- openldap-bugs - openldap.org

RE: (ITS#7061) Only return requested attrs in sssvlv response
by ctcard＠hotmail.com 10 Nov '11

10 Nov '11

apologies, I just checked master and can see that a fix was put in on 1st Nov. ---------------------------------------- > Date: Thu, 10 Nov 2011 14:36:11 +0000 > From: ctcard(a)hotmail.com > To: openldap-its(a)openldap.org > Subject: RE: (ITS#7061) Only return requested attrs in sssvlv response > > > Is anyone looking at this? > > ---------------------------------------- > > Date: Tue, 11 Oct 2011 13:58:55 +0000 > > From: ctcard(a)hotmail.com > > To: openldap-its(a)openldap.org > > Subject: (ITS#7061) Only return requested attrs in sssvlv response > > > > Full_Name: Chris Card > > Version: 2.4.26 + patch > > OS: Centos 5.4 > > URL: ftp://ftp.openldap.org/incoming/ > > Submission from: (NULL) (91.194.158.133) > > > > > > There was a fix put into master on 18 Jul 2011 with subject "Only return > > requested attrs in sssvlv response" SHA: > > 8eecc9a017584ea0b56b25f0e4750e3b16929de6. > > > > I have patched openldap 2.4.26 with all the fixes to sssvlv.c, but there is > > still an issue with the attributes returned in an sssvlv response. > > > > On the first sssvlv request only the requested attributes are returned, but on > > subsequent sssvlv requests using the vlv context returned by the first requests, > > all the attributes are returned. > > > > > > >

1 0

RE: (ITS#7061) Only return requested attrs in sssvlv response
by ctcard＠hotmail.com 10 Nov '11

10 Nov '11

Is anyone looking at this? ---------------------------------------- > Date: Tue, 11 Oct 2011 13:58:55 +0000 > From: ctcard(a)hotmail.com > To: openldap-its(a)openldap.org > Subject: (ITS#7061) Only return requested attrs in sssvlv response > > Full_Name: Chris Card > Version: 2.4.26 + patch > OS: Centos 5.4 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (91.194.158.133) > > > There was a fix put into master on 18 Jul 2011 with subject "Only return > requested attrs in sssvlv response" SHA: > 8eecc9a017584ea0b56b25f0e4750e3b16929de6. > > I have patched openldap 2.4.26 with all the fixes to sssvlv.c, but there is > still an issue with the attributes returned in an sssvlv response. > > On the first sssvlv request only the requested attributes are returned, but on > subsequent sssvlv requests using the vlv context returned by the first requests, > all the attributes are returned. > >

1 0

Re: (ITS#7087) test050-syncrepl-multimaster failed for mdb
by michael＠stroeder.com 10 Nov '11

10 Nov '11

Hmm, after 12 iterations slapd instances are blocked: Cleaning up test run directory from this run. Running 12 of 100 iterations running defines.sh Initializing server configurations... Starting server 1 on TCP/IP port 9011... Using ldapsearch to check that server 1 is running... Inserting syncprov overlay on server 1... Starting server 2 on TCP/IP port 9012... Using ldapsearch to check that server 2 is running... Configuring syncrepl on server 2... Starting server 3 on TCP/IP port 9013... Using ldapsearch to check that server 3 is running... Configuring syncrepl on server 3... Starting server 4 on TCP/IP port 9014... Using ldapsearch to check that server 4 is running... Configuring syncrepl on server 4... Adding schema and databases on server 1... Using ldapadd to populate server 1... Waiting 15 seconds for syncrepl to receive changes... Using ldapsearch to read config from server 1... Using ldapsearch to read config from server 2... Using ldapsearch to read config from server 3... [..hangs..]

1 0

Re: (ITS#7087) test050-syncrepl-multimaster failed for mdb
by michael＠stroeder.com 10 Nov '11

10 Nov '11

Download testrun/ here: http://www.stroeder.com/temp/openldap-its7087-testrun.tar.gz

1 0

(ITS#7087) test050-syncrepl-multimaster failed for mdb
by michael＠stroeder.com 10 Nov '11

10 Nov '11

Full_Name: Version: RE24 from git OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.128.253.233) This is also a test which only fails occasionally. testrun/ follows... >>>>> Starting test050-syncrepl-multimaster for mdb... running defines.sh Initializing server configurations... Starting server 1 on TCP/IP port 9011... Using ldapsearch to check that server 1 is running... Inserting syncprov overlay on server 1... Starting server 2 on TCP/IP port 9012... Using ldapsearch to check that server 2 is running... Configuring syncrepl on server 2... Starting server 3 on TCP/IP port 9013... Using ldapsearch to check that server 3 is running... Configuring syncrepl on server 3... Starting server 4 on TCP/IP port 9014... Using ldapsearch to check that server 4 is running... Configuring syncrepl on server 4... Adding schema and databases on server 1... Using ldapadd to populate server 1... Waiting 15 seconds for syncrepl to receive changes... Using ldapsearch to read config from server 1... Using ldapsearch to read config from server 2... Using ldapsearch to read config from server 3... Using ldapsearch to read config from server 4... Comparing retrieved configs from server 1 and server 2... Comparing retrieved configs from server 1 and server 3... Comparing retrieved configs from server 1 and server 4... Using ldapsearch to read all the entries from server 1... Using ldapsearch to read all the entries from server 2... Using ldapsearch to read all the entries from server 3... Using ldapsearch to read all the entries from server 4... Comparing retrieved entries from server 1 and server 2... Comparing retrieved entries from server 1 and server 3... test failed - server 1 and server 3 databases differ >>>>> test050-syncrepl-multimaster failed for mdb (exit 1) make[2]: *** [mdb-mod] Error 1 make[2]: Leaving directory `/usr/src/michael/openldap-git/re24/openldap/tests' make[1]: *** [test] Error 2 make[1]: Leaving directory `/usr/src/michael/openldap-git/re24/openldap/tests' make: *** [test] Error 2

1 0

Re: (ITS#7086) typofix for ldapmodify man page
by quanah＠zimbra.com 09 Nov '11

09 Nov '11

--On Wednesday, November 09, 2011 8:02 PM +0000 schmiddy(a)gmail.com wrote: > Full_Name: Josh Kupershmidt > Version: git head > OS: OS X > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (165.212.186.27) > > > Here is a typofix for the ldapmodify man page, replacing "where" with > "were" in the description of the "-S" option: Thanks, this is fixed. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7086) typofix for ldapmodify man page
by schmiddy＠gmail.com 09 Nov '11

09 Nov '11

Full_Name: Josh Kupershmidt Version: git head OS: OS X URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (165.212.186.27) Here is a typofix for the ldapmodify man page, replacing "where" with "were" in the description of the "-S" option: diff --git a/doc/man/man1/ldapmodify.1 b/doc/man/man1/ldapmodify.1 index 0268012..84296e8 100644 --- a/doc/man/man1/ldapmodify.1 +++ b/doc/man/man1/ldapmodify.1 @@ -144,7 +144,7 @@ will continue with modifications. The default is to exit after reporting an error. .TP .BI \-S \ file -Add or change records which where skipped due to an error are written to \fIfile\fP +Add or change records which were skipped due to an error are written to \fIfile\fP and the error message returned by the server is added as a comment. Most useful in conjunction with \fB\-c\fP. .TP

