From sacadmin Thu Aug 14 14:37:21 2008 Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m7ELbLVB003391; Thu, 14 Aug 2008 14:37:21 -0700 (PDT) Received: (from sommerfe@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id m7ELbLFh003387; Thu, 14 Aug 2008 14:37:21 -0700 (PDT) Date: Thu, 14 Aug 2008 14:37:21 -0700 (PDT) From: William Sommerfeld Message-Id: <200808142137.m7ELbLFh003387@sac.sfbay.sun.com> To: PSARC-record@sac.sfbay.sun.com Cc: Thejaswini.Singarajipura@sun.com Subject: IPsec session failover [PSARC/2008/523 FastTrack timeout 08/21/2008] Status: RO Content-Length: 569 Template Version: @(#)sac_nextcase 1.66 04/17/08 SMI This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: IPsec session failover 1.2. Name of Document Author/Supplier: Author: Thejaswini Singarajipura 1.3 Date of This Document: 14 August, 2008 4. Technical Description See the case directory for more detail 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From sommerfeld@sun.com Thu Aug 14 14:44:32 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m7ELiW3Q003452 for ; Thu, 14 Aug 2008 14:44:32 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m7ELiQEF011872; Thu, 14 Aug 2008 22:44:28 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K5M00G011Q34S00@nwk-avmta-2.sfbay.sun.com>; Thu, 14 Aug 2008 14:44:27 -0700 (PDT) Received: from thunk.east.sun.com ([129.148.174.66]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K5M006IN1Q25ZD0@nwk-avmta-2.sfbay.sun.com>; Thu, 14 Aug 2008 14:44:27 -0700 (PDT) Received: from [IPv6:::1] (localhost [IPv6:::1]) by thunk.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m7ELiQRm003286; Thu, 14 Aug 2008 17:44:26 -0400 (EDT) Date: Thu, 14 Aug 2008 17:44:24 -0400 From: Bill Sommerfeld Subject: 2008/523 IPsec session failover To: PSARC-ext Cc: ipsec-core , Thejaswini Singarajipura , Steven De Tar , Burt Clouse Message-id: <1218750264.2286.32.camel@thunk> MIME-version: 1.0 X-Mailer: Evolution 2.22.2 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 17011 I'm sponsoring the following case for Thejaswini Singarajipura. Timer expires on 8/21/2008. This case has a Patch/Micro release binding to permit inclusion in a Solaris 10 Update release. See interface table for stability levels; there is a (draft) contract for a Contracted Consolidation Private interface in the case directory. (and I'll be rounding up signatures on the contract shortly). Description: ------------ Solaris Cluster (SC), a HA offering from Sun, provides a load balancing, highly available and scalable data service. A scalable data service has several instances of the application running on a subset of the nodes of the cluster. Together these nodes provide a single service image to the remote client. When a node fails, the client connections which are serviced by the other nodes will face no interruptions. If there were service instances on the failed node, the service instance will be broken on the client side if TCP. The client then has to restart the request. This helps in reducing the service down time. The HA feature of Solaris Cluster cannot be supported for IPsec enabled service. IPsec works well on a single node. If a node fails, all IPsec Security Associations (SAs) as defined in RFC 2401, are lost and have to be regenerated on the new node and increases the service down time. If the SAs are synchronized on all the nodes of the SC which service the scalable service, the client can start a new connection after a node failure and the new node servicing the client can use the synchronized SA for the communication. Proposal: --------- The PF_KEY(7P) socket will be extended to facilitate the synchronization of the SA to the other nodes of the cluster The Solaris provided Key management mechanisms ipseckey(1M) and in.iked(1M) will be modified to make use of these new changes. Solaris sadb will be changed to contact Solaris Cluster for the SPI allocation. The in.iked will be modified to provide a method of detecting dead IKE peer as defined in RFC 3706. The project private ipsa_t structure, defined in usr/src/uts/common/inet/sadb.h will be extended to include the changes. These changes are tracked by CRs 6545486,6398024,6558870. Details: -------- The following changes are proposed to pfkeyv2.h: New sadb_x_replay_ctr structure: typedef struct sadb_x_replay_ctr { uint16_t sadb_x_rc_len; uint16_t sadb_x_rc_exttype; uint32_t sadb_x_rc_replay32; /* For 240x SAs. */ uint64_t sadb_x_rc_replay64; /* For 430x SAs. */ } sadb_x_replay_ctr_t; The new extension header contains the sequence number of the SA. The extension header is used to get or update the sequence number of the SA. Once we update a replay counter, we check off the sequence number of the SA as seen, and the SA will not accept any packet with a sequence number lower than the one we set. Also, when we snapshot the SA's replay counter, that value is the highest-seen replay value. New DUMP extension typedef struct sadb_x_edump { uint16_t sadb_x_edump_len; uint16_t sadb_x_edump_exttype; /* X_EDUMP */ uint32_t sadb_x_edump_reserved; /* Reserved */ uint64_t sadb_x_edump_timeout; /* Timeout interval in seconds */ } sadb_x_edump_t; The extended dump message will dump out all the SAs that are active in the interval specified by sadb_x_edump_timeout. The new extension can be used only with SADB_DUMP message. New PF_KEY message types: #define SADB_X_DELPAIR_STATE 15 The new message type is used to delete all SA pairs that are in the state specified and have a source address specified in the request. New PF_KEY message extensions: #define SADB_X_EXT_REPLAY_VALUE 24 #define SADB_X_EXT_EDUMP 25 #define SADB_X_EXT_LIFETIME_IDLE 26 New SA states #define SADB_X_SASTATE_ACTIVE_ELSEWHERE 2 #define SADB_X_SASTATE_IDLE 3 #define SADB_X_SASTATE_ACTIVE 4 The pf_key man page diffs are as below *** pf_key.orig Tue May 13 03:10:28 2008 --- pf_key.change Tue May 13 03:39:47 2008 *************** *** 120,125 **** --- 120,127 ---- #define SADB_X_EXT_ADDRESS_NATT_REM /* NAT-T remote (peer's private) */ #define SADB_X_EXT_ADDRESS_INNER_SRC /* Tunnel-mode inner source */ #define SADB_X_EXT_ADDRESS_INNER_DST /* Tunnel-mode inner dest */ + #define SADB_X_EXT_REPLAY_VALUE /* Replay Value */ + #define SADB_X_EXT_LIFETIME_IDLE /* Idle lifetime */ *************** *** 162,168 **** Lifetime Extension struct sadb_lifetime { uint16_t sadb_lifetime_len; ! uint16_t sadb_lifetime_exttype; /* SOFT, HARD, CURRENT */ uint32_t sadb_lifetime_allocations; uint64_t sadb_lifetime_bytes; uint64_t sadb_lifetime_addtime; --- 164,170 ---- Lifetime Extension struct sadb_lifetime { uint16_t sadb_lifetime_len; ! uint16_t sadb_lifetime_exttype; /* SOFT, HARD, CURRENT, IDLE */ uint32_t sadb_lifetime_allocations; uint64_t sadb_lifetime_bytes; uint64_t sadb_lifetime_addtime; *************** *** 381,386 **** --- 383,397 ---- }; + Replay Value + struct sadb_x_replay_ctr { + uint16_t sadb_x_rc_len; + uint16_t sadb_x_rc_exttype; + uint32_t sadb_x_rc_replay32; /* For 240x SAs. */ + uint64_t sadb_x_rc_replay64; /* For 430x SAs. */ + }; + + Message Use and Behavior Each message has a behavior. A behavior is defined as where the initial message travels, for example, user to kernel, *************** *** 408,416 **** If all other fields must be ignored, this is represented by SA(*). ! The lifetime extensions are represented with one to three letters after the word lifetime, representing (H)ARD, ! (S)OFT, and (C)URRENT. The address extensions are represented with one to three letters after the word "address," representing (S)RC, (D)ST, --- 419,427 ---- If all other fields must be ignored, this is represented by SA(*). ! The lifetime extensions are represented with one to four letters after the word lifetime, representing (H)ARD, ! (S)OFT, (C)URRENT, and (I)DLE. The address extensions are represented with one to three letters after the word "address," representing (S)RC, (D)ST, *************** *** 474,483 **** Send a SADB_UPDATE message from a user process to the ker- nel. ! c - The kernel returns the SADB_UPDATE message to all listening processes. --- 485,494 ---- Send a SADB_UPDATE message from a user process to the ker- nel. ! The kernel returns the SADB_UPDATE message to all listening processes. *************** *** 487,500 **** SADB_ADD Send a SADB_ADD message from a user process to the kernel. ! - The kernel returns the SADB_ADD message to all listening processes. ! --- 498,510 ---- SADB_ADD Send a SADB_ADD message from a user process to the kernel. ! The kernel returns the SADB_ADD message to all listening processes. ! *************** *** 533,540 **** ! SADB_ACQUIRE --- 543,550 ---- ! SADB_ACQUIRE *************** *** 619,627 **** SADB_EXPIRE The kernel sends a SADB_EXPIRE message to all listeners when ! the soft lmit of a security association has been expired. ! SADB_FLUSH --- 629,638 ---- SADB_EXPIRE The kernel sends a SADB_EXPIRE message to all listeners when ! the soft limit or the idle limit of a security association has ! been expired. ! SADB_FLUSH *************** *** 646,652 **** the sending socket. To mark the end of a dump a single base header arrives with --- 657,664 ---- the sending socket. To mark the end of a dump a single base header arrives with Changes to ipseckey(1M) - The following new keywords have been introduced, their functionality is described in the man page diffs below: *** ipseckey.orig Tue May 13 01:44:15 2008 --- ipseckey.change Tue May 13 01:52:23 2008 *************** *** 298,304 **** --- 298,308 ---- not specified, the value defaults to mature. This exten- sion is used by the add and update commands. + replay_value + Specifies the replay value of the SA. This extension is used + by the add and the update commands. + auth_alg | authalg | *************** *** 403,409 **** --- 407,421 ---- This extension is used by the add and update commands. + idle_addtime + idle_usetime + Specifies the number of seconds that this SA can exist if + the SA is not used before the SA is revalidated. If this + extension is not present, the default value is half of the + hard_addtime. This extension is used by the add and update + commands. + After the expiry of the idle time, the kernel sends an SADB_EXPIRE message with idle time as the trigger. ipseckey(1M) does not handle PF_KEY messages. If we do not have IKE daemon, the SADB_EXPIRE message would be discarded. Changes to the sadb allocation - The hook function in sadb will help us manage the cluster-wide unique SPI. The hook functions are enabled only when Solaris is in cluster mode. There will be very minimal impact when Solaris is running in non cluster mode. void (*cl_inet_getspi)(uint8_t, uint8_t *, size_t) = NULL; This will return the SPI value to be used for the SA association. int (*cl_inet_checkspi)(uint8_t, uint32_t) = NULL; This will check if the SPI exists in the cluster wide repository. void (*cl_inet_deletespi)(uint8_t, uint32_t) = NULL; This will delete the SPI from the cluster wide respository. Changes to IP to move the SA from IDLE state to MATURE state - With the SA synchronization, we have copies of the SA on all the nodes of SC hosting the scalable service. But, the node which has the SA in MATURE state will only service the client. When the node which has the SA in MATURE state fails, the new node which is chosen by the global node to handle the client, will have to have the SA state moved to MATURE state. The hook function will facilitate the move of the SA state from IDLE to MATURE. void (*cl_inet_idlesa)(uint8_t, uint32_t, sa_family_t, in6_addr_t, in6_addr_t) = NULL; The IP module when it receives a packet for the IDLE SA, first verifies the packet with the AH and/or ESP and if successful triggers the hook function to inform the SC module about the valid packet. The SC on the worker node then checks with the global node for the client. The global node maintains a list of clients that have sent packets and the node that the same has been forwarded to. The global node will then compare the client against this list to check if the client packet has indeed been forwarded by it. If it matches, the global node sends a messages to the SC daemon to move the SA from IDLE state to MATURE state. Changes to ike.config(4) - A new IKE rule parameter has been added and its functionality is described in the manpage diffs below. p2_idletime_secs *** ike.config_orig Tue May 13 02:26:28 2008 --- ike.config_change Tue May 13 02:32:49 2008 *************** *** 345,350 **** --- 345,356 ---- p2_softlife_secs is ignored if p2_lifetime_secs is not specified. + p2_idletime_secs num + + The idle lifetime of a phase 2 SA, in seconds. If the value + is specified, the value specifies the lifetime of the SA if + the security association is not used before the SA is + revalidated. ikeadm(1M) get command will also be updated to display the new parameter. Changes to in.iked(1M) - in.iked has been enhanced to provide Dead Peer Detection (DPD) as defined in RFC 3706. The Dead Peer Detection method uses IPsec traffic to minimize the number of IKE message to detect liveliness of the peer. The method uses ongoing valid IPsec traffic between the two as proof of liveliness. If a period of time lapses (as specified by the p2_idletime_secs) during which no packet exchange occurs, the liveliness of the peer is questionable and the node will initiate the DPD exchange. Interfaces: ----------- +----------------------------------+------------------+----------------------+ | Interface Name | Commitment | Comments | | | | | +----------------------------------+------------------+----------------------+ | ipseckey(1m) add/dump/ | Committed | Documented in | | update/get commands | | man pages | | | | | | replay_value | | specify replay value | | idle_addtime | | specify idle timeout | | | | after add. | | idle_usetime | | specify idle timeout | | | | after first use | +----------------------------------+------------------+----------------------+ | pfkeyv2.h | Committed | Documented in | | | | man pages | | sadb_x_replay_ctr | | Replay value ext.hdr | | SADB_X_EXT_REPLAY_VALUE | | Ext type replay | | SADB_X_EXT_LIFETIME_IDLE | | Ext type idle time | +----------------------------------+------------------+----------------------+ | pfkeyv2.h | Project