */ -#endif - int num_octets; - BI_CTX *bi_ctx; -} RSA_CTX; - -void RSA_priv_key_new(RSA_CTX **rsa_ctx, - const uint8_t *modulus, int mod_len, - const uint8_t *pub_exp, int pub_len, - const uint8_t *priv_exp, int priv_len -#ifdef CONFIG_BIGINT_CRT - , const uint8_t *p, int p_len, - const uint8_t *q, int q_len, - const uint8_t *dP, int dP_len, - const uint8_t *dQ, int dQ_len, - const uint8_t *qInv, int qInv_len -#endif - ); -void RSA_pub_key_new(RSA_CTX **rsa_ctx, - const uint8_t *modulus, int mod_len, - const uint8_t *pub_exp, int pub_len); -void RSA_free(RSA_CTX *ctx); -int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data, uint8_t *out_data, - int is_decryption); -bigint *RSA_private(const RSA_CTX *c, bigint *bi_msg); -#ifdef CONFIG_SSL_CERT_VERIFICATION -bigint *RSA_sign_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, - bigint *modulus, bigint *pub_exp); -bigint *RSA_public(const RSA_CTX * c, bigint *bi_msg); -int RSA_encrypt(const RSA_CTX *ctx, const uint8_t *in_data, uint16_t in_len, - uint8_t *out_data, int is_signing); -void RSA_print(const RSA_CTX *ctx); -#endif - -/************************************************************************** - * RNG declarations - **************************************************************************/ -EXP_FUNC void STDCALL RNG_initialize(const uint8_t *seed_buf, int size); -EXP_FUNC void STDCALL RNG_terminate(void); -EXP_FUNC void STDCALL get_random(int num_rand_bytes, uint8_t *rand_data); -void get_random_NZ(int num_rand_bytes, uint8_t *rand_data); - /************************************************************************** * X509 declarations **************************************************************************/ diff --git a/ssl/gen_cert.c b/ssl/gen_cert.c new file mode 100644 index 0000000000..840c445e69 --- /dev/null +++ b/ssl/gen_cert.c @@ -0,0 +1,316 @@ +/* + * Copyright (c) 2007, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#include "config.h" + +#ifdef CONFIG_GEN_CERTIFICATES +#include +#include +#include "crypto_misc.h" + +/** + * This file is not completed. + */ + +/* OBJECT IDENTIFIER sha1withRSAEncryption (1 2 840 113549 1 1 5) */ +static const uint8_t sig_oid[] = +{ + 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05 +}; + +/* OBJECT IDENTIFIER rsaEncryption (1 2 840 113549 1 1 1) */ +static const uint8_t rsa_enc_oid[] = +{ + 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01 +}; + +static const uint8_t pub_key_seq[] = +{ + 0x02, 0x03, 0x01, 0x00, 0x01 +}; + +static uint8_t set_gen_length(int len, uint8_t *buf, int *offset) +{ + if (len < 0x80) /* short form */ + { + buf[(*offset)++] = len; + return 1; + } + else /* long form */ + { + int i, length_bytes = 0; + + if (len & 0x00FF0000) + length_bytes = 3; + else if (len & 0x0000FF00) + length_bytes = 2; + else if (len & 0x000000FF) + length_bytes = 1; + + buf[(*offset)++] = 0x80 + length_bytes; + + for (i = length_bytes-1; i >= 0; i--) + { + buf[*offset+i] = len & 0xFF; + len >>= 8; + } + + *offset += length_bytes; + return length_bytes+1; + } +} + +static int pre_adjust_with_size(uint8_t type, + int *seq_offset, uint8_t *buf, int *offset) +{ + buf[(*offset)++] = type; + *seq_offset = *offset; + *offset += 4; /* fill in later */ + return *offset; +} + +static void adjust_with_size(int seq_size, int seq_start, + uint8_t *buf, int *offset) +{ + uint8_t seq_byte_size; + int orig_seq_size = seq_size; + int orig_seq_start = seq_start; + + seq_size = *offset-seq_size; + seq_byte_size = set_gen_length(seq_size, buf, &seq_start); + + if (seq_byte_size != 4) + { + memmove(&buf[orig_seq_start+seq_byte_size], + &buf[orig_seq_size], seq_size); + *offset -= 4-seq_byte_size; + } +} + +static void gen_serial_number(uint8_t *buf, int *offset) +{ + buf[(*offset)++] = ASN1_INTEGER; + buf[(*offset)++] = 1; + buf[(*offset)++] = 0x7F; +} + +static void gen_signature_alg(uint8_t *buf, int *offset) +{ + buf[(*offset)++] = ASN1_SEQUENCE; + set_gen_length(13, buf, offset); + buf[(*offset)++] = ASN1_OID; + set_gen_length(sizeof(sig_oid), buf, offset); + memcpy(&buf[*offset], sig_oid, sizeof(sig_oid)); + *offset += sizeof(sig_oid); + buf[(*offset)++] = ASN1_NULL; + buf[(*offset)++] = 0; +} + +static void gen_dn(const char *name, uint8_t dn_type, + uint8_t *buf, int *offset) +{ + int name_size = strlen(name); + + if (name_size > 0x70) /* just too big */ + { + printf(unsupported_str); + return; + } + + buf[(*offset)++] = ASN1_SET; + set_gen_length(9+name_size, buf, offset); + buf[(*offset)++] = ASN1_SEQUENCE; + set_gen_length(7+name_size, buf, offset); + buf[(*offset)++] = ASN1_OID; + buf[(*offset)++] = 3; + buf[(*offset)++] = 0x55; + buf[(*offset)++] = 0x04; + buf[(*offset)++] = dn_type; + buf[(*offset)++] = ASN1_PRINTABLE_STR; + buf[(*offset)++] = name_size; + strcpy(&buf[*offset], name); + *offset += name_size; +} + +static void gen_issuer(const char *cn, const char *o, const char *ou, + uint8_t *buf, int *offset) +{ + int seq_offset; + int seq_size = pre_adjust_with_size( + ASN1_SEQUENCE, &seq_offset, buf, offset); + + if (cn != NULL) + gen_dn(cn, 3, buf, offset); + + if (o != NULL) + gen_dn(o, 10, buf, offset); + + if (ou != NULL) + gen_dn(o, 11, buf, offset); + + adjust_with_size(seq_size, seq_offset, buf, offset); +} + +static void gen_utc_time(uint8_t *buf, int *offset) +{ + time_t curr_time = time(NULL); + struct tm *now_tm = gmtime(&curr_time); + + buf[(*offset)++] = ASN1_SEQUENCE; + set_gen_length(30, buf, offset); + + now_tm->tm_year -= 100; + now_tm->tm_mon++; + buf[(*offset)++] = ASN1_UTC_TIME; + buf[(*offset)++] = 13; + buf[(*offset)++] = now_tm->tm_year/10 + '0'; + buf[(*offset)++] = now_tm->tm_year%10 + '0'; + buf[(*offset)++] = now_tm->tm_mon/10 + '0'; + buf[(*offset)++] = now_tm->tm_mon%10 + '0'; + buf[(*offset)++] = now_tm->tm_mday/10 + '0'; + buf[(*offset)++] = now_tm->tm_mday%10 + '0'; + memset(&buf[*offset], '0', 6); + *offset += 6; + buf[(*offset)++] = 'Z'; + now_tm->tm_year += 30; /* add 30 years */ + memcpy(&buf[*offset], &buf[*offset-15], 15); + buf[*offset + 2] = now_tm->tm_year/10 + '0'; + buf[*offset + 3] = now_tm->tm_year%10 + '0'; + *offset += 15; +} + +static void gen_pub_key2(const uint8_t *key, int key_size, + uint8_t *buf, int *offset) +{ + int seq_offset; + int seq_size = pre_adjust_with_size( + ASN1_SEQUENCE, &seq_offset, buf, offset); + buf[(*offset)++] = ASN1_INTEGER; + buf[(*offset)++] = key_size; + memcpy(&buf[*offset], key, key_size); + *offset += key_size; + adjust_with_size(seq_size, seq_offset, buf, offset); +} + +static void gen_pub_key1(const uint8_t *key, int key_size, + uint8_t *buf, int *offset) +{ + int seq_offset; + int seq_size = pre_adjust_with_size( + ASN1_BIT_STRING, &seq_offset, buf, offset); + buf[(*offset)++] = 0; /* bit string is multiple of 8 */ + gen_pub_key2(key, key_size, buf, offset); + adjust_with_size(seq_size, seq_offset, buf, offset); +} + +static void gen_pub_key(const uint8_t *key, int key_size, + uint8_t *buf, int *offset) +{ + int seq_offset; + int seq_size = pre_adjust_with_size( + ASN1_SEQUENCE, &seq_offset, buf, offset); + + buf[(*offset)++] = ASN1_SEQUENCE; + set_gen_length(13, buf, offset); + buf[(*offset)++] = ASN1_OID; + set_gen_length(sizeof(rsa_enc_oid), buf, offset); + memcpy(&buf[*offset], rsa_enc_oid, sizeof(rsa_enc_oid)); + *offset += sizeof(rsa_enc_oid); + buf[(*offset)++] = ASN1_NULL; + buf[(*offset)++] = 0; + gen_pub_key1(key, key_size, buf, offset); + memcpy(&buf[*offset], pub_key_seq, sizeof(pub_key_seq)); + *offset += sizeof(pub_key_seq); + adjust_with_size(seq_size, seq_offset, buf, offset); +} + +static void gen_signature(const uint8_t *sig, int sig_size, + uint8_t *buf, int *offset) +{ + buf[(*offset)++] = ASN1_BIT_STRING; + set_gen_length(sig_size+1, buf, offset); + buf[(*offset)++] = 0; /* bit string is multiple of 8 */ + memcpy(&buf[*offset], sig, sig_size); + *offset += sig_size; +} + +static void gen_tbs_cert(const char *cn, const char *o, const char *ou, + const uint8_t *key, int key_size, uint8_t *buf, int *offset) +{ + int seq_offset; + int seq_size = pre_adjust_with_size( + ASN1_SEQUENCE, &seq_offset, buf, offset); + gen_serial_number(buf, offset); + gen_signature_alg(buf, offset); + gen_issuer(cn, o, ou, buf, offset); + gen_utc_time(buf, offset); + gen_issuer(cn, o, ou, buf, offset); + gen_pub_key(key, key_size, buf, offset); + adjust_with_size(seq_size, seq_offset, buf, offset); +} + +int gen_cert(const char *cn, const char *o, const char *ou, + const uint8_t *key, int key_size, uint8_t *buf) +{ + int offset = 0; + int seq_offset; + int seq_size = pre_adjust_with_size( + ASN1_SEQUENCE, &seq_offset, buf, &offset); + uint8_t sig[128]; + memset(sig, 0, sizeof(sig)); + + gen_tbs_cert(cn, o, ou, key, key_size, buf, &offset); + gen_signature_alg(buf, &offset); + gen_signature(sig, sizeof(sig), buf, &offset); + + adjust_with_size(seq_size, seq_offset, buf, &offset); + print_blob("GA", buf, offset); + return offset; /* the size of the certificate */ +} + +int main(int argc, char *argv[]) +{ + uint8_t key[16]; + uint8_t buf[2048]; + int offset = 0; + memset(key, 0, sizeof(key)); + memset(buf, 0, sizeof(buf)); + + //gen_tbs_cert("abc", "def", "ghi", key, sizeof(key), buf, &offset); + offset = gen_cert("abc", "def", "ghi", "blah", 5, buf); + FILE *f = fopen("blah.dat", "w"); + fwrite(buf, offset, 1, f); + fclose(f); + + return 0; +} + +#endif + diff --git a/ssl/x509.c b/ssl/x509.c index 849edded06..2ea0b5d05d 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -205,6 +205,48 @@ void x509_free(X509_CTX *x509_ctx) } #ifdef CONFIG_SSL_CERT_VERIFICATION +/** + * Take a signature and decrypt it. + */ +static bigint *sig_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, + bigint *modulus, bigint *pub_exp) +{ + int i, size; + bigint *decrypted_bi, *dat_bi; + bigint *bir = NULL; + uint8_t *block = (uint8_t *)alloca(sig_len); + + /* decrypt */ + dat_bi = bi_import(ctx, sig, sig_len); + ctx->mod_offset = BIGINT_M_OFFSET; + + /* convert to a normal block */ + decrypted_bi = bi_mod_power2(ctx, dat_bi, modulus, pub_exp); + + bi_export(ctx, decrypted_bi, block, sig_len); + ctx->mod_offset = BIGINT_M_OFFSET; + + i = 10; /* start at the first possible non-padded byte */ + while (block[i++] && i < sig_len); + size = sig_len - i; + + /* get only the bit we want */ + if (size > 0) + { + int len; + const uint8_t *sig_ptr = x509_get_signature(&block[i], &len); + + if (sig_ptr) + { + bir = bi_import(ctx, sig_ptr, len); + } + } + + /* save a few bytes of memory */ + bi_clear_cache(ctx); + return bir; +} + /** * Do some basic checks on the certificate chain. * @@ -296,7 +338,7 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) ctx = cert->rsa_ctx->bi_ctx; mod = next_cert->rsa_ctx->m; expn = next_cert->rsa_ctx->e; - cert_sig = RSA_sign_verify(ctx, cert->signature, cert->sig_len, + cert_sig = sig_verify(ctx, cert->signature, cert->sig_len, bi_clone(ctx, mod), bi_clone(ctx, expn)); if (cert_sig) diff --git a/www/index.html b/www/index.html index 3ae8d4c03b..75fe4731b0 100755 --- a/www/index.html +++ b/www/index.html @@ -7086,7 +7086,7 @@
    changes, notes and errata
    -
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* vfork() is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8 (yet to be released)@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* vfork() is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2007, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 7cac88ca9cb32b3bc8995c33acce450ff03819a3 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 18 Nov 2007 09:00:42 +0000 Subject: [PATCH 119/301] git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@142 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/asn1.c | 14 +++- ssl/crypto_misc.h | 1 - ssl/gen_cert.c | 171 ++++++++++++++++++++++++++++++++++------------ ssl/x509.c | 8 ++- 4 files changed, 145 insertions(+), 49 deletions(-) diff --git a/ssl/asn1.c b/ssl/asn1.c index 8cdd3e433c..d843b7988e 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -113,6 +113,15 @@ int asn1_get_int(const uint8_t *buf, int *offset, uint8_t **object) goto end_int_array; *object = (uint8_t *)malloc(len); + /* TODO */ +#if 0 + if (*object == 0x00) /* ignore the negative byte */ + { + len--; + (*object)++; + } +#endif + memcpy(*object, &buf[*offset], len); *offset += len; @@ -349,7 +358,7 @@ int asn1_public_key(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) asn1_next_obj(cert, offset, ASN1_BIT_STRING) < 0) goto end_pub_key; - (*offset)++; + (*offset)++; /* ignore the padding bit field */ if (asn1_next_obj(cert, offset, ASN1_SEQUENCE) < 0) goto end_pub_key; @@ -378,7 +387,8 @@ int asn1_signature(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) if (cert[(*offset)++] != ASN1_BIT_STRING) goto end_sig; - x509_ctx->sig_len = get_asn1_length(cert, offset); + x509_ctx->sig_len = get_asn1_length(cert, offset)-1; + (*offset)++; /* ignore bit string padding bits */ x509_ctx->signature = (uint8_t *)malloc(x509_ctx->sig_len); memcpy(x509_ctx->signature, &cert[*offset], x509_ctx->sig_len); *offset += x509_ctx->sig_len; diff --git a/ssl/crypto_misc.h b/ssl/crypto_misc.h index b311b50ec1..7f0e4e11d6 100644 --- a/ssl/crypto_misc.h +++ b/ssl/crypto_misc.h @@ -96,7 +96,6 @@ int x509_new(const uint8_t *cert, int *len, X509_CTX **ctx); void x509_free(X509_CTX *x509_ctx); #ifdef CONFIG_SSL_CERT_VERIFICATION int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert); -const uint8_t *x509_get_signature(const uint8_t *asn1_signature, int *len); #endif #ifdef CONFIG_SSL_FULL_MODE void x509_print(CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert); diff --git a/ssl/gen_cert.c b/ssl/gen_cert.c index 840c445e69..9cc7d9fec9 100644 --- a/ssl/gen_cert.c +++ b/ssl/gen_cert.c @@ -51,11 +51,24 @@ static const uint8_t rsa_enc_oid[] = 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01 }; +/* INTEGER 65537 */ static const uint8_t pub_key_seq[] = { 0x02, 0x03, 0x01, 0x00, 0x01 }; +/* 0x00 + SEQUENCE { + SEQUENCE { + OBJECT IDENTIFIER sha1 (1 3 14 3 2 26) + NULL + } + OCTET STRING */ +static const uint8_t asn1_sig[] = +{ + 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, + 0x1a, 0x05, 0x00, 0x04, 0x14 +}; + static uint8_t set_gen_length(int len, uint8_t *buf, int *offset) { if (len < 0x80) /* short form */ @@ -133,15 +146,16 @@ static void gen_signature_alg(uint8_t *buf, int *offset) buf[(*offset)++] = 0; } -static void gen_dn(const char *name, uint8_t dn_type, +static int gen_dn(const char *name, uint8_t dn_type, uint8_t *buf, int *offset) { + int ret = X509_OK; int name_size = strlen(name); if (name_size > 0x70) /* just too big */ { - printf(unsupported_str); - return; + ret = X509_NOT_OK; + goto error; } buf[(*offset)++] = ASN1_SET; @@ -157,25 +171,45 @@ static void gen_dn(const char *name, uint8_t dn_type, buf[(*offset)++] = name_size; strcpy(&buf[*offset], name); *offset += name_size; + +error: + return ret; } -static void gen_issuer(const char *cn, const char *o, const char *ou, +static int gen_issuer(const char *cn, const char *o, const char *ou, uint8_t *buf, int *offset) { + int ret = X509_OK; int seq_offset; int seq_size = pre_adjust_with_size( ASN1_SEQUENCE, &seq_offset, buf, offset); - if (cn != NULL) - gen_dn(cn, 3, buf, offset); + /* we need the common name at a minimum */ + if (cn == NULL) + { + ret = X509_NOT_OK; + goto error; + } + + if ((ret = gen_dn(cn, 3, buf, offset))) + goto error; if (o != NULL) - gen_dn(o, 10, buf, offset); + { + if ((ret = gen_dn(o, 10, buf, offset))) + goto error; + } if (ou != NULL) - gen_dn(o, 11, buf, offset); + { + if ((ret = gen_dn(o, 11, buf, offset))) + goto error; + } adjust_with_size(seq_size, seq_offset, buf, offset); + +error: + return ret; } static void gen_utc_time(uint8_t *buf, int *offset) @@ -206,32 +240,39 @@ static void gen_utc_time(uint8_t *buf, int *offset) *offset += 15; } -static void gen_pub_key2(const uint8_t *key, int key_size, - uint8_t *buf, int *offset) +static void gen_pub_key2(const RSA_CTX *rsa_ctx, uint8_t *buf, int *offset) { int seq_offset; + int pub_key_size = rsa_ctx->num_octets; + uint8_t *block = (uint8_t *)alloca(pub_key_size); int seq_size = pre_adjust_with_size( ASN1_SEQUENCE, &seq_offset, buf, offset); buf[(*offset)++] = ASN1_INTEGER; - buf[(*offset)++] = key_size; - memcpy(&buf[*offset], key, key_size); - *offset += key_size; + bi_export(rsa_ctx->bi_ctx, rsa_ctx->m, block, pub_key_size); + if (*block & 0x80) /* make integer positive */ + { + set_gen_length(pub_key_size+1, buf, offset); + buf[(*offset)++] = 0; + } + else + set_gen_length(pub_key_size, buf, offset); + + memcpy(&buf[*offset], block, pub_key_size); + *offset += pub_key_size; adjust_with_size(seq_size, seq_offset, buf, offset); } -static void gen_pub_key1(const uint8_t *key, int key_size, - uint8_t *buf, int *offset) +static void gen_pub_key1(const RSA_CTX *rsa_ctx, uint8_t *buf, int *offset) { int seq_offset; int seq_size = pre_adjust_with_size( ASN1_BIT_STRING, &seq_offset, buf, offset); buf[(*offset)++] = 0; /* bit string is multiple of 8 */ - gen_pub_key2(key, key_size, buf, offset); + gen_pub_key2(rsa_ctx, buf, offset); adjust_with_size(seq_size, seq_offset, buf, offset); } -static void gen_pub_key(const uint8_t *key, int key_size, - uint8_t *buf, int *offset) +static void gen_pub_key(const RSA_CTX *rsa_ctx, uint8_t *buf, int *offset) { int seq_offset; int seq_size = pre_adjust_with_size( @@ -245,71 +286,113 @@ static void gen_pub_key(const uint8_t *key, int key_size, *offset += sizeof(rsa_enc_oid); buf[(*offset)++] = ASN1_NULL; buf[(*offset)++] = 0; - gen_pub_key1(key, key_size, buf, offset); + gen_pub_key1(rsa_ctx, buf, offset); memcpy(&buf[*offset], pub_key_seq, sizeof(pub_key_seq)); *offset += sizeof(pub_key_seq); adjust_with_size(seq_size, seq_offset, buf, offset); } -static void gen_signature(const uint8_t *sig, int sig_size, - uint8_t *buf, int *offset) +static void gen_signature(const RSA_CTX *rsa_ctx, const uint8_t *sha_dgst, + uint8_t *buf, int *offset) { + uint8_t *enc_block = (uint8_t *)alloca(rsa_ctx->num_octets); + uint8_t *block = (uint8_t *)alloca(sizeof(asn1_sig) + SHA1_SIZE); + int sig_size; + + /* add the digest as an embedded asn.1 sequence */ + memcpy(block, asn1_sig, sizeof(asn1_sig)); + memcpy(&block[sizeof(asn1_sig)], sha_dgst, SHA1_SIZE); + + sig_size = RSA_encrypt(rsa_ctx, block, + sizeof(asn1_sig) + SHA1_SIZE, enc_block, 1); + buf[(*offset)++] = ASN1_BIT_STRING; set_gen_length(sig_size+1, buf, offset); buf[(*offset)++] = 0; /* bit string is multiple of 8 */ - memcpy(&buf[*offset], sig, sig_size); + memcpy(&buf[*offset], enc_block, sig_size); *offset += sig_size; } -static void gen_tbs_cert(const char *cn, const char *o, const char *ou, - const uint8_t *key, int key_size, uint8_t *buf, int *offset) +static int gen_tbs_cert(const char *cn, const char *o, const char *ou, + const RSA_CTX *rsa_ctx, uint8_t *buf, int *offset, + uint8_t *sha_dgst) { + int ret = X509_OK; + SHA1_CTX sha_ctx; int seq_offset; int seq_size = pre_adjust_with_size( - ASN1_SEQUENCE, &seq_offset, buf, offset); + ASN1_SEQUENCE, &seq_offset, buf, offset); + int begin_tbs = *offset; + gen_serial_number(buf, offset); gen_signature_alg(buf, offset); - gen_issuer(cn, o, ou, buf, offset); + if ((ret = gen_issuer(cn, o, ou, buf, offset))) + goto error; + gen_utc_time(buf, offset); - gen_issuer(cn, o, ou, buf, offset); - gen_pub_key(key, key_size, buf, offset); + if ((ret = gen_issuer(cn, o, ou, buf, offset))) + goto error; + + gen_pub_key(rsa_ctx, buf, offset); + + SHA1_Init(&sha_ctx); + SHA1_Update(&sha_ctx, &buf[begin_tbs], *offset-begin_tbs); + SHA1_Final(sha_dgst, &sha_ctx); adjust_with_size(seq_size, seq_offset, buf, offset); + +error: + return ret; } int gen_cert(const char *cn, const char *o, const char *ou, - const uint8_t *key, int key_size, uint8_t *buf) + const RSA_CTX *rsa_ctx, uint8_t *buf, int *cert_size) { + int ret = X509_OK; int offset = 0; int seq_offset; + uint8_t sha_dgst[SHA1_SIZE]; int seq_size = pre_adjust_with_size( ASN1_SEQUENCE, &seq_offset, buf, &offset); - uint8_t sig[128]; - memset(sig, 0, sizeof(sig)); - gen_tbs_cert(cn, o, ou, key, key_size, buf, &offset); + if ((ret = gen_tbs_cert(cn, o, ou, rsa_ctx, buf, &offset, sha_dgst))) + goto error; + gen_signature_alg(buf, &offset); - gen_signature(sig, sizeof(sig), buf, &offset); + gen_signature(rsa_ctx, sha_dgst, buf, &offset); adjust_with_size(seq_size, seq_offset, buf, &offset); - print_blob("GA", buf, offset); - return offset; /* the size of the certificate */ + *cert_size = offset; +error: + return ret; } int main(int argc, char *argv[]) { - uint8_t key[16]; + int ret = X509_OK; + uint8_t *key_buf = NULL; + RSA_CTX *rsa_ctx = NULL; uint8_t buf[2048]; - int offset = 0; - memset(key, 0, sizeof(key)); - memset(buf, 0, sizeof(buf)); + int cert_size; + FILE *f; - //gen_tbs_cert("abc", "def", "ghi", key, sizeof(key), buf, &offset); - offset = gen_cert("abc", "def", "ghi", "blah", 5, buf); - FILE *f = fopen("blah.dat", "w"); - fwrite(buf, offset, 1, f); + int len = get_file("../ssl/test/axTLS.key_512", &key_buf); + if ((ret = asn1_get_private_key(key_buf, len, &rsa_ctx))) + goto error; + + if ((ret = gen_cert("abc", "def", "ghi", rsa_ctx, buf, &cert_size))) + goto error; + + f = fopen("blah.dat", "w"); + fwrite(buf, cert_size, 1, f); fclose(f); +error: + free(key_buf); + RSA_free(rsa_ctx); + + if (ret) + printf("Some cert generation issue\n"); - return 0; + return ret; } #endif diff --git a/ssl/x509.c b/ssl/x509.c index 2ea0b5d05d..81617066ef 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -45,7 +45,7 @@ /** * Retrieve the signature from a certificate. */ -const uint8_t *x509_get_signature(const uint8_t *asn1_sig, int *len) +static const uint8_t *get_signature(const uint8_t *asn1_sig, int *len) { int offset = 0; const uint8_t *ptr = NULL; @@ -224,6 +224,7 @@ static bigint *sig_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, decrypted_bi = bi_mod_power2(ctx, dat_bi, modulus, pub_exp); bi_export(ctx, decrypted_bi, block, sig_len); + print_blob("SIGNATURE", block, sig_len); ctx->mod_offset = BIGINT_M_OFFSET; i = 10; /* start at the first possible non-padded byte */ @@ -233,8 +234,11 @@ static bigint *sig_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, /* get only the bit we want */ if (size > 0) { + FILE *f = fopen("blah.dat", "w"); + fwrite(&block[i], sig_len-i, 1, f); + fclose(f); int len; - const uint8_t *sig_ptr = x509_get_signature(&block[i], &len); + const uint8_t *sig_ptr = get_signature(&block[i], &len); if (sig_ptr) { From bffc3b21973b452dbcf80c51835faa3343fc907c Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 29 Nov 2007 13:02:54 +0000 Subject: [PATCH 120/301] certificate generation git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@143 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- bindings/csharp/axTLS.cs | 2 - bindings/generate_SWIG_interface.pl | 2 + bindings/generate_interface.pl | 2 + bindings/java/SSLCTX.java | 2 - crypto/crypto_misc.c | 2 +- crypto/rsa.c | 6 +- docsrc/axTLS.dox | 4 +- httpd/axhttp.h | 2 +- httpd/axhttpd.c | 14 --- ssl/Config.in | 69 +++++++++++-- ssl/Makefile | 14 +-- ssl/asn1.c | 16 ++- ssl/crypto_misc.h | 9 +- ssl/gen_cert.c | 147 +++++++++++----------------- ssl/loader.c | 86 +++++++++++++++- ssl/ssl.h | 29 +++++- ssl/test/Makefile | 7 +- ssl/test/ssltest.c | 106 ++++++++++---------- ssl/tls1.c | 57 +++++------ ssl/tls1.h | 7 +- ssl/x509.c | 85 +++++++++------- www/index.html | 2 +- 22 files changed, 389 insertions(+), 281 deletions(-) diff --git a/bindings/csharp/axTLS.cs b/bindings/csharp/axTLS.cs index f056df70a4..cf64a256e7 100644 --- a/bindings/csharp/axTLS.cs +++ b/bindings/csharp/axTLS.cs @@ -240,8 +240,6 @@ public class SSLCTX * - SSL_CLIENT_AUTHENTICATION (server only): Enforce client * authentication i.e. each handshake will include a "certificate * request" message from the server. - * - SSL_NO_DEFAULT_KEY: Don't use the default key/certificate. The - * user will load the key/certificate explicitly. * - SSL_DISPLAY_BYTES (full mode build only): Display the byte * sequences during the handshake. * - SSL_DISPLAY_STATES (full mode build only): Display the state diff --git a/bindings/generate_SWIG_interface.pl b/bindings/generate_SWIG_interface.pl index cb157abc0c..4b2517988f 100755 --- a/bindings/generate_SWIG_interface.pl +++ b/bindings/generate_SWIG_interface.pl @@ -70,6 +70,8 @@ sub parseFile { foreach $line (@_) { + next if $line =~ /ssl_x509_create/; # ignore for now + # test for a #define if (!$skip && $line =~ m/^#define/) { diff --git a/bindings/generate_interface.pl b/bindings/generate_interface.pl index dad5ae5cb1..c24bff9f40 100755 --- a/bindings/generate_interface.pl +++ b/bindings/generate_interface.pl @@ -133,6 +133,8 @@ sub parseFile foreach $line (@file) { + next if $line =~ /sl_x509_create/; # ignore for now + # test for a #define if (!$skip && $line =~ m/^#define/) { diff --git a/bindings/java/SSLCTX.java b/bindings/java/SSLCTX.java index 311bedb795..1cd3e032f0 100644 --- a/bindings/java/SSLCTX.java +++ b/bindings/java/SSLCTX.java @@ -68,8 +68,6 @@ public class SSLCTX * - SSL_CLIENT_AUTHENTICATION (server only): Enforce client authentication * i.e. each handshake will include a "certificate request" message from * the server. - * - SSL_NO_DEFAULT_KEY: Don't use the default key/certificate. The user - * will load the key/certificate explicitly. * - SSL_DISPLAY_BYTES (full mode build only): Display the byte sequences * during the handshake. * - SSL_DISPLAY_STATES (full mode build only): Display the state changes diff --git a/crypto/crypto_misc.c b/crypto/crypto_misc.c index bc802c703e..9bddee2100 100644 --- a/crypto/crypto_misc.c +++ b/crypto/crypto_misc.c @@ -52,7 +52,7 @@ static uint64_t rng_num; #endif static int rng_ref_count; -const char * const unsupported_str = "Error: feature not supported\n"; +const char * const unsupported_str = "Error: Feature not supported\n"; #ifndef CONFIG_SSL_SKELETON_MODE /** diff --git a/crypto/rsa.c b/crypto/rsa.c index 7fb17b330d..c0dcb0355b 100644 --- a/crypto/rsa.c +++ b/crypto/rsa.c @@ -80,6 +80,10 @@ void RSA_pub_key_new(RSA_CTX **ctx, { RSA_CTX *rsa_ctx; BI_CTX *bi_ctx = bi_initialize(); + + if (*ctx) /* if we load multiple certs, dump the old one */ + RSA_free(*ctx); + *ctx = (RSA_CTX *)calloc(1, sizeof(RSA_CTX)); rsa_ctx = *ctx; rsa_ctx->bi_ctx = bi_ctx; @@ -211,7 +215,7 @@ void RSA_print(const RSA_CTX *rsa_ctx) } #endif -#ifdef CONFIG_SSL_CERT_VERIFICATION +#if defined(CONFIG_SSL_CERT_VERIFICATION) || defined(CONFIG_SSL_GENERATE_X509_CERT) /** * Performs c = m^e mod n */ diff --git a/docsrc/axTLS.dox b/docsrc/axTLS.dox index 6780237683..d9959b21dd 100644 --- a/docsrc/axTLS.dox +++ b/docsrc/axTLS.dox @@ -459,7 +459,7 @@ WARN_LOGFILE = # directories like "/usr/src/myproject". Separate the files or directories # with spaces. -INPUT = ../bindings/csharp/axTLS.cs ../bindings/java/SSL.java ../bindings/java/SSLUtil.java ../bindings/java/SSLCTX.java ../bindings/java/SSLServer.java ../bindings/java/SSLClient.java ../bindings/java/SSLReadHolder.java ../ssl/ssl.h ../ssl/bigint.c ../ssl/bigint.h +INPUT = ../bindings/csharp/axTLS.cs ../bindings/java/SSL.java ../bindings/java/SSLUtil.java ../bindings/java/SSLCTX.java ../bindings/java/SSLServer.java ../bindings/java/SSLClient.java ../bindings/java/SSLReadHolder.java ../ssl/ssl.h ../crypto/bigint.c ../crypto/bigint.h # If the value of the INPUT tag contains directories, you can use the # FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp @@ -1005,7 +1005,7 @@ INCLUDE_FILE_PATTERNS = # undefined via #undef or recursively expanded use the := operator # instead of the = operator. -PREDEFINED = CONFIG_SSL_CERT_VERIFICATION CONFIG_SSL_ENABLE_CLIENT CONFIG_SSL_MAX_CLNT_SESSIONS=1 CONFIG_BIGINT_MONTGOMERY CONFIG_BIGINT_BARRETT CONFIG_BIGINT_CRT EXP_FUNC="" STDCALL="" +PREDEFINED = CONFIG_SSL_CERT_VERIFICATION CONFIG_SSL_ENABLE_CLIENT CONFIG_SSL_GENERATE_X509_CERT CONFIG_BIGINT_MONTGOMERY CONFIG_BIGINT_BARRETT CONFIG_BIGINT_CRT EXP_FUNC="" STDCALL="" # If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then # this tag can be used to specify a list of macro names that should be expanded. diff --git a/httpd/axhttp.h b/httpd/axhttp.h index de3a1985e8..62a36fd035 100644 --- a/httpd/axhttp.h +++ b/httpd/axhttp.h @@ -42,7 +42,7 @@ #define BLOCKSIZE 4096 #define INITIAL_CONNECTION_SLOTS 10 -#define CONFIG_HTTP_DEFAULT_SSL_OPTIONS 0 +#define CONFIG_HTTP_DEFAULT_SSL_OPTIONS 0 #define STATE_WANT_TO_READ_HEAD 1 #define STATE_WANT_TO_SEND_HEAD 2 diff --git a/httpd/axhttpd.c b/httpd/axhttpd.c index bd3b48dd48..de408022e2 100644 --- a/httpd/axhttpd.c +++ b/httpd/axhttpd.c @@ -36,20 +36,6 @@ #include #include "axhttp.h" -#if AXDEBUG -#define AXDEBUGSTART \ - { \ - FILE *dout; \ - dout = fopen("/var/log/axdebug", "a"); \ - -#define AXDEBUGEND \ - fclose(dout); \ - } -#else /* AXDEBUG */ -#define AXDEBUGSTART -#define AXDEBUGEND -#endif /* AXDEBUG */ - struct serverstruct *servers; struct connstruct *usedconns; struct connstruct *freeconns; diff --git a/ssl/Config.in b/ssl/Config.in index ec5fca84d5..05d88688c4 100644 --- a/ssl/Config.in +++ b/ssl/Config.in @@ -116,8 +116,12 @@ config CONFIG_SSL_USE_DEFAULT_KEY that is built in. This is one way to save on a couple of kB's if an external private key/certificate is used. + The private key is in ssl/private_key.h and the certificate is in + ssl/cert.h. + The advantage of a built-in private key/certificate is that no file - system is required for access. + system is required for access. Both the certificate and the private + key will be automatically loaded on a ssl_ctx_new(). However this private key/certificate can never be changed (without a code update). @@ -125,6 +129,62 @@ config CONFIG_SSL_USE_DEFAULT_KEY This mode is enabled by default. Disable this mode if the built-in key/certificate is not used. +config CONFIG_SSL_PRIVATE_KEY_LOCATION + string "Private key file location" + depends on !CONFIG_SSL_USE_DEFAULT_KEY && !CONFIG_SSL_SKELETON_MODE + help + The file location of the private key which will be automatically + loaded on a ssl_ctx_new(). + +config CONFIG_SSL_PRIVATE_KEY_PASSWORD + string "Private key password" + depends on !CONFIG_SSL_USE_DEFAULT_KEY && CONFIG_SSL_HAS_PEM + help + The password required to decrypt a PEM-encoded password file. + +config CONFIG_SSL_X509_CERT_LOCATION + string "X.509 certificate file location" + depends on !CONFIG_SSL_GENERATE_X509_CERT && !CONFIG_SSL_SKELETON_MODE + help + The file location of the X.509 certificate which will be automatically + loaded on a ssl_ctx_new(). + +config CONFIG_SSL_GENERATE_X509_CERT + bool "Generate X.509 Certificate" + default n + help + An X.509 certificate can be automatically generated on a + ssl_ctx_new(). A private key still needs to be provided (the private + key in ss/private_key.h will be used unless + CONFIG_SSL_PRIVATE_KEY_LOCATION is set. + + The certificate is generated on the fly, and so a minor start-up time + penalty is to be expected. + +config CONFIG_SSL_X509_COMMON_NAME + string "X.509 Common Name" + depends on CONFIG_SSL_GENERATE_X509_CERT + help + The common name for the X.509 certificate. This should in theory be + the URL for server. + + If this is blank, then the hostname is used. + +config CONFIG_SSL_X509_ORGANIZATION_NAME + string "X.509 Organization Name" + depends on CONFIG_SSL_GENERATE_X509_CERT + help + The organization name for the generated X.509 certificate. + + If this is blank, then $USERNAME will be used. + +config CONFIG_SSL_X509_ORGANIZATION_UNIT_NAME + string "X.509 Organization Unit Name" + depends on CONFIG_SSL_GENERATE_X509_CERT + help + The organization unit name for the generated X.509 certificate. This + field is optional. + config CONFIG_SSL_ENABLE_V23_HANDSHAKE bool "Enable v23 Handshake" default y @@ -251,13 +311,6 @@ config CONFIG_OPENSSL_COMPATIBLE Note: not all the API is implemented, so parts may still break. And it's definitely not 100% compatible. -config CONFIG_GEN_CERTIFICATES - bool "Enable the generation of certificates" - default n - depends on CONFIG_SSL_CERT_VERIFICATION - help - A primitive self-signed certificate generator. - config CONFIG_PERFORMANCE_TESTING bool "Build the bigint performance test tool" default n diff --git a/ssl/Makefile b/ssl/Makefile index eac1e8a701..62a62047dc 100644 --- a/ssl/Makefile +++ b/ssl/Makefile @@ -48,10 +48,8 @@ BASETARGET=libaxtls.so CRYPTO_PATH=$(AXTLS_HOME)/crypto/ ifdef CONFIG_PLATFORM_CYGWIN TARGET2=$(AXTLS_HOME)/$(STAGE)/libaxtls.dll.a -TARGET3=$(AXTLS_HOME)/$(STAGE)/gen_cert.exe else TARGET2=$(AXTLS_HOME)/$(STAGE)/$(LIBMINOR) -TARGET3=$(AXTLS_HOME)/$(STAGE)/gen_cert endif # shared library major/minor numbers @@ -64,7 +62,7 @@ STATIC_LIB=$(AXTLS_HOME)/$(STAGE)/axtls.static.lib CRYPTO_PATH=$(AXTLS_HOME)\\crypto\\ endif -libs: $(TARGET1) $(TARGET2) $(TARGET3) +libs: $(TARGET1) $(TARGET2) CRYPTO_OBJ=\ $(CRYPTO_PATH)aes.o \ @@ -79,14 +77,15 @@ CRYPTO_OBJ=\ OBJ=\ asn1.o \ - x509.o \ - os_port.o \ + gen_cert.o \ loader.o \ openssl.o \ + os_port.o \ p12.o \ tls1.o \ tls1_svr.o \ - tls1_clnt.o + tls1_clnt.o \ + x509.o include $(AXTLS_HOME)/config/makefile.post @@ -106,9 +105,6 @@ else -Wl,--enable-auto-import $(CRYPTO_OBJ) $(OBJ) endif -$(TARGET3): gen_cert.o - $(LD) $(LDFLAGS) -o $@ $< -L$(AXTLS_HOME)/$(STAGE) -laxtls - else # Win32 CRYPTO_OBJ:=$(CRYPTO_OBJ:.o=.obj) diff --git a/ssl/asn1.c b/ssl/asn1.c index d843b7988e..0fa9820e67 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -112,16 +112,13 @@ int asn1_get_int(const uint8_t *buf, int *offset, uint8_t **object) if ((len = asn1_next_obj(buf, offset, ASN1_INTEGER)) < 0) goto end_int_array; - *object = (uint8_t *)malloc(len); - /* TODO */ -#if 0 - if (*object == 0x00) /* ignore the negative byte */ + if (buf[*offset] == 0x00) /* ignore the negative byte */ { len--; - (*object)++; + (*offset)++; } -#endif + *object = (uint8_t *)malloc(len); memcpy(*object, &buf[*offset], len); *offset += len; @@ -421,10 +418,13 @@ void remove_ca_certs(CA_CERT_CTX *ca_cert_ctx) { int i = 0; + if (ca_cert_ctx == NULL) + return; + while (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) { x509_free(ca_cert_ctx->cert[i]); - ca_cert_ctx->cert[i++] = NULL; + ca_cert_ctx->cert[i] = NULL; } free(ca_cert_ctx); @@ -441,9 +441,7 @@ int asn1_compare_dn(char * const dn1[], char * const dn2[]) for (i = 0; i < X509_NUM_DN_TYPES; i++) { if (asn1_compare_dn_comp(dn1[i], dn2[i])) - { return 1; - } } return 0; /* all good */ diff --git a/ssl/crypto_misc.h b/ssl/crypto_misc.h index 7f0e4e11d6..3ceb9d1fc8 100644 --- a/ssl/crypto_misc.h +++ b/ssl/crypto_misc.h @@ -68,13 +68,8 @@ struct _x509_ctx { char *ca_cert_dn[X509_NUM_DN_TYPES]; char *cert_dn[X509_NUM_DN_TYPES]; -#if defined(_WIN32_WCE) - long not_before; - long not_after; -#else time_t not_before; time_t not_after; -#endif uint8_t *signature; uint16_t sig_len; uint8_t sig_type; @@ -98,8 +93,8 @@ void x509_free(X509_CTX *x509_ctx); int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert); #endif #ifdef CONFIG_SSL_FULL_MODE -void x509_print(CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert); -void x509_display_error(int error); +void x509_print(const X509_CTX *cert, CA_CERT_CTX *ca_cert_ctx); +const char * x509_display_error(int error); #endif /************************************************************************** diff --git a/ssl/gen_cert.c b/ssl/gen_cert.c index 9cc7d9fec9..f58463ca05 100644 --- a/ssl/gen_cert.c +++ b/ssl/gen_cert.c @@ -30,13 +30,13 @@ #include "config.h" -#ifdef CONFIG_GEN_CERTIFICATES +#ifdef CONFIG_SSL_GENERATE_X509_CERT #include #include -#include "crypto_misc.h" +#include "ssl.h" /** - * This file is not completed. + * Generate a basic X.509 certificate */ /* OBJECT IDENTIFIER sha1withRSAEncryption (1 2 840 113549 1 1 5) */ @@ -176,33 +176,35 @@ static int gen_dn(const char *name, uint8_t dn_type, return ret; } -static int gen_issuer(const char *cn, const char *o, const char *ou, - uint8_t *buf, int *offset) +static int gen_issuer(const char * dn[], uint8_t *buf, int *offset) { int ret = X509_OK; int seq_offset; int seq_size = pre_adjust_with_size( ASN1_SEQUENCE, &seq_offset, buf, offset); + char hostname[128]; - /* we need the common name at a minimum */ - if (cn == NULL) + /* we need the common name, so if not configured, use the hostname */ + if (dn[X509_COMMON_NAME] == NULL || strlen(dn[X509_COMMON_NAME]) == 0) { - ret = X509_NOT_OK; - goto error; + gethostname(hostname, sizeof(hostname)); + dn[X509_COMMON_NAME] = hostname; } - if ((ret = gen_dn(cn, 3, buf, offset))) - goto error; + if ((ret = gen_dn(dn[X509_COMMON_NAME], 3, buf, offset))) + goto error; - if (o != NULL) - { - if ((ret = gen_dn(o, 10, buf, offset))) - goto error; - } + if (dn[X509_ORGANIZATION] == NULL || strlen(dn[X509_ORGANIZATION]) == 0) + dn[X509_ORGANIZATION] = getenv("USERNAME"); + + if (dn[X509_ORGANIZATION] != NULL && + ((ret = gen_dn(dn[X509_ORGANIZATION], 10, buf, offset)))) + goto error; - if (ou != NULL) + if (dn[X509_ORGANIZATIONAL_TYPE] != NULL && + strlen(dn[X509_ORGANIZATIONAL_TYPE]) != 0) { - if ((ret = gen_dn(o, 11, buf, offset))) + if ((ret = gen_dn(dn[X509_ORGANIZATIONAL_TYPE], 11, buf, offset))) goto error; } @@ -212,32 +214,20 @@ static int gen_issuer(const char *cn, const char *o, const char *ou, return ret; } -static void gen_utc_time(uint8_t *buf, int *offset) +static const uint8_t time_seq[] = { - time_t curr_time = time(NULL); - struct tm *now_tm = gmtime(&curr_time); + ASN1_SEQUENCE, 30, + ASN1_UTC_TIME, 13, + '0', '7', '0', '1', '0', '1', '0', '0', '0', '0', '0', '0', 'Z', + ASN1_UTC_TIME, 13, /* make it good for 40 or so years */ + '4', '9', '0', '1', '0', '1', '0', '0', '0', '0', '0', '0', 'Z' +}; - buf[(*offset)++] = ASN1_SEQUENCE; - set_gen_length(30, buf, offset); - - now_tm->tm_year -= 100; - now_tm->tm_mon++; - buf[(*offset)++] = ASN1_UTC_TIME; - buf[(*offset)++] = 13; - buf[(*offset)++] = now_tm->tm_year/10 + '0'; - buf[(*offset)++] = now_tm->tm_year%10 + '0'; - buf[(*offset)++] = now_tm->tm_mon/10 + '0'; - buf[(*offset)++] = now_tm->tm_mon%10 + '0'; - buf[(*offset)++] = now_tm->tm_mday/10 + '0'; - buf[(*offset)++] = now_tm->tm_mday%10 + '0'; - memset(&buf[*offset], '0', 6); - *offset += 6; - buf[(*offset)++] = 'Z'; - now_tm->tm_year += 30; /* add 30 years */ - memcpy(&buf[*offset], &buf[*offset-15], 15); - buf[*offset + 2] = now_tm->tm_year/10 + '0'; - buf[*offset + 3] = now_tm->tm_year%10 + '0'; - *offset += 15; +static void gen_utc_time(uint8_t *buf, int *offset) +{ + /* fixed time */ + memcpy(&buf[*offset], time_seq, sizeof(time_seq)); + *offset += sizeof(time_seq); } static void gen_pub_key2(const RSA_CTX *rsa_ctx, uint8_t *buf, int *offset) @@ -249,6 +239,7 @@ static void gen_pub_key2(const RSA_CTX *rsa_ctx, uint8_t *buf, int *offset) ASN1_SEQUENCE, &seq_offset, buf, offset); buf[(*offset)++] = ASN1_INTEGER; bi_export(rsa_ctx->bi_ctx, rsa_ctx->m, block, pub_key_size); + if (*block & 0x80) /* make integer positive */ { set_gen_length(pub_key_size+1, buf, offset); @@ -259,6 +250,8 @@ static void gen_pub_key2(const RSA_CTX *rsa_ctx, uint8_t *buf, int *offset) memcpy(&buf[*offset], block, pub_key_size); *offset += pub_key_size; + memcpy(&buf[*offset], pub_key_seq, sizeof(pub_key_seq)); + *offset += sizeof(pub_key_seq); adjust_with_size(seq_size, seq_offset, buf, offset); } @@ -287,8 +280,6 @@ static void gen_pub_key(const RSA_CTX *rsa_ctx, uint8_t *buf, int *offset) buf[(*offset)++] = ASN1_NULL; buf[(*offset)++] = 0; gen_pub_key1(rsa_ctx, buf, offset); - memcpy(&buf[*offset], pub_key_seq, sizeof(pub_key_seq)); - *offset += sizeof(pub_key_seq); adjust_with_size(seq_size, seq_offset, buf, offset); } @@ -313,86 +304,64 @@ static void gen_signature(const RSA_CTX *rsa_ctx, const uint8_t *sha_dgst, *offset += sig_size; } -static int gen_tbs_cert(const char *cn, const char *o, const char *ou, +static int gen_tbs_cert(const char * dn[], const RSA_CTX *rsa_ctx, uint8_t *buf, int *offset, uint8_t *sha_dgst) { int ret = X509_OK; SHA1_CTX sha_ctx; int seq_offset; + int begin_tbs = *offset; int seq_size = pre_adjust_with_size( ASN1_SEQUENCE, &seq_offset, buf, offset); - int begin_tbs = *offset; gen_serial_number(buf, offset); gen_signature_alg(buf, offset); - if ((ret = gen_issuer(cn, o, ou, buf, offset))) + + /* CA certicate issuer */ + if ((ret = gen_issuer(dn, buf, offset))) goto error; gen_utc_time(buf, offset); - if ((ret = gen_issuer(cn, o, ou, buf, offset))) + + /* certificate issuer */ + if ((ret = gen_issuer(dn, buf, offset))) goto error; gen_pub_key(rsa_ctx, buf, offset); + adjust_with_size(seq_size, seq_offset, buf, offset); SHA1_Init(&sha_ctx); SHA1_Update(&sha_ctx, &buf[begin_tbs], *offset-begin_tbs); SHA1_Final(sha_dgst, &sha_ctx); - adjust_with_size(seq_size, seq_offset, buf, offset); error: return ret; } -int gen_cert(const char *cn, const char *o, const char *ou, - const RSA_CTX *rsa_ctx, uint8_t *buf, int *cert_size) +/** + * Create a new certificate. + */ +EXP_FUNC int STDCALL ssl_x509_create(SSL_CTX *ssl_ctx, const char * dn[], uint32_t options, uint8_t **cert_data) { - int ret = X509_OK; - int offset = 0; - int seq_offset; + int ret = X509_OK, offset = 0, seq_offset; + /* allocate enough space to load a new certificate */ + uint8_t *buf = (uint8_t *)alloca(ssl_ctx->rsa_ctx->num_octets*2 + 512); uint8_t sha_dgst[SHA1_SIZE]; - int seq_size = pre_adjust_with_size( - ASN1_SEQUENCE, &seq_offset, buf, &offset); + int seq_size = pre_adjust_with_size(ASN1_SEQUENCE, + &seq_offset, buf, &offset); - if ((ret = gen_tbs_cert(cn, o, ou, rsa_ctx, buf, &offset, sha_dgst))) + if ((ret = gen_tbs_cert(dn, ssl_ctx->rsa_ctx, buf, &offset, sha_dgst)) < 0) goto error; gen_signature_alg(buf, &offset); - gen_signature(rsa_ctx, sha_dgst, buf, &offset); - + gen_signature(ssl_ctx->rsa_ctx, sha_dgst, buf, &offset); adjust_with_size(seq_size, seq_offset, buf, &offset); - *cert_size = offset; -error: - return ret; -} - -int main(int argc, char *argv[]) -{ - int ret = X509_OK; - uint8_t *key_buf = NULL; - RSA_CTX *rsa_ctx = NULL; - uint8_t buf[2048]; - int cert_size; - FILE *f; - - int len = get_file("../ssl/test/axTLS.key_512", &key_buf); - if ((ret = asn1_get_private_key(key_buf, len, &rsa_ctx))) - goto error; + *cert_data = (uint8_t *)malloc(offset); /* create the exact memory for it */ + memcpy(*cert_data, buf, offset); - if ((ret = gen_cert("abc", "def", "ghi", rsa_ctx, buf, &cert_size))) - goto error; - - f = fopen("blah.dat", "w"); - fwrite(buf, cert_size, 1, f); - fclose(f); error: - free(key_buf); - RSA_free(rsa_ctx); - - if (ret) - printf("Some cert generation issue\n"); - - return ret; + return ret < 0 ? ret : offset; } #endif diff --git a/ssl/loader.c b/ssl/loader.c index 909b5b7474..4909d06288 100644 --- a/ssl/loader.c +++ b/ssl/loader.c @@ -69,7 +69,6 @@ EXP_FUNC int STDCALL ssl_obj_load(SSL_CTX *ssl_ctx, int obj_type, } ssl_obj = (SSLObjLoader *)calloc(1, sizeof(SSLObjLoader)); - ssl_obj->len = get_file(filename, &ssl_obj->buf); if (ssl_obj->len <= 0) @@ -107,8 +106,8 @@ EXP_FUNC int STDCALL ssl_obj_memory_load(SSL_CTX *ssl_ctx, int mem_type, const uint8_t *data, int len, const char *password) { int ret; - SSLObjLoader *ssl_obj; + ssl_obj = (SSLObjLoader *)calloc(1, sizeof(SSLObjLoader)); ssl_obj->buf = (uint8_t *)malloc(len); memcpy(ssl_obj->buf, data, len); @@ -219,10 +218,10 @@ static int pem_decrypt(const char *where, const char *end, AES_CTX aes_ctx; uint8_t key[32]; /* AES256 size */ - if (password == NULL) + if (password == NULL || strlen(password) == 0) { #ifdef CONFIG_SSL_FULL_MODE - printf("Error: need a password for this PEM file\n"); + printf("Error: Need a password for this PEM file\n"); TTY_FLUSH(); #endif goto error; } @@ -239,7 +238,7 @@ static int pem_decrypt(const char *where, const char *end, else { #ifdef CONFIG_SSL_FULL_MODE - printf("Error: Unsupported password cipher\n"); + printf("Error: Unsupported password cipher\n"); TTY_FLUSH(); #endif goto error; } @@ -387,3 +386,80 @@ static int ssl_obj_PEM_load(SSL_CTX *ssl_ctx, int obj_type, start, ssl_obj->len, password); } #endif /* CONFIG_SSL_HAS_PEM */ + +/** + * Load the key/certificates in memory depending on compile-time and user + * options. + */ +int load_key_certs(SSL_CTX *ssl_ctx) +{ + int ret = SSL_OK; + uint32_t options = ssl_ctx->options; + + /* do the private key first */ + if (strlen(CONFIG_SSL_PRIVATE_KEY_LOCATION) > 0) + { + if ((ret = ssl_obj_load(ssl_ctx, SSL_OBJ_RSA_KEY, + CONFIG_SSL_PRIVATE_KEY_LOCATION, + CONFIG_SSL_PRIVATE_KEY_PASSWORD)) < 0) + goto error; + } + else if (!(options & SSL_NO_DEFAULT_KEY)) + { +#if defined(CONFIG_SSL_USE_DEFAULT_KEY) || defined(CONFIG_SSL_SKELETON_MODE) + static const /* saves a few more bytes */ +#include "private_key.h" + + ssl_obj_memory_load(ssl_ctx, SSL_OBJ_RSA_KEY, default_private_key, + default_private_key_len, NULL); +#endif + } + + /* now load the certificate */ +#ifdef CONFIG_SSL_GENERATE_X509_CERT + uint8_t *cert_data; + int cert_size; + static const char *dn[] = + { + CONFIG_SSL_X509_COMMON_NAME, + CONFIG_SSL_X509_ORGANIZATION_NAME, + CONFIG_SSL_X509_ORGANIZATION_UNIT_NAME + }; + + if ((cert_size = ssl_x509_create(ssl_ctx, dn, &cert_data)) < 0) + { + ret = cert_size; + goto error; + } + + ssl_obj_memory_load(ssl_ctx, SSL_OBJ_X509_CERT, cert_data, cert_size, NULL); + free(cert_data); +#else + if (strlen(CONFIG_SSL_X509_CERT_LOCATION)) + { + if ((ret = ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CERT, + CONFIG_SSL_X509_CERT_LOCATION, NULL)) < 0) + goto error; + } + else if (!(options & SSL_NO_DEFAULT_KEY)) + { +#if defined(CONFIG_SSL_USE_DEFAULT_KEY) || defined(CONFIG_SSL_SKELETON_MODE) + static const /* saves a few bytes and RAM */ +#include "cert.h" + ssl_obj_memory_load(ssl_ctx, SSL_OBJ_X509_CERT, + default_certificate, default_certificate_len, NULL); +#endif + } +#endif + +error: +#ifdef CONFIG_SSL_FULL_MODE + if (ret) + { + printf("Error: Certificate or key not loaded\n"); TTY_FLUSH(); + } +#endif + + return ret; + +} diff --git a/ssl/ssl.h b/ssl/ssl.h index 5adeecc0d7..103c28b877 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -182,8 +182,6 @@ extern "C" { * - SSL_CLIENT_AUTHENTICATION (server only): Enforce client authentication * i.e. each handshake will include a "certificate request" message from the * server. Only available if verification has been enabled. - * - SSL_NO_DEFAULT_KEY: Don't use the default key/certificate. The user will - * load the key/certificate explicitly. * - SSL_DISPLAY_BYTES (full mode build only): Display the byte sequences * during the handshake. * - SSL_DISPLAY_STATES (full mode build only): Display the state changes @@ -436,9 +434,34 @@ EXP_FUNC int STDCALL ssl_obj_load(SSL_CTX *ssl_ctx, int obj_type, const char *fi */ EXP_FUNC int STDCALL ssl_obj_memory_load(SSL_CTX *ssl_ctx, int obj_type, const uint8_t *data, int len, const char *password); +#ifdef CONFIG_SSL_GENERATE_X509_CERT +/** + * @brief Create an X.509 certificate. + * + * This certificate is a self-signed v1 cert with a fixed start/stop validity + * times. It is also signed with the private key in ssl_ctx->rsa_ctx. + * + * @param ssl_ctx [in] The client/server context. + * @param dn [in] An array of distinguished name strings. The array is defined + * by: + * - SSL_X509_CERT_COMMON_NAME (0) + * - If SSL_X509_CERT_COMMON_NAME is empty or not defined, then the + * hostname will be used. + * - SSL_X509_CERT_ORGANIZATION (1) + * - If SSL_X509_CERT_ORGANIZATION is empty or not defined, then $USERNAME + * will be used. + * - SSL_X509_CERT_ORGANIZATIONAL_NAME (2) + * - SSL_X509_CERT_ORGANIZATIONAL_NAME is optional. + * @param options [in] Not used yet. + * @param cert_data [out] The certificate as a sequence of bytes. + * @return < 0 if an error, or the size of the certificate in bytes. + * @note cert_data must be freed when there is no more need for it. + */ +EXP_FUNC int STDCALL ssl_x509_create(SSL_CTX *ssl_ctx, const char * dn[], uint32_t options, uint8_t **cert_data); +#endif + /** * @brief Return the axTLS library version as a string. - * @note New API function for v1.1 */ EXP_FUNC const char * STDCALL ssl_version(void); diff --git a/ssl/test/Makefile b/ssl/test/Makefile index 7c3b885c1b..42465600f0 100644 --- a/ssl/test/Makefile +++ b/ssl/test/Makefile @@ -64,21 +64,22 @@ AXTLS_SSL_PATH="$(AXTLS_INCLUDE)ssl\\" CRYPTO_OBJ=\ $(CRYPTO_PATH)aes.obj \ + $(CRYPTO_PATH)bigint.obj \ + $(CRYPTO_PATH)crypto_misc.obj \ $(CRYPTO_PATH)hmac.obj \ + $(CRYPTO_PATH)md2.obj \ $(CRYPTO_PATH)md5.obj \ $(CRYPTO_PATH)rc4.obj \ + $(CRYPTO_PATH)rsa.obj \ $(CRYPTO_PATH)sha1.obj OBJ=\ $(AXTLS_SSL_PATH)asn1.obj \ $(AXTLS_SSL_PATH)x509.obj \ - $(AXTLS_SSL_PATH)bigint.obj \ - $(AXTLS_SSL_PATH)crypto_misc.obj \ $(AXTLS_SSL_PATH)os_port.obj \ $(AXTLS_SSL_PATH)loader.obj \ $(AXTLS_SSL_PATH)openssl.obj \ $(AXTLS_SSL_PATH)p12.obj \ - $(AXTLS_SSL_PATH)rsa.obj \ $(AXTLS_SSL_PATH)tls1.obj \ $(AXTLS_SSL_PATH)tls1_svr.obj \ $(AXTLS_SSL_PATH)tls1_clnt.obj diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 9eaf543595..db71fe1304 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -58,6 +58,7 @@ static int g_port = 19001; +#if 0 /************************************************************************** * AES tests * @@ -102,7 +103,7 @@ static int AES_test(BI_CTX *bi_ctx) enc_data, sizeof(enc_data)); if (memcmp(enc_data, ct, sizeof(ct))) { - fprintf(stderr, "Error: AES ENCRYPT #1 failed\n"); + printf("Error: AES ENCRYPT #1 failed\n"); goto end; } @@ -112,7 +113,7 @@ static int AES_test(BI_CTX *bi_ctx) if (memcmp(dec_data, in_str, sizeof(dec_data))) { - fprintf(stderr, "Error: AES DECRYPT #1 failed\n"); + printf("Error: AES DECRYPT #1 failed\n"); goto end; } } @@ -151,7 +152,7 @@ static int AES_test(BI_CTX *bi_ctx) if (memcmp(enc_data, ct, sizeof(ct))) { - fprintf(stderr, "Error: ENCRYPT #2 failed\n"); + printf("Error: ENCRYPT #2 failed\n"); goto end; } @@ -160,7 +161,7 @@ static int AES_test(BI_CTX *bi_ctx) AES_cbc_decrypt(&aes_key, enc_data, dec_data, sizeof(enc_data)); if (memcmp(dec_data, in_data, sizeof(dec_data))) { - fprintf(stderr, "Error: DECRYPT #2 failed\n"); + printf("Error: DECRYPT #2 failed\n"); goto end; } } @@ -232,7 +233,7 @@ static int RC4_test(BI_CTX *bi_ctx) if (memcmp(data[i], output[i], data_len[i])) { - fprintf(stderr, "Error: RC4 CRYPT #%d failed\n", i); + printf("Error: RC4 CRYPT #%d failed\n", i); goto end; } } @@ -268,7 +269,7 @@ static int SHA1_test(BI_CTX *bi_ctx) if (memcmp(digest, ct, sizeof(ct))) { - fprintf(stderr, "Error: SHA1 #1 failed\n"); + printf("Error: SHA1 #1 failed\n"); goto end; } } @@ -286,7 +287,7 @@ static int SHA1_test(BI_CTX *bi_ctx) if (memcmp(digest, ct, sizeof(ct))) { - fprintf(stderr, "Error: SHA1 #2 failed\n"); + printf("Error: SHA1 #2 failed\n"); goto end; } } @@ -322,7 +323,7 @@ static int MD5_test(BI_CTX *bi_ctx) if (memcmp(digest, ct, sizeof(ct))) { - fprintf(stderr, "Error: MD5 #1 failed\n"); + printf("Error: MD5 #1 failed\n"); goto end; } } @@ -340,7 +341,7 @@ static int MD5_test(BI_CTX *bi_ctx) if (memcmp(digest, ct, sizeof(ct))) { - fprintf(stderr, "Error: MD5 #2 failed\n"); + printf("Error: MD5 #2 failed\n"); goto end; } } @@ -481,7 +482,7 @@ static int RSA_test(void) "1aaaaaaaaaabbbbbbbbbbbbbbbccccccccccccccdddddddddddddeeeeeeeeee2" "1aaaaaaaaaabbbbbbbbbbbbbbbccccccccccccccdddddddddddddeeeeeeeee2\012"; uint8_t enc_data[128], dec_data[128]; - RSA_CTX *rsa_ctx; + RSA_CTX *rsa_ctx = NULL; BI_CTX *bi_ctx; bigint *plaintext_bi; bigint *enc_data_bi, *dec_data_bi; @@ -512,7 +513,7 @@ static int RSA_test(void) if (memcmp(dec_data, plaintext, strlen(plaintext))) { - fprintf(stderr, "Error: DECRYPT #1 failed\n"); + printf("Error: DECRYPT #1 failed\n"); goto end; } @@ -520,7 +521,7 @@ static int RSA_test(void) size = RSA_decrypt(rsa_ctx, enc_data2, dec_data2, 1); if (memcmp("abc", dec_data2, 3)) { - fprintf(stderr, "Error: ENCRYPT/DECRYPT #2 failed\n"); + printf("Error: ENCRYPT/DECRYPT #2 failed\n"); goto end; } @@ -642,8 +643,11 @@ static int cert_tests(void) printf("All Certificate tests passed\n"); bad_cert: + if (res) + printf("Error: A certificate test failed\n"); return res; } +#endif /** * init a server socket. @@ -751,7 +755,6 @@ static void do_client(client_t *clnt) } static int SSL_server_test( - SVR_CTX *svr_test_ctx, const char *testname, const char *openssl_option, const char *device_cert, @@ -778,11 +781,6 @@ static int SSL_server_test( if ((server_fd = server_socket_init(&g_port)) < 0) goto error; - if (private_key) - { - axolotls_option |= SSL_NO_DEFAULT_KEY; - } - if ((ssl_ctx = ssl_ctx_new(axolotls_option, SSL_DEFAULT_SVR_SESS)) == NULL) { ret = SSL_ERROR_INVALID_KEY; @@ -883,6 +881,7 @@ static int SSL_server_test( error: ssl_ctx_free(ssl_ctx); +printf("RES %d\n", ret); TTY_FLUSH(); return ret; } @@ -893,21 +892,21 @@ int SSL_server_tests(void) SVR_CTX svr_test_ctx; memset(&svr_test_ctx, 0, sizeof(SVR_CTX)); - printf("### starting server tests\n"); + printf("### starting server tests\n"); TTY_FLUSH(); /* Go through the algorithms */ /* * TLS1 client hello */ - if ((ret = SSL_server_test(NULL, "TLSv1", "-cipher RC4-SHA -tls1", + if ((ret = SSL_server_test("TLSv1", "-cipher RC4-SHA -tls1", NULL, NULL, NULL, NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; /* * AES128-SHA */ - if ((ret = SSL_server_test(NULL, "AES256-SHA", "-cipher AES128-SHA", + if ((ret = SSL_server_test("AES256-SHA", "-cipher AES128-SHA", DEFAULT_CERT, NULL, DEFAULT_KEY, NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; @@ -915,7 +914,7 @@ int SSL_server_tests(void) /* * AES256-SHA */ - if ((ret = SSL_server_test(NULL, "AES256-SHA", "-cipher AES128-SHA", + if ((ret = SSL_server_test("AES256-SHA", "-cipher AES128-SHA", DEFAULT_CERT, NULL, DEFAULT_KEY, NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; @@ -923,7 +922,7 @@ int SSL_server_tests(void) /* * RC4-SHA */ - if ((ret = SSL_server_test(NULL, "RC4-SHA", "-cipher RC4-SHA", + if ((ret = SSL_server_test("RC4-SHA", "-cipher RC4-SHA", DEFAULT_CERT, NULL, DEFAULT_KEY, NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; @@ -931,7 +930,7 @@ int SSL_server_tests(void) /* * RC4-MD5 */ - if ((ret = SSL_server_test(NULL, "RC4-MD5", "-cipher RC4-MD5", + if ((ret = SSL_server_test("RC4-MD5", "-cipher RC4-MD5", DEFAULT_CERT, NULL, DEFAULT_KEY, NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; @@ -940,7 +939,7 @@ int SSL_server_tests(void) * Session Reuse * all the session id's should match for session resumption. */ - if ((ret = SSL_server_test(NULL, "Session Reuse", + if ((ret = SSL_server_test("Session Reuse", "-cipher RC4-SHA -reconnect", DEFAULT_CERT, NULL, DEFAULT_KEY, NULL, NULL, DEFAULT_SVR_OPTION))) @@ -949,7 +948,7 @@ int SSL_server_tests(void) /* * 512 bit RSA key */ - if ((ret = SSL_server_test(NULL, "512 bit key", "-cipher RC4-SHA", + if ((ret = SSL_server_test("512 bit key", "-cipher RC4-SHA", "../ssl/test/axTLS.x509_512.cer", NULL, "../ssl/test/axTLS.key_512", NULL, NULL, DEFAULT_SVR_OPTION))) @@ -958,7 +957,7 @@ int SSL_server_tests(void) /* * 1024 bit RSA key (check certificate chaining) */ - if ((ret = SSL_server_test(NULL, "1024 bit key", + if ((ret = SSL_server_test("1024 bit key", "-cipher RC4-SHA", "../ssl/test/axTLS.x509_device.cer", "../ssl/test/axTLS.x509_512.cer", @@ -969,7 +968,7 @@ int SSL_server_tests(void) /* * 2048 bit RSA key */ - if ((ret = SSL_server_test(NULL, "2048 bit key", + if ((ret = SSL_server_test("2048 bit key", "-cipher RC4-SHA", "../ssl/test/axTLS.x509_2048.cer", NULL, "../ssl/test/axTLS.key_2048", @@ -979,7 +978,7 @@ int SSL_server_tests(void) /* * 4096 bit RSA key */ - if ((ret = SSL_server_test(NULL, "4096 bit key", + if ((ret = SSL_server_test("4096 bit key", "-cipher RC4-SHA", "../ssl/test/axTLS.x509_4096.cer", NULL, "../ssl/test/axTLS.key_4096", @@ -989,7 +988,7 @@ int SSL_server_tests(void) /* * Client Verification */ - if ((ret = SSL_server_test(NULL, "Client Verification", + if ((ret = SSL_server_test("Client Verification", "-cipher RC4-SHA -tls1 " "-cert ../ssl/test/axTLS.x509_2048.pem " "-key ../ssl/test/axTLS.key_2048.pem ", @@ -1001,7 +1000,7 @@ int SSL_server_tests(void) /* this test should fail */ if (stat("../ssl/test/axTLS.x509_bad_before.pem", &stat_buf) >= 0) { - if ((ret = SSL_server_test(NULL, "Bad Before Cert", + if ((ret = SSL_server_test("Bad Before Cert", "-cipher RC4-SHA -tls1 " "-cert ../ssl/test/axTLS.x509_bad_before.pem " "-key ../ssl/test/axTLS.key_512.pem ", @@ -1017,7 +1016,7 @@ int SSL_server_tests(void) } /* this test should fail */ - if ((ret = SSL_server_test(NULL, "Bad After Cert", + if ((ret = SSL_server_test("Bad After Cert", "-cipher RC4-SHA -tls1 " "-cert ../ssl/test/axTLS.x509_bad_after.pem " "-key ../ssl/test/axTLS.key_512.pem ", @@ -1033,7 +1032,7 @@ int SSL_server_tests(void) /* * Key in PEM format */ - if ((ret = SSL_server_test(NULL, "Key in PEM format", + if ((ret = SSL_server_test("Key in PEM format", "-cipher RC4-SHA", "../ssl/test/axTLS.x509_512.cer", NULL, "../ssl/test/axTLS.key_512.pem", NULL, @@ -1043,7 +1042,7 @@ int SSL_server_tests(void) /* * Cert in PEM format */ - if ((ret = SSL_server_test(NULL, "Cert in PEM format", + if ((ret = SSL_server_test("Cert in PEM format", "-cipher RC4-SHA", "../ssl/test/axTLS.x509_512.pem", NULL, "../ssl/test/axTLS.key_512.pem", NULL, @@ -1053,7 +1052,7 @@ int SSL_server_tests(void) /* * Cert chain in PEM format */ - if ((ret = SSL_server_test(NULL, "Cert chain in PEM format", + if ((ret = SSL_server_test("Cert chain in PEM format", "-cipher RC4-SHA", "../ssl/test/axTLS.x509_device.pem", NULL, "../ssl/test/axTLS.device_key.pem", @@ -1063,7 +1062,7 @@ int SSL_server_tests(void) /* * AES128 Encrypted key */ - if ((ret = SSL_server_test(NULL, "AES128 encrypted key", + if ((ret = SSL_server_test("AES128 encrypted key", "-cipher RC4-SHA", "../ssl/test/axTLS.x509_aes128.pem", NULL, "../ssl/test/axTLS.key_aes128.pem", @@ -1073,7 +1072,7 @@ int SSL_server_tests(void) /* * AES256 Encrypted key */ - if ((ret = SSL_server_test(NULL, "AES256 encrypted key", + if ((ret = SSL_server_test("AES256 encrypted key", "-cipher RC4-SHA", "../ssl/test/axTLS.x509_aes256.pem", NULL, "../ssl/test/axTLS.key_aes256.pem", @@ -1083,7 +1082,7 @@ int SSL_server_tests(void) /* * AES128 Encrypted invalid key */ - if ((ret = SSL_server_test(NULL, "AES128 encrypted invalid key", + if ((ret = SSL_server_test("AES128 encrypted invalid key", "-cipher RC4-SHA", "../ssl/test/axTLS.x509_aes128.pem", NULL, "../ssl/test/axTLS.key_aes128.pem", @@ -1096,7 +1095,7 @@ int SSL_server_tests(void) /* * PKCS#8 key (encrypted) */ - if ((ret = SSL_server_test(NULL, "pkcs#8 encrypted", "-cipher RC4-SHA", + if ((ret = SSL_server_test("pkcs#8 encrypted", "-cipher RC4-SHA", DEFAULT_CERT, NULL, "../ssl/test/axTLS.encrypted.p8", NULL, "abcd", DEFAULT_SVR_OPTION))) goto cleanup; @@ -1104,7 +1103,7 @@ int SSL_server_tests(void) /* * PKCS#8 key (unencrypted) */ - if ((ret = SSL_server_test(NULL, "pkcs#8 unencrypted", "-cipher RC4-SHA", + if ((ret = SSL_server_test("pkcs#8 unencrypted", "-cipher RC4-SHA", DEFAULT_CERT, NULL, "../ssl/test/axTLS.unencrypted.p8", NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; @@ -1112,12 +1111,12 @@ int SSL_server_tests(void) /* * PKCS#12 key/certificate */ - if ((ret = SSL_server_test(NULL, "pkcs#12 with CA", "-cipher RC4-SHA", + if ((ret = SSL_server_test("pkcs#12 with CA", "-cipher RC4-SHA", NULL, NULL, "../ssl/test/axTLS.withCA.p12", NULL, "abcd", DEFAULT_SVR_OPTION))) goto cleanup; - if ((ret = SSL_server_test(NULL, "pkcs#12 no CA", "-cipher RC4-SHA", + if ((ret = SSL_server_test("pkcs#12 no CA", "-cipher RC4-SHA", DEFAULT_CERT, NULL, "../ssl/test/axTLS.withoutCA.p12", NULL, "abcd", DEFAULT_SVR_OPTION))) goto cleanup; @@ -1126,7 +1125,11 @@ int SSL_server_tests(void) cleanup: if (ret) - fprintf(stderr, "Error: A server test failed\n"); + { + printf("Error: A server test failed\n"); TTY_FLUSH(); + exit(1); + } + return ret; } @@ -1200,11 +1203,6 @@ static int SSL_client_test( if (*ssl_ctx == NULL) { - if (private_key) - { - client_options |= SSL_NO_DEFAULT_KEY; - } - if ((*ssl_ctx = ssl_ctx_new( client_options, SSL_DEFAULT_CLNT_SESS)) == NULL) { @@ -1453,7 +1451,7 @@ int SSL_client_tests(void) cleanup: if (ret) - fprintf(stderr, "Error: A client test failed\n"); + printf("Error: A client test failed\n"); return ret; } @@ -1462,6 +1460,7 @@ int SSL_client_tests(void) * SSL Basic Testing (test a big packet handshake) * **************************************************************************/ +#if 0 static uint8_t basic_buf[256*1024]; static void do_basic(void) @@ -1572,6 +1571,7 @@ static int SSL_basic_test(void) ssl_ctx_free(ssl_svr_ctx); return ret; } +#endif #if !defined(WIN32) && defined(CONFIG_SSL_CTX_MUTEXING) /************************************************************************** @@ -1792,7 +1792,7 @@ static int header_issue(void) int main(int argc, char *argv[]) { int ret = 1; - BI_CTX *bi_ctx; + //BI_CTX *bi_ctx; int fd; #ifdef WIN32 @@ -1807,6 +1807,7 @@ int main(int argc, char *argv[]) dup2(fd, 2); #endif +#if 0 bi_ctx = bi_initialize(); if (AES_test(bi_ctx)) @@ -1881,6 +1882,7 @@ int main(int argc, char *argv[]) goto cleanup; system("sh ../ssl/test/killopenssl.sh"); +#endif if (SSL_server_tests()) goto cleanup; @@ -1898,9 +1900,7 @@ int main(int argc, char *argv[]) cleanup: if (ret) - { - fprintf(stderr, "Error: Some tests failed!\n"); - } + printf("Error: Some tests failed!\n"); close(fd); return ret; diff --git a/ssl/tls1.c b/ssl/tls1.c index 6dc67bd133..cd01cbdff4 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -38,14 +38,6 @@ #include #include "ssl.h" -/* Don't import the default key/certificate if not used */ -#if defined(CONFIG_SSL_USE_DEFAULT_KEY) || defined(CONFIG_SSL_SKELETON_MODE) -static const /* saves a few bytes and RAM */ -#include "cert.h" -static const /* saves a few more bytes */ -#include "private_key.h" -#endif - /* The session expiry time */ #define SSL_EXPIRY_TIME (CONFIG_SSL_EXPIRY_TIME*3600) @@ -173,22 +165,19 @@ EXP_FUNC SSL_CTX *STDCALL ssl_ctx_new(uint32_t options, int num_sessions) { SSL_CTX *ssl_ctx = (SSL_CTX *)calloc(1, sizeof (SSL_CTX)); ssl_ctx->options = options; + + if (load_key_certs(ssl_ctx) < 0) + { + free(ssl_ctx); /* can't load our key/certificate pair, so die */ + return NULL; + } + #ifndef CONFIG_SSL_SKELETON_MODE ssl_ctx->num_sessions = num_sessions; #endif SSL_CTX_MUTEX_INIT(ssl_ctx->mutex); -#if defined(CONFIG_SSL_USE_DEFAULT_KEY) || defined(CONFIG_SSL_SKELETON_MODE) - if (~options & SSL_NO_DEFAULT_KEY) - { - ssl_obj_memory_load(ssl_ctx, SSL_OBJ_RSA_KEY, default_private_key, - default_private_key_len, NULL); - ssl_obj_memory_load(ssl_ctx, SSL_OBJ_X509_CERT, - default_certificate, default_certificate_len, NULL); - } -#endif - #ifndef CONFIG_SSL_SKELETON_MODE if (num_sessions) { @@ -197,10 +186,6 @@ EXP_FUNC SSL_CTX *STDCALL ssl_ctx_new(uint32_t options, int num_sessions) } #endif -#ifdef CONFIG_SSL_CERT_VERIFICATION - ssl_ctx->ca_cert_ctx = (CA_CERT_CTX *)calloc(1, sizeof(CA_CERT_CTX)); -#endif - return ssl_ctx; } @@ -397,7 +382,12 @@ int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) int i = 0; int offset; X509_CTX *cert = NULL; - CA_CERT_CTX *ca_cert_ctx = ssl_ctx->ca_cert_ctx; + CA_CERT_CTX *ca_cert_ctx; + + if (ssl_ctx->ca_cert_ctx == NULL) + ssl_ctx->ca_cert_ctx = (CA_CERT_CTX *)calloc(1, sizeof(CA_CERT_CTX)); + + ca_cert_ctx = ssl_ctx->ca_cert_ctx; while (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) i++; @@ -418,11 +408,14 @@ int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) cert = ca_cert_ctx->cert[i]; SSL_CTX_LOCK(ssl_ctx->mutex); - if ((ret = x509_verify(ca_cert_ctx, cert))) + if ((ret = x509_verify(ca_cert_ctx, cert)) != X509_VFY_ERROR_SELF_SIGNED) { SSL_CTX_UNLOCK(ssl_ctx->mutex); x509_free(cert); /* get rid of it */ ca_cert_ctx->cert[i] = NULL; +#ifdef CONFIG_SSL_FULL_MODE + printf("Error: %s\n", x509_display_error(ret)); +#endif goto error; } @@ -1484,6 +1477,7 @@ int send_certificate(SSL *ssl) while (i < ssl->ssl_ctx->chain_length) { + X509_CTX *cert_ctx; SSL_CERT *cert = &ssl->ssl_ctx->certs[i]; buf[offset++] = 0; buf[offset++] = cert->size >> 8; /* cert 1 length */ @@ -1491,6 +1485,10 @@ int send_certificate(SSL *ssl) memcpy(&buf[offset], cert->buf, cert->size); offset += cert->size; i++; + // TODO: get rid of these + x509_new(cert->buf, &cert->size, &cert_ctx); + x509_print(cert_ctx, NULL); + x509_free(cert_ctx); } chain_length = offset - 7; @@ -1765,7 +1763,7 @@ int process_certificate(SSL *ssl, X509_CTX **x509_ctx) ret = ssl_verify_cert(ssl); } - DISPLAY_CERT(ssl, "process_certificate", *x509_ctx); + DISPLAY_CERT(ssl, *x509_ctx); ssl->next_state = is_client ? HS_SERVER_HELLO_DONE : HS_CLIENT_KEY_XCHG; ssl->dc->bm_proc_index += offset; error: @@ -1846,19 +1844,19 @@ void DISPLAY_STATE(SSL *ssl, int is_send, uint8_t state, int not_ok) /** * Debugging routine to display X509 certificates. */ -void DISPLAY_CERT(SSL *ssl, const char *label, const X509_CTX *x509_ctx) +void DISPLAY_CERT(SSL *ssl, const X509_CTX *x509_ctx) { if (!IS_SET_SSL_FLAG(SSL_DISPLAY_CERTS)) return; - x509_print(ssl->ssl_ctx->ca_cert_ctx, x509_ctx); + x509_print(x509_ctx, ssl->ssl_ctx->ca_cert_ctx); TTY_FLUSH(); } /** * Debugging routine to display RSA objects */ -void DISPLAY_RSA(SSL *ssl, const char *label, const RSA_CTX *rsa_ctx) +void DISPLAY_RSA(SSL *ssl, const RSA_CTX *rsa_ctx) { if (!IS_SET_SSL_FLAG(SSL_DISPLAY_RSA)) return; @@ -1897,8 +1895,7 @@ EXP_FUNC void STDCALL ssl_display_error(int error_code) /* X509 error? */ if (error_code < SSL_X509_OFFSET) { - x509_display_error(error_code - SSL_X509_OFFSET); - printf("\n"); + printf("%s\n", x509_display_error(error_code - SSL_X509_OFFSET)); return; } diff --git a/ssl/tls1.h b/ssl/tls1.h index 4280cb2ac4..af4dc115b6 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -172,7 +172,7 @@ struct _SSL uint16_t bm_read_index; struct _SSL *next; /* doubly linked list */ struct _SSL *prev; - struct _SSL_CTX *ssl_ctx; /* back reference to a clnt/svr ctx */ + struct _SSL_CTX *ssl_ctx; /* back reference to a clnt/svr ctx */ #ifndef CONFIG_SSL_SKELETON_MODE uint16_t session_index; SSL_SESS *session; @@ -243,6 +243,7 @@ int add_private_key(SSL_CTX *ssl_ctx, SSLObjLoader *ssl_obj); void ssl_obj_free(SSLObjLoader *ssl_obj); int pkcs8_decode(SSL_CTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password); int pkcs12_decode(SSL_CTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password); +int load_key_certs(SSL_CTX *ssl_ctx); #ifdef CONFIG_SSL_CERT_VERIFICATION int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len); void remove_ca_certs(CA_CERT_CTX *ca_cert_ctx); @@ -255,8 +256,8 @@ int do_client_connect(SSL *ssl); void DISPLAY_STATE(SSL *ssl, int is_send, uint8_t state, int not_ok); void DISPLAY_BYTES(SSL *ssl, const char *format, const uint8_t *data, int size, ...); -void DISPLAY_CERT(SSL *ssl, const char *label, const X509_CTX *x509_ctx); -void DISPLAY_RSA(SSL *ssl, const char *label, const RSA_CTX *rsa_ctx); +void DISPLAY_CERT(SSL *ssl, const X509_CTX *x509_ctx); +void DISPLAY_RSA(SSL *ssl, const RSA_CTX *rsa_ctx); void DISPLAY_ALERT(SSL *ssl, int alert); #else #define DISPLAY_STATE(A,B,C,D) diff --git a/ssl/x509.c b/ssl/x509.c index 81617066ef..a51ed1bb53 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -118,7 +118,7 @@ int x509_new(const uint8_t *cert, int *len, X509_CTX **ctx) bi_ctx = x509_ctx->rsa_ctx->bi_ctx; #ifdef CONFIG_SSL_CERT_VERIFICATION /* only care if doing verification */ - /* use the appropriate signature algorithm (either SHA1 or MD5) */ + /* use the appropriate signature algorithm (SHA1/MD5/MD2) */ if (x509_ctx->sig_type == SIG_TYPE_MD5) { MD5_CTX md5_ctx; @@ -224,7 +224,6 @@ static bigint *sig_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, decrypted_bi = bi_mod_power2(ctx, dat_bi, modulus, pub_exp); bi_export(ctx, decrypted_bi, block, sig_len); - print_blob("SIGNATURE", block, sig_len); ctx->mod_offset = BIGINT_M_OFFSET; i = 10; /* start at the first possible non-padded byte */ @@ -234,9 +233,6 @@ static bigint *sig_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, /* get only the bit we want */ if (size > 0) { - FILE *f = fopen("blah.dat", "w"); - fwrite(&block[i], sig_len-i, 1, f); - fclose(f); int len; const uint8_t *sig_ptr = get_signature(&block[i], &len); @@ -271,6 +267,7 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) bigint *mod, *expn; struct timeval tv; int match_ca_cert = 0; + uint8_t is_self_signed = 0; if (cert == NULL || ca_cert_ctx == NULL) { @@ -279,7 +276,7 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) } /* last cert in the chain - look for a trusted cert */ - if (cert->next == NULL) + if (cert->next == NULL && ca_cert_ctx) { while (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) { @@ -287,17 +284,15 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) ca_cert_ctx->cert[i]->cert_dn) == 0) { match_ca_cert = 1; + next_cert = ca_cert_ctx->cert[i]; break; } i++; } - if (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) - { - next_cert = ca_cert_ctx->cert[i]; - } - else /* trusted cert not found */ + /* trusted cert not found */ + if (i >= CONFIG_X509_MAX_CA_CERTS) { ret = X509_VFY_ERROR_NO_TRUSTED_CERT; goto end_verify; @@ -325,31 +320,37 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) } /* check the chain integrity */ - if (asn1_compare_dn(cert->ca_cert_dn, next_cert->cert_dn)) + if (next_cert && !match_ca_cert && + asn1_compare_dn(cert->ca_cert_dn, next_cert->cert_dn) == 0) { ret = X509_VFY_ERROR_INVALID_CHAIN; goto end_verify; } + ctx = cert->rsa_ctx->bi_ctx; + /* check for self-signing */ - if (!match_ca_cert && asn1_compare_dn(cert->ca_cert_dn, cert->cert_dn) == 0) + if (asn1_compare_dn(cert->ca_cert_dn, cert->cert_dn) == 0) { - ret = X509_VFY_ERROR_SELF_SIGNED; - goto end_verify; + is_self_signed = 1; + mod = cert->rsa_ctx->m; + expn = cert->rsa_ctx->e; + } + else + { + mod = next_cert->rsa_ctx->m; + expn = next_cert->rsa_ctx->e; } /* check the signature */ - ctx = cert->rsa_ctx->bi_ctx; - mod = next_cert->rsa_ctx->m; - expn = next_cert->rsa_ctx->e; cert_sig = sig_verify(ctx, cert->signature, cert->sig_len, bi_clone(ctx, mod), bi_clone(ctx, expn)); - if (cert_sig) + if (cert_sig && cert->digest) { - ret = cert->digest ? /* check the signature */ - bi_compare(cert_sig, cert->digest) : - X509_VFY_ERROR_UNSUPPORTED_DIGEST; + if (bi_compare(cert_sig, cert->digest)) + ret = X509_VFY_ERROR_BAD_SIGNATURE; + bi_free(ctx, cert_sig); if (ret) @@ -361,6 +362,12 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) goto end_verify; } + if (is_self_signed) + { + ret = X509_VFY_ERROR_SELF_SIGNED; + goto end_verify; + } + /* go down the certificate chain using recursion. */ if (ret == 0 && cert->next) { @@ -376,7 +383,7 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) /** * Used for diagnostics. */ -void x509_print(CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) +void x509_print(const X509_CTX *cert, CA_CERT_CTX *ca_cert_ctx) { if (cert == NULL) return; @@ -436,14 +443,12 @@ void x509_print(CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) break; } - printf("Verify:\t\t\t"); - if (ca_cert_ctx) { - x509_display_error(x509_verify(ca_cert_ctx, cert)); + printf("Verify:\t\t\t%s\n", + x509_display_error(x509_verify(ca_cert_ctx, cert))); } - printf("\n"); #if 0 print_blob("Signature", cert->signature, cert->sig_len); bi_print("Modulus", cert->rsa_ctx->m); @@ -452,48 +457,52 @@ void x509_print(CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) if (ca_cert_ctx) { - x509_print(ca_cert_ctx, cert->next); + x509_print(cert->next, ca_cert_ctx); } } -void x509_display_error(int error) +const char * x509_display_error(int error) { switch (error) { case X509_NOT_OK: - printf("X509 not ok"); + return "X509 not ok"; break; case X509_VFY_ERROR_NO_TRUSTED_CERT: - printf("No trusted cert is available"); + return "No trusted cert is available"; break; case X509_VFY_ERROR_BAD_SIGNATURE: - printf("Bad signature"); + return "Bad signature"; break; case X509_VFY_ERROR_NOT_YET_VALID: - printf("Cert is not yet valid"); + return "Cert is not yet valid"; break; case X509_VFY_ERROR_EXPIRED: - printf("Cert has expired"); + return "Cert has expired"; break; case X509_VFY_ERROR_SELF_SIGNED: - printf("Cert is self-signed"); + return "Cert is self-signed"; break; case X509_VFY_ERROR_INVALID_CHAIN: - printf("Chain is invalid (check order of certs)"); + return "Chain is invalid (check order of certs)"; break; case X509_VFY_ERROR_UNSUPPORTED_DIGEST: - printf("Unsupported digest"); + return "Unsupported digest"; break; case X509_INVALID_PRIV_KEY: - printf("Invalid private key"); + return "Invalid private key"; + break; + + default: + return "Unknown"; break; } } diff --git a/www/index.html b/www/index.html index 75fe4731b0..707b1af734 100755 --- a/www/index.html +++ b/www/index.html @@ -7086,7 +7086,7 @@
    changes, notes and errata
    -
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8 (yet to be released)@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* vfork() is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Certificates can now be automatically generated (the keys still need to be provided).\n* Certificate/keys can be loaded automatically given a file location.\n* ~SSL_NO_DEFAULT_KEY has been removed (it is now largely redundant).\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* vfork() is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2007, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 785380660e616d25b7ebb52fd4490f95c85aa2b6 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 2 Dec 2007 08:01:12 +0000 Subject: [PATCH 121/301] finishing touches to cert generation git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@144 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 1 + config/axhttpd.aip | 18 ++-- config/linuxconfig | 9 ++ config/win32config | 237 +++++++++++++++++++++++---------------------- crypto/crypto.h | 2 +- httpd/axhttp.h | 1 - ssl/Config.in | 20 ++-- ssl/asn1.c | 2 +- ssl/cert.h | 86 ++++++++-------- ssl/gen_cert.c | 10 +- ssl/loader.c | 21 ++-- ssl/os_port.h | 2 +- ssl/private_key.h | 108 ++++++++++----------- ssl/ssl.h | 6 +- ssl/test/Makefile | 5 +- ssl/test/ssltest.c | 50 +++++++--- ssl/tls1.c | 7 +- ssl/tls1.h | 5 +- ssl/tls1_clnt.c | 4 +- ssl/tls1_svr.c | 4 +- ssl/x509.c | 50 +++++----- www/index.html | 4 +- 22 files changed, 347 insertions(+), 305 deletions(-) diff --git a/Makefile b/Makefile index f6948de35f..02c33d2482 100644 --- a/Makefile +++ b/Makefile @@ -82,6 +82,7 @@ docs: # build the Win32 demo release version win32_demo: + @echo "#define AXTLS_VERSION \"$(VERSION)\"" > ssl/version.h $(MAKE) win32releaseconf install: $(PREFIX) all diff --git a/config/axhttpd.aip b/config/axhttpd.aip index 5d1a2254f8..412fe3b4d1 100755 --- a/config/axhttpd.aip +++ b/config/axhttpd.aip @@ -1,5 +1,5 @@ - + @@ -8,10 +8,10 @@ - + - + @@ -51,8 +51,8 @@ - - + + @@ -69,7 +69,7 @@ - + @@ -105,15 +105,15 @@ - - + + - + diff --git a/config/linuxconfig b/config/linuxconfig index 949ac051b6..9068c5b0b6 100644 --- a/config/linuxconfig +++ b/config/linuxconfig @@ -12,6 +12,7 @@ CONFIG_PLATFORM_LINUX=y # PREFIX="/usr/local" # CONFIG_DEBUG is not set +CONFIG_STRIP_UNWANTED_SECTIONS=y # CONFIG_VISUAL_STUDIO_7_0 is not set # CONFIG_VISUAL_STUDIO_8_0 is not set CONFIG_VISUAL_STUDIO_7_0_BASE="" @@ -31,6 +32,13 @@ CONFIG_SSL_FULL_MODE=y CONFIG_SSL_PROT_MEDIUM=y # CONFIG_SSL_PROT_HIGH is not set CONFIG_SSL_USE_DEFAULT_KEY=y +CONFIG_SSL_PRIVATE_KEY_LOCATION="" +CONFIG_SSL_PRIVATE_KEY_PASSWORD="" +CONFIG_SSL_X509_CERT_LOCATION="" +CONFIG_SSL_GENERATE_X509_CERT=y +CONFIG_SSL_X509_COMMON_NAME="" +CONFIG_SSL_X509_ORGANIZATION_NAME="" +CONFIG_SSL_X509_ORGANIZATION_UNIT_NAME="" CONFIG_SSL_ENABLE_V23_HANDSHAKE=y CONFIG_SSL_HAS_PEM=y CONFIG_SSL_USE_PKCS12=y @@ -62,6 +70,7 @@ CONFIG_HTTP_HAS_CGI=y CONFIG_HTTP_CGI_EXTENSIONS=".lua,.lp" CONFIG_HTTP_ENABLE_LUA=y CONFIG_HTTP_LUA_PREFIX="/usr/local" +CONFIG_HTTP_LUA_CGI_LAUNCHER="/bin/cgi" # CONFIG_HTTP_BUILD_LUA is not set CONFIG_HTTP_DIRECTORIES=y CONFIG_HTTP_HAS_AUTHORIZATION=y diff --git a/config/win32config b/config/win32config index 8640ea0f7e..cfff8094ac 100644 --- a/config/win32config +++ b/config/win32config @@ -1,117 +1,120 @@ -# -# Automatically generated make config: don't edit -# -HAVE_DOT_CONFIG=y -# CONFIG_PLATFORM_LINUX is not set -# CONFIG_PLATFORM_CYGWIN is not set -# CONFIG_PLATFORM_SOLARIS is not set -CONFIG_PLATFORM_WIN32=y - -# -# General Configuration -# -PREFIX="" -# CONFIG_DEBUG is not set -# CONFIG_STRIP_UNWANTED_SECTIONS is not set - -# -# Microsoft Compiler Options -# -# CONFIG_VISUAL_STUDIO_7_0 is not set -CONFIG_VISUAL_STUDIO_8_0=y -CONFIG_VISUAL_STUDIO_7_0_BASE="" -CONFIG_VISUAL_STUDIO_8_0_BASE="c:\\Program Files\\Microsoft Visual Studio 8" -CONFIG_EXTRA_CFLAGS_OPTIONS="" -CONFIG_EXTRA_LDFLAGS_OPTIONS="" - -# -# SSL Library -# -# CONFIG_SSL_SERVER_ONLY is not set -# CONFIG_SSL_CERT_VERIFICATION is not set -# CONFIG_SSL_ENABLE_CLIENT is not set -CONFIG_SSL_FULL_MODE=y -# CONFIG_SSL_SKELETON_MODE is not set -# CONFIG_SSL_PROT_LOW is not set -CONFIG_SSL_PROT_MEDIUM=y -# CONFIG_SSL_PROT_HIGH is not set -CONFIG_SSL_USE_DEFAULT_KEY=y -CONFIG_SSL_ENABLE_V23_HANDSHAKE=y -CONFIG_SSL_HAS_PEM=y -CONFIG_SSL_USE_PKCS12=y -CONFIG_SSL_EXPIRY_TIME=24 -CONFIG_X509_MAX_CA_CERTS=4 -CONFIG_SSL_MAX_CERTS=2 -# CONFIG_SSL_CTX_MUTEXING is not set -# CONFIG_USE_DEV_URANDOM is not set -CONFIG_WIN32_USE_CRYPTO_LIB=y -# CONFIG_OPENSSL_COMPATIBLE is not set -# CONFIG_PERFORMANCE_TESTING is not set -# CONFIG_SSL_TEST is not set -CONFIG_AXHTTPD=y - -# -# Axhttpd Configuration -# -# CONFIG_HTTP_STATIC_BUILD is not set -CONFIG_HTTP_PORT=80 -CONFIG_HTTP_HTTPS_PORT=443 -CONFIG_HTTP_SESSION_CACHE_SIZE=5 -CONFIG_HTTP_WEBROOT="www" -CONFIG_HTTP_TIMEOUT=300 - -# -# CGI -# -# CONFIG_HTTP_HAS_CGI is not set -CONFIG_HTTP_CGI_EXTENSIONS="" -# CONFIG_HTTP_ENABLE_LUA is not set -CONFIG_HTTP_LUA_PREFIX="" -CONFIG_HTTP_LUA_CGI_LAUNCHER="" -# CONFIG_HTTP_BUILD_LUA is not set -CONFIG_HTTP_DIRECTORIES=y -CONFIG_HTTP_HAS_AUTHORIZATION=y -# CONFIG_HTTP_CHANGE_UID is not set -# CONFIG_HTTP_HAS_IPV6 is not set -CONFIG_HTTP_VERBOSE=y -# CONFIG_HTTP_IS_DAEMON is not set - -# -# Language Bindings -# -# CONFIG_BINDINGS is not set -# CONFIG_CSHARP_BINDINGS is not set -# CONFIG_VBNET_BINDINGS is not set -CONFIG_DOT_NET_FRAMEWORK_BASE="" -# CONFIG_JAVA_BINDINGS is not set -CONFIG_JAVA_HOME="" -# CONFIG_PERL_BINDINGS is not set -CONFIG_PERL_CORE="" -CONFIG_PERL_LIB="" -# CONFIG_LUA_BINDINGS is not set -CONFIG_LUA_CORE="" - -# -# Samples -# -CONFIG_SAMPLES=y -CONFIG_C_SAMPLES=y -# CONFIG_CSHARP_SAMPLES is not set -# CONFIG_VBNET_SAMPLES is not set -# CONFIG_JAVA_SAMPLES is not set -# CONFIG_PERL_SAMPLES is not set -# CONFIG_LUA_SAMPLES is not set - -# -# BigInt Options -# -# CONFIG_BIGINT_CLASSICAL is not set -# CONFIG_BIGINT_MONTGOMERY is not set -CONFIG_BIGINT_BARRETT=y -CONFIG_BIGINT_CRT=y -# CONFIG_BIGINT_KARATSUBA is not set -MUL_KARATSUBA_THRESH=0 -SQU_KARATSUBA_THRESH=0 -CONFIG_BIGINT_SLIDING_WINDOW=y -CONFIG_BIGINT_SQUARE=y -# CONFIG_BIGINT_CHECK_ON is not set +# +# Automatically generated make config: don't edit +# +HAVE_DOT_CONFIG=y +# CONFIG_PLATFORM_LINUX is not set +# CONFIG_PLATFORM_CYGWIN is not set +# CONFIG_PLATFORM_SOLARIS is not set +CONFIG_PLATFORM_WIN32=y + +# +# General Configuration +# +PREFIX="" +# CONFIG_DEBUG is not set +# CONFIG_STRIP_UNWANTED_SECTIONS is not set + +# +# Microsoft Compiler Options +# +# CONFIG_VISUAL_STUDIO_7_0 is not set +CONFIG_VISUAL_STUDIO_8_0=y +CONFIG_VISUAL_STUDIO_7_0_BASE="" +CONFIG_VISUAL_STUDIO_8_0_BASE="c:\\Program Files\\Microsoft Visual Studio 8" +CONFIG_EXTRA_CFLAGS_OPTIONS="" +CONFIG_EXTRA_LDFLAGS_OPTIONS="" + +# +# SSL Library +# +# CONFIG_SSL_SERVER_ONLY is not set +# CONFIG_SSL_CERT_VERIFICATION is not set +# CONFIG_SSL_ENABLE_CLIENT is not set +CONFIG_SSL_FULL_MODE=y +# CONFIG_SSL_SKELETON_MODE is not set +# CONFIG_SSL_PROT_LOW is not set +CONFIG_SSL_PROT_MEDIUM=y +# CONFIG_SSL_PROT_HIGH is not set +CONFIG_SSL_USE_DEFAULT_KEY=y +CONFIG_SSL_PRIVATE_KEY_LOCATION="" +CONFIG_SSL_PRIVATE_KEY_PASSWORD="" +CONFIG_SSL_X509_CERT_LOCATION="" +CONFIG_SSL_GENERATE_X509_CERT=y +CONFIG_SSL_X509_COMMON_NAME="" +CONFIG_SSL_X509_ORGANIZATION_NAME="" +CONFIG_SSL_X509_ORGANIZATION_UNIT_NAME="" +CONFIG_SSL_ENABLE_V23_HANDSHAKE=y +CONFIG_SSL_HAS_PEM=y +CONFIG_SSL_USE_PKCS12=y +CONFIG_SSL_EXPIRY_TIME=24 +CONFIG_X509_MAX_CA_CERTS=4 +CONFIG_SSL_MAX_CERTS=2 +# CONFIG_SSL_CTX_MUTEXING is not set +# CONFIG_USE_DEV_URANDOM is not set +CONFIG_WIN32_USE_CRYPTO_LIB=y +# CONFIG_OPENSSL_COMPATIBLE is not set +# CONFIG_PERFORMANCE_TESTING is not set +# CONFIG_SSL_TEST is not set +CONFIG_AXHTTPD=y + +# +# Axhttpd Configuration +# +# CONFIG_HTTP_STATIC_BUILD is not set +CONFIG_HTTP_PORT=80 +CONFIG_HTTP_HTTPS_PORT=443 +CONFIG_HTTP_SESSION_CACHE_SIZE=5 +CONFIG_HTTP_WEBROOT="www" +CONFIG_HTTP_TIMEOUT=300 +# CONFIG_HTTP_HAS_CGI is not set +CONFIG_HTTP_CGI_EXTENSIONS="" +# CONFIG_HTTP_ENABLE_LUA is not set +CONFIG_HTTP_LUA_PREFIX="" +CONFIG_HTTP_LUA_CGI_LAUNCHER="" +# CONFIG_HTTP_BUILD_LUA is not set +CONFIG_HTTP_DIRECTORIES=y +CONFIG_HTTP_HAS_AUTHORIZATION=y +# CONFIG_HTTP_CHANGE_UID is not set +# CONFIG_HTTP_HAS_IPV6 is not set +CONFIG_HTTP_VERBOSE=y +# CONFIG_HTTP_IS_DAEMON is not set + +# +# Language Bindings +# +# CONFIG_BINDINGS is not set +# CONFIG_CSHARP_BINDINGS is not set +# CONFIG_VBNET_BINDINGS is not set +CONFIG_DOT_NET_FRAMEWORK_BASE="" +# CONFIG_JAVA_BINDINGS is not set +CONFIG_JAVA_HOME="" +# CONFIG_PERL_BINDINGS is not set +CONFIG_PERL_CORE="" +CONFIG_PERL_LIB="" +# CONFIG_LUA_BINDINGS is not set +CONFIG_LUA_CORE="" + +# +# Samples +# +CONFIG_SAMPLES=y +CONFIG_C_SAMPLES=y +# CONFIG_CSHARP_SAMPLES is not set +# CONFIG_VBNET_SAMPLES is not set +# CONFIG_JAVA_SAMPLES is not set +# CONFIG_PERL_SAMPLES is not set +# CONFIG_LUA_SAMPLES is not set + +# +# BigInt Options +# +# CONFIG_BIGINT_CLASSICAL is not set +# CONFIG_BIGINT_MONTGOMERY is not set +CONFIG_BIGINT_BARRETT=y +CONFIG_BIGINT_CRT=y +# CONFIG_BIGINT_KARATSUBA is not set +MUL_KARATSUBA_THRESH=0 +SQU_KARATSUBA_THRESH=0 +CONFIG_BIGINT_SLIDING_WINDOW=y +CONFIG_BIGINT_SQUARE=y +# CONFIG_BIGINT_CHECK_ON is not set diff --git a/crypto/crypto.h b/crypto/crypto.h index a4e6086580..5c95f21596 100644 --- a/crypto/crypto.h +++ b/crypto/crypto.h @@ -198,7 +198,7 @@ void RSA_free(RSA_CTX *ctx); int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data, uint8_t *out_data, int is_decryption); bigint *RSA_private(const RSA_CTX *c, bigint *bi_msg); -#ifdef CONFIG_SSL_CERT_VERIFICATION +#if defined(CONFIG_SSL_CERT_VERIFICATION) || defined(CONFIG_SSL_GENERATE_X509_CERT) bigint *RSA_sign_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, bigint *modulus, bigint *pub_exp); bigint *RSA_public(const RSA_CTX * c, bigint *bi_msg); diff --git a/httpd/axhttp.h b/httpd/axhttp.h index 62a36fd035..cc277f1a6d 100644 --- a/httpd/axhttp.h +++ b/httpd/axhttp.h @@ -28,7 +28,6 @@ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ -#include "os_port.h" #include "ssl.h" #define BACKLOG 15 diff --git a/ssl/Config.in b/ssl/Config.in index 05d88688c4..25cee495e4 100644 --- a/ssl/Config.in +++ b/ssl/Config.in @@ -144,7 +144,7 @@ config CONFIG_SSL_PRIVATE_KEY_PASSWORD config CONFIG_SSL_X509_CERT_LOCATION string "X.509 certificate file location" - depends on !CONFIG_SSL_GENERATE_X509_CERT && !CONFIG_SSL_SKELETON_MODE + depends on !CONFIG_SSL_GENERATE_X509_CERT && !CONFIG_SSL_USE_DEFAULT_KEY && !CONFIG_SSL_SKELETON_MODE help The file location of the X.509 certificate which will be automatically loaded on a ssl_ctx_new(). @@ -156,10 +156,13 @@ config CONFIG_SSL_GENERATE_X509_CERT An X.509 certificate can be automatically generated on a ssl_ctx_new(). A private key still needs to be provided (the private key in ss/private_key.h will be used unless - CONFIG_SSL_PRIVATE_KEY_LOCATION is set. + CONFIG_SSL_PRIVATE_KEY_LOCATION is set). The certificate is generated on the fly, and so a minor start-up time - penalty is to be expected. + penalty is to be expected. This feature adds around 5kB to the + library. + + This feature is disabled by default. config CONFIG_SSL_X509_COMMON_NAME string "X.509 Common Name" @@ -168,7 +171,7 @@ config CONFIG_SSL_X509_COMMON_NAME The common name for the X.509 certificate. This should in theory be the URL for server. - If this is blank, then the hostname is used. + If this is blank, then this will be value from gethostname(). config CONFIG_SSL_X509_ORGANIZATION_NAME string "X.509 Organization Name" @@ -176,14 +179,15 @@ config CONFIG_SSL_X509_ORGANIZATION_NAME help The organization name for the generated X.509 certificate. - If this is blank, then $USERNAME will be used. + If this is blank, then $USERDOMAIN will be used. config CONFIG_SSL_X509_ORGANIZATION_UNIT_NAME string "X.509 Organization Unit Name" depends on CONFIG_SSL_GENERATE_X509_CERT help - The organization unit name for the generated X.509 certificate. This - field is optional. + The organization unit name for the generated X.509 certificate. + + This field is optional. config CONFIG_SSL_ENABLE_V23_HANDSHAKE bool "Enable v23 Handshake" @@ -322,7 +326,7 @@ config CONFIG_PERFORMANCE_TESTING config CONFIG_SSL_TEST bool "Build the SSL testing tool" default n - depends on CONFIG_SSL_FULL_MODE + depends on CONFIG_SSL_FULL_MODE && !CONFIG_SSL_GENERATE_X509_CERT help Used for sanity checking the SSL handshaking. diff --git a/ssl/asn1.c b/ssl/asn1.c index 0fa9820e67..1639040d0c 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -112,7 +112,7 @@ int asn1_get_int(const uint8_t *buf, int *offset, uint8_t **object) if ((len = asn1_next_obj(buf, offset, ASN1_INTEGER)) < 0) goto end_int_array; - if (buf[*offset] == 0x00) /* ignore the negative byte */ + if (len > 1 && buf[*offset] == 0x00) /* ignore the negative byte */ { len--; (*offset)++; diff --git a/ssl/cert.h b/ssl/cert.h index 972a9e4b5e..7a85d2d843 100644 --- a/ssl/cert.h +++ b/ssl/cert.h @@ -1,43 +1,43 @@ -unsigned char default_certificate[] = { - 0x30, 0x82, 0x01, 0xd7, 0x30, 0x82, 0x01, 0x40, 0x02, 0x09, 0x00, 0xf1, - 0xc3, 0x87, 0xc0, 0xd4, 0xf4, 0x57, 0xc3, 0x30, 0x0d, 0x06, 0x09, 0x2a, - 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x34, - 0x31, 0x32, 0x30, 0x30, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x29, 0x61, - 0x78, 0x54, 0x4c, 0x53, 0x20, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, - 0x20, 0x44, 0x6f, 0x64, 0x67, 0x79, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, - 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, - 0x72, 0x69, 0x74, 0x79, 0x30, 0x1e, 0x17, 0x0d, 0x30, 0x36, 0x30, 0x36, - 0x30, 0x37, 0x31, 0x31, 0x34, 0x34, 0x33, 0x32, 0x5a, 0x17, 0x0d, 0x33, - 0x33, 0x31, 0x30, 0x32, 0x33, 0x31, 0x31, 0x34, 0x34, 0x33, 0x32, 0x5a, - 0x30, 0x2c, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, - 0x0d, 0x61, 0x78, 0x54, 0x4c, 0x53, 0x20, 0x50, 0x72, 0x6f, 0x6a, 0x65, - 0x63, 0x74, 0x31, 0x12, 0x30, 0x10, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, - 0x09, 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x30, 0x81, - 0x9f, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, - 0x01, 0x01, 0x05, 0x00, 0x03, 0x81, 0x8d, 0x00, 0x30, 0x81, 0x89, 0x02, - 0x81, 0x81, 0x00, 0xd8, 0xe0, 0xbf, 0x15, 0xde, 0xea, 0xaf, 0xe8, 0xd5, - 0xfd, 0x0b, 0xa8, 0xa8, 0xb3, 0xd7, 0x46, 0x5d, 0xa7, 0x26, 0x6c, 0x0c, - 0xb5, 0xd9, 0xbc, 0xc6, 0xf8, 0xc0, 0x78, 0xd0, 0xf6, 0x56, 0x65, 0xf8, - 0x29, 0x48, 0x0e, 0x7b, 0x0b, 0xa6, 0x25, 0x7e, 0xe8, 0x7b, 0x79, 0x6f, - 0x38, 0xe5, 0xb5, 0xb7, 0xf4, 0xe0, 0x9c, 0x91, 0x60, 0xf4, 0x06, 0xf3, - 0x40, 0x1e, 0xf9, 0x91, 0x19, 0xa9, 0x2f, 0x47, 0x43, 0xb5, 0x9b, 0x1e, - 0xdc, 0xf6, 0xaa, 0x1c, 0x49, 0x79, 0x21, 0x28, 0xcb, 0xaa, 0x49, 0x73, - 0xd9, 0x09, 0x05, 0x4c, 0x02, 0xf2, 0x4c, 0x4d, 0x6c, 0x1c, 0x80, 0xa7, - 0x14, 0x91, 0x44, 0xfc, 0x12, 0xb3, 0xe1, 0xe7, 0xe3, 0x4f, 0x44, 0xba, - 0x8c, 0xc3, 0x74, 0x39, 0xe8, 0x4c, 0xd0, 0xd4, 0x4c, 0x24, 0x61, 0xb4, - 0x40, 0x95, 0x8c, 0xc0, 0x0a, 0xb7, 0x02, 0x39, 0x31, 0x85, 0x93, 0x02, - 0x03, 0x01, 0x00, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, - 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x81, 0x81, 0x00, 0x0b, - 0x47, 0x24, 0x52, 0x7d, 0xb6, 0x63, 0x78, 0xbc, 0x80, 0xdd, 0x87, 0x6c, - 0x90, 0x4c, 0x33, 0xc3, 0x5c, 0xa7, 0x97, 0x09, 0x1c, 0x09, 0x4f, 0x9b, - 0x6e, 0xb3, 0x5a, 0x3e, 0x46, 0x92, 0x1a, 0xc7, 0x87, 0x15, 0x59, 0xe1, - 0x88, 0x5c, 0xce, 0x6a, 0xe2, 0x96, 0xaa, 0x32, 0xec, 0xc2, 0xed, 0x78, - 0x8b, 0xe0, 0x90, 0x66, 0x93, 0x14, 0xc3, 0x98, 0xab, 0x33, 0x35, 0xd3, - 0x7d, 0x5d, 0x51, 0x0a, 0x9c, 0xb9, 0x10, 0x58, 0x47, 0x7a, 0x98, 0x95, - 0x64, 0xff, 0x4c, 0x5d, 0x82, 0x19, 0xf9, 0xea, 0x0f, 0x5e, 0x9a, 0xcb, - 0x32, 0x27, 0x64, 0xca, 0x6f, 0x58, 0x8a, 0xd0, 0xc0, 0x36, 0xf4, 0xb9, - 0x63, 0x34, 0xa5, 0xda, 0x36, 0x50, 0x36, 0x49, 0xd2, 0xb7, 0x3a, 0x21, - 0x33, 0x5b, 0x3e, 0xd6, 0x5f, 0x0c, 0x99, 0x83, 0xb7, 0xb2, 0xf7, 0x8b, - 0x44, 0xc4, 0x5e, 0x73, 0x41, 0xa9, 0x02 -}; -unsigned int default_certificate_len = 475; +unsigned char default_certificate[] = { + 0x30, 0x82, 0x01, 0xd7, 0x30, 0x82, 0x01, 0x40, 0x02, 0x09, 0x00, 0xf1, + 0xc3, 0x87, 0xc0, 0xd4, 0xf4, 0x57, 0xc3, 0x30, 0x0d, 0x06, 0x09, 0x2a, + 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x34, + 0x31, 0x32, 0x30, 0x30, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x29, 0x61, + 0x78, 0x54, 0x4c, 0x53, 0x20, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, + 0x20, 0x44, 0x6f, 0x64, 0x67, 0x79, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, + 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, + 0x72, 0x69, 0x74, 0x79, 0x30, 0x1e, 0x17, 0x0d, 0x30, 0x36, 0x30, 0x36, + 0x30, 0x37, 0x31, 0x31, 0x34, 0x34, 0x33, 0x32, 0x5a, 0x17, 0x0d, 0x33, + 0x33, 0x31, 0x30, 0x32, 0x33, 0x31, 0x31, 0x34, 0x34, 0x33, 0x32, 0x5a, + 0x30, 0x2c, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, + 0x0d, 0x61, 0x78, 0x54, 0x4c, 0x53, 0x20, 0x50, 0x72, 0x6f, 0x6a, 0x65, + 0x63, 0x74, 0x31, 0x12, 0x30, 0x10, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, + 0x09, 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x30, 0x81, + 0x9f, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, + 0x01, 0x01, 0x05, 0x00, 0x03, 0x81, 0x8d, 0x00, 0x30, 0x81, 0x89, 0x02, + 0x81, 0x81, 0x00, 0xd8, 0xe0, 0xbf, 0x15, 0xde, 0xea, 0xaf, 0xe8, 0xd5, + 0xfd, 0x0b, 0xa8, 0xa8, 0xb3, 0xd7, 0x46, 0x5d, 0xa7, 0x26, 0x6c, 0x0c, + 0xb5, 0xd9, 0xbc, 0xc6, 0xf8, 0xc0, 0x78, 0xd0, 0xf6, 0x56, 0x65, 0xf8, + 0x29, 0x48, 0x0e, 0x7b, 0x0b, 0xa6, 0x25, 0x7e, 0xe8, 0x7b, 0x79, 0x6f, + 0x38, 0xe5, 0xb5, 0xb7, 0xf4, 0xe0, 0x9c, 0x91, 0x60, 0xf4, 0x06, 0xf3, + 0x40, 0x1e, 0xf9, 0x91, 0x19, 0xa9, 0x2f, 0x47, 0x43, 0xb5, 0x9b, 0x1e, + 0xdc, 0xf6, 0xaa, 0x1c, 0x49, 0x79, 0x21, 0x28, 0xcb, 0xaa, 0x49, 0x73, + 0xd9, 0x09, 0x05, 0x4c, 0x02, 0xf2, 0x4c, 0x4d, 0x6c, 0x1c, 0x80, 0xa7, + 0x14, 0x91, 0x44, 0xfc, 0x12, 0xb3, 0xe1, 0xe7, 0xe3, 0x4f, 0x44, 0xba, + 0x8c, 0xc3, 0x74, 0x39, 0xe8, 0x4c, 0xd0, 0xd4, 0x4c, 0x24, 0x61, 0xb4, + 0x40, 0x95, 0x8c, 0xc0, 0x0a, 0xb7, 0x02, 0x39, 0x31, 0x85, 0x93, 0x02, + 0x03, 0x01, 0x00, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, + 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x81, 0x81, 0x00, 0x0b, + 0x47, 0x24, 0x52, 0x7d, 0xb6, 0x63, 0x78, 0xbc, 0x80, 0xdd, 0x87, 0x6c, + 0x90, 0x4c, 0x33, 0xc3, 0x5c, 0xa7, 0x97, 0x09, 0x1c, 0x09, 0x4f, 0x9b, + 0x6e, 0xb3, 0x5a, 0x3e, 0x46, 0x92, 0x1a, 0xc7, 0x87, 0x15, 0x59, 0xe1, + 0x88, 0x5c, 0xce, 0x6a, 0xe2, 0x96, 0xaa, 0x32, 0xec, 0xc2, 0xed, 0x78, + 0x8b, 0xe0, 0x90, 0x66, 0x93, 0x14, 0xc3, 0x98, 0xab, 0x33, 0x35, 0xd3, + 0x7d, 0x5d, 0x51, 0x0a, 0x9c, 0xb9, 0x10, 0x58, 0x47, 0x7a, 0x98, 0x95, + 0x64, 0xff, 0x4c, 0x5d, 0x82, 0x19, 0xf9, 0xea, 0x0f, 0x5e, 0x9a, 0xcb, + 0x32, 0x27, 0x64, 0xca, 0x6f, 0x58, 0x8a, 0xd0, 0xc0, 0x36, 0xf4, 0xb9, + 0x63, 0x34, 0xa5, 0xda, 0x36, 0x50, 0x36, 0x49, 0xd2, 0xb7, 0x3a, 0x21, + 0x33, 0x5b, 0x3e, 0xd6, 0x5f, 0x0c, 0x99, 0x83, 0xb7, 0xb2, 0xf7, 0x8b, + 0x44, 0xc4, 0x5e, 0x73, 0x41, 0xa9, 0x02 +}; +unsigned int default_certificate_len = 475; diff --git a/ssl/gen_cert.c b/ssl/gen_cert.c index f58463ca05..faad29b0fa 100644 --- a/ssl/gen_cert.c +++ b/ssl/gen_cert.c @@ -195,14 +195,14 @@ static int gen_issuer(const char * dn[], uint8_t *buf, int *offset) goto error; if (dn[X509_ORGANIZATION] == NULL || strlen(dn[X509_ORGANIZATION]) == 0) - dn[X509_ORGANIZATION] = getenv("USERNAME"); + dn[X509_ORGANIZATION] = getenv("USERDOMAIN"); if (dn[X509_ORGANIZATION] != NULL && ((ret = gen_dn(dn[X509_ORGANIZATION], 10, buf, offset)))) goto error; if (dn[X509_ORGANIZATIONAL_TYPE] != NULL && - strlen(dn[X509_ORGANIZATIONAL_TYPE]) != 0) + strlen(dn[X509_ORGANIZATIONAL_TYPE]) > 0) { if ((ret = gen_dn(dn[X509_ORGANIZATIONAL_TYPE], 11, buf, offset))) goto error; @@ -219,8 +219,8 @@ static const uint8_t time_seq[] = ASN1_SEQUENCE, 30, ASN1_UTC_TIME, 13, '0', '7', '0', '1', '0', '1', '0', '0', '0', '0', '0', '0', 'Z', - ASN1_UTC_TIME, 13, /* make it good for 40 or so years */ - '4', '9', '0', '1', '0', '1', '0', '0', '0', '0', '0', '0', 'Z' + ASN1_UTC_TIME, 13, /* make it good for 30 or so years */ + '3', '8', '0', '1', '0', '1', '0', '0', '0', '0', '0', '0', 'Z' }; static void gen_utc_time(uint8_t *buf, int *offset) @@ -342,7 +342,7 @@ static int gen_tbs_cert(const char * dn[], /** * Create a new certificate. */ -EXP_FUNC int STDCALL ssl_x509_create(SSL_CTX *ssl_ctx, const char * dn[], uint32_t options, uint8_t **cert_data) +EXP_FUNC int STDCALL ssl_x509_create(SSL_CTX *ssl_ctx, uint32_t options, const char * dn[], uint8_t **cert_data) { int ret = X509_OK, offset = 0, seq_offset; /* allocate enough space to load a new certificate */ diff --git a/ssl/loader.c b/ssl/loader.c index 4909d06288..a6e4d94fb0 100644 --- a/ssl/loader.c +++ b/ssl/loader.c @@ -395,6 +395,16 @@ int load_key_certs(SSL_CTX *ssl_ctx) { int ret = SSL_OK; uint32_t options = ssl_ctx->options; +#ifdef CONFIG_SSL_GENERATE_X509_CERT + uint8_t *cert_data = NULL; + int cert_size; + static const char *dn[] = + { + CONFIG_SSL_X509_COMMON_NAME, + CONFIG_SSL_X509_ORGANIZATION_NAME, + CONFIG_SSL_X509_ORGANIZATION_UNIT_NAME + }; +#endif /* do the private key first */ if (strlen(CONFIG_SSL_PRIVATE_KEY_LOCATION) > 0) @@ -417,16 +427,7 @@ int load_key_certs(SSL_CTX *ssl_ctx) /* now load the certificate */ #ifdef CONFIG_SSL_GENERATE_X509_CERT - uint8_t *cert_data; - int cert_size; - static const char *dn[] = - { - CONFIG_SSL_X509_COMMON_NAME, - CONFIG_SSL_X509_ORGANIZATION_NAME, - CONFIG_SSL_X509_ORGANIZATION_UNIT_NAME - }; - - if ((cert_size = ssl_x509_create(ssl_ctx, dn, &cert_data)) < 0) + if ((cert_size = ssl_x509_create(ssl_ctx, 0, dn, &cert_data)) < 0) { ret = cert_size; goto error; diff --git a/ssl/os_port.h b/ssl/os_port.h index 8b47e36641..139850468d 100644 --- a/ssl/os_port.h +++ b/ssl/os_port.h @@ -99,7 +99,7 @@ extern "C" { #define strdup(A) _strdup(A) #define chroot(A) _chdir(A) #define chdir(A) _chdir(A) -#define alloca(A) _alloca(A) +#define alloca(A) _alloca(A) #ifndef lseek #define lseek(A,B,C) _lseek(A,B,C) #endif diff --git a/ssl/private_key.h b/ssl/private_key.h index 1ce34d6744..96a5253312 100644 --- a/ssl/private_key.h +++ b/ssl/private_key.h @@ -1,54 +1,54 @@ -unsigned char default_private_key[] = { - 0x30, 0x82, 0x02, 0x5d, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 0x00, 0xd8, - 0xe0, 0xbf, 0x15, 0xde, 0xea, 0xaf, 0xe8, 0xd5, 0xfd, 0x0b, 0xa8, 0xa8, - 0xb3, 0xd7, 0x46, 0x5d, 0xa7, 0x26, 0x6c, 0x0c, 0xb5, 0xd9, 0xbc, 0xc6, - 0xf8, 0xc0, 0x78, 0xd0, 0xf6, 0x56, 0x65, 0xf8, 0x29, 0x48, 0x0e, 0x7b, - 0x0b, 0xa6, 0x25, 0x7e, 0xe8, 0x7b, 0x79, 0x6f, 0x38, 0xe5, 0xb5, 0xb7, - 0xf4, 0xe0, 0x9c, 0x91, 0x60, 0xf4, 0x06, 0xf3, 0x40, 0x1e, 0xf9, 0x91, - 0x19, 0xa9, 0x2f, 0x47, 0x43, 0xb5, 0x9b, 0x1e, 0xdc, 0xf6, 0xaa, 0x1c, - 0x49, 0x79, 0x21, 0x28, 0xcb, 0xaa, 0x49, 0x73, 0xd9, 0x09, 0x05, 0x4c, - 0x02, 0xf2, 0x4c, 0x4d, 0x6c, 0x1c, 0x80, 0xa7, 0x14, 0x91, 0x44, 0xfc, - 0x12, 0xb3, 0xe1, 0xe7, 0xe3, 0x4f, 0x44, 0xba, 0x8c, 0xc3, 0x74, 0x39, - 0xe8, 0x4c, 0xd0, 0xd4, 0x4c, 0x24, 0x61, 0xb4, 0x40, 0x95, 0x8c, 0xc0, - 0x0a, 0xb7, 0x02, 0x39, 0x31, 0x85, 0x93, 0x02, 0x03, 0x01, 0x00, 0x01, - 0x02, 0x81, 0x81, 0x00, 0x94, 0x07, 0x72, 0xe5, 0xbe, 0xad, 0x79, 0x3b, - 0xf7, 0x33, 0x2c, 0x8e, 0x05, 0xf8, 0x1a, 0x6b, 0xd0, 0xe8, 0x91, 0xf5, - 0x16, 0x07, 0xd9, 0x82, 0x5c, 0x5c, 0xd5, 0x22, 0xa1, 0x9e, 0x42, 0x02, - 0x7f, 0x8b, 0xcd, 0xbe, 0xf4, 0x85, 0x52, 0xf6, 0x2c, 0xd5, 0x09, 0xd2, - 0x2c, 0xf4, 0x2c, 0xf6, 0x07, 0x85, 0x80, 0xf9, 0xdc, 0xd0, 0xcc, 0x3f, - 0x22, 0x31, 0x15, 0xf3, 0x49, 0xf2, 0xb5, 0xe2, 0x69, 0x99, 0x04, 0x04, - 0x49, 0x21, 0xdb, 0x9f, 0xa1, 0x54, 0x5a, 0xfa, 0xe4, 0xd9, 0xf9, 0x07, - 0x05, 0xff, 0x9a, 0x65, 0xa4, 0xeb, 0xf2, 0x47, 0xce, 0x56, 0xc7, 0x72, - 0x49, 0x48, 0x5c, 0xe8, 0x14, 0xd7, 0x8f, 0x25, 0xcc, 0x49, 0x29, 0x06, - 0x6a, 0x54, 0x7b, 0x17, 0xdc, 0x9e, 0xd4, 0x53, 0xf0, 0xf5, 0x9e, 0x85, - 0x25, 0xa1, 0xeb, 0x3d, 0xe9, 0x2f, 0xb9, 0x9c, 0xf6, 0xe1, 0x80, 0x81, - 0x02, 0x41, 0x00, 0xee, 0x02, 0x78, 0xc7, 0x78, 0x85, 0x04, 0x97, 0xcc, - 0x36, 0xbd, 0xd6, 0x11, 0xe2, 0xc7, 0x39, 0xd9, 0x34, 0x51, 0x72, 0x6f, - 0x8a, 0x0f, 0xcd, 0x88, 0x32, 0x33, 0x9b, 0xc7, 0xa7, 0x03, 0x77, 0xd9, - 0x82, 0x35, 0xb6, 0xdd, 0x1f, 0xc2, 0xc1, 0x13, 0x40, 0x83, 0x55, 0xeb, - 0x60, 0xeb, 0x81, 0x8e, 0x0c, 0x16, 0x62, 0xb4, 0xb4, 0x3c, 0xeb, 0x08, - 0x80, 0x9c, 0x79, 0xd3, 0x38, 0xca, 0xf1, 0x02, 0x41, 0x00, 0xe9, 0x45, - 0x5f, 0x2e, 0x16, 0xcc, 0x93, 0x50, 0x40, 0xb6, 0x79, 0xbc, 0x38, 0xe0, - 0x56, 0x68, 0x50, 0xd3, 0x2f, 0x73, 0x8c, 0x8c, 0x2a, 0x0e, 0x81, 0x4a, - 0x8a, 0xbb, 0xcc, 0xf0, 0x64, 0x34, 0x46, 0x9f, 0x07, 0x7d, 0x22, 0xb6, - 0xf9, 0x46, 0xac, 0x57, 0x23, 0x8c, 0x1e, 0xeb, 0xd3, 0x05, 0x4d, 0xa8, - 0x83, 0x6a, 0x67, 0xf6, 0xa6, 0xb1, 0xab, 0x8e, 0xc1, 0xef, 0xef, 0x7d, - 0xf0, 0xc3, 0x02, 0x40, 0x2f, 0xc6, 0x59, 0x3e, 0x18, 0xe8, 0x02, 0x73, - 0x01, 0xef, 0xdf, 0x0d, 0x30, 0x4b, 0xe8, 0x17, 0xa9, 0x8c, 0xc1, 0xe8, - 0x89, 0x91, 0x19, 0xf8, 0xf4, 0xa4, 0xb7, 0x0d, 0x46, 0xf7, 0x34, 0x50, - 0x03, 0x5e, 0x0a, 0xb0, 0x29, 0x14, 0xae, 0x00, 0x19, 0x80, 0x32, 0x9c, - 0xb5, 0x81, 0x9f, 0xe4, 0x42, 0x82, 0x14, 0xa0, 0x3d, 0x8b, 0x8c, 0x4a, - 0xd5, 0x4b, 0x13, 0x9d, 0xb4, 0x93, 0x4a, 0xd1, 0x02, 0x40, 0x64, 0x8c, - 0x83, 0x77, 0x61, 0x5a, 0x73, 0x11, 0x3f, 0xa3, 0xa8, 0x1b, 0x8a, 0xc4, - 0xa0, 0x5a, 0x3c, 0xa4, 0x9b, 0x2a, 0x8a, 0x65, 0x8c, 0x67, 0x4e, 0x31, - 0xac, 0x55, 0x41, 0x04, 0x49, 0x9d, 0x02, 0xe7, 0xdf, 0x99, 0x7f, 0xd2, - 0x30, 0xe6, 0xd6, 0xb8, 0x84, 0xd9, 0x0c, 0x27, 0x08, 0x81, 0x9b, 0xb4, - 0xcc, 0x58, 0x9c, 0x51, 0x84, 0x0e, 0xc7, 0x6d, 0x34, 0x89, 0x50, 0xc9, - 0x0f, 0x73, 0x02, 0x41, 0x00, 0xda, 0xde, 0x5e, 0x1a, 0xac, 0x1d, 0x1d, - 0xd7, 0xb9, 0x65, 0x26, 0x00, 0xf5, 0xd4, 0xe4, 0x28, 0x84, 0x86, 0x2f, - 0x00, 0x9c, 0x41, 0x00, 0x52, 0xe1, 0x47, 0x91, 0xc0, 0x52, 0x05, 0x4e, - 0x0f, 0x2f, 0x0d, 0xca, 0x9b, 0x3d, 0x89, 0x41, 0xbf, 0xee, 0x9f, 0xa1, - 0xe6, 0x9d, 0xa4, 0xeb, 0x45, 0x7f, 0xe3, 0xcb, 0xa4, 0x6b, 0x0a, 0xe2, - 0x7e, 0xb0, 0x87, 0x5c, 0x40, 0xb1, 0x51, 0x11, 0x1d -}; -unsigned int default_private_key_len = 609; +unsigned char default_private_key[] = { + 0x30, 0x82, 0x02, 0x5d, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 0x00, 0xd8, + 0xe0, 0xbf, 0x15, 0xde, 0xea, 0xaf, 0xe8, 0xd5, 0xfd, 0x0b, 0xa8, 0xa8, + 0xb3, 0xd7, 0x46, 0x5d, 0xa7, 0x26, 0x6c, 0x0c, 0xb5, 0xd9, 0xbc, 0xc6, + 0xf8, 0xc0, 0x78, 0xd0, 0xf6, 0x56, 0x65, 0xf8, 0x29, 0x48, 0x0e, 0x7b, + 0x0b, 0xa6, 0x25, 0x7e, 0xe8, 0x7b, 0x79, 0x6f, 0x38, 0xe5, 0xb5, 0xb7, + 0xf4, 0xe0, 0x9c, 0x91, 0x60, 0xf4, 0x06, 0xf3, 0x40, 0x1e, 0xf9, 0x91, + 0x19, 0xa9, 0x2f, 0x47, 0x43, 0xb5, 0x9b, 0x1e, 0xdc, 0xf6, 0xaa, 0x1c, + 0x49, 0x79, 0x21, 0x28, 0xcb, 0xaa, 0x49, 0x73, 0xd9, 0x09, 0x05, 0x4c, + 0x02, 0xf2, 0x4c, 0x4d, 0x6c, 0x1c, 0x80, 0xa7, 0x14, 0x91, 0x44, 0xfc, + 0x12, 0xb3, 0xe1, 0xe7, 0xe3, 0x4f, 0x44, 0xba, 0x8c, 0xc3, 0x74, 0x39, + 0xe8, 0x4c, 0xd0, 0xd4, 0x4c, 0x24, 0x61, 0xb4, 0x40, 0x95, 0x8c, 0xc0, + 0x0a, 0xb7, 0x02, 0x39, 0x31, 0x85, 0x93, 0x02, 0x03, 0x01, 0x00, 0x01, + 0x02, 0x81, 0x81, 0x00, 0x94, 0x07, 0x72, 0xe5, 0xbe, 0xad, 0x79, 0x3b, + 0xf7, 0x33, 0x2c, 0x8e, 0x05, 0xf8, 0x1a, 0x6b, 0xd0, 0xe8, 0x91, 0xf5, + 0x16, 0x07, 0xd9, 0x82, 0x5c, 0x5c, 0xd5, 0x22, 0xa1, 0x9e, 0x42, 0x02, + 0x7f, 0x8b, 0xcd, 0xbe, 0xf4, 0x85, 0x52, 0xf6, 0x2c, 0xd5, 0x09, 0xd2, + 0x2c, 0xf4, 0x2c, 0xf6, 0x07, 0x85, 0x80, 0xf9, 0xdc, 0xd0, 0xcc, 0x3f, + 0x22, 0x31, 0x15, 0xf3, 0x49, 0xf2, 0xb5, 0xe2, 0x69, 0x99, 0x04, 0x04, + 0x49, 0x21, 0xdb, 0x9f, 0xa1, 0x54, 0x5a, 0xfa, 0xe4, 0xd9, 0xf9, 0x07, + 0x05, 0xff, 0x9a, 0x65, 0xa4, 0xeb, 0xf2, 0x47, 0xce, 0x56, 0xc7, 0x72, + 0x49, 0x48, 0x5c, 0xe8, 0x14, 0xd7, 0x8f, 0x25, 0xcc, 0x49, 0x29, 0x06, + 0x6a, 0x54, 0x7b, 0x17, 0xdc, 0x9e, 0xd4, 0x53, 0xf0, 0xf5, 0x9e, 0x85, + 0x25, 0xa1, 0xeb, 0x3d, 0xe9, 0x2f, 0xb9, 0x9c, 0xf6, 0xe1, 0x80, 0x81, + 0x02, 0x41, 0x00, 0xee, 0x02, 0x78, 0xc7, 0x78, 0x85, 0x04, 0x97, 0xcc, + 0x36, 0xbd, 0xd6, 0x11, 0xe2, 0xc7, 0x39, 0xd9, 0x34, 0x51, 0x72, 0x6f, + 0x8a, 0x0f, 0xcd, 0x88, 0x32, 0x33, 0x9b, 0xc7, 0xa7, 0x03, 0x77, 0xd9, + 0x82, 0x35, 0xb6, 0xdd, 0x1f, 0xc2, 0xc1, 0x13, 0x40, 0x83, 0x55, 0xeb, + 0x60, 0xeb, 0x81, 0x8e, 0x0c, 0x16, 0x62, 0xb4, 0xb4, 0x3c, 0xeb, 0x08, + 0x80, 0x9c, 0x79, 0xd3, 0x38, 0xca, 0xf1, 0x02, 0x41, 0x00, 0xe9, 0x45, + 0x5f, 0x2e, 0x16, 0xcc, 0x93, 0x50, 0x40, 0xb6, 0x79, 0xbc, 0x38, 0xe0, + 0x56, 0x68, 0x50, 0xd3, 0x2f, 0x73, 0x8c, 0x8c, 0x2a, 0x0e, 0x81, 0x4a, + 0x8a, 0xbb, 0xcc, 0xf0, 0x64, 0x34, 0x46, 0x9f, 0x07, 0x7d, 0x22, 0xb6, + 0xf9, 0x46, 0xac, 0x57, 0x23, 0x8c, 0x1e, 0xeb, 0xd3, 0x05, 0x4d, 0xa8, + 0x83, 0x6a, 0x67, 0xf6, 0xa6, 0xb1, 0xab, 0x8e, 0xc1, 0xef, 0xef, 0x7d, + 0xf0, 0xc3, 0x02, 0x40, 0x2f, 0xc6, 0x59, 0x3e, 0x18, 0xe8, 0x02, 0x73, + 0x01, 0xef, 0xdf, 0x0d, 0x30, 0x4b, 0xe8, 0x17, 0xa9, 0x8c, 0xc1, 0xe8, + 0x89, 0x91, 0x19, 0xf8, 0xf4, 0xa4, 0xb7, 0x0d, 0x46, 0xf7, 0x34, 0x50, + 0x03, 0x5e, 0x0a, 0xb0, 0x29, 0x14, 0xae, 0x00, 0x19, 0x80, 0x32, 0x9c, + 0xb5, 0x81, 0x9f, 0xe4, 0x42, 0x82, 0x14, 0xa0, 0x3d, 0x8b, 0x8c, 0x4a, + 0xd5, 0x4b, 0x13, 0x9d, 0xb4, 0x93, 0x4a, 0xd1, 0x02, 0x40, 0x64, 0x8c, + 0x83, 0x77, 0x61, 0x5a, 0x73, 0x11, 0x3f, 0xa3, 0xa8, 0x1b, 0x8a, 0xc4, + 0xa0, 0x5a, 0x3c, 0xa4, 0x9b, 0x2a, 0x8a, 0x65, 0x8c, 0x67, 0x4e, 0x31, + 0xac, 0x55, 0x41, 0x04, 0x49, 0x9d, 0x02, 0xe7, 0xdf, 0x99, 0x7f, 0xd2, + 0x30, 0xe6, 0xd6, 0xb8, 0x84, 0xd9, 0x0c, 0x27, 0x08, 0x81, 0x9b, 0xb4, + 0xcc, 0x58, 0x9c, 0x51, 0x84, 0x0e, 0xc7, 0x6d, 0x34, 0x89, 0x50, 0xc9, + 0x0f, 0x73, 0x02, 0x41, 0x00, 0xda, 0xde, 0x5e, 0x1a, 0xac, 0x1d, 0x1d, + 0xd7, 0xb9, 0x65, 0x26, 0x00, 0xf5, 0xd4, 0xe4, 0x28, 0x84, 0x86, 0x2f, + 0x00, 0x9c, 0x41, 0x00, 0x52, 0xe1, 0x47, 0x91, 0xc0, 0x52, 0x05, 0x4e, + 0x0f, 0x2f, 0x0d, 0xca, 0x9b, 0x3d, 0x89, 0x41, 0xbf, 0xee, 0x9f, 0xa1, + 0xe6, 0x9d, 0xa4, 0xeb, 0x45, 0x7f, 0xe3, 0xcb, 0xa4, 0x6b, 0x0a, 0xe2, + 0x7e, 0xb0, 0x87, 0x5c, 0x40, 0xb1, 0x51, 0x11, 0x1d +}; +unsigned int default_private_key_len = 609; diff --git a/ssl/ssl.h b/ssl/ssl.h index 103c28b877..539d0a3058 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -439,9 +439,10 @@ EXP_FUNC int STDCALL ssl_obj_memory_load(SSL_CTX *ssl_ctx, int obj_type, const u * @brief Create an X.509 certificate. * * This certificate is a self-signed v1 cert with a fixed start/stop validity - * times. It is also signed with the private key in ssl_ctx->rsa_ctx. + * times. It is signed with an internal private key in ssl_ctx. * * @param ssl_ctx [in] The client/server context. + * @param options [in] Not used yet. * @param dn [in] An array of distinguished name strings. The array is defined * by: * - SSL_X509_CERT_COMMON_NAME (0) @@ -452,12 +453,11 @@ EXP_FUNC int STDCALL ssl_obj_memory_load(SSL_CTX *ssl_ctx, int obj_type, const u * will be used. * - SSL_X509_CERT_ORGANIZATIONAL_NAME (2) * - SSL_X509_CERT_ORGANIZATIONAL_NAME is optional. - * @param options [in] Not used yet. * @param cert_data [out] The certificate as a sequence of bytes. * @return < 0 if an error, or the size of the certificate in bytes. * @note cert_data must be freed when there is no more need for it. */ -EXP_FUNC int STDCALL ssl_x509_create(SSL_CTX *ssl_ctx, const char * dn[], uint32_t options, uint8_t **cert_data); +EXP_FUNC int STDCALL ssl_x509_create(SSL_CTX *ssl_ctx, uint32_t options, const char * dn[], uint8_t **cert_data); #endif /** diff --git a/ssl/test/Makefile b/ssl/test/Makefile index 42465600f0..56c711f197 100644 --- a/ssl/test/Makefile +++ b/ssl/test/Makefile @@ -75,11 +75,12 @@ CRYPTO_OBJ=\ OBJ=\ $(AXTLS_SSL_PATH)asn1.obj \ - $(AXTLS_SSL_PATH)x509.obj \ - $(AXTLS_SSL_PATH)os_port.obj \ + $(AXTLS_SSL_PATH)gen_cert.obj \ $(AXTLS_SSL_PATH)loader.obj \ $(AXTLS_SSL_PATH)openssl.obj \ + $(AXTLS_SSL_PATH)os_port.obj \ $(AXTLS_SSL_PATH)p12.obj \ + $(AXTLS_SSL_PATH)x509.obj \ $(AXTLS_SSL_PATH)tls1.obj \ $(AXTLS_SSL_PATH)tls1_svr.obj \ $(AXTLS_SSL_PATH)tls1_clnt.obj diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index db71fe1304..a97a5b578c 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -58,7 +58,6 @@ static int g_port = 19001; -#if 0 /************************************************************************** * AES tests * @@ -647,7 +646,6 @@ static int cert_tests(void) printf("Error: A certificate test failed\n"); return res; } -#endif /** * init a server socket. @@ -781,6 +779,11 @@ static int SSL_server_test( if ((server_fd = server_socket_init(&g_port)) < 0) goto error; + if (private_key) + { + axolotls_option |= SSL_NO_DEFAULT_KEY; + } + if ((ssl_ctx = ssl_ctx_new(axolotls_option, SSL_DEFAULT_SVR_SESS)) == NULL) { ret = SSL_ERROR_INVALID_KEY; @@ -881,7 +884,6 @@ static int SSL_server_test( error: ssl_ctx_free(ssl_ctx); -printf("RES %d\n", ret); TTY_FLUSH(); return ret; } @@ -1126,9 +1128,14 @@ int SSL_server_tests(void) cleanup: if (ret) { - printf("Error: A server test failed\n"); TTY_FLUSH(); + printf("Error: A server test failed\n"); + ssl_display_error(ret); exit(1); } + else + { + printf("All server tests passed\n"); TTY_FLUSH(); + } return ret; } @@ -1203,6 +1210,11 @@ static int SSL_client_test( if (*ssl_ctx == NULL) { + if (private_key) + { + client_options |= SSL_NO_DEFAULT_KEY; + } + if ((*ssl_ctx = ssl_ctx_new( client_options, SSL_DEFAULT_CLNT_SESS)) == NULL) { @@ -1402,7 +1414,7 @@ int SSL_client_tests(void) &ssl_ctx, "-cert ../ssl/test/axTLS.x509_device.pem " "-key ../ssl/test/axTLS.device_key.pem " - "-CAfile ../ssl/test/axTLS.x509_512.pem", NULL, + "-CAfile ../ssl/test/axTLS.x509_512.pem ", NULL, DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) goto cleanup; @@ -1414,7 +1426,8 @@ int SSL_client_tests(void) "-CAfile ../ssl/test/axTLS.ca_x509.pem " "-verify 1 ", NULL, DEFAULT_CLNT_OPTION, "../ssl/test/axTLS.key_1024", NULL, - "../ssl/test/axTLS.x509_1024.cer"))) + "../ssl/test/axTLS.x509_1024.cer")) + != SSL_X509_ERROR(X509_VFY_ERROR_SELF_SIGNED)) goto cleanup; /* Should get an "ERROR" from openssl (as the handshake fails as soon as @@ -1451,7 +1464,15 @@ int SSL_client_tests(void) cleanup: if (ret) + { + ssl_display_error(ret); printf("Error: A client test failed\n"); + exit(1); + } + else + { + printf("All client tests passed\n"); TTY_FLUSH(); + } return ret; } @@ -1460,7 +1481,6 @@ int SSL_client_tests(void) * SSL Basic Testing (test a big packet handshake) * **************************************************************************/ -#if 0 static uint8_t basic_buf[256*1024]; static void do_basic(void) @@ -1483,6 +1503,7 @@ static void do_basic(void) /* check the return status */ if (ssl_handshake_status(ssl_clnt) < 0) { + printf("YA YA\n"); ssl_display_error(ssl_handshake_status(ssl_clnt)); goto error; } @@ -1571,7 +1592,6 @@ static int SSL_basic_test(void) ssl_ctx_free(ssl_svr_ctx); return ret; } -#endif #if !defined(WIN32) && defined(CONFIG_SSL_CTX_MUTEXING) /************************************************************************** @@ -1725,7 +1745,7 @@ int multi_thread_test(void) SOCKET_CLOSE(server_fd); return res; } -#endif +#endif /* !defined(WIN32) && defined(CONFIG_SSL_CTX_MUTEXING) */ /************************************************************************** * Header issue @@ -1792,7 +1812,7 @@ static int header_issue(void) int main(int argc, char *argv[]) { int ret = 1; - //BI_CTX *bi_ctx; + BI_CTX *bi_ctx; int fd; #ifdef WIN32 @@ -1807,7 +1827,12 @@ int main(int argc, char *argv[]) dup2(fd, 2); #endif -#if 0 + /* can't do testing in this mode */ +#if defined CONFIG_SSL_GENERATE_X509_CERT + printf("Error: Must compile with default key/certificates\n"); + exit(1); +#endif + bi_ctx = bi_initialize(); if (AES_test(bi_ctx)) @@ -1882,7 +1907,6 @@ int main(int argc, char *argv[]) goto cleanup; system("sh ../ssl/test/killopenssl.sh"); -#endif if (SSL_server_tests()) goto cleanup; @@ -1891,7 +1915,7 @@ int main(int argc, char *argv[]) if (header_issue()) { - printf("Header tests failed\n"); + printf("Header tests failed\n"); TTY_FLUSH(); goto cleanup; } diff --git a/ssl/tls1.c b/ssl/tls1.c index cd01cbdff4..d84df3fb45 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -414,7 +414,7 @@ int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) x509_free(cert); /* get rid of it */ ca_cert_ctx->cert[i] = NULL; #ifdef CONFIG_SSL_FULL_MODE - printf("Error: %s\n", x509_display_error(ret)); + printf("Error: %s\n", x509_display_error(ret)); TTY_FLUSH(); #endif goto error; } @@ -1477,7 +1477,6 @@ int send_certificate(SSL *ssl) while (i < ssl->ssl_ctx->chain_length) { - X509_CTX *cert_ctx; SSL_CERT *cert = &ssl->ssl_ctx->certs[i]; buf[offset++] = 0; buf[offset++] = cert->size >> 8; /* cert 1 length */ @@ -1485,10 +1484,6 @@ int send_certificate(SSL *ssl) memcpy(&buf[offset], cert->buf, cert->size); offset += cert->size; i++; - // TODO: get rid of these - x509_new(cert->buf, &cert->size, &cert_ctx); - x509_print(cert_ctx, NULL); - x509_free(cert_ctx); } chain_length = offset - 7; diff --git a/ssl/tls1.h b/ssl/tls1.h index af4dc115b6..05258ed0de 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -42,6 +42,7 @@ extern "C" { #include "version.h" #include "crypto.h" +#include "os_port.h" #include "crypto_misc.h" #define SSL_RANDOM_SIZE 32 @@ -261,8 +262,8 @@ void DISPLAY_RSA(SSL *ssl, const RSA_CTX *rsa_ctx); void DISPLAY_ALERT(SSL *ssl, int alert); #else #define DISPLAY_STATE(A,B,C,D) -#define DISPLAY_CERT(A,B,C) -#define DISPLAY_RSA(A,B,C) +#define DISPLAY_CERT(A,B) +#define DISPLAY_RSA(A,B) #define DISPLAY_ALERT(A, B) #ifdef WIN32 void DISPLAY_BYTES(SSL *ssl, const char *format,/* win32 has no variadic macros */ diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index b1a58ca133..91314333c0 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -305,7 +305,7 @@ static int send_client_key_xchg(SSL *ssl) premaster_secret[0] = 0x03; /* encode the version number */ premaster_secret[1] = 0x01; get_random(SSL_SECRET_SIZE-2, &premaster_secret[2]); - DISPLAY_RSA(ssl, "send_client_key_xchg", ssl->x509_ctx->rsa_ctx); + DISPLAY_RSA(ssl, ssl->x509_ctx->rsa_ctx); /* rsa_ctx->bi_ctx is not thread-safe */ SSL_CTX_LOCK(ssl->ssl_ctx->mutex); @@ -351,7 +351,7 @@ static int send_cert_verify(SSL *ssl) RSA_CTX *rsa_ctx = ssl->ssl_ctx->rsa_ctx; int n = 0, ret; - DISPLAY_RSA(ssl, "send_cert_verify", rsa_ctx); + DISPLAY_RSA(ssl, rsa_ctx); buf[0] = HS_CERT_VERIFY; buf[1] = 0; diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index 26813692d7..3a79c31c94 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -378,7 +378,7 @@ static int process_client_key_xchg(SSL *ssl) int offset = 4; int ret = SSL_OK; - DISPLAY_RSA(ssl, "process_client_key_xchg", rsa_ctx); + DISPLAY_RSA(ssl, rsa_ctx); /* is there an extra size field? */ if ((secret_length - 2) == rsa_ctx->num_octets) @@ -444,7 +444,7 @@ static int process_cert_verify(SSL *ssl) PARANOIA_CHECK(pkt_size, x509_ctx->rsa_ctx->num_octets+6); - DISPLAY_RSA(ssl, "process_cert_verify", x509_ctx->rsa_ctx); + DISPLAY_RSA(ssl, x509_ctx->rsa_ctx); /* rsa_ctx->bi_ctx is not thread-safe */ SSL_CTX_LOCK(ssl->ssl_ctx->mutex); diff --git a/ssl/x509.c b/ssl/x509.c index a51ed1bb53..758f3f0e11 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -264,7 +264,7 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) bigint *cert_sig; X509_CTX *next_cert = NULL; BI_CTX *ctx; - bigint *mod, *expn; + bigint *mod = NULL, *expn = NULL; struct timeval tv; int match_ca_cert = 0; uint8_t is_self_signed = 0; @@ -319,14 +319,6 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) goto end_verify; } - /* check the chain integrity */ - if (next_cert && !match_ca_cert && - asn1_compare_dn(cert->ca_cert_dn, next_cert->cert_dn) == 0) - { - ret = X509_VFY_ERROR_INVALID_CHAIN; - goto end_verify; - } - ctx = cert->rsa_ctx->bi_ctx; /* check for self-signing */ @@ -336,30 +328,42 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) mod = cert->rsa_ctx->m; expn = cert->rsa_ctx->e; } - else + else if (next_cert != NULL) { mod = next_cert->rsa_ctx->m; expn = next_cert->rsa_ctx->e; + + /* check the chain integrity */ + if (asn1_compare_dn(cert->ca_cert_dn, next_cert->cert_dn) != 0) + { + ret = X509_VFY_ERROR_INVALID_CHAIN; + goto end_verify; + } } /* check the signature */ - cert_sig = sig_verify(ctx, cert->signature, cert->sig_len, - bi_clone(ctx, mod), bi_clone(ctx, expn)); - - if (cert_sig && cert->digest) + if (mod != NULL) { - if (bi_compare(cert_sig, cert->digest)) - ret = X509_VFY_ERROR_BAD_SIGNATURE; + cert_sig = sig_verify(ctx, cert->signature, cert->sig_len, + bi_clone(ctx, mod), bi_clone(ctx, expn)); - bi_free(ctx, cert_sig); + if (cert_sig && cert->digest) + { + if (bi_compare(cert_sig, cert->digest)) + { + ret = X509_VFY_ERROR_BAD_SIGNATURE; + } + + bi_free(ctx, cert_sig); - if (ret) + if (ret) + goto end_verify; + } + else + { + ret = X509_VFY_ERROR_BAD_SIGNATURE; goto end_verify; - } - else - { - ret = X509_VFY_ERROR_BAD_SIGNATURE; - goto end_verify; + } } if (is_self_signed) diff --git a/www/index.html b/www/index.html index 707b1af734..9628314f00 100755 --- a/www/index.html +++ b/www/index.html @@ -7086,12 +7086,12 @@
    changes, notes and errata
    -
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Certificates can now be automatically generated (the keys still need to be provided).\n* Certificate/keys can be loaded automatically given a file location.\n* ~SSL_NO_DEFAULT_KEY has been removed (it is now largely redundant).\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call ssl_get_session_id_size() and a change to ssl_client_new() to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* vfork() is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programmatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2007, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    <div class='header' macro='gradient vert #390108 #900'>\n<div class='headerShadow'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n<div class='headerForeground'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n</div>\n<div id='mainMenu'>\n<div refresh='content' tiddler='MainMenu'></div>\n</div>\n<div id='sidebar'>\n<div id='sidebarOptions' refresh='content' tiddler='SideBarOptions'></div>\n<div id='sidebarTabs' refresh='content' force='true' tiddler='SideBarTabs'></div>\n</div>\n<div id='displayArea'>\n<div id='messageArea'></div>\n<div id='tiddlerDisplay'></div>\n</div>
    -
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly some stuff.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n* axssl.lua - Lua sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!!!!Lua\n\n{{indent{{{{> [lua] ./axssl.lua <options>}}}\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n* The lua sample requires the luabit library from http://luaforge.net/projects/bit.\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* CGI has been removed from Win32 - it needs a lot more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    +
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n* axssl.lua - Lua sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!!!!Lua\n\n{{indent{{{{> [lua] ./axssl.lua <options>}}}\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n* The lua sample requires the luabit library from http://luaforge.net/projects/bit.\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* CGI has been removed from Win32 - it needs a lot more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    changes, notes and errata
    axTLS Embedded SSL
    http://axtls.cerocclub.com.au
    From 31efa0083113a053f509207e42f74615560c9293 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 2 Dec 2007 22:15:46 +0000 Subject: [PATCH 122/301] changes for 1.1.8 git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@145 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/Config.in | 3 --- config/linuxconfig | 1 - config/win32config | 1 - crypto/rsa.c | 3 ++- httpd/Config.in | 10 +------- httpd/axhttp.h | 2 +- httpd/axhttpd.c | 4 ---- httpd/proc.c | 2 +- ssl/Config.in | 7 +++--- ssl/asn1.c | 6 ++--- ssl/crypto_misc.h | 2 +- ssl/gen_cert.c | 19 +++++++++------ ssl/os_port.c | 16 +++++++++++++ ssl/os_port.h | 4 +--- ssl/test/ssltest.c | 18 +++++++------- ssl/tls1.c | 9 +++++-- ssl/x509.c | 58 ++++++++++++++++++++-------------------------- 17 files changed, 82 insertions(+), 83 deletions(-) diff --git a/config/Config.in b/config/Config.in index 4721ac4463..dc40756465 100644 --- a/config/Config.in +++ b/config/Config.in @@ -19,9 +19,6 @@ config CONFIG_PLATFORM_LINUX config CONFIG_PLATFORM_CYGWIN bool "Cygwin" -config CONFIG_PLATFORM_SOLARIS - bool "Solaris" - config CONFIG_PLATFORM_WIN32 bool "Win32" diff --git a/config/linuxconfig b/config/linuxconfig index 9068c5b0b6..614fdd80e4 100644 --- a/config/linuxconfig +++ b/config/linuxconfig @@ -74,7 +74,6 @@ CONFIG_HTTP_LUA_CGI_LAUNCHER="/bin/cgi" # CONFIG_HTTP_BUILD_LUA is not set CONFIG_HTTP_DIRECTORIES=y CONFIG_HTTP_HAS_AUTHORIZATION=y -# CONFIG_HTTP_CHANGE_UID is not set # CONFIG_HTTP_HAS_IPV6 is not set # CONFIG_HTTP_VERBOSE is not set # CONFIG_HTTP_IS_DAEMON is not set diff --git a/config/win32config b/config/win32config index cfff8094ac..6c8d607126 100644 --- a/config/win32config +++ b/config/win32config @@ -74,7 +74,6 @@ CONFIG_HTTP_LUA_CGI_LAUNCHER="" # CONFIG_HTTP_BUILD_LUA is not set CONFIG_HTTP_DIRECTORIES=y CONFIG_HTTP_HAS_AUTHORIZATION=y -# CONFIG_HTTP_CHANGE_UID is not set # CONFIG_HTTP_HAS_IPV6 is not set CONFIG_HTTP_VERBOSE=y # CONFIG_HTTP_IS_DAEMON is not set diff --git a/crypto/rsa.c b/crypto/rsa.c index c0dcb0355b..31627bb319 100644 --- a/crypto/rsa.c +++ b/crypto/rsa.c @@ -79,11 +79,12 @@ void RSA_pub_key_new(RSA_CTX **ctx, const uint8_t *pub_exp, int pub_len) { RSA_CTX *rsa_ctx; - BI_CTX *bi_ctx = bi_initialize(); + BI_CTX *bi_ctx; if (*ctx) /* if we load multiple certs, dump the old one */ RSA_free(*ctx); + bi_ctx = bi_initialize(); *ctx = (RSA_CTX *)calloc(1, sizeof(RSA_CTX)); rsa_ctx = *ctx; rsa_ctx->bi_ctx = bi_ctx; diff --git a/httpd/Config.in b/httpd/Config.in index ad66e2a167..c43eaa7776 100644 --- a/httpd/Config.in +++ b/httpd/Config.in @@ -59,6 +59,7 @@ depends on !CONFIG_PLATFORM_WIN32 config CONFIG_HTTP_HAS_CGI bool "Enable CGI" default y + depends on !CONFIG_PLATFORM_WIN32 help Enable the CGI capability. Not available on Win32 platforms. @@ -119,15 +120,6 @@ config CONFIG_HTTP_HAS_AUTHORIZATION help Pages/directories can have passwords associated with them. -config CONFIG_HTTP_CHANGE_UID - bool "Change UID" - default n - depends on !CONFIG_PLATFORM_WIN32 - help - Call setgid()/setuid() to disable access to protected files. - - This feature is normally disabled. - config CONFIG_HTTP_HAS_IPV6 bool "Enable IPv6" default n diff --git a/httpd/axhttp.h b/httpd/axhttp.h index cc277f1a6d..73c299fb14 100644 --- a/httpd/axhttp.h +++ b/httpd/axhttp.h @@ -41,7 +41,7 @@ #define BLOCKSIZE 4096 #define INITIAL_CONNECTION_SLOTS 10 -#define CONFIG_HTTP_DEFAULT_SSL_OPTIONS 0 +#define CONFIG_HTTP_DEFAULT_SSL_OPTIONS SSL_DISPLAY_CERTS #define STATE_WANT_TO_READ_HEAD 1 #define STATE_WANT_TO_SEND_HEAD 2 diff --git a/httpd/axhttpd.c b/httpd/axhttpd.c index de408022e2..23b7f6d539 100644 --- a/httpd/axhttpd.c +++ b/httpd/axhttpd.c @@ -187,10 +187,6 @@ int main(int argc, char *argv[]) ax_chdir(); #ifndef WIN32 -#ifdef CONFIG_HTTP_CHANGE_UID - setgid(32767); - setuid(32767); -#endif #ifdef CONFIG_HTTP_IS_DAEMON if (fork() > 0) /* parent will die */ exit(0); diff --git a/httpd/proc.c b/httpd/proc.c index f27dfabec1..30a2ee21c6 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -321,7 +321,7 @@ void procreadhead(struct connstruct *cn) /* If we have a blank line, advance to next stage */ if (*next == '\r' || *next == '\n') { -#ifndef WIN32 +#if defined(CONFIG_HTTP_HAS_CGI) if (cn->reqtype == TYPE_POST && cn->content_length > 0) { if (init_read_post_data(buf,next,cn,rv) == 0) diff --git a/ssl/Config.in b/ssl/Config.in index 25cee495e4..825d97d943 100644 --- a/ssl/Config.in +++ b/ssl/Config.in @@ -168,10 +168,11 @@ config CONFIG_SSL_X509_COMMON_NAME string "X.509 Common Name" depends on CONFIG_SSL_GENERATE_X509_CERT help - The common name for the X.509 certificate. This should in theory be - the URL for server. + The common name for the X.509 certificate. This should be the fully + qualified domain name (FQDN), e.g. www.foo.com. - If this is blank, then this will be value from gethostname(). + If this is blank, then this will be value from gethostname() and + getdomainname(). config CONFIG_SSL_X509_ORGANIZATION_NAME string "X.509 Organization Name" diff --git a/ssl/asn1.c b/ssl/asn1.c index 1639040d0c..7d4d36e173 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -132,10 +132,10 @@ int asn1_get_int(const uint8_t *buf, int *offset, uint8_t **object) int asn1_get_private_key(const uint8_t *buf, int len, RSA_CTX **rsa_ctx) { int offset = 7; - uint8_t *modulus, *priv_exp, *pub_exp; + uint8_t *modulus = NULL, *priv_exp = NULL, *pub_exp = NULL; int mod_len, priv_len, pub_len; #ifdef CONFIG_BIGINT_CRT - uint8_t *p, *q, *dP, *dQ, *qInv; + uint8_t *p = NULL, *q = NULL, *dP = NULL, *dQ = NULL, *qInv = NULL; int p_len, q_len, dP_len, dQ_len, qInv_len; #endif @@ -348,7 +348,7 @@ int asn1_name(const uint8_t *cert, int *offset, char *dn[]) int asn1_public_key(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) { int ret = X509_NOT_OK, mod_len, pub_len; - uint8_t *modulus, *pub_exp; + uint8_t *modulus = NULL, *pub_exp = NULL; if (asn1_next_obj(cert, offset, ASN1_SEQUENCE) < 0 || asn1_skip_obj(cert, offset, ASN1_SEQUENCE) || diff --git a/ssl/crypto_misc.h b/ssl/crypto_misc.h index 3ceb9d1fc8..dc1f6e1455 100644 --- a/ssl/crypto_misc.h +++ b/ssl/crypto_misc.h @@ -62,7 +62,7 @@ extern "C" { #define X509_NUM_DN_TYPES 3 #define X509_COMMON_NAME 0 #define X509_ORGANIZATION 1 -#define X509_ORGANIZATIONAL_TYPE 2 +#define X509_ORGANIZATIONAL_UNIT 2 struct _x509_ctx { diff --git a/ssl/gen_cert.c b/ssl/gen_cert.c index faad29b0fa..856dc3ac02 100644 --- a/ssl/gen_cert.c +++ b/ssl/gen_cert.c @@ -182,13 +182,18 @@ static int gen_issuer(const char * dn[], uint8_t *buf, int *offset) int seq_offset; int seq_size = pre_adjust_with_size( ASN1_SEQUENCE, &seq_offset, buf, offset); - char hostname[128]; + char fqdn[128]; - /* we need the common name, so if not configured, use the hostname */ + /* we need the common name, so if not configured, work out the fully + * qualified domain name */ if (dn[X509_COMMON_NAME] == NULL || strlen(dn[X509_COMMON_NAME]) == 0) { - gethostname(hostname, sizeof(hostname)); - dn[X509_COMMON_NAME] = hostname; + int fqdn_len; + gethostname(fqdn, sizeof(fqdn)); + fqdn_len = strlen(fqdn); + fqdn[fqdn_len++] = '.'; + getdomainname(&fqdn[fqdn_len], sizeof(fqdn)-fqdn_len); + dn[X509_COMMON_NAME] = fqdn; } if ((ret = gen_dn(dn[X509_COMMON_NAME], 3, buf, offset))) @@ -201,10 +206,10 @@ static int gen_issuer(const char * dn[], uint8_t *buf, int *offset) ((ret = gen_dn(dn[X509_ORGANIZATION], 10, buf, offset)))) goto error; - if (dn[X509_ORGANIZATIONAL_TYPE] != NULL && - strlen(dn[X509_ORGANIZATIONAL_TYPE]) > 0) + if (dn[X509_ORGANIZATIONAL_UNIT] != NULL && + strlen(dn[X509_ORGANIZATIONAL_UNIT]) > 0) { - if ((ret = gen_dn(dn[X509_ORGANIZATIONAL_TYPE], 11, buf, offset))) + if ((ret = gen_dn(dn[X509_ORGANIZATIONAL_UNIT], 11, buf, offset))) goto error; } diff --git a/ssl/os_port.c b/ssl/os_port.c index cddbea32a2..6a71000b47 100644 --- a/ssl/os_port.c +++ b/ssl/os_port.c @@ -72,6 +72,22 @@ EXP_FUNC int STDCALL strcasecmp(const char *s1, const char *s2) return *(unsigned char *)s1 - *(unsigned char *)(s2 - 1); } + +EXP_FUNC int STDCALL getdomainname(char *buf, int buf_size) +{ + HKEY hKey; + unsigned long datatype; + unsigned long bufferlength = buf_size; + + if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, + TEXT("SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters"), + 0, KEY_QUERY_VALUE, &hKey) != ERROR_SUCCESS) + return -1; + + RegQueryValueEx(hKey, "Domain", NULL, &datatype, buf, &bufferlength); + RegCloseKey(hKey); + return 0; +} #endif #undef malloc diff --git a/ssl/os_port.h b/ssl/os_port.h index 139850468d..262c4dd705 100644 --- a/ssl/os_port.h +++ b/ssl/os_port.h @@ -114,10 +114,7 @@ extern "C" { * automatically build some library dependencies. */ #pragma comment(lib, "WS2_32.lib") - -#ifdef CONFIG_WIN32_USE_CRYPTO_LIB #pragma comment(lib, "AdvAPI32.lib") -#endif typedef UINT8 uint8_t; typedef INT8 int8_t; @@ -131,6 +128,7 @@ typedef int socklen_t; EXP_FUNC void STDCALL gettimeofday(struct timeval* t,void* timezone); EXP_FUNC int STDCALL strcasecmp(const char *s1, const char *s2); +EXP_FUNC int STDCALL getdomainname(char *buf, int buf_size); #else /* Not Win32 */ diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index a97a5b578c..c4be8966d0 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1248,6 +1248,13 @@ static int SSL_client_test( goto client_test_exit; } } + + if (ssl_obj_load(*ssl_ctx, SSL_OBJ_X509_CACERT, + "../ssl/test/axTLS.ca_x509.cer", NULL)) + { + printf("could not add cert auth\n"); TTY_FLUSH(); + goto client_test_exit; + } } if (sess_resume && !sess_resume->start_server) @@ -1257,16 +1264,7 @@ static int SSL_client_test( if ((client_fd = client_socket_init(g_port)) < 0) { - printf("could not start socket on %d\n", g_port); - TTY_FLUSH(); - goto client_test_exit; - } - - if (ssl_obj_load(*ssl_ctx, SSL_OBJ_X509_CACERT, - "../ssl/test/axTLS.ca_x509.cer", NULL)) - { - printf("could not add cert auth\n"); - TTY_FLUSH(); + printf("could not start socket on %d\n", g_port); TTY_FLUSH(); goto client_test_exit; } diff --git a/ssl/tls1.c b/ssl/tls1.c index d84df3fb45..c98cd7a5f9 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -353,6 +353,11 @@ int add_cert(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) if ((ret = x509_new(buf, &offset, &cert))) goto error; +#if defined (CONFIG_SSL_FULL_MODE) + if (ssl_ctx->options & SSL_DISPLAY_CERTS) + x509_print(cert, NULL); +#endif + ssl_cert = &ssl_ctx->certs[i]; ssl_cert->size = len; ssl_cert->buf = (uint8_t *)malloc(len); @@ -448,7 +453,7 @@ EXP_FUNC const char * STDCALL ssl_get_cert_dn(const SSL *ssl, int component) return ssl->x509_ctx->cert_dn[X509_ORGANIZATION]; case SSL_X509_CERT_ORGANIZATIONAL_NAME: - return ssl->x509_ctx->cert_dn[X509_ORGANIZATIONAL_TYPE]; + return ssl->x509_ctx->cert_dn[X509_ORGANIZATIONAL_UNIT]; case SSL_X509_CA_CERT_COMMON_NAME: return ssl->x509_ctx->ca_cert_dn[X509_COMMON_NAME]; @@ -457,7 +462,7 @@ EXP_FUNC const char * STDCALL ssl_get_cert_dn(const SSL *ssl, int component) return ssl->x509_ctx->ca_cert_dn[X509_ORGANIZATION]; case SSL_X509_CA_CERT_ORGANIZATIONAL_NAME: - return ssl->x509_ctx->ca_cert_dn[X509_ORGANIZATIONAL_TYPE]; + return ssl->x509_ctx->ca_cert_dn[X509_ORGANIZATIONAL_UNIT]; default: return NULL; diff --git a/ssl/x509.c b/ssl/x509.c index 758f3f0e11..9b41b944e8 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -387,50 +387,42 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) /** * Used for diagnostics. */ +static const char *not_part_of_cert = ""; void x509_print(const X509_CTX *cert, CA_CERT_CTX *ca_cert_ctx) { if (cert == NULL) return; - printf("---------------- CERT DEBUG ----------------\n"); - printf("* CA Cert Distinguished Name\n"); - if (cert->ca_cert_dn[X509_COMMON_NAME]) - { - printf("Common Name (CN):\t%s\n", cert->ca_cert_dn[X509_COMMON_NAME]); - } + printf("=== CERTIFICATE ISSUED TO ===\n"); + printf("Common Name (CN):\t\t"); + printf("%s\n", cert->cert_dn[X509_COMMON_NAME] ? + cert->cert_dn[X509_COMMON_NAME] : not_part_of_cert); - if (cert->ca_cert_dn[X509_ORGANIZATION]) - { - printf("Organization (O):\t%s\n", cert->ca_cert_dn[X509_ORGANIZATION]); - } + printf("Organization (O):\t\t"); + printf("%s\n", cert->cert_dn[X509_ORGANIZATION] ? + cert->cert_dn[X509_ORGANIZATION] : not_part_of_cert); - if (cert->ca_cert_dn[X509_ORGANIZATIONAL_TYPE]) - { - printf("Organizational Unit (OU): %s\n", - cert->ca_cert_dn[X509_ORGANIZATIONAL_TYPE]); - } + printf("Organizational Unit (OU):\t"); + printf("%s\n", cert->cert_dn[X509_ORGANIZATIONAL_UNIT] ? + cert->cert_dn[X509_ORGANIZATIONAL_UNIT] : not_part_of_cert); - printf("* Cert Distinguished Name\n"); - if (cert->cert_dn[X509_COMMON_NAME]) - { - printf("Common Name (CN):\t%s\n", cert->cert_dn[X509_COMMON_NAME]); - } + printf("=== CERTIFICATE ISSUED BY ===\n"); + printf("Common Name (CN):\t\t"); + printf("%s\n", cert->ca_cert_dn[X509_COMMON_NAME] ? + cert->ca_cert_dn[X509_COMMON_NAME] : not_part_of_cert); - if (cert->cert_dn[X509_ORGANIZATION]) - { - printf("Organization (O):\t%s\n", cert->cert_dn[X509_ORGANIZATION]); - } + printf("Organization (O):\t\t"); + printf("%s\n", cert->ca_cert_dn[X509_ORGANIZATION] ? + cert->ca_cert_dn[X509_ORGANIZATION] : not_part_of_cert); - if (cert->cert_dn[X509_ORGANIZATIONAL_TYPE]) - { - printf("Organizational Unit (OU): %s\n", - cert->cert_dn[X509_ORGANIZATIONAL_TYPE]); - } + printf("Organizational Unit (OU):\t"); + printf("%s\n", cert->ca_cert_dn[X509_ORGANIZATIONAL_UNIT] ? + cert->ca_cert_dn[X509_ORGANIZATIONAL_UNIT] : not_part_of_cert); - printf("Not Before:\t\t%s", ctime(&cert->not_before)); - printf("Not After:\t\t%s", ctime(&cert->not_after)); - printf("RSA bitsize:\t\t%d\n", cert->rsa_ctx->num_octets*8); - printf("Sig Type:\t\t"); + printf("Not Before:\t\t\t%s", ctime(&cert->not_before)); + printf("Not After:\t\t\t%s", ctime(&cert->not_after)); + printf("RSA bitsize:\t\t\t%d\n", cert->rsa_ctx->num_octets*8); + printf("Sig Type:\t\t\t"); switch (cert->sig_type) { case SIG_TYPE_MD5: From 3cd0ded46d4141f4d92ff4ca2a906a4bc5ad4d4d Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 3 Dec 2007 07:27:13 +0000 Subject: [PATCH 123/301] changes git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@146 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- www/index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/www/index.html b/www/index.html index 9628314f00..a43bd65983 100755 --- a/www/index.html +++ b/www/index.html @@ -7096,7 +7096,7 @@
    axTLS Embedded SSL
    http://axtls.cerocclub.com.au
    /***\nhttp://tiddlystyles.com/#theme:DevFire\nAuthor: Clint Checketts\n***/\n\n/*{{{*/\nbody {\nbackground: #000;\n}\n/*}}}*/\n/***\n!Link styles /% ============================================================= %/\n***/\n/*{{{*/\na,\na.button,\n#mainMenu a.button,\n#sidebarOptions .sliderPanel a{\n color: #ffbf00;\n border: 0;\n background: transparent;\n}\n\na:hover,\na.button:hover,\n#mainMenu a.button:hover,\n#sidebarOptions .sliderPanel a:hover\n#sidebarOptions .sliderPanel a:active{\n color: #ff7f00;\n border: 0;\n border-bottom: #ff7f00 1px dashed;\n background: transparent;\n text-decoration: none;\n}\n\n#displayArea .button.highlight{\n color: #ffbf00;\n background: #4c4c4c;\n}\n/*}}}*/\n/***\n!Header styles /% ============================================================= %/\n***/\n/*{{{*/\n.header{\n border-bottom: 2px solid #ffbf00;\n color: #fff;\n}\n\n.headerForeground a {\n color: #fff;\n}\n\n.header a:hover {\n border-bottom: 1px dashed #fff;\n}\n/*}}}*/\n/***\n!Main menu styles /% ============================================================= %/\n***/\n/*{{{*/\n#mainMenu {color: #fff;}\n#mainMenu h1{\n font-size: 1.1em;\n}\n#mainMenu li,#mainMenu ul{\n list-style: none;\n margin: 0;\n padding: 0;\n}\n/*}}}*/\n/***\n!Sidebar styles /% ============================================================= %/\n***/\n/*{{{*/\n#sidebar {\n right: 0;\n color: #fff;\n border: 2px solid #ffbf00;\n border-width: 0 0 2px 2px;\n}\n#sidebarOptions {\n background-color: #4c4c4c;\n padding: 0;\n}\n\n#sidebarOptions a{\n margin: 0;\n color: #ffbf00;\n border: 0;\n}\n#sidebarOptions a:hover {\n color: #4c4c4c;\n background-color: #ffbf00;\n\n}\n\n#sidebarOptions a:active {\n color: #ffbf00;\n background-color: transparent;\n}\n\n#sidebarOptions .sliderPanel {\n background-color: #333;\n margin: 0;\n}\n\n#sidebarTabs {background-color: #4c4c4c;}\n#sidebarTabs .tabSelected {\n padding: 3px 3px;\n cursor: default;\n color: #ffbf00;\n background-color: #666;\n}\n#sidebarTabs .tabUnselected {\n color: #ffbf00;\n background-color: #5f5f5f;\n padding: 0 4px;\n}\n\n#sidebarTabs .tabUnselected:hover,\n#sidebarTabs .tabContents {\n background-color: #666;\n}\n\n.listTitle{color: #FFF;}\n#sidebarTabs .tabContents a{\n color: #ffbf00;\n}\n\n#sidebarTabs .tabContents a:hover{\n color: #ff7f00;\n background: transparent;\n}\n\n#sidebarTabs .txtMoreTab .tabSelected,\n#sidebarTabs .txtMoreTab .tab:hover,\n#sidebarTabs .txtMoreTab .tabContents{\n color: #ffbf00;\n background: #4c4c4c;\n}\n\n#sidebarTabs .txtMoreTab .tabUnselected {\n color: #ffbf00;\n background: #5f5f5f;\n}\n\n.tab.tabSelected, .tab.tabSelected:hover{color: #ffbf00; border: 0; background-color: #4c4c4c;cursor:default;}\n.tab.tabUnselected {background-color: #666;}\n.tab.tabUnselected:hover{color:#ffbf00; border: 0;background-color: #4c4c4c;}\n.tabContents {\n background-color: #4c4c4c;\n border: 0;\n}\n.tabContents .tabContents{background: #666;}\n.tabContents .tabSelected{background: #666;}\n.tabContents .tabUnselected{background: #5f5f5f;}\n.tabContents .tab:hover{background: #666;}\n/*}}}*/\n/***\n!Message area styles /% ============================================================= %/\n***/\n/*{{{*/\n#messageArea {background-color: #666; color: #fff; border: 2px solid #ffbf00;}\n#messageArea a:link, #messageArea a:visited {color: #ffbf00; text-decoration:none;}\n#messageArea a:hover {color: #ff7f00;}\n#messageArea a:active {color: #ff7f00;}\n#messageArea .messageToolbar a{\n border: 1px solid #ffbf00;\n background: #4c4c4c;\n}\n/*}}}*/\n/***\n!Popup styles /% ============================================================= %/\n***/\n/*{{{*/\n.popup {color: #fff; background-color: #4c4c4c; border: 1px solid #ffbf00;}\n.popup li.disabled{color: #fff;}\n.popup a {color: #ffbf00; }\n.popup a:hover { background: transparent; color: #ff7f00; border: 0;}\n.popup hr {color: #ffbf00; background: #ffbf00;}\n/*}}}*/\n/***\n!Tiddler Display styles /% ============================================================= %/\n***/\n/*{{{*/\n.title{color: #fff;}\nh1, h2, h3, h4, h5 {\n color: #fff;\n background-color: transparent;\n border-bottom: 1px solid #333;\n}\n\n.subtitle{\n color: #666;\n}\n\n.viewer {color: #fff; }\n\n.viewer table{background: #666; color: #fff;}\n\n.viewer th {background-color: #996; color: #fff;}\n\n.viewer pre, .viewer code {color: #ddd; background-color: #4c4c4c; border: 1px solid #ffbf00;}\n\n.viewer hr {color: #666;}\n\n.tiddler .button {color: #4c4c4c;}\n.tiddler .button:hover { color: #ffbf00; background-color: #4c4c4c;}\n.tiddler .button:active {color: #ffbf00; background-color: #4c4c4c;}\n\n.toolbar {\n color: #4c4c4c;\n}\n\n.toolbar a.button,\n.toolbar a.button:hover,\n.toolbar a.button:active,\n.editorFooter a{\n border: 0;\n}\n\n.footer {\n color: #ddd;\n}\n\n.selected .footer {\n color: #888;\n}\n\n.highlight, .marked {\n color: #000;\n background-color: #ffe72f;\n}\n.editorFooter {\n color: #aaa;\n}\n\n.tab{\n-moz-border-radius-topleft: 3px;\n-moz-border-radius-topright: 3px;\n}\n\n.tagging,\n.tagged{\n background: #4c4c4c;\n border: 1px solid #4c4c4c; \n}\n\n.selected .tagging,\n.selected .tagged{\n background-color: #333;\n border: 1px solid #ffbf00;\n}\n\n.tagging .listTitle,\n.tagged .listTitle{\n color: #fff;\n}\n\n.tagging .button,\n.tagged .button{\n color: #ffbf00;\n border: 0;\n padding: 0;\n}\n\n.tagging .button:hover,\n.tagged .button:hover{\nbackground: transparent;\n}\n\n.selected .isTag .tagging.simple,\n.selected .tagged.simple,\n.isTag .tagging.simple,\n.tagged.simple {\n float: none;\n display: inline;\n border: 0;\n background: transparent;\n color: #fff;\n margin: 0;\n}\n\n.cascade {\n background: #4c4c4c;\n color: #ddd;\n border: 1px solid #ffbf00;\n}\n/*}}}*/
    -
    axhttpd is a small embedded web server using the axTLS library. It is based originally on the web server written by Doug Currie which is at http://www.hcsw.org/awhttpd.\n\n!@@bgcolor(#ff0000):color(#ffffff):axhttpd Features@@ \n\n!!__Basic Authentication__\n\nBasic Authentication uses a password file called ".htpasswd", in the directory to be protected. This file is formatted as the familiar colon-separated username/encrypted-password pair, records delimited by newlines. The protection does not carry over to subdirectories. The utility program htpasswd is included to help manually edit .htpasswd files.\n\nThe encryption of this password uses a proprietary algorithm due to the dependency of many crypt libraries on DES. An example is in [[/test_dir/no_http|https://127.0.0.1/test_dir/no_http]] (username 'abcd', password is '1234').\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__SSL Protection__\n\nDirectories/files can be accessed using the 'http' or 'https' uri prefix. If normal http access for a directory needs to be disabled, then put "~SSLRequireSSL" into a '.htaccess' file in the directory to be protected. \n\nConversely, use "~SSLDenySSL" to deny access to directories via SSL.\n\nAn example is in [[/test_dir/no_http|http://127.0.0.1/test_dir/no_http]] and [[/test_dir/no_ssl|https://127.0.0.1/test_dir/no_ssl]].\n\nEntire directories can be denied access with a "Deny all" directive (regardless of SSL or authentication). An example is in [[/test_dir/bin|http://127.0.0.1/test_dir/bin]]\n\n!!__CGI__\n\n//chroot()// is optionally now used for added security. However this has the impact of removing the regular filesystem, so any CGI applications no longer have the usual access (to things like /bin, /lib etc). Any executables and libraries need to be copied into webroot.\n\nMost of the CGI 1.1 variables are now placed into the script environment and should work as normal.\n\n!!__Lua and Lua Pages__\n\nThis is a small scripting language gaining popularity in embedded applications due to its small footprint and fast speed.\n\nLua has been incorporated into the build, so simply select it and it will automatically install. Try pointing your browser at [[/test_dir/test_variables.lp|http://127.0.0.1/test_dir/test_variables.lp]] to see an example of Lua Pages.\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__Directory Listing__\n\nAn mconf option. Allow the files in directories to be displayed. An example is in [[/test_dir|http://127.0.0.1/test_dir]]\n\n!!__Other Features__\n\n* Timeout - HTTP 1.1 allows for persistent connections. This is the time allowed for this connection in seconds.\n* Daemon - Puts the process in daemon mode. \n* SSL session cache size - The size of the session cache (a heavily loaded server should maintain many sessions). A session will save on expensive SSL handshaking.\n\n
    +
    axhttpd is a small embedded web server using the axTLS library. It is based originally on the web server written by Doug Currie which is at http://www.hcsw.org/awhttpd.\n\n!@@bgcolor(#ff0000):color(#ffffff):axhttpd Features@@ \n\n!!__Basic Authentication__\n\nBasic Authentication uses a password file called ".htpasswd", in the directory to be protected. This file is formatted as the familiar colon-separated username/encrypted-password pair, records delimited by newlines. The protection does not carry over to subdirectories. The utility program htpasswd is included to help manually edit .htpasswd files.\n\nThe encryption of this password uses a proprietary algorithm due to the dependency of many crypt libraries on DES. An example is in [[/test_dir/no_http|https://127.0.0.1/test_dir/no_http]] (username 'abcd', password is '1234').\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__SSL Protection__\n\nDirectories/files can be accessed using the 'http' or 'https' uri prefix. If normal http access for a directory needs to be disabled, then put "~SSLRequireSSL" into a '.htaccess' file in the directory to be protected. \n\nConversely, use "~SSLDenySSL" to deny access to directories via SSL.\n\nAn example is in [[/test_dir/no_http|http://127.0.0.1/test_dir/no_http]] and [[/test_dir/no_ssl|https://127.0.0.1/test_dir/no_ssl]].\n\nEntire directories can be denied access with a "Deny all" directive (regardless of SSL or authentication). An example is in [[/test_dir/bin|http://127.0.0.1/test_dir/bin]]\n\n!!__CGI__\n\n//chroot()// is optionally now used for added security. However this has the impact of removing the regular filesystem, so any CGI applications no longer have the usual access (to things like /bin, /lib etc). Any executables and libraries need to be copied into webroot.\n\nMost of the CGI 1.1 variables are now placed into the script environment and should work as normal.\n\n!!__Lua and Lua Pages__\n\nThis is a small scripting language gaining popularity in embedded applications due to its small footprint and fast speed.\n\nLua has been incorporated into the build, so simply select it and it will automatically install. Try pointing your browser at [[test_main.html]|http://127.0.0.1/lua/test_main.html]] to see an example of Lua Pages.\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__Directory Listing__\n\nAn mconf option. Allow the files in directories to be displayed. An example is in [[/test_dir|http://127.0.0.1/test_dir]]\n\n!!__Other Features__\n\n* Timeout - HTTP 1.1 allows for persistent connections. This is the time allowed for this connection in seconds.\n* Daemon - Puts the process in daemon mode. \n* SSL session cache size - The size of the session cache (a heavily loaded server should maintain many sessions). A session will save on expensive SSL handshaking.\n\n
    From bf4238d4e7b6ae146b782487f7f0cd00db7786e1 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Tue, 4 Dec 2007 21:31:48 +0000 Subject: [PATCH 124/301] final touches to 1.1.8 git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@147 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- samples/c/axssl.c | 2 +- samples/csharp/axssl.cs | 2 +- samples/java/axssl.java | 2 +- samples/lua/axssl.lua | 2 +- samples/perl/axssl.pl | 2 +- samples/vbnet/axssl.vb | 3 +- ssl/Config.in | 2 +- ssl/gen_cert.c | 110 ++++++++++++++++++---------------------- ssl/x509.c | 12 +---- 9 files changed, 60 insertions(+), 77 deletions(-) diff --git a/samples/c/axssl.c b/samples/c/axssl.c index 28ea71baf1..6892ee452b 100644 --- a/samples/c/axssl.c +++ b/samples/c/axssl.c @@ -668,7 +668,7 @@ static void do_client(int argc, char *argv[]) SSL_X509_CERT_COMMON_NAME); if (common_name) { - printf("Common Name:\t\t%s\n", common_name); + printf("Common Name:\t\t\t%s\n", common_name); } display_session_id(ssl); diff --git a/samples/csharp/axssl.cs b/samples/csharp/axssl.cs index 2224f89ea2..dae2b8a41f 100644 --- a/samples/csharp/axssl.cs +++ b/samples/csharp/axssl.cs @@ -571,7 +571,7 @@ private void do_client(int build_mode, string[] args) if (common_name != null) { - Console.WriteLine("Common Name:\t\t" + common_name); + Console.WriteLine("Common Name:\t\t\t" + common_name); } display_session_id(ssl); diff --git a/samples/java/axssl.java b/samples/java/axssl.java index cc6bb711a2..2057f29662 100644 --- a/samples/java/axssl.java +++ b/samples/java/axssl.java @@ -562,7 +562,7 @@ else if (private_key_file.endsWith(".p12")) if (common_name != null) { - System.out.println("Common Name:\t\t" + common_name); + System.out.println("Common Name:\t\t\t" + common_name); } display_session_id(ssl); diff --git a/samples/lua/axssl.lua b/samples/lua/axssl.lua index 3f37551f26..6ea26b69dd 100755 --- a/samples/lua/axssl.lua +++ b/samples/lua/axssl.lua @@ -482,7 +482,7 @@ function do_client(build_mode) axtlsl.SSL_X509_CERT_COMMON_NAME) if common_name ~= nil then - print("Common Name:\t\t"..common_name) + print("Common Name:\t\t\t"..common_name) end display_session_id(ssl) diff --git a/samples/perl/axssl.pl b/samples/perl/axssl.pl index a8b4e26d97..e49d52270d 100755 --- a/samples/perl/axssl.pl +++ b/samples/perl/axssl.pl @@ -470,7 +470,7 @@ sub do_client my $common_name = axtlsp::ssl_get_cert_dn($ssl, $axtlsp::SSL_X509_CERT_COMMON_NAME); - printf("Common Name:\t\t%s\n", $common_name) if defined $common_name; + printf("Common Name:\t\t\t%s\n", $common_name) if defined $common_name; display_session_id($ssl); display_cipher($ssl); } diff --git a/samples/vbnet/axssl.vb b/samples/vbnet/axssl.vb index a33cc9466a..1b423c8659 100644 --- a/samples/vbnet/axssl.vb +++ b/samples/vbnet/axssl.vb @@ -485,7 +485,8 @@ Public Class axssl If common_name <> Nothing Console.WriteLine("Common Name:" & _ - ControlChars.Tab & ControlChars.Tab & common_name) + ControlChars.Tab & ControlChars.Tab & _ + ControlChars.Tab & common_name) End If display_session_id(ssl) diff --git a/ssl/Config.in b/ssl/Config.in index 825d97d943..d047d420ec 100644 --- a/ssl/Config.in +++ b/ssl/Config.in @@ -180,7 +180,7 @@ config CONFIG_SSL_X509_ORGANIZATION_NAME help The organization name for the generated X.509 certificate. - If this is blank, then $USERDOMAIN will be used. + This field is optional. config CONFIG_SSL_X509_ORGANIZATION_UNIT_NAME string "X.509 Organization Unit Name" diff --git a/ssl/gen_cert.c b/ssl/gen_cert.c index 856dc3ac02..a6dac7a4cb 100644 --- a/ssl/gen_cert.c +++ b/ssl/gen_cert.c @@ -39,36 +39,6 @@ * Generate a basic X.509 certificate */ -/* OBJECT IDENTIFIER sha1withRSAEncryption (1 2 840 113549 1 1 5) */ -static const uint8_t sig_oid[] = -{ - 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05 -}; - -/* OBJECT IDENTIFIER rsaEncryption (1 2 840 113549 1 1 1) */ -static const uint8_t rsa_enc_oid[] = -{ - 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01 -}; - -/* INTEGER 65537 */ -static const uint8_t pub_key_seq[] = -{ - 0x02, 0x03, 0x01, 0x00, 0x01 -}; - -/* 0x00 + SEQUENCE { - SEQUENCE { - OBJECT IDENTIFIER sha1 (1 3 14 3 2 26) - NULL - } - OCTET STRING */ -static const uint8_t asn1_sig[] = -{ - 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, - 0x1a, 0x05, 0x00, 0x04, 0x14 -}; - static uint8_t set_gen_length(int len, uint8_t *buf, int *offset) { if (len < 0x80) /* short form */ @@ -129,21 +99,23 @@ static void adjust_with_size(int seq_size, int seq_start, static void gen_serial_number(uint8_t *buf, int *offset) { - buf[(*offset)++] = ASN1_INTEGER; - buf[(*offset)++] = 1; - buf[(*offset)++] = 0x7F; + static const uint8_t ser_oid[] = { ASN1_INTEGER, 1, 0x7F }; + memcpy(&buf[*offset], ser_oid , sizeof(ser_oid)); + *offset += sizeof(ser_oid); } static void gen_signature_alg(uint8_t *buf, int *offset) { - buf[(*offset)++] = ASN1_SEQUENCE; - set_gen_length(13, buf, offset); - buf[(*offset)++] = ASN1_OID; - set_gen_length(sizeof(sig_oid), buf, offset); + /* OBJECT IDENTIFIER sha1withRSAEncryption (1 2 840 113549 1 1 5) */ + static const uint8_t sig_oid[] = + { + ASN1_SEQUENCE, 0x0d, ASN1_OID, 0x09, + 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, + ASN1_NULL, 0x00 + }; + memcpy(&buf[*offset], sig_oid, sizeof(sig_oid)); *offset += sizeof(sig_oid); - buf[(*offset)++] = ASN1_NULL; - buf[(*offset)++] = 0; } static int gen_dn(const char *name, uint8_t dn_type, @@ -193,18 +165,22 @@ static int gen_issuer(const char * dn[], uint8_t *buf, int *offset) fqdn_len = strlen(fqdn); fqdn[fqdn_len++] = '.'; getdomainname(&fqdn[fqdn_len], sizeof(fqdn)-fqdn_len); + fqdn_len = strlen(fqdn); + + if (fqdn[fqdn_len-1] == '.') /* ensure '.' is not last char */ + fqdn[fqdn_len-1] = 0; + dn[X509_COMMON_NAME] = fqdn; } if ((ret = gen_dn(dn[X509_COMMON_NAME], 3, buf, offset))) goto error; - if (dn[X509_ORGANIZATION] == NULL || strlen(dn[X509_ORGANIZATION]) == 0) - dn[X509_ORGANIZATION] = getenv("USERDOMAIN"); - - if (dn[X509_ORGANIZATION] != NULL && - ((ret = gen_dn(dn[X509_ORGANIZATION], 10, buf, offset)))) - goto error; + if (dn[X509_ORGANIZATION] != NULL && strlen(dn[X509_ORGANIZATION]) > 0) + { + if ((ret = gen_dn(dn[X509_ORGANIZATIONAL_UNIT], 10, buf, offset))) + goto error; + } if (dn[X509_ORGANIZATIONAL_UNIT] != NULL && strlen(dn[X509_ORGANIZATIONAL_UNIT]) > 0) @@ -219,17 +195,17 @@ static int gen_issuer(const char * dn[], uint8_t *buf, int *offset) return ret; } -static const uint8_t time_seq[] = -{ - ASN1_SEQUENCE, 30, - ASN1_UTC_TIME, 13, - '0', '7', '0', '1', '0', '1', '0', '0', '0', '0', '0', '0', 'Z', - ASN1_UTC_TIME, 13, /* make it good for 30 or so years */ - '3', '8', '0', '1', '0', '1', '0', '0', '0', '0', '0', '0', 'Z' -}; - static void gen_utc_time(uint8_t *buf, int *offset) { + static const uint8_t time_seq[] = + { + ASN1_SEQUENCE, 30, + ASN1_UTC_TIME, 13, + '0', '7', '0', '1', '0', '1', '0', '0', '0', '0', '0', '0', 'Z', + ASN1_UTC_TIME, 13, /* make it good for 30 or so years */ + '3', '8', '0', '1', '0', '1', '0', '0', '0', '0', '0', '0', 'Z' + }; + /* fixed time */ memcpy(&buf[*offset], time_seq, sizeof(time_seq)); *offset += sizeof(time_seq); @@ -237,6 +213,11 @@ static void gen_utc_time(uint8_t *buf, int *offset) static void gen_pub_key2(const RSA_CTX *rsa_ctx, uint8_t *buf, int *offset) { + static const uint8_t pub_key_seq[] = + { + ASN1_INTEGER, 0x03, 0x01, 0x00, 0x01 /* INTEGER 65537 */ + }; + int seq_offset; int pub_key_size = rsa_ctx->num_octets; uint8_t *block = (uint8_t *)alloca(pub_key_size); @@ -272,18 +253,20 @@ static void gen_pub_key1(const RSA_CTX *rsa_ctx, uint8_t *buf, int *offset) static void gen_pub_key(const RSA_CTX *rsa_ctx, uint8_t *buf, int *offset) { + /* OBJECT IDENTIFIER rsaEncryption (1 2 840 113549 1 1 1) */ + static const uint8_t rsa_enc_oid[] = + { + ASN1_SEQUENCE, 0x0d, ASN1_OID, 0x09, + 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, + ASN1_NULL, 0x00 + }; + int seq_offset; int seq_size = pre_adjust_with_size( ASN1_SEQUENCE, &seq_offset, buf, offset); - buf[(*offset)++] = ASN1_SEQUENCE; - set_gen_length(13, buf, offset); - buf[(*offset)++] = ASN1_OID; - set_gen_length(sizeof(rsa_enc_oid), buf, offset); memcpy(&buf[*offset], rsa_enc_oid, sizeof(rsa_enc_oid)); *offset += sizeof(rsa_enc_oid); - buf[(*offset)++] = ASN1_NULL; - buf[(*offset)++] = 0; gen_pub_key1(rsa_ctx, buf, offset); adjust_with_size(seq_size, seq_offset, buf, offset); } @@ -291,6 +274,13 @@ static void gen_pub_key(const RSA_CTX *rsa_ctx, uint8_t *buf, int *offset) static void gen_signature(const RSA_CTX *rsa_ctx, const uint8_t *sha_dgst, uint8_t *buf, int *offset) { + static const uint8_t asn1_sig[] = + { + ASN1_SEQUENCE, 0x21, ASN1_SEQUENCE, 0x09, ASN1_OID, 0x05, + 0x2b, 0x0e, 0x03, 0x02, 0x1a, /* sha1 (1 3 14 3 2 26) */ + ASN1_NULL, 0x00, ASN1_OCTET_STRING, 0x14 + }; + uint8_t *enc_block = (uint8_t *)alloca(rsa_ctx->num_octets); uint8_t *block = (uint8_t *)alloca(sizeof(asn1_sig) + SHA1_SIZE); int sig_size; diff --git a/ssl/x509.c b/ssl/x509.c index 9b41b944e8..ef42e68151 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -455,6 +455,8 @@ void x509_print(const X509_CTX *cert, CA_CERT_CTX *ca_cert_ctx) { x509_print(cert->next, ca_cert_ctx); } + + TTY_FLUSH(); } const char * x509_display_error(int error) @@ -463,43 +465,33 @@ const char * x509_display_error(int error) { case X509_NOT_OK: return "X509 not ok"; - break; case X509_VFY_ERROR_NO_TRUSTED_CERT: return "No trusted cert is available"; - break; case X509_VFY_ERROR_BAD_SIGNATURE: return "Bad signature"; - break; case X509_VFY_ERROR_NOT_YET_VALID: return "Cert is not yet valid"; - break; case X509_VFY_ERROR_EXPIRED: return "Cert has expired"; - break; case X509_VFY_ERROR_SELF_SIGNED: return "Cert is self-signed"; - break; case X509_VFY_ERROR_INVALID_CHAIN: return "Chain is invalid (check order of certs)"; - break; case X509_VFY_ERROR_UNSUPPORTED_DIGEST: return "Unsupported digest"; - break; case X509_INVALID_PRIV_KEY: return "Invalid private key"; - break; default: return "Unknown"; - break; } } #endif /* CONFIG_SSL_FULL_MODE */ From d02abde904ab168c5b422cd9b4cbbb45a29a234b Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 5 Mar 2008 08:47:05 +0000 Subject: [PATCH 125/301] fixed a bigint issue git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@149 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/bigint.c | 10 +++++++--- crypto/bigint_impl.h | 4 ++-- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/crypto/bigint.c b/crypto/bigint.c index 303c20a1c1..53a5839293 100644 --- a/crypto/bigint.c +++ b/crypto/bigint.c @@ -517,7 +517,7 @@ static bigint *bi_int_divide(BI_CTX *ctx, bigint *biR, comp denom) r = (r<comps[i]; biR->comps[i] = (comp)(r / denom); r %= denom; - } while (--i != 0); + } while (--i >= 0); return trim(biR); } @@ -947,6 +947,7 @@ static bigint *regular_square(BI_CTX *ctx, bigint *bi) for (j = i+1; j < t; j++) { long_comp xx = (long_comp)x[i]*x[j]; + long_comp xx2 = 2*xx; long_comp blob = (long_comp)w[i+j]+carry; if (u) /* previous overflow */ @@ -954,13 +955,16 @@ static bigint *regular_square(BI_CTX *ctx, bigint *bi) blob += COMP_RADIX; } + u = 0; - if (xx & COMP_BIG_MSB) /* check for overflow */ + tmp = xx2 + blob; + + /* check for overflow */ + if ((COMP_MAX-xx) < xx || (COMP_MAX-xx2) < blob) { u = 1; } - tmp = 2*xx + blob; w[i+j] = (comp)tmp; carry = (comp)(tmp >> COMP_BIT_SIZE); } diff --git a/crypto/bigint_impl.h b/crypto/bigint_impl.h index c23572733e..e2d456532d 100644 --- a/crypto/bigint_impl.h +++ b/crypto/bigint_impl.h @@ -44,10 +44,10 @@ /* Architecture specific functions for big ints */ #ifdef WIN32 #define COMP_RADIX 4294967296i64 -#define COMP_BIG_MSB 0x8000000000000000i64 +#define COMP_MAX 0xFFFFFFFFFFFFFFFFi64 #else #define COMP_RADIX 4294967296ULL /**< Max component + 1 */ -#define COMP_BIG_MSB 0x8000000000000000ULL /**< (Max dbl comp + 1)/ 2 */ +#define COMP_MAX 0xFFFFFFFFFFFFFFFFULL/**< (Max dbl comp -1) */ #endif #define COMP_BIT_SIZE 32 /**< Number of bits in a component. */ #define COMP_BYTE_SIZE 4 /**< Number of bytes in a component. */ From bc1e70c101bcda48150b534cfb29c94af7929774 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Tue, 13 May 2008 11:32:33 +0000 Subject: [PATCH 126/301] v1.1.9-2 changes git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@150 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/bigint_impl.h | 2 +- crypto/crypto_misc.c | 2 +- httpd/Config.in | 14 +++++++++++ httpd/axhttpd.c | 23 ++++++++++++++++++ ssl/asn1.c | 58 ++++++++++++++++++++++++++++++++++---------- ssl/crypto_misc.h | 1 + ssl/gen_cert.c | 2 +- ssl/loader.c | 3 +-- ssl/test/ms_iis.cer | 13 ++++++++++ ssl/test/ssltest.c | 10 ++++++++ ssl/x509.c | 2 +- www/index.html | 9 ++++--- 12 files changed, 116 insertions(+), 23 deletions(-) create mode 100755 ssl/test/ms_iis.cer diff --git a/crypto/bigint_impl.h b/crypto/bigint_impl.h index e2d456532d..1483154a41 100644 --- a/crypto/bigint_impl.h +++ b/crypto/bigint_impl.h @@ -44,7 +44,7 @@ /* Architecture specific functions for big ints */ #ifdef WIN32 #define COMP_RADIX 4294967296i64 -#define COMP_MAX 0xFFFFFFFFFFFFFFFFi64 +#define COMP_MAX 0xFFFFFFFFFFFFFFFFui64 #else #define COMP_RADIX 4294967296ULL /**< Max component + 1 */ #define COMP_MAX 0xFFFFFFFFFFFFFFFFULL/**< (Max dbl comp -1) */ diff --git a/crypto/crypto_misc.c b/crypto/crypto_misc.c index 9bddee2100..59b72ec08d 100644 --- a/crypto/crypto_misc.c +++ b/crypto/crypto_misc.c @@ -127,7 +127,7 @@ EXP_FUNC void STDCALL RNG_initialize(const uint8_t *seed_buf, int size) for (i = 0; i < size/(int)sizeof(uint64_t); i++) rng_num ^= *((uint64_t *)&seed_buf[i*sizeof(uint64_t)]); - srand((long)seed_buf); /* use the stack ptr as another rnd seed */ + srand((long)&seed_buf); /* use the stack ptr as another rnd seed */ #endif } diff --git a/httpd/Config.in b/httpd/Config.in index c43eaa7776..513d57ae30 100644 --- a/httpd/Config.in +++ b/httpd/Config.in @@ -129,6 +129,20 @@ config CONFIG_HTTP_HAS_IPV6 Does not work under Win32 +config CONFIG_HTTP_ENABLE_DIFFERENT_USER + bool "Enable different user" + default n + depends on !CONFIG_PLATFORM_WIN32 + help + Allow the web server to be run as a different user + +config CONFIG_HTTP_USER + string "As User" + default "nobody" + depends on CONFIG_HTTP_ENABLE_DIFFERENT_USER + help + The user name that will be used to run axhttpd. + config CONFIG_HTTP_VERBOSE bool "Verbose Mode" default y if CONFIG_SSL_FULL_MODE diff --git a/httpd/axhttpd.c b/httpd/axhttpd.c index 23b7f6d539..35d36f64c1 100644 --- a/httpd/axhttpd.c +++ b/httpd/axhttpd.c @@ -34,6 +34,7 @@ #include #include #include +#include #include "axhttp.h" struct serverstruct *servers; @@ -186,6 +187,28 @@ int main(int argc, char *argv[]) ax_chdir(); +#ifdef CONFIG_HTTP_ENABLE_DIFFERENT_USER + { + struct passwd *pd = getpwnam(CONFIG_HTTP_USER); + + if (pd != NULL) + { + int res = setuid(pd->pw_uid); + res |= setgid(pd->pw_gid); + +#if defined(CONFIG_HTTP_VERBOSE) + if (res == 0) + { + printf("change to '%s' successful\n", CONFIG_HTTP_USER); + TTY_FLUSH(); + } +#endif + } + + } +#endif + + #ifndef WIN32 #ifdef CONFIG_HTTP_IS_DAEMON if (fork() > 0) /* parent will die */ diff --git a/ssl/asn1.c b/ssl/asn1.c index 7d4d36e173..4f2e6db240 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -40,7 +40,8 @@ #include "crypto.h" #include "crypto_misc.h" -#define SIG_OID_PREFIX_SIZE 8 +#define SIG_OID_PREFIX_SIZE 8 +#define SIG_IIS6_OID_SIZE 5 /* Must be an RSA algorithm with either SHA1 or MD5 for verifying to work */ static const uint8_t sig_oid_prefix[SIG_OID_PREFIX_SIZE] = @@ -48,6 +49,11 @@ static const uint8_t sig_oid_prefix[SIG_OID_PREFIX_SIZE] = 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01 }; +static const uint8_t sig_iis6_oid[SIG_IIS6_OID_SIZE] = +{ + 0x2b, 0x0e, 0x03, 0x02, 0x1d +}; + /* CN, O, OU */ static const uint8_t g_dn_types[] = { 3, 10, 11 }; @@ -277,16 +283,34 @@ static int asn1_get_printable_str(const uint8_t *buf, int *offset, char **str) int len = X509_NOT_OK; /* some certs have this awful crud in them for some reason */ - if (buf[*offset] != ASN1_PRINTABLE_STR && - buf[*offset] != ASN1_TELETEX_STR && buf[*offset] != ASN1_IA5_STR) + if (buf[*offset] != ASN1_PRINTABLE_STR && + buf[*offset] != ASN1_TELETEX_STR && + buf[*offset] != ASN1_IA5_STR && + buf[*offset] != ASN1_UNICODE_STR) goto end_pnt_str; - (*offset)++; - len = get_asn1_length(buf, offset); - *str = (char *)malloc(len+1); /* allow for null */ - memcpy(*str, &buf[*offset], len); - (*str)[len] = 0; /* null terminate */ - *offset += len; + (*offset)++; + len = get_asn1_length(buf, offset); + + if (buf[*offset - 1] == ASN1_UNICODE_STR) + { + int i; + *str = (char *)malloc(len/2+1); /* allow for null */ + + for (i = 0; i < len; i += 2) + (*str)[i/2] = buf[*offset + i + 1]; + + (*str)[len/2] = 0; /* null terminate */ + } + else + { + *str = (char *)malloc(len+1); /* allow for null */ + memcpy(*str, &buf[*offset], len); + (*str)[len] = 0; /* null terminate */ + } + + *offset += len; + end_pnt_str: return len; } @@ -424,7 +448,7 @@ void remove_ca_certs(CA_CERT_CTX *ca_cert_ctx) while (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) { x509_free(ca_cert_ctx->cert[i]); - ca_cert_ctx->cert[i] = NULL; + ca_cert_ctx->cert[i++] = NULL; } free(ca_cert_ctx); @@ -463,10 +487,18 @@ int asn1_signature_type(const uint8_t *cert, len = get_asn1_length(cert, offset); - if (memcmp(sig_oid_prefix, &cert[*offset], SIG_OID_PREFIX_SIZE)) - goto end_check_sig; /* unrecognised cert type */ + if (len == 5 && memcmp(sig_iis6_oid, &cert[*offset], + SIG_IIS6_OID_SIZE) == 0) + { + x509_ctx->sig_type = SIG_TYPE_SHA1; + } + else + { + if (memcmp(sig_oid_prefix, &cert[*offset], SIG_OID_PREFIX_SIZE)) + goto end_check_sig; /* unrecognised cert type */ - x509_ctx->sig_type = cert[*offset + SIG_OID_PREFIX_SIZE]; + x509_ctx->sig_type = cert[*offset + SIG_OID_PREFIX_SIZE]; + } *offset += len; asn1_skip_obj(cert, offset, ASN1_NULL); /* if it's there */ diff --git a/ssl/crypto_misc.h b/ssl/crypto_misc.h index dc1f6e1455..97cb0f2d23 100644 --- a/ssl/crypto_misc.h +++ b/ssl/crypto_misc.h @@ -109,6 +109,7 @@ const char * x509_display_error(int error); #define ASN1_TELETEX_STR 0x14 #define ASN1_IA5_STR 0x16 #define ASN1_UTC_TIME 0x17 +#define ASN1_UNICODE_STR 0x1e #define ASN1_SEQUENCE 0x30 #define ASN1_SET 0x31 #define ASN1_IMPLICIT_TAG 0x80 diff --git a/ssl/gen_cert.c b/ssl/gen_cert.c index a6dac7a4cb..94b74903ca 100644 --- a/ssl/gen_cert.c +++ b/ssl/gen_cert.c @@ -178,7 +178,7 @@ static int gen_issuer(const char * dn[], uint8_t *buf, int *offset) if (dn[X509_ORGANIZATION] != NULL && strlen(dn[X509_ORGANIZATION]) > 0) { - if ((ret = gen_dn(dn[X509_ORGANIZATIONAL_UNIT], 10, buf, offset))) + if ((ret = gen_dn(dn[X509_ORGANIZATION], 10, buf, offset))) goto error; } diff --git a/ssl/loader.c b/ssl/loader.c index a6e4d94fb0..4232f7eec0 100644 --- a/ssl/loader.c +++ b/ssl/loader.c @@ -69,8 +69,7 @@ EXP_FUNC int STDCALL ssl_obj_load(SSL_CTX *ssl_ctx, int obj_type, } ssl_obj = (SSLObjLoader *)calloc(1, sizeof(SSLObjLoader)); - ssl_obj->len = get_file(filename, &ssl_obj->buf); - + ssl_obj->len = get_file(filename, &ssl_obj->buf); if (ssl_obj->len <= 0) { ret = SSL_ERROR_INVALID_KEY; diff --git a/ssl/test/ms_iis.cer b/ssl/test/ms_iis.cer new file mode 100755 index 0000000000..250b926d68 --- /dev/null +++ b/ssl/test/ms_iis.cer @@ -0,0 +1,13 @@ +-----BEGIN CERTIFICATE----- +MIIB5jCCAVOgAwIBAgIQWPe7KyA+U7lLUohulwW2HDAJBgUrDgMCHQUAMCExHzAd +BgNVBAMTFmF4dGxzLmNlcm9jY2x1Yi5jb20uYXUwHhcNMDgwMzE3MTAyMTA2WhcN +MDkwMzE3MTAyMTA2WjAhMR8wHQYDVQQDExZheHRscy5jZXJvY2NsdWIuY29tLmF1 +MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC9JqHlQjrQMt3JW8yxcGhFagDa +D4QiIY8+KItTt13fIBt5g1AG4VXniaylSqKKYNPwVzqSWl7WhxMmoFU73veF8o4M +G0Zc5qbVB6ukrSV4WaTgHrIO6pWkyiaQ4L/eYfCo/2pByhl0IUKkf/TMN346/rFg +JgrElx01l6QHNQrzVQIDAQABoycwJTATBgNVHSUEDDAKBggrBgEFBQcDATAOBgNV +HQ8EBwMFALAAAAAwCQYFKw4DAh0FAAOBgQAbH94H1fryngROJ//Oa0D3vvTO8CJ3 +8VW+3gQEwrPBOWmN6RV8OM0dE6pf8wD3s7PTCcM5+/HI1Qk53nUGrNiOmKM1s0JB +bvsO9RT+UF8mtdbo/n30M0MHMWPCC76baW3R+ANBp/V/z4l1ytpUTt+MHvz0VlUs +J4uJA3s3uh23Tg== +-----END CERTIFICATE----- diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index c4be8966d0..f441f40384 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -638,6 +638,16 @@ static int cert_tests(void) x509_free(x509_ctx); free(buf); + + ssl_ctx = ssl_ctx_new(0, 0); + if ((res = ssl_obj_load(ssl_ctx, + SSL_OBJ_X509_CERT, "../ssl/test/ms_iis.cer", NULL)) != SSL_OK) + { + ssl_display_error(res); + goto bad_cert; + } + + ssl_ctx_free(ssl_ctx); res = 0; /* all ok */ printf("All Certificate tests passed\n"); diff --git a/ssl/x509.c b/ssl/x509.c index ef42e68151..bd25da61ca 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -292,7 +292,7 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) } /* trusted cert not found */ - if (i >= CONFIG_X509_MAX_CA_CERTS) + if (match_ca_cert == 0) { ret = X509_VFY_ERROR_NO_TRUSTED_CERT; goto end_verify; diff --git a/www/index.html b/www/index.html index a43bd65983..1b9c8790f0 100755 --- a/www/index.html +++ b/www/index.html @@ -7086,17 +7086,18 @@
    changes, notes and errata
    -
    !@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programmatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    Type the text for 'YourName'
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    -
    axTLS uses a BSD style license:\n\nCopyright (c) 2007, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    +
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    <div class='header' macro='gradient vert #390108 #900'>\n<div class='headerShadow'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n<div class='headerForeground'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n</div>\n<div id='mainMenu'>\n<div refresh='content' tiddler='MainMenu'></div>\n</div>\n<div id='sidebar'>\n<div id='sidebarOptions' refresh='content' tiddler='SideBarOptions'></div>\n<div id='sidebarTabs' refresh='content' force='true' tiddler='SideBarTabs'></div>\n</div>\n<div id='displayArea'>\n<div id='messageArea'></div>\n<div id='tiddlerDisplay'></div>\n</div>
    -
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n* axssl.lua - Lua sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!!!!Lua\n\n{{indent{{{{> [lua] ./axssl.lua <options>}}}\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n* The lua sample requires the luabit library from http://luaforge.net/projects/bit.\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* CGI has been removed from Win32 - it needs a lot more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    +
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n* axssl.lua - Lua sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!!!!Lua\n\n{{indent{{{{> [lua] ./axssl.lua <options>}}}\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n* The lua sample requires the luabit library from http://luaforge.net/projects/bit.\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* CGI has been removed from Win32 - it needs a lot more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    changes, notes and errata
    axTLS Embedded SSL
    http://axtls.cerocclub.com.au
    /***\nhttp://tiddlystyles.com/#theme:DevFire\nAuthor: Clint Checketts\n***/\n\n/*{{{*/\nbody {\nbackground: #000;\n}\n/*}}}*/\n/***\n!Link styles /% ============================================================= %/\n***/\n/*{{{*/\na,\na.button,\n#mainMenu a.button,\n#sidebarOptions .sliderPanel a{\n color: #ffbf00;\n border: 0;\n background: transparent;\n}\n\na:hover,\na.button:hover,\n#mainMenu a.button:hover,\n#sidebarOptions .sliderPanel a:hover\n#sidebarOptions .sliderPanel a:active{\n color: #ff7f00;\n border: 0;\n border-bottom: #ff7f00 1px dashed;\n background: transparent;\n text-decoration: none;\n}\n\n#displayArea .button.highlight{\n color: #ffbf00;\n background: #4c4c4c;\n}\n/*}}}*/\n/***\n!Header styles /% ============================================================= %/\n***/\n/*{{{*/\n.header{\n border-bottom: 2px solid #ffbf00;\n color: #fff;\n}\n\n.headerForeground a {\n color: #fff;\n}\n\n.header a:hover {\n border-bottom: 1px dashed #fff;\n}\n/*}}}*/\n/***\n!Main menu styles /% ============================================================= %/\n***/\n/*{{{*/\n#mainMenu {color: #fff;}\n#mainMenu h1{\n font-size: 1.1em;\n}\n#mainMenu li,#mainMenu ul{\n list-style: none;\n margin: 0;\n padding: 0;\n}\n/*}}}*/\n/***\n!Sidebar styles /% ============================================================= %/\n***/\n/*{{{*/\n#sidebar {\n right: 0;\n color: #fff;\n border: 2px solid #ffbf00;\n border-width: 0 0 2px 2px;\n}\n#sidebarOptions {\n background-color: #4c4c4c;\n padding: 0;\n}\n\n#sidebarOptions a{\n margin: 0;\n color: #ffbf00;\n border: 0;\n}\n#sidebarOptions a:hover {\n color: #4c4c4c;\n background-color: #ffbf00;\n\n}\n\n#sidebarOptions a:active {\n color: #ffbf00;\n background-color: transparent;\n}\n\n#sidebarOptions .sliderPanel {\n background-color: #333;\n margin: 0;\n}\n\n#sidebarTabs {background-color: #4c4c4c;}\n#sidebarTabs .tabSelected {\n padding: 3px 3px;\n cursor: default;\n color: #ffbf00;\n background-color: #666;\n}\n#sidebarTabs .tabUnselected {\n color: #ffbf00;\n background-color: #5f5f5f;\n padding: 0 4px;\n}\n\n#sidebarTabs .tabUnselected:hover,\n#sidebarTabs .tabContents {\n background-color: #666;\n}\n\n.listTitle{color: #FFF;}\n#sidebarTabs .tabContents a{\n color: #ffbf00;\n}\n\n#sidebarTabs .tabContents a:hover{\n color: #ff7f00;\n background: transparent;\n}\n\n#sidebarTabs .txtMoreTab .tabSelected,\n#sidebarTabs .txtMoreTab .tab:hover,\n#sidebarTabs .txtMoreTab .tabContents{\n color: #ffbf00;\n background: #4c4c4c;\n}\n\n#sidebarTabs .txtMoreTab .tabUnselected {\n color: #ffbf00;\n background: #5f5f5f;\n}\n\n.tab.tabSelected, .tab.tabSelected:hover{color: #ffbf00; border: 0; background-color: #4c4c4c;cursor:default;}\n.tab.tabUnselected {background-color: #666;}\n.tab.tabUnselected:hover{color:#ffbf00; border: 0;background-color: #4c4c4c;}\n.tabContents {\n background-color: #4c4c4c;\n border: 0;\n}\n.tabContents .tabContents{background: #666;}\n.tabContents .tabSelected{background: #666;}\n.tabContents .tabUnselected{background: #5f5f5f;}\n.tabContents .tab:hover{background: #666;}\n/*}}}*/\n/***\n!Message area styles /% ============================================================= %/\n***/\n/*{{{*/\n#messageArea {background-color: #666; color: #fff; border: 2px solid #ffbf00;}\n#messageArea a:link, #messageArea a:visited {color: #ffbf00; text-decoration:none;}\n#messageArea a:hover {color: #ff7f00;}\n#messageArea a:active {color: #ff7f00;}\n#messageArea .messageToolbar a{\n border: 1px solid #ffbf00;\n background: #4c4c4c;\n}\n/*}}}*/\n/***\n!Popup styles /% ============================================================= %/\n***/\n/*{{{*/\n.popup {color: #fff; background-color: #4c4c4c; border: 1px solid #ffbf00;}\n.popup li.disabled{color: #fff;}\n.popup a {color: #ffbf00; }\n.popup a:hover { background: transparent; color: #ff7f00; border: 0;}\n.popup hr {color: #ffbf00; background: #ffbf00;}\n/*}}}*/\n/***\n!Tiddler Display styles /% ============================================================= %/\n***/\n/*{{{*/\n.title{color: #fff;}\nh1, h2, h3, h4, h5 {\n color: #fff;\n background-color: transparent;\n border-bottom: 1px solid #333;\n}\n\n.subtitle{\n color: #666;\n}\n\n.viewer {color: #fff; }\n\n.viewer table{background: #666; color: #fff;}\n\n.viewer th {background-color: #996; color: #fff;}\n\n.viewer pre, .viewer code {color: #ddd; background-color: #4c4c4c; border: 1px solid #ffbf00;}\n\n.viewer hr {color: #666;}\n\n.tiddler .button {color: #4c4c4c;}\n.tiddler .button:hover { color: #ffbf00; background-color: #4c4c4c;}\n.tiddler .button:active {color: #ffbf00; background-color: #4c4c4c;}\n\n.toolbar {\n color: #4c4c4c;\n}\n\n.toolbar a.button,\n.toolbar a.button:hover,\n.toolbar a.button:active,\n.editorFooter a{\n border: 0;\n}\n\n.footer {\n color: #ddd;\n}\n\n.selected .footer {\n color: #888;\n}\n\n.highlight, .marked {\n color: #000;\n background-color: #ffe72f;\n}\n.editorFooter {\n color: #aaa;\n}\n\n.tab{\n-moz-border-radius-topleft: 3px;\n-moz-border-radius-topright: 3px;\n}\n\n.tagging,\n.tagged{\n background: #4c4c4c;\n border: 1px solid #4c4c4c; \n}\n\n.selected .tagging,\n.selected .tagged{\n background-color: #333;\n border: 1px solid #ffbf00;\n}\n\n.tagging .listTitle,\n.tagged .listTitle{\n color: #fff;\n}\n\n.tagging .button,\n.tagged .button{\n color: #ffbf00;\n border: 0;\n padding: 0;\n}\n\n.tagging .button:hover,\n.tagged .button:hover{\nbackground: transparent;\n}\n\n.selected .isTag .tagging.simple,\n.selected .tagged.simple,\n.isTag .tagging.simple,\n.tagged.simple {\n float: none;\n display: inline;\n border: 0;\n background: transparent;\n color: #fff;\n margin: 0;\n}\n\n.cascade {\n background: #4c4c4c;\n color: #ddd;\n border: 1px solid #ffbf00;\n}\n/*}}}*/
    -
    axhttpd is a small embedded web server using the axTLS library. It is based originally on the web server written by Doug Currie which is at http://www.hcsw.org/awhttpd.\n\n!@@bgcolor(#ff0000):color(#ffffff):axhttpd Features@@ \n\n!!__Basic Authentication__\n\nBasic Authentication uses a password file called ".htpasswd", in the directory to be protected. This file is formatted as the familiar colon-separated username/encrypted-password pair, records delimited by newlines. The protection does not carry over to subdirectories. The utility program htpasswd is included to help manually edit .htpasswd files.\n\nThe encryption of this password uses a proprietary algorithm due to the dependency of many crypt libraries on DES. An example is in [[/test_dir/no_http|https://127.0.0.1/test_dir/no_http]] (username 'abcd', password is '1234').\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__SSL Protection__\n\nDirectories/files can be accessed using the 'http' or 'https' uri prefix. If normal http access for a directory needs to be disabled, then put "~SSLRequireSSL" into a '.htaccess' file in the directory to be protected. \n\nConversely, use "~SSLDenySSL" to deny access to directories via SSL.\n\nAn example is in [[/test_dir/no_http|http://127.0.0.1/test_dir/no_http]] and [[/test_dir/no_ssl|https://127.0.0.1/test_dir/no_ssl]].\n\nEntire directories can be denied access with a "Deny all" directive (regardless of SSL or authentication). An example is in [[/test_dir/bin|http://127.0.0.1/test_dir/bin]]\n\n!!__CGI__\n\n//chroot()// is optionally now used for added security. However this has the impact of removing the regular filesystem, so any CGI applications no longer have the usual access (to things like /bin, /lib etc). Any executables and libraries need to be copied into webroot.\n\nMost of the CGI 1.1 variables are now placed into the script environment and should work as normal.\n\n!!__Lua and Lua Pages__\n\nThis is a small scripting language gaining popularity in embedded applications due to its small footprint and fast speed.\n\nLua has been incorporated into the build, so simply select it and it will automatically install. Try pointing your browser at [[test_main.html]|http://127.0.0.1/lua/test_main.html]] to see an example of Lua Pages.\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__Directory Listing__\n\nAn mconf option. Allow the files in directories to be displayed. An example is in [[/test_dir|http://127.0.0.1/test_dir]]\n\n!!__Other Features__\n\n* Timeout - HTTP 1.1 allows for persistent connections. This is the time allowed for this connection in seconds.\n* Daemon - Puts the process in daemon mode. \n* SSL session cache size - The size of the session cache (a heavily loaded server should maintain many sessions). A session will save on expensive SSL handshaking.\n\n
    +
    axhttpd is a small embedded web server using the axTLS library. It is based originally on the web server written by Doug Currie which is at http://www.hcsw.org/awhttpd.\n\n!@@bgcolor(#ff0000):color(#ffffff):axhttpd Features@@ \n\n!!__Basic Authentication__\n\nBasic Authentication uses a password file called ".htpasswd", in the directory to be protected. This file is formatted as the familiar colon-separated username/encrypted-password pair, records delimited by newlines. The protection does not carry over to subdirectories. The utility program htpasswd is included to help manually edit .htpasswd files.\n\nThe encryption of this password uses a proprietary algorithm due to the dependency of many crypt libraries on DES. An example is in [[/test_dir/no_http|https://127.0.0.1/test_dir/no_http]] (username 'abcd', password is '1234').\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__SSL Protection__\n\nDirectories/files can be accessed using the 'http' or 'https' uri prefix. If normal http access for a directory needs to be disabled, then put "~SSLRequireSSL" into a '.htaccess' file in the directory to be protected. \n\nConversely, use "~SSLDenySSL" to deny access to directories via SSL.\n\nAn example is in [[/test_dir/no_http|http://127.0.0.1/test_dir/no_http]] and [[/test_dir/no_ssl|https://127.0.0.1/test_dir/no_ssl]].\n\nEntire directories can be denied access with a "Deny all" directive (regardless of SSL or authentication). An example is in [[/test_dir/bin|http://127.0.0.1/test_dir/bin]]\n\n!!__CGI__\n\nMost of the CGI 1.1 variables are now placed into the script environment and should work as normal.\n\n!!__Lua and Lua Pages__\n\nThis is a small scripting language gaining popularity in embedded applications due to its small footprint and fast speed.\n\nLua has been incorporated into the build, so simply select it and it will automatically install. Try pointing your browser at [[test_main.html]|http://127.0.0.1/lua/test_main.html]] to see an example of Lua Pages.\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__Directory Listing__\n\nAn mconf option. Allow the files in directories to be displayed. An example is in [[/test_dir|http://127.0.0.1/test_dir]]\n\n!!__Other Features__\n\n* Timeout - HTTP 1.1 allows for persistent connections. This is the time allowed for this connection in seconds.\n* Daemon - Puts the process in daemon mode. \n* SSL session cache size - The size of the session cache (a heavily loaded server should maintain many sessions). A session will save on expensive SSL handshaking.\n\n
    From 0abda1ca6477307c1b22a8aa71d1364506e2b10e Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 5 Nov 2008 12:01:50 +0000 Subject: [PATCH 127/301] changed x509 verification code git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@151 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/proc.c | 7 ++- ssl/test/ssltest.c | 66 ++++++++++++++++++---- ssl/tls1.c | 19 +------ ssl/tls1_svr.c | 6 ++ ssl/x509.c | 136 ++++++++++++++++++++++----------------------- www/index.html | 2 +- 6 files changed, 137 insertions(+), 99 deletions(-) diff --git a/httpd/proc.c b/httpd/proc.c index 30a2ee21c6..3c897c98b0 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2007, Cameron Rich + * Copyright (c) 2007-2008, Cameron Rich * * All rights reserved. * @@ -137,6 +137,11 @@ static int procheadelem(struct connstruct *cn, char *buf) { cn->if_modified_since = tdate_parse(value); } + else if (strcmp(buf, "Expect:") == 0) + { + send_error(cn, 417); /* expectation failed */ + return 0; + } #ifdef CONFIG_HTTP_HAS_AUTHORIZATION else if (strcmp(buf, "Authorization:") == 0 && strncmp(value, "Basic ", 6) == 0) diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index f441f40384..d525e1a686 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -770,7 +770,7 @@ static int SSL_server_test( const char *private_key, const char *ca_cert, const char *password, - int axolotls_option) + int axtls_option) { int server_fd, ret = 0; SSL_CTX *ssl_ctx = NULL; @@ -791,10 +791,10 @@ static int SSL_server_test( if (private_key) { - axolotls_option |= SSL_NO_DEFAULT_KEY; + axtls_option |= SSL_NO_DEFAULT_KEY; } - if ((ssl_ctx = ssl_ctx_new(axolotls_option, SSL_DEFAULT_SVR_SESS)) == NULL) + if ((ssl_ctx = ssl_ctx_new(axtls_option, SSL_DEFAULT_SVR_SESS)) == NULL) { ret = SSL_ERROR_INVALID_KEY; goto error; @@ -1012,7 +1012,7 @@ int SSL_server_tests(void) /* this test should fail */ if (stat("../ssl/test/axTLS.x509_bad_before.pem", &stat_buf) >= 0) { - if ((ret = SSL_server_test("Bad Before Cert", + if ((ret = SSL_server_test("Error: Bad Before Cert", "-cipher RC4-SHA -tls1 " "-cert ../ssl/test/axTLS.x509_bad_before.pem " "-key ../ssl/test/axTLS.key_512.pem ", @@ -1028,7 +1028,7 @@ int SSL_server_tests(void) } /* this test should fail */ - if ((ret = SSL_server_test("Bad After Cert", + if ((ret = SSL_server_test("Error: Bad After Cert", "-cipher RC4-SHA -tls1 " "-cert ../ssl/test/axTLS.x509_bad_after.pem " "-key ../ssl/test/axTLS.key_512.pem ", @@ -1041,6 +1041,53 @@ int SSL_server_tests(void) printf("SSL server test \"%s\" passed\n", "Bad After Cert"); TTY_FLUSH(); + /* + * No trusted cert + */ + if ((ret = SSL_server_test("Error: No trusted certificate", + "-cipher RC4-SHA -tls1 " + "-cert ../ssl/test/axTLS.x509_512.pem " + "-key ../ssl/test/axTLS.key_512.pem ", + NULL, NULL, NULL, + NULL, NULL, + DEFAULT_SVR_OPTION|SSL_CLIENT_AUTHENTICATION)) != + SSL_X509_ERROR(X509_VFY_ERROR_NO_TRUSTED_CERT)) + goto cleanup; + + printf("SSL server test \"%s\" passed\n", "No trusted certificate"); + TTY_FLUSH(); + + /* + * Self-signed (from the server) + */ + if ((ret = SSL_server_test("Error: Self-signed certificate (from server)", + "-cipher RC4-SHA -tls1 " + "-cert ../ssl/test/axTLS.x509_512.pem " + "-key ../ssl/test/axTLS.key_512.pem " + "-CAfile ../ssl/test/axTLS.ca_x509.pem ", + NULL, NULL, NULL, + NULL, NULL, + DEFAULT_SVR_OPTION|SSL_CLIENT_AUTHENTICATION)) != + SSL_X509_ERROR(X509_VFY_ERROR_SELF_SIGNED)) + goto cleanup; + + printf("SSL server test \"%s\" passed\n", + "Self-signed certificate (from server)"); + TTY_FLUSH(); + + /* + * Self-signed (from the client) + */ + if ((ret = SSL_server_test("Self-signed certificate (from client)", + "-cipher RC4-SHA -tls1 " + "-cert ../ssl/test/axTLS.x509_512.pem " + "-key ../ssl/test/axTLS.key_512.pem ", + NULL, NULL, NULL, + "../ssl/test/axTLS.ca_x509.cer", + NULL, + DEFAULT_SVR_OPTION|SSL_CLIENT_AUTHENTICATION))) + goto cleanup; + /* * Key in PEM format */ @@ -1434,13 +1481,12 @@ int SSL_client_tests(void) "-CAfile ../ssl/test/axTLS.ca_x509.pem " "-verify 1 ", NULL, DEFAULT_CLNT_OPTION, "../ssl/test/axTLS.key_1024", NULL, - "../ssl/test/axTLS.x509_1024.cer")) - != SSL_X509_ERROR(X509_VFY_ERROR_SELF_SIGNED)) + "../ssl/test/axTLS.x509_1024.cer"))) goto cleanup; /* Should get an "ERROR" from openssl (as the handshake fails as soon as * the certificate verification fails) */ - if ((ret = SSL_client_test("Expired cert (verify now) should fail!", + if ((ret = SSL_client_test("Error: Expired cert (verify now)", &ssl_ctx, "-cert ../ssl/test/axTLS.x509_bad_after.pem " "-key ../ssl/test/axTLS.key_512.pem", NULL, @@ -1452,10 +1498,9 @@ int SSL_client_tests(void) } printf("SSL client test \"Expired cert (verify now)\" passed\n"); - ret = 0; /* There is no "ERROR" from openssl */ - if ((ret = SSL_client_test("Expired cert (verify later) should fail!", + if ((ret = SSL_client_test("Error: Expired cert (verify later)", &ssl_ctx, "-cert ../ssl/test/axTLS.x509_bad_after.pem " "-key ../ssl/test/axTLS.key_512.pem", NULL, @@ -1467,7 +1512,6 @@ int SSL_client_tests(void) } printf("SSL client test \"Expired cert (verify later)\" passed\n"); - ret = 0; cleanup: diff --git a/ssl/tls1.c b/ssl/tls1.c index c98cd7a5f9..24710b9236 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -386,7 +386,6 @@ int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) int ret = SSL_ERROR_NO_CERT_DEFINED; int i = 0; int offset; - X509_CTX *cert = NULL; CA_CERT_CTX *ca_cert_ctx; if (ssl_ctx->ca_cert_ctx == NULL) @@ -409,22 +408,6 @@ int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) if ((ret = x509_new(buf, &offset, &ca_cert_ctx->cert[i]))) goto error; - /* make sure the cert is valid */ - cert = ca_cert_ctx->cert[i]; - SSL_CTX_LOCK(ssl_ctx->mutex); - - if ((ret = x509_verify(ca_cert_ctx, cert)) != X509_VFY_ERROR_SELF_SIGNED) - { - SSL_CTX_UNLOCK(ssl_ctx->mutex); - x509_free(cert); /* get rid of it */ - ca_cert_ctx->cert[i] = NULL; -#ifdef CONFIG_SSL_FULL_MODE - printf("Error: %s\n", x509_display_error(ret)); TTY_FLUSH(); -#endif - goto error; - } - - SSL_CTX_UNLOCK(ssl_ctx->mutex); len -= offset; ret = SSL_OK; /* ok so far */ @@ -1751,6 +1734,7 @@ int process_certificate(SSL *ssl, X509_CTX **x509_ctx) goto error; } + DISPLAY_CERT(ssl, *chain); chain = &((*chain)->next); offset += cert_size; } @@ -1763,7 +1747,6 @@ int process_certificate(SSL *ssl, X509_CTX **x509_ctx) ret = ssl_verify_cert(ssl); } - DISPLAY_CERT(ssl, *x509_ctx); ssl->next_state = is_client ? HS_SERVER_HELLO_DONE : HS_CLIENT_KEY_XCHG; ssl->dc->bm_proc_index += offset; error: diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index 3a79c31c94..6f5dedddf3 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -378,6 +378,12 @@ static int process_client_key_xchg(SSL *ssl) int offset = 4; int ret = SSL_OK; + if (rsa_ctx == NULL) + { + ret = SSL_ERROR_NO_CERT_DEFINED; + goto error; + } + DISPLAY_RSA(ssl, rsa_ctx); /* is there an extra size field? */ diff --git a/ssl/x509.c b/ssl/x509.c index bd25da61ca..db8fda6c4c 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -251,11 +251,11 @@ static bigint *sig_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, * Do some basic checks on the certificate chain. * * Certificate verification consists of a number of checks: - * - A root certificate exists in the certificate store. * - The date of the certificate is after the start date. * - The date of the certificate is before the finish date. - * - The certificate chain is valid. + * - A root certificate exists in the certificate store. * - That the certificate(s) are not self-signed. + * - The certificate chain is valid. * - The signature of the certificate is valid. */ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) @@ -263,44 +263,26 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) int ret = X509_OK, i = 0; bigint *cert_sig; X509_CTX *next_cert = NULL; - BI_CTX *ctx; + BI_CTX *ctx = NULL; bigint *mod = NULL, *expn = NULL; - struct timeval tv; int match_ca_cert = 0; + struct timeval tv; uint8_t is_self_signed = 0; - if (cert == NULL || ca_cert_ctx == NULL) + if (cert == NULL) { ret = X509_VFY_ERROR_NO_TRUSTED_CERT; goto end_verify; } - /* last cert in the chain - look for a trusted cert */ - if (cert->next == NULL && ca_cert_ctx) - { - while (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) - { - if (asn1_compare_dn(cert->ca_cert_dn, - ca_cert_ctx->cert[i]->cert_dn) == 0) - { - match_ca_cert = 1; - next_cert = ca_cert_ctx->cert[i]; - break; - } - - i++; - } - - /* trusted cert not found */ - if (match_ca_cert == 0) - { - ret = X509_VFY_ERROR_NO_TRUSTED_CERT; - goto end_verify; - } - } - else + /* a self-signed certificate that is not in the CA store - use this + to check the signature */ + if (asn1_compare_dn(cert->ca_cert_dn, cert->cert_dn) == 0) { - next_cert = cert->next; + is_self_signed = 1; + ctx = cert->rsa_ctx->bi_ctx; + mod = cert->rsa_ctx->m; + expn = cert->rsa_ctx->e; } gettimeofday(&tv, NULL); @@ -319,61 +301,76 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) goto end_verify; } - ctx = cert->rsa_ctx->bi_ctx; + next_cert = cert->next; - /* check for self-signing */ - if (asn1_compare_dn(cert->ca_cert_dn, cert->cert_dn) == 0) + /* last cert in the chain - look for a trusted cert */ + if (next_cert == NULL) { - is_self_signed = 1; - mod = cert->rsa_ctx->m; - expn = cert->rsa_ctx->e; + if (ca_cert_ctx != NULL) + { + /* go thu the CA store */ + while (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) + { + if (asn1_compare_dn(cert->ca_cert_dn, + ca_cert_ctx->cert[i]->cert_dn) == 0) + { + /* use this CA certificate for signature verification */ + match_ca_cert = 1; + ctx = ca_cert_ctx->cert[i]->rsa_ctx->bi_ctx; + mod = ca_cert_ctx->cert[i]->rsa_ctx->m; + expn = ca_cert_ctx->cert[i]->rsa_ctx->e; + break; + } + + i++; + } + } + + /* couldn't find a trusted cert (& let self-signed errors be returned) */ + if (!match_ca_cert && !is_self_signed) + { + ret = X509_VFY_ERROR_NO_TRUSTED_CERT; + goto end_verify; + } + } + else if (asn1_compare_dn(cert->ca_cert_dn, next_cert->cert_dn) != 0) + { + /* check the chain */ + ret = X509_VFY_ERROR_INVALID_CHAIN; + goto end_verify; } - else if (next_cert != NULL) + else /* use the next certificate in the chain for signature verify */ { + ctx = next_cert->rsa_ctx->bi_ctx; mod = next_cert->rsa_ctx->m; expn = next_cert->rsa_ctx->e; + } - /* check the chain integrity */ - if (asn1_compare_dn(cert->ca_cert_dn, next_cert->cert_dn) != 0) - { - ret = X509_VFY_ERROR_INVALID_CHAIN; - goto end_verify; - } + /* cert is self signed */ + if (!match_ca_cert && is_self_signed) + { + ret = X509_VFY_ERROR_SELF_SIGNED; + goto end_verify; } /* check the signature */ - if (mod != NULL) - { - cert_sig = sig_verify(ctx, cert->signature, cert->sig_len, - bi_clone(ctx, mod), bi_clone(ctx, expn)); + cert_sig = sig_verify(ctx, cert->signature, cert->sig_len, + bi_clone(ctx, mod), bi_clone(ctx, expn)); - if (cert_sig && cert->digest) - { - if (bi_compare(cert_sig, cert->digest)) - { - ret = X509_VFY_ERROR_BAD_SIGNATURE; - } + if (cert_sig && cert->digest) + { + if (bi_compare(cert_sig, cert->digest) != 0) + ret = X509_VFY_ERROR_BAD_SIGNATURE; - bi_free(ctx, cert_sig); - if (ret) - goto end_verify; - } - else - { - ret = X509_VFY_ERROR_BAD_SIGNATURE; - goto end_verify; - } + bi_free(ctx, cert_sig); } - if (is_self_signed) - { - ret = X509_VFY_ERROR_SELF_SIGNED; + if (ret) goto end_verify; - } /* go down the certificate chain using recursion. */ - if (ret == 0 && cert->next) + if (next_cert != NULL) { ret = x509_verify(ca_cert_ctx, next_cert); } @@ -441,7 +438,7 @@ void x509_print(const X509_CTX *cert, CA_CERT_CTX *ca_cert_ctx) if (ca_cert_ctx) { - printf("Verify:\t\t\t%s\n", + printf("Verify:\t\t\t\t%s\n", x509_display_error(x509_verify(ca_cert_ctx, cert))); } @@ -463,6 +460,9 @@ const char * x509_display_error(int error) { switch (error) { + case X509_OK: + return "Certificate verify successful"; + case X509_NOT_OK: return "X509 not ok"; diff --git a/www/index.html b/www/index.html index 1b9c8790f0..aef66de8fa 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 85e157927a327ac041d4d63b01fc97b944c6ffba Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 3 Dec 2008 09:36:59 +0000 Subject: [PATCH 128/301] double check on a bad signature git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@152 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/tls1.c | 2 +- ssl/x509.c | 4 ++++ www/index.html | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/ssl/tls1.c b/ssl/tls1.c index 24710b9236..9f6508c74c 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -1734,7 +1734,7 @@ int process_certificate(SSL *ssl, X509_CTX **x509_ctx) goto error; } - DISPLAY_CERT(ssl, *chain); + /* DISPLAY_CERT(ssl, *chain); */ chain = &((*chain)->next); offset += cert_size; } diff --git a/ssl/x509.c b/ssl/x509.c index db8fda6c4c..37db7f4e81 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -365,6 +365,10 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) bi_free(ctx, cert_sig); } + else + { + ret = X509_VFY_ERROR_BAD_SIGNATURE; + } if (ret) goto end_verify; diff --git a/www/index.html b/www/index.html index aef66de8fa..b267ec40b3 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 86f2e470e09c88590c4c56a72bb2f914a1e623f3 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 29 Jan 2009 10:38:57 +0000 Subject: [PATCH 129/301] fixed issue with certificate verification on firefox. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@153 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/makefile.conf | 1 + httpd/Makefile | 2 +- samples/c/Makefile | 2 +- ssl/tls1_svr.c | 8 +++----- 4 files changed, 6 insertions(+), 7 deletions(-) diff --git a/config/makefile.conf b/config/makefile.conf index cc06e97f53..9f9db13301 100644 --- a/config/makefile.conf +++ b/config/makefile.conf @@ -81,6 +81,7 @@ else # Not Win32 CFLAGS += -I$(AXTLS_HOME)/config -I$(AXTLS_HOME)/ssl -I$(AXTLS_HOME)/crypto LD=$(CC) +STRIP=strip # Solaris ifdef CONFIG_PLATFORM_SOLARIS diff --git a/httpd/Makefile b/httpd/Makefile index b37c9819b6..b8c18d2445 100644 --- a/httpd/Makefile +++ b/httpd/Makefile @@ -97,7 +97,7 @@ ifndef CONFIG_PLATFORM_WIN32 $(TARGET): $(OBJ) $(AXTLS_HOME)/$(STAGE)/libaxtls.a $(LD) $(LDFLAGS) -o $@ $(OBJ) $(LIBS) ifdef CONFIG_STRIP_UNWANTED_SECTIONS - strip --remove-section=.comment $(TARGET) + $(STRIP) --remove-section=.comment $(TARGET) endif $(TARGET2): htpasswd.o $(AXTLS_HOME)/$(STAGE)/libaxtls.a diff --git a/samples/c/Makefile b/samples/c/Makefile index f0a9d0ec03..17cf9e7c12 100644 --- a/samples/c/Makefile +++ b/samples/c/Makefile @@ -61,7 +61,7 @@ ifndef CONFIG_PLATFORM_WIN32 $(TARGET): $(OBJ) $(LIBS)/libaxtls.a $(LD) $(LDFLAGS) -o $@ $(OBJ) -L$(LIBS) -laxtls ifdef CONFIG_STRIP_UNWANTED_SECTIONS - strip --remove-section=.comment $(TARGET) + $(STRIP) --remove-section=.comment $(TARGET) endif # use strip else # Win32 diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index 6f5dedddf3..45b9bec6a6 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -370,7 +370,7 @@ static int send_server_hello_done(SSL *ssl) */ static int process_client_key_xchg(SSL *ssl) { - uint8_t *buf = ssl->bm_data; + uint8_t *buf = &ssl->bm_data[ssl->dc->bm_proc_index]; int pkt_size = ssl->bm_index; int premaster_size, secret_length = (buf[2] << 8) + buf[3]; uint8_t premaster_secret[MAX_KEY_BYTE_SIZE]; @@ -384,8 +384,6 @@ static int process_client_key_xchg(SSL *ssl) goto error; } - DISPLAY_RSA(ssl, rsa_ctx); - /* is there an extra size field? */ if ((secret_length - 2) == rsa_ctx->num_octets) offset += 2; @@ -419,6 +417,7 @@ static int process_client_key_xchg(SSL *ssl) ssl->next_state = HS_FINISHED; #endif error: + ssl->dc->bm_proc_index += rsa_ctx->num_octets+offset; return ret; } @@ -440,7 +439,7 @@ static int send_certificate_request(SSL *ssl) */ static int process_cert_verify(SSL *ssl) { - uint8_t *buf = ssl->bm_data; + uint8_t *buf = &ssl->bm_data[ssl->dc->bm_proc_index]; int pkt_size = ssl->bm_index; uint8_t dgst_buf[MAX_KEY_BYTE_SIZE]; uint8_t dgst[MD5_SIZE+SHA1_SIZE]; @@ -449,7 +448,6 @@ static int process_cert_verify(SSL *ssl) int n; PARANOIA_CHECK(pkt_size, x509_ctx->rsa_ctx->num_octets+6); - DISPLAY_RSA(ssl, x509_ctx->rsa_ctx); /* rsa_ctx->bi_ctx is not thread-safe */ From 1b9a2cad7bea790789b8384a65668efc5972d5df Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 30 Jan 2009 12:35:07 +0000 Subject: [PATCH 130/301] Extended the openssl compatibility layer a bit. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@154 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/openssl.c | 111 ++++++++++++++++++++++++++++++++++++++++++++++--- ssl/tls1.c | 16 +++---- ssl/tls1.h | 12 +++--- www/index.html | 2 +- 4 files changed, 120 insertions(+), 21 deletions(-) diff --git a/ssl/openssl.c b/ssl/openssl.c index 712e133820..b6b955008b 100644 --- a/ssl/openssl.c +++ b/ssl/openssl.c @@ -46,6 +46,8 @@ #define OPENSSL_CTX_ATTR ((OPENSSL_CTX *)ssl_ctx->bonus_attr) +static char *key_password = NULL; + void *SSLv23_server_method(void) { return NULL; } void *SSLv3_server_method(void) { return NULL; } void *TLSv1_server_method(void) { return NULL; } @@ -155,7 +157,7 @@ int SSL_CTX_use_certificate_file(SSL_CTX *ssl_ctx, const char *file, int type) int SSL_CTX_use_PrivateKey_file(SSL_CTX *ssl_ctx, const char *file, int type) { - return (ssl_obj_load(ssl_ctx, SSL_OBJ_RSA_KEY, file, NULL) == SSL_OK); + return (ssl_obj_load(ssl_ctx, SSL_OBJ_RSA_KEY, file, key_password) == SSL_OK); } int SSL_CTX_use_certificate_ASN1(SSL_CTX *ssl_ctx, int len, const uint8_t *d) @@ -164,13 +166,109 @@ int SSL_CTX_use_certificate_ASN1(SSL_CTX *ssl_ctx, int len, const uint8_t *d) SSL_OBJ_X509_CERT, d, len, NULL) == SSL_OK); } -#if 0 -const uint8_t *SSL_get_session(const SSL *ssl) +int SSL_CTX_set_session_id_context(SSL_CTX *ctx, const unsigned char *sid_ctx, + unsigned int sid_ctx_len) { - /* TODO: return SSL_SESSION type */ - return ssl_get_session_id(ssl); + return 1; +} + +int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx) +{ + return 1; +} + +int SSL_CTX_use_certificate_chain_file(SSL_CTX *ssl_ctx, const char *file) +{ + return (ssl_obj_load(ssl_ctx, + SSL_OBJ_X509_CERT, file, NULL) == SSL_OK); +} + +int SSL_shutdown(SSL *ssl) +{ + return 1; +} + +/*** get/set session ***/ +SSL_SESSION *SSL_get1_session(SSL *ssl) +{ + return (SSL_SESSION *)ssl_get_session_id(ssl); /* note: wrong cast */ +} + +int SSL_set_session(SSL *ssl, SSL_SESSION *session) +{ + memcpy(ssl->session_id, (uint8_t *)session, SSL_SESSION_ID_SIZE); + return 1; +} + +void SSL_SESSION_free(SSL_SESSION *session) { } +/*** end get/set session ***/ + +long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg) +{ + return 0; +} + +void SSL_CTX_set_verify(SSL_CTX *ctx, int mode, + int (*verify_callback)(int, void *)) { } + +void SSL_CTX_set_verify_depth(SSL_CTX *ctx,int depth) { } + +int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile, + const char *CApath) +{ + return 1; } -#endif + +void *SSL_load_client_CA_file(const char *file) +{ + return (void *)file; +} + +void SSL_CTX_set_client_CA_list(SSL_CTX *ssl_ctx, void *file) +{ + + ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CERT, (const char *)file, NULL); +} + +void SSLv23_method(void) { } + +void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, void *cb) { } + +void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u) +{ + key_password = (char *)u; +} + +int SSL_peek(SSL *ssl, void *buf, int num) +{ + memcpy(buf, ssl->bm_data, num); + return num; +} + +void SSL_set_bio(SSL *ssl, void *rbio, void *wbio) { } + +long SSL_get_verify_result(const SSL *ssl) +{ + return ssl_handshake_status(ssl); +} + +int SSL_state(SSL *ssl) +{ + return 0x03; // ok state +} + +/** end of could do better list */ + +void *SSL_get_peer_certificate(const SSL *ssl) +{ + return &ssl->ssl_ctx->certs[0]; +} + +int SSL_clear(SSL *ssl) +{ + return 1; +} + int SSL_CTX_check_private_key(const SSL_CTX *ctx) { @@ -192,6 +290,7 @@ void SSL_CTX_set_options(SSL_CTX *ssl_ctx, int option) {} int SSL_library_init(void ) { return 1; } void SSL_load_error_strings(void ) {} void ERR_print_errors_fp(FILE *fp) {} + #ifndef CONFIG_SSL_SKELETON_MODE long SSL_CTX_get_timeout(const SSL_CTX *ssl_ctx) { return CONFIG_SSL_EXPIRY_TIME*3600; } diff --git a/ssl/tls1.c b/ssl/tls1.c index 9f6508c74c..658c2c15d4 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -60,7 +60,7 @@ static int send_raw_packet(SSL *ssl, uint8_t protocol); const uint8_t ssl_prot_prefs[NUM_PROTOCOLS] = { SSL_RC4_128_SHA }; #else -static void session_free(SSL_SESS *ssl_sessions[], int sess_index); +static void session_free(SSL_SESSION *ssl_sessions[], int sess_index); const uint8_t ssl_prot_prefs[NUM_PROTOCOLS] = #ifdef CONFIG_SSL_PROT_LOW /* low security, fast speed */ @@ -181,8 +181,8 @@ EXP_FUNC SSL_CTX *STDCALL ssl_ctx_new(uint32_t options, int num_sessions) #ifndef CONFIG_SSL_SKELETON_MODE if (num_sessions) { - ssl_ctx->ssl_sessions = (SSL_SESS **) - calloc(1, num_sessions*sizeof(SSL_SESS *)); + ssl_ctx->ssl_sessions = (SSL_SESSION **) + calloc(1, num_sessions*sizeof(SSL_SESSION *)); } #endif @@ -1518,12 +1518,12 @@ void disposable_free(SSL *ssl) * Find if an existing session has the same session id. If so, use the * master secret from this session for session resumption. */ -SSL_SESS *ssl_session_update(int max_sessions, SSL_SESS *ssl_sessions[], +SSL_SESSION *ssl_session_update(int max_sessions, SSL_SESSION *ssl_sessions[], SSL *ssl, const uint8_t *session_id) { time_t tm = time(NULL); time_t oldest_sess_time = tm; - SSL_SESS *oldest_sess = NULL; + SSL_SESSION *oldest_sess = NULL; int i; /* no sessions? Then bail */ @@ -1566,7 +1566,7 @@ SSL_SESS *ssl_session_update(int max_sessions, SSL_SESS *ssl_sessions[], if (ssl_sessions[i] == NULL) { /* perfect, this will do */ - ssl_sessions[i] = (SSL_SESS *)calloc(1, sizeof(SSL_SESS)); + ssl_sessions[i] = (SSL_SESSION *)calloc(1, sizeof(SSL_SESSION)); ssl_sessions[i]->conn_time = tm; ssl->session_index = i; SSL_CTX_UNLOCK(ssl->ssl_ctx->mutex); @@ -1592,7 +1592,7 @@ SSL_SESS *ssl_session_update(int max_sessions, SSL_SESS *ssl_sessions[], /** * Free an existing session. */ -static void session_free(SSL_SESS *ssl_sessions[], int sess_index) +static void session_free(SSL_SESSION *ssl_sessions[], int sess_index) { if (ssl_sessions[sess_index]) { @@ -1604,7 +1604,7 @@ static void session_free(SSL_SESS *ssl_sessions[], int sess_index) /** * This ssl object doesn't want this session anymore. */ -void kill_ssl_session(SSL_SESS **ssl_sessions, SSL *ssl) +void kill_ssl_session(SSL_SESSION **ssl_sessions, SSL *ssl) { SSL_CTX_LOCK(ssl->ssl_ctx->mutex); diff --git a/ssl/tls1.h b/ssl/tls1.h index 05258ed0de..b64b4fda62 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -132,7 +132,7 @@ typedef struct time_t conn_time; uint8_t session_id[SSL_SESSION_ID_SIZE]; uint8_t master_secret[SSL_SECRET_SIZE]; -} SSL_SESS; +} SSL_SESSION; typedef struct { @@ -176,7 +176,7 @@ struct _SSL struct _SSL_CTX *ssl_ctx; /* back reference to a clnt/svr ctx */ #ifndef CONFIG_SSL_SKELETON_MODE uint16_t session_index; - SSL_SESS *session; + SSL_SESSION *session; #endif #ifdef CONFIG_SSL_CERT_VERIFICATION X509_CTX *x509_ctx; @@ -205,7 +205,7 @@ struct _SSL_CTX SSL_CERT certs[CONFIG_SSL_MAX_CERTS]; #ifndef CONFIG_SSL_SKELETON_MODE uint16_t num_sessions; - SSL_SESS **ssl_sessions; + SSL_SESSION **ssl_sessions; #endif #ifdef CONFIG_SSL_CTX_MUTEXING SSL_CTX_MUTEX_TYPE mutex; @@ -277,10 +277,10 @@ void DISPLAY_BYTES(SSL *ssl, const char *format,/* win32 has no variadic macros int process_certificate(SSL *ssl, X509_CTX **x509_ctx); #endif -SSL_SESS *ssl_session_update(int max_sessions, - SSL_SESS *ssl_sessions[], SSL *ssl, +SSL_SESSION *ssl_session_update(int max_sessions, + SSL_SESSION *ssl_sessions[], SSL *ssl, const uint8_t *session_id); -void kill_ssl_session(SSL_SESS **ssl_sessions, SSL *ssl); +void kill_ssl_session(SSL_SESSION **ssl_sessions, SSL *ssl); #ifdef __cplusplus } diff --git a/www/index.html b/www/index.html index b267ec40b3..9725ed54a0 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n\n!!__axhttpd__\n* strip now works a little better.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 38e6b1e2fc9cc8f57695b736dc0b0acbdffea0fb Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 30 Jan 2009 13:01:48 +0000 Subject: [PATCH 131/301] git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@155 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- www/index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/www/index.html b/www/index.html index 9725ed54a0..25cd2e69b1 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n\n!!__axhttpd__\n* strip now works a little better.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 68a71ccc40a337b4782f19d858631164af29690b Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 27 Feb 2009 11:19:34 +0000 Subject: [PATCH 132/301] cgi file uploads now work above 1kB in size git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@157 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/axhttp.h | 5 ++++- httpd/proc.c | 54 +++++++++++++++++++++++++------------------------- 2 files changed, 31 insertions(+), 28 deletions(-) diff --git a/httpd/axhttp.h b/httpd/axhttp.h index 73c299fb14..c87b9c442b 100644 --- a/httpd/axhttp.h +++ b/httpd/axhttp.h @@ -36,8 +36,10 @@ #define HAVE_IPV6 #endif -#define MAXPOSTDATASIZE 30000 +#define MAXPOSTDATASIZE 30000 /* adjust for file upload + size*/ #define MAXREQUESTLENGTH 256 +#define MAXREADLENGTH 8800 /* FF3=4096, IE7=8760 */ #define BLOCKSIZE 4096 #define INITIAL_CONNECTION_SLOTS 10 @@ -87,6 +89,7 @@ struct connstruct #if defined(CONFIG_HTTP_HAS_CGI) uint8_t is_cgi; + char cgicontenttype[MAXREQUESTLENGTH]; #ifdef CONFIG_HTTP_ENABLE_LUA uint8_t is_lua; #endif diff --git a/httpd/proc.c b/httpd/proc.c index 3c897c98b0..78fc7ae285 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -159,6 +159,10 @@ static int procheadelem(struct connstruct *cn, char *buf) { sscanf(value, "%d", &cn->content_length); } + else if (strcmp(buf, "Content-Type:") == 0) + { + my_strncpy(cn->cgicontenttype, value, MAXREQUESTLENGTH); + } else if (strcmp(buf, "Cookie:") == 0) { my_strncpy(cn->cookie, value, MAXREQUESTLENGTH); @@ -301,10 +305,10 @@ static void urlencode(const uint8_t *s, char *t) void procreadhead(struct connstruct *cn) { - char buf[MAXREQUESTLENGTH*4], *tp, *next; + char buf[MAXREADLENGTH], *tp, *next; int rv; - memset(buf, 0, MAXREQUESTLENGTH*4); + memset(buf, 0, sizeof(buf)); rv = special_read(cn, buf, sizeof(buf)-1); if (rv <= 0) { @@ -329,7 +333,7 @@ void procreadhead(struct connstruct *cn) #if defined(CONFIG_HTTP_HAS_CGI) if (cn->reqtype == TYPE_POST && cn->content_length > 0) { - if (init_read_post_data(buf,next,cn,rv) == 0) + if (init_read_post_data(buf, next, cn, rv) == 0) return; } #endif @@ -390,7 +394,6 @@ void procsendhead(struct connstruct *cn) file_exists = stat(cn->actualfile, &stbuf); #if defined(CONFIG_HTTP_HAS_CGI) - if (file_exists != -1 && cn->is_cgi) { if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) @@ -669,13 +672,15 @@ static void proccgi(struct connstruct *cn) type = "GET"; break; +#if defined(CONFIG_HTTP_HAS_CGI) case TYPE_POST: type = "POST"; sprintf(cgienv[cgi_index++], "CONTENT_LENGTH=%d", cn->content_length); - strcpy(cgienv[cgi_index++], /* hard-code? */ - "CONTENT_TYPE=application/x-www-form-urlencoded"); + snprintf(cgienv[cgi_index++], MAXREQUESTLENGTH, + "CONTENT_TYPE=%s", cn->cgicontenttype); break; +#endif } sprintf(cgienv[cgi_index++], "REQUEST_METHOD=%s", type); @@ -746,7 +751,9 @@ static void decode_path_info(struct connstruct *cn, char *path_info) { char *cgi_delim; +#if defined(CONFIG_HTTP_HAS_CGI) cn->is_cgi = 0; +#endif #ifdef CONFIG_HTTP_ENABLE_LUA cn->is_lua = 0; #endif @@ -763,6 +770,7 @@ static void decode_path_info(struct connstruct *cn, char *path_info) my_strncpy(cn->uri_query, cgi_delim+1, MAXREQUESTLENGTH); } +#if defined(CONFIG_HTTP_HAS_CGI) if ((cgi_delim = cgi_filetype_match(cn, path_info)) != NULL) { cn->is_cgi = 1; /* definitely a CGI script */ @@ -774,6 +782,7 @@ static void decode_path_info(struct connstruct *cn, char *path_info) *cgi_delim = '\0'; } } +#endif /* the bit at the start must be the script name */ my_strncpy(cn->filereq, path_info, MAXREQUESTLENGTH); @@ -787,7 +796,7 @@ static int init_read_post_data(char *buf, char *data, char *post_data; /* Too much Post data to send. MAXPOSTDATASIZE should be - configured (now it can be chaged in the header file) */ + configured (now it can be changed in the header file) */ if (cn->content_length > MAXPOSTDATASIZE) { send_error(cn, 418); @@ -800,17 +809,9 @@ static int init_read_post_data(char *buf, char *data, if (cn->post_data == NULL) { - cn->post_data = (char *) calloc(1, (cn->content_length + 1)); /* Allocate buffer for the POST data that will be used by proccgi to send POST data to the CGI script */ - - if (cn->post_data == NULL) - { - printf("axhttpd: could not allocate memory for POST data\n"); - TTY_FLUSH(); - send_error(cn, 599); - return 0; - } + cn->post_data = (char *)ax_calloc(1, (cn->content_length + 1)); } cn->post_state = 0; @@ -819,10 +820,8 @@ static int init_read_post_data(char *buf, char *data, while (next < &buf[rv]) { - /*copy POST data to buffer*/ - *post_data = *next; - post_data++; - next++; + /* copy POST data to buffer */ + *post_data++ = *next++; cn->post_read++; if (cn->post_read == cn->content_length) { @@ -839,11 +838,11 @@ static int init_read_post_data(char *buf, char *data, void read_post_data(struct connstruct *cn) { - char buf[MAXREQUESTLENGTH*4], *next; + char buf[MAXREADLENGTH], *next; char *post_data; int rv; - bzero(buf,MAXREQUESTLENGTH*4); + memset(buf, 0, sizeof(buf)); rv = special_read(cn, buf, sizeof(buf)-1); if (rv <= 0) { @@ -854,15 +853,13 @@ void read_post_data(struct connstruct *cn) buf[rv] = '\0'; next = buf; - post_data = &cn->post_data[cn->post_read]; while (next < &buf[rv]) { - *post_data = *next; - post_data++; - next++; + *post_data++ = *next++; cn->post_read++; + if (cn->post_read == cn->content_length) { /* No more POST data to be copied */ @@ -1174,7 +1171,7 @@ static void send_error(struct connstruct *cn, int err) break; case 418: - title = "POST data size is to large"; + title = "POST data size is too large"; text = title; break; @@ -1191,6 +1188,9 @@ static void send_error(struct connstruct *cn, int err) "\n\n%d %s\n" "

    %d %s

    \n\n", err, title, err, title, err, text); +#ifdef CONFIG_HTTP_VERBOSE + printf("axhttpd: http error: %s [%d]\n", title, err); TTY_FLUSH(); +#endif special_write(cn, buf, strlen(buf)); removeconnection(cn); } From 95e8c7998fa8629d50df6e2a7d0e6d32fe0a6974 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 27 Mar 2009 11:25:10 +0000 Subject: [PATCH 133/301] date comment changes + post stuff git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@158 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/axhttpd.c | 2 +- httpd/htpasswd.c | 2 +- httpd/proc.c | 21 ++++++++++----------- httpd/tdate_parse.c | 2 +- 4 files changed, 13 insertions(+), 14 deletions(-) diff --git a/httpd/axhttpd.c b/httpd/axhttpd.c index 35d36f64c1..fb7ad3d84c 100644 --- a/httpd/axhttpd.c +++ b/httpd/axhttpd.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2007, Cameron Rich + * Copyright (c) Cameron Rich * * All rights reserved. * diff --git a/httpd/htpasswd.c b/httpd/htpasswd.c index 1a7a2311f8..d1fbe32bfe 100644 --- a/httpd/htpasswd.c +++ b/httpd/htpasswd.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2007, Cameron Rich + * Copyright (c) Cameron Rich * * All rights reserved. * diff --git a/httpd/proc.c b/httpd/proc.c index 78fc7ae285..c90fa97909 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2007-2008, Cameron Rich + * Copyright (c) Cameron Rich * * All rights reserved. * @@ -571,8 +571,8 @@ static void proccgi(struct connstruct *cn) } #ifdef CONFIG_HTTP_VERBOSE - printf("[CGI]: %s:/%s\n", cn->is_ssl ? "https" : "http", cn->filereq); - TTY_FLUSH(); + printf("[CGI]: %s:/%s\n", cn->is_ssl ? "https" : "http", cn->filereq); + TTY_FLUSH(); #endif /* win32 cgi is a bit too painful */ @@ -1181,17 +1181,16 @@ static void send_error(struct connstruct *cn, int err) break; } - snprintf(buf, MAXREQUESTLENGTH, "HTTP/1.1 %d %s\n" - "Content-Type: text/html\n" - "Cache-Control: no-cache,no-store\n" - "Connection: close\n\n" - "\n\n%d %s\n" - "

    %d %s

    \n\n", - err, title, err, title, err, text); + snprintf(buf, sizeof(buf), HTTP_VERSION" 200 OK\n" + "Content-Type: text/html\n\n" + "\n%s\n" + "

    Error %d - %s

