From c2558af9c874dc88d4ece02b38cafee95a272518 Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Sat, 28 Aug 2010 08:29:47 -0700 Subject: [PATCH] Document and correct implementation of EXCLUSION_MASK 1. Require KLUDGEFREE if existing rule uses mark match 2. Pretty up the code 3. Use MASK_BITS rather than TC_BITS when calculating the offset of EXCLUSION_MASK Signed-off-by: Tom Eastep --- Shorewall/Perl/Shorewall/Chains.pm | 34 +++++++++++++++++++---------- Shorewall/Perl/Shorewall/Config.pm | 4 ++-- Shorewall/releasenotes.txt | 3 ++- docs/PacketMarking.xml | 8 +++++-- docs/images/MarkGeometry.dia | Bin 1894 -> 2039 bytes docs/images/MarkGeometry.png | Bin 13085 -> 17687 bytes 6 files changed, 32 insertions(+), 17 deletions(-) diff --git a/Shorewall/Perl/Shorewall/Chains.pm b/Shorewall/Perl/Shorewall/Chains.pm index adc46b3fa..4bfeebb16 100644 --- a/Shorewall/Perl/Shorewall/Chains.pm +++ b/Shorewall/Perl/Shorewall/Chains.pm @@ -3487,21 +3487,29 @@ sub expand_rule( $$$$$$$$$$;$ ) if ( $iexcl || $dexcl || $oexcl ) { # - # We have non-trivial exclusion -- need to create an exclusion chain + # We have non-trivial exclusion # if ( $disposition eq 'RETURN' || $disposition eq 'CONTINUE' ) { # # We can't use an exclusion chain -- we mark those packets to be excluded and then condition the following rules based on the mark value # - require_capability 'MARK_ANYWHERE' , 'Exclusion in ACCEPT+/CONTINUE/NONAT rules', 's'; + require_capability 'MARK_ANYWHERE' , 'Exclusion in ACCEPT+/CONTINUE/NONAT rules', 's' unless $chainref->{table} eq 'mangle'; + require_capability 'KLUDGEFREE' , 'Exclusion in ACCEPT+/CONTINUE/NONAT rules', 's' if $rule -~ / -m mark /; + # + # Clear the exclusion bit + # add_rule $chainref = $chainref , '-j MARK --and-mark ' . in_hex( $globals{EXCLUSION_MASK} ^ 0xffffffff ); - + # + # Mark packet if it matches any of the exclusions + # my $exclude = '-j MARK --or-mark ' . in_hex( $globals{EXCLUSION_MASK} ); add_rule $chainref, ( match_source_net $_ , $restriction ) . $exclude for ( mysplit $iexcl ); add_rule $chainref, ( match_dest_net $_ ) . $exclude for ( mysplit $dexcl ); add_rule $chainref, ( match_orig_dest $_ ) . $exclude for ( mysplit $oexcl ); - + # + # Augment the rule to include 'not excluded' + # $rule .= '-m mark --mark 0/' . in_hex( $globals{EXCLUSION_MASK} ) . ' '; } else { # @@ -3514,23 +3522,25 @@ sub expand_rule( $$$$$$$$$$;$ ) # Use the current rule and send all possible matches to the exclusion chain # for my $onet ( mysplit $onets ) { + $onet = match_orig_dest $onet; + for my $inet ( mysplit $inets ) { + + my $source_match = match_source_net( $inet, $restriction ) if have_capability( 'KLUDGEFREE' ); + for my $dnet ( mysplit $dnets ) { - # - # We evaluate the source net match in the inner loop to accomodate systems without $capabilities{KLUDGEFREE} - # - add_jump( $chainref, $echainref, 0, join( '', $rule, match_source_net( $inet, $restriction ), match_dest_net( $dnet ), $onet ), 1 ); + $source_match = match_source_net( $inet, $restriction ) unless have_capability( 'KLUDGEFREE' ); + add_jump( $chainref, $echainref, 0, join( '', $rule, $source_match, match_dest_net( $dnet ), $onet ), 1 ); } } } - # # Generate RETURNs for each exclusion # add_rule $echainref, ( match_source_net $_ , $restriction ) . '-j RETURN' for ( mysplit $iexcl ); - add_rule $echainref, ( match_dest_net $_ ) . '-j RETURN' for ( mysplit $dexcl ); - add_rule $echainref, ( match_orig_dest $_ ) . '-j RETURN' for ( mysplit $oexcl ); + add_rule $echainref, ( match_dest_net $_ ) . '-j RETURN' for ( mysplit $dexcl ); + add_rule $echainref, ( match_orig_dest $_ ) . '-j RETURN' for ( mysplit $oexcl ); # # Log rule # @@ -3554,7 +3564,7 @@ sub expand_rule( $$$$$$$$$$;$ ) unless ( $done ) { # - # No exclusions + # No non-trivial