1 0

Re: (ITS#7085) mutex lockup issue
by quanah＠zimbra.com 09 Nov '11

09 Nov '11

--On Wednesday, November 09, 2011 2:01 PM +0000 hayashis(a)indiana.edu wrote: > Full_Name: Soichi Hayashi > Version: 2.4.22 OpenLDAP 2.4.22 is quite old, and had various known issues. Please use a current release (2.4.26). This report will not be investigated unless you can reproduce it with a current release of OpenLDAP. You also fail to note what BDB release you are using, and whether or not it has all the relevant patches applied to it. If you have a broken policy of only using vendor provided packages, then you will need to send a bug report to RedHat, as it is their job to maintain their vendor packages. Thanks! --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7074) back-ldap module compilation issue with gcc 4.6.1
by stephane.paquot＠gmail.com 09 Nov '11

09 Nov '11

--90e6ba613518beaf2904b14dee12 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Hi Howard, Compilation is fine and module back-ldap is fully operational with the workaround you have suggested. Many thanks to you. 2011/10/29 <openldap-its(a)openldap.org> > > *** THIS IS AN AUTOMATICALLY GENERATED REPLY *** > > Thanks for your report to the OpenLDAP Issue Tracking System. Your > report has been assigned the tracking number ITS#7074. > > One of our support engineers will look at your report in due course. > Note that this may take some time because our support engineers > are volunteers. They only work on OpenLDAP when they have spare > time. > > If you need to provide additional information in regards to your > issue report, you may do so by replying to this message. Note that > any mail sent to openldap-its(a)openldap.org with (ITS#7074) > in the subject will automatically be attached to the issue report. > > mailto:openldap-its@openldap.org?subject=3D(ITS#7074) > > You may follow the progress of this report by loading the following > URL in a web browser: > http://www.OpenLDAP.org/its/index.cgi?findid=3D7074 > > Please remember to retain your issue tracking number (ITS#7074) > on any further messages you send to us regarding this report. If > you don't then you'll just waste our time and yours because we > won't be able to properly track the report. > > Please note that the Issue Tracking System is not intended to > be used to seek help in the proper use of OpenLDAP Software. > Such requests will be closed. > > OpenLDAP Software is user supported. > http://www.OpenLDAP.org/support/ > > -------------- > Copyright 1998-2007 The OpenLDAP Foundation, All Rights Reserved. > > --=20 _________________________________ St=E9phane PAQUOT stephane.paquot(a)gmail.com Site web : http://www.sqlpac.com/ --90e6ba613518beaf2904b14dee12 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable <div>Hi Howard,</div><div> </div><div>Compilation is fine and module bac= k-ldap is fully operational with the workaround you have suggested.</div><d= iv> </div><div>Many thanks to you.</div><div> </div> <div class=3D= "gmail_quote"> 2011/10/29 <<a href=3D"mailto:openldap-its@openldap.o= rg">openldap-its(a)openldap.org</a>> <blockquote class=3D"gmail_= quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1= ex;"> *** THIS IS AN AUTOMATICALLY GENERATED REPLY *** Thanks for your report to the OpenLDAP Issue Tracking System. =A0Your report has been assigned the tracking number ITS#7074. One of our support engineers will look at your report in due course. Note that this may take some time because our support engineers are volunteers. =A0They only work on OpenLDAP when they have spare time. If you need to provide additional information in regards to your issue report, you may do so by replying to this message. =A0Note that any mail sent to <a href=3D"mailto:openldap-its@openldap.org">openldap-its@= openldap.org</a> with (ITS#7074) in the subject will automatically be attached to the issue report. =A0 =A0 =A0 =A0mailto:<a href=3D"mailto:openldap-its@openldap.org">openlda= p-its(a)openldap.org</a>?subject=3D(ITS#7074) You may follow the progress of this report by loading the following URL in a web browser: =A0 =A0<a href=3D"http://www.OpenLDAP.org/its/index.cgi?findid=3D7074" tar= get=3D"_blank">http://www.OpenLDAP.org/its/index.cgi?findid=3D7074</a> Please remember to retain your issue tracking number (ITS#7074) on any further messages you send to us regarding this report. =A0If you don't then you'll just waste our time and yours because we won't be able to properly track the report. Please note that the Issue Tracking System is not intended to be used to seek help in the proper use of OpenLDAP Software. Such requests will be closed. OpenLDAP Software is user supported. =A0 =A0 =A0 =A0<a href=3D"http://www.OpenLDAP.org/support/" target=3D"_bla= nk">http://www.OpenLDAP.org/support/</a> -------------- Copyright 1998-2007 The OpenLDAP Foundation, All Rights Reserved. </blockquote></div> <div> </div>-- ____________= _____________________ St=E9phane PAQUOT <a href=3D"mailto:ste= phane.paquot(a)gmail.com">stephane.paquot(a)gmail.com</a> Site web : <a href= =3D"http://www.sqlpac.com/">http://www.sqlpac.com/</a> --90e6ba613518beaf2904b14dee12--