    \n\n", + title, err, text); + special_write(cn, buf, strlen(buf)); + #ifdef CONFIG_HTTP_VERBOSE printf("axhttpd: http error: %s [%d]\n", title, err); TTY_FLUSH(); #endif - special_write(cn, buf, strlen(buf)); removeconnection(cn); } diff --git a/httpd/tdate_parse.c b/httpd/tdate_parse.c index 813bdc578b..9124323846 100644 --- a/httpd/tdate_parse.c +++ b/httpd/tdate_parse.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2007, Cameron Rich + * Copyright (c) Cameron Rich * * All rights reserved. * From 2cedd593849a344c403e59fb25f5ef88e2845731 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 23 Sep 2009 12:38:23 +0000 Subject: [PATCH 134/301] Added SAN ("Subject Alternative Name" support git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@159 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/asn1.c | 54 +++++++++++++++++++++++++++++++++++++++++++- ssl/crypto_misc.h | 10 ++++++++- ssl/ssl.h | 17 ++++++++++++++ ssl/tls1.c | 34 ++++++++++++++++++++++++---- ssl/x509.c | 57 ++++++++++++++++++++++++++++++++++++++++++++++- www/index.html | 2 +- 6 files changed, 166 insertions(+), 8 deletions(-) diff --git a/ssl/asn1.c b/ssl/asn1.c index 4f2e6db240..ee474f4c1e 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -42,6 +42,7 @@ #define SIG_OID_PREFIX_SIZE 8 #define SIG_IIS6_OID_SIZE 5 +#define SIG_SUBJECT_ALT_NAME_SIZE 3 /* Must be an RSA algorithm with either SHA1 or MD5 for verifying to work */ static const uint8_t sig_oid_prefix[SIG_OID_PREFIX_SIZE] = @@ -54,6 +55,11 @@ static const uint8_t sig_iis6_oid[SIG_IIS6_OID_SIZE] = 0x2b, 0x0e, 0x03, 0x02, 0x1d }; +static const uint8_t sig_subject_alt_name[SIG_SUBJECT_ALT_NAME_SIZE] = +{ + 0x55, 0x1d, 0x11 +}; + /* CN, O, OU */ static const uint8_t g_dn_types[] = { 3, 10, 11 }; @@ -284,6 +290,7 @@ static int asn1_get_printable_str(const uint8_t *buf, int *offset, char **str) /* some certs have this awful crud in them for some reason */ if (buf[*offset] != ASN1_PRINTABLE_STR && + buf[*offset] != ASN1_PRINTABLE_STR2 && buf[*offset] != ASN1_TELETEX_STR && buf[*offset] != ASN1_IA5_STR && buf[*offset] != ASN1_UNICODE_STR) @@ -471,7 +478,52 @@ int asn1_compare_dn(char * const dn1[], char * const dn2[]) return 0; /* all good */ } -#endif +int asn1_find_oid(const uint8_t* cert, int* offset, + const uint8_t* oid, int oid_length) +{ + int seqlen; + if ((seqlen = asn1_next_obj(cert, offset, ASN1_SEQUENCE))> 0) + { + int end = *offset + seqlen; + + while (*offset < end) + { + int type = cert[(*offset)++]; + int length = get_asn1_length(cert, offset); + int noffset = *offset + length; + + if (type == ASN1_SEQUENCE) + { + type = cert[(*offset)++]; + length = get_asn1_length(cert, offset); + + if (type == ASN1_OID && length == oid_length && + memcmp(cert + *offset, oid, oid_length) == 0) + { + *offset += oid_length; + return 1; + } + } + + *offset = noffset; + } + } + + return 0; +} + +int asn1_find_subjectaltname(const uint8_t* cert, int offset) +{ + if (asn1_find_oid(cert, &offset, sig_subject_alt_name, + SIG_SUBJECT_ALT_NAME_SIZE)) + { + return offset; + } + + return 0; +} + +#endif /* CONFIG_SSL_CERT_VERIFICATION */ /** * Read the signature type of the certificate. We only support RSA-MD5 and diff --git a/ssl/crypto_misc.h b/ssl/crypto_misc.h index 97cb0f2d23..1fd514eeb1 100644 --- a/ssl/crypto_misc.h +++ b/ssl/crypto_misc.h @@ -68,6 +68,7 @@ struct _x509_ctx { char *ca_cert_dn[X509_NUM_DN_TYPES]; char *cert_dn[X509_NUM_DN_TYPES]; + char **subject_alt_dnsnames; time_t not_before; time_t not_after; uint8_t *signature; @@ -104,16 +105,22 @@ const char * x509_display_error(int error); #define ASN1_BIT_STRING 0x03 #define ASN1_OCTET_STRING 0x04 #define ASN1_NULL 0x05 +#define ASN1_PRINTABLE_STR2 0x0C #define ASN1_OID 0x06 +#define ASN1_PRINTABLE_STR2 0x0C #define ASN1_PRINTABLE_STR 0x13 #define ASN1_TELETEX_STR 0x14 #define ASN1_IA5_STR 0x16 #define ASN1_UTC_TIME 0x17 #define ASN1_UNICODE_STR 0x1e #define ASN1_SEQUENCE 0x30 +#define ASN1_CONTEXT_DNSNAME 0x82 #define ASN1_SET 0x31 +#define ASN1_V3_DATA 0xa3 #define ASN1_IMPLICIT_TAG 0x80 +#define ASN1_CONTEXT_DNSNAME 0x82 #define ASN1_EXPLICIT_TAG 0xa0 +#define ASN1_V3_DATA 0xa3 #define SIG_TYPE_MD2 0x02 #define SIG_TYPE_MD5 0x04 @@ -130,8 +137,9 @@ int asn1_name(const uint8_t *cert, int *offset, char *dn[]); int asn1_public_key(const uint8_t *cert, int *offset, X509_CTX *x509_ctx); #ifdef CONFIG_SSL_CERT_VERIFICATION int asn1_signature(const uint8_t *cert, int *offset, X509_CTX *x509_ctx); +int asn1_find_subjectaltname(const uint8_t* cert, int offset); int asn1_compare_dn(char * const dn1[], char * const dn2[]); -#endif +#endif /* CONFIG_SSL_CERT_VERIFICATION */ int asn1_signature_type(const uint8_t *cert, int *offset, X509_CTX *x509_ctx); diff --git a/ssl/ssl.h b/ssl/ssl.h index 539d0a3058..9fc8d0e0f9 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -384,6 +384,23 @@ EXP_FUNC int STDCALL ssl_verify_cert(const SSL *ssl); */ EXP_FUNC const char * STDCALL ssl_get_cert_dn(const SSL *ssl, int component); + +/** + * @brief Retrieve a Subject Alternative DNSName + * + * When a handshake is complete and a certificate has been exchanged, then the + * details of the remote certificate can be retrieved. + * + * This will usually be used by a client to check that the server's common + * name matches the URL. + * + * @param ssl [in] An SSL object reference. + * @param index [in] The index of the DNS name to retrieve. + * @return The appropriate string (or null if not defined) + * @note Verification build mode must be enabled. + */ +EXP_FUNC const char * STDCALL ssl_get_cert_subject_alt_dnsname(const SSL *ssl, int dnsindex); + /** * @brief Force the client to perform its handshake again. * diff --git a/ssl/tls1.c b/ssl/tls1.c index 658c2c15d4..9a469d7fe4 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -419,6 +419,7 @@ int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) return ret; } + /* * Retrieve an X.509 distinguished name component */ @@ -452,7 +453,27 @@ EXP_FUNC const char * STDCALL ssl_get_cert_dn(const SSL *ssl, int component) } } -#endif +/* + * Retrieve a "Subject Alternative Name" from a v3 certificate + */ +EXP_FUNC const char * STDCALL ssl_get_cert_subject_alt_dnsname(const SSL *ssl, + int dnsindex) +{ + int i; + + if (ssl->x509_ctx == NULL || ssl->x509_ctx->subject_alt_dnsnames == NULL) + return NULL; + + for (i = 0; i < dnsindex; ++i) + { + if (ssl->x509_ctx->subject_alt_dnsnames[i] == NULL) + return NULL; + } + + return ssl->x509_ctx->subject_alt_dnsnames[dnsindex]; +} + +#endif /* CONFIG_SSL_CERT_VERIFICATION */ /* * Find an ssl object based on the client's file descriptor. @@ -879,7 +900,6 @@ static void *crypt_new(SSL *ssl, uint8_t *key, uint8_t *iv, int is_decrypt) return (void *)aes_ctx; } - break; case SSL_RC4_128_MD5: #endif @@ -889,7 +909,6 @@ static void *crypt_new(SSL *ssl, uint8_t *key, uint8_t *iv, int is_decrypt) RC4_setup(rc4_ctx, key, 16); return (void *)rc4_ctx; } - break; } return NULL; /* its all gone wrong */ @@ -1505,7 +1524,7 @@ void disposable_free(SSL *ssl) { if (ssl->dc) { - free(ssl->dc->key_block); + free(ssl->dc->key_block); memset(ssl->dc, 0, sizeof(DISPOSABLE_CTX)); free(ssl->dc); ssl->dc = NULL; @@ -2045,12 +2064,19 @@ EXP_FUNC int STDCALL ssl_verify_cert(const SSL *ssl) return -1; } + EXP_FUNC const char * STDCALL ssl_get_cert_dn(const SSL *ssl, int component) { printf(unsupported_str); return NULL; } +EXP_FUNC const char * STDCALL ssl_get_cert_subject_alt_dnsname(const SSL *ssl, int index) +{ + printf(unsupported_str); + return NULL; +} + #endif /* CONFIG_SSL_CERT_VERIFICATION */ #endif /* CONFIG_BINDINGS */ diff --git a/ssl/x509.c b/ssl/x509.c index 37db7f4e81..d2e8ccbb4a 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -147,7 +147,53 @@ int x509_new(const uint8_t *cert, int *len, X509_CTX **ctx) x509_ctx->digest = bi_import(bi_ctx, md2_dgst, MD2_SIZE); } - offset = end_tbs; /* skip the v3 data */ + if (cert[offset] == ASN1_V3_DATA) + { + int suboffset; + + ++offset; + get_asn1_length(cert, &offset); + + if ((suboffset = asn1_find_subjectaltname(cert, offset)) > 0) + { + if (asn1_next_obj(cert, &suboffset, ASN1_OCTET_STRING) > 0) + { + int altlen; + + if ((altlen = asn1_next_obj(cert, + &suboffset, ASN1_SEQUENCE)) > 0) + { + int endalt = suboffset + altlen; + int totalnames = 0; + + while (suboffset < endalt) + { + int type = cert[suboffset++]; + int dnslen = get_asn1_length(cert, &suboffset); + + if (type == ASN1_CONTEXT_DNSNAME) + { + x509_ctx->subject_alt_dnsnames = (char**) + realloc(x509_ctx->subject_alt_dnsnames, + (totalnames + 2) * sizeof(char*)); + x509_ctx->subject_alt_dnsnames[totalnames] = + (char*)malloc(dnslen + 1); + x509_ctx->subject_alt_dnsnames[totalnames+1] = NULL; + memcpy(x509_ctx->subject_alt_dnsnames[totalnames], + cert + suboffset, dnslen); + x509_ctx->subject_alt_dnsnames[ + totalnames][dnslen] = 0; + ++totalnames; + } + + suboffset += dnslen; + } + } + } + } + } + + offset = end_tbs; /* skip the rest of v3 data */ if (asn1_skip_obj(cert, &offset, ASN1_SEQUENCE) || asn1_signature(cert, &offset, x509_ctx)) goto end_cert; @@ -188,6 +234,7 @@ void x509_free(X509_CTX *x509_ctx) free(x509_ctx->cert_dn[i]); } + free(x509_ctx->signature); #ifdef CONFIG_SSL_CERT_VERIFICATION @@ -195,6 +242,14 @@ void x509_free(X509_CTX *x509_ctx) { bi_free(x509_ctx->rsa_ctx->bi_ctx, x509_ctx->digest); } + + if (x509_ctx->subject_alt_dnsnames) + { + for (i = 0; x509_ctx->subject_alt_dnsnames[i]; ++i) + free(x509_ctx->subject_alt_dnsnames[i]); + + free(x509_ctx->subject_alt_dnsnames); + } #endif RSA_free(x509_ctx->rsa_ctx); diff --git a/www/index.html b/www/index.html index 25cd2e69b1..6170143e33 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 629b523044dbfda5a558b324be0199e0bd4498f0 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 24 Sep 2009 12:27:08 +0000 Subject: [PATCH 135/301] added the qualityssl.com.der certificate in the test harness git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@160 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/test/qualityssl.com.der | Bin 0 -> 1385 bytes ssl/test/ssltest.c | 18 ++++++++++++++++++ 2 files changed, 18 insertions(+) create mode 100644 ssl/test/qualityssl.com.der diff --git a/ssl/test/qualityssl.com.der b/ssl/test/qualityssl.com.der new file mode 100644 index 0000000000000000000000000000000000000000..c73b246440aed171f9e8baa9f1963c6981945fb3 GIT binary patch literal 1385 zcmXqLVofz@V)0$T%*4pVB*2;)`+UuO=IctEE2C}NI+_i5**LY@JlekVGBUEVG8i;Y zH{>?pWMd9xVH0Kw4TfJijR0P|-jhB+o4@kx^1oV5P5LUS6(OTAW%`QdC-8qL-YX zYbb9Z3sS-?EEXE#rwcN|EwiY&MAsv+D5X5HDAhntoY%k-2#pNDAWEFq&;-OaGB&j| zwTv=oya#hE(B&@PhP(#cAOi)3S&Yn#ObxjVI6zzuVMbj;5d$F*n_ZYYEHNi1HLo}+ zF*Vyz%0L1n$|)@9mztB4nVnjen3|WKTB2ZRWGHMP2$JIx=5op`am`E5%u6kX333Z_ z1(qh}0K*|T*azkhZeg*2qWrSVl++Z3q)G)OT`~qzAfvd2g%P?G!ZUMHl7T)olr#_r z$uf%wXz3L~Of4?X0fmr3<9y`EVq|4tZtMj{SSM3sBg5`nnJKJ07Hqy6pyHLVUvwd3 z@~>YS$_!^sg3J_F?3&asrlD&(tI7XYeTYKsT^^MMlKQI7tC^qLoj7vl|N4rgqv4&7 z!E9wY3_1?GSxhJVyl~7*o=NEU=T)maZ!phzb2CM^&rssSS)ZE2I~F8IsfOBj$6r?{ zF*#=%c9tcsGvH&kULvAAuuVR+&Y@K&(MzVNtxAw8jkQsj=+lS6ipe z^}cl26&%&Fd@N!tBCo_AG)l+3O3gaJFj@ale%`%lX>SbpfI%S3&&c?ng@u`kb%6m7 zh%XG{GZ`>IG^?_R8HliPXtM!REju$KoW*3|22!lRVsBt;V9mw@RKUWx$&itWk(tFn z+dvbhkcm-D7L*o?fr+s=HMz7X6%@w#DfxPNsU`Z(0l@~0?i@dO&psKz$30+6*vsf^EU0uMp-=Mn;xYgJhsjpk6g#YSV|C z2F^Js?r=;=2?1rP;MAhB)FNj`pd(5QRN$H!+h7?mKe@O7>SKs6475T16=YE{P-?$1?wo@z>i|9+~!DQVdb$zhdFPbbjeVz2aw9=Am=6Z-;U6 z|F>9q<}bL2pT$;l&p_UnL$%W88hLxTb-d_1NV7 z5vx7lh|YY~@$^u!tXR95RjB_Ln|2=Syaf4&D?T>;^EGyAxV=4)>HYDKrcYa=n;bdT zD1_gVIX$B?$mr*qC0U=IFPUawmVUQ6EAPkWtjR+Ab~fHD=a}%eSF`D(HiO5};&o+v z&!=k&N1dwdc6(Y{w23{{=0l>Iu~pl_{jsubject_alt_dnsnames[1], "qualityssl.com")) + { + printf("Cert #9 (2)\n"); + res = -1; + goto bad_cert; + } + x509_free(x509_ctx); + free(buf); + res = 0; /* all ok */ printf("All Certificate tests passed\n"); From 6f4efb3e57043217bf44795f526336d322f5757b Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 25 Sep 2009 11:52:55 +0000 Subject: [PATCH 136/301] Added axtlswrap git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@161 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 4 + axtlswrap/Makefile | 68 ++++++++ axtlswrap/axtlswrap.c | 378 ++++++++++++++++++++++++++++++++++++++++++ config/Config.in | 8 + httpd/Makefile | 3 + ssl/ssl.h | 7 +- ssl/test/Makefile | 4 +- ssl/x509.c | 3 +- 8 files changed, 467 insertions(+), 8 deletions(-) create mode 100755 axtlswrap/Makefile create mode 100755 axtlswrap/axtlswrap.c diff --git a/Makefile b/Makefile index 02c33d2482..2b3d3c8dd9 100644 --- a/Makefile +++ b/Makefile @@ -50,6 +50,9 @@ target: ifdef CONFIG_AXHTTPD $(MAKE) -C httpd endif +ifdef CONFIG_AXTLSWRAP + $(MAKE) -C axtlswrap +endif ifdef CONFIG_BINDINGS $(MAKE) -C bindings endif @@ -121,6 +124,7 @@ clean:: @cd crypto; $(MAKE) clean @cd ssl; $(MAKE) clean @cd httpd; $(MAKE) clean + @cd axtlswrap; $(MAKE) clean @cd samples; $(MAKE) clean @cd docsrc; $(MAKE) clean @cd bindings; $(MAKE) clean diff --git a/axtlswrap/Makefile b/axtlswrap/Makefile new file mode 100755 index 0000000000..b14825a4e4 --- /dev/null +++ b/axtlswrap/Makefile @@ -0,0 +1,68 @@ +# +# Copyright (c) 2009, Cameron Rich +# +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: +# +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# * Neither the name of the axTLS project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY +# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +# + +all : sslwrap + +AXTLS_HOME=.. + +include $(AXTLS_HOME)/config/.config +include $(AXTLS_HOME)/config/makefile.conf + +ifdef CONFIG_PLATFORM_CYGWIN +TARGET=$(AXTLS_HOME)/$(STAGE)/axtlswrap.exe +else # linux +TARGET=$(AXTLS_HOME)/$(STAGE)/axtlswrap +endif + +ifdef CONFIG_HTTP_STATIC_BUILD +LIBS=$(AXTLS_HOME)/$(STAGE)/libaxtls.a +else +LIBS=-L$(AXTLS_HOME)/$(STAGE) -laxtls +endif + +ifndef CONFIG_AXTLSWRAP +sslwrap: +else +sslwrap : $(TARGET) + +OBJ= axtlswrap.o +include $(AXTLS_HOME)/config/makefile.post + +$(TARGET): $(OBJ) $(AXTLS_HOME)/$(STAGE)/libaxtls.a + $(LD) $(LDFLAGS) -o $@ $(OBJ) $(LIBS) +ifdef CONFIG_STRIP_UNWANTED_SECTIONS + $(STRIP) --remove-section=.comment $(TARGET) +endif + +endif # CONFIG_AXTLSWRAP + +clean:: + -@rm -f $(TARGET)* + diff --git a/axtlswrap/axtlswrap.c b/axtlswrap/axtlswrap.c new file mode 100755 index 0000000000..5aa6675ab5 --- /dev/null +++ b/axtlswrap/axtlswrap.c @@ -0,0 +1,378 @@ +/* + * Copyright (c) 2009, Steve Bennett + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +/* + * sslwrap re-implemented with axTLS - a way to wrap an existing webserver + * with axTLS. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include "ssl.h" + +/* If nothing is received or sent in this many seconds, give up */ +static int opt_timeout = 60; + +static int opt_verbose = 0; + +int main(int argc, char *argv[]) +{ + int log_opts = LOG_PERROR; + int fd[2]; /* output from child */ + int df[2]; /* input to child */ + int pid; + unsigned char *readbuf; + int readlen; + + SSL_CTX *ssl_ctx; + SSL *ssl; + + /* This relies on stdin and stdout being one and the same */ + int sslfd = fileno(stdin); + + while (argc > 2 && argv[1][0] == '-') + { + if (argc > 3 && strcmp(argv[1], "-t") == 0) + { + opt_timeout = atoi(argv[2]); + argv += 2; + argc -= 2; + continue; + } + + if (strcmp(argv[1], "-q") == 0) + { + log_opts = 0; + argv++; + argc--; + continue; + } + + if (strcmp(argv[1], "-v") == 0) + { + opt_verbose++; + argv++; + argc--; + continue; + } + } + + if (argc < 2) + { + fprintf(stderr, "Usage: axtlswrap [-v] [-q] " + "[-t timeout] command ...\n"); + return 1; + } + + if (access(argv[1], X_OK) != 0) + { + fprintf(stderr, "Not an executabled: %s\n", argv[1]); + return 1; + } + + openlog("axtlswrap", LOG_PID | log_opts, LOG_DAEMON); + + /* Create an SSL context with the required options */ + ssl_ctx = ssl_ctx_new(opt_verbose > 1 ? + SSL_DISPLAY_STATES | SSL_DISPLAY_CERTS : 0, 1); + + if (ssl_ctx == NULL) + { + syslog(LOG_ERR, "Failed to create SSL ctx"); + return 1; + } + + /* And create an ssl session attached to sslfd */ + ssl = ssl_server_new(ssl_ctx, sslfd); + if (ssl == NULL) + { + syslog(LOG_ERR, "Failed to create SSL connection"); + return 1; + } + + /* Get past the handshaking */ + while ((readlen = ssl_read(ssl, &readbuf)) == SSL_OK) + { + /* Still handshaking */ + } + + if (readlen < 0) + { + syslog(LOG_ERR, "SSL handshake failed: %d", readlen); + return 1; + } + + if (opt_verbose) + { + syslog(LOG_INFO, "SSL handshake OK"); + } + + /* Looks OK, we have data, so fork the child and start */ + if (pipe(fd) < 0 || pipe(df) < 0) + { + syslog(LOG_ERR, "pipe failed: %m"); + return 1; + } + + /* Give some indication to the child that we are running SSL + * It would be possible to provide other details + * too. Perhaps as in: http://httpd.apache.org/docs/2.0/mod/mod_ssl.html + */ + setenv("SSL_PROTOCOL", "TLSv1", 1); + +#ifndef NOMMU + if (opt_verbose) + { + pid = fork(); + } + else +#endif + pid = vfork(); + if (pid < 0) + { + syslog(LOG_ERR, "vfork failed: %m"); + return 1; + } + + if (pid > 0) + { + /* This is the parent */ + unsigned char writebuf[4096]; + int writelen = 0; + struct pollfd pfd[3]; + int timeout_count = 0; + + int cwfd = df[1]; /* write to child */ + int crfd = fd[0]; /* read from child */ + + int child_alive = 1; + + /* Don't die on SIGPIPE */ + signal(SIGPIPE, SIG_IGN); + + close(df[0]); + close(fd[1]); + + pfd[0].fd = sslfd; + pfd[1].fd = cwfd; + pfd[2].fd = crfd; + + /* While the child is alive or there is something to return... */ + while (child_alive || writelen > 0) + { + /* Work out what to read and what to write */ + int ret; + + pfd[0].events = 0; + pfd[0].revents = 0; + + /* Only want to read ssl data if there is nothing else to do */ + if (readlen == 0) + { + /* can read ssl data */ + pfd[0].events |= POLLIN; + } + + if (writelen > 0) + { + /* can write ssl data - will block to do this */ + pfd[0].events |= POLLOUT; + } + + pfd[1].events = 0; + pfd[1].revents = 0; + + if (child_alive && readlen > 0) + { + pfd[1].events |= POLLOUT; + } + + pfd[2].events = 0; + pfd[2].revents = 0; + + if (child_alive && writelen == 0) + { + pfd[2].events |= POLLIN; + } + + /* Timeout after 1 second so we can increment timeout_count */ + ret = poll(pfd, 3, 1000); + + if (ret < 0) + { + if (errno != EAGAIN) + { + /* Kill off the child */ + kill(pid, SIGTERM); + break; + } + + continue; + } + + if (ret == 0) + { + if (++timeout_count >= opt_timeout) + { + /* Kill off the child */ + kill(pid, SIGTERM); + break; + } + + continue; + } + + timeout_count = 0; + + if (pfd[2].revents & POLLNVAL) + { + /* REVISIT: This can probably be removed */ + syslog(LOG_ERR, "Child closed output pipe"); + child_alive = 0; + } + else if (pfd[2].revents & POLLIN) + { + /* Can read from (3) */ + writelen = read(crfd, writebuf, sizeof(writebuf)); + if (writelen <= 0) + { + if (writelen < 0) + { + syslog(LOG_WARNING, "Failed to read from child: len=%d", + writelen); + } + break; + } + } + else if ((pfd[2].revents & POLLHUP) && kill(pid, 0) == 0) + { + if (opt_verbose) + { + syslog(LOG_INFO, "Child died and pipe gave POLLHUP"); + } + + child_alive = 0; + } + + if (writelen > 0) + { + const unsigned char *pt = writebuf; + while (writelen > 0) + { + ret = ssl_write(ssl, pt, writelen); + if (ret <= 0) + { + syslog(LOG_WARNING, "Failed to write ssl: ret=%d", ret); + /* Kill off the child now */ + kill(pid, SIGTERM); + writelen = -1; + break; + } + else + { + pt += ret; + writelen -= ret; + } + } + if (writelen < 0) + { + break; + } + } + else if (pfd[0].revents & POLLIN) + { + readlen = ssl_read(ssl, &readbuf); + if (readlen <= 0 && opt_verbose) + { + syslog(LOG_INFO, "ssl_read() returned %d", readlen); + } + + if (readlen < 0) + { + /* Kill off the child */ + kill(pid, SIGTERM); + break; + } + } + + if (pfd[1].revents & POLLNVAL) + { + /* REVISIT: This can probably be removed */ + syslog(LOG_ERR, "Child closed input pipe"); + readlen = -1; + child_alive = 0; + } + else if (pfd[1].revents & POLLOUT) + { + const unsigned char *pt = readbuf; + while (readlen > 0) + { + int len = write(cwfd, pt, readlen); + if (len <= 0) + { + syslog(LOG_WARNING, "Failed to write to child: len=%d", + len); + break; + } + + readlen -= len; + pt += len; + } + } + + } + + ssl_free(ssl); +#if 0 + fprintf(stderr, "[%d] SSL done: timeout_count=%d, readlen=%d, writelen=%d, child_alive=%d\n", + getpid(), timeout_count, readlen, writelen, child_alive); +#endif + return 0; + } + + /* Child */ + close(df[1]); + close(fd[0]); + + dup2(df[0],0); + dup2(fd[1],1); + + close(df[0]); + close(fd[1]); + + execv(argv[1], argv + 1); + _exit(1); +} diff --git a/config/Config.in b/config/Config.in index dc40756465..bebbb03307 100644 --- a/config/Config.in +++ b/config/Config.in @@ -107,6 +107,14 @@ config CONFIG_AXHTTPD help Build the AXHTTPD web server +config CONFIG_AXTLSWRAP + depends on !CONFIG_PLATFORM_WIN32 + bool "Enable axtlswrap" + default n + help + axtlswrap is similar to sslwrap - http://www.rickk.com/sslwrap. + It enables SSL for processes that don't have native SSL support. + source httpd/Config.in source bindings/Config.in source samples/Config.in diff --git a/httpd/Makefile b/httpd/Makefile index b8c18d2445..fbf2fae0e0 100644 --- a/httpd/Makefile +++ b/httpd/Makefile @@ -102,6 +102,9 @@ endif $(TARGET2): htpasswd.o $(AXTLS_HOME)/$(STAGE)/libaxtls.a $(LD) $(LDFLAGS) -o $@ htpasswd.o $(LIBS) +ifdef CONFIG_STRIP_UNWANTED_SECTIONS + $(STRIP) --remove-section=.comment $(TARGET2) +endif else # Win32 diff --git a/ssl/ssl.h b/ssl/ssl.h index 9fc8d0e0f9..d6ed68daee 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -369,8 +369,6 @@ EXP_FUNC int STDCALL ssl_verify_cert(const SSL *ssl); * This will usually be used by a client to check that the server's common * name matches the URL. * - * A full handshake needs to occur for this call to work properly. - * * @param ssl [in] An SSL object reference. * @param component [in] one of: * - SSL_X509_CERT_COMMON_NAME @@ -384,18 +382,17 @@ EXP_FUNC int STDCALL ssl_verify_cert(const SSL *ssl); */ EXP_FUNC const char * STDCALL ssl_get_cert_dn(const SSL *ssl, int component); - /** * @brief Retrieve a Subject Alternative DNSName * * When a handshake is complete and a certificate has been exchanged, then the * details of the remote certificate can be retrieved. * - * This will usually be used by a client to check that the server's common + * This will usually be used by a client to check that the server's DNS * name matches the URL. * * @param ssl [in] An SSL object reference. - * @param index [in] The index of the DNS name to retrieve. + * @param dnsindex [in] The index of the DNS name to retrieve. * @return The appropriate string (or null if not defined) * @note Verification build mode must be enabled. */ diff --git a/ssl/test/Makefile b/ssl/test/Makefile index 56c711f197..181f9aca42 100644 --- a/ssl/test/Makefile +++ b/ssl/test/Makefile @@ -51,10 +51,10 @@ ssltesting: $(AXTLS_HOME)/$(STAGE)/ssltest LIBS=$(AXTLS_HOME)/$(STAGE) $(AXTLS_HOME)/$(STAGE)/perf_bigint: perf_bigint.o $(LIBS)/libaxtls.a - $(CC) $(LDFLAGS) -o $@ $^ -L $(LIBS) -laxtls + $(LD) $(LDFLAGS) -o $@ $^ -L $(LIBS) -laxtls $(AXTLS_HOME)/$(STAGE)/ssltest: ssltest.o $(LIBS)/libaxtls.a - $(CC) $(LDFLAGS) -o $@ $^ -lpthread -L $(LIBS) -laxtls + $(LD) $(LDFLAGS) -o $@ $^ -lpthread -L $(LIBS) -laxtls else performance: $(AXTLS_HOME)/$(STAGE)/perf_bigint.exe ssltesting: $(AXTLS_HOME)/$(STAGE)/ssltest.exe diff --git a/ssl/x509.c b/ssl/x509.c index d2e8ccbb4a..89e2681a5b 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -381,7 +381,8 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) } } - /* couldn't find a trusted cert (& let self-signed errors be returned) */ + /* couldn't find a trusted cert (& let self-signed errors + be returned) */ if (!match_ca_cert && !is_self_signed) { ret = X509_VFY_ERROR_NO_TRUSTED_CERT; From 02de05fe6c8f6f3e02f6ce20c0c78b0fcef54d23 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 30 Sep 2009 11:26:49 +0000 Subject: [PATCH 137/301] added -p and -s options git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@162 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/axhttpd.c | 68 +++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 55 insertions(+), 13 deletions(-) diff --git a/httpd/axhttpd.c b/httpd/axhttpd.c index fb7ad3d84c..9d42aed8ee 100644 --- a/httpd/axhttpd.c +++ b/httpd/axhttpd.c @@ -43,7 +43,7 @@ struct connstruct *freeconns; const char * const server_version = "axhttpd/"AXTLS_VERSION; static void addtoservers(int sd); -static int openlistener(int port); +static int openlistener(char *address, int port); static void handlenewconnection(int listenfd, int is_ssl); static void addconnection(int sd, char *ip, int is_ssl); static void ax_chdir(void); @@ -117,8 +117,13 @@ int main(int argc, char *argv[]) struct connstruct *tp, *to; struct serverstruct *sp; int rnum, wnum, active; - int i; + int i = 1; time_t currtime; + char *httpAddress = NULL; + int httpPort = CONFIG_HTTP_PORT; + char *httpsAddress = NULL; + int httpsPort = CONFIG_HTTP_HTTPS_PORT; + char *portStr; #ifdef WIN32 WORD wVersionRequested = MAKEWORD(2, 2); @@ -140,6 +145,44 @@ int main(int argc, char *argv[]) #endif tdate_init(); + /* get some command-line parameters */ + while (argv[i] != NULL) + { + if (strcmp(argv[i], "-p") == 0 && argv[i+1] != NULL) + { + if ((portStr = strchr(argv[i+1], ':')) != NULL) + { + httpAddress = argv[i+1]; + *portStr = 0; + httpPort = atoi(portStr + 1); + } + else + httpPort = atoi(argv[i+1]); + + i += 2; + continue; + } + + if (strcmp(argv[i], "-s") == 0 && argv[i+1] != NULL) + { + if ((portStr = strchr(argv[i+1], ':')) != NULL) + { + httpsAddress = argv[i+1]; + *portStr = 0; + httpsPort = atoi(portStr + 1); + } + else + httpsPort = atoi(argv[i+1]); + + i += 2; + continue; + } + + printf("%s: [-p [address:]httpport] [-s [address:]httpsport]\n", + argv[0]); + exit(0); + } + for (i = 0; i < INITIAL_CONNECTION_SLOTS; i++) { tp = freeconns; @@ -147,22 +190,20 @@ int main(int argc, char *argv[]) freeconns->next = tp; } - if ((active = openlistener(CONFIG_HTTP_PORT)) == -1) + if ((active = openlistener(httpAddress, httpPort)) == -1) { #ifdef CONFIG_HTTP_VERBOSE - fprintf(stderr, "ERR: Couldn't bind to port %d\n", - CONFIG_HTTP_PORT); + fprintf(stderr, "ERR: Couldn't bind to port %d\n", httpPort); #endif exit(1); } addtoservers(active); - if ((active = openlistener(CONFIG_HTTP_HTTPS_PORT)) == -1) + if ((active = openlistener(httpsAddress, httpsPort)) == -1) { #ifdef CONFIG_HTTP_VERBOSE - fprintf(stderr, "ERR: Couldn't bind to port %d\n", - CONFIG_HTTP_HTTPS_PORT); + fprintf(stderr, "ERR: Couldn't bind to port %d\n", httpsPort); #endif exit(1); } @@ -181,7 +222,7 @@ int main(int argc, char *argv[]) printf("addcgiext %s\n", CONFIG_HTTP_CGI_EXTENSIONS); #endif printf("%s: listening on ports %d (http) and %d (https)\n", - server_version, CONFIG_HTTP_PORT, CONFIG_HTTP_HTTPS_PORT); + server_version, httpPort, httpsPort); TTY_FLUSH(); #endif @@ -418,7 +459,7 @@ static void handlenewconnection(int listenfd, int is_ssl) } #endif -static int openlistener(int port) +static int openlistener(char *address, int port) { int sd; #ifdef WIN32 @@ -435,17 +476,18 @@ static int openlistener(int port) memset(&my_addr, 0, sizeof(my_addr)); my_addr.sin_family = AF_INET; my_addr.sin_port = htons((short)port); - my_addr.sin_addr.s_addr = INADDR_ANY; + my_addr.sin_addr.s_addr = address == NULL ? + INADDR_ANY : inet_addr(address); #else struct sockaddr_in6 my_addr; if ((sd = socket(AF_INET6, SOCK_STREAM, 0)) == -1) return -1; - memset(&my_addr, 0, sizeof(my_addr)); my_addr.sin6_family = AF_INET6; my_addr.sin6_port = htons(port); - my_addr.sin6_addr.s_addr = INADDR_ANY; + my_addr.sin6_addr.s_addr = address == NULL ? + INADDR_ANY : iinet_addr(address); #endif setsockopt(sd, SOL_SOCKET, SO_REUSEADDR, &tp, sizeof(tp)); From 53142c0da5a13d94adf4e2eeb09c644c0a16cf34 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 15 Nov 2009 21:41:57 +0000 Subject: [PATCH 138/301] added shutdown to a CGI socket close. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@163 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/linuxconfig | 12 +- docsrc/axTLS.dox | 2609 +++++++++++++++++++++++--------------------- httpd/axhttpd.c | 1 + www/index.html | 2 +- 4 files changed, 1381 insertions(+), 1243 deletions(-) diff --git a/config/linuxconfig b/config/linuxconfig index 614fdd80e4..1a9f04f5d9 100644 --- a/config/linuxconfig +++ b/config/linuxconfig @@ -4,7 +4,6 @@ HAVE_DOT_CONFIG=y CONFIG_PLATFORM_LINUX=y # CONFIG_PLATFORM_CYGWIN is not set -# CONFIG_PLATFORM_SOLARIS is not set # CONFIG_PLATFORM_WIN32 is not set # @@ -35,7 +34,7 @@ CONFIG_SSL_USE_DEFAULT_KEY=y CONFIG_SSL_PRIVATE_KEY_LOCATION="" CONFIG_SSL_PRIVATE_KEY_PASSWORD="" CONFIG_SSL_X509_CERT_LOCATION="" -CONFIG_SSL_GENERATE_X509_CERT=y +# CONFIG_SSL_GENERATE_X509_CERT is not set CONFIG_SSL_X509_COMMON_NAME="" CONFIG_SSL_X509_ORGANIZATION_NAME="" CONFIG_SSL_X509_ORGANIZATION_UNIT_NAME="" @@ -48,10 +47,11 @@ CONFIG_SSL_MAX_CERTS=2 # CONFIG_SSL_CTX_MUTEXING is not set CONFIG_USE_DEV_URANDOM=y # CONFIG_WIN32_USE_CRYPTO_LIB is not set -CONFIG_OPENSSL_COMPATIBLE=y +# CONFIG_OPENSSL_COMPATIBLE is not set # CONFIG_PERFORMANCE_TESTING is not set # CONFIG_SSL_TEST is not set CONFIG_AXHTTPD=y +# CONFIG_AXTLSWRAP is not set # # Axhttpd Configuration @@ -75,13 +75,15 @@ CONFIG_HTTP_LUA_CGI_LAUNCHER="/bin/cgi" CONFIG_HTTP_DIRECTORIES=y CONFIG_HTTP_HAS_AUTHORIZATION=y # CONFIG_HTTP_HAS_IPV6 is not set -# CONFIG_HTTP_VERBOSE is not set +# CONFIG_HTTP_ENABLE_DIFFERENT_USER is not set +CONFIG_HTTP_USER="" +CONFIG_HTTP_VERBOSE=y # CONFIG_HTTP_IS_DAEMON is not set # # Language Bindings # -CONFIG_BINDINGS=y +# CONFIG_BINDINGS is not set # CONFIG_CSHARP_BINDINGS is not set # CONFIG_VBNET_BINDINGS is not set CONFIG_DOT_NET_FRAMEWORK_BASE="" diff --git a/docsrc/axTLS.dox b/docsrc/axTLS.dox index d9959b21dd..bca7d811dc 100644 --- a/docsrc/axTLS.dox +++ b/docsrc/axTLS.dox @@ -1,1237 +1,1372 @@ -# Doxyfile 1.4.5 - -# This file describes the settings to be used by the documentation system -# doxygen (www.doxygen.org) for a project -# -# All text after a hash (#) is considered a comment and will be ignored -# The format is: -# TAG = value [value, ...] -# For lists items can also be appended using: -# TAG += value [value, ...] -# Values that contain spaces should be placed between quotes (" ") - -#--------------------------------------------------------------------------- -# Project related configuration options -#--------------------------------------------------------------------------- - -# The PROJECT_NAME tag is a single word (or a sequence of words surrounded -# by quotes) that should identify the project. - -PROJECT_NAME = axTLS - -# The PROJECT_NUMBER tag can be used to enter a project or revision number. -# This could be handy for archiving the generated documentation or -# if some version control system is used. - -PROJECT_NUMBER = - -# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) -# base path where the generated documentation will be put. -# If a relative path is entered, it will be relative to the location -# where doxygen was started. If left blank the current directory will be used. - -OUTPUT_DIRECTORY = - -# If the CREATE_SUBDIRS tag is set to YES, then doxygen will create -# 4096 sub-directories (in 2 levels) under the output directory of each output -# format and will distribute the generated files over these directories. -# Enabling this option can be useful when feeding doxygen a huge amount of -# source files, where putting all generated files in the same directory would -# otherwise cause performance problems for the file system. - -CREATE_SUBDIRS = NO - -# The OUTPUT_LANGUAGE tag is used to specify the language in which all -# documentation generated by doxygen is written. Doxygen will use this -# information to generate all constant output in the proper language. -# The default language is English, other supported languages are: -# Brazilian, Catalan, Chinese, Chinese-Traditional, Croatian, Czech, Danish, -# Dutch, Finnish, French, German, Greek, Hungarian, Italian, Japanese, -# Japanese-en (Japanese with English messages), Korean, Korean-en, Norwegian, -# Polish, Portuguese, Romanian, Russian, Serbian, Slovak, Slovene, Spanish, -# Swedish, and Ukrainian. - -OUTPUT_LANGUAGE = English - -# This tag can be used to specify the encoding used in the generated output. -# The encoding is not always determined by the language that is chosen, -# but also whether or not the output is meant for Windows or non-Windows users. -# In case there is a difference, setting the USE_WINDOWS_ENCODING tag to YES -# forces the Windows encoding (this is the default for the Windows binary), -# whereas setting the tag to NO uses a Unix-style encoding (the default for -# all platforms other than Windows). - -USE_WINDOWS_ENCODING = NO - -# If the BRIEF_MEMBER_DESC tag is set to YES (the default) Doxygen will -# include brief member descriptions after the members that are listed in -# the file and class documentation (similar to JavaDoc). -# Set to NO to disable this. - -BRIEF_MEMBER_DESC = YES - -# If the REPEAT_BRIEF tag is set to YES (the default) Doxygen will prepend -# the brief description of a member or function before the detailed description. -# Note: if both HIDE_UNDOC_MEMBERS and BRIEF_MEMBER_DESC are set to NO, the -# brief descriptions will be completely suppressed. - -REPEAT_BRIEF = YES - -# This tag implements a quasi-intelligent brief description abbreviator -# that is used to form the text in various listings. Each string -# in this list, if found as the leading text of the brief description, will be -# stripped from the text and the result after processing the whole list, is -# used as the annotated text. Otherwise, the brief description is used as-is. -# If left blank, the following values are used ("$name" is automatically -# replaced with the name of the entity): "The $name class" "The $name widget" -# "The $name file" "is" "provides" "specifies" "contains" -# "represents" "a" "an" "the" - -ABBREVIATE_BRIEF = - -# If the ALWAYS_DETAILED_SEC and REPEAT_BRIEF tags are both set to YES then -# Doxygen will generate a detailed section even if there is only a brief -# description. - -ALWAYS_DETAILED_SEC = NO - -# If the INLINE_INHERITED_MEMB tag is set to YES, doxygen will show all -# inherited members of a class in the documentation of that class as if those -# members were ordinary class members. Constructors, destructors and assignment -# operators of the base classes will not be shown. - -INLINE_INHERITED_MEMB = NO - -# If the FULL_PATH_NAMES tag is set to YES then Doxygen will prepend the full -# path before files name in the file list and in the header files. If set -# to NO the shortest path that makes the file name unique will be used. - -FULL_PATH_NAMES = NO - -# If the FULL_PATH_NAMES tag is set to YES then the STRIP_FROM_PATH tag -# can be used to strip a user-defined part of the path. Stripping is -# only done if one of the specified strings matches the left-hand part of -# the path. The tag can be used to show relative paths in the file list. -# If left blank the directory from which doxygen is run is used as the -# path to strip. - -STRIP_FROM_PATH = - -# The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of -# the path mentioned in the documentation of a class, which tells -# the reader which header file to include in order to use a class. -# If left blank only the name of the header file containing the class -# definition is used. Otherwise one should specify the include paths that -# are normally passed to the compiler using the -I flag. - -STRIP_FROM_INC_PATH = - -# If the SHORT_NAMES tag is set to YES, doxygen will generate much shorter -# (but less readable) file names. This can be useful is your file systems -# doesn't support long names like on DOS, Mac, or CD-ROM. - -SHORT_NAMES = NO - -# If the JAVADOC_AUTOBRIEF tag is set to YES then Doxygen -# will interpret the first line (until the first dot) of a JavaDoc-style -# comment as the brief description. If set to NO, the JavaDoc -# comments will behave just like the Qt-style comments (thus requiring an -# explicit @brief command for a brief description. - -JAVADOC_AUTOBRIEF = NO - -# The MULTILINE_CPP_IS_BRIEF tag can be set to YES to make Doxygen -# treat a multi-line C++ special comment block (i.e. a block of //! or /// -# comments) as a brief description. This used to be the default behaviour. -# The new default is to treat a multi-line C++ comment block as a detailed -# description. Set this tag to YES if you prefer the old behaviour instead. - -MULTILINE_CPP_IS_BRIEF = NO - -# If the DETAILS_AT_TOP tag is set to YES then Doxygen -# will output the detailed description near the top, like JavaDoc. -# If set to NO, the detailed description appears after the member -# documentation. - -DETAILS_AT_TOP = NO - -# If the INHERIT_DOCS tag is set to YES (the default) then an undocumented -# member inherits the documentation from any documented member that it -# re-implements. - -INHERIT_DOCS = YES - -# If the SEPARATE_MEMBER_PAGES tag is set to YES, then doxygen will produce -# a new page for each member. If set to NO, the documentation of a member will -# be part of the file/class/namespace that contains it. - -SEPARATE_MEMBER_PAGES = NO - -# The TAB_SIZE tag can be used to set the number of spaces in a tab. -# Doxygen uses this value to replace tabs by spaces in code fragments. - -TAB_SIZE = 4 - -# This tag can be used to specify a number of aliases that acts -# as commands in the documentation. An alias has the form "name=value". -# For example adding "sideeffect=\par Side Effects:\n" will allow you to -# put the command \sideeffect (or @sideeffect) in the documentation, which -# will result in a user-defined paragraph with heading "Side Effects:". -# You can put \n's in the value part of an alias to insert newlines. - -ALIASES = - -# Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C -# sources only. Doxygen will then generate output that is more tailored for C. -# For instance, some of the names that are used will be different. The list -# of all members will be omitted, etc. - -OPTIMIZE_OUTPUT_FOR_C = YES - -# Set the OPTIMIZE_OUTPUT_JAVA tag to YES if your project consists of Java -# sources only. Doxygen will then generate output that is more tailored for Java. -# For instance, namespaces will be presented as packages, qualified scopes -# will look different, etc. - -OPTIMIZE_OUTPUT_JAVA = NO - -# If you use STL classes (i.e. std::string, std::vector, etc.) but do not want to -# include (a tag file for) the STL sources as input, then you should -# set this tag to YES in order to let doxygen match functions declarations and -# definitions whose arguments contain STL classes (e.g. func(std::string); v.s. -# func(std::string) {}). This also make the inheritance and collaboration -# diagrams that involve STL classes more complete and accurate. - -BUILTIN_STL_SUPPORT = NO - -# If member grouping is used in the documentation and the DISTRIBUTE_GROUP_DOC -# tag is set to YES, then doxygen will reuse the documentation of the first -# member in the group (if any) for the other members of the group. By default -# all members of a group must be documented explicitly. - -DISTRIBUTE_GROUP_DOC = NO - -# Set the SUBGROUPING tag to YES (the default) to allow class member groups of -# the same type (for instance a group of public functions) to be put as a -# subgroup of that type (e.g. under the Public Functions section). Set it to -# NO to prevent subgrouping. Alternatively, this can be done per class using -# the \nosubgrouping command. - -SUBGROUPING = YES - -#--------------------------------------------------------------------------- -# Build related configuration options -#--------------------------------------------------------------------------- - -# If the EXTRACT_ALL tag is set to YES doxygen will assume all entities in -# documentation are documented, even if no documentation was available. -# Private class members and static file members will be hidden unless -# the EXTRACT_PRIVATE and EXTRACT_STATIC tags are set to YES - -EXTRACT_ALL = NO - -# If the EXTRACT_PRIVATE tag is set to YES all private members of a class -# will be included in the documentation. - -EXTRACT_PRIVATE = NO - -# If the EXTRACT_STATIC tag is set to YES all static members of a file -# will be included in the documentation. - -EXTRACT_STATIC = NO - -# If the EXTRACT_LOCAL_CLASSES tag is set to YES classes (and structs) -# defined locally in source files will be included in the documentation. -# If set to NO only classes defined in header files are included. - -EXTRACT_LOCAL_CLASSES = YES - -# This flag is only useful for Objective-C code. When set to YES local -# methods, which are defined in the implementation section but not in -# the interface are included in the documentation. -# If set to NO (the default) only methods in the interface are included. - -EXTRACT_LOCAL_METHODS = NO - -# If the HIDE_UNDOC_MEMBERS tag is set to YES, Doxygen will hide all -# undocumented members of documented classes, files or namespaces. -# If set to NO (the default) these members will be included in the -# various overviews, but no documentation section is generated. -# This option has no effect if EXTRACT_ALL is enabled. - -HIDE_UNDOC_MEMBERS = NO - -# If the HIDE_UNDOC_CLASSES tag is set to YES, Doxygen will hide all -# undocumented classes that are normally visible in the class hierarchy. -# If set to NO (the default) these classes will be included in the various -# overviews. This option has no effect if EXTRACT_ALL is enabled. - -HIDE_UNDOC_CLASSES = NO - -# If the HIDE_FRIEND_COMPOUNDS tag is set to YES, Doxygen will hide all -# friend (class|struct|union) declarations. -# If set to NO (the default) these declarations will be included in the -# documentation. - -HIDE_FRIEND_COMPOUNDS = NO - -# If the HIDE_IN_BODY_DOCS tag is set to YES, Doxygen will hide any -# documentation blocks found inside the body of a function. -# If set to NO (the default) these blocks will be appended to the -# function's detailed documentation block. - -HIDE_IN_BODY_DOCS = NO - -# The INTERNAL_DOCS tag determines if documentation -# that is typed after a \internal command is included. If the tag is set -# to NO (the default) then the documentation will be excluded. -# Set it to YES to include the internal documentation. - -INTERNAL_DOCS = NO - -# If the CASE_SENSE_NAMES tag is set to NO then Doxygen will only generate -# file names in lower-case letters. If set to YES upper-case letters are also -# allowed. This is useful if you have classes or files whose names only differ -# in case and if your file system supports case sensitive file names. Windows -# and Mac users are advised to set this option to NO. - -CASE_SENSE_NAMES = YES - -# If the HIDE_SCOPE_NAMES tag is set to NO (the default) then Doxygen -# will show members with their full class and namespace scopes in the -# documentation. If set to YES the scope will be hidden. - -HIDE_SCOPE_NAMES = NO - -# If the SHOW_INCLUDE_FILES tag is set to YES (the default) then Doxygen -# will put a list of the files that are included by a file in the documentation -# of that file. - -SHOW_INCLUDE_FILES = NO - -# If the INLINE_INFO tag is set to YES (the default) then a tag [inline] -# is inserted in the documentation for inline members. - -INLINE_INFO = YES - -# If the SORT_MEMBER_DOCS tag is set to YES (the default) then doxygen -# will sort the (detailed) documentation of file and class members -# alphabetically by member name. If set to NO the members will appear in -# declaration order. - -SORT_MEMBER_DOCS = NO - -# If the SORT_BRIEF_DOCS tag is set to YES then doxygen will sort the -# brief documentation of file, namespace and class members alphabetically -# by member name. If set to NO (the default) the members will appear in -# declaration order. - -SORT_BRIEF_DOCS = NO - -# If the SORT_BY_SCOPE_NAME tag is set to YES, the class list will be -# sorted by fully-qualified names, including namespaces. If set to -# NO (the default), the class list will be sorted only by class name, -# not including the namespace part. -# Note: This option is not very useful if HIDE_SCOPE_NAMES is set to YES. -# Note: This option applies only to the class list, not to the -# alphabetical list. - -SORT_BY_SCOPE_NAME = NO - -# The GENERATE_TODOLIST tag can be used to enable (YES) or -# disable (NO) the todo list. This list is created by putting \todo -# commands in the documentation. - -GENERATE_TODOLIST = YES - -# The GENERATE_TESTLIST tag can be used to enable (YES) or -# disable (NO) the test list. This list is created by putting \test -# commands in the documentation. - -GENERATE_TESTLIST = YES - -# The GENERATE_BUGLIST tag can be used to enable (YES) or -# disable (NO) the bug list. This list is created by putting \bug -# commands in the documentation. - -GENERATE_BUGLIST = YES - -# The GENERATE_DEPRECATEDLIST tag can be used to enable (YES) or -# disable (NO) the deprecated list. This list is created by putting -# \deprecated commands in the documentation. - -GENERATE_DEPRECATEDLIST= YES - -# The ENABLED_SECTIONS tag can be used to enable conditional -# documentation sections, marked by \if sectionname ... \endif. - -ENABLED_SECTIONS = - -# The MAX_INITIALIZER_LINES tag determines the maximum number of lines -# the initial value of a variable or define consists of for it to appear in -# the documentation. If the initializer consists of more lines than specified -# here it will be hidden. Use a value of 0 to hide initializers completely. -# The appearance of the initializer of individual variables and defines in the -# documentation can be controlled using \showinitializer or \hideinitializer -# command in the documentation regardless of this setting. - -MAX_INITIALIZER_LINES = 30 - -# Set the SHOW_USED_FILES tag to NO to disable the list of files generated -# at the bottom of the documentation of classes and structs. If set to YES the -# list will mention the files that were used to generate the documentation. - -SHOW_USED_FILES = NO - -# If the sources in your project are distributed over multiple directories -# then setting the SHOW_DIRECTORIES tag to YES will show the directory hierarchy -# in the documentation. The default is YES. - -SHOW_DIRECTORIES = NO - -# The FILE_VERSION_FILTER tag can be used to specify a program or script that -# doxygen should invoke to get the current version for each file (typically from the -# version control system). Doxygen will invoke the program by executing (via -# popen()) the command , where is the value of -# the FILE_VERSION_FILTER tag, and is the name of an input file -# provided by doxygen. Whatever the program writes to standard output -# is used as the file version. See the manual for examples. - -FILE_VERSION_FILTER = - -#--------------------------------------------------------------------------- -# configuration options related to warning and progress messages -#--------------------------------------------------------------------------- - -# The QUIET tag can be used to turn on/off the messages that are generated -# by doxygen. Possible values are YES and NO. If left blank NO is used. - -QUIET = NO - -# The WARNINGS tag can be used to turn on/off the warning messages that are -# generated by doxygen. Possible values are YES and NO. If left blank -# NO is used. - -WARNINGS = YES - -# If WARN_IF_UNDOCUMENTED is set to YES, then doxygen will generate warnings -# for undocumented members. If EXTRACT_ALL is set to YES then this flag will -# automatically be disabled. - -WARN_IF_UNDOCUMENTED = YES - -# If WARN_IF_DOC_ERROR is set to YES, doxygen will generate warnings for -# potential errors in the documentation, such as not documenting some -# parameters in a documented function, or documenting parameters that -# don't exist or using markup commands wrongly. - -WARN_IF_DOC_ERROR = YES - -# This WARN_NO_PARAMDOC option can be abled to get warnings for -# functions that are documented, but have no documentation for their parameters -# or return value. If set to NO (the default) doxygen will only warn about -# wrong or incomplete parameter documentation, but not about the absence of -# documentation. - -WARN_NO_PARAMDOC = NO - -# The WARN_FORMAT tag determines the format of the warning messages that -# doxygen can produce. The string should contain the $file, $line, and $text -# tags, which will be replaced by the file and line number from which the -# warning originated and the warning text. Optionally the format may contain -# $version, which will be replaced by the version of the file (if it could -# be obtained via FILE_VERSION_FILTER) - -WARN_FORMAT = "$file:$line: $text" - -# The WARN_LOGFILE tag can be used to specify a file to which warning -# and error messages should be written. If left blank the output is written -# to stderr. - -WARN_LOGFILE = - -#--------------------------------------------------------------------------- -# configuration options related to the input files -#--------------------------------------------------------------------------- - -# The INPUT tag can be used to specify the files and/or directories that contain -# documented source files. You may enter file names like "myfile.cpp" or -# directories like "/usr/src/myproject". Separate the files or directories -# with spaces. - -INPUT = ../bindings/csharp/axTLS.cs ../bindings/java/SSL.java ../bindings/java/SSLUtil.java ../bindings/java/SSLCTX.java ../bindings/java/SSLServer.java ../bindings/java/SSLClient.java ../bindings/java/SSLReadHolder.java ../ssl/ssl.h ../crypto/bigint.c ../crypto/bigint.h - -# If the value of the INPUT tag contains directories, you can use the -# FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp -# and *.h) to filter out the source-files in the directories. If left -# blank the following patterns are tested: -# *.c *.cc *.cxx *.cpp *.c++ *.java *.ii *.ixx *.ipp *.i++ *.inl *.h *.hh *.hxx -# *.hpp *.h++ *.idl *.odl *.cs *.php *.php3 *.inc *.m *.mm *.py - -FILE_PATTERNS = - -# The RECURSIVE tag can be used to turn specify whether or not subdirectories -# should be searched for input files as well. Possible values are YES and NO. -# If left blank NO is used. - -RECURSIVE = NO - -# The EXCLUDE tag can be used to specify files and/or directories that should -# excluded from the INPUT source files. This way you can easily exclude a -# subdirectory from a directory tree whose root is specified with the INPUT tag. - -EXCLUDE = - -# The EXCLUDE_SYMLINKS tag can be used select whether or not files or -# directories that are symbolic links (a Unix filesystem feature) are excluded -# from the input. - -EXCLUDE_SYMLINKS = NO - -# If the value of the INPUT tag contains directories, you can use the -# EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude -# certain files from those directories. Note that the wildcards are matched -# against the file with absolute path, so to exclude all test directories -# for example use the pattern */test/* - -EXCLUDE_PATTERNS = - -# The EXAMPLE_PATH tag can be used to specify one or more files or -# directories that contain example code fragments that are included (see -# the \include command). - -EXAMPLE_PATH = - -# If the value of the EXAMPLE_PATH tag contains directories, you can use the -# EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp -# and *.h) to filter out the source-files in the directories. If left -# blank all files are included. - -EXAMPLE_PATTERNS = - -# If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be -# searched for input files to be used with the \include or \dontinclude -# commands irrespective of the value of the RECURSIVE tag. -# Possible values are YES and NO. If left blank NO is used. - -EXAMPLE_RECURSIVE = NO - -# The IMAGE_PATH tag can be used to specify one or more files or -# directories that contain image that are included in the documentation (see -# the \image command). - -IMAGE_PATH = images - -# The INPUT_FILTER tag can be used to specify a program that doxygen should -# invoke to filter for each input file. Doxygen will invoke the filter program -# by executing (via popen()) the command , where -# is the value of the INPUT_FILTER tag, and is the name of an -# input file. Doxygen will then use the output that the filter program writes -# to standard output. If FILTER_PATTERNS is specified, this tag will be -# ignored. - -INPUT_FILTER = - -# The FILTER_PATTERNS tag can be used to specify filters on a per file pattern -# basis. Doxygen will compare the file name with each pattern and apply the -# filter if there is a match. The filters are a list of the form: -# pattern=filter (like *.cpp=my_cpp_filter). See INPUT_FILTER for further -# info on how filters are used. If FILTER_PATTERNS is empty, INPUT_FILTER -# is applied to all files. - -FILTER_PATTERNS = - -# If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using -# INPUT_FILTER) will be used to filter the input files when producing source -# files to browse (i.e. when SOURCE_BROWSER is set to YES). - -FILTER_SOURCE_FILES = NO - -#--------------------------------------------------------------------------- -# configuration options related to source browsing -#--------------------------------------------------------------------------- - -# If the SOURCE_BROWSER tag is set to YES then a list of source files will -# be generated. Documented entities will be cross-referenced with these sources. -# Note: To get rid of all source code in the generated output, make sure also -# VERBATIM_HEADERS is set to NO. - -SOURCE_BROWSER = NO - -# Setting the INLINE_SOURCES tag to YES will include the body -# of functions and classes directly in the documentation. - -INLINE_SOURCES = NO - -# Setting the STRIP_CODE_COMMENTS tag to YES (the default) will instruct -# doxygen to hide any special comment blocks from generated source code -# fragments. Normal C and C++ comments will always remain visible. - -STRIP_CODE_COMMENTS = YES - -# If the REFERENCED_BY_RELATION tag is set to YES (the default) -# then for each documented function all documented -# functions referencing it will be listed. - -REFERENCED_BY_RELATION = YES - -# If the REFERENCES_RELATION tag is set to YES (the default) -# then for each documented function all documented entities -# called/used by that function will be listed. - -REFERENCES_RELATION = YES - -# If the USE_HTAGS tag is set to YES then the references to source code -# will point to the HTML generated by the htags(1) tool instead of doxygen -# built-in source browser. The htags tool is part of GNU's global source -# tagging system (see http://www.gnu.org/software/global/global.html). You -# will need version 4.8.6 or higher. - -USE_HTAGS = NO - -# If the VERBATIM_HEADERS tag is set to YES (the default) then Doxygen -# will generate a verbatim copy of the header file for each class for -# which an include is specified. Set to NO to disable this. - -VERBATIM_HEADERS = NO - -#--------------------------------------------------------------------------- -# configuration options related to the alphabetical class index -#--------------------------------------------------------------------------- - -# If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index -# of all compounds will be generated. Enable this if the project -# contains a lot of classes, structs, unions or interfaces. - -ALPHABETICAL_INDEX = NO - -# If the alphabetical index is enabled (see ALPHABETICAL_INDEX) then -# the COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns -# in which this list will be split (can be a number in the range [1..20]) - -COLS_IN_ALPHA_INDEX = 5 - -# In case all classes in a project start with a common prefix, all -# classes will be put under the same header in the alphabetical index. -# The IGNORE_PREFIX tag can be used to specify one or more prefixes that -# should be ignored while generating the index headers. - -IGNORE_PREFIX = - -#--------------------------------------------------------------------------- -# configuration options related to the HTML output -#--------------------------------------------------------------------------- - -# If the GENERATE_HTML tag is set to YES (the default) Doxygen will -# generate HTML output. - -GENERATE_HTML = YES - -# The HTML_OUTPUT tag is used to specify where the HTML docs will be put. -# If a relative path is entered the value of OUTPUT_DIRECTORY will be -# put in front of it. If left blank `html' will be used as the default path. - -HTML_OUTPUT = html - -# The HTML_FILE_EXTENSION tag can be used to specify the file extension for -# each generated HTML page (for example: .htm,.php,.asp). If it is left blank -# doxygen will generate files with .html extension. - -HTML_FILE_EXTENSION = .html - -# The HTML_HEADER tag can be used to specify a personal HTML header for -# each generated HTML page. If it is left blank doxygen will generate a -# standard header. - -HTML_HEADER = - -# The HTML_FOOTER tag can be used to specify a personal HTML footer for -# each generated HTML page. If it is left blank doxygen will generate a -# standard footer. - -HTML_FOOTER = doco_footer.html - -# The HTML_STYLESHEET tag can be used to specify a user-defined cascading -# style sheet that is used by each HTML page. It can be used to -# fine-tune the look of the HTML output. If the tag is left blank doxygen -# will generate a default style sheet. Note that doxygen will try to copy -# the style sheet file to the HTML output directory, so don't put your own -# stylesheet in the HTML output directory as well, or it will be erased! - -HTML_STYLESHEET = - -# If the HTML_ALIGN_MEMBERS tag is set to YES, the members of classes, -# files or namespaces will be aligned in HTML using tables. If set to -# NO a bullet list will be used. - -HTML_ALIGN_MEMBERS = YES - -# If the GENERATE_HTMLHELP tag is set to YES, additional index files -# will be generated that can be used as input for tools like the -# Microsoft HTML help workshop to generate a compressed HTML help file (.chm) -# of the generated HTML documentation. - -GENERATE_HTMLHELP = NO - -# If the GENERATE_HTMLHELP tag is set to YES, the CHM_FILE tag can -# be used to specify the file name of the resulting .chm file. You -# can add a path in front of the file if the result should not be -# written to the html output directory. - -CHM_FILE = - -# If the GENERATE_HTMLHELP tag is set to YES, the HHC_LOCATION tag can -# be used to specify the location (absolute path including file name) of -# the HTML help compiler (hhc.exe). If non-empty doxygen will try to run -# the HTML help compiler on the generated index.hhp. - -HHC_LOCATION = - -# If the GENERATE_HTMLHELP tag is set to YES, the GENERATE_CHI flag -# controls if a separate .chi index file is generated (YES) or that -# it should be included in the master .chm file (NO). - -GENERATE_CHI = NO - -# If the GENERATE_HTMLHELP tag is set to YES, the BINARY_TOC flag -# controls whether a binary table of contents is generated (YES) or a -# normal table of contents (NO) in the .chm file. - -BINARY_TOC = NO - -# The TOC_EXPAND flag can be set to YES to add extra items for group members -# to the contents of the HTML help documentation and to the tree view. - -TOC_EXPAND = YES - -# The DISABLE_INDEX tag can be used to turn on/off the condensed index at -# top of each HTML page. The value NO (the default) enables the index and -# the value YES disables it. - -DISABLE_INDEX = YES - -# This tag can be used to set the number of enum values (range [1..20]) -# that doxygen will group on one line in the generated HTML documentation. - -ENUM_VALUES_PER_LINE = 4 - -# If the GENERATE_TREEVIEW tag is set to YES, a side panel will be -# generated containing a tree-like index structure (just like the one that -# is generated for HTML Help). For this to work a browser that supports -# JavaScript, DHTML, CSS and frames is required (for instance Mozilla 1.0+, -# Netscape 6.0+, Internet explorer 5.0+, or Konqueror). Windows users are -# probably better off using the HTML help feature. - -GENERATE_TREEVIEW = YES - -# If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be -# used to set the initial width (in pixels) of the frame in which the tree -# is shown. - -TREEVIEW_WIDTH = 250 - -#--------------------------------------------------------------------------- -# configuration options related to the LaTeX output -#--------------------------------------------------------------------------- - -# If the GENERATE_LATEX tag is set to YES (the default) Doxygen will -# generate Latex output. - -GENERATE_LATEX = NO - -# The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put. -# If a relative path is entered the value of OUTPUT_DIRECTORY will be -# put in front of it. If left blank `latex' will be used as the default path. - -LATEX_OUTPUT = latex - -# The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be -# invoked. If left blank `latex' will be used as the default command name. - -LATEX_CMD_NAME = latex - -# The MAKEINDEX_CMD_NAME tag can be used to specify the command name to -# generate index for LaTeX. If left blank `makeindex' will be used as the -# default command name. - -MAKEINDEX_CMD_NAME = makeindex - -# If the COMPACT_LATEX tag is set to YES Doxygen generates more compact -# LaTeX documents. This may be useful for small projects and may help to -# save some trees in general. - -COMPACT_LATEX = NO - -# The PAPER_TYPE tag can be used to set the paper type that is used -# by the printer. Possible values are: a4, a4wide, letter, legal and -# executive. If left blank a4wide will be used. - -PAPER_TYPE = a4wide - -# The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX -# packages that should be included in the LaTeX output. - -EXTRA_PACKAGES = - -# The LATEX_HEADER tag can be used to specify a personal LaTeX header for -# the generated latex document. The header should contain everything until -# the first chapter. If it is left blank doxygen will generate a -# standard header. Notice: only use this tag if you know what you are doing! - -LATEX_HEADER = - -# If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated -# is prepared for conversion to pdf (using ps2pdf). The pdf file will -# contain links (just like the HTML output) instead of page references -# This makes the output suitable for online browsing using a pdf viewer. - -PDF_HYPERLINKS = NO - -# If the USE_PDFLATEX tag is set to YES, pdflatex will be used instead of -# plain latex in the generated Makefile. Set this option to YES to get a -# higher quality PDF documentation. - -USE_PDFLATEX = NO - -# If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \\batchmode. -# command to the generated LaTeX files. This will instruct LaTeX to keep -# running if errors occur, instead of asking the user for help. -# This option is also used when generating formulas in HTML. - -LATEX_BATCHMODE = NO - -# If LATEX_HIDE_INDICES is set to YES then doxygen will not -# include the index chapters (such as File Index, Compound Index, etc.) -# in the output. - -LATEX_HIDE_INDICES = NO - -#--------------------------------------------------------------------------- -# configuration options related to the RTF output -#--------------------------------------------------------------------------- - -# If the GENERATE_RTF tag is set to YES Doxygen will generate RTF output -# The RTF output is optimized for Word 97 and may not look very pretty with -# other RTF readers or editors. - -GENERATE_RTF = NO - -# The RTF_OUTPUT tag is used to specify where the RTF docs will be put. -# If a relative path is entered the value of OUTPUT_DIRECTORY will be -# put in front of it. If left blank `rtf' will be used as the default path. - -RTF_OUTPUT = rtf - -# If the COMPACT_RTF tag is set to YES Doxygen generates more compact -# RTF documents. This may be useful for small projects and may help to -# save some trees in general. - -COMPACT_RTF = NO - -# If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated -# will contain hyperlink fields. The RTF file will -# contain links (just like the HTML output) instead of page references. -# This makes the output suitable for online browsing using WORD or other -# programs which support those fields. -# Note: wordpad (write) and others do not support links. - -RTF_HYPERLINKS = NO - -# Load stylesheet definitions from file. Syntax is similar to doxygen's -# config file, i.e. a series of assignments. You only have to provide -# replacements, missing definitions are set to their default value. - -RTF_STYLESHEET_FILE = - -# Set optional variables used in the generation of an rtf document. -# Syntax is similar to doxygen's config file. - -RTF_EXTENSIONS_FILE = - -#--------------------------------------------------------------------------- -# configuration options related to the man page output -#--------------------------------------------------------------------------- - -# If the GENERATE_MAN tag is set to YES (the default) Doxygen will -# generate man pages - -GENERATE_MAN = NO - -# The MAN_OUTPUT tag is used to specify where the man pages will be put. -# If a relative path is entered the value of OUTPUT_DIRECTORY will be -# put in front of it. If left blank `man' will be used as the default path. - -MAN_OUTPUT = man - -# The MAN_EXTENSION tag determines the extension that is added to -# the generated man pages (default is the subroutine's section .3) - -MAN_EXTENSION = .3 - -# If the MAN_LINKS tag is set to YES and Doxygen generates man output, -# then it will generate one additional man file for each entity -# documented in the real man page(s). These additional files -# only source the real man page, but without them the man command -# would be unable to find the correct page. The default is NO. - -MAN_LINKS = NO - -#--------------------------------------------------------------------------- -# configuration options related to the XML output -#--------------------------------------------------------------------------- - -# If the GENERATE_XML tag is set to YES Doxygen will -# generate an XML file that captures the structure of -# the code including all documentation. - -GENERATE_XML = NO - -# The XML_OUTPUT tag is used to specify where the XML pages will be put. -# If a relative path is entered the value of OUTPUT_DIRECTORY will be -# put in front of it. If left blank `xml' will be used as the default path. - -XML_OUTPUT = xml - -# The XML_SCHEMA tag can be used to specify an XML schema, -# which can be used by a validating XML parser to check the -# syntax of the XML files. - -XML_SCHEMA = - -# The XML_DTD tag can be used to specify an XML DTD, -# which can be used by a validating XML parser to check the -# syntax of the XML files. - -XML_DTD = - -# If the XML_PROGRAMLISTING tag is set to YES Doxygen will -# dump the program listings (including syntax highlighting -# and cross-referencing information) to the XML output. Note that -# enabling this will significantly increase the size of the XML output. - -XML_PROGRAMLISTING = YES - -#--------------------------------------------------------------------------- -# configuration options for the AutoGen Definitions output -#--------------------------------------------------------------------------- - -# If the GENERATE_AUTOGEN_DEF tag is set to YES Doxygen will -# generate an AutoGen Definitions (see autogen.sf.net) file -# that captures the structure of the code including all -# documentation. Note that this feature is still experimental -# and incomplete at the moment. - -GENERATE_AUTOGEN_DEF = NO - -#--------------------------------------------------------------------------- -# configuration options related to the Perl module output -#--------------------------------------------------------------------------- - -# If the GENERATE_PERLMOD tag is set to YES Doxygen will -# generate a Perl module file that captures the structure of -# the code including all documentation. Note that this -# feature is still experimental and incomplete at the -# moment. - -GENERATE_PERLMOD = NO - -# If the PERLMOD_LATEX tag is set to YES Doxygen will generate -# the necessary Makefile rules, Perl scripts and LaTeX code to be able -# to generate PDF and DVI output from the Perl module output. - -PERLMOD_LATEX = NO - -# If the PERLMOD_PRETTY tag is set to YES the Perl module output will be -# nicely formatted so it can be parsed by a human reader. This is useful -# if you want to understand what is going on. On the other hand, if this -# tag is set to NO the size of the Perl module output will be much smaller -# and Perl will parse it just the same. - -PERLMOD_PRETTY = YES - -# The names of the make variables in the generated doxyrules.make file -# are prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX. -# This is useful so different doxyrules.make files included by the same -# Makefile don't overwrite each other's variables. - -PERLMOD_MAKEVAR_PREFIX = - -#--------------------------------------------------------------------------- -# Configuration options related to the preprocessor -#--------------------------------------------------------------------------- - -# If the ENABLE_PREPROCESSING tag is set to YES (the default) Doxygen will -# evaluate all C-preprocessor directives found in the sources and include -# files. - -ENABLE_PREPROCESSING = YES - -# If the MACRO_EXPANSION tag is set to YES Doxygen will expand all macro -# names in the source code. If set to NO (the default) only conditional -# compilation will be performed. Macro expansion can be done in a controlled -# way by setting EXPAND_ONLY_PREDEF to YES. - -MACRO_EXPANSION = YES - -# If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES -# then the macro expansion is limited to the macros specified with the -# PREDEFINED and EXPAND_AS_DEFINED tags. - -EXPAND_ONLY_PREDEF = YES - -# If the SEARCH_INCLUDES tag is set to YES (the default) the includes files -# in the INCLUDE_PATH (see below) will be search if a #include is found. - -SEARCH_INCLUDES = YES - -# The INCLUDE_PATH tag can be used to specify one or more directories that -# contain include files that are not input files but should be processed by -# the preprocessor. - -INCLUDE_PATH = - -# You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard -# patterns (like *.h and *.hpp) to filter out the header-files in the -# directories. If left blank, the patterns specified with FILE_PATTERNS will -# be used. - -INCLUDE_FILE_PATTERNS = - -# The PREDEFINED tag can be used to specify one or more macro names that -# are defined before the preprocessor is started (similar to the -D option of -# gcc). The argument of the tag is a list of macros of the form: name -# or name=definition (no spaces). If the definition and the = are -# omitted =1 is assumed. To prevent a macro definition from being -# undefined via #undef or recursively expanded use the := operator -# instead of the = operator. - -PREDEFINED = CONFIG_SSL_CERT_VERIFICATION CONFIG_SSL_ENABLE_CLIENT CONFIG_SSL_GENERATE_X509_CERT CONFIG_BIGINT_MONTGOMERY CONFIG_BIGINT_BARRETT CONFIG_BIGINT_CRT EXP_FUNC="" STDCALL="" - -# If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then -# this tag can be used to specify a list of macro names that should be expanded. -# The macro definition that is found in the sources will be used. -# Use the PREDEFINED tag if you want to use a different macro definition. - -EXPAND_AS_DEFINED = - -# If the SKIP_FUNCTION_MACROS tag is set to YES (the default) then -# doxygen's preprocessor will remove all function-like macros that are alone -# on a line, have an all uppercase name, and do not end with a semicolon. Such -# function macros are typically used for boiler-plate code, and will confuse -# the parser if not removed. - -SKIP_FUNCTION_MACROS = YES - -#--------------------------------------------------------------------------- -# Configuration::additions related to external references -#--------------------------------------------------------------------------- - -# The TAGFILES option can be used to specify one or more tagfiles. -# Optionally an initial location of the external documentation -# can be added for each tagfile. The format of a tag file without -# this location is as follows: -# TAGFILES = file1 file2 ... -# Adding location for the tag files is done as follows: -# TAGFILES = file1=loc1 "file2 = loc2" ... -# where "loc1" and "loc2" can be relative or absolute paths or -# URLs. If a location is present for each tag, the installdox tool -# does not have to be run to correct the links. -# Note that each tag file must have a unique name -# (where the name does NOT include the path) -# If a tag file is not located in the directory in which doxygen -# is run, you must also specify the path to the tagfile here. - -TAGFILES = - -# When a file name is specified after GENERATE_TAGFILE, doxygen will create -# a tag file that is based on the input files it reads. - -GENERATE_TAGFILE = - -# If the ALLEXTERNALS tag is set to YES all external classes will be listed -# in the class index. If set to NO only the inherited external classes -# will be listed. - -ALLEXTERNALS = NO - -# If the EXTERNAL_GROUPS tag is set to YES all external groups will be listed -# in the modules index. If set to NO, only the current project's groups will -# be listed. - -EXTERNAL_GROUPS = NO - -# The PERL_PATH should be the absolute path and name of the perl script -# interpreter (i.e. the result of `which perl'). - -PERL_PATH = /usr/bin/perl - -#--------------------------------------------------------------------------- -# Configuration options related to the dot tool -#--------------------------------------------------------------------------- - -# If the CLASS_DIAGRAMS tag is set to YES (the default) Doxygen will -# generate a inheritance diagram (in HTML, RTF and LaTeX) for classes with base -# or super classes. Setting the tag to NO turns the diagrams off. Note that -# this option is superseded by the HAVE_DOT option below. This is only a -# fallback. It is recommended to install and use dot, since it yields more -# powerful graphs. - -CLASS_DIAGRAMS = YES - -# If set to YES, the inheritance and collaboration graphs will hide -# inheritance and usage relations if the target is undocumented -# or is not a class. - -HIDE_UNDOC_RELATIONS = YES - -# If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is -# available from the path. This tool is part of Graphviz, a graph visualization -# toolkit from AT&T and Lucent Bell Labs. The other options in this section -# have no effect if this option is set to NO (the default) - -HAVE_DOT = NO - -# If the CLASS_GRAPH and HAVE_DOT tags are set to YES then doxygen -# will generate a graph for each documented class showing the direct and -# indirect inheritance relations. Setting this tag to YES will force the -# the CLASS_DIAGRAMS tag to NO. - -CLASS_GRAPH = NO - -# If the COLLABORATION_GRAPH and HAVE_DOT tags are set to YES then doxygen -# will generate a graph for each documented class showing the direct and -# indirect implementation dependencies (inheritance, containment, and -# class references variables) of the class with other documented classes. - -COLLABORATION_GRAPH = NO - -# If the GROUP_GRAPHS and HAVE_DOT tags are set to YES then doxygen -# will generate a graph for groups, showing the direct groups dependencies - -GROUP_GRAPHS = NO - -# If the UML_LOOK tag is set to YES doxygen will generate inheritance and -# collaboration diagrams in a style similar to the OMG's Unified Modeling -# Language. - -UML_LOOK = NO - -# If set to YES, the inheritance and collaboration graphs will show the -# relations between templates and their instances. - -TEMPLATE_RELATIONS = NO - -# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDE_GRAPH, and HAVE_DOT -# tags are set to YES then doxygen will generate a graph for each documented -# file showing the direct and indirect include dependencies of the file with -# other documented files. - -INCLUDE_GRAPH = NO - -# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDED_BY_GRAPH, and -# HAVE_DOT tags are set to YES then doxygen will generate a graph for each -# documented header file showing the documented files that directly or -# indirectly include this file. - -INCLUDED_BY_GRAPH = NO - -# If the CALL_GRAPH and HAVE_DOT tags are set to YES then doxygen will -# generate a call dependency graph for every global function or class method. -# Note that enabling this option will significantly increase the time of a run. -# So in most cases it will be better to enable call graphs for selected -# functions only using the \callgraph command. - -CALL_GRAPH = NO - -# If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen -# will graphical hierarchy of all classes instead of a textual one. - -GRAPHICAL_HIERARCHY = NO - -# If the DIRECTORY_GRAPH, SHOW_DIRECTORIES and HAVE_DOT tags are set to YES -# then doxygen will show the dependencies a directory has on other directories -# in a graphical way. The dependency relations are determined by the #include -# relations between the files in the directories. - -DIRECTORY_GRAPH = NO - -# The DOT_IMAGE_FORMAT tag can be used to set the image format of the images -# generated by dot. Possible values are png, jpg, or gif -# If left blank png will be used. - -DOT_IMAGE_FORMAT = png - -# The tag DOT_PATH can be used to specify the path where the dot tool can be -# found. If left blank, it is assumed the dot tool can be found in the path. - -DOT_PATH = - -# The DOTFILE_DIRS tag can be used to specify one or more directories that -# contain dot files that are included in the documentation (see the -# \dotfile command). - -DOTFILE_DIRS = - -# The MAX_DOT_GRAPH_WIDTH tag can be used to set the maximum allowed width -# (in pixels) of the graphs generated by dot. If a graph becomes larger than -# this value, doxygen will try to truncate the graph, so that it fits within -# the specified constraint. Beware that most browsers cannot cope with very -# large images. - -MAX_DOT_GRAPH_WIDTH = 1024 - -# The MAX_DOT_GRAPH_HEIGHT tag can be used to set the maximum allows height -# (in pixels) of the graphs generated by dot. If a graph becomes larger than -# this value, doxygen will try to truncate the graph, so that it fits within -# the specified constraint. Beware that most browsers cannot cope with very -# large images. - -MAX_DOT_GRAPH_HEIGHT = 1024 - -# The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the -# graphs generated by dot. A depth value of 3 means that only nodes reachable -# from the root by following a path via at most 3 edges will be shown. Nodes -# that lay further from the root node will be omitted. Note that setting this -# option to 1 or 2 may greatly reduce the computation time needed for large -# code bases. Also note that a graph may be further truncated if the graph's -# image dimensions are not sufficient to fit the graph (see MAX_DOT_GRAPH_WIDTH -# and MAX_DOT_GRAPH_HEIGHT). If 0 is used for the depth value (the default), -# the graph is not depth-constrained. - -MAX_DOT_GRAPH_DEPTH = 0 - -# Set the DOT_TRANSPARENT tag to YES to generate images with a transparent -# background. This is disabled by default, which results in a white background. -# Warning: Depending on the platform used, enabling this option may lead to -# badly anti-aliased labels on the edges of a graph (i.e. they become hard to -# read). - -DOT_TRANSPARENT = NO - -# Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output -# files in one run (i.e. multiple -o and -T options on the command line). This -# makes dot run faster, but since only newer versions of dot (>1.8.10) -# support this, this feature is disabled by default. - -DOT_MULTI_TARGETS = NO - -# If the GENERATE_LEGEND tag is set to YES (the default) Doxygen will -# generate a legend page explaining the meaning of the various boxes and -# arrows in the dot generated graphs. - -GENERATE_LEGEND = YES - -# If the DOT_CLEANUP tag is set to YES (the default) Doxygen will -# remove the intermediate dot files that are used to generate -# the various graphs. - -DOT_CLEANUP = YES - -#--------------------------------------------------------------------------- -# Configuration::additions related to the search engine -#--------------------------------------------------------------------------- - -# The SEARCHENGINE tag specifies whether or not a search engine should be -# used. If set to NO the values of all tags below this one will be ignored. - -SEARCHENGINE = NO +# Doxyfile 1.5.5 + +# This file describes the settings to be used by the documentation system +# doxygen (www.doxygen.org) for a project +# +# All text after a hash (#) is considered a comment and will be ignored +# The format is: +# TAG = value [value, ...] +# For lists items can also be appended using: +# TAG += value [value, ...] +# Values that contain spaces should be placed between quotes (" ") + +#--------------------------------------------------------------------------- +# Project related configuration options +#--------------------------------------------------------------------------- + +# This tag specifies the encoding used for all characters in the config file +# that follow. The default is UTF-8 which is also the encoding used for all +# text before the first occurrence of this tag. Doxygen uses libiconv (or the +# iconv built into libc) for the transcoding. See +# http://www.gnu.org/software/libiconv for the list of possible encodings. + +DOXYFILE_ENCODING = UTF-8 + +# The PROJECT_NAME tag is a single word (or a sequence of words surrounded +# by quotes) that should identify the project. + +PROJECT_NAME = axTLS + +# The PROJECT_NUMBER tag can be used to enter a project or revision number. +# This could be handy for archiving the generated documentation or +# if some version control system is used. + +PROJECT_NUMBER = + +# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) +# base path where the generated documentation will be put. +# If a relative path is entered, it will be relative to the location +# where doxygen was started. If left blank the current directory will be used. + +OUTPUT_DIRECTORY = + +# If the CREATE_SUBDIRS tag is set to YES, then doxygen will create +# 4096 sub-directories (in 2 levels) under the output directory of each output +# format and will distribute the generated files over these directories. +# Enabling this option can be useful when feeding doxygen a huge amount of +# source files, where putting all generated files in the same directory would +# otherwise cause performance problems for the file system. + +CREATE_SUBDIRS = NO + +# The OUTPUT_LANGUAGE tag is used to specify the language in which all +# documentation generated by doxygen is written. Doxygen will use this +# information to generate all constant output in the proper language. +# The default language is English, other supported languages are: +# Afrikaans, Arabic, Brazilian, Catalan, Chinese, Chinese-Traditional, +# Croatian, Czech, Danish, Dutch, Farsi, Finnish, French, German, Greek, +# Hungarian, Italian, Japanese, Japanese-en (Japanese with English messages), +# Korean, Korean-en, Lithuanian, Norwegian, Macedonian, Persian, Polish, +# Portuguese, Romanian, Russian, Serbian, Slovak, Slovene, Spanish, Swedish, +# and Ukrainian. + +OUTPUT_LANGUAGE = English + +# If the BRIEF_MEMBER_DESC tag is set to YES (the default) Doxygen will +# include brief member descriptions after the members that are listed in +# the file and class documentation (similar to JavaDoc). +# Set to NO to disable this. + +BRIEF_MEMBER_DESC = YES + +# If the REPEAT_BRIEF tag is set to YES (the default) Doxygen will prepend +# the brief description of a member or function before the detailed description. +# Note: if both HIDE_UNDOC_MEMBERS and BRIEF_MEMBER_DESC are set to NO, the +# brief descriptions will be completely suppressed. + +REPEAT_BRIEF = YES + +# This tag implements a quasi-intelligent brief description abbreviator +# that is used to form the text in various listings. Each string +# in this list, if found as the leading text of the brief description, will be +# stripped from the text and the result after processing the whole list, is +# used as the annotated text. Otherwise, the brief description is used as-is. +# If left blank, the following values are used ("$name" is automatically +# replaced with the name of the entity): "The $name class" "The $name widget" +# "The $name file" "is" "provides" "specifies" "contains" +# "represents" "a" "an" "the" + +ABBREVIATE_BRIEF = + +# If the ALWAYS_DETAILED_SEC and REPEAT_BRIEF tags are both set to YES then +# Doxygen will generate a detailed section even if there is only a brief +# description. + +ALWAYS_DETAILED_SEC = NO + +# If the INLINE_INHERITED_MEMB tag is set to YES, doxygen will show all +# inherited members of a class in the documentation of that class as if those +# members were ordinary class members. Constructors, destructors and assignment +# operators of the base classes will not be shown. + +INLINE_INHERITED_MEMB = NO + +# If the FULL_PATH_NAMES tag is set to YES then Doxygen will prepend the full +# path before files name in the file list and in the header files. If set +# to NO the shortest path that makes the file name unique will be used. + +FULL_PATH_NAMES = NO + +# If the FULL_PATH_NAMES tag is set to YES then the STRIP_FROM_PATH tag +# can be used to strip a user-defined part of the path. Stripping is +# only done if one of the specified strings matches the left-hand part of +# the path. The tag can be used to show relative paths in the file list. +# If left blank the directory from which doxygen is run is used as the +# path to strip. + +STRIP_FROM_PATH = + +# The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of +# the path mentioned in the documentation of a class, which tells +# the reader which header file to include in order to use a class. +# If left blank only the name of the header file containing the class +# definition is used. Otherwise one should specify the include paths that +# are normally passed to the compiler using the -I flag. + +STRIP_FROM_INC_PATH = + +# If the SHORT_NAMES tag is set to YES, doxygen will generate much shorter +# (but less readable) file names. This can be useful is your file systems +# doesn't support long names like on DOS, Mac, or CD-ROM. + +SHORT_NAMES = NO + +# If the JAVADOC_AUTOBRIEF tag is set to YES then Doxygen +# will interpret the first line (until the first dot) of a JavaDoc-style +# comment as the brief description. If set to NO, the JavaDoc +# comments will behave just like regular Qt-style comments +# (thus requiring an explicit @brief command for a brief description.) + +JAVADOC_AUTOBRIEF = NO + +# If the QT_AUTOBRIEF tag is set to YES then Doxygen will +# interpret the first line (until the first dot) of a Qt-style +# comment as the brief description. If set to NO, the comments +# will behave just like regular Qt-style comments (thus requiring +# an explicit \brief command for a brief description.) + +QT_AUTOBRIEF = NO + +# The MULTILINE_CPP_IS_BRIEF tag can be set to YES to make Doxygen +# treat a multi-line C++ special comment block (i.e. a block of //! or /// +# comments) as a brief description. This used to be the default behaviour. +# The new default is to treat a multi-line C++ comment block as a detailed +# description. Set this tag to YES if you prefer the old behaviour instead. + +MULTILINE_CPP_IS_BRIEF = NO + +# If the DETAILS_AT_TOP tag is set to YES then Doxygen +# will output the detailed description near the top, like JavaDoc. +# If set to NO, the detailed description appears after the member +# documentation. + +DETAILS_AT_TOP = NO + +# If the INHERIT_DOCS tag is set to YES (the default) then an undocumented +# member inherits the documentation from any documented member that it +# re-implements. + +INHERIT_DOCS = YES + +# If the SEPARATE_MEMBER_PAGES tag is set to YES, then doxygen will produce +# a new page for each member. If set to NO, the documentation of a member will +# be part of the file/class/namespace that contains it. + +SEPARATE_MEMBER_PAGES = NO + +# The TAB_SIZE tag can be used to set the number of spaces in a tab. +# Doxygen uses this value to replace tabs by spaces in code fragments. + +TAB_SIZE = 4 + +# This tag can be used to specify a number of aliases that acts +# as commands in the documentation. An alias has the form "name=value". +# For example adding "sideeffect=\par Side Effects:\n" will allow you to +# put the command \sideeffect (or @sideeffect) in the documentation, which +# will result in a user-defined paragraph with heading "Side Effects:". +# You can put \n's in the value part of an alias to insert newlines. + +ALIASES = + +# Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C +# sources only. Doxygen will then generate output that is more tailored for C. +# For instance, some of the names that are used will be different. The list +# of all members will be omitted, etc. + +OPTIMIZE_OUTPUT_FOR_C = YES + +# Set the OPTIMIZE_OUTPUT_JAVA tag to YES if your project consists of Java +# sources only. Doxygen will then generate output that is more tailored for +# Java. For instance, namespaces will be presented as packages, qualified +# scopes will look different, etc. + +OPTIMIZE_OUTPUT_JAVA = NO + +# Set the OPTIMIZE_FOR_FORTRAN tag to YES if your project consists of Fortran +# sources only. Doxygen will then generate output that is more tailored for +# Fortran. + +OPTIMIZE_FOR_FORTRAN = NO + +# Set the OPTIMIZE_OUTPUT_VHDL tag to YES if your project consists of VHDL +# sources. Doxygen will then generate output that is tailored for +# VHDL. + +OPTIMIZE_OUTPUT_VHDL = NO + +# If you use STL classes (i.e. std::string, std::vector, etc.) but do not want +# to include (a tag file for) the STL sources as input, then you should +# set this tag to YES in order to let doxygen match functions declarations and +# definitions whose arguments contain STL classes (e.g. func(std::string); v.s. +# func(std::string) {}). This also make the inheritance and collaboration +# diagrams that involve STL classes more complete and accurate. + +BUILTIN_STL_SUPPORT = NO + +# If you use Microsoft's C++/CLI language, you should set this option to YES to +# enable parsing support. + +CPP_CLI_SUPPORT = NO + +# Set the SIP_SUPPORT tag to YES if your project consists of sip sources only. +# Doxygen will parse them like normal C++ but will assume all classes use public +# instead of private inheritance when no explicit protection keyword is present. + +SIP_SUPPORT = NO + +# If member grouping is used in the documentation and the DISTRIBUTE_GROUP_DOC +# tag is set to YES, then doxygen will reuse the documentation of the first +# member in the group (if any) for the other members of the group. By default +# all members of a group must be documented explicitly. + +DISTRIBUTE_GROUP_DOC = NO + +# Set the SUBGROUPING tag to YES (the default) to allow class member groups of +# the same type (for instance a group of public functions) to be put as a +# subgroup of that type (e.g. under the Public Functions section). Set it to +# NO to prevent subgrouping. Alternatively, this can be done per class using +# the \nosubgrouping command. + +SUBGROUPING = YES + +# When TYPEDEF_HIDES_STRUCT is enabled, a typedef of a struct, union, or enum +# is documented as struct, union, or enum with the name of the typedef. So +# typedef struct TypeS {} TypeT, will appear in the documentation as a struct +# with name TypeT. When disabled the typedef will appear as a member of a file, +# namespace, or class. And the struct will be named TypeS. This can typically +# be useful for C code in case the coding convention dictates that all compound +# types are typedef'ed and only the typedef is referenced, never the tag name. + +TYPEDEF_HIDES_STRUCT = NO + +#--------------------------------------------------------------------------- +# Build related configuration options +#--------------------------------------------------------------------------- + +# If the EXTRACT_ALL tag is set to YES doxygen will assume all entities in +# documentation are documented, even if no documentation was available. +# Private class members and static file members will be hidden unless +# the EXTRACT_PRIVATE and EXTRACT_STATIC tags are set to YES + +EXTRACT_ALL = NO + +# If the EXTRACT_PRIVATE tag is set to YES all private members of a class +# will be included in the documentation. + +EXTRACT_PRIVATE = NO + +# If the EXTRACT_STATIC tag is set to YES all static members of a file +# will be included in the documentation. + +EXTRACT_STATIC = NO + +# If the EXTRACT_LOCAL_CLASSES tag is set to YES classes (and structs) +# defined locally in source files will be included in the documentation. +# If set to NO only classes defined in header files are included. + +EXTRACT_LOCAL_CLASSES = YES + +# This flag is only useful for Objective-C code. When set to YES local +# methods, which are defined in the implementation section but not in +# the interface are included in the documentation. +# If set to NO (the default) only methods in the interface are included. + +EXTRACT_LOCAL_METHODS = NO + +# If this flag is set to YES, the members of anonymous namespaces will be +# extracted and appear in the documentation as a namespace called +# 'anonymous_namespace{file}', where file will be replaced with the base +# name of the file that contains the anonymous namespace. By default +# anonymous namespace are hidden. + +EXTRACT_ANON_NSPACES = NO + +# If the HIDE_UNDOC_MEMBERS tag is set to YES, Doxygen will hide all +# undocumented members of documented classes, files or namespaces. +# If set to NO (the default) these members will be included in the +# various overviews, but no documentation section is generated. +# This option has no effect if EXTRACT_ALL is enabled. + +HIDE_UNDOC_MEMBERS = NO + +# If the HIDE_UNDOC_CLASSES tag is set to YES, Doxygen will hide all +# undocumented classes that are normally visible in the class hierarchy. +# If set to NO (the default) these classes will be included in the various +# overviews. This option has no effect if EXTRACT_ALL is enabled. + +HIDE_UNDOC_CLASSES = NO + +# If the HIDE_FRIEND_COMPOUNDS tag is set to YES, Doxygen will hide all +# friend (class|struct|union) declarations. +# If set to NO (the default) these declarations will be included in the +# documentation. + +HIDE_FRIEND_COMPOUNDS = NO + +# If the HIDE_IN_BODY_DOCS tag is set to YES, Doxygen will hide any +# documentation blocks found inside the body of a function. +# If set to NO (the default) these blocks will be appended to the +# function's detailed documentation block. + +HIDE_IN_BODY_DOCS = NO + +# The INTERNAL_DOCS tag determines if documentation +# that is typed after a \internal command is included. If the tag is set +# to NO (the default) then the documentation will be excluded. +# Set it to YES to include the internal documentation. + +INTERNAL_DOCS = NO + +# If the CASE_SENSE_NAMES tag is set to NO then Doxygen will only generate +# file names in lower-case letters. If set to YES upper-case letters are also +# allowed. This is useful if you have classes or files whose names only differ +# in case and if your file system supports case sensitive file names. Windows +# and Mac users are advised to set this option to NO. + +CASE_SENSE_NAMES = YES + +# If the HIDE_SCOPE_NAMES tag is set to NO (the default) then Doxygen +# will show members with their full class and namespace scopes in the +# documentation. If set to YES the scope will be hidden. + +HIDE_SCOPE_NAMES = NO + +# If the SHOW_INCLUDE_FILES tag is set to YES (the default) then Doxygen +# will put a list of the files that are included by a file in the documentation +# of that file. + +SHOW_INCLUDE_FILES = NO + +# If the INLINE_INFO tag is set to YES (the default) then a tag [inline] +# is inserted in the documentation for inline members. + +INLINE_INFO = YES + +# If the SORT_MEMBER_DOCS tag is set to YES (the default) then doxygen +# will sort the (detailed) documentation of file and class members +# alphabetically by member name. If set to NO the members will appear in +# declaration order. + +SORT_MEMBER_DOCS = NO + +# If the SORT_BRIEF_DOCS tag is set to YES then doxygen will sort the +# brief documentation of file, namespace and class members alphabetically +# by member name. If set to NO (the default) the members will appear in +# declaration order. + +SORT_BRIEF_DOCS = NO + +# If the SORT_GROUP_NAMES tag is set to YES then doxygen will sort the +# hierarchy of group names into alphabetical order. If set to NO (the default) +# the group names will appear in their defined order. + +SORT_GROUP_NAMES = NO + +# If the SORT_BY_SCOPE_NAME tag is set to YES, the class list will be +# sorted by fully-qualified names, including namespaces. If set to +# NO (the default), the class list will be sorted only by class name, +# not including the namespace part. +# Note: This option is not very useful if HIDE_SCOPE_NAMES is set to YES. +# Note: This option applies only to the class list, not to the +# alphabetical list. + +SORT_BY_SCOPE_NAME = NO + +# The GENERATE_TODOLIST tag can be used to enable (YES) or +# disable (NO) the todo list. This list is created by putting \todo +# commands in the documentation. + +GENERATE_TODOLIST = YES + +# The GENERATE_TESTLIST tag can be used to enable (YES) or +# disable (NO) the test list. This list is created by putting \test +# commands in the documentation. + +GENERATE_TESTLIST = YES + +# The GENERATE_BUGLIST tag can be used to enable (YES) or +# disable (NO) the bug list. This list is created by putting \bug +# commands in the documentation. + +GENERATE_BUGLIST = YES + +# The GENERATE_DEPRECATEDLIST tag can be used to enable (YES) or +# disable (NO) the deprecated list. This list is created by putting +# \deprecated commands in the documentation. + +GENERATE_DEPRECATEDLIST= YES + +# The ENABLED_SECTIONS tag can be used to enable conditional +# documentation sections, marked by \if sectionname ... \endif. + +ENABLED_SECTIONS = + +# The MAX_INITIALIZER_LINES tag determines the maximum number of lines +# the initial value of a variable or define consists of for it to appear in +# the documentation. If the initializer consists of more lines than specified +# here it will be hidden. Use a value of 0 to hide initializers completely. +# The appearance of the initializer of individual variables and defines in the +# documentation can be controlled using \showinitializer or \hideinitializer +# command in the documentation regardless of this setting. + +MAX_INITIALIZER_LINES = 30 + +# Set the SHOW_USED_FILES tag to NO to disable the list of files generated +# at the bottom of the documentation of classes and structs. If set to YES the +# list will mention the files that were used to generate the documentation. + +SHOW_USED_FILES = NO + +# If the sources in your project are distributed over multiple directories +# then setting the SHOW_DIRECTORIES tag to YES will show the directory hierarchy +# in the documentation. The default is NO. + +SHOW_DIRECTORIES = NO + +# The FILE_VERSION_FILTER tag can be used to specify a program or script that +# doxygen should invoke to get the current version for each file (typically from +# the version control system). Doxygen will invoke the program by executing (via +# popen()) the command , where is the value of +# the FILE_VERSION_FILTER tag, and is the name of an input file +# provided by doxygen. Whatever the program writes to standard output +# is used as the file version. See the manual for examples. + +FILE_VERSION_FILTER = + +#--------------------------------------------------------------------------- +# configuration options related to warning and progress messages +#--------------------------------------------------------------------------- + +# The QUIET tag can be used to turn on/off the messages that are generated +# by doxygen. Possible values are YES and NO. If left blank NO is used. + +QUIET = NO + +# The WARNINGS tag can be used to turn on/off the warning messages that are +# generated by doxygen. Possible values are YES and NO. If left blank +# NO is used. + +WARNINGS = YES + +# If WARN_IF_UNDOCUMENTED is set to YES, then doxygen will generate warnings +# for undocumented members. If EXTRACT_ALL is set to YES then this flag will +# automatically be disabled. + +WARN_IF_UNDOCUMENTED = YES + +# If WARN_IF_DOC_ERROR is set to YES, doxygen will generate warnings for +# potential errors in the documentation, such as not documenting some +# parameters in a documented function, or documenting parameters that +# don't exist or using markup commands wrongly. + +WARN_IF_DOC_ERROR = YES + +# This WARN_NO_PARAMDOC option can be abled to get warnings for +# functions that are documented, but have no documentation for their parameters +# or return value. If set to NO (the default) doxygen will only warn about +# wrong or incomplete parameter documentation, but not about the absence of +# documentation. + +WARN_NO_PARAMDOC = NO + +# The WARN_FORMAT tag determines the format of the warning messages that +# doxygen can produce. The string should contain the $file, $line, and $text +# tags, which will be replaced by the file and line number from which the +# warning originated and the warning text. Optionally the format may contain +# $version, which will be replaced by the version of the file (if it could +# be obtained via FILE_VERSION_FILTER) + +WARN_FORMAT = "$file:$line: $text" + +# The WARN_LOGFILE tag can be used to specify a file to which warning +# and error messages should be written. If left blank the output is written +# to stderr. + +WARN_LOGFILE = + +#--------------------------------------------------------------------------- +# configuration options related to the input files +#--------------------------------------------------------------------------- + +# The INPUT tag can be used to specify the files and/or directories that contain +# documented source files. You may enter file names like "myfile.cpp" or +# directories like "/usr/src/myproject". Separate the files or directories +# with spaces. + +INPUT = ../bindings/csharp/axTLS.cs \ + ../bindings/java/SSL.java \ + ../bindings/java/SSLUtil.java \ + ../bindings/java/SSLCTX.java \ + ../bindings/java/SSLServer.java \ + ../bindings/java/SSLClient.java \ + ../bindings/java/SSLReadHolder.java \ + ../ssl/ssl.h \ + ../crypto/bigint.c \ + ../crypto/bigint.h + +# This tag can be used to specify the character encoding of the source files +# that doxygen parses. Internally doxygen uses the UTF-8 encoding, which is +# also the default input encoding. Doxygen uses libiconv (or the iconv built +# into libc) for the transcoding. See http://www.gnu.org/software/libiconv for +# the list of possible encodings. + +INPUT_ENCODING = UTF-8 + +# If the value of the INPUT tag contains directories, you can use the +# FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp +# and *.h) to filter out the source-files in the directories. If left +# blank the following patterns are tested: +# *.c *.cc *.cxx *.cpp *.c++ *.java *.ii *.ixx *.ipp *.i++ *.inl *.h *.hh *.hxx +# *.hpp *.h++ *.idl *.odl *.cs *.php *.php3 *.inc *.m *.mm *.py *.f90 + +FILE_PATTERNS = + +# The RECURSIVE tag can be used to turn specify whether or not subdirectories +# should be searched for input files as well. Possible values are YES and NO. +# If left blank NO is used. + +RECURSIVE = NO + +# The EXCLUDE tag can be used to specify files and/or directories that should +# excluded from the INPUT source files. This way you can easily exclude a +# subdirectory from a directory tree whose root is specified with the INPUT tag. + +EXCLUDE = + +# The EXCLUDE_SYMLINKS tag can be used select whether or not files or +# directories that are symbolic links (a Unix filesystem feature) are excluded +# from the input. + +EXCLUDE_SYMLINKS = NO + +# If the value of the INPUT tag contains directories, you can use the +# EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude +# certain files from those directories. Note that the wildcards are matched +# against the file with absolute path, so to exclude all test directories +# for example use the pattern */test/* + +EXCLUDE_PATTERNS = + +# The EXCLUDE_SYMBOLS tag can be used to specify one or more symbol names +# (namespaces, classes, functions, etc.) that should be excluded from the +# output. The symbol name can be a fully qualified name, a word, or if the +# wildcard * is used, a substring. Examples: ANamespace, AClass, +# AClass::ANamespace, ANamespace::*Test + +EXCLUDE_SYMBOLS = + +# The EXAMPLE_PATH tag can be used to specify one or more files or +# directories that contain example code fragments that are included (see +# the \include command). + +EXAMPLE_PATH = + +# If the value of the EXAMPLE_PATH tag contains directories, you can use the +# EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp +# and *.h) to filter out the source-files in the directories. If left +# blank all files are included. + +EXAMPLE_PATTERNS = + +# If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be +# searched for input files to be used with the \include or \dontinclude +# commands irrespective of the value of the RECURSIVE tag. +# Possible values are YES and NO. If left blank NO is used. + +EXAMPLE_RECURSIVE = NO + +# The IMAGE_PATH tag can be used to specify one or more files or +# directories that contain image that are included in the documentation (see +# the \image command). + +IMAGE_PATH = images + +# The INPUT_FILTER tag can be used to specify a program that doxygen should +# invoke to filter for each input file. Doxygen will invoke the filter program +# by executing (via popen()) the command , where +# is the value of the INPUT_FILTER tag, and is the name of an +# input file. Doxygen will then use the output that the filter program writes +# to standard output. If FILTER_PATTERNS is specified, this tag will be +# ignored. + +INPUT_FILTER = + +# The FILTER_PATTERNS tag can be used to specify filters on a per file pattern +# basis. Doxygen will compare the file name with each pattern and apply the +# filter if there is a match. The filters are a list of the form: +# pattern=filter (like *.cpp=my_cpp_filter). See INPUT_FILTER for further +# info on how filters are used. If FILTER_PATTERNS is empty, INPUT_FILTER +# is applied to all files. + +FILTER_PATTERNS = + +# If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using +# INPUT_FILTER) will be used to filter the input files when producing source +# files to browse (i.e. when SOURCE_BROWSER is set to YES). + +FILTER_SOURCE_FILES = NO + +#--------------------------------------------------------------------------- +# configuration options related to source browsing +#--------------------------------------------------------------------------- + +# If the SOURCE_BROWSER tag is set to YES then a list of source files will +# be generated. Documented entities will be cross-referenced with these sources. +# Note: To get rid of all source code in the generated output, make sure also +# VERBATIM_HEADERS is set to NO. + +SOURCE_BROWSER = NO + +# Setting the INLINE_SOURCES tag to YES will include the body +# of functions and classes directly in the documentation. + +INLINE_SOURCES = NO + +# Setting the STRIP_CODE_COMMENTS tag to YES (the default) will instruct +# doxygen to hide any special comment blocks from generated source code +# fragments. Normal C and C++ comments will always remain visible. + +STRIP_CODE_COMMENTS = YES + +# If the REFERENCED_BY_RELATION tag is set to YES (the default) +# then for each documented function all documented +# functions referencing it will be listed. + +REFERENCED_BY_RELATION = YES + +# If the REFERENCES_RELATION tag is set to YES (the default) +# then for each documented function all documented entities +# called/used by that function will be listed. + +REFERENCES_RELATION = YES + +# If the REFERENCES_LINK_SOURCE tag is set to YES (the default) +# and SOURCE_BROWSER tag is set to YES, then the hyperlinks from +# functions in REFERENCES_RELATION and REFERENCED_BY_RELATION lists will +# link to the source code. Otherwise they will link to the documentstion. + +REFERENCES_LINK_SOURCE = YES + +# If the USE_HTAGS tag is set to YES then the references to source code +# will point to the HTML generated by the htags(1) tool instead of doxygen +# built-in source browser. The htags tool is part of GNU's global source +# tagging system (see http://www.gnu.org/software/global/global.html). You +# will need version 4.8.6 or higher. + +USE_HTAGS = NO + +# If the VERBATIM_HEADERS tag is set to YES (the default) then Doxygen +# will generate a verbatim copy of the header file for each class for +# which an include is specified. Set to NO to disable this. + +VERBATIM_HEADERS = NO + +#--------------------------------------------------------------------------- +# configuration options related to the alphabetical class index +#--------------------------------------------------------------------------- + +# If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index +# of all compounds will be generated. Enable this if the project +# contains a lot of classes, structs, unions or interfaces. + +ALPHABETICAL_INDEX = NO + +# If the alphabetical index is enabled (see ALPHABETICAL_INDEX) then +# the COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns +# in which this list will be split (can be a number in the range [1..20]) + +COLS_IN_ALPHA_INDEX = 5 + +# In case all classes in a project start with a common prefix, all +# classes will be put under the same header in the alphabetical index. +# The IGNORE_PREFIX tag can be used to specify one or more prefixes that +# should be ignored while generating the index headers. + +IGNORE_PREFIX = + +#--------------------------------------------------------------------------- +# configuration options related to the HTML output +#--------------------------------------------------------------------------- + +# If the GENERATE_HTML tag is set to YES (the default) Doxygen will +# generate HTML output. + +GENERATE_HTML = YES + +# The HTML_OUTPUT tag is used to specify where the HTML docs will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `html' will be used as the default path. + +HTML_OUTPUT = html + +# The HTML_FILE_EXTENSION tag can be used to specify the file extension for +# each generated HTML page (for example: .htm,.php,.asp). If it is left blank +# doxygen will generate files with .html extension. + +HTML_FILE_EXTENSION = .html + +# The HTML_HEADER tag can be used to specify a personal HTML header for +# each generated HTML page. If it is left blank doxygen will generate a +# standard header. + +HTML_HEADER = + +# The HTML_FOOTER tag can be used to specify a personal HTML footer for +# each generated HTML page. If it is left blank doxygen will generate a +# standard footer. + +HTML_FOOTER = doco_footer.html + +# The HTML_STYLESHEET tag can be used to specify a user-defined cascading +# style sheet that is used by each HTML page. It can be used to +# fine-tune the look of the HTML output. If the tag is left blank doxygen +# will generate a default style sheet. Note that doxygen will try to copy +# the style sheet file to the HTML output directory, so don't put your own +# stylesheet in the HTML output directory as well, or it will be erased! + +HTML_STYLESHEET = + +# If the HTML_ALIGN_MEMBERS tag is set to YES, the members of classes, +# files or namespaces will be aligned in HTML using tables. If set to +# NO a bullet list will be used. + +HTML_ALIGN_MEMBERS = YES + +# If the GENERATE_HTMLHELP tag is set to YES, additional index files +# will be generated that can be used as input for tools like the +# Microsoft HTML help workshop to generate a compiled HTML help file (.chm) +# of the generated HTML documentation. + +GENERATE_HTMLHELP = NO + +# If the GENERATE_DOCSET tag is set to YES, additional index files +# will be generated that can be used as input for Apple's Xcode 3 +# integrated development environment, introduced with OSX 10.5 (Leopard). +# To create a documentation set, doxygen will generate a Makefile in the +# HTML output directory. Running make will produce the docset in that +# directory and running "make install" will install the docset in +# ~/Library/Developer/Shared/Documentation/DocSets so that Xcode will find +# it at startup. + +GENERATE_DOCSET = NO + +# When GENERATE_DOCSET tag is set to YES, this tag determines the name of the +# feed. A documentation feed provides an umbrella under which multiple +# documentation sets from a single provider (such as a company or product suite) +# can be grouped. + +DOCSET_FEEDNAME = "Doxygen generated docs" + +# When GENERATE_DOCSET tag is set to YES, this tag specifies a string that +# should uniquely identify the documentation set bundle. This should be a +# reverse domain-name style string, e.g. com.mycompany.MyDocSet. Doxygen +# will append .docset to the name. + +DOCSET_BUNDLE_ID = org.doxygen.Project + +# If the HTML_DYNAMIC_SECTIONS tag is set to YES then the generated HTML +# documentation will contain sections that can be hidden and shown after the +# page has loaded. For this to work a browser that supports +# JavaScript and DHTML is required (for instance Mozilla 1.0+, Firefox +# Netscape 6.0+, Internet explorer 5.0+, Konqueror, or Safari). + +HTML_DYNAMIC_SECTIONS = NO + +# If the GENERATE_HTMLHELP tag is set to YES, the CHM_FILE tag can +# be used to specify the file name of the resulting .chm file. You +# can add a path in front of the file if the result should not be +# written to the html output directory. + +CHM_FILE = + +# If the GENERATE_HTMLHELP tag is set to YES, the HHC_LOCATION tag can +# be used to specify the location (absolute path including file name) of +# the HTML help compiler (hhc.exe). If non-empty doxygen will try to run +# the HTML help compiler on the generated index.hhp. + +HHC_LOCATION = + +# If the GENERATE_HTMLHELP tag is set to YES, the GENERATE_CHI flag +# controls if a separate .chi index file is generated (YES) or that +# it should be included in the master .chm file (NO). + +GENERATE_CHI = NO + +# If the GENERATE_HTMLHELP tag is set to YES, the BINARY_TOC flag +# controls whether a binary table of contents is generated (YES) or a +# normal table of contents (NO) in the .chm file. + +BINARY_TOC = NO + +# The TOC_EXPAND flag can be set to YES to add extra items for group members +# to the contents of the HTML help documentation and to the tree view. + +TOC_EXPAND = YES + +# The DISABLE_INDEX tag can be used to turn on/off the condensed index at +# top of each HTML page. The value NO (the default) enables the index and +# the value YES disables it. + +DISABLE_INDEX = YES + +# This tag can be used to set the number of enum values (range [1..20]) +# that doxygen will group on one line in the generated HTML documentation. + +ENUM_VALUES_PER_LINE = 4 + +# If the GENERATE_TREEVIEW tag is set to YES, a side panel will be +# generated containing a tree-like index structure (just like the one that +# is generated for HTML Help). For this to work a browser that supports +# JavaScript, DHTML, CSS and frames is required (for instance Mozilla 1.0+, +# Netscape 6.0+, Internet explorer 5.0+, or Konqueror). Windows users are +# probably better off using the HTML help feature. + +GENERATE_TREEVIEW = YES + +# If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be +# used to set the initial width (in pixels) of the frame in which the tree +# is shown. + +TREEVIEW_WIDTH = 250 + +#--------------------------------------------------------------------------- +# configuration options related to the LaTeX output +#--------------------------------------------------------------------------- + +# If the GENERATE_LATEX tag is set to YES (the default) Doxygen will +# generate Latex output. + +GENERATE_LATEX = NO + +# The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `latex' will be used as the default path. + +LATEX_OUTPUT = latex + +# The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be +# invoked. If left blank `latex' will be used as the default command name. + +LATEX_CMD_NAME = latex + +# The MAKEINDEX_CMD_NAME tag can be used to specify the command name to +# generate index for LaTeX. If left blank `makeindex' will be used as the +# default command name. + +MAKEINDEX_CMD_NAME = makeindex + +# If the COMPACT_LATEX tag is set to YES Doxygen generates more compact +# LaTeX documents. This may be useful for small projects and may help to +# save some trees in general. + +COMPACT_LATEX = NO + +# The PAPER_TYPE tag can be used to set the paper type that is used +# by the printer. Possible values are: a4, a4wide, letter, legal and +# executive. If left blank a4wide will be used. + +PAPER_TYPE = a4wide + +# The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX +# packages that should be included in the LaTeX output. + +EXTRA_PACKAGES = + +# The LATEX_HEADER tag can be used to specify a personal LaTeX header for +# the generated latex document. The header should contain everything until +# the first chapter. If it is left blank doxygen will generate a +# standard header. Notice: only use this tag if you know what you are doing! + +LATEX_HEADER = + +# If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated +# is prepared for conversion to pdf (using ps2pdf). The pdf file will +# contain links (just like the HTML output) instead of page references +# This makes the output suitable for online browsing using a pdf viewer. + +PDF_HYPERLINKS = NO + +# If the USE_PDFLATEX tag is set to YES, pdflatex will be used instead of +# plain latex in the generated Makefile. Set this option to YES to get a +# higher quality PDF documentation. + +USE_PDFLATEX = NO + +# If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \\batchmode. +# command to the generated LaTeX files. This will instruct LaTeX to keep +# running if errors occur, instead of asking the user for help. +# This option is also used when generating formulas in HTML. + +LATEX_BATCHMODE = NO + +# If LATEX_HIDE_INDICES is set to YES then doxygen will not +# include the index chapters (such as File Index, Compound Index, etc.) +# in the output. + +LATEX_HIDE_INDICES = NO + +#--------------------------------------------------------------------------- +# configuration options related to the RTF output +#--------------------------------------------------------------------------- + +# If the GENERATE_RTF tag is set to YES Doxygen will generate RTF output +# The RTF output is optimized for Word 97 and may not look very pretty with +# other RTF readers or editors. + +GENERATE_RTF = NO + +# The RTF_OUTPUT tag is used to specify where the RTF docs will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `rtf' will be used as the default path. + +RTF_OUTPUT = rtf + +# If the COMPACT_RTF tag is set to YES Doxygen generates more compact +# RTF documents. This may be useful for small projects and may help to +# save some trees in general. + +COMPACT_RTF = NO + +# If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated +# will contain hyperlink fields. The RTF file will +# contain links (just like the HTML output) instead of page references. +# This makes the output suitable for online browsing using WORD or other +# programs which support those fields. +# Note: wordpad (write) and others do not support links. + +RTF_HYPERLINKS = NO + +# Load stylesheet definitions from file. Syntax is similar to doxygen's +# config file, i.e. a series of assignments. You only have to provide +# replacements, missing definitions are set to their default value. + +RTF_STYLESHEET_FILE = + +# Set optional variables used in the generation of an rtf document. +# Syntax is similar to doxygen's config file. + +RTF_EXTENSIONS_FILE = + +#--------------------------------------------------------------------------- +# configuration options related to the man page output +#--------------------------------------------------------------------------- + +# If the GENERATE_MAN tag is set to YES (the default) Doxygen will +# generate man pages + +GENERATE_MAN = NO + +# The MAN_OUTPUT tag is used to specify where the man pages will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `man' will be used as the default path. + +MAN_OUTPUT = man + +# The MAN_EXTENSION tag determines the extension that is added to +# the generated man pages (default is the subroutine's section .3) + +MAN_EXTENSION = .3 + +# If the MAN_LINKS tag is set to YES and Doxygen generates man output, +# then it will generate one additional man file for each entity +# documented in the real man page(s). These additional files +# only source the real man page, but without them the man command +# would be unable to find the correct page. The default is NO. + +MAN_LINKS = NO + +#--------------------------------------------------------------------------- +# configuration options related to the XML output +#--------------------------------------------------------------------------- + +# If the GENERATE_XML tag is set to YES Doxygen will +# generate an XML file that captures the structure of +# the code including all documentation. + +GENERATE_XML = NO + +# The XML_OUTPUT tag is used to specify where the XML pages will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `xml' will be used as the default path. + +XML_OUTPUT = xml + +# The XML_SCHEMA tag can be used to specify an XML schema, +# which can be used by a validating XML parser to check the +# syntax of the XML files. + +XML_SCHEMA = + +# The XML_DTD tag can be used to specify an XML DTD, +# which can be used by a validating XML parser to check the +# syntax of the XML files. + +XML_DTD = + +# If the XML_PROGRAMLISTING tag is set to YES Doxygen will +# dump the program listings (including syntax highlighting +# and cross-referencing information) to the XML output. Note that +# enabling this will significantly increase the size of the XML output. + +XML_PROGRAMLISTING = YES + +#--------------------------------------------------------------------------- +# configuration options for the AutoGen Definitions output +#--------------------------------------------------------------------------- + +# If the GENERATE_AUTOGEN_DEF tag is set to YES Doxygen will +# generate an AutoGen Definitions (see autogen.sf.net) file +# that captures the structure of the code including all +# documentation. Note that this feature is still experimental +# and incomplete at the moment. + +GENERATE_AUTOGEN_DEF = NO + +#--------------------------------------------------------------------------- +# configuration options related to the Perl module output +#--------------------------------------------------------------------------- + +# If the GENERATE_PERLMOD tag is set to YES Doxygen will +# generate a Perl module file that captures the structure of +# the code including all documentation. Note that this +# feature is still experimental and incomplete at the +# moment. + +GENERATE_PERLMOD = NO + +# If the PERLMOD_LATEX tag is set to YES Doxygen will generate +# the necessary Makefile rules, Perl scripts and LaTeX code to be able +# to generate PDF and DVI output from the Perl module output. + +PERLMOD_LATEX = NO + +# If the PERLMOD_PRETTY tag is set to YES the Perl module output will be +# nicely formatted so it can be parsed by a human reader. This is useful +# if you want to understand what is going on. On the other hand, if this +# tag is set to NO the size of the Perl module output will be much smaller +# and Perl will parse it just the same. + +PERLMOD_PRETTY = YES + +# The names of the make variables in the generated doxyrules.make file +# are prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX. +# This is useful so different doxyrules.make files included by the same +# Makefile don't overwrite each other's variables. + +PERLMOD_MAKEVAR_PREFIX = + +#--------------------------------------------------------------------------- +# Configuration options related to the preprocessor +#--------------------------------------------------------------------------- + +# If the ENABLE_PREPROCESSING tag is set to YES (the default) Doxygen will +# evaluate all C-preprocessor directives found in the sources and include +# files. + +ENABLE_PREPROCESSING = YES + +# If the MACRO_EXPANSION tag is set to YES Doxygen will expand all macro +# names in the source code. If set to NO (the default) only conditional +# compilation will be performed. Macro expansion can be done in a controlled +# way by setting EXPAND_ONLY_PREDEF to YES. + +MACRO_EXPANSION = YES + +# If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES +# then the macro expansion is limited to the macros specified with the +# PREDEFINED and EXPAND_AS_DEFINED tags. + +EXPAND_ONLY_PREDEF = YES + +# If the SEARCH_INCLUDES tag is set to YES (the default) the includes files +# in the INCLUDE_PATH (see below) will be search if a #include is found. + +SEARCH_INCLUDES = YES + +# The INCLUDE_PATH tag can be used to specify one or more directories that +# contain include files that are not input files but should be processed by +# the preprocessor. + +INCLUDE_PATH = + +# You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard +# patterns (like *.h and *.hpp) to filter out the header-files in the +# directories. If left blank, the patterns specified with FILE_PATTERNS will +# be used. + +INCLUDE_FILE_PATTERNS = + +# The PREDEFINED tag can be used to specify one or more macro names that +# are defined before the preprocessor is started (similar to the -D option of +# gcc). The argument of the tag is a list of macros of the form: name +# or name=definition (no spaces). If the definition and the = are +# omitted =1 is assumed. To prevent a macro definition from being +# undefined via #undef or recursively expanded use the := operator +# instead of the = operator. + +PREDEFINED = CONFIG_SSL_CERT_VERIFICATION \ + CONFIG_SSL_ENABLE_CLIENT \ + CONFIG_SSL_GENERATE_X509_CERT \ + CONFIG_BIGINT_MONTGOMERY \ + CONFIG_BIGINT_BARRETT \ + CONFIG_BIGINT_CRT \ + "EXP_FUNC=" \ + "STDCALL=" + +# If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then +# this tag can be used to specify a list of macro names that should be expanded. +# The macro definition that is found in the sources will be used. +# Use the PREDEFINED tag if you want to use a different macro definition. + +EXPAND_AS_DEFINED = + +# If the SKIP_FUNCTION_MACROS tag is set to YES (the default) then +# doxygen's preprocessor will remove all function-like macros that are alone +# on a line, have an all uppercase name, and do not end with a semicolon. Such +# function macros are typically used for boiler-plate code, and will confuse +# the parser if not removed. + +SKIP_FUNCTION_MACROS = YES + +#--------------------------------------------------------------------------- +# Configuration::additions related to external references +#--------------------------------------------------------------------------- + +# The TAGFILES option can be used to specify one or more tagfiles. +# Optionally an initial location of the external documentation +# can be added for each tagfile. The format of a tag file without +# this location is as follows: +# TAGFILES = file1 file2 ... +# Adding location for the tag files is done as follows: +# TAGFILES = file1=loc1 "file2 = loc2" ... +# where "loc1" and "loc2" can be relative or absolute paths or +# URLs. If a location is present for each tag, the installdox tool +# does not have to be run to correct the links. +# Note that each tag file must have a unique name +# (where the name does NOT include the path) +# If a tag file is not located in the directory in which doxygen +# is run, you must also specify the path to the tagfile here. + +TAGFILES = + +# When a file name is specified after GENERATE_TAGFILE, doxygen will create +# a tag file that is based on the input files it reads. + +GENERATE_TAGFILE = + +# If the ALLEXTERNALS tag is set to YES all external classes will be listed +# in the class index. If set to NO only the inherited external classes +# will be listed. + +ALLEXTERNALS = NO + +# If the EXTERNAL_GROUPS tag is set to YES all external groups will be listed +# in the modules index. If set to NO, only the current project's groups will +# be listed. + +EXTERNAL_GROUPS = NO + +# The PERL_PATH should be the absolute path and name of the perl script +# interpreter (i.e. the result of `which perl'). + +PERL_PATH = /usr/bin/perl + +#--------------------------------------------------------------------------- +# Configuration options related to the dot tool +#--------------------------------------------------------------------------- + +# If the CLASS_DIAGRAMS tag is set to YES (the default) Doxygen will +# generate a inheritance diagram (in HTML, RTF and LaTeX) for classes with base +# or super classes. Setting the tag to NO turns the diagrams off. Note that +# this option is superseded by the HAVE_DOT option below. This is only a +# fallback. It is recommended to install and use dot, since it yields more +# powerful graphs. + +CLASS_DIAGRAMS = YES + +# You can define message sequence charts within doxygen comments using the \msc +# command. Doxygen will then run the mscgen tool (see +# http://www.mcternan.me.uk/mscgen/) to produce the chart and insert it in the +# documentation. The MSCGEN_PATH tag allows you to specify the directory where +# the mscgen tool resides. If left empty the tool is assumed to be found in the +# default search path. + +MSCGEN_PATH = + +# If set to YES, the inheritance and collaboration graphs will hide +# inheritance and usage relations if the target is undocumented +# or is not a class. + +HIDE_UNDOC_RELATIONS = YES + +# If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is +# available from the path. This tool is part of Graphviz, a graph visualization +# toolkit from AT&T and Lucent Bell Labs. The other options in this section +# have no effect if this option is set to NO (the default) + +HAVE_DOT = NO + +# If the CLASS_GRAPH and HAVE_DOT tags are set to YES then doxygen +# will generate a graph for each documented class showing the direct and +# indirect inheritance relations. Setting this tag to YES will force the +# the CLASS_DIAGRAMS tag to NO. + +CLASS_GRAPH = NO + +# If the COLLABORATION_GRAPH and HAVE_DOT tags are set to YES then doxygen +# will generate a graph for each documented class showing the direct and +# indirect implementation dependencies (inheritance, containment, and +# class references variables) of the class with other documented classes. + +COLLABORATION_GRAPH = NO + +# If the GROUP_GRAPHS and HAVE_DOT tags are set to YES then doxygen +# will generate a graph for groups, showing the direct groups dependencies + +GROUP_GRAPHS = NO + +# If the UML_LOOK tag is set to YES doxygen will generate inheritance and +# collaboration diagrams in a style similar to the OMG's Unified Modeling +# Language. + +UML_LOOK = NO + +# If set to YES, the inheritance and collaboration graphs will show the +# relations between templates and their instances. + +TEMPLATE_RELATIONS = NO + +# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDE_GRAPH, and HAVE_DOT +# tags are set to YES then doxygen will generate a graph for each documented +# file showing the direct and indirect include dependencies of the file with +# other documented files. + +INCLUDE_GRAPH = NO + +# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDED_BY_GRAPH, and +# HAVE_DOT tags are set to YES then doxygen will generate a graph for each +# documented header file showing the documented files that directly or +# indirectly include this file. + +INCLUDED_BY_GRAPH = NO + +# If the CALL_GRAPH and HAVE_DOT options are set to YES then +# doxygen will generate a call dependency graph for every global function +# or class method. Note that enabling this option will significantly increase +# the time of a run. So in most cases it will be better to enable call graphs +# for selected functions only using the \callgraph command. + +CALL_GRAPH = NO + +# If the CALLER_GRAPH and HAVE_DOT tags are set to YES then +# doxygen will generate a caller dependency graph for every global function +# or class method. Note that enabling this option will significantly increase +# the time of a run. So in most cases it will be better to enable caller +# graphs for selected functions only using the \callergraph command. + +CALLER_GRAPH = NO + +# If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen +# will graphical hierarchy of all classes instead of a textual one. + +GRAPHICAL_HIERARCHY = NO + +# If the DIRECTORY_GRAPH, SHOW_DIRECTORIES and HAVE_DOT tags are set to YES +# then doxygen will show the dependencies a directory has on other directories +# in a graphical way. The dependency relations are determined by the #include +# relations between the files in the directories. + +DIRECTORY_GRAPH = NO + +# The DOT_IMAGE_FORMAT tag can be used to set the image format of the images +# generated by dot. Possible values are png, jpg, or gif +# If left blank png will be used. + +DOT_IMAGE_FORMAT = png + +# The tag DOT_PATH can be used to specify the path where the dot tool can be +# found. If left blank, it is assumed the dot tool can be found in the path. + +DOT_PATH = + +# The DOTFILE_DIRS tag can be used to specify one or more directories that +# contain dot files that are included in the documentation (see the +# \dotfile command). + +DOTFILE_DIRS = + +# The MAX_DOT_GRAPH_MAX_NODES tag can be used to set the maximum number of +# nodes that will be shown in the graph. If the number of nodes in a graph +# becomes larger than this value, doxygen will truncate the graph, which is +# visualized by representing a node as a red box. Note that doxygen if the +# number of direct children of the root node in a graph is already larger than +# DOT_GRAPH_MAX_NODES then the graph will not be shown at all. Also note +# that the size of a graph can be further restricted by MAX_DOT_GRAPH_DEPTH. + +DOT_GRAPH_MAX_NODES = 50 + +# The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the +# graphs generated by dot. A depth value of 3 means that only nodes reachable +# from the root by following a path via at most 3 edges will be shown. Nodes +# that lay further from the root node will be omitted. Note that setting this +# option to 1 or 2 may greatly reduce the computation time needed for large +# code bases. Also note that the size of a graph can be further restricted by +# DOT_GRAPH_MAX_NODES. Using a depth of 0 means no depth restriction. + +MAX_DOT_GRAPH_DEPTH = 0 + +# Set the DOT_TRANSPARENT tag to YES to generate images with a transparent +# background. This is enabled by default, which results in a transparent +# background. Warning: Depending on the platform used, enabling this option +# may lead to badly anti-aliased labels on the edges of a graph (i.e. they +# become hard to read). + +DOT_TRANSPARENT = NO + +# Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output +# files in one run (i.e. multiple -o and -T options on the command line). This +# makes dot run faster, but since only newer versions of dot (>1.8.10) +# support this, this feature is disabled by default. + +DOT_MULTI_TARGETS = NO + +# If the GENERATE_LEGEND tag is set to YES (the default) Doxygen will +# generate a legend page explaining the meaning of the various boxes and +# arrows in the dot generated graphs. + +GENERATE_LEGEND = YES + +# If the DOT_CLEANUP tag is set to YES (the default) Doxygen will +# remove the intermediate dot files that are used to generate +# the various graphs. + +DOT_CLEANUP = YES + +#--------------------------------------------------------------------------- +# Configuration::additions related to the search engine +#--------------------------------------------------------------------------- + +# The SEARCHENGINE tag specifies whether or not a search engine should be +# used. If set to NO the values of all tags below this one will be ignored. + +SEARCHENGINE = NO diff --git a/httpd/axhttpd.c b/httpd/axhttpd.c index 9d42aed8ee..148d99a5f1 100644 --- a/httpd/axhttpd.c +++ b/httpd/axhttpd.c @@ -612,6 +612,7 @@ void removeconnection(struct connstruct *cn) cn->ssl = NULL; } + shutdown(cn->networkdesc, SHUT_WR); SOCKET_CLOSE(cn->networkdesc); } diff --git a/www/index.html b/www/index.html index 6170143e33..c123310fa4 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 1e8e8182426d59e5912b50720ed869a8acce2087 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 4 Dec 2009 10:59:07 +0000 Subject: [PATCH 139/301] index.html update git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@164 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- www/index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/www/index.html b/www/index.html index c123310fa4..78825ed78c 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 13dee95d971d6684c38510e0a5d2a85c7541c3a2 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 12 Dec 2009 04:11:56 +0000 Subject: [PATCH 140/301] Fix for ssl client renotiation SSL error git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@166 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/ssl.h | 1 + ssl/tls1.c | 17 +++++++++++++++-- ssl/tls1_clnt.c | 1 + 3 files changed, 17 insertions(+), 2 deletions(-) diff --git a/ssl/ssl.h b/ssl/ssl.h index d6ed68daee..9e9d801c06 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -100,6 +100,7 @@ extern "C" { #define SSL_ERROR_INVALID_KEY -269 #define SSL_ERROR_FINISHED_INVALID -271 #define SSL_ERROR_NO_CERT_DEFINED -272 +#define SSL_ERROR_NO_CLIENT_RENOG -273 #define SSL_ERROR_NOT_SUPPORTED -274 #define SSL_X509_OFFSET -512 #define SSL_X509_ERROR(A) (SSL_X509_OFFSET+A) diff --git a/ssl/tls1.c b/ssl/tls1.c index 9a469d7fe4..5ce8c24539 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -1230,8 +1230,16 @@ int basic_read(SSL *ssl, uint8_t **in_data) switch (ssl->record_type) { case PT_HANDSHAKE_PROTOCOL: - ssl->dc->bm_proc_index = 0; - ret = do_handshake(ssl, buf, read_len); + if (ssl->dc != NULL) + { + ssl->dc->bm_proc_index = 0; + ret = do_handshake(ssl, buf, read_len); + } + else /* no client renogiation allowed */ + { + ret = SSL_ERROR_NO_CLIENT_RENOG; + goto error; + } break; case PT_CHANGE_CIPHER_SPEC: @@ -1402,6 +1410,7 @@ int send_alert(SSL *ssl, int error_code) case SSL_ERROR_INVALID_HANDSHAKE: case SSL_ERROR_INVALID_PROT_MSG: + case SSL_ERROR_NO_CLIENT_RENOG: alert_num = SSL_ALERT_HANDSHAKE_FAILURE; break; @@ -1958,6 +1967,10 @@ EXP_FUNC void STDCALL ssl_display_error(int error_code) printf("no certificate defined"); break; + case SSL_ERROR_NO_CLIENT_RENOG: + printf("client renegotiation not supported"); + break; + case SSL_ERROR_NOT_SUPPORTED: printf("Option not supported"); break; diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index 91314333c0..beb0e278b2 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -123,6 +123,7 @@ int do_clnt_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len) case HS_FINISHED: ret = process_finished(ssl, hs_len); disposable_free(ssl); /* free up some memory */ + /* note: client renogiation is not allowed after this */ break; case HS_HELLO_REQUEST: From c484a1ee7285e2fca61a0830541d7f243ddc3d3d Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 1 May 2010 04:38:16 +0000 Subject: [PATCH 141/301] added an entropy pool to the RNG git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@167 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/crypto_misc.c | 73 ++++++++++++++++++++++++++------------------ www/index.html | 2 +- 2 files changed, 45 insertions(+), 30 deletions(-) diff --git a/crypto/crypto_misc.c b/crypto/crypto_misc.c index 59b72ec08d..fb257dd541 100644 --- a/crypto/crypto_misc.c +++ b/crypto/crypto_misc.c @@ -48,7 +48,12 @@ static HCRYPTPROV gCryptProv; #endif #if (!defined(CONFIG_USE_DEV_URANDOM) && !defined(CONFIG_WIN32_USE_CRYPTO_LIB)) -static uint64_t rng_num; +/* change to 32bit processor registers as appropriate */ +#define ENTROPY_POOL_SIZE 32 +#define ENTROPY_COUNTER1 (uint32_t)((tv.tv_sec<<16) + tv.tv_usec) +#define ENTROPY_COUNTER2 (uint32_t)rand() +static uint8_t entropy_pool[ENTROPY_POOL_SIZE]; +static MD5_CTX rng_digest_ctx; #endif static int rng_ref_count; @@ -119,15 +124,26 @@ EXP_FUNC void STDCALL RNG_initialize(const uint8_t *seed_buf, int size) } } #else - /* help seed with the user's private key - this is a number that - should be hard to find, due to the fact that it relies on knowing - the private key */ - int i; - - for (i = 0; i < size/(int)sizeof(uint64_t); i++) - rng_num ^= *((uint64_t *)&seed_buf[i*sizeof(uint64_t)]); + int i; + uint32_t seed_addr_val = (uint32_t)&seed_buf; + uint32_t *ep = (uint32_t *)entropy_pool; +printf("blah %08x\n", seed_addr_val); + + /* help start the entropy with the user's private key - this is + a number that should be hard to find, due to the fact that it + relies on knowing the private key */ + memcpy(entropy_pool, seed_buf, ENTROPY_POOL_SIZE); +print_blob("entropy 1", entropy_pool, ENTROPY_POOL_SIZE); + /* mix it up a little with a stack address */ + for (i = 0; i < ENTROPY_POOL_SIZE/4; i++) +{ +printf("YA: %08x\n", ep[i]); + ep[i] ^= seed_addr_val; +} +print_blob("entropy 2", entropy_pool, ENTROPY_POOL_SIZE); - srand((long)&seed_buf); /* use the stack ptr as another rnd seed */ + MD5_Init(&rng_digest_ctx); + srand((long)entropy_pool); #endif } @@ -165,31 +181,30 @@ EXP_FUNC void STDCALL get_random(int num_rand_bytes, uint8_t *rand_data) and a couple of random seeds to generate a random sequence */ RC4_CTX rng_ctx; struct timeval tv; - uint64_t big_num1, big_num2; + uint8_t digest[MD5_SIZE]; + int i; - gettimeofday(&tv, NULL); /* yes I know we shouldn't do this */ + /* A proper implementation would use counters etc for entropy */ + gettimeofday(&tv, NULL); + uint64_t *ep = (uint64_t *)entropy_pool; + ep[0] ^= (uint64_t)ENTROPY_COUNTER1; + ep[1] ^= (uint64_t)ENTROPY_COUNTER2; - /* all numbers by themselves are pretty simple, but combined should - * be a challenge */ - big_num1 = (uint64_t)tv.tv_sec*(tv.tv_usec+1); - big_num2 = (uint64_t)rand()*big_num1; - big_num1 ^= rng_num; + /* use a digested version of the entropy pool as a key */ + MD5_Update(&rng_digest_ctx, entropy_pool, ENTROPY_POOL_SIZE); + MD5_Final(digest, &rng_digest_ctx); - memcpy(rand_data, &big_num1, sizeof(uint64_t)); - if (num_rand_bytes > sizeof(uint64_t)) - memcpy(&rand_data[8], &big_num2, sizeof(uint64_t)); + /* come up with the random sequence */ + RC4_setup(&rng_ctx, digest, MD5_SIZE); /* use as a key */ + memcpy(rand_data, entropy_pool, ENTROPY_POOL_SIZE); + RC4_crypt(&rng_ctx, rand_data, rand_data, num_rand_bytes); - if (num_rand_bytes > 16) - { - /* clear rest of data */ - memset(&rand_data[16], 0, num_rand_bytes-16); - } + /* move things along */ + for (i = ENTROPY_POOL_SIZE-1; i >= MD5_SIZE ; i--) + entropy_pool[i] = entropy_pool[i-MD5_SIZE]; - RC4_setup(&rng_ctx, rand_data, 16); /* use as a key */ - RC4_crypt(&rng_ctx, rand_data, rand_data, num_rand_bytes); - - /* use last 8 bytes for next time */ - memcpy(&rng_num, &rand_data[num_rand_bytes-8], sizeof(uint64_t)); + /* insert the digest at the start of the entropy pool */ + memcpy(entropy_pool, digest, MD5_SIZE); #endif } diff --git a/www/index.html b/www/index.html index 78825ed78c..4f6d4ccc74 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From fe927a6d0e7d7f75e0b845231f0c0ee518b8c0d0 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 1 May 2010 04:56:01 +0000 Subject: [PATCH 142/301] account for output buffer being smaller than entropy pool git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@168 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/crypto_misc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/crypto/crypto_misc.c b/crypto/crypto_misc.c index fb257dd541..5efa2cb551 100644 --- a/crypto/crypto_misc.c +++ b/crypto/crypto_misc.c @@ -196,7 +196,8 @@ EXP_FUNC void STDCALL get_random(int num_rand_bytes, uint8_t *rand_data) /* come up with the random sequence */ RC4_setup(&rng_ctx, digest, MD5_SIZE); /* use as a key */ - memcpy(rand_data, entropy_pool, ENTROPY_POOL_SIZE); + memcpy(rand_data, entropy_pool, num_rand_bytes < ENTROPY_POOL_SIZE ? + num_rand_bytes : ENTROPY_POOL_SIZE); RC4_crypt(&rng_ctx, rand_data, rand_data, num_rand_bytes); /* move things along */ From e674d076d41820ce3620be72b69066a948f16f23 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 1 May 2010 05:28:44 +0000 Subject: [PATCH 143/301] removed debugging git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@169 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/crypto_misc.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/crypto/crypto_misc.c b/crypto/crypto_misc.c index 5efa2cb551..40df4e0241 100644 --- a/crypto/crypto_misc.c +++ b/crypto/crypto_misc.c @@ -53,7 +53,6 @@ static HCRYPTPROV gCryptProv; #define ENTROPY_COUNTER1 (uint32_t)((tv.tv_sec<<16) + tv.tv_usec) #define ENTROPY_COUNTER2 (uint32_t)rand() static uint8_t entropy_pool[ENTROPY_POOL_SIZE]; -static MD5_CTX rng_digest_ctx; #endif static int rng_ref_count; @@ -127,22 +126,16 @@ EXP_FUNC void STDCALL RNG_initialize(const uint8_t *seed_buf, int size) int i; uint32_t seed_addr_val = (uint32_t)&seed_buf; uint32_t *ep = (uint32_t *)entropy_pool; -printf("blah %08x\n", seed_addr_val); /* help start the entropy with the user's private key - this is a number that should be hard to find, due to the fact that it relies on knowing the private key */ memcpy(entropy_pool, seed_buf, ENTROPY_POOL_SIZE); -print_blob("entropy 1", entropy_pool, ENTROPY_POOL_SIZE); + /* mix it up a little with a stack address */ for (i = 0; i < ENTROPY_POOL_SIZE/4; i++) -{ -printf("YA: %08x\n", ep[i]); ep[i] ^= seed_addr_val; -} -print_blob("entropy 2", entropy_pool, ENTROPY_POOL_SIZE); - MD5_Init(&rng_digest_ctx); srand((long)entropy_pool); #endif } @@ -181,6 +174,7 @@ EXP_FUNC void STDCALL get_random(int num_rand_bytes, uint8_t *rand_data) and a couple of random seeds to generate a random sequence */ RC4_CTX rng_ctx; struct timeval tv; + MD5_CTX rng_digest_ctx; uint8_t digest[MD5_SIZE]; int i; @@ -191,6 +185,7 @@ EXP_FUNC void STDCALL get_random(int num_rand_bytes, uint8_t *rand_data) ep[1] ^= (uint64_t)ENTROPY_COUNTER2; /* use a digested version of the entropy pool as a key */ + MD5_Init(&rng_digest_ctx); MD5_Update(&rng_digest_ctx, entropy_pool, ENTROPY_POOL_SIZE); MD5_Final(digest, &rng_digest_ctx); From 8b2e5bba8279010bcec7cc5126cbf46e470d8c60 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 7 May 2010 10:39:58 +0000 Subject: [PATCH 144/301] fixes to axhttpd from Joe Pruett git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@170 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/crypto_misc.c | 2 +- httpd/axhttpd.c | 6 ++++-- httpd/proc.c | 31 +++++++++++++++++++------------ 3 files changed, 24 insertions(+), 15 deletions(-) diff --git a/crypto/crypto_misc.c b/crypto/crypto_misc.c index 40df4e0241..a44c5c22af 100644 --- a/crypto/crypto_misc.c +++ b/crypto/crypto_misc.c @@ -131,12 +131,12 @@ EXP_FUNC void STDCALL RNG_initialize(const uint8_t *seed_buf, int size) a number that should be hard to find, due to the fact that it relies on knowing the private key */ memcpy(entropy_pool, seed_buf, ENTROPY_POOL_SIZE); + srand((long)entropy_pool); /* mix it up a little with a stack address */ for (i = 0; i < ENTROPY_POOL_SIZE/4; i++) ep[i] ^= seed_addr_val; - srand((long)entropy_pool); #endif } diff --git a/httpd/axhttpd.c b/httpd/axhttpd.c index 148d99a5f1..bb54e487ca 100644 --- a/httpd/axhttpd.c +++ b/httpd/axhttpd.c @@ -55,7 +55,8 @@ static void addcgiext(const char *tp); #if !defined(WIN32) static void reaper(int sigtype) { - wait3(NULL, WNOHANG, NULL); + while (wait3(NULL, WNOHANG, NULL) > 0) + continue; } #endif #endif @@ -446,7 +447,8 @@ static void handlenewconnection(int listenfd, int is_ssl) else *ipbuf = '\0'; - addconnection(connfd, ipbuf, is_ssl); + if (connfd != -1) /* check for error condition */ + addconnection(connfd, ipbuf, is_ssl); } #else diff --git a/httpd/proc.c b/httpd/proc.c index c90fa97909..3874c8fc26 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -119,7 +119,7 @@ static int procheadelem(struct connstruct *cn, char *buf) #endif cn->if_modified_since = -1; } - else if (strcmp(buf, "Host:") == 0) + else if (strcasecmp(buf, "Host:") == 0) { if (sanitizehost(value) == 0) { @@ -129,21 +129,24 @@ static int procheadelem(struct connstruct *cn, char *buf) my_strncpy(cn->server_name, value, MAXREQUESTLENGTH); } - else if (strcmp(buf, "Connection:") == 0 && strcmp(value, "close") == 0) + else if (strcasecmp(buf, "Connection:") == 0 && strcmp(value, "close") == 0) { cn->close_when_done = 1; } - else if (strcmp(buf, "If-Modified-Since:") == 0) + else if (strcasecmp(buf, "If-Modified-Since:") == 0) { cn->if_modified_since = tdate_parse(value); } - else if (strcmp(buf, "Expect:") == 0) + else if (strcasecmp(buf, "Expect:") == 0) { - send_error(cn, 417); /* expectation failed */ - return 0; + /* supposed to be safe to ignore 100-continue */ + if (strcasecmp(value, "100-continue") != 0) { + send_error(cn, 417); /* expectation failed */ + return 0; + } } #ifdef CONFIG_HTTP_HAS_AUTHORIZATION - else if (strcmp(buf, "Authorization:") == 0 && + else if (strcasecmp(buf, "Authorization:") == 0 && strncmp(value, "Basic ", 6) == 0) { int size; @@ -155,15 +158,15 @@ static int procheadelem(struct connstruct *cn, char *buf) } #endif #if defined(CONFIG_HTTP_HAS_CGI) - else if (strcmp(buf, "Content-Length:") == 0) + else if (strcasecmp(buf, "Content-Length:") == 0) { sscanf(value, "%d", &cn->content_length); } - else if (strcmp(buf, "Content-Type:") == 0) + else if (strcasecmp(buf, "Content-Type:") == 0) { my_strncpy(cn->cgicontenttype, value, MAXREQUESTLENGTH); } - else if (strcmp(buf, "Cookie:") == 0) + else if (strcasecmp(buf, "Cookie:") == 0) { my_strncpy(cn->cookie, value, MAXREQUESTLENGTH); } @@ -628,11 +631,15 @@ static void proccgi(struct connstruct *cn) /* Our stdout/stderr goes to the socket */ dup2(tpipe[1], 1); dup2(tpipe[1], 2); + close(tpipe[0]); + close(tpipe[1]); /* If it was a POST request, send the socket data to our stdin */ - if (cn->reqtype == TYPE_POST) + if (cn->reqtype == TYPE_POST) { dup2(spipe[0], 0); - else /* Otherwise we can shutdown the read side of the sock */ + close(spipe[0]); + close(spipe[1]); + } else /* Otherwise we can shutdown the read side of the sock */ shutdown(cn->networkdesc, 0); myargs[0] = cn->actualfile; From 596f569e1ec1f18d9b9dd092f59f08297a99b0a0 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 7 May 2010 11:49:30 +0000 Subject: [PATCH 145/301] fixed warning git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@171 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/proc.c | 2 +- www/index.html | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/httpd/proc.c b/httpd/proc.c index 3874c8fc26..b9140cdc3b 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -1022,7 +1022,7 @@ static int sanitizehost(char *buf) } /* Enforce some basic URL rules... */ - if ((isalnum(*buf) == 0 && *buf != '-' && *buf != '.') || + if ((isalnum((int)(*buf)) == 0 && *buf != '-' && *buf != '.') || (*buf == '.' && *(buf+1) == '.') || (*buf == '.' && *(buf+1) == '-') || (*buf == '-' && *(buf+1) == '.')) diff --git a/www/index.html b/www/index.html index 4f6d4ccc74..ba4a7d8028 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From e686f3b6c6289aca2d5e060f0b55d9309c5c7ebc Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 8 May 2010 07:37:49 +0000 Subject: [PATCH 146/301] added alert for renegotiation failure git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@172 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/ssl.h | 1 + ssl/test/ssltest.c | 18 ++++++++++-------- ssl/tls1.c | 9 ++++++++- ssl/x509.c | 1 - 4 files changed, 19 insertions(+), 10 deletions(-) diff --git a/ssl/ssl.h b/ssl/ssl.h index 9e9d801c06..bde6b68656 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -115,6 +115,7 @@ extern "C" { #define SSL_ALERT_DECODE_ERROR 50 #define SSL_ALERT_DECRYPT_ERROR 51 #define SSL_ALERT_INVALID_VERSION 70 +#define SSL_ALERT_NO_RENEGOTIATION 100 /* The ciphers that are supported */ #define SSL_AES128_SHA 0x2f diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 62169d45a4..bdc3f8d36a 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -53,8 +53,8 @@ #define DEFAULT_KEY "../ssl/test/axTLS.key_512" //#define DEFAULT_SVR_OPTION SSL_DISPLAY_BYTES|SSL_DISPLAY_STATES #define DEFAULT_SVR_OPTION 0 -#define DEFAULT_CLNT_OPTION 0 //#define DEFAULT_CLNT_OPTION SSL_DISPLAY_BYTES|SSL_DISPLAY_STATES +#define DEFAULT_CLNT_OPTION 0 static int g_port = 19001; @@ -1281,7 +1281,7 @@ static int SSL_client_test( #endif } - usleep(200000); /* allow server to start */ + usleep(500000); /* allow server to start */ if (*ssl_ctx == NULL) { @@ -1449,12 +1449,14 @@ int SSL_client_tests(void) DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) goto cleanup; - sess_resume.do_reneg = 1; - if ((ret = SSL_client_test("Client renegotiation", - &ssl_ctx, NULL, &sess_resume, - DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) - goto cleanup; - sess_resume.do_reneg = 0; +// no client renegotiation +// TODO: this was causing a lock-up on x509_free() +// sess_resume.do_reneg = 1; +// if ((ret = SSL_client_test("Client renegotiation", +// &ssl_ctx, NULL, &sess_resume, +// DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) +// goto cleanup; +// sess_resume.do_reneg = 0; sess_resume.stop_server = 1; if ((ret = SSL_client_test("Client session resumption #2", diff --git a/ssl/tls1.c b/ssl/tls1.c index 5ce8c24539..a93df824d3 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -1410,7 +1410,6 @@ int send_alert(SSL *ssl, int error_code) case SSL_ERROR_INVALID_HANDSHAKE: case SSL_ERROR_INVALID_PROT_MSG: - case SSL_ERROR_NO_CLIENT_RENOG: alert_num = SSL_ALERT_HANDSHAKE_FAILURE; break; @@ -1433,6 +1432,10 @@ int send_alert(SSL *ssl, int error_code) alert_num = SSL_ALERT_BAD_CERTIFICATE; break; + case SSL_ERROR_NO_CLIENT_RENOG: + alert_num = SSL_ALERT_NO_RENEGOTIATION; + break; + default: /* a catch-all for any badly verified certificates */ alert_num = (error_code <= SSL_X509_OFFSET) ? @@ -2032,6 +2035,10 @@ void DISPLAY_ALERT(SSL *ssl, int alert) printf("decrypt error"); break; + case SSL_ALERT_NO_RENEGOTIATION: + printf("no renegotiation"); + break; + default: printf("alert - (unknown %d)", alert); break; diff --git a/ssl/x509.c b/ssl/x509.c index 89e2681a5b..595585b551 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -234,7 +234,6 @@ void x509_free(X509_CTX *x509_ctx) free(x509_ctx->cert_dn[i]); } - free(x509_ctx->signature); #ifdef CONFIG_SSL_CERT_VERIFICATION From 92b07bc18d2af04ab6c259d7550c9281ce53f388 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 9 May 2010 09:18:03 +0000 Subject: [PATCH 147/301] changed test for ssl_renegotiation failure git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@173 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/test/ssltest.c | 20 ++++++++++++-------- ssl/x509.c | 1 - 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index bdc3f8d36a..2ea473fbac 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1352,7 +1352,7 @@ static int SSL_client_test( /* renegotiate client */ if (sess_resume && sess_resume->do_reneg) { - if (ssl_renegotiate(ssl) < 0) + if ((ret = ssl_renegotiate(ssl)) < 0) goto client_test_exit; } @@ -1451,12 +1451,16 @@ int SSL_client_tests(void) // no client renegotiation // TODO: this was causing a lock-up on x509_free() -// sess_resume.do_reneg = 1; -// if ((ret = SSL_client_test("Client renegotiation", -// &ssl_ctx, NULL, &sess_resume, -// DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) -// goto cleanup; -// sess_resume.do_reneg = 0; + sess_resume.do_reneg = 1; + if ((ret = SSL_client_test("Client renegotiation", + &ssl_ctx, NULL, &sess_resume, + DEFAULT_CLNT_OPTION, NULL, NULL, NULL)) != + -SSL_ALERT_NO_RENEGOTIATION) + { + printf("*** Error: %d\n", ret); TTY_FLUSH(); + goto cleanup; + } + sess_resume.do_reneg = 0; sess_resume.stop_server = 1; if ((ret = SSL_client_test("Client session resumption #2", @@ -1527,7 +1531,7 @@ int SSL_client_tests(void) DEFAULT_CLNT_OPTION|SSL_SERVER_VERIFY_LATER, NULL, NULL, NULL)) != SSL_X509_ERROR(X509_VFY_ERROR_EXPIRED)) { - printf("*** Error: %d\n", ret); + printf("*** Error: %d\n", ret); TTY_FLUSH(); goto cleanup; } diff --git a/ssl/x509.c b/ssl/x509.c index 595585b551..dcdea04f1f 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -252,7 +252,6 @@ void x509_free(X509_CTX *x509_ctx) #endif RSA_free(x509_ctx->rsa_ctx); - next = x509_ctx->next; free(x509_ctx); x509_free(next); /* clear the chain */ From c1c56567189a2e35c5d55a35055c43e304ec9647 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 2 Jun 2010 12:39:51 +0000 Subject: [PATCH 148/301] fixed memory leak in test harness git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@174 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/test/ssltest.c | 1 + 1 file changed, 1 insertion(+) diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 2ea473fbac..29ec4ccd16 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1550,6 +1550,7 @@ int SSL_client_tests(void) printf("All client tests passed\n"); TTY_FLUSH(); } + ssl_ctx_free(ssl_ctx); return ret; } From 09e79822d543fd9ceece018fdf1eaba58789055e Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 6 Aug 2010 09:58:26 +0000 Subject: [PATCH 149/301] some fixes to bigint library git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@175 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/bigint.c | 4 ++-- crypto/crypto_misc.c | 10 +++++----- ssl/test/ssltest.c | 23 +++++++++++------------ ssl/tls1.c | 20 ++++++++++++++++---- www/index.html | 4 ++-- 5 files changed, 36 insertions(+), 25 deletions(-) diff --git a/crypto/bigint.c b/crypto/bigint.c index 53a5839293..1d95bd549d 100644 --- a/crypto/bigint.c +++ b/crypto/bigint.c @@ -1128,7 +1128,7 @@ static int find_max_exp_index(bigint *biexp) } shift >>= 1; - } while (--i != 0); + } while (i-- != 0); return -1; /* error - must have been a leading 0 */ } @@ -1151,7 +1151,7 @@ static int exp_bit_is_one(bigint *biexp, int offset) shift <<= 1; } - return test & shift; + return (test & shift) != 0; } #ifdef CONFIG_BIGINT_CHECK_ON diff --git a/crypto/crypto_misc.c b/crypto/crypto_misc.c index a44c5c22af..402efe7395 100644 --- a/crypto/crypto_misc.c +++ b/crypto/crypto_misc.c @@ -48,10 +48,10 @@ static HCRYPTPROV gCryptProv; #endif #if (!defined(CONFIG_USE_DEV_URANDOM) && !defined(CONFIG_WIN32_USE_CRYPTO_LIB)) -/* change to 32bit processor registers as appropriate */ +/* change to processor registers as appropriate */ #define ENTROPY_POOL_SIZE 32 -#define ENTROPY_COUNTER1 (uint32_t)((tv.tv_sec<<16) + tv.tv_usec) -#define ENTROPY_COUNTER2 (uint32_t)rand() +#define ENTROPY_COUNTER1 ((((uint64_t)tv.tv_sec)<<32) | tv.tv_usec) +#define ENTROPY_COUNTER2 rand() static uint8_t entropy_pool[ENTROPY_POOL_SIZE]; #endif @@ -181,8 +181,8 @@ EXP_FUNC void STDCALL get_random(int num_rand_bytes, uint8_t *rand_data) /* A proper implementation would use counters etc for entropy */ gettimeofday(&tv, NULL); uint64_t *ep = (uint64_t *)entropy_pool; - ep[0] ^= (uint64_t)ENTROPY_COUNTER1; - ep[1] ^= (uint64_t)ENTROPY_COUNTER2; + ep[0] ^= ENTROPY_COUNTER1; + ep[1] ^= ENTROPY_COUNTER2; /* use a digested version of the entropy pool as a key */ MD5_Init(&rng_digest_ctx); diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 29ec4ccd16..32297abd1c 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1449,18 +1449,17 @@ int SSL_client_tests(void) DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) goto cleanup; -// no client renegotiation -// TODO: this was causing a lock-up on x509_free() - sess_resume.do_reneg = 1; - if ((ret = SSL_client_test("Client renegotiation", - &ssl_ctx, NULL, &sess_resume, - DEFAULT_CLNT_OPTION, NULL, NULL, NULL)) != - -SSL_ALERT_NO_RENEGOTIATION) - { - printf("*** Error: %d\n", ret); TTY_FLUSH(); - goto cleanup; - } - sess_resume.do_reneg = 0; + // no client renegotiation + //sess_resume.do_reneg = 1; + //if ((ret = SSL_client_test("Client renegotiation", + // &ssl_ctx, NULL, &sess_resume, + // DEFAULT_CLNT_OPTION, NULL, NULL, NULL)) != + // -SSL_ALERT_NO_RENEGOTIATION) + //{ + // printf("*** Error: %d\n", ret); TTY_FLUSH(); + // goto cleanup; + //} + //sess_resume.do_reneg = 0; sess_resume.stop_server = 1; if ((ret = SSL_client_test("Client session resumption #2", diff --git a/ssl/tls1.c b/ssl/tls1.c index a93df824d3..d9f147a09c 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -47,7 +47,7 @@ static const char * server_finished = "server finished"; static const char * client_finished = "client finished"; static int do_handshake(SSL *ssl, uint8_t *buf, int read_len); -static void set_key_block(SSL *ssl, int is_write); +static int set_key_block(SSL *ssl, int is_write); static int verify_digest(SSL *ssl, int mode, const uint8_t *buf, int read_len); static void *crypt_new(SSL *ssl, uint8_t *key, uint8_t *iv, int is_decrypt); static int send_raw_packet(SSL *ssl, uint8_t protocol); @@ -1059,7 +1059,7 @@ int send_packet(SSL *ssl, uint8_t protocol, const uint8_t *in, int length) * Work out the cipher keys we are going to use for this session based on the * master secret. */ -static void set_key_block(SSL *ssl, int is_write) +static int set_key_block(SSL *ssl, int is_write) { const cipher_info_t *ciph_info = get_cipher_info(ssl->cipher); uint8_t *q; @@ -1067,6 +1067,9 @@ static void set_key_block(SSL *ssl, int is_write) uint8_t client_iv[16], server_iv[16]; /* big enough for AES128/256 */ int is_client = IS_SET_SSL_FLAG(SSL_IS_CLIENT); + if (ciph_info == NULL) + return -1; + /* only do once in a handshake */ if (ssl->dc->key_block == NULL) { @@ -1138,6 +1141,7 @@ static void set_key_block(SSL *ssl, int is_write) } ssl->cipher_info = ciph_info; + return 0; } /** @@ -1251,7 +1255,12 @@ int basic_read(SSL *ssl, uint8_t **in_data) /* all encrypted from now on */ SET_SSL_FLAG(SSL_RX_ENCRYPTED); - set_key_block(ssl, 0); + if (set_key_block(ssl, 0) < 0) + { + ret = SSL_ERROR_INVALID_HANDSHAKE; + goto error; + } + memset(ssl->read_sequence, 0, 8); break; @@ -1341,7 +1350,10 @@ int send_change_cipher_spec(SSL *ssl) int ret = send_packet(ssl, PT_CHANGE_CIPHER_SPEC, g_chg_cipher_spec_pkt, sizeof(g_chg_cipher_spec_pkt)); SET_SSL_FLAG(SSL_TX_ENCRYPTED); - set_key_block(ssl, 1); + + if (ret >= 0 && set_key_block(ssl, 1) < 0) + ret = SSL_ERROR_INVALID_HANDSHAKE; + memset(ssl->write_sequence, 0, 8); return ret; } diff --git a/www/index.html b/www/index.html index ba4a7d8028..21d2b676df 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.6@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    @@ -7097,7 +7097,7 @@
    axTLS Embedded SSL
    http://axtls.cerocclub.com.au
    /***\nhttp://tiddlystyles.com/#theme:DevFire\nAuthor: Clint Checketts\n***/\n\n/*{{{*/\nbody {\nbackground: #000;\n}\n/*}}}*/\n/***\n!Link styles /% ============================================================= %/\n***/\n/*{{{*/\na,\na.button,\n#mainMenu a.button,\n#sidebarOptions .sliderPanel a{\n color: #ffbf00;\n border: 0;\n background: transparent;\n}\n\na:hover,\na.button:hover,\n#mainMenu a.button:hover,\n#sidebarOptions .sliderPanel a:hover\n#sidebarOptions .sliderPanel a:active{\n color: #ff7f00;\n border: 0;\n border-bottom: #ff7f00 1px dashed;\n background: transparent;\n text-decoration: none;\n}\n\n#displayArea .button.highlight{\n color: #ffbf00;\n background: #4c4c4c;\n}\n/*}}}*/\n/***\n!Header styles /% ============================================================= %/\n***/\n/*{{{*/\n.header{\n border-bottom: 2px solid #ffbf00;\n color: #fff;\n}\n\n.headerForeground a {\n color: #fff;\n}\n\n.header a:hover {\n border-bottom: 1px dashed #fff;\n}\n/*}}}*/\n/***\n!Main menu styles /% ============================================================= %/\n***/\n/*{{{*/\n#mainMenu {color: #fff;}\n#mainMenu h1{\n font-size: 1.1em;\n}\n#mainMenu li,#mainMenu ul{\n list-style: none;\n margin: 0;\n padding: 0;\n}\n/*}}}*/\n/***\n!Sidebar styles /% ============================================================= %/\n***/\n/*{{{*/\n#sidebar {\n right: 0;\n color: #fff;\n border: 2px solid #ffbf00;\n border-width: 0 0 2px 2px;\n}\n#sidebarOptions {\n background-color: #4c4c4c;\n padding: 0;\n}\n\n#sidebarOptions a{\n margin: 0;\n color: #ffbf00;\n border: 0;\n}\n#sidebarOptions a:hover {\n color: #4c4c4c;\n background-color: #ffbf00;\n\n}\n\n#sidebarOptions a:active {\n color: #ffbf00;\n background-color: transparent;\n}\n\n#sidebarOptions .sliderPanel {\n background-color: #333;\n margin: 0;\n}\n\n#sidebarTabs {background-color: #4c4c4c;}\n#sidebarTabs .tabSelected {\n padding: 3px 3px;\n cursor: default;\n color: #ffbf00;\n background-color: #666;\n}\n#sidebarTabs .tabUnselected {\n color: #ffbf00;\n background-color: #5f5f5f;\n padding: 0 4px;\n}\n\n#sidebarTabs .tabUnselected:hover,\n#sidebarTabs .tabContents {\n background-color: #666;\n}\n\n.listTitle{color: #FFF;}\n#sidebarTabs .tabContents a{\n color: #ffbf00;\n}\n\n#sidebarTabs .tabContents a:hover{\n color: #ff7f00;\n background: transparent;\n}\n\n#sidebarTabs .txtMoreTab .tabSelected,\n#sidebarTabs .txtMoreTab .tab:hover,\n#sidebarTabs .txtMoreTab .tabContents{\n color: #ffbf00;\n background: #4c4c4c;\n}\n\n#sidebarTabs .txtMoreTab .tabUnselected {\n color: #ffbf00;\n background: #5f5f5f;\n}\n\n.tab.tabSelected, .tab.tabSelected:hover{color: #ffbf00; border: 0; background-color: #4c4c4c;cursor:default;}\n.tab.tabUnselected {background-color: #666;}\n.tab.tabUnselected:hover{color:#ffbf00; border: 0;background-color: #4c4c4c;}\n.tabContents {\n background-color: #4c4c4c;\n border: 0;\n}\n.tabContents .tabContents{background: #666;}\n.tabContents .tabSelected{background: #666;}\n.tabContents .tabUnselected{background: #5f5f5f;}\n.tabContents .tab:hover{background: #666;}\n/*}}}*/\n/***\n!Message area styles /% ============================================================= %/\n***/\n/*{{{*/\n#messageArea {background-color: #666; color: #fff; border: 2px solid #ffbf00;}\n#messageArea a:link, #messageArea a:visited {color: #ffbf00; text-decoration:none;}\n#messageArea a:hover {color: #ff7f00;}\n#messageArea a:active {color: #ff7f00;}\n#messageArea .messageToolbar a{\n border: 1px solid #ffbf00;\n background: #4c4c4c;\n}\n/*}}}*/\n/***\n!Popup styles /% ============================================================= %/\n***/\n/*{{{*/\n.popup {color: #fff; background-color: #4c4c4c; border: 1px solid #ffbf00;}\n.popup li.disabled{color: #fff;}\n.popup a {color: #ffbf00; }\n.popup a:hover { background: transparent; color: #ff7f00; border: 0;}\n.popup hr {color: #ffbf00; background: #ffbf00;}\n/*}}}*/\n/***\n!Tiddler Display styles /% ============================================================= %/\n***/\n/*{{{*/\n.title{color: #fff;}\nh1, h2, h3, h4, h5 {\n color: #fff;\n background-color: transparent;\n border-bottom: 1px solid #333;\n}\n\n.subtitle{\n color: #666;\n}\n\n.viewer {color: #fff; }\n\n.viewer table{background: #666; color: #fff;}\n\n.viewer th {background-color: #996; color: #fff;}\n\n.viewer pre, .viewer code {color: #ddd; background-color: #4c4c4c; border: 1px solid #ffbf00;}\n\n.viewer hr {color: #666;}\n\n.tiddler .button {color: #4c4c4c;}\n.tiddler .button:hover { color: #ffbf00; background-color: #4c4c4c;}\n.tiddler .button:active {color: #ffbf00; background-color: #4c4c4c;}\n\n.toolbar {\n color: #4c4c4c;\n}\n\n.toolbar a.button,\n.toolbar a.button:hover,\n.toolbar a.button:active,\n.editorFooter a{\n border: 0;\n}\n\n.footer {\n color: #ddd;\n}\n\n.selected .footer {\n color: #888;\n}\n\n.highlight, .marked {\n color: #000;\n background-color: #ffe72f;\n}\n.editorFooter {\n color: #aaa;\n}\n\n.tab{\n-moz-border-radius-topleft: 3px;\n-moz-border-radius-topright: 3px;\n}\n\n.tagging,\n.tagged{\n background: #4c4c4c;\n border: 1px solid #4c4c4c; \n}\n\n.selected .tagging,\n.selected .tagged{\n background-color: #333;\n border: 1px solid #ffbf00;\n}\n\n.tagging .listTitle,\n.tagged .listTitle{\n color: #fff;\n}\n\n.tagging .button,\n.tagged .button{\n color: #ffbf00;\n border: 0;\n padding: 0;\n}\n\n.tagging .button:hover,\n.tagged .button:hover{\nbackground: transparent;\n}\n\n.selected .isTag .tagging.simple,\n.selected .tagged.simple,\n.isTag .tagging.simple,\n.tagged.simple {\n float: none;\n display: inline;\n border: 0;\n background: transparent;\n color: #fff;\n margin: 0;\n}\n\n.cascade {\n background: #4c4c4c;\n color: #ddd;\n border: 1px solid #ffbf00;\n}\n/*}}}*/
    -
    axhttpd is a small embedded web server using the axTLS library. It is based originally on the web server written by Doug Currie which is at http://www.hcsw.org/awhttpd.\n\n!@@bgcolor(#ff0000):color(#ffffff):axhttpd Features@@ \n\n!!__Basic Authentication__\n\nBasic Authentication uses a password file called ".htpasswd", in the directory to be protected. This file is formatted as the familiar colon-separated username/encrypted-password pair, records delimited by newlines. The protection does not carry over to subdirectories. The utility program htpasswd is included to help manually edit .htpasswd files.\n\nThe encryption of this password uses a proprietary algorithm due to the dependency of many crypt libraries on DES. An example is in [[/test_dir/no_http|https://127.0.0.1/test_dir/no_http]] (username 'abcd', password is '1234').\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__SSL Protection__\n\nDirectories/files can be accessed using the 'http' or 'https' uri prefix. If normal http access for a directory needs to be disabled, then put "~SSLRequireSSL" into a '.htaccess' file in the directory to be protected. \n\nConversely, use "~SSLDenySSL" to deny access to directories via SSL.\n\nAn example is in [[/test_dir/no_http|http://127.0.0.1/test_dir/no_http]] and [[/test_dir/no_ssl|https://127.0.0.1/test_dir/no_ssl]].\n\nEntire directories can be denied access with a "Deny all" directive (regardless of SSL or authentication). An example is in [[/test_dir/bin|http://127.0.0.1/test_dir/bin]]\n\n!!__CGI__\n\nMost of the CGI 1.1 variables are now placed into the script environment and should work as normal.\n\n!!__Lua and Lua Pages__\n\nThis is a small scripting language gaining popularity in embedded applications due to its small footprint and fast speed.\n\nLua has been incorporated into the build, so simply select it and it will automatically install. Try pointing your browser at [[test_main.html]|http://127.0.0.1/lua/test_main.html]] to see an example of Lua Pages.\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__Directory Listing__\n\nAn mconf option. Allow the files in directories to be displayed. An example is in [[/test_dir|http://127.0.0.1/test_dir]]\n\n!!__Other Features__\n\n* Timeout - HTTP 1.1 allows for persistent connections. This is the time allowed for this connection in seconds.\n* Daemon - Puts the process in daemon mode. \n* SSL session cache size - The size of the session cache (a heavily loaded server should maintain many sessions). A session will save on expensive SSL handshaking.\n\n
    +
    axhttpd is a small embedded web server using the axTLS library. It is based originally on the web server written by Doug Currie which is at http://www.hcsw.org/awhttpd.\n\n!@@bgcolor(#ff0000):color(#ffffff):axhttpd Features@@ \n\n!!__Basic Authentication__\n\nBasic Authentication uses a password file called ".htpasswd", in the directory to be protected. This file is formatted as the familiar colon-separated username/encrypted-password pair, records delimited by newlines. The protection does not carry over to subdirectories. The utility program htpasswd is included to help manually edit .htpasswd files.\n\nThe encryption of this password uses a proprietary algorithm due to the dependency of many crypt libraries on DES. An example is in [[/test_dir/no_http|https://97.74.112.97:8443/test_dir/no_http]] (username 'abcd', password is '1234').\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__SSL Protection__\n\nDirectories/files can be accessed using the 'http' or 'https' uri prefix. If normal http access for a directory needs to be disabled, then put "~SSLRequireSSL" into a '.htaccess' file in the directory to be protected. \n\nConversely, use "~SSLDenySSL" to deny access to directories via SSL.\n\nAn example is in [[/test_dir/no_http|http://97.74.112.97:8080/test_dir/no_http]] and [[/test_dir/no_ssl|https://97.74.112.97:8443/test_dir/no_ssl]].\n\nEntire directories can be denied access with a "Deny all" directive (regardless of SSL or authentication). An example is in [[/test_dir/bin|http://97.74.112.97:8080/test_dir/bin]]\n\n!!__CGI__\n\nMost of the CGI 1.1 variables are now placed into the script environment and should work as normal.\n\n!!__Lua and Lua Pages__\n\nThis is a small scripting language gaining popularity in embedded applications due to its small footprint and fast speed.\n\nLua has been incorporated into the build, so simply select it and it will automatically install. Try pointing your browser at [[test_main.html|http://97.74.112.97:8080/lua/test_main.html]] to see an example of Lua Pages.\n\n//Note: This is an mconf enabled configuration option.//\n\nThe readline development library may have to be downloaded: //yum install readline-devel//\n\n!!__Directory Listing__\n\nAn mconf option. Allow the files in directories to be displayed. An example is in [[/test_dir|http://97.74.112.97:8080/test_dir]]\n\n!!__Other Features__\n\n* Timeout - HTTP 1.1 allows for persistent connections. This is the time allowed for this connection in seconds.\n* Daemon - Puts the process in daemon mode. \n* SSL session cache size - The size of the session cache (a heavily loaded server should maintain many sessions). A session will save on expensive SSL handshaking.\n\n
    From c69b6901fb26ecfeedc7ec56c0dd6fbf0ac9157c Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 7 Aug 2010 07:34:41 +0000 Subject: [PATCH 150/301] removed redundant x509_free() in do_client_connect() git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@176 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/test/ssltest.c | 26 +++++++++++++------------- ssl/tls1.c | 2 +- ssl/tls1_clnt.c | 3 +-- 3 files changed, 15 insertions(+), 16 deletions(-) diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 32297abd1c..328bbdca3d 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1352,8 +1352,12 @@ static int SSL_client_test( /* renegotiate client */ if (sess_resume && sess_resume->do_reneg) { - if ((ret = ssl_renegotiate(ssl)) < 0) - goto client_test_exit; + if (ssl_renegotiate(ssl) == -SSL_ALERT_NO_RENEGOTIATION) + ret = 0; + else + ret = -SSL_ALERT_NO_RENEGOTIATION; + + goto client_test_exit; } if (sess_resume) @@ -1450,16 +1454,13 @@ int SSL_client_tests(void) goto cleanup; // no client renegotiation - //sess_resume.do_reneg = 1; - //if ((ret = SSL_client_test("Client renegotiation", - // &ssl_ctx, NULL, &sess_resume, - // DEFAULT_CLNT_OPTION, NULL, NULL, NULL)) != - // -SSL_ALERT_NO_RENEGOTIATION) - //{ - // printf("*** Error: %d\n", ret); TTY_FLUSH(); - // goto cleanup; - //} - //sess_resume.do_reneg = 0; + sess_resume.do_reneg = 1; + // test relies on openssl killing the call + if ((ret = SSL_client_test("Client renegotiation", + &ssl_ctx, NULL, &sess_resume, + DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) + goto cleanup; + sess_resume.do_reneg = 0; sess_resume.stop_server = 1; if ((ret = SSL_client_test("Client session resumption #2", @@ -1579,7 +1580,6 @@ static void do_basic(void) /* check the return status */ if (ssl_handshake_status(ssl_clnt) < 0) { - printf("YA YA\n"); ssl_display_error(ssl_handshake_status(ssl_clnt)); goto error; } diff --git a/ssl/tls1.c b/ssl/tls1.c index d9f147a09c..94f413b533 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -1239,7 +1239,7 @@ int basic_read(SSL *ssl, uint8_t **in_data) ssl->dc->bm_proc_index = 0; ret = do_handshake(ssl, buf, read_len); } - else /* no client renogiation allowed */ + else /* no client renegotiation allowed */ { ret = SSL_ERROR_NO_CLIENT_RENOG; goto error; diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index beb0e278b2..3289afa756 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -123,7 +123,7 @@ int do_clnt_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len) case HS_FINISHED: ret = process_finished(ssl, hs_len); disposable_free(ssl); /* free up some memory */ - /* note: client renogiation is not allowed after this */ + /* note: client renegotiation is not allowed after this */ break; case HS_HELLO_REQUEST: @@ -146,7 +146,6 @@ int do_client_connect(SSL *ssl) ssl->bm_read_index = 0; ssl->next_state = HS_SERVER_HELLO; ssl->hs_status = SSL_NOT_OK; /* not connected */ - x509_free(ssl->x509_ctx); /* sit in a loop until it all looks good */ while (ssl->hs_status != SSL_OK) From 7e570e3943ea721c1e54045a47a851915fd18dfc Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 27 Dec 2010 09:40:51 +0000 Subject: [PATCH 151/301] Fixed 3132700 (close_notify), 3078672 (regular_square), 3072881 (process_server_hello). Using Montgomery until q_dash issue solved. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@180 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/bigint.c | 61 ++++++++--------- crypto/bigint_impl.h | 23 ++++++- crypto/rsa.c | 2 +- samples/c/axssl.c | 5 ++ ssl/BigIntConfig.in | 2 +- ssl/Makefile | 4 +- ssl/asn1.c | 1 + ssl/cert.h | 56 ++++++++-------- ssl/private_key.h | 102 ++++++++++++++--------------- ssl/ssl.h | 5 ++ ssl/test/axTLS.ca_key.pem | 26 ++++---- ssl/test/axTLS.ca_x509.cer | Bin 483 -> 483 bytes ssl/test/axTLS.ca_x509.pem | 20 +++--- ssl/test/axTLS.device_key | Bin 609 -> 608 bytes ssl/test/axTLS.device_key.pem | 26 ++++---- ssl/test/axTLS.encrypted.p8 | Bin 385 -> 383 bytes ssl/test/axTLS.encrypted_pem.p8 | 17 +++-- ssl/test/axTLS.key_1024 | Bin 609 -> 609 bytes ssl/test/axTLS.key_1024.pem | 26 ++++---- ssl/test/axTLS.key_1042 | Bin 0 -> 619 bytes ssl/test/axTLS.key_1042.pem | 15 +++++ ssl/test/axTLS.key_2048 | Bin 1191 -> 1192 bytes ssl/test/axTLS.key_2048.pem | 50 +++++++------- ssl/test/axTLS.key_4096 | Bin 2349 -> 2348 bytes ssl/test/axTLS.key_4096.pem | 98 +++++++++++++-------------- ssl/test/axTLS.key_512 | Bin 321 -> 319 bytes ssl/test/axTLS.key_512.pem | 14 ++-- ssl/test/axTLS.key_aes128.pem | 16 ++--- ssl/test/axTLS.key_aes256.pem | 16 ++--- ssl/test/axTLS.noname.p12 | Bin 1483 -> 1483 bytes ssl/test/axTLS.unencrypted.p8 | Bin 347 -> 345 bytes ssl/test/axTLS.unencrypted_pem.p8 | 16 ++--- ssl/test/axTLS.withCA.p12 | Bin 2089 -> 2089 bytes ssl/test/axTLS.withoutCA.p12 | Bin 1573 -> 1573 bytes ssl/test/axTLS.x509_1024.cer | Bin 475 -> 475 bytes ssl/test/axTLS.x509_1024.pem | 18 ++--- ssl/test/axTLS.x509_1042.cer | Bin 0 -> 477 bytes ssl/test/axTLS.x509_1042.pem | 12 ++++ ssl/test/axTLS.x509_2048.cer | Bin 607 -> 607 bytes ssl/test/axTLS.x509_2048.pem | 24 +++---- ssl/test/axTLS.x509_4096.cer | Bin 863 -> 863 bytes ssl/test/axTLS.x509_4096.pem | 34 +++++----- ssl/test/axTLS.x509_512.cer | Bin 406 -> 406 bytes ssl/test/axTLS.x509_512.pem | 18 ++--- ssl/test/axTLS.x509_aes128.pem | 18 ++--- ssl/test/axTLS.x509_aes256.pem | 18 ++--- ssl/test/axTLS.x509_bad_after.pem | 18 ++--- ssl/test/axTLS.x509_bad_before.pem | 14 ++-- ssl/test/axTLS.x509_device.cer | Bin 401 -> 401 bytes ssl/test/axTLS.x509_device.pem | 38 +++++------ ssl/test/killopenssl.sh | 1 + ssl/test/make_certs.sh | 25 ++++--- ssl/test/ssltest.c | 67 ++++++++++++++++--- ssl/tls1.c | 18 +++-- ssl/tls1.h | 1 + ssl/tls1_clnt.c | 6 ++ www/index.html | 2 +- 57 files changed, 532 insertions(+), 401 deletions(-) create mode 100644 ssl/test/axTLS.key_1042 create mode 100644 ssl/test/axTLS.key_1042.pem create mode 100644 ssl/test/axTLS.x509_1042.cer create mode 100644 ssl/test/axTLS.x509_1042.pem diff --git a/crypto/bigint.c b/crypto/bigint.c index 1d95bd549d..28b3c0ca0d 100644 --- a/crypto/bigint.c +++ b/crypto/bigint.c @@ -442,18 +442,18 @@ bigint *bi_divide(BI_CTX *ctx, bigint *u, bigint *v, int is_mod) else { q_dash = (comp)(((long_comp)U(0)*COMP_RADIX + U(1))/V1); - } - if (v->size > 1 && V2) - { - /* we are implementing the following: - if (V2*q_dash > (((U(0)*COMP_RADIX + U(1) - - q_dash*V1)*COMP_RADIX) + U(2))) ... */ - comp inner = (comp)((long_comp)COMP_RADIX*U(0) + U(1) - - (long_comp)q_dash*V1); - if ((long_comp)V2*q_dash > (long_comp)inner*COMP_RADIX + U(2)) + if (v->size > 1 && V2) { - q_dash--; + /* we are implementing the following: + if (V2*q_dash > (((U(0)*COMP_RADIX + U(1) - + q_dash*V1)*COMP_RADIX) + U(2))) ... */ + comp inner = (comp)((long_comp)COMP_RADIX*U(0) + U(1) - + (long_comp)q_dash*V1); + if ((long_comp)V2*q_dash > (long_comp)inner*COMP_RADIX + U(2)) + { + q_dash--; + } } } @@ -926,55 +926,52 @@ bigint *bi_multiply(BI_CTX *ctx, bigint *bia, bigint *bib) /* * Perform the actual square operion. It takes into account overflow. */ -static bigint *regular_square(BI_CTX *ctx, bigint *bi) +bigint *regular_square(BI_CTX *ctx, bigint *bi) { int t = bi->size; int i = 0, j; bigint *biR = alloc(ctx, t*2); comp *w = biR->comps; comp *x = bi->comps; - comp carry; - + long_comp carry; memset(w, 0, biR->size*COMP_BYTE_SIZE); do { long_comp tmp = w[2*i] + (long_comp)x[i]*x[i]; - comp u = 0; + uint8_t c = 0, q = 0; w[2*i] = (comp)tmp; carry = (comp)(tmp >> COMP_BIT_SIZE); for (j = i+1; j < t; j++) { + c = q = 0; long_comp xx = (long_comp)x[i]*x[j]; - long_comp xx2 = 2*xx; - long_comp blob = (long_comp)w[i+j]+carry; + if (COMP_MAX-xx < xx) + c = 1; - if (u) /* previous overflow */ - { - blob += COMP_RADIX; - } + tmp = (xx<<1); + if (COMP_MAX-tmp < w[i+j]) + c = 1; - u = 0; - tmp = xx2 + blob; + tmp += w[i+j]; - /* check for overflow */ - if ((COMP_MAX-xx) < xx || (COMP_MAX-xx2) < blob) - { - u = 1; - } + if (COMP_MAX-tmp < carry) + c = q = 1; + tmp += carry; w[i+j] = (comp)tmp; - carry = (comp)(tmp >> COMP_BIT_SIZE); + carry = tmp >> COMP_BIT_SIZE; + + if (c) + carry += COMP_RADIX; } w[i+t] += carry; - if (u) - { - w[i+t+1] = 1; /* add carry */ - } + if (c && !q) + w[i+t+1] = 1; /* add carry */ } while (++i < t); bi_free(ctx, bi); diff --git a/crypto/bigint_impl.h b/crypto/bigint_impl.h index 1483154a41..0b76aee2d4 100644 --- a/crypto/bigint_impl.h +++ b/crypto/bigint_impl.h @@ -41,7 +41,28 @@ #define BIGINT_NUM_MODS 1 #endif +//#define REGISTER_8 1 + /* Architecture specific functions for big ints */ +#if defined(REGISTER_8) +#define COMP_RADIX 256U /**< Max component + 1 */ +#define COMP_MAX 0xFFFFU/**< (Max dbl comp -1) */ +#define COMP_BIT_SIZE 8 /**< Number of bits in a component. */ +#define COMP_BYTE_SIZE 1 /**< Number of bytes in a component. */ +#define COMP_NUM_NIBBLES 2 /**< Used For diagnostics only. */ +typedef uint8_t comp; /**< A single precision component. */ +typedef uint16_t long_comp; /**< A double precision component. */ +typedef int16_t slong_comp; /**< A signed double precision component. */ +#elif defined(REGISTER_16) +#define COMP_RADIX 65536U /**< Max component + 1 */ +#define COMP_MAX 0xFFFFFFFFU/**< (Max dbl comp -1) */ +#define COMP_BIT_SIZE 16 /**< Number of bits in a component. */ +#define COMP_BYTE_SIZE 2 /**< Number of bytes in a component. */ +#define COMP_NUM_NIBBLES 4 /**< Used For diagnostics only. */ +typedef uint16_t comp; /**< A single precision component. */ +typedef uint32_t long_comp; /**< A double precision component. */ +typedef int32_t slong_comp; /**< A signed double precision component. */ +#else /* regular 32 bit */ #ifdef WIN32 #define COMP_RADIX 4294967296i64 #define COMP_MAX 0xFFFFFFFFFFFFFFFFui64 @@ -52,10 +73,10 @@ #define COMP_BIT_SIZE 32 /**< Number of bits in a component. */ #define COMP_BYTE_SIZE 4 /**< Number of bytes in a component. */ #define COMP_NUM_NIBBLES 8 /**< Used For diagnostics only. */ - typedef uint32_t comp; /**< A single precision component. */ typedef uint64_t long_comp; /**< A double precision component. */ typedef int64_t slong_comp; /**< A signed double precision component. */ +#endif /** * @struct _bigint diff --git a/crypto/rsa.c b/crypto/rsa.c index 31627bb319..0be429856d 100644 --- a/crypto/rsa.c +++ b/crypto/rsa.c @@ -88,7 +88,7 @@ void RSA_pub_key_new(RSA_CTX **ctx, *ctx = (RSA_CTX *)calloc(1, sizeof(RSA_CTX)); rsa_ctx = *ctx; rsa_ctx->bi_ctx = bi_ctx; - rsa_ctx->num_octets = (mod_len & 0xFFF0); + rsa_ctx->num_octets = mod_len; rsa_ctx->m = bi_import(bi_ctx, modulus, mod_len); bi_set_mod(bi_ctx, rsa_ctx->m, BIGINT_M_OFFSET); rsa_ctx->e = bi_import(bi_ctx, pub_exp, pub_len); diff --git a/samples/c/axssl.c b/samples/c/axssl.c index 6892ee452b..d9d9a60711 100644 --- a/samples/c/axssl.c +++ b/samples/c/axssl.c @@ -385,6 +385,11 @@ static void do_server(int argc, char *argv[]) printf("%s", read_buf); TTY_FLUSH(); } + else if (res == SSL_CLOSE_NOTIFY) + { + printf("shutting down SSL\n"); + TTY_FLUSH(); + } else if (res < SSL_OK && !quiet) { ssl_display_error(res); diff --git a/ssl/BigIntConfig.in b/ssl/BigIntConfig.in index 04c7438c07..cace9c5687 100644 --- a/ssl/BigIntConfig.in +++ b/ssl/BigIntConfig.in @@ -8,7 +8,7 @@ menu "BigInt Options" choice prompt "Reduction Algorithm" - default CONFIG_BIGINT_BARRETT + default CONFIG_BIGINT_MONTGOMERY config CONFIG_BIGINT_CLASSICAL bool "Classical" diff --git a/ssl/Makefile b/ssl/Makefile index 62a62047dc..aafe7bc9b6 100644 --- a/ssl/Makefile +++ b/ssl/Makefile @@ -91,10 +91,10 @@ include $(AXTLS_HOME)/config/makefile.post ifndef CONFIG_PLATFORM_WIN32 # Linux/Unix/Cygwin -$(TARGET1) : $(OBJ) +$(TARGET1) : $(CRYPTO_OBJ) $(OBJ) $(AR) -r $@ $(CRYPTO_OBJ) $(OBJ) -$(TARGET2) : $(OBJ) +$(TARGET2) : $(CRYPTO_OBJ) $(OBJ) ifndef CONFIG_PLATFORM_CYGWIN $(LD) $(LDFLAGS) $(LDSHARED) -Wl,-soname,$(LIBMAJOR) -o $(AXTLS_HOME)/$(STAGE)/$(LIBMINOR) $(CRYPTO_OBJ) $(OBJ) cd $(AXTLS_HOME)/$(STAGE); ln -sf $(LIBMINOR) $(LIBMAJOR); ln -sf $(LIBMAJOR) $(BASETARGET); cd - diff --git a/ssl/asn1.c b/ssl/asn1.c index ee474f4c1e..ca2701ef3a 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -210,6 +210,7 @@ static int asn1_get_utc_time(const uint8_t *buf, int *offset, time_t *t) if (buf[(*offset)++] != ASN1_UTC_TIME) goto end_utc_time; + len = get_asn1_length(buf, offset); t_offset = *offset; diff --git a/ssl/cert.h b/ssl/cert.h index 7a85d2d843..30c7b65882 100644 --- a/ssl/cert.h +++ b/ssl/cert.h @@ -1,43 +1,43 @@ unsigned char default_certificate[] = { - 0x30, 0x82, 0x01, 0xd7, 0x30, 0x82, 0x01, 0x40, 0x02, 0x09, 0x00, 0xf1, - 0xc3, 0x87, 0xc0, 0xd4, 0xf4, 0x57, 0xc3, 0x30, 0x0d, 0x06, 0x09, 0x2a, + 0x30, 0x82, 0x01, 0xd7, 0x30, 0x82, 0x01, 0x40, 0x02, 0x09, 0x00, 0xab, + 0x08, 0x18, 0xa7, 0x03, 0x07, 0x27, 0xfd, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x34, 0x31, 0x32, 0x30, 0x30, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x29, 0x61, 0x78, 0x54, 0x4c, 0x53, 0x20, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x20, 0x44, 0x6f, 0x64, 0x67, 0x79, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, - 0x72, 0x69, 0x74, 0x79, 0x30, 0x1e, 0x17, 0x0d, 0x30, 0x36, 0x30, 0x36, - 0x30, 0x37, 0x31, 0x31, 0x34, 0x34, 0x33, 0x32, 0x5a, 0x17, 0x0d, 0x33, - 0x33, 0x31, 0x30, 0x32, 0x33, 0x31, 0x31, 0x34, 0x34, 0x33, 0x32, 0x5a, + 0x72, 0x69, 0x74, 0x79, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x30, 0x31, 0x32, + 0x32, 0x36, 0x32, 0x32, 0x33, 0x33, 0x33, 0x39, 0x5a, 0x17, 0x0d, 0x32, + 0x34, 0x30, 0x39, 0x30, 0x33, 0x32, 0x32, 0x33, 0x33, 0x33, 0x39, 0x5a, 0x30, 0x2c, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0d, 0x61, 0x78, 0x54, 0x4c, 0x53, 0x20, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x31, 0x12, 0x30, 0x10, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x09, 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x30, 0x81, 0x9f, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x81, 0x8d, 0x00, 0x30, 0x81, 0x89, 0x02, - 0x81, 0x81, 0x00, 0xd8, 0xe0, 0xbf, 0x15, 0xde, 0xea, 0xaf, 0xe8, 0xd5, - 0xfd, 0x0b, 0xa8, 0xa8, 0xb3, 0xd7, 0x46, 0x5d, 0xa7, 0x26, 0x6c, 0x0c, - 0xb5, 0xd9, 0xbc, 0xc6, 0xf8, 0xc0, 0x78, 0xd0, 0xf6, 0x56, 0x65, 0xf8, - 0x29, 0x48, 0x0e, 0x7b, 0x0b, 0xa6, 0x25, 0x7e, 0xe8, 0x7b, 0x79, 0x6f, - 0x38, 0xe5, 0xb5, 0xb7, 0xf4, 0xe0, 0x9c, 0x91, 0x60, 0xf4, 0x06, 0xf3, - 0x40, 0x1e, 0xf9, 0x91, 0x19, 0xa9, 0x2f, 0x47, 0x43, 0xb5, 0x9b, 0x1e, - 0xdc, 0xf6, 0xaa, 0x1c, 0x49, 0x79, 0x21, 0x28, 0xcb, 0xaa, 0x49, 0x73, - 0xd9, 0x09, 0x05, 0x4c, 0x02, 0xf2, 0x4c, 0x4d, 0x6c, 0x1c, 0x80, 0xa7, - 0x14, 0x91, 0x44, 0xfc, 0x12, 0xb3, 0xe1, 0xe7, 0xe3, 0x4f, 0x44, 0xba, - 0x8c, 0xc3, 0x74, 0x39, 0xe8, 0x4c, 0xd0, 0xd4, 0x4c, 0x24, 0x61, 0xb4, - 0x40, 0x95, 0x8c, 0xc0, 0x0a, 0xb7, 0x02, 0x39, 0x31, 0x85, 0x93, 0x02, + 0x81, 0x81, 0x00, 0xcd, 0xfd, 0x89, 0x48, 0xbe, 0x36, 0xb9, 0x95, 0x76, + 0xd4, 0x13, 0x30, 0x0e, 0xbf, 0xb2, 0xed, 0x67, 0x0a, 0xc0, 0x16, 0x3f, + 0x51, 0x09, 0x9d, 0x29, 0x2f, 0xb2, 0x6d, 0x3f, 0x3e, 0x6c, 0x2f, 0x90, + 0x80, 0xa1, 0x71, 0xdf, 0xbe, 0x38, 0xc5, 0xcb, 0xa9, 0x9a, 0x40, 0x14, + 0x90, 0x0a, 0xf9, 0xb7, 0x07, 0x0b, 0xe1, 0xda, 0xe7, 0x09, 0xbf, 0x0d, + 0x57, 0x41, 0x86, 0x60, 0xa1, 0xc1, 0x27, 0x91, 0x5b, 0x0a, 0x98, 0x46, + 0x1b, 0xf6, 0xa2, 0x84, 0xf8, 0x65, 0xc7, 0xce, 0x2d, 0x96, 0x17, 0xaa, + 0x91, 0xf8, 0x61, 0x04, 0x50, 0x70, 0xeb, 0xb4, 0x43, 0xb7, 0xdc, 0x9a, + 0xcc, 0x31, 0x01, 0x14, 0xd4, 0xcd, 0xcc, 0xc2, 0x37, 0x6d, 0x69, 0x82, + 0xd6, 0xc6, 0xc4, 0xbe, 0xf2, 0x34, 0xa5, 0xc9, 0xa6, 0x19, 0x53, 0x32, + 0x7a, 0x86, 0x0e, 0x91, 0x82, 0x0f, 0xa1, 0x42, 0x54, 0xaa, 0x01, 0x02, 0x03, 0x01, 0x00, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, - 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x81, 0x81, 0x00, 0x0b, - 0x47, 0x24, 0x52, 0x7d, 0xb6, 0x63, 0x78, 0xbc, 0x80, 0xdd, 0x87, 0x6c, - 0x90, 0x4c, 0x33, 0xc3, 0x5c, 0xa7, 0x97, 0x09, 0x1c, 0x09, 0x4f, 0x9b, - 0x6e, 0xb3, 0x5a, 0x3e, 0x46, 0x92, 0x1a, 0xc7, 0x87, 0x15, 0x59, 0xe1, - 0x88, 0x5c, 0xce, 0x6a, 0xe2, 0x96, 0xaa, 0x32, 0xec, 0xc2, 0xed, 0x78, - 0x8b, 0xe0, 0x90, 0x66, 0x93, 0x14, 0xc3, 0x98, 0xab, 0x33, 0x35, 0xd3, - 0x7d, 0x5d, 0x51, 0x0a, 0x9c, 0xb9, 0x10, 0x58, 0x47, 0x7a, 0x98, 0x95, - 0x64, 0xff, 0x4c, 0x5d, 0x82, 0x19, 0xf9, 0xea, 0x0f, 0x5e, 0x9a, 0xcb, - 0x32, 0x27, 0x64, 0xca, 0x6f, 0x58, 0x8a, 0xd0, 0xc0, 0x36, 0xf4, 0xb9, - 0x63, 0x34, 0xa5, 0xda, 0x36, 0x50, 0x36, 0x49, 0xd2, 0xb7, 0x3a, 0x21, - 0x33, 0x5b, 0x3e, 0xd6, 0x5f, 0x0c, 0x99, 0x83, 0xb7, 0xb2, 0xf7, 0x8b, - 0x44, 0xc4, 0x5e, 0x73, 0x41, 0xa9, 0x02 + 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x81, 0x81, 0x00, 0x40, + 0xb4, 0x94, 0x9a, 0xa8, 0x89, 0x72, 0x1d, 0x07, 0xe5, 0xb3, 0x6b, 0x88, + 0x21, 0xc2, 0x38, 0x36, 0x9e, 0x7a, 0x8c, 0x49, 0x48, 0x68, 0x0c, 0x06, + 0xe8, 0xdb, 0x1f, 0x4e, 0x05, 0xe6, 0x31, 0xe3, 0xfd, 0xe6, 0x0d, 0x6b, + 0xd8, 0x13, 0x17, 0xe0, 0x2d, 0x0d, 0xb8, 0x7e, 0xcb, 0x20, 0x6c, 0xa8, + 0x73, 0xa7, 0xfd, 0xe3, 0xa7, 0xfa, 0xf3, 0x02, 0x60, 0x78, 0x1f, 0x13, + 0x40, 0x45, 0xee, 0x75, 0xf5, 0x10, 0xfd, 0x8f, 0x68, 0x74, 0xd4, 0xac, + 0xae, 0x04, 0x09, 0x55, 0x2c, 0xdb, 0xd8, 0x07, 0x07, 0x65, 0x69, 0x27, + 0x6e, 0xbf, 0x5e, 0x61, 0x40, 0x56, 0x8b, 0xd7, 0x33, 0x3b, 0xff, 0x6e, + 0x53, 0x7e, 0x9d, 0x3f, 0xc0, 0x40, 0x3a, 0xab, 0xa0, 0x50, 0x4e, 0x80, + 0x47, 0x46, 0x0d, 0x1e, 0xdb, 0x4c, 0xf1, 0x1b, 0x5d, 0x3c, 0x2a, 0x54, + 0xa7, 0x4d, 0xfa, 0x7b, 0x72, 0x66, 0xc5 }; unsigned int default_certificate_len = 475; diff --git a/ssl/private_key.h b/ssl/private_key.h index 96a5253312..ce7985c5a7 100644 --- a/ssl/private_key.h +++ b/ssl/private_key.h @@ -1,54 +1,54 @@ unsigned char default_private_key[] = { - 0x30, 0x82, 0x02, 0x5d, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 0x00, 0xd8, - 0xe0, 0xbf, 0x15, 0xde, 0xea, 0xaf, 0xe8, 0xd5, 0xfd, 0x0b, 0xa8, 0xa8, - 0xb3, 0xd7, 0x46, 0x5d, 0xa7, 0x26, 0x6c, 0x0c, 0xb5, 0xd9, 0xbc, 0xc6, - 0xf8, 0xc0, 0x78, 0xd0, 0xf6, 0x56, 0x65, 0xf8, 0x29, 0x48, 0x0e, 0x7b, - 0x0b, 0xa6, 0x25, 0x7e, 0xe8, 0x7b, 0x79, 0x6f, 0x38, 0xe5, 0xb5, 0xb7, - 0xf4, 0xe0, 0x9c, 0x91, 0x60, 0xf4, 0x06, 0xf3, 0x40, 0x1e, 0xf9, 0x91, - 0x19, 0xa9, 0x2f, 0x47, 0x43, 0xb5, 0x9b, 0x1e, 0xdc, 0xf6, 0xaa, 0x1c, - 0x49, 0x79, 0x21, 0x28, 0xcb, 0xaa, 0x49, 0x73, 0xd9, 0x09, 0x05, 0x4c, - 0x02, 0xf2, 0x4c, 0x4d, 0x6c, 0x1c, 0x80, 0xa7, 0x14, 0x91, 0x44, 0xfc, - 0x12, 0xb3, 0xe1, 0xe7, 0xe3, 0x4f, 0x44, 0xba, 0x8c, 0xc3, 0x74, 0x39, - 0xe8, 0x4c, 0xd0, 0xd4, 0x4c, 0x24, 0x61, 0xb4, 0x40, 0x95, 0x8c, 0xc0, - 0x0a, 0xb7, 0x02, 0x39, 0x31, 0x85, 0x93, 0x02, 0x03, 0x01, 0x00, 0x01, - 0x02, 0x81, 0x81, 0x00, 0x94, 0x07, 0x72, 0xe5, 0xbe, 0xad, 0x79, 0x3b, - 0xf7, 0x33, 0x2c, 0x8e, 0x05, 0xf8, 0x1a, 0x6b, 0xd0, 0xe8, 0x91, 0xf5, - 0x16, 0x07, 0xd9, 0x82, 0x5c, 0x5c, 0xd5, 0x22, 0xa1, 0x9e, 0x42, 0x02, - 0x7f, 0x8b, 0xcd, 0xbe, 0xf4, 0x85, 0x52, 0xf6, 0x2c, 0xd5, 0x09, 0xd2, - 0x2c, 0xf4, 0x2c, 0xf6, 0x07, 0x85, 0x80, 0xf9, 0xdc, 0xd0, 0xcc, 0x3f, - 0x22, 0x31, 0x15, 0xf3, 0x49, 0xf2, 0xb5, 0xe2, 0x69, 0x99, 0x04, 0x04, - 0x49, 0x21, 0xdb, 0x9f, 0xa1, 0x54, 0x5a, 0xfa, 0xe4, 0xd9, 0xf9, 0x07, - 0x05, 0xff, 0x9a, 0x65, 0xa4, 0xeb, 0xf2, 0x47, 0xce, 0x56, 0xc7, 0x72, - 0x49, 0x48, 0x5c, 0xe8, 0x14, 0xd7, 0x8f, 0x25, 0xcc, 0x49, 0x29, 0x06, - 0x6a, 0x54, 0x7b, 0x17, 0xdc, 0x9e, 0xd4, 0x53, 0xf0, 0xf5, 0x9e, 0x85, - 0x25, 0xa1, 0xeb, 0x3d, 0xe9, 0x2f, 0xb9, 0x9c, 0xf6, 0xe1, 0x80, 0x81, - 0x02, 0x41, 0x00, 0xee, 0x02, 0x78, 0xc7, 0x78, 0x85, 0x04, 0x97, 0xcc, - 0x36, 0xbd, 0xd6, 0x11, 0xe2, 0xc7, 0x39, 0xd9, 0x34, 0x51, 0x72, 0x6f, - 0x8a, 0x0f, 0xcd, 0x88, 0x32, 0x33, 0x9b, 0xc7, 0xa7, 0x03, 0x77, 0xd9, - 0x82, 0x35, 0xb6, 0xdd, 0x1f, 0xc2, 0xc1, 0x13, 0x40, 0x83, 0x55, 0xeb, - 0x60, 0xeb, 0x81, 0x8e, 0x0c, 0x16, 0x62, 0xb4, 0xb4, 0x3c, 0xeb, 0x08, - 0x80, 0x9c, 0x79, 0xd3, 0x38, 0xca, 0xf1, 0x02, 0x41, 0x00, 0xe9, 0x45, - 0x5f, 0x2e, 0x16, 0xcc, 0x93, 0x50, 0x40, 0xb6, 0x79, 0xbc, 0x38, 0xe0, - 0x56, 0x68, 0x50, 0xd3, 0x2f, 0x73, 0x8c, 0x8c, 0x2a, 0x0e, 0x81, 0x4a, - 0x8a, 0xbb, 0xcc, 0xf0, 0x64, 0x34, 0x46, 0x9f, 0x07, 0x7d, 0x22, 0xb6, - 0xf9, 0x46, 0xac, 0x57, 0x23, 0x8c, 0x1e, 0xeb, 0xd3, 0x05, 0x4d, 0xa8, - 0x83, 0x6a, 0x67, 0xf6, 0xa6, 0xb1, 0xab, 0x8e, 0xc1, 0xef, 0xef, 0x7d, - 0xf0, 0xc3, 0x02, 0x40, 0x2f, 0xc6, 0x59, 0x3e, 0x18, 0xe8, 0x02, 0x73, - 0x01, 0xef, 0xdf, 0x0d, 0x30, 0x4b, 0xe8, 0x17, 0xa9, 0x8c, 0xc1, 0xe8, - 0x89, 0x91, 0x19, 0xf8, 0xf4, 0xa4, 0xb7, 0x0d, 0x46, 0xf7, 0x34, 0x50, - 0x03, 0x5e, 0x0a, 0xb0, 0x29, 0x14, 0xae, 0x00, 0x19, 0x80, 0x32, 0x9c, - 0xb5, 0x81, 0x9f, 0xe4, 0x42, 0x82, 0x14, 0xa0, 0x3d, 0x8b, 0x8c, 0x4a, - 0xd5, 0x4b, 0x13, 0x9d, 0xb4, 0x93, 0x4a, 0xd1, 0x02, 0x40, 0x64, 0x8c, - 0x83, 0x77, 0x61, 0x5a, 0x73, 0x11, 0x3f, 0xa3, 0xa8, 0x1b, 0x8a, 0xc4, - 0xa0, 0x5a, 0x3c, 0xa4, 0x9b, 0x2a, 0x8a, 0x65, 0x8c, 0x67, 0x4e, 0x31, - 0xac, 0x55, 0x41, 0x04, 0x49, 0x9d, 0x02, 0xe7, 0xdf, 0x99, 0x7f, 0xd2, - 0x30, 0xe6, 0xd6, 0xb8, 0x84, 0xd9, 0x0c, 0x27, 0x08, 0x81, 0x9b, 0xb4, - 0xcc, 0x58, 0x9c, 0x51, 0x84, 0x0e, 0xc7, 0x6d, 0x34, 0x89, 0x50, 0xc9, - 0x0f, 0x73, 0x02, 0x41, 0x00, 0xda, 0xde, 0x5e, 0x1a, 0xac, 0x1d, 0x1d, - 0xd7, 0xb9, 0x65, 0x26, 0x00, 0xf5, 0xd4, 0xe4, 0x28, 0x84, 0x86, 0x2f, - 0x00, 0x9c, 0x41, 0x00, 0x52, 0xe1, 0x47, 0x91, 0xc0, 0x52, 0x05, 0x4e, - 0x0f, 0x2f, 0x0d, 0xca, 0x9b, 0x3d, 0x89, 0x41, 0xbf, 0xee, 0x9f, 0xa1, - 0xe6, 0x9d, 0xa4, 0xeb, 0x45, 0x7f, 0xe3, 0xcb, 0xa4, 0x6b, 0x0a, 0xe2, - 0x7e, 0xb0, 0x87, 0x5c, 0x40, 0xb1, 0x51, 0x11, 0x1d + 0x30, 0x82, 0x02, 0x5d, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 0x00, 0xcd, + 0xfd, 0x89, 0x48, 0xbe, 0x36, 0xb9, 0x95, 0x76, 0xd4, 0x13, 0x30, 0x0e, + 0xbf, 0xb2, 0xed, 0x67, 0x0a, 0xc0, 0x16, 0x3f, 0x51, 0x09, 0x9d, 0x29, + 0x2f, 0xb2, 0x6d, 0x3f, 0x3e, 0x6c, 0x2f, 0x90, 0x80, 0xa1, 0x71, 0xdf, + 0xbe, 0x38, 0xc5, 0xcb, 0xa9, 0x9a, 0x40, 0x14, 0x90, 0x0a, 0xf9, 0xb7, + 0x07, 0x0b, 0xe1, 0xda, 0xe7, 0x09, 0xbf, 0x0d, 0x57, 0x41, 0x86, 0x60, + 0xa1, 0xc1, 0x27, 0x91, 0x5b, 0x0a, 0x98, 0x46, 0x1b, 0xf6, 0xa2, 0x84, + 0xf8, 0x65, 0xc7, 0xce, 0x2d, 0x96, 0x17, 0xaa, 0x91, 0xf8, 0x61, 0x04, + 0x50, 0x70, 0xeb, 0xb4, 0x43, 0xb7, 0xdc, 0x9a, 0xcc, 0x31, 0x01, 0x14, + 0xd4, 0xcd, 0xcc, 0xc2, 0x37, 0x6d, 0x69, 0x82, 0xd6, 0xc6, 0xc4, 0xbe, + 0xf2, 0x34, 0xa5, 0xc9, 0xa6, 0x19, 0x53, 0x32, 0x7a, 0x86, 0x0e, 0x91, + 0x82, 0x0f, 0xa1, 0x42, 0x54, 0xaa, 0x01, 0x02, 0x03, 0x01, 0x00, 0x01, + 0x02, 0x81, 0x81, 0x00, 0x95, 0xaa, 0x6e, 0x11, 0xf5, 0x6a, 0x8b, 0xa2, + 0xc6, 0x48, 0xc6, 0x7c, 0x37, 0x6b, 0x1f, 0x55, 0x10, 0x76, 0x26, 0x24, + 0xc3, 0xf2, 0x5c, 0x5a, 0xdd, 0x2e, 0xf3, 0xa4, 0x1e, 0xbc, 0x7b, 0x1c, + 0x80, 0x10, 0x85, 0xbc, 0xd8, 0x45, 0x3c, 0xb8, 0xb2, 0x06, 0x53, 0xb5, + 0xd5, 0x7a, 0xe7, 0x0e, 0x92, 0xe6, 0x42, 0xc2, 0xe2, 0x2a, 0xd5, 0xd1, + 0x03, 0x9f, 0x6f, 0x53, 0x74, 0x68, 0x72, 0x8e, 0xbf, 0x03, 0xbb, 0xab, + 0xbd, 0xa1, 0xf9, 0x81, 0x7d, 0x12, 0xd4, 0x9d, 0xb6, 0xae, 0x4c, 0xad, + 0xca, 0xa8, 0xc9, 0x80, 0x8d, 0x0d, 0xd5, 0xd0, 0xa1, 0xbf, 0xec, 0x60, + 0x48, 0x49, 0xed, 0x97, 0x0f, 0x5e, 0xed, 0xfc, 0x39, 0x15, 0x96, 0x9e, + 0x5d, 0xe2, 0xb4, 0x5d, 0x2e, 0x04, 0xdc, 0x08, 0xa2, 0x65, 0x29, 0x2d, + 0x37, 0xfb, 0x62, 0x90, 0x1b, 0x7b, 0xe5, 0x3a, 0x58, 0x05, 0x55, 0xc1, + 0x02, 0x41, 0x00, 0xfc, 0x69, 0x28, 0xc9, 0xa8, 0xc4, 0x5c, 0xe3, 0xd0, + 0x5e, 0xaa, 0xda, 0xde, 0x87, 0x74, 0xdb, 0xcb, 0x40, 0x78, 0x8e, 0x1d, + 0x12, 0x96, 0x16, 0x61, 0x3f, 0xb3, 0x3e, 0xa3, 0x0d, 0xdc, 0x49, 0xa5, + 0x25, 0x87, 0xc5, 0x97, 0x85, 0x9d, 0xbb, 0xb4, 0xf0, 0x44, 0xfd, 0x6c, + 0xe8, 0xd2, 0x8c, 0xec, 0x33, 0x81, 0x46, 0x1e, 0x10, 0x12, 0x33, 0x16, + 0x95, 0x00, 0x4f, 0x75, 0xb4, 0xe5, 0x79, 0x02, 0x41, 0x00, 0xd0, 0xeb, + 0x65, 0x07, 0x10, 0x3b, 0xd9, 0x03, 0xeb, 0xdc, 0x6f, 0x4b, 0x8f, 0xc3, + 0x87, 0xce, 0x76, 0xd6, 0xc5, 0x14, 0x21, 0x4e, 0xe7, 0x4f, 0x1b, 0xe8, + 0x05, 0xf8, 0x84, 0x1a, 0xe0, 0xc5, 0xd6, 0xe3, 0x08, 0xb3, 0x54, 0x57, + 0x02, 0x1f, 0xd4, 0xd9, 0xfb, 0xff, 0x40, 0xb1, 0x56, 0x1c, 0x60, 0xf7, + 0xac, 0x91, 0xf3, 0xd3, 0xc6, 0x7f, 0x84, 0xfd, 0x84, 0x9d, 0xea, 0x26, + 0xee, 0xc9, 0x02, 0x41, 0x00, 0xa6, 0xcf, 0x1c, 0x6c, 0x81, 0x03, 0x1c, + 0x5c, 0x56, 0x05, 0x6a, 0x26, 0x70, 0xef, 0xd6, 0x13, 0xb7, 0x74, 0x28, + 0xf7, 0xca, 0x50, 0xd1, 0x2d, 0x83, 0x21, 0x64, 0xe4, 0xdd, 0x3f, 0x38, + 0xb8, 0xd6, 0xd2, 0x41, 0xb3, 0x1c, 0x9a, 0xea, 0x0d, 0xf5, 0xda, 0xdf, + 0xcd, 0x17, 0x9f, 0x9a, 0x1e, 0x15, 0xaf, 0x48, 0x1c, 0xbd, 0x9b, 0x63, + 0x5b, 0xad, 0xed, 0xd4, 0xa1, 0xae, 0xa9, 0x59, 0x09, 0x02, 0x40, 0x4e, + 0x08, 0xce, 0xa8, 0x8f, 0xc0, 0xba, 0xf3, 0x83, 0x02, 0xc8, 0x33, 0x62, + 0x14, 0x77, 0xc2, 0x7f, 0x93, 0x02, 0xf3, 0xdc, 0xe9, 0x1a, 0xee, 0xea, + 0x8e, 0x84, 0xc4, 0x69, 0x9b, 0x9c, 0x7f, 0x69, 0x1f, 0x4e, 0x1d, 0xa5, + 0x90, 0x06, 0x44, 0x1b, 0x7d, 0xfc, 0x69, 0x40, 0x21, 0xbc, 0xf7, 0x46, + 0xa4, 0xdc, 0x39, 0x7b, 0xe8, 0x8b, 0x49, 0x10, 0x44, 0x9d, 0x67, 0x5a, + 0x91, 0x86, 0x39, 0x02, 0x40, 0x41, 0x2c, 0x4e, 0xfe, 0xd9, 0x90, 0x89, + 0x00, 0x5c, 0x94, 0x0a, 0x4a, 0x7e, 0x1b, 0x1a, 0x80, 0x06, 0x01, 0x37, + 0xda, 0x50, 0x61, 0x9d, 0x9c, 0xfe, 0x25, 0x7f, 0xd8, 0xd4, 0xc4, 0x9e, + 0x81, 0xf2, 0x0c, 0x1e, 0x38, 0x21, 0x1e, 0x90, 0x3f, 0xd4, 0xba, 0x6c, + 0x53, 0xcb, 0xf0, 0x77, 0x79, 0x9b, 0xf1, 0xfa, 0x3f, 0x81, 0xdc, 0xf3, + 0x21, 0x02, 0x6d, 0xb7, 0x95, 0xc3, 0x2e, 0xce, 0xd5 }; unsigned int default_private_key_len = 609; diff --git a/ssl/ssl.h b/ssl/ssl.h index bde6b68656..6b3654d558 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -88,6 +88,7 @@ extern "C" { #define SSL_OK 0 #define SSL_NOT_OK -1 #define SSL_ERROR_DEAD -2 +#define SSL_CLOSE_NOTIFY -3 #define SSL_ERROR_CONN_LOST -256 #define SSL_ERROR_SOCK_SETUP_FAILURE -258 #define SSL_ERROR_INVALID_HANDSHAKE -260 @@ -105,6 +106,10 @@ extern "C" { #define SSL_X509_OFFSET -512 #define SSL_X509_ERROR(A) (SSL_X509_OFFSET+A) +/* alert types that are recognized */ +#define SSL_ALERT_TYPE_WARNING 1 +#define SLL_ALERT_TYPE_FATAL 2 + /* these are all the alerts that are recognized */ #define SSL_ALERT_CLOSE_NOTIFY 0 #define SSL_ALERT_UNEXPECTED_MESSAGE 10 diff --git a/ssl/test/axTLS.ca_key.pem b/ssl/test/axTLS.ca_key.pem index 7c8ac8af28..bd4f3241e5 100644 --- a/ssl/test/axTLS.ca_key.pem +++ b/ssl/test/axTLS.ca_key.pem @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICWwIBAAKBgQCnZdk20fYWh8O6kDTt0AuJWyp0YIrb7W1UNNMPXI5wA4J59IVj -Nmk5wocm9+Hqzbg7rORAN/mHPBhzLAjhnm1HODs36hW15DtbDkkH4wCM/Tsyv79m -n0xq1V6peK3t9vi2D4p/IRjHkYR2jm+BeknopijhY0kHHfpGTHa2DnVirwIDAQAB -AoGAd4Ia5SxYiBU9A0BYyT8yPUm8sYELIaAL4YYk+F6Xwhh/Whnb8MyzquzaGFP4 -Ee30jYYNHlvX5VheDDtvy8OTN5FgKNNdzvW15iA4Hxje04ZI7W87G7OIxm7aYRid -sG4XqZBtsOdj33IRd9hgozywGJ2qRqS6nn2KxRv1w07RniECQQDZAlKxijdn+vQ7 -8/8mXzC+FwQtzeTUCuLrBJcos9I/591ABoxYkWcYLxpFqgCEVwb1qfPBJkL07JPt -Fu6CTnBFAkEAxXmUBs47x5QM99qyBO5UwW0Ksrm/WD4guaaxzQShMt/HzgJl613z -/x4FtxiQJHAr6r2K0t5xTJx89LVKuouYYwJAImue6DAvJ5wDfzrtXo28snn+HLHK -uONdKL/apgcXszE4w74GJsoxWwGlniUf3d3b6b1iP2GtPyIDOJjpjduZLQJAE4jS -VtYB3d1MZxxQLeKxqayyuTlcr0r+C79sqT5C//hZGIzuLhlOMLd0k0cvwxsBjSgQ -2ok8pfp49fAVI1z5xwJAVmJgLc/mSti5A2q3c8HW8qvMJEDPWbpb7p8pg4ePtpa8 -EE3TO4O4J2H+k40C397km4yZXdkNQsiT1zVljJZpiw== +MIICXQIBAAKBgQCfxX6VHEhZNsMIqPPxt53h1UpfX1jU7ctqwBR4dpWRj3H6cCBN +EK8xj7IVcBTJq6vcMRDwrAUrElSIZl8Kv6+ZqhTss2j+E2tfzkzehP9LcAdAR+UM +JPBsYXic/+vmH5JCMO7CXLUsDJmO2q2Z1TjTtchu2DgAueTo0hWRtMvbMwIDAQAB +AoGARYOF+ZZenAJJhSENUiPTm4hTXX98hNgZYw7DWU4u8S/6JT5Xr3AM6YFduBoV +0VDR63GlrzEI5p6JDPeNbn3MBl14ZNZVOOkzenxsCsymCHKhickxR8VlRoN26Xpb +OcMxsnEOJ8zh0F97Re8bsE7OQhk4Z7KtArby2jY1bpSqkRECQQDQ0D9lIq0oINaS +Uezmj/eSlmRjUwF+Vx8t16Yu8mD8CJZUVBEhDn/Xo2GWlkFgbWUoAPanr8zAwKJX +6gImgMVPAkEAw+AxIgMqxs0GmsiesQMPe3Rf5kRId7ApFdhCq15J4URGOTdnyIUj +LBzJpGSiQFb/Fkt5dGrsDzawFd7hlBCa3QJAcWJCqiX0JDAAkx8NJfzSj7Q9+njd +/L5N3dSVFjTiWLhI+K1VR7/ZxzueB+i6wyNjpB8xz8fzxE5VWKtmU4XknQJBAKW+ +K/UK1wR3cnJA9j70RwKA27D98JAOaQWKBAf79en+mqlJn7EGL1fhWCKZ4M0ukBSu +cqw22V6aOO+YtCpUzqUCQQCapy9lw3tDuCAljW8H3p9ce/+wuK1FTnF0TCalgHQp +kn4btRLmj0josAj4lRrzi2uaYfwq39h9OIuy7ES7YKcv -----END RSA PRIVATE KEY----- diff --git a/ssl/test/axTLS.ca_x509.cer b/ssl/test/axTLS.ca_x509.cer index 9c9936b8e98d0b7475e522377e64ee5cb7d9858c..05d1ad10e1bd0f155922ab5c073dc63421fbbbe6 100644 GIT binary patch delta 341 zcmV-b0jmDv1LFe|FoFT!FoFR{0to>7=qD=NDmSW;6Gt>EtE=2G5b&%8D-u+QW?u@wubHY8?6YY86Kh}2Ox}e5OK=B3N97D8@N8jt zod4_QACf{a?!sKPEDV{B+O3(@IMcPrZrC^gx#Z~56_K>d+kZ0x0|5X5FbxI?Duzgg z_YDC71qA>Dfq?)T2~$RpF*+Pnvs-bFEp7UXa!sfLf6i7hw5R_m7=m+^QjWEr`esUp zA-5Maqh*3M^819hNAA9wMjW3)Rc%;1c-<|qIZOvm7|2$G_mKGPp);5{GU15!o}xHP nYt>EtrOAv{*BUt|tW_5@KbF2Rv4QR2q?~OsgvJw*G$qZ&H4&89 delta 341 zcmV-b0jmDv1LFe|FoFT!FoFR{0to<}ZgV)MI;C2X6GDfq?)W3xL`*peHaQC%L9rFu+`!L(F~VuAbis-81tk-U!?PR>rx=X`^>v z7F66sjS9#_Ti&fqR};+Q$KUpJ`w`LA$ggbk@)MB#opCapepcK}N6A!&jPSjWIYk=Qp=vJ9j$jvG#da=72kmR)cHplrHGX$ diff --git a/ssl/test/axTLS.ca_x509.pem b/ssl/test/axTLS.ca_x509.pem index 86f659710c..ce03a20512 100644 --- a/ssl/test/axTLS.ca_x509.pem +++ b/ssl/test/axTLS.ca_x509.pem @@ -1,13 +1,13 @@ -----BEGIN CERTIFICATE----- -MIIB3zCCAUgCCQCdbnM4pjqlWjANBgkqhkiG9w0BAQUFADA0MTIwMAYDVQQKEylh -eFRMUyBQcm9qZWN0IERvZGd5IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0wNjA2 -MDcxMTQ0MzJaFw0zMzEwMjMxMTQ0MzJaMDQxMjAwBgNVBAoTKWF4VExTIFByb2pl +MIIB3zCCAUgCCQD76Ccq3Co3qjANBgkqhkiG9w0BAQUFADA0MTIwMAYDVQQKEylh +eFRMUyBQcm9qZWN0IERvZGd5IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xMDEy +MjYyMjMzMzdaFw0yNDA5MDMyMjMzMzdaMDQxMjAwBgNVBAoTKWF4VExTIFByb2pl Y3QgRG9kZ3kgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUA -A4GNADCBiQKBgQCnZdk20fYWh8O6kDTt0AuJWyp0YIrb7W1UNNMPXI5wA4J59IVj -Nmk5wocm9+Hqzbg7rORAN/mHPBhzLAjhnm1HODs36hW15DtbDkkH4wCM/Tsyv79m -n0xq1V6peK3t9vi2D4p/IRjHkYR2jm+BeknopijhY0kHHfpGTHa2DnVirwIDAQAB -MA0GCSqGSIb3DQEBBQUAA4GBAB0LgNo0oCcwIie5plgwwFybQ8x95q6e3wndM/Mp -3gjcAFbGuchpo3dfFlTcRI0KyERb3q1MVxPM4sff9nT7EdHVyK9s8/ITkP2dcTKc -flbcTEfJVIeM8L2P5F41Hvn9GuGcMW8EmsC06gdbp1LLnqsdrXdMNBsAUBXfgPrU -+UcZ +A4GNADCBiQKBgQCfxX6VHEhZNsMIqPPxt53h1UpfX1jU7ctqwBR4dpWRj3H6cCBN +EK8xj7IVcBTJq6vcMRDwrAUrElSIZl8Kv6+ZqhTss2j+E2tfzkzehP9LcAdAR+UM +JPBsYXic/+vmH5JCMO7CXLUsDJmO2q2Z1TjTtchu2DgAueTo0hWRtMvbMwIDAQAB +MA0GCSqGSIb3DQEBBQUAA4GBABoJU0aQMTocVLNbcY4tbfqLck2oAn/OVjG0p/8p +GIJzlVKOtZ76ZkqHIbcXNKNlgjXy+4S3R+6+mkYcn0JVbVg7eN0tsDlMB04YyFaD +95D47KEzmDky4Yj2nqI4SmvVTf2lyYxV1zknrFUXND+WvjGxge3gpJxtMoTGE5E0 +Jc3F -----END CERTIFICATE----- diff --git a/ssl/test/axTLS.device_key b/ssl/test/axTLS.device_key index 4e981d143e1383828b8a76e18c57e0b0f59b202f..72a173429661c54bafaf35ebdba5a9a96cae5820 100644 GIT binary patch literal 608 zcmV-m0-yabf&yFu0RRGlfdI$Yu-g3!&RpWhvZBIkBv`Y)DwSzu_af7@f>p-pfh5{E z(L4t750a~*;kA%J54%}t&sUBDBGw^eb61K0v04zSb5EL5^m87c1yEU#M1o~&Hv9_`lwbHJ61=&H?7gQEfi0RRC4fq-Xb zsnZm^Bb*V&i<$)p6s<&x?^BUYsYO1{mE|?x8E@?E8tr)&gOWP-GTf7YVdQAle)?%b zm#w{K%!Uo5U>-Bb>d79OrtrefCHVs&m3a$8WRvR~jHs`6U9!& z(;$2m=b}w&oDumzsw#8DI5GDLxr*+0jCL7$M>P?H}x=B54Y8-Vj_Y$;Xk z0zf>>H`GU-GZli>S7o%ZOvVolNk%4?iUVCRQuQLP_OXJ~PFdfKXply*)@~;C5OEj; zemPV}3q0l$owlec2&)1>Ss=`0b1eF`?!Qrz?t6=uoGm*L{W*t}O@2Po;sTY0j-+f& z5k%7U0kBczV6G&kf!$rU)|=gOniXJ+e)n_50zm-VmU|#fVsk?VE#v#|&6;9_gVbJ$ uytH*a@JRQ%ppu`vA77wv5~Q()oO_8u>ciBD00{qvxuLOHOl(&(@wR&t+-Ic-(fn!L=2LAE_OnV2@ezYPqfv?7EVw ztnGa>p_(hpRr+n(N$Ooc;-Ug;rmFgzfA1^_2-*k;^0%11vl#+G0M`^95MJ-`(OR-i zBA|9yFh78sA*+l|0wMujX*I%@o4%O>ok-BGDtQP3_l0oh2@5c16ixpA!QhEf#zLZF zQvyK%tS>_pbrT+q^2G&mI(6scS|AxC&V>TLsLms2K>j$f{xgTlW2bz`iWbV^SZp~M zSQa|OOK(li0kpVqV}#k^0zZ3z5inI#a)-o>oxVh6us#Gh)Z2ij5G5&LpFzr;@!ous zU+nPW;~#)v8B_>M%wA;5u?2*padHnE!MbMQTY+(0Wgg|0 v3cKQF;e2bA5N6M*E~R!7Tl|5&J97n<934}R7|5Rx8jwm@UwAr_9k^bwbVnG3 diff --git a/ssl/test/axTLS.device_key.pem b/ssl/test/axTLS.device_key.pem index 2bcf5e37b3..3c28265475 100644 --- a/ssl/test/axTLS.device_key.pem +++ b/ssl/test/axTLS.device_key.pem @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXQIBAAKBgQDUIg4NEiu/diDAlbsWbTAhMKw4iBf2X5ohGJdTO6vhGQdEkhBR -Bgzdl9+0LbVDJY8YStUghwnuztT+IpNCrUtXtRK8Cn3QP+buzSe2ZGPVoEJIbvV/ -QudK/WuUDyTNSRTtW4S3RO36KqtbT6xh1QGTXV3I8sp7qwmcysklqZW8GwIDAQAB -AoGBAKBEDkuPw9+Ftp7pQIxj963LoQGgyEHJ3p9Mfd9TQLrydsw2cf9Uy9mKiWcN -9VkCgkZ/Gt/VRgrW1pIduxXv6O+8S14An+2mTayy3Ga1N6MulD7OHQP9kqR4j8TT -xaYPR/1skjhQ+Y0Uw4NEa3OkQp6lAUEp1aVX/mTfIZBguaUxAkEA/H543Ha6wbUV -iB+pHaBgj1nzarmuEey6kqqs7X0zoZory1X6bdpJ6l0/4qICa6aq+pt/7ywJCNoI -CPK3mL2zGQJBANcUHRBe7/HRWrJNIqB2WDA/gJshq4xOAiIBXWk1wpabvpkCnUjQ -rip5CAL3hXDnCQswZxRN/v7B4IlSxkKiY1MCQQCsL0MUdRMejfLFBXI6defjWiAZ -I86FAr6oziNnQP44sf4zh8pjp3zIihbK4lhsORhYFjrES29NzgG0uHBjhNnhAj97 -gBEwVVNyh8SMnb5EZbA+BDjU24CmECUpYZ9Bypzx3nyTX+zw4uMfgGAZVAhLzF5l -DmYiQqcpoipMsDsoCBcCQQCxBYSicXIPG8G6ZuFbgXFcZR7llgq74mbhfGuVEGbP -qS6ldhJb/IG9O3MFlRwdU44YyJ8QGpBKWF94OpIduF6w +MIICXAIBAAKBgQDH2LDa/QrOXOLHsqLCayRYs74qlWlk9yLTtIJVxumBJNo40TwG +8g+Sq6LhtZBAD7tZaM9XjgIi1iFjc1eKALFaEKpzT5pS9HM0mK48bgwO4DV0gbvC +t1LlwfEC1EkXgoMDumZwF0bpoKldLK9ayp6sXOYe7dcBc8CVjOiqzVCDowIDAQAB +AoGAZ2ap0xS8I5wRxouaBQgUrUSK71ORTalFPs6V5TXfGW/s7RrteRaDkjr2MtyT +f2HkaNV++mlCl629ZsyGDaRgHjPI6skemqbwws4l+QMglXkLQ2ST6xuMqrNlCaKN +Ys0l291VftlS6Bi/C/LD3bwMf6HTGThufchmQ87OvXYtNQkCQQD1jC5jypbk+Ilc +X4aGXaOSsyzrf3QblhPFTsXTIHwV56JNap5D1405LUeH9XvAca+EZyYAg0N/pOXB +rkSXww3PAkEA0Fp8+/zDI00liFOEud2hQ0A/VCqg0+SyCVGvA7AFnuXEURPbMkSB +ktk/x4BBn5DZUJMfOOal/ewbgPNqbClV7QJAPMw31EeeMxWC1VdltLFMxg8NSUYm +looDXTBS9SKu9rGC005Z34xokEaw1m4m9RBxGAR+OVRHCzzmEp22qCkIqwJAWSDM +ZHMs+rXuv1GS7nuLl5wtOxD9OYeUTX4+0uIClYWOpGxNEUTS9QGwUeRgriSlgd1d +ttab3XKaFWCLfvdzxQJBANuWeyBMYnNDBi3j++/NmmKEg9Reiby0dT3wSPe6oJKf +ux9foG8SpLGGnHuJQerD1IkACP+GuaGxWUxsVzPxtns= -----END RSA PRIVATE KEY----- diff --git a/ssl/test/axTLS.encrypted.p8 b/ssl/test/axTLS.encrypted.p8 index 8b0a7eb4117de421cfb917de7f03055fdfe2c28f..446a857dcb3631484bfe05348e438d5032340eef 100644 GIT binary patch literal 383 zcmV-_0f7E6f&qIl90m$1hDe6@4FL=R0Wb~(2(`xmEt!n?jsgM*00e>oSwg|2ApUKXo} zvsi(r<-qWv1&~+-?YEL`nF;)bGOWxB}wuSJav@GEg)}7Yjl+S_#gX$M&)Zhh~UPVHaQx!o3rNp1H_lgKN@v z!1}jkcy{w2d3f#&!=8zT;bkYTYfnk|7fE=x83jHeJT>mn+p7+N9MTpNTptIgp3@++ z#M`|+u70D3RvoTecB0S5Ch{ zHl7H=qA4HIOB;)ah$8h!;8it(u3j>D`liQs0*+k*%XW@PAMoO|ZVtaORrZR~IdUoh zNf*1NZ0jCJOsIuor2OuhY5SBS)gmT$Plt&Ub|ujkSvY}HF3T6ZV$+;=Cj1_ zqiV0Xy#~l}wq>xTcs~vcY@+sZ^yo(jDeDIm8}2%S8s3H&bnWkZz@9kPK8*&28D$i9 z3|2M?_7i99)`(fX3rvXr@m91pnk>4N^QQR5XPP=(qj)V!5qKV+KU4NR01UFqcL=0O z)N0{uLA$ f>0oNt1g(0Zzb?&!uhc`Lu&kDME*dK^i&ZfFoN%%v diff --git a/ssl/test/axTLS.encrypted_pem.p8 b/ssl/test/axTLS.encrypted_pem.p8 index 19ca3c5eae..b059096a36 100644 --- a/ssl/test/axTLS.encrypted_pem.p8 +++ b/ssl/test/axTLS.encrypted_pem.p8 @@ -1,11 +1,10 @@ -----BEGIN ENCRYPTED PRIVATE KEY----- -MIIBfTAcBgoqhkiG9w0BDAEBMA4ECN+YmhCv0ILdAgIIAASCAVu0QEfMkp0xUsNq -0Ek4Nsa/uxcs8N/2P7Ae7qCakkvsdRvvPPH0y+wuj5NgrG6WpPeeEx9fI2oNNTfC -pwncH0Xm99ofVrgMX6XC45LDZtzXNSZd4TdBP6xvlYXbuGegp5GPJ8emzscHCFhC -JfPHemRAcB7DhiWukPosuSUr5R8OluEMJrQLHuQtlDAvMjLEI98lSchPxF8LKCk3 -SS2uCcmc+4WiR0nHG9BOaGi38+PytHAnbfo1mfVSQzLfgLicMAVGysfQ9QOgpQOO -ygYfM/s7Duwbl0rshyXVJP+7BpYJnPtHvO4BTiizU7ZEr4WBiEnnANDrupSdsxeH -+cxZo70YJVdoPdgMd2ke6EIkUhp7HughFg+okldlEtJA4muKeEzwAxZu0TqxOtZ8 -UYRS4Ygk+rN7Y0qTKSYwSkrFBwUDkpctYjRUOeAZ/mYMKWmMn1ejAb5Is7bjEIxl -tw== +MIIBezAcBgoqhkiG9w0BDAEBMA4ECEHizqvZwHfYAgIIAASCAVkWuzUFR3hk3vXG +BoX1ULCIr+Om40+UkD0T/Vxl8zo6Vuvl13vAYqo2eDSNd75yKpYle0gSHn+aVeWZ +gKYrmpSqXF14CDeBXAd2GRwun9EIAwgkv9AMMPGzCXVTVFM/pLyuLexj283qvZf5 +/7Fe/cizYx/DxtiRw9QUsNWYckt3RAM6i87PTBw8uI7NqEMEkstHT51l5TR85JjL +F8ZYSuqv9LH/jkWhoedgID35r+ffjeYV06clebuRJAIcS78LG8833D1SyINlnj4y +Ts2NYf2R4CtR0rDJeDCcucDBnzPPIBv4JqsbUGDTMrlFIGJvmL4RuNP3TNIAk9tZ +FHw2QEBrcv6XNQa8DJwk/162CdDxQG5uWc/Ye4hF5OXzAd6gxKz8u6C3wCq0q3+b +PDc9wulGEejbL/lecZ7qT76CqYLupNmCBFAa8idGjAhU3LDwv4ooGF1aWFiGgG4= -----END ENCRYPTED PRIVATE KEY----- diff --git a/ssl/test/axTLS.key_1024 b/ssl/test/axTLS.key_1024 index 5b6ba1d037b002b0d62c9903a3582daac05f77e2..92429c236606819f460535cddd3c1c1a2386ea7e 100644 GIT binary patch literal 609 zcmV-n0-pUaf&yIv0RRGlfdI|@iAcUSxs`U*6EF_Hvh8OIz!pDI37sh~vTZ*;Y%h?2 zp>f~7IK|7Unm`ng3i-DO3*p-53BL_jL55(V!6%Vh3YbP4_M(LNWyj7fmKUm#_+bQ4 zaO<=~x7?b{F##0R&CJ3#ZE1qm#>BqzG^NR=8B;QPh7OT}51~R-ssRE60RRC4fq?*( zs%{bWYKx-ANXC3OYadk*b|xgl@?2WoF7u=wyn7sg5QV(hMLf8&22-`wdgl(3=0d{a zD%H^gpKnuiXmXCf1G}req4|M*64afxu1u}UsL6nh4b{-0zwBU0N$r;pUhVuj6_%b| z;++|D9NbAT;tGQs@mR%blb~7c#a(smKI?@ zvp%B@+)1S+hsBqLox8N~MEz{&(v0jgfkqw>5;GQ+08e$a<#_@@0MP4Y2M{~i1MA#x zOOL~c&UV(t6d_LMPaEh3_=FnZ#n$5pvs70CAJp0V|3I-;9ANjXk@M5We}w&no$4m; z$pS$Drq3K~fdd>|Rt0J%aPQU=w{$4?%23fQgCS((-9I?E*3v<<9GdD4_1fRf7oVCQ z6|YDfy_;iOt?ksIuBllG0zgg(&Zv*Ty7Pkq$TMOTcfx;@0`uJI8t&?jgv4o^oPTK_ zP93F?21FZu{AoZTy!S?=+&O#bi%Aefoo8B+hB*R2K`c)G*^r3o+(m=R>yKlNL=U?*N-L4NhtAFS(rd;edexK>+Roc*l5!1eeSb!19#biHMZR!!od?jgH`Kb>w%687GkutJnIO6oO#nY%JBk00O>_vE*8v_P(ZeM zyg1-iXi(EHbBv5C4uMLFyUg%pG)A8XeImB`MyyvOj2`RL1x=`fYG?MQv8#^3@9%x^ z!va7r##ufX=mK*A@81nDOXwG=jKS!Mks0{(q_+)5_cTxgUJ9@&6s`anfHIu5fuH0; zf)t=Vi;POuOB0>6lS5QhO; z8qBI0RM83|U-=XI+xdFHUJ40B(Z7#+LIL#}|29=c>WC12&1r>)F`kV&6u0I8 zb>ybJBs6_$^aUkav=3ux7hJ5O5vroQ!O@+4A`#Z~ci3l%0XPTz=c+>jLIJV=4ZCl+brIt;Q0bd|4=E zh37lQ64&|$`u_T>xj@1Ber<_56JlQiLIBxfv-kO(!4+vZ^Q({ISY>$x%$v3bG!^DD zb$^Q_#GxdZIfj+0i zZ9xe&&HxrlgMp<(vyQfEK4pN=vaC{HV-MVa$Q{tL6 zL?N0-7uT#hjhlbegc_)qd30=sxBSuSziDRPcnsC+37-jpSvm3q=&7Y4G};j%~f>`rI>+YHBU3><<%IgBHL2e-ASSZm_7>!echHJ-^o@f1$iY;SY ztM*PJi>)h?d*!9U=F%%`y#B;uL&16#k~Y0tc1xjS9Jm=iDC4@!Tj_LVzu+u>WO|c) zXPBf_f}$_JUJo)=7K<$c0|5X50)hbn0F-b7@t;+-p{YNjS&>q9It?Y)?UrWUSrDj- zK4^n4RCIcMPv5)je&kC8g#beC;+E z6=-eYf3QSK)&qp2<$NE_zv`dY_f%+&m$QdJ6DXHWX;rxQQ?Y zL&+~b_4ga;Uh|~u8zvI=3*Ar&m%6;lLUNuh<@WN{{Cx`BXIX(B!EB#aM@+aU_!F2* zx}ySOhbBRceZc3N6K45(f;IPr#R7qW0M3r;XD_EYQ${kZG;N+Ku_UN)Zy?pAVN0m& zYA`H$SG+nCp0}x}o@2CzbPRz&Vr(c}=L2s@oUCH?fxk*;6}=qtllXPUl=t;vC5mIF ziVzRy#it=X#{7r|9##KAv51P>5KbR$UJ=p1kT9H%mG^%+S;nEJW|w|VqdgRWk;|IF;uVzx=Us)7S@@q9;D7mLNsCe1$ zu243FUmQyg-sUPxkvx{mIbz`f_x1kTYZk=>y%P2!qwD^xhF^xi+Z5WBY4q`-rz`<= zMiwMNLdAU=)pC$m@8N^|D^(%LBuN7WCjxsX zzp129qfJc^NJNH`*)Emv{flUeCfEfOqnTWr2E)wZS-SyI9bO%!YE3Z6Wk?A?hm$dv z0)c@5$$25edjRv&-KHFP=KBZ^4M#tSU?!OK<-l6n5Z?;{{}_z z^-I#1z*_<7Xcx0=%X81)sT@c$_WkL!x>!LiJK3NA=+{5VD=Ni&_`HBA%D z=};1)H_4@&&##(e#3}oYGFnPyxM8rWON)o7-k~eo#&(TY-JQu%8rzNZ9%>*c_?52{ zx`I6c4rDa{T-+SDvj8!c+k0qa)nJcgxH5X?874{CydYOXO$IkaO98_A%XeNWTH)MN Geiue|he5Fb literal 1191 zcmV;Y1X%kpf&`-i0RRGm0RaHQpugMt&u|7rv!C9LJ=rhBH$C@fYh{Ath`JqsrwVq? zA;rGwdz;vW#=#sA1YEwE5j|QuiSkR15=5=(@4UbWOLeF_S#o-F8XALLbhnX29W0$0 z`^6U}4UEEJE#HKhq!Uh&FZ9AsCOsK;yP?!b@<$f99GRjI+k0MRvI+F2GfIq-0(2*< zI@+{M1%IXd(F9**b0+8=WCc3!R90Z=+`AS3+BF!K@+u=)cS!#laK$+W*UPbkBh$%E z9O&R=BhkV~W3pb90gAIAV!eeFdnK&`0|5X50)hbn0KrYIAk0gtB;cu1_*7~DLp$s41j1L{dy$8u z>Q{6SrHuFJ5=4!AZ6f&-rB0VNk}EF%GnIau0>!zBGX8BCm(}Gomw{5otF4q+j_!p^p1sm3^l)5OV-`8fG^47KzM3=dOYqWQN}Mx08R?P zYG(QI^V0Ya2D(mOHZ6n3J@*&>6Q$zUudW;ASZ zQzH5(Vi)P&Q`Izs^HP*fY*{R7YiqEtv!@=|O8tlwC^M*Cwj0|J48 z0LvBOMMw2v^dO~mza7xFv4n50Qe?_on9muo``SJVw9twDxz;$tm3C(+A5JQ?3KbZA zjJgHmx*IBX4Ilw`JwQ-@w86>Eta4z4TXD9^xK10mFm*b9*FGd6pGoDEYM0?EA=1$? zAh{7-VIk);QUektIB7B1=h0D7V+h(3j{<>!Ay@B-IXxJRi!d!JY9)Q_y>BYaL$g&; zytn>PR~(ZYzYOl@OGA*<38Cgn$53>6_^#wDST1{Xw-R%AJ5f%kWK&JFV-I!P2AUax z?0^i4+Xou6@fpn6>Md z0)c=X@A}4A#y*Q%XsE;Fq)6I8SgLZZ^7^m458-?+{^(mFM#e>F-0j)c{*7c|js3Dusa$NJOJF%*s<_@CX`P5&9Zxl{ zJ26krm{pSK35pUk>#y4J{_H2XK9P;o*ErV#fq*qDV<*E0RC9D5w-*D^YaVVcH?W@L z7s;4%??z;ZXmnf~khf-nE#R3RkTMyTDHf{l6Nty%m{M|z$?N~GZfa&6?#vD#hY5(3Q9a4T0*tGe(Ft6 zO;-?^5C%F<@^3Rfw--TTl+taOmOr~GdK)(nn7CLdWf(~;M^tEIe?>)9rZ-b(z&fld zu889x)h3mjT0%dJ!;@?nu1Q}VBR?b1nZz0*#bG94#Z3bgL~?FWE@IY(@jN{;`7(o{ zk)wd0e$5u#>W%b=p)(AbeCif8b+o2QveZ8Q_d3*qspKaLd#lf7_DBBS*~i#_?zj*_ zY#4krTfaewD+KTqj$y=qSBjI+r7Z%yrIBMOoytmj7kDr9c(l(O2)H z(fIxJS>u6Y1yFn6T~RR!FQc42Rn7XA9nD&{}+Bgme)E^6agbGAfFjP}bT-BtyT7xpS zxsvhyPAV4QD0s~sNH*~v9>nTJ5jfF1m^P4v%#zf_80||MDIovH9!TcNL!#P3aPoIZ zrD;~Rv6q+LSH0Ws>Z(Q93Cwwx^&folDdkYQQ?+^7Y#taZk_2zIcS_p$=-WR-r6k5^ z`Q9AZ&09&?%KTR0B5w;@o)9zIzM2QlSD_}WCD-!l z=*&)@iyn%}yS&`Pwxu?aBZ(YaFjVnGXPKfW_DrQF5?pMdqkHNWX5I6Wa{4!78X2NY z^fFYS(5%VL+Descke}>5rf%Lsv&*$)X*m>Xo*fzrh`@sK{ zemvF))83vU&aL&bKmY35mspKe{Zr~lRP&i}(_1>x{uu4m91s8-#1ZVjIV0-+@V>Cp z=oV(3oX&I}#5@ks0)hbn0NJo+7ZDZk6%w7HK)pDrqnnD06;`H2brD5^6aV%{S2R;b zO0q;pP8kx(Fxi9z zv^x<^nL(3>%JYV8GzTn1mGqo~57!}DNopBdOJZal(F8NW&GS_2j?u$hC9$sE)*UC| zA(ehgwlp8Sdetsc#gGHoeeyI62?enpCT;GDyn{fg!yf2{tK6r8L8-{j zWmujn)3R`}w^3W~oc9wnI&2gHljAvYx5(wc_y3pY_!v?j2cFQbtFD7qJcK>82lu++ z2de2Nx*CS`bCQ$dodSXZ0RX^aac1&D2nLUw8}i_%3EE0IGhLYo;R|OTMFZ(f_&3 z)ft!ypL4v4lJZ)sp$V*V0^U+|g-3jybt01u;0}_;i%@h4Im)VfvRVj}+PVQd z$%(#`JCzh771fa_2a++OL8ToUE)gBT+4vmT>p>VRShbNOdsO4khw^!!{2Kbjv34O8 zVDIg^UzX1Uv-cNx5VZn=0RaG^TDSp5|IEq3*QX1%b;f_^t)z4Jn;izN`>1p*n4Z3i zp<;ey?=s!vDVlM7g7{3Vv#|!aa!mnX z*x&1n=?C+SV=c!dei68K2K@qr)4OY<)Dv%4aJ+vNE5e*fVy$mik94^DjEy2B9~@7A zmppG1hUeC>4Du?hE(4tcf&l;o({o(SzVb|$)uyf04BMt^ExMrK9 zE-?$113*7OqH)9vfKDQRYuM`}(k6dDckd>_F&ZQByZ zZ6t*p4!v{Z>1O)Sga0~~zQHQlYQTPkB^jYVtKTUnRr&GVFg2W8o zkC0CEd$eLG7elaf8bk2{f&l;@Cv3%63(Sp{p0(|C36aQ)h~D9#vOmntkZ~slnhPqP z6^mvyz&YRPtNZy^tO*^&V>3Llc6E}l^rWx0uE(NM@%POqx>og2Vz+-3TX)f|WK3V< z!nA_Z_{F1d%Ct3r+XfP;ggZxUsXu(1vjtVTPYM7{dm@IOaK!EjU2_*}4*?d{?bs1- z-QR<+bsFyn0!&rwoJU2XzvSHG@Fz;@DX2p|sGURX?(2q`7gHk)MU)+TrVd!Yy-=>{ z*`PoHfRz&pcdaO8O!1<8c1fQ(aSAj|)#}u4Ep0;5M@#wpmeJ?wh-{#-F%}3)vYB3 ztJJUoqYbWSsq{2`FhC1&(maox?BB8At*_qHegN_Cm(UerlhGFqSp+Cz&}#6X`{ z2H3(|N2wGExlD97fXsOeCn^W`4Pn++s+M#D>;O(~wfl~y;qgj?b^u`WqW``cC|ig? z96y!M7XS2>*B=ru_+Qy_9la*KLK^5a-5uR~wh=@#U7Tn=6AH}gihl`NTe>q(s6__@ z%!kaMhJ)^ct&_f>W0CD_-U+Y4I0SM3pkvJ2 zC5#@2b&4ibCx^XoK}a?;7P^WLB95^r%-L{Z^TI${%`T)LB-5txgX;UR9*9tfG zp0JoMr}gZ3&ElIoiQP({zW|?|Q29=N}D%WseeY63jXE#yASA&jVGam|+W!jT0{up!{AH7z;XMwF|1&oLlT zIf-10|5X50)heo0Ic&e?J7A6sOJ1oEf|dfVdPFl7nV#Utbk!IcE+x| zwzL2mzN#?8R)=NF$soY8eCHCB3H|LyF9zTm1EmhU@HP^xA!jo7)<0XT9bP4MXZ}Tg z9vpLn130B*c(tPYd~`tvpU+SK#>$+(${mFip2Fs^tL+p5xrw4e0R9cryNig*Qm99AT2>K`J_ZtV`sYF+WVfz|JC5a< z32|_d#wA0pmA>Jqt>Mq+?{md{55I*UK^tnI4QyYb3M%J`W?RySWV>v6a0W~ptFc#8 z2+k-`_?PuZljI(Z0ycu)f%7=#+3so6_4~q}&izudsVk7dFnzrcH(x^A=H{OU7it9{ zgYY)1WTAuDc>i}P!P>*jVZ-o?Z5mw5N5SWmc^m+(>O|VI_8zn(F&6&QuB}9w1$fl; zoTz0hq;ReN$wnV{J0^Im88if^GkC^Y=)-Cng#lZ*eux-L-x(rbUK01LbXkwx0H)&siZdBsGY zPMq(uI&?)?UC^J;$pV4_0RaDqB(do1D>>Gq+(e`t>wW2jmbau)pXl!~H>zdxJy}70 zFQJ@~IHF5WD^efq<~`Y-ZapdE=Lvf^%`bxIV>8_ zpi17`dW!em{S$qPsQ zzinB>N&dd23n`lgx*LKC_VcD7mz0m(-cw6)yAq_15GEpUr!x{xm4s%+;_{m6IW3%P zUSyYXejLf2KjE=QU6-!scDoFt6`f&l+0&(85wU;4{*%q6qPV8GmC(8`8*ZrUuiq8z;aBT#Uur zDKGrMBOFWEVn`AV4MGdUv>t%IN_x}+7WbM=`KGAls{0t4O86`nN}ZmdaAZh%0M=q= z(+Zh=EN$fYA?`prE2p~xf&l+H9=lOdxG5_)MY;GlVN!q)iERlQWT;`HHkO%rFj6$8Eo2%|Sb z{rF3nAU+bOCGW7&gx08o=COjKnG9OXBv*(*XA_7DIoHpF9f_YHl z6Rf__Wk*KocnrQNJq$tmKXqr5#tV-L-)jzV4sP&t6|KgmadNx7o=1RY_L`XR=my%F zxJ*{_68OcU5|vB!271W?f&l>lq7j)r+-H%^f<*}JSZVtPV&|7V_uzNj4B0wPZU%(I z!-#xJMnItAM}A*#OO?#rh~@QEQ+PsjlRKVqeTyM#dxk0l02_r9_ zBsL~(g-PWYbR%PVYD*$Dua&VxhCu}x`T7lBNtJ2|fQF1p@+xlc!^9lFEq)(oD{-AG zMv3>^$8)&&Cqm9W>bB2ITLy^6lMzc_-U;tIQITU0U)4vV zu^PNP`(&Igf`#YYx+c>R;XC3`YZg5g(tGs#J^3oGTnXfccDQZ1E2^{1-{SxQU()Tj Tbx&XXcZMQG44N=;lHrQ{Y;S%h diff --git a/ssl/test/axTLS.key_4096.pem b/ssl/test/axTLS.key_4096.pem index 9929467f45..362e77724a 100644 --- a/ssl/test/axTLS.key_4096.pem +++ b/ssl/test/axTLS.key_4096.pem @@ -1,51 +1,51 @@ -----BEGIN RSA PRIVATE KEY----- -MIIJKQIBAAKCAgEA/Ce0mV0qytAwDPrjXRBlUh2gdKs2thDw3N18owXVrSUFq9Sw -AaMNrmep9DR9MEALcdMm3GCEJ7sOOiEQcqTz25di36WJDe+jo1z5nD2XZsPIsp9+ -k51Vz+W3B4vsXJAgzV+XZbmv9L0598VEwkpeI3Uc9et8ZhGvDPoHZyBQG1KAj6h3 -AKZ1+NthrhajxlrndQZ5Du/R5DSUQOBcCHHdzZgihdfF97Yn/kp1mele1ElZMlqg -BtpDi1TEQJ9XBtjCW0epFAm5THQ3gMx5DCcqB/cNYdZWqpZ0AuwATm61+46m4fFK -g3YAYPOi/74aKFuIQBw/lc8W//SV1x8SL/hf2XIdvSa9QhroNN0d3Xu2EUQzXZxo -PRMKzOqKfwlZW7ozT6hFBwPMh8yfhoPugq2TvqBjke1s3gmvwTgEcf+gY97qXiZC -X5bh/ehmnZ7vIblYFUD2yMlsKaXGJYweh3WKJlQnh71wQUg2Mxa6ig8ijrEozNlw -YfPCQFrNLqQfJOwdx90dy7hpUyUn1wo39p6wmC6n9ex4zeKbO4ndSp+/AJ+d5Qp8 -zoMzwneYV9LBQG8ry4uwzDkSWKb/WghsEbQ9O3sGIuI13SlT/B64v3bLb5AHagI8 -zS3kPsshjKhkcc2W9MKRBU2wIeCsNS052kaUq3rPMSBROrALmLk3en/Dq48CAwEA -AQKCAgEArPMy7So5Cqjm/FAtGI0BYeRORReWTCSsgGEudsauu7a0ABq+qjDDVodl -y8kgwLJ85xKUCf3tRy8G4BoDpQ688DYSrCFnMvbWP1urHV4ldWf+RX4eHHODAzil -ZHi1ovt8dEEHn89P/8a2dtqIgdbuYNWYCpj9Vyjz7yujXjmMmGDrKx26meiS7CDV -C8odhRSewuawq+0UArmJokIA/g3Tu4uIylKoR3JaVhGOPgYSc/rnQiFkt66HO47l -mQlxcJHGJUOulb7hqK3hz+bvc8V9D7+FH0EbaqANbF+hCirniWZb0odku2x5cAZM -G6uxV1MIzihR+Jf1R5PkHowCNoLegfM45tnuadP1+8Kezv1SsqkrkMEwfb0QN19C -2+bmnwYXagUgg/A2q2Shg9h4/3cpwdrDzGHD8IttGlzLR8HnlHkcAK3qRNqy9h60 -JDEW/tOurUSZBXjU9ZyoZSukcK3+yUjCDWS92wMOBlUQGh4/HCOOizahe6lhn2nT -+jkBvl38c+7GBKR0VyCisFi++FukMBbyU/hNNFByZxOj0b/+YVYI0qwM5oDzLhJH -69/VhxMx0xVt9/kOOO3yhdGjKCZztPZZm5mg2OzzXmf4im+hPSg0/OrdXrVNk4v/ -w7ouUQHSa3+rAAu8BJFF2rTWA7rjecVEnk6c77I6dEVYXdCfz8kCggEBAP+IJLHo -7Cs51qPcRKQc633phJa3pFGf6O8xN6pl8z1ZQX0voZyROKJLTytSH+zmPdmggUeg -7CRoV8BKY49YiOxO2Kx8BPfftItS9yvA3O9ztcdzQa72nYusMWwvj0yFU8DbYfnx -yYw59F/1pdPKFN83Sj4MJAOb4nAxBP1GiZvsPAgcTpf/197NLNHwUDdk/TXDtTLa -lx4uTn/SJDQuvsCCLBKyx7FdN5NPRN2kIKUWZLd7HRu2EhcSlATwf4TUPZz7atKN -2FD0svErpPOAspNPtnNj3RgeunGVqS2oi/XueuveNNCYLkcV8/UaZm85LBrPoEre -23qK9/ZN0SD534sCggEBAPyd+nD71pScrM0TI4Lc3jMNUKeZj3sT5rlhlkWlARhQ -WPEWYYg5vs3zDiRpG4Xy3n9ey+M6Tuw+/XpcJZxhrLYFOqparxXPP4qc+3EvtzpF -OskLR/2/bVnESf6+pQspmwW6G4IJ9vOmIJeUj9zeU0txuxKkjhAmInCnMxJOlYRm -xeLymuo5LZxrXmSXcX4cyZ0/4bF2L3IE5vH7ffdWXWYzW9wP7M4sFp+0iKjHuhC1 -gB6Qg0Mp0TVNUt0ZEelFLEJdA2lbbZ5yHhNXuhOxW/l3ASSe9tjTpy7yBSwBOpFG -l7QGISfJVEFfjyn7yWBYj5LDGnitlP4TtN8zyy6cJI0CggEAPRwY8ncqq7e8Thmq -TLkh1E3ZSJYIdQDSGwnhLx4MirpiwAZ5FtFgAugRueF9AxGY7wfEgxXIA3j0q2be -4nQg4qqEhNNv+LuGGN+xfsQz0gwRB+7XYXlW+gUnGKFTGtCz0+ZjSvv44FEn0R8V -Fk44qZ02YxpSLo7EG2KNt+h7lk9rl+D1JsKnpH/a3SYkeOrs50OzfMLr6urWGRlv -UQ9wzOcUlTAuM4uAc/k8FelfaTuuwHZv4qWrM9tcjMXbKS/8wCMcS9hiSBINDUIL -w7QegL5KetQCFveaTPmmqOWq+xiaSvgsF0qdnqBwZEh5ANZiZtMKmX0sbeT4Ie5A -OiunuwKCAQBlSlrvDqu9rwzCtdfZUwJtaftbGIGlkhdDYdPFXSIRQ7ZGBPlai/zr -y3dyNgrpLLb2T2ZlWC3pIGC2vVf/WlLMMVCSmgX2MsGBrOxNOBq57KRjlHhrUGRi -SAh7cqnuzeHw6+y3uZMhow0Semks4KB5ccLW+NBVvVS14vThdE0TZ7oVA74GCKM3 -Qv34S5kgPh7BRKoUZBUmHL0VbgfWMvUEU7eTh3cmPBteMh9RvbPnmz8iAkP/nDbc -roJ5UOITrL7QZUdG6XgMvik9DEH6P3Vnk8YLjwnfaw5wDm7wdBWtxqZxcru8nkeA -ZvaamPDoBtqauExW8xL4xaISlUv1BnrJAoIBAQCiEZk93GeRzYJFCO1YafsGYueX -Pffgd9wM2TpObgaEw8OIfEpGQKDiR35fb0uVzNyI5fVU5D5tP0b3LfvtQXV12ryQ -sVTA5YJcb8mRuUGy/AkjL54kNiZthUnlGHQjY3lqSyI1r5WxRIZBBRn5+g1eSZVq -CYCGjEryKm7vw8Qcvy1+H2crcZ0rRyLTcfFCr1ZXlyEZu48ScOtxcIDHc7j4J0LO -Peq2z0tbBojGkxFLX94J7zpRkWMPX9VHorEavDv7ZJwtgoXn3Lom0xHhO+JQaxY9 -FtJ79Ps9+SquXAnkhna4bbkrqrPM3+MAAV/S7bd1T1/8d4YiRQyaMHGS4Yr8 +MIIJKAIBAAKCAgEAo5gChsj+wQBrSNjdaeHZQFNBsrMsgQXT8+5U56Gq2ddnVP7s +s9O6SzyKNab45c3+68uDRhlAOk62O63smiDpfc8OvV+cYJkH0HLNSpUMILc61jdW +WnxrHRvHQm5Drlkc/s+VCf7YMNybOzKaigddZ1qMI5vtNd1kK3jx9q718T/Wmnj5 +nSwpSK5uV3+KGbkiBubBJtFatsfNkncxq8wIcwrAK8JQMxTWzhV6T4PFm1rcCko8 +HlpCtb1+6k1PTVcQmRAGOk7ybzM+txdBYpTSbZiWP7spehs3D5i4WChlGEksR1Ro +Y39FRVSmN1NnwDqsKq6I4yDVJpWbWkI/jMOTbBiuSV8dIz8j0JnEGiLFYSZhxU0D +FERyblAuYtaG8Tw9Mvkyg6GRo4Cffs0W3OqN9IehMwyZfOoWNXW0pkmy1D7+9zrU +gqnkJwp7q89l9kf+3tnH2H/uuBBCbBh8NFu/QYgrBPAUjmHEf1eKk9ClLQK85T9J +6aGpJVj0x1Vm2/vlars5qBx3TSrC+BKg2FVQoTKbbN5ySS3a6RyWWiGkuvkfvFFK +WTW9d8lpeH1ivXPGvUVZ5LOW/2W7pUAV3tFX76LR+P30WeOBYwVQe99dUTEJL6Oc +PVXN+pYdzVquKRJnULU5pMvd4QPILRHI99HAIVaTiidRtpRsmAR6CTVRCQECAwEA +AQKCAgBIbWlY8S3QlvXop5LHaOU9VF721dqzOLhQ+8h9UJcKoRIvkDmNmASXgLMT +89uoKl5dWJnC9DT6W5TUsTjaOA4H1B8LeoQKRFYwVFNNXNWkulqDMra5kvH9TioW +4Ch4zR1INvEeHsTqRRE40TuYNpCEzJLUxRjtSxopIP/HHkjmyUOi2kJw8ndIpWlW +tbGXl95Xvdvv6qpF2AnMeZb1H3zyKeVQulO1edlsHhgrkgRvtndK2vjo2z9DpSTG +aPneHNjNW0nWkNNGpiJy/wnEsmzDdtW2W4+ObvQepJeg+Clh6it/XQBmZJdvjX2V +awi5E4Db2K/kFsonrf68pC3sjT373RfHAEjiNY2Kspr7fgUNsFVOfyaORuWcqbzo +TMBG9vryGOfhsADISSWtJFN8FW4rjoIJ9Y0Oac95MCoMOFI82sr8VuEibwtbnhAz +2r6aB85XoSarJdfy6ejMTp6LHorJu7zcw7alNpEjiRxbMFTxRGeZoif2TKUmElxs +oaN76hZm3fOScvo3YhoZokz0MlSg0KzJzdpKlWvkoEhSr5RLHY+qlpd5sYAtf4bJ +EIH0vVrP5/B42Hnf/9g2wwP7wP+UfjzWCNPeniLOrfWyP//q2pdYjVX9U+pIVPOZ +cdNbOtH+GO3VHBAAG8QR7L85I+r+8L6w0ugWZp2cznQexDwO0QKCAQEA2bBmFxEV +8BUSnaFAvTipo5uKixVWpkV1EUWCE//2R1c0U0blW3KocefURIFHGYmu+XdmnI2H +MTDB9Nh0I6oqceXiRKeyvTppudIASrJER04ZEskw2YQEtDsRTZlBk4fK84ZtNAcs +RJX0nIIP1yFaSWoZWktiZB3RBDPBzfNU647Rw1wlsa7d1h0n4SGVfkq2NB+85Uqu +y2xAR1d61S5SxZAD2H3yNAwJBbEeJm3uiryDQKnDHuiGq9yngkGpyM5lWJ4q07Jw +sbdRW++c9xM0OmwUAZPjOXG3yOW/9/+X5/gYUh8HntCuq66DVjyEPbQH97rhB6rp +JroahvRzkpPinQKCAQEAwGJxZvJCCAaPnBvy4KcJ2ko5M12l7I91x5UDylAahexY +u4TyxeRSm+UcaYoV0BRG2usW2ImioxP1FNr+GSp0M3bOxE/dAebi061rpiMdS76j +ddH/uczVGZgKn3O8iZLyWquhCaxyAt5SdIVHfJ11IpMN4A6SxotQdAk6sjKjYXRQ +WgR8a+OG9vgrcADHV3GaBcQBZ3NRgkU1YddFyauTx5QPaWJSFmJcWn6HyNN2v3hG +HeskNeOyWgiT2roBO8mJvpM7lRQiFdWRKAeSMaJBpR0aLhEdwNn4HNjrQRgrWLWR +I3tU48+H8nmf/Br6xbF2IRRg7+26X5bPA7P3F3gQtQKCAQEAoVq4AUb/zMnB16cL +tnXGf+etpHP3mx0GrfuodCyYnr6LoWJ+ZO8y3eMpmnF8gvhkArM3ErlwyMxMJ7E9 +PKZH+c6cjakDunEOptZ6suM56uR/f0YzeDb7yZ+yrqL3UWQo0aMFVLgwXtIL0uow +1ZP6OUp0alJQJsdXA1ddwssnWcatwrGNmwtzkN5hjeT3yvmT3kTcHdTihRPC/V5h +RJyma5vYzeJk4aE+GsLzByca1iju3MI4R7OxBrhyTQFg2N/rjOkH84xjLcckfhG4 +dgb9AoTTu2uj1BNvV3C8fxUrwpxJYq1vV490uPqMjSIkHxxPf5c8bxOG59awDPIq +rC4DnQKCAQAE03Nczb7yTJfVpq3VDNumai49J6A96utdclOCA7hmm6MuMQuWA0A/ +QOQRkbEyYw/T9gnArNMznBCN0WCGaRY5JEXTjt1QauZNwQ/uPvtBJysajYYItyax +WasKjPCx0snZlGyZvYWupL0UxzMf4SNLFr1GXZc4+82s235pcfO/Qhex6mLkofSE +xXzxdlOJ0gO3GU+ftLjat7m7Fpddk7xFSWWJkznT7eu7KWlmlEdqTi4UGg3yfB/B +Om3bEsdtJIUcDr1z4+lm+tCFXItCS3uyFKTPewZwDAe5UYe1PlH4C7X0WeerP019 +u6dTv6mCxAzej5BO9Hu0YigXQ7BzGkPxAoIBAB8nbMVXC8yNlp617XQJkciLiN7h +oLI/zM2QcScGmgsqnhWLZjXAOd/pq/v5V6wJHcRjMzyxdnWSsPSkr7aux6JS8ffN +J7pW9VBit38UW3fRrWRMX+PCtILT+MWjb8q0NYDbBhKphDtHbKk/fJuzBVW5TwoA +TXsihp5wxO4JXXMXaw8BFtXt2BFv3d+Dr3Ua7wcCTFXrnEdFor/k3OPwJ0rqKahD +PaidQ+zu64aZF1MjDEWUHXumDli/vVCu6dmgQAGAlRMKd60oZUzxonx2SZ85cQo0 +TdXq1LOweaGRYe1RqUWGdcLX2BZI0EZ9L+aNzzFnSVbhnHx0sMKpOp8SlAM= -----END RSA PRIVATE KEY----- diff --git a/ssl/test/axTLS.key_512 b/ssl/test/axTLS.key_512 index 7ae50f23bdc90e48f165aff330220508a99699f5..3fc8a7872d1833a499188a99d980c4a73679acff 100644 GIT binary patch literal 319 zcmV-F0l@w+f&n`M0RRF)0LaQ+PP?|aIqFW!gl=!;cx+KRRTPd{I+q%^`tsdqZ6z+M z-dVxk@sQ$w)Z?*x$#qjAkjc@UZ`v8Z(6{b%7XkwT009C(Bst!D#sWcFv72SQj_^T7 zXvBW;y0f$ejvbTq0=-X(kFxf;{u7oOE|QFS6l&D}EzGq60wDnI zFPX;3E+?;+$;W#Q(q+p&nle)|SS{22GE+S_!{JE+ApqCT#;#n=(;-3RdDv>7>(4%b zN37Z%B2Gz9)?Bpd3SR;sIWvz>u;qNbYmXc34t}@Up13nx&75VeB7%Z}5;A3(0wDmf z{LoD2rY{4?_|0 Rj8E9Tl@FUXC?H~j_`9{Hm*W5c literal 321 zcmV-H0lxk)f&o1O0RRF)0MR=zU#S5?J%(*^zCdnK!AXBtb)hXb<-t7_Lcx{!|rfVZ|0=xRXKgPd)!Gy#fOP009C)0Fimb?T$65*W6;Z_#YNk zQ@#a*O7BqLt*OZgemVyg$o&?(z~q?GMVVlAY-DAL#~wAJ%@hSVITaeX4+WM10RkZa z=2Ex*d>@xxG0k=x#?fIqh)t}0wDn9_HXM@#5)1QLVZv(dI{VJ z<#zME>JR1d(>*U^;{HF#AygqJ2JGkYa5*N@$(u= Tmj7@iAR3)zxTTMr$9H6O@syE# diff --git a/ssl/test/axTLS.key_512.pem b/ssl/test/axTLS.key_512.pem index 1e2fb41f87..fed6d246da 100644 --- a/ssl/test/axTLS.key_512.pem +++ b/ssl/test/axTLS.key_512.pem @@ -1,9 +1,9 @@ -----BEGIN RSA PRIVATE KEY----- -MIIBPQIBAAJBANE7MF+pAUI9hm1yvkBuUcFJf1d1oS025cE9DyAa0SNt+nTSPiOw -cPygat7sQYiE/lQVa2HFFmK4k0HxTz3/Lr0CAwEAAQJBAJF5xO2ONajX3GK2+B8W -VVO+BYNK71DfranJCX46BxXI/Ra7wOSY0UWZYHVsZGWJxx41os0UBTg5FRq4DwWW -AQECIQDo69eo39iQqjwhpAQxatMh2CWYT7gokyu56V+5o2V3fQIhAOX2b+tQxDsB -w0J9UDN6CdwI5XbzveoP5fHTPS9j4rhBAiEA3c+y6Zx6dZHYf8TdRV5QwDtB2iGY -4/L7Qimvwm6Lc1UCIQDDXWrVsocTTjsReJ6zLOHFcjVnqklU2W7T1E8tvKE3QQIh -AMRpCFM7MrS2axuc8/HzGkqW/3AlIBqdZbilj5zHd2R0 +MIIBOwIBAAJBAMjKXU67trg56k7LhG5v5XhsUTpVFI5ZOpcat/ry3WhtJS6q3lnB +3vGQ4n/U47F7yXVTIpDJ0Zxv2hm/0LfudBcCAwEAAQJAJDnee8YCQVqxm2W8jvBB +RmjEfvG6s7QFjh2T9AK9T4mPsva55HuPnRee1WgkIVFLCB2wy+xeKqYUatT/Lcy1 +AQIhAO4vmcbILievlsnHew3SZcs+mjJTMlgt0/0yUz03w+FJAiEA187GrlzN0yFB +5HnYap/rzz6AR6zaHSJOSU/WXLTpCl8CIDkzj0+w5Xy8a48b7A5+t9meuDNbzZxl +rSKCgoESMmWZAiEAsPzQTOenlePMmoijSK7nQgxMQHwuVX5xHgbwEw/7n5kCIQDp +i1Gb2CDHu79/fL6kcQ9DEfGMT9i9lQ+bNiggYoL4uw== -----END RSA PRIVATE KEY----- diff --git a/ssl/test/axTLS.key_aes128.pem b/ssl/test/axTLS.key_aes128.pem index 8961bd9a59..79a46ae2d6 100644 --- a/ssl/test/axTLS.key_aes128.pem +++ b/ssl/test/axTLS.key_aes128.pem @@ -1,12 +1,12 @@ -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED -DEK-Info: AES-128-CBC,B3A0D2BCEF4DE916D0BBA30A6885251B +DEK-Info: AES-128-CBC,ECA1836F07770828A77072CB8E75B461 -v8y74AGReaPLmDt6O8wir6hX1Ze8K4fVNkrLqfDMdW5E7jBXKO8riCMNmSjQ9fyh -eTicej93+8krcIvSXKW18TdO+EWezQevgnLrAZQWaNPH2j4B+K5gm701uiiKFKVa -1zngAOByePYlN6z4JLbiCyJRhxSo5zCaUYkKC2eGh8mlE64QmokPSCAj0wcCDzGh -hdhBg1vm0GmaQwIDVn+8zMfahscXVMtBmyQf5YP4PQW2nqOt7aZHjBNdg9qnBpGw -b6YuY7eZ4FgQvYcsNCi34NroJb9pkTrrF2F9Meb6+3So7jtMFG/YaJdCuXtf01g/ -Qm+XA5pJUtIUr/hLQjhkaOVUtXv/k0o/MR4k5CbAmboLt6YHf5V8+01vk0bvv5dI -70pVdXMmx26xDZOGmjYzd93PWc+75jak3GN2fbWryQs= +IEKSJV5xp91M43nqeO3tWV42uXhRuQq1QYlwHNTJoJ+P/+Pw2g6DODFU2xcWoM89 +/QHcZIjC+Er4GM/IcRWI307XWexpxd3SSsvDd1D08HU6DyPts7Yb9zy0bwzDfS1g +wDhifACXUEYnpiTCAbO8Pni+4TMV4tQ25Iugis8IfUiBtqfsEAo/tOHbTIRTWUNN +yh7LS+7TKU0GuvEUP6uoxn0i1tDXtP9vaqgkO+DNFgi8A/Pm98qdTvLtp8mNHlJx +kX+U3+9yxm+HlwtjhU2DgHxBXq8eAtBW3rZj/pM7bFubSNeqbsD086hlxvom7ISa +Rpm7QhoPcrbFYy3rjs2JyQBoRvIAPXX2tYCuKh+Iylq5KztPspGIXXd3Sxv4g1tB +bQRVfmSwLNKo8rEP5vWa/DCVZl1GJoJTIR7vmQvGGkc= -----END RSA PRIVATE KEY----- diff --git a/ssl/test/axTLS.key_aes256.pem b/ssl/test/axTLS.key_aes256.pem index 7671a302fb..940db84f44 100644 --- a/ssl/test/axTLS.key_aes256.pem +++ b/ssl/test/axTLS.key_aes256.pem @@ -1,12 +1,12 @@ -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED -DEK-Info: AES-256-CBC,F076229CDC2BCB3B8722E3865855B45C +DEK-Info: AES-256-CBC,22B407B6BE071AC8FEADA8834A3C0FBB -WFV9QWzr4tNmD+1OeQ7BceQg5LVQHp20Jo1Ax29lq8JTPzeObhtaU2MUHlcPKHUS -vK4FyQxJ25CyMubbnaZqCCz9pNbseFuJ1tob9UqRmXkZ8HV3snRjJRbcctD+V9x+ -Ymi1GreXoDQtMp0FtMiFjPvIYciBQnaRv2ChMAnGXNbZXCxWWA9E5S3a+yWzo+gd -wEcowL+SUac1PEDGHokhKn7nctvI9cC4hE6JmKM1sD68/U3rRPXMGqmC7umqyT5P -gjWBb1uu0iRjFC9eQUsaKPxey5Be710GFlyf/Ff/tep7RhkryIWEPvIzYCBf6rhk -3pysFgTjfiUuBYUNumjXr/q5hgdtb75788XUDxKwAoUx+m8gi0nJg35CN2nmQ054 -VJxcZlNv0wqnJ+GTTZeN6fiAhTpVtHsqHQomRSfaBiw= +a9LRlNUJ0oatOOxS4eMMNd3mJLre6llYU8JXnJVFyuNzmh99sgdAFao2xDOoszYj +ZcBUDD5OcZxDIVRNnbsCC7iDXsOdIrBseDmC/qiRouNZ8i2a6Dh7IMTrpToPxNQ6 +rfDC1pEf2yUtbK8fefzIKzkXz84igCGrqLCIz1aqW+xjOOoTfXXIZj/LoYueLzag +i8/nasxFQqDFEFskH38dEOMTwiKs1xZh6cUA0sQo8l4IYiwjAsAqPMiNiOdBA6sD +9322LCQwPqqU7ZelTXl8NCWvxX5S5yxV7KYmEV7VeSiPj4/ZlI8t13TTw+2Lu5j0 +35Rh18I5iUPsDUV8VaU3df81wQHnWamKFGUAY2imS8X7z1uUiUiycuJipZNSoAHx +3QvISza1zXCqbzs8lI8JQqja+Onope0CeeCBKBo9fuUirI8NsG6EPrnp5IxACPXl -----END RSA PRIVATE KEY----- diff --git a/ssl/test/axTLS.noname.p12 b/ssl/test/axTLS.noname.p12 index 9d27999fa053e524fa4ca893c2d13ce9ed49bb7c..a81c31348c5af16aa5c1d637e828267ce2458a9b 100644 GIT binary patch delta 1327 zcmV+~13KQ@IG6CQn}Edc>K{XEvhivIL1TQ!Rl}jJPYn87ud(l*H&hD{$)nK= zJw`1mD|#+`N-4d}z2%?df@aUrYVA5Qjbdz=N-+~5ggru>lYdT!P|nRRJR8`me9`<@ z%9nx$q$p|xoIeu z5h*H-f9Fj`+yz+M{iA%1yHd;W~@f|P^XWaLx=s5mW$MKK!f|a@pDzAvmb2{df z8s_T)St6%cIe)|2l541>IeOe2WxkACs4f1_78ZoAGr38l&H4(fo}I?j zk$xIvV;Y0#5FG@;`A^i&NHGjO^AYPkHsGtu_>86bKz|#gADJg2FiTG7BIcx!Cx5VJ zhe*|Wgyi-k1O!iQKg_knq(r0Sfyh*19Rc1xM3h`i1{ebbhkw(b<*yUhM-X8YF0WZ3 z`+MnV=e>Y-dB!iTS0Jw?{o32gb<^wOkxrJgJIaGn6q$$#Gq=#1n^X}#wtxs9tk!Lt zQ-RLoc1OUz>cli9Ep9=o*hG~;;*h_w!ez%davPz8{=ilkZwxyE!C3_cHKvgI1|I=_ z-87Rjb3i;K(2Kt>5jN}59+!4zWv`qFG?SnLMt_37UQj9ha*F~22ml0v0(;*!g%}=j zUDm>}I3f?}j%ayDL}05OKrl2RFpi-|?#iZO>q1iOe+S8s1}_OvsRP zvVSa**{E%V6!q=>$YI;NAt-7-)Dnc>6R@j2`~!^2tRmIevxE538en}iH{j&0&?!t2 zQ&IM|^}TX6<9-I*B{@;ttCHKRq)3BSb0oMNAo4#w@fPsPOZ5ecQRJ|D`3;D^A!;zo zLXdY!9FCXhf5SYkDDt9v#!fQl=66PEEq^iyO0LY(mm**94^tL7rW&NzED+@ZL4m8B z?QdEA3>A%2xBmEPQTW>$Dz_gR({j&Q zGi=%Cc85-}avWO1Q-p&W^<*ZzQ|jsKYiVu@pC)7@m^hyS>#NP6edr%ZITl~g0M4t<4!0L;*r z-El+hQ1NqauB75a?k6Ope9XAps-=$m$n!)?dw))<1o{muE97Q#^QLwrUfWAmS?~lj zqDCeGSCAG~O14sfI_>>)p8sU!@7to?kh;$0@TSXtP5Y7-E~Vo%Z@h%Ly6L4y{-FzE2Q-4M)NHTk%Q zz8+of-@mDt>M4_P1rta4WDB>6m0@eK7;$X~AJ+O_p+0~xF)$%82?hl#4g&%j1povT lKUA~Jy=Qn3gqYvQpB2qe7zr5#1PFy9$+0Bsq^be}2mt;ieue-5 delta 1327 zcmV+~1q<@K8-llhZX<0 zkiP-CZedr!O}^OGn;BmG?`TDOv=3KX$)0mXUZ})Xg1Y7#c6H%D@k}QyRdSRF1ko?= zw#Lsj`DwZ18Gm}*NM~RgJVg{PBcosWt)vumqQc7T`4Du*rF(^ zlB*Kl_o(A0yMvfV{A@)vK904H@MDSy&}OG%^+OWvW`96)Ed2jkZqa3P-Ad2E=zGxJ z|JJ1!a5(^aa^?|OQ%YnGU;ar;r&DQ5ngKg!B@B{UhnwV9TGzg!bVR`opj^7v3&)5; zG1YnlvTq~fpdG^sZ4A6T3{bZSCNE>h*7maR-moN57Q zqiy~vSoL)u zhG~Ol z#wKc>#g+Iqr_;+qzEWUN$q*Usx8ds`kH(5)cJQ0gM)BDi@5p`Mv3)0S1zC39{V7yv zI4rA6;YZT@L(;EN3Lc|*@_u?^1baS!Eg~`hglR6w3@X4e%obHwtZ2Frz6&_lh$30TKf>;la_In~m%k_-&Hajyub^k`0Oy8X_a^0fqSF}g~ z<81YW&jC(FL8mB@`06D(_<@;6RqF*kfPXv&ilSWTl{M}8Gjq~ zwr}%in!Mhz%b{%(zWmiX!7X-G<%c)&ctH;w)`m%Z=hc00%uX$hsAkf~9!&4`fEr0r~ z(pTDre=sEtfIM)LjsqXQj8gUO|9_Tnmd(44NKwJBHl{N0Sg}C}klKlw?Tt5mkmdN5 zD}>|BDPR--WtjIR(u~B~KeY9CBqwunbfXF;I|}w7FyU`#7N$7N3;LGze(0K@?h~*P zs1V^f`(`oWIaWs{G7UNHO)B9>Mgp}gm~+d{BZDFAzdk`<`3Yt;iJ?V3-VpoEw5gaa zf2Om@GYd($am$l&1rtXxwu|ApG;ID@f`chs320&mjjA{>F)$%82?hl#4g&%j1povT lL75EQR*O1__}Y%Km|+mWIzn~41PCh;SJ5PVg&LNQUoKQMv;I|2a!0zm-C%3V&owzxU! zPRoRDZ{>JwQ94x=j#)aF8n^oL-DqtkE~?&H!QSzZ;(yfRv3tpNQzDSb(VTDE8NblC z?sOLd0|5X50zf1=-h0LZL0Yk!WxS5?K}KlAe(}1qv;~eGlk@_;Pl=DR_POMHkDV8u z)o3IkQA-FNu*>XTDy9@_)c-BawE+Sl0PZiD#>g%wua?QjdkxZM%RZViQ!-dB)BQ42 zJvYPQNdh4N*UrYST+P!VLF9SZYM<-RK7dE8+8rWJNl(^XwCM_80w6gvk591We7tLq z8|)5#x7nV!Gh5A^WvwEDf`Jk;WtjpY0I>YfOy{SS5EaD*dWKdzkhtbq;U^J5%G*q*u9kxn>HvQVuJX)!WW#1 literal 347 zcmV-h0i^ygf&o_o0RS)!1_>&LNQUoK`?>=Jpus$0zm-LJ1}3V0YW{7 zZF0UqZc)KWe^+&(EjH!BJr5un(Iaj8bkaT}uyFjKYToQYh=l%B6>DL|7Gk)QLGe#L z|1P}(0|5X50zm+gdBp9GHK^CzVz&4n7FAQe1%pcOP~WYo$q9Zs2NlTu7Q4XYn9)U< zV0CO{Wr@cgHKNTF1vohs8n_PymH`0*Apq#>*Qnpvkg7Z(qy#Z)(;?U;m`}JUlPkID zU%8`YcYOjO0Oj^?>rliy0mDLlP&0Z7+z91%^S$a1{HF-OsY=oO*SU z*nh;`MP5+AJ3-nZnB(&MLMgApZi{nO0wDmyU24^`hZ9aa5qO@nEaAm+HD{_xRM~FR t)K4wEp*KMSAppc_2va*Uw6<#-ob&PX8cLS`a3vrbon^SCkDSMMWONLcmL~uJ diff --git a/ssl/test/axTLS.unencrypted_pem.p8 b/ssl/test/axTLS.unencrypted_pem.p8 index e07375a848..6bedafaf43 100644 --- a/ssl/test/axTLS.unencrypted_pem.p8 +++ b/ssl/test/axTLS.unencrypted_pem.p8 @@ -1,10 +1,10 @@ -----BEGIN PRIVATE KEY----- -MIIBVwIBADANBgkqhkiG9w0BAQEFAASCAUEwggE9AgEAAkEA0TswX6kBQj2GbXK+ -QG5RwUl/V3WhLTblwT0PIBrRI236dNI+I7Bw/KBq3uxBiIT+VBVrYcUWYriTQfFP -Pf8uvQIDAQABAkEAkXnE7Y41qNfcYrb4HxZVU74Fg0rvUN+tqckJfjoHFcj9FrvA -5JjRRZlgdWxkZYnHHjWizRQFODkVGrgPBZYBAQIhAOjr16jf2JCqPCGkBDFq0yHY -JZhPuCiTK7npX7mjZXd9AiEA5fZv61DEOwHDQn1QM3oJ3AjldvO96g/l8dM9L2Pi -uEECIQDdz7LpnHp1kdh/xN1FXlDAO0HaIZjj8vtCKa/CbotzVQIhAMNdatWyhxNO -OxF4nrMs4cVyNWeqSVTZbtPUTy28oTdBAiEAxGkIUzsytLZrG5zz8fMaSpb/cCUg -Gp1luKWPnMd3ZHQ= +MIIBVQIBADANBgkqhkiG9w0BAQEFAASCAT8wggE7AgEAAkEAyMpdTru2uDnqTsuE +bm/leGxROlUUjlk6lxq3+vLdaG0lLqreWcHe8ZDif9TjsXvJdVMikMnRnG/aGb/Q +t+50FwIDAQABAkAkOd57xgJBWrGbZbyO8EFGaMR+8bqztAWOHZP0Ar1PiY+y9rnk +e4+dF57VaCQhUUsIHbDL7F4qphRq1P8tzLUBAiEA7i+ZxsguJ6+Wycd7DdJlyz6a +MlMyWC3T/TJTPTfD4UkCIQDXzsauXM3TIUHkedhqn+vPPoBHrNodIk5JT9ZctOkK +XwIgOTOPT7DlfLxrjxvsDn632Z64M1vNnGWtIoKCgRIyZZkCIQCw/NBM56eV48ya +iKNIrudCDExAfC5VfnEeBvATD/ufmQIhAOmLUZvYIMe7v398vqRxD0MR8YxP2L2V +D5s2KCBigvi7 -----END PRIVATE KEY----- diff --git a/ssl/test/axTLS.withCA.p12 b/ssl/test/axTLS.withCA.p12 index ae029dee0fd45e90460d0eacd15f9be1882756ea..fb236c1271b37abe72a3d7e5c3de55aff64a706e 100644 GIT binary patch delta 1901 zcmV-z2a@=y5UCK5U4O`L3jY~zNfH7A2mpYB1Zw73<2doRO_X^F)YU@fV0&9=vf_Ch ztzm0R>pFg&`l=BK2nd->NB$~BoUue8PAVYQgn4Vp;yifNrk|9>8&a|=eY2{~<2QDn z3#{_+&Jnf(s~Zj#+KI4(w>MEbJ1MzC^d9tPMC#>{y6nVp)_?m+-}YdgnTQrP?0qmV z+L1zHnsbNI$`s@7m3B+dDT!np&ihEsESn?@wi7ulN9c1kPW50deiXykD?Bgm)D6+| zX{~iU@Q-6|6ZCU`X>@^+P{isAjWPG5(eCdEA`I)#V4idk5KPal46&S~szkx`fctPw z#s4CL>c*;{iGP&vTmlmEa3BCwNi5Z5k0)sVwef}GF0z`Q+R9HDkaz(=-fAIO-kL?x zC*Oq0g;DS*HgDm|LFqi!n9@$**KW{0cC^ZVFtf>3?MrEJGWB2U^k@!9*3E#v_r5W3 zi#eP0o(Z@**_9mgXK6t=XCchGh3~jyDC7e0{jtV z#Pi>D3rB&^=%A_{CeX}tJIuR2*Navu61-}La&}tKxSX8d27uxiU?8cqEdl|zla#+tef&~?qQh1ek8V$;85#Qm2lWeqLRYH-0d=$#&OI>qt2hrlY2g6^2d zY_fN@`*&U()*y{nvOU!&D>5WT0eSITST0o*8ixfw?|0 zsc-ob8M^C3R+1Ep2M+IV?=yuQJKw*fL;$tkb*AAOZ@R6afyUL?+146}fJ)L3HGfuv z7?6Xf(!-MvXbXJv_8j)I)`xp#)Ox|Z7LhKrGypN;{Zo=AF=&@h-Fd1ZwvfV3L6$X} zpYSULJQ<&u=TcFMwaG_x7%NlM3t&RK!i2y#C@oJuct04j)KL%1=J+o?a}h8>r?jH~ zSU_9nmZZ{LWE?QkH^gC~(8Wy9Py;G<{FB!NMt@L(Ru{~ZX2ml0v0(&1HX3WX& z$NXkS(OU>3v8zfjrWFLsg}DX)HJ>UxctUvaAUC{>?YirBM{!t2;SZ=4iX>GWnc?~9rbt?Rh#Tr=dwyIq@W zEq^AnzyLrkljAFuaT$&58=EcF_NiwG=nBvE?^(o4*rnE5tW277iP;CFx_BR1d zv}rN3NnVH$*WDrb*e_XHrq6dHF!2)YqoNN;;_VfM`0}cgnKu)dh`ktb-gfBH-dsoE(Qm8&<}Xp!C^i7JCx2{at7U4?``==mPbj^ob4Qc5RMzqbi0a5hl>x|af1p>cS&T%( z;?6G~oRczfa;LVX^QP}@h|S$A7k>(i;SmF~?u`fqFQ5%Dp$|5l6~mr__;+C-QHw=B zZ^Tl)8(towWkxfA zFd!$VT=kJ2&7|q`0?;IY?0mSE$CztJ#&22Bppfb&QEVGXMqD)#H7?79YBwd4?Q4V8 zI!X1Pixzx4d;2j=Fe3&DDuzgg_YDCF6)_eB6!~New~3WuYq1z{Z3rLM`d*L_#ct_xo(Flj7J6%}9g~1cC z(b{wOWey{+fuMV(xKGAV=!pZ+-@^y-k9t$xMmfRJ;${RY=mgxUf_j7SshF?u0b@)4 zu>4Fa-mPQlf0iQbQ-N)3L~;jeByi~vJP9h&xjNqpjLDj^+kb$|QDM~6kO^x`J=n^} zv)ZYRqaZ~&^cp|GB|La$)Y3b?OYp@QA57%LVsJB8|E$S79IJ=LoT_Z~XN>X-iW>}` zJznpT1TrSdOiaa3{mVv9*nn_?K0DkEh}Es(kz~<>LmmIm{)w3LkF=zBg$1Do*>+#x zRb(7R4wma)jelK@^!he)EXN(!hcVP)1b&Ii75;EeNPV_E(nh8atkVC-r^erCWUdoyr>Rj-I%$HAg(!Iyh5hl zOJ$>{x)lR^1-2=ChvGjlO15Gs(z^z{!?a`@$$S_!xqlc>GV3i*%_IF0*^m~&$))J@(B^&NmJW}->hzshEZm!O68f z#rd*xi_}{ybmvuDlk?}p#w;!P_FLZMON1TVs#7{*fjpKX1Wkgrnqdu z8&l?Bt^)mszFOX|q5&%J3gDzJZPC&@*U|D zI1QWTIjrjd|EQv3i(s#O!tUX+u{WLEkAKd<$ppO**M6ZTwn2Nz+~vNPa2H!^ygZlL z9fb$pQ23rKet7Jhk}@qzfU;XqcfYM%J?;pO((&k@G74iQFJ!j#1eDQZUsf=py3NK& zul#eRN1!$lmfPO$xw6Pr>wOsR^gJ|BiKQiOTA&Sp;lm^NH(LZVd9-DNUW!2z3V-8V zxiDroRo^cH&4<^?sy@;7?>!4PDCr4ejUdKCZus{r&P+8%x_Lo2?J&KbfJp{*pc95v zPsECFgB9) zm?-nu)IQW=LPG_r^^ee)lrdaFW!sv8i7d9D>-&k)XdU z4p4lZQT^f>6e|hy*~O)}*12x_WjMgE_R}xH%S_8*+yHWrC00CN+4%QWzx+4!^6Si` z=YL3wyY^0&fh>8WGcqm{^L@(}chAo@OiEHiXNF(xw2qI-ts%swx#p<{Fxt_?ky|zK z;qAyb<#7r*7vp)(3DI>r9U;7+b#ZQ{9{>Aa?qgnXak=7FT2)$@u&E({JgS%Ww%}ph zsyyujWa{;l53K&_>JSMOqc*1nU7#JhWPef5u^Z|{E=ynmOn z7?;XJk^_I(fAAF@+ zk_Bau7${AOC3fjQfXO>N-p!&162L@Uk1F+*c*h-c2$zUSdyWL}(`K9nD)_AIFAUBGWq)-XW z4ViHtaP;Ybka;moFe3&DDuzgg_YDCF6)_eB6fw4o;kh(y{#b&8DO?F?Vh4??IFru@ nI3hBvLgVrQOL~*GhrmgY>TCbUpmqcZYikasmiDeQ0s;sCTK}~n diff --git a/ssl/test/axTLS.withoutCA.p12 b/ssl/test/axTLS.withoutCA.p12 index c4eb54c444ca361efa2c3b4e4d5082607b2bb693..a297afe7a79d1576765ca846247bbc9045268950 100644 GIT binary patch delta 1385 zcmV-v1(y1y45bW^U4O@@#T9Ga6Y>HA2mpYB0$|k@Srn|v*0P^bMq8vzL9kPx5Qfc_ za6Xw;gl#wkxGX|$*FOW#<|YceSytlfmI4PWZXM(&bE0w{bC$v zkO<5c+wIkX#poHdW`(Td5(E9Rh^Of>ds@bu4VFWe<523c5`RMGV?r`0vSG+YsgZ@g z1hUQ#Am(llo~?LM!KJpd*o797bMJXelFs4KrNVNNMn|)O5KAE%t7F^JgPUb(6JzOJ z>X9wt?=MIPi|S>*yGuGhMI4d1;-J*_E@dK&A>EB&F1#UmLVzAcA3^9=iYZ;La1 zE39UNgrCwF)(K6)hi$jiyWW9p2bFkVXQ^`HdOii*iDERED0jxAU)p`{Ki_y-UTgBO z4`0RCW6s1f^;9@`YbgDRKQJZ1p$R_yX8lvBV7z5->3>T1#-`3WP5#^gJvHm6FR#9# z_`UY3Sj@S*HaI|vYEv&(ceICDG?f)m^} z%fCnX#+%sgBC-Z`S^KTDJ<7qk=@xVACR++q>x2c56o#QBx}I2XJ5&!K!mo{kfYsOEF@W7eBuaMxRiPz>)7w>L zX#E6Aj*eSzL{%IN4iAY3@o$sqj4K#=D4f>#Kf4Z$Q&V{h<_@b)j4WG%iL*hc*K!V0 z^YoCf^nYbQpnJR9_5=R;nCUYh`_tva7T8-6D#o+Z0kC}u>-|AqD>x6sDS!PXVA?{C zR2EJ);$dtXUG|MvImPwQf)T`JRU7D+JrO&oog`a8alV2>o1Fh*N2ak-r8zc7NOAKc zJ)ueW4gc9-0+C7zgz8KxIDq5a`hAq~fa6#;rGKdjyShP#vo^^b9o7+3JGnz*UFzyI zgu2GKAoYw5*5*IU5LSqam_ddD144^fV)fVoO!ZbYCGKf6tWc)t1&i~m{j7&kUQlRB zppc(qM)TDP#^9$(ZX~^d=sOkQ(`#_;r&&7q6uW}S!GaJJ5!4Yd8Xjj~V495>N; zx6o{IE#tN<{9(L77!)y5Fe3&DDuzgg_YDCF6)_eB6!~New~3WuYq1z{Z3rLM`d*+Q9?}9X)Eds_P8G0s;sCB~7YQ delta 1385 zcmV-v1(y1y45bW^U4N>6#&mVUU%dhX2mpYB0$^mfQ38%E)oJ5rX4WaRWGt%enHLKW z-RNvtgw%;!0f^^tq~Xxn9qTS<;gqiUXVZ+RRzTxWcea}8Toq}KBZ{3)!(VmYE!#2#_vsA#qRpMNu*9LVBr*q)LJn42TONazwR;3{LNn$B4T&{ zp>z0lg>uVb3Ast;bHo6=;B8FL=`ji!So!+0KI7|ufJ)Q2CZ`!)h!TgC*jZoS)Nzyq z^<*4jT||Bjg#(kr?~p;%3XQfhlhime2)M;cnypjPD}N1n!GqR(H4g9Q?n;|(l0DUv zLF+Zp((P7r!cjPp2Xf9`+~$Bh8REoo~iX`wKJ10e%bfl@ zj4fjDg$q|@95_UlfUaZ0iHtISa8b!#Nw6RymUW=|kP8rj*a|J2mOwWc