exclusions or we're using marks to handle them # for my $onet ( mysplit $onets ) { $onet = match_orig_dest $onet; diff --git a/Shorewall/Perl/Shorewall/Config.pm b/Shorewall/Perl/Shorewall/Config.pm index d73aa6831..7e218ea51 100644 --- a/Shorewall/Perl/Shorewall/Config.pm +++ b/Shorewall/Perl/Shorewall/Config.pm @@ -3094,8 +3094,8 @@ sub get_configuration( $ ) { $config{PROVIDER_OFFSET} = $config{MASK_BITS} if $config{PROVIDER_OFFSET} < $config{MASK_BITS}; fatal_error 'PROVIDER_BITS + PROVIDER_OFFSET > 32' if $config{PROVIDER_BITS} + $config{PROVIDER_OFFSET} > 31; $globals{EXCLUSION_MASK} = 1 << ( $config{PROVIDER_OFFSET} + $config{PROVIDER_BITS} ); - } elsif ( $config{TC_BITS} >= $config{PROVIDER_BITS} ) { - $globals{EXCLUSION_MASK} = 1 << $config{TC_BITS}; + } elsif ( $config{MASK_BITS} >= $config{PROVIDER_BITS} ) { + $globals{EXCLUSION_MASK} = 1 << $config{MASK_BITS}; } else { $globals{EXCLUSION_MASK} = 1 << $config{PROVIDER_BITS}; } diff --git a/Shorewall/releasenotes.txt b/Shorewall/releasenotes.txt index f457b1778..5556502e7 100644 --- a/Shorewall/releasenotes.txt +++ b/Shorewall/releasenotes.txt @@ -35,7 +35,8 @@ VI. PROBLEMS CORRECTED AND NEW FEATURES IN PRIOR RELEASES address/net) in CONTINUE, NONAT and ACCEPT+ rules generated valid but incorrect iptables input. This has been corrected but requires that your iptables/kernel support marking rules in any - Netfilter table. + Netfilter table (CONTINUE in the tcrules file does not require this + support). This fix implements a new 'Mark in any table' capability; those who utilize a capabilities file should re-generate the file using diff --git a/docs/PacketMarking.xml b/docs/PacketMarking.xml index 45e24eb7e..c63782a77 100644 --- a/docs/PacketMarking.xml +++ b/docs/PacketMarking.xml @@ -331,7 +331,7 @@ tcp 6 19 TIME_WAIT src=206.124.146.176 dst=192.136.34.98 sport=58597 dport= WIDE_TC_MARKS=No, HIGH_ROUTE_MARKS=No - TC_BITS=8, PROVIDER_BITS=0, PROVIDER_OFFSET=0, + TC_BITS=8, PROVIDER_BITS=8, PROVIDER_OFFSET=0, MASK_BITS=8 @@ -364,7 +364,11 @@ tcp 6 19 TIME_WAIT src=206.124.146.176 dst=192.136.34.98 sport=58597 dport= than 16 when WIDE_TC_MARKS=Yes. Beginning with Shorewall 4.4.12, the field between MASK_BITS and - PROVIDER_OFFSET can be used for any purpose you want. + PROVIDER_OFFSET can be used for any purpose you want. + + Beginning with Shorewall 4.4.13, The first unused bit on the left is + used by Shorewall as an exclusion mark, allowing + exclusion in CONTINUE, NONAT and ACCEPT+ rules.
diff --git a/docs/images/MarkGeometry.dia b/docs/images/MarkGeometry.dia index a4e7277205523ea2422c7a95454bee13774a76db..d5f9947d3aa064d51b9537f9228286d46ecb1ba9 100644 GIT binary patch literal 2039 zcmVm&#URL)$>5zGk3yAF?WBKR}JOmI8~~i@p!Y^=`2coSw!5;wu+S0qkgWG z$x9`&P&he#^O+05<2Tu3SC=OQr-C?TV z{B+U?zI=O4YshLV9U?rNGtTxOA|`X+Oh1{gsZ{%q5Ncq>(QZ*LS9}%SPde%if)Dl6!`J6y*Li_mrl2X7hdpNvEqg(cSBUy z4KV=(OV7Z-YS0fc0**y21%n_PU-Rd+%R7xaPtiyKm2;z*`+> z_J58o_b+r&8?Ilp9_YF~?rf7)pf=+{sjOU$2~~h37oUVvUi_)@a6T=dQ4bNRA}+9> zcU-5BwCNwqM+QBBZI_iu%Vo#F4wQ7e#3&7^{w=(uQi~KF40JV_6 zt=%x4zt#EMy=aMD*B2R-DzSz9Ep>oNm-$~fTL3)fFDc8)3>l{_54teOM&Dp<^1%4=>3TEZ3ih)^L+jzG5C`F6*_Yx$+jm6N7 zVrJ06ss=P4!x%O=)UUadT0qzyMGR}j=ALlnXC5OU<^P^Ne{J0m6rvGe5?av!A<8ncGyc z9|u^_!ixP+$V>%GnZuf9Kie%Vq&|c(s>(sLDk0P4N0XlyLVjv5m!@h(>M=%=k~FKU z6pD%?X=VxA3KDmM_I&yM{BKQs+9W%aS5u^CsY`c0xT6|CbW(*1{guov>+>PW1%Rc z2%2d@2kG1$%Ovjq%>sXklWI(m1h)@P-LsH0LB<(Yke z19?oyXu6W7@-)$|hw?DS(zQ6$OpoP(%u+LG7!%sCKr3x!K~YC?y1XdT^JZG2y>f|G zdsQ|efaR+*tVWO2SmGeYRDeO)GS#gEJEhU|3|fmPZ4?`)CPN*RXt?&;X~HtSF0Fwz z8mbmJw%X@9Sb??l9Gcc><(8=9Quhu4!nK!OXGfSeeP*fz$xi_yz#(lMnOd`1yX?59 z021mfuUc5IZOi@WQvG{DTkdiF#l;BNrq#lpdk7qJxy6)9I16`Z&;5@?pO@NhQn%PJ z^{)HwoR^B8=1BMY=Sbtmxe3b83`7HU&brygaqbNh6DZv@j|~=OkkMM-XQP=(*O^J} z^}pBw=$HZ2WZojhplTXtK-B(kiAOq-u=sF04(6)I4aG@}Uyw2K#jl#1wDesw+oq`# z86BK$#_RyI%~%DEX1Rh*Y=wfEVhhYfDz8E1ujVJ2HyT$`#scIy9Y&#NOiR2ZyHCIJ V@$_izJ0VYx{s;amITN2S}W+3uCNWS-S&P7t*zPp=+){RKgAdXH42*80QqDkxr z(e!li{o=!GZ}9Hy=&c{{H|qa1;WJBpB1-ky>EKGr`J3VJ_VyNp_bHcg0>a=Lq+<9V z4?