Private | | | | | | | SADB_X_SASTATE_ACTIVE_ELSEWHERE| | | | SADB_X_SASTATE_IDLE | | | | SADB_X_SASTATE_ACTIVE | | | | SADB_X_DELPAIR_STATE | | | | SADB_X_EXT_EDUMP | | | +----------------------------------+------------------+----------------------+ | pfkeyv2.h | Uncommitted | | | | | | | sadb_x_edump | | | +----------------------------------+------------------+----------------------+ | ike.config(4) | Committed | Documented in | | | | man pages | | p2_idletime_secs | | idle timeout in | | | | rule | +----------------------------------+------------------+----------------------+ | ikeadm(1M) get defaults | Committed | | | command | | | | | | | | p2_idletime_secs | | | +----------------------------------+------------------+----------------------+ | IKE Dead Peer Detection | Standard | RFC 3706 | +----------------------------------+------------------+----------------------+ | cl_inet_getspi | Contracted | | | cl_inet_checkspi | Project | | | cl_inet_deletspi | Private | | | cl_inet_idlesa | | | +----------------------------------+------------------+----------------------+ From Darren.Moffat@sun.com Fri Aug 15 02:14:50 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m7F9EoIa029752 for ; Fri, 15 Aug 2008 02:14:50 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m7F9EnNw007166; Fri, 15 Aug 2008 03:14:50 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K5M00M05XOPJZ00@nwk-avmta-1.sfbay.Sun.COM>; Fri, 15 Aug 2008 02:14:49 -0700 (PDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K5M00LLWXOO3L20@nwk-avmta-1.sfbay.Sun.COM>; Fri, 15 Aug 2008 02:14:49 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe2.eu.sun.com [192.18.6.11]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m7F9EmkZ004036; Fri, 15 Aug 2008 09:14:48 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K5M00D01XGWDY00@fe-emea-10.sun.com> (original mail from Darren.Moffat@Sun.COM); Fri, 15 Aug 2008 10:14:48 +0100 (BST) Received: from [129.156.173.21] by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K5M006EMXOHOQ40@fe-emea-10.sun.com>; Fri, 15 Aug 2008 10:14:42 +0100 (BST) Date: Fri, 15 Aug 2008 10:14:41 +0100 From: Darren J Moffat Subject: Re: 2008/523 IPsec session failover In-reply-to: <1218750264.2286.32.camel@thunk> Sender: Darren.Moffat@sun.com To: Bill Sommerfeld Cc: PSARC-ext , ipsec-core , Thejaswini Singarajipura , Steven De Tar , Burt Clouse Message-id: <48A54901.5050505@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <1218750264.2286.32.camel@thunk> User-Agent: Thunderbird 2.0.0.14 (X11/20080630) Status: RO Content-Length: 614 I'm missing the bigger picture here, or failing to see where it is covered in the materials. Can someone draw me a simple picture of a multi node cluster using this showing which IKE the client connects to originally and where and how the SADB's are passed between the nodes. I think I understand how the failover happens with the switch from IDLE to MATURE. The part I'm missing is how all the SC nodes get the SADB entries in the first place and how that is done securely. I assume the IKE DPD functionality is generally useful for non SC deployments but is required by this case. -- Darren J Moffat From danmcd@sun.com Fri Aug 15 08:01:56 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m7FF1t84006202 for ; Fri, 15 Aug 2008 08:01:56 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m7FF1jRG035378; Fri, 15 Aug 2008 09:01:51 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K5N00F25DR1QQ00@nwk-avmta-1.sfbay.Sun.COM>; Fri, 15 Aug 2008 08:01:49 -0700 (PDT) Received: from everywhere.east.sun.com ([129.148.19.2]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K5N00CLCDQZYUD0@nwk-avmta-1.sfbay.Sun.COM>; Fri, 15 Aug 2008 08:01:48 -0700 (PDT) Received: from everywhere.east.sun.com (localhost [127.0.0.1]) by everywhere.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m7FF1lB9018937; Fri, 15 Aug 2008 11:01:47 -0400 (EDT) Received: (from danmcd@localhost) by everywhere.east.sun.com (8.14.3+Sun/8.14.3/Submit) id m7FF1k2n018936; Fri, 15 Aug 2008 11:01:46 -0400 (EDT) Date: Fri, 15 Aug 2008 11:01:46 -0400 From: Dan McDonald Subject: Re: 2008/523 IPsec session failover In-reply-to: <48A54901.5050505@Sun.COM> To: Darren J Moffat Cc: PSARC-ext , ipsec-core , Thejaswini Singarajipura , Burt Clouse Message-id: <20080815150146.GA18920@sun.com> Organization: Sun Microsystems, Inc. - Solaris Networking & Security MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <1218750264.2286.32.camel@thunk> <48A54901.5050505@Sun.COM> X-Authentication-warning: everywhere.east.sun.com: danmcd set sender to danmcd@sun.com using -f User-Agent: Mutt/1.5.17 (2007-11-01) Status: RO Content-Length: 1406 On Fri, Aug 15, 2008 at 10:14:41AM +0100, Darren J Moffat wrote: > I'm missing the bigger picture here, or failing to see where it is covered > in the materials. > > Can someone draw me a simple picture of a multi node cluster using this > showing which IKE the client connects to originally and where and how the > SADB's are passed between the nodes. SAs will be passed between the nodes via the Sun Cluster infrastructure. When clustering is enabled, various PF_KEY operations become cluster-wide ones. ADDs, GETSPIs, and UPDATEs affect all nodes in the cluster thanks to a combination of in-kernel hooks and augmentations of in.iked(1M) and ipseckey(1M). > I think I understand how the failover happens with the switch from IDLE to > MATURE. The part I'm missing is how all the SC nodes get the SADB entries > in the first place and how that is done securely. The cluster interconnect is a private LAN and is assumed to be detached from any other networks. This means, of course, if you compromise one node, you compromise them all, but clustering is all about redundancy and availabilty, not security, so I don't believe there are additional vulnerabilities being added by this project. > I assume the IKE DPD functionality is generally useful for non SC > deployments but is required by this case. Precisely! You'll have to ask Thejaswini for details beyond what I've mentoined. Dan From Robert.Gordon@sun.com Fri Aug 15 11:16:13 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m7FIGCIj016161 for ; Fri, 15 Aug 2008 11:16:13 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m7FIG5c5005744; Sat, 16 Aug 2008 02:16:12 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K5N00D03MQYC100@nwk-avmta-1.sfbay.Sun.COM>; Fri, 15 Aug 2008 11:16:10 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K5N006CUMQYV340@nwk-avmta-1.sfbay.Sun.COM>; Fri, 15 Aug 2008 11:16:10 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m7FIG9Lp018413; Fri, 15 Aug 2008 18:16:09 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K5N00I01LVIUJ00@mail-amer.sun.com> (original mail from Robert.Gordon@Sun.COM); Fri, 15 Aug 2008 12:16:09 -0600 (MDT) Received: from dh195.macrbg.com ([70.112.150.36]) by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K5N004Z5MQUHEA0@mail-amer.sun.com>; Fri, 15 Aug 2008 12:16:07 -0600 (MDT) Date: Fri, 15 Aug 2008 13:16:06 -0500 From: Robert Gordon Subject: Re: 2008/523 IPsec session failover In-reply-to: <1218750264.2286.32.camel@thunk> Sender: Robert.Gordon@sun.com To: Bill Sommerfeld Cc: PSARC-ext , ipsec-core , Thejaswini Singarajipura , Steven De Tar , Burt Clouse Message-id: <8302CC31-C171-41F1-9086-B6E92FB89017@Sun.COM> MIME-version: 1.0 X-Mailer: Apple Mail (2.928.1) Content-type: text/plain; format=flowed; charset=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <1218750264.2286.32.camel@thunk> Status: RO Content-Length: 316 On Aug 14, 2008, at 4:44 PM, Bill Sommerfeld wrote: > The hook functions are enabled only > when Solaris is in cluster mode. Is that a programmatic interface ? Could (from an architectural POV) this feature be enabled with out the presence of SUN Cluster, and if not why not ?? (I'm just curious..) Robert. From danmcd@sun.com Fri Aug 15 11:18:37 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m7FIIbAH016401 for ; Fri, 15 Aug 2008 11:18:37 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m7FIIXD5036848; Fri, 15 Aug 2008 12:18:34 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K5N00D0NMUWJV00@nwk-avmta-1.sfbay.Sun.COM>; Fri, 15 Aug 2008 11:18:32 -0700 (PDT) Received: from everywhere.east.sun.com ([129.148.19.2]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K5N006IAMUVV340@nwk-avmta-1.sfbay.Sun.COM>; Fri, 15 Aug 2008 11:18:32 -0700 (PDT) Received: from everywhere.east.sun.com (localhost [127.0.0.1]) by everywhere.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m7FIIUC5019373; Fri, 15 Aug 2008 14:18:31 -0400 (EDT) Received: (from danmcd@localhost) by everywhere.east.sun.com (8.14.3+Sun/8.14.3/Submit) id m7FIIUa6019372; Fri, 15 Aug 2008 14:18:30 -0400 (EDT) Date: Fri, 15 Aug 2008 14:18:30 -0400 From: Dan McDonald Subject: Re: 2008/523 IPsec session failover In-reply-to: <8302CC31-C171-41F1-9086-B6E92FB89017@Sun.COM> To: Robert Gordon Cc: Bill Sommerfeld , PSARC-ext , ipsec-core , Thejaswini Singarajipura , Steven De Tar , Burt Clouse Message-id: <20080815181830.GG18920@sun.com> Organization: Sun Microsystems, Inc. - Solaris Networking & Security MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <1218750264.2286.32.camel@thunk> <8302CC31-C171-41F1-9086-B6E92FB89017@Sun.COM> X-Authentication-warning: everywhere.east.sun.com: danmcd set sender to danmcd@sun.com using -f User-Agent: Mutt/1.5.17 (2007-11-01) Status: RO Content-Length: 741 On Fri, Aug 15, 2008 at 01:16:06PM -0500, Robert Gordon wrote: >> The hook functions are enabled only >> when Solaris is in cluster mode. > > Is that a programmatic interface ? I'm not sure. You'd have to ask Thejaswini. IIRC, the kernel ones are function pointers only initialized by the Sun Cluster kernel initializer. The user-space ones are done some other way. > Could (from an architectural POV) this feature be enabled with out the > presence of SUN Cluster, and if not why not ?? (I'm just curious..) The migration(s) of SAs cannot happen without Sun Cluster. IKE Dead Peer Detections and changes to support it would work even on a non-clustered system (and will be tested, BTW, on punchin servers prior to integration). Dan From Thejaswini.Singarajipura@sun.com Sun Aug 17 22:41:02 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m7I5f1MC012353 for ; Sun, 17 Aug 2008 22:41:01 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m7I5euk7011356; Mon, 18 Aug 2008 13:41:00 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K5S003057SA5P00@nwk-avmta-2.sfbay.sun.com>; Sun, 17 Aug 2008 22:40:58 -0700 (PDT) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K5S00LO67S8DT30@nwk-avmta-2.sfbay.sun.com>; Sun, 17 Aug 2008 22:40:57 -0700 (PDT) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m7I5etr1003292; Mon, 18 Aug 2008 05:40:55 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0K5S00M017OZ3W00@mail-apac.sun.com> (original mail from Thejaswini.Singarajipura@Sun.COM); Mon, 18 Aug 2008 13:40:55 +0800 (SGT) Received: from [129.158.239.163] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0K5S0079O7RXXJ34@mail-apac.sun.com>; Mon, 18 Aug 2008 13:40:51 +0800 (SGT) Date: Mon, 18 Aug 2008 11:27:25 +0530 From: Thejaswini Singarajipura Subject: Re: 2008/523 IPsec session failover In-reply-to: <48A54901.5050505@Sun.COM> Sender: Thejaswini.Singarajipura@sun.com To: Darren J Moffat Cc: Bill Sommerfeld , PSARC-ext , ipsec-core , Steven De Tar , Burt Clouse Message-id: <48A90F45.7060607@sun.com> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_YpITjf2RQlDHg5/bz3bZtw)" X-PMX-Version: 5.4.1.325704 References: <1218750264.2286.32.camel@thunk> <48A54901.5050505@Sun.COM> User-Agent: Thunderbird 2.0.0.9 (X11/20080213) Status: RO Content-Length: 73871 This is a multi-part message in MIME format. --Boundary_(ID_YpITjf2RQlDHg5/bz3bZtw) Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT Darren J Moffat wrote: > I'm missing the bigger picture here, or failing to see where it is > covered in the materials. > > Can someone draw me a simple picture of a multi node cluster using > this showing which IKE the client connects to originally and where and > how the SADB's are passed between the nodes. Attached below is a diagram of a 2-node cluster and a brief description of how the client connections are handled. > > I think I understand how the failover happens with the switch from > IDLE to MATURE. The part I'm missing is how all the SC nodes get the > SADB entries in the first place and how that is done securely. The SADB is synchronized over SC private interconnects, which is a private LAN and is detached from all other network. Hence I do not think we add any more vulnerability by this project. > > I assume the IKE DPD functionality is generally useful for non SC > deployments but is required by this case. Yes. Regards, Thejaswini > > -- > Darren J Moffat > --Boundary_(ID_YpITjf2RQlDHg5/bz3bZtw) Content-type: application/pdf; name=cluster_overview.pdf Content-transfer-encoding: BASE64 Content-disposition: inline; filename=cluster_overview.pdf JVBERi0xLjQKJcOkw7zDtsOfCjIgMCBvYmoKPDwvTGVuZ3RoIDMgMCBSL0ZpbHRl ci9GbGF0ZURlY29kZT4+CnN0cmVhbQp4nJVWyYrcMBC9+yt8DrhHpZY3MAYv3ZDc BhpyCDllg8AkZC75/ZSqSmVJds9MaDB2W7W+V69sTlD+Lf6UpqwM3jZg8dr2/vr8 rfz4rvxFL/3v+Ucx34q6OXVlC+Z0Lm9fy4crlGDL2/dPg4HRDsaa81i1g3Gm9o+N XlrTjdV5ML1/mMaqH8w8gjzT2cWsY9V50ws6AbFbzJXsHBg6BsAv2ZtjJ8FwCW8n vCGn9CQe8LXFq918cnTLpxxI1KoZIuOVD6XxwElE/wg11JwsJcgN2BenLugPTrnX MBO7YmP620mWdJwTlaBkIMfB54+lJaVM0Iyfbx+Ky614PMIP6m6HH7RjRThddrU4 TP6s9XBWCwbp0mLydspLStRQgegMpDaHf/hzEFLW9tCB5dDjJEk62BrHZnyVUDFB 0H/CI84XTEq1qDB6FuQd57xRwybM2CB0L7fbuVOdjwtHs6HPsMFbx3zz7mFGgm3n OCcdLZgJ/zbmKR12OovaxbyYZCoFh0OOSzNSsuOggHLxcJInjLDiL3SdMl3/MyMk M3l7ucfQnPqc0otnS5QizzbdCstDh7oN+6AdsDHBwZrjkujOf6iAWFzHmsHXHlpt VwixaNM1QZzOsRvibHsqKWjbsuEn/OC3K753qXCywZwo33H/SaxdzKyeTzasTNpT UYlFnTA9oXkFu67fq9FFxjcePB8o1mTVkCtGjIqTnkTArzLqbwAbvDZdaKhkDmbd LjZXpKPG5pw/UrKYMWHdJKOkOwhJ4PuXbddNCdmTF9sppNFoLtbwCKDhzMPNFd5F 49yd2j0cfvZuP+/C19Y7dWP40rRUpi0ouXUMcg18c7d0XeqadfEKz8m8ZmvG2nyw /edBZqVKmGkXjU4dr0yd5jeuzFjlbPwFEH+RMHRZEksIQLy8C6gzCOgOoFcAbQCN snWVCjZ9jslevcTaGqrbVeZXfySoOjjkzhpUNXsmzkzWecoSScIiurM2QgYLguAk DwoCXbxKX03GhlpsbUHULhLfRElTYmafXWK7FwUqMKGBGNwdRI/bDocUN9d0+Jnu