From dbd062e23e5021249847d4b92f7c2275901bf975 Mon Sep 17 00:00:00 2001 From: teastep Date: Sat, 19 Jun 2004 16:05:50 +0000 Subject: [PATCH] Shorewall 2.0.3-RC2 git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1403 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb --- Lrp2/usr/share/shorewall/firewall | 4 +- Lrp2/usr/share/shorewall/version | 2 +- Shorewall-docs/Documentation.xml | 32 ++++- Shorewall-docs/FAQ.xml | 49 +++++-- Shorewall-docs/IPSEC.xml | 23 +--- Shorewall-docs/Install.xml | 52 +++++-- Shorewall-docs/Shorewall_Doesnt.xml | 8 +- Shorewall-docs/Shorewall_Squid_Usage.xml | 6 +- Shorewall-docs/blacklisting_support.xml | 16 ++- Shorewall-docs/configuration_file_basics.xml | 6 +- Shorewall-docs/errata.xml | 51 ++++++- Shorewall-docs/images/network.png | Bin 38645 -> 39367 bytes Shorewall-docs/images/network.vdx | 138 +++++++++---------- Shorewall-docs/myfiles.xml | 46 ++----- Shorewall-docs/myfiles2.xml | 75 +++------- Shorewall-docs/ports.xml | 26 ++-- Shorewall-docs/support.xml | 11 +- Shorewall-docs/three-interface.xml | 6 +- Shorewall-docs/traffic_shaping.xml | 136 ++---------------- Shorewall-docs/troubleshoot.xml | 49 ++++++- Shorewall-docs2/FAQ.xml | 32 +++-- Shorewall2/fallback.sh | 2 +- Shorewall2/install.sh | 2 +- Shorewall2/shorewall.spec | 4 +- Shorewall2/uninstall.sh | 2 +- 25 files changed, 405 insertions(+), 373 deletions(-) diff --git a/Lrp2/usr/share/shorewall/firewall b/Lrp2/usr/share/shorewall/firewall index 85444ab71..d684f0d4b 100755 --- a/Lrp2/usr/share/shorewall/firewall +++ b/Lrp2/usr/share/shorewall/firewall @@ -4496,7 +4496,7 @@ setup_blacklist() { createchain blacklst no - [ -n "$BLACKLISTNEWONLY" ] && state="-m state --state NEW" || state= + [ -n "$BLACKLISTNEWONLY" ] && state="-m state --state NEW,INVALID" || state= for host in $hosts; do interface=${host%%:*} @@ -4851,7 +4851,7 @@ initialize_netfilter () { fi fi - [ -n "$BLACKLISTNEWONLY" ] && state="-m state --state NEW" || state= + [ -n "$BLACKLISTNEWONLY" ] && state="-m state --state NEW,INVALID" || state= echo "Creating Interface Chains..." diff --git a/Lrp2/usr/share/shorewall/version b/Lrp2/usr/share/shorewall/version index 372444575..660491f08 100644 --- a/Lrp2/usr/share/shorewall/version +++ b/Lrp2/usr/share/shorewall/version @@ -1 +1 @@ -2.0.3-RC1 +2.0.3-RC2 diff --git a/Shorewall-docs/Documentation.xml b/Shorewall-docs/Documentation.xml index 4f8e2a240..befa85839 100644 --- a/Shorewall-docs/Documentation.xml +++ b/Shorewall-docs/Documentation.xml @@ -1232,13 +1232,40 @@ DNAT net loc:192.168.1.3 tcp ssh The /etc/shorewall/rules file defines exceptions to the policies established in the /etc/shorewall/policy - file. There is one entry in /etc/shorewall/rules for each of these rules. + file. There is one entry in /etc/shorewall/rules for each of these rules. + Entries in this file only govern the establishment of new connections — + packets that are part of an existing connection or that establish a + connection that is related to an existing connection are automatically + accepted. Shorewall automatically enables firewall->firewall traffic over the loopback interface (lo) -- that traffic cannot be regulated using rules and any rule that tries to regulate such traffic will generate a warning and will be ignored. + Rules for each pair of zones (source zone, destination zone) are + evaluated in the order that they appear in the file — the first match + determines the disposition of the connection request with a couple of + caveats: + + + + LOG rules cause the connection request to be logged then + processing continues with the next rule in the file. + + + + QUEUE rules cause the connection request to be passed to + user-space -- the user-space application can later insert them back + into the stream for further processing by following rules. + + + + CONTINUE rules may cause the connection request to be + reprocessed using a different (source zone, destination zone) pair. + + + Entries in the file have the following columns: @@ -3115,7 +3142,8 @@ eth1 - Revision History - 1.122004-01-21TEAdd + 1.132004-02-13TEAdd + information about the order of rules evalution.1.122004-01-21TEAdd masquerade destination list.1.122004-01-18TECorrect typo.1.112004-01-05TEStandards Compliance1.102004-01-05TEImproved diff --git a/Shorewall-docs/FAQ.xml b/Shorewall-docs/FAQ.xml index c38eff1f5..0373ee9b3 100644 --- a/Shorewall-docs/FAQ.xml +++ b/Shorewall-docs/FAQ.xml @@ -17,7 +17,7 @@ - 2004-01-25 + 2004-03-04 2001-2004 @@ -529,6 +529,28 @@ eth2 192.168.2.0/24 See the Shorewall and FTP page. + +
+ (FAQ 33) From clients behind the firewall, connections to some + sites fail. Connections to the same sites from the firewall itself work + fine. What's wrong. + + Answer: Most likely, you need to + set CLAMPMSS=Yes in /etc/shorewall/shorewall.conf. +
+ +
+ (FAQ 35) I have two Ethernet interfaces to my local network which + I have bridged. When Shorewall is started, I'm unable to pass + traffic through the bridge. I have defined the bridge interface (br0) as + the local interface in /etc/shorewall/interfaces; the bridged Ethernet + interfaces are not defined to Shorewall. How do I tell Shorewall to + allow traffic through the bridge? + + Answer: Add the routeback option to + br0 in /etc/shorewall/interfaces. +
@@ -576,7 +598,7 @@ url="http://www.shorewall.net/pub/shorewall/parsefw/">http://www.shorewall.net/p http://gege.org/iptables http://home.regit.org/ulogd-php.html - I personnaly use Logwatch. It emails me a report each day from + I personally use Logwatch. It emails me a report each day from my various systems with each report summarizing the logged activity on the corresponding system.
@@ -1254,6 +1276,15 @@ Creating input Chains... after that will be ignored. Check man iptables and look at the -I (--insert) command. + +
+ (FAQ 34) How can I speed up start (restart)? + + Using a light-weight shell such as ash can + dramatically decrease the time required to start + or restart Shorewall. See the + SHOREWALL_SHELL variable in shorewall.conf. +
@@ -1542,19 +1573,19 @@ iptables: Invalid argument
(FAQ 28) How do I use Shorewall as a Bridging Firewall? - Basically, you don't. While there are kernel patches that - allow you to route bridge traffic through Netfilter, the environment is - so different from the Layer 3 firewalling environment that very little - of Shorewall works. In fact, so much of Shorewall doesn't work that - my official position is that Shorewall doesn't work with - Layer 2 Bridging. + Experimental Shorewall Bridging Firewall support is available — + check here for details.
Revision History - 1.152004-01-25TEUpdated + 1.192004-03-05TEAdded + link to Bridge.1.182004-02-27TEAdded + FAQ 35.1.172004-02-15TEAdded + FAQ 34.1.162004-02-11TEAdded + FAQ 33.1.152004-01-25TEUpdated FAQ 32 to mention masquerading. Remove tables.1.142004-01-24TEAdded FAQ 27a regarding kernel/iptables incompatibility.1.132004-01-24TEAdd a note about the detectnets interface diff --git a/Shorewall-docs/IPSEC.xml b/Shorewall-docs/IPSEC.xml index 09c651130..ee3f49fde 100644 --- a/Shorewall-docs/IPSEC.xml +++ b/Shorewall-docs/IPSEC.xml @@ -15,7 +15,7 @@ - 2004-01-22 + 2004-03-20 2001-2004 @@ -52,24 +52,9 @@ configuring FreeS/Wan. - Do not use Proxy ARP and FreeS/Wan on the same system unless you - are prepared to suffer the consequences. If you start or restart - Shorewall with an IPSEC tunnel active, the proxied IP addresses are - mistakenly assigned to the IPSEC tunnel device (ipsecX) rather than to - the interface that you specify in the INTERFACE column of - /etc/shorewall/proxyarp. I haven't had the time to debug this - problem so I can't say if it is a bug in the Kernel or in FreeS/Wan. - - You might be able to work around - this problem using the following (I haven't tried it): - - In /etc/shorewall/init, include: - - qt service ipsec stop - - In /etc/shorewall/start, include: - - qt service ipsec start + IPSEC and Proxy ARP don't work well together unless you have + Shorewall version 1.4.10 with the approriate Errata + fix applied or are running Shorewall 1.4.10e or later. diff --git a/Shorewall-docs/Install.xml b/Shorewall-docs/Install.xml index fac4317e5..55664b3bd 100644 --- a/Shorewall-docs/Install.xml +++ b/Shorewall-docs/Install.xml @@ -15,7 +15,7 @@ - 2003-04-08 + 2004-03-01 2001 @@ -24,6 +24,8 @@ 2003 + 2004 + Thomas M. Eastep @@ -37,21 +39,16 @@ - - Before upgrading, be sure to review the Upgrade Issues. - - - - Before attempting installation, I strongly urge you to read and - print a copy of the Shorewall - QuickStart Guide for the configuration that most closely matches - your own. - -
Install using RPM + + Before attempting installation, I strongly urge you to read and + print a copy of the Shorewall + QuickStart Guide for the configuration that most closely matches + your own. + + To install Shorewall using the RPM: @@ -117,6 +114,13 @@
Install using tarball + + Before attempting installation, I strongly urge you to read and + print a copy of the Shorewall + QuickStart Guide for the configuration that most closely matches + your own. + + To install Shorewall using the tarball and install script: @@ -186,6 +190,13 @@
Install the .lrp + + Before attempting installation, I strongly urge you to read and + print a copy of the Shorewall + QuickStart Guide for the configuration that most closely matches + your own. + + To install my version of Shorewall on a fresh Bering disk, simply replace the shorwall.lrp file on the image with the file that you downloaded. See the two-interface @@ -195,6 +206,11 @@
Upgrade using RPM + + Before upgrading, be sure to review the Upgrade Issues. + + If you already have the Shorewall RPM installed and are upgrading to a new version: @@ -264,6 +280,11 @@
Upgrade using tarball + + Before upgrading, be sure to review the Upgrade Issues. + + If you already have Shorewall installed and are upgrading to a new version using the tarball: @@ -348,6 +369,11 @@
Upgrade the .lrp + + Before upgrading, be sure to review the Upgrade Issues. + + If you already have a running Bering installation and wish to upgrade to a later version of Shorewall: diff --git a/Shorewall-docs/Shorewall_Doesnt.xml b/Shorewall-docs/Shorewall_Doesnt.xml index 0a4e7f15f..66c6ec5f6 100755 --- a/Shorewall-docs/Shorewall_Doesnt.xml +++ b/Shorewall-docs/Shorewall_Doesnt.xml @@ -13,11 +13,13 @@ Eastep - 2003-10-07 + 2004-03-05 2003 + 2004 + Thomas M Eastep @@ -36,7 +38,9 @@ - Be used to filter traffic through a Layer 2 Bridge + Be used to filter traffic through a Layer 2 Bridge (although + experimental Shorewall Bridge code is available — check here for details). diff --git a/Shorewall-docs/Shorewall_Squid_Usage.xml b/Shorewall-docs/Shorewall_Squid_Usage.xml index a9d52c482..3c94abebd 100644 --- a/Shorewall-docs/Shorewall_Squid_Usage.xml +++ b/Shorewall-docs/Shorewall_Squid_Usage.xml @@ -15,7 +15,7 @@ - 2004-02-04 + 2004-04-19 2003-2004 @@ -153,7 +153,7 @@ REDIRECT loc 3228 tcp www - !206.124.146. In /etc/shorewall/init, put: if [ -z "`ip rule list | grep www.out`" ] ; then - ip rule add fwmark 202 table www.out + ip rule add fwmark CA table www.out # Note 0xCA = 202 ip route add default via 192.168.1.3 dev eth1 table www.out ip route flush cache echo 0 > /proc/sys/net/ipv4/conf/eth1/send_redirects @@ -232,7 +232,7 @@ chkconfig --level 35 iptables on In /etc/shorewall/init, put: if [ -z "`ip rule list | grep www.out`" ] ; then - ip rule add fwmark 202 table www.out + ip rule add fwmark CA table www.out # Note 0xCA = 202 ip route add default via 192.0.2.177 dev eth1 table www.out ip route flush cache fi diff --git a/Shorewall-docs/blacklisting_support.xml b/Shorewall-docs/blacklisting_support.xml index 684ffa45e..adade65a4 100644 --- a/Shorewall-docs/blacklisting_support.xml +++ b/Shorewall-docs/blacklisting_support.xml @@ -15,7 +15,7 @@ - 2004-01-17 + 2004-02-17 2002-2004 @@ -57,7 +57,19 @@ - Only the source address is checked against the blacklists. + + Only the source address is checked against + the blacklists. Blacklists only stop blacklisted hosts from + connecting to you — they do not stop you or your users from connecting + to blacklisted hosts . + + + + Neither form of Shorewall blacklisting is + appropriate for blacklisting 1,000s of different addresses. + The blacklists will take forever to load and will have a very negative + effect on firewall performance. +
diff --git a/Shorewall-docs/configuration_file_basics.xml b/Shorewall-docs/configuration_file_basics.xml index e92cdc52d..a1b482de8 100644 --- a/Shorewall-docs/configuration_file_basics.xml +++ b/Shorewall-docs/configuration_file_basics.xml @@ -15,7 +15,7 @@ - 2004-01-05 + 2004-02-20 2001-2004 @@ -383,7 +383,7 @@ DNAT net loc:192.168.1.3 tcp 4000:4100 numbers separated by colons. - MAC Address of a NIC + MAC Address of an Ethernet Controller      [root@gateway root]# ifconfig eth0      eth0 Link encap:Ethernet HWaddr 02:00:08:E3:FA:55 Shorewall requires MAC addresses to be written in another way. In Shorewall, MAC addresses begin with a tilde (~) and consist of 6 hex numbers separated by hyphens. In Shorewall, the MAC address in - the example above would be written ~02-00-08-E3-FA-55. + the example above would be written ~02-00-08-E3-FA-55. It is not necessary to use the special Shorewall notation in the diff --git a/Shorewall-docs/errata.xml b/Shorewall-docs/errata.xml index b0c4c2d77..cca1afe5e 100644 --- a/Shorewall-docs/errata.xml +++ b/Shorewall-docs/errata.xml @@ -13,7 +13,7 @@ - 2004-02-04 + 2004-04-16 2001-2004 @@ -86,12 +86,55 @@ The maclist interface option previously wasn't available on Atheros WiFi cards. + + + In the /etc/shorewall/masq entry eth0:!10.1.1.150 +    0.0.0.0/0!10.1.0.0/16     10.1.2.16, + the !10.1.0.0/16 is ignored. + + + + A startup error occurs if an entry in the tcrules file has an + empty USER/GROUP column. + + + + Specifying multiple excluded source zones in a REDIRECT or + DNAT rule produces a startup error. Example of problem rule:#ACTION SOURCE DEST PROTO DEST PORT(S) +DNAT z1!z2,z3 z4:192.168.4.5 tcp 22 + + + + When using an Action in the ACTIONS column of a rule, you may + receive a warning message about the rule being a policy. While this + warning may be safely ignored, it may be eliminated by installing + the updated script linked below. + + + + Thanks to Sean Mathews, a long-standing problem with Proxy ARP + and IPSEC has been corrected. + These problems have been corrected in this firewall script which may be installed in /usr/share/shorewall/firewall as described above. + + The first two problem corrections were included in Shorewall + update 1.4.10a. + + The first three problem corrections were included in Shorewall + update 1.4.10b. + + The first four problem corrections were included in Shorewall + update 1.4.10c. + + The first six problem corrections were included in Shorewall + update 1.4.10d. + + All problem corrections were included in Shorewall update 1.4.10e.