{jwjfR7>BgnVc~*wG>;RR@IY=tj^j8KJjzjJaxI$Uq!S)07kjK*sJZpaK+5=u`@iI2x=jc2 z%MTH^YxGW&z<)e=S6b9qxea`IHM;9)xN__F9a+B#(qJ5ls=E&&xi|Co`!T=%?PM9e z{CG=m$gR~rB79F!L3e*dOs@l9q))inYMUBMS4FeoQ=`7#Zrg#$FReYWGl-Dii=;6B zzI;?$#TQ&;9E(q6aI-jD8k2bZub9Z9v*(gWK2Ln>we>!}8$&9ejbSgSFm0 zWlZJ4jnSINrAyhsp~tTJu|5Wy8Ke$jJYEM#R2O(O4Mho}F-~k7KzfW^;59=Np_q*( zaT0CPggy2tL&=iKX1^X12?I8TO9yI!btQu7m3#yYf`;bDapH^Qsm>_#i(U{05poc2 z1{Xx?n;ETUhe`^0c?n@Ni1aGH9aT`^r=RWBd1zP$-4;=JA@1Z-7@{H!QQI)YHn6dZ z3=G^3;}9djT-((!2+|Wwfa5w?pL!HG3>K+J56?bgWs_vktmehs;Q z{Y!*5LIxB5`h6Vw%g>qJ?_(qU zD?`+Ss|RTZy6TTx`(zWS^?Xn(E0=RZ6ClOKr_oGQf2$(8o>kDO$B0xF7uYR2Zn9fi zkB{=1$WF)YSJQUofcg{Gr#MyXi|VE$p*8Gm?Jv95Nba$1#V`*=b8K}T<|$$KG>hk zw->oY+vXx-1J=1((jd83B5wCWsco0G(McGv#gXYGX6m;uxPI%jjzS7Z_cDnPrS3g< zA(M!so;xV7-#Vs#YxL0;K55iZZ`2X}DfL^obt-fL?7n`havxjNZz%!j0QK9}9W(V? zQ@`DbmUwMrkwT>s4^Y1)3^=5$-%_NWJbkL)Ui@w8>F!3TglIiJdz#1GdLpw{f>}7RZkH4+;XtYg z7FLQgKlNZg6zAyu$BT2LI1f|{uXanrwtnR|=5+)J@8g~MF>YM_-1e2ZM>P9kz=bZ> z?1w<=XjnoS?V9~;_OO!r*pw384mwQ91LOSZm#`|{7nKmPnS`tsq!`JWd? zpB;z^ReGl(LVXly`^(N*qL~PA~|&jy`3uR~pT{K|A118`aKf$WRX@8g4yz+NQZ)SKdH7O;rmV zPp@-5S%P)VJ2a!w>OIlqrT%RKgj-L$&bKh_de2k^QtSd`17;s$%hZea)~KXa4zoAn)~mm*)R35Mcr!0G^_6W gvtKG|yW})K&;CTs+0n}1usJ*WA59S=59@9K06Cbh2><{9 diff --git a/docs/images/MarkGeometry.png b/docs/images/MarkGeometry.png index c5b589f8e4b80b206c4a827b2c5c5985d41b20ae..1ee34d214cc151a97e3651b6f86f33f31909d320 100644 GIT binary patch literal 17687 zcmeHvcTiN@yJe%-gbD^g1OWp_+lit^HDNohz?DAZZ>qX$YT z)KMN3ip28darm2GS564Px8nw~(hpFF$bTR38DS{YRTTQcJr&pZg%LMTxh-Pj%9fG- zTc+#hi)Efzs-DEjEcDhi=E}~gZFCdVSk*a8vMo8i)=NwJ)%+vv&Dn9e{Jm7#2KxR# zESiOy_leXo{)~)_ms#{W8VzG()(+aYJmqO_uZfL0v`2GL1w4d1Ks`N2w#kM30mb|3 z+)?=US@9$f%0AtnlD)-D5m+^T7{mEkBxa_ z_>7uDC=O`u+HkP2uq+bFxRnV=(rBIx;ac%V59O)s@(dH*nAr3<_>uyY?$IF)lnj?Zwd(aMR|WeMm|t_cj-m zJw2;&Dp^=nW0{uiWv`!~U&zSG_5S?ws>tyG<@5f=H&j!fkmJk;xC4TXVPjAPW3Enx z5_1@Obab@x`LCB3E?!iva<+yC$8U{#VAI&u^JW&y#?%T7>L(^97#SECFx$WUX7kwH zHh)hic}Ft7dGls4vc91~1}havlRlm3ArD`x>+33SNGbWeiJk=NXV0Du6&U*E=~gkL zcgKUpd+{DFJG;9rgM*q(GU1&c?!B@aM|-zjJwtm(uEcU6GCMn4CW->G43RC6?*U@0gl7`?r{ zbG6IlLqkJj@<>pBwvjk0p=4LfG--=1B|tziq8Eosl#|3Tj*CP5_>~4)8n|Go%?Qq- z4`=@M^(p`0V0A^s5R;C?-0f}GH?Lo3!WIkJ{r)C7V9p!Uty5#%N_7?%rl6pJ=8jeL z@iWvPc#T`qgiUmG;^+FZGmf36Y9bJ{54Rh|DK1`2RS?^GaP8W)tX+k8fhYWy{VE%C zeUz6kXDy9Xi5K^Wgq(u~GiwQFt@PX}q~g>{^YKBcW~*_kj=`GnTMwz+kb18OOG|P7 ze6sh!yuKEM0Z-7Ar6W3uOSe$8#&soSk(h=KTPN7o zn%DWB9V)j=t*)*vwi@I`o(i5+$o0>MD_5=*JI$+!9`3JU8H)z@JDr3C((v9h?FqtI zMg;|hh?`ID8@Gga`7wCiBqtB%+slXjYYd_bgRlFNl9TiE*|0E~4+E&QDjl2x9Sa(^crH;=p zj#ARl;CeC?vY(_%(TKV``fpCeIxh}I7?+Tsc!Oe~#ArbT8Wm_*mDOPOhK6)>b@`wF zltA}iehD`o!J(;yb=+MyM=OP1e`rM_g^iErty!KXe(w47Owws-STjRDL1}Ag1c?+k z4-ZQSTXV6)?=iQrIeuo4$uii*5N33i$vLdJhKHLQl!N+u(c*TmgI#o?@5hvf0XXFh z`K(>2%VtofR@c_TAjMZFnhoP#RJg5~;D~2w_#QdvN(WsDHA*0HSM&)@gLIU^u1uva&TDwrAHq7&d%96lJQ_?ItiP0u(y?A=3;N(-JLG$G~RF)vQrkypsJNsjxRYw z;*@KBz@;dogAblNtH$X5i_2jn-qew)spFER0@e}i>ZNajTt?j*OX;?>O08nV4%U?) zN=sX={I1`fjM7)h*Aqqeqg-o?8$xn^)i*bzZSfnCiz4ysjDGRjWj4kp4)imf$&%Qd zWGGUGSg0O{e0$6tnM_Pf=@zniv(N6GL4}A4#GjGKD>bMmMM^7u6uY{-!*qLuk?4~H z$RE;Er=E;dI`ySWlOH>A!g6^OZ!ub3(GtO)QRhcK4>zHft(J>af*(ILIQ45p+MHB# zwN!CDw#HZL$395BK_WwKu+;V3_Gs*N-SGD_eY?RV<$pl{VEDHxJ9CZe*0E zhuKiYuePx7ZW3&n&~(Dia$9vDlYBS3G%s_u2hTuoEYmJC|o7(8x{oghBt91!+m|` z86jw$Y&tCM)J5i-*RS6{fBrnuC?=Mc@*r(92Jh}{Rhe~NAF07;BQF0bV^#iW29L_7S(t|GlGF02E<8hT%xzPO3l|KkaQ)Cw zSf!<<+hT4@&ky7eICO|cEmcC*Hs1S*hi?>7$0Bp0Je-}J`r-v0_+0-y&DF2fbDHZd z(6##M1+g|%?N+4cec+^vcUN7TY748Xs)FJi^4s4;^H+>%;u9!P5iAOce1s~;*%a^n zafVX%09Yp7$8mQsX--HHO!C^zx^Uq_Z-JpSe70Dd7pHbc?Ae zXJ*V6NAbcv9R$2bSxRbZQSx;ZYM~AaD#s?