    $u*0)S z8u9!c34fdcIU4f|H!sxJQR}}MnJkI}SXDYkIN8G+2o|t#nmCBfG@K4KNT8uQV(Z3s z*$&DzJ_u32=s)R8dF{&C)?D~J)IS1S%oYzE_z;}zh-GNAEW|nh0j< zZGR|w0|MO5+I!0B_g~HiwP0$e)@e*VHxVTa*(rh3?q#HK7|o9wQTOLcIL4gF6u&Ee zWaLR1F)K7sC5aCBLol8_^@>vzqe1EAHpS#F4X5i9|Z#$g$hA-omRpO+W3{Y;& zGxHn#EUXQZtz!O=E)bsdr_^lDmJpfs*ar>+)BShXY*=b)OFj1xOjc)+ZXJQ^y}RK8 z^!Z|29~XB-%va;wa)O^9Y{J@iz*hm)P5D2(5=G4GBL8&*yT5{WC^Vm|+cvu@e>Wz= z11xoD$_#>hW8e>Z(M>T@Fe3&DDuzgg_YDCF6)_eB6fw4o;kh(y{#b&8DO?F?Vh4?? rIFrQ%J|bjvzdp4~^@oJ|#aiQ&EM$KU=hXxVZ}elQACIG40s;sC?cf~7 zIK|7Unm`ng3i-DO3*p-53BL_jL55(V!6%Vh3YbP4_M(LNWyj7fmKUm#_+bQ4aO<=~ zx7?b{F##0R&CJ3#ZE1qm#>BqzG^NR=8B;QPh7OT}51~R-s(%3j0|5X5FbxI?Duzgg z_YDC71qA>Dfq?)(w3M2tiE`IJL delta 341 zcmV-b0jmDn1KR@=FoFTsFoFR<0to=|!-v4s^jE`?6GDfq?)EMG4OHX2YiNz%7EAv0S()?W;ngSWExi$ug;b3v&B+=7+M diff --git a/ssl/test/axTLS.x509_1024.pem b/ssl/test/axTLS.x509_1024.pem index 81f3eaf1c4..ca0a8bfdef 100644 --- a/ssl/test/axTLS.x509_1024.pem +++ b/ssl/test/axTLS.x509_1024.pem @@ -1,12 +1,12 @@ -----BEGIN CERTIFICATE----- -MIIB1zCCAUACCQDxw4fA1PRXwzANBgkqhkiG9w0BAQUFADA0MTIwMAYDVQQKEylh -eFRMUyBQcm9qZWN0IERvZGd5IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0wNjA2 -MDcxMTQ0MzJaFw0zMzEwMjMxMTQ0MzJaMCwxFjAUBgNVBAoTDWF4VExTIFByb2pl +MIIB1zCCAUACCQCrCBinAwcn/TANBgkqhkiG9w0BAQUFADA0MTIwMAYDVQQKEylh +eFRMUyBQcm9qZWN0IERvZGd5IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xMDEy +MjYyMjMzMzlaFw0yNDA5MDMyMjMzMzlaMCwxFjAUBgNVBAoTDWF4VExTIFByb2pl Y3QxEjAQBgNVBAMTCTEyNy4wLjAuMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC -gYEA2OC/Fd7qr+jV/QuoqLPXRl2nJmwMtdm8xvjAeND2VmX4KUgOewumJX7oe3lv -OOW1t/TgnJFg9AbzQB75kRmpL0dDtZse3PaqHEl5ISjLqklz2QkFTALyTE1sHICn -FJFE/BKz4efjT0S6jMN0OehM0NRMJGG0QJWMwAq3AjkxhZMCAwEAATANBgkqhkiG -9w0BAQUFAAOBgQALRyRSfbZjeLyA3YdskEwzw1ynlwkcCU+bbrNaPkaSGseHFVnh -iFzOauKWqjLswu14i+CQZpMUw5irMzXTfV1RCpy5EFhHepiVZP9MXYIZ+eoPXprL -Midkym9YitDANvS5YzSl2jZQNknStzohM1s+1l8MmYO3sveLRMRec0GpAg== +gYEAzf2JSL42uZV21BMwDr+y7WcKwBY/UQmdKS+ybT8+bC+QgKFx3744xcupmkAU +kAr5twcL4drnCb8NV0GGYKHBJ5FbCphGG/aihPhlx84tlheqkfhhBFBw67RDt9ya +zDEBFNTNzMI3bWmC1sbEvvI0pcmmGVMyeoYOkYIPoUJUqgECAwEAATANBgkqhkiG +9w0BAQUFAAOBgQBAtJSaqIlyHQfls2uIIcI4Np56jElIaAwG6NsfTgXmMeP95g1r +2BMX4C0NuH7LIGyoc6f946f68wJgeB8TQEXudfUQ/Y9odNSsrgQJVSzb2AcHZWkn +br9eYUBWi9czO/9uU36dP8BAOqugUE6AR0YNHttM8RtdPCpUp036e3JmxQ== -----END CERTIFICATE----- diff --git a/ssl/test/axTLS.x509_1042.cer b/ssl/test/axTLS.x509_1042.cer new file mode 100644 index 0000000000000000000000000000000000000000..c1e1a6863d8f599f8078004eee1faa876984a844 GIT binary patch literal 477 zcmXqLV!Ub4#OTDt$*`J3VmULr`ac6+HcqWJkGAi;jEt?Mjh>z3lisv8BZ7bXiy3h<9gZjOWtrj7$a41b7qeqoFV}uBj0zwOs~r)mtJzc!#9`fSkzDXaS891pgpvJ{joy&Kd%)azfQP+cflf%Q4UI=b(ki8R?Rn9shf+&9|tn_bDB5)=C^y3+y3O0vcP literal 0 HcmV?d00001 diff --git a/ssl/test/axTLS.x509_1042.pem b/ssl/test/axTLS.x509_1042.pem new file mode 100644 index 0000000000..ff80079a36 --- /dev/null +++ b/ssl/test/axTLS.x509_1042.pem @@ -0,0 +1,12 @@ +-----BEGIN CERTIFICATE----- +MIIB2TCCAUICCQCrCBinAwcn/jANBgkqhkiG9w0BAQUFADA0MTIwMAYDVQQKEylh +eFRMUyBQcm9qZWN0IERvZGd5IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xMDEy +MjYyMjMzNDBaFw0yNDA5MDMyMjMzNDBaMCwxFjAUBgNVBAoTDWF4VExTIFByb2pl +Y3QxEjAQBgNVBAMTCTEyNy4wLjAuMTCBoTANBgkqhkiG9w0BAQEFAAOBjwAwgYsC +gYMDUYXtMubODhuyrWhYD7fomF6ZQMdjvQSYQIEEzdP0NsZq6a3wM1k6dMB1hmMs +GbT5jNfen3JdhL2s8AQ4rio6HJD3RCegOKr9Rt2r62MvWFSMflc6X4bH+bFxsnIV +jW6D+FLSeVPeVxpB0BVIQv2qSFNrTDlYbKU/RtGDx+TfgM354QIDAQABMA0GCSqG +SIb3DQEBBQUAA4GBAIEoXdKa4a2ThBYfcfAO8CCwnU4qUKOpAut3k3XSRdwOnQrG +epJ3UP1OpoMeoN2gtagcjcTzhXv/QPYbx5lRko5QfERFJwpNthy+Z8pa11JNY1dX +YugRs4Ad1BoKrCBYnm/QE7ZKVPEGFt2b/geFAW8HpndNWzn2PnTcdDQ/tC2X +-----END CERTIFICATE----- diff --git a/ssl/test/axTLS.x509_2048.cer b/ssl/test/axTLS.x509_2048.cer index c0badf7288617f5d618a62e1ad4a1343697a98ca..d92c8f4cf8cab97ab0efc225138b25ef3314bee7 100644 GIT binary patch delta 470 zcmV;{0V)391m6S`FoFVGFoFTZ0to=C2pFdW2PglL6GzBcJe|1#G@wcOJ_RbFZ{VD8d=Jgtx@?eB;+i!?A(}@Q z*Q`2?n}5`V8mO0fbZmyV{L$*aX=dJd4Atuip9z6kIr0SPsih$_+7Th;B4R)6a-;X9 zn1Nz7Pc!J{)flTH+fvuvNunx+hQ1DVL!>-R71UDlhr2hw(|?BoguI(|H*v7|=GIie zu?0#23a}FxQn57NE|HG`%GSe1Y@JEM{+?PZm_7>!echHJ-^o@f1$iY;SYtM*PJ zi>)h?d*!9U=F%%`y#B;uL&16#k~Y0tc1xjS9Jm=iDC4@!Tj_LVzu+u>WO|c)XPBf_ zf}$_JUJo)=7JrK^0s{d60Wb{)2`Yw2hW8Bt0R#mA1A&167`qR?XFk5`$56g!eKH~5 zVVqU5sKX~jRT3qASM z0gAIAV!eeFdw(UZ0s{d60Wb{)2`Yw2hW8Bt0R#mA1A&16JTF#r^sbEj^a5dO-<>$y zJf=3SFm*cgmC;Nx}i8(rB0aR&OI#=zqWUXjRU!ZQZ3j7*Qz6y)z?A z15`Yyf&Q=Yzzt^3#>i&I=Y)b2Q{HAco$(eJ9AH;T;v2?`?wV;&H_pYMq4qVK4+se) M3^D$%j_+%P=U7A5J^%m! diff --git a/ssl/test/axTLS.x509_2048.pem b/ssl/test/axTLS.x509_2048.pem index 1ed0141afb..18c0b45345 100644 --- a/ssl/test/axTLS.x509_2048.pem +++ b/ssl/test/axTLS.x509_2048.pem @@ -1,15 +1,15 @@ -----BEGIN CERTIFICATE----- -MIICWzCCAcQCCQDxw4fA1PRXxDANBgkqhkiG9w0BAQQFADA0MTIwMAYDVQQKEylh -eFRMUyBQcm9qZWN0IERvZGd5IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0wNjA2 -MDcxMTQ0MzJaFw0zMzEwMjMxMTQ0MzJaMCwxFjAUBgNVBAoTDWF4VExTIFByb2pl +MIICWzCCAcQCCQCrCBinAwcn/zANBgkqhkiG9w0BAQQFADA0MTIwMAYDVQQKEylh +eFRMUyBQcm9qZWN0IERvZGd5IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xMDEy +MjYyMjMzNDBaFw0yNDA5MDMyMjMzNDBaMCwxFjAUBgNVBAoTDWF4VExTIFByb2pl Y3QxEjAQBgNVBAMTCTEyNy4wLjAuMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC -AQoCggEBAMKgv9v6z3AGRLOf3o092S/ENz33Z2tlguOIuh2Apwp2ziHFvul7m9iF -xsEcEARcvpkRPVo6ifJLjhJErenvvMAIS3WoO1lyenMaGoNddLeRRB0snRn7xRcl -DYzCYS3fhJmkE06RL/TCTyY9GXa7odRI8kcWuByZog/be15lsgn0pjNKjJICdCer -Otq0TAV/pfzRBF9lcyboHWQFOu9UVmDp3LsV/9o1GJbyKiNZd0j/GnDFOQbXy7GD -I9PJTRzo4GQj0cJHY7JelORKiIsymcoMNRTboFRAx5y9jAGF8Ks196Rq/+9gYsvi -eE0h+pbdLLbM0uZvAYqzIGK9hRR7Ja0CAwEAATANBgkqhkiG9w0BAQQFAAOBgQA8 -L1Zz9K6M/PQCYWrfnTjbPKY2rTB1OvSV0Uwy5KKPQRS1+oK9dx4K0miX+1ZvI1bo -f7/1aFXOsW3dpTwYUSjJvTMjSwNUPKiB/q/xwA1mzsbIZsbnhIITU95mOJ3xFhgc -YFdJ4saL7pppTzfOxZ+h9jWbDwgJJAwx/q+O72uE5w== +AQoCggEBAKWgulghnDyduQE0oEn5PgUqoW/gnHB8D83dumyQU+KaNUQhmkcX16w6 +jZt/1IQaqJd5dGyGt/zR6r9pZt54DNXrCZ8JgVk58gToqaUhNNoRIeUiYj/scqP3 +pZiBYjVPM+jl1RirIttS191JoiqFhr4OdkOkPEwV1FLyh7s3v9OHAoS8m3U3cbD4 +5tZUwLEFSgEKsBMYUrE03i6RjwHK1sNGbJ1Jwv6eWlGLqYnlGI1TgoZrx5SeZ/2R +ii1jXKv2TiKLrSuSe+WlwebSK2u8/sRiQ8F6FZI2vVt2S6FjHLgZPijjusxb6XRl +v+AsfmR6k3xnmKRVgqIvvl4PMlUWiy0CAwEAATANBgkqhkiG9w0BAQQFAAOBgQAY +uw++Zz6+68dQvmd9MiHeYZxVsajDJ0RVEiV9V/TFLsGmJXmtHHX0vVjZJSpDomWJ +WKPZu/HvR6KrtOtz+HM2ap5FFfPcg5LA2Dqau2tvTub1KdvDSbfaTqRsh1cQ8FQI +222gV/DG5AZ8AlSuDzTgrMuIeWjKZ6hhkirZVIO+rg== -----END CERTIFICATE----- diff --git a/ssl/test/axTLS.x509_4096.cer b/ssl/test/axTLS.x509_4096.cer index 40bbe94fdd8d5fc57dd7463e4e9530b9d661e7c6..03d110d57d7b7c789a2e50fc77fd0f0fd277ca01 100644 GIT binary patch delta 728 zcmV;}0w?|72Hyq~FoFYHFoFWa0to=C2pFdW2PgoM6G9K1=I8HROg|p+1F=O{_L~U zx=TEYHKzFG&Hn4lgGL!ZI!?Abt?Zg0>3z=*yTDHf{l6Nty%m{M|z$?N~GZfa&6?#vD#hY5(3Q9a4T0*tGe(Ft6O;-?^ z5C%F<@^3Rfw--TTl+taOmOr~GdK)(nn7CLdWf(~;M^tEIe?>)9rZ-b(z&fldu889x z)h3mjT0%dJ!+(=(7_LcQ9V0&@(3!*A2 zpMK32-0F?=hoLhJnSAONHFdP6NwU;F{`Wf6f~n*u3VW;1W%ft@-r2|4f9|*tLTng( zG+Vzxh${r}6pmrUe^-i=(4{Q`yyZVh>7l75SoFtLW`EoJ|`j#EdTCOP)XHc~{q|4pm1IR5A$oJ8}Ay$)$CsDSP zY?uUk34b+F2>}8F0RRCo4F(A+hDe6@4FLfJ1potqfdGmT1%$9B3t|4jV;YYUPPl2x zz<>fvW!Z^^_T&FBHAcw_@jr<>_3uVcojrO2$Ln+B$ywD;Q+WH?xn&+QhqfqS284nc z$BNpsc_aJaS2?;7vjHR)RdOE%9J5EM9R^%WU>$o|JO_!0>azEL)?=6{7=Uj`i?;lu Kdp0#aUf@nTXG*vL delta 728 zcmV;}0w?|72Hyq~FoFYHFoFWa0to=|!-v4s^jF1^6Gmaox?BB8At*_qHegN_Cm(UerlhGFqSp+Cz&}#6X`{2H3(| zN2wGExlD97fXsOeCn^W`4Pn++s+M#D>;O(~wfl~y;qgj?b^u`WqW``cC|ig?96y!M z7XS2>*B=ru_WY5}SzEd@PpCx)1I&la zpN50(f~}LjpktBkY~Bg4!8inQ|Da>u>Ru*7UzXwh=w_Xs?;*KZ6+rgL$!sa5#wCm% zhjof3R40eMa6w2mGZwmv4&f!N}s;~pPl6je9nV2!grWg(!oG)E6aIa;H)(*Iod{)t9s8dAW=H7 z3z)e#dVhbztB(Q$0RRCo4F(A+hDe6@4FLfJ1potqfdF!_tvz{}$o2Hr<4lKT^;SqG zQh)O;>7shNF706dhrCO4>3DhKqZAs5h%J5J&8E~cxQ9`EF~_QC$P>BXiKMeT17|Qd zds_4QMn7zXRu^f9T@R7ePZ#hM@R_lkR)7x2IvxA0R&Bc7HvVyP^Yv_!mRWDN&`41i K)A5aXgiUw+yjTVR diff --git a/ssl/test/axTLS.x509_4096.pem b/ssl/test/axTLS.x509_4096.pem index b7aed1caba..a9517fe375 100644 --- a/ssl/test/axTLS.x509_4096.pem +++ b/ssl/test/axTLS.x509_4096.pem @@ -1,20 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDWzCCAsQCCQDxw4fA1PRXxTANBgkqhkiG9w0BAQQFADA0MTIwMAYDVQQKEylh -eFRMUyBQcm9qZWN0IERvZGd5IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0wNjA2 -MDcxMTQ0MzJaFw0zMzEwMjMxMTQ0MzJaMCwxFjAUBgNVBAoTDWF4VExTIFByb2pl +MIIDWzCCAsQCCQCrCBinAwcoADANBgkqhkiG9w0BAQQFADA0MTIwMAYDVQQKEylh +eFRMUyBQcm9qZWN0IERvZGd5IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xMDEy +MjYyMjMzNDFaFw0yNDA5MDMyMjMzNDFaMCwxFjAUBgNVBAoTDWF4VExTIFByb2pl Y3QxEjAQBgNVBAMTCTEyNy4wLjAuMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC -AgoCggIBAPwntJldKsrQMAz6410QZVIdoHSrNrYQ8NzdfKMF1a0lBavUsAGjDa5n -qfQ0fTBAC3HTJtxghCe7DjohEHKk89uXYt+liQ3vo6Nc+Zw9l2bDyLKffpOdVc/l -tweL7FyQIM1fl2W5r/S9OffFRMJKXiN1HPXrfGYRrwz6B2cgUBtSgI+odwCmdfjb -Ya4Wo8Za53UGeQ7v0eQ0lEDgXAhx3c2YIoXXxfe2J/5KdZnpXtRJWTJaoAbaQ4tU -xECfVwbYwltHqRQJuUx0N4DMeQwnKgf3DWHWVqqWdALsAE5utfuOpuHxSoN2AGDz -ov++GihbiEAcP5XPFv/0ldcfEi/4X9lyHb0mvUIa6DTdHd17thFEM12caD0TCszq -in8JWVu6M0+oRQcDzIfMn4aD7oKtk76gY5HtbN4Jr8E4BHH/oGPe6l4mQl+W4f3o -Zp2e7yG5WBVA9sjJbCmlxiWMHod1iiZUJ4e9cEFINjMWuooPIo6xKMzZcGHzwkBa -zS6kHyTsHcfdHcu4aVMlJ9cKN/aesJgup/XseM3imzuJ3UqfvwCfneUKfM6DM8J3 -mFfSwUBvK8uLsMw5Elim/1oIbBG0PTt7BiLiNd0pU/weuL92y2+QB2oCPM0t5D7L -IYyoZHHNlvTCkQVNsCHgrDUtOdpGlKt6zzEgUTqwC5i5N3p/w6uPAgMBAAEwDQYJ -KoZIhvcNAQEEBQADgYEAcrCtPXmZyPX01uNMh2X1VkgmUn/zLemierou7WD/h7xL -dOl4eeKjFBqIiC19382m1DK4h1F8MceqaMgTueCJpLM7A2cwN3ta8/pGP2yEVhdp -h10PkdRPF/AU8JmxnFaADsc6+6xWbbrdNv5xcvP1bJKWWW+30EhRF9PxjXiETXc= +AgoCggIBAKOYAobI/sEAa0jY3Wnh2UBTQbKzLIEF0/PuVOehqtnXZ1T+7LPTuks8 +ijWm+OXN/uvLg0YZQDpOtjut7Jog6X3PDr1fnGCZB9ByzUqVDCC3OtY3Vlp8ax0b +x0JuQ65ZHP7PlQn+2DDcmzsymooHXWdajCOb7TXdZCt48fau9fE/1pp4+Z0sKUiu +bld/ihm5IgbmwSbRWrbHzZJ3MavMCHMKwCvCUDMU1s4Vek+DxZta3ApKPB5aQrW9 +fupNT01XEJkQBjpO8m8zPrcXQWKU0m2Ylj+7KXobNw+YuFgoZRhJLEdUaGN/RUVU +pjdTZ8A6rCquiOMg1SaVm1pCP4zDk2wYrklfHSM/I9CZxBoixWEmYcVNAxREcm5Q +LmLWhvE8PTL5MoOhkaOAn37NFtzqjfSHoTMMmXzqFjV1tKZJstQ+/vc61IKp5CcK +e6vPZfZH/t7Zx9h/7rgQQmwYfDRbv0GIKwTwFI5hxH9XipPQpS0CvOU/SemhqSVY +9MdVZtv75Wq7Oagcd00qwvgSoNhVUKEym2zeckkt2ukcllohpLr5H7xRSlk1vXfJ +aXh9Yr1zxr1FWeSzlv9lu6VAFd7RV++i0fj99FnjgWMFUHvfXVExCS+jnD1VzfqW +Hc1arikSZ1C1OaTL3eEDyC0RyPfRwCFWk4onUbaUbJgEegk1UQkBAgMBAAEwDQYJ +KoZIhvcNAQEEBQADgYEAihEFhLAmC2H+wWMajxFOuGnKwIACS2XZiYX24/8wNUbJ +CvE/iTv170ZPnT16Asfrc+PJWdVPU3j72bllHjKHtihgBoSCGceK2rN5I/vgVzm6 +EbMBJBZVch8FHLNHqR0GXEtge1k8B4mI6rL3f9ZjmCkYgG9Ii7b8o3s2NT1e4E4= -----END CERTIFICATE----- diff --git a/ssl/test/axTLS.x509_512.cer b/ssl/test/axTLS.x509_512.cer index 48c6e13aa0af5678668c7d4a3245a3304030f01e..ab8537901dcb554c3e8913db640427ff6f96b5c0 100644 GIT binary patch delta 255 zcmV`1I7^edVC;X8TNgFXRF)}hXGBPtWGdNlo4Kg$^ zIWRLaGBYzXIFWWpK*-8nPP?|aIqFW!gl=!;cx+KRRTPd{I+q%^`tsdqZ6z+M-dVxk z@sQ$w)Z?*x$#qjAkjc@UZ`v8Z(6{b%7m@xLe;bx|S`^y`v>6C1+Uh2tbsc^!%V|{b z0>!-N!FDAFT{!L0Kmvv;%yz$e5Vmf#_?+PV(xvXGYp^n4OR7uKI{h4LA$kt zX?|rM7UpH}O0!wA=0d|EHa!9p&aSlcr;{icMS==F6)@eB!|iKhrrbISHh7JNgFUWFg7qZF)=hWGcsBi4Kp(_ zFfubSF*GzYGLd#jK+!ueU#S5?J%(*^zCdnK!AXBtb)hXb<-t7_Lcx{!|rfVZ|0=xRXKgPd)!Gy^;PHe+orDi@;j-#pg+HimSdbeiH?M(w-AE z)znMWx6-o`7W7)LwQ;<&^_G?+^z?NkWSKB;!Ri!v%ISqhJRXg1Caw0FoFS%FoFR$0to=C2pFdW2PgrN6G0j=FflSRHZn3ZGc+<<7Y#Br zFgY+YGBPtWG?8vhf5+Ic+WiX7T;j*FqQYw=ShKz=m1$)6BGa^jRmSOoB-%L9JO=U) zlB=TOwU9s$yIE+@SB?TA)*)kaSBe0!S`eypPnuHnb2ON)JZ=mQ;5BrCyTZ3p<-zd+ z)JYeDg9Ex|a2H1Dps8IfuUg8UtX$?E?biWwz?F>Xs?AV?Sfc_10RRCo4F(A+hDe6@ z4FLfK1pos<0K9l-*{D_!H028vtjMy<|BVVEVQA}FeeR?ZQfLBR0n|qZLW=yOF*k5q Yi#WHCV&E6$id&}}ntg`z!%!UoPq&g1Caw0FoFS%FoFR$0to=|!-v4s^jF4_6G0jnjsjMQ#-5S83#m?5K#sU z-Iw3AEww`>j~GhTAcqO=&eZ-QlR~XaSG5wn3VqN&=I+fWwq#?~ph8G)^?yR=O8sk; z4Px# diff --git a/ssl/test/axTLS.x509_device.pem b/ssl/test/axTLS.x509_device.pem index e9cbaaf314..048dbd9220 100644 --- a/ssl/test/axTLS.x509_device.pem +++ b/ssl/test/axTLS.x509_device.pem @@ -1,24 +1,24 @@ -----BEGIN CERTIFICATE----- -MIIBjTCCATcCCQDxw4fA1PRXxjANBgkqhkiG9w0BAQUFADAsMRYwFAYDVQQKEw1h -eFRMUyBQcm9qZWN0MRIwEAYDVQQDEwkxMjcuMC4wLjEwHhcNMDYwNjA3MTE0NDMy -WhcNMzMxMDIzMTE0NDMyWjArMSkwJwYDVQQKEyBheFRMUyBQcm9qZWN0IERldmlj -ZSBDZXJ0aWZpY2F0ZTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1CIODRIr -v3YgwJW7Fm0wITCsOIgX9l+aIRiXUzur4RkHRJIQUQYM3ZfftC21QyWPGErVIIcJ -7s7U/iKTQq1LV7USvAp90D/m7s0ntmRj1aBCSG71f0LnSv1rlA8kzUkU7VuEt0Tt -+iqrW0+sYdUBk11dyPLKe6sJnMrJJamVvBsCAwEAATANBgkqhkiG9w0BAQUFAANB -ABC3Uc6uImIpcLl1WYu8K8qkGnVT4K9JkdXHQFbhFZs37lvITrOHQ3j2oGXTbdAx -JFJ3II9xXkm+nc7oLHqhXlc= +MIIBjTCCATcCCQCrCBinAwcoATANBgkqhkiG9w0BAQUFADAsMRYwFAYDVQQKEw1h +eFRMUyBQcm9qZWN0MRIwEAYDVQQDEwkxMjcuMC4wLjEwHhcNMTAxMjI2MjIzMzQy +WhcNMjQwOTAzMjIzMzQyWjArMSkwJwYDVQQKEyBheFRMUyBQcm9qZWN0IERldmlj +ZSBDZXJ0aWZpY2F0ZTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAx9iw2v0K +zlzix7KiwmskWLO+KpVpZPci07SCVcbpgSTaONE8BvIPkqui4bWQQA+7WWjPV44C +ItYhY3NXigCxWhCqc0+aUvRzNJiuPG4MDuA1dIG7wrdS5cHxAtRJF4KDA7pmcBdG +6aCpXSyvWsqerFzmHu3XAXPAlYzoqs1Qg6MCAwEAATANBgkqhkiG9w0BAQUFAANB +ALx4Z9moVhA05QsUrMiyy/+NCiFhaOtZfe6kElJoAl4B1EcGQor8ozE3cFuLOLeQ +YuAX5YpbpxuafYbzw1AdAU8= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIIB3zCCAUgCCQCdbnM4pjqlWjANBgkqhkiG9w0BAQUFADA0MTIwMAYDVQQKEylh -eFRMUyBQcm9qZWN0IERvZGd5IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0wNjA2 -MDcxMTQ0MzJaFw0zMzEwMjMxMTQ0MzJaMDQxMjAwBgNVBAoTKWF4VExTIFByb2pl +MIIB3zCCAUgCCQD76Ccq3Co3qjANBgkqhkiG9w0BAQUFADA0MTIwMAYDVQQKEylh +eFRMUyBQcm9qZWN0IERvZGd5IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xMDEy +MjYyMjMzMzdaFw0yNDA5MDMyMjMzMzdaMDQxMjAwBgNVBAoTKWF4VExTIFByb2pl Y3QgRG9kZ3kgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUA -A4GNADCBiQKBgQCnZdk20fYWh8O6kDTt0AuJWyp0YIrb7W1UNNMPXI5wA4J59IVj -Nmk5wocm9+Hqzbg7rORAN/mHPBhzLAjhnm1HODs36hW15DtbDkkH4wCM/Tsyv79m -n0xq1V6peK3t9vi2D4p/IRjHkYR2jm+BeknopijhY0kHHfpGTHa2DnVirwIDAQAB -MA0GCSqGSIb3DQEBBQUAA4GBAB0LgNo0oCcwIie5plgwwFybQ8x95q6e3wndM/Mp -3gjcAFbGuchpo3dfFlTcRI0KyERb3q1MVxPM4sff9nT7EdHVyK9s8/ITkP2dcTKc -flbcTEfJVIeM8L2P5F41Hvn9GuGcMW8EmsC06gdbp1LLnqsdrXdMNBsAUBXfgPrU -+UcZ +A4GNADCBiQKBgQCfxX6VHEhZNsMIqPPxt53h1UpfX1jU7ctqwBR4dpWRj3H6cCBN +EK8xj7IVcBTJq6vcMRDwrAUrElSIZl8Kv6+ZqhTss2j+E2tfzkzehP9LcAdAR+UM +JPBsYXic/+vmH5JCMO7CXLUsDJmO2q2Z1TjTtchu2DgAueTo0hWRtMvbMwIDAQAB +MA0GCSqGSIb3DQEBBQUAA4GBABoJU0aQMTocVLNbcY4tbfqLck2oAn/OVjG0p/8p +GIJzlVKOtZ76ZkqHIbcXNKNlgjXy+4S3R+6+mkYcn0JVbVg7eN0tsDlMB04YyFaD +95D47KEzmDky4Yj2nqI4SmvVTf2lyYxV1zknrFUXND+WvjGxge3gpJxtMoTGE5E0 +Jc3F -----END CERTIFICATE----- diff --git a/ssl/test/killopenssl.sh b/ssl/test/killopenssl.sh index 17950fbaef..f5adf2db51 100755 --- a/ssl/test/killopenssl.sh +++ b/ssl/test/killopenssl.sh @@ -1,2 +1,3 @@ #!/bin/sh ps -ef|grep openssl | /usr/bin/awk '{print $2}' |xargs kill -9 +sleep 1 diff --git a/ssl/test/make_certs.sh b/ssl/test/make_certs.sh index dfc39d4f53..08f3993498 100755 --- a/ssl/test/make_certs.sh +++ b/ssl/test/make_certs.sh @@ -69,15 +69,18 @@ EOF openssl genrsa -out axTLS.ca_key.pem 1024 openssl genrsa -out axTLS.key_512.pem 512 openssl genrsa -out axTLS.key_1024.pem 1024 +openssl genrsa -out axTLS.key_1042.pem 1042 openssl genrsa -out axTLS.key_2048.pem 2048 openssl genrsa -out axTLS.key_4096.pem 4096 openssl genrsa -out axTLS.device_key.pem 1024 openssl genrsa -aes128 -passout pass:abcd -out axTLS.key_aes128.pem 512 openssl genrsa -aes256 -passout pass:abcd -out axTLS.key_aes256.pem 512 + # convert private keys into DER format openssl rsa -in axTLS.key_512.pem -out axTLS.key_512 -outform DER openssl rsa -in axTLS.key_1024.pem -out axTLS.key_1024 -outform DER +openssl rsa -in axTLS.key_1042.pem -out axTLS.key_1042 -outform DER openssl rsa -in axTLS.key_2048.pem -out axTLS.key_2048 -outform DER openssl rsa -in axTLS.key_4096.pem -out axTLS.key_4096 -outform DER openssl rsa -in axTLS.device_key.pem -out axTLS.device_key -outform DER @@ -89,6 +92,8 @@ openssl req -out axTLS.x509_512.req -key axTLS.key_512.pem -new \ -config ./certs.conf openssl req -out axTLS.x509_1024.req -key axTLS.key_1024.pem -new \ -config ./certs.conf +openssl req -out axTLS.x509_1042.req -key axTLS.key_1042.pem -new \ + -config ./certs.conf openssl req -out axTLS.x509_2048.req -key axTLS.key_2048.pem -new \ -config ./certs.conf openssl req -out axTLS.x509_4096.req -key axTLS.key_4096.pem -new \ @@ -102,29 +107,32 @@ openssl req -out axTLS.x509_aes256.req -key axTLS.key_aes256.pem \ # generate the actual certs. openssl x509 -req -in axTLS.ca_x509.req -out axTLS.ca_x509.pem \ - -sha1 -days 10000 -signkey axTLS.ca_key.pem + -sha1 -days 5000 -signkey axTLS.ca_key.pem openssl x509 -req -in axTLS.x509_512.req -out axTLS.x509_512.pem \ - -sha1 -CAcreateserial -days 10000 \ + -sha1 -CAcreateserial -days 5000 \ -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem openssl x509 -req -in axTLS.x509_1024.req -out axTLS.x509_1024.pem \ - -sha1 -CAcreateserial -days 10000 \ + -sha1 -CAcreateserial -days 5000 \ + -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem +openssl x509 -req -in axTLS.x509_1042.req -out axTLS.x509_1042.pem \ + -sha1 -CAcreateserial -days 5000 \ -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem openssl x509 -req -in axTLS.x509_2048.req -out axTLS.x509_2048.pem \ - -md5 -CAcreateserial -days 10000 \ + -md5 -CAcreateserial -days 5000 \ -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem openssl x509 -req -in axTLS.x509_4096.req -out axTLS.x509_4096.pem \ - -md5 -CAcreateserial -days 10000 \ + -md5 -CAcreateserial -days 5000 \ -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem openssl x509 -req -in axTLS.x509_device.req -out axTLS.x509_device.pem \ - -sha1 -CAcreateserial -days 10000 \ + -sha1 -CAcreateserial -days 5000 \ -CA axTLS.x509_512.pem -CAkey axTLS.key_512.pem openssl x509 -req -in axTLS.x509_aes128.req \ -out axTLS.x509_aes128.pem \ - -sha1 -CAcreateserial -days 10000 \ + -sha1 -CAcreateserial -days 5000 \ -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem openssl x509 -req -in axTLS.x509_aes256.req \ -out axTLS.x509_aes256.pem \ - -sha1 -CAcreateserial -days 10000 \ + -sha1 -CAcreateserial -days 5000 \ -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem # note: must be root to do this @@ -149,6 +157,7 @@ rm *.conf openssl x509 -in axTLS.ca_x509.pem -outform DER -out axTLS.ca_x509.cer openssl x509 -in axTLS.x509_512.pem -outform DER -out axTLS.x509_512.cer openssl x509 -in axTLS.x509_1024.pem -outform DER -out axTLS.x509_1024.cer +openssl x509 -in axTLS.x509_1042.pem -outform DER -out axTLS.x509_1042.cer openssl x509 -in axTLS.x509_2048.pem -outform DER -out axTLS.x509_2048.cer openssl x509 -in axTLS.x509_4096.pem -outform DER -out axTLS.x509_4096.cer openssl x509 -in axTLS.x509_device.pem -outform DER -out axTLS.x509_device.cer diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 328bbdca3d..86997d7859 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -66,6 +66,7 @@ static int g_port = 19001; #define TEST1_SIZE 16 #define TEST2_SIZE 32 +#if 0 static int AES_test(BI_CTX *bi_ctx) { AES_CTX aes_key; @@ -419,6 +420,7 @@ static int HMAC_test(BI_CTX *bi_ctx) end: return res; } +#endif /************************************************************************** * BIGINT tests @@ -427,10 +429,12 @@ static int HMAC_test(BI_CTX *bi_ctx) static int BIGINT_test(BI_CTX *ctx) { int res = 1; + +#ifndef REGISTER_8 +#ifndef REGISTER_16 bigint *bi_data, *bi_exp, *bi_res; const char *expnt, *plaintext, *mod; uint8_t compare[MAX_KEY_BYTE_SIZE]; - /** * 512 bit key */ @@ -461,6 +465,47 @@ static int BIGINT_test(BI_CTX *ctx) bi_export(ctx, bi_res, compare, 64); if (memcmp(plaintext, compare, 64) != 0) goto end; +#endif +#endif + + /* + * Multiply with psssible carry issue (8 bit) + */ + { + int i; + bigint *bi_x = bi_str_import( + ctx, + "AFD5060E224B70DA99EFB385BA5C0D2BEA0AD1DAAA52686E1A02D677BC65C1DA7A496BBDCC02999E8814F10AFC4B8E0DD4E6687E0762CE717A5EA1E452B5C56065C8431F0FB9D23CFF3A4B4149798C0670AF7F9565A0EAE5CF1AB16A1F0C3DD5E485DC5ABB96EBE0B6778A15B7302CBCE358E4BF2E2E30932758AC6EFA9F5828"); + uint8_t exp_sqr_result[bi_x->size*2]; + uint8_t exp_mlt_result[bi_x->size*2]; + bigint *arg2 = bi_clone(ctx, bi_x); + bigint *arg3 = bi_clone(ctx, bi_x); + bigint *sqr_result = bi_square(ctx, bi_x); + bigint *mlt_result = bi_multiply(ctx, arg2, arg3); + //bi_print("SQR_RESULT", sqr_result); + //bi_print("MLT_RESULT", mlt_result); + + if (bi_compare(sqr_result, mlt_result) != 0) + { + bi_export(ctx, sqr_result, exp_sqr_result, sizeof(exp_sqr_result)); + bi_export(ctx, mlt_result, exp_mlt_result, sizeof(exp_mlt_result)); + bi_free(ctx, sqr_result); + bi_free(ctx, mlt_result); + + for (i = 0; i < sizeof(exp_sqr_result); i++) + { + if (exp_sqr_result[i] != exp_mlt_result[i]) + { + printf("Error: SQUARE failed %d %02x %02x\n", i, + exp_sqr_result[i], exp_mlt_result[i]); + goto end; + } + } + } + + bi_free(ctx, sqr_result); + bi_free(ctx, mlt_result); + } printf("All BIGINT tests passed\n"); res = 0; @@ -755,9 +800,7 @@ typedef struct static void do_client(client_t *clnt) { char openssl_buf[2048]; - - /* make sure the main thread goes first */ - sleep(0); + usleep(500000); /* allow server to start */ /* show the session ids in the reconnect test */ if (strcmp(clnt->testname, "Session Reuse") == 0) @@ -882,7 +925,11 @@ static int SSL_server_test( while ((size = ssl_read(ssl, &read_buf)) == SSL_OK); SOCKET_CLOSE(client_fd); - if (size < SSL_OK) /* got some alert or something nasty */ + if (size == SSL_CLOSE_NOTIFY) + { + ret = SSL_OK; + } + else if (size < SSL_OK) /* got some alert or something nasty */ { ret = size; @@ -1392,7 +1439,7 @@ static int SSL_client_test( client_test_exit: ssl_free(ssl); SOCKET_CLOSE(client_fd); - usleep(200000); /* allow openssl to say something */ + usleep(500000); /* allow openssl to say something */ if (sess_resume) { @@ -1566,7 +1613,7 @@ static void do_basic(void) SSL *ssl_clnt; SSL_CTX *ssl_clnt_ctx = ssl_ctx_new( DEFAULT_CLNT_OPTION, SSL_DEFAULT_CLNT_SESS); - usleep(200000); /* allow server to start */ + usleep(500000); /* allow server to start */ if ((client_fd = client_socket_init(g_port)) < 0) goto error; @@ -1692,7 +1739,7 @@ void do_multi_clnt(multi_t *multi_data) if ((client_fd = client_socket_init(multi_data->port)) < 0) goto client_test_exit; - sleep(1); + usleep(500000); ssl = ssl_client_new(multi_data->ssl_clnt_ctx, client_fd, NULL, 0); if ((res = ssl_handshake_status(ssl))) @@ -1869,7 +1916,7 @@ static int header_issue(void) size = fread(buf, 1, sizeof(buf), f); SOCKET_WRITE(client_fd, buf, size); - usleep(200000); + usleep(500000); ret = 0; error: @@ -1911,6 +1958,7 @@ int main(int argc, char *argv[]) bi_ctx = bi_initialize(); +#if 0 if (AES_test(bi_ctx)) { printf("AES tests failed\n"); @@ -1945,6 +1993,7 @@ int main(int argc, char *argv[]) goto cleanup; } TTY_FLUSH(); +#endif if (BIGINT_test(bi_ctx)) { diff --git a/ssl/tls1.c b/ssl/tls1.c index 94f413b533..809d45cb01 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -245,8 +245,10 @@ EXP_FUNC void STDCALL ssl_free(SSL *ssl) if (ssl == NULL) /* just ignore null pointers */ return; - /* spec says we must notify when we are dying */ - send_alert(ssl, SSL_ALERT_CLOSE_NOTIFY); + /* only notify if we weren't notified first */ + if (!IS_SET_SSL_FLAG(SSL_RECEIVED_CLOSE_NOTIFY)) + /* spec says we must notify when we are dying */ + send_alert(ssl, SSL_ALERT_CLOSE_NOTIFY); ssl_ctx = ssl->ssl_ctx; @@ -284,7 +286,7 @@ EXP_FUNC int STDCALL ssl_read(SSL *ssl, uint8_t **in_data) int ret = basic_read(ssl, in_data); /* check for return code so we can send an alert */ - if (ret < SSL_OK) + if (ret < SSL_OK && ret != SSL_CLOSE_NOTIFY) { if (ret != SSL_ERROR_CONN_LOST) { @@ -1276,7 +1278,15 @@ int basic_read(SSL *ssl, uint8_t **in_data) case PT_ALERT_PROTOCOL: /* return the alert # with alert bit set */ - ret = -buf[1]; + if(buf[0] == SSL_ALERT_TYPE_WARNING && + buf[1] == SSL_ALERT_CLOSE_NOTIFY) + { + ret = SSL_CLOSE_NOTIFY; + SET_SSL_FLAG(SSL_RECEIVED_CLOSE_NOTIFY); + } + else + ret = -buf[1]; + DISPLAY_ALERT(ssl, buf[1]); break; diff --git a/ssl/tls1.h b/ssl/tls1.h index b64b4fda62..cead605de2 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -62,6 +62,7 @@ extern "C" { #define SSL_SESSION_RESUME 0x0008 #define SSL_IS_CLIENT 0x0010 #define SSL_HAS_CERT_REQ 0x0020 +#define SSL_RECEIVED_CLOSE_NOTIFY 0x0040 /* some macros to muck around with flag bits */ #define SET_SSL_FLAG(A) (ssl->flag |= A) diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index 3289afa756..0e9c10af42 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -250,6 +250,12 @@ static int process_server_hello(SSL *ssl) offset = 6 + SSL_RANDOM_SIZE; /* skip of session id size */ sess_id_size = buf[offset++]; + if (sess_id_size > SSL_SESSION_ID_SIZE) + { + ret = SSL_ERROR_INVALID_SESSION; + goto error; + } + if (num_sessions) { ssl->session = ssl_session_update(num_sessions, diff --git a/www/index.html b/www/index.html index 21d2b676df..e7e080e445 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.6@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 0d2e75b9c7ea3a83e866cba83ac379b955ac97ff Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 29 Dec 2010 11:49:30 +0000 Subject: [PATCH 152/301] fixed regular_square. Some scan-build tweaks. Made os_port.h "private". git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@181 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/Config.in | 12 ++++++------ crypto/aes.c | 2 +- crypto/bigint.c | 15 +++++++-------- samples/c/axssl.c | 2 -- ssl/BigIntConfig.in | 2 +- ssl/gen_cert.c | 1 + ssl/loader.c | 4 ++-- ssl/openssl.c | 1 + ssl/p12.c | 15 ++++++--------- ssl/test/killopenssl.sh | 1 - ssl/test/ssltest.c | 35 +++++++++-------------------------- ssl/tls1.c | 11 ++++++++--- ssl/tls1.h | 1 - ssl/tls1_clnt.c | 4 ++-- ssl/tls1_svr.c | 5 +++-- www/index.html | 2 +- 16 files changed, 48 insertions(+), 65 deletions(-) diff --git a/config/Config.in b/config/Config.in index bebbb03307..bc11f69d24 100644 --- a/config/Config.in +++ b/config/Config.in @@ -101,12 +101,6 @@ config CONFIG_EXTRA_LDFLAGS_OPTIONS endmenu source ssl/Config.in -config CONFIG_AXHTTPD - bool "Enable HTTP/HTTPS Web Server" - default y - help - Build the AXHTTPD web server - config CONFIG_AXTLSWRAP depends on !CONFIG_PLATFORM_WIN32 bool "Enable axtlswrap" @@ -115,6 +109,12 @@ config CONFIG_AXTLSWRAP axtlswrap is similar to sslwrap - http://www.rickk.com/sslwrap. It enables SSL for processes that don't have native SSL support. +config CONFIG_AXHTTPD + bool "Enable HTTP/HTTPS Web Server" + default y + help + Build the AXHTTPD web server + source httpd/Config.in source bindings/Config.in source samples/Config.in diff --git a/crypto/aes.c b/crypto/aes.c index 038a45bd85..9082a4069f 100644 --- a/crypto/aes.c +++ b/crypto/aes.c @@ -168,7 +168,7 @@ static void AES_decrypt(const AES_CTX *ctx, uint32_t *data); x^8+x^4+x^3+x+1 */ static unsigned char AES_xtime(uint32_t x) { - return x = (x&0x80) ? (x<<1)^0x1b : x<<1; + return (x&0x80) ? (x<<1)^0x1b : x<<1; } /** diff --git a/crypto/bigint.c b/crypto/bigint.c index 28b3c0ca0d..6a07a98d33 100644 --- a/crypto/bigint.c +++ b/crypto/bigint.c @@ -926,7 +926,7 @@ bigint *bi_multiply(BI_CTX *ctx, bigint *bia, bigint *bib) /* * Perform the actual square operion. It takes into account overflow. */ -bigint *regular_square(BI_CTX *ctx, bigint *bi) +static bigint *regular_square(BI_CTX *ctx, bigint *bi) { int t = bi->size; int i = 0, j; @@ -939,13 +939,13 @@ bigint *regular_square(BI_CTX *ctx, bigint *bi) do { long_comp tmp = w[2*i] + (long_comp)x[i]*x[i]; - uint8_t c = 0, q = 0; + uint8_t c = 0; w[2*i] = (comp)tmp; carry = (comp)(tmp >> COMP_BIT_SIZE); for (j = i+1; j < t; j++) { - c = q = 0; + c = 0; long_comp xx = (long_comp)x[i]*x[j]; if (COMP_MAX-xx < xx) c = 1; @@ -958,7 +958,7 @@ bigint *regular_square(BI_CTX *ctx, bigint *bi) tmp += w[i+j]; if (COMP_MAX-tmp < carry) - c = q = 1; + c = 1; tmp += carry; w[i+j] = (comp)tmp; @@ -968,10 +968,9 @@ bigint *regular_square(BI_CTX *ctx, bigint *bi) carry += COMP_RADIX; } - w[i+t] += carry; - - if (c && !q) - w[i+t+1] = 1; /* add carry */ + tmp = carry + w[i+t]; + w[i+t] = (comp)tmp; + w[i+t+1] = tmp >> COMP_BIT_SIZE; } while (++i < t); bi_free(ctx, bi); diff --git a/samples/c/axssl.c b/samples/c/axssl.c index d9d9a60711..20da957ec9 100644 --- a/samples/c/axssl.c +++ b/samples/c/axssl.c @@ -310,7 +310,6 @@ static void do_server(int argc, char *argv[]) if ((client_fd = accept(server_fd, (struct sockaddr *)&client_addr, &client_len)) < 0) { - res = 1; break; } @@ -683,7 +682,6 @@ static void do_client(int argc, char *argv[]) for (;;) { uint8_t buf[1024]; - res = SSL_OK; /* allow parallel reading of server and standard input */ FD_SET(client_fd, &read_set); diff --git a/ssl/BigIntConfig.in b/ssl/BigIntConfig.in index cace9c5687..944d2971b7 100644 --- a/ssl/BigIntConfig.in +++ b/ssl/BigIntConfig.in @@ -8,7 +8,7 @@ menu "BigInt Options" choice prompt "Reduction Algorithm" - default CONFIG_BIGINT_MONTGOMERY + default CONFIG_BIGINT_CLASSICAL config CONFIG_BIGINT_CLASSICAL bool "Classical" diff --git a/ssl/gen_cert.c b/ssl/gen_cert.c index 94b74903ca..c2fe381eb9 100644 --- a/ssl/gen_cert.c +++ b/ssl/gen_cert.c @@ -33,6 +33,7 @@ #ifdef CONFIG_SSL_GENERATE_X509_CERT #include #include +#include "os_port.h" #include "ssl.h" /** diff --git a/ssl/loader.c b/ssl/loader.c index 4232f7eec0..ab3c266519 100644 --- a/ssl/loader.c +++ b/ssl/loader.c @@ -41,7 +41,7 @@ #include #include #include - +#include "os_port.h" #include "ssl.h" static int do_obj(SSL_CTX *ssl_ctx, int obj_type, @@ -77,7 +77,7 @@ EXP_FUNC int STDCALL ssl_obj_load(SSL_CTX *ssl_ctx, int obj_type, } /* is the file a PEM file? */ - if (strncmp((char *)ssl_obj->buf, begin, strlen(begin)) == 0) + if (strstr((char *)ssl_obj->buf, begin) != NULL) { #ifdef CONFIG_SSL_HAS_PEM ret = ssl_obj_PEM_load(ssl_ctx, obj_type, ssl_obj, password); diff --git a/ssl/openssl.c b/ssl/openssl.c index b6b955008b..6b5c4d8ee9 100644 --- a/ssl/openssl.c +++ b/ssl/openssl.c @@ -42,6 +42,7 @@ #include #include #include +#include "os_port.h" #include "ssl.h" #define OPENSSL_CTX_ATTR ((OPENSSL_CTX *)ssl_ctx->bonus_attr) diff --git a/ssl/p12.c b/ssl/p12.c index 6ed92e431d..2bafaf7eaf 100644 --- a/ssl/p12.c +++ b/ssl/p12.c @@ -62,7 +62,7 @@ #include #include #include - +#include "os_port.h" #include "ssl.h" /* all commented out if not used */ @@ -233,15 +233,14 @@ static int p8_decrypt(const char *uni_pass, int uni_pass_len, int pkcs12_decode(SSL_CTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password) { uint8_t *buf = ssl_obj->buf; - int all_ok = 0, len, iterations, auth_safes_start, + int len, iterations, auth_safes_start, auth_safes_end, auth_safes_len, key_offset, offset = 0; int all_certs = 0; uint8_t *version = NULL, *auth_safes = NULL, *cert, *orig_mac; uint8_t key[SHA1_SIZE]; uint8_t mac[SHA1_SIZE]; const uint8_t *salt; - int uni_pass_len, ret; - int error_code = SSL_ERROR_NOT_SUPPORTED; + int uni_pass_len, ret = SSL_OK; char *uni_pass = make_uni_pass(password, &uni_pass_len); static const uint8_t pkcs_data[] = /* pkc7 data */ { 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x01 }; @@ -260,7 +259,7 @@ int pkcs12_decode(SSL_CTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password) if (asn1_get_int(buf, &offset, &version) < 0 || *version != 3) { - error_code = SSL_ERROR_INVALID_VERSION; + ret = SSL_ERROR_INVALID_VERSION; goto error; } @@ -414,17 +413,15 @@ int pkcs12_decode(SSL_CTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password) if (memcmp(mac, orig_mac, SHA1_SIZE)) { - error_code = SSL_ERROR_INVALID_HMAC; + ret = SSL_ERROR_INVALID_HMAC; goto error; } - all_ok = 1; - error: free(version); free(uni_pass); free(auth_safes); - return all_ok ? SSL_OK : error_code; + return ret; } /* diff --git a/ssl/test/killopenssl.sh b/ssl/test/killopenssl.sh index f5adf2db51..17950fbaef 100755 --- a/ssl/test/killopenssl.sh +++ b/ssl/test/killopenssl.sh @@ -1,3 +1,2 @@ #!/bin/sh ps -ef|grep openssl | /usr/bin/awk '{print $2}' |xargs kill -9 -sleep 1 diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 86997d7859..68fc2b6736 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -66,7 +66,6 @@ static int g_port = 19001; #define TEST1_SIZE 16 #define TEST2_SIZE 32 -#if 0 static int AES_test(BI_CTX *bi_ctx) { AES_CTX aes_key; @@ -420,7 +419,6 @@ static int HMAC_test(BI_CTX *bi_ctx) end: return res; } -#endif /************************************************************************** * BIGINT tests @@ -472,35 +470,20 @@ static int BIGINT_test(BI_CTX *ctx) * Multiply with psssible carry issue (8 bit) */ { - int i; - bigint *bi_x = bi_str_import( - ctx, - "AFD5060E224B70DA99EFB385BA5C0D2BEA0AD1DAAA52686E1A02D677BC65C1DA7A496BBDCC02999E8814F10AFC4B8E0DD4E6687E0762CE717A5EA1E452B5C56065C8431F0FB9D23CFF3A4B4149798C0670AF7F9565A0EAE5CF1AB16A1F0C3DD5E485DC5ABB96EBE0B6778A15B7302CBCE358E4BF2E2E30932758AC6EFA9F5828"); - uint8_t exp_sqr_result[bi_x->size*2]; - uint8_t exp_mlt_result[bi_x->size*2]; + bigint *bi_x = bi_str_import(ctx, + "AFD5060E224B70DA99EFB385BA5C0D2BEA0AD1DAAA52686E1A02D677BC65C1DA7A496BBDCC02999E8814F10AFC4B8E0DD4E6687E0762CE717A5EA1E452B5C56065C8431F0FB9D23CFF3A4B4149798C0670AF7F9565A0EAE5CF1AB16A1F0C3DD5E485DC5ABB96EBE0B6778A15B7302CBCE358E4BF2E2E30932758AC6EFA9F5828"); bigint *arg2 = bi_clone(ctx, bi_x); bigint *arg3 = bi_clone(ctx, bi_x); bigint *sqr_result = bi_square(ctx, bi_x); bigint *mlt_result = bi_multiply(ctx, arg2, arg3); - //bi_print("SQR_RESULT", sqr_result); - //bi_print("MLT_RESULT", mlt_result); if (bi_compare(sqr_result, mlt_result) != 0) { - bi_export(ctx, sqr_result, exp_sqr_result, sizeof(exp_sqr_result)); - bi_export(ctx, mlt_result, exp_mlt_result, sizeof(exp_mlt_result)); + bi_print("SQR_RESULT", sqr_result); + bi_print("MLT_RESULT", mlt_result); bi_free(ctx, sqr_result); bi_free(ctx, mlt_result); - - for (i = 0; i < sizeof(exp_sqr_result); i++) - { - if (exp_sqr_result[i] != exp_mlt_result[i]) - { - printf("Error: SQUARE failed %d %02x %02x\n", i, - exp_sqr_result[i], exp_mlt_result[i]); - goto end; - } - } + goto end; } bi_free(ctx, sqr_result); @@ -1203,6 +1186,7 @@ int SSL_server_tests(void) NULL, "abcd", DEFAULT_SVR_OPTION))) goto cleanup; +//#if 0 /* * AES128 Encrypted invalid key */ @@ -1215,6 +1199,7 @@ int SSL_server_tests(void) printf("SSL server test \"%s\" passed\n", "AES128 encrypted invalid key"); TTY_FLUSH(); +//#endif /* * PKCS#8 key (encrypted) @@ -1328,7 +1313,7 @@ static int SSL_client_test( #endif } - usleep(500000); /* allow server to start */ + sleep(5); /* allow server to start */ if (*ssl_ctx == NULL) { @@ -1590,6 +1575,7 @@ int SSL_client_tests(void) { ssl_display_error(ret); printf("Error: A client test failed\n"); + system("sh ../ssl/test/killopenssl.sh"); exit(1); } else @@ -1685,7 +1671,6 @@ static int SSL_basic_test(void) if (size < SSL_OK) /* got some alert or something nasty */ { - printf("Server "); ssl_display_error(size); ret = size; break; @@ -1958,7 +1943,6 @@ int main(int argc, char *argv[]) bi_ctx = bi_initialize(); -#if 0 if (AES_test(bi_ctx)) { printf("AES tests failed\n"); @@ -1993,7 +1977,6 @@ int main(int argc, char *argv[]) goto cleanup; } TTY_FLUSH(); -#endif if (BIGINT_test(bi_ctx)) { diff --git a/ssl/tls1.c b/ssl/tls1.c index 809d45cb01..9d1be37829 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -36,6 +36,7 @@ #include #include #include +#include "os_port.h" #include "ssl.h" /* The session expiry time */ @@ -1635,9 +1636,13 @@ SSL_SESSION *ssl_session_update(int max_sessions, SSL_SESSION *ssl_sessions[], } /* ok, we've used up all of our sessions. So blow the oldest session away */ - oldest_sess->conn_time = tm; - memset(oldest_sess->session_id, 0, sizeof(SSL_SESSION_ID_SIZE)); - memset(oldest_sess->master_secret, 0, sizeof(SSL_SECRET_SIZE)); + if (oldest_sess != NULL) + { + oldest_sess->conn_time = tm; + memset(oldest_sess->session_id, 0, sizeof(SSL_SESSION_ID_SIZE)); + memset(oldest_sess->master_secret, 0, sizeof(SSL_SECRET_SIZE)); + } + SSL_CTX_UNLOCK(ssl->ssl_ctx->mutex); return oldest_sess; } diff --git a/ssl/tls1.h b/ssl/tls1.h index cead605de2..a1e1bd9825 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -42,7 +42,6 @@ extern "C" { #include "version.h" #include "crypto.h" -#include "os_port.h" #include "crypto_misc.h" #define SSL_RANDOM_SIZE 32 diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index 0e9c10af42..3fb7f627d5 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -32,7 +32,7 @@ #include #include #include - +#include "os_port.h" #include "ssl.h" #ifdef CONFIG_SSL_ENABLE_CLIENT /* all commented out if no client */ @@ -79,7 +79,7 @@ EXP_FUNC SSL * STDCALL ssl_client_new(SSL_CTX *ssl_ctx, int client_fd, const */ int do_clnt_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len) { - int ret = SSL_OK; + int ret; /* To get here the state must be valid */ switch (handshake_type) diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index 45b9bec6a6..742ffd5934 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -31,7 +31,7 @@ #include #include #include - +#include "os_port.h" #include "ssl.h" static const uint8_t g_hello_done[] = { HS_SERVER_HELLO_DONE, 0, 0, 0 }; @@ -416,8 +416,9 @@ static int process_client_key_xchg(SSL *ssl) #else ssl->next_state = HS_FINISHED; #endif -error: + ssl->dc->bm_proc_index += rsa_ctx->num_octets+offset; +error: return ret; } diff --git a/www/index.html b/www/index.html index e7e080e445..6411f28ba8 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.8@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to ehuman - 3132700).\n* regular_square issue fixed (thanks to Hardy Griech - 3078672)\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start.\n* \n* 8/16/32 bit native int sizes can be selected in bigint_impl.h\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 8c18da4f1e1b366b686470ee16dee39c6481149a Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 2 Jan 2011 08:30:53 +0000 Subject: [PATCH 153/301] merged partial_multiply with regular_multiply function. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@182 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/bigint.c | 118 ++++++++++------------------------------- crypto/bigint_impl.h | 6 +-- ssl/BigIntConfig.in | 41 +++++++++----- ssl/test/perf_bigint.c | 18 ++++--- ssl/test/ssltest.c | 4 +- www/index.html | 2 +- 6 files changed, 72 insertions(+), 117 deletions(-) diff --git a/crypto/bigint.c b/crypto/bigint.c index 6a07a98d33..d8bd868d31 100644 --- a/crypto/bigint.c +++ b/crypto/bigint.c @@ -801,11 +801,16 @@ void bi_free_mod(BI_CTX *ctx, int mod_offset) /** * Perform a standard multiplication between two bigints. + * + * Barrett reduction has no need for some parts of the product, so ignore bits + * of the multiply. This routine gives Barrett its big performance + * improvements over Classical/Montgomery reduction methods. */ -static bigint *regular_multiply(BI_CTX *ctx, bigint *bia, bigint *bib) +static bigint *regular_multiply(BI_CTX *ctx, bigint *bia, bigint *bib, + int inner_partial, int outer_partial) { - int i, j, i_plus_j; - int n = bia->size; + int i = 0, j; + int n = bia->size; int t = bib->size; bigint *biR = alloc(ctx, n + t); comp *sr = biR->comps; @@ -817,23 +822,33 @@ static bigint *regular_multiply(BI_CTX *ctx, bigint *bia, bigint *bib) /* clear things to start with */ memset(biR->comps, 0, ((n+t)*COMP_BYTE_SIZE)); - i = 0; do { comp carry = 0; comp b = *sb++; - i_plus_j = i; + int r_index = i; j = 0; + if (outer_partial) + { + r_index = outer_partial-1; + j = outer_partial-i-1; + } + do { - long_comp tmp = sr[i_plus_j] + (long_comp)sa[j]*b + carry; - sr[i_plus_j++] = (comp)tmp; /* downsize */ - carry = (comp)(tmp >> COMP_BIT_SIZE); + if (inner_partial && r_index >= inner_partial) + { + break; + } + + long_comp tmp = sr[r_index] + ((long_comp)sa[j])*b + carry; + sr[r_index++] = (comp)tmp; /* downsize */ + carry = tmp >> COMP_BIT_SIZE; } while (++j < n); - sr[i_plus_j] = carry; + sr[r_index] = carry; } while (++i < t); bi_free(ctx, bia); @@ -913,12 +928,12 @@ bigint *bi_multiply(BI_CTX *ctx, bigint *bia, bigint *bib) #ifdef CONFIG_BIGINT_KARATSUBA if (min(bia->size, bib->size) < MUL_KARATSUBA_THRESH) { - return regular_multiply(ctx, bia, bib); + return regular_multiply(ctx, bia, bib, 0, 0); } return karatsuba(ctx, bia, bib, 0); #else - return regular_multiply(ctx, bia, bib); + return regular_multiply(ctx, bia, bib, 0, 0); #endif } @@ -941,7 +956,7 @@ static bigint *regular_square(BI_CTX *ctx, bigint *bi) long_comp tmp = w[2*i] + (long_comp)x[i]*x[i]; uint8_t c = 0; w[2*i] = (comp)tmp; - carry = (comp)(tmp >> COMP_BIT_SIZE); + carry = tmp >> COMP_BIT_SIZE; for (j = i+1; j < t; j++) { @@ -1242,81 +1257,6 @@ static bigint *comp_mod(bigint *bi, int mod) return bi; } -/* - * Barrett reduction has no need for some parts of the product, so ignore bits - * of the multiply. This routine gives Barrett its big performance - * improvements over Classical/Montgomery reduction methods. - */ -static bigint *partial_multiply(BI_CTX *ctx, bigint *bia, bigint *bib, - int inner_partial, int outer_partial) -{ - int i = 0, j, n = bia->size, t = bib->size; - bigint *biR; - comp carry; - comp *sr, *sa, *sb; - - check(bia); - check(bib); - - biR = alloc(ctx, n + t); - sa = bia->comps; - sb = bib->comps; - sr = biR->comps; - - if (inner_partial) - { - memset(sr, 0, inner_partial*COMP_BYTE_SIZE); - } - else /* outer partial */ - { - if (n < outer_partial || t < outer_partial) /* should we bother? */ - { - bi_free(ctx, bia); - bi_free(ctx, bib); - biR->comps[0] = 0; /* return 0 */ - biR->size = 1; - return biR; - } - - memset(&sr[outer_partial], 0, (n+t-outer_partial)*COMP_BYTE_SIZE); - } - - do - { - comp *a = sa; - comp b = *sb++; - long_comp tmp; - int i_plus_j = i; - carry = 0; - j = n; - - if (outer_partial && i_plus_j < outer_partial) - { - i_plus_j = outer_partial; - a = &sa[outer_partial-i]; - j = n-(outer_partial-i); - } - - do - { - if (inner_partial && i_plus_j >= inner_partial) - { - break; - } - - tmp = sr[i_plus_j] + ((long_comp)*a++)*b + carry; - sr[i_plus_j++] = (comp)tmp; /* downsize */ - carry = (comp)(tmp >> COMP_BIT_SIZE); - } while (--j != 0); - - sr[i_plus_j] = carry; - } while (++i < t); - - bi_free(ctx, bia); - bi_free(ctx, bib); - return trim(biR); -} - /** * @brief Perform a single Barrett reduction. * @param ctx [in] The bigint session context. @@ -1342,12 +1282,12 @@ bigint *bi_barrett(BI_CTX *ctx, bigint *bi) q1 = comp_right_shift(bi_clone(ctx, bi), k-1); /* do outer partial multiply */ - q2 = partial_multiply(ctx, q1, ctx->bi_mu[mod_offset], 0, k-1); + q2 = regular_multiply(ctx, q1, ctx->bi_mu[mod_offset], 0, k-1); q3 = comp_right_shift(q2, k+1); r1 = comp_mod(bi, k+1); /* do inner partial multiply */ - r2 = comp_mod(partial_multiply(ctx, q3, bim, k+1, 0), k+1); + r2 = comp_mod(regular_multiply(ctx, q3, bim, k+1, 0), k+1); r = bi_subtract(ctx, r1, r2, NULL); /* if (r >= m) r = r - m; */ diff --git a/crypto/bigint_impl.h b/crypto/bigint_impl.h index 0b76aee2d4..fef6e0378b 100644 --- a/crypto/bigint_impl.h +++ b/crypto/bigint_impl.h @@ -41,10 +41,8 @@ #define BIGINT_NUM_MODS 1 #endif -//#define REGISTER_8 1 - /* Architecture specific functions for big ints */ -#if defined(REGISTER_8) +#if defined(CONFIG_INTEGER_8BIT) #define COMP_RADIX 256U /**< Max component + 1 */ #define COMP_MAX 0xFFFFU/**< (Max dbl comp -1) */ #define COMP_BIT_SIZE 8 /**< Number of bits in a component. */ @@ -53,7 +51,7 @@ typedef uint8_t comp; /**< A single precision component. */ typedef uint16_t long_comp; /**< A double precision component. */ typedef int16_t slong_comp; /**< A signed double precision component. */ -#elif defined(REGISTER_16) +#elif defined(CONFIG_INTEGER_16BIT) #define COMP_RADIX 65536U /**< Max component + 1 */ #define COMP_MAX 0xFFFFFFFFU/**< (Max dbl comp -1) */ #define COMP_BIT_SIZE 16 /**< Number of bits in a component. */ diff --git a/ssl/BigIntConfig.in b/ssl/BigIntConfig.in index 944d2971b7..b951fbd959 100644 --- a/ssl/BigIntConfig.in +++ b/ssl/BigIntConfig.in @@ -8,7 +8,7 @@ menu "BigInt Options" choice prompt "Reduction Algorithm" - default CONFIG_BIGINT_CLASSICAL + default CONFIG_BIGINT_BARRETT config CONFIG_BIGINT_CLASSICAL bool "Classical" @@ -21,9 +21,8 @@ config CONFIG_BIGINT_MONTGOMERY bool "Montgomery" help Montgomery uses simple addition and multiplication to achieve its - performance. In this implementation it is slower than classical, - and it has the limitation that 0 <= x, y < m, and so is not used - when CRT is active. + performance. It has the limitation that 0 <= x, y < m, and so is not + used when CRT is active. This option will not be normally selected. @@ -31,9 +30,7 @@ config CONFIG_BIGINT_BARRETT bool "Barrett" help Barrett performs expensive precomputation before reduction and partial - multiplies for computational speed. It can't be used with some of the - calculations when CRT is used, and so defaults to classical when this - occurs. + multiplies for computational speed. It is about 40% faster than Classical/Montgomery with the expense of about 2kB, and so this option is normally selected. @@ -108,12 +105,9 @@ config CONFIG_BIGINT_SQUARE bool "Square Algorithm" default y help - Allow squaring to be used instead of a multiplication. - - Squaring is theoretically 50% faster than a standard multiply - (but is actually about 25% faster). - - It gives a 20% speed improvement and so should be selected. + Allow squaring to be used instead of a multiplication. It uses + 1/2 of the standard multiplies to obtain its performance. + It gives a 20% speed improvement overall and so should be selected. config CONFIG_BIGINT_CHECK_ON bool "BigInt Integrity Checking" @@ -126,7 +120,26 @@ config CONFIG_BIGINT_CHECK_ON This option is only selected when developing and should normally be turned off. -endmenu +choice + prompt "Integer Size" + default CONFIG_INTEGER_32BIT + +config CONFIG_INTEGER_32BIT + bool "32" + help + The native integer size is 32 bits or higher. + + +config CONFIG_INTEGER_16BIT + bool "16" + help + The native integer size is 16 bits. +config CONFIG_INTEGER_8BIT + bool "8" + help + The native integer size is 8 bits. +endchoice +endmenu diff --git a/ssl/test/perf_bigint.c b/ssl/test/perf_bigint.c index a4ffab6a3a..f092b9e23c 100644 --- a/ssl/test/perf_bigint.c +++ b/ssl/test/perf_bigint.c @@ -45,10 +45,11 @@ int main(int argc, char *argv[]) { #ifdef CONFIG_SSL_CERT_VERIFICATION - RSA_CTX *rsa_ctx; + RSA_CTX *rsa_ctx = NULL; BI_CTX *ctx; bigint *bi_data, *bi_res; - int diff, res = 1; + float diff; + int res = 1; struct timeval tv_old, tv_new; const char *plaintext; uint8_t compare[MAX_KEY_BYTE_SIZE]; @@ -84,7 +85,7 @@ int main(int argc, char *argv[]) diff = (tv_new.tv_sec-tv_old.tv_sec)*1000 + (tv_new.tv_usec-tv_old.tv_usec)/1000; - printf("512 bit decrypt time: %dms\n", diff/max_biggie); + printf("512 bit decrypt time: %.2fms\n", diff/max_biggie); TTY_FLUSH(); bi_export(ctx, bi_res, compare, 64); RSA_free(rsa_ctx); @@ -100,6 +101,7 @@ int main(int argc, char *argv[]) "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^"; len = get_file("../ssl/test/axTLS.key_1024", &buf); + rsa_ctx = NULL; asn1_get_private_key(buf, len, &rsa_ctx); ctx = rsa_ctx->bi_ctx; bi_data = bi_import(ctx, (uint8_t *)plaintext, strlen(plaintext)); @@ -121,7 +123,7 @@ int main(int argc, char *argv[]) diff = (tv_new.tv_sec-tv_old.tv_sec)*1000 + (tv_new.tv_usec-tv_old.tv_usec)/1000; - printf("1024 bit decrypt time: %dms\n", diff/max_biggie); + printf("1024 bit decrypt time: %.2fms\n", diff/max_biggie); TTY_FLUSH(); bi_export(ctx, bi_res, compare, 128); RSA_free(rsa_ctx); @@ -139,6 +141,7 @@ int main(int argc, char *argv[]) "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^"; len = get_file("../ssl/test/axTLS.key_2048", &buf); + rsa_ctx = NULL; asn1_get_private_key(buf, len, &rsa_ctx); ctx = rsa_ctx->bi_ctx; bi_data = bi_import(ctx, (uint8_t *)plaintext, strlen(plaintext)); @@ -159,7 +162,7 @@ int main(int argc, char *argv[]) diff = (tv_new.tv_sec-tv_old.tv_sec)*1000 + (tv_new.tv_usec-tv_old.tv_usec)/1000; - printf("2048 bit decrypt time: %dms\n", diff/max_biggie); + printf("2048 bit decrypt time: %.2fms\n", diff/max_biggie); TTY_FLUSH(); bi_export(ctx, bi_res, compare, 256); RSA_free(rsa_ctx); @@ -181,6 +184,7 @@ int main(int argc, char *argv[]) "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*^"; len = get_file("../ssl/test/axTLS.key_4096", &buf); + rsa_ctx = NULL; asn1_get_private_key(buf, len, &rsa_ctx); ctx = rsa_ctx->bi_ctx; bi_data = bi_import(ctx, (uint8_t *)plaintext, strlen(plaintext)); @@ -189,7 +193,7 @@ int main(int argc, char *argv[]) gettimeofday(&tv_new, NULL); diff = (tv_new.tv_sec-tv_old.tv_sec)*1000 + (tv_new.tv_usec-tv_old.tv_usec)/1000; - printf("4096 bit encrypt time: %dms\n", diff); + printf("4096 bit encrypt time: %.2fms\n", diff); TTY_FLUSH(); bi_data = bi_res; /* reuse again */ @@ -208,7 +212,7 @@ int main(int argc, char *argv[]) diff = (tv_new.tv_sec-tv_old.tv_sec)*1000 + (tv_new.tv_usec-tv_old.tv_usec)/1000; - printf("4096 bit decrypt time: %dms\n", diff/max_biggie); + printf("4096 bit decrypt time: %.2fms\n", diff/max_biggie); TTY_FLUSH(); bi_export(ctx, bi_res, compare, 512); RSA_free(rsa_ctx); diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 68fc2b6736..7b86a1bd15 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -428,8 +428,8 @@ static int BIGINT_test(BI_CTX *ctx) { int res = 1; -#ifndef REGISTER_8 -#ifndef REGISTER_16 +#ifndef CONFIG_INTEGER_8BIT +#ifndef CONFIG_INTEGER_16BIT bigint *bi_data, *bi_exp, *bi_res; const char *expnt, *plaintext, *mod; uint8_t compare[MAX_KEY_BYTE_SIZE]; diff --git a/www/index.html b/www/index.html index 6411f28ba8..7fabb8bc9d 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.8@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to ehuman - 3132700).\n* regular_square issue fixed (thanks to Hardy Griech - 3078672)\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start.\n* \n* 8/16/32 bit native int sizes can be selected in bigint_impl.h\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.9@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to ehuman - 3132700).\n* regular_square issue fixed (thanks to Hardy Griech - 3078672)\n* partial_multiply() removed and merged with regular_multiply().\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start.\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 28c35cf0f335f1537331f8781a70712287edf885 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 2 Jan 2011 10:16:43 +0000 Subject: [PATCH 154/301] Updated of comments. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@183 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/BigIntConfig.in | 4 ++-- www/index.html | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ssl/BigIntConfig.in b/ssl/BigIntConfig.in index b951fbd959..116ce17ea2 100644 --- a/ssl/BigIntConfig.in +++ b/ssl/BigIntConfig.in @@ -59,8 +59,8 @@ config CONFIG_BIGINT_KARATSUBA Uses 3 multiplications (plus a number of additions/subtractions) instead of 4. Multiplications are O(N^2) but addition/subtraction is O(N) hence for large numbers is beneficial. For this project, the - effect was only useful for 4096 bit keys. As these aren't likely to - be used, the feature is disabled by default. + effect was only useful for 4096 bit keys (for 32 bit processors). For + 8 bit processors this option might be a possibility. It costs about 2kB to enable it. diff --git a/www/index.html b/www/index.html index 7fabb8bc9d..d5e29cd326 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.9@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to ehuman - 3132700).\n* regular_square issue fixed (thanks to Hardy Griech - 3078672)\n* partial_multiply() removed and merged with regular_multiply().\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start.\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.9@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to ehuman - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From bc9a451b5111758585f62933fe0d079fdc9a2fb1 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 2 Jan 2011 22:38:59 +0000 Subject: [PATCH 155/301] fixed some valgrind detected issues. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@185 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/bigint.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/crypto/bigint.c b/crypto/bigint.c index d8bd868d31..634c1980d0 100644 --- a/crypto/bigint.c +++ b/crypto/bigint.c @@ -826,11 +826,10 @@ static bigint *regular_multiply(BI_CTX *ctx, bigint *bia, bigint *bib, do { comp carry = 0; - comp b = *sb++; int r_index = i; j = 0; - if (outer_partial) + if (outer_partial && outer_partial-i > 0 && outer_partial < n) { r_index = outer_partial-1; j = outer_partial-i-1; @@ -843,7 +842,7 @@ static bigint *regular_multiply(BI_CTX *ctx, bigint *bia, bigint *bib, break; } - long_comp tmp = sr[r_index] + ((long_comp)sa[j])*b + carry; + long_comp tmp = sr[r_index] + ((long_comp)sa[j])*sb[i] + carry; sr[r_index++] = (comp)tmp; /* downsize */ carry = tmp >> COMP_BIT_SIZE; } while (++j < n); @@ -945,7 +944,7 @@ static bigint *regular_square(BI_CTX *ctx, bigint *bi) { int t = bi->size; int i = 0, j; - bigint *biR = alloc(ctx, t*2); + bigint *biR = alloc(ctx, t*2+1); comp *w = biR->comps; comp *x = bi->comps; long_comp carry; From b8d6697ef8833d54f8b5e61daafe1d5eb1cc38b2 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 2 Jan 2011 23:03:18 +0000 Subject: [PATCH 156/301] Comment changes. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@186 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/test/ssltest.c | 2 -- www/index.html | 2 +- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 7b86a1bd15..a10737e90c 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1186,7 +1186,6 @@ int SSL_server_tests(void) NULL, "abcd", DEFAULT_SVR_OPTION))) goto cleanup; -//#if 0 /* * AES128 Encrypted invalid key */ @@ -1199,7 +1198,6 @@ int SSL_server_tests(void) printf("SSL server test \"%s\" passed\n", "AES128 encrypted invalid key"); TTY_FLUSH(); -//#endif /* * PKCS#8 key (encrypted) diff --git a/www/index.html b/www/index.html index d5e29cd326..aef580ae62 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.9@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to ehuman - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to ehuman - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From f5dbc8875e1ee162c52ad4aad6f5c6f7145a4932 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 3 Jan 2011 23:08:49 +0000 Subject: [PATCH 157/301] Removed os_port.h dependency. Fixed CA number issue (default now 120). git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@188 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 1 + crypto/aes.c | 1 + crypto/bigint.c | 4 +- crypto/crypto.h | 9 +- crypto/crypto_misc.c | 1 + crypto/hmac.c | 1 + crypto/md2.c | 2 +- crypto/md5.c | 1 + crypto/rc4.c | 1 + crypto/rsa.c | 1 + crypto/sha1.c | 1 + httpd/axhttp.h | 1 + httpd/htpasswd.c | 1 + samples/c/axssl.c | 1 + ssl/Config.in | 9 +- ssl/os_port.h | 2 +- ssl/ssl.h | 1 - ssl/test/ca-bundle.crt | 7989 ++++++++++++++++++++++++++++++++++++++++ ssl/test/ssltest.c | 53 +- ssl/tls1.c | 3 +- 20 files changed, 8062 insertions(+), 21 deletions(-) create mode 100644 ssl/test/ca-bundle.crt diff --git a/Makefile b/Makefile index 2b3d3c8dd9..036a29ebe3 100644 --- a/Makefile +++ b/Makefile @@ -108,6 +108,7 @@ endif install -m 644 ssl/*.h $(PREFIX)/include/axTLS -rm $(PREFIX)/include/axTLS/cert.h -rm $(PREFIX)/include/axTLS/private_key.h + -rm $(PREFIX)/include/axTLS/os_port.h install -m 644 config/config.h $(PREFIX)/include/axTLS installclean: diff --git a/crypto/aes.c b/crypto/aes.c index 9082a4069f..9b07e27ea1 100644 --- a/crypto/aes.c +++ b/crypto/aes.c @@ -35,6 +35,7 @@ */ #include +#include "os_port.h" #include "crypto.h" /* all commented out in skeleton mode */ diff --git a/crypto/bigint.c b/crypto/bigint.c index 634c1980d0..d131e8ab54 100644 --- a/crypto/bigint.c +++ b/crypto/bigint.c @@ -65,6 +65,7 @@ #include #include #include +#include "os_port.h" #include "bigint.h" #define V1 v->comps[v->size-1] /**< v1 for division */ @@ -953,13 +954,12 @@ static bigint *regular_square(BI_CTX *ctx, bigint *bi) do { long_comp tmp = w[2*i] + (long_comp)x[i]*x[i]; - uint8_t c = 0; w[2*i] = (comp)tmp; carry = tmp >> COMP_BIT_SIZE; for (j = i+1; j < t; j++) { - c = 0; + uint8_t c = 0; long_comp xx = (long_comp)x[i]*x[j]; if (COMP_MAX-xx < xx) c = 1; diff --git a/crypto/crypto.h b/crypto/crypto.h index 5c95f21596..c6f186cf97 100644 --- a/crypto/crypto.h +++ b/crypto/crypto.h @@ -40,10 +40,17 @@ extern "C" { #endif #include "config.h" -#include "os_port.h" #include "bigint_impl.h" #include "bigint.h" +#ifndef STDCALL +#define STDCALL +#endif +#ifndef EXP_FUNC +#define EXP_FUNC +#endif + + /* enable features based on a 'super-set' capbaility. */ #if defined(CONFIG_SSL_FULL_MODE) #define CONFIG_SSL_ENABLE_CLIENT diff --git a/crypto/crypto_misc.c b/crypto/crypto_misc.c index 402efe7395..8bca842c19 100644 --- a/crypto/crypto_misc.c +++ b/crypto/crypto_misc.c @@ -36,6 +36,7 @@ #include #include #include +#include "os_port.h" #include "crypto_misc.h" #ifdef CONFIG_WIN32_USE_CRYPTO_LIB #include "wincrypt.h" diff --git a/crypto/hmac.c b/crypto/hmac.c index 9199ff2207..7670a9e583 100644 --- a/crypto/hmac.c +++ b/crypto/hmac.c @@ -33,6 +33,7 @@ */ #include +#include "os_port.h" #include "crypto.h" /** diff --git a/crypto/md2.c b/crypto/md2.c index bfcbd24bbe..dee909a7a5 100644 --- a/crypto/md2.c +++ b/crypto/md2.c @@ -38,7 +38,7 @@ #include #include - +#include "os_port.h" #include "crypto.h" /** diff --git a/crypto/md5.c b/crypto/md5.c index b4f86cab58..7f50713006 100644 --- a/crypto/md5.c +++ b/crypto/md5.c @@ -33,6 +33,7 @@ */ #include +#include "os_port.h" #include "crypto.h" /* Constants for MD5Transform routine. diff --git a/crypto/rc4.c b/crypto/rc4.c index 57136b82bd..ec8b24711b 100644 --- a/crypto/rc4.c +++ b/crypto/rc4.c @@ -34,6 +34,7 @@ */ #include +#include "os_port.h" #include "crypto.h" /** diff --git a/crypto/rsa.c b/crypto/rsa.c index 0be429856d..143e66add5 100644 --- a/crypto/rsa.c +++ b/crypto/rsa.c @@ -37,6 +37,7 @@ #include #include #include +#include "os_port.h" #include "crypto.h" void RSA_priv_key_new(RSA_CTX **ctx, diff --git a/crypto/sha1.c b/crypto/sha1.c index be19100797..1082733e7e 100644 --- a/crypto/sha1.c +++ b/crypto/sha1.c @@ -34,6 +34,7 @@ */ #include +#include "os_port.h" #include "crypto.h" /* diff --git a/httpd/axhttp.h b/httpd/axhttp.h index c87b9c442b..961edeecf6 100644 --- a/httpd/axhttp.h +++ b/httpd/axhttp.h @@ -28,6 +28,7 @@ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ +#include "os_port.h" #include "ssl.h" #define BACKLOG 15 diff --git a/httpd/htpasswd.c b/httpd/htpasswd.c index d1fbe32bfe..8fe571ab7b 100644 --- a/httpd/htpasswd.c +++ b/httpd/htpasswd.c @@ -31,6 +31,7 @@ #include #include #include +#include "os_port.h" #include "ssl.h" int tfd; diff --git a/samples/c/axssl.c b/samples/c/axssl.c index 20da957ec9..5a0782731d 100644 --- a/samples/c/axssl.c +++ b/samples/c/axssl.c @@ -46,6 +46,7 @@ #include #include #include +#include "os_port.h" #include "ssl.h" /* define standard input */ diff --git a/ssl/Config.in b/ssl/Config.in index d047d420ec..557499c0dc 100644 --- a/ssl/Config.in +++ b/ssl/Config.in @@ -252,7 +252,7 @@ config CONFIG_SSL_EXPIRY_TIME config CONFIG_X509_MAX_CA_CERTS int "Maximum number of certificate authorites" - default 4 + default 120 if CONFIG_SSL_CERT_VERIFICATION depends on !CONFIG_SSL_SERVER_ONLY && !CONFIG_SSL_SKELETON_MODE help Determines the number of CA's allowed. @@ -260,11 +260,11 @@ config CONFIG_X509_MAX_CA_CERTS Increase this figure if more trusted sites are allowed. Each certificate adds about 300 bytes (when added). - The default is to allow four certification authorities. + The default is to allow the Debian cert bundle to be parsed. config CONFIG_SSL_MAX_CERTS int "Maximum number of chained certificates" - default 2 + default 3 help Determines the number of certificates used in a certificate chain. The chain length must be at least 1. @@ -272,8 +272,7 @@ config CONFIG_SSL_MAX_CERTS Increase this figure if more certificates are to be added to the chain. Each certificate adds about 300 bytes (when added). - The default is to allow one certificate + 1 certificate in the chain - (which may be the certificate authority certificate). + The default is to allow one certificate + 2 certificates in the chain. config CONFIG_SSL_CTX_MUTEXING bool "Enable SSL_CTX mutexing" diff --git a/ssl/os_port.h b/ssl/os_port.h index 262c4dd705..0efd6ae708 100644 --- a/ssl/os_port.h +++ b/ssl/os_port.h @@ -152,7 +152,7 @@ EXP_FUNC int STDCALL getdomainname(char *buf, int buf_size); #define SOCKET_READ(A,B,C) read(A,B,C) #define SOCKET_WRITE(A,B,C) write(A,B,C) -#define SOCKET_CLOSE(A) close(A) +#define SOCKET_CLOSE(A) if (A >= 0) close(A) #define SOCKET_BLOCK(A) int fd = fcntl(A, F_GETFL, NULL); \ fcntl(A, F_SETFL, fd & ~O_NONBLOCK) #define TTY_FLUSH() diff --git a/ssl/ssl.h b/ssl/ssl.h index 6b3654d558..009944046d 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -68,7 +68,6 @@ extern "C" { #endif #include -//#include "crypto.h" /* need to predefine before ssl_lib.h gets to it */ #define SSL_SESSION_ID_SIZE 32 diff --git a/ssl/test/ca-bundle.crt b/ssl/test/ca-bundle.crt new file mode 100644 index 0000000000..1e5553b213 --- /dev/null +++ b/ssl/test/ca-bundle.crt @@ -0,0 +1,7989 @@ +# This is a bundle of X.509 certificates of public Certificate +# Authorities. It was generated from the Mozilla root CA list. +# +# Source: mozilla/security/nss/lib/ckfw/builtins/certdata.txt +# +# Generated from certdata.txt RCS revision 1.39 +# +Certificate: + Data: + Version: 1 (0x0) + Serial Number: + 02:ad:66:7e:4e:45:fe:5e:57:6f:3c:98:19:5e:dd:c0 + Signature Algorithm: md2WithRSAEncryption + Issuer: C=US, O=RSA Data Security, Inc., OU=Secure Server Certification Authority + Validity + Not Before: Nov 9 00:00:00 1994 GMT + Not After : Jan 7 23:59:59 2010 GMT + Subject: C=US, O=RSA Data Security, Inc., OU=Secure Server Certification Authority + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1000 bit) + Modulus (1000 bit): + 00:92:ce:7a:c1:ae:83:3e:5a:aa:89:83:57:ac:25: + 01:76:0c:ad:ae:8e:2c:37:ce:eb:35:78:64:54:03: + e5:84:40:51:c9:bf:8f:08:e2:8a:82:08:d2:16:86: + 37:55:e9:b1:21:02:ad:76:68:81:9a:05:a2:4b:c9: + 4b:25:66:22:56:6c:88:07:8f:f7:81:59:6d:84:07: + 65:70:13:71:76:3e:9b:77:4c:e3:50:89:56:98:48: + b9:1d:a7:29:1a:13:2e:4a:11:59:9c:1e:15:d5:49: + 54:2c:73:3a:69:82:b1:97:39:9c:6d:70:67:48:e5: + dd:2d:d6:c8:1e:7b + Exponent: 65537 (0x10001) + Signature Algorithm: md2WithRSAEncryption + 65:dd:7e:e1:b2:ec:b0:e2:3a:e0:ec:71:46:9a:19:11:b8:d3: + c7:a0:b4:03:40:26:02:3e:09:9c:e1:12:b3:d1:5a:f6:37:a5: + b7:61:03:b6:5b:16:69:3b:c6:44:08:0c:88:53:0c:6b:97:49: + c7:3e:35:dc:6c:b9:bb:aa:df:5c:bb:3a:2f:93:60:b6:a9:4b: + 4d:f2:20:f7:cd:5f:7f:64:7b:8e:dc:00:5c:d7:fa:77:ca:39: + 16:59:6f:0e:ea:d3:b5:83:7f:4d:4d:42:56:76:b4:c9:5f:04: + f8:38:f8:eb:d2:5f:75:5f:cd:7b:fc:e5:8e:80:7c:fc:50 +MD5 Fingerprint=74:7B:82:03:43:F0:00:9E:6B:B3:EC:47:BF:85:A5:93 +-----BEGIN CERTIFICATE----- +MIICNDCCAaECEAKtZn5ORf5eV288mBle3cAwDQYJKoZIhvcNAQECBQAwXzELMAkG +A1UEBhMCVVMxIDAeBgNVBAoTF1JTQSBEYXRhIFNlY3VyaXR5LCBJbmMuMS4wLAYD +VQQLEyVTZWN1cmUgU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk0 +MTEwOTAwMDAwMFoXDTEwMDEwNzIzNTk1OVowXzELMAkGA1UEBhMCVVMxIDAeBgNV +BAoTF1JTQSBEYXRhIFNlY3VyaXR5LCBJbmMuMS4wLAYDVQQLEyVTZWN1cmUgU2Vy +dmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGbMA0GCSqGSIb3DQEBAQUAA4GJ +ADCBhQJ+AJLOesGugz5aqomDV6wlAXYMra6OLDfO6zV4ZFQD5YRAUcm/jwjiioII +0haGN1XpsSECrXZogZoFokvJSyVmIlZsiAeP94FZbYQHZXATcXY+m3dM41CJVphI +uR2nKRoTLkoRWZweFdVJVCxzOmmCsZc5nG1wZ0jl3S3WyB57AgMBAAEwDQYJKoZI +hvcNAQECBQADfgBl3X7hsuyw4jrg7HFGmhkRuNPHoLQDQCYCPgmc4RKz0Vr2N6W3 +YQO2WxZpO8ZECAyIUwxrl0nHPjXcbLm7qt9cuzovk2C2qUtN8iD3zV9/ZHuO3ABc +1/p3yjkWWW8O6tO1g39NTUJWdrTJXwT4OPjr0l91X817/OWOgHz8UA== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: 419 (0x1a3) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=US, O=GTE Corporation, CN=GTE CyberTrust Root + Validity + Not Before: Feb 23 23:01:00 1996 GMT + Not After : Feb 23 23:59:00 2006 GMT + Subject: C=US, O=GTE Corporation, CN=GTE CyberTrust Root + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:b8:e6:4f:ba:db:98:7c:71:7c:af:44:b7:d3:0f: + 46:d9:64:e5:93:c1:42:8e:c7:ba:49:8d:35:2d:7a: + e7:8b:bd:e5:05:31:59:c6:b1:2f:0a:0c:fb:9f:a7: + 3f:a2:09:66:84:56:1e:37:29:1b:87:e9:7e:0c:ca: + 9a:9f:a5:7f:f5:15:94:a3:d5:a2:46:82:d8:68:4c: + d1:37:15:06:68:af:bd:f8:b0:b3:f0:29:f5:95:5a: + 09:16:61:77:0a:22:25:d4:4f:45:aa:c7:bd:e5:96: + df:f9:d4:a8:8e:42:cc:24:c0:1e:91:27:4a:b5:6d: + 06:80:63:39:c4:a2:5e:38:03 + Exponent: 65537 (0x10001) + Signature Algorithm: md5WithRSAEncryption + 12:b3:75:c6:5f:1d:e1:61:55:80:00:d4:81:4b:7b:31:0f:23: + 63:e7:3d:f3:03:f9:f4:36:a8:bb:d9:e3:a5:97:4d:ea:2b:29: + e0:d6:6a:73:81:e6:c0:89:a3:d3:f1:e0:a5:a5:22:37:9a:63: + c2:48:20:b4:db:72:e3:c8:f6:d9:7c:be:b1:af:53:da:14:b4: + 21:b8:d6:d5:96:e3:fe:4e:0c:59:62:b6:9a:4a:f9:42:dd:8c: + 6f:81:a9:71:ff:f4:0a:72:6d:6d:44:0e:9d:f3:74:74:a8:d5: + 34:49:e9:5e:9e:e9:b4:7a:e1:e5:5a:1f:84:30:9c:d3:9f:a5: + 25:d8 +MD5 Fingerprint=C4:D7:F0:B2:A3:C5:7D:61:67:F0:04:CD:43:D3:BA:58 +-----BEGIN CERTIFICATE----- +MIIB+jCCAWMCAgGjMA0GCSqGSIb3DQEBBAUAMEUxCzAJBgNVBAYTAlVTMRgwFgYD +VQQKEw9HVEUgQ29ycG9yYXRpb24xHDAaBgNVBAMTE0dURSBDeWJlclRydXN0IFJv +b3QwHhcNOTYwMjIzMjMwMTAwWhcNMDYwMjIzMjM1OTAwWjBFMQswCQYDVQQGEwJV +UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMRwwGgYDVQQDExNHVEUgQ3liZXJU +cnVzdCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC45k+625h8cXyv +RLfTD0bZZOWTwUKOx7pJjTUteueLveUFMVnGsS8KDPufpz+iCWaEVh43KRuH6X4M +ypqfpX/1FZSj1aJGgthoTNE3FQZor734sLPwKfWVWgkWYXcKIiXUT0Wqx73llt/5 +1KiOQswkwB6RJ0q1bQaAYznEol44AwIDAQABMA0GCSqGSIb3DQEBBAUAA4GBABKz +dcZfHeFhVYAA1IFLezEPI2PnPfMD+fQ2qLvZ46WXTeorKeDWanOB5sCJo9Px4KWl +IjeaY8JIILTbcuPI9tl8vrGvU9oUtCG41tWW4/5ODFlitppK+ULdjG+BqXH/9Apy +bW1EDp3zdHSo1TRJ6V6e6bR64eVaH4QwnNOfpSXY +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: 421 (0x1a5) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root + Validity + Not Before: Aug 13 00:29:00 1998 GMT + Not After : Aug 13 23:59:00 2018 GMT + Subject: C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:95:0f:a0:b6:f0:50:9c:e8:7a:c7:88:cd:dd:17: + 0e:2e:b0:94:d0:1b:3d:0e:f6:94:c0:8a:94:c7:06: + c8:90:97:c8:b8:64:1a:7a:7e:6c:3c:53:e1:37:28: + 73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af: + 8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c: + 72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac: + 8d:42:aa:24:01:39:e6:9c:3f:01:85:57:0d:58:87: + 45:f8:d3:85:aa:93:69:26:85:70:48:80:3f:12:15: + c7:79:b4:1f:05:2f:3b:62:99 + Exponent: 65537 (0x10001) + Signature Algorithm: md5WithRSAEncryption + 6d:eb:1b:09:e9:5e:d9:51:db:67:22:61:a4:2a:3c:48:77:e3: + a0:7c:a6:de:73:a2:14:03:85:3d:fb:ab:0e:30:c5:83:16:33: + 81:13:08:9e:7b:34:4e:df:40:c8:74:d7:b9:7d:dc:f4:76:55: + 7d:9b:63:54:18:e9:f0:ea:f3:5c:b1:d9:8b:42:1e:b9:c0:95: + 4e:ba:fa:d5:e2:7c:f5:68:61:bf:8e:ec:05:97:5f:5b:b0:d7: + a3:85:34:c4:24:a7:0d:0f:95:93:ef:cb:94:d8:9e:1f:9d:5c: + 85:6d:c7:aa:ae:4f:1f:22:b5:cd:95:ad:ba:a7:cc:f9:ab:0b: + 7a:7f +MD5 Fingerprint=CA:3D:D3:68:F1:03:5C:D0:32:FA:B8:2B:59:E8:5A:DB +-----BEGIN CERTIFICATE----- +MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD +VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv +bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv +b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV +UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU +cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds +b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH +iM3dFw4usJTQGz0O9pTAipTHBsiQl8i4ZBp6fmw8U+E3KHNgf7KXUwefU/ltWJTS +r41tiGeA5u2ylc9yMcqlHHK6XALnZELn+aks1joNrI1CqiQBOeacPwGFVw1Yh0X4 +04Wqk2kmhXBIgD8SFcd5tB8FLztimQIDAQABMA0GCSqGSIb3DQEBBAUAA4GBAG3r +GwnpXtlR22ciYaQqPEh346B8pt5zohQDhT37qw4wxYMWM4ETCJ57NE7fQMh017l9 +3PR2VX2bY1QY6fDq81yx2YtCHrnAlU66+tXifPVoYb+O7AWXX1uw16OFNMQkpw0P +lZPvy5TYnh+dXIVtx6quTx8itc2VrbqnzPmrC3p/ +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Basic CA/emailAddress=personal-basic@thawte.com + Validity + Not Before: Jan 1 00:00:00 1996 GMT + Not After : Dec 31 23:59:59 2020 GMT + Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Basic CA/emailAddress=personal-basic@thawte.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:bc:bc:93:53:6d:c0:50:4f:82:15:e6:48:94:35: + a6:5a:be:6f:42:fa:0f:47:ee:77:75:72:dd:8d:49: + 9b:96:57:a0:78:d4:ca:3f:51:b3:69:0b:91:76:17: + 22:07:97:6a:c4:51:93:4b:e0:8d:ef:37:95:a1:0c: + 4d:da:34:90:1d:17:89:97:e0:35:38:57:4a:c0:f4: + 08:70:e9:3c:44:7b:50:7e:61:9a:90:e3:23:d3:88: + 11:46:27:f5:0b:07:0e:bb:dd:d1:7f:20:0a:88:b9: + 56:0b:2e:1c:80:da:f1:e3:9e:29:ef:14:bd:0a:44: + fb:1b:5b:18:d1:bf:23:93:21 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + Signature Algorithm: md5WithRSAEncryption + 2d:e2:99:6b:b0:3d:7a:89:d7:59:a2:94:01:1f:2b:dd:12:4b: + 53:c2:ad:7f:aa:a7:00:5c:91:40:57:25:4a:38:aa:84:70:b9: + d9:80:0f:a5:7b:5c:fb:73:c6:bd:d7:8a:61:5c:03:e3:2d:27: + a8:17:e0:84:85:42:dc:5e:9b:c6:b7:b2:6d:bb:74:af:e4:3f: + cb:a7:b7:b0:e0:5d:be:78:83:25:94:d2:db:81:0f:79:07:6d: + 4f:f4:39:15:5a:52:01:7b:de:32:d6:4d:38:f6:12:5c:06:50: + df:05:5b:bd:14:4b:a1:df:29:ba:3b:41:8d:f7:63:56:a1:df: + 22:b1 +MD5 Fingerprint=E6:0B:D2:C9:CA:2D:88:DB:1A:71:0E:4B:78:EB:02:41 +-----BEGIN CERTIFICATE----- +MIIDITCCAoqgAwIBAgIBADANBgkqhkiG9w0BAQQFADCByzELMAkGA1UEBhMCWkEx +FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMRowGAYD +VQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT +ZXJ2aWNlcyBEaXZpc2lvbjEhMB8GA1UEAxMYVGhhd3RlIFBlcnNvbmFsIEJhc2lj +IENBMSgwJgYJKoZIhvcNAQkBFhlwZXJzb25hbC1iYXNpY0B0aGF3dGUuY29tMB4X +DTk2MDEwMTAwMDAwMFoXDTIwMTIzMTIzNTk1OVowgcsxCzAJBgNVBAYTAlpBMRUw +EwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UE +ChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRpb24gU2Vy +dmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQZXJzb25hbCBCYXNpYyBD +QTEoMCYGCSqGSIb3DQEJARYZcGVyc29uYWwtYmFzaWNAdGhhd3RlLmNvbTCBnzAN +BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvLyTU23AUE+CFeZIlDWmWr5vQvoPR+53 +dXLdjUmbllegeNTKP1GzaQuRdhciB5dqxFGTS+CN7zeVoQxN2jSQHReJl+A1OFdK +wPQIcOk8RHtQfmGakOMj04gRRif1CwcOu93RfyAKiLlWCy4cgNrx454p7xS9CkT7 +G1sY0b8jkyECAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQQF +AAOBgQAt4plrsD16iddZopQBHyvdEktTwq1/qqcAXJFAVyVKOKqEcLnZgA+le1z7 +c8a914phXAPjLSeoF+CEhULcXpvGt7Jtu3Sv5D/Lp7ew4F2+eIMllNLbgQ95B21P +9DkVWlIBe94y1k049hJcBlDfBVu9FEuh3ym6O0GN92NWod8isQ== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Premium CA/emailAddress=personal-premium@thawte.com + Validity + Not Before: Jan 1 00:00:00 1996 GMT + Not After : Dec 31 23:59:59 2020 GMT + Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Premium CA/emailAddress=personal-premium@thawte.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:c9:66:d9:f8:07:44:cf:b9:8c:2e:f0:a1:ef:13: + 45:6c:05:df:de:27:16:51:36:41:11:6c:6c:3b:ed: + fe:10:7d:12:9e:e5:9b:42:9a:fe:60:31:c3:66:b7: + 73:3a:48:ae:4e:d0:32:37:94:88:b5:0d:b6:d9:f3: + f2:44:d9:d5:88:12:dd:76:4d:f2:1a:fc:6f:23:1e: + 7a:f1:d8:98:45:4e:07:10:ef:16:42:d0:43:75:6d: + 4a:de:e2:aa:c9:31:ff:1f:00:70:7c:66:cf:10:25: + 08:ba:fa:ee:00:e9:46:03:66:27:11:15:3b:aa:5b: + f2:98:dd:36:42:b2:da:88:75 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + Signature Algorithm: md5WithRSAEncryption + 69:36:89:f7:34:2a:33:72:2f:6d:3b:d4:22:b2:b8:6f:9a:c5: + 36:66:0e:1b:3c:a1:b1:75:5a:e6:fd:35:d3:f8:a8:f2:07:6f: + 85:67:8e:de:2b:b9:e2:17:b0:3a:a0:f0:0e:a2:00:9a:df:f3: + 14:15:6e:bb:c8:85:5a:98:80:f9:ff:be:74:1d:3d:f3:fe:30: + 25:d1:37:34:67:fa:a5:71:79:30:61:29:72:c0:e0:2c:4c:fb: + 56:e4:3a:a8:6f:e5:32:59:52:db:75:28:50:59:0c:f8:0b:19: + e4:ac:d9:af:96:8d:2f:50:db:07:c3:ea:1f:ab:33:e0:f5:2b: + 31:89 +MD5 Fingerprint=3A:B2:DE:22:9A:20:93:49:F9:ED:C8:D2:8A:E7:68:0D +-----BEGIN CERTIFICATE----- +MIIDKTCCApKgAwIBAgIBADANBgkqhkiG9w0BAQQFADCBzzELMAkGA1UEBhMCWkEx +FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMRowGAYD +VQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT +ZXJ2aWNlcyBEaXZpc2lvbjEjMCEGA1UEAxMaVGhhd3RlIFBlcnNvbmFsIFByZW1p +dW0gQ0ExKjAoBgkqhkiG9w0BCQEWG3BlcnNvbmFsLXByZW1pdW1AdGhhd3RlLmNv +bTAeFw05NjAxMDEwMDAwMDBaFw0yMDEyMzEyMzU5NTlaMIHPMQswCQYDVQQGEwJa +QTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xGjAY +BgNVBAoTEVRoYXd0ZSBDb25zdWx0aW5nMSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9u +IFNlcnZpY2VzIERpdmlzaW9uMSMwIQYDVQQDExpUaGF3dGUgUGVyc29uYWwgUHJl +bWl1bSBDQTEqMCgGCSqGSIb3DQEJARYbcGVyc29uYWwtcHJlbWl1bUB0aGF3dGUu +Y29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJZtn4B0TPuYwu8KHvE0Vs +Bd/eJxZRNkERbGw77f4QfRKe5ZtCmv5gMcNmt3M6SK5O0DI3lIi1DbbZ8/JE2dWI +Et12TfIa/G8jHnrx2JhFTgcQ7xZC0EN1bUre4qrJMf8fAHB8Zs8QJQi6+u4A6UYD +ZicRFTuqW/KY3TZCstqIdQIDAQABoxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqG +SIb3DQEBBAUAA4GBAGk2ifc0KjNyL2071CKyuG+axTZmDhs8obF1Wub9NdP4qPIH +b4Vnjt4rueIXsDqg8A6iAJrf8xQVbrvIhVqYgPn/vnQdPfP+MCXRNzRn+qVxeTBh +KXLA4CxM+1bkOqhv5TJZUtt1KFBZDPgLGeSs2a+WjS9Q2wfD6h+rM+D1KzGJ +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Freemail CA/emailAddress=personal-freemail@thawte.com + Validity + Not Before: Jan 1 00:00:00 1996 GMT + Not After : Dec 31 23:59:59 2020 GMT + Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Freemail CA/emailAddress=personal-freemail@thawte.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:d4:69:d7:d4:b0:94:64:5b:71:e9:47:d8:0c:51: + b6:ea:72:91:b0:84:5e:7d:2d:0d:8f:7b:12:df:85: + 25:75:28:74:3a:42:2c:63:27:9f:95:7b:4b:ef:7e: + 19:87:1d:86:ea:a3:dd:b9:ce:96:64:1a:c2:14:6e: + 44:ac:7c:e6:8f:e8:4d:0f:71:1f:40:38:a6:00:a3: + 87:78:f6:f9:94:86:5e:ad:ea:c0:5e:76:eb:d9:14: + a3:5d:6e:7a:7c:0c:a5:4b:55:7f:06:19:29:7f:9e: + 9a:26:d5:6a:bb:38:24:08:6a:98:c7:b1:da:a3:98: + 91:fd:79:db:e5:5a:c4:1c:b9 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + Signature Algorithm: md5WithRSAEncryption + c7:ec:92:7e:4e:f8:f5:96:a5:67:62:2a:a4:f0:4d:11:60:d0: + 6f:8d:60:58:61:ac:26:bb:52:35:5c:08:cf:30:fb:a8:4a:96: + 8a:1f:62:42:23:8c:17:0f:f4:ba:64:9c:17:ac:47:29:df:9d: + 98:5e:d2:6c:60:71:5c:a2:ac:dc:79:e3:e7:6e:00:47:1f:b5: + 0d:28:e8:02:9d:e4:9a:fd:13:f4:a6:d9:7c:b1:f8:dc:5f:23: + 26:09:91:80:73:d0:14:1b:de:43:a9:83:25:f2:e6:9c:2f:15: + ca:fe:a6:ab:8a:07:75:8b:0c:dd:51:84:6b:e4:f8:d1:ce:77: + a2:81 +MD5 Fingerprint=1E:74:C3:86:3C:0C:35:C5:3E:C2:7F:EF:3C:AA:3C:D9 +-----BEGIN CERTIFICATE----- +MIIDLTCCApagAwIBAgIBADANBgkqhkiG9w0BAQQFADCB0TELMAkGA1UEBhMCWkEx +FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMRowGAYD +VQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT +ZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVt +YWlsIENBMSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3dGUu +Y29tMB4XDTk2MDEwMTAwMDAwMFoXDTIwMTIzMTIzNTk1OVowgdExCzAJBgNVBAYT +AlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEa +MBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRp +b24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBG +cmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhh +d3RlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1GnX1LCUZFtx6UfY +DFG26nKRsIRefS0Nj3sS34UldSh0OkIsYyeflXtL734Zhx2G6qPduc6WZBrCFG5E +rHzmj+hND3EfQDimAKOHePb5lIZererAXnbr2RSjXW56fAylS1V/Bhkpf56aJtVq +uzgkCGqYx7Hao5iR/Xnb5VrEHLkCAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zAN +BgkqhkiG9w0BAQQFAAOBgQDH7JJ+Tvj1lqVnYiqk8E0RYNBvjWBYYawmu1I1XAjP +MPuoSpaKH2JCI4wXD/S6ZJwXrEcp352YXtJsYHFcoqzceePnbgBHH7UNKOgCneSa +/RP0ptl8sfjcXyMmCZGAc9AUG95DqYMl8uacLxXK/qarigd1iwzdUYRr5PjRznei +gQ== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com + Validity + Not Before: Aug 1 00:00:00 1996 GMT + Not After : Dec 31 23:59:59 2020 GMT + Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:d3:a4:50:6e:c8:ff:56:6b:e6:cf:5d:b6:ea:0c: + 68:75:47:a2:aa:c2:da:84:25:fc:a8:f4:47:51:da: + 85:b5:20:74:94:86:1e:0f:75:c9:e9:08:61:f5:06: + 6d:30:6e:15:19:02:e9:52:c0:62:db:4d:99:9e:e2: + 6a:0c:44:38:cd:fe:be:e3:64:09:70:c5:fe:b1:6b: + 29:b6:2f:49:c8:3b:d4:27:04:25:10:97:2f:e7:90: + 6d:c0:28:42:99:d7:4c:43:de:c3:f5:21:6d:54:9f: + 5d:c3:58:e1:c0:e4:d9:5b:b0:b8:dc:b4:7b:df:36: + 3a:c2:b5:66:22:12:d6:87:0d + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + Signature Algorithm: md5WithRSAEncryption + 07:fa:4c:69:5c:fb:95:cc:46:ee:85:83:4d:21:30:8e:ca:d9: + a8:6f:49:1a:e6:da:51:e3:60:70:6c:84:61:11:a1:1a:c8:48: + 3e:59:43:7d:4f:95:3d:a1:8b:b7:0b:62:98:7a:75:8a:dd:88: + 4e:4e:9e:40:db:a8:cc:32:74:b9:6f:0d:c6:e3:b3:44:0b:d9: + 8a:6f:9a:29:9b:99:18:28:3b:d1:e3:40:28:9a:5a:3c:d5:b5: + e7:20:1b:8b:ca:a4:ab:8d:e9:51:d9:e2:4c:2c:59:a9:da:b9: + b2:75:1b:f6:42:f2:ef:c7:f2:18:f9:89:bc:a3:ff:8a:23:2e: + 70:47 +MD5 Fingerprint=C5:70:C4:A2:ED:53:78:0C:C8:10:53:81:64:CB:D0:1D +-----BEGIN CERTIFICATE----- +MIIDEzCCAnygAwIBAgIBATANBgkqhkiG9w0BAQQFADCBxDELMAkGA1UEBhMCWkEx +FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYD +VQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlv +biBTZXJ2aWNlcyBEaXZpc2lvbjEZMBcGA1UEAxMQVGhhd3RlIFNlcnZlciBDQTEm +MCQGCSqGSIb3DQEJARYXc2VydmVyLWNlcnRzQHRoYXd0ZS5jb20wHhcNOTYwODAx +MDAwMDAwWhcNMjAxMjMxMjM1OTU5WjCBxDELMAkGA1UEBhMCWkExFTATBgNVBAgT +DFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYDVQQKExRUaGF3 +dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBTZXJ2aWNl +cyBEaXZpc2lvbjEZMBcGA1UEAxMQVGhhd3RlIFNlcnZlciBDQTEmMCQGCSqGSIb3 +DQEJARYXc2VydmVyLWNlcnRzQHRoYXd0ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQAD +gY0AMIGJAoGBANOkUG7I/1Zr5s9dtuoMaHVHoqrC2oQl/Kj0R1HahbUgdJSGHg91 +yekIYfUGbTBuFRkC6VLAYttNmZ7iagxEOM3+vuNkCXDF/rFrKbYvScg71CcEJRCX +L+eQbcAoQpnXTEPew/UhbVSfXcNY4cDk2VuwuNy0e982OsK1ZiIS1ocNAgMBAAGj +EzARMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAB/pMaVz7lcxG +7oWDTSEwjsrZqG9JGubaUeNgcGyEYRGhGshIPllDfU+VPaGLtwtimHp1it2ITk6e +QNuozDJ0uW8NxuOzRAvZim+aKZuZGCg70eNAKJpaPNW15yAbi8qkq43pUdniTCxZ +qdq5snUb9kLy78fyGPmJvKP/iiMucEc= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com + Validity + Not Before: Aug 1 00:00:00 1996 GMT + Not After : Dec 31 23:59:59 2020 GMT + Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:d2:36:36:6a:8b:d7:c2:5b:9e:da:81:41:62:8f: + 38:ee:49:04:55:d6:d0:ef:1c:1b:95:16:47:ef:18: + 48:35:3a:52:f4:2b:6a:06:8f:3b:2f:ea:56:e3:af: + 86:8d:9e:17:f7:9e:b4:65:75:02:4d:ef:cb:09:a2: + 21:51:d8:9b:d0:67:d0:ba:0d:92:06:14:73:d4:93: + cb:97:2a:00:9c:5c:4e:0c:bc:fa:15:52:fc:f2:44: + 6e:da:11:4a:6e:08:9f:2f:2d:e3:f9:aa:3a:86:73: + b6:46:53:58:c8:89:05:bd:83:11:b8:73:3f:aa:07: + 8d:f4:42:4d:e7:40:9d:1c:37 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + Signature Algorithm: md5WithRSAEncryption + 26:48:2c:16:c2:58:fa:e8:16:74:0c:aa:aa:5f:54:3f:f2:d7: + c9:78:60:5e:5e:6e:37:63:22:77:36:7e:b2:17:c4:34:b9:f5: + 08:85:fc:c9:01:38:ff:4d:be:f2:16:42:43:e7:bb:5a:46:fb: + c1:c6:11:1f:f1:4a:b0:28:46:c9:c3:c4:42:7d:bc:fa:ab:59: + 6e:d5:b7:51:88:11:e3:a4:85:19:6b:82:4c:a4:0c:12:ad:e9: + a4:ae:3f:f1:c3:49:65:9a:8c:c5:c8:3e:25:b7:94:99:bb:92: + 32:71:07:f0:86:5e:ed:50:27:a6:0d:a6:23:f9:bb:cb:a6:07: + 14:42 +MD5 Fingerprint=06:9F:69:79:16:66:90:02:1B:8C:8C:A2:C3:07:6F:3A +-----BEGIN CERTIFICATE----- +MIIDJzCCApCgAwIBAgIBATANBgkqhkiG9w0BAQQFADCBzjELMAkGA1UEBhMCWkEx +FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYD +VQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlv +biBTZXJ2aWNlcyBEaXZpc2lvbjEhMB8GA1UEAxMYVGhhd3RlIFByZW1pdW0gU2Vy +dmVyIENBMSgwJgYJKoZIhvcNAQkBFhlwcmVtaXVtLXNlcnZlckB0aGF3dGUuY29t +MB4XDTk2MDgwMTAwMDAwMFoXDTIwMTIzMTIzNTk1OVowgc4xCzAJBgNVBAYTAlpB +MRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEdMBsG +A1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp +b24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl +cnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv +bTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo847kkE +VdbQ7xwblRZH7xhINTpS9CtqBo87L+pW46+GjZ4X9560ZXUCTe/LCaIhUdib0GfQ +ug2SBhRz1JPLlyoAnFxODLz6FVL88kRu2hFKbgifLy3j+ao6hnO2RlNYyIkFvYMR +uHM/qgeN9EJN50CdHDcCAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG +9w0BAQQFAAOBgQAmSCwWwlj66BZ0DKqqX1Q/8tfJeGBeXm43YyJ3Nn6yF8Q0ufUI +hfzJATj/Tb7yFkJD57taRvvBxhEf8UqwKEbJw8RCfbz6q1lu1bdRiBHjpIUZa4JM +pAwSremkrj/xw0llmozFyD4lt5SZu5IycQfwhl7tUCemDaYj+bvLpgcUQg== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 903804111 (0x35def4cf) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=Equifax, OU=Equifax Secure Certificate Authority + Validity + Not Before: Aug 22 16:41:51 1998 GMT + Not After : Aug 22 16:41:51 2018 GMT + Subject: C=US, O=Equifax, OU=Equifax Secure Certificate Authority + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:c1:5d:b1:58:67:08:62:ee:a0:9a:2d:1f:08:6d: + 91:14:68:98:0a:1e:fe:da:04:6f:13:84:62:21:c3: + d1:7c:ce:9f:05:e0:b8:01:f0:4e:34:ec:e2:8a:95: + 04:64:ac:f1:6b:53:5f:05:b3:cb:67:80:bf:42:02: + 8e:fe:dd:01:09:ec:e1:00:14:4f:fc:fb:f0:0c:dd: + 43:ba:5b:2b:e1:1f:80:70:99:15:57:93:16:f1:0f: + 97:6a:b7:c2:68:23:1c:cc:4d:59:30:ac:51:1e:3b: + af:2b:d6:ee:63:45:7b:c5:d9:5f:50:d2:e3:50:0f: + 3a:88:e7:bf:14:fd:e0:c7:b9 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 CRL Distribution Points: + DirName:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority/CN=CRL1 + + X509v3 Private Key Usage Period: + Not After: Aug 22 16:41:51 2018 GMT + X509v3 Key Usage: + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4 + + X509v3 Subject Key Identifier: + 48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4 + X509v3 Basic Constraints: + CA:TRUE + 1.2.840.113533.7.65.0: + 0...V3.0c.... + Signature Algorithm: sha1WithRSAEncryption + 58:ce:29:ea:fc:f7:de:b5:ce:02:b9:17:b5:85:d1:b9:e3:e0: + 95:cc:25:31:0d:00:a6:92:6e:7f:b6:92:63:9e:50:95:d1:9a: + 6f:e4:11:de:63:85:6e:98:ee:a8:ff:5a:c8:d3:55:b2:66:71: + 57:de:c0:21:eb:3d:2a:a7:23:49:01:04:86:42:7b:fc:ee:7f: + a2:16:52:b5:67:67:d3:40:db:3b:26:58:b2:28:77:3d:ae:14: + 77:61:d6:fa:2a:66:27:a0:0d:fa:a7:73:5c:ea:70:f1:94:21: + 65:44:5f:fa:fc:ef:29:68:a9:a2:87:79:ef:79:ef:4f:ac:07: + 77:38 +MD5 Fingerprint=67:CB:9D:C0:13:24:8A:82:9B:B2:17:1E:D1:1B:EC:D4 +-----BEGIN CERTIFICATE----- +MIIDIDCCAomgAwIBAgIENd70zzANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJV +UzEQMA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2Vy +dGlmaWNhdGUgQXV0aG9yaXR5MB4XDTk4MDgyMjE2NDE1MVoXDTE4MDgyMjE2NDE1 +MVowTjELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0VxdWlmYXgxLTArBgNVBAsTJEVx +dWlmYXggU2VjdXJlIENlcnRpZmljYXRlIEF1dGhvcml0eTCBnzANBgkqhkiG9w0B +AQEFAAOBjQAwgYkCgYEAwV2xWGcIYu6gmi0fCG2RFGiYCh7+2gRvE4RiIcPRfM6f +BeC4AfBONOziipUEZKzxa1NfBbPLZ4C/QgKO/t0BCezhABRP/PvwDN1Dulsr4R+A +cJkVV5MW8Q+XarfCaCMczE1ZMKxRHjuvK9buY0V7xdlfUNLjUA86iOe/FP3gx7kC +AwEAAaOCAQkwggEFMHAGA1UdHwRpMGcwZaBjoGGkXzBdMQswCQYDVQQGEwJVUzEQ +MA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2VydGlm +aWNhdGUgQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMBoGA1UdEAQTMBGBDzIwMTgw +ODIyMTY0MTUxWjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAUSOZo+SvSspXXR9gj +IBBPM5iQn9QwHQYDVR0OBBYEFEjmaPkr0rKV10fYIyAQTzOYkJ/UMAwGA1UdEwQF +MAMBAf8wGgYJKoZIhvZ9B0EABA0wCxsFVjMuMGMDAgbAMA0GCSqGSIb3DQEBBQUA +A4GBAFjOKer89961zgK5F7WF0bnj4JXMJTENAKaSbn+2kmOeUJXRmm/kEd5jhW6Y +7qj/WsjTVbJmcVfewCHrPSqnI0kBBIZCe/zuf6IWUrVnZ9NA2zsmWLIodz2uFHdh +1voqZiegDfqnc1zqcPGUIWVEX/r87yloqaKHee9570+sB3c4 +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + d0:1e:40:90:00:00:46:52:00:00:00:01:00:00:00:04 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, ST=DC, L=Washington, O=ABA.ECOM, INC., CN=ABA.ECOM Root CA/emailAddress=admin@digsigtrust.com + Validity + Not Before: Jul 12 17:33:53 1999 GMT + Not After : Jul 9 17:33:53 2009 GMT + Subject: C=US, ST=DC, L=Washington, O=ABA.ECOM, INC., CN=ABA.ECOM Root CA/emailAddress=admin@digsigtrust.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:b1:d3:11:e0:79:55:43:07:08:4c:cb:05:42:00: + e2:0d:83:46:3d:e4:93:ba:b6:06:d3:0d:59:bd:3e: + c1:ce:43:67:01:8a:21:a8:ef:bc:cc:d0:a2:cc:b0: + 55:96:53:84:66:05:00:da:44:49:80:d8:54:0a:a5: + 25:86:94:ed:63:56:ff:70:6c:a3:a1:19:d2:78:be: + 68:2a:44:5e:2f:cf:cc:18:5e:47:bc:3a:b1:46:3d: + 1e:f0:b9:2c:34:5f:8c:7c:4c:08:29:9d:40:55:eb: + 3c:7d:83:de:b5:f0:f7:8a:83:0e:a1:4c:b4:3a:a5: + b3:5f:5a:22:97:ec:19:9b:c1:05:68:fd:e6:b7:a9: + 91:94:2c:e4:78:48:24:1a:25:19:3a:eb:95:9c:39: + 0a:8a:cf:42:b2:f0:1c:d5:5f:fb:6b:ed:68:56:7b: + 39:2c:72:38:b0:ee:93:a9:d3:7b:77:3c:eb:71:03: + a9:38:4a:16:6c:89:2a:ca:da:33:13:79:c2:55:8c: + ed:9c:bb:f2:cb:5b:10:f8:2e:61:35:c6:29:4c:2a: + d0:2a:63:d1:65:59:b4:f8:cd:f9:f4:00:84:b6:57: + 42:85:9d:32:a8:f9:2a:54:fb:ff:78:41:bc:bd:71: + 28:f4:bb:90:bc:ff:96:34:04:e3:45:9e:a1:46:28: + 40:81 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE, pathlen:8 + Signature Algorithm: sha1WithRSAEncryption + 04:6f:25:86:e4:e6:96:27:b4:d9:42:c0:d0:c9:00:b1:7f:54: + 3e:87:b2:6d:24:a9:2f:0a:7e:fd:a4:44:b0:f8:54:07:bd:1b: + 9d:9d:ca:7b:50:24:7b:11:5b:49:a3:a6:bf:12:74:d5:89:b7: + b7:2f:98:64:25:14:b7:61:e9:7f:60:80:6b:d3:64:e8:ab:bd: + 1a:d6:51:fa:c0:b4:5d:77:1a:7f:64:08:5e:79:c6:05:4c:f1: + 7a:dd:4d:7d:ce:e6:48:7b:54:d2:61:92:81:d6:1b:d6:00:f0: + 0e:9e:28:77:a0:4d:88:c7:22:76:19:c3:c7:9e:1b:a6:77:78: + f8:5f:9b:56:d1:f0:f2:17:ac:8e:9d:59:e6:1f:fe:57:b6:d9: + 5e:e1:5d:9f:45:ec:61:68:19:41:e1:b2:20:26:fe:5a:30:76: + 24:ff:40:72:3c:79:9f:7c:22:48:ab:46:cd:db:b3:86:2c:8f: + bf:05:41:d3:c1:e3:14:e3:41:17:26:d0:7c:a7:71:4c:19:e8: + 4a:0f:72:58:31:7d:ec:60:7a:a3:22:28:bd:19:24:60:3f:3b: + 87:73:c0:6b:e4:cb:ae:b7:ab:25:43:b2:55:2d:7b:ab:06:0e: + 75:5d:34:e5:5d:73:6d:9e:b2:75:40:a5:59:c9:4f:31:71:88: + d9:88:7f:54 +MD5 Fingerprint=41:B8:07:F7:A8:D1:09:EE:B4:9A:8E:70:4D:FC:1B:78 +-----BEGIN CERTIFICATE----- +MIIDtTCCAp2gAwIBAgIRANAeQJAAAEZSAAAAAQAAAAQwDQYJKoZIhvcNAQEFBQAw +gYkxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJEQzETMBEGA1UEBxMKV2FzaGluZ3Rv +bjEXMBUGA1UEChMOQUJBLkVDT00sIElOQy4xGTAXBgNVBAMTEEFCQS5FQ09NIFJv +b3QgQ0ExJDAiBgkqhkiG9w0BCQEWFWFkbWluQGRpZ3NpZ3RydXN0LmNvbTAeFw05 +OTA3MTIxNzMzNTNaFw0wOTA3MDkxNzMzNTNaMIGJMQswCQYDVQQGEwJVUzELMAkG +A1UECBMCREMxEzARBgNVBAcTCldhc2hpbmd0b24xFzAVBgNVBAoTDkFCQS5FQ09N +LCBJTkMuMRkwFwYDVQQDExBBQkEuRUNPTSBSb290IENBMSQwIgYJKoZIhvcNAQkB +FhVhZG1pbkBkaWdzaWd0cnVzdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw +ggEKAoIBAQCx0xHgeVVDBwhMywVCAOINg0Y95JO6tgbTDVm9PsHOQ2cBiiGo77zM +0KLMsFWWU4RmBQDaREmA2FQKpSWGlO1jVv9wbKOhGdJ4vmgqRF4vz8wYXke8OrFG +PR7wuSw0X4x8TAgpnUBV6zx9g9618PeKgw6hTLQ6pbNfWiKX7BmbwQVo/ea3qZGU +LOR4SCQaJRk665WcOQqKz0Ky8BzVX/tr7WhWezkscjiw7pOp03t3POtxA6k4ShZs +iSrK2jMTecJVjO2cu/LLWxD4LmE1xilMKtAqY9FlWbT4zfn0AIS2V0KFnTKo+SpU ++/94Qby9cSj0u5C8/5Y0BONFnqFGKECBAgMBAAGjFjAUMBIGA1UdEwEB/wQIMAYB +Af8CAQgwDQYJKoZIhvcNAQEFBQADggEBAARvJYbk5pYntNlCwNDJALF/VD6Hsm0k +qS8Kfv2kRLD4VAe9G52dyntQJHsRW0mjpr8SdNWJt7cvmGQlFLdh6X9ggGvTZOir +vRrWUfrAtF13Gn9kCF55xgVM8XrdTX3O5kh7VNJhkoHWG9YA8A6eKHegTYjHInYZ +w8eeG6Z3ePhfm1bR8PIXrI6dWeYf/le22V7hXZ9F7GFoGUHhsiAm/lowdiT/QHI8 +eZ98IkirRs3bs4Ysj78FQdPB4xTjQRcm0HyncUwZ6EoPclgxfexgeqMiKL0ZJGA/ +O4dzwGvky663qyVDslUte6sGDnVdNOVdc22esnVApVnJTzFxiNmIf1Q= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 913315222 (0x36701596) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=Digital Signature Trust Co., OU=DSTCA E1 + Validity + Not Before: Dec 10 18:10:23 1998 GMT + Not After : Dec 10 18:40:23 2018 GMT + Subject: C=US, O=Digital Signature Trust Co., OU=DSTCA E1 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:a0:6c:81:a9:cf:34:1e:24:dd:fe:86:28:cc:de: + 83:2f:f9:5e:d4:42:d2:e8:74:60:66:13:98:06:1c: + a9:51:12:69:6f:31:55:b9:49:72:00:08:7e:d3:a5: + 62:44:37:24:99:8f:d9:83:48:8f:99:6d:95:13:bb: + 43:3b:2e:49:4e:88:37:c1:bb:58:7f:fe:e1:bd:f8: + bb:61:cd:f3:47:c0:99:a6:f1:f3:91:e8:78:7c:00: + cb:61:c9:44:27:71:69:55:4a:7e:49:4d:ed:a2:a3: + be:02:4c:00:ca:02:a8:ee:01:02:31:64:0f:52:2d: + 13:74:76:36:b5:7a:b4:2d:71 + Exponent: 3 (0x3) + X509v3 extensions: + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 CRL Distribution Points: + DirName:/C=US/O=Digital Signature Trust Co./OU=DSTCA E1/CN=CRL1 + + X509v3 Private Key Usage Period: + Not Before: Dec 10 18:10:23 1998 GMT, Not After: Dec 10 18:10:23 2018 GMT + X509v3 Key Usage: + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:6A:79:7E:91:69:46:18:13:0A:02:77:A5:59:5B:60:98:25:0E:A2:F8 + + X509v3 Subject Key Identifier: + 6A:79:7E:91:69:46:18:13:0A:02:77:A5:59:5B:60:98:25:0E:A2:F8 + X509v3 Basic Constraints: + CA:TRUE + 1.2.840.113533.7.65.0: + 0 +..V4.0.... + Signature Algorithm: sha1WithRSAEncryption + 22:12:d8:7a:1d:dc:81:06:b6:09:65:b2:87:c8:1f:5e:b4:2f: + e9:c4:1e:f2:3c:c1:bb:04:90:11:4a:83:4e:7e:93:b9:4d:42: + c7:92:26:a0:5c:34:9a:38:72:f8:fd:6b:16:3e:20:ee:82:8b: + 31:2a:93:36:85:23:88:8a:3c:03:68:d3:c9:09:0f:4d:fc:6c: + a4:da:28:72:93:0e:89:80:b0:7d:fe:80:6f:65:6d:18:33:97: + 8b:c2:6b:89:ee:60:3d:c8:9b:ef:7f:2b:32:62:73:93:cb:3c: + e3:7b:e2:76:78:45:bc:a1:93:04:bb:86:9f:3a:5b:43:7a:c3: + 8a:65 +MD5 Fingerprint=25:7A:BA:83:2E:B6:A2:0B:DA:FE:F5:02:0F:08:D7:AD +-----BEGIN CERTIFICATE----- +MIIDKTCCApKgAwIBAgIENnAVljANBgkqhkiG9w0BAQUFADBGMQswCQYDVQQGEwJV +UzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMREwDwYDVQQL +EwhEU1RDQSBFMTAeFw05ODEyMTAxODEwMjNaFw0xODEyMTAxODQwMjNaMEYxCzAJ +BgNVBAYTAlVTMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4x +ETAPBgNVBAsTCERTVENBIEUxMIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCg +bIGpzzQeJN3+hijM3oMv+V7UQtLodGBmE5gGHKlREmlvMVW5SXIACH7TpWJENySZ +j9mDSI+ZbZUTu0M7LklOiDfBu1h//uG9+LthzfNHwJmm8fOR6Hh8AMthyUQncWlV +Sn5JTe2io74CTADKAqjuAQIxZA9SLRN0dja1erQtcQIBA6OCASQwggEgMBEGCWCG +SAGG+EIBAQQEAwIABzBoBgNVHR8EYTBfMF2gW6BZpFcwVTELMAkGA1UEBhMCVVMx +JDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjERMA8GA1UECxMI +RFNUQ0EgRTExDTALBgNVBAMTBENSTDEwKwYDVR0QBCQwIoAPMTk5ODEyMTAxODEw +MjNagQ8yMDE4MTIxMDE4MTAyM1owCwYDVR0PBAQDAgEGMB8GA1UdIwQYMBaAFGp5 +fpFpRhgTCgJ3pVlbYJglDqL4MB0GA1UdDgQWBBRqeX6RaUYYEwoCd6VZW2CYJQ6i ++DAMBgNVHRMEBTADAQH/MBkGCSqGSIb2fQdBAAQMMAobBFY0LjADAgSQMA0GCSqG +SIb3DQEBBQUAA4GBACIS2Hod3IEGtgllsofIH160L+nEHvI8wbsEkBFKg05+k7lN +QseSJqBcNJo4cvj9axY+IO6CizEqkzaFI4iKPANo08kJD038bKTaKHKTDomAsH3+ +gG9lbRgzl4vCa4nuYD3Im+9/KzJic5PLPON74nZ4RbyhkwS7hp86W0N6w4pl +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 913232846 (0x366ed3ce) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=Digital Signature Trust Co., OU=DSTCA E2 + Validity + Not Before: Dec 9 19:17:26 1998 GMT + Not After : Dec 9 19:47:26 2018 GMT + Subject: C=US, O=Digital Signature Trust Co., OU=DSTCA E2 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:bf:93:8f:17:92:ef:33:13:18:eb:10:7f:4e:16: + bf:ff:06:8f:2a:85:bc:5e:f9:24:a6:24:88:b6:03: + b7:c1:c3:5f:03:5b:d1:6f:ae:7e:42:ea:66:23:b8: + 63:83:56:fb:28:2d:e1:38:8b:b4:ee:a8:01:e1:ce: + 1c:b6:88:2a:22:46:85:fb:9f:a7:70:a9:47:14:3f: + ce:de:65:f0:a8:71:f7:4f:26:6c:8c:bc:c6:b5:ef: + de:49:27:ff:48:2a:7d:e8:4d:03:cc:c7:b2:52:c6: + 17:31:13:3b:b5:4d:db:c8:c4:f6:c3:0f:24:2a:da: + 0c:9d:e7:91:5b:80:cd:94:9d + Exponent: 3 (0x3) + X509v3 extensions: + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 CRL Distribution Points: + DirName:/C=US/O=Digital Signature Trust Co./OU=DSTCA E2/CN=CRL1 + + X509v3 Private Key Usage Period: + Not Before: Dec 9 19:17:26 1998 GMT, Not After: Dec 9 19:17:26 2018 GMT + X509v3 Key Usage: + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:1E:82:4D:28:65:80:3C:C9:41:6E:AC:35:2E:5A:CB:DE:EE:F8:39:5B + + X509v3 Subject Key Identifier: + 1E:82:4D:28:65:80:3C:C9:41:6E:AC:35:2E:5A:CB:DE:EE:F8:39:5B + X509v3 Basic Constraints: + CA:TRUE + 1.2.840.113533.7.65.0: + 0 +..V4.0.... + Signature Algorithm: sha1WithRSAEncryption + 47:8d:83:ad:62:f2:db:b0:9e:45:22:05:b9:a2:d6:03:0e:38: + 72:e7:9e:fc:7b:e6:93:b6:9a:a5:a2:94:c8:34:1d:91:d1:c5: + d7:f4:0a:25:0f:3d:78:81:9e:0f:b1:67:c4:90:4c:63:dd:5e: + a7:e2:ba:9f:f5:f7:4d:a5:31:7b:9c:29:2d:4c:fe:64:3e:ec: + b6:53:fe:ea:9b:ed:82:db:74:75:4b:07:79:6e:1e:d8:19:83: + 73:de:f5:3e:d0:b5:de:e7:4b:68:7d:43:2e:2a:20:e1:7e:a0: + 78:44:9e:08:f5:98:f9:c7:7f:1b:1b:d6:06:20:02:58:a1:c3: + a2:03 +MD5 Fingerprint=93:C2:8E:11:7B:D4:F3:03:19:BD:28:75:13:4A:45:4A +-----BEGIN CERTIFICATE----- +MIIDKTCCApKgAwIBAgIENm7TzjANBgkqhkiG9w0BAQUFADBGMQswCQYDVQQGEwJV +UzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMREwDwYDVQQL +EwhEU1RDQSBFMjAeFw05ODEyMDkxOTE3MjZaFw0xODEyMDkxOTQ3MjZaMEYxCzAJ +BgNVBAYTAlVTMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4x +ETAPBgNVBAsTCERTVENBIEUyMIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQC/ +k48Xku8zExjrEH9OFr//Bo8qhbxe+SSmJIi2A7fBw18DW9Fvrn5C6mYjuGODVvso +LeE4i7TuqAHhzhy2iCoiRoX7n6dwqUcUP87eZfCocfdPJmyMvMa1795JJ/9IKn3o +TQPMx7JSxhcxEzu1TdvIxPbDDyQq2gyd55FbgM2UnQIBA6OCASQwggEgMBEGCWCG +SAGG+EIBAQQEAwIABzBoBgNVHR8EYTBfMF2gW6BZpFcwVTELMAkGA1UEBhMCVVMx +JDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjERMA8GA1UECxMI +RFNUQ0EgRTIxDTALBgNVBAMTBENSTDEwKwYDVR0QBCQwIoAPMTk5ODEyMDkxOTE3 +MjZagQ8yMDE4MTIwOTE5MTcyNlowCwYDVR0PBAQDAgEGMB8GA1UdIwQYMBaAFB6C +TShlgDzJQW6sNS5ay97u+DlbMB0GA1UdDgQWBBQegk0oZYA8yUFurDUuWsve7vg5 +WzAMBgNVHRMEBTADAQH/MBkGCSqGSIb2fQdBAAQMMAobBFY0LjADAgSQMA0GCSqG +SIb3DQEBBQUAA4GBAEeNg61i8tuwnkUiBbmi1gMOOHLnnvx75pO2mqWilMg0HZHR +xdf0CiUPPXiBng+xZ8SQTGPdXqfiup/1902lMXucKS1M/mQ+7LZT/uqb7YLbdHVL +B3luHtgZg3Pe9T7Qtd7nS2h9Qy4qIOF+oHhEngj1mPnHfxsb1gYgAlihw6ID +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: + d0:1e:40:8b:00:00:02:7c:00:00:00:02:00:00:00:01 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=us, ST=Utah, L=Salt Lake City, O=Digital Signature Trust Co., OU=DSTCA X1, CN=DST RootCA X1/emailAddress=ca@digsigtrust.com + Validity + Not Before: Dec 1 18:18:55 1998 GMT + Not After : Nov 28 18:18:55 2008 GMT + Subject: C=us, ST=Utah, L=Salt Lake City, O=Digital Signature Trust Co., OU=DSTCA X1, CN=DST RootCA X1/emailAddress=ca@digsigtrust.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:d2:c6:26:b6:e7:a5:3d:c1:c4:68:d5:50:6f:53: + c5:6f:49:13:09:b8:af:2c:48:8d:14:6a:a3:17:5f: + 5a:f9:d3:2e:75:2f:d8:28:62:d1:93:2f:fc:4d:d4: + ab:87:e5:08:c7:99:e7:92:3f:75:bd:eb:25:b4:15: + c1:9b:19:3d:d2:44:8d:d7:74:20:6d:37:02:8f:69: + 93:5b:8a:c4:19:9d:f4:b2:0e:fc:16:6c:b9:b1:05: + 92:83:d1:85:2c:60:94:3e:45:55:a0:d9:ab:08:21: + e6:60:e8:3b:74:f2:99:50:51:68:d0:03:2d:b1:80: + be:a3:d8:52:b0:44:cd:43:4a:70:8e:58:85:95:e1: + 4e:2c:d6:2d:41:6f:d6:84:e7:c8:98:44:ca:47:db: + 2c:24:a5:69:26:cf:6b:b8:27:62:c3:f4:c9:7a:92: + 23:ed:13:67:82:ae:45:2e:45:e5:7e:72:3f:85:9d: + 94:62:10:e6:3c:91:a1:ad:77:00:e0:15:ec:f3:84: + 80:72:7a:8e:6e:60:97:c7:24:59:10:34:83:5b:e1: + a5:a4:69:b6:57:35:1c:78:59:c6:d3:2f:3a:73:67: + ee:94:ca:04:13:05:62:06:70:23:b3:f4:7c:ee:45: + d9:64:0b:5b:49:aa:a4:43:ce:26:c4:44:12:6c:b8: + dd:79 + Exponent: 65537 (0x10001) + Signature Algorithm: sha1WithRSAEncryption + a2:37:b2:3f:69:fb:d7:86:79:54:49:31:95:33:2b:f3:d1:09: + 14:49:62:60:86:a5:b0:11:e2:50:c2:1d:06:57:3e:2d:e8:33: + 64:be:9b:aa:ad:5f:1b:4d:d4:99:95:a2:8b:9a:c9:62:72:b5: + 69:ea:d9:58:ab:35:ed:15:a2:43:d6:b6:bc:07:79:65:64:73: + 7d:d7:79:ca:7b:d5:5a:51:c6:e1:53:04:96:8d:38:cf:a3:17: + ac:39:71:6b:01:c3:8b:53:3c:63:e9:ee:79:c0:e4:be:92:32: + 64:7a:b3:1f:97:94:62:bd:ea:b2:20:15:95:fb:97:f2:78:2f: + 63:36:40:38:e3:46:0f:1d:dd:ac:95:ca:e7:4b:90:7b:b1:4b: + a9:d4:c5:eb:9a:da:aa:d5:a3:94:14:46:8d:2d:1f:f3:3a:d6: + 93:3a:f6:3e:79:fc:e8:e6:b0:75:ed:ee:3d:c9:70:c7:5d:aa: + 81:4b:46:25:1c:c7:6c:15:e3:95:4e:0f:aa:32:37:94:0a:17: + 24:92:13:84:58:d2:63:6f:2b:f7:e6:5b:62:0b:13:17:b0:0d: + 52:4c:fe:fe:6f:5c:e2:91:6e:1d:fd:a4:62:d7:68:fa:8e:7a: + 4f:d2:08:da:93:dc:f0:92:11:7a:d0:dc:72:93:0c:73:93:62: + 85:68:d0:f4 +MD5 Fingerprint=6C:C9:A7:6E:47:F1:0C:E3:53:3B:78:4C:4D:C2:6A:C5 +-----BEGIN CERTIFICATE----- +MIID2DCCAsACEQDQHkCLAAACfAAAAAIAAAABMA0GCSqGSIb3DQEBBQUAMIGpMQsw +CQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMOU2FsdCBMYWtlIENp +dHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjERMA8GA1UE +CxMIRFNUQ0EgWDExFjAUBgNVBAMTDURTVCBSb290Q0EgWDExITAfBgkqhkiG9w0B +CQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTAeFw05ODEyMDExODE4NTVaFw0wODExMjgx +ODE4NTVaMIGpMQswCQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMO +U2FsdCBMYWtlIENpdHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0 +IENvLjERMA8GA1UECxMIRFNUQ0EgWDExFjAUBgNVBAMTDURTVCBSb290Q0EgWDEx +ITAfBgkqhkiG9w0BCQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBANLGJrbnpT3BxGjVUG9TxW9JEwm4ryxIjRRqoxdf +WvnTLnUv2Chi0ZMv/E3Uq4flCMeZ55I/db3rJbQVwZsZPdJEjdd0IG03Ao9pk1uK +xBmd9LIO/BZsubEFkoPRhSxglD5FVaDZqwgh5mDoO3TymVBRaNADLbGAvqPYUrBE +zUNKcI5YhZXhTizWLUFv1oTnyJhEykfbLCSlaSbPa7gnYsP0yXqSI+0TZ4KuRS5F +5X5yP4WdlGIQ5jyRoa13AOAV7POEgHJ6jm5gl8ckWRA0g1vhpaRptlc1HHhZxtMv +OnNn7pTKBBMFYgZwI7P0fO5F2WQLW0mqpEPOJsREEmy43XkCAwEAATANBgkqhkiG +9w0BAQUFAAOCAQEAojeyP2n714Z5VEkxlTMr89EJFEliYIalsBHiUMIdBlc+Legz +ZL6bqq1fG03UmZWii5rJYnK1aerZWKs17RWiQ9a2vAd5ZWRzfdd5ynvVWlHG4VME +lo04z6MXrDlxawHDi1M8Y+nuecDkvpIyZHqzH5eUYr3qsiAVlfuX8ngvYzZAOONG +Dx3drJXK50uQe7FLqdTF65raqtWjlBRGjS0f8zrWkzr2Pnn86Oawde3uPclwx12q +gUtGJRzHbBXjlU4PqjI3lAoXJJIThFjSY28r9+ZbYgsTF7ANUkz+/m9c4pFuHf2k +Ytdo+o56T9II2pPc8JIRetDccpMMc5NihWjQ9A== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: + d0:1e:40:8b:00:00:77:6d:00:00:00:01:00:00:00:04 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=us, ST=Utah, L=Salt Lake City, O=Digital Signature Trust Co., OU=DSTCA X2, CN=DST RootCA X2/emailAddress=ca@digsigtrust.com + Validity + Not Before: Nov 30 22:46:16 1998 GMT + Not After : Nov 27 22:46:16 2008 GMT + Subject: C=us, ST=Utah, L=Salt Lake City, O=Digital Signature Trust Co., OU=DSTCA X2, CN=DST RootCA X2/emailAddress=ca@digsigtrust.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:dc:75:f0:8c:c0:75:96:9a:c0:62:1f:26:f7:c4: + e1:9a:ea:e0:56:73:5b:99:cd:01:44:a8:08:b6:d5: + a7:da:1a:04:18:39:92:4a:78:a3:81:c2:f5:77:7a: + 50:b4:70:ff:9a:ab:c6:c7:ca:6e:83:4f:42:98:fb: + 26:0b:da:dc:6d:d6:a9:99:55:52:67:e9:28:03:92: + dc:e5:b0:05:9a:0f:15:f9:6b:59:72:56:f2:fa:39: + fc:aa:68:ee:0f:1f:10:83:2f:fc:9d:fa:17:96:dd: + 82:e3:e6:45:7d:c0:4b:80:44:1f:ed:2c:e0:84:fd: + 91:5c:92:54:69:25:e5:62:69:dc:e5:ee:00:52:bd: + 33:0b:ad:75:02:85:a7:64:50:2d:c5:19:19:30:c0: + 26:db:c9:d3:fd:2e:99:ad:59:b5:0b:4d:d4:41:ae: + 85:48:43:59:dc:b7:a8:e2:a2:de:c3:8f:d7:b8:a1: + 62:a6:68:50:52:e4:cf:31:a7:94:85:da:9f:46:32: + 17:56:e5:f2:eb:66:3d:12:ff:43:db:98:ef:77:cf: + cb:81:8d:34:b1:c6:50:4a:26:d1:e4:3e:41:50:af: + 6c:ae:22:34:2e:d5:6b:6e:83:ba:79:b8:76:65:48: + da:09:29:64:63:22:b9:fb:47:76:85:8c:86:44:cb: + 09:db + Exponent: 65537 (0x10001) + Signature Algorithm: sha1WithRSAEncryption + b5:36:0e:5d:e1:61:28:5a:11:65:c0:3f:83:03:79:4d:be:28: + a6:0b:07:02:52:85:cd:f8:91:d0:10:6c:b5:6a:20:5b:1c:90: + d9:30:3c:c6:48:9e:8a:5e:64:f9:a1:71:77:ef:04:27:1f:07: + eb:e4:26:f7:73:74:c9:44:18:1a:66:d3:e0:43:af:91:3b:d1: + cb:2c:d8:74:54:3a:1c:4d:ca:d4:68:cd:23:7c:1d:10:9e:45: + e9:f6:00:6e:a6:cd:19:ff:4f:2c:29:8f:57:4d:c4:77:92:be: + e0:4c:09:fb:5d:44:86:66:21:a8:b9:32:a2:56:d5:e9:8c:83: + 7c:59:3f:c4:f1:0b:e7:9d:ec:9e:bd:9c:18:0e:3e:c2:39:79: + 28:b7:03:0d:08:cb:c6:e7:d9:01:37:50:10:ec:cc:61:16:40: + d4:af:31:74:7b:fc:3f:31:a7:d0:47:73:33:39:1b:cc:4e:6a: + d7:49:83:11:06:fe:eb:82:58:33:32:4c:f0:56:ac:1e:9c:2f: + 56:9a:7b:c1:4a:1c:a5:fd:55:36:ce:fc:96:4d:f4:b0:f0:ec: + b7:6c:82:ed:2f:31:99:42:4c:a9:b2:0d:b8:15:5d:f1:df:ba: + c9:b5:4a:d4:64:98:b3:26:a9:30:c8:fd:a6:ec:ab:96:21:ad: + 7f:c2:78:b6 +MD5 Fingerprint=CD:3B:3D:62:5B:09:B8:09:36:87:9E:12:2F:71:64:BA +-----BEGIN CERTIFICATE----- +MIID2DCCAsACEQDQHkCLAAB3bQAAAAEAAAAEMA0GCSqGSIb3DQEBBQUAMIGpMQsw +CQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMOU2FsdCBMYWtlIENp +dHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjERMA8GA1UE +CxMIRFNUQ0EgWDIxFjAUBgNVBAMTDURTVCBSb290Q0EgWDIxITAfBgkqhkiG9w0B +CQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTAeFw05ODExMzAyMjQ2MTZaFw0wODExMjcy +MjQ2MTZaMIGpMQswCQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMO +U2FsdCBMYWtlIENpdHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0 +IENvLjERMA8GA1UECxMIRFNUQ0EgWDIxFjAUBgNVBAMTDURTVCBSb290Q0EgWDIx +ITAfBgkqhkiG9w0BCQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBANx18IzAdZaawGIfJvfE4Zrq4FZzW5nNAUSoCLbV +p9oaBBg5kkp4o4HC9Xd6ULRw/5qrxsfKboNPQpj7Jgva3G3WqZlVUmfpKAOS3OWw +BZoPFflrWXJW8vo5/Kpo7g8fEIMv/J36F5bdguPmRX3AS4BEH+0s4IT9kVySVGkl +5WJp3OXuAFK9MwutdQKFp2RQLcUZGTDAJtvJ0/0uma1ZtQtN1EGuhUhDWdy3qOKi +3sOP17ihYqZoUFLkzzGnlIXan0YyF1bl8utmPRL/Q9uY73fPy4GNNLHGUEom0eQ+ +QVCvbK4iNC7Va26Dunm4dmVI2gkpZGMiuftHdoWMhkTLCdsCAwEAATANBgkqhkiG +9w0BAQUFAAOCAQEAtTYOXeFhKFoRZcA/gwN5Tb4opgsHAlKFzfiR0BBstWogWxyQ +2TA8xkieil5k+aFxd+8EJx8H6+Qm93N0yUQYGmbT4EOvkTvRyyzYdFQ6HE3K1GjN +I3wdEJ5F6fYAbqbNGf9PLCmPV03Ed5K+4EwJ+11EhmYhqLkyolbV6YyDfFk/xPEL +553snr2cGA4+wjl5KLcDDQjLxufZATdQEOzMYRZA1K8xdHv8PzGn0EdzMzkbzE5q +10mDEQb+64JYMzJM8FasHpwvVpp7wUocpf1VNs78lk30sPDst2yC7S8xmUJMqbIN +uBVd8d+6ybVK1GSYsyapMMj9puyrliGtf8J4tg== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: + cd:ba:7f:56:f0:df:e4:bc:54:fe:22:ac:b3:72:aa:55 + Signature Algorithm: md2WithRSAEncryption + Issuer: C=US, O=VeriSign, Inc., OU=Class 1 Public Primary Certification Authority + Validity + Not Before: Jan 29 00:00:00 1996 GMT + Not After : Aug 1 23:59:59 2028 GMT + Subject: C=US, O=VeriSign, Inc., OU=Class 1 Public Primary Certification Authority + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:e5:19:bf:6d:a3:56:61:2d:99:48:71:f6:67:de: + b9:8d:eb:b7:9e:86:80:0a:91:0e:fa:38:25:af:46: + 88:82:e5:73:a8:a0:9b:24:5d:0d:1f:cc:65:6e:0c: + b0:d0:56:84:18:87:9a:06:9b:10:a1:73:df:b4:58: + 39:6b:6e:c1:f6:15:d5:a8:a8:3f:aa:12:06:8d:31: + ac:7f:b0:34:d7:8f:34:67:88:09:cd:14:11:e2:4e: + 45:56:69:1f:78:02:80:da:dc:47:91:29:bb:36:c9: + 63:5c:c5:e0:d7:2d:87:7b:a1:b7:32:b0:7b:30:ba: + 2a:2f:31:aa:ee:a3:67:da:db + Exponent: 65537 (0x10001) + Signature Algorithm: md2WithRSAEncryption + 4c:3f:b8:8b:c6:68:df:ee:43:33:0e:5d:e9:a6:cb:07:84:4d: + 7a:33:ff:92:1b:f4:36:ad:d8:95:22:36:68:11:6c:7c:42:cc: + f3:9c:2e:c4:07:3f:14:b0:0f:4f:ff:90:92:76:f9:e2:bc:4a: + e9:8f:cd:a0:80:0a:f7:c5:29:f1:82:22:5d:b8:b1:dd:81:23: + a3:7b:25:15:46:30:79:16:f8:ea:05:4b:94:7f:1d:c2:1c:c8: + e3:b7:f4:10:40:3c:13:c3:5f:1f:53:e8:48:e4:86:b4:7b:a1: + 35:b0:7b:25:ba:b8:d3:8e:ab:3f:38:9d:00:34:00:98:f3:d1: + 71:94 +MD5 Fingerprint=97:60:E8:57:5F:D3:50:47:E5:43:0C:94:36:8A:B0:62 +-----BEGIN CERTIFICATE----- +MIICPTCCAaYCEQDNun9W8N/kvFT+IqyzcqpVMA0GCSqGSIb3DQEBAgUAMF8xCzAJ +BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xh +c3MgMSBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05 +NjAxMjkwMDAwMDBaFw0yODA4MDEyMzU5NTlaMF8xCzAJBgNVBAYTAlVTMRcwFQYD +VQQKEw5WZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xhc3MgMSBQdWJsaWMgUHJp +bWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCBnzANBgkqhkiG9w0BAQEFAAOB +jQAwgYkCgYEA5Rm/baNWYS2ZSHH2Z965jeu3noaACpEO+jglr0aIguVzqKCbJF0N +H8xlbgyw0FaEGIeaBpsQoXPftFg5a27B9hXVqKg/qhIGjTGsf7A01480Z4gJzRQR +4k5FVmkfeAKA2txHkSm7NsljXMXg1y2He6G3MrB7MLoqLzGq7qNn2tsCAwEAATAN +BgkqhkiG9w0BAQIFAAOBgQBMP7iLxmjf7kMzDl3ppssHhE16M/+SG/Q2rdiVIjZo +EWx8QszznC7EBz8UsA9P/5CSdvnivErpj82ggAr3xSnxgiJduLHdgSOjeyUVRjB5 +FvjqBUuUfx3CHMjjt/QQQDwTw18fU+hI5Ia0e6E1sHslurjTjqs/OJ0ANACY89Fx +lA== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: + 2d:1b:fc:4a:17:8d:a3:91:eb:e7:ff:f5:8b:45:be:0b + Signature Algorithm: md2WithRSAEncryption + Issuer: C=US, O=VeriSign, Inc., OU=Class 2 Public Primary Certification Authority + Validity + Not Before: Jan 29 00:00:00 1996 GMT + Not After : Aug 1 23:59:59 2028 GMT + Subject: C=US, O=VeriSign, Inc., OU=Class 2 Public Primary Certification Authority + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:b6:5a:8b:a3:0d:6a:23:83:80:6b:cf:39:87:f4: + 21:13:33:06:4c:25:a2:ed:55:12:97:c5:a7:80:b9: + fa:83:c1:20:a0:fa:2f:15:0d:7c:a1:60:6b:7e:79: + 2c:fa:06:0f:3a:ae:f6:1b:6f:b1:d2:ff:2f:28:52: + 5f:83:7d:4b:c4:7a:b7:f8:66:1f:80:54:fc:b7:c2: + 8e:59:4a:14:57:46:d1:9a:93:be:41:91:03:bb:15: + 80:93:5c:eb:e7:cc:08:6c:3f:3e:b3:4a:fc:ff:4b: + 6c:23:d5:50:82:26:44:19:8e:23:c3:71:ea:19:24: + 47:04:9e:75:bf:c8:a6:00:1f + Exponent: 65537 (0x10001) + Signature Algorithm: md2WithRSAEncryption + 8a:1b:2b:fa:39:c1:74:d7:5e:d8:19:64:a2:58:4a:2d:37:e0: + 33:47:0f:ac:ed:f7:aa:db:1e:e4:8b:06:5c:60:27:ca:45:52: + ce:16:ef:3f:06:64:e7:94:68:7c:60:33:15:11:69:af:9d:62: + 8d:a3:03:54:6b:a6:be:e5:ee:05:18:60:04:bf:42:80:fd:d0: + a8:a8:1e:01:3b:f7:a3:5c:af:a3:dc:e6:26:80:23:3c:b8:44: + 74:f7:0a:ae:49:8b:61:78:cc:24:bf:88:8a:a7:0e:ea:73:19: + 41:fd:4d:03:f0:88:d1:e5:78:8d:a5:2a:4f:f6:97:0d:17:77: + ca:d8 +MD5 Fingerprint=B3:9C:25:B1:C3:2E:32:53:80:15:30:9D:4D:02:77:3E +-----BEGIN CERTIFICATE----- +MIICPDCCAaUCEC0b/EoXjaOR6+f/9YtFvgswDQYJKoZIhvcNAQECBQAwXzELMAkG +A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFz +cyAyIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk2 +MDEyOTAwMDAwMFoXDTI4MDgwMTIzNTk1OVowXzELMAkGA1UEBhMCVVMxFzAVBgNV +BAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAyIFB1YmxpYyBQcmlt +YXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GN +ADCBiQKBgQC2WoujDWojg4BrzzmH9CETMwZMJaLtVRKXxaeAufqDwSCg+i8VDXyh +YGt+eSz6Bg86rvYbb7HS/y8oUl+DfUvEerf4Zh+AVPy3wo5ZShRXRtGak75BkQO7 +FYCTXOvnzAhsPz6zSvz/S2wj1VCCJkQZjiPDceoZJEcEnnW/yKYAHwIDAQABMA0G +CSqGSIb3DQEBAgUAA4GBAIobK/o5wXTXXtgZZKJYSi034DNHD6zt96rbHuSLBlxg +J8pFUs4W7z8GZOeUaHxgMxURaa+dYo2jA1Rrpr7l7gUYYAS/QoD90KioHgE796Nc +r6Pc5iaAIzy4RHT3Cq5Ji2F4zCS/iIqnDupzGUH9TQPwiNHleI2lKk/2lw0Xd8rY +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: + 70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf + Signature Algorithm: md2WithRSAEncryption + Issuer: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority + Validity + Not Before: Jan 29 00:00:00 1996 GMT + Not After : Aug 1 23:59:59 2028 GMT + Subject: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:c9:5c:59:9e:f2:1b:8a:01:14:b4:10:df:04:40: + db:e3:57:af:6a:45:40:8f:84:0c:0b:d1:33:d9:d9: + 11:cf:ee:02:58:1f:25:f7:2a:a8:44:05:aa:ec:03: + 1f:78:7f:9e:93:b9:9a:00:aa:23:7d:d6:ac:85:a2: + 63:45:c7:72:27:cc:f4:4c:c6:75:71:d2:39:ef:4f: + 42:f0:75:df:0a:90:c6:8e:20:6f:98:0f:f8:ac:23: + 5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85: + e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2: + 71:64:4c:65:2e:81:68:45:a7 + Exponent: 65537 (0x10001) + Signature Algorithm: md2WithRSAEncryption + bb:4c:12:2b:cf:2c:26:00:4f:14:13:dd:a6:fb:fc:0a:11:84: + 8c:f3:28:1c:67:92:2f:7c:b6:c5:fa:df:f0:e8:95:bc:1d:8f: + 6c:2c:a8:51:cc:73:d8:a4:c0:53:f0:4e:d6:26:c0:76:01:57: + 81:92:5e:21:f1:d1:b1:ff:e7:d0:21:58:cd:69:17:e3:44:1c: + 9c:19:44:39:89:5c:dc:9c:00:0f:56:8d:02:99:ed:a2:90:45: + 4c:e4:bb:10:a4:3d:f0:32:03:0e:f1:ce:f8:e8:c9:51:8c:e6: + 62:9f:e6:9f:c0:7d:b7:72:9c:c9:36:3a:6b:9f:4e:a8:ff:64: + 0d:64 +MD5 Fingerprint=10:FC:63:5D:F6:26:3E:0D:F3:25:BE:5F:79:CD:67:67 +-----BEGIN CERTIFICATE----- +MIICPDCCAaUCEHC65B0Q2Sk0tjjKewPMur8wDQYJKoZIhvcNAQECBQAwXzELMAkG +A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFz +cyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk2 +MDEyOTAwMDAwMFoXDTI4MDgwMTIzNTk1OVowXzELMAkGA1UEBhMCVVMxFzAVBgNV +BAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAzIFB1YmxpYyBQcmlt +YXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GN +ADCBiQKBgQDJXFme8huKARS0EN8EQNvjV69qRUCPhAwL0TPZ2RHP7gJYHyX3KqhE +BarsAx94f56TuZoAqiN91qyFomNFx3InzPRMxnVx0jnvT0Lwdd8KkMaOIG+YD/is +I19wKTakyYbnsZogy1Olhec9vn2a/iRFM9x2Fe0PonFkTGUugWhFpwIDAQABMA0G +CSqGSIb3DQEBAgUAA4GBALtMEivPLCYATxQT3ab7/AoRhIzzKBxnki98tsX63/Do +lbwdj2wsqFHMc9ikwFPwTtYmwHYBV4GSXiHx0bH/59AhWM1pF+NEHJwZRDmJXNyc +AA9WjQKZ7aKQRUzkuxCkPfAyAw7xzvjoyVGM5mKf5p/AfbdynMk2OmufTqj/ZA1k +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: + 4c:c7:ea:aa:98:3e:71:d3:93:10:f8:3d:3a:89:91:92 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=VeriSign, Inc., OU=Class 1 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network + Validity + Not Before: May 18 00:00:00 1998 GMT + Not After : Aug 1 23:59:59 2028 GMT + Subject: C=US, O=VeriSign, Inc., OU=Class 1 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:aa:d0:ba:be:16:2d:b8:83:d4:ca:d2:0f:bc:76: + 31:ca:94:d8:1d:93:8c:56:02:bc:d9:6f:1a:6f:52: + 36:6e:75:56:0a:55:d3:df:43:87:21:11:65:8a:7e: + 8f:bd:21:de:6b:32:3f:1b:84:34:95:05:9d:41:35: + eb:92:eb:96:dd:aa:59:3f:01:53:6d:99:4f:ed:e5: + e2:2a:5a:90:c1:b9:c4:a6:15:cf:c8:45:eb:a6:5d: + 8e:9c:3e:f0:64:24:76:a5:cd:ab:1a:6f:b6:d8:7b: + 51:61:6e:a6:7f:87:c8:e2:b7:e5:34:dc:41:88:ea: + 09:40:be:73:92:3d:6b:e7:75 + Exponent: 65537 (0x10001) + Signature Algorithm: sha1WithRSAEncryption + a9:4f:c3:0d:c7:67:be:2c:cb:d9:a8:cd:2d:75:e7:7e:15:9e: + 3b:72:eb:7e:eb:5c:2d:09:87:d6:6b:6d:60:7c:e5:ae:c5:90: + 23:0c:5c:4a:d0:af:b1:5d:f3:c7:b6:0a:db:e0:15:93:0d:dd: + 03:bc:c7:76:8a:b5:dd:4f:c3:9b:13:75:b8:01:c0:e6:c9:5b: + 6b:a5:b8:89:dc:ac:a4:dd:72:ed:4e:a1:f7:4f:bc:06:d3:ea: + c8:64:74:7b:c2:95:41:9c:65:73:58:f1:90:9a:3c:6a:b1:98: + c9:c4:87:bc:cf:45:6d:45:e2:6e:22:3f:fe:bc:0f:31:5c:e8: + f2:d9 +MD5 Fingerprint=DB:23:3D:F9:69:FA:4B:B9:95:80:44:73:5E:7D:41:83 +-----BEGIN CERTIFICATE----- +MIIDAjCCAmsCEEzH6qqYPnHTkxD4PTqJkZIwDQYJKoZIhvcNAQEFBQAwgcExCzAJ +BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xh +c3MgMSBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcy +MTowOAYDVQQLEzEoYykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp +emVkIHVzZSBvbmx5MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMB4X +DTk4MDUxODAwMDAwMFoXDTI4MDgwMTIzNTk1OVowgcExCzAJBgNVBAYTAlVTMRcw +FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xhc3MgMSBQdWJsaWMg +UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcyMTowOAYDVQQLEzEo +YykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 +MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB +AQUAA4GNADCBiQKBgQCq0Lq+Fi24g9TK0g+8djHKlNgdk4xWArzZbxpvUjZudVYK +VdPfQ4chEWWKfo+9Id5rMj8bhDSVBZ1BNeuS65bdqlk/AVNtmU/t5eIqWpDBucSm +Fc/IReumXY6cPvBkJHalzasab7bYe1FhbqZ/h8jit+U03EGI6glAvnOSPWvndQID +AQABMA0GCSqGSIb3DQEBBQUAA4GBAKlPww3HZ74sy9mozS11534Vnjty637rXC0J +h9ZrbWB85a7FkCMMXErQr7Fd88e2CtvgFZMN3QO8x3aKtd1Pw5sTdbgBwObJW2ul +uIncrKTdcu1OofdPvAbT6shkdHvClUGcZXNY8ZCaPGqxmMnEh7zPRW1F4m4iP/68 +DzFc6PLZ +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: + b9:2f:60:cc:88:9f:a1:7a:46:09:b8:5b:70:6c:8a:af + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=VeriSign, Inc., OU=Class 2 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network + Validity + Not Before: May 18 00:00:00 1998 GMT + Not After : Aug 1 23:59:59 2028 GMT + Subject: C=US, O=VeriSign, Inc., OU=Class 2 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:a7:88:01:21:74:2c:e7:1a:03:f0:98:e1:97:3c: + 0f:21:08:f1:9c:db:97:e9:9a:fc:c2:04:06:13:be: + 5f:52:c8:cc:1e:2c:12:56:2c:b8:01:69:2c:cc:99: + 1f:ad:b0:96:ae:79:04:f2:13:39:c1:7b:98:ba:08: + 2c:e8:c2:84:13:2c:aa:69:e9:09:f4:c7:a9:02:a4: + 42:c2:23:4f:4a:d8:f0:0e:a2:fb:31:6c:c9:e6:6f: + 99:27:07:f5:e6:f4:4c:78:9e:6d:eb:46:86:fa:b9: + 86:c9:54:f2:b2:c4:af:d4:46:1c:5a:c9:15:30:ff: + 0d:6c:f5:2d:0e:6d:ce:7f:77 + Exponent: 65537 (0x10001) + Signature Algorithm: sha1WithRSAEncryption + 72:2e:f9:7f:d1:f1:71:fb:c4:9e:f6:c5:5e:51:8a:40:98:b8: + 68:f8:9b:1c:83:d8:e2:9d:bd:ff:ed:a1:e6:66:ea:2f:09:f4: + ca:d7:ea:a5:2b:95:f6:24:60:86:4d:44:2e:83:a5:c4:2d:a0: + d3:ae:78:69:6f:72:da:6c:ae:08:f0:63:92:37:e6:bb:c4:30: + 17:ad:77:cc:49:35:aa:cf:d8:8f:d1:be:b7:18:96:47:73:6a: + 54:22:34:64:2d:b6:16:9b:59:5b:b4:51:59:3a:b3:0b:14:f4: + 12:df:67:a0:f4:ad:32:64:5e:b1:46:72:27:8c:12:7b:c5:44: + b4:ae +MD5 Fingerprint=2D:BB:E5:25:D3:D1:65:82:3A:B7:0E:FA:E6:EB:E2:E1 +-----BEGIN CERTIFICATE----- +MIIDAzCCAmwCEQC5L2DMiJ+hekYJuFtwbIqvMA0GCSqGSIb3DQEBBQUAMIHBMQsw +CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xPDA6BgNVBAsTM0Ns +YXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBH +MjE6MDgGA1UECxMxKGMpIDE5OTggVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9y +aXplZCB1c2Ugb25seTEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazAe +Fw05ODA1MTgwMDAwMDBaFw0yODA4MDEyMzU5NTlaMIHBMQswCQYDVQQGEwJVUzEX +MBUGA1UEChMOVmVyaVNpZ24sIEluYy4xPDA6BgNVBAsTM0NsYXNzIDIgUHVibGlj +IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMjE6MDgGA1UECxMx +KGMpIDE5OTggVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25s +eTEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazCBnzANBgkqhkiG9w0B +AQEFAAOBjQAwgYkCgYEAp4gBIXQs5xoD8JjhlzwPIQjxnNuX6Zr8wgQGE75fUsjM +HiwSViy4AWkszJkfrbCWrnkE8hM5wXuYuggs6MKEEyyqaekJ9MepAqRCwiNPStjw +DqL7MWzJ5m+ZJwf15vRMeJ5t60aG+rmGyVTyssSv1EYcWskVMP8NbPUtDm3Of3cC +AwEAATANBgkqhkiG9w0BAQUFAAOBgQByLvl/0fFx+8Se9sVeUYpAmLho+Jscg9ji +nb3/7aHmZuovCfTK1+qlK5X2JGCGTUQug6XELaDTrnhpb3LabK4I8GOSN+a7xDAX +rXfMSTWqz9iP0b63GJZHc2pUIjRkLbYWm1lbtFFZOrMLFPQS32eg9K0yZF6xRnIn +jBJ7xUS0rg== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: + 7d:d9:fe:07:cf:a8:1e:b7:10:79:67:fb:a7:89:34:c6 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network + Validity + Not Before: May 18 00:00:00 1998 GMT + Not After : Aug 1 23:59:59 2028 GMT + Subject: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:cc:5e:d1:11:5d:5c:69:d0:ab:d3:b9:6a:4c:99: + 1f:59:98:30:8e:16:85:20:46:6d:47:3f:d4:85:20: + 84:e1:6d:b3:f8:a4:ed:0c:f1:17:0f:3b:f9:a7:f9: + 25:d7:c1:cf:84:63:f2:7c:63:cf:a2:47:f2:c6:5b: + 33:8e:64:40:04:68:c1:80:b9:64:1c:45:77:c7:d8: + 6e:f5:95:29:3c:50:e8:34:d7:78:1f:a8:ba:6d:43: + 91:95:8f:45:57:5e:7e:c5:fb:ca:a4:04:eb:ea:97: + 37:54:30:6f:bb:01:47:32:33:cd:dc:57:9b:64:69: + 61:f8:9b:1d:1c:89:4f:5c:67 + Exponent: 65537 (0x10001) + Signature Algorithm: sha1WithRSAEncryption + 51:4d:cd:be:5c:cb:98:19:9c:15:b2:01:39:78:2e:4d:0f:67: + 70:70:99:c6:10:5a:94:a4:53:4d:54:6d:2b:af:0d:5d:40:8b: + 64:d3:d7:ee:de:56:61:92:5f:a6:c4:1d:10:61:36:d3:2c:27: + 3c:e8:29:09:b9:11:64:74:cc:b5:73:9f:1c:48:a9:bc:61:01: + ee:e2:17:a6:0c:e3:40:08:3b:0e:e7:eb:44:73:2a:9a:f1:69: + 92:ef:71:14:c3:39:ac:71:a7:91:09:6f:e4:71:06:b3:ba:59: + 57:26:79:00:f6:f8:0d:a2:33:30:28:d4:aa:58:a0:9d:9d:69: + 91:fd +MD5 Fingerprint=A2:33:9B:4C:74:78:73:D4:6C:E7:C1:F3:8D:CB:5C:E9 +-----BEGIN CERTIFICATE----- +MIIDAjCCAmsCEH3Z/gfPqB63EHln+6eJNMYwDQYJKoZIhvcNAQEFBQAwgcExCzAJ +BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xh +c3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcy +MTowOAYDVQQLEzEoYykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp +emVkIHVzZSBvbmx5MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMB4X +DTk4MDUxODAwMDAwMFoXDTI4MDgwMTIzNTk1OVowgcExCzAJBgNVBAYTAlVTMRcw +FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xhc3MgMyBQdWJsaWMg +UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcyMTowOAYDVQQLEzEo +YykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 +MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB +AQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4 +pO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0 +13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4mx0ciU9cZwID +AQABMA0GCSqGSIb3DQEBBQUAA4GBAFFNzb5cy5gZnBWyATl4Lk0PZ3BwmcYQWpSk +U01UbSuvDV1Ai2TT1+7eVmGSX6bEHRBhNtMsJzzoKQm5EWR0zLVznxxIqbxhAe7i +F6YM40AIOw7n60RzKprxaZLvcRTDOaxxp5EJb+RxBrO6WVcmeQD2+A2iMzAo1KpY +oJ2daZH9 +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: + 32:88:8e:9a:d2:f5:eb:13:47:f8:7f:c4:20:37:25:f8 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=VeriSign, Inc., OU=Class 4 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network + Validity + Not Before: May 18 00:00:00 1998 GMT + Not After : Aug 1 23:59:59 2028 GMT + Subject: C=US, O=VeriSign, Inc., OU=Class 4 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:ba:f0:e4:cf:f9:c4:ae:85:54:b9:07:57:f9:8f: + c5:7f:68:11:f8:c4:17:b0:44:dc:e3:30:73:d5:2a: + 62:2a:b8:d0:cc:1c:ed:28:5b:7e:bd:6a:dc:b3:91: + 24:ca:41:62:3c:fc:02:01:bf:1c:16:31:94:05:97: + 76:6e:a2:ad:bd:61:17:6c:4e:30:86:f0:51:37:2a: + 50:c7:a8:62:81:dc:5b:4a:aa:c1:a0:b4:6e:eb:2f: + e5:57:c5:b1:2b:40:70:db:5a:4d:a1:8e:1f:bd:03: + 1f:d8:03:d4:8f:4c:99:71:bc:e2:82:cc:58:e8:98: + 3a:86:d3:86:38:f3:00:29:1f + Exponent: 65537 (0x10001) + Signature Algorithm: sha1WithRSAEncryption + 85:8c:12:c1:a7:b9:50:15:7a:cb:3e:ac:b8:43:8a:dc:aa:dd: + 14:ba:89:81:7e:01:3c:23:71:21:88:2f:82:dc:63:fa:02:45: + ac:45:59:d7:2a:58:44:5b:b7:9f:81:3b:92:68:3d:e2:37:24: + f5:7b:6c:8f:76:35:96:09:a8:59:9d:b9:ce:23:ab:74:d6:83: + fd:32:73:27:d8:69:3e:43:74:f6:ae:c5:89:9a:e7:53:7c:e9: + 7b:f6:4b:f3:c1:65:83:de:8d:8a:9c:3c:88:8d:39:59:fc:aa: + 3f:22:8d:a1:c1:66:50:81:72:4c:ed:22:64:4f:4f:ca:80:91: + b6:29 +MD5 Fingerprint=26:6D:2C:19:98:B6:70:68:38:50:54:19:EC:90:34:60 +-----BEGIN CERTIFICATE----- +MIIDAjCCAmsCEDKIjprS9esTR/h/xCA3JfgwDQYJKoZIhvcNAQEFBQAwgcExCzAJ +BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xh +c3MgNCBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcy +MTowOAYDVQQLEzEoYykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp +emVkIHVzZSBvbmx5MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMB4X +DTk4MDUxODAwMDAwMFoXDTI4MDgwMTIzNTk1OVowgcExCzAJBgNVBAYTAlVTMRcw +FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xhc3MgNCBQdWJsaWMg +UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcyMTowOAYDVQQLEzEo +YykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 +MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB +AQUAA4GNADCBiQKBgQC68OTP+cSuhVS5B1f5j8V/aBH4xBewRNzjMHPVKmIquNDM +HO0oW369atyzkSTKQWI8/AIBvxwWMZQFl3Zuoq29YRdsTjCG8FE3KlDHqGKB3FtK +qsGgtG7rL+VXxbErQHDbWk2hjh+9Ax/YA9SPTJlxvOKCzFjomDqG04Y48wApHwID +AQABMA0GCSqGSIb3DQEBBQUAA4GBAIWMEsGnuVAVess+rLhDityq3RS6iYF+ATwj +cSGIL4LcY/oCRaxFWdcqWERbt5+BO5JoPeI3JPV7bI92NZYJqFmduc4jq3TWg/0y +cyfYaT5DdPauxYma51N86Xv2S/PBZYPejYqcPIiNOVn8qj8ijaHBZlCBckztImRP +T8qAkbYp +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 02:00:00:00:00:00:d6:78:b7:94:05 + Signature Algorithm: md5WithRSAEncryption + Issuer: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA + Validity + Not Before: Sep 1 12:00:00 1998 GMT + Not After : Jan 28 12:00:00 2014 GMT + Subject: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:da:0e:e6:99:8d:ce:a3:e3:4f:8a:7e:fb:f1:8b: + 83:25:6b:ea:48:1f:f1:2a:b0:b9:95:11:04:bd:f0: + 63:d1:e2:67:66:cf:1c:dd:cf:1b:48:2b:ee:8d:89: + 8e:9a:af:29:80:65:ab:e9:c7:2d:12:cb:ab:1c:4c: + 70:07:a1:3d:0a:30:cd:15:8d:4f:f8:dd:d4:8c:50: + 15:1c:ef:50:ee:c4:2e:f7:fc:e9:52:f2:91:7d:e0: + 6d:d5:35:30:8e:5e:43:73:f2:41:e9:d5:6a:e3:b2: + 89:3a:56:39:38:6f:06:3c:88:69:5b:2a:4d:c5:a7: + 54:b8:6c:89:cc:9b:f9:3c:ca:e5:fd:89:f5:12:3c: + 92:78:96:d6:dc:74:6e:93:44:61:d1:8d:c7:46:b2: + 75:0e:86:e8:19:8a:d5:6d:6c:d5:78:16:95:a2:e9: + c8:0a:38:eb:f2:24:13:4f:73:54:93:13:85:3a:1b: + bc:1e:34:b5:8b:05:8c:b9:77:8b:b1:db:1f:20:91: + ab:09:53:6e:90:ce:7b:37:74:b9:70:47:91:22:51: + 63:16:79:ae:b1:ae:41:26:08:c8:19:2b:d1:46:aa: + 48:d6:64:2a:d7:83:34:ff:2c:2a:c1:6c:19:43:4a: + 07:85:e7:d3:7c:f6:21:68:ef:ea:f2:52:9f:7f:93: + 90:cf + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + X509v3 Subject Key Identifier: + 60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B + X509v3 Basic Constraints: critical + CA:TRUE + Signature Algorithm: md5WithRSAEncryption + ae:aa:9f:fc:b7:d2:cb:1f:5f:39:29:28:18:9e:34:c9:6c:4f: + 6f:1a:f0:64:a2:70:4a:4f:13:86:9b:60:28:9e:e8:81:49:98: + 7d:0a:bb:e5:b0:9d:3d:36:db:8f:05:51:ff:09:31:2a:1f:dd: + 89:77:9e:0f:2e:6c:95:04:ed:86:cb:b4:00:3f:84:02:4d:80: + 6a:2a:2d:78:0b:ae:6f:2b:a2:83:44:83:1f:cd:50:82:4c:24: + af:bd:f7:a5:b4:c8:5a:0f:f4:e7:47:5e:49:8e:37:96:fe:9a: + 88:05:3a:d9:c0:db:29:87:e6:19:96:47:a7:3a:a6:8c:8b:3c: + 77:fe:46:63:a7:53:da:21:d1:ac:7e:49:a2:4b:e6:c3:67:59: + 2f:b3:8a:0e:bb:2c:bd:a9:aa:42:7c:35:c1:d8:7f:d5:a7:31: + 3a:4e:63:43:39:af:08:b0:61:34:8c:d3:98:a9:43:34:f6:0f: + 87:29:3b:9d:c2:56:58:98:77:c3:f7:1b:ac:f6:9d:f8:3e:aa: + a7:54:45:f0:f5:f9:d5:31:65:fe:6b:58:9c:71:b3:1e:d7:52: + ea:32:17:fc:40:60:1d:c9:79:24:b2:f6:6c:fd:a8:66:0e:82: + dd:98:cb:da:c2:44:4f:2e:a0:7b:f2:f7:6b:2c:76:11:84:46: + 8a:78:a3:e3 +MD5 Fingerprint=AB:BF:EA:E3:6B:29:A6:CC:A6:78:35:99:EF:AD:2B:80 +-----BEGIN CERTIFICATE----- +MIIDdTCCAl2gAwIBAgILAgAAAAAA1ni3lAUwDQYJKoZIhvcNAQEEBQAwVzELMAkG +A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv +b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw +MDBaFw0xNDAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i +YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT +aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ +jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp +xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp +1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG +snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ +U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8 +9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIABjAdBgNVHQ4EFgQU +YHtmGkUNl8qJUC99BM00qP/8/UswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B +AQQFAAOCAQEArqqf/LfSyx9fOSkoGJ40yWxPbxrwZKJwSk8ThptgKJ7ogUmYfQq7 +5bCdPTbbjwVR/wkxKh/diXeeDy5slQTthsu0AD+EAk2AaioteAuubyuig0SDH81Q +gkwkr733pbTIWg/050deSY43lv6aiAU62cDbKYfmGZZHpzqmjIs8d/5GY6dT2iHR +rH5Jokvmw2dZL7OKDrssvamqQnw1wdh/1acxOk5jQzmvCLBhNIzTmKlDNPYPhyk7 +ncJWWJh3w/cbrPad+D6qp1RF8PX51TFl/mtYnHGzHtdS6jIX/EBgHcl5JLL2bP2o +Zg6C3ZjL2sJETy6ge/L3ayx2EYRGinij4w== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: 1 (0x1) + Signature Algorithm: sha1WithRSAEncryption + Issuer: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 1 Policy Validation Authority, CN=http://www.valicert.com//emailAddress=info@valicert.com + Validity + Not Before: Jun 25 22:23:48 1999 GMT + Not After : Jun 25 22:23:48 2019 GMT + Subject: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 1 Policy Validation Authority, CN=http://www.valicert.com//emailAddress=info@valicert.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:d8:59:82:7a:89:b8:96:ba:a6:2f:68:6f:58:2e: + a7:54:1c:06:6e:f4:ea:8d:48:bc:31:94:17:f0:f3: + 4e:bc:b2:b8:35:92:76:b0:d0:a5:a5:01:d7:00:03: + 12:22:19:08:f8:ff:11:23:9b:ce:07:f5:bf:69:1a: + 26:fe:4e:e9:d1:7f:9d:2c:40:1d:59:68:6e:a6:f8: + 58:b0:9d:1a:8f:d3:3f:f1:dc:19:06:81:a8:0e:e0: + 3a:dd:c8:53:45:09:06:e6:0f:70:c3:fa:40:a6:0e: + e2:56:05:0f:18:4d:fc:20:82:d1:73:55:74:8d:76: + 72:a0:1d:9d:1d:c0:dd:3f:71 + Exponent: 65537 (0x10001) + Signature Algorithm: sha1WithRSAEncryption + 50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f: + 71:ad:64:c8:dd:77:d2:ef:59:55:e8:3f:e8:8e:05:2a:21:f2: + 07:d2:b5:a7:52:fe:9c:b1:b6:e2:5b:77:17:40:ea:72:d6:23: + cb:28:81:32:c3:00:79:18:ec:59:17:89:c9:c6:6a:1e:71:c9: + fd:b7:74:a5:25:45:69:c5:48:ab:19:e1:45:8a:25:6b:19:ee: + e5:bb:12:f5:7f:f7:a6:8d:51:c3:f0:9d:74:b7:a9:3e:a0:a5: + ff:b6:49:03:13:da:22:cc:ed:71:82:2b:99:cf:3a:b7:f5:2d: + 72:c8 +MD5 Fingerprint=65:58:AB:15:AD:57:6C:1E:A8:A7:B5:69:AC:BF:FF:EB +-----BEGIN CERTIFICATE----- +MIIC5zCCAlACAQEwDQYJKoZIhvcNAQEFBQAwgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0 +IFZhbGlkYXRpb24gTmV0d29yazEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAz +BgNVBAsTLFZhbGlDZXJ0IENsYXNzIDEgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9y +aXR5MSEwHwYDVQQDExhodHRwOi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG +9w0BCQEWEWluZm9AdmFsaWNlcnQuY29tMB4XDTk5MDYyNTIyMjM0OFoXDTE5MDYy +NTIyMjM0OFowgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0IFZhbGlkYXRpb24gTmV0d29y +azEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAzBgNVBAsTLFZhbGlDZXJ0IENs +YXNzIDEgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9yaXR5MSEwHwYDVQQDExhodHRw +Oi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl +cnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYWYJ6ibiWuqYvaG9Y +LqdUHAZu9OqNSLwxlBfw8068srg1knaw0KWlAdcAAxIiGQj4/xEjm84H9b9pGib+ +TunRf50sQB1ZaG6m+FiwnRqP0z/x3BkGgagO4DrdyFNFCQbmD3DD+kCmDuJWBQ8Y +TfwggtFzVXSNdnKgHZ0dwN0/cQIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAFBoPUn0 +LBwGlN+VYH+Wexf+T3GtZMjdd9LvWVXoP+iOBSoh8gfStadS/pyxtuJbdxdA6nLW +I8sogTLDAHkY7FkXicnGah5xyf23dKUlRWnFSKsZ4UWKJWsZ7uW7EvV/96aNUcPw +nXS3qT6gpf+2SQMT2iLM7XGCK5nPOrf1LXLI +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: 1 (0x1) + Signature Algorithm: sha1WithRSAEncryption + Issuer: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 2 Policy Validation Authority, CN=http://www.valicert.com//emailAddress=info@valicert.com + Validity + Not Before: Jun 26 00:19:54 1999 GMT + Not After : Jun 26 00:19:54 2019 GMT + Subject: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 2 Policy Validation Authority, CN=http://www.valicert.com//emailAddress=info@valicert.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:ce:3a:71:ca:e5:ab:c8:59:92:55:d7:ab:d8:74: + 0e:f9:ee:d9:f6:55:47:59:65:47:0e:05:55:dc:eb: + 98:36:3c:5c:53:5d:d3:30:cf:38:ec:bd:41:89:ed: + 25:42:09:24:6b:0a:5e:b3:7c:dd:52:2d:4c:e6:d4: + d6:7d:5a:59:a9:65:d4:49:13:2d:24:4d:1c:50:6f: + b5:c1:85:54:3b:fe:71:e4:d3:5c:42:f9:80:e0:91: + 1a:0a:5b:39:36:67:f3:3f:55:7c:1b:3f:b4:5f:64: + 73:34:e3:b4:12:bf:87:64:f8:da:12:ff:37:27:c1: + b3:43:bb:ef:7b:6e:2e:69:f7 + Exponent: 65537 (0x10001) + Signature Algorithm: sha1WithRSAEncryption + 3b:7f:50:6f:6f:50:94:99:49:62:38:38:1f:4b:f8:a5:c8:3e: + a7:82:81:f6:2b:c7:e8:c5:ce:e8:3a:10:82:cb:18:00:8e:4d: + bd:a8:58:7f:a1:79:00:b5:bb:e9:8d:af:41:d9:0f:34:ee:21: + 81:19:a0:32:49:28:f4:c4:8e:56:d5:52:33:fd:50:d5:7e:99: + 6c:03:e4:c9:4c:fc:cb:6c:ab:66:b3:4a:21:8c:e5:b5:0c:32: + 3e:10:b2:cc:6c:a1:dc:9a:98:4c:02:5b:f3:ce:b9:9e:a5:72: + 0e:4a:b7:3f:3c:e6:16:68:f8:be:ed:74:4c:bc:5b:d5:62:1f: + 43:dd +MD5 Fingerprint=A9:23:75:9B:BA:49:36:6E:31:C2:DB:F2:E7:66:BA:87 +-----BEGIN CERTIFICATE----- +MIIC5zCCAlACAQEwDQYJKoZIhvcNAQEFBQAwgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0 +IFZhbGlkYXRpb24gTmV0d29yazEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAz +BgNVBAsTLFZhbGlDZXJ0IENsYXNzIDIgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9y +aXR5MSEwHwYDVQQDExhodHRwOi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG +9w0BCQEWEWluZm9AdmFsaWNlcnQuY29tMB4XDTk5MDYyNjAwMTk1NFoXDTE5MDYy +NjAwMTk1NFowgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0IFZhbGlkYXRpb24gTmV0d29y +azEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAzBgNVBAsTLFZhbGlDZXJ0IENs +YXNzIDIgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9yaXR5MSEwHwYDVQQDExhodHRw +Oi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl +cnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY +dA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9 +WlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS +v4dk+NoS/zcnwbNDu+97bi5p9wIDAQABMA0GCSqGSIb3DQEBBQUAA4GBADt/UG9v +UJSZSWI4OB9L+KXIPqeCgfYrx+jFzug6EILLGACOTb2oWH+heQC1u+mNr0HZDzTu +IYEZoDJJKPTEjlbVUjP9UNV+mWwD5MlM/Mtsq2azSiGM5bUMMj4QssxsodyamEwC +W/POuZ6lcg5Ktz885hZo+L7tdEy8W9ViH0Pd +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: 1 (0x1) + Signature Algorithm: sha1WithRSAEncryption + Issuer: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 3 Policy Validation Authority, CN=http://www.valicert.com//emailAddress=info@valicert.com + Validity + Not Before: Jun 26 00:22:33 1999 GMT + Not After : Jun 26 00:22:33 2019 GMT + Subject: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 3 Policy Validation Authority, CN=http://www.valicert.com//emailAddress=info@valicert.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:e3:98:51:96:1c:e8:d5:b1:06:81:6a:57:c3:72: + 75:93:ab:cf:9e:a6:fc:f3:16:52:d6:2d:4d:9f:35: + 44:a8:2e:04:4d:07:49:8a:38:29:f5:77:37:e7:b7: + ab:5d:df:36:71:14:99:8f:dc:c2:92:f1:e7:60:92: + 97:ec:d8:48:dc:bf:c1:02:20:c6:24:a4:28:4c:30: + 5a:76:6d:b1:5c:f3:dd:de:9e:10:71:a1:88:c7:5b: + 9b:41:6d:ca:b0:b8:8e:15:ee:ad:33:2b:cf:47:04: + 5c:75:71:0a:98:24:98:29:a7:49:59:a5:dd:f8:b7: + 43:62:61:f3:d3:e2:d0:55:3f + Exponent: 65537 (0x10001) + Signature Algorithm: sha1WithRSAEncryption + 56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d: + f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42: + d3:3e:cf:a9:54:f4:f1:d8:92:16:8c:d1:04:cb:4b:ab:c9:9f: + 45:ae:3c:8a:a9:b0:71:33:5d:c8:c5:57:df:af:a8:35:b3:7f: + 89:87:e9:e8:25:92:b8:7f:85:7a:ae:d6:bc:1e:37:58:2a:67: + c9:91:cf:2a:81:3e:ed:c6:39:df:c0:3e:19:9c:19:cc:13:4d: + 82:41:b5:8c:de:e0:3d:60:08:20:0f:45:7e:6b:a2:7f:a3:8c: + 15:ee +MD5 Fingerprint=A2:6F:53:B7:EE:40:DB:4A:68:E7:FA:18:D9:10:4B:72 +-----BEGIN CERTIFICATE----- +MIIC5zCCAlACAQEwDQYJKoZIhvcNAQEFBQAwgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0 +IFZhbGlkYXRpb24gTmV0d29yazEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAz +BgNVBAsTLFZhbGlDZXJ0IENsYXNzIDMgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9y +aXR5MSEwHwYDVQQDExhodHRwOi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG +9w0BCQEWEWluZm9AdmFsaWNlcnQuY29tMB4XDTk5MDYyNjAwMjIzM1oXDTE5MDYy +NjAwMjIzM1owgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0IFZhbGlkYXRpb24gTmV0d29y +azEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAzBgNVBAsTLFZhbGlDZXJ0IENs +YXNzIDMgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9yaXR5MSEwHwYDVQQDExhodHRw +Oi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl +cnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjmFGWHOjVsQaBalfD +cnWTq8+epvzzFlLWLU2fNUSoLgRNB0mKOCn1dzfnt6td3zZxFJmP3MKS8edgkpfs +2Ejcv8ECIMYkpChMMFp2bbFc893enhBxoYjHW5tBbcqwuI4V7q0zK89HBFx1cQqY +JJgpp0lZpd34t0NiYfPT4tBVPwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAFa7AliE +Zwgs3x/be0kz9dNnnfS0ChCzycUs4pJqcXgn8nCDQtM+z6lU9PHYkhaM0QTLS6vJ +n0WuPIqpsHEzXcjFV9+vqDWzf4mH6eglkrh/hXqu1rweN1gqZ8mRzyqBPu3GOd/A +PhmcGcwTTYJBtYze4D1gCCAPRX5ron+jjBXu +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: + 8b:5b:75:56:84:54:85:0b:00:cf:af:38:48:ce:b1:a4 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 1 Public Primary Certification Authority - G3 + Validity + Not Before: Oct 1 00:00:00 1999 GMT + Not After : Jul 16 23:59:59 2036 GMT + Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 1 Public Primary Certification Authority - G3 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:dd:84:d4:b9:b4:f9:a7:d8:f3:04:78:9c:de:3d: + dc:6c:13:16:d9:7a:dd:24:51:66:c0:c7:26:59:0d: + ac:06:08:c2:94:d1:33:1f:f0:83:35:1f:6e:1b:c8: + de:aa:6e:15:4e:54:27:ef:c4:6d:1a:ec:0b:e3:0e: + f0:44:a5:57:c7:40:58:1e:a3:47:1f:71:ec:60:f6: + 6d:94:c8:18:39:ed:fe:42:18:56:df:e4:4c:49:10: + 78:4e:01:76:35:63:12:36:dd:66:bc:01:04:36:a3: + 55:68:d5:a2:36:09:ac:ab:21:26:54:06:ad:3f:ca: + 14:e0:ac:ca:ad:06:1d:95:e2:f8:9d:f1:e0:60:ff: + c2:7f:75:2b:4c:cc:da:fe:87:99:21:ea:ba:fe:3e: + 54:d7:d2:59:78:db:3c:6e:cf:a0:13:00:1a:b8:27: + a1:e4:be:67:96:ca:a0:c5:b3:9c:dd:c9:75:9e:eb: + 30:9a:5f:a3:cd:d9:ae:78:19:3f:23:e9:5c:db:29: + bd:ad:55:c8:1b:54:8c:63:f6:e8:a6:ea:c7:37:12: + 5c:a3:29:1e:02:d9:db:1f:3b:b4:d7:0f:56:47:81: + 15:04:4a:af:83:27:d1:c5:58:88:c1:dd:f6:aa:a7: + a3:18:da:68:aa:6d:11:51:e1:bf:65:6b:9f:96:76: + d1:3d + Exponent: 65537 (0x10001) + Signature Algorithm: sha1WithRSAEncryption + ab:66:8d:d7:b3:ba:c7:9a:b6:e6:55:d0:05:f1:9f:31:8d:5a: + aa:d9:aa:46:26:0f:71:ed:a5:ad:53:56:62:01:47:2a:44:e9: + fe:3f:74:0b:13:9b:b9:f4:4d:1b:b2:d1:5f:b2:b6:d2:88:5c: + b3:9f:cd:cb:d4:a7:d9:60:95:84:3a:f8:c1:37:1d:61:ca:e7: + b0:c5:e5:91:da:54:a6:ac:31:81:ae:97:de:cd:08:ac:b8:c0: + 97:80:7f:6e:72:a4:e7:69:13:95:65:1f:c4:93:3c:fd:79:8f: + 04:d4:3e:4f:ea:f7:9e:ce:cd:67:7c:4f:65:02:ff:91:85:54: + 73:c7:ff:36:f7:86:2d:ec:d0:5e:4f:ff:11:9f:72:06:d6:b8: + 1a:f1:4c:0d:26:65:e2:44:80:1e:c7:9f:e3:dd:e8:0a:da:ec: + a5:20:80:69:68:a1:4f:7e:e1:6b:cf:07:41:fa:83:8e:bc:38: + dd:b0:2e:11:b1:6b:b2:42:cc:9a:bc:f9:48:22:79:4a:19:0f: + b2:1c:3e:20:74:d9:6a:c3:be:f2:28:78:13:56:79:4f:6d:50: + ea:1b:b0:b5:57:b1:37:66:58:23:f3:dc:0f:df:0a:87:c4:ef: + 86:05:d5:38:14:60:99:a3:4b:de:06:96:71:2c:f2:db:b6:1f: + a4:ef:3f:ee +MD5 Fingerprint=B1:47:BC:18:57:D1:18:A0:78:2D:EC:71:E8:2A:95:73 +-----BEGIN CERTIFICATE----- +MIIEGjCCAwICEQCLW3VWhFSFCwDPrzhIzrGkMA0GCSqGSIb3DQEBBQUAMIHKMQsw +CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl +cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu +LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT +aWduIENsYXNzIDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp +dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD +VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT +aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ +bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu +IENsYXNzIDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg +LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN2E1Lm0+afY8wR4 +nN493GwTFtl63SRRZsDHJlkNrAYIwpTRMx/wgzUfbhvI3qpuFU5UJ+/EbRrsC+MO +8ESlV8dAWB6jRx9x7GD2bZTIGDnt/kIYVt/kTEkQeE4BdjVjEjbdZrwBBDajVWjV +ojYJrKshJlQGrT/KFOCsyq0GHZXi+J3x4GD/wn91K0zM2v6HmSHquv4+VNfSWXjb +PG7PoBMAGrgnoeS+Z5bKoMWznN3JdZ7rMJpfo83ZrngZPyPpXNspva1VyBtUjGP2 +6KbqxzcSXKMpHgLZ2x87tNcPVkeBFQRKr4Mn0cVYiMHd9qqnoxjaaKptEVHhv2Vr +n5Z20T0CAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAq2aN17O6x5q25lXQBfGfMY1a +qtmqRiYPce2lrVNWYgFHKkTp/j90CxObufRNG7LRX7K20ohcs5/Ny9Sn2WCVhDr4 +wTcdYcrnsMXlkdpUpqwxga6X3s0IrLjAl4B/bnKk52kTlWUfxJM8/XmPBNQ+T+r3 +ns7NZ3xPZQL/kYVUc8f/NveGLezQXk//EZ9yBta4GvFMDSZl4kSAHsef493oCtrs +pSCAaWihT37ha88HQfqDjrw43bAuEbFrskLMmrz5SCJ5ShkPshw+IHTZasO+8ih4 +E1Z5T21Q6huwtVexN2ZYI/PcD98Kh8TvhgXVOBRgmaNL3gaWcSzy27YfpO8/7g== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: + 61:70:cb:49:8c:5f:98:45:29:e7:b0:a6:d9:50:5b:7a + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 2 Public Primary Certification Authority - G3 + Validity + Not Before: Oct 1 00:00:00 1999 GMT + Not After : Jul 16 23:59:59 2036 GMT + Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 2 Public Primary Certification Authority - G3 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:af:0a:0d:c2:d5:2c:db:67:b9:2d:e5:94:27:dd: + a5:be:e0:b0:4d:8f:b3:61:56:3c:d6:7c:c3:f4:cd: + 3e:86:cb:a2:88:e2:e1:d8:a4:69:c5:b5:e2:bf:c1: + a6:47:50:5e:46:39:8b:d5:96:ba:b5:6f:14:bf:10: + ce:27:13:9e:05:47:9b:31:7a:13:d8:1f:d9:d3:02: + 37:8b:ad:2c:47:f0:8e:81:06:a7:0d:30:0c:eb:f7: + 3c:0f:20:1d:dc:72:46:ee:a5:02:c8:5b:c3:c9:56: + 69:4c:c5:18:c1:91:7b:0b:d5:13:00:9b:bc:ef:c3: + 48:3e:46:60:20:85:2a:d5:90:b6:cd:8b:a0:cc:32: + dd:b7:fd:40:55:b2:50:1c:56:ae:cc:8d:77:4d:c7: + 20:4d:a7:31:76:ef:68:92:8a:90:1e:08:81:56:b2: + ad:69:a3:52:d0:cb:1c:c4:23:3d:1f:99:fe:4c:e8: + 16:63:8e:c6:08:8e:f6:31:f6:d2:fa:e5:76:dd:b5: + 1c:92:a3:49:cd:cd:01:cd:68:cd:a9:69:ba:a3:eb: + 1d:0d:9c:a4:20:a6:c1:a0:c5:d1:46:4c:17:6d:d2: + ac:66:3f:96:8c:e0:84:d4:36:ff:22:59:c5:f9:11: + 60:a8:5f:04:7d:f2:1a:f6:25:42:61:0f:c4:4a:b8: + 3e:89 + Exponent: 65537 (0x10001) + Signature Algorithm: sha1WithRSAEncryption + 34:26:15:3c:c0:8d:4d:43:49:1d:bd:e9:21:92:d7:66:9c:b7: + de:c5:b8:d0:e4:5d:5f:76:22:c0:26:f9:84:3a:3a:f9:8c:b5: + fb:ec:60:f1:e8:ce:04:b0:c8:dd:a7:03:8f:30:f3:98:df:a4: + e6:a4:31:df:d3:1c:0b:46:dc:72:20:3f:ae:ee:05:3c:a4:33: + 3f:0b:39:ac:70:78:73:4b:99:2b:df:30:c2:54:b0:a8:3b:55: + a1:fe:16:28:cd:42:bd:74:6e:80:db:27:44:a7:ce:44:5d:d4: + 1b:90:98:0d:1e:42:94:b1:00:2c:04:d0:74:a3:02:05:22:63: + 63:cd:83:b5:fb:c1:6d:62:6b:69:75:fd:5d:70:41:b9:f5:bf: + 7c:df:be:c1:32:73:22:21:8b:58:81:7b:15:91:7a:ba:e3:64: + 48:b0:7f:fb:36:25:da:95:d0:f1:24:14:17:dd:18:80:6b:46: + 23:39:54:f5:8e:62:09:04:1d:94:90:a6:9b:e6:25:e2:42:45: + aa:b8:90:ad:be:08:8f:a9:0b:42:18:94:cf:72:39:e1:b1:43: + e0:28:cf:b7:e7:5a:6c:13:6b:49:b3:ff:e3:18:7c:89:8b:33: + 5d:ac:33:d7:a7:f9:da:3a:55:c9:58:10:f9:aa:ef:5a:b6:cf: + 4b:4b:df:2a +MD5 Fingerprint=F8:BE:C4:63:22:C9:A8:46:74:8B:B8:1D:1E:4A:2B:F6 +-----BEGIN CERTIFICATE----- +MIIEGTCCAwECEGFwy0mMX5hFKeewptlQW3owDQYJKoZIhvcNAQEFBQAwgcoxCzAJ +BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVy +aVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24s +IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNp +Z24gQ2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0 +eSAtIEczMB4XDTk5MTAwMTAwMDAwMFoXDTM2MDcxNjIzNTk1OVowgcoxCzAJBgNV +BAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNp +Z24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24sIElu +Yy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24g +Q2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAt +IEczMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArwoNwtUs22e5LeWU +J92lvuCwTY+zYVY81nzD9M0+hsuiiOLh2KRpxbXiv8GmR1BeRjmL1Za6tW8UvxDO +JxOeBUebMXoT2B/Z0wI3i60sR/COgQanDTAM6/c8DyAd3HJG7qUCyFvDyVZpTMUY +wZF7C9UTAJu878NIPkZgIIUq1ZC2zYugzDLdt/1AVbJQHFauzI13TccgTacxdu9o +koqQHgiBVrKtaaNS0MscxCM9H5n+TOgWY47GCI72MfbS+uV23bUckqNJzc0BzWjN +qWm6o+sdDZykIKbBoMXRRkwXbdKsZj+WjOCE1Db/IlnF+RFgqF8EffIa9iVCYQ/E +Srg+iQIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQA0JhU8wI1NQ0kdvekhktdmnLfe +xbjQ5F1fdiLAJvmEOjr5jLX77GDx6M4EsMjdpwOPMPOY36TmpDHf0xwLRtxyID+u +7gU8pDM/CzmscHhzS5kr3zDCVLCoO1Wh/hYozUK9dG6A2ydEp85EXdQbkJgNHkKU +sQAsBNB0owIFImNjzYO1+8FtYmtpdf1dcEG59b98377BMnMiIYtYgXsVkXq642RI +sH/7NiXaldDxJBQX3RiAa0YjOVT1jmIJBB2UkKab5iXiQkWquJCtvgiPqQtCGJTP +cjnhsUPgKM+351psE2tJs//jGHyJizNdrDPXp/naOlXJWBD5qu9ats9LS98q +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: + 9b:7e:06:49:a3:3e:62:b9:d5:ee:90:48:71:29:ef:57 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G3 + Validity + Not Before: Oct 1 00:00:00 1999 GMT + Not After : Jul 16 23:59:59 2036 GMT + Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G3 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:cb:ba:9c:52:fc:78:1f:1a:1e:6f:1b:37:73:bd: + f8:c9:6b:94:12:30:4f:f0:36:47:f5:d0:91:0a:f5: + 17:c8:a5:61:c1:16:40:4d:fb:8a:61:90:e5:76:20: + c1:11:06:7d:ab:2c:6e:a6:f5:11:41:8e:fa:2d:ad: + 2a:61:59:a4:67:26:4c:d0:e8:bc:52:5b:70:20:04: + 58:d1:7a:c9:a4:69:bc:83:17:64:ad:05:8b:bc:d0: + 58:ce:8d:8c:f5:eb:f0:42:49:0b:9d:97:27:67:32: + 6e:e1:ae:93:15:1c:70:bc:20:4d:2f:18:de:92:88: + e8:6c:85:57:11:1a:e9:7e:e3:26:11:54:a2:45:96: + 55:83:ca:30:89:e8:dc:d8:a3:ed:2a:80:3f:7f:79: + 65:57:3e:15:20:66:08:2f:95:93:bf:aa:47:2f:a8: + 46:97:f0:12:e2:fe:c2:0a:2b:51:e6:76:e6:b7:46: + b7:e2:0d:a6:cc:a8:c3:4c:59:55:89:e6:e8:53:5c: + 1c:ea:9d:f0:62:16:0b:a7:c9:5f:0c:f0:de:c2:76: + ce:af:f7:6a:f2:fa:41:a6:a2:33:14:c9:e5:7a:63: + d3:9e:62:37:d5:85:65:9e:0e:e6:53:24:74:1b:5e: + 1d:12:53:5b:c7:2c:e7:83:49:3b:15:ae:8a:68:b9: + 57:97 + Exponent: 65537 (0x10001) + Signature Algorithm: sha1WithRSAEncryption + 11:14:96:c1:ab:92:08:f7:3f:2f:c9:b2:fe:e4:5a:9f:64:de: + db:21:4f:86:99:34:76:36:57:dd:d0:15:2f:c5:ad:7f:15:1f: + 37:62:73:3e:d4:e7:5f:ce:17:03:db:35:fa:2b:db:ae:60:09: + 5f:1e:5f:8f:6e:bb:0b:3d:ea:5a:13:1e:0c:60:6f:b5:c0:b5: + 23:22:2e:07:0b:cb:a9:74:cb:47:bb:1d:c1:d7:a5:6b:cc:2f: + d2:42:fd:49:dd:a7:89:cf:53:ba:da:00:5a:28:bf:82:df:f8: + ba:13:1d:50:86:82:fd:8e:30:8f:29:46:b0:1e:3d:35:da:38: + 62:16:18:4a:ad:e6:b6:51:6c:de:af:62:eb:01:d0:1e:24:fe: + 7a:8f:12:1a:12:68:b8:fb:66:99:14:14:45:5c:ae:e7:ae:69: + 17:81:2b:5a:37:c9:5e:2a:f4:c6:e2:a1:5c:54:9b:a6:54:00: + cf:f0:f1:c1:c7:98:30:1a:3b:36:16:db:a3:6e:ea:fd:ad:b2: + c2:da:ef:02:47:13:8a:c0:f1:b3:31:ad:4f:1c:e1:4f:9c:af: + 0f:0c:9d:f7:78:0d:d8:f4:35:56:80:da:b7:6d:17:8f:9d:1e: + 81:64:e1:fe:c5:45:ba:ad:6b:b9:0a:7a:4e:4f:4b:84:ee:4b: + f1:7d:dd:11 +MD5 Fingerprint=CD:68:B6:A7:C7:C4:CE:75:E0:1D:4F:57:44:61:92:09 +-----BEGIN CERTIFICATE----- +MIIEGjCCAwICEQCbfgZJoz5iudXukEhxKe9XMA0GCSqGSIb3DQEBBQUAMIHKMQsw +CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl +cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu +LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT +aWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp +dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD +VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT +aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ +bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu +IENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg +LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMu6nFL8eB8aHm8b +N3O9+MlrlBIwT/A2R/XQkQr1F8ilYcEWQE37imGQ5XYgwREGfassbqb1EUGO+i2t +KmFZpGcmTNDovFJbcCAEWNF6yaRpvIMXZK0Fi7zQWM6NjPXr8EJJC52XJ2cybuGu +kxUccLwgTS8Y3pKI6GyFVxEa6X7jJhFUokWWVYPKMIno3Nij7SqAP395ZVc+FSBm +CC+Vk7+qRy+oRpfwEuL+wgorUeZ25rdGt+INpsyow0xZVYnm6FNcHOqd8GIWC6fJ +Xwzw3sJ2zq/3avL6QaaiMxTJ5Xpj055iN9WFZZ4O5lMkdBteHRJTW8cs54NJOxWu +imi5V5cCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAERSWwauSCPc/L8my/uRan2Te +2yFPhpk0djZX3dAVL8WtfxUfN2JzPtTnX84XA9s1+ivbrmAJXx5fj267Cz3qWhMe +DGBvtcC1IyIuBwvLqXTLR7sdwdela8wv0kL9Sd2nic9TutoAWii/gt/4uhMdUIaC +/Y4wjylGsB49Ndo4YhYYSq3mtlFs3q9i6wHQHiT+eo8SGhJouPtmmRQURVyu565p +F4ErWjfJXir0xuKhXFSbplQAz/DxwceYMBo7Nhbbo27q/a2ywtrvAkcTisDxszGt +TxzhT5yvDwyd93gN2PQ1VoDat20Xj50egWTh/sVFuq1ruQp6Tk9LhO5L8X3dEQ== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: + ec:a0:a7:8b:6e:75:6a:01:cf:c4:7c:cc:2f:94:5e:d7 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 4 Public Primary Certification Authority - G3 + Validity + Not Before: Oct 1 00:00:00 1999 GMT + Not After : Jul 16 23:59:59 2036 GMT + Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 4 Public Primary Certification Authority - G3 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:ad:cb:a5:11:69:c6:59:ab:f1:8f:b5:19:0f:56: + ce:cc:b5:1f:20:e4:9e:26:25:4b:e0:73:65:89:59: + de:d0:83:e4:f5:0f:b5:bb:ad:f1:7c:e8:21:fc:e4: + e8:0c:ee:7c:45:22:19:76:92:b4:13:b7:20:5b:09: + fa:61:ae:a8:f2:a5:8d:85:c2:2a:d6:de:66:36:d2: + 9b:02:f4:a8:92:60:7c:9c:69:b4:8f:24:1e:d0:86: + 52:f6:32:9c:41:58:1e:22:bd:cd:45:62:95:08:6e: + d0:66:dd:53:a2:cc:f0:10:dc:54:73:8b:04:a1:46: + 33:33:5c:17:40:b9:9e:4d:d3:f3:be:55:83:e8:b1: + 89:8e:5a:7c:9a:96:22:90:3b:88:25:f2:d2:53:88: + 02:0c:0b:78:f2:e6:37:17:4b:30:46:07:e4:80:6d: + a6:d8:96:2e:e8:2c:f8:11:b3:38:0d:66:a6:9b:ea: + c9:23:5b:db:8e:e2:f3:13:8e:1a:59:2d:aa:02:f0: + ec:a4:87:66:dc:c1:3f:f5:d8:b9:f4:ec:82:c6:d2: + 3d:95:1d:e5:c0:4f:84:c9:d9:a3:44:28:06:6a:d7: + 45:ac:f0:6b:6a:ef:4e:5f:f8:11:82:1e:38:63:34: + 66:50:d4:3e:93:73:fa:30:c3:66:ad:ff:93:2d:97: + ef:03 + Exponent: 65537 (0x10001) + Signature Algorithm: sha1WithRSAEncryption + 8f:fa:25:6b:4f:5b:e4:a4:4e:27:55:ab:22:15:59:3c:ca:b5: + 0a:d4:4a:db:ab:dd:a1:5f:53:c5:a0:57:39:c2:ce:47:2b:be: + 3a:c8:56:bf:c2:d9:27:10:3a:b1:05:3c:c0:77:31:bb:3a:d3: + 05:7b:6d:9a:1c:30:8c:80:cb:93:93:2a:83:ab:05:51:82:02: + 00:11:67:6b:f3:88:61:47:5f:03:93:d5:5b:0d:e0:f1:d4:a1: + 32:35:85:b2:3a:db:b0:82:ab:d1:cb:0a:bc:4f:8c:5b:c5:4b: + 00:3b:1f:2a:82:a6:7e:36:85:dc:7e:3c:67:00:b5:e4:3b:52: + e0:a8:eb:5d:15:f9:c6:6d:f0:ad:1d:0e:85:b7:a9:9a:73:14: + 5a:5b:8f:41:28:c0:d5:e8:2d:4d:a4:5e:cd:aa:d9:ed:ce:dc: + d8:d5:3c:42:1d:17:c1:12:5d:45:38:c3:38:f3:fc:85:2e:83: + 46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0: + a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0: + 21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01: + a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3: + 35:60:91:ce +MD5 Fingerprint=DB:C8:F2:27:2E:B1:EA:6A:29:23:5D:FE:56:3E:33:DF +-----BEGIN CERTIFICATE----- +MIIEGjCCAwICEQDsoKeLbnVqAc/EfMwvlF7XMA0GCSqGSIb3DQEBBQUAMIHKMQsw +CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl +cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu +LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT +aWduIENsYXNzIDQgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp +dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD +VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT +aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ +bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu +IENsYXNzIDQgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg +LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK3LpRFpxlmr8Y+1 +GQ9Wzsy1HyDkniYlS+BzZYlZ3tCD5PUPtbut8XzoIfzk6AzufEUiGXaStBO3IFsJ ++mGuqPKljYXCKtbeZjbSmwL0qJJgfJxptI8kHtCGUvYynEFYHiK9zUVilQhu0Gbd +U6LM8BDcVHOLBKFGMzNcF0C5nk3T875Vg+ixiY5afJqWIpA7iCXy0lOIAgwLePLm +NxdLMEYH5IBtptiWLugs+BGzOA1mppvqySNb247i8xOOGlktqgLw7KSHZtzBP/XY +ufTsgsbSPZUd5cBPhMnZo0QoBmrXRazwa2rvTl/4EYIeOGM0ZlDUPpNz+jDDZq3/ +ky2X7wMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAj/ola09b5KROJ1WrIhVZPMq1 +CtRK26vdoV9TxaBXOcLORyu+OshWv8LZJxA6sQU8wHcxuzrTBXttmhwwjIDLk5Mq +g6sFUYICABFna/OIYUdfA5PVWw3g8dShMjWFsjrbsIKr0csKvE+MW8VLADsfKoKm +fjaF3H48ZwC15DtS4KjrXRX5xm3wrR0OhbepmnMUWluPQSjA1egtTaRezarZ7c7c +2NU8Qh0XwRJdRTjDOPP8hS6DRkiy1yBfkjaP53kPmF6Z6PDQpLv1U70qzlmwr25/ +bLvSHgCwIe34QWKCudiyxLtGUPMxxY8BqHTr9Xgn2uf3ZkPznoM+IKrDNWCRzg== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 927650371 (0x374ad243) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=Entrust.net, OU=www.entrust.net/CPS incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Secure Server Certification Authority + Validity + Not Before: May 25 16:09:40 1999 GMT + Not After : May 25 16:39:40 2019 GMT + Subject: C=US, O=Entrust.net, OU=www.entrust.net/CPS incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Secure Server Certification Authority + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:cd:28:83:34:54:1b:89:f3:0f:af:37:91:31:ff: + af:31:60:c9:a8:e8:b2:10:68:ed:9f:e7:93:36:f1: + 0a:64:bb:47:f5:04:17:3f:23:47:4d:c5:27:19:81: + 26:0c:54:72:0d:88:2d:d9:1f:9a:12:9f:bc:b3:71: + d3:80:19:3f:47:66:7b:8c:35:28:d2:b9:0a:df:24: + da:9c:d6:50:79:81:7a:5a:d3:37:f7:c2:4a:d8:29: + 92:26:64:d1:e4:98:6c:3a:00:8a:f5:34:9b:65:f8: + ed:e3:10:ff:fd:b8:49:58:dc:a0:de:82:39:6b:81: + b1:16:19:61:b9:54:b6:e6:43 + Exponent: 3 (0x3) + X509v3 extensions: + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 CRL Distribution Points: + DirName:/C=US/O=Entrust.net/OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority/CN=CRL1 + URI:http://www.entrust.net/CRL/net1.crl + + X509v3 Private Key Usage Period: + Not Before: May 25 16:09:40 1999 GMT, Not After: May 25 16:09:40 2019 GMT + X509v3 Key Usage: + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:F0:17:62:13:55:3D:B3:FF:0A:00:6B:FB:50:84:97:F3:ED:62:D0:1A + + X509v3 Subject Key Identifier: + F0:17:62:13:55:3D:B3:FF:0A:00:6B:FB:50:84:97:F3:ED:62:D0:1A + X509v3 Basic Constraints: + CA:TRUE + 1.2.840.113533.7.65.0: + 0 +..V4.0.... + Signature Algorithm: sha1WithRSAEncryption + 90:dc:30:02:fa:64:74:c2:a7:0a:a5:7c:21:8d:34:17:a8:fb: + 47:0e:ff:25:7c:8d:13:0a:fb:e4:98:b5:ef:8c:f8:c5:10:0d: + f7:92:be:f1:c3:d5:d5:95:6a:04:bb:2c:ce:26:36:65:c8:31: + c6:e7:ee:3f:e3:57:75:84:7a:11:ef:46:4f:18:f4:d3:98:bb: + a8:87:32:ba:72:f6:3c:e2:3d:9f:d7:1d:d9:c3:60:43:8c:58: + 0e:22:96:2f:62:a3:2c:1f:ba:ad:05:ef:ab:32:78:87:a0:54: + 73:19:b5:5c:05:f9:52:3e:6d:2d:45:0b:f7:0a:93:ea:ed:06: + f9:b2 +MD5 Fingerprint=DF:F2:80:73:CC:F1:E6:61:73:FC:F5:42:E9:C5:7C:EE +-----BEGIN CERTIFICATE----- +MIIE2DCCBEGgAwIBAgIEN0rSQzANBgkqhkiG9w0BAQUFADCBwzELMAkGA1UEBhMC +VVMxFDASBgNVBAoTC0VudHJ1c3QubmV0MTswOQYDVQQLEzJ3d3cuZW50cnVzdC5u +ZXQvQ1BTIGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMGA1UECxMc +KGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDE6MDgGA1UEAxMxRW50cnVzdC5u +ZXQgU2VjdXJlIFNlcnZlciBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05OTA1 +MjUxNjA5NDBaFw0xOTA1MjUxNjM5NDBaMIHDMQswCQYDVQQGEwJVUzEUMBIGA1UE +ChMLRW50cnVzdC5uZXQxOzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j +b3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF +bnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg +U2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA +A4GLADCBhwKBgQDNKIM0VBuJ8w+vN5Ex/68xYMmo6LIQaO2f55M28Qpku0f1BBc/ +I0dNxScZgSYMVHINiC3ZH5oSn7yzcdOAGT9HZnuMNSjSuQrfJNqc1lB5gXpa0zf3 +wkrYKZImZNHkmGw6AIr1NJtl+O3jEP/9uElY3KDegjlrgbEWGWG5VLbmQwIBA6OC +AdcwggHTMBEGCWCGSAGG+EIBAQQEAwIABzCCARkGA1UdHwSCARAwggEMMIHeoIHb +oIHYpIHVMIHSMQswCQYDVQQGEwJVUzEUMBIGA1UEChMLRW50cnVzdC5uZXQxOzA5 +BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5jb3JwLiBieSByZWYuIChsaW1p +dHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBFbnRydXN0Lm5ldCBMaW1pdGVk +MTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUgU2VydmVyIENlcnRpZmljYXRp +b24gQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMCmgJ6AlhiNodHRwOi8vd3d3LmVu +dHJ1c3QubmV0L0NSTC9uZXQxLmNybDArBgNVHRAEJDAigA8xOTk5MDUyNTE2MDk0 +MFqBDzIwMTkwNTI1MTYwOTQwWjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAU8Bdi +E1U9s/8KAGv7UISX8+1i0BowHQYDVR0OBBYEFPAXYhNVPbP/CgBr+1CEl/PtYtAa +MAwGA1UdEwQFMAMBAf8wGQYJKoZIhvZ9B0EABAwwChsEVjQuMAMCBJAwDQYJKoZI +hvcNAQEFBQADgYEAkNwwAvpkdMKnCqV8IY00F6j7Rw7/JXyNEwr75Ji174z4xRAN +95K+8cPV1ZVqBLssziY2ZcgxxufuP+NXdYR6Ee9GTxj005i7qIcyunL2POI9n9cd +2cNgQ4xYDiKWL2KjLB+6rQXvqzJ4h6BUcxm1XAX5Uj5tLUUL9wqT6u0G+bI= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 939758062 (0x380391ee) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=US, O=Entrust.net, OU=www.entrust.net/Client_CA_Info/CPS incorp. by ref. limits liab., OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Client Certification Authority + Validity + Not Before: Oct 12 19:24:30 1999 GMT + Not After : Oct 12 19:54:30 2019 GMT + Subject: C=US, O=Entrust.net, OU=www.entrust.net/Client_CA_Info/CPS incorp. by ref. limits liab., OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Client Certification Authority + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:c8:3a:99:5e:31:17:df:ac:27:6f:90:7b:e4:19: + ff:45:a3:34:c2:db:c1:a8:4f:f0:68:ea:84:fd:9f: + 75:79:cf:c1:8a:51:94:af:c7:57:03:47:64:9e:ad: + 82:1b:5a:da:7f:37:78:47:bb:37:98:12:96:ce:c6: + 13:7d:ef:d2:0c:30:51:a9:39:9e:55:f8:fb:b1:e7: + 30:de:83:b2:ba:3e:f1:d5:89:3b:3b:85:ba:aa:74: + 2c:fe:3f:31:6e:af:91:95:6e:06:d4:07:4d:4b:2c: + 56:47:18:04:52:da:0e:10:93:bf:63:90:9b:e1:df: + 8c:e6:02:a4:e6:4f:5e:f7:8b + Exponent: 3 (0x3) + X509v3 extensions: + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 CRL Distribution Points: + DirName:/C=US/O=Entrust.net/OU=www.entrust.net/Client_CA_Info/CPS incorp. by ref. limits liab./OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Client Certification Authority/CN=CRL1 + URI:http://www.entrust.net/CRL/Client1.crl + + X509v3 Private Key Usage Period: + Not Before: Oct 12 19:24:30 1999 GMT, Not After: Oct 12 19:24:30 2019 GMT + X509v3 Key Usage: + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:C4:FB:9C:29:7B:97:CD:4C:96:FC:EE:5B:B3:CA:99:74:8B:95:EA:4C + + X509v3 Subject Key Identifier: + C4:FB:9C:29:7B:97:CD:4C:96:FC:EE:5B:B3:CA:99:74:8B:95:EA:4C + X509v3 Basic Constraints: + CA:TRUE + 1.2.840.113533.7.65.0: + 0 +..V4.0.... + Signature Algorithm: md5WithRSAEncryption + 3f:ae:8a:f1:d7:66:03:05:9e:3e:fa:ea:1c:46:bb:a4:5b:8f: + 78:9a:12:48:99:f9:f4:35:de:0c:36:07:02:6b:10:3a:89:14: + 81:9c:31:a6:7c:b2:41:b2:6a:e7:07:01:a1:4b:f9:9f:25:3b: + 96:ca:99:c3:3e:a1:51:1c:f3:c3:2e:44:f7:b0:67:46:aa:92: + e5:3b:da:1c:19:14:38:30:d5:e2:a2:31:25:2e:f1:ec:45:38: + ed:f8:06:58:03:73:62:b0:10:31:8f:40:bf:64:e0:5c:3e:c5: + 4f:1f:da:12:43:ff:4c:e6:06:26:a8:9b:19:aa:44:3c:76:b2: + 5c:ec +MD5 Fingerprint=0C:41:2F:13:5B:A0:54:F5:96:66:2D:7E:CD:0E:03:F4 +-----BEGIN CERTIFICATE----- +MIIE7TCCBFagAwIBAgIEOAOR7jANBgkqhkiG9w0BAQQFADCByTELMAkGA1UEBhMC +VVMxFDASBgNVBAoTC0VudHJ1c3QubmV0MUgwRgYDVQQLFD93d3cuZW50cnVzdC5u +ZXQvQ2xpZW50X0NBX0luZm8vQ1BTIGluY29ycC4gYnkgcmVmLiBsaW1pdHMgbGlh +Yi4xJTAjBgNVBAsTHChjKSAxOTk5IEVudHJ1c3QubmV0IExpbWl0ZWQxMzAxBgNV +BAMTKkVudHJ1c3QubmV0IENsaWVudCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe +Fw05OTEwMTIxOTI0MzBaFw0xOTEwMTIxOTU0MzBaMIHJMQswCQYDVQQGEwJVUzEU +MBIGA1UEChMLRW50cnVzdC5uZXQxSDBGBgNVBAsUP3d3dy5lbnRydXN0Lm5ldC9D +bGllbnRfQ0FfSW5mby9DUFMgaW5jb3JwLiBieSByZWYuIGxpbWl0cyBsaWFiLjEl +MCMGA1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UEAxMq +RW50cnVzdC5uZXQgQ2xpZW50IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0G +CSqGSIb3DQEBAQUAA4GLADCBhwKBgQDIOpleMRffrCdvkHvkGf9FozTC28GoT/Bo +6oT9n3V5z8GKUZSvx1cDR2SerYIbWtp/N3hHuzeYEpbOxhN979IMMFGpOZ5V+Pux +5zDeg7K6PvHViTs7hbqqdCz+PzFur5GVbgbUB01LLFZHGARS2g4Qk79jkJvh34zm +AqTmT173iwIBA6OCAeAwggHcMBEGCWCGSAGG+EIBAQQEAwIABzCCASIGA1UdHwSC +ARkwggEVMIHkoIHhoIHepIHbMIHYMQswCQYDVQQGEwJVUzEUMBIGA1UEChMLRW50 +cnVzdC5uZXQxSDBGBgNVBAsUP3d3dy5lbnRydXN0Lm5ldC9DbGllbnRfQ0FfSW5m +by9DUFMgaW5jb3JwLiBieSByZWYuIGxpbWl0cyBsaWFiLjElMCMGA1UECxMcKGMp +IDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UEAxMqRW50cnVzdC5uZXQg +Q2xpZW50IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMCyg +KqAohiZodHRwOi8vd3d3LmVudHJ1c3QubmV0L0NSTC9DbGllbnQxLmNybDArBgNV +HRAEJDAigA8xOTk5MTAxMjE5MjQzMFqBDzIwMTkxMDEyMTkyNDMwWjALBgNVHQ8E +BAMCAQYwHwYDVR0jBBgwFoAUxPucKXuXzUyW/O5bs8qZdIuV6kwwHQYDVR0OBBYE +FMT7nCl7l81MlvzuW7PKmXSLlepMMAwGA1UdEwQFMAMBAf8wGQYJKoZIhvZ9B0EA +BAwwChsEVjQuMAMCBJAwDQYJKoZIhvcNAQEEBQADgYEAP66K8ddmAwWePvrqHEa7 +pFuPeJoSSJn59DXeDDYHAmsQOokUgZwxpnyyQbJq5wcBoUv5nyU7lsqZwz6hURzz +wy5E97BnRqqS5TvaHBkUODDV4qIxJS7x7EU47fgGWANzYrAQMY9Av2TgXD7FTx/a +EkP/TOYGJqibGapEPHayXOw= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 946059622 (0x3863b966) + Signature Algorithm: sha1WithRSAEncryption + Issuer: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048) + Validity + Not Before: Dec 24 17:50:51 1999 GMT + Not After : Dec 24 18:20:51 2019 GMT + Subject: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048) + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:ad:4d:4b:a9:12:86:b2:ea:a3:20:07:15:16:64: + 2a:2b:4b:d1:bf:0b:4a:4d:8e:ed:80:76:a5:67:b7: + 78:40:c0:73:42:c8:68:c0:db:53:2b:dd:5e:b8:76: + 98:35:93:8b:1a:9d:7c:13:3a:0e:1f:5b:b7:1e:cf: + e5:24:14:1e:b1:81:a9:8d:7d:b8:cc:6b:4b:03:f1: + 02:0c:dc:ab:a5:40:24:00:7f:74:94:a1:9d:08:29: + b3:88:0b:f5:87:77:9d:55:cd:e4:c3:7e:d7:6a:64: + ab:85:14:86:95:5b:97:32:50:6f:3d:c8:ba:66:0c: + e3:fc:bd:b8:49:c1:76:89:49:19:fd:c0:a8:bd:89: + a3:67:2f:c6:9f:bc:71:19:60:b8:2d:e9:2c:c9:90: + 76:66:7b:94:e2:af:78:d6:65:53:5d:3c:d6:9c:b2: + cf:29:03:f9:2f:a4:50:b2:d4:48:ce:05:32:55:8a: + fd:b2:64:4c:0e:e4:98:07:75:db:7f:df:b9:08:55: + 60:85:30:29:f9:7b:48:a4:69:86:e3:35:3f:1e:86: + 5d:7a:7a:15:bd:ef:00:8e:15:22:54:17:00:90:26: + 93:bc:0e:49:68:91:bf:f8:47:d3:9d:95:42:c1:0e: + 4d:df:6f:26:cf:c3:18:21:62:66:43:70:d6:d5:c0: + 07:e1 + Exponent: 65537 (0x10001) + X509v3 extensions: + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 Authority Key Identifier: + keyid:55:E4:81:D1:11:80:BE:D8:89:B9:08:A3:31:F9:A1:24:09:16:B9:70 + + X509v3 Subject Key Identifier: + 55:E4:81:D1:11:80:BE:D8:89:B9:08:A3:31:F9:A1:24:09:16:B9:70 + 1.2.840.113533.7.65.0: + 0...V5.0:4.0.... + Signature Algorithm: sha1WithRSAEncryption + 59:47:ac:21:84:8a:17:c9:9c:89:53:1e:ba:80:85:1a:c6:3c: + 4e:3e:b1:9c:b6:7c:c6:92:5d:18:64:02:e3:d3:06:08:11:61: + 7c:63:e3:2b:9d:31:03:70:76:d2:a3:28:a0:f4:bb:9a:63:73: + ed:6d:e5:2a:db:ed:14:a9:2b:c6:36:11:d0:2b:eb:07:8b:a5: + da:9e:5c:19:9d:56:12:f5:54:29:c8:05:ed:b2:12:2a:8d:f4: + 03:1b:ff:e7:92:10:87:b0:3a:b5:c3:9d:05:37:12:a3:c7:f4: + 15:b9:d5:a4:39:16:9b:53:3a:23:91:f1:a8:82:a2:6a:88:68: + c1:79:02:22:bc:aa:a6:d6:ae:df:b0:14:5f:b8:87:d0:dd:7c: + 7f:7b:ff:af:1c:cf:e6:db:07:ad:5e:db:85:9d:d0:2b:0d:33: + db:04:d1:e6:49:40:13:2b:76:fb:3e:e9:9c:89:0f:15:ce:18: + b0:85:78:21:4f:6b:4f:0e:fa:36:67:cd:07:f2:ff:08:d0:e2: + de:d9:bf:2a:af:b8:87:86:21:3c:04:ca:b7:94:68:7f:cf:3c: + e9:98:d7:38:ff:ec:c0:d9:50:f0:2e:4b:58:ae:46:6f:d0:2e: + c3:60:da:72:55:72:bd:4c:45:9e:61:ba:bf:84:81:92:03:d1: + d2:69:7c:c5 +MD5 Fingerprint=BA:21:EA:20:D6:DD:DB:8F:C1:57:8B:40:AD:A1:FC:FC +-----BEGIN CERTIFICATE----- +MIIEXDCCA0SgAwIBAgIEOGO5ZjANBgkqhkiG9w0BAQUFADCBtDEUMBIGA1UEChML +RW50cnVzdC5uZXQxQDA+BgNVBAsUN3d3dy5lbnRydXN0Lm5ldC9DUFNfMjA0OCBp +bmNvcnAuIGJ5IHJlZi4gKGxpbWl0cyBsaWFiLikxJTAjBgNVBAsTHChjKSAxOTk5 +IEVudHJ1c3QubmV0IExpbWl0ZWQxMzAxBgNVBAMTKkVudHJ1c3QubmV0IENlcnRp +ZmljYXRpb24gQXV0aG9yaXR5ICgyMDQ4KTAeFw05OTEyMjQxNzUwNTFaFw0xOTEy +MjQxODIwNTFaMIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDFAMD4GA1UECxQ3d3d3 +LmVudHJ1c3QubmV0L0NQU18yMDQ4IGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxp +YWIuKTElMCMGA1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEG +A1UEAxMqRW50cnVzdC5uZXQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgKDIwNDgp +MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArU1LqRKGsuqjIAcVFmQq +K0vRvwtKTY7tgHalZ7d4QMBzQshowNtTK91euHaYNZOLGp18EzoOH1u3Hs/lJBQe +sYGpjX24zGtLA/ECDNyrpUAkAH90lKGdCCmziAv1h3edVc3kw37XamSrhRSGlVuX +MlBvPci6Zgzj/L24ScF2iUkZ/cCovYmjZy/Gn7xxGWC4LeksyZB2ZnuU4q941mVT +XTzWnLLPKQP5L6RQstRIzgUyVYr9smRMDuSYB3Xbf9+5CFVghTAp+XtIpGmG4zU/ +HoZdenoVve8AjhUiVBcAkCaTvA5JaJG/+EfTnZVCwQ5N328mz8MYIWJmQ3DW1cAH +4QIDAQABo3QwcjARBglghkgBhvhCAQEEBAMCAAcwHwYDVR0jBBgwFoAUVeSB0RGA +vtiJuQijMfmhJAkWuXAwHQYDVR0OBBYEFFXkgdERgL7YibkIozH5oSQJFrlwMB0G +CSqGSIb2fQdBAAQQMA4bCFY1LjA6NC4wAwIEkDANBgkqhkiG9w0BAQUFAAOCAQEA +WUesIYSKF8mciVMeuoCFGsY8Tj6xnLZ8xpJdGGQC49MGCBFhfGPjK50xA3B20qMo +oPS7mmNz7W3lKtvtFKkrxjYR0CvrB4ul2p5cGZ1WEvVUKcgF7bISKo30Axv/55IQ +h7A6tcOdBTcSo8f0FbnVpDkWm1M6I5HxqIKiaohowXkCIryqptau37AUX7iH0N18 +f3v/rxzP5tsHrV7bhZ3QKw0z2wTR5klAEyt2+z7pnIkPFc4YsIV4IU9rTw76NmfN +B/L/CNDi3tm/Kq+4h4YhPATKt5Rof8886ZjXOP/swNlQ8C5LWK5Gb9Auw2DaclVy +vUxFnmG6v4SBkgPR0ml8xQ== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 33554617 (0x20000b9) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root + Validity + Not Before: May 12 18:46:00 2000 GMT + Not After : May 12 23:59:00 2025 GMT + Subject: C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:a3:04:bb:22:ab:98:3d:57:e8:26:72:9a:b5:79: + d4:29:e2:e1:e8:95:80:b1:b0:e3:5b:8e:2b:29:9a: + 64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2: + 62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01: + 52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7: + 73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a6: + 50:d2:a8:50:c3:28:ea:f5:ab:25:87:8a:9a:96:1c: + a9:67:b8:3f:0c:d5:f7:f9:52:13:2f:c2:1b:d5:70: + 70:f0:8f:c0:12:ca:06:cb:9a:e1:d9:ca:33:7a:77: + d6:f8:ec:b9:f1:68:44:42:48:13:d2:c0:c2:a4:ae: + 5e:60:fe:b6:a6:05:fc:b4:dd:07:59:02:d4:59:18: + 98:63:f5:a5:63:e0:90:0c:7d:5d:b2:06:7a:f3:85: + ea:eb:d4:03:ae:5e:84:3e:5f:ff:15:ed:69:bc:f9: + 39:36:72:75:cf:77:52:4d:f3:c9:90:2c:b9:3d:e5: + c9:23:53:3f:1f:24:98:21:5c:07:99:29:bd:c6:3a: + ec:e7:6e:86:3a:6b:97:74:63:33:bd:68:18:31:f0: + 78:8d:76:bf:fc:9e:8e:5d:2a:86:a7:4d:90:dc:27: + 1a:39 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + E5:9D:59:30:82:47:58:CC:AC:FA:08:54:36:86:7B:3A:B5:04:4D:F0 + X509v3 Basic Constraints: critical + CA:TRUE, pathlen:3 + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + Signature Algorithm: sha1WithRSAEncryption + 85:0c:5d:8e:e4:6f:51:68:42:05:a0:dd:bb:4f:27:25:84:03: + bd:f7:64:fd:2d:d7:30:e3:a4:10:17:eb:da:29:29:b6:79:3f: + 76:f6:19:13:23:b8:10:0a:f9:58:a4:d4:61:70:bd:04:61:6a: + 12:8a:17:d5:0a:bd:c5:bc:30:7c:d6:e9:0c:25:8d:86:40:4f: + ec:cc:a3:7e:38:c6:37:11:4f:ed:dd:68:31:8e:4c:d2:b3:01: + 74:ee:be:75:5e:07:48:1a:7f:70:ff:16:5c:84:c0:79:85:b8: + 05:fd:7f:be:65:11:a3:0f:c0:02:b4:f8:52:37:39:04:d5:a9: + 31:7a:18:bf:a0:2a:f4:12:99:f7:a3:45:82:e3:3c:5e:f5:9d: + 9e:b5:c8:9e:7c:2e:c8:a4:9e:4e:08:14:4b:6d:fd:70:6d:6b: + 1a:63:bd:64:e6:1f:b7:ce:f0:f2:9f:2e:bb:1b:b7:f2:50:88: + 73:92:c2:e2:e3:16:8d:9a:32:02:ab:8e:18:dd:e9:10:11:ee: + 7e:35:ab:90:af:3e:30:94:7a:d0:33:3d:a7:65:0f:f5:fc:8e: + 9e:62:cf:47:44:2c:01:5d:bb:1d:b5:32:d2:47:d2:38:2e:d0: + fe:81:dc:32:6a:1e:b5:ee:3c:d5:fc:e7:81:1d:19:c3:24:42: + ea:63:39:a9 +MD5 Fingerprint=AC:B6:94:A5:9C:17:E0:D7:91:52:9B:B1:97:06:A6:E4 +-----BEGIN CERTIFICATE----- +MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ +RTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYD +VQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTAwMDUxMjE4NDYwMFoX +DTI1MDUxMjIzNTkwMFowWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9y +ZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVy +VHJ1c3QgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKMEuyKr +mD1X6CZymrV51Cni4eiVgLGw41uOKymaZN+hXe2wCQVt2yguzmKiYv60iNoS6zjr +IZ3AQSsBUnuId9Mcj8e6uYi1agnnc+gRQKfRzMpijS3ljwumUNKoUMMo6vWrJYeK +mpYcqWe4PwzV9/lSEy/CG9VwcPCPwBLKBsua4dnKM3p31vjsufFoREJIE9LAwqSu +XmD+tqYF/LTdB1kC1FkYmGP1pWPgkAx9XbIGevOF6uvUA65ehD5f/xXtabz5OTZy +dc93Uk3zyZAsuT3lySNTPx8kmCFcB5kpvcY67Oduhjprl3RjM71oGDHweI12v/ye +jl0qhqdNkNwnGjkCAwEAAaNFMEMwHQYDVR0OBBYEFOWdWTCCR1jMrPoIVDaGezq1 +BE3wMBIGA1UdEwEB/wQIMAYBAf8CAQMwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3 +DQEBBQUAA4IBAQCFDF2O5G9RaEIFoN27TyclhAO992T9Ldcw46QQF+vaKSm2eT92 +9hkTI7gQCvlYpNRhcL0EYWoSihfVCr3FvDB81ukMJY2GQE/szKN+OMY3EU/t3Wgx +jkzSswF07r51XgdIGn9w/xZchMB5hbgF/X++ZRGjD8ACtPhSNzkE1akxehi/oCr0 +Epn3o0WC4zxe9Z2etciefC7IpJ5OCBRLbf1wbWsaY71k5h+3zvDyny67G7fyUIhz +ksLi4xaNmjICq44Y3ekQEe5+NauQrz4wlHrQMz2nZQ/1/I6eYs9HRCwBXbsdtTLS +R9I4LtD+gdwyah617jzV/OeBHRnDJELqYzmp +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=US, O=Equifax Secure Inc., CN=Equifax Secure Global eBusiness CA-1 + Validity + Not Before: Jun 21 04:00:00 1999 GMT + Not After : Jun 21 04:00:00 2020 GMT + Subject: C=US, O=Equifax Secure Inc., CN=Equifax Secure Global eBusiness CA-1 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:ba:e7:17:90:02:65:b1:34:55:3c:49:c2:51:d5: + df:a7:d1:37:8f:d1:e7:81:73:41:52:60:9b:9d:a1: + 17:26:78:ad:c7:b1:e8:26:94:32:b5:de:33:8d:3a: + 2f:db:f2:9a:7a:5a:73:98:a3:5c:e9:fb:8a:73:1b: + 5c:e7:c3:bf:80:6c:cd:a9:f4:d6:2b:c0:f7:f9:99: + aa:63:a2:b1:47:02:0f:d4:e4:51:3a:12:3c:6c:8a: + 5a:54:84:70:db:c1:c5:90:cf:72:45:cb:a8:59:c0: + cd:33:9d:3f:a3:96:eb:85:33:21:1c:3e:1e:3e:60: + 6e:76:9c:67:85:c5:c8:c3:61 + Exponent: 65537 (0x10001) + X509v3 extensions: + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Authority Key Identifier: + keyid:BE:A8:A0:74:72:50:6B:44:B7:C9:23:D8:FB:A8:FF:B3:57:6B:68:6C + + X509v3 Subject Key Identifier: + BE:A8:A0:74:72:50:6B:44:B7:C9:23:D8:FB:A8:FF:B3:57:6B:68:6C + Signature Algorithm: md5WithRSAEncryption + 30:e2:01:51:aa:c7:ea:5f:da:b9:d0:65:0f:30:d6:3e:da:0d: + 14:49:6e:91:93:27:14:31:ef:c4:f7:2d:45:f8:ec:c7:bf:a2: + 41:0d:23:b4:92:f9:19:00:67:bd:01:af:cd:e0:71:fc:5a:cf: + 64:c4:e0:96:98:d0:a3:40:e2:01:8a:ef:27:07:f1:65:01:8a: + 44:2d:06:65:75:52:c0:86:10:20:21:5f:6c:6b:0f:6c:ae:09: + 1c:af:f2:a2:18:34:c4:75:a4:73:1c:f1:8d:dc:ef:ad:f9:b3: + 76:b4:92:bf:dc:95:10:1e:be:cb:c8:3b:5a:84:60:19:56:94: + a9:55 +MD5 Fingerprint=8F:5D:77:06:27:C4:98:3C:5B:93:78:E7:D7:7D:9B:CC +-----BEGIN CERTIFICATE----- +MIICkDCCAfmgAwIBAgIBATANBgkqhkiG9w0BAQQFADBaMQswCQYDVQQGEwJVUzEc +MBoGA1UEChMTRXF1aWZheCBTZWN1cmUgSW5jLjEtMCsGA1UEAxMkRXF1aWZheCBT +ZWN1cmUgR2xvYmFsIGVCdXNpbmVzcyBDQS0xMB4XDTk5MDYyMTA0MDAwMFoXDTIw +MDYyMTA0MDAwMFowWjELMAkGA1UEBhMCVVMxHDAaBgNVBAoTE0VxdWlmYXggU2Vj +dXJlIEluYy4xLTArBgNVBAMTJEVxdWlmYXggU2VjdXJlIEdsb2JhbCBlQnVzaW5l +c3MgQ0EtMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAuucXkAJlsTRVPEnC +UdXfp9E3j9HngXNBUmCbnaEXJnitx7HoJpQytd4zjTov2/KaelpzmKNc6fuKcxtc +58O/gGzNqfTWK8D3+ZmqY6KxRwIP1ORROhI8bIpaVIRw28HFkM9yRcuoWcDNM50/ +o5brhTMhHD4ePmBudpxnhcXIw2ECAwEAAaNmMGQwEQYJYIZIAYb4QgEBBAQDAgAH +MA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUvqigdHJQa0S3ySPY+6j/s1dr +aGwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA +A4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA +Z70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv +8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 4 (0x4) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=US, O=Equifax Secure Inc., CN=Equifax Secure eBusiness CA-1 + Validity + Not Before: Jun 21 04:00:00 1999 GMT + Not After : Jun 21 04:00:00 2020 GMT + Subject: C=US, O=Equifax Secure Inc., CN=Equifax Secure eBusiness CA-1 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:ce:2f:19:bc:17:b7:77:de:93:a9:5f:5a:0d:17: + 4f:34:1a:0c:98:f4:22:d9:59:d4:c4:68:46:f0:b4: + 35:c5:85:03:20:c6:af:45:a5:21:51:45:41:eb:16: + 58:36:32:6f:e2:50:62:64:f9:fd:51:9c:aa:24:d9: + f4:9d:83:2a:87:0a:21:d3:12:38:34:6c:8d:00:6e: + 5a:a0:d9:42:ee:1a:21:95:f9:52:4c:55:5a:c5:0f: + 38:4f:46:fa:6d:f8:2e:35:d6:1d:7c:eb:e2:f0:b0: + 75:80:c8:a9:13:ac:be:88:ef:3a:6e:ab:5f:2a:38: + 62:02:b0:12:7b:fe:8f:a6:03 + Exponent: 65537 (0x10001) + X509v3 extensions: + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Authority Key Identifier: + keyid:4A:78:32:52:11:DB:59:16:36:5E:DF:C1:14:36:40:6A:47:7C:4C:A1 + + X509v3 Subject Key Identifier: + 4A:78:32:52:11:DB:59:16:36:5E:DF:C1:14:36:40:6A:47:7C:4C:A1 + Signature Algorithm: md5WithRSAEncryption + 75:5b:a8:9b:03:11:e6:e9:56:4c:cd:f9:a9:4c:c0:0d:9a:f3: + cc:65:69:e6:25:76:cc:59:b7:d6:54:c3:1d:cd:99:ac:19:dd: + b4:85:d5:e0:3d:fc:62:20:a7:84:4b:58:65:f1:e2:f9:95:21: + 3f:f5:d4:7e:58:1e:47:87:54:3e:58:a1:b5:b5:f8:2a:ef:71: + e7:bc:c3:f6:b1:49:46:e2:d7:a0:6b:e5:56:7a:9a:27:98:7c: + 46:62:14:e7:c9:fc:6e:03:12:79:80:38:1d:48:82:8d:fc:17: + fe:2a:96:2b:b5:62:a6:a6:3d:bd:7f:92:59:cd:5a:2a:82:b2: + 37:79 +MD5 Fingerprint=64:9C:EF:2E:44:FC:C6:8F:52:07:D0:51:73:8F:CB:3D +-----BEGIN CERTIFICATE----- +MIICgjCCAeugAwIBAgIBBDANBgkqhkiG9w0BAQQFADBTMQswCQYDVQQGEwJVUzEc +MBoGA1UEChMTRXF1aWZheCBTZWN1cmUgSW5jLjEmMCQGA1UEAxMdRXF1aWZheCBT +ZWN1cmUgZUJ1c2luZXNzIENBLTEwHhcNOTkwNjIxMDQwMDAwWhcNMjAwNjIxMDQw +MDAwWjBTMQswCQYDVQQGEwJVUzEcMBoGA1UEChMTRXF1aWZheCBTZWN1cmUgSW5j +LjEmMCQGA1UEAxMdRXF1aWZheCBTZWN1cmUgZUJ1c2luZXNzIENBLTEwgZ8wDQYJ +KoZIhvcNAQEBBQADgY0AMIGJAoGBAM4vGbwXt3fek6lfWg0XTzQaDJj0ItlZ1MRo +RvC0NcWFAyDGr0WlIVFFQesWWDYyb+JQYmT5/VGcqiTZ9J2DKocKIdMSODRsjQBu +WqDZQu4aIZX5UkxVWsUPOE9G+m34LjXWHXzr4vCwdYDIqROsvojvOm6rXyo4YgKw +Env+j6YDAgMBAAGjZjBkMBEGCWCGSAGG+EIBAQQEAwIABzAPBgNVHRMBAf8EBTAD +AQH/MB8GA1UdIwQYMBaAFEp4MlIR21kWNl7fwRQ2QGpHfEyhMB0GA1UdDgQWBBRK +eDJSEdtZFjZe38EUNkBqR3xMoTANBgkqhkiG9w0BAQQFAAOBgQB1W6ibAxHm6VZM +zfmpTMANmvPMZWnmJXbMWbfWVMMdzZmsGd20hdXgPfxiIKeES1hl8eL5lSE/9dR+ +WB5Hh1Q+WKG1tfgq73HnvMP2sUlG4tega+VWeponmHxGYhTnyfxuAxJ5gDgdSIKN +/Bf+KpYrtWKmpj29f5JZzVoqgrI3eQ== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 930140085 (0x3770cfb5) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=Equifax Secure, OU=Equifax Secure eBusiness CA-2 + Validity + Not Before: Jun 23 12:14:45 1999 GMT + Not After : Jun 23 12:14:45 2019 GMT + Subject: C=US, O=Equifax Secure, OU=Equifax Secure eBusiness CA-2 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:e4:39:39:93:1e:52:06:1b:28:36:f8:b2:a3:29: + c5:ed:8e:b2:11:bd:fe:eb:e7:b4:74:c2:8f:ff:05: + e7:d9:9d:06:bf:12:c8:3f:0e:f2:d6:d1:24:b2:11: + de:d1:73:09:8a:d4:b1:2c:98:09:0d:1e:50:46:b2: + 83:a6:45:8d:62:68:bb:85:1b:20:70:32:aa:40:cd: + a6:96:5f:c4:71:37:3f:04:f3:b7:41:24:39:07:1a: + 1e:2e:61:58:a0:12:0b:e5:a5:df:c5:ab:ea:37:71: + cc:1c:c8:37:3a:b9:97:52:a7:ac:c5:6a:24:94:4e: + 9c:7b:cf:c0:6a:d6:df:21:bd + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 CRL Distribution Points: + DirName:/C=US/O=Equifax Secure/OU=Equifax Secure eBusiness CA-2/CN=CRL1 + + X509v3 Private Key Usage Period: + Not After: Jun 23 12:14:45 2019 GMT + X509v3 Key Usage: + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:50:9E:0B:EA:AF:5E:B9:20:48:A6:50:6A:CB:FD:D8:20:7A:A7:82:76 + + X509v3 Subject Key Identifier: + 50:9E:0B:EA:AF:5E:B9:20:48:A6:50:6A:CB:FD:D8:20:7A:A7:82:76 + X509v3 Basic Constraints: + CA:TRUE + 1.2.840.113533.7.65.0: + 0...V3.0c.... + Signature Algorithm: sha1WithRSAEncryption + 0c:86:82:ad:e8:4e:1a:f5:8e:89:27:e2:35:58:3d:29:b4:07: + 8f:36:50:95:bf:6e:c1:9e:eb:c4:90:b2:85:a8:bb:b7:42:e0: + 0f:07:39:df:fb:9e:90:b2:d1:c1:3e:53:9f:03:44:b0:7e:4b: + f4:6f:e4:7c:1f:e7:e2:b1:e4:b8:9a:ef:c3:bd:ce:de:0b:32: + 34:d9:de:28:ed:33:6b:c4:d4:d7:3d:12:58:ab:7d:09:2d:cb: + 70:f5:13:8a:94:a1:27:a4:d6:70:c5:6d:94:b5:c9:7d:9d:a0: + d2:c6:08:49:d9:66:9b:a6:d3:f4:0b:dc:c5:26:57:e1:91:30: + ea:cd +MD5 Fingerprint=AA:BF:BF:64:97:DA:98:1D:6F:C6:08:3A:95:70:33:CA +-----BEGIN CERTIFICATE----- +MIIDIDCCAomgAwIBAgIEN3DPtTANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJV +UzEXMBUGA1UEChMORXF1aWZheCBTZWN1cmUxJjAkBgNVBAsTHUVxdWlmYXggU2Vj +dXJlIGVCdXNpbmVzcyBDQS0yMB4XDTk5MDYyMzEyMTQ0NVoXDTE5MDYyMzEyMTQ0 +NVowTjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkVxdWlmYXggU2VjdXJlMSYwJAYD +VQQLEx1FcXVpZmF4IFNlY3VyZSBlQnVzaW5lc3MgQ0EtMjCBnzANBgkqhkiG9w0B +AQEFAAOBjQAwgYkCgYEA5Dk5kx5SBhsoNviyoynF7Y6yEb3+6+e0dMKP/wXn2Z0G +vxLIPw7y1tEkshHe0XMJitSxLJgJDR5QRrKDpkWNYmi7hRsgcDKqQM2mll/EcTc/ +BPO3QSQ5BxoeLmFYoBIL5aXfxavqN3HMHMg3OrmXUqesxWoklE6ce8/AatbfIb0C +AwEAAaOCAQkwggEFMHAGA1UdHwRpMGcwZaBjoGGkXzBdMQswCQYDVQQGEwJVUzEX +MBUGA1UEChMORXF1aWZheCBTZWN1cmUxJjAkBgNVBAsTHUVxdWlmYXggU2VjdXJl +IGVCdXNpbmVzcyBDQS0yMQ0wCwYDVQQDEwRDUkwxMBoGA1UdEAQTMBGBDzIwMTkw +NjIzMTIxNDQ1WjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAUUJ4L6q9euSBIplBq +y/3YIHqngnYwHQYDVR0OBBYEFFCeC+qvXrkgSKZQasv92CB6p4J2MAwGA1UdEwQF +MAMBAf8wGgYJKoZIhvZ9B0EABA0wCxsFVjMuMGMDAgbAMA0GCSqGSIb3DQEBBQUA +A4GBAAyGgq3oThr1jokn4jVYPSm0B482UJW/bsGe68SQsoWou7dC4A8HOd/7npCy +0cE+U58DRLB+S/Rv5Hwf5+Kx5Lia78O9zt4LMjTZ3ijtM2vE1Nc9ElirfQkty3D1 +E4qUoSek1nDFbZS1yX2doNLGCEnZZpum0/QL3MUmV+GRMOrN +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 798 (0x31e) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=VISA, OU=Visa International Service Association, CN=GP Root 2 + Validity + Not Before: Aug 16 22:51:00 2000 GMT + Not After : Aug 15 23:59:00 2020 GMT + Subject: C=US, O=VISA, OU=Visa International Service Association, CN=GP Root 2 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:a9:01:70:b5:aa:c4:40:f0:ab:6a:26:61:79:19: + 00:fc:bf:9b:37:59:0c:af:6f:64:1b:f8:da:95:94: + 24:69:33:11:70:ca:e3:56:74:a2:17:57:64:5c:20: + 06:e1:d6:ef:71:b7:3b:f7:ab:c1:69:d0:49:a4:b1: + 04:d7:f4:57:62:89:5c:b0:75:2d:17:24:69:e3:42: + 60:e4:ee:74:d6:ab:80:56:d8:88:28:e1:fb:6d:22: + fd:23:7c:46:73:4f:7e:54:73:1e:a8:2c:55:58:75: + b7:4c:f3:5a:45:a5:02:1a:fa:da:9d:c3:45:c3:22: + 5e:f3:8b:f1:60:29:d2:c7:5f:b4:0c:3a:51:83:ef: + 30:f8:d4:e7:c7:f2:fa:99:a3:22:50:be:f9:05:37: + a3:ad:ed:9a:c3:e6:ec:88:1b:b6:19:27:1b:38:8b: + 80:4d:ec:b9:c7:c5:89:cb:fc:1a:32:ed:23:f0:b5: + 01:58:f9:f6:8f:e0:85:a9:4c:09:72:39:12:db:b3: + f5:cf:4e:62:64:da:c6:19:15:3a:63:1d:e9:17:55: + a1:4c:22:3c:34:32:46:f8:65:57:ba:2b:ef:36:8c: + 6a:fa:d9:d9:44:f4:aa:dd:84:d7:0d:1c:b2:54:ac: + 32:85:b4:64:0d:de:41:bb:b1:34:c6:01:86:32:64: + d5:9f + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + 9E:7D:4B:34:BF:71:AD:C2:05:F6:03:75:80:CE:A9:4F:1A:C4:24:4C + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + Signature Algorithm: sha1WithRSAEncryption + 21:a5:76:14:55:f9:ad:27:70:8f:3c:f4:d5:6c:c8:cc:0a:ab: + a3:98:0b:8a:06:23:c5:c9:61:db:99:07:69:35:26:31:fe:c7: + 2e:84:c2:99:61:d4:0d:e9:7d:2e:13:2b:7c:8e:85:b6:85:c7: + 4b:cf:35:b6:2c:47:3d:ce:29:2f:d8:6f:9f:89:1c:64:93:bf: + 08:bd:76:d0:90:8a:94:b3:7f:28:5b:6e:ac:4d:33:2c:ed:65: + dc:16:cc:e2:cd:ae:a4:3d:62:92:06:95:26:bf:df:b9:e4:20: + a6:73:6a:c1:be:f7:94:44:d6:4d:6f:2a:0b:6b:18:4d:74:10: + 36:68:6a:5a:c1:6a:a7:dd:36:29:8c:b8:30:8b:4f:21:3f:00: + 2e:54:30:07:3a:ba:8a:e4:c3:9e:ca:d8:b5:d8:7b:ce:75:45: + 66:07:f4:6d:2d:d8:7a:ca:e9:89:8a:f2:23:d8:2f:cb:6e:00: + 36:4f:fb:f0:2f:01:cc:0f:c0:22:65:f4:ab:e2:4e:61:2d:03: + 82:7d:91:16:b5:30:d5:14:de:5e:c7:90:fc:a1:fc:ab:10:af: + 5c:6b:70:a7:07:ef:29:86:e8:b2:25:c7:20:ff:26:dd:77:ef: + 79:44:14:c4:bd:dd:3b:c5:03:9b:77:23:ec:a0:ec:bb:5a:39: + b5:cc:ad:06 +MD5 Fingerprint=35:48:95:36:4A:54:5A:72:96:8E:E0:64:CC:EF:2C:8C +-----BEGIN CERTIFICATE----- +MIIDgDCCAmigAwIBAgICAx4wDQYJKoZIhvcNAQEFBQAwYTELMAkGA1UEBhMCVVMx +DTALBgNVBAoTBFZJU0ExLzAtBgNVBAsTJlZpc2EgSW50ZXJuYXRpb25hbCBTZXJ2 +aWNlIEFzc29jaWF0aW9uMRIwEAYDVQQDEwlHUCBSb290IDIwHhcNMDAwODE2MjI1 +MTAwWhcNMjAwODE1MjM1OTAwWjBhMQswCQYDVQQGEwJVUzENMAsGA1UEChMEVklT +QTEvMC0GA1UECxMmVmlzYSBJbnRlcm5hdGlvbmFsIFNlcnZpY2UgQXNzb2NpYXRp +b24xEjAQBgNVBAMTCUdQIFJvb3QgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC +AQoCggEBAKkBcLWqxEDwq2omYXkZAPy/mzdZDK9vZBv42pWUJGkzEXDK41Z0ohdX +ZFwgBuHW73G3O/erwWnQSaSxBNf0V2KJXLB1LRckaeNCYOTudNargFbYiCjh+20i +/SN8RnNPflRzHqgsVVh1t0zzWkWlAhr62p3DRcMiXvOL8WAp0sdftAw6UYPvMPjU +58fy+pmjIlC++QU3o63tmsPm7IgbthknGziLgE3sucfFicv8GjLtI/C1AVj59o/g +halMCXI5Etuz9c9OYmTaxhkVOmMd6RdVoUwiPDQyRvhlV7or7zaMavrZ2UT0qt2E +1w0cslSsMoW0ZA3eQbuxNMYBhjJk1Z8CAwEAAaNCMEAwHQYDVR0OBBYEFJ59SzS/ +ca3CBfYDdYDOqU8axCRMMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEG +MA0GCSqGSIb3DQEBBQUAA4IBAQAhpXYUVfmtJ3CPPPTVbMjMCqujmAuKBiPFyWHb +mQdpNSYx/scuhMKZYdQN6X0uEyt8joW2hcdLzzW2LEc9zikv2G+fiRxkk78IvXbQ +kIqUs38oW26sTTMs7WXcFsziza6kPWKSBpUmv9+55CCmc2rBvveURNZNbyoLaxhN +dBA2aGpawWqn3TYpjLgwi08hPwAuVDAHOrqK5MOeyti12HvOdUVmB/RtLdh6yumJ +ivIj2C/LbgA2T/vwLwHMD8AiZfSr4k5hLQOCfZEWtTDVFN5ex5D8ofyrEK9ca3Cn +B+8phuiyJccg/ybdd+95RBTEvd07xQObdyPsoOy7Wjm1zK0G +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 961510791 (0x394f7d87) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=WW, O=beTRUSTed, CN=beTRUSTed Root CAs, CN=beTRUSTed Root CA + Validity + Not Before: Jun 20 14:21:04 2000 GMT + Not After : Jun 20 13:21:04 2010 GMT + Subject: C=WW, O=beTRUSTed, CN=beTRUSTed Root CAs, CN=beTRUSTed Root CA + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:d4:b4:73:7a:13:0a:38:55:01:be:89:56:e1:94: + 9e:d4:be:5a:eb:4a:34:75:1b:61:29:c4:e1:ad:08: + 60:21:78:48:ff:b4:d0:fa:5e:41:8d:61:44:87:e8: + ed:c9:58:fa:fc:93:9a:df:4f:ea:3e:35:7d:f8:33: + 7a:e6:f1:d7:cd:6f:49:4b:3d:4f:2d:6e:0e:83:3a: + 18:78:77:a3:cf:e7:f4:4d:73:d8:9a:3b:1a:1d:be: + 95:53:cf:20:97:c2:cf:3e:24:52:6c:0c:8e:65:59: + c5:71:ff:62:09:8f:aa:c5:8f:cc:60:a0:73:4a:d7: + 38:3f:15:72:bf:a2:97:b7:70:e8:af:e2:7e:16:06: + 4c:f5:aa:64:26:72:07:25:ad:35:fc:18:b1:26:d7: + d8:ff:19:0e:83:1b:8c:dc:78:45:67:34:3d:f4:af: + 1c:8d:e4:6d:6b:ed:20:b3:67:9a:b4:61:cb:17:6f: + 89:35:ff:e7:4e:c0:32:12:e7:ee:ec:df:ff:97:30: + 74:ed:8d:47:8e:eb:b4:c3:44:e6:a7:4c:7f:56:43: + e8:b8:bc:b6:be:fa:83:97:e6:bb:fb:c4:b6:93:be: + 19:18:3e:8c:81:b9:73:88:16:f4:96:43:9c:67:73: + 17:90:d8:09:6e:63:ac:4a:b6:23:c4:01:a1:ad:a4: + e4:c5 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Certificate Policies: + Policy: 1.3.6.1.4.1.6334.1.0.0 + User Notice: + Explicit Text: Reliance on this certificate by any party assumes acceptance of the then applicable standard terms and conditions of use, and certification practice statement, which can be found at beTRUSTed's web site, https://www.beTRUSTed.com/vault/terms + CPS: https://www.beTRUSTed.com/vault/terms + + X509v3 CRL Distribution Points: + DirName:/O=beTRUSTed/C=WW + + X509v3 Subject Key Identifier: + 2A:B9:9B:69:2E:3B:9B:D8:CD:DE:2A:31:04:34:6B:CA:07:18:AB:67 + X509v3 Authority Key Identifier: + keyid:2A:B9:9B:69:2E:3B:9B:D8:CD:DE:2A:31:04:34:6B:CA:07:18:AB:67 + + X509v3 Key Usage: critical + Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign + Signature Algorithm: sha1WithRSAEncryption + 79:61:db:a3:5e:6e:16:b1:ea:76:51:f9:cb:15:9b:cb:69:be: + e6:81:6b:9f:28:1f:65:3e:dd:11:85:92:d4:e8:41:bf:7e:33: + bd:23:e7:f1:20:bf:a4:b4:a6:19:01:c6:8c:8d:35:7c:65:a4: + 4f:09:a4:d6:d8:23:15:05:13:a7:43:79:af:db:a3:0e:9b:7b: + 78:1a:f3:04:86:5a:c6:f6:8c:20:47:38:49:50:06:9d:72:67: + 3a:f0:98:03:ad:96:67:44:fc:3f:10:0d:86:4d:e4:00:3b:29: + 7b:ce:3b:3b:99:86:61:25:40:84:dc:13:62:b7:fa:ca:59:d6: + 03:1e:d6:53:01:cd:6d:4c:68:55:40:e1:ee:6b:c7:2a:00:00: + 48:82:b3:0a:01:c3:60:2a:0c:f7:82:35:ee:48:86:96:e4:74: + d4:3d:ea:01:71:ba:04:75:40:a7:a9:7f:39:39:9a:55:97:29: + 65:ae:19:55:25:05:72:47:d3:e8:18:dc:b8:e9:af:43:73:01: + 12:74:a3:e1:5c:5f:15:5d:24:f3:f9:e4:f4:b6:67:67:12:e7: + 64:22:8a:f6:a5:41:a6:1c:b6:60:63:45:8a:10:b4:ba:46:10: + ae:41:57:65:6c:3f:23:10:3f:21:10:59:b7:e4:40:dd:26:0c: + 23:f6:aa:ae +MD5 Fingerprint=85:CA:76:5A:1B:D1:68:22:DC:A2:23:12:CA:C6:80:34 +-----BEGIN CERTIFICATE----- +MIIFLDCCBBSgAwIBAgIEOU99hzANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJX +VzESMBAGA1UEChMJYmVUUlVTVGVkMRswGQYDVQQDExJiZVRSVVNUZWQgUm9vdCBD +QXMxGjAYBgNVBAMTEWJlVFJVU1RlZCBSb290IENBMB4XDTAwMDYyMDE0MjEwNFoX +DTEwMDYyMDEzMjEwNFowWjELMAkGA1UEBhMCV1cxEjAQBgNVBAoTCWJlVFJVU1Rl +ZDEbMBkGA1UEAxMSYmVUUlVTVGVkIFJvb3QgQ0FzMRowGAYDVQQDExFiZVRSVVNU +ZWQgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANS0c3oT +CjhVAb6JVuGUntS+WutKNHUbYSnE4a0IYCF4SP+00PpeQY1hRIfo7clY+vyTmt9P +6j41ffgzeubx181vSUs9Ty1uDoM6GHh3o8/n9E1z2Jo7Gh2+lVPPIJfCzz4kUmwM +jmVZxXH/YgmPqsWPzGCgc0rXOD8Vcr+il7dw6K/ifhYGTPWqZCZyByWtNfwYsSbX +2P8ZDoMbjNx4RWc0PfSvHI3kbWvtILNnmrRhyxdviTX/507AMhLn7uzf/5cwdO2N +R47rtMNE5qdMf1ZD6Li8tr76g5fmu/vEtpO+GRg+jIG5c4gW9JZDnGdzF5DYCW5j +rEq2I8QBoa2k5MUCAwEAAaOCAfgwggH0MA8GA1UdEwEB/wQFMAMBAf8wggFZBgNV +HSAEggFQMIIBTDCCAUgGCisGAQQBsT4BAAAwggE4MIIBAQYIKwYBBQUHAgIwgfQa +gfFSZWxpYW5jZSBvbiB0aGlzIGNlcnRpZmljYXRlIGJ5IGFueSBwYXJ0eSBhc3N1 +bWVzIGFjY2VwdGFuY2Ugb2YgdGhlIHRoZW4gYXBwbGljYWJsZSBzdGFuZGFyZCB0 +ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB1c2UsIGFuZCBjZXJ0aWZpY2F0aW9uIHBy +YWN0aWNlIHN0YXRlbWVudCwgd2hpY2ggY2FuIGJlIGZvdW5kIGF0IGJlVFJVU1Rl +ZCdzIHdlYiBzaXRlLCBodHRwczovL3d3dy5iZVRSVVNUZWQuY29tL3ZhdWx0L3Rl +cm1zMDEGCCsGAQUFBwIBFiVodHRwczovL3d3dy5iZVRSVVNUZWQuY29tL3ZhdWx0 +L3Rlcm1zMDQGA1UdHwQtMCswKaAnoCWkIzAhMRIwEAYDVQQKEwliZVRSVVNUZWQx +CzAJBgNVBAYTAldXMB0GA1UdDgQWBBQquZtpLjub2M3eKjEENGvKBxirZzAfBgNV +HSMEGDAWgBQquZtpLjub2M3eKjEENGvKBxirZzAOBgNVHQ8BAf8EBAMCAf4wDQYJ +KoZIhvcNAQEFBQADggEBAHlh26Nebhax6nZR+csVm8tpvuaBa58oH2U+3RGFktTo +Qb9+M70j5/Egv6S0phkBxoyNNXxlpE8JpNbYIxUFE6dDea/bow6be3ga8wSGWsb2 +jCBHOElQBp1yZzrwmAOtlmdE/D8QDYZN5AA7KXvOOzuZhmElQITcE2K3+spZ1gMe +1lMBzW1MaFVA4e5rxyoAAEiCswoBw2AqDPeCNe5IhpbkdNQ96gFxugR1QKepfzk5 +mlWXKWWuGVUlBXJH0+gY3Ljpr0NzARJ0o+FcXxVdJPP55PS2Z2cS52QiivalQaYc +tmBjRYoQtLpGEK5BV2VsPyMQPyEQWbfkQN0mDCP2qq4= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root + Validity + Not Before: May 30 10:38:31 2000 GMT + Not After : May 30 10:38:31 2020 GMT + Subject: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:96:96:d4:21:49:60:e2:6b:e8:41:07:0c:de:c4: + e0:dc:13:23:cd:c1:35:c7:fb:d6:4e:11:0a:67:5e: + f5:06:5b:6b:a5:08:3b:5b:29:16:3a:e7:87:b2:34: + 06:c5:bc:05:a5:03:7c:82:cb:29:10:ae:e1:88:81: + bd:d6:9e:d3:fe:2d:56:c1:15:ce:e3:26:9d:15:2e: + 10:fb:06:8f:30:04:de:a7:b4:63:b4:ff:b1:9c:ae: + 3c:af:77:b6:56:c5:b5:ab:a2:e9:69:3a:3d:0e:33: + 79:32:3f:70:82:92:99:61:6d:8d:30:08:8f:71:3f: + a6:48:57:19:f8:25:dc:4b:66:5c:a5:74:8f:98:ae: + c8:f9:c0:06:22:e7:ac:73:df:a5:2e:fb:52:dc:b1: + 15:65:20:fa:35:66:69:de:df:2c:f1:6e:bc:30:db: + 2c:24:12:db:eb:35:35:68:90:cb:00:b0:97:21:3d: + 74:21:23:65:34:2b:bb:78:59:a3:d6:e1:76:39:9a: + a4:49:8e:8c:74:af:6e:a4:9a:a3:d9:9b:d2:38:5c: + 9b:a2:18:cc:75:23:84:be:eb:e2:4d:33:71:8e:1a: + f0:c2:f8:c7:1d:a2:ad:03:97:2c:f8:cf:25:c6:f6: + b8:24:31:b1:63:5d:92:7f:63:f0:25:c9:53:2e:1f: + bf:4d + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + 95:B1:B4:F0:94:B6:BD:C7:DA:D1:11:09:21:BE:C1:AF:49:FD:10:7B + X509v3 Key Usage: + Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Authority Key Identifier: + keyid:95:B1:B4:F0:94:B6:BD:C7:DA:D1:11:09:21:BE:C1:AF:49:FD:10:7B + DirName:/C=SE/O=AddTrust AB/OU=AddTrust TTP Network/CN=AddTrust Class 1 CA Root + serial:01 + + Signature Algorithm: sha1WithRSAEncryption + 2c:6d:64:1b:1f:cd:0d:dd:b9:01:fa:96:63:34:32:48:47:99: + ae:97:ed:fd:72:16:a6:73:47:5a:f4:eb:dd:e9:f5:d6:fb:45: + cc:29:89:44:5d:bf:46:39:3d:e8:ee:bc:4d:54:86:1e:1d:6c: + e3:17:27:43:e1:89:56:2b:a9:6f:72:4e:49:33:e3:72:7c:2a: + 23:9a:bc:3e:ff:28:2a:ed:a3:ff:1c:23:ba:43:57:09:67:4d: + 4b:62:06:2d:f8:ff:6c:9d:60:1e:d8:1c:4b:7d:b5:31:2f:d9: + d0:7c:5d:f8:de:6b:83:18:78:37:57:2f:e8:33:07:67:df:1e: + c7:6b:2a:95:76:ae:8f:57:a3:f0:f4:52:b4:a9:53:08:cf:e0: + 4f:d3:7a:53:8b:fd:bb:1c:56:36:f2:fe:b2:b6:e5:76:bb:d5: + 22:65:a7:3f:fe:d1:66:ad:0b:bc:6b:99:86:ef:3f:7d:f3:18: + 32:ca:7b:c6:e3:ab:64:46:95:f8:26:69:d9:55:83:7b:2c:96: + 07:ff:59:2c:44:a3:c6:e5:e9:a9:dc:a1:63:80:5a:21:5e:21: + cf:53:54:f0:ba:6f:89:db:a8:aa:95:cf:8b:e3:71:cc:1e:1b: + 20:44:08:c0:7a:b6:40:fd:c4:e4:35:e1:1d:16:1c:d0:bc:2b: + 8e:d6:71:d9 +MD5 Fingerprint=1E:42:95:02:33:92:6B:B9:5F:C0:7F:DA:D6:B2:4B:FC +-----BEGIN CERTIFICATE----- +MIIEGDCCAwCgAwIBAgIBATANBgkqhkiG9w0BAQUFADBlMQswCQYDVQQGEwJTRTEU +MBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFkZFRydXN0IFRUUCBOZXR3 +b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENBIFJvb3QwHhcNMDAwNTMw +MTAzODMxWhcNMjAwNTMwMTAzODMxWjBlMQswCQYDVQQGEwJTRTEUMBIGA1UEChML +QWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFkZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYD +VQQDExhBZGRUcnVzdCBDbGFzcyAxIENBIFJvb3QwggEiMA0GCSqGSIb3DQEBAQUA +A4IBDwAwggEKAoIBAQCWltQhSWDia+hBBwzexODcEyPNwTXH+9ZOEQpnXvUGW2ul +CDtbKRY654eyNAbFvAWlA3yCyykQruGIgb3WntP+LVbBFc7jJp0VLhD7Bo8wBN6n +tGO0/7Gcrjyvd7ZWxbWroulpOj0OM3kyP3CCkplhbY0wCI9xP6ZIVxn4JdxLZlyl +dI+Yrsj5wAYi56xz36Uu+1LcsRVlIPo1Zmne3yzxbrww2ywkEtvrNTVokMsAsJch +PXQhI2U0K7t4WaPW4XY5mqRJjox0r26kmqPZm9I4XJuiGMx1I4S+6+JNM3GOGvDC ++Mcdoq0Dlyz4zyXG9rgkMbFjXZJ/Y/AlyVMuH79NAgMBAAGjgdIwgc8wHQYDVR0O +BBYEFJWxtPCUtr3H2tERCSG+wa9J/RB7MAsGA1UdDwQEAwIBBjAPBgNVHRMBAf8E +BTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl +MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk +ZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB +IFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0MkhHma6X +7f1yFqZzR1r0693p9db7RcwpiURdv0Y5PejuvE1Uhh4dbOMXJ0PhiVYrqW9yTkkz +43J8KiOavD7/KCrto/8cI7pDVwlnTUtiBi34/2ydYB7YHEt9tTEv2dB8Xfjea4MY +eDdXL+gzB2ffHsdrKpV2ro9Xo/D0UrSpUwjP4E/TelOL/bscVjby/rK25Xa71SJl +pz/+0WatC7xrmYbvP33zGDLKe8bjq2RGlfgmadlVg3sslgf/WSxEo8bl6ancoWOA +WiFeIc9TVPC6b4nbqKqVz4vjccweGyBECMB6tkD9xOQ14R0WHNC8K47Wcdk= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root + Validity + Not Before: May 30 10:48:38 2000 GMT + Not After : May 30 10:48:38 2020 GMT + Subject: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:b7:f7:1a:33:e6:f2:00:04:2d:39:e0:4e:5b:ed: + 1f:bc:6c:0f:cd:b5:fa:23:b6:ce:de:9b:11:33:97: + a4:29:4c:7d:93:9f:bd:4a:bc:93:ed:03:1a:e3:8f: + cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db: + 2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70: + 56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6: + 5f:0f:78:9d:9a:40:3c:0e:ac:61:aa:5e:14:8f:9e: + 87:a1:6a:50:dc:d7:9a:4e:af:05:b3:a6:71:94:9c: + 71:b3:50:60:0a:c7:13:9d:38:07:86:02:a8:e9:a8: + 69:26:18:90:ab:4c:b0:4f:23:ab:3a:4f:84:d8:df: + ce:9f:e1:69:6f:bb:d7:42:d7:6b:44:e4:c7:ad:ee: + 6d:41:5f:72:5a:71:08:37:b3:79:65:a4:59:a0:94: + 37:f7:00:2f:0d:c2:92:72:da:d0:38:72:db:14:a8: + 45:c4:5d:2a:7d:b7:b4:d6:c4:ee:ac:cd:13:44:b7: + c9:2b:dd:43:00:25:fa:61:b9:69:6a:58:23:11:b7: + a7:33:8f:56:75:59:f5:cd:29:d7:46:b7:0a:2b:65: + b6:d3:42:6f:15:b2:b8:7b:fb:ef:e9:5d:53:d5:34: + 5a:27 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A + X509v3 Key Usage: + Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Authority Key Identifier: + keyid:AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A + DirName:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root + serial:01 + + Signature Algorithm: sha1WithRSAEncryption + b0:9b:e0:85:25:c2:d6:23:e2:0f:96:06:92:9d:41:98:9c:d9: + 84:79:81:d9:1e:5b:14:07:23:36:65:8f:b0:d8:77:bb:ac:41: + 6c:47:60:83:51:b0:f9:32:3d:e7:fc:f6:26:13:c7:80:16:a5: + bf:5a:fc:87:cf:78:79:89:21:9a:e2:4c:07:0a:86:35:bc:f2: + de:51:c4:d2:96:b7:dc:7e:4e:ee:70:fd:1c:39:eb:0c:02:51: + 14:2d:8e:bd:16:e0:c1:df:46:75:e7:24:ad:ec:f4:42:b4:85: + 93:70:10:67:ba:9d:06:35:4a:18:d3:2b:7a:cc:51:42:a1:7a: + 63:d1:e6:bb:a1:c5:2b:c2:36:be:13:0d:e6:bd:63:7e:79:7b: + a7:09:0d:40:ab:6a:dd:8f:8a:c3:f6:f6:8c:1a:42:05:51:d4: + 45:f5:9f:a7:62:21:68:15:20:43:3c:99:e7:7c:bd:24:d8:a9: + 91:17:73:88:3f:56:1b:31:38:18:b4:71:0f:9a:cd:c8:0e:9e: + 8e:2e:1b:e1:8c:98:83:cb:1f:31:f1:44:4c:c6:04:73:49:76: + 60:0f:c7:f8:bd:17:80:6b:2e:e9:cc:4c:0e:5a:9a:79:0f:20: + 0a:2e:d5:9e:63:26:1e:55:92:94:d8:82:17:5a:7b:d0:bc:c7: + 8f:4e:86:04 +MD5 Fingerprint=1D:35:54:04:85:78:B0:3F:42:42:4D:BF:20:73:0A:3F +-----BEGIN CERTIFICATE----- +MIIENjCCAx6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJTRTEU +MBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFs +IFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290 +MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFowbzELMAkGA1UEBhMCU0Ux +FDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h +bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9v +dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALf3GjPm8gAELTngTlvt +H7xsD821+iO2zt6bETOXpClMfZOfvUq8k+0DGuOPz+VtUFrWlymUWoCwSXrbLpX9 +uMq/NzgtHj6RQa1wVsfwTz/oMp50ysiQVOnGXw94nZpAPA6sYapeFI+eh6FqUNzX +mk6vBbOmcZSccbNQYArHE504B4YCqOmoaSYYkKtMsE8jqzpPhNjfzp/haW+710LX +a0Tkx63ubUFfclpxCDezeWWkWaCUN/cALw3CknLa0Dhy2xSoRcRdKn23tNbE7qzN +E0S3ySvdQwAl+mG5aWpYIxG3pzOPVnVZ9c0p10a3CitlttNCbxWyuHv77+ldU9U0 +WicCAwEAAaOB3DCB2TAdBgNVHQ4EFgQUrb2YejS0Jvf6xCZU7wO94CTLVBowCwYD +VR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wgZkGA1UdIwSBkTCBjoAUrb2YejS0 +Jvf6xCZU7wO94CTLVBqhc6RxMG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRU +cnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsx +IjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3SCAQEwDQYJKoZIhvcN +AQEFBQADggEBALCb4IUlwtYj4g+WBpKdQZic2YR5gdkeWxQHIzZlj7DYd7usQWxH +YINRsPkyPef89iYTx4AWpb9a/IfPeHmJIZriTAcKhjW88t5RxNKWt9x+Tu5w/Rw5 +6wwCURQtjr0W4MHfRnXnJK3s9EK0hZNwEGe6nQY1ShjTK3rMUUKhemPR5ruhxSvC +Nr4TDea9Y355e6cJDUCrat2PisP29owaQgVR1EX1n6diIWgVIEM8med8vSTYqZEX +c4g/VhsxOBi0cQ+azcgOno4uG+GMmIPLHzHxREzGBHNJdmAPx/i9F4BrLunMTA5a +mnkPIAou1Z5jJh5VkpTYghdae9C8x49OhgQ= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Public CA Root + Validity + Not Before: May 30 10:41:50 2000 GMT + Not After : May 30 10:41:50 2020 GMT + Subject: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Public CA Root + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:e9:1a:30:8f:83:88:14:c1:20:d8:3c:9b:8f:1b: + 7e:03:74:bb:da:69:d3:46:a5:f8:8e:c2:0c:11:90: + 51:a5:2f:66:54:40:55:ea:db:1f:4a:56:ee:9f:23: + 6e:f4:39:cb:a1:b9:6f:f2:7e:f9:5d:87:26:61:9e: + 1c:f8:e2:ec:a6:81:f8:21:c5:24:cc:11:0c:3f:db: + 26:72:7a:c7:01:97:07:17:f9:d7:18:2c:30:7d:0e: + 7a:1e:62:1e:c6:4b:c0:fd:7d:62:77:d3:44:1e:27: + f6:3f:4b:44:b3:b7:38:d9:39:1f:60:d5:51:92:73: + 03:b4:00:69:e3:f3:14:4e:ee:d1:dc:09:cf:77:34: + 46:50:b0:f8:11:f2:fe:38:79:f7:07:39:fe:51:92: + 97:0b:5b:08:5f:34:86:01:ad:88:97:eb:66:cd:5e: + d1:ff:dc:7d:f2:84:da:ba:77:ad:dc:80:08:c7:a7: + 87:d6:55:9f:97:6a:e8:c8:11:64:ba:e7:19:29:3f: + 11:b3:78:90:84:20:52:5b:11:ef:78:d0:83:f6:d5: + 48:90:d0:30:1c:cf:80:f9:60:fe:79:e4:88:f2:dd: + 00:eb:94:45:eb:65:94:69:40:ba:c0:d5:b4:b8:ba: + 7d:04:11:a8:eb:31:05:96:94:4e:58:21:8e:9f:d0: + 60:fd + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + 81:3E:37:D8:92:B0:1F:77:9F:5C:B4:AB:73:AA:E7:F6:34:60:2F:FA + X509v3 Key Usage: + Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Authority Key Identifier: + keyid:81:3E:37:D8:92:B0:1F:77:9F:5C:B4:AB:73:AA:E7:F6:34:60:2F:FA + DirName:/C=SE/O=AddTrust AB/OU=AddTrust TTP Network/CN=AddTrust Public CA Root + serial:01 + + Signature Algorithm: sha1WithRSAEncryption + 03:f7:15:4a:f8:24:da:23:56:16:93:76:dd:36:28:b9:ae:1b: + b8:c3:f1:64:ba:20:18:78:95:29:27:57:05:bc:7c:2a:f4:b9: + 51:55:da:87:02:de:0f:16:17:31:f8:aa:79:2e:09:13:bb:af: + b2:20:19:12:e5:93:f9:4b:f9:83:e8:44:d5:b2:41:25:bf:88: + 75:6f:ff:10:fc:4a:54:d0:5f:f0:fa:ef:36:73:7d:1b:36:45: + c6:21:6d:b4:15:b8:4e:cf:9c:5c:a5:3d:5a:00:8e:06:e3:3c: + 6b:32:7b:f2:9f:f0:b6:fd:df:f0:28:18:48:f0:c6:bc:d0:bf: + 34:80:96:c2:4a:b1:6d:8e:c7:90:45:de:2f:67:ac:45:04:a3: + 7a:dc:55:92:c9:47:66:d8:1a:8c:c7:ed:9c:4e:9a:e0:12:bb: + b5:6a:4c:84:e1:e1:22:0d:87:00:64:fe:8c:7d:62:39:65:a6: + ef:42:b6:80:25:12:61:01:a8:24:13:70:00:11:26:5f:fa:35: + 50:c5:48:cc:06:47:e8:27:d8:70:8d:5f:64:e6:a1:44:26:5e: + 22:ec:92:cd:ff:42:9a:44:21:6d:5c:c5:e3:22:1d:5f:47:12: + e7:ce:5f:5d:fa:d8:aa:b1:33:2d:d9:76:f2:4e:3a:33:0c:2b: + b3:2d:90:06 +MD5 Fingerprint=C1:62:3E:23:C5:82:73:9C:03:59:4B:2B:E9:77:49:7F +-----BEGIN CERTIFICATE----- +MIIEFTCCAv2gAwIBAgIBATANBgkqhkiG9w0BAQUFADBkMQswCQYDVQQGEwJTRTEU +MBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFkZFRydXN0IFRUUCBOZXR3 +b3JrMSAwHgYDVQQDExdBZGRUcnVzdCBQdWJsaWMgQ0EgUm9vdDAeFw0wMDA1MzAx +MDQxNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB +ZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV +BAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC +AQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV +6tsfSlbunyNu9DnLoblv8n75XYcmYZ4c+OLspoH4IcUkzBEMP9smcnrHAZcHF/nX +GCwwfQ56HmIexkvA/X1id9NEHif2P0tEs7c42TkfYNVRknMDtABp4/MUTu7R3AnP +dzRGULD4EfL+OHn3Bzn+UZKXC1sIXzSGAa2Il+tmzV7R/9x98oTaunet3IAIx6eH +1lWfl2royBFkuucZKT8Rs3iQhCBSWxHveNCD9tVIkNAwHM+A+WD+eeSI8t0A65RF +62WUaUC6wNW0uLp9BBGo6zEFlpROWCGOn9Bg/QIDAQABo4HRMIHOMB0GA1UdDgQW +BBSBPjfYkrAfd59ctKtzquf2NGAv+jALBgNVHQ8EBAMCAQYwDwYDVR0TAQH/BAUw +AwEB/zCBjgYDVR0jBIGGMIGDgBSBPjfYkrAfd59ctKtzquf2NGAv+qFopGYwZDEL +MAkGA1UEBhMCU0UxFDASBgNVBAoTC0FkZFRydXN0IEFCMR0wGwYDVQQLExRBZGRU +cnVzdCBUVFAgTmV0d29yazEgMB4GA1UEAxMXQWRkVHJ1c3QgUHVibGljIENBIFJv +b3SCAQEwDQYJKoZIhvcNAQEFBQADggEBAAP3FUr4JNojVhaTdt02KLmuG7jD8WS6 +IBh4lSknVwW8fCr0uVFV2ocC3g8WFzH4qnkuCRO7r7IgGRLlk/lL+YPoRNWyQSW/ +iHVv/xD8SlTQX/D67zZzfRs2RcYhbbQVuE7PnFylPVoAjgbjPGsye/Kf8Lb93/Ao +GEjwxrzQvzSAlsJKsW2Ox5BF3i9nrEUEo3rcVZLJR2bYGozH7ZxOmuASu7VqTITh +4SINhwBk/ox9Yjllpu9CtoAlEmEBqCQTcAARJl/6NVDFSMwGR+gn2HCNX2TmoUQm +XiLsks3/QppEIW1cxeMiHV9HEufOX1362KqxMy3ZdvJOOjMMK7MtkAY= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Qualified CA Root + Validity + Not Before: May 30 10:44:50 2000 GMT + Not After : May 30 10:44:50 2020 GMT + Subject: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Qualified CA Root + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:e4:1e:9a:fe:dc:09:5a:87:a4:9f:47:be:11:5f: + af:84:34:db:62:3c:79:78:b7:e9:30:b5:ec:0c:1c: + 2a:c4:16:ff:e0:ec:71:eb:8a:f5:11:6e:ed:4f:0d: + 91:d2:12:18:2d:49:15:01:c2:a4:22:13:c7:11:64: + ff:22:12:9a:b9:8e:5c:2f:08:cf:71:6a:b3:67:01: + 59:f1:5d:46:f3:b0:78:a5:f6:0e:42:7a:e3:7f:1b: + cc:d0:f0:b7:28:fd:2a:ea:9e:b3:b0:b9:04:aa:fd: + f6:c7:b4:b1:b8:2a:a0:fb:58:f1:19:a0:6f:70:25: + 7e:3e:69:4a:7f:0f:22:d8:ef:ad:08:11:9a:29:99: + e1:aa:44:45:9a:12:5e:3e:9d:6d:52:fc:e7:a0:3d: + 68:2f:f0:4b:70:7c:13:38:ad:bc:15:25:f1:d6:ce: + ab:a2:c0:31:d6:2f:9f:e0:ff:14:59:fc:84:93:d9: + 87:7c:4c:54:13:eb:9f:d1:2d:11:f8:18:3a:3a:de: + 25:d9:f7:d3:40:ed:a4:06:12:c4:3b:e1:91:c1:56: + 35:f0:14:dc:65:36:09:6e:ab:a4:07:c7:35:d1:c2: + 03:33:36:5b:75:26:6d:42:f1:12:6b:43:6f:4b:71: + 94:fa:34:1d:ed:13:6e:ca:80:7f:98:2f:6c:b9:65: + d8:e9 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + 39:95:8B:62:8B:5C:C9:D4:80:BA:58:0F:97:3F:15:08:43:CC:98:A7 + X509v3 Key Usage: + Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Authority Key Identifier: + keyid:39:95:8B:62:8B:5C:C9:D4:80:BA:58:0F:97:3F:15:08:43:CC:98:A7 + DirName:/C=SE/O=AddTrust AB/OU=AddTrust TTP Network/CN=AddTrust Qualified CA Root + serial:01 + + Signature Algorithm: sha1WithRSAEncryption + 19:ab:75:ea:f8:8b:65:61:95:13:ba:69:04:ef:86:ca:13:a0: + c7:aa:4f:64:1b:3f:18:f6:a8:2d:2c:55:8f:05:b7:30:ea:42: + 6a:1d:c0:25:51:2d:a7:bf:0c:b3:ed:ef:08:7f:6c:3c:46:1a: + ea:18:43:df:76:cc:f9:66:86:9c:2c:68:f5:e9:17:f8:31:b3: + 18:c4:d6:48:7d:23:4c:68:c1:7e:bb:01:14:6f:c5:d9:6e:de: + bb:04:42:6a:f8:f6:5c:7d:e5:da:fa:87:eb:0d:35:52:67:d0: + 9e:97:76:05:93:3f:95:c7:01:e6:69:55:38:7f:10:61:99:c9: + e3:5f:a6:ca:3e:82:63:48:aa:e2:08:48:3e:aa:f2:b2:85:62: + a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07: + d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee: + c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6: + 72:5a:77:d2:63:cd:cf:58:89:00:42:63:3f:79:39:d0:44:b0: + 82:6e:41:19:e8:dd:e0:c1:88:5a:d1:1e:71:93:1f:24:30:74: + e5:1e:a8:de:3c:27:37:7f:83:ae:9e:77:cf:f0:30:b1:ff:4b: + 99:e8:c6:a1 +MD5 Fingerprint=27:EC:39:47:CD:DA:5A:AF:E2:9A:01:65:21:A9:4C:BB +-----BEGIN CERTIFICATE----- +MIIEHjCCAwagAwIBAgIBATANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJTRTEU +MBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFkZFRydXN0IFRUUCBOZXR3 +b3JrMSMwIQYDVQQDExpBZGRUcnVzdCBRdWFsaWZpZWQgQ0EgUm9vdDAeFw0wMDA1 +MzAxMDQ0NTBaFw0yMDA1MzAxMDQ0NTBaMGcxCzAJBgNVBAYTAlNFMRQwEgYDVQQK +EwtBZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIzAh +BgNVBAMTGkFkZFRydXN0IFF1YWxpZmllZCBDQSBSb290MIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEA5B6a/twJWoekn0e+EV+vhDTbYjx5eLfpMLXsDBwq +xBb/4Oxx64r1EW7tTw2R0hIYLUkVAcKkIhPHEWT/IhKauY5cLwjPcWqzZwFZ8V1G +87B4pfYOQnrjfxvM0PC3KP0q6p6zsLkEqv32x7SxuCqg+1jxGaBvcCV+PmlKfw8i +2O+tCBGaKZnhqkRFmhJePp1tUvznoD1oL/BLcHwTOK28FSXx1s6rosAx1i+f4P8U +WfyEk9mHfExUE+uf0S0R+Bg6Ot4l2ffTQO2kBhLEO+GRwVY18BTcZTYJbqukB8c1 +0cIDMzZbdSZtQvESa0NvS3GU+jQd7RNuyoB/mC9suWXY6QIDAQABo4HUMIHRMB0G +A1UdDgQWBBQ5lYtii1zJ1IC6WA+XPxUIQ8yYpzALBgNVHQ8EBAMCAQYwDwYDVR0T +AQH/BAUwAwEB/zCBkQYDVR0jBIGJMIGGgBQ5lYtii1zJ1IC6WA+XPxUIQ8yYp6Fr +pGkwZzELMAkGA1UEBhMCU0UxFDASBgNVBAoTC0FkZFRydXN0IEFCMR0wGwYDVQQL +ExRBZGRUcnVzdCBUVFAgTmV0d29yazEjMCEGA1UEAxMaQWRkVHJ1c3QgUXVhbGlm +aWVkIENBIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBABmrder4i2VhlRO6aQTv +hsoToMeqT2QbPxj2qC0sVY8FtzDqQmodwCVRLae/DLPt7wh/bDxGGuoYQ992zPlm +hpwsaPXpF/gxsxjE1kh9I0xowX67ARRvxdlu3rsEQmr49lx95dr6h+sNNVJn0J6X +dgWTP5XHAeZpVTh/EGGZyeNfpso+gmNIquIISD6q8rKFYqa0p9m9N5xotS1WfbC3 +P6CxB9bpT9zeRXEwMn8bLgn5v1Kh7sKAPgZcLlVAwRv1cEWw3F369nJad9Jjzc9Y +iQBCYz95OdBEsIJuQRno3eDBiFrRHnGTHyQwdOUeqN48Jzd/g66ed8/wMLH/S5no +xqE= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 2b:68:d4:a3:46:9e:c5:3b:28:09:ab:38:5d:7f:27:20 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=VeriSign, Inc., OU=Class 1 Public Primary Certification Authority + Validity + Not Before: Aug 4 00:00:00 2000 GMT + Not After : Aug 3 23:59:59 2004 GMT + Subject: O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/RPA (c)00, CN=Class 1 Public Primary OCSP Responder + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:b9:ed:5e:7a:3a:77:5f:ce:5f:3a:52:fc:cd:64: + f7:71:b5:6f:6a:96:c6:59:92:55:94:5d:2f:5b:2e: + c1:11:ea:26:8a:cb:a7:81:3c:f6:5a:44:de:7a:13: + 2f:fd:5a:51:d9:7b:37:26:4a:c0:27:3f:04:03:6a: + 56:c1:83:2c:e1:6f:5b:a9:54:50:24:4a:c6:2e:7a: + 4c:a1:5b:37:54:24:21:31:1f:a1:78:18:76:a7:b1: + 70:da:22:d0:6a:fe:07:62:40:c6:f7:f6:9b:7d:0c: + 06:b8:4b:c7:28:e4:66:23:84:51:ef:46:b7:93:d8: + 81:33:cb:e5:36:ac:c6:e8:05 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Alternative Name: + DirName:/CN=OCSP 1-1 + X509v3 CRL Distribution Points: + URI:http://crl.verisign.com/pca1.crl + + X509v3 Extended Key Usage: + OCSP Signing + Authority Information Access: + OCSP - URI:http://ocsp.verisign.com/ocsp/status + + X509v3 Certificate Policies: + Policy: 2.16.840.1.113733.1.7.1.1 + CPS: https://www.verisign.com/RPA + + X509v3 Basic Constraints: + CA:FALSE + X509v3 Key Usage: + Digital Signature + Signature Algorithm: sha1WithRSAEncryption + 70:90:dd:b8:e4:be:53:17:7c:7f:02:e9:d5:f7:8b:99:93:31: + 60:8d:7e:e6:60:6b:24:ef:60:ac:d2:ce:91:de:80:6d:09:a4: + d3:b8:38:e5:44:ca:72:5e:0d:2d:c1:77:9c:bd:2c:03:78:29: + 8d:a4:a5:77:87:f5:f1:2b:26:ad:cc:07:6c:3a:54:5a:28:e0: + 09:f3:4d:0a:04:ca:d4:58:69:0b:a7:b3:f5:dd:01:a5:e7:dc: + f0:1f:ba:c1:5d:90:8d:b3:ea:4f:c1:11:59:97:6a:b2:2b:13: + b1:da:ad:97:a1:b3:b1:a0:20:5b:ca:32:ab:8d:cf:13:f0:1f: + 29:c3 +MD5 Fingerprint=7E:6F:3A:53:1B:7C:BE:B0:30:DB:43:1E:1E:94:89:B2 +-----BEGIN CERTIFICATE----- +MIIDnjCCAwegAwIBAgIQK2jUo0aexTsoCas4XX8nIDANBgkqhkiG9w0BAQUFADBf +MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsT +LkNsYXNzIDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw +HhcNMDAwODA0MDAwMDAwWhcNMDQwODAzMjM1OTU5WjCBpzEXMBUGA1UEChMOVmVy +aVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5 +BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20v +UlBBIChjKTAwMS4wLAYDVQQDEyVDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IE9DU1Ag +UmVzcG9uZGVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC57V56Ondfzl86 +UvzNZPdxtW9qlsZZklWUXS9bLsER6iaKy6eBPPZaRN56Ey/9WlHZezcmSsAnPwQD +albBgyzhb1upVFAkSsYuekyhWzdUJCExH6F4GHansXDaItBq/gdiQMb39pt9DAa4 +S8co5GYjhFHvRreT2IEzy+U2rMboBQIDAQABo4IBEDCCAQwwIAYDVR0RBBkwF6QV +MBMxETAPBgNVBAMTCE9DU1AgMS0xMDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9j +cmwudmVyaXNpZ24uY29tL3BjYTEuY3JsMBMGA1UdJQQMMAoGCCsGAQUFBwMJMEIG +CCsGAQUFBwEBBDYwNDAyBggrBgEFBQcwAaYmFiRodHRwOi8vb2NzcC52ZXJpc2ln +bi5jb20vb2NzcC9zdGF0dXMwRAYDVR0gBD0wOzA5BgtghkgBhvhFAQcBATAqMCgG +CCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vUlBBMAkGA1UdEwQC +MAAwCwYDVR0PBAQDAgeAMA0GCSqGSIb3DQEBBQUAA4GBAHCQ3bjkvlMXfH8C6dX3 +i5mTMWCNfuZgayTvYKzSzpHegG0JpNO4OOVEynJeDS3Bd5y9LAN4KY2kpXeH9fEr +Jq3MB2w6VFoo4AnzTQoEytRYaQuns/XdAaXn3PAfusFdkI2z6k/BEVmXarIrE7Ha +rZehs7GgIFvKMquNzxPwHynD +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 09:46:17:e6:1d:d8:d4:1c:a0:0c:a0:62:e8:79:8a:a7 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=VeriSign, Inc., OU=Class 2 Public Primary Certification Authority + Validity + Not Before: Aug 1 00:00:00 2000 GMT + Not After : Jul 31 23:59:59 2004 GMT + Subject: O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/RPA (c)00, CN=Class 2 Public Primary OCSP Responder + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:d0:ca:63:31:61:7f:44:34:7c:05:7d:0b:3d:6a: + 90:cb:79:4b:77:0a:3f:4b:c7:23:e5:c0:62:2d:7e: + 9c:7e:3e:88:87:91:d0:ac:e8:4d:49:87:a2:96:90: + 8a:dd:04:a5:02:3f:8c:9b:e9:89:fe:62:a0:e2:5a: + bd:c8:dd:b4:78:e6:a5:42:93:08:67:01:c0:20:4d: + d7:5c:f4:5d:da:b3:e3:37:a6:52:1a:2c:4c:65:4d: + 8a:87:d9:a8:a3:f1:49:54:bb:3c:5c:80:51:68:c6: + fb:49:ff:0b:55:ab:15:dd:fb:9a:c1:b9:1d:74:0d: + b2:8c:44:5d:89:fc:9f:f9:83 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Alternative Name: + DirName:/CN=OCSP 1-2 + X509v3 CRL Distribution Points: + URI:http://crl.verisign.com/pca2.crl + + X509v3 Extended Key Usage: + OCSP Signing + Authority Information Access: + OCSP - URI:http://ocsp.verisign.com/ocsp/status + + X509v3 Certificate Policies: + Policy: 2.16.840.1.113733.1.7.1.1 + CPS: https://www.verisign.com/RPA + + X509v3 Basic Constraints: + CA:FALSE + X509v3 Key Usage: + Digital Signature + Signature Algorithm: sha1WithRSAEncryption + 1f:7d:09:6e:24:46:75:04:9c:f3:26:9b:e3:39:6e:17:ef:bc: + bd:a2:1b:d2:02:84:86:ab:d0:40:97:2c:c4:43:88:37:19:6b: + 22:a8:03:71:50:9d:20:dc:36:60:20:9a:73:2d:73:55:6c:58: + 9b:2c:c2:b4:34:2c:7a:33:42:ca:91:d9:e9:43:af:cf:1e:e0: + f5:c4:7a:ab:3f:72:63:1e:a9:37:e1:5b:3b:88:b3:13:86:82: + 90:57:cb:57:ff:f4:56:be:22:dd:e3:97:a8:e1:bc:22:43:c2: + dd:4d:db:f6:81:9e:92:14:9e:39:0f:13:54:de:82:d8:c0:5e: + 34:8d +MD5 Fingerprint=F3:45:BD:10:96:0D:85:4B:EF:9F:11:62:34:A7:5E:B5 +-----BEGIN CERTIFICATE----- +MIIDnjCCAwegAwIBAgIQCUYX5h3Y1BygDKBi6HmKpzANBgkqhkiG9w0BAQUFADBf +MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsT +LkNsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw +HhcNMDAwODAxMDAwMDAwWhcNMDQwNzMxMjM1OTU5WjCBpzEXMBUGA1UEChMOVmVy +aVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5 +BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20v +UlBBIChjKTAwMS4wLAYDVQQDEyVDbGFzcyAyIFB1YmxpYyBQcmltYXJ5IE9DU1Ag +UmVzcG9uZGVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQymMxYX9ENHwF +fQs9apDLeUt3Cj9LxyPlwGItfpx+PoiHkdCs6E1Jh6KWkIrdBKUCP4yb6Yn+YqDi +Wr3I3bR45qVCkwhnAcAgTddc9F3as+M3plIaLExlTYqH2aij8UlUuzxcgFFoxvtJ +/wtVqxXd+5rBuR10DbKMRF2J/J/5gwIDAQABo4IBEDCCAQwwIAYDVR0RBBkwF6QV +MBMxETAPBgNVBAMTCE9DU1AgMS0yMDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9j +cmwudmVyaXNpZ24uY29tL3BjYTIuY3JsMBMGA1UdJQQMMAoGCCsGAQUFBwMJMEIG +CCsGAQUFBwEBBDYwNDAyBggrBgEFBQcwAaYmFiRodHRwOi8vb2NzcC52ZXJpc2ln +bi5jb20vb2NzcC9zdGF0dXMwRAYDVR0gBD0wOzA5BgtghkgBhvhFAQcBATAqMCgG +CCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vUlBBMAkGA1UdEwQC +MAAwCwYDVR0PBAQDAgeAMA0GCSqGSIb3DQEBBQUAA4GBAB99CW4kRnUEnPMmm+M5 +bhfvvL2iG9IChIar0ECXLMRDiDcZayKoA3FQnSDcNmAgmnMtc1VsWJsswrQ0LHoz +QsqR2elDr88e4PXEeqs/cmMeqTfhWzuIsxOGgpBXy1f/9Fa+It3jl6jhvCJDwt1N +2/aBnpIUnjkPE1TegtjAXjSN +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 2e:96:9e:bf:b6:62:6c:ec:7b:e9:73:cc:e3:6c:c1:84 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority + Validity + Not Before: Aug 4 00:00:00 2000 GMT + Not After : Aug 3 23:59:59 2004 GMT + Subject: O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/RPA (c)00, CN=Class 3 Public Primary OCSP Responder + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:f1:e4:08:0e:83:bb:75:e3:48:e5:b8:db:a6:f0: + b9:ab:e9:3c:62:c7:5e:35:5b:d0:02:54:11:d8:c9: + d1:56:b9:76:4b:b9:ab:7a:e6:cd:ba:f6:0c:04:d6: + 7e:d6:b0:0a:65:ac:4e:39:e3:f1:f7:2d:a3:25:39: + ef:b0:8b:cf:be:db:0c:5d:6e:70:f4:07:cd:70:f7: + 3a:c0:3e:35:16:ed:78:8c:43:cf:c2:26:2e:47:d6: + 86:7d:9c:f1:be:d6:67:0c:22:25:a4:ca:65:e6:1f: + 7a:78:28:2f:3f:05:db:04:21:bf:e1:45:66:fe:3c: + b7:82:ed:5a:b8:16:15:b9:55 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Alternative Name: + DirName:/CN=OCSP 1-3 + X509v3 CRL Distribution Points: + URI:http://crl.verisign.com/pca3.1.1.crl + + X509v3 Extended Key Usage: + OCSP Signing + Authority Information Access: + OCSP - URI:http://ocsp.verisign.com/ocsp/status + + X509v3 Certificate Policies: + Policy: 2.16.840.1.113733.1.7.1.1 + CPS: https://www.verisign.com/RPA + + X509v3 Basic Constraints: + CA:FALSE + X509v3 Key Usage: + Digital Signature + Signature Algorithm: sha1WithRSAEncryption + 02:f6:53:63:c0:a9:1e:f2:d0:8b:33:30:8f:48:9b:4c:b0:56: + b4:83:71:4a:be:dc:50:d8:f5:b6:e0:0b:db:bd:78:4f:e9:cf: + 09:34:da:29:49:9d:01:73:5a:91:91:82:54:2c:13:0a:d3:77: + 23:cf:37:fc:63:de:a7:e3:f6:b7:b5:69:45:28:49:c3:91:dc: + aa:47:1c:a9:88:99:2c:05:2a:8d:8d:8a:fa:62:e2:5a:b7:00: + 20:5d:39:c4:28:c2:cb:fc:9e:a8:89:ae:5b:3d:8e:12:ea:32: + b2:fc:eb:14:d7:09:15:1a:c0:cd:1b:d5:b5:15:4e:41:d5:96: + e3:4e +MD5 Fingerprint=7D:51:92:C9:76:83:98:16:DE:8C:B3:86:C4:7D:66:FB +-----BEGIN CERTIFICATE----- +MIIDojCCAwugAwIBAgIQLpaev7ZibOx76XPM42zBhDANBgkqhkiG9w0BAQUFADBf +MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsT +LkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw +HhcNMDAwODA0MDAwMDAwWhcNMDQwODAzMjM1OTU5WjCBpzEXMBUGA1UEChMOVmVy +aVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5 +BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20v +UlBBIChjKTAwMS4wLAYDVQQDEyVDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IE9DU1Ag +UmVzcG9uZGVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDx5AgOg7t140jl +uNum8Lmr6Txix141W9ACVBHYydFWuXZLuat65s269gwE1n7WsAplrE454/H3LaMl +Oe+wi8++2wxdbnD0B81w9zrAPjUW7XiMQ8/CJi5H1oZ9nPG+1mcMIiWkymXmH3p4 +KC8/BdsEIb/hRWb+PLeC7Vq4FhW5VQIDAQABo4IBFDCCARAwIAYDVR0RBBkwF6QV +MBMxETAPBgNVBAMTCE9DU1AgMS0zMDUGA1UdHwQuMCwwKqAooCaGJGh0dHA6Ly9j +cmwudmVyaXNpZ24uY29tL3BjYTMuMS4xLmNybDATBgNVHSUEDDAKBggrBgEFBQcD +CTBCBggrBgEFBQcBAQQ2MDQwMgYIKwYBBQUHMAGmJhYkaHR0cDovL29jc3AudmVy +aXNpZ24uY29tL29jc3Avc3RhdHVzMEQGA1UdIAQ9MDswOQYLYIZIAYb4RQEHAQEw +KjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL1JQQTAJBgNV +HRMEAjAAMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQUFAAOBgQAC9lNjwKke8tCL +MzCPSJtMsFa0g3FKvtxQ2PW24AvbvXhP6c8JNNopSZ0Bc1qRkYJULBMK03cjzzf8 +Y96n4/a3tWlFKEnDkdyqRxypiJksBSqNjYr6YuJatwAgXTnEKMLL/J6oia5bPY4S +6jKy/OsU1wkVGsDNG9W1FU5B1ZbjTg== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + ff:45:d5:27:5d:24:fb:b3:c2:39:24:53:57:e1:4f:de + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=RSA Data Security, Inc., OU=Secure Server Certification Authority + Validity + Not Before: Aug 4 00:00:00 2000 GMT + Not After : Aug 3 23:59:59 2004 GMT + Subject: O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/RPA (c)00, CN=Secure Server OCSP Responder + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:b8:51:99:64:85:0e:ee:b3:0a:68:f0:bf:63:76: + 1d:53:f5:fc:a1:78:8c:33:ee:9f:f4:be:39:da:9b: + 0f:4d:47:a9:8f:20:e8:4b:44:bd:ce:cd:7b:90:d1: + 30:e8:90:c4:25:7b:89:28:de:bd:f6:93:1d:ff:b9: + ff:92:b5:a9:8d:e4:ae:cc:e2:c3:07:83:6a:a3:72: + 10:01:27:62:22:a6:35:26:39:2d:9e:cf:60:0c:fc: + 47:a4:d7:d0:42:78:a7:1d:6c:d0:cb:4f:15:a7:29: + 0a:b4:95:45:c4:b1:e7:5a:09:d7:39:95:d8:1d:35: + 9e:c2:bd:b3:5d:c1:0c:4b:1f + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Alternative Name: + DirName:/CN=OCSP 1-4 + X509v3 CRL Distribution Points: + URI:http://crl.verisign.com/RSASecureServer-p.crl + + X509v3 Extended Key Usage: + OCSP Signing + Authority Information Access: + OCSP - URI:http://ocsp.verisign.com/ocsp/status + + X509v3 Certificate Policies: + Policy: 2.16.840.1.113733.1.7.1.1 + CPS: https://www.verisign.com/RPA + + X509v3 Basic Constraints: + CA:FALSE + X509v3 Key Usage: + Digital Signature + Signature Algorithm: sha1WithRSAEncryption + 00:b3:10:53:66:9c:49:93:2e:31:a0:02:42:d2:58:57:7e:66: + a1:fe:1b:8a:61:18:50:40:2c:1e:2b:41:a5:d6:db:ff:ac:08: + 1c:5a:05:6d:02:5c:2a:b6:96:4f:47:db:be:4e:db:ce:cc:ba: + 86:b8:18:ce:b1:12:91:5f:63:f7:f3:48:3e:cc:f1:4d:13:e4: + 6d:09:94:78:00:92:cb:a3:20:9d:06:0b:6a:a0:43:07:ce:d1: + 19:6c:8f:18:75:9a:9f:17:33:fd:a9:26:b8:e3:e2:de:c2:a8: + c4:5a:8a:7f:98:d6:07:06:6b:cc:56:9e:86:70:ce:d4:ef +MD5 Fingerprint=2C:62:C3:D8:80:01:16:09:EA:59:EA:78:AB:10:43:F6 +-----BEGIN CERTIFICATE----- +MIIDnzCCAwygAwIBAgIRAP9F1SddJPuzwjkkU1fhT94wDQYJKoZIhvcNAQEFBQAw +XzELMAkGA1UEBhMCVVMxIDAeBgNVBAoTF1JTQSBEYXRhIFNlY3VyaXR5LCBJbmMu +MS4wLAYDVQQLEyVTZWN1cmUgU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5 +MB4XDTAwMDgwNDAwMDAwMFoXDTA0MDgwMzIzNTk1OVowgZ4xFzAVBgNVBAoTDlZl +cmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTsw +OQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29t +L1JQQSAoYykwMDElMCMGA1UEAxMcU2VjdXJlIFNlcnZlciBPQ1NQIFJlc3BvbmRl +cjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAuFGZZIUO7rMKaPC/Y3YdU/X8 +oXiMM+6f9L452psPTUepjyDoS0S9zs17kNEw6JDEJXuJKN699pMd/7n/krWpjeSu +zOLDB4Nqo3IQASdiIqY1Jjktns9gDPxHpNfQQninHWzQy08VpykKtJVFxLHnWgnX +OZXYHTWewr2zXcEMSx8CAwEAAaOCAR0wggEZMCAGA1UdEQQZMBekFTATMREwDwYD +VQQDEwhPQ1NQIDEtNDA+BgNVHR8ENzA1MDOgMaAvhi1odHRwOi8vY3JsLnZlcmlz +aWduLmNvbS9SU0FTZWN1cmVTZXJ2ZXItcC5jcmwwEwYDVR0lBAwwCgYIKwYBBQUH +AwkwQgYIKwYBBQUHAQEENjA0MDIGCCsGAQUFBzABpiYWJGh0dHA6Ly9vY3NwLnZl +cmlzaWduLmNvbS9vY3NwL3N0YXR1czBEBgNVHSAEPTA7MDkGC2CGSAGG+EUBBwEB +MCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9SUEEwCQYD +VR0TBAIwADALBgNVHQ8EBAMCB4AwDQYJKoZIhvcNAQEFBQADfgAAsxBTZpxJky4x +oAJC0lhXfmah/huKYRhQQCweK0Gl1tv/rAgcWgVtAlwqtpZPR9u+TtvOzLqGuBjO +sRKRX2P380g+zPFNE+RtCZR4AJLLoyCdBgtqoEMHztEZbI8YdZqfFzP9qSa44+Le +wqjEWop/mNYHBmvMVp6GcM7U7w== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 53:61:b2:60:ae:db:71:8e:a7:94:b3:13:33:f4:07:09 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network + Validity + Not Before: Sep 26 00:00:00 2000 GMT + Not After : Sep 25 23:59:59 2010 GMT + Subject: O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)00, CN=VeriSign Time Stamping Authority CA + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:d2:19:9d:67:c2:00:21:59:62:ce:b4:09:22:44: + 69:8a:f8:25:5a:db:ed:0d:b7:36:7e:4e:e0:bb:94: + 3e:90:25:87:c2:61:47:29:d9:bd:54:b8:63:cc:2c: + 7d:69:b4:33:36:f4:37:07:9a:c1:dd:40:54:fc:e0: + 78:9d:a0:93:b9:09:3d:23:51:7f:44:c2:14:74:db: + 0a:be:cb:c9:30:34:40:98:3e:d0:d7:25:10:81:94: + bd:07:4f:9c:d6:54:27:df:2e:a8:bf:cb:90:8c:8d: + 75:4b:bc:e2:e8:44:87:cd:e6:41:0a:25:6e:e8:f4: + 24:02:c5:52:0f:6e:ec:98:75 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: + CA:TRUE, pathlen:0 + X509v3 Certificate Policies: + Policy: 2.16.840.1.113733.1.7.23.1.3 + CPS: https://www.verisign.com/rpa + + X509v3 CRL Distribution Points: + URI:http://crl.verisign.com/pca3.crl + + X509v3 Key Usage: + Certificate Sign, CRL Sign + Authority Information Access: + OCSP - URI:http://ocsp.verisign.com/ocsp/status + + Signature Algorithm: sha1WithRSAEncryption + 82:70:68:95:df:b6:0d:c2:01:70:19:4a:d2:54:56:1e:ac:f2: + 45:4c:87:b8:f5:35:eb:78:4b:05:a9:c8:9d:3b:19:21:2e:70: + 34:4a:a2:f5:89:e0:15:75:45:e7:28:37:00:34:27:29:e8:37: + 4b:f2:ef:44:97:6b:17:51:1a:c3:56:9d:3c:1a:8a:f6:4a:46: + 46:37:8c:fa:cb:f5:64:5a:38:68:2e:1c:c3:ef:70:ce:b8:46: + 06:16:bf:f7:7e:e7:b5:a8:3e:45:ac:a9:25:75:22:7b:6f:3f: + b0:9c:94:e7:c7:73:ab:ac:1f:ee:25:9b:c0:16:ed:b7:ca:5b: + f0:14 +MD5 Fingerprint=89:49:54:8C:C8:68:9A:83:29:EC:DC:06:73:21:AB:97 +-----BEGIN CERTIFICATE----- +MIIDzTCCAzagAwIBAgIQU2GyYK7bcY6nlLMTM/QHCTANBgkqhkiG9w0BAQUFADCB +wTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTwwOgYDVQQL +EzNDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5 +IC0gRzIxOjA4BgNVBAsTMShjKSAxOTk4IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1 +dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdv +cmswHhcNMDAwOTI2MDAwMDAwWhcNMTAwOTI1MjM1OTU5WjCBpTEXMBUGA1UEChMO +VmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsx +OzA5BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5j +b20vcnBhIChjKTAwMSwwKgYDVQQDEyNWZXJpU2lnbiBUaW1lIFN0YW1waW5nIEF1 +dGhvcml0eSBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0hmdZ8IAIVli +zrQJIkRpivglWtvtDbc2fk7gu5Q+kCWHwmFHKdm9VLhjzCx9abQzNvQ3B5rB3UBU +/OB4naCTuQk9I1F/RMIUdNsKvsvJMDRAmD7Q1yUQgZS9B0+c1lQn3y6ov8uQjI11 +S7zi6ESHzeZBCiVu6PQkAsVSD27smHUCAwEAAaOB3zCB3DAPBgNVHRMECDAGAQH/ +AgEAMEUGA1UdIAQ+MDwwOgYMYIZIAYb4RQEHFwEDMCowKAYIKwYBBQUHAgEWHGh0 +dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEwMQYDVR0fBCowKDAmoCSgIoYgaHR0 +cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMy5jcmwwCwYDVR0PBAQDAgEGMEIGCCsG +AQUFBwEBBDYwNDAyBggrBgEFBQcwAaYmFiRodHRwOi8vb2NzcC52ZXJpc2lnbi5j +b20vb2NzcC9zdGF0dXMwDQYJKoZIhvcNAQEFBQADgYEAgnBold+2DcIBcBlK0lRW +HqzyRUyHuPU163hLBanInTsZIS5wNEqi9YngFXVF5yg3ADQnKeg3S/LvRJdrF1Ea +w1adPBqK9kpGRjeM+sv1ZFo4aC4cw+9wzrhGBha/937ntag+RaypJXUie28/sJyU +58dzq6wf7iWbwBbtt8pb8BQ= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA + Validity + Not Before: Jan 1 00:00:00 1997 GMT + Not After : Dec 31 23:59:59 2020 GMT + Subject: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:d6:2b:58:78:61:45:86:53:ea:34:7b:51:9c:ed: + b0:e6:2e:18:0e:fe:e0:5f:a8:27:d3:b4:c9:e0:7c: + 59:4e:16:0e:73:54:60:c1:7f:f6:9f:2e:e9:3a:85: + 24:15:3c:db:47:04:63:c3:9e:c4:94:1a:5a:df:4c: + 7a:f3:d9:43:1d:3c:10:7a:79:25:db:90:fe:f0:51: + e7:30:d6:41:00:fd:9f:28:df:79:be:94:bb:9d:b6: + 14:e3:23:85:d7:a9:41:e0:4c:a4:79:b0:2b:1a:8b: + f2:f8:3b:8a:3e:45:ac:71:92:00:b4:90:41:98:fb: + 5f:ed:fa:b7:2e:8a:f8:88:37 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + Signature Algorithm: md5WithRSAEncryption + 67:db:e2:c2:e6:87:3d:40:83:86:37:35:7d:1f:ce:9a:c3:0c: + 66:20:a8:ba:aa:04:89:86:c2:f5:10:08:0d:bf:cb:a2:05:8a: + d0:4d:36:3e:f4:d7:ef:69:c6:5e:e4:b0:94:6f:4a:b9:e7:de: + 5b:88:b6:7b:db:e3:27:e5:76:c3:f0:35:c1:cb:b5:27:9b:33: + 79:dc:90:a6:00:9e:77:fa:fc:cd:27:94:42:16:9c:d3:1c:68: + ec:bf:5c:dd:e5:a9:7b:10:0a:32:74:54:13:31:8b:85:03:84: + 91:b7:58:01:30:14:38:af:28:ca:fc:b1:50:19:19:09:ac:89: + 49:d3 +MD5 Fingerprint=7F:66:7A:71:D3:EB:69:78:20:9A:51:14:9D:83:DA:20 +-----BEGIN CERTIFICATE----- +MIICoTCCAgqgAwIBAgIBADANBgkqhkiG9w0BAQQFADCBizELMAkGA1UEBhMCWkEx +FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTEUMBIGA1UEBxMLRHVyYmFudmlsbGUxDzAN +BgNVBAoTBlRoYXd0ZTEdMBsGA1UECxMUVGhhd3RlIENlcnRpZmljYXRpb24xHzAd +BgNVBAMTFlRoYXd0ZSBUaW1lc3RhbXBpbmcgQ0EwHhcNOTcwMTAxMDAwMDAwWhcN +MjAxMjMxMjM1OTU5WjCBizELMAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4g +Q2FwZTEUMBIGA1UEBxMLRHVyYmFudmlsbGUxDzANBgNVBAoTBlRoYXd0ZTEdMBsG +A1UECxMUVGhhd3RlIENlcnRpZmljYXRpb24xHzAdBgNVBAMTFlRoYXd0ZSBUaW1l +c3RhbXBpbmcgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANYrWHhhRYZT +6jR7UZztsOYuGA7+4F+oJ9O0yeB8WU4WDnNUYMF/9p8u6TqFJBU820cEY8OexJQa +Wt9MevPZQx08EHp5JduQ/vBR5zDWQQD9nyjfeb6Uu522FOMjhdepQeBMpHmwKxqL +8vg7ij5FrHGSALSQQZj7X+36ty6K+Ig3AgMBAAGjEzARMA8GA1UdEwEB/wQFMAMB +Af8wDQYJKoZIhvcNAQEEBQADgYEAZ9viwuaHPUCDhjc1fR/OmsMMZiCouqoEiYbC +9RAIDb/LogWK0E02PvTX72nGXuSwlG9KuefeW4i2e9vjJ+V2w/A1wcu1J5szedyQ +pgCed/r8zSeUQhac0xxo7L9c3eWpexAKMnRUEzGLhQOEkbdYATAUOK8oyvyxUBkZ +CayJSdM= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 949686588 (0x389b113c) + Signature Algorithm: md5WithRSAEncryption + Issuer: O=Entrust.net, OU=www.entrust.net/SSL_CPS incorp. by ref. (limits liab.), OU=(c) 2000 Entrust.net Limited, CN=Entrust.net Secure Server Certification Authority + Validity + Not Before: Feb 4 17:20:00 2000 GMT + Not After : Feb 4 17:50:00 2020 GMT + Subject: O=Entrust.net, OU=www.entrust.net/SSL_CPS incorp. by ref. (limits liab.), OU=(c) 2000 Entrust.net Limited, CN=Entrust.net Secure Server Certification Authority + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:c7:c1:5f:4e:71:f1:ce:f0:60:86:0f:d2:58:7f: + d3:33:97:2d:17:a2:75:30:b5:96:64:26:2f:68:c3: + 44:ab:a8:75:e6:00:67:34:57:9e:65:c7:22:9b:73: + e6:d3:dd:08:0e:37:55:aa:25:46:81:6c:bd:fe:a8: + f6:75:57:57:8c:90:6c:4a:c3:3e:8b:4b:43:0a:c9: + 11:56:9a:9a:27:22:99:cf:55:9e:61:d9:02:e2:7c: + b6:7c:38:07:dc:e3:7f:4f:9a:b9:03:41:80:b6:75: + 67:13:0b:9f:e8:57:36:c8:5d:00:36:de:66:14:da: + 6e:76:1f:4f:37:8c:82:13:89 + Exponent: 65537 (0x10001) + X509v3 extensions: + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 CRL Distribution Points: + DirName:/O=Entrust.net/OU=www.entrust.net/SSL_CPS incorp. by ref. (limits liab.)