@@ -503,7 +546,11 @@ Aborted (core dumped) Revision History4 - 1.52004-02-05TEStartup + 1.92004-03-20TEProxy + ARP/IPSEC fix.1.82004-03-04TEMultiple + excluded zones problem..1.72004-02-15TETCrules + file problem..1.62004-02-09TEMasq + file exclusion problem.1.52004-02-05TEStartup Problem1.42004-01-19TEIPV6 address problems. Make RFC1918 file section more prominent.1.32004-01-14TEConfusing template file in 1.4.91.32004-01-03TEAdded diff --git a/Shorewall-docs/images/network.png b/Shorewall-docs/images/network.png index 714232481a708bbd38464e7ac4bc208081a6c297..e2c51aaba4236ddb6841879de46a49fa8ede78d3 100644 GIT binary patch literal 39367 zcmdRVgRHqnK@_tRg|P5^bimT1d)}IR0Dwspupcp5&|G6 z@J!ks_`>_DCjAmrJixF4{2(-uP?P|H%0kI54T*r?@DDO-iXe~^I|$_A0|K1`Ssv>k zkR2Zgv}phW3B`dxcdV0YRS^JHkcxuFs~Z}Ggdh?SAqfd92t-a!LP-wd27xHaDM@HZ zKnx(DCM69e4Gp#6fUwI#v!= zUw|@#oRSj9!Ocx6P8kgX@o{t0(BQbaCHeSR`T0peDj;z_5Z}$i&&SU#&dps60wEB< zheS}2UrpAuc0B39}JBqecrZ&X0>AQ>5)p`PX&<2QzedWMFE zu9}*lY|v*tJ!9iHDk?Y|8_*^`1!L9(4Z9*YzMco11jQteL;?nc4lTc&;ZEQ(azV=(G{pY1{yI`z{$LE^|cER z2l;w>g62S;p2@zxp1weXMbN4ltE1z&zrU|wB)* zs1h99nwpynY0O=Q7K9?bxMC} z>v+LJTk%b=m+&&PpAcdO`DQ3c-m}y$9cJ^r;ROm3IipwdA!P%e79XZ$y#N{fmPe2Y zcNREuyyZ`9L;OjHlKFAs8%dJeY;mTJST6`g;L411NrAJ|N2eT|droeOq=K@8oucyK z#d(AF-vYT_NdB&{^_DDiFXL&A#%wRV(e?QKZ&Bt0#tCjzo;~X$x6@L}GYSMJiV{J> z5G4!;G8ulfisq$&y}&Kr*w`=PBrrlKkVgJd539p#)u+0SXqLdHO$NX(vkRn=6JSH8 z0vP@u2+$s=_)mG7_!b4p1$^5Z{!cL>QLE_sa?ZEo>;kmpseG$`ffI@3MMPCP<#GDv zFy*nt1iAn%enW_mFu~zJ3Hpo%&5CLWMAEs?)ao`(R1?8Jlno?*>rYigYh)V#UTC}6 zivJ`u(_X!)yPkGQJHKO5P-I+p@=H4LKwe{N=+p3=&R^5KZDdge_%=#N#87K3PW3(+VT8utjO02Av>1Q9agX{Kh_E=J&}np1;plC zfW4>EO@LA;IQ4vm_wzLUmHGQ&yuV$a%_plXt6-po{&K~3WRY6NNGrOH#VybJbCvrU zC+zut6uD+2F{iL3F~SH$yu1yWDYv4weXDNWkQ%);o7Fq6GLR4FB!nK{E@-u&JagfE zM+CiH+<(lgkA#k}PIr!3iopy&Q-tweH0AK9sY&o$Lg z=d34QLrqld*RZ{S53`I*P_`g_Ey}NcIRv5KZ7fPIetU5@5oG4^x0rwhzz(9h@Jz6? zEyvIQX`Ps{+*tCN`}K)`V9R4D`oF@Oe+U~w)SsZ;|90LhX}aDl6uVx4HsY>gn=WR> zYA=&Z+_rS*&v!~(cP#X;5AHObZl&Tb*F;a^_0O|IUAONuo&AKmuB+?PHk~w-5O&{4 zbxS>a976*&g*jb!(m?k_2Hk7i0-Tu|4=rxjtK1*DlPSJJ`^ zi*w}bKw|%|UK>FmOktl={P0GZl%wByKShK&o^nwx?c0L-|E1OnP!n@Y4opAJh9}%8 znQOrjJ;MTCf7@VF0yV)-kpw@WI&$M5FUI!>p+>Olb+q~LmODw7Lu>zHxb9rgAnAgHiB9taO4Jr~dt$OqC5l+0J(k z#a9>9=N~dBoXO)oyHVJ4jg4m$YXA$*%oZgTG%JThqyG~A{GV~E03&E=6xDQsR5`*A zL8P-n83QL21preTwa=%U-0Bc~hgf5Rj39TC@Bec82;jfbRN)kr)(i|4nGJ}2tGb8a zDKu4pn@{vn&A)sm-f*9E_e{b1U!bO!Jmb-Wap9oE|ADl<5AgjVhqd|Nk$m27?rW3o zlL`Aj=57Z3HHWqP-#R;3pbolEChgxk_9)Py^_wRTbG@IhMK~2GJQmZ>E-c^Ks%{}j z0LxQlJv=-37;+miF$RF$ObksNla`%2{<1Ng(tqmVQXd>0N^IIWcIh8Q1dT2ps4AH! zhB|M`j*VZAD{Q)Lwk4>IHz?9o4D)w2A4%i0zmT*1HEn64zkbQZW>Kq*5vSW5Uu z=R<=#`-|MZu#yg+01W?J~-AnJ-N#w~RIGfkhTy%8^5{ zP0}m(=uh%!yM!Y0v-M{JdY)k>lYdqXZ$!O(1Z-(inq7ahCfD{$phn%B&2`B4a#mEH zwWj^@LGb<%&kq0Z@ifkRMVU2trp+~m%E&Z-%Hx(>$py=DK?l|&D1GF+p8MSdxp*nf z4U7>-PcOX8?-N3!zxRf`tuur@VxkwZ+dR>~yi(7#Y(zEEFsvyhi#;R6tq`KRhdmg! z-79wYr3n%iI8oM;xtu?#+7L-j3-Y;2$&UNv*N+XkLPj4e%d$B?#~pMDfFl4wvK9Wg zKW-TXei8rYs8GrsY1Oql9MaFza+p8}4O!P<(|#X>ZcAPEX6$P+tt#DhuUI<%3h})E z606cvu-#pGZ@FdP^CZEXV>>RUho<&B4)j8`JAyALQn*lg zMgVYAzYd1jhF$1L~QH_(n0WZo8~|5?DY%H!C|TxbR&z8$86 z;n@f6Su4Blh;mP9PJcl`Kee_z$|oJ*4zH+aS{bh89fs7GO`a@k{||RoHxFsVsSwZK zv>9g#q&4JP&4H(WHy`YcC%t*X45j1c-w}M|BLrycT$)1DaEvNVe?@;e4@Pwb5%j8u*yZti-Hm`%pMNaGkVM?o9_nR z7supfJ19%fMrNKI?9CQEVEP;RuOs>Wcl69#rr5yH0K2xvy;(fP{J$z9gb35F*uZL8`&M~P zA*rd_dnlhe*co;a3aNa8N|BWkkfg)Nz6m6FKm;Ka_MU~BzuLgq2>KKmT9mA>KI`uV z^@3E)e<#$cMR#!ePpM(cZB4&Y@kylckZf;sx*~Z~kLIT3M&3qEnK{P(ENb%siVr*O zQ}<03#;=36)>e({^YTL&&N}E}*jzVa77`ujLp8)&ycgyld?)&RP+DS2j+9p=Q01jM zFx)We92Kc|FJtE=qO37^V!q``pJqrymHf3Cu`iZ)~&#f+v@1A#iQY`(1K(`fA#=`}$wbhvm`YjV1R&;VE(X4-Y(>w{cdwJ6{ zFLVG~(NObi+q`@%m>w(TDYZWv?}O6M)BSj72j?zo zc72|n)hg*1H%l$IG(+O_S9Sj7NSM!so%~q#!n%V0Tr%&EbJnBhNePETuXf6Gnd@|4 zd|#EY%Mo%5OC4z7feZq~IQRI?hE&q_*yQ4#-TD_J^wrN}wow;`nIWPwr0W%X5I1H= zi@c`iF8&4H?yc7pXM8bmcmF%SPaRauyuPdG&1?*u}6l?X?#snn$k~>taD>IVMR6@6&Lm^Dq@K5|5Rw%F!gY9EW5B> zqlrpM{jTwv_UA=~D$p8yuZUR8Cu+Y?EEvoHCj>8xwxk-9coCS_nNLP$Ri%|8 z)e&_6YmwuDezz_?2gTJ2?06`Bj0^dT9TO3J^6lF2tJxhRH)H@;|J$GWccjHWWrqY5 z#X-q3VQFtqaztt@xFGkvj9IKfgvVCn)fE_h!Ez!cF0KYfJI2|N1%rtXR0toP@nDyq zFE7O9pEoB^D8{9MsZq!n0gfv-x?6I08PZl0O<@=3j17E9t{_zNGiGt?TO=Hw@rpc& zrZf*fS~oWq7rP3Y7;E1#y7=2l7D6$V)fA((m+n9c3%c~k2+DLw3j@=QsYB(0<%K+W zJbJ!u*>n$5#QkvwyXXC`FG{tDn^0uGXo4l zLmboEC>9My4XKV>RA&p?dm)Y>U%!P^!30C~Um-DyJc8}zv<$4LUDOFWtSo7y+LCyG zV(jkCuvd`$<@rWP4(m|8#TvIz5Y(DeZ)Mwk)FBHa$7e?6N#3?UN(fxs&>?|fnQ9dN zUhFePcy989uH<+5sy0)GrFgqyoSK?wW5`~b_!G;HFIt;ZrQA^(BMkV>+MPg6Lqoa9 zK>^q$(d_NfxA%t#A#*-oyKIq1LyF$_bPPH#XcLq{mu^L;>37obv@mz2Mm4E24|tiiId5AfTgx%KE1cHZ38n*tskYFo5x(a%jBH=ZxxZ}*M(re0 zBjUzVOOt_3Catah5)IUv1MGug{~~g(dn4`X{F}rhSqrCUD;sZ0F^#OnIycYbl(z7P{R+@PzSS>XDUV zg-Dm1Tl=C*Z3&NBd+u3V@@#vLa-7MixAX=A>(@hVBDYiq=*5;zNW)bgX2>?+)AquP zJI-lPNCm?^jr7~34{k?3xW6PV$PiVC#(pZX)yfW`+c81;m*Ra7I5 zSlGGe1q|*UI{3nW2?kiy2ocvS(NC|UskOqvj+18gK4gQJ#0}uB79sfQa;M9xe3kMG zH9nDeOv|Lc*67C-io7efWzU?l+~xZziTw=lp>xK+ij}4ka3&Xv5d7QFgU#3cDqa<^ zNa3hp#D$0SL2k(r4VsGh%_KrI@cqVk*uwtT;ripnPm!>r+?nXjMo4Skik>5!K0!K!WTT*G$(vNDJw zu$SbjRgUo{r3k*C?)6tU{jtA7V0}6^ZCmBRv15?8ePdxMG`gTOM9<+dG_6fAM*8mh z{R?>-v1SZ$Bdt#WP1VC{ejC^_A-g7fq>x+l(=W(%gaEK5@8aipd;9i*2Qu|>NT-h_ zO_dM-8$7I=Q`rhBTBc3)Bi%X)?P6QuLUKJnWnmgQ^b?f}`@3ndBHYK7B=(E$>GM~| zhFsi^L3Ao6UbWBD{!WW{ zeY)TNFk~Jt*d_StXRdt$4R@OeJvG zlS$hrL}J}p{6B+udt@)|o=o2{N@T26KDqK*VelL9k|>#>Z8TWHhWWE+ zl$p|K=moI-i07#H_grn8TQ?%7=*VJqai6#wIPlTXggpHrPpkfqG@b>qY%f$8l>sCp zpZiSSgYeQ5&P-3l@m_Tz`de!gUHfoN`W7!Kto4SrA=|zOg(|-+!id%7DH*pUnvy(- zmK~44shT#K2Jw1`$VTqDt}MbplJWy0D~kj22@jrxCO=hkaZtm;qozj~^HgB$nH%Jg zyFm=l!eN@7chrd2Bg8gpz6Yh;{TWUC6)}SZhp}4Jzr4WdQ!%^ZL_mIaO!>a4P#r@D zO6N1v57~#&dVxsztuB&jqr(xyVVr?1y46-q1;vqyO~%{lbWdALyMDY3r&u63mY{~( z%y^wLCo+1?PW0QN>zhgQIZbt7lrgm3Yz zZINDJwna*sr|`SH<*939o{~XWywH$Q0~6jiSok?p(x1HE;vzW|pAoG66x};!{GeF0 z6d^c$mletvWb(?2b)S$ z?n{>q=#+R8nO40jO! zsRvmz9IQJ|9CB#L0Fct5o_l}0A894+9VrNSUa*@#hpn`F5H4R1FOrU80Jn;2HmS`| z$m&Aa=mIx@x6f;!ugZWGL)^!Wuy+W90{#?qJyDnyo{}j*AD^s@BSe*o-{Zp zZR-2&KEFErfH5@7w~0n>=Q%DLzo)ISHllFquRS8(ZRSh{Fz?^ly>yhKbQC;V{;7tr z{d_%JaWA|A!yGmB`C6VR3?0I2EU)(`y=yPHmP(ck)>o*+F-XDyZ3qqdD32|5KNJ{i zTvlQQcADAti8wWhB}3dQzYA%9q0rIkY-MO2&A)Bvpck+vboHC1f?D@gGK-Vvb+>`C zm-(}+O&X;rpnG~(-(i*#)4|p0$;tj%EvMT-srS#B`nXiO2S})(4V1D^f2uYEM@e1U z<(XnjQmGXQv@PC&Q&$+Hz67JU^?4Zu1ntPZNJ?3Y18h&fdxR^-oR#O2tvY(QCA>^G zCTlHYIyR?ROb}5jqvMU93wf|>tQV3+1bxIc>wRCnFoxANO9+7B^lC;q<2d%%>U#Fm z*baaY<`HzvCN572M&X+DYUI`N!q5^%tQH0^|8}K?m_oA$`6%L}*smxCWe2hIVDQk) zvJ-%ZbtG6=P~$$dLHU~Wn!&+c`dW1)^a+uO&tu;^0KP4+V4oILd;!241DiSpo(ljT zr|Eqn>x{9P-rYyLv6MSSmMVr&^ybpSP$Zq~yz`=pgDBMb`C#*P->NeGo=W)}H7o`n z`rIZ@2u5LNz$yYUpV!U(0UafZ?H@pFd`YcX5B=(irx|T;llKJnnziBFCP7X%zC!eB z{egh`+DzVWb?)d&c&n)3fZu0^fH>Gew_i? zSyItNsIWF16HStEAiif~2b}0+1CQCXC#*qe^F`0|EGsLmPX1-ygC%2N@EnWGUx$ll ztntyDiwi1U-rL?*mkN&ziai?zULk@3%wHkiA`D`|JzoY!eB=t)^fRlM$ZcChiecEX zG&#eA=MnZ{=(QBm0)_Yk|3^~;nT3;$;}LH)miUIhK7n{GWZhZRb+b5$#2#K+UcbHj z0tTz$UwVB;0g;}H&D!wj#eB`7>3t4e6VU11YplEqN?KU3>hDV$BIQBd@H7!1XXNayr4S+lIUvax@d!f5hs{XIj5?;TKHT?5BSTAGa#pndEiILZk_B z$kV-HrWgn)+1o0U=-qK#c3Y9c!#taS}KmNrV~>9Bx_7mdd!zX%$Jgy z!iD2Vkd{f2Mz+GkvmONK{*fDqGJh&ie6%r}nEOS~+OY%Hv2Cf(Vg{a$mAn*}i+KvQ znyI(H65>Equ)4jvCUd^tyZj6}ObbLRCH~$R4jdFI5A=L2Dq__qnf2!Z$7N5w44A~(`O3JZ zg^5)2szS$}wg*f&0T{(~#gORgUFcVi?dmrPOTo;CU*)lWr1Kr~Wf5Q7mbTZDVnY{| z9!X89BX-?Y?viw<(M^gIEI=rrZs8}Gg?^`NvZ?+)KxNkVyIhaaN0j>k=ofN5{zvKW zq4KwK`fi!g&GDI;5Mmu(8z8(!&~?+9tVZ`I4^sNk*-&~BarJ}! zN8XtZh%mB>ZwaCdX6Pm^uB)qX!((sH-9j4YTX)kUxWR)KF+H(0 z@;w|%K_lG>pEZVd(Q%=OX_}vyyZ5NLd5s^pxUvcClMaTd_d>8`BM+v^pq3b5K~0l` zN^6}rlWsCCBlti@cMa2hT1isytX5k-0QO5<|KcZ+{EslVHG!`V(slO-8eOf4&;^Tz zaoYqwJ(x%RPhoy5uM^yw%wTdH$A(FhV2vLqVb0K@i9U z@-wrJ{f4$7MH;{1h>?2ujj8*+0+`oLhD~Ck)T;;eiDXS%VKst5pa4 z7~^N-Lf~-jI1jhL=1Sg7mm zxKpN**s-QPS0-XU@?%I-iNv$P(fzM$QdSM03-oudi-y0hDHW_0oO>a%7yjWmb3#K%TtU^?JO7DX_tR5Ijs@UG1@5Lph;XPVjEEfzF zC+Ju7Zp#TBe#^iwt0gO=VPNZW+IC^voF^>GZ+ngCQ@1`lSXthPeBf+vIbm&NJ4r_^ zpd@8sf1HGHWG6L2GOi7#G70@@cBD(r_q!I<9@VQ>D?x$mhzChneG5{V9=4TDEE{=& znpuW}S_yc@lu&}dyb}sEleCs-`~OI)Cl1f>Pt(Zwkw(c(lg|u2PtRs_iL8oXVcXtCRVcv@$m@>NlEpOdjTG9 zA=Wo5|KPvd2Whb|z8YtOym}1HN4dnKnq$V-IV+hZ9y*ahREiJM%xrd)cmboiRZtNvE2KvcHMSJ9Eh% z_pKW2PIh0K!6<=f1d(jsuT>Wa)}fX3Y+>=~Od3UlLRIeZPXQvINGDQ3l4%b~q1;`W z$ZekEw+47;sZaO4f9mvBRlBK?QGq^O4Vm^kOF*^>4y;8EkEgBX>l}A@_vYQ#k}U*q zyU7l_xQ@!E8i&1|>XO;Ms5MV(z}d?OUDe5-Ij^s_k6nCn zfHkowY;GH^G`^4E12%eIU@?iu{REx2n%jbVdh+w{f*mn}H-SZ7=waf!=;e>zuJD1s ztt;jS-^B)=CG%>RUF>_O25b+R=>C90?hK21c!J3A*zu=z%Ut~z&1l6;Pvv=)Ryv>) z6Of{!(HY22QQw;cnR6lLc#K50=JT~g8yT^N;!Y|k6 z+UdgTyx}D_)l%&eYwvexy*4(w&C_hMu=AE@o&=u)aMgH$xelGh+{h}<9(C(lHB^%0 zH&~y{*NS}AU09fVvJblOL|^>kgze7MR$4=km(1G1-L0)Vq2OjAAQ~qxwX;=}&b}vb zX`?QF#X)PnQN(%c7@zK&a{_{U#C}igo7k^Dm!zRo$1usP*4UZY+Z!&-2^a2ho5&q^odLUei3za$K62xDta?~^MCm<# z)5g0T1zZL0A519@o0rT202j6g2>(8b9ik|?i3aqK5FAh(jLNaS`Vf3zr{01TN97$> z&P!OzQ0`ZJ%PngEU0D$S0+@t%g&m1$`7}?&)+fMpFoy%dq#C_^lZMdDMM+%6$J|&` zt7kKFPN!|sQO}kKlZ72NWt24nQfkAuLb>|eMpq=KYwd;`q!+ChU%ZotC$SCBC4~B7 zS_q-T_kF1X$Nn6V_m^IqK>+Y-TsE7P@{5^kt8=k4;)3!w5pI9ZKGs@eRKh>a9u@yp zvlT!ohfN>R{#EAf>tj_;ool%Fk^42S_&kTb|4@{H#6P!-fkM4N{$4u?E{dGhP2_sT?&qiy~Cup~5{;4BQw~fvf`OHwfv+1|vs+*`2C%OxV z$z13@-vMOj^nlrp=nXYn}M~pg-jK38^B?;7OLeZ z<5k-qP}Z<+H-5Vv@h!ZIx=nwy$oJQ=8oVg1sXgA~R1eRViI^p`>k0HJ9!FkDQAtV3 zt3A^CoVm7($@}hTpM3(%kQaM~Sz#YRiVpO7Rvm4Sw95G+*2~uwh)@Y}g*)VtRyzL< zVH8G9kL2i#+I?iIZRT#?Wt4%SlxIZYP!g4f(c9luUf%H5f)oghl34ob-Oe{LuQu3f z9>7%9n#%Y(?69;Xg(YAr=24gz@k9GY_kY3-F?g-`{FJ6lubVwa@Gnl)Q#*eD)rIa6 zFl}OUXl>)epon@>q-QvSD*y?vFk+TQwLOUs7?hsOJNRRmS_*c4{#N%m!5K{ z$#?5w_xPav`8Rt7g!KhqKVWX>GBOhT_plx7%a0!nK!Q^=r{|9$rFG32^@ z_yz9*ivW9h$o7LK1lG4-N=zRpzrq6DUwO03Tb3&pN0Kx61X{XCYKpi-!ZQ4gD_B^A z(8eymEbg*&k!dpo=aOm901mylN5ZOdSc3pG`6GD1BZ>pi>!Cv?U;g9}cE2Z)y#%n3 z5~-*06OGFhIw>UF6)p`zD1Zmp|A*fU$GniI+Q6%rP<>T;1p^@`Z2J=#Ax=L zLlz-A5i`w%2=1jXTf;PuYIU0lblqZAUxkyl`t~bP@e4aX@B-hC^a4LcNU9HUL@9P@ zjWWTKAGgdN;gy#2_rC|A?`qLNw2RIPu*wr4fs8Nr+ZlkFW_=~AUF*PkI(MfK$rb(qn$PsX`> zU91l{GlaUBSP7x*D3#lg;hej$TIQ#j_cZAIM2^Pxy!(rjAOxIgZE-&(y;C{qvx>9}ne(l&n^C^N`U~Cv(Jy6L(|z*X zpsQ~JtkE_%6?2uh8Rkp~c{dNN|IRjVy~#l@l%GIn(GHZ*zZY0dSBfz&ZS_B`xmIR>$FZi#a@tVJes|GcB^<#3k6E_ zm}<1+YM@Q>hL2k9%z;Uj&(_w>iiNwbmKIW7G@OTn>Kjg)us~etbKBYOe0E0=!xuza zlLi@5TviaO_!lD~!D)d9HBh31Zho!h;FR{15yCMz9O;#4&7=4N+9cCZGHhiHw$I|T zv{;T?b;9zV`G>qu46jeDto>+Grf9Dv3b~q4K_pAQX`3yy<`;=ij@pth(?L+FBW%Nk zA`6g@9H>Q4R?5VZzXRLk!Vw0Br;ct=Kde7^ zNs!PV{cNl&$qPZY9u$aNBiIVk4Q7U3a@apUL}aI%dZE5CL-RKKT>7M#2NMZLQu%VB z7i{m3?$kBLerVYVwFtKkGa*9>==MGCj;}gkK7F)@FZx@QASIsqQ zVOK*Gb(N%xkTV8{l*>-@zi2Qu&^1_Np>q9+eS+aNRgGdF;=2R{rfw}5kUVxd%e|Ef zlT&ru`V#R%dGd&J(2B9uC3`}LUS%Qq>ySU>EnzJB9mAr(9?`6z4SDx9 zMU%Q>(bsx6Zk}GAt>z8ptVr+@4=gRYkVTV?U8o_UlfUy879?WCRTIU8h-+mwK(xy) z#JhTIi_q^OQ=nHJnLW(C`n~&B!o8JS|Nb0 zT9eR1A1e%ZrWvSl%_oL*W~#mx;_O2D%{?$HMT$cC1!)`z=uBTw#SKMeEh2c|cJ}_! zR^O3td{`jOv@HTOluZR2`mrY`4)r>nJ$TmADvhmUvHE zx-58$AEm|;O&sAD^@aq|(ehR_RoZ-Gx(hYn{f5D-9Z8=utE!?!x9CxOFLVI}`vhm1 zjS2nXvd3yBu!i@`2(ID*_q1hP8^^r6z3r!CjbhLo;5@tux*o+k_O}%iUoiy#iUlTA zR0o%LJ2HK`RhTKr=_%Wfnlf5t>Uy$b?NfP9IAYbX^kW@f{>7aa3|@WSs+3-ON>~gN z^lDF^58jkSi9mIQ0T&3;iax);^tQ73q#`=;!CiI&yq9tzB?f$_?z9C<-u;PptwD4y zpN+pr6<Z(1Y3$7u8E7Gs8= z)+hUpJDV!ajf8GA)W^$-9S3Ko?C~pf$@2IOj-&gu!HmM_rHuUF!0vc}~Svx4F!I z6r3wOND)Ah4u%#qu;V*WngB~{&S)6B?GJr@^6atAhcD*DM&<{dlALxw9-JbE6gm!E zPF@|}{XLArXMnx1?mW}YlvO#c=yd6%;}hQw_p$jMH7|Ea*EW%EWZPZc$*x{Y-P!84 zZ>_@_5&8LpgEylXrqqmnLHywqCDB^2yMeT!nkND_2LA?vb!YYhL(+bj==F6mvXC;v zgadaEtw{#Eyx-3YvwYW7WqmPLG)+d9d#{Ssl2-g>u@v#y2J>Vlt zf%Xx4Ea4_Ei_&&3IYic1&U7`;=8&JN@DdWEFWKmC;W?Jp+*@-DHazWTm!{pXuo6G* zAb9?B?x(}aKx;5PAI;jGDb@|tkfR6bN7I0~6=t1A)?_;Tm5=HW12BOYF*R|q)61vn zktSCaP~X`vUT68U$=-4M{}tM}5sj|3HMb69r&bbdIdD&l`u6qnV0 zlKZgf_JFTz=>WsZ=l0kI2w=Q&u{CL8G5pXEA94-3+czF}f9g0M^RH(2nqjJzDqQ?{ z>Qt9k_iI$Wl%XR?%Z-K{um3n$2$p+o5f?%A&YEebH%|MT*gHw>HD)KS=DqcZ>l`^fS@3(MJ9;cEf7hluvgp61xef zL_J#HOBE)~)9a_KTu1Z~z=&K222VOai6k{WE8`9gG(fN}BEy=yy2Mn_0_V!&${ouV zfS)|cHO$RPzOmjNNrV-Dn0IiB&bZVPN}%&HR$L}zHNcZ{|M(smbjwbZX~2op+eZ)@ z1qx|<^yZC{H1`|`HuygHgf190%IIfrPE}L zT+V;}c>dm;bml{PrrcG$a-$aA#eITT?CWo{v9_-d8>l3)7&vs?vS2FKGJP!yf`ATd zut$1wpzI)@2(w&1I8**wLw+`qmKdTfbrIEc<09;zXq5cvw9cFD`QTe&IxUB&Kf!lu zYoU%c;J#VyDYFiri_`ki#@7$S9$ipMac^#z+5UnhQRbuLkV#l(do_K+SkXwqS6`%f)}EZS&NXUyv^nN~DMD&tF@WuPjdnJVCwIUh@hCn( zqVFkqKO%AOdFXCt?@)|0tY&e(v+J9Pe#rpaqeKwq*^oZ!C^^ng219_evUOgwLG2fJ-@yWGPLC~0>RB$c4Hhu5P3^0NNglVo#My7Zq2Phi z3xc35ZX|RRjr(czIM6KgSHS5eZ?L%{{rZro9b`VgtP8hN-E=j=HBSpz4F)2|hh%K4 zg$frIOmF3J!#^m#-CP|MM?{%gCF`Udl)F#yzyj!Xe%b*8gMgbZv(*qY(EHF1ND+p+ zfq3lZdZLF?&68v1AOy_YI7!UNF zch0gEyhP;Sc@)Q{d(9xL(Y|eu-&pKBr-f%N$RSfK&%ASiX_fQ#ae*v42pu6PZZc!h zDoO|iH*F*RkH_L2KDLhH(!w!{4I^;gS=WW>n?jP*#f<`t1Xs&NHu(Z5{ir$|9KOfM z2Q1WF)a<$ll6K=7N(URn!g{&eHs)SFC)R%)>* z8LSjckb-4i7dwP=iz!j%n3}y6X+|uo)7@5v^P~W8EE`H&y7A;Z<%{B`U&xjE+}t||B5x6`8+r20Pvu-50{!_9 zm3LzHi9ET8=g%{zYm4>LG6PU5^Pc(DyGE@8-kdFU0OaGL9ro9VNTC*FJcWJl$v~{I zL!iAcn;Yg>A{nC>wI>o){ML*vb&S^R`wseK_p1M12@ZRq<_HUsfA(2TPotnP5>^;K z#cEc<+QItpr%KVW#Fo8p;LRv9T=sUroZ9C0t}k^xfSZ~GlBwtv2A9A)RR)<>oTs`|E=J&~df^6yL*7o*y;qS+sq1}ZBVt)^#x z(*{=l-S+FRiac^JC_r_WlTxdv2j@!X@9^=q)WPTLkO?Eor zdv>t*XIodZ8HhY}@LdYK!X&aq*U)c6Ug&ge9*!R2~W;2V@ z3(fTN4KW7yWKXMO6b5=b(rHm-5nAT5|BtJ;j*BYz`p4;og%?Xn3A-SI2uL?eiGtDy z2nf<8A&tA_l8YcM(%ndR*Gi{Ii%2)pjqttre4hCI{@a~9bLN~g=g!QXIp=-MbvEsV zOE^G#&dadsqn3LN8x#vG+9z@C!f!k6_=%>f2c?*GxX+vre6AC&yN;@%ZAPzKvv0EJ zUlC0q_ZiSdi_CNb%JMo@avzmV*^|RD#8YR=RDx+ReC-&1Wr0akJ`a^=i)w;#5h|5` zW7V;cw4r&cZ(c8}Gf^fF3c48k`53Mk{tY$OXqTuw9 z8hIwcw-+yt!*DcGHD{;b*}t}#F1*J@A+C8?pd99yNg)(+u*r6jCX zIlsOR>{kXue5Pqs+6knS-bOs9gH(NIepRSN5}JpVD!9xH#bnh-<2^U8QO^64iB-Tf zo~|PB>4lL6^q&%@S-&lsNYUw(;t5K0>*D=VE6wybJ8|Sw=a$#MUS4=e;l3MNC#Yov6t3P0})W;42BIS-+L&=z_n3|+;{=bd8Z zm^^GAN3BxU2p?T)H~NQtHJV*_BgyS<98VUIFYV3NL?QDe{MgcTU}LsKUf`>-UqUgz zQin8m;)`zwl1=XJe74_LckKN2h-kXrUM+w~Z}t}yu2CZ%d5#;Xhp+e?lM@vAo(E^o zWNLjmYIhU(BI|Ejk!h~=TD}{%QO)^@?z$a`AlXBV;ft|XiC%ln>hwI!M8d%&IB$t4 zSD1lQ0b>w+XZ2U#oC{2vbT0cPR-lo@*&$QT$IL!wow=3F^_;We7^9mQI;g5|r+h%N zhZMFeiVC_w1zTOA`Da3Wh1wBVNJj+|`kheE?migae35(dL3Tm>FRMWimjC#^U6;nS}aVQQyA zpcbsB?;UEw0;nPKzP4AZ=1}lq3#a5uIX5#r$m|Y_+_roF;fO8!iir;qJoN&IJ=##K_*8}K zqD6MQ@9)Cid=B^Qibw7)-s8U1Y&}58b}se$+zzbaV8eoKPG-FEZAX_V@2@bn8XjMQew9C0@a{jH0wF z`}4I2M}t`HFucG6UXW)nC_ftA(2BG)sowqMDTDVJWaUUm0^tIT%;K>tytrB|V3_6J zzO=a7UvEyASJKv!VYn#&d+Hz9vCK(K)i_7_2+w(;1bzI2e7+xJnX*@)*cU>cgP07h zGdpyemn(*{)+5*DH!tmWCLmf?@Z|mhmN==Qx;bh30WBl|HwfaLcg49A4b!9B?7?j( zCFhUy(F_dinnl8oA)e21t{4DMBs%0uip?%;cZkNPgPFnK1cqq+;M68}j!1Z~kP2gv z|C_#t>-+Jj-5>9%S*~{}WG=s#qLnV5>C+dPRhDHJm*%&R)6t8-l~|?i9=YVj^L)qs zWRP2HoxF&_IYRd%6VZ>|-TfQ~w6Sajgo;`Ks>}OJ%0HwU@>GDc)hf^LVLG~_{D}9) z?JaVik8-oBEhp)>gmg!;kY{id+MSwF^N3s*yBadq+aJRqZ5%enAjAZgm-*hOoyC?P z1834U44t}(iT`ciLZb~lMVN`xS6&Wfvr{Gvr$8CAb{)S}P&Griw z9MLZKk*c-)NCw>FPr&VMnSMIzw^%|5om8ipt*T07Vv=`Y23;S8_aMOUvBkhQM4{0 z@oKN29OnV?jO$BETM6IPmheN5uq3}kzmQJAR`xdt9UOUC9xlc)$`GC^jPY&{a1q