jfgOsWtL6P2n3Zen4uH9kyvX3+Vj8Vj+AwB+iMwKZW5kc3RyZWFtCmVuZG9iagoK MyAwIG9iago4MjIKZW5kb2JqCgo0IDAgb2JqCjw8L1R5cGUvWE9iamVjdC9TdWJ0 eXBlL0ltYWdlL1dpZHRoIDkxOSAvSGVpZ2h0IDgzNiAvQml0c1BlckNvbXBvbmVu dCA4IC9MZW5ndGggNSAwIFIKL0ZpbHRlci9GbGF0ZURlY29kZS9Db2xvclNwYWNl L0RldmljZVJHQgo+PgpzdHJlYW0KeJzs3b9rJE96x/H5Jy61Q2MMNubLGmS40IYD GwWLgwsMFyzHJg4cKNl8IuFI2CDMBYoUTWI2sAKDAgUOBBOKwZFQuhOu0vHjedjH tVXdNdW/qqt63q9g0Y56eqpb1d2fqa6uOhwAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAADOzgoY1dw1GgAAnIW5Iw+WZu4aDQAAzgLBA2OhLgEAgGwIHhgL dQkAAGRD8MBYqEsAACAbggfGQl0CAADZEDwwFuoSAADIhuCBsVCXAABANgQPjIW6 BAAAsiF4YCzUJQAAkE2ZweP5+fn29vbz5882hP7FxcWXL1/u7+9fXl5ssW/fvsl/ 5cWPHz/OWFqoMusSAABYpNKCx+vrqyRSKZKEWImy9vr379+/fv0qUdbyqiwpsVYX DjdBfpuv0DgqrS4BAIAFKyp4PD4+annkh8gC7isvLy/hJkjclVck4k5Y1iOisquo ugQAAJatnODx7du3i4sLKYxE0Mhisozbo6AxxEp8zbNdUpipP6Ii5dQlAACweOUE j9vbWynJ58+fTy7mttM2htjn52eJl/EwPFzYLHzmyqlLAABg8QoJHt+/f9eSdE2e jSHW1tm7MCeXeX191Xbjfh+xSIXUJQAAcA4KCR6WRbv2Mm0MsZJCHx8fP3786HY8 UBKSbdAD+cHLzPr4mLYGPz8/25LX19duwbTR2JWh/235CqlLAADgHBQSPPRRrB4l CUOsdYgVXojVUGrBVT9UEqn+9/7+3t54e6RNsvq6N4pXpAX4bLFDAABANoUEjxFD 7OH4jFgYYr3Iqq6vr93FrBjyui1jXR1ktfHPPXPsEAAAkE0hwWPcEHv4sV1uiNUR Zb3uCvpwlkVWW5vXLTZcGyE2xA4BAADZFBI8bIRYt7UzRWKItbbZxrdbV4H0SEyI DbFDAABANoUED8uE7ixdnd7ove7FTlusTae1RZY8Z+wQAACQTTnBQ0es8vqsntQ1 xI6ytvQVnhV2CAAAyKac4KHjVkmUjQ/Tqh0DbJmu3QniKyfEDsEOAQAA2ZQTPGza WXdkgNCXL1/u7+/tv10f7Ip3VyDEDsEOAQAA2RQVPOzxLhuj1SWvyOufP392f5Ue O3UAhHBWgtfX13B0gpNrI8SG2CEAACCb0oKHhENtMpV/7+/vX36Qn+UVSZteuH1+ fg77CdjIrm67q7yokx3ISmwMBFlAVmvjbtnavFI1rs1NtuHUYGeotLoEAAAWrMzg 8fj4KFFTexdooJX/ekFRkueXL1/cZbSbgbyoMXh17GHrNr3arLL229vbWwu0mpP1 V7KMJlv5111eCuYWUpfX9cR7256DMusSAABYJIIHxkJdAgAA2RA8MBbqEgAAyIbg gbFQlwAAQDYED4yFugQAALIheGAs1CUAAJDNChjV3DUaAACchbkjD5Zm7hoNAACw EMQtAAAAVIcQCwAAgOoQYgEAAFAdQiwAAACqQ4gFAABAdQixAAAAqA4hFgAAANUh xAIAAKA6hFgAAABUhxALAACA6hBiAQAAUB1CLAAAAKpDiAUAAEB1CLEAAACoDiEW AAAA1SHEAgAAoDqEWAAAAFSHEAsAAIDqEGIBAABQHUIsAAAAqkOIBQAAQHUIsQAA AKgOIRYAAADVIcQCAACgOoRYAAAAVIcQCwAAgOoQYgEAAFCs3W63adIWYhsXFnNv BwAAAM6IhNi2vJru8vJy7u0AAADAeZEIOjDE3t3dzb0RAAAAOC+RzgOJ9vv93BsB AACA8yIRdEiC/fTp09xbAAAAgHMkQbR3iH14eJi7+AAAADhHT09PvUMsfQkAAAAw i/f3934Jdr1ez112AAAAnK+bm5seIfbp6WnuggMAAOB8bbfbHiH2/f197oIDAADg rHUdMPbm5mbuIgMAAODc3d3ddQqx2+127iIDAADg3HUaMPbDhw9zlxcAAAD4P+kD xtKXAAAAAIVIHzD27e1t7sICAAAA/ydxwNjLy8u5SwoAAAD8v/V6fTLE3t3dzV1M AAAA4P+lDBjbdarZ9/f33dHT09PGcfWzDx8+aDOv/leisizz8PCg72VMWgAAAERo mGzz6dOn8C0Say2jSvjUFBo+JiZrdlOrLrBerzXTSn62lWiDsCzgjl4rb7+5uZFl 8u8TAAAAFC4+YOwf/vAHSZsWVr2QqelUQ6lmVImdjU+B6UNkjaMcyPKaV90XNd/q OuVDZf1dG4QBAACQh8S5XcC7KW+sSdNuwfeLefKhJ3sUWDuqpE3JtGFMjWTU+G8b E6yR1+W3kp+1uVg2WVbVYxsBAADQyfv7u+QuSV9ej9CTudFYr1GjzaH2ejiBbPiW iMhH//M//7NthYRYSZJdW1njv5VfnUyw9okSnrXXgcZaGmYBAABGJxFLs6umQWs1 tbZTsTr2AnUbXe1pJslv8tvGVkdtupQ3ho8+yYdqe6k+JOXRbgOygPe6hMM//OEP jSFWCzBdgo280Uuw7jbqztG9So9ZAACA4SRiSTq1R5z05nuYNiNB9NA3wcbfqEG0 7Y3/9V//1Rhi34/KSbAHp/uB7FhtRr68vJR9zmgGAAAAXUmyuru7s6eQJGLJv/EY Vk6C1Tz5+9//3kuwssL8CVY+MSXB2ivaMPvhSJNtY2EAAABgdrudZFfroSo/a/Q6 GcNyJljtYxBPsE9HXoj97//+b31jzgQbycyRR8DsjasfA3ORZgEAADwSkDSmahfT h4cHN3SlNCRmS7DxN1qC1f+6A8b+8ssvJ6NvPMFuNptOb+ydYA/OPrfH6CzNyn95 BAwAAJwtNx2tjkNOSXYN01GnW+HeG+dNsLYq9dd//ddDEmxjeaZOsN4KbZhZ6+NB oAUAAGdCH9Sy7KptlUMeR2p74+wJ9vDzgLG//e1vC0mwnYbh8jZH3yg/6B/RJrqV FzebTe+RdQEAAMrkDjJgfSyHP1AfeWPOBKtjbTW+8e/+7u/kV3/8x3+cHn1Tfjsk wY67zzXQuh0ndN4x2Sc6ZwSjHAAAgOroIAPug1r2fFDOW+HuGzMPYvCb3/xGfvvv //7v4W8XkGDtjVZUmxAtPqOuVAOabQEAQGnaBhkwZ5Jg5V3/+I//KAu0zSrblmAj TbsFJtiT7d6WbGW7Gic10xd1Rgmb81c1figAAMC4dFRSa3xrbGo7hwTrDsMVjioQ T7CR1U6RYGfc55pXt9utNs/qVMLhnL9hc24K7abr0lTcWFoAAHDOtG+kDS46bpqS +DEkTUlAKnMYrvTVLizBJu46t1W20xTA8ikWaN0uu0bSctgCTMQFAOCsyKXfAkZk aq0Cb4WTYEtOsOlvTJl+Qv+73+81Ektq1eiradZtAdZXtC1Xu+827gQAAFAviQ2a BOSir21lJNgFJFhJbgOH4Sq/3btx7mCNuDaSho2La50ZNNbSYAsAwNR2pwx5QlxH HNXneiZKU4tJsJFnteKrPRnD2OdjJVjvjbYhsow+myZ/RDfWuiOJNW4yAABwaWOR Pu7tdvyLPxSTzntARnsMeo+KSxn0GXP57fuRXNzl07OlKXmj9nWs/VZ4/Lck2LkS rFTstjfKh26PdCQx63Cr7bQEWgAAtP1Hr5U6NpGXUcNHsOX6+/DwoLdBG0coCiOB 20Vw9fOjMUo+xW190s/VH6Q81gbbY05VOnPGf7ukBFvO9BMp1bXrPrdBOewIJdAC AM6E3a+0gYa80Cgv2gPUGinzN2q5AyJZqNZ3kWDzJ9jM7d7L2OdTJNjDz7tOlpRj xO14IEeKHDvM7AAAWAZt+dTOABZW9ckRvfbJrxqbcaq7LZszTVU0DFf8txXtcxJs ZNdJcNVO45GJPwAAKJnestdWVrvhKD9o+6o7hk9pHQu1j0HvSBCO83+o8Fb4RAm2 7Q47CXaKfe5OPxH+NmWfD9x1bz9PwSxvsSmYAQAoh1wxw+c+5IomqXXVPhFASiRo bJ49h0at5SXYyIZUkWDPdhgu741dd509FKmnAnk7bbMAgBk1plZ9tF+udHqRWkyj Fgl2ogQr9WfIPn94eGh74znv86ISrPtGOWm4A9LKz40fBADA6PQJDrkYWQ8Bja+N TSsk2PxpqrRhuOKrXcY+P5Bgu+86WVJ3mv6KbgYAgInIFWez2XiPHsuLc3UslALk vC0rib3wSJDyRhIsCTbzMFyHtH2uPQ3kKJOTDA2zAIDh5GoiFyBrLdGnjN0GEyIB CTYeRCNtwtMlWKafqPFew36/lwSrwxpor4PwLQAAnCTXF72gaG8BCa7hNYUEez4J tke7d7w87HMSbOMb9Yuz9TEgygIA0rnxNTKkAAmWYbhIsMtIsAOH4Zqoutq4fPIF iinAAABxFl+FDu2Y+XGkIWlKm4vb3niejVon33ggwZ799BMD9/nU1VX2pHaXJcoC ABq58VV+sJaZxnt5NGqRYPMnWIbhOsMEa4iyAIBGclHQRld9Lri0Ri0S7ET7fL1e D9nnjVliogS7jH1+IMGONIgBURYAIJcGHW/Hbl+SYIe88cyH4SLBLibBnhyGK74H Jt3nEl91uyTKMrQsAJwna4C1C0FKJJCrW/ir6SLBkARbTiQgwZ55gn1f1jBcMyZY s9/vLcrSKgsAZ8VrgD1UFQkOJNizT7C0e59zgnXfqCMY3DAYFwCch/A6RYItM8Fm bvfut89nSbBn/q2hugQ76fQT2+1WoyyzfQHAsumVsdIE+84wXEUm2LaIQoKNvLGi YbgGJtg8+/zh4eHDUWNJAAC1C6+MA8c5F/mfUF5Go9ZiEmzOXRd/I9NPnG2CVXI2 +/Bjqq/wtwCAeoVXxsU0apFgJ9rnkWG4TibYDy3DcLHPSbCTniK0SbbtowEA1dGx 4kmw4RszNyQObPcuZPqJlARbyD4nwU6UYEuefkKf+2vr5QIAqIicyb27pYtJsE8M w0WCXUSCjbd7p3xTG7fdO74h5e9ze5GxZAGgXnoyv7q6slfi17WT45zPfnlKeeOB BDtZu3dkbKuiEmy8qHXt88z3GmpPsEZn+Gps9QUAlE9CqZzh7Tb0OTRqHc4pweYc huvkHjiTfX4OCbat78p0p4iJhuHSHMuECABQHTl1ywncbqiRYFMiQc40VdE+J8FW l2Alv41b6yrd57JY43c9AEDJ1uu1dSToHQkYhosEu5gEyzBc55ZgD8e7UbJwuBgA oFgSPq0ZlkYtEuwUCfad6SdIsMWfIvSGVOOnAADKdHd3d3l5eSDBVpVg3wobhiue YJexz0mwEyXYcobhaisGAKBMcp6XiwgJdrvdDklTskDOBFvUPifBFpVg36cZhmui BFvUPr+6umrbMwCA0khy074EU0QChuEiwS4jwZbW7p3/XsM5JFjv+VYAQOHkZH55 eUmjFgk2c4J9YvoJEmx5pwh3oGwAQOHkbC9n9XO4POVPsB/yDsOVv917SILlWwMJ NvLGWaafWDFOLADU4+04z2xFCXaicc6X/QjYpAm2cYhREmzKPs85/UTvfT5Lgp3l W4P8dr1eh78FAJRJxyVY/OWJBDtRgh19nw9s92YYLhJs7wQrGvstAwDK9Kllhpol XZ7OOcFONP3ERAl2GfucBDvRPp9u+glNsI1rBgAUq/FRXBJs5I0Mw0WCXUaCjbd7 n0ywi2n3lt+2dVICABSrcXqa/GmqnHHOh7zxcB6dOUmw8TcObPcuZBiulARbyD4f nmAbO3UDAAon6VEn6jJLujyRYKdo986cYGn3JsFOmmAb+xgAAMq3PrL/LunyRIJt e+PAYbhypqnF7HMS7ET7vN8wXPKijozNaFoAUC+3Jbaoy9PABJt5GK6rq6sF3Aov LU2RYJ+yD8M1MMGWv881vupepQsBAFRN+8Tu9/uTl6e2bmPlXJ4O5cUwEmyBCfZD 3uknKrrXsOwEa/FVVss4WgCwDKvjTAdVX55UaTGsogSbMgxXZA98ahmGi31Ogs1/ igiH4ZKv6vIdnPgKAMsz5FY4CbbtjXLdHJKm1ut1Ue3e8QRbyD4nwU6RYN9rnn7C 4qv8S3wFgOUJByhQpSVYhuEiwS4jwU40/cRECbbGfS6L6USEGl95egsAlkpO+OG1 L+Xy1HhpoFGLBJs/wTIM15Dwv6QEq9uyOk5eIF97aX0FgMXzroBlXp5IsBUlWNq9 a0mwbeWpKMFqh4fVkSxzd3fX+NEAgKWy62BRl6f4GytKsO9VDcM1MMEWss8PJNhp EuxT+4QXh4z7fL/fy8IWX+WHxs63AIBzoFfDIZEg8zBc/cY5L+1WeJkJNjI26Tkk 2A95h+EaOP1Ej30+JMHO+K1Bfn54eFiv19rf9cPxEUh5V+POAQCclcgVikat80mw U6SpzNNPVLTP899rqC7Brn4MA6idXSW4SpSlzwAAwKPXKblkuM9tkWALTFOjt3tH dh37nAQ7abu32xNgv9/Lf+/u7nR0LA2uspgUgAe1AABxcqXQy8d6vU6ZzKucBBuO c25SIsFms2l7Y0W3wkmwC0iwEw3DNUWCHb7Pt0dy9Gm/cQ2u8rPkWHmdrgIAgK52 u512PBOR0bTSG1i8Ny6gUYsEW1GCXdj0Ez32eSEJVl7cHckuXTk0tT4dR3kNVwUA QFebzUYuQ5JmvThaUaMWCbb3U0XxNzL9BAnWe6O8ogFV3qWnDk2nbhOrkffKaqUa MBkBAGAi7z+GYZQrkUbZ6hKstglvjuSH3Q9FJVh543q9HnJbluknSLBTJ9j9fi/V TI+mTz+mFbDOq0b7bAt5rx53sio96OgeAADIzGYhl2uWXqEaFyshwVpDkBTSekRo y094tV39eGzEfd65tFvh1X1rIMGOvs97D8M1MMHqTvAOJcuoUirNqPbFMFwPAAAl 2O/3Evb0ciaXP/nZfV54rkggxdDHmbVpyC6yeoWVC2vbQ8162XVHntQGZxLsLAk2 8zBcFU0/0Xuf90uwcrxoX5HVj7FY5b96358OqwCA2sm1TCKi9Xl7Ok6dkzPB6rAJ boOqFEMja+/7lToHkGyXpfSnn8dRry7BZp5+YhmPgJ1tgpUXJalaJwE5EGhZBQAs 2Ha71cu6pj7tdOpeGUdMsDbRpNtqqsF10u3SocaeTk1lxa1wEmxFCdZt95YjSD9I 3iI1nOZWAMD5kMuixku306n2QdUraWPOPDkMl5CM6g57PmlwDel2WWbmgfplJ9jF DMN1MsHar6x66/2Upu0GAOCM6CPMEjU11troOvogs9K7ltrdzoRjnutbwgbezCS+ fmgaaowEG38j008Um2AtvsoHMRMWAABtdABJiTRuZL36mcZafSBLnyIpajQed6gx bQeubhiuzGmKQQzKTLD6bKb2HCC+AgBwJmyoMRvEoDEGFNiZkwRLgtVbG9q1u6hv iAAAIA83yoa9cwtMsPJbEuyyh+FKSbBaY2l9BQDgzDVG2TITbCEP1MsbLy8vF/AI WGn7PLENliGzAACAcaOsDhE/3TBc4XvljUPSVDm3wkmwoyfY/X6vgzm3tcMDAABI lF2v1+4gYNvt1kJFjzSls4nZDPWN3HvE+oklTKBGgo28cfTpJxp/a7Xx8vLy4eGB 7q8AACDO5vyyePnpOFiuPk2j44lJ1NSAquOJycIrZ4Z6d3gxe7tN+qljlxkb7cEd Slc+a30kP1eRYBmGa5QEq195rBrID40jMAMAAJykucLGyw0zqjvCmCyjC0uY6T28 mCZbWdUnZ/JQN1alNCRGpp/gEbDSEqzbIC9/blmbrIpHtwAAQL0kyeiIoJpztC23 qM6cAxPsp+M0x2a9XuvXAd1kd2YNV/j1wTS+UdvPrcHcvmW4pkuw+p3CPkjb+b0J 7OQVgisAAFgeiUP6gI8mtLY8WWyC9SaA8/paGNnGzQQ0NLrctvQ23sLWzO6lbg3G YZBuowtrai1tNhAAAIApSOCR4KSNe/KDm3+KSrA6DJc+kaTTk1lktU7FM05A3EjK 47XNennV7U/i8Zb0mnlL21IAAIBZaJTVWUc3x0eiChzEwBoeJbXKYgQ5AAAAKGuV LSHBaocHfUBJP5Qn6wEAANBov99rt0z513ssKE+C1exqj1N5AykAAAAAbXa7nQ1j q+2fUw/DVV121TEBtM8qXVUBAADKIaHUHpYX8nPjYgMfAdMntmrJrq7NcULhkI3H RcoFAACYy36/18e+dJAor8NAjwSrky/YhLw6smulAU/2RsrgWqRcAACAubgNs5K+ Usbz1wQrP0vYsynDVj+mwZUou4DR+L3BE0bhpdzGnsYAAABVkNAoqUb+nbcYEkol fFocXf2YX8Adrt/G87d0pwPya5Pj8kbj14kYxs2xrrauyAAAACXb7/c2KdXl5eXc xfl/Op6/N4OVO0mWzo66gObWkyTHahffKZzDDgQAAEsi6SWMRjofAQrU9qjXEDTD AgCAiugsWm3BhieAitXvUa8ImmEBAEAtdOasSLD59OnT3GVEqxEf9Wob1gwAAKAo T09POphVnGQkGuhKNtajXrM/xwcAABAncSUl9kh83Ww2y3vAf3mGP+p1dXU190YA AAC0ent7s8EH4iQUEV/rMuRRL5phAQBAmRoHH2i0Xq/pP1Cp3rN6zV1wAAAAX3zw AVcJExxgoB6PejFLFwAAKIrG15RIc3l5ud1u5y4vxtHpUS+aYQEAQFESBx+QZWiI W570R7346+f39evX+B/ly5cv19fXj4+PAz/o27dvz8/P9/f3FxcXiW95fX2Vz729 vU1/C8b18vKifwKpBnOXBQBy2+12iWNnMfjAsp3sRiJ1YO4yni+Jl/aHkJ9ffpCI KwlWX//48aOkyn7rlzd+/vzZPiLlLZKaur4F45JvHPJHt+8ycxcHAPKR+Jo4+MDd 3R3x9RzEH/ViWuF5ReKiRNCLiwv5lfz77du33h9hoXSUtzw+Pkp5JGj1Lg9O+v79 OyEWwFlJH3xAFmPwgbPS9qiXvMgXmXlFQuzB6XUwJDRKEOoaYiNv0VwtercPz6Wu QEiIBXA+7u7uUuIrgw+crcZHvWiGnV08xFqL3OfPn3t/xLgh1u50D2kczk97bsxd ig4IsQDOx8muj5eXl8TXMxc+6kWD/OziITZlgZPGDbGvr6/X19eSCXuXZxa6RXOX ogNCLICz0vYkF4MPwGXfdyTQzl0WpLbEfvz4sfdHjBtirWC9y5Ni3PXf3t4O/CIw hfg2EmIBnJXdbufFVwYfQCN91CtPM6x8Ct+hIuIh9vHxUX8rMcxe/Pbt29evXxvH v3p9fQ3HZbJEKqlJ3mgPbckP8t/GKBUJsc/Pz5oJGwssZbu/v3c/QhZO7z0rhZFN lk+Xgh2OI03ZKA3yYmPzryzvjuQgn+72c9DH0MKv9rJmdxAG71E1HZHMfuvuT3fA h7CPh6xWttd6XMgP8l95sXExXa1sqSwmH6ebbMKPllJZkYZ0LwGAMrk9Y4mviMhW N7QDg2RmqZxvb295PrQikRAric7rgCoJyl7x3uKmtbYQK++VpKSrshQn7wpDZmOI tRfbCqyPoWke02xspUoZ8NYNaZLx5C1SYB15zGKqm2PlI7RI8lvdKP24cIvaMrm1 0IY5U1aov/Kypa1QPtR9RQqjhZS9aoWUH3Qny6+8HWLJWftmhFvX+KfUuBuWFgAW QJLJ5eUlgw+gEFIhvVERPn369PT0xNcr05gJJaVYY6D86yU3y7HeqiS5xUOsF35k VfoRYV+FttQX+XQbSMH7FHv9xI74eROkYBL/rJXYiupGR42gXuH147wX2zbHkmo4 +IOVJGzz1D4e3mZqYaSQXst2WHJ3H9pfSksYD7H6ESRYAAAykLy6aiLJVr5q0TB7 cEJsSOKThKvwdn/kXn88xIbLW+On11IaeUvjrywNut0eTKeZpyzEeqMfeJ8rWa6x 5NaL2H395OaEMd7tUeCVRDsAuK9YYRqbbcN4b+WxNUuxvdZj70+pHUuGz+AGAABS nJw2joZZ2xUvjngn0hFDrKUv7+Z41xBrYXj4qAWNmxB+rvUECEf6sjv4KZtjvY69 kktMtVv/XjTVvsTuK5FuCQdnJ1vCT3nUzt0PugYmmAAAII/wScM259wwazsh/S0j hlh7S+L997Zfuc+OpW9IpDwnQ2ynxtX4HtCk6rYhS6DV5+bCHgva5uwl55Nzoulv rWdCpxBrE7dVN7sEAACVkhAbTq8Qd3l5+fDwcFYNs4WE2LZQmvjpPbaiTWKITalO KZtzcJqRLYHfHh2cnrEWIL9+/RqW7eTmewukh9jPR237BAAATOft7e3m5qZx0tsI ecuZzM1xMv+ECLFdPzG+ByypWo9T92E6fQjLbuVrN4PGMkcK4y2QHmJXxyZi61Xb 2OcWAABM5/39/enpiYbZUI/4N2KItceg0t9SSHeCk3fwT5bZpWvT2/0SX93+A9pO q69o3A23cbruBPYWzdLh824AACAPGmY984ZYe+bIe2ioa4i1J5vyP9iVMuTUydBo j3dJRLy+vnb3hrXT6gwFjcMv2DC28Qe77Fmzrg92Na4EAADkN6RhdmFjIM8bYq07 aOLsAG2/Ch/A96S3HyaGWJsgoPGZ/e/fv7txOmUWXXu8K9wb2tAqv/LG7DWWgeND bFk/hB4h9jDqEBAAAGCgfg2z6/V6u93OXfZx9AixFoq8MGONk20h1stmEizDGQS8 t4Sf3vartk85HBsz0+eZSgyxhx/ZsnHGMdkVbri1ltLI59reC2c3sB0eDifrFS8y 2YG72n4h1p2cYni3DQAAMNz7+/vDw8PJQWU9svxms5m77INYC96qyzM7Fj4tGerE rBbVvBimkUn/DaeddSfGMt50tym/sklg3WlnZRmdGiBxlH7roxsmSet36k7jZTnW 1i/B/suRu1FeS6lse9iYGZmwIDKxV7j5jdPOeuWxbWlroG7bD9b+3NbiDQDpOt3Z lCu1XHOfnp6mKw9Qtd1ud3Nz0ynHzl3knqxxL5Ty9tfXV4msFmXlZ01xX36wV/RF DWYSmST8uHOehtlSXrQFdOU6VGn8V0ZWKB9ti+mkY4l9CdxJstz8Jh9hqW91bId0 i62fGO6KcIfbs1GyTGOzsC7QWFotwMkNkZDpbr78IP91A7OUzd0W3Ycn94O7k+2r SvpXAwAISRz98OFDYo7VhVfHcd0X1qkPGFd6wyxfCT3cZQYAnGSTwl9dXcWXDId8 P/kWAIdTDbP1NsMCADAXS7Dx5qD9fi95tfH6W3tfPiCbtoZZmmEBAOhku916F9MP Hz5447HLf0927TvPmeKB3tyGWZphAQDoRJJn43BA6/VaF9Cnt1KGDPr06dO82wLU SBtmFzPEFgAAGbQlWCVX1aenp8RhgmQ9ciGee4MAAACwcPEEK371q18lxtfNZrPs 6eABAABQgv1+33VSoUbEVwAAAOQhsbPrJO+hm5sbhocFAABAHsMT7Hq9Jr4CAAAg m4EJ9urqarfbzb0RAAAAOC9tUxWc9A//8A/EV6BqT09P3EMBANTo5GwFEYwBC1RN 4qvdT2FqMABARYYkWMXEskC9vDPAhw8f7u7uaJgFABRueIJVTCwL1MiaYUM0zAIA irXZbEZJsCs6FQB1Ovk1loZZAEBpnp6exkqwirllgbpEmmFDNMwCAEoweoJdHVts aK4BKrLb7boOrEfDLABgRqMnWLmuXV1dbTYbesYC1ZHD9ubmputk0zTMAgAy2+12 I6bW7XZLmwywAO/v7xJKaZgFAJTp7e2ta3uLury8JLUC54CGWQBAaTolWEmt6/Va Uutut3t/f5+77ACyomEWADCWl5eXL0ffv3/v8faTCZbUCiBEwywAYKD7+3u9Ojw/ P3d9r4TS8BpEagWQqHfDrJxhOL0AwJn7+PGjXhdub287vVGuIHrpIbUCGKhrw6yc duYuMgBgTq+vr3ZRuLi46NSjQC46pFYAI0pvmKVTAQCcudvbW7kcXF9fS4KVH75+ /Tp3iQDgRMNsv2ZY+c4+pP8/AKAc1gwr2VVO7D0aYwFgOm0Ns/2aYeVEp2/v0f8f AFAOCavWG1bSrJ3eP3/+TI4FUJTdbndzczOwN6yc3HQN9/f34xYPAJDNt2/f7Hx+ cXFx+LlzrPxKFpi7jADwk/f394eHh+122+O9ck6zU5x8fx+9bACAqT0/P2s/WGOD EmiPAvd1broBWAa92XR9fU2PAgCY0ffv3x8fHyVkSuzUB7KGsEZXWefAVa2OrbhS qvv7e64RAAoh50x7dlW/rcu/cxcKAM6OnISHB1fjDUfgNcYO9PHjR4Y7ADA795Eu uxUlX9vnLhcAnIvv379bR9ZRyNq8j/j27duICVkxoA2AGbkd/uVcJDlWf5Zznfxq 7tIBwPJNkWAbs6Wc1W3UghE/K/8eAwCJrPbFXE9Ect6zU5P86uXlZe4yAsDC3d/f j5gqZW2R1lH5lffw13D0KwCQjba4ev2jrP9A+HCrLMwNIwCYgjs4TG8XFxdySpcw mTh8liymD0GM0jDLNAoAuhrxIVb3FOR2MOiNh1gBIIXXDCtnYz1zltmh6+XlRa87 3kWHxlgA6SZ9iHXcm008xAoAbdy2UDlV1tKkKeW0URlXDDAOIM3ojwCEA2qN/hEr HmIFgIDbl6DGL/tuMzITgQGIy/YQ6xQ5lodYAcBlA8LUOzq3PV5B5zEAcaM/xBr5 LMmx437cqs6mBgCYiA3TXe9QMJbDOb0DiOAhVgBYEu1WWnuHUr06yLbMXRAA5eIh VgBYEr0XL+fJuQsyiD4LXG+PCAAZ8BArACyJPnpQ+1d77RTBUw8A2vAQKwAsjJ4S a38kyrrFzl0QAIXiIVYAWBg9Jdb7VJeS8hNiAUTwECsALEztZ3VFiAUQx0OsAAAA qA4PsQIAAKA6PMQKAACA6izjkSgeYgUAADgr9P8HAABAdQixAFCj1TCUFgAAAPnV FQvrKi0AAAAm0jvdzRhic74RAAAABaorFtZVWgAAAEykrlhYV2kBAAAwkbpiYV2l BVCjgX3vOdsAQB51xcK6SgugRiWH2JLLBgCZ9T6nzXIyrKu0AGo08HRBiAWAPOqK hXWVFkCNyg+xc70dAIpSVyysq7QAalRyUCy5bACQWV2xsK7SAqhRyUGx5LIBQGZ1 xcK6SgugRiUHxZLLBgCZ1RUL6yotgBqVHBRLLhsAZFZXLKyrtABqVHJQLLlsAJBZ XbGwrtICqFHJQbHksgFYkhUwzNxVGDhHA4++SQ/ekssGYEnyZx4szNxVGDhHA4++ SQ/ekssGYEmqOF30LuQsW1dXaYeorsDAYpQcFEsuG4AlqeJ0UVcsrKu0Q1RXYCCu +40IwDd3LQbOSBUHXe9CzrJ1dZV2iOoKDMTlCzpYrrlrMXBGqjjoehdylq2rq7RD VFdgIK6iKj2wqJNuacllm1S9JQcqVcVBV1csrKu0Q1RXYCCuoipdclAsuWyTqrfk QKWqOOjqioV1lXaI6goMxFVUpUsOiiWXbVL1lhyoVBUHXV2xsK7SDlFdgYG4iqp0 yUGx5LJNqt6SA5Wq4qCrKxbWVdohqiswEFdRlS45KJZctknVW3KgUlUcdHXFwrpK O0R1BQbiKqrSJQfFkss2qXpLDlSqioNuNQylnUh1BQbiKqrSA4s66ZaWXLZJ1Vty oFJVHHR1xcK6SjtEdQUG4iqq0gOLOumWlly2SdVbcqBSHHTojcqDhamoSpccFEsu 26TqLTlQKQ469EblwcJUVKVLDooll21S9ZYcqBQHHXqj8mBhKqrSJQfFkss2qXpL DlSKgw69UXmwMBVV6dUYJi3bXG+fUb0lByrFQYfeqDxYmIqqNCG2QPWWHKgUBx16 