*5mX3Iu2u=Q-k|HxuR6#!eu8~iGb6fk zi%FD&Lk^loNV8G5%NQnVyaZmW3lQPyRlr0zJ$xl&7J#N$9z$Q8YIfxHZ?E6H$+8`* zLC_MTIYc?@5pontN*dPd6{}A9r<9Zwt6=S7vt&R?A1k@h(0!nf+XoGtL`gVb|AzAU zGAvBHcI*3B6w3aF{K5&;t1PwLSSVCGok(mkeulqiGBH4X_5s90K~0^xuJ`pZbC~ne zFd8l~Ap;xiLjpzqF{f7XqcS|SsDG$Y5_$DcX1PeTCZ5 zsGrGlSb+it)YW(AUacpHdZXy(2@plBT&_o2dBmlvv025 z-8D_EC93i6-93?QO(-?rU7z*leB?20zoa~uUv=YBj$-olhl}c`&oJ#cvEa{*hlkap zP=#vHQ+fNw#>Vtn`6`(9U>%}0V>l^gp;oQO8o@y=?d8qvk~tBXxvAiMg+)UP}x zN_~|oz2!`$Hg$WPQQg&VP;AWJ1W>83bQ?Qu{63Z-WdA52!z<lPUmv zq0QdW-fLka61SbQG+db_va>3_sX>m7;2&Sn;GlxByrubFuyhkmhr0U{9+#y@Sb4fr z>i2cxS1++~B&F0dq8}!5vZ8knq7*UREDuhttk|#pQQ5KJ505tMFTi^gkNa)Bj^=wV zaM|APK2{Fvi^g#_t16kJlegA+M(_uoTXsK0TMd@EXqjdOHOKK8X{6Yxv9df_>}bdY zOY`KCyUFmtv`>yln+}s|MDe)Y9WvL-W4)G{Uy3f7bOfF8)bXp^&Pp6n_51TsGP;{M;oLbgbYuro{V;{%!F& zQ|*qLF)uZEe;;1Tjpjlm*@jI4xV9 z!0zu~ma|P4FZE^pE}HAvHqO=OyZbO{-9l=LL*tXgmoHx|IzPOKy%Q zC=8h_EC%utX!tGC2K2pk0m{noNX_@>Qc_T)K|4a4qs4G}!RFFPTu&U}_1D>Cb$_&Tl&J z)n_|a->$u4bp6{^mzbOL0Txc^P;6yJS7Ug)Ls`>q!#R(wX%yO+F`+y|p*qbSJ0-)$ zGs&HQ+*TuWu!%i&4uskGS%`Z-bvgBLb zwPa;6H9b4uuNSAztvTr57oR|H*|3VSj}>-y^%t9Z{mrqxZrK#U59`3ljH@HL8_p)#SDu8JWf9RW*OHKq2B|+raGySR{8UpU=I%LYKg2@P%}8Yx9W&-j{~3x4gTt zXWM7k*~q5NBvGHlom~_vOr)e_tpt%{&MfeCC?kS zwbzG=?PE;Hi1T5Dr8e=o{dbQl$}46M(1$GQF65MKN-B^H8GZWg?oZpA;-jOf(b%}S zxc&Wol^hKon0H!%hr$-agq0xZAeEPwMuzOkA%t)zlF( zj9c~?R#Y-Yv#$^6ao*J&yD3(^xBY!2iKnn;du%=>$Chk*S!^?M0h)y)&J+)Ac(K^7MA=giMG>RyWzNqq8=HnDg(7-BE*@@zJcx zZnE&VLCWMDaX>HB!?Hmi+aZmXktyVqm6Ma}q6fO-2EQCzI#^%c&Gv4FTHr>0D_)k<&)`e{jNf5T0Oc;8$1*stF)%KyZix&G~E zv)cWB_Tq)`jW<8g-J4a`%;{b)FrD@O@k~sQcGs5154K8#(OPV?r8yqSULkxM-Ompw z4gALrW?5(B_WCbz&lh|lx-jV1R^@qO<;6a5p~xu|^OK1@j^B^&35+->RlA&@7yqg~ zkU!gztsdS{71A!X?-X&{R@~A9GIPBzjc2IHILt<`mYH=?lN!yY@k0UYINc#miJAW> zvg$s&T5+3omoa~!Z$y$o{_s8-nKxb{`r_|N$FXY`^6^bc%;MtW52d8$U|axlHas;o zm5fe^5zQMThj1hCqwiVTj}Tx;Ai`0#zx+X zYqNKj->E9wd$-TDK2bfeA{I5?qLTG-{|)JULqw~Vh;g-ys%Mw;BTXHv_w7k{|ie)w<6XWBlfBrm2E8*QYCMGA-5z66^xO}({>(|oSDhsRvmXVu#zV|^O4L_2! zzzEChV>Tji>iKy9c6}{BaCdqhM8eX2*}_*v_r9bmU|CqZ>z6 zD_3P@1?KVgl(&0{ zs)yS|Tef6X>3nafB%5+N&Vujv#tlwpG*$DaKFa6(Fn(3h%xvb>-bjXNMd}4MQhN@EbjXy<+KIg6Qi2=F* zrbTZK7-`|_7RCKD$al$W|I;7s-)w39lXY;Kh+L^AA#9bFD7AT}w509O$S5)=U%HJH z`GqrayO!hfviYS87gC_M9Xoc+e6Y}%bqE-srtX1F$Hb~RUwn;x#Kh$yf##`;(_jVaS#t-t=71^`CR%nIY1da!qyOXEz#JhD0N)Tcw?|SFu}m@-+&x>G*aa<0Gkb(OQM}- zv03Qu=3;h3AT2^kvhD&nejLk(zIX55+$g>Zh>Jq=`4H`u%CI${KYVo3y{fqE?VbB$ z-IC^^#;&)At-punuZleqh9{-JxG=fgmvMMU+1ztQ}iDd6z<5l%mnTR)HXuFXs% zgSScyudzz0)u0Nd16V}}`i+?`N#Nu9DjcTyKxKoW9+VJJ@RSl06QL+1f{zBzuGuCgbMwX?bBlhSAmyTa{+yss-w z9y!AAx_QKH;<2cq&wF-_PakOb%szk$WVXM(0uW6RG7wP$RWPs}Y#=Abw3)#F2op&t zwN}>9hz8y@BE>d`g1gkC_tD1V4q^@Fe6l$U5zw^$C6q`0+mNndcw z7SiMF#54FBLeh2@g<8A1&_#Y2GhurA;0&W?Y-wj#p02Q(L9b&`O2N_a_$3%m&`SLA2+QA*9Fogm41DFLwWApRTq~n zJ_4+8{(zoGo3jBiS<(-fz3oTy$ec9lHcbbCah5?$2NVF;`0f=7C?V6)jG8XSX^CHs zphU9d`WcdwlVjYqIub>let$c4cF+EuUXJcvT2e`yUg9xt!ohc9+ZPK^mUp*m4-W=j zW=uLn&E{7ny;)NFcXU^7-2x*JgYZRt23S56$|w2UzkVeBU;D9))Bp&-e|Z7^x8C@l zFNQV$UtHw>@779Sa4F%FAte%bA@=}6cw8bux$-^qr)X9=L=;l&#Lu5MfrlwfWt_Ml z)t*>7(y=ghB?o)BI2c~6Kqt7Am@t8GR1^BWUL~IuvHC6?k;SS0Sx`%$9Ndb&$Pz7f z0yW_^`-VCL+TZkZR+LZUM&`9Cz()vlPfALPPe>>#XPYnqu%Ze&;G(YYuZIsGHa9jl zjv7y7p1#D@1l;ea@zp5MVFKB;7t)?+Qjt!smkbJRlj*c$(-9;8Q z5aXfiZE~H^{9rX$$Odx5Tz@V*SX-b$iuSuA)iD-$^ba6^O2bgH$#qQgXT@}44@ia^ z!wwzh01E&hM&f0UD7}04uB+I*XJU3Xi{$9>OelISVJyM;*85bK#XQRwy}n5sr!)x(NogYp-`&E?)v2J$4i>OU zfN5gD`*2S`koK-Ti0Yp>Yu(m9u1>XCHnxQH4VBsEL*@UdK?MrOvpU}_x3wu4tuE6b z;46d?HV5%t#0uD@SZkV@WdgflTALCw=}*NO`&-iB#gSv{?ZV45;C@ktKQCxpPLx_% zS&0>P$!mCjITdvOk7l$mefg5nS!A??=*lOGWPuLH1{1BSHncZ>#~H;En~~k*XTESb zg$fX|ExOatv0|7?o3R>e?L={JFWp+Nk)Vic!V6=y`l>h;v{POf*eekH1d@3(fk2S& z`(^&@P8>hjX9DR(wV=z(^dWCd5OGriEwE$fcgUjq#$0-b_@T(iCV()@rjTnEV>S3I zSGvXakT6on0?dOLJz|BNa5kgWF}MS0LyADOEh=6v)Shln*w`4*&lrqkQJ}{kY!c?i zYHLX^amCj~Tr0aB*QQnNS^)Sy8M;~;VVU7@+s}P#DZyqB7M$L_D|CB%`;2bWZ`gWB z0?