IExv}`lI8Qx3x5#9`w5@sP9^ZQ3%XW0rs$UX+&z6-jvTFpj(AWe*a-0>ASS8aH7S}*SoohLEPtr3DZh& z616JC1Ad6vixAL@-xToaF%2Fy?j^rS!}fX07h8FvQD^W0g@pIZBitX9Q8f$J#Ti}J zFnRc>KE3>ptgZS}JmN@X1{XJjQ!m#KbWKM$6r@Q0^_i*(?IBAP#(+#HV|$B$$%_yiAk zRSv#}ZP35C=tD@&RGzlIKGVJ*Okp^i-?KQZRp1>$N)8zicR_VrTiVU{Ij$X5?2Ip- zZZ=2}2_YE_%!DAkqSi!78n0)sDujaijvbpQ%&~YAcvKm*@gckqY9o^psL@vowny_y zHXcE8e;v>A7zeG7d41GJ%u{kd3WTl^V8jN101K?FNG@rq--o-nThb(vxL6rN&!ws# zdOlwe7`S@iQUJ@WgUr8?-a|5Z_lWU1`S)2Q>E6pv4iwT|klZN+Lkmi%(4UH0eAiww zL&zj!ihcw{K2ZE4;pDY}q)W6q2(W4(Q5I-9jqe=5y;OQU_JN3vDvv0{q%Q++FrU7s zFT&|mC&9R$1Cf#WgN(+-!qD_%sq+9O1Dzkze2vL4kfmO1SeT|ksAKK1wR0jUNw;}3 z69|2>iOM|pJCKRpQnNIEa?c>q)|&8UF|g|^o$f62G2HlJJz=(tY(BGgIKgwde2POE z->cc57Yl@1K5!gxg%{=W2BC+tC>%W$sRVXL_)okSS7}ro z51r;uvGmsx-`m7H0wmxMO=<`X&Ym!K5#rFezmTP3Mi|pyta*439p?ug0Ta?*$d7RK zuZM)kqU=WD2E9(bCMImoyi?Wv3KZO9w(sRdjzt%Zq&+_GvZ&J>DTjxmca`i+M!1fp z%eh0$KRpSj05zd{jJvwdxfrz?**m9UR{QZLsczU*JxJR3=|+LrOPtZs&+RNxbw|!> zD-`Z>az_Hk4H{*ug2T;noe>#_%eF?h4{AjVB0kAH039!>Xa;MRzSKYS@#qb}7r-Dh zYD)R5nMOH0nKOTRDX_)rgP$APio|B#kdP5PxOrJ-5x>geETmU2XqK;=zIQ`TDV_DF zY{wkC2f2Z1^+*T^f0JxdDvXdAYP~iMtoFgXVy!UoAQFE(qqC^MYk{w*E~lW`GMqE*g9`kD=UfR$tW@8N2tS$VT7#Uyau!ARrq z>@S*No;KAlOpgA?JBi%lqy6f2Tv>3@r)BuU`coh3LJxD&SJVnClmn&PmodawI-Mf zM}*fNdbCyXp-^1dDcE0gmx%k{d^$oYi7#!rmxrb>0)a}UZqSH}s-#jWs`vZ6AeYOd z6-wGY+@p%eU*Gh?jY+UHKNhgDm}}Be(2VYoxIfkK^dT(^6h8nf?IROXzIC~nWZD`? zlEaRP#?DqBmPUe^qBL`g|0Xah4%i-b`YbSu3BJ63X#IHWr7myGJy12y5N2wdeMj;8O;~MsSs$W+Fwt8~Ml2QNeS59*sW@OpW9^i^q#xc)<7S3LXTVlU!2xOhU8k zCagGL2?R1x|73g+mp)Xo5dqJLQHa;c-kbx^h(UQ-1G)M~IZhoiG@_gmR8}gjpS)|V zh%G+iO&#z&dHwrDYRCy%enE(bhJSyG>yPGk#BR_|d$xy-MI7TPV ziBTnGCm4`sm?GLwSq(1U#<42FQHI_8gUL(oa*NCaqERviV2v6oeZy`^E;uN9&d^&t zxn>xX{7MGbrU%)MO}YW9Ia4zWme37zGWS0b&6qs`awOamZO7laF6>*jE=qnH{~aE7`a{ol3CwLaUe;KDJ&7!>x|f!#B|V^u}> z6@2GEtrjur7l&|;@wGgvk?vt!_apFL>J63^_S|)qR)v*!Vxxe8S%52J$fatT0CJM!oRV03*`{mrmo$iAsu3h;uI!=N9`um3#HMbN{3*`71!8#3^j}4CW+%XuC ziKo{inv{*tidP0}d4*@K3W*Zx8)FwddhZr<*3>~-)a+-~Q-9Fg8n+S|pvdbj@BgX6``1qa z?zxtH!PF5@I@|a_mDB?zm�cg#S?~LW;UOCA+A(t=mw*>+}9J-qR6+1oY7hur#IoI6o93 zg1Syj*5GIlVR{oE`K-jnB%d?NFxnh3|d)KQ&0$ z6mV(PiT{g{i91G`u>V);Ai$aw^uN#h0Um0ooAvhoqg(A^jPY1^VDEb&iT_r} zFu(`ao$UW)BdH#2xY0ae8t(x_}9x2AUs!g?>#zcQx+VELgVC{D;jH zbX;SNo!ltfCgp!LF9B)d?;r*Sw9#h!ji1f>;&jOlGL~4XVPddoobx}txJ|A?80S0&xEb-IQuuY6T`UfGRpYH z=>Hy+le-H4*!nMhrhzt4y##i5+WTj&6GvE#WHYEC4<5v*w*C}YOA<1QOyNakWPPcFY5Wwp$iDq+jC$q@%t6Ag5yMRlHDlAcYsCUi&JPNqO4GKkBMxj8(=S zA6!|}%bk^nO>)=RZdXGgS?h8W**U0yQzg_8_^ zy+Kru{J+n2?NG_I1%MpJ`Xx_vfVe&?)jF*srsS5t?~+TjRMWVDo`w-iZ)Sr9m1jg7 z&b9Q7zK!+e{nV$)HM_7?b!Y;e@xG{8G;;ge{aF@a3$N=KlHSwLl z_y=OfqZJph6|gJ>dZ2WArt&xvOgR5k#1HA{G|75^K%}uQ{FXlIbt z0{>T{d`PARlz_kmu!no=zfKnhfnnqAku!EGpn~S5ciiWeblxf5>IPZGNOc4}hWdxe z&N~xBny7fte++Lhn!0 zLB?Io9vE>vXuJ37jT1SQ)Z^dR6$&>Z2^AC%d9iEmT>gm1bdAmBDxV@Vm?1Q6!`;$c zq*Bh7_vS&Cck(=jQsc0I-FUlVeh0d{$XK5Bq&Bgk0aSSUnd3Q3;LM zN4%Xc(a@eoWQgJU$96p02_V8b3@h3R$eJc54n^wf_U`WX*>kMPdS4r@pV~lmwC@Q+ z=dUxyuori#etn!ZD2IS@_7$U+-~IUT>oib>Iu&Xlr1}Tt_!OO5jKPPdq~}f9gwxpH zF0t+g>={o-!rnjRy07Sy^&ILL({BI@jGeV>;|A1{JNn+iyG!(btoZYjh_9+;#=!H| zW&j}9W=9tQF|~!yjfUnstSoKLIcdWs6T|X(?tZUnai_IL+qOA#`s@!$8OtzcF#kYu z5kZR&9Ay?wn5SBEW(#K-)Mw+D8e$2Y;RV7F_Fbi-Bkz>; z05GAwLjlU0;qwRi7hMBk1)}X2I>4k-hp4J~P&F<92NZ#B^1V;kkR1Q}4K*5+yJUB} z1WGxP%3uT*O&9p}iJHvK>9m4uTGy`hE&iMr=~=|mq{1zgNIIs(=-g%ca@)%3X!>{O zTKd?52HYoD*y`wOQf{ghxX7cp{^y0!^~xh8{Bs@Y8I1D){C64Kss%D$lqJ@qyl?D> zmi~>vHNT>IT23Rvs^dE! zz6y=7#tacGVOMqZ&_V>t6PcjS+NmAf^>p2Gr5v-#kIox7pvR8v7k{sTlV0BKzX9~# ztH+rDYzzgYPA0)y6qWo5Jy7nJbbyk8@Lt{h`%&(eco5}3v^*%quAM4In*8{V)N4OQ z%dPf{{sYHh*S3J`Anz6IN1L|n2FbrbyF529Is)!Ng_q{2HP(0*+0NpP!>*L-V=t66 z=FH&_jg?O0je$S+KNk%%_^Heoy(+r==~j6CQLum@2(&GF4meE=bmLq0vqqPh;P^FX zjlvWTj?*1zlM`P`%EPNwfUp8O$j8LQLeVNnwtxVo{WpwRVPYa5we+`qOG}DDDUzW< zWvDUyj$K|c0fBEj0K?_?1dvZHpRWNC=RS8<0V5uMpvUnb(3=+d@PA%7tp35D z#O9NexTP28t^Rshw^Q6!a*=QIjs+dI6ClapwTg|iW$Z2k_(k9`h(QyIJXoqUkmRbmQ9ufc)*>~0<5Em5Bu567Fx#)5RW~^ue>AvI{P$@ zGr@X3vd-NMbUpT8-QGP>{|FcL3uyZ%_6`aNUt)qpEG+OqfUcSDy0%1$ntDLtJ!+!H zBA@g2cD}aZ0Sy16`2{4fy8AUHQB6Q^@}_Ghk!5+hLPY2}}Sx z`}@gll>c}YW98SGZS7CIf@|jP8l^BojbmDw{x#W*>gzOEeXZHoHtgBVpMoj?P8SLy?rC*vy%!Syto-e>+{aam#DIciSgB4O!2LsS**oqx3d2*El~-fr z_8-+Yrwn!8&eW{#tdJ#ykTicRT{KGnW(Aegw+#l>kun12BNo>ug|+T4th^06}rHp)mVvl(4B zTnDC%7yjP8s+ZJq=YyE@3jO}9osPw)=SuH8qXF`E&d%&&_usC5Wzl=6#yQe?YZ91bxWyqg6eP~DGu3h7e(%aki7r~D$hvdc0eIs(d1>#BrL&PPM z-zsJ5_2#{r(c`5hlO2WnezWp@XW{5NWw1a3Ohqad)n(4yhN*wUs(whfR32WtVBe{* zzQBnzC#n(Q=5x2hN8L@_G(xKT>cg-%MM?x^z(4>YE?%IW3nk7b?tlM{_3o3TSpR0_ z+h=|qHr*zg3@1q=G6WWkjv{e7v60q(x(li>iyfmB6{vhG8L-TC1U$FrcTMt+6FBCZ z1kc>HxZe1<;0BmZ@#ENvs-3SX6(bc|{eV%e0H0WhJ06r8&G#Q(aaipK6jN3CIte3n zXHNXuORx{BU3q+w*jIb>c{@|lMgbG_YSdh*3&(DolOp5U`rq1cx_SN>63y)#Iu@He zv}PPvQ`)|X#vG1fNOjI5izm;|Zd-rom{zu;f7>78@r2!Pt9KLil9SsxhxDm^G?$1k~ix%JWk z{Tr;3Xsx-DFVn2kLpZ^*+rUtYmRN3Ge)^h{tV2F`nj2^Kudu%GqdzFs@j@hE5}O%- zIp3JaKD*96Ao$*z<9YS`D&|7pe34|idq5I8Px7x@YQet!$KBe)j&W;X!zZya7Jz8W zCKlf9cM`8r4H~>#=CCR?#N?L24H^p$!d#-!YS-+#q_F^+=6gMMfH5wu_Zy$TVy`n> z3%mwHNebh-p57d(uXTnSrGx=aU6Upj&-aZrCcvqdfDqd2cFfB(R;lRqw)gtMk}4N~ z%j8${iyAr|F_E&)wwwC(bV)0noA}^&JoX`Xx-E8wrb*Y@=-jk5{ltR=ac~^!|3XcQ z7E}LaRd7rogX``^HeK2x$7Yjm(^_2Q>g<{xLJdD(YrH>NAR+Zfn@;fBz)D*^Q(Ir$ zriL}1eKwbwUtYqu*8X)FRr`YVl(PwPILkEy0{n4gpsk6wR6ZkCLTUYNCJG>uL&uX} za*cns{{C_sa_7#yZcy`yvx=pt_A#KmNj@#@8yKRxsE&k_jBiMP zw#`uzt{$a@bUTJ9{95iHBbB~?lz>KmP<^OUduWh`C3X^Z9jga;|1oexp#9t&Hl?Wc znvE{=e!^+LnRH4*KP~bu@W3*&*$gZj%xUG%d^cM*>_#wdeuTFB*pf zG#KWVJD5lfkFeGj&o|pHzKYBv{!ZxlUSnWhw^uyAXHCAY7ZSfOw(43>N`BwWPPLw{ z^7tG~N#9fV-J63{SP4`G0Mgu79a(j|TEqmTPR?yPqH52oImjO8%UR3r}FDzvrh&tEDH!V{JjTM9xsj)1LKqOczK8bBHpo;GQs zx+(js(YZX|pOhLj$PK~$7w}u35di3XKlm{;bP(7Qb-TA-Zb5F&BYAvJG$k#36C@<< z^G)sZKh%M1YEo@~dgncHuPk{q@9vfP0Ew^;`y+>Ja;1-x*~hY3#D&bk6DlCU4u%3E zeJjG`(0qx@2(=XU;%ICzTOT>AmORm_Ubd=bm~CD>B-niZxCiqE2h%h^LFMFmp#%xv zl#bgDZeCiP)S_#sDPL&xPI&SGTfk=@fJ2{X!{K94qe%w#_ty!}BGLNW^G#LnkN$x5 zPg}2kNr+6@|2C*wZE+L2EibM1*1gS3zVJ3#GFg*uW>aDB5_0W$#(C|G_JKNamPj#6Am^~Qoi zQP=Aq=8^03k~IU@hXb*O2T@I^Tf#q`_sis19@RLhF5N@?;fY3`cYF<{wRV``g}g?L zp51p<>^;C#bkYrQB!aGofpdp`2WZ|t7{2Z|h=ELG{k+XEfnKiwzMOFjN2rl!UL3!h zKqKGUvaFUOeMA0A9cz)|K^B@lmwDnUAp!_|!#hm-$TlM;i>u}8!GK6O)v|gYd{lEr z6M7>M8r+8Wy;=mm!p-#Cs4+-qK?uO5H{_0S{`=$2T8A`L(6PWAx>30E7=priX>!fG zeGk$=+`DcRS)HTR8k~pR4@a|D2`0t(@9}&W&=@ev%6Dc$)bENw>JGs0 zHGuOEiXSa+Vt|TaAQc9VcBvIf%83J9$vDZ?#k2<(yGkFLmzY0bUz~P;?&yLmPZgC+ zq|$4VKm?LK1E2{H4$pp!uU5`O$bEf#^R#%Wdq+YUw|7n8bFvQ-y{F$=4#OYugb&K; zF@zrK*9-;VLv3aw9`5uVJgQD%-A@NNTLt<&^-JqdJ4C(2sa$C^H}Vlnt%B6bvuz$` zv|_p4%F&mh4$3v4!J9dUG*exJxDQ>oLje5-B6&wJk+UEEwy@N$OxLP?-Uud@f*{2+ zhA;`PUEO64#$F6-N3y;QmTc@_U4HaNfdYu;LselRNMW6etj|AYf;YF(C4DG zGeGIjnA@=2B7QG?u8WfiN;=(mFWApyZ80o3FcQRJ0WIDyKmYi)cBL!krDDgrtQ<(! zmqC*1BRbq-?d{a<$M7Sj{H>Mzo#yL9eK3T(L5Uv{L<5*NwITMwLUhx!wZ)@g{GOgT ze!vPHdDct)ks0~?hsGms8{em(4T>U~gC0xpw59YNWJIRtQUD?uVGS7dFWe)8)bjrZ z8_@%)3j~r;DIBORNxNpUX9P7F`$pVs8h?i@+<5a(ZkJ5MM)# zBG~x<%P4~yYntz=7W}CS#j2DHl7kPPtv)3{HW_*H6?YsQ z_^`vrBG6ZBI+wE=mlw7Y+~1`l@%P!Ulb3%s-z@Y%W+4^}e$}Iz(9qba=`@Qn1UnKN zfuDAlN?{~1nt!c>4B`^a08zr&HF>LY78ATFa5RFE*e9S%de0epuff+HD!O|ntu2fr z23z@xS3MIGc3b44*W>eKs}3rpT0`K2k%K&op=>TJl@&545$(ynqU?VOuftZ# zO_G<=I1vPeq*DYf+4gi;N z#Cwnsec_;GQA;z}kmH^hKByr4s0MQCw^XYzd$oV?`?u6I=`6VD7Y(+{_j!@IVTHzM zds@9jTO+?G)9h;|9^|C{$b@bRrWb1X2fRdY2qCL8KR;{~l88qkuhI^+PNP6ud+blf zrJvA+hbwq z&?Z_N?u3Mnd%Q{L#YMtGIHO-Vc1mHi4+#u$Ei>?~uT)bCqAt5S4Wh@>k%uoX&NfAE z7<7kC-QXZZofqatH^xi!HPs%+p1gV8)J$1+qw~{^dtvP)dA&~Az^gca{bAmz*YRU3 zDc$TZoI?*GO40)>xOnKoGuzeRJDtW$6%~JmXkqbNViBiUr|4wFjY@%tC14)i>MWVnQol@|c2ul)nmMKF# zXm?irFgRQ`#L49sOxJ^b>%eih@G9T4yStnFJxaPstrMoQsiz={lA2F({DS`a^UtS0 z-6M03PIfyF?ceqFfdg?3I|6|=cW=+{A=Rjy>{;nZW@ygorU?pl zR6aH@Jp~DsnwFY_92}dPBTCaHk7ypV(Z-J=w-gLsKL}V*=DVM<%kz9(iGx7I2eAd2 zqI>sEl(Hp+gBN+mr~2ibUcCjoMgH^dNiCo zSkt|#*6lutN-Q77jP1MLGFhJyZg8JSe>x72M9C&V)8w^{7+ymUcME;a)f@}vvUmqsbU&iEajiT7HSt)3S(t3er}LB-Q%$raC`NJT^eFG2qbm*DpSot zuP(Ol3)qWg&%zAM9lAshF}mm{=7-cxy;QTuXg^My<$jV9d5TKG<4`@Veoh_{eDr>Q ze@w?`kCUfQ=Kak1$jE|1>czU7K%ux@(5~!l?i0nI_lKL>ali9AiCrd$y<<_^e2CPM zk?TVOo2|y7EJ!#ISE6Hx*c@q~c$f`3pS(y5ssQ#t{1wBTP`3M%jFN<;1D*s>0w}3^ zJ{EWB%qi^?tsiSr5TUV--zZ{)b%u5lovo&rnnp7Ux{fp!w0^OLVEpiF;}6Y8KKj!8 z{p(e?3nIF5GP{^*P9CpSPB0|@!_7`x9{R9M@R+Nbu|1!^J6=-qz9&}1GPv|GYN}eO z2n?eh-n)@5ZRrKmZBvIdb_QI6-}i|V77@a^WN1hzr`-e4F@nlD!Y{xH!QV%__0JFe zcohT0pagunX?xq-3T16=Z{s|kDP+j`CncW~*A!MtdQk>Ah^D$Pwuf{Y!!r(!|M1=lx?hd_Wcc`4L z)h?!8?iHhw)EL?PR)1w8IJYAt|JyYl<;_@mAl=XCn_O~bL*UHnHOg4QcuLf@6I{!q zdSqC;czOY-+>ZNH&X((;c=+;n!ehn#h>(;6!XocpPYxJ@t6#{0c;E4Itwwr9ZI!*7 zjz)5Yx#DO%?D``Koa)KidPG}JD~*}HhhcNKI~L^m09<^BN9dKh>2n+QqR00|dJU_b zptDzwgSf1=GMyZ(M+cLy+yf8KG6qQN#2yD26EQ)^av`*+W;XggEQQsFd0q-d4-nJy zycc_kq$qH0pIxu?4|fPswC!!*&Jh|tPF>^en2bhC8)uah(ZU4idq~z=P%cEUx_}0Cj1iQHxxUNo8Ox|ofZ?b z!@pX11QEDjSFi+vA#@8goOR&)@$FJxo4y3QKICpGH?(nX_7-n+kABjGUnzMF3R)v1 za;qcOKVeld^x~NF`^oCQ3YvvaK%9&Z1oCi7xt{7NMh(S=?#Fv%>1zS7O7OYDLOwFJ z{8}*)hJ43|>KOSqpx`bDILLlP1F8nQy7x=io&_KJ<+I)E*!!Jxi%1%D8{;3|JFg`?5`=Q!+agpvNnF(}-i{6TkXYTqgAm`9QW0ewjD z5rGtEn$~YZ$&(ow!v51`Yh@SPr)DgN5d~b&p6@%p&u8ee>HeXwdyDBpzoms7JIWF( z4Rt4lubN}9t(@xT^Fr3mWSsyD5K5@TlS=Z= zOAn7h(Ny9);u)HZVb2E6g9opI>-PDFB34#wUw`tZ4Szr4=9$Xl!Iris3oTw!_i61% z7yf-K^sIherjQ{GSJzo7GJA6I@?_FYw`5Dsb5@a!{JYHR?!DlE#2fTI2EgxEG~~#V z>w7uDv~f25MsGg?77^1msUj3rqpdF*`jbr3#TvLy09sDLV2A%ZF3Ah1kD>6#p2+SKBd`#;<2Klwz;6JK;KGDGA%T^193L zsGc@W`dAsXrKAZjxF~a6R%Powp!vi^}rh#A0Zaht@2m#>J zcX_%x$m$}E$yL&HR~JoUA**N86+btGlBez`ml1`lPj;10)i?F1TN_=<0#9WISx^cq}@15?QWR^c(9Ub5HGkL z*YL;p*TVrf{R;rbPAGN-J>k`M1nn~OS#gt$+Om?)h+(70=Ge?vgoTblR}Q&r5nT<* zF{yOoFM?Ns!vJ5(~BJEu+W<*<0wUV)^fG)QphkJ43x#xL_UBK4@LAo~%US{{7_5&G7j^ zPn;Sfn`b{!^H*31-hF33l>{(-n8|z2dbW*GvEy;3{DKN{Q_wkC!4=chpsM3%N6NR4 z&IQjA?!_0zEC%@JD(Y*`%)WYkTrr}r2QG%`CNvQ3Ab#3SY!7Zj(W1S0`oB~zaD&cA zP!H0A@co5vqm|Q;1sU zqb~9+elq0(I12|R!2TC-QNJ<&KpQ&<*><|A|4RJ5DKjLUg$R5(k(3mu6>0sZ*h1i9= zKhYa8*XhG)n4o*ILMQHbmDiyNUhth$*{1< zHSHfjE67hsz%8SwY;}ac!SBZ5E;uMhq#`iZ4fSGearLWVK8WYMjytV*okvV_&Zr|K z+_$TC?D104-2b$<#$YMmMp(&n7?YJFhRMrZ#Mj-((t`K3^2q?yFXOU@KnDPBwfm_t zr&O$3HMGUKvrvjR87^r0=zW)x70XI~XC3N>z-ttxpy=?D-Mn#pdiJAA({xvcmwtmp z6hlowxcbX^v3;(9Qt=%FtNb)=(yx2*>u^^uV^h;IW;u1;kS8BcvA?c$09giF^JZ2S zV>I3S|2n+6q%0?<*W@W*rM)$A<^I6$Z$SzOEAiAj(7K6_`O9w-cRUxd z1z2Nk)HTS!y8FuT2n9emkKFS0!``-Dr|x;3d`;))u>XBEe`c3}E?VeN6LSAkb#M?q z^I{+TGsk&ap3@t!|)b~N8f&sx^*5_bBY zi~Ro+q3*R^{{sA?vkpoeytnIouWXI3X5-tgyLfIc*QIY8{=bLt=~ts@spI*u-T*h? zl*&=naILkb~4#$T|J^vGPve6NZnDv${-{fiV^_%zV#CN^1fHFx$Qph?thKr&^0>5OS zK!|Hf2RJLY&R-Ylv-P4Z|RISz{>X8&^s}d zn{x8o@iT?(bM_jcf1*|GPV9rLqYNqupnkHhqq9Al9dSRuMYPAsE{Oy~tzn7}AA1f2 z*g*$>g09vwosspkA0Zvt;Z{7081Q8~!Ai;}rSU&F;5MBCGul_XD?O|dohw`?88hTX z)D$%Y<+y9cN9`J`PD4`V4K7&T(Ujqi&j_A2eD>?6d^E@!EhEA*Q4|XMj6xl>w=!CO zUlO%pL*TW#3%Gl$JM~ueGit;X12B>gop!GlpFk>s!`J}tBlR@UMWKX@+>ZkV9xp=7 za-wv0D6A7VDbniFiFabp&V@78gQ(W+8O8`l@*51|hUcSo=!tZn#i~}ydSiS@7~`L- z>j{^B`co&_#1ZwxZ|7YztK*4|?5|DPfp=yK*6etncGj6Wy{RRh>Kn7~8(^G+egtna z^@=rj6?4(gb(msb&MNO~YAGN-Ryo3=uqMdU0>f}0WGq#292K_msv*?}0pBzRUdSqP zLG3NAhYykO#N;q%=v5!IMj@H!tqJZ}q@pt{>YA)o5$qBEsFXu&*mY$~gRFO>y_!J0 zCUB(aMp6(_4~}Mi4N2!%2QN7gJD-BzDJ%zJJDV2>MN6h#kk9^so0vc!oCv-34}4f` z81c*`ne(AEPO}D##=j3#ameBURTbc{&jX|I+v{^( zi|A!_G$*)@C}Q!7BAA}Bbc`>cc_{~91rBIoZ5`jVu3~W4GPxj!nl!!|A!F=v;rY+{ zAts}ul?@BUF3`_t-rRbP5ni>LLCLgeGOah0;sw9;@)*^Y`w;IQ(S|mRGj-!0CuLuz z;0yIRXm$WW8dLU%?KPxt&%YLDKBAfDe>M72HXOt{DEVPR(xPF#p_cy3v}cfn(dAi5 zJ&tydkaWSHHg4_gczAg$dg>nE{QOoRax@aQP&feVe3VpHjzxZwE*bc;CgIfpyjMZh z)s(2WS&GBf><@!$ic=m{B?CcqmLMd4p&>Y&W4b!)dh!$Ki);`qVCb{*N?0onE^F!{ zHprto#-dR@<3yB}67=5P-Eg5)+E6wEtwa;LJ|)l<^dYEa1<1LpqitG!+d*`cF@P)O zw#o+XRm(QGfloBbaI+s%u6|w4UHe-65wg~06Xz>d8Zl^?jf(}zc_sDra*BHhw}3ee zM?&`MP%8NCG3((b@lTUpNi1Ab&FmL-nchTfUb3fJyV_!ETX=ff!o}k0phuvP>FWm` z`JTPN>9_PCjoe?Shy;)%aPa+gAB#ibi3__y-DaUE7TB;ISI~?M;*lYiXJ`vwZ?qZNXcg)Ev2Dce0gP>>|(7TjiMrH-_5*RIe98o*t ze&pFj|1uL8Va-bUZvBTOd`j-_A_jDsP5ivhcb5Dp1B2_il~sfpQJe>R)^fsmg_v~o z63;`P6BK`p6tWvoQ_YLuN=D&l@$$B}@4ZO^S(|scza~^+Qj{L}S+rrsE!4>*Mq(ks zW9;%M@2yJ+Pes|nr?$WfaiKGYoQv8ECc#MxPyhFHi07iDPu=ivivospO4nrV7KG1V zf0F=GEhF@lTn~j(`0idPX<8L}zXQQpH2hbvyw7zs6D3`@;u`W*IS_%vp7wf7i4HR8 zDa-1gQ_VSvWKzO6V;tS=l;>RVd;Cj#Qp3GGj+<1#e$|i6HPCiV4>!25nSerPbcv)6 zUGv~We|V28Ubn0|i{O2b)5p`d`EB+0XG?c4ZCA^NJF@5RQY~x#p7>IEp){O;u7tCz z{pzMP2Z<+-K!YBoZ)p(!rC@Sh{~l5h(GDH+LBKWhwf-CoUJ)%^cw_s=Qp$T^KWmjI zTFp}!y(d*5OZOKgF@t&R`wj1Fpmgm%ou%uc@Cd?qZPEGVO#8yk0+W>JX zDR5V0Qs`tZ3y9!6BgN9MXu^rf_!MGwmy$Y_{}o5u1oKe_joSSN{Xg;KaO+>oN<&*NIS{gaVh$dqJQ69A-uD?S2N*S=Xyo>8Fn> zzTFwmC;Fbse~B$?oVwS15h_o1z#9%TiGO(ZbK5XO=dQz_m#+kGIvxXy>8N%v7L80v zzPvukwv6+Lr+mNcWY5?fl6Q)})aJG3?C?ozmIBZOtMUD_!){zLOW@weqmgW7Ip=4| z=( znkvX-K>EiX_GEd#y#Hd%9&v5d)%O|sZIC);Ese?+i6enxTrFa$fBErY_cuzwu2C1* zgZ)+vf`Idvv4C`~Fh(Y%s^~kU;Mf(9;MsyYk!YwGm;q!l=P6*RO?yRjs7M6u-$w<| zFXZ)S!*rtt-wWvD_{$Ia-P2&~P+^tTy9FHt0&+>2$pSRlkfJZL`#)>c9d3X;j(;Eo z-gG&j*6P0`pP!RAZ+EA^xM+)B$SfYt>dATHRS*a_eQI=6qlD-H=A1Tj*_1m1SSmU~ z$mOBzYYnelmZ&9HoT?yRq_!%Dg@U@VOmobQ`BpvvmfQF?g67m8=-2oG>yM=zByV2; zLxJDDjKzVBCB;Z-+a+5#g3KPz9CwA{#2m^5vq4!Z2m&WHRUZat4xx9NRp1KAUhANT zEL1LqnqQc8(n8vCL=_V{lYWamlP0TmS|MJ+4U}G z!_K`e9t#-5GWh;qd)L|3WYeufGZ0*cs;HQRrZfTRN({XT(tAe{f>Na=6oG(rq(~lk zC@&x&0#X#D6B2@@{o8wP(-1F8)+CpFi1y zOmMo(X-K*Oz)1U3?$)qhAy^)orf*eB+0P2ca?j-zZ2c#&t)7>X?+WD@*mr-HI?h?g z=hZ$F0JL0=61qSIv9Xu&VZe=t>SGDdgdNQNl z>m74DjVAwe^A$}fhV_r zj9Scxf?&Zr+H<9?owo)W9n0M6&E6W#FIP9U@|%plQFq^nQBiUzw<5(zH#r`ee8Z-H zeSXF;g<3xg?c1wvql7j3 zzO!3kb{&+rSWlou&l+oU8vEx3mbbYlcne>)tS9!{w154F(X9#nu>>}5lSV+3OkmVj zsWUDa34*9bUjs{@L@l}QVwcjyXp+M2hTgHUe-OZ?HfN=W$#3$SIAO&4MNTN9o zT>Jqx%aDyRK`Z<9Hwf?hD9b#M=YOXnhS@f`+O69n_cO&@{!0Vf2_o>zxC#vy;TIQY zUakm&B=(ega;jn~IlrE{zS5|xHeJyH^W>xXJ~m>`;Jy*zI4-% z>T_iyCP|)Ze1U*cxwvD1_Dh=?qQ)f;&v)s2=YVfTsUjT+nAOvYQS6z2)6m8PTE=sWzoWf14m}ftzao+2n~ef zN1a|fHh9Kn@H*#cmsjJc!e>Wj&@FWO!*7sRJg<5Zyv8{~nT$DT-c9g-R>pK`s)%}>DDT|4Vw;#UOl5%8Eq!240CzDg zR->t##k(Ib_HkvGHkz|2r-;NxY=c;v7QhYAZgO20)5F1g&QxTt@_Q$#dP76m;d?3C z!