o/JgYajSoyg5YE+q3pIDleKgQ29UHiwMVXoUhFgAeXDQoTcqDxaGKo0hqD9AZhx0 6I3Kg4WhSmMI6g+QGQcdeqPyYGGo0hiC+gNkxkGH3qg8WBiqNIag/gCZcdChNyoP FoYqjSGoP0BmHHTojcqDhaFKYwjqD5AZBx16o/JgYajSGIL6A2TGQYfeqDxYGKo0 hqD+AJlx0KE3Kg8WhiqNIag/QGYcdOiNyoOFoUpjCOoPkBkHHXqj8mBhqNIYgvoD ZMZBh96oPFgYqjSGoP4AmXHQoTcqDxaGKo0hqD9AZhx06I3Kg4WhSmMI6g+QGQcd eqPyYGGo0hiC+gNkxkGH3qg8WBiqNIag/gCZcdChNyoPFoYqjSGoP0BmtR903759 +/r165cvXy4uLlY/yH9vb2+fn5+/f/9uS8piq4As2farkLu2kLvk58+fG5cJP2j4 HpBSvby8yJo/fvw4fG2d1F55AE+2Ku2dB+T4dX8rR3T6AnoSG4WeTO7v7/OfTLxN 9rbXeLtF3jX8o19fX/UiMnxtnBKBzOo96OR8e319rYnx8fHRTZgSX+Uk3HiKk/NV 20nSEmYYVvVdJ09xtvLISdg+SBY+vZEJ5NyrG5v/71hv5QEa5azScuS2nXCUhMnI AvJi/DzTg8bXGY9r92t+2xlST7NjbbhcO+QKMlYk5pQIZFbpQSfnMW16lbNu4wLf vn2T38oJKvxV2/nKmgIaVyiBOeW0qQ0j8ZOwftDJVaWLl3w6lVYeoE3OKi3fteMn Cjl9RRbQU5z8O1Gpxl1tIj2V6Sm07X7W4fhnGqUN1l0hIRaoUY0H3ffv37W54Pb2 NrKY/LYx4vYLsXJubwvM3splPfrVXgrZ2IRCiAXKlLlKx7+J652mtlbHiXoQzXUy cT9dkrnumUinAkIsgEOdB53ecpKzXLyT6uPjY2PK7RdiE+ma7STceHkixAJlylyl 5QSl33bDX2lvAV2gsU1SIm7K1+quSgixB6dfQWNTMyEWgKrxoNNm2N4n8K4htlPn K1uznYTbPqh7wVsRYoFRZK7SkR4F8h1cTnTaZ6Axyw0JXZGv/+OeTOLtDG2frj9r p4LGx9YIsQBUdQedPTzV+4TTNcR22j/umvVuYNipoC3EymXL+tPq2buxT6/7JMLF xYWOw9AWv21J+WHcZ0AOFVYeIC5/lW67ZWMNrXoIewevHPLyxnBtcm6RN9pQLfKD /Nc712k8lpOSdkiQ9bsLhKdBOynJkm7YljLYr2Q9UlrvRBf/oEbuuTHSqaDt/J9y CrXy6DKyf9quKSc3MMQpEcisuoPOHnbovYZOIbZrq6m7ZjnjNV6hGtepiVfOrnqe 1DOtnmPdxez2ol1NZDG7ZrlLetc+XVu8F3FX1VUeIC5/lW7sUaB9CfQY1yPX61Eg 7/LODO6S1mwrP7jnATl52rlCv9Xag1S2kvA02DgagI6cIMXQ85W8S9Ys69T/pnxQ I+/caD3HvIboxhN4yilUXrQdYiVvHJ0gvoFtOCUCmVV30Nlt+t5rOBliQ51W7q7Z 2kjlB++D3Hc15tWDc1p23xh2Bg5bYhsjq65txNtw1VUeIC5/lW7sUaBtmPpzY48C +a3Xxth2crCv0nrgazx286SkNTegeiFWm0O9M4ku4wVvPefYqk5+UKPw3NjYqSA8 jyWeQhtPjFZUW2fKBjbilAhkVt1BlyHEhi92Wrm3Zv1G715cwnXqvS036Cq9wNm5 VBttwjuPYcl1hV5HO23EDs/zvVVXeYC4Wap0eL/Ge2jLu6uiTaNeWG07ORycRkX9 b9sJULknE223DG/f6Gd5cU7DttvJIf5BkU/3Vht2KghXm3gKbVvMK2riBoY4JQKZ VXfQRaYkSNQpxB4G9IlVNiCYpUfvRG0tLeEWWROBNsK0nYHDxpPGDWlsXhiiusoD xM1Spb0eBW5fAqUp1HoUaF93byVtJ4dDEOTSQ6y2gobLtE0l456sTn5Q5NO9F8NO Bd5qE0+hkcW8oiZuYIhTIpBZdQednWMbT9cH5zEEl7tA1xDbb3SCSJm9E3X8cWC3 tIklj/SLGPfPXV3lAeJmqdJejwK3L4GyJ480PskprvFZp8aTwyE4P0SWdBfWaL1q ea4qwtYc/6DIp4ev61nd2gG81SaeQiOLNZb85Aa2rSd9ewEMVONBFx8hXEUabNtO RCOOE9tWHu1UkC3EDtmQFDVWHiBirirtntMksIUnN20b1Pm1V01DckXyVe8Qa2dR 7+MS02niYuGnh69bpwJtB1hlCbE9Hh/glAhkVuNBp00E8ckO0s9XKW9JFzn1acc2 uUIN7E4QDhrT1p2gd4+LRDVWHiBiriptPQr04A0zqvYouL6+lhTX2CNoiu4Ehx9N oF7vhchnuUYMsYef2wFWw7oTNA66uwq6E5zcwBCnRCCzGg86+1YeGTCqwBArFyYt tj4w6/4q8akEfWO41W0PdvU4CXdSY+UBIuaq0tajQI7uxoxqPQrkJNB43pviwa5D y3NVkc9yjRtiD06ngnC1iadQ3ZawHcArauIGhjglAplVetDZOb/tPNM2/v9hvhB7 cDo5eJ/SdYgtryUhHLFBXwlHZZRLIaMTAG1mrNI2sGrbOc3G52/8cpo4xNahY4g9 NM0AG/ksOefYi6OHWEvU4Wo7DbHlnRjDyQ4SNzDEKRHIrN6DTs48eoNezu1yarIb cHL+0e/RcrYJ78rZ+Sp8WqGtA1inIjWu2WXPnXmve0Nwy7/eI8nKJjuwUR8bJzuw Mb3lHG6XHr0R2XvrQvVWHqDRjFXaHqRqO0JtgbY12BnD1mAnSQvGdnu97TZN49d/ XYl7LvJORPZZ1sh58oMa6Uk4co6KTOedcgq1E6M7i4F9O3DXeXIDG3FKBDKr/aCT M4ycqSQZ6olI/tVHd8PToNsKavQreeOvuk7S6r29rf3BGkbCXyVOO+tOJqsB3q4X 3kXEXVJHLI8MDtND7ZUH8MxYpb0b320LxO+kvESnnfVmrA7v1Mi51BKdezKx7/7u JAve+arTBzWW3DuFti2pH9p4gk2cdlbOhLaL9Gu+vkvnlm1bWziBb4hTIpAZBx16 o/JgYajSGIL6A2TGQYfeqDxYGKo0hqD+AJlx0KE3Kg8WhiqNIag/QGYcdOiNyoOF oUpjCOoPkBkHHXqj8mBhqNIYgvoDZMZBh96oPFgYqjSGoP4AmXHQoTcqDxaGKo0h qD9AZhx06I3Kg4WhSmMI6g+QGQcdeqPyYGGo0hiC+gNkxkGH3qg8WBiqNIag/gCZ cdChNyoPFoYqjSGoP0BmHHTojcqDhaFKYwjqD5AZBx16o/JgYajSGIL6A2TGQYfe qDxYGKo0hqD+AJlx0KE3Kg8WhiqNIag/QGYcdOiNyoOFoUpjCOoPkBkHHXqj8mBh qNIYgvoDZMZBh96oPFgYqjSGoP4AmXHQoTcqDxaGKo0hqD9AZhx06I3Kg4WhSmMI 6g+QGQcdeqPyYGGo0hiC+gNkxkGH3qg8WBiqNIag/gCZcdChNyoPFoYqjSGoP0Bm HHTojcqDhaFKYwjqD5AZBx16o/JgYajSGIL6A2TGQYfeqDxYGKo0hqD+AJlx0KE3 Kg8WhiqNIag/QGYcdOiNyoOFoUpjCOoPkBkHHXqj8mBhqNIYgvoDZMZBh96oPFgY qjSGoP4AmXHQoTcqDxaGKo0hqD9AZhx06I3Kg4WhSmMI6g+QGQcdeqPyYGEqrdIv Ly8rx9evXxsXW/1M3jX8o19fX+Xjvnz5MsrahK5NS3hxcXF9fT3WmjOotP4A9eKg K9D379/nLkISKg8WpuoqLfHPAqpky8Zl5PVIyu3q8fHx8+fPI0ZiXdv9/b3+V0r7 8eNHeUU+aPjKM6i6/gA1qvqgc1sV5OzXuIx7Yh9rYyVkyhlb1iwn2OFr89Ysq724 uBh3tROpuvIAoaqrtLbHajNm2/nwcNzGcds2xwqxeq72Sv78/Kzr//bt28D1Z1B1 /QFqVPtBpw0L8Ztohx+nx7bWia7kMqHtAyPuOjlF39/fS3yt6C9SUVGBFFVXaQ2x cibR00ikU0GZIfb29rax2CdP7+Wouv4ANVrAQWeND5GYqqf3ET/UOqGNtcLr62sJ sfJvRX+RiooKpKi6SttZzm4/NbZeFhtitXtt2JmKEAugzQIOOj1/ameqjx8/NnYo LT/ETrraiVRUVCBF1VXaPcvp93r5N1ys2BDbSHK4rv/5+XmK9Y+r6voD1GgBB52e P+0mmj0U4CLETqGiogIpqq7S7lku0qmgMXDKK9fX19adqW1YAO20b52pZBnr0OUt LIvZM1/yQ+92VO1jwGMCABot4KCz86fdRGs8RRNiR1dRUYEUVVdp7yyn50OJf16n gsbAqVHTlpQfNIK64VMSrL2oN7zsFpi3Tu+9un6Jo1236PHxsaJm2EPl9Qeo0QIO Ovf8qX1Kw04FbSFWTpLWn1bvvjWO5eKOJCMXBTkb2zOz3pID2x8IscCMqq7S4Vmu sVOBFzj1XXJa886Z8l9tmLWFG7OoLOaF2MbF9MzcqcuBJdjGm2tlqrr+ADVawEHn nhvtxOud9xpDrJ5XrVVB75TpPTJ3Mb2fJYnUnhrTUbDCXTe8/YEQC8yo6iodnuUa OxV4YVLPb41BUV50z2DaiyBsFPVCrC7mPWOridQ7tUZYgq1lhFhVdf0BarSAg847 J1sbqXuyDU/vjXn14CRb941hM0XYEjtK+wMhFphR1VW68at62KnAOyO1RdPDj7Oc joZtD1i1jR6g67TFGsuWOLC2Jlgpcy29CEzV9Qeo0QIOujAlagOCmzzD03vbqds9 bx/amynCtDlK+wMhFphR1VW6rdOUdiqws5B3wvTaUcMV6jojpyZ3Dd4EuKHErZCz 91jDeudUdf0BarSAgy48A0t21Uhp523v9B5pVbAuXtpw0ZZ1vVP6KO0P4WoLV1FR gRRVV+m2EGudCvQ8lifE9tsE7Q9WaYI9VF5/gBot4KBrPAPbuVTP297pPX6mdc/J bWd4bw3D2x9SClaaiooKpKi6SkfGYLFOBfolfUh3gnACBfckGWkfSKHlnGjI2Qyq rj9AjRZw0LWd9NzzdrYQO3BbCLHAjKqu0vGBBK1Twarvg13anBs+aeWdJCOpOE6b YRufhP161HWF+VVdf4AaLeCgi3xz1+EC5Ow9sDtBeN5u607Qr/2hbbWFq6ioQIqq q3Q8xFqngtWwIba8AbvCyQ4aF9Ml408H6BMEjVPlytoIsQBCCzjoIiFWTpt6Htb2 B/dXiQ926RvDxoG2B7sGPk5LiAVmVHWV1vQY6U3aNh2Mtri6owjKD9oC4LbQ2mQH cj60yQ5s9i53nENdTE6elkjlxChLxnu66sn2S0DXVkUfg6rrD1CjBRx08fObnbe9 zew6xJbXPmCr9V7p0f7gIsQCM6q0Sod98tuW1E4FQ6adlQRri2lM1XVKRrXEq2Nu exPENDaxuiwPN+q+V2ZQUVGBZaj9oNObWfE7TTYnl/e6N4Wi/GstEu5iNtmBntL1 /BxOdtC7/cFl2biKh3NrrzyAhyqNIag/QGZVH3TeV/W29ljr3BX+KnHaWbdVQUKp 5l79r7xub+nX/qDcYpjCu4FVXXmAEFUaQ1B/gMw46NAblQcLQ5XGENQfIDMOOvRG 5cHCUKUxBPUHyIyDDr1RebAwVGkMQf0BMuOgQ29UHiwMVRpDUH+AzDjo0BuVBwtD lcYQ1B8gMw469EblwcJQpTEE9QfIjIOuHPv9fu4idEPlwcJQpTEE9QfIjIOuEE9P T/KH2Gw2cxekAyoPFoYqjSGoP0BmHHQleHt7+/Dhg/4tPn36JP+du0RJqDxYGKo0 hqD+AJlx0M3u/f1dguvqZ1U0yVJ5sDBUaQxB/QEy46Cb3c3NzarJ1dVV4b1kqTxY mDOs0vIlerfbPT09zV2QJTjD+gPMi4NuXtvttjHBqg8fPjw8PMxdxlZUHizMOVRp +Wosp53NZiNfky8vL/U8U0sXpsKdQ/0BisJBNy+5mlhv2DbFNslSebAwi6zSu91O vgvf3d3JmaTxmzIJdiyLrD9AyTjoZvf+/r5er+M5tswmWSoPFmYBVVq+8Epq3Ww2 clYJO9uH6EgwogXUH6AuHHSFqLFJlsqDhamxSr+9vUkQ1YbWk+cQEuykaqw/QNU4 6IbrdNUI2XoSm2TLue5QebAw5VdpfQ5rs9nc3NykNLRGlHMmWYzy6w+wMBUddENO 15Nu47gFS2mSlawr17LptijR1DsWyKzAKv329uY9hzWK2RPsKFsx7yaEyiwVsGAV HXTFnu56r7/tjYlNsnJpG1z2QSqqPECK0qp01+4BveXftEqLHVdmqYAFq+ig613U qbdxooKV3yRbUeUBUpRWpR8eHkYJeyfl37SBn1vaX0qVWSpgwSo66HoXdeptnK5g hTfJVlR5gBQFVumBHV89YS+CuTZ54OcW+Jc6lFoqYMEqOuh6F3XqbZy6YMU2yVZU eYAUBVbpt7e3/pn1Z439YOfa5IGfW+Bf6lBqqYAFq+ig613UqbcxQ8ESm2R3u12P YvRWUeUBUpRZpe/u7von1x/anuSaa5MHfm6Zf6kySwUsWEUHXYas2E+2gj08PJxs kpXrXbYm2YoqD5CizCotR/TAcQnktNC28rk2eeDnlvmXKrNUwIJVdNBly4rZ1t/j jfv9vnHuSJdc7/I0yVZUeYAUxVbp7XbbO8He3NxE1kyIHVGZpQIWrKKDjhBrCmmS rajyAClKrtInOxT1SLAHQuyoyiwVsGAVHXSEWFdKk6xk3X4rT1RR5QFSlFyl5ZDv OmzsyQR7IMSOqsxSAQvW6ZQIhOauwsBoCq/SnYaNTUmwB0LsqMosFbBg4+QYnLG5 qzAwmvKrdOKwsYkJ9kCIHVWZpQJQgt7nh6lPLCUUzO0lK5e5UdYJnJvyQ8hutxsx wR4IsaMqs1QASlBCVhx3/eMWTHvJSoKdcSJaoGpVhJD4sLGdEuyBEDuqMksFoASF ZMUR188ZDyjKyUZO4KS5azGAEvU+P0x9Yim2YAA6yR94sDxz12IAJep9fpj6xFJs wQAslTfCXu9+RHOdhQZ+LidPAHUpNisWWzAAS+UOGzukJzwhFgAyKDYrFlswAAu2 2Wz0HDLkWU5CLABkUGxWLLZgAErw9PQ00Zghw88hhFgAyKDYrFhswQDMa7fb6fQE XUe+SkSIBYAqFJsViy0YgLlIfPWevZJXRv8UQiwAVKHYrFhswQDkF8ZXdXl5OXqn AkIsAFSh2KxYbMEA5PT29tYYX83d3d24n0iIBYAqFJsViy0YgDz2+/3NzU0kvhpZ csTPJcQCQBWKzYrFFgzA1NLj64cPHx4eHsb9dEIsAFSh2KyYcv2KmK5gAKbTKb5u NpspRtkixAJAFYrNisUWbFz6uMq4N0OBGkkclVBqE2bF3d3dTTRI7CEty8mnb7fb t7e33muYwsDTZl0nTwCo+nTnzhEpP6zX6+nGP5+CFFXLP8UtUaAWneLrzc3N1F/6 Bp4VZzw9VlpsAJjObrfTk5vevyuq2XC73YYnYUmzkgmLKmcj75lrmmRxbjrF12wH yPAcqDIUNULOjXd3d5eXl+4OnLdIADALiYXuyfnm5maKMcb7kRN120Xk06dPcols u+U3L4nZYYFpksX5kKqeHl/znHAkJD89PckpJT6ol5xYyrzjI6WS8svpOtyx8kqZ ZQaAqbk37o18xy/k9r3OQRkhRZULUznBW3J1/JJNkywWTM4bbgth/MjdbrfTlUS7 tspXXTnoEhN1gQlWzifyjSB+Gizn7AcA+cl5vvHcKGd+yYfzhq7GjN1W2pubm0kv iykircdWztkLCYyuU3yVhacog8Q5iXzr9TqxJN6BWc4XTDlFyNksZSvk7D13YQFg Tu/v7/GzpVwUZvyyL9e7rtejeR8Ek48+GbylhKW1+QD9pMdX7Xs/4ke/vb3Jp0ve O3nL5mTBZu+bpB0evP5dcXSFBYBDy1NUHrlOPTw8zBK9EoeXbDzJz/IgmHxivOvd iiZZ1C+lnlttH2XoV/lEfawp8XMTyzZjgpWPlj3TI4TTFRYATPrFKMNIOB45Vw9s aZG3y4Uv86Uq5fEWmmRRLxtKLk7OGKNU8sZHJgeaJcFqf93EDgNt6AoLAEZyaadT qITenA2JcqFJ7Bwbpw+CZSs5TbJYtnhvn9G/8A78MhvKeejJrtAuu8OLTVdYAPC0 PeEVIZlwogkiQ+O2w4zePS9ecppksVSNX9MmGjsrPvpHVxM9XxaWWb44jxi/6QoL AKGTT3hF3NzcZLgrN0ojhsp8G3G/36cMF8YtQlTH5kxRUw/92uO7dqM8CfYwdusx XWEBoE3KE14Rcv2a9NIwJGZ7ZrmDn3L9nXTueGAK+ujldGNneYbHwmwJ9pDcczjR 7KMoAEDJhj/2q30MJnr4a5T7iTNOniXlp0kWC6PzSWX7uIEnAYnc2Yo6SoENs/4B QNyIvc4mGsdgYOfY/JewEE2ywBC9OxXMdfj3GO/as16vZyk5ANTl5LRTiaabxrF3 c7EUaYry9ECTLNCVnE/sfvrvfve7rof/vF9ge493racCvtICQIpROnFNOhF5vxL+ yZ/8yf/8z/9MVKR+Eptk5y4mMDM55OVg+XCk93e63jMq4RZM7968dIUFgHQDb35N mmCV90z0Sb/61a9Wx2d7c3beSyGXp5NPq8n+5CqGc+aekWyMqfROBRnOSCnu7+87 nbUUXWEBoKsht+zzXC/69YsrcJRF2V0pXTiYEwHnxs1vbjOmfRX97W9/W84ZKa7f /SO6wgJAD/2e8JKImPN60TVpl9y1bLfbRZpkSy45MDrrNG451j0j2XCpJ09ThSRY 1fWkylEPAL11fcLrz//8zzPf9d7v9+mNG+4EBzrkbGnzZEWaZOlOgPPhzoLtDu/v 3nyxJsrIHZnZE6x+M3VbUzv11OKoB4DeOt3/+qM/+iO94mR+oD4+QcPf/M3f2M92 C1K2y25NSoFLu00fNsnSKQ7n4P1If3ZvsrjPZOmh4c0L1vjAVOZZ+UJuXnU3IXGY Ao56ABiox6Cs+Yexamu91HYYudjJJW+z2ejCboJVBQ5j5TbJ0ikOi2eDD9hYHN5N Fouj8kN4wIa36WdPsKotissp6F//9V9/+eWXtrMoRz0AjKLTsDBz3b8LC2lD8Xi8 ZhC3eXaiWcZ62263dIrDQBL5Sus2E3JvPVj4dL9Bn3we0+1UMGOClf0sZxj7dC+K e0OjtA2xwlEPAGNJH8zKvVbKaTznpTPsHNt4FfPabL0OBrIGbuFhMfQehB2bcxcn xr3z7t7KsfLLDye/Y+o32RkTrHzr1LOQ+13e6+/kdV5q7NBbQhsyACxGWycued1i oXuzTE7CejLPeUFxr4Ntg8HKlUWu5rqMO4mAu4GFX+6BkyTvhcdsUX2/tYTusebe TLHOP/pdOLHDj3YqmGsgaO97tHs+tJOkbZfLzkiK79EAMK7GJ7zsLC1XDTcQWoIN s+LU9MLdeKVwydXcLZXXGFLabAhAusb4qsq5Se0ecRZQvTs+/b78ztsjyOua655J 3D4GHreXPt+gAWAK3hNebXM4egPIZJ7qUR8P6fQW72af28GANIuKpEyZUcgUxm5e daO1xe+KpqiTE6NsgoVn9wTY1i0/pF/8Zx8QDAAWzJoL2qKpO7rj6udnMeQsXWYm dJ8oCacHSumJB8zLHu2PJ9hOsWp0Elzd48vN2xat9Y5P1++hc5E9aV123X68bkt4 +rd4+TZdS24HgBpp+0n8tGwNEW6rgnUwKDATSnk0r7YN5DjjdR+I6xRfZclZGvrk nGDff907HW6xCxzm7qRIvykNt5nvQwEA4lJaU/WaFSZYdXl5OXEZ+3C3y+sRUWYD 8ihOJp9RsCHpdl3c39//5V/+ZUrJ54qvyvtK2PjYfkVPM7lfab1OVhbFZRuLeowO ANCDl2ALGYE8IvJoxtPRjGUbXc8w1xEbMuOGSICc5T6C++ykN72I++zS7373u7lK 2I8OouU2sbpjC7gRHQBQtXiCLTPNNnbVOzjNs3L9Wsx1avTI1IgNmWVD5gqH7ih2 9qXPOxVYK+XV1VVF99zddlcrtmyv9asvcA5rAEA/cnq3Bx/cBGstM2U+waF51b22 eh0MFnOdGjEyRbAhmTdEDroZvyG6XwPdo95NgNanqK6+o223afT1Ajv8AwAGkiuU XLPCBKsKGfPH416MvEakMoN3P6NEppPYkOk25Ne//rX7X8lRszwh5Y1H5x7gbvf4 9Xqtz5fZ8WUDxpacY1M6zJd5XwkAMFzbQ15VdJF1C+x259Pn16pue+kamfphQybd kD/7sz9bzRpfbXgEezirbe6q9yP37e6sBwXmWDn8w3tG3mC8VZ8BAACJIglWfijz Hr1dxVY/tylZg4xsRY2jA6kekakHNmTSDfnNb34z4/OG3h12O6K9OUTakt68c6PE eTOIuSco7QVR0YwMAICB3BDrJVh9vdhn/7WtyS7E3tWt2GIDE3EbVL3Ort70W/Gk 5x1KpeVYb3Awt09URWOCAQBGoXnVuxy4c2aV2R7rioxwzo1FLJ5Ucol2cgi4Kc4d Zsq63KQkvTDEzp5j5Tupe1C7m+ZGdADAGXo70p+9h7zK7yLrdfZz59XVG6Ny+eMy hwVzb6bYt7YhX0XDEDtXjpVi21ZY/PbOUeV/ywYAZBBPsMWmWbm66XXcbZZxu/a5 QzEACyD1PBxPwPsSp51je0xu2xhiZ8mxXrOwO/2WnKkYAxYAYNxWTS/Bale0Yvua SsnX63XYp1e5z38BtdM5qty86n73dA9SORB61Hy3CXeWHOs+mOlGdK+pmc5CAACX XBe0iSNMsOElskyRBCtXf9IsquYOJ+WN7W9Jb2Alt/lQ8udYKbmebdwRtNzy8IUU ABDhNXG4CXZVw8wCbjtSOIIBtyBRNbefjJtX3UkKJg2xk+ZY96PtOHXvEMkChFgA QAovwZbfDHs4XvL0Uui2J3vPf5UfxQGlgw+4/b3dpOeN+T/KHXb3Dn7mHOsOZuse v9qDgkG0AACJvDYfN8HKJazw+3pS2rYhFwovOWDcY9CGmfK+kY3eNTQlxI74TVCO Uzeduv0l3OjOMQsA6EQvZ21dZGtJg20DSz4dzVs2IELqqptX7TB0pzMYvQ57k3ZF DP9oC8zWeSD8yjl4gwAAZ2q327U95LVyBm8sVmRWMn3x6uqKx5xRDjni5GuXfdVy 86qb6ORnORinqLqN8x1MkWPdTXO7r9sxSxcCAMBYvARb1HyUEXJN9IZc8Bq43NGK gLlYd27v4HKfVczQnbtTiB2YY9saXWWdbpIHAGAIt6+ad5GVXxXeYCJXQ7c9mS6y KJA3zZYNl+qmSptDdlKdQmynHCvbuDmy/2aO6ACAM9TWTGThdvjYPnm47cne8Omy gQzAhZyk1kkutRDo5lW3/7Ysk3N0uK4hNjHHytZZZHUHuW3s9wsAwLgeHh7sKelD MIJBFZ1L7Tkvr4OBNc+6GwhMR0eO8vKq+yXLquL7UbaCRSbtGpJjve+PdvTZaaTw GzoAgMXwnmKuqAlls9lEZiWjgwHycLu1uHfY3UcRZ/lieHK+gzbx0nojD7jRXeKr O9ssAADT8Z7+8GZsL/+mfNusZN4Q6xUlc1TBPTrc6WLdBKgttBJr5/oy1TXEShyV FNpYWu8LozfILc9UAgDyk6tS2L3t4PRwq2XsAu+BNTdg6IZwixOj0GeaVj+3r7oz C5ST6BLnO1gdHzSLfGO1rjvu3Q33+y9PcgEAZqFPQrmXIe8ZjSrin/uwSeMt3ZXz nDjQm9vgb3m1bUSCeZ0MsXJ0pMxy67boujlWzgzyK25zAAAK4SXYWlpiD8cgIVdk K7DXcy/PoEZYqrY76fYVT1sm5+0/4IlM2vX3f//3q2jf14cj/dmL6Ey/BQAoUCTB yvWukEtzIrfFzH32ZLvdnhxGLN5+hQVIrEVS7bU76Mp55tFt4ZRfuVWrqGOkcb4D qfy6IXJQNH5FdUfhc6fGc88MDP0BACiN27PUvcDpIypy1avl1qE7FWbjtTg+XOeo cQklSqxIbXNRua8Xe7fCG67We2hL22nDxti2b3/WrssUzwCAMumlyr0ue6PI1pJj rbmsx13RTjkHden0x/U6D1h3axuRoPDJQVbRh7YaG2Mj/XDcPgYAABTIbWbxng0p ttGpkSQN976ne2mOp3FC7ILF/7hS+aWSu19w2qYCqWJM1HiTqWyadoeQY0E22cYn aev3CwBALdwbi6ufH0wuufWpkbct3hhc3mWaELtgkT+u2wvF/frTOCLBAujwHdYD 1v1m53ZFkNfnLScAAF21TYClwW+9XtcSZff7vZtgGzsYyKXcNocQu2DhH9f+7l4L pH3TsTvsUltOzspal81m86tf/arxMNcmaHmllh5EAAC49ELmPt/hPqcsP5R/R1XZ M9dujwhvki9C7Dnw/rjaYcaqsQRXt0rY7Xip9guLr7ppUud/+eWXv/qrv7Ktdg+Q tgm8AACowtuR/ew2VVX0nJdyc0jbA2v2zM5MZcS07I/rTlfnfoVxx+hYUucBow3L 1ugqMf4v/uIvJMqGTdAAACxDJMFWN4qsty2Nj7TMW0JMxP643oRu7mP49gzg8oaT cmu4RnTdD//yL/9iu4JhYAEAC+O2UHlNl/Jftzdd+dy7xu6Uu+4IBu4ybqwNX2l8 cdL35vmU0d87ewn/6Z/+yf2vNx2AdZaWpCeZtpauMp14I2hp5wGd0OE//uM/Vj8f DgAALIZ2Ig0TrF4Q68qxWnK3B6Cb0lfHKRKKCmD9XpyrhI3vnb2E9iS+VVRvELm6 usekk0BuTcre82tPT0/aGCs/LHXzAQA4HJPeYrrIvh/pz43trkUFsH4vzlXCxvfO XkILsW57o71Y0Zx06aSG67cz9zum1wStIyrL5s9bVAAA8qg9wbq8timLPUUFsH4v zlXCxvfOXkLLqyun0VX/+pLiKrqPkM6bpa5xGlnZFToM3cJGYAAAoJF7cQw7GNR1 NZQr+3q91m2x7ToUFsD6vThXCRvfO3sJ3RDrTsu1yPiq3FE4Vj+Pt+BNOnZzc0Nj LADgHFhLbFsX2bpy7OHYo0C3xWJPUQGs34tzlbDxvbOX0EKsjoxa772DOO1CEDa6 qrbJo2mMBQCcDx1pM9JFttIGLos9RQWwfi/OVcLG985eQguxkvH+8z//0//DL4J+ F1sFja62KyI9f2iMBQCcoSV1kfUCEpZk2X9cb0iNcH66+Mi3NMYCAM6N92CU18Fg vV7XFWiXnXPO3CL/uHJ8tXUecBNpylRcNMYCAM6N3cR0E6yNrC4vVjR0/CJzDtTy /rgSU73ZRrwc2+krpDbGVnS0AgAwnFxDb25uwgRrarkyLi/nwCzsj+vm1caZOyTf pjTAutbrtdufFgCAc+Ml2LZnogu0sJwD18L+uDrZlh1lNnPu4UfHgB49eXQqhFq+ cgIAMC59iqSxY55cZwsftWBhOQeuBfxx5fBxDyJv+i233bX3gXZ1NEJZAQCojTsl vZtgNdy6/fcKtICcgza1/3Elsup8HOv12l50D7cPHz5Exh9I/xQaYwEAZ2u73Xp3 M93m2ZJz7ApLN3cV60mfujLu10PrvSNH2ShHFo2xAAAor4NByV1k82UpzGTuKtZf 27QFkm8lx47YdkpjLAAAhyDBuo+f1DWELJCfJEm380C2OxpXV1fu5wIAcG72+732 4lPeQ16r8W6AAgsjx4XESD1w7u7u7HV36I/NZjPRp2+3W1n/8B62AADUS6/F3pQH 7hCX9L4DQhojjY08YCNryYEz6RdA+fpZcs8fAADycJt0vEmFuo7HDpwJm7Zg9fPI A29vb9O1wRo9TmmMBQBAyfXXHaHd7WBAvwKcOb1t8enTJ3vl6upqxnsWNMYCAGDa ushquHX7/gFnZbvd2vc7i44Sa+2Q8frkZEBjLAAARi7K2rjktvDItdIu3yWPIgtM x+tmY1/x5Pud5NjNZjPLcUFjLAAALrcN1rt2c8XEWWmbE2RVxkitNMYCANDIfXSF