1 0

(ITS#7085) mutex lockup issue
by hayashis＠indiana.edu 09 Nov '11

09 Nov '11

Full_Name: Soichi Hayashi Version: 2.4.22 OS: RHEL 5.7 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (99.137.202.79) When a large number of ldap update requests collides with large number of ldap search queries, mutex on BDB linked to OpenLDAP deadlocks. Following is the gdb output when this deadlocks occurs. (gdb) info threads 13 Thread 0x40a73940 (LWP 18767) 0x00000037aa4d48a8 in epoll_wait () from /lib64/libc.so.6 12 Thread 0x41cbe940 (LWP 18768) 0x00000037aa4cd722 in select () from /lib64/libc.so.6 11 Thread 0x424bf940 (LWP 18769) 0x00000037aac0aee9 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 10 Thread 0x42cc0940 (LWP 19203) 0x00000037aac0aee9 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 9 Thread 0x41274940 (LWP 19212) 0x00000037aac0aee9 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 8 Thread 0x434c1940 (LWP 19213) 0x00000037aac0aee9 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 7 Thread 0x43cc2940 (LWP 19214) 0x00000037aac0aee9 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 6 Thread 0x444c3940 (LWP 19215) 0x00000037aac0aee9 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 5 Thread 0x44cc4940 (LWP 19216) 0x00000037aac0aee9 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 4 Thread 0x454c5940 (LWP 19217) 0x00000037aac0a256 in pthread_rwlock_rdlock () from /lib64/libpthread.so.0 3 Thread 0x45cc6940 (LWP 19218) 0x00000037aac0aee9 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 2 Thread 0x464c7940 (LWP 19219) 0x00000037aac0a4c0 in pthread_rwlock_wrlock () from /lib64/libpthread.so.0 * 1 Thread 0x2ad9964071e0 (LWP 18752) 0x00000037aac07b35 in pthread_join () from /lib64/libpthread.so.0 (gdb) thread 2 [Switching to thread 2 (Thread 0x464c7940 (LWP 19219))]#0 0x00000037aac0a4c0 in pthread_rwlock_wrlock () from /lib64/libpthread.so.0 (gdb) bt #0 0x00000037aac0a4c0 in pthread_rwlock_wrlock () from /lib64/libpthread.so.0 #1 0x0000003f22c2b963 in __db_pthread_mutex_lock_openldap_slapd24_mdv () from /usr/lib64/libslapd24_db-4.8.so #2 0x0000003f22d1e2dc in __memp_fget_openldap_slapd24_mdv () from /usr/lib64/libslapd24_db-4.8.so #3 0x0000003f22c46a8f in __bam_search_openldap_slapd24_mdv () from /usr/lib64/libslapd24_db-4.8.so #4 0x0000003f22c34649 in ?? () from /usr/lib64/libslapd24_db-4.8.so #5 0x0000003f22c3534b in ?? () from /usr/lib64/libslapd24_db-4.8.so #6 0x0000003f22cd4bbf in __dbc_iput_openldap_slapd24_mdv () from /usr/lib64/libslapd24_db-4.8.so #7 0x0000003f22cd536f in __dbc_put_openldap_slapd24_mdv () from /usr/lib64/libslapd24_db-4.8.so #8 0x0000003f22cdca0f in __dbc_put_pp_openldap_slapd24_mdv () from /usr/lib64/libslapd24_db-4.8.so #9 0x00000000004c9d7e in bdb_idl_insert_key () #10 0x00000000004cbcb2 in bdb_key_change () (gdb) thread 4 [Switching to thread 4 (Thread 0x454c5940 (LWP 19217))]#0 0x00000037aac0a256 in pthread_rwlock_rdlock () from /lib64/libpthread.so.0 (gdb) bt #0 0x00000037aac0a256 in pthread_rwlock_rdlock () from /lib64/libpthread.so.0 #1 0x0000003f22c2b754 in __db_pthread_mutex_readlock_openldap_slapd24_mdv () from /usr/lib64/libslapd24_db-4.8.so #2 0x0000003f22d1e5fc in __memp_fget_openldap_slapd24_mdv () from /usr/lib64/libslapd24_db-4.8.so #3 0x0000003f22cd3df9 in __dbc_iget_openldap_slapd24_mdv () from /usr/lib64/libslapd24_db-4.8.so #4 0x0000003f22cdd43a in __dbc_get_pp_openldap_slapd24_mdv () from /usr/lib64/libslapd24_db-4.8.so #5 0x00000000004ca6d0 in bdb_idl_fetch_key () #6 0x00000000004cbd75 in bdb_key_read () In above case, thread 2 and thread 4 are deadlocked. The deadlock occurs within 2 - 8 hours after we start testing LDAP server on our BDII services. Meanwhile, OpenLDAP version 2.3 does not cause this deadlock, but it causes a gradual CPU usage increase until the performance degrades to the point where we need to restart the server. Is there anyway you could fix the deadlock issue on v2.4, or CPU usage issue on v2.3? Thanks, Soichi Hayashi

1 0

(ITS#7084) Password Modify Extended Operation to set pwdReset: TRUE
by michael＠stroeder.com 08 Nov '11

08 Nov '11

Full_Name: Version: OS: URL: Submission from: (NULL) (192.166.104.102) Feature Request: The Password Modify Extended Operation should set pwdReset: TRUE if the accompanying password policy specifies pwdMustChange: TRUE. Section 8.2.7 of http://tools.ietf.org/html/draft-behera-ldap-password-policy-09#section-8.2 says: If the value the pwdMustChange is TRUE and the modification is performed by a password administrator, then the pwdReset attribute is set to TRUE. Otherwise, the pwdReset is removed from the user's entry if it exists. So the question is how to determine whether the modification is performed by a password administrator. There could be an attribute in the password policy entry with values like authzTo/authzFrom to specify the set of password admins.

1 0

Re: (ITS#7082) smbk5pwd not respecting olcSmbK5PwdEnable on 64-bit platforms
by h.b.furuseth＠usit.uio.no 07 Nov '11

07 Nov '11

Thank you. I've committed your fix. verbs_to_mask() adds bits to an existing mask. > (...) I'm not sure why this only > manifests on 64-bit architectures, as my reduced test case (can > provide if necessary) also fails on 32-bit architectures. Probably just a coincidence: There happens to be a 0 on the stack where the compiler puts the m variable on on your 32-bit hosts. -- Hallvard

1 0

(ITS#7083) Broken verb_to_mask() calls
by h.b.furuseth＠usit.uio.no 07 Nov '11

07 Nov '11

Full_Name: Hallvard B Furuseth Version: 2.3-2.4.26 OS: URL: Submission from: (NULL) (193.71.61.60) Submitted by: hallvard slapd/bconfig.c and contrib:smbk5pwd.c use verb_to_mask() as if it returned a bitmask instead of an index. This affects delete operations of restrict, allows, disallows, requires, syslog loglevel, and smbk5pwd modules.

1 0

(ITS#7082) smbk5pwd not respecting olcSmbK5PwdEnable on 64-bit platforms
by zanchey＠ucc.gu.uwa.edu.au 07 Nov '11

07 Nov '11

Full_Name: David Adam Version: 2.4.23 OS: Debian URL: http://www.openldap.org/lists/openldap-technical/201111/msg00034.html Submission from: (NULL) (2001:44b8:6112:bc00:6ef0:49ff:fe74:26c4) On 64-bit machines using the contributed smbk5pwd overlay, the smbk5pwd module insists on trying to load all the Kerberos configuration regardless, even if smbk5PwdEnable is set to 'samba'. I suspect this has something to do with the call to verbs_to_mask() in smbk5pwd_cf_func (under the case PC_SMB_ENABLE) - my very basic printf() debugging shows that m is set correctly on 32-bit architectures but on 64-bit architectures returns a varying and strangely-numbered value (4511419, -1407332384, 353253328 in subsequent runs). The problem goes away if the m variable is initialised to 0 before the call to verbs_to_mask(). Most of the calls to verbs_to_mask() in the rest of the source initialise the fourth variable to 0 before calling. Either smbk5pwd also needs to do this, or the verbs_to_mask function needs to initialise the variable before use. I'm not sure why this only manifests on 64-bit architectures, as my reduced test case (can provide if necessary) also fails on 32-bit architectures.