+<(lx29Vt%enJa-|}p{X9Ew+z-2uK7ZXf#Xb*Y%NOF2y2*b(-6Eh%DUM%n$rtH1S$9rwMvoau~UC2TsrU_SozoYnYlx~ilovb}uymx9z}iiOoV zefrZ&ro=?8yzOix!0<(*dRs;IYd)5yH+}o#XVZK%Pkou%m#Ed?;VaV6)OAe$=x}#( zW->gzcHsWV^yFlJ8@I81y=fG7?P0K@9O+MWeL-q!gZ~+qbW+uoDud?3yp~CVuxfTT zW-G9!ZTiYCN7j)$LF~4}g6c|gE3zH4@oSL6ww=9iWWfk+mcR3wJv9}a2J`YNJ-T3j zT_p|XjpqYXQ!nP~I5gN?e!G#%z*X5Dj?3y zmQSwuJU?Q0g!#;#4($H*dL+o8Y{3Jy)+;nkRxgIiir>?3k=DPJlexS@yvk^HL0INO zFSi8<$)VECR5jwgLqxH{=r6htavTKQA3u6De{l$H!>~~eP|;8J>Kr?I#+I$_zeyT|#a92mzMP9+ zdV8fH%&sp*v@QA#`xuL?INlSEE+q>tViwkvBSon0j}ba?zww=Q8vQG*qFa+1Z$!`# zAZ;1cQQFS)AB5t@l57jYm=a}o?teQjQ>=~>M0 zl*irhO3pan*(c%gr2QRNkqG>&_YDVW2bzVNktfQ3C>d(S>a!9`T+wtXCQfD8tL%Si z0p%JGpU{a8rE4I7H@UiKcJP)s%~kEq;W1;gz9Ao!!#JM?+*|u&DJ(shm1nwNVa%z{ zT@F?w-Yq|)Z$ukH^!DO}WLBfoQWDh2<|_3ZBfhC(Ml}ycFe@$LRizHIerAeXynQj# z&KlJ>qjgX4Iz0L~YB)@)_i`E0`Hf6F<5?ND_nT&iPJvIMJ?Z9zy8DI0jPp7CU3pMC zp&=IGSL}5Y#4@yiZl-7vF}(xMw|i|{>z{ZSYwsd@#;q-Pc(qPId!GR>}H8qnjG89%rni!kGVzBGjLo2b4@L_~M^q)9?9Lzn#Zw$b z0=5njAoQSAMro+{_m;I{6&bZc8woA~QVY9TZ5gH9pWxoYaJU9&MO8U;4lSoWG{Qc5 z*N^dJVTis$lVoN|t+x0FwI9oTBUtnc{9EY!I*H;AiVd?X0CwdygJ!W;pP_>&myXixZl6!-G)L^<&m#ayishrM+i0zuO|IG$r-5~A1}eLi$BD$0r>Q7i$} z$a-;e(<9I4LDV|g<}OUpXZWtcik$$I5$x;dmkCx1no4X1L@X;EE{(VT&^{Yy1g8PQ zH<+Lj{BSYmp5@K>-_Kv5z?0zU7>~}(nDb2TVLzoc*7OLO*QAECd?HDXA8_lNR=dWb z##BnCdBf8iHX(KmlGp)BtNLZkgS6PKl_rGE-2g;M z3OGU#Az)^x#`SKXd-$Ho+CM8tR^BOg5cQWI2QG|^DpCHR>#(7{{s+WKb-iFIe=5-TjcWv`nYG;%%^L#@uXt1XPO&S^i;5<)z$`1Ii_ zC3B9`xu&{O)nc1AFl>yZwL8dkVL+#4B{D^aS_^wsRB){mSa_&wI}|xT@X2!Tf6>KJ z+5=@MX9|l?+>~%SIJY=ik^=I9A@y`)F%iJDoqqZsx0g^y2;Giv8DV_l)d_JN!&^}_ z(ysjwh6YczEA)luNNB&+NLUV0+om1emL4FhCx}a_@iV;s2S6`}p3G3xOkf?f`t-4V zO9b(NLp2|y>siG4YYQiq1dN@^++FWO>_ckM*uUNmJqP@qF8rSq4(f2%A6n zIq+jdgZj*WyA1x|hRvutsD?CP&3)428!oqX-Wwbri=6k*ZVSoFotDkyupT8;j+C)i zzGS<9&iIw?--W{L7!;OqUaD(nsDX}6v9`RYmwyzhUhg$ke)Ha!_$s}QYGkFCkoVsO z{Q9vJ1ozf@iHep`Q*i2xHNb2Bm19%Ebp+&4;_r{syG+*;DmgU#t>$`Ts%rYv0BG{J z-WlBy+xn1=uZVt_vfRf<=Oj=hr5Y&{c5Opx?-bMCEYWm-bpCpJ#!QO2)rq8!B(lwT z>CL>`r!zo1y(a$8y%Wx7per94WwTHam^UDY`_gZVkhr( zmAGN`#4sp2qUaRm3U@efnOS1U&Lk^vdy2g$5%2^~LY9?^BmvcRc^qfCl;bk>nY6EW zf~fh9N~?Mr?ZUgtHDR5w9dHKzvQaf@2brU*IZ1G~Xmm4O=P7n0$j0TEj6B?l(c25S z!Wx3*dn=-OBKU`q-Hg1N7{E1tp1~VzG8)Xbos+C}As#HmX;T+s^r*_BiHs{HpYn%E zG@ekI8W9EPGShKkNgjlyFCj@+YP1)uoU8I?y1QgjOQf5s0w~Pxa-kI^6_YAESgVq7 zgQGQ%JkuoAIqgzI%Wm{DLETgnz`9oRdwF0x|06EN4>*3jhohhbXdrFDY(SYFom&2n zzNvRtBDKr$`D>Q<-yLBi2x4xl0q1rEMZF>(U{E!zy27)en$ z2D~rlB=)0o@T`bV)$Ou-eO+i2nR_;^)2=mIs zXXD7e&0*o8gOy9ogXBkUFIbSppL_Xz?!Yd@tE+tqKn~WMFfc-DHvCvOdX+JTgD9F9 zndUtOq^ouBS@yvfWT6rnoDC2VW8~kqBA30;-lzk*#oQEq_$vS)>~^m9)Dd_ zI?z2(9s@b0#LwdfJjP_B?Hpz(Z@D=>oaD1B10yw-;eWFR)q2v2k36%qH5uUL12-@Ty3n04uZ1OR|L z=Jm{Z!W(AQYmC#2auRiBnt#gmpV~Xa;|kLsx*tUfbN%)>x@O^1VT`XOaU&&V1u%7Q z1ucXASwq@bI9)N~Mq1$A?N2@eHOU7L^Ld91!Kl)o8fj F{s))VjRF7w literal 38645 zcmeFY_di_G(*V4pEX&90Ei4kfC(*)UmFUr;iYZivw(sWoKF|04_5B0h^ZB@Y@0^)4bLPyQGiUCI(bG`_v48*o07ye!#Q*>x1mpi+ zkrLt|?=RGR@jnD!25L%x%3;Ee`+?5&-~Q z;z1#s0DzAe0I+QX0LY{Q0E`})P5My$r~o}}!zcg7AR+>g0*EMxxBvhO3L+{B{FOoo z03f9!1+W670RTEGDm*?F9Tg0J#ouxPNI6L9nCP_e{OIT?I4GEySm{{lpcDXr5P*V< zf{ugE5&)2KMOkjLGE-Nc5IT=@&mz;-hg?UE9rCC{*t*wC4(!#vF%Z?5}Wo6}fURF&_WohYU zeSQ7#FkrZ*w5H~=sj0~lr=B&O)zMVh+S)ob1t=XZZEC`kbkq;m_w;luEC4z>E(Zn% zhKFl?z&R5ny(;D>V ze}5l`b3Hmb#o=(N1Kzm+K%%3DilQOhYOe(hd;SNpiTD<;ew0fFhHKtHV*ZpAS=DIQ zFpM}us!)8+>n(le>E%vp-IioZN~N0SW96nLF)0#c)XvYo>eHLkeK# z>)>kmV)(Ivrn-|tXk#q7es+6XvZe)dSA%X=)uNzE&>f#Jq=DMkSD#; zJEAIvgrF7wA^uN4vAHg68feQ-#Qd+DgOBPoPu=aEqqP7+J)({4x-bC=s}ps)3$kU` zgy1g`fqV$kh(M}SMOf|y(f{1!a?V;j@h{7T)iu03HC9wy;^nyJUJ@l!6~8H*B{BH8 zKC6s8HF;1XXE@SOn!c5L&9JyvAu8(d^X!+}&Lb@%SI2rscVUFM;c4FU*^i*+{Oi#? zN{u1H;y@!3@EVQHsF2a#w7#_!@mFv4wJf+ZeRD}ihvtP1H79^*8X z9G$nCEYJ>y?TPL=s>YV^fxoYjYF$uTVN;|y%Fgn-b20!5eXQ3ZFfUx-Hie-&>gr;*pq+mny zlpsRjU(&EJhy8XvF2{R#;ft4ndfu2+(3KV&-OJTWtQ zk)U(JzI6g9kI{Aemk{skQK8?pn<1Ag&KYNtNhSmw&4~JJIG>3ok#K-C*D^B1rS@db zS&pFCy4k8UR(ivrFp7R*Y}-W1w-ZGS|4;(e>f_fm9wqzTD#{fY}=;A zB_|rMbS2_zQ2n8vg_K0y&aZOz`K`PJ=rm*b%aT9bas{y>zK+ zIU3Lsz1c)61RP#1;ug9O0!}g(uh-cF_FSy5j#ApryBDvoHx$kqb#dEOw@0D@$N36p zC~%PT+z~hkL(iUu_eMT}piBDQWrCs3);6iGPXDNOi=#vY6_m&_qhhh`DO3z=6OGh$ z#hM*^sAFs_bHaj%GvGGsC@S#nBXAfp7jJ)84M?CHtV5a$+D zH-~lLp>Vw6&%VC7bzKS_?96HDd17*vz>bHan&gRZK=l|{Ah@dFiJE`eKj42*_t1FM zGb;nFZ?{0}^#4lv4+^d=v{V%HPKcI>AVEmn%iCb|n-oh{Gjs>UN3Db}VPMWO& zpkO?`^62-O%NvUgJnGlhL^W}2N`Nzj2t0MdziCoEOqh;5gH2fl_4jXJOa41`dq^rm ztSj95zmk4Na9{ys^G{T=4)#p&GbL@3v}g-1!)pj*&-Ud*Fs1@eYl?RO)+hn69i+8b z_Z-f#`2TWW4NXIi>@YB~Z&?3VPfs9y(179SfZ4WnMGTcU-ZF4gcD=)wNFH^05O!eDWuxSi%Z3$^?uR|1a?jg95E z^O-Fk@ftATP2)dgz9#Xng|Dho4V$l&(+$je$zRV83{USRZZ&(kDPwHR@U}vLh3>k) zGO$7oDb)p46&Vir=I^rYQY@ASCx9aUImFi&w?jwOI5q?36yfCO+mNXwnTvA<8QU^0 zvMZYlKUzkQb+XhI0>|@Pez(>%$zI>W^!3kMCn^DwGkJ3ToZ<(FXIa?wlv=$7|`z_I;@tzV(x&dYldfz?mG zh6PZ!Kr=@d|HSDZi5;~&g|PhishBW(cKKVC6cScGQ2+O*8$<-cDvLO>FlqHUTKy>K zfJJ$(ug)ZPVyw+Wkm8^|)Gbl~64dvVxiSoB;Vsa|I5yPTztQS_v^rsuEsr>wq$jLj z#xSh&m)QBuJIw6_Xy8|~uk`h=mYp?4omUdqrDKbu^LkRJGfl5>h^PNINN;DJ?h%Tz z$6DON^h{yW2g{GchXSNE0&{N;WDwOYB8!$%zGo!^;q&#@(*wlB;QCF&IMHQ#@aXt4 zX7A%-C6=B#49QVeBYd{c3`SD=G#`-Pg>|W2zr0WMA6$b}Bqa?S$fYuI&t~4#84KQF zk*Sb=ESW9%zifyRn{kfvA9g?I?w7K%35^ganY<#Ad0H}r8xmC^g}fds;jk_c1Fxkg zyQ}T*KZm?IbF?PUEShZjHt<$qniQoRXEgKK|4+YipbnShG~lyEuDS z)hker4Y0Rptp(h<>-_8RN$G5`qg2-Sw)(u$OgyY;DdTxr*_r&A5ys}d4)MjkC-B^J zg1WmB&8MRaM>>CBlk8PhC`^*UcH`2Qgbx7+9=b*sRzkD-3jvN&uRBnbC6M94#Jak+ zi#%cLFF<(3FxF7v|3soyfYF0nb-d{L&i0k5o`<(hno(B$ENi!Ek1uWMBUGh2k)lG?`l@}1eJPrW{8{JJz5L|~bq3=hV!U*WGD(p6Ij!=fl` z=l$5w+<{IyXPwPEPw;A1JUgJB3S&S_XFMwX`uJ;T@m;cuIPVwTqmP>XTZQfujSv=8 z{3HfP1$_}?sP798@`=#@(%_@eo~#h?qY`z)Sr`VKZ__g+Z|Whe({4Ff*=lXLGvc+c z<>SNtAVsW;xPP#A5C5L*1#ZUQqwZS&URg8ys_M-Z5xD7ur<@pzt-dP* z);lVk`F3L%J3$(A)7Z&X#nc?7#~^0gj1DRk7*S!zdcX>|eL z4E!M5{O8k-5%_ZG-`F`XwK@L<=#-wSU!VzOqQTa)+S zeUsqAtKD8e<>^<`QrT>Fjmi)J!$-#w694?J9%?XLZaA*^du!Jk;k-;*ljJ? zdH?VZiilR<))_>XX^+0ImuD2!@5-Zv5~+J-HU18O_H{DZJm=$=!)E)2v~~4JV&E*^ zt@#Yti>4V4pv;F20ciE33k>o@=%0D^l51Bc*_#iQ-o_dR!NDLd8mPxT*+!a{ML{w=UyVhPYxE zlQ$;2`!|=uwQmLO=);M5bhumYGLV8aY)ih@d1l2*ms0{K%ZgI^Uo9XI(=NgFKDS!? zl~?eGu@i={na5P!TAN*p<)SPc-9DSf*bUJcg)-;7$LFW=$A>%S!cU2lvqJc+ltl3d zaAcAYEX7Bn?R)Nv{fa>8_=#~tm6>n!C4HTeG|HsG{IK+$!HP>HQ1fJG=(UqT(eB&q z7y=F=@LPyu@vrk3AnBhSLBZeiUcQ*P`Dgm=>SPe5ik-KunNrYI_SI1{Yaaf2uX=Rc zgii`PUR#i4G9PAl_$b5xMfbfnulz&B7kgUD%YUKLWK-qFFGL67CkX+LERaQ?Q_Xwe zJd6}_T&!LE%kFR#bkldWWbLp=xoH=*WeS$q?TJ@B2FotVaA5BmJa<|jm~~^l8HKUY zgHpld`HSt>8lfJW2;cl_`n8Vrf z4|c6)k5G69;36~mG7O@P2AM779$(q2@Y#EWr2iR*o*KzE*+v;N9fr6lg`n?I>D_sh zk?!I|$N$Qsz4g#;k$?R@}aLGHm17td=esC zfO-JW{mKqb1z8*81GZ*^uLujpGp9V{`kTycCSq8a7d4ACBTdTcwTWaaC2cw%0g);_ zDm!eSM#1qu$r#GJtxHOt&%l%+48p;(sJps7Bs+#G%=B9i2Z%hrE4G zO>Af}j`{kFQ@lMG z{m^KyH&~sdv;q40D~M5*KpFOy@-%ek=Jt)L2x%5K3zy}m&Jqo{m9!ZxpH3o&i;iC0 zljsU*d`MxGPGv2GM84I-yv>v?qWyx@Vfi~s@n}J6BH)e~L`g7cvqvwq>X(I%C*dGp z$f$Q`D(S=fgX+6$v~+ZLZ^P~P))d*PI^-ivCr$#tvqC&t0k6pQ3eCP#Mx&n-NEh2m zO=7C)^awvu2pn|vu>kVMKz~ExPNeJDNvOxpf#$F~P%(40FP~fZS>(~9l2-^mc^e%} zuC9~P^MTe|V0t{^_5C+dlaGLQkCnC*=^g|7L`GqoU!2}X1=INc?$9QMP$*1QXW1}< z=Vgm;97R7Ck%;m;(33u08<}^iHS4=+1QniSqS|6Dq3H1mj-R%#`D8S^W&R$G zElE=nU#$~?qfU5V^GuuNbtMhk26AwN>1R7O+8?i^EaEPX% zya>hTBA&K@f^#S!#bq|Zz#YgYx@z*diocBPbgA5Riab{_otr?eN=}V;EY~Cg)YQzg> zU!wbt={w0~(yQ$qgUQw2M8_TdcRk!5?}ktEU8u|H0^(nSP|DLuf+35%L!Gw*nJ?WH z1f<2Y?%n-~818o4R36L<7DqwJEoL zq7Nj>`I|Zt(0|IWR#U`_4~(vUy(>#Y+;I*jL*zQ`@?S)6yqaKezWG#o`KFE|4!jUo z1nUlOmSF%Taa8oKQrh3|lt;%8ZV6g;bH?KNqdtHlw=-WuD3cFD;$@R;4Rfpr-oryS za|u;ty_2MN)kX7?*A@F6?bY>5X}V|!qB_C@RLqpZ;%K1}npI(!_HW?R))wChLBw2* zMGi0RPYHZG_<+07#@;zXKw4H7H6`LQmfQz1+V7k5FuA*Wyr+#H!hKuIs=Z}=nrhe8X}R5{AJxCn*7Xp_oTK_^ zDecYF;G;`I_Kf_m*^LX5k0%y)javH8^10r=zkVKu)Z4E8ElLlAJVf`M-K-qG&{ZWQ zwPk-NS2xNIrUDC=*u9_$igR*$3$mt}INvERDB_j+Bl#>bhU>;u@74We^Y^{)nW<6A zo5^!sj1-h$!LeIMC=0Ps%JNM~GGB8{_I^_3CCdwwPNO>82=M}8*;!Bv^+$#+Yf&P zS89AJ7aDRT#`d%_Hx8wat)|W@n9m3UKAYvx0r7!d#-W#5of&CRv0$hC;HMZ4!?{UX zQVu+P)x1aMDEQj7t#|S`k~e_5dI_dTaii z2;7~c&;OZJ4E#Ar1QlM`%Q%}D*ctxw{%V~=3*)VU_Mp|g`Lsw$(+uuBOYuBCO z86@{czVL-1N4FanM0w!&Bzsk5lG0=LLv(g%U&E`<)!@S1BjUFF9JmL0bhB0;89x2Q z{_w$%iIQi}(+y!5y(8zGGlKI0`Suq-hj9kP3{3Q=sEghMtS*KTEHXI3J2iLGsQT95 zKWHU%>ZOBA&79zo5BbI04*BV;K|;91;vsr8qB3$YEG!!RA3sA5QNe|`u+Z<8C6j`i z2E&686^|8&3_RJIoUE}nv7w`` zkcdDJ_5M5FX2Dn+Al0QO{y3O)e}D)0sLQ3b@CY8O+n=7zocz?AHPf9DfmG- zU%H6kE8j2Jiwub)0#owqsEh9SLqH$XRtB=!NtMM}X-+u{G~LiH7dgml64=;j0F0>% zpCyBNDw&IuLLL28oK4gpl}fG)=528I5JnpQIti|TVRF|V+5f(2S*XrpR!+| zzlp#8Vy`xVE&GRJ9ll?eiO3sbXIzWVOZEo21cqA!zVCDADM#F3|Atk|-<3a?R{GU; zV+)AEJx07q4(IX6aCU{nSmdWB1x@)EE;)6xRWx`SpTB)6N1Wh2Yt6NvW#O@ZnZ39Y z7*0{q;}Ji~58#_YjzY;u#Y3acQ z6WUc_w_YkxR}~*6vngGuw=&nzs(D}$jWXk3Rp-Hd?%IR~%7Oodm09 zERaEC5wU9Hzytod^U4;dInV1;|JhuWXV!wvrt=;pcQ4`lf?n9(&xYb%Wj|SORG~qw z&Y1@J6&gTTs%74t*9EtUKUVc8{1p9+r$Sf$xL;;F(@QXc;V@j;(6lG74!&8SemSz^ zo2XQTm{vjrp55|pToptHdPEb+zCiNF8Egk{!inx}4T(--m&QThjKp(s%Mbq$B0xJ+ zc?IxX^~+aT<3UM{eX$wwb!bi`G8t>Umd+-f6c;Ex9VF^=kap@#&#lzq{F4?n3_tyY!>9Qaety@lD$RrW#tEP@LAK}j|Hx)is^?X6!P}!IYL;E z`fBziy#}6It4JYDe(v{T>e}B!ZGS00wf!gF8XQ|aBSuNRiw#Ylp&7~Ch zlvSQ`V-^*D$yg4R|15zim*cD`PG{(dg zW0gKWTc!pB*=ItGr*^X)(vZn&e|HiYpsV^UWv5H83;9_knxk9OwP5} zQFr?J?N(zRM%eKx9nmR0RE={CT_OfEX^b3+{Gj+9z`k~J6R$Nh-)Kk*F%)<)CSN?* z`SI?E0uIXIi9w@mFRE%bm@oJmc$~3uK;-e$1s$D-V%hNJ$v-(+W_-IPBKNpPzHr*c zsgLJ3RyZRZG{0v?#S4bB1P!7U!tu|%+2>7?OtgC}1QByk zaqkK{Zzb-S4SSBD0`h1ILR$q&%n&{`t%LPA7OnH>`#Bya zPyEn$J2Ce9)BA9RkMnnveLo_J=}za$MKC>a-H}G{&WMBM1JnMUho{^QrVp&mp?|F#Z)48}I_j67ZXM}H>@$v(Un_9*ZBaMm&dm^>+gc1y7v z5`RxS?fy7vvn|a_B8;D@&AqVk@SiWoDP)`C^uO@Yh+uOcQoR+^8-Nilky4h321wmR z2VDyy-j>f}Q&Gms5~ z&Rvr8GpZ!jKW+rewt5T3sCz~2KO$qV>l-sGt{qyQZ|UzRWE>J2?{xv-O84W*-lU=< z53AKxVbl-r<)5p`-)Fe1nAou!9*YpmEgxo_|68)1KCvBL8x90|qzZ6DR12S=Z6)r^ z%F&u_K)W7#Y`)L!Im0l$WE%;&W2(9*x;3EdF()rwwMrttr13^GO`CNn_zV3NnuwCS zo3Qj)-L3_gncJ#3Oh^d(tk0my_W{j}c|{H7!N)c;Lc=0Fg@c{!*_sM$d!M9tPEpjX zn(vU*HDD^9@Sk;kaHjZ|PM0^Y;Cy-0NU~S#xzisoDaRQ|Gb5pvOVd1Jr>WKqM1`S;xn-yZcZ$_5LMM8BSZN=GR3A65^{rf@(v3H`_rrh~@; zFQ^xI?lp)C8(h&S-O+Er!K2T3Xl}-=^oEwC-6{$V^a~$mYwPelBO{9~dRsUsBU5Q) zuY0P~`gm^}F*a0OB0S z35N`PnoDgTZzcS9!<+8wu-R1%4}PFxvhYXhC09lJx6}tk>{>IJneB&4p}{da$0oNlE1YCJHZm-GSzX%- zLxd#`_vFbapSjZjHX{evS-(i|#S@*8eI#ps+CFD{trnEb_QwAg(I;A?!lSj`m(098 zj=`_X>Q27SDG=Fg?%u7ecsBINXLm5|TVn&o$*=jWyRu&E5pOF?Mf^?9I0U;nM>l`TE{*o9f=ep%3n~W<^mej)4LMakb$jKjN`_(y=hm z(9`hFqS*20tl}ERR_cZ}lR=xx{_jJ+txaPvGqqy6sP6ZSw933X-V#QJtPqQd-mdSo zV>LyUw7gL?9+J;jc4ulkc?BPXU)F{J9UM*lhOF=Skc^Pp(HJQ_GKhM4xV05@2k>6S zgbw2P&9|e|3NmTvimqev5;viJ>ZfD z0<($Jq2ZySk;P`j&Q!$=){?%$VdEW#r%QR6P|!L{QX9f6D9Fvt_w@2)YirBpWhU~Q z87lml^p74w(-=EC%V2T3MyU4bX(csSW7Rf%HZGU0C6a_s4KZ3L?MIcc(?>e^wjRr- z@YKoV08X(QtfKtz-G^&QIIcHb~o+0`|RNSn$r^&~!Ipd;oR5{h-;(KR< zJq5K4Ro;&^Gdc_tLIkY+g^|d)hQ$Ev0M;aG`KRyAY@;8F`9S7&2ma!h6lC#x8T+T^ zi}k%ZtqTN7IM{pOP?tdubb3;TC?91MT(8*A^>c>|tr@0(h3p(4pqP)OSnErI{2 ziGp6Qt&?CpZZ0I`pkjC-!+@fS4+aT)sM|ZgZ*A@Tad2G?UHMP-U5|i0D@~!8{P2Th zQMm2K3Q&}Orf5Xco?T!hKM+7jz;H*KsJ`LF70spANbR{|r*+dCx%)xwJ;si%h3iu; zFMS5h(lsZU_XYnvW-!!!(9rW91bIDfbtU@p9kNo^35B3u->4et@P6Ib2|C0`{oxP# zaTv>_P(Gh~zEnX!+*#4MgY^m-8MoLfgRTHs|7N)N&~iisj)unaLm=6NuC1V>^$hpQ zP?+f7c`5hd1w;6cT2*L!5PE4p{TdBHyaT{Jt&uJm^w_(2xwfod)fyHWR`7JEK{av};gEKdzNrN>i#2Ef4kLCFX z3B9-vW>RR53`+2&p*?@;yg=q{c$8H<+PsAsJW|9ChDj)B>Xr{Wa6)(87LE%o`|9+@{Oh$w*nh@LilPJVL6 zx*th9f+;)iFr(S4NZXUcCpqfDNO?NBOyNVvCuV;zLOVHA=%uOe?|IK8H0UM9H&i^3p2F^T>6@(4nA z`P^*?2oFciKBc#`H6uhj!?Cc_{MMI1bMW+{{uAi#t8SSB0aUnFes~vLpN&vNdktGs z8W_zU5>|RtT3Y(%IJ@0tTfQ#G=t7q313LiuN}T!x^bqX$ptL>8`*ZjqM$4LYp}HE} zA#eH(-1S7x*>CR?n=E|J!1eLAOf8trhQa2Hl8d;R*Nr_6NK~x3jWOZ-S5j(<&P#kU zkbC%7@deYad*usTiEc0m;{aq>h3-~-iT={uNXS*D_%7=pixjV726#v{07NtkWDv_0 z@07RNsf9O{E{$4Y@+f~x=KqQaKrfk7l*|+bt6*&2A#bhHyMDAW{yEk-J?*Gl(7tq{ zf9y+FB>DO4g_W%fu6*fNK>%I7t@D9|Iq?gb?_+awzf4jlmX7C4y9};J30laFM)z{p z^J<%efE>BgNade}Ey(RM-^n|yKY#7GjQPTHx^9myqcSPUtNQU)vqWIrG#kzPtVPT{ z(A}Bv^P6_EW-{ROCrRvU2OfS82R?&7t~8k+4uQ-s2tMm}o$;r#1wRCl3+b$ML#Za9 ztY19xUIK;X8?0MKrxsoRH)Ch@|t;mDd;)yj;U$BJ?)<_KQgI2ALeMjh*A1gB&+%k z0coxrWIGQ)g)>9ckzbvD|2WqSXicfOmtv*L7+WN{l97oVngluf*Q9&~YxXGKG>SoN zj1~-Ez)in9M!X!T^0Y;TzY|1-Ye3rh?{Nbm%UG9(Q~_pA<}!6sX;w1i@9(g8DId&2 z&r&?np3ntkMC(*8%_{D{$G_;g6+R?A?_XGoU;#a$lKswczrxkN`r97rnYtwr#h!ty zv{y!aG+wQW(EcmHHiD$e*&Gt~jHf|I^-YaLL{M*boFE=*RU}}# z543b)K%mkcj$JzG--Y6hl49^-dkXY?oC>xk?2`D)oW zMY&DqChZJ(-uWA$#fd8d`{Rm;^Q+M)B5=l}J>YWjZf||Tg|vv^JFR=;r7;8gQ{yUu zR4(3eCkpLf-l0`bXyxg|s@;I5c4LVcPWwJrN0Sur@W4^FQ8tuJ z#aWT;EDPL$%@=vh4w?eA+w55 z!@X{klgF!^s9aJ^YhR*f&a*J+bw;eEkjRDt4;jRp?|bAuRYY;A{bP9UZEg?S$pAn< z4f(cjey4of5Dv%)nOzu#RheyYkQ#xq{5hBSv8?XV7?GfJshm+O@%t|i=0&gZ>rHI= z$E#EkA1jH2H${^>sq|=ul>_PFdT|5k-Gr&MJ>i#`lm!35ve*{ z)iaJVp%p3_F%bzND8C8vy2tuuf(*8MTKv0CrY|=V+TEn@a>ZnMzd6W)2-jDA;DpGi zXKDQAO!*1f2}JCIHwbD?^8nEigrVwjgp$8iU3(r6m3xBThxYeFzt+J=KZc7U)VuP^ z5QIlq9a2?B?kA+trK@dz)!$|mxC;gYzx-&k{ z`>DXt*t^Uj+pPCD-RzrrXMn$-vuvFjGbo6O7;fx}A}@%jAk|{m&?=xZd{uO-7nK6F zsmjP)Yzk!qYxF3)v&Lfb#cDz~utUlVf{^U4>wPP}0htxa4kv$f{Sa=$)SAuwA6@bky5usa3D$ zZxp-FT9)vcnAX)$Z@59fdzOkH(B6D_qqEXwdL7Cor9P2o!GgVzq#=6+k>p&8m0ah4 z;KA}Rb9ds+jmg6fWhu(TuF5c-OlcB393^Wa=d8 zXNL9A6^bewV?zXNI|AHiNxGg|QZc0DFqLOFy(7kvn08Uo4qR*KLCGZmJ03v#=F&g( zU)yXdnNRFo~zu?0vgjh6w)tO$U`Nb81-cj;brq&HaeJ~KJSY6|!REZF1 zqp$tRS@cR-wO<}hYA|qC6w>8G4TblI>$3**6HXqF@zs-c_g{tDnMiKZinC4Tuye1V z0(s=yNcf@RN+-_}69x&%@1g|;svn!AQ9NlB9bes)6sd-Koz;;QMvVug_sQIXOPdKq&4~3V}H!8F9?1uZD=2f|AAOq^HG3dA> zm*>X#P;GQd^1&^NQT>$8pHG2l}l> zjnlhlJ}bE4lxB;&u|a3t;v*g3R|W2jU1bxf0@$)b5p65H@QcUh3p2lM7$EgUIN7NJ zCV$$NR~M#H+YghHtZz7d<}XObeW;J!wR4u%OuYY7RB$7*ASZ+onmNS&EEX6B9GnW5 zmzZKlKB}U81kyE76;uFu^j$2FN#-1?CJjk-(tOSZQ!eJinw~vu+8PUZv`@Rap?e&S z?DqtvJvRrDfTf2Wq)}Lj>A?qFhlo1xE?<$2$5q_s*O_+&bc5Cg0R{BwBlLE(r{4lV z3ND&Xe>0?@+QxOx>fLrQcy5z?$)E}I(~-AHr_II%_bm{3rQ&5HG}E08OaZ=&KH|Gr$S4>aRMP7TQF})9%nnmc!o1u^ zSRm8ixwU%n;lX7z<;a<4P;}LavySvHM7Q#vnEsLymx(_Pij}(78R?nOF?v>rW6=u) zR8J>JkS*&2FU^?k!h*_0#SI#U`a;bV>aglx>m*>CI+~72fg%S5AyEaakH=(!WSI^- zL4^f17ayd=EHk=+f90$5HJBK)P@P<#5_R+>UDnTmAKIQ}VALAlZJ6sfNulY%QkC*; z-d=9|>*M2kL-n^AT4RnwOH=)GiJ^|x@6N`Pn51(6gF38PIvpV1*SE$j3PYdn2~E#N z$j1pR`pai`T@abl>5zmXjCKW-ph0)64nv++Hthdx{q9{sLD4-^XsjW_KnF?Uf5D?s zCKYw17(a8pFj`;0YVYMgalK%AwL*TW(SK_Ti+IWp3!?SPo{GA1N}fC-cyT>`(8j(>*B({1-T7@QndJAY=sB z(l^e76AT})(_M`&zW-%kc*)N#F*8@jWpn&;j$dJ5&ipX#@Pf#(rCh^TgiOn2yIXQb z;|x)ilvm38m_APR1S4 z%?@2qpm<+gzPj4r*4{47#6{P22nz#V!Oy3XzZ&Hi>#Ddo*AJ2O%8U8K7H}-8D13M~ zrom(++Fc_4@981C# z6taef<ndSY;hRzDnz2t)6un$J7~XI7n#%vVf&R_#lkLW_47t4>tE4LNbk z?M2nopDtQ0iO#Hv4mpEz++16jGvTwrvs<@pWRTtE&^4D3i$mkj&&l!M^6h_HXcVp0 zuazNu2vFgc(7*3on4<%=+>=Sboy?#isg`kvvK&Ep^?Rh};~*xPvEM!~qJgwyE`_Mh z>N*#l&s&;X=|(Nb+xTeR66#adDOV3)Y5R z_S7e!Ie|#Iv-0gilMQmn>yf6r#?dY7KIKqKfoG(}<<4AD z;cXt6LHQ&O@Z+ha5$p3)uMYWha?