(&OuV25W5O(W!nD6I|X`4E+$rIOhS%_tEbCF=)t~Sih%8CY^cUrR1KPX5|M`!rx z9>Bwqa=Y6-}5Q2hBH7<;9js*4N3;3V-0rH)t7uin6D8MEvrOTuf5<^9;z-inmG6MX^W~Ucyv%*$&WZ9^@?BT((cTa9Apwr#$@nBWB)Ae~{W>_AwfJ@x{pmrk* z<`IQG!XTAnzgpK+YE9rn7K|`5GSUZHJZ68Tadl$@WA<3W++`E!@M(`ITn>*|hB?Ci}K}EBX5}-#ugKsDC>)o>CbV%+fgqD{J8~_UF0}~GT zMP?oMAkwwMSQO;TL~p1UAkXnLQRRmp3^M@di@gttD%MAX+4idw z=s*T>Jy6YMH(sa}`YwW-U?`c_CJ$D z>YPKSX$@A7(mlku5PCy;9l+#;r+*&Y)GE&WD4&3X-JgRbj>^bj(RYps(5ZHP0;Y(5 z1@VKlnVFeJ(pwi0LEnRsiD`B|zgF$}^G}Rfut-`J_UQ@P_to5XCZqmV?jN6?v1ym) z;9E)PZ-S=@_EXJ|j1F8*PnYfgL?d$dx(FKj$JGcxv0#VPN|g@o2UCPfx(ua9)aypa zjX71sr3IvMnF}lG&kr!LphEm%f56F<0b}A??qbF3va-7*$D6JO-Gocp+e(;-L2(( zFyCbww?+o5Y6IF|2cuWEV)A`N%P=r7aQyk16g)WVQ zNi-eC$4D3rv|*Z$#Q-(T0U?=Uyfj>q)vyN}$q6okLJBsOrr!$-R;)^CZtbC$!CCxkQn{3zsf!eO{EU zDX|?B8xbQPs(HUpHUd{e_D3#WfTzu?nScd@8K0$W4U~>S1F$hh>)CRedAM8 z%xK_hi#V%XxaZ-elRtlcIDVEU6PgGZ49dYrcw2|oN4g9+D#F(A`^&ebAYe=Hkdu=m z{t(G=D7>0@k1e$@=Evb7Ay;87ArhwwEY_eqfEk!^*4BG34)Fwn8)Fto6&PK64FeOD z5%NTO6V}Qcd}~8s6I%TA*0%QGj%pGZip;^HS85Ddg-rwUcw@Fl8az4{L&aG^4B~mv zx#zZ5#u1MYMCy9Kwk;Y9KH#g|+}z;SGoS5FFD;+xIB^NMa!(6eiU}_ zr;fbT9ZOC=J6us@JqW%~M?eS%#Jy!Kf-23&8v+sA9Mq3KzOsuF{Z(55LJTa_ul@Yy zi#o)5ppY@5+4QQ*IfC7ExlWuo0e&_e2;u>-JoDKM3jiY{4^Y1g;)ULFAs(?6iIf5b z30HH#B2Lwh778*l-5`K5X?7GLRv5m%-ZT0YbOI6sv?liy|P@c;Y zLck#9iSFmN)hU0T%$Ow|Opl<)yg?)0*=6s;Dy?F(YiKPf3^*}%wH!rYnXJpe@S7&6 z=1zz@zhHdKK4ZfB71j}`8fkh+E3rZi4shud9yxjxZkP*{pXGx2Y~_p~uya#_%@%Mk z4hjmQyhZaE@|N6a(EGc~cR=TcN=C`8rvr3P*sE8PxVs2*($dxS1gIdS^dS%~+o0Yb zo7Nh|P1uFI;HY0)!o&~fL*!!9pl!^6>jfmiQk#&vr8{ z{wSz(md);XRmy$iM=R-sJoG>;j5Un2slj4}i=RSs#$pQLFY89i^eYMglV=uy?=`^V7Tuzh^CqatV}7#6Jj)Qr_0Jb2AG zC}uUx?nZ95%DHplZ>_fNUmLxd|TD=ol&2JoW~Y|g4F4^Hu$bxJ@&L_jJ{eUAxC zw!@lQ5@0L<2^n2@Jgu>>#8MrMtkBQ30Gz)Al)(im&Znoo9Rmd{$fOj?lytGkqL1xy z3@=k#T_%_si(OX?Fl%jhf%Q66%h%&<-j&jUT8ZvvN%Bm2{rVqtH-adwhxpL_A&PJd z1lMMkWp0g6pYNDR$5DNjU-Ze^upIgomN+pu1PQK2BogNcW%(cFVpe~YAb<|1Rf0o|m|!AA!+e6UJ$Gz| zqo-h+572PU2mn6Wkpq$CEzxs>mojQs8(4z752MuQqa0402*2 zBf~Tnvno)2Ow4H-Ohwf+I7(XgF;C}1_1g* zLK0z#2MZq_Bc=G{f^IUHZR>B3<(Gw0-u}zN9)VZ@r#&_n29<$yM6ZYnUA_lZ3FZ0{ z@jgSwx#(^LAL>vHbG#*k6A)w+LulxWyyX5;jUO4^Z6Wf`oG4TP*8?MnzC%?U97bUX2rJ z^Uw^n1DPLDxsc--$UJ98%V!n>J;gMm#b?0@W+c^2#d|QavqpNjyU)Q{kA5GLqupn3 z0}KY!CtiBJ;{5!O2{D&kd|wd&HtP^_ z-zdSGJUma383n446HFbBdmBq5+DDI{as8>$)zt+~`PS~;_q--@a_<42CAIJv8X8hw zycovb@IEN0A1ulYLj4}g_zdJzq0omSlqsr-2W;;>5Y+pf%Ty#GSTHDvZT~!qaGYdh zWS)aeuwC*H)`d7I_{ry#LFa>^K;%;}+#;A&i*VIev;ZtcmB*&PMUziKCkF~uhi3|b z%`4-L8HA-@zn)c{S;J2^BKAd8NL>)UD2~Ul!3+u>Z(N)Cra7TBS1nH`rY?d+kOgL2 zfT)jd_k#a7+huta6tkzewP%co;N&y%;K2j4@6kNaGoIjX8S=&yn|9E{09P;HM>1#$ zpEn1w>uRCGuuuD!7Fd&NqI3gaY2H2%>L>_1pXb zr&J&gx*?D!mzNJar-hA7?O@$q%OSJPp(F}9FGRaBLozrH!$9fC z@<>(L^&2;!Vilh`M*R-X2!QvuJxe*Gx5~v90kLq*X?Lk=c|rF=h%pw6Mc@?zg^}O{ zn(MacafH|XdCCdS4PaKAS$3zz53>NZ4^>^cD*NE!LsppTL%+)MBJ1$^V!J^>lM(M= z)tR5~z6c_rp&)SNOvr_QPYs7$gZ>rXY=i}~EOKRX#xoSQ71^prDo{@!BItj({iZyUP4B6iDkqXrjpBtKYw|zx~z8v&W2h5uEsM zV?g>47O=@h*vBke*#+iNVp5b5S&IS5Y;O*dItfj zybfqK5cDJjiy$oqhTLul8900qyHtMk1X(X2k%_6PkH|C%n#g4w9`bo^uqXq1KXRsQ zV|h&cA!aKZ<`OvWl?;%x33d<*2gOXa)hZolrALp8(6D%1g7rZevV!abTbOEFvm=!t z4&=?kktMAXi-?y1+|i(fcLO8Bg$D0j7yw5` zG;#tAc2+6Sv_NCM!<(pFWYVUTDB`vbAe!~&&6{-_CqTf2298jg5XWFjcZA~^j(dj) zfZOA){__&a0i?@Aoh_Y=896RO|Cj9#VFh4rZ)evP&Z_JPCngZ%Fc5Z-dRnmuKr*qT z5u3+QsWm$~7ETW2f@G%*^#Pk!d$4FrBjWlAUYHI{Ri;XoQdUFUUE4&E?b44NBSqx8 z?<#N*q%H0)l2%BYhTDRr$^eLIWbuB_*qQc^>%X>+0`N0(-~dDld;D3Sf4N8JoX+xd)I*9k?4OnAu>r<&jfb;M7G<>8Th>NlQbQ z_Pa<;9X-2SS68<&Xqq$&5)zgXfn&jYxi|hU0TSCNUhwXFVbcI^WSMoP%q9k}0;H9} z!cdd}yORZs9-B&L2xO4eZ9Xgv{&bMV>~O{b@dH66iwFt%0LA4dNR9Q;fCVFA_=@Dx z#lblvHdaC+DYqKpZNjiE8tpU3}-*;jkufK?8Zjz?HT?GY3f z&X~Ih$3NhsWUyomVjN&a2SBb{VgC@j@#)jV<&cT6gCuXF8?q+1O}>8$3>y~L1SDPp z2P^~y1}*c?1W+D7Ow6fX#Na8bM4AL3G*3 zoFM20P_WpfjRxTZAmyI`3AGNLu%)hU{Dl)V4t5a{9Vj=eTU+YjM&!2{E|;^xSOgcI zb>(Aj9Z#$Wi~#NKt;4?;SSoy*jbzsDcx+mEMEP=j`&;&!