1 0

Re: (ITS#7081) test020-proxycache failed for bdb
by hyc＠symas.com 04 Nov '11

04 Nov '11

michael(a)stroeder.com wrote: > Full_Name: > Version: > OS: > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (84.128.242.48) > > > Seems there's a regression in HEAD's slapo-pcache possibly due to the recent > commits. Thanks for the report, fixed in master. > >>>>>> Starting test020-proxycache for bdb... > Starting master slapd on TCP/IP port 9011... > Using ldapsearch to check that master slapd is running... > Using ldapadd to populate the master directory... > Starting proxy cache on TCP/IP port 9012... > Using ldapsearch to check that proxy slapd is running... > Making queries on the proxy cache... > Query 1: filter:(sn=Jon) attrs:all (expect nothing) > Query 2: filter:(|(cn=*Jon*)(sn=Jon*)) attrs:cn sn title uid > Query 3: filter:(sn=Smith*) attrs:cn sn uid > Query 4: filter:(sn=Doe*) attrs:cn sn title uid > Query 5: filter:(uid=johnd) attrs:mail postaladdress telephonenumber cn uid > Query 6: filter:(mail=*@mail.alumni.example.com) attrs:cn sn title uid > Query 7: filter:(mail=*) attrs:cn sn title uid > Query 8: filter:(mail=*example.com) attrs:cn sn title uid > ldapsearch failed (4) > Query 9: filter:(uid=b*) attrs:mail > ldapsearch failed (4) > Query 10: filter:(|(cn=All Staff)(sn=All Staff)) attrs:sn cn title uid > undefinedAttr > Query 1 not cacheable > Query 2 cacheable > Query 3 cacheable > Query 4 cacheable > Query 5 cacheable > Query 6 cacheable > Query 7 not cacheable > Query 8 cacheable > Query 9 cacheable > Query 10 cacheable > Successfully verified cacheability > Query 11: filter:(|(cn=*Jones)(sn=Jones)) attrs:cn sn title uid > Query 12: filter:(sn=Smith) attrs:cn sn title uid > Query 13: filter:(uid=bjorn) attrs:mail postaladdress telephonenumber cn uid > Query 14: filter:(mail=jaj@mail.alumni.example.com) attrs:cn sn title uid > Query 15: filter:(mail=*example.com) attrs:cn sn title uid > ldapsearch failed (4) > Query 16: filter:(uid=b*) attrs:mail > ldapsearch should have failed! >>>>>> test020-proxycache failed for bdb > (exit 1) > make[2]: *** [bdb-mod] Error 1 > make[2]: Leaving directory `/usr/src/michael/openldap/tests' > make[1]: *** [test] Error 2 > make[1]: Leaving directory `/usr/src/michael/openldap/tests' > make: *** [test] Error 2 > m > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7081) test020-proxycache failed for bdb
by michael＠stroeder.com 04 Nov '11

04 Nov '11

Full_Name: Version: OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.128.242.48) Seems there's a regression in HEAD's slapo-pcache possibly due to the recent commits. >>>>> Starting test020-proxycache for bdb... Starting master slapd on TCP/IP port 9011... Using ldapsearch to check that master slapd is running... Using ldapadd to populate the master directory... Starting proxy cache on TCP/IP port 9012... Using ldapsearch to check that proxy slapd is running... Making queries on the proxy cache... Query 1: filter:(sn=Jon) attrs:all (expect nothing) Query 2: filter:(|(cn=*Jon*)(sn=Jon*)) attrs:cn sn title uid Query 3: filter:(sn=Smith*) attrs:cn sn uid Query 4: filter:(sn=Doe*) attrs:cn sn title uid Query 5: filter:(uid=johnd) attrs:mail postaladdress telephonenumber cn uid Query 6: filter:(mail=*@mail.alumni.example.com) attrs:cn sn title uid Query 7: filter:(mail=*) attrs:cn sn title uid Query 8: filter:(mail=*example.com) attrs:cn sn title uid ldapsearch failed (4) Query 9: filter:(uid=b*) attrs:mail ldapsearch failed (4) Query 10: filter:(|(cn=All Staff)(sn=All Staff)) attrs:sn cn title uid undefinedAttr Query 1 not cacheable Query 2 cacheable Query 3 cacheable Query 4 cacheable Query 5 cacheable Query 6 cacheable Query 7 not cacheable Query 8 cacheable Query 9 cacheable Query 10 cacheable Successfully verified cacheability Query 11: filter:(|(cn=*Jones)(sn=Jones)) attrs:cn sn title uid Query 12: filter:(sn=Smith) attrs:cn sn title uid Query 13: filter:(uid=bjorn) attrs:mail postaladdress telephonenumber cn uid Query 14: filter:(mail=jaj@mail.alumni.example.com) attrs:cn sn title uid Query 15: filter:(mail=*example.com) attrs:cn sn title uid ldapsearch failed (4) Query 16: filter:(uid=b*) attrs:mail ldapsearch should have failed! >>>>> test020-proxycache failed for bdb (exit 1) make[2]: *** [bdb-mod] Error 1 make[2]: Leaving directory `/usr/src/michael/openldap/tests' make[1]: *** [test] Error 2 make[1]: Leaving directory `/usr/src/michael/openldap/tests' make: *** [test] Error 2 m

1 0

(ITS#7080) post read control in back-config
by michael＠stroeder.com 03 Nov '11

03 Nov '11

Full_Name: Version: OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.163.60.140) back-config should support the post read control so that applications can determine the possibly renumbered DN after adding/modifying an entry

1 0

(ITS#7079) back-mdb
by hyc＠OpenLDAP.org 03 Nov '11

03 Nov '11

Full_Name: Howard Chu Version: HEAD/RE24 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (76.94.188.8) Submitted by: hyc back-mdb is working well in master, should be added to RE24 and marked Experimental.

1 0

(ITS#7078) slapadd should be pipelined
by hyc＠OpenLDAP.org 03 Nov '11

03 Nov '11

Full_Name: Howard Chu Version: HEAD/RE24 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (76.94.188.8) Submitted by: hyc When using slapadd -q and tool-threads is > 1, slapadd should use a separate thread for reading/parsing the input LDIF, to allow it to run concurrently with the backend add operation. Already implemented in master.

1 0

(ITS#7077) olcMirrorMode implicit change not seen in cn=config
by christopher_wood＠pobox.com 03 Nov '11

03 Nov '11

Full_Name: Christopher Wood Version: 2.4.26 OS: Debian 6 (Squeeze) URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (173.206.227.67) Quoth Howard Chu: "There's a bit of a glitch here; when you modify the olcSyncrepl attribute, it is internally a delete followed by an add. When the delete occurs, the olcMirrorMode flag is implicitly turned off. (Because it is only allowed to be On for a database that is being replicated.) When the add occurs, the flag is not automatically turned back on. "The solution is to set it explicitly in your LDAPModify request." http://www.openldap.org/lists/openldap-technical/201109/msg00010.html The issue is that when this implicit flag toggle happens, the directory still reports that olcMirrorMode is TRUE. Assuming starting with a working MMR pair, this reproduces the issue: $ ldapmodify -x -w password -D 'cn=config' -h ldapmm1 dn: olcDatabase={0}config,cn=config changetype: modify replace: olcRootPW olcRootPW: password2 - replace: olcSyncrepl olcSyncrepl: rid=1 provider=ldap://ldapmm1 binddn="cn=config" bindmethod=simple credentials=password2 searchbase="cn=config" type=refreshAndPersist retry="5 5 30 +" timeout=5 olcSyncrepl: rid=2 provider=ldap://ldapmm2 binddn="cn=config" bindmethod=simple credentials=password2 searchbase="cn=config" type=refreshAndPersist retry="5 5 30 +" timeout=5 modifying entry "olcDatabase={0}config,cn=config" dn: olcDatabase={0}config,cn=config changetype: modify replace: olcRootPW olcRootPW: password3 modifying entry "olcDatabase={0}config,cn=config" ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral $ ldapsearch -x -w password2 -D 'cn=config' -b 'olcDatabase={0}config,cn=config' -s base -h ldapmm1 '' 'olcMirrorMode' # extended LDIF # # LDAPv3 # base <olcDatabase={0}config,cn=config> with scope baseObject # filter: (objectclass=*) # requesting: olcMirrorMode # # {0}config, config dn: olcDatabase={0}config,cn=config olcMirrorMode: TRUE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1