+~nLMXI6QYxs==d)GdQse{tVVmHFd+$QvYv(Uz z5z57&leLt{wpCHq=A)G9faGV@N>qJy_gwPU6bXT7#V)XXC+ZQzaD_eh%JwO>?oHu? z3JpTn*{?cFvX5^u?txcxqRrQM=4gVcmkK|V99jno8ctE)pd7+GA^6-C5xyEe`*do@ z{E7A7L?Yi3iJ7Qyw9br3<)H?4}L5SJ=<=u z{&90>8I$Sge!@(ByB+)kq6B&K63K|4#u{TBa>MFIcnpUY<$x~RYW~F8iUdF%BgRGl z23^ecb$V6F^Io!FM~0gmcJ7tz-XeE6y!@1Vm0Le^qn8>@tf}_2{%2xuF4^}Vl9@rX z8uCse8MFP3FlZ?j=&!TZ>_>BQzW&MF%00?fthtZ&jcnPkk>Mt%oVxxyyK}X++rgvi zm?A5uI7T;xGgo{kFhcFnTLY7ujK1jrEdlb58{&cS2YZk3MO8XJnqS3fo2_{uq0q9$6Ofl^Xkczn2g*jM!R7Ntt1jmhptc!gHO51>)B4hj z8+G+~(+>vGyuWz$6W7xe@WzmNtJwv(xV5o|0ark1QKho_OBkltZZzkc(@1h`vxq|!hmM&)6g?{U4>BCL~C0RO#w|jJ52t zTslfI{UxA_`Fz*BGyA}mk&+t~t_q0H%xRH)?CS~V(}u!ykISmu?6}}5>a7i~(n+k~ zXU`@kW&$F*<;5TmX_~e0nlMbcVBo$OYDU%dqyh50$H z`n&H5Ocqq`O!LD1{rNGu@7ULi4yZtR$0>A>ak7QN_=6UoYaR<7L_k2j<4%)r=*VX( z@HVf<&5(tl?S^79+LGmB!J>ENDUQv8p;`%}mm8jS)beO;YA@5$HirF2pdK%LW7Qwb z8!jk8`)Kyw$A(sK{F1cY&T1(nfv_Ih0xrq*DuwSrPX1|=0vi5Y{304Lg$Ccj=COj$ zq4??HiKX_)E0g3--_PEGUeD}sbR#w|C;h(w1qIs#G)x2p!Kyp68NPcif!Bw%+}+{E zIAx|ei?qN#bqu9N>)D5*N7X*fC(o?8FAS-#Jc_=bnC?_oPQjbMyD+}4&(6j1YP~~J zWQh65)g2x)eP?^c1$S8UZ_xVlo|ojZz6-bjf9V2&M6I55{}k#0Tf=3JFDjUI9rtk; zzp8t|7uc4$!b<1t`r=e2DYFLa-LfEkrGzflKTqX^F*rvK(n;u+C1Rotfqm-sB z0XN61nKgWx>k6NfhIfXGE+d1=aXhpW7{B}RsYx!KTy7QIG%ntT3vy}duWM*t3#OsJ zmht`FJz;qo7djn_a!LQ{GCLTw7Pyt zEGt^9dy^rAmlO87*zP|0>hpuE-;UH(x4N6&&GlHkh#b;-?E$tu4}*G$AquT_xu~*Xf4rigu@N6< zCWkp1LeMK1ix0B~3om0Zp-M$)SQX8m4fU->`G@n3rn9MkhK&KT6c78mg!e!RD|{Jy z7lL1RJNnkwa~=Bzm3UQj2B>HQy$=d~1?SZSy}7LXe_sSSUiX#JEr;;n&k}c#2|(Mz zpRuKhcf{o=3gwomk9TYsQ$Klr`N8o@rE5&`Y|a>5)^9o1lx%@U+?5m*pX|D<&*aAQ!6Y%X5giQi0yAF{n2 zA7D|)zW>t*+uCXkMt+6|w-QY32uvP~=!QD@uH2hoj6ZoV9*%nI!LCB6uWN#Kg;Pea zi$aRO2Xq6Z_ac_Blh&>lx{CKef62fG=Yxm8HC?a7j6dT*oL74MCmMe}Q}vT26W_3NbdE!3!uT6bQGQbj5rG#rpsC;%XjsA=Hc%atdjZ5zIh#=(%{((hbk& z%GL{^$a%EnFVUoYIhdvB9U61m8l-{5h8ALp-;{|l`(uktwjj)C(1(T51@jU4`>a_w zGk@2+S>G-?8^9behuJysR5i88P>qbwv_#r?C4)8EvJ;7IVw7I8Q2zcVb0<${hUVqZ znCK-Ei0=|e+64oFz~`lfy@;71R7Jgs&|!?c?kSVe+hxikEC{4MlNfVEtaHCj@XkHx1Cfel7Fggaik8VAjX!iU2+mjNLJMtRo($PRN-i#5CT4XUb!4IFjqt`j zS@NAJYGkXr$#5>^<>(=#mA2L{LURvipdREw)D?6#Mcs3^qE?Zp2^BgJfr-y{$ho{JlU3u!SDorX~ zU~noG-tv5&r@kl8S>?0A=o(FMEXj9JDRaJXcVbp{He=}OL~L;ZaseD|+=Y$NU1&8j z&p;P~qo8k~OZGv0(mTYlN7IiXb()EK{=)a<>3KtXl^)R2`ZPW-2%smCglxy}O1@B= z-EBv`hK`@j)k}P72Q(y5NsH{rDTtS^%$Wv(qwhj^(&A$8-~T3W_p0NhUnIdAD?slB zeb8d2n^iOL#CM0kceGA9q2idfLcfn$@fF1n5YL=OMZ_Gviefho{gd$pdB3?r1mvkTy1&z|!iTM& z??pqQFV6FK&*^_4-o^0n#MIHUA^H_AoI}V~)iHB{shTGQ`W6l1k9u?*WTeR83p-jF zBn*k*_l!Ahm5(~{TaY2;5^>ZvLVP}zB*du*i#fI$VV;=J>4t`DTy2`^lEmw!h?lMbzOYhQuiOJV<&|UXPhlzJWx)nad3IuW(%+gmP0nZxEB}b?LC`afa!w-lS^?C*_(t+Vc@hLc? zbjWjLDdeo(Um$FBGv=Zyjx)DL2!q?D!K02F-Hvw zcryLkdjr}F_^q(vXz&q>rzu*sdPqO+O|$mIIN)AfHc2sd?xqpmN&x z7_`)}Pxhz=Qtq-7B%hnFS$-75n1B93XB&e3DYt@cQ{+FyA<$afmx{l7d`YYukZ>9$ zdqME}T}Km`K|F+BUY(eE6h6U7)y{SHOWidc6h$HME!BrU-E#klHDzZ41tg(G&lkSn z(IF7-=9|PptKs-WoRaD=*P=>aOq%*7j>&-w@w_~X235gXhxt+-UFDCvNex`&E02b- zlm)*|tNWO#EO;dtw(SI8vc3cPsoQN3TL3O?$sOT&g?4s}3*4IfTVd-8tRx(Y zVZHcXgmShxBE&S*66Ms|m+Zt85xHQ!tQ8U(CX={=W!J-~96hcU6o>CtM>@Wrjw{bB z>G(pV%ubnTabMK;>mI9yX3nuEUXEX#MTyK zr4Q*jVM{`gh39cGhw_y;AxDp4Lqrkc$(TDC>A@USS{D@IH1~p$HJ1nPDLJ&>KTJV1 z1WC=Ws5G7M-u!-M*58o4X383vvooGJ-TyfL?MFCn`L~ZCdZzE-0nY7jGLGt&Lc(`+ zLdkH54mu+9k`{0ke;#X5jbW7`{!Vj#D(V$3MUbqynAp3qe4P+Cf7RK?b82zrpS@lm zSonR}9wa>2$B{csSnWFJ9h1qqMq>bEGh>|8C`QlTBFMa zV?O*bwI5gc7;NzMDBETufhFHll&d3WxE`ATPp4!bpT_GVN7IQ8ZoK>D^bZL%bMYRoDbZE1yigP+fybRE z9QUFq-~zG!RwOH zG~1;IxzmGaWk=V$MDHq;6jQ&Y?Z44v!tzS*^rKPW+4=G)$8>63j!MFTmA8kD`)0{CGOhcdJl)d9B9o-N53Wk(MFF`a7SBR zQCZ32nWj(pE89w{sM!Pe)2BsL=0Av`YIgP4I{gQjBi@D}1#eQRHZKa7XID|3c#=r+Kgy?x zM%L<&!SL`WM(lURoyN#snPj7Ug;A(g-HN55a~4t@6X zRi(Usz!Nb+BBbj73Q)<%%&V{C=lb*moAj9NodFzZr&3-pn@-fe4kv)mBLEEv-tPN_WHp~Ya`F6k$UUJN zv1k0Z;{RhL1<7koZP@-{^!I-z)*$-lh;FZQ^&Ba*)b4wYyXq&(T8Y2ZFy#9`Gmm`;-$U-yDG9h5`8PN{{~BZu`11c(1_U$* z|Nd(AEzkeVsDBN3|F=)!kZIgS;PLL_;?C+#0j z@gr_|XSKd+{t*s(_)NR~Kh+YkQ>7=NpufS?a5>PEtzz4O6&q>KxLYr~a}vWWzJjY) z+^ZG0Jy%eJ!bY~sz#pYQJ9~YrqD_rh04@sMZA4rYAiCYWfch?FBBPB7W~R9QcsmJ< z%GAx}Fqmb{HuS;7Et4?-3hD_8?FNQFF~9BnJ_o0BJoavdV-HoEljp@5yBeZdAM46* z2`xuvsE|H)|I^-6Uub-Ozd%Fm_gn)H^S}#t-*sl6h`@ggo>85uWb8kp{nFE3Utjnp zY{fpcLjbaE(&<$@RP@zpCm8dOEveM^yR9{gjGK>~7cWIPF$tKh9pZFw~IR%$!`B!{COfVCq!gr@p5YB6uGJc z$(jv5`46FYNcMSUbuC1i9g-tZ-AK{(tWi|+%!eJ2>V1ZkcoZsgx zk@M>nAD53n4w(DGrP*ANhCk@(oLZKi*VnikSnI>T&BEnOL1r`c$ucd;GUW})wd&yV z0Er{yIIg9l$tPJQj71zW`odZ?;4J>eaIR^3KHrhMtHOU-eC3lBUCQ!2z1BFqSu)Ty zwKKoH6Mx{|LN-~8S|hyoBg$^(kO@ zTN1Eo+^Pg$U`yE~CoUBIJ$*z7AxeInflNJOjNQEdG@9Aq)0;qCj!IyFI9bn+}!3EXZ>H%Pg z>gF-~gvP{L@Mz0;hKxPSK$wGj_Grr&DRT~pDGB~OL9}lt`o6|!>L1)iyRwR#rBD#Q z@yhzCWsz$7nZ~*}HU?xI@yD8{+`M`qg&K&rh4QRfL1UH|J_Q&ejs9NE;sO9MKoGtQ zCILiNl5II?=m9nDF0&-Ojx4(9Qm?wch*qgT8;q z$N}sXLFn}!2g{Aip%u$+-IYP>+YHUcIlgqx z`?hxOG6&BOz8|EQsyYqrdIg?y$o4GcR(jSoJ{l4~j00sJ%^8$L6?_7gBnkBTE0#fd zEa(aG@j}7dXP4hBr?+IIGVbjC4*Plo%W$c_Ga@kyF+s!7%c545h*N58a?5xzy3)P$ z!S-`l6vzPZI&(> z?s>|C3gd#V$)yEMBQs)<(Uqb<0a_Pn0d4A?Xdrmp8m`v9Cin`LtolicDC2z$@-Tmz zP*=zVchKM?QaA!|*yi842a(tgP(PmCA%ES_(nkvI$7n^mn>zsGnWJC@R9);XKXJ;Z^0SbVinTvfkPo~=au=EncEkP+~}LE}Le_u$gLE%$@> z$e@VX)WG5g0mWz+E<50&->~3sB2xIrMJxJwJz)ufj-71)_rONEy9i5 z@^`R!DMK#GBIq5-kkI|UtfY5YxN6s?IM@+Yps+ z!wTVTrNF)ys&=ZnW|woxj!g~3Qf=t59AMsO_dm`?(M=CJqt<>*uhCh&-^UtE>!7@@ zrKeY(1%kzF?bqk!K@rFK*UZw}uwI$m50mkW8dZ=<7fdoJ?PxBWnF7Fpz)|`LD)_qB zeHqlB@Jk3n>-xVBLqS&X4H)UVOV7u^F>u)>qu=yg19|n_MKwNvxAG1NfJX~or;XO# zf8)`la7=fUbh`vnnJIwP40oK=)zwXYnsFGNSan_jX8&PO6}iOw4$y`zpk*hR0!}|s z^vJgA!N-%OvWaQj*6;t(^Y#fr;;l9M!>xq3#E>{x3sUkqEDpf9>Xvab5*@LQs=j&~ zps!$mKA3f`DzM$mFAX3WC?W)&&o%VkJrfDDDVxtskrav>Jp0#1E1HbvN4Z;s%%Gv= zwzzFLQYUDm@834SE~GyTG`WB)$Y*3)CW(&0yoBy#V0{8B*$B8AGlL^V$sp2zfAs@PE>Jh%Cg$( z9W;icrS`)!)J^d~&G?}}+B+H_sy{zlp^;ti@AHQP_jg`ihN*IQ>+;?G)G6A9qJL7T zgC5&YS)5xjhL6Z*0wF-35BUD54tDwUql>?N(>d=HX*7B^4dR$cEO}8S&Y=Fq*FfLb zPiJ4(--d8bPA(DWBH`mPPXs0n8JXwa`+4V$ga6{t9e7lk-5Us{sWM|DI;7fiz3Q}ls2QE<@uC_W%`{hogZj<N6`sHVE&qKyrEix>=P%I*ZSn7rV<&InbxH3S#OK5@pozqR7; z;C^S|v4fkCD1-?AKJn~wtj`XASvJG3`UPqHdp<7D@0OKhhI!jwt(6{XR#eDdBtvdT zmE0i{%=LwQ?$Z>UXXnro1V9JL$5O$mu}J+NY?o8OMi2PU2jWd$<{y1pzqTa|{`i&GIR)L4gy2_-U#yTjS>($j7 z54N)9;Ht$0e~DyMV-1TpIY05@M__FK!?fn5$kKeOotBEvQ;d7u#y=bJ&Ykx(pubD8 zF5h2`J2Q`KDxcgu%vfy!Ikqgc3i)*eoonv4P=!tTEqo%}r{uBuDK`Wml)u92FF`gIKXckW3G`ZR}#g>lpwy|@{;s%{*_2(X@&1FL1>3wX;w zlH>3Fp_-%lOdU9nYRj!w62+0{dV@WU7+%P>bii$&xjd&LgoH1z=8b+G!gBz=q;fZ? zTzbuoVTrVakf*R94O~i1#-LXnL&MHZOv{#!u_hn@d8dP>%b(LJ9 zH6J}#vR?*s0)K`|Pw$>vdJdX@ETV){-{e=R5<_ETtCws~Ly+Q^leqUT^OvHmTHXex z2;bZ#9BO*O67uY3K++aA`QyCwR_}xdqc%q+nF`*nn<1BUlR@s}*x_rdAW1a<eW&SxvnDL-o6FF9^tTa8#9@GI`ZbqBH3ks$Y1h||3ha0&KiZVm{( zxq^t5w5+W%tpk^21q2Yu)~vnjy1v%Ld%V2qe`ln{Jz|3*0#n@g3s&MsgWT74!X5!m zLT-8r{E*anM38IZwF$`cud52OsSm|C+~Cm{FnfP>rea5?t>RS_D8mJS$(ipi4WB={ z8*7Yciz44xS;R^sqZ>-Rz4b(l>r>j-Wv;J3i&yR!((oO)$V(OQUT8I7ncn`f!5*@` z@~I?6F6;|veK6v(ZO#v~86_k&E{X>QNE|ADT9&6Hmu2)$M}n@8blWW+4s~!Pyg%uY zO(%gmqVKuD$$sCw8hN%q>6h;;F%YJ~RFJtW4x|9m|CNgM;jw-|I40C9UUutr$|+)dooR6m>#&wE&U@00v4T5cFjN zb_pU;@wu^hB>ERgw^FSwVz2!8Xj4p^G5(*bAil0H=^!CU#oeVvonKmzu{D$gB*0Tu z-{yFe1)D<$>O%PB?2LSVF5gKknL_-qfCPcBYQ3YRrT7%y`eH~N~y^AaW@FKTJZl3^*8wUqE2 zeV;abafsrMLL5S%16|$M)D18jr31jDIEYb?X&7E@6j~|04Xp*_!Fs@ zEz6f4shezh={f#781xpK&=Z?*nmNvjy121<8hBB81m-xnX#a`csksdOEj5UK5yDuv z78wBO$Uqmcs|t`IgG?nGH@CW^NIsJBcDh_!IW2QN4Z^OS*3|EB&g>h}K#W*7E(aCv zG0U+7zE3!i6S?cwA3&VvAahOMBz&V z4Lj!v0U(Hpb5ER_>s}W`soIu@R0wkVDFB7`tU%Poc`rx-SlnsL?fG^$VZgyR3CYAX zc{PMT8EN=%z8>FmX}(HopMB>f*La2w9(=GD*P1*e)4#+F+&`rwWiKp0Q18T#2|=LP zglL5XM2_){9`st48XQFO+1}end0wudRRrn1AO`R->rZ@qHDRD4Y`sA=0{}|4p^|v#bv*eN)3CkgRwTpY;KXkIkN56`0YP}oPADrxzw5PEMP)gPk<~2HB}|>-`Z@|0h=F8;9s0s#$p~i7eQaqEB6+aW zBq{_UbnWhOo)7~fi8xJGmlUwyVLdBj$dIm^ z3_1cAUBHrjKrzVdB&6kR@n!wg%Qf6P4bkto=cNHugh6z?mGnc1Nm8CP0IIEUk&Pr{ z9$vG2(O|teH6-kXQl!zD zHk3ji4XGvDHJ2sRx!J@MQuS$$YJIe5TzmJQ-% z&bgNON*#&J<`($tyPs_+3vv6Z@v3()n!ly^mKxiCh&eAYQ$YCYRjr{i6(%nJFJulZ zB0%eIdwBi$6TRJGqTZWd1EHhEQdru8ou<>JXCIMEr|I0NU4=bx zkIsJdI$3w&0e})8HrEw*HaAsnKM`pSE7Dhlme#8h`E++rXg~Kd^WW$F;WONVdvd#b z*efJW0iK{S`#E|XcYu*$h0r3Ew|+omM}cdhtOE?~T!`N>05)$fcK_@ay`COo?0J7* z&Uk|xGE@J0=PH_i&b3d*ZoUm--W2A&00ky*ASz)+9Ma%pxTAt3!+K>OzcdV^q6*OR z5s5(h(N6ij%+q9k%IiaB3f%ZzzfCB;mn1+ zz6GauSNsx;816tnW*b0n5&w$gwF{q+Bc<8fyi3r5EbIP>*S#cliBdQGYbi*J7B;xp z_#8mB)pweW^!NM>f~%QlfBKY>(TX^r^$7mca<$eAM1ub@YVehJ4fz;PeN2ekBAQTe;@p!@j`4a!~`CUNSiIU zy=K%)FDR8v9p|ggI_swWGHn6je8Y2R8@1KSFGi2QOEj?;8C?JFDCTDyQ%-^ty{Y-T zMOw!dtUxsx2nFxgGE&qG_DLh+eftb?y~g`BMINL-*N`{f%ZHV_Vm=E$FJy22mWXmI zZLYz9>wu^UCu&~cZXMO7H}V4W+fhJPdE0C`x5Cf&q2t` zyB?(F0x;reB0}&|NHu=y>NVXiwl$!;515O4`&wFeE9OrbR~EH5&4nawwE)DjDe0S0 zmCZI=WevK<&zsA1Uv{;V3m&~_z<#;Y({&=EeO4rt>piKoy@XqWO@xk`E?5%K0M0eI zd(83&0z!B0r4+JKhy@Fa&LS7_<6(B`5;LB?E4X|VOc!!t3*dJT;g@^T5W4!hXyt z!C9_&-k-F-r%dDJJvqRW^@K^Yny*y^LSKga(C4O9yaQ?ZvselWML8)+?&DLWSiRYodKyz=lkHgMgC-eTLCDWT42!*|_YT@qtvma{42rP%UR>Tn_7B~xt#jii&ibfXHI+BuNB8))6XjhB(!j&VsrR?oX|5P$;n#&2;^;oDL-^OW z!`;^UeGMhR|6i;#Y97f}!!0r0hrdvnm=#>o_DPphLZSm*G4Fj7SzJxzUgmoCem}^R z=v6x$Qo<@65SH^NFQ;+*MqpN05KLtG%9=j(zu8m-57H0E3snyKmfd&% z;v!;P_o3)CjTJ~fu{eEPH5tg^V`y&H{V6^}`l(c|;XqTc>{UK!F1tJhn8f^Z=E~5U zRxJ{y#oVI`GoQVO{7pR4jx;nPvAAb0;_jV5dX?EBv|p-O;9~tD_`Bk&zPJkqhx^i& zNs0!h&7Sj@mGwAQ<_)7pCLC8}r}3r*9&NT2S?J0A6OBLX za()#V-BZ^XWQG5#WI8g#26)wW4h3Fn+iyC4CtV@Xa{XK)8s##c3FNe*Yr%GzBjkzP zOjgGVF?kw~Oa-NlLdq&lH(I|d+BYth;=?JxI&^uzVpSd@o^fTRGdO}b<)^@_E4Wm1ZH2;>jm5eOPD8kVd-PpFZ(hT|g8fdzM2(xFA z`>EL%y#N$U#K*wnpg`(}tL7z}#twgwHA0=Krlu*TI9=Zuln~u^vkW@n5LH|6tL!23 z#fTVB(kIM|@&O=snoSI@k6|bu{e#L~0tmuB?PFXAQHn6tzuuf?`^I~KnS_YVWo;hA>6Qx&bGhdHak z1n|QjGQAI1Cm9a&ZB17e)y4#kq){>n(VstnyAXByc|0}-!qQoc#=l;}i1yxd8)6e9 zF!}}`29kM2ec|kD9Q2q}#V>?fE6Vd*oDV9Fd51XVDp@OE<4G+NS@j7wr8=?I)^&#j z53I`A#fCpAB!M%8n32p;Cf3pg)s!-u?ZAd-FX*&TkpbqaI1)7uozyrKe&-z)OTO0`%mNWj5zn%XEbmtE`jDM*J?f))xeyZ2 z9S0NIDcapX#QzIpU}Th%^j|hn;NYJ-)i;xf&>;T=$G=hDAoSrJFR=E2CzO8g2g^Ye z-jbo8`0_v!@1Xo2z!@Sji}Gn5$$PFQ7AlJrh=uEs$c3MfyRGiq$HH#YTY`}4lwZ30 zVIVk93RnF@zEf2TSj%B+sMpOk*Qq<<%|=SqBpz>R`fl|36}!wU1`)U-R~eN(Ya0)! z3MXC7fDbu<@jb7s;V?JByYZc+5h%ia%#vb==TaT z$RNII^Wpn}u!f-X$(~HpicZp2@~zl^^Nq6l(~;* zqR|tzRizL9^tPX=+O&n4N^DHoKV%30LQXH>{TvaHC3-DjL*g%Tp$21Q$K|&sT_A31 z|APOWq?sn|1nj(M6T#fm?F5bqppO>IZ)_f18;`VYOaN6&P-j(OaUFsTz?6Hlsr*P= z*oWVfHYJ{QzBTz|{3YkWDZ5GKiHO#jIfx9z3b>F+03C*)SRXLVw**(B6h(&>>OTWO(svha&{4l|5bZZNVf<@-lbcp2~kc<*LyQJ}}l+?&bT~l}ik{^NR53^#eBR z-5n*J=aV*t)dUl7OzyHN*I;wK!=0Da*bB4*cnl{|%6_j4wxqCw+1E+q1jSa3y33Uj z5m<2VR%nv?35S{qvLqZ~S6YNSF0~8p2(?afA8*1g z&7d`zuq0cGwBoK{4ohs-y>FIRbq*gPthU;*wV6g94DJz6U_HXh4Q(glcVr17LE!Id z2U;YeyI#zm*l$+qhFqyeZSq6@Cj~WJe$Hi@0Ga z*v8W7-IoWisjuV}4CJ&gLpmLFU3~28U24=Fn&dJn4bA%!72&}*vl|QHAMj&i@eSe) z3}DDzhv}wSubh12p>}o4ReAJ>^i`A|mFSX}j4o^YSQ z$Ha+M=!=^*5D2v0IOSlScnyYBoP02D%OQOLhBeO=@y&v=HefRhcv4PF0bjw$?W6Zg z4DNkt8TTQl&YW~6tR9KT`^})qde1;p{62)<6T-rS@m;{#lQ%1e+BMF;vvKvN1ls#O z-h)ncDUfD(P$vI$l8ntpoD(;^JyhcL*x8y`K3+w-blAe&2rk)kaQ-}S3AQNt#;{8K z=01SUOM0rBiDZ4!O}P^6G%DHg1f#V>Qt$Ty1_2^Q87M!A9Qnd2;O`AQK^fjK|X2UVGAgSZ`NMFdKxxi7x^=b2y8f`~#wg}ZNpx(Wd zDYZUz>BNP*;h` ziV54z^Dbr}3)qU1j!zr-ZpSPcf#(}53Bbkp47h`gql^lI1(Y*_&?wRGTk}AoneId&gN0Aa@@p$#F_FbqWT{8@@ z?J9lY&cOuJVDqv4G0U3cDcTgG5my@;78v}XXafiuJA<1Dr;4(5MlgQ925m@>jnvtX30EHo?Hvrau>WOy-9YZ>B#y$%dWjDy1We;?If?QDF67T& z&N2+irxu%j%XWOo1?fv#Bg<%rptHz5c)rJWagOsX1X+?ACjxC-S6-ai#OF2SfH_OLZPu9v zSkNMhIyHW`shWtc6t@2ez9uTQYh%s-!A31)TJ**qU0}NNQmduxH?wlwY=}dha;KzL zs=NWSS9!IL=0oJfP@gAsc3xJrMk)1PH{Z_>PyAYq4lIxXE@opqSQiwZ^y;PfzzxYX zVQewov|G%LfK;mVU6gPb)we##3q1mb#SrFPnaAJ%q*3(2h@?a7nJ^Gj6Xk1sK9S{s z9|*Yvf$x8Zv|7CPm%LjJCMp7-ReZk&jNFwLPyif~e`302sB??4I&p!*(T=NRrI=oR$oAt^c9;QL3)W~`Y5GL^w|53e1o9WL`S<4dXv*AgH^sor zcT-9BauH&Fd41A~wDbRGYnMHpooYE=!UO5YPL>o9N7pgnTeK;**wcjk|)Ox#tJ#eO}!FJCX8J7c#P~?dg{TmdVU`9qOk1{6eNq*h% zXj1tZpO#yvz1ZCKb5&KTqYuoMp#ip&Z~0s{yD72tpwow@N%07Y#}zJY%x#=7U*l$j zsenvYKOhX}5{#W%JkAB11Tfy?W&2bbqGUnA{QY=e*JV}k8>@?L!f9+SXch@q>D|M! zWB`^)LvaXdbX0_`Hp1B{PO}d=C%Ynp$K<|9p34D~Z|C?W6B-DX}T- zof@J_{584dHp={lSFq`6vEY{OeFusA__@D(<&O53JCl@iG7`(bM!}MUgZJB7m|u-7 zNjN<4A!zYp^$O5(?XG?X(@rYo3=C#--CbYggH!>A*D%imtu#>mBy&#g=4qa-LA%zY z11atwcc8IyI;j3)@3^wo+fD2wO`Q%tWKH@FVl!w@Etao1Keb`+N{@RXgNJvQIc-v|aBbgc zBI+{=ZS#(2AB!n=n`61IWhvxO^wP~{WKoJRrZPI}k018>AHVB*$*Fr^v+iCR zwdajz%fp5qd|^lh*XP#e3GxFicwn$`szG}fBmXxX%A;((_Akb2#Wv6t)~;Wb1lDG- z#2Uc>a;ZTH9k3BOvvFcJl2oh0G7l_P#@Q;m9AcOgk9zg&0ao2SG$iR56O8}JxLfE` z->5HBOeDVeuh~J@DcE0@0d%-~{lPYk4Jrfg4YsWx{g8X)*Np`d!P$#H+2Hn`Xr)k_ zFDSy{6Du9{d8E+9{^Mnv$)BKumt1dz43u6~jNk%+mDxjIuU8Kaa2&cnw}}nQ7}d4D zo%Ig!Ki~19cZ0MA8;!zyMjWfFC)`RgS#3e)Cbs_S`b)YE9`+1QS+gYO0;V2?MnZu@v@ zh^~F%F63!FL%>539)c?sICTk^V|`d#{n!pq``ms`|0&Epmw~7UWh+wq3B9JF*0@G- zK*Z~J$sRLNT)&Pp@M8d!yD0vX2;bj&fo4&Hc!H9wh+M?1ArtpoT-SmT<;m>^`jnR| zslqZI!P$?0gR&bXjwu|GvEC39!7j%Wq<0JG3!&eKKAI+cvj08Ftk=h4j+C2{E#FjV z2p=!pig|dmUGd>U2-hE*No}v3aCX1P1!ZuG&^VU?co|xNW>RkL7_~yv6bTc_u2xjC zU?LEGTsQ)y zcDW62dDhQTcz((kxxNJ&#U4lf7bH2?G9XlstCyE0L=7%*m3uz#A(zb*tq|v!3iB+xP!jZ)VNIo!H=9p}|szV&hi~v0=>9b|U(Z`YO75 zJ{QGT7Atp8>)uy0Q?AOKgrn3_rxZuux#RQ4owfmRK%SP|C>_bcQvflax6KYu;QLWtn`i+%k7-Zv+WHr+A1Dr5r{ ztR^h1=jbrbY9qH$s^21h^Zb6KjB7aP71SaSCl71SI1r`{o$in4jTN9+`tERu&;5uw z1ea1m7ccH*9A20F-IKX@Ml|Pvp)t=xk$CWh93r10>;{OIt-7oKLvRkIy9KMRl8cUt z7TNC381qJpMN~#V~^TxM~w;fsX;HSocMFMEpqtr;3t3O#5+#V+vHRjq++rFYFS)9x) zAA-C8?EHOhwj#!2!*#}N8ho3GnULybAwr-#jHxJuCTFoPXX#nI?CYfx85bNU0&Dy) zR7ciO7MMfuDhH>KZ{ioKmZGfFt=j1!ZFmyT(%L`HNIsFJ zsCE4Ua^AWbAb^}_r%wQY|um`kUp^SVq{HX$hg|JAU;#c8s!;-mz)6 z&7SE&o)lh�qLW4RC?|H0yL}9Cxtr#}_hF@|b=#B$hi&&~`YFH9pY7eYldfa7K&7 z2Zgf#%36mADFa&?0$$~?^fC^KL4}JCR%{%D^zQ?`X1_ff+kRxYike(6J$V@lYS!#c zcZ)lye9sT&a4Jr=S+_b{Y1Qv_Ogu%H4Df-HtL+lBFBbao`Q7wTVI1+MXIfo|gbBB8 znHia#GvB$RvN*4vaN{3aCIo$QT&S=gUuoZIdZ!_6Yy?NjQf|PhQRbJvGBfFX-&6R7 z&eJL(AzEJ&et*e>^ZZct#B#g*^4?9%-*%DNeBQfb|C#C`oBen&38$g%G%{hM^u0M+ z9vU2x4ICxAOD+i^nWzcPI6YnHhb$Vv-3n)E_O52zZMtbcZew+2qZvy@g&QEIX4sG} zJ6HkEDY7GNZ+L#9yTi!JaIBX}0k10}TguB!ckbk4=rs-xppe?yqH<}InN~peyr+>< zxbd=A{0S*{cw!%vwhI`=3mVw$Ge{C2v3pb{M3k8XInt3w9Gt(;2)Jz3JP*QoHWe`+b7=>k?kUC%od~~v_n%lWFd%WTPujUcF_5;~2Sf;7KUG*pF96_DOR z6zKv=C@NhN1gYV-{tM6RXJ75?+1^zYU0RUtYL+-dH9CKJsw zz^#EkGAPy6`Lk&$?ybQWR$9S>o>AMs3-n~nnXi4cU{X%=t3u=mG!#fP$nW2KJ_XOw~=YDQKBi4>l>4(?wQF4uos^c=O`N% zLP7(FEaFSjnov~IuFHf^lNwbSQNgfU{5EDl#T=*N@Ten=5m0r=NiV(sm>K%Z_(39M zuRxX~Q9+%qYM9B3bE&f)-Er^rM7c$IO%52aFmtj{vBYi4*`{AZu!{{0%$Ep>M+o!q z2@9DjXJ6($d_#XY`hHMib@xsjbR*=-qwdZh@Hy985}j$7;O%iCkLUjQ$!izyc|ZDk zO$k|X36Qh)w)Y&7#fKCQk-T7pAo?(KQkJT}von9P_Nr=!^-w`{v_C!X-`1w?=F3@K z^Pvlz94?!?0q2@nMs%JNfRB|`+-+W(4JMW=b>c5wjR2(lAe7hObs7&m7TlNnrP{sI z@4CoyveQ%7OE>0`-__S+IM8|$M){Fa2y?