BIuzIvlQuwo0Tr+1Gmka2eG0HXjuUgAAUBC5QLsPebkJ9u3tTa7mzIaApfJG0LJG VxtBS/4tZOCOh4cHKQydfAAAcNlgBW6ClQu6XcfdRipgSbwRtOwrm/xQ1CQgmqtp jAUAwCOXbHdQArrIYqkkDUpVd0fKckfQcnNsaSTB0hgLAECEzkVLgsXy7HY7GyzL WjUlFrqdYIudvY7GWAAAIiJtsHmmKAKm431BczsPaOeZu7u7kps6aYwFACDChhjy Eqxe5dfrNddQ1MUdXsAdQevy8tIqs9TwEkbTiqMxFgCAuJsj+683TS1TeqEiEvm8 4V7dzgPypWzGsvWgjbFzlwIAgAp4CZbJvFARyajhE1veNLLWTvt+NF9hk0gJVz+P agsAAELeKLJugpVIQNcCFM4dQcurvVKxvW9kerP+4eFhpsKmurm5kRA+dykAACid 9SF0nyix5lkaZlEaqZDuDAVtnQca5+HS2n51dVXsQFuHY8lpjAUAIIVc2b1x4N3m 2WKHJMIZkviqldM6wXp3E+I9ut05vDabTbFf0GiMBQAgkTVbeQm25MHhcW70Ga6w ZroDx518tN+6y+rwBWUOWUBjLAAAnYQPebnNs4XMMo+z5T6x5eXYm5sbt7pGuN1o rRNCgU2yNMYCAJBuv99bD8PwMRmahjCLh4cH+wIV3inomj+1kdNT4ANfNMYCANCJ RIKbmxu3bcqLDYzEjmwkyF1dXXmNrsMrpPssmKu0B760eXnuUgAAUCW6yGJGmmDD WwO73U5rY78uLt7stJ5ypqaVY2318zwOAAAgRSTBylW+cQgjYETeyAPuCFoSX3tH TZ1QIOLy8rKQHuBXR3OXAgCAyjw9PVmE8BLsp0+f5BXaiDAuqVqbzUZiW1tvlrHm RLapviJkmdm/qWmbMwcaAABdaafEMMHahZ4HTzAWqWw2+MDNzY297uZY9/Uh3AFj I0p44IvGWAAAenPbo7wmrLFCBXD4uXa5VUtHgh03T7oNvHGJg3dNhMZYAACGszlq w5hRyLMwqI7EM7ed3x0J1u08MPqd/XDA2LgZH/iiMRYAgCG0Rci4HQnk+p7SRbZT ZkCNulYqHSjAG0HLXeF0/VW8D0ox1wNfeugxMAgAAL3ZzPVutHCbZ+ORY2hCQvE6 VSd3ulh3BC0bAmvqaWHbBoyNm+WBr6urK7ruAAAwxNvbm5srvA4GKSF2+jJiBv3+ uO5IsO4dc/k5w7Qa8QFjI/I/8KWBf/bREgAAWIZOCfZAiF20xD+uxDCpNm4nWPcB q8yNjScHjG0zy6Nel5eXNMYCADDcZrNxG6bc5tm7u7vGqy0hdsFS/rgPDw8aWSWP edNvmcydTlMGjPXMNfMyjbEAAIxCQkg4r/3BaZ51ezkqQuyCnfzjetNvuV9zbKCA /PkwccBYJdl73qeraIwFAGAsEj/cW8NuF8ewVY0Qu2Apf9zIyANuH4PMEgeMnXGI LUNjLAAAo/Nm8lo1dZElxC5Y2x/34eHBbcB0RyTw2vDn4nXtDv3t3/5tOXMN0BgL AMC4vCTg3heW3KIZgBC7YOEfV+cs1tfdTrDuLAMl5LH4gLG//vWvf/nll9nbYI1+ CyinPAAA1M7tSxBOGKp3YwmxCxb+cSUcunfq3RG09HGqEhKscqcJcxuKt9ut3mII O3jPSAo218NlAAAs1c2R/de9d2xmLB6mY39ct8em99iUTSMrgXCWqa/ahAPGSuS2 1KppvJzILQlWylNOqAYAYGHcMbhWx8EK9IfdkS3WmG/DFxuTcOJ7R1/hpO8tv4SN 71Xa3u7mPS8fFpVdjQRvK2HjRAY6Dlgh7Z86uG4hhQEAYGG86KJ3YxNDVOOL/ZLV RCuc9L3ll7DxvR43x1p/6RIe8G+jPRyurq7anv3X2wonZ/TIg8ZYAAAm4g5WIPFA r7aJIarxxSGpbPQVTvre8kvY+F7ldi619kz560sdKOcB/0bb7fZk26ak8UJGVKAx FgCA6WiOdVvkEkNU44tDUtnoK5z0veWXsPG9ypt+q5B2yxFdXV0V0gRKYywAANNx r7DeQ172eoZUNvoKJ31v+SVsfK/96ve//737ysJG5i9nsAJtjA277wIAgBGFwxTY rzKkstFXOOl7yy9h43vtV1dXV3/6p3+6+jFE1WFxyhmsYLPZXF5ezl0KAACWbLfb efN52a8ypLLRVzjpe8svYeN77Vc6XPC//du/ldB3dCKFDFaggyosr88GAACl8SIQ luTc/riFDFZwc3NDYywAAFM7t5xzVs7wj1vCYAU0xgIAkMEZ5pzzcZ5/3BIGK6Ax FgCAqZ1nzjkT5/nHLWGwAhpjAQCY2nnmnDNxtn/cEgYroDEWAIBJhQ+zY2HmrmLz mH2wAm2MXeSAZgAAlGDuhIXJzV3FZjP7YAU3NzdXV1dzfToAAAAqNe9gBdoaLP/O 8ukAAACo17yDFVwdzfLRAAAAqNe8gxXQGAsAAIB+5h2sgMZYAAAA9DPjYAU0xgIA AKC3GQcroDEWAAAAvc01WIE2xu73+8yfCwAAgGWYa7CCy8vLeWcQAwAAQL3mGqxA OzPQGAsAAIB+5hqsgMZYAAAADDHLYAU0xgIAAGCgWQYroDEWAAAAA+UfrIDGWAAA AAyXf7CCy8vLu7u7bB8HAACA5ck/WMHT09MsY3wBAABgSTIPViDxVT5ulglwAQAA sCSZByuQD6IxFgAAAMPlHKyAxlgAAACMJedgBTTGAgAAYCzZBiugMRYAAABjyTlY AY2xAAAAGEu2wQq0MTbzlGEAAABYqmyDFUhUvry8nPpTAAAAcCbyDFaw3++zDYkA AACAc5BnsAIaYwEAADCuDIMV0BgLAACAceUZrIDGWAAAAIwrw2AFNMYCAABgdBkG K6AxFgAAAKOberACbYyVtDzR+gEAAHCeph6s4OpoopUDAADgbE06WIF2WqAxFgAA AOOaerACGmMBAAAwhUkHK6AxFgAAABOZdLACGmMBAAAwkekGK6AxFgAAANOZbrCC q6urSedWAAAAwDmbaLCC7Xa7Wq32+/24qwUAAAAOUw5WcHl5SWMsAAAAJjLRYAXa 55bGWAAAAExkosEKaIwFAADApKYYrIDGWAAAAExtisEKaIwFAADA1EYfrGC73T48 PIy1NgAAACA03WAFAAAAwHR0sIIpZvICAAAApkMzLAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE/n69esq 6suXL9fX14+Pj3OXFDgLLy8vcrjd3t7KoTd3WQAAKN3z87OlVvn55QeJuJJg9fWP Hz++vr7OXVJgye7v7+VAs++PcxcHAIAKWIgNfyXZ9eLiQn4l/3779i19nY+Pj/IW uS6PV8yZLW+LUJrv378TYgEASBcJsQen10Gn/KbRV2Ruwp3u6j/uFpFS8itqn7cV hhALAEC6eIi11qHPnz+nr9NujHZqvx1Iu0ZMtPIRt2jScqJRUfs8UhhCLAAA6eIh NmWB0Ovr6/X1tVysxyhgKrn0TxdURtyiScuJRkXt80hhCLEAAKRLbIn9+PGj9/rJ NacsM5bb29uuSbuHyBYlbuyI5cy5ewd+9IxFPQzb56OXPF4YQiwAAOniIfbx8VF/ KxdffeXl5cVGAfr69auE24uLC/nBfdfz87NerO2V+/v7lUPe5Q3e9fr6+vnz57Dr gn6c3c2XH+S/bsdUfeRqFZA3ehvijrcg5enUMSDcIiUhR9Yse0P3gHyofYq86Lbc jljOlD+BvEve6+5Sb7+FK/R2slewThvbb/n0PZC4jYn7POSWXH62naN7pu0vEqml iYWxnePtLtm0xt0rxZOFbbWymLzl5NYBALAMdjENfyVXSbcvqHsV1kf19Q67vqIX Wb1V2rhOubZGPuvwo9XXfYJMc6N8liZejRP6ipcQ7HMbV6u/ldJq/NANCVfSKLJF bjKXgslqZXfpSGUWP7zsMbCcKX+Cw4/H8TTZaluivdH77iC/1aK6MUl+0GQov7Km yK4b22PndPpLpW9jZJ83cksu+8G+cEmRGqtfei09WRj9lSyju0v+bdtd8in6N5KF LbXKAuHXGQAAlqotcMql3MbXsqunG2vtpqdelxuX8T7L7qU2zqGgrb6WmiQANEYd Xblc2d0XI9lAP9TrDqERyHuxTWSLrJCylyRUWOHlB917o5fz5J/ABpTwWuTs9fBD pajeffPG8nfd2K7Lp/+lOm1j1xDrldwLohodbY91qqUnC9O2u/R1d212KHl/OG1A Tt9SAADqtWonV1KJst5V0q7CdlNVFkhsF7XG2MaxDvQmrP1X1i/rCYf2alz5yU8M WyAbX28TyR4WPLy7zNOVM/InkFf0V+6eNN5sUPahjW13jUGx08Z2Wj59D3TaxkjZ 4vQtYSC0DjbWPJteS08WJr675PVwPd6hp30MumwoAAC1Wv3w4ojcZ0+JBJFl7Fde G5pmmJR+qp3CoTVYhWu2O+YnPzG+RW1pZ7pyRgpjt8JTBlKwD23sRWmp0s2KnTa2 0/Lpe6DTNkbKFtdWcmt6jdecISE2ZXfZVwz56kcnWADAebIQm7j8wBDbGI3E9VFk nZJY3Kd4EsPhyTid2KNg6hDbqZwp3xFSHqu3ndm2gP7WbTbvtLGdlk/fA522Mb7m iLaSH5p2i4nX0pOF6VeXtDCJ9xQAAFiMtqttm4Eh1v2ttbnpDeLGBiV9mkaf7pF4 8Pr62ikcrhIM3Op+wWNIOU8WJnGjTi4cLtBpYzstn74HOm1jpGxxbSVvLEBiLT1Z mK679+vXr+6IB7TKAgDOyhSRIL6M9Sq0znthP0Zl90xlAWt26xcOE7euxxZ1Ch6j lHPZIXZ4sRPLlvIpKSE2vZaeLEzX3Xv40QnWjbI0yQIAzsQUkeDkMvrstj7irc+q h1deGznKe2qmUzg8ecc80dQhtlM5F9mdIH0PFNWdoFMtPVmYrrvXaJS1YznzZHkA AMzCLnyJy48SYt1HvHW4/nAZSzVtwyOkfGL82aV02R7sSilnpDC2npQYYwOQxh/s cvsqd01Z6cun74FO2xgpW1xbyb3d0qmWnixM+u5qDPCWqBMfVwQAoGqrHxKXHyXE Hn40xn48arwB2lawTuGwraFMSRIYHoQ65bpRytnjuTnjPvsf9utwWcue+9fptLGd lk/fA522MVK2uLaSe7ulUy09WZjE3SUbGA7tG18DAADL03YVbjNWiLUw0HY5tjYu t2mubd4Ba1RsW0/j9EmSghojU6ct6pTrRiln4nNz4XrkFVm/uz+//BiAtG2yA+8Z /OlCbL89kLKNkX0eYZXTi8T25Uv3WKdaerIw6btL1h9+9WgbaxcAgOWxtrhVS3Nc yK7akTFd3clq25axmNT2udY0pz1m5QKtHQ/cm+AWvbxGRfmVO4OYpSO7uMtvvxwl 9qts2yIbij8ccKnxRvMo5Yz/CWzyVndKVllS9144lYAu3DjtrPe5XTe2x/KJe6DT Nkb2eYTVPSuMrF/rnhuzO9XSeGE67S5dv6zE6oDOObtqb6AGAGAZ3MdAPG1vkeuv OwCmXDEbm4ws79kybVMn6FPVkRipE8dbk+D9/b1csmV5Swju9VrDg36oLOB1rZTC 26p0gfS5utq2yGbm9bKH/NbdUV6sGlLOlD+Bux4rue29xoUl/7gLawbzkl7Xje23 c07ugX7bGN/njXSdsnvdSqiTynkf0amWthWm6+6Sj5C3SPHsXVo2htgCAAA4ZxZi 5y4IAAAAkIoQCwAAgOoQYgEAAFAdQiwAAACqQ4gFAABAXSKjXQEAAAAFCke7ahsj DgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAlOn79+9fv3798uXLxcXF6me3t7ejf9y3b99eXl7u7+8/fvzY9b2Jbxzy ESjK6+vr9fW11kb5a0pFtV89Pz9//vxZfyU/yH9nLCcAAMhMQsLFkcQDSbP2+uPj o7woyXb0j5N1ShrR7NHpvVKklDcO+YgqyAbOXYRM5MuIVk75Qf4rX6nkDyrfTQ7H BCs/yx/6+5GmWc2x57N/AAA4Z3r1f3l5CX8lsVbywxQfKh/XL2Gmv7H3RxRO/iga 3uYuiG+K6Kip1VpfNaxq67p+SbF6q9/FZPli9w8AoC6rLJaxFRk2JCSX/shHS2aY qFSE2P9t71zOGomVMOq0Jo5JYmIgBSIgAhIgAAJgz5q9t3fdty7/R92i9Gj1w20b zlnMx8h6lB5u/VaXpNWYPLvNel3i9478W8pfWJ1xe7PtAwAA98URyg8RuwFXenpd W40QfQx2L/dyCX+qiH17e5Pvx7UN+cbr6+slmlo9WIrYTufeZvsAAMDd8TO03zG1 OKAiVbTY9e/fv0uI1Ra/WcTu0s5HdtYsepVfbeqNdqoHF4nYXcoFAAD4GdrvmFoc UJEqWkMzTIfY3yNJTEL4hnFLZX8nmaEIftZBuXO8JULO5/PT05PvyUq70afvS8de hJwhk27pL9b5S2cr4vn5eUTzWCqvtRKWRzeYtXG/fDLeT4GwPyytms4q4kmUKjqX apOailO4pdUGt1LaqfW82S1h2aF9C1MEt7DTLHJbjbg/quxUre0Pyzba3B8k1S+I 5ePdmvCcO+0zO24BAACc6nSzOz+jFgdUpIXewMoGm/37UlaixbWNazBXINo27mLM d47HbKsK07eie1YqK2pFTxgVkfbypMXklog1yao8FdmiWYmzC9G+XcgVnfKPcVRN l4VK4sarXGH5WHJFUHyXgqUZVuLpy9/DtfepWJ/UjxFvFunk09de/hELPX8/p8IK rarBRNnUOtrCe8rFp+vbkUEyLV+J7bTP7LgFAACILJZxq/gZtTigIh20XDYrZaU9 0uGr2mXj+kRCIkoI6au4YbwqQqKoE9JvMZonTGJPhUbBVi1Cgcn+styS6g4j00VJ SKe1Wa37eRy1npdlVfDFQK9pdWk0ZusxozHS/6fvvs2Wv9a0By2s7payvpv1L602 tXYFxn633vGsRgbJtMqdoNo+I+MWAAAgskrKLeZn1OKAisxSStl0bpJEUalvLZrL J8shismpJjlaCtM0VVKniuaCpKVepFLiBvlqzHRkk5Ds6W+uV8WTefFvRUjNJWFm qfrGR9uS0LIi/JRUJ7XJVFuy9qq5SbMWVoX0iKNFq16lnc7IIOnk0G/JMtXIuAUA AIB7x3SLv/uOCspFztJ5f1DEVhkUsb7ul173p5jpcNFUSqde0XPYGifFLFeMow2u S/u19kyi1rK/y6XCcZG21EL3apDDQyu3aiaLROxgJruI2NXjFgAAAO4ROYuewvre 0v3+phlMVsWNWjHzTlamSN/e3kwr+g6jWRE7jcndU5e+3DKTvCKn4FUby2oxUuvp 6+V+VK1Vl9TS2ln7By2cvm64UKBZMnKFwRYR2xkknRwWidibPacCAAAALoS8KP09 +6LjreT0aOLk7ZOUsH86welrZ33p37iLiN2yJz1efevL1IMtMxvNI8hC+zd5F7Rq MS5iZys4hU1hYnbr0zoROztIOjkgYgEAAH45Jsk6EiXN/oOvZf2sgM6b/aqu0CEJ RkeeddSvwsvV0RhN+nP7hnTffa9V07L0KiNqynWd/q56CJTSbtydYPwAVd+/bzVd V6+OiB0ZJJ0ccCcAAAD45ejY0tanfmqTh6wTS4MitqowB0Vsuf28s7ErbSma5ePj o9RRaeVwRB6PiNi4GFtdhp2WbOyKzFpoHyWZ557G/bXrpSJ2cJB0cthrYxcAAADc KTplqDq5+9GdUfZoAU0n2KfI2uFePQJrUMQqZFDEVo/Ymj2KVoHl0qL9V3cQtFqp 1JNJNvtBsmXawdMJUl1O7VO/SpHmp2OVLqx+osKsheksr6m2Xa7KUhE7OEhGcqja U6aaHbcAAABwd7heikLFFFo6GN+RxIrH/iuyC0itepkcsgjaouX7s2KSUsZoOdEP wJfPpN7ae+a+m7481T+uGLeKiKW4yLHiov2tVko7uZLCd80fr7jSXjAXli2TEloA b73Ed2GZ1L7rtFgva0Bfdp61UG3rPV69LqFKWrD1fqnaKUYGSSeHTku2Us2OWwAA ALgvtDfc5aKQ+Gmtv6WbSSVF/FO/OtY+snx0/ZOf2SUHhngUbVRZnrPFUbbufeor vVpafA9XiOp2WtczEm/VIrzK8WqnketHdVNtzNPMS8ue0f6yZcyGeJ1uXxm2IpgN cVtZWlZNF+OW9epbOH25l8QcBv2Hfb+b8kyllMu/I4Mk1VStXXZuzLzfPv26AwAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANwmT09P//79u7YVAAAAAPCNU5uH h4fn5+fz+XxtG6/Jnz9/Xl5erm1Fj7e3N5PZ6jL7w/478tFP4uPj4/HxUdX8+/fv jfcXdHh/f7fus7Fqf1zbliZmmz0YbaRd2xAAAPifBpAAiCInCoNx8WOpLmPjBenY bBW36t+yjJeF9nPjP59Isqq/Oh/dWjdtscd6588n6qanpyerpmmM/ayDg3h9ffXf XDcrYs1Ik68y8tq2AADA/2hNHNKxphBGMnl5eZFquoCB/8e0ikmyvXLr27yvL8El pKPmU+84K8I6y8zufHRMN41jlpg9q5dPpVo9ueT6Yatk1/05sO934Ua4NRFbdrHZ dryIvbUfngAAt0Nr4qgu0raQGrn0s9109Y4TXN/mfX0JBn8LjOO9s+ijY7ppHPdd WZfcWvWKmmf3Pl3Evt+FG+HWRGzZxVcRsdcdaQAAt0xn4tBHI1rOhO6lPUjP5/O+ E1zH5tfX1x19CZTbLlk5ncm089EB3bQIs8TsWe2ve0XNc4k+HWf378KNcFMittrF x4vY6440AIAbZ5GI7b/BvNz7TXfs3H2Cq9r8+Pi41zt3vcqvTkNbmmudiN1e7iUo 7Rm0sK95LlfNC/XpILt8F25tDIiriNhqU7S6+GAR2xlpAAAwtScOf1zrI3vUm5rV XqGnpyd7tJrS87VKC9SuB8/Ht2mcPnfHR7cu+1ufRqdTS2gZ6ol9+r6hXmsRiWiq xfQX5WbD8/PzyBxd2uzhlo99lOJbZVVxFWQllnESctqMuDZW0WpV+yNuylZBvoUk bbr3fkm8f9L6qF/lFVXbBStXi7EeogbRwIgHLNjYiEOoWs3oHNsZq52R5sgGRUjJ W306W6h9VH7L1B0pUBbG0j1h57swXkRn7E1rv02J0ypXZx+uaUDa36UNsY/sj7K4 2Y5udVnna+tfMYvmmcvhfHcLO2ZYNB8h6iY5wy9t7dt5KQMAsA6fOFK4JjJNfzaR xQepDsPxZ6BPeSkffwiXj/c0sWo3vWtdX2uKUqplp2zzScQi2KRgyfszb8vm6Usn pOQK9Oles95pYC98uXRjWcVpy9pQcTRD+Y57n85UUJqkVqzEtqq8umpb8B8y0dQ4 zJ4+US8ovBR71e7rj9WRkebbzVS69UiS/WULdwq1gvz3SMwkJon2q/FdANu/8XCJ asXHi+iPvWntt6nktEHEak+lj0ZVP41/BXoRau0YZ7aj++Ok9SXy8Kj8lTC10nYL W2b49sz4E6n6KOizro8AAG6KNPfZs9SXYmz+8uUvPXL9uWfR4gKRnPTSHOqB5aMy rfWpuFJZxXf6VcWip3eSN3Ey6lC1efr0JTBSTE390UvWWkDKoV9KdRrSYm8SDzK4 NN7tnM129qOyyluqth1fV/QQVV8qLtqjwOSlXO2+qTtWZ0dadVucxakuhg8W6vYn Uz1JCknjWSb1vwvjRXTG3pZvU2KdQJJhSQ2qg6JVpSCcvk5T8eqPPFI6XTYrYpOq V3H+u28vC6tmVPczWllL3TDW9REAwE1xKrBJxJ63vhIlZp3BqnOolpXKSTntt7Wy 0rpfWVwn//QollQb2dLbEgPpZXp1LVQFzZ5+02q3anWmrzeMaYosI6/2iU1Zbana dkpTWyKh2lydNmy1wOxIq/7ySsZU81/U7K0k+u1Q+nJYX0QBP94aVata7bbx25SK 2OJOEANbrZTGpxSg//YZeaSs+BK1wqWHvZUuaqEyT0+Jw1w+AABuitaMllgnYl0S JF+v2YfnoIhNB6KmyLPHC5R5Vn0JWtJihKUidtDOvUTslqptZ1xXVJur1YazY7Uf 2d1gqi6mrfy3i1j/sqwYt4NFdGJOm79NKcmFRGz1xYRH65wSfFERG18WXNpCf39h mnnLvYrr+ggA4KZozWiJdSJ2+npr5u/I7Glvz97WuoE9kO0RHbc19fM/dZmtVBnN 7Ey+BJ2qjbBaxMqvwyap6k1Ge4nY1VXrt/zqQXWYiO2MtOnr7C+F25BIS2oXErHj 2nu8NRaJ2NW9Gd2tt4yHRa3UIuXZ6egdRWw0/gAL7cngkU+NjW+JvfoIAOCmGHx2 rRaxnlArBiYPqhtp3z/3VuuB/PZJKq6a/8YHb0quJZRyWXJLKStErO+Pludw1Xf3 6iJ2F64iYmdHmvANbiK+SvjZInbFYDCR//4dNW8KnBVa+7bSbEdfWsRe1MLp+zW4 fvlyi736CADgphicuVaL2OlrEcBvRC2dLX17b9pve5oTsXqG73Vavtbfysf4ke4E uo/AiB+VkfcSsb/NnWBkpEX8cIA4MC4kYm/EnWD1tykVcWl3gr7cGunoHUVstOoY Cx0/cWLp0dbr+ggA4KZozWiJLSJWTlz2pLU/yidt9Zk/KGI3HgaV8rQJpbpK3Nr9 NMJSEVsVEmXkvUTslqpt52AROzLSrOWThiw3/l9IxE7DvynGW2ORiN3xaLV1AmlR K3XE9uAjZUcRm46VuJyFWlCtlt4aey3W9REAwE3RmtESW0Ts9PVUr94x6jmvELGK Vi6f2n91hnm/UjFPTSvVecePXSrXkMuTBFq16xRdhh8mYrdUbTsHi9iRkVa6u5QH fK0QsVV16ueJpRDdRJBsiK7a1YoPFtFKPm3+NqUiLidi/aDUlNzGsFpp8JGyRcRW j9jyxr+chToTOGVbPZltlnV9BABwO7iGmX2a+Y/96lzmE31r8aE87DGi+dfEg+kE bWjy3UyuHOLh4Wa2m6Hlo3j2uA7Sn13OSjanq6MSri5iKTZJzS5bpXW89+8Hh5bN 5dWRqnz/9JrT68JYo053dD6qlru6atspTW2tKZVmd9qw0wKzI02yIV7+Va5PVvu0 /wVJjSy3Zy86xvSNkD7yZWTs/ep3YbCI/ld19bcpsUIgtQwrG9bvBYh3ommvk/8W G3mkjHxTYhdP4YSB8nKQeP/gXhZWzTh938llgeV1GCOs6CMAgNvhVNDyqrIZPN6C muSNpYr7C1qZWJzWVOgXrSq5jqj1K3V8sm5dQiovBa9FvIWhRWlzy5fASVc9jpTi 5vlCtI4Xi1eapubye1fVHZrj3O1NFXdZq+6IB/W3PqpWeXvVVlOa+vyJW+gyPva7 PFKqdfHx0B+rIyNNV5HG1ijlQerTdE1wVf9HwyxPbdmTGenujzRCNAZS61W/C7NF GJ2x51Vb+m0q0V1g4/HTHqV4r1ZsWK9p/JpUW2m2o/vjZCq62K8w0xuK93A1sC6G LpevN1rYMkOX0cTvjoWvONV5aR8BAAAAiAN2grPZHAAAAAAAAOBHcgosDTx958bT Xq4UAAAAADiYQUVXDTxGIu6V9nKlAAAAAMDBDCq6auAxEnGvtJcrBQAAAAAOZlDR VQOPkYh7pb1cKQAAAABwMIOKrhp4jETcK+3lSgEAAACAgxlUdNXAYyTiXmkvVwoA AAAAHMygoqsGHiMR90p7uVIAAAAAAAAAAAAAAH4DulPy5eXl79+/17ZlDW6/X+8O AAAA8PNYcen2z+bh4cEvVb+2LWsw+/3G9lLEXqW7GWMAAACwLy8vLyZ1TPaszuF8 Pv+8+9lN+92viBVVEbu9u2cp9eoBhQIAAMBvw6TFRrX2+Pj4895Z/1QRu727Z/nz 508KOaBQAAAA+G28vb2Z6nh5eVmX/Hw+V99Z3zs/VcRu7O5ZXl9fy0a7dKEAAADw ayn9AUY8BCyOfC9Xi9h1fggHeC9cRcQO1mswWssndjyHpXx8fJhYbTXalkI3Gvzz 3F0AAADA5vfX19e/f/9GtWMhpkbso/P5/PT0JGVi/9rfrge05lY9Aldod7zC7Y+0 EGf5WMjDw4P9oSIeHx+tuFmDR2yLkf1dttwyLaSap5uqrN7e3qoi1sI9Q2u05+fn WYEkO32nmP1RrkmWrSFLyjZRZ6nX3GblmSypithqd7uRKrfVUJbE7PE4Vrq1hn9q ydNgcCfYVqHTWAct6vESb7GU3PpOEXQMhQeWefZH8vQ5KqxlvBaWmxXUyqHs1pER Uo1m+Tx8UrZt3+ZZgwEAAG6cqB80CUowKEQzpsJ90TVNdlWlZCiyT53a2uNpTSpE 3aLzoGL8Kktt0zTt6k5C0UIsPEaT+rIcfEeSRfOCYkyZ7drJSrdolrAjpUx4/PnE 9Z6Ki6bG1rBKuYqTtZZWgidWP+pn+1Q1NUti0WXXlN3tDavk3p4y0mXe9Cl7Yit5 m0fNWV2+bhU60kFLezwRf2dZTK+gtZikoBVn4Rp1nmcahP2RPIVta65L1Q6pBbya Kt2bYmSETF+r3IYn9OFhH/3nk0GbZw0GAAC4C+TUGgWGzYkK0fKXx5SMSUenVsVJ OdFPX4rFY/pSp0uIkQ1i47ZV9eoUhJP+q+k75RbN8xDFTNWf1d5lBG/wGM3lVtra n/SMpy2XtaXKoqSsdk3Z3RJRFhLXBj1DD5ESK6VvPHOg5YNRFjoNd9Ci0VjiybUY m0pPLabA+FtgZCSr9VI7WxKFuAHxUys0KczZEeJKOJVStuGszX2DAQAA7ohSYCgk viyeGhKlqpSkf5Iek+bxCXe10+mgbbIhRZsK8VMuObYyVMykIqQ3yv34MR+r8uyL /lZruMbupBVazo16phUzhVfX/VS12INW8dRKpc2dPi2NGeygaclorDKevDWK+iNZ cVIv+9/V3x0x5sgI8UyqP7XS8Ju1uW8wAADAHdESsUn/DIrY6jrSVKxkbhSxfdta k/70OVnrIy08tqRUS8+0NOGIN2+nCrPyzzVJS5qWeqYVM4WXS7iDbBGx4x3UqshS ETuSvDWKqhX3keyr6HKpLUeCewvLc2bW4NLm/m+cGD5i86zBAAAA90I5y4/P+x09 1qKTW8wzElexRmzrK5yYQzW3ag79Ss2KE9NmpjNNM1Tv0hqXf0sNnhWxg/Y7pnlM BcUdRitqMd5BLQsPELGDI3n6/AXhrXEKXtNO9LI2KVu9v6wzQvorsdH/YdDmWYMB AADugnKWH5/3y5iD6qIT7b0gLhaN2HY5EbvCb1Cbyk9fW++rDqJ3IWItjjwzdXpD y214pBb3JWJnixA6BkFJfDue49vlRFz8HxkhHZ/YGLjI5r7BAAAAt085Y47P+2XM zpvi2dzWWVvmttSdoHqcVDKv5XjQR+f8x03l1Sq0WmPw3fr09Y64dCXdy53ANz2l Le2nVSL2vtwJFq1S+okK1Wt2LU8ttPo+tcERojMNLJp6yk9ySEdSrLC5bzAAAMAt U86Y4/N+NeaI3ruoiO3YkPYNadd2ua2pzLC1BaxP1YxxETvu6br7xq5IVRptEbHT 8o1dx4vYjpHOx8dH2cJxjdr+Lpdko0mDI8QKMpEZnQ1ahx73bZ41GAAA4I7YXcT6 QZSpIJtA9zqdYNa2pUdsJaXhRzClIsrDuOy/uqSgY+24iE35lAqzmqGl0mLa7BFb ZbifAVU6avoG9qp5G0XsYAe1KnKMiJ0dyfZHecxX1OE6ijZ+mpaaB0dIOfBa9G2e NRgAAOBe8CnVp9G0UuT4ck3rWHUduj6Fc+PjzUTaS+JKqZrbuLWLbHOrtFyZ3sD6 ZQfvXwfpty47SDFVZftv5118uklBbqWl4HT5FI/BT5cdCEWzwHh4vhwmY73Kbu2E q6BYtK/7eRyt71l1rDhtQfIlQTcv9Y7n1jJmpIMW9XhJq+i+iPU8R0by6fvGKMtE