1 0

Re: (ITS#6981) slapd crashes when using sssvlv and pcache overlays
by hyc＠symas.com 02 Nov '11

02 Nov '11

h.b.furuseth(a)usit.uio.no wrote: > Though the original case is now fixed in master, this simpler test > case crashes in the same way. It forces REP_ENTRY_MUSTRELEASE to be > set, since the current fix is to restore OpenLDAP 2.4.23's behavior of > not flushing the entry otherwise. But 2.4.23 also crashes with this: > > $ cat<<EOF>its6981.conf > include servers/slapd/schema/core.schema > database bdb > suffix o=test > rootdn o=test > directory its6981/a > > overlay pcache > pcache bdb 10000 1 50 100 > pcacheAttrset 0 * + > pcacheTemplate (objectClass=) 0 60 > pcacheTemplate (o=) 0 60 > pcache-directory its6981/b > EOF > > $ mkdir -p its6981/a its6981/b; rm -f its6981/?/* > $ servers/slapd/slapd -Tadd -f its6981.conf<<EOF > dn: o=test > objectclass: organization > o: test > EOF > > $ servers/slapd/slapd -f its6981.conf -d0 -h ldap://localhost:3890/& > $ clients/tools/ldapsearch -LLLxh localhost:3890 -b o=test '(o=test)' > > > It doesn't seem to make sense for code to assume sr_entry persists > past the point it'd be flushed if REP_ENTRY_MUSTRELEASE is set. > That's why this change snuck into ITS#6758 (SlapyReply usage). > Probably we should put the flush back someday - after checking better > than I did last time. > OK, the flush is back to where it was in 2.4.26. pcache.c has been reorganized again, taking ITS#5112 into account. REP_RESULT handling is still in pcache_op_cleanup (as #5112 requires) but REP_SEARCH is back in op_response (where it used to be, before the #5112 patch). -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6981) slapd crashes when using sssvlv and pcache overlays
by h.b.furuseth＠usit.uio.no 02 Nov '11

02 Nov '11

Though the original case is now fixed in master, this simpler test case crashes in the same way. It forces REP_ENTRY_MUSTRELEASE to be set, since the current fix is to restore OpenLDAP 2.4.23's behavior of not flushing the entry otherwise. But 2.4.23 also crashes with this: $ cat <<EOF >its6981.conf include servers/slapd/schema/core.schema database bdb suffix o=test rootdn o=test directory its6981/a overlay pcache pcache bdb 10000 1 50 100 pcacheAttrset 0 * + pcacheTemplate (objectClass=) 0 60 pcacheTemplate (o=) 0 60 pcache-directory its6981/b EOF $ mkdir -p its6981/a its6981/b; rm -f its6981/?/* $ servers/slapd/slapd -Tadd -f its6981.conf <<EOF dn: o=test objectclass: organization o: test EOF $ servers/slapd/slapd -f its6981.conf -d0 -h ldap://localhost:3890/ & $ clients/tools/ldapsearch -LLLxh localhost:3890 -b o=test '(o=test)' It doesn't seem to make sense for code to assume sr_entry persists past the point it'd be flushed if REP_ENTRY_MUSTRELEASE is set. That's why this change snuck into ITS#6758 (SlapyReply usage). Probably we should put the flush back someday - after checking better than I did last time. -- Hallvard

1 0

(ITS#7076) Duplicate result messages on entry/searchref error
by h.b.furuseth＠usit.uio.no 01 Nov '11

01 Nov '11

Full_Name: Hallvard B Furuseth Version: all OS: URL: Submission from: (NULL) (193.71.61.60) Submitted by: hallvard If slap_send_search_entry() or slap_send_search_reference() fail, the client receives two responses. These functions should not send_ldap_error(). Their caller does that. Only tested with slap_send_search_entry(), by replacing the first 'if ( rc == -1 )' with 'if ( 1 )'.

1 0

Re: (ITS#7074) back-ldap module compilation issue with gcc 4.6.1
by hyc＠symas.com 01 Nov '11

01 Nov '11

stephane.paquot(a)gmail.com wrote: > Full_Name: Stéphane PAQUOT > Version: 2.4.26 > OS: Windows (MingW) > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (83.194.186.14) > > > Hi > > I am actually compiling backend modules for openldap 2.4.26 with MingW (gcc > version 4.6.1, GNU make 3.81, GNU libtool 2.4, GNU automake 1.11.1, GNU autoconf > 2.68. > An issue occurs when compiling back-ldap module. > > The GNU tools used are the following : > host-triplet: i686-pc-mingw32 > shell: /bin/sh > compiler: gcc > compiler flags: -O3 -s -mms-bitfields -march=i386 -mtune=i686 > linker: c:/mingw/mingw32/bin/ld.exe (gnu? yes) > libtool: (GNU libtool) 2.4 > automake: automake (GNU automake) 1.11.1 > autoconf: autoconf (GNU Autoconf) 2.68 > > The command line to compile openldap 2.4.26 is the following > > ./configure --prefix=/software/openldap \ > --enable-slapd \ > --enable-modules \ > --enable-rewrite \ > --enable-bdb=mod \ > --enable-hdb=mod \ > --enable-ldap=mod \ > --enable-sql=mod \ > --enable-monitor=mod \ > --enable-accesslog=mod \ > --enable-auditlog=mod \ > --enable-rwm=mod \ > --enable-syncprov=mod \ > --with-odbc=odbc32 \ > --with-tls=openssl \ > --without-cyrus-sasl > > Here are the compilation flags : > CPPFLAGS="-I/software/openssl/include > -I/software/berkeleydb/berkeleydb-5.2/include" > LDFLAGS="-I/software/openssl/lib -I/software/berkeleydb/berkeleydb-5.2/lib" > LIBS="-lodbc32 -lws2_32" > > All backends modules and overlays compile fine but when compiling backend > back-ldap as a module, the following compile error occurs : error: initializer > element is not constant. > > $ make > /bin/sh ../../../libtool --tag=disable-static --mode=compile gcc -g -O2 > -std=c89 > -I../../../include -I../../../include -I.. -I./.. > -I/software/openssl/i > nclude -I/software/berkeleydb/berkeleydb-5.2/include -DSLAPD_IMPORT -c > chain.c > > gcc -g -O2 -std=c89 -I../../../include -I../../../include -I.. -I./.. > -I/softwa > re/openssl/include -I/software/berkeleydb/berkeleydb-5.2/include -DSLAPD_IMPORT > -c chain.c -DDLL_EXPORT -DPIC -o .libs/chain.o > chain.c:1273:3: error: initializer element is not constant > chain.c:1273:3: error: (near initialization for 'chainocs[1].co_table') > make: *** [chain.lo] Error 1 > > gcc 4.6.1 complains about > > static ConfigOCs chainocs[] = { > { "( OLcfgOvOc:3.1 " > "NAME 'olcChainConfig' " > "DESC 'Chain configuration' " > "SUP olcOverlayConfig " > "MAY ( " > #ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR > "olcChainingBehavior $ " > #endif /* LDAP_CONTROL_X_CHAINING_BEHAVIOR */ > "olcChainCacheURI $ " > "olcChainMaxReferralDepth $ " > "olcChainReturnError " > ") )", > Cft_Overlay, chaincfg, NULL, chain_cfadd }, > { "( OLcfgOvOc:3.2 " > "NAME 'olcChainDatabase' " > "DESC 'Chain remote server configuration' " > "AUXILIARY )", > Cft_Misc, olcDatabaseDummy, chain_ldadd > #ifdef SLAP_CONFIG_DELETE > , NULL, chain_lddel > #endif > }, > { NULL, 0, NULL} > }; > > I try to solve this problem but I'm a little stuck. When back-ldap is not > compiled as a module, no problem, slapd compiles fine with this backend > back-ldap. This type of problem seems to crop up regularly with Windows modules; the Windows linker is too stupid to figure out how to reference a data symbol from a different binary. In this case you can fix it by making a local copy of the definition of olcDatabaseDummy (which is in slapd/bconfig.c) and use the local copy in this table instead of the original. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7062) writes from lost connections not increasing contextCSN
by hyc＠symas.com 01 Nov '11