_{pvagiNi%nW(AfOil9f zNQVKxH^P{}v;2=VGl?K%G=Q;ZQTI4Xco*O{zx%owXuTVui3&)g5c~?j04fF2@2=3% zE$Wh?gj=GxlMo620+UQ8&~TOZlQJLw_3FVEc=c$t8yGs&K=SLWc5?tEOsL{OIo~ns zyowyLfuR%|92|U{>`Eqloe_wN61VAt%W5RLA(n;78B(mw)kN!zB0}x9D zW^j;xx;ac50Bb42l>l9rv4tLpEcU^25C z_tov^L<0!~q64HVfIBOq5r7+45UIxHj=`bxH z8B7a@a{wxeIaWc%!5}&?R5t`T{h2{752W2(Q|JxQN+h_ZVSGlsuA2*k_JuCc13#DR zxz92k`{y5{o8Ktd)#QLF)hxA9Q0U;G<1QklxcRiqsj9LPLa@$eert8LkYHR$M@I*l zV;toq+g}$4$+1`pm~yQZI;-&rydAjZ@2hrjd=m$8{*kZ*SA=vx)DAZNnrgIPEQb5TEh!47o|`MqL3Msf~-hk0f9`+-X?P56i#+Vryv6zs_;9^ z`^W)UPQ7XklOn-~anPzq@gAxb_Qt}hCw`)f!2F2cUu|WL6omH!)kp(!4|JgLDa7@G zy4w2i!GnEokF84=>Iui5?^m(Y`cqCNQDhDGzSm+cq6lRC-YLNpMx2qFOp5#bc_!t$ zOxkJ+`#aw2+)Akn9g+7Ro{KqtN=9+cB2?xPI-TNOOiY8=@*9D)rJ=l9y+w@o^wFd3 z-(yVM2df%mrq6)Tql0&M8a6UP_yvCcHUpFUZ)=+&->IpoQBsFpp^1rNlM}}8y_m5V z@1MN(t+o|}oSW?I5#53GZ9G@Nr zBMKr~eMd*Ipu^NTYU;OxR#Q+BwB$TJMT8O{H=N}vy`av`I0}6?Su6Ko5P1ICrv3OU z5`BGr04}UtT#4%miSH_ctzimwp}wt(2@+7=a$GC8w6?jZ4d;K}1qYMEnKoB9w*u!y zEwDGl)0^gGN2hY$xKTH|d&uCqw;2eC<_Uz{>OaRrs9IsYUPlW;4@)mDrig31L&*Bh zmfH2U*(jx|Dh>>sKsmJsGl+xII8h!Az^-#>NXEh8_Tb=Pv>Y?ofl#3S95*St9M{(H zyFLKe{d|_0A071=+2%!%g4v}d~NEng@pxkiO1&FR-+l8#U9M4&fc%G z<{Z8aR_eBy;-ZU-`Shw?U%)1uI(5qPkVu!^Cu42R>E`ApA9#_HvVI_6|3%jTo1d@m z$&)9q-n@B|8gp!I>|0My7)(L4 zfRx{GC9vBo?rd-0lt8A&v*hIL>EUzB%j!TVlPUsJr?mk2OZfrORY$e}^^z)rW2yym z>$~l55Yaw@Z81VGU)_i8=FRBBnz4i9oA3w`l^Jmz4-O6vw7fVuIfqt~#JzFt?ebAe z{3ZZsNELT>c4`ADH=E~;kX<@glm=U}v}E(NShnZEow&frNUEpB4m}{&`g9%Zf;S&W zN&@wnob3jf>dZ=bqS6@M;Q>f?ZkX&VFZ%q$onR66^DPC4ahSX=o z_7G$|AQOw*3<`eGwLZZFl`EBH?+Ey>tgn9?8)NVR>fd4E2M;90%>4WfMnUSKfF$UTYXSWP|S3yqB#lw^VBA@URY` z^#_KAH^9#{1(UL)lT&ifY*TxCqS{&Tub@2lx9z$s5)Jw% zXJ^L^V9-OGm@osan4X^>3@o?VG+4fiYa0_Meh~D_pI<`(R)LsCwY0PpKU{}s8j3xm z?&Ro*I(P2etyvvCJ$e~d>%EdEKDRdne_M>?P25(M)6uyCx$o%c`21kkNl97x^5x6P znVDuvVWg%@Ohmz$Z^*vg|Nd!W!Uz~GX;oE9;AoxoQ$YiphKX^w216^MT~2n6mNo!n z6_jav{4*n?e|%oNAZbq&J^fz(f)|E{r_{AJCFMSCPt37{i>&F;$$tV9iW;wUtuVmt zUWt((@xE_t%p@r(`P$dF5SU5i=xD+o{3{9!_^9VWa)0aFHKGA91He{a_Idg8NVt-# ztLt+R8`s@M$>~L|GBUmfMF@rta|?^FBO?hg>IcyRJtPXjG+OK3@%c0AG!@5F@TAF4 zKP%998x+KR>sAQ#m1jkRZ{NN91+CH9&|CKsZy&oQ1h$co)8Q$o2|)Qn(E$${O;5{eux(e!8=#rw-I}SnX@f%)Y;W8^8?o5+KLOkA?;*Yg%pT-!c%x zT3bnq8XAv`j2IUe7khhqZ;6P=85mqAXAq0;4f)bHRKGsctJ0&3>=10zc571@^}qi7 c?J)chRffsmjLyIYAb=44Q2s&Q{iiSg3s??FbpQYW literal 13085 zcmeHtXHb;c*JnG9GAhcbWCcb6m5eAs5KxfNAUR1E5D<_oIT`>J5NVR+oO5b&lAHvA zCI^w6waKCBJ&&`sRa>>S^?rD__RD`9i=x3N+!O5NdkunN( z@-_-}g6pr-@QDLXK@7f}Hk6fmgd!q;5^B;zP^f=U=tmD#onzJ}Ty(;WkBPr_4W!7) zDeR@{<_A*TjXL`9{FxP8ydS2^$$#Vp%3_xU&X}7SV;7$#P()RP&BvvfM9L@KHTIA6 zh;6t#PDN=Pakxt&#=cPh>f=>wXJH01dYimM!68CLq1D&J+V$q^?SG?CnDxpPPSXhQ z=z(BHsh5XqWkOY?{X#DIlqf#SFxhelJOBUY_eHSpcIvSb{Y3yrR~)+bMQ*sX*|6= zWF*RVv{8&J+|{3*pUxv5?pRp9*Hq5jjyjVbl4#x*U#oW`vy{mR?Ie9LF2i84(OD*? zOoA4{m`g8TTM7~DJde(oF=uWUSH6Sh%A8dy8e%%7w_)#>vddZ^hdR4A_)BBBL>k>! z8^ljlvJl@<>R}wv;#jMF(%PCG&0}Z3{S6~QJ2Xe{Gx_bYkx*Ix!J-d*>cD&t{bu7u zrqufLtj>iV$^eI@aZO=6DV6iJ#i@BrH#LRjUUU{QyBJ~3^4dLwmNo+!!ZUE(q?YgB z56(<%s63CJrybk3vV3xoMmkeQ=aXA$P-k67P!AG4E_dBo&5RRvTV6_!S9f=JZ?J3R z-kSDfFkkFVTprAgK7F1x1(&TswePezUQsOQw4QVR3g7eIgon$0ss4BPnmu7dFoVbT zuP%8WJ$!RhG@0JZEq)8H9__XDrpsV~E@vr|yP z>0OEdI-5y1^sabcl31sH@K#F7M+}B3@Y7v67okJ$xdineRg`W9}XNYGv3Sx9>6QPm^=q`X;sgO^Shn zUBAjPmy$~_2WvTIzA~7*jLVJ)XV*+36J@8lfBDj-k{2U9Ym+rqJp742_Ovxpo7RSJ zpbxw}NCYY_*&;h_w#!_(O{8P@P_3zB_6#^@i>sKEecz5!~_2Xu>zB#D!^`kAFQRG??>=Ntj$j zl3q{G^_II%@Xln=$55uVkuB|aBgJOA!N$#&ZX1?p<>BHxbK0$<){cvjk<16pc^yJ_ z2W@XzkWHLwm6XL`^L5lsCJOXjT`R{YCe-RYJu1q}Z{4~jy*b~__N3OV{|34*IY@+6 zK|$gCRRKjziLFt)!YHHE$I!Aer#bTVzo1H#IpamS(D-bPp7yZM=Z4^o+eH~02?x7) zJ<@wpeJ{~YvUXwQ>}GK(c|#FISHfX#^W?5Qv7AA>Y1PRW=o;U;*aNkErS|@M&bWIVXxHjP4~fy9_=D0%Q$HLU zJsBkfdizpkc^y}uz&kGvYFpzLza={i={lh?U-gMk1zrpnT;C9~pMU(m@aX8s%Dv%Z z(^MsEsyyMK(&iu(!