(=zRV66W`OrQk2*S=8Us+DS#wFSfjQL4(MSuU zl;H@_wW5LM|JVD5k$%`yx%KX|P$y=kCqvBIC?jh%^}zzk4G#cGUnSQ#TPOQp8()_huLo!ld-eT3CpIe`>%<3=AzFd=Bz zc__csu+Z*y(Z)Eh7gDNyy65hAawtz}4*pi`8FZ$J4F$;JV%qULj3w6pRr^MzPo58Z zAG8?wX)`Bh6(Y{u-6=ofH|BkL8Jv`;Yq!ZU5>&J#g2Kk*)0xlV~cn-d*T?k&k>Uqgz@EW?zB9}#DkH0m5Y-zp@3{z0(! zm^frw(cZ#>RO6}bJh6|wB{$b}#u~L5HMJqmZK0QM1yAXzmMZ$QadM?OWptWyWb<4< zb2-FT-@;rzYnNcIuVR{Vrp0#4Y2=PBn|Da8$3BPh>!cJsy;Ic;PB9Y@$xXtdq^{c7&dhwOq z$FPb@c#nd4`X2}VYQ$RZa*QFdWs2ob4+&jh{9XBsD1pueou=m)m2Se5UVO4?wSXvvg-SJZihfQ%7+WGuZZM`f*#yG=3T2e+f|N~+Op;{}r>rbjm3 z&ce{LR~6u@kj9%^LV1i^k;-T)-+Qn6ivi@EoH|PMK^5WcxB}wa#Ni9sgm+^iSrLPAw zHoni1K~6PLGbT#Fc6#f?jUw|Kc|h|o9mQyEYRU31_-7UX;1ea%U*t$02`)>}8F@K& zN};jhFX2C`38wp?kQbw89uxRes|BvpT&j7(|BjZ!nBYrns+H@76T!%aHCl)yUB0ie zBw$h18pQVFws_k1S=Z@`Xd#x42V2{sVpT4y+Hw!Ic@>4YVOv@GwNERh&$yjsi5o(F zq^8|0Vf+ZsJ7>D38NGSgmk^4sgblZIItjqFxcu;keV(G_>z~yHBF6OkP)RsvmAYka z@ao|75SW4ozm|ykN0*KUi<)~+9aAiQOpLz)F6ReLQ>L$^sH|d6E6_VK$oEaDclA#jR>K$L zLQ8Dksba(c<5gzJLoDSPMDhODl-q{@$JgYn&Gn{x2gR&hYV%T|*fnG2JX6{qUxIki zlk9zQFG&`zisK8q2i6b9=50MXEq2>2*+yUa0axdx)?*@4b8sU~1K$rzcp7k)wJHsN zWdWM;_nI4dA@gmmdOl_>TmcM|Xvmp7-N=a*_%;))(Id8IX%#LPirooXBt|YW;9_Yw zwZ{3`BS1tRV0d@eWv;JjDWQj86m-J4un*+XlaJP({C;`N0+?$mcJWyn0RYcoHX2Yw zthHSimoMT>7Lu;%H6l{m7bU6CPrALo)}yPm2EJ|4G!S#{?6?mAw|AeGO6BCsEDvUj zs0u=wpdy$7pftjOh83u7-9Y;c#yv0ZoflB}ZQucW>~^y>AhyakwCh=f@(Nr46-wXc zgX^gaB_RrMq?%flfarX(9G{3n%=hAwMsW zO1T#f_<%_(qmP4*1r;U+b6d2%CPzcyQKIcJ5V*v8j3y7yJNO=Afw)LL1+(uwa;KD} zP}^gGWfQgCRDGAk^?Ai(ebIXVJ+&Ym7fJh8lLz1imSaPiSAg2Mr=?#0E8;_$T`!@h zAO%7T?9fAMH5Wxtc0xXKhZ%Q0aE~WPgkchH6Z^=_VY%b%ct@-nj$pU1hmoA!BVQVY zLY%*YCL#Xi@otX$SHF@3A1pz|uS}frvap=GA*L+X)&H+m^cDJT$x`z;!xUw-gJ(0| zI>Yot3!qdq2WRyV4Myo5SJoewahn9W&iBPNsr9D1E4S%Z_hCR&!N08|H+fu@ z+mcfo;cw*^R(ve4WCqnqESUJj@BloI^3+@PmHw=(5`yp64y>Pbi*vmHx{=0f20_~l zlIs6t>9xlw8(sWKgd*I+mS4|+k#hXXd%>&Z%znfCx{?-c{EX^A)~X8PRO_WF2oa~| z7uH5z!Va0a!fsRin*Gw%$pSImlNMjST`6Vad@4;S;U`^eLEm=IyE$;Ms28YVqT-Vz{%=E-9QQ4aV%5A#ezM-S0zsD=z!cI4(C882{Q_ zwg7&lF5*rzr0l?ON)BgL4_|e~nRVP`x}PWVSoryxX$`LeLi|Lh8{!GFN0~42ohTIx!O3<$ z*Ax}1;35Xg!eW1Js8fbRKx&ve%|#qevBCFtt%F}`GJk(Az=L}K`l>NQm>A}qnpAif z#J%^Vs8#OJ%7wwZ=S;djug>by%>3{-5cK3I@&1Wdl1J?#B$1q*+qJObkXVdS47G_S zwyoHw1y1=R6lA9AYYq7dHgzr{oK=#mKOPq$ZUvsVRFFH(zwy@Ck@U3jVR4vq3MD{i zx3Igjkl*JEQ`Za!X{xWol9Oj)<8ovYgd7_OG65#F9d0Vpz6R+t10q;k7D*ylh diff --git a/Shorewall-docs/images/network.vdx b/Shorewall-docs/images/network.vdx index ef91d9375..87c5b1c3d 100755 --- a/Shorewall-docs/images/network.vdx +++ b/Shorewall-docs/images/network.vdx @@ -1,5 +1,5 @@ - + @@ -1249,8 +1249,8 @@ BAQP///////////////////////////////////////////////////////////////////////// /wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD// wD//wD//wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn///////////////////////////////// ///////////////////////////////////////////////////////////////////////////// -//////////////////////////////////////////////////wAAAP////////////////////// -///////////////////////////////////////////////////////////////////////////// +//////////////////////////////////////////////////wAAAP///7+/v////7+/v////7+/ +v////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v//// /////////////// ///////////////////////////////////////////////////////////////////////////// ////////wAAAAD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wCfnwkoKA @@ -1261,9 +1261,9 @@ vzBAQP/////////////////////////////////////////////////////////////////////// AAAAD//wAAAAD//wAAAAD//wAAAAD//wAAAAD//wAAAAD//wAAAAD//wAAAAD//wAAAAD//wBAQAD //wD//wD//wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn/////////////////////////////// ///////////////////////////////////////////////////////////////////////////// -////////////////////////////////////////////////////wAAAP//////////////////// -///////////////////////////////////////////////////////////////////////////// -///////////////////////////////////////////////////////////////////////////// +////////////////////////////////////////////////////wAAAGBgYP///wAAAP///wAAAP +///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wA +AAP////////////////////////////////////////////////////////////////////////// /////////////////////////wAAAAD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD// wD//wD//wB/fw5YWAD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//w D//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD @@ -1273,8 +1273,8 @@ AD//wAAAAD//wAAAAD//wAAAAD//wAAAAD//wAAAAD//wAAAAD//wAAAAD//wAAAAD//wAAAAD//w AAAAD//wAAAAD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn////////////// ///////////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////wAAAP/// -///////////////////////////////////////////////////////////////////////////// -///////////////////////////////////////////////////////////////////////////// +wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP +///wAAAP///wAAAP///////////////////////////////////////////////////////////// //////////////////////////////////////////wAAAAD//wD//wD//wD//wD//wD//wD//wD/ /wD//wD//wD//wD//wD//wD//wlgYACHhwD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD// wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//w @@ -1307,8 +1307,8 @@ AQAD//wBAQAD//wBAQAD//wBAQAD//wBwcAD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD/ /wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn//////////////////////////////////////// /////////////// /////////////////////////////////////////////////////0BAQP///0BAQP///0BAQP/// -0BAQP///0BAQP///0BAQP///////wAAAH9/f////39/f////39/f////39/f////39/f////39/f/ -///39/f////39/f////39/f////39/f////////////////////////////////////////////// +0BAQP///0BAQP///0BAQP///////wAAAP//////////////////////////////////////////// +///////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////// /wAAAAD//wD//wD//wCfnwD//wAAAAD//wAAAAD//wAAAAD//wAAAAD//wAAAAD//wAAAAD//wAAA AD//wAAAAD//wAAAAD//wAAAAD//wAAAAD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//w @@ -1318,8 +1318,8 @@ D//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wC/vzBAQP/ AD//wAAAAD//wAAAAD//wAAAAD//wAAAAD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//w D//wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////// -/////////9zc3Hl5eZWVlf///////////////////////wAAAP///wAAAP///wAAAP///wAAAP/// -wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP//////////////////////// +/////////9zc3Hl5eZWVlf///////////////////////wAAAP/////////////////////////// +///////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////// //////////////////wAAAAD//wD//wD//wD//wBAQAD//wBAQAD//wBAQAD//wBAQAD//wBAQAD/ /wBAQAD//wBAQAD//wBAQAD//wBAQAD//wBAQAD//wBAQAD//wDPzwD//wD//wD//wD//wD//wD// @@ -1329,8 +1329,8 @@ D//wD//wC/vzBAQP///////////////////////////////////////////////////////////// /wD//wD//wCHhwD//wBAQAD//wBAQAD//wBAQAD//wBAQAD//wBwcAD//wD//wD//wD//wD//wD// wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn///////////////////// ///////////////////////////////////////////////////////////////////////////// -//////////////////////////3l5eTEzOVVVV25ucv///////////////////wAAAAAAAP///wAA -AP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP/////////// +//////////////////////////3l5eTEzOVVVV25ucv///////////////////wAAAP////////// +///////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////// ///////////////////////////////////wAAAAD//wD//wD//wD//wD//wD//wD//wD//wD//wD //wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD/ @@ -1384,22 +1384,22 @@ wD//wD//wD//wD//wD//wD//wxgYJ+fn///////////////////////////////////////////// wC/vzBAQP//////////////////////////////////////////////////////////////////// ///////////////////////////////7+/vxBAQAD//wD//wD//wD//wD//wD//wD//wD//wD//wD //wAAAMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwAAAAJqampCQkA8eHgDn5wD//wD//wD//wD/ -/wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn////////////////////////wAAA -P///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP//// -///////////////////3d3d2Jmcd/h5ZSe0p6lzs3Nzc3NzUxRaWtsbv///////////////wAAAP/ -//wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP////// -///////////////////////////////////////////////////////////////////////////// +/wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn////////wAAAP///wAAAP///wAAA +P///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///w +AAAP///wAAAP///////3d3d2Jmcd/h5ZSe0p6lzs3Nzc3NzUxRaWtsbv///////yAgIP///wAAAP/ +//wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAA +AP///0BAQP/////////////////////////////////////////////////////////////////// ////////////////////////////wAAAAD//wD//wD//wD//wD//wCoqAEEBAcNDQcNDQcNDQcNDQ cNDQcNDQcNDQcNDQcNDQcNDQcNDQcNDQcNDQcNDQcNDQcNDQYODgDKygD//wD//wD//wD//wD//wD //wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD/ /wD//wD//wD//wD//wC/vzBAQP/////////////////////////////////////////////////// ////////////////////////////////////////////////7+/vxBAQAD//wD//wD//wD//wD//w D//wD//wD//wD//wD//wAAAMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwAAAAJqampqamjM/PwC -fnwD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn/////////// -/////////0BAQP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAA -P///wAAAP///39/f////////////////////3d3d2Jmcd/h5ayy0c3Nzc3NzY6Yz46Yz2ZmZm1ucf -///////0BAQP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP/ -//wAAAP///39/f/////////////////////////////////////////////////////////////// +fnwD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn////0BAQP// +/wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAA +P///wAAAP///wAAAP///wAAAP///39/f////3d3d2Jmcd/h5ayy0c3Nzc3NzY6Yz46Yz2ZmZm1ucf +///////wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP/ +//wAAAP///wAAAP///wAAAP////////////////////////////////////////////////////// /////////////////////////////////////////////wAAAAD//wD//wD//wD//wD//wA/PyAgI JCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkDQ7OxkoKADf3w D//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD @@ -1407,10 +1407,10 @@ D//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD /////////////////////////////////////////////////////////////////7+/vxBAQAD// wD//wD//wD//wD//wD//wD//wD//wD//wD//wAAAMDAwIODg6qqqsDAwMXFxcDAwMDAwMDAwMDAwA AAAJqampqamjM/PwCfnwD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wx -gYJ+fn////////////////////////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v/// -/7+/v////7+/v////7+/v////7+/v////////////////////////3d3d2Jmcd/h5cTG0M3NzY6Yz -46Yz83Nzc3NzUxRaW1ucf///////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v////7 -+/v////7+/v////7+/v////7+/v////////////////////////////////////////////////// +gYJ+fn////////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v/// +/7+/v////7+/v////7+/v////7+/v////7+/v////7+/v////////3d3d2Jmcd/h5cTG0M3NzY6Yz +46Yz83Nzc3NzUxRaW1uccfHx////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v////7 ++/v////7+/v////7+/v////7+/v////7+/v////8/Pz////////////////////////////////// //////////////////////////////////////////////////////////////wAAAACvrwD//wD/ /wD//wD//wA/PyEhIWBgYGBgYLS0tMDAwMDAwMDAwMDAwMDAwMDAwMDAwJ2dnZiYmJiYmKKiopiYm JiYmEBMTIeHhxMz @@ -1567,9 +1567,9 @@ zBAQP//////////////////////////////////////////////////////////////////////// ///////////////////////////7+/vxBAQAD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wA AADAwMCNLIwqRChwcHBwcHBMTEwcHBxUVFTAwMAAAAJqampqamjM/PwCfnwD//wD//wD//wD//wD/ /wD//wD//wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn//////////////////////////////// -////////7+/v0BAQP///////////////////////////////////////0BAQP///0BAQP///0BAQP -///0BAQP///0BAQP///0BAQP///0BAQP///0BAQP///0BAQJubmyQkJI+PjzMzM////0BAQP///// -///////////////////////////////////////////////////////////////////////////// +////////7+/v0BAQP///////////////////////////////0BAQP///0BAQP///0BAQP///0BAQP +///0BAQP///0BAQP///0BAQP///0BAQP///0BAQP///0BAQJubmyQkJI+PjzMzM////0BAQP///0B +AQP////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////// ////////////////////////wAAAAD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//w D//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD @@ -1579,9 +1579,9 @@ D//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD /////////////////////////////7+/vxBAQAD//wD//wD//wD//wD//wD//wD//wD//wD//wD// wAAADAwMBEZEQAoAAAAAAAAAAAAAAICAg4ODjAwMAAAAJqampqamjM/PwCfnwD//wD//wD//wD//w D//wD//wD//wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn////////////////////////////// -//////////7+/v0BAQP///////////////////////////////////9/f3////wAAAP///wAAAP// -/wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///2BgY -P//////////////////////////////////////////////////////////////////////////// +//////////7+/v0BAQP///////////////////////////5+fn////wAAAP///wAAAP///wAAAP// +/wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAA +P///yAgIP//////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////// //////////////////////////wAAAAD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD/ /wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD// @@ -1590,9 +1590,9 @@ D//wD//wD//wD//wC/vzBAQP///////////////////////////////////////////////////// //////////////////////////////////////////////7+/vxBAQAD//wD//wD//wD//wD//wD/ /wD//wD//wD//wD//wAAADAwMC4uLgAAAAAAAAAAAAAAAAAAAB4eHjAwMAAAAJqampqamjM/PwCfn wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn///////////// -///////////////////////////7+/v0BAQP///////////////////////////////////////0B +///////////////////////////7+/v0BAQP///////////////////////////////0BAQP///0B AQP///0BAQP///0BAQP///0BAQP///0BAQP///0BAQP///0BAQP///0BAQP///0BAQP///0BAQP// -/0BAQP///0BAQP/////////////////////////////////////////////////////////////// +/0BAQP///0BAQP///0BAQP/////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////wAAAAD//wD//wD//wD//wD//wD//wD//wD //wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD/ @@ -1613,8 +1613,8 @@ fwB/fwB/fwB/fwB/fwB/fwB/fwB/fwB/fwB/fwB/fwB/fwB/fwBgYDBAQP/////////////////// ///7+/vxBAQAD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wAAADAwMB83HwjPCC4uLhISEgs LCwMDAwoKCjAwMAAAAJqampqamjM/PwCfnwD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD/ /wD//wD//wD//wxgYJ+fn////////////////////////////////////////7+/v0BAQP/////// -////////////////////////////////wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP -///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///////////////////////////// +////////////////////////wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP +///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///////////////////// ///////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////// 6+vr39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f3 @@ -1624,8 +1624,8 @@ LCwMDAwoKCjAwMAAAAJqampqamjM/PwCfnwD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD/ ////////////////////7+/vxBAQAD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wAAADAwMC kpKQAAAAAAAAAAAAAAAAAAABgYGDAwMAAAAJqampqamjM/PwCfnwD//wD//wD//wD//wD//wD//wD //wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn/////////////////////////////////////// -/7+/v0BAQP///////////////////////////////////9/f3////wAAAP///wAAAP///wAAAP/// -wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///2BgYP//////// +/7+/v0BAQP///////////////////////////5+fn////wAAAP///wAAAP///wAAAP///wAAAP/// +wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///yAgIP ///////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////// @@ -1636,8 +1636,8 @@ wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///2BgYP//////// //////////////////////7+/vxBAQAD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wAAAFRU VAAAAAAAAAAAAAAAAAAAAAAAAAAAAFRUVAAAAJqampqamjM/PwCfnwD//wD//wD//wD//wD//wD// wD//wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn///////////////////////////////////// -///7+/v0BAQP///////////////////////////////////////39/f////39/f////39/f////39 -/f////39/f////39/f////39/f////39/f////39/f////39/f////39/f////39/f/////////// +///7+/v0BAQP///////////////////////////////39/f////39/f////39/f////39/f////39 +/f////39/f////39/f////39/f////39/f////39/f////39/f////39/f////39/f////39/f/// ///////////////////////////////////////////////////////////////////////////// ////////////////////////////////8/PzwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA @@ -1659,8 +1659,8 @@ A/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA D//wD//wD//wD//wD//wD//wD//wCTkwMGBm9vb4GBgYGBgYGBgYGBgYGBgYGBgYGBgYqKimh3d5q amjM/PwCfnwD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn/// /////////////////////////////////////7+/v0BAQP/////////////////////////////// -////////wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP -///wAAAP///wAAAP///wAAAP///////////////////////////////////////////////////// +wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP +///wAAAP///wAAAP///wAAAP///wAAAP///////////////////////////////////////////// //////////////////////////////////////////////////////////////////7+/vxAQQAAA /wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/ wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/w @@ -1670,8 +1670,8 @@ A/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAAvzAwQP////////////////////////// xBAQAD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wCoqAkPD8rKyubm5ubm5ubm5ubm5u bm5ubm5ubm5ru7u2h3dzM+PgCfnwD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD //wD//wxgYJ+fn////////////////////////////////////////7+/v0BAQP////////////// -/////////////////////9/f3////wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP/// -wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///2BgYP//////////////////////////////// +/////////////5+fn////wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP/// +wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///yAgIP//////////////////////// ///////////////////////////////////////////////////////////////////////////// //////7+/vxAQQAAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA3wAA/wAAfwAA/wAAfwAA /wAAfwAA/wAAfwAA/wAAfwAA/wAAfwAA/wAAfwAA/wAAfwAA/wAAfwAA/wAAfwAA/wAAfwAA/wAAf @@ -1681,8 +1681,8 @@ AA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAAvzAwQP///////// /////////////7+/vxBAQAD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wCoqAkPD zk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OSQkJBATEwCVlQD//wD//wD//wD//wD//wD//wD//wD//w D//wD//wD//wD//wD//wD//wxgYJ+fn////////////////////////////////////////7+/v0B -AQP///////////////////////////////////////7+/v////7+/v////7+/v////7+/v////7+/ -v////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v//////////////////// +AQP///////////////////////////////7+/v////7+/v////7+/v////7+/v////7+/v////7+/ +v////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v//////////// /////////////// ///////////////////////////////////////////////////////////////////////////// ////////7+/vxAQQAAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAAAAAA/wAAAAAA/w @@ -1693,8 +1693,8 @@ A/wAAAAAA/wAA3wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA ///////////////7+/vxBAQAD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wC oqAA/PwA/PwA/PwA/PwA/PwA/PwA/PwA/PwA/PwA/PwDg4AD//wD//wD//wD//wD//wD//wD//wD/ /wD//wD//wD//wD//wD//wD//wxgYJ+fn////////////////////////////////////////7+/v -0BAQP////////////////////////////////////f39////7+/v////7+/v////7+/v////7+/v/ -///7+/v////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v////9fX1////////////// +0BAQP///////////////////////////+fn5////7+/v////7+/v////7+/v////7+/v////7+/v/ +///7+/v////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v////7+/v////8fHx////// ///////////////////////////////////////////////////////////////////////////// /////////////////////////7+/vxAQQAAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAAv wAA/wAAAAAA/wAAAAAA/wAAAAAA/wAAAAAA/wAAAAAA/wAAAAAA/wAAAAAA/wAAAAAA/wAAAAAA/w @@ -1704,9 +1704,9 @@ A/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA ////////////////////////////////7+/vxBAQAD//wD//wD//wD//wD//wD//wD//wD//wD//w D//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD //wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn/////////////////////////// -/////////////7+/v0BAQP///////////////////////////////////////wAAAP///wAAAP/// +/////////////7+/v0BAQP///////////////////////////////wAAAP///wAAAP///wAAAP/// wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP -///////////////////////////////////////////////////////////////////////////// +///wAAAP///////////////////////////////////////////////////////////////////// //////////////////////////////////////////7+/vxAQQAAA/wAA/wAA/wAA/wAA/wAA/wAA /wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/ wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/w @@ -1715,9 +1715,9 @@ A/wAA/wAA/wAA/wAA/wAAvzAwQP////////////////////////////////////////////////// /////////////////////////////////////////////////7+/vxBAQAD//wD//wD//wD//wD// wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//w D//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wxgYJ+fn////////// -//////////////////////////////7+/v0BAQP///////////////////////////////////9/f -3////wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP/// -wAAAP///wAAAP///2BgYP//////////////////////////////////////////////////////// +//////////////////////////////7+/v0BAQP///////////////////////////5+fn////wAA +AP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP///wAAAP/// +wAAAP///wAAAP///wAAAP///yAgIP//////////////////////////////////////////////// ///////////////////////////////////////////////////////////7+/vxAQQAAA/wAA/wA A/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/wAAxwAA/wAAvwAA/wAAvwAA/wAAvwAA /wAAvwAA/wAAvwAA/wAAvwAA/wAAvwAA/wAAvwAA/wAAvwAA/wAA/wAA/wAA/wAA/wAA/wAA/wAA/ @@ -3206,8 +3206,8 @@ f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f ///////////////////////////////////////////////////////////////////////////// /////////////w4AAAAUAAAAAAAAABAAAAAUAAAA 2002-08-11T08:58:32 -2003-12-29T07:34:23 -2003-12-29T07:34:13 +2004-02-13T16:20:19 +2004-02-13T16:11:36 2002-08-11T08:58:32 @@ -40781,7 +40781,7 @@ B/wAAA/8AAB//AAAf/wAAH/8AAA//AAAP/wAAD/8AAA//AAAP/wAAD/+AAA//4AAf//gAP/////// - + 85 @@ -40990,10 +40990,10 @@ B/wAAA/8AAB//AAAf/wAAH/8AAA//AAAP/wAAD/8AAA//AAAP/wAAD/+AAA//4AAf//gAP/////// 0 -206.124.146.176 -206.124.146.178 -206.124.146.179 -206.124.146.180 +206.124.146.176/24 +206.124.146.178/24 +206.124.146.179/24 +206.124.146.180/24 @@ -41731,8 +41731,8 @@ B/wAAA/8AAB//AAAf/wAAH/8AAA//AAAP/wAAD/8AAA//AAAP/wAAD/+AAA//4AAf//gAP/////// -44 -45 +45.1 +43.1 15 3 7.5 @@ -41791,11 +41791,11 @@ B/wAAA/8AAB//AAAf/wAAH/8AAA//AAAP/wAAD/8AAA//AAAP/wAAD/+AAA//4AAf//gAP/////// 0 -192.168.1.254 +192.168.1.254/24 -45 +45.4 47.5 14 3 @@ -41855,7 +41855,7 @@ B/wAAA/8AAB//AAAf/wAAH/8AAA//AAAP/wAAD/8AAA//AAAP/wAAD/+AAA//4AAf//gAP/////// 0 -192.168.3.254 +192.168.3.254/24 @@ -41936,7 +41936,7 @@ B/wAAA/8AAB//AAAf/wAAH/8AAA//AAAP/wAAD/8AAA//AAAP/wAAD/+AAA//4AAf//gAP/////// 0 -192.168.2.254 +206.124.146.176/32 @@ -71384,7 +71384,7 @@ www.xxx.yyy.zzz/ - + 1 1 0 diff --git a/Shorewall-docs/myfiles.xml b/Shorewall-docs/myfiles.xml index 75acf2c68..de8df80b0 100644 --- a/Shorewall-docs/myfiles.xml +++ b/Shorewall-docs/myfiles.xml @@ -15,7 +15,7 @@ - 2004-01-20 + 2004-02-13 2001-2004 @@ -51,10 +51,11 @@ I have DSL service and have 5 static IP addresses - (206.124.146.176-180). My DSL modem (Fujitsu Speedport) is - connected to eth0. I have a local network connected to eth2 (subnet - 192.168.1.0/24), a DMZ connected to eth1 (192.168.2.0/24) and a Wireless - network connected to eth3 (192.168.3.0/24). + (206.124.146.176-180/24). My DSL modem (Fujitsu Speedport) + is connected to eth0. I have a local network connected to eth2 (subnet + 192.168.1.0/24), a DMZ connected to eth1 (206.124.146.176/24) and a + Wireless network connected to eth3 (192.168.3.0/24). Note that the IP + address of eth1 is a duplicate of one on eth0. I use: @@ -202,7 +203,7 @@ tx Texas Peer Network in Dallas #ZONE INERFACE BROADCAST OPTIONS net eth0 206.124.146.255 dhcp,norfc1918,routefilter,blacklist,tcpflags loc eth2 192.168.1.255 dhcp -dmz eth1 192.168.2.255 +dmz eth1 - WiFi eth3 192.168.3.255 dhcp,maclist - texas 192.168.9.255 #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE @@ -453,33 +454,11 @@ ACCEPT dmz fw tcp ACCEPT dmz fw udp snmp REJECT dmz fw tcp auth ############################################################################################################################################################################### -# DMZ to Internet -# -ACCEPT dmz net tcp smtp,domain,www,https,whois,echo,2702,21,2703,ssh,8080 -ACCEPT dmz net udp domain -ACCEPT dmz net:$POPSERVERS tcp pop3 -#ACCEPT dmz net:206.191.151.2 tcp pop3 -#ACCEPT dmz net:66.216.26.115 tcp pop3 -# -# Something is wrong with the FTP connection tracking code or there is some client out there -# that is sending a PORT command which that code doesn't understand. Either way, -# the following works around the problem. -# -ACCEPT:$LOG dmz net tcp 1024: 20 -############################################################################################################################################################################### -# DMZ to Firewall -- ntp & snmp, Silently reject Auth -# -ACCEPT dmz fw udp ntp ntp -ACCEPT dmz fw tcp snmp,ssh -ACCEPT dmz fw udp snmp -REJECT dmz fw tcp auth -############################################################################################################################################################################### -# # DMZ to Local Network # ACCEPT dmz loc tcp smtp,6001:6010 -ACCEPT dmz loc tcp 111 -ACCEPT dmz loc udp +ACCEPT dmz:206.124.146.177 loc:192.168.1.3 tcp 111 +ACCEPT dmz:206.124.146.177 loc:192.168.1.3 udp# ############################################################################################################################################################################### # Internet to Firewall # @@ -555,10 +534,9 @@ ACCEPT all all icmp ... auto eth1 iface eth1 inet static - address 192.168.2.1 - netmask 255.255.255.0 - network 192.168.2.0 - broadcast 192.168.2.255 + address 206.124.146.176 + netmask 255.255.255.266 + broadcast 0.0.0.0 up ip route add 206.124.146.177 dev eth1 ... diff --git a/Shorewall-docs/myfiles2.xml b/Shorewall-docs/myfiles2.xml index 3cab2e321..4f33ce943 100644 --- a/Shorewall-docs/myfiles2.xml +++ b/Shorewall-docs/myfiles2.xml @@ -15,7 +15,7 @@ - 2004-02-08 + 2004-02-22 2001-2004 @@ -47,15 +47,16 @@ The configuration shown here corresponds to Shorewall version - 2.0.0-Beta1. It may use features not available in earlier Shorewall + 2.0.0-Beta2. It may use features not available in earlier Shorewall releases. I have DSL service and have 5 static IP addresses (206.124.146.176-180). My DSL modem (Fujitsu Speedport) is connected to eth0. I have a local network connected to eth2 (subnet - 192.168.1.0/24), a DMZ connected to eth1 (192.168.2.0/24) and a Wireless - network connected to eth3 (192.168.3.0/24). + 192.168.1.0/24), a DMZ connected to eth1 (206.124.146.176/32) and a + Wireless network connected to eth3 (192.168.3.0/24). Note that the IP + address of eth1 is a duplicate of one on eth0. I use: @@ -204,7 +205,7 @@ tx Texas Peer Network in Dallas #ZONE INERFACE BROADCAST OPTIONS net eth0 206.124.146.255 dhcp,norfc1918,routefilter,blacklist,tcpflags,nosmurfs loc eth2 192.168.1.255 dhcp,detectnets -dmz eth1 192.168.2.255 +dmz eth1 - WiFi eth3 192.168.3.255 dhcp,maclist,detectnets - texas 192.168.9.255 #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE @@ -261,6 +262,7 @@ eth3 192.168.3.0/24 #ADDRESS/SUBNET PROTOCOL PORT 0.0.0.0/0 udp 1434 0.0.0.0/0 tcp 1433 +0.0.0.0/0 tcp 3127 0.0.0.0/0 tcp 8081 0.0.0.0/0 tcp 57 #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE @@ -292,7 +294,7 @@ all all REJECT $LOG # Reje

Although most of our internal systems use one-to-one NAT, my wife's system (192.168.1.4) uses IP Masquerading (actually SNAT) - as does my SuSE system (192.168.1.3), our laptop (192.168.3.8) and + as do my SuSE system (192.168.1.3), our laptop (192.168.3.8) and visitors with laptops. #INTERFACE SUBNET ADDRESS @@ -346,18 +348,7 @@ gre net $TEXAS
#ACTION -DropSMB #Silently Drops Microsoft SMB Traffic -RejectSMB #Silently Reject Microsoft SMB Traffic -DropUPnP #Silently Drop UPnP Probes -RejectAuth #Silently Reject Auth -DropPing #Silently Drop Ping -DropDNSrep #Silently Drop DNS Replies -AllowPing #Accept Ping - Mirrors #Accept traffic from the Shorewall Mirror sites - -MyDrop:DROP #My DROP common action -MyReject:REJECT #My REJECT common action #LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
@@ -378,11 +369,11 @@ ACCEPT $MIRRORS
- action.MyDrop + /etc/shorewall/action.Drop
This is my common action for the DROP policy. It is like the - standard Reject action except that it + standard Drop action except that it allows Ping. #TARGET SOURCE DEST PROTO DEST SOURCE RATE USER/ @@ -398,12 +389,13 @@ DropDNSrep
- action.MyReject + /etc/shorewall/action.Reject