/OU=(c) 2000 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority/CN=CRL1 + + X509v3 Private Key Usage Period: + Not Before: Feb 4 17:20:00 2000 GMT, Not After: Feb 4 17:50:00 2020 GMT + X509v3 Key Usage: + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:CB:6C:C0:6B:E3:BB:3E:CB:FC:22:9C:FE:FB:8B:92:9C:B0:F2:6E:22 + + X509v3 Subject Key Identifier: + CB:6C:C0:6B:E3:BB:3E:CB:FC:22:9C:FE:FB:8B:92:9C:B0:F2:6E:22 + X509v3 Basic Constraints: + CA:TRUE + 1.2.840.113533.7.65.0: + 0...V5.0:4.0.... + Signature Algorithm: md5WithRSAEncryption + 62:db:81:91:ce:c8:9a:77:42:2f:ec:bd:27:a3:53:0f:50:1b: + ea:4e:92:f0:a9:af:a9:a0:ba:48:61:cb:ef:c9:06:ef:1f:d5: + f4:ee:df:56:2d:e6:ca:6a:19:73:aa:53:be:92:b3:50:02:b6: + 85:26:72:63:d8:75:50:62:75:14:b7:b3:50:1a:3f:ca:11:00: + 0b:85:45:69:6d:b6:a5:ae:51:e1:4a:dc:82:3f:6c:8c:34:b2: + 77:6b:d9:02:f6:7f:0e:ea:65:04:f1:cd:54:ca:ba:c9:cc:e0: + 84:f7:c8:3e:11:97:d3:60:09:18:bc:05:ff:6c:89:33:f0:ec: + 15:0f +MD5 Fingerprint=9D:66:6A:CC:FF:D5:F5:43:B4:BF:8C:16:D1:2B:A8:99 +-----BEGIN CERTIFICATE----- +MIIElTCCA/6gAwIBAgIEOJsRPDANBgkqhkiG9w0BAQQFADCBujEUMBIGA1UEChML +RW50cnVzdC5uZXQxPzA9BgNVBAsUNnd3dy5lbnRydXN0Lm5ldC9TU0xfQ1BTIGlu +Y29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMGA1UECxMcKGMpIDIwMDAg +RW50cnVzdC5uZXQgTGltaXRlZDE6MDgGA1UEAxMxRW50cnVzdC5uZXQgU2VjdXJl +IFNlcnZlciBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wMDAyMDQxNzIwMDBa +Fw0yMDAyMDQxNzUwMDBaMIG6MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDE/MD0GA1UE +CxQ2d3d3LmVudHJ1c3QubmV0L1NTTF9DUFMgaW5jb3JwLiBieSByZWYuIChsaW1p +dHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMjAwMCBFbnRydXN0Lm5ldCBMaW1pdGVk +MTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUgU2VydmVyIENlcnRpZmljYXRp +b24gQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHwV9OcfHO +8GCGD9JYf9Mzly0XonUwtZZkJi9ow0SrqHXmAGc0V55lxyKbc+bT3QgON1WqJUaB +bL3+qPZ1V1eMkGxKwz6LS0MKyRFWmponIpnPVZ5h2QLifLZ8OAfc439PmrkDQYC2 +dWcTC5/oVzbIXQA23mYU2m52H083jIITiQIDAQABo4IBpDCCAaAwEQYJYIZIAYb4 +QgEBBAQDAgAHMIHjBgNVHR8EgdswgdgwgdWggdKggc+kgcwwgckxFDASBgNVBAoT +C0VudHJ1c3QubmV0MT8wPQYDVQQLFDZ3d3cuZW50cnVzdC5uZXQvU1NMX0NQUyBp +bmNvcnAuIGJ5IHJlZi4gKGxpbWl0cyBsaWFiLikxJTAjBgNVBAsTHChjKSAyMDAw +IEVudHJ1c3QubmV0IExpbWl0ZWQxOjA4BgNVBAMTMUVudHJ1c3QubmV0IFNlY3Vy +ZSBTZXJ2ZXIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxDTALBgNVBAMTBENSTDEw +KwYDVR0QBCQwIoAPMjAwMDAyMDQxNzIwMDBagQ8yMDIwMDIwNDE3NTAwMFowCwYD +VR0PBAQDAgEGMB8GA1UdIwQYMBaAFMtswGvjuz7L/CKc/vuLkpyw8m4iMB0GA1Ud +DgQWBBTLbMBr47s+y/winP77i5KcsPJuIjAMBgNVHRMEBTADAQH/MB0GCSqGSIb2 +fQdBAAQQMA4bCFY1LjA6NC4wAwIEkDANBgkqhkiG9w0BAQQFAAOBgQBi24GRzsia +d0Iv7L0no1MPUBvqTpLwqa+poLpIYcvvyQbvH9X07t9WLebKahlzqlO+krNQAraF +JnJj2HVQYnUUt7NQGj/KEQALhUVpbbalrlHhStyCP2yMNLJ3a9kC9n8O6mUE8c1U +yrrJzOCE98g+EZfTYAkYvAX/bIkz8OwVDw== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 949941988 (0x389ef6e4) + Signature Algorithm: md5WithRSAEncryption + Issuer: O=Entrust.net, OU=www.entrust.net/GCCA_CPS incorp. by ref. (limits liab.), OU=(c) 2000 Entrust.net Limited, CN=Entrust.net Client Certification Authority + Validity + Not Before: Feb 7 16:16:40 2000 GMT + Not After : Feb 7 16:46:40 2020 GMT + Subject: O=Entrust.net, OU=www.entrust.net/GCCA_CPS incorp. by ref. (limits liab.), OU=(c) 2000 Entrust.net Limited, CN=Entrust.net Client Certification Authority + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:93:74:b4:b6:e4:c5:4b:d6:a1:68:7f:62:d5:ec: + f7:51:57:b3:72:4a:98:f5:d0:89:c9:ad:63:cd:4d: + 35:51:6a:84:d4:ad:c9:68:79:6f:b8:eb:11:db:87: + ae:5c:24:51:13:f1:54:25:84:af:29:2b:9f:e3:80: + e2:d9:cb:dd:c6:45:49:34:88:90:5e:01:97:ef:ea: + 53:a6:dd:fc:c1:de:4b:2a:25:e4:e9:35:fa:55:05: + 06:e5:89:7a:ea:a4:11:57:3b:fc:7c:3d:36:cd:67: + 35:6d:a4:a9:25:59:bd:66:f5:f9:27:e4:95:67:d6: + 3f:92:80:5e:f2:34:7d:2b:85 + Exponent: 65537 (0x10001) + X509v3 extensions: + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 CRL Distribution Points: + DirName:/O=Entrust.net/OU=www.entrust.net/GCCA_CPS incorp. by ref. (limits liab.)/OU=(c) 2000 Entrust.net Limited/CN=Entrust.net Client Certification Authority/CN=CRL1 + + X509v3 Private Key Usage Period: + Not Before: Feb 7 16:16:40 2000 GMT, Not After: Feb 7 16:46:40 2020 GMT + X509v3 Key Usage: + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:84:8B:74:FD:C5:8D:C0:FF:27:6D:20:37:45:7C:FE:2D:CE:BA:D3:7D + + X509v3 Subject Key Identifier: + 84:8B:74:FD:C5:8D:C0:FF:27:6D:20:37:45:7C:FE:2D:CE:BA:D3:7D + X509v3 Basic Constraints: + CA:TRUE + 1.2.840.113533.7.65.0: + 0...V5.0:4.0.... + Signature Algorithm: md5WithRSAEncryption + 4e:6f:35:80:3b:d1:8a:f5:0e:a7:20:cb:2d:65:55:d0:92:f4: + e7:84:b5:06:26:83:12:84:0b:ac:3b:b2:44:ee:bd:cf:40:db: + 20:0e:ba:6e:14:ea:30:e0:3b:62:7c:7f:8b:6b:7c:4a:a7:d5: + 35:3c:be:a8:5c:ea:4b:bb:93:8e:80:66:ab:0f:29:fd:4d:2d: + bf:1a:9b:0a:90:c5:ab:da:d1:b3:86:d4:2f:24:52:5c:7a:6d: + c6:f2:fe:e5:4d:1a:30:8c:90:f2:ba:d7:4a:3e:43:7e:d4:c8: + 50:1a:87:f8:4f:81:c7:76:0b:84:3a:72:9d:ce:65:66:97:ae: + 26:5e +MD5 Fingerprint=9A:77:19:18:ED:96:CF:DF:1B:B7:0E:F5:8D:B9:88:2E +-----BEGIN CERTIFICATE----- +MIIEgzCCA+ygAwIBAgIEOJ725DANBgkqhkiG9w0BAQQFADCBtDEUMBIGA1UEChML +RW50cnVzdC5uZXQxQDA+BgNVBAsUN3d3dy5lbnRydXN0Lm5ldC9HQ0NBX0NQUyBp +bmNvcnAuIGJ5IHJlZi4gKGxpbWl0cyBsaWFiLikxJTAjBgNVBAsTHChjKSAyMDAw +IEVudHJ1c3QubmV0IExpbWl0ZWQxMzAxBgNVBAMTKkVudHJ1c3QubmV0IENsaWVu +dCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wMDAyMDcxNjE2NDBaFw0yMDAy +MDcxNjQ2NDBaMIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDFAMD4GA1UECxQ3d3d3 +LmVudHJ1c3QubmV0L0dDQ0FfQ1BTIGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxp +YWIuKTElMCMGA1UECxMcKGMpIDIwMDAgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEG +A1UEAxMqRW50cnVzdC5uZXQgQ2xpZW50IENlcnRpZmljYXRpb24gQXV0aG9yaXR5 +MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCTdLS25MVL1qFof2LV7PdRV7Ny +Spj10InJrWPNTTVRaoTUrcloeW+46xHbh65cJFET8VQlhK8pK5/jgOLZy93GRUk0 +iJBeAZfv6lOm3fzB3ksqJeTpNfpVBQbliXrqpBFXO/x8PTbNZzVtpKklWb1m9fkn +5JVn1j+SgF7yNH0rhQIDAQABo4IBnjCCAZowEQYJYIZIAYb4QgEBBAQDAgAHMIHd +BgNVHR8EgdUwgdIwgc+ggcyggcmkgcYwgcMxFDASBgNVBAoTC0VudHJ1c3QubmV0 +MUAwPgYDVQQLFDd3d3cuZW50cnVzdC5uZXQvR0NDQV9DUFMgaW5jb3JwLiBieSBy +ZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMjAwMCBFbnRydXN0Lm5l +dCBMaW1pdGVkMTMwMQYDVQQDEypFbnRydXN0Lm5ldCBDbGllbnQgQ2VydGlmaWNh +dGlvbiBBdXRob3JpdHkxDTALBgNVBAMTBENSTDEwKwYDVR0QBCQwIoAPMjAwMDAy +MDcxNjE2NDBagQ8yMDIwMDIwNzE2NDY0MFowCwYDVR0PBAQDAgEGMB8GA1UdIwQY +MBaAFISLdP3FjcD/J20gN0V8/i3OutN9MB0GA1UdDgQWBBSEi3T9xY3A/ydtIDdF +fP4tzrrTfTAMBgNVHRMEBTADAQH/MB0GCSqGSIb2fQdBAAQQMA4bCFY1LjA6NC4w +AwIEkDANBgkqhkiG9w0BAQQFAAOBgQBObzWAO9GK9Q6nIMstZVXQkvTnhLUGJoMS +hAusO7JE7r3PQNsgDrpuFOow4DtifH+La3xKp9U1PL6oXOpLu5OOgGarDyn9TS2/ +GpsKkMWr2tGzhtQvJFJcem3G8v7lTRowjJDyutdKPkN+1MhQGof4T4HHdguEOnKd +zmVml64mXg== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=AOL Time Warner Inc., OU=America Online Inc., CN=AOL Time Warner Root Certification Authority 1 + Validity + Not Before: May 29 06:00:00 2002 GMT + Not After : Nov 20 15:03:00 2037 GMT + Subject: C=US, O=AOL Time Warner Inc., OU=America Online Inc., CN=AOL Time Warner Root Certification Authority 1 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:99:de:8f:c3:25:a3:69:34:e8:05:f7:74:b9:bf: + 5a:97:19:b9:2f:94:d2:93:e5:2d:89:ca:84:7c:3f: + 10:43:1b:8c:8b:7c:84:58:f8:24:7c:48:cf:2a:fd: + c0:15:d9:18:7e:84:1a:17:d3:db:9e:d7:ca:e4:d9: + d7:aa:58:51:87:f0:f0:8b:48:4e:e2:c2:c4:59:69: + 30:62:b6:30:a2:8c:0b:11:99:61:35:6d:7e:ef:c5: + b1:19:06:20:12:8e:42:e1:df:0f:96:10:52:a8:cf: + 9c:5f:95:14:d8:af:3b:75:0b:31:20:1f:44:2f:a2: + 62:41:b3:bb:18:21:db:ca:71:3c:8c:ec:b6:b9:0d: + 9f:ef:51:ef:4d:7b:12:f2:0b:0c:e1:ac:40:8f:77: + 7f:b0:ca:78:71:0c:5d:16:71:70:a2:d7:c2:3a:85: + cd:0e:9a:c4:e0:00:b0:d5:25:ea:dc:2b:e4:94:2d: + 38:9c:89:41:57:64:28:65:19:1c:b6:44:b4:c8:31: + 6b:8e:01:7b:76:59:25:7f:15:1c:84:08:7c:73:65: + 20:0a:a1:04:2e:1a:32:a8:9a:20:b1:9c:2c:21:59: + e7:fb:cf:ee:70:2d:08:ca:63:3e:2c:9b:93:19:6a: + a4:c2:97:ff:b7:86:57:88:85:6c:9e:15:16:2b:4d: + 2c:b3 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + A1:36:30:16:CB:86:90:00:45:80:53:B1:8F:C8:D8:3D:7C:BE:5F:12 + X509v3 Authority Key Identifier: + keyid:A1:36:30:16:CB:86:90:00:45:80:53:B1:8F:C8:D8:3D:7C:BE:5F:12 + + X509v3 Key Usage: critical + Digital Signature, Certificate Sign, CRL Sign + Signature Algorithm: sha1WithRSAEncryption + 8a:20:18:a5:be:b3:2f:b4:a6:84:00:40:30:29:fa:b4:14:73: + 4c:79:45:a7:f6:70:e0:e8:7e:64:1e:0a:95:7c:6a:61:c2:ef: + 4e:1f:be:ff:c9:99:1f:07:61:4a:e1:5d:4c:cd:ad:ee:d0:52: + 32:d9:59:32:bc:da:79:72:d6:7b:09:e8:02:81:35:d3:0a:df: + 11:1d:c9:79:a0:80:4d:fe:5a:d7:56:d6:ed:0f:2a:af:a7:18: + 75:33:0c:ea:c1:61:05:4f:6a:9a:89:f2:8d:b9:9f:2e:ef:b0: + 5f:5a:00:eb:be:ad:a0:f8:44:05:67:bc:cb:04:ef:9e:64:c5: + e9:c8:3f:05:bf:c6:2f:07:1c:c3:36:71:86:ca:38:66:4a:cd: + d6:b8:4b:c6:6c:a7:97:3b:fa:13:2d:6e:23:61:87:a1:63:42: + ac:c2:cb:97:9f:61:68:cf:2d:4c:04:9d:d7:25:4f:0a:0e:4d: + 90:8b:18:56:a8:93:48:57:dc:6f:ae:bd:9e:67:57:77:89:50: + b3:be:11:9b:45:67:83:86:19:87:d3:98:bd:08:1a:16:1f:58: + 82:0b:e1:96:69:05:4b:8e:ec:83:51:31:07:d5:d4:9f:ff:59: + 7b:a8:6e:85:cf:d3:4b:a9:49:b0:5f:b0:39:28:68:0e:73:dd: + 25:9a:de:12 +MD5 Fingerprint=E7:7A:DC:B1:1F:6E:06:1F:74:6C:59:16:27:C3:4B:C0 +-----BEGIN CERTIFICATE----- +MIID5jCCAs6gAwIBAgIBATANBgkqhkiG9w0BAQUFADCBgzELMAkGA1UEBhMCVVMx +HTAbBgNVBAoTFEFPTCBUaW1lIFdhcm5lciBJbmMuMRwwGgYDVQQLExNBbWVyaWNh +IE9ubGluZSBJbmMuMTcwNQYDVQQDEy5BT0wgVGltZSBXYXJuZXIgUm9vdCBDZXJ0 +aWZpY2F0aW9uIEF1dGhvcml0eSAxMB4XDTAyMDUyOTA2MDAwMFoXDTM3MTEyMDE1 +MDMwMFowgYMxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRBT0wgVGltZSBXYXJuZXIg +SW5jLjEcMBoGA1UECxMTQW1lcmljYSBPbmxpbmUgSW5jLjE3MDUGA1UEAxMuQU9M +IFRpbWUgV2FybmVyIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgMTCCASIw +DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJnej8Mlo2k06AX3dLm/WpcZuS+U +0pPlLYnKhHw/EEMbjIt8hFj4JHxIzyr9wBXZGH6EGhfT257XyuTZ16pYUYfw8ItI +TuLCxFlpMGK2MKKMCxGZYTVtfu/FsRkGIBKOQuHfD5YQUqjPnF+VFNivO3ULMSAf +RC+iYkGzuxgh28pxPIzstrkNn+9R7017EvILDOGsQI93f7DKeHEMXRZxcKLXwjqF +zQ6axOAAsNUl6twr5JQtOJyJQVdkKGUZHLZEtMgxa44Be3ZZJX8VHIQIfHNlIAqh +BC4aMqiaILGcLCFZ5/vP7nAtCMpjPiybkxlqpMKX/7eGV4iFbJ4VFitNLLMCAwEA +AaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUoTYwFsuGkABFgFOxj8jY +PXy+XxIwHwYDVR0jBBgwFoAUoTYwFsuGkABFgFOxj8jYPXy+XxIwDgYDVR0PAQH/ +BAQDAgGGMA0GCSqGSIb3DQEBBQUAA4IBAQCKIBilvrMvtKaEAEAwKfq0FHNMeUWn +9nDg6H5kHgqVfGphwu9OH77/yZkfB2FK4V1Mza3u0FIy2VkyvNp5ctZ7CegCgTXT +Ct8RHcl5oIBN/lrXVtbtDyqvpxh1MwzqwWEFT2qaifKNuZ8u77BfWgDrvq2g+EQF +Z7zLBO+eZMXpyD8Fv8YvBxzDNnGGyjhmSs3WuEvGbKeXO/oTLW4jYYehY0KswsuX +n2Fozy1MBJ3XJU8KDk2QixhWqJNIV9xvrr2eZ1d3iVCzvhGbRWeDhhmH05i9CBoW +H1iCC+GWaQVLjuyDUTEH1dSf/1l7qG6Fz9NLqUmwX7A5KGgOc90lmt4S +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=AOL Time Warner Inc., OU=America Online Inc., CN=AOL Time Warner Root Certification Authority 2 + Validity + Not Before: May 29 06:00:00 2002 GMT + Not After : Sep 28 23:43:00 2037 GMT + Subject: C=US, O=AOL Time Warner Inc., OU=America Online Inc., CN=AOL Time Warner Root Certification Authority 2 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (4096 bit) + Modulus (4096 bit): + 00:b4:37:5a:08:16:99:14:e8:55:b1:1b:24:6b:fc: + c7:8b:e6:87:a9:89:ee:8b:99:cd:4f:40:86:a4:b6: + 4d:c9:d9:b1:dc:3c:4d:0d:85:4c:15:6c:46:8b:52: + 78:9f:f8:23:fd:67:f5:24:3a:68:5d:d0:f7:64:61: + 41:54:a3:8b:a5:08:d2:29:5b:9b:60:4f:26:83:d1: + 63:12:56:49:76:a4:16:c2:a5:9d:45:ac:8b:84:95: + a8:16:b1:ec:9f:ea:24:1a:ef:b9:57:5c:9a:24:21: + 2c:4d:0e:71:1f:a6:ac:5d:45:74:03:98:c4:54:8c: + 16:4a:41:77:86:95:75:0c:47:01:66:60:fc:15:f1: + 0f:ea:f5:14:78:c7:0e:d7:6e:81:1c:5e:bf:5e:e7: + 3a:2a:d8:97:17:30:7c:00:ad:08:9d:33:af:b8:99: + 61:80:8b:a8:95:7e:14:dc:12:6c:a4:d0:d8:ef:40: + 49:02:36:f9:6e:a9:d6:1d:96:56:04:b2:b3:2d:16: + 56:86:8f:d9:20:57:80:cd:67:10:6d:b0:4c:f0:da: + 46:b6:ea:25:2e:46:af:8d:b0:85:38:34:8b:14:26: + 82:2b:ac:ae:99:0b:8e:14:d7:52:bd:9e:69:c3:86: + 02:0b:ea:76:75:31:09:ce:33:19:21:85:43:e6:89: + 2d:9f:25:37:67:f1:23:6a:d2:00:6d:97:f9:9f:e7: + 29:ca:dd:1f:d7:06:ea:b8:c9:b9:09:21:9f:c8:3f: + 06:c5:d2:e9:12:46:00:4e:7b:08:eb:42:3d:2b:48: + 6e:9d:67:dd:4b:02:e4:44:f3:93:19:a5:27:ce:69: + 7a:be:67:d3:fc:50:a4:2c:ab:c3:6b:b9:e3:80:4c: + cf:05:61:4b:2b:dc:1b:b9:a6:d2:d0:aa:f5:2b:73: + fb:ce:90:35:9f:0c:52:1c:bf:5c:21:61:11:5b:15: + 4b:a9:24:51:fc:a4:5c:f7:17:9d:b0:d2:fa:07:e9: + 8f:56:e4:1a:8c:68:8a:04:d3:7c:5a:e3:9e:a2:a1: + ca:71:5b:a2:d4:a0:e7:29:85:5d:03:68:2a:4f:d2: + 06:d7:3d:f9:c3:03:2f:3f:65:f9:67:1e:47:40:d3: + 63:0f:e3:d5:8e:f9:85:ab:97:4c:b3:d7:26:eb:96: + 0a:94:de:85:36:9c:c8:7f:81:09:02:49:2a:0e:f5: + 64:32:0c:82:d1:ba:6a:82:1b:b3:4b:74:11:f3:8c: + 77:d6:9f:bf:dc:37:a4:a7:55:04:2f:d4:31:e8:d3: + 46:b9:03:7c:da:12:4e:59:64:b7:51:31:31:50:a0: + ca:1c:27:d9:10:2e:ad:d6:bd:10:66:2b:c3:b0:22: + 4a:12:5b + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + 4F:69:6D:03:7E:9D:9F:07:18:43:BC:B7:10:4E:D5:BF:A9:C4:20:28 + X509v3 Authority Key Identifier: + keyid:4F:69:6D:03:7E:9D:9F:07:18:43:BC:B7:10:4E:D5:BF:A9:C4:20:28 + + X509v3 Key Usage: critical + Digital Signature, Certificate Sign, CRL Sign + Signature Algorithm: sha1WithRSAEncryption + 3b:f3:ae:ca:e8:2e:87:85:fb:65:59:e7:ad:11:14:a5:57:bc: + 58:9f:24:12:57:bb:fb:3f:34:da:ee:ad:7a:2a:34:72:70:31: + 6b:c7:19:98:80:c9:82:de:37:77:5e:54:8b:8e:f2:ea:67:4f: + c9:74:84:91:56:09:d5:e5:7a:9a:81:b6:81:c2:ad:36:e4:f1: + 54:11:53:f3:34:45:01:26:c8:e5:1a:bc:34:44:21:de:ad:25: + fc:76:16:77:21:90:80:98:57:9d:4e:ea:ec:2f:aa:3c:14:7b: + 57:c1:7e:18:14:67:ee:24:c6:bd:ba:15:b0:d2:18:bd:b7:55: + 81:ac:53:c0:e8:dd:69:12:13:42:b7:02:b5:05:41:ca:79:50: + 6e:82:0e:71:72:93:46:e8:9d:0d:5d:bd:ae:ce:29:ad:63:d5: + 55:16:80:30:27:ff:76:ba:f7:b8:d6:4a:e3:d9:b5:f9:52:d0: + 4e:40:a9:c7:e5:c2:32:c7:aa:76:24:e1:6b:05:50:eb:c5:bf: + 0a:54:e5:b9:42:3c:24:fb:b7:07:9c:30:9f:79:5a:e6:e0:40: + 52:15:f4:fc:aa:f4:56:f9:44:97:87:ed:0e:65:72:5e:be:26: + fb:4d:a4:2d:08:07:de:d8:5c:a0:dc:81:33:99:18:25:11:77: + a7:eb:fd:58:09:2c:99:6b:1b:8a:f3:52:3f:1a:4d:48:60:f1: + a0:f6:33:02:53:8b:ed:25:09:b8:0d:2d:ed:97:73:ec:d7:96: + 1f:8e:60:0e:da:10:9b:2f:18:24:f6:a6:4d:0a:f9:3b:cb:75: + c2:cc:2f:ce:24:69:c9:0a:22:8e:59:a7:f7:82:0c:d7:d7:6b: + 35:9c:43:00:6a:c4:95:67:ba:9c:45:cb:b8:0e:37:f7:dc:4e: + 01:4f:be:0a:b6:03:d3:ad:8a:45:f7:da:27:4d:29:b1:48:df: + e4:11:e4:96:46:bd:6c:02:3e:d6:51:c8:95:17:01:15:a9:f2: + aa:aa:f2:bf:2f:65:1b:6f:d0:b9:1a:93:f5:8e:35:c4:80:87: + 3e:94:2f:66:e4:e9:a8:ff:41:9c:70:2a:4f:2a:39:18:95:1e: + 7e:fb:61:01:3c:51:08:2e:28:18:a4:16:0f:31:fd:3a:6c:23: + 93:20:76:e1:fd:07:85:d1:5b:3f:d2:1c:73:32:dd:fa:b9:f8: + 8c:cf:02:87:7a:9a:96:e4:ed:4f:89:8d:53:43:ab:0e:13:c0: + 01:15:b4:79:38:db:fc:6e:3d:9e:51:b6:b8:13:8b:67:cf:f9: + 7c:d9:22:1d:f6:5d:c5:1c:01:2f:98:e8:7a:24:18:bc:84:d7: + fa:dc:72:5b:f7:c1:3a:68 +MD5 Fingerprint=01:5A:99:C3:D6:4F:A9:4B:3C:3B:B1:A3:AB:27:4C:BF +-----BEGIN CERTIFICATE----- +MIIF5jCCA86gAwIBAgIBATANBgkqhkiG9w0BAQUFADCBgzELMAkGA1UEBhMCVVMx +HTAbBgNVBAoTFEFPTCBUaW1lIFdhcm5lciBJbmMuMRwwGgYDVQQLExNBbWVyaWNh +IE9ubGluZSBJbmMuMTcwNQYDVQQDEy5BT0wgVGltZSBXYXJuZXIgUm9vdCBDZXJ0 +aWZpY2F0aW9uIEF1dGhvcml0eSAyMB4XDTAyMDUyOTA2MDAwMFoXDTM3MDkyODIz +NDMwMFowgYMxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRBT0wgVGltZSBXYXJuZXIg +SW5jLjEcMBoGA1UECxMTQW1lcmljYSBPbmxpbmUgSW5jLjE3MDUGA1UEAxMuQU9M +IFRpbWUgV2FybmVyIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgMjCCAiIw +DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALQ3WggWmRToVbEbJGv8x4vmh6mJ +7ouZzU9AhqS2TcnZsdw8TQ2FTBVsRotSeJ/4I/1n9SQ6aF3Q92RhQVSji6UI0ilb +m2BPJoPRYxJWSXakFsKlnUWsi4SVqBax7J/qJBrvuVdcmiQhLE0OcR+mrF1FdAOY +xFSMFkpBd4aVdQxHAWZg/BXxD+r1FHjHDtdugRxev17nOirYlxcwfACtCJ0zr7iZ +YYCLqJV+FNwSbKTQ2O9ASQI2+W6p1h2WVgSysy0WVoaP2SBXgM1nEG2wTPDaRrbq +JS5Gr42whTg0ixQmgiusrpkLjhTXUr2eacOGAgvqdnUxCc4zGSGFQ+aJLZ8lN2fx +I2rSAG2X+Z/nKcrdH9cG6rjJuQkhn8g/BsXS6RJGAE57COtCPStIbp1n3UsC5ETz +kxmlJ85per5n0/xQpCyrw2u544BMzwVhSyvcG7mm0tCq9Stz+86QNZ8MUhy/XCFh +EVsVS6kkUfykXPcXnbDS+gfpj1bkGoxoigTTfFrjnqKhynFbotSg5ymFXQNoKk/S +Btc9+cMDLz9l+WceR0DTYw/j1Y75hauXTLPXJuuWCpTehTacyH+BCQJJKg71ZDIM +gtG6aoIbs0t0EfOMd9afv9w3pKdVBC/UMejTRrkDfNoSTllkt1ExMVCgyhwn2RAu +rda9EGYrw7AiShJbAgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYE +FE9pbQN+nZ8HGEO8txBO1b+pxCAoMB8GA1UdIwQYMBaAFE9pbQN+nZ8HGEO8txBO +1b+pxCAoMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQUFAAOCAgEAO/Ouyugu +h4X7ZVnnrREUpVe8WJ8kEle7+z802u6teio0cnAxa8cZmIDJgt43d15Ui47y6mdP +yXSEkVYJ1eV6moG2gcKtNuTxVBFT8zRFASbI5Rq8NEQh3q0l/HYWdyGQgJhXnU7q +7C+qPBR7V8F+GBRn7iTGvboVsNIYvbdVgaxTwOjdaRITQrcCtQVBynlQboIOcXKT +RuidDV29rs4prWPVVRaAMCf/drr3uNZK49m1+VLQTkCpx+XCMseqdiThawVQ68W/ +ClTluUI8JPu3B5wwn3la5uBAUhX0/Kr0VvlEl4ftDmVyXr4m+02kLQgH3thcoNyB +M5kYJRF3p+v9WAksmWsbivNSPxpNSGDxoPYzAlOL7SUJuA0t7Zdz7NeWH45gDtoQ +my8YJPamTQr5O8t1wswvziRpyQoijlmn94IM19drNZxDAGrElWe6nEXLuA4399xO +AU++CrYD062KRffaJ00psUjf5BHklka9bAI+1lHIlRcBFanyqqryvy9lG2/QuRqT +9Y41xICHPpQvZuTpqP9BnHAqTyo5GJUefvthATxRCC4oGKQWDzH9OmwjkyB24f0H +hdFbP9IcczLd+rn4jM8Ch3qaluTtT4mNU0OrDhPAARW0eTjb/G49nlG2uBOLZ8/5 +fNkiHfZdxRwBL5joeiQYvITX+txyW/fBOmg= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1018510662 (0x3cb53d46) + Signature Algorithm: sha1WithRSAEncryption + Issuer: O=beTRUSTed, OU=beTRUSTed Root CAs, CN=beTRUSTed Root CA-Baltimore Implementation + Validity + Not Before: Apr 11 07:38:51 2002 GMT + Not After : Apr 11 07:38:51 2022 GMT + Subject: O=beTRUSTed, OU=beTRUSTed Root CAs, CN=beTRUSTed Root CA-Baltimore Implementation + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:bc:7e:c4:39:9c:8c:e3:d6:1c:86:ff:ca:62:ad: + e0:7f:30:45:7a:8e:1a:b3:b8:c7:f9:d1:36:ff:22: + f3:4e:6a:5f:84:10:fb:66:81:c3:94:79:31:d2:91: + e1:77:8e:18:2a:c3:14:de:51:f5:4f:a3:2b:bc:18: + 16:e2:b5:dd:79:de:22:f8:82:7e:cb:81:1f:fd:27: + 2c:8f:fa:97:64:22:8e:f8:ff:61:a3:9c:1b:1e:92: + 8f:c0:a8:09:df:09:11:ec:b7:7d:31:9a:1a:ea:83: + 21:06:3c:9f:ba:5c:ff:94:ea:6a:b8:c3:6b:55:34: + 4f:3d:32:1f:dd:81:14:e0:c4:3c:cd:9d:30:f8:30: + a9:97:d3:ee:cc:a3:d0:1f:5f:1c:13:81:d4:18:ab: + 94:d1:63:c3:9e:7f:35:92:9e:5f:44:ea:ec:f4:22: + 5c:b7:e8:3d:7d:a4:f9:89:a9:91:b2:2a:d9:eb:33: + 87:ee:a5:fd:e3:da:cc:88:e6:89:26:6e:c7:2b:82: + d0:5e:9d:59:db:14:ec:91:83:05:c3:5e:0e:c6:2a: + d0:04:dd:71:3d:20:4e:58:27:fc:53:fb:78:78:19: + 14:b2:fc:90:52:89:38:62:60:07:b4:a0:ec:ac:6b: + 50:d6:fd:b9:28:6b:ef:52:2d:3a:b2:ff:f1:01:40: + ac:37 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Certificate Policies: + Policy: 1.3.6.1.4.1.6334.0.0.1.9.40.51377 + User Notice: + Explicit Text: Reliance on or use of this Certificate creates an acknowledgment and acceptance of the then applicable standard terms and conditions of use, the Certification Practice Statement and the Relying Party Agreement, which can be found at the beTRUSTed web site, http://www.betrusted.com/products_services/index.html + CPS: http://www.betrusted.com/products_services/index.html + + X509v3 Subject Key Identifier: + 45:3D:C3:A9:D1:DC:3F:24:56:98:1C:73:18:88:6A:FF:83:47:ED:B6 + X509v3 Authority Key Identifier: + keyid:45:3D:C3:A9:D1:DC:3F:24:56:98:1C:73:18:88:6A:FF:83:47:ED:B6 + + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + Signature Algorithm: sha1WithRSAEncryption + 49:92:bc:a3:ee:ac:bd:fa:0d:c9:8b:79:86:1c:23:76:b0:80: + 59:77:fc:da:7f:b4:4b:df:c3:64:4b:6a:4e:0e:ad:f2:7d:59: + 77:05:ad:0a:89:73:b0:fa:bc:cb:dc:8d:00:88:8f:a6:a0:b2: + ea:ac:52:27:bf:a1:48:7c:97:10:7b:ba:ed:13:1d:9a:07:6e: + cb:31:62:12:e8:63:03:aa:7d:6d:e3:f8:1b:76:21:78:1b:9f: + 4b:43:8c:d3:49:86:f6:1b:5c:f6:2e:60:15:d3:e9:e3:7b:75: + 3f:d0:02:83:d0:18:82:41:cd:65:37:ea:8e:32:7e:bd:6b:99: + 5d:30:11:c8:db:48:54:1c:3b:e1:a7:13:d3:6a:48:93:f7:3d: + 8c:7f:05:e8:ce:f3:88:2a:63:04:b8:ea:7e:58:7c:01:7b:5b: + e1:c5:7d:ef:21:e0:8d:0e:5d:51:7d:b1:67:fd:a3:bd:38:36: + c6:f2:38:86:87:1a:96:68:60:46:fb:28:14:47:55:e1:a7:80: + 0c:6b:e2:ea:df:4d:7c:90:48:a0:36:bd:09:17:89:7f:c3:f2: + d3:9c:9c:e3:dd:c4:1b:dd:f5:b7:71:b3:53:05:89:06:d0:cb: + 4a:80:c1:c8:53:90:b5:3c:31:88:17:50:9f:c9:c4:0e:8b:d8: + a8:02:63:0d +MD5 Fingerprint=81:35:B9:FB:FB:12:CA:18:69:36:EB:AE:69:78:A1:F1 +-----BEGIN CERTIFICATE----- +MIIFajCCBFKgAwIBAgIEPLU9RjANBgkqhkiG9w0BAQUFADBmMRIwEAYDVQQKEwli +ZVRSVVNUZWQxGzAZBgNVBAsTEmJlVFJVU1RlZCBSb290IENBczEzMDEGA1UEAxMq +YmVUUlVTVGVkIFJvb3QgQ0EtQmFsdGltb3JlIEltcGxlbWVudGF0aW9uMB4XDTAy +MDQxMTA3Mzg1MVoXDTIyMDQxMTA3Mzg1MVowZjESMBAGA1UEChMJYmVUUlVTVGVk +MRswGQYDVQQLExJiZVRSVVNUZWQgUm9vdCBDQXMxMzAxBgNVBAMTKmJlVFJVU1Rl +ZCBSb290IENBLUJhbHRpbW9yZSBJbXBsZW1lbnRhdGlvbjCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBALx+xDmcjOPWHIb/ymKt4H8wRXqOGrO4x/nRNv8i +805qX4QQ+2aBw5R5MdKR4XeOGCrDFN5R9U+jK7wYFuK13XneIviCfsuBH/0nLI/6 +l2Qijvj/YaOcGx6Sj8CoCd8JEey3fTGaGuqDIQY8n7pc/5TqarjDa1U0Tz0yH92B +FODEPM2dMPgwqZfT7syj0B9fHBOB1BirlNFjw55/NZKeX0Tq7PQiXLfoPX2k+Ymp +kbIq2eszh+6l/ePazIjmiSZuxyuC0F6dWdsU7JGDBcNeDsYq0ATdcT0gTlgn/FP7 +eHgZFLL8kFKJOGJgB7Sg7KxrUNb9uShr71ItOrL/8QFArDcCAwEAAaOCAh4wggIa +MA8GA1UdEwEB/wQFMAMBAf8wggG1BgNVHSAEggGsMIIBqDCCAaQGDysGAQQBsT4A +AAEJKIORMTCCAY8wggFIBggrBgEFBQcCAjCCAToaggE2UmVsaWFuY2Ugb24gb3Ig +dXNlIG9mIHRoaXMgQ2VydGlmaWNhdGUgY3JlYXRlcyBhbiBhY2tub3dsZWRnbWVu +dCBhbmQgYWNjZXB0YW5jZSBvZiB0aGUgdGhlbiBhcHBsaWNhYmxlIHN0YW5kYXJk +IHRlcm1zIGFuZCBjb25kaXRpb25zIG9mIHVzZSwgdGhlIENlcnRpZmljYXRpb24g +UHJhY3RpY2UgU3RhdGVtZW50IGFuZCB0aGUgUmVseWluZyBQYXJ0eSBBZ3JlZW1l +bnQsIHdoaWNoIGNhbiBiZSBmb3VuZCBhdCB0aGUgYmVUUlVTVGVkIHdlYiBzaXRl +LCBodHRwOi8vd3d3LmJldHJ1c3RlZC5jb20vcHJvZHVjdHNfc2VydmljZXMvaW5k +ZXguaHRtbDBBBggrBgEFBQcCARY1aHR0cDovL3d3dy5iZXRydXN0ZWQuY29tL3By +b2R1Y3RzX3NlcnZpY2VzL2luZGV4Lmh0bWwwHQYDVR0OBBYEFEU9w6nR3D8kVpgc +cxiIav+DR+22MB8GA1UdIwQYMBaAFEU9w6nR3D8kVpgccxiIav+DR+22MA4GA1Ud +DwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOCAQEASZK8o+6svfoNyYt5hhwjdrCA +WXf82n+0S9/DZEtqTg6t8n1ZdwWtColzsPq8y9yNAIiPpqCy6qxSJ7+hSHyXEHu6 +7RMdmgduyzFiEuhjA6p9beP4G3YheBufS0OM00mG9htc9i5gFdPp43t1P9ACg9AY +gkHNZTfqjjJ+vWuZXTARyNtIVBw74acT02pIk/c9jH8F6M7ziCpjBLjqflh8AXtb +4cV97yHgjQ5dUX2xZ/2jvTg2xvI4hocalmhgRvsoFEdV4aeADGvi6t9NfJBIoDa9 +CReJf8Py05yc493EG931t3GzUwWJBtDLSoDByFOQtTwxiBdQn8nEDovYqAJjDQ== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1018515264 (0x3cb54f40) + Signature Algorithm: sha1WithRSAEncryption + Issuer: O=beTRUSTed, OU=beTRUSTed Root CAs, CN=beTRUSTed Root CA - Entrust Implementation + Validity + Not Before: Apr 11 08:24:27 2002 GMT + Not After : Apr 11 08:54:27 2022 GMT + Subject: O=beTRUSTed, OU=beTRUSTed Root CAs, CN=beTRUSTed Root CA - Entrust Implementation + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:ba:f4:44:03:aa:12:6a:b5:43:ec:55:92:b6:30: + 7d:35:57:0c:db:f3:0d:27:6e:4c:f7:50:a8:9b:4e: + 2b:6f:db:f5:ad:1c:4b:5d:b3:a9:c1:fe:7b:44:eb: + 5b:a3:05:0d:1f:c5:34:2b:30:00:29:f1:78:40:b2: + a4:ff:3a:f4:01:88:17:7e:e6:d4:26:d3:ba:4c:ea: + 32:fb:43:77:97:87:23:c5:db:43:a3:f5:2a:a3:51: + 5e:e1:3b:d2:65:69:7e:55:15:9b:7a:e7:69:f7:44: + e0:57:b5:15:e8:66:60:0f:0d:03:fb:82:8e:a3:e8: + 11:7b:6c:be:c7:63:0e:17:93:df:cf:4b:ae:6e:73: + 75:e0:f3:aa:b9:a4:c0:09:1b:85:ea:71:29:88:41: + 32:f9:f0:2a:0e:6c:09:f2:74:6b:66:6c:52:13:1f: + 18:bc:d4:3e:f7:d8:6e:20:9e:ca:fe:fc:21:94:ee: + 13:28:4b:d7:5c:5e:0c:66:ee:e9:bb:0f:c1:34:b1: + 7f:08:76:f3:3d:26:70:c9:8b:25:1d:62:24:0c:ea: + 1c:75:4e:c0:12:e4:ba:13:1d:30:29:2d:56:33:05: + bb:97:59:7e:c6:49:4f:89:d7:2f:24:a8:b6:88:40: + b5:64:92:53:56:24:e4:a2:a0:85:b3:5e:90:b4:12: + 33:cd + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Certificate Policies: + Policy: 1.3.6.1.4.1.6334.0.0.2.9.40.51377 + User Notice: + Explicit Text: Reliance on or use of this Certificate creates an acknowledgment and acceptance of the then applicable standard terms and conditions of use, the Certification Practice Statement and the Relying Party Agreement, which can be found at the beTRUSTed web site, https://www.betrusted.com/products_services/index.html + CPS: https://www.betrusted.com/products_services/index.html + + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 CRL Distribution Points: + DirName:/O=beTRUSTed/OU=beTRUSTed Root CAs/CN=beTRUSTed Root CA - Entrust Implementation/CN=CRL1 + + X509v3 Private Key Usage Period: + Not Before: Apr 11 08:24:27 2002 GMT, Not After: Apr 11 08:54:27 2022 GMT + X509v3 Key Usage: + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:7D:70:E5:AE:38:8B:06:3F:AA:1C:1A:8F:F9:CF:24:30:AA:84:84:16 + + X509v3 Subject Key Identifier: + 7D:70:E5:AE:38:8B:06:3F:AA:1C:1A:8F:F9:CF:24:30:AA:84:84:16 + X509v3 Basic Constraints: + CA:TRUE + 1.2.840.113533.7.65.0: + 0...V6.0:4.0.... + Signature Algorithm: sha1WithRSAEncryption + 2a:b8:17:ce:1f:10:94:eb:b8:9a:b7:b9:5f:ec:da:f7:92:24: + ac:dc:92:3b:c7:20:8d:f2:99:e5:5d:38:a1:c2:34:ed:c5:13: + 59:5c:05:b5:2b:4f:61:9b:91:fb:41:fc:fc:d5:3c:4d:98:76: + 06:f5:81:7d:eb:dd:90:e6:d1:56:54:da:e3:2d:0c:9f:11:32: + 94:22:01:7a:f6:6c:2c:74:67:04:cc:a5:8f:8e:2c:b3:43:b5: + 94:a2:d0:7d:e9:62:7f:06:be:27:01:83:9e:3a:fd:8a:ee:98: + 43:4a:6b:d7:b5:97:3b:3a:bf:4f:6d:b4:63:fa:33:00:34:2e: + 2d:6d:96:c9:7b:ca:99:63:ba:be:f4:f6:30:a0:2d:98:96:e9: + 56:44:05:a9:44:a3:61:10:eb:82:a1:67:5d:bc:5d:27:75:aa: + 8a:28:36:2a:38:92:d9:dd:a4:5e:00:a5:cc:cc:7c:29:2a:de: + 28:90:ab:b7:e1:b6:ff:7d:25:0b:40:d8:aa:34:a3:2d:de:07: + eb:5f:ce:0a:dd:ca:7e:3a:7d:26:c1:62:68:3a:e6:2f:37:f3: + 81:86:21:c4:a9:64:aa:ef:45:36:d1:1a:66:7c:f8:e9:37:d6: + d6:61:be:a2:ad:48:e7:df:e6:74:fe:d3:6d:7d:d2:25:dc:ac: + 62:57:a9:f7 +MD5 Fingerprint=7D:86:90:8F:5B:F1:F2:40:C0:F7:3D:62:B5:A4:A9:3B +-----BEGIN CERTIFICATE----- +MIIGUTCCBTmgAwIBAgIEPLVPQDANBgkqhkiG9w0BAQUFADBmMRIwEAYDVQQKEwli +ZVRSVVNUZWQxGzAZBgNVBAsTEmJlVFJVU1RlZCBSb290IENBczEzMDEGA1UEAxMq +YmVUUlVTVGVkIFJvb3QgQ0EgLSBFbnRydXN0IEltcGxlbWVudGF0aW9uMB4XDTAy +MDQxMTA4MjQyN1oXDTIyMDQxMTA4NTQyN1owZjESMBAGA1UEChMJYmVUUlVTVGVk +MRswGQYDVQQLExJiZVRSVVNUZWQgUm9vdCBDQXMxMzAxBgNVBAMTKmJlVFJVU1Rl +ZCBSb290IENBIC0gRW50cnVzdCBJbXBsZW1lbnRhdGlvbjCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBALr0RAOqEmq1Q+xVkrYwfTVXDNvzDSduTPdQqJtO +K2/b9a0cS12zqcH+e0TrW6MFDR/FNCswACnxeECypP869AGIF37m1CbTukzqMvtD +d5eHI8XbQ6P1KqNRXuE70mVpflUVm3rnafdE4Fe1FehmYA8NA/uCjqPoEXtsvsdj +DheT389Lrm5zdeDzqrmkwAkbhepxKYhBMvnwKg5sCfJ0a2ZsUhMfGLzUPvfYbiCe +yv78IZTuEyhL11xeDGbu6bsPwTSxfwh28z0mcMmLJR1iJAzqHHVOwBLkuhMdMCkt +VjMFu5dZfsZJT4nXLySotohAtWSSU1Yk5KKghbNekLQSM80CAwEAAaOCAwUwggMB +MIIBtwYDVR0gBIIBrjCCAaowggGmBg8rBgEEAbE+AAACCSiDkTEwggGRMIIBSQYI +KwYBBQUHAgIwggE7GoIBN1JlbGlhbmNlIG9uIG9yIHVzZSBvZiB0aGlzIENlcnRp +ZmljYXRlIGNyZWF0ZXMgYW4gYWNrbm93bGVkZ21lbnQgYW5kIGFjY2VwdGFuY2Ug +b2YgdGhlIHRoZW4gYXBwbGljYWJsZSBzdGFuZGFyZCB0ZXJtcyBhbmQgY29uZGl0 +aW9ucyBvZiB1c2UsIHRoZSBDZXJ0aWZpY2F0aW9uIFByYWN0aWNlIFN0YXRlbWVu +dCBhbmQgdGhlIFJlbHlpbmcgUGFydHkgQWdyZWVtZW50LCB3aGljaCBjYW4gYmUg +Zm91bmQgYXQgdGhlIGJlVFJVU1RlZCB3ZWIgc2l0ZSwgaHR0cHM6Ly93d3cuYmV0 +cnVzdGVkLmNvbS9wcm9kdWN0c19zZXJ2aWNlcy9pbmRleC5odG1sMEIGCCsGAQUF +BwIBFjZodHRwczovL3d3dy5iZXRydXN0ZWQuY29tL3Byb2R1Y3RzX3NlcnZpY2Vz +L2luZGV4Lmh0bWwwEQYJYIZIAYb4QgEBBAQDAgAHMIGJBgNVHR8EgYEwfzB9oHug +eaR3MHUxEjAQBgNVBAoTCWJlVFJVU1RlZDEbMBkGA1UECxMSYmVUUlVTVGVkIFJv +b3QgQ0FzMTMwMQYDVQQDEypiZVRSVVNUZWQgUm9vdCBDQSAtIEVudHJ1c3QgSW1w +bGVtZW50YXRpb24xDTALBgNVBAMTBENSTDEwKwYDVR0QBCQwIoAPMjAwMjA0MTEw +ODI0MjdagQ8yMDIyMDQxMTA4NTQyN1owCwYDVR0PBAQDAgEGMB8GA1UdIwQYMBaA +FH1w5a44iwY/qhwaj/nPJDCqhIQWMB0GA1UdDgQWBBR9cOWuOIsGP6ocGo/5zyQw +qoSEFjAMBgNVHRMEBTADAQH/MB0GCSqGSIb2fQdBAAQQMA4bCFY2LjA6NC4wAwIE +kDANBgkqhkiG9w0BAQUFAAOCAQEAKrgXzh8QlOu4mre5X+za95IkrNySO8cgjfKZ +5V04ocI07cUTWVwFtStPYZuR+0H8/NU8TZh2BvWBfevdkObRVlTa4y0MnxEylCIB +evZsLHRnBMylj44ss0O1lKLQfelifwa+JwGDnjr9iu6YQ0pr17WXOzq/T220Y/oz +ADQuLW2WyXvKmWO6vvT2MKAtmJbpVkQFqUSjYRDrgqFnXbxdJ3Wqiig2KjiS2d2k +XgClzMx8KSreKJCrt+G2/30lC0DYqjSjLd4H61/OCt3Kfjp9JsFiaDrmLzfzgYYh +xKlkqu9FNtEaZnz46TfW1mG+oq1I59/mdP7TbX3SJdysYlep9w== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 3b:59:c7:7b:cd:5b:57:9e:bd:37:52:ac:76:b4:aa:1a + Signature Algorithm: sha1WithRSAEncryption + Issuer: O=beTRUSTed, OU=beTRUSTed Root CAs, CN=beTRUSTed Root CA - RSA Implementation + Validity + Not Before: Apr 11 11:18:13 2002 GMT + Not After : Apr 12 11:07:25 2022 GMT + Subject: O=beTRUSTed, OU=beTRUSTed Root CAs, CN=beTRUSTed Root CA - RSA Implementation + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:e4:ba:34:30:09:8e:57:d0:b9:06:2c:6f:6e:24: + 80:22:bf:5d:43:a6:fa:4f:ac:82:e7:1c:68:70:85: + 1b:a3:6e:b5:aa:78:d9:6e:07:4b:3f:e9:df:f5:ea: + e8:54:a1:61:8a:0e:2f:69:75:18:b7:0c:e5:14:8d: + 71:6e:98:b8:55:fc:0c:95:d0:9b:6e:e1:2d:88:d4: + 3a:40:6b:92:f1:99:96:64:de:db:ff:78:f4:ee:96: + 1d:47:89:7c:d4:be:b9:88:77:23:3a:09:e6:04:9e: + 6d:aa:5e:d2:c8:bd:9a:4e:19:df:89:ea:5b:0e:7e: + c3:e4:b4:f0:e0:69:3b:88:0f:41:90:f8:d4:71:43: + 24:c1:8f:26:4b:3b:56:e9:ff:8c:6c:37:e9:45:ad: + 85:8c:53:c3:60:86:90:4a:96:c9:b3:54:b0:bb:17: + f0:1c:45:d9:d4:1b:19:64:56:0a:19:f7:cc:e1:ff: + 86:af:7e:58:5e:ac:7a:90:1f:c9:28:39:45:7b:a2: + b6:c7:9c:1f:da:85:d4:21:86:59:30:93:be:53:33: + 37:f6:ef:41:cf:33:c7:ab:72:6b:25:f5:f3:53:1b: + 0c:4c:2e:f1:75:4b:ef:a0:87:f7:fe:8a:15:d0:6c: + d5:cb:f9:68:53:b9:70:15:13:c2:f5:2e:fb:43:35: + 75:2d + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: + CA:TRUE + X509v3 Certificate Policies: + Policy: 1.3.6.1.4.1.6334.0.0.3.9.40.51377 + CPS: http://www.betrusted.com/products_services/index.html + User Notice: + Explicit Text: Reliance on or use of this Certificate creates an acknowledgment and acceptance of the then applicable standard terms and conditions of use, the Certification Practice Statement and the Relying Party Agreement, which can be found at the beTRUSTed web site, http://www.betrusted.com/products_services/index.html + + X509v3 Key Usage: + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:A9:EC:14:7E:F9:D9:43:CC:53:2B:14:AD:CF:F7:F0:59:89:41:CD:19 + + X509v3 Subject Key Identifier: + A9:EC:14:7E:F9:D9:43:CC:53:2B:14:AD:CF:F7:F0:59:89:41:CD:19 + Signature Algorithm: sha1WithRSAEncryption + db:97:b0:75:ea:0c:c4:c1:98:ca:56:05:c0:a8:ad:26:48:af: + 2d:20:e8:81:c7:b6:df:43:c1:2c:1d:75:4b:d4:42:8d:e7:7a: + a8:74:dc:66:42:59:87:b3:f5:69:6d:d9:a9:9e:b3:7d:1c:31: + c1:f5:54:e2:59:24:49:e5:ee:bd:39:a6:6b:8a:98:44:fb:9b: + d7:2a:83:97:34:2d:c7:7d:35:4c:2d:34:b8:3e:0d:c4:ec:88: + 27:af:9e:92:fd:50:61:82:a8:60:07:14:53:cc:65:13:c1:f6: + 47:44:69:d2:31:c8:a6:dd:2e:b3:0b:de:4a:8d:5b:3d:ab:0d: + c2:35:52:a2:56:37:cc:32:8b:28:85:42:9c:91:40:7a:70:2b: + 38:36:d5:e1:73:1a:1f:e5:fa:7e:5f:dc:d6:9c:3b:30:ea:db: + c0:5b:27:5c:d3:73:07:c1:c2:f3:4c:9b:6f:9f:1b:ca:1e:aa: + a8:38:33:09:58:b2:ae:fc:07:e8:36:dc:55:ba:2f:4f:40:fe: + 7a:bd:06:a6:81:c1:93:22:7c:86:11:0a:06:77:48:ae:35:b7: + 2f:32:9a:61:5e:8b:be:29:9f:29:24:88:56:39:2c:a8:d2:ab: + 96:03:5a:d4:48:9f:b9:40:84:0b:98:68:fb:01:43:d6:1b:e2: + 09:b1:97:1c +MD5 Fingerprint=86:42:05:09:BC:A7:9D:EC:1D:F3:2E:0E:BA:D8:1D:D0 +-----BEGIN CERTIFICATE----- +MIIFaDCCBFCgAwIBAgIQO1nHe81bV569N1KsdrSqGjANBgkqhkiG9w0BAQUFADBi +MRIwEAYDVQQKEwliZVRSVVNUZWQxGzAZBgNVBAsTEmJlVFJVU1RlZCBSb290IENB +czEvMC0GA1UEAxMmYmVUUlVTVGVkIFJvb3QgQ0EgLSBSU0EgSW1wbGVtZW50YXRp +b24wHhcNMDIwNDExMTExODEzWhcNMjIwNDEyMTEwNzI1WjBiMRIwEAYDVQQKEwli +ZVRSVVNUZWQxGzAZBgNVBAsTEmJlVFJVU1RlZCBSb290IENBczEvMC0GA1UEAxMm +YmVUUlVTVGVkIFJvb3QgQ0EgLSBSU0EgSW1wbGVtZW50YXRpb24wggEiMA0GCSqG +SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkujQwCY5X0LkGLG9uJIAiv11DpvpPrILn +HGhwhRujbrWqeNluB0s/6d/16uhUoWGKDi9pdRi3DOUUjXFumLhV/AyV0Jtu4S2I +1DpAa5LxmZZk3tv/ePTulh1HiXzUvrmIdyM6CeYEnm2qXtLIvZpOGd+J6lsOfsPk +tPDgaTuID0GQ+NRxQyTBjyZLO1bp/4xsN+lFrYWMU8NghpBKlsmzVLC7F/AcRdnU +GxlkVgoZ98zh/4avflherHqQH8koOUV7orbHnB/ahdQhhlkwk75TMzf270HPM8er +cmsl9fNTGwxMLvF1S++gh/f+ihXQbNXL+WhTuXAVE8L1LvtDNXUtAgMBAAGjggIY +MIICFDAMBgNVHRMEBTADAQH/MIIBtQYDVR0gBIIBrDCCAagwggGkBg8rBgEEAbE+ +AAADCSiDkTEwggGPMEEGCCsGAQUFBwIBFjVodHRwOi8vd3d3LmJldHJ1c3RlZC5j +b20vcHJvZHVjdHNfc2VydmljZXMvaW5kZXguaHRtbDCCAUgGCCsGAQUFBwICMIIB +OhqCATZSZWxpYW5jZSBvbiBvciB1c2Ugb2YgdGhpcyBDZXJ0aWZpY2F0ZSBjcmVh +dGVzIGFuIGFja25vd2xlZGdtZW50IGFuZCBhY2NlcHRhbmNlIG9mIHRoZSB0aGVu +IGFwcGxpY2FibGUgc3RhbmRhcmQgdGVybXMgYW5kIGNvbmRpdGlvbnMgb2YgdXNl +LCB0aGUgQ2VydGlmaWNhdGlvbiBQcmFjdGljZSBTdGF0ZW1lbnQgYW5kIHRoZSBS +ZWx5aW5nIFBhcnR5IEFncmVlbWVudCwgd2hpY2ggY2FuIGJlIGZvdW5kIGF0IHRo +ZSBiZVRSVVNUZWQgd2ViIHNpdGUsIGh0dHA6Ly93d3cuYmV0cnVzdGVkLmNvbS9w +cm9kdWN0c19zZXJ2aWNlcy9pbmRleC5odG1sMAsGA1UdDwQEAwIBBjAfBgNVHSME +GDAWgBSp7BR++dlDzFMrFK3P9/BZiUHNGTAdBgNVHQ4EFgQUqewUfvnZQ8xTKxSt +z/fwWYlBzRkwDQYJKoZIhvcNAQEFBQADggEBANuXsHXqDMTBmMpWBcCorSZIry0g +6IHHtt9DwSwddUvUQo3neqh03GZCWYez9Wlt2ames30cMcH1VOJZJEnl7r05pmuK +mET7m9cqg5c0Lcd9NUwtNLg+DcTsiCevnpL9UGGCqGAHFFPMZRPB9kdEadIxyKbd +LrML3kqNWz2rDcI1UqJWN8wyiyiFQpyRQHpwKzg21eFzGh/l+n5f3NacOzDq28Bb +J1zTcwfBwvNMm2+fG8oeqqg4MwlYsq78B+g23FW6L09A/nq9BqaBwZMifIYRCgZ3 +SK41ty8ymmFei74pnykkiFY5LKjSq5YDWtRIn7lAhAuYaPsBQ9Yb4gmxlxw= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 0a:01:01:01:00:00:02:7c:00:00:00:0a:00:00:00:02 + Signature Algorithm: sha1WithRSAEncryption + Issuer: O=RSA Security Inc, OU=RSA Security 2048 V3 + Validity + Not Before: Feb 22 20:39:23 2001 GMT + Not After : Feb 22 20:39:23 2026 GMT + Subject: O=RSA Security Inc, OU=RSA Security 2048 V3 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:b7:8f:55:71:d2:80:dd:7b:69:79:a7:f0:18:50: + 32:3c:62:67:f6:0a:95:07:dd:e6:1b:f3:9e:d9:d2: + 41:54:6b:ad:9f:7c:be:19:cd:fb:46:ab:41:68:1e: + 18:ea:55:c8:2f:91:78:89:28:fb:27:29:60:ff:df: + 8f:8c:3b:c9:49:9b:b5:a4:94:ce:01:ea:3e:b5:63: + 7b:7f:26:fd:19:dd:c0:21:bd:84:d1:2d:4f:46:c3: + 4e:dc:d8:37:39:3b:28:af:cb:9d:1a:ea:2b:af:21: + a5:c1:23:22:b8:b8:1b:5a:13:87:57:83:d1:f0:20: + e7:e8:4f:23:42:b0:00:a5:7d:89:e9:e9:61:73:94: + 98:71:26:bc:2d:6a:e0:f7:4d:f0:f1:b6:2a:38:31: + 81:0d:29:e1:00:c1:51:0f:4c:52:f8:04:5a:aa:7d: + 72:d3:b8:87:2a:bb:63:10:03:2a:b3:a1:4f:0d:5a: + 5e:46:b7:3d:0e:f5:74:ec:99:9f:f9:3d:24:81:88: + a6:dd:60:54:e8:95:36:3d:c6:09:93:9a:a3:12:80: + 00:55:99:19:47:bd:d0:a5:7c:c3:ba:fb:1f:f7:f5: + 0f:f8:ac:b9:b5:f4:37:98:13:18:de:85:5b:b7:0c: + 82:3b:87:6f:95:39:58:30:da:6e:01:68:17:22:cc: + c0:0b + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:07:C3:51:30:A4:AA:E9:45:AE:35:24:FA:FF:24:2C:33:D0:B1:9D:8C + + X509v3 Subject Key Identifier: + 07:C3:51:30:A4:AA:E9:45:AE:35:24:FA:FF:24:2C:33:D0:B1:9D:8C + Signature Algorithm: sha1WithRSAEncryption + 5f:3e:86:76:6e:b8:35:3c:4e:36:1c:1e:79:98:bf:fd:d5:12: + 11:79:52:0e:ee:31:89:bc:dd:7f:f9:d1:c6:15:21:e8:8a:01: + 54:0d:3a:fb:54:b9:d6:63:d4:b1:aa:96:4d:a2:42:4d:d4:53: + 1f:8b:10:de:7f:65:be:60:13:27:71:88:a4:73:e3:84:63:d1: + a4:55:e1:50:93:e6:1b:0e:79:d0:67:bc:46:c8:bf:3f:17:0d: + 95:e6:c6:90:69:de:e7:b4:2f:de:95:7d:d0:12:3f:3d:3e:7f: + 4d:3f:14:68:f5:11:50:d5:c1:f4:90:a5:08:1d:31:60:ff:60: + 8c:23:54:0a:af:fe:a1:6e:c5:d1:7a:2a:68:78:cf:1e:82:0a: + 20:b4:1f:ad:e5:85:b2:6a:68:75:4e:ad:25:37:94:85:be:bd: + a1:d4:ea:b7:0c:4b:3c:9d:e8:12:00:f0:5f:ac:0d:e1:ac:70: + 63:73:f7:7f:79:9f:32:25:42:74:05:80:28:bf:bd:c1:24:96: + 58:15:b1:17:21:e9:89:4b:db:07:88:67:f4:15:ad:70:3e:2f: + 4d:85:3b:c2:b7:db:fe:98:68:23:89:e1:74:0f:de:f4:c5:84: + 63:29:1b:cc:cb:07:c9:00:a4:a9:d7:c2:22:4f:67:d7:77:ec: + 20:05:61:de +MD5 Fingerprint=77:0D:19:B1:21:FD:00:42:9C:3E:0C:A5:DD:0B:02:8E +-----BEGIN CERTIFICATE----- +MIIDYTCCAkmgAwIBAgIQCgEBAQAAAnwAAAAKAAAAAjANBgkqhkiG9w0BAQUFADA6 +MRkwFwYDVQQKExBSU0EgU2VjdXJpdHkgSW5jMR0wGwYDVQQLExRSU0EgU2VjdXJp +dHkgMjA0OCBWMzAeFw0wMTAyMjIyMDM5MjNaFw0yNjAyMjIyMDM5MjNaMDoxGTAX +BgNVBAoTEFJTQSBTZWN1cml0eSBJbmMxHTAbBgNVBAsTFFJTQSBTZWN1cml0eSAy +MDQ4IFYzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt49VcdKA3Xtp +eafwGFAyPGJn9gqVB93mG/Oe2dJBVGutn3y+Gc37RqtBaB4Y6lXIL5F4iSj7Jylg +/9+PjDvJSZu1pJTOAeo+tWN7fyb9Gd3AIb2E0S1PRsNO3Ng3OTsor8udGuorryGl +wSMiuLgbWhOHV4PR8CDn6E8jQrAApX2J6elhc5SYcSa8LWrg903w8bYqODGBDSnh +AMFRD0xS+ARaqn1y07iHKrtjEAMqs6FPDVpeRrc9DvV07Jmf+T0kgYim3WBU6JU2 +PcYJk5qjEoAAVZkZR73QpXzDuvsf9/UP+Ky5tfQ3mBMY3oVbtwyCO4dvlTlYMNpu +AWgXIszACwIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB +BjAfBgNVHSMEGDAWgBQHw1EwpKrpRa41JPr/JCwz0LGdjDAdBgNVHQ4EFgQUB8NR +MKSq6UWuNST6/yQsM9CxnYwwDQYJKoZIhvcNAQEFBQADggEBAF8+hnZuuDU8TjYc +HnmYv/3VEhF5Ug7uMYm83X/50cYVIeiKAVQNOvtUudZj1LGqlk2iQk3UUx+LEN5/ +Zb5gEydxiKRz44Rj0aRV4VCT5hsOedBnvEbIvz8XDZXmxpBp3ue0L96VfdASPz0+ +f00/FGj1EVDVwfSQpQgdMWD/YIwjVAqv/qFuxdF6Kmh4zx6CCiC0H63lhbJqaHVO +rSU3lIW+vaHU6rcMSzyd6BIA8F+sDeGscGNz9395nzIlQnQFgCi/vcEkllgVsRch +6YlL2weIZ/QVrXA+L02FO8K32/6YaCOJ4XQP3vTFhGMpG8zLB8kApKnXwiJPZ9d3 +7CAFYd4= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 0a:01:01:01:00:00:02:7c:00:00:00:0b:00:00:00:02 + Signature Algorithm: sha1WithRSAEncryption + Issuer: O=RSA Security Inc, OU=RSA Security 1024 V3 + Validity + Not Before: Feb 22 21:01:49 2001 GMT + Not After : Feb 22 20:01:49 2026 GMT + Subject: O=RSA Security Inc, OU=RSA Security 1024 V3 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:d5:dd:fe:66:09:cf:24:3c:3e:ae:81:4e:4e:8a: + c4:69:80:5b:59:3b:df:b9:4d:4c:ca:b5:2d:c3:27: + 2d:3c:af:00:42:6d:bc:28:a6:96:cf:7f:d7:58:ac: + 83:0a:a3:55:b5:7b:17:90:15:84:4c:8a:ee:26:99: + dc:58:ef:c7:38:a6:aa:af:d0:8e:42:c8:62:d7:ab: + ac:a9:fb:4a:7d:bf:ea:fe:12:4d:dd:ff:26:2d:6f: + 36:54:68:c8:d2:84:56:ee:92:53:61:09:b3:3f:39: + 9b:a8:c9:9b:bd:ce:9f:7e:d4:19:6a:16:29:18:be: + d7:3a:69:dc:25:5b:33:1a:51 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:C4:C0:1C:A4:07:94:FD:CD:4D:01:D4:54:DA:A5:0C:5F:DE:AE:05:5A + + X509v3 Subject Key Identifier: + C4:C0:1C:A4:07:94:FD:CD:4D:01:D4:54:DA:A5:0C:5F:DE:AE:05:5A + Signature Algorithm: sha1WithRSAEncryption + 3f:2d:6a:e3:26:43:95:7d:89:97:65:fb:75:e4:72:1d:46:57: + c4:61:6b:69:9f:12:9b:2c:d5:5a:e8:c0:a2:f0:43:95:e3:1f: + e9:76:cd:dc:eb:bc:93:a0:65:0a:c7:4d:4f:5f:a7:af:a2:46: + 14:b9:0c:f3:cc:bd:6a:6e:b7:9d:de:25:42:d0:54:ff:9e:68: + 73:63:dc:24:eb:22:bf:a8:72:f2:5e:00:e1:0d:4e:3a:43:6e: + 99:4e:3f:89:78:03:98:ca:f3:55:cc:9d:ae:8e:c1:aa:45:98: + fa:8f:1a:a0:8d:88:23:f1:15:41:0d:a5:46:3e:91:3f:8b:eb: + f7:71 +MD5 Fingerprint=3A:E5:50:B0:39:BE:C7:46:36:33:A1:FE:82:3E:8D:94 +-----BEGIN CERTIFICATE----- +MIICXDCCAcWgAwIBAgIQCgEBAQAAAnwAAAALAAAAAjANBgkqhkiG9w0BAQUFADA6 +MRkwFwYDVQQKExBSU0EgU2VjdXJpdHkgSW5jMR0wGwYDVQQLExRSU0EgU2VjdXJp +dHkgMTAyNCBWMzAeFw0wMTAyMjIyMTAxNDlaFw0yNjAyMjIyMDAxNDlaMDoxGTAX +BgNVBAoTEFJTQSBTZWN1cml0eSBJbmMxHTAbBgNVBAsTFFJTQSBTZWN1cml0eSAx +MDI0IFYzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDV3f5mCc8kPD6ugU5O +isRpgFtZO9+5TUzKtS3DJy08rwBCbbwoppbPf9dYrIMKo1W1exeQFYRMiu4mmdxY +78c4pqqv0I5CyGLXq6yp+0p9v+r+Ek3d/yYtbzZUaMjShFbuklNhCbM/OZuoyZu9 +zp9+1BlqFikYvtc6adwlWzMaUQIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MA4G +A1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBTEwBykB5T9zU0B1FTapQxf3q4FWjAd +BgNVHQ4EFgQUxMAcpAeU/c1NAdRU2qUMX96uBVowDQYJKoZIhvcNAQEFBQADgYEA +Py1q4yZDlX2Jl2X7deRyHUZXxGFraZ8SmyzVWujAovBDleMf6XbN3Ou8k6BlCsdN +T1+nr6JGFLkM88y9am63nd4lQtBU/55oc2PcJOsiv6hy8l4A4Q1OOkNumU4/iXgD +mMrzVcydro7BqkWY+o8aoI2II/EVQQ2lRj6RP4vr93E= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 144470 (0x23456) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA + Validity + Not Before: May 21 04:00:00 2002 GMT + Not After : May 21 04:00:00 2022 GMT + Subject: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:da:cc:18:63:30:fd:f4:17:23:1a:56:7e:5b:df: + 3c:6c:38:e4:71:b7:78:91:d4:bc:a1:d8:4c:f8:a8: + 43:b6:03:e9:4d:21:07:08:88:da:58:2f:66:39:29: + bd:05:78:8b:9d:38:e8:05:b7:6a:7e:71:a4:e6:c4: + 60:a6:b0:ef:80:e4:89:28:0f:9e:25:d6:ed:83:f3: + ad:a6:91:c7:98:c9:42:18:35:14:9d:ad:98:46:92: + 2e:4f:ca:f1:87:43:c1:16:95:57:2d:50:ef:89:2d: + 80:7a:57:ad:f2:ee:5f:6b:d2:00:8d:b9:14:f8:14: + 15:35:d9:c0:46:a3:7b:72:c8:91:bf:c9:55:2b:cd: + d0:97:3e:9c:26:64:cc:df:ce:83:19:71:ca:4e:e6: + d4:d5:7b:a9:19:cd:55:de:c8:ec:d2:5e:38:53:e5: + 5c:4f:8c:2d:fe:50:23:36:fc:66:e6:cb:8e:a4:39: + 19:00:b7:95:02:39:91:0b:0e:fe:38:2e:d1:1d:05: + 9a:f6:4d:3e:6f:0f:07:1d:af:2c:1e:8f:60:39:e2: + fa:36:53:13:39:d4:5e:26:2b:db:3d:a8:14:bd:32: + eb:18:03:28:52:04:71:e5:ab:33:3d:e1:38:bb:07: + 36:84:62:9c:79:ea:16:30:f4:5f:c0:2b:e8:71:6b: + e4:f9 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E + X509v3 Authority Key Identifier: + keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E + + Signature Algorithm: sha1WithRSAEncryption + 35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f: + 78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf: + dd:41:1a:05:4e:9b:4b:ee:4a:6f:55:52:b3:24:a1:37:0a:eb: + 64:76:2a:2e:2c:f3:fd:3b:75:90:bf:fa:71:d8:c7:3d:37:d2: + b5:05:95:62:b9:a6:de:89:3d:36:7b:38:77:48:97:ac:a6:20: + 8f:2e:a6:c9:0c:c2:b2:99:45:00:c7:ce:11:51:22:22:e0:a5: + ea:b6:15:48:09:64:ea:5e:4f:74:f7:05:3e:c7:8a:52:0c:db: + 15:b4:bd:6d:9b:e5:c6:b1:54:68:a9:e3:69:90:b6:9a:a5:0f: + b8:b9:3f:20:7d:ae:4a:b5:b8:9c:e4:1d:b6:ab:e6:94:a5:c1: + c7:83:ad:db:f5:27:87:0e:04:6c:d5:ff:dd:a0:5d:ed:87:52: + b7:2b:15:02:ae:39:a6:6a:74:e9:da:c4:e7:bc:4d:34:1e:a9: + 5c:4d:33:5f:92:09:2f:88:66:5d:77:97:c7:1d:76:13:a9:d5: + e5:f1:16:09:11:35:d5:ac:db:24:71:70:2c:98:56:0b:d9:17: + b4:d1:e3:51:2b:5e:75:e8:d5:d0:dc:4f:34:ed:c2:05:66:80: + a1:cb:e6:33 +MD5 Fingerprint=F7:75:AB:29:FB:51:4E:B7:77:5E:FF:05:3C:99:8E:F5 +-----BEGIN CERTIFICATE----- +MIIDVDCCAjygAwIBAgIDAjRWMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT +MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i +YWwgQ0EwHhcNMDIwNTIxMDQwMDAwWhcNMjIwNTIxMDQwMDAwWjBCMQswCQYDVQQG +EwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UEAxMSR2VvVHJ1c3Qg +R2xvYmFsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2swYYzD9 +9BcjGlZ+W988bDjkcbd4kdS8odhM+KhDtgPpTSEHCIjaWC9mOSm9BXiLnTjoBbdq +fnGk5sRgprDvgOSJKA+eJdbtg/OtppHHmMlCGDUUna2YRpIuT8rxh0PBFpVXLVDv +iS2Aelet8u5fa9IAjbkU+BQVNdnARqN7csiRv8lVK83Qlz6cJmTM386DGXHKTubU +1XupGc1V3sjs0l44U+VcT4wt/lAjNvxm5suOpDkZALeVAjmRCw7+OC7RHQWa9k0+ +bw8HHa8sHo9gOeL6NlMTOdReJivbPagUvTLrGAMoUgRx5aszPeE4uwc2hGKceeoW +MPRfwCvocWvk+QIDAQABo1MwUTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTA +ephojYn7qwVkDBF9qn1luMrMTjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1l +uMrMTjANBgkqhkiG9w0BAQUFAAOCAQEANeMpauUvXVSOKVCUn5kaFOSPeCpilKIn +Z57QzxpeR+nBsqTP3UEaBU6bS+5Kb1VSsyShNwrrZHYqLizz/Tt1kL/6cdjHPTfS +tQWVYrmm3ok9Nns4d0iXrKYgjy6myQzCsplFAMfOEVEiIuCl6rYVSAlk6l5PdPcF +PseKUgzbFbS9bZvlxrFUaKnjaZC2mqUPuLk/IH2uSrW4nOQdtqvmlKXBx4Ot2/Un +hw4EbNX/3aBd7YdStysVAq45pmp06drE57xNNB6pXE0zX5IJL4hmXXeXxx12E6nV +5fEWCRE11azbJHFwLJhWC9kXtNHjUStedejV0NxPNO3CBWaAocvmMw== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 44:be:0c:8b:50:00:24:b4:11:d3:36:30:4b:c0:33:77 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Network Applications + Validity + Not Before: Jul 9 18:48:39 1999 GMT + Not After : Jul 9 18:57:49 2019 GMT + Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Network Applications + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:b3:fb:91:a1:e4:36:55:85:ac:06:34:5b:a0:9a: + 58:b2:f8:b5:0f:05:77:83:ae:32:b1:76:92:68:ec: + 23:4a:c9:76:3f:e3:9c:b6:37:79:03:b9:ab:69:8d: + 07:25:b6:19:67:e4:b0:1b:18:73:61:4a:e8:7e:cd: + d3:2f:64:e3:a6:7c:0c:fa:17:80:a3:0d:47:89:4f: + 51:71:2f:ee:fc:3f:f9:b8:16:80:87:89:93:25:20: + 9a:43:82:69:24:76:28:59:35:a1:1d:c0:7f:83:06: + 64:16:20:2c:d3:49:a4:85:b4:c0:61:7f:51:08:f8: + 68:15:91:80:cb:a5:d5:ee:3b:3a:f4:84:04:5e:60: + 59:a7:8c:34:72:ee:b8:78:c5:d1:3b:12:4a:6f:7e: + 65:27:b9:a4:55:c5:b9:6f:43:a4:c5:1d:2c:99:c0: + 52:a4:78:4c:15:b3:40:98:08:6b:43:c6:01:b0:7a: + 7b:f5:6b:1c:22:3f:cb:ef:ff:a8:d0:3a:4b:76:15: + 9e:d2:d1:c6:2e:e3:db:57:1b:32:a2:b8:6f:e8:86: + a6:3f:70:ab:e5:70:92:ab:44:1e:40:50:fb:9c:a3: + 62:e4:6c:6e:a0:c8:de:e2:80:42:fa:e9:2f:e8:ce: + 32:04:8f:7c:8d:b7:1c:a3:35:3c:15:dd:9e:c3:ae: + 97:a5 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Key Usage: + Digital Signature, Non Repudiation, Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + FA:86:C9:DB:E0:BA:E9:78:F5:4B:A8:D6:15:DF:F0:D3:E1:6A:14:3C + X509v3 CRL Distribution Points: + URI:http://crl.usertrust.com/UTN-USERFirst-NetworkApplications.crl + + Signature Algorithm: sha1WithRSAEncryption + a4:f3:25:cc:d1:d4:91:83:22:d0:cc:32:ab:9b:96:4e:34:91: + 54:20:25:34:61:5f:2a:02:15:e1:8b:aa:ff:7d:64:51:cf:0a: + ff:bc:7d:d8:21:6a:78:cb:2f:51:6f:f8:42:1d:33:bd:eb:b5: + 7b:94:c3:c3:a9:a0:2d:df:d1:29:1f:1d:fe:8f:3f:bb:a8:45: + 2a:7f:d1:6e:55:24:e2:bb:02:fb:31:3f:be:e8:bc:ec:40:2b: + f8:01:d4:56:38:e4:ca:44:82:b5:61:20:21:67:65:f6:f0:0b: + e7:34:f8:a5:c2:9c:a3:5c:40:1f:85:93:95:06:de:4f:d4:27: + a9:b6:a5:fc:16:cd:73:31:3f:b8:65:27:cf:d4:53:1a:f0:ac: + 6e:9f:4f:05:0c:03:81:a7:84:29:c4:5a:bd:64:57:72:ad:3b: + cf:37:18:a6:98:c6:ad:06:b4:dc:08:a3:04:d5:29:a4:96:9a: + 12:67:4a:8c:60:45:9d:f1:23:9a:b0:00:9c:68:b5:98:50:d3: + ef:8e:2e:92:65:b1:48:3e:21:be:15:30:2a:0d:b5:0c:a3:6b: + 3f:ae:7f:57:f5:1f:96:7c:df:6f:dd:82:30:2c:65:1b:40:4a: + cd:68:b9:72:ec:71:76:ec:54:8e:1f:85:0c:01:6a:fa:a6:38: + ac:1f:c4:84 +MD5 Fingerprint=BF:60:59:A3:5B:BA:F6:A7:76:42:DA:6F:1A:7B:50:CF +-----BEGIN CERTIFICATE----- +MIIEZDCCA0ygAwIBAgIQRL4Mi1AAJLQR0zYwS8AzdzANBgkqhkiG9w0BAQUFADCB +ozELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug +Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho +dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xKzApBgNVBAMTIlVUTi1VU0VSRmlyc3Qt +TmV0d29yayBBcHBsaWNhdGlvbnMwHhcNOTkwNzA5MTg0ODM5WhcNMTkwNzA5MTg1 +NzQ5WjCBozELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0 +IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYD +VQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xKzApBgNVBAMTIlVUTi1VU0VS +Rmlyc3QtTmV0d29yayBBcHBsaWNhdGlvbnMwggEiMA0GCSqGSIb3DQEBAQUAA4IB +DwAwggEKAoIBAQCz+5Gh5DZVhawGNFugmliy+LUPBXeDrjKxdpJo7CNKyXY/45y2 +N3kDuatpjQclthln5LAbGHNhSuh+zdMvZOOmfAz6F4CjDUeJT1FxL+78P/m4FoCH +iZMlIJpDgmkkdihZNaEdwH+DBmQWICzTSaSFtMBhf1EI+GgVkYDLpdXuOzr0hARe +YFmnjDRy7rh4xdE7EkpvfmUnuaRVxblvQ6TFHSyZwFKkeEwVs0CYCGtDxgGwenv1 +axwiP8vv/6jQOkt2FZ7S0cYu49tXGzKiuG/ohqY/cKvlcJKrRB5AUPuco2LkbG6g +yN7igEL66S/ozjIEj3yNtxyjNTwV3Z7DrpelAgMBAAGjgZEwgY4wCwYDVR0PBAQD +AgHGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFPqGydvguul49Uuo1hXf8NPh +ahQ8ME8GA1UdHwRIMEYwRKBCoECGPmh0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9V +VE4tVVNFUkZpcnN0LU5ldHdvcmtBcHBsaWNhdGlvbnMuY3JsMA0GCSqGSIb3DQEB +BQUAA4IBAQCk8yXM0dSRgyLQzDKrm5ZONJFUICU0YV8qAhXhi6r/fWRRzwr/vH3Y +IWp4yy9Rb/hCHTO967V7lMPDqaAt39EpHx3+jz+7qEUqf9FuVSTiuwL7MT++6Lzs +QCv4AdRWOOTKRIK1YSAhZ2X28AvnNPilwpyjXEAfhZOVBt5P1CeptqX8Fs1zMT+4 +ZSfP1FMa8Kxun08FDAOBp4QpxFq9ZFdyrTvPNximmMatBrTcCKME1SmklpoSZ0qM +YEWd8SOasACcaLWYUNPvji6SZbFIPiG+FTAqDbUMo2s/rn9X9R+WfN9v3YIwLGUb +QErNaLly7HF27FSOH4UMAWr6pjisH8SE +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=America Online Inc., CN=America Online Root Certification Authority 1 + Validity + Not Before: May 28 06:00:00 2002 GMT + Not After : Nov 19 20:43:00 2037 GMT + Subject: C=US, O=America Online Inc., CN=America Online Root Certification Authority 1 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:a8:2f:e8:a4:69:06:03:47:c3:e9:2a:98:ff:19: + a2:70:9a:c6:50:b2:7e:a5:df:68:4d:1b:7c:0f:b6: + 97:68:7d:2d:a6:8b:97:e9:64:86:c9:a3:ef:a0:86: + bf:60:65:9c:4b:54:88:c2:48:c5:4a:39:bf:14:e3: + 59:55:e5:19:b4:74:c8:b4:05:39:5c:16:a5:e2:95: + 05:e0:12:ae:59:8b:a2:33:68:58:1c:a6:d4:15:b7: + d8:9f:d7:dc:71:ab:7e:9a:bf:9b:8e:33:0f:22:fd: + 1f:2e:e7:07:36:ef:62:39:c5:dd:cb:ba:25:14:23: + de:0c:c6:3d:3c:ce:82:08:e6:66:3e:da:51:3b:16: + 3a:a3:05:7f:a0:dc:87:d5:9c:fc:72:a9:a0:7d:78: + e4:b7:31:55:1e:65:bb:d4:61:b0:21:60:ed:10:32: + 72:c5:92:25:1e:f8:90:4a:18:78:47:df:7e:30:37: + 3e:50:1b:db:1c:d3:6b:9a:86:53:07:b0:ef:ac:06: + 78:f8:84:99:fe:21:8d:4c:80:b6:0c:82:f6:66:70: + 79:1a:d3:4f:a3:cf:f1:cf:46:b0:4b:0f:3e:dd:88: + 62:b8:8c:a9:09:28:3b:7a:c7:97:e1:1e:e5:f4:9f: + c0:c0:ae:24:a0:c8:a1:d9:0f:d6:7b:26:82:69:32: + 3d:a7 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + 00:AD:D9:A3:F6:79:F6:6E:74:A9:7F:33:3D:81:17:D7:4C:CF:33:DE + X509v3 Authority Key Identifier: + keyid:00:AD:D9:A3:F6:79:F6:6E:74:A9:7F:33:3D:81:17:D7:4C:CF:33:DE + + X509v3 Key Usage: critical + Digital Signature, Certificate Sign, CRL Sign + Signature Algorithm: sha1WithRSAEncryption + 7c:8a:d1:1f:18:37:82:e0:b8:b0:a3:ed:56:95:c8:62:61:9c: + 05:a2:cd:c2:62:26:61:cd:10:16:d7:cc:b4:65:34:d0:11:8a: + ad:a8:a9:05:66:ef:74:f3:6d:5f:9d:99:af:f6:8b:fb:eb:52: + b2:05:98:a2:6f:2a:c5:54:bd:25:bd:5f:ae:c8:86:ea:46:2c: + c1:b3:bd:c1:e9:49:70:18:16:97:08:13:8c:20:e0:1b:2e:3a: + 47:cb:1e:e4:00:30:95:5b:f4:45:a3:c0:1a:b0:01:4e:ab:bd: + c0:23:6e:63:3f:80:4a:c5:07:ed:dc:e2:6f:c7:c1:62:f1:e3: + 72:d6:04:c8:74:67:0b:fa:88:ab:a1:01:c8:6f:f0:14:af:d2: + 99:cd:51:93:7e:ed:2e:38:c7:bd:ce:46:50:3d:72:e3:79:25: + 9d:9b:88:2b:10:20:dd:a5:b8:32:9f:8d:e0:29:df:21:74:86: + 82:db:2f:82:30:c6:c7:35:86:b3:f9:96:5f:46:db:0c:45:fd: + f3:50:c3:6f:c6:c3:48:ad:46:a6:e1:27:47:0a:1d:0e:9b:b6: + c2:77:7f:63:f2:e0:7d:1a:be:fc:e0:df:d7:c7:a7:6c:b0:f9: + ae:ba:3c:fd:74:b4:11:e8:58:0d:80:bc:d3:a8:80:3a:99:ed: + 75:cc:46:7b +MD5 Fingerprint=14:F1:08:AD:9D:FA:64:E2:89:E7:1C:CF:A8:AD:7D:5E +-----BEGIN CERTIFICATE----- +MIIDpDCCAoygAwIBAgIBATANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEc +MBoGA1UEChMTQW1lcmljYSBPbmxpbmUgSW5jLjE2MDQGA1UEAxMtQW1lcmljYSBP +bmxpbmUgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAxMB4XDTAyMDUyODA2 +MDAwMFoXDTM3MTExOTIwNDMwMFowYzELMAkGA1UEBhMCVVMxHDAaBgNVBAoTE0Ft +ZXJpY2EgT25saW5lIEluYy4xNjA0BgNVBAMTLUFtZXJpY2EgT25saW5lIFJvb3Qg +Q2VydGlmaWNhdGlvbiBBdXRob3JpdHkgMTCCASIwDQYJKoZIhvcNAQEBBQADggEP +ADCCAQoCggEBAKgv6KRpBgNHw+kqmP8ZonCaxlCyfqXfaE0bfA+2l2h9LaaLl+lk +hsmj76CGv2BlnEtUiMJIxUo5vxTjWVXlGbR0yLQFOVwWpeKVBeASrlmLojNoWBym +1BW32J/X3HGrfpq/m44zDyL9Hy7nBzbvYjnF3cu6JRQj3gzGPTzOggjmZj7aUTsW +OqMFf6Dch9Wc/HKpoH145LcxVR5lu9RhsCFg7RAycsWSJR74kEoYeEfffjA3PlAb +2xzTa5qGUwew76wGePiEmf4hjUyAtgyC9mZweRrTT6PP8c9GsEsPPt2IYriMqQko +O3rHl+Ee5fSfwMCuJKDIodkP1nsmgmkyPacCAwEAAaNjMGEwDwYDVR0TAQH/BAUw +AwEB/zAdBgNVHQ4EFgQUAK3Zo/Z59m50qX8zPYEX10zPM94wHwYDVR0jBBgwFoAU +AK3Zo/Z59m50qX8zPYEX10zPM94wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB +BQUAA4IBAQB8itEfGDeC4Liwo+1WlchiYZwFos3CYiZhzRAW18y0ZTTQEYqtqKkF +Zu90821fnZmv9ov761KyBZiibyrFVL0lvV+uyIbqRizBs73B6UlwGBaXCBOMIOAb +LjpHyx7kADCVW/RFo8AasAFOq73AI25jP4BKxQft3OJvx8Fi8eNy1gTIdGcL+oir +oQHIb/AUr9KZzVGTfu0uOMe9zkZQPXLjeSWdm4grECDdpbgyn43gKd8hdIaC2y+C +MMbHNYaz+ZZfRtsMRf3zUMNvxsNIrUam4SdHCh0Om7bCd39j8uB9Gr784N/Xx6ds +sPmuujz9dLQR6FgNgLzTqIA6me11zEZ7 +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=America Online Inc., CN=America Online Root Certification Authority 2 + Validity + Not Before: May 28 06:00:00 2002 GMT + Not After : Sep 29 14:08:00 2037 GMT + Subject: C=US, O=America Online Inc., CN=America Online Root Certification Authority 2 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (4096 bit) + Modulus (4096 bit): + 00:cc:41:45:1d:e9:3d:4d:10:f6:8c:b1:41:c9:e0: + 5e:cb:0d:b7:bf:47:73:d3:f0:55:4d:dd:c6:0c:fa: + b1:66:05:6a:cd:78:b4:dc:02:db:4e:81:f3:d7:a7: + 7c:71:bc:75:63:a0:5d:e3:07:0c:48:ec:25:c4:03: + 20:f4:ff:0e:3b:12:ff:9b:8d:e1:c6:d5:1b:b4:6d: + 22:e3:b1:db:7f:21:64:af:86:bc:57:22:2a:d6:47: + 81:57:44:82:56:53:bd:86:14:01:0b:fc:7f:74:a4: + 5a:ae:f1:ba:11:b5:9b:58:5a:80:b4:37:78:09:33: + 7c:32:47:03:5c:c4:a5:83:48:f4:57:56:6e:81:36: + 27:18:4f:ec:9b:28:c2:d4:b4:d7:7c:0c:3e:0c:2b: + df:ca:04:d7:c6:8e:ea:58:4e:a8:a4:a5:18:1c:6c: + 45:98:a3:41:d1:2d:d2:c7:6d:8d:19:f1:ad:79:b7: + 81:3f:bd:06:82:27:2d:10:58:05:b5:78:05:b9:2f: + db:0c:6b:90:90:7e:14:59:38:bb:94:24:13:e5:d1: + 9d:14:df:d3:82:4d:46:f0:80:39:52:32:0f:e3:84: + b2:7a:43:f2:5e:de:5f:3f:1d:dd:e3:b2:1b:a0:a1: + 2a:23:03:6e:2e:01:15:87:5c:a6:75:75:c7:97:61: + be:de:86:dc:d4:48:db:bd:2a:bf:4a:55:da:e8:7d: + 50:fb:b4:80:17:b8:94:bf:01:3d:ea:da:ba:7c:e0: + 58:67:17:b9:58:e0:88:86:46:67:6c:9d:10:47:58: + 32:d0:35:7c:79:2a:90:a2:5a:10:11:23:35:ad:2f: + cc:e4:4a:5b:a7:c8:27:f2:83:de:5e:bb:5e:77:e7: + e8:a5:6e:63:c2:0d:5d:61:d0:8c:d2:6c:5a:21:0e: + ca:28:a3:ce:2a:e9:95:c7:48:cf:96:6f:1d:92:25: + c8:c6:c6:c1:c1:0c:05:ac:26:c4:d2:75:d2:e1:2a: + 67:c0:3d:5b:a5:9a:eb:cf:7b:1a:a8:9d:14:45:e5: + 0f:a0:9a:65:de:2f:28:bd:ce:6f:94:66:83:48:29: + d8:ea:65:8c:af:93:d9:64:9f:55:57:26:bf:6f:cb: + 37:31:99:a3:60:bb:1c:ad:89:34:32:62:b8:43:21: + 06:72:0c:a1:5c:6d:46:c5:fa:29:cf:30:de:89:dc: + 71:5b:dd:b6:37:3e:df:50:f5:b8:07:25:26:e5:bc: + b5:fe:3c:02:b3:b7:f8:be:43:c1:87:11:94:9e:23: + 6c:17:8a:b8:8a:27:0c:54:47:f0:a9:b3:c0:80:8c: + a0:27:eb:1d:19:e3:07:8e:77:70:ca:2b:f4:7d:76: + e0:78:67 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + 4D:45:C1:68:38:BB:73:A9:69:A1:20:E7:ED:F5:22:A1:23:14:D7:9E + X509v3 Authority Key Identifier: + keyid:4D:45:C1:68:38:BB:73:A9:69:A1:20:E7:ED:F5:22:A1:23:14:D7:9E + + X509v3 Key Usage: critical + Digital Signature, Certificate Sign, CRL Sign + Signature Algorithm: sha1WithRSAEncryption + 67:6b:06:b9:5f:45:3b:2a:4b:33:b3:e6:1b:6b:59:4e:22:cc: + b9:b7:a4:25:c9:a7:c4:f0:54:96:0b:64:f3:b1:58:4f:5e:51: + fc:b2:97:7b:27:65:c2:e5:ca:e7:0d:0c:25:7b:62:e3:fa:9f: + b4:87:b7:45:46:af:83:a5:97:48:8c:a5:bd:f1:16:2b:9b:76: + 2c:7a:35:60:6c:11:80:97:cc:a9:92:52:e6:2b:e6:69:ed:a9: + f8:36:2d:2c:77:bf:61:48:d1:63:0b:b9:5b:52:ed:18:b0:43: + 42:22:a6:b1:77:ae:de:69:c5:cd:c7:1c:a1:b1:a5:1c:10:fb: + 18:be:1a:70:dd:c1:92:4b:be:29:5a:9d:3f:35:be:e5:7d:51: + f8:55:e0:25:75:23:87:1e:5c:dc:ba:9d:b0:ac:b3:69:db:17: + 83:c9:f7:de:0c:bc:08:dc:91:9e:a8:d0:d7:15:37:73:a5:35: + b8:fc:7e:c5:44:40:06:c3:eb:f8:22:80:5c:47:ce:02:e3:11: + 9f:44:ff:fd:9a:32:cc:7d:64:51:0e:eb:57:26:76:3a:e3:1e: + 22:3c:c2:a6:36:dd:19:ef:a7:fc:12:f3:26:c0:59:31:85:4c: + 9c:d8:cf:df:a4:cc:cc:29:93:ff:94:6d:76:5c:13:08:97:f2: + ed:a5:0b:4d:dd:e8:c9:68:0e:66:d3:00:0e:33:12:5b:bc:95: + e5:32:90:a8:b3:c6:6c:83:ad:77:ee:8b:7e:7e:b1:a9:ab:d3: + e1:f1:b6:c0:b1:ea:88:c0:e7:d3:90:e9:28:92:94:7b:68:7b: + 97:2a:0a:67:2d:85:02:38:10:e4:03:61:d4:da:25:36:c7:08: + 58:2d:a1:a7:51:af:30:0a:49:f5:a6:69:87:07:2d:44:46:76: + 8e:2a:e5:9a:3b:d7:18:a2:fc:9c:38:10:cc:c6:3b:d2:b5:17: + 3a:6f:fd:ae:25:bd:f5:72:59:64:b1:74:2a:38:5f:18:4c:df: + cf:71:04:5a:36:d4:bf:2f:99:9c:e8:d9:ba:b1:95:e6:02:4b: + 21:a1:5b:d5:c1:4f:8f:ae:69:6d:53:db:01:93:b5:5c:1e:18: + dd:64:5a:ca:18:28:3e:63:04:11:fd:1c:8d:00:0f:b8:37:df: + 67:8a:9d:66:a9:02:6a:91:ff:13:ca:2f:5d:83:bc:87:93:6c: + dc:24:51:16:04:25:66:fa:b3:d9:c2:ba:29:be:9a:48:38:82: + 99:f4:bf:3b:4a:31:19:f9:bf:8e:21:33:14:ca:4f:54:5f:fb: + ce:fb:8f:71:7f:fd:5e:19:a0:0f:4b:91:b8:c4:54:bc:06:b0: + 45:8f:26:91:a2:8e:fe:a9 +MD5 Fingerprint=D6:ED:3C:CA:E2:66:0F:AF:10:43:0D:77:9B:04:09:BF +-----BEGIN CERTIFICATE----- +MIIFpDCCA4ygAwIBAgIBATANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEc +MBoGA1UEChMTQW1lcmljYSBPbmxpbmUgSW5jLjE2MDQGA1UEAxMtQW1lcmljYSBP +bmxpbmUgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAyMB4XDTAyMDUyODA2 +MDAwMFoXDTM3MDkyOTE0MDgwMFowYzELMAkGA1UEBhMCVVMxHDAaBgNVBAoTE0Ft +ZXJpY2EgT25saW5lIEluYy4xNjA0BgNVBAMTLUFtZXJpY2EgT25saW5lIFJvb3Qg +Q2VydGlmaWNhdGlvbiBBdXRob3JpdHkgMjCCAiIwDQYJKoZIhvcNAQEBBQADggIP +ADCCAgoCggIBAMxBRR3pPU0Q9oyxQcngXssNt79Hc9PwVU3dxgz6sWYFas14tNwC +206B89enfHG8dWOgXeMHDEjsJcQDIPT/DjsS/5uN4cbVG7RtIuOx238hZK+GvFci +KtZHgVdEglZTvYYUAQv8f3SkWq7xuhG1m1hagLQ3eAkzfDJHA1zEpYNI9FdWboE2 +JxhP7JsowtS013wMPgwr38oE18aO6lhOqKSlGBxsRZijQdEt0sdtjRnxrXm3gT+9 +BoInLRBYBbV4Bbkv2wxrkJB+FFk4u5QkE+XRnRTf04JNRvCAOVIyD+OEsnpD8l7e +Xz8d3eOyG6ChKiMDbi4BFYdcpnV1x5dhvt6G3NRI270qv0pV2uh9UPu0gBe4lL8B +PeraunzgWGcXuVjgiIZGZ2ydEEdYMtA1fHkqkKJaEBEjNa0vzORKW6fIJ/KD3l67 +Xnfn6KVuY8INXWHQjNJsWiEOyiijzirplcdIz5ZvHZIlyMbGwcEMBawmxNJ10uEq +Z8A9W6Wa6897GqidFEXlD6CaZd4vKL3Ob5Rmg0gp2OpljK+T2WSfVVcmv2/LNzGZ +o2C7HK2JNDJiuEMhBnIMoVxtRsX6Kc8w3onccVvdtjc+31D1uAclJuW8tf48ArO3 ++L5DwYcRlJ4jbBeKuIonDFRH8KmzwICMoCfrHRnjB453cMor9H124HhnAgMBAAGj +YzBhMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFE1FwWg4u3OpaaEg5+31IqEj +FNeeMB8GA1UdIwQYMBaAFE1FwWg4u3OpaaEg5+31IqEjFNeeMA4GA1UdDwEB/wQE +AwIBhjANBgkqhkiG9w0BAQUFAAOCAgEAZ2sGuV9FOypLM7PmG2tZTiLMubekJcmn +xPBUlgtk87FYT15R/LKXeydlwuXK5w0MJXti4/qftIe3RUavg6WXSIylvfEWK5t2 +LHo1YGwRgJfMqZJS5ivmae2p+DYtLHe/YUjRYwu5W1LtGLBDQiKmsXeu3mnFzccc +obGlHBD7GL4acN3Bkku+KVqdPzW+5X1R+FXgJXUjhx5c3LqdsKyzadsXg8n33gy8 +CNyRnqjQ1xU3c6U1uPx+xURABsPr+CKAXEfOAuMRn0T//ZoyzH1kUQ7rVyZ2OuMe +IjzCpjbdGe+n/BLzJsBZMYVMnNjP36TMzCmT/5RtdlwTCJfy7aULTd3oyWgOZtMA +DjMSW7yV5TKQqLPGbIOtd+6Lfn6xqavT4fG2wLHqiMDn05DpKJKUe2h7lyoKZy2F +AjgQ5ANh1NolNscIWC2hp1GvMApJ9aZphwctREZ2jirlmjvXGKL8nDgQzMY70rUX +Om/9riW99XJZZLF0KjhfGEzfz3EEWjbUvy+ZnOjZurGV5gJLIaFb1cFPj65pbVPb +AZO1XB4Y3WRayhgoPmMEEf0cjQAPuDffZ4qdZqkCapH/E8ovXYO8h5Ns3CRRFgQl +Zvqz2cK6Kb6aSDiCmfS/O0oxGfm/jiEzFMpPVF/7zvuPcX/9XhmgD0uRuMRUvAaw +RY8mkaKO/qk= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 13:86:35:4d:1d:3f:06:f2:c1:f9:65:05:d5:90:1c:62 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=VISA, OU=Visa International Service Association, CN=Visa eCommerce Root + Validity + Not Before: Jun 26 02:18:36 2002 GMT + Not After : Jun 24 00:16:12 2022 GMT + Subject: C=US, O=VISA, OU=Visa International Service Association, CN=Visa eCommerce Root + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:af:57:de:56:1e:6e:a1:da:60:b1:94:27:cb:17: + db:07:3f:80:85:4f:c8:9c:b6:d0:f4:6f:4f:cf:99: + d8:e1:db:c2:48:5c:3a:ac:39:33:c7:1f:6a:8b:26: + 3d:2b:35:f5:48:b1:91:c1:02:4e:04:96:91:7b:b0: + 33:f0:b1:14:4e:11:6f:b5:40:af:1b:45:a5:4a:ef: + 7e:b6:ac:f2:a0:1f:58:3f:12:46:60:3c:8d:a1:e0: + 7d:cf:57:3e:33:1e:fb:47:f1:aa:15:97:07:55:66: + a5:b5:2d:2e:d8:80:59:b2:a7:0d:b7:46:ec:21:63: + ff:35:ab:a5:02:cf:2a:f4:4c:fe:7b:f5:94:5d:84: + 4d:a8:f2:60:8f:db:0e:25:3c:9f:73:71:cf:94:df: + 4a:ea:db:df:72:38:8c:f3:96:bd:f1:17:bc:d2:ba: + 3b:45:5a:c6:a7:f6:c6:17:8b:01:9d:fc:19:a8:2a: + 83:16:b8:3a:48:fe:4e:3e:a0:ab:06:19:e9:53:f3: + 80:13:07:ed:2d:bf:3f:0a:3c:55:20:39:2c:2c:00: + 69:74:95:4a:bc:20:b2:a9:79:e5:18:89:91:a8:dc: + 1c:4d:ef:bb:7e:37:0b:5d:fe:39:a5:88:52:8c:00: + 6c:ec:18:7c:41:bd:f6:8b:75:77:ba:60:9d:84:e7: + fe:2d + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + X509v3 Subject Key Identifier: + 15:38:83:0F:3F:2C:3F:70:33:1E:CD:46:FE:07:8C:20:E0:D7:C3:B7 + Signature Algorithm: sha1WithRSAEncryption + 5f:f1:41:7d:7c:5c:08:b9:2b:e0:d5:92:47:fa:67:5c:a5:13: + c3:03:21:9b:2b:4c:89:46:cf:59:4d:c9:fe:a5:40:b6:63:cd: + dd:71:28:95:67:11:cc:24:ac:d3:44:6c:71:ae:01:20:6b:03: + a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7: + 8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7: + 2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2: + 73:d0:e3:90:22:73:43:cd:f3:ef:ea:73:ce:45:8a:b0:a6:49: + ff:4c:7d:9d:71:88:c4:76:1d:90:5b:1d:ee:fd:cc:f7:ee:fd: + 60:a5:b1:7a:16:71:d1:16:d0:7c:12:3c:6c:69:97:db:ae:5f: + 39:9a:70:2f:05:3c:19:46:04:99:20:36:d0:60:6e:61:06:bb: + 16:42:8c:70:f7:30:fb:e0:db:66:a3:00:01:bd:e6:2c:da:91: + 5f:a0:46:8b:4d:6a:9c:3d:3d:dd:05:46:fe:76:bf:a0:0a:3c: + e4:00:e6:27:b7:ff:84:2d:de:ba:22:27:96:10:71:eb:22:ed: + df:df:33:9c:cf:e3:ad:ae:8e:d4:8e:e6:4f:51:af:16:92:e0: + 5c:f6:07:0f +MD5 Fingerprint=FC:11:B8:D8:08:93:30:00:6D:23:F9:7E:EB:52:1E:02 +-----BEGIN CERTIFICATE----- +MIIDojCCAoqgAwIBAgIQE4Y1TR0/BvLB+WUF1ZAcYjANBgkqhkiG9w0BAQUFADBr +MQswCQYDVQQGEwJVUzENMAsGA1UEChMEVklTQTEvMC0GA1UECxMmVmlzYSBJbnRl +cm5hdGlvbmFsIFNlcnZpY2UgQXNzb2NpYXRpb24xHDAaBgNVBAMTE1Zpc2EgZUNv +bW1lcmNlIFJvb3QwHhcNMDIwNjI2MDIxODM2WhcNMjIwNjI0MDAxNjEyWjBrMQsw +CQYDVQQGEwJVUzENMAsGA1UEChMEVklTQTEvMC0GA1UECxMmVmlzYSBJbnRlcm5h +dGlvbmFsIFNlcnZpY2UgQXNzb2NpYXRpb24xHDAaBgNVBAMTE1Zpc2EgZUNvbW1l +cmNlIFJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvV95WHm6h +2mCxlCfLF9sHP4CFT8icttD0b0/Pmdjh28JIXDqsOTPHH2qLJj0rNfVIsZHBAk4E +lpF7sDPwsRROEW+1QK8bRaVK7362rPKgH1g/EkZgPI2h4H3PVz4zHvtH8aoVlwdV +ZqW1LS7YgFmypw23RuwhY/81q6UCzyr0TP579ZRdhE2o8mCP2w4lPJ9zcc+U30rq +299yOIzzlr3xF7zSujtFWsan9sYXiwGd/BmoKoMWuDpI/k4+oKsGGelT84ATB+0t +vz8KPFUgOSwsAGl0lUq8ILKpeeUYiZGo3BxN77t+Nwtd/jmliFKMAGzsGHxBvfaL +dXe6YJ2E5/4tAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQD +AgEGMB0GA1UdDgQWBBQVOIMPPyw/cDMezUb+B4wg4NfDtzANBgkqhkiG9w0BAQUF +AAOCAQEAX/FBfXxcCLkr4NWSR/pnXKUTwwMhmytMiUbPWU3J/qVAtmPN3XEolWcR +zCSs00Rsca4BIGsDoo8Ytyk6feUWYFN4PMCvFYP3j1IzJL1kk5fui/fbGKhtcbP3 +LBfQdCVp9/5rPJS+TUtBjE7ic9DjkCJzQ83z7+pzzkWKsKZJ/0x9nXGIxHYdkFsd +7v3M9+79YKWxehZx0RbQfBI8bGmX265fOZpwLwU8GUYEmSA20GBuYQa7FkKMcPcw +++DbZqMAAb3mLNqRX6BGi01qnD093QVG/na/oAo85ADmJ7f/hC3euiInlhBx6yLt +398znM/jra6O1I7mT1GvFpLgXPYHDw== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1002 (0x3ea) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 2 CA/emailAddress=certificate@trustcenter.de + Validity + Not Before: Mar 9 11:59:59 1998 GMT + Not After : Jan 1 11:59:59 2011 GMT + Subject: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 2 CA/emailAddress=certificate@trustcenter.de + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:da:38:e8:ed:32:00:29:71:83:01:0d:bf:8c:01: + dc:da:c6:ad:39:a4:a9:8a:2f:d5:8b:5c:68:5f:50: + c6:62:f5:66:bd:ca:91:22:ec:aa:1d:51:d7:3d:b3: + 51:b2:83:4e:5d:cb:49:b0:f0:4c:55:e5:6b:2d:c7: + 85:0b:30:1c:92:4e:82:d4:ca:02:ed:f7:6f:be:dc: + e0:e3:14:b8:05:53:f2:9a:f4:56:8b:5a:9e:85:93: + d1:b4:82:56:ae:4d:bb:a8:4b:57:16:bc:fe:f8:58: + 9e:f8:29:8d:b0:7b:cd:78:c9:4f:ac:8b:67:0c:f1: + 9c:fb:fc:57:9b:57:5c:4f:0d + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Key Usage: critical + Digital Signature, Certificate Sign, CRL Sign + Netscape CA Policy Url: + http://www.trustcenter.de/guidelines + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + Signature Algorithm: md5WithRSAEncryption + 84:52:fb:28:df:ff:1f:75:01:bc:01:be:04:56:97:6a:74:42: + 24:31:83:f9:46:b1:06:8a:89:cf:96:2c:33:bf:8c:b5:5f:7a: + 72:a1:85:06:ce:86:f8:05:8e:e8:f9:25:ca:da:83:8c:06:ac: + eb:36:6d:85:91:34:04:36:f4:42:f0:f8:79:2e:0a:48:5c:ab: + cc:51:4f:78:76:a0:d9:ac:19:bd:2a:d1:69:04:28:91:ca:36: + 10:27:80:57:5b:d2:5c:f5:c2:5b:ab:64:81:63:74:51:f4:97: + bf:cd:12:28:f7:4d:66:7f:a7:f0:1c:01:26:78:b2:66:47:70: + 51:64 +MD5 Fingerprint=B8:16:33:4C:4C:4C:F2:D8:D3:4D:06:B4:A6:5B:40:03 +-----BEGIN CERTIFICATE----- +MIIDXDCCAsWgAwIBAgICA+owDQYJKoZIhvcNAQEEBQAwgbwxCzAJBgNVBAYTAkRF +MRAwDgYDVQQIEwdIYW1idXJnMRAwDgYDVQQHEwdIYW1idXJnMTowOAYDVQQKEzFU +QyBUcnVzdENlbnRlciBmb3IgU2VjdXJpdHkgaW4gRGF0YSBOZXR3b3JrcyBHbWJI +MSIwIAYDVQQLExlUQyBUcnVzdENlbnRlciBDbGFzcyAyIENBMSkwJwYJKoZIhvcN +AQkBFhpjZXJ0aWZpY2F0ZUB0cnVzdGNlbnRlci5kZTAeFw05ODAzMDkxMTU5NTla +Fw0xMTAxMDExMTU5NTlaMIG8MQswCQYDVQQGEwJERTEQMA4GA1UECBMHSGFtYnVy +ZzEQMA4GA1UEBxMHSGFtYnVyZzE6MDgGA1UEChMxVEMgVHJ1c3RDZW50ZXIgZm9y +IFNlY3VyaXR5IGluIERhdGEgTmV0d29ya3MgR21iSDEiMCAGA1UECxMZVEMgVHJ1 +c3RDZW50ZXIgQ2xhc3MgMiBDQTEpMCcGCSqGSIb3DQEJARYaY2VydGlmaWNhdGVA +dHJ1c3RjZW50ZXIuZGUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANo46O0y +AClxgwENv4wB3NrGrTmkqYov1YtcaF9QxmL1Zr3KkSLsqh1R1z2zUbKDTl3LSbDw +TFXlay3HhQswHJJOgtTKAu33b77c4OMUuAVT8pr0VotanoWT0bSCVq5Nu6hLVxa8 +/vhYnvgpjbB7zXjJT6yLZwzxnPv8V5tXXE8NAgMBAAGjazBpMA8GA1UdEwEB/wQF +MAMBAf8wDgYDVR0PAQH/BAQDAgGGMDMGCWCGSAGG+EIBCAQmFiRodHRwOi8vd3d3 +LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwEQYJYIZIAYb4QgEBBAQDAgAHMA0G +CSqGSIb3DQEBBAUAA4GBAIRS+yjf/x91AbwBvgRWl2p0QiQxg/lGsQaKic+WLDO/ +jLVfenKhhQbOhvgFjuj5Jcrag4wGrOs2bYWRNAQ29ELw+HkuCkhcq8xRT3h2oNms +Gb0q0WkEKJHKNhAngFdb0lz1wlurZIFjdFH0l7/NEij3TWZ/p/AcASZ4smZHcFFk +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1003 (0x3eb) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 3 CA/emailAddress=certificate@trustcenter.de + Validity + Not Before: Mar 9 11:59:59 1998 GMT + Not After : Jan 1 11:59:59 2011 GMT + Subject: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 3 CA/emailAddress=certificate@trustcenter.de + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:b6:b4:c1:35:05:2e:0d:8d:ec:a0:40:6a:1c:0e: + 27:a6:50:92:6b:50:1b:07:de:2e:e7:76:cc:e0:da: + fc:84:a8:5e:8c:63:6a:2b:4d:d9:4e:02:76:11:c1: + 0b:f2:8d:79:ca:00:b6:f1:b0:0e:d7:fb:a4:17:3d: + af:ab:69:7a:96:27:bf:af:33:a1:9a:2a:59:aa:c4: + b5:37:08:f2:12:a5:31:b6:43:f5:32:96:71:28:28: + ab:8d:28:86:df:bb:ee:e3:0c:7d:30:d6:c3:52:ab: + 8f:5d:27:9c:6b:c0:a3:e7:05:6b:57:49:44:b3:6e: + ea:64:cf:d2:8e:7a:50:77:77 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Key Usage: critical + Digital Signature, Certificate Sign, CRL Sign + Netscape CA Policy Url: + http://www.trustcenter.de/guidelines + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + Signature Algorithm: md5WithRSAEncryption + 16:3d:c6:cd:c1:bb:85:71:85:46:9f:3e:20:8f:51:28:99:ec: + 2d:45:21:63:23:5b:04:bb:4c:90:b8:88:92:04:4d:bd:7d:01: + a3:3f:f6:ec:ce:f1:de:fe:7d:e5:e1:3e:bb:c6:ab:5e:0b:dd: + 3d:96:c4:cb:a9:d4:f9:26:e6:06:4e:9e:0c:a5:7a:ba:6e:c3: + 7c:82:19:d1:c7:b1:b1:c3:db:0d:8e:9b:40:7c:37:0b:f1:5d: + e8:fd:1f:90:88:a5:0e:4e:37:64:21:a8:4e:8d:b4:9f:f1:de: + 48:ad:d5:56:18:52:29:8b:47:34:12:09:d4:bb:92:35:ef:0f: + db:34 +MD5 Fingerprint=5F:94:4A:73:22:B8:F7:D1:31:EC:59:39:F7:8E:FE:6E +-----BEGIN CERTIFICATE----- +MIIDXDCCAsWgAwIBAgICA+swDQYJKoZIhvcNAQEEBQAwgbwxCzAJBgNVBAYTAkRF +MRAwDgYDVQQIEwdIYW1idXJnMRAwDgYDVQQHEwdIYW1idXJnMTowOAYDVQQKEzFU +QyBUcnVzdENlbnRlciBmb3IgU2VjdXJpdHkgaW4gRGF0YSBOZXR3b3JrcyBHbWJI +MSIwIAYDVQQLExlUQyBUcnVzdENlbnRlciBDbGFzcyAzIENBMSkwJwYJKoZIhvcN +AQkBFhpjZXJ0aWZpY2F0ZUB0cnVzdGNlbnRlci5kZTAeFw05ODAzMDkxMTU5NTla +Fw0xMTAxMDExMTU5NTlaMIG8MQswCQYDVQQGEwJERTEQMA4GA1UECBMHSGFtYnVy +ZzEQMA4GA1UEBxMHSGFtYnVyZzE6MDgGA1UEChMxVEMgVHJ1c3RDZW50ZXIgZm9y +IFNlY3VyaXR5IGluIERhdGEgTmV0d29ya3MgR21iSDEiMCAGA1UECxMZVEMgVHJ1 +c3RDZW50ZXIgQ2xhc3MgMyBDQTEpMCcGCSqGSIb3DQEJARYaY2VydGlmaWNhdGVA +dHJ1c3RjZW50ZXIuZGUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALa0wTUF +Lg2N7KBAahwOJ6ZQkmtQGwfeLud2zODa/ISoXoxjaitN2U4CdhHBC/KNecoAtvGw +Dtf7pBc9r6tpepYnv68zoZoqWarEtTcI8hKlMbZD9TKWcSgoq40oht+77uMMfTDW +w1Krj10nnGvAo+cFa1dJRLNu6mTP0o56UHd3AgMBAAGjazBpMA8GA1UdEwEB/wQF +MAMBAf8wDgYDVR0PAQH/BAQDAgGGMDMGCWCGSAGG+EIBCAQmFiRodHRwOi8vd3d3 +LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwEQYJYIZIAYb4QgEBBAQDAgAHMA0G +CSqGSIb3DQEBBAUAA4GBABY9xs3Bu4VxhUafPiCPUSiZ7C1FIWMjWwS7TJC4iJIE +Tb19AaM/9uzO8d7+feXhPrvGq14L3T2WxMup1Pkm5gZOngylerpuw3yCGdHHsbHD +2w2Om0B8NwvxXej9H5CIpQ5ON2QhqE6NtJ/x3kit1VYYUimLRzQSCdS7kjXvD9s0 +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 65568 (0x10020) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA + Validity + Not Before: Jun 11 10:46:39 2002 GMT + Not After : Jun 11 10:46:39 2027 GMT + Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:ce:b1:c1:2e:d3:4f:7c:cd:25:ce:18:3e:4f:c4: + 8c:6f:80:6a:73:c8:5b:51:f8:9b:d2:dc:bb:00:5c: + b1:a0:fc:75:03:ee:81:f0:88:ee:23:52:e9:e6:15: + 33:8d:ac:2d:09:c5:76:f9:2b:39:80:89:e4:97:4b: + 90:a5:a8:78:f8:73:43:7b:a4:61:b0:d8:58:cc:e1: + 6c:66:7e:9c:f3:09:5e:55:63:84:d5:a8:ef:f3:b1: + 2e:30:68:b3:c4:3c:d8:ac:6e:8d:99:5a:90:4e:34: + dc:36:9a:8f:81:88:50:b7:6d:96:42:09:f3:d7:95: + 83:0d:41:4b:b0:6a:6b:f8:fc:0f:7e:62:9f:67:c4: + ed:26:5f:10:26:0f:08:4f:f0:a4:57:28:ce:8f:b8: + ed:45:f6:6e:ee:25:5d:aa:6e:39:be:e4:93:2f:d9: + 47:a0:72:eb:fa:a6:5b:af:ca:53:3f:e2:0e:c6:96: + 56:11:6e:f7:e9:66:a9:26:d8:7f:95:53:ed:0a:85: + 88:ba:4f:29:a5:42:8c:5e:b6:fc:85:20:00:aa:68: + 0b:a1:1a:85:01:9c:c4:46:63:82:88:b6:22:b1:ee: + fe:aa:46:59:7e:cf:35:2c:d5:b6:da:5d:f7:48:33: + 14:54:b6:eb:d9:6f:ce:cd:88:d6:ab:1b:da:96:3b: + 1d:59 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + Signature Algorithm: sha1WithRSAEncryption + b8:8d:ce:ef:e7:14:ba:cf:ee:b0:44:92:6c:b4:39:3e:a2:84: + 6e:ad:b8:21:77:d2:d4:77:82:87:e6:20:41:81:ee:e2:f8:11: + b7:63:d1:17:37:be:19:76:24:1c:04:1a:4c:eb:3d:aa:67:6f: + 2d:d4:cd:fe:65:31:70:c5:1b:a6:02:0a:ba:60:7b:6d:58:c2: + 9a:49:fe:63:32:0b:6b:e3:3a:c0:ac:ab:3b:b0:e8:d3:09:51: + 8c:10:83:c6:34:e0:c5:2b:e0:1a:b6:60:14:27:6c:32:77:8c: + bc:b2:72:98:cf:cd:cc:3f:b9:c8:24:42:14:d6:57:fc:e6:26: + 43:a9:1d:e5:80:90:ce:03:54:28:3e:f7:3f:d3:f8:4d:ed:6a: + 0a:3a:93:13:9b:3b:14:23:13:63:9c:3f:d1:87:27:79:e5:4c: + 51:e3:01:ad:85:5d:1a:3b:b1:d5:73:10:a4:d3:f2:bc:6e:64: + f5:5a:56:90:a8:c7:0e:4c:74:0f:2e:71:3b:f7:c8:47:f4:69: + 6f:15:f2:11:5e:83:1e:9c:7c:52:ae:fd:02:da:12:a8:59:67: + 18:db:bc:70:dd:9b:b1:69:ed:80:ce:89:40:48:6a:0e:35:ca: + 29:66:15:21:94:2c:e8:60:2a:9b:85:4a:40:f3:6b:8a:24:ec: + 06:16:2c:73 +MD5 Fingerprint=2C:8F:9F:66:1D:18:90:B1:47:26:9D:8E:86:82:8C:A9 +-----BEGIN CERTIFICATE----- +MIIDDDCCAfSgAwIBAgIDAQAgMA0GCSqGSIb3DQEBBQUAMD4xCzAJBgNVBAYTAlBM +MRswGQYDVQQKExJVbml6ZXRvIFNwLiB6IG8uby4xEjAQBgNVBAMTCUNlcnR1bSBD +QTAeFw0wMjA2MTExMDQ2MzlaFw0yNzA2MTExMDQ2MzlaMD4xCzAJBgNVBAYTAlBM +MRswGQYDVQQKExJVbml6ZXRvIFNwLiB6IG8uby4xEjAQBgNVBAMTCUNlcnR1bSBD +QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM6xwS7TT3zNJc4YPk/E +jG+AanPIW1H4m9LcuwBcsaD8dQPugfCI7iNS6eYVM42sLQnFdvkrOYCJ5JdLkKWo +ePhzQ3ukYbDYWMzhbGZ+nPMJXlVjhNWo7/OxLjBos8Q82KxujZlakE403Daaj4GI +ULdtlkIJ89eVgw1BS7Bqa/j8D35in2fE7SZfECYPCE/wpFcozo+47UX2bu4lXapu +Ob7kky/ZR6By6/qmW6/KUz/iDsaWVhFu9+lmqSbYf5VT7QqFiLpPKaVCjF62/IUg +AKpoC6EahQGcxEZjgoi2IrHu/qpGWX7PNSzVttpd90gzFFS269lvzs2I1qsb2pY7 +HVkCAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEA +uI3O7+cUus/usESSbLQ5PqKEbq24IXfS1HeCh+YgQYHu4vgRt2PRFze+GXYkHAQa +TOs9qmdvLdTN/mUxcMUbpgIKumB7bVjCmkn+YzILa+M6wKyrO7Do0wlRjBCDxjTg +xSvgGrZgFCdsMneMvLJymM/NzD+5yCRCFNZX/OYmQ6kd5YCQzgNUKD73P9P4Te1q +CjqTE5s7FCMTY5w/0YcneeVMUeMBrYVdGjux1XMQpNPyvG5k9VpWkKjHDkx0Dy5x +O/fIR/RpbxXyEV6DHpx8Uq79AtoSqFlnGNu8cN2bsWntgM6JQEhqDjXKKWYVIZQs +6GAqm4VKQPNriiTsBhYscw== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services + Validity + Not Before: Jan 1 00:00:00 2004 GMT + Not After : Dec 31 23:59:59 2028 GMT + Subject: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:be:40:9d:f4:6e:e1:ea:76:87:1c:4d:45:44:8e: + be:46:c8:83:06:9d:c1:2a:fe:18:1f:8e:e4:02:fa: + f3:ab:5d:50:8a:16:31:0b:9a:06:d0:c5:70:22:cd: + 49:2d:54:63:cc:b6:6e:68:46:0b:53:ea:cb:4c:24: + c0:bc:72:4e:ea:f1:15:ae:f4:54:9a:12:0a:c3:7a: + b2:33:60:e2:da:89:55:f3:22:58:f3:de:dc:cf:ef: + 83:86:a2:8c:94:4f:9f:68:f2:98:90:46:84:27:c7: + 76:bf:e3:cc:35:2c:8b:5e:07:64:65:82:c0:48:b0: + a8:91:f9:61:9f:76:20:50:a8:91:c7:66:b5:eb:78: + 62:03:56:f0:8a:1a:13:ea:31:a3:1e:a0:99:fd:38: + f6:f6:27:32:58:6f:07:f5:6b:b8:fb:14:2b:af:b7: + aa:cc:d6:63:5f:73:8c:da:05:99:a8:38:a8:cb:17: + 78:36:51:ac:e9:9e:f4:78:3a:8d:cf:0f:d9:42:e2: + 98:0c:ab:2f:9f:0e:01:de:ef:9f:99:49:f1:2d:df: + ac:74:4d:1b:98:b5:47:c5:e5:29:d1:f9:90:18:c7: + 62:9c:be:83:c7:26:7b:3e:8a:25:c7:c0:dd:9d:e6: + 35:68:10:20:9d:8f:d8:de:d2:c3:84:9c:0d:5e:e8: + 2f:c9 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 CRL Distribution Points: + URI:http://crl.comodoca.com/AAACertificateServices.crl + URI:http://crl.comodo.net/AAACertificateServices.crl + + Signature Algorithm: sha1WithRSAEncryption + 08:56:fc:02:f0:9b:e8:ff:a4:fa:d6:7b:c6:44:80:ce:4f:c4: + c5:f6:00:58:cc:a6:b6:bc:14:49:68:04:76:e8:e6:ee:5d:ec: + 02:0f:60:d6:8d:50:18:4f:26:4e:01:e3:e6:b0:a5:ee:bf:bc: + 74:54:41:bf:fd:fc:12:b8:c7:4f:5a:f4:89:60:05:7f:60:b7: + 05:4a:f3:f6:f1:c2:bf:c4:b9:74:86:b6:2d:7d:6b:cc:d2:f3: + 46:dd:2f:c6:e0:6a:c3:c3:34:03:2c:7d:96:dd:5a:c2:0e:a7: + 0a:99:c1:05:8b:ab:0c:2f:f3:5c:3a:cf:6c:37:55:09:87:de: + 53:40:6c:58:ef:fc:b6:ab:65:6e:04:f6:1b:dc:3c:e0:5a:15: + c6:9e:d9:f1:59:48:30:21:65:03:6c:ec:e9:21:73:ec:9b:03: + a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c: + d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2: + a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2: + ae:f2:e3:2b:38:3a:09:81:b5:6b:85:d7:be:2d:ed:3f:1a:b7: + b2:63:e2:f5:62:2c:82:d4:6a:00:41:50:f1:39:83:9f:95:e9: + 36:96:98:6e +MD5 Fingerprint=49:79:04:B0:EB:87:19:AC:47:B0:BC:11:51:9B:74:D0 +-----BEGIN CERTIFICATE----- +MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb +MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow +GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj +YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL +MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE +BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM +GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP +ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua +BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe +3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4 +YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR +rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm +ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU +oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF +MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v +QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t +b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF +AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q +GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz +Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2 +G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi +l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3 +smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=Secure Certificate Services + Validity + Not Before: Jan 1 00:00:00 2004 GMT + Not After : Dec 31 23:59:59 2028 GMT + Subject: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=Secure Certificate Services + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:c0:71:33:82:8a:d0:70:eb:73:87:82:40:d5:1d: + e4:cb:c9:0e:42:90:f9:de:34:b9:a1:ba:11:f4:25: + 85:f3:cc:72:6d:f2:7b:97:6b:b3:07:f1:77:24:91: + 5f:25:8f:f6:74:3d:e4:80:c2:f8:3c:0d:f3:bf:40: + ea:f7:c8:52:d1:72:6f:ef:c8:ab:41:b8:6e:2e:17: + 2a:95:69:0c:cd:d2:1e:94:7b:2d:94:1d:aa:75:d7: + b3:98:cb:ac:bc:64:53:40:bc:8f:ac:ac:36:cb:5c: + ad:bb:dd:e0:94:17:ec:d1:5c:d0:bf:ef:a5:95:c9: + 90:c5:b0:ac:fb:1b:43:df:7a:08:5d:b7:b8:f2:40: + 1b:2b:27:9e:50:ce:5e:65:82:88:8c:5e:d3:4e:0c: + 7a:ea:08:91:b6:36:aa:2b:42:fb:ea:c2:a3:39:e5: + db:26:38:ad:8b:0a:ee:19:63:c7:1c:24:df:03:78: + da:e6:ea:c1:47:1a:0b:0b:46:09:dd:02:fc:de:cb: + 87:5f:d7:30:63:68:a1:ae:dc:32:a1:ba:be:fe:44: + ab:68:b6:a5:17:15:fd:bd:d5:a7:a7:9a:e4:44:33: + e9:88:8e:fc:ed:51:eb:93:71:4e:ad:01:e7:44:8e: + ab:2d:cb:a8:fe:01:49:48:f0:c0:dd:c7:68:d8:92: + fe:3d + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + 3C:D8:93:88:C2:C0:82:09:CC:01:99:06:93:20:E9:9E:70:09:63:4F + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 CRL Distribution Points: + URI:http://crl.comodoca.com/SecureCertificateServices.crl + URI:http://crl.comodo.net/SecureCertificateServices.crl + + Signature Algorithm: sha1WithRSAEncryption + 87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94: + 59:66:e0:9e:28:a8:5e:d3:b7:f4:34:e6:aa:39:b2:97:16:c5: + 82:6f:32:a4:e9:8c:e7:af:fd:ef:c2:e8:b9:4b:aa:a3:f4:e6: + da:8d:65:21:fb:ba:80:eb:26:28:85:1a:fe:39:8c:de:5b:04: + 04:b4:54:f9:a3:67:9e:41:fa:09:52:cc:05:48:a8:c9:3f:21: + 04:1e:ce:48:6b:fc:85:e8:c2:7b:af:7f:b7:cc:f8:5f:3a:fd: + 35:c6:0d:ef:97:dc:4c:ab:11:e1:6b:cb:31:d1:6c:fb:48:80: + ab:dc:9c:37:b8:21:14:4b:0d:71:3d:ec:83:33:6e:d1:6e:32: + 16:ec:98:c7:16:8b:59:a6:34:ab:05:57:2d:93:f7:aa:13:cb: + d2:13:e2:b7:2e:3b:cd:6b:50:17:09:68:3e:b5:26:57:ee:b6: + e0:b6:dd:b9:29:80:79:7d:8f:a3:f0:a4:28:a4:15:c4:85:f4: + 27:d4:6b:bf:e5:5c:e4:65:02:76:54:b4:e3:37:66:24:d3:19: + 61:c8:52:10:e5:8b:37:9a:b9:a9:f9:1d:bf:ea:99:92:61:96: + ff:01:cd:a1:5f:0d:bc:71:bc:0e:ac:0b:1d:47:45:1d:c1:ec: + 7c:ec:fd:29 +MD5 Fingerprint=D3:D9:BD:AE:9F:AC:67:24:B3:C8:1B:52:E1:B9:A9:BD +-----BEGIN CERTIFICATE----- +MIIEPzCCAyegAwIBAgIBATANBgkqhkiG9w0BAQUFADB+MQswCQYDVQQGEwJHQjEb +MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow +GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEkMCIGA1UEAwwbU2VjdXJlIENlcnRp +ZmljYXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVow +fjELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G +A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxJDAiBgNV +BAMMG1NlY3VyZSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEB +BQADggEPADCCAQoCggEBAMBxM4KK0HDrc4eCQNUd5MvJDkKQ+d40uaG6EfQlhfPM +cm3ye5drswfxdySRXyWP9nQ95IDC+DwN879A6vfIUtFyb+/Iq0G4bi4XKpVpDM3S +HpR7LZQdqnXXs5jLrLxkU0C8j6ysNstcrbvd4JQX7NFc0L/vpZXJkMWwrPsbQ996 +CF23uPJAGysnnlDOXmWCiIxe004MeuoIkbY2qitC++rCoznl2yY4rYsK7hljxxwk +3wN42ubqwUcaCwtGCd0C/N7Lh1/XMGNooa7cMqG6vv5Eq2i2pRcV/b3Vp6ea5EQz +6YiO/O1R65NxTq0B50SOqy3LqP4BSUjwwN3HaNiS/j0CAwEAAaOBxzCBxDAdBgNV +HQ4EFgQUPNiTiMLAggnMAZkGkyDpnnAJY08wDgYDVR0PAQH/BAQDAgEGMA8GA1Ud +EwEB/wQFMAMBAf8wgYEGA1UdHwR6MHgwO6A5oDeGNWh0dHA6Ly9jcmwuY29tb2Rv +Y2EuY29tL1NlY3VyZUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDmgN6A1hjNodHRw +Oi8vY3JsLmNvbW9kby5uZXQvU2VjdXJlQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmww +DQYJKoZIhvcNAQEFBQADggEBAIcBbSMdflsXfcFhMs+P5/OKlFlm4J4oqF7Tt/Q0 +5qo5spcWxYJvMqTpjOev/e/C6LlLqqP05tqNZSH7uoDrJiiFGv45jN5bBAS0VPmj +Z55B+glSzAVIqMk/IQQezkhr/IXownuvf7fM+F86/TXGDe+X3EyrEeFryzHRbPtI +gKvcnDe4IRRLDXE97IMzbtFuMhbsmMcWi1mmNKsFVy2T96oTy9IT4rcuO81rUBcJ +aD61JlfutuC23bkpgHl9j6PwpCikFcSF9CfUa7/lXORlAnZUtOM3ZiTTGWHIUhDl +izeauan5Hb/qmZJhlv8BzaFfDbxxvA6sCx1HRR3B7Hzs/Sk= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=Trusted Certificate Services + Validity + Not Before: Jan 1 00:00:00 2004 GMT + Not After : Dec 31 23:59:59 2028 GMT + Subject: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=Trusted Certificate Services + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:df:71:6f:36:58:53:5a:f2:36:54:57:80:c4:74: + 08:20:ed:18:7f:2a:1d:e6:35:9a:1e:25:ac:9c:e5: + 96:7e:72:52:a0:15:42:db:59:dd:64:7a:1a:d0:b8: + 7b:dd:39:15:bc:55:48:c4:ed:3a:00:ea:31:11:ba: + f2:71:74:1a:67:b8:cf:33:cc:a8:31:af:a3:e3:d7: + 7f:bf:33:2d:4c:6a:3c:ec:8b:c3:92:d2:53:77:24: + 74:9c:07:6e:70:fc:bd:0b:5b:76:ba:5f:f2:ff:d7: + 37:4b:4a:60:78:f7:f0:fa:ca:70:b4:ea:59:aa:a3: + ce:48:2f:a9:c3:b2:0b:7e:17:72:16:0c:a6:07:0c: + 1b:38:cf:c9:62:b7:3f:a0:93:a5:87:41:f2:b7:70: + 40:77:d8:be:14:7c:e3:a8:c0:7a:8e:e9:63:6a:d1: + 0f:9a:c6:d2:f4:8b:3a:14:04:56:d4:ed:b8:cc:6e: + f5:fb:e2:2c:58:bd:7f:4f:6b:2b:f7:60:24:58:24: + ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7: + 5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49: + 5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06: + 9f:d2:5b:5e:11:1b:f4:c7:04:35:29:d2:55:5c:e4: + ed:eb + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + C5:7B:58:BD:ED:DA:25:69:D2:F7:59:16:A8:B3:32:C0:7B:27:5B:F4 + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 CRL Distribution Points: + URI:http://crl.comodoca.com/TrustedCertificateServices.crl + URI:http://crl.comodo.net/TrustedCertificateServices.crl + + Signature Algorithm: sha1WithRSAEncryption + c8:93:81:3b:89:b4:af:b8:84:12:4c:8d:d2:f0:db:70:ba:57: + 86:15:34:10:b9:2f:7f:1e:b0:a8:89:60:a1:8a:c2:77:0c:50: + 4a:9b:00:8b:d8:8b:f4:41:e2:d0:83:8a:4a:1c:14:06:b0:a3: + 68:05:70:31:30:a7:53:9b:0e:e9:4a:a0:58:69:67:0e:ae:9d: + f6:a5:2c:41:bf:3c:06:6b:e4:59:cc:6d:10:f1:96:6f:1f:df: + f4:04:02:a4:9f:45:3e:c8:d8:fa:36:46:44:50:3f:82:97:91: + 1f:28:db:18:11:8c:2a:e4:65:83:57:12:12:8c:17:3f:94:36: + fe:5d:b0:c0:04:77:13:b8:f4:15:d5:3f:38:cc:94:3a:55:d0: + ac:98:f5:ba:00:5f:e0:86:19:81:78:2f:28:c0:7e:d3:cc:42: + 0a:f5:ae:50:a0:d1:3e:c6:a1:71:ec:3f:a0:20:8c:66:3a:89: + b4:8e:d4:d8:b1:4d:25:47:ee:2f:88:c8:b5:e1:05:45:c0:be: + 14:71:de:7a:fd:8e:7b:7d:4d:08:96:a5:12:73:f0:2d:ca:37: + 27:74:12:27:4c:cb:b6:97:e9:d9:ae:08:6d:5a:39:40:dd:05: + 47:75:6a:5a:21:b3:a3:18:cf:4e:f7:2e:57:b7:98:70:5e:c8: + c4:78:b0:62 +MD5 Fingerprint=91:1B:3F:6E:CD:9E:AB:EE:07:FE:1F:71:D2:B3:61:27 +-----BEGIN CERTIFICATE----- +MIIEQzCCAyugAwIBAgIBATANBgkqhkiG9w0BAQUFADB/MQswCQYDVQQGEwJHQjEb +MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow +GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDElMCMGA1UEAwwcVHJ1c3RlZCBDZXJ0 +aWZpY2F0ZSBTZXJ2aWNlczAeFw0wNDAxMDEwMDAwMDBaFw0yODEyMzEyMzU5NTla +MH8xCzAJBgNVBAYTAkdCMRswGQYDVQQIDBJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO +BgNVBAcMB1NhbGZvcmQxGjAYBgNVBAoMEUNvbW9kbyBDQSBMaW1pdGVkMSUwIwYD +VQQDDBxUcnVzdGVkIENlcnRpZmljYXRlIFNlcnZpY2VzMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEA33FvNlhTWvI2VFeAxHQIIO0Yfyod5jWaHiWsnOWW +fnJSoBVC21ndZHoa0Lh73TkVvFVIxO06AOoxEbrycXQaZ7jPM8yoMa+j49d/vzMt +TGo87IvDktJTdyR0nAducPy9C1t2ul/y/9c3S0pgePfw+spwtOpZqqPOSC+pw7IL +fhdyFgymBwwbOM/JYrc/oJOlh0Hyt3BAd9i+FHzjqMB6juljatEPmsbS9Is6FARW +1O24zG71++IsWL1/T2sr92AkWCTOJu80kTrV44HQsvAEAtdbtz6SrGsSivnkBbA7 +kUlcsutT6vifR4buv5XAwAaf0lteERv0xwQ1KdJVXOTt6wIDAQABo4HJMIHGMB0G +A1UdDgQWBBTFe1i97doladL3WRaoszLAeydb9DAOBgNVHQ8BAf8EBAMCAQYwDwYD +VR0TAQH/BAUwAwEB/zCBgwYDVR0fBHwwejA8oDqgOIY2aHR0cDovL2NybC5jb21v +ZG9jYS5jb20vVHJ1c3RlZENlcnRpZmljYXRlU2VydmljZXMuY3JsMDqgOKA2hjRo +dHRwOi8vY3JsLmNvbW9kby5uZXQvVHJ1c3RlZENlcnRpZmljYXRlU2VydmljZXMu +Y3JsMA0GCSqGSIb3DQEBBQUAA4IBAQDIk4E7ibSvuIQSTI3S8NtwuleGFTQQuS9/ +HrCoiWChisJ3DFBKmwCL2Iv0QeLQg4pKHBQGsKNoBXAxMKdTmw7pSqBYaWcOrp32 +pSxBvzwGa+RZzG0Q8ZZvH9/0BAKkn0U+yNj6NkZEUD+Cl5EfKNsYEYwq5GWDVxIS +jBc/lDb+XbDABHcTuPQV1T84zJQ6VdCsmPW6AF/ghhmBeC8owH7TzEIK9a5QoNE+ +xqFx7D+gIIxmOom0jtTYsU0lR+4viMi14QVFwL4Ucd56/Y57fU0IlqUSc/Atyjcn +dBInTMu2l+nZrghtWjlA3QVHdWpaIbOjGM9O9y5Xt5hwXsjEeLBi +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA Chained CAs Certification Authority, CN=IPS CA Chained CAs Certification Authority/emailAddress=ips@mail.ips.es + Validity + Not Before: Dec 29 00:53:58 2001 GMT + Not After : Dec 27 00:53:58 2025 GMT + Subject: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA Chained CAs Certification Authority, CN=IPS CA Chained CAs Certification Authority/emailAddress=ips@mail.ips.es + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:dc:56:92:49:b2:94:20:bc:98:4f:50:eb:68:a4: + a7:49:0b:bf:d2:31:e8:c7:4f:c2:86:0b:fa:68:fd: + 43:5a:8a:f3:60:92:35:99:38:bb:4d:03:52:21:5b: + f0:37:99:35:e1:41:20:81:85:81:05:71:81:9d:b4: + 95:19:a9:5f:76:34:2e:63:37:35:57:8e:b4:1f:42: + 3f:15:5c:e1:7a:c1:5f:13:18:32:31:c9:ad:be:a3: + c7:83:66:1e:b9:9c:04:13:cb:69:c1:06:de:30:06: + bb:33:a3:b5:1f:f0:8f:6f:ce:ff:96:e8:54:be:66: + 80:ae:6b:db:41:84:36:a2:3d + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + A1:AD:31:B1:F9:3E:E1:17:A6:C8:AB:34:FC:52:87:09:1E:62:52:41 + X509v3 Authority Key Identifier: + keyid:A1:AD:31:B1:F9:3E:E1:17:A6:C8:AB:34:FC:52:87:09:1E:62:52:41 + DirName:/C=ES/ST=Barcelona/L=Barcelona/O=IPS Internet publishing Services s.l./O=ips@mail.ips.es C.I.F. B-60929452/OU=IPS CA Chained CAs Certification Authority/CN=IPS CA Chained CAs Certification Authority/emailAddress=ips@mail.ips.es + serial:00 + + X509v3 Basic Constraints: + CA:TRUE + X509v3 Key Usage: + Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign, Encipher Only, Decipher Only + X509v3 Extended Key Usage: + TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, Time Stamping, Microsoft Individual Code Signing, Microsoft Commercial Code Signing, Microsoft Trust List Signing, Microsoft Encrypted File System + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 Subject Alternative Name: + email:ips@mail.ips.es + X509v3 Issuer Alternative Name: + email:ips@mail.ips.es + Netscape Comment: + Chained CA Certificate issued by http://www.ips.es/ + Netscape Base Url: + http://www.ips.es/ips2002/ + Netscape CA Revocation Url: + http://www.ips.es/ips2002/ips2002CAC.crl + Netscape Revocation Url: + http://www.ips.es/ips2002/revocationCAC.html? + Netscape Renewal Url: + http://www.ips.es/ips2002/renewalCAC.html? + Netscape CA Policy Url: + http://www.ips.es/ips2002/policyCAC.html + X509v3 CRL Distribution Points: + URI:http://www.ips.es/ips2002/ips2002CAC.crl + URI:http://wwwback.ips.es/ips2002/ips2002CAC.crl + + Authority Information Access: + OCSP - URI:http://ocsp.ips.es/ + + Signature Algorithm: sha1WithRSAEncryption + 44:72:30:9d:56:58:a2:41:1b:28:b7:95:e1:a6:1a:95:5f:a7: + 78:40:2b:ef:db:96:4a:fc:4c:71:63:d9:73:95:bd:02:e2:a2: + 06:c7:be:97:2a:93:80:34:86:03:fa:dc:d8:3d:1e:07:cd:1e: + 73:43:24:60:f5:1d:61:dc:dc:96:a0:bc:fb:1d:e3:e7:12:00: + 27:33:02:c0:c0:2b:53:3d:d8:6b:03:81:a3:db:d6:93:95:20: + ef:d3:96:7e:26:90:89:9c:26:9b:cd:6f:66:ab:ed:03:22:44: + 38:cc:59:bd:9f:db:f6:07:a2:01:7f:26:c4:63:f5:25:42:5e: + 62:bd +MD5 Fingerprint=8D:72:51:DB:A0:3A:CF:20:77:DF:F2:65:06:5E:DF:EF +-----BEGIN CERTIFICATE----- +MIIH9zCCB2CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCARwxCzAJBgNVBAYTAkVT +MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE +ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE +ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjEzMDEGA1UECxMq +SVBTIENBIENoYWluZWQgQ0FzIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MTMwMQYD +VQQDEypJUFMgQ0EgQ2hhaW5lZCBDQXMgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkx +HjAcBgkqhkiG9w0BCQEWD2lwc0BtYWlsLmlwcy5lczAeFw0wMTEyMjkwMDUzNTha +Fw0yNTEyMjcwMDUzNThaMIIBHDELMAkGA1UEBhMCRVMxEjAQBgNVBAgTCUJhcmNl +bG9uYTESMBAGA1UEBxMJQmFyY2Vsb25hMS4wLAYDVQQKEyVJUFMgSW50ZXJuZXQg +cHVibGlzaGluZyBTZXJ2aWNlcyBzLmwuMSswKQYDVQQKFCJpcHNAbWFpbC5pcHMu +ZXMgQy5JLkYuICBCLTYwOTI5NDUyMTMwMQYDVQQLEypJUFMgQ0EgQ2hhaW5lZCBD +QXMgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxMzAxBgNVBAMTKklQUyBDQSBDaGFp +bmVkIENBcyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEeMBwGCSqGSIb3DQEJARYP +aXBzQG1haWwuaXBzLmVzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDcVpJJ +spQgvJhPUOtopKdJC7/SMejHT8KGC/po/UNaivNgkjWZOLtNA1IhW/A3mTXhQSCB +hYEFcYGdtJUZqV92NC5jNzVXjrQfQj8VXOF6wV8TGDIxya2+o8eDZh65nAQTy2nB +Bt4wBrszo7Uf8I9vzv+W6FS+ZoCua9tBhDaiPQIDAQABo4IEQzCCBD8wHQYDVR0O +BBYEFKGtMbH5PuEXpsirNPxShwkeYlJBMIIBTgYDVR0jBIIBRTCCAUGAFKGtMbH5 +PuEXpsirNPxShwkeYlJBoYIBJKSCASAwggEcMQswCQYDVQQGEwJFUzESMBAGA1UE +CBMJQmFyY2Vsb25hMRIwEAYDVQQHEwlCYXJjZWxvbmExLjAsBgNVBAoTJUlQUyBJ +bnRlcm5ldCBwdWJsaXNoaW5nIFNlcnZpY2VzIHMubC4xKzApBgNVBAoUImlwc0Bt +YWlsLmlwcy5lcyBDLkkuRi4gIEItNjA5Mjk0NTIxMzAxBgNVBAsTKklQUyBDQSBD +aGFpbmVkIENBcyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEzMDEGA1UEAxMqSVBT +IENBIENoYWluZWQgQ0FzIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MR4wHAYJKoZI +hvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOCAQAwDAYDVR0TBAUwAwEB/zAMBgNVHQ8E +BQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMG +CCsGAQUFBwMEBggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYB +BAGCNwoDAQYKKwYBBAGCNwoDBDARBglghkgBhvhCAQEEBAMCAAcwGgYDVR0RBBMw +EYEPaXBzQG1haWwuaXBzLmVzMBoGA1UdEgQTMBGBD2lwc0BtYWlsLmlwcy5lczBC +BglghkgBhvhCAQ0ENRYzQ2hhaW5lZCBDQSBDZXJ0aWZpY2F0ZSBpc3N1ZWQgYnkg +aHR0cDovL3d3dy5pcHMuZXMvMCkGCWCGSAGG+EIBAgQcFhpodHRwOi8vd3d3Lmlw +cy5lcy9pcHMyMDAyLzA3BglghkgBhvhCAQQEKhYoaHR0cDovL3d3dy5pcHMuZXMv +aXBzMjAwMi9pcHMyMDAyQ0FDLmNybDA8BglghkgBhvhCAQMELxYtaHR0cDovL3d3 +dy5pcHMuZXMvaXBzMjAwMi9yZXZvY2F0aW9uQ0FDLmh0bWw/MDkGCWCGSAGG+EIB +BwQsFipodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL3JlbmV3YWxDQUMuaHRtbD8w +NwYJYIZIAYb4QgEIBCoWKGh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvcG9saWN5 +Q0FDLmh0bWwwbQYDVR0fBGYwZDAuoCygKoYoaHR0cDovL3d3dy5pcHMuZXMvaXBz +MjAwMi9pcHMyMDAyQ0FDLmNybDAyoDCgLoYsaHR0cDovL3d3d2JhY2suaXBzLmVz +L2lwczIwMDIvaXBzMjAwMkNBQy5jcmwwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUF +BzABhhNodHRwOi8vb2NzcC5pcHMuZXMvMA0GCSqGSIb3DQEBBQUAA4GBAERyMJ1W +WKJBGyi3leGmGpVfp3hAK+/blkr8THFj2XOVvQLiogbHvpcqk4A0hgP63Ng9HgfN +HnNDJGD1HWHc3JagvPsd4+cSACczAsDAK1M92GsDgaPb1pOVIO/Tln4mkImcJpvN +b2ar7QMiRDjMWb2f2/YHogF/JsRj9SVCXmK9 +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA CLASE1 Certification Authority, CN=IPS CA CLASE1 Certification Authority/emailAddress=ips@mail.ips.es + Validity + Not Before: Dec 29 00:59:38 2001 GMT + Not After : Dec 27 00:59:38 2025 GMT + Subject: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA CLASE1 Certification Authority, CN=IPS CA CLASE1 Certification Authority/emailAddress=ips@mail.ips.es + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:e0:51:27:a7:0b:dd:af:d1:b9:43:5b:82:37:45: + 56:72:ef:9a:b6:c2:12:ef:2c:12:cc:76:f9:06:59: + af:5d:21:d4:d2:5a:b8:a0:d4:f3:6a:fd:ca:69:8d: + 66:48:f7:74:e6:ee:36:bd:e8:96:91:75:a6:71:28: + ca:e7:22:12:32:69:b0:3e:1e:6b:f4:50:52:62:62: + fd:63:3b:7d:7e:ec:ee:38:ea:62:f4:6c:a8:71:8d: + e1:e9:8b:c9:3f:c6:b5:cd:94:42:6f:dd:82:45:3c: + e8:df:09:e8:ef:0a:55:a9:56:47:61:4c:49:64:73: + 10:28:3f:ca:bf:09:ff:c6:2f + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + EB:B3:19:79:F3:C1:A5:1C:AC:DC:BA:1F:66:A2:B2:9B:69:D0:78:08 + X509v3 Authority Key Identifier: + keyid:EB:B3:19:79:F3:C1:A5:1C:AC:DC:BA:1F:66:A2:B2:9B:69:D0:78:08 + DirName:/C=ES/ST=Barcelona/L=Barcelona/O=IPS Internet publishing Services s.l./O=ips@mail.ips.es C.I.F. B-60929452/OU=IPS CA CLASE1 Certification Authority/CN=IPS CA CLASE1 Certification Authority/emailAddress=ips@mail.ips.es + serial:00 + + X509v3 Basic Constraints: + CA:TRUE + X509v3 Key Usage: + Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign, Encipher Only, Decipher Only + X509v3 Extended Key Usage: + TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, Time Stamping, Microsoft Individual Code Signing, Microsoft Commercial Code Signing, Microsoft Trust List Signing, Microsoft Encrypted File System + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 Subject Alternative Name: + email:ips@mail.ips.es + X509v3 Issuer Alternative Name: + email:ips@mail.ips.es + Netscape Comment: + CLASE1 CA Certificate issued by http://www.ips.es/ + Netscape Base Url: + http://www.ips.es/ips2002/ + Netscape CA Revocation Url: + http://www.ips.es/ips2002/ips2002CLASE1.crl + Netscape Revocation Url: + http://www.ips.es/ips2002/revocationCLASE1.html? + Netscape Renewal Url: + http://www.ips.es/ips2002/renewalCLASE1.html? + Netscape CA Policy Url: + http://www.ips.es/ips2002/policyCLASE1.html + X509v3 CRL Distribution Points: + URI:http://www.ips.es/ips2002/ips2002CLASE1.crl + URI:http://wwwback.ips.es/ips2002/ips2002CLASE1.crl + + Authority Information Access: + OCSP - URI:http://ocsp.ips.es/ + + Signature Algorithm: sha1WithRSAEncryption + 2b:d0:eb:fd:da:c8:ca:59:6a:da:d3:cc:32:2e:c9:54:1b:8a: + 62:7e:15:2d:e9:d9:31:d3:2e:f4:27:23:ff:5b:ab:c5:4a:b6: + 72:40:ae:53:74:f4:bc:05:b4:c6:d9:c8:c9:77:fb:b7:f9:34: + 7f:78:00:f8:d6:a4:e4:52:3f:2c:4a:63:57:81:75:5a:8e:e8: + 8c:fb:02:c0:94:c6:29:ba:b3:dc:1c:e8:b2:af:d2:2e:62:5b: + 1a:a9:8e:0e:cc:c5:57:45:51:14:e9:4e:1c:88:a5:91:f4:a3: + f7:8e:51:c8:a9:be:86:33:3e:e6:2f:48:6e:af:54:90:4e:ad: + b1:25 +MD5 Fingerprint=84:90:1D:95:30:49:56:FC:41:81:F0:45:D7:76:C4:6B +-----BEGIN CERTIFICATE----- +MIIH6jCCB1OgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCARIxCzAJBgNVBAYTAkVT +MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE +ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE +ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjEuMCwGA1UECxMl +SVBTIENBIENMQVNFMSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEuMCwGA1UEAxMl +SVBTIENBIENMQVNFMSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEeMBwGCSqGSIb3 +DQEJARYPaXBzQG1haWwuaXBzLmVzMB4XDTAxMTIyOTAwNTkzOFoXDTI1MTIyNzAw +NTkzOFowggESMQswCQYDVQQGEwJFUzESMBAGA1UECBMJQmFyY2Vsb25hMRIwEAYD +VQQHEwlCYXJjZWxvbmExLjAsBgNVBAoTJUlQUyBJbnRlcm5ldCBwdWJsaXNoaW5n +IFNlcnZpY2VzIHMubC4xKzApBgNVBAoUImlwc0BtYWlsLmlwcy5lcyBDLkkuRi4g +IEItNjA5Mjk0NTIxLjAsBgNVBAsTJUlQUyBDQSBDTEFTRTEgQ2VydGlmaWNhdGlv +biBBdXRob3JpdHkxLjAsBgNVBAMTJUlQUyBDQSBDTEFTRTEgQ2VydGlmaWNhdGlv +biBBdXRob3JpdHkxHjAcBgkqhkiG9w0BCQEWD2lwc0BtYWlsLmlwcy5lczCBnzAN +BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA4FEnpwvdr9G5Q1uCN0VWcu+atsIS7ywS +zHb5BlmvXSHU0lq4oNTzav3KaY1mSPd05u42veiWkXWmcSjK5yISMmmwPh5r9FBS +YmL9Yzt9fuzuOOpi9GyocY3h6YvJP8a1zZRCb92CRTzo3wno7wpVqVZHYUxJZHMQ +KD/Kvwn/xi8CAwEAAaOCBEowggRGMB0GA1UdDgQWBBTrsxl588GlHKzcuh9morKb +adB4CDCCAUQGA1UdIwSCATswggE3gBTrsxl588GlHKzcuh9morKbadB4CKGCARqk +ggEWMIIBEjELMAkGA1UEBhMCRVMxEjAQBgNVBAgTCUJhcmNlbG9uYTESMBAGA1UE +BxMJQmFyY2Vsb25hMS4wLAYDVQQKEyVJUFMgSW50ZXJuZXQgcHVibGlzaGluZyBT +ZXJ2aWNlcyBzLmwuMSswKQYDVQQKFCJpcHNAbWFpbC5pcHMuZXMgQy5JLkYuICBC +LTYwOTI5NDUyMS4wLAYDVQQLEyVJUFMgQ0EgQ0xBU0UxIENlcnRpZmljYXRpb24g +QXV0aG9yaXR5MS4wLAYDVQQDEyVJUFMgQ0EgQ0xBU0UxIENlcnRpZmljYXRpb24g +QXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOCAQAwDAYD +VR0TBAUwAwEB/zAMBgNVHQ8EBQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUFBwMBBggr +BgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYBBAGCNwIB +FQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYKKwYBBAGCNwoDBDARBglghkgBhvhC +AQEEBAMCAAcwGgYDVR0RBBMwEYEPaXBzQG1haWwuaXBzLmVzMBoGA1UdEgQTMBGB +D2lwc0BtYWlsLmlwcy5lczBBBglghkgBhvhCAQ0ENBYyQ0xBU0UxIENBIENlcnRp +ZmljYXRlIGlzc3VlZCBieSBodHRwOi8vd3d3Lmlwcy5lcy8wKQYJYIZIAYb4QgEC +BBwWGmh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvMDoGCWCGSAGG+EIBBAQtFito +dHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL2lwczIwMDJDTEFTRTEuY3JsMD8GCWCG +SAGG+EIBAwQyFjBodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL3Jldm9jYXRpb25D +TEFTRTEuaHRtbD8wPAYJYIZIAYb4QgEHBC8WLWh0dHA6Ly93d3cuaXBzLmVzL2lw +czIwMDIvcmVuZXdhbENMQVNFMS5odG1sPzA6BglghkgBhvhCAQgELRYraHR0cDov +L3d3dy5pcHMuZXMvaXBzMjAwMi9wb2xpY3lDTEFTRTEuaHRtbDBzBgNVHR8EbDBq +MDGgL6AthitodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL2lwczIwMDJDTEFTRTEu +Y3JsMDWgM6Axhi9odHRwOi8vd3d3YmFjay5pcHMuZXMvaXBzMjAwMi9pcHMyMDAy +Q0xBU0UxLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9v +Y3NwLmlwcy5lcy8wDQYJKoZIhvcNAQEFBQADgYEAK9Dr/drIyllq2tPMMi7JVBuK +Yn4VLenZMdMu9Ccj/1urxUq2ckCuU3T0vAW0xtnIyXf7t/k0f3gA+Nak5FI/LEpj +V4F1Wo7ojPsCwJTGKbqz3Bzosq/SLmJbGqmODszFV0VRFOlOHIilkfSj945RyKm+ +hjM+5i9Ibq9UkE6tsSU= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA CLASE3 Certification Authority, CN=IPS CA CLASE3 Certification Authority/emailAddress=ips@mail.ips.es + Validity + Not Before: Dec 29 01:01:44 2001 GMT + Not After : Dec 27 01:01:44 2025 GMT + Subject: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA CLASE3 Certification Authority, CN=IPS CA CLASE3 Certification Authority/emailAddress=ips@mail.ips.es + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:ab:17:fe:0e:b0:c6:68:1b:53:f0:52:be:9f:fa: + da:fa:8b:13:04:bb:01:8f:32:d9:1f:8f:4d:ce:36: + 98:da:e4:00:44:8c:28:d8:13:44:2a:a4:6b:4e:17: + 24:42:9c:d3:88:a4:41:82:d6:23:fb:8b:c9:86:e5: + b9:a9:82:05:dc:f1:de:1f:e0:0c:99:55:98:f2:38: + ec:6c:9d:20:03:c0:ef:aa:a3:c6:64:04:51:2d:78: + 0d:a3:d2:a8:3a:d6:24:4c:e9:96:7a:18:ac:13:23: + 22:1b:7c:e8:31:11:b3:5f:09:aa:30:70:71:46:25: + 6b:49:71:80:2b:95:01:b2:1f + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + B8:93:FF:2E:CB:DC:2C:8E:A2:E7:7A:FE:36:51:21:A3:98:5B:0C:34 + X509v3 Authority Key Identifier: + keyid:B8:93:FF:2E:CB:DC:2C:8E:A2:E7:7A:FE:36:51:21:A3:98:5B:0C:34 + DirName:/C=ES/ST=Barcelona/L=Barcelona/O=IPS Internet publishing Services s.l./O=ips@mail.ips.es C.I.F. B-60929452/OU=IPS CA CLASE3 Certification Authority/CN=IPS CA CLASE3 Certification Authority/emailAddress=ips@mail.ips.es + serial:00 + + X509v3 Basic Constraints: + CA:TRUE + X509v3 Key Usage: + Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign, Encipher Only, Decipher Only + X509v3 Extended Key Usage: + TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, Time Stamping, Microsoft Individual Code Signing, Microsoft Commercial Code Signing, Microsoft Trust List Signing, Microsoft Encrypted File System + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 Subject Alternative Name: + email:ips@mail.ips.es + X509v3 Issuer Alternative Name: + email:ips@mail.ips.es + Netscape Comment: + CLASE3 CA Certificate issued by http://www.ips.es/ + Netscape Base Url: + http://www.ips.es/ips2002/ + Netscape CA Revocation Url: + http://www.ips.es/ips2002/ips2002CLASE3.crl + Netscape Revocation Url: + http://www.ips.es/ips2002/revocationCLASE3.html? + Netscape Renewal Url: + http://www.ips.es/ips2002/renewalCLASE3.html? + Netscape CA Policy Url: + http://www.ips.es/ips2002/policyCLASE3.html + X509v3 CRL Distribution Points: + URI:http://www.ips.es/ips2002/ips2002CLASE3.crl + URI:http://wwwback.ips.es/ips2002/ips2002CLASE3.crl + + Authority Information Access: + OCSP - URI:http://ocsp.ips.es/ + + Signature Algorithm: sha1WithRSAEncryption + 17:65:5c:99:95:43:03:27:af:26:e5:eb:d0:b3:17:23:f7:43: + aa:c7:f0:7d:ec:0f:c6:a9:ae:ae:96:0f:76:29:1c:e2:06:2d: + 7e:26:c5:3c:fa:a1:c1:81:ce:53:b0:42:d1:97:57:1a:17:7e: + a4:51:61:c6:ee:e9:5e:ef:05:ba:eb:bd:0f:a7:92:6f:d8:a3: + 06:68:29:8e:79:f5:ff:bf:f9:a7:af:e4:b1:ce:c2:d1:80:42: + 27:05:04:34:f8:c3:7f:16:78:23:0c:07:24:f2:46:47:ad:3b: + 54:d0:af:d5:31:b2:af:7d:c8:ea:e9:d4:56:d9:0e:13:b2:c5: + 45:50 +MD5 Fingerprint=42:76:97:68:CF:A6:B4:38:24:AA:A1:1B:F2:67:DE:CA +-----BEGIN CERTIFICATE----- +MIIH6jCCB1OgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCARIxCzAJBgNVBAYTAkVT +MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE +ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE +ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjEuMCwGA1UECxMl +SVBTIENBIENMQVNFMyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEuMCwGA1UEAxMl +SVBTIENBIENMQVNFMyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEeMBwGCSqGSIb3 +DQEJARYPaXBzQG1haWwuaXBzLmVzMB4XDTAxMTIyOTAxMDE0NFoXDTI1MTIyNzAx +MDE0NFowggESMQswCQYDVQQGEwJFUzESMBAGA1UECBMJQmFyY2Vsb25hMRIwEAYD +VQQHEwlCYXJjZWxvbmExLjAsBgNVBAoTJUlQUyBJbnRlcm5ldCBwdWJsaXNoaW5n +IFNlcnZpY2VzIHMubC4xKzApBgNVBAoUImlwc0BtYWlsLmlwcy5lcyBDLkkuRi4g +IEItNjA5Mjk0NTIxLjAsBgNVBAsTJUlQUyBDQSBDTEFTRTMgQ2VydGlmaWNhdGlv +biBBdXRob3JpdHkxLjAsBgNVBAMTJUlQUyBDQSBDTEFTRTMgQ2VydGlmaWNhdGlv +biBBdXRob3JpdHkxHjAcBgkqhkiG9w0BCQEWD2lwc0BtYWlsLmlwcy5lczCBnzAN +BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAqxf+DrDGaBtT8FK+n/ra+osTBLsBjzLZ +H49NzjaY2uQARIwo2BNEKqRrThckQpzTiKRBgtYj+4vJhuW5qYIF3PHeH+AMmVWY +8jjsbJ0gA8DvqqPGZARRLXgNo9KoOtYkTOmWehisEyMiG3zoMRGzXwmqMHBxRiVr +SXGAK5UBsh8CAwEAAaOCBEowggRGMB0GA1UdDgQWBBS4k/8uy9wsjqLnev42USGj +mFsMNDCCAUQGA1UdIwSCATswggE3gBS4k/8uy9wsjqLnev42USGjmFsMNKGCARqk +ggEWMIIBEjELMAkGA1UEBhMCRVMxEjAQBgNVBAgTCUJhcmNlbG9uYTESMBAGA1UE +BxMJQmFyY2Vsb25hMS4wLAYDVQQKEyVJUFMgSW50ZXJuZXQgcHVibGlzaGluZyBT +ZXJ2aWNlcyBzLmwuMSswKQYDVQQKFCJpcHNAbWFpbC5pcHMuZXMgQy5JLkYuICBC +LTYwOTI5NDUyMS4wLAYDVQQLEyVJUFMgQ0EgQ0xBU0UzIENlcnRpZmljYXRpb24g +QXV0aG9yaXR5MS4wLAYDVQQDEyVJUFMgQ0EgQ0xBU0UzIENlcnRpZmljYXRpb24g +QXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOCAQAwDAYD +VR0TBAUwAwEB/zAMBgNVHQ8EBQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUFBwMBBggr +BgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYBBAGCNwIB +FQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYKKwYBBAGCNwoDBDARBglghkgBhvhC +AQEEBAMCAAcwGgYDVR0RBBMwEYEPaXBzQG1haWwuaXBzLmVzMBoGA1UdEgQTMBGB +D2lwc0BtYWlsLmlwcy5lczBBBglghkgBhvhCAQ0ENBYyQ0xBU0UzIENBIENlcnRp +ZmljYXRlIGlzc3VlZCBieSBodHRwOi8vd3d3Lmlwcy5lcy8wKQYJYIZIAYb4QgEC +BBwWGmh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvMDoGCWCGSAGG+EIBBAQtFito +dHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL2lwczIwMDJDTEFTRTMuY3JsMD8GCWCG +SAGG+EIBAwQyFjBodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL3Jldm9jYXRpb25D +TEFTRTMuaHRtbD8wPAYJYIZIAYb4QgEHBC8WLWh0dHA6Ly93d3cuaXBzLmVzL2lw +czIwMDIvcmVuZXdhbENMQVNFMy5odG1sPzA6BglghkgBhvhCAQgELRYraHR0cDov +L3d3dy5pcHMuZXMvaXBzMjAwMi9wb2xpY3lDTEFTRTMuaHRtbDBzBgNVHR8EbDBq +MDGgL6AthitodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL2lwczIwMDJDTEFTRTMu +Y3JsMDWgM6Axhi9odHRwOi8vd3d3YmFjay5pcHMuZXMvaXBzMjAwMi9pcHMyMDAy +Q0xBU0UzLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9v +Y3NwLmlwcy5lcy8wDQYJKoZIhvcNAQEFBQADgYEAF2VcmZVDAyevJuXr0LMXI/dD +qsfwfewPxqmurpYPdikc4gYtfibFPPqhwYHOU7BC0ZdXGhd+pFFhxu7pXu8Fuuu9 +D6eSb9ijBmgpjnn1/7/5p6/ksc7C0YBCJwUENPjDfxZ4IwwHJPJGR607VNCv1TGy +r33I6unUVtkOE7LFRVA= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA CLASEA1 Certification Authority, CN=IPS CA CLASEA1 Certification Authority/emailAddress=ips@mail.ips.es + Validity + Not Before: Dec 29 01:05:32 2001 GMT + Not After : Dec 27 01:05:32 2025 GMT + Subject: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA CLASEA1 Certification Authority, CN=IPS CA CLASEA1 Certification Authority/emailAddress=ips@mail.ips.es + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:bb:30:d7:dc:d0:54:bd:35:4e:9f:c5:4c:82:ea: + d1:50:3c:47:98:fc:9b:69:9d:77:cd:6e:e0:3f:ee: + eb:32:5f:5f:9f:d2:d0:79:e5:95:73:44:21:32:e0: + 0a:db:9d:d7:ce:8d:ab:52:8b:2b:78:e0:9b:5b:7d: + f4:fd:6d:09:e5:ae:e1:6c:1d:07:23:a0:17:d1:f9: + 7d:a8:46:46:91:22:a8:b2:69:c6:ad:f7:f5:f5:94: + a1:30:94:bd:00:cc:44:7f:ee:c4:9e:c9:c1:e6:8f: + 0a:36:c1:fd:24:3d:01:a0:f5:7b:e2:7c:78:66:43: + 8b:4f:59:f2:9b:d9:fa:49:b3 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + 67:26:96:E7:A1:BF:D8:B5:03:9D:FE:3B:DC:FE:F2:8A:E6:15:DD:30 + X509v3 Authority Key Identifier: + keyid:67:26:96:E7:A1:BF:D8:B5:03:9D:FE:3B:DC:FE:F2:8A:E6:15:DD:30 + DirName:/C=ES/ST=Barcelona/L=Barcelona/O=IPS Internet publishing Services s.l./O=ips@mail.ips.es C.I.F. B-60929452/OU=IPS CA CLASEA1 Certification Authority/CN=IPS CA CLASEA1 Certification Authority/emailAddress=ips@mail.ips.es + serial:00 + + X509v3 Basic Constraints: + CA:TRUE + X509v3 Key Usage: + Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign, Encipher Only, Decipher Only + X509v3 Extended Key Usage: + TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, Time Stamping, Microsoft Individual Code Signing, Microsoft Commercial Code Signing, Microsoft Trust List Signing, Microsoft Encrypted File System + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 Subject Alternative Name: + email:ips@mail.ips.es + X509v3 Issuer Alternative Name: + email:ips@mail.ips.es + Netscape Comment: + CLASEA1 CA Certificate issued by http://www.ips.es/ + Netscape Base Url: + http://www.ips.es/ips2002/ + Netscape CA Revocation Url: + http://www.ips.es/ips2002/ips2002CLASEA1.crl + Netscape Revocation Url: + http://www.ips.es/ips2002/revocationCLASEA1.html? + Netscape Renewal Url: + http://www.ips.es/ips2002/renewalCLASEA1.html? + Netscape CA Policy Url: + http://www.ips.es/ips2002/policyCLASEA1.html + X509v3 CRL Distribution Points: + URI:http://www.ips.es/ips2002/ips2002CLASEA1.crl + URI:http://wwwback.ips.es/ips2002/ips2002CLASEA1.crl + + Authority Information Access: + OCSP - URI:http://ocsp.ips.es/ + + Signature Algorithm: sha1WithRSAEncryption + 7e:ba:8a:ac:80:00:84:15:0a:d5:98:51:0c:64:c5:9c:02:58: + 83:66:ca:ad:1e:07:cd:7e:6a:da:80:07:df:03:34:4a:1c:93: + c4:4b:58:20:35:36:71:ed:a2:0a:35:12:a5:a6:65:a7:85:69: + 0a:0e:e3:61:ee:ea:be:28:93:33:d5:ec:e8:be:c4:db:5f:7f: + a8:f9:63:31:c8:6b:96:e2:29:c2:5b:a0:e7:97:36:9d:77:5e: + 31:6b:fe:d3:a7:db:2a:db:db:96:8b:1f:66:de:b6:03:c0:2b: + b3:78:d6:55:07:e5:8f:39:50:de:07:23:72:e6:bd:20:14:4b: + b4:86 +MD5 Fingerprint=0C:F8:9E:17:FC:D4:03:BD:E6:8D:9B:3C:05:87:FE:84 +-----BEGIN CERTIFICATE----- +MIIH9zCCB2CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCARQxCzAJBgNVBAYTAkVT +MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE +ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE +ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjEvMC0GA1UECxMm +SVBTIENBIENMQVNFQTEgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxLzAtBgNVBAMT +JklQUyBDQSBDTEFTRUExIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MR4wHAYJKoZI +hvcNAQkBFg9pcHNAbWFpbC5pcHMuZXMwHhcNMDExMjI5MDEwNTMyWhcNMjUxMjI3 +MDEwNTMyWjCCARQxCzAJBgNVBAYTAkVTMRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQ +BgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UEChMlSVBTIEludGVybmV0IHB1Ymxpc2hp +bmcgU2VydmljZXMgcy5sLjErMCkGA1UEChQiaXBzQG1haWwuaXBzLmVzIEMuSS5G +LiAgQi02MDkyOTQ1MjEvMC0GA1UECxMmSVBTIENBIENMQVNFQTEgQ2VydGlmaWNh +dGlvbiBBdXRob3JpdHkxLzAtBgNVBAMTJklQUyBDQSBDTEFTRUExIENlcnRpZmlj +YXRpb24gQXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXMw +gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALsw19zQVL01Tp/FTILq0VA8R5j8 +m2mdd81u4D/u6zJfX5/S0HnllXNEITLgCtud186Nq1KLK3jgm1t99P1tCeWu4Wwd +ByOgF9H5fahGRpEiqLJpxq339fWUoTCUvQDMRH/uxJ7JweaPCjbB/SQ9AaD1e+J8 +eGZDi09Z8pvZ+kmzAgMBAAGjggRTMIIETzAdBgNVHQ4EFgQUZyaW56G/2LUDnf47 +3P7yiuYV3TAwggFGBgNVHSMEggE9MIIBOYAUZyaW56G/2LUDnf473P7yiuYV3TCh +ggEcpIIBGDCCARQxCzAJBgNVBAYTAkVTMRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQ +BgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UEChMlSVBTIEludGVybmV0IHB1Ymxpc2hp +bmcgU2VydmljZXMgcy5sLjErMCkGA1UEChQiaXBzQG1haWwuaXBzLmVzIEMuSS5G +LiAgQi02MDkyOTQ1MjEvMC0GA1UECxMmSVBTIENBIENMQVNFQTEgQ2VydGlmaWNh +dGlvbiBBdXRob3JpdHkxLzAtBgNVBAMTJklQUyBDQSBDTEFTRUExIENlcnRpZmlj +YXRpb24gQXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOC +AQAwDAYDVR0TBAUwAwEB/zAMBgNVHQ8EBQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUF +BwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYB +BAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYKKwYBBAGCNwoDBDARBglg +hkgBhvhCAQEEBAMCAAcwGgYDVR0RBBMwEYEPaXBzQG1haWwuaXBzLmVzMBoGA1Ud +EgQTMBGBD2lwc0BtYWlsLmlwcy5lczBCBglghkgBhvhCAQ0ENRYzQ0xBU0VBMSBD +QSBDZXJ0aWZpY2F0ZSBpc3N1ZWQgYnkgaHR0cDovL3d3dy5pcHMuZXMvMCkGCWCG +SAGG+EIBAgQcFhpodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyLzA7BglghkgBhvhC +AQQELhYsaHR0cDovL3d3dy5pcHMuZXMvaXBzMjAwMi9pcHMyMDAyQ0xBU0VBMS5j +cmwwQAYJYIZIAYb4QgEDBDMWMWh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvcmV2 +b2NhdGlvbkNMQVNFQTEuaHRtbD8wPQYJYIZIAYb4QgEHBDAWLmh0dHA6Ly93d3cu +aXBzLmVzL2lwczIwMDIvcmVuZXdhbENMQVNFQTEuaHRtbD8wOwYJYIZIAYb4QgEI +BC4WLGh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvcG9saWN5Q0xBU0VBMS5odG1s +MHUGA1UdHwRuMGwwMqAwoC6GLGh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvaXBz +MjAwMkNMQVNFQTEuY3JsMDagNKAyhjBodHRwOi8vd3d3YmFjay5pcHMuZXMvaXBz +MjAwMi9pcHMyMDAyQ0xBU0VBMS5jcmwwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUF +BzABhhNodHRwOi8vb2NzcC5pcHMuZXMvMA0GCSqGSIb3DQEBBQUAA4GBAH66iqyA +AIQVCtWYUQxkxZwCWINmyq0eB81+atqAB98DNEock8RLWCA1NnHtogo1EqWmZaeF +aQoO42Hu6r4okzPV7Oi+xNtff6j5YzHIa5biKcJboOeXNp13XjFr/tOn2yrb25aL +H2betgPAK7N41lUH5Y85UN4HI3LmvSAUS7SG +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA CLASEA3 Certification Authority, CN=IPS CA CLASEA3 Certification Authority/emailAddress=ips@mail.ips.es + Validity + Not Before: Dec 29 01:07:50 2001 GMT + Not After : Dec 27 01:07:50 2025 GMT + Subject: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA CLASEA3 Certification Authority, CN=IPS CA CLASEA3 Certification Authority/emailAddress=ips@mail.ips.es + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:ee:80:00:f6:1a:64:2e:ad:6a:c8:83:b1:8b:a7: + ee:8f:d9:b6:db:cd:1b:bb:86:06:22:76:33:0c:12: + 6d:48:56:61:d2:dc:82:25:62:2f:9f:d2:69:30:65: + 03:42:23:58:bc:47:dc:6b:d6:75:5d:17:3c:e1:ff: + f2:58:67:79:a0:c1:81:b1:d4:56:a2:f2:8d:11:99: + fd:f6:7d:f1:c7:c4:5e:02:2a:9a:e2:4a:b5:13:8a: + 00:fd:8c:77:86:e6:d7:94:f5:20:75:2e:0e:4c:bf: + 74:c4:3f:81:3e:83:b4:a3:38:36:29:e7:e8:2a:f5: + 8c:88:41:aa:80:a6:e3:6c:ef + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + 1E:9F:57:50:47:B6:61:93:39:D3:2C:FC:DA:5D:3D:05:75:B7:99:02 + X509v3 Authority Key Identifier: + keyid:1E:9F:57:50:47:B6:61:93:39:D3:2C:FC:DA:5D:3D:05:75:B7:99:02 + DirName:/C=ES/ST=Barcelona/L=Barcelona/O=IPS Internet publishing Services s.l./O=ips@mail.ips.es C.I.F. B-60929452/OU=IPS CA CLASEA3 Certification Authority/CN=IPS CA CLASEA3 Certification Authority/emailAddress=ips@mail.ips.es + serial:00 + + X509v3 Basic Constraints: + CA:TRUE + X509v3 Key Usage: + Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign, Encipher Only, Decipher Only + X509v3 Extended Key Usage: + TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, Time Stamping, Microsoft Individual Code Signing, Microsoft Commercial Code Signing, Microsoft Trust List Signing, Microsoft Encrypted File System + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 Subject Alternative Name: + email:ips@mail.ips.es + X509v3 Issuer Alternative Name: + email:ips@mail.ips.es + Netscape Comment: + CLASEA3 CA Certificate issued by http://www.ips.es/ + Netscape Base Url: + http://www.ips.es/ips2002/ + Netscape CA Revocation Url: + http://www.ips.es/ips2002/ips2002CLASEA3.crl + Netscape Revocation Url: + http://www.ips.es/ips2002/revocationCLASEA3.html? + Netscape Renewal Url: + http://www.ips.es/ips2002/renewalCLASEA3.html? + Netscape CA Policy Url: + http://www.ips.es/ips2002/policyCLASEA3.html + X509v3 CRL Distribution Points: + URI:http://www.ips.es/ips2002/ips2002CLASEA3.crl + URI:http://wwwback.ips.es/ips2002/ips2002CLASEA3.crl + + Authority Information Access: + OCSP - URI:http://ocsp.ips.es/ + + Signature Algorithm: sha1WithRSAEncryption + 4a:3d:20:47:1a:da:89:f4:7a:2b:31:79:ec:01:c0:cc:01:f5: + d6:c1:fc:c8:c3:f3:50:02:51:90:58:2a:9f:e7:35:09:5b:30: + 0a:81:00:25:47:af:d4:0f:0e:9e:60:26:a8:95:a7:83:08:df: + 2d:ac:e9:0e:f7:9c:c8:9f:cb:93:45:f1:ba:6a:c6:67:51:4a: + 69:4f:6b:fe:7d:0b:2f:52:29:c2:50:ad:24:44:ed:23:b3:48: + cb:44:40:c1:03:95:0c:0a:78:06:12:01:f5:91:31:2d:49:8d: + bb:3f:45:4e:2c:e0:e8:cd:b5:c9:14:15:0c:e3:07:83:9b:26: + 75:ef +MD5 Fingerprint=06:F9:EB:EC:CC:56:9D:88:BA:90:F5:BA:B0:1A:E0:02 +-----BEGIN CERTIFICATE----- +MIIH9zCCB2CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCARQxCzAJBgNVBAYTAkVT +MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE +ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE +ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjEvMC0GA1UECxMm +SVBTIENBIENMQVNFQTMgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxLzAtBgNVBAMT +JklQUyBDQSBDTEFTRUEzIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MR4wHAYJKoZI +hvcNAQkBFg9pcHNAbWFpbC5pcHMuZXMwHhcNMDExMjI5MDEwNzUwWhcNMjUxMjI3 +MDEwNzUwWjCCARQxCzAJBgNVBAYTAkVTMRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQ +BgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UEChMlSVBTIEludGVybmV0IHB1Ymxpc2hp +bmcgU2VydmljZXMgcy5sLjErMCkGA1UEChQiaXBzQG1haWwuaXBzLmVzIEMuSS5G +LiAgQi02MDkyOTQ1MjEvMC0GA1UECxMmSVBTIENBIENMQVNFQTMgQ2VydGlmaWNh +dGlvbiBBdXRob3JpdHkxLzAtBgNVBAMTJklQUyBDQSBDTEFTRUEzIENlcnRpZmlj +YXRpb24gQXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXMw +gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAO6AAPYaZC6tasiDsYun7o/ZttvN +G7uGBiJ2MwwSbUhWYdLcgiViL5/SaTBlA0IjWLxH3GvWdV0XPOH/8lhneaDBgbHU +VqLyjRGZ/fZ98cfEXgIqmuJKtROKAP2Md4bm15T1IHUuDky/dMQ/gT6DtKM4Ninn +6Cr1jIhBqoCm42zvAgMBAAGjggRTMIIETzAdBgNVHQ4EFgQUHp9XUEe2YZM50yz8 +2l09BXW3mQIwggFGBgNVHSMEggE9MIIBOYAUHp9XUEe2YZM50yz82l09BXW3mQKh +ggEcpIIBGDCCARQxCzAJBgNVBAYTAkVTMRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQ +BgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UEChMlSVBTIEludGVybmV0IHB1Ymxpc2hp +bmcgU2VydmljZXMgcy5sLjErMCkGA1UEChQiaXBzQG1haWwuaXBzLmVzIEMuSS5G +LiAgQi02MDkyOTQ1MjEvMC0GA1UECxMmSVBTIENBIENMQVNFQTMgQ2VydGlmaWNh +dGlvbiBBdXRob3JpdHkxLzAtBgNVBAMTJklQUyBDQSBDTEFTRUEzIENlcnRpZmlj +YXRpb24gQXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOC +AQAwDAYDVR0TBAUwAwEB/zAMBgNVHQ8EBQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUF +BwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYB +BAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYKKwYBBAGCNwoDBDARBglg +hkgBhvhCAQEEBAMCAAcwGgYDVR0RBBMwEYEPaXBzQG1haWwuaXBzLmVzMBoGA1Ud +EgQTMBGBD2lwc0BtYWlsLmlwcy5lczBCBglghkgBhvhCAQ0ENRYzQ0xBU0VBMyBD +QSBDZXJ0aWZpY2F0ZSBpc3N1ZWQgYnkgaHR0cDovL3d3dy5pcHMuZXMvMCkGCWCG +SAGG+EIBAgQcFhpodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyLzA7BglghkgBhvhC +AQQELhYsaHR0cDovL3d3dy5pcHMuZXMvaXBzMjAwMi9pcHMyMDAyQ0xBU0VBMy5j +cmwwQAYJYIZIAYb4QgEDBDMWMWh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvcmV2 +b2NhdGlvbkNMQVNFQTMuaHRtbD8wPQYJYIZIAYb4QgEHBDAWLmh0dHA6Ly93d3cu +aXBzLmVzL2lwczIwMDIvcmVuZXdhbENMQVNFQTMuaHRtbD8wOwYJYIZIAYb4QgEI +BC4WLGh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvcG9saWN5Q0xBU0VBMy5odG1s +MHUGA1UdHwRuMGwwMqAwoC6GLGh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvaXBz +MjAwMkNMQVNFQTMuY3JsMDagNKAyhjBodHRwOi8vd3d3YmFjay5pcHMuZXMvaXBz +MjAwMi9pcHMyMDAyQ0xBU0VBMy5jcmwwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUF +BzABhhNodHRwOi8vb2NzcC5pcHMuZXMvMA0GCSqGSIb3DQEBBQUAA4GBAEo9IEca +2on0eisxeewBwMwB9dbB/MjD81ACUZBYKp/nNQlbMAqBACVHr9QPDp5gJqiVp4MI +3y2s6Q73nMify5NF8bpqxmdRSmlPa/59Cy9SKcJQrSRE7SOzSMtEQMEDlQwKeAYS +AfWRMS1Jjbs/RU4s4OjNtckUFQzjB4ObJnXv +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 1 (0x0) + Serial Number: 0 (0x0) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=ES, ST=BARCELONA, L=BARCELONA, O=IPS Seguridad CA, OU=Certificaciones, CN=IPS SERVIDORES/emailAddress=ips@mail.ips.es + Validity + Not Before: Jan 1 23:21:07 1998 GMT + Not After : Dec 29 23:21:07 2009 GMT + Subject: C=ES, ST=BARCELONA, L=BARCELONA, O=IPS Seguridad CA, OU=Certificaciones, CN=IPS SERVIDORES/emailAddress=ips@mail.ips.es + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:ac:4f:52:74:9f:39:ea:8e:dc:25:c4:bc:98:5d: + 98:64:24:09:3c:21:b3:cc:19:b5:8e:94:8e:87:d1: + f8:37:3e:a1:c8:2d:58:a4:80:35:5b:a1:75:6c:1d: + 45:0c:1f:61:63:6a:5e:6f:9b:0a:4c:c1:c8:b8:61: + 23:35:81:ff:fe:ac:78:70:2d:68:e1:3a:07:98:95: + 02:54:dd:cd:23:b7:80:53:d7:c8:37:45:72:06:24: + 12:ba:13:61:21:8a:6e:75:28:e0:c5:0f:34:fd:36: + d8:45:7f:e1:b8:36:ef:b3:e1:c6:20:8e:e8:b4:38: + bc:e1:3e:f6:11:de:8c:9d:01 + Exponent: 65537 (0x10001) + Signature Algorithm: md5WithRSAEncryption + 2c:f3:c3:79:58:24:de:c6:3b:d1:e0:42:69:b8:ee:64:b3:3d: + 62:01:b9:b3:84:df:23:7d:dd:98:cf:10:a9:fe:00:d8:22:96: + 05:13:07:54:57:c5:a7:de:cb:d9:b8:88:42:f6:99:db:14:77: + 1f:b6:fe:25:3d:e1:a2:3e:03:a9:81:d2:2d:6c:47:f5:96:46: + 8c:22:ab:c8:cc:0d:0e:97:5e:8b:41:b4:3b:c4:0a:06:40:1d: + dd:46:f4:01:dd:ba:82:2e:3c:3d:78:70:9e:7c:18:d0:ab:f8: + b8:77:07:46:71:f1:ca:0b:63:5c:6a:f9:72:94:d5:01:4f:a0: + db:42 +MD5 Fingerprint=7B:B5:08:99:9A:8C:18:BF:85:27:7D:0E:AE:DA:B2:AB +-----BEGIN CERTIFICATE----- +MIICtzCCAiACAQAwDQYJKoZIhvcNAQEEBQAwgaMxCzAJBgNVBAYTAkVTMRIwEAYD +VQQIEwlCQVJDRUxPTkExEjAQBgNVBAcTCUJBUkNFTE9OQTEZMBcGA1UEChMQSVBT +IFNlZ3VyaWRhZCBDQTEYMBYGA1UECxMPQ2VydGlmaWNhY2lvbmVzMRcwFQYDVQQD +Ew5JUFMgU0VSVklET1JFUzEeMBwGCSqGSIb3DQEJARYPaXBzQG1haWwuaXBzLmVz +MB4XDTk4MDEwMTIzMjEwN1oXDTA5MTIyOTIzMjEwN1owgaMxCzAJBgNVBAYTAkVT +MRIwEAYDVQQIEwlCQVJDRUxPTkExEjAQBgNVBAcTCUJBUkNFTE9OQTEZMBcGA1UE +ChMQSVBTIFNlZ3VyaWRhZCBDQTEYMBYGA1UECxMPQ2VydGlmaWNhY2lvbmVzMRcw +FQYDVQQDEw5JUFMgU0VSVklET1JFUzEeMBwGCSqGSIb3DQEJARYPaXBzQG1haWwu +aXBzLmVzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCsT1J0nznqjtwlxLyY +XZhkJAk8IbPMGbWOlI6H0fg3PqHILVikgDVboXVsHUUMH2Fjal5vmwpMwci4YSM1 +gf/+rHhwLWjhOgeYlQJU3c0jt4BT18g3RXIGJBK6E2Ehim51KODFDzT9NthFf+G4 +Nu+z4cYgjui0OLzhPvYR3oydAQIDAQABMA0GCSqGSIb3DQEBBAUAA4GBACzzw3lY +JN7GO9HgQmm47mSzPWIBubOE3yN93ZjPEKn+ANgilgUTB1RXxafey9m4iEL2mdsU +dx+2/iU94aI+A6mB0i1sR/WWRowiq8jMDQ6XXotBtDvECgZAHd1G9AHduoIuPD14 +cJ58GNCr+Lh3B0Zx8coLY1xq+XKU1QFPoNtC +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA Timestamping Certification Authority, CN=IPS CA Timestamping Certification Authority/emailAddress=ips@mail.ips.es + Validity + Not Before: Dec 29 01:10:18 2001 GMT + Not After : Dec 27 01:10:18 2025 GMT + Subject: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA Timestamping Certification Authority, CN=IPS CA Timestamping Certification Authority/emailAddress=ips@mail.ips.es + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:bc:b8:ee:56:a5:9a:8c:e6:36:c9:c2:62:a0:66: + 81:8d:1a:d5:7a:d2:73:9f:0e:84:64:ba:95:b4:90: + a7:78:af:ca:fe:54:61:5b:ce:b2:20:57:01:ae:44: + 92:43:10:38:11:f7:68:fc:17:40:a5:68:27:32:3b: + c4:a7:e6:42:71:c5:99:ef:76:ff:2b:95:24:f5:49: + 92:18:68:ca:00:b5:a4:5a:2f:6e:cb:d6:1b:2c:0d: + 54:67:6b:7a:29:a1:58:ab:a2:5a:00:d6:5b:bb:18: + c2:df:f6:1e:13:56:76:9b:a5:68:e2:98:ce:c6:03: + 8a:34:db:4c:83:41:a6:a9:a3 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + 8B:D0:10:50:09:81:F2:9D:09:D5:0E:60:78:03:22:A2:3F:C8:CA:66 + X509v3 Authority Key Identifier: + keyid:8B:D0:10:50:09:81:F2:9D:09:D5:0E:60:78:03:22:A2:3F:C8:CA:66 + DirName:/C=ES/ST=Barcelona/L=Barcelona/O=IPS Internet publishing Services s.l./O=ips@mail.ips.es C.I.F. B-60929452/OU=IPS CA Timestamping Certification Authority/CN=IPS CA Timestamping Certification Authority/emailAddress=ips@mail.ips.es + serial:00 + + X509v3 Basic Constraints: + CA:TRUE + X509v3 Key Usage: + Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign, Encipher Only, Decipher Only + X509v3 Extended Key Usage: + TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, Time Stamping, Microsoft Individual Code Signing, Microsoft Commercial Code Signing, Microsoft Trust List Signing, Microsoft Encrypted File System + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 Subject Alternative Name: + email:ips@mail.ips.es + X509v3 Issuer Alternative Name: + email:ips@mail.ips.es + Netscape Comment: + Timestamping CA Certificate issued by http://www.ips.es/ + Netscape Base Url: + http://www.ips.es/ips2002/ + Netscape CA Revocation Url: + http://www.ips.es/ips2002/ips2002Timestamping.crl + Netscape Revocation Url: + http://www.ips.es/ips2002/revocationTimestamping.html? + Netscape Renewal Url: + http://www.ips.es/ips2002/renewalTimestamping.html? + Netscape CA Policy Url: + http://www.ips.es/ips2002/policyTimestamping.html + X509v3 CRL Distribution Points: + URI:http://www.ips.es/ips2002/ips2002Timestamping.crl + URI:http://wwwback.ips.es/ips2002/ips2002Timestamping.crl + + Authority Information Access: + OCSP - URI:http://ocsp.ips.es/ + + Signature Algorithm: sha1WithRSAEncryption + 65:ba:c1:cc:00:1a:95:91:ca:e9:6c:3a:bf:3a:1e:14:08:7c: + fb:83:ee:6b:62:51:d3:33:91:b5:60:79:7e:04:d8:5d:79:37: + e8:c3:5b:b0:c4:67:2d:68:5a:b2:5f:0e:0a:fa:cd:3f:3a:45: + a1:ea:36:cf:26:1e:a7:11:28:c5:94:8f:84:4c:53:08:c5:93: + b3:fc:e2:7f:f5:8d:f3:b1:a9:85:5f:88:de:91:96:ee:17:5b: + ae:a5:ea:70:65:78:2c:21:64:01:95:ce:ce:4c:3e:50:f4:b6: + 59:cb:63:8d:b6:bd:18:d4:87:4a:5f:dc:ef:e9:56:f0:0a:0c: + e8:75 +MD5 Fingerprint=2E:03:FD:C5:F5:D7:2B:94:64:C1:BE:89:31:F1:16:9B +-----BEGIN CERTIFICATE----- +MIIIODCCB6GgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCAR4xCzAJBgNVBAYTAkVT +MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE +ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE +ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjE0MDIGA1UECxMr +SVBTIENBIFRpbWVzdGFtcGluZyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTE0MDIG +A1UEAxMrSVBTIENBIFRpbWVzdGFtcGluZyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0 +eTEeMBwGCSqGSIb3DQEJARYPaXBzQG1haWwuaXBzLmVzMB4XDTAxMTIyOTAxMTAx +OFoXDTI1MTIyNzAxMTAxOFowggEeMQswCQYDVQQGEwJFUzESMBAGA1UECBMJQmFy +Y2Vsb25hMRIwEAYDVQQHEwlCYXJjZWxvbmExLjAsBgNVBAoTJUlQUyBJbnRlcm5l +dCBwdWJsaXNoaW5nIFNlcnZpY2VzIHMubC4xKzApBgNVBAoUImlwc0BtYWlsLmlw +cy5lcyBDLkkuRi4gIEItNjA5Mjk0NTIxNDAyBgNVBAsTK0lQUyBDQSBUaW1lc3Rh +bXBpbmcgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxNDAyBgNVBAMTK0lQUyBDQSBU +aW1lc3RhbXBpbmcgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxHjAcBgkqhkiG9w0B +CQEWD2lwc0BtYWlsLmlwcy5lczCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA +vLjuVqWajOY2ycJioGaBjRrVetJznw6EZLqVtJCneK/K/lRhW86yIFcBrkSSQxA4 +Efdo/BdApWgnMjvEp+ZCccWZ73b/K5Uk9UmSGGjKALWkWi9uy9YbLA1UZ2t6KaFY +q6JaANZbuxjC3/YeE1Z2m6Vo4pjOxgOKNNtMg0GmqaMCAwEAAaOCBIAwggR8MB0G +A1UdDgQWBBSL0BBQCYHynQnVDmB4AyKiP8jKZjCCAVAGA1UdIwSCAUcwggFDgBSL +0BBQCYHynQnVDmB4AyKiP8jKZqGCASakggEiMIIBHjELMAkGA1UEBhMCRVMxEjAQ +BgNVBAgTCUJhcmNlbG9uYTESMBAGA1UEBxMJQmFyY2Vsb25hMS4wLAYDVQQKEyVJ +UFMgSW50ZXJuZXQgcHVibGlzaGluZyBTZXJ2aWNlcyBzLmwuMSswKQYDVQQKFCJp +cHNAbWFpbC5pcHMuZXMgQy5JLkYuICBCLTYwOTI5NDUyMTQwMgYDVQQLEytJUFMg +Q0EgVGltZXN0YW1waW5nIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MTQwMgYDVQQD +EytJUFMgQ0EgVGltZXN0YW1waW5nIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MR4w +HAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOCAQAwDAYDVR0TBAUwAwEB/zAM +BgNVHQ8EBQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYB +BQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIB +FgYKKwYBBAGCNwoDAQYKKwYBBAGCNwoDBDARBglghkgBhvhCAQEEBAMCAAcwGgYD +VR0RBBMwEYEPaXBzQG1haWwuaXBzLmVzMBoGA1UdEgQTMBGBD2lwc0BtYWlsLmlw +cy5lczBHBglghkgBhvhCAQ0EOhY4VGltZXN0YW1waW5nIENBIENlcnRpZmljYXRl +IGlzc3VlZCBieSBodHRwOi8vd3d3Lmlwcy5lcy8wKQYJYIZIAYb4QgECBBwWGmh0 +dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvMEAGCWCGSAGG+EIBBAQzFjFodHRwOi8v +d3d3Lmlwcy5lcy9pcHMyMDAyL2lwczIwMDJUaW1lc3RhbXBpbmcuY3JsMEUGCWCG +SAGG+EIBAwQ4FjZodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL3Jldm9jYXRpb25U +aW1lc3RhbXBpbmcuaHRtbD8wQgYJYIZIAYb4QgEHBDUWM2h0dHA6Ly93d3cuaXBz +LmVzL2lwczIwMDIvcmVuZXdhbFRpbWVzdGFtcGluZy5odG1sPzBABglghkgBhvhC +AQgEMxYxaHR0cDovL3d3dy5pcHMuZXMvaXBzMjAwMi9wb2xpY3lUaW1lc3RhbXBp +bmcuaHRtbDB/BgNVHR8EeDB2MDegNaAzhjFodHRwOi8vd3d3Lmlwcy5lcy9pcHMy +MDAyL2lwczIwMDJUaW1lc3RhbXBpbmcuY3JsMDugOaA3hjVodHRwOi8vd3d3YmFj +ay5pcHMuZXMvaXBzMjAwMi9pcHMyMDAyVGltZXN0YW1waW5nLmNybDAvBggrBgEF +BQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9vY3NwLmlwcy5lcy8wDQYJKoZI +hvcNAQEFBQADgYEAZbrBzAAalZHK6Ww6vzoeFAh8+4Pua2JR0zORtWB5fgTYXXk3 +6MNbsMRnLWhasl8OCvrNPzpFoeo2zyYepxEoxZSPhExTCMWTs/zif/WN87GphV+I +3pGW7hdbrqXqcGV4LCFkAZXOzkw+UPS2Wctjjba9GNSHSl/c7+lW8AoM6HU= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 985026699 (0x3ab6508b) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority + Validity + Not Before: Mar 19 18:33:33 2001 GMT + Not After : Mar 17 18:33:33 2021 GMT + Subject: C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:bf:61:b5:95:53:ba:57:fc:fa:f2:67:0b:3a:1a: + df:11:80:64:95:b4:d1:bc:cd:7a:cf:f6:29:96:2e: + 24:54:40:24:38:f7:1a:85:dc:58:4c:cb:a4:27:42: + 97:d0:9f:83:8a:c3:e4:06:03:5b:00:a5:51:1e:70: + 04:74:e2:c1:d4:3a:ab:d7:ad:3b:07:18:05:8e:fd: + 83:ac:ea:66:d9:18:1b:68:8a:f5:57:1a:98:ba:f5: + ed:76:3d:7c:d9:de:94:6a:3b:4b:17:c1:d5:8f:bd: + 65:38:3a:95:d0:3d:55:36:4e:df:79:57:31:2a:1e: + d8:59:65:49:58:20:98:7e:ab:5f:7e:9f:e9:d6:4d: + ec:83:74:a9:c7:6c:d8:ee:29:4a:85:2a:06:14:f9: + 54:e6:d3:da:65:07:8b:63:37:12:d7:d0:ec:c3:7b: + 20:41:44:a3:ed:cb:a0:17:e1:71:65:ce:1d:66:31: + f7:76:01:19:c8:7d:03:58:b6:95:49:1d:a6:12:26: + e8:c6:0c:76:e0:e3:66:cb:ea:5d:a6:26:ee:e5:cc: + 5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d: + 71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36: + cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6: + 90:bb + Exponent: 65537 (0x10001) + X509v3 extensions: + Authority Information Access: + OCSP - URI:https://ocsp.quovadisoffshore.com + + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Certificate Policies: + Policy: 1.3.6.1.4.1.8024.0.1 + User Notice: + Explicit Text: Reliance on the QuoVadis Root Certificate by any party assumes acceptance of the then applicable standard terms and conditions of use, certification practices, and the QuoVadis Certificate Policy. + CPS: http://www.quovadis.bm + + X509v3 Subject Key Identifier: + 8B:4B:6D:ED:D3:29:B9:06:19:EC:39:39:A9:F0:97:84:6A:CB:EF:DF + X509v3 Authority Key Identifier: + keyid:8B:4B:6D:ED:D3:29:B9:06:19:EC:39:39:A9:F0:97:84:6A:CB:EF:DF + DirName:/C=BM/O=QuoVadis Limited/OU=Root Certification Authority/CN=QuoVadis Root Certification Authority + serial:3A:B6:50:8B + + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + Signature Algorithm: sha1WithRSAEncryption + 8a:d4:14:b5:fe:f4:9a:92:a7:19:d4:a4:7e:72:18:8f:d9:68: + 7c:52:24:dd:67:6f:39:7a:c4:aa:5e:3d:e2:58:b0:4d:70:98: + 84:61:e8:1b:e3:69:18:0e:ce:fb:47:50:a0:4e:ff:f0:24:1f: + bd:b2:ce:f5:27:fc:ec:2f:53:aa:73:7b:03:3d:74:6e:e6:16: + 9e:eb:a5:2e:c4:bf:56:27:50:2b:62:ba:be:4b:1c:3c:55:5c: + 41:1d:24:be:82:20:47:5d:d5:44:7e:7a:16:68:df:7d:4d:51: + 70:78:57:1d:33:1e:fd:02:99:9c:0c:cd:0a:05:4f:c7:bb:8e: + a4:75:fa:4a:6d:b1:80:8e:09:56:b9:9c:1a:60:fe:5d:c1:d7: + 7a:dc:11:78:d0:d6:5d:c1:b7:d5:ad:32:99:03:3a:8a:cc:54: + 25:39:31:81:7b:13:22:51:ba:46:6c:a1:bb:9e:fa:04:6c:49: + 26:74:8f:d2:73:eb:cc:30:a2:e6:ea:59:22:87:f8:97:f5:0e: + fd:ea:cc:92:a4:16:c4:52:18:ea:21:ce:b1:f1:e6:84:81:e5: + ba:a9:86:28:f2:43:5a:5d:12:9d:ac:1e:d9:a8:e5:0a:6a:a7: + 7f:a0:87:29:cf:f2:89:4d:d4:ec:c5:e2:e6:7a:d0:36:23:8a: + 4a:74:36:f9 +MD5 Fingerprint=27:DE:36:FE:72:B7:00:03:00:9D:F4:F0:1E:6C:04:24 +-----BEGIN CERTIFICATE----- +MIIF0DCCBLigAwIBAgIEOrZQizANBgkqhkiG9w0BAQUFADB/MQswCQYDVQQGEwJC +TTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDElMCMGA1UECxMcUm9vdCBDZXJ0 +aWZpY2F0aW9uIEF1dGhvcml0eTEuMCwGA1UEAxMlUXVvVmFkaXMgUm9vdCBDZXJ0 +aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wMTAzMTkxODMzMzNaFw0yMTAzMTcxODMz +MzNaMH8xCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMSUw +IwYDVQQLExxSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MS4wLAYDVQQDEyVR +dW9WYWRpcyBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIIBIjANBgkqhkiG +9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2G1lVO6V/z68mcLOhrfEYBklbTRvM16z/Yp +li4kVEAkOPcahdxYTMukJ0KX0J+DisPkBgNbAKVRHnAEdOLB1Dqr1607BxgFjv2D +rOpm2RgbaIr1VxqYuvXtdj182d6UajtLF8HVj71lODqV0D1VNk7feVcxKh7YWWVJ +WCCYfqtffp/p1k3sg3Spx2zY7ilKhSoGFPlU5tPaZQeLYzcS19Dsw3sgQUSj7cug +F+FxZc4dZjH3dgEZyH0DWLaVSR2mEiboxgx24ONmy+pdpibu5cxfvWenAScOospU +xbF6lR1xHkopigPcakXBpBlebzbNw6Kwt/5cOOJSvPhEQ+aQuwIDAQABo4ICUjCC +Ak4wPQYIKwYBBQUHAQEEMTAvMC0GCCsGAQUFBzABhiFodHRwczovL29jc3AucXVv +dmFkaXNvZmZzaG9yZS5jb20wDwYDVR0TAQH/BAUwAwEB/zCCARoGA1UdIASCAREw +ggENMIIBCQYJKwYBBAG+WAABMIH7MIHUBggrBgEFBQcCAjCBxxqBxFJlbGlhbmNl +IG9uIHRoZSBRdW9WYWRpcyBSb290IENlcnRpZmljYXRlIGJ5IGFueSBwYXJ0eSBh +c3N1bWVzIGFjY2VwdGFuY2Ugb2YgdGhlIHRoZW4gYXBwbGljYWJsZSBzdGFuZGFy +ZCB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB1c2UsIGNlcnRpZmljYXRpb24gcHJh +Y3RpY2VzLCBhbmQgdGhlIFF1b1ZhZGlzIENlcnRpZmljYXRlIFBvbGljeS4wIgYI +KwYBBQUHAgEWFmh0dHA6Ly93d3cucXVvdmFkaXMuYm0wHQYDVR0OBBYEFItLbe3T +KbkGGew5Oanwl4Rqy+/fMIGuBgNVHSMEgaYwgaOAFItLbe3TKbkGGew5Oanwl4Rq +y+/foYGEpIGBMH8xCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1p +dGVkMSUwIwYDVQQLExxSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MS4wLAYD +VQQDEyVRdW9WYWRpcyBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5ggQ6tlCL +MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOCAQEAitQUtf70mpKnGdSk +fnIYj9lofFIk3WdvOXrEql494liwTXCYhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8 +7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R +cHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y +mQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW +xFIY6iHOsfHmhIHluqmGKPJDWl0Snawe2ajlCmqnf6CHKc/yiU3U7MXi5nrQNiOK +SnQ2+Q== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1 + Validity + Not Before: Sep 30 04:20:49 2003 GMT + Not After : Sep 30 04:20:49 2023 GMT + Subject: C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:b3:b3:fe:7f:d3:6d:b1:ef:16:7c:57:a5:0c:6d: + 76:8a:2f:4b:bf:64:fb:4c:ee:8a:f0:f3:29:7c:f5: + ff:ee:2a:e0:e9:e9:ba:5b:64:22:9a:9a:6f:2c:3a: + 26:69:51:05:99:26:dc:d5:1c:6a:71:c6:9a:7d:1e: + 9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27: + a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8: + 22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21: + 68:06:98:14:96:87:d2:61:36:bc:6d:27:56:9e:57: + ee:c0:c0:56:fd:32:cf:a4:d9:8e:c2:23:d7:8d:a8: + f3:d8:25:ac:97:e4:70:38:f4:b6:3a:b4:9d:3b:97: + 26:43:a3:a1:bc:49:59:72:4c:23:30:87:01:58:f6: + 4e:be:1c:68:56:66:af:cd:41:5d:c8:b3:4d:2a:55: + 46:ab:1f:da:1e:e2:40:3d:db:cd:7d:b9:92:80:9c: + 37:dd:0c:96:64:9d:dc:22:f7:64:8b:df:61:de:15: + 94:52:15:a0:7d:52:c9:4b:a8:21:c9:c6:b1:ed:cb: + c3:95:60:d1:0f:f0:ab:70:f8:df:cb:4d:7e:ec:d6: + fa:ab:d9:bd:7f:54:f2:a5:e9:79:fa:d9:d6:76:24: + 28:73 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48 + X509v3 Key Usage: + Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + Signature Algorithm: sha1WithRSAEncryption + 68:40:a9:a8:bb:e4:4f:5d:79:b3:05:b5:17:b3:60:13:eb:c6: + 92:5d:e0:d1:d3:6a:fe:fb:be:9b:6d:bf:c7:05:6d:59:20:c4: + 1c:f0:b7:da:84:58:02:63:fa:48:16:ef:4f:a5:0b:f7:4a:98: + f2:3f:9e:1b:ad:47:6b:63:ce:08:47:eb:52:3f:78:9c:af:4d: + ae:f8:d5:4f:cf:9a:98:2a:10:41:39:52:c4:dd:d9:9b:0e:ef: + 93:01:ae:b2:2e:ca:68:42:24:42:6c:b0:b3:3a:3e:cd:e9:da: + 48:c4:15:cb:e9:f9:07:0f:92:50:49:8a:dd:31:97:5f:c9:e9: + 37:aa:3b:59:65:97:94:32:c9:b3:9f:3e:3a:62:58:c5:49:ad: + 62:0e:71:a5:32:aa:2f:c6:89:76:43:40:13:13:67:3d:a2:54: + 25:10:cb:f1:3a:f2:d9:fa:db:49:56:bb:a6:fe:a7:41:35:c3: + e0:88:61:c9:88:c7:df:36:10:22:98:59:ea:b0:4a:fb:56:16: + 73:6e:ac:4d:f7:22:a1:4f:ad:1d:7a:2d:45:27:e5:30:c1:5e: + f2:da:13:cb:25:42:51:95:47:03:8c:6c:21:cc:74:42:ed:53: + ff:33:8b:8f:0f:57:01:16:2f:cf:a6:ee:c9:70:22:14:bd:fd: + be:6c:0b:03 +MD5 Fingerprint=F1:BC:63:6A:54:E0:B5:27:F5:CD:E7:1A:E3:4D:6E:4A +-----BEGIN CERTIFICATE----- +MIIDWjCCAkKgAwIBAgIBADANBgkqhkiG9w0BAQUFADBQMQswCQYDVQQGEwJKUDEY +MBYGA1UEChMPU0VDT00gVHJ1c3QubmV0MScwJQYDVQQLEx5TZWN1cml0eSBDb21t +dW5pY2F0aW9uIFJvb3RDQTEwHhcNMDMwOTMwMDQyMDQ5WhcNMjMwOTMwMDQyMDQ5 +WjBQMQswCQYDVQQGEwJKUDEYMBYGA1UEChMPU0VDT00gVHJ1c3QubmV0MScwJQYD +VQQLEx5TZWN1cml0eSBDb21tdW5pY2F0aW9uIFJvb3RDQTEwggEiMA0GCSqGSIb3 +DQEBAQUAA4IBDwAwggEKAoIBAQCzs/5/022x7xZ8V6UMbXaKL0u/ZPtM7orw8yl8 +9f/uKuDp6bpbZCKamm8sOiZpUQWZJtzVHGpxxpp9Hp3dfGzGjGdnSj74cbAZJ6kJ +DKaVv0uMDPpVmDvY6CKhS3E4eayXkmmziX7qIWgGmBSWh9JhNrxtJ1aeV+7AwFb9 +Ms+k2Y7CI9eNqPPYJayX5HA49LY6tJ07lyZDo6G8SVlyTCMwhwFY9k6+HGhWZq/N +QV3Is00qVUarH9oe4kA92819uZKAnDfdDJZkndwi92SL32HeFZRSFaB9UslLqCHJ +xrHty8OVYNEP8Ktw+N/LTX7s1vqr2b1/VPKl6Xn62dZ2JChzAgMBAAGjPzA9MB0G +A1UdDgQWBBSgc0mZaNyFW2XjmygvV5+9M7wHSDALBgNVHQ8EBAMCAQYwDwYDVR0T +AQH/BAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAaECpqLvkT115swW1F7NgE+vG +kl3g0dNq/vu+m22/xwVtWSDEHPC32oRYAmP6SBbvT6UL90qY8j+eG61Ha2POCEfr +Uj94nK9NrvjVT8+amCoQQTlSxN3Zmw7vkwGusi7KaEIkQmywszo+zenaSMQVy+n5 +Bw+SUEmK3TGXX8npN6o7WWWXlDLJs58+OmJYxUmtYg5xpTKqL8aJdkNAExNnPaJU +JRDL8Try2frbSVa7pv6nQTXD4IhhyYjH3zYQIphZ6rBK+1YWc26sTfcioU+tHXot +RSflMMFe8toTyyVCUZVHA4xsIcx0Qu1T/zOLjw9XARYvz6buyXAiFL39vmwLAw== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 36 (0x24) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=FI, O=Sonera, CN=Sonera Class1 CA + Validity + Not Before: Apr 6 10:49:13 2001 GMT + Not After : Apr 6 10:49:13 2021 GMT + Subject: C=FI, O=Sonera, CN=Sonera Class1 CA + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:b5:89:1f:2b:4f:67:0a:79:ff:c5:1e:f8:7f:3c: + ed:d1:7e:da:b0:cd:6d:2f:36:ac:34:c6:db:d9:64: + 17:08:63:30:33:22:8a:4c:ee:8e:bb:0f:0d:42:55: + c9:9d:2e:a5:ef:f7:a7:8c:c3:ab:b9:97:cb:8e:ef: + 3f:15:67:a8:82:72:63:53:0f:41:8c:7d:10:95:24: + a1:5a:a5:06:fa:92:57:9d:fa:a5:01:f2:75:e9:1f: + bc:56:26:52:4e:78:19:65:58:55:03:58:c0:14:ae: + 8c:7c:55:5f:70:5b:77:23:06:36:97:f3:24:b5:9a: + 46:95:e4:df:0d:0b:05:45:e5:d1:f2:1d:82:bb:c6: + 13:e0:fe:aa:7a:fd:69:30:94:f3:d2:45:85:fc:f2: + 32:5b:32:de:e8:6c:5d:1f:cb:a4:22:74:b0:80:8e: + 5d:94:f7:06:00:4b:a9:d4:5e:2e:35:50:09:f3:80: + 97:f4:0c:17:ae:39:d8:5f:cd:33:c1:1c:ca:89:c2: + 22:f7:45:12:ed:5e:12:93:9d:63:ab:82:2e:b9:eb: + 42:41:44:cb:4a:1a:00:82:0d:9e:f9:8b:57:3e:4c: + c7:17:ed:2c:8b:72:33:5f:72:7a:38:56:d5:e6:d9: + ae:05:1a:1d:75:45:b1:cb:a5:25:1c:12:57:36:fd: + 22:37 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + 47:E2:0C:8B:F6:53:88:52 + X509v3 Key Usage: + Certificate Sign, CRL Sign + Signature Algorithm: sha1WithRSAEncryption + 8b:1a:b2:c9:5d:61:b4:e1:b9:2b:b9:53:d1:b2:85:9d:77:8e: + 16:ee:11:3d:db:c2:63:d9:5b:97:65:fb:12:67:d8:2a:5c:b6: + ab:e5:5e:c3:b7:16:2f:c8:e8:ab:1d:8a:fd:ab:1a:7c:d5:5f: + 63:cf:dc:b0:dd:77:b9:a8:e6:d2:22:38:87:07:14:d9:ff:be: + 56:b5:fd:07:0e:3c:55:ca:16:cc:a7:a6:77:37:fb:db:5c:1f: + 4e:59:06:87:a3:03:43:f5:16:ab:b7:84:bd:4e:ef:9f:31:37: + f0:46:f1:40:b6:d1:0c:a5:64:f8:63:5e:21:db:55:4e:4f:31: + 76:9c:10:61:8e:b6:53:3a:a3:11:be:af:6d:7c:1e:bd:ae:2d: + e2:0c:69:c7:85:53:68:a2:61:ba:c5:3e:b4:79:54:78:9e:0a: + c7:02:be:62:d1:11:82:4b:65:2f:91:5a:c2:a8:87:b1:56:68: + 94:79:f9:25:f7:c1:d5:ae:1a:b8:bb:3d:8f:a9:8a:38:15:f7: + 73:d0:5a:60:d1:80:b0:f0:dc:d5:50:cd:4e:ee:92:48:69:ed: + b2:23:1e:30:cc:c8:94:c8:b6:f5:3b:86:7f:3f:a6:2e:9f:f6: + 3e:2c:b5:92:96:3e:df:2c:93:8a:ff:81:8c:0f:0f:59:21:19: + 57:bd:55:9a +MD5 Fingerprint=33:B7:84:F5:5F:27:D7:68:27:DE:14:DE:12:2A:ED:6F +-----BEGIN CERTIFICATE----- +MIIDIDCCAgigAwIBAgIBJDANBgkqhkiG9w0BAQUFADA5MQswCQYDVQQGEwJGSTEP +MA0GA1UEChMGU29uZXJhMRkwFwYDVQQDExBTb25lcmEgQ2xhc3MxIENBMB4XDTAx +MDQwNjEwNDkxM1oXDTIxMDQwNjEwNDkxM1owOTELMAkGA1UEBhMCRkkxDzANBgNV +BAoTBlNvbmVyYTEZMBcGA1UEAxMQU29uZXJhIENsYXNzMSBDQTCCASIwDQYJKoZI +hvcNAQEBBQADggEPADCCAQoCggEBALWJHytPZwp5/8Ue+H887dF+2rDNbS82rDTG +29lkFwhjMDMiikzujrsPDUJVyZ0upe/3p4zDq7mXy47vPxVnqIJyY1MPQYx9EJUk +oVqlBvqSV536pQHydekfvFYmUk54GWVYVQNYwBSujHxVX3BbdyMGNpfzJLWaRpXk +3w0LBUXl0fIdgrvGE+D+qnr9aTCU89JFhfzyMlsy3uhsXR/LpCJ0sICOXZT3BgBL +qdReLjVQCfOAl/QMF6452F/NM8EcyonCIvdFEu1eEpOdY6uCLrnrQkFEy0oaAIIN +nvmLVz5MxxftLItyM19yejhW1ebZrgUaHXVFsculJRwSVzb9IjcCAwEAAaMzMDEw +DwYDVR0TAQH/BAUwAwEB/zARBgNVHQ4ECgQIR+IMi/ZTiFIwCwYDVR0PBAQDAgEG +MA0GCSqGSIb3DQEBBQUAA4IBAQCLGrLJXWG04bkruVPRsoWdd44W7hE928Jj2VuX +ZfsSZ9gqXLar5V7DtxYvyOirHYr9qxp81V9jz9yw3Xe5qObSIjiHBxTZ/75Wtf0H +DjxVyhbMp6Z3N/vbXB9OWQaHowND9Rart4S9Tu+fMTfwRvFAttEMpWT4Y14h21VO +TzF2nBBhjrZTOqMRvq9tfB69ri3iDGnHhVNoomG6xT60eVR4ngrHAr5i0RGCS2Uv +kVrCqIexVmiUefkl98HVrhq4uz2PqYo4Ffdz0Fpg0YCw8NzVUM1O7pJIae2yIx4w +zMiUyLb1O4Z/P6Yun/Y+LLWSlj7fLJOK/4GMDw9ZIRlXvVWa +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 29 (0x1d) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=FI, O=Sonera, CN=Sonera Class2 CA + Validity + Not Before: Apr 6 07:29:40 2001 GMT + Not After : Apr 6 07:29:40 2021 GMT + Subject: C=FI, O=Sonera, CN=Sonera Class2 CA + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:90:17:4a:35:9d:ca:f0:0d:96:c7:44:fa:16:37: + fc:48:bd:bd:7f:80:2d:35:3b:e1:6f:a8:67:a9:bf: + 03:1c:4d:8c:6f:32:47:d5:41:68:a4:13:04:c1:35: + 0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91: + 5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed: + e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84: + 36:69:b3:fd:5e:76:bd:a3:2d:99:d3:90:4e:23:28: + 7d:18:63:f1:54:3b:26:9d:76:5b:97:42:b2:ff:ae: + f0:4e:ec:dd:39:95:4e:83:06:7f:e7:49:40:c8:c5: + 01:b2:54:5a:66:1d:3d:fc:f9:e9:3c:0a:9e:81:b8: + 70:f0:01:8b:e4:23:54:7c:c8:ae:f8:90:1e:00:96: + 72:d4:54:cf:61:23:bc:ea:fb:9d:02:95:d1:b6:b9: + 71:3a:69:08:3f:0f:b4:e1:42:c7:88:f5:3f:98:a8: + a7:ba:1c:e0:71:71:ef:58:57:81:50:7a:5c:6b:74: + 46:0e:83:03:98:c3:8e:a8:6e:f2:76:32:6e:27:83: + c2:73:f3:dc:18:e8:b4:93:ea:75:44:6b:04:60:20: + 71:57:87:9d:f3:be:a0:90:23:3d:8a:24:e1:da:21: + db:c3 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + 4A:A0:AA:58:84:D3:5E:3C + X509v3 Key Usage: + Certificate Sign, CRL Sign + Signature Algorithm: sha1WithRSAEncryption + 5a:ce:87:f9:16:72:15:57:4b:1d:d9:9b:e7:a2:26:30:ec:93: + 67:df:d6:2d:d2:34:af:f7:38:a5:ce:ab:16:b9:ab:2f:7c:35: + cb:ac:d0:0f:b4:4c:2b:fc:80:ef:6b:8c:91:5f:36:76:f7:db: + b3:1b:19:ea:f4:b2:11:fd:61:71:44:bf:28:b3:3a:1d:bf:b3: + 43:e8:9f:bf:dc:31:08:71:b0:9d:8d:d6:34:47:32:90:c6:65: + 24:f7:a0:4a:7c:04:73:8f:39:6f:17:8c:72:b5:bd:4b:c8:7a: + f8:7b:83:c3:28:4e:9c:09:ea:67:3f:b2:67:04:1b:c3:14:da: + f8:e7:49:24:91:d0:1d:6a:fa:61:39:ef:6b:e7:21:75:06:07: + d8:12:b4:21:20:70:42:71:81:da:3c:9a:36:be:a6:5b:0d:6a: + 6c:9a:1f:91:7b:f9:f9:ef:42:ba:4e:4e:9e:cc:0c:8d:94:dc: + d9:45:9c:5e:ec:42:50:63:ae:f4:5d:c4:b1:12:dc:ca:3b:a8: + 2e:9d:14:5a:05:75:b7:ec:d7:63:e2:ba:35:b6:04:08:91:e8: + da:9d:9c:f6:66:b5:18:ac:0a:a6:54:26:34:33:d2:1b:c1:d4: + 7f:1a:3a:8e:0b:aa:32:6e:db:fc:4f:25:9f:d9:32:c7:96:5a: + 70:ac:df:4c +MD5 Fingerprint=A3:EC:75:0F:2E:88:DF:FA:48:01:4E:0B:5C:48:6F:FB +-----BEGIN CERTIFICATE----- +MIIDIDCCAgigAwIBAgIBHTANBgkqhkiG9w0BAQUFADA5MQswCQYDVQQGEwJGSTEP +MA0GA1UEChMGU29uZXJhMRkwFwYDVQQDExBTb25lcmEgQ2xhc3MyIENBMB4XDTAx +MDQwNjA3Mjk0MFoXDTIxMDQwNjA3Mjk0MFowOTELMAkGA1UEBhMCRkkxDzANBgNV +BAoTBlNvbmVyYTEZMBcGA1UEAxMQU29uZXJhIENsYXNzMiBDQTCCASIwDQYJKoZI +hvcNAQEBBQADggEPADCCAQoCggEBAJAXSjWdyvANlsdE+hY3/Ei9vX+ALTU74W+o +Z6m/AxxNjG8yR9VBaKQTBME1DJqEQ/xcHf+Js+gXGM2RX/uJ4+q/Tl18GybTdXnt +5oTjV+WtKcT0OijnpXuENmmz/V52vaMtmdOQTiMofRhj8VQ7Jp12W5dCsv+u8E7s +3TmVToMGf+dJQMjFAbJUWmYdPfz56TwKnoG4cPABi+QjVHzIrviQHgCWctRUz2Ej +vOr7nQKV0ba5cTppCD8PtOFCx4j1P5iop7oc4HFx71hXgVB6XGt0Rg6DA5jDjqhu +8nYybieDwnPz3BjotJPqdURrBGAgcVeHnfO+oJAjPYok4doh28MCAwEAAaMzMDEw +DwYDVR0TAQH/BAUwAwEB/zARBgNVHQ4ECgQISqCqWITTXjwwCwYDVR0PBAQDAgEG +MA0GCSqGSIb3DQEBBQUAA4IBAQBazof5FnIVV0sd2ZvnoiYw7JNn39Yt0jSv9zil +zqsWuasvfDXLrNAPtEwr/IDva4yRXzZ299uzGxnq9LIR/WFxRL8oszodv7ND6J+/ +3DEIcbCdjdY0RzKQxmUk96BKfARzjzlvF4xytb1LyHr4e4PDKE6cCepnP7JnBBvD +FNr450kkkdAdavphOe9r5yF1BgfYErQhIHBCcYHaPJo2vqZbDWpsmh+Re/n570K6 +Tk6ezAyNlNzZRZxe7EJQY670XcSxEtzKO6gunRRaBXW37Ndj4ro1tgQIkejanZz2 +ZrUYrAqmVCY0M9IbwdR/GjqOC6oybtv8TyWf2TLHllpwrN9M +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 10000010 (0x98968a) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA + Validity + Not Before: Dec 17 09:23:49 2002 GMT + Not After : Dec 16 09:15:38 2015 GMT + Subject: C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:98:d2:b5:51:11:7a:81:a6:14:98:71:6d:be:cc: + e7:13:1b:d6:27:0e:7a:b3:6a:18:1c:b6:61:5a:d5: + 61:09:bf:de:90:13:c7:67:ee:dd:f3:da:c5:0c:12: + 9e:35:55:3e:2c:27:88:40:6b:f7:dc:dd:22:61:f5: + c2:c7:0e:f5:f6:d5:76:53:4d:8f:8c:bc:18:76:37: + 85:9d:e8:ca:49:c7:d2:4f:98:13:09:a2:3e:22:88: + 9c:7f:d6:f2:10:65:b4:ee:5f:18:d5:17:e3:f8:c5: + fd:e2:9d:a2:ef:53:0e:85:77:a2:0f:e1:30:47:ee: + 00:e7:33:7d:44:67:1a:0b:51:e8:8b:a0:9e:50:98: + 68:34:52:1f:2e:6d:01:f2:60:45:f2:31:eb:a9:31: + 68:29:bb:7a:41:9e:c6:19:7f:94:b4:51:39:03:7f: + b2:de:a7:32:9b:b4:47:8e:6f:b4:4a:ae:e5:af:b1: + dc:b0:1b:61:bc:99:72:de:e4:89:b7:7a:26:5d:da: + 33:49:5b:52:9c:0e:f5:8a:ad:c3:b8:3d:e8:06:6a: + c2:d5:2a:0b:6c:7b:84:bd:56:05:cb:86:65:92:ec: + 44:2b:b0:8e:b9:dc:70:0b:46:da:ad:bc:63:88:39: + fa:db:6a:fe:23:fa:bc:e4:48:f4:67:2b:6a:11:10: + 21:49 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: + CA:TRUE + X509v3 Certificate Policies: + Policy: X509v3 Any Policy + CPS: http://www.pkioverheid.nl/policies/root-policy + + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + X509v3 Subject Key Identifier: + A8:7D:EB:BC:63:A4:74:13:74:00:EC:96:E0:D3:34:C1:2C:BF:6C:F8 + Signature Algorithm: sha1WithRSAEncryption + 05:84:87:55:74:36:61:c1:bb:d1:d4:c6:15:a8:13:b4:9f:a4: + fe:bb:ee:15:b4:2f:06:0c:29:f2:a8:92:a4:61:0d:fc:ab:5c: + 08:5b:51:13:2b:4d:c2:2a:61:c8:f8:09:58:fc:2d:02:b2:39: + 7d:99:66:81:bf:6e:5c:95:45:20:6c:e6:79:a7:d1:d8:1c:29: + fc:c2:20:27:51:c8:f1:7c:5d:34:67:69:85:11:30:c6:00:d2: + d7:f3:d3:7c:b6:f0:31:57:28:12:82:73:e9:33:2f:a6:55:b4: + 0b:91:94:47:9c:fa:bb:7a:42:32:e8:ae:7e:2d:c8:bc:ac:14: + bf:d9:0f:d9:5b:fc:c1:f9:7a:95:e1:7d:7e:96:fc:71:b0:c2: + 4c:c8:df:45:34:c9:ce:0d:f2:9c:64:08:d0:3b:c3:29:c5:b2: + ed:90:04:c1:b1:29:91:c5:30:6f:c1:a9:72:33:cc:fe:5d:16: + 17:2c:11:69:e7:7e:fe:c5:83:08:df:bc:dc:22:3a:2e:20:69: + 23:39:56:60:67:90:8b:2e:76:39:fb:11:88:97:f6:7c:bd:4b: + b8:20:16:67:05:8d:e2:3b:c1:72:3f:94:95:37:c7:5d:b9:9e: + d8:93:a1:17:8f:ff:0c:66:15:c1:24:7c:32:7c:03:1d:3b:a1: + 58:45:32:93 +MD5 Fingerprint=60:84:7C:5A:CE:DB:0C:D4:CB:A7:E9:FE:02:C6:A9:C0 +-----BEGIN CERTIFICATE----- +MIIDujCCAqKgAwIBAgIEAJiWijANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJO +TDEeMBwGA1UEChMVU3RhYXQgZGVyIE5lZGVybGFuZGVuMSYwJAYDVQQDEx1TdGFh +dCBkZXIgTmVkZXJsYW5kZW4gUm9vdCBDQTAeFw0wMjEyMTcwOTIzNDlaFw0xNTEy +MTYwOTE1MzhaMFUxCzAJBgNVBAYTAk5MMR4wHAYDVQQKExVTdGFhdCBkZXIgTmVk +ZXJsYW5kZW4xJjAkBgNVBAMTHVN0YWF0IGRlciBOZWRlcmxhbmRlbiBSb290IENB +MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmNK1URF6gaYUmHFtvszn +ExvWJw56s2oYHLZhWtVhCb/ekBPHZ+7d89rFDBKeNVU+LCeIQGv33N0iYfXCxw71 +9tV2U02PjLwYdjeFnejKScfST5gTCaI+Ioicf9byEGW07l8Y1Rfj+MX94p2i71MO +hXeiD+EwR+4A5zN9RGcaC1Hoi6CeUJhoNFIfLm0B8mBF8jHrqTFoKbt6QZ7GGX+U +tFE5A3+y3qcym7RHjm+0Sq7lr7HcsBthvJly3uSJt3omXdozSVtSnA71iq3DuD3o +BmrC1SoLbHuEvVYFy4ZlkuxEK7COudxwC0barbxjiDn622r+I/q85Ej0ZytqERAh +SQIDAQABo4GRMIGOMAwGA1UdEwQFMAMBAf8wTwYDVR0gBEgwRjBEBgRVHSAAMDww +OgYIKwYBBQUHAgEWLmh0dHA6Ly93d3cucGtpb3ZlcmhlaWQubmwvcG9saWNpZXMv +cm9vdC1wb2xpY3kwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSofeu8Y6R0E3QA +7Jbg0zTBLL9s+DANBgkqhkiG9w0BAQUFAAOCAQEABYSHVXQ2YcG70dTGFagTtJ+k +/rvuFbQvBgwp8qiSpGEN/KtcCFtREytNwiphyPgJWPwtArI5fZlmgb9uXJVFIGzm +eafR2Bwp/MIgJ1HI8XxdNGdphREwxgDS1/PTfLbwMVcoEoJz6TMvplW0C5GUR5z6 +u3pCMuiufi3IvKwUv9kP2Vv8wfl6leF9fpb8cbDCTMjfRTTJzg3ynGQI0DvDKcWy +7ZAEwbEpkcUwb8GpcjPM/l0WFywRaed+/sWDCN+83CI6LiBpIzlWYGeQiy52OfsR +iJf2fL1LuCAWZwWN4jvBcj+UlTfHXbme2JOhF4//DGYVwSR8MnwDHTuhWEUykw== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 986490188 (0x3acca54c) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=DK, O=TDC Internet, OU=TDC Internet Root CA + Validity + Not Before: Apr 5 16:33:17 2001 GMT + Not After : Apr 5 17:03:17 2021 GMT + Subject: C=DK, O=TDC Internet, OU=TDC Internet Root CA + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:c4:b8:40:bc:91:d5:63:1f:d7:99:a0:8b:0c:40: + 1e:74:b7:48:9d:46:8c:02:b2:e0:24:5f:f0:19:13: + a7:37:83:6b:5d:c7:8e:f9:84:30:ce:1a:3b:fa:fb: + ce:8b:6d:23:c6:c3:6e:66:9f:89:a5:df:e0:42:50: + 67:fa:1f:6c:1e:f4:d0:05:d6:bf:ca:d6:4e:e4:68: + 60:6c:46:aa:1c:5d:63:e1:07:86:0e:65:00:a7:2e: + a6:71:c6:bc:b9:81:a8:3a:7d:1a:d2:f9:d1:ac:4b: + cb:ce:75:af:dc:7b:fa:81:73:d4:fc:ba:bd:41:88: + d4:74:b3:f9:5e:38:3a:3c:43:a8:d2:95:4e:77:6d: + 13:0c:9d:8f:78:01:b7:5a:20:1f:03:37:35:e2:2c: + db:4b:2b:2c:78:b9:49:db:c4:d0:c7:9c:9c:e4:8a: + 20:09:21:16:56:66:ff:05:ec:5b:e3:f0:cf:ab:24: + 24:5e:c3:7f:70:7a:12:c4:d2:b5:10:a0:b6:21:e1: + 8d:78:69:55:44:69:f5:ca:96:1c:34:85:17:25:77: + e2:f6:2f:27:98:78:fd:79:06:3a:a2:d6:5a:43:c1: + ff:ec:04:3b:ee:13:ef:d3:58:5a:ff:92:eb:ec:ae: + da:f2:37:03:47:41:b6:97:c9:2d:0a:41:22:bb:bb: + e6:a7 + Exponent: 65537 (0x10001) + X509v3 extensions: + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 CRL Distribution Points: + DirName:/C=DK/O=TDC Internet/OU=TDC Internet Root CA/CN=CRL1 + + X509v3 Private Key Usage Period: + Not Before: Apr 5 16:33:17 2001 GMT, Not After: Apr 5 17:03:17 2021 GMT + X509v3 Key Usage: + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:6C:64:01:C7:FD:85:6D:AC:C8:DA:9E:50:08:85:08:B5:3C:56:A8:50 + + X509v3 Subject Key Identifier: + 6C:64:01:C7:FD:85:6D:AC:C8:DA:9E:50:08:85:08:B5:3C:56:A8:50 + X509v3 Basic Constraints: + CA:TRUE + 1.2.840.113533.7.65.0: + 0...V5.0:4.0.... + Signature Algorithm: sha1WithRSAEncryption + 4e:43:cc:d1:dd:1d:10:1b:06:7f:b7:a4:fa:d3:d9:4d:fb:23: + 9f:23:54:5b:e6:8b:2f:04:28:8b:b5:27:6d:89:a1:ec:98:69: + dc:e7:8d:26:83:05:79:74:ec:b4:b9:a3:97:c1:35:00:fd:15: + da:39:81:3a:95:31:90:de:97:e9:86:a8:99:77:0c:e5:5a:a0: + 84:ff:12:16:ac:6e:b8:8d:c3:7b:92:c2:ac:2e:d0:7d:28:ec: + b6:f3:60:38:69:6f:3e:d8:04:55:3e:9e:cc:55:d2:ba:fe:bb: + 47:04:d7:0a:d9:16:0a:34:29:f5:58:13:d5:4f:cf:8f:56:4b: + b3:1e:ee:d3:98:79:da:08:1e:0c:6f:b8:f8:16:27:ef:c2:6f: + 3d:f6:a3:4b:3e:0e:e4:6d:6c:db:3b:41:12:9b:bd:0d:47:23: + 7f:3c:4a:d0:af:c0:af:f6:ef:1b:b5:15:c4:eb:83:c4:09:5f: + 74:8b:d9:11:fb:c2:56:b1:3c:f8:70:ca:34:8d:43:40:13:8c: + fd:99:03:54:79:c6:2e:ea:86:a1:f6:3a:d4:09:bc:f4:bc:66: + cc:3d:58:d0:57:49:0a:ee:25:e2:41:ee:13:f9:9b:38:34:d1: + 00:f5:7e:e7:94:1d:fc:69:03:62:b8:99:05:05:3d:6b:78:12: + bd:b0:6f:65 +MD5 Fingerprint=91:F4:03:55:20:A1:F8:63:2C:62:DE:AC:FB:61:1C:8E +-----BEGIN CERTIFICATE----- +MIIEKzCCAxOgAwIBAgIEOsylTDANBgkqhkiG9w0BAQUFADBDMQswCQYDVQQGEwJE +SzEVMBMGA1UEChMMVERDIEludGVybmV0MR0wGwYDVQQLExRUREMgSW50ZXJuZXQg +Um9vdCBDQTAeFw0wMTA0MDUxNjMzMTdaFw0yMTA0MDUxNzAzMTdaMEMxCzAJBgNV +BAYTAkRLMRUwEwYDVQQKEwxUREMgSW50ZXJuZXQxHTAbBgNVBAsTFFREQyBJbnRl +cm5ldCBSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxLhA +vJHVYx/XmaCLDEAedLdInUaMArLgJF/wGROnN4NrXceO+YQwzho7+vvOi20jxsNu +Zp+Jpd/gQlBn+h9sHvTQBda/ytZO5GhgbEaqHF1j4QeGDmUApy6mcca8uYGoOn0a +0vnRrEvLznWv3Hv6gXPU/Lq9QYjUdLP5Xjg6PEOo0pVOd20TDJ2PeAG3WiAfAzc1 +4izbSysseLlJ28TQx5yc5IogCSEWVmb/Bexb4/DPqyQkXsN/cHoSxNK1EKC2IeGN +eGlVRGn1ypYcNIUXJXfi9i8nmHj9eQY6otZaQ8H/7AQ77hPv01ha/5Lr7K7a8jcD +R0G2l8ktCkEiu7vmpwIDAQABo4IBJTCCASEwEQYJYIZIAYb4QgEBBAQDAgAHMGUG +A1UdHwReMFwwWqBYoFakVDBSMQswCQYDVQQGEwJESzEVMBMGA1UEChMMVERDIElu +dGVybmV0MR0wGwYDVQQLExRUREMgSW50ZXJuZXQgUm9vdCBDQTENMAsGA1UEAxME +Q1JMMTArBgNVHRAEJDAigA8yMDAxMDQwNTE2MzMxN1qBDzIwMjEwNDA1MTcwMzE3 +WjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAUbGQBx/2FbazI2p5QCIUItTxWqFAw +HQYDVR0OBBYEFGxkAcf9hW2syNqeUAiFCLU8VqhQMAwGA1UdEwQFMAMBAf8wHQYJ +KoZIhvZ9B0EABBAwDhsIVjUuMDo0LjADAgSQMA0GCSqGSIb3DQEBBQUAA4IBAQBO +Q8zR3R0QGwZ/t6T609lN+yOfI1Rb5osvBCiLtSdtiaHsmGnc540mgwV5dOy0uaOX +wTUA/RXaOYE6lTGQ3pfphqiZdwzlWqCE/xIWrG64jcN7ksKsLtB9KOy282A4aW8+ +2ARVPp7MVdK6/rtHBNcK2RYKNCn1WBPVT8+PVkuzHu7TmHnaCB4Mb7j4Fifvwm89 +9qNLPg7kbWzbO0ESm70NRyN/PErQr8Cv9u8btRXE64PECV90i9kR+8JWsTz4cMo0 +jUNAE4z9mQNUecYu6oah9jrUCbz0vGbMPVjQV0kK7iXiQe4T+Zs4NNEA9X7nlB38 +aQNiuJkFBT1reBK9sG9l +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1044954564 (0x3e48bdc4) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=DK, O=TDC, CN=TDC OCES CA + Validity + Not Before: Feb 11 08:39:30 2003 GMT + Not After : Feb 11 09:09:30 2037 GMT + Subject: C=DK, O=TDC, CN=TDC OCES CA + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:ac:62:f6:61:20:b2:cf:c0:c6:85:d7:e3:79:e6: + cc:ed:f2:39:92:a4:97:2e:64:a3:84:5b:87:9c:4c: + fd:a4:f3:c4:5f:21:bd:56:10:eb:db:2e:61:ec:93: + 69:e3:a3:cc:bd:99:c3:05:fc:06:b8:ca:36:1c:fe: + 90:8e:49:4c:c4:56:9a:2f:56:bc:cf:7b:0c:f1:6f: + 47:a6:0d:43:4d:e2:e9:1d:39:34:cd:8d:2c:d9:12: + 98:f9:e3:e1:c1:4a:7c:86:38:c4:a9:c4:61:88:d2: + 5e:af:1a:26:4d:d5:e4:a0:22:47:84:d9:64:b7:19: + 96:fc:ec:19:e4:b2:97:26:4e:4a:4c:cb:8f:24:8b: + 54:18:1c:48:61:7b:d5:88:68:da:5d:b5:ea:cd:1a: + 30:c1:80:83:76:50:aa:4f:d1:d4:dd:38:f0:ef:16: + f4:e1:0c:50:06:bf:ea:fb:7a:49:a1:28:2b:1c:f6: + fc:15:32:a3:74:6a:8f:a9:c3:62:29:71:31:e5:3b: + a4:60:17:5e:74:e6:da:13:ed:e9:1f:1f:1b:d1:b2: + 68:73:c6:10:34:75:46:10:10:e3:90:00:76:40:cb: + 8b:b7:43:09:21:ff:ab:4e:93:c6:58:e9:a5:82:db: + 77:c4:3a:99:b1:72:95:49:04:f0:b7:2b:fa:7b:59: + 8e:dd + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + X509v3 Certificate Policies: + Policy: 1.2.208.169.1.1.1 + CPS: http://www.certifikat.dk/repository + User Notice: + Organization: TDC + Number: 1 + Explicit Text: Certifikater fra denne CA udstedes under OID 1.2.208.169.1.1.1. Certificates from this CA are issued under OID 1.2.208.169.1.1.1. + + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 CRL Distribution Points: + DirName:/C=DK/O=TDC/CN=TDC OCES CA/CN=CRL1 + URI:http://crl.oces.certifikat.dk/oces.crl + + X509v3 Private Key Usage Period: + Not Before: Feb 11 08:39:30 2003 GMT, Not After: Feb 11 09:09:30 2037 GMT + X509v3 Authority Key Identifier: + keyid:60:B5:85:EC:56:64:7E:12:19:27:67:1D:50:15:4B:73:AE:3B:F9:12 + + X509v3 Subject Key Identifier: + 60:B5:85:EC:56:64:7E:12:19:27:67:1D:50:15:4B:73:AE:3B:F9:12 + 1.2.840.113533.7.65.0: + 0...V6.0:4.0.... + Signature Algorithm: sha1WithRSAEncryption + 0a:ba:26:26:46:d3:73:a8:09:f3:6b:0b:30:99:fd:8a:e1:57: + 7a:11:d3:b8:94:d7:09:10:6e:a3:b1:38:03:d1:b6:f2:43:41: + 29:62:a7:72:d8:fb:7c:05:e6:31:70:27:54:18:4e:8a:7c:4e: + e5:d1:ca:8c:78:88:cf:1b:d3:90:8b:e6:23:f8:0b:0e:33:43: + 7d:9c:e2:0a:19:8f:c9:01:3e:74:5d:74:c9:8b:1c:03:e5:18: + c8:01:4c:3f:cb:97:05:5d:98:71:a6:98:6f:b6:7c:bd:37:7f: + be:e1:93:25:6d:6f:f0:0a:ad:17:18:e1:03:bc:07:29:c8:ad: + 26:e8:f8:61:f0:fd:21:09:7e:9a:8e:a9:68:7d:48:62:72:bd: + 00:ea:01:99:b8:06:82:51:81:4e:f1:f5:b4:91:54:b9:23:7a: + 00:9a:9f:5d:8d:e0:3c:64:b9:1a:12:92:2a:c7:82:44:72:39: + dc:e2:3c:c6:d8:55:f5:15:4e:c8:05:0e:db:c6:d0:62:a6:ec: + 15:b4:b5:02:82:db:ac:8c:a2:81:f0:9b:99:31:f5:20:20:a8: + 88:61:0a:07:9f:94:fc:d0:d7:1b:cc:2e:17:f3:04:27:76:67: + eb:54:83:fd:a4:90:7e:06:3d:04:a3:43:2d:da:fc:0b:62:ea: + 2f:5f:62:53 +MD5 Fingerprint=93:7F:90:1C:ED:84:67:17:A4:65:5F:9B:CB:30:02:97 +-----BEGIN CERTIFICATE----- +MIIFGTCCBAGgAwIBAgIEPki9xDANBgkqhkiG9w0BAQUFADAxMQswCQYDVQQGEwJE +SzEMMAoGA1UEChMDVERDMRQwEgYDVQQDEwtUREMgT0NFUyBDQTAeFw0wMzAyMTEw +ODM5MzBaFw0zNzAyMTEwOTA5MzBaMDExCzAJBgNVBAYTAkRLMQwwCgYDVQQKEwNU +REMxFDASBgNVBAMTC1REQyBPQ0VTIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A +MIIBCgKCAQEArGL2YSCyz8DGhdfjeebM7fI5kqSXLmSjhFuHnEz9pPPEXyG9VhDr +2y5h7JNp46PMvZnDBfwGuMo2HP6QjklMxFaaL1a8z3sM8W9Hpg1DTeLpHTk0zY0s +2RKY+ePhwUp8hjjEqcRhiNJerxomTdXkoCJHhNlktxmW/OwZ5LKXJk5KTMuPJItU +GBxIYXvViGjaXbXqzRowwYCDdlCqT9HU3Tjw7xb04QxQBr/q+3pJoSgrHPb8FTKj +dGqPqcNiKXEx5TukYBdedObaE+3pHx8b0bJoc8YQNHVGEBDjkAB2QMuLt0MJIf+r +TpPGWOmlgtt3xDqZsXKVSQTwtyv6e1mO3QIDAQABo4ICNzCCAjMwDwYDVR0TAQH/ +BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwgewGA1UdIASB5DCB4TCB3gYIKoFQgSkB +AQEwgdEwLwYIKwYBBQUHAgEWI2h0dHA6Ly93d3cuY2VydGlmaWthdC5kay9yZXBv +c2l0b3J5MIGdBggrBgEFBQcCAjCBkDAKFgNUREMwAwIBARqBgUNlcnRpZmlrYXRl +ciBmcmEgZGVubmUgQ0EgdWRzdGVkZXMgdW5kZXIgT0lEIDEuMi4yMDguMTY5LjEu +MS4xLiBDZXJ0aWZpY2F0ZXMgZnJvbSB0aGlzIENBIGFyZSBpc3N1ZWQgdW5kZXIg +T0lEIDEuMi4yMDguMTY5LjEuMS4xLjARBglghkgBhvhCAQEEBAMCAAcwgYEGA1Ud +HwR6MHgwSKBGoESkQjBAMQswCQYDVQQGEwJESzEMMAoGA1UEChMDVERDMRQwEgYD +VQQDEwtUREMgT0NFUyBDQTENMAsGA1UEAxMEQ1JMMTAsoCqgKIYmaHR0cDovL2Ny +bC5vY2VzLmNlcnRpZmlrYXQuZGsvb2Nlcy5jcmwwKwYDVR0QBCQwIoAPMjAwMzAy +MTEwODM5MzBagQ8yMDM3MDIxMTA5MDkzMFowHwYDVR0jBBgwFoAUYLWF7FZkfhIZ +J2cdUBVLc647+RIwHQYDVR0OBBYEFGC1hexWZH4SGSdnHVAVS3OuO/kSMB0GCSqG +SIb2fQdBAAQQMA4bCFY2LjA6NC4wAwIEkDANBgkqhkiG9w0BAQUFAAOCAQEACrom +JkbTc6gJ82sLMJn9iuFXehHTuJTXCRBuo7E4A9G28kNBKWKnctj7fAXmMXAnVBhO +inxO5dHKjHiIzxvTkIvmI/gLDjNDfZziChmPyQE+dF10yYscA+UYyAFMP8uXBV2Y +caaYb7Z8vTd/vuGTJW1v8AqtFxjhA7wHKcitJuj4YfD9IQl+mo6paH1IYnK9AOoB +mbgGglGBTvH1tJFUuSN6AJqfXY3gPGS5GhKSKseCRHI53OI8xthV9RVOyAUO28bQ +YqbsFbS1AoLbrIyigfCbmTH1ICCoiGEKB5+U/NDXG8wuF/MEJ3Zn61SD/aSQfgY9 +BKNDLdr8C2LqL19iUw== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 44:be:0c:8b:50:00:21:b4:11:d3:2a:68:06:a9:ad:69 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN - DATACorp SGC + Validity + Not Before: Jun 24 18:57:21 1999 GMT + Not After : Jun 24 19:06:30 2019 GMT + Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN - DATACorp SGC + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:df:ee:58:10:a2:2b:6e:55:c4:8e:bf:2e:46:09: + e7:e0:08:0f:2e:2b:7a:13:94:1b:bd:f6:b6:80:8e: + 65:05:93:00:1e:bc:af:e2:0f:8e:19:0d:12:47:ec: + ac:ad:a3:fa:2e:70:f8:de:6e:fb:56:42:15:9e:2e: + 5c:ef:23:de:21:b9:05:76:27:19:0f:4f:d6:c3:9c: + b4:be:94:19:63:f2:a6:11:0a:eb:53:48:9c:be:f2: + 29:3b:16:e8:1a:a0:4c:a6:c9:f4:18:59:68:c0:70: + f2:53:00:c0:5e:50:82:a5:56:6f:36:f9:4a:e0:44: + 86:a0:4d:4e:d6:47:6e:49:4a:cb:67:d7:a6:c4:05: + b9:8e:1e:f4:fc:ff:cd:e7:36:e0:9c:05:6c:b2:33: + 22:15:d0:b4:e0:cc:17:c0:b2:c0:f4:fe:32:3f:29: + 2a:95:7b:d8:f2:a7:4e:0f:54:7c:a1:0d:80:b3:09: + 03:c1:ff:5c:dd:5e:9a:3e:bc:ae:bc:47:8a:6a:ae: + 71:ca:1f:b1:2a:b8:5f:42:05:0b:ec:46:30:d1:72: + 0b:ca:e9:56:6d:f5:ef:df:78:be:61:ba:b2:a5:ae: + 04:4c:bc:a8:ac:69:15:97:bd:ef:eb:b4:8c:bf:35: + f8:d4:c3:d1:28:0e:5c:3a:9f:70:18:33:20:77:c4: + a2:af + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Key Usage: + Digital Signature, Non Repudiation, Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + 53:32:D1:B3:CF:7F:FA:E0:F1:A0:5D:85:4E:92:D2:9E:45:1D:B4:4F + X509v3 CRL Distribution Points: + URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl + + X509v3 Extended Key Usage: + TLS Web Server Authentication, Microsoft Server Gated Crypto, Netscape Server Gated Crypto + Signature Algorithm: sha1WithRSAEncryption + 27:35:97:00:8a:8b:28:bd:c6:33:30:1e:29:fc:e2:f7:d5:98: + d4:40:bb:60:ca:bf:ab:17:2c:09:36:7f:50:fa:41:dc:ae:96: + 3a:0a:23:3e:89:59:c9:a3:07:ed:1b:37:ad:fc:7c:be:51:49: + 5a:de:3a:0a:54:08:16:45:c2:99:b1:87:cd:8c:68:e0:69:03: + e9:c4:4e:98:b2:3b:8c:16:b3:0e:a0:0c:98:50:9b:93:a9:70: + 09:c8:2c:a3:8f:df:02:e4:e0:71:3a:f1:b4:23:72:a0:aa:01: + df:df:98:3e:14:50:a0:31:26:bd:28:e9:5a:30:26:75:f9:7b: + 60:1c:8d:f3:cd:50:26:6d:04:27:9a:df:d5:0d:45:47:29:6b: + 2c:e6:76:d9:a9:29:7d:32:dd:c9:36:3c:bd:ae:35:f1:11:9e: + 1d:bb:90:3f:12:47:4e:8e:d7:7e:0f:62:73:1d:52:26:38:1c: + 18:49:fd:30:74:9a:c4:e5:22:2f:d8:c0:8d:ed:91:7a:4c:00: + 8f:72:7f:5d:da:dd:1b:8b:45:6b:e7:dd:69:97:a8:c5:56:4c: + 0f:0c:f6:9f:7a:91:37:f6:97:82:e0:dd:71:69:ff:76:3f:60: + 4d:3c:cf:f7:99:f9:c6:57:f4:c9:55:39:78:ba:2c:79:c9:a6: + 88:2b:f4:08 +MD5 Fingerprint=B3:A5:3E:77:21:6D:AC:4A:C0:C9:FB:D5:41:3D:CA:06 +-----BEGIN CERTIFICATE----- +MIIEXjCCA0agAwIBAgIQRL4Mi1AAIbQR0ypoBqmtaTANBgkqhkiG9w0BAQUFADCB +kzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug +Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho +dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xGzAZBgNVBAMTElVUTiAtIERBVEFDb3Jw +IFNHQzAeFw05OTA2MjQxODU3MjFaFw0xOTA2MjQxOTA2MzBaMIGTMQswCQYDVQQG +EwJVUzELMAkGA1UECBMCVVQxFzAVBgNVBAcTDlNhbHQgTGFrZSBDaXR5MR4wHAYD +VQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxITAfBgNVBAsTGGh0dHA6Ly93d3cu +dXNlcnRydXN0LmNvbTEbMBkGA1UEAxMSVVROIC0gREFUQUNvcnAgU0dDMIIBIjAN +BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3+5YEKIrblXEjr8uRgnn4AgPLit6 +E5Qbvfa2gI5lBZMAHryv4g+OGQ0SR+ysraP6LnD43m77VkIVni5c7yPeIbkFdicZ +D0/Ww5y0vpQZY/KmEQrrU0icvvIpOxboGqBMpsn0GFlowHDyUwDAXlCCpVZvNvlK +4ESGoE1O1kduSUrLZ9emxAW5jh70/P/N5zbgnAVssjMiFdC04MwXwLLA9P4yPykq +lXvY8qdOD1R8oQ2AswkDwf9c3V6aPryuvEeKaq5xyh+xKrhfQgUL7EYw0XILyulW +bfXv33i+Ybqypa4ETLyorGkVl73v67SMvzX41MPRKA5cOp9wGDMgd8SirwIDAQAB +o4GrMIGoMAsGA1UdDwQEAwIBxjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRT +MtGzz3/64PGgXYVOktKeRR20TzA9BgNVHR8ENjA0MDKgMKAuhixodHRwOi8vY3Js +LnVzZXJ0cnVzdC5jb20vVVROLURBVEFDb3JwU0dDLmNybDAqBgNVHSUEIzAhBggr +BgEFBQcDAQYKKwYBBAGCNwoDAwYJYIZIAYb4QgQBMA0GCSqGSIb3DQEBBQUAA4IB +AQAnNZcAiosovcYzMB4p/OL31ZjUQLtgyr+rFywJNn9Q+kHcrpY6CiM+iVnJowft +Gzet/Hy+UUla3joKVAgWRcKZsYfNjGjgaQPpxE6YsjuMFrMOoAyYUJuTqXAJyCyj +j98C5OBxOvG0I3KgqgHf35g+FFCgMSa9KOlaMCZ1+XtgHI3zzVAmbQQnmt/VDUVH +KWss5nbZqSl9Mt3JNjy9rjXxEZ4du5A/EkdOjtd+D2JzHVImOBwYSf0wdJrE5SIv +2MCN7ZF6TACPcn9d2t0bi0Vr591pl6jFVkwPDPafepE39peC4N1xaf92P2BNPM/3 +mfnGV/TJVTl4uix5yaaIK/QI +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 44:be:0c:8b:50:00:24:b4:11:d3:36:25:25:67:c9:89 + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Client Authentication and Email + Validity + Not Before: Jul 9 17:28:50 1999 GMT + Not After : Jul 9 17:36:58 2019 GMT + Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Client Authentication and Email + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:b2:39:85:a4:f2:7d:ab:41:3b:62:46:37:ae:cd: + c1:60:75:bc:39:65:f9:4a:1a:47:a2:b9:cc:48:cc: + 6a:98:d5:4d:35:19:b9:a4:42:e5:ce:49:e2:8a:2f: + 1e:7c:d2:31:07:c7:4e:b4:83:64:9d:2e:29:d5:a2: + 64:c4:85:bd:85:51:35:79:a4:4e:68:90:7b:1c:7a: + a4:92:a8:17:f2:98:15:f2:93:cc:c9:a4:32:95:bb: + 0c:4f:30:bd:98:a0:0b:8b:e5:6e:1b:a2:46:fa:78: + bc:a2:6f:ab:59:5e:a5:2f:cf:ca:da:6d:aa:2f:eb: + ac:a1:b3:6a:aa:b7:2e:67:35:8b:79:e1:1e:69:88: + e2:e6:46:cd:a0:a5:ea:be:0b:ce:76:3a:7a:0e:9b: + ea:fc:da:27:5b:3d:73:1f:22:e6:48:61:c6:4c:f3: + 69:b1:a8:2e:1b:b6:d4:31:20:2c:bc:82:8a:8e:a4: + 0e:a5:d7:89:43:fc:16:5a:af:1d:71:d7:11:59:da: + ba:87:0d:af:fa:f3:e1:c2:f0:a4:c5:67:8c:d6:d6: + 54:3a:de:0a:a4:ba:03:77:b3:65:c8:fd:1e:d3:74: + 62:aa:18:ca:68:93:1e:a1:85:7e:f5:47:65:cb:f8: + 4d:57:28:74:d2:34:ff:30:b6:ee:f6:62:30:14:8c: + 2c:eb + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Key Usage: + Digital Signature, Non Repudiation, Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + 89:82:67:7D:C4:9D:26:70:00:4B:B4:50:48:7C:DE:3D:AE:04:6E:7D + X509v3 CRL Distribution Points: + URI:http://crl.usertrust.com/UTN-USERFirst-ClientAuthenticationandEmail.crl + + X509v3 Extended Key Usage: + TLS Web Client Authentication, E-mail Protection + Signature Algorithm: sha1WithRSAEncryption + b1:6d:61:5d:a6:1a:7f:7c:ab:4a:e4:30:fc:53:6f:25:24:c6: + ca:ed:e2:31:5c:2b:0e:ee:ee:61:55:6f:04:3e:cf:39:de:c5: + 1b:49:94:e4:eb:20:4c:b4:e6:9e:50:2e:72:d9:8d:f5:aa:a3: + b3:4a:da:56:1c:60:97:80:dc:82:a2:ad:4a:bd:8a:2b:ff:0b: + 09:b4:c6:d7:20:04:45:e4:cd:80:01:ba:ba:2b:6e:ce:aa:d7: + 92:fe:e4:af:eb:f4:26:1d:16:2a:7f:6c:30:95:37:2f:33:12: + ac:7f:dd:c7:d1:11:8c:51:98:b2:d0:a3:91:d0:ad:f6:9f:9e: + 83:93:1e:1d:42:b8:46:af:6b:66:f0:9b:7f:ea:e3:03:02:e5: + 02:51:c1:aa:d5:35:9d:72:40:03:89:ba:31:1d:c5:10:68:52: + 9e:df:a2:85:c5:5c:08:a6:78:e6:53:4f:b1:e8:b7:d3:14:9e: + 93:a6:c3:64:e3:ac:7e:71:cd:bc:9f:e9:03:1b:cc:fb:e9:ac: + 31:c1:af:7c:15:74:02:99:c3:b2:47:a6:c2:32:61:d7:c7:6f: + 48:24:51:27:a1:d5:87:55:f2:7b:8f:98:3d:16:9e:ee:75:b6: + f8:d0:8e:f2:f3:c6:ae:28:5b:a7:f0:f3:36:17:fc:c3:05:d3: + ca:03:4a:54 +MD5 Fingerprint=D7:34:3D:EF:1D:27:09:28:E1:31:02:5B:13:2B:DD:F7 +-----BEGIN CERTIFICATE----- +MIIEojCCA4qgAwIBAgIQRL4Mi1AAJLQR0zYlJWfJiTANBgkqhkiG9w0BAQUFADCB +rjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug +Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho +dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMTLVVUTi1VU0VSRmlyc3Qt +Q2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbDAeFw05OTA3MDkxNzI4NTBa +Fw0xOTA3MDkxNzM2NThaMIGuMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQxFzAV +BgNVBAcTDlNhbHQgTGFrZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5l +dHdvcmsxITAfBgNVBAsTGGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTE2MDQGA1UE +AxMtVVROLVVTRVJGaXJzdC1DbGllbnQgQXV0aGVudGljYXRpb24gYW5kIEVtYWls +MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsjmFpPJ9q0E7YkY3rs3B +YHW8OWX5ShpHornMSMxqmNVNNRm5pELlzkniii8efNIxB8dOtINknS4p1aJkxIW9 +hVE1eaROaJB7HHqkkqgX8pgV8pPMyaQylbsMTzC9mKALi+VuG6JG+ni8om+rWV6l +L8/K2m2qL+usobNqqrcuZzWLeeEeaYji5kbNoKXqvgvOdjp6Dpvq/NonWz1zHyLm +SGHGTPNpsaguG7bUMSAsvIKKjqQOpdeJQ/wWWq8dcdcRWdq6hw2v+vPhwvCkxWeM +1tZUOt4KpLoDd7NlyP0e03RiqhjKaJMeoYV+9Udly/hNVyh00jT/MLbu9mIwFIws +6wIDAQABo4G5MIG2MAsGA1UdDwQEAwIBxjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud +DgQWBBSJgmd9xJ0mcABLtFBIfN49rgRufTBYBgNVHR8EUTBPME2gS6BJhkdodHRw +Oi8vY3JsLnVzZXJ0cnVzdC5jb20vVVROLVVTRVJGaXJzdC1DbGllbnRBdXRoZW50 +aWNhdGlvbmFuZEVtYWlsLmNybDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH +AwQwDQYJKoZIhvcNAQEFBQADggEBALFtYV2mGn98q0rkMPxTbyUkxsrt4jFcKw7u +7mFVbwQ+zznexRtJlOTrIEy05p5QLnLZjfWqo7NK2lYcYJeA3IKirUq9iiv/Cwm0 +xtcgBEXkzYABurorbs6q15L+5K/r9CYdFip/bDCVNy8zEqx/3cfREYxRmLLQo5HQ +rfafnoOTHh1CuEava2bwm3/q4wMC5QJRwarVNZ1yQAOJujEdxRBoUp7fooXFXAim +eOZTT7Hot9MUnpOmw2TjrH5xzbyf6QMbzPvprDHBr3wVdAKZw7JHpsIyYdfHb0gk +USeh1YdV8nuPmD0Wnu51tvjQjvLzxq4oW6fw8zYX/MMF08oDSlQ= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 44:be:0c:8b:50:00:24:b4:11:d3:36:2a:fe:65:0a:fd + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware + Validity + Not Before: Jul 9 18:10:42 1999 GMT + Not After : Jul 9 18:19:22 2019 GMT + Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:b1:f7:c3:38:3f:b4:a8:7f:cf:39:82:51:67:d0: + 6d:9f:d2:ff:58:f3:e7:9f:2b:ec:0d:89:54:99:b9: + 38:99:16:f7:e0:21:79:48:c2:bb:61:74:12:96:1d: + 3c:6a:72:d5:3c:10:67:3a:39:ed:2b:13:cd:66:eb: + 95:09:33:a4:6c:97:b1:e8:c6:ec:c1:75:79:9c:46: + 5e:8d:ab:d0:6a:fd:b9:2a:55:17:10:54:b3:19:f0: + 9a:f6:f1:b1:5d:b6:a7:6d:fb:e0:71:17:6b:a2:88: + fb:00:df:fe:1a:31:77:0c:9a:01:7a:b1:32:e3:2b: + 01:07:38:6e:c3:a5:5e:23:bc:45:9b:7b:50:c1:c9: + 30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98: + 17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e: + 69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b: + 29:0d:46:0f:8c:cc:49:34:b0:69:51:bd:f9:06:cd: + 68:ad:66:4c:bc:3e:ac:61:bd:0a:88:0e:c8:df:3d: + ee:7c:04:4c:9d:0a:5e:6b:91:d6:ee:c7:ed:28:8d: + ab:4d:87:89:73:d0:6e:a4:d0:1e:16:8b:14:e1:76: + 44:03:7f:63:ac:e4:cd:49:9c:c5:92:f4:ab:32:a1: + 48:5b + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Key Usage: + Digital Signature, Non Repudiation, Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + A1:72:5F:26:1B:28:98:43:95:5D:07:37:D5:85:96:9D:4B:D2:C3:45 + X509v3 CRL Distribution Points: + URI:http://crl.usertrust.com/UTN-USERFirst-Hardware.crl + + X509v3 Extended Key Usage: + TLS Web Server Authentication, IPSec End System, IPSec Tunnel, IPSec User + Signature Algorithm: sha1WithRSAEncryption + 47:19:0f:de:74:c6:99:97:af:fc:ad:28:5e:75:8e:eb:2d:67: + ee:4e:7b:2b:d7:0c:ff:f6:de:cb:55:a2:0a:e1:4c:54:65:93: + 60:6b:9f:12:9c:ad:5e:83:2c:eb:5a:ae:c0:e4:2d:f4:00:63: + 1d:b8:c0:6c:f2:cf:49:bb:4d:93:6f:06:a6:0a:22:b2:49:62: + 08:4e:ff:c8:c8:14:b2:88:16:5d:e7:01:e4:12:95:e5:45:34: + b3:8b:69:bd:cf:b4:85:8f:75:51:9e:7d:3a:38:3a:14:48:12: + c6:fb:a7:3b:1a:8d:0d:82:40:07:e8:04:08:90:a1:89:cb:19: + 50:df:ca:1c:01:bc:1d:04:19:7b:10:76:97:3b:ee:90:90:ca: + c4:0e:1f:16:6e:75:ef:33:f8:d3:6f:5b:1e:96:e3:e0:74:77: + 74:7b:8a:a2:6e:2d:dd:76:d6:39:30:82:f0:ab:9c:52:f2:2a: + c7:af:49:5e:7e:c7:68:e5:82:81:c8:6a:27:f9:27:88:2a:d5: + 58:50:95:1f:f0:3b:1c:57:bb:7d:14:39:62:2b:9a:c9:94:92: + 2a:a3:22:0c:ff:89:26:7d:5f:23:2b:47:d7:15:1d:a9:6a:9e: + 51:0d:2a:51:9e:81:f9:d4:3b:5e:70:12:7f:10:32:9c:1e:bb: + 9d:f8:66:a8 +MD5 Fingerprint=4C:56:41:E5:0D:BB:2B:E8:CA:A3:ED:18:08:AD:43:39 +-----BEGIN CERTIFICATE----- +MIIEdDCCA1ygAwIBAgIQRL4Mi1AAJLQR0zYq/mUK/TANBgkqhkiG9w0BAQUFADCB +lzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug +Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho +dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xHzAdBgNVBAMTFlVUTi1VU0VSRmlyc3Qt +SGFyZHdhcmUwHhcNOTkwNzA5MTgxMDQyWhcNMTkwNzA5MTgxOTIyWjCBlzELMAkG +A1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEe +MBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExhodHRwOi8v +d3d3LnVzZXJ0cnVzdC5jb20xHzAdBgNVBAMTFlVUTi1VU0VSRmlyc3QtSGFyZHdh +cmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCx98M4P7Sof885glFn +0G2f0v9Y8+efK+wNiVSZuTiZFvfgIXlIwrthdBKWHTxqctU8EGc6Oe0rE81m65UJ +M6Rsl7HoxuzBdXmcRl6Nq9Bq/bkqVRcQVLMZ8Jr28bFdtqdt++BxF2uiiPsA3/4a +MXcMmgF6sTLjKwEHOG7DpV4jvEWbe1DByTCP2+UretNb+zNAHqDVmBe8i4fDidNd +oI6yqqr2jmmIBsX6iSHzCJ1pLgkzmykNRg+MzEk0sGlRvfkGzWitZky8PqxhvQqI +DsjfPe58BEydCl5rkdbux+0ojatNh4lz0G6k0B4WixThdkQDf2Os5M1JnMWS9Ksy +oUhbAgMBAAGjgbkwgbYwCwYDVR0PBAQDAgHGMA8GA1UdEwEB/wQFMAMBAf8wHQYD +VR0OBBYEFKFyXyYbKJhDlV0HN9WFlp1L0sNFMEQGA1UdHwQ9MDswOaA3oDWGM2h0 +dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VVE4tVVNFUkZpcnN0LUhhcmR3YXJlLmNy +bDAxBgNVHSUEKjAoBggrBgEFBQcDAQYIKwYBBQUHAwUGCCsGAQUFBwMGBggrBgEF +BQcDBzANBgkqhkiG9w0BAQUFAAOCAQEARxkP3nTGmZev/K0oXnWO6y1n7k57K9cM +//bey1WiCuFMVGWTYGufEpytXoMs61quwOQt9ABjHbjAbPLPSbtNk28Gpgoiskli +CE7/yMgUsogWXecB5BKV5UU0s4tpvc+0hY91UZ59Ojg6FEgSxvunOxqNDYJAB+gE +CJChicsZUN/KHAG8HQQZexB2lzvukJDKxA4fFm517zP4029bHpbj4HR3dHuKom4t +3XbWOTCC8KucUvIqx69JXn7HaOWCgchqJ/kniCrVWFCVH/A7HFe7fRQ5YiuayZSS +KqMiDP+JJn1fIytH1xUdqWqeUQ0qUZ6B+dQ7XnASfxAynB67nfhmqA== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object + Validity + Not Before: Jul 9 18:31:20 1999 GMT + Not After : Jul 9 18:40:36 2019 GMT + Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:ce:aa:81:3f:a3:a3:61:78:aa:31:00:55:95:11: + 9e:27:0f:1f:1c:df:3a:9b:82:68:30:c0:4a:61:1d: + f1:2f:0e:fa:be:79:f7:a5:23:ef:55:51:96:84:cd: + db:e3:b9:6e:3e:31:d8:0a:20:67:c7:f4:d9:bf:94: + eb:47:04:3e:02:ce:2a:a2:5d:87:04:09:f6:30:9d: + 18:8a:97:b2:aa:1c:fc:41:d2:a1:36:cb:fb:3d:91: + ba:e7:d9:70:35:fa:e4:e7:90:c3:9b:a3:9b:d3:3c: + f5:12:99:77:b1:b7:09:e0:68:e6:1c:b8:f3:94:63: + 88:6a:6a:fe:0b:76:c9:be:f4:22:e4:67:b9:ab:1a: + 5e:77:c1:85:07:dd:0d:6c:bf:ee:06:c7:77:6a:41: + 9e:a7:0f:d7:fb:ee:94:17:b7:fc:85:be:a4:ab:c4: + 1c:31:dd:d7:b6:d1:e4:f0:ef:df:16:8f:b2:52:93: + d7:a1:d4:89:a1:07:2e:bf:e1:01:12:42:1e:1a:e1: + d8:95:34:db:64:79:28:ff:ba:2e:11:c2:e5:e8:5b: + 92:48:fb:47:0b:c2:6c:da:ad:32:83:41:f3:a5:e5: + 41:70:fd:65:90:6d:fa:fa:51:c4:f9:bd:96:2b:19: + 04:2c:d3:6d:a7:dc:f0:7f:6f:83:65:e2:6a:ab:87: + 86:75 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Key Usage: + Digital Signature, Non Repudiation, Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + DA:ED:64:74:14:9C:14:3C:AB:DD:99:A9:BD:5B:28:4D:8B:3C:C9:D8 + X509v3 CRL Distribution Points: + URI:http://crl.usertrust.com/UTN-USERFirst-Object.crl + + X509v3 Extended Key Usage: + Code Signing, Time Stamping, Microsoft Encrypted File System + Signature Algorithm: sha1WithRSAEncryption + 08:1f:52:b1:37:44:78:db:fd:ce:b9:da:95:96:98:aa:55:64: + 80:b5:5a:40:dd:21:a5:c5:c1:f3:5f:2c:4c:c8:47:5a:69:ea: + e8:f0:35:35:f4:d0:25:f3:c8:a6:a4:87:4a:bd:1b:b1:73:08: + bd:d4:c3:ca:b6:35:bb:59:86:77:31:cd:a7:80:14:ae:13:ef: + fc:b1:48:f9:6b:25:25:2d:51:b6:2c:6d:45:c1:98:c8:8a:56: + 5d:3e:ee:43:4e:3e:6b:27:8e:d0:3a:4b:85:0b:5f:d3:ed:6a: + a7:75:cb:d1:5a:87:2f:39:75:13:5a:72:b0:02:81:9f:be:f0: + 0f:84:54:20:62:6c:69:d4:e1:4d:c6:0d:99:43:01:0d:12:96: + 8c:78:9d:bf:50:a2:b1:44:aa:6a:cf:17:7a:cf:6f:0f:d4:f8: + 24:55:5f:f0:34:16:49:66:3e:50:46:c9:63:71:38:31:62:b8: + 62:b9:f3:53:ad:6c:b5:2b:a2:12:aa:19:4f:09:da:5e:e7:93: + c6:8e:14:08:fe:f0:30:80:18:a0:86:85:4d:c8:7d:d7:8b:03: + fe:6e:d5:f7:9d:16:ac:92:2c:a0:23:e5:9c:91:52:1f:94:df: + 17:94:73:c3:b3:c1:c1:71:05:20:00:78:bd:13:52:1d:a8:3e: + cd:00:1f:c8 +MD5 Fingerprint=A7:F2:E4:16:06:41:11:50:30:6B:9C:E3:B4:9C:B0:C9 +-----BEGIN CERTIFICATE----- +MIIEZjCCA06gAwIBAgIQRL4Mi1AAJLQR0zYt4LNfGzANBgkqhkiG9w0BAQUFADCB +lTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug +Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho +dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xHTAbBgNVBAMTFFVUTi1VU0VSRmlyc3Qt +T2JqZWN0MB4XDTk5MDcwOTE4MzEyMFoXDTE5MDcwOTE4NDAzNlowgZUxCzAJBgNV +BAYTAlVTMQswCQYDVQQIEwJVVDEXMBUGA1UEBxMOU2FsdCBMYWtlIENpdHkxHjAc +BgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEhMB8GA1UECxMYaHR0cDovL3d3 +dy51c2VydHJ1c3QuY29tMR0wGwYDVQQDExRVVE4tVVNFUkZpcnN0LU9iamVjdDCC +ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM6qgT+jo2F4qjEAVZURnicP +HxzfOpuCaDDASmEd8S8O+r5596Uj71VRloTN2+O5bj4x2AogZ8f02b+U60cEPgLO +KqJdhwQJ9jCdGIqXsqoc/EHSoTbL+z2RuufZcDX65OeQw5ujm9M89RKZd7G3CeBo +5hy485RjiGpq/gt2yb70IuRnuasaXnfBhQfdDWy/7gbHd2pBnqcP1/vulBe3/IW+ +pKvEHDHd17bR5PDv3xaPslKT16HUiaEHLr/hARJCHhrh2JU022R5KP+6LhHC5ehb +kkj7RwvCbNqtMoNB86XlQXD9ZZBt+vpRxPm9lisZBCzTbafc8H9vg2XiaquHhnUC +AwEAAaOBrzCBrDALBgNVHQ8EBAMCAcYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E +FgQU2u1kdBScFDyr3ZmpvVsoTYs8ydgwQgYDVR0fBDswOTA3oDWgM4YxaHR0cDov +L2NybC51c2VydHJ1c3QuY29tL1VUTi1VU0VSRmlyc3QtT2JqZWN0LmNybDApBgNV +HSUEIjAgBggrBgEFBQcDAwYIKwYBBQUHAwgGCisGAQQBgjcKAwQwDQYJKoZIhvcN +AQEFBQADggEBAAgfUrE3RHjb/c652pWWmKpVZIC1WkDdIaXFwfNfLEzIR1pp6ujw +NTX00CXzyKakh0q9G7FzCL3Uw8q2NbtZhncxzaeAFK4T7/yxSPlrJSUtUbYsbUXB +mMiKVl0+7kNOPmsnjtA6S4ULX9Ptaqd1y9Fahy85dRNacrACgZ++8A+EVCBibGnU +4U3GDZlDAQ0Slox4nb9QorFEqmrPF3rPbw/U+CRVX/A0FklmPlBGyWNxODFiuGK5 +81OtbLUrohKqGU8J2l7nk8aOFAj+8DCAGKCGhU3IfdeLA/5u1fedFqySLKAj5ZyR +Uh+U3xeUc8OzwcFxBSAAeL0TUh2oPs0AH8g= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org, CN=Chambers of Commerce Root + Validity + Not Before: Sep 30 16:13:43 2003 GMT + Not After : Sep 30 16:13:44 2037 GMT + Subject: C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org, CN=Chambers of Commerce Root + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:b7:36:55:e5:a5:5d:18:30:e0:da:89:54:91:fc: + c8:c7:52:f8:2f:50:d9:ef:b1:75:73:65:47:7d:1b: + 5b:ba:75:c5:fc:a1:88:24:fa:2f:ed:ca:08:4a:39: + 54:c4:51:7a:b5:da:60:ea:38:3c:81:b2:cb:f1:bb: + d9:91:23:3f:48:01:70:75:a9:05:2a:ad:1f:71:f3: + c9:54:3d:1d:06:6a:40:3e:b3:0c:85:ee:5c:1b:79: + c2:62:c4:b8:36:8e:35:5d:01:0c:23:04:47:35:aa: + 9b:60:4e:a0:66:3d:cb:26:0a:9c:40:a1:f4:5d:98: + bf:71:ab:a5:00:68:2a:ed:83:7a:0f:a2:14:b5:d4: + 22:b3:80:b0:3c:0c:5a:51:69:2d:58:18:8f:ed:99: + 9e:f1:ae:e2:95:e6:f6:47:a8:d6:0c:0f:b0:58:58: + db:c3:66:37:9e:9b:91:54:33:37:d2:94:1c:6a:48: + c9:c9:f2:a5:da:a5:0c:23:f7:23:0e:9c:32:55:5e: + 71:9c:84:05:51:9a:2d:fd:e6:4e:2a:34:5a:de:ca: + 40:37:67:0c:54:21:55:77:da:0a:0c:cc:97:ae:80: + dc:94:36:4a:f4:3e:ce:36:13:1e:53:e4:ac:4e:3a: + 05:ec:db:ae:72:9c:38:8b:d0:39:3b:89:0a:3e:77: + fe:75 + Exponent: 3 (0x3) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE, pathlen:12 + X509v3 CRL Distribution Points: + URI:http://crl.chambersign.org/chambersroot.crl + + X509v3 Subject Key Identifier: + E3:94:F5:B1:4D:E9:DB:A1:29:5B:57:8B:4D:76:06:76:E1:D1:A2:8A + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 Subject Alternative Name: + email:chambersroot@chambersign.org + X509v3 Issuer Alternative Name: + email:chambersroot@chambersign.org + X509v3 Certificate Policies: + Policy: 1.3.6.1.4.1.17326.10.3.1 + CPS: http://cps.chambersign.org/cps/chambersroot.html + + Signature Algorithm: sha1WithRSAEncryption + 0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef: + 13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90: + 01:72:93:e7:1e:7d:5f:f6:89:c6:5d:a7:40:09:3d:ac:49:45: + 45:dc:2e:8d:30:68:b2:09:ba:fb:c3:2f:cc:ba:0b:df:3f:77: + 7b:46:7d:3a:12:24:8e:96:8f:3c:05:0a:6f:d2:94:28:1d:6d: + 0c:c0:2e:88:22:d5:d8:cf:1d:13:c7:f0:48:d7:d7:05:a7:cf: + c7:47:9e:3b:3c:34:c8:80:4f:d4:14:bb:fc:0d:50:f7:fa:b3: + ec:42:5f:a9:dd:6d:c8:f4:75:cf:7b:c1:72:26:b1:01:1c:5c: + 2c:fd:7a:4e:b4:01:c5:05:57:b9:e7:3c:aa:05:d9:88:e9:07: + 46:41:ce:ef:41:81:ae:58:df:83:a2:ae:ca:d7:77:1f:e7:00: + 3c:9d:6f:8e:e4:32:09:1d:4d:78:34:78:34:3c:94:9b:26:ed: + 4f:71:c6:19:7a:bd:20:22:48:5a:fe:4b:7d:03:b7:e7:58:be: + c6:32:4e:74:1e:68:dd:a8:68:5b:b3:3e:ee:62:7d:d9:80:e8: + 0a:75:7a:b7:ee:b4:65:9a:21:90:e0:aa:d0:98:bc:38:b5:73: + 3c:8b:f8:dc +MD5 Fingerprint=B0:01:EE:14:D9:AF:29:18:94:76:8E:F1:69:33:2A:84 +-----BEGIN CERTIFICATE----- +MIIEvTCCA6WgAwIBAgIBADANBgkqhkiG9w0BAQUFADB/MQswCQYDVQQGEwJFVTEn +MCUGA1UEChMeQUMgQ2FtZXJmaXJtYSBTQSBDSUYgQTgyNzQzMjg3MSMwIQYDVQQL +ExpodHRwOi8vd3d3LmNoYW1iZXJzaWduLm9yZzEiMCAGA1UEAxMZQ2hhbWJlcnMg +b2YgQ29tbWVyY2UgUm9vdDAeFw0wMzA5MzAxNjEzNDNaFw0zNzA5MzAxNjEzNDRa +MH8xCzAJBgNVBAYTAkVVMScwJQYDVQQKEx5BQyBDYW1lcmZpcm1hIFNBIENJRiBB +ODI3NDMyODcxIzAhBgNVBAsTGmh0dHA6Ly93d3cuY2hhbWJlcnNpZ24ub3JnMSIw +IAYDVQQDExlDaGFtYmVycyBvZiBDb21tZXJjZSBSb290MIIBIDANBgkqhkiG9w0B +AQEFAAOCAQ0AMIIBCAKCAQEAtzZV5aVdGDDg2olUkfzIx1L4L1DZ77F1c2VHfRtb +unXF/KGIJPov7coISjlUxFF6tdpg6jg8gbLL8bvZkSM/SAFwdakFKq0fcfPJVD0d +BmpAPrMMhe5cG3nCYsS4No41XQEMIwRHNaqbYE6gZj3LJgqcQKH0XZi/caulAGgq +7YN6D6IUtdQis4CwPAxaUWktWBiP7Zme8a7ileb2R6jWDA+wWFjbw2Y3npuRVDM3 +0pQcakjJyfKl2qUMI/cjDpwyVV5xnIQFUZot/eZOKjRa3spAN2cMVCFVd9oKDMyX +roDclDZK9D7ONhMeU+SsTjoF7Nuucpw4i9A5O4kKPnf+dQIBA6OCAUQwggFAMBIG +A1UdEwEB/wQIMAYBAf8CAQwwPAYDVR0fBDUwMzAxoC+gLYYraHR0cDovL2NybC5j +aGFtYmVyc2lnbi5vcmcvY2hhbWJlcnNyb290LmNybDAdBgNVHQ4EFgQU45T1sU3p +26EpW1eLTXYGduHRooowDgYDVR0PAQH/BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIA +BzAnBgNVHREEIDAegRxjaGFtYmVyc3Jvb3RAY2hhbWJlcnNpZ24ub3JnMCcGA1Ud +EgQgMB6BHGNoYW1iZXJzcm9vdEBjaGFtYmVyc2lnbi5vcmcwWAYDVR0gBFEwTzBN +BgsrBgEEAYGHLgoDATA+MDwGCCsGAQUFBwIBFjBodHRwOi8vY3BzLmNoYW1iZXJz +aWduLm9yZy9jcHMvY2hhbWJlcnNyb290Lmh0bWwwDQYJKoZIhvcNAQEFBQADggEB +AAxBl8IahsAifJ/7kPMa0QOx7xP5IV8EnNrJpY0nbJaHkb5BkAFyk+cefV/2icZd +p0AJPaxJRUXcLo0waLIJuvvDL8y6C98/d3tGfToSJI6WjzwFCm/SlCgdbQzALogi +1djPHRPH8EjX1wWnz8dHnjs8NMiAT9QUu/wNUPf6s+xCX6ndbcj0dc97wXImsQEc +XCz9ek60AcUFV7nnPKoF2YjpB0ZBzu9Bga5Y34OirsrXdx/nADydb47kMgkdTXg0 +eDQ8lJsm7U9xxhl6vSAiSFr+S30Dt+dYvsYyTnQeaN2oaFuzPu5ifdmA6Ap1erfu +tGWaIZDgqtCYvDi1czyL+Nw= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org, CN=Global Chambersign Root + Validity + Not Before: Sep 30 16:14:18 2003 GMT + Not After : Sep 30 16:14:18 2037 GMT + Subject: C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org, CN=Global Chambersign Root + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:a2:70:a2:d0:9f:42:ae:5b:17:c7:d8:7d:cf:14: + 83:fc:4f:c9:a1:b7:13:af:8a:d7:9e:3e:04:0a:92: + 8b:60:56:fa:b4:32:2f:88:4d:a1:60:08:f4:b7:09: + 4e:a0:49:2f:49:d6:d3:df:9d:97:5a:9f:94:04:70: + ec:3f:59:d9:b7:cc:66:8b:98:52:28:09:02:df:c5: + 2f:84:8d:7a:97:77:bf:ec:40:9d:25:72:ab:b5:3f: + 32:98:fb:b7:b7:fc:72:84:e5:35:87:f9:55:fa:a3: + 1f:0e:6f:2e:28:dd:69:a0:d9:42:10:c6:f8:b5:44: + c2:d0:43:7f:db:bc:e4:a2:3c:6a:55:78:0a:77:a9: + d8:ea:19:32:b7:2f:fe:5c:3f:1b:ee:b1:98:ec:ca: + ad:7a:69:45:e3:96:0f:55:f6:e6:ed:75:ea:65:e8: + 32:56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07: + d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d: + 04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6: + 0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12: + a5:a1:cf:48:50:a5:ef:d2:c8:1a:13:fa:b0:7f:b1: + 82:1c:77:6a:0f:5f:dc:0b:95:8f:ef:43:7e:e6:45: + 09:25 + Exponent: 3 (0x3) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE, pathlen:12 + X509v3 CRL Distribution Points: + URI:http://crl.chambersign.org/chambersignroot.crl + + X509v3 Subject Key Identifier: + 43:9C:36:9F:B0:9E:30:4D:C6:CE:5F:AD:10:AB:E5:03:A5:FA:A9:14 + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + X509v3 Subject Alternative Name: + email:chambersignroot@chambersign.org + X509v3 Issuer Alternative Name: + email:chambersignroot@chambersign.org + X509v3 Certificate Policies: + Policy: 1.3.6.1.4.1.17326.10.1.1 + CPS: http://cps.chambersign.org/cps/chambersignroot.html + + Signature Algorithm: sha1WithRSAEncryption + 3c:3b:70:91:f9:04:54:27:91:e1:ed:ed:fe:68:7f:61:5d:e5: + 41:65:4f:32:f1:18:05:94:6a:1c:de:1f:70:db:3e:7b:32:02: + 34:b5:0c:6c:a1:8a:7c:a5:f4:8f:ff:d4:d8:ad:17:d5:2d:04: + d1:3f:58:80:e2:81:59:88:be:c0:e3:46:93:24:fe:90:bd:26: + a2:30:2d:e8:97:26:57:35:89:74:96:18:f6:15:e2:af:24:19: + 56:02:02:b2:ba:0f:14:ea:c6:8a:66:c1:86:45:55:8b:be:92: + be:9c:a4:04:c7:49:3c:9e:e8:29:7a:89:d7:fe:af:ff:68:f5: + a5:17:90:bd:ac:99:cc:a5:86:57:09:67:46:db:d6:16:c2:46: + f1:e4:a9:50:f5:8f:d1:92:15:d3:5f:3e:c6:00:49:3a:6e:58: + b2:d1:d1:27:0d:25:c8:32:f8:20:11:cd:7d:32:33:48:94:54: + 4c:dd:dc:79:c4:30:9f:eb:8e:b8:55:b5:d7:88:5c:c5:6a:24: + 3d:b2:d3:05:03:51:c6:07:ef:cc:14:72:74:3d:6e:72:ce:18: + 28:8c:4a:a0:77:e5:09:2b:45:44:47:ac:b7:67:7f:01:8a:05: + 5a:93:be:a1:c1:ff:f8:e7:0e:67:a4:47:49:76:5d:75:90:1a: + f5:26:8f:f0 +MD5 Fingerprint=C5:E6:7B:BF:06:D0:4F:43:ED:C4:7A:65:8A:FB:6B:19 +-----BEGIN CERTIFICATE----- +MIIExTCCA62gAwIBAgIBADANBgkqhkiG9w0BAQUFADB9MQswCQYDVQQGEwJFVTEn +MCUGA1UEChMeQUMgQ2FtZXJmaXJtYSBTQSBDSUYgQTgyNzQzMjg3MSMwIQYDVQQL +ExpodHRwOi8vd3d3LmNoYW1iZXJzaWduLm9yZzEgMB4GA1UEAxMXR2xvYmFsIENo +YW1iZXJzaWduIFJvb3QwHhcNMDMwOTMwMTYxNDE4WhcNMzcwOTMwMTYxNDE4WjB9 +MQswCQYDVQQGEwJFVTEnMCUGA1UEChMeQUMgQ2FtZXJmaXJtYSBTQSBDSUYgQTgy +NzQzMjg3MSMwIQYDVQQLExpodHRwOi8vd3d3LmNoYW1iZXJzaWduLm9yZzEgMB4G +A1UEAxMXR2xvYmFsIENoYW1iZXJzaWduIFJvb3QwggEgMA0GCSqGSIb3DQEBAQUA +A4IBDQAwggEIAoIBAQCicKLQn0KuWxfH2H3PFIP8T8mhtxOviteePgQKkotgVvq0 +Mi+ITaFgCPS3CU6gSS9J1tPfnZdan5QEcOw/Wdm3zGaLmFIoCQLfxS+EjXqXd7/s +QJ0lcqu1PzKY+7e3/HKE5TWH+VX6ox8Oby4o3Wmg2UIQxvi1RMLQQ3/bvOSiPGpV +eAp3qdjqGTK3L/5cPxvusZjsyq16aUXjlg9V9ubtdepl6DJWk0aJqCWKZQbua795 +B9Dxt6/tLE2Su8CoX6dnfQTyFQhwrJLWfQTSM/tMtgsL+xrJxI0DqX5c8lCrEqWh +z0hQpe/SyBoT+rB/sYIcd2oPX9wLlY/vQ37mRQklAgEDo4IBUDCCAUwwEgYDVR0T +AQH/BAgwBgEB/wIBDDA/BgNVHR8EODA2MDSgMqAwhi5odHRwOi8vY3JsLmNoYW1i +ZXJzaWduLm9yZy9jaGFtYmVyc2lnbnJvb3QuY3JsMB0GA1UdDgQWBBRDnDafsJ4w +TcbOX60Qq+UDpfqpFDAOBgNVHQ8BAf8EBAMCAQYwEQYJYIZIAYb4QgEBBAQDAgAH +MCoGA1UdEQQjMCGBH2NoYW1iZXJzaWducm9vdEBjaGFtYmVyc2lnbi5vcmcwKgYD +VR0SBCMwIYEfY2hhbWJlcnNpZ25yb290QGNoYW1iZXJzaWduLm9yZzBbBgNVHSAE +VDBSMFAGCysGAQQBgYcuCgEBMEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly9jcHMuY2hh +bWJlcnNpZ24ub3JnL2Nwcy9jaGFtYmVyc2lnbnJvb3QuaHRtbDANBgkqhkiG9w0B +AQUFAAOCAQEAPDtwkfkEVCeR4e3t/mh/YV3lQWVPMvEYBZRqHN4fcNs+ezICNLUM +bKGKfKX0j//U2K0X1S0E0T9YgOKBWYi+wONGkyT+kL0mojAt6JcmVzWJdJYY9hXi +ryQZVgICsroPFOrGimbBhkVVi76SvpykBMdJPJ7oKXqJ1/6v/2j1pReQvayZzKWG +VwlnRtvWFsJG8eSpUPWP0ZIV018+xgBJOm5YstHRJw0lyDL4IBHNfTIzSJRUTN3c +ecQwn+uOuFW114hcxWokPbLTBQNRxgfvzBRydD1ucs4YKIxKoHflCStFREest2d/ +AYoFWpO+ocH/+OcOZ6RHSXZddZAa9SaP8A== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 123 (0x7b) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=HU, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado/emailAddress=info@netlock.hu + Validity + Not Before: Mar 30 01:47:11 2003 GMT + Not After : Dec 15 01:47:11 2022 GMT + Subject: C=HU, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado/emailAddress=info@netlock.hu + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:c7:52:25:b2:d8:3d:d4:84:55:09:a7:1b:bd:6c: + b9:14:f4:8a:02:db:76:fc:6a:2a:78:ab:e5:77:f0: + 6e:e0:8c:23:67:db:a5:64:99:b9:dd:01:3e:6f:ef: + 2d:9a:3c:22:f0:5d:c9:57:a0:55:41:7f:f2:43:5e: + 58:82:53:31:65:ce:1e:f2:26:ba:00:54:1e:af:b0: + bc:1c:e4:52:8c:a0:32:af:b7:37:b1:53:67:68:74: + 67:50:f6:2d:2e:64:de:ae:26:79:df:df:99:86:ab: + ab:7f:85:ec:a0:fb:80:cc:f4:b8:0c:1e:93:45:63: + b9:dc:b8:5b:9b:ed:5b:39:d4:5f:62:b0:a7:8e:7c: + 66:38:2c:aa:b1:08:63:17:67:7d:cc:bd:b3:f1:c3: + 3f:cf:50:39:ed:d1:19:83:15:db:87:12:27:96:b7: + da:ea:e5:9d:bc:ba:ea:39:4f:8b:ef:74:9a:e7:c5: + d0:d2:ea:86:51:1c:e4:fe:64:08:28:04:79:05:eb: + ca:c5:71:0e:0b:ef:ab:ea:ec:12:11:a1:18:05:32: + 69:d1:0c:2c:1a:3d:25:99:3f:b5:7c:ca:6d:b0:ae: + 99:99:fa:08:60:e7:19:c2:f2:bd:51:d3:cc:d3:02: + ac:c1:11:0c:80:ce:ab:dc:94:9d:6b:a3:39:53:3a: + d6:85 + Exponent: 50557 (0xc57d) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE, pathlen:4 + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + Netscape Comment: + FIGYELEM! Ezen tanusitvany a NetLock Kft. Minositett Szolgaltatasi Szabalyzataban leirt eljarasok alapjan keszult. A minositett elektronikus alairas joghatas ervenyesulesenek, valamint elfogadasanak feltetele a Minositett Szolgaltatasi Szabalyzatban, az Altalanos Szerzodesi Feltetelekben eloirt ellenorzesi eljaras megtetele. A dokumentumok megtalalhatok a https://www.netlock.hu/docs/ cimen vagy kerhetok az info@netlock.net e-mail cimen. WARNING! The issuance and the use of this certificate are subject to the NetLock Qualified CPS available at https://www.netlock.hu/docs/ or by e-mail at info@netlock.net + X509v3 Subject Key Identifier: + 09:6A:62:16:92:B0:5A:BB:55:0E:CB:75:32:3A:32:E5:B2:21:C9:28 + Signature Algorithm: sha1WithRSAEncryption + 91:6a:50:9c:db:78:81:9b:3f:8b:42:e3:3b:fc:a6:c3:ee:43: + e0:cf:f3:e2:80:35:49:45:76:02:e2:e3:2f:05:c5:f1:2a:e7: + c0:41:33:c6:b6:9b:d0:33:39:cd:c0:db:a1:ad:6c:37:02:4c: + 58:41:3b:f2:97:92:c6:48:a8:cd:e5:8a:39:89:61:f9:52:97: + e9:bd:f6:f9:94:74:e8:71:0e:bc:77:86:c3:06:cc:5a:7c:4a: + 7e:34:50:30:2e:fb:7f:32:9a:8d:3d:f3:20:5b:f8:6a:ca:86: + f3:31:4c:2c:59:80:02:7d:fe:38:c9:30:75:1c:b7:55:e3:bc: + 9f:ba:a8:6d:84:28:05:75:b3:8b:0d:c0:91:54:21:e7:a6:0b: + b4:99:f5:51:41:dc:cd:a3:47:22:d9:c7:01:81:c4:dc:47:4f: + 26:ea:1f:ed:db:cd:0d:98:f4:a3:9c:b4:73:32:4a:96:99:fe: + bc:7f:c8:25:58:f8:58:f3:76:66:89:54:a4:a6:3e:c4:50:5c: + ba:89:18:82:75:48:21:d2:4f:13:e8:60:7e:07:76:db:10:b5: + 51:e6:aa:b9:68:aa:cd:f6:9d:90:75:12:ea:38:1a:ca:44:e8: + b7:99:a7:2a:68:95:66:95:ab:ad:ef:89:cb:60:a9:06:12:c6: + 94:47:e9:28 +MD5 Fingerprint=D4:80:65:68:24:F9:89:22:28:DB:F5:A4:9A:17:8F:14 +-----BEGIN CERTIFICATE----- +MIIG0TCCBbmgAwIBAgIBezANBgkqhkiG9w0BAQUFADCByTELMAkGA1UEBhMCSFUx +ETAPBgNVBAcTCEJ1ZGFwZXN0MScwJQYDVQQKEx5OZXRMb2NrIEhhbG96YXRiaXp0 +b25zYWdpIEtmdC4xGjAYBgNVBAsTEVRhbnVzaXR2YW55a2lhZG9rMUIwQAYDVQQD +EzlOZXRMb2NrIE1pbm9zaXRldHQgS296amVneXpvaSAoQ2xhc3MgUUEpIFRhbnVz +aXR2YW55a2lhZG8xHjAcBgkqhkiG9w0BCQEWD2luZm9AbmV0bG9jay5odTAeFw0w +MzAzMzAwMTQ3MTFaFw0yMjEyMTUwMTQ3MTFaMIHJMQswCQYDVQQGEwJIVTERMA8G +A1UEBxMIQnVkYXBlc3QxJzAlBgNVBAoTHk5ldExvY2sgSGFsb3phdGJpenRvbnNh +Z2kgS2Z0LjEaMBgGA1UECxMRVGFudXNpdHZhbnlraWFkb2sxQjBABgNVBAMTOU5l +dExvY2sgTWlub3NpdGV0dCBLb3pqZWd5em9pIChDbGFzcyBRQSkgVGFudXNpdHZh +bnlraWFkbzEeMBwGCSqGSIb3DQEJARYPaW5mb0BuZXRsb2NrLmh1MIIBIjANBgkq +hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx1Ilstg91IRVCacbvWy5FPSKAtt2/Goq +eKvld/Bu4IwjZ9ulZJm53QE+b+8tmjwi8F3JV6BVQX/yQ15YglMxZc4e8ia6AFQe +r7C8HORSjKAyr7c3sVNnaHRnUPYtLmTeriZ539+Zhqurf4XsoPuAzPS4DB6TRWO5 +3Lhbm+1bOdRfYrCnjnxmOCyqsQhjF2d9zL2z8cM/z1A57dEZgxXbhxInlrfa6uWd +vLrqOU+L73Sa58XQ0uqGURzk/mQIKAR5BevKxXEOC++r6uwSEaEYBTJp0QwsGj0l +mT+1fMptsK6ZmfoIYOcZwvK9UdPM0wKswREMgM6r3JSda6M5UzrWhQIDAMV9o4IC +wDCCArwwEgYDVR0TAQH/BAgwBgEB/wIBBDAOBgNVHQ8BAf8EBAMCAQYwggJ1Bglg +hkgBhvhCAQ0EggJmFoICYkZJR1lFTEVNISBFemVuIHRhbnVzaXR2YW55IGEgTmV0 +TG9jayBLZnQuIE1pbm9zaXRldHQgU3pvbGdhbHRhdGFzaSBTemFiYWx5emF0YWJh +biBsZWlydCBlbGphcmFzb2sgYWxhcGphbiBrZXN6dWx0LiBBIG1pbm9zaXRldHQg +ZWxla3Ryb25pa3VzIGFsYWlyYXMgam9naGF0YXMgZXJ2ZW55ZXN1bGVzZW5laywg +dmFsYW1pbnQgZWxmb2dhZGFzYW5hayBmZWx0ZXRlbGUgYSBNaW5vc2l0ZXR0IFN6 +b2xnYWx0YXRhc2kgU3phYmFseXphdGJhbiwgYXogQWx0YWxhbm9zIFN6ZXJ6b2Rl +c2kgRmVsdGV0ZWxla2JlbiBlbG9pcnQgZWxsZW5vcnplc2kgZWxqYXJhcyBtZWd0 +ZXRlbGUuIEEgZG9rdW1lbnR1bW9rIG1lZ3RhbGFsaGF0b2sgYSBodHRwczovL3d3 +dy5uZXRsb2NrLmh1L2RvY3MvIGNpbWVuIHZhZ3kga2VyaGV0b2sgYXogaW5mb0Bu +ZXRsb2NrLm5ldCBlLW1haWwgY2ltZW4uIFdBUk5JTkchIFRoZSBpc3N1YW5jZSBh +bmQgdGhlIHVzZSBvZiB0aGlzIGNlcnRpZmljYXRlIGFyZSBzdWJqZWN0IHRvIHRo +ZSBOZXRMb2NrIFF1YWxpZmllZCBDUFMgYXZhaWxhYmxlIGF0IGh0dHBzOi8vd3d3 +Lm5ldGxvY2suaHUvZG9jcy8gb3IgYnkgZS1tYWlsIGF0IGluZm9AbmV0bG9jay5u +ZXQwHQYDVR0OBBYEFAlqYhaSsFq7VQ7LdTI6MuWyIckoMA0GCSqGSIb3DQEBBQUA +A4IBAQCRalCc23iBmz+LQuM7/KbD7kPgz/PigDVJRXYC4uMvBcXxKufAQTPGtpvQ +MznNwNuhrWw3AkxYQTvyl5LGSKjN5Yo5iWH5Upfpvfb5lHTocQ68d4bDBsxafEp+ +NFAwLvt/MpqNPfMgW/hqyobzMUwsWYACff44yTB1HLdV47yfuqhthCgFdbOLDcCR +VCHnpgu0mfVRQdzNo0ci2ccBgcTcR08m6h/t280NmPSjnLRzMkqWmf68f8glWPhY +83ZmiVSkpj7EUFy6iRiCdUgh0k8T6GB+B3bbELVR5qq5aKrN9p2QdRLqOBrKROi3 +macqaJVmlaut74nLYKkGEsaUR+ko +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 259 (0x103) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=HU, ST=Hungary, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Kozjegyzoi (Class A) Tanusitvanykiado + Validity + Not Before: Feb 24 23:14:47 1999 GMT + Not After : Feb 19 23:14:47 2019 GMT + Subject: C=HU, ST=Hungary, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Kozjegyzoi (Class A) Tanusitvanykiado + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:bc:74:8c:0f:bb:4c:f4:37:1e:a9:05:82:d8:e6: + e1:6c:70:ea:78:b5:6e:d1:38:44:0d:a8:83:ce:5d: + d2:d6:d5:81:c5:d4:4b:e7:5b:94:70:26:db:3b:9d: + 6a:4c:62:f7:71:f3:64:d6:61:3b:3d:eb:73:a3:37: + d9:cf:ea:8c:92:3b:cd:f7:07:dc:66:74:97:f4:45: + 22:dd:f4:5c:e0:bf:6d:f3:be:65:33:e4:15:3a:bf: + db:98:90:55:38:c4:ed:a6:55:63:0b:b0:78:04:f4: + e3:6e:c1:3f:8e:fc:51:78:1f:92:9e:83:c2:fe:d9: + b0:a9:c9:bc:5a:00:ff:a9:a8:98:74:fb:f6:2c:3e: + 15:39:0d:b6:04:55:a8:0e:98:20:42:b3:b1:25:ad: + 7e:9a:6f:5d:53:b1:ab:0c:fc:eb:e0:f3:7a:b3:a8: + b3:ff:46:f6:63:a2:d8:3a:98:7b:b6:ac:85:ff:b0: + 25:4f:74:63:e7:13:07:a5:0a:8f:05:f7:c0:64:6f: + 7e:a7:27:80:96:de:d4:2e:86:60:c7:6b:2b:5e:73: + 7b:17:e7:91:3f:64:0c:d8:4b:22:34:2b:9b:32:f2: + 48:1f:9f:a1:0a:84:7a:e2:c2:ad:97:3d:8e:d5:c1: + f9:56:a3:50:e9:c6:b4:fa:98:a2:ee:95:e6:2a:03: + 8c:df + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE, pathlen:4 + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + Netscape Comment: + FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztositasa vedi. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! The issuance and the use of this certificate is subject to the NetLock CPS available at https://www.netlock.net/docs or by e-mail at cps@netlock.net. + Signature Algorithm: md5WithRSAEncryption + 48:24:46:f7:ba:56:6f:fa:c8:28:03:40:4e:e5:31:39:6b:26: + 6b:53:7f:db:df:df:f3:71:3d:26:c0:14:0e:c6:67:7b:23:a8: + 0c:73:dd:01:bb:c6:ca:6e:37:39:55:d5:c7:8c:56:20:0e:28: + 0a:0e:d2:2a:a4:b0:49:52:c6:38:07:fe:be:0a:09:8c:d1:98: + cf:ca:da:14:31:a1:4f:d2:39:fc:0f:11:2c:43:c3:dd:ab:93: + c7:55:3e:47:7c:18:1a:00:dc:f3:7b:d8:f2:7f:52:6c:20:f4: + 0b:5f:69:52:f4:ee:f8:b2:29:60:eb:e3:49:31:21:0d:d6:b5: + 10:41:e2:41:09:6c:e2:1a:9a:56:4b:77:02:f6:a0:9b:9a:27: + 87:e8:55:29:71:c2:90:9f:45:78:1a:e1:15:64:3d:d0:0e:d8: + a0:76:9f:ae:c5:d0:2e:ea:d6:0f:56:ec:64:7f:5a:9b:14:58: + 01:27:7e:13:50:c7:6b:2a:e6:68:3c:bf:5c:a0:0a:1b:e1:0e: + 7a:e9:e2:80:c3:e9:e9:f6:fd:6c:11:9e:d0:e5:28:27:2b:54: + 32:42:14:82:75:e6:4a:f0:2b:66:75:63:8c:a2:fb:04:3e:83: + 0e:9b:36:f0:18:e4:26:20:c3:8c:f0:28:07:ad:3c:17:66:88: + b5:fd:b6:88 +MD5 Fingerprint=86:38:6D:5E:49:63:6C:85:5C:DB:6D:DC:94:B7:D0:F7 +-----BEGIN CERTIFICATE----- +MIIGfTCCBWWgAwIBAgICAQMwDQYJKoZIhvcNAQEEBQAwga8xCzAJBgNVBAYTAkhV +MRAwDgYDVQQIEwdIdW5nYXJ5MREwDwYDVQQHEwhCdWRhcGVzdDEnMCUGA1UEChMe +TmV0TG9jayBIYWxvemF0Yml6dG9uc2FnaSBLZnQuMRowGAYDVQQLExFUYW51c2l0 +dmFueWtpYWRvazE2MDQGA1UEAxMtTmV0TG9jayBLb3pqZWd5em9pIChDbGFzcyBB +KSBUYW51c2l0dmFueWtpYWRvMB4XDTk5MDIyNDIzMTQ0N1oXDTE5MDIxOTIzMTQ0 +N1owga8xCzAJBgNVBAYTAkhVMRAwDgYDVQQIEwdIdW5nYXJ5MREwDwYDVQQHEwhC +dWRhcGVzdDEnMCUGA1UEChMeTmV0TG9jayBIYWxvemF0Yml6dG9uc2FnaSBLZnQu +MRowGAYDVQQLExFUYW51c2l0dmFueWtpYWRvazE2MDQGA1UEAxMtTmV0TG9jayBL +b3pqZWd5em9pIChDbGFzcyBBKSBUYW51c2l0dmFueWtpYWRvMIIBIjANBgkqhkiG +9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvHSMD7tM9DceqQWC2ObhbHDqeLVu0ThEDaiD +zl3S1tWBxdRL51uUcCbbO51qTGL3cfNk1mE7PetzozfZz+qMkjvN9wfcZnSX9EUi +3fRc4L9t875lM+QVOr/bmJBVOMTtplVjC7B4BPTjbsE/jvxReB+SnoPC/tmwqcm8 +WgD/qaiYdPv2LD4VOQ22BFWoDpggQrOxJa1+mm9dU7GrDPzr4PN6s6iz/0b2Y6LY +Oph7tqyF/7AlT3Rj5xMHpQqPBffAZG9+pyeAlt7ULoZgx2srXnN7F+eRP2QM2Esi +NCubMvJIH5+hCoR64sKtlz2O1cH5VqNQ6ca0+pii7pXmKgOM3wIDAQABo4ICnzCC +ApswDgYDVR0PAQH/BAQDAgAGMBIGA1UdEwEB/wQIMAYBAf8CAQQwEQYJYIZIAYb4 +QgEBBAQDAgAHMIICYAYJYIZIAYb4QgENBIICURaCAk1GSUdZRUxFTSEgRXplbiB0 +YW51c2l0dmFueSBhIE5ldExvY2sgS2Z0LiBBbHRhbGFub3MgU3pvbGdhbHRhdGFz +aSBGZWx0ZXRlbGVpYmVuIGxlaXJ0IGVsamFyYXNvayBhbGFwamFuIGtlc3p1bHQu +IEEgaGl0ZWxlc2l0ZXMgZm9seWFtYXRhdCBhIE5ldExvY2sgS2Z0LiB0ZXJtZWtm +ZWxlbG9zc2VnLWJpenRvc2l0YXNhIHZlZGkuIEEgZGlnaXRhbGlzIGFsYWlyYXMg +ZWxmb2dhZGFzYW5hayBmZWx0ZXRlbGUgYXogZWxvaXJ0IGVsbGVub3J6ZXNpIGVs +amFyYXMgbWVndGV0ZWxlLiBBeiBlbGphcmFzIGxlaXJhc2EgbWVndGFsYWxoYXRv +IGEgTmV0TG9jayBLZnQuIEludGVybmV0IGhvbmxhcGphbiBhIGh0dHBzOi8vd3d3 +Lm5ldGxvY2submV0L2RvY3MgY2ltZW4gdmFneSBrZXJoZXRvIGF6IGVsbGVub3J6 +ZXNAbmV0bG9jay5uZXQgZS1tYWlsIGNpbWVuLiBJTVBPUlRBTlQhIFRoZSBpc3N1 +YW5jZSBhbmQgdGhlIHVzZSBvZiB0aGlzIGNlcnRpZmljYXRlIGlzIHN1YmplY3Qg +dG8gdGhlIE5ldExvY2sgQ1BTIGF2YWlsYWJsZSBhdCBodHRwczovL3d3dy5uZXRs +b2NrLm5ldC9kb2NzIG9yIGJ5IGUtbWFpbCBhdCBjcHNAbmV0bG9jay5uZXQuMA0G +CSqGSIb3DQEBBAUAA4IBAQBIJEb3ulZv+sgoA0BO5TE5ayZrU3/b39/zcT0mwBQO +xmd7I6gMc90Bu8bKbjc5VdXHjFYgDigKDtIqpLBJUsY4B/6+CgmM0ZjPytoUMaFP +0jn8DxEsQ8Pdq5PHVT5HfBgaANzze9jyf1JsIPQLX2lS9O74silg6+NJMSEN1rUQ +QeJBCWziGppWS3cC9qCbmieH6FUpccKQn0V4GuEVZD3QDtigdp+uxdAu6tYPVuxk +f1qbFFgBJ34TUMdrKuZoPL9coAob4Q566eKAw+np9v1sEZ7Q5SgnK1QyQhSCdeZK +8CtmdWOMovsEPoMOmzbwGOQmIMOM8CgHrTwXZoi1/baI +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 105 (0x69) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=HU, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Uzleti (Class B) Tanusitvanykiado + Validity + Not Before: Feb 25 14:10:22 1999 GMT + Not After : Feb 20 14:10:22 2019 GMT + Subject: C=HU, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Uzleti (Class B) Tanusitvanykiado + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:b1:ea:04:ec:20:a0:23:c2:8f:38:60:cf:c7:46: + b3:d5:1b:fe:fb:b9:99:9e:04:dc:1c:7f:8c:4a:81: + 98:ee:a4:d4:ca:8a:17:b9:22:7f:83:0a:75:4c:9b: + c0:69:d8:64:39:a3:ed:92:a3:fd:5b:5c:74:1a:c0: + 47:ca:3a:69:76:9a:ba:e2:44:17:fc:4c:a3:d5:fe: + b8:97:88:af:88:03:89:1f:a4:f2:04:3e:c8:07:0b: + e6:f9:b3:2f:7a:62:14:09:46:14:ca:64:f5:8b:80: + b5:62:a8:d8:6b:d6:71:93:2d:b3:bf:09:54:58:ed: + 06:eb:a8:7b:dc:43:b1:a1:69 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE, pathlen:4 + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + Netscape Comment: + FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztositasa vedi. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! The issuance and the use of this certificate is subject to the NetLock CPS available at https://www.netlock.net/docs or by e-mail at cps@netlock.net. + Signature Algorithm: md5WithRSAEncryption + 04:db:ae:8c:17:af:f8:0e:90:31:4e:cd:3e:09:c0:6d:3a:b0: + f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96: + cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb: + 22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39: + 1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:d6:17:5c:47: + 4f:e3:1d:38:eb:9f:d5:7b:95:a8:28:9e:15:4a:d1:d1:d0:2b: + 00:97:a0:e2:92:36:2b:63:ac:58:01:6b:33:29:50:86:83:f1: + 01:48 +MD5 Fingerprint=39:16:AA:B9:6A:41:E1:14:69:DF:9E:6C:3B:72:DC:B6 +-----BEGIN CERTIFICATE----- +MIIFSzCCBLSgAwIBAgIBaTANBgkqhkiG9w0BAQQFADCBmTELMAkGA1UEBhMCSFUx +ETAPBgNVBAcTCEJ1ZGFwZXN0MScwJQYDVQQKEx5OZXRMb2NrIEhhbG96YXRiaXp0 +b25zYWdpIEtmdC4xGjAYBgNVBAsTEVRhbnVzaXR2YW55a2lhZG9rMTIwMAYDVQQD +EylOZXRMb2NrIFV6bGV0aSAoQ2xhc3MgQikgVGFudXNpdHZhbnlraWFkbzAeFw05 +OTAyMjUxNDEwMjJaFw0xOTAyMjAxNDEwMjJaMIGZMQswCQYDVQQGEwJIVTERMA8G +A1UEBxMIQnVkYXBlc3QxJzAlBgNVBAoTHk5ldExvY2sgSGFsb3phdGJpenRvbnNh +Z2kgS2Z0LjEaMBgGA1UECxMRVGFudXNpdHZhbnlraWFkb2sxMjAwBgNVBAMTKU5l +dExvY2sgVXpsZXRpIChDbGFzcyBCKSBUYW51c2l0dmFueWtpYWRvMIGfMA0GCSqG +SIb3DQEBAQUAA4GNADCBiQKBgQCx6gTsIKAjwo84YM/HRrPVG/77uZmeBNwcf4xK +gZjupNTKihe5In+DCnVMm8Bp2GQ5o+2So/1bXHQawEfKOml2mrriRBf8TKPV/riX +iK+IA4kfpPIEPsgHC+b5sy96YhQJRhTKZPWLgLViqNhr1nGTLbO/CVRY7QbrqHvc +Q7GhaQIDAQABo4ICnzCCApswEgYDVR0TAQH/BAgwBgEB/wIBBDAOBgNVHQ8BAf8E +BAMCAAYwEQYJYIZIAYb4QgEBBAQDAgAHMIICYAYJYIZIAYb4QgENBIICURaCAk1G +SUdZRUxFTSEgRXplbiB0YW51c2l0dmFueSBhIE5ldExvY2sgS2Z0LiBBbHRhbGFu +b3MgU3pvbGdhbHRhdGFzaSBGZWx0ZXRlbGVpYmVuIGxlaXJ0IGVsamFyYXNvayBh +bGFwamFuIGtlc3p1bHQuIEEgaGl0ZWxlc2l0ZXMgZm9seWFtYXRhdCBhIE5ldExv +Y2sgS2Z0LiB0ZXJtZWtmZWxlbG9zc2VnLWJpenRvc2l0YXNhIHZlZGkuIEEgZGln +aXRhbGlzIGFsYWlyYXMgZWxmb2dhZGFzYW5hayBmZWx0ZXRlbGUgYXogZWxvaXJ0 +IGVsbGVub3J6ZXNpIGVsamFyYXMgbWVndGV0ZWxlLiBBeiBlbGphcmFzIGxlaXJh +c2EgbWVndGFsYWxoYXRvIGEgTmV0TG9jayBLZnQuIEludGVybmV0IGhvbmxhcGph +biBhIGh0dHBzOi8vd3d3Lm5ldGxvY2submV0L2RvY3MgY2ltZW4gdmFneSBrZXJo +ZXRvIGF6IGVsbGVub3J6ZXNAbmV0bG9jay5uZXQgZS1tYWlsIGNpbWVuLiBJTVBP +UlRBTlQhIFRoZSBpc3N1YW5jZSBhbmQgdGhlIHVzZSBvZiB0aGlzIGNlcnRpZmlj +YXRlIGlzIHN1YmplY3QgdG8gdGhlIE5ldExvY2sgQ1BTIGF2YWlsYWJsZSBhdCBo +dHRwczovL3d3dy5uZXRsb2NrLm5ldC9kb2NzIG9yIGJ5IGUtbWFpbCBhdCBjcHNA +bmV0bG9jay5uZXQuMA0GCSqGSIb3DQEBBAUAA4GBAATbrowXr/gOkDFOzT4JwG06 +sPgzTEdM43WIEJessDgVkcYplswhwG08pXTP2IKlOcNl40JwuyKQ433bNXbhoLXa +n3BukxowOR0w2y7jfLKRstE3Kfq51hdcR0/jHTjrn9V7lagonhVK0dHQKwCXoOKS +NitjrFgBazMpUIaD8QFI +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 104 (0x68) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=HU, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Expressz (Class C) Tanusitvanykiado + Validity + Not Before: Feb 25 14:08:11 1999 GMT + Not After : Feb 20 14:08:11 2019 GMT + Subject: C=HU, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Expressz (Class C) Tanusitvanykiado + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:eb:ec:b0:6c:61:8a:23:25:af:60:20:e3:d9:9f: + fc:93:0b:db:5d:8d:b0:a1:b3:40:3a:82:ce:fd:75: + e0:78:32:03:86:5a:86:95:91:ed:53:fa:9d:40:fc: + e6:e8:dd:d9:5b:7a:03:bd:5d:f3:3b:0c:c3:51:79: + 9b:ad:55:a0:e9:d0:03:10:af:0a:ba:14:42:d9:52: + 26:11:22:c7:d2:20:cc:82:a4:9a:a9:fe:b8:81:76: + 9d:6a:b7:d2:36:75:3e:b1:86:09:f6:6e:6d:7e:4e: + b7:7a:ec:ae:71:84:f6:04:33:08:25:32:eb:74:ac: + 16:44:c6:e4:40:93:1d:7f:ad + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE, pathlen:4 + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + Netscape Comment: + FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztositasa vedi. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! The issuance and the use of this certificate is subject to the NetLock CPS available at https://www.netlock.net/docs or by e-mail at cps@netlock.net. + Signature Algorithm: md5WithRSAEncryption + 10:ad:7f:d7:0c:32:80:0a:d8:86:f1:79:98:b5:ad:d4:cd:b3: + 36:c4:96:48:c1:5c:cd:9a:d9:05:2e:9f:be:50:eb:f4:26:14: + 10:2d:d4:66:17:f8:9e:c1:27:fd:f1:ed:e4:7b:4b:a0:6c:b5: + ab:9a:57:70:a6:ed:a0:a4:ed:2e:f5:fd:fc:bd:fe:4d:37:08: + 0c:bc:e3:96:83:22:f5:49:1b:7f:4b:2b:b4:54:c1:80:7c:99: + 4e:1d:d0:8c:ee:d0:ac:e5:92:fa:75:56:fe:64:a0:13:8f:b8: + b8:16:9d:61:05:67:80:c8:d0:d8:a5:07:02:34:98:04:8d:33: + 04:d4 +MD5 Fingerprint=4F:EB:F1:F0:70:C2:80:63:5D:58:9F:DA:12:3C:A9:C4 +-----BEGIN CERTIFICATE----- +MIIFTzCCBLigAwIBAgIBaDANBgkqhkiG9w0BAQQFADCBmzELMAkGA1UEBhMCSFUx +ETAPBgNVBAcTCEJ1ZGFwZXN0MScwJQYDVQQKEx5OZXRMb2NrIEhhbG96YXRiaXp0 +b25zYWdpIEtmdC4xGjAYBgNVBAsTEVRhbnVzaXR2YW55a2lhZG9rMTQwMgYDVQQD +EytOZXRMb2NrIEV4cHJlc3N6IChDbGFzcyBDKSBUYW51c2l0dmFueWtpYWRvMB4X +DTk5MDIyNTE0MDgxMVoXDTE5MDIyMDE0MDgxMVowgZsxCzAJBgNVBAYTAkhVMREw +DwYDVQQHEwhCdWRhcGVzdDEnMCUGA1UEChMeTmV0TG9jayBIYWxvemF0Yml6dG9u +c2FnaSBLZnQuMRowGAYDVQQLExFUYW51c2l0dmFueWtpYWRvazE0MDIGA1UEAxMr +TmV0TG9jayBFeHByZXNzeiAoQ2xhc3MgQykgVGFudXNpdHZhbnlraWFkbzCBnzAN +BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA6+ywbGGKIyWvYCDj2Z/8kwvbXY2wobNA +OoLO/XXgeDIDhlqGlZHtU/qdQPzm6N3ZW3oDvV3zOwzDUXmbrVWg6dADEK8KuhRC +2VImESLH0iDMgqSaqf64gXadarfSNnU+sYYJ9m5tfk63euyucYT2BDMIJTLrdKwW +RMbkQJMdf60CAwEAAaOCAp8wggKbMBIGA1UdEwEB/wQIMAYBAf8CAQQwDgYDVR0P +AQH/BAQDAgAGMBEGCWCGSAGG+EIBAQQEAwIABzCCAmAGCWCGSAGG+EIBDQSCAlEW +ggJNRklHWUVMRU0hIEV6ZW4gdGFudXNpdHZhbnkgYSBOZXRMb2NrIEtmdC4gQWx0 +YWxhbm9zIFN6b2xnYWx0YXRhc2kgRmVsdGV0ZWxlaWJlbiBsZWlydCBlbGphcmFz +b2sgYWxhcGphbiBrZXN6dWx0LiBBIGhpdGVsZXNpdGVzIGZvbHlhbWF0YXQgYSBO +ZXRMb2NrIEtmdC4gdGVybWVrZmVsZWxvc3NlZy1iaXp0b3NpdGFzYSB2ZWRpLiBB +IGRpZ2l0YWxpcyBhbGFpcmFzIGVsZm9nYWRhc2FuYWsgZmVsdGV0ZWxlIGF6IGVs +b2lydCBlbGxlbm9yemVzaSBlbGphcmFzIG1lZ3RldGVsZS4gQXogZWxqYXJhcyBs +ZWlyYXNhIG1lZ3RhbGFsaGF0byBhIE5ldExvY2sgS2Z0LiBJbnRlcm5ldCBob25s +YXBqYW4gYSBodHRwczovL3d3dy5uZXRsb2NrLm5ldC9kb2NzIGNpbWVuIHZhZ3kg +a2VyaGV0byBheiBlbGxlbm9yemVzQG5ldGxvY2submV0IGUtbWFpbCBjaW1lbi4g +SU1QT1JUQU5UISBUaGUgaXNzdWFuY2UgYW5kIHRoZSB1c2Ugb2YgdGhpcyBjZXJ0 +aWZpY2F0ZSBpcyBzdWJqZWN0IHRvIHRoZSBOZXRMb2NrIENQUyBhdmFpbGFibGUg +YXQgaHR0cHM6Ly93d3cubmV0bG9jay5uZXQvZG9jcyBvciBieSBlLW1haWwgYXQg +Y3BzQG5ldGxvY2submV0LjANBgkqhkiG9w0BAQQFAAOBgQAQrX/XDDKACtiG8XmY +ta3UzbM2xJZIwVzNmtkFLp++UOv0JhQQLdRmF/iewSf98e3ke0ugbLWrmldwpu2g +pO0u9f38vf5NNwgMvOOWgyL1SRt/Syu0VMGAfJlOHdCM7tCs5ZL6dVb+ZKATj7i4 +Fp1hBWeAyNDYpQcCNJgEjTME1A== +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 50:94:6c:ec:18:ea:d5:9c:4d:d5:97:ef:75:8f:a0:ad + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, OU=www.xrampsecurity.com, O=XRamp Security Services Inc, CN=XRamp Global Certification Authority + Validity + Not Before: Nov 1 17:14:04 2004 GMT + Not After : Jan 1 05:37:19 2035 GMT + Subject: C=US, OU=www.xrampsecurity.com, O=XRamp Security Services Inc, CN=XRamp Global Certification Authority + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:98:24:1e:bd:15:b4:ba:df:c7:8c:a5:27:b6:38: + 0b:69:f3:b6:4e:a8:2c:2e:21:1d:5c:44:df:21:5d: + 7e:23:74:fe:5e:7e:b4:4a:b7:a6:ad:1f:ae:e0:06: + 16:e2:9b:5b:d9:67:74:6b:5d:80:8f:29:9d:86:1b: + d9:9c:0d:98:6d:76:10:28:58:e4:65:b0:7f:4a:98: + 79:9f:e0:c3:31:7e:80:2b:b5:8c:c0:40:3b:11:86: + d0:cb:a2:86:36:60:a4:d5:30:82:6d:d9:6e:d0:0f: + 12:04:33:97:5f:4f:61:5a:f0:e4:f9:91:ab:e7:1d: + 3b:bc:e8:cf:f4:6b:2d:34:7c:e2:48:61:1c:8e:f3: + 61:44:cc:6f:a0:4a:a9:94:b0:4d:da:e7:a9:34:7a: + 72:38:a8:41:cc:3c:94:11:7d:eb:c8:a6:8c:b7:86: + cb:ca:33:3b:d9:3d:37:8b:fb:7a:3e:86:2c:e7:73: + d7:0a:57:ac:64:9b:19:eb:f4:0f:04:08:8a:ac:03: + 17:19:64:f4:5a:25:22:8d:34:2c:b2:f6:68:1d:12: + 6d:d3:8a:1e:14:da:c4:8f:a6:e2:23:85:d5:7a:0d: + bd:6a:e0:e9:ec:ec:17:bb:42:1b:67:aa:25:ed:45: + 83:21:fc:c1:c9:7c:d5:62:3e:fa:f2:c5:2d:d3:fd: + d4:65 + Exponent: 65537 (0x10001) + X509v3 extensions: + 1.3.6.1.4.1.311.20.2: + ...C.A + X509v3 Key Usage: + Digital Signature, Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B + X509v3 CRL Distribution Points: + URI:http://crl.xrampsecurity.com/XGCA.crl + + 1.3.6.1.4.1.311.21.1: + ... + Signature Algorithm: sha1WithRSAEncryption + 91:15:39:03:01:1b:67:fb:4a:1c:f9:0a:60:5b:a1:da:4d:97: + 62:f9:24:53:27:d7:82:64:4e:90:2e:c3:49:1b:2b:9a:dc:fc: + a8:78:67:35:f1:1d:f0:11:bd:b7:48:e3:10:f6:0d:df:3f:d2: + c9:b6:aa:55:a4:48:ba:02:db:de:59:2e:15:5b:3b:9d:16:7d: + 47:d7:37:ea:5f:4d:76:12:36:bb:1f:d7:a1:81:04:46:20:a3: + 2c:6d:a9:9e:01:7e:3f:29:ce:00:93:df:fd:c9:92:73:89:89: + 64:9e:e7:2b:e4:1c:91:2c:d2:b9:ce:7d:ce:6f:31:99:d3:e6: + be:d2:1e:90:f0:09:14:79:5c:23:ab:4d:d2:da:21:1f:4d:99: + 79:9d:e1:cf:27:9f:10:9b:1c:88:0d:b0:8a:64:41:31:b8:0e: + 6c:90:24:a4:9b:5c:71:8f:ba:bb:7e:1c:1b:db:6a:80:0f:21: + bc:e9:db:a6:b7:40:f4:b2:8b:a9:b1:e4:ef:9a:1a:d0:3d:69: + 99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7: + 43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09: + 84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9: + b4:03:25:bc +MD5 Fingerprint=A1:0B:44:B3:CA:10:D8:00:6E:9D:0F:D8:0F:92:0A:D1 +-----BEGIN CERTIFICATE----- +MIIEMDCCAxigAwIBAgIQUJRs7Bjq1ZxN1ZfvdY+grTANBgkqhkiG9w0BAQUFADCB +gjELMAkGA1UEBhMCVVMxHjAcBgNVBAsTFXd3dy54cmFtcHNlY3VyaXR5LmNvbTEk +MCIGA1UEChMbWFJhbXAgU2VjdXJpdHkgU2VydmljZXMgSW5jMS0wKwYDVQQDEyRY +UmFtcCBHbG9iYWwgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDQxMTAxMTcx +NDA0WhcNMzUwMTAxMDUzNzE5WjCBgjELMAkGA1UEBhMCVVMxHjAcBgNVBAsTFXd3 +dy54cmFtcHNlY3VyaXR5LmNvbTEkMCIGA1UEChMbWFJhbXAgU2VjdXJpdHkgU2Vy +dmljZXMgSW5jMS0wKwYDVQQDEyRYUmFtcCBHbG9iYWwgQ2VydGlmaWNhdGlvbiBB +dXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCYJB69FbS6 +38eMpSe2OAtp87ZOqCwuIR1cRN8hXX4jdP5efrRKt6atH67gBhbim1vZZ3RrXYCP +KZ2GG9mcDZhtdhAoWORlsH9KmHmf4MMxfoArtYzAQDsRhtDLooY2YKTVMIJt2W7Q +DxIEM5dfT2Fa8OT5kavnHTu86M/0ay00fOJIYRyO82FEzG+gSqmUsE3a56k0enI4 +qEHMPJQRfevIpoy3hsvKMzvZPTeL+3o+hiznc9cKV6xkmxnr9A8ECIqsAxcZZPRa +JSKNNCyy9mgdEm3Tih4U2sSPpuIjhdV6Db1q4Ons7Be7QhtnqiXtRYMh/MHJfNVi +PvryxS3T/dRlAgMBAAGjgZ8wgZwwEwYJKwYBBAGCNxQCBAYeBABDAEEwCwYDVR0P +BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFMZPoj0GY4QJnM5i5ASs +jVy16bYbMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jcmwueHJhbXBzZWN1cml0 +eS5jb20vWEdDQS5jcmwwEAYJKwYBBAGCNxUBBAMCAQEwDQYJKoZIhvcNAQEFBQAD +ggEBAJEVOQMBG2f7Shz5CmBbodpNl2L5JFMn14JkTpAuw0kbK5rc/Kh4ZzXxHfAR +vbdI4xD2Dd8/0sm2qlWkSLoC295ZLhVbO50WfUfXN+pfTXYSNrsf16GBBEYgoyxt +qZ4Bfj8pzgCT3/3JknOJiWSe5yvkHJEs0rnOfc5vMZnT5r7SHpDwCRR5XCOrTdLa +IR9NmXmd4c8nnxCbHIgNsIpkQTG4DmyQJKSbXHGPurt+HBvbaoAPIbzp26a3QPSy +i6mx5O+aGtA9aZnuqCij4Tyz8LIRnM98QObd50N9otg6tamN8jSZxNQQ4Qb9CYQQ +O+7ETPTsJ3xCwnR8gooJybQDJbw= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority + Validity + Not Before: Jun 29 17:06:20 2004 GMT + Not After : Jun 29 17:06:20 2034 GMT + Subject: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:de:9d:d7:ea:57:18:49:a1:5b:eb:d7:5f:48:86: + ea:be:dd:ff:e4:ef:67:1c:f4:65:68:b3:57:71:a0: + 5e:77:bb:ed:9b:49:e9:70:80:3d:56:18:63:08:6f: + da:f2:cc:d0:3f:7f:02:54:22:54:10:d8:b2:81:d4: + c0:75:3d:4b:7f:c7:77:c3:3e:78:ab:1a:03:b5:20: + 6b:2f:6a:2b:b1:c5:88:7e:c4:bb:1e:b0:c1:d8:45: + 27:6f:aa:37:58:f7:87:26:d7:d8:2d:f6:a9:17:b7: + 1f:72:36:4e:a6:17:3f:65:98:92:db:2a:6e:5d:a2: + fe:88:e0:0b:de:7f:e5:8d:15:e1:eb:cb:3a:d5:e2: + 12:a2:13:2d:d8:8e:af:5f:12:3d:a0:08:05:08:b6: + 5c:a5:65:38:04:45:99:1e:a3:60:60:74:c5:41:a5: + 72:62:1b:62:c5:1f:6f:5f:1a:42:be:02:51:65:a8: + ae:23:18:6a:fc:78:03:a9:4d:7f:80:c3:fa:ab:5a: + fc:a1:40:a4:ca:19:16:fe:b2:c8:ef:5e:73:0d:ee: + 77:bd:9a:f6:79:98:bc:b1:07:67:a2:15:0d:dd:a0: + 58:c6:44:7b:0a:3e:62:28:5f:ba:41:07:53:58:cf: + 11:7e:38:74:c5:f8:ff:b5:69:90:8f:84:74:ea:97: + 1b:af + Exponent: 3 (0x3) + X509v3 extensions: + X509v3 Subject Key Identifier: + D2:C4:B0:D2:91:D4:4C:11:71:B3:61:CB:3D:A1:FE:DD:A8:6A:D4:E3 + X509v3 Authority Key Identifier: + keyid:D2:C4:B0:D2:91:D4:4C:11:71:B3:61:CB:3D:A1:FE:DD:A8:6A:D4:E3 + DirName:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority + serial:00 + + X509v3 Basic Constraints: + CA:TRUE + Signature Algorithm: sha1WithRSAEncryption + 32:4b:f3:b2:ca:3e:91:fc:12:c6:a1:07:8c:8e:77:a0:33:06: + 14:5c:90:1e:18:f7:08:a6:3d:0a:19:f9:87:80:11:6e:69:e4: + 96:17:30:ff:34:91:63:72:38:ee:cc:1c:01:a3:1d:94:28:a4: + 31:f6:7a:c4:54:d7:f6:e5:31:58:03:a2:cc:ce:62:db:94:45: + 73:b5:bf:45:c9:24:b5:d5:82:02:ad:23:79:69:8d:b8:b6:4d: + ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5: + 89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85: + e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef: + 87:0d:c4:0f:61:8b:ad:ee:83:2b:95:f8:8e:92:84:72:39:eb: + 20:ea:83:ed:83:cd:97:6e:08:bc:eb:4e:26:b6:73:2b:e4:d3: + f6:4c:fe:26:71:e2:61:11:74:4a:ff:57:1a:87:0f:75:48:2e: + cf:51:69:17:a0:02:12:61:95:d5:d1:40:b2:10:4c:ee:c4:ac: + 10:43:a6:a5:9e:0a:d5:95:62:9a:0d:cf:88:82:c5:32:0c:e4: + 2b:9f:45:e6:0d:9f:28:9c:b1:b9:2a:5a:57:ad:37:0f:af:1d: + 7f:db:bd:9f +MD5 Fingerprint=91:DE:06:25:AB:DA:FD:32:17:0C:BB:25:17:2A:84:67 +-----BEGIN CERTIFICATE----- +MIIEADCCAuigAwIBAgIBADANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEh +MB8GA1UEChMYVGhlIEdvIERhZGR5IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBE +YWRkeSBDbGFzcyAyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA0MDYyOTE3 +MDYyMFoXDTM0MDYyOTE3MDYyMFowYzELMAkGA1UEBhMCVVMxITAfBgNVBAoTGFRo +ZSBHbyBEYWRkeSBHcm91cCwgSW5jLjExMC8GA1UECxMoR28gRGFkZHkgQ2xhc3Mg +MiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASAwDQYJKoZIhvcNAQEBBQADggEN +ADCCAQgCggEBAN6d1+pXGEmhW+vXX0iG6r7d/+TvZxz0ZWizV3GgXne77ZtJ6XCA +PVYYYwhv2vLM0D9/AlQiVBDYsoHUwHU9S3/Hd8M+eKsaA7Ugay9qK7HFiH7Eux6w +wdhFJ2+qN1j3hybX2C32qRe3H3I2TqYXP2WYktsqbl2i/ojgC95/5Y0V4evLOtXi +EqITLdiOr18SPaAIBQi2XKVlOARFmR6jYGB0xUGlcmIbYsUfb18aQr4CUWWoriMY +avx4A6lNf4DD+qta/KFApMoZFv6yyO9ecw3ud72a9nmYvLEHZ6IVDd2gWMZEewo+ +YihfukEHU1jPEX44dMX4/7VpkI+EdOqXG68CAQOjgcAwgb0wHQYDVR0OBBYEFNLE +sNKR1EwRcbNhyz2h/t2oatTjMIGNBgNVHSMEgYUwgYKAFNLEsNKR1EwRcbNhyz2h +/t2oatTjoWekZTBjMQswCQYDVQQGEwJVUzEhMB8GA1UEChMYVGhlIEdvIERhZGR5 +IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBEYWRkeSBDbGFzcyAyIENlcnRpZmlj +YXRpb24gQXV0aG9yaXR5ggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQAD +ggEBADJL87LKPpH8EsahB4yOd6AzBhRckB4Y9wimPQoZ+YeAEW5p5JYXMP80kWNy +OO7MHAGjHZQopDH2esRU1/blMVgDoszOYtuURXO1v0XJJLXVggKtI3lpjbi2Tc7P +TMozI+gciKqdi0FuFskg5YmezTvacPd+mSYgFFQlq25zheabIZ0KbIIOqPjCDPoQ +HmyW74cNxA9hi63ugyuV+I6ShHI56yDqg+2DzZduCLzrTia2cyvk0/ZM/iZx4mER +dEr/VxqHD3VILs9RaRegAhJhldXRQLIQTO7ErBBDpqWeCtWVYpoNz4iCxTIM5Cuf +ReYNnyicsbkqWletNw+vHX/bvZ8= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: sha1WithRSAEncryption + Issuer: C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority + Validity + Not Before: Jun 29 17:39:16 2004 GMT + Not After : Jun 29 17:39:16 2034 GMT + Subject: C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:b7:32:c8:fe:e9:71:a6:04:85:ad:0c:11:64:df: + ce:4d:ef:c8:03:18:87:3f:a1:ab:fb:3c:a6:9f:f0: + c3:a1:da:d4:d8:6e:2b:53:90:fb:24:a4:3e:84:f0: + 9e:e8:5f:ec:e5:27:44:f5:28:a6:3f:7b:de:e0:2a: + f0:c8:af:53:2f:9e:ca:05:01:93:1e:8f:66:1c:39: + a7:4d:fa:5a:b6:73:04:25:66:eb:77:7f:e7:59:c6: + 4a:99:25:14:54:eb:26:c7:f3:7f:19:d5:30:70:8f: + af:b0:46:2a:ff:ad:eb:29:ed:d7:9f:aa:04:87:a3: + d4:f9:89:a5:34:5f:db:43:91:82:36:d9:66:3c:b1: + b8:b9:82:fd:9c:3a:3e:10:c8:3b:ef:06:65:66:7a: + 9b:19:18:3d:ff:71:51:3c:30:2e:5f:be:3d:77:73: + b2:5d:06:6c:c3:23:56:9a:2b:85:26:92:1c:a7:02: + b3:e4:3f:0d:af:08:79:82:b8:36:3d:ea:9c:d3:35: + b3:bc:69:ca:f5:cc:9d:e8:fd:64:8d:17:80:33:6e: + 5e:4a:5d:99:c9:1e:87:b4:9d:1a:c0:d5:6e:13:35: + 23:5e:df:9b:5f:3d:ef:d6:f7:76:c2:ea:3e:bb:78: + 0d:1c:42:67:6b:04:d8:f8:d6:da:6f:8b:f2:44:a0: + 01:ab + Exponent: 3 (0x3) + X509v3 extensions: + X509v3 Subject Key Identifier: + BF:5F:B7:D1:CE:DD:1F:86:F4:5B:55:AC:DC:D7:10:C2:0E:A9:88:E7 + X509v3 Authority Key Identifier: + keyid:BF:5F:B7:D1:CE:DD:1F:86:F4:5B:55:AC:DC:D7:10:C2:0E:A9:88:E7 + DirName:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority + serial:00 + + X509v3 Basic Constraints: + CA:TRUE + Signature Algorithm: sha1WithRSAEncryption + 05:9d:3f:88:9d:d1:c9:1a:55:a1:ac:69:f3:f3:59:da:9b:01: + 87:1a:4f:57:a9:a1:79:09:2a:db:f7:2f:b2:1e:cc:c7:5e:6a: + d8:83:87:a1:97:ef:49:35:3e:77:06:41:58:62:bf:8e:58:b8: + 0a:67:3f:ec:b3:dd:21:66:1f:c9:54:fa:72:cc:3d:4c:40:d8: + 81:af:77:9e:83:7a:bb:a2:c7:f5:34:17:8e:d9:11:40:f4:fc: + 2c:2a:4d:15:7f:a7:62:5d:2e:25:d3:00:0b:20:1a:1d:68:f9: + 17:b8:f4:bd:8b:ed:28:59:dd:4d:16:8b:17:83:c8:b2:65:c7: + 2d:7a:a5:aa:bc:53:86:6d:dd:57:a4:ca:f8:20:41:0b:68:f0: + f4:fb:74:be:56:5d:7a:79:f5:f9:1d:85:e3:2d:95:be:f5:71: + 90:43:cc:8d:1f:9a:00:0a:87:29:e9:55:22:58:00:23:ea:e3: + 12:43:29:5b:47:08:dd:8c:41:6a:65:06:a8:e5:21:aa:41:b4: + 95:21:95:b9:7d:d1:34:ab:13:d6:ad:bc:dc:e2:3d:39:cd:bd: + 3e:75:70:a1:18:59:03:c9:22:b4:8f:9c:d5:5e:2a:d7:a5:b6: + d4:0a:6d:f8:b7:40:11:46:9a:1f:79:0e:62:bf:0f:97:ec:e0: + 2f:1f:17:94 +MD5 Fingerprint=32:4A:4B:BB:C8:63:69:9B:BE:74:9A:C6:DD:1D:46:24 +-----BEGIN CERTIFICATE----- +MIIEDzCCAvegAwIBAgIBADANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQGEwJVUzEl +MCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAGA1UECxMp +U3RhcmZpZWxkIENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDQw +NjI5MTczOTE2WhcNMzQwNjI5MTczOTE2WjBoMQswCQYDVQQGEwJVUzElMCMGA1UE +ChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAGA1UECxMpU3RhcmZp +ZWxkIENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3 +DQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf +8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN ++lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0 +X9tDkYI22WY8sbi5gv2cOj4QyDvvBmVmepsZGD3/cVE8MC5fvj13c7JdBmzDI1aa +K4UmkhynArPkPw2vCHmCuDY96pzTNbO8acr1zJ3o/WSNF4Azbl5KXZnJHoe0nRrA +1W4TNSNe35tfPe/W93bC6j67eA0cQmdrBNj41tpvi/JEoAGrAgEDo4HFMIHCMB0G +A1UdDgQWBBS/X7fRzt0fhvRbVazc1xDCDqmI5zCBkgYDVR0jBIGKMIGHgBS/X7fR +zt0fhvRbVazc1xDCDqmI56FspGowaDELMAkGA1UEBhMCVVMxJTAjBgNVBAoTHFN0 +YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xMjAwBgNVBAsTKVN0YXJmaWVsZCBD +bGFzcyAyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5ggEAMAwGA1UdEwQFMAMBAf8w +DQYJKoZIhvcNAQEFBQADggEBAAWdP4id0ckaVaGsafPzWdqbAYcaT1epoXkJKtv3 +L7IezMdeatiDh6GX70k1PncGQVhiv45YuApnP+yz3SFmH8lU+nLMPUxA2IGvd56D +eruix/U0F47ZEUD0/CwqTRV/p2JdLiXTAAsgGh1o+Re49L2L7ShZ3U0WixeDyLJl +xy16paq8U4Zt3VekyvggQQto8PT7dL5WXXp59fkdheMtlb71cZBDzI0fmgAKhynp +VSJYACPq4xJDKVtHCN2MQWplBqjlIapBtJUhlbl90TSrE9atvNziPTnNvT51cKEY +WQPJIrSPnNVeKtelttQKbfi3QBFGmh95DmK/D5fs4C8fF5Q= +-----END CERTIFICATE----- + + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=IL, ST=Israel, L=Eilat, O=StartCom Ltd., OU=CA Authority Dep., CN=Free SSL Certification Authority/emailAddress=admin@startcom.org + Validity + Not Before: Mar 17 17:37:48 2005 GMT + Not After : Mar 10 17:37:48 2035 GMT + Subject: C=IL, ST=Israel, L=Eilat, O=StartCom Ltd., OU=CA Authority Dep., CN=Free SSL Certification Authority/emailAddress=admin@startcom.org + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:ed:84:60:00:23:9e:c8:4a:51:29:27:de:3a:a1: + 39:b5:69:ab:09:b2:2f:34:fd:61:dc:3d:d3:b0:cf: + b1:d7:c2:c4:c2:b1:e4:96:56:c4:be:aa:14:0e:e7: + cc:3a:50:c8:3a:62:9d:c3:a3:ac:59:7b:8e:ee:55: + 1a:1c:47:be:a3:97:39:b3:b5:ef:23:2c:08:e8:d8: + af:73:2f:b9:c9:83:e8:ed:00:0f:c8:75:a5:2f:34: + 4c:18:e8:76:88:23:49:8a:db:b6:ed:68:da:c3:b5: + 62:29:4c:a5:4b:b7:98:b4:09:14:10:a0:f8:fe:62: + 76:22:15:0b:a4:d6:08:2f:35 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Key Usage: + Digital Signature, Non Repudiation, Key Encipherment, Certificate Sign, CRL Sign + X509v3 Subject Key Identifier: + 1C:89:C3:96:CC:BD:FE:32:D5:0D:8C:81:31:B6:98:9D:8D:28:64:8D + X509v3 Authority Key Identifier: + keyid:1C:89:C3:96:CC:BD:FE:32:D5:0D:8C:81:31:B6:98:9D:8D:28:64:8D + DirName:/C=IL/ST=Israel/L=Eilat/O=StartCom Ltd./OU=CA Authority Dep./CN=Free SSL Certification Authority/emailAddress=admin@startcom.org + serial:00 + + X509v3 Subject Alternative Name: + email:admin@startcom.org + X509v3 Issuer Alternative Name: + email:admin@startcom.org + Netscape Cert Type: + SSL CA, S/MIME CA, Object Signing CA + Netscape Comment: + Free SSL Certification Authority + Netscape CA Revocation Url: + http://cert.startcom.org/ca-crl.crl + Netscape Base Url: + http://cert.startcom.org/ + Netscape CA Policy Url: + http://cert.startcom.org/index.php?app=111 + Signature Algorithm: md5WithRSAEncryption + 6c:71:25:e1:9e:34:91:21:ef:db:6c:bd:01:08:56:8f:88:d8: + 41:3a:53:f5:72:df:27:57:4b:76:84:f7:68:a4:fe:eb:3f:09: + 7e:28:b8:57:ea:1f:c1:aa:e2:ff:96:9f:49:99:e6:b2:95:73: + 96:c6:48:c7:5e:8d:07:72:56:f8:83:8f:9f:77:af:29:d3:45: + 0e:a4:ee:b0:36:74:2d:f0:cd:98:23:7b:37:4b:da:fe:51:98: + c4:1e:34:3c:88:fd:99:3b:50:a7:c1:8b:33:c7:c2:52:16:12: + 95:53:65:22:ef:ba:8b:ce:62:db:70:23:b1:80:df:1a:20:38: + e7:7e +MD5 Fingerprint=08:7C:58:1F:52:2B:44:B4:3B:79:CD:01:F8:C5:C3:C9 +-----BEGIN CERTIFICATE----- +MIIFFjCCBH+gAwIBAgIBADANBgkqhkiG9w0BAQQFADCBsDELMAkGA1UEBhMCSUwx +DzANBgNVBAgTBklzcmFlbDEOMAwGA1UEBxMFRWlsYXQxFjAUBgNVBAoTDVN0YXJ0 +Q29tIEx0ZC4xGjAYBgNVBAsTEUNBIEF1dGhvcml0eSBEZXAuMSkwJwYDVQQDEyBG +cmVlIFNTTCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYS +YWRtaW5Ac3RhcnRjb20ub3JnMB4XDTA1MDMxNzE3Mzc0OFoXDTM1MDMxMDE3Mzc0 +OFowgbAxCzAJBgNVBAYTAklMMQ8wDQYDVQQIEwZJc3JhZWwxDjAMBgNVBAcTBUVp +bGF0MRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMRowGAYDVQQLExFDQSBBdXRob3Jp +dHkgRGVwLjEpMCcGA1UEAxMgRnJlZSBTU0wgQ2VydGlmaWNhdGlvbiBBdXRob3Jp +dHkxITAfBgkqhkiG9w0BCQEWEmFkbWluQHN0YXJ0Y29tLm9yZzCBnzANBgkqhkiG +9w0BAQEFAAOBjQAwgYkCgYEA7YRgACOeyEpRKSfeOqE5tWmrCbIvNP1h3D3TsM+x +18LEwrHkllbEvqoUDufMOlDIOmKdw6OsWXuO7lUaHEe+o5c5s7XvIywI6Nivcy+5 +yYPo7QAPyHWlLzRMGOh2iCNJitu27Wjaw7ViKUylS7eYtAkUEKD4/mJ2IhULpNYI +LzUCAwEAAaOCAjwwggI4MA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgHmMB0G +A1UdDgQWBBQcicOWzL3+MtUNjIExtpidjShkjTCB3QYDVR0jBIHVMIHSgBQcicOW +zL3+MtUNjIExtpidjShkjaGBtqSBszCBsDELMAkGA1UEBhMCSUwxDzANBgNVBAgT +BklzcmFlbDEOMAwGA1UEBxMFRWlsYXQxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4x +GjAYBgNVBAsTEUNBIEF1dGhvcml0eSBEZXAuMSkwJwYDVQQDEyBGcmVlIFNTTCBD +ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYSYWRtaW5Ac3Rh +cnRjb20ub3JnggEAMB0GA1UdEQQWMBSBEmFkbWluQHN0YXJ0Y29tLm9yZzAdBgNV +HRIEFjAUgRJhZG1pbkBzdGFydGNvbS5vcmcwEQYJYIZIAYb4QgEBBAQDAgAHMC8G +CWCGSAGG+EIBDQQiFiBGcmVlIFNTTCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAy +BglghkgBhvhCAQQEJRYjaHR0cDovL2NlcnQuc3RhcnRjb20ub3JnL2NhLWNybC5j +cmwwKAYJYIZIAYb4QgECBBsWGWh0dHA6Ly9jZXJ0LnN0YXJ0Y29tLm9yZy8wOQYJ +YIZIAYb4QgEIBCwWKmh0dHA6Ly9jZXJ0LnN0YXJ0Y29tLm9yZy9pbmRleC5waHA/ +YXBwPTExMTANBgkqhkiG9w0BAQQFAAOBgQBscSXhnjSRIe/bbL0BCFaPiNhBOlP1 +ct8nV0t2hPdopP7rPwl+KLhX6h/BquL/lp9JmeaylXOWxkjHXo0Hclb4g4+fd68p +00UOpO6wNnQt8M2YI3s3S9r+UZjEHjQ8iP2ZO1CnwYszx8JSFhKVU2Ui77qLzmLb +cCOxgN8aIDjnfg== +-----END CERTIFICATE----- + + +# +# RHNS CA certificate. Appended to the ca-bundle at package build-time. +# +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=US, ST=North Carolina, L=Research Triangle Park, O=Red Hat, Inc., OU=Red Hat Network Services, CN=RHNS Certificate Authority/Email=rhns@redhat.com + Validity + Not Before: Aug 23 22:45:55 2000 GMT + Not After : Aug 28 22:45:55 2003 GMT + Subject: C=US, ST=North Carolina, L=Research Triangle Park, O=Red Hat, Inc., OU=Red Hat Network Services, CN=RHNS Certificate Authority/Email=rhns@redhat.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:c0:68:2b:12:30:e2:21:2d:22:c6:72:71:5b:bf: + 17:a0:93:10:e9:9b:e3:c9:8d:3b:2d:ac:c4:bb:95: + 3b:e0:ca:55:32:dc:95:c2:10:b3:04:b2:51:fb:e8: + 85:61:16:34:a5:b4:1d:67:5c:a7:77:f4:f0:92:da: + b4:8b:af:95:93:62:f3:66:29:ae:c0:88:b7:64:84: + 0e:48:90:60:f8:60:3e:00:7f:54:dd:17:a6:ac:18: + e0:42:de:7c:be:90:81:f7:f4:05:85:0a:08:cc:d5: + f2:9f:fc:24:8b:77:a5:3d:e9:48:a9:ef:0f:3b:63: + a3:fe:a6:83:4c:e8:dc:0b:77 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + 54:15:CD:9F:2C:F7:EC:0D:1F:D2:A8:BE:4C:07:AC:88:3E:FB:9B:0A + X509v3 Authority Key Identifier: + keyid:54:15:CD:9F:2C:F7:EC:0D:1F:D2:A8:BE:4C:07:AC:88:3E:FB:9B:0A + DirName:/C=US/ST=North Carolina/L=Research Triangle Park/O=Red Hat, Inc./OU=Red Hat Network Services/CN=RHNS Certificate Authority/Email=rhns@redhat.com + serial:00 + + X509v3 Basic Constraints: + CA:TRUE + Signature Algorithm: md5WithRSAEncryption + 93:01:88:88:67:67:91:8c:9e:d0:12:14:90:71:12:87:55:0a: + f2:52:1b:ad:f2:d3:07:1d:af:70:99:bb:b0:cd:80:23:c9:ed: + 2b:73:e9:63:b1:d0:b3:8c:60:c5:42:64:a6:c1:95:56:90:c5: + 35:06:03:58:f5:8e:2b:d9:f9:a9:a0:10:a9:99:f7:15:42:92: + a5:50:d7:11:07:f1:02:d5:e0:70:e4:55:6e:2a:ce:25:f8:5d: + cd:0b:2f:10:61:f8:f6:20:42:cc:c3:89:f8:8a:4f:82:24:12: + cf:39:7f:21:a8:2c:8d:52:97:52:c5:f7:5f:42:a5:87:09:66: + b0:cc +-----BEGIN CERTIFICATE----- +MIIEMDCCA5mgAwIBAgIBADANBgkqhkiG9w0BAQQFADCBxzELMAkGA1UEBhMCVVMx +FzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMR8wHQYDVQQHExZSZXNlYXJjaCBUcmlh +bmdsZSBQYXJrMRYwFAYDVQQKEw1SZWQgSGF0LCBJbmMuMSEwHwYDVQQLExhSZWQg +SGF0IE5ldHdvcmsgU2VydmljZXMxIzAhBgNVBAMTGlJITlMgQ2VydGlmaWNhdGUg +QXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9yaG5zQHJlZGhhdC5jb20wHhcNMDAw +ODIzMjI0NTU1WhcNMDMwODI4MjI0NTU1WjCBxzELMAkGA1UEBhMCVVMxFzAVBgNV +BAgTDk5vcnRoIENhcm9saW5hMR8wHQYDVQQHExZSZXNlYXJjaCBUcmlhbmdsZSBQ +YXJrMRYwFAYDVQQKEw1SZWQgSGF0LCBJbmMuMSEwHwYDVQQLExhSZWQgSGF0IE5l +dHdvcmsgU2VydmljZXMxIzAhBgNVBAMTGlJITlMgQ2VydGlmaWNhdGUgQXV0aG9y +aXR5MR4wHAYJKoZIhvcNAQkBFg9yaG5zQHJlZGhhdC5jb20wgZ8wDQYJKoZIhvcN +AQEBBQADgY0AMIGJAoGBAMBoKxIw4iEtIsZycVu/F6CTEOmb48mNOy2sxLuVO+DK +VTLclcIQswSyUfvohWEWNKW0HWdcp3f08JLatIuvlZNi82YprsCIt2SEDkiQYPhg +PgB/VN0XpqwY4ELefL6Qgff0BYUKCMzV8p/8JIt3pT3pSKnvDztjo/6mg0zo3At3 +AgMBAAGjggEoMIIBJDAdBgNVHQ4EFgQUVBXNnyz37A0f0qi+TAesiD77mwowgfQG +A1UdIwSB7DCB6YAUVBXNnyz37A0f0qi+TAesiD77mwqhgc2kgcowgccxCzAJBgNV +BAYTAlVTMRcwFQYDVQQIEw5Ob3J0aCBDYXJvbGluYTEfMB0GA1UEBxMWUmVzZWFy +Y2ggVHJpYW5nbGUgUGFyazEWMBQGA1UEChMNUmVkIEhhdCwgSW5jLjEhMB8GA1UE +CxMYUmVkIEhhdCBOZXR3b3JrIFNlcnZpY2VzMSMwIQYDVQQDExpSSE5TIENlcnRp +ZmljYXRlIEF1dGhvcml0eTEeMBwGCSqGSIb3DQEJARYPcmhuc0ByZWRoYXQuY29t +ggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAkwGIiGdnkYye0BIU +kHESh1UK8lIbrfLTBx2vcJm7sM2AI8ntK3PpY7HQs4xgxUJkpsGVVpDFNQYDWPWO +K9n5qaAQqZn3FUKSpVDXEQfxAtXgcORVbirOJfhdzQsvEGH49iBCzMOJ+IpPgiQS +zzl/IagsjVKXUsX3X0KlhwlmsMw= +-----END CERTIFICATE----- + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=US, ST=North Carolina, L=Raleigh, O=Red Hat, Inc., OU=Red Hat Network, CN=RHN Certificate Authority/Email=rhn-noc@redhat.com + Validity + Not Before: Sep 5 20:45:16 2002 GMT + Not After : Sep 9 20:45:16 2007 GMT + Subject: C=US, ST=North Carolina, L=Raleigh, O=Red Hat, Inc., OU=Red Hat Network, CN=RHN Certificate Authority/Email=rhn-noc@redhat.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:b3:16:b7:c5:f5:b9:69:51:1f:cd:b4:3d:70:cf: + 60:57:85:a4:2a:a7:5d:28:22:0e:ec:19:e2:92:f7: + 48:97:a6:a6:1f:51:95:83:11:8f:9a:98:a2:90:e0: + cb:4a:24:19:94:a8:8a:4b:88:b4:06:6c:ce:77:d7: + 15:3b:3c:cd:66:83:cf:23:1d:0d:bc:0a:0c:cb:1f: + cb:40:fb:f3:d9:fe:2a:b4:85:2c:7b:c9:a1:fe:f3: + 8f:68:1d:f2:12:b1:a4:16:19:ce:0f:b8:9a:9c:d9: + bc:5f:49:62:b2:95:93:ce:5d:2e:dd:79:3c:f1:5b: + a6:b7:a2:b5:39:0d:8e:12:31 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + 7F:1B:64:A1:2E:02:C5:A8:7D:B8:D1:B1:8B:06:9D:A3:A9:50:63:92 + X509v3 Authority Key Identifier: + keyid:7F:1B:64:A1:2E:02:C5:A8:7D:B8:D1:B1:8B:06:9D:A3:A9:50:63:92 + DirName:/C=US/ST=North Carolina/L=Raleigh/O=Red Hat, Inc./OU=Red Hat Network/CN=RHN Certificate Authority/Email=rhn-noc@redhat.com + serial:00 + + X509v3 Basic Constraints: + CA:TRUE + Signature Algorithm: md5WithRSAEncryption + 28:4d:42:e5:34:22:dd:c6:86:63:04:75:52:67:17:45:72:f2: + 3b:21:2b:45:59:72:73:f7:59:36:9d:57:43:c6:dc:94:0f:0e: + ff:13:5c:4f:50:37:85:b2:e4:c2:1f:35:9f:74:f4:e7:53:fb: + a1:06:b8:39:ce:e4:0a:86:7b:5f:28:5d:c7:11:9e:12:a5:d6: + b9:6c:e9:18:09:d5:f0:42:e7:54:b5:91:9e:23:ad:12:7a:aa: + 72:7c:39:3c:83:f8:75:a4:7b:03:92:ff:2a:d4:c5:76:19:12: + fa:b4:3b:b0:89:2c:95:8c:01:90:0d:d8:ba:06:05:61:00:ac: + 95:da +-----BEGIN CERTIFICATE----- +MIID7jCCA1egAwIBAgIBADANBgkqhkiG9w0BAQQFADCBsTELMAkGA1UEBhMCVVMx +FzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRAwDgYDVQQHEwdSYWxlaWdoMRYwFAYD +VQQKEw1SZWQgSGF0LCBJbmMuMRgwFgYDVQQLEw9SZWQgSGF0IE5ldHdvcmsxIjAg +BgNVBAMTGVJITiBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEW +EnJobi1ub2NAcmVkaGF0LmNvbTAeFw0wMjA5MDUyMDQ1MTZaFw0wNzA5MDkyMDQ1 +MTZaMIGxMQswCQYDVQQGEwJVUzEXMBUGA1UECBMOTm9ydGggQ2Fyb2xpbmExEDAO +BgNVBAcTB1JhbGVpZ2gxFjAUBgNVBAoTDVJlZCBIYXQsIEluYy4xGDAWBgNVBAsT +D1JlZCBIYXQgTmV0d29yazEiMCAGA1UEAxMZUkhOIENlcnRpZmljYXRlIEF1dGhv +cml0eTEhMB8GCSqGSIb3DQEJARYScmhuLW5vY0ByZWRoYXQuY29tMIGfMA0GCSqG +SIb3DQEBAQUAA4GNADCBiQKBgQCzFrfF9blpUR/NtD1wz2BXhaQqp10oIg7sGeKS +90iXpqYfUZWDEY+amKKQ4MtKJBmUqIpLiLQGbM531xU7PM1mg88jHQ28CgzLH8tA ++/PZ/iq0hSx7yaH+849oHfISsaQWGc4PuJqc2bxfSWKylZPOXS7deTzxW6a3orU5 +DY4SMQIDAQABo4IBEjCCAQ4wHQYDVR0OBBYEFH8bZKEuAsWofbjRsYsGnaOpUGOS +MIHeBgNVHSMEgdYwgdOAFH8bZKEuAsWofbjRsYsGnaOpUGOSoYG3pIG0MIGxMQsw +CQYDVQQGEwJVUzEXMBUGA1UECBMOTm9ydGggQ2Fyb2xpbmExEDAOBgNVBAcTB1Jh +bGVpZ2gxFjAUBgNVBAoTDVJlZCBIYXQsIEluYy4xGDAWBgNVBAsTD1JlZCBIYXQg +TmV0d29yazEiMCAGA1UEAxMZUkhOIENlcnRpZmljYXRlIEF1dGhvcml0eTEhMB8G +CSqGSIb3DQEJARYScmhuLW5vY0ByZWRoYXQuY29tggEAMAwGA1UdEwQFMAMBAf8w +DQYJKoZIhvcNAQEEBQADgYEAKE1C5TQi3caGYwR1UmcXRXLyOyErRVlyc/dZNp1X +Q8bclA8O/xNcT1A3hbLkwh81n3T051P7oQa4Oc7kCoZ7XyhdxxGeEqXWuWzpGAnV +8ELnVLWRniOtEnqqcnw5PIP4daR7A5L/KtTFdhkS+rQ7sIkslYwBkA3YugYFYQCs +ldo= +-----END CERTIFICATE----- + +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 0 (0x0) + Signature Algorithm: md5WithRSAEncryption + Issuer: C=US, ST=North Carolina, L=Raleigh, O=Red Hat, Inc., OU=Red Hat Network, CN=RHN Certificate Authority/emailAddress=rhn-noc@redhat.com + Validity + Not Before: Aug 29 02:10:55 2003 GMT + Not After : Aug 26 02:10:55 2013 GMT + Subject: C=US, ST=North Carolina, L=Raleigh, O=Red Hat, Inc., OU=Red Hat Network, CN=RHN Certificate Authority/emailAddress=rhn-noc@redhat.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (1024 bit) + Modulus (1024 bit): + 00:bf:61:63:eb:3d:8b:2b:45:48:e6:c2:fb:7c:d2: + 21:21:b8:ec:90:93:41:30:7c:2c:8d:79:d5:14:e9: + 0e:7e:3f:ef:d6:0a:9b:0a:a6:02:52:01:2d:26:96: + a4:ed:bd:a9:9e:aa:08:03:c1:61:0a:41:80:ea:ae: + 74:cc:61:26:d0:05:91:55:3e:66:14:a2:20:b3:d6: + 9d:71:0c:ab:77:cc:f4:f0:11:b5:25:33:8a:4e:22: + 9a:10:36:67:fa:11:6d:48:76:3a:1f:d2:e3:44:7b: + 89:66:be:b4:85:fb:2f:a6:aa:13:fa:9a:6d:c9:bb: + 18:c4:04:af:4f:15:69:89:9b + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Subject Key Identifier: + 69:44:27:05:DC:2E:ED:A5:F4:81:C4:D7:78:45:E7:44:5D:F8:87:47 + X509v3 Authority Key Identifier: + keyid:69:44:27:05:DC:2E:ED:A5:F4:81:C4:D7:78:45:E7:44:5D:F8:87:47 + DirName:/C=US/ST=North Carolina/L=Raleigh/O=Red Hat, Inc./OU=Red Hat Network/CN=RHN Certificate Authority/emailAddress=rhn-noc@redhat.com + serial:00 + + X509v3 Basic Constraints: + CA:TRUE + Signature Algorithm: md5WithRSAEncryption + 23:c9:ca:07:9f:5e:96:39:83:e0:4e:da:dd:47:84:30:ca:d4: + d5:38:86:f9:de:88:83:ca:2c:47:26:36:ab:f4:14:1e:28:29: + de:7d:10:4a:5e:91:3e:5a:99:07:0c:a9:2e:e3:fb:78:44:49: + c5:32:d6:e8:7a:97:ff:29:d0:33:ae:26:ba:76:06:7e:79:97: + 17:0c:4f:2d:2a:8b:8a:ac:41:59:ae:e9:c4:55:2d:b9:88:df: + 9b:7b:41:f8:32:2e:ee:c9:c0:59:e2:30:57:5e:37:47:29:c0: + 2d:78:33:d3:ce:a3:2b:dc:84:da:bf:3b:2e:4b:b6:b3:b6:4e: + 9e:80 +-----BEGIN CERTIFICATE----- +MIID7jCCA1egAwIBAgIBADANBgkqhkiG9w0BAQQFADCBsTELMAkGA1UEBhMCVVMx +FzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRAwDgYDVQQHEwdSYWxlaWdoMRYwFAYD +VQQKEw1SZWQgSGF0LCBJbmMuMRgwFgYDVQQLEw9SZWQgSGF0IE5ldHdvcmsxIjAg +BgNVBAMTGVJITiBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEW +EnJobi1ub2NAcmVkaGF0LmNvbTAeFw0wMzA4MjkwMjEwNTVaFw0xMzA4MjYwMjEw +NTVaMIGxMQswCQYDVQQGEwJVUzEXMBUGA1UECBMOTm9ydGggQ2Fyb2xpbmExEDAO +BgNVBAcTB1JhbGVpZ2gxFjAUBgNVBAoTDVJlZCBIYXQsIEluYy4xGDAWBgNVBAsT +D1JlZCBIYXQgTmV0d29yazEiMCAGA1UEAxMZUkhOIENlcnRpZmljYXRlIEF1dGhv +cml0eTEhMB8GCSqGSIb3DQEJARYScmhuLW5vY0ByZWRoYXQuY29tMIGfMA0GCSqG +SIb3DQEBAQUAA4GNADCBiQKBgQC/YWPrPYsrRUjmwvt80iEhuOyQk0EwfCyNedUU +6Q5+P+/WCpsKpgJSAS0mlqTtvameqggDwWEKQYDqrnTMYSbQBZFVPmYUoiCz1p1x +DKt3zPTwEbUlM4pOIpoQNmf6EW1Idjof0uNEe4lmvrSF+y+mqhP6mm3JuxjEBK9P +FWmJmwIDAQABo4IBEjCCAQ4wHQYDVR0OBBYEFGlEJwXcLu2l9IHE13hF50Rd+IdH +MIHeBgNVHSMEgdYwgdOAFGlEJwXcLu2l9IHE13hF50Rd+IdHoYG3pIG0MIGxMQsw +CQYDVQQGEwJVUzEXMBUGA1UECBMOTm9ydGggQ2Fyb2xpbmExEDAOBgNVBAcTB1Jh +bGVpZ2gxFjAUBgNVBAoTDVJlZCBIYXQsIEluYy4xGDAWBgNVBAsTD1JlZCBIYXQg +TmV0d29yazEiMCAGA1UEAxMZUkhOIENlcnRpZmljYXRlIEF1dGhvcml0eTEhMB8G +CSqGSIb3DQEJARYScmhuLW5vY0ByZWRoYXQuY29tggEAMAwGA1UdEwQFMAMBAf8w +DQYJKoZIhvcNAQEEBQADgYEAI8nKB59eljmD4E7a3UeEMMrU1TiG+d6Ig8osRyY2 +q/QUHigp3n0QSl6RPlqZBwypLuP7eERJxTLW6HqX/ynQM64munYGfnmXFwxPLSqL +iqxBWa7pxFUtuYjfm3tB+DIu7snAWeIwV143RynALXgz086jK9yE2r87Lku2s7ZO +noA= +-----END CERTIFICATE----- diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index a10737e90c..5bb7b29c57 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -47,6 +47,7 @@ #include #endif +#include "os_port.h" #include "ssl.h" #define DEFAULT_CERT "../ssl/test/axTLS.x509_512.cer" @@ -694,6 +695,16 @@ static int cert_tests(void) x509_free(x509_ctx); free(buf); + ssl_ctx = ssl_ctx_new(0, 0); + if (ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CACERT, + "../ssl/test/ca-bundle.crt", NULL)) + { + printf("Cert #10\n"); + goto bad_cert; + } + + ssl_ctx_free(ssl_ctx); + res = 0; /* all ok */ printf("All Certificate tests passed\n"); @@ -1008,7 +1019,8 @@ int SSL_server_tests(void) /* * 512 bit RSA key */ - if ((ret = SSL_server_test("512 bit key", "-cipher RC4-SHA", + if ((ret = SSL_server_test("512 bit key", + "-cipher RC4-SHA", "../ssl/test/axTLS.x509_512.cer", NULL, "../ssl/test/axTLS.key_512", NULL, NULL, DEFAULT_SVR_OPTION))) @@ -1018,13 +1030,21 @@ int SSL_server_tests(void) * 1024 bit RSA key (check certificate chaining) */ if ((ret = SSL_server_test("1024 bit key", - "-cipher RC4-SHA", - "../ssl/test/axTLS.x509_device.cer", - "../ssl/test/axTLS.x509_512.cer", - "../ssl/test/axTLS.device_key", + "-cipher RC4-SHA", + "../ssl/test/axTLS.x509_1024.cer", NULL, + "../ssl/test/axTLS.key_1024", NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; + /* + * 1042 bit RSA key (check certificate chaining) + */ + if ((ret = SSL_server_test("1042 bit key", + "-cipher RC4-SHA", + "../ssl/test/axTLS.x509_1042.cer", NULL, + "../ssl/test/axTLS.key_1042", + NULL, NULL, DEFAULT_SVR_OPTION))) + goto cleanup; /* * 2048 bit RSA key */ @@ -1311,7 +1331,7 @@ static int SSL_client_test( #endif } - sleep(5); /* allow server to start */ + usleep(500000); /* allow server to start */ if (*ssl_ctx == NULL) { @@ -1354,8 +1374,8 @@ static int SSL_client_test( } } - if (ssl_obj_load(*ssl_ctx, SSL_OBJ_X509_CACERT, - "../ssl/test/axTLS.ca_x509.cer", NULL)) + if (ssl_obj_load(*ssl_ctx, SSL_OBJ_X509_CACERT, + "../ssl/test/axTLS.ca_x509.cer", NULL)) { printf("could not add cert auth\n"); TTY_FLUSH(); goto client_test_exit; @@ -1566,6 +1586,23 @@ int SSL_client_tests(void) } printf("SSL client test \"Expired cert (verify later)\" passed\n"); + + /* invalid cert type */ + if ((ret = SSL_client_test("Error: Invalid certificate type", + &ssl_ctx, + "-cert ../ssl/test/axTLS.x509_2048.pem " + "-key ../ssl/test/axTLS.key_2048.pem " + "-CAfile ../ssl/test/axTLS.ca_x509.pem " + "-verify 1 ", NULL, DEFAULT_CLNT_OPTION, + "../ssl/test/axTLS.x509_1024.cer", NULL, + "../ssl/test/axTLS.x509_1024.cer")) + != SSL_ERROR_INVALID_KEY) + { + printf("*** Error: %d\n", ret); TTY_FLUSH(); + goto cleanup; + } + + printf("SSL client test \"Invalid certificate type\" passed\n"); ret = 0; cleanup: diff --git a/ssl/tls1.c b/ssl/tls1.c index 9d1be37829..2d5ab76d6b 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -399,7 +399,7 @@ int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) while (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) i++; - if (i > CONFIG_X509_MAX_CA_CERTS) + if (i >= CONFIG_X509_MAX_CA_CERTS) { #ifdef CONFIG_SSL_FULL_MODE printf("Error: maximum number of CA certs added - change of " @@ -422,7 +422,6 @@ int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) return ret; } - /* * Retrieve an X.509 distinguished name component */ From 9e082c868e4a905b9fd6e391fa5dc01a51f856b4 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Tue, 4 Jan 2011 01:34:46 +0000 Subject: [PATCH 158/301] Ignore CA cert errors (caused by invalid signature types in cert bundles) git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@189 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/bigint.c | 8 ++++---- ssl/asn1.c | 4 ++-- ssl/test/ssltest.c | 21 +++++++++++---------- ssl/tls1.c | 6 ++---- ssl/x509.c | 5 ++++- 5 files changed, 23 insertions(+), 21 deletions(-) diff --git a/crypto/bigint.c b/crypto/bigint.c index d131e8ab54..93195c623b 100644 --- a/crypto/bigint.c +++ b/crypto/bigint.c @@ -961,17 +961,17 @@ static bigint *regular_square(BI_CTX *ctx, bigint *bi) { uint8_t c = 0; long_comp xx = (long_comp)x[i]*x[j]; - if (COMP_MAX-xx < xx) + if ((COMP_MAX-xx) < xx) c = 1; tmp = (xx<<1); - if (COMP_MAX-tmp < w[i+j]) + if ((COMP_MAX-tmp) < w[i+j]) c = 1; tmp += w[i+j]; - if (COMP_MAX-tmp < carry) + if ((COMP_MAX-tmp) < carry) c = 1; tmp += carry; @@ -982,7 +982,7 @@ static bigint *regular_square(BI_CTX *ctx, bigint *bi) carry += COMP_RADIX; } - tmp = carry + w[i+t]; + tmp = w[i+t] + carry; w[i+t] = (comp)tmp; w[i+t+1] = tmp >> COMP_BIT_SIZE; } while (++i < t); diff --git a/ssl/asn1.c b/ssl/asn1.c index ca2701ef3a..d99b0a8b54 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -50,7 +50,7 @@ static const uint8_t sig_oid_prefix[SIG_OID_PREFIX_SIZE] = 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01 }; -static const uint8_t sig_iis6_oid[SIG_IIS6_OID_SIZE] = +static const uint8_t sig_sha1WithRSAEncrypt[SIG_IIS6_OID_SIZE] = { 0x2b, 0x0e, 0x03, 0x02, 0x1d }; @@ -540,7 +540,7 @@ int asn1_signature_type(const uint8_t *cert, len = get_asn1_length(cert, offset); - if (len == 5 && memcmp(sig_iis6_oid, &cert[*offset], + if (len == 5 && memcmp(sig_sha1WithRSAEncrypt, &cert[*offset], SIG_IIS6_OID_SIZE) == 0) { x509_ctx->sig_type = SIG_TYPE_SHA1; diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 5bb7b29c57..9712402c70 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -572,6 +572,17 @@ static int cert_tests(void) SSL_CTX *ssl_ctx; uint8_t *buf; + ssl_ctx = ssl_ctx_new(0, 0); + if (ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CACERT, + "../ssl/test/ca-bundle.crt", NULL)) + { + printf("Cert #10\n"); + goto bad_cert; + } + + ssl_ctx_free(ssl_ctx); + exit(0); + /* check a bunch of 3rd party certificates */ ssl_ctx = ssl_ctx_new(0, 0); len = get_file("../ssl/test/microsoft.x509_ca", &buf); @@ -695,16 +706,6 @@ static int cert_tests(void) x509_free(x509_ctx); free(buf); - ssl_ctx = ssl_ctx_new(0, 0); - if (ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CACERT, - "../ssl/test/ca-bundle.crt", NULL)) - { - printf("Cert #10\n"); - goto bad_cert; - } - - ssl_ctx_free(ssl_ctx); - res = 0; /* all ok */ printf("All Certificate tests passed\n"); diff --git a/ssl/tls1.c b/ssl/tls1.c index 2d5ab76d6b..84632020a8 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -386,9 +386,9 @@ int add_cert(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) */ int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) { - int ret = SSL_ERROR_NO_CERT_DEFINED; int i = 0; int offset; + int ret = SSL_OK; /* ignore errors for now */ CA_CERT_CTX *ca_cert_ctx; if (ssl_ctx->ca_cert_ctx == NULL) @@ -408,9 +408,7 @@ int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) goto error; } - if ((ret = x509_new(buf, &offset, &ca_cert_ctx->cert[i]))) - goto error; - + ret = x509_new(buf, &offset, &ca_cert_ctx->cert[i]); len -= offset; ret = SSL_OK; /* ok so far */ diff --git a/ssl/x509.c b/ssl/x509.c index dcdea04f1f..c297ed67fc 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -113,7 +113,9 @@ int x509_new(const uint8_t *cert, int *len, X509_CTX **ctx) asn1_validity(cert, &offset, x509_ctx) || asn1_name(cert, &offset, x509_ctx->cert_dn) || asn1_public_key(cert, &offset, x509_ctx)) + { goto end_cert; + } bi_ctx = x509_ctx->rsa_ctx->bi_ctx; @@ -210,7 +212,8 @@ int x509_new(const uint8_t *cert, int *len, X509_CTX **ctx) #ifdef CONFIG_SSL_FULL_MODE if (ret) { - printf("Error: Invalid X509 ASN.1 file\n"); + printf("Error: Invalid X509 ASN.1 file (%s)\n", + x509_display_error(ret)); } #endif From 26e256c758752b371a1f7467ff7da385c8f6181c Mon Sep 17 00:00:00 2001 From: cameronrich Date: Tue, 4 Jan 2011 04:20:21 +0000 Subject: [PATCH 159/301] Added some certificate loading tweaks. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@190 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/Config.in | 2 +- ssl/loader.c | 131 +- ssl/test/ca-bundle.crt | 10832 ++++++++++++--------------------------- ssl/test/ssltest.c | 41 +- ssl/tls1.c | 29 +- ssl/x509.c | 6 +- 6 files changed, 3323 insertions(+), 7718 deletions(-) diff --git a/ssl/Config.in b/ssl/Config.in index 557499c0dc..cd84c9566f 100644 --- a/ssl/Config.in +++ b/ssl/Config.in @@ -252,7 +252,7 @@ config CONFIG_SSL_EXPIRY_TIME config CONFIG_X509_MAX_CA_CERTS int "Maximum number of certificate authorites" - default 120 if CONFIG_SSL_CERT_VERIFICATION + default 150 if CONFIG_SSL_CERT_VERIFICATION depends on !CONFIG_SSL_SERVER_ONLY && !CONFIG_SSL_SKELETON_MODE help Determines the number of CA's allowed. diff --git a/ssl/loader.c b/ssl/loader.c index ab3c266519..96679a5667 100644 --- a/ssl/loader.c +++ b/ssl/loader.c @@ -290,78 +290,91 @@ static int pem_decrypt(const char *where, const char *end, static int new_pem_obj(SSL_CTX *ssl_ctx, int is_cacert, char *where, int remain, const char *password) { - int ret = SSL_OK; + int ret = SSL_ERROR_BAD_CERTIFICATE; SSLObjLoader *ssl_obj = NULL; - int i, pem_size, obj_type; - char *start = NULL, *end = NULL; - for (i = 0; i < NUM_PEM_TYPES; i++) + while (remain > 0) { - if ((start = strstr(where, begins[i])) && - (end = strstr(where, ends[i]))) - { - remain -= (int)(end-start); - start += strlen(begins[i]); - pem_size = (int)(end-start); - - ssl_obj = (SSLObjLoader *)calloc(1, sizeof(SSLObjLoader)); + int i, pem_size, obj_type; + char *start = NULL, *end = NULL; - /* 4/3 bigger than what we need but so what */ - ssl_obj->buf = (uint8_t *)calloc(1, pem_size); - - if (i == IS_RSA_PRIVATE_KEY && - strstr(start, "Proc-Type:") && - strstr(start, "4,ENCRYPTED")) + for (i = 0; i < NUM_PEM_TYPES; i++) + { + if ((start = strstr(where, begins[i])) && + (end = strstr(where, ends[i]))) { - /* check for encrypted PEM file */ - if (pem_decrypt(start, end, password, ssl_obj) < 0) + remain -= (int)(end-start); + start += strlen(begins[i]); + pem_size = (int)(end-start); + + ssl_obj = (SSLObjLoader *)calloc(1, sizeof(SSLObjLoader)); + + /* 4/3 bigger than what we need but so what */ + ssl_obj->buf = (uint8_t *)calloc(1, pem_size); + + if (i == IS_RSA_PRIVATE_KEY && + strstr(start, "Proc-Type:") && + strstr(start, "4,ENCRYPTED")) + { + /* check for encrypted PEM file */ + if (pem_decrypt(start, end, password, ssl_obj) < 0) + { + ret = SSL_ERROR_BAD_CERTIFICATE; + goto error; + } + } + else if (base64_decode(start, pem_size, + ssl_obj->buf, &ssl_obj->len) != 0) + { + ret = SSL_ERROR_BAD_CERTIFICATE; goto error; - } - else if (base64_decode(start, pem_size, - ssl_obj->buf, &ssl_obj->len) != 0) - goto error; - - switch (i) - { - case IS_RSA_PRIVATE_KEY: - obj_type = SSL_OBJ_RSA_KEY; - break; - - case IS_ENCRYPTED_PRIVATE_KEY: - obj_type = SSL_OBJ_PKCS8; - break; - - case IS_CERTIFICATE: - obj_type = is_cacert ? - SSL_OBJ_X509_CACERT : SSL_OBJ_X509_CERT; - break; - - default: + } + + switch (i) + { + case IS_RSA_PRIVATE_KEY: + obj_type = SSL_OBJ_RSA_KEY; + break; + + case IS_ENCRYPTED_PRIVATE_KEY: + obj_type = SSL_OBJ_PKCS8; + break; + + case IS_CERTIFICATE: + obj_type = is_cacert ? + SSL_OBJ_X509_CACERT : SSL_OBJ_X509_CERT; + break; + + default: + ret = SSL_ERROR_BAD_CERTIFICATE; + goto error; + } + + /* In a format we can now understand - so process it */ + if ((ret = do_obj(ssl_ctx, obj_type, ssl_obj, password))) goto error; - } - /* In a format we can now understand - so process it */ - if ((ret = do_obj(ssl_ctx, obj_type, ssl_obj, password))) - goto error; + end += strlen(ends[i]); + remain -= strlen(ends[i]); + while (remain > 0 && (*end == '\r' || *end == '\n')) + { + end++; + remain--; + } - end += strlen(ends[i]); - remain -= strlen(ends[i]); - while (remain > 0 && (*end == '\r' || *end == '\n')) - { - end++; - remain--; + break; } - - break; } - } - if (i == NUM_PEM_TYPES) - goto error; + ssl_obj_free(ssl_obj); + ssl_obj = NULL; - /* more PEM stuff to process? */ - if (remain) - ret = new_pem_obj(ssl_ctx, is_cacert, end, remain, password); + if (i == NUM_PEM_TYPES) + { + ret = SSL_ERROR_BAD_CERTIFICATE; + goto error; + } + } error: ssl_obj_free(ssl_obj); diff --git a/ssl/test/ca-bundle.crt b/ssl/test/ca-bundle.crt index 1e5553b213..0c002393a3 100644 --- a/ssl/test/ca-bundle.crt +++ b/ssl/test/ca-bundle.crt @@ -1,577 +1,56 @@ -# This is a bundle of X.509 certificates of public Certificate -# Authorities. It was generated from the Mozilla root CA list. -# -# Source: mozilla/security/nss/lib/ckfw/builtins/certdata.txt -# -# Generated from certdata.txt RCS revision 1.39 -# -Certificate: - Data: - Version: 1 (0x0) - Serial Number: - 02:ad:66:7e:4e:45:fe:5e:57:6f:3c:98:19:5e:dd:c0 - Signature Algorithm: md2WithRSAEncryption - Issuer: C=US, O=RSA Data Security, Inc., OU=Secure Server Certification Authority - Validity - Not Before: Nov 9 00:00:00 1994 GMT - Not After : Jan 7 23:59:59 2010 GMT - Subject: C=US, O=RSA Data Security, Inc., OU=Secure Server Certification Authority - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1000 bit) - Modulus (1000 bit): - 00:92:ce:7a:c1:ae:83:3e:5a:aa:89:83:57:ac:25: - 01:76:0c:ad:ae:8e:2c:37:ce:eb:35:78:64:54:03: - e5:84:40:51:c9:bf:8f:08:e2:8a:82:08:d2:16:86: - 37:55:e9:b1:21:02:ad:76:68:81:9a:05:a2:4b:c9: - 4b:25:66:22:56:6c:88:07:8f:f7:81:59:6d:84:07: - 65:70:13:71:76:3e:9b:77:4c:e3:50:89:56:98:48: - b9:1d:a7:29:1a:13:2e:4a:11:59:9c:1e:15:d5:49: - 54:2c:73:3a:69:82:b1:97:39:9c:6d:70:67:48:e5: - dd:2d:d6:c8:1e:7b - Exponent: 65537 (0x10001) - Signature Algorithm: md2WithRSAEncryption - 65:dd:7e:e1:b2:ec:b0:e2:3a:e0:ec:71:46:9a:19:11:b8:d3: - c7:a0:b4:03:40:26:02:3e:09:9c:e1:12:b3:d1:5a:f6:37:a5: - b7:61:03:b6:5b:16:69:3b:c6:44:08:0c:88:53:0c:6b:97:49: - c7:3e:35:dc:6c:b9:bb:aa:df:5c:bb:3a:2f:93:60:b6:a9:4b: - 4d:f2:20:f7:cd:5f:7f:64:7b:8e:dc:00:5c:d7:fa:77:ca:39: - 16:59:6f:0e:ea:d3:b5:83:7f:4d:4d:42:56:76:b4:c9:5f:04: - f8:38:f8:eb:d2:5f:75:5f:cd:7b:fc:e5:8e:80:7c:fc:50 -MD5 Fingerprint=74:7B:82:03:43:F0:00:9E:6B:B3:EC:47:BF:85:A5:93 -----BEGIN CERTIFICATE----- -MIICNDCCAaECEAKtZn5ORf5eV288mBle3cAwDQYJKoZIhvcNAQECBQAwXzELMAkG -A1UEBhMCVVMxIDAeBgNVBAoTF1JTQSBEYXRhIFNlY3VyaXR5LCBJbmMuMS4wLAYD -VQQLEyVTZWN1cmUgU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk0 -MTEwOTAwMDAwMFoXDTEwMDEwNzIzNTk1OVowXzELMAkGA1UEBhMCVVMxIDAeBgNV -BAoTF1JTQSBEYXRhIFNlY3VyaXR5LCBJbmMuMS4wLAYDVQQLEyVTZWN1cmUgU2Vy -dmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGbMA0GCSqGSIb3DQEBAQUAA4GJ -ADCBhQJ+AJLOesGugz5aqomDV6wlAXYMra6OLDfO6zV4ZFQD5YRAUcm/jwjiioII -0haGN1XpsSECrXZogZoFokvJSyVmIlZsiAeP94FZbYQHZXATcXY+m3dM41CJVphI -uR2nKRoTLkoRWZweFdVJVCxzOmmCsZc5nG1wZ0jl3S3WyB57AgMBAAEwDQYJKoZI -hvcNAQECBQADfgBl3X7hsuyw4jrg7HFGmhkRuNPHoLQDQCYCPgmc4RKz0Vr2N6W3 -YQO2WxZpO8ZECAyIUwxrl0nHPjXcbLm7qt9cuzovk2C2qUtN8iD3zV9/ZHuO3ABc -1/p3yjkWWW8O6tO1g39NTUJWdrTJXwT4OPjr0l91X817/OWOgHz8UA== ------END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: 419 (0x1a3) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=US, O=GTE Corporation, CN=GTE CyberTrust Root - Validity - Not Before: Feb 23 23:01:00 1996 GMT - Not After : Feb 23 23:59:00 2006 GMT - Subject: C=US, O=GTE Corporation, CN=GTE CyberTrust Root - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:b8:e6:4f:ba:db:98:7c:71:7c:af:44:b7:d3:0f: - 46:d9:64:e5:93:c1:42:8e:c7:ba:49:8d:35:2d:7a: - e7:8b:bd:e5:05:31:59:c6:b1:2f:0a:0c:fb:9f:a7: - 3f:a2:09:66:84:56:1e:37:29:1b:87:e9:7e:0c:ca: - 9a:9f:a5:7f:f5:15:94:a3:d5:a2:46:82:d8:68:4c: - d1:37:15:06:68:af:bd:f8:b0:b3:f0:29:f5:95:5a: - 09:16:61:77:0a:22:25:d4:4f:45:aa:c7:bd:e5:96: - df:f9:d4:a8:8e:42:cc:24:c0:1e:91:27:4a:b5:6d: - 06:80:63:39:c4:a2:5e:38:03 - Exponent: 65537 (0x10001) - Signature Algorithm: md5WithRSAEncryption - 12:b3:75:c6:5f:1d:e1:61:55:80:00:d4:81:4b:7b:31:0f:23: - 63:e7:3d:f3:03:f9:f4:36:a8:bb:d9:e3:a5:97:4d:ea:2b:29: - e0:d6:6a:73:81:e6:c0:89:a3:d3:f1:e0:a5:a5:22:37:9a:63: - c2:48:20:b4:db:72:e3:c8:f6:d9:7c:be:b1:af:53:da:14:b4: - 21:b8:d6:d5:96:e3:fe:4e:0c:59:62:b6:9a:4a:f9:42:dd:8c: - 6f:81:a9:71:ff:f4:0a:72:6d:6d:44:0e:9d:f3:74:74:a8:d5: - 34:49:e9:5e:9e:e9:b4:7a:e1:e5:5a:1f:84:30:9c:d3:9f:a5: - 25:d8 -MD5 Fingerprint=C4:D7:F0:B2:A3:C5:7D:61:67:F0:04:CD:43:D3:BA:58 ------BEGIN CERTIFICATE----- -MIIB+jCCAWMCAgGjMA0GCSqGSIb3DQEBBAUAMEUxCzAJBgNVBAYTAlVTMRgwFgYD -VQQKEw9HVEUgQ29ycG9yYXRpb24xHDAaBgNVBAMTE0dURSBDeWJlclRydXN0IFJv -b3QwHhcNOTYwMjIzMjMwMTAwWhcNMDYwMjIzMjM1OTAwWjBFMQswCQYDVQQGEwJV -UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMRwwGgYDVQQDExNHVEUgQ3liZXJU -cnVzdCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC45k+625h8cXyv -RLfTD0bZZOWTwUKOx7pJjTUteueLveUFMVnGsS8KDPufpz+iCWaEVh43KRuH6X4M -ypqfpX/1FZSj1aJGgthoTNE3FQZor734sLPwKfWVWgkWYXcKIiXUT0Wqx73llt/5 -1KiOQswkwB6RJ0q1bQaAYznEol44AwIDAQABMA0GCSqGSIb3DQEBBAUAA4GBABKz -dcZfHeFhVYAA1IFLezEPI2PnPfMD+fQ2qLvZ46WXTeorKeDWanOB5sCJo9Px4KWl -IjeaY8JIILTbcuPI9tl8vrGvU9oUtCG41tWW4/5ODFlitppK+ULdjG+BqXH/9Apy -bW1EDp3zdHSo1TRJ6V6e6bR64eVaH4QwnNOfpSXY ------END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: 421 (0x1a5) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root - Validity - Not Before: Aug 13 00:29:00 1998 GMT - Not After : Aug 13 23:59:00 2018 GMT - Subject: C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:95:0f:a0:b6:f0:50:9c:e8:7a:c7:88:cd:dd:17: - 0e:2e:b0:94:d0:1b:3d:0e:f6:94:c0:8a:94:c7:06: - c8:90:97:c8:b8:64:1a:7a:7e:6c:3c:53:e1:37:28: - 73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af: - 8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c: - 72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac: - 8d:42:aa:24:01:39:e6:9c:3f:01:85:57:0d:58:87: - 45:f8:d3:85:aa:93:69:26:85:70:48:80:3f:12:15: - c7:79:b4:1f:05:2f:3b:62:99 - Exponent: 65537 (0x10001) - Signature Algorithm: md5WithRSAEncryption - 6d:eb:1b:09:e9:5e:d9:51:db:67:22:61:a4:2a:3c:48:77:e3: - a0:7c:a6:de:73:a2:14:03:85:3d:fb:ab:0e:30:c5:83:16:33: - 81:13:08:9e:7b:34:4e:df:40:c8:74:d7:b9:7d:dc:f4:76:55: - 7d:9b:63:54:18:e9:f0:ea:f3:5c:b1:d9:8b:42:1e:b9:c0:95: - 4e:ba:fa:d5:e2:7c:f5:68:61:bf:8e:ec:05:97:5f:5b:b0:d7: - a3:85:34:c4:24:a7:0d:0f:95:93:ef:cb:94:d8:9e:1f:9d:5c: - 85:6d:c7:aa:ae:4f:1f:22:b5:cd:95:ad:ba:a7:cc:f9:ab:0b: - 7a:7f -MD5 Fingerprint=CA:3D:D3:68:F1:03:5C:D0:32:FA:B8:2B:59:E8:5A:DB ------BEGIN CERTIFICATE----- -MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD -VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv -bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv -b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV -UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU -cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds -b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH -iM3dFw4usJTQGz0O9pTAipTHBsiQl8i4ZBp6fmw8U+E3KHNgf7KXUwefU/ltWJTS -r41tiGeA5u2ylc9yMcqlHHK6XALnZELn+aks1joNrI1CqiQBOeacPwGFVw1Yh0X4 -04Wqk2kmhXBIgD8SFcd5tB8FLztimQIDAQABMA0GCSqGSIb3DQEBBAUAA4GBAG3r -GwnpXtlR22ciYaQqPEh346B8pt5zohQDhT37qw4wxYMWM4ETCJ57NE7fQMh017l9 -3PR2VX2bY1QY6fDq81yx2YtCHrnAlU66+tXifPVoYb+O7AWXX1uw16OFNMQkpw0P -lZPvy5TYnh+dXIVtx6quTx8itc2VrbqnzPmrC3p/ ------END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Basic CA/emailAddress=personal-basic@thawte.com - Validity - Not Before: Jan 1 00:00:00 1996 GMT - Not After : Dec 31 23:59:59 2020 GMT - Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Basic CA/emailAddress=personal-basic@thawte.com - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:bc:bc:93:53:6d:c0:50:4f:82:15:e6:48:94:35: - a6:5a:be:6f:42:fa:0f:47:ee:77:75:72:dd:8d:49: - 9b:96:57:a0:78:d4:ca:3f:51:b3:69:0b:91:76:17: - 22:07:97:6a:c4:51:93:4b:e0:8d:ef:37:95:a1:0c: - 4d:da:34:90:1d:17:89:97:e0:35:38:57:4a:c0:f4: - 08:70:e9:3c:44:7b:50:7e:61:9a:90:e3:23:d3:88: - 11:46:27:f5:0b:07:0e:bb:dd:d1:7f:20:0a:88:b9: - 56:0b:2e:1c:80:da:f1:e3:9e:29:ef:14:bd:0a:44: - fb:1b:5b:18:d1:bf:23:93:21 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - Signature Algorithm: md5WithRSAEncryption - 2d:e2:99:6b:b0:3d:7a:89:d7:59:a2:94:01:1f:2b:dd:12:4b: - 53:c2:ad:7f:aa:a7:00:5c:91:40:57:25:4a:38:aa:84:70:b9: - d9:80:0f:a5:7b:5c:fb:73:c6:bd:d7:8a:61:5c:03:e3:2d:27: - a8:17:e0:84:85:42:dc:5e:9b:c6:b7:b2:6d:bb:74:af:e4:3f: - cb:a7:b7:b0:e0:5d:be:78:83:25:94:d2:db:81:0f:79:07:6d: - 4f:f4:39:15:5a:52:01:7b:de:32:d6:4d:38:f6:12:5c:06:50: - df:05:5b:bd:14:4b:a1:df:29:ba:3b:41:8d:f7:63:56:a1:df: - 22:b1 -MD5 Fingerprint=E6:0B:D2:C9:CA:2D:88:DB:1A:71:0E:4B:78:EB:02:41 ------BEGIN CERTIFICATE----- -MIIDITCCAoqgAwIBAgIBADANBgkqhkiG9w0BAQQFADCByzELMAkGA1UEBhMCWkEx -FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMRowGAYD -VQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT -ZXJ2aWNlcyBEaXZpc2lvbjEhMB8GA1UEAxMYVGhhd3RlIFBlcnNvbmFsIEJhc2lj -IENBMSgwJgYJKoZIhvcNAQkBFhlwZXJzb25hbC1iYXNpY0B0aGF3dGUuY29tMB4X -DTk2MDEwMTAwMDAwMFoXDTIwMTIzMTIzNTk1OVowgcsxCzAJBgNVBAYTAlpBMRUw -EwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UE -ChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRpb24gU2Vy -dmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQZXJzb25hbCBCYXNpYyBD -QTEoMCYGCSqGSIb3DQEJARYZcGVyc29uYWwtYmFzaWNAdGhhd3RlLmNvbTCBnzAN -BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvLyTU23AUE+CFeZIlDWmWr5vQvoPR+53 -dXLdjUmbllegeNTKP1GzaQuRdhciB5dqxFGTS+CN7zeVoQxN2jSQHReJl+A1OFdK -wPQIcOk8RHtQfmGakOMj04gRRif1CwcOu93RfyAKiLlWCy4cgNrx454p7xS9CkT7 -G1sY0b8jkyECAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQQF -AAOBgQAt4plrsD16iddZopQBHyvdEktTwq1/qqcAXJFAVyVKOKqEcLnZgA+le1z7 -c8a914phXAPjLSeoF+CEhULcXpvGt7Jtu3Sv5D/Lp7ew4F2+eIMllNLbgQ95B21P -9DkVWlIBe94y1k049hJcBlDfBVu9FEuh3ym6O0GN92NWod8isQ== ------END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Premium CA/emailAddress=personal-premium@thawte.com - Validity - Not Before: Jan 1 00:00:00 1996 GMT - Not After : Dec 31 23:59:59 2020 GMT - Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Premium CA/emailAddress=personal-premium@thawte.com - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:c9:66:d9:f8:07:44:cf:b9:8c:2e:f0:a1:ef:13: - 45:6c:05:df:de:27:16:51:36:41:11:6c:6c:3b:ed: - fe:10:7d:12:9e:e5:9b:42:9a:fe:60:31:c3:66:b7: - 73:3a:48:ae:4e:d0:32:37:94:88:b5:0d:b6:d9:f3: - f2:44:d9:d5:88:12:dd:76:4d:f2:1a:fc:6f:23:1e: - 7a:f1:d8:98:45:4e:07:10:ef:16:42:d0:43:75:6d: - 4a:de:e2:aa:c9:31:ff:1f:00:70:7c:66:cf:10:25: - 08:ba:fa:ee:00:e9:46:03:66:27:11:15:3b:aa:5b: - f2:98:dd:36:42:b2:da:88:75 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - Signature Algorithm: md5WithRSAEncryption - 69:36:89:f7:34:2a:33:72:2f:6d:3b:d4:22:b2:b8:6f:9a:c5: - 36:66:0e:1b:3c:a1:b1:75:5a:e6:fd:35:d3:f8:a8:f2:07:6f: - 85:67:8e:de:2b:b9:e2:17:b0:3a:a0:f0:0e:a2:00:9a:df:f3: - 14:15:6e:bb:c8:85:5a:98:80:f9:ff:be:74:1d:3d:f3:fe:30: - 25:d1:37:34:67:fa:a5:71:79:30:61:29:72:c0:e0:2c:4c:fb: - 56:e4:3a:a8:6f:e5:32:59:52:db:75:28:50:59:0c:f8:0b:19: - e4:ac:d9:af:96:8d:2f:50:db:07:c3:ea:1f:ab:33:e0:f5:2b: - 31:89 -MD5 Fingerprint=3A:B2:DE:22:9A:20:93:49:F9:ED:C8:D2:8A:E7:68:0D ------BEGIN CERTIFICATE----- -MIIDKTCCApKgAwIBAgIBADANBgkqhkiG9w0BAQQFADCBzzELMAkGA1UEBhMCWkEx -FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMRowGAYD -VQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT -ZXJ2aWNlcyBEaXZpc2lvbjEjMCEGA1UEAxMaVGhhd3RlIFBlcnNvbmFsIFByZW1p -dW0gQ0ExKjAoBgkqhkiG9w0BCQEWG3BlcnNvbmFsLXByZW1pdW1AdGhhd3RlLmNv -bTAeFw05NjAxMDEwMDAwMDBaFw0yMDEyMzEyMzU5NTlaMIHPMQswCQYDVQQGEwJa -QTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xGjAY -BgNVBAoTEVRoYXd0ZSBDb25zdWx0aW5nMSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9u -IFNlcnZpY2VzIERpdmlzaW9uMSMwIQYDVQQDExpUaGF3dGUgUGVyc29uYWwgUHJl -bWl1bSBDQTEqMCgGCSqGSIb3DQEJARYbcGVyc29uYWwtcHJlbWl1bUB0aGF3dGUu -Y29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJZtn4B0TPuYwu8KHvE0Vs -Bd/eJxZRNkERbGw77f4QfRKe5ZtCmv5gMcNmt3M6SK5O0DI3lIi1DbbZ8/JE2dWI -Et12TfIa/G8jHnrx2JhFTgcQ7xZC0EN1bUre4qrJMf8fAHB8Zs8QJQi6+u4A6UYD -ZicRFTuqW/KY3TZCstqIdQIDAQABoxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqG -SIb3DQEBBAUAA4GBAGk2ifc0KjNyL2071CKyuG+axTZmDhs8obF1Wub9NdP4qPIH -b4Vnjt4rueIXsDqg8A6iAJrf8xQVbrvIhVqYgPn/vnQdPfP+MCXRNzRn+qVxeTBh -KXLA4CxM+1bkOqhv5TJZUtt1KFBZDPgLGeSs2a+WjS9Q2wfD6h+rM+D1KzGJ ------END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Freemail CA/emailAddress=personal-freemail@thawte.com - Validity - Not Before: Jan 1 00:00:00 1996 GMT - Not After : Dec 31 23:59:59 2020 GMT - Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Freemail CA/emailAddress=personal-freemail@thawte.com - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:d4:69:d7:d4:b0:94:64:5b:71:e9:47:d8:0c:51: - b6:ea:72:91:b0:84:5e:7d:2d:0d:8f:7b:12:df:85: - 25:75:28:74:3a:42:2c:63:27:9f:95:7b:4b:ef:7e: - 19:87:1d:86:ea:a3:dd:b9:ce:96:64:1a:c2:14:6e: - 44:ac:7c:e6:8f:e8:4d:0f:71:1f:40:38:a6:00:a3: - 87:78:f6:f9:94:86:5e:ad:ea:c0:5e:76:eb:d9:14: - a3:5d:6e:7a:7c:0c:a5:4b:55:7f:06:19:29:7f:9e: - 9a:26:d5:6a:bb:38:24:08:6a:98:c7:b1:da:a3:98: - 91:fd:79:db:e5:5a:c4:1c:b9 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - Signature Algorithm: md5WithRSAEncryption - c7:ec:92:7e:4e:f8:f5:96:a5:67:62:2a:a4:f0:4d:11:60:d0: - 6f:8d:60:58:61:ac:26:bb:52:35:5c:08:cf:30:fb:a8:4a:96: - 8a:1f:62:42:23:8c:17:0f:f4:ba:64:9c:17:ac:47:29:df:9d: - 98:5e:d2:6c:60:71:5c:a2:ac:dc:79:e3:e7:6e:00:47:1f:b5: - 0d:28:e8:02:9d:e4:9a:fd:13:f4:a6:d9:7c:b1:f8:dc:5f:23: - 26:09:91:80:73:d0:14:1b:de:43:a9:83:25:f2:e6:9c:2f:15: - ca:fe:a6:ab:8a:07:75:8b:0c:dd:51:84:6b:e4:f8:d1:ce:77: - a2:81 -MD5 Fingerprint=1E:74:C3:86:3C:0C:35:C5:3E:C2:7F:EF:3C:AA:3C:D9 ------BEGIN CERTIFICATE----- -MIIDLTCCApagAwIBAgIBADANBgkqhkiG9w0BAQQFADCB0TELMAkGA1UEBhMCWkEx -FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMRowGAYD -VQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT -ZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVt -YWlsIENBMSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3dGUu -Y29tMB4XDTk2MDEwMTAwMDAwMFoXDTIwMTIzMTIzNTk1OVowgdExCzAJBgNVBAYT -AlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEa -MBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRp -b24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBG -cmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhh -d3RlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1GnX1LCUZFtx6UfY -DFG26nKRsIRefS0Nj3sS34UldSh0OkIsYyeflXtL734Zhx2G6qPduc6WZBrCFG5E -rHzmj+hND3EfQDimAKOHePb5lIZererAXnbr2RSjXW56fAylS1V/Bhkpf56aJtVq -uzgkCGqYx7Hao5iR/Xnb5VrEHLkCAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zAN -BgkqhkiG9w0BAQQFAAOBgQDH7JJ+Tvj1lqVnYiqk8E0RYNBvjWBYYawmu1I1XAjP -MPuoSpaKH2JCI4wXD/S6ZJwXrEcp352YXtJsYHFcoqzceePnbgBHH7UNKOgCneSa -/RP0ptl8sfjcXyMmCZGAc9AUG95DqYMl8uacLxXK/qarigd1iwzdUYRr5PjRznei -gQ== ------END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1 (0x1) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com - Validity - Not Before: Aug 1 00:00:00 1996 GMT - Not After : Dec 31 23:59:59 2020 GMT - Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Server CA/emailAddress=server-certs@thawte.com - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:d3:a4:50:6e:c8:ff:56:6b:e6:cf:5d:b6:ea:0c: - 68:75:47:a2:aa:c2:da:84:25:fc:a8:f4:47:51:da: - 85:b5:20:74:94:86:1e:0f:75:c9:e9:08:61:f5:06: - 6d:30:6e:15:19:02:e9:52:c0:62:db:4d:99:9e:e2: - 6a:0c:44:38:cd:fe:be:e3:64:09:70:c5:fe:b1:6b: - 29:b6:2f:49:c8:3b:d4:27:04:25:10:97:2f:e7:90: - 6d:c0:28:42:99:d7:4c:43:de:c3:f5:21:6d:54:9f: - 5d:c3:58:e1:c0:e4:d9:5b:b0:b8:dc:b4:7b:df:36: - 3a:c2:b5:66:22:12:d6:87:0d - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - Signature Algorithm: md5WithRSAEncryption - 07:fa:4c:69:5c:fb:95:cc:46:ee:85:83:4d:21:30:8e:ca:d9: - a8:6f:49:1a:e6:da:51:e3:60:70:6c:84:61:11:a1:1a:c8:48: - 3e:59:43:7d:4f:95:3d:a1:8b:b7:0b:62:98:7a:75:8a:dd:88: - 4e:4e:9e:40:db:a8:cc:32:74:b9:6f:0d:c6:e3:b3:44:0b:d9: - 8a:6f:9a:29:9b:99:18:28:3b:d1:e3:40:28:9a:5a:3c:d5:b5: - e7:20:1b:8b:ca:a4:ab:8d:e9:51:d9:e2:4c:2c:59:a9:da:b9: - b2:75:1b:f6:42:f2:ef:c7:f2:18:f9:89:bc:a3:ff:8a:23:2e: - 70:47 -MD5 Fingerprint=C5:70:C4:A2:ED:53:78:0C:C8:10:53:81:64:CB:D0:1D ------BEGIN CERTIFICATE----- -MIIDEzCCAnygAwIBAgIBATANBgkqhkiG9w0BAQQFADCBxDELMAkGA1UEBhMCWkEx -FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYD -VQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlv -biBTZXJ2aWNlcyBEaXZpc2lvbjEZMBcGA1UEAxMQVGhhd3RlIFNlcnZlciBDQTEm -MCQGCSqGSIb3DQEJARYXc2VydmVyLWNlcnRzQHRoYXd0ZS5jb20wHhcNOTYwODAx -MDAwMDAwWhcNMjAxMjMxMjM1OTU5WjCBxDELMAkGA1UEBhMCWkExFTATBgNVBAgT -DFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYDVQQKExRUaGF3 -dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBTZXJ2aWNl -cyBEaXZpc2lvbjEZMBcGA1UEAxMQVGhhd3RlIFNlcnZlciBDQTEmMCQGCSqGSIb3 -DQEJARYXc2VydmVyLWNlcnRzQHRoYXd0ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQAD -gY0AMIGJAoGBANOkUG7I/1Zr5s9dtuoMaHVHoqrC2oQl/Kj0R1HahbUgdJSGHg91 -yekIYfUGbTBuFRkC6VLAYttNmZ7iagxEOM3+vuNkCXDF/rFrKbYvScg71CcEJRCX -L+eQbcAoQpnXTEPew/UhbVSfXcNY4cDk2VuwuNy0e982OsK1ZiIS1ocNAgMBAAGj -EzARMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAB/pMaVz7lcxG -7oWDTSEwjsrZqG9JGubaUeNgcGyEYRGhGshIPllDfU+VPaGLtwtimHp1it2ITk6e -QNuozDJ0uW8NxuOzRAvZim+aKZuZGCg70eNAKJpaPNW15yAbi8qkq43pUdniTCxZ -qdq5snUb9kLy78fyGPmJvKP/iiMucEc= ------END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1 (0x1) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com - Validity - Not Before: Aug 1 00:00:00 1996 GMT - Not After : Dec 31 23:59:59 2020 GMT - Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:d2:36:36:6a:8b:d7:c2:5b:9e:da:81:41:62:8f: - 38:ee:49:04:55:d6:d0:ef:1c:1b:95:16:47:ef:18: - 48:35:3a:52:f4:2b:6a:06:8f:3b:2f:ea:56:e3:af: - 86:8d:9e:17:f7:9e:b4:65:75:02:4d:ef:cb:09:a2: - 21:51:d8:9b:d0:67:d0:ba:0d:92:06:14:73:d4:93: - cb:97:2a:00:9c:5c:4e:0c:bc:fa:15:52:fc:f2:44: - 6e:da:11:4a:6e:08:9f:2f:2d:e3:f9:aa:3a:86:73: - b6:46:53:58:c8:89:05:bd:83:11:b8:73:3f:aa:07: - 8d:f4:42:4d:e7:40:9d:1c:37 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - Signature Algorithm: md5WithRSAEncryption - 26:48:2c:16:c2:58:fa:e8:16:74:0c:aa:aa:5f:54:3f:f2:d7: - c9:78:60:5e:5e:6e:37:63:22:77:36:7e:b2:17:c4:34:b9:f5: - 08:85:fc:c9:01:38:ff:4d:be:f2:16:42:43:e7:bb:5a:46:fb: - c1:c6:11:1f:f1:4a:b0:28:46:c9:c3:c4:42:7d:bc:fa:ab:59: - 6e:d5:b7:51:88:11:e3:a4:85:19:6b:82:4c:a4:0c:12:ad:e9: - a4:ae:3f:f1:c3:49:65:9a:8c:c5:c8:3e:25:b7:94:99:bb:92: - 32:71:07:f0:86:5e:ed:50:27:a6:0d:a6:23:f9:bb:cb:a6:07: - 14:42 -MD5 Fingerprint=06:9F:69:79:16:66:90:02:1B:8C:8C:A2:C3:07:6F:3A ------BEGIN CERTIFICATE----- -MIIDJzCCApCgAwIBAgIBATANBgkqhkiG9w0BAQQFADCBzjELMAkGA1UEBhMCWkEx -FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYD -VQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlv -biBTZXJ2aWNlcyBEaXZpc2lvbjEhMB8GA1UEAxMYVGhhd3RlIFByZW1pdW0gU2Vy -dmVyIENBMSgwJgYJKoZIhvcNAQkBFhlwcmVtaXVtLXNlcnZlckB0aGF3dGUuY29t -MB4XDTk2MDgwMTAwMDAwMFoXDTIwMTIzMTIzNTk1OVowgc4xCzAJBgNVBAYTAlpB -MRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEdMBsG -A1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp -b24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl -cnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv -bTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo847kkE -VdbQ7xwblRZH7xhINTpS9CtqBo87L+pW46+GjZ4X9560ZXUCTe/LCaIhUdib0GfQ -ug2SBhRz1JPLlyoAnFxODLz6FVL88kRu2hFKbgifLy3j+ao6hnO2RlNYyIkFvYMR -uHM/qgeN9EJN50CdHDcCAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG -9w0BAQQFAAOBgQAmSCwWwlj66BZ0DKqqX1Q/8tfJeGBeXm43YyJ3Nn6yF8Q0ufUI -hfzJATj/Tb7yFkJD57taRvvBxhEf8UqwKEbJw8RCfbz6q1lu1bdRiBHjpIUZa4JM -pAwSremkrj/xw0llmozFyD4lt5SZu5IycQfwhl7tUCemDaYj+bvLpgcUQg== ------END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 903804111 (0x35def4cf) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=Equifax, OU=Equifax Secure Certificate Authority - Validity - Not Before: Aug 22 16:41:51 1998 GMT - Not After : Aug 22 16:41:51 2018 GMT - Subject: C=US, O=Equifax, OU=Equifax Secure Certificate Authority - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:c1:5d:b1:58:67:08:62:ee:a0:9a:2d:1f:08:6d: - 91:14:68:98:0a:1e:fe:da:04:6f:13:84:62:21:c3: - d1:7c:ce:9f:05:e0:b8:01:f0:4e:34:ec:e2:8a:95: - 04:64:ac:f1:6b:53:5f:05:b3:cb:67:80:bf:42:02: - 8e:fe:dd:01:09:ec:e1:00:14:4f:fc:fb:f0:0c:dd: - 43:ba:5b:2b:e1:1f:80:70:99:15:57:93:16:f1:0f: - 97:6a:b7:c2:68:23:1c:cc:4d:59:30:ac:51:1e:3b: - af:2b:d6:ee:63:45:7b:c5:d9:5f:50:d2:e3:50:0f: - 3a:88:e7:bf:14:fd:e0:c7:b9 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 CRL Distribution Points: - DirName:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority/CN=CRL1 - - X509v3 Private Key Usage Period: - Not After: Aug 22 16:41:51 2018 GMT - X509v3 Key Usage: - Certificate Sign, CRL Sign - X509v3 Authority Key Identifier: - keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4 - - X509v3 Subject Key Identifier: - 48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4 - X509v3 Basic Constraints: - CA:TRUE - 1.2.840.113533.7.65.0: - 0...V3.0c.... - Signature Algorithm: sha1WithRSAEncryption - 58:ce:29:ea:fc:f7:de:b5:ce:02:b9:17:b5:85:d1:b9:e3:e0: - 95:cc:25:31:0d:00:a6:92:6e:7f:b6:92:63:9e:50:95:d1:9a: - 6f:e4:11:de:63:85:6e:98:ee:a8:ff:5a:c8:d3:55:b2:66:71: - 57:de:c0:21:eb:3d:2a:a7:23:49:01:04:86:42:7b:fc:ee:7f: - a2:16:52:b5:67:67:d3:40:db:3b:26:58:b2:28:77:3d:ae:14: - 77:61:d6:fa:2a:66:27:a0:0d:fa:a7:73:5c:ea:70:f1:94:21: - 65:44:5f:fa:fc:ef:29:68:a9:a2:87:79:ef:79:ef:4f:ac:07: - 77:38 -MD5 Fingerprint=67:CB:9D:C0:13:24:8A:82:9B:B2:17:1E:D1:1B:EC:D4 ------BEGIN CERTIFICATE----- -MIIDIDCCAomgAwIBAgIENd70zzANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJV -UzEQMA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2Vy -dGlmaWNhdGUgQXV0aG9yaXR5MB4XDTk4MDgyMjE2NDE1MVoXDTE4MDgyMjE2NDE1 -MVowTjELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0VxdWlmYXgxLTArBgNVBAsTJEVx -dWlmYXggU2VjdXJlIENlcnRpZmljYXRlIEF1dGhvcml0eTCBnzANBgkqhkiG9w0B -AQEFAAOBjQAwgYkCgYEAwV2xWGcIYu6gmi0fCG2RFGiYCh7+2gRvE4RiIcPRfM6f -BeC4AfBONOziipUEZKzxa1NfBbPLZ4C/QgKO/t0BCezhABRP/PvwDN1Dulsr4R+A -cJkVV5MW8Q+XarfCaCMczE1ZMKxRHjuvK9buY0V7xdlfUNLjUA86iOe/FP3gx7kC -AwEAAaOCAQkwggEFMHAGA1UdHwRpMGcwZaBjoGGkXzBdMQswCQYDVQQGEwJVUzEQ -MA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2VydGlm -aWNhdGUgQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMBoGA1UdEAQTMBGBDzIwMTgw -ODIyMTY0MTUxWjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAUSOZo+SvSspXXR9gj -IBBPM5iQn9QwHQYDVR0OBBYEFEjmaPkr0rKV10fYIyAQTzOYkJ/UMAwGA1UdEwQF -MAMBAf8wGgYJKoZIhvZ9B0EABA0wCxsFVjMuMGMDAgbAMA0GCSqGSIb3DQEBBQUA -A4GBAFjOKer89961zgK5F7WF0bnj4JXMJTENAKaSbn+2kmOeUJXRmm/kEd5jhW6Y -7qj/WsjTVbJmcVfewCHrPSqnI0kBBIZCe/zuf6IWUrVnZ9NA2zsmWLIodz2uFHdh -1voqZiegDfqnc1zqcPGUIWVEX/r87yloqaKHee9570+sB3c4 +MIIEuDCCA6CgAwIBAgIBBDANBgkqhkiG9w0BAQUFADCBtDELMAkGA1UEBhMCQlIx +EzARBgNVBAoTCklDUC1CcmFzaWwxPTA7BgNVBAsTNEluc3RpdHV0byBOYWNpb25h +bCBkZSBUZWNub2xvZ2lhIGRhIEluZm9ybWFjYW8gLSBJVEkxETAPBgNVBAcTCEJy +YXNpbGlhMQswCQYDVQQIEwJERjExMC8GA1UEAxMoQXV0b3JpZGFkZSBDZXJ0aWZp +Y2Fkb3JhIFJhaXogQnJhc2lsZWlyYTAeFw0wMTExMzAxMjU4MDBaFw0xMTExMzAy +MzU5MDBaMIG0MQswCQYDVQQGEwJCUjETMBEGA1UEChMKSUNQLUJyYXNpbDE9MDsG +A1UECxM0SW5zdGl0dXRvIE5hY2lvbmFsIGRlIFRlY25vbG9naWEgZGEgSW5mb3Jt +YWNhbyAtIElUSTERMA8GA1UEBxMIQnJhc2lsaWExCzAJBgNVBAgTAkRGMTEwLwYD +VQQDEyhBdXRvcmlkYWRlIENlcnRpZmljYWRvcmEgUmFpeiBCcmFzaWxlaXJhMIIB +IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwPMudwX/hvm+Uh2b/lQAcHVA +isamaLkWdkwP9/S/tOKIgRrL6Oy+ZIGlOUdd6uYtk9Ma/3pUpgcfNAj0vYm5gsyj +Qo9emsc+x6m4VWwk9iqMZSCK5EQkAq/Ut4n7KuLE1+gdftwdIgxfUsPt4CyNrY50 +QV57KM2UT8x5rrmzEjr7TICGpSUAl2gVqe6xaii+bmYR1QrmWaBSAG59LrkrjrYt +bRhFboUDe1DK+6T8s5L6k8c8okpbHpa9veMztDVC9sPJ60MWXh6anVKo1UcLcbUR +yEeNvZneVRKAAU6ouwdjDvwlsaKydFKwed0ToQ47bmUKgcm+wV3eTRk36UOnTwID +AQABo4HSMIHPME4GA1UdIARHMEUwQwYFYEwBAQAwOjA4BggrBgEFBQcCARYsaHR0 +cDovL2FjcmFpei5pY3BicmFzaWwuZ292LmJyL0RQQ2FjcmFpei5wZGYwPQYDVR0f +BDYwNDAyoDCgLoYsaHR0cDovL2FjcmFpei5pY3BicmFzaWwuZ292LmJyL0xDUmFj +cmFpei5jcmwwHQYDVR0OBBYEFIr68VeEERM1kEL6V0lUaQ2kxPA3MA8GA1UdEwEB +/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBBQUAA4IBAQAZA5c1 +U/hgIh6OcgLAfiJgFWpvmDZWqlV30/bHFpj8iBobJSm5uDpt7TirYh1Uxe3fQaGl +YjJe+9zd+izPRbBqXPVQA34EXcwk4qpWuf1hHriWfdrx8AcqSqr6CuQFwSr75Fos +SzlwDADa70mT7wZjAmQhnZx2xJ6wfWlT9VQfS//JYeIc7Fue2JNLd00UOSMMaiK/ +t79enKNHEA2fupH3vEigf5Eh4bVAN5VohrTm6MY53x7XQZZr1ME7a55lFEnSeT0u +mlOAjR2mAbvSM5X5oSZNrmetdzyTj2flCM8CC7MLab0kkdngRIlUBGHF1/S5nmPb +K+9A46sd33oqK8n8 +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIESzCCAzOgAwIBAgIJAJigUTEEXRQpMA0GCSqGSIb3DQEBBQUAMHYxCzAJBgNV +BAYTAkRFMQ8wDQYDVQQIEwZIZXNzZW4xDjAMBgNVBAcTBUZ1bGRhMRAwDgYDVQQK +EwdEZWJjb25mMRMwEQYDVQQDEwpEZWJjb25mIENBMR8wHQYJKoZIhvcNAQkBFhBq +b2VyZ0BkZWJpYW4ub3JnMB4XDTA1MTEwNTE3NTUxNFoXDTE1MTEwMzE3NTUxNFow +djELMAkGA1UEBhMCREUxDzANBgNVBAgTBkhlc3NlbjEOMAwGA1UEBxMFRnVsZGEx +EDAOBgNVBAoTB0RlYmNvbmYxEzARBgNVBAMTCkRlYmNvbmYgQ0ExHzAdBgkqhkiG +9w0BCQEWEGpvZXJnQGRlYmlhbi5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw +ggEKAoIBAQCvbOo0SrIwI5IMlsshH8WF3dHB9r9JlSKhMPaybawa1EyvZspMQ3wa +F5qxNf3Sj+NElEmjseEqvCZiIIzqwerHu0Qw62cDYCdCd2+Wb5m0bPYB5CGHiyU1 +eNP0je42O0YeXG2BvUujN8AviocVo39X2YwNQ0ryy4OaqYgm2pRlbtT2ESbF+SfV +Y2iqQj/f8ymF+lHo/pz8tbAqxWcqaSiHFAVQJrdqtFhtoodoNiE3q76zJoUkZTXB +k60Yc3MJSnatZCpnsSBr/D7zpntl0THrUjjtdRWCjQVhqfhM1yZJV+ApbLdheFh0 +ZWlSxdnp25p0q0XYw/7G92ELyFDfBUUNAgMBAAGjgdswgdgwHQYDVR0OBBYEFMuV +dFNb4mCWUFbcP5LOtxFLrEVTMIGoBgNVHSMEgaAwgZ2AFMuVdFNb4mCWUFbcP5LO +txFLrEVToXqkeDB2MQswCQYDVQQGEwJERTEPMA0GA1UECBMGSGVzc2VuMQ4wDAYD +VQQHEwVGdWxkYTEQMA4GA1UEChMHRGViY29uZjETMBEGA1UEAxMKRGViY29uZiBD +QTEfMB0GCSqGSIb3DQEJARYQam9lcmdAZGViaWFuLm9yZ4IJAJigUTEEXRQpMAwG +A1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAGZXxHg4mnkvilRIM1EQfGdY +S5b/WcyF2MYSTeTvK4aIB6VHwpZoZCnDGj2m2D3CkHT0upAD9o0zM1tdsfncLzV+ +mDT/jNmBtYo4QXx5vEPwvEIcgrWjwk7SyaEUhZjtolTkHB7ACl0oD0r71St4iEPR +qTUCEXk2E47bg1Fz58wNt/yo2+4iqiRjg1XCH4evkQuhpW+dTZnDyFNqwSYZapOE +TBA+9zBb6xD1KM2DdY7r4GiyYItN0BKLfuWbh9LXGbl1C+f4P11g+m2MPiavIeCe +1iazG5pcS3KoTLACsYlEX24TINtg4kcuS81XdllcnsV3Kdts0nIqPj6uhTTZD0k= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - d0:1e:40:90:00:00:46:52:00:00:00:01:00:00:00:04 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, ST=DC, L=Washington, O=ABA.ECOM, INC., CN=ABA.ECOM Root CA/emailAddress=admin@digsigtrust.com - Validity - Not Before: Jul 12 17:33:53 1999 GMT - Not After : Jul 9 17:33:53 2009 GMT - Subject: C=US, ST=DC, L=Washington, O=ABA.ECOM, INC., CN=ABA.ECOM Root CA/emailAddress=admin@digsigtrust.com - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:b1:d3:11:e0:79:55:43:07:08:4c:cb:05:42:00: - e2:0d:83:46:3d:e4:93:ba:b6:06:d3:0d:59:bd:3e: - c1:ce:43:67:01:8a:21:a8:ef:bc:cc:d0:a2:cc:b0: - 55:96:53:84:66:05:00:da:44:49:80:d8:54:0a:a5: - 25:86:94:ed:63:56:ff:70:6c:a3:a1:19:d2:78:be: - 68:2a:44:5e:2f:cf:cc:18:5e:47:bc:3a:b1:46:3d: - 1e:f0:b9:2c:34:5f:8c:7c:4c:08:29:9d:40:55:eb: - 3c:7d:83:de:b5:f0:f7:8a:83:0e:a1:4c:b4:3a:a5: - b3:5f:5a:22:97:ec:19:9b:c1:05:68:fd:e6:b7:a9: - 91:94:2c:e4:78:48:24:1a:25:19:3a:eb:95:9c:39: - 0a:8a:cf:42:b2:f0:1c:d5:5f:fb:6b:ed:68:56:7b: - 39:2c:72:38:b0:ee:93:a9:d3:7b:77:3c:eb:71:03: - a9:38:4a:16:6c:89:2a:ca:da:33:13:79:c2:55:8c: - ed:9c:bb:f2:cb:5b:10:f8:2e:61:35:c6:29:4c:2a: - d0:2a:63:d1:65:59:b4:f8:cd:f9:f4:00:84:b6:57: - 42:85:9d:32:a8:f9:2a:54:fb:ff:78:41:bc:bd:71: - 28:f4:bb:90:bc:ff:96:34:04:e3:45:9e:a1:46:28: - 40:81 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE, pathlen:8 - Signature Algorithm: sha1WithRSAEncryption - 04:6f:25:86:e4:e6:96:27:b4:d9:42:c0:d0:c9:00:b1:7f:54: - 3e:87:b2:6d:24:a9:2f:0a:7e:fd:a4:44:b0:f8:54:07:bd:1b: - 9d:9d:ca:7b:50:24:7b:11:5b:49:a3:a6:bf:12:74:d5:89:b7: - b7:2f:98:64:25:14:b7:61:e9:7f:60:80:6b:d3:64:e8:ab:bd: - 1a:d6:51:fa:c0:b4:5d:77:1a:7f:64:08:5e:79:c6:05:4c:f1: - 7a:dd:4d:7d:ce:e6:48:7b:54:d2:61:92:81:d6:1b:d6:00:f0: - 0e:9e:28:77:a0:4d:88:c7:22:76:19:c3:c7:9e:1b:a6:77:78: - f8:5f:9b:56:d1:f0:f2:17:ac:8e:9d:59:e6:1f:fe:57:b6:d9: - 5e:e1:5d:9f:45:ec:61:68:19:41:e1:b2:20:26:fe:5a:30:76: - 24:ff:40:72:3c:79:9f:7c:22:48:ab:46:cd:db:b3:86:2c:8f: - bf:05:41:d3:c1:e3:14:e3:41:17:26:d0:7c:a7:71:4c:19:e8: - 4a:0f:72:58:31:7d:ec:60:7a:a3:22:28:bd:19:24:60:3f:3b: - 87:73:c0:6b:e4:cb:ae:b7:ab:25:43:b2:55:2d:7b:ab:06:0e: - 75:5d:34:e5:5d:73:6d:9e:b2:75:40:a5:59:c9:4f:31:71:88: - d9:88:7f:54 -MD5 Fingerprint=41:B8:07:F7:A8:D1:09:EE:B4:9A:8E:70:4D:FC:1B:78 -----BEGIN CERTIFICATE----- MIIDtTCCAp2gAwIBAgIRANAeQJAAAEZSAAAAAQAAAAQwDQYJKoZIhvcNAQEFBQAw gYkxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJEQzETMBEGA1UEBxMKV2FzaGluZ3Rv @@ -594,1470 +73,597 @@ w8eeG6Z3ePhfm1bR8PIXrI6dWeYf/le22V7hXZ9F7GFoGUHhsiAm/lowdiT/QHI8 eZ98IkirRs3bs4Ysj78FQdPB4xTjQRcm0HyncUwZ6EoPclgxfexgeqMiKL0ZJGA/ O4dzwGvky663qyVDslUte6sGDnVdNOVdc22esnVApVnJTzFxiNmIf1Q= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 913315222 (0x36701596) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=Digital Signature Trust Co., OU=DSTCA E1 - Validity - Not Before: Dec 10 18:10:23 1998 GMT - Not After : Dec 10 18:40:23 2018 GMT - Subject: C=US, O=Digital Signature Trust Co., OU=DSTCA E1 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:a0:6c:81:a9:cf:34:1e:24:dd:fe:86:28:cc:de: - 83:2f:f9:5e:d4:42:d2:e8:74:60:66:13:98:06:1c: - a9:51:12:69:6f:31:55:b9:49:72:00:08:7e:d3:a5: - 62:44:37:24:99:8f:d9:83:48:8f:99:6d:95:13:bb: - 43:3b:2e:49:4e:88:37:c1:bb:58:7f:fe:e1:bd:f8: - bb:61:cd:f3:47:c0:99:a6:f1:f3:91:e8:78:7c:00: - cb:61:c9:44:27:71:69:55:4a:7e:49:4d:ed:a2:a3: - be:02:4c:00:ca:02:a8:ee:01:02:31:64:0f:52:2d: - 13:74:76:36:b5:7a:b4:2d:71 - Exponent: 3 (0x3) - X509v3 extensions: - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 CRL Distribution Points: - DirName:/C=US/O=Digital Signature Trust Co./OU=DSTCA E1/CN=CRL1 - - X509v3 Private Key Usage Period: - Not Before: Dec 10 18:10:23 1998 GMT, Not After: Dec 10 18:10:23 2018 GMT - X509v3 Key Usage: - Certificate Sign, CRL Sign - X509v3 Authority Key Identifier: - keyid:6A:79:7E:91:69:46:18:13:0A:02:77:A5:59:5B:60:98:25:0E:A2:F8 - - X509v3 Subject Key Identifier: - 6A:79:7E:91:69:46:18:13:0A:02:77:A5:59:5B:60:98:25:0E:A2:F8 - X509v3 Basic Constraints: - CA:TRUE - 1.2.840.113533.7.65.0: - 0 -..V4.0.... - Signature Algorithm: sha1WithRSAEncryption - 22:12:d8:7a:1d:dc:81:06:b6:09:65:b2:87:c8:1f:5e:b4:2f: - e9:c4:1e:f2:3c:c1:bb:04:90:11:4a:83:4e:7e:93:b9:4d:42: - c7:92:26:a0:5c:34:9a:38:72:f8:fd:6b:16:3e:20:ee:82:8b: - 31:2a:93:36:85:23:88:8a:3c:03:68:d3:c9:09:0f:4d:fc:6c: - a4:da:28:72:93:0e:89:80:b0:7d:fe:80:6f:65:6d:18:33:97: - 8b:c2:6b:89:ee:60:3d:c8:9b:ef:7f:2b:32:62:73:93:cb:3c: - e3:7b:e2:76:78:45:bc:a1:93:04:bb:86:9f:3a:5b:43:7a:c3: - 8a:65 -MD5 Fingerprint=25:7A:BA:83:2E:B6:A2:0B:DA:FE:F5:02:0F:08:D7:AD ------BEGIN CERTIFICATE----- -MIIDKTCCApKgAwIBAgIENnAVljANBgkqhkiG9w0BAQUFADBGMQswCQYDVQQGEwJV -UzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMREwDwYDVQQL -EwhEU1RDQSBFMTAeFw05ODEyMTAxODEwMjNaFw0xODEyMTAxODQwMjNaMEYxCzAJ -BgNVBAYTAlVTMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4x -ETAPBgNVBAsTCERTVENBIEUxMIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCg -bIGpzzQeJN3+hijM3oMv+V7UQtLodGBmE5gGHKlREmlvMVW5SXIACH7TpWJENySZ -j9mDSI+ZbZUTu0M7LklOiDfBu1h//uG9+LthzfNHwJmm8fOR6Hh8AMthyUQncWlV -Sn5JTe2io74CTADKAqjuAQIxZA9SLRN0dja1erQtcQIBA6OCASQwggEgMBEGCWCG -SAGG+EIBAQQEAwIABzBoBgNVHR8EYTBfMF2gW6BZpFcwVTELMAkGA1UEBhMCVVMx -JDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjERMA8GA1UECxMI -RFNUQ0EgRTExDTALBgNVBAMTBENSTDEwKwYDVR0QBCQwIoAPMTk5ODEyMTAxODEw -MjNagQ8yMDE4MTIxMDE4MTAyM1owCwYDVR0PBAQDAgEGMB8GA1UdIwQYMBaAFGp5 -fpFpRhgTCgJ3pVlbYJglDqL4MB0GA1UdDgQWBBRqeX6RaUYYEwoCd6VZW2CYJQ6i -+DAMBgNVHRMEBTADAQH/MBkGCSqGSIb2fQdBAAQMMAobBFY0LjADAgSQMA0GCSqG -SIb3DQEBBQUAA4GBACIS2Hod3IEGtgllsofIH160L+nEHvI8wbsEkBFKg05+k7lN -QseSJqBcNJo4cvj9axY+IO6CizEqkzaFI4iKPANo08kJD038bKTaKHKTDomAsH3+ -gG9lbRgzl4vCa4nuYD3Im+9/KzJic5PLPON74nZ4RbyhkwS7hp86W0N6w4pl ------END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 913232846 (0x366ed3ce) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=Digital Signature Trust Co., OU=DSTCA E2 - Validity - Not Before: Dec 9 19:17:26 1998 GMT - Not After : Dec 9 19:47:26 2018 GMT - Subject: C=US, O=Digital Signature Trust Co., OU=DSTCA E2 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:bf:93:8f:17:92:ef:33:13:18:eb:10:7f:4e:16: - bf:ff:06:8f:2a:85:bc:5e:f9:24:a6:24:88:b6:03: - b7:c1:c3:5f:03:5b:d1:6f:ae:7e:42:ea:66:23:b8: - 63:83:56:fb:28:2d:e1:38:8b:b4:ee:a8:01:e1:ce: - 1c:b6:88:2a:22:46:85:fb:9f:a7:70:a9:47:14:3f: - ce:de:65:f0:a8:71:f7:4f:26:6c:8c:bc:c6:b5:ef: - de:49:27:ff:48:2a:7d:e8:4d:03:cc:c7:b2:52:c6: - 17:31:13:3b:b5:4d:db:c8:c4:f6:c3:0f:24:2a:da: - 0c:9d:e7:91:5b:80:cd:94:9d - Exponent: 3 (0x3) - X509v3 extensions: - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 CRL Distribution Points: - DirName:/C=US/O=Digital Signature Trust Co./OU=DSTCA E2/CN=CRL1 - - X509v3 Private Key Usage Period: - Not Before: Dec 9 19:17:26 1998 GMT, Not After: Dec 9 19:17:26 2018 GMT - X509v3 Key Usage: - Certificate Sign, CRL Sign - X509v3 Authority Key Identifier: - keyid:1E:82:4D:28:65:80:3C:C9:41:6E:AC:35:2E:5A:CB:DE:EE:F8:39:5B - - X509v3 Subject Key Identifier: - 1E:82:4D:28:65:80:3C:C9:41:6E:AC:35:2E:5A:CB:DE:EE:F8:39:5B - X509v3 Basic Constraints: - CA:TRUE - 1.2.840.113533.7.65.0: - 0 -..V4.0.... - Signature Algorithm: sha1WithRSAEncryption - 47:8d:83:ad:62:f2:db:b0:9e:45:22:05:b9:a2:d6:03:0e:38: - 72:e7:9e:fc:7b:e6:93:b6:9a:a5:a2:94:c8:34:1d:91:d1:c5: - d7:f4:0a:25:0f:3d:78:81:9e:0f:b1:67:c4:90:4c:63:dd:5e: - a7:e2:ba:9f:f5:f7:4d:a5:31:7b:9c:29:2d:4c:fe:64:3e:ec: - b6:53:fe:ea:9b:ed:82:db:74:75:4b:07:79:6e:1e:d8:19:83: - 73:de:f5:3e:d0:b5:de:e7:4b:68:7d:43:2e:2a:20:e1:7e:a0: - 78:44:9e:08:f5:98:f9:c7:7f:1b:1b:d6:06:20:02:58:a1:c3: - a2:03 -MD5 Fingerprint=93:C2:8E:11:7B:D4:F3:03:19:BD:28:75:13:4A:45:4A -----BEGIN CERTIFICATE----- -MIIDKTCCApKgAwIBAgIENm7TzjANBgkqhkiG9w0BAQUFADBGMQswCQYDVQQGEwJV -UzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMREwDwYDVQQL -EwhEU1RDQSBFMjAeFw05ODEyMDkxOTE3MjZaFw0xODEyMDkxOTQ3MjZaMEYxCzAJ -BgNVBAYTAlVTMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4x -ETAPBgNVBAsTCERTVENBIEUyMIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQC/ -k48Xku8zExjrEH9OFr//Bo8qhbxe+SSmJIi2A7fBw18DW9Fvrn5C6mYjuGODVvso -LeE4i7TuqAHhzhy2iCoiRoX7n6dwqUcUP87eZfCocfdPJmyMvMa1795JJ/9IKn3o -TQPMx7JSxhcxEzu1TdvIxPbDDyQq2gyd55FbgM2UnQIBA6OCASQwggEgMBEGCWCG -SAGG+EIBAQQEAwIABzBoBgNVHR8EYTBfMF2gW6BZpFcwVTELMAkGA1UEBhMCVVMx -JDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjERMA8GA1UECxMI -RFNUQ0EgRTIxDTALBgNVBAMTBENSTDEwKwYDVR0QBCQwIoAPMTk5ODEyMDkxOTE3 -MjZagQ8yMDE4MTIwOTE5MTcyNlowCwYDVR0PBAQDAgEGMB8GA1UdIwQYMBaAFB6C -TShlgDzJQW6sNS5ay97u+DlbMB0GA1UdDgQWBBQegk0oZYA8yUFurDUuWsve7vg5 -WzAMBgNVHRMEBTADAQH/MBkGCSqGSIb2fQdBAAQMMAobBFY0LjADAgSQMA0GCSqG -SIb3DQEBBQUAA4GBAEeNg61i8tuwnkUiBbmi1gMOOHLnnvx75pO2mqWilMg0HZHR -xdf0CiUPPXiBng+xZ8SQTGPdXqfiup/1902lMXucKS1M/mQ+7LZT/uqb7YLbdHVL -B3luHtgZg3Pe9T7Qtd7nS2h9Qy4qIOF+oHhEngj1mPnHfxsb1gYgAlihw6ID +MIIENjCCAx6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJTRTEU +MBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFs +IFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290 +MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFowbzELMAkGA1UEBhMCU0Ux +FDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h +bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9v +dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALf3GjPm8gAELTngTlvt +H7xsD821+iO2zt6bETOXpClMfZOfvUq8k+0DGuOPz+VtUFrWlymUWoCwSXrbLpX9 +uMq/NzgtHj6RQa1wVsfwTz/oMp50ysiQVOnGXw94nZpAPA6sYapeFI+eh6FqUNzX +mk6vBbOmcZSccbNQYArHE504B4YCqOmoaSYYkKtMsE8jqzpPhNjfzp/haW+710LX +a0Tkx63ubUFfclpxCDezeWWkWaCUN/cALw3CknLa0Dhy2xSoRcRdKn23tNbE7qzN +E0S3ySvdQwAl+mG5aWpYIxG3pzOPVnVZ9c0p10a3CitlttNCbxWyuHv77+ldU9U0 +WicCAwEAAaOB3DCB2TAdBgNVHQ4EFgQUrb2YejS0Jvf6xCZU7wO94CTLVBowCwYD +VR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wgZkGA1UdIwSBkTCBjoAUrb2YejS0 +Jvf6xCZU7wO94CTLVBqhc6RxMG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRU +cnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsx +IjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3SCAQEwDQYJKoZIhvcN +AQEFBQADggEBALCb4IUlwtYj4g+WBpKdQZic2YR5gdkeWxQHIzZlj7DYd7usQWxH +YINRsPkyPef89iYTx4AWpb9a/IfPeHmJIZriTAcKhjW88t5RxNKWt9x+Tu5w/Rw5 +6wwCURQtjr0W4MHfRnXnJK3s9EK0hZNwEGe6nQY1ShjTK3rMUUKhemPR5ruhxSvC +Nr4TDea9Y355e6cJDUCrat2PisP29owaQgVR1EX1n6diIWgVIEM8med8vSTYqZEX +c4g/VhsxOBi0cQ+azcgOno4uG+GMmIPLHzHxREzGBHNJdmAPx/i9F4BrLunMTA5a +mnkPIAou1Z5jJh5VkpTYghdae9C8x49OhgQ= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: - d0:1e:40:8b:00:00:02:7c:00:00:00:02:00:00:00:01 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=us, ST=Utah, L=Salt Lake City, O=Digital Signature Trust Co., OU=DSTCA X1, CN=DST RootCA X1/emailAddress=ca@digsigtrust.com - Validity - Not Before: Dec 1 18:18:55 1998 GMT - Not After : Nov 28 18:18:55 2008 GMT - Subject: C=us, ST=Utah, L=Salt Lake City, O=Digital Signature Trust Co., OU=DSTCA X1, CN=DST RootCA X1/emailAddress=ca@digsigtrust.com - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:d2:c6:26:b6:e7:a5:3d:c1:c4:68:d5:50:6f:53: - c5:6f:49:13:09:b8:af:2c:48:8d:14:6a:a3:17:5f: - 5a:f9:d3:2e:75:2f:d8:28:62:d1:93:2f:fc:4d:d4: - ab:87:e5:08:c7:99:e7:92:3f:75:bd:eb:25:b4:15: - c1:9b:19:3d:d2:44:8d:d7:74:20:6d:37:02:8f:69: - 93:5b:8a:c4:19:9d:f4:b2:0e:fc:16:6c:b9:b1:05: - 92:83:d1:85:2c:60:94:3e:45:55:a0:d9:ab:08:21: - e6:60:e8:3b:74:f2:99:50:51:68:d0:03:2d:b1:80: - be:a3:d8:52:b0:44:cd:43:4a:70:8e:58:85:95:e1: - 4e:2c:d6:2d:41:6f:d6:84:e7:c8:98:44:ca:47:db: - 2c:24:a5:69:26:cf:6b:b8:27:62:c3:f4:c9:7a:92: - 23:ed:13:67:82:ae:45:2e:45:e5:7e:72:3f:85:9d: - 94:62:10:e6:3c:91:a1:ad:77:00:e0:15:ec:f3:84: - 80:72:7a:8e:6e:60:97:c7:24:59:10:34:83:5b:e1: - a5:a4:69:b6:57:35:1c:78:59:c6:d3:2f:3a:73:67: - ee:94:ca:04:13:05:62:06:70:23:b3:f4:7c:ee:45: - d9:64:0b:5b:49:aa:a4:43:ce:26:c4:44:12:6c:b8: - dd:79 - Exponent: 65537 (0x10001) - Signature Algorithm: sha1WithRSAEncryption - a2:37:b2:3f:69:fb:d7:86:79:54:49:31:95:33:2b:f3:d1:09: - 14:49:62:60:86:a5:b0:11:e2:50:c2:1d:06:57:3e:2d:e8:33: - 64:be:9b:aa:ad:5f:1b:4d:d4:99:95:a2:8b:9a:c9:62:72:b5: - 69:ea:d9:58:ab:35:ed:15:a2:43:d6:b6:bc:07:79:65:64:73: - 7d:d7:79:ca:7b:d5:5a:51:c6:e1:53:04:96:8d:38:cf:a3:17: - ac:39:71:6b:01:c3:8b:53:3c:63:e9:ee:79:c0:e4:be:92:32: - 64:7a:b3:1f:97:94:62:bd:ea:b2:20:15:95:fb:97:f2:78:2f: - 63:36:40:38:e3:46:0f:1d:dd:ac:95:ca:e7:4b:90:7b:b1:4b: - a9:d4:c5:eb:9a:da:aa:d5:a3:94:14:46:8d:2d:1f:f3:3a:d6: - 93:3a:f6:3e:79:fc:e8:e6:b0:75:ed:ee:3d:c9:70:c7:5d:aa: - 81:4b:46:25:1c:c7:6c:15:e3:95:4e:0f:aa:32:37:94:0a:17: - 24:92:13:84:58:d2:63:6f:2b:f7:e6:5b:62:0b:13:17:b0:0d: - 52:4c:fe:fe:6f:5c:e2:91:6e:1d:fd:a4:62:d7:68:fa:8e:7a: - 4f:d2:08:da:93:dc:f0:92:11:7a:d0:dc:72:93:0c:73:93:62: - 85:68:d0:f4 -MD5 Fingerprint=6C:C9:A7:6E:47:F1:0C:E3:53:3B:78:4C:4D:C2:6A:C5 -----BEGIN CERTIFICATE----- -MIID2DCCAsACEQDQHkCLAAACfAAAAAIAAAABMA0GCSqGSIb3DQEBBQUAMIGpMQsw -CQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMOU2FsdCBMYWtlIENp -dHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjERMA8GA1UE -CxMIRFNUQ0EgWDExFjAUBgNVBAMTDURTVCBSb290Q0EgWDExITAfBgkqhkiG9w0B -CQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTAeFw05ODEyMDExODE4NTVaFw0wODExMjgx -ODE4NTVaMIGpMQswCQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMO -U2FsdCBMYWtlIENpdHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0 -IENvLjERMA8GA1UECxMIRFNUQ0EgWDExFjAUBgNVBAMTDURTVCBSb290Q0EgWDEx -ITAfBgkqhkiG9w0BCQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTCCASIwDQYJKoZIhvcN -AQEBBQADggEPADCCAQoCggEBANLGJrbnpT3BxGjVUG9TxW9JEwm4ryxIjRRqoxdf -WvnTLnUv2Chi0ZMv/E3Uq4flCMeZ55I/db3rJbQVwZsZPdJEjdd0IG03Ao9pk1uK -xBmd9LIO/BZsubEFkoPRhSxglD5FVaDZqwgh5mDoO3TymVBRaNADLbGAvqPYUrBE -zUNKcI5YhZXhTizWLUFv1oTnyJhEykfbLCSlaSbPa7gnYsP0yXqSI+0TZ4KuRS5F -5X5yP4WdlGIQ5jyRoa13AOAV7POEgHJ6jm5gl8ckWRA0g1vhpaRptlc1HHhZxtMv -OnNn7pTKBBMFYgZwI7P0fO5F2WQLW0mqpEPOJsREEmy43XkCAwEAATANBgkqhkiG -9w0BAQUFAAOCAQEAojeyP2n714Z5VEkxlTMr89EJFEliYIalsBHiUMIdBlc+Legz -ZL6bqq1fG03UmZWii5rJYnK1aerZWKs17RWiQ9a2vAd5ZWRzfdd5ynvVWlHG4VME -lo04z6MXrDlxawHDi1M8Y+nuecDkvpIyZHqzH5eUYr3qsiAVlfuX8ngvYzZAOONG -Dx3drJXK50uQe7FLqdTF65raqtWjlBRGjS0f8zrWkzr2Pnn86Oawde3uPclwx12q -gUtGJRzHbBXjlU4PqjI3lAoXJJIThFjSY28r9+ZbYgsTF7ANUkz+/m9c4pFuHf2k -Ytdo+o56T9II2pPc8JIRetDccpMMc5NihWjQ9A== ------END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: - d0:1e:40:8b:00:00:77:6d:00:00:00:01:00:00:00:04 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=us, ST=Utah, L=Salt Lake City, O=Digital Signature Trust Co., OU=DSTCA X2, CN=DST RootCA X2/emailAddress=ca@digsigtrust.com - Validity - Not Before: Nov 30 22:46:16 1998 GMT - Not After : Nov 27 22:46:16 2008 GMT - Subject: C=us, ST=Utah, L=Salt Lake City, O=Digital Signature Trust Co., OU=DSTCA X2, CN=DST RootCA X2/emailAddress=ca@digsigtrust.com - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:dc:75:f0:8c:c0:75:96:9a:c0:62:1f:26:f7:c4: - e1:9a:ea:e0:56:73:5b:99:cd:01:44:a8:08:b6:d5: - a7:da:1a:04:18:39:92:4a:78:a3:81:c2:f5:77:7a: - 50:b4:70:ff:9a:ab:c6:c7:ca:6e:83:4f:42:98:fb: - 26:0b:da:dc:6d:d6:a9:99:55:52:67:e9:28:03:92: - dc:e5:b0:05:9a:0f:15:f9:6b:59:72:56:f2:fa:39: - fc:aa:68:ee:0f:1f:10:83:2f:fc:9d:fa:17:96:dd: - 82:e3:e6:45:7d:c0:4b:80:44:1f:ed:2c:e0:84:fd: - 91:5c:92:54:69:25:e5:62:69:dc:e5:ee:00:52:bd: - 33:0b:ad:75:02:85:a7:64:50:2d:c5:19:19:30:c0: - 26:db:c9:d3:fd:2e:99:ad:59:b5:0b:4d:d4:41:ae: - 85:48:43:59:dc:b7:a8:e2:a2:de:c3:8f:d7:b8:a1: - 62:a6:68:50:52:e4:cf:31:a7:94:85:da:9f:46:32: - 17:56:e5:f2:eb:66:3d:12:ff:43:db:98:ef:77:cf: - cb:81:8d:34:b1:c6:50:4a:26:d1:e4:3e:41:50:af: - 6c:ae:22:34:2e:d5:6b:6e:83:ba:79:b8:76:65:48: - da:09:29:64:63:22:b9:fb:47:76:85:8c:86:44:cb: - 09:db - Exponent: 65537 (0x10001) - Signature Algorithm: sha1WithRSAEncryption - b5:36:0e:5d:e1:61:28:5a:11:65:c0:3f:83:03:79:4d:be:28: - a6:0b:07:02:52:85:cd:f8:91:d0:10:6c:b5:6a:20:5b:1c:90: - d9:30:3c:c6:48:9e:8a:5e:64:f9:a1:71:77:ef:04:27:1f:07: - eb:e4:26:f7:73:74:c9:44:18:1a:66:d3:e0:43:af:91:3b:d1: - cb:2c:d8:74:54:3a:1c:4d:ca:d4:68:cd:23:7c:1d:10:9e:45: - e9:f6:00:6e:a6:cd:19:ff:4f:2c:29:8f:57:4d:c4:77:92:be: - e0:4c:09:fb:5d:44:86:66:21:a8:b9:32:a2:56:d5:e9:8c:83: - 7c:59:3f:c4:f1:0b:e7:9d:ec:9e:bd:9c:18:0e:3e:c2:39:79: - 28:b7:03:0d:08:cb:c6:e7:d9:01:37:50:10:ec:cc:61:16:40: - d4:af:31:74:7b:fc:3f:31:a7:d0:47:73:33:39:1b:cc:4e:6a: - d7:49:83:11:06:fe:eb:82:58:33:32:4c:f0:56:ac:1e:9c:2f: - 56:9a:7b:c1:4a:1c:a5:fd:55:36:ce:fc:96:4d:f4:b0:f0:ec: - b7:6c:82:ed:2f:31:99:42:4c:a9:b2:0d:b8:15:5d:f1:df:ba: - c9:b5:4a:d4:64:98:b3:26:a9:30:c8:fd:a6:ec:ab:96:21:ad: - 7f:c2:78:b6 -MD5 Fingerprint=CD:3B:3D:62:5B:09:B8:09:36:87:9E:12:2F:71:64:BA ------BEGIN CERTIFICATE----- -MIID2DCCAsACEQDQHkCLAAB3bQAAAAEAAAAEMA0GCSqGSIb3DQEBBQUAMIGpMQsw -CQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMOU2FsdCBMYWtlIENp -dHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjERMA8GA1UE -CxMIRFNUQ0EgWDIxFjAUBgNVBAMTDURTVCBSb290Q0EgWDIxITAfBgkqhkiG9w0B -CQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTAeFw05ODExMzAyMjQ2MTZaFw0wODExMjcy -MjQ2MTZaMIGpMQswCQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMO -U2FsdCBMYWtlIENpdHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0 -IENvLjERMA8GA1UECxMIRFNUQ0EgWDIxFjAUBgNVBAMTDURTVCBSb290Q0EgWDIx -ITAfBgkqhkiG9w0BCQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTCCASIwDQYJKoZIhvcN -AQEBBQADggEPADCCAQoCggEBANx18IzAdZaawGIfJvfE4Zrq4FZzW5nNAUSoCLbV -p9oaBBg5kkp4o4HC9Xd6ULRw/5qrxsfKboNPQpj7Jgva3G3WqZlVUmfpKAOS3OWw -BZoPFflrWXJW8vo5/Kpo7g8fEIMv/J36F5bdguPmRX3AS4BEH+0s4IT9kVySVGkl -5WJp3OXuAFK9MwutdQKFp2RQLcUZGTDAJtvJ0/0uma1ZtQtN1EGuhUhDWdy3qOKi -3sOP17ihYqZoUFLkzzGnlIXan0YyF1bl8utmPRL/Q9uY73fPy4GNNLHGUEom0eQ+ -QVCvbK4iNC7Va26Dunm4dmVI2gkpZGMiuftHdoWMhkTLCdsCAwEAATANBgkqhkiG -9w0BAQUFAAOCAQEAtTYOXeFhKFoRZcA/gwN5Tb4opgsHAlKFzfiR0BBstWogWxyQ -2TA8xkieil5k+aFxd+8EJx8H6+Qm93N0yUQYGmbT4EOvkTvRyyzYdFQ6HE3K1GjN -I3wdEJ5F6fYAbqbNGf9PLCmPV03Ed5K+4EwJ+11EhmYhqLkyolbV6YyDfFk/xPEL -553snr2cGA4+wjl5KLcDDQjLxufZATdQEOzMYRZA1K8xdHv8PzGn0EdzMzkbzE5q -10mDEQb+64JYMzJM8FasHpwvVpp7wUocpf1VNs78lk30sPDst2yC7S8xmUJMqbIN -uBVd8d+6ybVK1GSYsyapMMj9puyrliGtf8J4tg== +MIIEGDCCAwCgAwIBAgIBATANBgkqhkiG9w0BAQUFADBlMQswCQYDVQQGEwJTRTEU +MBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFkZFRydXN0IFRUUCBOZXR3 +b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENBIFJvb3QwHhcNMDAwNTMw +MTAzODMxWhcNMjAwNTMwMTAzODMxWjBlMQswCQYDVQQGEwJTRTEUMBIGA1UEChML +QWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFkZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYD +VQQDExhBZGRUcnVzdCBDbGFzcyAxIENBIFJvb3QwggEiMA0GCSqGSIb3DQEBAQUA +A4IBDwAwggEKAoIBAQCWltQhSWDia+hBBwzexODcEyPNwTXH+9ZOEQpnXvUGW2ul +CDtbKRY654eyNAbFvAWlA3yCyykQruGIgb3WntP+LVbBFc7jJp0VLhD7Bo8wBN6n +tGO0/7Gcrjyvd7ZWxbWroulpOj0OM3kyP3CCkplhbY0wCI9xP6ZIVxn4JdxLZlyl +dI+Yrsj5wAYi56xz36Uu+1LcsRVlIPo1Zmne3yzxbrww2ywkEtvrNTVokMsAsJch +PXQhI2U0K7t4WaPW4XY5mqRJjox0r26kmqPZm9I4XJuiGMx1I4S+6+JNM3GOGvDC ++Mcdoq0Dlyz4zyXG9rgkMbFjXZJ/Y/AlyVMuH79NAgMBAAGjgdIwgc8wHQYDVR0O +BBYEFJWxtPCUtr3H2tERCSG+wa9J/RB7MAsGA1UdDwQEAwIBBjAPBgNVHRMBAf8E +BTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl +MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk +ZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB +IFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0MkhHma6X +7f1yFqZzR1r0693p9db7RcwpiURdv0Y5PejuvE1Uhh4dbOMXJ0PhiVYrqW9yTkkz +43J8KiOavD7/KCrto/8cI7pDVwlnTUtiBi34/2ydYB7YHEt9tTEv2dB8Xfjea4MY +eDdXL+gzB2ffHsdrKpV2ro9Xo/D0UrSpUwjP4E/TelOL/bscVjby/rK25Xa71SJl +pz/+0WatC7xrmYbvP33zGDLKe8bjq2RGlfgmadlVg3sslgf/WSxEo8bl6ancoWOA +WiFeIc9TVPC6b4nbqKqVz4vjccweGyBECMB6tkD9xOQ14R0WHNC8K47Wcdk= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: - cd:ba:7f:56:f0:df:e4:bc:54:fe:22:ac:b3:72:aa:55 - Signature Algorithm: md2WithRSAEncryption - Issuer: C=US, O=VeriSign, Inc., OU=Class 1 Public Primary Certification Authority - Validity - Not Before: Jan 29 00:00:00 1996 GMT - Not After : Aug 1 23:59:59 2028 GMT - Subject: C=US, O=VeriSign, Inc., OU=Class 1 Public Primary Certification Authority - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:e5:19:bf:6d:a3:56:61:2d:99:48:71:f6:67:de: - b9:8d:eb:b7:9e:86:80:0a:91:0e:fa:38:25:af:46: - 88:82:e5:73:a8:a0:9b:24:5d:0d:1f:cc:65:6e:0c: - b0:d0:56:84:18:87:9a:06:9b:10:a1:73:df:b4:58: - 39:6b:6e:c1:f6:15:d5:a8:a8:3f:aa:12:06:8d:31: - ac:7f:b0:34:d7:8f:34:67:88:09:cd:14:11:e2:4e: - 45:56:69:1f:78:02:80:da:dc:47:91:29:bb:36:c9: - 63:5c:c5:e0:d7:2d:87:7b:a1:b7:32:b0:7b:30:ba: - 2a:2f:31:aa:ee:a3:67:da:db - Exponent: 65537 (0x10001) - Signature Algorithm: md2WithRSAEncryption - 4c:3f:b8:8b:c6:68:df:ee:43:33:0e:5d:e9:a6:cb:07:84:4d: - 7a:33:ff:92:1b:f4:36:ad:d8:95:22:36:68:11:6c:7c:42:cc: - f3:9c:2e:c4:07:3f:14:b0:0f:4f:ff:90:92:76:f9:e2:bc:4a: - e9:8f:cd:a0:80:0a:f7:c5:29:f1:82:22:5d:b8:b1:dd:81:23: - a3:7b:25:15:46:30:79:16:f8:ea:05:4b:94:7f:1d:c2:1c:c8: - e3:b7:f4:10:40:3c:13:c3:5f:1f:53:e8:48:e4:86:b4:7b:a1: - 35:b0:7b:25:ba:b8:d3:8e:ab:3f:38:9d:00:34:00:98:f3:d1: - 71:94 -MD5 Fingerprint=97:60:E8:57:5F:D3:50:47:E5:43:0C:94:36:8A:B0:62 -----BEGIN CERTIFICATE----- -MIICPTCCAaYCEQDNun9W8N/kvFT+IqyzcqpVMA0GCSqGSIb3DQEBAgUAMF8xCzAJ -BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xh -c3MgMSBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05 -NjAxMjkwMDAwMDBaFw0yODA4MDEyMzU5NTlaMF8xCzAJBgNVBAYTAlVTMRcwFQYD -VQQKEw5WZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xhc3MgMSBQdWJsaWMgUHJp -bWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCBnzANBgkqhkiG9w0BAQEFAAOB -jQAwgYkCgYEA5Rm/baNWYS2ZSHH2Z965jeu3noaACpEO+jglr0aIguVzqKCbJF0N -H8xlbgyw0FaEGIeaBpsQoXPftFg5a27B9hXVqKg/qhIGjTGsf7A01480Z4gJzRQR -4k5FVmkfeAKA2txHkSm7NsljXMXg1y2He6G3MrB7MLoqLzGq7qNn2tsCAwEAATAN -BgkqhkiG9w0BAQIFAAOBgQBMP7iLxmjf7kMzDl3ppssHhE16M/+SG/Q2rdiVIjZo -EWx8QszznC7EBz8UsA9P/5CSdvnivErpj82ggAr3xSnxgiJduLHdgSOjeyUVRjB5 -FvjqBUuUfx3CHMjjt/QQQDwTw18fU+hI5Ia0e6E1sHslurjTjqs/OJ0ANACY89Fx -lA== +MIIEFTCCAv2gAwIBAgIBATANBgkqhkiG9w0BAQUFADBkMQswCQYDVQQGEwJTRTEU +MBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFkZFRydXN0IFRUUCBOZXR3 +b3JrMSAwHgYDVQQDExdBZGRUcnVzdCBQdWJsaWMgQ0EgUm9vdDAeFw0wMDA1MzAx +MDQxNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB +ZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV +BAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC +AQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV +6tsfSlbunyNu9DnLoblv8n75XYcmYZ4c+OLspoH4IcUkzBEMP9smcnrHAZcHF/nX +GCwwfQ56HmIexkvA/X1id9NEHif2P0tEs7c42TkfYNVRknMDtABp4/MUTu7R3AnP +dzRGULD4EfL+OHn3Bzn+UZKXC1sIXzSGAa2Il+tmzV7R/9x98oTaunet3IAIx6eH +1lWfl2royBFkuucZKT8Rs3iQhCBSWxHveNCD9tVIkNAwHM+A+WD+eeSI8t0A65RF +62WUaUC6wNW0uLp9BBGo6zEFlpROWCGOn9Bg/QIDAQABo4HRMIHOMB0GA1UdDgQW +BBSBPjfYkrAfd59ctKtzquf2NGAv+jALBgNVHQ8EBAMCAQYwDwYDVR0TAQH/BAUw +AwEB/zCBjgYDVR0jBIGGMIGDgBSBPjfYkrAfd59ctKtzquf2NGAv+qFopGYwZDEL +MAkGA1UEBhMCU0UxFDASBgNVBAoTC0FkZFRydXN0IEFCMR0wGwYDVQQLExRBZGRU +cnVzdCBUVFAgTmV0d29yazEgMB4GA1UEAxMXQWRkVHJ1c3QgUHVibGljIENBIFJv +b3SCAQEwDQYJKoZIhvcNAQEFBQADggEBAAP3FUr4JNojVhaTdt02KLmuG7jD8WS6 +IBh4lSknVwW8fCr0uVFV2ocC3g8WFzH4qnkuCRO7r7IgGRLlk/lL+YPoRNWyQSW/ +iHVv/xD8SlTQX/D67zZzfRs2RcYhbbQVuE7PnFylPVoAjgbjPGsye/Kf8Lb93/Ao +GEjwxrzQvzSAlsJKsW2Ox5BF3i9nrEUEo3rcVZLJR2bYGozH7ZxOmuASu7VqTITh +4SINhwBk/ox9Yjllpu9CtoAlEmEBqCQTcAARJl/6NVDFSMwGR+gn2HCNX2TmoUQm +XiLsks3/QppEIW1cxeMiHV9HEufOX1362KqxMy3ZdvJOOjMMK7MtkAY= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: - 2d:1b:fc:4a:17:8d:a3:91:eb:e7:ff:f5:8b:45:be:0b - Signature Algorithm: md2WithRSAEncryption - Issuer: C=US, O=VeriSign, Inc., OU=Class 2 Public Primary Certification Authority - Validity - Not Before: Jan 29 00:00:00 1996 GMT - Not After : Aug 1 23:59:59 2028 GMT - Subject: C=US, O=VeriSign, Inc., OU=Class 2 Public Primary Certification Authority - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:b6:5a:8b:a3:0d:6a:23:83:80:6b:cf:39:87:f4: - 21:13:33:06:4c:25:a2:ed:55:12:97:c5:a7:80:b9: - fa:83:c1:20:a0:fa:2f:15:0d:7c:a1:60:6b:7e:79: - 2c:fa:06:0f:3a:ae:f6:1b:6f:b1:d2:ff:2f:28:52: - 5f:83:7d:4b:c4:7a:b7:f8:66:1f:80:54:fc:b7:c2: - 8e:59:4a:14:57:46:d1:9a:93:be:41:91:03:bb:15: - 80:93:5c:eb:e7:cc:08:6c:3f:3e:b3:4a:fc:ff:4b: - 6c:23:d5:50:82:26:44:19:8e:23:c3:71:ea:19:24: - 47:04:9e:75:bf:c8:a6:00:1f - Exponent: 65537 (0x10001) - Signature Algorithm: md2WithRSAEncryption - 8a:1b:2b:fa:39:c1:74:d7:5e:d8:19:64:a2:58:4a:2d:37:e0: - 33:47:0f:ac:ed:f7:aa:db:1e:e4:8b:06:5c:60:27:ca:45:52: - ce:16:ef:3f:06:64:e7:94:68:7c:60:33:15:11:69:af:9d:62: - 8d:a3:03:54:6b:a6:be:e5:ee:05:18:60:04:bf:42:80:fd:d0: - a8:a8:1e:01:3b:f7:a3:5c:af:a3:dc:e6:26:80:23:3c:b8:44: - 74:f7:0a:ae:49:8b:61:78:cc:24:bf:88:8a:a7:0e:ea:73:19: - 41:fd:4d:03:f0:88:d1:e5:78:8d:a5:2a:4f:f6:97:0d:17:77: - ca:d8 -MD5 Fingerprint=B3:9C:25:B1:C3:2E:32:53:80:15:30:9D:4D:02:77:3E -----BEGIN CERTIFICATE----- -MIICPDCCAaUCEC0b/EoXjaOR6+f/9YtFvgswDQYJKoZIhvcNAQECBQAwXzELMAkG -A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFz -cyAyIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk2 -MDEyOTAwMDAwMFoXDTI4MDgwMTIzNTk1OVowXzELMAkGA1UEBhMCVVMxFzAVBgNV -BAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAyIFB1YmxpYyBQcmlt -YXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GN -ADCBiQKBgQC2WoujDWojg4BrzzmH9CETMwZMJaLtVRKXxaeAufqDwSCg+i8VDXyh -YGt+eSz6Bg86rvYbb7HS/y8oUl+DfUvEerf4Zh+AVPy3wo5ZShRXRtGak75BkQO7 -FYCTXOvnzAhsPz6zSvz/S2wj1VCCJkQZjiPDceoZJEcEnnW/yKYAHwIDAQABMA0G -CSqGSIb3DQEBAgUAA4GBAIobK/o5wXTXXtgZZKJYSi034DNHD6zt96rbHuSLBlxg -J8pFUs4W7z8GZOeUaHxgMxURaa+dYo2jA1Rrpr7l7gUYYAS/QoD90KioHgE796Nc -r6Pc5iaAIzy4RHT3Cq5Ji2F4zCS/iIqnDupzGUH9TQPwiNHleI2lKk/2lw0Xd8rY +MIIEHjCCAwagAwIBAgIBATANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJTRTEU +MBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFkZFRydXN0IFRUUCBOZXR3 +b3JrMSMwIQYDVQQDExpBZGRUcnVzdCBRdWFsaWZpZWQgQ0EgUm9vdDAeFw0wMDA1 +MzAxMDQ0NTBaFw0yMDA1MzAxMDQ0NTBaMGcxCzAJBgNVBAYTAlNFMRQwEgYDVQQK +EwtBZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIzAh +BgNVBAMTGkFkZFRydXN0IFF1YWxpZmllZCBDQSBSb290MIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEA5B6a/twJWoekn0e+EV+vhDTbYjx5eLfpMLXsDBwq +xBb/4Oxx64r1EW7tTw2R0hIYLUkVAcKkIhPHEWT/IhKauY5cLwjPcWqzZwFZ8V1G +87B4pfYOQnrjfxvM0PC3KP0q6p6zsLkEqv32x7SxuCqg+1jxGaBvcCV+PmlKfw8i +2O+tCBGaKZnhqkRFmhJePp1tUvznoD1oL/BLcHwTOK28FSXx1s6rosAx1i+f4P8U +WfyEk9mHfExUE+uf0S0R+Bg6Ot4l2ffTQO2kBhLEO+GRwVY18BTcZTYJbqukB8c1 +0cIDMzZbdSZtQvESa0NvS3GU+jQd7RNuyoB/mC9suWXY6QIDAQABo4HUMIHRMB0G +A1UdDgQWBBQ5lYtii1zJ1IC6WA+XPxUIQ8yYpzALBgNVHQ8EBAMCAQYwDwYDVR0T +AQH/BAUwAwEB/zCBkQYDVR0jBIGJMIGGgBQ5lYtii1zJ1IC6WA+XPxUIQ8yYp6Fr +pGkwZzELMAkGA1UEBhMCU0UxFDASBgNVBAoTC0FkZFRydXN0IEFCMR0wGwYDVQQL +ExRBZGRUcnVzdCBUVFAgTmV0d29yazEjMCEGA1UEAxMaQWRkVHJ1c3QgUXVhbGlm +aWVkIENBIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBABmrder4i2VhlRO6aQTv +hsoToMeqT2QbPxj2qC0sVY8FtzDqQmodwCVRLae/DLPt7wh/bDxGGuoYQ992zPlm +hpwsaPXpF/gxsxjE1kh9I0xowX67ARRvxdlu3rsEQmr49lx95dr6h+sNNVJn0J6X +dgWTP5XHAeZpVTh/EGGZyeNfpso+gmNIquIISD6q8rKFYqa0p9m9N5xotS1WfbC3 +P6CxB9bpT9zeRXEwMn8bLgn5v1Kh7sKAPgZcLlVAwRv1cEWw3F369nJad9Jjzc9Y +iQBCYz95OdBEsIJuQRno3eDBiFrRHnGTHyQwdOUeqN48Jzd/g66ed8/wMLH/S5no +xqE= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: - 70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf - Signature Algorithm: md2WithRSAEncryption - Issuer: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority - Validity - Not Before: Jan 29 00:00:00 1996 GMT - Not After : Aug 1 23:59:59 2028 GMT - Subject: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:c9:5c:59:9e:f2:1b:8a:01:14:b4:10:df:04:40: - db:e3:57:af:6a:45:40:8f:84:0c:0b:d1:33:d9:d9: - 11:cf:ee:02:58:1f:25:f7:2a:a8:44:05:aa:ec:03: - 1f:78:7f:9e:93:b9:9a:00:aa:23:7d:d6:ac:85:a2: - 63:45:c7:72:27:cc:f4:4c:c6:75:71:d2:39:ef:4f: - 42:f0:75:df:0a:90:c6:8e:20:6f:98:0f:f8:ac:23: - 5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85: - e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2: - 71:64:4c:65:2e:81:68:45:a7 - Exponent: 65537 (0x10001) - Signature Algorithm: md2WithRSAEncryption - bb:4c:12:2b:cf:2c:26:00:4f:14:13:dd:a6:fb:fc:0a:11:84: - 8c:f3:28:1c:67:92:2f:7c:b6:c5:fa:df:f0:e8:95:bc:1d:8f: - 6c:2c:a8:51:cc:73:d8:a4:c0:53:f0:4e:d6:26:c0:76:01:57: - 81:92:5e:21:f1:d1:b1:ff:e7:d0:21:58:cd:69:17:e3:44:1c: - 9c:19:44:39:89:5c:dc:9c:00:0f:56:8d:02:99:ed:a2:90:45: - 4c:e4:bb:10:a4:3d:f0:32:03:0e:f1:ce:f8:e8:c9:51:8c:e6: - 62:9f:e6:9f:c0:7d:b7:72:9c:c9:36:3a:6b:9f:4e:a8:ff:64: - 0d:64 -MD5 Fingerprint=10:FC:63:5D:F6:26:3E:0D:F3:25:BE:5F:79:CD:67:67 -----BEGIN CERTIFICATE----- -MIICPDCCAaUCEHC65B0Q2Sk0tjjKewPMur8wDQYJKoZIhvcNAQECBQAwXzELMAkG -A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFz -cyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk2 -MDEyOTAwMDAwMFoXDTI4MDgwMTIzNTk1OVowXzELMAkGA1UEBhMCVVMxFzAVBgNV -BAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAzIFB1YmxpYyBQcmlt -YXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GN -ADCBiQKBgQDJXFme8huKARS0EN8EQNvjV69qRUCPhAwL0TPZ2RHP7gJYHyX3KqhE -BarsAx94f56TuZoAqiN91qyFomNFx3InzPRMxnVx0jnvT0Lwdd8KkMaOIG+YD/is -I19wKTakyYbnsZogy1Olhec9vn2a/iRFM9x2Fe0PonFkTGUugWhFpwIDAQABMA0G -CSqGSIb3DQEBAgUAA4GBALtMEivPLCYATxQT3ab7/AoRhIzzKBxnki98tsX63/Do -lbwdj2wsqFHMc9ikwFPwTtYmwHYBV4GSXiHx0bH/59AhWM1pF+NEHJwZRDmJXNyc -AA9WjQKZ7aKQRUzkuxCkPfAyAw7xzvjoyVGM5mKf5p/AfbdynMk2OmufTqj/ZA1k +MIIDpDCCAoygAwIBAgIBATANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEc +MBoGA1UEChMTQW1lcmljYSBPbmxpbmUgSW5jLjE2MDQGA1UEAxMtQW1lcmljYSBP +bmxpbmUgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAxMB4XDTAyMDUyODA2 +MDAwMFoXDTM3MTExOTIwNDMwMFowYzELMAkGA1UEBhMCVVMxHDAaBgNVBAoTE0Ft +ZXJpY2EgT25saW5lIEluYy4xNjA0BgNVBAMTLUFtZXJpY2EgT25saW5lIFJvb3Qg +Q2VydGlmaWNhdGlvbiBBdXRob3JpdHkgMTCCASIwDQYJKoZIhvcNAQEBBQADggEP +ADCCAQoCggEBAKgv6KRpBgNHw+kqmP8ZonCaxlCyfqXfaE0bfA+2l2h9LaaLl+lk +hsmj76CGv2BlnEtUiMJIxUo5vxTjWVXlGbR0yLQFOVwWpeKVBeASrlmLojNoWBym +1BW32J/X3HGrfpq/m44zDyL9Hy7nBzbvYjnF3cu6JRQj3gzGPTzOggjmZj7aUTsW +OqMFf6Dch9Wc/HKpoH145LcxVR5lu9RhsCFg7RAycsWSJR74kEoYeEfffjA3PlAb +2xzTa5qGUwew76wGePiEmf4hjUyAtgyC9mZweRrTT6PP8c9GsEsPPt2IYriMqQko +O3rHl+Ee5fSfwMCuJKDIodkP1nsmgmkyPacCAwEAAaNjMGEwDwYDVR0TAQH/BAUw +AwEB/zAdBgNVHQ4EFgQUAK3Zo/Z59m50qX8zPYEX10zPM94wHwYDVR0jBBgwFoAU +AK3Zo/Z59m50qX8zPYEX10zPM94wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB +BQUAA4IBAQB8itEfGDeC4Liwo+1WlchiYZwFos3CYiZhzRAW18y0ZTTQEYqtqKkF +Zu90821fnZmv9ov761KyBZiibyrFVL0lvV+uyIbqRizBs73B6UlwGBaXCBOMIOAb +LjpHyx7kADCVW/RFo8AasAFOq73AI25jP4BKxQft3OJvx8Fi8eNy1gTIdGcL+oir +oQHIb/AUr9KZzVGTfu0uOMe9zkZQPXLjeSWdm4grECDdpbgyn43gKd8hdIaC2y+C +MMbHNYaz+ZZfRtsMRf3zUMNvxsNIrUam4SdHCh0Om7bCd39j8uB9Gr784N/Xx6ds +sPmuujz9dLQR6FgNgLzTqIA6me11zEZ7 -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: - 4c:c7:ea:aa:98:3e:71:d3:93:10:f8:3d:3a:89:91:92 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=VeriSign, Inc., OU=Class 1 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network - Validity - Not Before: May 18 00:00:00 1998 GMT - Not After : Aug 1 23:59:59 2028 GMT - Subject: C=US, O=VeriSign, Inc., OU=Class 1 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:aa:d0:ba:be:16:2d:b8:83:d4:ca:d2:0f:bc:76: - 31:ca:94:d8:1d:93:8c:56:02:bc:d9:6f:1a:6f:52: - 36:6e:75:56:0a:55:d3:df:43:87:21:11:65:8a:7e: - 8f:bd:21:de:6b:32:3f:1b:84:34:95:05:9d:41:35: - eb:92:eb:96:dd:aa:59:3f:01:53:6d:99:4f:ed:e5: - e2:2a:5a:90:c1:b9:c4:a6:15:cf:c8:45:eb:a6:5d: - 8e:9c:3e:f0:64:24:76:a5:cd:ab:1a:6f:b6:d8:7b: - 51:61:6e:a6:7f:87:c8:e2:b7:e5:34:dc:41:88:ea: - 09:40:be:73:92:3d:6b:e7:75 - Exponent: 65537 (0x10001) - Signature Algorithm: sha1WithRSAEncryption - a9:4f:c3:0d:c7:67:be:2c:cb:d9:a8:cd:2d:75:e7:7e:15:9e: - 3b:72:eb:7e:eb:5c:2d:09:87:d6:6b:6d:60:7c:e5:ae:c5:90: - 23:0c:5c:4a:d0:af:b1:5d:f3:c7:b6:0a:db:e0:15:93:0d:dd: - 03:bc:c7:76:8a:b5:dd:4f:c3:9b:13:75:b8:01:c0:e6:c9:5b: - 6b:a5:b8:89:dc:ac:a4:dd:72:ed:4e:a1:f7:4f:bc:06:d3:ea: - c8:64:74:7b:c2:95:41:9c:65:73:58:f1:90:9a:3c:6a:b1:98: - c9:c4:87:bc:cf:45:6d:45:e2:6e:22:3f:fe:bc:0f:31:5c:e8: - f2:d9 -MD5 Fingerprint=DB:23:3D:F9:69:FA:4B:B9:95:80:44:73:5E:7D:41:83 -----BEGIN CERTIFICATE----- -MIIDAjCCAmsCEEzH6qqYPnHTkxD4PTqJkZIwDQYJKoZIhvcNAQEFBQAwgcExCzAJ -BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xh -c3MgMSBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcy -MTowOAYDVQQLEzEoYykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp -emVkIHVzZSBvbmx5MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMB4X -DTk4MDUxODAwMDAwMFoXDTI4MDgwMTIzNTk1OVowgcExCzAJBgNVBAYTAlVTMRcw -FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xhc3MgMSBQdWJsaWMg -UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcyMTowOAYDVQQLEzEo -YykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 -MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB -AQUAA4GNADCBiQKBgQCq0Lq+Fi24g9TK0g+8djHKlNgdk4xWArzZbxpvUjZudVYK -VdPfQ4chEWWKfo+9Id5rMj8bhDSVBZ1BNeuS65bdqlk/AVNtmU/t5eIqWpDBucSm -Fc/IReumXY6cPvBkJHalzasab7bYe1FhbqZ/h8jit+U03EGI6glAvnOSPWvndQID -AQABMA0GCSqGSIb3DQEBBQUAA4GBAKlPww3HZ74sy9mozS11534Vnjty637rXC0J -h9ZrbWB85a7FkCMMXErQr7Fd88e2CtvgFZMN3QO8x3aKtd1Pw5sTdbgBwObJW2ul -uIncrKTdcu1OofdPvAbT6shkdHvClUGcZXNY8ZCaPGqxmMnEh7zPRW1F4m4iP/68 -DzFc6PLZ +MIIFpDCCA4ygAwIBAgIBATANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEc +MBoGA1UEChMTQW1lcmljYSBPbmxpbmUgSW5jLjE2MDQGA1UEAxMtQW1lcmljYSBP +bmxpbmUgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAyMB4XDTAyMDUyODA2 +MDAwMFoXDTM3MDkyOTE0MDgwMFowYzELMAkGA1UEBhMCVVMxHDAaBgNVBAoTE0Ft +ZXJpY2EgT25saW5lIEluYy4xNjA0BgNVBAMTLUFtZXJpY2EgT25saW5lIFJvb3Qg +Q2VydGlmaWNhdGlvbiBBdXRob3JpdHkgMjCCAiIwDQYJKoZIhvcNAQEBBQADggIP +ADCCAgoCggIBAMxBRR3pPU0Q9oyxQcngXssNt79Hc9PwVU3dxgz6sWYFas14tNwC +206B89enfHG8dWOgXeMHDEjsJcQDIPT/DjsS/5uN4cbVG7RtIuOx238hZK+GvFci +KtZHgVdEglZTvYYUAQv8f3SkWq7xuhG1m1hagLQ3eAkzfDJHA1zEpYNI9FdWboE2 +JxhP7JsowtS013wMPgwr38oE18aO6lhOqKSlGBxsRZijQdEt0sdtjRnxrXm3gT+9 +BoInLRBYBbV4Bbkv2wxrkJB+FFk4u5QkE+XRnRTf04JNRvCAOVIyD+OEsnpD8l7e +Xz8d3eOyG6ChKiMDbi4BFYdcpnV1x5dhvt6G3NRI270qv0pV2uh9UPu0gBe4lL8B +PeraunzgWGcXuVjgiIZGZ2ydEEdYMtA1fHkqkKJaEBEjNa0vzORKW6fIJ/KD3l67 +Xnfn6KVuY8INXWHQjNJsWiEOyiijzirplcdIz5ZvHZIlyMbGwcEMBawmxNJ10uEq +Z8A9W6Wa6897GqidFEXlD6CaZd4vKL3Ob5Rmg0gp2OpljK+T2WSfVVcmv2/LNzGZ +o2C7HK2JNDJiuEMhBnIMoVxtRsX6Kc8w3onccVvdtjc+31D1uAclJuW8tf48ArO3 ++L5DwYcRlJ4jbBeKuIonDFRH8KmzwICMoCfrHRnjB453cMor9H124HhnAgMBAAGj +YzBhMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFE1FwWg4u3OpaaEg5+31IqEj +FNeeMB8GA1UdIwQYMBaAFE1FwWg4u3OpaaEg5+31IqEjFNeeMA4GA1UdDwEB/wQE +AwIBhjANBgkqhkiG9w0BAQUFAAOCAgEAZ2sGuV9FOypLM7PmG2tZTiLMubekJcmn +xPBUlgtk87FYT15R/LKXeydlwuXK5w0MJXti4/qftIe3RUavg6WXSIylvfEWK5t2 +LHo1YGwRgJfMqZJS5ivmae2p+DYtLHe/YUjRYwu5W1LtGLBDQiKmsXeu3mnFzccc +obGlHBD7GL4acN3Bkku+KVqdPzW+5X1R+FXgJXUjhx5c3LqdsKyzadsXg8n33gy8 +CNyRnqjQ1xU3c6U1uPx+xURABsPr+CKAXEfOAuMRn0T//ZoyzH1kUQ7rVyZ2OuMe +IjzCpjbdGe+n/BLzJsBZMYVMnNjP36TMzCmT/5RtdlwTCJfy7aULTd3oyWgOZtMA +DjMSW7yV5TKQqLPGbIOtd+6Lfn6xqavT4fG2wLHqiMDn05DpKJKUe2h7lyoKZy2F +AjgQ5ANh1NolNscIWC2hp1GvMApJ9aZphwctREZ2jirlmjvXGKL8nDgQzMY70rUX +Om/9riW99XJZZLF0KjhfGEzfz3EEWjbUvy+ZnOjZurGV5gJLIaFb1cFPj65pbVPb +AZO1XB4Y3WRayhgoPmMEEf0cjQAPuDffZ4qdZqkCapH/E8ovXYO8h5Ns3CRRFgQl +Zvqz2cK6Kb6aSDiCmfS/O0oxGfm/jiEzFMpPVF/7zvuPcX/9XhmgD0uRuMRUvAaw +RY8mkaKO/qk= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: - b9:2f:60:cc:88:9f:a1:7a:46:09:b8:5b:70:6c:8a:af - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=VeriSign, Inc., OU=Class 2 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network - Validity - Not Before: May 18 00:00:00 1998 GMT - Not After : Aug 1 23:59:59 2028 GMT - Subject: C=US, O=VeriSign, Inc., OU=Class 2 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:a7:88:01:21:74:2c:e7:1a:03:f0:98:e1:97:3c: - 0f:21:08:f1:9c:db:97:e9:9a:fc:c2:04:06:13:be: - 5f:52:c8:cc:1e:2c:12:56:2c:b8:01:69:2c:cc:99: - 1f:ad:b0:96:ae:79:04:f2:13:39:c1:7b:98:ba:08: - 2c:e8:c2:84:13:2c:aa:69:e9:09:f4:c7:a9:02:a4: - 42:c2:23:4f:4a:d8:f0:0e:a2:fb:31:6c:c9:e6:6f: - 99:27:07:f5:e6:f4:4c:78:9e:6d:eb:46:86:fa:b9: - 86:c9:54:f2:b2:c4:af:d4:46:1c:5a:c9:15:30:ff: - 0d:6c:f5:2d:0e:6d:ce:7f:77 - Exponent: 65537 (0x10001) - Signature Algorithm: sha1WithRSAEncryption - 72:2e:f9:7f:d1:f1:71:fb:c4:9e:f6:c5:5e:51:8a:40:98:b8: - 68:f8:9b:1c:83:d8:e2:9d:bd:ff:ed:a1:e6:66:ea:2f:09:f4: - ca:d7:ea:a5:2b:95:f6:24:60:86:4d:44:2e:83:a5:c4:2d:a0: - d3:ae:78:69:6f:72:da:6c:ae:08:f0:63:92:37:e6:bb:c4:30: - 17:ad:77:cc:49:35:aa:cf:d8:8f:d1:be:b7:18:96:47:73:6a: - 54:22:34:64:2d:b6:16:9b:59:5b:b4:51:59:3a:b3:0b:14:f4: - 12:df:67:a0:f4:ad:32:64:5e:b1:46:72:27:8c:12:7b:c5:44: - b4:ae -MD5 Fingerprint=2D:BB:E5:25:D3:D1:65:82:3A:B7:0E:FA:E6:EB:E2:E1 -----BEGIN CERTIFICATE----- -MIIDAzCCAmwCEQC5L2DMiJ+hekYJuFtwbIqvMA0GCSqGSIb3DQEBBQUAMIHBMQsw -CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xPDA6BgNVBAsTM0Ns -YXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBH -MjE6MDgGA1UECxMxKGMpIDE5OTggVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9y -aXplZCB1c2Ugb25seTEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazAe -Fw05ODA1MTgwMDAwMDBaFw0yODA4MDEyMzU5NTlaMIHBMQswCQYDVQQGEwJVUzEX -MBUGA1UEChMOVmVyaVNpZ24sIEluYy4xPDA6BgNVBAsTM0NsYXNzIDIgUHVibGlj -IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMjE6MDgGA1UECxMx -KGMpIDE5OTggVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25s -eTEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazCBnzANBgkqhkiG9w0B -AQEFAAOBjQAwgYkCgYEAp4gBIXQs5xoD8JjhlzwPIQjxnNuX6Zr8wgQGE75fUsjM -HiwSViy4AWkszJkfrbCWrnkE8hM5wXuYuggs6MKEEyyqaekJ9MepAqRCwiNPStjw -DqL7MWzJ5m+ZJwf15vRMeJ5t60aG+rmGyVTyssSv1EYcWskVMP8NbPUtDm3Of3cC -AwEAATANBgkqhkiG9w0BAQUFAAOBgQByLvl/0fFx+8Se9sVeUYpAmLho+Jscg9ji -nb3/7aHmZuovCfTK1+qlK5X2JGCGTUQug6XELaDTrnhpb3LabK4I8GOSN+a7xDAX -rXfMSTWqz9iP0b63GJZHc2pUIjRkLbYWm1lbtFFZOrMLFPQS32eg9K0yZF6xRnIn -jBJ7xUS0rg== +MIID5jCCAs6gAwIBAgIBATANBgkqhkiG9w0BAQUFADCBgzELMAkGA1UEBhMCVVMx +HTAbBgNVBAoTFEFPTCBUaW1lIFdhcm5lciBJbmMuMRwwGgYDVQQLExNBbWVyaWNh +IE9ubGluZSBJbmMuMTcwNQYDVQQDEy5BT0wgVGltZSBXYXJuZXIgUm9vdCBDZXJ0 +aWZpY2F0aW9uIEF1dGhvcml0eSAxMB4XDTAyMDUyOTA2MDAwMFoXDTM3MTEyMDE1 +MDMwMFowgYMxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRBT0wgVGltZSBXYXJuZXIg +SW5jLjEcMBoGA1UECxMTQW1lcmljYSBPbmxpbmUgSW5jLjE3MDUGA1UEAxMuQU9M +IFRpbWUgV2FybmVyIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgMTCCASIw +DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJnej8Mlo2k06AX3dLm/WpcZuS+U +0pPlLYnKhHw/EEMbjIt8hFj4JHxIzyr9wBXZGH6EGhfT257XyuTZ16pYUYfw8ItI +TuLCxFlpMGK2MKKMCxGZYTVtfu/FsRkGIBKOQuHfD5YQUqjPnF+VFNivO3ULMSAf +RC+iYkGzuxgh28pxPIzstrkNn+9R7017EvILDOGsQI93f7DKeHEMXRZxcKLXwjqF +zQ6axOAAsNUl6twr5JQtOJyJQVdkKGUZHLZEtMgxa44Be3ZZJX8VHIQIfHNlIAqh +BC4aMqiaILGcLCFZ5/vP7nAtCMpjPiybkxlqpMKX/7eGV4iFbJ4VFitNLLMCAwEA +AaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUoTYwFsuGkABFgFOxj8jY +PXy+XxIwHwYDVR0jBBgwFoAUoTYwFsuGkABFgFOxj8jYPXy+XxIwDgYDVR0PAQH/ +BAQDAgGGMA0GCSqGSIb3DQEBBQUAA4IBAQCKIBilvrMvtKaEAEAwKfq0FHNMeUWn +9nDg6H5kHgqVfGphwu9OH77/yZkfB2FK4V1Mza3u0FIy2VkyvNp5ctZ7CegCgTXT +Ct8RHcl5oIBN/lrXVtbtDyqvpxh1MwzqwWEFT2qaifKNuZ8u77BfWgDrvq2g+EQF +Z7zLBO+eZMXpyD8Fv8YvBxzDNnGGyjhmSs3WuEvGbKeXO/oTLW4jYYehY0KswsuX +n2Fozy1MBJ3XJU8KDk2QixhWqJNIV9xvrr2eZ1d3iVCzvhGbRWeDhhmH05i9CBoW +H1iCC+GWaQVLjuyDUTEH1dSf/1l7qG6Fz9NLqUmwX7A5KGgOc90lmt4S -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: - 7d:d9:fe:07:cf:a8:1e:b7:10:79:67:fb:a7:89:34:c6 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network - Validity - Not Before: May 18 00:00:00 1998 GMT - Not After : Aug 1 23:59:59 2028 GMT - Subject: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:cc:5e:d1:11:5d:5c:69:d0:ab:d3:b9:6a:4c:99: - 1f:59:98:30:8e:16:85:20:46:6d:47:3f:d4:85:20: - 84:e1:6d:b3:f8:a4:ed:0c:f1:17:0f:3b:f9:a7:f9: - 25:d7:c1:cf:84:63:f2:7c:63:cf:a2:47:f2:c6:5b: - 33:8e:64:40:04:68:c1:80:b9:64:1c:45:77:c7:d8: - 6e:f5:95:29:3c:50:e8:34:d7:78:1f:a8:ba:6d:43: - 91:95:8f:45:57:5e:7e:c5:fb:ca:a4:04:eb:ea:97: - 37:54:30:6f:bb:01:47:32:33:cd:dc:57:9b:64:69: - 61:f8:9b:1d:1c:89:4f:5c:67 - Exponent: 65537 (0x10001) - Signature Algorithm: sha1WithRSAEncryption - 51:4d:cd:be:5c:cb:98:19:9c:15:b2:01:39:78:2e:4d:0f:67: - 70:70:99:c6:10:5a:94:a4:53:4d:54:6d:2b:af:0d:5d:40:8b: - 64:d3:d7:ee:de:56:61:92:5f:a6:c4:1d:10:61:36:d3:2c:27: - 3c:e8:29:09:b9:11:64:74:cc:b5:73:9f:1c:48:a9:bc:61:01: - ee:e2:17:a6:0c:e3:40:08:3b:0e:e7:eb:44:73:2a:9a:f1:69: - 92:ef:71:14:c3:39:ac:71:a7:91:09:6f:e4:71:06:b3:ba:59: - 57:26:79:00:f6:f8:0d:a2:33:30:28:d4:aa:58:a0:9d:9d:69: - 91:fd -MD5 Fingerprint=A2:33:9B:4C:74:78:73:D4:6C:E7:C1:F3:8D:CB:5C:E9 -----BEGIN CERTIFICATE----- -MIIDAjCCAmsCEH3Z/gfPqB63EHln+6eJNMYwDQYJKoZIhvcNAQEFBQAwgcExCzAJ -BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xh -c3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcy -MTowOAYDVQQLEzEoYykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp -emVkIHVzZSBvbmx5MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMB4X -DTk4MDUxODAwMDAwMFoXDTI4MDgwMTIzNTk1OVowgcExCzAJBgNVBAYTAlVTMRcw -FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xhc3MgMyBQdWJsaWMg -UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcyMTowOAYDVQQLEzEo -YykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 -MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB -AQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4 -pO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0 -13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4mx0ciU9cZwID -AQABMA0GCSqGSIb3DQEBBQUAA4GBAFFNzb5cy5gZnBWyATl4Lk0PZ3BwmcYQWpSk -U01UbSuvDV1Ai2TT1+7eVmGSX6bEHRBhNtMsJzzoKQm5EWR0zLVznxxIqbxhAe7i -F6YM40AIOw7n60RzKprxaZLvcRTDOaxxp5EJb+RxBrO6WVcmeQD2+A2iMzAo1KpY -oJ2daZH9 +MIIF5jCCA86gAwIBAgIBATANBgkqhkiG9w0BAQUFADCBgzELMAkGA1UEBhMCVVMx +HTAbBgNVBAoTFEFPTCBUaW1lIFdhcm5lciBJbmMuMRwwGgYDVQQLExNBbWVyaWNh +IE9ubGluZSBJbmMuMTcwNQYDVQQDEy5BT0wgVGltZSBXYXJuZXIgUm9vdCBDZXJ0 +aWZpY2F0aW9uIEF1dGhvcml0eSAyMB4XDTAyMDUyOTA2MDAwMFoXDTM3MDkyODIz +NDMwMFowgYMxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRBT0wgVGltZSBXYXJuZXIg +SW5jLjEcMBoGA1UECxMTQW1lcmljYSBPbmxpbmUgSW5jLjE3MDUGA1UEAxMuQU9M +IFRpbWUgV2FybmVyIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgMjCCAiIw +DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALQ3WggWmRToVbEbJGv8x4vmh6mJ +7ouZzU9AhqS2TcnZsdw8TQ2FTBVsRotSeJ/4I/1n9SQ6aF3Q92RhQVSji6UI0ilb +m2BPJoPRYxJWSXakFsKlnUWsi4SVqBax7J/qJBrvuVdcmiQhLE0OcR+mrF1FdAOY +xFSMFkpBd4aVdQxHAWZg/BXxD+r1FHjHDtdugRxev17nOirYlxcwfACtCJ0zr7iZ +YYCLqJV+FNwSbKTQ2O9ASQI2+W6p1h2WVgSysy0WVoaP2SBXgM1nEG2wTPDaRrbq +JS5Gr42whTg0ixQmgiusrpkLjhTXUr2eacOGAgvqdnUxCc4zGSGFQ+aJLZ8lN2fx +I2rSAG2X+Z/nKcrdH9cG6rjJuQkhn8g/BsXS6RJGAE57COtCPStIbp1n3UsC5ETz +kxmlJ85per5n0/xQpCyrw2u544BMzwVhSyvcG7mm0tCq9Stz+86QNZ8MUhy/XCFh +EVsVS6kkUfykXPcXnbDS+gfpj1bkGoxoigTTfFrjnqKhynFbotSg5ymFXQNoKk/S +Btc9+cMDLz9l+WceR0DTYw/j1Y75hauXTLPXJuuWCpTehTacyH+BCQJJKg71ZDIM +gtG6aoIbs0t0EfOMd9afv9w3pKdVBC/UMejTRrkDfNoSTllkt1ExMVCgyhwn2RAu +rda9EGYrw7AiShJbAgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYE +FE9pbQN+nZ8HGEO8txBO1b+pxCAoMB8GA1UdIwQYMBaAFE9pbQN+nZ8HGEO8txBO +1b+pxCAoMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQUFAAOCAgEAO/Ouyugu +h4X7ZVnnrREUpVe8WJ8kEle7+z802u6teio0cnAxa8cZmIDJgt43d15Ui47y6mdP +yXSEkVYJ1eV6moG2gcKtNuTxVBFT8zRFASbI5Rq8NEQh3q0l/HYWdyGQgJhXnU7q +7C+qPBR7V8F+GBRn7iTGvboVsNIYvbdVgaxTwOjdaRITQrcCtQVBynlQboIOcXKT +RuidDV29rs4prWPVVRaAMCf/drr3uNZK49m1+VLQTkCpx+XCMseqdiThawVQ68W/ +ClTluUI8JPu3B5wwn3la5uBAUhX0/Kr0VvlEl4ftDmVyXr4m+02kLQgH3thcoNyB +M5kYJRF3p+v9WAksmWsbivNSPxpNSGDxoPYzAlOL7SUJuA0t7Zdz7NeWH45gDtoQ +my8YJPamTQr5O8t1wswvziRpyQoijlmn94IM19drNZxDAGrElWe6nEXLuA4399xO +AU++CrYD062KRffaJ00psUjf5BHklka9bAI+1lHIlRcBFanyqqryvy9lG2/QuRqT +9Y41xICHPpQvZuTpqP9BnHAqTyo5GJUefvthATxRCC4oGKQWDzH9OmwjkyB24f0H +hdFbP9IcczLd+rn4jM8Ch3qaluTtT4mNU0OrDhPAARW0eTjb/G49nlG2uBOLZ8/5 +fNkiHfZdxRwBL5joeiQYvITX+txyW/fBOmg= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: - 32:88:8e:9a:d2:f5:eb:13:47:f8:7f:c4:20:37:25:f8 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=VeriSign, Inc., OU=Class 4 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network - Validity - Not Before: May 18 00:00:00 1998 GMT - Not After : Aug 1 23:59:59 2028 GMT - Subject: C=US, O=VeriSign, Inc., OU=Class 4 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:ba:f0:e4:cf:f9:c4:ae:85:54:b9:07:57:f9:8f: - c5:7f:68:11:f8:c4:17:b0:44:dc:e3:30:73:d5:2a: - 62:2a:b8:d0:cc:1c:ed:28:5b:7e:bd:6a:dc:b3:91: - 24:ca:41:62:3c:fc:02:01:bf:1c:16:31:94:05:97: - 76:6e:a2:ad:bd:61:17:6c:4e:30:86:f0:51:37:2a: - 50:c7:a8:62:81:dc:5b:4a:aa:c1:a0:b4:6e:eb:2f: - e5:57:c5:b1:2b:40:70:db:5a:4d:a1:8e:1f:bd:03: - 1f:d8:03:d4:8f:4c:99:71:bc:e2:82:cc:58:e8:98: - 3a:86:d3:86:38:f3:00:29:1f - Exponent: 65537 (0x10001) - Signature Algorithm: sha1WithRSAEncryption - 85:8c:12:c1:a7:b9:50:15:7a:cb:3e:ac:b8:43:8a:dc:aa:dd: - 14:ba:89:81:7e:01:3c:23:71:21:88:2f:82:dc:63:fa:02:45: - ac:45:59:d7:2a:58:44:5b:b7:9f:81:3b:92:68:3d:e2:37:24: - f5:7b:6c:8f:76:35:96:09:a8:59:9d:b9:ce:23:ab:74:d6:83: - fd:32:73:27:d8:69:3e:43:74:f6:ae:c5:89:9a:e7:53:7c:e9: - 7b:f6:4b:f3:c1:65:83:de:8d:8a:9c:3c:88:8d:39:59:fc:aa: - 3f:22:8d:a1:c1:66:50:81:72:4c:ed:22:64:4f:4f:ca:80:91: - b6:29 -MD5 Fingerprint=26:6D:2C:19:98:B6:70:68:38:50:54:19:EC:90:34:60 -----BEGIN CERTIFICATE----- -MIIDAjCCAmsCEDKIjprS9esTR/h/xCA3JfgwDQYJKoZIhvcNAQEFBQAwgcExCzAJ -BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xh -c3MgNCBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcy -MTowOAYDVQQLEzEoYykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp -emVkIHVzZSBvbmx5MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMB4X -DTk4MDUxODAwMDAwMFoXDTI4MDgwMTIzNTk1OVowgcExCzAJBgNVBAYTAlVTMRcw -FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xhc3MgNCBQdWJsaWMg -UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcyMTowOAYDVQQLEzEo -YykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 -MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB -AQUAA4GNADCBiQKBgQC68OTP+cSuhVS5B1f5j8V/aBH4xBewRNzjMHPVKmIquNDM -HO0oW369atyzkSTKQWI8/AIBvxwWMZQFl3Zuoq29YRdsTjCG8FE3KlDHqGKB3FtK -qsGgtG7rL+VXxbErQHDbWk2hjh+9Ax/YA9SPTJlxvOKCzFjomDqG04Y48wApHwID -AQABMA0GCSqGSIb3DQEBBQUAA4GBAIWMEsGnuVAVess+rLhDityq3RS6iYF+ATwj -cSGIL4LcY/oCRaxFWdcqWERbt5+BO5JoPeI3JPV7bI92NZYJqFmduc4jq3TWg/0y -cyfYaT5DdPauxYma51N86Xv2S/PBZYPejYqcPIiNOVn8qj8ijaHBZlCBckztImRP -T8qAkbYp ------END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 02:00:00:00:00:00:d6:78:b7:94:05 - Signature Algorithm: md5WithRSAEncryption - Issuer: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA - Validity - Not Before: Sep 1 12:00:00 1998 GMT - Not After : Jan 28 12:00:00 2014 GMT - Subject: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:da:0e:e6:99:8d:ce:a3:e3:4f:8a:7e:fb:f1:8b: - 83:25:6b:ea:48:1f:f1:2a:b0:b9:95:11:04:bd:f0: - 63:d1:e2:67:66:cf:1c:dd:cf:1b:48:2b:ee:8d:89: - 8e:9a:af:29:80:65:ab:e9:c7:2d:12:cb:ab:1c:4c: - 70:07:a1:3d:0a:30:cd:15:8d:4f:f8:dd:d4:8c:50: - 15:1c:ef:50:ee:c4:2e:f7:fc:e9:52:f2:91:7d:e0: - 6d:d5:35:30:8e:5e:43:73:f2:41:e9:d5:6a:e3:b2: - 89:3a:56:39:38:6f:06:3c:88:69:5b:2a:4d:c5:a7: - 54:b8:6c:89:cc:9b:f9:3c:ca:e5:fd:89:f5:12:3c: - 92:78:96:d6:dc:74:6e:93:44:61:d1:8d:c7:46:b2: - 75:0e:86:e8:19:8a:d5:6d:6c:d5:78:16:95:a2:e9: - c8:0a:38:eb:f2:24:13:4f:73:54:93:13:85:3a:1b: - bc:1e:34:b5:8b:05:8c:b9:77:8b:b1:db:1f:20:91: - ab:09:53:6e:90:ce:7b:37:74:b9:70:47:91:22:51: - 63:16:79:ae:b1:ae:41:26:08:c8:19:2b:d1:46:aa: - 48:d6:64:2a:d7:83:34:ff:2c:2a:c1:6c:19:43:4a: - 07:85:e7:d3:7c:f6:21:68:ef:ea:f2:52:9f:7f:93: - 90:cf - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - X509v3 Subject Key Identifier: - 60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B - X509v3 Basic Constraints: critical - CA:TRUE - Signature Algorithm: md5WithRSAEncryption - ae:aa:9f:fc:b7:d2:cb:1f:5f:39:29:28:18:9e:34:c9:6c:4f: - 6f:1a:f0:64:a2:70:4a:4f:13:86:9b:60:28:9e:e8:81:49:98: - 7d:0a:bb:e5:b0:9d:3d:36:db:8f:05:51:ff:09:31:2a:1f:dd: - 89:77:9e:0f:2e:6c:95:04:ed:86:cb:b4:00:3f:84:02:4d:80: - 6a:2a:2d:78:0b:ae:6f:2b:a2:83:44:83:1f:cd:50:82:4c:24: - af:bd:f7:a5:b4:c8:5a:0f:f4:e7:47:5e:49:8e:37:96:fe:9a: - 88:05:3a:d9:c0:db:29:87:e6:19:96:47:a7:3a:a6:8c:8b:3c: - 77:fe:46:63:a7:53:da:21:d1:ac:7e:49:a2:4b:e6:c3:67:59: - 2f:b3:8a:0e:bb:2c:bd:a9:aa:42:7c:35:c1:d8:7f:d5:a7:31: - 3a:4e:63:43:39:af:08:b0:61:34:8c:d3:98:a9:43:34:f6:0f: - 87:29:3b:9d:c2:56:58:98:77:c3:f7:1b:ac:f6:9d:f8:3e:aa: - a7:54:45:f0:f5:f9:d5:31:65:fe:6b:58:9c:71:b3:1e:d7:52: - ea:32:17:fc:40:60:1d:c9:79:24:b2:f6:6c:fd:a8:66:0e:82: - dd:98:cb:da:c2:44:4f:2e:a0:7b:f2:f7:6b:2c:76:11:84:46: - 8a:78:a3:e3 -MD5 Fingerprint=AB:BF:EA:E3:6B:29:A6:CC:A6:78:35:99:EF:AD:2B:80 ------BEGIN CERTIFICATE----- -MIIDdTCCAl2gAwIBAgILAgAAAAAA1ni3lAUwDQYJKoZIhvcNAQEEBQAwVzELMAkG -A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv -b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw -MDBaFw0xNDAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i -YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT -aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ -jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp -xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp -1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG -snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ -U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8 -9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIABjAdBgNVHQ4EFgQU -YHtmGkUNl8qJUC99BM00qP/8/UswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B -AQQFAAOCAQEArqqf/LfSyx9fOSkoGJ40yWxPbxrwZKJwSk8ThptgKJ7ogUmYfQq7 -5bCdPTbbjwVR/wkxKh/diXeeDy5slQTthsu0AD+EAk2AaioteAuubyuig0SDH81Q -gkwkr733pbTIWg/050deSY43lv6aiAU62cDbKYfmGZZHpzqmjIs8d/5GY6dT2iHR -rH5Jokvmw2dZL7OKDrssvamqQnw1wdh/1acxOk5jQzmvCLBhNIzTmKlDNPYPhyk7 -ncJWWJh3w/cbrPad+D6qp1RF8PX51TFl/mtYnHGzHtdS6jIX/EBgHcl5JLL2bP2o -Zg6C3ZjL2sJETy6ge/L3ayx2EYRGinij4w== +MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ +RTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYD +VQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTAwMDUxMjE4NDYwMFoX +DTI1MDUxMjIzNTkwMFowWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9y +ZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVy +VHJ1c3QgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKMEuyKr +mD1X6CZymrV51Cni4eiVgLGw41uOKymaZN+hXe2wCQVt2yguzmKiYv60iNoS6zjr +IZ3AQSsBUnuId9Mcj8e6uYi1agnnc+gRQKfRzMpijS3ljwumUNKoUMMo6vWrJYeK +mpYcqWe4PwzV9/lSEy/CG9VwcPCPwBLKBsua4dnKM3p31vjsufFoREJIE9LAwqSu +XmD+tqYF/LTdB1kC1FkYmGP1pWPgkAx9XbIGevOF6uvUA65ehD5f/xXtabz5OTZy +dc93Uk3zyZAsuT3lySNTPx8kmCFcB5kpvcY67Oduhjprl3RjM71oGDHweI12v/ye +jl0qhqdNkNwnGjkCAwEAAaNFMEMwHQYDVR0OBBYEFOWdWTCCR1jMrPoIVDaGezq1 +BE3wMBIGA1UdEwEB/wQIMAYBAf8CAQMwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3 +DQEBBQUAA4IBAQCFDF2O5G9RaEIFoN27TyclhAO992T9Ldcw46QQF+vaKSm2eT92 +9hkTI7gQCvlYpNRhcL0EYWoSihfVCr3FvDB81ukMJY2GQE/szKN+OMY3EU/t3Wgx +jkzSswF07r51XgdIGn9w/xZchMB5hbgF/X++ZRGjD8ACtPhSNzkE1akxehi/oCr0 +Epn3o0WC4zxe9Z2etciefC7IpJ5OCBRLbf1wbWsaY71k5h+3zvDyny67G7fyUIhz +ksLi4xaNmjICq44Y3ekQEe5+NauQrz4wlHrQMz2nZQ/1/I6eYs9HRCwBXbsdtTLS +R9I4LtD+gdwyah617jzV/OeBHRnDJELqYzmp -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: 1 (0x1) - Signature Algorithm: sha1WithRSAEncryption - Issuer: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 1 Policy Validation Authority, CN=http://www.valicert.com//emailAddress=info@valicert.com - Validity - Not Before: Jun 25 22:23:48 1999 GMT - Not After : Jun 25 22:23:48 2019 GMT - Subject: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 1 Policy Validation Authority, CN=http://www.valicert.com//emailAddress=info@valicert.com - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:d8:59:82:7a:89:b8:96:ba:a6:2f:68:6f:58:2e: - a7:54:1c:06:6e:f4:ea:8d:48:bc:31:94:17:f0:f3: - 4e:bc:b2:b8:35:92:76:b0:d0:a5:a5:01:d7:00:03: - 12:22:19:08:f8:ff:11:23:9b:ce:07:f5:bf:69:1a: - 26:fe:4e:e9:d1:7f:9d:2c:40:1d:59:68:6e:a6:f8: - 58:b0:9d:1a:8f:d3:3f:f1:dc:19:06:81:a8:0e:e0: - 3a:dd:c8:53:45:09:06:e6:0f:70:c3:fa:40:a6:0e: - e2:56:05:0f:18:4d:fc:20:82:d1:73:55:74:8d:76: - 72:a0:1d:9d:1d:c0:dd:3f:71 - Exponent: 65537 (0x10001) - Signature Algorithm: sha1WithRSAEncryption - 50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f: - 71:ad:64:c8:dd:77:d2:ef:59:55:e8:3f:e8:8e:05:2a:21:f2: - 07:d2:b5:a7:52:fe:9c:b1:b6:e2:5b:77:17:40:ea:72:d6:23: - cb:28:81:32:c3:00:79:18:ec:59:17:89:c9:c6:6a:1e:71:c9: - fd:b7:74:a5:25:45:69:c5:48:ab:19:e1:45:8a:25:6b:19:ee: - e5:bb:12:f5:7f:f7:a6:8d:51:c3:f0:9d:74:b7:a9:3e:a0:a5: - ff:b6:49:03:13:da:22:cc:ed:71:82:2b:99:cf:3a:b7:f5:2d: - 72:c8 -MD5 Fingerprint=65:58:AB:15:AD:57:6C:1E:A8:A7:B5:69:AC:BF:FF:EB -----BEGIN CERTIFICATE----- -MIIC5zCCAlACAQEwDQYJKoZIhvcNAQEFBQAwgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0 -IFZhbGlkYXRpb24gTmV0d29yazEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAz -BgNVBAsTLFZhbGlDZXJ0IENsYXNzIDEgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9y -aXR5MSEwHwYDVQQDExhodHRwOi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG -9w0BCQEWEWluZm9AdmFsaWNlcnQuY29tMB4XDTk5MDYyNTIyMjM0OFoXDTE5MDYy -NTIyMjM0OFowgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0IFZhbGlkYXRpb24gTmV0d29y -azEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAzBgNVBAsTLFZhbGlDZXJ0IENs -YXNzIDEgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9yaXR5MSEwHwYDVQQDExhodHRw -Oi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl -cnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYWYJ6ibiWuqYvaG9Y -LqdUHAZu9OqNSLwxlBfw8068srg1knaw0KWlAdcAAxIiGQj4/xEjm84H9b9pGib+ -TunRf50sQB1ZaG6m+FiwnRqP0z/x3BkGgagO4DrdyFNFCQbmD3DD+kCmDuJWBQ8Y -TfwggtFzVXSNdnKgHZ0dwN0/cQIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAFBoPUn0 -LBwGlN+VYH+Wexf+T3GtZMjdd9LvWVXoP+iOBSoh8gfStadS/pyxtuJbdxdA6nLW -I8sogTLDAHkY7FkXicnGah5xyf23dKUlRWnFSKsZ4UWKJWsZ7uW7EvV/96aNUcPw -nXS3qT6gpf+2SQMT2iLM7XGCK5nPOrf1LXLI +MIIFajCCBFKgAwIBAgIEPLU9RjANBgkqhkiG9w0BAQUFADBmMRIwEAYDVQQKEwli +ZVRSVVNUZWQxGzAZBgNVBAsTEmJlVFJVU1RlZCBSb290IENBczEzMDEGA1UEAxMq +YmVUUlVTVGVkIFJvb3QgQ0EtQmFsdGltb3JlIEltcGxlbWVudGF0aW9uMB4XDTAy +MDQxMTA3Mzg1MVoXDTIyMDQxMTA3Mzg1MVowZjESMBAGA1UEChMJYmVUUlVTVGVk +MRswGQYDVQQLExJiZVRSVVNUZWQgUm9vdCBDQXMxMzAxBgNVBAMTKmJlVFJVU1Rl +ZCBSb290IENBLUJhbHRpbW9yZSBJbXBsZW1lbnRhdGlvbjCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBALx+xDmcjOPWHIb/ymKt4H8wRXqOGrO4x/nRNv8i +805qX4QQ+2aBw5R5MdKR4XeOGCrDFN5R9U+jK7wYFuK13XneIviCfsuBH/0nLI/6 +l2Qijvj/YaOcGx6Sj8CoCd8JEey3fTGaGuqDIQY8n7pc/5TqarjDa1U0Tz0yH92B +FODEPM2dMPgwqZfT7syj0B9fHBOB1BirlNFjw55/NZKeX0Tq7PQiXLfoPX2k+Ymp +kbIq2eszh+6l/ePazIjmiSZuxyuC0F6dWdsU7JGDBcNeDsYq0ATdcT0gTlgn/FP7 +eHgZFLL8kFKJOGJgB7Sg7KxrUNb9uShr71ItOrL/8QFArDcCAwEAAaOCAh4wggIa +MA8GA1UdEwEB/wQFMAMBAf8wggG1BgNVHSAEggGsMIIBqDCCAaQGDysGAQQBsT4A +AAEJKIORMTCCAY8wggFIBggrBgEFBQcCAjCCAToaggE2UmVsaWFuY2Ugb24gb3Ig +dXNlIG9mIHRoaXMgQ2VydGlmaWNhdGUgY3JlYXRlcyBhbiBhY2tub3dsZWRnbWVu +dCBhbmQgYWNjZXB0YW5jZSBvZiB0aGUgdGhlbiBhcHBsaWNhYmxlIHN0YW5kYXJk +IHRlcm1zIGFuZCBjb25kaXRpb25zIG9mIHVzZSwgdGhlIENlcnRpZmljYXRpb24g +UHJhY3RpY2UgU3RhdGVtZW50IGFuZCB0aGUgUmVseWluZyBQYXJ0eSBBZ3JlZW1l +bnQsIHdoaWNoIGNhbiBiZSBmb3VuZCBhdCB0aGUgYmVUUlVTVGVkIHdlYiBzaXRl +LCBodHRwOi8vd3d3LmJldHJ1c3RlZC5jb20vcHJvZHVjdHNfc2VydmljZXMvaW5k +ZXguaHRtbDBBBggrBgEFBQcCARY1aHR0cDovL3d3dy5iZXRydXN0ZWQuY29tL3By +b2R1Y3RzX3NlcnZpY2VzL2luZGV4Lmh0bWwwHQYDVR0OBBYEFEU9w6nR3D8kVpgc +cxiIav+DR+22MB8GA1UdIwQYMBaAFEU9w6nR3D8kVpgccxiIav+DR+22MA4GA1Ud +DwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOCAQEASZK8o+6svfoNyYt5hhwjdrCA +WXf82n+0S9/DZEtqTg6t8n1ZdwWtColzsPq8y9yNAIiPpqCy6qxSJ7+hSHyXEHu6 +7RMdmgduyzFiEuhjA6p9beP4G3YheBufS0OM00mG9htc9i5gFdPp43t1P9ACg9AY +gkHNZTfqjjJ+vWuZXTARyNtIVBw74acT02pIk/c9jH8F6M7ziCpjBLjqflh8AXtb +4cV97yHgjQ5dUX2xZ/2jvTg2xvI4hocalmhgRvsoFEdV4aeADGvi6t9NfJBIoDa9 +CReJf8Py05yc493EG931t3GzUwWJBtDLSoDByFOQtTwxiBdQn8nEDovYqAJjDQ== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: 1 (0x1) - Signature Algorithm: sha1WithRSAEncryption - Issuer: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 2 Policy Validation Authority, CN=http://www.valicert.com//emailAddress=info@valicert.com - Validity - Not Before: Jun 26 00:19:54 1999 GMT - Not After : Jun 26 00:19:54 2019 GMT - Subject: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 2 Policy Validation Authority, CN=http://www.valicert.com//emailAddress=info@valicert.com - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:ce:3a:71:ca:e5:ab:c8:59:92:55:d7:ab:d8:74: - 0e:f9:ee:d9:f6:55:47:59:65:47:0e:05:55:dc:eb: - 98:36:3c:5c:53:5d:d3:30:cf:38:ec:bd:41:89:ed: - 25:42:09:24:6b:0a:5e:b3:7c:dd:52:2d:4c:e6:d4: - d6:7d:5a:59:a9:65:d4:49:13:2d:24:4d:1c:50:6f: - b5:c1:85:54:3b:fe:71:e4:d3:5c:42:f9:80:e0:91: - 1a:0a:5b:39:36:67:f3:3f:55:7c:1b:3f:b4:5f:64: - 73:34:e3:b4:12:bf:87:64:f8:da:12:ff:37:27:c1: - b3:43:bb:ef:7b:6e:2e:69:f7 - Exponent: 65537 (0x10001) - Signature Algorithm: sha1WithRSAEncryption - 3b:7f:50:6f:6f:50:94:99:49:62:38:38:1f:4b:f8:a5:c8:3e: - a7:82:81:f6:2b:c7:e8:c5:ce:e8:3a:10:82:cb:18:00:8e:4d: - bd:a8:58:7f:a1:79:00:b5:bb:e9:8d:af:41:d9:0f:34:ee:21: - 81:19:a0:32:49:28:f4:c4:8e:56:d5:52:33:fd:50:d5:7e:99: - 6c:03:e4:c9:4c:fc:cb:6c:ab:66:b3:4a:21:8c:e5:b5:0c:32: - 3e:10:b2:cc:6c:a1:dc:9a:98:4c:02:5b:f3:ce:b9:9e:a5:72: - 0e:4a:b7:3f:3c:e6:16:68:f8:be:ed:74:4c:bc:5b:d5:62:1f: - 43:dd -MD5 Fingerprint=A9:23:75:9B:BA:49:36:6E:31:C2:DB:F2:E7:66:BA:87 -----BEGIN CERTIFICATE----- -MIIC5zCCAlACAQEwDQYJKoZIhvcNAQEFBQAwgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0 -IFZhbGlkYXRpb24gTmV0d29yazEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAz -BgNVBAsTLFZhbGlDZXJ0IENsYXNzIDIgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9y -aXR5MSEwHwYDVQQDExhodHRwOi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG -9w0BCQEWEWluZm9AdmFsaWNlcnQuY29tMB4XDTk5MDYyNjAwMTk1NFoXDTE5MDYy -NjAwMTk1NFowgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0IFZhbGlkYXRpb24gTmV0d29y -azEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAzBgNVBAsTLFZhbGlDZXJ0IENs -YXNzIDIgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9yaXR5MSEwHwYDVQQDExhodHRw -Oi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl -cnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY -dA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9 -WlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS -v4dk+NoS/zcnwbNDu+97bi5p9wIDAQABMA0GCSqGSIb3DQEBBQUAA4GBADt/UG9v -UJSZSWI4OB9L+KXIPqeCgfYrx+jFzug6EILLGACOTb2oWH+heQC1u+mNr0HZDzTu -IYEZoDJJKPTEjlbVUjP9UNV+mWwD5MlM/Mtsq2azSiGM5bUMMj4QssxsodyamEwC -W/POuZ6lcg5Ktz885hZo+L7tdEy8W9ViH0Pd +MIIFLDCCBBSgAwIBAgIEOU99hzANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJX +VzESMBAGA1UEChMJYmVUUlVTVGVkMRswGQYDVQQDExJiZVRSVVNUZWQgUm9vdCBD +QXMxGjAYBgNVBAMTEWJlVFJVU1RlZCBSb290IENBMB4XDTAwMDYyMDE0MjEwNFoX +DTEwMDYyMDEzMjEwNFowWjELMAkGA1UEBhMCV1cxEjAQBgNVBAoTCWJlVFJVU1Rl +ZDEbMBkGA1UEAxMSYmVUUlVTVGVkIFJvb3QgQ0FzMRowGAYDVQQDExFiZVRSVVNU +ZWQgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANS0c3oT +CjhVAb6JVuGUntS+WutKNHUbYSnE4a0IYCF4SP+00PpeQY1hRIfo7clY+vyTmt9P +6j41ffgzeubx181vSUs9Ty1uDoM6GHh3o8/n9E1z2Jo7Gh2+lVPPIJfCzz4kUmwM +jmVZxXH/YgmPqsWPzGCgc0rXOD8Vcr+il7dw6K/ifhYGTPWqZCZyByWtNfwYsSbX +2P8ZDoMbjNx4RWc0PfSvHI3kbWvtILNnmrRhyxdviTX/507AMhLn7uzf/5cwdO2N +R47rtMNE5qdMf1ZD6Li8tr76g5fmu/vEtpO+GRg+jIG5c4gW9JZDnGdzF5DYCW5j +rEq2I8QBoa2k5MUCAwEAAaOCAfgwggH0MA8GA1UdEwEB/wQFMAMBAf8wggFZBgNV +HSAEggFQMIIBTDCCAUgGCisGAQQBsT4BAAAwggE4MIIBAQYIKwYBBQUHAgIwgfQa +gfFSZWxpYW5jZSBvbiB0aGlzIGNlcnRpZmljYXRlIGJ5IGFueSBwYXJ0eSBhc3N1 +bWVzIGFjY2VwdGFuY2Ugb2YgdGhlIHRoZW4gYXBwbGljYWJsZSBzdGFuZGFyZCB0 +ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB1c2UsIGFuZCBjZXJ0aWZpY2F0aW9uIHBy +YWN0aWNlIHN0YXRlbWVudCwgd2hpY2ggY2FuIGJlIGZvdW5kIGF0IGJlVFJVU1Rl +ZCdzIHdlYiBzaXRlLCBodHRwczovL3d3dy5iZVRSVVNUZWQuY29tL3ZhdWx0L3Rl +cm1zMDEGCCsGAQUFBwIBFiVodHRwczovL3d3dy5iZVRSVVNUZWQuY29tL3ZhdWx0 +L3Rlcm1zMDQGA1UdHwQtMCswKaAnoCWkIzAhMRIwEAYDVQQKEwliZVRSVVNUZWQx +CzAJBgNVBAYTAldXMB0GA1UdDgQWBBQquZtpLjub2M3eKjEENGvKBxirZzAfBgNV +HSMEGDAWgBQquZtpLjub2M3eKjEENGvKBxirZzAOBgNVHQ8BAf8EBAMCAf4wDQYJ +KoZIhvcNAQEFBQADggEBAHlh26Nebhax6nZR+csVm8tpvuaBa58oH2U+3RGFktTo +Qb9+M70j5/Egv6S0phkBxoyNNXxlpE8JpNbYIxUFE6dDea/bow6be3ga8wSGWsb2 +jCBHOElQBp1yZzrwmAOtlmdE/D8QDYZN5AA7KXvOOzuZhmElQITcE2K3+spZ1gMe +1lMBzW1MaFVA4e5rxyoAAEiCswoBw2AqDPeCNe5IhpbkdNQ96gFxugR1QKepfzk5 +mlWXKWWuGVUlBXJH0+gY3Ljpr0NzARJ0o+FcXxVdJPP55PS2Z2cS52QiivalQaYc +tmBjRYoQtLpGEK5BV2VsPyMQPyEQWbfkQN0mDCP2qq4= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: 1 (0x1) - Signature Algorithm: sha1WithRSAEncryption - Issuer: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 3 Policy Validation Authority, CN=http://www.valicert.com//emailAddress=info@valicert.com - Validity - Not Before: Jun 26 00:22:33 1999 GMT - Not After : Jun 26 00:22:33 2019 GMT - Subject: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 3 Policy Validation Authority, CN=http://www.valicert.com//emailAddress=info@valicert.com - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:e3:98:51:96:1c:e8:d5:b1:06:81:6a:57:c3:72: - 75:93:ab:cf:9e:a6:fc:f3:16:52:d6:2d:4d:9f:35: - 44:a8:2e:04:4d:07:49:8a:38:29:f5:77:37:e7:b7: - ab:5d:df:36:71:14:99:8f:dc:c2:92:f1:e7:60:92: - 97:ec:d8:48:dc:bf:c1:02:20:c6:24:a4:28:4c:30: - 5a:76:6d:b1:5c:f3:dd:de:9e:10:71:a1:88:c7:5b: - 9b:41:6d:ca:b0:b8:8e:15:ee:ad:33:2b:cf:47:04: - 5c:75:71:0a:98:24:98:29:a7:49:59:a5:dd:f8:b7: - 43:62:61:f3:d3:e2:d0:55:3f - Exponent: 65537 (0x10001) - Signature Algorithm: sha1WithRSAEncryption - 56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d: - f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42: - d3:3e:cf:a9:54:f4:f1:d8:92:16:8c:d1:04:cb:4b:ab:c9:9f: - 45:ae:3c:8a:a9:b0:71:33:5d:c8:c5:57:df:af:a8:35:b3:7f: - 89:87:e9:e8:25:92:b8:7f:85:7a:ae:d6:bc:1e:37:58:2a:67: - c9:91:cf:2a:81:3e:ed:c6:39:df:c0:3e:19:9c:19:cc:13:4d: - 82:41:b5:8c:de:e0:3d:60:08:20:0f:45:7e:6b:a2:7f:a3:8c: - 15:ee -MD5 Fingerprint=A2:6F:53:B7:EE:40:DB:4A:68:E7:FA:18:D9:10:4B:72 -----BEGIN CERTIFICATE----- -MIIC5zCCAlACAQEwDQYJKoZIhvcNAQEFBQAwgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0 -IFZhbGlkYXRpb24gTmV0d29yazEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAz -BgNVBAsTLFZhbGlDZXJ0IENsYXNzIDMgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9y -aXR5MSEwHwYDVQQDExhodHRwOi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG -9w0BCQEWEWluZm9AdmFsaWNlcnQuY29tMB4XDTk5MDYyNjAwMjIzM1oXDTE5MDYy -NjAwMjIzM1owgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0IFZhbGlkYXRpb24gTmV0d29y -azEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAzBgNVBAsTLFZhbGlDZXJ0IENs -YXNzIDMgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9yaXR5MSEwHwYDVQQDExhodHRw -Oi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl -cnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjmFGWHOjVsQaBalfD -cnWTq8+epvzzFlLWLU2fNUSoLgRNB0mKOCn1dzfnt6td3zZxFJmP3MKS8edgkpfs -2Ejcv8ECIMYkpChMMFp2bbFc893enhBxoYjHW5tBbcqwuI4V7q0zK89HBFx1cQqY -JJgpp0lZpd34t0NiYfPT4tBVPwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAFa7AliE -Zwgs3x/be0kz9dNnnfS0ChCzycUs4pJqcXgn8nCDQtM+z6lU9PHYkhaM0QTLS6vJ -n0WuPIqpsHEzXcjFV9+vqDWzf4mH6eglkrh/hXqu1rweN1gqZ8mRzyqBPu3GOd/A -PhmcGcwTTYJBtYze4D1gCCAPRX5ron+jjBXu +MIIGUTCCBTmgAwIBAgIEPLVPQDANBgkqhkiG9w0BAQUFADBmMRIwEAYDVQQKEwli +ZVRSVVNUZWQxGzAZBgNVBAsTEmJlVFJVU1RlZCBSb290IENBczEzMDEGA1UEAxMq +YmVUUlVTVGVkIFJvb3QgQ0EgLSBFbnRydXN0IEltcGxlbWVudGF0aW9uMB4XDTAy +MDQxMTA4MjQyN1oXDTIyMDQxMTA4NTQyN1owZjESMBAGA1UEChMJYmVUUlVTVGVk +MRswGQYDVQQLExJiZVRSVVNUZWQgUm9vdCBDQXMxMzAxBgNVBAMTKmJlVFJVU1Rl +ZCBSb290IENBIC0gRW50cnVzdCBJbXBsZW1lbnRhdGlvbjCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBALr0RAOqEmq1Q+xVkrYwfTVXDNvzDSduTPdQqJtO +K2/b9a0cS12zqcH+e0TrW6MFDR/FNCswACnxeECypP869AGIF37m1CbTukzqMvtD +d5eHI8XbQ6P1KqNRXuE70mVpflUVm3rnafdE4Fe1FehmYA8NA/uCjqPoEXtsvsdj +DheT389Lrm5zdeDzqrmkwAkbhepxKYhBMvnwKg5sCfJ0a2ZsUhMfGLzUPvfYbiCe +yv78IZTuEyhL11xeDGbu6bsPwTSxfwh28z0mcMmLJR1iJAzqHHVOwBLkuhMdMCkt +VjMFu5dZfsZJT4nXLySotohAtWSSU1Yk5KKghbNekLQSM80CAwEAAaOCAwUwggMB +MIIBtwYDVR0gBIIBrjCCAaowggGmBg8rBgEEAbE+AAACCSiDkTEwggGRMIIBSQYI +KwYBBQUHAgIwggE7GoIBN1JlbGlhbmNlIG9uIG9yIHVzZSBvZiB0aGlzIENlcnRp +ZmljYXRlIGNyZWF0ZXMgYW4gYWNrbm93bGVkZ21lbnQgYW5kIGFjY2VwdGFuY2Ug +b2YgdGhlIHRoZW4gYXBwbGljYWJsZSBzdGFuZGFyZCB0ZXJtcyBhbmQgY29uZGl0 +aW9ucyBvZiB1c2UsIHRoZSBDZXJ0aWZpY2F0aW9uIFByYWN0aWNlIFN0YXRlbWVu +dCBhbmQgdGhlIFJlbHlpbmcgUGFydHkgQWdyZWVtZW50LCB3aGljaCBjYW4gYmUg +Zm91bmQgYXQgdGhlIGJlVFJVU1RlZCB3ZWIgc2l0ZSwgaHR0cHM6Ly93d3cuYmV0 +cnVzdGVkLmNvbS9wcm9kdWN0c19zZXJ2aWNlcy9pbmRleC5odG1sMEIGCCsGAQUF +BwIBFjZodHRwczovL3d3dy5iZXRydXN0ZWQuY29tL3Byb2R1Y3RzX3NlcnZpY2Vz +L2luZGV4Lmh0bWwwEQYJYIZIAYb4QgEBBAQDAgAHMIGJBgNVHR8EgYEwfzB9oHug +eaR3MHUxEjAQBgNVBAoTCWJlVFJVU1RlZDEbMBkGA1UECxMSYmVUUlVTVGVkIFJv +b3QgQ0FzMTMwMQYDVQQDEypiZVRSVVNUZWQgUm9vdCBDQSAtIEVudHJ1c3QgSW1w +bGVtZW50YXRpb24xDTALBgNVBAMTBENSTDEwKwYDVR0QBCQwIoAPMjAwMjA0MTEw +ODI0MjdagQ8yMDIyMDQxMTA4NTQyN1owCwYDVR0PBAQDAgEGMB8GA1UdIwQYMBaA +FH1w5a44iwY/qhwaj/nPJDCqhIQWMB0GA1UdDgQWBBR9cOWuOIsGP6ocGo/5zyQw +qoSEFjAMBgNVHRMEBTADAQH/MB0GCSqGSIb2fQdBAAQQMA4bCFY2LjA6NC4wAwIE +kDANBgkqhkiG9w0BAQUFAAOCAQEAKrgXzh8QlOu4mre5X+za95IkrNySO8cgjfKZ +5V04ocI07cUTWVwFtStPYZuR+0H8/NU8TZh2BvWBfevdkObRVlTa4y0MnxEylCIB +evZsLHRnBMylj44ss0O1lKLQfelifwa+JwGDnjr9iu6YQ0pr17WXOzq/T220Y/oz +ADQuLW2WyXvKmWO6vvT2MKAtmJbpVkQFqUSjYRDrgqFnXbxdJ3Wqiig2KjiS2d2k +XgClzMx8KSreKJCrt+G2/30lC0DYqjSjLd4H61/OCt3Kfjp9JsFiaDrmLzfzgYYh +xKlkqu9FNtEaZnz46TfW1mG+oq1I59/mdP7TbX3SJdysYlep9w== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: - 8b:5b:75:56:84:54:85:0b:00:cf:af:38:48:ce:b1:a4 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 1 Public Primary Certification Authority - G3 - Validity - Not Before: Oct 1 00:00:00 1999 GMT - Not After : Jul 16 23:59:59 2036 GMT - Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 1 Public Primary Certification Authority - G3 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:dd:84:d4:b9:b4:f9:a7:d8:f3:04:78:9c:de:3d: - dc:6c:13:16:d9:7a:dd:24:51:66:c0:c7:26:59:0d: - ac:06:08:c2:94:d1:33:1f:f0:83:35:1f:6e:1b:c8: - de:aa:6e:15:4e:54:27:ef:c4:6d:1a:ec:0b:e3:0e: - f0:44:a5:57:c7:40:58:1e:a3:47:1f:71:ec:60:f6: - 6d:94:c8:18:39:ed:fe:42:18:56:df:e4:4c:49:10: - 78:4e:01:76:35:63:12:36:dd:66:bc:01:04:36:a3: - 55:68:d5:a2:36:09:ac:ab:21:26:54:06:ad:3f:ca: - 14:e0:ac:ca:ad:06:1d:95:e2:f8:9d:f1:e0:60:ff: - c2:7f:75:2b:4c:cc:da:fe:87:99:21:ea:ba:fe:3e: - 54:d7:d2:59:78:db:3c:6e:cf:a0:13:00:1a:b8:27: - a1:e4:be:67:96:ca:a0:c5:b3:9c:dd:c9:75:9e:eb: - 30:9a:5f:a3:cd:d9:ae:78:19:3f:23:e9:5c:db:29: - bd:ad:55:c8:1b:54:8c:63:f6:e8:a6:ea:c7:37:12: - 5c:a3:29:1e:02:d9:db:1f:3b:b4:d7:0f:56:47:81: - 15:04:4a:af:83:27:d1:c5:58:88:c1:dd:f6:aa:a7: - a3:18:da:68:aa:6d:11:51:e1:bf:65:6b:9f:96:76: - d1:3d - Exponent: 65537 (0x10001) - Signature Algorithm: sha1WithRSAEncryption - ab:66:8d:d7:b3:ba:c7:9a:b6:e6:55:d0:05:f1:9f:31:8d:5a: - aa:d9:aa:46:26:0f:71:ed:a5:ad:53:56:62:01:47:2a:44:e9: - fe:3f:74:0b:13:9b:b9:f4:4d:1b:b2:d1:5f:b2:b6:d2:88:5c: - b3:9f:cd:cb:d4:a7:d9:60:95:84:3a:f8:c1:37:1d:61:ca:e7: - b0:c5:e5:91:da:54:a6:ac:31:81:ae:97:de:cd:08:ac:b8:c0: - 97:80:7f:6e:72:a4:e7:69:13:95:65:1f:c4:93:3c:fd:79:8f: - 04:d4:3e:4f:ea:f7:9e:ce:cd:67:7c:4f:65:02:ff:91:85:54: - 73:c7:ff:36:f7:86:2d:ec:d0:5e:4f:ff:11:9f:72:06:d6:b8: - 1a:f1:4c:0d:26:65:e2:44:80:1e:c7:9f:e3:dd:e8:0a:da:ec: - a5:20:80:69:68:a1:4f:7e:e1:6b:cf:07:41:fa:83:8e:bc:38: - dd:b0:2e:11:b1:6b:b2:42:cc:9a:bc:f9:48:22:79:4a:19:0f: - b2:1c:3e:20:74:d9:6a:c3:be:f2:28:78:13:56:79:4f:6d:50: - ea:1b:b0:b5:57:b1:37:66:58:23:f3:dc:0f:df:0a:87:c4:ef: - 86:05:d5:38:14:60:99:a3:4b:de:06:96:71:2c:f2:db:b6:1f: - a4:ef:3f:ee -MD5 Fingerprint=B1:47:BC:18:57:D1:18:A0:78:2D:EC:71:E8:2A:95:73 -----BEGIN CERTIFICATE----- -MIIEGjCCAwICEQCLW3VWhFSFCwDPrzhIzrGkMA0GCSqGSIb3DQEBBQUAMIHKMQsw -CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl -cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu -LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT -aWduIENsYXNzIDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp -dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD -VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT -aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ -bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu -IENsYXNzIDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg -LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN2E1Lm0+afY8wR4 -nN493GwTFtl63SRRZsDHJlkNrAYIwpTRMx/wgzUfbhvI3qpuFU5UJ+/EbRrsC+MO -8ESlV8dAWB6jRx9x7GD2bZTIGDnt/kIYVt/kTEkQeE4BdjVjEjbdZrwBBDajVWjV -ojYJrKshJlQGrT/KFOCsyq0GHZXi+J3x4GD/wn91K0zM2v6HmSHquv4+VNfSWXjb -PG7PoBMAGrgnoeS+Z5bKoMWznN3JdZ7rMJpfo83ZrngZPyPpXNspva1VyBtUjGP2 -6KbqxzcSXKMpHgLZ2x87tNcPVkeBFQRKr4Mn0cVYiMHd9qqnoxjaaKptEVHhv2Vr -n5Z20T0CAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAq2aN17O6x5q25lXQBfGfMY1a -qtmqRiYPce2lrVNWYgFHKkTp/j90CxObufRNG7LRX7K20ohcs5/Ny9Sn2WCVhDr4 -wTcdYcrnsMXlkdpUpqwxga6X3s0IrLjAl4B/bnKk52kTlWUfxJM8/XmPBNQ+T+r3 -ns7NZ3xPZQL/kYVUc8f/NveGLezQXk//EZ9yBta4GvFMDSZl4kSAHsef493oCtrs -pSCAaWihT37ha88HQfqDjrw43bAuEbFrskLMmrz5SCJ5ShkPshw+IHTZasO+8ih4 -E1Z5T21Q6huwtVexN2ZYI/PcD98Kh8TvhgXVOBRgmaNL3gaWcSzy27YfpO8/7g== +MIIFaDCCBFCgAwIBAgIQO1nHe81bV569N1KsdrSqGjANBgkqhkiG9w0BAQUFADBi +MRIwEAYDVQQKEwliZVRSVVNUZWQxGzAZBgNVBAsTEmJlVFJVU1RlZCBSb290IENB +czEvMC0GA1UEAxMmYmVUUlVTVGVkIFJvb3QgQ0EgLSBSU0EgSW1wbGVtZW50YXRp +b24wHhcNMDIwNDExMTExODEzWhcNMjIwNDEyMTEwNzI1WjBiMRIwEAYDVQQKEwli +ZVRSVVNUZWQxGzAZBgNVBAsTEmJlVFJVU1RlZCBSb290IENBczEvMC0GA1UEAxMm +YmVUUlVTVGVkIFJvb3QgQ0EgLSBSU0EgSW1wbGVtZW50YXRpb24wggEiMA0GCSqG +SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkujQwCY5X0LkGLG9uJIAiv11DpvpPrILn +HGhwhRujbrWqeNluB0s/6d/16uhUoWGKDi9pdRi3DOUUjXFumLhV/AyV0Jtu4S2I +1DpAa5LxmZZk3tv/ePTulh1HiXzUvrmIdyM6CeYEnm2qXtLIvZpOGd+J6lsOfsPk +tPDgaTuID0GQ+NRxQyTBjyZLO1bp/4xsN+lFrYWMU8NghpBKlsmzVLC7F/AcRdnU +GxlkVgoZ98zh/4avflherHqQH8koOUV7orbHnB/ahdQhhlkwk75TMzf270HPM8er +cmsl9fNTGwxMLvF1S++gh/f+ihXQbNXL+WhTuXAVE8L1LvtDNXUtAgMBAAGjggIY +MIICFDAMBgNVHRMEBTADAQH/MIIBtQYDVR0gBIIBrDCCAagwggGkBg8rBgEEAbE+ +AAADCSiDkTEwggGPMEEGCCsGAQUFBwIBFjVodHRwOi8vd3d3LmJldHJ1c3RlZC5j +b20vcHJvZHVjdHNfc2VydmljZXMvaW5kZXguaHRtbDCCAUgGCCsGAQUFBwICMIIB +OhqCATZSZWxpYW5jZSBvbiBvciB1c2Ugb2YgdGhpcyBDZXJ0aWZpY2F0ZSBjcmVh +dGVzIGFuIGFja25vd2xlZGdtZW50IGFuZCBhY2NlcHRhbmNlIG9mIHRoZSB0aGVu +IGFwcGxpY2FibGUgc3RhbmRhcmQgdGVybXMgYW5kIGNvbmRpdGlvbnMgb2YgdXNl +LCB0aGUgQ2VydGlmaWNhdGlvbiBQcmFjdGljZSBTdGF0ZW1lbnQgYW5kIHRoZSBS +ZWx5aW5nIFBhcnR5IEFncmVlbWVudCwgd2hpY2ggY2FuIGJlIGZvdW5kIGF0IHRo +ZSBiZVRSVVNUZWQgd2ViIHNpdGUsIGh0dHA6Ly93d3cuYmV0cnVzdGVkLmNvbS9w +cm9kdWN0c19zZXJ2aWNlcy9pbmRleC5odG1sMAsGA1UdDwQEAwIBBjAfBgNVHSME +GDAWgBSp7BR++dlDzFMrFK3P9/BZiUHNGTAdBgNVHQ4EFgQUqewUfvnZQ8xTKxSt +z/fwWYlBzRkwDQYJKoZIhvcNAQEFBQADggEBANuXsHXqDMTBmMpWBcCorSZIry0g +6IHHtt9DwSwddUvUQo3neqh03GZCWYez9Wlt2ames30cMcH1VOJZJEnl7r05pmuK +mET7m9cqg5c0Lcd9NUwtNLg+DcTsiCevnpL9UGGCqGAHFFPMZRPB9kdEadIxyKbd +LrML3kqNWz2rDcI1UqJWN8wyiyiFQpyRQHpwKzg21eFzGh/l+n5f3NacOzDq28Bb +J1zTcwfBwvNMm2+fG8oeqqg4MwlYsq78B+g23FW6L09A/nq9BqaBwZMifIYRCgZ3 +SK41ty8ymmFei74pnykkiFY5LKjSq5YDWtRIn7lAhAuYaPsBQ9Yb4gmxlxw= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: - 61:70:cb:49:8c:5f:98:45:29:e7:b0:a6:d9:50:5b:7a - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 2 Public Primary Certification Authority - G3 - Validity - Not Before: Oct 1 00:00:00 1999 GMT - Not After : Jul 16 23:59:59 2036 GMT - Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 2 Public Primary Certification Authority - G3 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:af:0a:0d:c2:d5:2c:db:67:b9:2d:e5:94:27:dd: - a5:be:e0:b0:4d:8f:b3:61:56:3c:d6:7c:c3:f4:cd: - 3e:86:cb:a2:88:e2:e1:d8:a4:69:c5:b5:e2:bf:c1: - a6:47:50:5e:46:39:8b:d5:96:ba:b5:6f:14:bf:10: - ce:27:13:9e:05:47:9b:31:7a:13:d8:1f:d9:d3:02: - 37:8b:ad:2c:47:f0:8e:81:06:a7:0d:30:0c:eb:f7: - 3c:0f:20:1d:dc:72:46:ee:a5:02:c8:5b:c3:c9:56: - 69:4c:c5:18:c1:91:7b:0b:d5:13:00:9b:bc:ef:c3: - 48:3e:46:60:20:85:2a:d5:90:b6:cd:8b:a0:cc:32: - dd:b7:fd:40:55:b2:50:1c:56:ae:cc:8d:77:4d:c7: - 20:4d:a7:31:76:ef:68:92:8a:90:1e:08:81:56:b2: - ad:69:a3:52:d0:cb:1c:c4:23:3d:1f:99:fe:4c:e8: - 16:63:8e:c6:08:8e:f6:31:f6:d2:fa:e5:76:dd:b5: - 1c:92:a3:49:cd:cd:01:cd:68:cd:a9:69:ba:a3:eb: - 1d:0d:9c:a4:20:a6:c1:a0:c5:d1:46:4c:17:6d:d2: - ac:66:3f:96:8c:e0:84:d4:36:ff:22:59:c5:f9:11: - 60:a8:5f:04:7d:f2:1a:f6:25:42:61:0f:c4:4a:b8: - 3e:89 - Exponent: 65537 (0x10001) - Signature Algorithm: sha1WithRSAEncryption - 34:26:15:3c:c0:8d:4d:43:49:1d:bd:e9:21:92:d7:66:9c:b7: - de:c5:b8:d0:e4:5d:5f:76:22:c0:26:f9:84:3a:3a:f9:8c:b5: - fb:ec:60:f1:e8:ce:04:b0:c8:dd:a7:03:8f:30:f3:98:df:a4: - e6:a4:31:df:d3:1c:0b:46:dc:72:20:3f:ae:ee:05:3c:a4:33: - 3f:0b:39:ac:70:78:73:4b:99:2b:df:30:c2:54:b0:a8:3b:55: - a1:fe:16:28:cd:42:bd:74:6e:80:db:27:44:a7:ce:44:5d:d4: - 1b:90:98:0d:1e:42:94:b1:00:2c:04:d0:74:a3:02:05:22:63: - 63:cd:83:b5:fb:c1:6d:62:6b:69:75:fd:5d:70:41:b9:f5:bf: - 7c:df:be:c1:32:73:22:21:8b:58:81:7b:15:91:7a:ba:e3:64: - 48:b0:7f:fb:36:25:da:95:d0:f1:24:14:17:dd:18:80:6b:46: - 23:39:54:f5:8e:62:09:04:1d:94:90:a6:9b:e6:25:e2:42:45: - aa:b8:90:ad:be:08:8f:a9:0b:42:18:94:cf:72:39:e1:b1:43: - e0:28:cf:b7:e7:5a:6c:13:6b:49:b3:ff:e3:18:7c:89:8b:33: - 5d:ac:33:d7:a7:f9:da:3a:55:c9:58:10:f9:aa:ef:5a:b6:cf: - 4b:4b:df:2a -MD5 Fingerprint=F8:BE:C4:63:22:C9:A8:46:74:8B:B8:1D:1E:4A:2B:F6 -----BEGIN CERTIFICATE----- -MIIEGTCCAwECEGFwy0mMX5hFKeewptlQW3owDQYJKoZIhvcNAQEFBQAwgcoxCzAJ -BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVy -aVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24s -IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNp -Z24gQ2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0 -eSAtIEczMB4XDTk5MTAwMTAwMDAwMFoXDTM2MDcxNjIzNTk1OVowgcoxCzAJBgNV -BAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNp -Z24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24sIElu -Yy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24g -Q2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAt -IEczMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArwoNwtUs22e5LeWU -J92lvuCwTY+zYVY81nzD9M0+hsuiiOLh2KRpxbXiv8GmR1BeRjmL1Za6tW8UvxDO -JxOeBUebMXoT2B/Z0wI3i60sR/COgQanDTAM6/c8DyAd3HJG7qUCyFvDyVZpTMUY -wZF7C9UTAJu878NIPkZgIIUq1ZC2zYugzDLdt/1AVbJQHFauzI13TccgTacxdu9o -koqQHgiBVrKtaaNS0MscxCM9H5n+TOgWY47GCI72MfbS+uV23bUckqNJzc0BzWjN -qWm6o+sdDZykIKbBoMXRRkwXbdKsZj+WjOCE1Db/IlnF+RFgqF8EffIa9iVCYQ/E -Srg+iQIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQA0JhU8wI1NQ0kdvekhktdmnLfe -xbjQ5F1fdiLAJvmEOjr5jLX77GDx6M4EsMjdpwOPMPOY36TmpDHf0xwLRtxyID+u -7gU8pDM/CzmscHhzS5kr3zDCVLCoO1Wh/hYozUK9dG6A2ydEp85EXdQbkJgNHkKU -sQAsBNB0owIFImNjzYO1+8FtYmtpdf1dcEG59b98377BMnMiIYtYgXsVkXq642RI -sH/7NiXaldDxJBQX3RiAa0YjOVT1jmIJBB2UkKab5iXiQkWquJCtvgiPqQtCGJTP -cjnhsUPgKM+351psE2tJs//jGHyJizNdrDPXp/naOlXJWBD5qu9ats9LS98q +MIIDDDCCAfSgAwIBAgIDAQAgMA0GCSqGSIb3DQEBBQUAMD4xCzAJBgNVBAYTAlBM +MRswGQYDVQQKExJVbml6ZXRvIFNwLiB6IG8uby4xEjAQBgNVBAMTCUNlcnR1bSBD +QTAeFw0wMjA2MTExMDQ2MzlaFw0yNzA2MTExMDQ2MzlaMD4xCzAJBgNVBAYTAlBM +MRswGQYDVQQKExJVbml6ZXRvIFNwLiB6IG8uby4xEjAQBgNVBAMTCUNlcnR1bSBD +QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM6xwS7TT3zNJc4YPk/E +jG+AanPIW1H4m9LcuwBcsaD8dQPugfCI7iNS6eYVM42sLQnFdvkrOYCJ5JdLkKWo +ePhzQ3ukYbDYWMzhbGZ+nPMJXlVjhNWo7/OxLjBos8Q82KxujZlakE403Daaj4GI +ULdtlkIJ89eVgw1BS7Bqa/j8D35in2fE7SZfECYPCE/wpFcozo+47UX2bu4lXapu +Ob7kky/ZR6By6/qmW6/KUz/iDsaWVhFu9+lmqSbYf5VT7QqFiLpPKaVCjF62/IUg +AKpoC6EahQGcxEZjgoi2IrHu/qpGWX7PNSzVttpd90gzFFS269lvzs2I1qsb2pY7 +HVkCAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEA +uI3O7+cUus/usESSbLQ5PqKEbq24IXfS1HeCh+YgQYHu4vgRt2PRFze+GXYkHAQa +TOs9qmdvLdTN/mUxcMUbpgIKumB7bVjCmkn+YzILa+M6wKyrO7Do0wlRjBCDxjTg +xSvgGrZgFCdsMneMvLJymM/NzD+5yCRCFNZX/OYmQ6kd5YCQzgNUKD73P9P4Te1q +CjqTE5s7FCMTY5w/0YcneeVMUeMBrYVdGjux1XMQpNPyvG5k9VpWkKjHDkx0Dy5x +O/fIR/RpbxXyEV6DHpx8Uq79AtoSqFlnGNu8cN2bsWntgM6JQEhqDjXKKWYVIZQs +6GAqm4VKQPNriiTsBhYscw== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: - 9b:7e:06:49:a3:3e:62:b9:d5:ee:90:48:71:29:ef:57 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G3 - Validity - Not Before: Oct 1 00:00:00 1999 GMT - Not After : Jul 16 23:59:59 2036 GMT - Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G3 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:cb:ba:9c:52:fc:78:1f:1a:1e:6f:1b:37:73:bd: - f8:c9:6b:94:12:30:4f:f0:36:47:f5:d0:91:0a:f5: - 17:c8:a5:61:c1:16:40:4d:fb:8a:61:90:e5:76:20: - c1:11:06:7d:ab:2c:6e:a6:f5:11:41:8e:fa:2d:ad: - 2a:61:59:a4:67:26:4c:d0:e8:bc:52:5b:70:20:04: - 58:d1:7a:c9:a4:69:bc:83:17:64:ad:05:8b:bc:d0: - 58:ce:8d:8c:f5:eb:f0:42:49:0b:9d:97:27:67:32: - 6e:e1:ae:93:15:1c:70:bc:20:4d:2f:18:de:92:88: - e8:6c:85:57:11:1a:e9:7e:e3:26:11:54:a2:45:96: - 55:83:ca:30:89:e8:dc:d8:a3:ed:2a:80:3f:7f:79: - 65:57:3e:15:20:66:08:2f:95:93:bf:aa:47:2f:a8: - 46:97:f0:12:e2:fe:c2:0a:2b:51:e6:76:e6:b7:46: - b7:e2:0d:a6:cc:a8:c3:4c:59:55:89:e6:e8:53:5c: - 1c:ea:9d:f0:62:16:0b:a7:c9:5f:0c:f0:de:c2:76: - ce:af:f7:6a:f2:fa:41:a6:a2:33:14:c9:e5:7a:63: - d3:9e:62:37:d5:85:65:9e:0e:e6:53:24:74:1b:5e: - 1d:12:53:5b:c7:2c:e7:83:49:3b:15:ae:8a:68:b9: - 57:97 - Exponent: 65537 (0x10001) - Signature Algorithm: sha1WithRSAEncryption - 11:14:96:c1:ab:92:08:f7:3f:2f:c9:b2:fe:e4:5a:9f:64:de: - db:21:4f:86:99:34:76:36:57:dd:d0:15:2f:c5:ad:7f:15:1f: - 37:62:73:3e:d4:e7:5f:ce:17:03:db:35:fa:2b:db:ae:60:09: - 5f:1e:5f:8f:6e:bb:0b:3d:ea:5a:13:1e:0c:60:6f:b5:c0:b5: - 23:22:2e:07:0b:cb:a9:74:cb:47:bb:1d:c1:d7:a5:6b:cc:2f: - d2:42:fd:49:dd:a7:89:cf:53:ba:da:00:5a:28:bf:82:df:f8: - ba:13:1d:50:86:82:fd:8e:30:8f:29:46:b0:1e:3d:35:da:38: - 62:16:18:4a:ad:e6:b6:51:6c:de:af:62:eb:01:d0:1e:24:fe: - 7a:8f:12:1a:12:68:b8:fb:66:99:14:14:45:5c:ae:e7:ae:69: - 17:81:2b:5a:37:c9:5e:2a:f4:c6:e2:a1:5c:54:9b:a6:54:00: - cf:f0:f1:c1:c7:98:30:1a:3b:36:16:db:a3:6e:ea:fd:ad:b2: - c2:da:ef:02:47:13:8a:c0:f1:b3:31:ad:4f:1c:e1:4f:9c:af: - 0f:0c:9d:f7:78:0d:d8:f4:35:56:80:da:b7:6d:17:8f:9d:1e: - 81:64:e1:fe:c5:45:ba:ad:6b:b9:0a:7a:4e:4f:4b:84:ee:4b: - f1:7d:dd:11 -MD5 Fingerprint=CD:68:B6:A7:C7:C4:CE:75:E0:1D:4F:57:44:61:92:09 -----BEGIN CERTIFICATE----- -MIIEGjCCAwICEQCbfgZJoz5iudXukEhxKe9XMA0GCSqGSIb3DQEBBQUAMIHKMQsw -CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl -cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu -LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT -aWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp -dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD -VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT -aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ -bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu -IENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg -LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMu6nFL8eB8aHm8b -N3O9+MlrlBIwT/A2R/XQkQr1F8ilYcEWQE37imGQ5XYgwREGfassbqb1EUGO+i2t -KmFZpGcmTNDovFJbcCAEWNF6yaRpvIMXZK0Fi7zQWM6NjPXr8EJJC52XJ2cybuGu -kxUccLwgTS8Y3pKI6GyFVxEa6X7jJhFUokWWVYPKMIno3Nij7SqAP395ZVc+FSBm -CC+Vk7+qRy+oRpfwEuL+wgorUeZ25rdGt+INpsyow0xZVYnm6FNcHOqd8GIWC6fJ -Xwzw3sJ2zq/3avL6QaaiMxTJ5Xpj055iN9WFZZ4O5lMkdBteHRJTW8cs54NJOxWu -imi5V5cCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAERSWwauSCPc/L8my/uRan2Te -2yFPhpk0djZX3dAVL8WtfxUfN2JzPtTnX84XA9s1+ivbrmAJXx5fj267Cz3qWhMe -DGBvtcC1IyIuBwvLqXTLR7sdwdela8wv0kL9Sd2nic9TutoAWii/gt/4uhMdUIaC -/Y4wjylGsB49Ndo4YhYYSq3mtlFs3q9i6wHQHiT+eo8SGhJouPtmmRQURVyu565p -F4ErWjfJXir0xuKhXFSbplQAz/DxwceYMBo7Nhbbo27q/a2ywtrvAkcTisDxszGt -TxzhT5yvDwyd93gN2PQ1VoDat20Xj50egWTh/sVFuq1ruQp6Tk9LhO5L8X3dEQ== +MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb +MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow +GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj +YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL +MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE +BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM +GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP +ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua +BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe +3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4 +YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR +rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm +ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU +oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF +MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v +QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t +b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF +AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q +GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz +Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2 +G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi +l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3 +smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: - ec:a0:a7:8b:6e:75:6a:01:cf:c4:7c:cc:2f:94:5e:d7 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 4 Public Primary Certification Authority - G3 - Validity - Not Before: Oct 1 00:00:00 1999 GMT - Not After : Jul 16 23:59:59 2036 GMT - Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 4 Public Primary Certification Authority - G3 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:ad:cb:a5:11:69:c6:59:ab:f1:8f:b5:19:0f:56: - ce:cc:b5:1f:20:e4:9e:26:25:4b:e0:73:65:89:59: - de:d0:83:e4:f5:0f:b5:bb:ad:f1:7c:e8:21:fc:e4: - e8:0c:ee:7c:45:22:19:76:92:b4:13:b7:20:5b:09: - fa:61:ae:a8:f2:a5:8d:85:c2:2a:d6:de:66:36:d2: - 9b:02:f4:a8:92:60:7c:9c:69:b4:8f:24:1e:d0:86: - 52:f6:32:9c:41:58:1e:22:bd:cd:45:62:95:08:6e: - d0:66:dd:53:a2:cc:f0:10:dc:54:73:8b:04:a1:46: - 33:33:5c:17:40:b9:9e:4d:d3:f3:be:55:83:e8:b1: - 89:8e:5a:7c:9a:96:22:90:3b:88:25:f2:d2:53:88: - 02:0c:0b:78:f2:e6:37:17:4b:30:46:07:e4:80:6d: - a6:d8:96:2e:e8:2c:f8:11:b3:38:0d:66:a6:9b:ea: - c9:23:5b:db:8e:e2:f3:13:8e:1a:59:2d:aa:02:f0: - ec:a4:87:66:dc:c1:3f:f5:d8:b9:f4:ec:82:c6:d2: - 3d:95:1d:e5:c0:4f:84:c9:d9:a3:44:28:06:6a:d7: - 45:ac:f0:6b:6a:ef:4e:5f:f8:11:82:1e:38:63:34: - 66:50:d4:3e:93:73:fa:30:c3:66:ad:ff:93:2d:97: - ef:03 - Exponent: 65537 (0x10001) - Signature Algorithm: sha1WithRSAEncryption - 8f:fa:25:6b:4f:5b:e4:a4:4e:27:55:ab:22:15:59:3c:ca:b5: - 0a:d4:4a:db:ab:dd:a1:5f:53:c5:a0:57:39:c2:ce:47:2b:be: - 3a:c8:56:bf:c2:d9:27:10:3a:b1:05:3c:c0:77:31:bb:3a:d3: - 05:7b:6d:9a:1c:30:8c:80:cb:93:93:2a:83:ab:05:51:82:02: - 00:11:67:6b:f3:88:61:47:5f:03:93:d5:5b:0d:e0:f1:d4:a1: - 32:35:85:b2:3a:db:b0:82:ab:d1:cb:0a:bc:4f:8c:5b:c5:4b: - 00:3b:1f:2a:82:a6:7e:36:85:dc:7e:3c:67:00:b5:e4:3b:52: - e0:a8:eb:5d:15:f9:c6:6d:f0:ad:1d:0e:85:b7:a9:9a:73:14: - 5a:5b:8f:41:28:c0:d5:e8:2d:4d:a4:5e:cd:aa:d9:ed:ce:dc: - d8:d5:3c:42:1d:17:c1:12:5d:45:38:c3:38:f3:fc:85:2e:83: - 46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0: - a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0: - 21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01: - a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3: - 35:60:91:ce -MD5 Fingerprint=DB:C8:F2:27:2E:B1:EA:6A:29:23:5D:FE:56:3E:33:DF -----BEGIN CERTIFICATE----- -MIIEGjCCAwICEQDsoKeLbnVqAc/EfMwvlF7XMA0GCSqGSIb3DQEBBQUAMIHKMQsw -CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl -cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu -LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT -aWduIENsYXNzIDQgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp -dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD -VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT -aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ -bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu -IENsYXNzIDQgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg -LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK3LpRFpxlmr8Y+1 -GQ9Wzsy1HyDkniYlS+BzZYlZ3tCD5PUPtbut8XzoIfzk6AzufEUiGXaStBO3IFsJ -+mGuqPKljYXCKtbeZjbSmwL0qJJgfJxptI8kHtCGUvYynEFYHiK9zUVilQhu0Gbd -U6LM8BDcVHOLBKFGMzNcF0C5nk3T875Vg+ixiY5afJqWIpA7iCXy0lOIAgwLePLm -NxdLMEYH5IBtptiWLugs+BGzOA1mppvqySNb247i8xOOGlktqgLw7KSHZtzBP/XY -ufTsgsbSPZUd5cBPhMnZo0QoBmrXRazwa2rvTl/4EYIeOGM0ZlDUPpNz+jDDZq3/ -ky2X7wMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAj/ola09b5KROJ1WrIhVZPMq1 -CtRK26vdoV9TxaBXOcLORyu+OshWv8LZJxA6sQU8wHcxuzrTBXttmhwwjIDLk5Mq -g6sFUYICABFna/OIYUdfA5PVWw3g8dShMjWFsjrbsIKr0csKvE+MW8VLADsfKoKm -fjaF3H48ZwC15DtS4KjrXRX5xm3wrR0OhbepmnMUWluPQSjA1egtTaRezarZ7c7c -2NU8Qh0XwRJdRTjDOPP8hS6DRkiy1yBfkjaP53kPmF6Z6PDQpLv1U70qzlmwr25/ -bLvSHgCwIe34QWKCudiyxLtGUPMxxY8BqHTr9Xgn2uf3ZkPznoM+IKrDNWCRzg== +MIIEPzCCAyegAwIBAgIBATANBgkqhkiG9w0BAQUFADB+MQswCQYDVQQGEwJHQjEb +MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow +GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEkMCIGA1UEAwwbU2VjdXJlIENlcnRp +ZmljYXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVow +fjELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G +A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxJDAiBgNV +BAMMG1NlY3VyZSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEB +BQADggEPADCCAQoCggEBAMBxM4KK0HDrc4eCQNUd5MvJDkKQ+d40uaG6EfQlhfPM +cm3ye5drswfxdySRXyWP9nQ95IDC+DwN879A6vfIUtFyb+/Iq0G4bi4XKpVpDM3S +HpR7LZQdqnXXs5jLrLxkU0C8j6ysNstcrbvd4JQX7NFc0L/vpZXJkMWwrPsbQ996 +CF23uPJAGysnnlDOXmWCiIxe004MeuoIkbY2qitC++rCoznl2yY4rYsK7hljxxwk +3wN42ubqwUcaCwtGCd0C/N7Lh1/XMGNooa7cMqG6vv5Eq2i2pRcV/b3Vp6ea5EQz +6YiO/O1R65NxTq0B50SOqy3LqP4BSUjwwN3HaNiS/j0CAwEAAaOBxzCBxDAdBgNV +HQ4EFgQUPNiTiMLAggnMAZkGkyDpnnAJY08wDgYDVR0PAQH/BAQDAgEGMA8GA1Ud +EwEB/wQFMAMBAf8wgYEGA1UdHwR6MHgwO6A5oDeGNWh0dHA6Ly9jcmwuY29tb2Rv +Y2EuY29tL1NlY3VyZUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDmgN6A1hjNodHRw +Oi8vY3JsLmNvbW9kby5uZXQvU2VjdXJlQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmww +DQYJKoZIhvcNAQEFBQADggEBAIcBbSMdflsXfcFhMs+P5/OKlFlm4J4oqF7Tt/Q0 +5qo5spcWxYJvMqTpjOev/e/C6LlLqqP05tqNZSH7uoDrJiiFGv45jN5bBAS0VPmj +Z55B+glSzAVIqMk/IQQezkhr/IXownuvf7fM+F86/TXGDe+X3EyrEeFryzHRbPtI +gKvcnDe4IRRLDXE97IMzbtFuMhbsmMcWi1mmNKsFVy2T96oTy9IT4rcuO81rUBcJ +aD61JlfutuC23bkpgHl9j6PwpCikFcSF9CfUa7/lXORlAnZUtOM3ZiTTGWHIUhDl +izeauan5Hb/qmZJhlv8BzaFfDbxxvA6sCx1HRR3B7Hzs/Sk= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 927650371 (0x374ad243) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=Entrust.net, OU=www.entrust.net/CPS incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Secure Server Certification Authority - Validity - Not Before: May 25 16:09:40 1999 GMT - Not After : May 25 16:39:40 2019 GMT - Subject: C=US, O=Entrust.net, OU=www.entrust.net/CPS incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Secure Server Certification Authority - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:cd:28:83:34:54:1b:89:f3:0f:af:37:91:31:ff: - af:31:60:c9:a8:e8:b2:10:68:ed:9f:e7:93:36:f1: - 0a:64:bb:47:f5:04:17:3f:23:47:4d:c5:27:19:81: - 26:0c:54:72:0d:88:2d:d9:1f:9a:12:9f:bc:b3:71: - d3:80:19:3f:47:66:7b:8c:35:28:d2:b9:0a:df:24: - da:9c:d6:50:79:81:7a:5a:d3:37:f7:c2:4a:d8:29: - 92:26:64:d1:e4:98:6c:3a:00:8a:f5:34:9b:65:f8: - ed:e3:10:ff:fd:b8:49:58:dc:a0:de:82:39:6b:81: - b1:16:19:61:b9:54:b6:e6:43 - Exponent: 3 (0x3) - X509v3 extensions: - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 CRL Distribution Points: - DirName:/C=US/O=Entrust.net/OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority/CN=CRL1 - URI:http://www.entrust.net/CRL/net1.crl - - X509v3 Private Key Usage Period: - Not Before: May 25 16:09:40 1999 GMT, Not After: May 25 16:09:40 2019 GMT - X509v3 Key Usage: - Certificate Sign, CRL Sign - X509v3 Authority Key Identifier: - keyid:F0:17:62:13:55:3D:B3:FF:0A:00:6B:FB:50:84:97:F3:ED:62:D0:1A - - X509v3 Subject Key Identifier: - F0:17:62:13:55:3D:B3:FF:0A:00:6B:FB:50:84:97:F3:ED:62:D0:1A - X509v3 Basic Constraints: - CA:TRUE - 1.2.840.113533.7.65.0: - 0 -..V4.0.... - Signature Algorithm: sha1WithRSAEncryption - 90:dc:30:02:fa:64:74:c2:a7:0a:a5:7c:21:8d:34:17:a8:fb: - 47:0e:ff:25:7c:8d:13:0a:fb:e4:98:b5:ef:8c:f8:c5:10:0d: - f7:92:be:f1:c3:d5:d5:95:6a:04:bb:2c:ce:26:36:65:c8:31: - c6:e7:ee:3f:e3:57:75:84:7a:11:ef:46:4f:18:f4:d3:98:bb: - a8:87:32:ba:72:f6:3c:e2:3d:9f:d7:1d:d9:c3:60:43:8c:58: - 0e:22:96:2f:62:a3:2c:1f:ba:ad:05:ef:ab:32:78:87:a0:54: - 73:19:b5:5c:05:f9:52:3e:6d:2d:45:0b:f7:0a:93:ea:ed:06: - f9:b2 -MD5 Fingerprint=DF:F2:80:73:CC:F1:E6:61:73:FC:F5:42:E9:C5:7C:EE -----BEGIN CERTIFICATE----- -MIIE2DCCBEGgAwIBAgIEN0rSQzANBgkqhkiG9w0BAQUFADCBwzELMAkGA1UEBhMC -VVMxFDASBgNVBAoTC0VudHJ1c3QubmV0MTswOQYDVQQLEzJ3d3cuZW50cnVzdC5u -ZXQvQ1BTIGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMGA1UECxMc -KGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDE6MDgGA1UEAxMxRW50cnVzdC5u -ZXQgU2VjdXJlIFNlcnZlciBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05OTA1 -MjUxNjA5NDBaFw0xOTA1MjUxNjM5NDBaMIHDMQswCQYDVQQGEwJVUzEUMBIGA1UE -ChMLRW50cnVzdC5uZXQxOzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j -b3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF -bnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg -U2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA -A4GLADCBhwKBgQDNKIM0VBuJ8w+vN5Ex/68xYMmo6LIQaO2f55M28Qpku0f1BBc/ -I0dNxScZgSYMVHINiC3ZH5oSn7yzcdOAGT9HZnuMNSjSuQrfJNqc1lB5gXpa0zf3 -wkrYKZImZNHkmGw6AIr1NJtl+O3jEP/9uElY3KDegjlrgbEWGWG5VLbmQwIBA6OC -AdcwggHTMBEGCWCGSAGG+EIBAQQEAwIABzCCARkGA1UdHwSCARAwggEMMIHeoIHb -oIHYpIHVMIHSMQswCQYDVQQGEwJVUzEUMBIGA1UEChMLRW50cnVzdC5uZXQxOzA5 -BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5jb3JwLiBieSByZWYuIChsaW1p -dHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBFbnRydXN0Lm5ldCBMaW1pdGVk -MTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUgU2VydmVyIENlcnRpZmljYXRp -b24gQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMCmgJ6AlhiNodHRwOi8vd3d3LmVu -dHJ1c3QubmV0L0NSTC9uZXQxLmNybDArBgNVHRAEJDAigA8xOTk5MDUyNTE2MDk0 -MFqBDzIwMTkwNTI1MTYwOTQwWjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAU8Bdi -E1U9s/8KAGv7UISX8+1i0BowHQYDVR0OBBYEFPAXYhNVPbP/CgBr+1CEl/PtYtAa -MAwGA1UdEwQFMAMBAf8wGQYJKoZIhvZ9B0EABAwwChsEVjQuMAMCBJAwDQYJKoZI -hvcNAQEFBQADgYEAkNwwAvpkdMKnCqV8IY00F6j7Rw7/JXyNEwr75Ji174z4xRAN -95K+8cPV1ZVqBLssziY2ZcgxxufuP+NXdYR6Ee9GTxj005i7qIcyunL2POI9n9cd -2cNgQ4xYDiKWL2KjLB+6rQXvqzJ4h6BUcxm1XAX5Uj5tLUUL9wqT6u0G+bI= +MIIEQzCCAyugAwIBAgIBATANBgkqhkiG9w0BAQUFADB/MQswCQYDVQQGEwJHQjEb +MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow +GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDElMCMGA1UEAwwcVHJ1c3RlZCBDZXJ0 +aWZpY2F0ZSBTZXJ2aWNlczAeFw0wNDAxMDEwMDAwMDBaFw0yODEyMzEyMzU5NTla +MH8xCzAJBgNVBAYTAkdCMRswGQYDVQQIDBJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO +BgNVBAcMB1NhbGZvcmQxGjAYBgNVBAoMEUNvbW9kbyBDQSBMaW1pdGVkMSUwIwYD +VQQDDBxUcnVzdGVkIENlcnRpZmljYXRlIFNlcnZpY2VzMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEA33FvNlhTWvI2VFeAxHQIIO0Yfyod5jWaHiWsnOWW +fnJSoBVC21ndZHoa0Lh73TkVvFVIxO06AOoxEbrycXQaZ7jPM8yoMa+j49d/vzMt +TGo87IvDktJTdyR0nAducPy9C1t2ul/y/9c3S0pgePfw+spwtOpZqqPOSC+pw7IL +fhdyFgymBwwbOM/JYrc/oJOlh0Hyt3BAd9i+FHzjqMB6juljatEPmsbS9Is6FARW +1O24zG71++IsWL1/T2sr92AkWCTOJu80kTrV44HQsvAEAtdbtz6SrGsSivnkBbA7 +kUlcsutT6vifR4buv5XAwAaf0lteERv0xwQ1KdJVXOTt6wIDAQABo4HJMIHGMB0G +A1UdDgQWBBTFe1i97doladL3WRaoszLAeydb9DAOBgNVHQ8BAf8EBAMCAQYwDwYD +VR0TAQH/BAUwAwEB/zCBgwYDVR0fBHwwejA8oDqgOIY2aHR0cDovL2NybC5jb21v +ZG9jYS5jb20vVHJ1c3RlZENlcnRpZmljYXRlU2VydmljZXMuY3JsMDqgOKA2hjRo +dHRwOi8vY3JsLmNvbW9kby5uZXQvVHJ1c3RlZENlcnRpZmljYXRlU2VydmljZXMu +Y3JsMA0GCSqGSIb3DQEBBQUAA4IBAQDIk4E7ibSvuIQSTI3S8NtwuleGFTQQuS9/ +HrCoiWChisJ3DFBKmwCL2Iv0QeLQg4pKHBQGsKNoBXAxMKdTmw7pSqBYaWcOrp32 +pSxBvzwGa+RZzG0Q8ZZvH9/0BAKkn0U+yNj6NkZEUD+Cl5EfKNsYEYwq5GWDVxIS +jBc/lDb+XbDABHcTuPQV1T84zJQ6VdCsmPW6AF/ghhmBeC8owH7TzEIK9a5QoNE+ +xqFx7D+gIIxmOom0jtTYsU0lR+4viMi14QVFwL4Ucd56/Y57fU0IlqUSc/Atyjcn +dBInTMu2l+nZrghtWjlA3QVHdWpaIbOjGM9O9y5Xt5hwXsjEeLBi -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 939758062 (0x380391ee) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=US, O=Entrust.net, OU=www.entrust.net/Client_CA_Info/CPS incorp. by ref. limits liab., OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Client Certification Authority - Validity - Not Before: Oct 12 19:24:30 1999 GMT - Not After : Oct 12 19:54:30 2019 GMT - Subject: C=US, O=Entrust.net, OU=www.entrust.net/Client_CA_Info/CPS incorp. by ref. limits liab., OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Client Certification Authority - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:c8:3a:99:5e:31:17:df:ac:27:6f:90:7b:e4:19: - ff:45:a3:34:c2:db:c1:a8:4f:f0:68:ea:84:fd:9f: - 75:79:cf:c1:8a:51:94:af:c7:57:03:47:64:9e:ad: - 82:1b:5a:da:7f:37:78:47:bb:37:98:12:96:ce:c6: - 13:7d:ef:d2:0c:30:51:a9:39:9e:55:f8:fb:b1:e7: - 30:de:83:b2:ba:3e:f1:d5:89:3b:3b:85:ba:aa:74: - 2c:fe:3f:31:6e:af:91:95:6e:06:d4:07:4d:4b:2c: - 56:47:18:04:52:da:0e:10:93:bf:63:90:9b:e1:df: - 8c:e6:02:a4:e6:4f:5e:f7:8b - Exponent: 3 (0x3) - X509v3 extensions: - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 CRL Distribution Points: - DirName:/C=US/O=Entrust.net/OU=www.entrust.net/Client_CA_Info/CPS incorp. by ref. limits liab./OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Client Certification Authority/CN=CRL1 - URI:http://www.entrust.net/CRL/Client1.crl - - X509v3 Private Key Usage Period: - Not Before: Oct 12 19:24:30 1999 GMT, Not After: Oct 12 19:24:30 2019 GMT - X509v3 Key Usage: - Certificate Sign, CRL Sign - X509v3 Authority Key Identifier: - keyid:C4:FB:9C:29:7B:97:CD:4C:96:FC:EE:5B:B3:CA:99:74:8B:95:EA:4C - - X509v3 Subject Key Identifier: - C4:FB:9C:29:7B:97:CD:4C:96:FC:EE:5B:B3:CA:99:74:8B:95:EA:4C - X509v3 Basic Constraints: - CA:TRUE - 1.2.840.113533.7.65.0: - 0 -..V4.0.... - Signature Algorithm: md5WithRSAEncryption - 3f:ae:8a:f1:d7:66:03:05:9e:3e:fa:ea:1c:46:bb:a4:5b:8f: - 78:9a:12:48:99:f9:f4:35:de:0c:36:07:02:6b:10:3a:89:14: - 81:9c:31:a6:7c:b2:41:b2:6a:e7:07:01:a1:4b:f9:9f:25:3b: - 96:ca:99:c3:3e:a1:51:1c:f3:c3:2e:44:f7:b0:67:46:aa:92: - e5:3b:da:1c:19:14:38:30:d5:e2:a2:31:25:2e:f1:ec:45:38: - ed:f8:06:58:03:73:62:b0:10:31:8f:40:bf:64:e0:5c:3e:c5: - 4f:1f:da:12:43:ff:4c:e6:06:26:a8:9b:19:aa:44:3c:76:b2: - 5c:ec -MD5 Fingerprint=0C:41:2F:13:5B:A0:54:F5:96:66:2D:7E:CD:0E:03:F4 -----BEGIN CERTIFICATE----- -MIIE7TCCBFagAwIBAgIEOAOR7jANBgkqhkiG9w0BAQQFADCByTELMAkGA1UEBhMC -VVMxFDASBgNVBAoTC0VudHJ1c3QubmV0MUgwRgYDVQQLFD93d3cuZW50cnVzdC5u -ZXQvQ2xpZW50X0NBX0luZm8vQ1BTIGluY29ycC4gYnkgcmVmLiBsaW1pdHMgbGlh -Yi4xJTAjBgNVBAsTHChjKSAxOTk5IEVudHJ1c3QubmV0IExpbWl0ZWQxMzAxBgNV -BAMTKkVudHJ1c3QubmV0IENsaWVudCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe -Fw05OTEwMTIxOTI0MzBaFw0xOTEwMTIxOTU0MzBaMIHJMQswCQYDVQQGEwJVUzEU -MBIGA1UEChMLRW50cnVzdC5uZXQxSDBGBgNVBAsUP3d3dy5lbnRydXN0Lm5ldC9D -bGllbnRfQ0FfSW5mby9DUFMgaW5jb3JwLiBieSByZWYuIGxpbWl0cyBsaWFiLjEl -MCMGA1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UEAxMq -RW50cnVzdC5uZXQgQ2xpZW50IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0G -CSqGSIb3DQEBAQUAA4GLADCBhwKBgQDIOpleMRffrCdvkHvkGf9FozTC28GoT/Bo -6oT9n3V5z8GKUZSvx1cDR2SerYIbWtp/N3hHuzeYEpbOxhN979IMMFGpOZ5V+Pux -5zDeg7K6PvHViTs7hbqqdCz+PzFur5GVbgbUB01LLFZHGARS2g4Qk79jkJvh34zm -AqTmT173iwIBA6OCAeAwggHcMBEGCWCGSAGG+EIBAQQEAwIABzCCASIGA1UdHwSC -ARkwggEVMIHkoIHhoIHepIHbMIHYMQswCQYDVQQGEwJVUzEUMBIGA1UEChMLRW50 -cnVzdC5uZXQxSDBGBgNVBAsUP3d3dy5lbnRydXN0Lm5ldC9DbGllbnRfQ0FfSW5m -by9DUFMgaW5jb3JwLiBieSByZWYuIGxpbWl0cyBsaWFiLjElMCMGA1UECxMcKGMp -IDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UEAxMqRW50cnVzdC5uZXQg -Q2xpZW50IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMCyg -KqAohiZodHRwOi8vd3d3LmVudHJ1c3QubmV0L0NSTC9DbGllbnQxLmNybDArBgNV -HRAEJDAigA8xOTk5MTAxMjE5MjQzMFqBDzIwMTkxMDEyMTkyNDMwWjALBgNVHQ8E -BAMCAQYwHwYDVR0jBBgwFoAUxPucKXuXzUyW/O5bs8qZdIuV6kwwHQYDVR0OBBYE -FMT7nCl7l81MlvzuW7PKmXSLlepMMAwGA1UdEwQFMAMBAf8wGQYJKoZIhvZ9B0EA -BAwwChsEVjQuMAMCBJAwDQYJKoZIhvcNAQEEBQADgYEAP66K8ddmAwWePvrqHEa7 -pFuPeJoSSJn59DXeDDYHAmsQOokUgZwxpnyyQbJq5wcBoUv5nyU7lsqZwz6hURzz -wy5E97BnRqqS5TvaHBkUODDV4qIxJS7x7EU47fgGWANzYrAQMY9Av2TgXD7FTx/a -EkP/TOYGJqibGapEPHayXOw= +MIIDKTCCApKgAwIBAgIENnAVljANBgkqhkiG9w0BAQUFADBGMQswCQYDVQQGEwJV +UzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMREwDwYDVQQL +EwhEU1RDQSBFMTAeFw05ODEyMTAxODEwMjNaFw0xODEyMTAxODQwMjNaMEYxCzAJ +BgNVBAYTAlVTMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4x +ETAPBgNVBAsTCERTVENBIEUxMIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCg +bIGpzzQeJN3+hijM3oMv+V7UQtLodGBmE5gGHKlREmlvMVW5SXIACH7TpWJENySZ +j9mDSI+ZbZUTu0M7LklOiDfBu1h//uG9+LthzfNHwJmm8fOR6Hh8AMthyUQncWlV +Sn5JTe2io74CTADKAqjuAQIxZA9SLRN0dja1erQtcQIBA6OCASQwggEgMBEGCWCG +SAGG+EIBAQQEAwIABzBoBgNVHR8EYTBfMF2gW6BZpFcwVTELMAkGA1UEBhMCVVMx +JDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjERMA8GA1UECxMI +RFNUQ0EgRTExDTALBgNVBAMTBENSTDEwKwYDVR0QBCQwIoAPMTk5ODEyMTAxODEw +MjNagQ8yMDE4MTIxMDE4MTAyM1owCwYDVR0PBAQDAgEGMB8GA1UdIwQYMBaAFGp5 +fpFpRhgTCgJ3pVlbYJglDqL4MB0GA1UdDgQWBBRqeX6RaUYYEwoCd6VZW2CYJQ6i ++DAMBgNVHRMEBTADAQH/MBkGCSqGSIb2fQdBAAQMMAobBFY0LjADAgSQMA0GCSqG +SIb3DQEBBQUAA4GBACIS2Hod3IEGtgllsofIH160L+nEHvI8wbsEkBFKg05+k7lN +QseSJqBcNJo4cvj9axY+IO6CizEqkzaFI4iKPANo08kJD038bKTaKHKTDomAsH3+ +gG9lbRgzl4vCa4nuYD3Im+9/KzJic5PLPON74nZ4RbyhkwS7hp86W0N6w4pl +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIID2DCCAsACEQDQHkCLAAACfAAAAAIAAAABMA0GCSqGSIb3DQEBBQUAMIGpMQsw +CQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMOU2FsdCBMYWtlIENp +dHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjERMA8GA1UE +CxMIRFNUQ0EgWDExFjAUBgNVBAMTDURTVCBSb290Q0EgWDExITAfBgkqhkiG9w0B +CQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTAeFw05ODEyMDExODE4NTVaFw0wODExMjgx +ODE4NTVaMIGpMQswCQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMO +U2FsdCBMYWtlIENpdHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0 +IENvLjERMA8GA1UECxMIRFNUQ0EgWDExFjAUBgNVBAMTDURTVCBSb290Q0EgWDEx +ITAfBgkqhkiG9w0BCQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBANLGJrbnpT3BxGjVUG9TxW9JEwm4ryxIjRRqoxdf +WvnTLnUv2Chi0ZMv/E3Uq4flCMeZ55I/db3rJbQVwZsZPdJEjdd0IG03Ao9pk1uK +xBmd9LIO/BZsubEFkoPRhSxglD5FVaDZqwgh5mDoO3TymVBRaNADLbGAvqPYUrBE +zUNKcI5YhZXhTizWLUFv1oTnyJhEykfbLCSlaSbPa7gnYsP0yXqSI+0TZ4KuRS5F +5X5yP4WdlGIQ5jyRoa13AOAV7POEgHJ6jm5gl8ckWRA0g1vhpaRptlc1HHhZxtMv +OnNn7pTKBBMFYgZwI7P0fO5F2WQLW0mqpEPOJsREEmy43XkCAwEAATANBgkqhkiG +9w0BAQUFAAOCAQEAojeyP2n714Z5VEkxlTMr89EJFEliYIalsBHiUMIdBlc+Legz +ZL6bqq1fG03UmZWii5rJYnK1aerZWKs17RWiQ9a2vAd5ZWRzfdd5ynvVWlHG4VME +lo04z6MXrDlxawHDi1M8Y+nuecDkvpIyZHqzH5eUYr3qsiAVlfuX8ngvYzZAOONG +Dx3drJXK50uQe7FLqdTF65raqtWjlBRGjS0f8zrWkzr2Pnn86Oawde3uPclwx12q +gUtGJRzHbBXjlU4PqjI3lAoXJJIThFjSY28r9+ZbYgsTF7ANUkz+/m9c4pFuHf2k +Ytdo+o56T9II2pPc8JIRetDccpMMc5NihWjQ9A== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDKTCCApKgAwIBAgIENm7TzjANBgkqhkiG9w0BAQUFADBGMQswCQYDVQQGEwJV +UzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMREwDwYDVQQL +EwhEU1RDQSBFMjAeFw05ODEyMDkxOTE3MjZaFw0xODEyMDkxOTQ3MjZaMEYxCzAJ +BgNVBAYTAlVTMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4x +ETAPBgNVBAsTCERTVENBIEUyMIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQC/ +k48Xku8zExjrEH9OFr//Bo8qhbxe+SSmJIi2A7fBw18DW9Fvrn5C6mYjuGODVvso +LeE4i7TuqAHhzhy2iCoiRoX7n6dwqUcUP87eZfCocfdPJmyMvMa1795JJ/9IKn3o +TQPMx7JSxhcxEzu1TdvIxPbDDyQq2gyd55FbgM2UnQIBA6OCASQwggEgMBEGCWCG +SAGG+EIBAQQEAwIABzBoBgNVHR8EYTBfMF2gW6BZpFcwVTELMAkGA1UEBhMCVVMx +JDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjERMA8GA1UECxMI +RFNUQ0EgRTIxDTALBgNVBAMTBENSTDEwKwYDVR0QBCQwIoAPMTk5ODEyMDkxOTE3 +MjZagQ8yMDE4MTIwOTE5MTcyNlowCwYDVR0PBAQDAgEGMB8GA1UdIwQYMBaAFB6C +TShlgDzJQW6sNS5ay97u+DlbMB0GA1UdDgQWBBQegk0oZYA8yUFurDUuWsve7vg5 +WzAMBgNVHRMEBTADAQH/MBkGCSqGSIb2fQdBAAQMMAobBFY0LjADAgSQMA0GCSqG +SIb3DQEBBQUAA4GBAEeNg61i8tuwnkUiBbmi1gMOOHLnnvx75pO2mqWilMg0HZHR +xdf0CiUPPXiBng+xZ8SQTGPdXqfiup/1902lMXucKS1M/mQ+7LZT/uqb7YLbdHVL +B3luHtgZg3Pe9T7Qtd7nS2h9Qy4qIOF+oHhEngj1mPnHfxsb1gYgAlihw6ID +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIID2DCCAsACEQDQHkCLAAB3bQAAAAEAAAAEMA0GCSqGSIb3DQEBBQUAMIGpMQsw +CQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMOU2FsdCBMYWtlIENp +dHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjERMA8GA1UE +CxMIRFNUQ0EgWDIxFjAUBgNVBAMTDURTVCBSb290Q0EgWDIxITAfBgkqhkiG9w0B +CQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTAeFw05ODExMzAyMjQ2MTZaFw0wODExMjcy +MjQ2MTZaMIGpMQswCQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMO +U2FsdCBMYWtlIENpdHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0 +IENvLjERMA8GA1UECxMIRFNUQ0EgWDIxFjAUBgNVBAMTDURTVCBSb290Q0EgWDIx +ITAfBgkqhkiG9w0BCQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBANx18IzAdZaawGIfJvfE4Zrq4FZzW5nNAUSoCLbV +p9oaBBg5kkp4o4HC9Xd6ULRw/5qrxsfKboNPQpj7Jgva3G3WqZlVUmfpKAOS3OWw +BZoPFflrWXJW8vo5/Kpo7g8fEIMv/J36F5bdguPmRX3AS4BEH+0s4IT9kVySVGkl +5WJp3OXuAFK9MwutdQKFp2RQLcUZGTDAJtvJ0/0uma1ZtQtN1EGuhUhDWdy3qOKi +3sOP17ihYqZoUFLkzzGnlIXan0YyF1bl8utmPRL/Q9uY73fPy4GNNLHGUEom0eQ+ +QVCvbK4iNC7Va26Dunm4dmVI2gkpZGMiuftHdoWMhkTLCdsCAwEAATANBgkqhkiG +9w0BAQUFAAOCAQEAtTYOXeFhKFoRZcA/gwN5Tb4opgsHAlKFzfiR0BBstWogWxyQ +2TA8xkieil5k+aFxd+8EJx8H6+Qm93N0yUQYGmbT4EOvkTvRyyzYdFQ6HE3K1GjN +I3wdEJ5F6fYAbqbNGf9PLCmPV03Ed5K+4EwJ+11EhmYhqLkyolbV6YyDfFk/xPEL +553snr2cGA4+wjl5KLcDDQjLxufZATdQEOzMYRZA1K8xdHv8PzGn0EdzMzkbzE5q +10mDEQb+64JYMzJM8FasHpwvVpp7wUocpf1VNs78lk30sPDst2yC7S8xmUJMqbIN +uBVd8d+6ybVK1GSYsyapMMj9puyrliGtf8J4tg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEgzCCA+ygAwIBAgIEOJ725DANBgkqhkiG9w0BAQQFADCBtDEUMBIGA1UEChML +RW50cnVzdC5uZXQxQDA+BgNVBAsUN3d3dy5lbnRydXN0Lm5ldC9HQ0NBX0NQUyBp +bmNvcnAuIGJ5IHJlZi4gKGxpbWl0cyBsaWFiLikxJTAjBgNVBAsTHChjKSAyMDAw +IEVudHJ1c3QubmV0IExpbWl0ZWQxMzAxBgNVBAMTKkVudHJ1c3QubmV0IENsaWVu +dCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wMDAyMDcxNjE2NDBaFw0yMDAy +MDcxNjQ2NDBaMIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDFAMD4GA1UECxQ3d3d3 +LmVudHJ1c3QubmV0L0dDQ0FfQ1BTIGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxp +YWIuKTElMCMGA1UECxMcKGMpIDIwMDAgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEG +A1UEAxMqRW50cnVzdC5uZXQgQ2xpZW50IENlcnRpZmljYXRpb24gQXV0aG9yaXR5 +MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCTdLS25MVL1qFof2LV7PdRV7Ny +Spj10InJrWPNTTVRaoTUrcloeW+46xHbh65cJFET8VQlhK8pK5/jgOLZy93GRUk0 +iJBeAZfv6lOm3fzB3ksqJeTpNfpVBQbliXrqpBFXO/x8PTbNZzVtpKklWb1m9fkn +5JVn1j+SgF7yNH0rhQIDAQABo4IBnjCCAZowEQYJYIZIAYb4QgEBBAQDAgAHMIHd +BgNVHR8EgdUwgdIwgc+ggcyggcmkgcYwgcMxFDASBgNVBAoTC0VudHJ1c3QubmV0 +MUAwPgYDVQQLFDd3d3cuZW50cnVzdC5uZXQvR0NDQV9DUFMgaW5jb3JwLiBieSBy +ZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMjAwMCBFbnRydXN0Lm5l +dCBMaW1pdGVkMTMwMQYDVQQDEypFbnRydXN0Lm5ldCBDbGllbnQgQ2VydGlmaWNh +dGlvbiBBdXRob3JpdHkxDTALBgNVBAMTBENSTDEwKwYDVR0QBCQwIoAPMjAwMDAy +MDcxNjE2NDBagQ8yMDIwMDIwNzE2NDY0MFowCwYDVR0PBAQDAgEGMB8GA1UdIwQY +MBaAFISLdP3FjcD/J20gN0V8/i3OutN9MB0GA1UdDgQWBBSEi3T9xY3A/ydtIDdF +fP4tzrrTfTAMBgNVHRMEBTADAQH/MB0GCSqGSIb2fQdBAAQQMA4bCFY1LjA6NC4w +AwIEkDANBgkqhkiG9w0BAQQFAAOBgQBObzWAO9GK9Q6nIMstZVXQkvTnhLUGJoMS +hAusO7JE7r3PQNsgDrpuFOow4DtifH+La3xKp9U1PL6oXOpLu5OOgGarDyn9TS2/ +GpsKkMWr2tGzhtQvJFJcem3G8v7lTRowjJDyutdKPkN+1MhQGof4T4HHdguEOnKd +zmVml64mXg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIElTCCA/6gAwIBAgIEOJsRPDANBgkqhkiG9w0BAQQFADCBujEUMBIGA1UEChML +RW50cnVzdC5uZXQxPzA9BgNVBAsUNnd3dy5lbnRydXN0Lm5ldC9TU0xfQ1BTIGlu +Y29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMGA1UECxMcKGMpIDIwMDAg +RW50cnVzdC5uZXQgTGltaXRlZDE6MDgGA1UEAxMxRW50cnVzdC5uZXQgU2VjdXJl +IFNlcnZlciBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wMDAyMDQxNzIwMDBa +Fw0yMDAyMDQxNzUwMDBaMIG6MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDE/MD0GA1UE +CxQ2d3d3LmVudHJ1c3QubmV0L1NTTF9DUFMgaW5jb3JwLiBieSByZWYuIChsaW1p +dHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMjAwMCBFbnRydXN0Lm5ldCBMaW1pdGVk +MTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUgU2VydmVyIENlcnRpZmljYXRp +b24gQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHwV9OcfHO +8GCGD9JYf9Mzly0XonUwtZZkJi9ow0SrqHXmAGc0V55lxyKbc+bT3QgON1WqJUaB +bL3+qPZ1V1eMkGxKwz6LS0MKyRFWmponIpnPVZ5h2QLifLZ8OAfc439PmrkDQYC2 +dWcTC5/oVzbIXQA23mYU2m52H083jIITiQIDAQABo4IBpDCCAaAwEQYJYIZIAYb4 +QgEBBAQDAgAHMIHjBgNVHR8EgdswgdgwgdWggdKggc+kgcwwgckxFDASBgNVBAoT +C0VudHJ1c3QubmV0MT8wPQYDVQQLFDZ3d3cuZW50cnVzdC5uZXQvU1NMX0NQUyBp +bmNvcnAuIGJ5IHJlZi4gKGxpbWl0cyBsaWFiLikxJTAjBgNVBAsTHChjKSAyMDAw +IEVudHJ1c3QubmV0IExpbWl0ZWQxOjA4BgNVBAMTMUVudHJ1c3QubmV0IFNlY3Vy +ZSBTZXJ2ZXIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxDTALBgNVBAMTBENSTDEw +KwYDVR0QBCQwIoAPMjAwMDAyMDQxNzIwMDBagQ8yMDIwMDIwNDE3NTAwMFowCwYD +VR0PBAQDAgEGMB8GA1UdIwQYMBaAFMtswGvjuz7L/CKc/vuLkpyw8m4iMB0GA1Ud +DgQWBBTLbMBr47s+y/winP77i5KcsPJuIjAMBgNVHRMEBTADAQH/MB0GCSqGSIb2 +fQdBAAQQMA4bCFY1LjA6NC4wAwIEkDANBgkqhkiG9w0BAQQFAAOBgQBi24GRzsia +d0Iv7L0no1MPUBvqTpLwqa+poLpIYcvvyQbvH9X07t9WLebKahlzqlO+krNQAraF +JnJj2HVQYnUUt7NQGj/KEQALhUVpbbalrlHhStyCP2yMNLJ3a9kC9n8O6mUE8c1U +yrrJzOCE98g+EZfTYAkYvAX/bIkz8OwVDw== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 946059622 (0x3863b966) - Signature Algorithm: sha1WithRSAEncryption - Issuer: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048) - Validity - Not Before: Dec 24 17:50:51 1999 GMT - Not After : Dec 24 18:20:51 2019 GMT - Subject: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048) - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:ad:4d:4b:a9:12:86:b2:ea:a3:20:07:15:16:64: - 2a:2b:4b:d1:bf:0b:4a:4d:8e:ed:80:76:a5:67:b7: - 78:40:c0:73:42:c8:68:c0:db:53:2b:dd:5e:b8:76: - 98:35:93:8b:1a:9d:7c:13:3a:0e:1f:5b:b7:1e:cf: - e5:24:14:1e:b1:81:a9:8d:7d:b8:cc:6b:4b:03:f1: - 02:0c:dc:ab:a5:40:24:00:7f:74:94:a1:9d:08:29: - b3:88:0b:f5:87:77:9d:55:cd:e4:c3:7e:d7:6a:64: - ab:85:14:86:95:5b:97:32:50:6f:3d:c8:ba:66:0c: - e3:fc:bd:b8:49:c1:76:89:49:19:fd:c0:a8:bd:89: - a3:67:2f:c6:9f:bc:71:19:60:b8:2d:e9:2c:c9:90: - 76:66:7b:94:e2:af:78:d6:65:53:5d:3c:d6:9c:b2: - cf:29:03:f9:2f:a4:50:b2:d4:48:ce:05:32:55:8a: - fd:b2:64:4c:0e:e4:98:07:75:db:7f:df:b9:08:55: - 60:85:30:29:f9:7b:48:a4:69:86:e3:35:3f:1e:86: - 5d:7a:7a:15:bd:ef:00:8e:15:22:54:17:00:90:26: - 93:bc:0e:49:68:91:bf:f8:47:d3:9d:95:42:c1:0e: - 4d:df:6f:26:cf:c3:18:21:62:66:43:70:d6:d5:c0: - 07:e1 - Exponent: 65537 (0x10001) - X509v3 extensions: - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 Authority Key Identifier: - keyid:55:E4:81:D1:11:80:BE:D8:89:B9:08:A3:31:F9:A1:24:09:16:B9:70 - - X509v3 Subject Key Identifier: - 55:E4:81:D1:11:80:BE:D8:89:B9:08:A3:31:F9:A1:24:09:16:B9:70 - 1.2.840.113533.7.65.0: - 0...V5.0:4.0.... - Signature Algorithm: sha1WithRSAEncryption - 59:47:ac:21:84:8a:17:c9:9c:89:53:1e:ba:80:85:1a:c6:3c: - 4e:3e:b1:9c:b6:7c:c6:92:5d:18:64:02:e3:d3:06:08:11:61: - 7c:63:e3:2b:9d:31:03:70:76:d2:a3:28:a0:f4:bb:9a:63:73: - ed:6d:e5:2a:db:ed:14:a9:2b:c6:36:11:d0:2b:eb:07:8b:a5: - da:9e:5c:19:9d:56:12:f5:54:29:c8:05:ed:b2:12:2a:8d:f4: - 03:1b:ff:e7:92:10:87:b0:3a:b5:c3:9d:05:37:12:a3:c7:f4: - 15:b9:d5:a4:39:16:9b:53:3a:23:91:f1:a8:82:a2:6a:88:68: - c1:79:02:22:bc:aa:a6:d6:ae:df:b0:14:5f:b8:87:d0:dd:7c: - 7f:7b:ff:af:1c:cf:e6:db:07:ad:5e:db:85:9d:d0:2b:0d:33: - db:04:d1:e6:49:40:13:2b:76:fb:3e:e9:9c:89:0f:15:ce:18: - b0:85:78:21:4f:6b:4f:0e:fa:36:67:cd:07:f2:ff:08:d0:e2: - de:d9:bf:2a:af:b8:87:86:21:3c:04:ca:b7:94:68:7f:cf:3c: - e9:98:d7:38:ff:ec:c0:d9:50:f0:2e:4b:58:ae:46:6f:d0:2e: - c3:60:da:72:55:72:bd:4c:45:9e:61:ba:bf:84:81:92:03:d1: - d2:69:7c:c5 -MD5 Fingerprint=BA:21:EA:20:D6:DD:DB:8F:C1:57:8B:40:AD:A1:FC:FC -----BEGIN CERTIFICATE----- MIIEXDCCA0SgAwIBAgIEOGO5ZjANBgkqhkiG9w0BAQUFADCBtDEUMBIGA1UEChML RW50cnVzdC5uZXQxQDA+BgNVBAsUN3d3dy5lbnRydXN0Lm5ldC9DUFNfMjA0OCBp @@ -2084,194 +690,82 @@ f3v/rxzP5tsHrV7bhZ3QKw0z2wTR5klAEyt2+z7pnIkPFc4YsIV4IU9rTw76NmfN B/L/CNDi3tm/Kq+4h4YhPATKt5Rof8886ZjXOP/swNlQ8C5LWK5Gb9Auw2DaclVy vUxFnmG6v4SBkgPR0ml8xQ== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 33554617 (0x20000b9) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root - Validity - Not Before: May 12 18:46:00 2000 GMT - Not After : May 12 23:59:00 2025 GMT - Subject: C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:a3:04:bb:22:ab:98:3d:57:e8:26:72:9a:b5:79: - d4:29:e2:e1:e8:95:80:b1:b0:e3:5b:8e:2b:29:9a: - 64:df:a1:5d:ed:b0:09:05:6d:db:28:2e:ce:62:a2: - 62:fe:b4:88:da:12:eb:38:eb:21:9d:c0:41:2b:01: - 52:7b:88:77:d3:1c:8f:c7:ba:b9:88:b5:6a:09:e7: - 73:e8:11:40:a7:d1:cc:ca:62:8d:2d:e5:8f:0b:a6: - 50:d2:a8:50:c3:28:ea:f5:ab:25:87:8a:9a:96:1c: - a9:67:b8:3f:0c:d5:f7:f9:52:13:2f:c2:1b:d5:70: - 70:f0:8f:c0:12:ca:06:cb:9a:e1:d9:ca:33:7a:77: - d6:f8:ec:b9:f1:68:44:42:48:13:d2:c0:c2:a4:ae: - 5e:60:fe:b6:a6:05:fc:b4:dd:07:59:02:d4:59:18: - 98:63:f5:a5:63:e0:90:0c:7d:5d:b2:06:7a:f3:85: - ea:eb:d4:03:ae:5e:84:3e:5f:ff:15:ed:69:bc:f9: - 39:36:72:75:cf:77:52:4d:f3:c9:90:2c:b9:3d:e5: - c9:23:53:3f:1f:24:98:21:5c:07:99:29:bd:c6:3a: - ec:e7:6e:86:3a:6b:97:74:63:33:bd:68:18:31:f0: - 78:8d:76:bf:fc:9e:8e:5d:2a:86:a7:4d:90:dc:27: - 1a:39 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - E5:9D:59:30:82:47:58:CC:AC:FA:08:54:36:86:7B:3A:B5:04:4D:F0 - X509v3 Basic Constraints: critical - CA:TRUE, pathlen:3 - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - Signature Algorithm: sha1WithRSAEncryption - 85:0c:5d:8e:e4:6f:51:68:42:05:a0:dd:bb:4f:27:25:84:03: - bd:f7:64:fd:2d:d7:30:e3:a4:10:17:eb:da:29:29:b6:79:3f: - 76:f6:19:13:23:b8:10:0a:f9:58:a4:d4:61:70:bd:04:61:6a: - 12:8a:17:d5:0a:bd:c5:bc:30:7c:d6:e9:0c:25:8d:86:40:4f: - ec:cc:a3:7e:38:c6:37:11:4f:ed:dd:68:31:8e:4c:d2:b3:01: - 74:ee:be:75:5e:07:48:1a:7f:70:ff:16:5c:84:c0:79:85:b8: - 05:fd:7f:be:65:11:a3:0f:c0:02:b4:f8:52:37:39:04:d5:a9: - 31:7a:18:bf:a0:2a:f4:12:99:f7:a3:45:82:e3:3c:5e:f5:9d: - 9e:b5:c8:9e:7c:2e:c8:a4:9e:4e:08:14:4b:6d:fd:70:6d:6b: - 1a:63:bd:64:e6:1f:b7:ce:f0:f2:9f:2e:bb:1b:b7:f2:50:88: - 73:92:c2:e2:e3:16:8d:9a:32:02:ab:8e:18:dd:e9:10:11:ee: - 7e:35:ab:90:af:3e:30:94:7a:d0:33:3d:a7:65:0f:f5:fc:8e: - 9e:62:cf:47:44:2c:01:5d:bb:1d:b5:32:d2:47:d2:38:2e:d0: - fe:81:dc:32:6a:1e:b5:ee:3c:d5:fc:e7:81:1d:19:c3:24:42: - ea:63:39:a9 -MD5 Fingerprint=AC:B6:94:A5:9C:17:E0:D7:91:52:9B:B1:97:06:A6:E4 -----BEGIN CERTIFICATE----- -MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ -RTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYD -VQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTAwMDUxMjE4NDYwMFoX -DTI1MDUxMjIzNTkwMFowWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9y -ZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVy -VHJ1c3QgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKMEuyKr -mD1X6CZymrV51Cni4eiVgLGw41uOKymaZN+hXe2wCQVt2yguzmKiYv60iNoS6zjr -IZ3AQSsBUnuId9Mcj8e6uYi1agnnc+gRQKfRzMpijS3ljwumUNKoUMMo6vWrJYeK -mpYcqWe4PwzV9/lSEy/CG9VwcPCPwBLKBsua4dnKM3p31vjsufFoREJIE9LAwqSu -XmD+tqYF/LTdB1kC1FkYmGP1pWPgkAx9XbIGevOF6uvUA65ehD5f/xXtabz5OTZy -dc93Uk3zyZAsuT3lySNTPx8kmCFcB5kpvcY67Oduhjprl3RjM71oGDHweI12v/ye -jl0qhqdNkNwnGjkCAwEAAaNFMEMwHQYDVR0OBBYEFOWdWTCCR1jMrPoIVDaGezq1 -BE3wMBIGA1UdEwEB/wQIMAYBAf8CAQMwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3 -DQEBBQUAA4IBAQCFDF2O5G9RaEIFoN27TyclhAO992T9Ldcw46QQF+vaKSm2eT92 -9hkTI7gQCvlYpNRhcL0EYWoSihfVCr3FvDB81ukMJY2GQE/szKN+OMY3EU/t3Wgx -jkzSswF07r51XgdIGn9w/xZchMB5hbgF/X++ZRGjD8ACtPhSNzkE1akxehi/oCr0 -Epn3o0WC4zxe9Z2etciefC7IpJ5OCBRLbf1wbWsaY71k5h+3zvDyny67G7fyUIhz -ksLi4xaNmjICq44Y3ekQEe5+NauQrz4wlHrQMz2nZQ/1/I6eYs9HRCwBXbsdtTLS -R9I4LtD+gdwyah617jzV/OeBHRnDJELqYzmp +MIIE7TCCBFagAwIBAgIEOAOR7jANBgkqhkiG9w0BAQQFADCByTELMAkGA1UEBhMC +VVMxFDASBgNVBAoTC0VudHJ1c3QubmV0MUgwRgYDVQQLFD93d3cuZW50cnVzdC5u +ZXQvQ2xpZW50X0NBX0luZm8vQ1BTIGluY29ycC4gYnkgcmVmLiBsaW1pdHMgbGlh +Yi4xJTAjBgNVBAsTHChjKSAxOTk5IEVudHJ1c3QubmV0IExpbWl0ZWQxMzAxBgNV +BAMTKkVudHJ1c3QubmV0IENsaWVudCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe +Fw05OTEwMTIxOTI0MzBaFw0xOTEwMTIxOTU0MzBaMIHJMQswCQYDVQQGEwJVUzEU +MBIGA1UEChMLRW50cnVzdC5uZXQxSDBGBgNVBAsUP3d3dy5lbnRydXN0Lm5ldC9D +bGllbnRfQ0FfSW5mby9DUFMgaW5jb3JwLiBieSByZWYuIGxpbWl0cyBsaWFiLjEl +MCMGA1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UEAxMq +RW50cnVzdC5uZXQgQ2xpZW50IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0G +CSqGSIb3DQEBAQUAA4GLADCBhwKBgQDIOpleMRffrCdvkHvkGf9FozTC28GoT/Bo +6oT9n3V5z8GKUZSvx1cDR2SerYIbWtp/N3hHuzeYEpbOxhN979IMMFGpOZ5V+Pux +5zDeg7K6PvHViTs7hbqqdCz+PzFur5GVbgbUB01LLFZHGARS2g4Qk79jkJvh34zm +AqTmT173iwIBA6OCAeAwggHcMBEGCWCGSAGG+EIBAQQEAwIABzCCASIGA1UdHwSC +ARkwggEVMIHkoIHhoIHepIHbMIHYMQswCQYDVQQGEwJVUzEUMBIGA1UEChMLRW50 +cnVzdC5uZXQxSDBGBgNVBAsUP3d3dy5lbnRydXN0Lm5ldC9DbGllbnRfQ0FfSW5m +by9DUFMgaW5jb3JwLiBieSByZWYuIGxpbWl0cyBsaWFiLjElMCMGA1UECxMcKGMp +IDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UEAxMqRW50cnVzdC5uZXQg +Q2xpZW50IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMCyg +KqAohiZodHRwOi8vd3d3LmVudHJ1c3QubmV0L0NSTC9DbGllbnQxLmNybDArBgNV +HRAEJDAigA8xOTk5MTAxMjE5MjQzMFqBDzIwMTkxMDEyMTkyNDMwWjALBgNVHQ8E +BAMCAQYwHwYDVR0jBBgwFoAUxPucKXuXzUyW/O5bs8qZdIuV6kwwHQYDVR0OBBYE +FMT7nCl7l81MlvzuW7PKmXSLlepMMAwGA1UdEwQFMAMBAf8wGQYJKoZIhvZ9B0EA +BAwwChsEVjQuMAMCBJAwDQYJKoZIhvcNAQEEBQADgYEAP66K8ddmAwWePvrqHEa7 +pFuPeJoSSJn59DXeDDYHAmsQOokUgZwxpnyyQbJq5wcBoUv5nyU7lsqZwz6hURzz +wy5E97BnRqqS5TvaHBkUODDV4qIxJS7x7EU47fgGWANzYrAQMY9Av2TgXD7FTx/a +EkP/TOYGJqibGapEPHayXOw= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1 (0x1) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=US, O=Equifax Secure Inc., CN=Equifax Secure Global eBusiness CA-1 - Validity - Not Before: Jun 21 04:00:00 1999 GMT - Not After : Jun 21 04:00:00 2020 GMT - Subject: C=US, O=Equifax Secure Inc., CN=Equifax Secure Global eBusiness CA-1 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:ba:e7:17:90:02:65:b1:34:55:3c:49:c2:51:d5: - df:a7:d1:37:8f:d1:e7:81:73:41:52:60:9b:9d:a1: - 17:26:78:ad:c7:b1:e8:26:94:32:b5:de:33:8d:3a: - 2f:db:f2:9a:7a:5a:73:98:a3:5c:e9:fb:8a:73:1b: - 5c:e7:c3:bf:80:6c:cd:a9:f4:d6:2b:c0:f7:f9:99: - aa:63:a2:b1:47:02:0f:d4:e4:51:3a:12:3c:6c:8a: - 5a:54:84:70:db:c1:c5:90:cf:72:45:cb:a8:59:c0: - cd:33:9d:3f:a3:96:eb:85:33:21:1c:3e:1e:3e:60: - 6e:76:9c:67:85:c5:c8:c3:61 - Exponent: 65537 (0x10001) - X509v3 extensions: - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Authority Key Identifier: - keyid:BE:A8:A0:74:72:50:6B:44:B7:C9:23:D8:FB:A8:FF:B3:57:6B:68:6C - - X509v3 Subject Key Identifier: - BE:A8:A0:74:72:50:6B:44:B7:C9:23:D8:FB:A8:FF:B3:57:6B:68:6C - Signature Algorithm: md5WithRSAEncryption - 30:e2:01:51:aa:c7:ea:5f:da:b9:d0:65:0f:30:d6:3e:da:0d: - 14:49:6e:91:93:27:14:31:ef:c4:f7:2d:45:f8:ec:c7:bf:a2: - 41:0d:23:b4:92:f9:19:00:67:bd:01:af:cd:e0:71:fc:5a:cf: - 64:c4:e0:96:98:d0:a3:40:e2:01:8a:ef:27:07:f1:65:01:8a: - 44:2d:06:65:75:52:c0:86:10:20:21:5f:6c:6b:0f:6c:ae:09: - 1c:af:f2:a2:18:34:c4:75:a4:73:1c:f1:8d:dc:ef:ad:f9:b3: - 76:b4:92:bf:dc:95:10:1e:be:cb:c8:3b:5a:84:60:19:56:94: - a9:55 -MD5 Fingerprint=8F:5D:77:06:27:C4:98:3C:5B:93:78:E7:D7:7D:9B:CC ------BEGIN CERTIFICATE----- -MIICkDCCAfmgAwIBAgIBATANBgkqhkiG9w0BAQQFADBaMQswCQYDVQQGEwJVUzEc -MBoGA1UEChMTRXF1aWZheCBTZWN1cmUgSW5jLjEtMCsGA1UEAxMkRXF1aWZheCBT -ZWN1cmUgR2xvYmFsIGVCdXNpbmVzcyBDQS0xMB4XDTk5MDYyMTA0MDAwMFoXDTIw -MDYyMTA0MDAwMFowWjELMAkGA1UEBhMCVVMxHDAaBgNVBAoTE0VxdWlmYXggU2Vj -dXJlIEluYy4xLTArBgNVBAMTJEVxdWlmYXggU2VjdXJlIEdsb2JhbCBlQnVzaW5l -c3MgQ0EtMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAuucXkAJlsTRVPEnC -UdXfp9E3j9HngXNBUmCbnaEXJnitx7HoJpQytd4zjTov2/KaelpzmKNc6fuKcxtc -58O/gGzNqfTWK8D3+ZmqY6KxRwIP1ORROhI8bIpaVIRw28HFkM9yRcuoWcDNM50/ -o5brhTMhHD4ePmBudpxnhcXIw2ECAwEAAaNmMGQwEQYJYIZIAYb4QgEBBAQDAgAH -MA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUvqigdHJQa0S3ySPY+6j/s1dr -aGwwHQYDVR0OBBYEFL6ooHRyUGtEt8kj2Puo/7NXa2hsMA0GCSqGSIb3DQEBBAUA -A4GBADDiAVGqx+pf2rnQZQ8w1j7aDRRJbpGTJxQx78T3LUX47Me/okENI7SS+RkA -Z70Br83gcfxaz2TE4JaY0KNA4gGK7ycH8WUBikQtBmV1UsCGECAhX2xrD2yuCRyv -8qIYNMR1pHMc8Y3c7635s3a0kr/clRAevsvIO1qEYBlWlKlV +-----BEGIN CERTIFICATE----- +MIIE2DCCBEGgAwIBAgIEN0rSQzANBgkqhkiG9w0BAQUFADCBwzELMAkGA1UEBhMC +VVMxFDASBgNVBAoTC0VudHJ1c3QubmV0MTswOQYDVQQLEzJ3d3cuZW50cnVzdC5u +ZXQvQ1BTIGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMGA1UECxMc +KGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDE6MDgGA1UEAxMxRW50cnVzdC5u +ZXQgU2VjdXJlIFNlcnZlciBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05OTA1 +MjUxNjA5NDBaFw0xOTA1MjUxNjM5NDBaMIHDMQswCQYDVQQGEwJVUzEUMBIGA1UE +ChMLRW50cnVzdC5uZXQxOzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j +b3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF +bnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg +U2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA +A4GLADCBhwKBgQDNKIM0VBuJ8w+vN5Ex/68xYMmo6LIQaO2f55M28Qpku0f1BBc/ +I0dNxScZgSYMVHINiC3ZH5oSn7yzcdOAGT9HZnuMNSjSuQrfJNqc1lB5gXpa0zf3 +wkrYKZImZNHkmGw6AIr1NJtl+O3jEP/9uElY3KDegjlrgbEWGWG5VLbmQwIBA6OC +AdcwggHTMBEGCWCGSAGG+EIBAQQEAwIABzCCARkGA1UdHwSCARAwggEMMIHeoIHb +oIHYpIHVMIHSMQswCQYDVQQGEwJVUzEUMBIGA1UEChMLRW50cnVzdC5uZXQxOzA5 +BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5jb3JwLiBieSByZWYuIChsaW1p +dHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBFbnRydXN0Lm5ldCBMaW1pdGVk +MTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUgU2VydmVyIENlcnRpZmljYXRp +b24gQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMCmgJ6AlhiNodHRwOi8vd3d3LmVu +dHJ1c3QubmV0L0NSTC9uZXQxLmNybDArBgNVHRAEJDAigA8xOTk5MDUyNTE2MDk0 +MFqBDzIwMTkwNTI1MTYwOTQwWjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAU8Bdi +E1U9s/8KAGv7UISX8+1i0BowHQYDVR0OBBYEFPAXYhNVPbP/CgBr+1CEl/PtYtAa +MAwGA1UdEwQFMAMBAf8wGQYJKoZIhvZ9B0EABAwwChsEVjQuMAMCBJAwDQYJKoZI +hvcNAQEFBQADgYEAkNwwAvpkdMKnCqV8IY00F6j7Rw7/JXyNEwr75Ji174z4xRAN +95K+8cPV1ZVqBLssziY2ZcgxxufuP+NXdYR6Ee9GTxj005i7qIcyunL2POI9n9cd +2cNgQ4xYDiKWL2KjLB+6rQXvqzJ4h6BUcxm1XAX5Uj5tLUUL9wqT6u0G+bI= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDIDCCAomgAwIBAgIENd70zzANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJV +UzEQMA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2Vy +dGlmaWNhdGUgQXV0aG9yaXR5MB4XDTk4MDgyMjE2NDE1MVoXDTE4MDgyMjE2NDE1 +MVowTjELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0VxdWlmYXgxLTArBgNVBAsTJEVx +dWlmYXggU2VjdXJlIENlcnRpZmljYXRlIEF1dGhvcml0eTCBnzANBgkqhkiG9w0B +AQEFAAOBjQAwgYkCgYEAwV2xWGcIYu6gmi0fCG2RFGiYCh7+2gRvE4RiIcPRfM6f +BeC4AfBONOziipUEZKzxa1NfBbPLZ4C/QgKO/t0BCezhABRP/PvwDN1Dulsr4R+A +cJkVV5MW8Q+XarfCaCMczE1ZMKxRHjuvK9buY0V7xdlfUNLjUA86iOe/FP3gx7kC +AwEAAaOCAQkwggEFMHAGA1UdHwRpMGcwZaBjoGGkXzBdMQswCQYDVQQGEwJVUzEQ +MA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2VydGlm +aWNhdGUgQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMBoGA1UdEAQTMBGBDzIwMTgw +ODIyMTY0MTUxWjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAUSOZo+SvSspXXR9gj +IBBPM5iQn9QwHQYDVR0OBBYEFEjmaPkr0rKV10fYIyAQTzOYkJ/UMAwGA1UdEwQF +MAMBAf8wGgYJKoZIhvZ9B0EABA0wCxsFVjMuMGMDAgbAMA0GCSqGSIb3DQEBBQUA +A4GBAFjOKer89961zgK5F7WF0bnj4JXMJTENAKaSbn+2kmOeUJXRmm/kEd5jhW6Y +7qj/WsjTVbJmcVfewCHrPSqnI0kBBIZCe/zuf6IWUrVnZ9NA2zsmWLIodz2uFHdh +1voqZiegDfqnc1zqcPGUIWVEX/r87yloqaKHee9570+sB3c4 -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 4 (0x4) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=US, O=Equifax Secure Inc., CN=Equifax Secure eBusiness CA-1 - Validity - Not Before: Jun 21 04:00:00 1999 GMT - Not After : Jun 21 04:00:00 2020 GMT - Subject: C=US, O=Equifax Secure Inc., CN=Equifax Secure eBusiness CA-1 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:ce:2f:19:bc:17:b7:77:de:93:a9:5f:5a:0d:17: - 4f:34:1a:0c:98:f4:22:d9:59:d4:c4:68:46:f0:b4: - 35:c5:85:03:20:c6:af:45:a5:21:51:45:41:eb:16: - 58:36:32:6f:e2:50:62:64:f9:fd:51:9c:aa:24:d9: - f4:9d:83:2a:87:0a:21:d3:12:38:34:6c:8d:00:6e: - 5a:a0:d9:42:ee:1a:21:95:f9:52:4c:55:5a:c5:0f: - 38:4f:46:fa:6d:f8:2e:35:d6:1d:7c:eb:e2:f0:b0: - 75:80:c8:a9:13:ac:be:88:ef:3a:6e:ab:5f:2a:38: - 62:02:b0:12:7b:fe:8f:a6:03 - Exponent: 65537 (0x10001) - X509v3 extensions: - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Authority Key Identifier: - keyid:4A:78:32:52:11:DB:59:16:36:5E:DF:C1:14:36:40:6A:47:7C:4C:A1 - - X509v3 Subject Key Identifier: - 4A:78:32:52:11:DB:59:16:36:5E:DF:C1:14:36:40:6A:47:7C:4C:A1 - Signature Algorithm: md5WithRSAEncryption - 75:5b:a8:9b:03:11:e6:e9:56:4c:cd:f9:a9:4c:c0:0d:9a:f3: - cc:65:69:e6:25:76:cc:59:b7:d6:54:c3:1d:cd:99:ac:19:dd: - b4:85:d5:e0:3d:fc:62:20:a7:84:4b:58:65:f1:e2:f9:95:21: - 3f:f5:d4:7e:58:1e:47:87:54:3e:58:a1:b5:b5:f8:2a:ef:71: - e7:bc:c3:f6:b1:49:46:e2:d7:a0:6b:e5:56:7a:9a:27:98:7c: - 46:62:14:e7:c9:fc:6e:03:12:79:80:38:1d:48:82:8d:fc:17: - fe:2a:96:2b:b5:62:a6:a6:3d:bd:7f:92:59:cd:5a:2a:82:b2: - 37:79 -MD5 Fingerprint=64:9C:EF:2E:44:FC:C6:8F:52:07:D0:51:73:8F:CB:3D -----BEGIN CERTIFICATE----- MIICgjCCAeugAwIBAgIBBDANBgkqhkiG9w0BAQQFADBTMQswCQYDVQQGEwJVUzEc MBoGA1UEChMTRXF1aWZheCBTZWN1cmUgSW5jLjEmMCQGA1UEAxMdRXF1aWZheCBT @@ -2288,59 +782,6 @@ zfmpTMANmvPMZWnmJXbMWbfWVMMdzZmsGd20hdXgPfxiIKeES1hl8eL5lSE/9dR+ WB5Hh1Q+WKG1tfgq73HnvMP2sUlG4tega+VWeponmHxGYhTnyfxuAxJ5gDgdSIKN /Bf+KpYrtWKmpj29f5JZzVoqgrI3eQ== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 930140085 (0x3770cfb5) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=Equifax Secure, OU=Equifax Secure eBusiness CA-2 - Validity - Not Before: Jun 23 12:14:45 1999 GMT - Not After : Jun 23 12:14:45 2019 GMT - Subject: C=US, O=Equifax Secure, OU=Equifax Secure eBusiness CA-2 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:e4:39:39:93:1e:52:06:1b:28:36:f8:b2:a3:29: - c5:ed:8e:b2:11:bd:fe:eb:e7:b4:74:c2:8f:ff:05: - e7:d9:9d:06:bf:12:c8:3f:0e:f2:d6:d1:24:b2:11: - de:d1:73:09:8a:d4:b1:2c:98:09:0d:1e:50:46:b2: - 83:a6:45:8d:62:68:bb:85:1b:20:70:32:aa:40:cd: - a6:96:5f:c4:71:37:3f:04:f3:b7:41:24:39:07:1a: - 1e:2e:61:58:a0:12:0b:e5:a5:df:c5:ab:ea:37:71: - cc:1c:c8:37:3a:b9:97:52:a7:ac:c5:6a:24:94:4e: - 9c:7b:cf:c0:6a:d6:df:21:bd - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 CRL Distribution Points: - DirName:/C=US/O=Equifax Secure/OU=Equifax Secure eBusiness CA-2/CN=CRL1 - - X509v3 Private Key Usage Period: - Not After: Jun 23 12:14:45 2019 GMT - X509v3 Key Usage: - Certificate Sign, CRL Sign - X509v3 Authority Key Identifier: - keyid:50:9E:0B:EA:AF:5E:B9:20:48:A6:50:6A:CB:FD:D8:20:7A:A7:82:76 - - X509v3 Subject Key Identifier: - 50:9E:0B:EA:AF:5E:B9:20:48:A6:50:6A:CB:FD:D8:20:7A:A7:82:76 - X509v3 Basic Constraints: - CA:TRUE - 1.2.840.113533.7.65.0: - 0...V3.0c.... - Signature Algorithm: sha1WithRSAEncryption - 0c:86:82:ad:e8:4e:1a:f5:8e:89:27:e2:35:58:3d:29:b4:07: - 8f:36:50:95:bf:6e:c1:9e:eb:c4:90:b2:85:a8:bb:b7:42:e0: - 0f:07:39:df:fb:9e:90:b2:d1:c1:3e:53:9f:03:44:b0:7e:4b: - f4:6f:e4:7c:1f:e7:e2:b1:e4:b8:9a:ef:c3:bd:ce:de:0b:32: - 34:d9:de:28:ed:33:6b:c4:d4:d7:3d:12:58:ab:7d:09:2d:cb: - 70:f5:13:8a:94:a1:27:a4:d6:70:c5:6d:94:b5:c9:7d:9d:a0: - d2:c6:08:49:d9:66:9b:a6:d3:f4:0b:dc:c5:26:57:e1:91:30: - ea:cd -MD5 Fingerprint=AA:BF:BF:64:97:DA:98:1D:6F:C6:08:3A:95:70:33:CA -----BEGIN CERTIFICATE----- MIIDIDCCAomgAwIBAgIEN3DPtTANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJV UzEXMBUGA1UEChMORXF1aWZheCBTZWN1cmUxJjAkBgNVBAsTHUVxdWlmYXggU2Vj @@ -2360,4590 +801,1390 @@ A4GBAAyGgq3oThr1jokn4jVYPSm0B482UJW/bsGe68SQsoWou7dC4A8HOd/7npCy 0cE+U58DRLB+S/Rv5Hwf5+Kx5Lia78O9zt4LMjTZ3ijtM2vE1Nc9ElirfQkty3D1 E4qUoSek1nDFbZS1yX2doNLGCEnZZpum0/QL3MUmV+GRMOrN -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 798 (0x31e) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=VISA, OU=Visa International Service Association, CN=GP Root 2 - Validity - Not Before: Aug 16 22:51:00 2000 GMT - Not After : Aug 15 23:59:00 2020 GMT - Subject: C=US, O=VISA, OU=Visa International Service Association, CN=GP Root 2 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:a9:01:70:b5:aa:c4:40:f0:ab:6a:26:61:79:19: - 00:fc:bf:9b:37:59:0c:af:6f:64:1b:f8:da:95:94: - 24:69:33:11:70:ca:e3:56:74:a2:17:57:64:5c:20: - 06:e1:d6:ef:71:b7:3b:f7:ab:c1:69:d0:49:a4:b1: - 04:d7:f4:57:62:89:5c:b0:75:2d:17:24:69:e3:42: - 60:e4:ee:74:d6:ab:80:56:d8:88:28:e1:fb:6d:22: - fd:23:7c:46:73:4f:7e:54:73:1e:a8:2c:55:58:75: - b7:4c:f3:5a:45:a5:02:1a:fa:da:9d:c3:45:c3:22: - 5e:f3:8b:f1:60:29:d2:c7:5f:b4:0c:3a:51:83:ef: - 30:f8:d4:e7:c7:f2:fa:99:a3:22:50:be:f9:05:37: - a3:ad:ed:9a:c3:e6:ec:88:1b:b6:19:27:1b:38:8b: - 80:4d:ec:b9:c7:c5:89:cb:fc:1a:32:ed:23:f0:b5: - 01:58:f9:f6:8f:e0:85:a9:4c:09:72:39:12:db:b3: - f5:cf:4e:62:64:da:c6:19:15:3a:63:1d:e9:17:55: - a1:4c:22:3c:34:32:46:f8:65:57:ba:2b:ef:36:8c: - 6a:fa:d9:d9:44:f4:aa:dd:84:d7:0d:1c:b2:54:ac: - 32:85:b4:64:0d:de:41:bb:b1:34:c6:01:86:32:64: - d5:9f - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - 9E:7D:4B:34:BF:71:AD:C2:05:F6:03:75:80:CE:A9:4F:1A:C4:24:4C - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - Signature Algorithm: sha1WithRSAEncryption - 21:a5:76:14:55:f9:ad:27:70:8f:3c:f4:d5:6c:c8:cc:0a:ab: - a3:98:0b:8a:06:23:c5:c9:61:db:99:07:69:35:26:31:fe:c7: - 2e:84:c2:99:61:d4:0d:e9:7d:2e:13:2b:7c:8e:85:b6:85:c7: - 4b:cf:35:b6:2c:47:3d:ce:29:2f:d8:6f:9f:89:1c:64:93:bf: - 08:bd:76:d0:90:8a:94:b3:7f:28:5b:6e:ac:4d:33:2c:ed:65: - dc:16:cc:e2:cd:ae:a4:3d:62:92:06:95:26:bf:df:b9:e4:20: - a6:73:6a:c1:be:f7:94:44:d6:4d:6f:2a:0b:6b:18:4d:74:10: - 36:68:6a:5a:c1:6a:a7:dd:36:29:8c:b8:30:8b:4f:21:3f:00: - 2e:54:30:07:3a:ba:8a:e4:c3:9e:ca:d8:b5:d8:7b:ce:75:45: - 66:07:f4:6d:2d:d8:7a:ca:e9:89:8a:f2:23:d8:2f:cb:6e:00: - 36:4f:fb:f0:2f:01:cc:0f:c0:22:65:f4:ab:e2:4e:61:2d:03: - 82:7d:91:16:b5:30:d5:14:de:5e:c7:90:fc:a1:fc:ab:10:af: - 5c:6b:70:a7:07:ef:29:86:e8:b2:25:c7:20:ff:26:dd:77:ef: - 79:44:14:c4:bd:dd:3b:c5:03:9b:77:23:ec:a0:ec:bb:5a:39: - b5:cc:ad:06 -MD5 Fingerprint=35:48:95:36:4A:54:5A:72:96:8E:E0:64:CC:EF:2C:8C -----BEGIN CERTIFICATE----- -MIIDgDCCAmigAwIBAgICAx4wDQYJKoZIhvcNAQEFBQAwYTELMAkGA1UEBhMCVVMx -DTALBgNVBAoTBFZJU0ExLzAtBgNVBAsTJlZpc2EgSW50ZXJuYXRpb25hbCBTZXJ2 -aWNlIEFzc29jaWF0aW9uMRIwEAYDVQQDEwlHUCBSb290IDIwHhcNMDAwODE2MjI1 -MTAwWhcNMjAwODE1MjM1OTAwWjBhMQswCQYDVQQGEwJVUzENMAsGA1UEChMEVklT -QTEvMC0GA1UECxMmVmlzYSBJbnRlcm5hdGlvbmFsIFNlcnZpY2UgQXNzb2NpYXRp -b24xEjAQBgNVBAMTCUdQIFJvb3QgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC -AQoCggEBAKkBcLWqxEDwq2omYXkZAPy/mzdZDK9vZBv42pWUJGkzEXDK41Z0ohdX -ZFwgBuHW73G3O/erwWnQSaSxBNf0V2KJXLB1LRckaeNCYOTudNargFbYiCjh+20i -/SN8RnNPflRzHqgsVVh1t0zzWkWlAhr62p3DRcMiXvOL8WAp0sdftAw6UYPvMPjU -58fy+pmjIlC++QU3o63tmsPm7IgbthknGziLgE3sucfFicv8GjLtI/C1AVj59o/g -halMCXI5Etuz9c9OYmTaxhkVOmMd6RdVoUwiPDQyRvhlV7or7zaMavrZ2UT0qt2E -1w0cslSsMoW0ZA3eQbuxNMYBhjJk1Z8CAwEAAaNCMEAwHQYDVR0OBBYEFJ59SzS/ -ca3CBfYDdYDOqU8axCRMMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEG -MA0GCSqGSIb3DQEBBQUAA4IBAQAhpXYUVfmtJ3CPPPTVbMjMCqujmAuKBiPFyWHb -mQdpNSYx/scuhMKZYdQN6X0uEyt8joW2hcdLzzW2LEc9zikv2G+fiRxkk78IvXbQ -kIqUs38oW26sTTMs7WXcFsziza6kPWKSBpUmv9+55CCmc2rBvveURNZNbyoLaxhN -dBA2aGpawWqn3TYpjLgwi08hPwAuVDAHOrqK5MOeyti12HvOdUVmB/RtLdh6yumJ -ivIj2C/LbgA2T/vwLwHMD8AiZfSr4k5hLQOCfZEWtTDVFN5ex5D8ofyrEK9ca3Cn -B+8phuiyJccg/ybdd+95RBTEvd07xQObdyPsoOy7Wjm1zK0G +MIIDVDCCAjygAwIBAgIDAjRWMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT +MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i +YWwgQ0EwHhcNMDIwNTIxMDQwMDAwWhcNMjIwNTIxMDQwMDAwWjBCMQswCQYDVQQG +EwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UEAxMSR2VvVHJ1c3Qg +R2xvYmFsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2swYYzD9 +9BcjGlZ+W988bDjkcbd4kdS8odhM+KhDtgPpTSEHCIjaWC9mOSm9BXiLnTjoBbdq +fnGk5sRgprDvgOSJKA+eJdbtg/OtppHHmMlCGDUUna2YRpIuT8rxh0PBFpVXLVDv +iS2Aelet8u5fa9IAjbkU+BQVNdnARqN7csiRv8lVK83Qlz6cJmTM386DGXHKTubU +1XupGc1V3sjs0l44U+VcT4wt/lAjNvxm5suOpDkZALeVAjmRCw7+OC7RHQWa9k0+ +bw8HHa8sHo9gOeL6NlMTOdReJivbPagUvTLrGAMoUgRx5aszPeE4uwc2hGKceeoW +MPRfwCvocWvk+QIDAQABo1MwUTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTA +ephojYn7qwVkDBF9qn1luMrMTjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1l +uMrMTjANBgkqhkiG9w0BAQUFAAOCAQEANeMpauUvXVSOKVCUn5kaFOSPeCpilKIn +Z57QzxpeR+nBsqTP3UEaBU6bS+5Kb1VSsyShNwrrZHYqLizz/Tt1kL/6cdjHPTfS +tQWVYrmm3ok9Nns4d0iXrKYgjy6myQzCsplFAMfOEVEiIuCl6rYVSAlk6l5PdPcF +PseKUgzbFbS9bZvlxrFUaKnjaZC2mqUPuLk/IH2uSrW4nOQdtqvmlKXBx4Ot2/Un +hw4EbNX/3aBd7YdStysVAq45pmp06drE57xNNB6pXE0zX5IJL4hmXXeXxx12E6nV +5fEWCRE11azbJHFwLJhWC9kXtNHjUStedejV0NxPNO3CBWaAocvmMw== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 961510791 (0x394f7d87) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=WW, O=beTRUSTed, CN=beTRUSTed Root CAs, CN=beTRUSTed Root CA - Validity - Not Before: Jun 20 14:21:04 2000 GMT - Not After : Jun 20 13:21:04 2010 GMT - Subject: C=WW, O=beTRUSTed, CN=beTRUSTed Root CAs, CN=beTRUSTed Root CA - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:d4:b4:73:7a:13:0a:38:55:01:be:89:56:e1:94: - 9e:d4:be:5a:eb:4a:34:75:1b:61:29:c4:e1:ad:08: - 60:21:78:48:ff:b4:d0:fa:5e:41:8d:61:44:87:e8: - ed:c9:58:fa:fc:93:9a:df:4f:ea:3e:35:7d:f8:33: - 7a:e6:f1:d7:cd:6f:49:4b:3d:4f:2d:6e:0e:83:3a: - 18:78:77:a3:cf:e7:f4:4d:73:d8:9a:3b:1a:1d:be: - 95:53:cf:20:97:c2:cf:3e:24:52:6c:0c:8e:65:59: - c5:71:ff:62:09:8f:aa:c5:8f:cc:60:a0:73:4a:d7: - 38:3f:15:72:bf:a2:97:b7:70:e8:af:e2:7e:16:06: - 4c:f5:aa:64:26:72:07:25:ad:35:fc:18:b1:26:d7: - d8:ff:19:0e:83:1b:8c:dc:78:45:67:34:3d:f4:af: - 1c:8d:e4:6d:6b:ed:20:b3:67:9a:b4:61:cb:17:6f: - 89:35:ff:e7:4e:c0:32:12:e7:ee:ec:df:ff:97:30: - 74:ed:8d:47:8e:eb:b4:c3:44:e6:a7:4c:7f:56:43: - e8:b8:bc:b6:be:fa:83:97:e6:bb:fb:c4:b6:93:be: - 19:18:3e:8c:81:b9:73:88:16:f4:96:43:9c:67:73: - 17:90:d8:09:6e:63:ac:4a:b6:23:c4:01:a1:ad:a4: - e4:c5 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Certificate Policies: - Policy: 1.3.6.1.4.1.6334.1.0.0 - User Notice: - Explicit Text: Reliance on this certificate by any party assumes acceptance of the then applicable standard terms and conditions of use, and certification practice statement, which can be found at beTRUSTed's web site, https://www.beTRUSTed.com/vault/terms - CPS: https://www.beTRUSTed.com/vault/terms - - X509v3 CRL Distribution Points: - DirName:/O=beTRUSTed/C=WW - - X509v3 Subject Key Identifier: - 2A:B9:9B:69:2E:3B:9B:D8:CD:DE:2A:31:04:34:6B:CA:07:18:AB:67 - X509v3 Authority Key Identifier: - keyid:2A:B9:9B:69:2E:3B:9B:D8:CD:DE:2A:31:04:34:6B:CA:07:18:AB:67 - - X509v3 Key Usage: critical - Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign - Signature Algorithm: sha1WithRSAEncryption - 79:61:db:a3:5e:6e:16:b1:ea:76:51:f9:cb:15:9b:cb:69:be: - e6:81:6b:9f:28:1f:65:3e:dd:11:85:92:d4:e8:41:bf:7e:33: - bd:23:e7:f1:20:bf:a4:b4:a6:19:01:c6:8c:8d:35:7c:65:a4: - 4f:09:a4:d6:d8:23:15:05:13:a7:43:79:af:db:a3:0e:9b:7b: - 78:1a:f3:04:86:5a:c6:f6:8c:20:47:38:49:50:06:9d:72:67: - 3a:f0:98:03:ad:96:67:44:fc:3f:10:0d:86:4d:e4:00:3b:29: - 7b:ce:3b:3b:99:86:61:25:40:84:dc:13:62:b7:fa:ca:59:d6: - 03:1e:d6:53:01:cd:6d:4c:68:55:40:e1:ee:6b:c7:2a:00:00: - 48:82:b3:0a:01:c3:60:2a:0c:f7:82:35:ee:48:86:96:e4:74: - d4:3d:ea:01:71:ba:04:75:40:a7:a9:7f:39:39:9a:55:97:29: - 65:ae:19:55:25:05:72:47:d3:e8:18:dc:b8:e9:af:43:73:01: - 12:74:a3:e1:5c:5f:15:5d:24:f3:f9:e4:f4:b6:67:67:12:e7: - 64:22:8a:f6:a5:41:a6:1c:b6:60:63:45:8a:10:b4:ba:46:10: - ae:41:57:65:6c:3f:23:10:3f:21:10:59:b7:e4:40:dd:26:0c: - 23:f6:aa:ae -MD5 Fingerprint=85:CA:76:5A:1B:D1:68:22:DC:A2:23:12:CA:C6:80:34 -----BEGIN CERTIFICATE----- -MIIFLDCCBBSgAwIBAgIEOU99hzANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJX -VzESMBAGA1UEChMJYmVUUlVTVGVkMRswGQYDVQQDExJiZVRSVVNUZWQgUm9vdCBD -QXMxGjAYBgNVBAMTEWJlVFJVU1RlZCBSb290IENBMB4XDTAwMDYyMDE0MjEwNFoX -DTEwMDYyMDEzMjEwNFowWjELMAkGA1UEBhMCV1cxEjAQBgNVBAoTCWJlVFJVU1Rl -ZDEbMBkGA1UEAxMSYmVUUlVTVGVkIFJvb3QgQ0FzMRowGAYDVQQDExFiZVRSVVNU -ZWQgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANS0c3oT -CjhVAb6JVuGUntS+WutKNHUbYSnE4a0IYCF4SP+00PpeQY1hRIfo7clY+vyTmt9P -6j41ffgzeubx181vSUs9Ty1uDoM6GHh3o8/n9E1z2Jo7Gh2+lVPPIJfCzz4kUmwM -jmVZxXH/YgmPqsWPzGCgc0rXOD8Vcr+il7dw6K/ifhYGTPWqZCZyByWtNfwYsSbX -2P8ZDoMbjNx4RWc0PfSvHI3kbWvtILNnmrRhyxdviTX/507AMhLn7uzf/5cwdO2N -R47rtMNE5qdMf1ZD6Li8tr76g5fmu/vEtpO+GRg+jIG5c4gW9JZDnGdzF5DYCW5j -rEq2I8QBoa2k5MUCAwEAAaOCAfgwggH0MA8GA1UdEwEB/wQFMAMBAf8wggFZBgNV -HSAEggFQMIIBTDCCAUgGCisGAQQBsT4BAAAwggE4MIIBAQYIKwYBBQUHAgIwgfQa -gfFSZWxpYW5jZSBvbiB0aGlzIGNlcnRpZmljYXRlIGJ5IGFueSBwYXJ0eSBhc3N1 -bWVzIGFjY2VwdGFuY2Ugb2YgdGhlIHRoZW4gYXBwbGljYWJsZSBzdGFuZGFyZCB0 -ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB1c2UsIGFuZCBjZXJ0aWZpY2F0aW9uIHBy -YWN0aWNlIHN0YXRlbWVudCwgd2hpY2ggY2FuIGJlIGZvdW5kIGF0IGJlVFJVU1Rl -ZCdzIHdlYiBzaXRlLCBodHRwczovL3d3dy5iZVRSVVNUZWQuY29tL3ZhdWx0L3Rl -cm1zMDEGCCsGAQUFBwIBFiVodHRwczovL3d3dy5iZVRSVVNUZWQuY29tL3ZhdWx0 -L3Rlcm1zMDQGA1UdHwQtMCswKaAnoCWkIzAhMRIwEAYDVQQKEwliZVRSVVNUZWQx -CzAJBgNVBAYTAldXMB0GA1UdDgQWBBQquZtpLjub2M3eKjEENGvKBxirZzAfBgNV -HSMEGDAWgBQquZtpLjub2M3eKjEENGvKBxirZzAOBgNVHQ8BAf8EBAMCAf4wDQYJ -KoZIhvcNAQEFBQADggEBAHlh26Nebhax6nZR+csVm8tpvuaBa58oH2U+3RGFktTo -Qb9+M70j5/Egv6S0phkBxoyNNXxlpE8JpNbYIxUFE6dDea/bow6be3ga8wSGWsb2 -jCBHOElQBp1yZzrwmAOtlmdE/D8QDYZN5AA7KXvOOzuZhmElQITcE2K3+spZ1gMe -1lMBzW1MaFVA4e5rxyoAAEiCswoBw2AqDPeCNe5IhpbkdNQ96gFxugR1QKepfzk5 -mlWXKWWuGVUlBXJH0+gY3Ljpr0NzARJ0o+FcXxVdJPP55PS2Z2cS52QiivalQaYc -tmBjRYoQtLpGEK5BV2VsPyMQPyEQWbfkQN0mDCP2qq4= +MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG +A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv +b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw +MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i +YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT +aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ +jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp +xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp +1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG +snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ +U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8 +9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E +BTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0B +AQUFAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOz +yj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE +38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymP +AbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr+WymXUad +DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME +HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1 (0x1) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root - Validity - Not Before: May 30 10:38:31 2000 GMT - Not After : May 30 10:38:31 2020 GMT - Subject: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:96:96:d4:21:49:60:e2:6b:e8:41:07:0c:de:c4: - e0:dc:13:23:cd:c1:35:c7:fb:d6:4e:11:0a:67:5e: - f5:06:5b:6b:a5:08:3b:5b:29:16:3a:e7:87:b2:34: - 06:c5:bc:05:a5:03:7c:82:cb:29:10:ae:e1:88:81: - bd:d6:9e:d3:fe:2d:56:c1:15:ce:e3:26:9d:15:2e: - 10:fb:06:8f:30:04:de:a7:b4:63:b4:ff:b1:9c:ae: - 3c:af:77:b6:56:c5:b5:ab:a2:e9:69:3a:3d:0e:33: - 79:32:3f:70:82:92:99:61:6d:8d:30:08:8f:71:3f: - a6:48:57:19:f8:25:dc:4b:66:5c:a5:74:8f:98:ae: - c8:f9:c0:06:22:e7:ac:73:df:a5:2e:fb:52:dc:b1: - 15:65:20:fa:35:66:69:de:df:2c:f1:6e:bc:30:db: - 2c:24:12:db:eb:35:35:68:90:cb:00:b0:97:21:3d: - 74:21:23:65:34:2b:bb:78:59:a3:d6:e1:76:39:9a: - a4:49:8e:8c:74:af:6e:a4:9a:a3:d9:9b:d2:38:5c: - 9b:a2:18:cc:75:23:84:be:eb:e2:4d:33:71:8e:1a: - f0:c2:f8:c7:1d:a2:ad:03:97:2c:f8:cf:25:c6:f6: - b8:24:31:b1:63:5d:92:7f:63:f0:25:c9:53:2e:1f: - bf:4d - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - 95:B1:B4:F0:94:B6:BD:C7:DA:D1:11:09:21:BE:C1:AF:49:FD:10:7B - X509v3 Key Usage: - Certificate Sign, CRL Sign - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Authority Key Identifier: - keyid:95:B1:B4:F0:94:B6:BD:C7:DA:D1:11:09:21:BE:C1:AF:49:FD:10:7B - DirName:/C=SE/O=AddTrust AB/OU=AddTrust TTP Network/CN=AddTrust Class 1 CA Root - serial:01 - - Signature Algorithm: sha1WithRSAEncryption - 2c:6d:64:1b:1f:cd:0d:dd:b9:01:fa:96:63:34:32:48:47:99: - ae:97:ed:fd:72:16:a6:73:47:5a:f4:eb:dd:e9:f5:d6:fb:45: - cc:29:89:44:5d:bf:46:39:3d:e8:ee:bc:4d:54:86:1e:1d:6c: - e3:17:27:43:e1:89:56:2b:a9:6f:72:4e:49:33:e3:72:7c:2a: - 23:9a:bc:3e:ff:28:2a:ed:a3:ff:1c:23:ba:43:57:09:67:4d: - 4b:62:06:2d:f8:ff:6c:9d:60:1e:d8:1c:4b:7d:b5:31:2f:d9: - d0:7c:5d:f8:de:6b:83:18:78:37:57:2f:e8:33:07:67:df:1e: - c7:6b:2a:95:76:ae:8f:57:a3:f0:f4:52:b4:a9:53:08:cf:e0: - 4f:d3:7a:53:8b:fd:bb:1c:56:36:f2:fe:b2:b6:e5:76:bb:d5: - 22:65:a7:3f:fe:d1:66:ad:0b:bc:6b:99:86:ef:3f:7d:f3:18: - 32:ca:7b:c6:e3:ab:64:46:95:f8:26:69:d9:55:83:7b:2c:96: - 07:ff:59:2c:44:a3:c6:e5:e9:a9:dc:a1:63:80:5a:21:5e:21: - cf:53:54:f0:ba:6f:89:db:a8:aa:95:cf:8b:e3:71:cc:1e:1b: - 20:44:08:c0:7a:b6:40:fd:c4:e4:35:e1:1d:16:1c:d0:bc:2b: - 8e:d6:71:d9 -MD5 Fingerprint=1E:42:95:02:33:92:6B:B9:5F:C0:7F:DA:D6:B2:4B:FC -----BEGIN CERTIFICATE----- -MIIEGDCCAwCgAwIBAgIBATANBgkqhkiG9w0BAQUFADBlMQswCQYDVQQGEwJTRTEU -MBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFkZFRydXN0IFRUUCBOZXR3 -b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENBIFJvb3QwHhcNMDAwNTMw -MTAzODMxWhcNMjAwNTMwMTAzODMxWjBlMQswCQYDVQQGEwJTRTEUMBIGA1UEChML -QWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFkZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYD -VQQDExhBZGRUcnVzdCBDbGFzcyAxIENBIFJvb3QwggEiMA0GCSqGSIb3DQEBAQUA -A4IBDwAwggEKAoIBAQCWltQhSWDia+hBBwzexODcEyPNwTXH+9ZOEQpnXvUGW2ul -CDtbKRY654eyNAbFvAWlA3yCyykQruGIgb3WntP+LVbBFc7jJp0VLhD7Bo8wBN6n -tGO0/7Gcrjyvd7ZWxbWroulpOj0OM3kyP3CCkplhbY0wCI9xP6ZIVxn4JdxLZlyl -dI+Yrsj5wAYi56xz36Uu+1LcsRVlIPo1Zmne3yzxbrww2ywkEtvrNTVokMsAsJch -PXQhI2U0K7t4WaPW4XY5mqRJjox0r26kmqPZm9I4XJuiGMx1I4S+6+JNM3GOGvDC -+Mcdoq0Dlyz4zyXG9rgkMbFjXZJ/Y/AlyVMuH79NAgMBAAGjgdIwgc8wHQYDVR0O -BBYEFJWxtPCUtr3H2tERCSG+wa9J/RB7MAsGA1UdDwQEAwIBBjAPBgNVHRMBAf8E -BTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl -MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk -ZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB -IFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0MkhHma6X -7f1yFqZzR1r0693p9db7RcwpiURdv0Y5PejuvE1Uhh4dbOMXJ0PhiVYrqW9yTkkz -43J8KiOavD7/KCrto/8cI7pDVwlnTUtiBi34/2ydYB7YHEt9tTEv2dB8Xfjea4MY -eDdXL+gzB2ffHsdrKpV2ro9Xo/D0UrSpUwjP4E/TelOL/bscVjby/rK25Xa71SJl -pz/+0WatC7xrmYbvP33zGDLKe8bjq2RGlfgmadlVg3sslgf/WSxEo8bl6ancoWOA -WiFeIc9TVPC6b4nbqKqVz4vjccweGyBECMB6tkD9xOQ14R0WHNC8K47Wcdk= +MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD +VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv +bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv +b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV +UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU +cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds +b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH +iM3dFw4usJTQGz0O9pTAipTHBsiQl8i4ZBp6fmw8U+E3KHNgf7KXUwefU/ltWJTS +r41tiGeA5u2ylc9yMcqlHHK6XALnZELn+aks1joNrI1CqiQBOeacPwGFVw1Yh0X4 +04Wqk2kmhXBIgD8SFcd5tB8FLztimQIDAQABMA0GCSqGSIb3DQEBBAUAA4GBAG3r +GwnpXtlR22ciYaQqPEh346B8pt5zohQDhT37qw4wxYMWM4ETCJ57NE7fQMh017l9 +3PR2VX2bY1QY6fDq81yx2YtCHrnAlU66+tXifPVoYb+O7AWXX1uw16OFNMQkpw0P +lZPvy5TYnh+dXIVtx6quTx8itc2VrbqnzPmrC3p/ -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1 (0x1) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root - Validity - Not Before: May 30 10:48:38 2000 GMT - Not After : May 30 10:48:38 2020 GMT - Subject: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:b7:f7:1a:33:e6:f2:00:04:2d:39:e0:4e:5b:ed: - 1f:bc:6c:0f:cd:b5:fa:23:b6:ce:de:9b:11:33:97: - a4:29:4c:7d:93:9f:bd:4a:bc:93:ed:03:1a:e3:8f: - cf:e5:6d:50:5a:d6:97:29:94:5a:80:b0:49:7a:db: - 2e:95:fd:b8:ca:bf:37:38:2d:1e:3e:91:41:ad:70: - 56:c7:f0:4f:3f:e8:32:9e:74:ca:c8:90:54:e9:c6: - 5f:0f:78:9d:9a:40:3c:0e:ac:61:aa:5e:14:8f:9e: - 87:a1:6a:50:dc:d7:9a:4e:af:05:b3:a6:71:94:9c: - 71:b3:50:60:0a:c7:13:9d:38:07:86:02:a8:e9:a8: - 69:26:18:90:ab:4c:b0:4f:23:ab:3a:4f:84:d8:df: - ce:9f:e1:69:6f:bb:d7:42:d7:6b:44:e4:c7:ad:ee: - 6d:41:5f:72:5a:71:08:37:b3:79:65:a4:59:a0:94: - 37:f7:00:2f:0d:c2:92:72:da:d0:38:72:db:14:a8: - 45:c4:5d:2a:7d:b7:b4:d6:c4:ee:ac:cd:13:44:b7: - c9:2b:dd:43:00:25:fa:61:b9:69:6a:58:23:11:b7: - a7:33:8f:56:75:59:f5:cd:29:d7:46:b7:0a:2b:65: - b6:d3:42:6f:15:b2:b8:7b:fb:ef:e9:5d:53:d5:34: - 5a:27 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A - X509v3 Key Usage: - Certificate Sign, CRL Sign - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Authority Key Identifier: - keyid:AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A - DirName:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root - serial:01 - - Signature Algorithm: sha1WithRSAEncryption - b0:9b:e0:85:25:c2:d6:23:e2:0f:96:06:92:9d:41:98:9c:d9: - 84:79:81:d9:1e:5b:14:07:23:36:65:8f:b0:d8:77:bb:ac:41: - 6c:47:60:83:51:b0:f9:32:3d:e7:fc:f6:26:13:c7:80:16:a5: - bf:5a:fc:87:cf:78:79:89:21:9a:e2:4c:07:0a:86:35:bc:f2: - de:51:c4:d2:96:b7:dc:7e:4e:ee:70:fd:1c:39:eb:0c:02:51: - 14:2d:8e:bd:16:e0:c1:df:46:75:e7:24:ad:ec:f4:42:b4:85: - 93:70:10:67:ba:9d:06:35:4a:18:d3:2b:7a:cc:51:42:a1:7a: - 63:d1:e6:bb:a1:c5:2b:c2:36:be:13:0d:e6:bd:63:7e:79:7b: - a7:09:0d:40:ab:6a:dd:8f:8a:c3:f6:f6:8c:1a:42:05:51:d4: - 45:f5:9f:a7:62:21:68:15:20:43:3c:99:e7:7c:bd:24:d8:a9: - 91:17:73:88:3f:56:1b:31:38:18:b4:71:0f:9a:cd:c8:0e:9e: - 8e:2e:1b:e1:8c:98:83:cb:1f:31:f1:44:4c:c6:04:73:49:76: - 60:0f:c7:f8:bd:17:80:6b:2e:e9:cc:4c:0e:5a:9a:79:0f:20: - 0a:2e:d5:9e:63:26:1e:55:92:94:d8:82:17:5a:7b:d0:bc:c7: - 8f:4e:86:04 -MD5 Fingerprint=1D:35:54:04:85:78:B0:3F:42:42:4D:BF:20:73:0A:3F -----BEGIN CERTIFICATE----- -MIIENjCCAx6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJTRTEU -MBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFs -IFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290 -MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFowbzELMAkGA1UEBhMCU0Ux -FDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h -bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9v -dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALf3GjPm8gAELTngTlvt -H7xsD821+iO2zt6bETOXpClMfZOfvUq8k+0DGuOPz+VtUFrWlymUWoCwSXrbLpX9 -uMq/NzgtHj6RQa1wVsfwTz/oMp50ysiQVOnGXw94nZpAPA6sYapeFI+eh6FqUNzX -mk6vBbOmcZSccbNQYArHE504B4YCqOmoaSYYkKtMsE8jqzpPhNjfzp/haW+710LX -a0Tkx63ubUFfclpxCDezeWWkWaCUN/cALw3CknLa0Dhy2xSoRcRdKn23tNbE7qzN -E0S3ySvdQwAl+mG5aWpYIxG3pzOPVnVZ9c0p10a3CitlttNCbxWyuHv77+ldU9U0 -WicCAwEAAaOB3DCB2TAdBgNVHQ4EFgQUrb2YejS0Jvf6xCZU7wO94CTLVBowCwYD -VR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wgZkGA1UdIwSBkTCBjoAUrb2YejS0 -Jvf6xCZU7wO94CTLVBqhc6RxMG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRU -cnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsx -IjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3SCAQEwDQYJKoZIhvcN -AQEFBQADggEBALCb4IUlwtYj4g+WBpKdQZic2YR5gdkeWxQHIzZlj7DYd7usQWxH -YINRsPkyPef89iYTx4AWpb9a/IfPeHmJIZriTAcKhjW88t5RxNKWt9x+Tu5w/Rw5 -6wwCURQtjr0W4MHfRnXnJK3s9EK0hZNwEGe6nQY1ShjTK3rMUUKhemPR5ruhxSvC -Nr4TDea9Y355e6cJDUCrat2PisP29owaQgVR1EX1n6diIWgVIEM8med8vSTYqZEX -c4g/VhsxOBi0cQ+azcgOno4uG+GMmIPLHzHxREzGBHNJdmAPx/i9F4BrLunMTA5a -mnkPIAou1Z5jJh5VkpTYghdae9C8x49OhgQ= +MIIB+jCCAWMCAgGjMA0GCSqGSIb3DQEBBAUAMEUxCzAJBgNVBAYTAlVTMRgwFgYD +VQQKEw9HVEUgQ29ycG9yYXRpb24xHDAaBgNVBAMTE0dURSBDeWJlclRydXN0IFJv +b3QwHhcNOTYwMjIzMjMwMTAwWhcNMDYwMjIzMjM1OTAwWjBFMQswCQYDVQQGEwJV +UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMRwwGgYDVQQDExNHVEUgQ3liZXJU +cnVzdCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC45k+625h8cXyv +RLfTD0bZZOWTwUKOx7pJjTUteueLveUFMVnGsS8KDPufpz+iCWaEVh43KRuH6X4M +ypqfpX/1FZSj1aJGgthoTNE3FQZor734sLPwKfWVWgkWYXcKIiXUT0Wqx73llt/5 +1KiOQswkwB6RJ0q1bQaAYznEol44AwIDAQABMA0GCSqGSIb3DQEBBAUAA4GBABKz +dcZfHeFhVYAA1IFLezEPI2PnPfMD+fQ2qLvZ46WXTeorKeDWanOB5sCJo9Px4KWl +IjeaY8JIILTbcuPI9tl8vrGvU9oUtCG41tWW4/5ODFlitppK+ULdjG+BqXH/9Apy +bW1EDp3zdHSo1TRJ6V6e6bR64eVaH4QwnNOfpSXY -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1 (0x1) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Public CA Root - Validity - Not Before: May 30 10:41:50 2000 GMT - Not After : May 30 10:41:50 2020 GMT - Subject: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Public CA Root - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:e9:1a:30:8f:83:88:14:c1:20:d8:3c:9b:8f:1b: - 7e:03:74:bb:da:69:d3:46:a5:f8:8e:c2:0c:11:90: - 51:a5:2f:66:54:40:55:ea:db:1f:4a:56:ee:9f:23: - 6e:f4:39:cb:a1:b9:6f:f2:7e:f9:5d:87:26:61:9e: - 1c:f8:e2:ec:a6:81:f8:21:c5:24:cc:11:0c:3f:db: - 26:72:7a:c7:01:97:07:17:f9:d7:18:2c:30:7d:0e: - 7a:1e:62:1e:c6:4b:c0:fd:7d:62:77:d3:44:1e:27: - f6:3f:4b:44:b3:b7:38:d9:39:1f:60:d5:51:92:73: - 03:b4:00:69:e3:f3:14:4e:ee:d1:dc:09:cf:77:34: - 46:50:b0:f8:11:f2:fe:38:79:f7:07:39:fe:51:92: - 97:0b:5b:08:5f:34:86:01:ad:88:97:eb:66:cd:5e: - d1:ff:dc:7d:f2:84:da:ba:77:ad:dc:80:08:c7:a7: - 87:d6:55:9f:97:6a:e8:c8:11:64:ba:e7:19:29:3f: - 11:b3:78:90:84:20:52:5b:11:ef:78:d0:83:f6:d5: - 48:90:d0:30:1c:cf:80:f9:60:fe:79:e4:88:f2:dd: - 00:eb:94:45:eb:65:94:69:40:ba:c0:d5:b4:b8:ba: - 7d:04:11:a8:eb:31:05:96:94:4e:58:21:8e:9f:d0: - 60:fd - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - 81:3E:37:D8:92:B0:1F:77:9F:5C:B4:AB:73:AA:E7:F6:34:60:2F:FA - X509v3 Key Usage: - Certificate Sign, CRL Sign - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Authority Key Identifier: - keyid:81:3E:37:D8:92:B0:1F:77:9F:5C:B4:AB:73:AA:E7:F6:34:60:2F:FA - DirName:/C=SE/O=AddTrust AB/OU=AddTrust TTP Network/CN=AddTrust Public CA Root - serial:01 - - Signature Algorithm: sha1WithRSAEncryption - 03:f7:15:4a:f8:24:da:23:56:16:93:76:dd:36:28:b9:ae:1b: - b8:c3:f1:64:ba:20:18:78:95:29:27:57:05:bc:7c:2a:f4:b9: - 51:55:da:87:02:de:0f:16:17:31:f8:aa:79:2e:09:13:bb:af: - b2:20:19:12:e5:93:f9:4b:f9:83:e8:44:d5:b2:41:25:bf:88: - 75:6f:ff:10:fc:4a:54:d0:5f:f0:fa:ef:36:73:7d:1b:36:45: - c6:21:6d:b4:15:b8:4e:cf:9c:5c:a5:3d:5a:00:8e:06:e3:3c: - 6b:32:7b:f2:9f:f0:b6:fd:df:f0:28:18:48:f0:c6:bc:d0:bf: - 34:80:96:c2:4a:b1:6d:8e:c7:90:45:de:2f:67:ac:45:04:a3: - 7a:dc:55:92:c9:47:66:d8:1a:8c:c7:ed:9c:4e:9a:e0:12:bb: - b5:6a:4c:84:e1:e1:22:0d:87:00:64:fe:8c:7d:62:39:65:a6: - ef:42:b6:80:25:12:61:01:a8:24:13:70:00:11:26:5f:fa:35: - 50:c5:48:cc:06:47:e8:27:d8:70:8d:5f:64:e6:a1:44:26:5e: - 22:ec:92:cd:ff:42:9a:44:21:6d:5c:c5:e3:22:1d:5f:47:12: - e7:ce:5f:5d:fa:d8:aa:b1:33:2d:d9:76:f2:4e:3a:33:0c:2b: - b3:2d:90:06 -MD5 Fingerprint=C1:62:3E:23:C5:82:73:9C:03:59:4B:2B:E9:77:49:7F -----BEGIN CERTIFICATE----- -MIIEFTCCAv2gAwIBAgIBATANBgkqhkiG9w0BAQUFADBkMQswCQYDVQQGEwJTRTEU -MBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFkZFRydXN0IFRUUCBOZXR3 -b3JrMSAwHgYDVQQDExdBZGRUcnVzdCBQdWJsaWMgQ0EgUm9vdDAeFw0wMDA1MzAx -MDQxNTBaFw0yMDA1MzAxMDQxNTBaMGQxCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtB -ZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIDAeBgNV -BAMTF0FkZFRydXN0IFB1YmxpYyBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOC -AQ8AMIIBCgKCAQEA6Rowj4OIFMEg2Dybjxt+A3S72mnTRqX4jsIMEZBRpS9mVEBV -6tsfSlbunyNu9DnLoblv8n75XYcmYZ4c+OLspoH4IcUkzBEMP9smcnrHAZcHF/nX -GCwwfQ56HmIexkvA/X1id9NEHif2P0tEs7c42TkfYNVRknMDtABp4/MUTu7R3AnP -dzRGULD4EfL+OHn3Bzn+UZKXC1sIXzSGAa2Il+tmzV7R/9x98oTaunet3IAIx6eH -1lWfl2royBFkuucZKT8Rs3iQhCBSWxHveNCD9tVIkNAwHM+A+WD+eeSI8t0A65RF -62WUaUC6wNW0uLp9BBGo6zEFlpROWCGOn9Bg/QIDAQABo4HRMIHOMB0GA1UdDgQW -BBSBPjfYkrAfd59ctKtzquf2NGAv+jALBgNVHQ8EBAMCAQYwDwYDVR0TAQH/BAUw -AwEB/zCBjgYDVR0jBIGGMIGDgBSBPjfYkrAfd59ctKtzquf2NGAv+qFopGYwZDEL -MAkGA1UEBhMCU0UxFDASBgNVBAoTC0FkZFRydXN0IEFCMR0wGwYDVQQLExRBZGRU -cnVzdCBUVFAgTmV0d29yazEgMB4GA1UEAxMXQWRkVHJ1c3QgUHVibGljIENBIFJv -b3SCAQEwDQYJKoZIhvcNAQEFBQADggEBAAP3FUr4JNojVhaTdt02KLmuG7jD8WS6 -IBh4lSknVwW8fCr0uVFV2ocC3g8WFzH4qnkuCRO7r7IgGRLlk/lL+YPoRNWyQSW/ -iHVv/xD8SlTQX/D67zZzfRs2RcYhbbQVuE7PnFylPVoAjgbjPGsye/Kf8Lb93/Ao -GEjwxrzQvzSAlsJKsW2Ox5BF3i9nrEUEo3rcVZLJR2bYGozH7ZxOmuASu7VqTITh -4SINhwBk/ox9Yjllpu9CtoAlEmEBqCQTcAARJl/6NVDFSMwGR+gn2HCNX2TmoUQm -XiLsks3/QppEIW1cxeMiHV9HEufOX1362KqxMy3ZdvJOOjMMK7MtkAY= +MIIH9zCCB2CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCARwxCzAJBgNVBAYTAkVT +MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE +ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE +ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjEzMDEGA1UECxMq +SVBTIENBIENoYWluZWQgQ0FzIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MTMwMQYD +VQQDEypJUFMgQ0EgQ2hhaW5lZCBDQXMgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkx +HjAcBgkqhkiG9w0BCQEWD2lwc0BtYWlsLmlwcy5lczAeFw0wMTEyMjkwMDUzNTha +Fw0yNTEyMjcwMDUzNThaMIIBHDELMAkGA1UEBhMCRVMxEjAQBgNVBAgTCUJhcmNl +bG9uYTESMBAGA1UEBxMJQmFyY2Vsb25hMS4wLAYDVQQKEyVJUFMgSW50ZXJuZXQg +cHVibGlzaGluZyBTZXJ2aWNlcyBzLmwuMSswKQYDVQQKFCJpcHNAbWFpbC5pcHMu +ZXMgQy5JLkYuICBCLTYwOTI5NDUyMTMwMQYDVQQLEypJUFMgQ0EgQ2hhaW5lZCBD +QXMgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxMzAxBgNVBAMTKklQUyBDQSBDaGFp +bmVkIENBcyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEeMBwGCSqGSIb3DQEJARYP +aXBzQG1haWwuaXBzLmVzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDcVpJJ +spQgvJhPUOtopKdJC7/SMejHT8KGC/po/UNaivNgkjWZOLtNA1IhW/A3mTXhQSCB +hYEFcYGdtJUZqV92NC5jNzVXjrQfQj8VXOF6wV8TGDIxya2+o8eDZh65nAQTy2nB +Bt4wBrszo7Uf8I9vzv+W6FS+ZoCua9tBhDaiPQIDAQABo4IEQzCCBD8wHQYDVR0O +BBYEFKGtMbH5PuEXpsirNPxShwkeYlJBMIIBTgYDVR0jBIIBRTCCAUGAFKGtMbH5 +PuEXpsirNPxShwkeYlJBoYIBJKSCASAwggEcMQswCQYDVQQGEwJFUzESMBAGA1UE +CBMJQmFyY2Vsb25hMRIwEAYDVQQHEwlCYXJjZWxvbmExLjAsBgNVBAoTJUlQUyBJ +bnRlcm5ldCBwdWJsaXNoaW5nIFNlcnZpY2VzIHMubC4xKzApBgNVBAoUImlwc0Bt +YWlsLmlwcy5lcyBDLkkuRi4gIEItNjA5Mjk0NTIxMzAxBgNVBAsTKklQUyBDQSBD +aGFpbmVkIENBcyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEzMDEGA1UEAxMqSVBT +IENBIENoYWluZWQgQ0FzIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MR4wHAYJKoZI +hvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOCAQAwDAYDVR0TBAUwAwEB/zAMBgNVHQ8E +BQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMG +CCsGAQUFBwMEBggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYB +BAGCNwoDAQYKKwYBBAGCNwoDBDARBglghkgBhvhCAQEEBAMCAAcwGgYDVR0RBBMw +EYEPaXBzQG1haWwuaXBzLmVzMBoGA1UdEgQTMBGBD2lwc0BtYWlsLmlwcy5lczBC +BglghkgBhvhCAQ0ENRYzQ2hhaW5lZCBDQSBDZXJ0aWZpY2F0ZSBpc3N1ZWQgYnkg +aHR0cDovL3d3dy5pcHMuZXMvMCkGCWCGSAGG+EIBAgQcFhpodHRwOi8vd3d3Lmlw +cy5lcy9pcHMyMDAyLzA3BglghkgBhvhCAQQEKhYoaHR0cDovL3d3dy5pcHMuZXMv +aXBzMjAwMi9pcHMyMDAyQ0FDLmNybDA8BglghkgBhvhCAQMELxYtaHR0cDovL3d3 +dy5pcHMuZXMvaXBzMjAwMi9yZXZvY2F0aW9uQ0FDLmh0bWw/MDkGCWCGSAGG+EIB +BwQsFipodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL3JlbmV3YWxDQUMuaHRtbD8w +NwYJYIZIAYb4QgEIBCoWKGh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvcG9saWN5 +Q0FDLmh0bWwwbQYDVR0fBGYwZDAuoCygKoYoaHR0cDovL3d3dy5pcHMuZXMvaXBz +MjAwMi9pcHMyMDAyQ0FDLmNybDAyoDCgLoYsaHR0cDovL3d3d2JhY2suaXBzLmVz +L2lwczIwMDIvaXBzMjAwMkNBQy5jcmwwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUF +BzABhhNodHRwOi8vb2NzcC5pcHMuZXMvMA0GCSqGSIb3DQEBBQUAA4GBAERyMJ1W +WKJBGyi3leGmGpVfp3hAK+/blkr8THFj2XOVvQLiogbHvpcqk4A0hgP63Ng9HgfN +HnNDJGD1HWHc3JagvPsd4+cSACczAsDAK1M92GsDgaPb1pOVIO/Tln4mkImcJpvN +b2ar7QMiRDjMWb2f2/YHogF/JsRj9SVCXmK9 -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1 (0x1) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Qualified CA Root - Validity - Not Before: May 30 10:44:50 2000 GMT - Not After : May 30 10:44:50 2020 GMT - Subject: C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Qualified CA Root - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:e4:1e:9a:fe:dc:09:5a:87:a4:9f:47:be:11:5f: - af:84:34:db:62:3c:79:78:b7:e9:30:b5:ec:0c:1c: - 2a:c4:16:ff:e0:ec:71:eb:8a:f5:11:6e:ed:4f:0d: - 91:d2:12:18:2d:49:15:01:c2:a4:22:13:c7:11:64: - ff:22:12:9a:b9:8e:5c:2f:08:cf:71:6a:b3:67:01: - 59:f1:5d:46:f3:b0:78:a5:f6:0e:42:7a:e3:7f:1b: - cc:d0:f0:b7:28:fd:2a:ea:9e:b3:b0:b9:04:aa:fd: - f6:c7:b4:b1:b8:2a:a0:fb:58:f1:19:a0:6f:70:25: - 7e:3e:69:4a:7f:0f:22:d8:ef:ad:08:11:9a:29:99: - e1:aa:44:45:9a:12:5e:3e:9d:6d:52:fc:e7:a0:3d: - 68:2f:f0:4b:70:7c:13:38:ad:bc:15:25:f1:d6:ce: - ab:a2:c0:31:d6:2f:9f:e0:ff:14:59:fc:84:93:d9: - 87:7c:4c:54:13:eb:9f:d1:2d:11:f8:18:3a:3a:de: - 25:d9:f7:d3:40:ed:a4:06:12:c4:3b:e1:91:c1:56: - 35:f0:14:dc:65:36:09:6e:ab:a4:07:c7:35:d1:c2: - 03:33:36:5b:75:26:6d:42:f1:12:6b:43:6f:4b:71: - 94:fa:34:1d:ed:13:6e:ca:80:7f:98:2f:6c:b9:65: - d8:e9 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - 39:95:8B:62:8B:5C:C9:D4:80:BA:58:0F:97:3F:15:08:43:CC:98:A7 - X509v3 Key Usage: - Certificate Sign, CRL Sign - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Authority Key Identifier: - keyid:39:95:8B:62:8B:5C:C9:D4:80:BA:58:0F:97:3F:15:08:43:CC:98:A7 - DirName:/C=SE/O=AddTrust AB/OU=AddTrust TTP Network/CN=AddTrust Qualified CA Root - serial:01 - - Signature Algorithm: sha1WithRSAEncryption - 19:ab:75:ea:f8:8b:65:61:95:13:ba:69:04:ef:86:ca:13:a0: - c7:aa:4f:64:1b:3f:18:f6:a8:2d:2c:55:8f:05:b7:30:ea:42: - 6a:1d:c0:25:51:2d:a7:bf:0c:b3:ed:ef:08:7f:6c:3c:46:1a: - ea:18:43:df:76:cc:f9:66:86:9c:2c:68:f5:e9:17:f8:31:b3: - 18:c4:d6:48:7d:23:4c:68:c1:7e:bb:01:14:6f:c5:d9:6e:de: - bb:04:42:6a:f8:f6:5c:7d:e5:da:fa:87:eb:0d:35:52:67:d0: - 9e:97:76:05:93:3f:95:c7:01:e6:69:55:38:7f:10:61:99:c9: - e3:5f:a6:ca:3e:82:63:48:aa:e2:08:48:3e:aa:f2:b2:85:62: - a6:b4:a7:d9:bd:37:9c:68:b5:2d:56:7d:b0:b7:3f:a0:b1:07: - d6:e9:4f:dc:de:45:71:30:32:7f:1b:2e:09:f9:bf:52:a1:ee: - c2:80:3e:06:5c:2e:55:40:c1:1b:f5:70:45:b0:dc:5d:fa:f6: - 72:5a:77:d2:63:cd:cf:58:89:00:42:63:3f:79:39:d0:44:b0: - 82:6e:41:19:e8:dd:e0:c1:88:5a:d1:1e:71:93:1f:24:30:74: - e5:1e:a8:de:3c:27:37:7f:83:ae:9e:77:cf:f0:30:b1:ff:4b: - 99:e8:c6:a1 -MD5 Fingerprint=27:EC:39:47:CD:DA:5A:AF:E2:9A:01:65:21:A9:4C:BB -----BEGIN CERTIFICATE----- -MIIEHjCCAwagAwIBAgIBATANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJTRTEU -MBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFkZFRydXN0IFRUUCBOZXR3 -b3JrMSMwIQYDVQQDExpBZGRUcnVzdCBRdWFsaWZpZWQgQ0EgUm9vdDAeFw0wMDA1 -MzAxMDQ0NTBaFw0yMDA1MzAxMDQ0NTBaMGcxCzAJBgNVBAYTAlNFMRQwEgYDVQQK -EwtBZGRUcnVzdCBBQjEdMBsGA1UECxMUQWRkVHJ1c3QgVFRQIE5ldHdvcmsxIzAh -BgNVBAMTGkFkZFRydXN0IFF1YWxpZmllZCBDQSBSb290MIIBIjANBgkqhkiG9w0B -AQEFAAOCAQ8AMIIBCgKCAQEA5B6a/twJWoekn0e+EV+vhDTbYjx5eLfpMLXsDBwq -xBb/4Oxx64r1EW7tTw2R0hIYLUkVAcKkIhPHEWT/IhKauY5cLwjPcWqzZwFZ8V1G -87B4pfYOQnrjfxvM0PC3KP0q6p6zsLkEqv32x7SxuCqg+1jxGaBvcCV+PmlKfw8i -2O+tCBGaKZnhqkRFmhJePp1tUvznoD1oL/BLcHwTOK28FSXx1s6rosAx1i+f4P8U -WfyEk9mHfExUE+uf0S0R+Bg6Ot4l2ffTQO2kBhLEO+GRwVY18BTcZTYJbqukB8c1 -0cIDMzZbdSZtQvESa0NvS3GU+jQd7RNuyoB/mC9suWXY6QIDAQABo4HUMIHRMB0G -A1UdDgQWBBQ5lYtii1zJ1IC6WA+XPxUIQ8yYpzALBgNVHQ8EBAMCAQYwDwYDVR0T -AQH/BAUwAwEB/zCBkQYDVR0jBIGJMIGGgBQ5lYtii1zJ1IC6WA+XPxUIQ8yYp6Fr -pGkwZzELMAkGA1UEBhMCU0UxFDASBgNVBAoTC0FkZFRydXN0IEFCMR0wGwYDVQQL -ExRBZGRUcnVzdCBUVFAgTmV0d29yazEjMCEGA1UEAxMaQWRkVHJ1c3QgUXVhbGlm -aWVkIENBIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBABmrder4i2VhlRO6aQTv -hsoToMeqT2QbPxj2qC0sVY8FtzDqQmodwCVRLae/DLPt7wh/bDxGGuoYQ992zPlm -hpwsaPXpF/gxsxjE1kh9I0xowX67ARRvxdlu3rsEQmr49lx95dr6h+sNNVJn0J6X -dgWTP5XHAeZpVTh/EGGZyeNfpso+gmNIquIISD6q8rKFYqa0p9m9N5xotS1WfbC3 -P6CxB9bpT9zeRXEwMn8bLgn5v1Kh7sKAPgZcLlVAwRv1cEWw3F369nJad9Jjzc9Y -iQBCYz95OdBEsIJuQRno3eDBiFrRHnGTHyQwdOUeqN48Jzd/g66ed8/wMLH/S5no -xqE= ------END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 2b:68:d4:a3:46:9e:c5:3b:28:09:ab:38:5d:7f:27:20 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=VeriSign, Inc., OU=Class 1 Public Primary Certification Authority - Validity - Not Before: Aug 4 00:00:00 2000 GMT - Not After : Aug 3 23:59:59 2004 GMT - Subject: O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/RPA (c)00, CN=Class 1 Public Primary OCSP Responder - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:b9:ed:5e:7a:3a:77:5f:ce:5f:3a:52:fc:cd:64: - f7:71:b5:6f:6a:96:c6:59:92:55:94:5d:2f:5b:2e: - c1:11:ea:26:8a:cb:a7:81:3c:f6:5a:44:de:7a:13: - 2f:fd:5a:51:d9:7b:37:26:4a:c0:27:3f:04:03:6a: - 56:c1:83:2c:e1:6f:5b:a9:54:50:24:4a:c6:2e:7a: - 4c:a1:5b:37:54:24:21:31:1f:a1:78:18:76:a7:b1: - 70:da:22:d0:6a:fe:07:62:40:c6:f7:f6:9b:7d:0c: - 06:b8:4b:c7:28:e4:66:23:84:51:ef:46:b7:93:d8: - 81:33:cb:e5:36:ac:c6:e8:05 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Alternative Name: - DirName:/CN=OCSP 1-1 - X509v3 CRL Distribution Points: - URI:http://crl.verisign.com/pca1.crl - - X509v3 Extended Key Usage: - OCSP Signing - Authority Information Access: - OCSP - URI:http://ocsp.verisign.com/ocsp/status - - X509v3 Certificate Policies: - Policy: 2.16.840.1.113733.1.7.1.1 - CPS: https://www.verisign.com/RPA - - X509v3 Basic Constraints: - CA:FALSE - X509v3 Key Usage: - Digital Signature - Signature Algorithm: sha1WithRSAEncryption - 70:90:dd:b8:e4:be:53:17:7c:7f:02:e9:d5:f7:8b:99:93:31: - 60:8d:7e:e6:60:6b:24:ef:60:ac:d2:ce:91:de:80:6d:09:a4: - d3:b8:38:e5:44:ca:72:5e:0d:2d:c1:77:9c:bd:2c:03:78:29: - 8d:a4:a5:77:87:f5:f1:2b:26:ad:cc:07:6c:3a:54:5a:28:e0: - 09:f3:4d:0a:04:ca:d4:58:69:0b:a7:b3:f5:dd:01:a5:e7:dc: - f0:1f:ba:c1:5d:90:8d:b3:ea:4f:c1:11:59:97:6a:b2:2b:13: - b1:da:ad:97:a1:b3:b1:a0:20:5b:ca:32:ab:8d:cf:13:f0:1f: - 29:c3 -MD5 Fingerprint=7E:6F:3A:53:1B:7C:BE:B0:30:DB:43:1E:1E:94:89:B2 ------BEGIN CERTIFICATE----- -MIIDnjCCAwegAwIBAgIQK2jUo0aexTsoCas4XX8nIDANBgkqhkiG9w0BAQUFADBf -MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsT -LkNsYXNzIDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw -HhcNMDAwODA0MDAwMDAwWhcNMDQwODAzMjM1OTU5WjCBpzEXMBUGA1UEChMOVmVy -aVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5 -BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20v -UlBBIChjKTAwMS4wLAYDVQQDEyVDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IE9DU1Ag -UmVzcG9uZGVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC57V56Ondfzl86 -UvzNZPdxtW9qlsZZklWUXS9bLsER6iaKy6eBPPZaRN56Ey/9WlHZezcmSsAnPwQD -albBgyzhb1upVFAkSsYuekyhWzdUJCExH6F4GHansXDaItBq/gdiQMb39pt9DAa4 -S8co5GYjhFHvRreT2IEzy+U2rMboBQIDAQABo4IBEDCCAQwwIAYDVR0RBBkwF6QV -MBMxETAPBgNVBAMTCE9DU1AgMS0xMDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9j -cmwudmVyaXNpZ24uY29tL3BjYTEuY3JsMBMGA1UdJQQMMAoGCCsGAQUFBwMJMEIG -CCsGAQUFBwEBBDYwNDAyBggrBgEFBQcwAaYmFiRodHRwOi8vb2NzcC52ZXJpc2ln -bi5jb20vb2NzcC9zdGF0dXMwRAYDVR0gBD0wOzA5BgtghkgBhvhFAQcBATAqMCgG -CCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vUlBBMAkGA1UdEwQC -MAAwCwYDVR0PBAQDAgeAMA0GCSqGSIb3DQEBBQUAA4GBAHCQ3bjkvlMXfH8C6dX3 -i5mTMWCNfuZgayTvYKzSzpHegG0JpNO4OOVEynJeDS3Bd5y9LAN4KY2kpXeH9fEr -Jq3MB2w6VFoo4AnzTQoEytRYaQuns/XdAaXn3PAfusFdkI2z6k/BEVmXarIrE7Ha -rZehs7GgIFvKMquNzxPwHynD ------END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 09:46:17:e6:1d:d8:d4:1c:a0:0c:a0:62:e8:79:8a:a7 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=VeriSign, Inc., OU=Class 2 Public Primary Certification Authority - Validity - Not Before: Aug 1 00:00:00 2000 GMT - Not After : Jul 31 23:59:59 2004 GMT - Subject: O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/RPA (c)00, CN=Class 2 Public Primary OCSP Responder - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:d0:ca:63:31:61:7f:44:34:7c:05:7d:0b:3d:6a: - 90:cb:79:4b:77:0a:3f:4b:c7:23:e5:c0:62:2d:7e: - 9c:7e:3e:88:87:91:d0:ac:e8:4d:49:87:a2:96:90: - 8a:dd:04:a5:02:3f:8c:9b:e9:89:fe:62:a0:e2:5a: - bd:c8:dd:b4:78:e6:a5:42:93:08:67:01:c0:20:4d: - d7:5c:f4:5d:da:b3:e3:37:a6:52:1a:2c:4c:65:4d: - 8a:87:d9:a8:a3:f1:49:54:bb:3c:5c:80:51:68:c6: - fb:49:ff:0b:55:ab:15:dd:fb:9a:c1:b9:1d:74:0d: - b2:8c:44:5d:89:fc:9f:f9:83 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Alternative Name: - DirName:/CN=OCSP 1-2 - X509v3 CRL Distribution Points: - URI:http://crl.verisign.com/pca2.crl - - X509v3 Extended Key Usage: - OCSP Signing - Authority Information Access: - OCSP - URI:http://ocsp.verisign.com/ocsp/status - - X509v3 Certificate Policies: - Policy: 2.16.840.1.113733.1.7.1.1 - CPS: https://www.verisign.com/RPA - - X509v3 Basic Constraints: - CA:FALSE - X509v3 Key Usage: - Digital Signature - Signature Algorithm: sha1WithRSAEncryption - 1f:7d:09:6e:24:46:75:04:9c:f3:26:9b:e3:39:6e:17:ef:bc: - bd:a2:1b:d2:02:84:86:ab:d0:40:97:2c:c4:43:88:37:19:6b: - 22:a8:03:71:50:9d:20:dc:36:60:20:9a:73:2d:73:55:6c:58: - 9b:2c:c2:b4:34:2c:7a:33:42:ca:91:d9:e9:43:af:cf:1e:e0: - f5:c4:7a:ab:3f:72:63:1e:a9:37:e1:5b:3b:88:b3:13:86:82: - 90:57:cb:57:ff:f4:56:be:22:dd:e3:97:a8:e1:bc:22:43:c2: - dd:4d:db:f6:81:9e:92:14:9e:39:0f:13:54:de:82:d8:c0:5e: - 34:8d -MD5 Fingerprint=F3:45:BD:10:96:0D:85:4B:EF:9F:11:62:34:A7:5E:B5 ------BEGIN CERTIFICATE----- -MIIDnjCCAwegAwIBAgIQCUYX5h3Y1BygDKBi6HmKpzANBgkqhkiG9w0BAQUFADBf -MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsT -LkNsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw -HhcNMDAwODAxMDAwMDAwWhcNMDQwNzMxMjM1OTU5WjCBpzEXMBUGA1UEChMOVmVy -aVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5 -BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20v -UlBBIChjKTAwMS4wLAYDVQQDEyVDbGFzcyAyIFB1YmxpYyBQcmltYXJ5IE9DU1Ag -UmVzcG9uZGVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQymMxYX9ENHwF -fQs9apDLeUt3Cj9LxyPlwGItfpx+PoiHkdCs6E1Jh6KWkIrdBKUCP4yb6Yn+YqDi -Wr3I3bR45qVCkwhnAcAgTddc9F3as+M3plIaLExlTYqH2aij8UlUuzxcgFFoxvtJ -/wtVqxXd+5rBuR10DbKMRF2J/J/5gwIDAQABo4IBEDCCAQwwIAYDVR0RBBkwF6QV -MBMxETAPBgNVBAMTCE9DU1AgMS0yMDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9j -cmwudmVyaXNpZ24uY29tL3BjYTIuY3JsMBMGA1UdJQQMMAoGCCsGAQUFBwMJMEIG -CCsGAQUFBwEBBDYwNDAyBggrBgEFBQcwAaYmFiRodHRwOi8vb2NzcC52ZXJpc2ln -bi5jb20vb2NzcC9zdGF0dXMwRAYDVR0gBD0wOzA5BgtghkgBhvhFAQcBATAqMCgG -CCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vUlBBMAkGA1UdEwQC -MAAwCwYDVR0PBAQDAgeAMA0GCSqGSIb3DQEBBQUAA4GBAB99CW4kRnUEnPMmm+M5 -bhfvvL2iG9IChIar0ECXLMRDiDcZayKoA3FQnSDcNmAgmnMtc1VsWJsswrQ0LHoz -QsqR2elDr88e4PXEeqs/cmMeqTfhWzuIsxOGgpBXy1f/9Fa+It3jl6jhvCJDwt1N -2/aBnpIUnjkPE1TegtjAXjSN ------END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 2e:96:9e:bf:b6:62:6c:ec:7b:e9:73:cc:e3:6c:c1:84 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority - Validity - Not Before: Aug 4 00:00:00 2000 GMT - Not After : Aug 3 23:59:59 2004 GMT - Subject: O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/RPA (c)00, CN=Class 3 Public Primary OCSP Responder - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:f1:e4:08:0e:83:bb:75:e3:48:e5:b8:db:a6:f0: - b9:ab:e9:3c:62:c7:5e:35:5b:d0:02:54:11:d8:c9: - d1:56:b9:76:4b:b9:ab:7a:e6:cd:ba:f6:0c:04:d6: - 7e:d6:b0:0a:65:ac:4e:39:e3:f1:f7:2d:a3:25:39: - ef:b0:8b:cf:be:db:0c:5d:6e:70:f4:07:cd:70:f7: - 3a:c0:3e:35:16:ed:78:8c:43:cf:c2:26:2e:47:d6: - 86:7d:9c:f1:be:d6:67:0c:22:25:a4:ca:65:e6:1f: - 7a:78:28:2f:3f:05:db:04:21:bf:e1:45:66:fe:3c: - b7:82:ed:5a:b8:16:15:b9:55 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Alternative Name: - DirName:/CN=OCSP 1-3 - X509v3 CRL Distribution Points: - URI:http://crl.verisign.com/pca3.1.1.crl - - X509v3 Extended Key Usage: - OCSP Signing - Authority Information Access: - OCSP - URI:http://ocsp.verisign.com/ocsp/status - - X509v3 Certificate Policies: - Policy: 2.16.840.1.113733.1.7.1.1 - CPS: https://www.verisign.com/RPA - - X509v3 Basic Constraints: - CA:FALSE - X509v3 Key Usage: - Digital Signature - Signature Algorithm: sha1WithRSAEncryption - 02:f6:53:63:c0:a9:1e:f2:d0:8b:33:30:8f:48:9b:4c:b0:56: - b4:83:71:4a:be:dc:50:d8:f5:b6:e0:0b:db:bd:78:4f:e9:cf: - 09:34:da:29:49:9d:01:73:5a:91:91:82:54:2c:13:0a:d3:77: - 23:cf:37:fc:63:de:a7:e3:f6:b7:b5:69:45:28:49:c3:91:dc: - aa:47:1c:a9:88:99:2c:05:2a:8d:8d:8a:fa:62:e2:5a:b7:00: - 20:5d:39:c4:28:c2:cb:fc:9e:a8:89:ae:5b:3d:8e:12:ea:32: - b2:fc:eb:14:d7:09:15:1a:c0:cd:1b:d5:b5:15:4e:41:d5:96: - e3:4e -MD5 Fingerprint=7D:51:92:C9:76:83:98:16:DE:8C:B3:86:C4:7D:66:FB ------BEGIN CERTIFICATE----- -MIIDojCCAwugAwIBAgIQLpaev7ZibOx76XPM42zBhDANBgkqhkiG9w0BAQUFADBf -MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsT -LkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw -HhcNMDAwODA0MDAwMDAwWhcNMDQwODAzMjM1OTU5WjCBpzEXMBUGA1UEChMOVmVy -aVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5 -BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20v -UlBBIChjKTAwMS4wLAYDVQQDEyVDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IE9DU1Ag -UmVzcG9uZGVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDx5AgOg7t140jl -uNum8Lmr6Txix141W9ACVBHYydFWuXZLuat65s269gwE1n7WsAplrE454/H3LaMl -Oe+wi8++2wxdbnD0B81w9zrAPjUW7XiMQ8/CJi5H1oZ9nPG+1mcMIiWkymXmH3p4 -KC8/BdsEIb/hRWb+PLeC7Vq4FhW5VQIDAQABo4IBFDCCARAwIAYDVR0RBBkwF6QV -MBMxETAPBgNVBAMTCE9DU1AgMS0zMDUGA1UdHwQuMCwwKqAooCaGJGh0dHA6Ly9j -cmwudmVyaXNpZ24uY29tL3BjYTMuMS4xLmNybDATBgNVHSUEDDAKBggrBgEFBQcD -CTBCBggrBgEFBQcBAQQ2MDQwMgYIKwYBBQUHMAGmJhYkaHR0cDovL29jc3AudmVy -aXNpZ24uY29tL29jc3Avc3RhdHVzMEQGA1UdIAQ9MDswOQYLYIZIAYb4RQEHAQEw -KjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL1JQQTAJBgNV -HRMEAjAAMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQUFAAOBgQAC9lNjwKke8tCL -MzCPSJtMsFa0g3FKvtxQ2PW24AvbvXhP6c8JNNopSZ0Bc1qRkYJULBMK03cjzzf8 -Y96n4/a3tWlFKEnDkdyqRxypiJksBSqNjYr6YuJatwAgXTnEKMLL/J6oia5bPY4S -6jKy/OsU1wkVGsDNG9W1FU5B1ZbjTg== +MIIH6jCCB1OgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCARIxCzAJBgNVBAYTAkVT +MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE +ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE +ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjEuMCwGA1UECxMl +SVBTIENBIENMQVNFMSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEuMCwGA1UEAxMl +SVBTIENBIENMQVNFMSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEeMBwGCSqGSIb3 +DQEJARYPaXBzQG1haWwuaXBzLmVzMB4XDTAxMTIyOTAwNTkzOFoXDTI1MTIyNzAw +NTkzOFowggESMQswCQYDVQQGEwJFUzESMBAGA1UECBMJQmFyY2Vsb25hMRIwEAYD +VQQHEwlCYXJjZWxvbmExLjAsBgNVBAoTJUlQUyBJbnRlcm5ldCBwdWJsaXNoaW5n +IFNlcnZpY2VzIHMubC4xKzApBgNVBAoUImlwc0BtYWlsLmlwcy5lcyBDLkkuRi4g +IEItNjA5Mjk0NTIxLjAsBgNVBAsTJUlQUyBDQSBDTEFTRTEgQ2VydGlmaWNhdGlv +biBBdXRob3JpdHkxLjAsBgNVBAMTJUlQUyBDQSBDTEFTRTEgQ2VydGlmaWNhdGlv +biBBdXRob3JpdHkxHjAcBgkqhkiG9w0BCQEWD2lwc0BtYWlsLmlwcy5lczCBnzAN +BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA4FEnpwvdr9G5Q1uCN0VWcu+atsIS7ywS +zHb5BlmvXSHU0lq4oNTzav3KaY1mSPd05u42veiWkXWmcSjK5yISMmmwPh5r9FBS +YmL9Yzt9fuzuOOpi9GyocY3h6YvJP8a1zZRCb92CRTzo3wno7wpVqVZHYUxJZHMQ +KD/Kvwn/xi8CAwEAAaOCBEowggRGMB0GA1UdDgQWBBTrsxl588GlHKzcuh9morKb +adB4CDCCAUQGA1UdIwSCATswggE3gBTrsxl588GlHKzcuh9morKbadB4CKGCARqk +ggEWMIIBEjELMAkGA1UEBhMCRVMxEjAQBgNVBAgTCUJhcmNlbG9uYTESMBAGA1UE +BxMJQmFyY2Vsb25hMS4wLAYDVQQKEyVJUFMgSW50ZXJuZXQgcHVibGlzaGluZyBT +ZXJ2aWNlcyBzLmwuMSswKQYDVQQKFCJpcHNAbWFpbC5pcHMuZXMgQy5JLkYuICBC +LTYwOTI5NDUyMS4wLAYDVQQLEyVJUFMgQ0EgQ0xBU0UxIENlcnRpZmljYXRpb24g +QXV0aG9yaXR5MS4wLAYDVQQDEyVJUFMgQ0EgQ0xBU0UxIENlcnRpZmljYXRpb24g +QXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOCAQAwDAYD +VR0TBAUwAwEB/zAMBgNVHQ8EBQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUFBwMBBggr +BgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYBBAGCNwIB +FQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYKKwYBBAGCNwoDBDARBglghkgBhvhC +AQEEBAMCAAcwGgYDVR0RBBMwEYEPaXBzQG1haWwuaXBzLmVzMBoGA1UdEgQTMBGB +D2lwc0BtYWlsLmlwcy5lczBBBglghkgBhvhCAQ0ENBYyQ0xBU0UxIENBIENlcnRp +ZmljYXRlIGlzc3VlZCBieSBodHRwOi8vd3d3Lmlwcy5lcy8wKQYJYIZIAYb4QgEC +BBwWGmh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvMDoGCWCGSAGG+EIBBAQtFito +dHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL2lwczIwMDJDTEFTRTEuY3JsMD8GCWCG +SAGG+EIBAwQyFjBodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL3Jldm9jYXRpb25D +TEFTRTEuaHRtbD8wPAYJYIZIAYb4QgEHBC8WLWh0dHA6Ly93d3cuaXBzLmVzL2lw +czIwMDIvcmVuZXdhbENMQVNFMS5odG1sPzA6BglghkgBhvhCAQgELRYraHR0cDov +L3d3dy5pcHMuZXMvaXBzMjAwMi9wb2xpY3lDTEFTRTEuaHRtbDBzBgNVHR8EbDBq +MDGgL6AthitodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL2lwczIwMDJDTEFTRTEu +Y3JsMDWgM6Axhi9odHRwOi8vd3d3YmFjay5pcHMuZXMvaXBzMjAwMi9pcHMyMDAy +Q0xBU0UxLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9v +Y3NwLmlwcy5lcy8wDQYJKoZIhvcNAQEFBQADgYEAK9Dr/drIyllq2tPMMi7JVBuK +Yn4VLenZMdMu9Ccj/1urxUq2ckCuU3T0vAW0xtnIyXf7t/k0f3gA+Nak5FI/LEpj +V4F1Wo7ojPsCwJTGKbqz3Bzosq/SLmJbGqmODszFV0VRFOlOHIilkfSj945RyKm+ +hjM+5i9Ibq9UkE6tsSU= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - ff:45:d5:27:5d:24:fb:b3:c2:39:24:53:57:e1:4f:de - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=RSA Data Security, Inc., OU=Secure Server Certification Authority - Validity - Not Before: Aug 4 00:00:00 2000 GMT - Not After : Aug 3 23:59:59 2004 GMT - Subject: O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/RPA (c)00, CN=Secure Server OCSP Responder - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:b8:51:99:64:85:0e:ee:b3:0a:68:f0:bf:63:76: - 1d:53:f5:fc:a1:78:8c:33:ee:9f:f4:be:39:da:9b: - 0f:4d:47:a9:8f:20:e8:4b:44:bd:ce:cd:7b:90:d1: - 30:e8:90:c4:25:7b:89:28:de:bd:f6:93:1d:ff:b9: - ff:92:b5:a9:8d:e4:ae:cc:e2:c3:07:83:6a:a3:72: - 10:01:27:62:22:a6:35:26:39:2d:9e:cf:60:0c:fc: - 47:a4:d7:d0:42:78:a7:1d:6c:d0:cb:4f:15:a7:29: - 0a:b4:95:45:c4:b1:e7:5a:09:d7:39:95:d8:1d:35: - 9e:c2:bd:b3:5d:c1:0c:4b:1f - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Alternative Name: - DirName:/CN=OCSP 1-4 - X509v3 CRL Distribution Points: - URI:http://crl.verisign.com/RSASecureServer-p.crl - - X509v3 Extended Key Usage: - OCSP Signing - Authority Information Access: - OCSP - URI:http://ocsp.verisign.com/ocsp/status - - X509v3 Certificate Policies: - Policy: 2.16.840.1.113733.1.7.1.1 - CPS: https://www.verisign.com/RPA - - X509v3 Basic Constraints: - CA:FALSE - X509v3 Key Usage: - Digital Signature - Signature Algorithm: sha1WithRSAEncryption - 00:b3:10:53:66:9c:49:93:2e:31:a0:02:42:d2:58:57:7e:66: - a1:fe:1b:8a:61:18:50:40:2c:1e:2b:41:a5:d6:db:ff:ac:08: - 1c:5a:05:6d:02:5c:2a:b6:96:4f:47:db:be:4e:db:ce:cc:ba: - 86:b8:18:ce:b1:12:91:5f:63:f7:f3:48:3e:cc:f1:4d:13:e4: - 6d:09:94:78:00:92:cb:a3:20:9d:06:0b:6a:a0:43:07:ce:d1: - 19:6c:8f:18:75:9a:9f:17:33:fd:a9:26:b8:e3:e2:de:c2:a8: - c4:5a:8a:7f:98:d6:07:06:6b:cc:56:9e:86:70:ce:d4:ef -MD5 Fingerprint=2C:62:C3:D8:80:01:16:09:EA:59:EA:78:AB:10:43:F6 ------BEGIN CERTIFICATE----- -MIIDnzCCAwygAwIBAgIRAP9F1SddJPuzwjkkU1fhT94wDQYJKoZIhvcNAQEFBQAw -XzELMAkGA1UEBhMCVVMxIDAeBgNVBAoTF1JTQSBEYXRhIFNlY3VyaXR5LCBJbmMu -MS4wLAYDVQQLEyVTZWN1cmUgU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5 -MB4XDTAwMDgwNDAwMDAwMFoXDTA0MDgwMzIzNTk1OVowgZ4xFzAVBgNVBAoTDlZl -cmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTsw -OQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29t -L1JQQSAoYykwMDElMCMGA1UEAxMcU2VjdXJlIFNlcnZlciBPQ1NQIFJlc3BvbmRl -cjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAuFGZZIUO7rMKaPC/Y3YdU/X8 -oXiMM+6f9L452psPTUepjyDoS0S9zs17kNEw6JDEJXuJKN699pMd/7n/krWpjeSu -zOLDB4Nqo3IQASdiIqY1Jjktns9gDPxHpNfQQninHWzQy08VpykKtJVFxLHnWgnX -OZXYHTWewr2zXcEMSx8CAwEAAaOCAR0wggEZMCAGA1UdEQQZMBekFTATMREwDwYD -VQQDEwhPQ1NQIDEtNDA+BgNVHR8ENzA1MDOgMaAvhi1odHRwOi8vY3JsLnZlcmlz -aWduLmNvbS9SU0FTZWN1cmVTZXJ2ZXItcC5jcmwwEwYDVR0lBAwwCgYIKwYBBQUH -AwkwQgYIKwYBBQUHAQEENjA0MDIGCCsGAQUFBzABpiYWJGh0dHA6Ly9vY3NwLnZl -cmlzaWduLmNvbS9vY3NwL3N0YXR1czBEBgNVHSAEPTA7MDkGC2CGSAGG+EUBBwEB -MCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9SUEEwCQYD -VR0TBAIwADALBgNVHQ8EBAMCB4AwDQYJKoZIhvcNAQEFBQADfgAAsxBTZpxJky4x -oAJC0lhXfmah/huKYRhQQCweK0Gl1tv/rAgcWgVtAlwqtpZPR9u+TtvOzLqGuBjO -sRKRX2P380g+zPFNE+RtCZR4AJLLoyCdBgtqoEMHztEZbI8YdZqfFzP9qSa44+Le -wqjEWop/mNYHBmvMVp6GcM7U7w== +-----BEGIN CERTIFICATE----- +MIIH6jCCB1OgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCARIxCzAJBgNVBAYTAkVT +MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE +ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE +ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjEuMCwGA1UECxMl +SVBTIENBIENMQVNFMyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEuMCwGA1UEAxMl +SVBTIENBIENMQVNFMyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEeMBwGCSqGSIb3 +DQEJARYPaXBzQG1haWwuaXBzLmVzMB4XDTAxMTIyOTAxMDE0NFoXDTI1MTIyNzAx +MDE0NFowggESMQswCQYDVQQGEwJFUzESMBAGA1UECBMJQmFyY2Vsb25hMRIwEAYD +VQQHEwlCYXJjZWxvbmExLjAsBgNVBAoTJUlQUyBJbnRlcm5ldCBwdWJsaXNoaW5n +IFNlcnZpY2VzIHMubC4xKzApBgNVBAoUImlwc0BtYWlsLmlwcy5lcyBDLkkuRi4g +IEItNjA5Mjk0NTIxLjAsBgNVBAsTJUlQUyBDQSBDTEFTRTMgQ2VydGlmaWNhdGlv +biBBdXRob3JpdHkxLjAsBgNVBAMTJUlQUyBDQSBDTEFTRTMgQ2VydGlmaWNhdGlv +biBBdXRob3JpdHkxHjAcBgkqhkiG9w0BCQEWD2lwc0BtYWlsLmlwcy5lczCBnzAN +BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAqxf+DrDGaBtT8FK+n/ra+osTBLsBjzLZ +H49NzjaY2uQARIwo2BNEKqRrThckQpzTiKRBgtYj+4vJhuW5qYIF3PHeH+AMmVWY +8jjsbJ0gA8DvqqPGZARRLXgNo9KoOtYkTOmWehisEyMiG3zoMRGzXwmqMHBxRiVr +SXGAK5UBsh8CAwEAAaOCBEowggRGMB0GA1UdDgQWBBS4k/8uy9wsjqLnev42USGj +mFsMNDCCAUQGA1UdIwSCATswggE3gBS4k/8uy9wsjqLnev42USGjmFsMNKGCARqk +ggEWMIIBEjELMAkGA1UEBhMCRVMxEjAQBgNVBAgTCUJhcmNlbG9uYTESMBAGA1UE +BxMJQmFyY2Vsb25hMS4wLAYDVQQKEyVJUFMgSW50ZXJuZXQgcHVibGlzaGluZyBT +ZXJ2aWNlcyBzLmwuMSswKQYDVQQKFCJpcHNAbWFpbC5pcHMuZXMgQy5JLkYuICBC +LTYwOTI5NDUyMS4wLAYDVQQLEyVJUFMgQ0EgQ0xBU0UzIENlcnRpZmljYXRpb24g +QXV0aG9yaXR5MS4wLAYDVQQDEyVJUFMgQ0EgQ0xBU0UzIENlcnRpZmljYXRpb24g +QXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOCAQAwDAYD +VR0TBAUwAwEB/zAMBgNVHQ8EBQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUFBwMBBggr +BgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYBBAGCNwIB +FQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYKKwYBBAGCNwoDBDARBglghkgBhvhC +AQEEBAMCAAcwGgYDVR0RBBMwEYEPaXBzQG1haWwuaXBzLmVzMBoGA1UdEgQTMBGB +D2lwc0BtYWlsLmlwcy5lczBBBglghkgBhvhCAQ0ENBYyQ0xBU0UzIENBIENlcnRp +ZmljYXRlIGlzc3VlZCBieSBodHRwOi8vd3d3Lmlwcy5lcy8wKQYJYIZIAYb4QgEC +BBwWGmh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvMDoGCWCGSAGG+EIBBAQtFito +dHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL2lwczIwMDJDTEFTRTMuY3JsMD8GCWCG +SAGG+EIBAwQyFjBodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL3Jldm9jYXRpb25D +TEFTRTMuaHRtbD8wPAYJYIZIAYb4QgEHBC8WLWh0dHA6Ly93d3cuaXBzLmVzL2lw +czIwMDIvcmVuZXdhbENMQVNFMy5odG1sPzA6BglghkgBhvhCAQgELRYraHR0cDov +L3d3dy5pcHMuZXMvaXBzMjAwMi9wb2xpY3lDTEFTRTMuaHRtbDBzBgNVHR8EbDBq +MDGgL6AthitodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL2lwczIwMDJDTEFTRTMu +Y3JsMDWgM6Axhi9odHRwOi8vd3d3YmFjay5pcHMuZXMvaXBzMjAwMi9pcHMyMDAy +Q0xBU0UzLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9v +Y3NwLmlwcy5lcy8wDQYJKoZIhvcNAQEFBQADgYEAF2VcmZVDAyevJuXr0LMXI/dD +qsfwfewPxqmurpYPdikc4gYtfibFPPqhwYHOU7BC0ZdXGhd+pFFhxu7pXu8Fuuu9 +D6eSb9ijBmgpjnn1/7/5p6/ksc7C0YBCJwUENPjDfxZ4IwwHJPJGR607VNCv1TGy +r33I6unUVtkOE7LFRVA= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 53:61:b2:60:ae:db:71:8e:a7:94:b3:13:33:f4:07:09 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network - Validity - Not Before: Sep 26 00:00:00 2000 GMT - Not After : Sep 25 23:59:59 2010 GMT - Subject: O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)00, CN=VeriSign Time Stamping Authority CA - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:d2:19:9d:67:c2:00:21:59:62:ce:b4:09:22:44: - 69:8a:f8:25:5a:db:ed:0d:b7:36:7e:4e:e0:bb:94: - 3e:90:25:87:c2:61:47:29:d9:bd:54:b8:63:cc:2c: - 7d:69:b4:33:36:f4:37:07:9a:c1:dd:40:54:fc:e0: - 78:9d:a0:93:b9:09:3d:23:51:7f:44:c2:14:74:db: - 0a:be:cb:c9:30:34:40:98:3e:d0:d7:25:10:81:94: - bd:07:4f:9c:d6:54:27:df:2e:a8:bf:cb:90:8c:8d: - 75:4b:bc:e2:e8:44:87:cd:e6:41:0a:25:6e:e8:f4: - 24:02:c5:52:0f:6e:ec:98:75 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: - CA:TRUE, pathlen:0 - X509v3 Certificate Policies: - Policy: 2.16.840.1.113733.1.7.23.1.3 - CPS: https://www.verisign.com/rpa - - X509v3 CRL Distribution Points: - URI:http://crl.verisign.com/pca3.crl - - X509v3 Key Usage: - Certificate Sign, CRL Sign - Authority Information Access: - OCSP - URI:http://ocsp.verisign.com/ocsp/status - - Signature Algorithm: sha1WithRSAEncryption - 82:70:68:95:df:b6:0d:c2:01:70:19:4a:d2:54:56:1e:ac:f2: - 45:4c:87:b8:f5:35:eb:78:4b:05:a9:c8:9d:3b:19:21:2e:70: - 34:4a:a2:f5:89:e0:15:75:45:e7:28:37:00:34:27:29:e8:37: - 4b:f2:ef:44:97:6b:17:51:1a:c3:56:9d:3c:1a:8a:f6:4a:46: - 46:37:8c:fa:cb:f5:64:5a:38:68:2e:1c:c3:ef:70:ce:b8:46: - 06:16:bf:f7:7e:e7:b5:a8:3e:45:ac:a9:25:75:22:7b:6f:3f: - b0:9c:94:e7:c7:73:ab:ac:1f:ee:25:9b:c0:16:ed:b7:ca:5b: - f0:14 -MD5 Fingerprint=89:49:54:8C:C8:68:9A:83:29:EC:DC:06:73:21:AB:97 -----BEGIN CERTIFICATE----- -MIIDzTCCAzagAwIBAgIQU2GyYK7bcY6nlLMTM/QHCTANBgkqhkiG9w0BAQUFADCB -wTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTwwOgYDVQQL -EzNDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5 -IC0gRzIxOjA4BgNVBAsTMShjKSAxOTk4IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1 -dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdv -cmswHhcNMDAwOTI2MDAwMDAwWhcNMTAwOTI1MjM1OTU5WjCBpTEXMBUGA1UEChMO -VmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsx -OzA5BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5j -b20vcnBhIChjKTAwMSwwKgYDVQQDEyNWZXJpU2lnbiBUaW1lIFN0YW1waW5nIEF1 -dGhvcml0eSBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0hmdZ8IAIVli -zrQJIkRpivglWtvtDbc2fk7gu5Q+kCWHwmFHKdm9VLhjzCx9abQzNvQ3B5rB3UBU -/OB4naCTuQk9I1F/RMIUdNsKvsvJMDRAmD7Q1yUQgZS9B0+c1lQn3y6ov8uQjI11 -S7zi6ESHzeZBCiVu6PQkAsVSD27smHUCAwEAAaOB3zCB3DAPBgNVHRMECDAGAQH/ -AgEAMEUGA1UdIAQ+MDwwOgYMYIZIAYb4RQEHFwEDMCowKAYIKwYBBQUHAgEWHGh0 -dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEwMQYDVR0fBCowKDAmoCSgIoYgaHR0 -cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMy5jcmwwCwYDVR0PBAQDAgEGMEIGCCsG -AQUFBwEBBDYwNDAyBggrBgEFBQcwAaYmFiRodHRwOi8vb2NzcC52ZXJpc2lnbi5j -b20vb2NzcC9zdGF0dXMwDQYJKoZIhvcNAQEFBQADgYEAgnBold+2DcIBcBlK0lRW -HqzyRUyHuPU163hLBanInTsZIS5wNEqi9YngFXVF5yg3ADQnKeg3S/LvRJdrF1Ea -w1adPBqK9kpGRjeM+sv1ZFo4aC4cw+9wzrhGBha/937ntag+RaypJXUie28/sJyU -58dzq6wf7iWbwBbtt8pb8BQ= +MIIH9zCCB2CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCARQxCzAJBgNVBAYTAkVT +MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE +ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE +ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjEvMC0GA1UECxMm +SVBTIENBIENMQVNFQTEgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxLzAtBgNVBAMT +JklQUyBDQSBDTEFTRUExIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MR4wHAYJKoZI +hvcNAQkBFg9pcHNAbWFpbC5pcHMuZXMwHhcNMDExMjI5MDEwNTMyWhcNMjUxMjI3 +MDEwNTMyWjCCARQxCzAJBgNVBAYTAkVTMRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQ +BgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UEChMlSVBTIEludGVybmV0IHB1Ymxpc2hp +bmcgU2VydmljZXMgcy5sLjErMCkGA1UEChQiaXBzQG1haWwuaXBzLmVzIEMuSS5G +LiAgQi02MDkyOTQ1MjEvMC0GA1UECxMmSVBTIENBIENMQVNFQTEgQ2VydGlmaWNh +dGlvbiBBdXRob3JpdHkxLzAtBgNVBAMTJklQUyBDQSBDTEFTRUExIENlcnRpZmlj +YXRpb24gQXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXMw +gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALsw19zQVL01Tp/FTILq0VA8R5j8 +m2mdd81u4D/u6zJfX5/S0HnllXNEITLgCtud186Nq1KLK3jgm1t99P1tCeWu4Wwd +ByOgF9H5fahGRpEiqLJpxq339fWUoTCUvQDMRH/uxJ7JweaPCjbB/SQ9AaD1e+J8 +eGZDi09Z8pvZ+kmzAgMBAAGjggRTMIIETzAdBgNVHQ4EFgQUZyaW56G/2LUDnf47 +3P7yiuYV3TAwggFGBgNVHSMEggE9MIIBOYAUZyaW56G/2LUDnf473P7yiuYV3TCh +ggEcpIIBGDCCARQxCzAJBgNVBAYTAkVTMRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQ +BgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UEChMlSVBTIEludGVybmV0IHB1Ymxpc2hp +bmcgU2VydmljZXMgcy5sLjErMCkGA1UEChQiaXBzQG1haWwuaXBzLmVzIEMuSS5G +LiAgQi02MDkyOTQ1MjEvMC0GA1UECxMmSVBTIENBIENMQVNFQTEgQ2VydGlmaWNh +dGlvbiBBdXRob3JpdHkxLzAtBgNVBAMTJklQUyBDQSBDTEFTRUExIENlcnRpZmlj +YXRpb24gQXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOC +AQAwDAYDVR0TBAUwAwEB/zAMBgNVHQ8EBQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUF +BwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYB +BAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYKKwYBBAGCNwoDBDARBglg +hkgBhvhCAQEEBAMCAAcwGgYDVR0RBBMwEYEPaXBzQG1haWwuaXBzLmVzMBoGA1Ud +EgQTMBGBD2lwc0BtYWlsLmlwcy5lczBCBglghkgBhvhCAQ0ENRYzQ0xBU0VBMSBD +QSBDZXJ0aWZpY2F0ZSBpc3N1ZWQgYnkgaHR0cDovL3d3dy5pcHMuZXMvMCkGCWCG +SAGG+EIBAgQcFhpodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyLzA7BglghkgBhvhC +AQQELhYsaHR0cDovL3d3dy5pcHMuZXMvaXBzMjAwMi9pcHMyMDAyQ0xBU0VBMS5j +cmwwQAYJYIZIAYb4QgEDBDMWMWh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvcmV2 +b2NhdGlvbkNMQVNFQTEuaHRtbD8wPQYJYIZIAYb4QgEHBDAWLmh0dHA6Ly93d3cu +aXBzLmVzL2lwczIwMDIvcmVuZXdhbENMQVNFQTEuaHRtbD8wOwYJYIZIAYb4QgEI +BC4WLGh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvcG9saWN5Q0xBU0VBMS5odG1s +MHUGA1UdHwRuMGwwMqAwoC6GLGh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvaXBz +MjAwMkNMQVNFQTEuY3JsMDagNKAyhjBodHRwOi8vd3d3YmFjay5pcHMuZXMvaXBz +MjAwMi9pcHMyMDAyQ0xBU0VBMS5jcmwwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUF +BzABhhNodHRwOi8vb2NzcC5pcHMuZXMvMA0GCSqGSIb3DQEBBQUAA4GBAH66iqyA +AIQVCtWYUQxkxZwCWINmyq0eB81+atqAB98DNEock8RLWCA1NnHtogo1EqWmZaeF +aQoO42Hu6r4okzPV7Oi+xNtff6j5YzHIa5biKcJboOeXNp13XjFr/tOn2yrb25aL +H2betgPAK7N41lUH5Y85UN4HI3LmvSAUS7SG -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA - Validity - Not Before: Jan 1 00:00:00 1997 GMT - Not After : Dec 31 23:59:59 2020 GMT - Subject: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:d6:2b:58:78:61:45:86:53:ea:34:7b:51:9c:ed: - b0:e6:2e:18:0e:fe:e0:5f:a8:27:d3:b4:c9:e0:7c: - 59:4e:16:0e:73:54:60:c1:7f:f6:9f:2e:e9:3a:85: - 24:15:3c:db:47:04:63:c3:9e:c4:94:1a:5a:df:4c: - 7a:f3:d9:43:1d:3c:10:7a:79:25:db:90:fe:f0:51: - e7:30:d6:41:00:fd:9f:28:df:79:be:94:bb:9d:b6: - 14:e3:23:85:d7:a9:41:e0:4c:a4:79:b0:2b:1a:8b: - f2:f8:3b:8a:3e:45:ac:71:92:00:b4:90:41:98:fb: - 5f:ed:fa:b7:2e:8a:f8:88:37 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - Signature Algorithm: md5WithRSAEncryption - 67:db:e2:c2:e6:87:3d:40:83:86:37:35:7d:1f:ce:9a:c3:0c: - 66:20:a8:ba:aa:04:89:86:c2:f5:10:08:0d:bf:cb:a2:05:8a: - d0:4d:36:3e:f4:d7:ef:69:c6:5e:e4:b0:94:6f:4a:b9:e7:de: - 5b:88:b6:7b:db:e3:27:e5:76:c3:f0:35:c1:cb:b5:27:9b:33: - 79:dc:90:a6:00:9e:77:fa:fc:cd:27:94:42:16:9c:d3:1c:68: - ec:bf:5c:dd:e5:a9:7b:10:0a:32:74:54:13:31:8b:85:03:84: - 91:b7:58:01:30:14:38:af:28:ca:fc:b1:50:19:19:09:ac:89: - 49:d3 -MD5 Fingerprint=7F:66:7A:71:D3:EB:69:78:20:9A:51:14:9D:83:DA:20 -----BEGIN CERTIFICATE----- -MIICoTCCAgqgAwIBAgIBADANBgkqhkiG9w0BAQQFADCBizELMAkGA1UEBhMCWkEx -FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTEUMBIGA1UEBxMLRHVyYmFudmlsbGUxDzAN -BgNVBAoTBlRoYXd0ZTEdMBsGA1UECxMUVGhhd3RlIENlcnRpZmljYXRpb24xHzAd -BgNVBAMTFlRoYXd0ZSBUaW1lc3RhbXBpbmcgQ0EwHhcNOTcwMTAxMDAwMDAwWhcN -MjAxMjMxMjM1OTU5WjCBizELMAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4g -Q2FwZTEUMBIGA1UEBxMLRHVyYmFudmlsbGUxDzANBgNVBAoTBlRoYXd0ZTEdMBsG -A1UECxMUVGhhd3RlIENlcnRpZmljYXRpb24xHzAdBgNVBAMTFlRoYXd0ZSBUaW1l -c3RhbXBpbmcgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANYrWHhhRYZT -6jR7UZztsOYuGA7+4F+oJ9O0yeB8WU4WDnNUYMF/9p8u6TqFJBU820cEY8OexJQa -Wt9MevPZQx08EHp5JduQ/vBR5zDWQQD9nyjfeb6Uu522FOMjhdepQeBMpHmwKxqL -8vg7ij5FrHGSALSQQZj7X+36ty6K+Ig3AgMBAAGjEzARMA8GA1UdEwEB/wQFMAMB -Af8wDQYJKoZIhvcNAQEEBQADgYEAZ9viwuaHPUCDhjc1fR/OmsMMZiCouqoEiYbC -9RAIDb/LogWK0E02PvTX72nGXuSwlG9KuefeW4i2e9vjJ+V2w/A1wcu1J5szedyQ -pgCed/r8zSeUQhac0xxo7L9c3eWpexAKMnRUEzGLhQOEkbdYATAUOK8oyvyxUBkZ -CayJSdM= +MIIH9zCCB2CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCARQxCzAJBgNVBAYTAkVT +MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE +ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE +ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjEvMC0GA1UECxMm +SVBTIENBIENMQVNFQTMgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxLzAtBgNVBAMT +JklQUyBDQSBDTEFTRUEzIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MR4wHAYJKoZI +hvcNAQkBFg9pcHNAbWFpbC5pcHMuZXMwHhcNMDExMjI5MDEwNzUwWhcNMjUxMjI3 +MDEwNzUwWjCCARQxCzAJBgNVBAYTAkVTMRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQ +BgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UEChMlSVBTIEludGVybmV0IHB1Ymxpc2hp +bmcgU2VydmljZXMgcy5sLjErMCkGA1UEChQiaXBzQG1haWwuaXBzLmVzIEMuSS5G +LiAgQi02MDkyOTQ1MjEvMC0GA1UECxMmSVBTIENBIENMQVNFQTMgQ2VydGlmaWNh +dGlvbiBBdXRob3JpdHkxLzAtBgNVBAMTJklQUyBDQSBDTEFTRUEzIENlcnRpZmlj +YXRpb24gQXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXMw +gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAO6AAPYaZC6tasiDsYun7o/ZttvN +G7uGBiJ2MwwSbUhWYdLcgiViL5/SaTBlA0IjWLxH3GvWdV0XPOH/8lhneaDBgbHU +VqLyjRGZ/fZ98cfEXgIqmuJKtROKAP2Md4bm15T1IHUuDky/dMQ/gT6DtKM4Ninn +6Cr1jIhBqoCm42zvAgMBAAGjggRTMIIETzAdBgNVHQ4EFgQUHp9XUEe2YZM50yz8 +2l09BXW3mQIwggFGBgNVHSMEggE9MIIBOYAUHp9XUEe2YZM50yz82l09BXW3mQKh +ggEcpIIBGDCCARQxCzAJBgNVBAYTAkVTMRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQ +BgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UEChMlSVBTIEludGVybmV0IHB1Ymxpc2hp +bmcgU2VydmljZXMgcy5sLjErMCkGA1UEChQiaXBzQG1haWwuaXBzLmVzIEMuSS5G +LiAgQi02MDkyOTQ1MjEvMC0GA1UECxMmSVBTIENBIENMQVNFQTMgQ2VydGlmaWNh +dGlvbiBBdXRob3JpdHkxLzAtBgNVBAMTJklQUyBDQSBDTEFTRUEzIENlcnRpZmlj +YXRpb24gQXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOC +AQAwDAYDVR0TBAUwAwEB/zAMBgNVHQ8EBQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUF +BwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYB +BAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYKKwYBBAGCNwoDBDARBglg +hkgBhvhCAQEEBAMCAAcwGgYDVR0RBBMwEYEPaXBzQG1haWwuaXBzLmVzMBoGA1Ud +EgQTMBGBD2lwc0BtYWlsLmlwcy5lczBCBglghkgBhvhCAQ0ENRYzQ0xBU0VBMyBD +QSBDZXJ0aWZpY2F0ZSBpc3N1ZWQgYnkgaHR0cDovL3d3dy5pcHMuZXMvMCkGCWCG +SAGG+EIBAgQcFhpodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyLzA7BglghkgBhvhC +AQQELhYsaHR0cDovL3d3dy5pcHMuZXMvaXBzMjAwMi9pcHMyMDAyQ0xBU0VBMy5j +cmwwQAYJYIZIAYb4QgEDBDMWMWh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvcmV2 +b2NhdGlvbkNMQVNFQTMuaHRtbD8wPQYJYIZIAYb4QgEHBDAWLmh0dHA6Ly93d3cu +aXBzLmVzL2lwczIwMDIvcmVuZXdhbENMQVNFQTMuaHRtbD8wOwYJYIZIAYb4QgEI +BC4WLGh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvcG9saWN5Q0xBU0VBMy5odG1s +MHUGA1UdHwRuMGwwMqAwoC6GLGh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvaXBz +MjAwMkNMQVNFQTMuY3JsMDagNKAyhjBodHRwOi8vd3d3YmFjay5pcHMuZXMvaXBz +MjAwMi9pcHMyMDAyQ0xBU0VBMy5jcmwwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUF +BzABhhNodHRwOi8vb2NzcC5pcHMuZXMvMA0GCSqGSIb3DQEBBQUAA4GBAEo9IEca +2on0eisxeewBwMwB9dbB/MjD81ACUZBYKp/nNQlbMAqBACVHr9QPDp5gJqiVp4MI +3y2s6Q73nMify5NF8bpqxmdRSmlPa/59Cy9SKcJQrSRE7SOzSMtEQMEDlQwKeAYS +AfWRMS1Jjbs/RU4s4OjNtckUFQzjB4ObJnXv -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 949686588 (0x389b113c) - Signature Algorithm: md5WithRSAEncryption - Issuer: O=Entrust.net, OU=www.entrust.net/SSL_CPS incorp. by ref. (limits liab.), OU=(c) 2000 Entrust.net Limited, CN=Entrust.net Secure Server Certification Authority - Validity - Not Before: Feb 4 17:20:00 2000 GMT - Not After : Feb 4 17:50:00 2020 GMT - Subject: O=Entrust.net, OU=www.entrust.net/SSL_CPS incorp. by ref. (limits liab.), OU=(c) 2000 Entrust.net Limited, CN=Entrust.net Secure Server Certification Authority - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:c7:c1:5f:4e:71:f1:ce:f0:60:86:0f:d2:58:7f: - d3:33:97:2d:17:a2:75:30:b5:96:64:26:2f:68:c3: - 44:ab:a8:75:e6:00:67:34:57:9e:65:c7:22:9b:73: - e6:d3:dd:08:0e:37:55:aa:25:46:81:6c:bd:fe:a8: - f6:75:57:57:8c:90:6c:4a:c3:3e:8b:4b:43:0a:c9: - 11:56:9a:9a:27:22:99:cf:55:9e:61:d9:02:e2:7c: - b6:7c:38:07:dc:e3:7f:4f:9a:b9:03:41:80:b6:75: - 67:13:0b:9f:e8:57:36:c8:5d:00:36:de:66:14:da: - 6e:76:1f:4f:37:8c:82:13:89 - Exponent: 65537 (0x10001) - X509v3 extensions: - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 CRL Distribution Points: - DirName:/O=Entrust.net/OU=www.entrust.net/SSL_CPS incorp. by ref. (limits liab.)/OU=(c) 2000 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority/CN=CRL1 - - X509v3 Private Key Usage Period: - Not Before: Feb 4 17:20:00 2000 GMT, Not After: Feb 4 17:50:00 2020 GMT - X509v3 Key Usage: - Certificate Sign, CRL Sign - X509v3 Authority Key Identifier: - keyid:CB:6C:C0:6B:E3:BB:3E:CB:FC:22:9C:FE:FB:8B:92:9C:B0:F2:6E:22 - - X509v3 Subject Key Identifier: - CB:6C:C0:6B:E3:BB:3E:CB:FC:22:9C:FE:FB:8B:92:9C:B0:F2:6E:22 - X509v3 Basic Constraints: - CA:TRUE - 1.2.840.113533.7.65.0: - 0...V5.0:4.0.... - Signature Algorithm: md5WithRSAEncryption - 62:db:81:91:ce:c8:9a:77:42:2f:ec:bd:27:a3:53:0f:50:1b: - ea:4e:92:f0:a9:af:a9:a0:ba:48:61:cb:ef:c9:06:ef:1f:d5: - f4:ee:df:56:2d:e6:ca:6a:19:73:aa:53:be:92:b3:50:02:b6: - 85:26:72:63:d8:75:50:62:75:14:b7:b3:50:1a:3f:ca:11:00: - 0b:85:45:69:6d:b6:a5:ae:51:e1:4a:dc:82:3f:6c:8c:34:b2: - 77:6b:d9:02:f6:7f:0e:ea:65:04:f1:cd:54:ca:ba:c9:cc:e0: - 84:f7:c8:3e:11:97:d3:60:09:18:bc:05:ff:6c:89:33:f0:ec: - 15:0f -MD5 Fingerprint=9D:66:6A:CC:FF:D5:F5:43:B4:BF:8C:16:D1:2B:A8:99 -----BEGIN CERTIFICATE----- -MIIElTCCA/6gAwIBAgIEOJsRPDANBgkqhkiG9w0BAQQFADCBujEUMBIGA1UEChML -RW50cnVzdC5uZXQxPzA9BgNVBAsUNnd3dy5lbnRydXN0Lm5ldC9TU0xfQ1BTIGlu -Y29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMGA1UECxMcKGMpIDIwMDAg -RW50cnVzdC5uZXQgTGltaXRlZDE6MDgGA1UEAxMxRW50cnVzdC5uZXQgU2VjdXJl -IFNlcnZlciBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wMDAyMDQxNzIwMDBa -Fw0yMDAyMDQxNzUwMDBaMIG6MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDE/MD0GA1UE -CxQ2d3d3LmVudHJ1c3QubmV0L1NTTF9DUFMgaW5jb3JwLiBieSByZWYuIChsaW1p -dHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMjAwMCBFbnRydXN0Lm5ldCBMaW1pdGVk -MTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUgU2VydmVyIENlcnRpZmljYXRp -b24gQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHwV9OcfHO -8GCGD9JYf9Mzly0XonUwtZZkJi9ow0SrqHXmAGc0V55lxyKbc+bT3QgON1WqJUaB -bL3+qPZ1V1eMkGxKwz6LS0MKyRFWmponIpnPVZ5h2QLifLZ8OAfc439PmrkDQYC2 -dWcTC5/oVzbIXQA23mYU2m52H083jIITiQIDAQABo4IBpDCCAaAwEQYJYIZIAYb4 -QgEBBAQDAgAHMIHjBgNVHR8EgdswgdgwgdWggdKggc+kgcwwgckxFDASBgNVBAoT -C0VudHJ1c3QubmV0MT8wPQYDVQQLFDZ3d3cuZW50cnVzdC5uZXQvU1NMX0NQUyBp -bmNvcnAuIGJ5IHJlZi4gKGxpbWl0cyBsaWFiLikxJTAjBgNVBAsTHChjKSAyMDAw -IEVudHJ1c3QubmV0IExpbWl0ZWQxOjA4BgNVBAMTMUVudHJ1c3QubmV0IFNlY3Vy -ZSBTZXJ2ZXIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxDTALBgNVBAMTBENSTDEw -KwYDVR0QBCQwIoAPMjAwMDAyMDQxNzIwMDBagQ8yMDIwMDIwNDE3NTAwMFowCwYD -VR0PBAQDAgEGMB8GA1UdIwQYMBaAFMtswGvjuz7L/CKc/vuLkpyw8m4iMB0GA1Ud -DgQWBBTLbMBr47s+y/winP77i5KcsPJuIjAMBgNVHRMEBTADAQH/MB0GCSqGSIb2 -fQdBAAQQMA4bCFY1LjA6NC4wAwIEkDANBgkqhkiG9w0BAQQFAAOBgQBi24GRzsia -d0Iv7L0no1MPUBvqTpLwqa+poLpIYcvvyQbvH9X07t9WLebKahlzqlO+krNQAraF -JnJj2HVQYnUUt7NQGj/KEQALhUVpbbalrlHhStyCP2yMNLJ3a9kC9n8O6mUE8c1U -yrrJzOCE98g+EZfTYAkYvAX/bIkz8OwVDw== +MIICtzCCAiACAQAwDQYJKoZIhvcNAQEEBQAwgaMxCzAJBgNVBAYTAkVTMRIwEAYD +VQQIEwlCQVJDRUxPTkExEjAQBgNVBAcTCUJBUkNFTE9OQTEZMBcGA1UEChMQSVBT +IFNlZ3VyaWRhZCBDQTEYMBYGA1UECxMPQ2VydGlmaWNhY2lvbmVzMRcwFQYDVQQD +Ew5JUFMgU0VSVklET1JFUzEeMBwGCSqGSIb3DQEJARYPaXBzQG1haWwuaXBzLmVz +MB4XDTk4MDEwMTIzMjEwN1oXDTA5MTIyOTIzMjEwN1owgaMxCzAJBgNVBAYTAkVT +MRIwEAYDVQQIEwlCQVJDRUxPTkExEjAQBgNVBAcTCUJBUkNFTE9OQTEZMBcGA1UE +ChMQSVBTIFNlZ3VyaWRhZCBDQTEYMBYGA1UECxMPQ2VydGlmaWNhY2lvbmVzMRcw +FQYDVQQDEw5JUFMgU0VSVklET1JFUzEeMBwGCSqGSIb3DQEJARYPaXBzQG1haWwu +aXBzLmVzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCsT1J0nznqjtwlxLyY +XZhkJAk8IbPMGbWOlI6H0fg3PqHILVikgDVboXVsHUUMH2Fjal5vmwpMwci4YSM1 +gf/+rHhwLWjhOgeYlQJU3c0jt4BT18g3RXIGJBK6E2Ehim51KODFDzT9NthFf+G4 +Nu+z4cYgjui0OLzhPvYR3oydAQIDAQABMA0GCSqGSIb3DQEBBAUAA4GBACzzw3lY +JN7GO9HgQmm47mSzPWIBubOE3yN93ZjPEKn+ANgilgUTB1RXxafey9m4iEL2mdsU +dx+2/iU94aI+A6mB0i1sR/WWRowiq8jMDQ6XXotBtDvECgZAHd1G9AHduoIuPD14 +cJ58GNCr+Lh3B0Zx8coLY1xq+XKU1QFPoNtC -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 949941988 (0x389ef6e4) - Signature Algorithm: md5WithRSAEncryption - Issuer: O=Entrust.net, OU=www.entrust.net/GCCA_CPS incorp. by ref. (limits liab.), OU=(c) 2000 Entrust.net Limited, CN=Entrust.net Client Certification Authority - Validity - Not Before: Feb 7 16:16:40 2000 GMT - Not After : Feb 7 16:46:40 2020 GMT - Subject: O=Entrust.net, OU=www.entrust.net/GCCA_CPS incorp. by ref. (limits liab.), OU=(c) 2000 Entrust.net Limited, CN=Entrust.net Client Certification Authority - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:93:74:b4:b6:e4:c5:4b:d6:a1:68:7f:62:d5:ec: - f7:51:57:b3:72:4a:98:f5:d0:89:c9:ad:63:cd:4d: - 35:51:6a:84:d4:ad:c9:68:79:6f:b8:eb:11:db:87: - ae:5c:24:51:13:f1:54:25:84:af:29:2b:9f:e3:80: - e2:d9:cb:dd:c6:45:49:34:88:90:5e:01:97:ef:ea: - 53:a6:dd:fc:c1:de:4b:2a:25:e4:e9:35:fa:55:05: - 06:e5:89:7a:ea:a4:11:57:3b:fc:7c:3d:36:cd:67: - 35:6d:a4:a9:25:59:bd:66:f5:f9:27:e4:95:67:d6: - 3f:92:80:5e:f2:34:7d:2b:85 - Exponent: 65537 (0x10001) - X509v3 extensions: - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 CRL Distribution Points: - DirName:/O=Entrust.net/OU=www.entrust.net/GCCA_CPS incorp. by ref. (limits liab.)/OU=(c) 2000 Entrust.net Limited/CN=Entrust.net Client Certification Authority/CN=CRL1 - - X509v3 Private Key Usage Period: - Not Before: Feb 7 16:16:40 2000 GMT, Not After: Feb 7 16:46:40 2020 GMT - X509v3 Key Usage: - Certificate Sign, CRL Sign - X509v3 Authority Key Identifier: - keyid:84:8B:74:FD:C5:8D:C0:FF:27:6D:20:37:45:7C:FE:2D:CE:BA:D3:7D - - X509v3 Subject Key Identifier: - 84:8B:74:FD:C5:8D:C0:FF:27:6D:20:37:45:7C:FE:2D:CE:BA:D3:7D - X509v3 Basic Constraints: - CA:TRUE - 1.2.840.113533.7.65.0: - 0...V5.0:4.0.... - Signature Algorithm: md5WithRSAEncryption - 4e:6f:35:80:3b:d1:8a:f5:0e:a7:20:cb:2d:65:55:d0:92:f4: - e7:84:b5:06:26:83:12:84:0b:ac:3b:b2:44:ee:bd:cf:40:db: - 20:0e:ba:6e:14:ea:30:e0:3b:62:7c:7f:8b:6b:7c:4a:a7:d5: - 35:3c:be:a8:5c:ea:4b:bb:93:8e:80:66:ab:0f:29:fd:4d:2d: - bf:1a:9b:0a:90:c5:ab:da:d1:b3:86:d4:2f:24:52:5c:7a:6d: - c6:f2:fe:e5:4d:1a:30:8c:90:f2:ba:d7:4a:3e:43:7e:d4:c8: - 50:1a:87:f8:4f:81:c7:76:0b:84:3a:72:9d:ce:65:66:97:ae: - 26:5e -MD5 Fingerprint=9A:77:19:18:ED:96:CF:DF:1B:B7:0E:F5:8D:B9:88:2E -----BEGIN CERTIFICATE----- -MIIEgzCCA+ygAwIBAgIEOJ725DANBgkqhkiG9w0BAQQFADCBtDEUMBIGA1UEChML -RW50cnVzdC5uZXQxQDA+BgNVBAsUN3d3dy5lbnRydXN0Lm5ldC9HQ0NBX0NQUyBp -bmNvcnAuIGJ5IHJlZi4gKGxpbWl0cyBsaWFiLikxJTAjBgNVBAsTHChjKSAyMDAw -IEVudHJ1c3QubmV0IExpbWl0ZWQxMzAxBgNVBAMTKkVudHJ1c3QubmV0IENsaWVu -dCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wMDAyMDcxNjE2NDBaFw0yMDAy -MDcxNjQ2NDBaMIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDFAMD4GA1UECxQ3d3d3 -LmVudHJ1c3QubmV0L0dDQ0FfQ1BTIGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxp -YWIuKTElMCMGA1UECxMcKGMpIDIwMDAgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEG -A1UEAxMqRW50cnVzdC5uZXQgQ2xpZW50IENlcnRpZmljYXRpb24gQXV0aG9yaXR5 -MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCTdLS25MVL1qFof2LV7PdRV7Ny -Spj10InJrWPNTTVRaoTUrcloeW+46xHbh65cJFET8VQlhK8pK5/jgOLZy93GRUk0 -iJBeAZfv6lOm3fzB3ksqJeTpNfpVBQbliXrqpBFXO/x8PTbNZzVtpKklWb1m9fkn -5JVn1j+SgF7yNH0rhQIDAQABo4IBnjCCAZowEQYJYIZIAYb4QgEBBAQDAgAHMIHd -BgNVHR8EgdUwgdIwgc+ggcyggcmkgcYwgcMxFDASBgNVBAoTC0VudHJ1c3QubmV0 -MUAwPgYDVQQLFDd3d3cuZW50cnVzdC5uZXQvR0NDQV9DUFMgaW5jb3JwLiBieSBy -ZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMjAwMCBFbnRydXN0Lm5l -dCBMaW1pdGVkMTMwMQYDVQQDEypFbnRydXN0Lm5ldCBDbGllbnQgQ2VydGlmaWNh -dGlvbiBBdXRob3JpdHkxDTALBgNVBAMTBENSTDEwKwYDVR0QBCQwIoAPMjAwMDAy -MDcxNjE2NDBagQ8yMDIwMDIwNzE2NDY0MFowCwYDVR0PBAQDAgEGMB8GA1UdIwQY -MBaAFISLdP3FjcD/J20gN0V8/i3OutN9MB0GA1UdDgQWBBSEi3T9xY3A/ydtIDdF -fP4tzrrTfTAMBgNVHRMEBTADAQH/MB0GCSqGSIb2fQdBAAQQMA4bCFY1LjA6NC4w -AwIEkDANBgkqhkiG9w0BAQQFAAOBgQBObzWAO9GK9Q6nIMstZVXQkvTnhLUGJoMS -hAusO7JE7r3PQNsgDrpuFOow4DtifH+La3xKp9U1PL6oXOpLu5OOgGarDyn9TS2/ -GpsKkMWr2tGzhtQvJFJcem3G8v7lTRowjJDyutdKPkN+1MhQGof4T4HHdguEOnKd -zmVml64mXg== +MIIIODCCB6GgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCAR4xCzAJBgNVBAYTAkVT +MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE +ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE +ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjE0MDIGA1UECxMr +SVBTIENBIFRpbWVzdGFtcGluZyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTE0MDIG +A1UEAxMrSVBTIENBIFRpbWVzdGFtcGluZyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0 +eTEeMBwGCSqGSIb3DQEJARYPaXBzQG1haWwuaXBzLmVzMB4XDTAxMTIyOTAxMTAx +OFoXDTI1MTIyNzAxMTAxOFowggEeMQswCQYDVQQGEwJFUzESMBAGA1UECBMJQmFy +Y2Vsb25hMRIwEAYDVQQHEwlCYXJjZWxvbmExLjAsBgNVBAoTJUlQUyBJbnRlcm5l +dCBwdWJsaXNoaW5nIFNlcnZpY2VzIHMubC4xKzApBgNVBAoUImlwc0BtYWlsLmlw +cy5lcyBDLkkuRi4gIEItNjA5Mjk0NTIxNDAyBgNVBAsTK0lQUyBDQSBUaW1lc3Rh +bXBpbmcgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxNDAyBgNVBAMTK0lQUyBDQSBU +aW1lc3RhbXBpbmcgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxHjAcBgkqhkiG9w0B +CQEWD2lwc0BtYWlsLmlwcy5lczCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA +vLjuVqWajOY2ycJioGaBjRrVetJznw6EZLqVtJCneK/K/lRhW86yIFcBrkSSQxA4 +Efdo/BdApWgnMjvEp+ZCccWZ73b/K5Uk9UmSGGjKALWkWi9uy9YbLA1UZ2t6KaFY +q6JaANZbuxjC3/YeE1Z2m6Vo4pjOxgOKNNtMg0GmqaMCAwEAAaOCBIAwggR8MB0G +A1UdDgQWBBSL0BBQCYHynQnVDmB4AyKiP8jKZjCCAVAGA1UdIwSCAUcwggFDgBSL +0BBQCYHynQnVDmB4AyKiP8jKZqGCASakggEiMIIBHjELMAkGA1UEBhMCRVMxEjAQ +BgNVBAgTCUJhcmNlbG9uYTESMBAGA1UEBxMJQmFyY2Vsb25hMS4wLAYDVQQKEyVJ +UFMgSW50ZXJuZXQgcHVibGlzaGluZyBTZXJ2aWNlcyBzLmwuMSswKQYDVQQKFCJp +cHNAbWFpbC5pcHMuZXMgQy5JLkYuICBCLTYwOTI5NDUyMTQwMgYDVQQLEytJUFMg +Q0EgVGltZXN0YW1waW5nIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MTQwMgYDVQQD +EytJUFMgQ0EgVGltZXN0YW1waW5nIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MR4w +HAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOCAQAwDAYDVR0TBAUwAwEB/zAM +BgNVHQ8EBQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYB +BQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIB +FgYKKwYBBAGCNwoDAQYKKwYBBAGCNwoDBDARBglghkgBhvhCAQEEBAMCAAcwGgYD +VR0RBBMwEYEPaXBzQG1haWwuaXBzLmVzMBoGA1UdEgQTMBGBD2lwc0BtYWlsLmlw +cy5lczBHBglghkgBhvhCAQ0EOhY4VGltZXN0YW1waW5nIENBIENlcnRpZmljYXRl +IGlzc3VlZCBieSBodHRwOi8vd3d3Lmlwcy5lcy8wKQYJYIZIAYb4QgECBBwWGmh0 +dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvMEAGCWCGSAGG+EIBBAQzFjFodHRwOi8v +d3d3Lmlwcy5lcy9pcHMyMDAyL2lwczIwMDJUaW1lc3RhbXBpbmcuY3JsMEUGCWCG +SAGG+EIBAwQ4FjZodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL3Jldm9jYXRpb25U +aW1lc3RhbXBpbmcuaHRtbD8wQgYJYIZIAYb4QgEHBDUWM2h0dHA6Ly93d3cuaXBz +LmVzL2lwczIwMDIvcmVuZXdhbFRpbWVzdGFtcGluZy5odG1sPzBABglghkgBhvhC +AQgEMxYxaHR0cDovL3d3dy5pcHMuZXMvaXBzMjAwMi9wb2xpY3lUaW1lc3RhbXBp +bmcuaHRtbDB/BgNVHR8EeDB2MDegNaAzhjFodHRwOi8vd3d3Lmlwcy5lcy9pcHMy +MDAyL2lwczIwMDJUaW1lc3RhbXBpbmcuY3JsMDugOaA3hjVodHRwOi8vd3d3YmFj +ay5pcHMuZXMvaXBzMjAwMi9pcHMyMDAyVGltZXN0YW1waW5nLmNybDAvBggrBgEF +BQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9vY3NwLmlwcy5lcy8wDQYJKoZI +hvcNAQEFBQADgYEAZbrBzAAalZHK6Ww6vzoeFAh8+4Pua2JR0zORtWB5fgTYXXk3 +6MNbsMRnLWhasl8OCvrNPzpFoeo2zyYepxEoxZSPhExTCMWTs/zif/WN87GphV+I +3pGW7hdbrqXqcGV4LCFkAZXOzkw+UPS2Wctjjba9GNSHSl/c7+lW8AoM6HU= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIF0DCCBLigAwIBAgIEOrZQizANBgkqhkiG9w0BAQUFADB/MQswCQYDVQQGEwJC +TTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDElMCMGA1UECxMcUm9vdCBDZXJ0 +aWZpY2F0aW9uIEF1dGhvcml0eTEuMCwGA1UEAxMlUXVvVmFkaXMgUm9vdCBDZXJ0 +aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wMTAzMTkxODMzMzNaFw0yMTAzMTcxODMz +MzNaMH8xCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMSUw +IwYDVQQLExxSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MS4wLAYDVQQDEyVR +dW9WYWRpcyBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIIBIjANBgkqhkiG +9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2G1lVO6V/z68mcLOhrfEYBklbTRvM16z/Yp +li4kVEAkOPcahdxYTMukJ0KX0J+DisPkBgNbAKVRHnAEdOLB1Dqr1607BxgFjv2D +rOpm2RgbaIr1VxqYuvXtdj182d6UajtLF8HVj71lODqV0D1VNk7feVcxKh7YWWVJ +WCCYfqtffp/p1k3sg3Spx2zY7ilKhSoGFPlU5tPaZQeLYzcS19Dsw3sgQUSj7cug +F+FxZc4dZjH3dgEZyH0DWLaVSR2mEiboxgx24ONmy+pdpibu5cxfvWenAScOospU +xbF6lR1xHkopigPcakXBpBlebzbNw6Kwt/5cOOJSvPhEQ+aQuwIDAQABo4ICUjCC +Ak4wPQYIKwYBBQUHAQEEMTAvMC0GCCsGAQUFBzABhiFodHRwczovL29jc3AucXVv +dmFkaXNvZmZzaG9yZS5jb20wDwYDVR0TAQH/BAUwAwEB/zCCARoGA1UdIASCAREw +ggENMIIBCQYJKwYBBAG+WAABMIH7MIHUBggrBgEFBQcCAjCBxxqBxFJlbGlhbmNl +IG9uIHRoZSBRdW9WYWRpcyBSb290IENlcnRpZmljYXRlIGJ5IGFueSBwYXJ0eSBh +c3N1bWVzIGFjY2VwdGFuY2Ugb2YgdGhlIHRoZW4gYXBwbGljYWJsZSBzdGFuZGFy +ZCB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB1c2UsIGNlcnRpZmljYXRpb24gcHJh +Y3RpY2VzLCBhbmQgdGhlIFF1b1ZhZGlzIENlcnRpZmljYXRlIFBvbGljeS4wIgYI +KwYBBQUHAgEWFmh0dHA6Ly93d3cucXVvdmFkaXMuYm0wHQYDVR0OBBYEFItLbe3T +KbkGGew5Oanwl4Rqy+/fMIGuBgNVHSMEgaYwgaOAFItLbe3TKbkGGew5Oanwl4Rq +y+/foYGEpIGBMH8xCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1p +dGVkMSUwIwYDVQQLExxSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MS4wLAYD +VQQDEyVRdW9WYWRpcyBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5ggQ6tlCL +MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOCAQEAitQUtf70mpKnGdSk +fnIYj9lofFIk3WdvOXrEql494liwTXCYhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8 +7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R +cHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y +mQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW +xFIY6iHOsfHmhIHluqmGKPJDWl0Snawe2ajlCmqnf6CHKc/yiU3U7MXi5nrQNiOK +SnQ2+Q== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIC5zCCAlACAQEwDQYJKoZIhvcNAQEFBQAwgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0 +IFZhbGlkYXRpb24gTmV0d29yazEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAz +BgNVBAsTLFZhbGlDZXJ0IENsYXNzIDMgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9y +aXR5MSEwHwYDVQQDExhodHRwOi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG +9w0BCQEWEWluZm9AdmFsaWNlcnQuY29tMB4XDTk5MDYyNjAwMjIzM1oXDTE5MDYy +NjAwMjIzM1owgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0IFZhbGlkYXRpb24gTmV0d29y +azEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAzBgNVBAsTLFZhbGlDZXJ0IENs +YXNzIDMgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9yaXR5MSEwHwYDVQQDExhodHRw +Oi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl +cnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjmFGWHOjVsQaBalfD +cnWTq8+epvzzFlLWLU2fNUSoLgRNB0mKOCn1dzfnt6td3zZxFJmP3MKS8edgkpfs +2Ejcv8ECIMYkpChMMFp2bbFc893enhBxoYjHW5tBbcqwuI4V7q0zK89HBFx1cQqY +JJgpp0lZpd34t0NiYfPT4tBVPwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAFa7AliE +Zwgs3x/be0kz9dNnnfS0ChCzycUs4pJqcXgn8nCDQtM+z6lU9PHYkhaM0QTLS6vJ +n0WuPIqpsHEzXcjFV9+vqDWzf4mH6eglkrh/hXqu1rweN1gqZ8mRzyqBPu3GOd/A +PhmcGcwTTYJBtYze4D1gCCAPRX5ron+jjBXu +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICXDCCAcWgAwIBAgIQCgEBAQAAAnwAAAALAAAAAjANBgkqhkiG9w0BAQUFADA6 +MRkwFwYDVQQKExBSU0EgU2VjdXJpdHkgSW5jMR0wGwYDVQQLExRSU0EgU2VjdXJp +dHkgMTAyNCBWMzAeFw0wMTAyMjIyMTAxNDlaFw0yNjAyMjIyMDAxNDlaMDoxGTAX +BgNVBAoTEFJTQSBTZWN1cml0eSBJbmMxHTAbBgNVBAsTFFJTQSBTZWN1cml0eSAx +MDI0IFYzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDV3f5mCc8kPD6ugU5O +isRpgFtZO9+5TUzKtS3DJy08rwBCbbwoppbPf9dYrIMKo1W1exeQFYRMiu4mmdxY +78c4pqqv0I5CyGLXq6yp+0p9v+r+Ek3d/yYtbzZUaMjShFbuklNhCbM/OZuoyZu9 +zp9+1BlqFikYvtc6adwlWzMaUQIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MA4G +A1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBTEwBykB5T9zU0B1FTapQxf3q4FWjAd +BgNVHQ4EFgQUxMAcpAeU/c1NAdRU2qUMX96uBVowDQYJKoZIhvcNAQEFBQADgYEA +Py1q4yZDlX2Jl2X7deRyHUZXxGFraZ8SmyzVWujAovBDleMf6XbN3Ou8k6BlCsdN +T1+nr6JGFLkM88y9am63nd4lQtBU/55oc2PcJOsiv6hy8l4A4Q1OOkNumU4/iXgD +mMrzVcydro7BqkWY+o8aoI2II/EVQQ2lRj6RP4vr93E= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1 (0x1) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=AOL Time Warner Inc., OU=America Online Inc., CN=AOL Time Warner Root Certification Authority 1 - Validity - Not Before: May 29 06:00:00 2002 GMT - Not After : Nov 20 15:03:00 2037 GMT - Subject: C=US, O=AOL Time Warner Inc., OU=America Online Inc., CN=AOL Time Warner Root Certification Authority 1 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:99:de:8f:c3:25:a3:69:34:e8:05:f7:74:b9:bf: - 5a:97:19:b9:2f:94:d2:93:e5:2d:89:ca:84:7c:3f: - 10:43:1b:8c:8b:7c:84:58:f8:24:7c:48:cf:2a:fd: - c0:15:d9:18:7e:84:1a:17:d3:db:9e:d7:ca:e4:d9: - d7:aa:58:51:87:f0:f0:8b:48:4e:e2:c2:c4:59:69: - 30:62:b6:30:a2:8c:0b:11:99:61:35:6d:7e:ef:c5: - b1:19:06:20:12:8e:42:e1:df:0f:96:10:52:a8:cf: - 9c:5f:95:14:d8:af:3b:75:0b:31:20:1f:44:2f:a2: - 62:41:b3:bb:18:21:db:ca:71:3c:8c:ec:b6:b9:0d: - 9f:ef:51:ef:4d:7b:12:f2:0b:0c:e1:ac:40:8f:77: - 7f:b0:ca:78:71:0c:5d:16:71:70:a2:d7:c2:3a:85: - cd:0e:9a:c4:e0:00:b0:d5:25:ea:dc:2b:e4:94:2d: - 38:9c:89:41:57:64:28:65:19:1c:b6:44:b4:c8:31: - 6b:8e:01:7b:76:59:25:7f:15:1c:84:08:7c:73:65: - 20:0a:a1:04:2e:1a:32:a8:9a:20:b1:9c:2c:21:59: - e7:fb:cf:ee:70:2d:08:ca:63:3e:2c:9b:93:19:6a: - a4:c2:97:ff:b7:86:57:88:85:6c:9e:15:16:2b:4d: - 2c:b3 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Subject Key Identifier: - A1:36:30:16:CB:86:90:00:45:80:53:B1:8F:C8:D8:3D:7C:BE:5F:12 - X509v3 Authority Key Identifier: - keyid:A1:36:30:16:CB:86:90:00:45:80:53:B1:8F:C8:D8:3D:7C:BE:5F:12 - - X509v3 Key Usage: critical - Digital Signature, Certificate Sign, CRL Sign - Signature Algorithm: sha1WithRSAEncryption - 8a:20:18:a5:be:b3:2f:b4:a6:84:00:40:30:29:fa:b4:14:73: - 4c:79:45:a7:f6:70:e0:e8:7e:64:1e:0a:95:7c:6a:61:c2:ef: - 4e:1f:be:ff:c9:99:1f:07:61:4a:e1:5d:4c:cd:ad:ee:d0:52: - 32:d9:59:32:bc:da:79:72:d6:7b:09:e8:02:81:35:d3:0a:df: - 11:1d:c9:79:a0:80:4d:fe:5a:d7:56:d6:ed:0f:2a:af:a7:18: - 75:33:0c:ea:c1:61:05:4f:6a:9a:89:f2:8d:b9:9f:2e:ef:b0: - 5f:5a:00:eb:be:ad:a0:f8:44:05:67:bc:cb:04:ef:9e:64:c5: - e9:c8:3f:05:bf:c6:2f:07:1c:c3:36:71:86:ca:38:66:4a:cd: - d6:b8:4b:c6:6c:a7:97:3b:fa:13:2d:6e:23:61:87:a1:63:42: - ac:c2:cb:97:9f:61:68:cf:2d:4c:04:9d:d7:25:4f:0a:0e:4d: - 90:8b:18:56:a8:93:48:57:dc:6f:ae:bd:9e:67:57:77:89:50: - b3:be:11:9b:45:67:83:86:19:87:d3:98:bd:08:1a:16:1f:58: - 82:0b:e1:96:69:05:4b:8e:ec:83:51:31:07:d5:d4:9f:ff:59: - 7b:a8:6e:85:cf:d3:4b:a9:49:b0:5f:b0:39:28:68:0e:73:dd: - 25:9a:de:12 -MD5 Fingerprint=E7:7A:DC:B1:1F:6E:06:1F:74:6C:59:16:27:C3:4B:C0 -----BEGIN CERTIFICATE----- -MIID5jCCAs6gAwIBAgIBATANBgkqhkiG9w0BAQUFADCBgzELMAkGA1UEBhMCVVMx -HTAbBgNVBAoTFEFPTCBUaW1lIFdhcm5lciBJbmMuMRwwGgYDVQQLExNBbWVyaWNh -IE9ubGluZSBJbmMuMTcwNQYDVQQDEy5BT0wgVGltZSBXYXJuZXIgUm9vdCBDZXJ0 -aWZpY2F0aW9uIEF1dGhvcml0eSAxMB4XDTAyMDUyOTA2MDAwMFoXDTM3MTEyMDE1 -MDMwMFowgYMxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRBT0wgVGltZSBXYXJuZXIg -SW5jLjEcMBoGA1UECxMTQW1lcmljYSBPbmxpbmUgSW5jLjE3MDUGA1UEAxMuQU9M -IFRpbWUgV2FybmVyIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgMTCCASIw -DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJnej8Mlo2k06AX3dLm/WpcZuS+U -0pPlLYnKhHw/EEMbjIt8hFj4JHxIzyr9wBXZGH6EGhfT257XyuTZ16pYUYfw8ItI -TuLCxFlpMGK2MKKMCxGZYTVtfu/FsRkGIBKOQuHfD5YQUqjPnF+VFNivO3ULMSAf -RC+iYkGzuxgh28pxPIzstrkNn+9R7017EvILDOGsQI93f7DKeHEMXRZxcKLXwjqF -zQ6axOAAsNUl6twr5JQtOJyJQVdkKGUZHLZEtMgxa44Be3ZZJX8VHIQIfHNlIAqh -BC4aMqiaILGcLCFZ5/vP7nAtCMpjPiybkxlqpMKX/7eGV4iFbJ4VFitNLLMCAwEA -AaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUoTYwFsuGkABFgFOxj8jY -PXy+XxIwHwYDVR0jBBgwFoAUoTYwFsuGkABFgFOxj8jYPXy+XxIwDgYDVR0PAQH/ -BAQDAgGGMA0GCSqGSIb3DQEBBQUAA4IBAQCKIBilvrMvtKaEAEAwKfq0FHNMeUWn -9nDg6H5kHgqVfGphwu9OH77/yZkfB2FK4V1Mza3u0FIy2VkyvNp5ctZ7CegCgTXT -Ct8RHcl5oIBN/lrXVtbtDyqvpxh1MwzqwWEFT2qaifKNuZ8u77BfWgDrvq2g+EQF -Z7zLBO+eZMXpyD8Fv8YvBxzDNnGGyjhmSs3WuEvGbKeXO/oTLW4jYYehY0KswsuX -n2Fozy1MBJ3XJU8KDk2QixhWqJNIV9xvrr2eZ1d3iVCzvhGbRWeDhhmH05i9CBoW -H1iCC+GWaQVLjuyDUTEH1dSf/1l7qG6Fz9NLqUmwX7A5KGgOc90lmt4S +MIIDYTCCAkmgAwIBAgIQCgEBAQAAAnwAAAAKAAAAAjANBgkqhkiG9w0BAQUFADA6 +MRkwFwYDVQQKExBSU0EgU2VjdXJpdHkgSW5jMR0wGwYDVQQLExRSU0EgU2VjdXJp +dHkgMjA0OCBWMzAeFw0wMTAyMjIyMDM5MjNaFw0yNjAyMjIyMDM5MjNaMDoxGTAX +BgNVBAoTEFJTQSBTZWN1cml0eSBJbmMxHTAbBgNVBAsTFFJTQSBTZWN1cml0eSAy +MDQ4IFYzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt49VcdKA3Xtp +eafwGFAyPGJn9gqVB93mG/Oe2dJBVGutn3y+Gc37RqtBaB4Y6lXIL5F4iSj7Jylg +/9+PjDvJSZu1pJTOAeo+tWN7fyb9Gd3AIb2E0S1PRsNO3Ng3OTsor8udGuorryGl +wSMiuLgbWhOHV4PR8CDn6E8jQrAApX2J6elhc5SYcSa8LWrg903w8bYqODGBDSnh +AMFRD0xS+ARaqn1y07iHKrtjEAMqs6FPDVpeRrc9DvV07Jmf+T0kgYim3WBU6JU2 +PcYJk5qjEoAAVZkZR73QpXzDuvsf9/UP+Ky5tfQ3mBMY3oVbtwyCO4dvlTlYMNpu +AWgXIszACwIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB +BjAfBgNVHSMEGDAWgBQHw1EwpKrpRa41JPr/JCwz0LGdjDAdBgNVHQ4EFgQUB8NR +MKSq6UWuNST6/yQsM9CxnYwwDQYJKoZIhvcNAQEFBQADggEBAF8+hnZuuDU8TjYc +HnmYv/3VEhF5Ug7uMYm83X/50cYVIeiKAVQNOvtUudZj1LGqlk2iQk3UUx+LEN5/ +Zb5gEydxiKRz44Rj0aRV4VCT5hsOedBnvEbIvz8XDZXmxpBp3ue0L96VfdASPz0+ +f00/FGj1EVDVwfSQpQgdMWD/YIwjVAqv/qFuxdF6Kmh4zx6CCiC0H63lhbJqaHVO +rSU3lIW+vaHU6rcMSzyd6BIA8F+sDeGscGNz9395nzIlQnQFgCi/vcEkllgVsRch +6YlL2weIZ/QVrXA+L02FO8K32/6YaCOJ4XQP3vTFhGMpG8zLB8kApKnXwiJPZ9d3 +7CAFYd4= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1 (0x1) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=AOL Time Warner Inc., OU=America Online Inc., CN=AOL Time Warner Root Certification Authority 2 - Validity - Not Before: May 29 06:00:00 2002 GMT - Not After : Sep 28 23:43:00 2037 GMT - Subject: C=US, O=AOL Time Warner Inc., OU=America Online Inc., CN=AOL Time Warner Root Certification Authority 2 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (4096 bit) - Modulus (4096 bit): - 00:b4:37:5a:08:16:99:14:e8:55:b1:1b:24:6b:fc: - c7:8b:e6:87:a9:89:ee:8b:99:cd:4f:40:86:a4:b6: - 4d:c9:d9:b1:dc:3c:4d:0d:85:4c:15:6c:46:8b:52: - 78:9f:f8:23:fd:67:f5:24:3a:68:5d:d0:f7:64:61: - 41:54:a3:8b:a5:08:d2:29:5b:9b:60:4f:26:83:d1: - 63:12:56:49:76:a4:16:c2:a5:9d:45:ac:8b:84:95: - a8:16:b1:ec:9f:ea:24:1a:ef:b9:57:5c:9a:24:21: - 2c:4d:0e:71:1f:a6:ac:5d:45:74:03:98:c4:54:8c: - 16:4a:41:77:86:95:75:0c:47:01:66:60:fc:15:f1: - 0f:ea:f5:14:78:c7:0e:d7:6e:81:1c:5e:bf:5e:e7: - 3a:2a:d8:97:17:30:7c:00:ad:08:9d:33:af:b8:99: - 61:80:8b:a8:95:7e:14:dc:12:6c:a4:d0:d8:ef:40: - 49:02:36:f9:6e:a9:d6:1d:96:56:04:b2:b3:2d:16: - 56:86:8f:d9:20:57:80:cd:67:10:6d:b0:4c:f0:da: - 46:b6:ea:25:2e:46:af:8d:b0:85:38:34:8b:14:26: - 82:2b:ac:ae:99:0b:8e:14:d7:52:bd:9e:69:c3:86: - 02:0b:ea:76:75:31:09:ce:33:19:21:85:43:e6:89: - 2d:9f:25:37:67:f1:23:6a:d2:00:6d:97:f9:9f:e7: - 29:ca:dd:1f:d7:06:ea:b8:c9:b9:09:21:9f:c8:3f: - 06:c5:d2:e9:12:46:00:4e:7b:08:eb:42:3d:2b:48: - 6e:9d:67:dd:4b:02:e4:44:f3:93:19:a5:27:ce:69: - 7a:be:67:d3:fc:50:a4:2c:ab:c3:6b:b9:e3:80:4c: - cf:05:61:4b:2b:dc:1b:b9:a6:d2:d0:aa:f5:2b:73: - fb:ce:90:35:9f:0c:52:1c:bf:5c:21:61:11:5b:15: - 4b:a9:24:51:fc:a4:5c:f7:17:9d:b0:d2:fa:07:e9: - 8f:56:e4:1a:8c:68:8a:04:d3:7c:5a:e3:9e:a2:a1: - ca:71:5b:a2:d4:a0:e7:29:85:5d:03:68:2a:4f:d2: - 06:d7:3d:f9:c3:03:2f:3f:65:f9:67:1e:47:40:d3: - 63:0f:e3:d5:8e:f9:85:ab:97:4c:b3:d7:26:eb:96: - 0a:94:de:85:36:9c:c8:7f:81:09:02:49:2a:0e:f5: - 64:32:0c:82:d1:ba:6a:82:1b:b3:4b:74:11:f3:8c: - 77:d6:9f:bf:dc:37:a4:a7:55:04:2f:d4:31:e8:d3: - 46:b9:03:7c:da:12:4e:59:64:b7:51:31:31:50:a0: - ca:1c:27:d9:10:2e:ad:d6:bd:10:66:2b:c3:b0:22: - 4a:12:5b - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Subject Key Identifier: - 4F:69:6D:03:7E:9D:9F:07:18:43:BC:B7:10:4E:D5:BF:A9:C4:20:28 - X509v3 Authority Key Identifier: - keyid:4F:69:6D:03:7E:9D:9F:07:18:43:BC:B7:10:4E:D5:BF:A9:C4:20:28 - - X509v3 Key Usage: critical - Digital Signature, Certificate Sign, CRL Sign - Signature Algorithm: sha1WithRSAEncryption - 3b:f3:ae:ca:e8:2e:87:85:fb:65:59:e7:ad:11:14:a5:57:bc: - 58:9f:24:12:57:bb:fb:3f:34:da:ee:ad:7a:2a:34:72:70:31: - 6b:c7:19:98:80:c9:82:de:37:77:5e:54:8b:8e:f2:ea:67:4f: - c9:74:84:91:56:09:d5:e5:7a:9a:81:b6:81:c2:ad:36:e4:f1: - 54:11:53:f3:34:45:01:26:c8:e5:1a:bc:34:44:21:de:ad:25: - fc:76:16:77:21:90:80:98:57:9d:4e:ea:ec:2f:aa:3c:14:7b: - 57:c1:7e:18:14:67:ee:24:c6:bd:ba:15:b0:d2:18:bd:b7:55: - 81:ac:53:c0:e8:dd:69:12:13:42:b7:02:b5:05:41:ca:79:50: - 6e:82:0e:71:72:93:46:e8:9d:0d:5d:bd:ae:ce:29:ad:63:d5: - 55:16:80:30:27:ff:76:ba:f7:b8:d6:4a:e3:d9:b5:f9:52:d0: - 4e:40:a9:c7:e5:c2:32:c7:aa:76:24:e1:6b:05:50:eb:c5:bf: - 0a:54:e5:b9:42:3c:24:fb:b7:07:9c:30:9f:79:5a:e6:e0:40: - 52:15:f4:fc:aa:f4:56:f9:44:97:87:ed:0e:65:72:5e:be:26: - fb:4d:a4:2d:08:07:de:d8:5c:a0:dc:81:33:99:18:25:11:77: - a7:eb:fd:58:09:2c:99:6b:1b:8a:f3:52:3f:1a:4d:48:60:f1: - a0:f6:33:02:53:8b:ed:25:09:b8:0d:2d:ed:97:73:ec:d7:96: - 1f:8e:60:0e:da:10:9b:2f:18:24:f6:a6:4d:0a:f9:3b:cb:75: - c2:cc:2f:ce:24:69:c9:0a:22:8e:59:a7:f7:82:0c:d7:d7:6b: - 35:9c:43:00:6a:c4:95:67:ba:9c:45:cb:b8:0e:37:f7:dc:4e: - 01:4f:be:0a:b6:03:d3:ad:8a:45:f7:da:27:4d:29:b1:48:df: - e4:11:e4:96:46:bd:6c:02:3e:d6:51:c8:95:17:01:15:a9:f2: - aa:aa:f2:bf:2f:65:1b:6f:d0:b9:1a:93:f5:8e:35:c4:80:87: - 3e:94:2f:66:e4:e9:a8:ff:41:9c:70:2a:4f:2a:39:18:95:1e: - 7e:fb:61:01:3c:51:08:2e:28:18:a4:16:0f:31:fd:3a:6c:23: - 93:20:76:e1:fd:07:85:d1:5b:3f:d2:1c:73:32:dd:fa:b9:f8: - 8c:cf:02:87:7a:9a:96:e4:ed:4f:89:8d:53:43:ab:0e:13:c0: - 01:15:b4:79:38:db:fc:6e:3d:9e:51:b6:b8:13:8b:67:cf:f9: - 7c:d9:22:1d:f6:5d:c5:1c:01:2f:98:e8:7a:24:18:bc:84:d7: - fa:dc:72:5b:f7:c1:3a:68 -MD5 Fingerprint=01:5A:99:C3:D6:4F:A9:4B:3C:3B:B1:A3:AB:27:4C:BF -----BEGIN CERTIFICATE----- -MIIF5jCCA86gAwIBAgIBATANBgkqhkiG9w0BAQUFADCBgzELMAkGA1UEBhMCVVMx -HTAbBgNVBAoTFEFPTCBUaW1lIFdhcm5lciBJbmMuMRwwGgYDVQQLExNBbWVyaWNh -IE9ubGluZSBJbmMuMTcwNQYDVQQDEy5BT0wgVGltZSBXYXJuZXIgUm9vdCBDZXJ0 -aWZpY2F0aW9uIEF1dGhvcml0eSAyMB4XDTAyMDUyOTA2MDAwMFoXDTM3MDkyODIz -NDMwMFowgYMxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRBT0wgVGltZSBXYXJuZXIg -SW5jLjEcMBoGA1UECxMTQW1lcmljYSBPbmxpbmUgSW5jLjE3MDUGA1UEAxMuQU9M -IFRpbWUgV2FybmVyIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgMjCCAiIw -DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALQ3WggWmRToVbEbJGv8x4vmh6mJ -7ouZzU9AhqS2TcnZsdw8TQ2FTBVsRotSeJ/4I/1n9SQ6aF3Q92RhQVSji6UI0ilb -m2BPJoPRYxJWSXakFsKlnUWsi4SVqBax7J/qJBrvuVdcmiQhLE0OcR+mrF1FdAOY -xFSMFkpBd4aVdQxHAWZg/BXxD+r1FHjHDtdugRxev17nOirYlxcwfACtCJ0zr7iZ -YYCLqJV+FNwSbKTQ2O9ASQI2+W6p1h2WVgSysy0WVoaP2SBXgM1nEG2wTPDaRrbq -JS5Gr42whTg0ixQmgiusrpkLjhTXUr2eacOGAgvqdnUxCc4zGSGFQ+aJLZ8lN2fx -I2rSAG2X+Z/nKcrdH9cG6rjJuQkhn8g/BsXS6RJGAE57COtCPStIbp1n3UsC5ETz -kxmlJ85per5n0/xQpCyrw2u544BMzwVhSyvcG7mm0tCq9Stz+86QNZ8MUhy/XCFh -EVsVS6kkUfykXPcXnbDS+gfpj1bkGoxoigTTfFrjnqKhynFbotSg5ymFXQNoKk/S -Btc9+cMDLz9l+WceR0DTYw/j1Y75hauXTLPXJuuWCpTehTacyH+BCQJJKg71ZDIM -gtG6aoIbs0t0EfOMd9afv9w3pKdVBC/UMejTRrkDfNoSTllkt1ExMVCgyhwn2RAu -rda9EGYrw7AiShJbAgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYE -FE9pbQN+nZ8HGEO8txBO1b+pxCAoMB8GA1UdIwQYMBaAFE9pbQN+nZ8HGEO8txBO -1b+pxCAoMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQUFAAOCAgEAO/Ouyugu -h4X7ZVnnrREUpVe8WJ8kEle7+z802u6teio0cnAxa8cZmIDJgt43d15Ui47y6mdP -yXSEkVYJ1eV6moG2gcKtNuTxVBFT8zRFASbI5Rq8NEQh3q0l/HYWdyGQgJhXnU7q -7C+qPBR7V8F+GBRn7iTGvboVsNIYvbdVgaxTwOjdaRITQrcCtQVBynlQboIOcXKT -RuidDV29rs4prWPVVRaAMCf/drr3uNZK49m1+VLQTkCpx+XCMseqdiThawVQ68W/ -ClTluUI8JPu3B5wwn3la5uBAUhX0/Kr0VvlEl4ftDmVyXr4m+02kLQgH3thcoNyB -M5kYJRF3p+v9WAksmWsbivNSPxpNSGDxoPYzAlOL7SUJuA0t7Zdz7NeWH45gDtoQ -my8YJPamTQr5O8t1wswvziRpyQoijlmn94IM19drNZxDAGrElWe6nEXLuA4399xO -AU++CrYD062KRffaJ00psUjf5BHklka9bAI+1lHIlRcBFanyqqryvy9lG2/QuRqT -9Y41xICHPpQvZuTpqP9BnHAqTyo5GJUefvthATxRCC4oGKQWDzH9OmwjkyB24f0H -hdFbP9IcczLd+rn4jM8Ch3qaluTtT4mNU0OrDhPAARW0eTjb/G49nlG2uBOLZ8/5 -fNkiHfZdxRwBL5joeiQYvITX+txyW/fBOmg= +MIIDWjCCAkKgAwIBAgIBADANBgkqhkiG9w0BAQUFADBQMQswCQYDVQQGEwJKUDEY +MBYGA1UEChMPU0VDT00gVHJ1c3QubmV0MScwJQYDVQQLEx5TZWN1cml0eSBDb21t +dW5pY2F0aW9uIFJvb3RDQTEwHhcNMDMwOTMwMDQyMDQ5WhcNMjMwOTMwMDQyMDQ5 +WjBQMQswCQYDVQQGEwJKUDEYMBYGA1UEChMPU0VDT00gVHJ1c3QubmV0MScwJQYD +VQQLEx5TZWN1cml0eSBDb21tdW5pY2F0aW9uIFJvb3RDQTEwggEiMA0GCSqGSIb3 +DQEBAQUAA4IBDwAwggEKAoIBAQCzs/5/022x7xZ8V6UMbXaKL0u/ZPtM7orw8yl8 +9f/uKuDp6bpbZCKamm8sOiZpUQWZJtzVHGpxxpp9Hp3dfGzGjGdnSj74cbAZJ6kJ +DKaVv0uMDPpVmDvY6CKhS3E4eayXkmmziX7qIWgGmBSWh9JhNrxtJ1aeV+7AwFb9 +Ms+k2Y7CI9eNqPPYJayX5HA49LY6tJ07lyZDo6G8SVlyTCMwhwFY9k6+HGhWZq/N +QV3Is00qVUarH9oe4kA92819uZKAnDfdDJZkndwi92SL32HeFZRSFaB9UslLqCHJ +xrHty8OVYNEP8Ktw+N/LTX7s1vqr2b1/VPKl6Xn62dZ2JChzAgMBAAGjPzA9MB0G +A1UdDgQWBBSgc0mZaNyFW2XjmygvV5+9M7wHSDALBgNVHQ8EBAMCAQYwDwYDVR0T +AQH/BAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAaECpqLvkT115swW1F7NgE+vG +kl3g0dNq/vu+m22/xwVtWSDEHPC32oRYAmP6SBbvT6UL90qY8j+eG61Ha2POCEfr +Uj94nK9NrvjVT8+amCoQQTlSxN3Zmw7vkwGusi7KaEIkQmywszo+zenaSMQVy+n5 +Bw+SUEmK3TGXX8npN6o7WWWXlDLJs58+OmJYxUmtYg5xpTKqL8aJdkNAExNnPaJU +JRDL8Try2frbSVa7pv6nQTXD4IhhyYjH3zYQIphZ6rBK+1YWc26sTfcioU+tHXot +RSflMMFe8toTyyVCUZVHA4xsIcx0Qu1T/zOLjw9XARYvz6buyXAiFL39vmwLAw== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1018510662 (0x3cb53d46) - Signature Algorithm: sha1WithRSAEncryption - Issuer: O=beTRUSTed, OU=beTRUSTed Root CAs, CN=beTRUSTed Root CA-Baltimore Implementation - Validity - Not Before: Apr 11 07:38:51 2002 GMT - Not After : Apr 11 07:38:51 2022 GMT - Subject: O=beTRUSTed, OU=beTRUSTed Root CAs, CN=beTRUSTed Root CA-Baltimore Implementation - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:bc:7e:c4:39:9c:8c:e3:d6:1c:86:ff:ca:62:ad: - e0:7f:30:45:7a:8e:1a:b3:b8:c7:f9:d1:36:ff:22: - f3:4e:6a:5f:84:10:fb:66:81:c3:94:79:31:d2:91: - e1:77:8e:18:2a:c3:14:de:51:f5:4f:a3:2b:bc:18: - 16:e2:b5:dd:79:de:22:f8:82:7e:cb:81:1f:fd:27: - 2c:8f:fa:97:64:22:8e:f8:ff:61:a3:9c:1b:1e:92: - 8f:c0:a8:09:df:09:11:ec:b7:7d:31:9a:1a:ea:83: - 21:06:3c:9f:ba:5c:ff:94:ea:6a:b8:c3:6b:55:34: - 4f:3d:32:1f:dd:81:14:e0:c4:3c:cd:9d:30:f8:30: - a9:97:d3:ee:cc:a3:d0:1f:5f:1c:13:81:d4:18:ab: - 94:d1:63:c3:9e:7f:35:92:9e:5f:44:ea:ec:f4:22: - 5c:b7:e8:3d:7d:a4:f9:89:a9:91:b2:2a:d9:eb:33: - 87:ee:a5:fd:e3:da:cc:88:e6:89:26:6e:c7:2b:82: - d0:5e:9d:59:db:14:ec:91:83:05:c3:5e:0e:c6:2a: - d0:04:dd:71:3d:20:4e:58:27:fc:53:fb:78:78:19: - 14:b2:fc:90:52:89:38:62:60:07:b4:a0:ec:ac:6b: - 50:d6:fd:b9:28:6b:ef:52:2d:3a:b2:ff:f1:01:40: - ac:37 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Certificate Policies: - Policy: 1.3.6.1.4.1.6334.0.0.1.9.40.51377 - User Notice: - Explicit Text: Reliance on or use of this Certificate creates an acknowledgment and acceptance of the then applicable standard terms and conditions of use, the Certification Practice Statement and the Relying Party Agreement, which can be found at the beTRUSTed web site, http://www.betrusted.com/products_services/index.html - CPS: http://www.betrusted.com/products_services/index.html - - X509v3 Subject Key Identifier: - 45:3D:C3:A9:D1:DC:3F:24:56:98:1C:73:18:88:6A:FF:83:47:ED:B6 - X509v3 Authority Key Identifier: - keyid:45:3D:C3:A9:D1:DC:3F:24:56:98:1C:73:18:88:6A:FF:83:47:ED:B6 - - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - Signature Algorithm: sha1WithRSAEncryption - 49:92:bc:a3:ee:ac:bd:fa:0d:c9:8b:79:86:1c:23:76:b0:80: - 59:77:fc:da:7f:b4:4b:df:c3:64:4b:6a:4e:0e:ad:f2:7d:59: - 77:05:ad:0a:89:73:b0:fa:bc:cb:dc:8d:00:88:8f:a6:a0:b2: - ea:ac:52:27:bf:a1:48:7c:97:10:7b:ba:ed:13:1d:9a:07:6e: - cb:31:62:12:e8:63:03:aa:7d:6d:e3:f8:1b:76:21:78:1b:9f: - 4b:43:8c:d3:49:86:f6:1b:5c:f6:2e:60:15:d3:e9:e3:7b:75: - 3f:d0:02:83:d0:18:82:41:cd:65:37:ea:8e:32:7e:bd:6b:99: - 5d:30:11:c8:db:48:54:1c:3b:e1:a7:13:d3:6a:48:93:f7:3d: - 8c:7f:05:e8:ce:f3:88:2a:63:04:b8:ea:7e:58:7c:01:7b:5b: - e1:c5:7d:ef:21:e0:8d:0e:5d:51:7d:b1:67:fd:a3:bd:38:36: - c6:f2:38:86:87:1a:96:68:60:46:fb:28:14:47:55:e1:a7:80: - 0c:6b:e2:ea:df:4d:7c:90:48:a0:36:bd:09:17:89:7f:c3:f2: - d3:9c:9c:e3:dd:c4:1b:dd:f5:b7:71:b3:53:05:89:06:d0:cb: - 4a:80:c1:c8:53:90:b5:3c:31:88:17:50:9f:c9:c4:0e:8b:d8: - a8:02:63:0d -MD5 Fingerprint=81:35:B9:FB:FB:12:CA:18:69:36:EB:AE:69:78:A1:F1 -----BEGIN CERTIFICATE----- -MIIFajCCBFKgAwIBAgIEPLU9RjANBgkqhkiG9w0BAQUFADBmMRIwEAYDVQQKEwli -ZVRSVVNUZWQxGzAZBgNVBAsTEmJlVFJVU1RlZCBSb290IENBczEzMDEGA1UEAxMq -YmVUUlVTVGVkIFJvb3QgQ0EtQmFsdGltb3JlIEltcGxlbWVudGF0aW9uMB4XDTAy -MDQxMTA3Mzg1MVoXDTIyMDQxMTA3Mzg1MVowZjESMBAGA1UEChMJYmVUUlVTVGVk -MRswGQYDVQQLExJiZVRSVVNUZWQgUm9vdCBDQXMxMzAxBgNVBAMTKmJlVFJVU1Rl -ZCBSb290IENBLUJhbHRpbW9yZSBJbXBsZW1lbnRhdGlvbjCCASIwDQYJKoZIhvcN -AQEBBQADggEPADCCAQoCggEBALx+xDmcjOPWHIb/ymKt4H8wRXqOGrO4x/nRNv8i -805qX4QQ+2aBw5R5MdKR4XeOGCrDFN5R9U+jK7wYFuK13XneIviCfsuBH/0nLI/6 -l2Qijvj/YaOcGx6Sj8CoCd8JEey3fTGaGuqDIQY8n7pc/5TqarjDa1U0Tz0yH92B -FODEPM2dMPgwqZfT7syj0B9fHBOB1BirlNFjw55/NZKeX0Tq7PQiXLfoPX2k+Ymp -kbIq2eszh+6l/ePazIjmiSZuxyuC0F6dWdsU7JGDBcNeDsYq0ATdcT0gTlgn/FP7 -eHgZFLL8kFKJOGJgB7Sg7KxrUNb9uShr71ItOrL/8QFArDcCAwEAAaOCAh4wggIa -MA8GA1UdEwEB/wQFMAMBAf8wggG1BgNVHSAEggGsMIIBqDCCAaQGDysGAQQBsT4A -AAEJKIORMTCCAY8wggFIBggrBgEFBQcCAjCCAToaggE2UmVsaWFuY2Ugb24gb3Ig -dXNlIG9mIHRoaXMgQ2VydGlmaWNhdGUgY3JlYXRlcyBhbiBhY2tub3dsZWRnbWVu -dCBhbmQgYWNjZXB0YW5jZSBvZiB0aGUgdGhlbiBhcHBsaWNhYmxlIHN0YW5kYXJk -IHRlcm1zIGFuZCBjb25kaXRpb25zIG9mIHVzZSwgdGhlIENlcnRpZmljYXRpb24g -UHJhY3RpY2UgU3RhdGVtZW50IGFuZCB0aGUgUmVseWluZyBQYXJ0eSBBZ3JlZW1l -bnQsIHdoaWNoIGNhbiBiZSBmb3VuZCBhdCB0aGUgYmVUUlVTVGVkIHdlYiBzaXRl -LCBodHRwOi8vd3d3LmJldHJ1c3RlZC5jb20vcHJvZHVjdHNfc2VydmljZXMvaW5k -ZXguaHRtbDBBBggrBgEFBQcCARY1aHR0cDovL3d3dy5iZXRydXN0ZWQuY29tL3By -b2R1Y3RzX3NlcnZpY2VzL2luZGV4Lmh0bWwwHQYDVR0OBBYEFEU9w6nR3D8kVpgc -cxiIav+DR+22MB8GA1UdIwQYMBaAFEU9w6nR3D8kVpgccxiIav+DR+22MA4GA1Ud -DwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOCAQEASZK8o+6svfoNyYt5hhwjdrCA -WXf82n+0S9/DZEtqTg6t8n1ZdwWtColzsPq8y9yNAIiPpqCy6qxSJ7+hSHyXEHu6 -7RMdmgduyzFiEuhjA6p9beP4G3YheBufS0OM00mG9htc9i5gFdPp43t1P9ACg9AY -gkHNZTfqjjJ+vWuZXTARyNtIVBw74acT02pIk/c9jH8F6M7ziCpjBLjqflh8AXtb -4cV97yHgjQ5dUX2xZ/2jvTg2xvI4hocalmhgRvsoFEdV4aeADGvi6t9NfJBIoDa9 -CReJf8Py05yc493EG931t3GzUwWJBtDLSoDByFOQtTwxiBdQn8nEDovYqAJjDQ== +MIIDIDCCAgigAwIBAgIBJDANBgkqhkiG9w0BAQUFADA5MQswCQYDVQQGEwJGSTEP +MA0GA1UEChMGU29uZXJhMRkwFwYDVQQDExBTb25lcmEgQ2xhc3MxIENBMB4XDTAx +MDQwNjEwNDkxM1oXDTIxMDQwNjEwNDkxM1owOTELMAkGA1UEBhMCRkkxDzANBgNV +BAoTBlNvbmVyYTEZMBcGA1UEAxMQU29uZXJhIENsYXNzMSBDQTCCASIwDQYJKoZI +hvcNAQEBBQADggEPADCCAQoCggEBALWJHytPZwp5/8Ue+H887dF+2rDNbS82rDTG +29lkFwhjMDMiikzujrsPDUJVyZ0upe/3p4zDq7mXy47vPxVnqIJyY1MPQYx9EJUk +oVqlBvqSV536pQHydekfvFYmUk54GWVYVQNYwBSujHxVX3BbdyMGNpfzJLWaRpXk +3w0LBUXl0fIdgrvGE+D+qnr9aTCU89JFhfzyMlsy3uhsXR/LpCJ0sICOXZT3BgBL +qdReLjVQCfOAl/QMF6452F/NM8EcyonCIvdFEu1eEpOdY6uCLrnrQkFEy0oaAIIN +nvmLVz5MxxftLItyM19yejhW1ebZrgUaHXVFsculJRwSVzb9IjcCAwEAAaMzMDEw +DwYDVR0TAQH/BAUwAwEB/zARBgNVHQ4ECgQIR+IMi/ZTiFIwCwYDVR0PBAQDAgEG +MA0GCSqGSIb3DQEBBQUAA4IBAQCLGrLJXWG04bkruVPRsoWdd44W7hE928Jj2VuX +ZfsSZ9gqXLar5V7DtxYvyOirHYr9qxp81V9jz9yw3Xe5qObSIjiHBxTZ/75Wtf0H +DjxVyhbMp6Z3N/vbXB9OWQaHowND9Rart4S9Tu+fMTfwRvFAttEMpWT4Y14h21VO +TzF2nBBhjrZTOqMRvq9tfB69ri3iDGnHhVNoomG6xT60eVR4ngrHAr5i0RGCS2Uv +kVrCqIexVmiUefkl98HVrhq4uz2PqYo4Ffdz0Fpg0YCw8NzVUM1O7pJIae2yIx4w +zMiUyLb1O4Z/P6Yun/Y+LLWSlj7fLJOK/4GMDw9ZIRlXvVWa -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1018515264 (0x3cb54f40) - Signature Algorithm: sha1WithRSAEncryption - Issuer: O=beTRUSTed, OU=beTRUSTed Root CAs, CN=beTRUSTed Root CA - Entrust Implementation - Validity - Not Before: Apr 11 08:24:27 2002 GMT - Not After : Apr 11 08:54:27 2022 GMT - Subject: O=beTRUSTed, OU=beTRUSTed Root CAs, CN=beTRUSTed Root CA - Entrust Implementation - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:ba:f4:44:03:aa:12:6a:b5:43:ec:55:92:b6:30: - 7d:35:57:0c:db:f3:0d:27:6e:4c:f7:50:a8:9b:4e: - 2b:6f:db:f5:ad:1c:4b:5d:b3:a9:c1:fe:7b:44:eb: - 5b:a3:05:0d:1f:c5:34:2b:30:00:29:f1:78:40:b2: - a4:ff:3a:f4:01:88:17:7e:e6:d4:26:d3:ba:4c:ea: - 32:fb:43:77:97:87:23:c5:db:43:a3:f5:2a:a3:51: - 5e:e1:3b:d2:65:69:7e:55:15:9b:7a:e7:69:f7:44: - e0:57:b5:15:e8:66:60:0f:0d:03:fb:82:8e:a3:e8: - 11:7b:6c:be:c7:63:0e:17:93:df:cf:4b:ae:6e:73: - 75:e0:f3:aa:b9:a4:c0:09:1b:85:ea:71:29:88:41: - 32:f9:f0:2a:0e:6c:09:f2:74:6b:66:6c:52:13:1f: - 18:bc:d4:3e:f7:d8:6e:20:9e:ca:fe:fc:21:94:ee: - 13:28:4b:d7:5c:5e:0c:66:ee:e9:bb:0f:c1:34:b1: - 7f:08:76:f3:3d:26:70:c9:8b:25:1d:62:24:0c:ea: - 1c:75:4e:c0:12:e4:ba:13:1d:30:29:2d:56:33:05: - bb:97:59:7e:c6:49:4f:89:d7:2f:24:a8:b6:88:40: - b5:64:92:53:56:24:e4:a2:a0:85:b3:5e:90:b4:12: - 33:cd - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Certificate Policies: - Policy: 1.3.6.1.4.1.6334.0.0.2.9.40.51377 - User Notice: - Explicit Text: Reliance on or use of this Certificate creates an acknowledgment and acceptance of the then applicable standard terms and conditions of use, the Certification Practice Statement and the Relying Party Agreement, which can be found at the beTRUSTed web site, https://www.betrusted.com/products_services/index.html - CPS: https://www.betrusted.com/products_services/index.html - - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 CRL Distribution Points: - DirName:/O=beTRUSTed/OU=beTRUSTed Root CAs/CN=beTRUSTed Root CA - Entrust Implementation/CN=CRL1 - - X509v3 Private Key Usage Period: - Not Before: Apr 11 08:24:27 2002 GMT, Not After: Apr 11 08:54:27 2022 GMT - X509v3 Key Usage: - Certificate Sign, CRL Sign - X509v3 Authority Key Identifier: - keyid:7D:70:E5:AE:38:8B:06:3F:AA:1C:1A:8F:F9:CF:24:30:AA:84:84:16 - - X509v3 Subject Key Identifier: - 7D:70:E5:AE:38:8B:06:3F:AA:1C:1A:8F:F9:CF:24:30:AA:84:84:16 - X509v3 Basic Constraints: - CA:TRUE - 1.2.840.113533.7.65.0: - 0...V6.0:4.0.... - Signature Algorithm: sha1WithRSAEncryption - 2a:b8:17:ce:1f:10:94:eb:b8:9a:b7:b9:5f:ec:da:f7:92:24: - ac:dc:92:3b:c7:20:8d:f2:99:e5:5d:38:a1:c2:34:ed:c5:13: - 59:5c:05:b5:2b:4f:61:9b:91:fb:41:fc:fc:d5:3c:4d:98:76: - 06:f5:81:7d:eb:dd:90:e6:d1:56:54:da:e3:2d:0c:9f:11:32: - 94:22:01:7a:f6:6c:2c:74:67:04:cc:a5:8f:8e:2c:b3:43:b5: - 94:a2:d0:7d:e9:62:7f:06:be:27:01:83:9e:3a:fd:8a:ee:98: - 43:4a:6b:d7:b5:97:3b:3a:bf:4f:6d:b4:63:fa:33:00:34:2e: - 2d:6d:96:c9:7b:ca:99:63:ba:be:f4:f6:30:a0:2d:98:96:e9: - 56:44:05:a9:44:a3:61:10:eb:82:a1:67:5d:bc:5d:27:75:aa: - 8a:28:36:2a:38:92:d9:dd:a4:5e:00:a5:cc:cc:7c:29:2a:de: - 28:90:ab:b7:e1:b6:ff:7d:25:0b:40:d8:aa:34:a3:2d:de:07: - eb:5f:ce:0a:dd:ca:7e:3a:7d:26:c1:62:68:3a:e6:2f:37:f3: - 81:86:21:c4:a9:64:aa:ef:45:36:d1:1a:66:7c:f8:e9:37:d6: - d6:61:be:a2:ad:48:e7:df:e6:74:fe:d3:6d:7d:d2:25:dc:ac: - 62:57:a9:f7 -MD5 Fingerprint=7D:86:90:8F:5B:F1:F2:40:C0:F7:3D:62:B5:A4:A9:3B -----BEGIN CERTIFICATE----- -MIIGUTCCBTmgAwIBAgIEPLVPQDANBgkqhkiG9w0BAQUFADBmMRIwEAYDVQQKEwli -ZVRSVVNUZWQxGzAZBgNVBAsTEmJlVFJVU1RlZCBSb290IENBczEzMDEGA1UEAxMq -YmVUUlVTVGVkIFJvb3QgQ0EgLSBFbnRydXN0IEltcGxlbWVudGF0aW9uMB4XDTAy -MDQxMTA4MjQyN1oXDTIyMDQxMTA4NTQyN1owZjESMBAGA1UEChMJYmVUUlVTVGVk -MRswGQYDVQQLExJiZVRSVVNUZWQgUm9vdCBDQXMxMzAxBgNVBAMTKmJlVFJVU1Rl -ZCBSb290IENBIC0gRW50cnVzdCBJbXBsZW1lbnRhdGlvbjCCASIwDQYJKoZIhvcN -AQEBBQADggEPADCCAQoCggEBALr0RAOqEmq1Q+xVkrYwfTVXDNvzDSduTPdQqJtO -K2/b9a0cS12zqcH+e0TrW6MFDR/FNCswACnxeECypP869AGIF37m1CbTukzqMvtD -d5eHI8XbQ6P1KqNRXuE70mVpflUVm3rnafdE4Fe1FehmYA8NA/uCjqPoEXtsvsdj -DheT389Lrm5zdeDzqrmkwAkbhepxKYhBMvnwKg5sCfJ0a2ZsUhMfGLzUPvfYbiCe -yv78IZTuEyhL11xeDGbu6bsPwTSxfwh28z0mcMmLJR1iJAzqHHVOwBLkuhMdMCkt -VjMFu5dZfsZJT4nXLySotohAtWSSU1Yk5KKghbNekLQSM80CAwEAAaOCAwUwggMB -MIIBtwYDVR0gBIIBrjCCAaowggGmBg8rBgEEAbE+AAACCSiDkTEwggGRMIIBSQYI -KwYBBQUHAgIwggE7GoIBN1JlbGlhbmNlIG9uIG9yIHVzZSBvZiB0aGlzIENlcnRp -ZmljYXRlIGNyZWF0ZXMgYW4gYWNrbm93bGVkZ21lbnQgYW5kIGFjY2VwdGFuY2Ug -b2YgdGhlIHRoZW4gYXBwbGljYWJsZSBzdGFuZGFyZCB0ZXJtcyBhbmQgY29uZGl0 -aW9ucyBvZiB1c2UsIHRoZSBDZXJ0aWZpY2F0aW9uIFByYWN0aWNlIFN0YXRlbWVu -dCBhbmQgdGhlIFJlbHlpbmcgUGFydHkgQWdyZWVtZW50LCB3aGljaCBjYW4gYmUg -Zm91bmQgYXQgdGhlIGJlVFJVU1RlZCB3ZWIgc2l0ZSwgaHR0cHM6Ly93d3cuYmV0 -cnVzdGVkLmNvbS9wcm9kdWN0c19zZXJ2aWNlcy9pbmRleC5odG1sMEIGCCsGAQUF -BwIBFjZodHRwczovL3d3dy5iZXRydXN0ZWQuY29tL3Byb2R1Y3RzX3NlcnZpY2Vz -L2luZGV4Lmh0bWwwEQYJYIZIAYb4QgEBBAQDAgAHMIGJBgNVHR8EgYEwfzB9oHug -eaR3MHUxEjAQBgNVBAoTCWJlVFJVU1RlZDEbMBkGA1UECxMSYmVUUlVTVGVkIFJv -b3QgQ0FzMTMwMQYDVQQDEypiZVRSVVNUZWQgUm9vdCBDQSAtIEVudHJ1c3QgSW1w -bGVtZW50YXRpb24xDTALBgNVBAMTBENSTDEwKwYDVR0QBCQwIoAPMjAwMjA0MTEw -ODI0MjdagQ8yMDIyMDQxMTA4NTQyN1owCwYDVR0PBAQDAgEGMB8GA1UdIwQYMBaA -FH1w5a44iwY/qhwaj/nPJDCqhIQWMB0GA1UdDgQWBBR9cOWuOIsGP6ocGo/5zyQw -qoSEFjAMBgNVHRMEBTADAQH/MB0GCSqGSIb2fQdBAAQQMA4bCFY2LjA6NC4wAwIE -kDANBgkqhkiG9w0BAQUFAAOCAQEAKrgXzh8QlOu4mre5X+za95IkrNySO8cgjfKZ -5V04ocI07cUTWVwFtStPYZuR+0H8/NU8TZh2BvWBfevdkObRVlTa4y0MnxEylCIB -evZsLHRnBMylj44ss0O1lKLQfelifwa+JwGDnjr9iu6YQ0pr17WXOzq/T220Y/oz -ADQuLW2WyXvKmWO6vvT2MKAtmJbpVkQFqUSjYRDrgqFnXbxdJ3Wqiig2KjiS2d2k -XgClzMx8KSreKJCrt+G2/30lC0DYqjSjLd4H61/OCt3Kfjp9JsFiaDrmLzfzgYYh -xKlkqu9FNtEaZnz46TfW1mG+oq1I59/mdP7TbX3SJdysYlep9w== +MIIDIDCCAgigAwIBAgIBHTANBgkqhkiG9w0BAQUFADA5MQswCQYDVQQGEwJGSTEP +MA0GA1UEChMGU29uZXJhMRkwFwYDVQQDExBTb25lcmEgQ2xhc3MyIENBMB4XDTAx +MDQwNjA3Mjk0MFoXDTIxMDQwNjA3Mjk0MFowOTELMAkGA1UEBhMCRkkxDzANBgNV +BAoTBlNvbmVyYTEZMBcGA1UEAxMQU29uZXJhIENsYXNzMiBDQTCCASIwDQYJKoZI +hvcNAQEBBQADggEPADCCAQoCggEBAJAXSjWdyvANlsdE+hY3/Ei9vX+ALTU74W+o +Z6m/AxxNjG8yR9VBaKQTBME1DJqEQ/xcHf+Js+gXGM2RX/uJ4+q/Tl18GybTdXnt +5oTjV+WtKcT0OijnpXuENmmz/V52vaMtmdOQTiMofRhj8VQ7Jp12W5dCsv+u8E7s +3TmVToMGf+dJQMjFAbJUWmYdPfz56TwKnoG4cPABi+QjVHzIrviQHgCWctRUz2Ej +vOr7nQKV0ba5cTppCD8PtOFCx4j1P5iop7oc4HFx71hXgVB6XGt0Rg6DA5jDjqhu +8nYybieDwnPz3BjotJPqdURrBGAgcVeHnfO+oJAjPYok4doh28MCAwEAAaMzMDEw +DwYDVR0TAQH/BAUwAwEB/zARBgNVHQ4ECgQISqCqWITTXjwwCwYDVR0PBAQDAgEG +MA0GCSqGSIb3DQEBBQUAA4IBAQBazof5FnIVV0sd2ZvnoiYw7JNn39Yt0jSv9zil +zqsWuasvfDXLrNAPtEwr/IDva4yRXzZ299uzGxnq9LIR/WFxRL8oszodv7ND6J+/ +3DEIcbCdjdY0RzKQxmUk96BKfARzjzlvF4xytb1LyHr4e4PDKE6cCepnP7JnBBvD +FNr450kkkdAdavphOe9r5yF1BgfYErQhIHBCcYHaPJo2vqZbDWpsmh+Re/n570K6 +Tk6ezAyNlNzZRZxe7EJQY670XcSxEtzKO6gunRRaBXW37Ndj4ro1tgQIkejanZz2 +ZrUYrAqmVCY0M9IbwdR/GjqOC6oybtv8TyWf2TLHllpwrN9M -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 3b:59:c7:7b:cd:5b:57:9e:bd:37:52:ac:76:b4:aa:1a - Signature Algorithm: sha1WithRSAEncryption - Issuer: O=beTRUSTed, OU=beTRUSTed Root CAs, CN=beTRUSTed Root CA - RSA Implementation - Validity - Not Before: Apr 11 11:18:13 2002 GMT - Not After : Apr 12 11:07:25 2022 GMT - Subject: O=beTRUSTed, OU=beTRUSTed Root CAs, CN=beTRUSTed Root CA - RSA Implementation - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:e4:ba:34:30:09:8e:57:d0:b9:06:2c:6f:6e:24: - 80:22:bf:5d:43:a6:fa:4f:ac:82:e7:1c:68:70:85: - 1b:a3:6e:b5:aa:78:d9:6e:07:4b:3f:e9:df:f5:ea: - e8:54:a1:61:8a:0e:2f:69:75:18:b7:0c:e5:14:8d: - 71:6e:98:b8:55:fc:0c:95:d0:9b:6e:e1:2d:88:d4: - 3a:40:6b:92:f1:99:96:64:de:db:ff:78:f4:ee:96: - 1d:47:89:7c:d4:be:b9:88:77:23:3a:09:e6:04:9e: - 6d:aa:5e:d2:c8:bd:9a:4e:19:df:89:ea:5b:0e:7e: - c3:e4:b4:f0:e0:69:3b:88:0f:41:90:f8:d4:71:43: - 24:c1:8f:26:4b:3b:56:e9:ff:8c:6c:37:e9:45:ad: - 85:8c:53:c3:60:86:90:4a:96:c9:b3:54:b0:bb:17: - f0:1c:45:d9:d4:1b:19:64:56:0a:19:f7:cc:e1:ff: - 86:af:7e:58:5e:ac:7a:90:1f:c9:28:39:45:7b:a2: - b6:c7:9c:1f:da:85:d4:21:86:59:30:93:be:53:33: - 37:f6:ef:41:cf:33:c7:ab:72:6b:25:f5:f3:53:1b: - 0c:4c:2e:f1:75:4b:ef:a0:87:f7:fe:8a:15:d0:6c: - d5:cb:f9:68:53:b9:70:15:13:c2:f5:2e:fb:43:35: - 75:2d - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: - CA:TRUE - X509v3 Certificate Policies: - Policy: 1.3.6.1.4.1.6334.0.0.3.9.40.51377 - CPS: http://www.betrusted.com/products_services/index.html - User Notice: - Explicit Text: Reliance on or use of this Certificate creates an acknowledgment and acceptance of the then applicable standard terms and conditions of use, the Certification Practice Statement and the Relying Party Agreement, which can be found at the beTRUSTed web site, http://www.betrusted.com/products_services/index.html - - X509v3 Key Usage: - Certificate Sign, CRL Sign - X509v3 Authority Key Identifier: - keyid:A9:EC:14:7E:F9:D9:43:CC:53:2B:14:AD:CF:F7:F0:59:89:41:CD:19 - - X509v3 Subject Key Identifier: - A9:EC:14:7E:F9:D9:43:CC:53:2B:14:AD:CF:F7:F0:59:89:41:CD:19 - Signature Algorithm: sha1WithRSAEncryption - db:97:b0:75:ea:0c:c4:c1:98:ca:56:05:c0:a8:ad:26:48:af: - 2d:20:e8:81:c7:b6:df:43:c1:2c:1d:75:4b:d4:42:8d:e7:7a: - a8:74:dc:66:42:59:87:b3:f5:69:6d:d9:a9:9e:b3:7d:1c:31: - c1:f5:54:e2:59:24:49:e5:ee:bd:39:a6:6b:8a:98:44:fb:9b: - d7:2a:83:97:34:2d:c7:7d:35:4c:2d:34:b8:3e:0d:c4:ec:88: - 27:af:9e:92:fd:50:61:82:a8:60:07:14:53:cc:65:13:c1:f6: - 47:44:69:d2:31:c8:a6:dd:2e:b3:0b:de:4a:8d:5b:3d:ab:0d: - c2:35:52:a2:56:37:cc:32:8b:28:85:42:9c:91:40:7a:70:2b: - 38:36:d5:e1:73:1a:1f:e5:fa:7e:5f:dc:d6:9c:3b:30:ea:db: - c0:5b:27:5c:d3:73:07:c1:c2:f3:4c:9b:6f:9f:1b:ca:1e:aa: - a8:38:33:09:58:b2:ae:fc:07:e8:36:dc:55:ba:2f:4f:40:fe: - 7a:bd:06:a6:81:c1:93:22:7c:86:11:0a:06:77:48:ae:35:b7: - 2f:32:9a:61:5e:8b:be:29:9f:29:24:88:56:39:2c:a8:d2:ab: - 96:03:5a:d4:48:9f:b9:40:84:0b:98:68:fb:01:43:d6:1b:e2: - 09:b1:97:1c -MD5 Fingerprint=86:42:05:09:BC:A7:9D:EC:1D:F3:2E:0E:BA:D8:1D:D0 -----BEGIN CERTIFICATE----- -MIIFaDCCBFCgAwIBAgIQO1nHe81bV569N1KsdrSqGjANBgkqhkiG9w0BAQUFADBi -MRIwEAYDVQQKEwliZVRSVVNUZWQxGzAZBgNVBAsTEmJlVFJVU1RlZCBSb290IENB -czEvMC0GA1UEAxMmYmVUUlVTVGVkIFJvb3QgQ0EgLSBSU0EgSW1wbGVtZW50YXRp -b24wHhcNMDIwNDExMTExODEzWhcNMjIwNDEyMTEwNzI1WjBiMRIwEAYDVQQKEwli -ZVRSVVNUZWQxGzAZBgNVBAsTEmJlVFJVU1RlZCBSb290IENBczEvMC0GA1UEAxMm -YmVUUlVTVGVkIFJvb3QgQ0EgLSBSU0EgSW1wbGVtZW50YXRpb24wggEiMA0GCSqG -SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkujQwCY5X0LkGLG9uJIAiv11DpvpPrILn -HGhwhRujbrWqeNluB0s/6d/16uhUoWGKDi9pdRi3DOUUjXFumLhV/AyV0Jtu4S2I -1DpAa5LxmZZk3tv/ePTulh1HiXzUvrmIdyM6CeYEnm2qXtLIvZpOGd+J6lsOfsPk -tPDgaTuID0GQ+NRxQyTBjyZLO1bp/4xsN+lFrYWMU8NghpBKlsmzVLC7F/AcRdnU -GxlkVgoZ98zh/4avflherHqQH8koOUV7orbHnB/ahdQhhlkwk75TMzf270HPM8er -cmsl9fNTGwxMLvF1S++gh/f+ihXQbNXL+WhTuXAVE8L1LvtDNXUtAgMBAAGjggIY -MIICFDAMBgNVHRMEBTADAQH/MIIBtQYDVR0gBIIBrDCCAagwggGkBg8rBgEEAbE+ -AAADCSiDkTEwggGPMEEGCCsGAQUFBwIBFjVodHRwOi8vd3d3LmJldHJ1c3RlZC5j -b20vcHJvZHVjdHNfc2VydmljZXMvaW5kZXguaHRtbDCCAUgGCCsGAQUFBwICMIIB -OhqCATZSZWxpYW5jZSBvbiBvciB1c2Ugb2YgdGhpcyBDZXJ0aWZpY2F0ZSBjcmVh -dGVzIGFuIGFja25vd2xlZGdtZW50IGFuZCBhY2NlcHRhbmNlIG9mIHRoZSB0aGVu -IGFwcGxpY2FibGUgc3RhbmRhcmQgdGVybXMgYW5kIGNvbmRpdGlvbnMgb2YgdXNl -LCB0aGUgQ2VydGlmaWNhdGlvbiBQcmFjdGljZSBTdGF0ZW1lbnQgYW5kIHRoZSBS -ZWx5aW5nIFBhcnR5IEFncmVlbWVudCwgd2hpY2ggY2FuIGJlIGZvdW5kIGF0IHRo -ZSBiZVRSVVNUZWQgd2ViIHNpdGUsIGh0dHA6Ly93d3cuYmV0cnVzdGVkLmNvbS9w -cm9kdWN0c19zZXJ2aWNlcy9pbmRleC5odG1sMAsGA1UdDwQEAwIBBjAfBgNVHSME -GDAWgBSp7BR++dlDzFMrFK3P9/BZiUHNGTAdBgNVHQ4EFgQUqewUfvnZQ8xTKxSt -z/fwWYlBzRkwDQYJKoZIhvcNAQEFBQADggEBANuXsHXqDMTBmMpWBcCorSZIry0g -6IHHtt9DwSwddUvUQo3neqh03GZCWYez9Wlt2ames30cMcH1VOJZJEnl7r05pmuK -mET7m9cqg5c0Lcd9NUwtNLg+DcTsiCevnpL9UGGCqGAHFFPMZRPB9kdEadIxyKbd -LrML3kqNWz2rDcI1UqJWN8wyiyiFQpyRQHpwKzg21eFzGh/l+n5f3NacOzDq28Bb -J1zTcwfBwvNMm2+fG8oeqqg4MwlYsq78B+g23FW6L09A/nq9BqaBwZMifIYRCgZ3 -SK41ty8ymmFei74pnykkiFY5LKjSq5YDWtRIn7lAhAuYaPsBQ9Yb4gmxlxw= +MIIDujCCAqKgAwIBAgIEAJiWijANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJO +TDEeMBwGA1UEChMVU3RhYXQgZGVyIE5lZGVybGFuZGVuMSYwJAYDVQQDEx1TdGFh +dCBkZXIgTmVkZXJsYW5kZW4gUm9vdCBDQTAeFw0wMjEyMTcwOTIzNDlaFw0xNTEy +MTYwOTE1MzhaMFUxCzAJBgNVBAYTAk5MMR4wHAYDVQQKExVTdGFhdCBkZXIgTmVk +ZXJsYW5kZW4xJjAkBgNVBAMTHVN0YWF0IGRlciBOZWRlcmxhbmRlbiBSb290IENB +MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmNK1URF6gaYUmHFtvszn +ExvWJw56s2oYHLZhWtVhCb/ekBPHZ+7d89rFDBKeNVU+LCeIQGv33N0iYfXCxw71 +9tV2U02PjLwYdjeFnejKScfST5gTCaI+Ioicf9byEGW07l8Y1Rfj+MX94p2i71MO +hXeiD+EwR+4A5zN9RGcaC1Hoi6CeUJhoNFIfLm0B8mBF8jHrqTFoKbt6QZ7GGX+U +tFE5A3+y3qcym7RHjm+0Sq7lr7HcsBthvJly3uSJt3omXdozSVtSnA71iq3DuD3o +BmrC1SoLbHuEvVYFy4ZlkuxEK7COudxwC0barbxjiDn622r+I/q85Ej0ZytqERAh +SQIDAQABo4GRMIGOMAwGA1UdEwQFMAMBAf8wTwYDVR0gBEgwRjBEBgRVHSAAMDww +OgYIKwYBBQUHAgEWLmh0dHA6Ly93d3cucGtpb3ZlcmhlaWQubmwvcG9saWNpZXMv +cm9vdC1wb2xpY3kwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSofeu8Y6R0E3QA +7Jbg0zTBLL9s+DANBgkqhkiG9w0BAQUFAAOCAQEABYSHVXQ2YcG70dTGFagTtJ+k +/rvuFbQvBgwp8qiSpGEN/KtcCFtREytNwiphyPgJWPwtArI5fZlmgb9uXJVFIGzm +eafR2Bwp/MIgJ1HI8XxdNGdphREwxgDS1/PTfLbwMVcoEoJz6TMvplW0C5GUR5z6 +u3pCMuiufi3IvKwUv9kP2Vv8wfl6leF9fpb8cbDCTMjfRTTJzg3ynGQI0DvDKcWy +7ZAEwbEpkcUwb8GpcjPM/l0WFywRaed+/sWDCN+83CI6LiBpIzlWYGeQiy52OfsR +iJf2fL1LuCAWZwWN4jvBcj+UlTfHXbme2JOhF4//DGYVwSR8MnwDHTuhWEUykw== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 0a:01:01:01:00:00:02:7c:00:00:00:0a:00:00:00:02 - Signature Algorithm: sha1WithRSAEncryption - Issuer: O=RSA Security Inc, OU=RSA Security 2048 V3 - Validity - Not Before: Feb 22 20:39:23 2001 GMT - Not After : Feb 22 20:39:23 2026 GMT - Subject: O=RSA Security Inc, OU=RSA Security 2048 V3 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:b7:8f:55:71:d2:80:dd:7b:69:79:a7:f0:18:50: - 32:3c:62:67:f6:0a:95:07:dd:e6:1b:f3:9e:d9:d2: - 41:54:6b:ad:9f:7c:be:19:cd:fb:46:ab:41:68:1e: - 18:ea:55:c8:2f:91:78:89:28:fb:27:29:60:ff:df: - 8f:8c:3b:c9:49:9b:b5:a4:94:ce:01:ea:3e:b5:63: - 7b:7f:26:fd:19:dd:c0:21:bd:84:d1:2d:4f:46:c3: - 4e:dc:d8:37:39:3b:28:af:cb:9d:1a:ea:2b:af:21: - a5:c1:23:22:b8:b8:1b:5a:13:87:57:83:d1:f0:20: - e7:e8:4f:23:42:b0:00:a5:7d:89:e9:e9:61:73:94: - 98:71:26:bc:2d:6a:e0:f7:4d:f0:f1:b6:2a:38:31: - 81:0d:29:e1:00:c1:51:0f:4c:52:f8:04:5a:aa:7d: - 72:d3:b8:87:2a:bb:63:10:03:2a:b3:a1:4f:0d:5a: - 5e:46:b7:3d:0e:f5:74:ec:99:9f:f9:3d:24:81:88: - a6:dd:60:54:e8:95:36:3d:c6:09:93:9a:a3:12:80: - 00:55:99:19:47:bd:d0:a5:7c:c3:ba:fb:1f:f7:f5: - 0f:f8:ac:b9:b5:f4:37:98:13:18:de:85:5b:b7:0c: - 82:3b:87:6f:95:39:58:30:da:6e:01:68:17:22:cc: - c0:0b - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - X509v3 Authority Key Identifier: - keyid:07:C3:51:30:A4:AA:E9:45:AE:35:24:FA:FF:24:2C:33:D0:B1:9D:8C - - X509v3 Subject Key Identifier: - 07:C3:51:30:A4:AA:E9:45:AE:35:24:FA:FF:24:2C:33:D0:B1:9D:8C - Signature Algorithm: sha1WithRSAEncryption - 5f:3e:86:76:6e:b8:35:3c:4e:36:1c:1e:79:98:bf:fd:d5:12: - 11:79:52:0e:ee:31:89:bc:dd:7f:f9:d1:c6:15:21:e8:8a:01: - 54:0d:3a:fb:54:b9:d6:63:d4:b1:aa:96:4d:a2:42:4d:d4:53: - 1f:8b:10:de:7f:65:be:60:13:27:71:88:a4:73:e3:84:63:d1: - a4:55:e1:50:93:e6:1b:0e:79:d0:67:bc:46:c8:bf:3f:17:0d: - 95:e6:c6:90:69:de:e7:b4:2f:de:95:7d:d0:12:3f:3d:3e:7f: - 4d:3f:14:68:f5:11:50:d5:c1:f4:90:a5:08:1d:31:60:ff:60: - 8c:23:54:0a:af:fe:a1:6e:c5:d1:7a:2a:68:78:cf:1e:82:0a: - 20:b4:1f:ad:e5:85:b2:6a:68:75:4e:ad:25:37:94:85:be:bd: - a1:d4:ea:b7:0c:4b:3c:9d:e8:12:00:f0:5f:ac:0d:e1:ac:70: - 63:73:f7:7f:79:9f:32:25:42:74:05:80:28:bf:bd:c1:24:96: - 58:15:b1:17:21:e9:89:4b:db:07:88:67:f4:15:ad:70:3e:2f: - 4d:85:3b:c2:b7:db:fe:98:68:23:89:e1:74:0f:de:f4:c5:84: - 63:29:1b:cc:cb:07:c9:00:a4:a9:d7:c2:22:4f:67:d7:77:ec: - 20:05:61:de -MD5 Fingerprint=77:0D:19:B1:21:FD:00:42:9C:3E:0C:A5:DD:0B:02:8E -----BEGIN CERTIFICATE----- -MIIDYTCCAkmgAwIBAgIQCgEBAQAAAnwAAAAKAAAAAjANBgkqhkiG9w0BAQUFADA6 -MRkwFwYDVQQKExBSU0EgU2VjdXJpdHkgSW5jMR0wGwYDVQQLExRSU0EgU2VjdXJp -dHkgMjA0OCBWMzAeFw0wMTAyMjIyMDM5MjNaFw0yNjAyMjIyMDM5MjNaMDoxGTAX -BgNVBAoTEFJTQSBTZWN1cml0eSBJbmMxHTAbBgNVBAsTFFJTQSBTZWN1cml0eSAy -MDQ4IFYzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt49VcdKA3Xtp -eafwGFAyPGJn9gqVB93mG/Oe2dJBVGutn3y+Gc37RqtBaB4Y6lXIL5F4iSj7Jylg -/9+PjDvJSZu1pJTOAeo+tWN7fyb9Gd3AIb2E0S1PRsNO3Ng3OTsor8udGuorryGl -wSMiuLgbWhOHV4PR8CDn6E8jQrAApX2J6elhc5SYcSa8LWrg903w8bYqODGBDSnh -AMFRD0xS+ARaqn1y07iHKrtjEAMqs6FPDVpeRrc9DvV07Jmf+T0kgYim3WBU6JU2 -PcYJk5qjEoAAVZkZR73QpXzDuvsf9/UP+Ky5tfQ3mBMY3oVbtwyCO4dvlTlYMNpu -AWgXIszACwIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB -BjAfBgNVHSMEGDAWgBQHw1EwpKrpRa41JPr/JCwz0LGdjDAdBgNVHQ4EFgQUB8NR -MKSq6UWuNST6/yQsM9CxnYwwDQYJKoZIhvcNAQEFBQADggEBAF8+hnZuuDU8TjYc -HnmYv/3VEhF5Ug7uMYm83X/50cYVIeiKAVQNOvtUudZj1LGqlk2iQk3UUx+LEN5/ -Zb5gEydxiKRz44Rj0aRV4VCT5hsOedBnvEbIvz8XDZXmxpBp3ue0L96VfdASPz0+ -f00/FGj1EVDVwfSQpQgdMWD/YIwjVAqv/qFuxdF6Kmh4zx6CCiC0H63lhbJqaHVO -rSU3lIW+vaHU6rcMSzyd6BIA8F+sDeGscGNz9395nzIlQnQFgCi/vcEkllgVsRch -6YlL2weIZ/QVrXA+L02FO8K32/6YaCOJ4XQP3vTFhGMpG8zLB8kApKnXwiJPZ9d3 -7CAFYd4= +MIIDXDCCAsWgAwIBAgICA+owDQYJKoZIhvcNAQEEBQAwgbwxCzAJBgNVBAYTAkRF +MRAwDgYDVQQIEwdIYW1idXJnMRAwDgYDVQQHEwdIYW1idXJnMTowOAYDVQQKEzFU +QyBUcnVzdENlbnRlciBmb3IgU2VjdXJpdHkgaW4gRGF0YSBOZXR3b3JrcyBHbWJI +MSIwIAYDVQQLExlUQyBUcnVzdENlbnRlciBDbGFzcyAyIENBMSkwJwYJKoZIhvcN +AQkBFhpjZXJ0aWZpY2F0ZUB0cnVzdGNlbnRlci5kZTAeFw05ODAzMDkxMTU5NTla +Fw0xMTAxMDExMTU5NTlaMIG8MQswCQYDVQQGEwJERTEQMA4GA1UECBMHSGFtYnVy +ZzEQMA4GA1UEBxMHSGFtYnVyZzE6MDgGA1UEChMxVEMgVHJ1c3RDZW50ZXIgZm9y +IFNlY3VyaXR5IGluIERhdGEgTmV0d29ya3MgR21iSDEiMCAGA1UECxMZVEMgVHJ1 +c3RDZW50ZXIgQ2xhc3MgMiBDQTEpMCcGCSqGSIb3DQEJARYaY2VydGlmaWNhdGVA +dHJ1c3RjZW50ZXIuZGUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANo46O0y +AClxgwENv4wB3NrGrTmkqYov1YtcaF9QxmL1Zr3KkSLsqh1R1z2zUbKDTl3LSbDw +TFXlay3HhQswHJJOgtTKAu33b77c4OMUuAVT8pr0VotanoWT0bSCVq5Nu6hLVxa8 +/vhYnvgpjbB7zXjJT6yLZwzxnPv8V5tXXE8NAgMBAAGjazBpMA8GA1UdEwEB/wQF +MAMBAf8wDgYDVR0PAQH/BAQDAgGGMDMGCWCGSAGG+EIBCAQmFiRodHRwOi8vd3d3 +LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwEQYJYIZIAYb4QgEBBAQDAgAHMA0G +CSqGSIb3DQEBBAUAA4GBAIRS+yjf/x91AbwBvgRWl2p0QiQxg/lGsQaKic+WLDO/ +jLVfenKhhQbOhvgFjuj5Jcrag4wGrOs2bYWRNAQ29ELw+HkuCkhcq8xRT3h2oNms +Gb0q0WkEKJHKNhAngFdb0lz1wlurZIFjdFH0l7/NEij3TWZ/p/AcASZ4smZHcFFk -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 0a:01:01:01:00:00:02:7c:00:00:00:0b:00:00:00:02 - Signature Algorithm: sha1WithRSAEncryption - Issuer: O=RSA Security Inc, OU=RSA Security 1024 V3 - Validity - Not Before: Feb 22 21:01:49 2001 GMT - Not After : Feb 22 20:01:49 2026 GMT - Subject: O=RSA Security Inc, OU=RSA Security 1024 V3 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:d5:dd:fe:66:09:cf:24:3c:3e:ae:81:4e:4e:8a: - c4:69:80:5b:59:3b:df:b9:4d:4c:ca:b5:2d:c3:27: - 2d:3c:af:00:42:6d:bc:28:a6:96:cf:7f:d7:58:ac: - 83:0a:a3:55:b5:7b:17:90:15:84:4c:8a:ee:26:99: - dc:58:ef:c7:38:a6:aa:af:d0:8e:42:c8:62:d7:ab: - ac:a9:fb:4a:7d:bf:ea:fe:12:4d:dd:ff:26:2d:6f: - 36:54:68:c8:d2:84:56:ee:92:53:61:09:b3:3f:39: - 9b:a8:c9:9b:bd:ce:9f:7e:d4:19:6a:16:29:18:be: - d7:3a:69:dc:25:5b:33:1a:51 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - X509v3 Authority Key Identifier: - keyid:C4:C0:1C:A4:07:94:FD:CD:4D:01:D4:54:DA:A5:0C:5F:DE:AE:05:5A - - X509v3 Subject Key Identifier: - C4:C0:1C:A4:07:94:FD:CD:4D:01:D4:54:DA:A5:0C:5F:DE:AE:05:5A - Signature Algorithm: sha1WithRSAEncryption - 3f:2d:6a:e3:26:43:95:7d:89:97:65:fb:75:e4:72:1d:46:57: - c4:61:6b:69:9f:12:9b:2c:d5:5a:e8:c0:a2:f0:43:95:e3:1f: - e9:76:cd:dc:eb:bc:93:a0:65:0a:c7:4d:4f:5f:a7:af:a2:46: - 14:b9:0c:f3:cc:bd:6a:6e:b7:9d:de:25:42:d0:54:ff:9e:68: - 73:63:dc:24:eb:22:bf:a8:72:f2:5e:00:e1:0d:4e:3a:43:6e: - 99:4e:3f:89:78:03:98:ca:f3:55:cc:9d:ae:8e:c1:aa:45:98: - fa:8f:1a:a0:8d:88:23:f1:15:41:0d:a5:46:3e:91:3f:8b:eb: - f7:71 -MD5 Fingerprint=3A:E5:50:B0:39:BE:C7:46:36:33:A1:FE:82:3E:8D:94 -----BEGIN CERTIFICATE----- -MIICXDCCAcWgAwIBAgIQCgEBAQAAAnwAAAALAAAAAjANBgkqhkiG9w0BAQUFADA6 -MRkwFwYDVQQKExBSU0EgU2VjdXJpdHkgSW5jMR0wGwYDVQQLExRSU0EgU2VjdXJp -dHkgMTAyNCBWMzAeFw0wMTAyMjIyMTAxNDlaFw0yNjAyMjIyMDAxNDlaMDoxGTAX -BgNVBAoTEFJTQSBTZWN1cml0eSBJbmMxHTAbBgNVBAsTFFJTQSBTZWN1cml0eSAx -MDI0IFYzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDV3f5mCc8kPD6ugU5O -isRpgFtZO9+5TUzKtS3DJy08rwBCbbwoppbPf9dYrIMKo1W1exeQFYRMiu4mmdxY -78c4pqqv0I5CyGLXq6yp+0p9v+r+Ek3d/yYtbzZUaMjShFbuklNhCbM/OZuoyZu9 -zp9+1BlqFikYvtc6adwlWzMaUQIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MA4G -A1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBTEwBykB5T9zU0B1FTapQxf3q4FWjAd -BgNVHQ4EFgQUxMAcpAeU/c1NAdRU2qUMX96uBVowDQYJKoZIhvcNAQEFBQADgYEA -Py1q4yZDlX2Jl2X7deRyHUZXxGFraZ8SmyzVWujAovBDleMf6XbN3Ou8k6BlCsdN -T1+nr6JGFLkM88y9am63nd4lQtBU/55oc2PcJOsiv6hy8l4A4Q1OOkNumU4/iXgD -mMrzVcydro7BqkWY+o8aoI2II/EVQQ2lRj6RP4vr93E= +MIIDXDCCAsWgAwIBAgICA+swDQYJKoZIhvcNAQEEBQAwgbwxCzAJBgNVBAYTAkRF +MRAwDgYDVQQIEwdIYW1idXJnMRAwDgYDVQQHEwdIYW1idXJnMTowOAYDVQQKEzFU +QyBUcnVzdENlbnRlciBmb3IgU2VjdXJpdHkgaW4gRGF0YSBOZXR3b3JrcyBHbWJI +MSIwIAYDVQQLExlUQyBUcnVzdENlbnRlciBDbGFzcyAzIENBMSkwJwYJKoZIhvcN +AQkBFhpjZXJ0aWZpY2F0ZUB0cnVzdGNlbnRlci5kZTAeFw05ODAzMDkxMTU5NTla +Fw0xMTAxMDExMTU5NTlaMIG8MQswCQYDVQQGEwJERTEQMA4GA1UECBMHSGFtYnVy +ZzEQMA4GA1UEBxMHSGFtYnVyZzE6MDgGA1UEChMxVEMgVHJ1c3RDZW50ZXIgZm9y +IFNlY3VyaXR5IGluIERhdGEgTmV0d29ya3MgR21iSDEiMCAGA1UECxMZVEMgVHJ1 +c3RDZW50ZXIgQ2xhc3MgMyBDQTEpMCcGCSqGSIb3DQEJARYaY2VydGlmaWNhdGVA +dHJ1c3RjZW50ZXIuZGUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALa0wTUF +Lg2N7KBAahwOJ6ZQkmtQGwfeLud2zODa/ISoXoxjaitN2U4CdhHBC/KNecoAtvGw +Dtf7pBc9r6tpepYnv68zoZoqWarEtTcI8hKlMbZD9TKWcSgoq40oht+77uMMfTDW +w1Krj10nnGvAo+cFa1dJRLNu6mTP0o56UHd3AgMBAAGjazBpMA8GA1UdEwEB/wQF +MAMBAf8wDgYDVR0PAQH/BAQDAgGGMDMGCWCGSAGG+EIBCAQmFiRodHRwOi8vd3d3 +LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwEQYJYIZIAYb4QgEBBAQDAgAHMA0G +CSqGSIb3DQEBBAUAA4GBABY9xs3Bu4VxhUafPiCPUSiZ7C1FIWMjWwS7TJC4iJIE +Tb19AaM/9uzO8d7+feXhPrvGq14L3T2WxMup1Pkm5gZOngylerpuw3yCGdHHsbHD +2w2Om0B8NwvxXej9H5CIpQ5ON2QhqE6NtJ/x3kit1VYYUimLRzQSCdS7kjXvD9s0 -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 144470 (0x23456) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA - Validity - Not Before: May 21 04:00:00 2002 GMT - Not After : May 21 04:00:00 2022 GMT - Subject: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:da:cc:18:63:30:fd:f4:17:23:1a:56:7e:5b:df: - 3c:6c:38:e4:71:b7:78:91:d4:bc:a1:d8:4c:f8:a8: - 43:b6:03:e9:4d:21:07:08:88:da:58:2f:66:39:29: - bd:05:78:8b:9d:38:e8:05:b7:6a:7e:71:a4:e6:c4: - 60:a6:b0:ef:80:e4:89:28:0f:9e:25:d6:ed:83:f3: - ad:a6:91:c7:98:c9:42:18:35:14:9d:ad:98:46:92: - 2e:4f:ca:f1:87:43:c1:16:95:57:2d:50:ef:89:2d: - 80:7a:57:ad:f2:ee:5f:6b:d2:00:8d:b9:14:f8:14: - 15:35:d9:c0:46:a3:7b:72:c8:91:bf:c9:55:2b:cd: - d0:97:3e:9c:26:64:cc:df:ce:83:19:71:ca:4e:e6: - d4:d5:7b:a9:19:cd:55:de:c8:ec:d2:5e:38:53:e5: - 5c:4f:8c:2d:fe:50:23:36:fc:66:e6:cb:8e:a4:39: - 19:00:b7:95:02:39:91:0b:0e:fe:38:2e:d1:1d:05: - 9a:f6:4d:3e:6f:0f:07:1d:af:2c:1e:8f:60:39:e2: - fa:36:53:13:39:d4:5e:26:2b:db:3d:a8:14:bd:32: - eb:18:03:28:52:04:71:e5:ab:33:3d:e1:38:bb:07: - 36:84:62:9c:79:ea:16:30:f4:5f:c0:2b:e8:71:6b: - e4:f9 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Subject Key Identifier: - C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E - X509v3 Authority Key Identifier: - keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E - - Signature Algorithm: sha1WithRSAEncryption - 35:e3:29:6a:e5:2f:5d:54:8e:29:50:94:9f:99:1a:14:e4:8f: - 78:2a:62:94:a2:27:67:9e:d0:cf:1a:5e:47:e9:c1:b2:a4:cf: - dd:41:1a:05:4e:9b:4b:ee:4a:6f:55:52:b3:24:a1:37:0a:eb: - 64:76:2a:2e:2c:f3:fd:3b:75:90:bf:fa:71:d8:c7:3d:37:d2: - b5:05:95:62:b9:a6:de:89:3d:36:7b:38:77:48:97:ac:a6:20: - 8f:2e:a6:c9:0c:c2:b2:99:45:00:c7:ce:11:51:22:22:e0:a5: - ea:b6:15:48:09:64:ea:5e:4f:74:f7:05:3e:c7:8a:52:0c:db: - 15:b4:bd:6d:9b:e5:c6:b1:54:68:a9:e3:69:90:b6:9a:a5:0f: - b8:b9:3f:20:7d:ae:4a:b5:b8:9c:e4:1d:b6:ab:e6:94:a5:c1: - c7:83:ad:db:f5:27:87:0e:04:6c:d5:ff:dd:a0:5d:ed:87:52: - b7:2b:15:02:ae:39:a6:6a:74:e9:da:c4:e7:bc:4d:34:1e:a9: - 5c:4d:33:5f:92:09:2f:88:66:5d:77:97:c7:1d:76:13:a9:d5: - e5:f1:16:09:11:35:d5:ac:db:24:71:70:2c:98:56:0b:d9:17: - b4:d1:e3:51:2b:5e:75:e8:d5:d0:dc:4f:34:ed:c2:05:66:80: - a1:cb:e6:33 -MD5 Fingerprint=F7:75:AB:29:FB:51:4E:B7:77:5E:FF:05:3C:99:8E:F5 -----BEGIN CERTIFICATE----- -MIIDVDCCAjygAwIBAgIDAjRWMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT -MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i -YWwgQ0EwHhcNMDIwNTIxMDQwMDAwWhcNMjIwNTIxMDQwMDAwWjBCMQswCQYDVQQG -EwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UEAxMSR2VvVHJ1c3Qg -R2xvYmFsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2swYYzD9 -9BcjGlZ+W988bDjkcbd4kdS8odhM+KhDtgPpTSEHCIjaWC9mOSm9BXiLnTjoBbdq -fnGk5sRgprDvgOSJKA+eJdbtg/OtppHHmMlCGDUUna2YRpIuT8rxh0PBFpVXLVDv -iS2Aelet8u5fa9IAjbkU+BQVNdnARqN7csiRv8lVK83Qlz6cJmTM386DGXHKTubU -1XupGc1V3sjs0l44U+VcT4wt/lAjNvxm5suOpDkZALeVAjmRCw7+OC7RHQWa9k0+ -bw8HHa8sHo9gOeL6NlMTOdReJivbPagUvTLrGAMoUgRx5aszPeE4uwc2hGKceeoW -MPRfwCvocWvk+QIDAQABo1MwUTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTA -ephojYn7qwVkDBF9qn1luMrMTjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1l -uMrMTjANBgkqhkiG9w0BAQUFAAOCAQEANeMpauUvXVSOKVCUn5kaFOSPeCpilKIn -Z57QzxpeR+nBsqTP3UEaBU6bS+5Kb1VSsyShNwrrZHYqLizz/Tt1kL/6cdjHPTfS -tQWVYrmm3ok9Nns4d0iXrKYgjy6myQzCsplFAMfOEVEiIuCl6rYVSAlk6l5PdPcF -PseKUgzbFbS9bZvlxrFUaKnjaZC2mqUPuLk/IH2uSrW4nOQdtqvmlKXBx4Ot2/Un -hw4EbNX/3aBd7YdStysVAq45pmp06drE57xNNB6pXE0zX5IJL4hmXXeXxx12E6nV -5fEWCRE11azbJHFwLJhWC9kXtNHjUStedejV0NxPNO3CBWaAocvmMw== +MIIEKzCCAxOgAwIBAgIEOsylTDANBgkqhkiG9w0BAQUFADBDMQswCQYDVQQGEwJE +SzEVMBMGA1UEChMMVERDIEludGVybmV0MR0wGwYDVQQLExRUREMgSW50ZXJuZXQg +Um9vdCBDQTAeFw0wMTA0MDUxNjMzMTdaFw0yMTA0MDUxNzAzMTdaMEMxCzAJBgNV +BAYTAkRLMRUwEwYDVQQKEwxUREMgSW50ZXJuZXQxHTAbBgNVBAsTFFREQyBJbnRl +cm5ldCBSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxLhA +vJHVYx/XmaCLDEAedLdInUaMArLgJF/wGROnN4NrXceO+YQwzho7+vvOi20jxsNu +Zp+Jpd/gQlBn+h9sHvTQBda/ytZO5GhgbEaqHF1j4QeGDmUApy6mcca8uYGoOn0a +0vnRrEvLznWv3Hv6gXPU/Lq9QYjUdLP5Xjg6PEOo0pVOd20TDJ2PeAG3WiAfAzc1 +4izbSysseLlJ28TQx5yc5IogCSEWVmb/Bexb4/DPqyQkXsN/cHoSxNK1EKC2IeGN +eGlVRGn1ypYcNIUXJXfi9i8nmHj9eQY6otZaQ8H/7AQ77hPv01ha/5Lr7K7a8jcD +R0G2l8ktCkEiu7vmpwIDAQABo4IBJTCCASEwEQYJYIZIAYb4QgEBBAQDAgAHMGUG +A1UdHwReMFwwWqBYoFakVDBSMQswCQYDVQQGEwJESzEVMBMGA1UEChMMVERDIElu +dGVybmV0MR0wGwYDVQQLExRUREMgSW50ZXJuZXQgUm9vdCBDQTENMAsGA1UEAxME +Q1JMMTArBgNVHRAEJDAigA8yMDAxMDQwNTE2MzMxN1qBDzIwMjEwNDA1MTcwMzE3 +WjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAUbGQBx/2FbazI2p5QCIUItTxWqFAw +HQYDVR0OBBYEFGxkAcf9hW2syNqeUAiFCLU8VqhQMAwGA1UdEwQFMAMBAf8wHQYJ +KoZIhvZ9B0EABBAwDhsIVjUuMDo0LjADAgSQMA0GCSqGSIb3DQEBBQUAA4IBAQBO +Q8zR3R0QGwZ/t6T609lN+yOfI1Rb5osvBCiLtSdtiaHsmGnc540mgwV5dOy0uaOX +wTUA/RXaOYE6lTGQ3pfphqiZdwzlWqCE/xIWrG64jcN7ksKsLtB9KOy282A4aW8+ +2ARVPp7MVdK6/rtHBNcK2RYKNCn1WBPVT8+PVkuzHu7TmHnaCB4Mb7j4Fifvwm89 +9qNLPg7kbWzbO0ESm70NRyN/PErQr8Cv9u8btRXE64PECV90i9kR+8JWsTz4cMo0 +jUNAE4z9mQNUecYu6oah9jrUCbz0vGbMPVjQV0kK7iXiQe4T+Zs4NNEA9X7nlB38 +aQNiuJkFBT1reBK9sG9l -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 44:be:0c:8b:50:00:24:b4:11:d3:36:30:4b:c0:33:77 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Network Applications - Validity - Not Before: Jul 9 18:48:39 1999 GMT - Not After : Jul 9 18:57:49 2019 GMT - Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Network Applications - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:b3:fb:91:a1:e4:36:55:85:ac:06:34:5b:a0:9a: - 58:b2:f8:b5:0f:05:77:83:ae:32:b1:76:92:68:ec: - 23:4a:c9:76:3f:e3:9c:b6:37:79:03:b9:ab:69:8d: - 07:25:b6:19:67:e4:b0:1b:18:73:61:4a:e8:7e:cd: - d3:2f:64:e3:a6:7c:0c:fa:17:80:a3:0d:47:89:4f: - 51:71:2f:ee:fc:3f:f9:b8:16:80:87:89:93:25:20: - 9a:43:82:69:24:76:28:59:35:a1:1d:c0:7f:83:06: - 64:16:20:2c:d3:49:a4:85:b4:c0:61:7f:51:08:f8: - 68:15:91:80:cb:a5:d5:ee:3b:3a:f4:84:04:5e:60: - 59:a7:8c:34:72:ee:b8:78:c5:d1:3b:12:4a:6f:7e: - 65:27:b9:a4:55:c5:b9:6f:43:a4:c5:1d:2c:99:c0: - 52:a4:78:4c:15:b3:40:98:08:6b:43:c6:01:b0:7a: - 7b:f5:6b:1c:22:3f:cb:ef:ff:a8:d0:3a:4b:76:15: - 9e:d2:d1:c6:2e:e3:db:57:1b:32:a2:b8:6f:e8:86: - a6:3f:70:ab:e5:70:92:ab:44:1e:40:50:fb:9c:a3: - 62:e4:6c:6e:a0:c8:de:e2:80:42:fa:e9:2f:e8:ce: - 32:04:8f:7c:8d:b7:1c:a3:35:3c:15:dd:9e:c3:ae: - 97:a5 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Key Usage: - Digital Signature, Non Repudiation, Certificate Sign, CRL Sign - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Subject Key Identifier: - FA:86:C9:DB:E0:BA:E9:78:F5:4B:A8:D6:15:DF:F0:D3:E1:6A:14:3C - X509v3 CRL Distribution Points: - URI:http://crl.usertrust.com/UTN-USERFirst-NetworkApplications.crl - - Signature Algorithm: sha1WithRSAEncryption - a4:f3:25:cc:d1:d4:91:83:22:d0:cc:32:ab:9b:96:4e:34:91: - 54:20:25:34:61:5f:2a:02:15:e1:8b:aa:ff:7d:64:51:cf:0a: - ff:bc:7d:d8:21:6a:78:cb:2f:51:6f:f8:42:1d:33:bd:eb:b5: - 7b:94:c3:c3:a9:a0:2d:df:d1:29:1f:1d:fe:8f:3f:bb:a8:45: - 2a:7f:d1:6e:55:24:e2:bb:02:fb:31:3f:be:e8:bc:ec:40:2b: - f8:01:d4:56:38:e4:ca:44:82:b5:61:20:21:67:65:f6:f0:0b: - e7:34:f8:a5:c2:9c:a3:5c:40:1f:85:93:95:06:de:4f:d4:27: - a9:b6:a5:fc:16:cd:73:31:3f:b8:65:27:cf:d4:53:1a:f0:ac: - 6e:9f:4f:05:0c:03:81:a7:84:29:c4:5a:bd:64:57:72:ad:3b: - cf:37:18:a6:98:c6:ad:06:b4:dc:08:a3:04:d5:29:a4:96:9a: - 12:67:4a:8c:60:45:9d:f1:23:9a:b0:00:9c:68:b5:98:50:d3: - ef:8e:2e:92:65:b1:48:3e:21:be:15:30:2a:0d:b5:0c:a3:6b: - 3f:ae:7f:57:f5:1f:96:7c:df:6f:dd:82:30:2c:65:1b:40:4a: - cd:68:b9:72:ec:71:76:ec:54:8e:1f:85:0c:01:6a:fa:a6:38: - ac:1f:c4:84 -MD5 Fingerprint=BF:60:59:A3:5B:BA:F6:A7:76:42:DA:6F:1A:7B:50:CF -----BEGIN CERTIFICATE----- -MIIEZDCCA0ygAwIBAgIQRL4Mi1AAJLQR0zYwS8AzdzANBgkqhkiG9w0BAQUFADCB -ozELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug -Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho -dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xKzApBgNVBAMTIlVUTi1VU0VSRmlyc3Qt -TmV0d29yayBBcHBsaWNhdGlvbnMwHhcNOTkwNzA5MTg0ODM5WhcNMTkwNzA5MTg1 -NzQ5WjCBozELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0 -IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYD -VQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xKzApBgNVBAMTIlVUTi1VU0VS -Rmlyc3QtTmV0d29yayBBcHBsaWNhdGlvbnMwggEiMA0GCSqGSIb3DQEBAQUAA4IB -DwAwggEKAoIBAQCz+5Gh5DZVhawGNFugmliy+LUPBXeDrjKxdpJo7CNKyXY/45y2 -N3kDuatpjQclthln5LAbGHNhSuh+zdMvZOOmfAz6F4CjDUeJT1FxL+78P/m4FoCH -iZMlIJpDgmkkdihZNaEdwH+DBmQWICzTSaSFtMBhf1EI+GgVkYDLpdXuOzr0hARe -YFmnjDRy7rh4xdE7EkpvfmUnuaRVxblvQ6TFHSyZwFKkeEwVs0CYCGtDxgGwenv1 -axwiP8vv/6jQOkt2FZ7S0cYu49tXGzKiuG/ohqY/cKvlcJKrRB5AUPuco2LkbG6g -yN7igEL66S/ozjIEj3yNtxyjNTwV3Z7DrpelAgMBAAGjgZEwgY4wCwYDVR0PBAQD -AgHGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFPqGydvguul49Uuo1hXf8NPh -ahQ8ME8GA1UdHwRIMEYwRKBCoECGPmh0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9V -VE4tVVNFUkZpcnN0LU5ldHdvcmtBcHBsaWNhdGlvbnMuY3JsMA0GCSqGSIb3DQEB -BQUAA4IBAQCk8yXM0dSRgyLQzDKrm5ZONJFUICU0YV8qAhXhi6r/fWRRzwr/vH3Y -IWp4yy9Rb/hCHTO967V7lMPDqaAt39EpHx3+jz+7qEUqf9FuVSTiuwL7MT++6Lzs -QCv4AdRWOOTKRIK1YSAhZ2X28AvnNPilwpyjXEAfhZOVBt5P1CeptqX8Fs1zMT+4 -ZSfP1FMa8Kxun08FDAOBp4QpxFq9ZFdyrTvPNximmMatBrTcCKME1SmklpoSZ0qM -YEWd8SOasACcaLWYUNPvji6SZbFIPiG+FTAqDbUMo2s/rn9X9R+WfN9v3YIwLGUb -QErNaLly7HF27FSOH4UMAWr6pjisH8SE +MIIFGTCCBAGgAwIBAgIEPki9xDANBgkqhkiG9w0BAQUFADAxMQswCQYDVQQGEwJE +SzEMMAoGA1UEChMDVERDMRQwEgYDVQQDEwtUREMgT0NFUyBDQTAeFw0wMzAyMTEw +ODM5MzBaFw0zNzAyMTEwOTA5MzBaMDExCzAJBgNVBAYTAkRLMQwwCgYDVQQKEwNU +REMxFDASBgNVBAMTC1REQyBPQ0VTIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A +MIIBCgKCAQEArGL2YSCyz8DGhdfjeebM7fI5kqSXLmSjhFuHnEz9pPPEXyG9VhDr +2y5h7JNp46PMvZnDBfwGuMo2HP6QjklMxFaaL1a8z3sM8W9Hpg1DTeLpHTk0zY0s +2RKY+ePhwUp8hjjEqcRhiNJerxomTdXkoCJHhNlktxmW/OwZ5LKXJk5KTMuPJItU +GBxIYXvViGjaXbXqzRowwYCDdlCqT9HU3Tjw7xb04QxQBr/q+3pJoSgrHPb8FTKj +dGqPqcNiKXEx5TukYBdedObaE+3pHx8b0bJoc8YQNHVGEBDjkAB2QMuLt0MJIf+r +TpPGWOmlgtt3xDqZsXKVSQTwtyv6e1mO3QIDAQABo4ICNzCCAjMwDwYDVR0TAQH/ +BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwgewGA1UdIASB5DCB4TCB3gYIKoFQgSkB +AQEwgdEwLwYIKwYBBQUHAgEWI2h0dHA6Ly93d3cuY2VydGlmaWthdC5kay9yZXBv +c2l0b3J5MIGdBggrBgEFBQcCAjCBkDAKFgNUREMwAwIBARqBgUNlcnRpZmlrYXRl +ciBmcmEgZGVubmUgQ0EgdWRzdGVkZXMgdW5kZXIgT0lEIDEuMi4yMDguMTY5LjEu +MS4xLiBDZXJ0aWZpY2F0ZXMgZnJvbSB0aGlzIENBIGFyZSBpc3N1ZWQgdW5kZXIg +T0lEIDEuMi4yMDguMTY5LjEuMS4xLjARBglghkgBhvhCAQEEBAMCAAcwgYEGA1Ud +HwR6MHgwSKBGoESkQjBAMQswCQYDVQQGEwJESzEMMAoGA1UEChMDVERDMRQwEgYD +VQQDEwtUREMgT0NFUyBDQTENMAsGA1UEAxMEQ1JMMTAsoCqgKIYmaHR0cDovL2Ny +bC5vY2VzLmNlcnRpZmlrYXQuZGsvb2Nlcy5jcmwwKwYDVR0QBCQwIoAPMjAwMzAy +MTEwODM5MzBagQ8yMDM3MDIxMTA5MDkzMFowHwYDVR0jBBgwFoAUYLWF7FZkfhIZ +J2cdUBVLc647+RIwHQYDVR0OBBYEFGC1hexWZH4SGSdnHVAVS3OuO/kSMB0GCSqG +SIb2fQdBAAQQMA4bCFY2LjA6NC4wAwIEkDANBgkqhkiG9w0BAQUFAAOCAQEACrom +JkbTc6gJ82sLMJn9iuFXehHTuJTXCRBuo7E4A9G28kNBKWKnctj7fAXmMXAnVBhO +inxO5dHKjHiIzxvTkIvmI/gLDjNDfZziChmPyQE+dF10yYscA+UYyAFMP8uXBV2Y +caaYb7Z8vTd/vuGTJW1v8AqtFxjhA7wHKcitJuj4YfD9IQl+mo6paH1IYnK9AOoB +mbgGglGBTvH1tJFUuSN6AJqfXY3gPGS5GhKSKseCRHI53OI8xthV9RVOyAUO28bQ +YqbsFbS1AoLbrIyigfCbmTH1ICCoiGEKB5+U/NDXG8wuF/MEJ3Zn61SD/aSQfgY9 +BKNDLdr8C2LqL19iUw== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1 (0x1) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=America Online Inc., CN=America Online Root Certification Authority 1 - Validity - Not Before: May 28 06:00:00 2002 GMT - Not After : Nov 19 20:43:00 2037 GMT - Subject: C=US, O=America Online Inc., CN=America Online Root Certification Authority 1 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:a8:2f:e8:a4:69:06:03:47:c3:e9:2a:98:ff:19: - a2:70:9a:c6:50:b2:7e:a5:df:68:4d:1b:7c:0f:b6: - 97:68:7d:2d:a6:8b:97:e9:64:86:c9:a3:ef:a0:86: - bf:60:65:9c:4b:54:88:c2:48:c5:4a:39:bf:14:e3: - 59:55:e5:19:b4:74:c8:b4:05:39:5c:16:a5:e2:95: - 05:e0:12:ae:59:8b:a2:33:68:58:1c:a6:d4:15:b7: - d8:9f:d7:dc:71:ab:7e:9a:bf:9b:8e:33:0f:22:fd: - 1f:2e:e7:07:36:ef:62:39:c5:dd:cb:ba:25:14:23: - de:0c:c6:3d:3c:ce:82:08:e6:66:3e:da:51:3b:16: - 3a:a3:05:7f:a0:dc:87:d5:9c:fc:72:a9:a0:7d:78: - e4:b7:31:55:1e:65:bb:d4:61:b0:21:60:ed:10:32: - 72:c5:92:25:1e:f8:90:4a:18:78:47:df:7e:30:37: - 3e:50:1b:db:1c:d3:6b:9a:86:53:07:b0:ef:ac:06: - 78:f8:84:99:fe:21:8d:4c:80:b6:0c:82:f6:66:70: - 79:1a:d3:4f:a3:cf:f1:cf:46:b0:4b:0f:3e:dd:88: - 62:b8:8c:a9:09:28:3b:7a:c7:97:e1:1e:e5:f4:9f: - c0:c0:ae:24:a0:c8:a1:d9:0f:d6:7b:26:82:69:32: - 3d:a7 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Subject Key Identifier: - 00:AD:D9:A3:F6:79:F6:6E:74:A9:7F:33:3D:81:17:D7:4C:CF:33:DE - X509v3 Authority Key Identifier: - keyid:00:AD:D9:A3:F6:79:F6:6E:74:A9:7F:33:3D:81:17:D7:4C:CF:33:DE - - X509v3 Key Usage: critical - Digital Signature, Certificate Sign, CRL Sign - Signature Algorithm: sha1WithRSAEncryption - 7c:8a:d1:1f:18:37:82:e0:b8:b0:a3:ed:56:95:c8:62:61:9c: - 05:a2:cd:c2:62:26:61:cd:10:16:d7:cc:b4:65:34:d0:11:8a: - ad:a8:a9:05:66:ef:74:f3:6d:5f:9d:99:af:f6:8b:fb:eb:52: - b2:05:98:a2:6f:2a:c5:54:bd:25:bd:5f:ae:c8:86:ea:46:2c: - c1:b3:bd:c1:e9:49:70:18:16:97:08:13:8c:20:e0:1b:2e:3a: - 47:cb:1e:e4:00:30:95:5b:f4:45:a3:c0:1a:b0:01:4e:ab:bd: - c0:23:6e:63:3f:80:4a:c5:07:ed:dc:e2:6f:c7:c1:62:f1:e3: - 72:d6:04:c8:74:67:0b:fa:88:ab:a1:01:c8:6f:f0:14:af:d2: - 99:cd:51:93:7e:ed:2e:38:c7:bd:ce:46:50:3d:72:e3:79:25: - 9d:9b:88:2b:10:20:dd:a5:b8:32:9f:8d:e0:29:df:21:74:86: - 82:db:2f:82:30:c6:c7:35:86:b3:f9:96:5f:46:db:0c:45:fd: - f3:50:c3:6f:c6:c3:48:ad:46:a6:e1:27:47:0a:1d:0e:9b:b6: - c2:77:7f:63:f2:e0:7d:1a:be:fc:e0:df:d7:c7:a7:6c:b0:f9: - ae:ba:3c:fd:74:b4:11:e8:58:0d:80:bc:d3:a8:80:3a:99:ed: - 75:cc:46:7b -MD5 Fingerprint=14:F1:08:AD:9D:FA:64:E2:89:E7:1C:CF:A8:AD:7D:5E -----BEGIN CERTIFICATE----- -MIIDpDCCAoygAwIBAgIBATANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEc -MBoGA1UEChMTQW1lcmljYSBPbmxpbmUgSW5jLjE2MDQGA1UEAxMtQW1lcmljYSBP -bmxpbmUgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAxMB4XDTAyMDUyODA2 -MDAwMFoXDTM3MTExOTIwNDMwMFowYzELMAkGA1UEBhMCVVMxHDAaBgNVBAoTE0Ft -ZXJpY2EgT25saW5lIEluYy4xNjA0BgNVBAMTLUFtZXJpY2EgT25saW5lIFJvb3Qg -Q2VydGlmaWNhdGlvbiBBdXRob3JpdHkgMTCCASIwDQYJKoZIhvcNAQEBBQADggEP -ADCCAQoCggEBAKgv6KRpBgNHw+kqmP8ZonCaxlCyfqXfaE0bfA+2l2h9LaaLl+lk -hsmj76CGv2BlnEtUiMJIxUo5vxTjWVXlGbR0yLQFOVwWpeKVBeASrlmLojNoWBym -1BW32J/X3HGrfpq/m44zDyL9Hy7nBzbvYjnF3cu6JRQj3gzGPTzOggjmZj7aUTsW -OqMFf6Dch9Wc/HKpoH145LcxVR5lu9RhsCFg7RAycsWSJR74kEoYeEfffjA3PlAb -2xzTa5qGUwew76wGePiEmf4hjUyAtgyC9mZweRrTT6PP8c9GsEsPPt2IYriMqQko -O3rHl+Ee5fSfwMCuJKDIodkP1nsmgmkyPacCAwEAAaNjMGEwDwYDVR0TAQH/BAUw -AwEB/zAdBgNVHQ4EFgQUAK3Zo/Z59m50qX8zPYEX10zPM94wHwYDVR0jBBgwFoAU -AK3Zo/Z59m50qX8zPYEX10zPM94wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB -BQUAA4IBAQB8itEfGDeC4Liwo+1WlchiYZwFos3CYiZhzRAW18y0ZTTQEYqtqKkF -Zu90821fnZmv9ov761KyBZiibyrFVL0lvV+uyIbqRizBs73B6UlwGBaXCBOMIOAb -LjpHyx7kADCVW/RFo8AasAFOq73AI25jP4BKxQft3OJvx8Fi8eNy1gTIdGcL+oir -oQHIb/AUr9KZzVGTfu0uOMe9zkZQPXLjeSWdm4grECDdpbgyn43gKd8hdIaC2y+C -MMbHNYaz+ZZfRtsMRf3zUMNvxsNIrUam4SdHCh0Om7bCd39j8uB9Gr784N/Xx6ds -sPmuujz9dLQR6FgNgLzTqIA6me11zEZ7 +MIIDITCCAoqgAwIBAgIBADANBgkqhkiG9w0BAQQFADCByzELMAkGA1UEBhMCWkEx +FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMRowGAYD +VQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT +ZXJ2aWNlcyBEaXZpc2lvbjEhMB8GA1UEAxMYVGhhd3RlIFBlcnNvbmFsIEJhc2lj +IENBMSgwJgYJKoZIhvcNAQkBFhlwZXJzb25hbC1iYXNpY0B0aGF3dGUuY29tMB4X +DTk2MDEwMTAwMDAwMFoXDTIwMTIzMTIzNTk1OVowgcsxCzAJBgNVBAYTAlpBMRUw +EwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UE +ChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRpb24gU2Vy +dmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQZXJzb25hbCBCYXNpYyBD +QTEoMCYGCSqGSIb3DQEJARYZcGVyc29uYWwtYmFzaWNAdGhhd3RlLmNvbTCBnzAN +BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvLyTU23AUE+CFeZIlDWmWr5vQvoPR+53 +dXLdjUmbllegeNTKP1GzaQuRdhciB5dqxFGTS+CN7zeVoQxN2jSQHReJl+A1OFdK +wPQIcOk8RHtQfmGakOMj04gRRif1CwcOu93RfyAKiLlWCy4cgNrx454p7xS9CkT7 +G1sY0b8jkyECAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQQF +AAOBgQAt4plrsD16iddZopQBHyvdEktTwq1/qqcAXJFAVyVKOKqEcLnZgA+le1z7 +c8a914phXAPjLSeoF+CEhULcXpvGt7Jtu3Sv5D/Lp7ew4F2+eIMllNLbgQ95B21P +9DkVWlIBe94y1k049hJcBlDfBVu9FEuh3ym6O0GN92NWod8isQ== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1 (0x1) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=America Online Inc., CN=America Online Root Certification Authority 2 - Validity - Not Before: May 28 06:00:00 2002 GMT - Not After : Sep 29 14:08:00 2037 GMT - Subject: C=US, O=America Online Inc., CN=America Online Root Certification Authority 2 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (4096 bit) - Modulus (4096 bit): - 00:cc:41:45:1d:e9:3d:4d:10:f6:8c:b1:41:c9:e0: - 5e:cb:0d:b7:bf:47:73:d3:f0:55:4d:dd:c6:0c:fa: - b1:66:05:6a:cd:78:b4:dc:02:db:4e:81:f3:d7:a7: - 7c:71:bc:75:63:a0:5d:e3:07:0c:48:ec:25:c4:03: - 20:f4:ff:0e:3b:12:ff:9b:8d:e1:c6:d5:1b:b4:6d: - 22:e3:b1:db:7f:21:64:af:86:bc:57:22:2a:d6:47: - 81:57:44:82:56:53:bd:86:14:01:0b:fc:7f:74:a4: - 5a:ae:f1:ba:11:b5:9b:58:5a:80:b4:37:78:09:33: - 7c:32:47:03:5c:c4:a5:83:48:f4:57:56:6e:81:36: - 27:18:4f:ec:9b:28:c2:d4:b4:d7:7c:0c:3e:0c:2b: - df:ca:04:d7:c6:8e:ea:58:4e:a8:a4:a5:18:1c:6c: - 45:98:a3:41:d1:2d:d2:c7:6d:8d:19:f1:ad:79:b7: - 81:3f:bd:06:82:27:2d:10:58:05:b5:78:05:b9:2f: - db:0c:6b:90:90:7e:14:59:38:bb:94:24:13:e5:d1: - 9d:14:df:d3:82:4d:46:f0:80:39:52:32:0f:e3:84: - b2:7a:43:f2:5e:de:5f:3f:1d:dd:e3:b2:1b:a0:a1: - 2a:23:03:6e:2e:01:15:87:5c:a6:75:75:c7:97:61: - be:de:86:dc:d4:48:db:bd:2a:bf:4a:55:da:e8:7d: - 50:fb:b4:80:17:b8:94:bf:01:3d:ea:da:ba:7c:e0: - 58:67:17:b9:58:e0:88:86:46:67:6c:9d:10:47:58: - 32:d0:35:7c:79:2a:90:a2:5a:10:11:23:35:ad:2f: - cc:e4:4a:5b:a7:c8:27:f2:83:de:5e:bb:5e:77:e7: - e8:a5:6e:63:c2:0d:5d:61:d0:8c:d2:6c:5a:21:0e: - ca:28:a3:ce:2a:e9:95:c7:48:cf:96:6f:1d:92:25: - c8:c6:c6:c1:c1:0c:05:ac:26:c4:d2:75:d2:e1:2a: - 67:c0:3d:5b:a5:9a:eb:cf:7b:1a:a8:9d:14:45:e5: - 0f:a0:9a:65:de:2f:28:bd:ce:6f:94:66:83:48:29: - d8:ea:65:8c:af:93:d9:64:9f:55:57:26:bf:6f:cb: - 37:31:99:a3:60:bb:1c:ad:89:34:32:62:b8:43:21: - 06:72:0c:a1:5c:6d:46:c5:fa:29:cf:30:de:89:dc: - 71:5b:dd:b6:37:3e:df:50:f5:b8:07:25:26:e5:bc: - b5:fe:3c:02:b3:b7:f8:be:43:c1:87:11:94:9e:23: - 6c:17:8a:b8:8a:27:0c:54:47:f0:a9:b3:c0:80:8c: - a0:27:eb:1d:19:e3:07:8e:77:70:ca:2b:f4:7d:76: - e0:78:67 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Subject Key Identifier: - 4D:45:C1:68:38:BB:73:A9:69:A1:20:E7:ED:F5:22:A1:23:14:D7:9E - X509v3 Authority Key Identifier: - keyid:4D:45:C1:68:38:BB:73:A9:69:A1:20:E7:ED:F5:22:A1:23:14:D7:9E - - X509v3 Key Usage: critical - Digital Signature, Certificate Sign, CRL Sign - Signature Algorithm: sha1WithRSAEncryption - 67:6b:06:b9:5f:45:3b:2a:4b:33:b3:e6:1b:6b:59:4e:22:cc: - b9:b7:a4:25:c9:a7:c4:f0:54:96:0b:64:f3:b1:58:4f:5e:51: - fc:b2:97:7b:27:65:c2:e5:ca:e7:0d:0c:25:7b:62:e3:fa:9f: - b4:87:b7:45:46:af:83:a5:97:48:8c:a5:bd:f1:16:2b:9b:76: - 2c:7a:35:60:6c:11:80:97:cc:a9:92:52:e6:2b:e6:69:ed:a9: - f8:36:2d:2c:77:bf:61:48:d1:63:0b:b9:5b:52:ed:18:b0:43: - 42:22:a6:b1:77:ae:de:69:c5:cd:c7:1c:a1:b1:a5:1c:10:fb: - 18:be:1a:70:dd:c1:92:4b:be:29:5a:9d:3f:35:be:e5:7d:51: - f8:55:e0:25:75:23:87:1e:5c:dc:ba:9d:b0:ac:b3:69:db:17: - 83:c9:f7:de:0c:bc:08:dc:91:9e:a8:d0:d7:15:37:73:a5:35: - b8:fc:7e:c5:44:40:06:c3:eb:f8:22:80:5c:47:ce:02:e3:11: - 9f:44:ff:fd:9a:32:cc:7d:64:51:0e:eb:57:26:76:3a:e3:1e: - 22:3c:c2:a6:36:dd:19:ef:a7:fc:12:f3:26:c0:59:31:85:4c: - 9c:d8:cf:df:a4:cc:cc:29:93:ff:94:6d:76:5c:13:08:97:f2: - ed:a5:0b:4d:dd:e8:c9:68:0e:66:d3:00:0e:33:12:5b:bc:95: - e5:32:90:a8:b3:c6:6c:83:ad:77:ee:8b:7e:7e:b1:a9:ab:d3: - e1:f1:b6:c0:b1:ea:88:c0:e7:d3:90:e9:28:92:94:7b:68:7b: - 97:2a:0a:67:2d:85:02:38:10:e4:03:61:d4:da:25:36:c7:08: - 58:2d:a1:a7:51:af:30:0a:49:f5:a6:69:87:07:2d:44:46:76: - 8e:2a:e5:9a:3b:d7:18:a2:fc:9c:38:10:cc:c6:3b:d2:b5:17: - 3a:6f:fd:ae:25:bd:f5:72:59:64:b1:74:2a:38:5f:18:4c:df: - cf:71:04:5a:36:d4:bf:2f:99:9c:e8:d9:ba:b1:95:e6:02:4b: - 21:a1:5b:d5:c1:4f:8f:ae:69:6d:53:db:01:93:b5:5c:1e:18: - dd:64:5a:ca:18:28:3e:63:04:11:fd:1c:8d:00:0f:b8:37:df: - 67:8a:9d:66:a9:02:6a:91:ff:13:ca:2f:5d:83:bc:87:93:6c: - dc:24:51:16:04:25:66:fa:b3:d9:c2:ba:29:be:9a:48:38:82: - 99:f4:bf:3b:4a:31:19:f9:bf:8e:21:33:14:ca:4f:54:5f:fb: - ce:fb:8f:71:7f:fd:5e:19:a0:0f:4b:91:b8:c4:54:bc:06:b0: - 45:8f:26:91:a2:8e:fe:a9 -MD5 Fingerprint=D6:ED:3C:CA:E2:66:0F:AF:10:43:0D:77:9B:04:09:BF -----BEGIN CERTIFICATE----- -MIIFpDCCA4ygAwIBAgIBATANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEc -MBoGA1UEChMTQW1lcmljYSBPbmxpbmUgSW5jLjE2MDQGA1UEAxMtQW1lcmljYSBP -bmxpbmUgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAyMB4XDTAyMDUyODA2 -MDAwMFoXDTM3MDkyOTE0MDgwMFowYzELMAkGA1UEBhMCVVMxHDAaBgNVBAoTE0Ft -ZXJpY2EgT25saW5lIEluYy4xNjA0BgNVBAMTLUFtZXJpY2EgT25saW5lIFJvb3Qg -Q2VydGlmaWNhdGlvbiBBdXRob3JpdHkgMjCCAiIwDQYJKoZIhvcNAQEBBQADggIP -ADCCAgoCggIBAMxBRR3pPU0Q9oyxQcngXssNt79Hc9PwVU3dxgz6sWYFas14tNwC -206B89enfHG8dWOgXeMHDEjsJcQDIPT/DjsS/5uN4cbVG7RtIuOx238hZK+GvFci -KtZHgVdEglZTvYYUAQv8f3SkWq7xuhG1m1hagLQ3eAkzfDJHA1zEpYNI9FdWboE2 -JxhP7JsowtS013wMPgwr38oE18aO6lhOqKSlGBxsRZijQdEt0sdtjRnxrXm3gT+9 -BoInLRBYBbV4Bbkv2wxrkJB+FFk4u5QkE+XRnRTf04JNRvCAOVIyD+OEsnpD8l7e -Xz8d3eOyG6ChKiMDbi4BFYdcpnV1x5dhvt6G3NRI270qv0pV2uh9UPu0gBe4lL8B -PeraunzgWGcXuVjgiIZGZ2ydEEdYMtA1fHkqkKJaEBEjNa0vzORKW6fIJ/KD3l67 -Xnfn6KVuY8INXWHQjNJsWiEOyiijzirplcdIz5ZvHZIlyMbGwcEMBawmxNJ10uEq -Z8A9W6Wa6897GqidFEXlD6CaZd4vKL3Ob5Rmg0gp2OpljK+T2WSfVVcmv2/LNzGZ -o2C7HK2JNDJiuEMhBnIMoVxtRsX6Kc8w3onccVvdtjc+31D1uAclJuW8tf48ArO3 -+L5DwYcRlJ4jbBeKuIonDFRH8KmzwICMoCfrHRnjB453cMor9H124HhnAgMBAAGj -YzBhMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFE1FwWg4u3OpaaEg5+31IqEj -FNeeMB8GA1UdIwQYMBaAFE1FwWg4u3OpaaEg5+31IqEjFNeeMA4GA1UdDwEB/wQE -AwIBhjANBgkqhkiG9w0BAQUFAAOCAgEAZ2sGuV9FOypLM7PmG2tZTiLMubekJcmn -xPBUlgtk87FYT15R/LKXeydlwuXK5w0MJXti4/qftIe3RUavg6WXSIylvfEWK5t2 -LHo1YGwRgJfMqZJS5ivmae2p+DYtLHe/YUjRYwu5W1LtGLBDQiKmsXeu3mnFzccc -obGlHBD7GL4acN3Bkku+KVqdPzW+5X1R+FXgJXUjhx5c3LqdsKyzadsXg8n33gy8 -CNyRnqjQ1xU3c6U1uPx+xURABsPr+CKAXEfOAuMRn0T//ZoyzH1kUQ7rVyZ2OuMe -IjzCpjbdGe+n/BLzJsBZMYVMnNjP36TMzCmT/5RtdlwTCJfy7aULTd3oyWgOZtMA -DjMSW7yV5TKQqLPGbIOtd+6Lfn6xqavT4fG2wLHqiMDn05DpKJKUe2h7lyoKZy2F -AjgQ5ANh1NolNscIWC2hp1GvMApJ9aZphwctREZ2jirlmjvXGKL8nDgQzMY70rUX -Om/9riW99XJZZLF0KjhfGEzfz3EEWjbUvy+ZnOjZurGV5gJLIaFb1cFPj65pbVPb -AZO1XB4Y3WRayhgoPmMEEf0cjQAPuDffZ4qdZqkCapH/E8ovXYO8h5Ns3CRRFgQl -Zvqz2cK6Kb6aSDiCmfS/O0oxGfm/jiEzFMpPVF/7zvuPcX/9XhmgD0uRuMRUvAaw -RY8mkaKO/qk= +MIIDLTCCApagAwIBAgIBADANBgkqhkiG9w0BAQQFADCB0TELMAkGA1UEBhMCWkEx +FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMRowGAYD +VQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT +ZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVt +YWlsIENBMSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3dGUu +Y29tMB4XDTk2MDEwMTAwMDAwMFoXDTIwMTIzMTIzNTk1OVowgdExCzAJBgNVBAYT +AlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEa +MBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRp +b24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBG +cmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhh +d3RlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1GnX1LCUZFtx6UfY +DFG26nKRsIRefS0Nj3sS34UldSh0OkIsYyeflXtL734Zhx2G6qPduc6WZBrCFG5E +rHzmj+hND3EfQDimAKOHePb5lIZererAXnbr2RSjXW56fAylS1V/Bhkpf56aJtVq +uzgkCGqYx7Hao5iR/Xnb5VrEHLkCAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zAN +BgkqhkiG9w0BAQQFAAOBgQDH7JJ+Tvj1lqVnYiqk8E0RYNBvjWBYYawmu1I1XAjP +MPuoSpaKH2JCI4wXD/S6ZJwXrEcp352YXtJsYHFcoqzceePnbgBHH7UNKOgCneSa +/RP0ptl8sfjcXyMmCZGAc9AUG95DqYMl8uacLxXK/qarigd1iwzdUYRr5PjRznei +gQ== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 13:86:35:4d:1d:3f:06:f2:c1:f9:65:05:d5:90:1c:62 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=VISA, OU=Visa International Service Association, CN=Visa eCommerce Root - Validity - Not Before: Jun 26 02:18:36 2002 GMT - Not After : Jun 24 00:16:12 2022 GMT - Subject: C=US, O=VISA, OU=Visa International Service Association, CN=Visa eCommerce Root - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:af:57:de:56:1e:6e:a1:da:60:b1:94:27:cb:17: - db:07:3f:80:85:4f:c8:9c:b6:d0:f4:6f:4f:cf:99: - d8:e1:db:c2:48:5c:3a:ac:39:33:c7:1f:6a:8b:26: - 3d:2b:35:f5:48:b1:91:c1:02:4e:04:96:91:7b:b0: - 33:f0:b1:14:4e:11:6f:b5:40:af:1b:45:a5:4a:ef: - 7e:b6:ac:f2:a0:1f:58:3f:12:46:60:3c:8d:a1:e0: - 7d:cf:57:3e:33:1e:fb:47:f1:aa:15:97:07:55:66: - a5:b5:2d:2e:d8:80:59:b2:a7:0d:b7:46:ec:21:63: - ff:35:ab:a5:02:cf:2a:f4:4c:fe:7b:f5:94:5d:84: - 4d:a8:f2:60:8f:db:0e:25:3c:9f:73:71:cf:94:df: - 4a:ea:db:df:72:38:8c:f3:96:bd:f1:17:bc:d2:ba: - 3b:45:5a:c6:a7:f6:c6:17:8b:01:9d:fc:19:a8:2a: - 83:16:b8:3a:48:fe:4e:3e:a0:ab:06:19:e9:53:f3: - 80:13:07:ed:2d:bf:3f:0a:3c:55:20:39:2c:2c:00: - 69:74:95:4a:bc:20:b2:a9:79:e5:18:89:91:a8:dc: - 1c:4d:ef:bb:7e:37:0b:5d:fe:39:a5:88:52:8c:00: - 6c:ec:18:7c:41:bd:f6:8b:75:77:ba:60:9d:84:e7: - fe:2d - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - X509v3 Subject Key Identifier: - 15:38:83:0F:3F:2C:3F:70:33:1E:CD:46:FE:07:8C:20:E0:D7:C3:B7 - Signature Algorithm: sha1WithRSAEncryption - 5f:f1:41:7d:7c:5c:08:b9:2b:e0:d5:92:47:fa:67:5c:a5:13: - c3:03:21:9b:2b:4c:89:46:cf:59:4d:c9:fe:a5:40:b6:63:cd: - dd:71:28:95:67:11:cc:24:ac:d3:44:6c:71:ae:01:20:6b:03: - a2:8f:18:b7:29:3a:7d:e5:16:60:53:78:3c:c0:af:15:83:f7: - 8f:52:33:24:bd:64:93:97:ee:8b:f7:db:18:a8:6d:71:b3:f7: - 2c:17:d0:74:25:69:f7:fe:6b:3c:94:be:4d:4b:41:8c:4e:e2: - 73:d0:e3:90:22:73:43:cd:f3:ef:ea:73:ce:45:8a:b0:a6:49: - ff:4c:7d:9d:71:88:c4:76:1d:90:5b:1d:ee:fd:cc:f7:ee:fd: - 60:a5:b1:7a:16:71:d1:16:d0:7c:12:3c:6c:69:97:db:ae:5f: - 39:9a:70:2f:05:3c:19:46:04:99:20:36:d0:60:6e:61:06:bb: - 16:42:8c:70:f7:30:fb:e0:db:66:a3:00:01:bd:e6:2c:da:91: - 5f:a0:46:8b:4d:6a:9c:3d:3d:dd:05:46:fe:76:bf:a0:0a:3c: - e4:00:e6:27:b7:ff:84:2d:de:ba:22:27:96:10:71:eb:22:ed: - df:df:33:9c:cf:e3:ad:ae:8e:d4:8e:e6:4f:51:af:16:92:e0: - 5c:f6:07:0f -MD5 Fingerprint=FC:11:B8:D8:08:93:30:00:6D:23:F9:7E:EB:52:1E:02 -----BEGIN CERTIFICATE----- -MIIDojCCAoqgAwIBAgIQE4Y1TR0/BvLB+WUF1ZAcYjANBgkqhkiG9w0BAQUFADBr -MQswCQYDVQQGEwJVUzENMAsGA1UEChMEVklTQTEvMC0GA1UECxMmVmlzYSBJbnRl -cm5hdGlvbmFsIFNlcnZpY2UgQXNzb2NpYXRpb24xHDAaBgNVBAMTE1Zpc2EgZUNv -bW1lcmNlIFJvb3QwHhcNMDIwNjI2MDIxODM2WhcNMjIwNjI0MDAxNjEyWjBrMQsw -CQYDVQQGEwJVUzENMAsGA1UEChMEVklTQTEvMC0GA1UECxMmVmlzYSBJbnRlcm5h -dGlvbmFsIFNlcnZpY2UgQXNzb2NpYXRpb24xHDAaBgNVBAMTE1Zpc2EgZUNvbW1l -cmNlIFJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvV95WHm6h -2mCxlCfLF9sHP4CFT8icttD0b0/Pmdjh28JIXDqsOTPHH2qLJj0rNfVIsZHBAk4E -lpF7sDPwsRROEW+1QK8bRaVK7362rPKgH1g/EkZgPI2h4H3PVz4zHvtH8aoVlwdV -ZqW1LS7YgFmypw23RuwhY/81q6UCzyr0TP579ZRdhE2o8mCP2w4lPJ9zcc+U30rq -299yOIzzlr3xF7zSujtFWsan9sYXiwGd/BmoKoMWuDpI/k4+oKsGGelT84ATB+0t -vz8KPFUgOSwsAGl0lUq8ILKpeeUYiZGo3BxN77t+Nwtd/jmliFKMAGzsGHxBvfaL -dXe6YJ2E5/4tAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQD -AgEGMB0GA1UdDgQWBBQVOIMPPyw/cDMezUb+B4wg4NfDtzANBgkqhkiG9w0BAQUF -AAOCAQEAX/FBfXxcCLkr4NWSR/pnXKUTwwMhmytMiUbPWU3J/qVAtmPN3XEolWcR -zCSs00Rsca4BIGsDoo8Ytyk6feUWYFN4PMCvFYP3j1IzJL1kk5fui/fbGKhtcbP3 -LBfQdCVp9/5rPJS+TUtBjE7ic9DjkCJzQ83z7+pzzkWKsKZJ/0x9nXGIxHYdkFsd -7v3M9+79YKWxehZx0RbQfBI8bGmX265fOZpwLwU8GUYEmSA20GBuYQa7FkKMcPcw -++DbZqMAAb3mLNqRX6BGi01qnD093QVG/na/oAo85ADmJ7f/hC3euiInlhBx6yLt -398znM/jra6O1I7mT1GvFpLgXPYHDw== +MIIDKTCCApKgAwIBAgIBADANBgkqhkiG9w0BAQQFADCBzzELMAkGA1UEBhMCWkEx +FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMRowGAYD +VQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT +ZXJ2aWNlcyBEaXZpc2lvbjEjMCEGA1UEAxMaVGhhd3RlIFBlcnNvbmFsIFByZW1p +dW0gQ0ExKjAoBgkqhkiG9w0BCQEWG3BlcnNvbmFsLXByZW1pdW1AdGhhd3RlLmNv +bTAeFw05NjAxMDEwMDAwMDBaFw0yMDEyMzEyMzU5NTlaMIHPMQswCQYDVQQGEwJa +QTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xGjAY +BgNVBAoTEVRoYXd0ZSBDb25zdWx0aW5nMSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9u +IFNlcnZpY2VzIERpdmlzaW9uMSMwIQYDVQQDExpUaGF3dGUgUGVyc29uYWwgUHJl +bWl1bSBDQTEqMCgGCSqGSIb3DQEJARYbcGVyc29uYWwtcHJlbWl1bUB0aGF3dGUu +Y29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJZtn4B0TPuYwu8KHvE0Vs +Bd/eJxZRNkERbGw77f4QfRKe5ZtCmv5gMcNmt3M6SK5O0DI3lIi1DbbZ8/JE2dWI +Et12TfIa/G8jHnrx2JhFTgcQ7xZC0EN1bUre4qrJMf8fAHB8Zs8QJQi6+u4A6UYD +ZicRFTuqW/KY3TZCstqIdQIDAQABoxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqG +SIb3DQEBBAUAA4GBAGk2ifc0KjNyL2071CKyuG+axTZmDhs8obF1Wub9NdP4qPIH +b4Vnjt4rueIXsDqg8A6iAJrf8xQVbrvIhVqYgPn/vnQdPfP+MCXRNzRn+qVxeTBh +KXLA4CxM+1bkOqhv5TJZUtt1KFBZDPgLGeSs2a+WjS9Q2wfD6h+rM+D1KzGJ -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1002 (0x3ea) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 2 CA/emailAddress=certificate@trustcenter.de - Validity - Not Before: Mar 9 11:59:59 1998 GMT - Not After : Jan 1 11:59:59 2011 GMT - Subject: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 2 CA/emailAddress=certificate@trustcenter.de - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:da:38:e8:ed:32:00:29:71:83:01:0d:bf:8c:01: - dc:da:c6:ad:39:a4:a9:8a:2f:d5:8b:5c:68:5f:50: - c6:62:f5:66:bd:ca:91:22:ec:aa:1d:51:d7:3d:b3: - 51:b2:83:4e:5d:cb:49:b0:f0:4c:55:e5:6b:2d:c7: - 85:0b:30:1c:92:4e:82:d4:ca:02:ed:f7:6f:be:dc: - e0:e3:14:b8:05:53:f2:9a:f4:56:8b:5a:9e:85:93: - d1:b4:82:56:ae:4d:bb:a8:4b:57:16:bc:fe:f8:58: - 9e:f8:29:8d:b0:7b:cd:78:c9:4f:ac:8b:67:0c:f1: - 9c:fb:fc:57:9b:57:5c:4f:0d - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Key Usage: critical - Digital Signature, Certificate Sign, CRL Sign - Netscape CA Policy Url: - http://www.trustcenter.de/guidelines - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - Signature Algorithm: md5WithRSAEncryption - 84:52:fb:28:df:ff:1f:75:01:bc:01:be:04:56:97:6a:74:42: - 24:31:83:f9:46:b1:06:8a:89:cf:96:2c:33:bf:8c:b5:5f:7a: - 72:a1:85:06:ce:86:f8:05:8e:e8:f9:25:ca:da:83:8c:06:ac: - eb:36:6d:85:91:34:04:36:f4:42:f0:f8:79:2e:0a:48:5c:ab: - cc:51:4f:78:76:a0:d9:ac:19:bd:2a:d1:69:04:28:91:ca:36: - 10:27:80:57:5b:d2:5c:f5:c2:5b:ab:64:81:63:74:51:f4:97: - bf:cd:12:28:f7:4d:66:7f:a7:f0:1c:01:26:78:b2:66:47:70: - 51:64 -MD5 Fingerprint=B8:16:33:4C:4C:4C:F2:D8:D3:4D:06:B4:A6:5B:40:03 -----BEGIN CERTIFICATE----- -MIIDXDCCAsWgAwIBAgICA+owDQYJKoZIhvcNAQEEBQAwgbwxCzAJBgNVBAYTAkRF -MRAwDgYDVQQIEwdIYW1idXJnMRAwDgYDVQQHEwdIYW1idXJnMTowOAYDVQQKEzFU -QyBUcnVzdENlbnRlciBmb3IgU2VjdXJpdHkgaW4gRGF0YSBOZXR3b3JrcyBHbWJI -MSIwIAYDVQQLExlUQyBUcnVzdENlbnRlciBDbGFzcyAyIENBMSkwJwYJKoZIhvcN -AQkBFhpjZXJ0aWZpY2F0ZUB0cnVzdGNlbnRlci5kZTAeFw05ODAzMDkxMTU5NTla -Fw0xMTAxMDExMTU5NTlaMIG8MQswCQYDVQQGEwJERTEQMA4GA1UECBMHSGFtYnVy -ZzEQMA4GA1UEBxMHSGFtYnVyZzE6MDgGA1UEChMxVEMgVHJ1c3RDZW50ZXIgZm9y -IFNlY3VyaXR5IGluIERhdGEgTmV0d29ya3MgR21iSDEiMCAGA1UECxMZVEMgVHJ1 -c3RDZW50ZXIgQ2xhc3MgMiBDQTEpMCcGCSqGSIb3DQEJARYaY2VydGlmaWNhdGVA -dHJ1c3RjZW50ZXIuZGUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANo46O0y -AClxgwENv4wB3NrGrTmkqYov1YtcaF9QxmL1Zr3KkSLsqh1R1z2zUbKDTl3LSbDw -TFXlay3HhQswHJJOgtTKAu33b77c4OMUuAVT8pr0VotanoWT0bSCVq5Nu6hLVxa8 -/vhYnvgpjbB7zXjJT6yLZwzxnPv8V5tXXE8NAgMBAAGjazBpMA8GA1UdEwEB/wQF -MAMBAf8wDgYDVR0PAQH/BAQDAgGGMDMGCWCGSAGG+EIBCAQmFiRodHRwOi8vd3d3 -LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwEQYJYIZIAYb4QgEBBAQDAgAHMA0G -CSqGSIb3DQEBBAUAA4GBAIRS+yjf/x91AbwBvgRWl2p0QiQxg/lGsQaKic+WLDO/ -jLVfenKhhQbOhvgFjuj5Jcrag4wGrOs2bYWRNAQ29ELw+HkuCkhcq8xRT3h2oNms -Gb0q0WkEKJHKNhAngFdb0lz1wlurZIFjdFH0l7/NEij3TWZ/p/AcASZ4smZHcFFk +MIIDJzCCApCgAwIBAgIBATANBgkqhkiG9w0BAQQFADCBzjELMAkGA1UEBhMCWkEx +FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYD +VQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlv +biBTZXJ2aWNlcyBEaXZpc2lvbjEhMB8GA1UEAxMYVGhhd3RlIFByZW1pdW0gU2Vy +dmVyIENBMSgwJgYJKoZIhvcNAQkBFhlwcmVtaXVtLXNlcnZlckB0aGF3dGUuY29t +MB4XDTk2MDgwMTAwMDAwMFoXDTIwMTIzMTIzNTk1OVowgc4xCzAJBgNVBAYTAlpB +MRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEdMBsG +A1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp +b24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl +cnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv +bTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo847kkE +VdbQ7xwblRZH7xhINTpS9CtqBo87L+pW46+GjZ4X9560ZXUCTe/LCaIhUdib0GfQ +ug2SBhRz1JPLlyoAnFxODLz6FVL88kRu2hFKbgifLy3j+ao6hnO2RlNYyIkFvYMR +uHM/qgeN9EJN50CdHDcCAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG +9w0BAQQFAAOBgQAmSCwWwlj66BZ0DKqqX1Q/8tfJeGBeXm43YyJ3Nn6yF8Q0ufUI +hfzJATj/Tb7yFkJD57taRvvBxhEf8UqwKEbJw8RCfbz6q1lu1bdRiBHjpIUZa4JM +pAwSremkrj/xw0llmozFyD4lt5SZu5IycQfwhl7tUCemDaYj+bvLpgcUQg== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1003 (0x3eb) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 3 CA/emailAddress=certificate@trustcenter.de - Validity - Not Before: Mar 9 11:59:59 1998 GMT - Not After : Jan 1 11:59:59 2011 GMT - Subject: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 3 CA/emailAddress=certificate@trustcenter.de - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:b6:b4:c1:35:05:2e:0d:8d:ec:a0:40:6a:1c:0e: - 27:a6:50:92:6b:50:1b:07:de:2e:e7:76:cc:e0:da: - fc:84:a8:5e:8c:63:6a:2b:4d:d9:4e:02:76:11:c1: - 0b:f2:8d:79:ca:00:b6:f1:b0:0e:d7:fb:a4:17:3d: - af:ab:69:7a:96:27:bf:af:33:a1:9a:2a:59:aa:c4: - b5:37:08:f2:12:a5:31:b6:43:f5:32:96:71:28:28: - ab:8d:28:86:df:bb:ee:e3:0c:7d:30:d6:c3:52:ab: - 8f:5d:27:9c:6b:c0:a3:e7:05:6b:57:49:44:b3:6e: - ea:64:cf:d2:8e:7a:50:77:77 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Key Usage: critical - Digital Signature, Certificate Sign, CRL Sign - Netscape CA Policy Url: - http://www.trustcenter.de/guidelines - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - Signature Algorithm: md5WithRSAEncryption - 16:3d:c6:cd:c1:bb:85:71:85:46:9f:3e:20:8f:51:28:99:ec: - 2d:45:21:63:23:5b:04:bb:4c:90:b8:88:92:04:4d:bd:7d:01: - a3:3f:f6:ec:ce:f1:de:fe:7d:e5:e1:3e:bb:c6:ab:5e:0b:dd: - 3d:96:c4:cb:a9:d4:f9:26:e6:06:4e:9e:0c:a5:7a:ba:6e:c3: - 7c:82:19:d1:c7:b1:b1:c3:db:0d:8e:9b:40:7c:37:0b:f1:5d: - e8:fd:1f:90:88:a5:0e:4e:37:64:21:a8:4e:8d:b4:9f:f1:de: - 48:ad:d5:56:18:52:29:8b:47:34:12:09:d4:bb:92:35:ef:0f: - db:34 -MD5 Fingerprint=5F:94:4A:73:22:B8:F7:D1:31:EC:59:39:F7:8E:FE:6E -----BEGIN CERTIFICATE----- -MIIDXDCCAsWgAwIBAgICA+swDQYJKoZIhvcNAQEEBQAwgbwxCzAJBgNVBAYTAkRF -MRAwDgYDVQQIEwdIYW1idXJnMRAwDgYDVQQHEwdIYW1idXJnMTowOAYDVQQKEzFU -QyBUcnVzdENlbnRlciBmb3IgU2VjdXJpdHkgaW4gRGF0YSBOZXR3b3JrcyBHbWJI -MSIwIAYDVQQLExlUQyBUcnVzdENlbnRlciBDbGFzcyAzIENBMSkwJwYJKoZIhvcN -AQkBFhpjZXJ0aWZpY2F0ZUB0cnVzdGNlbnRlci5kZTAeFw05ODAzMDkxMTU5NTla -Fw0xMTAxMDExMTU5NTlaMIG8MQswCQYDVQQGEwJERTEQMA4GA1UECBMHSGFtYnVy -ZzEQMA4GA1UEBxMHSGFtYnVyZzE6MDgGA1UEChMxVEMgVHJ1c3RDZW50ZXIgZm9y -IFNlY3VyaXR5IGluIERhdGEgTmV0d29ya3MgR21iSDEiMCAGA1UECxMZVEMgVHJ1 -c3RDZW50ZXIgQ2xhc3MgMyBDQTEpMCcGCSqGSIb3DQEJARYaY2VydGlmaWNhdGVA -dHJ1c3RjZW50ZXIuZGUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALa0wTUF -Lg2N7KBAahwOJ6ZQkmtQGwfeLud2zODa/ISoXoxjaitN2U4CdhHBC/KNecoAtvGw -Dtf7pBc9r6tpepYnv68zoZoqWarEtTcI8hKlMbZD9TKWcSgoq40oht+77uMMfTDW -w1Krj10nnGvAo+cFa1dJRLNu6mTP0o56UHd3AgMBAAGjazBpMA8GA1UdEwEB/wQF -MAMBAf8wDgYDVR0PAQH/BAQDAgGGMDMGCWCGSAGG+EIBCAQmFiRodHRwOi8vd3d3 -LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwEQYJYIZIAYb4QgEBBAQDAgAHMA0G -CSqGSIb3DQEBBAUAA4GBABY9xs3Bu4VxhUafPiCPUSiZ7C1FIWMjWwS7TJC4iJIE -Tb19AaM/9uzO8d7+feXhPrvGq14L3T2WxMup1Pkm5gZOngylerpuw3yCGdHHsbHD -2w2Om0B8NwvxXej9H5CIpQ5ON2QhqE6NtJ/x3kit1VYYUimLRzQSCdS7kjXvD9s0 +MIIDEzCCAnygAwIBAgIBATANBgkqhkiG9w0BAQQFADCBxDELMAkGA1UEBhMCWkEx +FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYD +VQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlv +biBTZXJ2aWNlcyBEaXZpc2lvbjEZMBcGA1UEAxMQVGhhd3RlIFNlcnZlciBDQTEm +MCQGCSqGSIb3DQEJARYXc2VydmVyLWNlcnRzQHRoYXd0ZS5jb20wHhcNOTYwODAx +MDAwMDAwWhcNMjAxMjMxMjM1OTU5WjCBxDELMAkGA1UEBhMCWkExFTATBgNVBAgT +DFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYDVQQKExRUaGF3 +dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBTZXJ2aWNl +cyBEaXZpc2lvbjEZMBcGA1UEAxMQVGhhd3RlIFNlcnZlciBDQTEmMCQGCSqGSIb3 +DQEJARYXc2VydmVyLWNlcnRzQHRoYXd0ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQAD +gY0AMIGJAoGBANOkUG7I/1Zr5s9dtuoMaHVHoqrC2oQl/Kj0R1HahbUgdJSGHg91 +yekIYfUGbTBuFRkC6VLAYttNmZ7iagxEOM3+vuNkCXDF/rFrKbYvScg71CcEJRCX +L+eQbcAoQpnXTEPew/UhbVSfXcNY4cDk2VuwuNy0e982OsK1ZiIS1ocNAgMBAAGj +EzARMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAB/pMaVz7lcxG +7oWDTSEwjsrZqG9JGubaUeNgcGyEYRGhGshIPllDfU+VPaGLtwtimHp1it2ITk6e +QNuozDJ0uW8NxuOzRAvZim+aKZuZGCg70eNAKJpaPNW15yAbi8qkq43pUdniTCxZ +qdq5snUb9kLy78fyGPmJvKP/iiMucEc= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 65568 (0x10020) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA - Validity - Not Before: Jun 11 10:46:39 2002 GMT - Not After : Jun 11 10:46:39 2027 GMT - Subject: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:ce:b1:c1:2e:d3:4f:7c:cd:25:ce:18:3e:4f:c4: - 8c:6f:80:6a:73:c8:5b:51:f8:9b:d2:dc:bb:00:5c: - b1:a0:fc:75:03:ee:81:f0:88:ee:23:52:e9:e6:15: - 33:8d:ac:2d:09:c5:76:f9:2b:39:80:89:e4:97:4b: - 90:a5:a8:78:f8:73:43:7b:a4:61:b0:d8:58:cc:e1: - 6c:66:7e:9c:f3:09:5e:55:63:84:d5:a8:ef:f3:b1: - 2e:30:68:b3:c4:3c:d8:ac:6e:8d:99:5a:90:4e:34: - dc:36:9a:8f:81:88:50:b7:6d:96:42:09:f3:d7:95: - 83:0d:41:4b:b0:6a:6b:f8:fc:0f:7e:62:9f:67:c4: - ed:26:5f:10:26:0f:08:4f:f0:a4:57:28:ce:8f:b8: - ed:45:f6:6e:ee:25:5d:aa:6e:39:be:e4:93:2f:d9: - 47:a0:72:eb:fa:a6:5b:af:ca:53:3f:e2:0e:c6:96: - 56:11:6e:f7:e9:66:a9:26:d8:7f:95:53:ed:0a:85: - 88:ba:4f:29:a5:42:8c:5e:b6:fc:85:20:00:aa:68: - 0b:a1:1a:85:01:9c:c4:46:63:82:88:b6:22:b1:ee: - fe:aa:46:59:7e:cf:35:2c:d5:b6:da:5d:f7:48:33: - 14:54:b6:eb:d9:6f:ce:cd:88:d6:ab:1b:da:96:3b: - 1d:59 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - Signature Algorithm: sha1WithRSAEncryption - b8:8d:ce:ef:e7:14:ba:cf:ee:b0:44:92:6c:b4:39:3e:a2:84: - 6e:ad:b8:21:77:d2:d4:77:82:87:e6:20:41:81:ee:e2:f8:11: - b7:63:d1:17:37:be:19:76:24:1c:04:1a:4c:eb:3d:aa:67:6f: - 2d:d4:cd:fe:65:31:70:c5:1b:a6:02:0a:ba:60:7b:6d:58:c2: - 9a:49:fe:63:32:0b:6b:e3:3a:c0:ac:ab:3b:b0:e8:d3:09:51: - 8c:10:83:c6:34:e0:c5:2b:e0:1a:b6:60:14:27:6c:32:77:8c: - bc:b2:72:98:cf:cd:cc:3f:b9:c8:24:42:14:d6:57:fc:e6:26: - 43:a9:1d:e5:80:90:ce:03:54:28:3e:f7:3f:d3:f8:4d:ed:6a: - 0a:3a:93:13:9b:3b:14:23:13:63:9c:3f:d1:87:27:79:e5:4c: - 51:e3:01:ad:85:5d:1a:3b:b1:d5:73:10:a4:d3:f2:bc:6e:64: - f5:5a:56:90:a8:c7:0e:4c:74:0f:2e:71:3b:f7:c8:47:f4:69: - 6f:15:f2:11:5e:83:1e:9c:7c:52:ae:fd:02:da:12:a8:59:67: - 18:db:bc:70:dd:9b:b1:69:ed:80:ce:89:40:48:6a:0e:35:ca: - 29:66:15:21:94:2c:e8:60:2a:9b:85:4a:40:f3:6b:8a:24:ec: - 06:16:2c:73 -MD5 Fingerprint=2C:8F:9F:66:1D:18:90:B1:47:26:9D:8E:86:82:8C:A9 -----BEGIN CERTIFICATE----- -MIIDDDCCAfSgAwIBAgIDAQAgMA0GCSqGSIb3DQEBBQUAMD4xCzAJBgNVBAYTAlBM -MRswGQYDVQQKExJVbml6ZXRvIFNwLiB6IG8uby4xEjAQBgNVBAMTCUNlcnR1bSBD -QTAeFw0wMjA2MTExMDQ2MzlaFw0yNzA2MTExMDQ2MzlaMD4xCzAJBgNVBAYTAlBM -MRswGQYDVQQKExJVbml6ZXRvIFNwLiB6IG8uby4xEjAQBgNVBAMTCUNlcnR1bSBD -QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM6xwS7TT3zNJc4YPk/E -jG+AanPIW1H4m9LcuwBcsaD8dQPugfCI7iNS6eYVM42sLQnFdvkrOYCJ5JdLkKWo -ePhzQ3ukYbDYWMzhbGZ+nPMJXlVjhNWo7/OxLjBos8Q82KxujZlakE403Daaj4GI -ULdtlkIJ89eVgw1BS7Bqa/j8D35in2fE7SZfECYPCE/wpFcozo+47UX2bu4lXapu -Ob7kky/ZR6By6/qmW6/KUz/iDsaWVhFu9+lmqSbYf5VT7QqFiLpPKaVCjF62/IUg -AKpoC6EahQGcxEZjgoi2IrHu/qpGWX7PNSzVttpd90gzFFS269lvzs2I1qsb2pY7 -HVkCAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEA -uI3O7+cUus/usESSbLQ5PqKEbq24IXfS1HeCh+YgQYHu4vgRt2PRFze+GXYkHAQa -TOs9qmdvLdTN/mUxcMUbpgIKumB7bVjCmkn+YzILa+M6wKyrO7Do0wlRjBCDxjTg -xSvgGrZgFCdsMneMvLJymM/NzD+5yCRCFNZX/OYmQ6kd5YCQzgNUKD73P9P4Te1q -CjqTE5s7FCMTY5w/0YcneeVMUeMBrYVdGjux1XMQpNPyvG5k9VpWkKjHDkx0Dy5x -O/fIR/RpbxXyEV6DHpx8Uq79AtoSqFlnGNu8cN2bsWntgM6JQEhqDjXKKWYVIZQs -6GAqm4VKQPNriiTsBhYscw== +MIICoTCCAgqgAwIBAgIBADANBgkqhkiG9w0BAQQFADCBizELMAkGA1UEBhMCWkEx +FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTEUMBIGA1UEBxMLRHVyYmFudmlsbGUxDzAN +BgNVBAoTBlRoYXd0ZTEdMBsGA1UECxMUVGhhd3RlIENlcnRpZmljYXRpb24xHzAd +BgNVBAMTFlRoYXd0ZSBUaW1lc3RhbXBpbmcgQ0EwHhcNOTcwMTAxMDAwMDAwWhcN +MjAxMjMxMjM1OTU5WjCBizELMAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4g +Q2FwZTEUMBIGA1UEBxMLRHVyYmFudmlsbGUxDzANBgNVBAoTBlRoYXd0ZTEdMBsG +A1UECxMUVGhhd3RlIENlcnRpZmljYXRpb24xHzAdBgNVBAMTFlRoYXd0ZSBUaW1l +c3RhbXBpbmcgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANYrWHhhRYZT +6jR7UZztsOYuGA7+4F+oJ9O0yeB8WU4WDnNUYMF/9p8u6TqFJBU820cEY8OexJQa +Wt9MevPZQx08EHp5JduQ/vBR5zDWQQD9nyjfeb6Uu522FOMjhdepQeBMpHmwKxqL +8vg7ij5FrHGSALSQQZj7X+36ty6K+Ig3AgMBAAGjEzARMA8GA1UdEwEB/wQFMAMB +Af8wDQYJKoZIhvcNAQEEBQADgYEAZ9viwuaHPUCDhjc1fR/OmsMMZiCouqoEiYbC +9RAIDb/LogWK0E02PvTX72nGXuSwlG9KuefeW4i2e9vjJ+V2w/A1wcu1J5szedyQ +pgCed/r8zSeUQhac0xxo7L9c3eWpexAKMnRUEzGLhQOEkbdYATAUOK8oyvyxUBkZ +CayJSdM= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1 (0x1) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services - Validity - Not Before: Jan 1 00:00:00 2004 GMT - Not After : Dec 31 23:59:59 2028 GMT - Subject: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:be:40:9d:f4:6e:e1:ea:76:87:1c:4d:45:44:8e: - be:46:c8:83:06:9d:c1:2a:fe:18:1f:8e:e4:02:fa: - f3:ab:5d:50:8a:16:31:0b:9a:06:d0:c5:70:22:cd: - 49:2d:54:63:cc:b6:6e:68:46:0b:53:ea:cb:4c:24: - c0:bc:72:4e:ea:f1:15:ae:f4:54:9a:12:0a:c3:7a: - b2:33:60:e2:da:89:55:f3:22:58:f3:de:dc:cf:ef: - 83:86:a2:8c:94:4f:9f:68:f2:98:90:46:84:27:c7: - 76:bf:e3:cc:35:2c:8b:5e:07:64:65:82:c0:48:b0: - a8:91:f9:61:9f:76:20:50:a8:91:c7:66:b5:eb:78: - 62:03:56:f0:8a:1a:13:ea:31:a3:1e:a0:99:fd:38: - f6:f6:27:32:58:6f:07:f5:6b:b8:fb:14:2b:af:b7: - aa:cc:d6:63:5f:73:8c:da:05:99:a8:38:a8:cb:17: - 78:36:51:ac:e9:9e:f4:78:3a:8d:cf:0f:d9:42:e2: - 98:0c:ab:2f:9f:0e:01:de:ef:9f:99:49:f1:2d:df: - ac:74:4d:1b:98:b5:47:c5:e5:29:d1:f9:90:18:c7: - 62:9c:be:83:c7:26:7b:3e:8a:25:c7:c0:dd:9d:e6: - 35:68:10:20:9d:8f:d8:de:d2:c3:84:9c:0d:5e:e8: - 2f:c9 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 CRL Distribution Points: - URI:http://crl.comodoca.com/AAACertificateServices.crl - URI:http://crl.comodo.net/AAACertificateServices.crl - - Signature Algorithm: sha1WithRSAEncryption - 08:56:fc:02:f0:9b:e8:ff:a4:fa:d6:7b:c6:44:80:ce:4f:c4: - c5:f6:00:58:cc:a6:b6:bc:14:49:68:04:76:e8:e6:ee:5d:ec: - 02:0f:60:d6:8d:50:18:4f:26:4e:01:e3:e6:b0:a5:ee:bf:bc: - 74:54:41:bf:fd:fc:12:b8:c7:4f:5a:f4:89:60:05:7f:60:b7: - 05:4a:f3:f6:f1:c2:bf:c4:b9:74:86:b6:2d:7d:6b:cc:d2:f3: - 46:dd:2f:c6:e0:6a:c3:c3:34:03:2c:7d:96:dd:5a:c2:0e:a7: - 0a:99:c1:05:8b:ab:0c:2f:f3:5c:3a:cf:6c:37:55:09:87:de: - 53:40:6c:58:ef:fc:b6:ab:65:6e:04:f6:1b:dc:3c:e0:5a:15: - c6:9e:d9:f1:59:48:30:21:65:03:6c:ec:e9:21:73:ec:9b:03: - a1:e0:37:ad:a0:15:18:8f:fa:ba:02:ce:a7:2c:a9:10:13:2c: - d4:e5:08:26:ab:22:97:60:f8:90:5e:74:d4:a2:9a:53:bd:f2: - a9:68:e0:a2:6e:c2:d7:6c:b1:a3:0f:9e:bf:eb:68:e7:56:f2: - ae:f2:e3:2b:38:3a:09:81:b5:6b:85:d7:be:2d:ed:3f:1a:b7: - b2:63:e2:f5:62:2c:82:d4:6a:00:41:50:f1:39:83:9f:95:e9: - 36:96:98:6e -MD5 Fingerprint=49:79:04:B0:EB:87:19:AC:47:B0:BC:11:51:9B:74:D0 -----BEGIN CERTIFICATE----- -MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb -MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow -GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj -YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL -MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE -BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM -GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP -ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua -BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe -3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4 -YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR -rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm -ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU -oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF -MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v -QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t -b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF -AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q -GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz -Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2 -G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi -l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3 -smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg== +MIIEXjCCA0agAwIBAgIQRL4Mi1AAIbQR0ypoBqmtaTANBgkqhkiG9w0BAQUFADCB +kzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug +Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho +dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xGzAZBgNVBAMTElVUTiAtIERBVEFDb3Jw +IFNHQzAeFw05OTA2MjQxODU3MjFaFw0xOTA2MjQxOTA2MzBaMIGTMQswCQYDVQQG +EwJVUzELMAkGA1UECBMCVVQxFzAVBgNVBAcTDlNhbHQgTGFrZSBDaXR5MR4wHAYD +VQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxITAfBgNVBAsTGGh0dHA6Ly93d3cu +dXNlcnRydXN0LmNvbTEbMBkGA1UEAxMSVVROIC0gREFUQUNvcnAgU0dDMIIBIjAN +BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3+5YEKIrblXEjr8uRgnn4AgPLit6 +E5Qbvfa2gI5lBZMAHryv4g+OGQ0SR+ysraP6LnD43m77VkIVni5c7yPeIbkFdicZ +D0/Ww5y0vpQZY/KmEQrrU0icvvIpOxboGqBMpsn0GFlowHDyUwDAXlCCpVZvNvlK +4ESGoE1O1kduSUrLZ9emxAW5jh70/P/N5zbgnAVssjMiFdC04MwXwLLA9P4yPykq +lXvY8qdOD1R8oQ2AswkDwf9c3V6aPryuvEeKaq5xyh+xKrhfQgUL7EYw0XILyulW +bfXv33i+Ybqypa4ETLyorGkVl73v67SMvzX41MPRKA5cOp9wGDMgd8SirwIDAQAB +o4GrMIGoMAsGA1UdDwQEAwIBxjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRT +MtGzz3/64PGgXYVOktKeRR20TzA9BgNVHR8ENjA0MDKgMKAuhixodHRwOi8vY3Js +LnVzZXJ0cnVzdC5jb20vVVROLURBVEFDb3JwU0dDLmNybDAqBgNVHSUEIzAhBggr +BgEFBQcDAQYKKwYBBAGCNwoDAwYJYIZIAYb4QgQBMA0GCSqGSIb3DQEBBQUAA4IB +AQAnNZcAiosovcYzMB4p/OL31ZjUQLtgyr+rFywJNn9Q+kHcrpY6CiM+iVnJowft +Gzet/Hy+UUla3joKVAgWRcKZsYfNjGjgaQPpxE6YsjuMFrMOoAyYUJuTqXAJyCyj +j98C5OBxOvG0I3KgqgHf35g+FFCgMSa9KOlaMCZ1+XtgHI3zzVAmbQQnmt/VDUVH +KWss5nbZqSl9Mt3JNjy9rjXxEZ4du5A/EkdOjtd+D2JzHVImOBwYSf0wdJrE5SIv +2MCN7ZF6TACPcn9d2t0bi0Vr591pl6jFVkwPDPafepE39peC4N1xaf92P2BNPM/3 +mfnGV/TJVTl4uix5yaaIK/QI -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1 (0x1) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=Secure Certificate Services - Validity - Not Before: Jan 1 00:00:00 2004 GMT - Not After : Dec 31 23:59:59 2028 GMT - Subject: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=Secure Certificate Services - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:c0:71:33:82:8a:d0:70:eb:73:87:82:40:d5:1d: - e4:cb:c9:0e:42:90:f9:de:34:b9:a1:ba:11:f4:25: - 85:f3:cc:72:6d:f2:7b:97:6b:b3:07:f1:77:24:91: - 5f:25:8f:f6:74:3d:e4:80:c2:f8:3c:0d:f3:bf:40: - ea:f7:c8:52:d1:72:6f:ef:c8:ab:41:b8:6e:2e:17: - 2a:95:69:0c:cd:d2:1e:94:7b:2d:94:1d:aa:75:d7: - b3:98:cb:ac:bc:64:53:40:bc:8f:ac:ac:36:cb:5c: - ad:bb:dd:e0:94:17:ec:d1:5c:d0:bf:ef:a5:95:c9: - 90:c5:b0:ac:fb:1b:43:df:7a:08:5d:b7:b8:f2:40: - 1b:2b:27:9e:50:ce:5e:65:82:88:8c:5e:d3:4e:0c: - 7a:ea:08:91:b6:36:aa:2b:42:fb:ea:c2:a3:39:e5: - db:26:38:ad:8b:0a:ee:19:63:c7:1c:24:df:03:78: - da:e6:ea:c1:47:1a:0b:0b:46:09:dd:02:fc:de:cb: - 87:5f:d7:30:63:68:a1:ae:dc:32:a1:ba:be:fe:44: - ab:68:b6:a5:17:15:fd:bd:d5:a7:a7:9a:e4:44:33: - e9:88:8e:fc:ed:51:eb:93:71:4e:ad:01:e7:44:8e: - ab:2d:cb:a8:fe:01:49:48:f0:c0:dd:c7:68:d8:92: - fe:3d - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - 3C:D8:93:88:C2:C0:82:09:CC:01:99:06:93:20:E9:9E:70:09:63:4F - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 CRL Distribution Points: - URI:http://crl.comodoca.com/SecureCertificateServices.crl - URI:http://crl.comodo.net/SecureCertificateServices.crl - - Signature Algorithm: sha1WithRSAEncryption - 87:01:6d:23:1d:7e:5b:17:7d:c1:61:32:cf:8f:e7:f3:8a:94: - 59:66:e0:9e:28:a8:5e:d3:b7:f4:34:e6:aa:39:b2:97:16:c5: - 82:6f:32:a4:e9:8c:e7:af:fd:ef:c2:e8:b9:4b:aa:a3:f4:e6: - da:8d:65:21:fb:ba:80:eb:26:28:85:1a:fe:39:8c:de:5b:04: - 04:b4:54:f9:a3:67:9e:41:fa:09:52:cc:05:48:a8:c9:3f:21: - 04:1e:ce:48:6b:fc:85:e8:c2:7b:af:7f:b7:cc:f8:5f:3a:fd: - 35:c6:0d:ef:97:dc:4c:ab:11:e1:6b:cb:31:d1:6c:fb:48:80: - ab:dc:9c:37:b8:21:14:4b:0d:71:3d:ec:83:33:6e:d1:6e:32: - 16:ec:98:c7:16:8b:59:a6:34:ab:05:57:2d:93:f7:aa:13:cb: - d2:13:e2:b7:2e:3b:cd:6b:50:17:09:68:3e:b5:26:57:ee:b6: - e0:b6:dd:b9:29:80:79:7d:8f:a3:f0:a4:28:a4:15:c4:85:f4: - 27:d4:6b:bf:e5:5c:e4:65:02:76:54:b4:e3:37:66:24:d3:19: - 61:c8:52:10:e5:8b:37:9a:b9:a9:f9:1d:bf:ea:99:92:61:96: - ff:01:cd:a1:5f:0d:bc:71:bc:0e:ac:0b:1d:47:45:1d:c1:ec: - 7c:ec:fd:29 -MD5 Fingerprint=D3:D9:BD:AE:9F:AC:67:24:B3:C8:1B:52:E1:B9:A9:BD -----BEGIN CERTIFICATE----- -MIIEPzCCAyegAwIBAgIBATANBgkqhkiG9w0BAQUFADB+MQswCQYDVQQGEwJHQjEb -MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow -GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEkMCIGA1UEAwwbU2VjdXJlIENlcnRp -ZmljYXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVow -fjELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G -A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxJDAiBgNV -BAMMG1NlY3VyZSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEB -BQADggEPADCCAQoCggEBAMBxM4KK0HDrc4eCQNUd5MvJDkKQ+d40uaG6EfQlhfPM -cm3ye5drswfxdySRXyWP9nQ95IDC+DwN879A6vfIUtFyb+/Iq0G4bi4XKpVpDM3S -HpR7LZQdqnXXs5jLrLxkU0C8j6ysNstcrbvd4JQX7NFc0L/vpZXJkMWwrPsbQ996 -CF23uPJAGysnnlDOXmWCiIxe004MeuoIkbY2qitC++rCoznl2yY4rYsK7hljxxwk -3wN42ubqwUcaCwtGCd0C/N7Lh1/XMGNooa7cMqG6vv5Eq2i2pRcV/b3Vp6ea5EQz -6YiO/O1R65NxTq0B50SOqy3LqP4BSUjwwN3HaNiS/j0CAwEAAaOBxzCBxDAdBgNV -HQ4EFgQUPNiTiMLAggnMAZkGkyDpnnAJY08wDgYDVR0PAQH/BAQDAgEGMA8GA1Ud -EwEB/wQFMAMBAf8wgYEGA1UdHwR6MHgwO6A5oDeGNWh0dHA6Ly9jcmwuY29tb2Rv -Y2EuY29tL1NlY3VyZUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDmgN6A1hjNodHRw -Oi8vY3JsLmNvbW9kby5uZXQvU2VjdXJlQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmww -DQYJKoZIhvcNAQEFBQADggEBAIcBbSMdflsXfcFhMs+P5/OKlFlm4J4oqF7Tt/Q0 -5qo5spcWxYJvMqTpjOev/e/C6LlLqqP05tqNZSH7uoDrJiiFGv45jN5bBAS0VPmj -Z55B+glSzAVIqMk/IQQezkhr/IXownuvf7fM+F86/TXGDe+X3EyrEeFryzHRbPtI -gKvcnDe4IRRLDXE97IMzbtFuMhbsmMcWi1mmNKsFVy2T96oTy9IT4rcuO81rUBcJ -aD61JlfutuC23bkpgHl9j6PwpCikFcSF9CfUa7/lXORlAnZUtOM3ZiTTGWHIUhDl -izeauan5Hb/qmZJhlv8BzaFfDbxxvA6sCx1HRR3B7Hzs/Sk= +MIIEojCCA4qgAwIBAgIQRL4Mi1AAJLQR0zYlJWfJiTANBgkqhkiG9w0BAQUFADCB +rjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug +Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho +dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMTLVVUTi1VU0VSRmlyc3Qt +Q2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbDAeFw05OTA3MDkxNzI4NTBa +Fw0xOTA3MDkxNzM2NThaMIGuMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQxFzAV +BgNVBAcTDlNhbHQgTGFrZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5l +dHdvcmsxITAfBgNVBAsTGGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTE2MDQGA1UE +AxMtVVROLVVTRVJGaXJzdC1DbGllbnQgQXV0aGVudGljYXRpb24gYW5kIEVtYWls +MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsjmFpPJ9q0E7YkY3rs3B +YHW8OWX5ShpHornMSMxqmNVNNRm5pELlzkniii8efNIxB8dOtINknS4p1aJkxIW9 +hVE1eaROaJB7HHqkkqgX8pgV8pPMyaQylbsMTzC9mKALi+VuG6JG+ni8om+rWV6l +L8/K2m2qL+usobNqqrcuZzWLeeEeaYji5kbNoKXqvgvOdjp6Dpvq/NonWz1zHyLm +SGHGTPNpsaguG7bUMSAsvIKKjqQOpdeJQ/wWWq8dcdcRWdq6hw2v+vPhwvCkxWeM +1tZUOt4KpLoDd7NlyP0e03RiqhjKaJMeoYV+9Udly/hNVyh00jT/MLbu9mIwFIws +6wIDAQABo4G5MIG2MAsGA1UdDwQEAwIBxjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud +DgQWBBSJgmd9xJ0mcABLtFBIfN49rgRufTBYBgNVHR8EUTBPME2gS6BJhkdodHRw +Oi8vY3JsLnVzZXJ0cnVzdC5jb20vVVROLVVTRVJGaXJzdC1DbGllbnRBdXRoZW50 +aWNhdGlvbmFuZEVtYWlsLmNybDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH +AwQwDQYJKoZIhvcNAQEFBQADggEBALFtYV2mGn98q0rkMPxTbyUkxsrt4jFcKw7u +7mFVbwQ+zznexRtJlOTrIEy05p5QLnLZjfWqo7NK2lYcYJeA3IKirUq9iiv/Cwm0 +xtcgBEXkzYABurorbs6q15L+5K/r9CYdFip/bDCVNy8zEqx/3cfREYxRmLLQo5HQ +rfafnoOTHh1CuEava2bwm3/q4wMC5QJRwarVNZ1yQAOJujEdxRBoUp7fooXFXAim +eOZTT7Hot9MUnpOmw2TjrH5xzbyf6QMbzPvprDHBr3wVdAKZw7JHpsIyYdfHb0gk +USeh1YdV8nuPmD0Wnu51tvjQjvLzxq4oW6fw8zYX/MMF08oDSlQ= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1 (0x1) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=Trusted Certificate Services - Validity - Not Before: Jan 1 00:00:00 2004 GMT - Not After : Dec 31 23:59:59 2028 GMT - Subject: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=Trusted Certificate Services - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:df:71:6f:36:58:53:5a:f2:36:54:57:80:c4:74: - 08:20:ed:18:7f:2a:1d:e6:35:9a:1e:25:ac:9c:e5: - 96:7e:72:52:a0:15:42:db:59:dd:64:7a:1a:d0:b8: - 7b:dd:39:15:bc:55:48:c4:ed:3a:00:ea:31:11:ba: - f2:71:74:1a:67:b8:cf:33:cc:a8:31:af:a3:e3:d7: - 7f:bf:33:2d:4c:6a:3c:ec:8b:c3:92:d2:53:77:24: - 74:9c:07:6e:70:fc:bd:0b:5b:76:ba:5f:f2:ff:d7: - 37:4b:4a:60:78:f7:f0:fa:ca:70:b4:ea:59:aa:a3: - ce:48:2f:a9:c3:b2:0b:7e:17:72:16:0c:a6:07:0c: - 1b:38:cf:c9:62:b7:3f:a0:93:a5:87:41:f2:b7:70: - 40:77:d8:be:14:7c:e3:a8:c0:7a:8e:e9:63:6a:d1: - 0f:9a:c6:d2:f4:8b:3a:14:04:56:d4:ed:b8:cc:6e: - f5:fb:e2:2c:58:bd:7f:4f:6b:2b:f7:60:24:58:24: - ce:26:ef:34:91:3a:d5:e3:81:d0:b2:f0:04:02:d7: - 5b:b7:3e:92:ac:6b:12:8a:f9:e4:05:b0:3b:91:49: - 5c:b2:eb:53:ea:f8:9f:47:86:ee:bf:95:c0:c0:06: - 9f:d2:5b:5e:11:1b:f4:c7:04:35:29:d2:55:5c:e4: - ed:eb - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - C5:7B:58:BD:ED:DA:25:69:D2:F7:59:16:A8:B3:32:C0:7B:27:5B:F4 - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 CRL Distribution Points: - URI:http://crl.comodoca.com/TrustedCertificateServices.crl - URI:http://crl.comodo.net/TrustedCertificateServices.crl - - Signature Algorithm: sha1WithRSAEncryption - c8:93:81:3b:89:b4:af:b8:84:12:4c:8d:d2:f0:db:70:ba:57: - 86:15:34:10:b9:2f:7f:1e:b0:a8:89:60:a1:8a:c2:77:0c:50: - 4a:9b:00:8b:d8:8b:f4:41:e2:d0:83:8a:4a:1c:14:06:b0:a3: - 68:05:70:31:30:a7:53:9b:0e:e9:4a:a0:58:69:67:0e:ae:9d: - f6:a5:2c:41:bf:3c:06:6b:e4:59:cc:6d:10:f1:96:6f:1f:df: - f4:04:02:a4:9f:45:3e:c8:d8:fa:36:46:44:50:3f:82:97:91: - 1f:28:db:18:11:8c:2a:e4:65:83:57:12:12:8c:17:3f:94:36: - fe:5d:b0:c0:04:77:13:b8:f4:15:d5:3f:38:cc:94:3a:55:d0: - ac:98:f5:ba:00:5f:e0:86:19:81:78:2f:28:c0:7e:d3:cc:42: - 0a:f5:ae:50:a0:d1:3e:c6:a1:71:ec:3f:a0:20:8c:66:3a:89: - b4:8e:d4:d8:b1:4d:25:47:ee:2f:88:c8:b5:e1:05:45:c0:be: - 14:71:de:7a:fd:8e:7b:7d:4d:08:96:a5:12:73:f0:2d:ca:37: - 27:74:12:27:4c:cb:b6:97:e9:d9:ae:08:6d:5a:39:40:dd:05: - 47:75:6a:5a:21:b3:a3:18:cf:4e:f7:2e:57:b7:98:70:5e:c8: - c4:78:b0:62 -MD5 Fingerprint=91:1B:3F:6E:CD:9E:AB:EE:07:FE:1F:71:D2:B3:61:27 -----BEGIN CERTIFICATE----- -MIIEQzCCAyugAwIBAgIBATANBgkqhkiG9w0BAQUFADB/MQswCQYDVQQGEwJHQjEb -MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow -GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDElMCMGA1UEAwwcVHJ1c3RlZCBDZXJ0 -aWZpY2F0ZSBTZXJ2aWNlczAeFw0wNDAxMDEwMDAwMDBaFw0yODEyMzEyMzU5NTla -MH8xCzAJBgNVBAYTAkdCMRswGQYDVQQIDBJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO -BgNVBAcMB1NhbGZvcmQxGjAYBgNVBAoMEUNvbW9kbyBDQSBMaW1pdGVkMSUwIwYD -VQQDDBxUcnVzdGVkIENlcnRpZmljYXRlIFNlcnZpY2VzMIIBIjANBgkqhkiG9w0B -AQEFAAOCAQ8AMIIBCgKCAQEA33FvNlhTWvI2VFeAxHQIIO0Yfyod5jWaHiWsnOWW -fnJSoBVC21ndZHoa0Lh73TkVvFVIxO06AOoxEbrycXQaZ7jPM8yoMa+j49d/vzMt -TGo87IvDktJTdyR0nAducPy9C1t2ul/y/9c3S0pgePfw+spwtOpZqqPOSC+pw7IL -fhdyFgymBwwbOM/JYrc/oJOlh0Hyt3BAd9i+FHzjqMB6juljatEPmsbS9Is6FARW -1O24zG71++IsWL1/T2sr92AkWCTOJu80kTrV44HQsvAEAtdbtz6SrGsSivnkBbA7 -kUlcsutT6vifR4buv5XAwAaf0lteERv0xwQ1KdJVXOTt6wIDAQABo4HJMIHGMB0G -A1UdDgQWBBTFe1i97doladL3WRaoszLAeydb9DAOBgNVHQ8BAf8EBAMCAQYwDwYD -VR0TAQH/BAUwAwEB/zCBgwYDVR0fBHwwejA8oDqgOIY2aHR0cDovL2NybC5jb21v -ZG9jYS5jb20vVHJ1c3RlZENlcnRpZmljYXRlU2VydmljZXMuY3JsMDqgOKA2hjRo -dHRwOi8vY3JsLmNvbW9kby5uZXQvVHJ1c3RlZENlcnRpZmljYXRlU2VydmljZXMu -Y3JsMA0GCSqGSIb3DQEBBQUAA4IBAQDIk4E7ibSvuIQSTI3S8NtwuleGFTQQuS9/ -HrCoiWChisJ3DFBKmwCL2Iv0QeLQg4pKHBQGsKNoBXAxMKdTmw7pSqBYaWcOrp32 -pSxBvzwGa+RZzG0Q8ZZvH9/0BAKkn0U+yNj6NkZEUD+Cl5EfKNsYEYwq5GWDVxIS -jBc/lDb+XbDABHcTuPQV1T84zJQ6VdCsmPW6AF/ghhmBeC8owH7TzEIK9a5QoNE+ -xqFx7D+gIIxmOom0jtTYsU0lR+4viMi14QVFwL4Ucd56/Y57fU0IlqUSc/Atyjcn -dBInTMu2l+nZrghtWjlA3QVHdWpaIbOjGM9O9y5Xt5hwXsjEeLBi +MIIEdDCCA1ygAwIBAgIQRL4Mi1AAJLQR0zYq/mUK/TANBgkqhkiG9w0BAQUFADCB +lzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug +Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho +dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xHzAdBgNVBAMTFlVUTi1VU0VSRmlyc3Qt +SGFyZHdhcmUwHhcNOTkwNzA5MTgxMDQyWhcNMTkwNzA5MTgxOTIyWjCBlzELMAkG +A1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEe +MBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExhodHRwOi8v +d3d3LnVzZXJ0cnVzdC5jb20xHzAdBgNVBAMTFlVUTi1VU0VSRmlyc3QtSGFyZHdh +cmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCx98M4P7Sof885glFn +0G2f0v9Y8+efK+wNiVSZuTiZFvfgIXlIwrthdBKWHTxqctU8EGc6Oe0rE81m65UJ +M6Rsl7HoxuzBdXmcRl6Nq9Bq/bkqVRcQVLMZ8Jr28bFdtqdt++BxF2uiiPsA3/4a +MXcMmgF6sTLjKwEHOG7DpV4jvEWbe1DByTCP2+UretNb+zNAHqDVmBe8i4fDidNd +oI6yqqr2jmmIBsX6iSHzCJ1pLgkzmykNRg+MzEk0sGlRvfkGzWitZky8PqxhvQqI +DsjfPe58BEydCl5rkdbux+0ojatNh4lz0G6k0B4WixThdkQDf2Os5M1JnMWS9Ksy +oUhbAgMBAAGjgbkwgbYwCwYDVR0PBAQDAgHGMA8GA1UdEwEB/wQFMAMBAf8wHQYD +VR0OBBYEFKFyXyYbKJhDlV0HN9WFlp1L0sNFMEQGA1UdHwQ9MDswOaA3oDWGM2h0 +dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VVE4tVVNFUkZpcnN0LUhhcmR3YXJlLmNy +bDAxBgNVHSUEKjAoBggrBgEFBQcDAQYIKwYBBQUHAwUGCCsGAQUFBwMGBggrBgEF +BQcDBzANBgkqhkiG9w0BAQUFAAOCAQEARxkP3nTGmZev/K0oXnWO6y1n7k57K9cM +//bey1WiCuFMVGWTYGufEpytXoMs61quwOQt9ABjHbjAbPLPSbtNk28Gpgoiskli +CE7/yMgUsogWXecB5BKV5UU0s4tpvc+0hY91UZ59Ojg6FEgSxvunOxqNDYJAB+gE +CJChicsZUN/KHAG8HQQZexB2lzvukJDKxA4fFm517zP4029bHpbj4HR3dHuKom4t +3XbWOTCC8KucUvIqx69JXn7HaOWCgchqJ/kniCrVWFCVH/A7HFe7fRQ5YiuayZSS +KqMiDP+JJn1fIytH1xUdqWqeUQ0qUZ6B+dQ7XnASfxAynB67nfhmqA== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA Chained CAs Certification Authority, CN=IPS CA Chained CAs Certification Authority/emailAddress=ips@mail.ips.es - Validity - Not Before: Dec 29 00:53:58 2001 GMT - Not After : Dec 27 00:53:58 2025 GMT - Subject: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA Chained CAs Certification Authority, CN=IPS CA Chained CAs Certification Authority/emailAddress=ips@mail.ips.es - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:dc:56:92:49:b2:94:20:bc:98:4f:50:eb:68:a4: - a7:49:0b:bf:d2:31:e8:c7:4f:c2:86:0b:fa:68:fd: - 43:5a:8a:f3:60:92:35:99:38:bb:4d:03:52:21:5b: - f0:37:99:35:e1:41:20:81:85:81:05:71:81:9d:b4: - 95:19:a9:5f:76:34:2e:63:37:35:57:8e:b4:1f:42: - 3f:15:5c:e1:7a:c1:5f:13:18:32:31:c9:ad:be:a3: - c7:83:66:1e:b9:9c:04:13:cb:69:c1:06:de:30:06: - bb:33:a3:b5:1f:f0:8f:6f:ce:ff:96:e8:54:be:66: - 80:ae:6b:db:41:84:36:a2:3d - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - A1:AD:31:B1:F9:3E:E1:17:A6:C8:AB:34:FC:52:87:09:1E:62:52:41 - X509v3 Authority Key Identifier: - keyid:A1:AD:31:B1:F9:3E:E1:17:A6:C8:AB:34:FC:52:87:09:1E:62:52:41 - DirName:/C=ES/ST=Barcelona/L=Barcelona/O=IPS Internet publishing Services s.l./O=ips@mail.ips.es C.I.F. B-60929452/OU=IPS CA Chained CAs Certification Authority/CN=IPS CA Chained CAs Certification Authority/emailAddress=ips@mail.ips.es - serial:00 - - X509v3 Basic Constraints: - CA:TRUE - X509v3 Key Usage: - Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign, Encipher Only, Decipher Only - X509v3 Extended Key Usage: - TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, Time Stamping, Microsoft Individual Code Signing, Microsoft Commercial Code Signing, Microsoft Trust List Signing, Microsoft Encrypted File System - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 Subject Alternative Name: - email:ips@mail.ips.es - X509v3 Issuer Alternative Name: - email:ips@mail.ips.es - Netscape Comment: - Chained CA Certificate issued by http://www.ips.es/ - Netscape Base Url: - http://www.ips.es/ips2002/ - Netscape CA Revocation Url: - http://www.ips.es/ips2002/ips2002CAC.crl - Netscape Revocation Url: - http://www.ips.es/ips2002/revocationCAC.html? - Netscape Renewal Url: - http://www.ips.es/ips2002/renewalCAC.html? - Netscape CA Policy Url: - http://www.ips.es/ips2002/policyCAC.html - X509v3 CRL Distribution Points: - URI:http://www.ips.es/ips2002/ips2002CAC.crl - URI:http://wwwback.ips.es/ips2002/ips2002CAC.crl - - Authority Information Access: - OCSP - URI:http://ocsp.ips.es/ - - Signature Algorithm: sha1WithRSAEncryption - 44:72:30:9d:56:58:a2:41:1b:28:b7:95:e1:a6:1a:95:5f:a7: - 78:40:2b:ef:db:96:4a:fc:4c:71:63:d9:73:95:bd:02:e2:a2: - 06:c7:be:97:2a:93:80:34:86:03:fa:dc:d8:3d:1e:07:cd:1e: - 73:43:24:60:f5:1d:61:dc:dc:96:a0:bc:fb:1d:e3:e7:12:00: - 27:33:02:c0:c0:2b:53:3d:d8:6b:03:81:a3:db:d6:93:95:20: - ef:d3:96:7e:26:90:89:9c:26:9b:cd:6f:66:ab:ed:03:22:44: - 38:cc:59:bd:9f:db:f6:07:a2:01:7f:26:c4:63:f5:25:42:5e: - 62:bd -MD5 Fingerprint=8D:72:51:DB:A0:3A:CF:20:77:DF:F2:65:06:5E:DF:EF -----BEGIN CERTIFICATE----- -MIIH9zCCB2CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCARwxCzAJBgNVBAYTAkVT -MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE -ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE -ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjEzMDEGA1UECxMq -SVBTIENBIENoYWluZWQgQ0FzIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MTMwMQYD -VQQDEypJUFMgQ0EgQ2hhaW5lZCBDQXMgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkx -HjAcBgkqhkiG9w0BCQEWD2lwc0BtYWlsLmlwcy5lczAeFw0wMTEyMjkwMDUzNTha -Fw0yNTEyMjcwMDUzNThaMIIBHDELMAkGA1UEBhMCRVMxEjAQBgNVBAgTCUJhcmNl -bG9uYTESMBAGA1UEBxMJQmFyY2Vsb25hMS4wLAYDVQQKEyVJUFMgSW50ZXJuZXQg -cHVibGlzaGluZyBTZXJ2aWNlcyBzLmwuMSswKQYDVQQKFCJpcHNAbWFpbC5pcHMu -ZXMgQy5JLkYuICBCLTYwOTI5NDUyMTMwMQYDVQQLEypJUFMgQ0EgQ2hhaW5lZCBD -QXMgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxMzAxBgNVBAMTKklQUyBDQSBDaGFp -bmVkIENBcyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEeMBwGCSqGSIb3DQEJARYP -aXBzQG1haWwuaXBzLmVzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDcVpJJ -spQgvJhPUOtopKdJC7/SMejHT8KGC/po/UNaivNgkjWZOLtNA1IhW/A3mTXhQSCB -hYEFcYGdtJUZqV92NC5jNzVXjrQfQj8VXOF6wV8TGDIxya2+o8eDZh65nAQTy2nB -Bt4wBrszo7Uf8I9vzv+W6FS+ZoCua9tBhDaiPQIDAQABo4IEQzCCBD8wHQYDVR0O -BBYEFKGtMbH5PuEXpsirNPxShwkeYlJBMIIBTgYDVR0jBIIBRTCCAUGAFKGtMbH5 -PuEXpsirNPxShwkeYlJBoYIBJKSCASAwggEcMQswCQYDVQQGEwJFUzESMBAGA1UE -CBMJQmFyY2Vsb25hMRIwEAYDVQQHEwlCYXJjZWxvbmExLjAsBgNVBAoTJUlQUyBJ -bnRlcm5ldCBwdWJsaXNoaW5nIFNlcnZpY2VzIHMubC4xKzApBgNVBAoUImlwc0Bt -YWlsLmlwcy5lcyBDLkkuRi4gIEItNjA5Mjk0NTIxMzAxBgNVBAsTKklQUyBDQSBD -aGFpbmVkIENBcyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEzMDEGA1UEAxMqSVBT -IENBIENoYWluZWQgQ0FzIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MR4wHAYJKoZI -hvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOCAQAwDAYDVR0TBAUwAwEB/zAMBgNVHQ8E -BQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMG -CCsGAQUFBwMEBggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYB -BAGCNwoDAQYKKwYBBAGCNwoDBDARBglghkgBhvhCAQEEBAMCAAcwGgYDVR0RBBMw -EYEPaXBzQG1haWwuaXBzLmVzMBoGA1UdEgQTMBGBD2lwc0BtYWlsLmlwcy5lczBC -BglghkgBhvhCAQ0ENRYzQ2hhaW5lZCBDQSBDZXJ0aWZpY2F0ZSBpc3N1ZWQgYnkg -aHR0cDovL3d3dy5pcHMuZXMvMCkGCWCGSAGG+EIBAgQcFhpodHRwOi8vd3d3Lmlw -cy5lcy9pcHMyMDAyLzA3BglghkgBhvhCAQQEKhYoaHR0cDovL3d3dy5pcHMuZXMv -aXBzMjAwMi9pcHMyMDAyQ0FDLmNybDA8BglghkgBhvhCAQMELxYtaHR0cDovL3d3 -dy5pcHMuZXMvaXBzMjAwMi9yZXZvY2F0aW9uQ0FDLmh0bWw/MDkGCWCGSAGG+EIB -BwQsFipodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL3JlbmV3YWxDQUMuaHRtbD8w -NwYJYIZIAYb4QgEIBCoWKGh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvcG9saWN5 -Q0FDLmh0bWwwbQYDVR0fBGYwZDAuoCygKoYoaHR0cDovL3d3dy5pcHMuZXMvaXBz -MjAwMi9pcHMyMDAyQ0FDLmNybDAyoDCgLoYsaHR0cDovL3d3d2JhY2suaXBzLmVz -L2lwczIwMDIvaXBzMjAwMkNBQy5jcmwwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUF -BzABhhNodHRwOi8vb2NzcC5pcHMuZXMvMA0GCSqGSIb3DQEBBQUAA4GBAERyMJ1W -WKJBGyi3leGmGpVfp3hAK+/blkr8THFj2XOVvQLiogbHvpcqk4A0hgP63Ng9HgfN -HnNDJGD1HWHc3JagvPsd4+cSACczAsDAK1M92GsDgaPb1pOVIO/Tln4mkImcJpvN -b2ar7QMiRDjMWb2f2/YHogF/JsRj9SVCXmK9 +MIIEZDCCA0ygAwIBAgIQRL4Mi1AAJLQR0zYwS8AzdzANBgkqhkiG9w0BAQUFADCB +ozELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug +Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho +dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xKzApBgNVBAMTIlVUTi1VU0VSRmlyc3Qt +TmV0d29yayBBcHBsaWNhdGlvbnMwHhcNOTkwNzA5MTg0ODM5WhcNMTkwNzA5MTg1 +NzQ5WjCBozELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0 +IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYD +VQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xKzApBgNVBAMTIlVUTi1VU0VS +Rmlyc3QtTmV0d29yayBBcHBsaWNhdGlvbnMwggEiMA0GCSqGSIb3DQEBAQUAA4IB +DwAwggEKAoIBAQCz+5Gh5DZVhawGNFugmliy+LUPBXeDrjKxdpJo7CNKyXY/45y2 +N3kDuatpjQclthln5LAbGHNhSuh+zdMvZOOmfAz6F4CjDUeJT1FxL+78P/m4FoCH +iZMlIJpDgmkkdihZNaEdwH+DBmQWICzTSaSFtMBhf1EI+GgVkYDLpdXuOzr0hARe +YFmnjDRy7rh4xdE7EkpvfmUnuaRVxblvQ6TFHSyZwFKkeEwVs0CYCGtDxgGwenv1 +axwiP8vv/6jQOkt2FZ7S0cYu49tXGzKiuG/ohqY/cKvlcJKrRB5AUPuco2LkbG6g +yN7igEL66S/ozjIEj3yNtxyjNTwV3Z7DrpelAgMBAAGjgZEwgY4wCwYDVR0PBAQD +AgHGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFPqGydvguul49Uuo1hXf8NPh +ahQ8ME8GA1UdHwRIMEYwRKBCoECGPmh0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9V +VE4tVVNFUkZpcnN0LU5ldHdvcmtBcHBsaWNhdGlvbnMuY3JsMA0GCSqGSIb3DQEB +BQUAA4IBAQCk8yXM0dSRgyLQzDKrm5ZONJFUICU0YV8qAhXhi6r/fWRRzwr/vH3Y +IWp4yy9Rb/hCHTO967V7lMPDqaAt39EpHx3+jz+7qEUqf9FuVSTiuwL7MT++6Lzs +QCv4AdRWOOTKRIK1YSAhZ2X28AvnNPilwpyjXEAfhZOVBt5P1CeptqX8Fs1zMT+4 +ZSfP1FMa8Kxun08FDAOBp4QpxFq9ZFdyrTvPNximmMatBrTcCKME1SmklpoSZ0qM +YEWd8SOasACcaLWYUNPvji6SZbFIPiG+FTAqDbUMo2s/rn9X9R+WfN9v3YIwLGUb +QErNaLly7HF27FSOH4UMAWr6pjisH8SE -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA CLASE1 Certification Authority, CN=IPS CA CLASE1 Certification Authority/emailAddress=ips@mail.ips.es - Validity - Not Before: Dec 29 00:59:38 2001 GMT - Not After : Dec 27 00:59:38 2025 GMT - Subject: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA CLASE1 Certification Authority, CN=IPS CA CLASE1 Certification Authority/emailAddress=ips@mail.ips.es - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:e0:51:27:a7:0b:dd:af:d1:b9:43:5b:82:37:45: - 56:72:ef:9a:b6:c2:12:ef:2c:12:cc:76:f9:06:59: - af:5d:21:d4:d2:5a:b8:a0:d4:f3:6a:fd:ca:69:8d: - 66:48:f7:74:e6:ee:36:bd:e8:96:91:75:a6:71:28: - ca:e7:22:12:32:69:b0:3e:1e:6b:f4:50:52:62:62: - fd:63:3b:7d:7e:ec:ee:38:ea:62:f4:6c:a8:71:8d: - e1:e9:8b:c9:3f:c6:b5:cd:94:42:6f:dd:82:45:3c: - e8:df:09:e8:ef:0a:55:a9:56:47:61:4c:49:64:73: - 10:28:3f:ca:bf:09:ff:c6:2f - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - EB:B3:19:79:F3:C1:A5:1C:AC:DC:BA:1F:66:A2:B2:9B:69:D0:78:08 - X509v3 Authority Key Identifier: - keyid:EB:B3:19:79:F3:C1:A5:1C:AC:DC:BA:1F:66:A2:B2:9B:69:D0:78:08 - DirName:/C=ES/ST=Barcelona/L=Barcelona/O=IPS Internet publishing Services s.l./O=ips@mail.ips.es C.I.F. B-60929452/OU=IPS CA CLASE1 Certification Authority/CN=IPS CA CLASE1 Certification Authority/emailAddress=ips@mail.ips.es - serial:00 - - X509v3 Basic Constraints: - CA:TRUE - X509v3 Key Usage: - Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign, Encipher Only, Decipher Only - X509v3 Extended Key Usage: - TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, Time Stamping, Microsoft Individual Code Signing, Microsoft Commercial Code Signing, Microsoft Trust List Signing, Microsoft Encrypted File System - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 Subject Alternative Name: - email:ips@mail.ips.es - X509v3 Issuer Alternative Name: - email:ips@mail.ips.es - Netscape Comment: - CLASE1 CA Certificate issued by http://www.ips.es/ - Netscape Base Url: - http://www.ips.es/ips2002/ - Netscape CA Revocation Url: - http://www.ips.es/ips2002/ips2002CLASE1.crl - Netscape Revocation Url: - http://www.ips.es/ips2002/revocationCLASE1.html? - Netscape Renewal Url: - http://www.ips.es/ips2002/renewalCLASE1.html? - Netscape CA Policy Url: - http://www.ips.es/ips2002/policyCLASE1.html - X509v3 CRL Distribution Points: - URI:http://www.ips.es/ips2002/ips2002CLASE1.crl - URI:http://wwwback.ips.es/ips2002/ips2002CLASE1.crl - - Authority Information Access: - OCSP - URI:http://ocsp.ips.es/ - - Signature Algorithm: sha1WithRSAEncryption - 2b:d0:eb:fd:da:c8:ca:59:6a:da:d3:cc:32:2e:c9:54:1b:8a: - 62:7e:15:2d:e9:d9:31:d3:2e:f4:27:23:ff:5b:ab:c5:4a:b6: - 72:40:ae:53:74:f4:bc:05:b4:c6:d9:c8:c9:77:fb:b7:f9:34: - 7f:78:00:f8:d6:a4:e4:52:3f:2c:4a:63:57:81:75:5a:8e:e8: - 8c:fb:02:c0:94:c6:29:ba:b3:dc:1c:e8:b2:af:d2:2e:62:5b: - 1a:a9:8e:0e:cc:c5:57:45:51:14:e9:4e:1c:88:a5:91:f4:a3: - f7:8e:51:c8:a9:be:86:33:3e:e6:2f:48:6e:af:54:90:4e:ad: - b1:25 -MD5 Fingerprint=84:90:1D:95:30:49:56:FC:41:81:F0:45:D7:76:C4:6B -----BEGIN CERTIFICATE----- -MIIH6jCCB1OgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCARIxCzAJBgNVBAYTAkVT -MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE -ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE -ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjEuMCwGA1UECxMl -SVBTIENBIENMQVNFMSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEuMCwGA1UEAxMl -SVBTIENBIENMQVNFMSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEeMBwGCSqGSIb3 -DQEJARYPaXBzQG1haWwuaXBzLmVzMB4XDTAxMTIyOTAwNTkzOFoXDTI1MTIyNzAw -NTkzOFowggESMQswCQYDVQQGEwJFUzESMBAGA1UECBMJQmFyY2Vsb25hMRIwEAYD -VQQHEwlCYXJjZWxvbmExLjAsBgNVBAoTJUlQUyBJbnRlcm5ldCBwdWJsaXNoaW5n -IFNlcnZpY2VzIHMubC4xKzApBgNVBAoUImlwc0BtYWlsLmlwcy5lcyBDLkkuRi4g -IEItNjA5Mjk0NTIxLjAsBgNVBAsTJUlQUyBDQSBDTEFTRTEgQ2VydGlmaWNhdGlv -biBBdXRob3JpdHkxLjAsBgNVBAMTJUlQUyBDQSBDTEFTRTEgQ2VydGlmaWNhdGlv -biBBdXRob3JpdHkxHjAcBgkqhkiG9w0BCQEWD2lwc0BtYWlsLmlwcy5lczCBnzAN -BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA4FEnpwvdr9G5Q1uCN0VWcu+atsIS7ywS -zHb5BlmvXSHU0lq4oNTzav3KaY1mSPd05u42veiWkXWmcSjK5yISMmmwPh5r9FBS -YmL9Yzt9fuzuOOpi9GyocY3h6YvJP8a1zZRCb92CRTzo3wno7wpVqVZHYUxJZHMQ -KD/Kvwn/xi8CAwEAAaOCBEowggRGMB0GA1UdDgQWBBTrsxl588GlHKzcuh9morKb -adB4CDCCAUQGA1UdIwSCATswggE3gBTrsxl588GlHKzcuh9morKbadB4CKGCARqk -ggEWMIIBEjELMAkGA1UEBhMCRVMxEjAQBgNVBAgTCUJhcmNlbG9uYTESMBAGA1UE -BxMJQmFyY2Vsb25hMS4wLAYDVQQKEyVJUFMgSW50ZXJuZXQgcHVibGlzaGluZyBT -ZXJ2aWNlcyBzLmwuMSswKQYDVQQKFCJpcHNAbWFpbC5pcHMuZXMgQy5JLkYuICBC -LTYwOTI5NDUyMS4wLAYDVQQLEyVJUFMgQ0EgQ0xBU0UxIENlcnRpZmljYXRpb24g -QXV0aG9yaXR5MS4wLAYDVQQDEyVJUFMgQ0EgQ0xBU0UxIENlcnRpZmljYXRpb24g -QXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOCAQAwDAYD -VR0TBAUwAwEB/zAMBgNVHQ8EBQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUFBwMBBggr -BgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYBBAGCNwIB -FQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYKKwYBBAGCNwoDBDARBglghkgBhvhC -AQEEBAMCAAcwGgYDVR0RBBMwEYEPaXBzQG1haWwuaXBzLmVzMBoGA1UdEgQTMBGB -D2lwc0BtYWlsLmlwcy5lczBBBglghkgBhvhCAQ0ENBYyQ0xBU0UxIENBIENlcnRp -ZmljYXRlIGlzc3VlZCBieSBodHRwOi8vd3d3Lmlwcy5lcy8wKQYJYIZIAYb4QgEC -BBwWGmh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvMDoGCWCGSAGG+EIBBAQtFito -dHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL2lwczIwMDJDTEFTRTEuY3JsMD8GCWCG -SAGG+EIBAwQyFjBodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL3Jldm9jYXRpb25D -TEFTRTEuaHRtbD8wPAYJYIZIAYb4QgEHBC8WLWh0dHA6Ly93d3cuaXBzLmVzL2lw -czIwMDIvcmVuZXdhbENMQVNFMS5odG1sPzA6BglghkgBhvhCAQgELRYraHR0cDov -L3d3dy5pcHMuZXMvaXBzMjAwMi9wb2xpY3lDTEFTRTEuaHRtbDBzBgNVHR8EbDBq -MDGgL6AthitodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL2lwczIwMDJDTEFTRTEu -Y3JsMDWgM6Axhi9odHRwOi8vd3d3YmFjay5pcHMuZXMvaXBzMjAwMi9pcHMyMDAy -Q0xBU0UxLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9v -Y3NwLmlwcy5lcy8wDQYJKoZIhvcNAQEFBQADgYEAK9Dr/drIyllq2tPMMi7JVBuK -Yn4VLenZMdMu9Ccj/1urxUq2ckCuU3T0vAW0xtnIyXf7t/k0f3gA+Nak5FI/LEpj -V4F1Wo7ojPsCwJTGKbqz3Bzosq/SLmJbGqmODszFV0VRFOlOHIilkfSj945RyKm+ -hjM+5i9Ibq9UkE6tsSU= +MIIC5zCCAlACAQEwDQYJKoZIhvcNAQEFBQAwgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0 +IFZhbGlkYXRpb24gTmV0d29yazEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAz +BgNVBAsTLFZhbGlDZXJ0IENsYXNzIDEgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9y +aXR5MSEwHwYDVQQDExhodHRwOi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG +9w0BCQEWEWluZm9AdmFsaWNlcnQuY29tMB4XDTk5MDYyNTIyMjM0OFoXDTE5MDYy +NTIyMjM0OFowgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0IFZhbGlkYXRpb24gTmV0d29y +azEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAzBgNVBAsTLFZhbGlDZXJ0IENs +YXNzIDEgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9yaXR5MSEwHwYDVQQDExhodHRw +Oi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl +cnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYWYJ6ibiWuqYvaG9Y +LqdUHAZu9OqNSLwxlBfw8068srg1knaw0KWlAdcAAxIiGQj4/xEjm84H9b9pGib+ +TunRf50sQB1ZaG6m+FiwnRqP0z/x3BkGgagO4DrdyFNFCQbmD3DD+kCmDuJWBQ8Y +TfwggtFzVXSNdnKgHZ0dwN0/cQIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAFBoPUn0 +LBwGlN+VYH+Wexf+T3GtZMjdd9LvWVXoP+iOBSoh8gfStadS/pyxtuJbdxdA6nLW +I8sogTLDAHkY7FkXicnGah5xyf23dKUlRWnFSKsZ4UWKJWsZ7uW7EvV/96aNUcPw +nXS3qT6gpf+2SQMT2iLM7XGCK5nPOrf1LXLI -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA CLASE3 Certification Authority, CN=IPS CA CLASE3 Certification Authority/emailAddress=ips@mail.ips.es - Validity - Not Before: Dec 29 01:01:44 2001 GMT - Not After : Dec 27 01:01:44 2025 GMT - Subject: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA CLASE3 Certification Authority, CN=IPS CA CLASE3 Certification Authority/emailAddress=ips@mail.ips.es - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:ab:17:fe:0e:b0:c6:68:1b:53:f0:52:be:9f:fa: - da:fa:8b:13:04:bb:01:8f:32:d9:1f:8f:4d:ce:36: - 98:da:e4:00:44:8c:28:d8:13:44:2a:a4:6b:4e:17: - 24:42:9c:d3:88:a4:41:82:d6:23:fb:8b:c9:86:e5: - b9:a9:82:05:dc:f1:de:1f:e0:0c:99:55:98:f2:38: - ec:6c:9d:20:03:c0:ef:aa:a3:c6:64:04:51:2d:78: - 0d:a3:d2:a8:3a:d6:24:4c:e9:96:7a:18:ac:13:23: - 22:1b:7c:e8:31:11:b3:5f:09:aa:30:70:71:46:25: - 6b:49:71:80:2b:95:01:b2:1f - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - B8:93:FF:2E:CB:DC:2C:8E:A2:E7:7A:FE:36:51:21:A3:98:5B:0C:34 - X509v3 Authority Key Identifier: - keyid:B8:93:FF:2E:CB:DC:2C:8E:A2:E7:7A:FE:36:51:21:A3:98:5B:0C:34 - DirName:/C=ES/ST=Barcelona/L=Barcelona/O=IPS Internet publishing Services s.l./O=ips@mail.ips.es C.I.F. B-60929452/OU=IPS CA CLASE3 Certification Authority/CN=IPS CA CLASE3 Certification Authority/emailAddress=ips@mail.ips.es - serial:00 - - X509v3 Basic Constraints: - CA:TRUE - X509v3 Key Usage: - Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign, Encipher Only, Decipher Only - X509v3 Extended Key Usage: - TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, Time Stamping, Microsoft Individual Code Signing, Microsoft Commercial Code Signing, Microsoft Trust List Signing, Microsoft Encrypted File System - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 Subject Alternative Name: - email:ips@mail.ips.es - X509v3 Issuer Alternative Name: - email:ips@mail.ips.es - Netscape Comment: - CLASE3 CA Certificate issued by http://www.ips.es/ - Netscape Base Url: - http://www.ips.es/ips2002/ - Netscape CA Revocation Url: - http://www.ips.es/ips2002/ips2002CLASE3.crl - Netscape Revocation Url: - http://www.ips.es/ips2002/revocationCLASE3.html? - Netscape Renewal Url: - http://www.ips.es/ips2002/renewalCLASE3.html? - Netscape CA Policy Url: - http://www.ips.es/ips2002/policyCLASE3.html - X509v3 CRL Distribution Points: - URI:http://www.ips.es/ips2002/ips2002CLASE3.crl - URI:http://wwwback.ips.es/ips2002/ips2002CLASE3.crl - - Authority Information Access: - OCSP - URI:http://ocsp.ips.es/ - - Signature Algorithm: sha1WithRSAEncryption - 17:65:5c:99:95:43:03:27:af:26:e5:eb:d0:b3:17:23:f7:43: - aa:c7:f0:7d:ec:0f:c6:a9:ae:ae:96:0f:76:29:1c:e2:06:2d: - 7e:26:c5:3c:fa:a1:c1:81:ce:53:b0:42:d1:97:57:1a:17:7e: - a4:51:61:c6:ee:e9:5e:ef:05:ba:eb:bd:0f:a7:92:6f:d8:a3: - 06:68:29:8e:79:f5:ff:bf:f9:a7:af:e4:b1:ce:c2:d1:80:42: - 27:05:04:34:f8:c3:7f:16:78:23:0c:07:24:f2:46:47:ad:3b: - 54:d0:af:d5:31:b2:af:7d:c8:ea:e9:d4:56:d9:0e:13:b2:c5: - 45:50 -MD5 Fingerprint=42:76:97:68:CF:A6:B4:38:24:AA:A1:1B:F2:67:DE:CA -----BEGIN CERTIFICATE----- -MIIH6jCCB1OgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCARIxCzAJBgNVBAYTAkVT -MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE -ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE -ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjEuMCwGA1UECxMl -SVBTIENBIENMQVNFMyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEuMCwGA1UEAxMl -SVBTIENBIENMQVNFMyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEeMBwGCSqGSIb3 -DQEJARYPaXBzQG1haWwuaXBzLmVzMB4XDTAxMTIyOTAxMDE0NFoXDTI1MTIyNzAx -MDE0NFowggESMQswCQYDVQQGEwJFUzESMBAGA1UECBMJQmFyY2Vsb25hMRIwEAYD -VQQHEwlCYXJjZWxvbmExLjAsBgNVBAoTJUlQUyBJbnRlcm5ldCBwdWJsaXNoaW5n -IFNlcnZpY2VzIHMubC4xKzApBgNVBAoUImlwc0BtYWlsLmlwcy5lcyBDLkkuRi4g -IEItNjA5Mjk0NTIxLjAsBgNVBAsTJUlQUyBDQSBDTEFTRTMgQ2VydGlmaWNhdGlv -biBBdXRob3JpdHkxLjAsBgNVBAMTJUlQUyBDQSBDTEFTRTMgQ2VydGlmaWNhdGlv -biBBdXRob3JpdHkxHjAcBgkqhkiG9w0BCQEWD2lwc0BtYWlsLmlwcy5lczCBnzAN -BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAqxf+DrDGaBtT8FK+n/ra+osTBLsBjzLZ -H49NzjaY2uQARIwo2BNEKqRrThckQpzTiKRBgtYj+4vJhuW5qYIF3PHeH+AMmVWY -8jjsbJ0gA8DvqqPGZARRLXgNo9KoOtYkTOmWehisEyMiG3zoMRGzXwmqMHBxRiVr -SXGAK5UBsh8CAwEAAaOCBEowggRGMB0GA1UdDgQWBBS4k/8uy9wsjqLnev42USGj -mFsMNDCCAUQGA1UdIwSCATswggE3gBS4k/8uy9wsjqLnev42USGjmFsMNKGCARqk -ggEWMIIBEjELMAkGA1UEBhMCRVMxEjAQBgNVBAgTCUJhcmNlbG9uYTESMBAGA1UE -BxMJQmFyY2Vsb25hMS4wLAYDVQQKEyVJUFMgSW50ZXJuZXQgcHVibGlzaGluZyBT -ZXJ2aWNlcyBzLmwuMSswKQYDVQQKFCJpcHNAbWFpbC5pcHMuZXMgQy5JLkYuICBC -LTYwOTI5NDUyMS4wLAYDVQQLEyVJUFMgQ0EgQ0xBU0UzIENlcnRpZmljYXRpb24g -QXV0aG9yaXR5MS4wLAYDVQQDEyVJUFMgQ0EgQ0xBU0UzIENlcnRpZmljYXRpb24g -QXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOCAQAwDAYD -VR0TBAUwAwEB/zAMBgNVHQ8EBQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUFBwMBBggr -BgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYBBAGCNwIB -FQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYKKwYBBAGCNwoDBDARBglghkgBhvhC -AQEEBAMCAAcwGgYDVR0RBBMwEYEPaXBzQG1haWwuaXBzLmVzMBoGA1UdEgQTMBGB -D2lwc0BtYWlsLmlwcy5lczBBBglghkgBhvhCAQ0ENBYyQ0xBU0UzIENBIENlcnRp -ZmljYXRlIGlzc3VlZCBieSBodHRwOi8vd3d3Lmlwcy5lcy8wKQYJYIZIAYb4QgEC -BBwWGmh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvMDoGCWCGSAGG+EIBBAQtFito -dHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL2lwczIwMDJDTEFTRTMuY3JsMD8GCWCG -SAGG+EIBAwQyFjBodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL3Jldm9jYXRpb25D -TEFTRTMuaHRtbD8wPAYJYIZIAYb4QgEHBC8WLWh0dHA6Ly93d3cuaXBzLmVzL2lw -czIwMDIvcmVuZXdhbENMQVNFMy5odG1sPzA6BglghkgBhvhCAQgELRYraHR0cDov -L3d3dy5pcHMuZXMvaXBzMjAwMi9wb2xpY3lDTEFTRTMuaHRtbDBzBgNVHR8EbDBq -MDGgL6AthitodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL2lwczIwMDJDTEFTRTMu -Y3JsMDWgM6Axhi9odHRwOi8vd3d3YmFjay5pcHMuZXMvaXBzMjAwMi9pcHMyMDAy -Q0xBU0UzLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9v -Y3NwLmlwcy5lcy8wDQYJKoZIhvcNAQEFBQADgYEAF2VcmZVDAyevJuXr0LMXI/dD -qsfwfewPxqmurpYPdikc4gYtfibFPPqhwYHOU7BC0ZdXGhd+pFFhxu7pXu8Fuuu9 -D6eSb9ijBmgpjnn1/7/5p6/ksc7C0YBCJwUENPjDfxZ4IwwHJPJGR607VNCv1TGy -r33I6unUVtkOE7LFRVA= +MIIC5zCCAlACAQEwDQYJKoZIhvcNAQEFBQAwgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0 +IFZhbGlkYXRpb24gTmV0d29yazEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAz +BgNVBAsTLFZhbGlDZXJ0IENsYXNzIDIgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9y +aXR5MSEwHwYDVQQDExhodHRwOi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG +9w0BCQEWEWluZm9AdmFsaWNlcnQuY29tMB4XDTk5MDYyNjAwMTk1NFoXDTE5MDYy +NjAwMTk1NFowgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0IFZhbGlkYXRpb24gTmV0d29y +azEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAzBgNVBAsTLFZhbGlDZXJ0IENs +YXNzIDIgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9yaXR5MSEwHwYDVQQDExhodHRw +Oi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl +cnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY +dA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9 +WlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS +v4dk+NoS/zcnwbNDu+97bi5p9wIDAQABMA0GCSqGSIb3DQEBBQUAA4GBADt/UG9v +UJSZSWI4OB9L+KXIPqeCgfYrx+jFzug6EILLGACOTb2oWH+heQC1u+mNr0HZDzTu +IYEZoDJJKPTEjlbVUjP9UNV+mWwD5MlM/Mtsq2azSiGM5bUMMj4QssxsodyamEwC +W/POuZ6lcg5Ktz885hZo+L7tdEy8W9ViH0Pd +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICPTCCAaYCEQDNun9W8N/kvFT+IqyzcqpVMA0GCSqGSIb3DQEBAgUAMF8xCzAJ +BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xh +c3MgMSBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05 +NjAxMjkwMDAwMDBaFw0yODA4MDEyMzU5NTlaMF8xCzAJBgNVBAYTAlVTMRcwFQYD +VQQKEw5WZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xhc3MgMSBQdWJsaWMgUHJp +bWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCBnzANBgkqhkiG9w0BAQEFAAOB +jQAwgYkCgYEA5Rm/baNWYS2ZSHH2Z965jeu3noaACpEO+jglr0aIguVzqKCbJF0N +H8xlbgyw0FaEGIeaBpsQoXPftFg5a27B9hXVqKg/qhIGjTGsf7A01480Z4gJzRQR +4k5FVmkfeAKA2txHkSm7NsljXMXg1y2He6G3MrB7MLoqLzGq7qNn2tsCAwEAATAN +BgkqhkiG9w0BAQIFAAOBgQBMP7iLxmjf7kMzDl3ppssHhE16M/+SG/Q2rdiVIjZo +EWx8QszznC7EBz8UsA9P/5CSdvnivErpj82ggAr3xSnxgiJduLHdgSOjeyUVRjB5 +FvjqBUuUfx3CHMjjt/QQQDwTw18fU+hI5Ia0e6E1sHslurjTjqs/OJ0ANACY89Fx +lA== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA CLASEA1 Certification Authority, CN=IPS CA CLASEA1 Certification Authority/emailAddress=ips@mail.ips.es - Validity - Not Before: Dec 29 01:05:32 2001 GMT - Not After : Dec 27 01:05:32 2025 GMT - Subject: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA CLASEA1 Certification Authority, CN=IPS CA CLASEA1 Certification Authority/emailAddress=ips@mail.ips.es - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:bb:30:d7:dc:d0:54:bd:35:4e:9f:c5:4c:82:ea: - d1:50:3c:47:98:fc:9b:69:9d:77:cd:6e:e0:3f:ee: - eb:32:5f:5f:9f:d2:d0:79:e5:95:73:44:21:32:e0: - 0a:db:9d:d7:ce:8d:ab:52:8b:2b:78:e0:9b:5b:7d: - f4:fd:6d:09:e5:ae:e1:6c:1d:07:23:a0:17:d1:f9: - 7d:a8:46:46:91:22:a8:b2:69:c6:ad:f7:f5:f5:94: - a1:30:94:bd:00:cc:44:7f:ee:c4:9e:c9:c1:e6:8f: - 0a:36:c1:fd:24:3d:01:a0:f5:7b:e2:7c:78:66:43: - 8b:4f:59:f2:9b:d9:fa:49:b3 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - 67:26:96:E7:A1:BF:D8:B5:03:9D:FE:3B:DC:FE:F2:8A:E6:15:DD:30 - X509v3 Authority Key Identifier: - keyid:67:26:96:E7:A1:BF:D8:B5:03:9D:FE:3B:DC:FE:F2:8A:E6:15:DD:30 - DirName:/C=ES/ST=Barcelona/L=Barcelona/O=IPS Internet publishing Services s.l./O=ips@mail.ips.es C.I.F. B-60929452/OU=IPS CA CLASEA1 Certification Authority/CN=IPS CA CLASEA1 Certification Authority/emailAddress=ips@mail.ips.es - serial:00 - - X509v3 Basic Constraints: - CA:TRUE - X509v3 Key Usage: - Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign, Encipher Only, Decipher Only - X509v3 Extended Key Usage: - TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, Time Stamping, Microsoft Individual Code Signing, Microsoft Commercial Code Signing, Microsoft Trust List Signing, Microsoft Encrypted File System - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 Subject Alternative Name: - email:ips@mail.ips.es - X509v3 Issuer Alternative Name: - email:ips@mail.ips.es - Netscape Comment: - CLASEA1 CA Certificate issued by http://www.ips.es/ - Netscape Base Url: - http://www.ips.es/ips2002/ - Netscape CA Revocation Url: - http://www.ips.es/ips2002/ips2002CLASEA1.crl - Netscape Revocation Url: - http://www.ips.es/ips2002/revocationCLASEA1.html? - Netscape Renewal Url: - http://www.ips.es/ips2002/renewalCLASEA1.html? - Netscape CA Policy Url: - http://www.ips.es/ips2002/policyCLASEA1.html - X509v3 CRL Distribution Points: - URI:http://www.ips.es/ips2002/ips2002CLASEA1.crl - URI:http://wwwback.ips.es/ips2002/ips2002CLASEA1.crl - - Authority Information Access: - OCSP - URI:http://ocsp.ips.es/ - - Signature Algorithm: sha1WithRSAEncryption - 7e:ba:8a:ac:80:00:84:15:0a:d5:98:51:0c:64:c5:9c:02:58: - 83:66:ca:ad:1e:07:cd:7e:6a:da:80:07:df:03:34:4a:1c:93: - c4:4b:58:20:35:36:71:ed:a2:0a:35:12:a5:a6:65:a7:85:69: - 0a:0e:e3:61:ee:ea:be:28:93:33:d5:ec:e8:be:c4:db:5f:7f: - a8:f9:63:31:c8:6b:96:e2:29:c2:5b:a0:e7:97:36:9d:77:5e: - 31:6b:fe:d3:a7:db:2a:db:db:96:8b:1f:66:de:b6:03:c0:2b: - b3:78:d6:55:07:e5:8f:39:50:de:07:23:72:e6:bd:20:14:4b: - b4:86 -MD5 Fingerprint=0C:F8:9E:17:FC:D4:03:BD:E6:8D:9B:3C:05:87:FE:84 -----BEGIN CERTIFICATE----- -MIIH9zCCB2CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCARQxCzAJBgNVBAYTAkVT -MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE -ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE -ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjEvMC0GA1UECxMm -SVBTIENBIENMQVNFQTEgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxLzAtBgNVBAMT -JklQUyBDQSBDTEFTRUExIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MR4wHAYJKoZI -hvcNAQkBFg9pcHNAbWFpbC5pcHMuZXMwHhcNMDExMjI5MDEwNTMyWhcNMjUxMjI3 -MDEwNTMyWjCCARQxCzAJBgNVBAYTAkVTMRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQ -BgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UEChMlSVBTIEludGVybmV0IHB1Ymxpc2hp -bmcgU2VydmljZXMgcy5sLjErMCkGA1UEChQiaXBzQG1haWwuaXBzLmVzIEMuSS5G -LiAgQi02MDkyOTQ1MjEvMC0GA1UECxMmSVBTIENBIENMQVNFQTEgQ2VydGlmaWNh -dGlvbiBBdXRob3JpdHkxLzAtBgNVBAMTJklQUyBDQSBDTEFTRUExIENlcnRpZmlj -YXRpb24gQXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXMw -gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALsw19zQVL01Tp/FTILq0VA8R5j8 -m2mdd81u4D/u6zJfX5/S0HnllXNEITLgCtud186Nq1KLK3jgm1t99P1tCeWu4Wwd -ByOgF9H5fahGRpEiqLJpxq339fWUoTCUvQDMRH/uxJ7JweaPCjbB/SQ9AaD1e+J8 -eGZDi09Z8pvZ+kmzAgMBAAGjggRTMIIETzAdBgNVHQ4EFgQUZyaW56G/2LUDnf47 -3P7yiuYV3TAwggFGBgNVHSMEggE9MIIBOYAUZyaW56G/2LUDnf473P7yiuYV3TCh -ggEcpIIBGDCCARQxCzAJBgNVBAYTAkVTMRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQ -BgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UEChMlSVBTIEludGVybmV0IHB1Ymxpc2hp -bmcgU2VydmljZXMgcy5sLjErMCkGA1UEChQiaXBzQG1haWwuaXBzLmVzIEMuSS5G -LiAgQi02MDkyOTQ1MjEvMC0GA1UECxMmSVBTIENBIENMQVNFQTEgQ2VydGlmaWNh -dGlvbiBBdXRob3JpdHkxLzAtBgNVBAMTJklQUyBDQSBDTEFTRUExIENlcnRpZmlj -YXRpb24gQXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOC -AQAwDAYDVR0TBAUwAwEB/zAMBgNVHQ8EBQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUF -BwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYB -BAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYKKwYBBAGCNwoDBDARBglg -hkgBhvhCAQEEBAMCAAcwGgYDVR0RBBMwEYEPaXBzQG1haWwuaXBzLmVzMBoGA1Ud -EgQTMBGBD2lwc0BtYWlsLmlwcy5lczBCBglghkgBhvhCAQ0ENRYzQ0xBU0VBMSBD -QSBDZXJ0aWZpY2F0ZSBpc3N1ZWQgYnkgaHR0cDovL3d3dy5pcHMuZXMvMCkGCWCG -SAGG+EIBAgQcFhpodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyLzA7BglghkgBhvhC -AQQELhYsaHR0cDovL3d3dy5pcHMuZXMvaXBzMjAwMi9pcHMyMDAyQ0xBU0VBMS5j -cmwwQAYJYIZIAYb4QgEDBDMWMWh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvcmV2 -b2NhdGlvbkNMQVNFQTEuaHRtbD8wPQYJYIZIAYb4QgEHBDAWLmh0dHA6Ly93d3cu -aXBzLmVzL2lwczIwMDIvcmVuZXdhbENMQVNFQTEuaHRtbD8wOwYJYIZIAYb4QgEI -BC4WLGh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvcG9saWN5Q0xBU0VBMS5odG1s -MHUGA1UdHwRuMGwwMqAwoC6GLGh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvaXBz -MjAwMkNMQVNFQTEuY3JsMDagNKAyhjBodHRwOi8vd3d3YmFjay5pcHMuZXMvaXBz -MjAwMi9pcHMyMDAyQ0xBU0VBMS5jcmwwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUF -BzABhhNodHRwOi8vb2NzcC5pcHMuZXMvMA0GCSqGSIb3DQEBBQUAA4GBAH66iqyA -AIQVCtWYUQxkxZwCWINmyq0eB81+atqAB98DNEock8RLWCA1NnHtogo1EqWmZaeF -aQoO42Hu6r4okzPV7Oi+xNtff6j5YzHIa5biKcJboOeXNp13XjFr/tOn2yrb25aL -H2betgPAK7N41lUH5Y85UN4HI3LmvSAUS7SG +MIIDAjCCAmsCEEzH6qqYPnHTkxD4PTqJkZIwDQYJKoZIhvcNAQEFBQAwgcExCzAJ +BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xh +c3MgMSBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcy +MTowOAYDVQQLEzEoYykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp +emVkIHVzZSBvbmx5MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMB4X +DTk4MDUxODAwMDAwMFoXDTI4MDgwMTIzNTk1OVowgcExCzAJBgNVBAYTAlVTMRcw +FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xhc3MgMSBQdWJsaWMg +UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcyMTowOAYDVQQLEzEo +YykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 +MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB +AQUAA4GNADCBiQKBgQCq0Lq+Fi24g9TK0g+8djHKlNgdk4xWArzZbxpvUjZudVYK +VdPfQ4chEWWKfo+9Id5rMj8bhDSVBZ1BNeuS65bdqlk/AVNtmU/t5eIqWpDBucSm +Fc/IReumXY6cPvBkJHalzasab7bYe1FhbqZ/h8jit+U03EGI6glAvnOSPWvndQID +AQABMA0GCSqGSIb3DQEBBQUAA4GBAKlPww3HZ74sy9mozS11534Vnjty637rXC0J +h9ZrbWB85a7FkCMMXErQr7Fd88e2CtvgFZMN3QO8x3aKtd1Pw5sTdbgBwObJW2ul +uIncrKTdcu1OofdPvAbT6shkdHvClUGcZXNY8ZCaPGqxmMnEh7zPRW1F4m4iP/68 +DzFc6PLZ -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA CLASEA3 Certification Authority, CN=IPS CA CLASEA3 Certification Authority/emailAddress=ips@mail.ips.es - Validity - Not Before: Dec 29 01:07:50 2001 GMT - Not After : Dec 27 01:07:50 2025 GMT - Subject: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA CLASEA3 Certification Authority, CN=IPS CA CLASEA3 Certification Authority/emailAddress=ips@mail.ips.es - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:ee:80:00:f6:1a:64:2e:ad:6a:c8:83:b1:8b:a7: - ee:8f:d9:b6:db:cd:1b:bb:86:06:22:76:33:0c:12: - 6d:48:56:61:d2:dc:82:25:62:2f:9f:d2:69:30:65: - 03:42:23:58:bc:47:dc:6b:d6:75:5d:17:3c:e1:ff: - f2:58:67:79:a0:c1:81:b1:d4:56:a2:f2:8d:11:99: - fd:f6:7d:f1:c7:c4:5e:02:2a:9a:e2:4a:b5:13:8a: - 00:fd:8c:77:86:e6:d7:94:f5:20:75:2e:0e:4c:bf: - 74:c4:3f:81:3e:83:b4:a3:38:36:29:e7:e8:2a:f5: - 8c:88:41:aa:80:a6:e3:6c:ef - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - 1E:9F:57:50:47:B6:61:93:39:D3:2C:FC:DA:5D:3D:05:75:B7:99:02 - X509v3 Authority Key Identifier: - keyid:1E:9F:57:50:47:B6:61:93:39:D3:2C:FC:DA:5D:3D:05:75:B7:99:02 - DirName:/C=ES/ST=Barcelona/L=Barcelona/O=IPS Internet publishing Services s.l./O=ips@mail.ips.es C.I.F. B-60929452/OU=IPS CA CLASEA3 Certification Authority/CN=IPS CA CLASEA3 Certification Authority/emailAddress=ips@mail.ips.es - serial:00 - - X509v3 Basic Constraints: - CA:TRUE - X509v3 Key Usage: - Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign, Encipher Only, Decipher Only - X509v3 Extended Key Usage: - TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, Time Stamping, Microsoft Individual Code Signing, Microsoft Commercial Code Signing, Microsoft Trust List Signing, Microsoft Encrypted File System - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 Subject Alternative Name: - email:ips@mail.ips.es - X509v3 Issuer Alternative Name: - email:ips@mail.ips.es - Netscape Comment: - CLASEA3 CA Certificate issued by http://www.ips.es/ - Netscape Base Url: - http://www.ips.es/ips2002/ - Netscape CA Revocation Url: - http://www.ips.es/ips2002/ips2002CLASEA3.crl - Netscape Revocation Url: - http://www.ips.es/ips2002/revocationCLASEA3.html? - Netscape Renewal Url: - http://www.ips.es/ips2002/renewalCLASEA3.html? - Netscape CA Policy Url: - http://www.ips.es/ips2002/policyCLASEA3.html - X509v3 CRL Distribution Points: - URI:http://www.ips.es/ips2002/ips2002CLASEA3.crl - URI:http://wwwback.ips.es/ips2002/ips2002CLASEA3.crl - - Authority Information Access: - OCSP - URI:http://ocsp.ips.es/ - - Signature Algorithm: sha1WithRSAEncryption - 4a:3d:20:47:1a:da:89:f4:7a:2b:31:79:ec:01:c0:cc:01:f5: - d6:c1:fc:c8:c3:f3:50:02:51:90:58:2a:9f:e7:35:09:5b:30: - 0a:81:00:25:47:af:d4:0f:0e:9e:60:26:a8:95:a7:83:08:df: - 2d:ac:e9:0e:f7:9c:c8:9f:cb:93:45:f1:ba:6a:c6:67:51:4a: - 69:4f:6b:fe:7d:0b:2f:52:29:c2:50:ad:24:44:ed:23:b3:48: - cb:44:40:c1:03:95:0c:0a:78:06:12:01:f5:91:31:2d:49:8d: - bb:3f:45:4e:2c:e0:e8:cd:b5:c9:14:15:0c:e3:07:83:9b:26: - 75:ef -MD5 Fingerprint=06:F9:EB:EC:CC:56:9D:88:BA:90:F5:BA:B0:1A:E0:02 -----BEGIN CERTIFICATE----- -MIIH9zCCB2CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCARQxCzAJBgNVBAYTAkVT -MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE -ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE -ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjEvMC0GA1UECxMm -SVBTIENBIENMQVNFQTMgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxLzAtBgNVBAMT -JklQUyBDQSBDTEFTRUEzIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MR4wHAYJKoZI -hvcNAQkBFg9pcHNAbWFpbC5pcHMuZXMwHhcNMDExMjI5MDEwNzUwWhcNMjUxMjI3 -MDEwNzUwWjCCARQxCzAJBgNVBAYTAkVTMRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQ -BgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UEChMlSVBTIEludGVybmV0IHB1Ymxpc2hp -bmcgU2VydmljZXMgcy5sLjErMCkGA1UEChQiaXBzQG1haWwuaXBzLmVzIEMuSS5G -LiAgQi02MDkyOTQ1MjEvMC0GA1UECxMmSVBTIENBIENMQVNFQTMgQ2VydGlmaWNh -dGlvbiBBdXRob3JpdHkxLzAtBgNVBAMTJklQUyBDQSBDTEFTRUEzIENlcnRpZmlj -YXRpb24gQXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXMw -gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAO6AAPYaZC6tasiDsYun7o/ZttvN -G7uGBiJ2MwwSbUhWYdLcgiViL5/SaTBlA0IjWLxH3GvWdV0XPOH/8lhneaDBgbHU -VqLyjRGZ/fZ98cfEXgIqmuJKtROKAP2Md4bm15T1IHUuDky/dMQ/gT6DtKM4Ninn -6Cr1jIhBqoCm42zvAgMBAAGjggRTMIIETzAdBgNVHQ4EFgQUHp9XUEe2YZM50yz8 -2l09BXW3mQIwggFGBgNVHSMEggE9MIIBOYAUHp9XUEe2YZM50yz82l09BXW3mQKh -ggEcpIIBGDCCARQxCzAJBgNVBAYTAkVTMRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQ -BgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UEChMlSVBTIEludGVybmV0IHB1Ymxpc2hp -bmcgU2VydmljZXMgcy5sLjErMCkGA1UEChQiaXBzQG1haWwuaXBzLmVzIEMuSS5G -LiAgQi02MDkyOTQ1MjEvMC0GA1UECxMmSVBTIENBIENMQVNFQTMgQ2VydGlmaWNh -dGlvbiBBdXRob3JpdHkxLzAtBgNVBAMTJklQUyBDQSBDTEFTRUEzIENlcnRpZmlj -YXRpb24gQXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOC -AQAwDAYDVR0TBAUwAwEB/zAMBgNVHQ8EBQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUF -BwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYB -BAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYKKwYBBAGCNwoDBDARBglg -hkgBhvhCAQEEBAMCAAcwGgYDVR0RBBMwEYEPaXBzQG1haWwuaXBzLmVzMBoGA1Ud -EgQTMBGBD2lwc0BtYWlsLmlwcy5lczBCBglghkgBhvhCAQ0ENRYzQ0xBU0VBMyBD -QSBDZXJ0aWZpY2F0ZSBpc3N1ZWQgYnkgaHR0cDovL3d3dy5pcHMuZXMvMCkGCWCG -SAGG+EIBAgQcFhpodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyLzA7BglghkgBhvhC -AQQELhYsaHR0cDovL3d3dy5pcHMuZXMvaXBzMjAwMi9pcHMyMDAyQ0xBU0VBMy5j -cmwwQAYJYIZIAYb4QgEDBDMWMWh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvcmV2 -b2NhdGlvbkNMQVNFQTMuaHRtbD8wPQYJYIZIAYb4QgEHBDAWLmh0dHA6Ly93d3cu -aXBzLmVzL2lwczIwMDIvcmVuZXdhbENMQVNFQTMuaHRtbD8wOwYJYIZIAYb4QgEI -BC4WLGh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvcG9saWN5Q0xBU0VBMy5odG1s -MHUGA1UdHwRuMGwwMqAwoC6GLGh0dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvaXBz -MjAwMkNMQVNFQTMuY3JsMDagNKAyhjBodHRwOi8vd3d3YmFjay5pcHMuZXMvaXBz -MjAwMi9pcHMyMDAyQ0xBU0VBMy5jcmwwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUF -BzABhhNodHRwOi8vb2NzcC5pcHMuZXMvMA0GCSqGSIb3DQEBBQUAA4GBAEo9IEca -2on0eisxeewBwMwB9dbB/MjD81ACUZBYKp/nNQlbMAqBACVHr9QPDp5gJqiVp4MI -3y2s6Q73nMify5NF8bpqxmdRSmlPa/59Cy9SKcJQrSRE7SOzSMtEQMEDlQwKeAYS -AfWRMS1Jjbs/RU4s4OjNtckUFQzjB4ObJnXv +MIIEGjCCAwICEQCLW3VWhFSFCwDPrzhIzrGkMA0GCSqGSIb3DQEBBQUAMIHKMQsw +CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl +cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu +LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT +aWduIENsYXNzIDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp +dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD +VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT +aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ +bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu +IENsYXNzIDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg +LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN2E1Lm0+afY8wR4 +nN493GwTFtl63SRRZsDHJlkNrAYIwpTRMx/wgzUfbhvI3qpuFU5UJ+/EbRrsC+MO +8ESlV8dAWB6jRx9x7GD2bZTIGDnt/kIYVt/kTEkQeE4BdjVjEjbdZrwBBDajVWjV +ojYJrKshJlQGrT/KFOCsyq0GHZXi+J3x4GD/wn91K0zM2v6HmSHquv4+VNfSWXjb +PG7PoBMAGrgnoeS+Z5bKoMWznN3JdZ7rMJpfo83ZrngZPyPpXNspva1VyBtUjGP2 +6KbqxzcSXKMpHgLZ2x87tNcPVkeBFQRKr4Mn0cVYiMHd9qqnoxjaaKptEVHhv2Vr +n5Z20T0CAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAq2aN17O6x5q25lXQBfGfMY1a +qtmqRiYPce2lrVNWYgFHKkTp/j90CxObufRNG7LRX7K20ohcs5/Ny9Sn2WCVhDr4 +wTcdYcrnsMXlkdpUpqwxga6X3s0IrLjAl4B/bnKk52kTlWUfxJM8/XmPBNQ+T+r3 +ns7NZ3xPZQL/kYVUc8f/NveGLezQXk//EZ9yBta4GvFMDSZl4kSAHsef493oCtrs +pSCAaWihT37ha88HQfqDjrw43bAuEbFrskLMmrz5SCJ5ShkPshw+IHTZasO+8ih4 +E1Z5T21Q6huwtVexN2ZYI/PcD98Kh8TvhgXVOBRgmaNL3gaWcSzy27YfpO8/7g== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 1 (0x0) - Serial Number: 0 (0x0) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=ES, ST=BARCELONA, L=BARCELONA, O=IPS Seguridad CA, OU=Certificaciones, CN=IPS SERVIDORES/emailAddress=ips@mail.ips.es - Validity - Not Before: Jan 1 23:21:07 1998 GMT - Not After : Dec 29 23:21:07 2009 GMT - Subject: C=ES, ST=BARCELONA, L=BARCELONA, O=IPS Seguridad CA, OU=Certificaciones, CN=IPS SERVIDORES/emailAddress=ips@mail.ips.es - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:ac:4f:52:74:9f:39:ea:8e:dc:25:c4:bc:98:5d: - 98:64:24:09:3c:21:b3:cc:19:b5:8e:94:8e:87:d1: - f8:37:3e:a1:c8:2d:58:a4:80:35:5b:a1:75:6c:1d: - 45:0c:1f:61:63:6a:5e:6f:9b:0a:4c:c1:c8:b8:61: - 23:35:81:ff:fe:ac:78:70:2d:68:e1:3a:07:98:95: - 02:54:dd:cd:23:b7:80:53:d7:c8:37:45:72:06:24: - 12:ba:13:61:21:8a:6e:75:28:e0:c5:0f:34:fd:36: - d8:45:7f:e1:b8:36:ef:b3:e1:c6:20:8e:e8:b4:38: - bc:e1:3e:f6:11:de:8c:9d:01 - Exponent: 65537 (0x10001) - Signature Algorithm: md5WithRSAEncryption - 2c:f3:c3:79:58:24:de:c6:3b:d1:e0:42:69:b8:ee:64:b3:3d: - 62:01:b9:b3:84:df:23:7d:dd:98:cf:10:a9:fe:00:d8:22:96: - 05:13:07:54:57:c5:a7:de:cb:d9:b8:88:42:f6:99:db:14:77: - 1f:b6:fe:25:3d:e1:a2:3e:03:a9:81:d2:2d:6c:47:f5:96:46: - 8c:22:ab:c8:cc:0d:0e:97:5e:8b:41:b4:3b:c4:0a:06:40:1d: - dd:46:f4:01:dd:ba:82:2e:3c:3d:78:70:9e:7c:18:d0:ab:f8: - b8:77:07:46:71:f1:ca:0b:63:5c:6a:f9:72:94:d5:01:4f:a0: - db:42 -MD5 Fingerprint=7B:B5:08:99:9A:8C:18:BF:85:27:7D:0E:AE:DA:B2:AB -----BEGIN CERTIFICATE----- -MIICtzCCAiACAQAwDQYJKoZIhvcNAQEEBQAwgaMxCzAJBgNVBAYTAkVTMRIwEAYD -VQQIEwlCQVJDRUxPTkExEjAQBgNVBAcTCUJBUkNFTE9OQTEZMBcGA1UEChMQSVBT -IFNlZ3VyaWRhZCBDQTEYMBYGA1UECxMPQ2VydGlmaWNhY2lvbmVzMRcwFQYDVQQD -Ew5JUFMgU0VSVklET1JFUzEeMBwGCSqGSIb3DQEJARYPaXBzQG1haWwuaXBzLmVz -MB4XDTk4MDEwMTIzMjEwN1oXDTA5MTIyOTIzMjEwN1owgaMxCzAJBgNVBAYTAkVT -MRIwEAYDVQQIEwlCQVJDRUxPTkExEjAQBgNVBAcTCUJBUkNFTE9OQTEZMBcGA1UE -ChMQSVBTIFNlZ3VyaWRhZCBDQTEYMBYGA1UECxMPQ2VydGlmaWNhY2lvbmVzMRcw -FQYDVQQDEw5JUFMgU0VSVklET1JFUzEeMBwGCSqGSIb3DQEJARYPaXBzQG1haWwu -aXBzLmVzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCsT1J0nznqjtwlxLyY -XZhkJAk8IbPMGbWOlI6H0fg3PqHILVikgDVboXVsHUUMH2Fjal5vmwpMwci4YSM1 -gf/+rHhwLWjhOgeYlQJU3c0jt4BT18g3RXIGJBK6E2Ehim51KODFDzT9NthFf+G4 -Nu+z4cYgjui0OLzhPvYR3oydAQIDAQABMA0GCSqGSIb3DQEBBAUAA4GBACzzw3lY -JN7GO9HgQmm47mSzPWIBubOE3yN93ZjPEKn+ANgilgUTB1RXxafey9m4iEL2mdsU -dx+2/iU94aI+A6mB0i1sR/WWRowiq8jMDQ6XXotBtDvECgZAHd1G9AHduoIuPD14 -cJ58GNCr+Lh3B0Zx8coLY1xq+XKU1QFPoNtC +MIICPDCCAaUCEC0b/EoXjaOR6+f/9YtFvgswDQYJKoZIhvcNAQECBQAwXzELMAkG +A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFz +cyAyIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk2 +MDEyOTAwMDAwMFoXDTI4MDgwMTIzNTk1OVowXzELMAkGA1UEBhMCVVMxFzAVBgNV +BAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAyIFB1YmxpYyBQcmlt +YXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GN +ADCBiQKBgQC2WoujDWojg4BrzzmH9CETMwZMJaLtVRKXxaeAufqDwSCg+i8VDXyh +YGt+eSz6Bg86rvYbb7HS/y8oUl+DfUvEerf4Zh+AVPy3wo5ZShRXRtGak75BkQO7 +FYCTXOvnzAhsPz6zSvz/S2wj1VCCJkQZjiPDceoZJEcEnnW/yKYAHwIDAQABMA0G +CSqGSIb3DQEBAgUAA4GBAIobK/o5wXTXXtgZZKJYSi034DNHD6zt96rbHuSLBlxg +J8pFUs4W7z8GZOeUaHxgMxURaa+dYo2jA1Rrpr7l7gUYYAS/QoD90KioHgE796Nc +r6Pc5iaAIzy4RHT3Cq5Ji2F4zCS/iIqnDupzGUH9TQPwiNHleI2lKk/2lw0Xd8rY -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA Timestamping Certification Authority, CN=IPS CA Timestamping Certification Authority/emailAddress=ips@mail.ips.es - Validity - Not Before: Dec 29 01:10:18 2001 GMT - Not After : Dec 27 01:10:18 2025 GMT - Subject: C=ES, ST=Barcelona, L=Barcelona, O=IPS Internet publishing Services s.l., O=ips@mail.ips.es C.I.F. B-60929452, OU=IPS CA Timestamping Certification Authority, CN=IPS CA Timestamping Certification Authority/emailAddress=ips@mail.ips.es - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:bc:b8:ee:56:a5:9a:8c:e6:36:c9:c2:62:a0:66: - 81:8d:1a:d5:7a:d2:73:9f:0e:84:64:ba:95:b4:90: - a7:78:af:ca:fe:54:61:5b:ce:b2:20:57:01:ae:44: - 92:43:10:38:11:f7:68:fc:17:40:a5:68:27:32:3b: - c4:a7:e6:42:71:c5:99:ef:76:ff:2b:95:24:f5:49: - 92:18:68:ca:00:b5:a4:5a:2f:6e:cb:d6:1b:2c:0d: - 54:67:6b:7a:29:a1:58:ab:a2:5a:00:d6:5b:bb:18: - c2:df:f6:1e:13:56:76:9b:a5:68:e2:98:ce:c6:03: - 8a:34:db:4c:83:41:a6:a9:a3 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - 8B:D0:10:50:09:81:F2:9D:09:D5:0E:60:78:03:22:A2:3F:C8:CA:66 - X509v3 Authority Key Identifier: - keyid:8B:D0:10:50:09:81:F2:9D:09:D5:0E:60:78:03:22:A2:3F:C8:CA:66 - DirName:/C=ES/ST=Barcelona/L=Barcelona/O=IPS Internet publishing Services s.l./O=ips@mail.ips.es C.I.F. B-60929452/OU=IPS CA Timestamping Certification Authority/CN=IPS CA Timestamping Certification Authority/emailAddress=ips@mail.ips.es - serial:00 - - X509v3 Basic Constraints: - CA:TRUE - X509v3 Key Usage: - Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign, Encipher Only, Decipher Only - X509v3 Extended Key Usage: - TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, Time Stamping, Microsoft Individual Code Signing, Microsoft Commercial Code Signing, Microsoft Trust List Signing, Microsoft Encrypted File System - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 Subject Alternative Name: - email:ips@mail.ips.es - X509v3 Issuer Alternative Name: - email:ips@mail.ips.es - Netscape Comment: - Timestamping CA Certificate issued by http://www.ips.es/ - Netscape Base Url: - http://www.ips.es/ips2002/ - Netscape CA Revocation Url: - http://www.ips.es/ips2002/ips2002Timestamping.crl - Netscape Revocation Url: - http://www.ips.es/ips2002/revocationTimestamping.html? - Netscape Renewal Url: - http://www.ips.es/ips2002/renewalTimestamping.html? - Netscape CA Policy Url: - http://www.ips.es/ips2002/policyTimestamping.html - X509v3 CRL Distribution Points: - URI:http://www.ips.es/ips2002/ips2002Timestamping.crl - URI:http://wwwback.ips.es/ips2002/ips2002Timestamping.crl - - Authority Information Access: - OCSP - URI:http://ocsp.ips.es/ - - Signature Algorithm: sha1WithRSAEncryption - 65:ba:c1:cc:00:1a:95:91:ca:e9:6c:3a:bf:3a:1e:14:08:7c: - fb:83:ee:6b:62:51:d3:33:91:b5:60:79:7e:04:d8:5d:79:37: - e8:c3:5b:b0:c4:67:2d:68:5a:b2:5f:0e:0a:fa:cd:3f:3a:45: - a1:ea:36:cf:26:1e:a7:11:28:c5:94:8f:84:4c:53:08:c5:93: - b3:fc:e2:7f:f5:8d:f3:b1:a9:85:5f:88:de:91:96:ee:17:5b: - ae:a5:ea:70:65:78:2c:21:64:01:95:ce:ce:4c:3e:50:f4:b6: - 59:cb:63:8d:b6:bd:18:d4:87:4a:5f:dc:ef:e9:56:f0:0a:0c: - e8:75 -MD5 Fingerprint=2E:03:FD:C5:F5:D7:2B:94:64:C1:BE:89:31:F1:16:9B -----BEGIN CERTIFICATE----- -MIIIODCCB6GgAwIBAgIBADANBgkqhkiG9w0BAQUFADCCAR4xCzAJBgNVBAYTAkVT -MRIwEAYDVQQIEwlCYXJjZWxvbmExEjAQBgNVBAcTCUJhcmNlbG9uYTEuMCwGA1UE -ChMlSVBTIEludGVybmV0IHB1Ymxpc2hpbmcgU2VydmljZXMgcy5sLjErMCkGA1UE -ChQiaXBzQG1haWwuaXBzLmVzIEMuSS5GLiAgQi02MDkyOTQ1MjE0MDIGA1UECxMr -SVBTIENBIFRpbWVzdGFtcGluZyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTE0MDIG -A1UEAxMrSVBTIENBIFRpbWVzdGFtcGluZyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0 -eTEeMBwGCSqGSIb3DQEJARYPaXBzQG1haWwuaXBzLmVzMB4XDTAxMTIyOTAxMTAx -OFoXDTI1MTIyNzAxMTAxOFowggEeMQswCQYDVQQGEwJFUzESMBAGA1UECBMJQmFy -Y2Vsb25hMRIwEAYDVQQHEwlCYXJjZWxvbmExLjAsBgNVBAoTJUlQUyBJbnRlcm5l -dCBwdWJsaXNoaW5nIFNlcnZpY2VzIHMubC4xKzApBgNVBAoUImlwc0BtYWlsLmlw -cy5lcyBDLkkuRi4gIEItNjA5Mjk0NTIxNDAyBgNVBAsTK0lQUyBDQSBUaW1lc3Rh -bXBpbmcgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxNDAyBgNVBAMTK0lQUyBDQSBU -aW1lc3RhbXBpbmcgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxHjAcBgkqhkiG9w0B -CQEWD2lwc0BtYWlsLmlwcy5lczCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA -vLjuVqWajOY2ycJioGaBjRrVetJznw6EZLqVtJCneK/K/lRhW86yIFcBrkSSQxA4 -Efdo/BdApWgnMjvEp+ZCccWZ73b/K5Uk9UmSGGjKALWkWi9uy9YbLA1UZ2t6KaFY -q6JaANZbuxjC3/YeE1Z2m6Vo4pjOxgOKNNtMg0GmqaMCAwEAAaOCBIAwggR8MB0G -A1UdDgQWBBSL0BBQCYHynQnVDmB4AyKiP8jKZjCCAVAGA1UdIwSCAUcwggFDgBSL -0BBQCYHynQnVDmB4AyKiP8jKZqGCASakggEiMIIBHjELMAkGA1UEBhMCRVMxEjAQ -BgNVBAgTCUJhcmNlbG9uYTESMBAGA1UEBxMJQmFyY2Vsb25hMS4wLAYDVQQKEyVJ -UFMgSW50ZXJuZXQgcHVibGlzaGluZyBTZXJ2aWNlcyBzLmwuMSswKQYDVQQKFCJp -cHNAbWFpbC5pcHMuZXMgQy5JLkYuICBCLTYwOTI5NDUyMTQwMgYDVQQLEytJUFMg -Q0EgVGltZXN0YW1waW5nIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MTQwMgYDVQQD -EytJUFMgQ0EgVGltZXN0YW1waW5nIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MR4w -HAYJKoZIhvcNAQkBFg9pcHNAbWFpbC5pcHMuZXOCAQAwDAYDVR0TBAUwAwEB/zAM -BgNVHQ8EBQMDB/+AMGsGA1UdJQRkMGIGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYB -BQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIB -FgYKKwYBBAGCNwoDAQYKKwYBBAGCNwoDBDARBglghkgBhvhCAQEEBAMCAAcwGgYD -VR0RBBMwEYEPaXBzQG1haWwuaXBzLmVzMBoGA1UdEgQTMBGBD2lwc0BtYWlsLmlw -cy5lczBHBglghkgBhvhCAQ0EOhY4VGltZXN0YW1waW5nIENBIENlcnRpZmljYXRl -IGlzc3VlZCBieSBodHRwOi8vd3d3Lmlwcy5lcy8wKQYJYIZIAYb4QgECBBwWGmh0 -dHA6Ly93d3cuaXBzLmVzL2lwczIwMDIvMEAGCWCGSAGG+EIBBAQzFjFodHRwOi8v -d3d3Lmlwcy5lcy9pcHMyMDAyL2lwczIwMDJUaW1lc3RhbXBpbmcuY3JsMEUGCWCG -SAGG+EIBAwQ4FjZodHRwOi8vd3d3Lmlwcy5lcy9pcHMyMDAyL3Jldm9jYXRpb25U -aW1lc3RhbXBpbmcuaHRtbD8wQgYJYIZIAYb4QgEHBDUWM2h0dHA6Ly93d3cuaXBz -LmVzL2lwczIwMDIvcmVuZXdhbFRpbWVzdGFtcGluZy5odG1sPzBABglghkgBhvhC -AQgEMxYxaHR0cDovL3d3dy5pcHMuZXMvaXBzMjAwMi9wb2xpY3lUaW1lc3RhbXBp -bmcuaHRtbDB/BgNVHR8EeDB2MDegNaAzhjFodHRwOi8vd3d3Lmlwcy5lcy9pcHMy -MDAyL2lwczIwMDJUaW1lc3RhbXBpbmcuY3JsMDugOaA3hjVodHRwOi8vd3d3YmFj -ay5pcHMuZXMvaXBzMjAwMi9pcHMyMDAyVGltZXN0YW1waW5nLmNybDAvBggrBgEF -BQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9vY3NwLmlwcy5lcy8wDQYJKoZI -hvcNAQEFBQADgYEAZbrBzAAalZHK6Ww6vzoeFAh8+4Pua2JR0zORtWB5fgTYXXk3 -6MNbsMRnLWhasl8OCvrNPzpFoeo2zyYepxEoxZSPhExTCMWTs/zif/WN87GphV+I -3pGW7hdbrqXqcGV4LCFkAZXOzkw+UPS2Wctjjba9GNSHSl/c7+lW8AoM6HU= +MIIDAzCCAmwCEQC5L2DMiJ+hekYJuFtwbIqvMA0GCSqGSIb3DQEBBQUAMIHBMQsw +CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xPDA6BgNVBAsTM0Ns +YXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBH +MjE6MDgGA1UECxMxKGMpIDE5OTggVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9y +aXplZCB1c2Ugb25seTEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazAe +Fw05ODA1MTgwMDAwMDBaFw0yODA4MDEyMzU5NTlaMIHBMQswCQYDVQQGEwJVUzEX +MBUGA1UEChMOVmVyaVNpZ24sIEluYy4xPDA6BgNVBAsTM0NsYXNzIDIgUHVibGlj +IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMjE6MDgGA1UECxMx +KGMpIDE5OTggVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25s +eTEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazCBnzANBgkqhkiG9w0B +AQEFAAOBjQAwgYkCgYEAp4gBIXQs5xoD8JjhlzwPIQjxnNuX6Zr8wgQGE75fUsjM +HiwSViy4AWkszJkfrbCWrnkE8hM5wXuYuggs6MKEEyyqaekJ9MepAqRCwiNPStjw +DqL7MWzJ5m+ZJwf15vRMeJ5t60aG+rmGyVTyssSv1EYcWskVMP8NbPUtDm3Of3cC +AwEAATANBgkqhkiG9w0BAQUFAAOBgQByLvl/0fFx+8Se9sVeUYpAmLho+Jscg9ji +nb3/7aHmZuovCfTK1+qlK5X2JGCGTUQug6XELaDTrnhpb3LabK4I8GOSN+a7xDAX +rXfMSTWqz9iP0b63GJZHc2pUIjRkLbYWm1lbtFFZOrMLFPQS32eg9K0yZF6xRnIn +jBJ7xUS0rg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEGTCCAwECEGFwy0mMX5hFKeewptlQW3owDQYJKoZIhvcNAQEFBQAwgcoxCzAJ +BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVy +aVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24s +IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNp +Z24gQ2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0 +eSAtIEczMB4XDTk5MTAwMTAwMDAwMFoXDTM2MDcxNjIzNTk1OVowgcoxCzAJBgNV +BAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNp +Z24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24sIElu +Yy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24g +Q2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAt +IEczMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArwoNwtUs22e5LeWU +J92lvuCwTY+zYVY81nzD9M0+hsuiiOLh2KRpxbXiv8GmR1BeRjmL1Za6tW8UvxDO +JxOeBUebMXoT2B/Z0wI3i60sR/COgQanDTAM6/c8DyAd3HJG7qUCyFvDyVZpTMUY +wZF7C9UTAJu878NIPkZgIIUq1ZC2zYugzDLdt/1AVbJQHFauzI13TccgTacxdu9o +koqQHgiBVrKtaaNS0MscxCM9H5n+TOgWY47GCI72MfbS+uV23bUckqNJzc0BzWjN +qWm6o+sdDZykIKbBoMXRRkwXbdKsZj+WjOCE1Db/IlnF+RFgqF8EffIa9iVCYQ/E +Srg+iQIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQA0JhU8wI1NQ0kdvekhktdmnLfe +xbjQ5F1fdiLAJvmEOjr5jLX77GDx6M4EsMjdpwOPMPOY36TmpDHf0xwLRtxyID+u +7gU8pDM/CzmscHhzS5kr3zDCVLCoO1Wh/hYozUK9dG6A2ydEp85EXdQbkJgNHkKU +sQAsBNB0owIFImNjzYO1+8FtYmtpdf1dcEG59b98377BMnMiIYtYgXsVkXq642RI +sH/7NiXaldDxJBQX3RiAa0YjOVT1jmIJBB2UkKab5iXiQkWquJCtvgiPqQtCGJTP +cjnhsUPgKM+351psE2tJs//jGHyJizNdrDPXp/naOlXJWBD5qu9ats9LS98q -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 985026699 (0x3ab6508b) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority - Validity - Not Before: Mar 19 18:33:33 2001 GMT - Not After : Mar 17 18:33:33 2021 GMT - Subject: C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:bf:61:b5:95:53:ba:57:fc:fa:f2:67:0b:3a:1a: - df:11:80:64:95:b4:d1:bc:cd:7a:cf:f6:29:96:2e: - 24:54:40:24:38:f7:1a:85:dc:58:4c:cb:a4:27:42: - 97:d0:9f:83:8a:c3:e4:06:03:5b:00:a5:51:1e:70: - 04:74:e2:c1:d4:3a:ab:d7:ad:3b:07:18:05:8e:fd: - 83:ac:ea:66:d9:18:1b:68:8a:f5:57:1a:98:ba:f5: - ed:76:3d:7c:d9:de:94:6a:3b:4b:17:c1:d5:8f:bd: - 65:38:3a:95:d0:3d:55:36:4e:df:79:57:31:2a:1e: - d8:59:65:49:58:20:98:7e:ab:5f:7e:9f:e9:d6:4d: - ec:83:74:a9:c7:6c:d8:ee:29:4a:85:2a:06:14:f9: - 54:e6:d3:da:65:07:8b:63:37:12:d7:d0:ec:c3:7b: - 20:41:44:a3:ed:cb:a0:17:e1:71:65:ce:1d:66:31: - f7:76:01:19:c8:7d:03:58:b6:95:49:1d:a6:12:26: - e8:c6:0c:76:e0:e3:66:cb:ea:5d:a6:26:ee:e5:cc: - 5f:bd:67:a7:01:27:0e:a2:ca:54:c5:b1:7a:95:1d: - 71:1e:4a:29:8a:03:dc:6a:45:c1:a4:19:5e:6f:36: - cd:c3:a2:b0:b7:fe:5c:38:e2:52:bc:f8:44:43:e6: - 90:bb - Exponent: 65537 (0x10001) - X509v3 extensions: - Authority Information Access: - OCSP - URI:https://ocsp.quovadisoffshore.com - - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Certificate Policies: - Policy: 1.3.6.1.4.1.8024.0.1 - User Notice: - Explicit Text: Reliance on the QuoVadis Root Certificate by any party assumes acceptance of the then applicable standard terms and conditions of use, certification practices, and the QuoVadis Certificate Policy. - CPS: http://www.quovadis.bm - - X509v3 Subject Key Identifier: - 8B:4B:6D:ED:D3:29:B9:06:19:EC:39:39:A9:F0:97:84:6A:CB:EF:DF - X509v3 Authority Key Identifier: - keyid:8B:4B:6D:ED:D3:29:B9:06:19:EC:39:39:A9:F0:97:84:6A:CB:EF:DF - DirName:/C=BM/O=QuoVadis Limited/OU=Root Certification Authority/CN=QuoVadis Root Certification Authority - serial:3A:B6:50:8B - - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - Signature Algorithm: sha1WithRSAEncryption - 8a:d4:14:b5:fe:f4:9a:92:a7:19:d4:a4:7e:72:18:8f:d9:68: - 7c:52:24:dd:67:6f:39:7a:c4:aa:5e:3d:e2:58:b0:4d:70:98: - 84:61:e8:1b:e3:69:18:0e:ce:fb:47:50:a0:4e:ff:f0:24:1f: - bd:b2:ce:f5:27:fc:ec:2f:53:aa:73:7b:03:3d:74:6e:e6:16: - 9e:eb:a5:2e:c4:bf:56:27:50:2b:62:ba:be:4b:1c:3c:55:5c: - 41:1d:24:be:82:20:47:5d:d5:44:7e:7a:16:68:df:7d:4d:51: - 70:78:57:1d:33:1e:fd:02:99:9c:0c:cd:0a:05:4f:c7:bb:8e: - a4:75:fa:4a:6d:b1:80:8e:09:56:b9:9c:1a:60:fe:5d:c1:d7: - 7a:dc:11:78:d0:d6:5d:c1:b7:d5:ad:32:99:03:3a:8a:cc:54: - 25:39:31:81:7b:13:22:51:ba:46:6c:a1:bb:9e:fa:04:6c:49: - 26:74:8f:d2:73:eb:cc:30:a2:e6:ea:59:22:87:f8:97:f5:0e: - fd:ea:cc:92:a4:16:c4:52:18:ea:21:ce:b1:f1:e6:84:81:e5: - ba:a9:86:28:f2:43:5a:5d:12:9d:ac:1e:d9:a8:e5:0a:6a:a7: - 7f:a0:87:29:cf:f2:89:4d:d4:ec:c5:e2:e6:7a:d0:36:23:8a: - 4a:74:36:f9 -MD5 Fingerprint=27:DE:36:FE:72:B7:00:03:00:9D:F4:F0:1E:6C:04:24 -----BEGIN CERTIFICATE----- -MIIF0DCCBLigAwIBAgIEOrZQizANBgkqhkiG9w0BAQUFADB/MQswCQYDVQQGEwJC -TTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDElMCMGA1UECxMcUm9vdCBDZXJ0 -aWZpY2F0aW9uIEF1dGhvcml0eTEuMCwGA1UEAxMlUXVvVmFkaXMgUm9vdCBDZXJ0 -aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wMTAzMTkxODMzMzNaFw0yMTAzMTcxODMz -MzNaMH8xCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMSUw -IwYDVQQLExxSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MS4wLAYDVQQDEyVR -dW9WYWRpcyBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIIBIjANBgkqhkiG -9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2G1lVO6V/z68mcLOhrfEYBklbTRvM16z/Yp -li4kVEAkOPcahdxYTMukJ0KX0J+DisPkBgNbAKVRHnAEdOLB1Dqr1607BxgFjv2D -rOpm2RgbaIr1VxqYuvXtdj182d6UajtLF8HVj71lODqV0D1VNk7feVcxKh7YWWVJ -WCCYfqtffp/p1k3sg3Spx2zY7ilKhSoGFPlU5tPaZQeLYzcS19Dsw3sgQUSj7cug -F+FxZc4dZjH3dgEZyH0DWLaVSR2mEiboxgx24ONmy+pdpibu5cxfvWenAScOospU -xbF6lR1xHkopigPcakXBpBlebzbNw6Kwt/5cOOJSvPhEQ+aQuwIDAQABo4ICUjCC -Ak4wPQYIKwYBBQUHAQEEMTAvMC0GCCsGAQUFBzABhiFodHRwczovL29jc3AucXVv -dmFkaXNvZmZzaG9yZS5jb20wDwYDVR0TAQH/BAUwAwEB/zCCARoGA1UdIASCAREw -ggENMIIBCQYJKwYBBAG+WAABMIH7MIHUBggrBgEFBQcCAjCBxxqBxFJlbGlhbmNl -IG9uIHRoZSBRdW9WYWRpcyBSb290IENlcnRpZmljYXRlIGJ5IGFueSBwYXJ0eSBh -c3N1bWVzIGFjY2VwdGFuY2Ugb2YgdGhlIHRoZW4gYXBwbGljYWJsZSBzdGFuZGFy -ZCB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB1c2UsIGNlcnRpZmljYXRpb24gcHJh -Y3RpY2VzLCBhbmQgdGhlIFF1b1ZhZGlzIENlcnRpZmljYXRlIFBvbGljeS4wIgYI -KwYBBQUHAgEWFmh0dHA6Ly93d3cucXVvdmFkaXMuYm0wHQYDVR0OBBYEFItLbe3T -KbkGGew5Oanwl4Rqy+/fMIGuBgNVHSMEgaYwgaOAFItLbe3TKbkGGew5Oanwl4Rq -y+/foYGEpIGBMH8xCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1p -dGVkMSUwIwYDVQQLExxSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MS4wLAYD -VQQDEyVRdW9WYWRpcyBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5ggQ6tlCL -MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOCAQEAitQUtf70mpKnGdSk -fnIYj9lofFIk3WdvOXrEql494liwTXCYhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8 -7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R -cHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y -mQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW -xFIY6iHOsfHmhIHluqmGKPJDWl0Snawe2ajlCmqnf6CHKc/yiU3U7MXi5nrQNiOK -SnQ2+Q== +MIICPDCCAaUCEHC65B0Q2Sk0tjjKewPMur8wDQYJKoZIhvcNAQECBQAwXzELMAkG +A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFz +cyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk2 +MDEyOTAwMDAwMFoXDTI4MDgwMTIzNTk1OVowXzELMAkGA1UEBhMCVVMxFzAVBgNV +BAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAzIFB1YmxpYyBQcmlt +YXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GN +ADCBiQKBgQDJXFme8huKARS0EN8EQNvjV69qRUCPhAwL0TPZ2RHP7gJYHyX3KqhE +BarsAx94f56TuZoAqiN91qyFomNFx3InzPRMxnVx0jnvT0Lwdd8KkMaOIG+YD/is +I19wKTakyYbnsZogy1Olhec9vn2a/iRFM9x2Fe0PonFkTGUugWhFpwIDAQABMA0G +CSqGSIb3DQEBAgUAA4GBALtMEivPLCYATxQT3ab7/AoRhIzzKBxnki98tsX63/Do +lbwdj2wsqFHMc9ikwFPwTtYmwHYBV4GSXiHx0bH/59AhWM1pF+NEHJwZRDmJXNyc +AA9WjQKZ7aKQRUzkuxCkPfAyAw7xzvjoyVGM5mKf5p/AfbdynMk2OmufTqj/ZA1k -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1 - Validity - Not Before: Sep 30 04:20:49 2003 GMT - Not After : Sep 30 04:20:49 2023 GMT - Subject: C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1 - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:b3:b3:fe:7f:d3:6d:b1:ef:16:7c:57:a5:0c:6d: - 76:8a:2f:4b:bf:64:fb:4c:ee:8a:f0:f3:29:7c:f5: - ff:ee:2a:e0:e9:e9:ba:5b:64:22:9a:9a:6f:2c:3a: - 26:69:51:05:99:26:dc:d5:1c:6a:71:c6:9a:7d:1e: - 9d:dd:7c:6c:c6:8c:67:67:4a:3e:f8:71:b0:19:27: - a9:09:0c:a6:95:bf:4b:8c:0c:fa:55:98:3b:d8:e8: - 22:a1:4b:71:38:79:ac:97:92:69:b3:89:7e:ea:21: - 68:06:98:14:96:87:d2:61:36:bc:6d:27:56:9e:57: - ee:c0:c0:56:fd:32:cf:a4:d9:8e:c2:23:d7:8d:a8: - f3:d8:25:ac:97:e4:70:38:f4:b6:3a:b4:9d:3b:97: - 26:43:a3:a1:bc:49:59:72:4c:23:30:87:01:58:f6: - 4e:be:1c:68:56:66:af:cd:41:5d:c8:b3:4d:2a:55: - 46:ab:1f:da:1e:e2:40:3d:db:cd:7d:b9:92:80:9c: - 37:dd:0c:96:64:9d:dc:22:f7:64:8b:df:61:de:15: - 94:52:15:a0:7d:52:c9:4b:a8:21:c9:c6:b1:ed:cb: - c3:95:60:d1:0f:f0:ab:70:f8:df:cb:4d:7e:ec:d6: - fa:ab:d9:bd:7f:54:f2:a5:e9:79:fa:d9:d6:76:24: - 28:73 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48 - X509v3 Key Usage: - Certificate Sign, CRL Sign - X509v3 Basic Constraints: critical - CA:TRUE - Signature Algorithm: sha1WithRSAEncryption - 68:40:a9:a8:bb:e4:4f:5d:79:b3:05:b5:17:b3:60:13:eb:c6: - 92:5d:e0:d1:d3:6a:fe:fb:be:9b:6d:bf:c7:05:6d:59:20:c4: - 1c:f0:b7:da:84:58:02:63:fa:48:16:ef:4f:a5:0b:f7:4a:98: - f2:3f:9e:1b:ad:47:6b:63:ce:08:47:eb:52:3f:78:9c:af:4d: - ae:f8:d5:4f:cf:9a:98:2a:10:41:39:52:c4:dd:d9:9b:0e:ef: - 93:01:ae:b2:2e:ca:68:42:24:42:6c:b0:b3:3a:3e:cd:e9:da: - 48:c4:15:cb:e9:f9:07:0f:92:50:49:8a:dd:31:97:5f:c9:e9: - 37:aa:3b:59:65:97:94:32:c9:b3:9f:3e:3a:62:58:c5:49:ad: - 62:0e:71:a5:32:aa:2f:c6:89:76:43:40:13:13:67:3d:a2:54: - 25:10:cb:f1:3a:f2:d9:fa:db:49:56:bb:a6:fe:a7:41:35:c3: - e0:88:61:c9:88:c7:df:36:10:22:98:59:ea:b0:4a:fb:56:16: - 73:6e:ac:4d:f7:22:a1:4f:ad:1d:7a:2d:45:27:e5:30:c1:5e: - f2:da:13:cb:25:42:51:95:47:03:8c:6c:21:cc:74:42:ed:53: - ff:33:8b:8f:0f:57:01:16:2f:cf:a6:ee:c9:70:22:14:bd:fd: - be:6c:0b:03 -MD5 Fingerprint=F1:BC:63:6A:54:E0:B5:27:F5:CD:E7:1A:E3:4D:6E:4A -----BEGIN CERTIFICATE----- -MIIDWjCCAkKgAwIBAgIBADANBgkqhkiG9w0BAQUFADBQMQswCQYDVQQGEwJKUDEY -MBYGA1UEChMPU0VDT00gVHJ1c3QubmV0MScwJQYDVQQLEx5TZWN1cml0eSBDb21t -dW5pY2F0aW9uIFJvb3RDQTEwHhcNMDMwOTMwMDQyMDQ5WhcNMjMwOTMwMDQyMDQ5 -WjBQMQswCQYDVQQGEwJKUDEYMBYGA1UEChMPU0VDT00gVHJ1c3QubmV0MScwJQYD -VQQLEx5TZWN1cml0eSBDb21tdW5pY2F0aW9uIFJvb3RDQTEwggEiMA0GCSqGSIb3 -DQEBAQUAA4IBDwAwggEKAoIBAQCzs/5/022x7xZ8V6UMbXaKL0u/ZPtM7orw8yl8 -9f/uKuDp6bpbZCKamm8sOiZpUQWZJtzVHGpxxpp9Hp3dfGzGjGdnSj74cbAZJ6kJ -DKaVv0uMDPpVmDvY6CKhS3E4eayXkmmziX7qIWgGmBSWh9JhNrxtJ1aeV+7AwFb9 -Ms+k2Y7CI9eNqPPYJayX5HA49LY6tJ07lyZDo6G8SVlyTCMwhwFY9k6+HGhWZq/N -QV3Is00qVUarH9oe4kA92819uZKAnDfdDJZkndwi92SL32HeFZRSFaB9UslLqCHJ -xrHty8OVYNEP8Ktw+N/LTX7s1vqr2b1/VPKl6Xn62dZ2JChzAgMBAAGjPzA9MB0G -A1UdDgQWBBSgc0mZaNyFW2XjmygvV5+9M7wHSDALBgNVHQ8EBAMCAQYwDwYDVR0T -AQH/BAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAaECpqLvkT115swW1F7NgE+vG -kl3g0dNq/vu+m22/xwVtWSDEHPC32oRYAmP6SBbvT6UL90qY8j+eG61Ha2POCEfr -Uj94nK9NrvjVT8+amCoQQTlSxN3Zmw7vkwGusi7KaEIkQmywszo+zenaSMQVy+n5 -Bw+SUEmK3TGXX8npN6o7WWWXlDLJs58+OmJYxUmtYg5xpTKqL8aJdkNAExNnPaJU -JRDL8Try2frbSVa7pv6nQTXD4IhhyYjH3zYQIphZ6rBK+1YWc26sTfcioU+tHXot -RSflMMFe8toTyyVCUZVHA4xsIcx0Qu1T/zOLjw9XARYvz6buyXAiFL39vmwLAw== +MIIDAjCCAmsCEH3Z/gfPqB63EHln+6eJNMYwDQYJKoZIhvcNAQEFBQAwgcExCzAJ +BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xh +c3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcy +MTowOAYDVQQLEzEoYykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp +emVkIHVzZSBvbmx5MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMB4X +DTk4MDUxODAwMDAwMFoXDTI4MDgwMTIzNTk1OVowgcExCzAJBgNVBAYTAlVTMRcw +FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xhc3MgMyBQdWJsaWMg +UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcyMTowOAYDVQQLEzEo +YykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 +MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB +AQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4 +pO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0 +13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4mx0ciU9cZwID +AQABMA0GCSqGSIb3DQEBBQUAA4GBAFFNzb5cy5gZnBWyATl4Lk0PZ3BwmcYQWpSk +U01UbSuvDV1Ai2TT1+7eVmGSX6bEHRBhNtMsJzzoKQm5EWR0zLVznxxIqbxhAe7i +F6YM40AIOw7n60RzKprxaZLvcRTDOaxxp5EJb+RxBrO6WVcmeQD2+A2iMzAo1KpY +oJ2daZH9 -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 36 (0x24) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=FI, O=Sonera, CN=Sonera Class1 CA - Validity - Not Before: Apr 6 10:49:13 2001 GMT - Not After : Apr 6 10:49:13 2021 GMT - Subject: C=FI, O=Sonera, CN=Sonera Class1 CA - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:b5:89:1f:2b:4f:67:0a:79:ff:c5:1e:f8:7f:3c: - ed:d1:7e:da:b0:cd:6d:2f:36:ac:34:c6:db:d9:64: - 17:08:63:30:33:22:8a:4c:ee:8e:bb:0f:0d:42:55: - c9:9d:2e:a5:ef:f7:a7:8c:c3:ab:b9:97:cb:8e:ef: - 3f:15:67:a8:82:72:63:53:0f:41:8c:7d:10:95:24: - a1:5a:a5:06:fa:92:57:9d:fa:a5:01:f2:75:e9:1f: - bc:56:26:52:4e:78:19:65:58:55:03:58:c0:14:ae: - 8c:7c:55:5f:70:5b:77:23:06:36:97:f3:24:b5:9a: - 46:95:e4:df:0d:0b:05:45:e5:d1:f2:1d:82:bb:c6: - 13:e0:fe:aa:7a:fd:69:30:94:f3:d2:45:85:fc:f2: - 32:5b:32:de:e8:6c:5d:1f:cb:a4:22:74:b0:80:8e: - 5d:94:f7:06:00:4b:a9:d4:5e:2e:35:50:09:f3:80: - 97:f4:0c:17:ae:39:d8:5f:cd:33:c1:1c:ca:89:c2: - 22:f7:45:12:ed:5e:12:93:9d:63:ab:82:2e:b9:eb: - 42:41:44:cb:4a:1a:00:82:0d:9e:f9:8b:57:3e:4c: - c7:17:ed:2c:8b:72:33:5f:72:7a:38:56:d5:e6:d9: - ae:05:1a:1d:75:45:b1:cb:a5:25:1c:12:57:36:fd: - 22:37 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Subject Key Identifier: - 47:E2:0C:8B:F6:53:88:52 - X509v3 Key Usage: - Certificate Sign, CRL Sign - Signature Algorithm: sha1WithRSAEncryption - 8b:1a:b2:c9:5d:61:b4:e1:b9:2b:b9:53:d1:b2:85:9d:77:8e: - 16:ee:11:3d:db:c2:63:d9:5b:97:65:fb:12:67:d8:2a:5c:b6: - ab:e5:5e:c3:b7:16:2f:c8:e8:ab:1d:8a:fd:ab:1a:7c:d5:5f: - 63:cf:dc:b0:dd:77:b9:a8:e6:d2:22:38:87:07:14:d9:ff:be: - 56:b5:fd:07:0e:3c:55:ca:16:cc:a7:a6:77:37:fb:db:5c:1f: - 4e:59:06:87:a3:03:43:f5:16:ab:b7:84:bd:4e:ef:9f:31:37: - f0:46:f1:40:b6:d1:0c:a5:64:f8:63:5e:21:db:55:4e:4f:31: - 76:9c:10:61:8e:b6:53:3a:a3:11:be:af:6d:7c:1e:bd:ae:2d: - e2:0c:69:c7:85:53:68:a2:61:ba:c5:3e:b4:79:54:78:9e:0a: - c7:02:be:62:d1:11:82:4b:65:2f:91:5a:c2:a8:87:b1:56:68: - 94:79:f9:25:f7:c1:d5:ae:1a:b8:bb:3d:8f:a9:8a:38:15:f7: - 73:d0:5a:60:d1:80:b0:f0:dc:d5:50:cd:4e:ee:92:48:69:ed: - b2:23:1e:30:cc:c8:94:c8:b6:f5:3b:86:7f:3f:a6:2e:9f:f6: - 3e:2c:b5:92:96:3e:df:2c:93:8a:ff:81:8c:0f:0f:59:21:19: - 57:bd:55:9a -MD5 Fingerprint=33:B7:84:F5:5F:27:D7:68:27:DE:14:DE:12:2A:ED:6F -----BEGIN CERTIFICATE----- -MIIDIDCCAgigAwIBAgIBJDANBgkqhkiG9w0BAQUFADA5MQswCQYDVQQGEwJGSTEP -MA0GA1UEChMGU29uZXJhMRkwFwYDVQQDExBTb25lcmEgQ2xhc3MxIENBMB4XDTAx -MDQwNjEwNDkxM1oXDTIxMDQwNjEwNDkxM1owOTELMAkGA1UEBhMCRkkxDzANBgNV -BAoTBlNvbmVyYTEZMBcGA1UEAxMQU29uZXJhIENsYXNzMSBDQTCCASIwDQYJKoZI -hvcNAQEBBQADggEPADCCAQoCggEBALWJHytPZwp5/8Ue+H887dF+2rDNbS82rDTG -29lkFwhjMDMiikzujrsPDUJVyZ0upe/3p4zDq7mXy47vPxVnqIJyY1MPQYx9EJUk -oVqlBvqSV536pQHydekfvFYmUk54GWVYVQNYwBSujHxVX3BbdyMGNpfzJLWaRpXk -3w0LBUXl0fIdgrvGE+D+qnr9aTCU89JFhfzyMlsy3uhsXR/LpCJ0sICOXZT3BgBL -qdReLjVQCfOAl/QMF6452F/NM8EcyonCIvdFEu1eEpOdY6uCLrnrQkFEy0oaAIIN -nvmLVz5MxxftLItyM19yejhW1ebZrgUaHXVFsculJRwSVzb9IjcCAwEAAaMzMDEw -DwYDVR0TAQH/BAUwAwEB/zARBgNVHQ4ECgQIR+IMi/ZTiFIwCwYDVR0PBAQDAgEG -MA0GCSqGSIb3DQEBBQUAA4IBAQCLGrLJXWG04bkruVPRsoWdd44W7hE928Jj2VuX -ZfsSZ9gqXLar5V7DtxYvyOirHYr9qxp81V9jz9yw3Xe5qObSIjiHBxTZ/75Wtf0H -DjxVyhbMp6Z3N/vbXB9OWQaHowND9Rart4S9Tu+fMTfwRvFAttEMpWT4Y14h21VO -TzF2nBBhjrZTOqMRvq9tfB69ri3iDGnHhVNoomG6xT60eVR4ngrHAr5i0RGCS2Uv -kVrCqIexVmiUefkl98HVrhq4uz2PqYo4Ffdz0Fpg0YCw8NzVUM1O7pJIae2yIx4w -zMiUyLb1O4Z/P6Yun/Y+LLWSlj7fLJOK/4GMDw9ZIRlXvVWa +MIIEGjCCAwICEQCbfgZJoz5iudXukEhxKe9XMA0GCSqGSIb3DQEBBQUAMIHKMQsw +CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl +cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu +LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT +aWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp +dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD +VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT +aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ +bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu +IENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg +LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMu6nFL8eB8aHm8b +N3O9+MlrlBIwT/A2R/XQkQr1F8ilYcEWQE37imGQ5XYgwREGfassbqb1EUGO+i2t +KmFZpGcmTNDovFJbcCAEWNF6yaRpvIMXZK0Fi7zQWM6NjPXr8EJJC52XJ2cybuGu +kxUccLwgTS8Y3pKI6GyFVxEa6X7jJhFUokWWVYPKMIno3Nij7SqAP395ZVc+FSBm +CC+Vk7+qRy+oRpfwEuL+wgorUeZ25rdGt+INpsyow0xZVYnm6FNcHOqd8GIWC6fJ +Xwzw3sJ2zq/3avL6QaaiMxTJ5Xpj055iN9WFZZ4O5lMkdBteHRJTW8cs54NJOxWu +imi5V5cCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAERSWwauSCPc/L8my/uRan2Te +2yFPhpk0djZX3dAVL8WtfxUfN2JzPtTnX84XA9s1+ivbrmAJXx5fj267Cz3qWhMe +DGBvtcC1IyIuBwvLqXTLR7sdwdela8wv0kL9Sd2nic9TutoAWii/gt/4uhMdUIaC +/Y4wjylGsB49Ndo4YhYYSq3mtlFs3q9i6wHQHiT+eo8SGhJouPtmmRQURVyu565p +F4ErWjfJXir0xuKhXFSbplQAz/DxwceYMBo7Nhbbo27q/a2ywtrvAkcTisDxszGt +TxzhT5yvDwyd93gN2PQ1VoDat20Xj50egWTh/sVFuq1ruQp6Tk9LhO5L8X3dEQ== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 29 (0x1d) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=FI, O=Sonera, CN=Sonera Class2 CA - Validity - Not Before: Apr 6 07:29:40 2001 GMT - Not After : Apr 6 07:29:40 2021 GMT - Subject: C=FI, O=Sonera, CN=Sonera Class2 CA - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:90:17:4a:35:9d:ca:f0:0d:96:c7:44:fa:16:37: - fc:48:bd:bd:7f:80:2d:35:3b:e1:6f:a8:67:a9:bf: - 03:1c:4d:8c:6f:32:47:d5:41:68:a4:13:04:c1:35: - 0c:9a:84:43:fc:5c:1d:ff:89:b3:e8:17:18:cd:91: - 5f:fb:89:e3:ea:bf:4e:5d:7c:1b:26:d3:75:79:ed: - e6:84:e3:57:e5:ad:29:c4:f4:3a:28:e7:a5:7b:84: - 36:69:b3:fd:5e:76:bd:a3:2d:99:d3:90:4e:23:28: - 7d:18:63:f1:54:3b:26:9d:76:5b:97:42:b2:ff:ae: - f0:4e:ec:dd:39:95:4e:83:06:7f:e7:49:40:c8:c5: - 01:b2:54:5a:66:1d:3d:fc:f9:e9:3c:0a:9e:81:b8: - 70:f0:01:8b:e4:23:54:7c:c8:ae:f8:90:1e:00:96: - 72:d4:54:cf:61:23:bc:ea:fb:9d:02:95:d1:b6:b9: - 71:3a:69:08:3f:0f:b4:e1:42:c7:88:f5:3f:98:a8: - a7:ba:1c:e0:71:71:ef:58:57:81:50:7a:5c:6b:74: - 46:0e:83:03:98:c3:8e:a8:6e:f2:76:32:6e:27:83: - c2:73:f3:dc:18:e8:b4:93:ea:75:44:6b:04:60:20: - 71:57:87:9d:f3:be:a0:90:23:3d:8a:24:e1:da:21: - db:c3 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Subject Key Identifier: - 4A:A0:AA:58:84:D3:5E:3C - X509v3 Key Usage: - Certificate Sign, CRL Sign - Signature Algorithm: sha1WithRSAEncryption - 5a:ce:87:f9:16:72:15:57:4b:1d:d9:9b:e7:a2:26:30:ec:93: - 67:df:d6:2d:d2:34:af:f7:38:a5:ce:ab:16:b9:ab:2f:7c:35: - cb:ac:d0:0f:b4:4c:2b:fc:80:ef:6b:8c:91:5f:36:76:f7:db: - b3:1b:19:ea:f4:b2:11:fd:61:71:44:bf:28:b3:3a:1d:bf:b3: - 43:e8:9f:bf:dc:31:08:71:b0:9d:8d:d6:34:47:32:90:c6:65: - 24:f7:a0:4a:7c:04:73:8f:39:6f:17:8c:72:b5:bd:4b:c8:7a: - f8:7b:83:c3:28:4e:9c:09:ea:67:3f:b2:67:04:1b:c3:14:da: - f8:e7:49:24:91:d0:1d:6a:fa:61:39:ef:6b:e7:21:75:06:07: - d8:12:b4:21:20:70:42:71:81:da:3c:9a:36:be:a6:5b:0d:6a: - 6c:9a:1f:91:7b:f9:f9:ef:42:ba:4e:4e:9e:cc:0c:8d:94:dc: - d9:45:9c:5e:ec:42:50:63:ae:f4:5d:c4:b1:12:dc:ca:3b:a8: - 2e:9d:14:5a:05:75:b7:ec:d7:63:e2:ba:35:b6:04:08:91:e8: - da:9d:9c:f6:66:b5:18:ac:0a:a6:54:26:34:33:d2:1b:c1:d4: - 7f:1a:3a:8e:0b:aa:32:6e:db:fc:4f:25:9f:d9:32:c7:96:5a: - 70:ac:df:4c -MD5 Fingerprint=A3:EC:75:0F:2E:88:DF:FA:48:01:4E:0B:5C:48:6F:FB -----BEGIN CERTIFICATE----- -MIIDIDCCAgigAwIBAgIBHTANBgkqhkiG9w0BAQUFADA5MQswCQYDVQQGEwJGSTEP -MA0GA1UEChMGU29uZXJhMRkwFwYDVQQDExBTb25lcmEgQ2xhc3MyIENBMB4XDTAx -MDQwNjA3Mjk0MFoXDTIxMDQwNjA3Mjk0MFowOTELMAkGA1UEBhMCRkkxDzANBgNV -BAoTBlNvbmVyYTEZMBcGA1UEAxMQU29uZXJhIENsYXNzMiBDQTCCASIwDQYJKoZI -hvcNAQEBBQADggEPADCCAQoCggEBAJAXSjWdyvANlsdE+hY3/Ei9vX+ALTU74W+o -Z6m/AxxNjG8yR9VBaKQTBME1DJqEQ/xcHf+Js+gXGM2RX/uJ4+q/Tl18GybTdXnt -5oTjV+WtKcT0OijnpXuENmmz/V52vaMtmdOQTiMofRhj8VQ7Jp12W5dCsv+u8E7s -3TmVToMGf+dJQMjFAbJUWmYdPfz56TwKnoG4cPABi+QjVHzIrviQHgCWctRUz2Ej -vOr7nQKV0ba5cTppCD8PtOFCx4j1P5iop7oc4HFx71hXgVB6XGt0Rg6DA5jDjqhu -8nYybieDwnPz3BjotJPqdURrBGAgcVeHnfO+oJAjPYok4doh28MCAwEAAaMzMDEw -DwYDVR0TAQH/BAUwAwEB/zARBgNVHQ4ECgQISqCqWITTXjwwCwYDVR0PBAQDAgEG -MA0GCSqGSIb3DQEBBQUAA4IBAQBazof5FnIVV0sd2ZvnoiYw7JNn39Yt0jSv9zil -zqsWuasvfDXLrNAPtEwr/IDva4yRXzZ299uzGxnq9LIR/WFxRL8oszodv7ND6J+/ -3DEIcbCdjdY0RzKQxmUk96BKfARzjzlvF4xytb1LyHr4e4PDKE6cCepnP7JnBBvD -FNr450kkkdAdavphOe9r5yF1BgfYErQhIHBCcYHaPJo2vqZbDWpsmh+Re/n570K6 -Tk6ezAyNlNzZRZxe7EJQY670XcSxEtzKO6gunRRaBXW37Ndj4ro1tgQIkejanZz2 -ZrUYrAqmVCY0M9IbwdR/GjqOC6oybtv8TyWf2TLHllpwrN9M +MIIDAjCCAmsCEDKIjprS9esTR/h/xCA3JfgwDQYJKoZIhvcNAQEFBQAwgcExCzAJ +BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xh +c3MgNCBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcy +MTowOAYDVQQLEzEoYykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp +emVkIHVzZSBvbmx5MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMB4X +DTk4MDUxODAwMDAwMFoXDTI4MDgwMTIzNTk1OVowgcExCzAJBgNVBAYTAlVTMRcw +FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xhc3MgNCBQdWJsaWMg +UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcyMTowOAYDVQQLEzEo +YykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 +MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB +AQUAA4GNADCBiQKBgQC68OTP+cSuhVS5B1f5j8V/aBH4xBewRNzjMHPVKmIquNDM +HO0oW369atyzkSTKQWI8/AIBvxwWMZQFl3Zuoq29YRdsTjCG8FE3KlDHqGKB3FtK +qsGgtG7rL+VXxbErQHDbWk2hjh+9Ax/YA9SPTJlxvOKCzFjomDqG04Y48wApHwID +AQABMA0GCSqGSIb3DQEBBQUAA4GBAIWMEsGnuVAVess+rLhDityq3RS6iYF+ATwj +cSGIL4LcY/oCRaxFWdcqWERbt5+BO5JoPeI3JPV7bI92NZYJqFmduc4jq3TWg/0y +cyfYaT5DdPauxYma51N86Xv2S/PBZYPejYqcPIiNOVn8qj8ijaHBZlCBckztImRP +T8qAkbYp -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 10000010 (0x98968a) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA - Validity - Not Before: Dec 17 09:23:49 2002 GMT - Not After : Dec 16 09:15:38 2015 GMT - Subject: C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:98:d2:b5:51:11:7a:81:a6:14:98:71:6d:be:cc: - e7:13:1b:d6:27:0e:7a:b3:6a:18:1c:b6:61:5a:d5: - 61:09:bf:de:90:13:c7:67:ee:dd:f3:da:c5:0c:12: - 9e:35:55:3e:2c:27:88:40:6b:f7:dc:dd:22:61:f5: - c2:c7:0e:f5:f6:d5:76:53:4d:8f:8c:bc:18:76:37: - 85:9d:e8:ca:49:c7:d2:4f:98:13:09:a2:3e:22:88: - 9c:7f:d6:f2:10:65:b4:ee:5f:18:d5:17:e3:f8:c5: - fd:e2:9d:a2:ef:53:0e:85:77:a2:0f:e1:30:47:ee: - 00:e7:33:7d:44:67:1a:0b:51:e8:8b:a0:9e:50:98: - 68:34:52:1f:2e:6d:01:f2:60:45:f2:31:eb:a9:31: - 68:29:bb:7a:41:9e:c6:19:7f:94:b4:51:39:03:7f: - b2:de:a7:32:9b:b4:47:8e:6f:b4:4a:ae:e5:af:b1: - dc:b0:1b:61:bc:99:72:de:e4:89:b7:7a:26:5d:da: - 33:49:5b:52:9c:0e:f5:8a:ad:c3:b8:3d:e8:06:6a: - c2:d5:2a:0b:6c:7b:84:bd:56:05:cb:86:65:92:ec: - 44:2b:b0:8e:b9:dc:70:0b:46:da:ad:bc:63:88:39: - fa:db:6a:fe:23:fa:bc:e4:48:f4:67:2b:6a:11:10: - 21:49 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: - CA:TRUE - X509v3 Certificate Policies: - Policy: X509v3 Any Policy - CPS: http://www.pkioverheid.nl/policies/root-policy - - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - X509v3 Subject Key Identifier: - A8:7D:EB:BC:63:A4:74:13:74:00:EC:96:E0:D3:34:C1:2C:BF:6C:F8 - Signature Algorithm: sha1WithRSAEncryption - 05:84:87:55:74:36:61:c1:bb:d1:d4:c6:15:a8:13:b4:9f:a4: - fe:bb:ee:15:b4:2f:06:0c:29:f2:a8:92:a4:61:0d:fc:ab:5c: - 08:5b:51:13:2b:4d:c2:2a:61:c8:f8:09:58:fc:2d:02:b2:39: - 7d:99:66:81:bf:6e:5c:95:45:20:6c:e6:79:a7:d1:d8:1c:29: - fc:c2:20:27:51:c8:f1:7c:5d:34:67:69:85:11:30:c6:00:d2: - d7:f3:d3:7c:b6:f0:31:57:28:12:82:73:e9:33:2f:a6:55:b4: - 0b:91:94:47:9c:fa:bb:7a:42:32:e8:ae:7e:2d:c8:bc:ac:14: - bf:d9:0f:d9:5b:fc:c1:f9:7a:95:e1:7d:7e:96:fc:71:b0:c2: - 4c:c8:df:45:34:c9:ce:0d:f2:9c:64:08:d0:3b:c3:29:c5:b2: - ed:90:04:c1:b1:29:91:c5:30:6f:c1:a9:72:33:cc:fe:5d:16: - 17:2c:11:69:e7:7e:fe:c5:83:08:df:bc:dc:22:3a:2e:20:69: - 23:39:56:60:67:90:8b:2e:76:39:fb:11:88:97:f6:7c:bd:4b: - b8:20:16:67:05:8d:e2:3b:c1:72:3f:94:95:37:c7:5d:b9:9e: - d8:93:a1:17:8f:ff:0c:66:15:c1:24:7c:32:7c:03:1d:3b:a1: - 58:45:32:93 -MD5 Fingerprint=60:84:7C:5A:CE:DB:0C:D4:CB:A7:E9:FE:02:C6:A9:C0 -----BEGIN CERTIFICATE----- -MIIDujCCAqKgAwIBAgIEAJiWijANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJO -TDEeMBwGA1UEChMVU3RhYXQgZGVyIE5lZGVybGFuZGVuMSYwJAYDVQQDEx1TdGFh -dCBkZXIgTmVkZXJsYW5kZW4gUm9vdCBDQTAeFw0wMjEyMTcwOTIzNDlaFw0xNTEy -MTYwOTE1MzhaMFUxCzAJBgNVBAYTAk5MMR4wHAYDVQQKExVTdGFhdCBkZXIgTmVk -ZXJsYW5kZW4xJjAkBgNVBAMTHVN0YWF0IGRlciBOZWRlcmxhbmRlbiBSb290IENB -MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmNK1URF6gaYUmHFtvszn -ExvWJw56s2oYHLZhWtVhCb/ekBPHZ+7d89rFDBKeNVU+LCeIQGv33N0iYfXCxw71 -9tV2U02PjLwYdjeFnejKScfST5gTCaI+Ioicf9byEGW07l8Y1Rfj+MX94p2i71MO -hXeiD+EwR+4A5zN9RGcaC1Hoi6CeUJhoNFIfLm0B8mBF8jHrqTFoKbt6QZ7GGX+U -tFE5A3+y3qcym7RHjm+0Sq7lr7HcsBthvJly3uSJt3omXdozSVtSnA71iq3DuD3o -BmrC1SoLbHuEvVYFy4ZlkuxEK7COudxwC0barbxjiDn622r+I/q85Ej0ZytqERAh -SQIDAQABo4GRMIGOMAwGA1UdEwQFMAMBAf8wTwYDVR0gBEgwRjBEBgRVHSAAMDww -OgYIKwYBBQUHAgEWLmh0dHA6Ly93d3cucGtpb3ZlcmhlaWQubmwvcG9saWNpZXMv -cm9vdC1wb2xpY3kwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSofeu8Y6R0E3QA -7Jbg0zTBLL9s+DANBgkqhkiG9w0BAQUFAAOCAQEABYSHVXQ2YcG70dTGFagTtJ+k -/rvuFbQvBgwp8qiSpGEN/KtcCFtREytNwiphyPgJWPwtArI5fZlmgb9uXJVFIGzm -eafR2Bwp/MIgJ1HI8XxdNGdphREwxgDS1/PTfLbwMVcoEoJz6TMvplW0C5GUR5z6 -u3pCMuiufi3IvKwUv9kP2Vv8wfl6leF9fpb8cbDCTMjfRTTJzg3ynGQI0DvDKcWy -7ZAEwbEpkcUwb8GpcjPM/l0WFywRaed+/sWDCN+83CI6LiBpIzlWYGeQiy52OfsR -iJf2fL1LuCAWZwWN4jvBcj+UlTfHXbme2JOhF4//DGYVwSR8MnwDHTuhWEUykw== +MIIEGjCCAwICEQDsoKeLbnVqAc/EfMwvlF7XMA0GCSqGSIb3DQEBBQUAMIHKMQsw +CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl +cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu +LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT +aWduIENsYXNzIDQgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp +dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD +VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT +aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ +bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu +IENsYXNzIDQgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg +LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK3LpRFpxlmr8Y+1 +GQ9Wzsy1HyDkniYlS+BzZYlZ3tCD5PUPtbut8XzoIfzk6AzufEUiGXaStBO3IFsJ ++mGuqPKljYXCKtbeZjbSmwL0qJJgfJxptI8kHtCGUvYynEFYHiK9zUVilQhu0Gbd +U6LM8BDcVHOLBKFGMzNcF0C5nk3T875Vg+ixiY5afJqWIpA7iCXy0lOIAgwLePLm +NxdLMEYH5IBtptiWLugs+BGzOA1mppvqySNb247i8xOOGlktqgLw7KSHZtzBP/XY +ufTsgsbSPZUd5cBPhMnZo0QoBmrXRazwa2rvTl/4EYIeOGM0ZlDUPpNz+jDDZq3/ +ky2X7wMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAj/ola09b5KROJ1WrIhVZPMq1 +CtRK26vdoV9TxaBXOcLORyu+OshWv8LZJxA6sQU8wHcxuzrTBXttmhwwjIDLk5Mq +g6sFUYICABFna/OIYUdfA5PVWw3g8dShMjWFsjrbsIKr0csKvE+MW8VLADsfKoKm +fjaF3H48ZwC15DtS4KjrXRX5xm3wrR0OhbepmnMUWluPQSjA1egtTaRezarZ7c7c +2NU8Qh0XwRJdRTjDOPP8hS6DRkiy1yBfkjaP53kPmF6Z6PDQpLv1U70qzlmwr25/ +bLvSHgCwIe34QWKCudiyxLtGUPMxxY8BqHTr9Xgn2uf3ZkPznoM+IKrDNWCRzg== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 986490188 (0x3acca54c) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=DK, O=TDC Internet, OU=TDC Internet Root CA - Validity - Not Before: Apr 5 16:33:17 2001 GMT - Not After : Apr 5 17:03:17 2021 GMT - Subject: C=DK, O=TDC Internet, OU=TDC Internet Root CA - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:c4:b8:40:bc:91:d5:63:1f:d7:99:a0:8b:0c:40: - 1e:74:b7:48:9d:46:8c:02:b2:e0:24:5f:f0:19:13: - a7:37:83:6b:5d:c7:8e:f9:84:30:ce:1a:3b:fa:fb: - ce:8b:6d:23:c6:c3:6e:66:9f:89:a5:df:e0:42:50: - 67:fa:1f:6c:1e:f4:d0:05:d6:bf:ca:d6:4e:e4:68: - 60:6c:46:aa:1c:5d:63:e1:07:86:0e:65:00:a7:2e: - a6:71:c6:bc:b9:81:a8:3a:7d:1a:d2:f9:d1:ac:4b: - cb:ce:75:af:dc:7b:fa:81:73:d4:fc:ba:bd:41:88: - d4:74:b3:f9:5e:38:3a:3c:43:a8:d2:95:4e:77:6d: - 13:0c:9d:8f:78:01:b7:5a:20:1f:03:37:35:e2:2c: - db:4b:2b:2c:78:b9:49:db:c4:d0:c7:9c:9c:e4:8a: - 20:09:21:16:56:66:ff:05:ec:5b:e3:f0:cf:ab:24: - 24:5e:c3:7f:70:7a:12:c4:d2:b5:10:a0:b6:21:e1: - 8d:78:69:55:44:69:f5:ca:96:1c:34:85:17:25:77: - e2:f6:2f:27:98:78:fd:79:06:3a:a2:d6:5a:43:c1: - ff:ec:04:3b:ee:13:ef:d3:58:5a:ff:92:eb:ec:ae: - da:f2:37:03:47:41:b6:97:c9:2d:0a:41:22:bb:bb: - e6:a7 - Exponent: 65537 (0x10001) - X509v3 extensions: - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 CRL Distribution Points: - DirName:/C=DK/O=TDC Internet/OU=TDC Internet Root CA/CN=CRL1 - - X509v3 Private Key Usage Period: - Not Before: Apr 5 16:33:17 2001 GMT, Not After: Apr 5 17:03:17 2021 GMT - X509v3 Key Usage: - Certificate Sign, CRL Sign - X509v3 Authority Key Identifier: - keyid:6C:64:01:C7:FD:85:6D:AC:C8:DA:9E:50:08:85:08:B5:3C:56:A8:50 - - X509v3 Subject Key Identifier: - 6C:64:01:C7:FD:85:6D:AC:C8:DA:9E:50:08:85:08:B5:3C:56:A8:50 - X509v3 Basic Constraints: - CA:TRUE - 1.2.840.113533.7.65.0: - 0...V5.0:4.0.... - Signature Algorithm: sha1WithRSAEncryption - 4e:43:cc:d1:dd:1d:10:1b:06:7f:b7:a4:fa:d3:d9:4d:fb:23: - 9f:23:54:5b:e6:8b:2f:04:28:8b:b5:27:6d:89:a1:ec:98:69: - dc:e7:8d:26:83:05:79:74:ec:b4:b9:a3:97:c1:35:00:fd:15: - da:39:81:3a:95:31:90:de:97:e9:86:a8:99:77:0c:e5:5a:a0: - 84:ff:12:16:ac:6e:b8:8d:c3:7b:92:c2:ac:2e:d0:7d:28:ec: - b6:f3:60:38:69:6f:3e:d8:04:55:3e:9e:cc:55:d2:ba:fe:bb: - 47:04:d7:0a:d9:16:0a:34:29:f5:58:13:d5:4f:cf:8f:56:4b: - b3:1e:ee:d3:98:79:da:08:1e:0c:6f:b8:f8:16:27:ef:c2:6f: - 3d:f6:a3:4b:3e:0e:e4:6d:6c:db:3b:41:12:9b:bd:0d:47:23: - 7f:3c:4a:d0:af:c0:af:f6:ef:1b:b5:15:c4:eb:83:c4:09:5f: - 74:8b:d9:11:fb:c2:56:b1:3c:f8:70:ca:34:8d:43:40:13:8c: - fd:99:03:54:79:c6:2e:ea:86:a1:f6:3a:d4:09:bc:f4:bc:66: - cc:3d:58:d0:57:49:0a:ee:25:e2:41:ee:13:f9:9b:38:34:d1: - 00:f5:7e:e7:94:1d:fc:69:03:62:b8:99:05:05:3d:6b:78:12: - bd:b0:6f:65 -MD5 Fingerprint=91:F4:03:55:20:A1:F8:63:2C:62:DE:AC:FB:61:1C:8E -----BEGIN CERTIFICATE----- -MIIEKzCCAxOgAwIBAgIEOsylTDANBgkqhkiG9w0BAQUFADBDMQswCQYDVQQGEwJE -SzEVMBMGA1UEChMMVERDIEludGVybmV0MR0wGwYDVQQLExRUREMgSW50ZXJuZXQg -Um9vdCBDQTAeFw0wMTA0MDUxNjMzMTdaFw0yMTA0MDUxNzAzMTdaMEMxCzAJBgNV -BAYTAkRLMRUwEwYDVQQKEwxUREMgSW50ZXJuZXQxHTAbBgNVBAsTFFREQyBJbnRl -cm5ldCBSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxLhA -vJHVYx/XmaCLDEAedLdInUaMArLgJF/wGROnN4NrXceO+YQwzho7+vvOi20jxsNu -Zp+Jpd/gQlBn+h9sHvTQBda/ytZO5GhgbEaqHF1j4QeGDmUApy6mcca8uYGoOn0a -0vnRrEvLznWv3Hv6gXPU/Lq9QYjUdLP5Xjg6PEOo0pVOd20TDJ2PeAG3WiAfAzc1 -4izbSysseLlJ28TQx5yc5IogCSEWVmb/Bexb4/DPqyQkXsN/cHoSxNK1EKC2IeGN -eGlVRGn1ypYcNIUXJXfi9i8nmHj9eQY6otZaQ8H/7AQ77hPv01ha/5Lr7K7a8jcD -R0G2l8ktCkEiu7vmpwIDAQABo4IBJTCCASEwEQYJYIZIAYb4QgEBBAQDAgAHMGUG -A1UdHwReMFwwWqBYoFakVDBSMQswCQYDVQQGEwJESzEVMBMGA1UEChMMVERDIElu -dGVybmV0MR0wGwYDVQQLExRUREMgSW50ZXJuZXQgUm9vdCBDQTENMAsGA1UEAxME -Q1JMMTArBgNVHRAEJDAigA8yMDAxMDQwNTE2MzMxN1qBDzIwMjEwNDA1MTcwMzE3 -WjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAUbGQBx/2FbazI2p5QCIUItTxWqFAw -HQYDVR0OBBYEFGxkAcf9hW2syNqeUAiFCLU8VqhQMAwGA1UdEwQFMAMBAf8wHQYJ -KoZIhvZ9B0EABBAwDhsIVjUuMDo0LjADAgSQMA0GCSqGSIb3DQEBBQUAA4IBAQBO -Q8zR3R0QGwZ/t6T609lN+yOfI1Rb5osvBCiLtSdtiaHsmGnc540mgwV5dOy0uaOX -wTUA/RXaOYE6lTGQ3pfphqiZdwzlWqCE/xIWrG64jcN7ksKsLtB9KOy282A4aW8+ -2ARVPp7MVdK6/rtHBNcK2RYKNCn1WBPVT8+PVkuzHu7TmHnaCB4Mb7j4Fifvwm89 -9qNLPg7kbWzbO0ESm70NRyN/PErQr8Cv9u8btRXE64PECV90i9kR+8JWsTz4cMo0 -jUNAE4z9mQNUecYu6oah9jrUCbz0vGbMPVjQV0kK7iXiQe4T+Zs4NNEA9X7nlB38 -aQNiuJkFBT1reBK9sG9l +MIICNDCCAaECEAKtZn5ORf5eV288mBle3cAwDQYJKoZIhvcNAQECBQAwXzELMAkG +A1UEBhMCVVMxIDAeBgNVBAoTF1JTQSBEYXRhIFNlY3VyaXR5LCBJbmMuMS4wLAYD +VQQLEyVTZWN1cmUgU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk0 +MTEwOTAwMDAwMFoXDTEwMDEwNzIzNTk1OVowXzELMAkGA1UEBhMCVVMxIDAeBgNV +BAoTF1JTQSBEYXRhIFNlY3VyaXR5LCBJbmMuMS4wLAYDVQQLEyVTZWN1cmUgU2Vy +dmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGbMA0GCSqGSIb3DQEBAQUAA4GJ +ADCBhQJ+AJLOesGugz5aqomDV6wlAXYMra6OLDfO6zV4ZFQD5YRAUcm/jwjiioII +0haGN1XpsSECrXZogZoFokvJSyVmIlZsiAeP94FZbYQHZXATcXY+m3dM41CJVphI +uR2nKRoTLkoRWZweFdVJVCxzOmmCsZc5nG1wZ0jl3S3WyB57AgMBAAEwDQYJKoZI +hvcNAQECBQADfgBl3X7hsuyw4jrg7HFGmhkRuNPHoLQDQCYCPgmc4RKz0Vr2N6W3 +YQO2WxZpO8ZECAyIUwxrl0nHPjXcbLm7qt9cuzovk2C2qUtN8iD3zV9/ZHuO3ABc +1/p3yjkWWW8O6tO1g39NTUJWdrTJXwT4OPjr0l91X817/OWOgHz8UA== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1044954564 (0x3e48bdc4) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=DK, O=TDC, CN=TDC OCES CA - Validity - Not Before: Feb 11 08:39:30 2003 GMT - Not After : Feb 11 09:09:30 2037 GMT - Subject: C=DK, O=TDC, CN=TDC OCES CA - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:ac:62:f6:61:20:b2:cf:c0:c6:85:d7:e3:79:e6: - cc:ed:f2:39:92:a4:97:2e:64:a3:84:5b:87:9c:4c: - fd:a4:f3:c4:5f:21:bd:56:10:eb:db:2e:61:ec:93: - 69:e3:a3:cc:bd:99:c3:05:fc:06:b8:ca:36:1c:fe: - 90:8e:49:4c:c4:56:9a:2f:56:bc:cf:7b:0c:f1:6f: - 47:a6:0d:43:4d:e2:e9:1d:39:34:cd:8d:2c:d9:12: - 98:f9:e3:e1:c1:4a:7c:86:38:c4:a9:c4:61:88:d2: - 5e:af:1a:26:4d:d5:e4:a0:22:47:84:d9:64:b7:19: - 96:fc:ec:19:e4:b2:97:26:4e:4a:4c:cb:8f:24:8b: - 54:18:1c:48:61:7b:d5:88:68:da:5d:b5:ea:cd:1a: - 30:c1:80:83:76:50:aa:4f:d1:d4:dd:38:f0:ef:16: - f4:e1:0c:50:06:bf:ea:fb:7a:49:a1:28:2b:1c:f6: - fc:15:32:a3:74:6a:8f:a9:c3:62:29:71:31:e5:3b: - a4:60:17:5e:74:e6:da:13:ed:e9:1f:1f:1b:d1:b2: - 68:73:c6:10:34:75:46:10:10:e3:90:00:76:40:cb: - 8b:b7:43:09:21:ff:ab:4e:93:c6:58:e9:a5:82:db: - 77:c4:3a:99:b1:72:95:49:04:f0:b7:2b:fa:7b:59: - 8e:dd - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - X509v3 Certificate Policies: - Policy: 1.2.208.169.1.1.1 - CPS: http://www.certifikat.dk/repository - User Notice: - Organization: TDC - Number: 1 - Explicit Text: Certifikater fra denne CA udstedes under OID 1.2.208.169.1.1.1. Certificates from this CA are issued under OID 1.2.208.169.1.1.1. - - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 CRL Distribution Points: - DirName:/C=DK/O=TDC/CN=TDC OCES CA/CN=CRL1 - URI:http://crl.oces.certifikat.dk/oces.crl - - X509v3 Private Key Usage Period: - Not Before: Feb 11 08:39:30 2003 GMT, Not After: Feb 11 09:09:30 2037 GMT - X509v3 Authority Key Identifier: - keyid:60:B5:85:EC:56:64:7E:12:19:27:67:1D:50:15:4B:73:AE:3B:F9:12 - - X509v3 Subject Key Identifier: - 60:B5:85:EC:56:64:7E:12:19:27:67:1D:50:15:4B:73:AE:3B:F9:12 - 1.2.840.113533.7.65.0: - 0...V6.0:4.0.... - Signature Algorithm: sha1WithRSAEncryption - 0a:ba:26:26:46:d3:73:a8:09:f3:6b:0b:30:99:fd:8a:e1:57: - 7a:11:d3:b8:94:d7:09:10:6e:a3:b1:38:03:d1:b6:f2:43:41: - 29:62:a7:72:d8:fb:7c:05:e6:31:70:27:54:18:4e:8a:7c:4e: - e5:d1:ca:8c:78:88:cf:1b:d3:90:8b:e6:23:f8:0b:0e:33:43: - 7d:9c:e2:0a:19:8f:c9:01:3e:74:5d:74:c9:8b:1c:03:e5:18: - c8:01:4c:3f:cb:97:05:5d:98:71:a6:98:6f:b6:7c:bd:37:7f: - be:e1:93:25:6d:6f:f0:0a:ad:17:18:e1:03:bc:07:29:c8:ad: - 26:e8:f8:61:f0:fd:21:09:7e:9a:8e:a9:68:7d:48:62:72:bd: - 00:ea:01:99:b8:06:82:51:81:4e:f1:f5:b4:91:54:b9:23:7a: - 00:9a:9f:5d:8d:e0:3c:64:b9:1a:12:92:2a:c7:82:44:72:39: - dc:e2:3c:c6:d8:55:f5:15:4e:c8:05:0e:db:c6:d0:62:a6:ec: - 15:b4:b5:02:82:db:ac:8c:a2:81:f0:9b:99:31:f5:20:20:a8: - 88:61:0a:07:9f:94:fc:d0:d7:1b:cc:2e:17:f3:04:27:76:67: - eb:54:83:fd:a4:90:7e:06:3d:04:a3:43:2d:da:fc:0b:62:ea: - 2f:5f:62:53 -MD5 Fingerprint=93:7F:90:1C:ED:84:67:17:A4:65:5F:9B:CB:30:02:97 -----BEGIN CERTIFICATE----- -MIIFGTCCBAGgAwIBAgIEPki9xDANBgkqhkiG9w0BAQUFADAxMQswCQYDVQQGEwJE -SzEMMAoGA1UEChMDVERDMRQwEgYDVQQDEwtUREMgT0NFUyBDQTAeFw0wMzAyMTEw -ODM5MzBaFw0zNzAyMTEwOTA5MzBaMDExCzAJBgNVBAYTAkRLMQwwCgYDVQQKEwNU -REMxFDASBgNVBAMTC1REQyBPQ0VTIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A -MIIBCgKCAQEArGL2YSCyz8DGhdfjeebM7fI5kqSXLmSjhFuHnEz9pPPEXyG9VhDr -2y5h7JNp46PMvZnDBfwGuMo2HP6QjklMxFaaL1a8z3sM8W9Hpg1DTeLpHTk0zY0s -2RKY+ePhwUp8hjjEqcRhiNJerxomTdXkoCJHhNlktxmW/OwZ5LKXJk5KTMuPJItU -GBxIYXvViGjaXbXqzRowwYCDdlCqT9HU3Tjw7xb04QxQBr/q+3pJoSgrHPb8FTKj -dGqPqcNiKXEx5TukYBdedObaE+3pHx8b0bJoc8YQNHVGEBDjkAB2QMuLt0MJIf+r -TpPGWOmlgtt3xDqZsXKVSQTwtyv6e1mO3QIDAQABo4ICNzCCAjMwDwYDVR0TAQH/ -BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwgewGA1UdIASB5DCB4TCB3gYIKoFQgSkB -AQEwgdEwLwYIKwYBBQUHAgEWI2h0dHA6Ly93d3cuY2VydGlmaWthdC5kay9yZXBv -c2l0b3J5MIGdBggrBgEFBQcCAjCBkDAKFgNUREMwAwIBARqBgUNlcnRpZmlrYXRl -ciBmcmEgZGVubmUgQ0EgdWRzdGVkZXMgdW5kZXIgT0lEIDEuMi4yMDguMTY5LjEu -MS4xLiBDZXJ0aWZpY2F0ZXMgZnJvbSB0aGlzIENBIGFyZSBpc3N1ZWQgdW5kZXIg -T0lEIDEuMi4yMDguMTY5LjEuMS4xLjARBglghkgBhvhCAQEEBAMCAAcwgYEGA1Ud -HwR6MHgwSKBGoESkQjBAMQswCQYDVQQGEwJESzEMMAoGA1UEChMDVERDMRQwEgYD -VQQDEwtUREMgT0NFUyBDQTENMAsGA1UEAxMEQ1JMMTAsoCqgKIYmaHR0cDovL2Ny -bC5vY2VzLmNlcnRpZmlrYXQuZGsvb2Nlcy5jcmwwKwYDVR0QBCQwIoAPMjAwMzAy -MTEwODM5MzBagQ8yMDM3MDIxMTA5MDkzMFowHwYDVR0jBBgwFoAUYLWF7FZkfhIZ -J2cdUBVLc647+RIwHQYDVR0OBBYEFGC1hexWZH4SGSdnHVAVS3OuO/kSMB0GCSqG -SIb2fQdBAAQQMA4bCFY2LjA6NC4wAwIEkDANBgkqhkiG9w0BAQUFAAOCAQEACrom -JkbTc6gJ82sLMJn9iuFXehHTuJTXCRBuo7E4A9G28kNBKWKnctj7fAXmMXAnVBhO -inxO5dHKjHiIzxvTkIvmI/gLDjNDfZziChmPyQE+dF10yYscA+UYyAFMP8uXBV2Y -caaYb7Z8vTd/vuGTJW1v8AqtFxjhA7wHKcitJuj4YfD9IQl+mo6paH1IYnK9AOoB -mbgGglGBTvH1tJFUuSN6AJqfXY3gPGS5GhKSKseCRHI53OI8xthV9RVOyAUO28bQ -YqbsFbS1AoLbrIyigfCbmTH1ICCoiGEKB5+U/NDXG8wuF/MEJ3Zn61SD/aSQfgY9 -BKNDLdr8C2LqL19iUw== +MIIDzTCCAzagAwIBAgIQU2GyYK7bcY6nlLMTM/QHCTANBgkqhkiG9w0BAQUFADCB +wTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTwwOgYDVQQL +EzNDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5 +IC0gRzIxOjA4BgNVBAsTMShjKSAxOTk4IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1 +dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdv +cmswHhcNMDAwOTI2MDAwMDAwWhcNMTAwOTI1MjM1OTU5WjCBpTEXMBUGA1UEChMO +VmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsx +OzA5BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5j +b20vcnBhIChjKTAwMSwwKgYDVQQDEyNWZXJpU2lnbiBUaW1lIFN0YW1waW5nIEF1 +dGhvcml0eSBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0hmdZ8IAIVli +zrQJIkRpivglWtvtDbc2fk7gu5Q+kCWHwmFHKdm9VLhjzCx9abQzNvQ3B5rB3UBU +/OB4naCTuQk9I1F/RMIUdNsKvsvJMDRAmD7Q1yUQgZS9B0+c1lQn3y6ov8uQjI11 +S7zi6ESHzeZBCiVu6PQkAsVSD27smHUCAwEAAaOB3zCB3DAPBgNVHRMECDAGAQH/ +AgEAMEUGA1UdIAQ+MDwwOgYMYIZIAYb4RQEHFwEDMCowKAYIKwYBBQUHAgEWHGh0 +dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEwMQYDVR0fBCowKDAmoCSgIoYgaHR0 +cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMy5jcmwwCwYDVR0PBAQDAgEGMEIGCCsG +AQUFBwEBBDYwNDAyBggrBgEFBQcwAaYmFiRodHRwOi8vb2NzcC52ZXJpc2lnbi5j +b20vb2NzcC9zdGF0dXMwDQYJKoZIhvcNAQEFBQADgYEAgnBold+2DcIBcBlK0lRW +HqzyRUyHuPU163hLBanInTsZIS5wNEqi9YngFXVF5yg3ADQnKeg3S/LvRJdrF1Ea +w1adPBqK9kpGRjeM+sv1ZFo4aC4cw+9wzrhGBha/937ntag+RaypJXUie28/sJyU +58dzq6wf7iWbwBbtt8pb8BQ= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 44:be:0c:8b:50:00:21:b4:11:d3:2a:68:06:a9:ad:69 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN - DATACorp SGC - Validity - Not Before: Jun 24 18:57:21 1999 GMT - Not After : Jun 24 19:06:30 2019 GMT - Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN - DATACorp SGC - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:df:ee:58:10:a2:2b:6e:55:c4:8e:bf:2e:46:09: - e7:e0:08:0f:2e:2b:7a:13:94:1b:bd:f6:b6:80:8e: - 65:05:93:00:1e:bc:af:e2:0f:8e:19:0d:12:47:ec: - ac:ad:a3:fa:2e:70:f8:de:6e:fb:56:42:15:9e:2e: - 5c:ef:23:de:21:b9:05:76:27:19:0f:4f:d6:c3:9c: - b4:be:94:19:63:f2:a6:11:0a:eb:53:48:9c:be:f2: - 29:3b:16:e8:1a:a0:4c:a6:c9:f4:18:59:68:c0:70: - f2:53:00:c0:5e:50:82:a5:56:6f:36:f9:4a:e0:44: - 86:a0:4d:4e:d6:47:6e:49:4a:cb:67:d7:a6:c4:05: - b9:8e:1e:f4:fc:ff:cd:e7:36:e0:9c:05:6c:b2:33: - 22:15:d0:b4:e0:cc:17:c0:b2:c0:f4:fe:32:3f:29: - 2a:95:7b:d8:f2:a7:4e:0f:54:7c:a1:0d:80:b3:09: - 03:c1:ff:5c:dd:5e:9a:3e:bc:ae:bc:47:8a:6a:ae: - 71:ca:1f:b1:2a:b8:5f:42:05:0b:ec:46:30:d1:72: - 0b:ca:e9:56:6d:f5:ef:df:78:be:61:ba:b2:a5:ae: - 04:4c:bc:a8:ac:69:15:97:bd:ef:eb:b4:8c:bf:35: - f8:d4:c3:d1:28:0e:5c:3a:9f:70:18:33:20:77:c4: - a2:af - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Key Usage: - Digital Signature, Non Repudiation, Certificate Sign, CRL Sign - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Subject Key Identifier: - 53:32:D1:B3:CF:7F:FA:E0:F1:A0:5D:85:4E:92:D2:9E:45:1D:B4:4F - X509v3 CRL Distribution Points: - URI:http://crl.usertrust.com/UTN-DATACorpSGC.crl - - X509v3 Extended Key Usage: - TLS Web Server Authentication, Microsoft Server Gated Crypto, Netscape Server Gated Crypto - Signature Algorithm: sha1WithRSAEncryption - 27:35:97:00:8a:8b:28:bd:c6:33:30:1e:29:fc:e2:f7:d5:98: - d4:40:bb:60:ca:bf:ab:17:2c:09:36:7f:50:fa:41:dc:ae:96: - 3a:0a:23:3e:89:59:c9:a3:07:ed:1b:37:ad:fc:7c:be:51:49: - 5a:de:3a:0a:54:08:16:45:c2:99:b1:87:cd:8c:68:e0:69:03: - e9:c4:4e:98:b2:3b:8c:16:b3:0e:a0:0c:98:50:9b:93:a9:70: - 09:c8:2c:a3:8f:df:02:e4:e0:71:3a:f1:b4:23:72:a0:aa:01: - df:df:98:3e:14:50:a0:31:26:bd:28:e9:5a:30:26:75:f9:7b: - 60:1c:8d:f3:cd:50:26:6d:04:27:9a:df:d5:0d:45:47:29:6b: - 2c:e6:76:d9:a9:29:7d:32:dd:c9:36:3c:bd:ae:35:f1:11:9e: - 1d:bb:90:3f:12:47:4e:8e:d7:7e:0f:62:73:1d:52:26:38:1c: - 18:49:fd:30:74:9a:c4:e5:22:2f:d8:c0:8d:ed:91:7a:4c:00: - 8f:72:7f:5d:da:dd:1b:8b:45:6b:e7:dd:69:97:a8:c5:56:4c: - 0f:0c:f6:9f:7a:91:37:f6:97:82:e0:dd:71:69:ff:76:3f:60: - 4d:3c:cf:f7:99:f9:c6:57:f4:c9:55:39:78:ba:2c:79:c9:a6: - 88:2b:f4:08 -MD5 Fingerprint=B3:A5:3E:77:21:6D:AC:4A:C0:C9:FB:D5:41:3D:CA:06 -----BEGIN CERTIFICATE----- -MIIEXjCCA0agAwIBAgIQRL4Mi1AAIbQR0ypoBqmtaTANBgkqhkiG9w0BAQUFADCB -kzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug -Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho -dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xGzAZBgNVBAMTElVUTiAtIERBVEFDb3Jw -IFNHQzAeFw05OTA2MjQxODU3MjFaFw0xOTA2MjQxOTA2MzBaMIGTMQswCQYDVQQG -EwJVUzELMAkGA1UECBMCVVQxFzAVBgNVBAcTDlNhbHQgTGFrZSBDaXR5MR4wHAYD -VQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxITAfBgNVBAsTGGh0dHA6Ly93d3cu -dXNlcnRydXN0LmNvbTEbMBkGA1UEAxMSVVROIC0gREFUQUNvcnAgU0dDMIIBIjAN -BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3+5YEKIrblXEjr8uRgnn4AgPLit6 -E5Qbvfa2gI5lBZMAHryv4g+OGQ0SR+ysraP6LnD43m77VkIVni5c7yPeIbkFdicZ -D0/Ww5y0vpQZY/KmEQrrU0icvvIpOxboGqBMpsn0GFlowHDyUwDAXlCCpVZvNvlK -4ESGoE1O1kduSUrLZ9emxAW5jh70/P/N5zbgnAVssjMiFdC04MwXwLLA9P4yPykq -lXvY8qdOD1R8oQ2AswkDwf9c3V6aPryuvEeKaq5xyh+xKrhfQgUL7EYw0XILyulW -bfXv33i+Ybqypa4ETLyorGkVl73v67SMvzX41MPRKA5cOp9wGDMgd8SirwIDAQAB -o4GrMIGoMAsGA1UdDwQEAwIBxjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRT -MtGzz3/64PGgXYVOktKeRR20TzA9BgNVHR8ENjA0MDKgMKAuhixodHRwOi8vY3Js -LnVzZXJ0cnVzdC5jb20vVVROLURBVEFDb3JwU0dDLmNybDAqBgNVHSUEIzAhBggr -BgEFBQcDAQYKKwYBBAGCNwoDAwYJYIZIAYb4QgQBMA0GCSqGSIb3DQEBBQUAA4IB -AQAnNZcAiosovcYzMB4p/OL31ZjUQLtgyr+rFywJNn9Q+kHcrpY6CiM+iVnJowft -Gzet/Hy+UUla3joKVAgWRcKZsYfNjGjgaQPpxE6YsjuMFrMOoAyYUJuTqXAJyCyj -j98C5OBxOvG0I3KgqgHf35g+FFCgMSa9KOlaMCZ1+XtgHI3zzVAmbQQnmt/VDUVH -KWss5nbZqSl9Mt3JNjy9rjXxEZ4du5A/EkdOjtd+D2JzHVImOBwYSf0wdJrE5SIv -2MCN7ZF6TACPcn9d2t0bi0Vr591pl6jFVkwPDPafepE39peC4N1xaf92P2BNPM/3 -mfnGV/TJVTl4uix5yaaIK/QI +MIIDojCCAoqgAwIBAgIQE4Y1TR0/BvLB+WUF1ZAcYjANBgkqhkiG9w0BAQUFADBr +MQswCQYDVQQGEwJVUzENMAsGA1UEChMEVklTQTEvMC0GA1UECxMmVmlzYSBJbnRl +cm5hdGlvbmFsIFNlcnZpY2UgQXNzb2NpYXRpb24xHDAaBgNVBAMTE1Zpc2EgZUNv +bW1lcmNlIFJvb3QwHhcNMDIwNjI2MDIxODM2WhcNMjIwNjI0MDAxNjEyWjBrMQsw +CQYDVQQGEwJVUzENMAsGA1UEChMEVklTQTEvMC0GA1UECxMmVmlzYSBJbnRlcm5h +dGlvbmFsIFNlcnZpY2UgQXNzb2NpYXRpb24xHDAaBgNVBAMTE1Zpc2EgZUNvbW1l +cmNlIFJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvV95WHm6h +2mCxlCfLF9sHP4CFT8icttD0b0/Pmdjh28JIXDqsOTPHH2qLJj0rNfVIsZHBAk4E +lpF7sDPwsRROEW+1QK8bRaVK7362rPKgH1g/EkZgPI2h4H3PVz4zHvtH8aoVlwdV +ZqW1LS7YgFmypw23RuwhY/81q6UCzyr0TP579ZRdhE2o8mCP2w4lPJ9zcc+U30rq +299yOIzzlr3xF7zSujtFWsan9sYXiwGd/BmoKoMWuDpI/k4+oKsGGelT84ATB+0t +vz8KPFUgOSwsAGl0lUq8ILKpeeUYiZGo3BxN77t+Nwtd/jmliFKMAGzsGHxBvfaL +dXe6YJ2E5/4tAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQD +AgEGMB0GA1UdDgQWBBQVOIMPPyw/cDMezUb+B4wg4NfDtzANBgkqhkiG9w0BAQUF +AAOCAQEAX/FBfXxcCLkr4NWSR/pnXKUTwwMhmytMiUbPWU3J/qVAtmPN3XEolWcR +zCSs00Rsca4BIGsDoo8Ytyk6feUWYFN4PMCvFYP3j1IzJL1kk5fui/fbGKhtcbP3 +LBfQdCVp9/5rPJS+TUtBjE7ic9DjkCJzQ83z7+pzzkWKsKZJ/0x9nXGIxHYdkFsd +7v3M9+79YKWxehZx0RbQfBI8bGmX265fOZpwLwU8GUYEmSA20GBuYQa7FkKMcPcw +++DbZqMAAb3mLNqRX6BGi01qnD093QVG/na/oAo85ADmJ7f/hC3euiInlhBx6yLt +398znM/jra6O1I7mT1GvFpLgXPYHDw== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 44:be:0c:8b:50:00:24:b4:11:d3:36:25:25:67:c9:89 - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Client Authentication and Email - Validity - Not Before: Jul 9 17:28:50 1999 GMT - Not After : Jul 9 17:36:58 2019 GMT - Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Client Authentication and Email - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:b2:39:85:a4:f2:7d:ab:41:3b:62:46:37:ae:cd: - c1:60:75:bc:39:65:f9:4a:1a:47:a2:b9:cc:48:cc: - 6a:98:d5:4d:35:19:b9:a4:42:e5:ce:49:e2:8a:2f: - 1e:7c:d2:31:07:c7:4e:b4:83:64:9d:2e:29:d5:a2: - 64:c4:85:bd:85:51:35:79:a4:4e:68:90:7b:1c:7a: - a4:92:a8:17:f2:98:15:f2:93:cc:c9:a4:32:95:bb: - 0c:4f:30:bd:98:a0:0b:8b:e5:6e:1b:a2:46:fa:78: - bc:a2:6f:ab:59:5e:a5:2f:cf:ca:da:6d:aa:2f:eb: - ac:a1:b3:6a:aa:b7:2e:67:35:8b:79:e1:1e:69:88: - e2:e6:46:cd:a0:a5:ea:be:0b:ce:76:3a:7a:0e:9b: - ea:fc:da:27:5b:3d:73:1f:22:e6:48:61:c6:4c:f3: - 69:b1:a8:2e:1b:b6:d4:31:20:2c:bc:82:8a:8e:a4: - 0e:a5:d7:89:43:fc:16:5a:af:1d:71:d7:11:59:da: - ba:87:0d:af:fa:f3:e1:c2:f0:a4:c5:67:8c:d6:d6: - 54:3a:de:0a:a4:ba:03:77:b3:65:c8:fd:1e:d3:74: - 62:aa:18:ca:68:93:1e:a1:85:7e:f5:47:65:cb:f8: - 4d:57:28:74:d2:34:ff:30:b6:ee:f6:62:30:14:8c: - 2c:eb - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Key Usage: - Digital Signature, Non Repudiation, Certificate Sign, CRL Sign - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Subject Key Identifier: - 89:82:67:7D:C4:9D:26:70:00:4B:B4:50:48:7C:DE:3D:AE:04:6E:7D - X509v3 CRL Distribution Points: - URI:http://crl.usertrust.com/UTN-USERFirst-ClientAuthenticationandEmail.crl - - X509v3 Extended Key Usage: - TLS Web Client Authentication, E-mail Protection - Signature Algorithm: sha1WithRSAEncryption - b1:6d:61:5d:a6:1a:7f:7c:ab:4a:e4:30:fc:53:6f:25:24:c6: - ca:ed:e2:31:5c:2b:0e:ee:ee:61:55:6f:04:3e:cf:39:de:c5: - 1b:49:94:e4:eb:20:4c:b4:e6:9e:50:2e:72:d9:8d:f5:aa:a3: - b3:4a:da:56:1c:60:97:80:dc:82:a2:ad:4a:bd:8a:2b:ff:0b: - 09:b4:c6:d7:20:04:45:e4:cd:80:01:ba:ba:2b:6e:ce:aa:d7: - 92:fe:e4:af:eb:f4:26:1d:16:2a:7f:6c:30:95:37:2f:33:12: - ac:7f:dd:c7:d1:11:8c:51:98:b2:d0:a3:91:d0:ad:f6:9f:9e: - 83:93:1e:1d:42:b8:46:af:6b:66:f0:9b:7f:ea:e3:03:02:e5: - 02:51:c1:aa:d5:35:9d:72:40:03:89:ba:31:1d:c5:10:68:52: - 9e:df:a2:85:c5:5c:08:a6:78:e6:53:4f:b1:e8:b7:d3:14:9e: - 93:a6:c3:64:e3:ac:7e:71:cd:bc:9f:e9:03:1b:cc:fb:e9:ac: - 31:c1:af:7c:15:74:02:99:c3:b2:47:a6:c2:32:61:d7:c7:6f: - 48:24:51:27:a1:d5:87:55:f2:7b:8f:98:3d:16:9e:ee:75:b6: - f8:d0:8e:f2:f3:c6:ae:28:5b:a7:f0:f3:36:17:fc:c3:05:d3: - ca:03:4a:54 -MD5 Fingerprint=D7:34:3D:EF:1D:27:09:28:E1:31:02:5B:13:2B:DD:F7 -----BEGIN CERTIFICATE----- -MIIEojCCA4qgAwIBAgIQRL4Mi1AAJLQR0zYlJWfJiTANBgkqhkiG9w0BAQUFADCB -rjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug -Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho -dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMTLVVUTi1VU0VSRmlyc3Qt -Q2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbDAeFw05OTA3MDkxNzI4NTBa -Fw0xOTA3MDkxNzM2NThaMIGuMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQxFzAV -BgNVBAcTDlNhbHQgTGFrZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5l -dHdvcmsxITAfBgNVBAsTGGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTE2MDQGA1UE -AxMtVVROLVVTRVJGaXJzdC1DbGllbnQgQXV0aGVudGljYXRpb24gYW5kIEVtYWls -MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsjmFpPJ9q0E7YkY3rs3B -YHW8OWX5ShpHornMSMxqmNVNNRm5pELlzkniii8efNIxB8dOtINknS4p1aJkxIW9 -hVE1eaROaJB7HHqkkqgX8pgV8pPMyaQylbsMTzC9mKALi+VuG6JG+ni8om+rWV6l -L8/K2m2qL+usobNqqrcuZzWLeeEeaYji5kbNoKXqvgvOdjp6Dpvq/NonWz1zHyLm -SGHGTPNpsaguG7bUMSAsvIKKjqQOpdeJQ/wWWq8dcdcRWdq6hw2v+vPhwvCkxWeM -1tZUOt4KpLoDd7NlyP0e03RiqhjKaJMeoYV+9Udly/hNVyh00jT/MLbu9mIwFIws -6wIDAQABo4G5MIG2MAsGA1UdDwQEAwIBxjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud -DgQWBBSJgmd9xJ0mcABLtFBIfN49rgRufTBYBgNVHR8EUTBPME2gS6BJhkdodHRw -Oi8vY3JsLnVzZXJ0cnVzdC5jb20vVVROLVVTRVJGaXJzdC1DbGllbnRBdXRoZW50 -aWNhdGlvbmFuZEVtYWlsLmNybDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH -AwQwDQYJKoZIhvcNAQEFBQADggEBALFtYV2mGn98q0rkMPxTbyUkxsrt4jFcKw7u -7mFVbwQ+zznexRtJlOTrIEy05p5QLnLZjfWqo7NK2lYcYJeA3IKirUq9iiv/Cwm0 -xtcgBEXkzYABurorbs6q15L+5K/r9CYdFip/bDCVNy8zEqx/3cfREYxRmLLQo5HQ -rfafnoOTHh1CuEava2bwm3/q4wMC5QJRwarVNZ1yQAOJujEdxRBoUp7fooXFXAim -eOZTT7Hot9MUnpOmw2TjrH5xzbyf6QMbzPvprDHBr3wVdAKZw7JHpsIyYdfHb0gk -USeh1YdV8nuPmD0Wnu51tvjQjvLzxq4oW6fw8zYX/MMF08oDSlQ= +MIIDgDCCAmigAwIBAgICAx4wDQYJKoZIhvcNAQEFBQAwYTELMAkGA1UEBhMCVVMx +DTALBgNVBAoTBFZJU0ExLzAtBgNVBAsTJlZpc2EgSW50ZXJuYXRpb25hbCBTZXJ2 +aWNlIEFzc29jaWF0aW9uMRIwEAYDVQQDEwlHUCBSb290IDIwHhcNMDAwODE2MjI1 +MTAwWhcNMjAwODE1MjM1OTAwWjBhMQswCQYDVQQGEwJVUzENMAsGA1UEChMEVklT +QTEvMC0GA1UECxMmVmlzYSBJbnRlcm5hdGlvbmFsIFNlcnZpY2UgQXNzb2NpYXRp +b24xEjAQBgNVBAMTCUdQIFJvb3QgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC +AQoCggEBAKkBcLWqxEDwq2omYXkZAPy/mzdZDK9vZBv42pWUJGkzEXDK41Z0ohdX +ZFwgBuHW73G3O/erwWnQSaSxBNf0V2KJXLB1LRckaeNCYOTudNargFbYiCjh+20i +/SN8RnNPflRzHqgsVVh1t0zzWkWlAhr62p3DRcMiXvOL8WAp0sdftAw6UYPvMPjU +58fy+pmjIlC++QU3o63tmsPm7IgbthknGziLgE3sucfFicv8GjLtI/C1AVj59o/g +halMCXI5Etuz9c9OYmTaxhkVOmMd6RdVoUwiPDQyRvhlV7or7zaMavrZ2UT0qt2E +1w0cslSsMoW0ZA3eQbuxNMYBhjJk1Z8CAwEAAaNCMEAwHQYDVR0OBBYEFJ59SzS/ +ca3CBfYDdYDOqU8axCRMMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEG +MA0GCSqGSIb3DQEBBQUAA4IBAQAhpXYUVfmtJ3CPPPTVbMjMCqujmAuKBiPFyWHb +mQdpNSYx/scuhMKZYdQN6X0uEyt8joW2hcdLzzW2LEc9zikv2G+fiRxkk78IvXbQ +kIqUs38oW26sTTMs7WXcFsziza6kPWKSBpUmv9+55CCmc2rBvveURNZNbyoLaxhN +dBA2aGpawWqn3TYpjLgwi08hPwAuVDAHOrqK5MOeyti12HvOdUVmB/RtLdh6yumJ +ivIj2C/LbgA2T/vwLwHMD8AiZfSr4k5hLQOCfZEWtTDVFN5ex5D8ofyrEK9ca3Cn +B+8phuiyJccg/ybdd+95RBTEvd07xQObdyPsoOy7Wjm1zK0G -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 44:be:0c:8b:50:00:24:b4:11:d3:36:2a:fe:65:0a:fd - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware - Validity - Not Before: Jul 9 18:10:42 1999 GMT - Not After : Jul 9 18:19:22 2019 GMT - Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:b1:f7:c3:38:3f:b4:a8:7f:cf:39:82:51:67:d0: - 6d:9f:d2:ff:58:f3:e7:9f:2b:ec:0d:89:54:99:b9: - 38:99:16:f7:e0:21:79:48:c2:bb:61:74:12:96:1d: - 3c:6a:72:d5:3c:10:67:3a:39:ed:2b:13:cd:66:eb: - 95:09:33:a4:6c:97:b1:e8:c6:ec:c1:75:79:9c:46: - 5e:8d:ab:d0:6a:fd:b9:2a:55:17:10:54:b3:19:f0: - 9a:f6:f1:b1:5d:b6:a7:6d:fb:e0:71:17:6b:a2:88: - fb:00:df:fe:1a:31:77:0c:9a:01:7a:b1:32:e3:2b: - 01:07:38:6e:c3:a5:5e:23:bc:45:9b:7b:50:c1:c9: - 30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98: - 17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e: - 69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b: - 29:0d:46:0f:8c:cc:49:34:b0:69:51:bd:f9:06:cd: - 68:ad:66:4c:bc:3e:ac:61:bd:0a:88:0e:c8:df:3d: - ee:7c:04:4c:9d:0a:5e:6b:91:d6:ee:c7:ed:28:8d: - ab:4d:87:89:73:d0:6e:a4:d0:1e:16:8b:14:e1:76: - 44:03:7f:63:ac:e4:cd:49:9c:c5:92:f4:ab:32:a1: - 48:5b - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Key Usage: - Digital Signature, Non Repudiation, Certificate Sign, CRL Sign - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Subject Key Identifier: - A1:72:5F:26:1B:28:98:43:95:5D:07:37:D5:85:96:9D:4B:D2:C3:45 - X509v3 CRL Distribution Points: - URI:http://crl.usertrust.com/UTN-USERFirst-Hardware.crl - - X509v3 Extended Key Usage: - TLS Web Server Authentication, IPSec End System, IPSec Tunnel, IPSec User - Signature Algorithm: sha1WithRSAEncryption - 47:19:0f:de:74:c6:99:97:af:fc:ad:28:5e:75:8e:eb:2d:67: - ee:4e:7b:2b:d7:0c:ff:f6:de:cb:55:a2:0a:e1:4c:54:65:93: - 60:6b:9f:12:9c:ad:5e:83:2c:eb:5a:ae:c0:e4:2d:f4:00:63: - 1d:b8:c0:6c:f2:cf:49:bb:4d:93:6f:06:a6:0a:22:b2:49:62: - 08:4e:ff:c8:c8:14:b2:88:16:5d:e7:01:e4:12:95:e5:45:34: - b3:8b:69:bd:cf:b4:85:8f:75:51:9e:7d:3a:38:3a:14:48:12: - c6:fb:a7:3b:1a:8d:0d:82:40:07:e8:04:08:90:a1:89:cb:19: - 50:df:ca:1c:01:bc:1d:04:19:7b:10:76:97:3b:ee:90:90:ca: - c4:0e:1f:16:6e:75:ef:33:f8:d3:6f:5b:1e:96:e3:e0:74:77: - 74:7b:8a:a2:6e:2d:dd:76:d6:39:30:82:f0:ab:9c:52:f2:2a: - c7:af:49:5e:7e:c7:68:e5:82:81:c8:6a:27:f9:27:88:2a:d5: - 58:50:95:1f:f0:3b:1c:57:bb:7d:14:39:62:2b:9a:c9:94:92: - 2a:a3:22:0c:ff:89:26:7d:5f:23:2b:47:d7:15:1d:a9:6a:9e: - 51:0d:2a:51:9e:81:f9:d4:3b:5e:70:12:7f:10:32:9c:1e:bb: - 9d:f8:66:a8 -MD5 Fingerprint=4C:56:41:E5:0D:BB:2B:E8:CA:A3:ED:18:08:AD:43:39 -----BEGIN CERTIFICATE----- -MIIEdDCCA1ygAwIBAgIQRL4Mi1AAJLQR0zYq/mUK/TANBgkqhkiG9w0BAQUFADCB -lzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug -Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho -dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xHzAdBgNVBAMTFlVUTi1VU0VSRmlyc3Qt -SGFyZHdhcmUwHhcNOTkwNzA5MTgxMDQyWhcNMTkwNzA5MTgxOTIyWjCBlzELMAkG -A1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEe -MBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExhodHRwOi8v -d3d3LnVzZXJ0cnVzdC5jb20xHzAdBgNVBAMTFlVUTi1VU0VSRmlyc3QtSGFyZHdh -cmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCx98M4P7Sof885glFn -0G2f0v9Y8+efK+wNiVSZuTiZFvfgIXlIwrthdBKWHTxqctU8EGc6Oe0rE81m65UJ -M6Rsl7HoxuzBdXmcRl6Nq9Bq/bkqVRcQVLMZ8Jr28bFdtqdt++BxF2uiiPsA3/4a -MXcMmgF6sTLjKwEHOG7DpV4jvEWbe1DByTCP2+UretNb+zNAHqDVmBe8i4fDidNd -oI6yqqr2jmmIBsX6iSHzCJ1pLgkzmykNRg+MzEk0sGlRvfkGzWitZky8PqxhvQqI -DsjfPe58BEydCl5rkdbux+0ojatNh4lz0G6k0B4WixThdkQDf2Os5M1JnMWS9Ksy -oUhbAgMBAAGjgbkwgbYwCwYDVR0PBAQDAgHGMA8GA1UdEwEB/wQFMAMBAf8wHQYD -VR0OBBYEFKFyXyYbKJhDlV0HN9WFlp1L0sNFMEQGA1UdHwQ9MDswOaA3oDWGM2h0 -dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VVE4tVVNFUkZpcnN0LUhhcmR3YXJlLmNy -bDAxBgNVHSUEKjAoBggrBgEFBQcDAQYIKwYBBQUHAwUGCCsGAQUFBwMGBggrBgEF -BQcDBzANBgkqhkiG9w0BAQUFAAOCAQEARxkP3nTGmZev/K0oXnWO6y1n7k57K9cM -//bey1WiCuFMVGWTYGufEpytXoMs61quwOQt9ABjHbjAbPLPSbtNk28Gpgoiskli -CE7/yMgUsogWXecB5BKV5UU0s4tpvc+0hY91UZ59Ojg6FEgSxvunOxqNDYJAB+gE -CJChicsZUN/KHAG8HQQZexB2lzvukJDKxA4fFm517zP4029bHpbj4HR3dHuKom4t -3XbWOTCC8KucUvIqx69JXn7HaOWCgchqJ/kniCrVWFCVH/A7HFe7fRQ5YiuayZSS -KqMiDP+JJn1fIytH1xUdqWqeUQ0qUZ6B+dQ7XnASfxAynB67nfhmqA== ------END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object - Validity - Not Before: Jul 9 18:31:20 1999 GMT - Not After : Jul 9 18:40:36 2019 GMT - Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:ce:aa:81:3f:a3:a3:61:78:aa:31:00:55:95:11: - 9e:27:0f:1f:1c:df:3a:9b:82:68:30:c0:4a:61:1d: - f1:2f:0e:fa:be:79:f7:a5:23:ef:55:51:96:84:cd: - db:e3:b9:6e:3e:31:d8:0a:20:67:c7:f4:d9:bf:94: - eb:47:04:3e:02:ce:2a:a2:5d:87:04:09:f6:30:9d: - 18:8a:97:b2:aa:1c:fc:41:d2:a1:36:cb:fb:3d:91: - ba:e7:d9:70:35:fa:e4:e7:90:c3:9b:a3:9b:d3:3c: - f5:12:99:77:b1:b7:09:e0:68:e6:1c:b8:f3:94:63: - 88:6a:6a:fe:0b:76:c9:be:f4:22:e4:67:b9:ab:1a: - 5e:77:c1:85:07:dd:0d:6c:bf:ee:06:c7:77:6a:41: - 9e:a7:0f:d7:fb:ee:94:17:b7:fc:85:be:a4:ab:c4: - 1c:31:dd:d7:b6:d1:e4:f0:ef:df:16:8f:b2:52:93: - d7:a1:d4:89:a1:07:2e:bf:e1:01:12:42:1e:1a:e1: - d8:95:34:db:64:79:28:ff:ba:2e:11:c2:e5:e8:5b: - 92:48:fb:47:0b:c2:6c:da:ad:32:83:41:f3:a5:e5: - 41:70:fd:65:90:6d:fa:fa:51:c4:f9:bd:96:2b:19: - 04:2c:d3:6d:a7:dc:f0:7f:6f:83:65:e2:6a:ab:87: - 86:75 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Key Usage: - Digital Signature, Non Repudiation, Certificate Sign, CRL Sign - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Subject Key Identifier: - DA:ED:64:74:14:9C:14:3C:AB:DD:99:A9:BD:5B:28:4D:8B:3C:C9:D8 - X509v3 CRL Distribution Points: - URI:http://crl.usertrust.com/UTN-USERFirst-Object.crl - - X509v3 Extended Key Usage: - Code Signing, Time Stamping, Microsoft Encrypted File System - Signature Algorithm: sha1WithRSAEncryption - 08:1f:52:b1:37:44:78:db:fd:ce:b9:da:95:96:98:aa:55:64: - 80:b5:5a:40:dd:21:a5:c5:c1:f3:5f:2c:4c:c8:47:5a:69:ea: - e8:f0:35:35:f4:d0:25:f3:c8:a6:a4:87:4a:bd:1b:b1:73:08: - bd:d4:c3:ca:b6:35:bb:59:86:77:31:cd:a7:80:14:ae:13:ef: - fc:b1:48:f9:6b:25:25:2d:51:b6:2c:6d:45:c1:98:c8:8a:56: - 5d:3e:ee:43:4e:3e:6b:27:8e:d0:3a:4b:85:0b:5f:d3:ed:6a: - a7:75:cb:d1:5a:87:2f:39:75:13:5a:72:b0:02:81:9f:be:f0: - 0f:84:54:20:62:6c:69:d4:e1:4d:c6:0d:99:43:01:0d:12:96: - 8c:78:9d:bf:50:a2:b1:44:aa:6a:cf:17:7a:cf:6f:0f:d4:f8: - 24:55:5f:f0:34:16:49:66:3e:50:46:c9:63:71:38:31:62:b8: - 62:b9:f3:53:ad:6c:b5:2b:a2:12:aa:19:4f:09:da:5e:e7:93: - c6:8e:14:08:fe:f0:30:80:18:a0:86:85:4d:c8:7d:d7:8b:03: - fe:6e:d5:f7:9d:16:ac:92:2c:a0:23:e5:9c:91:52:1f:94:df: - 17:94:73:c3:b3:c1:c1:71:05:20:00:78:bd:13:52:1d:a8:3e: - cd:00:1f:c8 -MD5 Fingerprint=A7:F2:E4:16:06:41:11:50:30:6B:9C:E3:B4:9C:B0:C9 ------BEGIN CERTIFICATE----- -MIIEZjCCA06gAwIBAgIQRL4Mi1AAJLQR0zYt4LNfGzANBgkqhkiG9w0BAQUFADCB -lTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug -Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho -dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xHTAbBgNVBAMTFFVUTi1VU0VSRmlyc3Qt -T2JqZWN0MB4XDTk5MDcwOTE4MzEyMFoXDTE5MDcwOTE4NDAzNlowgZUxCzAJBgNV -BAYTAlVTMQswCQYDVQQIEwJVVDEXMBUGA1UEBxMOU2FsdCBMYWtlIENpdHkxHjAc -BgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEhMB8GA1UECxMYaHR0cDovL3d3 -dy51c2VydHJ1c3QuY29tMR0wGwYDVQQDExRVVE4tVVNFUkZpcnN0LU9iamVjdDCC -ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM6qgT+jo2F4qjEAVZURnicP -HxzfOpuCaDDASmEd8S8O+r5596Uj71VRloTN2+O5bj4x2AogZ8f02b+U60cEPgLO -KqJdhwQJ9jCdGIqXsqoc/EHSoTbL+z2RuufZcDX65OeQw5ujm9M89RKZd7G3CeBo -5hy485RjiGpq/gt2yb70IuRnuasaXnfBhQfdDWy/7gbHd2pBnqcP1/vulBe3/IW+ -pKvEHDHd17bR5PDv3xaPslKT16HUiaEHLr/hARJCHhrh2JU022R5KP+6LhHC5ehb -kkj7RwvCbNqtMoNB86XlQXD9ZZBt+vpRxPm9lisZBCzTbafc8H9vg2XiaquHhnUC -AwEAAaOBrzCBrDALBgNVHQ8EBAMCAcYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E -FgQU2u1kdBScFDyr3ZmpvVsoTYs8ydgwQgYDVR0fBDswOTA3oDWgM4YxaHR0cDov -L2NybC51c2VydHJ1c3QuY29tL1VUTi1VU0VSRmlyc3QtT2JqZWN0LmNybDApBgNV -HSUEIjAgBggrBgEFBQcDAwYIKwYBBQUHAwgGCisGAQQBgjcKAwQwDQYJKoZIhvcN -AQEFBQADggEBAAgfUrE3RHjb/c652pWWmKpVZIC1WkDdIaXFwfNfLEzIR1pp6ujw -NTX00CXzyKakh0q9G7FzCL3Uw8q2NbtZhncxzaeAFK4T7/yxSPlrJSUtUbYsbUXB -mMiKVl0+7kNOPmsnjtA6S4ULX9Ptaqd1y9Fahy85dRNacrACgZ++8A+EVCBibGnU -4U3GDZlDAQ0Slox4nb9QorFEqmrPF3rPbw/U+CRVX/A0FklmPlBGyWNxODFiuGK5 -81OtbLUrohKqGU8J2l7nk8aOFAj+8DCAGKCGhU3IfdeLA/5u1fedFqySLKAj5ZyR -Uh+U3xeUc8OzwcFxBSAAeL0TUh2oPs0AH8g= +MIIETzCCAzegAwIBAgIEO63vKTANBgkqhkiG9w0BAQUFADBxMQswCQYDVQQGEwJQTDEfMB0GA1UE +ChMWVFAgSW50ZXJuZXQgU3AuIHogby5vLjEkMCIGA1UECxMbQ2VudHJ1bSBDZXJ0eWZpa2Fjamkg +U2lnbmV0MRswGQYDVQQDExJDQyBTaWduZXQgLSBSb290Q0EwHhcNMDEwOTIzMTQxODE3WhcNMTEw +OTIzMTMxODE3WjB1MQswCQYDVQQGEwJQTDEfMB0GA1UEChMWVFAgSW50ZXJuZXQgU3AuIHogby5v +LjEkMCIGA1UECxMbQ2VudHJ1bSBDZXJ0eWZpa2FjamkgU2lnbmV0MR8wHQYDVQQDExZDQyBTaWdu +ZXQgLSBDQSBLbGFzYSAxMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4SRW9Q58g5DY1Hw7h +gCRKBEdPdGn0MFHsfw7rlu/oQm7IChI/uWd9q5wwo77YojtTDjRnpgZsjqBeynX8T90vFILqsY2K +5CF1OESalwvVr3sZiQX79lisuFKat92u6hBFikFIVxfHHB67Af+g7u0dEHdDW7lwy81MwFYxBTRy +9wIDAQABo4IBbTCCAWkwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwggEEBgNVHSAE +gfwwgfkwgfYGDSsGAQQBvj8CAQoBAQAwgeQwgZoGCCsGAQUFBwICMIGNGoGKQ2VydHlmaWthdCB3 +eXN0YXdpb255IHpnb2RuaWUgeiBkb2t1bWVudGVtOiAiUG9saXR5a2EgQ2VydHlmaWthY2ppIGRs +YSBSb290Q0EiLiBDZXJ0eWZpa2F0IHd5c3Rhd2lvbnkgcHJ6ZXogUm9vdENBIHcgaGllcmFyY2hp +aSBDQyBTaWduZXQuMEUGCCsGAQUFBwIBFjlodHRwOi8vd3d3LnNpZ25ldC5wbC9yZXBvenl0b3Jp +dW0vZG9rdW1lbnR5L3BjX3Jvb3RjYS50eHQwHwYDVR0jBBgwFoAUwJvFIw0C4aZOSGsfAOnjmhQb +sa8wHQYDVR0OBBYEFMODHtVZd1T7TftXR/nEI1zR54njMA0GCSqGSIb3DQEBBQUAA4IBAQBRIHQB +FIGh8Jpxt87AgSLwIEEk4+oGy769u3NtoaR0R3WNMdmt7fXTi0tyTQ9V4AIszxVjhnUPaKnF1KYy +f8Tl+YTzk9ZfFkZ3kCdSaILZAOIrmqWNLPmjUQ5/JiMGho0e1YmWUcMci84+pIisTsytFzVP32/W ++sz2H4FQAvOIMmxB7EJX9AdbnXn9EXZ+4nCqi0ft5z96ZqOJJiCB3vSaoYg+wdkcvb6souMJzuc2 +uptXtR1Xf3ihlHaGW+hmnpcwFA6AoNrom6Vgzk6U1ienx0Cw28BhRSKqzKkyXkuK8gRflZUx84uf +tXncwKJrMiE3lvgOOBITRzcahirLer4c +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIE9zCCA9+gAwIBAgIEPL/xoTANBgkqhkiG9w0BAQUFADB2MQswCQYDVQQGEwJQTDEfMB0GA1UE +ChMWVFAgSW50ZXJuZXQgU3AuIHogby5vLjEkMCIGA1UECxMbQ2VudHJ1bSBDZXJ0eWZpa2Fjamkg +U2lnbmV0MSAwHgYDVQQDExdDQyBTaWduZXQgLSBQQ0EgS2xhc2EgMjAeFw0wMjA0MTkxMDI5NTNa +Fw0xNzA0MTgxMjUzMDdaMHUxCzAJBgNVBAYTAlBMMR8wHQYDVQQKExZUUCBJbnRlcm5ldCBTcC4g +eiBvLm8uMSQwIgYDVQQLExtDZW50cnVtIENlcnR5ZmlrYWNqaSBTaWduZXQxHzAdBgNVBAMTFkND +IFNpZ25ldCAtIENBIEtsYXNhIDIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqgLJu +QqY4yavbSgHg8CyfKTx4BokNSDOVz4eD9vptUr11Kqd06ED1hlH7Sg0goBFAfntNU/QTKwSBaNui +me7C4sSEdgsKrPoAhGb4Mq8y7Ty7RqZz7mkzNMqzL2L2U4yQ2QjvpH8MH0IBqOWEcpSkpwnrCDIm +RoTfd+YlZWKi2JceQixUUYIQ45Ox8+x8hHbvvZdgqtcvo8PW27qoHkp/7hMuJ44kDAGrmxffBXl/ +OBRZp0uO1CSLcMcVJzyr2phKhy406MYdWrtNPEluGs0GFDzd0nrIctiWAO4cmct4S72S9Q6e//0G +O9f3/Ca5Kb2I1xYLj/xE+HgjHX9aD2MhAgMBAAGjggGMMIIBiDAPBgNVHRMBAf8EBTADAQH/MA4G +A1UdDwEB/wQEAwIBBjCB4wYDVR0gBIHbMIHYMIHVBg0rBgEEAb4/AhQKAQEAMIHDMHUGCCsGAQUF +BwICMGkaZ0NlcnR5ZmlrYXQgd3lzdGF3aW9ueSB6Z29kbmllIHogZG9rdW1lbnRlbTogIlBvbGl0 +eWthIENlcnR5ZmlrYWNqaSBQQ0EyIC0gQ2VydHlmaWthdHkgVXJ6ZWRvdyBLbGFzeSAyIi4wSgYI +KwYBBQUHAgEWPmh0dHA6Ly93d3cuc2lnbmV0LnBsL3JlcG96eXRvcml1bS9kb2t1bWVudHkva2xh +c2EyL3BjX3BjYTIudHh0MD8GA1UdHwQ4MDYwNKAyoDCGLmh0dHA6Ly93d3cuc2lnbmV0LnBsL3Jl +cG96eXRvcml1bS9jcmwvcGNhMi5jcmwwHwYDVR0jBBgwFoAUwGxGyl2CfpYHRonE82AVXO08kMIw +HQYDVR0OBBYEFLtFBlILy4HNKVSzvHxBTM0HDowlMA0GCSqGSIb3DQEBBQUAA4IBAQBWTsCbqXrX +hBBev5v5cIuc6gJM8ww7oR0uMQRZoFSqvQUPWBYM2/TLI/f8UM9hSShUVj3zEsSj/vFHagUVmzuV +Xo5u0WK8iaqATSyEVBhADHrPG6wYcLKJlagge/ILA0m+SieyP2sjYD9MUB9KZIEyBKv0429UuDTw +6P7pslxMWJBSNyQxaLIs0SRKsqZZWkc7ZYAj2apSkBMX2Is1oHA+PwkF6jQMwCao/+CndXPUzfCF +6caa9WwW31W26MlXCvSmJgfiTPwGvm4PkPmOnmWZ3CczzhHl4q7ztHFzshJH3sZWDnrWwBFjzz5e +Pr3WHV1wA7EY6oT4zBx+2gT9XBTB +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEUzCCAzugAwIBAgIEPq+qjzANBgkqhkiG9w0BAQUFADBhMQswCQYDVQQGEwJQTDE3MDUGA1UE +ChMuQ1ppQyBDZW50cmFzdCBTQSB3IGltaWVuaXUgTWluaXN0cmEgR29zcG9kYXJraTEZMBcGA1UE +AxMQQ1ppQyBDZW50cmFzdCBTQTAeFw0wMzA0MzAxMDUwNTVaFw0wODA0MjgxMDUwNTVaMGgxCzAJ +BgNVBAYTAlBMMR8wHQYDVQQKExZUUCBJbnRlcm5ldCBTcC4geiBvLm8uMR8wHQYDVQQDExZDQyBT +aWduZXQgLSBDQSBLbGFzYSAzMRcwFQYDVQQFEw5OdW1lciB3cGlzdTogNDCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBALVdeOM62cPH2NERFxbS5FIp/HSv3fgesdVsTUFxZbGtE+/E0RMl +KZQJHH9emx7vRYubsi4EOLCjYsCOTFvgGRIpZzx7R7T5c0Di5XFkRU4gjBl7aHJoKb5SLzGlWdoX +GsekVtl6keEACrizV2EafqjI8cnBWY7OxQ1ooLQp5AeFjXg+5PT0lO6TUZAubqjFbhVbxSWjqvdj +93RGfyYE76MnNn4c2xWySD07n7uno06TC0IJe6+3WSX1h+76VsIFouWBXOoM7cxxiLjoqdBVu24+ +P8e81SukE7qEvOwDPmk9ZJFtt1nBNg8a1kaixcljrA/43XwOPz6qnJ+cIj/xywECAwEAAaOCAQow +ggEGMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMDMGA1UdIAEB/wQpMCcwJQYEVR0g +ADAdMBsGCCsGAQUFBwIBFg93d3cuY2VudHJhc3QucGwwgY4GA1UdIwSBhjCBg4AU2a7r85Cp1iJN +W0Ca1LR6VG3996ShZaRjMGExCzAJBgNVBAYTAlBMMTcwNQYDVQQKEy5DWmlDIENlbnRyYXN0IFNB +IHcgaW1pZW5pdSBNaW5pc3RyYSBHb3Nwb2RhcmtpMRkwFwYDVQQDExBDWmlDIENlbnRyYXN0IFNB +ggQ9/0sQMB0GA1UdDgQWBBR7Y8wZkHq0zrY7nn1tFSdQ0PlJuTANBgkqhkiG9w0BAQUFAAOCAQEA +ldt/svO5c1MU08FKgrOXCGEbEPbQxhpM0xcd6Iv3dCo6qugEgjEs9Qm5CwUNKMnFsvR27cJWUvZb +MVcvwlwCwclOdwF6u/QRS8bC2HYErhYo9bp9yuxxzuow2A94c5fPqfVrjXy+vDouchAm6+A5Wjzv +J8wxVFDCs+9iGACmyUWr/JGXCYiQIbQkwlkRKHHlan9ymKf1NvIej/3EpeT8fKr6ywxGuhAfqofW +pg3WJY/RCB4lTzD8vZGNwfMFGkWhJkypad3i9w3lGmDVpsHaWtCgGfd0H7tUtWPkP+t7EjIRCD9J +HYnTR+wbbewc5vOI+UobR15ynGfFIaSIiMTVtQ== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEejCCA2KgAwIBAgIEP4vk6TANBgkqhkiG9w0BAQUFADB1MQswCQYDVQQGEwJQ +TDEfMB0GA1UEChMWVFAgSW50ZXJuZXQgU3AuIHogby5vLjEkMCIGA1UECxMbQ2Vu +dHJ1bSBDZXJ0eWZpa2FjamkgU2lnbmV0MR8wHQYDVQQDExZDQyBTaWduZXQgLSBD +QSBLbGFzYSAyMB4XDTAzMTAxNDExNTgyMloXDTE3MDQxODEyNTMwN1owdzELMAkG +A1UEBhMCUEwxHzAdBgNVBAoTFlRQIEludGVybmV0IFNwLiB6IG8uby4xJDAiBgNV +BAsTG0NlbnRydW0gQ2VydHlmaWthY2ppIFNpZ25ldDEhMB8GA1UEAxMYQ0MgU2ln +bmV0IC0gT0NTUCBLbGFzYSAyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCo +VCsaBStblXQYVNthe3dvaCrfvKpPXngh4almm988iIlEv9CVTaAdCfaJNihvA+Vs +Qw8++ix1VqteMQE474/MV/YaXigP0Zr0QB+g+/7PWVlv+5U9Gzp9+Xx4DJay8AoI +iB7Iy5Qf9iZiHm5BiPRIuUXT4ZRbZRYPh0/76vgRsQIDAQABo4IBkjCCAY4wDgYD +VR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMJMEEGA1UdHwQ6MDgwNqA0 +oDKGMGh0dHA6Ly93d3cuc2lnbmV0LnBsL3JlcG96eXRvcml1bS9jcmwva2xhc2Ey +LmNybDCB2AYDVR0gBIHQMIHNMIHKBg4rBgEEAb4/AoFICgwBADCBtzBsBggrBgEF +BQcCAjBgGl5DZXJ0eWZpa2F0IHd5ZGFueSB6Z29kbmllIHogZG9rdW1lbnRlbSAi +UG9saXR5a2EgQ2VydHlmaWthY2ppIC0gQ2VydHlmaWthdHkgcmVzcG9uZGVyb3cg +T0NTUCIuMEcGCCsGAQUFBwIBFjtodHRwOi8vd3d3LnNpZ25ldC5wbC9yZXBvenl0 +b3JpdW0vZG9rdW1lbnR5L3BjX29jc3BfMV8wLnBkZjAfBgNVHSMEGDAWgBS7RQZS +C8uBzSlUs7x8QUzNBw6MJTAdBgNVHQ4EFgQUKEVrOY7cEHvsVgvoyZdytlbtgwEw +CQYDVR0TBAIwADANBgkqhkiG9w0BAQUFAAOCAQEAQrRg5MV6dxr0HU2IsLInxhvt +iUVmSFkIUsBCjzLoewOXA16d2oDyHhI/eE+VgAsp+2ANjZu4xRteHIHoYMsN218M +eD2MLRsYS0U9xxAFK9gDj/KscPbrrdoqLvtPSMhUb4adJS9HLhvUe6BicvBf3A71 +iCNe431axGNDWKnpuj2KUpj4CFHYsWCXky847YtTXDjri9NIwJJauazsrSjK+oXp +ngRS506mdQ7vWrtApkh8zhhWp7duCkjcCo1O8JxqYr2qEW1fXmgOISe010v2mmuv +hHxPyVwoAU4KkOw0nbXZn53yak0is5+XmAjh0wWue44AssHrjC9nUh3mkLt6eQ== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEezCCA2OgAwIBAgIEP4vnLzANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQGEwJQ +TDEfMB0GA1UEChMWVFAgSW50ZXJuZXQgU3AuIHogby5vLjEfMB0GA1UEAxMWQ0Mg +U2lnbmV0IC0gQ0EgS2xhc2EgMzEXMBUGA1UEBRMOTnVtZXIgd3Bpc3U6IDQwHhcN +MDMxMDE0MTIwODAwWhcNMDgwNDI4MTA1MDU1WjB3MQswCQYDVQQGEwJQTDEfMB0G +A1UEChMWVFAgSW50ZXJuZXQgU3AuIHogby5vLjEkMCIGA1UECxMbQ2VudHJ1bSBD +ZXJ0eWZpa2FjamkgU2lnbmV0MSEwHwYDVQQDExhDQyBTaWduZXQgLSBPQ1NQIEts +YXNhIDMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM/9GwvARNuCVN+PqZmO +4FqH8vTqhenUyqRkmAVT4YhLu0a9AXeLAYVDu+NTkYzsAUMAfu55rIKHNLlm6WbF +KvLiKKz4p4pbUr+ToPcwl/TDotidloUdBAxDg0SL+PmQqACZDe3seJho2IYf2vDL +/G4TLMbKmNB0mlWFuN0f4fJNAgMBAAGjggGgMIIBnDAOBgNVHQ8BAf8EBAMCB4Aw +EwYDVR0lBAwwCgYIKwYBBQUHAwkwTwYDVR0fBEgwRjBEoEKgQIY+aHR0cDovL3d3 +dy5zaWduZXQucGwva3dhbGlmaWtvd2FuZS9yZXBvenl0b3JpdW0vY3JsL2tsYXNh +My5jcmwwgdgGA1UdIASB0DCBzTCBygYOKwYBBAG+PwKCLAoCAQAwgbcwbAYIKwYB +BQUHAgIwYBpeQ2VydHlmaWthdCB3eWRhbnkgemdvZG5pZSB6IGRva3VtZW50ZW0g +IlBvbGl0eWthIENlcnR5ZmlrYWNqaSAtIENlcnR5ZmlrYXR5IHJlc3BvbmRlcm93 +IE9DU1AiLjBHBggrBgEFBQcCARY7aHR0cDovL3d3dy5zaWduZXQucGwvcmVwb3p5 +dG9yaXVtL2Rva3VtZW50eS9wY19vY3NwXzFfMC5wZGYwHwYDVR0jBBgwFoAUe2PM +GZB6tM62O559bRUnUND5SbkwHQYDVR0OBBYEFG4jnCMvBALRQXtmDn9TyXQ/EKP+ +MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQEFBQADggEBACXrKG5Def5lpRwmZom3UEDq +bl7y4U3qomG4B+ok2FVZGgPZti+ZgvrenPj7PtbYCUBPsCSTNrznKinoT3gD9lQQ +xkEHwdc6VD1GlFp+qI64u0+wS9Epatrdf7aBnizrOIB4LJd4E2TWQ6trspetjMIU +upyWls1BmYUxB91R7QkTiAUSNZ87s3auhZuG4f0V0JLVCcg2rn7AN1rfMkgxCbHk +GxiQbYWFljl6aatxR3odnnzVUe1I8uoY2JXpmmUcOG4dNGuQYziyKG3mtXCQWvug +5qi9Mf3KUh1oSTKx6HfLjjNl1+wMB5Mdb8LF0XyZLdJM9yIZh7SBRsYm9QiXevY= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFGjCCBAKgAwIBAgIEPL7eEDANBgkqhkiG9w0BAQUFADBxMQswCQYDVQQGEwJQTDEfMB0GA1UE +ChMWVFAgSW50ZXJuZXQgU3AuIHogby5vLjEkMCIGA1UECxMbQ2VudHJ1bSBDZXJ0eWZpa2Fjamkg +U2lnbmV0MRswGQYDVQQDExJDQyBTaWduZXQgLSBSb290Q0EwHhcNMDIwNDE4MTQ1NDA4WhcNMjYw +OTIxMTU0MjE5WjB2MQswCQYDVQQGEwJQTDEfMB0GA1UEChMWVFAgSW50ZXJuZXQgU3AuIHogby5v +LjEkMCIGA1UECxMbQ2VudHJ1bSBDZXJ0eWZpa2FjamkgU2lnbmV0MSAwHgYDVQQDExdDQyBTaWdu +ZXQgLSBQQ0EgS2xhc2EgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM7BrBlbN5ma +M5eg0BOTqoZ+9NBDvU8Lm5rTdrMswFTCathzpVVLK/JD4K3+4oCZ9SRAspEXE4gvwb08ASY6w5s+ +HpRkeJw8YzMFR5kDZD5adgnCAy4vDfIXYZgppXPaTQ8wnfUZ7BZ7Zfa7QBemUIcJIzJBB0UqgtxW +Ceol9IekpBRVmuuSA6QG0Jkm+pGDJ05yj2eQG8jTcBENM7sVA8rGRMyFA4skSZ+D0OG6FS2xC1i9 +JyN0ag1yII/LPx8HK5J4W9MaPRNjAEeaa2qI9EpchwrOxnyVbQfSedCG1VRJfAsE/9tT9CMUPZ3x +W20QjQcSZJqVcmGW9gVsXKQOVLsCAwEAAaOCAbMwggGvMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0P +AQH/BAQDAgEGMIIBBAYDVR0gBIH8MIH5MIH2Bg0rBgEEAb4/AgEKAQEBMIHkMIGaBggrBgEFBQcC +AjCBjRqBikNlcnR5ZmlrYXQgd3lzdGF3aW9ueSB6Z29kbmllIHogZG9rdW1lbnRlbTogIlBvbGl0 +eWthIENlcnR5ZmlrYWNqaSBkbGEgUm9vdENBIi4gQ2VydHlmaWthdCB3eXN0YXdpb255IHByemV6 +IFJvb3RDQSB3IGhpZXJhcmNoaWkgQ0MgU2lnbmV0LjBFBggrBgEFBQcCARY5aHR0cDovL3d3dy5z +aWduZXQucGwvcmVwb3p5dG9yaXVtL2Rva3VtZW50eS9wY19yb290Y2EudHh0MEQGA1UdHwQ9MDsw +OaA3oDWGM2h0dHA6Ly93d3cuc2lnbmV0LnBsL3JlcG96eXRvcml1bS9yb290Y2Evcm9vdGNhLmNy +bDAfBgNVHSMEGDAWgBTAm8UjDQLhpk5Iax8A6eOaFBuxrzAdBgNVHQ4EFgQUwGxGyl2CfpYHRonE +82AVXO08kMIwDQYJKoZIhvcNAQEFBQADggEBABp1TAUsa+BeVWg4cjowc8yTJ5XN3GvN96GObMkx +UGY7U9kVrLI71xBgoNVyzXTiMNDBvjh7vdPWjpl5SDiRpnnKiOFXA43HvNWzUaOkTu1mxjJsZsan +ot1Xt6j0ZDC+03FjLHdYMyM9kSWp6afb4980EPYZCcSzgM5TOGfJmNii5Tq468VFKrX+52Aou1G2 +2Ohu+EEOlOrG7ylKv1hHUJJCjwN0ZVEIn1nDbrU9FeGCz8J9ihVUvnENEBbBkU37PWqWuHitKQDV +tcwTwJJdR8cmKq3NmkwAm9fPacidQLpaw0WkuGrS+fEDhu1Nhy9xELP6NA9GRTCNxm/dXlcwnmY= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFGjCCBAKgAwIBAgIEPV0tNDANBgkqhkiG9w0BAQUFADBxMQswCQYDVQQGEwJQTDEfMB0GA1UE +ChMWVFAgSW50ZXJuZXQgU3AuIHogby5vLjEkMCIGA1UECxMbQ2VudHJ1bSBDZXJ0eWZpa2Fjamkg +U2lnbmV0MRswGQYDVQQDExJDQyBTaWduZXQgLSBSb290Q0EwHhcNMDIwODE2MTY0OTU2WhcNMjYw +OTIxMTU0MjE5WjB2MQswCQYDVQQGEwJQTDEfMB0GA1UEChMWVFAgSW50ZXJuZXQgU3AuIHogby5v +LjEkMCIGA1UECxMbQ2VudHJ1bSBDZXJ0eWZpa2FjamkgU2lnbmV0MSAwHgYDVQQDExdDQyBTaWdu +ZXQgLSBQQ0EgS2xhc2EgMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALN3LanJtdue +Ne6geWUTFENa+lEuzqELcoqhYB+a/tJcPEkc6TX/bYPzalRRjqs+quMP6KZTU0DixOrV+K7iWaqA +iQ913HX5IBLmKDCrTVW/ZvSDpiBKbxlHfSNuJxAuVT6HdbzK7yAW38ssX+yS2tZYHZ5FhZcfqzPE +OpO94mAKcBUhk6T/ki0evXX/ZvvktwmF3hKattzwtM4JMLurAEl8SInyEYULw5JdlfcBez2Tg6Db +w34hA1A+ckTwhxzecrB8TUe2BnQKOs9vr2cCACpFFcOmPkM0Drtjctr1QHm1tYSqRFRf9VcV5tfC +3P8QqoK4ONjtLPHc9x5NE1uK/FMCAwEAAaOCAbMwggGvMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0P +AQH/BAQDAgEGMIIBBAYDVR0gBIH8MIH5MIH2Bg0rBgEEAb4/AgEKAQECMIHkMIGaBggrBgEFBQcC +AjCBjRqBikNlcnR5ZmlrYXQgd3lzdGF3aW9ueSB6Z29kbmllIHogZG9rdW1lbnRlbTogIlBvbGl0 +eWthIENlcnR5ZmlrYWNqaSBkbGEgUm9vdENBIi4gQ2VydHlmaWthdCB3eXN0YXdpb255IHByemV6 +IFJvb3RDQSB3IGhpZXJhcmNoaWkgQ0MgU2lnbmV0LjBFBggrBgEFBQcCARY5aHR0cDovL3d3dy5z +aWduZXQucGwvcmVwb3p5dG9yaXVtL2Rva3VtZW50eS9wY19yb290Y2EudHh0MEQGA1UdHwQ9MDsw +OaA3oDWGM2h0dHA6Ly93d3cuc2lnbmV0LnBsL3JlcG96eXRvcml1bS9yb290Y2Evcm9vdGNhLmNy +bDAfBgNVHSMEGDAWgBTAm8UjDQLhpk5Iax8A6eOaFBuxrzAdBgNVHQ4EFgQUXvthcPHlH5BgGhlM +ErJNXWlhlgAwDQYJKoZIhvcNAQEFBQADggEBACIce95Mvn710KCAISA0CuHD4aznTU6pLoCDShW4 +7OR+GTpJUm1coTcUqlBHV9mra4VFrBcBuOkHZoBLq/jmE0QJWnpSEULDcH9J3mF0nqO9SM+mWyJG +dsJF/XU/7smummgjMNQXwzQTtWORF+6v5KUbWX85anO2wR+M6YTBWC55zWpWi4RG3vkHFs5Ze2oF +JTlpuxw9ZgxTnWlwI9QR2MvEhYIUMKMOWxw1nt0kKj+5TCNQQGh/VJJ1dsiroGh/io1DOcePEhKz +1Ag52y6Wf0nJJB9yk0sFakqZH18F7eQecQImgZyyeRtsG95leNugB3BXWCW+KxwiBrtQTXv4dTE= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEzzCCA7egAwIBAgIEO6ocGTANBgkqhkiG9w0BAQUFADBxMQswCQYDVQQGEwJQTDEfMB0GA1UE +ChMWVFAgSW50ZXJuZXQgU3AuIHogby5vLjEkMCIGA1UECxMbQ2VudHJ1bSBDZXJ0eWZpa2Fjamkg +U2lnbmV0MRswGQYDVQQDExJDQyBTaWduZXQgLSBSb290Q0EwHhcNMDEwOTIwMTY0MjE5WhcNMjYw +OTIxMTU0MjE5WjBxMQswCQYDVQQGEwJQTDEfMB0GA1UEChMWVFAgSW50ZXJuZXQgU3AuIHogby5v +LjEkMCIGA1UECxMbQ2VudHJ1bSBDZXJ0eWZpa2FjamkgU2lnbmV0MRswGQYDVQQDExJDQyBTaWdu +ZXQgLSBSb290Q0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrr2vydnNpELfGW3Ks +ARiDhJvwDtUe4AbWev+OfMc3+vA29nX8ZmIwno3gmItjo5DbUCCRiCMq5c9epcGu+kg4a3BJChVX +REl8gVh0ST15rr3RKrSc4VgsvQzl0ZUraeQLl8JoRT5PLsUj3qwF78jUCQVckiiLVcnGfZtFCm+D +CJXliQBDMB9XFAUEiO/DtEBs0B7wJGx7lgJeJpQUcGiaOPjcJDYOk7rNAYmmD2gWeSlepufO8luU +YG/YDxTC4mqhRqfa4MnVO5dqy+ICj2UvUpHbZDB0KfGRibgBYeQP1kuqgIzJN4UqknVAJb0aMBSP +l+9k2fAUdchx1njlbdcbAgMBAAGjggFtMIIBaTAPBgNVHRMBAf8EBTADAQH/MIIBBAYDVR0gBIH8 +MIH5MIH2Bg0rBgEEAb4/AgEKAQEAMIHkMIGaBggrBgEFBQcCAjCBjRqBikNlcnR5ZmlrYXQgd3lz +dGF3aW9ueSB6Z29kbmllIHogZG9rdW1lbnRlbTogIlBvbGl0eWthIENlcnR5ZmlrYWNqaSBkbGEg +Um9vdENBIi4gQ2VydHlmaWthdCB3eXN0YXdpb255IHByemV6IFJvb3RDQSB3IGhpZXJhcmNoaWkg +Q0MgU2lnbmV0LjBFBggrBgEFBQcCARY5aHR0cDovL3d3dy5zaWduZXQucGwvcmVwb3p5dG9yaXVt +L2Rva3VtZW50eS9wY19yb290Y2EudHh0MB0GA1UdDgQWBBTAm8UjDQLhpk5Iax8A6eOaFBuxrzAf +BgNVHSMEGDAWgBTAm8UjDQLhpk5Iax8A6eOaFBuxrzAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcN +AQEFBQADggEBAGnY5QmYqnnO9OqFOWZxxb25UHRnaRF6IV9aaGit5BZufZj2Tq3v8L3SgE34GOoI +cdRMMG5JEpEU4mN/Ef3oY6Eo+7HfqaPHI4KFmbDSPiK5s+wmf+bQSm0Yq5/h4ZOdcAESlLQeLSt1 +CQk2JoKQJ6pyAf6xJBgWEIlm4RXE4J3324PUiOp83kW6MDvaa1xY976WyInr4rwoLgxVl11LZeKW +ha0RJJxJgw/NyWpKG7LWCm1fglF8JH51vZNndGYq1iKtfnrIOvLZq6bzaCiZm1EurD8HE6P7pmAB +KK6o3C2OXlNfNIgwkDN/cDqk5TYsTkrpfriJPdxXBH8hQOkW89g= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIID/TCCA2agAwIBAgIEP4/gkTANBgkqhkiG9w0BAQUFADB1MQswCQYDVQQGEwJQTDEfMB0GA1UE +ChMWVFAgSW50ZXJuZXQgU3AuIHogby5vLjEkMCIGA1UECxMbQ2VudHJ1bSBDZXJ0eWZpa2Fjamkg +U2lnbmV0MR8wHQYDVQQDExZDQyBTaWduZXQgLSBDQSBLbGFzYSAxMB4XDTAzMTAxNzEyMjkwMloX +DTExMDkyMzExMTgxN1owdjELMAkGA1UEBhMCUEwxHzAdBgNVBAoTFlRQIEludGVybmV0IFNwLiB6 +IG8uby4xJDAiBgNVBAsTG0NlbnRydW0gQ2VydHlmaWthY2ppIFNpZ25ldDEgMB4GA1UEAxMXQ0Mg +U2lnbmV0IC0gVFNBIEtsYXNhIDEwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOJYrISEtSsd +uHajROh5/n7NGrkpYTT9NEaPe9+ucuQ37KxIbfJwXJjgUc1dw4wCkcQ12FJarD1X6mSQ4cfN/60v +LfKI5ZD4nhJTMKlAj1pX9ScQ/MuyvKStCbn5WTkjPhjRAM0tdwXSnzuTEunfw0Oup559y3Iqxg1c +ExflB6cfAgMBAAGjggGXMIIBkzBBBgNVHR8EOjA4MDagNKAyhjBodHRwOi8vd3d3LnNpZ25ldC5w +bC9yZXBvenl0b3JpdW0vY3JsL2tsYXNhMS5jcmwwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQM +MAoGCCsGAQUFBwMIMIHaBgNVHSAEgdIwgc8wgcwGDSsGAQQBvj8CZAoRAgEwgbowbwYIKwYBBQUH +AgIwYxphQ2VydHlmaWthdCB3eXN0YXdpb255IHpnb2RuaWUgeiBkb2t1bWVudGVtICJQb2xpdHlr +YSBDZXJ0eWZpa2FjamkgQ0MgU2lnbmV0IC0gWm5ha293YW5pZSBjemFzZW0iLjBHBggrBgEFBQcC +ARY7aHR0cDovL3d3dy5zaWduZXQucGwvcmVwb3p5dG9yaXVtL2Rva3VtZW50eS9wY190c2ExXzJf +MS5wZGYwHwYDVR0jBBgwFoAUw4Me1Vl3VPtN+1dH+cQjXNHnieMwHQYDVR0OBBYEFJdDwEqtcavO +Yd9u9tej53vWXwNBMAkGA1UdEwQCMAAwDQYJKoZIhvcNAQEFBQADgYEAnpiQkqLCJQYXUrqMHUEz ++z3rOqS0XzSFnVVLhkVssvXc8S3FkJIiQTUrkScjI4CToCzujj3EyfNxH6yiLlMbskF8I31JxIeB +vueqV+s+o76CZm3ycu9hb0I4lswuxoT+q5ZzPR8Irrb51rZXlolR+7KtwMg4sFDJZ8RNgOf7tbA= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org, CN=Chambers of Commerce Root - Validity - Not Before: Sep 30 16:13:43 2003 GMT - Not After : Sep 30 16:13:44 2037 GMT - Subject: C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org, CN=Chambers of Commerce Root - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:b7:36:55:e5:a5:5d:18:30:e0:da:89:54:91:fc: - c8:c7:52:f8:2f:50:d9:ef:b1:75:73:65:47:7d:1b: - 5b:ba:75:c5:fc:a1:88:24:fa:2f:ed:ca:08:4a:39: - 54:c4:51:7a:b5:da:60:ea:38:3c:81:b2:cb:f1:bb: - d9:91:23:3f:48:01:70:75:a9:05:2a:ad:1f:71:f3: - c9:54:3d:1d:06:6a:40:3e:b3:0c:85:ee:5c:1b:79: - c2:62:c4:b8:36:8e:35:5d:01:0c:23:04:47:35:aa: - 9b:60:4e:a0:66:3d:cb:26:0a:9c:40:a1:f4:5d:98: - bf:71:ab:a5:00:68:2a:ed:83:7a:0f:a2:14:b5:d4: - 22:b3:80:b0:3c:0c:5a:51:69:2d:58:18:8f:ed:99: - 9e:f1:ae:e2:95:e6:f6:47:a8:d6:0c:0f:b0:58:58: - db:c3:66:37:9e:9b:91:54:33:37:d2:94:1c:6a:48: - c9:c9:f2:a5:da:a5:0c:23:f7:23:0e:9c:32:55:5e: - 71:9c:84:05:51:9a:2d:fd:e6:4e:2a:34:5a:de:ca: - 40:37:67:0c:54:21:55:77:da:0a:0c:cc:97:ae:80: - dc:94:36:4a:f4:3e:ce:36:13:1e:53:e4:ac:4e:3a: - 05:ec:db:ae:72:9c:38:8b:d0:39:3b:89:0a:3e:77: - fe:75 - Exponent: 3 (0x3) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE, pathlen:12 - X509v3 CRL Distribution Points: - URI:http://crl.chambersign.org/chambersroot.crl - - X509v3 Subject Key Identifier: - E3:94:F5:B1:4D:E9:DB:A1:29:5B:57:8B:4D:76:06:76:E1:D1:A2:8A - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 Subject Alternative Name: - email:chambersroot@chambersign.org - X509v3 Issuer Alternative Name: - email:chambersroot@chambersign.org - X509v3 Certificate Policies: - Policy: 1.3.6.1.4.1.17326.10.3.1 - CPS: http://cps.chambersign.org/cps/chambersroot.html - - Signature Algorithm: sha1WithRSAEncryption - 0c:41:97:c2:1a:86:c0:22:7c:9f:fb:90:f3:1a:d1:03:b1:ef: - 13:f9:21:5f:04:9c:da:c9:a5:8d:27:6c:96:87:91:be:41:90: - 01:72:93:e7:1e:7d:5f:f6:89:c6:5d:a7:40:09:3d:ac:49:45: - 45:dc:2e:8d:30:68:b2:09:ba:fb:c3:2f:cc:ba:0b:df:3f:77: - 7b:46:7d:3a:12:24:8e:96:8f:3c:05:0a:6f:d2:94:28:1d:6d: - 0c:c0:2e:88:22:d5:d8:cf:1d:13:c7:f0:48:d7:d7:05:a7:cf: - c7:47:9e:3b:3c:34:c8:80:4f:d4:14:bb:fc:0d:50:f7:fa:b3: - ec:42:5f:a9:dd:6d:c8:f4:75:cf:7b:c1:72:26:b1:01:1c:5c: - 2c:fd:7a:4e:b4:01:c5:05:57:b9:e7:3c:aa:05:d9:88:e9:07: - 46:41:ce:ef:41:81:ae:58:df:83:a2:ae:ca:d7:77:1f:e7:00: - 3c:9d:6f:8e:e4:32:09:1d:4d:78:34:78:34:3c:94:9b:26:ed: - 4f:71:c6:19:7a:bd:20:22:48:5a:fe:4b:7d:03:b7:e7:58:be: - c6:32:4e:74:1e:68:dd:a8:68:5b:b3:3e:ee:62:7d:d9:80:e8: - 0a:75:7a:b7:ee:b4:65:9a:21:90:e0:aa:d0:98:bc:38:b5:73: - 3c:8b:f8:dc -MD5 Fingerprint=B0:01:EE:14:D9:AF:29:18:94:76:8E:F1:69:33:2A:84 -----BEGIN CERTIFICATE----- MIIEvTCCA6WgAwIBAgIBADANBgkqhkiG9w0BAQUFADB/MQswCQYDVQQGEwJFVTEn MCUGA1UEChMeQUMgQ2FtZXJmaXJtYSBTQSBDSUYgQTgyNzQzMjg3MSMwIQYDVQQL @@ -6972,349 +2213,395 @@ XCz9ek60AcUFV7nnPKoF2YjpB0ZBzu9Bga5Y34OirsrXdx/nADydb47kMgkdTXg0 eDQ8lJsm7U9xxhl6vSAiSFr+S30Dt+dYvsYyTnQeaN2oaFuzPu5ifdmA6Ap1erfu tGWaIZDgqtCYvDi1czyL+Nw= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org, CN=Global Chambersign Root - Validity - Not Before: Sep 30 16:14:18 2003 GMT - Not After : Sep 30 16:14:18 2037 GMT - Subject: C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org, CN=Global Chambersign Root - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:a2:70:a2:d0:9f:42:ae:5b:17:c7:d8:7d:cf:14: - 83:fc:4f:c9:a1:b7:13:af:8a:d7:9e:3e:04:0a:92: - 8b:60:56:fa:b4:32:2f:88:4d:a1:60:08:f4:b7:09: - 4e:a0:49:2f:49:d6:d3:df:9d:97:5a:9f:94:04:70: - ec:3f:59:d9:b7:cc:66:8b:98:52:28:09:02:df:c5: - 2f:84:8d:7a:97:77:bf:ec:40:9d:25:72:ab:b5:3f: - 32:98:fb:b7:b7:fc:72:84:e5:35:87:f9:55:fa:a3: - 1f:0e:6f:2e:28:dd:69:a0:d9:42:10:c6:f8:b5:44: - c2:d0:43:7f:db:bc:e4:a2:3c:6a:55:78:0a:77:a9: - d8:ea:19:32:b7:2f:fe:5c:3f:1b:ee:b1:98:ec:ca: - ad:7a:69:45:e3:96:0f:55:f6:e6:ed:75:ea:65:e8: - 32:56:93:46:89:a8:25:8a:65:06:ee:6b:bf:79:07: - d0:f1:b7:af:ed:2c:4d:92:bb:c0:a8:5f:a7:67:7d: - 04:f2:15:08:70:ac:92:d6:7d:04:d2:33:fb:4c:b6: - 0b:0b:fb:1a:c9:c4:8d:03:a9:7e:5c:f2:50:ab:12: - a5:a1:cf:48:50:a5:ef:d2:c8:1a:13:fa:b0:7f:b1: - 82:1c:77:6a:0f:5f:dc:0b:95:8f:ef:43:7e:e6:45: - 09:25 - Exponent: 3 (0x3) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE, pathlen:12 - X509v3 CRL Distribution Points: - URI:http://crl.chambersign.org/chambersignroot.crl - - X509v3 Subject Key Identifier: - 43:9C:36:9F:B0:9E:30:4D:C6:CE:5F:AD:10:AB:E5:03:A5:FA:A9:14 - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - X509v3 Subject Alternative Name: - email:chambersignroot@chambersign.org - X509v3 Issuer Alternative Name: - email:chambersignroot@chambersign.org - X509v3 Certificate Policies: - Policy: 1.3.6.1.4.1.17326.10.1.1 - CPS: http://cps.chambersign.org/cps/chambersignroot.html - - Signature Algorithm: sha1WithRSAEncryption - 3c:3b:70:91:f9:04:54:27:91:e1:ed:ed:fe:68:7f:61:5d:e5: - 41:65:4f:32:f1:18:05:94:6a:1c:de:1f:70:db:3e:7b:32:02: - 34:b5:0c:6c:a1:8a:7c:a5:f4:8f:ff:d4:d8:ad:17:d5:2d:04: - d1:3f:58:80:e2:81:59:88:be:c0:e3:46:93:24:fe:90:bd:26: - a2:30:2d:e8:97:26:57:35:89:74:96:18:f6:15:e2:af:24:19: - 56:02:02:b2:ba:0f:14:ea:c6:8a:66:c1:86:45:55:8b:be:92: - be:9c:a4:04:c7:49:3c:9e:e8:29:7a:89:d7:fe:af:ff:68:f5: - a5:17:90:bd:ac:99:cc:a5:86:57:09:67:46:db:d6:16:c2:46: - f1:e4:a9:50:f5:8f:d1:92:15:d3:5f:3e:c6:00:49:3a:6e:58: - b2:d1:d1:27:0d:25:c8:32:f8:20:11:cd:7d:32:33:48:94:54: - 4c:dd:dc:79:c4:30:9f:eb:8e:b8:55:b5:d7:88:5c:c5:6a:24: - 3d:b2:d3:05:03:51:c6:07:ef:cc:14:72:74:3d:6e:72:ce:18: - 28:8c:4a:a0:77:e5:09:2b:45:44:47:ac:b7:67:7f:01:8a:05: - 5a:93:be:a1:c1:ff:f8:e7:0e:67:a4:47:49:76:5d:75:90:1a: - f5:26:8f:f0 -MD5 Fingerprint=C5:E6:7B:BF:06:D0:4F:43:ED:C4:7A:65:8A:FB:6B:19 -----BEGIN CERTIFICATE----- MIIExTCCA62gAwIBAgIBADANBgkqhkiG9w0BAQUFADB9MQswCQYDVQQGEwJFVTEn -MCUGA1UEChMeQUMgQ2FtZXJmaXJtYSBTQSBDSUYgQTgyNzQzMjg3MSMwIQYDVQQL -ExpodHRwOi8vd3d3LmNoYW1iZXJzaWduLm9yZzEgMB4GA1UEAxMXR2xvYmFsIENo -YW1iZXJzaWduIFJvb3QwHhcNMDMwOTMwMTYxNDE4WhcNMzcwOTMwMTYxNDE4WjB9 -MQswCQYDVQQGEwJFVTEnMCUGA1UEChMeQUMgQ2FtZXJmaXJtYSBTQSBDSUYgQTgy -NzQzMjg3MSMwIQYDVQQLExpodHRwOi8vd3d3LmNoYW1iZXJzaWduLm9yZzEgMB4G -A1UEAxMXR2xvYmFsIENoYW1iZXJzaWduIFJvb3QwggEgMA0GCSqGSIb3DQEBAQUA -A4IBDQAwggEIAoIBAQCicKLQn0KuWxfH2H3PFIP8T8mhtxOviteePgQKkotgVvq0 -Mi+ITaFgCPS3CU6gSS9J1tPfnZdan5QEcOw/Wdm3zGaLmFIoCQLfxS+EjXqXd7/s -QJ0lcqu1PzKY+7e3/HKE5TWH+VX6ox8Oby4o3Wmg2UIQxvi1RMLQQ3/bvOSiPGpV -eAp3qdjqGTK3L/5cPxvusZjsyq16aUXjlg9V9ubtdepl6DJWk0aJqCWKZQbua795 -B9Dxt6/tLE2Su8CoX6dnfQTyFQhwrJLWfQTSM/tMtgsL+xrJxI0DqX5c8lCrEqWh -z0hQpe/SyBoT+rB/sYIcd2oPX9wLlY/vQ37mRQklAgEDo4IBUDCCAUwwEgYDVR0T -AQH/BAgwBgEB/wIBDDA/BgNVHR8EODA2MDSgMqAwhi5odHRwOi8vY3JsLmNoYW1i -ZXJzaWduLm9yZy9jaGFtYmVyc2lnbnJvb3QuY3JsMB0GA1UdDgQWBBRDnDafsJ4w -TcbOX60Qq+UDpfqpFDAOBgNVHQ8BAf8EBAMCAQYwEQYJYIZIAYb4QgEBBAQDAgAH -MCoGA1UdEQQjMCGBH2NoYW1iZXJzaWducm9vdEBjaGFtYmVyc2lnbi5vcmcwKgYD -VR0SBCMwIYEfY2hhbWJlcnNpZ25yb290QGNoYW1iZXJzaWduLm9yZzBbBgNVHSAE -VDBSMFAGCysGAQQBgYcuCgEBMEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly9jcHMuY2hh -bWJlcnNpZ24ub3JnL2Nwcy9jaGFtYmVyc2lnbnJvb3QuaHRtbDANBgkqhkiG9w0B -AQUFAAOCAQEAPDtwkfkEVCeR4e3t/mh/YV3lQWVPMvEYBZRqHN4fcNs+ezICNLUM -bKGKfKX0j//U2K0X1S0E0T9YgOKBWYi+wONGkyT+kL0mojAt6JcmVzWJdJYY9hXi -ryQZVgICsroPFOrGimbBhkVVi76SvpykBMdJPJ7oKXqJ1/6v/2j1pReQvayZzKWG -VwlnRtvWFsJG8eSpUPWP0ZIV018+xgBJOm5YstHRJw0lyDL4IBHNfTIzSJRUTN3c -ecQwn+uOuFW114hcxWokPbLTBQNRxgfvzBRydD1ucs4YKIxKoHflCStFREest2d/ -AYoFWpO+ocH/+OcOZ6RHSXZddZAa9SaP8A== ------END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 123 (0x7b) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=HU, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado/emailAddress=info@netlock.hu - Validity - Not Before: Mar 30 01:47:11 2003 GMT - Not After : Dec 15 01:47:11 2022 GMT - Subject: C=HU, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado/emailAddress=info@netlock.hu - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:c7:52:25:b2:d8:3d:d4:84:55:09:a7:1b:bd:6c: - b9:14:f4:8a:02:db:76:fc:6a:2a:78:ab:e5:77:f0: - 6e:e0:8c:23:67:db:a5:64:99:b9:dd:01:3e:6f:ef: - 2d:9a:3c:22:f0:5d:c9:57:a0:55:41:7f:f2:43:5e: - 58:82:53:31:65:ce:1e:f2:26:ba:00:54:1e:af:b0: - bc:1c:e4:52:8c:a0:32:af:b7:37:b1:53:67:68:74: - 67:50:f6:2d:2e:64:de:ae:26:79:df:df:99:86:ab: - ab:7f:85:ec:a0:fb:80:cc:f4:b8:0c:1e:93:45:63: - b9:dc:b8:5b:9b:ed:5b:39:d4:5f:62:b0:a7:8e:7c: - 66:38:2c:aa:b1:08:63:17:67:7d:cc:bd:b3:f1:c3: - 3f:cf:50:39:ed:d1:19:83:15:db:87:12:27:96:b7: - da:ea:e5:9d:bc:ba:ea:39:4f:8b:ef:74:9a:e7:c5: - d0:d2:ea:86:51:1c:e4:fe:64:08:28:04:79:05:eb: - ca:c5:71:0e:0b:ef:ab:ea:ec:12:11:a1:18:05:32: - 69:d1:0c:2c:1a:3d:25:99:3f:b5:7c:ca:6d:b0:ae: - 99:99:fa:08:60:e7:19:c2:f2:bd:51:d3:cc:d3:02: - ac:c1:11:0c:80:ce:ab:dc:94:9d:6b:a3:39:53:3a: - d6:85 - Exponent: 50557 (0xc57d) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE, pathlen:4 - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - Netscape Comment: - FIGYELEM! Ezen tanusitvany a NetLock Kft. Minositett Szolgaltatasi Szabalyzataban leirt eljarasok alapjan keszult. A minositett elektronikus alairas joghatas ervenyesulesenek, valamint elfogadasanak feltetele a Minositett Szolgaltatasi Szabalyzatban, az Altalanos Szerzodesi Feltetelekben eloirt ellenorzesi eljaras megtetele. A dokumentumok megtalalhatok a https://www.netlock.hu/docs/ cimen vagy kerhetok az info@netlock.net e-mail cimen. WARNING! The issuance and the use of this certificate are subject to the NetLock Qualified CPS available at https://www.netlock.hu/docs/ or by e-mail at info@netlock.net - X509v3 Subject Key Identifier: - 09:6A:62:16:92:B0:5A:BB:55:0E:CB:75:32:3A:32:E5:B2:21:C9:28 - Signature Algorithm: sha1WithRSAEncryption - 91:6a:50:9c:db:78:81:9b:3f:8b:42:e3:3b:fc:a6:c3:ee:43: - e0:cf:f3:e2:80:35:49:45:76:02:e2:e3:2f:05:c5:f1:2a:e7: - c0:41:33:c6:b6:9b:d0:33:39:cd:c0:db:a1:ad:6c:37:02:4c: - 58:41:3b:f2:97:92:c6:48:a8:cd:e5:8a:39:89:61:f9:52:97: - e9:bd:f6:f9:94:74:e8:71:0e:bc:77:86:c3:06:cc:5a:7c:4a: - 7e:34:50:30:2e:fb:7f:32:9a:8d:3d:f3:20:5b:f8:6a:ca:86: - f3:31:4c:2c:59:80:02:7d:fe:38:c9:30:75:1c:b7:55:e3:bc: - 9f:ba:a8:6d:84:28:05:75:b3:8b:0d:c0:91:54:21:e7:a6:0b: - b4:99:f5:51:41:dc:cd:a3:47:22:d9:c7:01:81:c4:dc:47:4f: - 26:ea:1f:ed:db:cd:0d:98:f4:a3:9c:b4:73:32:4a:96:99:fe: - bc:7f:c8:25:58:f8:58:f3:76:66:89:54:a4:a6:3e:c4:50:5c: - ba:89:18:82:75:48:21:d2:4f:13:e8:60:7e:07:76:db:10:b5: - 51:e6:aa:b9:68:aa:cd:f6:9d:90:75:12:ea:38:1a:ca:44:e8: - b7:99:a7:2a:68:95:66:95:ab:ad:ef:89:cb:60:a9:06:12:c6: - 94:47:e9:28 -MD5 Fingerprint=D4:80:65:68:24:F9:89:22:28:DB:F5:A4:9A:17:8F:14 ------BEGIN CERTIFICATE----- -MIIG0TCCBbmgAwIBAgIBezANBgkqhkiG9w0BAQUFADCByTELMAkGA1UEBhMCSFUx -ETAPBgNVBAcTCEJ1ZGFwZXN0MScwJQYDVQQKEx5OZXRMb2NrIEhhbG96YXRiaXp0 -b25zYWdpIEtmdC4xGjAYBgNVBAsTEVRhbnVzaXR2YW55a2lhZG9rMUIwQAYDVQQD -EzlOZXRMb2NrIE1pbm9zaXRldHQgS296amVneXpvaSAoQ2xhc3MgUUEpIFRhbnVz -aXR2YW55a2lhZG8xHjAcBgkqhkiG9w0BCQEWD2luZm9AbmV0bG9jay5odTAeFw0w -MzAzMzAwMTQ3MTFaFw0yMjEyMTUwMTQ3MTFaMIHJMQswCQYDVQQGEwJIVTERMA8G -A1UEBxMIQnVkYXBlc3QxJzAlBgNVBAoTHk5ldExvY2sgSGFsb3phdGJpenRvbnNh -Z2kgS2Z0LjEaMBgGA1UECxMRVGFudXNpdHZhbnlraWFkb2sxQjBABgNVBAMTOU5l -dExvY2sgTWlub3NpdGV0dCBLb3pqZWd5em9pIChDbGFzcyBRQSkgVGFudXNpdHZh -bnlraWFkbzEeMBwGCSqGSIb3DQEJARYPaW5mb0BuZXRsb2NrLmh1MIIBIjANBgkq -hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx1Ilstg91IRVCacbvWy5FPSKAtt2/Goq -eKvld/Bu4IwjZ9ulZJm53QE+b+8tmjwi8F3JV6BVQX/yQ15YglMxZc4e8ia6AFQe -r7C8HORSjKAyr7c3sVNnaHRnUPYtLmTeriZ539+Zhqurf4XsoPuAzPS4DB6TRWO5 -3Lhbm+1bOdRfYrCnjnxmOCyqsQhjF2d9zL2z8cM/z1A57dEZgxXbhxInlrfa6uWd -vLrqOU+L73Sa58XQ0uqGURzk/mQIKAR5BevKxXEOC++r6uwSEaEYBTJp0QwsGj0l -mT+1fMptsK6ZmfoIYOcZwvK9UdPM0wKswREMgM6r3JSda6M5UzrWhQIDAMV9o4IC -wDCCArwwEgYDVR0TAQH/BAgwBgEB/wIBBDAOBgNVHQ8BAf8EBAMCAQYwggJ1Bglg -hkgBhvhCAQ0EggJmFoICYkZJR1lFTEVNISBFemVuIHRhbnVzaXR2YW55IGEgTmV0 -TG9jayBLZnQuIE1pbm9zaXRldHQgU3pvbGdhbHRhdGFzaSBTemFiYWx5emF0YWJh -biBsZWlydCBlbGphcmFzb2sgYWxhcGphbiBrZXN6dWx0LiBBIG1pbm9zaXRldHQg -ZWxla3Ryb25pa3VzIGFsYWlyYXMgam9naGF0YXMgZXJ2ZW55ZXN1bGVzZW5laywg -dmFsYW1pbnQgZWxmb2dhZGFzYW5hayBmZWx0ZXRlbGUgYSBNaW5vc2l0ZXR0IFN6 -b2xnYWx0YXRhc2kgU3phYmFseXphdGJhbiwgYXogQWx0YWxhbm9zIFN6ZXJ6b2Rl -c2kgRmVsdGV0ZWxla2JlbiBlbG9pcnQgZWxsZW5vcnplc2kgZWxqYXJhcyBtZWd0 -ZXRlbGUuIEEgZG9rdW1lbnR1bW9rIG1lZ3RhbGFsaGF0b2sgYSBodHRwczovL3d3 -dy5uZXRsb2NrLmh1L2RvY3MvIGNpbWVuIHZhZ3kga2VyaGV0b2sgYXogaW5mb0Bu -ZXRsb2NrLm5ldCBlLW1haWwgY2ltZW4uIFdBUk5JTkchIFRoZSBpc3N1YW5jZSBh -bmQgdGhlIHVzZSBvZiB0aGlzIGNlcnRpZmljYXRlIGFyZSBzdWJqZWN0IHRvIHRo -ZSBOZXRMb2NrIFF1YWxpZmllZCBDUFMgYXZhaWxhYmxlIGF0IGh0dHBzOi8vd3d3 -Lm5ldGxvY2suaHUvZG9jcy8gb3IgYnkgZS1tYWlsIGF0IGluZm9AbmV0bG9jay5u -ZXQwHQYDVR0OBBYEFAlqYhaSsFq7VQ7LdTI6MuWyIckoMA0GCSqGSIb3DQEBBQUA -A4IBAQCRalCc23iBmz+LQuM7/KbD7kPgz/PigDVJRXYC4uMvBcXxKufAQTPGtpvQ -MznNwNuhrWw3AkxYQTvyl5LGSKjN5Yo5iWH5Upfpvfb5lHTocQ68d4bDBsxafEp+ -NFAwLvt/MpqNPfMgW/hqyobzMUwsWYACff44yTB1HLdV47yfuqhthCgFdbOLDcCR -VCHnpgu0mfVRQdzNo0ci2ccBgcTcR08m6h/t280NmPSjnLRzMkqWmf68f8glWPhY -83ZmiVSkpj7EUFy6iRiCdUgh0k8T6GB+B3bbELVR5qq5aKrN9p2QdRLqOBrKROi3 -macqaJVmlaut74nLYKkGEsaUR+ko +MCUGA1UEChMeQUMgQ2FtZXJmaXJtYSBTQSBDSUYgQTgyNzQzMjg3MSMwIQYDVQQL +ExpodHRwOi8vd3d3LmNoYW1iZXJzaWduLm9yZzEgMB4GA1UEAxMXR2xvYmFsIENo +YW1iZXJzaWduIFJvb3QwHhcNMDMwOTMwMTYxNDE4WhcNMzcwOTMwMTYxNDE4WjB9 +MQswCQYDVQQGEwJFVTEnMCUGA1UEChMeQUMgQ2FtZXJmaXJtYSBTQSBDSUYgQTgy +NzQzMjg3MSMwIQYDVQQLExpodHRwOi8vd3d3LmNoYW1iZXJzaWduLm9yZzEgMB4G +A1UEAxMXR2xvYmFsIENoYW1iZXJzaWduIFJvb3QwggEgMA0GCSqGSIb3DQEBAQUA +A4IBDQAwggEIAoIBAQCicKLQn0KuWxfH2H3PFIP8T8mhtxOviteePgQKkotgVvq0 +Mi+ITaFgCPS3CU6gSS9J1tPfnZdan5QEcOw/Wdm3zGaLmFIoCQLfxS+EjXqXd7/s +QJ0lcqu1PzKY+7e3/HKE5TWH+VX6ox8Oby4o3Wmg2UIQxvi1RMLQQ3/bvOSiPGpV +eAp3qdjqGTK3L/5cPxvusZjsyq16aUXjlg9V9ubtdepl6DJWk0aJqCWKZQbua795 +B9Dxt6/tLE2Su8CoX6dnfQTyFQhwrJLWfQTSM/tMtgsL+xrJxI0DqX5c8lCrEqWh +z0hQpe/SyBoT+rB/sYIcd2oPX9wLlY/vQ37mRQklAgEDo4IBUDCCAUwwEgYDVR0T +AQH/BAgwBgEB/wIBDDA/BgNVHR8EODA2MDSgMqAwhi5odHRwOi8vY3JsLmNoYW1i +ZXJzaWduLm9yZy9jaGFtYmVyc2lnbnJvb3QuY3JsMB0GA1UdDgQWBBRDnDafsJ4w +TcbOX60Qq+UDpfqpFDAOBgNVHQ8BAf8EBAMCAQYwEQYJYIZIAYb4QgEBBAQDAgAH +MCoGA1UdEQQjMCGBH2NoYW1iZXJzaWducm9vdEBjaGFtYmVyc2lnbi5vcmcwKgYD +VR0SBCMwIYEfY2hhbWJlcnNpZ25yb290QGNoYW1iZXJzaWduLm9yZzBbBgNVHSAE +VDBSMFAGCysGAQQBgYcuCgEBMEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly9jcHMuY2hh +bWJlcnNpZ24ub3JnL2Nwcy9jaGFtYmVyc2lnbnJvb3QuaHRtbDANBgkqhkiG9w0B +AQUFAAOCAQEAPDtwkfkEVCeR4e3t/mh/YV3lQWVPMvEYBZRqHN4fcNs+ezICNLUM +bKGKfKX0j//U2K0X1S0E0T9YgOKBWYi+wONGkyT+kL0mojAt6JcmVzWJdJYY9hXi +ryQZVgICsroPFOrGimbBhkVVi76SvpykBMdJPJ7oKXqJ1/6v/2j1pReQvayZzKWG +VwlnRtvWFsJG8eSpUPWP0ZIV018+xgBJOm5YstHRJw0lyDL4IBHNfTIzSJRUTN3c +ecQwn+uOuFW114hcxWokPbLTBQNRxgfvzBRydD1ucs4YKIxKoHflCStFREest2d/ +AYoFWpO+ocH/+OcOZ6RHSXZddZAa9SaP8A== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 259 (0x103) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=HU, ST=Hungary, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Kozjegyzoi (Class A) Tanusitvanykiado - Validity - Not Before: Feb 24 23:14:47 1999 GMT - Not After : Feb 19 23:14:47 2019 GMT - Subject: C=HU, ST=Hungary, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Kozjegyzoi (Class A) Tanusitvanykiado - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:bc:74:8c:0f:bb:4c:f4:37:1e:a9:05:82:d8:e6: - e1:6c:70:ea:78:b5:6e:d1:38:44:0d:a8:83:ce:5d: - d2:d6:d5:81:c5:d4:4b:e7:5b:94:70:26:db:3b:9d: - 6a:4c:62:f7:71:f3:64:d6:61:3b:3d:eb:73:a3:37: - d9:cf:ea:8c:92:3b:cd:f7:07:dc:66:74:97:f4:45: - 22:dd:f4:5c:e0:bf:6d:f3:be:65:33:e4:15:3a:bf: - db:98:90:55:38:c4:ed:a6:55:63:0b:b0:78:04:f4: - e3:6e:c1:3f:8e:fc:51:78:1f:92:9e:83:c2:fe:d9: - b0:a9:c9:bc:5a:00:ff:a9:a8:98:74:fb:f6:2c:3e: - 15:39:0d:b6:04:55:a8:0e:98:20:42:b3:b1:25:ad: - 7e:9a:6f:5d:53:b1:ab:0c:fc:eb:e0:f3:7a:b3:a8: - b3:ff:46:f6:63:a2:d8:3a:98:7b:b6:ac:85:ff:b0: - 25:4f:74:63:e7:13:07:a5:0a:8f:05:f7:c0:64:6f: - 7e:a7:27:80:96:de:d4:2e:86:60:c7:6b:2b:5e:73: - 7b:17:e7:91:3f:64:0c:d8:4b:22:34:2b:9b:32:f2: - 48:1f:9f:a1:0a:84:7a:e2:c2:ad:97:3d:8e:d5:c1: - f9:56:a3:50:e9:c6:b4:fa:98:a2:ee:95:e6:2a:03: - 8c:df - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - X509v3 Basic Constraints: critical - CA:TRUE, pathlen:4 - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - Netscape Comment: - FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztositasa vedi. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! The issuance and the use of this certificate is subject to the NetLock CPS available at https://www.netlock.net/docs or by e-mail at cps@netlock.net. - Signature Algorithm: md5WithRSAEncryption - 48:24:46:f7:ba:56:6f:fa:c8:28:03:40:4e:e5:31:39:6b:26: - 6b:53:7f:db:df:df:f3:71:3d:26:c0:14:0e:c6:67:7b:23:a8: - 0c:73:dd:01:bb:c6:ca:6e:37:39:55:d5:c7:8c:56:20:0e:28: - 0a:0e:d2:2a:a4:b0:49:52:c6:38:07:fe:be:0a:09:8c:d1:98: - cf:ca:da:14:31:a1:4f:d2:39:fc:0f:11:2c:43:c3:dd:ab:93: - c7:55:3e:47:7c:18:1a:00:dc:f3:7b:d8:f2:7f:52:6c:20:f4: - 0b:5f:69:52:f4:ee:f8:b2:29:60:eb:e3:49:31:21:0d:d6:b5: - 10:41:e2:41:09:6c:e2:1a:9a:56:4b:77:02:f6:a0:9b:9a:27: - 87:e8:55:29:71:c2:90:9f:45:78:1a:e1:15:64:3d:d0:0e:d8: - a0:76:9f:ae:c5:d0:2e:ea:d6:0f:56:ec:64:7f:5a:9b:14:58: - 01:27:7e:13:50:c7:6b:2a:e6:68:3c:bf:5c:a0:0a:1b:e1:0e: - 7a:e9:e2:80:c3:e9:e9:f6:fd:6c:11:9e:d0:e5:28:27:2b:54: - 32:42:14:82:75:e6:4a:f0:2b:66:75:63:8c:a2:fb:04:3e:83: - 0e:9b:36:f0:18:e4:26:20:c3:8c:f0:28:07:ad:3c:17:66:88: - b5:fd:b6:88 -MD5 Fingerprint=86:38:6D:5E:49:63:6C:85:5C:DB:6D:DC:94:B7:D0:F7 -----BEGIN CERTIFICATE----- -MIIGfTCCBWWgAwIBAgICAQMwDQYJKoZIhvcNAQEEBQAwga8xCzAJBgNVBAYTAkhV -MRAwDgYDVQQIEwdIdW5nYXJ5MREwDwYDVQQHEwhCdWRhcGVzdDEnMCUGA1UEChMe -TmV0TG9jayBIYWxvemF0Yml6dG9uc2FnaSBLZnQuMRowGAYDVQQLExFUYW51c2l0 -dmFueWtpYWRvazE2MDQGA1UEAxMtTmV0TG9jayBLb3pqZWd5em9pIChDbGFzcyBB -KSBUYW51c2l0dmFueWtpYWRvMB4XDTk5MDIyNDIzMTQ0N1oXDTE5MDIxOTIzMTQ0 -N1owga8xCzAJBgNVBAYTAkhVMRAwDgYDVQQIEwdIdW5nYXJ5MREwDwYDVQQHEwhC -dWRhcGVzdDEnMCUGA1UEChMeTmV0TG9jayBIYWxvemF0Yml6dG9uc2FnaSBLZnQu -MRowGAYDVQQLExFUYW51c2l0dmFueWtpYWRvazE2MDQGA1UEAxMtTmV0TG9jayBL -b3pqZWd5em9pIChDbGFzcyBBKSBUYW51c2l0dmFueWtpYWRvMIIBIjANBgkqhkiG -9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvHSMD7tM9DceqQWC2ObhbHDqeLVu0ThEDaiD -zl3S1tWBxdRL51uUcCbbO51qTGL3cfNk1mE7PetzozfZz+qMkjvN9wfcZnSX9EUi -3fRc4L9t875lM+QVOr/bmJBVOMTtplVjC7B4BPTjbsE/jvxReB+SnoPC/tmwqcm8 -WgD/qaiYdPv2LD4VOQ22BFWoDpggQrOxJa1+mm9dU7GrDPzr4PN6s6iz/0b2Y6LY -Oph7tqyF/7AlT3Rj5xMHpQqPBffAZG9+pyeAlt7ULoZgx2srXnN7F+eRP2QM2Esi -NCubMvJIH5+hCoR64sKtlz2O1cH5VqNQ6ca0+pii7pXmKgOM3wIDAQABo4ICnzCC -ApswDgYDVR0PAQH/BAQDAgAGMBIGA1UdEwEB/wQIMAYBAf8CAQQwEQYJYIZIAYb4 -QgEBBAQDAgAHMIICYAYJYIZIAYb4QgENBIICURaCAk1GSUdZRUxFTSEgRXplbiB0 -YW51c2l0dmFueSBhIE5ldExvY2sgS2Z0LiBBbHRhbGFub3MgU3pvbGdhbHRhdGFz -aSBGZWx0ZXRlbGVpYmVuIGxlaXJ0IGVsamFyYXNvayBhbGFwamFuIGtlc3p1bHQu -IEEgaGl0ZWxlc2l0ZXMgZm9seWFtYXRhdCBhIE5ldExvY2sgS2Z0LiB0ZXJtZWtm -ZWxlbG9zc2VnLWJpenRvc2l0YXNhIHZlZGkuIEEgZGlnaXRhbGlzIGFsYWlyYXMg -ZWxmb2dhZGFzYW5hayBmZWx0ZXRlbGUgYXogZWxvaXJ0IGVsbGVub3J6ZXNpIGVs -amFyYXMgbWVndGV0ZWxlLiBBeiBlbGphcmFzIGxlaXJhc2EgbWVndGFsYWxoYXRv -IGEgTmV0TG9jayBLZnQuIEludGVybmV0IGhvbmxhcGphbiBhIGh0dHBzOi8vd3d3 -Lm5ldGxvY2submV0L2RvY3MgY2ltZW4gdmFneSBrZXJoZXRvIGF6IGVsbGVub3J6 -ZXNAbmV0bG9jay5uZXQgZS1tYWlsIGNpbWVuLiBJTVBPUlRBTlQhIFRoZSBpc3N1 -YW5jZSBhbmQgdGhlIHVzZSBvZiB0aGlzIGNlcnRpZmljYXRlIGlzIHN1YmplY3Qg -dG8gdGhlIE5ldExvY2sgQ1BTIGF2YWlsYWJsZSBhdCBodHRwczovL3d3dy5uZXRs -b2NrLm5ldC9kb2NzIG9yIGJ5IGUtbWFpbCBhdCBjcHNAbmV0bG9jay5uZXQuMA0G -CSqGSIb3DQEBBAUAA4IBAQBIJEb3ulZv+sgoA0BO5TE5ayZrU3/b39/zcT0mwBQO -xmd7I6gMc90Bu8bKbjc5VdXHjFYgDigKDtIqpLBJUsY4B/6+CgmM0ZjPytoUMaFP -0jn8DxEsQ8Pdq5PHVT5HfBgaANzze9jyf1JsIPQLX2lS9O74silg6+NJMSEN1rUQ -QeJBCWziGppWS3cC9qCbmieH6FUpccKQn0V4GuEVZD3QDtigdp+uxdAu6tYPVuxk -f1qbFFgBJ34TUMdrKuZoPL9coAob4Q566eKAw+np9v1sEZ7Q5SgnK1QyQhSCdeZK -8CtmdWOMovsEPoMOmzbwGOQmIMOM8CgHrTwXZoi1/baI +MIIDkjCCAnqgAwIBAgIRAIW9S/PY2uNp9pTXX8OlRCMwDQYJKoZIhvcNAQEFBQAw +PTELMAkGA1UEBhMCRlIxETAPBgNVBAoTCENlcnRwbHVzMRswGQYDVQQDExJDbGFz +cyAyIFByaW1hcnkgQ0EwHhcNOTkwNzA3MTcwNTAwWhcNMTkwNzA2MjM1OTU5WjA9 +MQswCQYDVQQGEwJGUjERMA8GA1UEChMIQ2VydHBsdXMxGzAZBgNVBAMTEkNsYXNz +IDIgUHJpbWFyeSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANxQ +ltAS+DXSCHh6tlJw/W/uz7kRy1134ezpfgSN1sxvc0NXYKwzCkTsA18cgCSR5aiR +VhKC9+Ar9NuuYS6JEI1rbLqzAr3VNsVINyPi8Fo3UjMXEuLRYE2+L0ER4/YXJQyL +kcAbmXuZVg2v7tK8R1fjeUl7NIknJITesezpWE7+Tt9avkGtrAjFGA7v0lPubNCd +EgETjdyAYveVqUSISnFOYFWe2yMZeVYHDD9jC1yw4r5+FfyUM1hBOHTE4Y+L3yas +H7WLO7dDWWuwJKZtkIvEcupdM5i3y95ee++U8Rs+yskhwcWYAqqi9lt3m/V+llU0 +HGdpwPFC40es/CgcZlUCAwEAAaOBjDCBiTAPBgNVHRMECDAGAQH/AgEKMAsGA1Ud +DwQEAwIBBjAdBgNVHQ4EFgQU43Mt38sOKAze3bOkynm4jrvoMIkwEQYJYIZIAYb4 +QgEBBAQDAgEGMDcGA1UdHwQwMC4wLKAqoCiGJmh0dHA6Ly93d3cuY2VydHBsdXMu +Y29tL0NSTC9jbGFzczIuY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQCnVM+IRBnL39R/ +AN9WM2K191EBkOvDP9GIROkkXe/nFL0gt5o8AP5tn9uQ3Nf0YtaLcF3n5QRIqWh8 +yfFC82x/xXp8HVGIutIKPidd3i1RTtMTZGnkLuPT55sJmabglZvOGtd/vjzOUrMR +FcEPF80Du5wlFbqidon8BvEY0JNLDnyCt6X09l/+7UCmnYR0ObncHoUW2ikbhiMA +ybuJfm6AiB4vFLQDJKgybwOaRywwvlbGp0ICcBvqQNi6BQNwB6SW//1IMwrh3KWB +kJtN3X3n57LNXMhqlfil9o3EXXgIvnsG1knPGTZQIy4I5p4FTUcY1Rbpsda2ENW7 +l7+ijrRU +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEHTCCAwWgAwIBAgIQToEtioJl4AsC7j41AkblPTANBgkqhkiG9w0BAQUFADCB +gTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G +A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxJzAlBgNV +BAMTHkNPTU9ETyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjEyMDEwMDAw +MDBaFw0yOTEyMzEyMzU5NTlaMIGBMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3Jl +YXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01P +RE8gQ0EgTGltaXRlZDEnMCUGA1UEAxMeQ09NT0RPIENlcnRpZmljYXRpb24gQXV0 +aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ECLi3LjkRv3 +UcEbVASY06m/weaKXTuH+7uIzg3jLz8GlvCiKVCZrts7oVewdFFxze1CkU1B/qnI +2GqGd0S7WWaXUF601CxwRM/aN5VCaTwwxHGzUvAhTaHYujl8HJ6jJJ3ygxaYqhZ8 +Q5sVW7euNJH+1GImGEaaP+vB+fGQV+useg2L23IwambV4EajcNxo2f8ESIl33rXp ++2dtQem8Ob0y2WIC8bGoPW43nOIv4tOiJovGuFVDiOEjPqXSJDlqR6sA1KGzqSX+ +DT+nHbrTUcELpNqsOO9VUCQFZUaTNE8tja3G1CEZ0o7KBWFxB3NH5YoZEr0ETc5O +nKVIrLsm9wIDAQABo4GOMIGLMB0GA1UdDgQWBBQLWOWLxkwVN6RAqTCpIb5HNlpW +/zAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zBJBgNVHR8EQjBAMD6g +PKA6hjhodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9DT01PRE9DZXJ0aWZpY2F0aW9u +QXV0aG9yaXR5LmNybDANBgkqhkiG9w0BAQUFAAOCAQEAPpiem/Yb6dc5t3iuHXIY +SdOH5EOC6z/JqvWote9VfCFSZfnVDeFs9D6Mk3ORLgLETgdxb8CPOGEIqB6BCsAv +IC9Bi5HcSEW88cbeunZrM8gALTFGTO3nnc+IlP8zwFboJIYmuNg4ON8qa90SzMc/ +RxdMosIGlgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4 +zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd +BA6+C4OmF4O5MBKgxTMVBbkN+8cFduPYSo38NBejxiEovjBFMR7HeL5YYTisO+IB +ZQ== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDtzCCAp+gAwIBAgIQDOfg5RfYRv6P5WD8G/AwOTANBgkqhkiG9w0BAQUFADBl +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv +b3QgQ0EwHhcNMDYxMTEwMDAwMDAwWhcNMzExMTEwMDAwMDAwWjBlMQswCQYDVQQG +EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl +cnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgQ0EwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtDhXO5EOAXLGH87dg+XESpa7c +JpSIqvTO9SA5KFhgDPiA2qkVlTJhPLWxKISKityfCgyDF3qPkKyK53lTXDGEKvYP +mDI2dsze3Tyoou9q+yHyUmHfnyDXH+Kx2f4YZNISW1/5WBg1vEfNoTb5a3/UsDg+ +wRvDjDPZ2C8Y/igPs6eD1sNuRMBhNZYW/lmci3Zt1/GiSw0r/wty2p5g0I6QNcZ4 +VYcgoc/lbQrISXwxmDNsIumH0DJaoroTghHtORedmTpyoeb6pNnVFzF1roV9Iq4/ +AUaG9ih5yLHa5FcXxH4cDrC0kqZWs72yl+2qp/C3xag/lRbQ/6GW6whfGHdPAgMB +AAGjYzBhMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW +BBRF66Kv9JLLgjEtUYunpyGd823IDzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYun +pyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAog683+Lt8ONyc3pklL/3cmbYMuRC +dWKuh+vy1dneVrOfzM4UKLkNl2BcEkxY5NM9g0lFWJc1aRqoR+pWxnmrEthngYTf +fwk8lOa4JiwgvT2zKIn3X/8i4peEH+ll74fg38FnSbNd67IJKusm7Xi+fT8r87cm +NW1fiQG2SVufAQWbqz0lwcy2f8Lxb4bG+mRo64EtlOtCt/qMHt1i8b5QZ7dsvfPx +H2sMNgcWfzd8qVttevESRmCD1ycEvkvOl77DZypoEd+A5wwzZr8TDRRu838fYxAe ++o0bJW1sj6W3YQGx0qMmoRBxna3iw/nDmVG3KwcIzi7mULKn+gpFL6Lw8g== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD +QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT +MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j +b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG +9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB +CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97 +nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt +43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P +T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4 +gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO +BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR +TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw +DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr +hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg +06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF +PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls +YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk +CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j +ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL +MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 +LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug +RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm ++9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW +PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM +xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB +Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3 +hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg +EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF +MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA +FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec +nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z +eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF +hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2 +Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe +vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep ++OkuE6N36B9K +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIECTCCAvGgAwIBAgIQDV6ZCtadt3js2AdWO4YV2TANBgkqhkiG9w0BAQUFADBb +MQswCQYDVQQGEwJVUzEgMB4GA1UEChMXRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3Qx +ETAPBgNVBAsTCERTVCBBQ0VTMRcwFQYDVQQDEw5EU1QgQUNFUyBDQSBYNjAeFw0w +MzExMjAyMTE5NThaFw0xNzExMjAyMTE5NThaMFsxCzAJBgNVBAYTAlVTMSAwHgYD +VQQKExdEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdDERMA8GA1UECxMIRFNUIEFDRVMx +FzAVBgNVBAMTDkRTVCBBQ0VTIENBIFg2MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A +MIIBCgKCAQEAuT31LMmU3HWKlV1j6IR3dma5WZFcRt2SPp/5DgO0PWGSvSMmtWPu +ktKe1jzIDZBfZIGxqAgNTNj50wUoUrQBJcWVHAx+PhCEdc/BGZFjz+iokYi5Q1K7 +gLFViYsx+tC3dr5BPTCapCIlF3PoHuLTrCq9Wzgh1SpL11V94zpVvddtawJXa+ZH +fAjIgrrep4c9oW24MFbCswKBXy314powGCi4ZtPLAZZv6opFVdbgnf9nKxcCpk4a +ahELfrd755jWjHZvwTvbUJN+5dCOHze4vbrGn2zpfDPyMjwmR/onJALJfh1biEIT +ajV8fTXpLmaRcpPVMibEdPVTo7NdmvYJywIDAQABo4HIMIHFMA8GA1UdEwEB/wQF +MAMBAf8wDgYDVR0PAQH/BAQDAgHGMB8GA1UdEQQYMBaBFHBraS1vcHNAdHJ1c3Rk +c3QuY29tMGIGA1UdIARbMFkwVwYKYIZIAWUDAgEBATBJMEcGCCsGAQUFBwIBFjto +dHRwOi8vd3d3LnRydXN0ZHN0LmNvbS9jZXJ0aWZpY2F0ZXMvcG9saWN5L0FDRVMt +aW5kZXguaHRtbDAdBgNVHQ4EFgQUCXIGThhDD+XWzMNqizF7eI+og7gwDQYJKoZI +hvcNAQEFBQADggEBAKPYjtay284F5zLNAdMEA+V25FYrnJmQ6AgwbN99Pe7lv7Uk +QIRJ4dEorsTCOlMwiPH1d25Ryvr/ma8kXxug/fKshMrfqfBfBC6tFr8hlxCBPeP/ +h40y3JTlR4peahPJlJU90u7INJXQgNStMgiAVDzgvVJT11J8smk/f3rPanTK+gQq +nExaBqXpIK1FZg9p8d2/6eMyi/rgwYZNcjwu2JN4Cir42NInPRmJX1p7ijvMDNpR +rscL9yuwNwXsvFcj4jjSm2jzVhKIT0J8uDHEtdvkyCE06UgRNe76x5JXxZ805Mf2 +9w4LTJxoeHtxMcfrHuBnQfO3oKfN5XozNmr6mis= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/ +MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT +DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow +PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD +Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB +AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O +rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq +OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b +xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw +7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD +aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV +HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG +SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69 +ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr +AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz +R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5 +JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo +Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEkTCCA3mgAwIBAgIERWtQVDANBgkqhkiG9w0BAQUFADCBsDELMAkGA1UEBhMC +VVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xOTA3BgNVBAsTMHd3dy5lbnRydXN0 +Lm5ldC9DUFMgaXMgaW5jb3Jwb3JhdGVkIGJ5IHJlZmVyZW5jZTEfMB0GA1UECxMW +KGMpIDIwMDYgRW50cnVzdCwgSW5jLjEtMCsGA1UEAxMkRW50cnVzdCBSb290IENl +cnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA2MTEyNzIwMjM0MloXDTI2MTEyNzIw +NTM0MlowgbAxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMTkw +NwYDVQQLEzB3d3cuZW50cnVzdC5uZXQvQ1BTIGlzIGluY29ycG9yYXRlZCBieSBy +ZWZlcmVuY2UxHzAdBgNVBAsTFihjKSAyMDA2IEVudHJ1c3QsIEluYy4xLTArBgNV +BAMTJEVudHJ1c3QgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASIwDQYJ +KoZIhvcNAQEBBQADggEPADCCAQoCggEBALaVtkNC+sZtKm9I35RMOVcF7sN5EUFo +Nu3s/poBj6E4KPz3EEZmLk0eGrEaTsbRwJWIsMn/MYszA9u3g3s+IIRe7bJWKKf4 +4LlAcTfFy0cOlypowCKVYhXbR9n10Cv/gkvJrT7eTNuQgFA/CYqEAOwwCj0Yzfv9 +KlmaI5UXLEWeH25DeW0MXJj+SKfFI0dcXv1u5x609mhF0YaDW6KKjbHjKYD+JXGI +rb68j6xSlkuqUY3kEzEZ6E5Nn9uss2rVvDlUccp6en+Q3X0dgNmBu1kmwhH+5pPi +94DkZfs0Nw4pgHBNrziGLp5/V6+eF67rHMsoIV+2HNjnogQi+dPa2MsCAwEAAaOB +sDCBrTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zArBgNVHRAEJDAi +gA8yMDA2MTEyNzIwMjM0MlqBDzIwMjYxMTI3MjA1MzQyWjAfBgNVHSMEGDAWgBRo +kORnpKZTgMeGZqTx90tD+4S9bTAdBgNVHQ4EFgQUaJDkZ6SmU4DHhmak8fdLQ/uE +vW0wHQYJKoZIhvZ9B0EABBAwDhsIVjcuMTo0LjADAgSQMA0GCSqGSIb3DQEBBQUA +A4IBAQCT1DCw1wMgKtD5Y+iRDAUgqV8ZyntyTtSx29CW+1RaGSwMCPeyvIWonX9t +O1KzKtvn1ISMY/YPyyYBkVBs9F8U4pN0wBOeMDpQ47RgxRzwIkSNcUesyBrJ6Zua +AGAT/3B+XxFNSRuzFVJ7yVTav52Vr2ua2J7p8eRDjeIRRDq/r72DQnNSi6q7pynP +9WQcCk3RvKqsnyrQ/39/2n3qse0wJcGE2jTSW3iDVuycNsMm4hH2Z0kdkquM++v/ +eu6FSqdQgPCnXEqULl8FmTxSQeDNtGPPAUO6nIPcj2A781q0tHuu2guQOHXvgR1m +0vdXcDazv/wor3ElhVsT/h5/WrQ8 +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEVzCCAz+gAwIBAgIBATANBgkqhkiG9w0BAQUFADCBnTELMAkGA1UEBhMCRVMx +IjAgBgNVBAcTGUMvIE11bnRhbmVyIDI0NCBCYXJjZWxvbmExQjBABgNVBAMTOUF1 +dG9yaWRhZCBkZSBDZXJ0aWZpY2FjaW9uIEZpcm1hcHJvZmVzaW9uYWwgQ0lGIEE2 +MjYzNDA2ODEmMCQGCSqGSIb3DQEJARYXY2FAZmlybWFwcm9mZXNpb25hbC5jb20w +HhcNMDExMDI0MjIwMDAwWhcNMTMxMDI0MjIwMDAwWjCBnTELMAkGA1UEBhMCRVMx +IjAgBgNVBAcTGUMvIE11bnRhbmVyIDI0NCBCYXJjZWxvbmExQjBABgNVBAMTOUF1 +dG9yaWRhZCBkZSBDZXJ0aWZpY2FjaW9uIEZpcm1hcHJvZmVzaW9uYWwgQ0lGIEE2 +MjYzNDA2ODEmMCQGCSqGSIb3DQEJARYXY2FAZmlybWFwcm9mZXNpb25hbC5jb20w +ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDnIwNvbyOlXnjOlSztlB5u +Cp4Bx+ow0Syd3Tfom5h5VtP8c9/Qit5Vj1H5WuretXDE7aTt/6MNbg9kUDGvASdY +rv5sp0ovFy3Tc9UTHI9ZpTQsHVQERc1ouKDAA6XPhUJHlShbz++AbOCQl4oBPB3z +hxAwJkh91/zpnZFx/0GaqUC1N5wpIE8fUuOgfRNtVLcK3ulqTgesrBlf3H5idPay +BQC6haD9HThuy1q7hryUZzM1gywfI834yJFxzJeL764P3CkDG8A563DtwW4O2GcL +iam8NeTvtjS0pbbELaW+0MOUJEjb35bTALVmGotmBQ/dPz/LP6pemkr4tErvlTcb +AgMBAAGjgZ8wgZwwKgYDVR0RBCMwIYYfaHR0cDovL3d3dy5maXJtYXByb2Zlc2lv +bmFsLmNvbTASBgNVHRMBAf8ECDAGAQH/AgEBMCsGA1UdEAQkMCKADzIwMDExMDI0 +MjIwMDAwWoEPMjAxMzEwMjQyMjAwMDBaMA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4E +FgQUMwugZtHq2s7eYpMEKFK1FH84aLcwDQYJKoZIhvcNAQEFBQADggEBAEdz/o0n +VPD11HecJ3lXV7cVVuzH2Fi3AQL0M+2TUIiefEaxvT8Ub/GzR0iLjJcG1+p+o1wq +u00vR+L4OQbJnC4xGgN49Lw4xiKLMzHwFgQEffl25EvXwOaD7FnMP97/T2u3Z36m +hoEyIwOdyPdfwUpgpZKpsaSgYMN4h7Mi8yrrW6ntBas3D7Hi05V2Y1Z0jFhyGzfl +ZKG+TQyTmAyX9odtsz/ny4Cm7YjHX1BiAuiZdBbQ5rQ58SfLyEDW44YQqSMSkuBp +QWOnryULwMWSyx6Yo1q6xTMPoJcB3X/ge9YGVM+h4k0460tQtcsm9MracEpqoeJ5 +quGnM/b9Sh/22WA= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDZjCCAk6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBEMQswCQYDVQQGEwJVUzEW +MBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgR2xvYmFs +IENBIDIwHhcNMDQwMzA0MDUwMDAwWhcNMTkwMzA0MDUwMDAwWjBEMQswCQYDVQQG +EwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3Qg +R2xvYmFsIENBIDIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDvPE1A +PRDfO1MA4Wf+lGAVPoWI8YkNkMgoI5kF6CsgncbzYEbYwbLVjDHZ3CB5JIG/NTL8 +Y2nbsSpr7iFY8gjpeMtvy/wWUsiRxP89c96xPqfCfWbB9X5SJBri1WeR0IIQ13hL +TytCOb1kLUCgsBDTOEhGiKEMuzozKmKY+wCdE1l/bztyqu6mD4b5BWHqZ38MN5aL +5mkWRxHCJ1kDs6ZgwiFAVvqgx306E+PsV8ez1q6diYD3Aecs9pYrEw15LNnA5IZ7 +S4wMcoKK+xfNAGw6EzywhIdLFnopsk/bHdQL82Y3vdj2V7teJHq4PIu5+pIaGoSe +2HSPqht/XvT+RSIhAgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYE +FHE4NvICMVNHK266ZUapEBVYIAUJMB8GA1UdIwQYMBaAFHE4NvICMVNHK266ZUap +EBVYIAUJMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQUFAAOCAQEAA/e1K6td +EPx7srJerJsOflN4WT5CBP51o62sgU7XAotexC3IUnbHLB/8gTKY0UvGkpMzNTEv +/NgdRN3ggX+d6YvhZJFiCzkIjKx0nVnZellSlxG5FntvRdOW2TF9AjYPnDtuzywN +A0ZF66D0f0hExghAzN4bcLUprbqLOzRldRtxIR0sFAqwlpW41uryZfspuk/qkZN0 +abby/+Ea0AzRdoXLiiW9l14sbxWZJue2Kf8i7MkCx1YAzUm5s2x7UwQa4qjJqhIF +I8LO57sEAszAR6LkxCkvW0VXiVHuPOtSCP8HNR6fNWpHSlaY0VqFH4z1Ir+rzoPz +4iIprn2DQKi6bA== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDfDCCAmSgAwIBAgIQGKy1av1pthU6Y2yv2vrEoTANBgkqhkiG9w0BAQUFADBY +MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjExMC8GA1UEAxMo +R2VvVHJ1c3QgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjEx +MjcwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMFgxCzAJBgNVBAYTAlVTMRYwFAYDVQQK +Ew1HZW9UcnVzdCBJbmMuMTEwLwYDVQQDEyhHZW9UcnVzdCBQcmltYXJ5IENlcnRp +ZmljYXRpb24gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC +AQEAvrgVe//UfH1nrYNke8hCUy3f9oQIIGHWAVlqnEQRr+92/ZV+zmEwu3qDXwK9 +AWbK7hWNb6EwnL2hhZ6UOvNWiAAxz9juapYC2e0DjPt1befquFUWBRaa9OBesYjA +ZIVcFU2Ix7e64HXprQU9nceJSOC7KMgD4TCTZF5SwFlwIjVXiIrxlQqD17wxcwE0 +7e9GceBrAqg1cmuXm2bgyxx5X9gaBGgeRwLmnWDiNpcB3841kt++Z8dtd1k7j53W +kBWUvEI0EME5+bEnPn7WinXFsq+W06Lem+SYvn3h6YGttm/81w7a4DSwDRp35+MI +mO9Y+pyEtzavwt+s0vQQBnBxNQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4G +A1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQULNVQQZcVi/CPNmFbSvtr2ZnJM5IwDQYJ +KoZIhvcNAQEFBQADggEBAFpwfyzdtzRP9YZRqSa+S7iq8XEN3GHHoOo0Hnp3DwQ1 +6CePbJC/kRYkRj5KTs4rFtULUh38H2eiAkUxT87z+gOneZ1TatnaYzr4gNfTmeGl +4b7UVXGYNTq+k+qurUKykG/g/CFNNWMziUnWm07Kx+dOCQD32sfvmWKZd7aVIl6K +oKv0uHiYyjgZmclynnjNS6yvGaBzEi38wkG6gZHaFloxt/m0cYASSJlyc1pZU8Fj +UjPtp8nSOQJw+uCxQmYpqptR7TBUIhRf2asdweSU8Pj1K/fqynhG1riR/aYNKxoU +AT6A8EKglQdebc3MS6RFjasS6LPeWuWgfOgPIh1a6Vk= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFbDCCA1SgAwIBAgIBATANBgkqhkiG9w0BAQUFADBHMQswCQYDVQQGEwJVUzEW +MBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEgMB4GA1UEAxMXR2VvVHJ1c3QgVW5pdmVy +c2FsIENBIDIwHhcNMDQwMzA0MDUwMDAwWhcNMjkwMzA0MDUwMDAwWjBHMQswCQYD +VQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEgMB4GA1UEAxMXR2VvVHJ1 +c3QgVW5pdmVyc2FsIENBIDIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC +AQCzVFLByT7y2dyxUxpZKeexw0Uo5dfR7cXFS6GqdHtXr0om/Nj1XqduGdt0DE81 +WzILAePb63p3NeqqWuDW6KFXlPCQo3RWlEQwAx5cTiuFJnSCegx2oG9NzkEtoBUG +FF+3Qs17j1hhNNwqCPkuwwGmIkQcTAeC5lvO0Ep8BNMZcyfwqph/Lq9O64ceJHdq +XbboW0W63MOhBW9Wjo8QJqVJwy7XQYci4E+GymC16qFjwAGXEHm9ADwSbSsVsaxL +se4YuU6W3Nx2/zu+z18DwPw76L5GG//aQMJS9/7jOvdqdzXQ2o3rXhhqMcceujwb +KNZrVMaqW9eiLBsZzKIC9ptZvTdrhrVtgrrY6slWvKk2WP0+GfPtDCapkzj4T8Fd +IgbQl+rhrcZV4IErKIM6+vR7IVEAvlI4zs1meaj0gVbi0IMJR1FbUGrP20gaXT73 +y/Zl92zxlfgCOzJWgjl6W70viRu/obTo/3+NjN8D8WBOWBFM66M/ECuDmgFz2ZRt +hAAnZqzwcEAJQpKtT5MNYQlRJNiS1QuUYbKHsu3/mjX/hVTK7URDrBs8FmtISgoc +QIgfksILAAX/8sgCSqSqqcyZlpwvWOB94b67B9xfBHJcMTTD7F8t4D1kkCLm0ey4 +Lt1ZrtmhN79UNdxzMk+MBB4zsslG8dhcyFVQyWi9qLo2CQIDAQABo2MwYTAPBgNV +HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR281Xh+qQ2+/CfXGJx7Tz0RzgQKzAfBgNV +HSMEGDAWgBR281Xh+qQ2+/CfXGJx7Tz0RzgQKzAOBgNVHQ8BAf8EBAMCAYYwDQYJ +KoZIhvcNAQEFBQADggIBAGbBxiPz2eAubl/oz66wsCVNK/g7WJtAJDday6sWSf+z +dXkzoS9tcBc0kf5nfo/sm+VegqlVHy/c1FEHEv6sFj4sNcZj/NwQ6w2jqtB8zNHQ +L1EuxBRa3ugZ4T7GzKQp5y6EqgYweHZUcyiYWTjgAA1i00J9IZ+uPTqM1fp3DRgr +Fg5fNuH8KrUwJM/gYwx7WBr+mbpCErGR9Hxo4sjoryzqyX6uuyo9DRXcNJW2GHSo +ag/HtPQTxORb7QrSpJdMKu0vbBKJPfEncKpqA1Ihn0CoZ1Dy81of398j9tx4TuaY +T1U6U+Pv8vSfx3zYWK8pIpe44L2RLrB27FcRz+8pRPPphXpgY+RdM4kX2TGq2tbz +GDVyz4crL2MjhF2EjD9XoIj8mZEoJmmZ1I+XRL6O1UixpCgp8RW04eWe3fiPpm8m +1wk8OhwRDqZsN/etRIcsKMfYdIKz0G9KV7s1KSegi+ghp4dkNl3M2Basx7InQJJV +OCiNUW7dFGdTbHFcJoRNdVq2fmBWqU2t+5sel/MN2dKXVHfaPRK34B7vCAas+YWH +6aLcr34YEoP9VhdBLtUpgn2Z9DH2canPLAEnpQW5qrJITirvn5NSUZU8UnOOVkwX +QMAJKOSLakhT2+zNVVXxxvjpoixMptEmX36vWkzaH6byHCx+rgIW0lbQL1dTR+iS +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFaDCCA1CgAwIBAgIBATANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJVUzEW +MBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEeMBwGA1UEAxMVR2VvVHJ1c3QgVW5pdmVy +c2FsIENBMB4XDTA0MDMwNDA1MDAwMFoXDTI5MDMwNDA1MDAwMFowRTELMAkGA1UE +BhMCVVMxFjAUBgNVBAoTDUdlb1RydXN0IEluYy4xHjAcBgNVBAMTFUdlb1RydXN0 +IFVuaXZlcnNhbCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKYV +VaCjxuAfjJ0hUNfBvitbtaSeodlyWL0AG0y/YckUHUWCq8YdgNY96xCcOq9tJPi8 +cQGeBvV8Xx7BDlXKg5pZMK4ZyzBIle0iN430SppyZj6tlcDgFgDgEB8rMQ7XlFTT +QjOgNB0eRXbdT8oYN+yFFXoZCPzVx5zw8qkuEKmS5j1YPakWaDwvdSEYfyh3peFh +F7em6fgemdtzbvQKoiFs7tqqhZJmr/Z6a4LauiIINQ/PQvE1+mrufislzDoR5G2v +c7J2Ha3QsnhnGqQ5HFELZ1aD/ThdDc7d8Lsrlh/eezJS/R27tQahsiFepdaVaH/w +mZ7cRQg+59IJDTWU3YBOU5fXtQlEIGQWFwMCTFMNaN7VqnJNk22CDtucvc+081xd +VHppCZbW2xHBjXWotM85yM48vCR85mLK4b19p71XZQvk/iXttmkQ3CgaRr0BHdCX +teGYO8A3ZNY9lO4L4fUorgtWv3GLIylBjobFS1J72HGrH4oVpjuDWtdYAVHGTEHZ +f9hBZ3KiKN9gg6meyHv8U3NyWfWTehd2Ds735VzZC1U0oqpbtWpU5xPKV+yXbfRe +Bi9Fi1jUIxaS5BZuKGNZMN9QAZxjiRqf2xeUgnA3wySemkfWWspOqGmJch+RbNt+ +nhutxx9z3SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB +/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY +MBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG +9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc +aanQmjg8+uUfNeVE44B5lGiku8SfPeE0zTBGi1QrlaXv9z+ZhP015s8xxtxqv6fX +IwjhmF7DWgh2qaavdy+3YL1ERmrvl/9zlcGO6JP7/TG37FcREUWbMPEaiDnBTzyn +ANXH/KttgCJwpQzgXQQpAvvLoJHRfNbDflDVnVi+QTjruXU8FdmbyUqDWcDaU/0z +uzYYm4UPFd3uLax2k7nZAY1IEKj79TiG8dsKxr2EoyNB3tZ3b4XUhRxQ4K5RirqN +Pnbiucon8l+f725ZDQbYKxek0nxru18UGkiPGkzns0ccjkxFKyDuSN/n3QmOGKja +QI2SJhFTYXNd673nxE0pN2HrrDktZy4W1vUAg4WhzH92xH3kt0tm7wNFYGm2DFKW +koRepqO1pD4r2czYG0eq8kTaT/kD6PAUyz/zg97QwVTjt+gKN02LIFkDMBmhLMi9 +ER/frslKxfMnZmaGrGiR/9nmUxwPi1xpZQomyB40w11Re9epnAahNt3ViZS82eQt +DF4JbAiXfKM9fJP/P6EUp8+1Xevb2xzEdt+Iub1FBZUbrvxGakyvSOPOrg/Sfuvm +bJxPgWp6ZKy7PtXny3YuxadIwVyQD8vIP/rmMuGNG2+k5o7Y+SlIis5z/iw= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDujCCAqKgAwIBAgILBAAAAAABD4Ym5g0wDQYJKoZIhvcNAQEFBQAwTDEgMB4G +A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp +Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1 +MDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG +A1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZI +hvcNAQEBBQADggEPADCCAQoCggEBAKbPJA6+Lm8omUVCxKs+IVSbC9N/hHD6ErPL +v4dfxn+G07IwXNb9rfF73OX4YJYJkhD10FPe+3t+c4isUoh7SqbKSaZeqKeMWhG8 +eoLrvozps6yWJQeXSpkqBy+0Hne/ig+1AnwblrjFuTosvNYSuetZfeLQBoZfXklq +tTleiDTsvHgMCJiEbKjNS7SgfQx5TfC4LcshytVsW33hoCmEofnTlEnLJGKRILzd +C9XZzPnqJworc5HGnRusyMvo4KD0L5CLTfuwNhv2GXqF4G3yYROIXJ/gkwpRl4pa +zq+r1feqCapgvdzZX99yqWATXgAByUr6P6TqBwMhAo6CygPCm48CAwEAAaOBnDCB +mTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUm+IH +V2ccHsBqBt5ZtJot39wZhi4wNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5n +bG9iYWxzaWduLm5ldC9yb290LXIyLmNybDAfBgNVHSMEGDAWgBSb4gdXZxwewGoG +3lm0mi3f3BmGLjANBgkqhkiG9w0BAQUFAAOCAQEAmYFThxxol4aR7OBKuEQLq4Gs +J0/WwbgcQ3izDJr86iw8bmEbTUsp9Z8FHSbBuOmDAGJFtqkIk7mpM0sYmsL4h4hO +291xNBrBVNpGP+DTKqttVCL1OmLNIG+6KYnX3ZHu01yiPqFbQfXf5WRDLenVOavS +ot+3i9DAgBkcRcAtjOj4LaR0VknFBbVPFd5uRHg5h6h+u/N5GJG79G+dwfCMNYxd +AfvDbbnvRG15RjF+Cv6pgsH/76tuIMRQyV+dTZsXjAzlAcmgQWpzU/qlULRuJQ/7 +TBj0/VLZjmmx6BEP3ojY+x1J96relc8geMJgEtslQIxq/H5COEBkEveegeGTLg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEADCCAuigAwIBAgIBADANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEh +MB8GA1UEChMYVGhlIEdvIERhZGR5IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBE +YWRkeSBDbGFzcyAyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA0MDYyOTE3 +MDYyMFoXDTM0MDYyOTE3MDYyMFowYzELMAkGA1UEBhMCVVMxITAfBgNVBAoTGFRo +ZSBHbyBEYWRkeSBHcm91cCwgSW5jLjExMC8GA1UECxMoR28gRGFkZHkgQ2xhc3Mg +MiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASAwDQYJKoZIhvcNAQEBBQADggEN +ADCCAQgCggEBAN6d1+pXGEmhW+vXX0iG6r7d/+TvZxz0ZWizV3GgXne77ZtJ6XCA +PVYYYwhv2vLM0D9/AlQiVBDYsoHUwHU9S3/Hd8M+eKsaA7Ugay9qK7HFiH7Eux6w +wdhFJ2+qN1j3hybX2C32qRe3H3I2TqYXP2WYktsqbl2i/ojgC95/5Y0V4evLOtXi +EqITLdiOr18SPaAIBQi2XKVlOARFmR6jYGB0xUGlcmIbYsUfb18aQr4CUWWoriMY +avx4A6lNf4DD+qta/KFApMoZFv6yyO9ecw3ud72a9nmYvLEHZ6IVDd2gWMZEewo+ +YihfukEHU1jPEX44dMX4/7VpkI+EdOqXG68CAQOjgcAwgb0wHQYDVR0OBBYEFNLE +sNKR1EwRcbNhyz2h/t2oatTjMIGNBgNVHSMEgYUwgYKAFNLEsNKR1EwRcbNhyz2h +/t2oatTjoWekZTBjMQswCQYDVQQGEwJVUzEhMB8GA1UEChMYVGhlIEdvIERhZGR5 +IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBEYWRkeSBDbGFzcyAyIENlcnRpZmlj +YXRpb24gQXV0aG9yaXR5ggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQAD +ggEBADJL87LKPpH8EsahB4yOd6AzBhRckB4Y9wimPQoZ+YeAEW5p5JYXMP80kWNy +OO7MHAGjHZQopDH2esRU1/blMVgDoszOYtuURXO1v0XJJLXVggKtI3lpjbi2Tc7P +TMozI+gciKqdi0FuFskg5YmezTvacPd+mSYgFFQlq25zheabIZ0KbIIOqPjCDPoQ +HmyW74cNxA9hi63ugyuV+I6ShHI56yDqg+2DzZduCLzrTia2cyvk0/ZM/iZx4mER +dEr/VxqHD3VILs9RaRegAhJhldXRQLIQTO7ErBBDpqWeCtWVYpoNz4iCxTIM5Cuf +ReYNnyicsbkqWletNw+vHX/bvZ8= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 105 (0x69) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=HU, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Uzleti (Class B) Tanusitvanykiado - Validity - Not Before: Feb 25 14:10:22 1999 GMT - Not After : Feb 20 14:10:22 2019 GMT - Subject: C=HU, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Uzleti (Class B) Tanusitvanykiado - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:b1:ea:04:ec:20:a0:23:c2:8f:38:60:cf:c7:46: - b3:d5:1b:fe:fb:b9:99:9e:04:dc:1c:7f:8c:4a:81: - 98:ee:a4:d4:ca:8a:17:b9:22:7f:83:0a:75:4c:9b: - c0:69:d8:64:39:a3:ed:92:a3:fd:5b:5c:74:1a:c0: - 47:ca:3a:69:76:9a:ba:e2:44:17:fc:4c:a3:d5:fe: - b8:97:88:af:88:03:89:1f:a4:f2:04:3e:c8:07:0b: - e6:f9:b3:2f:7a:62:14:09:46:14:ca:64:f5:8b:80: - b5:62:a8:d8:6b:d6:71:93:2d:b3:bf:09:54:58:ed: - 06:eb:a8:7b:dc:43:b1:a1:69 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE, pathlen:4 - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - Netscape Comment: - FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztositasa vedi. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! The issuance and the use of this certificate is subject to the NetLock CPS available at https://www.netlock.net/docs or by e-mail at cps@netlock.net. - Signature Algorithm: md5WithRSAEncryption - 04:db:ae:8c:17:af:f8:0e:90:31:4e:cd:3e:09:c0:6d:3a:b0: - f8:33:4c:47:4c:e3:75:88:10:97:ac:b0:38:15:91:c6:29:96: - cc:21:c0:6d:3c:a5:74:cf:d8:82:a5:39:c3:65:e3:42:70:bb: - 22:90:e3:7d:db:35:76:e1:a0:b5:da:9f:70:6e:93:1a:30:39: - 1d:30:db:2e:e3:7c:b2:91:b2:d1:37:29:fa:b9:d6:17:5c:47: - 4f:e3:1d:38:eb:9f:d5:7b:95:a8:28:9e:15:4a:d1:d1:d0:2b: - 00:97:a0:e2:92:36:2b:63:ac:58:01:6b:33:29:50:86:83:f1: - 01:48 -MD5 Fingerprint=39:16:AA:B9:6A:41:E1:14:69:DF:9E:6C:3B:72:DC:B6 -----BEGIN CERTIFICATE----- MIIFSzCCBLSgAwIBAgIBaTANBgkqhkiG9w0BAQQFADCBmTELMAkGA1UEBhMCSFUx ETAPBgNVBAcTCEJ1ZGFwZXN0MScwJQYDVQQKEx5OZXRMb2NrIEhhbG96YXRiaXp0 @@ -7346,51 +2633,6 @@ sPgzTEdM43WIEJessDgVkcYplswhwG08pXTP2IKlOcNl40JwuyKQ433bNXbhoLXa n3BukxowOR0w2y7jfLKRstE3Kfq51hdcR0/jHTjrn9V7lagonhVK0dHQKwCXoOKS NitjrFgBazMpUIaD8QFI -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 104 (0x68) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=HU, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Expressz (Class C) Tanusitvanykiado - Validity - Not Before: Feb 25 14:08:11 1999 GMT - Not After : Feb 20 14:08:11 2019 GMT - Subject: C=HU, L=Budapest, O=NetLock Halozatbiztonsagi Kft., OU=Tanusitvanykiadok, CN=NetLock Expressz (Class C) Tanusitvanykiado - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:eb:ec:b0:6c:61:8a:23:25:af:60:20:e3:d9:9f: - fc:93:0b:db:5d:8d:b0:a1:b3:40:3a:82:ce:fd:75: - e0:78:32:03:86:5a:86:95:91:ed:53:fa:9d:40:fc: - e6:e8:dd:d9:5b:7a:03:bd:5d:f3:3b:0c:c3:51:79: - 9b:ad:55:a0:e9:d0:03:10:af:0a:ba:14:42:d9:52: - 26:11:22:c7:d2:20:cc:82:a4:9a:a9:fe:b8:81:76: - 9d:6a:b7:d2:36:75:3e:b1:86:09:f6:6e:6d:7e:4e: - b7:7a:ec:ae:71:84:f6:04:33:08:25:32:eb:74:ac: - 16:44:c6:e4:40:93:1d:7f:ad - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE, pathlen:4 - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - Netscape Comment: - FIGYELEM! Ezen tanusitvany a NetLock Kft. Altalanos Szolgaltatasi Felteteleiben leirt eljarasok alapjan keszult. A hitelesites folyamatat a NetLock Kft. termekfelelosseg-biztositasa vedi. A digitalis alairas elfogadasanak feltetele az eloirt ellenorzesi eljaras megtetele. Az eljaras leirasa megtalalhato a NetLock Kft. Internet honlapjan a https://www.netlock.net/docs cimen vagy kerheto az ellenorzes@netlock.net e-mail cimen. IMPORTANT! The issuance and the use of this certificate is subject to the NetLock CPS available at https://www.netlock.net/docs or by e-mail at cps@netlock.net. - Signature Algorithm: md5WithRSAEncryption - 10:ad:7f:d7:0c:32:80:0a:d8:86:f1:79:98:b5:ad:d4:cd:b3: - 36:c4:96:48:c1:5c:cd:9a:d9:05:2e:9f:be:50:eb:f4:26:14: - 10:2d:d4:66:17:f8:9e:c1:27:fd:f1:ed:e4:7b:4b:a0:6c:b5: - ab:9a:57:70:a6:ed:a0:a4:ed:2e:f5:fd:fc:bd:fe:4d:37:08: - 0c:bc:e3:96:83:22:f5:49:1b:7f:4b:2b:b4:54:c1:80:7c:99: - 4e:1d:d0:8c:ee:d0:ac:e5:92:fa:75:56:fe:64:a0:13:8f:b8: - b8:16:9d:61:05:67:80:c8:d0:d8:a5:07:02:34:98:04:8d:33: - 04:d4 -MD5 Fingerprint=4F:EB:F1:F0:70:C2:80:63:5D:58:9F:DA:12:3C:A9:C4 -----BEGIN CERTIFICATE----- MIIFTzCCBLigAwIBAgIBaDANBgkqhkiG9w0BAQQFADCBmzELMAkGA1UEBhMCSFUx ETAPBgNVBAcTCEJ1ZGFwZXN0MScwJQYDVQQKEx5OZXRMb2NrIEhhbG96YXRiaXp0 @@ -7422,246 +2664,197 @@ ta3UzbM2xJZIwVzNmtkFLp++UOv0JhQQLdRmF/iewSf98e3ke0ugbLWrmldwpu2g pO0u9f38vf5NNwgMvOOWgyL1SRt/Syu0VMGAfJlOHdCM7tCs5ZL6dVb+ZKATj7i4 Fp1hBWeAyNDYpQcCNJgEjTME1A== -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 50:94:6c:ec:18:ea:d5:9c:4d:d5:97:ef:75:8f:a0:ad - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, OU=www.xrampsecurity.com, O=XRamp Security Services Inc, CN=XRamp Global Certification Authority - Validity - Not Before: Nov 1 17:14:04 2004 GMT - Not After : Jan 1 05:37:19 2035 GMT - Subject: C=US, OU=www.xrampsecurity.com, O=XRamp Security Services Inc, CN=XRamp Global Certification Authority - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:98:24:1e:bd:15:b4:ba:df:c7:8c:a5:27:b6:38: - 0b:69:f3:b6:4e:a8:2c:2e:21:1d:5c:44:df:21:5d: - 7e:23:74:fe:5e:7e:b4:4a:b7:a6:ad:1f:ae:e0:06: - 16:e2:9b:5b:d9:67:74:6b:5d:80:8f:29:9d:86:1b: - d9:9c:0d:98:6d:76:10:28:58:e4:65:b0:7f:4a:98: - 79:9f:e0:c3:31:7e:80:2b:b5:8c:c0:40:3b:11:86: - d0:cb:a2:86:36:60:a4:d5:30:82:6d:d9:6e:d0:0f: - 12:04:33:97:5f:4f:61:5a:f0:e4:f9:91:ab:e7:1d: - 3b:bc:e8:cf:f4:6b:2d:34:7c:e2:48:61:1c:8e:f3: - 61:44:cc:6f:a0:4a:a9:94:b0:4d:da:e7:a9:34:7a: - 72:38:a8:41:cc:3c:94:11:7d:eb:c8:a6:8c:b7:86: - cb:ca:33:3b:d9:3d:37:8b:fb:7a:3e:86:2c:e7:73: - d7:0a:57:ac:64:9b:19:eb:f4:0f:04:08:8a:ac:03: - 17:19:64:f4:5a:25:22:8d:34:2c:b2:f6:68:1d:12: - 6d:d3:8a:1e:14:da:c4:8f:a6:e2:23:85:d5:7a:0d: - bd:6a:e0:e9:ec:ec:17:bb:42:1b:67:aa:25:ed:45: - 83:21:fc:c1:c9:7c:d5:62:3e:fa:f2:c5:2d:d3:fd: - d4:65 - Exponent: 65537 (0x10001) - X509v3 extensions: - 1.3.6.1.4.1.311.20.2: - ...C.A - X509v3 Key Usage: - Digital Signature, Certificate Sign, CRL Sign - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Subject Key Identifier: - C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B - X509v3 CRL Distribution Points: - URI:http://crl.xrampsecurity.com/XGCA.crl - - 1.3.6.1.4.1.311.21.1: - ... - Signature Algorithm: sha1WithRSAEncryption - 91:15:39:03:01:1b:67:fb:4a:1c:f9:0a:60:5b:a1:da:4d:97: - 62:f9:24:53:27:d7:82:64:4e:90:2e:c3:49:1b:2b:9a:dc:fc: - a8:78:67:35:f1:1d:f0:11:bd:b7:48:e3:10:f6:0d:df:3f:d2: - c9:b6:aa:55:a4:48:ba:02:db:de:59:2e:15:5b:3b:9d:16:7d: - 47:d7:37:ea:5f:4d:76:12:36:bb:1f:d7:a1:81:04:46:20:a3: - 2c:6d:a9:9e:01:7e:3f:29:ce:00:93:df:fd:c9:92:73:89:89: - 64:9e:e7:2b:e4:1c:91:2c:d2:b9:ce:7d:ce:6f:31:99:d3:e6: - be:d2:1e:90:f0:09:14:79:5c:23:ab:4d:d2:da:21:1f:4d:99: - 79:9d:e1:cf:27:9f:10:9b:1c:88:0d:b0:8a:64:41:31:b8:0e: - 6c:90:24:a4:9b:5c:71:8f:ba:bb:7e:1c:1b:db:6a:80:0f:21: - bc:e9:db:a6:b7:40:f4:b2:8b:a9:b1:e4:ef:9a:1a:d0:3d:69: - 99:ee:a8:28:a3:e1:3c:b3:f0:b2:11:9c:cf:7c:40:e6:dd:e7: - 43:7d:a2:d8:3a:b5:a9:8d:f2:34:99:c4:d4:10:e1:06:fd:09: - 84:10:3b:ee:c4:4c:f4:ec:27:7c:42:c2:74:7c:82:8a:09:c9: - b4:03:25:bc -MD5 Fingerprint=A1:0B:44:B3:CA:10:D8:00:6E:9D:0F:D8:0F:92:0A:D1 -----BEGIN CERTIFICATE----- -MIIEMDCCAxigAwIBAgIQUJRs7Bjq1ZxN1ZfvdY+grTANBgkqhkiG9w0BAQUFADCB -gjELMAkGA1UEBhMCVVMxHjAcBgNVBAsTFXd3dy54cmFtcHNlY3VyaXR5LmNvbTEk -MCIGA1UEChMbWFJhbXAgU2VjdXJpdHkgU2VydmljZXMgSW5jMS0wKwYDVQQDEyRY -UmFtcCBHbG9iYWwgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDQxMTAxMTcx -NDA0WhcNMzUwMTAxMDUzNzE5WjCBgjELMAkGA1UEBhMCVVMxHjAcBgNVBAsTFXd3 -dy54cmFtcHNlY3VyaXR5LmNvbTEkMCIGA1UEChMbWFJhbXAgU2VjdXJpdHkgU2Vy -dmljZXMgSW5jMS0wKwYDVQQDEyRYUmFtcCBHbG9iYWwgQ2VydGlmaWNhdGlvbiBB -dXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCYJB69FbS6 -38eMpSe2OAtp87ZOqCwuIR1cRN8hXX4jdP5efrRKt6atH67gBhbim1vZZ3RrXYCP -KZ2GG9mcDZhtdhAoWORlsH9KmHmf4MMxfoArtYzAQDsRhtDLooY2YKTVMIJt2W7Q -DxIEM5dfT2Fa8OT5kavnHTu86M/0ay00fOJIYRyO82FEzG+gSqmUsE3a56k0enI4 -qEHMPJQRfevIpoy3hsvKMzvZPTeL+3o+hiznc9cKV6xkmxnr9A8ECIqsAxcZZPRa -JSKNNCyy9mgdEm3Tih4U2sSPpuIjhdV6Db1q4Ons7Be7QhtnqiXtRYMh/MHJfNVi -PvryxS3T/dRlAgMBAAGjgZ8wgZwwEwYJKwYBBAGCNxQCBAYeBABDAEEwCwYDVR0P -BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFMZPoj0GY4QJnM5i5ASs -jVy16bYbMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jcmwueHJhbXBzZWN1cml0 -eS5jb20vWEdDQS5jcmwwEAYJKwYBBAGCNxUBBAMCAQEwDQYJKoZIhvcNAQEFBQAD -ggEBAJEVOQMBG2f7Shz5CmBbodpNl2L5JFMn14JkTpAuw0kbK5rc/Kh4ZzXxHfAR -vbdI4xD2Dd8/0sm2qlWkSLoC295ZLhVbO50WfUfXN+pfTXYSNrsf16GBBEYgoyxt -qZ4Bfj8pzgCT3/3JknOJiWSe5yvkHJEs0rnOfc5vMZnT5r7SHpDwCRR5XCOrTdLa -IR9NmXmd4c8nnxCbHIgNsIpkQTG4DmyQJKSbXHGPurt+HBvbaoAPIbzp26a3QPSy -i6mx5O+aGtA9aZnuqCij4Tyz8LIRnM98QObd50N9otg6tamN8jSZxNQQ4Qb9CYQQ -O+7ETPTsJ3xCwnR8gooJybQDJbw= +MIIGfTCCBWWgAwIBAgICAQMwDQYJKoZIhvcNAQEEBQAwga8xCzAJBgNVBAYTAkhV +MRAwDgYDVQQIEwdIdW5nYXJ5MREwDwYDVQQHEwhCdWRhcGVzdDEnMCUGA1UEChMe +TmV0TG9jayBIYWxvemF0Yml6dG9uc2FnaSBLZnQuMRowGAYDVQQLExFUYW51c2l0 +dmFueWtpYWRvazE2MDQGA1UEAxMtTmV0TG9jayBLb3pqZWd5em9pIChDbGFzcyBB +KSBUYW51c2l0dmFueWtpYWRvMB4XDTk5MDIyNDIzMTQ0N1oXDTE5MDIxOTIzMTQ0 +N1owga8xCzAJBgNVBAYTAkhVMRAwDgYDVQQIEwdIdW5nYXJ5MREwDwYDVQQHEwhC +dWRhcGVzdDEnMCUGA1UEChMeTmV0TG9jayBIYWxvemF0Yml6dG9uc2FnaSBLZnQu +MRowGAYDVQQLExFUYW51c2l0dmFueWtpYWRvazE2MDQGA1UEAxMtTmV0TG9jayBL +b3pqZWd5em9pIChDbGFzcyBBKSBUYW51c2l0dmFueWtpYWRvMIIBIjANBgkqhkiG +9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvHSMD7tM9DceqQWC2ObhbHDqeLVu0ThEDaiD +zl3S1tWBxdRL51uUcCbbO51qTGL3cfNk1mE7PetzozfZz+qMkjvN9wfcZnSX9EUi +3fRc4L9t875lM+QVOr/bmJBVOMTtplVjC7B4BPTjbsE/jvxReB+SnoPC/tmwqcm8 +WgD/qaiYdPv2LD4VOQ22BFWoDpggQrOxJa1+mm9dU7GrDPzr4PN6s6iz/0b2Y6LY +Oph7tqyF/7AlT3Rj5xMHpQqPBffAZG9+pyeAlt7ULoZgx2srXnN7F+eRP2QM2Esi +NCubMvJIH5+hCoR64sKtlz2O1cH5VqNQ6ca0+pii7pXmKgOM3wIDAQABo4ICnzCC +ApswDgYDVR0PAQH/BAQDAgAGMBIGA1UdEwEB/wQIMAYBAf8CAQQwEQYJYIZIAYb4 +QgEBBAQDAgAHMIICYAYJYIZIAYb4QgENBIICURaCAk1GSUdZRUxFTSEgRXplbiB0 +YW51c2l0dmFueSBhIE5ldExvY2sgS2Z0LiBBbHRhbGFub3MgU3pvbGdhbHRhdGFz +aSBGZWx0ZXRlbGVpYmVuIGxlaXJ0IGVsamFyYXNvayBhbGFwamFuIGtlc3p1bHQu +IEEgaGl0ZWxlc2l0ZXMgZm9seWFtYXRhdCBhIE5ldExvY2sgS2Z0LiB0ZXJtZWtm +ZWxlbG9zc2VnLWJpenRvc2l0YXNhIHZlZGkuIEEgZGlnaXRhbGlzIGFsYWlyYXMg +ZWxmb2dhZGFzYW5hayBmZWx0ZXRlbGUgYXogZWxvaXJ0IGVsbGVub3J6ZXNpIGVs +amFyYXMgbWVndGV0ZWxlLiBBeiBlbGphcmFzIGxlaXJhc2EgbWVndGFsYWxoYXRv +IGEgTmV0TG9jayBLZnQuIEludGVybmV0IGhvbmxhcGphbiBhIGh0dHBzOi8vd3d3 +Lm5ldGxvY2submV0L2RvY3MgY2ltZW4gdmFneSBrZXJoZXRvIGF6IGVsbGVub3J6 +ZXNAbmV0bG9jay5uZXQgZS1tYWlsIGNpbWVuLiBJTVBPUlRBTlQhIFRoZSBpc3N1 +YW5jZSBhbmQgdGhlIHVzZSBvZiB0aGlzIGNlcnRpZmljYXRlIGlzIHN1YmplY3Qg +dG8gdGhlIE5ldExvY2sgQ1BTIGF2YWlsYWJsZSBhdCBodHRwczovL3d3dy5uZXRs +b2NrLm5ldC9kb2NzIG9yIGJ5IGUtbWFpbCBhdCBjcHNAbmV0bG9jay5uZXQuMA0G +CSqGSIb3DQEBBAUAA4IBAQBIJEb3ulZv+sgoA0BO5TE5ayZrU3/b39/zcT0mwBQO +xmd7I6gMc90Bu8bKbjc5VdXHjFYgDigKDtIqpLBJUsY4B/6+CgmM0ZjPytoUMaFP +0jn8DxEsQ8Pdq5PHVT5HfBgaANzze9jyf1JsIPQLX2lS9O74silg6+NJMSEN1rUQ +QeJBCWziGppWS3cC9qCbmieH6FUpccKQn0V4GuEVZD3QDtigdp+uxdAu6tYPVuxk +f1qbFFgBJ34TUMdrKuZoPL9coAob4Q566eKAw+np9v1sEZ7Q5SgnK1QyQhSCdeZK +8CtmdWOMovsEPoMOmzbwGOQmIMOM8CgHrTwXZoi1/baI -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority - Validity - Not Before: Jun 29 17:06:20 2004 GMT - Not After : Jun 29 17:06:20 2034 GMT - Subject: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:de:9d:d7:ea:57:18:49:a1:5b:eb:d7:5f:48:86: - ea:be:dd:ff:e4:ef:67:1c:f4:65:68:b3:57:71:a0: - 5e:77:bb:ed:9b:49:e9:70:80:3d:56:18:63:08:6f: - da:f2:cc:d0:3f:7f:02:54:22:54:10:d8:b2:81:d4: - c0:75:3d:4b:7f:c7:77:c3:3e:78:ab:1a:03:b5:20: - 6b:2f:6a:2b:b1:c5:88:7e:c4:bb:1e:b0:c1:d8:45: - 27:6f:aa:37:58:f7:87:26:d7:d8:2d:f6:a9:17:b7: - 1f:72:36:4e:a6:17:3f:65:98:92:db:2a:6e:5d:a2: - fe:88:e0:0b:de:7f:e5:8d:15:e1:eb:cb:3a:d5:e2: - 12:a2:13:2d:d8:8e:af:5f:12:3d:a0:08:05:08:b6: - 5c:a5:65:38:04:45:99:1e:a3:60:60:74:c5:41:a5: - 72:62:1b:62:c5:1f:6f:5f:1a:42:be:02:51:65:a8: - ae:23:18:6a:fc:78:03:a9:4d:7f:80:c3:fa:ab:5a: - fc:a1:40:a4:ca:19:16:fe:b2:c8:ef:5e:73:0d:ee: - 77:bd:9a:f6:79:98:bc:b1:07:67:a2:15:0d:dd:a0: - 58:c6:44:7b:0a:3e:62:28:5f:ba:41:07:53:58:cf: - 11:7e:38:74:c5:f8:ff:b5:69:90:8f:84:74:ea:97: - 1b:af - Exponent: 3 (0x3) - X509v3 extensions: - X509v3 Subject Key Identifier: - D2:C4:B0:D2:91:D4:4C:11:71:B3:61:CB:3D:A1:FE:DD:A8:6A:D4:E3 - X509v3 Authority Key Identifier: - keyid:D2:C4:B0:D2:91:D4:4C:11:71:B3:61:CB:3D:A1:FE:DD:A8:6A:D4:E3 - DirName:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority - serial:00 - - X509v3 Basic Constraints: - CA:TRUE - Signature Algorithm: sha1WithRSAEncryption - 32:4b:f3:b2:ca:3e:91:fc:12:c6:a1:07:8c:8e:77:a0:33:06: - 14:5c:90:1e:18:f7:08:a6:3d:0a:19:f9:87:80:11:6e:69:e4: - 96:17:30:ff:34:91:63:72:38:ee:cc:1c:01:a3:1d:94:28:a4: - 31:f6:7a:c4:54:d7:f6:e5:31:58:03:a2:cc:ce:62:db:94:45: - 73:b5:bf:45:c9:24:b5:d5:82:02:ad:23:79:69:8d:b8:b6:4d: - ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5: - 89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85: - e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef: - 87:0d:c4:0f:61:8b:ad:ee:83:2b:95:f8:8e:92:84:72:39:eb: - 20:ea:83:ed:83:cd:97:6e:08:bc:eb:4e:26:b6:73:2b:e4:d3: - f6:4c:fe:26:71:e2:61:11:74:4a:ff:57:1a:87:0f:75:48:2e: - cf:51:69:17:a0:02:12:61:95:d5:d1:40:b2:10:4c:ee:c4:ac: - 10:43:a6:a5:9e:0a:d5:95:62:9a:0d:cf:88:82:c5:32:0c:e4: - 2b:9f:45:e6:0d:9f:28:9c:b1:b9:2a:5a:57:ad:37:0f:af:1d: - 7f:db:bd:9f -MD5 Fingerprint=91:DE:06:25:AB:DA:FD:32:17:0C:BB:25:17:2A:84:67 -----BEGIN CERTIFICATE----- -MIIEADCCAuigAwIBAgIBADANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEh -MB8GA1UEChMYVGhlIEdvIERhZGR5IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBE -YWRkeSBDbGFzcyAyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA0MDYyOTE3 -MDYyMFoXDTM0MDYyOTE3MDYyMFowYzELMAkGA1UEBhMCVVMxITAfBgNVBAoTGFRo -ZSBHbyBEYWRkeSBHcm91cCwgSW5jLjExMC8GA1UECxMoR28gRGFkZHkgQ2xhc3Mg -MiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASAwDQYJKoZIhvcNAQEBBQADggEN -ADCCAQgCggEBAN6d1+pXGEmhW+vXX0iG6r7d/+TvZxz0ZWizV3GgXne77ZtJ6XCA -PVYYYwhv2vLM0D9/AlQiVBDYsoHUwHU9S3/Hd8M+eKsaA7Ugay9qK7HFiH7Eux6w -wdhFJ2+qN1j3hybX2C32qRe3H3I2TqYXP2WYktsqbl2i/ojgC95/5Y0V4evLOtXi -EqITLdiOr18SPaAIBQi2XKVlOARFmR6jYGB0xUGlcmIbYsUfb18aQr4CUWWoriMY -avx4A6lNf4DD+qta/KFApMoZFv6yyO9ecw3ud72a9nmYvLEHZ6IVDd2gWMZEewo+ -YihfukEHU1jPEX44dMX4/7VpkI+EdOqXG68CAQOjgcAwgb0wHQYDVR0OBBYEFNLE -sNKR1EwRcbNhyz2h/t2oatTjMIGNBgNVHSMEgYUwgYKAFNLEsNKR1EwRcbNhyz2h -/t2oatTjoWekZTBjMQswCQYDVQQGEwJVUzEhMB8GA1UEChMYVGhlIEdvIERhZGR5 -IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBEYWRkeSBDbGFzcyAyIENlcnRpZmlj -YXRpb24gQXV0aG9yaXR5ggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQAD -ggEBADJL87LKPpH8EsahB4yOd6AzBhRckB4Y9wimPQoZ+YeAEW5p5JYXMP80kWNy -OO7MHAGjHZQopDH2esRU1/blMVgDoszOYtuURXO1v0XJJLXVggKtI3lpjbi2Tc7P -TMozI+gciKqdi0FuFskg5YmezTvacPd+mSYgFFQlq25zheabIZ0KbIIOqPjCDPoQ -HmyW74cNxA9hi63ugyuV+I6ShHI56yDqg+2DzZduCLzrTia2cyvk0/ZM/iZx4mER -dEr/VxqHD3VILs9RaRegAhJhldXRQLIQTO7ErBBDpqWeCtWVYpoNz4iCxTIM5Cuf -ReYNnyicsbkqWletNw+vHX/bvZ8= +MIIG0TCCBbmgAwIBAgIBezANBgkqhkiG9w0BAQUFADCByTELMAkGA1UEBhMCSFUx +ETAPBgNVBAcTCEJ1ZGFwZXN0MScwJQYDVQQKEx5OZXRMb2NrIEhhbG96YXRiaXp0 +b25zYWdpIEtmdC4xGjAYBgNVBAsTEVRhbnVzaXR2YW55a2lhZG9rMUIwQAYDVQQD +EzlOZXRMb2NrIE1pbm9zaXRldHQgS296amVneXpvaSAoQ2xhc3MgUUEpIFRhbnVz +aXR2YW55a2lhZG8xHjAcBgkqhkiG9w0BCQEWD2luZm9AbmV0bG9jay5odTAeFw0w +MzAzMzAwMTQ3MTFaFw0yMjEyMTUwMTQ3MTFaMIHJMQswCQYDVQQGEwJIVTERMA8G +A1UEBxMIQnVkYXBlc3QxJzAlBgNVBAoTHk5ldExvY2sgSGFsb3phdGJpenRvbnNh +Z2kgS2Z0LjEaMBgGA1UECxMRVGFudXNpdHZhbnlraWFkb2sxQjBABgNVBAMTOU5l +dExvY2sgTWlub3NpdGV0dCBLb3pqZWd5em9pIChDbGFzcyBRQSkgVGFudXNpdHZh +bnlraWFkbzEeMBwGCSqGSIb3DQEJARYPaW5mb0BuZXRsb2NrLmh1MIIBIjANBgkq +hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx1Ilstg91IRVCacbvWy5FPSKAtt2/Goq +eKvld/Bu4IwjZ9ulZJm53QE+b+8tmjwi8F3JV6BVQX/yQ15YglMxZc4e8ia6AFQe +r7C8HORSjKAyr7c3sVNnaHRnUPYtLmTeriZ539+Zhqurf4XsoPuAzPS4DB6TRWO5 +3Lhbm+1bOdRfYrCnjnxmOCyqsQhjF2d9zL2z8cM/z1A57dEZgxXbhxInlrfa6uWd +vLrqOU+L73Sa58XQ0uqGURzk/mQIKAR5BevKxXEOC++r6uwSEaEYBTJp0QwsGj0l +mT+1fMptsK6ZmfoIYOcZwvK9UdPM0wKswREMgM6r3JSda6M5UzrWhQIDAMV9o4IC +wDCCArwwEgYDVR0TAQH/BAgwBgEB/wIBBDAOBgNVHQ8BAf8EBAMCAQYwggJ1Bglg +hkgBhvhCAQ0EggJmFoICYkZJR1lFTEVNISBFemVuIHRhbnVzaXR2YW55IGEgTmV0 +TG9jayBLZnQuIE1pbm9zaXRldHQgU3pvbGdhbHRhdGFzaSBTemFiYWx5emF0YWJh +biBsZWlydCBlbGphcmFzb2sgYWxhcGphbiBrZXN6dWx0LiBBIG1pbm9zaXRldHQg +ZWxla3Ryb25pa3VzIGFsYWlyYXMgam9naGF0YXMgZXJ2ZW55ZXN1bGVzZW5laywg +dmFsYW1pbnQgZWxmb2dhZGFzYW5hayBmZWx0ZXRlbGUgYSBNaW5vc2l0ZXR0IFN6 +b2xnYWx0YXRhc2kgU3phYmFseXphdGJhbiwgYXogQWx0YWxhbm9zIFN6ZXJ6b2Rl +c2kgRmVsdGV0ZWxla2JlbiBlbG9pcnQgZWxsZW5vcnplc2kgZWxqYXJhcyBtZWd0 +ZXRlbGUuIEEgZG9rdW1lbnR1bW9rIG1lZ3RhbGFsaGF0b2sgYSBodHRwczovL3d3 +dy5uZXRsb2NrLmh1L2RvY3MvIGNpbWVuIHZhZ3kga2VyaGV0b2sgYXogaW5mb0Bu +ZXRsb2NrLm5ldCBlLW1haWwgY2ltZW4uIFdBUk5JTkchIFRoZSBpc3N1YW5jZSBh +bmQgdGhlIHVzZSBvZiB0aGlzIGNlcnRpZmljYXRlIGFyZSBzdWJqZWN0IHRvIHRo +ZSBOZXRMb2NrIFF1YWxpZmllZCBDUFMgYXZhaWxhYmxlIGF0IGh0dHBzOi8vd3d3 +Lm5ldGxvY2suaHUvZG9jcy8gb3IgYnkgZS1tYWlsIGF0IGluZm9AbmV0bG9jay5u +ZXQwHQYDVR0OBBYEFAlqYhaSsFq7VQ7LdTI6MuWyIckoMA0GCSqGSIb3DQEBBQUA +A4IBAQCRalCc23iBmz+LQuM7/KbD7kPgz/PigDVJRXYC4uMvBcXxKufAQTPGtpvQ +MznNwNuhrWw3AkxYQTvyl5LGSKjN5Yo5iWH5Upfpvfb5lHTocQ68d4bDBsxafEp+ +NFAwLvt/MpqNPfMgW/hqyobzMUwsWYACff44yTB1HLdV47yfuqhthCgFdbOLDcCR +VCHnpgu0mfVRQdzNo0ci2ccBgcTcR08m6h/t280NmPSjnLRzMkqWmf68f8glWPhY +83ZmiVSkpj7EUFy6iRiCdUgh0k8T6GB+B3bbELVR5qq5aKrN9p2QdRLqOBrKROi3 +macqaJVmlaut74nLYKkGEsaUR+ko +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFtzCCA5+gAwIBAgICBQkwDQYJKoZIhvcNAQEFBQAwRTELMAkGA1UEBhMCQk0x +GTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMTElF1b1ZhZGlzIFJv +b3QgQ0EgMjAeFw0wNjExMjQxODI3MDBaFw0zMTExMjQxODIzMzNaMEUxCzAJBgNV +BAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYDVQQDExJRdW9W +YWRpcyBSb290IENBIDIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCa +GMpLlA0ALa8DKYrwD4HIrkwZhR0In6spRIXzL4GtMh6QRr+jhiYaHv5+HBg6XJxg +Fyo6dIMzMH1hVBHL7avg5tKifvVrbxi3Cgst/ek+7wrGsxDp3MJGF/hd/aTa/55J +WpzmM+Yklvc/ulsrHHo1wtZn/qtmUIttKGAr79dgw8eTvI02kfN/+NsRE8Scd3bB +rrcCaoF6qUWD4gXmuVbBlDePSHFjIuwXZQeVikvfj8ZaCuWw419eaxGrDPmF60Tp ++ARz8un+XJiM9XOva7R+zdRcAitMOeGylZUtQofX1bOQQ7dsE/He3fbE+Ik/0XX1 +ksOR1YqI0JDs3G3eicJlcZaLDQP9nL9bFqyS2+r+eXyt66/3FsvbzSUr5R/7mp/i +Ucw6UwxI5g69ybR2BlLmEROFcmMDBOAENisgGQLodKcftslWZvB1JdxnwQ5hYIiz +PtGo/KPaHbDRsSNU30R2be1B2MGyIrZTHN81Hdyhdyox5C315eXbyOD/5YDXC2Og +/zOhD7osFRXql7PSorW+8oyWHhqPHWykYTe5hnMz15eWniN9gqRMgeKh0bpnX5UH +oycR7hYQe7xFSkyyBNKr79X9DFHOUGoIMfmR2gyPZFwDwzqLID9ujWc9Otb+fVuI +yV77zGHcizN300QyNQliBJIWENieJ0f7OyHj+OsdWwIDAQABo4GwMIGtMA8GA1Ud +EwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMB0GA1UdDgQWBBQahGK8SEwzJQTU7tD2 +A8QZRtGUazBuBgNVHSMEZzBlgBQahGK8SEwzJQTU7tD2A8QZRtGUa6FJpEcwRTEL +MAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMT +ElF1b1ZhZGlzIFJvb3QgQ0EgMoICBQkwDQYJKoZIhvcNAQEFBQADggIBAD4KFk2f +BluornFdLwUvZ+YTRYPENvbzwCYMDbVHZF34tHLJRqUDGCdViXh9duqWNIAXINzn +g/iN/Ae42l9NLmeyhP3ZRPx3UIHmfLTJDQtyU/h2BwdBR5YM++CCJpNVjP4iH2Bl +fF/nJrP3MpCYUNQ3cVX2kiF495V5+vgtJodmVjB3pjd4M1IQWK4/YY7yarHvGH5K +WWPKjaJW1acvvFYfzznB4vsKqBUsfU16Y8Zsl0Q80m/DShcK+JDSV6IZUaUtl0Ha +B0+pUNqQjZRG4T7wlP0QADj1O+hA4bRuVhogzG9Yje0uRY/W6ZM/57Es3zrWIozc +hLsib9D45MY56QSIPMO661V6bYCZJPVsAfv4l7CUW+v90m/xd2gNNWQjrLhVoQPR +TUIZ3Ph1WVaj+ahJefivDrkRoHy3au000LYmYjgahwz46P0u05B/B5EqHdZ+XIWD +mbA4CD/pXvk1B+TJYm5Xf6dQlfe6yJvmjqIBxdZmv3lh8zwc4bmCXF2gw+nYSL0Z +ohEUGW6yhhtoPkg3Goi3XZZenMfvJ2II4pEZXNLxId26F0KCl3GBUzGpn/Z9Yr9y +4aOTHcyKJloJONDO1w2AFrR4pTqHTI2KpdVGl/IsELm8VCLAAVBpQ570su9t+Oza +8eOx79+Rj1QqCyXBJhnEUhAFZdWCEOrCMc0u +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGnTCCBIWgAwIBAgICBcYwDQYJKoZIhvcNAQEFBQAwRTELMAkGA1UEBhMCQk0x +GTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMTElF1b1ZhZGlzIFJv +b3QgQ0EgMzAeFw0wNjExMjQxOTExMjNaFw0zMTExMjQxOTA2NDRaMEUxCzAJBgNV +BAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYDVQQDExJRdW9W +YWRpcyBSb290IENBIDMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDM +V0IWVJzmmNPTTe7+7cefQzlKZbPoFog02w1ZkXTPkrgEQK0CSzGrvI2RaNggDhoB +4hp7Thdd4oq3P5kazethq8Jlph+3t723j/z9cI8LoGe+AaJZz3HmDyl2/7FWeUUr +H556VOijKTVopAFPD6QuN+8bv+OPEKhyq1hX51SGyMnzW9os2l2ObjyjPtr7guXd +8lyyBTNvijbO0BNO/79KDDRMpsMhvVAEVeuxu537RR5kFd5VAYwCdrXLoT9Cabwv +vWhDFlaJKjdhkf2mrk7AyxRllDdLkgbvBNDInIjbC3uBr7E9KsRlOni27tyAsdLT +mZw67mtaa7ONt9XOnMK+pUsvFrGeaDsGb659n/je7Mwpp5ijJUMv7/FfJuGITfhe +btfZFG4ZM2mnO4SJk8RTVROhUXhA+LjJou57ulJCg54U7QVSWllWp5f8nT8KKdjc +T5EOE7zelaTfi5m+rJsziO+1ga8bxiJTyPbH7pcUsMV8eFLI8M5ud2CEpukqdiDt +WAEXMJPpGovgc2PZapKUSU60rUqFxKMiMPwJ7Wgic6aIDFUhWMXhOp8q3crhkODZ +c6tsgLjoC2SToJyMGf+z0gzskSaHirOi4XCPLArlzW1oUevaPwV/izLmE1xr/l9A +4iLItLRkT9a6fUg+qGkM17uGcclzuD87nSVL2v9A6wIDAQABo4IBlTCCAZEwDwYD +VR0TAQH/BAUwAwEB/zCB4QYDVR0gBIHZMIHWMIHTBgkrBgEEAb5YAAMwgcUwgZMG +CCsGAQUFBwICMIGGGoGDQW55IHVzZSBvZiB0aGlzIENlcnRpZmljYXRlIGNvbnN0 +aXR1dGVzIGFjY2VwdGFuY2Ugb2YgdGhlIFF1b1ZhZGlzIFJvb3QgQ0EgMyBDZXJ0 +aWZpY2F0ZSBQb2xpY3kgLyBDZXJ0aWZpY2F0aW9uIFByYWN0aWNlIFN0YXRlbWVu +dC4wLQYIKwYBBQUHAgEWIWh0dHA6Ly93d3cucXVvdmFkaXNnbG9iYWwuY29tL2Nw +czALBgNVHQ8EBAMCAQYwHQYDVR0OBBYEFPLAE+CCQz777i9nMpY1XNu4ywLQMG4G +A1UdIwRnMGWAFPLAE+CCQz777i9nMpY1XNu4ywLQoUmkRzBFMQswCQYDVQQGEwJC +TTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg +Um9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0 +7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem +d1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62Iix2rFo1bZhfZFvSLgNLd ++LJ2w/w4E6oM3kJpK27zPOuAJ9v1pkQNn1pVWQvVDVJIxa6f8i+AxeoyUDUSly7B +4f/xI4hROJ/yZlZ25w9Rl6VSDE1JUZU2Pb+iSwwQHYaZTKrzchGT5Or2m9qoXadN +t54CrnMAyNojA+j56hl0YgCUyyIgvpSnWbWCar6ZeXqp8kokUvd0/bpO5qgdAm6x +DYBEwa7TIzdfu4V8K5Iu6H6li92Z4b8nby1dqnuH/grdS/yO9SbkbnBCbjPsMZ57 +k8HkyWkaPcBrTiJt7qtYTcbQQcEr6k8Sh17rRdhs9ZgC06DYVYoGmRmioHfRMJ6s +zHXug/WwYjnPbFfiTNKRCw51KBuav/0aQ/HKd/s7j2G4aSgWQgRecCocIdiP4b0j +Wy10QJLZYxkNc91pvGJHvOB0K7Lrfb5BG7XARsWhIstfTsEokt4YutUqKLsRixeT +mJlglFwjz1onl14LBQaTNx47aTbrqZ5hHY8y2o4M1nQ+ewkk2gF3R8Q7zTSMmfXK +4SVhM7JZG+Ju1zdXtg2pEto= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDvDCCAqSgAwIBAgIQB1YipOjUiolN9BPI8PjqpTANBgkqhkiG9w0BAQUFADBK +MQswCQYDVQQGEwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3QgQ29ycG9yYXRpb24x +GTAXBgNVBAMTEFNlY3VyZSBHbG9iYWwgQ0EwHhcNMDYxMTA3MTk0MjI4WhcNMjkx +MjMxMTk1MjA2WjBKMQswCQYDVQQGEwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3Qg +Q29ycG9yYXRpb24xGTAXBgNVBAMTEFNlY3VyZSBHbG9iYWwgQ0EwggEiMA0GCSqG +SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvNS7YrGxVaQZx5RNoJLNP2MwhR/jxYDiJ +iQPpvepeRlMJ3Fz1Wuj3RSoC6zFh1ykzTM7HfAo3fg+6MpjhHZevj8fcyTiW89sa +/FHtaMbQbqR8JNGuQsiWUGMu4P51/pinX0kuleM5M2SOHqRfkNJnPLLZ/kG5VacJ +jnIFHovdRIWCQtBJwB1g8NEXLJXr9qXBkqPFwqcIYA1gBBCWeZ4WNOaptvolRTnI +HmX5k/Wq8VLcmZg9pYYaDDUz+kulBAYVHDGA76oYa8J719rO+TMg1fW9ajMtgQT7 +sFzUnKPiXB3jqUJ1XnvUd+85VLrJChgbEplJL4hL/VBi0XPnj3pDAgMBAAGjgZ0w +gZowEwYJKwYBBAGCNxQCBAYeBABDAEEwCwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQF +MAMBAf8wHQYDVR0OBBYEFK9EBMJBfkiD2045AuzshHrmzsmkMDQGA1UdHwQtMCsw +KaAnoCWGI2h0dHA6Ly9jcmwuc2VjdXJldHJ1c3QuY29tL1NHQ0EuY3JsMBAGCSsG +AQQBgjcVAQQDAgEAMA0GCSqGSIb3DQEBBQUAA4IBAQBjGghAfaReUw132HquHw0L +URYD7xh8yOOvaliTFGCRsoTciE6+OYo68+aCiV0BN7OrJKQVDpI1WkpEXk5X+nXO +H0jOZvQ8QCaSmGwb7iRGDBezUqXbpZGRzzfTb+cnCDpOGR86p1hcF895P4vkp9Mm +I50mD1hp/Ed+stCNi5O/KU9DaXR2Z0vPB4zmAve14bRDtUstFJ/53CYNv6ZHdAbY +iNE6KTCEztI5gGIbqMdXSbxqVVFnFUq+NQfk1XWYN3kwFNspnWzFacxHVaIw98xc +f8LDmBxrThaA63p4ZUWiABqvDA1VZDRIuJK58bRQKfJPIx/abKwfROHdI3hRW8cW +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDuDCCAqCgAwIBAgIQDPCOXAgWpa1Cf/DrJxhZ0DANBgkqhkiG9w0BAQUFADBI +MQswCQYDVQQGEwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3QgQ29ycG9yYXRpb24x +FzAVBgNVBAMTDlNlY3VyZVRydXN0IENBMB4XDTA2MTEwNzE5MzExOFoXDTI5MTIz +MTE5NDA1NVowSDELMAkGA1UEBhMCVVMxIDAeBgNVBAoTF1NlY3VyZVRydXN0IENv +cnBvcmF0aW9uMRcwFQYDVQQDEw5TZWN1cmVUcnVzdCBDQTCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBAKukgeWVzfX2FI7CT8rU4niVWJxB4Q2ZQCQXOZEz +Zum+4YOvYlyJ0fwkW2Gz4BERQRwdbvC4u/jep4G6pkjGnx29vo6pQT64lO0pGtSO +0gMdA+9tDWccV9cGrcrI9f4Or2YlSASWC12juhbDCE/RRvgUXPLIXgGZbf2IzIao +wW8xQmxSPmjL8xk037uHGFaAJsTQ3MBv396gwpEWoGQRS0S8Hvbn+mPeZqx2pHGj +7DaUaHp3pLHnDi+BeuK1cobvomuL8A/b01k/unK8RCSc43Oz969XL0Imnal0ugBS +8kvNU3xHCzaFDmapCJcWNFfBZveA4+1wVMeT4C4oFVmHursCAwEAAaOBnTCBmjAT +BgkrBgEEAYI3FAIEBh4EAEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB +/zAdBgNVHQ4EFgQUQjK2FvoE/f5dS3rD/fdMQB1aQ68wNAYDVR0fBC0wKzApoCeg +JYYjaHR0cDovL2NybC5zZWN1cmV0cnVzdC5jb20vU1RDQS5jcmwwEAYJKwYBBAGC +NxUBBAMCAQAwDQYJKoZIhvcNAQEFBQADggEBADDtT0rhWDpSclu1pqNlGKa7UTt3 +6Z3q059c4EVlew3KW+JwULKUBRSuSceNQQcSc5R+DCMh/bwQf2AQWnL1mA6s7Ll/ +3XpvXdMc9P+IBWlCqQVxyLesJugutIxq/3HcuLHfmbx8IVQr5Fiiu1cprp6poxkm +D5kuCLDv/WnPmRoJjeOnnyvJNjR7JLN4TJUXpAYmHrZkUjZfYGfZnMUFdAvnZyPS +CPyI6a6Lf+Ew9Dd+/cYy2i2eRDAwbO4H3tI0/NL/QPZL9GZGBlSm8jIKYyYwa5vR +3ItHuuG51WLQoqD0ZwV4KWMabwTW+MZMo5qxN7SN5ShLHZ4swrhovO0C7jE= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority - Validity - Not Before: Jun 29 17:39:16 2004 GMT - Not After : Jun 29 17:39:16 2034 GMT - Subject: C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:b7:32:c8:fe:e9:71:a6:04:85:ad:0c:11:64:df: - ce:4d:ef:c8:03:18:87:3f:a1:ab:fb:3c:a6:9f:f0: - c3:a1:da:d4:d8:6e:2b:53:90:fb:24:a4:3e:84:f0: - 9e:e8:5f:ec:e5:27:44:f5:28:a6:3f:7b:de:e0:2a: - f0:c8:af:53:2f:9e:ca:05:01:93:1e:8f:66:1c:39: - a7:4d:fa:5a:b6:73:04:25:66:eb:77:7f:e7:59:c6: - 4a:99:25:14:54:eb:26:c7:f3:7f:19:d5:30:70:8f: - af:b0:46:2a:ff:ad:eb:29:ed:d7:9f:aa:04:87:a3: - d4:f9:89:a5:34:5f:db:43:91:82:36:d9:66:3c:b1: - b8:b9:82:fd:9c:3a:3e:10:c8:3b:ef:06:65:66:7a: - 9b:19:18:3d:ff:71:51:3c:30:2e:5f:be:3d:77:73: - b2:5d:06:6c:c3:23:56:9a:2b:85:26:92:1c:a7:02: - b3:e4:3f:0d:af:08:79:82:b8:36:3d:ea:9c:d3:35: - b3:bc:69:ca:f5:cc:9d:e8:fd:64:8d:17:80:33:6e: - 5e:4a:5d:99:c9:1e:87:b4:9d:1a:c0:d5:6e:13:35: - 23:5e:df:9b:5f:3d:ef:d6:f7:76:c2:ea:3e:bb:78: - 0d:1c:42:67:6b:04:d8:f8:d6:da:6f:8b:f2:44:a0: - 01:ab - Exponent: 3 (0x3) - X509v3 extensions: - X509v3 Subject Key Identifier: - BF:5F:B7:D1:CE:DD:1F:86:F4:5B:55:AC:DC:D7:10:C2:0E:A9:88:E7 - X509v3 Authority Key Identifier: - keyid:BF:5F:B7:D1:CE:DD:1F:86:F4:5B:55:AC:DC:D7:10:C2:0E:A9:88:E7 - DirName:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority - serial:00 - - X509v3 Basic Constraints: - CA:TRUE - Signature Algorithm: sha1WithRSAEncryption - 05:9d:3f:88:9d:d1:c9:1a:55:a1:ac:69:f3:f3:59:da:9b:01: - 87:1a:4f:57:a9:a1:79:09:2a:db:f7:2f:b2:1e:cc:c7:5e:6a: - d8:83:87:a1:97:ef:49:35:3e:77:06:41:58:62:bf:8e:58:b8: - 0a:67:3f:ec:b3:dd:21:66:1f:c9:54:fa:72:cc:3d:4c:40:d8: - 81:af:77:9e:83:7a:bb:a2:c7:f5:34:17:8e:d9:11:40:f4:fc: - 2c:2a:4d:15:7f:a7:62:5d:2e:25:d3:00:0b:20:1a:1d:68:f9: - 17:b8:f4:bd:8b:ed:28:59:dd:4d:16:8b:17:83:c8:b2:65:c7: - 2d:7a:a5:aa:bc:53:86:6d:dd:57:a4:ca:f8:20:41:0b:68:f0: - f4:fb:74:be:56:5d:7a:79:f5:f9:1d:85:e3:2d:95:be:f5:71: - 90:43:cc:8d:1f:9a:00:0a:87:29:e9:55:22:58:00:23:ea:e3: - 12:43:29:5b:47:08:dd:8c:41:6a:65:06:a8:e5:21:aa:41:b4: - 95:21:95:b9:7d:d1:34:ab:13:d6:ad:bc:dc:e2:3d:39:cd:bd: - 3e:75:70:a1:18:59:03:c9:22:b4:8f:9c:d5:5e:2a:d7:a5:b6: - d4:0a:6d:f8:b7:40:11:46:9a:1f:79:0e:62:bf:0f:97:ec:e0: - 2f:1f:17:94 -MD5 Fingerprint=32:4A:4B:BB:C8:63:69:9B:BE:74:9A:C6:DD:1D:46:24 -----BEGIN CERTIFICATE----- MIIEDzCCAvegAwIBAgIBADANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQGEwJVUzEl MCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAGA1UECxMp @@ -7686,68 +2879,50 @@ xy16paq8U4Zt3VekyvggQQto8PT7dL5WXXp59fkdheMtlb71cZBDzI0fmgAKhynp VSJYACPq4xJDKVtHCN2MQWplBqjlIapBtJUhlbl90TSrE9atvNziPTnNvT51cKEY WQPJIrSPnNVeKtelttQKbfi3QBFGmh95DmK/D5fs4C8fF5Q= -----END CERTIFICATE----- - - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=IL, ST=Israel, L=Eilat, O=StartCom Ltd., OU=CA Authority Dep., CN=Free SSL Certification Authority/emailAddress=admin@startcom.org - Validity - Not Before: Mar 17 17:37:48 2005 GMT - Not After : Mar 10 17:37:48 2035 GMT - Subject: C=IL, ST=Israel, L=Eilat, O=StartCom Ltd., OU=CA Authority Dep., CN=Free SSL Certification Authority/emailAddress=admin@startcom.org - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:ed:84:60:00:23:9e:c8:4a:51:29:27:de:3a:a1: - 39:b5:69:ab:09:b2:2f:34:fd:61:dc:3d:d3:b0:cf: - b1:d7:c2:c4:c2:b1:e4:96:56:c4:be:aa:14:0e:e7: - cc:3a:50:c8:3a:62:9d:c3:a3:ac:59:7b:8e:ee:55: - 1a:1c:47:be:a3:97:39:b3:b5:ef:23:2c:08:e8:d8: - af:73:2f:b9:c9:83:e8:ed:00:0f:c8:75:a5:2f:34: - 4c:18:e8:76:88:23:49:8a:db:b6:ed:68:da:c3:b5: - 62:29:4c:a5:4b:b7:98:b4:09:14:10:a0:f8:fe:62: - 76:22:15:0b:a4:d6:08:2f:35 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Key Usage: - Digital Signature, Non Repudiation, Key Encipherment, Certificate Sign, CRL Sign - X509v3 Subject Key Identifier: - 1C:89:C3:96:CC:BD:FE:32:D5:0D:8C:81:31:B6:98:9D:8D:28:64:8D - X509v3 Authority Key Identifier: - keyid:1C:89:C3:96:CC:BD:FE:32:D5:0D:8C:81:31:B6:98:9D:8D:28:64:8D - DirName:/C=IL/ST=Israel/L=Eilat/O=StartCom Ltd./OU=CA Authority Dep./CN=Free SSL Certification Authority/emailAddress=admin@startcom.org - serial:00 - - X509v3 Subject Alternative Name: - email:admin@startcom.org - X509v3 Issuer Alternative Name: - email:admin@startcom.org - Netscape Cert Type: - SSL CA, S/MIME CA, Object Signing CA - Netscape Comment: - Free SSL Certification Authority - Netscape CA Revocation Url: - http://cert.startcom.org/ca-crl.crl - Netscape Base Url: - http://cert.startcom.org/ - Netscape CA Policy Url: - http://cert.startcom.org/index.php?app=111 - Signature Algorithm: md5WithRSAEncryption - 6c:71:25:e1:9e:34:91:21:ef:db:6c:bd:01:08:56:8f:88:d8: - 41:3a:53:f5:72:df:27:57:4b:76:84:f7:68:a4:fe:eb:3f:09: - 7e:28:b8:57:ea:1f:c1:aa:e2:ff:96:9f:49:99:e6:b2:95:73: - 96:c6:48:c7:5e:8d:07:72:56:f8:83:8f:9f:77:af:29:d3:45: - 0e:a4:ee:b0:36:74:2d:f0:cd:98:23:7b:37:4b:da:fe:51:98: - c4:1e:34:3c:88:fd:99:3b:50:a7:c1:8b:33:c7:c2:52:16:12: - 95:53:65:22:ef:ba:8b:ce:62:db:70:23:b1:80:df:1a:20:38: - e7:7e -MD5 Fingerprint=08:7C:58:1F:52:2B:44:B4:3B:79:CD:01:F8:C5:C3:C9 +-----BEGIN CERTIFICATE----- +MIIHyTCCBbGgAwIBAgIBATANBgkqhkiG9w0BAQUFADB9MQswCQYDVQQGEwJJTDEW +MBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwg +Q2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh +dGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0NjM2WhcNMzYwOTE3MTk0NjM2WjB9 +MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi +U2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3Rh +cnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUA +A4ICDwAwggIKAoICAQDBiNsJvGxGfHiflXu1M5DycmLWwTYgIiRezul38kMKogZk +pMyONvg45iPwbm2xPN1yo4UcodM9tDMr0y+v/uqwQVlntsQGfQqedIXWeUyAN3rf +OQVSWff0G0ZDpNKFhdLDcfN1YjS6LIp/Ho/u7TTQEceWzVI9ujPW3U3eCztKS5/C +Ji/6tRYccjV3yjxd5srhJosaNnZcAdt0FCX+7bWgiA/deMotHweXMAEtcnn6RtYT +Kqi5pquDSR3l8u/d5AGOGAqPY1MWhWKpDhk6zLVmpsJrdAfkK+F2PrRt2PZE4XNi +HzvEvqBTViVsUQn3qqvKv3b9bZvzndu/PWa8DFaqr5hIlTpL36dYUNk4dalb6kMM +Av+Z6+hsTXBbKWWc3apdzK8BMewM69KN6Oqce+Zu9ydmDBpI125C4z/eIT574Q1w ++2OqqGwaVLRcJXrJosmLFqa7LH4XXgVNWG4SHQHuEhANxjJ/GP/89PrNbpHoNkm+ +Gkhpi8KWTRoSsmkXwQqQ1vp5Iki/untp+HDH+no32NgN0nZPV/+Qt+OR0t3vwmC3 +Zzrd/qqc8NSLf3Iizsafl7b4r4qgEKjZ+xjGtrVcUjyJthkqcwEKDwOzEmDyei+B +26Nu/yYwl/WL3YlXtq09s68rxbd2AvCl1iuahhQqcvbjM4xdCUsT37uMdBNSSwID +AQABo4ICUjCCAk4wDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAa4wHQYDVR0OBBYE +FE4L7xqkQFulF2mHMMo0aEPQQa7yMGQGA1UdHwRdMFswLKAqoCiGJmh0dHA6Ly9j +ZXJ0LnN0YXJ0Y29tLm9yZy9zZnNjYS1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3Js +LnN0YXJ0Y29tLm9yZy9zZnNjYS1jcmwuY3JsMIIBXQYDVR0gBIIBVDCCAVAwggFM +BgsrBgEEAYG1NwEBATCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9jZXJ0LnN0YXJ0 +Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5zdGFy +dGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3Rh +cnQgQ29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlh +YmlsaXR5LCByZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2Yg +dGhlIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFp +bGFibGUgYXQgaHR0cDovL2NlcnQuc3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJ +YIZIAYb4QgEBBAQDAgAHMDgGCWCGSAGG+EIBDQQrFilTdGFydENvbSBGcmVlIFNT +TCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTANBgkqhkiG9w0BAQUFAAOCAgEAFmyZ +9GYMNPXQhV59CuzaEE44HF7fpiUFS5Eyweg78T3dRAlbB0mKKctmArexmvclmAk8 +jhvh3TaHK0u7aNM5Zj2gJsfyOZEdUauCe37Vzlrk4gNXcGmXCPleWKYK34wGmkUW +FjgKXlf2Ysd6AgXmvB618p70qSmD+LIU424oh0TDkBreOKk8rENNZEXO3SipXPJz +ewT4F+irsfMuXGRuczE6Eri8sxHkfY+BUZo7jYn0TZNmezwD7dOaHZrzZVD1oNB1 +ny+v8OqCQ5j4aZyJecRDjkZy42Q2Eq/3JR44iZB3fsNrarnDy0RLrHiQi+fHLB5L +EUTINFInzQpdn4XBidUaePKVEFMy3YCEZnXZtWgo+2EuvoSoOMCZEoalHmdkrQYu +L6lwhceWD3yJZfWOQ1QOq92lgDmUYMA0yZZwLKMS9R9Ie70cfmu3nZD0Ijuu+Pwq +yvqCUqDvr0tVk+vBtfAii6w0TiYiBKGHLHVKt+V9E9e4DGTANtLJL4YSjCMJwRuC +O3NJo2pXh5Tl1njFmUNj403gdy3hZZlyaQQaRwnmDwFWJPsfvw55qVguucQJAX6V +um0ABj6y6koQOdjQK/W/7HW/lwLFCRsI3FU34oH7N4RDYiDK51ZLZer+bMEkkySh +NOsF/5oirpt9P/FlUQqmMGqz9IgcgA38corog14= +-----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIFFjCCBH+gAwIBAgIBADANBgkqhkiG9w0BAQQFADCBsDELMAkGA1UEBhMCSUwx DzANBgNVBAgTBklzcmFlbDEOMAwGA1UEBxMFRWlsYXQxFjAUBgNVBAoTDVN0YXJ0 @@ -7778,212 +2953,633 @@ ct8nV0t2hPdopP7rPwl+KLhX6h/BquL/lp9JmeaylXOWxkjHXo0Hclb4g4+fd68p 00UOpO6wNnQt8M2YI3s3S9r+UZjEHjQ8iP2ZO1CnwYszx8JSFhKVU2Ui77qLzmLb cCOxgN8aIDjnfg== -----END CERTIFICATE----- - - -# -# RHNS CA certificate. Appended to the ca-bundle at package build-time. -# -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=US, ST=North Carolina, L=Research Triangle Park, O=Red Hat, Inc., OU=Red Hat Network Services, CN=RHNS Certificate Authority/Email=rhns@redhat.com - Validity - Not Before: Aug 23 22:45:55 2000 GMT - Not After : Aug 28 22:45:55 2003 GMT - Subject: C=US, ST=North Carolina, L=Research Triangle Park, O=Red Hat, Inc., OU=Red Hat Network Services, CN=RHNS Certificate Authority/Email=rhns@redhat.com - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:c0:68:2b:12:30:e2:21:2d:22:c6:72:71:5b:bf: - 17:a0:93:10:e9:9b:e3:c9:8d:3b:2d:ac:c4:bb:95: - 3b:e0:ca:55:32:dc:95:c2:10:b3:04:b2:51:fb:e8: - 85:61:16:34:a5:b4:1d:67:5c:a7:77:f4:f0:92:da: - b4:8b:af:95:93:62:f3:66:29:ae:c0:88:b7:64:84: - 0e:48:90:60:f8:60:3e:00:7f:54:dd:17:a6:ac:18: - e0:42:de:7c:be:90:81:f7:f4:05:85:0a:08:cc:d5: - f2:9f:fc:24:8b:77:a5:3d:e9:48:a9:ef:0f:3b:63: - a3:fe:a6:83:4c:e8:dc:0b:77 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - 54:15:CD:9F:2C:F7:EC:0D:1F:D2:A8:BE:4C:07:AC:88:3E:FB:9B:0A - X509v3 Authority Key Identifier: - keyid:54:15:CD:9F:2C:F7:EC:0D:1F:D2:A8:BE:4C:07:AC:88:3E:FB:9B:0A - DirName:/C=US/ST=North Carolina/L=Research Triangle Park/O=Red Hat, Inc./OU=Red Hat Network Services/CN=RHNS Certificate Authority/Email=rhns@redhat.com - serial:00 - - X509v3 Basic Constraints: - CA:TRUE - Signature Algorithm: md5WithRSAEncryption - 93:01:88:88:67:67:91:8c:9e:d0:12:14:90:71:12:87:55:0a: - f2:52:1b:ad:f2:d3:07:1d:af:70:99:bb:b0:cd:80:23:c9:ed: - 2b:73:e9:63:b1:d0:b3:8c:60:c5:42:64:a6:c1:95:56:90:c5: - 35:06:03:58:f5:8e:2b:d9:f9:a9:a0:10:a9:99:f7:15:42:92: - a5:50:d7:11:07:f1:02:d5:e0:70:e4:55:6e:2a:ce:25:f8:5d: - cd:0b:2f:10:61:f8:f6:20:42:cc:c3:89:f8:8a:4f:82:24:12: - cf:39:7f:21:a8:2c:8d:52:97:52:c5:f7:5f:42:a5:87:09:66: - b0:cc ------BEGIN CERTIFICATE----- -MIIEMDCCA5mgAwIBAgIBADANBgkqhkiG9w0BAQQFADCBxzELMAkGA1UEBhMCVVMx -FzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMR8wHQYDVQQHExZSZXNlYXJjaCBUcmlh -bmdsZSBQYXJrMRYwFAYDVQQKEw1SZWQgSGF0LCBJbmMuMSEwHwYDVQQLExhSZWQg -SGF0IE5ldHdvcmsgU2VydmljZXMxIzAhBgNVBAMTGlJITlMgQ2VydGlmaWNhdGUg -QXV0aG9yaXR5MR4wHAYJKoZIhvcNAQkBFg9yaG5zQHJlZGhhdC5jb20wHhcNMDAw -ODIzMjI0NTU1WhcNMDMwODI4MjI0NTU1WjCBxzELMAkGA1UEBhMCVVMxFzAVBgNV -BAgTDk5vcnRoIENhcm9saW5hMR8wHQYDVQQHExZSZXNlYXJjaCBUcmlhbmdsZSBQ -YXJrMRYwFAYDVQQKEw1SZWQgSGF0LCBJbmMuMSEwHwYDVQQLExhSZWQgSGF0IE5l -dHdvcmsgU2VydmljZXMxIzAhBgNVBAMTGlJITlMgQ2VydGlmaWNhdGUgQXV0aG9y -aXR5MR4wHAYJKoZIhvcNAQkBFg9yaG5zQHJlZGhhdC5jb20wgZ8wDQYJKoZIhvcN -AQEBBQADgY0AMIGJAoGBAMBoKxIw4iEtIsZycVu/F6CTEOmb48mNOy2sxLuVO+DK -VTLclcIQswSyUfvohWEWNKW0HWdcp3f08JLatIuvlZNi82YprsCIt2SEDkiQYPhg -PgB/VN0XpqwY4ELefL6Qgff0BYUKCMzV8p/8JIt3pT3pSKnvDztjo/6mg0zo3At3 -AgMBAAGjggEoMIIBJDAdBgNVHQ4EFgQUVBXNnyz37A0f0qi+TAesiD77mwowgfQG -A1UdIwSB7DCB6YAUVBXNnyz37A0f0qi+TAesiD77mwqhgc2kgcowgccxCzAJBgNV -BAYTAlVTMRcwFQYDVQQIEw5Ob3J0aCBDYXJvbGluYTEfMB0GA1UEBxMWUmVzZWFy -Y2ggVHJpYW5nbGUgUGFyazEWMBQGA1UEChMNUmVkIEhhdCwgSW5jLjEhMB8GA1UE -CxMYUmVkIEhhdCBOZXR3b3JrIFNlcnZpY2VzMSMwIQYDVQQDExpSSE5TIENlcnRp -ZmljYXRlIEF1dGhvcml0eTEeMBwGCSqGSIb3DQEJARYPcmhuc0ByZWRoYXQuY29t -ggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAkwGIiGdnkYye0BIU -kHESh1UK8lIbrfLTBx2vcJm7sM2AI8ntK3PpY7HQs4xgxUJkpsGVVpDFNQYDWPWO -K9n5qaAQqZn3FUKSpVDXEQfxAtXgcORVbirOJfhdzQsvEGH49iBCzMOJ+IpPgiQS -zzl/IagsjVKXUsX3X0KlhwlmsMw= +-----BEGIN CERTIFICATE----- +MIIF2TCCA8GgAwIBAgIQXAuFXAvnWUHfV8w/f52oNjANBgkqhkiG9w0BAQUFADBk +MQswCQYDVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0 +YWwgQ2VydGlmaWNhdGUgU2VydmljZXMxGzAZBgNVBAMTElN3aXNzY29tIFJvb3Qg +Q0EgMTAeFw0wNTA4MTgxMjA2MjBaFw0yNTA4MTgyMjA2MjBaMGQxCzAJBgNVBAYT +AmNoMREwDwYDVQQKEwhTd2lzc2NvbTElMCMGA1UECxMcRGlnaXRhbCBDZXJ0aWZp +Y2F0ZSBTZXJ2aWNlczEbMBkGA1UEAxMSU3dpc3Njb20gUm9vdCBDQSAxMIICIjAN +BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0LmwqAzZuz8h+BvVM5OAFmUgdbI9 +m2BtRsiMMW8Xw/qabFbtPMWRV8PNq5ZJkCoZSx6jbVfd8StiKHVFXqrWW/oLJdih +FvkcxC7mlSpnzNApbjyFNDhhSbEAn9Y6cV9Nbc5fuankiX9qUvrKm/LcqfmdmUc/ +TilftKaNXXsLmREDA/7n29uj/x2lzZAeAR81sH8A25Bvxn570e56eqeqDFdvpG3F +EzuwpdntMhy0XmeLVNxzh+XTF3xmUHJd1BpYwdnP2IkCb6dJtDZd0KTeByy2dbco +kdaXvij1mB7qWybJvbCXc9qukSbraMH5ORXWZ0sKbU/Lz7DkQnGMU3nn7uHbHaBu +HYwadzVcFh4rUx80i9Fs/PJnB3r1re3WmquhsUvhzDdf/X/NTa64H5xD+SpYVUNF +vJbNcA78yeNmuk6NO4HLFWR7uZToXTNShXEuT46iBhFRyePLoW4xCGQMwtI89Tbo +19AOeCMgkckkKmUpWyL3Ic6DXqTz3kvTaI9GdVyDCW4pa8RwjPWd1yAv/0bSKzjC +L3UcPX7ape8eYIVpQtPM+GP+HkM5haa2Y0EQs3MevNP6yn0WR+Kn1dCjigoIlmJW +bjTb2QK5MHXjBNLnj8KwEUAKrNVxAmKLMb7dxiNYMUJDLXT5xp6mig/p/r+D5kNX +JLrvRjSq1xIBOO0CAwEAAaOBhjCBgzAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0hBBYw +FDASBgdghXQBUwABBgdghXQBUwABMBIGA1UdEwEB/wQIMAYBAf8CAQcwHwYDVR0j +BBgwFoAUAyUv3m+CATpcLNwroWm1Z9SM0/0wHQYDVR0OBBYEFAMlL95vggE6XCzc +K6FptWfUjNP9MA0GCSqGSIb3DQEBBQUAA4ICAQA1EMvspgQNDQ/NwNurqPKIlwzf +ky9NfEBWMXrrpA9gzXrzvsMnjgM+pN0S734edAY8PzHyHHuRMSG08NBsl9Tpl7Ik +Vh5WwzW9iAUPWxAaZOHHgjD5Mq2eUCzneAXQMbFamIp1TpBcahQq4FJHgmDmHtqB +sfsUC1rxn9KVuj7QG9YVHaO+htXbD8BJZLsuUBlL0iT43R4HVtA4oJVwIHaM190e +3p9xxCPvgxNcoyQVTSlAPGrEqdi3pkSlDfTgnXceQHAm/NrZNuR55LU/vJtlvrsR +ls/bxig5OgjOR1tTWsWZ/l2p3e9M1MalrQLmjAcSHm8D0W+go/MpvRLHUKKwf4ip +mXeascClOS5cfGniLLDqN2qk4Vrh9VDlg++luyqI54zb/W1elxmofmZ1a3Hqv7HH +b6D0jqTsNFFbjCYDcKF31QESVwA12yPeDooomf2xEG9L/zgtYE4snOtnta1J7ksf +rK/7DZBaZmBwXarNeNQk7shBoJMBkpxqnvy5JMWzFYJ+vq6VK+uxwNrjAWALXmms +hFZhvnEX/h0TD/7Gh0Xp/jKgGg0TpJRVcaUWi7rKibCyx/yP2FS1k2Kdzs9Z+z0Y +zirLNRWCXf9UIltxUvu3yf5gmwBBZPCqKuy2QkPOiWaByIufOVQDJdMWNY6E0F/6 +MBr1mmz0DlP5OlvRHA== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFujCCA6KgAwIBAgIJALtAHEP1Xk+wMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV +BAYTAkNIMRUwEwYDVQQKEwxTd2lzc1NpZ24gQUcxHzAdBgNVBAMTFlN3aXNzU2ln +biBHb2xkIENBIC0gRzIwHhcNMDYxMDI1MDgzMDM1WhcNMzYxMDI1MDgzMDM1WjBF +MQswCQYDVQQGEwJDSDEVMBMGA1UEChMMU3dpc3NTaWduIEFHMR8wHQYDVQQDExZT +d2lzc1NpZ24gR29sZCBDQSAtIEcyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC +CgKCAgEAr+TufoskDhJuqVAtFkQ7kpJcyrhdhJJCEyq8ZVeCQD5XJM1QiyUqt2/8 +76LQwB8CJEoTlo8jE+YoWACjR8cGp4QjK7u9lit/VcyLwVcfDmJlD909Vopz2q5+ +bbqBHH5CjCA12UNNhPqE21Is8w4ndwtrvxEvcnifLtg+5hg3Wipy+dpikJKVyh+c +6bM8K8vzARO/Ws/BtQpgvd21mWRTuKCWs2/iJneRjOBiEAKfNA+k1ZIzUd6+jbqE +emA8atufK+ze3gE/bk3lUIbLtK/tREDFylqM2tIrfKjuvqblCqoOpd8FUrdVxyJd +MmqXl2MT28nbeTZ7hTpKxVKJ+STnnXepgv9VHKVxaSvRAiTysybUa9oEVeXBCsdt +MDeQKuSeFDNeFhdVxVu1yzSJkvGdJo+hB9TGsnhQ2wwMC3wLjEHXuendjIj3o02y +MszYF9rNt85mndT9Xv+9lz4pded+p2JYryU0pUHHPbwNUMoDAw8IWh+Vc3hiv69y +FGkOpeUDDniOJihC8AcLYiAQZzlG+qkDzAQ4embvIIO1jEpWjpEA/I5cgt6IoMPi +aG59je883WX0XaxR7ySArqpWl2/5rX3aYT+YdzylkbYcjCbaZaIJbcHiVOO5ykxM +gI93e2CaHt+28kgeDrpOVG2Y4OGiGqJ3UM/EY5LsRxmd6+ZrzsECAwEAAaOBrDCB +qTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUWyV7 +lqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn +8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov +L3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6 +45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD2StiGwC5+OlgzczO +UYrHUDFu4Up+GC9pWbY9ZIEr44OE5iKHjn3g7gKZYbge9LgriBIWhMIxkziWMaa5 +O1M/wySTVltpkuzFwbs4AOPsF6m43Md8AYOfMke6UiI0HTJ6CVanfCU2qT1L2sCC +bwq7EsiHSycR+R4tx5M/nttfJmtS2S6K8RTGRI0Vqbe/vd6mGu6uLftIdxf+u+yv +GPUqUfA5hJeVbG4bwyvEdGB5JbAKJ9/fXtI5z0V9QkvfsywexcZdylU6oJxpmo/a +77KwPJ+HbBIrZXAVUjEaJM9vMSNQH4xPjyPDdEFjHFWoFN0+4FFQz/EbMFYOkrCC +hdiDyyJkvC24JdVUorgG6q2SpCSgwYa1ShNqR88uC1aVVMvOmttqtKay20EIhid3 +92qgQmwLOM7XdVAyksLfKzAiSNDVQTglXaTpXZ/GlHXQRf0wl0OPkKsKx4ZzYEpp +Ld6leNcG2mqeSz53OiATIgHQv2ieY2BrNU0LbbqhPcCT4H8js1WtciVORvnSFu+w +ZMEBnunKoGqYDs/YYPIvSbjkQuE4NRb0yG5P94FW6LqjviOvrv1vA+ACOzB2+htt +Qc8Bsem4yWb02ybzOqR08kkkW8mw0FfB+j564ZfJ +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFwTCCA6mgAwIBAgIITrIAZwwDXU8wDQYJKoZIhvcNAQEFBQAwSTELMAkGA1UE +BhMCQ0gxFTATBgNVBAoTDFN3aXNzU2lnbiBBRzEjMCEGA1UEAxMaU3dpc3NTaWdu +IFBsYXRpbnVtIENBIC0gRzIwHhcNMDYxMDI1MDgzNjAwWhcNMzYxMDI1MDgzNjAw +WjBJMQswCQYDVQQGEwJDSDEVMBMGA1UEChMMU3dpc3NTaWduIEFHMSMwIQYDVQQD +ExpTd2lzc1NpZ24gUGxhdGludW0gQ0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQAD +ggIPADCCAgoCggIBAMrfogLi2vj8Bxax3mCq3pZcZB/HL37PZ/pEQtZ2Y5Wu669y +IIpFR4ZieIbWIDkm9K6j/SPnpZy1IiEZtzeTIsBQnIJ71NUERFzLtMKfkr4k2Htn +IuJpX+UFeNSH2XFwMyVTtIc7KZAoNppVRDBopIOXfw0enHb/FZ1glwCNioUD7IC+ +6ixuEFGSzH7VozPY1kneWCqv9hbrS3uQMpe5up1Y8fhXSQQeol0GcN1x2/ndi5ob +jM89o03Oy3z2u5yg+gnOI2Ky6Q0f4nIoj5+saCB9bzuohTEJfwvH6GXp43gOCWcw +izSC+13gzJ2BbWLuCB4ELE6b7P6pT1/9aXjvCR+htL/68++QHkwFix7qepF6w9fl ++zC8bBsQWJj3Gl/QKTIDE0ZNYWqFTFJ0LwYfexHihJfGmfNtf9dng34TaNhxKFrY +zt3oEBSa/m0jh26OWnA81Y0JAKeqvLAxN23IhBQeW71FYyBrS3SMvds6DsHPWhaP +pZjydomyExI7C3d3rLvlPClKknLKYRorXkzig3R3+jVIeoVNjZpTxN94ypeRSCtF +KwH3HBqi7Ri6Cr2D+m+8jVeTO9TUps4e8aCxzqv9KyiaTxvXw3LbpMS/XUz13XuW +ae5ogObnmLo2t/5u7Su9IPhlGdpVCX4l3P5hYnL5fhgC72O00Puv5TtjjGePAgMB +AAGjgawwgakwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O +BBYEFFCvzAeHFUdvOMW0ZdHelarp35zMMB8GA1UdIwQYMBaAFFCvzAeHFUdvOMW0 +ZdHelarp35zMMEYGA1UdIAQ/MD0wOwYJYIV0AVkBAQEBMC4wLAYIKwYBBQUHAgEW +IGh0dHA6Ly9yZXBvc2l0b3J5LnN3aXNzc2lnbi5jb20vMA0GCSqGSIb3DQEBBQUA +A4ICAQAIhab1Fgz8RBrBY+D5VUYI/HAcQiiWjrfFwUF1TglxeeVtlspLpYhg0DB0 +uMoI3LQwnkAHFmtllXcBrqS3NQuB2nEVqXQXOHtYyvkv+8Bldo1bAbl93oI9ZLi+ +FHSjClTTLJUYFzX1UWs/j6KWYTl4a0vlpqD4U99REJNi54Av4tHgvI42Rncz7Lj7 +jposiU0xEQ8mngS7twSNC/K5/FqdOxa3L8iYq/6KUFkuozv8KV2LwUvJ4ooTHbG/ +u0IdUt1O2BReEMYxB+9xJ/cbOQncguqLs5WGXv312l0xpuAxtpTmREl0xRbl9x8D +YSjFyMsSoEJL+WuICI20MhjzdZ/EfwBPBZWcoxcCw7NTm6ogOSkrZvqdr16zktK1 +puEa+S1BaYEUtLS17Yk9zvupnTVCRLEcFHOBzyoBNZox1S2PbYTfgE1X4z/FhHXa +icYwu+uPyyIIoK6q8QNsOktNCaUOcsZWayFCTiMlFGiudgp8DAdwZPmaL/YFOSbG +DI8Zf0NebvRbFS/bYV3mZy8/CJT5YLSYMdp08YSTcU1f+2BY0fvEwW2JorsgH51x +kcsymxM9Pn2SUjWskpSi0xjCfMfqr3YFFt1nJ8J+HAciIfNAChs0B0QTwoRqjt8Z +Wr9/6x3iGjjRXK9HkmuAtTClyY3YqzGBH9/CZjfTk6mFhnll0g== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFvTCCA6WgAwIBAgIITxvUL1S7L0swDQYJKoZIhvcNAQEFBQAwRzELMAkGA1UE +BhMCQ0gxFTATBgNVBAoTDFN3aXNzU2lnbiBBRzEhMB8GA1UEAxMYU3dpc3NTaWdu +IFNpbHZlciBDQSAtIEcyMB4XDTA2MTAyNTA4MzI0NloXDTM2MTAyNTA4MzI0Nlow +RzELMAkGA1UEBhMCQ0gxFTATBgNVBAoTDFN3aXNzU2lnbiBBRzEhMB8GA1UEAxMY +U3dpc3NTaWduIFNpbHZlciBDQSAtIEcyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A +MIICCgKCAgEAxPGHf9N4Mfc4yfjDmUO8x/e8N+dOcbpLj6VzHVxumK4DV644N0Mv +Fz0fyM5oEMF4rhkDKxD6LHmD9ui5aLlV8gREpzn5/ASLHvGiTSf5YXu6t+WiE7br +YT7QbNHm+/pe7R20nqA1W6GSy/BJkv6FCgU+5tkL4k+73JU3/JHpMjUi0R86TieF +nbAVlDLaYQ1HTWBCrpJH6INaUFjpiou5XaHc3ZlKHzZnu0jkg7Y360g6rw9njxcH +6ATK72oxh9TAtvmUcXtnZLi2kUpCe2UuMGoM9ZDulebyzYLs2aFK7PayS+VFheZt +eJMELpyCbTapxDFkH4aDCyr0NQp4yVXPQbBH6TCfmb5hqAaEuSh6XzjZG6k4sIN/ +c8HDO0gqgg8hm7jMqDXDhBuDsz6+pJVpATqJAHgE2cn0mRmrVn5bi4Y5FZGkECwJ +MoBgs5PAKrYYC51+jUnyEEp/+dVGLxmSo5mnJqy7jDzmDrxHB9xzUfFwZC8I+bRH +HTBsROopN4WSaGa8gzj+ezku01DwH/teYLappvonQfGbGHLy9YR0SslnxFSuSGTf +jNFusB3hB48IHpmccelM2KX3RxIfdNFRnobzwqIjQAtz20um53MGjMGg6cFZrEb6 +5i/4z3GcRm25xBWNOHkDRUjvxF3XCO6HOSKGsg0PWEP3calILv3q1h8CAwEAAaOB +rDCBqTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU +F6DNweRBtjpbO8tFnb0cwpj6hlgwHwYDVR0jBBgwFoAUF6DNweRBtjpbO8tFnb0c +wpj6hlgwRgYDVR0gBD8wPTA7BglghXQBWQEDAQEwLjAsBggrBgEFBQcCARYgaHR0 +cDovL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIB +AHPGgeAn0i0P4JUw4ppBf1AsX19iYamGamkYDHRJ1l2E6kFSGG9YrVBWIGrGvShp +WJHckRE1qTodvBqlYJ7YH39FkWnZfrt4csEGDyrOj4VwYaygzQu4OSlWhDJOhrs9 +xCrZ1x9y7v5RoSJBsXECYxqCsGKrXlcSH9/L3XWgwF15kIwb4FDm3jH+mHtwX6WQ +2K34ArZv02DdQEsixT2tOnqfGhpHkXkzuoLcMmkDlm4fS/Bx/uNncqCxv1yL5PqZ +IseEuRuNI5c/7SXgz2W79WEE790eslpBIlqhn10s6FvJbakMDHiqYMZWjwFaDGi8 +aRl5xB9+lwW/xekkUV7U1UtT7dkjWjYDZaPBA61BMPNGG4WQr2W11bHkFlt4dR2X +em1ZqSqPe97Dh4kQmUlzeMg9vVE1dCrV8X5pGyq7O70luJpaPXJhkGaH7gzWTdQR +dAtq/gsD/KNVV4n+SsuuWxcFyPKNIzFTONItaj+CuY0IavdeQXRuwxF+B6wpYJE/ +OMpXEA29MC/HpeZBoNquBYeaoKRlbEwJDIm6uNO5wJOKMPqN5ZprFQFOZ6raYlY+ +hAhm0sQ2fac+EPyI4NSA5QC9qvNOBqN6avlicuMJT+ubDgEj8Z+7fNzcbBGXJbLy +tGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFcjCCA1qgAwIBAgIQH51ZWtcvwgZEpYAIaeNe9jANBgkqhkiG9w0BAQUFADA/ +MQswCQYDVQQGEwJUVzEwMC4GA1UECgwnR292ZXJubWVudCBSb290IENlcnRpZmlj +YXRpb24gQXV0aG9yaXR5MB4XDTAyMTIwNTEzMjMzM1oXDTMyMTIwNTEzMjMzM1ow +PzELMAkGA1UEBhMCVFcxMDAuBgNVBAoMJ0dvdmVybm1lbnQgUm9vdCBDZXJ0aWZp +Y2F0aW9uIEF1dGhvcml0eTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB +AJoluOzMonWoe/fOW1mKydGGEghU7Jzy50b2iPN86aXfTEc2pBsBHH8eV4qNw8XR +IePaJD9IK/ufLqGU5ywck9G/GwGHU5nOp/UKIXZ3/6m3xnOUT0b3EEk3+qhZSV1q +gQdW8or5BtD3cCJNtLdBuTK4sfCxw5w/cP1T3YGq2GN49thTbqGsaoQkclSGxtKy +yhwOeYHWtXBiCAEuTk8O1RGvqa/lmr/czIdtJuTJV6L7lvnM4T9TjGxMfptTCAts +F/tnyMKtsc2AtJfcdgEWFelq16TheEfOhtX7MfP6Mb40qij7cEwdScevLJ1tZqa2 +jWR+tSBqnTuBto9AAGdLiYa4zGX+FVPpBMHWXx1E1wovJ5pGfaENda1UhhXcSTvx +ls4Pm6Dso3pdvtUqdULle96ltqqvKKyskKw4t9VoNSZ63Pc78/1Fm9G7Q3hub/FC +VGqY8A2tl+lSXunVanLeavcbYBT0peS2cWeqH+riTcFCQP5nRhc4L0c/cZyu5SHK +YS1tB6iEfC3uUSXxY5Ce/eFXiGvviiNtsea9P63RPZYLhY3Naye7twWb7LuRqQoH +EgKXTiCQ8P8NHuJBO9NAOueNXdpm5AKwB1KYXA6OM5zCppX7VRluTI6uSw+9wThN +Xo+EHWbNxWCWtFJaBYmOlXqYwZE8lSOyDvR5tMl8wUohAgMBAAGjajBoMB0GA1Ud +DgQWBBTMzO/MKWCkO7GStjz6MmKPrCUVOzAMBgNVHRMEBTADAQH/MDkGBGcqBwAE +MTAvMC0CAQAwCQYFKw4DAhoFADAHBgVnKgMAAAQUA5vwIhP/lSg209yewDL7MTqK +UWUwDQYJKoZIhvcNAQEFBQADggIBAECASvomyc5eMN1PhnR2WPWus4MzeKR6dBcZ +TulStbngCnRiqmjKeKBMmo4sIy7VahIkv9Ro04rQ2JyftB8M3jh+Vzj8jeJPXgyf +qzvS/3WXy6TjZwj/5cAWtUgBfen5Cv8b5Wppv3ghqMKnI6mGq3ZW6A4M9hPdKmaK +ZEk9GhiHkASfQlK3T8v+R0F2Ne//AHY2RTKbxkaFXeIksB7jSJaYV0eUVXoPQbFE +JPPB/hprv4j9wabak2BegUqZIJxIZhm1AHlUD7gsL0u8qV1bYH+Mh6XgUmMqvtg7 +hUAV/h62ZT/FS9p+tXo1KaMuephgIqP0fSdOLeq0dDzpD6QzDxARvBMB1uUO07+1 +EqLhRSPAzAhuYbeJq4PjJB7mXQfnHyA+z2fI56wwbSdLaG5LKlwCCDTb+HbkZ6Mm +nD+iMsJKxYEYMRBWqoTvLQr/uB930r+lWKBi5NdLkXWNiYCYfm3LU05er/ayl4WX +udpVBrkk7tfGOB5jGxI7leFYrPLfhNVfmS8NVVvmONsuP3LpSIXLuykTjx44Vbnz +ssQwmSNOXfJIoRIM3BKQCZBUkQM8R+XVyWXgt0t97EfTsws+rZ7QdAAO671RrcDe +LMDDav7v3Aun+kbfYNucpllQdSNpc5Oy+fwC00fmcc4QAu4njIT/rEUNE1yDMuAl +pYYsfPQS +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEIDCCAwigAwIBAgIQNE7VVyDV7exJ9C/ON9srbTANBgkqhkiG9w0BAQUFADCB +qTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf +Q2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw +MDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV +BAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw +NzE2MjM1OTU5WjCBqTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5j +LjEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYG +A1UECxMvKGMpIDIwMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNl +IG9ubHkxHzAdBgNVBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwggEiMA0GCSqG +SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsoPD7gFnUnMekz52hWXMJEEUMDSxuaPFs +W0hoSVk3/AszGcJ3f8wQLZU0HObrTQmnHNK4yZc2AreJ1CRfBsDMRJSUjQJib+ta +3RGNKJpchJAQeg29dGYvajig4tVUROsdB58Hum/u6f1OCyn1PoSgAfGcq/gcfomk +6KHYcWUNo1F77rzSImANuVud37r8UVsLr5iy6S7pBOhih94ryNdOwUxkHt3Ph1i6 +Sk/KaAcdHJ1KxtUvkcx8cXIcxcBn6zL9yZJclNqFwJu/U30rCfSMnZEfl2pSy94J +NqR32HuHUETVPm4pafs5SSYeCaWAe0At6+gnhcn+Yf1+5nyXHdWdAgMBAAGjQjBA +MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBR7W0XP +r87Lev0xkhpqtvNG61dIUDANBgkqhkiG9w0BAQUFAAOCAQEAeRHAS7ORtvzw6WfU +DW5FvlXok9LOAz/t2iWwHVfLHjp2oEzsUHboZHIMpKnxuIvW1oeEuzLlQRHAd9mz +YJ3rG9XRbkREqaYB7FViHXe4XI5ISXycO1cRrK1zN44veFyQaEfZYGDm/Ac9IiAX +xPcW6cTYcvnIc3zfFi8VqT79aie2oetaupgf1eNNZAqdE8hhuvU5HIe6uL17In/2 +/qxAeeWsEG89jxt5dovEN7MhGITlNgDrYyCZuen+MwS7QcjBAvlEYyCegc5C09Y/ +LHbTY5xZ3Y+m4Q6gLkH3LpVHz7z9M/P2C2F+fpErgUfCJzDupxBdN49cOSvkBPB7 +jVaMaA== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIID+zCCAuOgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBtzE/MD0GA1UEAww2VMOc +UktUUlVTVCBFbGVrdHJvbmlrIFNlcnRpZmlrYSBIaXptZXQgU2HEn2xhecSxY8Sx +c8SxMQswCQYDVQQGDAJUUjEPMA0GA1UEBwwGQU5LQVJBMVYwVAYDVQQKDE0oYykg +MjAwNSBUw5xSS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8 +dmVubGnEn2kgSGl6bWV0bGVyaSBBLsWeLjAeFw0wNTA1MTMxMDI3MTdaFw0xNTAz +MjIxMDI3MTdaMIG3MT8wPQYDVQQDDDZUw5xSS1RSVVNUIEVsZWt0cm9uaWsgU2Vy +dGlmaWthIEhpem1ldCBTYcSfbGF5xLFjxLFzxLExCzAJBgNVBAYMAlRSMQ8wDQYD +VQQHDAZBTktBUkExVjBUBgNVBAoMTShjKSAyMDA1IFTDnFJLVFJVU1QgQmlsZ2kg +xLBsZXRpxZ9pbSB2ZSBCaWxpxZ9pbSBHw7x2ZW5sacSfaSBIaXptZXRsZXJpIEEu +xZ4uMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAylIF1mMD2Bxf3dJ7 +XfIMYGFbazt0K3gNfUW9InTojAPBxhEqPZW8qZSwu5GXyGl8hMW0kWxsE2qkVa2k +heiVfrMArwDCBRj1cJ02i67L5BuBf5OI+2pVu32Fks66WJ/bMsW9Xe8iSi9BB35J +YbOG7E6mQW6EvAPs9TscyB/C7qju6hJKjRTP8wrgUDn5CDX4EVmt5yLqS8oUBt5C +urKZ8y1UiBAG6uEaPj1nH/vO+3yC6BFdSsG5FOpU2WabfIl9BJpiyelSPJ6c79L1 +JuTm5Rh8i27fbMx4W09ysstcP4wFjdFMjK2Sx+F4f2VsSQZQLJ4ywtdKxnWKWU51 +b0dewQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAV +9VX/N5aAWSGk/KEVTCD21F/aAyT8z5Aa9CEKmu46sWrv7/hg0Uw2ZkUd82YCdAR7 +kjCo3gp2D++Vbr3JN+YaDayJSFvMgzbC9UZcWYJWtNX+I7TYVBxEq8Sn5RTOPEFh +fEPmzcSBCYsk+1Ql1haolgxnB2+zUEfjHCQo3SqYpGH+2+oSN7wBGjSFvW5P55Fy +B0SFHljKVETd96y5y4khctuPwGkplyqjrhgjlxxBKot8KsF8kOipKMDTkcatKIdA +aLX/7KfS0zgYnNN9aV3wxqUeJBujR/xpB2jn5Jq07Q+hh4cCzofSSE7hvP/L8XKS +RGQDJereW26fyfJOrN3H +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEPDCCAySgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBvjE/MD0GA1UEAww2VMOc +UktUUlVTVCBFbGVrdHJvbmlrIFNlcnRpZmlrYSBIaXptZXQgU2HEn2xhecSxY8Sx +c8SxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMV0wWwYDVQQKDFRUw5xS +S1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kg +SGl6bWV0bGVyaSBBLsWeLiAoYykgS2FzxLFtIDIwMDUwHhcNMDUxMTA3MTAwNzU3 +WhcNMTUwOTE2MTAwNzU3WjCBvjE/MD0GA1UEAww2VMOcUktUUlVTVCBFbGVrdHJv +bmlrIFNlcnRpZmlrYSBIaXptZXQgU2HEn2xhecSxY8Sxc8SxMQswCQYDVQQGEwJU +UjEPMA0GA1UEBwwGQW5rYXJhMV0wWwYDVQQKDFRUw5xSS1RSVVNUIEJpbGdpIMSw +bGV0acWfaW0gdmUgQmlsacWfaW0gR8O8dmVubGnEn2kgSGl6bWV0bGVyaSBBLsWe +LiAoYykgS2FzxLFtIDIwMDUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB +AQCpNn7DkUNMwxmYCMjHWHtPFoylzkkBH3MOrHUTpvqeLCDe2JAOCtFp0if7qnef +J1Il4std2NiDUBd9irWCPwSOtNXwSadktx4uXyCcUHVPr+G1QRT0mJKIx+XlZEdh +R3n9wFHxwZnn3M5q+6+1ATDcRhzviuyV79z/rxAc653YsKpqhRgNF8k+v/Gb0AmJ +Qv2gQrSdiVFVKc8bcLyEVK3BEx+Y9C52YItdP5qtygy/p1Zbj3e41Z55SZI/4PGX +JHpsmxcPbe9TmJEr5A++WXkHeLuXlfSfadRYhwqp48y2WBmfJiGxxFmNskF1wK1p +zpwACPI2/z7woQ8arBT9pmAPAgMBAAGjQzBBMB0GA1UdDgQWBBTZN7NOBf3Zz58S +Fq62iS/rJTqIHDAPBgNVHQ8BAf8EBQMDBwYAMA8GA1UdEwEB/wQFMAMBAf8wDQYJ +KoZIhvcNAQEFBQADggEBAHJglrfJ3NgpXiOFX7KzLXb7iNcX/nttRbj2hWyfIvwq +ECLsqrkw9qtY1jkQMZkpAL2JZkH7dN6RwRgLn7Vhy506vvWolKMiVW4XSf/SKfE4 +Jl3vpao6+XF75tpYHdN0wgH6PmlYX63LaL4ULptswLbcoCb6dxriJNoaN+BnrdFz +gw2lGh1uEpJ+hGIAF728JRhX8tepb1mIvDS3LoV4nZbcFMMsilKbloxSZj2GFotH +uFEJjOp9zYhys2AzsfAKRO8P9Qk3iCQOLGsgOqL6EfJANZxEaGM7rDNvY7wsu/LS +y3Z9fYjYHcgFHW68lKlmjHdxx/qR+i9Rnuk5UrbnBEI= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIE0zCCA7ugAwIBAgIQGNrRniZ96LtKIVjNzGs7SjANBgkqhkiG9w0BAQUFADCB +yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL +ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJp +U2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxW +ZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0 +aG9yaXR5IC0gRzUwHhcNMDYxMTA4MDAwMDAwWhcNMzYwNzE2MjM1OTU5WjCByjEL +MAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZW +ZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2ln +biwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJp +U2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9y +aXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1 +nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ/XxrcgxiV0i6CqqpkKzj/i5Vbex +t0uz/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6/WhkcIz +SdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQG +BO+QueQA5N06tRn/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+ +rCpSx4/VBEnkjWNHiDxpg8v+R70rfk/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10/ +NIeWiu5T6CUVAgMBAAGjgbIwga8wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E +BAMCAQYwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAH +BgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVy +aXNpZ24uY29tL3ZzbG9nby5naWYwHQYDVR0OBBYEFH/TZafC3ey78DAJ80M5+gKv +MzEzMA0GCSqGSIb3DQEBBQUAA4IBAQCTJEowX2LP2BqYLz3q3JktvXf2pXkiOOzE +p6B4Eq1iDkVwZMXnl2YtmAl+X6/WzChl8gGqCBpH3vn5fJJaCGkgDdk+bW48DW7Y +5gaRQBi5+MHt39tBquCWIMnNZBU4gcmU7qKEKQsTb47bDN0lAtukixlE0kF6BWlK +WE9gyn6CagsCqiUXObXbf+eEZSqVir2G3l6BFoMtEMze/aiCKm0oHw0LxOXnGiYZ +4fQRbxC1lfznQgUy286dUV4otp6F01vvpX1FQHKOtw5rDgb7MzVIcbidJ4vEZV8N +hnacRHr2lVz2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIID5TCCAs2gAwIBAgIEOeSXnjANBgkqhkiG9w0BAQUFADCBgjELMAkGA1UEBhMC +VVMxFDASBgNVBAoTC1dlbGxzIEZhcmdvMSwwKgYDVQQLEyNXZWxscyBGYXJnbyBD +ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEvMC0GA1UEAxMmV2VsbHMgRmFyZ28gUm9v +dCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDAxMDExMTY0MTI4WhcNMjEwMTE0 +MTY0MTI4WjCBgjELMAkGA1UEBhMCVVMxFDASBgNVBAoTC1dlbGxzIEZhcmdvMSww +KgYDVQQLEyNXZWxscyBGYXJnbyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEvMC0G +A1UEAxMmV2VsbHMgRmFyZ28gUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDVqDM7Jvk0/82bfuUER84A4n13 +5zHCLielTWi5MbqNQ1mXx3Oqfz1cQJ4F5aHiidlMuD+b+Qy0yGIZLEWukR5zcUHE +SxP9cMIlrCL1dQu3U+SlK93OvRw6esP3E48mVJwWa2uv+9iWsWCaSOAlIiR5NM4O +JgALTqv9i86C1y8IcGjBqAr5dE8Hq6T54oN+J3N0Prj5OEL8pahbSCOz6+MlsoCu +ltQKnMJ4msZoGK43YjdeUXWoWGPAUe5AeH6orxqg4bB4nVCMe+ez/I4jsNtlAHCE +AQgAFG5Uhpq6zPk3EPbg3oQtnaSFN9OH4xXQwReQfhkhahKpdv0SAulPIV4XAgMB +AAGjYTBfMA8GA1UdEwEB/wQFMAMBAf8wTAYDVR0gBEUwQzBBBgtghkgBhvt7hwcB +CzAyMDAGCCsGAQUFBwIBFiRodHRwOi8vd3d3LndlbGxzZmFyZ28uY29tL2NlcnRw +b2xpY3kwDQYJKoZIhvcNAQEFBQADggEBANIn3ZwKdyu7IvICtUpKkfnRLb7kuxpo +7w6kAOnu5+/u9vnldKTC2FJYxHT7zmu1Oyl5GFrvm+0fazbuSCUlFLZWohDo7qd/ +0D+j0MNdJu4HzMPBJCGHHt8qElNvQRbn7a6U+oxy+hNH8Dx+rn0ROhPs7fpvcmR7 +nX1/Jv16+yWt6j4pf0zjAFcysLPp7VMX2YuyFA4w6OXVE8Zkr8QA1dhYJPz1j+zx +x32l2w8n0cbyQIjmH/ZhqPRCyLk306m+LFZ4wnKbWV01QIroTmMatukgalHizqSQ +33ZwmVxwQ023tqcZZE6St8WRPH9IFmV7Fv3L/PvZ1dZPIWU7Sn9Ho/s= -----END CERTIFICATE----- - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=US, ST=North Carolina, L=Raleigh, O=Red Hat, Inc., OU=Red Hat Network, CN=RHN Certificate Authority/Email=rhn-noc@redhat.com - Validity - Not Before: Sep 5 20:45:16 2002 GMT - Not After : Sep 9 20:45:16 2007 GMT - Subject: C=US, ST=North Carolina, L=Raleigh, O=Red Hat, Inc., OU=Red Hat Network, CN=RHN Certificate Authority/Email=rhn-noc@redhat.com - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:b3:16:b7:c5:f5:b9:69:51:1f:cd:b4:3d:70:cf: - 60:57:85:a4:2a:a7:5d:28:22:0e:ec:19:e2:92:f7: - 48:97:a6:a6:1f:51:95:83:11:8f:9a:98:a2:90:e0: - cb:4a:24:19:94:a8:8a:4b:88:b4:06:6c:ce:77:d7: - 15:3b:3c:cd:66:83:cf:23:1d:0d:bc:0a:0c:cb:1f: - cb:40:fb:f3:d9:fe:2a:b4:85:2c:7b:c9:a1:fe:f3: - 8f:68:1d:f2:12:b1:a4:16:19:ce:0f:b8:9a:9c:d9: - bc:5f:49:62:b2:95:93:ce:5d:2e:dd:79:3c:f1:5b: - a6:b7:a2:b5:39:0d:8e:12:31 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - 7F:1B:64:A1:2E:02:C5:A8:7D:B8:D1:B1:8B:06:9D:A3:A9:50:63:92 - X509v3 Authority Key Identifier: - keyid:7F:1B:64:A1:2E:02:C5:A8:7D:B8:D1:B1:8B:06:9D:A3:A9:50:63:92 - DirName:/C=US/ST=North Carolina/L=Raleigh/O=Red Hat, Inc./OU=Red Hat Network/CN=RHN Certificate Authority/Email=rhn-noc@redhat.com - serial:00 - - X509v3 Basic Constraints: - CA:TRUE - Signature Algorithm: md5WithRSAEncryption - 28:4d:42:e5:34:22:dd:c6:86:63:04:75:52:67:17:45:72:f2: - 3b:21:2b:45:59:72:73:f7:59:36:9d:57:43:c6:dc:94:0f:0e: - ff:13:5c:4f:50:37:85:b2:e4:c2:1f:35:9f:74:f4:e7:53:fb: - a1:06:b8:39:ce:e4:0a:86:7b:5f:28:5d:c7:11:9e:12:a5:d6: - b9:6c:e9:18:09:d5:f0:42:e7:54:b5:91:9e:23:ad:12:7a:aa: - 72:7c:39:3c:83:f8:75:a4:7b:03:92:ff:2a:d4:c5:76:19:12: - fa:b4:3b:b0:89:2c:95:8c:01:90:0d:d8:ba:06:05:61:00:ac: - 95:da ------BEGIN CERTIFICATE----- -MIID7jCCA1egAwIBAgIBADANBgkqhkiG9w0BAQQFADCBsTELMAkGA1UEBhMCVVMx -FzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRAwDgYDVQQHEwdSYWxlaWdoMRYwFAYD -VQQKEw1SZWQgSGF0LCBJbmMuMRgwFgYDVQQLEw9SZWQgSGF0IE5ldHdvcmsxIjAg -BgNVBAMTGVJITiBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEW -EnJobi1ub2NAcmVkaGF0LmNvbTAeFw0wMjA5MDUyMDQ1MTZaFw0wNzA5MDkyMDQ1 -MTZaMIGxMQswCQYDVQQGEwJVUzEXMBUGA1UECBMOTm9ydGggQ2Fyb2xpbmExEDAO -BgNVBAcTB1JhbGVpZ2gxFjAUBgNVBAoTDVJlZCBIYXQsIEluYy4xGDAWBgNVBAsT -D1JlZCBIYXQgTmV0d29yazEiMCAGA1UEAxMZUkhOIENlcnRpZmljYXRlIEF1dGhv -cml0eTEhMB8GCSqGSIb3DQEJARYScmhuLW5vY0ByZWRoYXQuY29tMIGfMA0GCSqG -SIb3DQEBAQUAA4GNADCBiQKBgQCzFrfF9blpUR/NtD1wz2BXhaQqp10oIg7sGeKS -90iXpqYfUZWDEY+amKKQ4MtKJBmUqIpLiLQGbM531xU7PM1mg88jHQ28CgzLH8tA -+/PZ/iq0hSx7yaH+849oHfISsaQWGc4PuJqc2bxfSWKylZPOXS7deTzxW6a3orU5 -DY4SMQIDAQABo4IBEjCCAQ4wHQYDVR0OBBYEFH8bZKEuAsWofbjRsYsGnaOpUGOS -MIHeBgNVHSMEgdYwgdOAFH8bZKEuAsWofbjRsYsGnaOpUGOSoYG3pIG0MIGxMQsw -CQYDVQQGEwJVUzEXMBUGA1UECBMOTm9ydGggQ2Fyb2xpbmExEDAOBgNVBAcTB1Jh -bGVpZ2gxFjAUBgNVBAoTDVJlZCBIYXQsIEluYy4xGDAWBgNVBAsTD1JlZCBIYXQg -TmV0d29yazEiMCAGA1UEAxMZUkhOIENlcnRpZmljYXRlIEF1dGhvcml0eTEhMB8G -CSqGSIb3DQEJARYScmhuLW5vY0ByZWRoYXQuY29tggEAMAwGA1UdEwQFMAMBAf8w -DQYJKoZIhvcNAQEEBQADgYEAKE1C5TQi3caGYwR1UmcXRXLyOyErRVlyc/dZNp1X -Q8bclA8O/xNcT1A3hbLkwh81n3T051P7oQa4Oc7kCoZ7XyhdxxGeEqXWuWzpGAnV -8ELnVLWRniOtEnqqcnw5PIP4daR7A5L/KtTFdhkS+rQ7sIkslYwBkA3YugYFYQCs -ldo= +-----BEGIN CERTIFICATE----- +MIIEMDCCAxigAwIBAgIQUJRs7Bjq1ZxN1ZfvdY+grTANBgkqhkiG9w0BAQUFADCB +gjELMAkGA1UEBhMCVVMxHjAcBgNVBAsTFXd3dy54cmFtcHNlY3VyaXR5LmNvbTEk +MCIGA1UEChMbWFJhbXAgU2VjdXJpdHkgU2VydmljZXMgSW5jMS0wKwYDVQQDEyRY +UmFtcCBHbG9iYWwgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDQxMTAxMTcx +NDA0WhcNMzUwMTAxMDUzNzE5WjCBgjELMAkGA1UEBhMCVVMxHjAcBgNVBAsTFXd3 +dy54cmFtcHNlY3VyaXR5LmNvbTEkMCIGA1UEChMbWFJhbXAgU2VjdXJpdHkgU2Vy +dmljZXMgSW5jMS0wKwYDVQQDEyRYUmFtcCBHbG9iYWwgQ2VydGlmaWNhdGlvbiBB +dXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCYJB69FbS6 +38eMpSe2OAtp87ZOqCwuIR1cRN8hXX4jdP5efrRKt6atH67gBhbim1vZZ3RrXYCP +KZ2GG9mcDZhtdhAoWORlsH9KmHmf4MMxfoArtYzAQDsRhtDLooY2YKTVMIJt2W7Q +DxIEM5dfT2Fa8OT5kavnHTu86M/0ay00fOJIYRyO82FEzG+gSqmUsE3a56k0enI4 +qEHMPJQRfevIpoy3hsvKMzvZPTeL+3o+hiznc9cKV6xkmxnr9A8ECIqsAxcZZPRa +JSKNNCyy9mgdEm3Tih4U2sSPpuIjhdV6Db1q4Ons7Be7QhtnqiXtRYMh/MHJfNVi +PvryxS3T/dRlAgMBAAGjgZ8wgZwwEwYJKwYBBAGCNxQCBAYeBABDAEEwCwYDVR0P +BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFMZPoj0GY4QJnM5i5ASs +jVy16bYbMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jcmwueHJhbXBzZWN1cml0 +eS5jb20vWEdDQS5jcmwwEAYJKwYBBAGCNxUBBAMCAQEwDQYJKoZIhvcNAQEFBQAD +ggEBAJEVOQMBG2f7Shz5CmBbodpNl2L5JFMn14JkTpAuw0kbK5rc/Kh4ZzXxHfAR +vbdI4xD2Dd8/0sm2qlWkSLoC295ZLhVbO50WfUfXN+pfTXYSNrsf16GBBEYgoyxt +qZ4Bfj8pzgCT3/3JknOJiWSe5yvkHJEs0rnOfc5vMZnT5r7SHpDwCRR5XCOrTdLa +IR9NmXmd4c8nnxCbHIgNsIpkQTG4DmyQJKSbXHGPurt+HBvbaoAPIbzp26a3QPSy +i6mx5O+aGtA9aZnuqCij4Tyz8LIRnM98QObd50N9otg6tamN8jSZxNQQ4Qb9CYQQ +O+7ETPTsJ3xCwnR8gooJybQDJbw= -----END CERTIFICATE----- - -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=US, ST=North Carolina, L=Raleigh, O=Red Hat, Inc., OU=Red Hat Network, CN=RHN Certificate Authority/emailAddress=rhn-noc@redhat.com - Validity - Not Before: Aug 29 02:10:55 2003 GMT - Not After : Aug 26 02:10:55 2013 GMT - Subject: C=US, ST=North Carolina, L=Raleigh, O=Red Hat, Inc., OU=Red Hat Network, CN=RHN Certificate Authority/emailAddress=rhn-noc@redhat.com - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:bf:61:63:eb:3d:8b:2b:45:48:e6:c2:fb:7c:d2: - 21:21:b8:ec:90:93:41:30:7c:2c:8d:79:d5:14:e9: - 0e:7e:3f:ef:d6:0a:9b:0a:a6:02:52:01:2d:26:96: - a4:ed:bd:a9:9e:aa:08:03:c1:61:0a:41:80:ea:ae: - 74:cc:61:26:d0:05:91:55:3e:66:14:a2:20:b3:d6: - 9d:71:0c:ab:77:cc:f4:f0:11:b5:25:33:8a:4e:22: - 9a:10:36:67:fa:11:6d:48:76:3a:1f:d2:e3:44:7b: - 89:66:be:b4:85:fb:2f:a6:aa:13:fa:9a:6d:c9:bb: - 18:c4:04:af:4f:15:69:89:9b - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Subject Key Identifier: - 69:44:27:05:DC:2E:ED:A5:F4:81:C4:D7:78:45:E7:44:5D:F8:87:47 - X509v3 Authority Key Identifier: - keyid:69:44:27:05:DC:2E:ED:A5:F4:81:C4:D7:78:45:E7:44:5D:F8:87:47 - DirName:/C=US/ST=North Carolina/L=Raleigh/O=Red Hat, Inc./OU=Red Hat Network/CN=RHN Certificate Authority/emailAddress=rhn-noc@redhat.com - serial:00 - - X509v3 Basic Constraints: - CA:TRUE - Signature Algorithm: md5WithRSAEncryption - 23:c9:ca:07:9f:5e:96:39:83:e0:4e:da:dd:47:84:30:ca:d4: - d5:38:86:f9:de:88:83:ca:2c:47:26:36:ab:f4:14:1e:28:29: - de:7d:10:4a:5e:91:3e:5a:99:07:0c:a9:2e:e3:fb:78:44:49: - c5:32:d6:e8:7a:97:ff:29:d0:33:ae:26:ba:76:06:7e:79:97: - 17:0c:4f:2d:2a:8b:8a:ac:41:59:ae:e9:c4:55:2d:b9:88:df: - 9b:7b:41:f8:32:2e:ee:c9:c0:59:e2:30:57:5e:37:47:29:c0: - 2d:78:33:d3:ce:a3:2b:dc:84:da:bf:3b:2e:4b:b6:b3:b6:4e: - 9e:80 ------BEGIN CERTIFICATE----- -MIID7jCCA1egAwIBAgIBADANBgkqhkiG9w0BAQQFADCBsTELMAkGA1UEBhMCVVMx -FzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRAwDgYDVQQHEwdSYWxlaWdoMRYwFAYD -VQQKEw1SZWQgSGF0LCBJbmMuMRgwFgYDVQQLEw9SZWQgSGF0IE5ldHdvcmsxIjAg -BgNVBAMTGVJITiBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEW -EnJobi1ub2NAcmVkaGF0LmNvbTAeFw0wMzA4MjkwMjEwNTVaFw0xMzA4MjYwMjEw -NTVaMIGxMQswCQYDVQQGEwJVUzEXMBUGA1UECBMOTm9ydGggQ2Fyb2xpbmExEDAO -BgNVBAcTB1JhbGVpZ2gxFjAUBgNVBAoTDVJlZCBIYXQsIEluYy4xGDAWBgNVBAsT -D1JlZCBIYXQgTmV0d29yazEiMCAGA1UEAxMZUkhOIENlcnRpZmljYXRlIEF1dGhv -cml0eTEhMB8GCSqGSIb3DQEJARYScmhuLW5vY0ByZWRoYXQuY29tMIGfMA0GCSqG -SIb3DQEBAQUAA4GNADCBiQKBgQC/YWPrPYsrRUjmwvt80iEhuOyQk0EwfCyNedUU -6Q5+P+/WCpsKpgJSAS0mlqTtvameqggDwWEKQYDqrnTMYSbQBZFVPmYUoiCz1p1x -DKt3zPTwEbUlM4pOIpoQNmf6EW1Idjof0uNEe4lmvrSF+y+mqhP6mm3JuxjEBK9P -FWmJmwIDAQABo4IBEjCCAQ4wHQYDVR0OBBYEFGlEJwXcLu2l9IHE13hF50Rd+IdH -MIHeBgNVHSMEgdYwgdOAFGlEJwXcLu2l9IHE13hF50Rd+IdHoYG3pIG0MIGxMQsw -CQYDVQQGEwJVUzEXMBUGA1UECBMOTm9ydGggQ2Fyb2xpbmExEDAOBgNVBAcTB1Jh -bGVpZ2gxFjAUBgNVBAoTDVJlZCBIYXQsIEluYy4xGDAWBgNVBAsTD1JlZCBIYXQg -TmV0d29yazEiMCAGA1UEAxMZUkhOIENlcnRpZmljYXRlIEF1dGhvcml0eTEhMB8G -CSqGSIb3DQEJARYScmhuLW5vY0ByZWRoYXQuY29tggEAMAwGA1UdEwQFMAMBAf8w -DQYJKoZIhvcNAQEEBQADgYEAI8nKB59eljmD4E7a3UeEMMrU1TiG+d6Ig8osRyY2 -q/QUHigp3n0QSl6RPlqZBwypLuP7eERJxTLW6HqX/ynQM64munYGfnmXFwxPLSqL -iqxBWa7pxFUtuYjfm3tB+DIu7snAWeIwV143RynALXgz086jK9yE2r87Lku2s7ZO -noA= +-----BEGIN CERTIFICATE----- +MIIDnzCCAoegAwIBAgIBJjANBgkqhkiG9w0BAQUFADBxMQswCQYDVQQGEwJERTEc +MBoGA1UEChMTRGV1dHNjaGUgVGVsZWtvbSBBRzEfMB0GA1UECxMWVC1UZWxlU2Vj +IFRydXN0IENlbnRlcjEjMCEGA1UEAxMaRGV1dHNjaGUgVGVsZWtvbSBSb290IENB +IDIwHhcNOTkwNzA5MTIxMTAwWhcNMTkwNzA5MjM1OTAwWjBxMQswCQYDVQQGEwJE +RTEcMBoGA1UEChMTRGV1dHNjaGUgVGVsZWtvbSBBRzEfMB0GA1UECxMWVC1UZWxl +U2VjIFRydXN0IENlbnRlcjEjMCEGA1UEAxMaRGV1dHNjaGUgVGVsZWtvbSBSb290 +IENBIDIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrC6M14IspFLEU +ha88EOQ5bzVdSq7d6mGNlUn0b2SjGmBmpKlAIoTZ1KXleJMOaAGtuU1cOs7TuKhC +QN/Po7qCWWqSG6wcmtoIKyUn+WkjR/Hg6yx6m/UTAtB+NHzCnjwAWav12gz1Mjwr +rFDa1sPeg5TKqAyZMg4ISFZbavva4VhYAUlfckE8FQYBjl2tqriTtM2e66foai1S +NNs671x1Udrb8zH57nGYMsRUFUQM+ZtV7a3fGAigo4aKSe5TBY8ZTNXeWHmb0moc +QqvF1afPaA+W5OFhmHZhyJF81j4A4pFQh+GdCuatl9Idxjp9y7zaAzTVjlsB9WoH +txa2bkp/AgMBAAGjQjBAMB0GA1UdDgQWBBQxw3kbuvVT1xfgiXotF2wKsyudMzAP +BgNVHRMECDAGAQH/AgEFMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC +AQEAlGRZrTlk5ynrE/5aw4sTV8gEJPB0d8Bg42f76Ymmg7+Wgnxu1MM9756Abrsp +tJh6sTtU6zkXR34ajgv8HzFZMQSyzhfzLMdiNlXiItiJVbSYSKpk+tYcNthEeFpa +IzpXl/V6ME+un2pMSyuOoAPjPuCp1NJ70rOo4nI8rZ7/gFnkm0W09juwzTkZmDLl +6iFhkOQxIY40sfcvNUqFENrnijchvllj4PKFiDFT1FQUhXB59C4Gdyd1Lx+4ivn+ +xbrYNuSD7Odlt79jWvNGr4GUN9RBjNYj1h7P9WgbRGOiWrqnNVmh5XAFmw4jV5mU +Cm26OWMohpLzGITY+9HPBVZkVw== +-----END CERTIFICATE----- + +-----BEGIN CERTIFICATE----- +MIIEFTCCA36gAwIBAgIBADANBgkqhkiG9w0BAQQFADCBvjELMAkGA1UEBhMCVVMx +EDAOBgNVBAgTB0luZGlhbmExFTATBgNVBAcTDEluZGlhbmFwb2xpczEoMCYGA1UE +ChMfU29mdHdhcmUgaW4gdGhlIFB1YmxpYyBJbnRlcmVzdDETMBEGA1UECxMKaG9z +dG1hc3RlcjEgMB4GA1UEAxMXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxJTAjBgkq +hkiG9w0BCQEWFmhvc3RtYXN0ZXJAc3BpLWluYy5vcmcwHhcNMDMwMTE1MTYyOTE3 +WhcNMDcwMTE0MTYyOTE3WjCBvjELMAkGA1UEBhMCVVMxEDAOBgNVBAgTB0luZGlh +bmExFTATBgNVBAcTDEluZGlhbmFwb2xpczEoMCYGA1UEChMfU29mdHdhcmUgaW4g +dGhlIFB1YmxpYyBJbnRlcmVzdDETMBEGA1UECxMKaG9zdG1hc3RlcjEgMB4GA1UE +AxMXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxJTAjBgkqhkiG9w0BCQEWFmhvc3Rt +YXN0ZXJAc3BpLWluYy5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAPB6 +rdoiLR3RodtM22LMcfwfqb5OrJNl7fwmvskgF7yP6sdD2bOfDIXhg9852jhY8/kL +VOFe1ELAL2OyN4RAxk0rliZQVgeTgqvgkOVIBbNwgnjN6mqtuWzFiPL+NXQExq40 +I3whM+4lEiwSHaV+MYxWanMdhc+kImT50LKfkxcdAgMBAAGjggEfMIIBGzAdBgNV +HQ4EFgQUB63oQR1/vda/G4F6P4xLiN4E0vowgesGA1UdIwSB4zCB4IAUB63oQR1/ +vda/G4F6P4xLiN4E0vqhgcSkgcEwgb4xCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdJ +bmRpYW5hMRUwEwYDVQQHEwxJbmRpYW5hcG9saXMxKDAmBgNVBAoTH1NvZnR3YXJl +IGluIHRoZSBQdWJsaWMgSW50ZXJlc3QxEzARBgNVBAsTCmhvc3RtYXN0ZXIxIDAe +BgNVBAMTF0NlcnRpZmljYXRpb24gQXV0aG9yaXR5MSUwIwYJKoZIhvcNAQkBFhZo +b3N0bWFzdGVyQHNwaS1pbmMub3JnggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcN +AQEEBQADgYEAm/Abn8c2y1nO3fgpAIslxvi9iNBZDhQtJ0VQZY6wgSfANyDOR4DW +iexO/AlorB49KnkFS7TjCAoLOZhcg5FaNiKnlstMI5krQmau1Qnb/vGSNsE/UGms +1ts+QYPUs0KmGEAFUri2XzLy+aQo9Kw74VBvqnxvaaMeY5yMcKNOieY= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIIDjCCBfagAwIBAgIJAOiOtsn4KhQoMA0GCSqGSIb3DQEBBQUAMIG8MQswCQYD +VQQGEwJVUzEQMA4GA1UECBMHSW5kaWFuYTEVMBMGA1UEBxMMSW5kaWFuYXBvbGlz +MSgwJgYDVQQKEx9Tb2Z0d2FyZSBpbiB0aGUgUHVibGljIEludGVyZXN0MRMwEQYD +VQQLEwpob3N0bWFzdGVyMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkx +JTAjBgkqhkiG9w0BCQEWFmhvc3RtYXN0ZXJAc3BpLWluYy5vcmcwHhcNMDgwNTEz +MDgwNzU2WhcNMTgwNTExMDgwNzU2WjCBvDELMAkGA1UEBhMCVVMxEDAOBgNVBAgT +B0luZGlhbmExFTATBgNVBAcTDEluZGlhbmFwb2xpczEoMCYGA1UEChMfU29mdHdh +cmUgaW4gdGhlIFB1YmxpYyBJbnRlcmVzdDETMBEGA1UECxMKaG9zdG1hc3RlcjEe +MBwGA1UEAxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSUwIwYJKoZIhvcNAQkBFhZo +b3N0bWFzdGVyQHNwaS1pbmMub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC +CgKCAgEA3DbmR0LCxFF1KYdAw9iOIQbSGE7r7yC9kDyFEBOMKVuUY/b0LfEGQpG5 +GcRCaQi/izZF6igFM0lIoCdDkzWKQdh4s/Dvs24t3dHLfer0dSbTPpA67tfnLAS1 +fOH1fMVO73e9XKKTM5LOfYFIz2u1IiwIg/3T1c87Lf21SZBb9q1NE8re06adU1Fx +Y0b4ShZcmO4tbZoWoXaQ4mBDmdaJ1mwuepiyCwMs43pPx93jzONKao15Uvr0wa8u +jyoIyxspgpJyQ7zOiKmqp4pRQ1WFmjcDeJPI8L20QcgHQprLNZd6ioFl3h1UCAHx +ZFy3FxpRvB7DWYd2GBaY7r/2Z4GLBjXFS21ZGcfSxki+bhQog0oQnBv1b7ypjvVp +/rLBVcznFMn5WxRTUQfqzj3kTygfPGEJ1zPSbqdu1McTCW9rXRTunYkbpWry9vjQ +co7qch8vNGopCsUK7BxAhRL3pqXTT63AhYxMfHMgzFMY8bJYTAH1v+pk1Vw5xc5s +zFNaVrpBDyXfa1C2x4qgvQLCxTtVpbJkIoRRKFauMe5e+wsWTUYFkYBE7axt8Feo ++uthSKDLG7Mfjs3FIXcDhB78rKNDCGOM7fkn77SwXWfWT+3Qiz5dW8mRvZYChD3F +TbxCP3T9PF2sXEg2XocxLxhsxGjuoYvJWdAY4wCAs1QnLpnwFVMCAwEAAaOCAg8w +ggILMB0GA1UdDgQWBBQ0cdE41xU2g0dr1zdkQjuOjVKdqzCB8QYDVR0jBIHpMIHm +gBQ0cdE41xU2g0dr1zdkQjuOjVKdq6GBwqSBvzCBvDELMAkGA1UEBhMCVVMxEDAO +BgNVBAgTB0luZGlhbmExFTATBgNVBAcTDEluZGlhbmFwb2xpczEoMCYGA1UEChMf +U29mdHdhcmUgaW4gdGhlIFB1YmxpYyBJbnRlcmVzdDETMBEGA1UECxMKaG9zdG1h +c3RlcjEeMBwGA1UEAxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSUwIwYJKoZIhvcN +AQkBFhZob3N0bWFzdGVyQHNwaS1pbmMub3JnggkA6I62yfgqFCgwDwYDVR0TAQH/ +BAUwAwEB/zARBglghkgBhvhCAQEEBAMCAAcwCQYDVR0SBAIwADAuBglghkgBhvhC +AQ0EIRYfU29mdHdhcmUgaW4gdGhlIFB1YmxpYyBJbnRlcmVzdDAwBglghkgBhvhC +AQQEIxYhaHR0cHM6Ly9jYS5zcGktaW5jLm9yZy9jYS1jcmwucGVtMDIGCWCGSAGG ++EIBAwQlFiNodHRwczovL2NhLnNwaS1pbmMub3JnL2NlcnQtY3JsLnBlbTAhBgNV +HREEGjAYgRZob3N0bWFzdGVyQHNwaS1pbmMub3JnMA4GA1UdDwEB/wQEAwIBBjAN +BgkqhkiG9w0BAQUFAAOCAgEAtM294LnqsgMrfjLp3nI/yUuCXp3ir1UJogxU6M8Y +PCggHam7AwIvUjki+RfPrWeQswN/2BXja367m1YBrzXU2rnHZxeb1NUON7MgQS4M +AcRb+WU+wmHo0vBqlXDDxm/VNaSsWXLhid+hoJ0kvSl56WEq2dMeyUakCHhBknIP +qxR17QnwovBc78MKYiC3wihmrkwvLo9FYyaW8O4x5otVm6o6+YI5HYg84gd1GuEP +sTC8cTLSOv76oYnzQyzWcsR5pxVIBcDYLXIC48s9Fmq6ybgREOJJhcyWR2AFJS7v +dVkz9UcZFu/abF8HyKZQth3LZjQl/GaD68W2MEH4RkRiqMEMVObqTFoo5q7Gt/5/ +O5aoLu7HaD7dAD0prypjq1/uSSotxdz70cbT0ZdWUoa2lOvUYFG3/B6bzAKb1B+P ++UqPti4oOxfMxaYF49LTtcYDyeFIQpvLP+QX4P4NAZUJurgNceQJcHdC2E3hQqlg +g9cXiUPS1N2nGLar1CQlh7XU4vwuImm9rWgs/3K1mKoGnOcqarihk3bOsPN/nOHg +T7jYhkalMwIsJWE3KpLIrIF0aGOHM3a9BX9e1dUCbb2v/ypaqknsmHlHU5H2DjRa +yaXG67Ljxay2oHA1u8hRadDytaIybrw/oDc5fHE2pgXfDBLkFqfF1stjo5VwP+YE +o2A= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDvjCCA3ygAwIBAgIFJQaThoEwCwYHKoZIzjgEAwUAMIGFMQswCQYDVQQGEwJG +UjEPMA0GA1UECBMGRnJhbmNlMQ4wDAYDVQQHEwVQYXJpczEQMA4GA1UEChMHUE0v +U0dETjEOMAwGA1UECxMFRENTU0kxDjAMBgNVBAMTBUlHQy9BMSMwIQYJKoZIhvcN +AQkBFhRpZ2NhQHNnZG4ucG0uZ291di5mcjAeFw0wMjEyMTMxNDM5MTVaFw0yMDEw +MTcxNDM5MTRaMIGFMQswCQYDVQQGEwJGUjEPMA0GA1UECBMGRnJhbmNlMQ4wDAYD +VQQHEwVQYXJpczEQMA4GA1UEChMHUE0vU0dETjEOMAwGA1UECxMFRENTU0kxDjAM +BgNVBAMTBUlHQy9BMSMwIQYJKoZIhvcNAQkBFhRpZ2NhQHNnZG4ucG0uZ291di5m +cjCCAbYwggErBgcqhkjOOAQBMIIBHgKBgQCFkMImdk9zDzJfTO4XPdAAmLbAdWws +ZiEMZh19RyTo3CyhFqO77OIXrwY6vc1pcc3MgWJ0dgQpAgrDMtmFFxpUu4gmjVsx +8GpxQC+4VOgLY8Cvmcd/UDzYg07EIRto8BwCpPJ/JfUxwzV2V3N713aAX+cEoKZ/ +s+kgxC6nZCA7oQIVALME/JYjkdW2uKIGngsEPbXAjdhDAoGADh/uqWJx94UBm31c +9d8ZTBfRGRnmSSRVFDgPWgA69JD4BR5da8tKz+1HjfMhDXljbMH86ixpD5Ka1Z0V +pRYUPbyAoB37tsmXMJY7kjyD19d5VdaZboUjVvhH6UJy5lpNNNGSvFl4fqkxyvw+ +pq1QV0N5RcvK120hlXdfHUX+YKYDgYQAAoGAQGr7IuKJcYIvJRMjxwl43KxXY2xC +aoCiM/bv117MfI94aNf1UusGhp7CbYAY9CXuL60P0oPMAajbaTE5Z34AuITeHq3Y +CNMHwxalip8BHqSSGmGiQsXeK7T+r1rPXsccZ1c5ikGDZ4xn5gUaCyy2rCmb+fOJ +6VAfCbAbAjmNKwejdzB1MA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgFGMBUG +A1UdIAQOMAwwCgYIKoF6AXkBAQEwHQYDVR0OBBYEFPkeNRcUf8idzpKblYbLNxs0 +MQhSMB8GA1UdIwQYMBaAFPkeNRcUf8idzpKblYbLNxs0MQhSMAsGByqGSM44BAMF +AAMvADAsAhRVh+CJA5eVyEYU5AO9Tm7GxX0rmQIUBCqsU5u1WxoZ5lEXicDX5/Ob +sRQ= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEAjCCAuqgAwIBAgIFORFFEJQwDQYJKoZIhvcNAQEFBQAwgYUxCzAJBgNVBAYT +AkZSMQ8wDQYDVQQIEwZGcmFuY2UxDjAMBgNVBAcTBVBhcmlzMRAwDgYDVQQKEwdQ +TS9TR0ROMQ4wDAYDVQQLEwVEQ1NTSTEOMAwGA1UEAxMFSUdDL0ExIzAhBgkqhkiG +9w0BCQEWFGlnY2FAc2dkbi5wbS5nb3V2LmZyMB4XDTAyMTIxMzE0MjkyM1oXDTIw +MTAxNzE0MjkyMlowgYUxCzAJBgNVBAYTAkZSMQ8wDQYDVQQIEwZGcmFuY2UxDjAM +BgNVBAcTBVBhcmlzMRAwDgYDVQQKEwdQTS9TR0ROMQ4wDAYDVQQLEwVEQ1NTSTEO +MAwGA1UEAxMFSUdDL0ExIzAhBgkqhkiG9w0BCQEWFGlnY2FAc2dkbi5wbS5nb3V2 +LmZyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsh/R0GLFMzvABIaI +s9z4iPf930Pfeo2aSVz2TqrMHLmh6yeJ8kbpO0px1R2OLc/mratjUMdUC24SyZA2 +xtgv2pGqaMVy/hcKshd+ebUyiHDKcMCWSo7kVc0dJ5S/znIq7Fz5cyD+vfcuiWe4 +u0dzEvfRNWk68gq5rv9GQkaiv6GFGvm/5P9JhfejcIYyHF2fYPepraX/z9E0+X1b +F8bc1g4oa8Ld8fUzaJ1O/Id8NhLWo4DoQw1VYZTqZDdH6nfK0LJYBcNdfrGoRpAx +Vs5wKpayMLh35nnAvSk7/ZR3TL0gzUEl4C7HG7vupARB0l2tEmqKm0f7yd1GQOGd +PDPQtQIDAQABo3cwdTAPBgNVHRMBAf8EBTADAQH/MAsGA1UdDwQEAwIBRjAVBgNV +HSAEDjAMMAoGCCqBegF5AQEBMB0GA1UdDgQWBBSjBS8YYFDCiQrdKyFP/45OqDAx +NjAfBgNVHSMEGDAWgBSjBS8YYFDCiQrdKyFP/45OqDAxNjANBgkqhkiG9w0BAQUF +AAOCAQEABdwm2Pp3FURo/C9mOnTgXeQp/wYHE4RKq89toB9RlPhJy3Q2FLwV3duJ +L92PoF189RLrn544pEfMs5bZvpwlqwN+Mw+VgQ39FuCIvjfwbF3QMZsyK10XZZOY +YLxuj7GoPB7ZHPOpJkL5ZB3C55L29B5aqhlSXa/oovdgoPaN8In1buAKBQGVyYsg +Crpa/JosPL3Dt8ldeCUFP1YUmwza+zpI/pdpXsoQhvdOlgQITeywvl3cO45Pwf2a +NjSaTFR+FwNIlQgRHAdvhQh+XU3Endv7rs6y0bO4g2wdsrN58dhwmX7wEwLOXt1R +0982gaEbeC9xs/FZTEYYKKuF0mBWWg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIHPTCCBSWgAwIBAgIBADANBgkqhkiG9w0BAQQFADB5MRAwDgYDVQQKEwdSb290 +IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB +IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA +Y2FjZXJ0Lm9yZzAeFw0wMzAzMzAxMjI5NDlaFw0zMzAzMjkxMjI5NDlaMHkxEDAO +BgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEi +MCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJ +ARYSc3VwcG9ydEBjYWNlcnQub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC +CgKCAgEAziLA4kZ97DYoB1CW8qAzQIxL8TtmPzHlawI229Z89vGIj053NgVBlfkJ +8BLPRoZzYLdufujAWGSuzbCtRRcMY/pnCujW0r8+55jE8Ez64AO7NV1sId6eINm6 +zWYyN3L69wj1x81YyY7nDl7qPv4coRQKFWyGhFtkZip6qUtTefWIonvuLwphK42y +fk1WpRPs6tqSnqxEQR5YYGUFZvjARL3LlPdCfgv3ZWiYUQXw8wWRBB0bF4LsyFe7 +w2t6iPGwcswlWyCR7BYCEo8y6RcYSNDHBS4CMEK4JZwFaz+qOqfrU0j36NK2B5jc +G8Y0f3/JHIJ6BVgrCFvzOKKrF11myZjXnhCLotLddJr3cQxyYN/Nb5gznZY0dj4k +epKwDpUeb+agRThHqtdB7Uq3EvbXG4OKDy7YCbZZ16oE/9KTfWgu3YtLq1i6L43q +laegw1SJpfvbi1EinbLDvhG+LJGGi5Z4rSDTii8aP8bQUWWHIbEZAWV/RRyH9XzQ +QUxPKZgh/TMfdQwEUfoZd9vUFBzugcMd9Zi3aQaRIt0AUMyBMawSB3s42mhb5ivU +fslfrejrckzzAeVLIL+aplfKkQABi6F1ITe1Yw1nPkZPcCBnzsXWWdsC4PDSy826 +YreQQejdIOQpvGQpQsgi3Hia/0PsmBsJUUtaWsJx8cTLc6nloQsCAwEAAaOCAc4w +ggHKMB0GA1UdDgQWBBQWtTIb1Mfz4OaO873SsDrusjkY0TCBowYDVR0jBIGbMIGY +gBQWtTIb1Mfz4OaO873SsDrusjkY0aF9pHsweTEQMA4GA1UEChMHUm9vdCBDQTEe +MBwGA1UECxMVaHR0cDovL3d3dy5jYWNlcnQub3JnMSIwIAYDVQQDExlDQSBDZXJ0 +IFNpZ25pbmcgQXV0aG9yaXR5MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QGNhY2Vy +dC5vcmeCAQAwDwYDVR0TAQH/BAUwAwEB/zAyBgNVHR8EKzApMCegJaAjhiFodHRw +czovL3d3dy5jYWNlcnQub3JnL3Jldm9rZS5jcmwwMAYJYIZIAYb4QgEEBCMWIWh0 +dHBzOi8vd3d3LmNhY2VydC5vcmcvcmV2b2tlLmNybDA0BglghkgBhvhCAQgEJxYl +aHR0cDovL3d3dy5jYWNlcnQub3JnL2luZGV4LnBocD9pZD0xMDBWBglghkgBhvhC +AQ0ESRZHVG8gZ2V0IHlvdXIgb3duIGNlcnRpZmljYXRlIGZvciBGUkVFIGhlYWQg +b3ZlciB0byBodHRwOi8vd3d3LmNhY2VydC5vcmcwDQYJKoZIhvcNAQEEBQADggIB +ACjH7pyCArpcgBLKNQodgW+JapnM8mgPf6fhjViVPr3yBsOQWqy1YPaZQwGjiHCc +nWKdpIevZ1gNMDY75q1I08t0AoZxPuIrA2jxNGJARjtT6ij0rPtmlVOKTV39O9lg +18p5aTuxZZKmxoGCXJzN600BiqXfEVWqFcofN8CCmHBh22p8lqOOLlQ+TyGpkO/c +gr/c6EWtTZBzCDyUZbAEmXZ/4rzCahWqlwQ3JNgelE5tDlG+1sSPypZt90Pf6DBl +Jzt7u0NDY8RD97LsaMzhGY4i+5jhe1o+ATc7iwiwovOVThrLm82asduycPAtStvY +sONvRUgzEv/+PDIqVPfE94rwiCPCR/5kenHA0R6mY7AHfqQv0wGP3J8rtsYIqQ+T +SCX8Ev2fQtzzxD72V7DX3WnRBnc0CkvSyqD/HMaMyRa+xMwyN2hzXwj7UfdJUzYF +CpUCTPJ5GhD22Dp1nPMd8aINcGeGG7MW9S/lpOt5hvk9C8JzC6WZrG/8Z7jlLwum +GCSNe9FINSkYQKyTYOGWhlC0elnYjyELn8+CkcY7v2vcB5G5l1YjqrZslMZIBjzk +zk6q5PYvCdxTby78dOs6Y5nCpqyJvKeyRKANihDjbPIky/qbn3BHLt4Ui9SyIAmW +omTxJBzcoTWcFbLUvFUufQb1nA5V9FrWk9p2rSVzTMVD +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGCDCCA/CgAwIBAgIBATANBgkqhkiG9w0BAQQFADB5MRAwDgYDVQQKEwdSb290 +IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB +IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA +Y2FjZXJ0Lm9yZzAeFw0wNTEwMTQwNzM2NTVaFw0zMzAzMjgwNzM2NTVaMFQxFDAS +BgNVBAoTC0NBY2VydCBJbmMuMR4wHAYDVQQLExVodHRwOi8vd3d3LkNBY2VydC5v +cmcxHDAaBgNVBAMTE0NBY2VydCBDbGFzcyAzIFJvb3QwggIiMA0GCSqGSIb3DQEB +AQUAA4ICDwAwggIKAoICAQCrSTURSHzSJn5TlM9Dqd0o10Iqi/OHeBlYfA+e2ol9 +4fvrcpANdKGWZKufoCSZc9riVXbHF3v1BKxGuMO+f2SNEGwk82GcwPKQ+lHm9WkB +Y8MPVuJKQs/iRIwlKKjFeQl9RrmK8+nzNCkIReQcn8uUBByBqBSzmGXEQ+xOgo0J +0b2qW42S0OzekMV/CsLj6+YxWl50PpczWejDAz1gM7/30W9HxM3uYoNSbi4ImqTZ +FRiRpoWSR7CuSOtttyHshRpocjWr//AQXcD0lKdq1TuSfkyQBX6TwSyLpI5idBVx +bgtxA+qvFTia1NIFcm+M+SvrWnIl+TlG43IbPgTDZCciECqKT1inA62+tC4T7V2q +SNfVfdQqe1z6RgRQ5MwOQluM7dvyz/yWk+DbETZUYjQ4jwxgmzuXVjit89Jbi6Bb +6k6WuHzX1aCGcEDTkSm3ojyt9Yy7zxqSiuQ0e8DYbF/pCsLDpyCaWt8sXVJcukfV +m+8kKHA4IC/VfynAskEDaJLM4JzMl0tF7zoQCqtwOpiVcK01seqFK6QcgCExqa5g +eoAmSAC4AcCTY1UikTxW56/bOiXzjzFU6iaLgVn5odFTEcV7nQP2dBHgbbEsPyyG +kZlxmqZ3izRg0RS0LKydr4wQ05/EavhvE/xzWfdmQnQeiuP43NJvmJzLR5iVQAX7 +6QIDAQABo4G/MIG8MA8GA1UdEwEB/wQFMAMBAf8wXQYIKwYBBQUHAQEEUTBPMCMG +CCsGAQUFBzABhhdodHRwOi8vb2NzcC5DQWNlcnQub3JnLzAoBggrBgEFBQcwAoYc +aHR0cDovL3d3dy5DQWNlcnQub3JnL2NhLmNydDBKBgNVHSAEQzBBMD8GCCsGAQQB +gZBKMDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuQ0FjZXJ0Lm9yZy9pbmRleC5w +aHA/aWQ9MTAwDQYJKoZIhvcNAQEEBQADggIBAH8IiKHaGlBJ2on7oQhy84r3HsQ6 +tHlbIDCxRd7CXdNlafHCXVRUPIVfuXtCkcKZ/RtRm6tGpaEQU55tiKxzbiwzpvD0 +nuB1wT6IRanhZkP+VlrRekF490DaSjrxC1uluxYG5sLnk7mFTZdPsR44Q4Dvmw2M +77inYACHV30eRBzLI++bPJmdr7UpHEV5FpZNJ23xHGzDwlVks7wU4vOkHx4y/CcV +Bc/dLq4+gmF78CEQGPZE6lM5+dzQmiDgxrvgu1pPxJnIB721vaLbLmINQjRBvP+L +ivVRIqqIMADisNS8vmW61QNXeZvo3MhN+FDtkaVSKKKs+zZYPumUK5FQhxvWXtaM +zPcPEAxSTtAWYeXlCmy/F8dyRlecmPVsYGN6b165Ti/Iubm7aoW8mA3t+T6XhDSU +rgCvoeXnkm5OvfPi2RSLXNLrAWygF6UtEOucekq9ve7O/e0iQKtwOIj1CodqwqsF +YMlIBdpTwd5Ed2qz8zw87YC8pjhKKSRf/lk7myV6VmMAZLldpGJ9VzZPrYPvH5JT +oI53V93lYRE9IwCQTDz6o2CTBKOvNfYOao9PSmCnhQVsRqGP9Md246FZV/dxssRu +FFxtbUFm3xuTsdQAw+7Lzzw9IYCpX2Nl/N3gX6T0K/CFcUHUZyX7GrGXrtaZghNB +0m6lG5kngOcLqagA +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICiTCCAg+gAwIBAgIQH0evqmIAcFBUTAGem2OZKjAKBggqhkjOPQQDAzCBhTEL +MAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE +BxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMT +IkNPTU9ETyBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDgwMzA2MDAw +MDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdy +ZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09N +T0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBFQ0MgQ2VydGlmaWNhdGlv +biBBdXRob3JpdHkwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQDR3svdcmCFYX7deSR +FtSrYpn1PlILBs5BAH+X4QokPB0BBO490o0JlwzgdeT6+3eKKvUDYEs2ixYjFq0J +cfRK9ChQtP6IHG4/bC8vCVlbpVsLM5niwz2J+Wos77LTBumjQjBAMB0GA1UdDgQW +BBR1cacZSBm8nZ3qQUfflMRId5nTeTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/ +BAUwAwEB/zAKBggqhkjOPQQDAwNoADBlAjEA7wNbeqy3eApyt4jf/7VGFAkK+qDm +fQjGGoe9GKhzvSbKYAydzpmfz1wPMOG+FDHqAjAU9JM8SaczepBGR7NjfRObTrdv +GDeAU/7dIOA1mjbRxwG55tzd8/8dLDoWV9mSOdY= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFijCCA3KgAwIBAgIQDHbanJEMTiye/hXQWJM8TDANBgkqhkiG9w0BAQUFADBf +MQswCQYDVQQGEwJOTDESMBAGA1UEChMJRGlnaU5vdGFyMRowGAYDVQQDExFEaWdp +Tm90YXIgUm9vdCBDQTEgMB4GCSqGSIb3DQEJARYRaW5mb0BkaWdpbm90YXIubmww +HhcNMDcwNTE2MTcxOTM2WhcNMjUwMzMxMTgxOTIxWjBfMQswCQYDVQQGEwJOTDES +MBAGA1UEChMJRGlnaU5vdGFyMRowGAYDVQQDExFEaWdpTm90YXIgUm9vdCBDQTEg +MB4GCSqGSIb3DQEJARYRaW5mb0BkaWdpbm90YXIubmwwggIiMA0GCSqGSIb3DQEB +AQUAA4ICDwAwggIKAoICAQCssFjBAL3YIQgLK5r+blYwBZ8bd5AQQVzDDYcRd46B +8cp86Yxq7Th0Nbva3/m7wAk3tJZzgX0zGpg595NvlX89ubF1h7pRSOiLcD6VBMXY +tsMW2YiwsYcdcNqGtA8Ui3rPENF0NqISe3eGSnnme98CEWilToauNFibJBN4ViIl +HgGLS1Fx+4LMWZZpiFpoU8W5DQI3y0u8ZkqQfioLBQftFl9VkHXYRskbg+IIvvEj +zJkd1ioPgyAVWCeCLvriIsJJsbkBgWqdbZ1Ad2h2TiEqbYRAhU52mXyC8/O3AlnU +JgEbjt+tUwbRrhjd4rI6y9eIOI6sWym5GdOY+RgDz0iChmYLG2kPyes4iHomGgVM +ktck1JbyrFIto0fVUvY//s6EBnCmqj6i8rZWNBhXouSBbefK8GrTx5FrAoNBfBXv +a5pkXuPQPOWx63tdhvvL5ndJzaNl3Pe5nLjkC1+Tz8wwGjIczhxjlaX56uF0i57p +K6kwe6AYHw4YC+VbqdPRbB4HZ4+RS6mKvNJmqpMBiLKR+jFc1abBUggJzQpjotMi +puih2TkGl/VujQKQjBR7P4DNG5y6xFhyI6+2Vp/GekIzKQc/gsnmHwUNzUwoNovT +yD4cxojvXu6JZOkd69qJfjKmadHdzIif0dDJZiHcBmfFlHqabWJMfczgZICynkeO +owIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNV +HQ4EFgQUiGi/4I41xDs4a2L3KDuEgcgM100wDQYJKoZIhvcNAQEFBQADggIBADsC +jcs8MOhuoK3yc7NfniUTBAXT9uOLuwt5zlPe5JbF0a9zvNXD0EBVfEB/zRtfCdXy +fJ9oHbtdzno5wozWmHvFg1Wo1X1AyuAe94leY12hE8JdiraKfADzI8PthV9xdvBo +Y6pFITlIYXg23PFDk9Qlx/KAZeFTAnVR/Ho67zerhChXDNjU1JlWbOOi/lmEtDHo +M/hklJRRl6s5xUvt2t2AC298KQ3EjopyDedTFLJgQT2EkTFoPSdE2+Xe9PpjRchM +Ppj1P0G6Tss3DbpmmPHdy59c91Q2gmssvBNhl0L4eLvMyKKfyvBovWsdst+Nbwed +2o5nx0ceyrm/KkKRt2NTZvFCo+H0Wk1Ya7XkpDOtXHAd3ODy63MUkZoDweoAZbwH +/M8SESIsrqC9OuCiKthZ6SnTGDWkrBFfGbW1G/8iSlzGeuQX7yCpp/Q/rYqnmgQl +nQ7KN+ZQ/YxCKQSa7LnPS3K94gg2ryMvYuXKAdNw23yCIywWMQzGNgeQerEfZ1jE +O1hZibCMjFCz2IbLaKPECudpSyDOwR5WS5WpI2jYMNjD67BVUc3l/Su49bsRn1NU +9jQZjHkJNsphFyUXC4KYcwx3dMPVDceoEkzHp1RxRy4sGn3J4ys7SN4nhKdjNrN9 +j6BkOSQNPXuHr2ZcdBtLc7LljPCGmbjlxd+Ewbfr +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIID5jCCAs6gAwIBAgIQV8szb8JcFuZHFhfjkDFo4DANBgkqhkiG9w0BAQUFADBi +MQswCQYDVQQGEwJVUzEhMB8GA1UEChMYTmV0d29yayBTb2x1dGlvbnMgTC5MLkMu +MTAwLgYDVQQDEydOZXR3b3JrIFNvbHV0aW9ucyBDZXJ0aWZpY2F0ZSBBdXRob3Jp +dHkwHhcNMDYxMjAxMDAwMDAwWhcNMjkxMjMxMjM1OTU5WjBiMQswCQYDVQQGEwJV +UzEhMB8GA1UEChMYTmV0d29yayBTb2x1dGlvbnMgTC5MLkMuMTAwLgYDVQQDEydO +ZXR3b3JrIFNvbHV0aW9ucyBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwggEiMA0GCSqG +SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkvH6SMG3G2I4rC7xGzuAnlt7e+foS0zwz +c7MEL7xxjOWftiJgPl9dzgn/ggwbmlFQGiaJ3dVhXRncEg8tCqJDXRfQNJIg6nPP +OCwGJgl6cvf6UDL4wpPTaaIjzkGxzOTVHzbRijr4jGPiFFlp7Q3Tf2vouAPlT2rl +mGNpSAW+Lv8ztumXWWn4Zxmuk2GWRBXTcrA/vGp97Eh/jcOrqnErU2lBUzS1sLnF +BgrEsEX1QV1uiUV7PTsmjHTC5dLRfbIR1PtYMiKagMnc/Qzpf14Dl847ABSHJ3A4 +qY5usyd2mFHgBeMhqxrVhSI8KbWaFsWAqPS7azCPL0YCorEMIuDTAgMBAAGjgZcw +gZQwHQYDVR0OBBYEFCEwyfsA106Y2oeqKtCnLrFAMadMMA4GA1UdDwEB/wQEAwIB +BjAPBgNVHRMBAf8EBTADAQH/MFIGA1UdHwRLMEkwR6BFoEOGQWh0dHA6Ly9jcmwu +bmV0c29sc3NsLmNvbS9OZXR3b3JrU29sdXRpb25zQ2VydGlmaWNhdGVBdXRob3Jp +dHkuY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8 +6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/ +h1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH +/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv +wKeI8lN3s2Berq4o2jUsbzRF0ybh3uxbTydrFny9RAQYgrOJeRcQcT16ohZO9QHN +pGxlaKFJdlxDydi8NmdspZS11My5vWo1ViHe2MPr+8ukYEywVaCge1ey +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEvTCCA6WgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBhTELMAkGA1UEBhMCVVMx +IDAeBgNVBAoMF1dlbGxzIEZhcmdvIFdlbGxzU2VjdXJlMRwwGgYDVQQLDBNXZWxs +cyBGYXJnbyBCYW5rIE5BMTYwNAYDVQQDDC1XZWxsc1NlY3VyZSBQdWJsaWMgUm9v +dCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDcxMjEzMTcwNzU0WhcNMjIxMjE0 +MDAwNzU0WjCBhTELMAkGA1UEBhMCVVMxIDAeBgNVBAoMF1dlbGxzIEZhcmdvIFdl +bGxzU2VjdXJlMRwwGgYDVQQLDBNXZWxscyBGYXJnbyBCYW5rIE5BMTYwNAYDVQQD +DC1XZWxsc1NlY3VyZSBQdWJsaWMgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkw +ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDub7S9eeKPCCGeOARBJe+r +WxxTkqxtnt3CxC5FlAM1iGd0V+PfjLindo8796jE2yljDpFoNoqXjopxaAkH5OjU +Dk/41itMpBb570OYj7OeUt9tkTmPOL13i0Nj67eT/DBMHAGTthP796EfvyXhdDcs +HqRePGj4S78NuR4uNuip5Kf4D8uCdXw1LSLWwr8L87T8bJVhHlfXBIEyg1J55oNj +z7fLY4sR4r1e6/aN7ZVyKLSsEmLpSjPmgzKuBXWVvYSV2ypcm44uDLiBK0HmOFaf +SZtsdvqKXfcBeYF8wYNABf5x/Qw/zE5gCQ5lRxAvAcAFP4/4s0HvWkJ+We/Slwxl +AgMBAAGjggE0MIIBMDAPBgNVHRMBAf8EBTADAQH/MDkGA1UdHwQyMDAwLqAsoCqG +KGh0dHA6Ly9jcmwucGtpLndlbGxzZmFyZ28uY29tL3dzcHJjYS5jcmwwDgYDVR0P +AQH/BAQDAgHGMB0GA1UdDgQWBBQmlRkQ2eihl5H/3BnZtQQ+0nMKajCBsgYDVR0j +BIGqMIGngBQmlRkQ2eihl5H/3BnZtQQ+0nMKaqGBi6SBiDCBhTELMAkGA1UEBhMC +VVMxIDAeBgNVBAoMF1dlbGxzIEZhcmdvIFdlbGxzU2VjdXJlMRwwGgYDVQQLDBNX +ZWxscyBGYXJnbyBCYW5rIE5BMTYwNAYDVQQDDC1XZWxsc1NlY3VyZSBQdWJsaWMg +Um9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHmCAQEwDQYJKoZIhvcNAQEFBQADggEB +ALkVsUSRzCPIK0134/iaeycNzXK7mQDKfGYZUMbVmO2rvwNa5U3lHshPcZeG1eMd +/ZDJPHV3V3p9+N701NX3leZ0bh08rnyd2wIDBSxxSyU+B+NemvVmFymIGjifz6pB +A4SXa5M4esowRBskRDPQ5NHcKDj0E0M1NSljqHyita04pO2t/caaH/+Xc/77szWn +k4bGdpEA5qxRFsQnMlzbc9qlk1eOPm01JghZ1edE13YgY+esE2fDbbFwRnzVlhE9 +iW9dqKHrjQrawx0zbKPqZxmamX9LPYNRKh3KL4YMon4QLSvUFpULB6ouFJJJtylv +2G0xffX8oRAHh84vWdw+WNs= -----END CERTIFICATE----- diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 9712402c70..a2887b8eee 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -572,17 +572,6 @@ static int cert_tests(void) SSL_CTX *ssl_ctx; uint8_t *buf; - ssl_ctx = ssl_ctx_new(0, 0); - if (ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CACERT, - "../ssl/test/ca-bundle.crt", NULL)) - { - printf("Cert #10\n"); - goto bad_cert; - } - - ssl_ctx_free(ssl_ctx); - exit(0); - /* check a bunch of 3rd party certificates */ ssl_ctx = ssl_ctx_new(0, 0); len = get_file("../ssl/test/microsoft.x509_ca", &buf); @@ -706,7 +695,17 @@ static int cert_tests(void) x509_free(x509_ctx); free(buf); - res = 0; /* all ok */ + ssl_ctx = ssl_ctx_new(0, 0); + if (ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CACERT, + "../ssl/test/ca-bundle.crt", NULL)) + { + printf("Cert #10\n"); + goto bad_cert; + } + + ssl_ctx_free(ssl_ctx); + +res = 0; /* all ok */ printf("All Certificate tests passed\n"); bad_cert: @@ -795,7 +794,7 @@ typedef struct static void do_client(client_t *clnt) { char openssl_buf[2048]; - usleep(500000); /* allow server to start */ + usleep(200000); /* allow server to start */ /* show the session ids in the reconnect test */ if (strcmp(clnt->testname, "Session Reuse") == 0) @@ -1332,7 +1331,7 @@ static int SSL_client_test( #endif } - usleep(500000); /* allow server to start */ + usleep(200000); /* allow server to start */ if (*ssl_ctx == NULL) { @@ -1443,7 +1442,7 @@ static int SSL_client_test( client_test_exit: ssl_free(ssl); SOCKET_CLOSE(client_fd); - usleep(500000); /* allow openssl to say something */ + usleep(200000); /* allow openssl to say something */ if (sess_resume) { @@ -1451,9 +1450,6 @@ static int SSL_client_test( { ssl_ctx_free(*ssl_ctx); *ssl_ctx = NULL; -#ifndef WIN32 - pthread_cancel(sess_resume->server_thread); -#endif } else if (sess_resume->start_server) { @@ -1466,9 +1462,6 @@ static int SSL_client_test( { ssl_ctx_free(*ssl_ctx); *ssl_ctx = NULL; -#ifndef WIN32 - pthread_cancel(thread); -#endif } if (ret == 0) @@ -1635,7 +1628,7 @@ static void do_basic(void) SSL *ssl_clnt; SSL_CTX *ssl_clnt_ctx = ssl_ctx_new( DEFAULT_CLNT_OPTION, SSL_DEFAULT_CLNT_SESS); - usleep(500000); /* allow server to start */ + usleep(200000); /* allow server to start */ if ((client_fd = client_socket_init(g_port)) < 0) goto error; @@ -1760,7 +1753,7 @@ void do_multi_clnt(multi_t *multi_data) if ((client_fd = client_socket_init(multi_data->port)) < 0) goto client_test_exit; - usleep(500000); + usleep(200000); ssl = ssl_client_new(multi_data->ssl_clnt_ctx, client_fd, NULL, 0); if ((res = ssl_handshake_status(ssl))) @@ -1937,7 +1930,7 @@ static int header_issue(void) size = fread(buf, 1, sizeof(buf), f); SOCKET_WRITE(client_fd, buf, size); - usleep(500000); + usleep(200000); ret = 0; error: diff --git a/ssl/tls1.c b/ssl/tls1.c index 84632020a8..dd4130f5a4 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -386,9 +386,8 @@ int add_cert(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) */ int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) { - int i = 0; - int offset; int ret = SSL_OK; /* ignore errors for now */ + int i = 0; CA_CERT_CTX *ca_cert_ctx; if (ssl_ctx->ca_cert_ctx == NULL) @@ -399,24 +398,26 @@ int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) while (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) i++; - if (i >= CONFIG_X509_MAX_CA_CERTS) + while (len > 0) { + int offset; + if (i >= CONFIG_X509_MAX_CA_CERTS) + { #ifdef CONFIG_SSL_FULL_MODE - printf("Error: maximum number of CA certs added - change of " - "compile-time configuration required\n"); + printf("Error: maximum number of CA certs added - change of " + "compile-time configuration required\n"); #endif - goto error; - } + break; + } - ret = x509_new(buf, &offset, &ca_cert_ctx->cert[i]); - len -= offset; - ret = SSL_OK; /* ok so far */ - /* recurse? */ - if (len > 0) - ret = add_cert_auth(ssl_ctx, &buf[offset], len); + /* ignore the return code */ + if (x509_new(buf, &offset, &ca_cert_ctx->cert[i]) == X509_OK) + i++; + + len -= offset; + } -error: return ret; } diff --git a/ssl/x509.c b/ssl/x509.c index c297ed67fc..185fd7591d 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -209,13 +209,15 @@ int x509_new(const uint8_t *cert, int *len, X509_CTX **ctx) ret = X509_OK; end_cert: -#ifdef CONFIG_SSL_FULL_MODE if (ret) { +#ifdef CONFIG_SSL_FULL_MODE printf("Error: Invalid X509 ASN.1 file (%s)\n", x509_display_error(ret)); - } #endif + x509_free(x509_ctx); + *ctx = NULL; + } return ret; } From ab9ddd16f59d5401a3c5c490585b5931c1af7e95 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 7 Jan 2011 13:09:50 +0000 Subject: [PATCH 160/301] Added support to v1.0 http (which apache's ab tool uses) git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@191 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/axhttp.h | 1 + httpd/proc.c | 19 +++++++++++++------ 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/httpd/axhttp.h b/httpd/axhttp.h index 961edeecf6..a741455b70 100644 --- a/httpd/axhttp.h +++ b/httpd/axhttp.h @@ -85,6 +85,7 @@ struct connstruct int numbytes; char databuf[BLOCKSIZE]; uint8_t is_ssl; + uint8_t is_v1_0; uint8_t close_when_done; time_t if_modified_since; diff --git a/httpd/proc.c b/httpd/proc.c index b9140cdc3b..b8ba55df63 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -103,7 +103,7 @@ static int procheadelem(struct connstruct *cn, char *buf) if ((delim = strchr(value, ' ')) == NULL) /* expect HTTP type */ return 0; - *delim = 0; + *delim++ = 0; urldecode(value); if (sanitizefile(value) == 0) @@ -118,6 +118,8 @@ static int procheadelem(struct connstruct *cn, char *buf) my_strncpy(cn->filereq, value, MAXREQUESTLENGTH); #endif cn->if_modified_since = -1; + if (strcmp(delim, "HTTP/1.0") == 0) /* v1.0 HTTP? */ + cn->is_v1_0 = 1; } else if (strcasecmp(buf, "Host:") == 0) { @@ -315,7 +317,7 @@ void procreadhead(struct connstruct *cn) rv = special_read(cn, buf, sizeof(buf)-1); if (rv <= 0) { - if (rv < 0) /* really dead? */ + if (rv < 0 || !cn->is_ssl) /* really dead? */ removeconnection(cn); return; } @@ -512,9 +514,14 @@ void procreadfile(struct connstruct *cn) if (cn->close_when_done) /* close immediately */ removeconnection(cn); else - { /* keep socket open - HTTP 1.1 */ - cn->state = STATE_WANT_TO_READ_HEAD; - cn->numbytes = 0; + { + if (cn->is_v1_0) /* die now */ + removeconnection(cn); + else /* keep socket open - HTTP 1.1 */ + { + cn->state = STATE_WANT_TO_READ_HEAD; + cn->numbytes = 0; + } } return; @@ -853,7 +860,7 @@ void read_post_data(struct connstruct *cn) rv = special_read(cn, buf, sizeof(buf)-1); if (rv <= 0) { - if (rv < 0) /* really dead? */ + if (rv < 0 || !cn->is_ssl) /* really dead? */ removeconnection(cn); return; } From 9e1cb29c54ad9559454ad9b4beee4ce9de73c99b Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 8 Jan 2011 03:44:47 +0000 Subject: [PATCH 161/301] Added comments to hmac and rc4 code and extra diagnotics to cert # out of bounds. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@192 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/hmac.c | 4 ++++ crypto/rc4.c | 2 +- ssl/tls1.c | 10 ++++++---- www/index.html | 2 +- 4 files changed, 12 insertions(+), 6 deletions(-) diff --git a/crypto/hmac.c b/crypto/hmac.c index 7670a9e583..24a04d77ae 100644 --- a/crypto/hmac.c +++ b/crypto/hmac.c @@ -30,6 +30,8 @@ /** * HMAC implementation - This code was originally taken from RFC2104 + * See http://www.ietf.org/rfc/rfc2104.txt and + * http://www.faqs.org/rfcs/rfc2202.html */ #include @@ -38,6 +40,7 @@ /** * Perform HMAC-MD5 + * NOTE: does not handle keys larger than the block size. */ void hmac_md5(const uint8_t *msg, int length, const uint8_t *key, int key_len, uint8_t *digest) @@ -70,6 +73,7 @@ void hmac_md5(const uint8_t *msg, int length, const uint8_t *key, /** * Perform HMAC-SHA1 + * NOTE: does not handle keys larger than the block size. */ void hmac_sha1(const uint8_t *msg, int length, const uint8_t *key, int key_len, uint8_t *digest) diff --git a/crypto/rc4.c b/crypto/rc4.c index ec8b24711b..12a121151d 100644 --- a/crypto/rc4.c +++ b/crypto/rc4.c @@ -67,12 +67,12 @@ void RC4_setup(RC4_CTX *ctx, const uint8_t *key, int length) /** * Perform the encrypt/decrypt operation (can use it for either since * this is a stream cipher). + * NOTE: *msg and *out must be the same pointer (performance tweak) */ void RC4_crypt(RC4_CTX *ctx, const uint8_t *msg, uint8_t *out, int length) { int i; uint8_t *m, x, y, a, b; - out = (uint8_t *)msg; x = ctx->x; y = ctx->y; diff --git a/ssl/tls1.c b/ssl/tls1.c index dd4130f5a4..6d86d8e77e 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -347,8 +347,9 @@ int add_cert(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) if (i == CONFIG_SSL_MAX_CERTS) /* too many certs */ { #ifdef CONFIG_SSL_FULL_MODE - printf("Error: maximum number of certs added - change of " - "compile-time configuration required\n"); + printf("Error: maximum number of certs added (%d) - change of " + "compile-time configuration required\n", + CONFIG_SSL_MAX_CERTS); #endif goto error; } @@ -404,8 +405,9 @@ int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) if (i >= CONFIG_X509_MAX_CA_CERTS) { #ifdef CONFIG_SSL_FULL_MODE - printf("Error: maximum number of CA certs added - change of " - "compile-time configuration required\n"); + printf("Error: maximum number of CA certs added (%d) - change of " + "compile-time configuration required\n", + CONFIG_X509_MAX_CA_CERTS); #endif break; } diff --git a/www/index.html b/www/index.html index aef580ae62..9a98eb3216 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to ehuman - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to ehuman - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 7ddde6ec6bde3708298cc0a1ec4e7a09f9923dbd Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 9 Jan 2011 22:19:05 +0000 Subject: [PATCH 162/301] Some fixes after scan-build. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@193 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/test/ssltest.c | 9 ++------- ssl/tls1_clnt.c | 7 +++++-- 2 files changed, 7 insertions(+), 9 deletions(-) diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index a2887b8eee..f26a881ef7 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -515,7 +515,6 @@ static int RSA_test(void) bigint *plaintext_bi; bigint *enc_data_bi, *dec_data_bi; uint8_t enc_data2[128], dec_data2[128]; - int size; int len; uint8_t *buf; @@ -546,7 +545,7 @@ static int RSA_test(void) } RSA_encrypt(rsa_ctx, (const uint8_t *)"abc", 3, enc_data2, 0); - size = RSA_decrypt(rsa_ctx, enc_data2, dec_data2, 1); + RSA_decrypt(rsa_ctx, enc_data2, dec_data2, 1); if (memcmp("abc", dec_data2, 3)) { printf("Error: ENCRYPT/DECRYPT #2 failed\n"); @@ -921,17 +920,14 @@ static int SSL_server_test( if (size == SSL_CLOSE_NOTIFY) { - ret = SSL_OK; + /* do nothing */ } else if (size < SSL_OK) /* got some alert or something nasty */ { ret = size; if (ret == SSL_ERROR_CONN_LOST) - { - ret = SSL_OK; continue; - } break; /* we've got a problem */ } @@ -1092,7 +1088,6 @@ int SSL_server_tests(void) printf("SSL server test \"%s\" passed\n", "Bad Before Cert"); TTY_FLUSH(); - ret = 0; /* is ok */ } /* this test should fail */ diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index 3fb7f627d5..cb1be7724f 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -51,7 +51,6 @@ EXP_FUNC SSL * STDCALL ssl_client_new(SSL_CTX *ssl_ctx, int client_fd, const uint8_t *session_id, uint8_t sess_id_size) { SSL *ssl; - int ret; SOCKET_BLOCK(client_fd); /* ensure blocking mode */ ssl = ssl_new(ssl_ctx, client_fd); @@ -70,7 +69,7 @@ EXP_FUNC SSL * STDCALL ssl_client_new(SSL_CTX *ssl_ctx, int client_fd, const } SET_SSL_FLAG(SSL_IS_CLIENT); - ret = do_client_connect(ssl); + do_client_connect(ssl); return ssl; } @@ -130,6 +129,10 @@ int do_clnt_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len) disposable_new(ssl); ret = do_client_connect(ssl); break; + + default: + ret = SSL_ERROR_INVALID_HANDSHAKE; + break; } return ret; From f2dabd56b755425e42cab2cd6599772e2253bbbb Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 14 Jan 2011 13:57:34 +0000 Subject: [PATCH 163/301] Allow non-blocked ssl_client_new() operation. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@194 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/ssl.h | 1 + ssl/tls1_clnt.c | 29 ++++++++++++++++------------- 2 files changed, 17 insertions(+), 13 deletions(-) diff --git a/ssl/ssl.h b/ssl/ssl.h index 009944046d..6778837f9e 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -82,6 +82,7 @@ extern "C" { #define SSL_DISPLAY_BYTES 0x00100000 #define SSL_DISPLAY_CERTS 0x00200000 #define SSL_DISPLAY_RSA 0x00400000 +#define SSL_CLIENT_NON_BLOCKING 0x00800000 /* errors that can be generated */ #define SSL_OK 0 diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index cb1be7724f..510126ab15 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -151,23 +151,26 @@ int do_client_connect(SSL *ssl) ssl->hs_status = SSL_NOT_OK; /* not connected */ /* sit in a loop until it all looks good */ - while (ssl->hs_status != SSL_OK) + if (!IS_SET_SSL_FLAG(SSL_CLIENT_NON_BLOCKING)) { - ret = basic_read(ssl, NULL); - - if (ret < SSL_OK) - { - if (ret != SSL_ERROR_CONN_LOST) - { - /* let the server know we are dying and why */ - if (send_alert(ssl, ret)) + while (ssl->hs_status != SSL_OK) + { + ret = basic_read(ssl, NULL); + + if (ret < SSL_OK) + { + if (ret != SSL_ERROR_CONN_LOST) { - /* something nasty happened, so get rid of it */ - kill_ssl_session(ssl->ssl_ctx->ssl_sessions, ssl); + /* let the server know we are dying and why */ + if (send_alert(ssl, ret)) + { + /* something nasty happened, so get rid of it */ + kill_ssl_session(ssl->ssl_ctx->ssl_sessions, ssl); + } } - } - break; + break; + } } } From e68581f0c21285ae3a720d10eba015c66678749c Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 14 Jan 2011 14:10:36 +0000 Subject: [PATCH 164/301] Small code factoring improvement to do_client_connect() git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@195 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/tls1_clnt.c | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-) diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index 510126ab15..f846ffdc94 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -155,22 +155,10 @@ int do_client_connect(SSL *ssl) { while (ssl->hs_status != SSL_OK) { - ret = basic_read(ssl, NULL); + ret = ssl_read(ssl, NULL); if (ret < SSL_OK) - { - if (ret != SSL_ERROR_CONN_LOST) - { - /* let the server know we are dying and why */ - if (send_alert(ssl, ret)) - { - /* something nasty happened, so get rid of it */ - kill_ssl_session(ssl->ssl_ctx->ssl_sessions, ssl); - } - } - break; - } } } From 529d87ba097764db4a30fda2d99be06dc38fc6cc Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 14 Jan 2011 23:25:33 +0000 Subject: [PATCH 165/301] Added Visual Studio 2010 support and fixed some VS compilation issues. Removed code to force blocking mode. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@196 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/Config.in | 10 +++++++++- config/makefile.conf | 9 +++++++-- crypto/bigint.c | 3 ++- crypto/crypto_misc.c | 3 ++- ssl/os_port.h | 5 +---- ssl/ssl.h | 8 +++++--- ssl/tls1.c | 9 +++++++++ ssl/tls1_clnt.c | 5 +---- 8 files changed, 36 insertions(+), 16 deletions(-) diff --git a/config/Config.in b/config/Config.in index bc11f69d24..c42bcefb76 100644 --- a/config/Config.in +++ b/config/Config.in @@ -58,7 +58,7 @@ depends on CONFIG_PLATFORM_WIN32 choice prompt "Compiler" depends on CONFIG_PLATFORM_WIN32 - default CONFIG_VISUAL_STUDIO_7_0 + default CONFIG_VISUAL_STUDIO_10_0 config CONFIG_VISUAL_STUDIO_7_0 bool "Visual Studio 7.0 (2003)" @@ -70,6 +70,10 @@ config CONFIG_VISUAL_STUDIO_8_0 help Use Microsoft's Visual Studio 2005 platform. +config CONFIG_VISUAL_STUDIO_10_0 + bool "Visual Studio 10.0 (2010)" + help + Use Microsoft's Visual Studio 2010 platform. endchoice config CONFIG_VISUAL_STUDIO_7_0_BASE @@ -82,6 +86,10 @@ config CONFIG_VISUAL_STUDIO_8_0_BASE depends on CONFIG_VISUAL_STUDIO_8_0 default "c:\\Program Files\\Microsoft Visual Studio 8" +config CONFIG_VISUAL_STUDIO_10_0_BASE + string "Base" + depends on CONFIG_VISUAL_STUDIO_10_0 + default "c:\\Program Files\\Microsoft Visual Studio 10.0" endmenu config CONFIG_EXTRA_CFLAGS_OPTIONS diff --git a/config/makefile.conf b/config/makefile.conf index 9f9db13301..9b2373ccf4 100644 --- a/config/makefile.conf +++ b/config/makefile.conf @@ -48,16 +48,21 @@ CONFIG_VISUAL_STUDIO_7_0_BASE_UNIX:=$(shell cygpath -u $(CONFIG_VISUAL_STUDIO_7_ export INCLUDE=$(shell echo "$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\include;$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\platformsdk\include") export LIB=$(shell echo "$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\\platformsdk\lib;$(CONFIG_VISUAL_STUDIO_7_0_BASE)\vc7\lib") PATH:=$(CONFIG_VISUAL_STUDIO_7_0_BASE_UNIX)/vc7/bin:$(CONFIG_VISUAL_STUDIO_7_0_BASE_UNIX)/common7/ide:$(PATH) -else +endif ifdef CONFIG_VISUAL_STUDIO_8_0 CONFIG_VISUAL_STUDIO_8_0_BASE_UNIX:=$(shell cygpath -u $(CONFIG_VISUAL_STUDIO_8_0_BASE)) export INCLUDE=$(shell echo "$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\include;$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\platformsdk\include") export LIB=$(shell echo "$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\platformsdk\lib;$(CONFIG_VISUAL_STUDIO_8_0_BASE)\vc\lib") PATH:=$(CONFIG_VISUAL_STUDIO_8_0_BASE_UNIX)/vc/bin:$(CONFIG_VISUAL_STUDIO_8_0_BASE_UNIX)/common7/ide:$(PATH) +endif +ifdef CONFIG_VISUAL_STUDIO_10_0 +CONFIG_VISUAL_STUDIO_10_0_BASE_UNIX:=$(shell cygpath -u $(CONFIG_VISUAL_STUDIO_10_0_BASE)) +export INCLUDE=$(shell echo "$(CONFIG_VISUAL_STUDIO_10_0_BASE)\vc\include;$(CONFIG_VISUAL_STUDIO_10_0_BASE)\..\Microsoft SDKs\Windows\v7.0A\include") +export LIB=$(shell echo "$(CONFIG_VISUAL_STUDIO_10_0_BASE)\vc\lib;$(CONFIG_VISUAL_STUDIO_10_0_BASE)\..\Microsoft SDKs\Windows\v7.0A\lib") +PATH:=$(CONFIG_VISUAL_STUDIO_10_0_BASE_UNIX)/vc/bin:$(CONFIG_VISUAL_STUDIO_10_0_BASE_UNIX)/common7/ide:$(PATH) stuff: @echo $(INCLUDE) endif -endif CC=cl.exe LD=link.exe diff --git a/crypto/bigint.c b/crypto/bigint.c index 93195c623b..80a991b220 100644 --- a/crypto/bigint.c +++ b/crypto/bigint.c @@ -826,6 +826,7 @@ static bigint *regular_multiply(BI_CTX *ctx, bigint *bia, bigint *bib, do { + long_comp tmp; comp carry = 0; int r_index = i; j = 0; @@ -843,7 +844,7 @@ static bigint *regular_multiply(BI_CTX *ctx, bigint *bia, bigint *bib, break; } - long_comp tmp = sr[r_index] + ((long_comp)sa[j])*sb[i] + carry; + tmp = sr[r_index] + ((long_comp)sa[j])*sb[i] + carry; sr[r_index++] = (comp)tmp; /* downsize */ carry = tmp >> COMP_BIT_SIZE; } while (++j < n); diff --git a/crypto/crypto_misc.c b/crypto/crypto_misc.c index 8bca842c19..8e7cbf9c5d 100644 --- a/crypto/crypto_misc.c +++ b/crypto/crypto_misc.c @@ -177,11 +177,12 @@ EXP_FUNC void STDCALL get_random(int num_rand_bytes, uint8_t *rand_data) struct timeval tv; MD5_CTX rng_digest_ctx; uint8_t digest[MD5_SIZE]; + uint64_t *ep; int i; /* A proper implementation would use counters etc for entropy */ gettimeofday(&tv, NULL); - uint64_t *ep = (uint64_t *)entropy_pool; + ep = (uint64_t *)entropy_pool; ep[0] ^= ENTROPY_COUNTER1; ep[1] ^= ENTROPY_COUNTER2; diff --git a/ssl/os_port.h b/ssl/os_port.h index 0efd6ae708..af71651a8e 100644 --- a/ssl/os_port.h +++ b/ssl/os_port.h @@ -82,8 +82,6 @@ extern "C" { #define SOCKET_READ(A,B,C) recv(A,B,C,0) #define SOCKET_WRITE(A,B,C) send(A,B,C,0) #define SOCKET_CLOSE(A) closesocket(A) -#define SOCKET_BLOCK(A) u_long argp = 0; \ - ioctlsocket(A, FIONBIO, &argp) #define srandom(A) srand(A) #define random() rand() #define getpid() _getpid() @@ -143,6 +141,7 @@ EXP_FUNC int STDCALL getdomainname(char *buf, int buf_size); #include #include #include +#include #include #include #include @@ -153,8 +152,6 @@ EXP_FUNC int STDCALL getdomainname(char *buf, int buf_size); #define SOCKET_READ(A,B,C) read(A,B,C) #define SOCKET_WRITE(A,B,C) write(A,B,C) #define SOCKET_CLOSE(A) if (A >= 0) close(A) -#define SOCKET_BLOCK(A) int fd = fcntl(A, F_GETFL, NULL); \ - fcntl(A, F_SETFL, fd & ~O_NONBLOCK) #define TTY_FLUSH() #endif /* Not Win32 */ diff --git a/ssl/ssl.h b/ssl/ssl.h index 6778837f9e..c379e02e76 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -197,7 +197,8 @@ extern "C" { * are passed during a handshake. * - SSL_DISPLAY_RSA (full mode build only): Display the RSA key details that * are passed during a handshake. - * + * - SSL_CLIENT_NON_BLOCKING (client only): Use non-blocking version of + * ssl_client_new. * @param num_sessions [in] The number of sessions to be used for session * caching. If this value is 0, then there is no session caching. This option * is not used in skeleton mode. @@ -231,8 +232,9 @@ EXP_FUNC SSL * STDCALL ssl_server_new(SSL_CTX *ssl_ctx, int client_fd); * It is up to the application to establish the initial logical connection * (whether it is a socket, serial connection etc). * - * This is a blocking call - it will finish when the handshake is complete (or - * has failed). + * This is a normall a blocking call - it will finish when the handshake is + * complete (or has failed). To use in non-blocking mode, set + * SSL_CLIENT_NON_BLOCKING in ssl_ctx_new. * @param ssl_ctx [in] The client context. * @param client_fd [in] The client's file descriptor. * @param session_id [in] A 32 byte session id for session resumption. This diff --git a/ssl/tls1.c b/ssl/tls1.c index 6d86d8e77e..3060faebd2 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -287,6 +287,7 @@ EXP_FUNC int STDCALL ssl_read(SSL *ssl, uint8_t **in_data) int ret = basic_read(ssl, in_data); /* check for return code so we can send an alert */ + if (ret < SSL_OK && ret != SSL_CLOSE_NOTIFY) { if (ret != SSL_ERROR_CONN_LOST) @@ -1159,6 +1160,14 @@ int basic_read(SSL *ssl, uint8_t **in_data) read_len = SOCKET_READ(ssl->client_fd, &buf[ssl->bm_read_index], ssl->need_bytes-ssl->got_bytes); + if (ret < 0) +#ifdef WIN32 + if (GetLastError() == WSAEWOULDBLOCK) +#else + if (errno == EAGAIN || errno == EWOULDBLOCK) +#endif + return 0; + /* connection has gone, so die */ if (read_len <= 0) { diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index f846ffdc94..676d01c55a 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -50,10 +50,7 @@ static int send_cert_verify(SSL *ssl); EXP_FUNC SSL * STDCALL ssl_client_new(SSL_CTX *ssl_ctx, int client_fd, const uint8_t *session_id, uint8_t sess_id_size) { - SSL *ssl; - - SOCKET_BLOCK(client_fd); /* ensure blocking mode */ - ssl = ssl_new(ssl_ctx, client_fd); + SSL *ssl = ssl_new(ssl_ctx, client_fd); if (session_id && ssl_ctx->num_sessions) { From faba18dfc1f4d4116bc682ebb7b644244302815f Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 16 Jan 2011 21:44:03 +0000 Subject: [PATCH 166/301] Check made in ssl_write for EAGAIN return from write(). git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@197 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/ssl.h | 14 ++++++++------ ssl/tls1.c | 25 +++++++++++++++---------- 2 files changed, 23 insertions(+), 16 deletions(-) diff --git a/ssl/ssl.h b/ssl/ssl.h index c379e02e76..71b09a134f 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -197,8 +197,8 @@ extern "C" { * are passed during a handshake. * - SSL_DISPLAY_RSA (full mode build only): Display the RSA key details that * are passed during a handshake. - * - SSL_CLIENT_NON_BLOCKING (client only): Use non-blocking version of - * ssl_client_new. + * - SSL_CLIENT_NON_BLOCKING (client only): To use a non-blocking version of + * ssl_client_new(). * @param num_sessions [in] The number of sessions to be used for session * caching. If this value is 0, then there is no session caching. This option * is not used in skeleton mode. @@ -232,9 +232,9 @@ EXP_FUNC SSL * STDCALL ssl_server_new(SSL_CTX *ssl_ctx, int client_fd); * It is up to the application to establish the initial logical connection * (whether it is a socket, serial connection etc). * - * This is a normall a blocking call - it will finish when the handshake is + * This is a normally a blocking call - it will finish when the handshake is * complete (or has failed). To use in non-blocking mode, set - * SSL_CLIENT_NON_BLOCKING in ssl_ctx_new. + * SSL_CLIENT_NON_BLOCKING in ssl_ctx_new(). * @param ssl_ctx [in] The client context. * @param client_fd [in] The client's file descriptor. * @param session_id [in] A 32 byte session id for session resumption. This @@ -257,7 +257,8 @@ EXP_FUNC void STDCALL ssl_free(SSL *ssl); /** * @brief Read the SSL data stream. - * The socket must be in blocking mode. + * If the socket is non-blocking and data is blocked then SSO_OK will be + * returned. * @param ssl [in] An SSL object reference. * @param in_data [out] If the read was successful, a pointer to the read * buffer will be here. Do NOT ever free this memory as this buffer is used in @@ -274,7 +275,8 @@ EXP_FUNC int STDCALL ssl_read(SSL *ssl, uint8_t **in_data); /** * @brief Write to the SSL data stream. - * The socket must be in blocking mode. + * if the socket is non-blocking and data is blocked then a check is made + * to ensure that all data is sent (i.e. blocked mode is forced). * @param ssl [in] An SSL obect reference. * @param out_data [in] The data to be written * @param out_len [in] The number of bytes to be written. diff --git a/ssl/tls1.c b/ssl/tls1.c index 3060faebd2..4bc2f1a6bb 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -939,14 +939,21 @@ static int send_raw_packet(SSL *ssl, uint8_t protocol) while (sent < pkt_size) { - if ((ret = SOCKET_WRITE(ssl->client_fd, - &ssl->bm_all_data[sent], pkt_size)) < 0) + ret = SOCKET_WRITE(ssl->client_fd, + &ssl->bm_all_data[sent], pkt_size); + + if (ret >= 0) + sent += ret; + else { - ret = SSL_ERROR_CONN_LOST; - break; - } - sent += ret; +#ifdef WIN32 + if (GetLastError() != WSAEWOULDBLOCK) +#else + if (errno != EAGAIN && errno != EWOULDBLOCK) +#endif + return SSL_ERROR_CONN_LOST; + } /* keep going until the write buffer has some space */ if (sent != pkt_size) @@ -955,11 +962,9 @@ static int send_raw_packet(SSL *ssl, uint8_t protocol) FD_ZERO(&wfds); FD_SET(ssl->client_fd, &wfds); + /* block and wait for it */ if (select(ssl->client_fd + 1, NULL, &wfds, NULL, NULL) < 0) - { - ret = SSL_ERROR_CONN_LOST; - break; - } + return SSL_ERROR_CONN_LOST; } } From 2c092baa283d5a8c5e86725b48fa9021e8352657 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 16 Jan 2011 21:59:50 +0000 Subject: [PATCH 167/301] Name change to SSL_CONNECT_IN_PARTS as last name was ambiguous. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@198 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/ssl.h | 6 +++--- ssl/tls1_clnt.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ssl/ssl.h b/ssl/ssl.h index 71b09a134f..198efc6899 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -82,7 +82,7 @@ extern "C" { #define SSL_DISPLAY_BYTES 0x00100000 #define SSL_DISPLAY_CERTS 0x00200000 #define SSL_DISPLAY_RSA 0x00400000 -#define SSL_CLIENT_NON_BLOCKING 0x00800000 +#define SSL_CONNECT_IN_PARTS 0x00800000 /* errors that can be generated */ #define SSL_OK 0 @@ -197,7 +197,7 @@ extern "C" { * are passed during a handshake. * - SSL_DISPLAY_RSA (full mode build only): Display the RSA key details that * are passed during a handshake. - * - SSL_CLIENT_NON_BLOCKING (client only): To use a non-blocking version of + * - SSL_CONNECT_IN_PARTS (client only): To use a non-blocking version of * ssl_client_new(). * @param num_sessions [in] The number of sessions to be used for session * caching. If this value is 0, then there is no session caching. This option @@ -234,7 +234,7 @@ EXP_FUNC SSL * STDCALL ssl_server_new(SSL_CTX *ssl_ctx, int client_fd); * * This is a normally a blocking call - it will finish when the handshake is * complete (or has failed). To use in non-blocking mode, set - * SSL_CLIENT_NON_BLOCKING in ssl_ctx_new(). + * SSL_CONNECT_IN_PARTS in ssl_ctx_new(). * @param ssl_ctx [in] The client context. * @param client_fd [in] The client's file descriptor. * @param session_id [in] A 32 byte session id for session resumption. This diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index 676d01c55a..3937015e78 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -148,7 +148,7 @@ int do_client_connect(SSL *ssl) ssl->hs_status = SSL_NOT_OK; /* not connected */ /* sit in a loop until it all looks good */ - if (!IS_SET_SSL_FLAG(SSL_CLIENT_NON_BLOCKING)) + if (!IS_SET_SSL_FLAG(SSL_CONNECT_IN_PARTS)) { while (ssl->hs_status != SSL_OK) { From 18c3faf4a875fb4919ae5deee8c415736ecce6eb Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 19 Jan 2011 22:41:03 +0000 Subject: [PATCH 168/301] added test case for non-blocking sockets. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@199 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/test/ssltest.c | 132 +++++++++++++++++++++++++++++++++++++++++++++ ssl/tls1.c | 4 +- 2 files changed, 135 insertions(+), 1 deletion(-) diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index f26a881ef7..50516e6dda 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1725,6 +1725,133 @@ static int SSL_basic_test(void) return ret; } +/************************************************************************** + * SSL unblocked case + * + **************************************************************************/ +static void do_unblocked(void) +{ + int client_fd; + SSL *ssl_clnt; + SSL_CTX *ssl_clnt_ctx = ssl_ctx_new( + DEFAULT_CLNT_OPTION, + SSL_DEFAULT_CLNT_SESS | + SSL_CONNECT_IN_PARTS); + usleep(200000); /* allow server to start */ + + if ((client_fd = client_socket_init(g_port)) < 0) + goto error; + + { +#ifdef WIN32 + u_long argp = 1; + ioctlsocket(client_fd, FIONBIO, &argp); +#else + int flags = fcntl(client_fd, F_GETFL, NULL); + fcntl(client_fd, F_SETFL, flags | O_NONBLOCK); +#endif + } + + if (ssl_obj_load(ssl_clnt_ctx, SSL_OBJ_X509_CACERT, + "../ssl/test/axTLS.ca_x509.cer", NULL)) + goto error; + + ssl_clnt = ssl_client_new(ssl_clnt_ctx, client_fd, NULL, 0); + + while (ssl_handshake_status(ssl_clnt) != SSL_OK) + { + if (ssl_read(ssl_clnt, NULL) < 0) + { + ssl_display_error(ssl_handshake_status(ssl_clnt)); + goto error; + } + } + + ssl_write(ssl_clnt, basic_buf, sizeof(basic_buf)); + ssl_free(ssl_clnt); + +error: + ssl_ctx_free(ssl_clnt_ctx); + SOCKET_CLOSE(client_fd); + + /* exit this thread */ +} + +static int SSL_unblocked_test(void) +{ + int server_fd, client_fd, ret = 0, size = 0, offset = 0; + SSL_CTX *ssl_svr_ctx = NULL; + struct sockaddr_in client_addr; + uint8_t *read_buf; + socklen_t clnt_len = sizeof(client_addr); + SSL *ssl_svr; +#ifndef WIN32 + pthread_t thread; +#endif + memset(basic_buf, 0xA5, sizeof(basic_buf)/2); + memset(&basic_buf[sizeof(basic_buf)/2], 0x5A, sizeof(basic_buf)/2); + + if ((server_fd = server_socket_init(&g_port)) < 0) + goto error; + + ssl_svr_ctx = ssl_ctx_new(DEFAULT_SVR_OPTION, SSL_DEFAULT_SVR_SESS); + +#ifndef WIN32 + pthread_create(&thread, NULL, + (void *(*)(void *))do_unblocked, NULL); + pthread_detach(thread); +#else + CreateThread(NULL, 1024, (LPTHREAD_START_ROUTINE)do_unblocked, + NULL, 0, NULL); +#endif + + /* Wait for a client to connect */ + if ((client_fd = accept(server_fd, + (struct sockaddr *) &client_addr, &clnt_len)) < 0) + { + ret = SSL_ERROR_SOCK_SETUP_FAILURE; + goto error; + } + + /* we are ready to go */ + ssl_svr = ssl_server_new(ssl_svr_ctx, client_fd); + + do + { + while ((size = ssl_read(ssl_svr, &read_buf)) == SSL_OK); + + if (size < SSL_OK) /* got some alert or something nasty */ + { + ssl_display_error(size); + ret = size; + break; + } + else /* looks more promising */ + { + if (memcmp(read_buf, &basic_buf[offset], size) != 0) + { + ret = SSL_NOT_OK; + break; + } + } + + offset += size; + } while (offset < sizeof(basic_buf)); + + printf(ret == SSL_OK && offset == sizeof(basic_buf) ? + "SSL unblocked test passed\n" : + "SSL unblocked test failed\n"); + TTY_FLUSH(); + + ssl_free(ssl_svr); + SOCKET_CLOSE(server_fd); + SOCKET_CLOSE(client_fd); + +error: + ssl_ctx_free(ssl_svr_ctx); + return ret; +} + #if !defined(WIN32) && defined(CONFIG_SSL_CTX_MUTEXING) /************************************************************************** * Multi-Threading Tests @@ -2035,6 +2162,11 @@ int main(int argc, char *argv[]) system("sh ../ssl/test/killopenssl.sh"); + if (SSL_unblocked_test()) + goto cleanup; + + system("sh ../ssl/test/killopenssl.sh"); + if (SSL_client_tests()) goto cleanup; diff --git a/ssl/tls1.c b/ssl/tls1.c index 4bc2f1a6bb..6bcb2bb214 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -1165,13 +1165,15 @@ int basic_read(SSL *ssl, uint8_t **in_data) read_len = SOCKET_READ(ssl->client_fd, &buf[ssl->bm_read_index], ssl->need_bytes-ssl->got_bytes); - if (ret < 0) + if (read_len < 0) + { #ifdef WIN32 if (GetLastError() == WSAEWOULDBLOCK) #else if (errno == EAGAIN || errno == EWOULDBLOCK) #endif return 0; + } /* connection has gone, so die */ if (read_len <= 0) From e254859fb018737dfe3bb8961b824d21364712e9 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 20 Jan 2011 08:51:42 +0000 Subject: [PATCH 169/301] Default is always 150 regardless of ssl configuration. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@200 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/Config.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ssl/Config.in b/ssl/Config.in index cd84c9566f..ce2fdbc9b7 100644 --- a/ssl/Config.in +++ b/ssl/Config.in @@ -252,7 +252,7 @@ config CONFIG_SSL_EXPIRY_TIME config CONFIG_X509_MAX_CA_CERTS int "Maximum number of certificate authorites" - default 150 if CONFIG_SSL_CERT_VERIFICATION + default 150 depends on !CONFIG_SSL_SERVER_ONLY && !CONFIG_SSL_SKELETON_MODE help Determines the number of CA's allowed. From 9c91e355da22e680c27dfc7380320c3b00b549d9 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Mon, 24 Jan 2011 22:49:20 +0000 Subject: [PATCH 170/301] Now load PEM cert bundles correctly for verification. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@201 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/asn1.c | 10 +++++----- ssl/loader.c | 12 ++++-------- ssl/tls1.c | 19 ++++++------------- ssl/x509.c | 2 +- 4 files changed, 16 insertions(+), 27 deletions(-) diff --git a/ssl/asn1.c b/ssl/asn1.c index d99b0a8b54..b30d89114e 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -433,13 +433,13 @@ int asn1_signature(const uint8_t *cert, int *offset, X509_CTX *x509_ctx) */ static int asn1_compare_dn_comp(const char *dn1, const char *dn2) { - int ret = 1; + int ret; - if ((dn1 && dn2 == NULL) || (dn1 == NULL && dn2)) goto err_no_match; - - ret = (dn1 && dn2) ? strcmp(dn1, dn2) : 0; + if (dn1 == NULL && dn2 == NULL) + ret = 0; + else + ret = (dn1 && dn2) ? strcmp(dn1, dn2) : 0; -err_no_match: return ret; } diff --git a/ssl/loader.c b/ssl/loader.c index 96679a5667..7bb3c671a9 100644 --- a/ssl/loader.c +++ b/ssl/loader.c @@ -303,7 +303,7 @@ static int new_pem_obj(SSL_CTX *ssl_ctx, int is_cacert, char *where, if ((start = strstr(where, begins[i])) && (end = strstr(where, ends[i]))) { - remain -= (int)(end-start); + remain -= (int)(end-where); start += strlen(begins[i]); pem_size = (int)(end-start); @@ -362,20 +362,16 @@ static int new_pem_obj(SSL_CTX *ssl_ctx, int is_cacert, char *where, remain--; } + where = end; break; } } ssl_obj_free(ssl_obj); ssl_obj = NULL; - - if (i == NUM_PEM_TYPES) - { - ret = SSL_ERROR_BAD_CERTIFICATE; - goto error; - } + if (start == NULL) + break; } - error: ssl_obj_free(ssl_obj); return ret; diff --git a/ssl/tls1.c b/ssl/tls1.c index 6bcb2bb214..dc8f4ddb14 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -416,7 +416,13 @@ int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) /* ignore the return code */ if (x509_new(buf, &offset, &ca_cert_ctx->cert[i]) == X509_OK) + { +#if defined (CONFIG_SSL_FULL_MODE) + if (ssl_ctx->options & SSL_DISPLAY_CERTS) + x509_print(ca_cert_ctx->cert[i], NULL); +#endif i++; + } len -= offset; } @@ -1808,7 +1814,6 @@ int process_certificate(SSL *ssl, X509_CTX **x509_ctx) goto error; } - /* DISPLAY_CERT(ssl, *chain); */ chain = &((*chain)->next); offset += cert_size; } @@ -1898,18 +1903,6 @@ void DISPLAY_STATE(SSL *ssl, int is_send, uint8_t state, int not_ok) TTY_FLUSH(); } -/** - * Debugging routine to display X509 certificates. - */ -void DISPLAY_CERT(SSL *ssl, const X509_CTX *x509_ctx) -{ - if (!IS_SET_SSL_FLAG(SSL_DISPLAY_CERTS)) - return; - - x509_print(x509_ctx, ssl->ssl_ctx->ca_cert_ctx); - TTY_FLUSH(); -} - /** * Debugging routine to display RSA objects */ diff --git a/ssl/x509.c b/ssl/x509.c index 185fd7591d..bea9173d2d 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -367,7 +367,7 @@ int x509_verify(const CA_CERT_CTX *ca_cert_ctx, const X509_CTX *cert) if (ca_cert_ctx != NULL) { /* go thu the CA store */ - while (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) + while (i < CONFIG_X509_MAX_CA_CERTS && ca_cert_ctx->cert[i]) { if (asn1_compare_dn(cert->ca_cert_dn, ca_cert_ctx->cert[i]->cert_dn) == 0) From 7f3d1265ef386020fea6105407af9d93951c0792 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Tue, 8 Feb 2011 11:38:05 +0000 Subject: [PATCH 171/301] fixed issue with bad certs on cygwin git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@202 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/loader.c | 2 +- ssl/test/ssltest.c | 4 ++-- ssl/tls1.c | 2 +- ssl/x509.c | 6 ++---- www/index.html | 2 +- 5 files changed, 7 insertions(+), 9 deletions(-) diff --git a/ssl/loader.c b/ssl/loader.c index 7bb3c671a9..6009cba360 100644 --- a/ssl/loader.c +++ b/ssl/loader.c @@ -136,7 +136,7 @@ static int do_obj(SSL_CTX *ssl_ctx, int obj_type, #ifdef CONFIG_SSL_CERT_VERIFICATION case SSL_OBJ_X509_CACERT: - ret = add_cert_auth(ssl_ctx, ssl_obj->buf, ssl_obj->len); + add_cert_auth(ssl_ctx, ssl_obj->buf, ssl_obj->len); break; #endif diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 50516e6dda..9e86004d21 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -703,13 +703,13 @@ static int cert_tests(void) } ssl_ctx_free(ssl_ctx); - -res = 0; /* all ok */ + res = 0; /* all ok */ printf("All Certificate tests passed\n"); bad_cert: if (res) printf("Error: A certificate test failed\n"); + return res; } diff --git a/ssl/tls1.c b/ssl/tls1.c index dc8f4ddb14..c332ff81f4 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -421,9 +421,9 @@ int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) if (ssl_ctx->options & SSL_DISPLAY_CERTS) x509_print(ca_cert_ctx->cert[i], NULL); #endif - i++; } + i++; len -= offset; } diff --git a/ssl/x509.c b/ssl/x509.c index bea9173d2d..cb007fbbc7 100644 --- a/ssl/x509.c +++ b/ssl/x509.c @@ -200,15 +200,13 @@ int x509_new(const uint8_t *cert, int *len, X509_CTX **ctx) asn1_signature(cert, &offset, x509_ctx)) goto end_cert; #endif - + ret = X509_OK; +end_cert: if (len) { *len = cert_size; } - ret = X509_OK; -end_cert: - if (ret) { #ifdef CONFIG_SSL_FULL_MODE diff --git a/www/index.html b/www/index.html index 9a98eb3216..4bfe7c7697 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to ehuman - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to ehuman - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 222f2d98f16f58f02f33902a2cc0b8d73e9aa905 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 11 Feb 2011 12:43:01 +0000 Subject: [PATCH 172/301] Fixed SOCKET_WRITE() when blocked. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@203 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/axhttpd.c | 5 +++++ ssl/tls1.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/httpd/axhttpd.c b/httpd/axhttpd.c index bb54e487ca..d4b1f4926b 100644 --- a/httpd/axhttpd.c +++ b/httpd/axhttpd.c @@ -34,7 +34,10 @@ #include #include #include + +#if !defined(WIN32) #include +#endif #include "axhttp.h" struct serverstruct *servers; @@ -614,7 +617,9 @@ void removeconnection(struct connstruct *cn) cn->ssl = NULL; } +#ifndef WIN32 shutdown(cn->networkdesc, SHUT_WR); +#endif SOCKET_CLOSE(cn->networkdesc); } diff --git a/ssl/tls1.c b/ssl/tls1.c index c332ff81f4..d8bcf239e1 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -946,7 +946,7 @@ static int send_raw_packet(SSL *ssl, uint8_t protocol) while (sent < pkt_size) { ret = SOCKET_WRITE(ssl->client_fd, - &ssl->bm_all_data[sent], pkt_size); + &ssl->bm_all_data[sent], pkt_size-sent); if (ret >= 0) sent += ret; From 2ae9a3ec830f691490b361df47345940bd228ff4 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Tue, 26 Apr 2011 20:33:55 +0000 Subject: [PATCH 173/301] Started to implement TLS1.1 (but disabled for now) git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@204 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/Config.in | 2 +- ssl/tls1.c | 40 +++++++++++++++++++++++++++++----------- ssl/tls1.h | 7 +++++++ ssl/tls1_clnt.c | 19 ++++++++++++++----- ssl/tls1_svr.c | 29 +++++++++++++++++------------ www/index.html | 2 +- 6 files changed, 69 insertions(+), 30 deletions(-) diff --git a/ssl/Config.in b/ssl/Config.in index ce2fdbc9b7..b8cd8e4be7 100644 --- a/ssl/Config.in +++ b/ssl/Config.in @@ -192,7 +192,7 @@ config CONFIG_SSL_X509_ORGANIZATION_UNIT_NAME config CONFIG_SSL_ENABLE_V23_HANDSHAKE bool "Enable v23 Handshake" - default y + default n help Some browsers use the v23 handshake client hello message (an SSL2 format message which all SSL servers can understand). diff --git a/ssl/tls1.c b/ssl/tls1.c index d8bcf239e1..ded4c0284f 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -287,7 +287,6 @@ EXP_FUNC int STDCALL ssl_read(SSL *ssl, uint8_t **in_data) int ret = basic_read(ssl, in_data); /* check for return code so we can send an alert */ - if (ret < SSL_OK && ret != SSL_CLOSE_NOTIFY) { if (ret != SSL_ERROR_CONN_LOST) @@ -695,19 +694,38 @@ static int verify_digest(SSL *ssl, int mode, const uint8_t *buf, int read_len) if (ssl->cipher_info->padding_size) { - hmac_offset = read_len-buf[read_len-1]-ssl->cipher_info->digest_size-1; + int last_blk_size = buf[read_len-1], i; + hmac_offset = read_len-last_blk_size-ssl->cipher_info->digest_size-1; + + /* guard against a timing attack - make sure we do the digest */ + if (hmac_offset < 0 || last_blk_size > ssl->cipher_info->padding_size) + { + hmac_offset = 0; + } + else + { + /* already looked at last byte */ + for (i = 1; i < last_blk_size; i++) + { + if (buf[read_len-i] != last_blk_size) + { + hmac_offset = 0; + break; + } + } + } } else { hmac_offset = read_len - ssl->cipher_info->digest_size; - } - /* sanity check the offset */ - if (hmac_offset < 0) - { - return SSL_ERROR_INVALID_HMAC; + if (hmac_offset < 0) + { + hmac_offset = 0; + } } + /* sanity check the offset */ ssl->hmac_header[3] = hmac_offset >> 8; /* insert size */ ssl->hmac_header[4] = hmac_offset & 0xff; add_hmac_digest(ssl, mode, ssl->hmac_header, buf, hmac_offset, hmac_buf); @@ -935,8 +953,8 @@ static int send_raw_packet(SSL *ssl, uint8_t protocol) int ret = SSL_OK; rec_buf[0] = protocol; - rec_buf[1] = 0x03; /* version = 3.1 (TLS) */ - rec_buf[2] = 0x01; + rec_buf[1] = 0x03; /* version = 3.1 or higher */ + rec_buf[2] = ssl->version & 0x0f; rec_buf[3] = ssl->bm_index >> 8; rec_buf[4] = ssl->bm_index & 0xff; @@ -1011,8 +1029,8 @@ int send_packet(SSL *ssl, uint8_t protocol, const uint8_t *in, int length) uint8_t hmac_header[SSL_RECORD_SIZE]; hmac_header[0] = protocol; - hmac_header[1] = 0x03; - hmac_header[2] = 0x01; + hmac_header[1] = 0x03; /* version = 3.1 or higher */ + hmac_header[2] = ssl->version & 0x0f; hmac_header[3] = length >> 8; hmac_header[4] = length & 0xff; diff --git a/ssl/tls1.h b/ssl/tls1.h index a1e1bd9825..079613530b 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -44,6 +44,11 @@ extern "C" { #include "crypto.h" #include "crypto_misc.h" +#define SSL_PROTOCOL_MIN_VERSION 0x31 /* TLS v1.0 */ +//#define SSL_PROTOCOL_MINOR_VERSION 0x02 /* TLS v1.1 */ +#define SSL_PROTOCOL_MINOR_VERSION 0x01 /* TLS v1.0 */ +//#define SSL_PROTOCOL_VERSION 0x32 /* TLS v1.1 */ +#define SSL_PROTOCOL_VERSION 0x31 /* TLS v1.1 */ #define SSL_RANDOM_SIZE 32 #define SSL_SECRET_SIZE 48 #define SSL_FINISHED_HASH_SIZE 12 @@ -160,6 +165,8 @@ struct _SSL uint8_t record_type; uint8_t cipher; uint8_t sess_id_size; + uint8_t version; + uint8_t client_version; int16_t next_state; int16_t hs_status; DISPOSABLE_CTX *dc; /* temporary data which we'll get rid of soon */ diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index 3937015e78..33aa1ad609 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -51,6 +51,7 @@ EXP_FUNC SSL * STDCALL ssl_client_new(SSL_CTX *ssl_ctx, int client_fd, const uint8_t *session_id, uint8_t sess_id_size) { SSL *ssl = ssl_new(ssl_ctx, client_fd); + ssl->version = SSL_PROTOCOL_VERSION; if (session_id && ssl_ctx->num_sessions) { @@ -178,7 +179,7 @@ static int send_client_hello(SSL *ssl) buf[2] = 0; /* byte 3 is calculated later */ buf[4] = 0x03; - buf[5] = 0x01; + buf[5] = ssl->version & 0x0f; /* client random value - spec says that 1st 4 bytes are big endian time */ *tm_ptr++ = (uint8_t)(((long)tm & 0xff000000) >> 24); @@ -227,14 +228,22 @@ static int process_server_hello(SSL *ssl) { uint8_t *buf = ssl->bm_data; int pkt_size = ssl->bm_index; - int version = (buf[4] << 4) + buf[5]; int num_sessions = ssl->ssl_ctx->num_sessions; uint8_t sess_id_size; int offset, ret = SSL_OK; /* check that we are talking to a TLSv1 server */ - if (version != 0x31) - return SSL_ERROR_INVALID_VERSION; + uint8_t version = (buf[4] << 4) + buf[5]; + if (version > SSL_PROTOCOL_VERSION) + version = SSL_PROTOCOL_VERSION; + else if (ssl->version < SSL_PROTOCOL_MIN_VERSION) + { + ret = SSL_ERROR_INVALID_VERSION; + ssl_display_error(ret); + goto error; + } + + ssl->version = version; /* get the server random value */ memcpy(ssl->dc->server_random, &buf[6], SSL_RANDOM_SIZE); @@ -300,7 +309,7 @@ static int send_client_key_xchg(SSL *ssl) buf[1] = 0; premaster_secret[0] = 0x03; /* encode the version number */ - premaster_secret[1] = 0x01; + premaster_secret[1] = SSL_PROTOCOL_MINOR_VERSION; /* must be TLS 1.1 */ get_random(SSL_SECRET_SIZE-2, &premaster_secret[2]); DISPLAY_RSA(ssl, ssl->x509_ctx->rsa_ctx); diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index 742ffd5934..53a37b924a 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -120,17 +120,20 @@ static int process_client_hello(SSL *ssl) uint8_t *record_buf = ssl->hmac_header; int pkt_size = ssl->bm_index; int i, j, cs_len, id_len, offset = 6 + SSL_RANDOM_SIZE; - int version = (record_buf[1] << 4) + record_buf[2]; int ret = SSL_OK; /* should be v3.1 (TLSv1) or better - we'll send in v3.1 mode anyway */ - if (version < 0x31) + uint8_t version = (record_buf[1] << 4) + record_buf[2]; + if (version > SSL_PROTOCOL_VERSION) + version = SSL_PROTOCOL_VERSION; + else if (ssl->version < SSL_PROTOCOL_MIN_VERSION) { ret = SSL_ERROR_INVALID_VERSION; ssl_display_error(ret); goto error; } + ssl->version = ssl->client_version = version; memcpy(ssl->dc->client_random, &buf[6], SSL_RANDOM_SIZE); /* process the session id */ @@ -151,10 +154,11 @@ static int process_client_hello(SSL *ssl) PARANOIA_CHECK(pkt_size, offset); - /* work out what cipher suite we are going to use */ - for (j = 0; j < NUM_PROTOCOLS; j++) + /* work out what cipher suite we are going to use - client defines + the preference */ + for (i = 0; i < cs_len; i += 2) { - for (i = 0; i < cs_len; i += 2) + for (j = 0; j < NUM_PROTOCOLS; j++) { if (ssl_prot_prefs[j] == buf[offset+i]) /* got a match? */ { @@ -180,7 +184,6 @@ int process_sslv23_client_hello(SSL *ssl) { uint8_t *buf = ssl->bm_data; int bytes_needed = ((buf[0] & 0x7f) << 8) + buf[1]; - int version = (buf[3] << 4) + buf[4]; int ret = SSL_OK; /* we have already read 3 extra bytes so far */ @@ -193,8 +196,9 @@ int process_sslv23_client_hello(SSL *ssl) DISPLAY_BYTES(ssl, "received %d bytes", buf, read_len, read_len); - /* should be v3.1 (TLSv1) or better - we'll send in v3.1 mode anyway */ - if (version < 0x31) + /* should be v3.1 (TLSv1) or better */ + ssl->version = (buf[3] << 4) + buf[4]; + if (ssl->version < SSL_PROTOCOL_MIN_VERSION) { return SSL_ERROR_INVALID_VERSION; } @@ -308,7 +312,7 @@ static int send_server_hello(SSL *ssl) buf[2] = 0; /* byte 3 is calculated later */ buf[4] = 0x03; - buf[5] = 0x01; + buf[5] = ssl->version & 0x0f; /* server random value */ get_random(SSL_RANDOM_SIZE, &buf[6]); @@ -396,11 +400,12 @@ static int process_client_key_xchg(SSL *ssl) SSL_CTX_UNLOCK(ssl->ssl_ctx->mutex); if (premaster_size != SSL_SECRET_SIZE || - premaster_secret[0] != 0x03 || /* check version is 3.1 (TLS) */ - premaster_secret[1] != 0x01) + premaster_secret[0] != 0x03 || /* must be the same as client + offered version */ + premaster_secret[1] != (ssl->client_version & 0x0f)) { /* guard against a Bleichenbacher attack */ - memset(premaster_secret, 0, SSL_SECRET_SIZE); + get_random(SSL_SECRET_SIZE, premaster_secret); /* and continue - will die eventually when checking the mac */ } diff --git a/www/index.html b/www/index.html index 4bfe7c7697..0cd96b7511 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to ehuman - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* Support for TLS 1.1\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 8558c49351784e14ace856a1b993b68ff38e2a29 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 28 Apr 2011 13:00:20 +0000 Subject: [PATCH 174/301] Fixed variable length macs used by gnutls. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@205 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/test/ssltest.c | 4 ++-- ssl/tls1.c | 2 +- ssl/tls1_svr.c | 3 ++- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 9e86004d21..9ecd2275b1 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -798,13 +798,13 @@ static void do_client(client_t *clnt) /* show the session ids in the reconnect test */ if (strcmp(clnt->testname, "Session Reuse") == 0) { - sprintf(openssl_buf, "echo \"hello client\" | openssl s_client " + sprintf(openssl_buf, "echo \"hello client\" | openssl s_client -tls1 " "-connect localhost:%d %s 2>&1 | grep \"Session-ID:\"", g_port, clnt->openssl_option); } else { - sprintf(openssl_buf, "echo \"hello client\" | openssl s_client " + sprintf(openssl_buf, "echo \"hello client\" | openssl s_client -tls1 " #ifdef WIN32 "-connect localhost:%d -quiet %s", #else diff --git a/ssl/tls1.c b/ssl/tls1.c index ded4c0284f..21a01733b9 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -698,7 +698,7 @@ static int verify_digest(SSL *ssl, int mode, const uint8_t *buf, int read_len) hmac_offset = read_len-last_blk_size-ssl->cipher_info->digest_size-1; /* guard against a timing attack - make sure we do the digest */ - if (hmac_offset < 0 || last_blk_size > ssl->cipher_info->padding_size) + if (hmac_offset < 0) { hmac_offset = 0; } diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index 53a37b924a..de6f4898a3 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -124,9 +124,10 @@ static int process_client_hello(SSL *ssl) /* should be v3.1 (TLSv1) or better - we'll send in v3.1 mode anyway */ uint8_t version = (record_buf[1] << 4) + record_buf[2]; + if (version > SSL_PROTOCOL_VERSION) version = SSL_PROTOCOL_VERSION; - else if (ssl->version < SSL_PROTOCOL_MIN_VERSION) + else if (version < SSL_PROTOCOL_MIN_VERSION) { ret = SSL_ERROR_INVALID_VERSION; ssl_display_error(ret); From 1a19505e760462a3923418fad3d6612a6f52fe7c Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 28 Apr 2011 23:49:17 +0000 Subject: [PATCH 175/301] Fix for version (take 2) git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@206 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/tls1_svr.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index de6f4898a3..13305332c2 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -122,19 +122,18 @@ static int process_client_hello(SSL *ssl) int i, j, cs_len, id_len, offset = 6 + SSL_RANDOM_SIZE; int ret = SSL_OK; - /* should be v3.1 (TLSv1) or better - we'll send in v3.1 mode anyway */ uint8_t version = (record_buf[1] << 4) + record_buf[2]; + ssl->version = ssl->client_version = version; if (version > SSL_PROTOCOL_VERSION) - version = SSL_PROTOCOL_VERSION; - else if (version < SSL_PROTOCOL_MIN_VERSION) + ssl->version = SSL_PROTOCOL_VERSION; /* use client's version */ + else if (version < SSL_PROTOCOL_MIN_VERSION) /* old version supported? */ { ret = SSL_ERROR_INVALID_VERSION; ssl_display_error(ret); goto error; } - ssl->version = ssl->client_version = version; memcpy(ssl->dc->client_random, &buf[6], SSL_RANDOM_SIZE); /* process the session id */ From 70a8f79fa62af36e377bb63c5d7ab7326df0ea1b Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 6 May 2011 12:35:32 +0000 Subject: [PATCH 176/301] TLSv1.1 feature added. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@207 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/test/killgnutls.sh | 2 + ssl/test/ssltest.c | 47 ++++++++++++++++++++-- ssl/tls1.c | 90 ++++++++++++++++++++++++++++-------------- ssl/tls1.h | 9 ++--- ssl/tls1_clnt.c | 10 +++-- ssl/tls1_svr.c | 16 +++----- 6 files changed, 123 insertions(+), 51 deletions(-) create mode 100755 ssl/test/killgnutls.sh diff --git a/ssl/test/killgnutls.sh b/ssl/test/killgnutls.sh new file mode 100755 index 0000000000..f910f4b073 --- /dev/null +++ b/ssl/test/killgnutls.sh @@ -0,0 +1,2 @@ +#!/bin/sh +ps -ef|grep gnutls-serv | /usr/bin/awk '{print $2}' |xargs kill -9 diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 9ecd2275b1..4dd1fca475 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -802,7 +802,7 @@ static void do_client(client_t *clnt) "-connect localhost:%d %s 2>&1 | grep \"Session-ID:\"", g_port, clnt->openssl_option); } - else + else if (strstr(clnt->testname, "GNUTLS") == NULL) { sprintf(openssl_buf, "echo \"hello client\" | openssl s_client -tls1 " #ifdef WIN32 @@ -812,6 +812,16 @@ static void do_client(client_t *clnt) #endif g_port, clnt->openssl_option); } + else /* gnutls */ + { + sprintf(openssl_buf, "echo \"hello client\" | gnutls-cli " +#ifdef WIN32 + "-p %d %s 127.0.0.1", +#else + "-p %d %s 127.0.0.1 > /dev/null 2>&1", +#endif + g_port, clnt->openssl_option); + } system(openssl_buf); } @@ -1243,6 +1253,15 @@ int SSL_server_tests(void) NULL, "abcd", DEFAULT_SVR_OPTION))) goto cleanup; + /* + * GNUTLS + */ + if ((ret = SSL_server_test("GNUTLS client", + "", + "../ssl/test/axTLS.x509_1024.cer", NULL, + "../ssl/test/axTLS.key_1024", + NULL, NULL, DEFAULT_SVR_OPTION))) + goto cleanup; ret = 0; cleanup: @@ -1279,6 +1298,7 @@ typedef struct { const char *testname; const char *openssl_option; + int do_gnutls; } server_t; static void do_server(server_t *svr) @@ -1287,8 +1307,17 @@ static void do_server(server_t *svr) #ifndef WIN32 pthread_setcanceltype(PTHREAD_CANCEL_ASYNCHRONOUS, NULL); #endif - sprintf(openssl_buf, "openssl s_server -tls1 " - "-accept %d -quiet %s ", g_port, svr->openssl_option); + if (svr->do_gnutls) + { + sprintf(openssl_buf, "gnutls-serv " + "-p %d --quiet %s ", g_port, svr->openssl_option); + } + else + { + sprintf(openssl_buf, "openssl s_server -tls1 " + "-accept %d -quiet %s ", g_port, svr->openssl_option); + } + system(openssl_buf); } @@ -1311,6 +1340,8 @@ static int SSL_client_test( pthread_t thread; #endif + server_data.do_gnutls = strstr(test, "GNUTLS") != NULL; + if (sess_resume == NULL || sess_resume->start_server) { g_port++; @@ -1592,6 +1623,14 @@ int SSL_client_tests(void) } printf("SSL client test \"Invalid certificate type\" passed\n"); + + if ((ret = SSL_client_test("GNUTLS client", + &ssl_ctx, + "--x509certfile ../ssl/test/axTLS.x509_1024.pem " + "--x509keyfile ../ssl/test/axTLS.key_1024.pem -q", NULL, + DEFAULT_CLNT_OPTION, NULL, NULL, NULL))) + goto cleanup; + ret = 0; cleanup: @@ -1600,6 +1639,7 @@ int SSL_client_tests(void) ssl_display_error(ret); printf("Error: A client test failed\n"); system("sh ../ssl/test/killopenssl.sh"); + system("sh ../ssl/test/killgnutls.sh"); exit(1); } else @@ -2171,6 +2211,7 @@ int main(int argc, char *argv[]) goto cleanup; system("sh ../ssl/test/killopenssl.sh"); + system("sh ../ssl/test/killgnutls.sh"); if (SSL_server_tests()) goto cleanup; diff --git a/ssl/tls1.c b/ssl/tls1.c index 21a01733b9..5a828e91a6 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -715,7 +715,7 @@ static int verify_digest(SSL *ssl, int mode, const uint8_t *buf, int read_len) } } } - else + else /* stream cipher */ { hmac_offset = read_len - ssl->cipher_info->digest_size; @@ -1009,9 +1009,7 @@ static int send_raw_packet(SSL *ssl, uint8_t protocol) */ int send_packet(SSL *ssl, uint8_t protocol, const uint8_t *in, int length) { - int msg_length = length; - int ret, pad_bytes = 0; - ssl->bm_index = msg_length; + int ret, msg_length = 0; /* if our state is bad, don't bother */ if (ssl->hs_status == SSL_ERROR_DEAD) @@ -1022,17 +1020,19 @@ int send_packet(SSL *ssl, uint8_t protocol, const uint8_t *in, int length) memcpy(ssl->bm_data, in, length); } + msg_length += length; if (IS_SET_SSL_FLAG(SSL_TX_ENCRYPTED)) { int mode = IS_SET_SSL_FLAG(SSL_IS_CLIENT) ? SSL_CLIENT_WRITE : SSL_SERVER_WRITE; - uint8_t hmac_header[SSL_RECORD_SIZE]; - - hmac_header[0] = protocol; - hmac_header[1] = 0x03; /* version = 3.1 or higher */ - hmac_header[2] = ssl->version & 0x0f; - hmac_header[3] = length >> 8; - hmac_header[4] = length & 0xff; + uint8_t hmac_header[SSL_RECORD_SIZE] = + { + protocol, + 0x03, /* version = 3.1 or higher */ + ssl->version & 0x0f, + msg_length >> 8, + msg_length & 0xff + }; if (protocol == PT_HANDSHAKE_PROTOCOL) { @@ -1040,21 +1040,20 @@ int send_packet(SSL *ssl, uint8_t protocol, const uint8_t *in, int length) if (ssl->bm_data[0] != HS_HELLO_REQUEST) { - add_packet(ssl, ssl->bm_data, ssl->bm_index); + add_packet(ssl, ssl->bm_data, msg_length); } } /* add the packet digest */ + add_hmac_digest(ssl, mode, hmac_header, ssl->bm_data, msg_length, + &ssl->bm_data[msg_length]); msg_length += ssl->cipher_info->digest_size; - ssl->bm_index = msg_length; - add_hmac_digest(ssl, mode, hmac_header, ssl->bm_data, length, - &ssl->bm_data[length]); /* add padding? */ if (ssl->cipher_info->padding_size) { int last_blk_size = msg_length%ssl->cipher_info->padding_size; - pad_bytes = ssl->cipher_info->padding_size - last_blk_size; + int pad_bytes = ssl->cipher_info->padding_size - last_blk_size; /* ensure we always have at least 1 padding byte */ if (pad_bytes == 0) @@ -1062,12 +1061,24 @@ int send_packet(SSL *ssl, uint8_t protocol, const uint8_t *in, int length) memset(&ssl->bm_data[msg_length], pad_bytes-1, pad_bytes); msg_length += pad_bytes; - ssl->bm_index = msg_length; } DISPLAY_BYTES(ssl, "unencrypted write", ssl->bm_data, msg_length); increment_write_sequence(ssl); + /* add the explicit IV for TLS1.1 */ + if (ssl->version >= SSL_PROTOCOL_VERSION1_1 && + ssl->cipher_info->iv_size) + + { + uint8_t iv_size = ssl->cipher_info->iv_size; + uint8_t *t_buf = alloca(msg_length + iv_size); + memcpy(t_buf + iv_size, ssl->bm_data, msg_length); + get_random(iv_size, t_buf); + msg_length += iv_size; + memcpy(ssl->bm_data, t_buf, msg_length); + } + /* now encrypt the packet */ ssl->cipher_info->encrypt(ssl->encrypt_ctx, ssl->bm_data, ssl->bm_data, msg_length); @@ -1078,10 +1089,11 @@ int send_packet(SSL *ssl, uint8_t protocol, const uint8_t *in, int length) if (ssl->bm_data[0] != HS_HELLO_REQUEST) { - add_packet(ssl, ssl->bm_data, ssl->bm_index); + add_packet(ssl, ssl->bm_data, length); } } + ssl->bm_index = msg_length; if ((ret = send_raw_packet(ssl, protocol)) <= 0) return ret; @@ -1223,10 +1235,27 @@ int basic_read(SSL *ssl, uint8_t **in_data) if (IS_SET_SSL_FLAG(SSL_NEED_RECORD)) { /* check for sslv2 "client hello" */ - if (buf[0] & 0x80 && buf[2] == 1 && buf[3] == 0x03) + if (buf[0] & 0x80 && buf[2] == 1) { #ifdef CONFIG_SSL_ENABLE_V23_HANDSHAKE + uint8_t version = (buf[3] << 4) + buf[4]; DISPLAY_BYTES(ssl, "ssl2 record", buf, 5); + + /* should be v3.1 (TLSv1) or better */ + ssl->version = ssl->client_version = version; + + if (version > SSL_PROTOCOL_VERSION_MAX) + { + /* use client's version */ + ssl->version = SSL_PROTOCOL_VERSION_MAX; + } + else if (version < SSL_PROTOCOL_MIN_VERSION) + { + ret = SSL_ERROR_INVALID_VERSION; + ssl_display_error(ret); + return ret; + } + add_packet(ssl, &buf[2], 3); ret = process_sslv23_client_hello(ssl); #else @@ -1259,6 +1288,14 @@ int basic_read(SSL *ssl, uint8_t **in_data) if (IS_SET_SSL_FLAG(SSL_RX_ENCRYPTED)) { ssl->cipher_info->decrypt(ssl->decrypt_ctx, buf, buf, read_len); + + if (ssl->version >= SSL_PROTOCOL_VERSION1_1 && + ssl->cipher_info->iv_size) + { + buf += ssl->cipher_info->iv_size; + read_len -= ssl->cipher_info->iv_size; + } + read_len = verify_digest(ssl, is_client ? SSL_CLIENT_READ : SSL_SERVER_READ, buf, read_len); @@ -1310,7 +1347,7 @@ int basic_read(SSL *ssl, uint8_t **in_data) case PT_APP_PROTOCOL_DATA: if (in_data) { - *in_data = ssl->bm_data; /* point to the work buffer */ + *in_data = buf; /* point to the work buffer */ (*in_data)[read_len] = 0; /* null terminate just in case */ } @@ -1414,12 +1451,8 @@ int send_change_cipher_spec(SSL *ssl) */ int send_finished(SSL *ssl) { - uint8_t *buf = ssl->bm_data; - - buf[0] = HS_FINISHED; - buf[1] = 0; - buf[2] = 0; - buf[3] = SSL_FINISHED_HASH_SIZE; + uint8_t buf[SSL_FINISHED_HASH_SIZE+4] = { + HS_FINISHED, 0, 0, SSL_FINISHED_HASH_SIZE }; /* now add the finished digest mac (12 bytes) */ finished_digest(ssl, @@ -1436,7 +1469,7 @@ int send_finished(SSL *ssl) #endif return send_packet(ssl, PT_HANDSHAKE_PROTOCOL, - NULL, SSL_FINISHED_HASH_SIZE+4); + buf, SSL_FINISHED_HASH_SIZE+4); } /** @@ -1516,9 +1549,8 @@ int send_alert(SSL *ssl, int error_code) /** * Process a client finished message. */ -int process_finished(SSL *ssl, int hs_len) +int process_finished(SSL *ssl, uint8_t *buf, int hs_len) { - uint8_t *buf = ssl->bm_data; int ret = SSL_OK; int is_client = IS_SET_SSL_FLAG(SSL_IS_CLIENT); int resume = IS_SET_SSL_FLAG(SSL_SESSION_RESUME); diff --git a/ssl/tls1.h b/ssl/tls1.h index 079613530b..b533096ee3 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -45,10 +45,9 @@ extern "C" { #include "crypto_misc.h" #define SSL_PROTOCOL_MIN_VERSION 0x31 /* TLS v1.0 */ -//#define SSL_PROTOCOL_MINOR_VERSION 0x02 /* TLS v1.1 */ -#define SSL_PROTOCOL_MINOR_VERSION 0x01 /* TLS v1.0 */ -//#define SSL_PROTOCOL_VERSION 0x32 /* TLS v1.1 */ -#define SSL_PROTOCOL_VERSION 0x31 /* TLS v1.1 */ +#define SSL_PROTOCOL_MINOR_VERSION 0x02 /* TLS v1.1 */ +#define SSL_PROTOCOL_VERSION_MAX 0x32 /* TLS v1.1 */ +#define SSL_PROTOCOL_VERSION1_1 0x32 /* TLS v1.1 */ #define SSL_RANDOM_SIZE 32 #define SSL_SECRET_SIZE 48 #define SSL_FINISHED_HASH_SIZE 12 @@ -236,7 +235,7 @@ int send_packet(SSL *ssl, uint8_t protocol, const uint8_t *in, int length); int do_svr_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len); int do_clnt_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len); -int process_finished(SSL *ssl, int hs_len); +int process_finished(SSL *ssl, uint8_t *buf, int hs_len); int process_sslv23_client_hello(SSL *ssl); int send_alert(SSL *ssl, int error_code); int send_finished(SSL *ssl); diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index 33aa1ad609..616c789762 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -51,7 +51,7 @@ EXP_FUNC SSL * STDCALL ssl_client_new(SSL_CTX *ssl_ctx, int client_fd, const uint8_t *session_id, uint8_t sess_id_size) { SSL *ssl = ssl_new(ssl_ctx, client_fd); - ssl->version = SSL_PROTOCOL_VERSION; + ssl->version = SSL_PROTOCOL_VERSION_MAX; /* try top version first */ if (session_id && ssl_ctx->num_sessions) { @@ -118,7 +118,7 @@ int do_clnt_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len) break; case HS_FINISHED: - ret = process_finished(ssl, hs_len); + ret = process_finished(ssl, buf, hs_len); disposable_free(ssl); /* free up some memory */ /* note: client renegotiation is not allowed after this */ break; @@ -234,8 +234,10 @@ static int process_server_hello(SSL *ssl) /* check that we are talking to a TLSv1 server */ uint8_t version = (buf[4] << 4) + buf[5]; - if (version > SSL_PROTOCOL_VERSION) - version = SSL_PROTOCOL_VERSION; + if (version > SSL_PROTOCOL_VERSION_MAX) + { + version = SSL_PROTOCOL_VERSION_MAX; + } else if (ssl->version < SSL_PROTOCOL_MIN_VERSION) { ret = SSL_ERROR_INVALID_VERSION; diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index 13305332c2..f374928f1b 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -103,7 +103,7 @@ int do_svr_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len) break; case HS_FINISHED: - ret = process_finished(ssl, hs_len); + ret = process_finished(ssl, buf, hs_len); disposable_free(ssl); /* free up some memory */ break; } @@ -125,8 +125,11 @@ static int process_client_hello(SSL *ssl) uint8_t version = (record_buf[1] << 4) + record_buf[2]; ssl->version = ssl->client_version = version; - if (version > SSL_PROTOCOL_VERSION) - ssl->version = SSL_PROTOCOL_VERSION; /* use client's version */ + if (version > SSL_PROTOCOL_VERSION_MAX) + { + /* use client's version instead */ + ssl->version = SSL_PROTOCOL_VERSION_MAX; + } else if (version < SSL_PROTOCOL_MIN_VERSION) /* old version supported? */ { ret = SSL_ERROR_INVALID_VERSION; @@ -196,13 +199,6 @@ int process_sslv23_client_hello(SSL *ssl) DISPLAY_BYTES(ssl, "received %d bytes", buf, read_len, read_len); - /* should be v3.1 (TLSv1) or better */ - ssl->version = (buf[3] << 4) + buf[4]; - if (ssl->version < SSL_PROTOCOL_MIN_VERSION) - { - return SSL_ERROR_INVALID_VERSION; - } - add_packet(ssl, buf, read_len); /* connection has gone, so die */ From 42cd25fa9da212fd74273499358af3b3947b722a Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 7 May 2011 00:10:20 +0000 Subject: [PATCH 177/301] Fixed closure alerts. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@208 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/tls1.c | 12 ++++++++---- ssl/tls1.h | 2 +- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/ssl/tls1.c b/ssl/tls1.c index 5a828e91a6..4bc71a21cc 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -247,8 +247,8 @@ EXP_FUNC void STDCALL ssl_free(SSL *ssl) return; /* only notify if we weren't notified first */ - if (!IS_SET_SSL_FLAG(SSL_RECEIVED_CLOSE_NOTIFY)) - /* spec says we must notify when we are dying */ + /* spec says we must notify when we are dying */ + if (!IS_SET_SSL_FLAG(SSL_SENT_CLOSE_NOTIFY)) send_alert(ssl, SSL_ALERT_CLOSE_NOTIFY); ssl_ctx = ssl->ssl_ctx; @@ -1021,6 +1021,7 @@ int send_packet(SSL *ssl, uint8_t protocol, const uint8_t *in, int length) } msg_length += length; + if (IS_SET_SSL_FLAG(SSL_TX_ENCRYPTED)) { int mode = IS_SET_SSL_FLAG(SSL_IS_CLIENT) ? @@ -1360,12 +1361,15 @@ int basic_read(SSL *ssl, uint8_t **in_data) buf[1] == SSL_ALERT_CLOSE_NOTIFY) { ret = SSL_CLOSE_NOTIFY; - SET_SSL_FLAG(SSL_RECEIVED_CLOSE_NOTIFY); + send_alert(ssl, SSL_ALERT_CLOSE_NOTIFY); + SET_SSL_FLAG(SSL_SENT_CLOSE_NOTIFY); } else + { ret = -buf[1]; + DISPLAY_ALERT(ssl, buf[1]); + } - DISPLAY_ALERT(ssl, buf[1]); break; default: diff --git a/ssl/tls1.h b/ssl/tls1.h index b533096ee3..55552afe75 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -65,7 +65,7 @@ extern "C" { #define SSL_SESSION_RESUME 0x0008 #define SSL_IS_CLIENT 0x0010 #define SSL_HAS_CERT_REQ 0x0020 -#define SSL_RECEIVED_CLOSE_NOTIFY 0x0040 +#define SSL_SENT_CLOSE_NOTIFY 0x0040 /* some macros to muck around with flag bits */ #define SET_SSL_FLAG(A) (ssl->flag |= A) From 6dd1ae9595056f0ff4150def1d6fead34578629d Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 7 May 2011 00:13:17 +0000 Subject: [PATCH 178/301] Updated changes. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@209 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- www/index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/www/index.html b/www/index.html index 0cd96b7511..3007e0c50e 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* Support for TLS 1.1\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* TLS v1.1 implemented and is enabled by default.\n* Closure alerts implemented correctly.\n* Fixed issue with ~SSLv23 hello versioning. \n \n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.4@@\n\n!!__SSL Library__\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n* Fixed variable length MAC issue as used by gnutls.\n* Fixed version issue when TLS >=1.1 is used.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 66c588d3ab2ec41736903be62ed5ab6971092d2f Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 18 Jun 2011 11:06:18 +0000 Subject: [PATCH 179/301] ensure that a compare with a non-null and null x509 field returns non-zero git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@210 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/asn1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ssl/asn1.c b/ssl/asn1.c index b30d89114e..171d3798e9 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -438,7 +438,7 @@ static int asn1_compare_dn_comp(const char *dn1, const char *dn2) if (dn1 == NULL && dn2 == NULL) ret = 0; else - ret = (dn1 && dn2) ? strcmp(dn1, dn2) : 0; + ret = (dn1 && dn2) ? strcmp(dn1, dn2) : 1; return ret; } From 96b65cdb96e09af83c2e4fe5057f5d57e707d873 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 24 Jun 2011 12:16:42 +0000 Subject: [PATCH 180/301] fixed timeout issue in axhttd, -fPIC enabled, pkcs8 enabled for server git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@211 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/makefile.conf | 2 +- httpd/axhttpd.c | 7 ++++++- ssl/Config.in | 2 +- ssl/loader.c | 8 ++++++-- ssl/test/perf_bigint.c | 2 ++ www/index.html | 4 ++-- 6 files changed, 18 insertions(+), 7 deletions(-) diff --git a/config/makefile.conf b/config/makefile.conf index 9b2373ccf4..59db122d27 100644 --- a/config/makefile.conf +++ b/config/makefile.conf @@ -100,7 +100,7 @@ LDSHARED = -shared # Linux ifndef CONFIG_PLATFORM_CYGWIN -# CFLAGS += -fPIC +CFLAGS += -fPIC # Cygwin else diff --git a/httpd/axhttpd.c b/httpd/axhttpd.c index d4b1f4926b..12039bc65e 100644 --- a/httpd/axhttpd.c +++ b/httpd/axhttpd.c @@ -266,6 +266,7 @@ int main(int argc, char *argv[]) /* main loop */ while (1) { + struct timeval tv = { 10, 0 }; FD_ZERO(&rfds); FD_ZERO(&wfds); rnum = wnum = -1; @@ -336,7 +337,11 @@ int main(int argc, char *argv[]) active = select(wnum > rnum ? wnum+1 : rnum+1, rnum != -1 ? &rfds : NULL, wnum != -1 ? &wfds : NULL, - NULL, NULL); + NULL, usedconns ? &tv : NULL); + + /* timeout? */ + if (active == 0) + continue; /* New connection? */ sp = servers; diff --git a/ssl/Config.in b/ssl/Config.in index b8cd8e4be7..8044418617 100644 --- a/ssl/Config.in +++ b/ssl/Config.in @@ -225,7 +225,7 @@ config CONFIG_SSL_USE_PKCS12 bool "Use PKCS8/PKCS12" default n if !CONFIG_SSL_FULL_MODE default y if CONFIG_SSL_FULL_MODE - depends on !CONFIG_SSL_SERVER_ONLY && !CONFIG_SSL_SKELETON_MODE +# depends on !CONFIG_SSL_SERVER_ONLY && !CONFIG_SSL_SKELETON_MODE help PKCS#12 certificates combine private keys and certificates together in one file. diff --git a/ssl/loader.c b/ssl/loader.c index 6009cba360..90231f3ed9 100644 --- a/ssl/loader.c +++ b/ssl/loader.c @@ -175,16 +175,18 @@ void ssl_obj_free(SSLObjLoader *ssl_obj) */ #ifdef CONFIG_SSL_HAS_PEM -#define NUM_PEM_TYPES 3 +#define NUM_PEM_TYPES 4 #define IV_SIZE 16 #define IS_RSA_PRIVATE_KEY 0 #define IS_ENCRYPTED_PRIVATE_KEY 1 -#define IS_CERTIFICATE 2 +#define IS_PRIVATE_KEY 2 +#define IS_CERTIFICATE 3 static const char * const begins[NUM_PEM_TYPES] = { "-----BEGIN RSA PRIVATE KEY-----", "-----BEGIN ENCRYPTED PRIVATE KEY-----", + "-----BEGIN PRIVATE KEY-----", "-----BEGIN CERTIFICATE-----", }; @@ -192,6 +194,7 @@ static const char * const ends[NUM_PEM_TYPES] = { "-----END RSA PRIVATE KEY-----", "-----END ENCRYPTED PRIVATE KEY-----", + "-----END PRIVATE KEY-----", "-----END CERTIFICATE-----", }; @@ -337,6 +340,7 @@ static int new_pem_obj(SSL_CTX *ssl_ctx, int is_cacert, char *where, break; case IS_ENCRYPTED_PRIVATE_KEY: + case IS_PRIVATE_KEY: obj_type = SSL_OBJ_PKCS8; break; diff --git a/ssl/test/perf_bigint.c b/ssl/test/perf_bigint.c index f092b9e23c..6336d1b4ca 100644 --- a/ssl/test/perf_bigint.c +++ b/ssl/test/perf_bigint.c @@ -35,6 +35,8 @@ #include #include #include + +#include "os_port.h" #include "ssl.h" /************************************************************************** diff --git a/www/index.html b/www/index.html index 3007e0c50e..aad53fa44c 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* TLS v1.1 implemented and is enabled by default.\n* Closure alerts implemented correctly.\n* Fixed issue with ~SSLv23 hello versioning. \n \n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.4@@\n\n!!__SSL Library__\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n* Fixed variable length MAC issue as used by gnutls.\n* Fixed version issue when TLS >=1.1 is used.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.1@@\n\n!!__SSL Library__\n* Enable ~PKCS8/12 option for server.\n* Issue where comparing a null and an empty string could return a false positive for cert check.\n* -fPIC added as a Linux compile option.\n\n!!__axhttpd__\n* Killing connections on timeout is guaranteed.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* TLS v1.1 implemented and is enabled by default.\n* Closure alerts implemented correctly.\n* Fixed issue with ~SSLv23 hello versioning. \n \n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.4@@\n\n!!__SSL Library__\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n* Fixed variable length MAC issue as used by gnutls.\n* Fixed version issue when TLS >=1.1 is used.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    @@ -7097,7 +7097,7 @@
    axTLS Embedded SSL
    http://axtls.cerocclub.com.au
    /***\nhttp://tiddlystyles.com/#theme:DevFire\nAuthor: Clint Checketts\n***/\n\n/*{{{*/\nbody {\nbackground: #000;\n}\n/*}}}*/\n/***\n!Link styles /% ============================================================= %/\n***/\n/*{{{*/\na,\na.button,\n#mainMenu a.button,\n#sidebarOptions .sliderPanel a{\n color: #ffbf00;\n border: 0;\n background: transparent;\n}\n\na:hover,\na.button:hover,\n#mainMenu a.button:hover,\n#sidebarOptions .sliderPanel a:hover\n#sidebarOptions .sliderPanel a:active{\n color: #ff7f00;\n border: 0;\n border-bottom: #ff7f00 1px dashed;\n background: transparent;\n text-decoration: none;\n}\n\n#displayArea .button.highlight{\n color: #ffbf00;\n background: #4c4c4c;\n}\n/*}}}*/\n/***\n!Header styles /% ============================================================= %/\n***/\n/*{{{*/\n.header{\n border-bottom: 2px solid #ffbf00;\n color: #fff;\n}\n\n.headerForeground a {\n color: #fff;\n}\n\n.header a:hover {\n border-bottom: 1px dashed #fff;\n}\n/*}}}*/\n/***\n!Main menu styles /% ============================================================= %/\n***/\n/*{{{*/\n#mainMenu {color: #fff;}\n#mainMenu h1{\n font-size: 1.1em;\n}\n#mainMenu li,#mainMenu ul{\n list-style: none;\n margin: 0;\n padding: 0;\n}\n/*}}}*/\n/***\n!Sidebar styles /% ============================================================= %/\n***/\n/*{{{*/\n#sidebar {\n right: 0;\n color: #fff;\n border: 2px solid #ffbf00;\n border-width: 0 0 2px 2px;\n}\n#sidebarOptions {\n background-color: #4c4c4c;\n padding: 0;\n}\n\n#sidebarOptions a{\n margin: 0;\n color: #ffbf00;\n border: 0;\n}\n#sidebarOptions a:hover {\n color: #4c4c4c;\n background-color: #ffbf00;\n\n}\n\n#sidebarOptions a:active {\n color: #ffbf00;\n background-color: transparent;\n}\n\n#sidebarOptions .sliderPanel {\n background-color: #333;\n margin: 0;\n}\n\n#sidebarTabs {background-color: #4c4c4c;}\n#sidebarTabs .tabSelected {\n padding: 3px 3px;\n cursor: default;\n color: #ffbf00;\n background-color: #666;\n}\n#sidebarTabs .tabUnselected {\n color: #ffbf00;\n background-color: #5f5f5f;\n padding: 0 4px;\n}\n\n#sidebarTabs .tabUnselected:hover,\n#sidebarTabs .tabContents {\n background-color: #666;\n}\n\n.listTitle{color: #FFF;}\n#sidebarTabs .tabContents a{\n color: #ffbf00;\n}\n\n#sidebarTabs .tabContents a:hover{\n color: #ff7f00;\n background: transparent;\n}\n\n#sidebarTabs .txtMoreTab .tabSelected,\n#sidebarTabs .txtMoreTab .tab:hover,\n#sidebarTabs .txtMoreTab .tabContents{\n color: #ffbf00;\n background: #4c4c4c;\n}\n\n#sidebarTabs .txtMoreTab .tabUnselected {\n color: #ffbf00;\n background: #5f5f5f;\n}\n\n.tab.tabSelected, .tab.tabSelected:hover{color: #ffbf00; border: 0; background-color: #4c4c4c;cursor:default;}\n.tab.tabUnselected {background-color: #666;}\n.tab.tabUnselected:hover{color:#ffbf00; border: 0;background-color: #4c4c4c;}\n.tabContents {\n background-color: #4c4c4c;\n border: 0;\n}\n.tabContents .tabContents{background: #666;}\n.tabContents .tabSelected{background: #666;}\n.tabContents .tabUnselected{background: #5f5f5f;}\n.tabContents .tab:hover{background: #666;}\n/*}}}*/\n/***\n!Message area styles /% ============================================================= %/\n***/\n/*{{{*/\n#messageArea {background-color: #666; color: #fff; border: 2px solid #ffbf00;}\n#messageArea a:link, #messageArea a:visited {color: #ffbf00; text-decoration:none;}\n#messageArea a:hover {color: #ff7f00;}\n#messageArea a:active {color: #ff7f00;}\n#messageArea .messageToolbar a{\n border: 1px solid #ffbf00;\n background: #4c4c4c;\n}\n/*}}}*/\n/***\n!Popup styles /% ============================================================= %/\n***/\n/*{{{*/\n.popup {color: #fff; background-color: #4c4c4c; border: 1px solid #ffbf00;}\n.popup li.disabled{color: #fff;}\n.popup a {color: #ffbf00; }\n.popup a:hover { background: transparent; color: #ff7f00; border: 0;}\n.popup hr {color: #ffbf00; background: #ffbf00;}\n/*}}}*/\n/***\n!Tiddler Display styles /% ============================================================= %/\n***/\n/*{{{*/\n.title{color: #fff;}\nh1, h2, h3, h4, h5 {\n color: #fff;\n background-color: transparent;\n border-bottom: 1px solid #333;\n}\n\n.subtitle{\n color: #666;\n}\n\n.viewer {color: #fff; }\n\n.viewer table{background: #666; color: #fff;}\n\n.viewer th {background-color: #996; color: #fff;}\n\n.viewer pre, .viewer code {color: #ddd; background-color: #4c4c4c; border: 1px solid #ffbf00;}\n\n.viewer hr {color: #666;}\n\n.tiddler .button {color: #4c4c4c;}\n.tiddler .button:hover { color: #ffbf00; background-color: #4c4c4c;}\n.tiddler .button:active {color: #ffbf00; background-color: #4c4c4c;}\n\n.toolbar {\n color: #4c4c4c;\n}\n\n.toolbar a.button,\n.toolbar a.button:hover,\n.toolbar a.button:active,\n.editorFooter a{\n border: 0;\n}\n\n.footer {\n color: #ddd;\n}\n\n.selected .footer {\n color: #888;\n}\n\n.highlight, .marked {\n color: #000;\n background-color: #ffe72f;\n}\n.editorFooter {\n color: #aaa;\n}\n\n.tab{\n-moz-border-radius-topleft: 3px;\n-moz-border-radius-topright: 3px;\n}\n\n.tagging,\n.tagged{\n background: #4c4c4c;\n border: 1px solid #4c4c4c; \n}\n\n.selected .tagging,\n.selected .tagged{\n background-color: #333;\n border: 1px solid #ffbf00;\n}\n\n.tagging .listTitle,\n.tagged .listTitle{\n color: #fff;\n}\n\n.tagging .button,\n.tagged .button{\n color: #ffbf00;\n border: 0;\n padding: 0;\n}\n\n.tagging .button:hover,\n.tagged .button:hover{\nbackground: transparent;\n}\n\n.selected .isTag .tagging.simple,\n.selected .tagged.simple,\n.isTag .tagging.simple,\n.tagged.simple {\n float: none;\n display: inline;\n border: 0;\n background: transparent;\n color: #fff;\n margin: 0;\n}\n\n.cascade {\n background: #4c4c4c;\n color: #ddd;\n border: 1px solid #ffbf00;\n}\n/*}}}*/
    -
    axhttpd is a small embedded web server using the axTLS library. It is based originally on the web server written by Doug Currie which is at http://www.hcsw.org/awhttpd.\n\n!@@bgcolor(#ff0000):color(#ffffff):axhttpd Features@@ \n\n!!__Basic Authentication__\n\nBasic Authentication uses a password file called ".htpasswd", in the directory to be protected. This file is formatted as the familiar colon-separated username/encrypted-password pair, records delimited by newlines. The protection does not carry over to subdirectories. The utility program htpasswd is included to help manually edit .htpasswd files.\n\nThe encryption of this password uses a proprietary algorithm due to the dependency of many crypt libraries on DES. An example is in [[/test_dir/no_http|https://97.74.112.97:8443/test_dir/no_http]] (username 'abcd', password is '1234').\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__SSL Protection__\n\nDirectories/files can be accessed using the 'http' or 'https' uri prefix. If normal http access for a directory needs to be disabled, then put "~SSLRequireSSL" into a '.htaccess' file in the directory to be protected. \n\nConversely, use "~SSLDenySSL" to deny access to directories via SSL.\n\nAn example is in [[/test_dir/no_http|http://97.74.112.97:8080/test_dir/no_http]] and [[/test_dir/no_ssl|https://97.74.112.97:8443/test_dir/no_ssl]].\n\nEntire directories can be denied access with a "Deny all" directive (regardless of SSL or authentication). An example is in [[/test_dir/bin|http://97.74.112.97:8080/test_dir/bin]]\n\n!!__CGI__\n\nMost of the CGI 1.1 variables are now placed into the script environment and should work as normal.\n\n!!__Lua and Lua Pages__\n\nThis is a small scripting language gaining popularity in embedded applications due to its small footprint and fast speed.\n\nLua has been incorporated into the build, so simply select it and it will automatically install. Try pointing your browser at [[test_main.html|http://97.74.112.97:8080/lua/test_main.html]] to see an example of Lua Pages.\n\n//Note: This is an mconf enabled configuration option.//\n\nThe readline development library may have to be downloaded: //yum install readline-devel//\n\n!!__Directory Listing__\n\nAn mconf option. Allow the files in directories to be displayed. An example is in [[/test_dir|http://97.74.112.97:8080/test_dir]]\n\n!!__Other Features__\n\n* Timeout - HTTP 1.1 allows for persistent connections. This is the time allowed for this connection in seconds.\n* Daemon - Puts the process in daemon mode. \n* SSL session cache size - The size of the session cache (a heavily loaded server should maintain many sessions). A session will save on expensive SSL handshaking.\n\n
    +
    axhttpd is a small embedded web server using the axTLS library. It is based originally on the web server written by Doug Currie which is at http://www.hcsw.org/awhttpd.\n\n!@@bgcolor(#ff0000):color(#ffffff):axhttpd Features@@ \n\n!!__Basic Authentication__\n\nBasic Authentication uses a password file called ".htpasswd", in the directory to be protected. This file is formatted as the familiar colon-separated username/encrypted-password pair, records delimited by newlines. The protection does not carry over to subdirectories. The utility program htpasswd is included to help manually edit .htpasswd files.\n\nThe encryption of this password uses a proprietary algorithm due to the dependency of many crypt libraries on DES. An example is in [[/test_dir/no_http|https://localhost/test_dir/no_http]] (username 'abcd', password is '1234').\n\n//Note: This is an mconf enabled configuration option.//\n\n!!__SSL Protection__\n\nDirectories/files can be accessed using the 'http' or 'https' uri prefix. If normal http access for a directory needs to be disabled, then put "~SSLRequireSSL" into a '.htaccess' file in the directory to be protected. \n\nConversely, use "~SSLDenySSL" to deny access to directories via SSL.\n\nAn example is in [[/test_dir/no_http|http://localhost/test_dir/no_http]] and [[/test_dir/no_ssl|https://localhost/test_dir/no_ssl]].\n\nEntire directories can be denied access with a "Deny all" directive (regardless of SSL or authentication). An example is in [[/test_dir/bin|http://localhost/test_dir/bin]]\n\n!!__CGI__\n\nMost of the CGI 1.1 variables are now placed into the script environment and should work as normal.\n\n!!__Lua and Lua Pages__\n\nThis is a small scripting language gaining popularity in embedded applications due to its small footprint and fast speed.\n\nLua has been incorporated into the build, so simply select it and it will automatically install. Try pointing your browser at [[test_main.html|http://localhost/lua/test_main.html]] to see an example of Lua Pages.\n\n//Note: This is an mconf enabled configuration option.//\n\nThe readline development library may have to be downloaded: //yum install readline-devel//\n\n!!__Directory Listing__\n\nAn mconf option. Allow the files in directories to be displayed. An example is in [[/test_dir|http://localhost/test_dir]]\n\n!!__Other Features__\n\n* Timeout - HTTP 1.1 allows for persistent connections. This is the time allowed for this connection in seconds.\n* Daemon - Puts the process in daemon mode. \n* SSL session cache size - The size of the session cache (a heavily loaded server should maintain many sessions). A session will save on expensive SSL handshaking.\n\n
    From f22e36ab564a08444a30b09f2bd243e048eebd93 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 24 Jun 2011 13:11:51 +0000 Subject: [PATCH 181/301] Added test for PKCS8 unencrypted PEM format. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@212 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/Config.in | 1 - ssl/test/ssltest.c | 12 ++++++++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/ssl/Config.in b/ssl/Config.in index 8044418617..e66ab7ca35 100644 --- a/ssl/Config.in +++ b/ssl/Config.in @@ -225,7 +225,6 @@ config CONFIG_SSL_USE_PKCS12 bool "Use PKCS8/PKCS12" default n if !CONFIG_SSL_FULL_MODE default y if CONFIG_SSL_FULL_MODE -# depends on !CONFIG_SSL_SERVER_ONLY && !CONFIG_SSL_SKELETON_MODE help PKCS#12 certificates combine private keys and certificates together in one file. diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 4dd1fca475..65c25c5b7f 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -1233,13 +1233,21 @@ int SSL_server_tests(void) goto cleanup; /* - * PKCS#8 key (unencrypted) + * PKCS#8 key (unencrypted DER format) */ - if ((ret = SSL_server_test("pkcs#8 unencrypted", "-cipher RC4-SHA", + if ((ret = SSL_server_test("pkcs#8 DER unencrypted", "-cipher RC4-SHA", DEFAULT_CERT, NULL, "../ssl/test/axTLS.unencrypted.p8", NULL, NULL, DEFAULT_SVR_OPTION))) goto cleanup; + /* + * PKCS#8 key (unencrypted PEM format) + */ + if ((ret = SSL_server_test("pkcs#8 PEM unencrypted", "-cipher RC4-SHA", + DEFAULT_CERT, NULL, "../ssl/test/axTLS.unencrypted_pem.p8", + NULL, NULL, DEFAULT_SVR_OPTION))) + goto cleanup; + /* * PKCS#12 key/certificate */ From 15ab963e13f6fea8f6dbe597daec36ac76a4dfd9 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 24 Jun 2011 21:29:50 +0000 Subject: [PATCH 182/301] fixed some mconf dependency issues git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@213 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/Config.in | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ssl/Config.in b/ssl/Config.in index e66ab7ca35..6f363dc13c 100644 --- a/ssl/Config.in +++ b/ssl/Config.in @@ -225,6 +225,7 @@ config CONFIG_SSL_USE_PKCS12 bool "Use PKCS8/PKCS12" default n if !CONFIG_SSL_FULL_MODE default y if CONFIG_SSL_FULL_MODE + depends on !CONFIG_SSL_SKELETON_MODE help PKCS#12 certificates combine private keys and certificates together in one file. @@ -317,6 +318,7 @@ config CONFIG_OPENSSL_COMPATIBLE config CONFIG_PERFORMANCE_TESTING bool "Build the bigint performance test tool" default n + depends on CONFIG_SSL_CERT_VERIFICATION help Used for performance testing of bigint. From 9c517f6351cbb9dd98a565a51086861b1036f5e3 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 15 Jul 2011 23:36:46 +0000 Subject: [PATCH 183/301] * Use RFC1123 format for date/time. * UTC/localtime issue with If-Modified-Since header. * Expires header added. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@214 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/proc.c | 41 ++++++++++++++++++++++++++++++----------- httpd/tdate_parse.c | 8 ++------ 2 files changed, 32 insertions(+), 17 deletions(-) diff --git a/httpd/proc.c b/httpd/proc.c index b8ba55df63..0419147a67 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -41,6 +41,7 @@ #define HTTP_VERSION "HTTP/1.1" static const char * index_file = "index.html"; +static const char * rfc1123_format = "%a, %d %b %Y %H:%M:%S GMT"; static int special_read(struct connstruct *cn, void *buf, size_t count); static int special_write(struct connstruct *cn, @@ -373,8 +374,11 @@ void procsendhead(struct connstruct *cn) { char buf[MAXREQUESTLENGTH]; struct stat stbuf; - time_t now = cn->timeout - CONFIG_HTTP_TIMEOUT; + time_t t_time; + struct tm *ptm; char date[32]; + char last_modified[32]; + char expires[32]; int file_exists; /* are we trying to access a file over the HTTP connection instead of a @@ -439,17 +443,26 @@ void procsendhead(struct connstruct *cn) return; } - strcpy(date, ctime(&now)); + + time(&t_time); + ptm = gmtime(&t_time); + strftime(date, sizeof(date), rfc1123_format, ptm); /* has the file been read before? */ - if (cn->if_modified_since != -1 && (cn->if_modified_since == 0 || - cn->if_modified_since >= stbuf.st_mtime)) + if (cn->if_modified_since != -1) + { - snprintf(buf, sizeof(buf), HTTP_VERSION" 304 Not Modified\nServer: " - "%s\nDate: %s\n", server_version, date); - special_write(cn, buf, strlen(buf)); - cn->state = STATE_WANT_TO_READ_HEAD; - return; + ptm = gmtime(&stbuf.st_mtime); + t_time = mktime(ptm); + + if (cn->if_modified_since >= t_time) + { + snprintf(buf, sizeof(buf), HTTP_VERSION" 304 Not Modified\nServer: " + "%s\nDate: %s\n\n", server_version, date); + special_write(cn, buf, strlen(buf)); + cn->state = STATE_WANT_TO_READ_HEAD; + return; + } } if (cn->reqtype == TYPE_HEAD) @@ -471,11 +484,17 @@ void procsendhead(struct connstruct *cn) return; } + ptm = gmtime(&stbuf.st_mtime); + strftime(last_modified, sizeof(last_modified), rfc1123_format, ptm); + t_time += CONFIG_HTTP_TIMEOUT; + ptm = gmtime(&t_time); + strftime(expires, sizeof(expires), rfc1123_format, ptm); + snprintf(buf, sizeof(buf), HTTP_VERSION" 200 OK\nServer: %s\n" "Content-Type: %s\nContent-Length: %ld\n" - "Date: %sLast-Modified: %s\n", server_version, + "Date: %s\nLast-Modified: %s\nExpires: %s\n\n", server_version, getmimetype(cn->actualfile), (long) stbuf.st_size, - date, ctime(&stbuf.st_mtime)); /* ctime() has a \n on the end */ + date, last_modified, expires); special_write(cn, buf, strlen(buf)); diff --git a/httpd/tdate_parse.c b/httpd/tdate_parse.c index 9124323846..7165bdebdc 100644 --- a/httpd/tdate_parse.c +++ b/httpd/tdate_parse.c @@ -89,13 +89,9 @@ time_t tdate_parse(const char* str) memset(&tm, 0, sizeof(struct tm)); /* wdy, DD mth YY HH:MM:SS GMT */ - if ((sscanf(str, "%3[a-zA-Z], %d %3[a-zA-Z] %d %d:%d:%d GMT", + if (sscanf(str, "%3[a-zA-Z], %d %3[a-zA-Z] %d %d:%d:%d GMT", str_wday, &tm_mday, str_mon, &tm_year, &tm_hour, &tm_min, - &tm_sec) == 7) || - /* wdy mth DD HH:MM:SS YY */ - (sscanf(str, "%3[a-zA-Z] %3[a-zA-Z] %d %d:%d:%d %d", - str_wday, str_mon, &tm_mday, &tm_hour, &tm_min, &tm_sec, - &tm_year) == 7)) + &tm_sec) == 7) { int8_t tm_wday = day_mon_map_search(str_wday, wday_tab, sizeof(wday_tab)/sizeof(struct day_mon_map)); From 2e0da63a796e73e588d507bfecee4d026a818eb7 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 29 Jul 2011 08:54:48 +0000 Subject: [PATCH 184/301] Fixed bi_export, change to makefile git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@215 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/makefile.conf | 2 +- crypto/bigint.c | 3 ++- www/index.html | 4 ++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/config/makefile.conf b/config/makefile.conf index 59db122d27..482f209ced 100644 --- a/config/makefile.conf +++ b/config/makefile.conf @@ -86,7 +86,7 @@ else # Not Win32 CFLAGS += -I$(AXTLS_HOME)/config -I$(AXTLS_HOME)/ssl -I$(AXTLS_HOME)/crypto LD=$(CC) -STRIP=strip +STRIP=$(CROSS)strip # Solaris ifdef CONFIG_PLATFORM_SOLARIS diff --git a/crypto/bigint.c b/crypto/bigint.c index 80a991b220..e9ca04cb99 100644 --- a/crypto/bigint.c +++ b/crypto/bigint.c @@ -723,10 +723,11 @@ void bi_export(BI_CTX *ctx, bigint *x, uint8_t *data, int size) if (k < 0) { - break; + goto buf_done; } } } +buf_done: bi_free(ctx, x); } diff --git a/www/index.html b/www/index.html index aad53fa44c..78728d4841 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,12 +7087,12 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.1@@\n\n!!__SSL Library__\n* Enable ~PKCS8/12 option for server.\n* Issue where comparing a null and an empty string could return a false positive for cert check.\n* -fPIC added as a Linux compile option.\n\n!!__axhttpd__\n* Killing connections on timeout is guaranteed.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* TLS v1.1 implemented and is enabled by default.\n* Closure alerts implemented correctly.\n* Fixed issue with ~SSLv23 hello versioning. \n \n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.4@@\n\n!!__SSL Library__\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n* Fixed variable length MAC issue as used by gnutls.\n* Fixed version issue when TLS >=1.1 is used.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.2@@\n\n!!__SSL Library__\n* bi_export could have a buffer overrun with incorrect input (thanks Gilles ~Boccon-Gibod - 3334305)\n\n!!__axhttpd__\n* ~RFC1123 time format used in the headers.\n* Expires heading added (current time + ~CONFIG_HTTP_TIMEOUT)\n* UTC/localtime issue with ~If-Modified-Since header.\n\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.1@@\n\n!!__SSL Library__\n* Allow reading of ~PKCS8/12 unencrypted keys in PEM format and mconf will allow the option in server mode (thanks Steve Bennett).\n* Issue where comparing a null and an empty string could return a false positive for cert check (thanks Gilles ~Boccon-Gibod - 3310885).\n* -fPIC added as a Linux compile option.\n\n!!__axhttpd__\n* Killing connections on session timeout is guaranteed.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* TLS v1.1 implemented and is enabled by default.\n* Closure alerts implemented correctly.\n* Fixed issue with ~SSLv23 hello versioning. \n \n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.4@@\n\n!!__SSL Library__\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n* Fixed variable length MAC issue as used by gnutls.\n* Fixed version issue when TLS >=1.1 is used.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    <div class='header' macro='gradient vert #390108 #900'>\n<div class='headerShadow'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n<div class='headerForeground'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n</div>\n<div id='mainMenu'>\n<div refresh='content' tiddler='MainMenu'></div>\n</div>\n<div id='sidebar'>\n<div id='sidebarOptions' refresh='content' tiddler='SideBarOptions'></div>\n<div id='sidebarTabs' refresh='content' force='true' tiddler='SideBarTabs'></div>\n</div>\n<div id='displayArea'>\n<div id='messageArea'></div>\n<div id='tiddlerDisplay'></div>\n</div>
    -
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n* axssl.lua - Lua sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!!!!Lua\n\n{{indent{{{{> [lua] ./axssl.lua <options>}}}\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n* The lua sample requires the luabit library from http://luaforge.net/projects/bit.\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* CGI has been removed from Win32 - it needs a lot more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    +
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n* axssl.lua - Lua sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!!!!Lua\n\n{{indent{{{{> [lua] ./axssl.lua <options>}}}\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n* The lua sample requires the luabit library from http://luaforge.net/projects/bit.\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* CGI has been removed from Win32 - it needs a lot more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    changes, notes and errata
    axTLS Embedded SSL
    http://axtls.cerocclub.com.au
    From cbd60876eb51ebe7d89f73e9b688ddfd118b50ef Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 29 Jul 2011 10:15:33 +0000 Subject: [PATCH 185/301] added -w command line option for axhttd fixed compilation error for axtlswrap git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@216 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- axtlswrap/axtlswrap.c | 1 + httpd/axhttpd.c | 19 ++++++++++++++----- www/index.html | 2 +- 3 files changed, 16 insertions(+), 6 deletions(-) diff --git a/axtlswrap/axtlswrap.c b/axtlswrap/axtlswrap.c index 5aa6675ab5..43b448eb79 100755 --- a/axtlswrap/axtlswrap.c +++ b/axtlswrap/axtlswrap.c @@ -41,6 +41,7 @@ #include #include #include +#include "os_port.h" #include "ssl.h" /* If nothing is received or sent in this many seconds, give up */ diff --git a/httpd/axhttpd.c b/httpd/axhttpd.c index 12039bc65e..9a94ab0e16 100644 --- a/httpd/axhttpd.c +++ b/httpd/axhttpd.c @@ -44,6 +44,7 @@ struct serverstruct *servers; struct connstruct *usedconns; struct connstruct *freeconns; const char * const server_version = "axhttpd/"AXTLS_VERSION; +static const char *webroot = CONFIG_HTTP_WEBROOT; static void addtoservers(int sd); static int openlistener(char *address, int port); @@ -182,9 +183,18 @@ int main(int argc, char *argv[]) continue; } - printf("%s: [-p [address:]httpport] [-s [address:]httpsport]\n", - argv[0]); - exit(0); + if (strcmp(argv[i], "-w") == 0 && argv[i+1] != NULL) + { + webroot = argv[i+1]; + i += 2; + continue; + } + + printf("%s:\n" + " [-p [address:]httpport]\n" + " [-s [address:]httpsport]\n" + " [-w webroot]\n", argv[0]); + exit(1); } for (i = 0; i < INITIAL_CONNECTION_SLOTS; i++) @@ -644,10 +654,9 @@ void removeconnection(struct connstruct *cn) /* * Change directories one way or the other. */ + static void ax_chdir(void) { - static char *webroot = CONFIG_HTTP_WEBROOT; - if (chdir(webroot)) { #ifdef CONFIG_HTTP_VERBOSE diff --git a/www/index.html b/www/index.html index 78728d4841..2ffb079387 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.2@@\n\n!!__SSL Library__\n* bi_export could have a buffer overrun with incorrect input (thanks Gilles ~Boccon-Gibod - 3334305)\n\n!!__axhttpd__\n* ~RFC1123 time format used in the headers.\n* Expires heading added (current time + ~CONFIG_HTTP_TIMEOUT)\n* UTC/localtime issue with ~If-Modified-Since header.\n\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.1@@\n\n!!__SSL Library__\n* Allow reading of ~PKCS8/12 unencrypted keys in PEM format and mconf will allow the option in server mode (thanks Steve Bennett).\n* Issue where comparing a null and an empty string could return a false positive for cert check (thanks Gilles ~Boccon-Gibod - 3310885).\n* -fPIC added as a Linux compile option.\n\n!!__axhttpd__\n* Killing connections on session timeout is guaranteed.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* TLS v1.1 implemented and is enabled by default.\n* Closure alerts implemented correctly.\n* Fixed issue with ~SSLv23 hello versioning. \n \n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.4@@\n\n!!__SSL Library__\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n* Fixed variable length MAC issue as used by gnutls.\n* Fixed version issue when TLS >=1.1 is used.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.3@@\n\n!!__SSL Library__\n* axtlswrap compilation error fixed.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.2@@\n\n!!__SSL Library__\n* bi_export could have a buffer overrun with incorrect input (thanks Gilles ~Boccon-Gibod - 3334305)\n\n!!__axhttpd__\n* ~RFC1123 time format used in the headers.\n* Expires heading added (current time + ~CONFIG_HTTP_TIMEOUT)\n* UTC/localtime issue with ~If-Modified-Since header.\n\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.1@@\n\n!!__SSL Library__\n* Allow reading of ~PKCS8/12 unencrypted keys in PEM format and mconf will allow the option in server mode (thanks Steve Bennett).\n* Issue where comparing a null and an empty string could return a false positive for cert check (thanks Gilles ~Boccon-Gibod - 3310885).\n* -fPIC added as a Linux compile option.\n\n!!__axhttpd__\n* Killing connections on session timeout is guaranteed.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* TLS v1.1 implemented and is enabled by default.\n* Closure alerts implemented correctly.\n* Fixed issue with ~SSLv23 hello versioning. \n \n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.4@@\n\n!!__SSL Library__\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n* Fixed variable length MAC issue as used by gnutls.\n* Fixed version issue when TLS >=1.1 is used.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From 92667aee8a34fd09eaeb3a98d6e2ea98a99c742b Mon Sep 17 00:00:00 2001 From: cameronrich Date: Wed, 24 Aug 2011 09:56:49 +0000 Subject: [PATCH 186/301] Removed Lua dependencies and made sure PHP can be run. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@217 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/Config.in | 25 +++++++++++-------------- httpd/axhttp.h | 3 --- httpd/proc.c | 41 +++++------------------------------------ 3 files changed, 16 insertions(+), 53 deletions(-) diff --git a/httpd/Config.in b/httpd/Config.in index 513d57ae30..1eff5a6950 100644 --- a/httpd/Config.in +++ b/httpd/Config.in @@ -65,7 +65,7 @@ config CONFIG_HTTP_HAS_CGI config CONFIG_HTTP_CGI_EXTENSIONS string "CGI File Extension(s)" - default ".lua,.lp" + default ".lua,.lp,.php" depends on CONFIG_HTTP_HAS_CGI help Tell axhhtpd what file extension(s) are used for CGI. @@ -83,29 +83,26 @@ config CONFIG_HTTP_ENABLE_LUA config CONFIG_HTTP_LUA_PREFIX string "Lua's Installation Prefix" - default "/usr/local" + default "/usr" depends on CONFIG_HTTP_ENABLE_LUA help - The location of Lua's installation prefix. This is also necessary for - Lua's cgi launcher application. - -config CONFIG_HTTP_LUA_CGI_LAUNCHER - string "CGI launcher location" - default "/bin/cgi.exe" if CONFIG_PLATFORM_CYGWIN - default "/bin/cgi" if !CONFIG_PLATFORM_CYGWIN - depends on CONFIG_HTTP_ENABLE_LUA - help - The location of LUA's CGI launcher application (after - the CONFIG_HTTP_LUA_PREFIX) + The location of Lua's installation prefix. config CONFIG_HTTP_BUILD_LUA bool "Build Lua" default n depends on CONFIG_HTTP_ENABLE_LUA help - Build Lua and install in /usr/local/bin + Build Lua and install in /usr/bin by default. +config CONFIG_HTTP_CGI_LAUNCHER + string "CGI launcher location" + default "/usr/bin/cgi.exe" + depends on CONFIG_HTTP_HAS_CGI + help + The location of the CGI launcher application (could be /usr/bin/php5). + The default is to use Lua's CGI launcher. endmenu config CONFIG_HTTP_DIRECTORIES diff --git a/httpd/axhttp.h b/httpd/axhttp.h index a741455b70..3b4b5a5bf3 100644 --- a/httpd/axhttp.h +++ b/httpd/axhttp.h @@ -92,9 +92,6 @@ struct connstruct #if defined(CONFIG_HTTP_HAS_CGI) uint8_t is_cgi; char cgicontenttype[MAXREQUESTLENGTH]; -#ifdef CONFIG_HTTP_ENABLE_LUA - uint8_t is_lua; -#endif int content_length; char remote_addr[MAXREQUESTLENGTH]; char uri_request[MAXREQUESTLENGTH]; diff --git a/httpd/proc.c b/httpd/proc.c index 0419147a67..ae238797cc 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -405,14 +405,7 @@ void procsendhead(struct connstruct *cn) #if defined(CONFIG_HTTP_HAS_CGI) if (file_exists != -1 && cn->is_cgi) { - if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) - { - /* A non-executable file, or directory? */ - send_error(cn, 403); - } - else - proccgi(cn); - + proccgi(cn); return; } #endif @@ -578,7 +571,7 @@ void procsendfile(struct connstruct *cn) static void proccgi(struct connstruct *cn) { int tpipe[2], spipe[2]; - char *myargs[2]; + char *myargs[3]; char cgienv[CGI_ARG_SIZE][MAXREQUESTLENGTH]; char * cgiptr[CGI_ARG_SIZE+4]; const char *type = "HEAD"; @@ -668,8 +661,9 @@ static void proccgi(struct connstruct *cn) } else /* Otherwise we can shutdown the read side of the sock */ shutdown(cn->networkdesc, 0); - myargs[0] = cn->actualfile; - myargs[1] = NULL; + myargs[0] = CONFIG_HTTP_CGI_LAUNCHER; + myargs[1] = cn->actualfile; + myargs[2] = NULL; /* * set the cgi args. A url is defined by: @@ -721,11 +715,6 @@ static void proccgi(struct connstruct *cn) if (cn->is_ssl) strcpy(cgienv[cgi_index++], "HTTPS=on"); -#ifdef CONFIG_PLATFORM_CYGWIN - /* TODO: find out why Lua needs this */ - strcpy(cgienv[cgi_index++], "PATH=/usr/bin"); -#endif - if (cgi_index >= CGI_ARG_SIZE) { printf("Content-type: text/plain\n\nToo many CGI args (%d, %d)\n", @@ -761,14 +750,7 @@ static char * cgi_filetype_match(struct connstruct *cn, const char *fn) t += strlen(tp->ext); if (*t == '/' || *t == '\0') - { -#ifdef CONFIG_HTTP_ENABLE_LUA - if (strcmp(tp->ext, ".lua") == 0 || strcmp(tp->ext, ".lp") == 0) - cn->is_lua = 1; -#endif - return t; - } else return NULL; @@ -786,9 +768,6 @@ static void decode_path_info(struct connstruct *cn, char *path_info) #if defined(CONFIG_HTTP_HAS_CGI) cn->is_cgi = 0; -#endif -#ifdef CONFIG_HTTP_ENABLE_LUA - cn->is_lua = 0; #endif *cn->uri_request = '\0'; *cn->uri_path_info = '\0'; @@ -1005,16 +984,6 @@ static void buildactualfile(struct connstruct *cn) *cp = 0; } #endif - -#if defined(CONFIG_HTTP_ENABLE_LUA) - /* - * Use the lua launcher if this file has a lua extension. Put this at the - * end as we need the directory name. - */ - if (cn->is_lua) - sprintf(cn->actualfile, "%s%s", CONFIG_HTTP_LUA_PREFIX, - CONFIG_HTTP_LUA_CGI_LAUNCHER); -#endif } static int sanitizefile(const char *buf) From c0eb269cf755a7813cbfaef4df126e6cc322ea5a Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 9 Sep 2011 10:48:17 +0000 Subject: [PATCH 187/301] Config change to remove exe suffix. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@218 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/Config.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd/Config.in b/httpd/Config.in index 1eff5a6950..486ae804df 100644 --- a/httpd/Config.in +++ b/httpd/Config.in @@ -98,7 +98,7 @@ config CONFIG_HTTP_BUILD_LUA config CONFIG_HTTP_CGI_LAUNCHER string "CGI launcher location" - default "/usr/bin/cgi.exe" + default "/usr/bin/cgi" depends on CONFIG_HTTP_HAS_CGI help The location of the CGI launcher application (could be /usr/bin/php5). From cd28f3caaee1ae2172f9a9afff18049d8822a6dd Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 30 Sep 2011 09:41:05 +0000 Subject: [PATCH 188/301] Fixed issue with non-blocking client mode. Added php mime type. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@219 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- httpd/proc.c | 2 ++ ssl/tls1_clnt.c | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd/proc.c b/httpd/proc.c index ae238797cc..07c92c2b3f 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -1203,6 +1203,8 @@ static const char *getmimetype(const char *name) return "text/html"; else if (strstr(name, ".css")) return "text/css"; + else if (strstr(name, ".php")) + return "application/x-http-php"; else return "application/octet-stream"; } diff --git a/ssl/tls1_clnt.c b/ssl/tls1_clnt.c index 616c789762..196b40ed3c 100644 --- a/ssl/tls1_clnt.c +++ b/ssl/tls1_clnt.c @@ -158,9 +158,10 @@ int do_client_connect(SSL *ssl) if (ret < SSL_OK) break; } + + ssl->hs_status = ret; /* connected? */ } - ssl->hs_status = ret; /* connected? */ return ret; } From 1378f8a78fe1138cc9230f89d27d0d171cb35bc5 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 30 Sep 2011 09:54:21 +0000 Subject: [PATCH 189/301] Updated index.html and the default linux config. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@220 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- config/linuxconfig | 19 ++++++++++++------- www/index.html | 2 +- 2 files changed, 13 insertions(+), 8 deletions(-) diff --git a/config/linuxconfig b/config/linuxconfig index 1a9f04f5d9..d78eaa7619 100644 --- a/config/linuxconfig +++ b/config/linuxconfig @@ -14,8 +14,10 @@ PREFIX="/usr/local" CONFIG_STRIP_UNWANTED_SECTIONS=y # CONFIG_VISUAL_STUDIO_7_0 is not set # CONFIG_VISUAL_STUDIO_8_0 is not set +# CONFIG_VISUAL_STUDIO_10_0 is not set CONFIG_VISUAL_STUDIO_7_0_BASE="" CONFIG_VISUAL_STUDIO_8_0_BASE="" +CONFIG_VISUAL_STUDIO_10_0_BASE="" CONFIG_EXTRA_CFLAGS_OPTIONS="" CONFIG_EXTRA_LDFLAGS_OPTIONS="" @@ -38,20 +40,20 @@ CONFIG_SSL_X509_CERT_LOCATION="" CONFIG_SSL_X509_COMMON_NAME="" CONFIG_SSL_X509_ORGANIZATION_NAME="" CONFIG_SSL_X509_ORGANIZATION_UNIT_NAME="" -CONFIG_SSL_ENABLE_V23_HANDSHAKE=y +# CONFIG_SSL_ENABLE_V23_HANDSHAKE is not set CONFIG_SSL_HAS_PEM=y CONFIG_SSL_USE_PKCS12=y CONFIG_SSL_EXPIRY_TIME=24 -CONFIG_X509_MAX_CA_CERTS=4 -CONFIG_SSL_MAX_CERTS=2 +CONFIG_X509_MAX_CA_CERTS=150 +CONFIG_SSL_MAX_CERTS=3 # CONFIG_SSL_CTX_MUTEXING is not set CONFIG_USE_DEV_URANDOM=y # CONFIG_WIN32_USE_CRYPTO_LIB is not set # CONFIG_OPENSSL_COMPATIBLE is not set # CONFIG_PERFORMANCE_TESTING is not set # CONFIG_SSL_TEST is not set -CONFIG_AXHTTPD=y # CONFIG_AXTLSWRAP is not set +CONFIG_AXHTTPD=y # # Axhttpd Configuration @@ -67,11 +69,11 @@ CONFIG_HTTP_TIMEOUT=300 # CGI # CONFIG_HTTP_HAS_CGI=y -CONFIG_HTTP_CGI_EXTENSIONS=".lua,.lp" +CONFIG_HTTP_CGI_EXTENSIONS=".lua,.lp,.php" CONFIG_HTTP_ENABLE_LUA=y -CONFIG_HTTP_LUA_PREFIX="/usr/local" -CONFIG_HTTP_LUA_CGI_LAUNCHER="/bin/cgi" +CONFIG_HTTP_LUA_PREFIX="/usr" # CONFIG_HTTP_BUILD_LUA is not set +CONFIG_HTTP_CGI_LAUNCHER="/usr/bin/cgi" CONFIG_HTTP_DIRECTORIES=y CONFIG_HTTP_HAS_AUTHORIZATION=y # CONFIG_HTTP_HAS_IPV6 is not set @@ -119,3 +121,6 @@ SQU_KARATSUBA_THRESH=0 CONFIG_BIGINT_SLIDING_WINDOW=y CONFIG_BIGINT_SQUARE=y # CONFIG_BIGINT_CHECK_ON is not set +CONFIG_INTEGER_32BIT=y +# CONFIG_INTEGER_16BIT is not set +# CONFIG_INTEGER_8BIT is not set diff --git a/www/index.html b/www/index.html index 2ffb079387..88be682713 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.3@@\n\n!!__SSL Library__\n* axtlswrap compilation error fixed.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.2@@\n\n!!__SSL Library__\n* bi_export could have a buffer overrun with incorrect input (thanks Gilles ~Boccon-Gibod - 3334305)\n\n!!__axhttpd__\n* ~RFC1123 time format used in the headers.\n* Expires heading added (current time + ~CONFIG_HTTP_TIMEOUT)\n* UTC/localtime issue with ~If-Modified-Since header.\n\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.1@@\n\n!!__SSL Library__\n* Allow reading of ~PKCS8/12 unencrypted keys in PEM format and mconf will allow the option in server mode (thanks Steve Bennett).\n* Issue where comparing a null and an empty string could return a false positive for cert check (thanks Gilles ~Boccon-Gibod - 3310885).\n* -fPIC added as a Linux compile option.\n\n!!__axhttpd__\n* Killing connections on session timeout is guaranteed.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* TLS v1.1 implemented and is enabled by default.\n* Closure alerts implemented correctly.\n* Fixed issue with ~SSLv23 hello versioning. \n \n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.4@@\n\n!!__SSL Library__\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n* Fixed variable length MAC issue as used by gnutls.\n* Fixed version issue when TLS >=1.1 is used.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.4@@\n\n!!__axhttpd__\n* Allow other CGI applications (such as PHP) to call HTML files from their command line.\n* Added PHP mime type\n* Fixed issue with non-blocking client connections not working properly (thanks Richard Titmuss).\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.3@@\n\n!!__SSL Library__\n* axtlswrap compilation error fixed.\n\n!!__axhttpd__\n* added '-w' command-line option to set the webroot directory.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.2@@\n\n!!__SSL Library__\n* bi_export could have a buffer overrun with incorrect input (thanks Gilles ~Boccon-Gibod - 3334305)\n\n!!__axhttpd__\n* ~RFC1123 time format used in the headers.\n* Expires heading added (current time + ~CONFIG_HTTP_TIMEOUT)\n* UTC/localtime issue with ~If-Modified-Since header.\n\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.1@@\n\n!!__SSL Library__\n* Allow reading of ~PKCS8/12 unencrypted keys in PEM format and mconf will allow the option in server mode (thanks Steve Bennett).\n* Issue where comparing a null and an empty string could return a false positive for cert check (thanks Gilles ~Boccon-Gibod - 3310885).\n* -fPIC added as a Linux compile option.\n\n!!__axhttpd__\n* Killing connections on session timeout is guaranteed.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* TLS v1.1 implemented and is enabled by default.\n* Closure alerts implemented correctly.\n* Fixed issue with ~SSLv23 hello versioning. \n \n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.4@@\n\n!!__SSL Library__\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n* Fixed variable length MAC issue as used by gnutls.\n* Fixed version issue when TLS >=1.1 is used.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From ffa4da45ee50d29d4c1311f77f2b0298a502ea4a Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 10 Feb 2012 10:31:02 +0000 Subject: [PATCH 190/301] Fix in asn1_get_printable string Buffer overflow vulnerability in proc.c Possible double memory release on invalid certificates. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@221 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/crypto_misc.c | 6 ++++-- httpd/proc.c | 8 +++++--- ssl/asn1.c | 17 ++++++++++------- ssl/loader.c | 13 +++++++++---- www/index.html | 2 +- 5 files changed, 29 insertions(+), 17 deletions(-) diff --git a/crypto/crypto_misc.c b/crypto/crypto_misc.c index 8e7cbf9c5d..92e24c951a 100644 --- a/crypto/crypto_misc.c +++ b/crypto/crypto_misc.c @@ -348,13 +348,15 @@ EXP_FUNC int STDCALL base64_decode(const char *in, int len, y = t = 0; } + + if (z >= *outlen) /* check that we don't go past the output buffer */ + goto error; } if (y != 0) goto error; - if (outlen) - *outlen = z; + *outlen = z; ret = 0; error: diff --git a/httpd/proc.c b/httpd/proc.c index 07c92c2b3f..32a72c7e5e 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -152,7 +152,7 @@ static int procheadelem(struct connstruct *cn, char *buf) else if (strcasecmp(buf, "Authorization:") == 0 && strncmp(value, "Basic ", 6) == 0) { - int size; + int size = sizeof(cn->authorization); if (base64_decode(&value[6], strlen(&value[6]), (uint8_t *)cn->authorization, &size)) cn->authorization[0] = 0; /* error */ @@ -1051,7 +1051,8 @@ static int check_digest(char *salt, const char *msg_passwd) { uint8_t b256_salt[MAXREQUESTLENGTH]; uint8_t real_passwd[MD5_SIZE]; - int salt_size; + int salt_size = sizeof(b256_salt); + int password_size = sizeof(real_passwd); char *b64_passwd; uint8_t md5_result[MD5_SIZE]; MD5_CTX ctx; @@ -1064,7 +1065,8 @@ static int check_digest(char *salt, const char *msg_passwd) if (base64_decode(salt, strlen(salt), b256_salt, &salt_size)) return -1; - if (base64_decode(b64_passwd, strlen(b64_passwd), real_passwd, NULL)) + if (base64_decode(b64_passwd, strlen(b64_passwd), real_passwd, + &password_size)) return -1; /* very simple MD5 crypt algorithm, but then the salt we use is large */ diff --git a/ssl/asn1.c b/ssl/asn1.c index 171d3798e9..92ed7d11f8 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -288,19 +288,20 @@ static int asn1_get_oid_x520(const uint8_t *buf, int *offset) static int asn1_get_printable_str(const uint8_t *buf, int *offset, char **str) { int len = X509_NOT_OK; + int asn1_type = buf[*offset]; /* some certs have this awful crud in them for some reason */ - if (buf[*offset] != ASN1_PRINTABLE_STR && - buf[*offset] != ASN1_PRINTABLE_STR2 && - buf[*offset] != ASN1_TELETEX_STR && - buf[*offset] != ASN1_IA5_STR && - buf[*offset] != ASN1_UNICODE_STR) + if (buf[asn1_type] != ASN1_PRINTABLE_STR && + buf[asn1_type] != ASN1_PRINTABLE_STR2 && + buf[asn1_type] != ASN1_TELETEX_STR && + buf[asn1_type] != ASN1_IA5_STR && + buf[asn1_type] != ASN1_UNICODE_STR) goto end_pnt_str; (*offset)++; len = get_asn1_length(buf, offset); - if (buf[*offset - 1] == ASN1_UNICODE_STR) + if (buf[asn1_type - 1] == ASN1_UNICODE_STR) { int i; *str = (char *)malloc(len/2+1); /* allow for null */ @@ -330,7 +331,7 @@ int asn1_name(const uint8_t *cert, int *offset, char *dn[]) { int ret = X509_NOT_OK; int dn_type; - char *tmp = NULL; + char *tmp; if (asn1_next_obj(cert, offset, ASN1_SEQUENCE) < 0) goto end_name; @@ -343,6 +344,8 @@ int asn1_name(const uint8_t *cert, int *offset, char *dn[]) (dn_type = asn1_get_oid_x520(cert, offset)) < 0) goto end_name; + tmp = NULL; + if (asn1_get_printable_str(cert, offset, &tmp) < 0) { free(tmp); diff --git a/ssl/loader.c b/ssl/loader.c index 90231f3ed9..18f3347f8a 100644 --- a/ssl/loader.c +++ b/ssl/loader.c @@ -259,6 +259,7 @@ static int pem_decrypt(const char *where, const char *end, /* turn base64 into binary */ pem_size = (int)(end-start); + ssl_obj->len = sizeof(ssl_obj->buf); if (base64_decode(start, pem_size, ssl_obj->buf, &ssl_obj->len) != 0) goto error; @@ -326,11 +327,15 @@ static int new_pem_obj(SSL_CTX *ssl_ctx, int is_cacert, char *where, goto error; } } - else if (base64_decode(start, pem_size, - ssl_obj->buf, &ssl_obj->len) != 0) + else { - ret = SSL_ERROR_BAD_CERTIFICATE; - goto error; + ssl_obj->len = pem_size; + if (base64_decode(start, pem_size, + ssl_obj->buf, &ssl_obj->len) != 0) + { + ret = SSL_ERROR_BAD_CERTIFICATE; + goto error; + } } switch (i) diff --git a/www/index.html b/www/index.html index 88be682713..7055794fe6 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.4@@\n\n!!__axhttpd__\n* Allow other CGI applications (such as PHP) to call HTML files from their command line.\n* Added PHP mime type\n* Fixed issue with non-blocking client connections not working properly (thanks Richard Titmuss).\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.3@@\n\n!!__SSL Library__\n* axtlswrap compilation error fixed.\n\n!!__axhttpd__\n* added '-w' command-line option to set the webroot directory.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.2@@\n\n!!__SSL Library__\n* bi_export could have a buffer overrun with incorrect input (thanks Gilles ~Boccon-Gibod - 3334305)\n\n!!__axhttpd__\n* ~RFC1123 time format used in the headers.\n* Expires heading added (current time + ~CONFIG_HTTP_TIMEOUT)\n* UTC/localtime issue with ~If-Modified-Since header.\n\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.1@@\n\n!!__SSL Library__\n* Allow reading of ~PKCS8/12 unencrypted keys in PEM format and mconf will allow the option in server mode (thanks Steve Bennett).\n* Issue where comparing a null and an empty string could return a false positive for cert check (thanks Gilles ~Boccon-Gibod - 3310885).\n* -fPIC added as a Linux compile option.\n\n!!__axhttpd__\n* Killing connections on session timeout is guaranteed.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* TLS v1.1 implemented and is enabled by default.\n* Closure alerts implemented correctly.\n* Fixed issue with ~SSLv23 hello versioning. \n \n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.4@@\n\n!!__SSL Library__\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n* Fixed variable length MAC issue as used by gnutls.\n* Fixed version issue when TLS >=1.1 is used.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.4@@\n\n!!__axhttpd__\n* Allow other CGI applications (such as PHP) to call HTML files from their command line.\n\n!!__SSL Library__\n* Fixed memory leak with invalid certificates (thanks Jon Trauntvein)\n* Fixed issue with non-blocking client connections not working properly (thanks Richard Titmuss).\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.3@@\n\n!!__SSL Library__\n* axtlswrap compilation error fixed.\n\n!!__axhttpd__\n* added '-w' command-line option to set the webroot directory.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.2@@\n\n!!__SSL Library__\n* bi_export could have a buffer overrun with incorrect input (thanks Gilles ~Boccon-Gibod - 3334305)\n\n!!__axhttpd__\n* ~RFC1123 time format used in the headers.\n* Expires heading added (current time + ~CONFIG_HTTP_TIMEOUT)\n* UTC/localtime issue with ~If-Modified-Since header.\n\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.1@@\n\n!!__SSL Library__\n* Allow reading of ~PKCS8/12 unencrypted keys in PEM format and mconf will allow the option in server mode (thanks Steve Bennett).\n* Issue where comparing a null and an empty string could return a false positive for cert check (thanks Gilles ~Boccon-Gibod - 3310885).\n* -fPIC added as a Linux compile option.\n\n!!__axhttpd__\n* Killing connections on session timeout is guaranteed.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* TLS v1.1 implemented and is enabled by default.\n* Closure alerts implemented correctly.\n* Fixed issue with ~SSLv23 hello versioning. \n \n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.4@@\n\n!!__SSL Library__\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n* Fixed variable length MAC issue as used by gnutls.\n* Fixed version issue when TLS >=1.1 is used.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From af155d91d9605de98989770e7ef03b7033ce9f7c Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 11 Feb 2012 11:30:45 +0000 Subject: [PATCH 191/301] Some fixes after going through the test harness git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@222 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/crypto_misc.c | 7 ++++++- ssl/asn1.c | 44 ++++++++++++++++++++++---------------------- ssl/loader.c | 2 +- 3 files changed, 29 insertions(+), 24 deletions(-) diff --git a/crypto/crypto_misc.c b/crypto/crypto_misc.c index 92e24c951a..0902fab05b 100644 --- a/crypto/crypto_misc.c +++ b/crypto/crypto_misc.c @@ -349,14 +349,19 @@ EXP_FUNC int STDCALL base64_decode(const char *in, int len, y = t = 0; } - if (z >= *outlen) /* check that we don't go past the output buffer */ + /* check that we don't go past the output buffer */ + if (outlen && z >= *outlen) + { + printf("Stuff %d, %d\n", z, *outlen); goto error; + } } if (y != 0) goto error; *outlen = z; + ret = 0; error: diff --git a/ssl/asn1.c b/ssl/asn1.c index 92ed7d11f8..f3e17a37ba 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -291,34 +291,34 @@ static int asn1_get_printable_str(const uint8_t *buf, int *offset, char **str) int asn1_type = buf[*offset]; /* some certs have this awful crud in them for some reason */ - if (buf[asn1_type] != ASN1_PRINTABLE_STR && - buf[asn1_type] != ASN1_PRINTABLE_STR2 && - buf[asn1_type] != ASN1_TELETEX_STR && - buf[asn1_type] != ASN1_IA5_STR && - buf[asn1_type] != ASN1_UNICODE_STR) + if (asn1_type != ASN1_PRINTABLE_STR && + asn1_type != ASN1_PRINTABLE_STR2 && + asn1_type != ASN1_TELETEX_STR && + asn1_type != ASN1_IA5_STR && + asn1_type != ASN1_UNICODE_STR) goto end_pnt_str; - (*offset)++; - len = get_asn1_length(buf, offset); + (*offset)++; + len = get_asn1_length(buf, offset); - if (buf[asn1_type - 1] == ASN1_UNICODE_STR) - { - int i; - *str = (char *)malloc(len/2+1); /* allow for null */ + if (asn1_type == ASN1_UNICODE_STR) + { + int i; + *str = (char *)malloc(len/2+1); /* allow for null */ - for (i = 0; i < len; i += 2) - (*str)[i/2] = buf[*offset + i + 1]; + for (i = 0; i < len; i += 2) + (*str)[i/2] = buf[*offset + i + 1]; - (*str)[len/2] = 0; /* null terminate */ - } - else - { - *str = (char *)malloc(len+1); /* allow for null */ - memcpy(*str, &buf[*offset], len); - (*str)[len] = 0; /* null terminate */ - } + (*str)[len/2] = 0; /* null terminate */ + } + else + { + *str = (char *)malloc(len+1); /* allow for null */ + memcpy(*str, &buf[*offset], len); + (*str)[len] = 0; /* null terminate */ + } - *offset += len; + *offset += len; end_pnt_str: return len; diff --git a/ssl/loader.c b/ssl/loader.c index 18f3347f8a..333fb18e9c 100644 --- a/ssl/loader.c +++ b/ssl/loader.c @@ -259,7 +259,6 @@ static int pem_decrypt(const char *where, const char *end, /* turn base64 into binary */ pem_size = (int)(end-start); - ssl_obj->len = sizeof(ssl_obj->buf); if (base64_decode(start, pem_size, ssl_obj->buf, &ssl_obj->len) != 0) goto error; @@ -315,6 +314,7 @@ static int new_pem_obj(SSL_CTX *ssl_ctx, int is_cacert, char *where, /* 4/3 bigger than what we need but so what */ ssl_obj->buf = (uint8_t *)calloc(1, pem_size); + ssl_obj->len = pem_size; if (i == IS_RSA_PRIVATE_KEY && strstr(start, "Proc-Type:") && From 5fcb19810a0543738196933ea18d2e1b5116343e Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 11 Feb 2012 11:32:48 +0000 Subject: [PATCH 192/301] removed diagnostic statement git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@223 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/crypto_misc.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/crypto/crypto_misc.c b/crypto/crypto_misc.c index 0902fab05b..9d7710d26a 100644 --- a/crypto/crypto_misc.c +++ b/crypto/crypto_misc.c @@ -350,11 +350,8 @@ EXP_FUNC int STDCALL base64_decode(const char *in, int len, } /* check that we don't go past the output buffer */ - if (outlen && z >= *outlen) - { - printf("Stuff %d, %d\n", z, *outlen); + if (z >= *outlen) goto error; - } } if (y != 0) From c0074b3044c9628509288b780d36add7541156db Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sat, 25 Feb 2012 08:07:12 +0000 Subject: [PATCH 193/301] Fixed issue with session id's in the future git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@224 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/tls1.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/ssl/tls1.c b/ssl/tls1.c index 4bc71a21cc..25405c825c 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -1667,8 +1667,10 @@ SSL_SESSION *ssl_session_update(int max_sessions, SSL_SESSION *ssl_sessions[], { if (ssl_sessions[i]) { - /* kill off any expired sessions */ - if (tm > ssl_sessions[i]->conn_time + SSL_EXPIRY_TIME) + /* kill off any expired sessions (including those in + the future) */ + if ((tm > ssl_sessions[i]->conn_time + SSL_EXPIRY_TIME) || + (tm < ssl_sessions[i]->conn_time)) { session_free(ssl_sessions, i); continue; @@ -1712,13 +1714,9 @@ SSL_SESSION *ssl_session_update(int max_sessions, SSL_SESSION *ssl_sessions[], } /* ok, we've used up all of our sessions. So blow the oldest session away */ - if (oldest_sess != NULL) - { - oldest_sess->conn_time = tm; - memset(oldest_sess->session_id, 0, sizeof(SSL_SESSION_ID_SIZE)); - memset(oldest_sess->master_secret, 0, sizeof(SSL_SECRET_SIZE)); - } - + oldest_sess->conn_time = tm; + memset(oldest_sess->session_id, 0, sizeof(SSL_SESSION_ID_SIZE)); + memset(oldest_sess->master_secret, 0, sizeof(SSL_SECRET_SIZE)); SSL_CTX_UNLOCK(ssl->ssl_ctx->mutex); return oldest_sess; } From fec170a640ffcf2cc77e0c5f87428c67604fb49f Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 1 Jun 2012 11:23:00 +0000 Subject: [PATCH 194/301] fixed issue with buffer limit 1 less than it should have been git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@225 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/crypto_misc.c | 3 +-- www/index.html | 4 ++-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/crypto/crypto_misc.c b/crypto/crypto_misc.c index 9d7710d26a..9a9a4f957c 100644 --- a/crypto/crypto_misc.c +++ b/crypto/crypto_misc.c @@ -350,7 +350,7 @@ EXP_FUNC int STDCALL base64_decode(const char *in, int len, } /* check that we don't go past the output buffer */ - if (z >= *outlen) + if (z > *outlen) goto error; } @@ -358,7 +358,6 @@ EXP_FUNC int STDCALL base64_decode(const char *in, int len, goto error; *outlen = z; - ret = 0; error: diff --git a/www/index.html b/www/index.html index 7055794fe6..91ac4ff4e0 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,12 +7087,12 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.4@@\n\n!!__axhttpd__\n* Allow other CGI applications (such as PHP) to call HTML files from their command line.\n\n!!__SSL Library__\n* Fixed memory leak with invalid certificates (thanks Jon Trauntvein)\n* Fixed issue with non-blocking client connections not working properly (thanks Richard Titmuss).\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.3@@\n\n!!__SSL Library__\n* axtlswrap compilation error fixed.\n\n!!__axhttpd__\n* added '-w' command-line option to set the webroot directory.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.2@@\n\n!!__SSL Library__\n* bi_export could have a buffer overrun with incorrect input (thanks Gilles ~Boccon-Gibod - 3334305)\n\n!!__axhttpd__\n* ~RFC1123 time format used in the headers.\n* Expires heading added (current time + ~CONFIG_HTTP_TIMEOUT)\n* UTC/localtime issue with ~If-Modified-Since header.\n\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.1@@\n\n!!__SSL Library__\n* Allow reading of ~PKCS8/12 unencrypted keys in PEM format and mconf will allow the option in server mode (thanks Steve Bennett).\n* Issue where comparing a null and an empty string could return a false positive for cert check (thanks Gilles ~Boccon-Gibod - 3310885).\n* -fPIC added as a Linux compile option.\n\n!!__axhttpd__\n* Killing connections on session timeout is guaranteed.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* TLS v1.1 implemented and is enabled by default.\n* Closure alerts implemented correctly.\n* Fixed issue with ~SSLv23 hello versioning. \n \n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.4@@\n\n!!__SSL Library__\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n* Fixed variable length MAC issue as used by gnutls.\n* Fixed version issue when TLS >=1.1 is used.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.6@@\n\n!!__SSL Library__\n* Fixed issue where the stdint typedefs were not imported by default (stdint.h had to be included explicity) (thanks Anthony G. Basile)\n* Fixed RNG initialization issue where client library was performed incorrectly (thanks Gilles Boccon~-Gibod). \n\n!!__axhttpd__\n* Now compiles properly under TCP/IP v6.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.5@@\n\n!!__SSL Library__\n* Fixed possible buffer overflow when doing base64 decoding (thanks Emil Kvarnhammar).\n* Fixed unicode parsing error in certificates (thanks Eric Hu)\n\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.4@@\n\n!!__axhttpd__\n* Allow other CGI applications (such as PHP) to call HTML files from their command line.\n\n!!__SSL Library__\n* Fixed memory leak with invalid certificates (thanks Jon Trauntvein)\n* Fixed issue with non-blocking client connections not working properly (thanks Richard Titmuss).\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.3@@\n\n!!__SSL Library__\n* axtlswrap compilation error fixed.\n\n!!__axhttpd__\n* added '-w' command-line option to set the webroot directory.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.2@@\n\n!!__SSL Library__\n* bi_export could have a buffer overrun with incorrect input (thanks Gilles ~Boccon-Gibod - 3334305)\n\n!!__axhttpd__\n* ~RFC1123 time format used in the headers.\n* Expires heading added (current time + ~CONFIG_HTTP_TIMEOUT)\n* UTC/localtime issue with ~If-Modified-Since header.\n\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.1@@\n\n!!__SSL Library__\n* Allow reading of ~PKCS8/12 unencrypted keys in PEM format and mconf will allow the option in server mode (thanks Steve Bennett).\n* Issue where comparing a null and an empty string could return a false positive for cert check (thanks Gilles ~Boccon-Gibod - 3310885).\n* -fPIC added as a Linux compile option.\n\n!!__axhttpd__\n* Killing connections on session timeout is guaranteed.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* TLS v1.1 implemented and is enabled by default.\n* Closure alerts implemented correctly.\n* Fixed issue with ~SSLv23 hello versioning. \n \n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.4@@\n\n!!__SSL Library__\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n* Fixed variable length MAC issue as used by gnutls.\n* Fixed version issue when TLS >=1.1 is used.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    <div class='header' macro='gradient vert #390108 #900'>\n<div class='headerShadow'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n<div class='headerForeground'>\n<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;\n<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>\n</div>\n</div>\n<div id='mainMenu'>\n<div refresh='content' tiddler='MainMenu'></div>\n</div>\n<div id='sidebar'>\n<div id='sidebarOptions' refresh='content' tiddler='SideBarOptions'></div>\n<div id='sidebarTabs' refresh='content' force='true' tiddler='SideBarTabs'></div>\n</div>\n<div id='displayArea'>\n<div id='messageArea'></div>\n<div id='tiddlerDisplay'></div>\n</div>
    -
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n* axssl.lua - Lua sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!!!!Lua\n\n{{indent{{{{> [lua] ./axssl.lua <options>}}}\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n* The lua sample requires the luabit library from http://luaforge.net/projects/bit.\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* CGI has been removed from Win32 - it needs a lot more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    +
    !@@bgcolor(#ff0000):color(#ffffff):axTLS Quick Start Guide@@\n\nThis is a guide to get a small SSL web-server up and running quickly.\n\n!!__Introduction__\n\nThe axTLS project is an SSL client/server library using the ~TLSv1 protocol. It is designed to be small and fast, and is suited to embedded projects. A web server is included.\n\nThe basic web server + SSL library is around 60-70kB and is configurable for features or size.\n\n!!__Compilation__\n\nAll platforms require GNU make. This means on Win32 that Cygwin needs to be installed with "make" and various developer options selected.\n\nConfiguration now uses a tool called "mconf" which gives a nice way to configure options (similar to what is used in ~BusyBox and the Linux kernel).\n\nYou should be able to compile axTLS simply by extracting it, change into the extracted directory and typing:\n\n{{indent{{{{> make}}}\n\nSelect your platform type, save the configuration, exit, and then type "make" again.\n\nIf all goes well, you should end up with an executable called "axhttpd" (or axhttpd.exe) in the //_stage// directory.\n\nTo play with all the various axTLS options, type:\n\n{{indent{{{{> make menuconfig}}}\n\nSave the new configuration and rebuild.\n\n!!__Running it__\n\nTo run it, go to the //_stage// directory, and type (as superuser):\n\n{{indent{{{{> axhttpd}}}\n\nNote: you may have to set your ~LD_LIBRARY_PATH - e.g. go to //_stage// and type //export ~LD_LIBRARY_PATH=`pwd`//\n\nAnd then point your browser at https://127.0.0.1 And you should see a this html page with a padlock appearing on your browser. or type http://127.0.0.1 to see the same page unencrypted.\n\n!!__The axssl utilities__\n\nThe axssl suite of tools are the SSL test tools in the various language bindings. They are:\n\n* axssl - C sample\n* axssl.csharp - C# sample\n* axssl.vbnet - VB.NET sample\n* axtls.jar - Java sample\n* axssl.pl - Perl sample\n* axssl.lua - Lua sample\n\nAll the tools have identical command-line parameters. e.g. to run something interesting:\n\n{{indent{{{{> axssl s_server -verify -CAfile ../ssl/test/axTLS.ca_x509}}}\n\nand\n\n{{indent{{{{> axssl s_client -cert ../ssl/test/axTLS.x509_1024 -key ../ssl/test/axTLS.key_1024 -reconnect}}}\n\n!!!!C#\n\nIf building under Linux or other non-Win32 platforms, Mono must be installed and the executable is run as:\n\n{{indent{{{{> mono axssl.csharp.exe ...}}}\n\n!!!!Java\n\nThe java version is run as:\n\n{{indent{{{{> java -jar axtls.jar <options>}}}\n\n!!!!Perl\n\n{{indent{{{{> [perl] ./axssl.pl <options>}}}\n\nIf running under Win32, be sure to use the correct version of Perl (i.e. ~ActiveState's version works ok).\n\n!!!!Lua\n\n{{indent{{{{> [lua] ./axssl.lua <options>}}}\n\n!__Known Issues__\n\n* Firefox doesn't handle legacy ~SSLv2 at all well. Disabling ~SSLv2 still initiates a ~SSLv23 handshake (v1.5). And continuous pressing of the "Reload" page instigates a change to ~SSLv3 for some reason (even though the TLS 1.0 option is selected). This will cause a "Firefox and <server> cannot communicate securely because they have no common encryption algorithms" (v1.5), or "Firefox can't connect to <server> because the site uses a security protocol which isn't enabled" (v2.0). See bugzilla issues 343543 and 359484 (Comment #7). It's all broken (hopefully fixed soon).\n* Perl/Java bindings don't work on 64 bit Linux machines. I can't even compile the latest version of Perl on an ~AMD64 box (using ~FC3).\n* Java 1.4 or better is required for the Java interfaces.\n* Processes that fork can't use session resumption unless some form of IPC is used.\n* Ensure libperl.so and libaxtls.so are in the shared library path when running with the perl bindings. A way to do this is with:\n\n{{indent{{{{> export LD_LIBRARY_PATH=`perl -e 'use Config; print $Config{archlib};'`/CORE:.}}}\n* The lua sample requires the luabit library from http://luaforge.net/projects/bit.\n\n!!!!Win32 issues\n\n* Be careful about doing .NET executions on network drives - .NET complains with security exceptions on the binary. //TODO: Add a manifest file to prevent this.//\n* CGI has been removed from Win32 - it needs a lot more work to get it right.\n* The default Microsoft .NET SDK is v2.0.50727. Download from: http://msdn.microsoft.com/netframework/downloads/updates/default.aspx.\n\n!!!!Solaris issues\n\n* mconf doesn't work well - some manual tweaking is required for string values.\n* GNU make is required and needs to be in $PATH.\n* To get swig's library dependencies to work (and for the C library to be found), I needed to type:\n\n{{indent{{{{> export LD_LIBRARY_PATH=/usr/local/gcc-3.3.1/lib:.}}}\n\n!!!!Cygwin issues\n\n* The bindings all compile but don't run under Cygwin with the exception of Perl. This is due to win32 executables being incompatible with Cygwin libraries.\n\n
    changes, notes and errata
    axTLS Embedded SSL
    http://axtls.cerocclub.com.au
    From 8ac626444412980da2268abb30d4240534c6ef22 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 8 Jun 2012 10:42:11 +0000 Subject: [PATCH 195/301] looks like some stuff didn't get checked in git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@226 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/crypto.h | 3 +- crypto/crypto_misc.c | 70 ++++++++++++++++++++------------------------ crypto/os_int.h | 67 ++++++++++++++++++++++++++++++++++++++++++ httpd/axhttpd.c | 9 ++++-- httpd/htpasswd.c | 2 +- ssl/asn1.c | 4 +-- ssl/os_port.h | 15 +--------- ssl/tls1.c | 1 + ssl/tls1.h | 1 + 9 files changed, 113 insertions(+), 59 deletions(-) create mode 100644 crypto/os_int.h diff --git a/crypto/crypto.h b/crypto/crypto.h index c6f186cf97..8a314a3321 100644 --- a/crypto/crypto.h +++ b/crypto/crypto.h @@ -217,7 +217,8 @@ void RSA_print(const RSA_CTX *ctx); /************************************************************************** * RNG declarations **************************************************************************/ -EXP_FUNC void STDCALL RNG_initialize(const uint8_t *seed_buf, int size); +EXP_FUNC void STDCALL RNG_initialize(void); +EXP_FUNC void STDCALL RNG_custom_init(const uint8_t *seed_buf, int size); EXP_FUNC void STDCALL RNG_terminate(void); EXP_FUNC void STDCALL get_random(int num_rand_bytes, uint8_t *rand_data); void get_random_NZ(int num_rand_bytes, uint8_t *rand_data); diff --git a/crypto/crypto_misc.c b/crypto/crypto_misc.c index 9a9a4f957c..1dea121d99 100644 --- a/crypto/crypto_misc.c +++ b/crypto/crypto_misc.c @@ -56,7 +56,6 @@ static HCRYPTPROV gCryptProv; static uint8_t entropy_pool[ENTROPY_POOL_SIZE]; #endif -static int rng_ref_count; const char * const unsupported_str = "Error: Feature not supported\n"; #ifndef CONFIG_SSL_SKELETON_MODE @@ -102,46 +101,44 @@ int get_file(const char *filename, uint8_t **buf) * - On Linux use /dev/urandom * - If none of these work then use a custom RNG. */ -EXP_FUNC void STDCALL RNG_initialize(const uint8_t *seed_buf, int size) +EXP_FUNC void STDCALL RNG_initialize() { - if (rng_ref_count == 0) - { #if !defined(WIN32) && defined(CONFIG_USE_DEV_URANDOM) - rng_fd = ax_open("/dev/urandom", O_RDONLY); + rng_fd = ax_open("/dev/urandom", O_RDONLY); #elif defined(WIN32) && defined(CONFIG_WIN32_USE_CRYPTO_LIB) - if (!CryptAcquireContext(&gCryptProv, - NULL, NULL, PROV_RSA_FULL, 0)) + if (!CryptAcquireContext(&gCryptProv, + NULL, NULL, PROV_RSA_FULL, 0)) + { + if (GetLastError() == NTE_BAD_KEYSET && + !CryptAcquireContext(&gCryptProv, + NULL, + NULL, + PROV_RSA_FULL, + CRYPT_NEWKEYSET)) { - if (GetLastError() == NTE_BAD_KEYSET && - !CryptAcquireContext(&gCryptProv, - NULL, - NULL, - PROV_RSA_FULL, - CRYPT_NEWKEYSET)) - { - printf("CryptoLib: %x\n", unsupported_str, GetLastError()); - exit(1); - } + printf("CryptoLib: %x\n", unsupported_str, GetLastError()); + exit(1); } -#else - int i; - uint32_t seed_addr_val = (uint32_t)&seed_buf; - uint32_t *ep = (uint32_t *)entropy_pool; - - /* help start the entropy with the user's private key - this is - a number that should be hard to find, due to the fact that it - relies on knowing the private key */ - memcpy(entropy_pool, seed_buf, ENTROPY_POOL_SIZE); - srand((long)entropy_pool); + } +#else + /* start of with a stack to copy across */ + int i; + memcpy(entropy_pool, &i, ENTROPY_POOL_SIZE); + srand(&i); +#endif +} - /* mix it up a little with a stack address */ - for (i = 0; i < ENTROPY_POOL_SIZE/4; i++) - ep[i] ^= seed_addr_val; +/** + * If no /dev/urandom, then initialise the RNG with something interesting. + */ +EXP_FUNC void STDCALL RNG_custom_init(const uint8_t *seed_buf, int size) +{ +#if defined(WIN32) || defined(CONFIG_WIN32_USE_CRYPTO_LIB) + int i; + for (i = 0; i < ENTROPY_POOL_SIZE && i < size; i++) + entropy_pool[i] ^= seed_buf[i]; #endif - } - - rng_ref_count++; } /** @@ -149,14 +146,11 @@ EXP_FUNC void STDCALL RNG_initialize(const uint8_t *seed_buf, int size) */ EXP_FUNC void STDCALL RNG_terminate(void) { - if (--rng_ref_count == 0) - { #ifndef WIN32 - close(rng_fd); + close(rng_fd); #elif defined(CONFIG_WIN32_USE_CRYPTO_LIB) - CryptReleaseContext(gCryptProv, 0); + CryptReleaseContext(gCryptProv, 0); #endif - } } /** diff --git a/crypto/os_int.h b/crypto/os_int.h new file mode 100644 index 0000000000..8788567238 --- /dev/null +++ b/crypto/os_int.h @@ -0,0 +1,67 @@ +/* + * Copyright (c) 2012, Cameron Rich + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of the axTLS project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +/** + * @file os_int.h + * + * Ensure a consistent bit size + */ + +#ifndef HEADER_OS_INT_H +#define HEADER_OS_INT_H + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(WIN32) +typedef UINT8 uint8_t; +typedef INT8 int8_t; +typedef UINT16 uint16_t; +typedef INT16 int16_t; +typedef UINT32 uint32_t; +typedef INT32 int32_t; +typedef UINT64 uint64_t; +typedef INT64 int64_t; +#else /* Not Win32 */ + +#ifdef CONFIG_PLATFORM_SOLARIS +#include +#else +#include +#endif /* Not Solaris */ + +#endif /* Not Win32 */ + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/httpd/axhttpd.c b/httpd/axhttpd.c index 9a94ab0e16..ce57dbb9d2 100644 --- a/httpd/axhttpd.c +++ b/httpd/axhttpd.c @@ -453,7 +453,7 @@ static void addtoservers(int sd) static void handlenewconnection(int listenfd, int is_ssl) { struct sockaddr_in6 their_addr; - int tp = sizeof(their_addr); + socklen_t tp = sizeof(their_addr); char ipbuf[100]; int connfd = accept(listenfd, (struct sockaddr *)&their_addr, &tp); @@ -506,8 +506,11 @@ static int openlistener(char *address, int port) my_addr.sin6_family = AF_INET6; my_addr.sin6_port = htons(port); - my_addr.sin6_addr.s_addr = address == NULL ? - INADDR_ANY : iinet_addr(address); + + if (address == NULL) + my_addr.sin6_addr = in6addr_any; + else + inet_pton(AF_INET6, address, &my_addr.sin6_addr); #endif setsockopt(sd, SOL_SOCKET, SO_REUSEADDR, &tp, sizeof(tp)); diff --git a/httpd/htpasswd.c b/httpd/htpasswd.c index 8fe571ab7b..7c99abf1e4 100644 --- a/httpd/htpasswd.c +++ b/httpd/htpasswd.c @@ -120,7 +120,7 @@ int main(int argc, char *argv[]) exit(1); } - RNG_initialize((uint8_t *)pw, sizeof(pw)); + RNG_initialize(); get_random(MD5_SIZE, md5_salt); RNG_terminate(); base64_encode(md5_salt, MD5_SIZE, b64_salt, sizeof(b64_salt)); diff --git a/ssl/asn1.c b/ssl/asn1.c index f3e17a37ba..b082275b2e 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -160,8 +160,8 @@ int asn1_get_private_key(const uint8_t *buf, int len, RSA_CTX **rsa_ctx) return X509_INVALID_PRIV_KEY; } - /* initialise the RNG */ - RNG_initialize(buf, len); + /* Use the private key to mix up the RNG if possible. */ + RNG_custom_init(buf, len); mod_len = asn1_get_int(buf, &offset, &modulus); pub_len = asn1_get_int(buf, &offset, &pub_exp); diff --git a/ssl/os_port.h b/ssl/os_port.h index af71651a8e..1742868d5b 100644 --- a/ssl/os_port.h +++ b/ssl/os_port.h @@ -41,6 +41,7 @@ extern "C" { #endif +#include "os_int.h" #include #if defined(WIN32) @@ -114,14 +115,6 @@ extern "C" { #pragma comment(lib, "WS2_32.lib") #pragma comment(lib, "AdvAPI32.lib") -typedef UINT8 uint8_t; -typedef INT8 int8_t; -typedef UINT16 uint16_t; -typedef INT16 int16_t; -typedef UINT32 uint32_t; -typedef INT32 int32_t; -typedef UINT64 uint64_t; -typedef INT64 int64_t; typedef int socklen_t; EXP_FUNC void STDCALL gettimeofday(struct timeval* t,void* timezone); @@ -130,12 +123,6 @@ EXP_FUNC int STDCALL getdomainname(char *buf, int buf_size); #else /* Not Win32 */ -#ifdef CONFIG_PLATFORM_SOLARIS -#include -#else -#include -#endif /* Not Solaris */ - #include #include #include diff --git a/ssl/tls1.c b/ssl/tls1.c index 25405c825c..407798d590 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -166,6 +166,7 @@ EXP_FUNC SSL_CTX *STDCALL ssl_ctx_new(uint32_t options, int num_sessions) { SSL_CTX *ssl_ctx = (SSL_CTX *)calloc(1, sizeof (SSL_CTX)); ssl_ctx->options = options; + RNG_initialize(); if (load_key_certs(ssl_ctx) < 0) { diff --git a/ssl/tls1.h b/ssl/tls1.h index 55552afe75..5a5d654e61 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -42,6 +42,7 @@ extern "C" { #include "version.h" #include "crypto.h" +#include "os_int.h" #include "crypto_misc.h" #define SSL_PROTOCOL_MIN_VERSION 0x31 /* TLS v1.0 */ From 24384a37a4c773340e8a9351f22c2c3c4730b3f9 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 1 Jul 2012 10:57:25 +0000 Subject: [PATCH 196/301] Changed order of when os_int.h is imported git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@227 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/tls1.h | 3 ++- www/index.html | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/ssl/tls1.h b/ssl/tls1.h index 5a5d654e61..414a173438 100755 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -41,8 +41,9 @@ extern "C" { #endif #include "version.h" -#include "crypto.h" +#include "config.h" #include "os_int.h" +#include "crypto.h" #include "crypto_misc.h" #define SSL_PROTOCOL_MIN_VERSION 0x31 /* TLS v1.0 */ diff --git a/www/index.html b/www/index.html index 91ac4ff4e0..2c5f2bbfdf 100755 --- a/www/index.html +++ b/www/index.html @@ -7087,7 +7087,7 @@
    changes, notes and errata
    Type the text for 'YourName'
    -
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.6@@\n\n!!__SSL Library__\n* Fixed issue where the stdint typedefs were not imported by default (stdint.h had to be included explicity) (thanks Anthony G. Basile)\n* Fixed RNG initialization issue where client library was performed incorrectly (thanks Gilles Boccon~-Gibod). \n\n!!__axhttpd__\n* Now compiles properly under TCP/IP v6.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.5@@\n\n!!__SSL Library__\n* Fixed possible buffer overflow when doing base64 decoding (thanks Emil Kvarnhammar).\n* Fixed unicode parsing error in certificates (thanks Eric Hu)\n\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.4@@\n\n!!__axhttpd__\n* Allow other CGI applications (such as PHP) to call HTML files from their command line.\n\n!!__SSL Library__\n* Fixed memory leak with invalid certificates (thanks Jon Trauntvein)\n* Fixed issue with non-blocking client connections not working properly (thanks Richard Titmuss).\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.3@@\n\n!!__SSL Library__\n* axtlswrap compilation error fixed.\n\n!!__axhttpd__\n* added '-w' command-line option to set the webroot directory.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.2@@\n\n!!__SSL Library__\n* bi_export could have a buffer overrun with incorrect input (thanks Gilles ~Boccon-Gibod - 3334305)\n\n!!__axhttpd__\n* ~RFC1123 time format used in the headers.\n* Expires heading added (current time + ~CONFIG_HTTP_TIMEOUT)\n* UTC/localtime issue with ~If-Modified-Since header.\n\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.1@@\n\n!!__SSL Library__\n* Allow reading of ~PKCS8/12 unencrypted keys in PEM format and mconf will allow the option in server mode (thanks Steve Bennett).\n* Issue where comparing a null and an empty string could return a false positive for cert check (thanks Gilles ~Boccon-Gibod - 3310885).\n* -fPIC added as a Linux compile option.\n\n!!__axhttpd__\n* Killing connections on session timeout is guaranteed.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* TLS v1.1 implemented and is enabled by default.\n* Closure alerts implemented correctly.\n* Fixed issue with ~SSLv23 hello versioning. \n \n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.4@@\n\n!!__SSL Library__\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n* Fixed variable length MAC issue as used by gnutls.\n* Fixed version issue when TLS >=1.1 is used.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    +
    @@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.8@@\n\n!!__SSL Library__\n* Fixed issue where the stdint typedefs were not imported by default (stdint.h had to be included explicity) (thanks Anthony G. Basile)\n\n!!__axhttpd__\n* The password hash broke due to an over zealous buffer overflow check. \n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.6@@\n\n!!__SSL Library__\n* Fixed issue where the stdint typedefs were not imported by default (stdint.h had to be included explicity) (thanks Anthony G. Basile)\n* Fixed RNG initialization issue where client library was performed incorrectly (thanks Gilles Boccon~-Gibod). \n\n!!__axhttpd__\n* Now compiles properly under TCP/IP v6.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.5@@\n\n!!__SSL Library__\n* Fixed possible buffer overflow when doing base64 decoding (thanks Emil Kvarnhammar).\n* Fixed unicode parsing error in certificates (thanks Eric Hu)\n\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.4@@\n\n!!__axhttpd__\n* Allow other CGI applications (such as PHP) to call HTML files from their command line.\n\n!!__SSL Library__\n* Fixed memory leak with invalid certificates (thanks Jon Trauntvein)\n* Fixed issue with non-blocking client connections not working properly (thanks Richard Titmuss).\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.3@@\n\n!!__SSL Library__\n* axtlswrap compilation error fixed.\n\n!!__axhttpd__\n* added '-w' command-line option to set the webroot directory.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.2@@\n\n!!__SSL Library__\n* bi_export could have a buffer overrun with incorrect input (thanks Gilles ~Boccon-Gibod - 3334305)\n\n!!__axhttpd__\n* ~RFC1123 time format used in the headers.\n* Expires heading added (current time + ~CONFIG_HTTP_TIMEOUT)\n* UTC/localtime issue with ~If-Modified-Since header.\n\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.1@@\n\n!!__SSL Library__\n* Allow reading of ~PKCS8/12 unencrypted keys in PEM format and mconf will allow the option in server mode (thanks Steve Bennett).\n* Issue where comparing a null and an empty string could return a false positive for cert check (thanks Gilles ~Boccon-Gibod - 3310885).\n* -fPIC added as a Linux compile option.\n\n!!__axhttpd__\n* Killing connections on session timeout is guaranteed.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.4.0@@\n\n!!__SSL Library__\n* TLS v1.1 implemented and is enabled by default.\n* Closure alerts implemented correctly.\n* Fixed issue with ~SSLv23 hello versioning. \n \n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.4@@\n\n!!__SSL Library__\n* SSL 2.0 client hello is turned off by default as per RFC 4346 Appendix E.\n* Client determines the cipher suite selected rather than the server as per RFC 4346 7.4.1.2.\n* Guard against timing HMAC timing attacks as per RFC 4346 6.2.3.2.\n* Fixed ~SOCKET_WRITE buffer issue (thanks Hardy Griech - 3177419)\n* Fixed variable length MAC issue as used by gnutls.\n* Fixed version issue when TLS >=1.1 is used.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.2@@\n\n!!__SSL Library__\n* Loading of PEM certificate bundles now loads CA certs properly.\n* ssl_client_new() can now be broken up into an ssl_client_new() and successive ssl_read()'s now by setting the ~SSL_CONNECT_IN_PARTS as an option in ssl_ctx_new().\n* Non-blocked mode is now not a requirement but calls may still be blocked.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.1@@\n\n!!__SSL Library__\n* Certificate bundles which contain "invalid" certificates (i.e. invalid digests types etc) are ignored rather than cause failure.\n\n!!__axhttpd__\n* ~HTTPv1.0 packets close a connection upon completion.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.3.0@@\n\n!!__SSL Library__\n* Close notify is now sent as an error code from ssl_read(). Server code should be modified to check for ~SSL_CLOSE_NOTIFY (thanks to Eric Hu - 3132700).\n* regular_square() issue fixed (3078672)\n* partial_multiply() removed and merged with regular_multiply() (3078372).\n* Invalid session id size now returns ~SSL_ERROR_INVALID_SESSION (thanks to Hardy Griech - 3072881)\n* q-dash issue with Barrett reduction fixed (thanks to Hardy Griech - 3079291).\n* PEM file detection now looks for "-BEGIN" in any part of the file rather than at the start (3123838).\n* 8/16/32 bit native int sizes can be selected in configuration.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.7@@\n\n!!__SSL Library__\n* A fix to find_max_exp_index() (thanks to Hardy Griech).\n* Check is made to get_cipher_info() if the appropriate cipher is not found (thanks to Hardy Griech).\n* Extra x509_free() removed from do_client_connect().\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.5@@\n\n!!__SSL Library__\n* The custom RNG updated to use an entropy pool (with better hooks to use counters).\n\n!!__axhttpd__\n* Headers are case insensitive (thanks to Joe Pruett for this and the following).\n* Child zombie issue fixed.\n* EOF on ~POSTs fixed.\n* Expect is ignored.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.4@@\n\n!!__SSL Library__\n* Client renegotiation now results in an error. This is the result of a security flaw described in this paper http://extendedsubset.com/Renegotiating_TLS.pdf, and also is explained in detail here http://www.cupfighter.net/index.php/2009/11/tls-renegotiation-attack/.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.3@@\n\n!!__SSL Library__\n* v3 certificates with ~SANs now supports (thanks to Carsten Sørensen).\n* axtlswrap added - a port of sslwrap (thanks to Steve Bennett)\n\n!!__axhttpd__\n* shutdown() called before socket close in CGI (thanks to Tom Brown)\n* command-line parameters to specify the http/https port.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.2@@\n\n!!__axhttpd__\n* File uploads over 1kB (but under MAXPOSTDATASIZE) are now supported.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.1@@\n\n!!__SSL Library__\n* Certificate verification now works for Firefox.\n* Extended the openssl API.\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.2.0@@\n\n!!__SSL Library__\n* A self-signed certificate will be verified as ok provided that that it is on the certificate authority list.\n* Certificates are not verified when added as certificate authorities (since self-signed and expired certificates can be added to browsers etc)\n\n@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.9@@\n\n!!__SSL Library__\n* Now support MS IIS resource kit certificates (thanks to Carsten Sørensen).\n* Fixed a memory leak when freeing more than one CA certificate.\n* The bigint library had a problem with squaring which affected classical reduction (thanks to Manuel Klimek).\n\n!!__axhttpd__\n* Brought back setuid()/setgid() as an option.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.8@@\n\n!!__SSL Library__\n* Now using a BSD style license.\n* Self-signed certificates can now be automatically generated (the keys still need to be provided).\n* A new API call //ssl_x509_create()// can be used to programatically create the certificate.\n* Certificate/keys can be loaded automatically given a file location.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.7@@\n\n!!__SSL Library__\n\n* Variable sized session id's is now better handled for session caching. It has meant a new API call //ssl_get_session_id_size()// and a change to //ssl_client_new()// to define the session id size.\n* Muliple records with a single header are now better supported (thanks to Hervé Sibert).\n* ~MD2 added for Verisign root cert verification (thanks to Byron Rakitzis).\n* The ~MD5/~SHA1 digests are calculated incrementally to reduce memory (thanks to Byron Rakitzis).\n* The bigint cache is now cleared regularly to reduce memory.\n\n!!__axhttpd__\n\n* Improved the POST handling (thanks to Christian Melki).\n* CSS files now work properly.\n* Lua's CGI launcher location is configurable.\n* //vfork()// is now used for CGI for performance reasons.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.6@@\n\n!!__SSL Library__\n\n* ~RC4 speed improvements\n* Lua samples/bindings now work properly\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.5@@\n\n!!__SSL Library__\n\n* Session id's can now be variable lengths in server hello messages.\n* 0 length client certificates are now supported.\n* ssl_version() now returns just the version and not the date.\n* ssl_write() was not sending complete packets under load.\n\n!!__axhttpd__\n\n* Completely updated the CGI code.\n* Lua now integrated - Lua scripts and Lua Pages now run.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.4@@\n\n!!__SSL Library__\n\n* Fixed a Win32 crypto library issue with non-Administrator users\n* Removed compiler warnings that showed up in ~FC6.\n* GNU TLS certificates are now accepted.\n* Separated the send/receive headers for HMAC calculations.\n* Fixed a compilation problem with swig/perl/~FC6.\n* Fixed an issue with loading PEM CA certificates.\n\n!!__axhttpd__\n\n* Made //setuid()/setgid()// call an mconf option.\n* Made //chroot()// an mconf option. Default to //chdir()// instead.\n* Removed optional permissions checking.\n\n!@@bgcolor(#ff0000):color(#ffffff):Changes for 1.1.1@@\n\n!!__SSL Library__\n\n* AES should now work on 16bit processors (there was an alignment problem).\n* Various freed objects are cleared before freeing.\n* Header files now installed in ///usr/local/include/axTLS//.\n* -DCYGWIN replaced with -~DCONFIG_PLATFORM_CYGWIN (and the same for Solaris).\n* removed "-noextern" option in Swig. Fixed some other warnings in Win32.\n* SSLCTX changed to ~SSL_CTX (to be consistent with openssl). SSLCTX still exists for backwards compatibility.\n* malloc() and friends call abort() on failure.\n* Fixed a memory leak in directory listings.\n* Added openssl() compatibility functions.\n* Fixed Cygwin 'make install' issue.\n\n!!__axhttpd__\n\n* main.c now becomes axhttpd.c.\n* Header file issue fixed (in mime_types.c).\n* //chroot()// now used for better security.\n* Basic authentication implemented (via .htpasswd).\n* SSL access/denial protection implemented (via .htaccess).\n* Directory access protection implemented (via .htaccess).\n* Can now have more than one CGI file extension in mconf.\n* "~If-Modified-Since" request now handled properly.\n* Performance tweaks to remove //ssl_find()//.
    [[Read Me]]
    axTLS uses a BSD style license:\n\nCopyright (c) 2008, Cameron Rich All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer. Redistributions in binary\nform must reproduce the above copyright notice, this list of conditions and\nthe following disclaimer in the documentation and/or other materials\nprovided with the distribution. Neither the name of the axTLS Project nor\nthe names of its contributors may be used to endorse or promote products\nderived from this software without specific prior written permission. \n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\nARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\nOUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGE.
    [[Read Me]] \n[[Changelog]]\n[[axhttpd]]\n[[License]]
    From df4606a991aa8a1bd4fc8b4e9a7d872b3c6a85b1 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 1 Jul 2012 11:10:14 +0000 Subject: [PATCH 197/301] added cast to srand git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@228 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/crypto_misc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/crypto_misc.c b/crypto/crypto_misc.c index 1dea121d99..62eb6fe700 100644 --- a/crypto/crypto_misc.c +++ b/crypto/crypto_misc.c @@ -124,7 +124,7 @@ EXP_FUNC void STDCALL RNG_initialize() /* start of with a stack to copy across */ int i; memcpy(entropy_pool, &i, ENTROPY_POOL_SIZE); - srand(&i); + srand((unsigned int)&i); #endif } From f74c9cafcae3cc42c620a6839387a4cb91504d0e Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 6 Jan 2013 12:38:42 +0000 Subject: [PATCH 198/301] Client version number comes from client hello and not the record layer. This was causing issues in Chrome git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@229 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/tls1.c | 5 ++--- ssl/tls1_svr.c | 2 +- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/ssl/tls1.c b/ssl/tls1.c index 407798d590..428c9ea56b 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -660,7 +660,7 @@ static void add_hmac_digest(SSL *ssl, int mode, uint8_t *hmac_header, ssl->cipher_info->digest_size, hmac_buf); #if 0 - print_blob("record", ssl->hmac_tx, SSL_RECORD_SIZE); + print_blob("record", hmac_header, SSL_RECORD_SIZE); print_blob("buf", buf, buf_len); if (mode == SSL_SERVER_WRITE || mode == SSL_CLIENT_WRITE) { @@ -1071,7 +1071,6 @@ int send_packet(SSL *ssl, uint8_t protocol, const uint8_t *in, int length) /* add the explicit IV for TLS1.1 */ if (ssl->version >= SSL_PROTOCOL_VERSION1_1 && ssl->cipher_info->iv_size) - { uint8_t iv_size = ssl->cipher_info->iv_size; uint8_t *t_buf = alloca(msg_length + iv_size); @@ -1131,7 +1130,7 @@ static int set_key_block(SSL *ssl, int is_write) ssl->dc->master_secret, ssl->dc->key_block, ciph_info->key_block_size); #if 0 - print_blob("keyblock", ssl->key_block, ciph_info->key_block_size); + print_blob("keyblock", ssl->dc->key_block, ciph_info->key_block_size); #endif } diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index f374928f1b..51c9d76e8d 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -122,7 +122,7 @@ static int process_client_hello(SSL *ssl) int i, j, cs_len, id_len, offset = 6 + SSL_RANDOM_SIZE; int ret = SSL_OK; - uint8_t version = (record_buf[1] << 4) + record_buf[2]; + uint8_t version = (buf[4] << 4) + buf[5]; ssl->version = ssl->client_version = version; if (version > SSL_PROTOCOL_VERSION_MAX) From 5c51893035a136faafb5b8b07daa82f581a4613f Mon Sep 17 00:00:00 2001 From: ehuman Date: Mon, 5 Aug 2013 15:47:52 +0000 Subject: [PATCH 199/301] Moved setting encryption flags to after handshake completion git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@230 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/tls1.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/ssl/tls1.c b/ssl/tls1.c index 428c9ea56b..6122ae9e98 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -1334,14 +1334,14 @@ int basic_read(SSL *ssl, uint8_t **in_data) goto error; } - /* all encrypted from now on */ - SET_SSL_FLAG(SSL_RX_ENCRYPTED); if (set_key_block(ssl, 0) < 0) { ret = SSL_ERROR_INVALID_HANDSHAKE; goto error; } + /* all encrypted from now on */ + SET_SSL_FLAG(SSL_RX_ENCRYPTED); memset(ssl->read_sequence, 0, 8); break; @@ -1441,11 +1441,12 @@ int send_change_cipher_spec(SSL *ssl) { int ret = send_packet(ssl, PT_CHANGE_CIPHER_SPEC, g_chg_cipher_spec_pkt, sizeof(g_chg_cipher_spec_pkt)); - SET_SSL_FLAG(SSL_TX_ENCRYPTED); if (ret >= 0 && set_key_block(ssl, 1) < 0) ret = SSL_ERROR_INVALID_HANDSHAKE; - + + if (ssl->cipher_info) + SET_SSL_FLAG(SSL_TX_ENCRYPTED); memset(ssl->write_sequence, 0, 8); return ret; } From 97f9f969a38aea756001a90a982b92f3f62540d0 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Sun, 22 Sep 2013 10:34:51 +0000 Subject: [PATCH 200/301] added printf changes from Fabian Frank to stop warnings/erros git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@231 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/loader.c | 6 +++--- ssl/tls1.c | 11 +++++++---- ssl/tls1_svr.c | 1 - 3 files changed, 10 insertions(+), 8 deletions(-) diff --git a/ssl/loader.c b/ssl/loader.c index 333fb18e9c..511eb53138 100644 --- a/ssl/loader.c +++ b/ssl/loader.c @@ -82,7 +82,7 @@ EXP_FUNC int STDCALL ssl_obj_load(SSL_CTX *ssl_ctx, int obj_type, #ifdef CONFIG_SSL_HAS_PEM ret = ssl_obj_PEM_load(ssl_ctx, obj_type, ssl_obj, password); #else - printf(unsupported_str); + printf("%s", unsupported_str); ret = SSL_ERROR_NOT_SUPPORTED; #endif } @@ -93,7 +93,7 @@ EXP_FUNC int STDCALL ssl_obj_load(SSL_CTX *ssl_ctx, int obj_type, ssl_obj_free(ssl_obj); return ret; #else - printf(unsupported_str); + printf("%s", unsupported_str); return SSL_ERROR_NOT_SUPPORTED; #endif /* CONFIG_SSL_SKELETON_MODE */ } @@ -150,7 +150,7 @@ static int do_obj(SSL_CTX *ssl_ctx, int obj_type, break; #endif default: - printf(unsupported_str); + printf("%s", unsupported_str); ret = SSL_ERROR_NOT_SUPPORTED; break; } diff --git a/ssl/tls1.c b/ssl/tls1.c index 6122ae9e98..e95d5eb188 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -1447,6 +1447,9 @@ int send_change_cipher_spec(SSL *ssl) if (ssl->cipher_info) SET_SSL_FLAG(SSL_TX_ENCRYPTED); + if (ssl->cipher_info) + SET_SSL_FLAG(SSL_TX_ENCRYPTED); + memset(ssl->write_sequence, 0, 8); return ret; } @@ -2161,7 +2164,7 @@ EXP_FUNC void STDCALL ssl_display_error(int error_code) {} EXP_FUNC SSL * STDCALL ssl_client_new(SSL_CTX *ssl_ctx, int client_fd, const uint8_t *session_id, uint8_t sess_id_size) { - printf(unsupported_str); + printf("%s", unsupported_str); return NULL; } #endif @@ -2169,20 +2172,20 @@ EXP_FUNC SSL * STDCALL ssl_client_new(SSL_CTX *ssl_ctx, int client_fd, const #if !defined(CONFIG_SSL_CERT_VERIFICATION) EXP_FUNC int STDCALL ssl_verify_cert(const SSL *ssl) { - printf(unsupported_str); + printf("%s", unsupported_str); return -1; } EXP_FUNC const char * STDCALL ssl_get_cert_dn(const SSL *ssl, int component) { - printf(unsupported_str); + printf("%s", unsupported_str); return NULL; } EXP_FUNC const char * STDCALL ssl_get_cert_subject_alt_dnsname(const SSL *ssl, int index) { - printf(unsupported_str); + printf("%s", unsupported_str); return NULL; } diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index 51c9d76e8d..1a99ac1fa7 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -117,7 +117,6 @@ int do_svr_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len) static int process_client_hello(SSL *ssl) { uint8_t *buf = ssl->bm_data; - uint8_t *record_buf = ssl->hmac_header; int pkt_size = ssl->bm_index; int i, j, cs_len, id_len, offset = 6 + SSL_RANDOM_SIZE; int ret = SSL_OK; From e6f9ae68c1ebd92612d86753622e39a6c6eeb114 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Thu, 14 Nov 2013 18:34:36 +0000 Subject: [PATCH 201/301] added generalized time for certificates git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@232 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/asn1.c | 66 +++++++++++++++++++++++++++++++++++------------ ssl/crypto_misc.h | 1 + 2 files changed, 51 insertions(+), 16 deletions(-) diff --git a/ssl/asn1.c b/ssl/asn1.c index b082275b2e..4e468755d4 100644 --- a/ssl/asn1.c +++ b/ssl/asn1.c @@ -205,30 +205,64 @@ int asn1_get_private_key(const uint8_t *buf, int len, RSA_CTX **rsa_ctx) */ static int asn1_get_utc_time(const uint8_t *buf, int *offset, time_t *t) { - int ret = X509_NOT_OK, len, t_offset; + int ret = X509_NOT_OK, len, t_offset, abs_year; struct tm tm; - if (buf[(*offset)++] != ASN1_UTC_TIME) - goto end_utc_time; + /* see http://tools.ietf.org/html/rfc5280#section-4.1.2.5 */ + if (buf[*offset] == ASN1_UTC_TIME) + { + (*offset)++; - len = get_asn1_length(buf, offset); - t_offset = *offset; + len = get_asn1_length(buf, offset); + t_offset = *offset; - memset(&tm, 0, sizeof(struct tm)); - tm.tm_year = (buf[t_offset] - '0')*10 + (buf[t_offset+1] - '0'); + memset(&tm, 0, sizeof(struct tm)); + tm.tm_year = (buf[t_offset] - '0')*10 + (buf[t_offset+1] - '0'); - if (tm.tm_year <= 50) /* 1951-2050 thing */ - { - tm.tm_year += 100; + if (tm.tm_year <= 50) /* 1951-2050 thing */ + { + tm.tm_year += 100; + } + + tm.tm_mon = (buf[t_offset+2] - '0')*10 + (buf[t_offset+3] - '0') - 1; + tm.tm_mday = (buf[t_offset+4] - '0')*10 + (buf[t_offset+5] - '0'); + *t = mktime(&tm); + *offset += len; + ret = X509_OK; } + else if (buf[*offset] == ASN1_GENERALIZED_TIME) + { + (*offset)++; - tm.tm_mon = (buf[t_offset+2] - '0')*10 + (buf[t_offset+3] - '0') - 1; - tm.tm_mday = (buf[t_offset+4] - '0')*10 + (buf[t_offset+5] - '0'); - *t = mktime(&tm); - *offset += len; - ret = X509_OK; + len = get_asn1_length(buf, offset); + t_offset = *offset; + + memset(&tm, 0, sizeof(struct tm)); + abs_year = ((buf[t_offset] - '0')*1000 + + (buf[t_offset+1] - '0')*100 + (buf[t_offset+2] - '0')*10 + + (buf[t_offset+3] - '0')); + + if (abs_year <= 1901) + { + tm.tm_year = 1; + tm.tm_mon = 0; + tm.tm_mday = 1; + } + else + { + tm.tm_year = abs_year - 1900; + tm.tm_mon = (buf[t_offset+4] - '0')*10 + (buf[t_offset+5] - '0') - 1; + tm.tm_mday = (buf[t_offset+6] - '0')*10 + (buf[t_offset+7] - '0'); + tm.tm_hour = (buf[t_offset+8] - '0')*10 + (buf[t_offset+9] - '0'); + tm.tm_min = (buf[t_offset+10] - '0')*10 + (buf[t_offset+11] - '0'); + tm.tm_sec = (buf[t_offset+12] - '0')*10 + (buf[t_offset+13] - '0'); + *t = mktime(&tm); + } + + *offset += len; + ret = X509_OK; + } -end_utc_time: return ret; } diff --git a/ssl/crypto_misc.h b/ssl/crypto_misc.h index 1fd514eeb1..9bbc8e5ca7 100644 --- a/ssl/crypto_misc.h +++ b/ssl/crypto_misc.h @@ -112,6 +112,7 @@ const char * x509_display_error(int error); #define ASN1_TELETEX_STR 0x14 #define ASN1_IA5_STR 0x16 #define ASN1_UTC_TIME 0x17 +#define ASN1_GENERALIZED_TIME 0x18 #define ASN1_UNICODE_STR 0x1e #define ASN1_SEQUENCE 0x30 #define ASN1_CONTEXT_DNSNAME 0x82 From ce488f91800e0d53ef833ddd29b2086bf2febae2 Mon Sep 17 00:00:00 2001 From: olereinhardt Date: Wed, 24 Sep 2014 10:19:21 +0000 Subject: [PATCH 202/301] Fix handling of return values of SOCKET_READ in process_sslv23_client_hello() git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@233 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/tls1_svr.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index 1a99ac1fa7..1717ceff3b 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -198,14 +198,14 @@ int process_sslv23_client_hello(SSL *ssl) DISPLAY_BYTES(ssl, "received %d bytes", buf, read_len, read_len); - add_packet(ssl, buf, read_len); - /* connection has gone, so die */ - if (bytes_needed < 0) + if (read_len < 0) { return SSL_ERROR_CONN_LOST; } + add_packet(ssl, buf, read_len); + /* now work out what cipher suite we are going to use */ for (j = 0; j < NUM_PROTOCOLS; j++) { From 29e7d3554dbe28266f3a2a64efdd406d6262a59e Mon Sep 17 00:00:00 2001 From: olereinhardt Date: Wed, 24 Sep 2014 10:21:23 +0000 Subject: [PATCH 203/301] Fixed array access out of bounds bug in add_cert() git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@234 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- ssl/tls1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ssl/tls1.c b/ssl/tls1.c index e95d5eb188..800decbaab 100755 --- a/ssl/tls1.c +++ b/ssl/tls1.c @@ -342,7 +342,7 @@ int add_cert(SSL_CTX *ssl_ctx, const uint8_t *buf, int len) X509_CTX *cert = NULL; int offset; - while (ssl_ctx->certs[i].buf && i < CONFIG_SSL_MAX_CERTS) + while (i < CONFIG_SSL_MAX_CERTS && ssl_ctx->certs[i].buf) i++; if (i == CONFIG_SSL_MAX_CERTS) /* too many certs */ From 08b27ee1cbfaf36bdf2454a7e70d1f5ad873f6d3 Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 31 Oct 2014 11:01:56 +0000 Subject: [PATCH 204/301] Modified the test script git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@235 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- Makefile | 2 +- ssl/test/ssltest.c | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/Makefile b/Makefile index 036a29ebe3..e3d9e8bc3b 100644 --- a/Makefile +++ b/Makefile @@ -78,7 +78,7 @@ release: -@rm www/index.20* -@rm -fr $(STAGE) @echo "#define AXTLS_VERSION \"$(VERSION)\"" > ssl/version.h - cd ../; tar cvfz $(RELEASE).tar.gz --wildcards-match-slash --exclude .svn axTLS; cd -; + cd ../; tar cvfz $(RELEASE).tar.gz --wildcards-match-slash --exclude .svn axtls-code; cd -; docs: $(MAKE) -C docsrc doco diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index 65c25c5b7f..d1c855fc1c 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -2226,11 +2226,11 @@ int main(int argc, char *argv[]) system("sh ../ssl/test/killopenssl.sh"); - if (header_issue()) - { - printf("Header tests failed\n"); TTY_FLUSH(); - goto cleanup; - } + //if (header_issue()) + //{ + // printf("Header tests failed\n"); TTY_FLUSH(); + // goto cleanup; + //} ret = 0; /* all ok */ printf("**** ALL TESTS PASSED ****\n"); TTY_FLUSH(); From 9ef84f9234b84de16a5f5d18f43c126fdb35da9a Mon Sep 17 00:00:00 2001 From: cameronrich Date: Fri, 7 Nov 2014 00:38:49 +0000 Subject: [PATCH 205/301] * RSA_decrypt now checks the integrity of the first 11 bytes. * The size of the output buffer in RSA_decrypt is now checked and cleared. * get_random now returns an error code * Various system calls now check the return code to remove gcc warnings. git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@237 9a5d90b5-6617-0410-8a86-bb477d3ed2e3 --- crypto/crypto.h | 6 +- crypto/crypto_misc.c | 15 +- crypto/rsa.c | 45 +- httpd/proc.c | 15 +- ssl/test/ssltest.c | 44 +- ssl/tls1_svr.c | 13 +- www/index.html | 9746 +++++++++++++++++++++--------------------- 7 files changed, 4964 insertions(+), 4920 deletions(-) diff --git a/crypto/crypto.h b/crypto/crypto.h index 8a314a3321..128a56bab8 100644 --- a/crypto/crypto.h +++ b/crypto/crypto.h @@ -203,7 +203,7 @@ void RSA_pub_key_new(RSA_CTX **rsa_ctx, const uint8_t *pub_exp, int pub_len); void RSA_free(RSA_CTX *ctx); int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data, uint8_t *out_data, - int is_decryption); + int out_len, int is_decryption); bigint *RSA_private(const RSA_CTX *c, bigint *bi_msg); #if defined(CONFIG_SSL_CERT_VERIFICATION) || defined(CONFIG_SSL_GENERATE_X509_CERT) bigint *RSA_sign_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, @@ -220,8 +220,8 @@ void RSA_print(const RSA_CTX *ctx); EXP_FUNC void STDCALL RNG_initialize(void); EXP_FUNC void STDCALL RNG_custom_init(const uint8_t *seed_buf, int size); EXP_FUNC void STDCALL RNG_terminate(void); -EXP_FUNC void STDCALL get_random(int num_rand_bytes, uint8_t *rand_data); -void get_random_NZ(int num_rand_bytes, uint8_t *rand_data); +EXP_FUNC int STDCALL get_random(int num_rand_bytes, uint8_t *rand_data); +int get_random_NZ(int num_rand_bytes, uint8_t *rand_data); #ifdef __cplusplus } diff --git a/crypto/crypto_misc.c b/crypto/crypto_misc.c index 62eb6fe700..ccc64a28e5 100644 --- a/crypto/crypto_misc.c +++ b/crypto/crypto_misc.c @@ -156,11 +156,12 @@ EXP_FUNC void STDCALL RNG_terminate(void) /** * Set a series of bytes with a random number. Individual bytes can be 0 */ -EXP_FUNC void STDCALL get_random(int num_rand_bytes, uint8_t *rand_data) +EXP_FUNC int STDCALL get_random(int num_rand_bytes, uint8_t *rand_data) { #if !defined(WIN32) && defined(CONFIG_USE_DEV_URANDOM) - /* use the Linux default */ - read(rng_fd, rand_data, num_rand_bytes); /* read from /dev/urandom */ + /* use the Linux default - read from /dev/urandom */ + if (read(rng_fd, rand_data, num_rand_bytes) < 0) + return -1; #elif defined(WIN32) && defined(CONFIG_WIN32_USE_CRYPTO_LIB) /* use Microsoft Crypto Libraries */ CryptGenRandom(gCryptProv, num_rand_bytes, rand_data); @@ -198,21 +199,25 @@ EXP_FUNC void STDCALL get_random(int num_rand_bytes, uint8_t *rand_data) /* insert the digest at the start of the entropy pool */ memcpy(entropy_pool, digest, MD5_SIZE); #endif + return 0; } /** * Set a series of bytes with a random number. Individual bytes are not zero. */ -void get_random_NZ(int num_rand_bytes, uint8_t *rand_data) +int get_random_NZ(int num_rand_bytes, uint8_t *rand_data) { int i; - get_random(num_rand_bytes, rand_data); + if (get_random(num_rand_bytes, rand_data)) + return -1; for (i = 0; i < num_rand_bytes; i++) { while (rand_data[i] == 0) /* can't be 0 */ rand_data[i] = (uint8_t)(rand()); } + + return 0; } /** diff --git a/crypto/rsa.c b/crypto/rsa.c index 143e66add5..8f06cf8963 100644 --- a/crypto/rsa.c +++ b/crypto/rsa.c @@ -134,21 +134,26 @@ void RSA_free(RSA_CTX *rsa_ctx) /** * @brief Use PKCS1.5 for decryption/verification. * @param ctx [in] The context - * @param in_data [in] The data to encrypt (must be < modulus size-11) - * @param out_data [out] The encrypted data. + * @param in_data [in] The data to decrypt (must be < modulus size-11) + * @param out_data [out] The decrypted data. + * @param out_len [int] The size of the decrypted buffer in bytes * @param is_decryption [in] Decryption or verify operation. * @return The number of bytes that were originally encrypted. -1 on error. * @see http://www.rsasecurity.com/rsalabs/node.asp?id=2125 */ int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data, - uint8_t *out_data, int is_decryption) + uint8_t *out_data, int out_len, int is_decryption) { const int byte_size = ctx->num_octets; - int i, size; + int i = 0, size; bigint *decrypted_bi, *dat_bi; uint8_t *block = (uint8_t *)alloca(byte_size); + int pad_count = 0; - memset(out_data, 0, byte_size); /* initialise */ + if (out_len < byte_size) /* check output has enough size */ + return -1; + + memset(out_data, 0, out_len); /* initialise */ /* decrypt */ dat_bi = bi_import(ctx->bi_ctx, in_data, byte_size); @@ -162,28 +167,37 @@ int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data, /* convert to a normal block */ bi_export(ctx->bi_ctx, decrypted_bi, block, byte_size); - i = 10; /* start at the first possible non-padded byte */ + if (block[i++] != 0) /* leading 0? */ + return -1; #ifdef CONFIG_SSL_CERT_VERIFICATION if (is_decryption == 0) /* PKCS1.5 signing pads with "0xff"s */ { - while (block[i++] == 0xff && i < byte_size); + if (block[i++] != 0x01) /* BT correct? */ + return -1; - if (block[i-2] != 0xff) - i = byte_size; /*ensure size is 0 */ + while (block[i++] == 0xff && i < byte_size) + pad_count++; } else /* PKCS1.5 encryption padding is random */ #endif { - while (block[i++] && i < byte_size); + if (block[i++] != 0x02) /* BT correct? */ + return -1; + + while (block[i++] && i < byte_size) + pad_count++; } + + /* check separator byte - and padding must be 8 or more bytes */ + if (i == byte_size || pad_count < 8) + return -1; + size = byte_size - i; /* get only the bit we want */ - if (size > 0) - memcpy(out_data, &block[i], size); - - return size ? size : -1; + memcpy(out_data, &block[i], size); + return size; } /** @@ -249,7 +263,8 @@ int RSA_encrypt(const RSA_CTX *ctx, const uint8_t *in_data, uint16_t in_len, else /* randomize the encryption padding with non-zero bytes */ { out_data[1] = 2; - get_random_NZ(num_pads_needed, &out_data[2]); + if (get_random_NZ(num_pads_needed, &out_data[2]) < 0) + return -1; } out_data[2+num_pads_needed] = 0; diff --git a/httpd/proc.c b/httpd/proc.c index 32a72c7e5e..07583d3f3c 100644 --- a/httpd/proc.c +++ b/httpd/proc.c @@ -188,7 +188,12 @@ static void procdirlisting(struct connstruct *cn) { snprintf(buf, sizeof(buf), HTTP_VERSION " 200 OK\nContent-Type: text/html\n\n"); - write(cn->networkdesc, buf, strlen(buf)); + if (write(cn->networkdesc, buf, strlen(buf)) < 0) + { + printf("procdirlisting: could not write"); + TTY_FLUSH(); + } + removeconnection(cn); return; } @@ -625,7 +630,13 @@ static void proccgi(struct connstruct *cn) /* Send POST query data to CGI script */ if ((cn->reqtype == TYPE_POST) && (cn->content_length > 0)) { - write(spipe[1], cn->post_data, cn->content_length); + if (write(spipe[1], cn->post_data, cn->content_length) == -1) + { + printf("[CGI]: could write to pipe"); + TTY_FLUSH(); + return; + } + close(spipe[0]); close(spipe[1]); diff --git a/ssl/test/ssltest.c b/ssl/test/ssltest.c index d1c855fc1c..cd7e4732f3 100644 --- a/ssl/test/ssltest.c +++ b/ssl/test/ssltest.c @@ -57,6 +57,9 @@ //#define DEFAULT_CLNT_OPTION SSL_DISPLAY_BYTES|SSL_DISPLAY_STATES #define DEFAULT_CLNT_OPTION 0 +/* hack to remove gcc warning */ +#define SYSTEM(A) if (system(A) < 0) printf("system call error\n"); + static int g_port = 19001; /************************************************************************** @@ -545,7 +548,7 @@ static int RSA_test(void) } RSA_encrypt(rsa_ctx, (const uint8_t *)"abc", 3, enc_data2, 0); - RSA_decrypt(rsa_ctx, enc_data2, dec_data2, 1); + RSA_decrypt(rsa_ctx, enc_data2, dec_data2, sizeof(dec_data2), 1); if (memcmp("abc", dec_data2, 3)) { printf("Error: ENCRYPT/DECRYPT #2 failed\n"); @@ -823,7 +826,7 @@ static void do_client(client_t *clnt) g_port, clnt->openssl_option); } - system(openssl_buf); + SYSTEM(openssl_buf); } static int SSL_server_test( @@ -1326,7 +1329,7 @@ static void do_server(server_t *svr) "-accept %d -quiet %s ", g_port, svr->openssl_option); } - system(openssl_buf); + SYSTEM(openssl_buf); } static int SSL_client_test( @@ -1646,8 +1649,8 @@ int SSL_client_tests(void) { ssl_display_error(ret); printf("Error: A client test failed\n"); - system("sh ../ssl/test/killopenssl.sh"); - system("sh ../ssl/test/killgnutls.sh"); + SYSTEM("sh ../ssl/test/killopenssl.sh"); + SYSTEM("sh ../ssl/test/killgnutls.sh"); exit(1); } else @@ -2065,7 +2068,7 @@ static void do_header_issue(void) pthread_setcanceltype(PTHREAD_CANCEL_ASYNCHRONOUS, NULL); #endif sprintf(axtls_buf, "./axssl s_client -connect localhost:%d", g_port); - system(axtls_buf); + SYSTEM(axtls_buf); } static int header_issue(void) @@ -2099,7 +2102,12 @@ static int header_issue(void) } size = fread(buf, 1, sizeof(buf), f); - SOCKET_WRITE(client_fd, buf, size); + if (SOCKET_WRITE(client_fd, buf, size) < 0) + { + ret = SSL_ERROR_SOCK_SETUP_FAILURE; + goto error; + } + usleep(200000); ret = 0; @@ -2108,7 +2116,7 @@ static int header_issue(void) SOCKET_CLOSE(client_fd); SOCKET_CLOSE(server_fd); TTY_FLUSH(); - system("killall axssl"); + SYSTEM("killall axssl"); return ret; } @@ -2208,29 +2216,29 @@ int main(int argc, char *argv[]) if (SSL_basic_test()) goto cleanup; - system("sh ../ssl/test/killopenssl.sh"); + SYSTEM("sh ../ssl/test/killopenssl.sh"); if (SSL_unblocked_test()) goto cleanup; - system("sh ../ssl/test/killopenssl.sh"); + SYSTEM("sh ../ssl/test/killopenssl.sh"); if (SSL_client_tests()) goto cleanup; - system("sh ../ssl/test/killopenssl.sh"); - system("sh ../ssl/test/killgnutls.sh"); + SYSTEM("sh ../ssl/test/killopenssl.sh"); + SYSTEM("sh ../ssl/test/killgnutls.sh"); if (SSL_server_tests()) goto cleanup; - system("sh ../ssl/test/killopenssl.sh"); + SYSTEM("sh ../ssl/test/killopenssl.sh"); - //if (header_issue()) - //{ - // printf("Header tests failed\n"); TTY_FLUSH(); - // goto cleanup; - //} + if (header_issue()) + { + printf("Header tests failed\n"); TTY_FLUSH(); + goto cleanup; + } ret = 0; /* all ok */ printf("**** ALL TESTS PASSED ****\n"); TTY_FLUSH(); diff --git a/ssl/tls1_svr.c b/ssl/tls1_svr.c index 1717ceff3b..b4b0f648da 100644 --- a/ssl/tls1_svr.c +++ b/ssl/tls1_svr.c @@ -310,7 +310,9 @@ static int send_server_hello(SSL *ssl) buf[5] = ssl->version & 0x0f; /* server random value */ - get_random(SSL_RANDOM_SIZE, &buf[6]); + if (get_random(SSL_RANDOM_SIZE, &buf[6]) < 0) + return SSL_NOT_OK; + memcpy(ssl->dc->server_random, &buf[6], SSL_RANDOM_SIZE); offset = 6 + SSL_RANDOM_SIZE; @@ -391,7 +393,8 @@ static int process_client_key_xchg(SSL *ssl) /* rsa_ctx->bi_ctx is not thread-safe */ SSL_CTX_LOCK(ssl->ssl_ctx->mutex); - premaster_size = RSA_decrypt(rsa_ctx, &buf[offset], premaster_secret, 1); + premaster_size = RSA_decrypt(rsa_ctx, &buf[offset], premaster_secret, + sizeof(premaster_secret), 1); SSL_CTX_UNLOCK(ssl->ssl_ctx->mutex); if (premaster_size != SSL_SECRET_SIZE || @@ -400,7 +403,9 @@ static int process_client_key_xchg(SSL *ssl) premaster_secret[1] != (ssl->client_version & 0x0f)) { /* guard against a Bleichenbacher attack */ - get_random(SSL_SECRET_SIZE, premaster_secret); + if (get_random(SSL_SECRET_SIZE, premaster_secret) < 0) + return SSL_NOT_OK; + /* and continue - will die eventually when checking the mac */ } @@ -453,7 +458,7 @@ static int process_cert_verify(SSL *ssl) /* rsa_ctx->bi_ctx is not thread-safe */ SSL_CTX_LOCK(ssl->ssl_ctx->mutex); - n = RSA_decrypt(x509_ctx->rsa_ctx, &buf[6], dgst_buf, 0); + n = RSA_decrypt(x509_ctx->rsa_ctx, &buf[6], dgst_buf, sizeof(dgst_buf), 0); SSL_CTX_UNLOCK(ssl->ssl_ctx->mutex); if (n != SHA1_SIZE + MD5_SIZE) diff --git a/www/index.html b/www/index.html index 2c5f2bbfdf..e4f28c62de 100755 --- a/www/index.html +++ b/www/index.html @@ -51,163 +51,163 @@ // Miscellaneous options var config = { - numRssItems: 20, // Number of items in the RSS feed - animFast: 0.12, // Speed for animations (lower == slower) - animSlow: 0.01, // Speed for EasterEgg animations - cascadeFast: 20, // Speed for cascade animations (higher == slower) - cascadeSlow: 60, // Speed for EasterEgg cascade animations - cascadeDepth: 5, // Depth of cascade animation - displayStartupTime: false // Whether to display startup time - }; + numRssItems: 20, // Number of items in the RSS feed + animFast: 0.12, // Speed for animations (lower == slower) + animSlow: 0.01, // Speed for EasterEgg animations + cascadeFast: 20, // Speed for cascade animations (higher == slower) + cascadeSlow: 60, // Speed for EasterEgg cascade animations + cascadeDepth: 5, // Depth of cascade animation + displayStartupTime: false // Whether to display startup time + }; // Messages config.messages = { - messageClose: {}, - dates: {} + messageClose: {}, + dates: {} }; // Options that can be set in the options panel and/or cookies config.options = { - chkRegExpSearch: false, - chkCaseSensitiveSearch: false, - chkAnimate: true, - chkSaveBackups: true, - chkAutoSave: false, - chkGenerateAnRssFeed: false, - chkSaveEmptyTemplate: false, - chkOpenInNewWindow: true, - chkToggleLinks: false, - chkHttpReadOnly: true, - chkForceMinorUpdate: false, - chkConfirmDelete: true, - chkInsertTabs: false, - txtBackupFolder: "", - txtMainTab: "tabTimeline", - txtMoreTab: "moreTabAll", - txtMaxEditRows: "30" - }; - + chkRegExpSearch: false, + chkCaseSensitiveSearch: false, + chkAnimate: true, + chkSaveBackups: true, + chkAutoSave: false, + chkGenerateAnRssFeed: false, + chkSaveEmptyTemplate: false, + chkOpenInNewWindow: true, + chkToggleLinks: false, + chkHttpReadOnly: true, + chkForceMinorUpdate: false, + chkConfirmDelete: true, + chkInsertTabs: false, + txtBackupFolder: "", + txtMainTab: "tabTimeline", + txtMoreTab: "moreTabAll", + txtMaxEditRows: "30" + }; + // List of notification functions to be called when certain tiddlers are changed or deleted config.notifyTiddlers = [ - {name: "StyleSheetLayout", notify: refreshStyles}, - {name: "StyleSheetColors", notify: refreshStyles}, - {name: "StyleSheet", notify: refreshStyles}, - {name: "StyleSheetPrint", notify: refreshStyles}, - {name: "PageTemplate", notify: refreshPageTemplate}, - {name: "SiteTitle", notify: refreshPageTitle}, - {name: "SiteSubtitle", notify: refreshPageTitle}, - {name: "ColorPalette", notify: refreshColorPalette}, - {name: null, notify: refreshDisplay} - ]; + {name: "StyleSheetLayout", notify: refreshStyles}, + {name: "StyleSheetColors", notify: refreshStyles}, + {name: "StyleSheet", notify: refreshStyles}, + {name: "StyleSheetPrint", notify: refreshStyles}, + {name: "PageTemplate", notify: refreshPageTemplate}, + {name: "SiteTitle", notify: refreshPageTitle}, + {name: "SiteSubtitle", notify: refreshPageTitle}, + {name: "ColorPalette", notify: refreshColorPalette}, + {name: null, notify: refreshDisplay} + ]; // Default tiddler templates var DEFAULT_VIEW_TEMPLATE = 1; var DEFAULT_EDIT_TEMPLATE = 2; config.tiddlerTemplates = { - 1: "ViewTemplate", - 2: "EditTemplate" - }; + 1: "ViewTemplate", + 2: "EditTemplate" + }; // More messages (rather a legacy layout that shouldn't really be like this) config.views = { - wikified: { - tag: {} - }, - editor: { - tagChooser: {} - } - }; + wikified: { + tag: {} + }, + editor: { + tagChooser: {} + } + }; // Macros; each has a 'handler' member that is inserted later config.macros = { - today: {}, - version: {}, - search: {sizeTextbox: 15}, - tiddler: {}, - tag: {}, - tags: {}, - tagging: {}, - timeline: {}, - allTags: {}, - list: { - all: {}, - missing: {}, - orphans: {}, - shadowed: {} - }, - closeAll: {}, - permaview: {}, - saveChanges: {}, - slider: {}, - option: {}, - newTiddler: {}, - newJournal: {}, - sparkline: {}, - tabs: {}, - gradient: {}, - message: {}, - view: {}, - edit: {}, - tagChooser: {}, - toolbar: {}, - br: {}, - plugins: {}, - refreshDisplay: {}, - importTiddlers: {} - }; + today: {}, + version: {}, + search: {sizeTextbox: 15}, + tiddler: {}, + tag: {}, + tags: {}, + tagging: {}, + timeline: {}, + allTags: {}, + list: { + all: {}, + missing: {}, + orphans: {}, + shadowed: {} + }, + closeAll: {}, + permaview: {}, + saveChanges: {}, + slider: {}, + option: {}, + newTiddler: {}, + newJournal: {}, + sparkline: {}, + tabs: {}, + gradient: {}, + message: {}, + view: {}, + edit: {}, + tagChooser: {}, + toolbar: {}, + br: {}, + plugins: {}, + refreshDisplay: {}, + importTiddlers: {} + }; // Commands supported by the toolbar macro config.commands = { - closeTiddler: {}, - closeOthers: {}, - editTiddler: {}, - saveTiddler: {hideReadOnly: true}, - cancelTiddler: {}, - deleteTiddler: {hideReadOnly: true}, - permalink: {}, - references: {}, - jump: {} - }; + closeTiddler: {}, + closeOthers: {}, + editTiddler: {}, + saveTiddler: {hideReadOnly: true}, + cancelTiddler: {}, + deleteTiddler: {hideReadOnly: true}, + permalink: {}, + references: {}, + jump: {} + }; // Browser detection... In a very few places, there's nothing else for it but to // know what browser we're using. config.userAgent = navigator.userAgent.toLowerCase(); config.browser = { - isIE: config.userAgent.indexOf("msie") != -1 && config.userAgent.indexOf("opera") == -1, - ieVersion: /MSIE (\d.\d)/i.exec(config.userAgent), // config.browser.ieVersion[1], if it exists, will be the IE version string, eg "6.0" - isSafari: config.userAgent.indexOf("applewebkit") != -1, - isBadSafari: !((new RegExp("[\u0150\u0170]","g")).test("\u0150")), - firefoxDate: /Gecko\/(\d{8})/i.exec(config.userAgent), // config.browser.firefoxDate[1], if it exists, will be Firefox release date as "YYYYMMDD" - isOpera: config.userAgent.indexOf("opera") != -1, - isLinux: config.userAgent.indexOf("linux") != -1, - isUnix: config.userAgent.indexOf("x11") != -1, - isMac: config.userAgent.indexOf("mac") != -1, - isWindows: config.userAgent.indexOf("win") != -1 - }; + isIE: config.userAgent.indexOf("msie") != -1 && config.userAgent.indexOf("opera") == -1, + ieVersion: /MSIE (\d.\d)/i.exec(config.userAgent), // config.browser.ieVersion[1], if it exists, will be the IE version string, eg "6.0" + isSafari: config.userAgent.indexOf("applewebkit") != -1, + isBadSafari: !((new RegExp("[\u0150\u0170]","g")).test("\u0150")), + firefoxDate: /Gecko\/(\d{8})/i.exec(config.userAgent), // config.browser.firefoxDate[1], if it exists, will be Firefox release date as "YYYYMMDD" + isOpera: config.userAgent.indexOf("opera") != -1, + isLinux: config.userAgent.indexOf("linux") != -1, + isUnix: config.userAgent.indexOf("x11") != -1, + isMac: config.userAgent.indexOf("mac") != -1, + isWindows: config.userAgent.indexOf("win") != -1 + }; // Basic regular expressions config.textPrimitives = { - upperLetter: "[A-Z\u00c0-\u00de\u0150\u0170]", - lowerLetter: "[a-z0-9_\\-\u00df-\u00ff\u0151\u0171]", - anyLetter: "[A-Za-z0-9_\\-\u00c0-\u00de\u00df-\u00ff\u0150\u0170\u0151\u0171]", - anyLetterStrict: "[A-Za-z0-9\u00c0-\u00de\u00df-\u00ff\u0150\u0170\u0151\u0171]" - }; + upperLetter: "[A-Z\u00c0-\u00de\u0150\u0170]", + lowerLetter: "[a-z0-9_\\-\u00df-\u00ff\u0151\u0171]", + anyLetter: "[A-Za-z0-9_\\-\u00c0-\u00de\u00df-\u00ff\u0150\u0170\u0151\u0171]", + anyLetterStrict: "[A-Za-z0-9\u00c0-\u00de\u00df-\u00ff\u0150\u0170\u0151\u0171]" + }; if(config.browser.isBadSafari) - config.textPrimitives = { - upperLetter: "[A-Z\u00c0-\u00de]", - lowerLetter: "[a-z0-9_\\-\u00df-\u00ff]", - anyLetter: "[A-Za-z0-9_\\-\u00c0-\u00de\u00df-\u00ff]", - anyLetterStrict: "[A-Za-z0-9\u00c0-\u00de\u00df-\u00ff]" - } + config.textPrimitives = { + upperLetter: "[A-Z\u00c0-\u00de]", + lowerLetter: "[a-z0-9_\\-\u00df-\u00ff]", + anyLetter: "[A-Za-z0-9_\\-\u00c0-\u00de\u00df-\u00ff]", + anyLetterStrict: "[A-Za-z0-9\u00c0-\u00de\u00df-\u00ff]" + } config.textPrimitives.sliceSeparator = "::"; config.textPrimitives.urlPattern = "[a-z]{3,8}:[^\\s:'\"][^\\s'\"]*(?:/|\\b)"; config.textPrimitives.unWikiLink = "~"; config.textPrimitives.wikiLink = "(?:(?:" + config.textPrimitives.upperLetter + "+" + - config.textPrimitives.lowerLetter + "+" + - config.textPrimitives.upperLetter + - config.textPrimitives.anyLetter + "*)|(?:" + - config.textPrimitives.upperLetter + "{2,}" + - config.textPrimitives.lowerLetter + "+))"; + config.textPrimitives.lowerLetter + "+" + + config.textPrimitives.upperLetter + + config.textPrimitives.anyLetter + "*)|(?:" + + config.textPrimitives.upperLetter + "{2,}" + + config.textPrimitives.lowerLetter + "+))"; config.textPrimitives.cssLookahead = "(?:(" + config.textPrimitives.anyLetter + "+)\\(([^\\)\\|\\n]+)(?:\\):))|(?:(" + config.textPrimitives.anyLetter + "+):([^;\\|\\n]+);)"; config.textPrimitives.cssLookaheadRegExp = new RegExp(config.textPrimitives.cssLookahead,"mg"); @@ -215,45 +215,45 @@ config.textPrimitives.brackettedLink = "\\[\\[([^\\]]+)\\]\\]"; config.textPrimitives.titledBrackettedLink = "\\[\\[([^\\[\\]\\|]+)\\|([^\\[\\]\\|]+)\\]\\]"; config.textPrimitives.tiddlerForcedLinkRegExp = new RegExp("(?:" + config.textPrimitives.titledBrackettedLink + ")|(?:" + - config.textPrimitives.brackettedLink + ")|(?:" + - config.textPrimitives.urlPattern + ")","mg"); + config.textPrimitives.brackettedLink + ")|(?:" + + config.textPrimitives.urlPattern + ")","mg"); config.textPrimitives.tiddlerAnyLinkRegExp = new RegExp("("+ config.textPrimitives.wikiLink + ")|(?:" + - config.textPrimitives.titledBrackettedLink + ")|(?:" + - config.textPrimitives.brackettedLink + ")|(?:" + - config.textPrimitives.urlPattern + ")","mg"); + config.textPrimitives.titledBrackettedLink + ")|(?:" + + config.textPrimitives.brackettedLink + ")|(?:" + + config.textPrimitives.urlPattern + ")","mg"); // --------------------------------------------------------------------------------- // Shadow tiddlers // --------------------------------------------------------------------------------- config.shadowTiddlers = { - ColorPalette: "Background: #fff\n" + - "Foreground: #000\n" + - "PrimaryPale: #8cf\n" + - "PrimaryLight: #18f\n" + - "PrimaryMid: #04b\n" + - "PrimaryDark: #014\n" + - "SecondaryPale: #ffc\n" + - "SecondaryLight: #fe8\n" + - "SecondaryMid: #db4\n" + - "SecondaryDark: #841\n" + - "TertiaryPale: #eee\n" + - "TertiaryLight: #ccc\n" + - "TertiaryMid: #999\n" + - "TertiaryDark: #666\n" + - "Error: #f88\n", - StyleSheet: "", - StyleSheetColors: "/*{{{*/\nbody {\n background: [[ColorPalette::Background]];\n color: [[ColorPalette::Foreground]];\n}\n\na{\n color: [[ColorPalette::PrimaryMid]];\n}\n\na:hover{\n background: [[ColorPalette::PrimaryMid]];\n color: [[ColorPalette::Background]];\n}\n\na img{\n border: 0;\n}\n\nh1,h2,h3,h4,h5 {\n color: [[ColorPalette::SecondaryDark]];\n background: [[ColorPalette::PrimaryPale]];\n}\n\n.button {\n color: [[ColorPalette::PrimaryDark]];\n border: 1px solid [[ColorPalette::Background]];\n}\n\n.button:hover {\n color: [[ColorPalette::PrimaryDark]];\n background: [[ColorPalette::SecondaryLight]];\n border-color: [[ColorPalette::SecondaryMid]];\n}\n\n.button:active {\n color: [[ColorPalette::Background]];\n background: [[ColorPalette::SecondaryMid]];\n border: 1px solid [[ColorPalette::SecondaryDark]];\n}\n\n.header {\n background: [[ColorPalette::PrimaryMid]];\n}\n\n.headerShadow {\n color: [[ColorPalette::Foreground]];\n}\n\n.headerShadow a {\n font-weight: normal;\n color: [[ColorPalette::Foreground]];\n}\n\n.headerForeground {\n color: [[ColorPalette::Background]];\n}\n\n.headerForeground a {\n font-weight: normal;\n color: [[ColorPalette::PrimaryPale]];\n}\n\n.tabSelected{\n color: [[ColorPalette::PrimaryDark]];\n background: [[ColorPalette::TertiaryPale]];\n border-left: 1px solid [[ColorPalette::TertiaryLight]];\n border-top: 1px solid [[ColorPalette::TertiaryLight]];\n border-right: 1px solid [[ColorPalette::TertiaryLight]];\n}\n\n.tabUnselected {\n color: [[ColorPalette::Background]];\n background: [[ColorPalette::TertiaryMid]];\n}\n\n.tabContents {\n color: [[ColorPalette::PrimaryDark]];\n background: [[ColorPalette::TertiaryPale]];\n border: 1px solid [[ColorPalette::TertiaryLight]];\n}\n\n.tabContents .button {\n border: 0;}\n\n#sidebar {\n}\n\n#sidebarOptions input {\n border: 1px solid [[ColorPalette::PrimaryMid]];\n}\n\n#sidebarOptions .sliderPanel {\n background: [[ColorPalette::PrimaryPale]];\n}\n\n#sidebarOptions .sliderPanel a {\n border: none;\n color: [[ColorPalette::PrimaryMid]];\n}\n\n#sidebarOptions .sliderPanel a:hover {\n color: [[ColorPalette::Background]];\n background: [[ColorPalette::PrimaryMid]];\n}\n\n#sidebarOptions .sliderPanel a:active {\n color: [[ColorPalette::PrimaryMid]];\n background: [[ColorPalette::Background]];\n}\n\n.wizard {\n background: [[ColorPalette::SecondaryLight]];\n border-top: 1px solid [[ColorPalette::SecondaryMid]];\n border-left: 1px solid [[ColorPalette::SecondaryMid]];\n}\n\n.wizard h1 {\n color: [[ColorPalette::SecondaryDark]];\n}\n\n.wizard h2 {\n color: [[ColorPalette::Foreground]];\n}\n\n.wizardStep {\n background: [[ColorPalette::Background]];\n border-top: 1px solid [[ColorPalette::SecondaryMid]];\n border-bottom: 1px solid [[ColorPalette::SecondaryMid]];\n border-left: 1px solid [[ColorPalette::SecondaryMid]];\n}\n\n.wizard .button {\n color: [[ColorPalette::Background]];\n background: [[ColorPalette::PrimaryMid]];\n border-top: 1px solid [[ColorPalette::PrimaryLight]];\n border-right: 1px solid [[ColorPalette::PrimaryDark]];\n border-bottom: 1px solid [[ColorPalette::PrimaryDark]];\n border-left: 1px solid [[ColorPalette::PrimaryLight]];\n}\n\n.wizard .button:hover {\n color: [[ColorPalette::PrimaryLight]];\n background: [[ColorPalette::PrimaryDark]];\n border-color: [[ColorPalette::PrimaryLight]];\n}\n\n.wizard .button:active {\n color: [[ColorPalette::Background]];\n background: [[ColorPalette::PrimaryMid]];\n border-top: 1px solid [[ColorPalette::PrimaryLight]];\n border-right: 1px solid [[ColorPalette::PrimaryDark]];\n border-bottom: 1px solid [[ColorPalette::PrimaryDark]];\n border-left: 1px solid [[ColorPalette::PrimaryLight]];\n}\n\n#messageArea {\n border: 1px solid [[ColorPalette::SecondaryDark]];\n background: [[ColorPalette::SecondaryMid]];\n color: [[ColorPalette::PrimaryDark]];\n}\n\n#messageArea .button {\n padding: 0.2em 0.2em 0.2em 0.2em;\n color: [[ColorPalette::PrimaryDark]];\n background: [[ColorPalette::Background]];\n}\n\n.popup {\n background: [[ColorPalette::PrimaryLight]];\n border: 1px solid [[ColorPalette::PrimaryMid]];\n}\n\n.popup hr {\n color: [[ColorPalette::PrimaryDark]];\n background: [[ColorPalette::PrimaryDark]];\n border-bottom: 1px;\n}\n\n.listBreak div{\n border-bottom: 1px solid [[ColorPalette::PrimaryDark]];\n}\n\n.popup li.disabled {\n color: [[ColorPalette::PrimaryMid]];\n}\n\n.popup li a, .popup li a:visited {\n color: [[ColorPalette::TertiaryPale]];\n border: none;\n}\n\n.popup li a:hover {\n background: [[ColorPalette::PrimaryDark]];\n color: [[ColorPalette::Background]];\n border: none;\n}\n\n.tiddler .defaultCommand {\n font-weight: bold;\n}\n\n.shadow .title {\n color: [[ColorPalette::TertiaryDark]];\n}\n\n.title {\n color: [[ColorPalette::SecondaryDark]];\n}\n\n.subtitle {\n color: [[ColorPalette::TertiaryDark]];\n}\n\n.toolbar {\n color: [[ColorPalette::PrimaryMid]];\n}\n\n.tagging, .tagged {\n border: 1px solid [[ColorPalette::TertiaryPale]];\n background-color: [[ColorPalette::TertiaryPale]];\n}\n\n.selected .tagging, .selected .tagged {\n background-color: [[ColorPalette::TertiaryLight]];\n border: 1px solid [[ColorPalette::TertiaryMid]];\n}\n\n.tagging .listTitle, .tagged .listTitle {\n color: [[ColorPalette::PrimaryDark]];\n}\n\n.tagging .button, .tagged .button {\n border: none;\n}\n\n.footer {\n color: [[ColorPalette::TertiaryLight]];\n}\n\n.selected .footer {\n color: [[ColorPalette::TertiaryMid]];\n}\n\n.sparkline {\n background: [[ColorPalette::PrimaryPale]];\n border: 0;\n}\n\n.sparktick {\n background: [[ColorPalette::PrimaryDark]];\n}\n\n.error, .errorButton {\n color: [[ColorPalette::Foreground]];\n background: [[ColorPalette::Error]];\n}\n\n.warning {\n color: [[ColorPalette::Foreground]];\n background: [[ColorPalette::SecondaryPale]];\n}\n\n.cascade {\n background: [[ColorPalette::TertiaryPale]];\n color: [[ColorPalette::TertiaryMid]];\n border: 1px solid [[ColorPalette::TertiaryMid]];\n}\n\n.imageLink, #displayArea .imageLink {\n background: transparent;\n}\n\n.viewer .listTitle {list-style-type: none; margin-left: -2em;}\n\n.viewer .button {\n border: 1px solid [[ColorPalette::SecondaryMid]];\n}\n\n.viewer blockquote {\n border-left: 3px solid [[ColorPalette::TertiaryDark]];\n}\n\n.viewer table {\n border: 2px solid [[ColorPalette::TertiaryDark]];\n}\n\n.viewer th, thead td {\n background: [[ColorPalette::SecondaryMid]];\n border: 1px solid [[ColorPalette::TertiaryDark]];\n color: [[ColorPalette::Background]];\n}\n\n.viewer td, .viewer tr {\n border: 1px solid [[ColorPalette::TertiaryDark]];\n}\n\n.viewer pre {\n border: 1px solid [[ColorPalette::SecondaryLight]];\n background: [[ColorPalette::SecondaryPale]];\n}\n\n.viewer code {\n color: [[ColorPalette::SecondaryDark]];\n}\n\n.viewer hr {\n border: 0;\n border-top: dashed 1px [[ColorPalette::TertiaryDark]];\n color: [[ColorPalette::TertiaryDark]];\n}\n\n.highlight, .marked {\n background: [[ColorPalette::SecondaryLight]];\n}\n\n.editor input {\n border: 1px solid [[ColorPalette::PrimaryMid]];\n}\n\n.editor textarea {\n border: 1px solid [[ColorPalette::PrimaryMid]];\n width: 100%;\n}\n\n.editorFooter {\n color: [[ColorPalette::TertiaryMid]];\n}\n\n/*}}}*/", - StyleSheetLayout: "/*{{{*/\n* html .tiddler {\n height: 1%;\n}\n\nbody {\n font-size: .75em;\n font-family: arial,helvetica;\n margin: 0;\n padding: 0;\n}\n\nh1,h2,h3,h4,h5 {\n font-weight: bold;\n text-decoration: none;\n padding-left: 0.4em;\n}\n\nh1 {font-size: 1.35em;}\nh2 {font-size: 1.25em;}\nh3 {font-size: 1.1em;}\nh4 {font-size: 1em;}\nh5 {font-size: .9em;}\n\nhr {\n height: 1px;\n}\n\na{\n text-decoration: none;\n}\n\ndt {font-weight: bold;}\n\nol { list-style-type: decimal }\nol ol { list-style-type: lower-alpha }\nol ol ol { list-style-type: lower-roman }\nol ol ol ol { list-style-type: decimal }\nol ol ol ol ol { list-style-type: lower-alpha }\nol ol ol ol ol ol { list-style-type: lower-roman }\nol ol ol ol ol ol ol { list-style-type: decimal }\n\n.txtOptionInput {\n width: 11em;\n}\n\n#contentWrapper .chkOptionInput {\n border: 0;\n}\n\n.externalLink {\n text-decoration: underline;\n}\n\n.indent {margin-left:3em;}\n.outdent {margin-left:3em; text-indent:-3em;}\ncode.escaped {white-space:nowrap;}\n\n.tiddlyLinkExisting {\n font-weight: bold;\n}\n\n.tiddlyLinkNonExisting {\n font-style: italic;\n}\n\n/* the 'a' is required for IE, otherwise it renders the whole tiddler a bold */\na.tiddlyLinkNonExisting.shadow {\n font-weight: bold;\n}\n\n#mainMenu .tiddlyLinkExisting, \n#mainMenu .tiddlyLinkNonExisting,\n#sidebarTabs .tiddlyLinkNonExisting{\n font-weight: normal;\n font-style: normal;\n}\n\n#sidebarTabs .tiddlyLinkExisting {\n font-weight: bold;\n font-style: normal;\n}\n\n.header {\n position: relative;\n}\n\n.header a:hover {\n background: transparent;\n}\n\n.headerShadow {\n position: relative;\n padding: 4.5em 0em 1em 1em;\n left: -1px;\n top: -1px;\n}\n\n.headerForeground {\n position: absolute;\n padding: 4.5em 0em 1em 1em;\n left: 0px;\n top: 0px;\n}\n\n.siteTitle {\n font-size: 3em;\n}\n\n.siteSubtitle {\n font-size: 1.2em;\n}\n\n#mainMenu {\n position: absolute;\n left: 0;\n width: 10em;\n text-align: right;\n line-height: 1.6em;\n padding: 1.5em 0.5em 0.5em 0.5em;\n font-size: 1.1em;\n}\n\n#sidebar {\n position: absolute;\n right: 3px;\n width: 16em;\n font-size: .9em;\n}\n\n#sidebarOptions {\n padding-top: 0.3em;\n}\n\n#sidebarOptions a {\n margin: 0em 0.2em;\n padding: 0.2em 0.3em;\n display: block;\n}\n\n#sidebarOptions input {\n margin: 0.4em 0.5em;\n}\n\n#sidebarOptions .sliderPanel {\n margin-left: 1em;\n padding: 0.5em;\n font-size: .85em;\n}\n\n#sidebarOptions .sliderPanel a {\n font-weight: bold;\n display: inline;\n padding: 0;\n}\n\n#sidebarOptions .sliderPanel input {\n margin: 0 0 .3em 0;\n}\n\n#sidebarTabs .tabContents {\n width: 15em;\n overflow: hidden;\n}\n\n.wizard {\n padding: 0.1em 0em 0em 2em;\n}\n\n.wizard h1 {\n font-size: 2em;\n font-weight: bold;\n background: none;\n padding: 0em 0em 0em 0em;\n margin: 0.4em 0em 0.2em 0em;\n}\n\n.wizard h2 {\n font-size: 1.2em;\n font-weight: bold;\n background: none;\n padding: 0em 0em 0em 0em;\n margin: 0.2em 0em 0.2em 0em;\n}\n\n.wizardStep {\n padding: 1em 1em 1em 1em;\n}\n\n.wizard .button {\n margin: 0.5em 0em 0em 0em;\n font-size: 1.2em;\n}\n\n#messageArea {\nposition:absolute; top:0; right:0; margin: 0.5em; padding: 0.5em;\n}\n\n*[id='messageArea'] {\nposition:fixed !important; z-index:99;}\n\n.messageToolbar {\ndisplay: block;\ntext-align: right;\n}\n\n#messageArea a{\n text-decoration: underline;\n}\n\n.popup {\n font-size: .9em;\n padding: 0.2em;\n list-style: none;\n margin: 0;\n}\n\n.popup hr {\n display: block;\n height: 1px;\n width: auto;\n padding: 0;\n margin: 0.2em 0em;\n}\n\n.listBreak {\n font-size: 1px;\n line-height: 1px;\n}\n\n.listBreak div {\n margin: 2px 0;\n}\n\n.popup li.disabled {\n padding: 0.2em;\n}\n\n.popup li a{\n display: block;\n padding: 0.2em;\n}\n\n.tabset {\n padding: 1em 0em 0em 0.5em;\n}\n\n.tab {\n margin: 0em 0em 0em 0.25em;\n padding: 2px;\n}\n\n.tabContents {\n padding: 0.5em;\n}\n\n.tabContents ul, .tabContents ol {\n margin: 0;\n padding: 0;\n}\n\n.txtMainTab .tabContents li {\n list-style: none;\n}\n\n.tabContents li.listLink {\n margin-left: .75em;\n}\n\n#displayArea {\n margin: 1em 17em 0em 14em;\n}\n\n\n.toolbar {\n text-align: right;\n font-size: .9em;\n visibility: hidden;\n}\n\n.selected .toolbar {\n visibility: visible;\n}\n\n.tiddler {\n padding: 1em 1em 0em 1em;\n}\n\n.missing .viewer,.missing .title {\n font-style: italic;\n}\n\n.title {\n font-size: 1.6em;\n font-weight: bold;\n}\n\n.missing .subtitle {\n display: none;\n}\n\n.subtitle {\n font-size: 1.1em;\n}\n\n.tiddler .button {\n padding: 0.2em 0.4em;\n}\n\n.tagging {\nmargin: 0.5em 0.5em 0.5em 0;\nfloat: left;\ndisplay: none;\n}\n\n.isTag .tagging {\ndisplay: block;\n}\n\n.tagged {\nmargin: 0.5em;\nfloat: right;\n}\n\n.tagging, .tagged {\nfont-size: 0.9em;\npadding: 0.25em;\n}\n\n.tagging ul, .tagged ul {\nlist-style: none;margin: 0.25em;\npadding: 0;\n}\n\n.tagClear {\nclear: both;\n}\n\n.footer {\n font-size: .9em;\n}\n\n.footer li {\ndisplay: inline;\n}\n\n* html .viewer pre {\n width: 99%;\n padding: 0 0 1em 0;\n}\n\n.viewer {\n line-height: 1.4em;\n padding-top: 0.5em;\n}\n\n.viewer .button {\n margin: 0em 0.25em;\n padding: 0em 0.25em;\n}\n\n.viewer blockquote {\n line-height: 1.5em;\n padding-left: 0.8em;\n margin-left: 2.5em;\n}\n\n.viewer ul, .viewer ol{\n margin-left: 0.5em;\n padding-left: 1.5em;\n}\n\n.viewer table {\n border-collapse: collapse;\n margin: 0.8em 1.0em;\n}\n\n.viewer th, .viewer td, .viewer tr,.viewer caption{\n padding: 3px;\n}\n\n.viewer table.listView {\n font-size: 0.85em;\n margin: 0.8em 1.0em;\n}\n\n.viewer table.listView th, .viewer table.listView td, .viewer table.listView tr {\n padding: 0px 3px 0px 3px;\n}\n\n.viewer pre {\n padding: 0.5em;\n margin-left: 0.5em;\n font-size: 1.2em;\n line-height: 1.4em;\n overflow: auto;\n}\n\n.viewer code {\n font-size: 1.2em;\n line-height: 1.4em;\n}\n\n.editor {\nfont-size: 1.1em;\n}\n\n.editor input, .editor textarea {\n display: block;\n width: 100%;\n font: inherit;\n}\n\n.editorFooter {\n padding: 0.25em 0em;\n font-size: .9em;\n}\n\n.editorFooter .button {\npadding-top: 0px; padding-bottom: 0px;}\n\n.fieldsetFix {border: 0;\npadding: 0;\nmargin: 1px 0px 1px 0px;\n}\n\n.sparkline {\n line-height: 1em;\n}\n\n.sparktick {\n outline: 0;\n}\n\n.zoomer {\n font-size: 1.1em;\n position: absolute;\n padding: 1em;\n}\n\n.cascade {\n font-size: 1.1em;\n position: absolute;\n overflow: hidden;\n}\n/*}}}*/", - StyleSheetPrint: "/*{{{*/\n@media print {\n#mainMenu, #sidebar, #messageArea, .toolbar {display: none ! important;}\n#displayArea {margin: 1em 1em 0em 1em;}\n/* Fixes a feature in Firefox 1.5.0.2 where print preview displays the noscript content */\nnoscript {display:none;}\n}\n/*}}}*/", - PageTemplate: "\n
    \n
    \n \n\n
    \n
    \n \n\n
    \n
    \n\n\n
    \n
    \n
    \n
    \n", - ViewTemplate: "\n
    \n
    \n
    , ( )
    \n
    \n
    \n
    \n
    \n", - EditTemplate: "\n
    \n
    \n
    \n
    \n
    \n", - MarkupPreHead: "\n\n", - MarkupPostHead: "", - MarkupPreBody: "", - MarkupPostBody: "" - }; + ColorPalette: "Background: #fff\n" + + "Foreground: #000\n" + + "PrimaryPale: #8cf\n" + + "PrimaryLight: #18f\n" + + "PrimaryMid: #04b\n" + + "PrimaryDark: #014\n" + + "SecondaryPale: #ffc\n" + + "SecondaryLight: #fe8\n" + + "SecondaryMid: #db4\n" + + "SecondaryDark: #841\n" + + "TertiaryPale: #eee\n" + + "TertiaryLight: #ccc\n" + + "TertiaryMid: #999\n" + + "TertiaryDark: #666\n" + + "Error: #f88\n", + StyleSheet: "", + StyleSheetColors: "/*{{{*/\nbody {\n background: [[ColorPalette::Background]];\n color: [[ColorPalette::Foreground]];\n}\n\na{\n color: [[ColorPalette::PrimaryMid]];\n}\n\na:hover{\n background: [[ColorPalette::PrimaryMid]];\n color: [[ColorPalette::Background]];\n}\n\na img{\n border: 0;\n}\n\nh1,h2,h3,h4,h5 {\n color: [[ColorPalette::SecondaryDark]];\n background: [[ColorPalette::PrimaryPale]];\n}\n\n.button {\n color: [[ColorPalette::PrimaryDark]];\n border: 1px solid [[ColorPalette::Background]];\n}\n\n.button:hover {\n color: [[ColorPalette::PrimaryDark]];\n background: [[ColorPalette::SecondaryLight]];\n border-color: [[ColorPalette::SecondaryMid]];\n}\n\n.button:active {\n color: [[ColorPalette::Background]];\n background: [[ColorPalette::SecondaryMid]];\n border: 1px solid [[ColorPalette::SecondaryDark]];\n}\n\n.header {\n background: [[ColorPalette::PrimaryMid]];\n}\n\n.headerShadow {\n color: [[ColorPalette::Foreground]];\n}\n\n.headerShadow a {\n font-weight: normal;\n color: [[ColorPalette::Foreground]];\n}\n\n.headerForeground {\n color: [[ColorPalette::Background]];\n}\n\n.headerForeground a {\n font-weight: normal;\n color: [[ColorPalette::PrimaryPale]];\n}\n\n.tabSelected{\n color: [[ColorPalette::PrimaryDark]];\n background: [[ColorPalette::TertiaryPale]];\n border-left: 1px solid [[ColorPalette::TertiaryLight]];\n border-top: 1px solid [[ColorPalette::TertiaryLight]];\n border-right: 1px solid [[ColorPalette::TertiaryLight]];\n}\n\n.tabUnselected {\n color: [[ColorPalette::Background]];\n background: [[ColorPalette::TertiaryMid]];\n}\n\n.tabContents {\n color: [[ColorPalette::PrimaryDark]];\n background: [[ColorPalette::TertiaryPale]];\n border: 1px solid [[ColorPalette::TertiaryLight]];\n}\n\n.tabContents .button {\n border: 0;}\n\n#sidebar {\n}\n\n#sidebarOptions input {\n border: 1px solid [[ColorPalette::PrimaryMid]];\n}\n\n#sidebarOptions .sliderPanel {\n background: [[ColorPalette::PrimaryPale]];\n}\n\n#sidebarOptions .sliderPanel a {\n border: none;\n color: [[ColorPalette::PrimaryMid]];\n}\n\n#sidebarOptions .sliderPanel a:hover {\n color: [[ColorPalette::Background]];\n background: [[ColorPalette::PrimaryMid]];\n}\n\n#sidebarOptions .sliderPanel a:active {\n color: [[ColorPalette::PrimaryMid]];\n background: [[ColorPalette::Background]];\n}\n\n.wizard {\n background: [[ColorPalette::SecondaryLight]];\n border-top: 1px solid [[ColorPalette::SecondaryMid]];\n border-left: 1px solid [[ColorPalette::SecondaryMid]];\n}\n\n.wizard h1 {\n color: [[ColorPalette::SecondaryDark]];\n}\n\n.wizard h2 {\n color: [[ColorPalette::Foreground]];\n}\n\n.wizardStep {\n background: [[ColorPalette::Background]];\n border-top: 1px solid [[ColorPalette::SecondaryMid]];\n border-bottom: 1px solid [[ColorPalette::SecondaryMid]];\n border-left: 1px solid [[ColorPalette::SecondaryMid]];\n}\n\n.wizard .button {\n color: [[ColorPalette::Background]];\n background: [[ColorPalette::PrimaryMid]];\n border-top: 1px solid [[ColorPalette::PrimaryLight]];\n border-right: 1px solid [[ColorPalette::PrimaryDark]];\n border-bottom: 1px solid [[ColorPalette::PrimaryDark]];\n border-left: 1px solid [[ColorPalette::PrimaryLight]];\n}\n\n.wizard .button:hover {\n color: [[ColorPalette::PrimaryLight]];\n background: [[ColorPalette::PrimaryDark]];\n border-color: [[ColorPalette::PrimaryLight]];\n}\n\n.wizard .button:active {\n color: [[ColorPalette::Background]];\n background: [[ColorPalette::PrimaryMid]];\n border-top: 1px solid [[ColorPalette::PrimaryLight]];\n border-right: 1px solid [[ColorPalette::PrimaryDark]];\n border-bottom: 1px solid [[ColorPalette::PrimaryDark]];\n border-left: 1px solid [[ColorPalette::PrimaryLight]];\n}\n\n#messageArea {\n border: 1px solid [[ColorPalette::SecondaryDark]];\n background: [[ColorPalette::SecondaryMid]];\n color: [[ColorPalette::PrimaryDark]];\n}\n\n#messageArea .button {\n padding: 0.2em 0.2em 0.2em 0.2em;\n color: [[ColorPalette::PrimaryDark]];\n background: [[ColorPalette::Background]];\n}\n\n.popup {\n background: [[ColorPalette::PrimaryLight]];\n border: 1px solid [[ColorPalette::PrimaryMid]];\n}\n\n.popup hr {\n color: [[ColorPalette::PrimaryDark]];\n background: [[ColorPalette::PrimaryDark]];\n border-bottom: 1px;\n}\n\n.listBreak div{\n border-bottom: 1px solid [[ColorPalette::PrimaryDark]];\n}\n\n.popup li.disabled {\n color: [[ColorPalette::PrimaryMid]];\n}\n\n.popup li a, .popup li a:visited {\n color: [[ColorPalette::TertiaryPale]];\n border: none;\n}\n\n.popup li a:hover {\n background: [[ColorPalette::PrimaryDark]];\n color: [[ColorPalette::Background]];\n border: none;\n}\n\n.tiddler .defaultCommand {\n font-weight: bold;\n}\n\n.shadow .title {\n color: [[ColorPalette::TertiaryDark]];\n}\n\n.title {\n color: [[ColorPalette::SecondaryDark]];\n}\n\n.subtitle {\n color: [[ColorPalette::TertiaryDark]];\n}\n\n.toolbar {\n color: [[ColorPalette::PrimaryMid]];\n}\n\n.tagging, .tagged {\n border: 1px solid [[ColorPalette::TertiaryPale]];\n background-color: [[ColorPalette::TertiaryPale]];\n}\n\n.selected .tagging, .selected .tagged {\n background-color: [[ColorPalette::TertiaryLight]];\n border: 1px solid [[ColorPalette::TertiaryMid]];\n}\n\n.tagging .listTitle, .tagged .listTitle {\n color: [[ColorPalette::PrimaryDark]];\n}\n\n.tagging .button, .tagged .button {\n border: none;\n}\n\n.footer {\n color: [[ColorPalette::TertiaryLight]];\n}\n\n.selected .footer {\n color: [[ColorPalette::TertiaryMid]];\n}\n\n.sparkline {\n background: [[ColorPalette::PrimaryPale]];\n border: 0;\n}\n\n.sparktick {\n background: [[ColorPalette::PrimaryDark]];\n}\n\n.error, .errorButton {\n color: [[ColorPalette::Foreground]];\n background: [[ColorPalette::Error]];\n}\n\n.warning {\n color: [[ColorPalette::Foreground]];\n background: [[ColorPalette::SecondaryPale]];\n}\n\n.cascade {\n background: [[ColorPalette::TertiaryPale]];\n color: [[ColorPalette::TertiaryMid]];\n border: 1px solid [[ColorPalette::TertiaryMid]];\n}\n\n.imageLink, #displayArea .imageLink {\n background: transparent;\n}\n\n.viewer .listTitle {list-style-type: none; margin-left: -2em;}\n\n.viewer .button {\n border: 1px solid [[ColorPalette::SecondaryMid]];\n}\n\n.viewer blockquote {\n border-left: 3px solid [[ColorPalette::TertiaryDark]];\n}\n\n.viewer table {\n border: 2px solid [[ColorPalette::TertiaryDark]];\n}\n\n.viewer th, thead td {\n background: [[ColorPalette::SecondaryMid]];\n border: 1px solid [[ColorPalette::TertiaryDark]];\n color: [[ColorPalette::Background]];\n}\n\n.viewer td, .viewer tr {\n border: 1px solid [[ColorPalette::TertiaryDark]];\n}\n\n.viewer pre {\n border: 1px solid [[ColorPalette::SecondaryLight]];\n background: [[ColorPalette::SecondaryPale]];\n}\n\n.viewer code {\n color: [[ColorPalette::SecondaryDark]];\n}\n\n.viewer hr {\n border: 0;\n border-top: dashed 1px [[ColorPalette::TertiaryDark]];\n color: [[ColorPalette::TertiaryDark]];\n}\n\n.highlight, .marked {\n background: [[ColorPalette::SecondaryLight]];\n}\n\n.editor input {\n border: 1px solid [[ColorPalette::PrimaryMid]];\n}\n\n.editor textarea {\n border: 1px solid [[ColorPalette::PrimaryMid]];\n width: 100%;\n}\n\n.editorFooter {\n color: [[ColorPalette::TertiaryMid]];\n}\n\n/*}}}*/", + StyleSheetLayout: "/*{{{*/\n* html .tiddler {\n height: 1%;\n}\n\nbody {\n font-size: .75em;\n font-family: arial,helvetica;\n margin: 0;\n padding: 0;\n}\n\nh1,h2,h3,h4,h5 {\n font-weight: bold;\n text-decoration: none;\n padding-left: 0.4em;\n}\n\nh1 {font-size: 1.35em;}\nh2 {font-size: 1.25em;}\nh3 {font-size: 1.1em;}\nh4 {font-size: 1em;}\nh5 {font-size: .9em;}\n\nhr {\n height: 1px;\n}\n\na{\n text-decoration: none;\n}\n\ndt {font-weight: bold;}\n\nol { list-style-type: decimal }\nol ol { list-style-type: lower-alpha }\nol ol ol { list-style-type: lower-roman }\nol ol ol ol { list-style-type: decimal }\nol ol ol ol ol { list-style-type: lower-alpha }\nol ol ol ol ol ol { list-style-type: lower-roman }\nol ol ol ol ol ol ol { list-style-type: decimal }\n\n.txtOptionInput {\n width: 11em;\n}\n\n#contentWrapper .chkOptionInput {\n border: 0;\n}\n\n.externalLink {\n text-decoration: underline;\n}\n\n.indent {margin-left:3em;}\n.outdent {margin-left:3em; text-indent:-3em;}\ncode.escaped {white-space:nowrap;}\n\n.tiddlyLinkExisting {\n font-weight: bold;\n}\n\n.tiddlyLinkNonExisting {\n font-style: italic;\n}\n\n/* the 'a' is required for IE, otherwise it renders the whole tiddler a bold */\na.tiddlyLinkNonExisting.shadow {\n font-weight: bold;\n}\n\n#mainMenu .tiddlyLinkExisting, \n#mainMenu .tiddlyLinkNonExisting,\n#sidebarTabs .tiddlyLinkNonExisting{\n font-weight: normal;\n font-style: normal;\n}\n\n#sidebarTabs .tiddlyLinkExisting {\n font-weight: bold;\n font-style: normal;\n}\n\n.header {\n position: relative;\n}\n\n.header a:hover {\n background: transparent;\n}\n\n.headerShadow {\n position: relative;\n padding: 4.5em 0em 1em 1em;\n left: -1px;\n top: -1px;\n}\n\n.headerForeground {\n position: absolute;\n padding: 4.5em 0em 1em 1em;\n left: 0px;\n top: 0px;\n}\n\n.siteTitle {\n font-size: 3em;\n}\n\n.siteSubtitle {\n font-size: 1.2em;\n}\n\n#mainMenu {\n position: absolute;\n left: 0;\n width: 10em;\n text-align: right;\n line-height: 1.6em;\n padding: 1.5em 0.5em 0.5em 0.5em;\n font-size: 1.1em;\n}\n\n#sidebar {\n position: absolute;\n right: 3px;\n width: 16em;\n font-size: .9em;\n}\n\n#sidebarOptions {\n padding-top: 0.3em;\n}\n\n#sidebarOptions a {\n margin: 0em 0.2em;\n padding: 0.2em 0.3em;\n display: block;\n}\n\n#sidebarOptions input {\n margin: 0.4em 0.5em;\n}\n\n#sidebarOptions .sliderPanel {\n margin-left: 1em;\n padding: 0.5em;\n font-size: .85em;\n}\n\n#sidebarOptions .sliderPanel a {\n font-weight: bold;\n display: inline;\n padding: 0;\n}\n\n#sidebarOptions .sliderPanel input {\n margin: 0 0 .3em 0;\n}\n\n#sidebarTabs .tabContents {\n width: 15em;\n overflow: hidden;\n}\n\n.wizard {\n padding: 0.1em 0em 0em 2em;\n}\n\n.wizard h1 {\n font-size: 2em;\n font-weight: bold;\n background: none;\n padding: 0em 0em 0em 0em;\n margin: 0.4em 0em 0.2em 0em;\n}\n\n.wizard h2 {\n font-size: 1.2em;\n font-weight: bold;\n background: none;\n padding: 0em 0em 0em 0em;\n margin: 0.2em 0em 0.2em 0em;\n}\n\n.wizardStep {\n padding: 1em 1em 1em 1em;\n}\n\n.wizard .button {\n margin: 0.5em 0em 0em 0em;\n font-size: 1.2em;\n}\n\n#messageArea {\nposition:absolute; top:0; right:0; margin: 0.5em; padding: 0.5em;\n}\n\n*[id='messageArea'] {\nposition:fixed !important; z-index:99;}\n\n.messageToolbar {\ndisplay: block;\ntext-align: right;\n}\n\n#messageArea a{\n text-decoration: underline;\n}\n\n.popup {\n font-size: .9em;\n padding: 0.2em;\n list-style: none;\n margin: 0;\n}\n\n.popup hr {\n display: block;\n height: 1px;\n width: auto;\n padding: 0;\n margin: 0.2em 0em;\n}\n\n.listBreak {\n font-size: 1px;\n line-height: 1px;\n}\n\n.listBreak div {\n margin: 2px 0;\n}\n\n.popup li.disabled {\n padding: 0.2em;\n}\n\n.popup li a{\n display: block;\n padding: 0.2em;\n}\n\n.tabset {\n padding: 1em 0em 0em 0.5em;\n}\n\n.tab {\n margin: 0em 0em 0em 0.25em;\n padding: 2px;\n}\n\n.tabContents {\n padding: 0.5em;\n}\n\n.tabContents ul, .tabContents ol {\n margin: 0;\n padding: 0;\n}\n\n.txtMainTab .tabContents li {\n list-style: none;\n}\n\n.tabContents li.listLink {\n margin-left: .75em;\n}\n\n#displayArea {\n margin: 1em 17em 0em 14em;\n}\n\n\n.toolbar {\n text-align: right;\n font-size: .9em;\n visibility: hidden;\n}\n\n.selected .toolbar {\n visibility: visible;\n}\n\n.tiddler {\n padding: 1em 1em 0em 1em;\n}\n\n.missing .viewer,.missing .title {\n font-style: italic;\n}\n\n.title {\n font-size: 1.6em;\n font-weight: bold;\n}\n\n.missing .subtitle {\n display: none;\n}\n\n.subtitle {\n font-size: 1.1em;\n}\n\n.tiddler .button {\n padding: 0.2em 0.4em;\n}\n\n.tagging {\nmargin: 0.5em 0.5em 0.5em 0;\nfloat: left;\ndisplay: none;\n}\n\n.isTag .tagging {\ndisplay: block;\n}\n\n.tagged {\nmargin: 0.5em;\nfloat: right;\n}\n\n.tagging, .tagged {\nfont-size: 0.9em;\npadding: 0.25em;\n}\n\n.tagging ul, .tagged ul {\nlist-style: none;margin: 0.25em;\npadding: 0;\n}\n\n.tagClear {\nclear: both;\n}\n\n.footer {\n font-size: .9em;\n}\n\n.footer li {\ndisplay: inline;\n}\n\n* html .viewer pre {\n width: 99%;\n padding: 0 0 1em 0;\n}\n\n.viewer {\n line-height: 1.4em;\n padding-top: 0.5em;\n}\n\n.viewer .button {\n margin: 0em 0.25em;\n padding: 0em 0.25em;\n}\n\n.viewer blockquote {\n line-height: 1.5em;\n padding-left: 0.8em;\n margin-left: 2.5em;\n}\n\n.viewer ul, .viewer ol{\n margin-left: 0.5em;\n padding-left: 1.5em;\n}\n\n.viewer table {\n border-collapse: collapse;\n margin: 0.8em 1.0em;\n}\n\n.viewer th, .viewer td, .viewer tr,.viewer caption{\n padding: 3px;\n}\n\n.viewer table.listView {\n font-size: 0.85em;\n margin: 0.8em 1.0em;\n}\n\n.viewer table.listView th, .viewer table.listView td, .viewer table.listView tr {\n padding: 0px 3px 0px 3px;\n}\n\n.viewer pre {\n padding: 0.5em;\n margin-left: 0.5em;\n font-size: 1.2em;\n line-height: 1.4em;\n overflow: auto;\n}\n\n.viewer code {\n font-size: 1.2em;\n line-height: 1.4em;\n}\n\n.editor {\nfont-size: 1.1em;\n}\n\n.editor input, .editor textarea {\n display: block;\n width: 100%;\n font: inherit;\n}\n\n.editorFooter {\n padding: 0.25em 0em;\n font-size: .9em;\n}\n\n.editorFooter .button {\npadding-top: 0px; padding-bottom: 0px;}\n\n.fieldsetFix {border: 0;\npadding: 0;\nmargin: 1px 0px 1px 0px;\n}\n\n.sparkline {\n line-height: 1em;\n}\n\n.sparktick {\n outline: 0;\n}\n\n.zoomer {\n font-size: 1.1em;\n position: absolute;\n padding: 1em;\n}\n\n.cascade {\n font-size: 1.1em;\n position: absolute;\n overflow: hidden;\n}\n/*}}}*/", + StyleSheetPrint: "/*{{{*/\n@media print {\n#mainMenu, #sidebar, #messageArea, .toolbar {display: none ! important;}\n#displayArea {margin: 1em 1em 0em 1em;}\n/* Fixes a feature in Firefox 1.5.0.2 where print preview displays the noscript content */\nnoscript {display:none;}\n}\n/*}}}*/", + PageTemplate: "\n
    \n
    \n \n\n
    \n
    \n \n\n
    \n
    \n\n\n
    \n
    \n
    \n
    \n", + ViewTemplate: "\n
    \n
    \n
    , ( )
    \n
    \n
    \n
    \n
    \n", + EditTemplate: "\n
    \n
    \n
    \n
    \n
    \n", + MarkupPreHead: "\n\n", + MarkupPostHead: "", + MarkupPreBody: "", + MarkupPostBody: "" + }; // --------------------------------------------------------------------------------- // Translateable strings @@ -262,50 +262,50 @@ // Strings in "double quotes" should be translated; strings in 'single quotes' should be left alone merge(config.options,{ - txtUserName: "YourName"}); + txtUserName: "YourName"}); merge(config.messages,{ - customConfigError: "Problems were encountered loading plugins. See PluginManager for details", - pluginError: "Error: %0", - pluginDisabled: "Not executed because disabled via 'systemConfigDisable' tag", - pluginForced: "Executed because forced via 'systemConfigForce' tag", - pluginVersionError: "Not executed because this plugin needs a newer version of TiddlyWiki", - nothingSelected: "Nothing is selected. You must select one or more items first", - savedSnapshotError: "It appears that this TiddlyWiki has been incorrectly saved. Please see http://www.tiddlywiki.com/#DownloadSoftware for details", - subtitleUnknown: "(unknown)", - undefinedTiddlerToolTip: "The tiddler '%0' doesn't yet exist", - shadowedTiddlerToolTip: "The tiddler '%0' doesn't yet exist, but has a pre-defined shadow value", - tiddlerLinkTooltip: "%0 - %1, %2", - externalLinkTooltip: "External link to %0", - noTags: "There are no tagged tiddlers", - notFileUrlError: "You need to save this TiddlyWiki to a file before you can save changes", - cantSaveError: "It's not possible to save changes. This could be because your browser doesn't support saving (instead, use FireFox if you can), or because the pathname to your TiddlyWiki file contains illegal characters", - invalidFileError: "The original file '%0' does not appear to be a valid TiddlyWiki", - backupSaved: "Backup saved", - backupFailed: "Failed to save backup file", - rssSaved: "RSS feed saved", - rssFailed: "Failed to save RSS feed file", - emptySaved: "Empty template saved", - emptyFailed: "Failed to save empty template file", - mainSaved: "Main TiddlyWiki file saved", - mainFailed: "Failed to save main TiddlyWiki file. Your changes have not been saved", - macroError: "Error in macro <<%0>>", - macroErrorDetails: "Error while executing macro <<%0>>:\n%1", - missingMacro: "No such macro", - overwriteWarning: "A tiddler named '%0' already exists. Choose OK to overwrite it", - unsavedChangesWarning: "WARNING! There are unsaved changes in TiddlyWiki\n\nChoose OK to save\nChoose CANCEL to discard", - confirmExit: "--------------------------------\n\nThere are unsaved changes in TiddlyWiki. If you continue you will lose those changes\n\n--------------------------------", - saveInstructions: "SaveChanges", - unsupportedTWFormat: "Unsupported TiddlyWiki format '%0'", - tiddlerSaveError: "Error when saving tiddler '%0'", - tiddlerLoadError: "Error when loading tiddler '%0'", - wrongSaveFormat: "Cannot save with storage format '%0'. Using standard format for save.", - invalidFieldName: "Invalid field name %0", - fieldCannotBeChanged: "Field '%0' cannot be changed"}); + customConfigError: "Problems were encountered loading plugins. See PluginManager for details", + pluginError: "Error: %0", + pluginDisabled: "Not executed because disabled via 'systemConfigDisable' tag", + pluginForced: "Executed because forced via 'systemConfigForce' tag", + pluginVersionError: "Not executed because this plugin needs a newer version of TiddlyWiki", + nothingSelected: "Nothing is selected. You must select one or more items first", + savedSnapshotError: "It appears that this TiddlyWiki has been incorrectly saved. Please see http://www.tiddlywiki.com/#DownloadSoftware for details", + subtitleUnknown: "(unknown)", + undefinedTiddlerToolTip: "The tiddler '%0' doesn't yet exist", + shadowedTiddlerToolTip: "The tiddler '%0' doesn't yet exist, but has a pre-defined shadow value", + tiddlerLinkTooltip: "%0 - %1, %2", + externalLinkTooltip: "External link to %0", + noTags: "There are no tagged tiddlers", + notFileUrlError: "You need to save this TiddlyWiki to a file before you can save changes", + cantSaveError: "It's not possible to save changes. This could be because your browser doesn't support saving (instead, use FireFox if you can), or because the pathname to your TiddlyWiki file contains illegal characters", + invalidFileError: "The original file '%0' does not appear to be a valid TiddlyWiki", + backupSaved: "Backup saved", + backupFailed: "Failed to save backup file", + rssSaved: "RSS feed saved", + rssFailed: "Failed to save RSS feed file", + emptySaved: "Empty template saved", + emptyFailed: "Failed to save empty template file", + mainSaved: "Main TiddlyWiki file saved", + mainFailed: "Failed to save main TiddlyWiki file. Your changes have not been saved", + macroError: "Error in macro <<%0>>", + macroErrorDetails: "Error while executing macro <<%0>>:\n%1", + missingMacro: "No such macro", + overwriteWarning: "A tiddler named '%0' already exists. Choose OK to overwrite it", + unsavedChangesWarning: "WARNING! There are unsaved changes in TiddlyWiki\n\nChoose OK to save\nChoose CANCEL to discard", + confirmExit: "--------------------------------\n\nThere are unsaved changes in TiddlyWiki. If you continue you will lose those changes\n\n--------------------------------", + saveInstructions: "SaveChanges", + unsupportedTWFormat: "Unsupported TiddlyWiki format '%0'", + tiddlerSaveError: "Error when saving tiddler '%0'", + tiddlerLoadError: "Error when loading tiddler '%0'", + wrongSaveFormat: "Cannot save with storage format '%0'. Using standard format for save.", + invalidFieldName: "Invalid field name %0", + fieldCannotBeChanged: "Field '%0' cannot be changed"}); merge(config.messages.messageClose,{ - text: "close", - tooltip: "close this message area"}); + text: "close", + tooltip: "close this message area"}); config.messages.dates.months = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November","December"]; config.messages.dates.days = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"]; @@ -313,48 +313,48 @@ config.messages.dates.shortDays = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"]; merge(config.views.wikified.tag,{ - labelNoTags: "no tags", - labelTags: "tags: ", - openTag: "Open tag '%0'", - tooltip: "Show tiddlers tagged with '%0'", - openAllText: "Open all", - openAllTooltip: "Open all of these tiddlers", - popupNone: "No other tiddlers tagged with '%0'"}); + labelNoTags: "no tags", + labelTags: "tags: ", + openTag: "Open tag '%0'", + tooltip: "Show tiddlers tagged with '%0'", + openAllText: "Open all", + openAllTooltip: "Open all of these tiddlers", + popupNone: "No other tiddlers tagged with '%0'"}); merge(config.views.wikified,{ - defaultText: "The tiddler '%0' doesn't yet exist. Double-click to create it", - defaultModifier: "(missing)", - shadowModifier: "(built-in shadow tiddler)", - createdPrompt: "created"}); + defaultText: "The tiddler '%0' doesn't yet exist. Double-click to create it", + defaultModifier: "(missing)", + shadowModifier: "(built-in shadow tiddler)", + createdPrompt: "created"}); merge(config.views.editor,{ - tagPrompt: "Type tags separated with spaces, [[use double square brackets]] if necessary, or add existing", - defaultText: "Type the text for '%0'"}); + tagPrompt: "Type tags separated with spaces, [[use double square brackets]] if necessary, or add existing", + defaultText: "Type the text for '%0'"}); merge(config.views.editor.tagChooser,{ - text: "tags", - tooltip: "Choose existing tags to add to this tiddler", - popupNone: "There are no tags defined", - tagTooltip: "Add the tag '%0'"}); + text: "tags", + tooltip: "Choose existing tags to add to this tiddler", + popupNone: "There are no tags defined", + tagTooltip: "Add the tag '%0'"}); merge(config.macros.search,{ - label: "search", - prompt: "Search this TiddlyWiki", - accessKey: "F", - successMsg: "%0 tiddlers found matching %1", - failureMsg: "No tiddlers found matching %0"}); + label: "search", + prompt: "Search this TiddlyWiki", + accessKey: "F", + successMsg: "%0 tiddlers found matching %1", + failureMsg: "No tiddlers found matching %0"}); merge(config.macros.tagging,{ - label: "tagging: ", - labelNotTag: "not tagging", - tooltip: "List of tiddlers tagged with '%0'"}); + label: "tagging: ", + labelNotTag: "not tagging", + tooltip: "List of tiddlers tagged with '%0'"}); merge(config.macros.timeline,{ - dateFormat: "DD MMM YYYY"}); + dateFormat: "DD MMM YYYY"}); merge(config.macros.allTags,{ - tooltip: "Show tiddlers tagged with '%0'", - noTags: "There are no tagged tiddlers"}); + tooltip: "Show tiddlers tagged with '%0'", + noTags: "There are no tagged tiddlers"}); config.macros.list.all.prompt = "All tiddlers in alphabetical order"; config.macros.list.missing.prompt = "Tiddlers that have links to them but are not defined"; @@ -362,155 +362,155 @@ config.macros.list.shadowed.prompt = "Tiddlers shadowed with default contents"; merge(config.macros.closeAll,{ - label: "close all", - prompt: "Close all displayed tiddlers (except any that are being edited)"}); + label: "close all", + prompt: "Close all displayed tiddlers (except any that are being edited)"}); merge(config.macros.permaview,{ - label: "permaview", - prompt: "Link to an URL that retrieves all the currently displayed tiddlers"}); + label: "permaview", + prompt: "Link to an URL that retrieves all the currently displayed tiddlers"}); merge(config.macros.saveChanges,{ - label: "save changes", - prompt: "Save all tiddlers to create a new TiddlyWiki", - accessKey: "S"}); + label: "save changes", + prompt: "Save all tiddlers to create a new TiddlyWiki", + accessKey: "S"}); merge(config.macros.newTiddler,{ - label: "new tiddler", - prompt: "Create a new tiddler", - title: "New Tiddler", - accessKey: "N"}); + label: "new tiddler", + prompt: "Create a new tiddler", + title: "New Tiddler", + accessKey: "N"}); merge(config.macros.newJournal,{ - label: "new journal", - prompt: "Create a new tiddler from the current date and time", - accessKey: "J"}); + label: "new journal", + prompt: "Create a new tiddler from the current date and time", + accessKey: "J"}); merge(config.macros.plugins,{ - skippedText: "(This plugin has not been executed because it was added since startup)", - noPluginText: "There are no plugins installed", - confirmDeleteText: "Are you sure you want to delete these tiddlers:\n\n%0", - listViewTemplate : { - columns: [ - {name: 'Selected', field: 'Selected', rowName: 'title', type: 'Selector'}, - {name: 'Title', field: 'title', tiddlerLink: 'title', title: "Title", type: 'TiddlerLink'}, - {name: 'Forced', field: 'forced', title: "Forced", tag: 'systemConfigForce', type: 'TagCheckbox'}, - {name: 'Disabled', field: 'disabled', title: "Disabled", tag: 'systemConfigDisable', type: 'TagCheckbox'}, - {name: 'Executed', field: 'executed', title: "Loaded", type: 'Boolean', trueText: "Yes", falseText: "No"}, - {name: 'Error', field: 'error', title: "Status", type: 'Boolean', trueText: "Error", falseText: "OK"}, - {name: 'Log', field: 'log', title: "Log", type: 'StringList'} - ], - rowClasses: [ - {className: 'error', field: 'error'}, - {className: 'warning', field: 'warning'} - ], - actions: [ - {caption: "More actions...", name: ''}, - {caption: "Remove systemConfig tag", name: 'remove'}, - {caption: "Delete these tiddlers forever", name: 'delete'} - ]} - }); + skippedText: "(This plugin has not been executed because it was added since startup)", + noPluginText: "There are no plugins installed", + confirmDeleteText: "Are you sure you want to delete these tiddlers:\n\n%0", + listViewTemplate : { + columns: [ + {name: 'Selected', field: 'Selected', rowName: 'title', type: 'Selector'}, + {name: 'Title', field: 'title', tiddlerLink: 'title', title: "Title", type: 'TiddlerLink'}, + {name: 'Forced', field: 'forced', title: "Forced", tag: 'systemConfigForce', type: 'TagCheckbox'}, + {name: 'Disabled', field: 'disabled', title: "Disabled", tag: 'systemConfigDisable', type: 'TagCheckbox'}, + {name: 'Executed', field: 'executed', title: "Loaded", type: 'Boolean', trueText: "Yes", falseText: "No"}, + {name: 'Error', field: 'error', title: "Status", type: 'Boolean', trueText: "Error", falseText: "OK"}, + {name: 'Log', field: 'log', title: "Log", type: 'StringList'} + ], + rowClasses: [ + {className: 'error', field: 'error'}, + {className: 'warning', field: 'warning'} + ], + actions: [ + {caption: "More actions...", name: ''}, + {caption: "Remove systemConfig tag", name: 'remove'}, + {caption: "Delete these tiddlers forever", name: 'delete'} + ]} + }); merge(config.macros.refreshDisplay,{ - label: "refresh", - prompt: "Redraw the entire TiddlyWiki display" - }); + label: "refresh", + prompt: "Redraw the entire TiddlyWiki display" + }); merge(config.macros.importTiddlers,{ - readOnlyWarning: "You cannot import tiddlers into a read-only TiddlyWiki. Try opening the TiddlyWiki file from a file:// URL", - defaultPath: "http://www.tiddlywiki.com/index.html", - fetchLabel: "fetch", - fetchPrompt: "Fetch the tiddlywiki file", - fetchError: "There were problems fetching the tiddlywiki file", - confirmOverwriteText: "Are you sure you want to overwrite these tiddlers:\n\n%0", - wizardTitle: "Import tiddlers from another TiddlyWiki file", - step1: "Step 1: Locate the TiddlyWiki file", - step1prompt: "Enter the URL or pathname here: ", - step1promptFile: "...or browse for a file: ", - step1promptFeeds: "...or select a pre-defined feed: ", - step1feedPrompt: "Choose...", - step2: "Step 2: Loading TiddlyWiki file", - step2Text: "Please wait while the file is loaded from: %0", - step3: "Step 3: Choose the tiddlers to import", - step4: "%0 tiddler(s) imported", - step5: "Done", - listViewTemplate: { - columns: [ - {name: 'Selected', field: 'Selected', rowName: 'title', type: 'Selector'}, - {name: 'Title', field: 'title', title: "Title", type: 'String'}, - {name: 'Snippet', field: 'text', title: "Snippet", type: 'String'}, - {name: 'Tags', field: 'tags', title: "Tags", type: 'Tags'} - ], - rowClasses: [ - ], - actions: [ - {caption: "More actions...", name: ''}, - {caption: "Import these tiddlers", name: 'import'} - ]} - }); + readOnlyWarning: "You cannot import tiddlers into a read-only TiddlyWiki. Try opening the TiddlyWiki file from a file:// URL", + defaultPath: "http://www.tiddlywiki.com/index.html", + fetchLabel: "fetch", + fetchPrompt: "Fetch the tiddlywiki file", + fetchError: "There were problems fetching the tiddlywiki file", + confirmOverwriteText: "Are you sure you want to overwrite these tiddlers:\n\n%0", + wizardTitle: "Import tiddlers from another TiddlyWiki file", + step1: "Step 1: Locate the TiddlyWiki file", + step1prompt: "Enter the URL or pathname here: ", + step1promptFile: "...or browse for a file: ", + step1promptFeeds: "...or select a pre-defined feed: ", + step1feedPrompt: "Choose...", + step2: "Step 2: Loading TiddlyWiki file", + step2Text: "Please wait while the file is loaded from: %0", + step3: "Step 3: Choose the tiddlers to import", + step4: "%0 tiddler(s) imported", + step5: "Done", + listViewTemplate: { + columns: [ + {name: 'Selected', field: 'Selected', rowName: 'title', type: 'Selector'}, + {name: 'Title', field: 'title', title: "Title", type: 'String'}, + {name: 'Snippet', field: 'text', title: "Snippet", type: 'String'}, + {name: 'Tags', field: 'tags', title: "Tags", type: 'Tags'} + ], + rowClasses: [ + ], + actions: [ + {caption: "More actions...", name: ''}, + {caption: "Import these tiddlers", name: 'import'} + ]} + }); merge(config.commands.closeTiddler,{ - text: "close", - tooltip: "Close this tiddler"}); + text: "close", + tooltip: "Close this tiddler"}); merge(config.commands.closeOthers,{ - text: "close others", - tooltip: "Close all other tiddlers"}); + text: "close others", + tooltip: "Close all other tiddlers"}); merge(config.commands.editTiddler,{ - text: "edit", - tooltip: "Edit this tiddler", - readOnlyText: "view", - readOnlyTooltip: "View the source of this tiddler"}); + text: "edit", + tooltip: "Edit this tiddler", + readOnlyText: "view", + readOnlyTooltip: "View the source of this tiddler"}); merge(config.commands.saveTiddler,{ - text: "done", - tooltip: "Save changes to this tiddler"}); + text: "done", + tooltip: "Save changes to this tiddler"}); merge(config.commands.cancelTiddler,{ - text: "cancel", - tooltip: "Undo changes to this tiddler", - warning: "Are you sure you want to abandon your changes to '%0'?", - readOnlyText: "done", - readOnlyTooltip: "View this tiddler normally"}); + text: "cancel", + tooltip: "Undo changes to this tiddler", + warning: "Are you sure you want to abandon your changes to '%0'?", + readOnlyText: "done", + readOnlyTooltip: "View this tiddler normally"}); merge(config.commands.deleteTiddler,{ - text: "delete", - tooltip: "Delete this tiddler", - warning: "Are you sure you want to delete '%0'?"}); + text: "delete", + tooltip: "Delete this tiddler", + warning: "Are you sure you want to delete '%0'?"}); merge(config.commands.permalink,{ - text: "permalink", - tooltip: "Permalink for this tiddler"}); + text: "permalink", + tooltip: "Permalink for this tiddler"}); merge(config.commands.references,{ - text: "references", - tooltip: "Show tiddlers that link to this one", - popupNone: "No references"}); + text: "references", + tooltip: "Show tiddlers that link to this one", + popupNone: "No references"}); merge(config.commands.jump,{ - text: "jump", - tooltip: "Jump to another open tiddler"}); + text: "jump", + tooltip: "Jump to another open tiddler"}); merge(config.shadowTiddlers,{ - DefaultTiddlers: "GettingStarted", - MainMenu: "GettingStarted", - SiteTitle: "My TiddlyWiki", - SiteSubtitle: "a reusable non-linear personal web notebook", - SiteUrl: "http://www.tiddlywiki.com/", - GettingStarted: "To get started with this blank TiddlyWiki, you'll need to modify the following tiddlers:\n* SiteTitle & SiteSubtitle: The title and subtitle of the site, as shown above (after saving, they will also appear in the browser title bar)\n* MainMenu: The menu (usually on the left)\n* DefaultTiddlers: Contains the names of the tiddlers that you want to appear when the TiddlyWiki is opened\nYou'll also need to enter your username for signing your edits: <

    +

    + +An Overview of Cryptography + +

    +

    +Gary C. Kessler
    +May 1998
    +(26 September 2005) +

    +
    +
    +

    +A much shorter, edited version of this paper appears in the 1999 Edition of Handbook on Local Area Networks, published by Auerbach in September 1998. Since that time, this article has taken on a life of its own... +

    +
    +