=>}d>y37d?nkq~4Q=eRv#T@LJ2A^T)>SVFZW0%s=!Ar3S2HRM zex3ZxZWfTT!R(P%y|kH#!7D^tv$8zwqd}j4k&_&W|M(&H)4&hcu`^dZPK0J9Q4I~{ z>FZPV#Hiy_&t>UyJ!p^MlvWNV`^$r#E|cNHk!-y6LBV&yGup-6%6d=lx#6jF1!6P2 zZ@9z{;@`*_ATV2@udo>F<&h1LsgZHK+%+_$!NS5KBPXYpt5wQ`&dkijeDDqY^y%;I zwK0t|XU-hVM_ZRXYriB+JlY&BFnGhn^3OjH(iP$dr5HR?1Ra(`b-s1Kt#iPQ)=aos zjJa7`Y+%p3IyX6+Mi|k?$ooc*eOj3^WwSmI+CJ#P-0fNxdST&0IHW{tFiU7H-Fe_5 zv@OK!P&+xV_I!VKWh!26(&bAg2FtdQ)aHIU-^)wJ#VeFk#|`+Qv0t<0)-GWQC3Z%X8-!@7xm*JPulG$y?6u68Cm zA}s2q=0?r^^hb5IL36qZ1%}7xDx)w-TiF_0+f-G&ZnIDQEcMj}OD!f}*1K)gq?eT3 zO-)TT+s9X{Y*jiOu1%TFcSXubODkrp=aOH&%8th0dbzR&>x5PYC6}jDkp%yOPQd1Y zf~d#k^-ufS8oB2W##GFY{l-cU0wYQ{-|U8YGOKCQ&>Y+rk>70byH`~mO?l^bc|}c9 zHKS_w_Sn5jj?gmuc=fM^lfic%_C1)Rdl+?XY0c0>lEpfmF1`93<3@<;o_t;ivkTis z_4m^qV@p%{)#v^>x7)5XDG_u&Y?s8iG9~EG1Pp1^UW%Q4zFE)w_Gl5i*71q+TSI6C zi~7&+PkFF&axU|->vZaO9F`1wZOs&w4~t-j77CRr9XX^J@|~p^g(fpk%SE$1TYc2L zc2xdIl#GkZQlBRI;%-@3ReFRKQAJ4jzTtS_$S|wP(cUlo_BJj(-c!qlAk*l3o`Rk} z@0z$T`PNE*dQehw^7c%SXoq3p;zyzN-o0OSbj=seoC!`(Pv?6voN!Dy>}+flw;aRb z5+1%`^@#3(4l?g<9n#nww8DjdevaJLY2mA?yd%~emzP{Gdh~5%ZlZ*}Lo@_K!gAsP zZb+x^49h|B-t{3zR4R*m_7dxULA%V~R8;9p{prL(MO_gmib@sQL%L9@W6$)Tmfz0J zyyW>Ws^f$|#H=h-XY+KqBfiE8W!o=&HFo;b>iVjaXQRC#3Z*7?%;3oHZBnzDF>6Y*vAvz>qF)&&#^0*v>*>yJNAX(3sGfPsup<-}^!G_r zhBCdgz#}11oy=K(Dke0Vs>foeQf*n#rT}-W9l@p6W*K<*XOP_8qM6taQTru*`6-m_ zJ)#~)haJ>`Ywl&IC#?tu9=1ZFg9+H~?KV0&M2F1q=R_?6?(f!}rE+e7XIvS&Zh^mr`lIu?<)}FE`@PqNNdhnNd_+ zTrNXu&;inW@^lJKVtTa5VhDZ#ii+-!G! zf;oI`xKKPeI2ix)XRkk3Z3fh$kYlpqT;WuvI~b@3VRo{`4;)qr1tOY+xUVq+c?#-W z8fCo(S#Gl8*#vQTpAhw2c%V#qFPBG{t&JY1@I`*-j$(Y)v`P{o1lL*meDoR4df*XP z-bj*=kfYt=jw*lP6@K*yPTdlhO%vuDH_SmsEDzKr-H&jJ9S4mK+_h3B% zc>_QEbtPkb+=7RV$bfmS2}KBXxm|aV;xg#NYl;&7pnjDiB!-mWYf z&GK!ir>AF`T1iQXhg96CB|r%j0bC-(5uS+C1nCd?5MqTIUFGgKpZ@d#Bb(351J+MV zr(WM|S!&ZDxog}It#wGS%@x_wN3-rJ8U)ozaYUp?lu?S@Q6h0_7EC!_&U4wEcm4i~ zjihaVW1moM*9V&!E$kN4nS148v%lk)NT_rYCW3e>YmlDeu0pFt5|P&e~X6 z&$aDjSHn7$iob57yjhpphmuRdInW-zc-t*fQ8C1X7UA^>3yaJQ%kO5}bsZgdt4o9X zH#bXc-V7RC-yTPIUc7$&`qqePyxEtxXZQ|vsvHSZJ*`rjnwqW<1a#KKegFQnJDOjC zlauqqyLY`iYh!FWcj`UU@qfd+;|4?bt+U#R<5`ggCwWt?O?l70&`h))#cpIQ`A2ki zPv}~I{hTGY!R~02S}@N*-1Cd#x6Zp6=PWioJ#F5Xg7#@SbK%0^Ij-t|oB&~t@SWp* zH2ma;bgc!_9nn=kLuu9&)fwMZ)S15db~B;N;Fd@e?ib)wGeFqm+mgVC$bh@_3| zte0z7e`i}oba<~Udz#e5o6UXqt=g^YT4>v zIZvtuH2>3#6gT%p1RVc+VjzB1dHIjxt&9*YpuVSthJ++{MsPtQC{RD$=tn_GnU*XS zB>3#U7%BAs12M7J>bY8}7DIXWs>l-_S5#EE!VBOM#Ys#f{vg?(A`uw6XC(p)Oas zZfDK+#OL!*xvOw!mGm~eA&J$!bafUuu=ga{{eRF1%Idi;F$?bu8`%N+*coT6lQ#DH zp1(p)LzB5tN32aC9PMvrY2?RUW_y$D0C_=M!)^cOBtHhvCq2TuF~?i!q9ei=UIKIxv7#0)5jvg&C_CMHJTbb?nE}fT`2Nc8MOh-+fVH)qD4u0#CpP%1lHgSh% z)V>I3N8T}A23C{^my6_)$gkOn3Sn&wwA=e>aO%`4iV-rji$R*x#$?nz`?U3ng*cv8 z2z?&#MnpztGRuZ9HdE;jWU8cpVDIei4r?~FRW>faSbKz*o$w+Om`9`Unk9jYH=At> z#^dpJV#XO(BFB415|WavA|ka-MIak)UAy-1#EBE~8KnH9-y7bPnsn1fce-sYCL)go zt6Dtb2RMpTRaXz6^w`zyjuq0lsSw9r=uSA;rsaO>eHk8hFk6GGxur!*cQ8YVQJApR zPb=h@Q(aTTR>7l60udg zsiUnegU?8}%25t{nsIHqYy>B~v`K?mfzL%lR6be-yrCx)Iz7 zTGKY5dq2)&M-x#)4X;nx*-rbW?Rn_v=*%uHnQ7?5e-)LLGMMV>>eVQU99V)#61`Qr z&N!hYHNQew$Th*5l4_&w&$q>`YqrC?Yk~QPR!53)x!U~E9-rTz@HW4Gn^Vwt(32o11L* zIf#VZpYAm*%y3*A#o#$}bjxiFGFR3HGDD8{d%TvRhq>$t4_w^$=OUu+n11Y5p=Dmm z_abB?0{*>PVo{8clRUIqfnbQ|?u3)YV2lL( z^s6dhqMq}#&n2>u&W?`0O$cpLmTed*$hg5e3<3_7f-L@nH0HX1z>_O{FQ9<^w%Qnj z$V(XRI~Oz+8$Gr1i9alcHuL}icJ|Df%wD-?u*Imwjxe?lA3pQ}C^@W;SG?XK9xaHP zj})Z>JTb0~6idYlI$%PbrdPA`YqKuU2?~_mO8DI9N45g#9RRZ5K)${xfMxp#bHfP? z27^?nT#SGcEF@tfo%Axuxl_>N6fiwJ*i;D|+9xw$pnGDWn4k48dLY-8pq&XST zY{;_BhJ6rd%SXEGrlv=!DJhGD z-6^h38YS$Y(>~rfkU>J3raq{vzg23SEIRT0@tJW)J8Gv(rTJ29mDu_wV5-3NZ{D&IU5NU8HLLv&xw?xgm#?Gb^%jDGm=A+3meIYq}=4WT``t+=NchXH_G=fXtN}9))jKPZ9 z*MNzcnWoen#{*6)5NeiuO9&E;X#i`OgLX>G%VR68EO@W@8a$5X>;Ckt>+|j8uG&<> zg%_6EE-l=ojnZ;*yi7E4adF0jM%fen{r#VwG2OT^s(a4+L*X_t5h~+ad)wEq#}h_W zMEus)-5)bEojDEahk3eH0SO5S*NrNxs;+DR82MP_zUYF6VhyzQNK23mq?H&I-JiXT zR_=)t_Agnen*?Xb)ZWvh09sKMNYK#G@azGMS)t-ok|hH%`T5or=Cu4)F-&H_hjXs_ zwpeWLeSwa%s&r-JcK%FD0CIJ1>@x?CEug*hya*1)CMJ|!k2RX!kcngIu7sQLia)x}Alb5sEr86~MP0RRcwYoJTax?