This is my common action for the REJECT policy. It is like the - standard Drop action except that it - allows Ping. + standard Reject action except that it + allows Ping and contains one rule that guards against + log flooding by broken software running in my local zone. #TARGET SOURCE DEST PROTO DEST SOURCE RATE USER/ # PORT(S) PORT(S) LIMIT GROUP @@ -437,15 +429,12 @@ REJECT:$LOG loc net tcp REJECT loc net tcp 137,445 REJECT loc net udp 137:139 # -DROP loc:!192.168.1.0/24 net - QUEUE loc net udp QUEUE loc fw udp QUEUE loc net tcp ############################################################################################################################################################################### # Local Network to Firewall # -DROP loc:!192.168.1.0/24 fw ACCEPT loc fw tcp ssh,time,10000,swat,137,139,445 ACCEPT loc fw udp snmp,ntp,445 ACCEPT loc fw udp 137:139 @@ -453,7 +442,6 @@ ACCEPT loc fw udp ############################################################################################################################################################################### # Local Network to DMZ # -DROP loc:!192.168.1.0/24 dmz REJECT loc dmz tcp 465 ACCEPT loc dmz udp domain,xdmcp ACCEPT loc dmz tcp www,smtp,domain,ssh,imap,https,imaps,cvspserver,ftp,10000,8080,10027,pop3 - @@ -509,33 +497,11 @@ ACCEPT dmz fw tcp ACCEPT dmz fw udp snmp REJECT dmz fw tcp auth ############################################################################################################################################################################### -# DMZ to Internet -# -ACCEPT dmz net tcp smtp,domain,www,https,whois,echo,2702,21,2703,ssh,8080 -ACCEPT dmz net udp domain -ACCEPT dmz net:$POPSERVERS tcp pop3 -#ACCEPT dmz net:206.191.151.2 tcp pop3 -#ACCEPT dmz net:66.216.26.115 tcp pop3 -# -# Something is wrong with the FTP connection tracking code or there is some client out there -# that is sending a PORT command which that code doesn't understand. Either way, -# the following works around the problem. -# -ACCEPT:$LOG dmz net tcp 1024: 20 -############################################################################################################################################################################### -# DMZ to Firewall -- ntp & snmp, Silently reject Auth -# -ACCEPT dmz fw udp ntp ntp -ACCEPT dmz fw tcp snmp,ssh -ACCEPT dmz fw udp snmp -REJECT dmz fw tcp auth -############################################################################################################################################################################### -# # DMZ to Local Network # ACCEPT dmz loc tcp smtp,6001:6010 -ACCEPT dmz loc tcp 111 -ACCEPT dmz loc udp +ACCEPT dmz:206.124.146.177 loc:192.168.1.3 tcp 111 +ACCEPT dmz:206.124.146.177 loc:192.168.1.3 udp ############################################################################################################################################################################### # Internet to Firewall # @@ -598,7 +564,7 @@ ACCEPT all all icmp
-
+
/etc/network/interfaces
@@ -611,10 +577,9 @@ ACCEPT all all icmp ... auto eth1 iface eth1 inet static - address 192.168.2.1 - netmask 255.255.255.0 - network 192.168.2.0 - broadcast 192.168.2.255 + address 206.124.146.176 + netmask 255.255.255.255 + broadcast 0.0.0.0 up ip route add 206.124.146.177 dev eth1 ...
diff --git a/Shorewall-docs/ports.xml b/Shorewall-docs/ports.xml index 57644e95d..44ddb0783 100644 --- a/Shorewall-docs/ports.xml +++ b/Shorewall-docs/ports.xml @@ -13,7 +13,7 @@ - 2004-02-05 + 2004-02-18 2001-2002 @@ -118,15 +118,9 @@ ACCEPT <destination> <source>
NFS - I personally use the following rules for opening access from zone z1 - to a server with IP address a.b.c.d in zone z2. I have found though that - different distributions behave differently so your milage may vary. - - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) -ACCEPT <z1> <z2>:a.b.c.d tcp 111 -ACCEPT <z1> <z2>:a.b.c.d udp 111 -ACCEPT <z1> <z2>:a.b.c.d udp 2049 -ACCEPT <z1> <z2>:a.b.c.d udp 32700: + #ACTION SOURCE DESTINATION PROTO DEST PORT(S) +ACCEPT <z1>:<list of client IPs> <z2>:a.b.c.d tcp 111 +ACCEPT <z1>:<list of client IPs> <z2>:a.b.c.d udp
@@ -136,6 +130,14 @@ ACCEPT <z1> <z2><source> <destination> udp 123
+
+ <trademark>PCAnywhere</trademark> + + #ACTION SOURCE DESTINATION PROTO DEST PORT(S) +ACCEPT <source> <destination> udp 5632 +ACCEPT <source> <destination> tcp 5631 +
+
Pop3 @@ -255,7 +257,9 @@ ACCEPT <source> <destination> Revision History - 1.52004-02-05TEAdded + 1.72004-02-12TEMake + NFS work for everyone1.62004-02-12TEAdded + PCAnywhere1.52004-02-05TEAdded information about VNC viewers in listen mode.1.42004-01-26TECorrect ICQ.1.32004-01-04TEAlphabetize1.22004-01-03TEAdd rules file entries.1.12002-07-30TEInitial diff --git a/Shorewall-docs/support.xml b/Shorewall-docs/support.xml index 401f76ed3..826105898 100755 --- a/Shorewall-docs/support.xml +++ b/Shorewall-docs/support.xml @@ -15,7 +15,7 @@ - 2004-01-01 + 2004-02-19 2001-2004 @@ -121,6 +121,12 @@ questions but we can't do your job for you. + + Please do NOT include the output of iptables -L + — the output of shorewall show or + shorewall status is much more useful. + + When reporting a problem, ALWAYS include this information: @@ -296,7 +302,8 @@ Revision History - 1.22003-01-01TERemoved + 1.32003-02-19TEAdmonish + against including "iptables -L" output.1.22003-01-01TERemoved .GIF and moved note about unsupported releases. Move Revision History to this Appendix.1.12003-12-19TECorrected URL for Newbies List diff --git a/Shorewall-docs/three-interface.xml b/Shorewall-docs/three-interface.xml index f2340df52..ff6e9a15d 100644 --- a/Shorewall-docs/three-interface.xml +++ b/Shorewall-docs/three-interface.xml @@ -15,7 +15,7 @@ - 2004-12-05 + 2004-02-12 2002 @@ -530,6 +530,10 @@ fw net ACCEPT /etc/shorewall/masq and change it to match your configuration. + If, despite all advice to the contrary, you are using this guide and + want to use one-to-one NAT or Proxy ARP for your DMZ, remove the entry for + eth2 from /etc/shorewall/masq. + If your external IP is static, you can enter it in the third column diff --git a/Shorewall-docs/traffic_shaping.xml b/Shorewall-docs/traffic_shaping.xml index a914ffc40..0989c0f27 100755 --- a/Shorewall-docs/traffic_shaping.xml +++ b/Shorewall-docs/traffic_shaping.xml @@ -15,7 +15,7 @@ - 2004-01-21 + 2004-02-11 2001-2004 @@ -46,8 +46,7 @@ A new TC_ENABLED parameter in - /etc/shorewall.conf. Traffic Shaping also requires that you enable - packet mangling. + /etc/shorewall.conf. @@ -229,12 +228,11 @@ column may only be non-empty if the SOURCE is the firewall itself. When this column is non-empty, the rule applies only if the program generating the output is running under the effective user and/or - group. It may contain : + group. It may contain : - [<user name or number>]:[<group name or number>] - + [<user name or number>]:[<group name or number>] - The colon is optionnal when specifying only a user. + The colon is optionnal when specifying only a user. Examples : john: / john / :users / john:users @@ -247,63 +245,11 @@ arriving on eth2 and eth3 should be marked with 2. All packets originating on the firewall itself should be marked with 3. - - - - - MARK - - SOURCE - - DESTINATION - - PROTOCOL - - - - - - 1 - - eth1 - - 0.0.0.0/0 - - all - - - - 2 - - eth2 - - 0.0.0.0/0 - - all - - - - 2 - - eth3 - - 0.0.0.0/0 - - all - - - - 3 - - fw - - 0.0.0.0/0 - - all - - - - + #MARK SOURCE DESTINATION PROTOCOL USER/GROUP +1 eth1 0.0.0.0/0 all +2 eth2 0.0.0.0/0 all +2 eth3 0.0.0.0/0 all +3 fw 0.0.0.0/0 all @@ -312,33 +258,8 @@ All GRE (protocol 47) packets not originating on the firewall and destined for 155.186.235.151 should be marked with 12. - - - - - MARK - - SOURCE - - DESTINATION - - PROTOCOL - - - - - - 12 - - 0.0.0.0/0 - - 155.186.235.151 - - 47 - - - - + #MARK SOURCE DESTINATION PROTOCOL USER/GROUP +12 0.0.0.0/0 155.182.235.151 47 @@ -347,37 +268,8 @@ All SSH packets originating in 192.168.1.0/24 and destined for 155.186.235.151 should be marked with 22. - - - - - MARK - - SOURCE - - DESTINATION - - PROTOCOL - - PORT(S) - - - - - - 22 - - 192.168.1.0/24 - - 155.186.235.151 - - tcp - - 22 - - - - + #MARK SOURCE DESTINATION PROTOCOL USER/GROUP +22 192.168.1.0/24 155.182.235.151 tcp 22
diff --git a/Shorewall-docs/troubleshoot.xml b/Shorewall-docs/troubleshoot.xml index 80a88ddc4..fd0a58914 100644 --- a/Shorewall-docs/troubleshoot.xml +++ b/Shorewall-docs/troubleshoot.xml @@ -13,7 +13,7 @@ Eastep - 2004-01-06 + 2004-02-02 2001-2004 @@ -119,6 +119,50 @@ iptables: No chain/target/match by that name
+
+ Some Things to Keep in Mind + + + + You cannot test your firewall from the + inside. Just because you send requests to your firewall + external IP address does not mean that the request will be associated + with the external interface or the net zone. Any + traffic that you generate from the local network will be associated + with your local interface and will be treated as loc->fw traffic. + + + + IP addresses are properties of systems, + not of interfaces. It is a mistake to believe that your + firewall is able to forward packets just because you can ping the IP + address of all of the firewall's interfaces from the local + network. The only conclusion you can draw from such pinging success is + that the link between the local system and the firewall works and that + you probably have the local system's default gateway set + correctly. + + + + Reply packets do NOT automatically follow + the reverse path of the one taken by the original request. + All packets are routed according to the routing table of the host at + each step of the way. This issue commonly comes up when people install + a Shorewall firewall parallel to an existing gateway and try to use + DNAT through Shorewall without changing the default gateway of the + system receiving the forwarded requests. Requests come in through the + Shorewall firewall where the destination IP address gets rewritten but + replies go out unmodified through the old gateway. + + + + Shorewall itself has no notion of inside + or outside. These concepts are embodied in how Shorewall is + configured. + + +
+
Your Network Environment @@ -355,7 +399,8 @@ DROP net fw icmp echo-request Revision History - 1.62005-01-06TEAdd + 1.72005-02-02TEAdd + hint about testing from inside the firewall.1.62005-01-06TEAdd pointer to Site and Mailing List Archives Searches.1.52004-01-01TEAdded information about eliminating ping-generated log messages.1.42003-12-22TEInitial Docbook Conversion diff --git a/Shorewall-docs2/FAQ.xml b/Shorewall-docs2/FAQ.xml index 10c51298f..c4076eed2 100644 --- a/Shorewall-docs2/FAQ.xml +++ b/Shorewall-docs2/FAQ.xml @@ -17,7 +17,7 @@ - 2004-06-11 + 2004-06-18 2001-2004 @@ -58,9 +58,9 @@ class="directory">/etc/shorewall and modify the copies. Note that you must copy /usr/share/doc/shorewall/default-config/shorewall.conf - and /usr/share/doc/shorewall/default-config/modules to /etc/shorewall even if you do not modify - those files. + and /usr/share/doc/shorewall/default-config/modules + to /etc/shorewall even if you do + not modify those files.
@@ -407,16 +407,17 @@ eth2 192.168.2.0/24 following:
- > I know PoM -ng is going to address this issue, but till it - is ready, and > all the extras are ported to it, is there any way - to use the h.323 > contrack module kernel patch with a 2.6 kernel? - > Running 2.6.1 - no 2.4 kernel stuff on the system, so downgrade - is not > an option... The module is not ported yet to 2.6, sorry. - > Do I have any options besides a gatekeeper app (does not work in - my > network) or a proxy (would prefer to avoid them)? I suggest - everyone to setup a proxy (gatekeeper) instead: the module is really - dumb and does not deserve to exist at all. It was an excellent tool to - debug/develop the newnat interface. + > I know PoM -ng is going to address this issue, but till it is ready, and +> all the extras are ported to it, is there any way to use the h.323 +> contrack module kernel patch with a 2.6 kernel? +> Running 2.6.1 - no 2.4 kernel stuff on the system, so downgrade is not +> an option... The module is not ported yet to 2.6, sorry. +> Do I have any options besides a gatekeeper app (does not work in my +> network) or a proxy (would prefer to avoid them)? + +I suggest everyone to setup a proxy (gatekeeper) instead: the module is +really dumb and does not deserve to exist at all. It was an excellent tool +to debug/develop the newnat interface.
Look here @@ -1734,7 +1735,8 @@ iptables: Invalid argument Revision History - 1.262004-05-18TEDelete + 1.272004-06-18TECorrect + formatting in H323 quote.1.262004-05-18TEDelete obsolete ping information.1.252004-05-18TEEmpty /etc/shorewall on Debian.1.252004-05-08TEUpdate for Shorewall 2.0.21.242004-04-25TEAdd diff --git a/Shorewall2/fallback.sh b/Shorewall2/fallback.sh index 10eb41c05..68e249476 100755 --- a/Shorewall2/fallback.sh +++ b/Shorewall2/fallback.sh @@ -28,7 +28,7 @@ # shown below. Simply run this script to revert to your prior version of # Shoreline Firewall. -VERSION=2.0.3-RC1 +VERSION=2.0.3-RC2 usage() # $1 = exit status { diff --git a/Shorewall2/install.sh b/Shorewall2/install.sh index d24c30a5c..deac6f96d 100755 --- a/Shorewall2/install.sh +++ b/Shorewall2/install.sh @@ -22,7 +22,7 @@ # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA # -VERSION=2.0.3-RC1 +VERSION=2.0.3-RC2 usage() # $1 = exit status { diff --git a/Shorewall2/shorewall.spec b/Shorewall2/shorewall.spec index e9ee14922..f056f6d6f 100644 --- a/Shorewall2/shorewall.spec +++ b/Shorewall2/shorewall.spec @@ -1,6 +1,6 @@ %define name shorewall %define version 2.0.3 -%define release 0RC1 +%define release 0RC2 %define prefix /usr Summary: Shoreline Firewall is an iptables-based firewall for Linux systems. @@ -141,6 +141,8 @@ fi %doc COPYING INSTALL changelog.txt releasenotes.txt tunnel %changelog +* Sat Jun 19 2004 Tom Eastep tom@shorewall.net +- Updated to 2.0.2-0RC2 * Tue Jun 15 2004 Tom Eastep tom@shorewall.net - Updated to 2.0.2-0RC1 * Mon Jun 14 2004 Tom Eastep tom@shorewall.net diff --git a/Shorewall2/uninstall.sh b/Shorewall2/uninstall.sh index fbfb8de5e..1bb31dd23 100755 --- a/Shorewall2/uninstall.sh +++ b/Shorewall2/uninstall.sh @@ -26,7 +26,7 @@ # You may only use this script to uninstall the version # shown below. Simply run this script to remove Seattle Firewall -VERSION=2.0.3-RC1 +VERSION=2.0.3-RC2 usage() # $1 = exit status {