01 Nov '11

ebackes(a)symas.com wrote: > Full_Name: Emily Backes > Version: 2.4.26 > OS: any > URL: > Submission from: (NULL) (75.244.124.114) > > > If a client connects and writes, e.g. ADDs entries, then disconnects > before seeing the result, the writes are stored in the database but do > not increment contextCSN. This is an obvious consequence of the fact that checks for abandoned ops are performed before any response callbacks are invoked. The main op might have completed but no overlay code will run, so syncprov never gets a chance to update itself. (See result.c send_ldap_response()) The fix is less obvious. Probably we should only bypass the callbacks if rs->sr_err == SLAPD_ABANDON, meaning that the operation itself was actually aborted. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7075) back-perl initialization broken
by h.b.furuseth＠usit.uio.no 31 Oct '11

31 Oct '11

Full_Name: Hallvard B Furuseth Version: 2.4.17-2.4.26 OS: URL: http://groups.google.com/group/comp.lang.perl.misc/browse_thread/thread/151… Submission from: (NULL) (193.71.61.60) Submitted by: hallvard back-perl initialization broken PERL_SYS_INIT3() is called with wrong arguments. Introduced by ITS#5658. Fixing it to do the same as the Perl main program, but I can not test it on a system where these params are used so it is relevant - e.g. Windows. - arg 3 (env) is NULL, but Perl:proto.h requires non-NULL. Fixing to use PERL_SYS_INIT() instead. That also affects Perl versions before 5.6. 5.6 introduced INIT3, INIT is older. The alternative would be to pass &(char **environ) to PERL_SYS_INIT3(), but who knows what Perl does with the environment. Seems simpler to avoid it. - PERL_SYS_INIT/INIT3() can change their arguments. back-perl passed the changed argc but not the changed argv to perl_parse(). Fixing to pass both the changed argc and the changed argv. - arg 2 is passed char *(*argv)[3]. Fixing to pass as a char ***argv: char *embedding[] = { "", "-e", "0", NULL }, **argv = embedding; char ***old = (char ***) &embedding, ***corrected = &argv; 'old' is how the address was passed, 'new' is how it should be passed. 'old' holds the address of the embedding array, but it should hold the address of a variable which holds that address. See comp.lang.perl.misc discussion "PERL_SYS_INIT()" from Oct 31 2011.

1 0

Re: (ITS#7072) caseIgnoreMatch equals regular capital I with dotted capital I
by hyc＠symas.com 31 Oct '11

31 Oct '11

Frank.Meisschaert(a)UGent.be wrote: > Full_Name: Frank Meisschaert > Version: 2.4.26 > OS: linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (157.193.44.200) > > > When I try to add the names "İsmail" (original, with dotted capital I) and > "Ismail" (transcribed, regular capital I) to an entry using ldapmodify: > > dn: ... > changetype: modify > replace: givenName > givenName: Ismail > givenName:: xLBzbWFpbA== > - > > I get the error: > > ldap_modify: Type or value exists (20) > additional info: givenName: value #0 provided more than once > > The lowercase version of dotted and regular capital I is regular i which > explains this error. However according to unicode case folding the dotted > capital I should be mapped to 0069 0307 (i, combining dot above) which would > make Ismail andİsmail different when compared case-insensitively as I > would expect. Apparently our liblunicode implementation doesn't use the CaseFolding data. I believe that means our implementation corresponds to the "Simple" case folding rules. They're valid, just not doing what you want in this case. So it appears that this is an enhancement request. I don't believe this request warrants a very high priority. Looking at the Unicode charts, I-with-dot-above is the only character where the two case folding alternatives actually makes a difference. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7074) back-ldap module compilation issue with gcc 4.6.1
by stephane.paquot＠gmail.com 29 Oct '11

29 Oct '11

Full_Name: Stéphane PAQUOT Version: 2.4.26 OS: Windows (MingW) URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (83.194.186.14) Hi I am actually compiling backend modules for openldap 2.4.26 with MingW (gcc version 4.6.1, GNU make 3.81, GNU libtool 2.4, GNU automake 1.11.1, GNU autoconf 2.68. An issue occurs when compiling back-ldap module. The GNU tools used are the following : host-triplet: i686-pc-mingw32 shell: /bin/sh compiler: gcc compiler flags: -O3 -s -mms-bitfields -march=i386 -mtune=i686 linker: c:/mingw/mingw32/bin/ld.exe (gnu? yes) libtool: (GNU libtool) 2.4 automake: automake (GNU automake) 1.11.1 autoconf: autoconf (GNU Autoconf) 2.68 The command line to compile openldap 2.4.26 is the following ./configure --prefix=/software/openldap \ --enable-slapd \ --enable-modules \ --enable-rewrite \ --enable-bdb=mod \ --enable-hdb=mod \ --enable-ldap=mod \ --enable-sql=mod \ --enable-monitor=mod \ --enable-accesslog=mod \ --enable-auditlog=mod \ --enable-rwm=mod \ --enable-syncprov=mod \ --with-odbc=odbc32 \ --with-tls=openssl \ --without-cyrus-sasl Here are the compilation flags : CPPFLAGS="-I/software/openssl/include -I/software/berkeleydb/berkeleydb-5.2/include" LDFLAGS="-I/software/openssl/lib -I/software/berkeleydb/berkeleydb-5.2/lib" LIBS="-lodbc32 -lws2_32" All backends modules and overlays compile fine but when compiling backend back-ldap as a module, the following compile error occurs : error: initializer element is not constant. $ make /bin/sh ../../../libtool --tag=disable-static --mode=compile gcc -g -O2 -std=c89 -I../../../include -I../../../include -I.. -I./.. -I/software/openssl/i nclude -I/software/berkeleydb/berkeleydb-5.2/include -DSLAPD_IMPORT -c chain.c gcc -g -O2 -std=c89 -I../../../include -I../../../include -I.. -I./.. -I/softwa re/openssl/include -I/software/berkeleydb/berkeleydb-5.2/include -DSLAPD_IMPORT -c chain.c -DDLL_EXPORT -DPIC -o .libs/chain.o chain.c:1273:3: error: initializer element is not constant chain.c:1273:3: error: (near initialization for 'chainocs[1].co_table') make: *** [chain.lo] Error 1 gcc 4.6.1 complains about static ConfigOCs chainocs[] = { { "( OLcfgOvOc:3.1 " "NAME 'olcChainConfig' " "DESC 'Chain configuration' " "SUP olcOverlayConfig " "MAY ( " #ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR "olcChainingBehavior $ " #endif /* LDAP_CONTROL_X_CHAINING_BEHAVIOR */ "olcChainCacheURI $ " "olcChainMaxReferralDepth $ " "olcChainReturnError " ") )", Cft_Overlay, chaincfg, NULL, chain_cfadd }, { "( OLcfgOvOc:3.2 " "NAME 'olcChainDatabase' " "DESC 'Chain remote server configuration' " "AUXILIARY )", Cft_Misc, olcDatabaseDummy, chain_ldadd #ifdef SLAP_CONFIG_DELETE , NULL, chain_lddel #endif }, { NULL, 0, NULL} }; I try to solve this problem but I'm a little stuck. When back-ldap is not compiled as a module, no problem, slapd compiles fine with this backend back-ldap. Best regards and many thanks to you. Stéphane PAQUOT Database Administrator (Sybase, Oracle, MS SQL Server, MySQL). France, Paris.