SVSi8nRNXl4kMThC1EEP37Fsy7E3a3PfYAAAgLtAF1a6LtILyniZqU+RNufG+y59 BpeKU7jWeRQuKZjucvUpNeU2+I5+qW3T8LWz0VS/wlX/TRo1ZTh7QUNsB0uoRnAv xHJdWstl8WbVtETskizVOl47W3ZrP3wq7iEt6+V3niqhivO7xlyk+V4hvxa2U+hs B63o8ZR5dZjF5K4eU+TBkTx93UQcL1OzCOmI3TRmolwcHCFynT3VKFugb/OswQAA AACDbHw5Dj8e05nxalqhnzynmlcGAAAAwAEgYqGD/D1aXitacT3YJAAAAIAJEQtd 9Oq/9akcNo60BwAAAEAgYqGDnHWrbqsWqF1+x1sFAAAAsHGvPfxs/Ais6FFgg0H7 v/pn/AIAAABciOfn57hVvOX6mC4J5X6lX8X5fI43HfipAqzJAwAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACM819wCzE7CmVu ZHN0cmVhbQplbmRvYmoKCjUgMCBvYmoKMzIwNDAKZW5kb2JqCgo3IDAgb2JqCjw8 L0xlbmd0aCA4IDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJytV8uq 2zAQ3ecrvC441ciyHEMw2HLuorsLgS5Kd31AF4XeTX+/mhm9ZTs3UALGsl4z55x5 RJyh+Xv604imFfZVg7TPYcTn2/fm84fmN03i7+3nabmfen2+NINUdsH9W/PxBRqQ zf3Hl6tYhQElugmu4jK13VUCaKGEkho/SZ5Zp/ZytV8XHCjo6QVwCi52RTtcxThJ OzV9vX863e6n1+J+GMjCDQOyy/mUHh98JV1hreEJQybgbYrXkwlslcYF9Haz763m vX4hD2YAOpy3sd2KBwbohsQUf6dznQYODiU7un2WamrR7QRFKSNOhmYHO6vkMLXe yiF1lg2zi/k2e8pAN2qe3MGz77pzt4EnUnD/tbmDFADCbisI6J1VbMEtx/3GBmqG /4WRgRkG5zhzZV0JiM8eXcCj6UzrLkAF4oGMGMAVlAP/hh/ENeEyTBlEtzj4/bhL /uIZd24u0XuWWxTXyt6x2yDYCOuJ4TVBXbBI6SalnZwn+8roLQwSCnOP3F5scvWA XD3qc1+GNxnK7CRBFODiWCJ/e+vFbAWIz579DYS4UGIHrDdEF+s2TSAqDd2SlKij yEMUDTJpozMMeG/QImHMdtlVBOGYBvmuDFEeKysmExh/41HiFuY+uNF4dcdSWBDD 89SObgtrwb7vxqc8DxuMPKLwgtuq+DS5fwmRFnzPEFMpPYQpMFlCkymxpRSqLHgJ mgWRZUcr69lnzX1BuaCwViepOiZ5E7Ryy3LBUe71QkIk+mBtwMaaaSgtDN5DA7K2 8GXqcyUTt1HNu6EpN0h6xKq+nMcyMDe4cAEY0mdGQcjIaUSDG86VwhF4zEEhat02 utS4GuOuFT4W8MykAtsJhRZ5KLO8q1wtDQX5vQUSQ2wXXoKr7+s2BXKZznKkZmV2 FNdF4DhZeREEZHR4KGKFy0/eSRQSSpYxRfzBXxeLWIR4TcUWY6HbgpCrmE1GfRpz hnqF0LJgYI2TK3au+OBZdZyBduVozsNhV+jYYNRUPJK6gqrBKEBPM9JmUYhNEQvO F9ICnkICNZecKpP2b42d5AHI70g9+zXMBQ7mxqXoamcOOoh1ZyAXk3wkk+7Udw8h yp7sbDifbVTNw7ZSaSxbFYmPWJfDTufxTEnmjn7xLRbVF6dqyUkm685jQvPxv8TC oDfLUvlfh4LYYGuWkpkkv2L///jPgQnQUfvU34OMyKQx22NSUPxWxDxiErqqAXme yazpcPVhT4k0Kc3kolCubttQ1D2f+8qG5TCDuKJ+HJV5RNKWNOHzHpAgaSpyWf1L yTKbShrM0Nq4TOJ3HPZQJss9837IyrPe4O0B0f041j3JblPsa3404rX5B45hhR4K ZW5kc3RyZWFtCmVuZG9iagoKOCAwIG9iagoxMDEzCmVuZG9iagoKMTAgMCBvYmoK PDwvTGVuZ3RoIDExIDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoMSAzMDc2 MD4+CnN0cmVhbQp4nO29C3xURZY4XOfefib9uP1M+pXuTqeTdLqT7qSTkEAwVxJi 5CEhRkxkQhJIIOEZQgDRYQhKQBFGUDS67igKAz5mpFHWwXmZmY2O7gwrM8M4685D HBln3ZGRcdBvR0nnO1W3u9MBdB77/ff3fd9v++beW3Xq1KmqU6dOnVNV3Rkc2NhD NGSI8ERctqar/8OJjAJCyI8IAeOyTYOemQUNKgyfJUSVsbx/xRrb47e+S4j6fUKU EytWb1m+o+BrMwkxYHze0709Xd226Q+MELLkIaRR2YsA5Zb4IMZPYzyvd83grS98 kiHD+EWMn1y9blnXN6yHdhPS8TWML1nTdWu/7JuqNwnp1GDcs7ZrTU/lH80KjIcI MT3ev27D4EQe6SZkA6Xn6R/o6f/dpWkvY/wCIbJKhAFe9IP5QUHjHC+TK5QqdUam RqvTCwajyWyxZmXb7A6nK8ft8eb68vz5BYWBomComPz/8CPfS2z4nDf5TP/wT0qQ id9NfcbnsLwriS2+UoIm4nruJxN//NtqoErcsr+/EdLnIdJAtBO9E9+c+BO5SOYR y4Rm4sTE7zk/9zSmChMXGFajjJY0Z+IF8hb5MfkeaSXfITeRb5KvkcPkMfIouQ5h NPwQeYE0I/53SQtZRq7H0BbSgal7yP3kHpQxCtmA9/fw2o5XceL6Hd5dqTr9mvwa rNBAKsiSK+q7kF2IQe4jM2E71r5GfjfZR55AuoVkK9LcQPJS2LUT30Nx/QHXR5aT XHI7QkS8AxM/J7/Cq5LUkC+Td8kYKSOvwiiZQ57G/GvJcSy5A+t7/3+Xuf/7+d/P /37+9/O/n/+Xf2aRxxOhJ3HmSn5m4mxWRk6RRaAHPVmauGbgdRu7RkgQJ5RZzdc3 XjOzZsb06qpplRXl0bLSSLikOBQsChQW5PvzfLlejzvH5XTYbdlZVovZZDQIep1W k5mhVikVchnPAQlBdiy7rnX2ypitrjOm8dX7BE9Mc8OF+eEYMTq8PoMnGm4rTmDF 5MEYMc2NmZtajxOxqi2mCF6OckOM9wsfejHzfIdndkzmxz/fnK7uWGFzq9cnvOFI pbdhnpi9rtXrdcQ4P/5dj0n4N6fL0x0TmhDudUiQ62OkqZXeJyd+U4VAUuVtw2dz aywnGW1ru1olX0TrZ/Syat4Au4XjGltdfYyYjxPNb2LEQtEuVJEYqYkVBrEiAoYY NRKOgfnDGJhiYJmPVZ5aBM12tuoqPJjdvdI3u7sPOdrdOcnTCxJHvZ7dnt3NrYYo Blml58ZeXdh6PDOjzlfXk5ECkOMZmQjJdBAEESTSfxw01wALcJrZ049zRKVFBhpp hWfTe2VMvKcTA7565BymmCZTTk6M7klPIpgtGTJJIanUmKIuppSq4emLiV0xco/n eGh0956TAlnaGdR0+7q7vtAa47sQ4Tjh/bN7W2LOuU23IAiLwruz10M7vJ49aPd5 Zvd6dmOc4nbi01dPu30KvLu3p5MKCnT66jFNXde6yzvqiBnxPTtmCMauQ7Trbjvn QGhbWzbWbPdsHxJD3NkrZ1Geh1P9wsTt+m7GffGeLk9saOlKSbi69iQF3LtbiGk+ 9iL7sQMwJ8uY4FR350pao5VdtBWzV3p239PDWrKH1RwF0jN7ZT29aUYUb3IT5r6l dXavb/ZkgdguDPD+y/N6vTFbkGbcvXs2rWJXN9ZeqjImTNafCr0jCFifupjYwl6k hbEYSxS76tsSoATCLTQbTemsb2vzSt2KqDGlf5e8xOfZTSkq/TFzUPCOYdpocWhu c+vsegdrfYyra515PttxHsNzm1JgyEac3eHzDolHc2/0zV0odXJv8tHZIo1QLtWx iJrAZ1RPZTtOYbjB19C5e3eDz9Owu3N318mJoaU+j+DbfVyj2d0/u9PDhjYg/Jv3 OGINe9piQmcvTMdOpuLU0Dw3Zlq4mHZPg6e3S9IGtT5vlcNraEviNH1WcmIgoUCj WEsDabfwPtZOg0rH4WmgGuQkDnxHTKiiIxHrclMrCvoyJpTsgQPgRiTvoEOBb/PP 7rsxwSKHNykyVLUtTECRiNdLB8k9J0WyFCOxoYWtUtxDljqeI2I4iL3XSVNGkymW m2jKUDIllb3Th72VPffGvyDV6RK92+AzeqrDrAeYRu2OjbZgG/+rKqaqSnS4qa6V d3CJEOfgaSgjiBqqJpYVZBkpT1AR7hZ8ntO+mBCMyetaRx01bR7BgBoMUuKQoAgx 0U6V5mnfa0BVJTELMaiJgZUmEVSdTIPzWVWYmMrrmb27MyFr6U1M6Pvu3qu3E3EE HzbVIeEbjD7a2h8x/ZVQzP4GOrIcXgljTltMR9VvTPc+e2D7HHWtHlQ1OHYXsoBn tqeXdnzM01nPlEKbIx18cuJsZz3VcVhliuJICDk+2/5yqTap2Oy/fhgM4TDYvqet d/rlbJ7bkgo1t2513NZWTAgHTvTiqxXo+BMlMX9DwckIvcOnzpxij9KI1+A1+PEB Tpnr0jLedekdBfmEDMkJXVtpRC/+H+gqArdKnCBCFmRly437s/kM7RENHCbWw1ki yYTMgwq9BpS85qDBkKUgt85QbDOIdodhW3dE74D4hAPecsBLDrjXAdsc0OGABQ7A hAsOeN0BjzF4PwO6GfwDho9JMZY6xLKEWSpxwL9+wGgdc8A6BzQ5oJalYTYs5jRL OsiKWcCSPAz+OoM/xuCdLCnCsnzlA5bnGEtYxwgJLMMHyTxIa18im/gdShBznZ3a GKkUhK+SGnTwigZdSGvNvawgzCaySkhteoulSg2NMMiMCVaOlO3eJNMijNbZJLA/ mcHD8lxghEaTTOtP8kYqoz31WZ/8DCQ+Sy6DX5GSnnZ5Svtn5rlaUhDs2cL880HA 57mOJe3CuXa7cF44T8Ljo7Xjo8Kv2kdLI+Arz/f5DGarNWrxVpRVVlYYfLkKi8/g lf1DeU/PD403dI6/1LnA8C/Le6KyZv63u+66JHQvyA2Hcxd08xfu2gUrqOzaUOgv yPeSArCIYftRx9MukjmSk2NQP+ARCji98ahIDORQHogqTSU8IR/OEwN5vZxjluGQ RUB7SOxUqSqFJ3I0wxax0NLDHQzA2QCMBkAIAAlANUb2BaA/AJ0BaAqAGIBIADwB cLNkTBpKpmLSaZYzFoCDafB0Jg0MTGHfeolP46PnGKcunkvEpeg5Eh61j4+Ojtae N1aHz9d+dL40Qq0hMZPzQh6vyrE7K70nJ/79eaUgvZ3uylx8P4dxCOIHkPNoCSBr KwzI6lwl8lpiNYv7KvxRQ2W0zGqhcP5CvLUp2tqxtLtsYby1NeCPVoPgv+/e7dsC reHoCnjgS/3N46+viIbDVUv5n9YUBTvHn9391f3x6UurCEcaJ97mb+FfRlZnk4ui RTOSnc1ZRkSVIBqAGM4auCzegNx+PttWSd9iq1JTadA/xJmI8c5MMVN0uirtmX2c Xg6CPFuzUy7a5Mu5UTvE7HDQDvvsMGSHfjt02qHJDsQO1+BLtEPEDh47CHa4wPAQ KcnkSfFM8PRlZEYwIZevkNrxV4JBgqD27Fr7fMbfBHODduVuJZdhLjLjpBjk7+H5 eRlfyOAyMuwZRRm8JgsatIu0y7W8TAt6qRDaw21+zpfLVZQbKTu9yM6yaTxluULJ 33LfB8+8++7xJ348/sAT+57Z8LVlNy3eqn8nHgfbT38Fjj+NfvP3j0Dz8KNf2Yl6 nNTiQ5CvRD66yFPi+uzfGEnG0cynCepdjWDgjgI5pBuWZ8IhueVtUe9wOzg375Dn uOXDhRGzG2RuqL7ohn1u4Prd0OmGJjeIbhh1Q8wNB1nU4wbBDcQNFxgEUdMxp45o ysgOxksqkGeQXcgr4eKYMH6OjeQl7R+dr0XGeafKFJUmZINZ4cvNryiv5IR4ePGM vHIqT7NuOl8iiiUl114bnt7JZcwIBrvGZd2V8hkMVlIi4oiux2F9CUe0gcTELbT1 GpJquUibbjTR5p4xwZgJTpjgsAkOmGCHCQZN0G2CPBOYTSAzIScYxj4TMsMEnSZo MoFoglETxExwkEUFExATXGBRxEtHm8KJBCPSlV67NGTH7ElmfHRVRsClycFUtjA1 dj6tWRGl2ss88Q7/Mf8k8ZI/ijssI7xgsjbyglZo5Hmd3K496tDpvUfJ05zJ9IDc hHOMyvEEbxkWvYecxCk4OQvvc/Zy2kP6YbVI1JDJ56pRhfngrA9GfSD4gPhQhflA 9EHEBx4Wj/mg34c+FgViGLGHkhBEmGz1FDVFu56OnHdZEEPv2sfLzi1pJ7VUL9WO jo8acAwFg8lR5FB6lNrGPGO5sd7I/6sC5ioWK1YpeAWFQhCpk2CbX+krYCKC/Mr3 VXgNbNikRaL8x5/4rQ/s2b7NGq2DyM0dnStoIOyPTq/v2rPnq/vhX+trhNLxJ77U 38JNY8HimiLk6g0T73BvoTYKwx4x0yCq1ZUGgxAIoua5ID6akVEZ8NDHPpPBbDIZ DCaNLRggeXqv28tl8l7RIzjFTGOl05k3YhOISlB5VP2qIdVZlSKDVylEuWjKrpQT hUkzQkwGk94aDBQXuHMPe0WjtdGrLxb1xeDhS4v7OLXisKi0Foi+osoC0WKrLLCK xIqdFLEu54ZKob8UOkuhqRQ8pXCsFDpKYUEpJEUuyfJTQTb07DhJpEBngvMZv6vp TXtAGAsSmoDptfPPYz8Q1Go0lkTapSuZjxPCLtXWsexgootC+gA45Zlmu6vytaw3 s97L4l/LhGWmQyau09Bv4BRBwD8trw+CWZF5cuLfRLXeWOkrxEfg5MRvntcL9P2+ qM7MrAyXqYXK7JMT//ocvgmbeqTZB//WS2OFTkXy3AI6C/kMUZzycZyU5xeUoM7E KSiL9nzU4KMa02K2Zlmp9oCDHavd1uzMcNj6j+vndc65b3H/gmM7atvdqhxtOFz6 0g2rr9v3L+ufdbkzCqBs8I6W2eW3XBuoG7hx8wFXRkH8vTcXioVzZn1hX/PORxIj jZshe5pYyeHnFcKIispCUKXR6o9ZwWp+gDPp9QY9ASWRZwqZGsOwqFe6lZxSTuSC nFPzcjprWSzZjWgaD+sij2VDLBtqsyGcTbtsABvMxsUrqCHHT5+qEsaQ+dVhOs+0 1556uWp8NMH1HJPZmVMpK3T68aE0V2I0r5IvdBbgA6N03qYMbPNLI8NXUVmJjIla fNLo4GZ8cWvrzduad2TMfv31YHDerHV7Nm/m9tcYD94SjzeM3zm7fjq21YGzyHMo /27SL6oVkA9cpnaEoAsjTlNp0dg3cUQJOl6Z+RAnOI+6ns4RDOajJrXMazxEdMNZ outZ06EsT1YP1+EFtxdEL6A2SJgoqO9GzwlnXkvovNrxMUnOwnTsL2kH7E2m+Quu bnDADWs3bq/KKcz3uGqum70uXtAa8KFy1Pn54D+sK6jwe24ZP9dTQY0MaXbAObEB deQwtsZHQuSX4hfyHpTLtcq5+Yvzufyg/3pNm4bTKP0jWpVWGxT0VrcVB7FVGHHg 0CVHfd5H+eCjSpM2Tz4sEneJu5fjTGCUmbKzC4czxOIMHIkl0FECYglgoJ21k2m6 6vBr1GLARo/RwTeK4+z0+V+dr6o9n2xwFZoNNMAiCcX3InFNnH1eqWu0UfnS2FyN QfUMNfdnJzgp+42YErBX2zlVBHW8yuPyoDYMtgfbyXrW58i3isSs6ZfMBwYqT1hp KAB+g4KOkGgZP1y4adraW5/quu1X4L7xpqoFmZpQ/rxjX3/gwZrcUPynp3fOuXbV FyrqH3xweNXWE00vbJheWhO5pXHrHXfE7du8LTBz5tBN89sS3P0mcjeTZEGhaLdn gl0JFjlYADgraAXQ80arVleJ4vMHUa1UVxpHRCJoTk78p2hCsMKIIM2IqDDpMwzG SsvJiY9FNQb0GTqdFBvCgP5OXrTxfZzlTrWYrV7OeWxouMNZGzTZIGIDwQYXWPS0 DUZtELPBQRvss8GQDfpt0GkD0QZSlhmPMVATA0UYVGAJ6fkPspxSNnx+nuuSmutS Hov0osOQWYaT79IIsxfZDAllRos5YfGZqCbjmOIyctzLf/rTT1/86PyFFZtGdvdu fph/Of7bU7+Lnwfnj94G26Xu7x97BdwvP/e9+G+SvstvkfcFYEj4LsLf5Lt0T/Vd DgfgXADGAmAOgAx9F4wcCMBgALoD0BKA+gCUByAvAA6WjG4K97f6Lx3/z3gw/zTp u6AyTPowU3yXv+C3WCb9lt/Ge1oDrR0dK0quj3e3BiQ788De7dtKGlGLUL+lZfzH y8snVQq1HOLTl5dTe1uB0n8SbU0zGsRKsd9w1Pi0Gdwj5CCJES6DZBCV6wFO0Jiy RlQm+w65qJe75ZxO7pX3cRmZGoKmmPGQBq3zTN6j6eFQUQ55gXihep8XBC+c9cKo F2Je2McSOpkqHU2GPV6YYmsvYfOIZF6dQ7bhvD1peNFpnnKxOhxuF9J8QfNHNsh0 OBzcpw7oc8ArijcUnIzqHoPe2CiTmWXc+Sxw5RTncDzO4c/bnI30LWbQVN7Mc0oe mGOEFhmqIaxNextV4ZJ4F+BcnbRlEzM29gbMGLnr8e+Mf+fOLY25fuS2KXfxyu33 fPlLt6ziq/fEL3znF/FXSoOy56mZ+8kvZv7su1/7TQvKujDxjvwFtHQLOPmLxI7C u0uV2Wi3u/W2WtsC2722t2xypc1mkcsVZrPJIrN4vMZmj9t7F8ebOY53ezC2S2Yx yzxemcVkNjabjOa7EFdutsoVJiPGzcZdKqVZpVKq2Nkgr8dNd7q0Sl223eEvIMrM oxq90lppabBssuy0PGiRT1NdR1FPTpwUnzReL1OMKEGpUlpknFxD8gWcXYioxykU J/8AWckRLah4rUYs1KzgpMGUxxYJcCRdDMAJNmZwtO1gA66eLRMgwmEGlMYfXU64 yIZoCxttnLSSIC00DF2xwoCD8aW0kdjBgFf1ShIKberaDRuIp9gUljAb241Z1bZw ezQcjLa3o1ZDUzGr2pBFjcOgKiiM7VKVZE8GdDSgS0AEpapGVQOGaHYY5z6kkJC+ 4jwP9bcekT8j5/LkkO9p8HABE1S6YYsZehRwnfxm+Qr5iPyoXG6VJytP6KMNFErw 8eCD/PyCCq8l12LOMplKOF8ybERpw4j8hUXR+JvBd+IX/fF3vOWzYdsi09g/l7pm 1MA/bbF8/588nWhsb1YMX/q/uObxZ7kPb67VlJaKzuLx9+DEcG1haek8w/S4Bs4t zKkqJTypiM/jf4YaN0DKybXcqJhtEtFkNdJHZgVoDWDkZ0Ss7soCOlvfqNQ0jrnO uDiXR5nZKB82Vogky8/nFI0sKISXCqGzEEhhfyGnLMzxPegRiQhB3iOiFeeZFR7J EaaPiBqH3uw24yCrMM40yxScOpeq7Xx1RmWumoDO5yFZMnto2C/q/W5/2I8D0i9i on/mTrWoZhanPquSqAU1CqG6btpOvZ3baRbNNOUjc06luWxYZocM+6wTdXCwDg7U wVAdDNZBdx201EF9HZTXQV4dmOtAVgdn6+BMHYzWASIfZsg7piJLmKQOLtbBOYY8 NhW5+wqa1emoh5NI6WXLrkBIFSkyHE8dcAIr9gKr42lWxxhr0D7WoP466ET3j6FO nbg7rrKWeeUEn77ieRmi8MaS9vNjiUlfOHNeeKUjtXg5Nql8ceAsaX8lCEl3CuGS VVA7/lu2ipTIT72d9RQ7HI2igoZgu+QG4UsyDmtQMWeg5TdYBfVRiFIhMxvMjY5i mFsMxR4M5lNRc9AEAwbuVAL/FSNonS4nlyljpEgHUgvixItUcRBRW9BLF1tkktk4 TXrQJ/WrvBaftBAzrYwpb4rPSwakpM3hnqZ5jaC7dSj+b/95/Fc3bF1Ss3b9xkWH +vfeArITpaNP6h3P9i+66Za10zffNfDI623HXoOZjUX23LU9+9/a0l2ydGGtmLOw NffRFYsevWVWa+Pa4X9q+O2tj981uOHe+Lq2L8xZur99ehm1dFQ4z/4Btb8dPhSr DKiuDYLxLl5m5nkZhpoNRmGXQm5WKNCv9ig4s1wuGIy8TCHXZNuJTH0U5yu5VXFy 4qI4oTJW3oUuDd/Ac6jl5TwiKjKITbQ12TptMltKZzupzs48mMmp+MwM0ZGxght0 QrcTWpxQ74RyJ+Q5wewEmRMuOuGcE844YcwJJ5xw2AkHnLDDCZ+Df/Zvwa/+bxZw MB1fzEvmiDjB4wSB5RhjVIecwPU7odOJw6TjCrmfKvlXGSafneGz5hKcR6h5TEcC m0loamo2Sc4dOA5yqa6fougrmfRVePk/FNbnx58LxP+5oL4CDq9x/PjxBsPsSmjg t0xru/QJ90lHpTIcnh6qHZ+AzU/MNDpzw3R9B+3m9Wi15XEvirnhjHUZ2zLuzZB9 kDGRwWXoR2RgzR0RTSh2Sp7o7S4XNYcm0MN2HXUaH9Y8hf6ioBSVnKjsVx5U8kqv 2WHKGvaKPj16aYeIt8k75N3nPeg97T3rVRBvzIsi5M/3DpdFgvkgy4dPL+bDuXw4 kw+P5MNgPrTkQz1LkOAH8mGIwbtZUl4yaSwfdiThSMiRDyQffphOS0pOp3UiLU9L En4ZFQQ+ciUVLNacRugZ8SWWItFxJFO+dTVqqyRSY6z4A8lsc9PyPMPgi1keqZQf JuEpfkjw6b9nhA7nw760osqT9UMOcBfy4Ww+nM6Hg4xx/fkg5oMnH4R8iLGowPCm yGfH1aT4CjH/yymf6RleMQSWJBax1guj2fMvtr9Cl0HOjAln2te/RhdBgwThtZg+ ShcLas+fal+fcHWYRc6hQv8GWhO8Bx8QJEG0fxJevbRWwlSzJbHMk9oNqwBy6kTH /kh+OOKdVVR/3e9/37ph/KO51wrP8U+2nHzzC7P9pQur8zY+uH/O+LN7m8Lh/JYO btEctqOb2I9xkjFxOfonao1hRCE8Y/+WnaPrDw/beftRYhNs/bYhVJpZDxHTGv1W Pcfr1RR60MZnym32HPNOXnTxyzmSA9eIORDJAU8OCDlwIQdO58DBHBjKAYQfy4GO HEjb4krNocKvy5Anb7zWQXl0pv18e3vt+bEl7Qnr0d1sWWrhFptWmbhuDt7kYJH1 BSt3uxxWwxfhfeAhZSzKU3srbFOhIDGTRcumZSkU8OYz7773zzu/FfaHCiz5m9bt enz/Mxt8N37DDbafvgW2oZsLo5W1G3+y76UPHvHfu4Gw3ap3+E9Qf9iJn7wpLnWM 8FpenjOSKRiPmp42E2TN02DKe0BuMh7S8o5hkRyyFlh7Oe8OlUhU6OvhQyfPVyFj CuC6pgIQCyBSAJ4CwPhoAQwxiBToZPCESKV2R6Wl0bQ9Uvt4Wdm5xGI63VOhjl5q R4oah1zIAyTXk7sv92BuLFeu1ahBX6VuVHNPKk4qXlXweoVbwQk8tRDal7TTZ3J9 HTlH0BKoSNuUiPoNKQ7yn8R95gd2P/4d4E4u7vVHp6M/h15d/IeLV27b++UvtTd2 7dwNwnfegFrXRbZzMW9GcAa3/5o3v/XMb5gHHZ/Dn2SSVgCCWGg7an/aKRSMEKLy o+esMxwVHG50nnOTzrNWHkDnWUdN2OnmrEodcWUOi/ZDhkPmQjN60MzdoZ5SJLkR O5RcnUiFawOT2iDhNdMdCcbEV4JTfebzZZfvntbLvGYv1+Ld4b3o5TU+p4/b47vk 49p8fT5OobAquEWKnQo6aj9WyB+UHZG9IOOZH63IRuf5Af6r/D/xPPrQ/yHi1NJY ztejHTLpSKNZFiTMjaamYNKVJjjELVfuvV7uUsfj2AOl6+I1rYGkX027IOlXvxH/ nusPq0rC4aou/nvYFV2XDs1885uSd71/4m1YR75LMolT1JGYwsQfU4sarfpYdyQx FAndqPOnbcsBYTtu11773dTeG0eihMgq2PdJfBAQjfb7VaJgU90vRGxHvPcTXivg XPoNh7tROCLq2TLDNqW6MmerXuaWcSqZn2gFrUeLo0lrV28TifC4Oc+8irvXD9v8 sM4PYT/o/fCWH17yw2MMssAPtQw+weCvM2AHQ6uS8F5imaWcx1i2bSyPm0FUaYca Lj/hkDBdqGiUoWhQ0174Ndr7aLKEUUsHUU2fZ/sm85OiURSUz0BHli/nD/CH+TFe 7vSAxuP0zPPs8cg0TqeT0/GEEzhOkCWGcPt67O02k1fi69TDDHQjC1JdHOUCvxyf uHCfp2/j+PauG4zGG7pg+323PfjErhnXyOf9/Mj3/y3+evtNPul0Q333gtzx5V8f 2f81+oUnup4v06C+KoHvih1FRUGVSqkOqF1OY7PzLnXArFYHVEpjs0qt3BUsMgeD RQfUh9WcVZ2vrlTz2UdtT9uJ0xUoCipVapU+1380T68tAU4mHNXbgoFgdbAtKHsk 8EyAa8oDXx4dmA61pjFvAXTANngMjoEcVMpgUcDpylOpCU0/rjc2koi0IvKEUz1s Em36Q6awqYeLRWBfBJoiIEYgEgFPBIQIXIjA6QiMRgBTDzKEoQj0R6CTYUYYjgTv ZxCMkghUYbazLGfsijxiMptEOp1QqqQUOaSlmjrhX8UIvorZO7nBO/oulZ2fBdHE PdUeDp6i81IYTV7ULmgHo2ppnzR7ZYm1E2nJRBKsE48pjik4SB7GKC/glVdRB3kJ m9iSq1AolWC1Zsk08UUhj/uD5kBr/JbkRgkY5pZUwd5gdcnSUVCvmTUtbMjOKoKa +leXVkmHM2YWFHde6vhwTo4zKxzW5rQdiz/x5QAnrTcrvKirr5FViYtPVwFfCXyp qdRXymfxoaPFT4eFzJHy5eWbyneW866RSDlevjKH+oGyacI1nMHszTsKJl95Zo4O RJW2ka5Ik0MzSK6QixZy7hPhnOECsfhZ36ECKiMTPSpVdVaBbkbPDJEGiVEwIprx Cd2waKLZTU9k1YpZw92RTSI0iKhtwCyCQoT/OifCT0QYE+GECE+IcECEO0QYFGGp CC0MNV8EK0P9UAREPsOQnxPhsAgPioDklouwSIRKEfIYpkyEiyK8K8IbDPMFhraD YbaJUC9COaNpZJivfpykiMUfYcXvFGFARNcLmkSYxbDzktiI/BuG/wor/gCjy+oq TkAzI56qhoJVI73CT0wlvyhJW6rzQx+nVfpEsnlSvRclSUv15pItPJNs4YE0zPQa fJyswStJgshW2jAkF2F4ZlZ474Uk4gnWIDFZN4mZvxBhVIQYo7EjyZv6JI5A0cRN FPE0q9AzIuxjiKtEmCGCJ1lKlVTEQRE6WedKpZiTjBpj7RhiFUilOljOc6wCXIwl 97PisVS9mBrqHZ9/0u1yb/dyfdDxuUhX958/393+qxelkqiSZRi0j59jK/Tp+6/s SN34uSA7ABAeHaV7LKOjiWMY1eGwcD59k+BFUkU3JQ2VUZyxn1dqK6vp+pJLLVRG NGptJakSqrj+6FD0dJQnUSHqifJKxBx9LsvZGKRLWmw7v42tPrWnb8tIGzCWv7hR k1WZ2q1ReONLWwO3LF2/PCM8Rwr29EoHzqSNmwfue6bm+ufnbL07cj3bvbltsLmy Ij5dOndGoy3jP5Yiyc2cffXzHn9A2s8Bar9wG9F+yQKX+Jou84iGzyIcoGl8BLTk cdM2haiBx9GSU2zrjqQ2GLtt0GKD+uRuoiy5m3jGBmM2OJFMLbdBng3OpcEP2+BA 2i6lhBZhaGZGZ0YKe4cNBllJEiFZcruSS+13diZ3Q6VapLZCkXy6vHRczcH9LK81 MYeNotBcHCXhceqg1tKzCN40G0WacSzMduE2jn9XMk64WdI7ZY8wy+TStzFE1/Pi jWw9r4j/g3iz1+uxWKzmXLPXk93szfXsQmOInuDINTbnJhb5rB5vLi+3OAuLiAxd BL3Z6JVZjMZ+3ZBun47XqRwrZJCZSZcxecRU29EDCLBZRKNvDKTW9EJkJbeAHnM9 