+WfK0OOy5Up)< zh8_21V!U}XUE0mj(Xrv;7k7wSeL>OLuH=@{0vSnKS>*w9vNhsxI04V2@@`uHx~~yo zVaC!tz+*C7r8{bqmTZB!4mP0_++^BB2Kl)ABe3N0qEm@R`W1G~^CF#-qaO~z&UXlh ztiC`(jS324@7nUR`Jbmx)Apw;@bmESyx0kOhJ34$r^CWC$x$|LD9rM!?{agai$s4ZQF_|J1LKqJ~=siGEO5e6L@>CIx(B6cikV;^70F z4G?zQp$4wX?j82oz1YyuU_AIVo6zHRTwG|usHNC_>?8<^#e)=@Q&dzQNQq!!5Z%$)UW?F-? zfsXAUMMNSl2&Oe`ZEca*4L+h^V8}P=j-sHc0{RiO`R>h>>2bI-TIFP&xx#rQ$i^ny z`jJir1UMy!RtoeGk~raacCc=Ts}orKktggw!fPxlX}5rM^`Xi$w};KWAal8E@a0eN z6lnPSEu2I9uFdxc+bcr~(frn&#hj?}5nBUMR6?J#o0~;PC<_FD7<#XxU$1xS>mM|? zwr0ESuAe=BJ}f9G2pJ>N3%f3Yf@c0BfJu0NHl(AyT?w32ntZIe)A@f@mI@?t4zq0+ zkp|`C!~RoGu0CpSxH`e-HXF3IwwBx0CcVAXF9p(xWr*4bm!&2PFQNiV1rm@Kp47+3 zXKBJ|D);AS8~R4>Pz>e=aG2jcIH@t|zS(`fhk}g@iKI|gVvu(MjJhtRMwD1hRKBj# zODVbTqd{s5vJI_15~;(nF}H%_CxucQbv7)vy}AN^|m0KWx8)`!~g ztDq-mo3gyGBm+fN0!}xqfVWzXG>!WP0b6d|4{d5Bry2hTw||SR<0c=UI*3}0coB~e ze|`o=y!cencuurUUQu14XJcoixO{rEF)vL_`(>F3KJ4S#}~&mH#-aLhD$Uu zF*aU;)cXS69Y)4vouSBKMh=cOrwO&3a!4=Dp}&oH++Y)sG6Nm1atZPK34QLz`wK{# zMy2mQy{e2-v2}33rJzH$I@t2tAe*!L%J~=kT4li#b~^`$((L^B_;?+it4{lNpaAC9 z*VhYvF|`j34Xv*gYOIZx%GR(*x@fXf0?CdU%%EKuGCVvy=mgWMs@xjb-y}m@hPk|Q zcfn;Si31~DxUw;3U55i1Ysu+kYpVoA@>`{mdF_cm6#5;Vg}vCAtbss2T!gTt67BIn zm0_1o|45*>~V~+_NUa;g)DgcoZj~*>z$E?^2V~~aY&O|&Is=Mp9vwF!1n4X`X zpH9U6338%G%(yr}k(%RCpyb$l@ zXbAT!grUppc;rH$a}lB9c#8V{zr`-^?p}Scy^;=2&Kv?^twKYeV%a~gW&yHP&V_3u zDS*&Mb@BMdO{CbyQ)&;E*=l}%Ifpb=Ip1lu7LdaL8!V?tNHm;DkvODYjuV7lVp-{_ zu8+u4K=xQ(zyM#pGm*3u^_0rL`8xa$Q)DoLl$tv$`E?!r{ly6iwxBWCpI{*cxzwo; zFOrK)j9^{~*#Ulcm&>;MZD}DHgGf%ATr>#1?&WeU_8JixDM2!;;p|*4A1i3=pxZp9 za@09_FfH)=U{t8T0ktbwHUAPMS1ob~du>3iRqb4;qpLf&yqwkSPZhB!WZ3i)?^=JZk_q(!9MZ^lCDq9{(LlGx|*WmrwdmFo;rCK z&O?7A3&*rH>9&#kQ(!KWp^o8qpA^VWYrX^FUb)f5@ot^@U``~{Qon*I4$_-*2htdjgh@$BcMY4~U0>-b zvz?I?KKj{6G3xsR6lkgSl*oj~?gTRyH@K0&?Y8VU!;O@_w_WsYBVUlSS)96+i=(9$ zQ6e6dI8P)Z0Mgtpt0UwlSpH~wkAN6x?cCQ`pjO2x&%<2#7=gr$j9ah(Y(hd~%jN!* z9GGT9Bu9gJrDEd2X1*y}L175$GY@7=a#43P#f-wrJdZqo18+TNv*|T4aq(^B91V<6 zPNj!atcO4#bwe&{@r%zn_10|tx?0d_X4?J@&gPzc_> zeEIUBYdKU(Qqp(Q^UxCAN9Q!Ilz2M@KNK|OhadxLxH(Sq-4_oC+vtJhEr5n;?>pNB zdm>&2oW}ro8M^z-JkdV2Z;5Yfp{i2{i{DE{o*MlH|b z7^!*$GEw}kc>=GbgES#8K@yMp4XoR)6%rfiyZ`d(76BDH1kC7PqFZ4nF)}j3UwJ

)3SkVFCwJ9Jdq+u6mq`c*<@u(GjrvaIltBAJuCW*HOMsL_~- z4AOr!gjO(iU_dojw+h=uq}PWMf#^bBL`3BGcG$*y9aq2iaDa=io83XVo1w zV2fASDg6Pl*^Z8Zk2@wNCSFmD^ngTwzzn&I3vj#ZG(K>CVc{kf)q)QF+WdT)R;l?t z;|a{{%nT#sBI&txu+{R~W$Edr!Tm+7(O?PRd$i=&9cKYa>ZNw)f-PE(b(&Oyi7k^Y zQhqkxT(x^*5JB~=PgGg%&_K6>uVgJ`MVWAeK+e^#n_MnJiWm~QWq_SvN2D}uK0`;C zL5IR88t*|YSqa+BzJrIEd)t8;52z&`yFs8G_PmTj4{z&l3j^BCYSv03wvob6V_u81IgM4+L*|r(PPV74Iw0p|pPM6Oh@ju`rLwg4uw4 z&e{6zgrDq>;lUBL5Bb69wjT0i<XdO zW{76afXER662!y(sGx5y%m1k%fz7>ZZ0RInQG{Cn=e0al=hZM#3YHugM<>rA3|sxP zGV2Xeh4=64fNh$)z>Q%7f=IwX*9%nrnf~b+`SG5^@sSJT{rlr!&FO_l&FcaJNR1#! z1oI2$86;YSz^U|4C5V;6)&vxHS6B=!8`0&IZ2oorJDA{ z`7#-SwULB|`i0ZbrvU}ewJSie5#k%+@xzI-_uNGp(*SEjbMb}q|oyxbO(0tzL3 z#iM!T-y3|K-PqtlpFMlF@8@)5>B}W$$k95cS6+Gio=wZ!{rVvx3{e`S?snK4U}u5j zN=6reN->^?-mzT7?fuP#bEAm)($LW0&@6f+IXNPrRrKsVU<0oUe%5Yi5+*O`qJxK% zlPkh9W7xh>)2dDt6*CVgqr`-Se~`+DG2RfoIXMiXK#!D(t$f*NoM;D-VMYHUD+aA; zK3bA_nv6aNToEWMt+ktI2+9wDwn@MAbB0l~ips0qMt?WC5Ypm)vs3rKxIMw$rTnVE?xbhNBw>Q$~Ko16=_ z>OSwtX5k+6$id!B(DrT}Q5UdC`Cs*@y>8plPsMy25j=|RcvCTm4MO37ONIRcB`5*{ zr(SgiBu~gh2(U&icy6DJoa5+f+?RY9VkxC~fIh*b0RKryNT4xs?)dhzmW|rhHOy#Q z!I#f{CiMrgVQJN4YtnMjd^j+s+u#CaFv`lxR>PG~ul#F=nkJJsnh$~G*toeB@7?=- zJ{C@LokY77UjyM05*-~aviJSu1cVkJ;8X&vL}+w$_THW|grGTX!wAa3^nht@;=mP9 zE;X;}=SofvJAC~3+qZA9B*BP^f%~_Qjg76Z6+4Z|sKl)~4m|FHL1n_3%QrGq(&e*M z(m!Hfj3mK@vh?dbN2^_mCuTxTV+#WRbu%##)TBL*OoE(q36Ae_Jtre2MXY#(nE~(& zlB2l7Oz#Z|S@>Vv%9CBPkW9cro;5L91#m*kG>WMia6+ z*T)EM|HmxCRxTjqw-5!RgG?xp`7?M|_=>ufQ_`O=@cu8%7V$)yAyq7Q;f^NqIa)&g KQJ&b-*Z%|VM#Ve;