1 0

Re: (ITS#7010) Deadlock in Producer/Consumer Nodes
by ghola＠rebelbase.com 28 Oct '11

28 Oct '11

Here is the data requested from the most recent lock-up. Default locking region information: 14 Last allocated locker ID 0x7fffffff Current maximum unused locker ID 9 Number of lock modes 1000 Maximum number of locks possible 1000 Maximum number of lockers possible 1000 Maximum number of lock objects possible 160 Number of lock object partitions 27 Number of current locks 682 Maximum number of locks at any one time 5 Maximum number of locks in any one bucket 0 Maximum number of locks stolen by for an empty partition 0 Maximum number of locks stolen for any one partition 63 Number of current lockers 63 Maximum number of lockers at any one time 21 Number of current lock objects 377 Maximum number of lock objects at any one time 3 Maximum number of lock objects in any one bucket 0 Maximum number of objects stolen by for an empty partition 0 Maximum number of objects stolen for any one partition 13M Total number of locks requested (13581842) 13M Total number of locks released (13581804) 0 Total number of locks upgraded 13 Total number of locks downgraded 6 Lock requests not available due to conflicts, for which we waited 1 Lock requests not available due to conflicts, for which we did not wait 0 Number of deadlocks 0 Lock timeout value 0 Number of locks that have timed out 0 Transaction timeout value 0 Number of transactions that have timed out 808KB The size of the lock region 15280 The number of partition locks that required waiting (0%) 10921 The maximum number of times any partition lock was waited for (0%) 0 The number of object queue operations that required waiting (0%) 4742 The number of locker allocations that required waiting (0%) 0 The number of region locks that required waiting (0%) 3 Maximum hash bucket length =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Lock REGINFO information: Lock Region type 5 Region ID __db.005 Region name 0x2aeb3285c000 Region address 0x2aeb3285c138 Region primary address 0 Region maximum allocation 0 Region allocated Region allocations: 327 allocations, 0 failures, 0 frees, 1 longest Allocations by power-of-two sizes: 1KB 322 2KB 0 4KB 0 8KB 0 16KB 1 32KB 2 64KB 0 128KB 1 256KB 1 512KB 0 1024KB 0 REGION_JOIN_OK Region flags =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Lock region parameters: 262177 Lock region region mutex [0/450861 0% 15746/47187942583984] 1031 locker table size 1031 object table size 952 obj_off 122400 locker_off 1 need_dd =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Lock conflict matrix: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Locks grouped by lockers: Locker Mode Count Status ----------------- Object --------------- 1 dd=22 locks held 1 write locks 0 pid/thread 7123/47021676422512 priority 100 1 READ 1 HELD id2entry.bdb handle 0 2 dd=21 locks held 1 write locks 0 pid/thread 7123/47021676422512 priority 100 2 READ 1 HELD dn2id.bdb handle 0 3 dd=20 locks held 0 write locks 0 pid/thread 7123/47021676422512 priority 100 4 dd=16 locks held 1 write locks 0 pid/thread 7123/1113479488 priority 100 4 READ 1 HELD entryUUID.bdb handle 0 5 dd=15 locks held 1 write locks 0 pid/thread 7123/1113479488 priority 100 5 READ 1 HELD modifyTimestamp.bdb handle 0 6 dd=12 locks held 1 write locks 0 pid/thread 7123/1113479488 priority 100 6 READ 1 HELD cn.bdb handle 0 7 dd=11 locks held 1 write locks 0 pid/thread 7123/1113479488 priority 100 7 READ 1 HELD givenName.bdb handle 0 8 dd=10 locks held 1 write locks 0 pid/thread 7123/1113479488 priority 100 8 READ 1 HELD sn.bdb handle 0 9 dd= 9 locks held 1 write locks 0 pid/thread 7123/1113479488 priority 100 9 READ 1 HELD objectClass.bdb handle 0 a dd= 6 locks held 1 write locks 0 pid/thread 7123/1113479488 priority 100 a READ 1 HELD uid.bdb handle 0 b dd= 5 locks held 1 write locks 0 pid/thread 7123/1113479488 priority 100 b READ 1 HELD uidNumber.bdb handle 0 c dd= 4 locks held 1 write locks 0 pid/thread 7123/1113479488 priority 100 c READ 1 HELD gidNumber.bdb handle 0 d dd= 3 locks held 1 write locks 0 pid/thread 7123/1121872192 priority 100 d READ 1 HELD sambaSID.bdb handle 0 e dd= 2 locks held 1 write locks 0 pid/thread 7123/1121872192 priority 100 e READ 1 HELD sambaPrimaryGroupSID.bdb handle 0 80000380 dd=14 locks held 0 write locks 0 pid/thread 7123/1121872192 priority 100 80000381 dd=13 locks held 0 write locks 0 pid/thread 7123/1092884800 priority 100 80000003 dd=19 locks held 0 write locks 0 pid/thread 7123/47021676422512 priority 100 80000004 dd=18 locks held 0 write locks 0 pid/thread 7123/47021676422512 priority 100 80000005 dd=17 locks held 1 write locks 0 pid/thread 7123/1113479488 priority 100 80000005 READ 1 HELD 0x3dc78 len: 9 data: a2b007000000000000 80000938 dd= 8 locks held 0 write locks 0 pid/thread 7123/1138657600 priority 100 80000939 dd= 7 locks held 0 write locks 0 pid/thread 7123/1130264896 priority 100 80048a47 dd= 1 locks held 0 write locks 0 pid/thread 7123/1147050304 priority 100 800dc266 dd= 0 locks held 11 write locks 5 pid/thread 7123/1138657600 priority 100 800dc266 WRITE 1 WAIT 0x3dc78 len: 9 data: a2b007000000000000 800dc266 READ 2 