6MCpxGEXg/YV3JYQ9IWgLQRzQ1AdgkAIbCHIDMF/fRqC34fgtRA8FYKHQ3BPCBYx JAlDHYI/M4QXQ/BMCO4OARJaFYLFIZgfgpkhCIbAEYKPQ/BuCN5gRB4Jwd4Q3J4s z8qKeRWLOc+KSRFKVSdVxpsh+GESYVMawgxWjI0V80ZaRaUyMLs48ZBE4ResiBMh OBKCBxmR60NQGYK8EJhDoEijgKk7QjAYguWswVwIPgzBuRCcCcErIXiB1RBTO0PQ FIJZIShLI9IrUfl+CJ4LweEQ3JdGqyUEDQw7NwTGEMhCcDHJm7FkzST8gRAsDUFz COpDUB6CfMYqCT9VjxNT6V+GL9WmCmsjrj6TVp8DSfrp9clj9aFfYbsQgrMhOJ2s 0IEk9W7WVon6RYbAjYYgFoJ9IRgKQX8IFoRAH5o0EzsuMwg7rqafP1vz/7Wq/+pI n0Hps6auq5FILdhOrtgG6ZJteD2pPdWOE0Q0aqxO3/+7crMv4RJl3K18WMntlD0o Q/uVtLextVwdJ7mQ0sGtymmft7RbPn/vmmmzq4q8wXxHqKE9/tOrLvRuPbauIhyM mk31v+V+fNU1360Tb8tU8pWkFA2ImsriI8XcdcU3F68o5iuLGoo2FfFFBrNhe3GR ubi4qNwM+WYwmDU2bfHMYk5VXET8ei8Y6dk+mYuqlSVaU6XLv98mI6omVaeK1/Aq UWmSiVqhUqbZT0xmg1VfVFwYduceXufd5uW8+m3hqEJ9WFW4jVgjVtHaZJWprGUX onA2CqejMBqFC+wZiYInKunrgcT20hvjo8Kvz59pn3Jkbyx1RK92flqEpkpP5lHM D+7SbR2j6wnJk9/ZHmVG44nMsUyulM7heowdCcCLjtcc3OEsyKIwQZnZeIIb47hn 0CWiu0l0pwhJ0N2ov+YIXvIMXg6HLi33hY0PL/CEsD/0//H1wfvW/fuXHl71n9++ dkejuUwdDjuffnT9vb2n73py83l3wHINPPt0bLBn/r3rr+15aMUTr3qN0fiaxx/7 4pIZG1fOXvPYysPv4Aw98Qd4WWbkdIQnVjETXtZzCziOI3IIC6+QcDvdNfNWeGXG T38py4OXr6crTGZC5M9hz3PEzdWJE8QggMAZTWDiwV0lAGynUwz9QRCgp3nvyHGb c3LcmDYtxyTIZA5uPzGC0WhHiEyVme04orYHZNUy9OHprsFjGS9lyDwZkHFQHVOP qnm12gttbliUszxnZw6flwOmHL0tzM4oyJQ20W738G4g4AHOwIPH44VZxshFL5zz whkvjHnhhBcOe+GAF3Z4YdAL3V5o8UK9F8q9kOcFsxdkXvhb8avTM4iLL8uSji9j WKNeNIy9cDB57qTfC03s6EmEHTpJHUy5DGGBF67ULx1Xt00/R/cFoYpKMtUw2WH7 qSXtVJjZGbl2dJwxggbrfHYoiKJgl6NeClLlMz+o2po8fICBYGlEUMpragRlTQ0T /opoDmwWYLPsqIx7kbxHuHy+kl/EL+dlM9wQcPe5ucOWExbuKe2LWi4T6OYPgFZO pIWayZ3jNuB5gBwuCw1VqqsKCrzsSJ0Unwb8/t+9D5VwKj988+zx/5xXm79w/P1O x6zF8UU33BSB/+AEzjf+K/6WT19sX3QNHw7zReGy5q//+0JjXr4iHFbd3C9bTVeY 43P499DTthIv+ZN4c9aIQqGyj+gEK3cUHJ4HVCY4JGTJh0XrIZPP1Mu5dmSyb1jx +NDJczOXcyI7lk2Pbzclz2hLR7ZHk+HEYW02BaSODk1ZVX43taqcXAVNqBFbn3KL 8m4lT3XbvV5+j/N9J7cs584cLoeeDYpYshvPa4Dfqzml+ZWGfyTjmYxvZfD6DHcG 1+0AtcfmbPyK+uvq76h5vdqt5pTSvnSQLdV3MFWDPJacgMnl52nSafi0def34jXd NYmF56W3r8gNtMZ/mVhzjs8Je7bA4sS6s9f76fyuKq4iuegMpCXewG2V7yWZpEZ0 K99RkMx3iFOuBqWiiQCzFVVEvS3CizzHo4CNYfXKpLPqCQ48tyITsJJ5qEuI3yJD jcJtjf8pfg6coI2PQF+8YR/8DkJQDL/bN+2j8bvGH47/GcsNYrktiXJzsEyCZTsz sFzSoQCiEBScSqHe5uGB1wpvXL1cJZZrktFy5RX49AdBA674O/GL0Bt/SL53X9wW /2n8TNy2rwKU3Aru1o+oV7Mu/jQMk+8SgSwQM8jzwnMZMVFuYktxWUpjJX9Ce1wp EqXBqDxeFjlthE4j0JnfEGVn8c4njjBeTFTiBb3ereeUcnokm83WBfmpvSjluht7 mpfXVdQtvv/O+Fv2FVXX642LIpV3Nq9/Mp/WZN7E2/KvoS4ugLViVq77iN4T9tR6 FnhkSt7jyTboRK0sg1Zrn9ZYmWG4XyHLvp+YbtOD/uuaw9p890H7Ni87W5XJ5wfM W3mR8KCXF/KruU0BWB6AhgDkB+DjAPwkAHS9/0TyBNUOdjYqdYKRnm6UDl5JBx5P MKRUshAA7mzaucbkwanJ8yLpaixh7E3uGwi/xtCPxt8Vzoz/Vuq9xAxNlRgmzU+d 5m7Jt8JOumnlN4HKozc2vieDb8lgLOtM1rksfjDrQNbhLH7Aeof1OSufZy23dlvP WWWDxh3GE0Y+31hp5L4pwKB8h5ybJ4dBgAcB5gKkH3Khy8tBupMg91CZ8aamac6b SwxmI41VpJw4i0HBXYy/Hr8bHoaytV9tdhZlFgeWxL/2y/h/7Pzj3V+9g7p1jsW1 77thL1ShcI/kmabFe6A5fiL+07H4Ow81fcj8vGs2x394e8Kbls1Abzof/GJA1ILW dL+4QAc6JaH75yreb1feXxYhKJcenM/zjiju9/PZjpMT/yVqHe5GxxG7Hntdawa6 UXCPKbsRDkuDkyeFtoMK8za36Lc/7i5wr+JOFMLhQjhQCEOFMFgI3YUgK4QLhXCu EM4w+CA7btVSCPWFcLoQxgohlWVHMgumioUQKQRPIZgZheqLjISEh/HRQpwZCyF5 jvUz7PIrfOfRc0wkzgex/8epH832Dsba2dmfbGGMHvofa5e+0Zjv8xqi1LfGTrri +41ST8lmRMsH1sZHL7a15JeWLrzjYtqegEwl8y3tyBn/of3GL8Tz7myIb5+yKRDG uWXOxNv8CzgGM0kW2SSKMxRQjlrP6DaGjbzxH4mSaASNR8NnyjX/qLDp76Ynr7/I We6mJ69v58TkyeuDyRPSUsunnn9Goaem6flJy1PtkUE3B2GOfdsNyowGgZ5/NghG U1qYI2MffjhG741bt2zZuPWL8pXxvfFjeO1B+V6I14ZPXoIGmAbXQG38m/HX4j+I f5udhJ54W7kFJa2E/6E4MZQD4RzIWeACvWub63XXBy6ZK8dly87Kbs62Zd2hVpnV WRa1qiA/uzn/DrnMLM/Pk8uUSnV2dpZNYcvzZzf7tytsZoW/QGGzWrKbrdmW7ZkZ 5szMDHkmZMhAqbbZbA/bXrPJjHKFmmRAFp+RmaFSKmTsJ+ToD8fp9SESIf0cEQRB FPhMXtCLYf0azqoEHh0go8HpDhGrX6lQZ+iOFLv0fIapLQJzI1AdgWAEbBFQRODP 70bghQhsisDyCLREoD4ClSwtMwIfR+BcBN6IwIsReCoCD0dgUQQaGII4kR8BK6Nw IgKHI/BgBJYmCZRHAFONEeAi8NrFCGARZyIwxlCRyN2MDlbiFZZtJyOYzwr9cwTe i8CbmI2hbYnAqggsjsD1DD+QrNjDf2ZEsWZHkiQ2sZqlKvUxQ3iFte1wEqebFSwh YDG/YAgSheVpbctnCH0fJ8vA1t8RAbpR080Ygm15JiKug0cicE8kAW5h+z3Y8LwI mNOae5jhSLtBXITt81RfiMDrEXiJ7f5I20ip/aB+BjmbBlkQgXAE3JGrfEV3ydVX gBPnbT/LF/9MM/my5Kt8d/pq6aQWTeTzBnr4sKM9knYIC1UOO3+FkWg4yrb7EwZ0 +uldyY+fPMybPN6LdkE0O9y+PoyDm43t2eY82JENkWwxuymbn+a/zr/Zz7fkgTUP bLlv5nL0zAHntkNt9oLsjmw+y7LZwsVMkKWGn6uhUA09+EdP966Xvuwl1Z2pCbqT BT52JeYoizkLoslzvgq6YBA1JRYMlFtmzsn1xG8viJ+SxX8aiC/Jv/Ym+GjYDWb5 2w2BBXM4Y2dpxSeyT0rnzoUH5a7p17V/+gTffOlZ2a41jeHwIveiSx9za0e7GsLh SKj8/vEbuG/vDU4rCiesFh1qTBd54kTKRCmhJooRTRSn4DzisN1HTFVop2gOh7Vo vjndloR1oshB64R+MzbdPnijo338ZXamhX0hSLIOEpoyMpJ1NOsbWfxdqodUnCzL nFWf1ZLVzUyBE1kqtczUYuIybjcAr5eDHiBTzsznDnZqg24mXz7TU4dcmuo907I4 7lfxs/F74W4oXneyRhPIKA4U/Pzgv8X/vOODvaD6Ts6rbtgP5RBBc0iHU/tXvx5/ If7jb8Y/3vPtnPjvqeXM+8CFnNBwqGcflj0l43iikKm/pOCtPKfhN+lguQ4W6aBB B5U6yNOBWQcyHfzXhzo4p4MzOhjTwQkdHNbBgzrYqYNBHXTroEUH9SxDvg6sOlDo 4GMdvKGDV3Twgg6O6ODA1ZBT1C8y4un4SPyyqiDNVyW8n6RVAunuuAI1L60S7zK6 UtkSDpZtk5LEiWSLsNA+HbTp4HodVOtArYOH/qyD93Twpg5eTNKXIE/p4GEd3K2D LUlsKYqUA4wyZu69rPV/R3PfZc27Twd36FA76qBTB006EHUQSSNUJVE6fQVDLujg LINzozqI6eCgDvbpYEhHKaXIeHT4FnTwkg6O6UCvk1Y/09RRx/qr7Jt1fKbSunwn /bNV3WWro1fVlX8ZOYwGGanFUdex3pSf8mA45UF38bTikmm1Wt73rffLItdcEwnG j9AzMtGJ9+U/QxujFH4q3hwKFcvlMkVQ8YPgz4Pcg+4jbs7rdt+hCJoViqCclyv4 7SUhc0lJaH4IOJ4rCV8fArc85A3KC0VFk4JTKHSFfvtdWZB1JD+bJ0dKw/dzpkwd tX3p+RjdEe0jwWeC3wryvDfozi8gJegkhoQQZ5KX8CEsuDRq+7rmoFuxzShmax83 lhlXcYejsC8KO6LQHYWWKMyIgowtK56LwokoPBKFQZZUH4Vytug4FgXMciCJL8E9 UTCzjNWYIEax1cBJy5SjUYhFYSgK/SxBWqmUli8PRqEpeuUJy6vNclfaxhfPCT/D OaqD6q83TtHT8e2ShTz+Bv1i+PrR0VG6zIMTVrux2oipu+Ql0kqPLLHSQ9qhnS72 0OmKqVC/VU73Nt4NQZGATtUJD1QUA39z0YqizUX8iz5o9cF1vOQndbDvLa1f3+al aw2gvIq5Le1ukUrpCyUWuoBNCOpW+c8Gv7j30/hPbrcv6hp/Nm3XC5bWr78dPpw9 sib+IxAh3K0vMUMOPLc6fmJJS7oxTkPxQbimdth7TTjcuiz+brww/i1ZwnO6B2Ut QL4mVhM72D33i3oHaHiHWQPm/YURQTek43SZR0z3a3h0UvUBUPGBjzngjuTdD07b YbvdG9BTvylssjbqD+u0ha7C4kJekBUeDgRN3sRGZpFiFXc2CAeD0B+EpiCIQcmW Sese4dfUlH/jPN0rZs7L+fPt9Bus7QkPBm0J9rsOzIGZui3IHBivwTvpzbCv5WO8 Iiq759MnEx6LL7r6qfgR0LfehN5M8/b4H4tmg3X3SOkkn+Lfv3vV+O/sLYvjfvRo hJqir3wZeeQnhL+Ff5KYyDviP8h0Wt0uaa9QobVq87W8mrfxAZ5Xa2Uj4QzI0Oh5 3UjC1czkCaeT8Vr1VzO0Gbzpq0S0kD7OzC/n7rWAaAGPBYgFTlsgZoG3LLDPAv0W aErCa+5lr7MseR8LX2DRURYdSmIvYEmqJVPGQJqaY+Mg4TCx85phthtP2Xm+unYM H9QuQ2HftZUegue9FeCjBhEVQqBMncbforn0c27G+a75hRnF3M/HfwAVvTcHM8AW /52fn2mY+4W4/9I/WxetSPri21GiHNAqvqfLzFQ53ZV0f9uxiwqN9btgP0wcHkfE wSt5h0ub2ut2ooiccMFhFxxwwQ4XDLpguQsWuaDBBfkusLpA4YKLLnjXBWdc8IoL XnDBERdsYmgtSbQ3XDDmgnQ6KYR6F5S5ADwuMLuAuNDndsE5RgwRu11QnkzgLrjg rAtOu2DUBf0uEF0QcdF8Qho85oKDLLWJIVwxKXSkzwMdV1FQU6eMyYFwTniDdgyV //Vj0oHtxOEs9IeNfOqncq7YFE/I+/ZPn0uoiJ6BdktpEMJ7tlekqYKCm1df+vm2 mV85jn1VMPGe/Fnsq1zyrJinsFvtnNJhd2xXKHFyUTqUCjvxZAs4S2Qf8dp5hUmj p9NGg9PdqD+iYz9DoeS9B/MULYpuBZpnYJArHENi7uPyPPlaTnPQrhwyibav6x43 +UyrOJIHtWIeePLgbB4czKNm+MCS9snDImXvpk4Y01FPj45I6hl1c3CU7UntYiJK dTCwNvvgKloUEm/5s50LDJFLXzbe0BkvQI5k37wEVvM8Pc74ptyF/Pj0cdnOSw+k fqip/sabisOXdNwf2OoFYb/jjvd1jhZ/h77mI+JQsR86fe6r825K/ujpxB/iDcot 9GfeiTLxu+8sj9Ibn01uTv02KpCpnxJFNThl79BfCic2fi9p5BDIVZNavOsRZuZd 5AYMm7mniQPTGxBGbxveCvkPiIDvCrxVmH4DzS9jvzpOFEhnv2wDiWLYoagmNkyn YRXCtsqwtpjXTHER3oJ3EPHXIWxeIs8c5V5iky8i82A9aUF4FOsYRfp++sY4/V1+ N2zlRO4cd45fzv9Stku+X6FUrFW6lL9Q/aN6YcYBTZN2s16lHxFmGoghz/CByWTZ Ya3KXm+7ybbW/qpjs+N5xwfOclfQ9XFOp+derzn3Pt+rebfk/dH/g/ybEpwqIbMI z/jEoRLNITeiPslVbUIYTc0Ce4qfL6R4C0SNMUjkUpKXEmGe2MgribAMcd5KhOVE Q/4jEVYg/GIirCTLyTgtSaZGoqthWSIMxMi9nghzRMe9nQjzpIz7IBGWESPvTYTl JJuPJsIKhM9NhJXkR3x7IqwiZbJAIqwmVbLFiXAGqGT3J8KZpFL+SCKsIf3yHyfC Wk2D4tpEWEeIcVd934q+wb7bero93V2DXZ5l6/q3DPSt6B30POUpi0RKPdeuWN7l mb9u7brBLf09nrp1A/3rBroG+9atLfFcu3q1h+Fu8Az0bOgZ2NTTXeJp6V03sLa7 a3XP056+DZ4uz+BAV3fPmq6BVZ51yz+bmKdrbbdnTdcWz9IepLWib8NgzwBWqW+t Z1nPwGAXvlduHOjb0N23jGJvKEmV0tyzYuPqroGphIsna5EKLOoZ2EALKi2JRK5M /T9aWVJP+sgKvAfxvo30kG6c4btJF8a7MLSMrCP9ZAsZYFi9CPWQp/AuIxG8SjF0 LcKXM9z5iLsW70HE70dKHlKHsQEM02cXK4FilLBcq/HypNHdwGI9+O7B9yZWE4rZ gqk0/1pWq9Wkx5uL0D6GT0sdZLS7EX8NvgfIKoStwxr9PTWjFNcyDlBaW/C9lGHT eq1gZQ6y2klc6mM5ljEI5ZYUX0k2slZtQJw+TE3S3oCtuaItpJlR3ohhWvfPq3Hx 1XhxFcgiVp8NqRaVYrm0r/6KvP8f5uzfXqPPy1HPMDezcldgfAFiLmdl/mWuSfLb x/iUpEjLWcYo09AaTF3NeNDN5J2OgLWJlg8i7SRv1uBzkNFaxkqS8tARuQapSi1Z ynrSw+o6iDWjMtLHctL63IDvzfhuZnloDzxLQoz+RjaS6dgeZPiTY385ax1txzLW Hz2M992shf1MTrcwjtMxO4iQ6SSM12Z2lWDqikQbp/K0JFHvvy9XmOVbg6WHL+PZ QArSwXqLhm9N1I7ia0kGcmEBcuV60oB3HfY7DS9AKO3XBnzOY/DZCLkRn1S6r0OO zcZrPoO2IIzSoTftfamvr+zbJLyXxfqxbusYxgDD/e+MnULMNR/LDqSNo76EztzI JI72KS1jC+bYmKoL5d6mtHG1McGhgbR6SuNuDcOXakjrtjoh7WsT1GkPSdKwhkEH mW5uS5TWi+mbGN46rEdyxCYl+rM5toGVOIgy0MWoe/DuS9RsICF1FE7HuiT9yxlX 1zA+zmc9sy7RmnVYw560vJMj4spSuhMaZ4CNoI2MB90pHq5jdU9yI8mnSY4sY3yY 5JdUk5KrSsmVZU9qik1sVG/EZ3IUd2HaBtaKK2nfhCWvZuVuSOvnSc5LvTJVh0ra RNJK/YyPfQk99tf0sIdBulg4qQmT5dJ5oTthNVB+dV0xm4dS2ANpUjrJ08/nz+qE Vhok6XpxkspaFutPpdBWSXwoJBVsnGxmkrGK9XP6WErqt8m6rUPctWzEbmQ9QWvQ m2qxVGa6tCdnMGnsTtpISVm8mnR9XpvTJed6xp8re5f2Ai1hPcJ7GPXk3CeVvzYx W669rKcGyOU2VpL2BjaPUcujm0jz8CbEk+aLK2X+s2UkSU8apz2JfuieMgKT9K7s bYljUgsGmV4YTBvbyb7quozLVx+Xn6epkvz9PO27jHE5OftOrZPUIipH09Oo3YQz xrUYryLlZBpaaNPQ2qrCdwTj1ObysOsmMhef5XgVIiyAONNIFG8P3pUordXsnqRK 74ZEyy9vXbq2Ts4EVEK7mPa7cgT2M53Rlci9iUlgX0K/bEzoyR5ssScB70m1ktbi 75mfk2nhy+o+dU6m97yE1bEWn0sZhyXZ3ciePYkxLrXxBjaObkukbUhIW2+ixstT cz/NcyOTY9qOjUxSNiZqMJCYGW5mLd6QmGt6/kfa2pTidz/T+RuYnihg9ZakfE2a lrpyVHclRtvqxMzTzebBpA1AKW1kuSXtla7veqbk+2z9IVn7VNYpxupEjhCTmh6E 9SVgt6VybGDaYzABk3g1kBjn/5Oc7WI1T9oePQm70HMZb+nc96eEJyJxdRnL1Z3Q IusSNsp7DL+P1XBDWvrk7N/H8m1Jy9WdkK5lTKdO5trINF5oysjrYbxK9sIAm702 pGZST0KGe9h8enNibFLY/wwvexJaZ1IDdrNRKklL32XSMsikpYvR9aTsjqTd1sfS +1LyeSUvuhL86GOtlTg+lSfr0jSU5AMVJMa6VAL9J0zr/o/zhq25SWujXvp/Mq/8 iLG3zlqznGd+ho/bv2h1iLcL5urbv2jruLX/1qFb+R//BOGbNuNjTT8+Vq/Dx6q1 VkfTqrOruFVrtw3YBzeaLc4VK/GxvA8fPb1mh6cP9L3u3vByXt/7Uu9EL+/ujfSI Pf09Qz37ekZ7TveoxF6dtfqlXoj1wL5eEFIJ8p7e4fV22wbrbXU27xa8OU6MCcbq 2DFZUP8ciN/N81fTMxje3yFQ/IUpu3rBGDx1VB88jPdX8T6Ct3i0rI5iPf92tEJ6 Z7tZLvXbOsz1G62WQZ/25EvvTKH6JP/ecw/wQYpkPp/lrn7/YS748B4+eP9+Pnjf fpbwwn5/fvXph4Di6B8tjlQveBQeHSHBB0cwmf/Dc3fR13kxgrn+9CEJfjjMBf9l ltb92qsk+CqGxZew6uJ38LHvA3gPAe8O29y/HWaknz9ud9KqfOO4yVJ9/BiweoSO ZTmrjw1D8F9nRbxP4n3qRyT4o91ccO9uEtyD9z27+eDdu2XB3TsIIzLkY+0R374j L796+zYS/NI2WXAr3uK2cEX1tmFZcB8We9cwCe7C8M5hVXDHnYrgnRgWhyurqsXh gmC1Y5olu9JiqbAYyy36qEVTZlGXWhQRCx+2kBJLfoGusEBfFNSFgvpcny7Pp89x 6zxuvV4waOg/VFUoVRpeJtcQ4DQKvtstEp2uWiRGUzXh1cHTPOj1oOf1+lp9h16m 1uvdPKd0gEubrbRrLUKW1igza0M1RTWFNfk1eTW5NZ6anBpHTXaNpcZYo69R1yhq +BpS0xSFmHEumdsyK2YCfN84KxYNzj3Je5pjZcG5MWXT4tbjAF9uQ2iMu+skkJaY 7K6THL6Mdbcsbj0JNpo87HiRAJDY3M7hvW3HOTIrBnfFfDe20pe4sDXmueukQFpa j3Mwq62tLTZtblMrxWoLumLd9B/ODLnaYmU0sM/VRubGpi+MOXyzglf7LNmwZMPg 4GXA44Uy+k+oumKFvvp0OFyVRNpnQypEgsHBtOgUDLyPm2gJ3Z2xH/jqoa7V0Ubv YDCWHStCliEKrdTg4MaNaWSl53E15WNT86y5MVUz3k2LY3YfRl7FSCVGNL5ZhPzf 0UvBDwplbmRzdHJlYW0KZW5kb2JqCgoxMSAwIG9iagoxNjY0OQplbmRvYmoKCjEy IDAgb2JqCjw8L1R5cGUvRm9udERlc2NyaXB0b3IvRm9udE5hbWUvQkFBQUFBK1Ro b3JuZGFsZQovRmxhZ3MgNAovRm9udEJCb3hbLTE2NiAtMzA2IDEwMDcgMTAwNF0v SXRhbGljQW5nbGUgMAovQXNjZW50IDg5MQovRGVzY2VudCAtMjE2Ci9DYXBIZWln aHQgMTAwNAovU3RlbVYgODAKL0ZvbnRGaWxlMiAxMCAwIFI+PgplbmRvYmoKCjEz IDAgb2JqCjw8L0xlbmd0aCA0MjIvRmlsdGVyL0ZsYXRlRGVjb2RlPj4Kc3RyZWFt CnicXZNNb6MwEIbv/Aofu4cKPDHQShFSmg8ph22rTfcHEHBSpAaQQw759+t3Xror 7QH02J6xnzFDut5v9n03pe9haA5+Mqeub4O/DrfQeHP0565PrJi2a6Z5pO/mUo9J GnMP9+vkL/v+NCyXSforrl2ncDcPq3Y4+h9J+hZaH7r+bB5+rw9xfLiN45e/+H4y WVJVpvWnuM/PenytLz7VrMd9G5e76f4YU/4FfNxHb0THlirN0PrrWDc+1P3ZJ8ss q8xyt6sS37f/rbmcKcdT81mHGGpjaJblroosysUTeEHOwU5ZMnDO+WdwQV6DS+VS 45/IC/AzWfdfkQX8wlwLXpN34A15C96SNX7H3DKyzTivTP+yAM/+yrM/HCz9CzhY +peoxdJfcJalf67z9C9ewPQvNmD6O9Ru6V8q0z/Xs+AvmVWmv0ONdvYHC/0F9yz0 F+wj9Bfcp9DfoUahv0NdQv8FPIX+ucbQ3+Fcob/oPP0dapHZH99IZv8VmP5Oz+X9 u602z9wlaCP0+Xd7muYWQmxN/Rm0J9GNXe///i/jMCJLnz8RrdSOCmVuZHN0cmVh bQplbmRvYmoKCjE0IDAgb2JqCjw8L1R5cGUvRm9udC9TdWJ0eXBlL1RydWVUeXBl L0Jhc2VGb250L0JBQUFBQStUaG9ybmRhbGUKL0ZpcnN0Q2hhciAwCi9MYXN0Q2hh ciA0NQovV2lkdGhzWzc3NyA2MTAgNTAwIDQ0MyAyNTAgMjc3IDI3NyA1MDAgMzg5 IDI3NyAzMzMgNDQzIDUwMCA1MDAgNTAwIDcyMgo1MDAgNTAwIDMzMyA0NDMgNTAw IDUwMCAyNTAgNTU2IDUwMCA3NzcgMzMzIDUwMCA1NTYgNTAwIDcyMiA1MDAKMzMz IDMzMyAyNTAgNzIyIDU1NiA1MDAgOTQzIDY2NiAxODAgNzIyIDYxMCA0NDMgNjEw IDcyMiBdCi9Gb250RGVzY3JpcHRvciAxMiAwIFIKL1RvVW5pY29kZSAxMyAwIFIK Pj4KZW5kb2JqCgoxNSAwIG9iago8PC9GMSAxNCAwIFIKPj4KZW5kb2JqCgoxNiAw IG9iago8PC9Gb250IDE1IDAgUgovWE9iamVjdDw8L0ltNCA0IDAgUj4+Ci9Qcm9j U2V0Wy9QREYvVGV4dC9JbWFnZUMvSW1hZ2VJL0ltYWdlQl0KPj4KZW5kb2JqCgox IDAgb2JqCjw8L1R5cGUvUGFnZS9QYXJlbnQgOSAwIFIvUmVzb3VyY2VzIDE2IDAg Ui9NZWRpYUJveFswIDAgNjEyIDc5Ml0vR3JvdXA8PC9TL1RyYW5zcGFyZW5jeS9D Uy9EZXZpY2VSR0IvSSB0cnVlPj4vQ29udGVudHMgMiAwIFI+PgplbmRvYmoKCjYg MCBvYmoKPDwvVHlwZS9QYWdlL1BhcmVudCA5IDAgUi9SZXNvdXJjZXMgMTYgMCBS L01lZGlhQm94WzAgMCA2MTIgNzkyXS9Hcm91cDw8L1MvVHJhbnNwYXJlbmN5L0NT L0RldmljZVJHQi9JIHRydWU+Pi9Db250ZW50cyA3IDAgUj4+CmVuZG9iagoKOSAw IG9iago8PC9UeXBlL1BhZ2VzCi9SZXNvdXJjZXMgMTYgMCBSCi9NZWRpYUJveFsg MCAwIDU5NSA4NDIgXQovS2lkc1sgMSAwIFIgNiAwIFIgXQovQ291bnQgMj4+CmVu ZG9iagoKMTcgMCBvYmoKPDwvVHlwZS9DYXRhbG9nL1BhZ2VzIDkgMCBSCi9PcGVu QWN0aW9uWzEgMCBSIC9YWVogbnVsbCBudWxsIDBdCj4+CmVuZG9iagoKMTggMCBv YmoKPDwvQXV0aG9yPEZFRkYwMDU0MDA2ODAwNjUwMDZBMDA2MTAwNzMwMDc3MDA2 OTAwNkUwMDY5MDAyMDAwNTMwMDY5MDA2RTAwNjcwMDYxMDA3MjAwNjEwMDZBMDA2 OTAwNzAwMDc1MDA3MjAwNjE+Ci9DcmVhdG9yPEZFRkYwMDU3MDA3MjAwNjkwMDc0 MDA2NTAwNzI+Ci9Qcm9kdWNlcjxGRUZGMDA1MzAwNzQwMDYxMDA3MjAwNEYwMDY2 MDA2NjAwNjkwMDYzMDA2NTAwMjAwMDM4PgovQ3JlYXRpb25EYXRlKEQ6MjAwODA4 MTgxMTE4NDMrMDUnMzAnKT4+CmVuZG9iagoKeHJlZgowIDE5CjAwMDAwMDAwMDAg NjU1MzUgZiAKMDAwMDA1MjE3NSAwMDAwMCBuIAowMDAwMDAwMDE5IDAwMDAwIG4g CjAwMDAwMDA5MTIgMDAwMDAgbiAKMDAwMDAwMDkzMiAwMDAwMCBuIAowMDAwMDMz MTM2IDAwMDAwIG4gCjAwMDAwNTIzMTggMDAwMDAgbiAKMDAwMDAzMzE1OCAwMDAw MCBuIAowMDAwMDM0MjQyIDAwMDAwIG4gCjAwMDAwNTI0NjEgMDAwMDAgbiAKMDAw MDAzNDI2MyAwMDAwMCBuIAowMDAwMDUwOTk5IDAwMDAwIG4gCjAwMDAwNTEwMjIg MDAwMDAgbiAKMDAwMDA1MTIxNCAwMDAwMCBuIAowMDAwMDUxNzA2IDAwMDAwIG4g CjAwMDAwNTIwNDMgMDAwMDAgbiAKMDAwMDA1MjA3NiAwMDAwMCBuIAowMDAwMDUy NTY2IDAwMDAwIG4gCjAwMDAwNTI2NTAgMDAwMDAgbiAKdHJhaWxlcgo8PC9TaXpl IDE5L1Jvb3QgMTcgMCBSCi9JbmZvIDE4IDAgUgovSUQgWyA8MENDMUFGQzBBMDM0 NENEN0M1RDVBNjk3ODUxN0I3RUY+CjwwQ0MxQUZDMEEwMzQ0Q0Q3QzVENUE2OTc4 NTE3QjdFRj4gXQovRG9jQ2hlY2tzdW0gL0QyODE0MjY5QTZGQTkxNDQxQkFBMDkz MTIzREFDNTUzCj4+CnN0YXJ0eHJlZgo1MjkyMwolJUVPRgo= --Boundary_(ID_YpITjf2RQlDHg5/bz3bZtw)-- From Thejaswini.Singarajipura@sun.com Sun Aug 17 23:07:09 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m7I679j1013005 for ; Sun, 17 Aug 2008 23:07:09 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m7I677e7020083; Sun, 17 Aug 2008 23:07:09 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K5S00K038ZVZE00@nwk-avmta-1.sfbay.Sun.COM>; Sun, 17 Aug 2008 23:07:07 -0700 (PDT) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K5S00HQI8ZUYM50@nwk-avmta-1.sfbay.Sun.COM>; Sun, 17 Aug 2008 23:07:07 -0700 (PDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m7I676MS015947; Mon, 18 Aug 2008 06:07:06 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0K5S00G018XN2B00@mail-apac.sun.com> (original mail from Thejaswini.Singarajipura@Sun.COM); Mon, 18 Aug 2008 14:07:06 +0800 (SGT) Received: from [129.158.239.163] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0K5S00FZG8ZTQY7K@mail-apac.sun.com>; Mon, 18 Aug 2008 14:07:05 +0800 (SGT) Date: Mon, 18 Aug 2008 11:53:45 +0530 From: Thejaswini Singarajipura Subject: Re: 2008/523 IPsec session failover In-reply-to: <8302CC31-C171-41F1-9086-B6E92FB89017@Sun.COM> Sender: Thejaswini.Singarajipura@sun.com To: Robert Gordon Cc: Bill Sommerfeld , PSARC-ext , ipsec-core , Steven De Tar , Burt Clouse Message-id: <48A91571.4080304@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <1218750264.2286.32.camel@thunk> <8302CC31-C171-41F1-9086-B6E92FB89017@Sun.COM> User-Agent: Thunderbird 2.0.0.9 (X11/20080213) Status: RO Content-Length: 877 Robert Gordon wrote: > > On Aug 14, 2008, at 4:44 PM, Bill Sommerfeld wrote: > >> The hook functions are enabled only >> when Solaris is in cluster mode. > > Is that a programmatic interface ? In the Kernel, it is function pointers initialized by Sun Cluster initialization module. In the User land, it is a socket interface over the loopback address which is used only if the node is booted in cluster mode using Sun Cluster. Solaris provides an interface to check the status of the node (clustered or non clustered) using Sun Cluster. > > Could (from an architectural POV) this feature be enabled with out the > presence of SUN Cluster, and if not why not ?? (I'm just curious..) > The SA migration is enabled only if the cluster is booted in cluster mode using SC. The IKE DPD is enabled on a non-clustered environment also. Regards, Thejaswini > Robert. > From Darren.Moffat@sun.com Mon Aug 18 02:07:28 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m7I97RYE018550 for ; Mon, 18 Aug 2008 02:07:27 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m7I97KvF017160; Mon, 18 Aug 2008 17:07:26 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K5S00C19HCBWP00@nwk-avmta-2.sfbay.sun.com>; Mon, 18 Aug 2008 02:07:23 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K5S00L09HCADWD0@nwk-avmta-2.sfbay.sun.com>; Mon, 18 Aug 2008 02:07:22 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe3.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m7I97L2C001859; Mon, 18 Aug 2008 09:07:21 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K5S00101G1R4500@fe-emea-10.sun.com> (original mail from Darren.Moffat@Sun.COM); Mon, 18 Aug 2008 10:07:21 +0100 (BST) Received: from [129.156.173.21] by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K5S00HHNHC8GZ80@fe-emea-10.sun.com>; Mon, 18 Aug 2008 10:07:21 +0100 (BST) Date: Mon, 18 Aug 2008 10:07:20 +0100 From: Darren J Moffat Subject: Re: 2008/523 IPsec session failover In-reply-to: <48A90F45.7060607@sun.com> Sender: Darren.Moffat@sun.com To: Thejaswini Singarajipura Cc: Bill Sommerfeld , PSARC-ext , ipsec-core , Steven De Tar , Burt Clouse Message-id: <48A93BC8.8010600@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <1218750264.2286.32.camel@thunk> <48A54901.5050505@Sun.COM> <48A90F45.7060607@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080630) Status: RO Content-Length: 1534 Thejaswini Singarajipura wrote: > > > Darren J Moffat wrote: >> I'm missing the bigger picture here, or failing to see where it is >> covered in the materials. >> >> Can someone draw me a simple picture of a multi node cluster using >> this showing which IKE the client connects to originally and where and >> how the SADB's are passed between the nodes. > > Attached below is a diagram of a 2-node cluster and a brief description > of how the client connections are handled. >> >> I think I understand how the failover happens with the switch from >> IDLE to MATURE. The part I'm missing is how all the SC nodes get the >> SADB entries in the first place and how that is done securely. > > The SADB is synchronized over SC private interconnects, which is a > private LAN and is detached from all other network. > Hence I do not think we add any more vulnerability by this project. I thought that SC could be deployed in such away that the nodes were physically quite far away from each other. How is that private interconnect protected in that case ? While this might sound like I'm asking about existing architecture of SC I don't believe that today highly sensitive key material is passed over this "private" SC interconnect. How do customers *really* deploy this ? Is it always true that only cluster nodes are connected ? Are all the switches etc completely private or can VLANing be used to support multiple clusters or make a "private" interconnect over existing infrastructure ? -- Darren J Moffat From Thejaswini.Singarajipura@sun.com Mon Aug 18 02:51:46 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m7I9pj4P019139 for ; Mon, 18 Aug 2008 02:51:46 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m7I9pgcD019466; Mon, 18 Aug 2008 10:51:44 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K5S00001JE63300@nwk-avmta-1.sfbay.Sun.COM>; Mon, 18 Aug 2008 02:51:42 -0700 (PDT) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K5S00BYQJE59H50@nwk-avmta-1.sfbay.Sun.COM>; Mon, 18 Aug 2008 02:51:42 -0700 (PDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m7I9pfV5004718; Mon, 18 Aug 2008 09:51:41 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0K5S00601JAD7000@mail-apac.sun.com> (original mail from Thejaswini.Singarajipura@Sun.COM); Mon, 18 Aug 2008 17:51:41 +0800 (SGT) Received: from [129.158.239.163] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0K5S0095ZJE48A3C@mail-apac.sun.com>; Mon, 18 Aug 2008 17:51:40 +0800 (SGT) Date: Mon, 18 Aug 2008 15:38:22 +0530 From: Thejaswini Singarajipura Subject: Re: 2008/523 IPsec session failover In-reply-to: <48A93BC8.8010600@Sun.COM> Sender: Thejaswini.Singarajipura@sun.com To: Darren J Moffat Cc: Bill Sommerfeld , PSARC-ext , ipsec-core , Steven De Tar , Burt Clouse Message-id: <48A94A16.2040003@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <1218750264.2286.32.camel@thunk> <48A54901.5050505@Sun.COM> <48A90F45.7060607@sun.com> <48A93BC8.8010600@Sun.COM> User-Agent: Thunderbird 2.0.0.9 (X11/20080213) Status: RO Content-Length: 2239 Darren J Moffat wrote: > Thejaswini Singarajipura wrote: >> >> >> Darren J Moffat wrote: >>> I'm missing the bigger picture here, or failing to see where it is >>> covered in the materials. >>> >>> Can someone draw me a simple picture of a multi node cluster using >>> this showing which IKE the client connects to originally and where >>> and how the SADB's are passed between the nodes. >> >> Attached below is a diagram of a 2-node cluster and a brief >> description of how the client connections are handled. >>> >>> I think I understand how the failover happens with the switch from >>> IDLE to MATURE. The part I'm missing is how all the SC nodes get >>> the SADB entries in the first place and how that is done securely. >> >> The SADB is synchronized over SC private interconnects, which is a >> private LAN and is detached from all other network. >> Hence I do not think we add any more vulnerability by this project. > > I thought that SC could be deployed in such away that the nodes were > physically quite far away from each other. How is that private > interconnect protected in that case ? While this might sound like > I'm asking about existing architecture of SC I don't believe that > today highly sensitive key material is passed over this "private" SC > interconnect. Yes, the existing SC deployment do have key data being transferred over the private interconnect. The example being the in-memory data transfer from one instance of Oracle RAC to another RAC instance. > > How do customers *really* deploy this ? Is it always true that only > cluster nodes are connected ? Are all the switches etc completely > private or can VLANing be used to support multiple clusters or make a > "private" interconnect over existing infrastructure ? AFAIK it is always the cluster nodes that are supported in the private network. SC supports VLANing. But does not allow sharing of public and private network. SC requires minimum of two private interconnects. So customers use VLANing to reduce the hardware requirement for private interconnects. SC also supports IPsec for SC private interconnects. So if it is a requirement IPsec can be enabled to keep the traffic secure. Regards, Thejaswini From Darren.Moffat@sun.com Mon Aug 18 03:20:33 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m7IAKWBt019846 for ; Mon, 18 Aug 2008 03:20:33 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m7IAKUrO000770; Mon, 18 Aug 2008 11:20:32 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K5S00M0DKQ52T00@brm-avmta-1.central.sun.com>; Mon, 18 Aug 2008 04:20:29 -0600 (MDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K5S00BBYKQ34R80@brm-avmta-1.central.sun.com>; Mon, 18 Aug 2008 04:20:28 -0600 (MDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe3.eu.sun.com [192.18.6.10]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m7IAKRFl006552; Mon, 18 Aug 2008 10:20:27 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K5S00501K4OOG00@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM); Mon, 18 Aug 2008 11:20:27 +0100 (BST) Received: from [129.156.173.21] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K5S00CSEKQ1R1C0@fe-emea-09.sun.com>; Mon, 18 Aug 2008 11:20:26 +0100 (BST) Date: Mon, 18 Aug 2008 11:20:25 +0100 From: Darren J Moffat Subject: Re: 2008/523 IPsec session failover In-reply-to: <48A94A16.2040003@sun.com> Sender: Darren.Moffat@sun.com To: Thejaswini Singarajipura Cc: Bill Sommerfeld , PSARC-ext , ipsec-core , Steven De Tar , Burt Clouse Message-id: <48A94CE9.70902@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <1218750264.2286.32.camel@thunk> <48A54901.5050505@Sun.COM> <48A90F45.7060607@sun.com> <48A93BC8.8010600@Sun.COM> <48A94A16.2040003@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080630) Status: RO Content-Length: 2062 Thejaswini Singarajipura wrote: >>> The SADB is synchronized over SC private interconnects, which is a >>> private LAN and is detached from all other network. >>> Hence I do not think we add any more vulnerability by this project. >> >> I thought that SC could be deployed in such away that the nodes were >> physically quite far away from each other. How is that private >> interconnect protected in that case ? While this might sound like >> I'm asking about existing architecture of SC I don't believe that >> today highly sensitive key material is passed over this "private" SC >> interconnect. > Yes, the existing SC deployment do have key data being transferred over > the private interconnect. The example being the in-memory data transfer > from one instance of Oracle RAC to another RAC instance. That isn't key material shared with clients of the cluster though and it isn't SC that is Oracle RAC doing that. >> How do customers *really* deploy this ? Is it always true that only >> cluster nodes are connected ? Are all the switches etc completely >> private or can VLANing be used to support multiple clusters or make a >> "private" interconnect over existing infrastructure ? > > AFAIK it is always the cluster nodes that are supported in the private > network. SC supports VLANing. But does not allow sharing of public and > private network. SC requires minimum of two private interconnects. So > customers use VLANing to reduce the hardware requirement for private > interconnects. General grumble grumble on the assumption by some people that VLANs are a security feature. > SC also supports IPsec for SC private interconnects. So if it is a > requirement IPsec can be enabled to keep the traffic secure. That is the answer I was looking for, thanks. I'd like the documentation to make it clear that this should probably be used when the cluster nodes are serving IPsec clients because key material is passed over the private cluster interconnect. Other than I'm happy now, thank you. -- Darren J Moffat From sommerfeld@sun.com Tue Aug 26 15:46:12 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m7QMkBpb014933 for ; Tue, 26 Aug 2008 15:46:12 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m7QMk8Hh017215; Tue, 26 Aug 2008 23:46:11 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K6800K01CKX4S00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 26 Aug 2008 15:46:09 -0700 (PDT) Received: from dm-east-01.east.sun.com ([129.148.9.192]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K6800HCWCKWGQ90@nwk-avmta-1.sfbay.Sun.COM>; Tue, 26 Aug 2008 15:46:09 -0700 (PDT) Received: from localhost.SFBay.Sun.COM (dhcp-umpk17-109-36.SFBay.Sun.COM [129.146.109.36]) by dm-east-01.east.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m7QMk4K9057644; Tue, 26 Aug 2008 18:46:04 -0400 (EDT) Received: from localhost.SFBay.Sun.COM (localhost [127.0.0.1]) by localhost.SFBay.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id m7QMk3Fl009687; Tue, 26 Aug 2008 15:46:03 -0700 (PDT) Received: (from sommerfeld@localhost) by localhost.SFBay.Sun.COM (8.14.3+Sun/8.14.3/Submit) id m7QMk3rl009686; Tue, 26 Aug 2008 15:46:03 -0700 (PDT) Date: Tue, 26 Aug 2008 15:46:02 -0700 From: Bill Sommerfeld Subject: Re: 2008/523 IPsec session failover In-reply-to: <1218750264.2286.32.camel@thunk> To: PSARC-ext Cc: ipsec-core , Thejaswini Singarajipura , Steven De Tar , Burt Clouse Message-id: <1219790762.1822.20.camel@localhost> MIME-version: 1.0 X-Mailer: Evolution 2.22.2 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <1218750264.2286.32.camel@thunk> X-Authentication-warning: localhost.SFBay.Sun.COM: sommerfeld set sender to sommerfeld@sun.com using -f Status: RO Content-Length: 118 According to the minutes of the PSARC meeting of 8/20/2008, this fast-track was approved. I have marked it as such.