HELD dn2id.bdb page 11658 800dc266 WRITE 4 HELD dn2id.bdb page 11658 800dc266 READ 2 HELD objectClass.bdb page 115 800dc266 WRITE 2 HELD objectClass.bdb page 115 800dc266 READ 1 HELD objectClass.bdb page 3 800dc266 READ 1 HELD entryUUID.bdb page 2839 800dc266 WRITE 2 HELD entryUUID.bdb page 2839 800dc266 READ 1 HELD modifyTimestamp.bdb page 3168 800dc266 WRITE 2 HELD modifyTimestamp.bdb page 3168 800dc266 WRITE 3 HELD id2entry.bdb page 14475 800dc266 READ 1 HELD 0x36718 len: 9 data: 9cb007000000000000 800dc268 dd= 0 locks held 0 write locks 0 pid/thread 7123/1163835712 priority 100 800dc269 dd= 0 locks held 0 write locks 0 pid/thread 7123/1155443008 priority 100 800dc26a dd= 0 locks held 0 write locks 0 pid/thread 7123/1172228416 priority 100 800dc26b dd= 0 locks held 0 write locks 0 pid/thread 7123/1180621120 priority 100 800dc26c dd= 0 locks held 0 write locks 0 pid/thread 7123/1189013824 priority 100 800dc26d dd= 0 locks held 0 write locks 0 pid/thread 7123/1197406528 priority 100 800dc26e dd= 0 locks held 0 write locks 0 pid/thread 7123/1205799232 priority 100 800dc26f dd= 0 locks held 0 write locks 0 pid/thread 7123/1214191936 priority 100 800dc270 dd= 0 locks held 0 write locks 0 pid/thread 7123/1222584640 priority 100 800dc271 dd= 0 locks held 0 write locks 0 pid/thread 7123/1230977344 priority 100 800dc272 dd= 0 locks held 0 write locks 0 pid/thread 7123/1239370048 priority 100 800dc273 dd= 0 locks held 0 write locks 0 pid/thread 7123/1247762752 priority 100 800dc274 dd= 0 locks held 0 write locks 0 pid/thread 7123/1256155456 priority 100 800dc275 dd= 0 locks held 0 write locks 0 pid/thread 7123/1264548160 priority 100 800dc276 dd= 0 locks held 0 write locks 0 pid/thread 7123/1272940864 priority 100 800dc277 dd= 0 locks held 0 write locks 0 pid/thread 7123/1289726272 priority 100 800dc278 dd= 0 locks held 0 write locks 0 pid/thread 7123/1281333568 priority 100 800dc279 dd= 0 locks held 0 write locks 0 pid/thread 7123/1298118976 priority 100 800dc27a dd= 0 locks held 0 write locks 0 pid/thread 7123/1306511680 priority 100 800dc27b dd= 0 locks held 0 write locks 0 pid/thread 7123/1314904384 priority 100 800dc27c dd= 0 locks held 0 write locks 0 pid/thread 7123/1331689792 priority 100 800dc27d dd= 0 locks held 0 write locks 0 pid/thread 7123/1340082496 priority 100 800dc27e dd= 0 locks held 0 write locks 0 pid/thread 7123/1348475200 priority 100 800dc27f dd= 0 locks held 0 write locks 0 pid/thread 7123/1356867904 priority 100 800dc280 dd= 0 locks held 0 write locks 0 pid/thread 7123/1365260608 priority 100 800dc281 dd= 0 locks held 0 write locks 0 pid/thread 7123/1373653312 priority 100 800dc282 dd= 0 locks held 0 write locks 0 pid/thread 7123/1382046016 priority 100 800dc283 dd= 0 locks held 0 write locks 0 pid/thread 7123/1390438720 priority 100 800dc284 dd= 0 locks held 0 write locks 0 pid/thread 7123/1407224128 priority 100 800dc285 dd= 0 locks held 0 write locks 0 pid/thread 7123/1398831424 priority 100 800dc286 dd= 0 locks held 0 write locks 0 pid/thread 7123/1415616832 priority 100 800dc287 dd= 0 locks held 0 write locks 0 pid/thread 7123/1424009536 priority 100 800dc288 dd= 0 locks held 0 write locks 0 pid/thread 7123/1432402240 priority 100 800dc289 dd= 0 locks held 0 write locks 0 pid/thread 7123/1440794944 priority 100 800dc28a dd= 0 locks held 0 write locks 0 pid/thread 7123/1449187648 priority 100 800dc28b dd= 0 locks held 0 write locks 0 pid/thread 7123/1457580352 priority 100 800dc28c dd= 0 locks held 0 write locks 0 pid/thread 7123/1474365760 priority 100 800dc28d dd= 0 locks held 0 write locks 0 pid/thread 7123/1465973056 priority 100 800dc28e dd= 0 locks held 0 write locks 0 pid/thread 7123/1482758464 priority 100 800dc28e READ 1 WAIT dn2id.bdb page 11658 800dc28f dd= 0 locks held 0 write locks 0 pid/thread 7123/1491151168 priority 100 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Locks grouped by object: Locker Mode Count Status ----------------- Object --------------- 800dc266 READ 2 HELD objectClass.bdb page 115 800dc266 WRITE 2 HELD objectClass.bdb page 115 800dc266 WRITE 3 HELD id2entry.bdb page 14475 4 READ 1 HELD entryUUID.bdb handle 0 1 READ 1 HELD id2entry.bdb handle 0 b READ 1 HELD uidNumber.bdb handle 0 80000005 READ 1 HELD 0x3dc78 len: 9 data: a2b007000000000000 800dc266 WRITE 1 WAIT 0x3dc78 len: 9 data: a2b007000000000000 e READ 1 HELD sambaPrimaryGroupSID.bdb handle 0 2 READ 1 HELD dn2id.bdb handle 0 800dc266 READ 1 HELD entryUUID.bdb page 2839 800dc266 WRITE 2 HELD entryUUID.bdb page 2839 a READ 1 HELD uid.bdb handle 0 6 READ 1 HELD cn.bdb handle 0 800dc266 READ 1 HELD 0x36718 len: 9 data: 9cb007000000000000 800dc266 READ 1 HELD modifyTimestamp.bdb page 3168 800dc266 WRITE 2 HELD modifyTimestamp.bdb page 3168 d READ 1 HELD sambaSID.bdb handle 0 c READ 1 HELD gidNumber.bdb handle 0 5 READ 1 HELD modifyTimestamp.bdb handle 0 8 READ 1 HELD sn.bdb handle 0 7 READ 1 HELD givenName.bdb handle 0 800dc266 READ 1 HELD objectClass.bdb page 3 9 READ 1 HELD objectClass.bdb handle 0 800dc266 READ 2 HELD dn2id.bdb page 11658 800dc266 WRITE 4 HELD dn2id.bdb page 11658 800dc28e READ 1 WAIT dn2id.bdb page 11658

1 0

(ITS#7073) zero-length entries should be allowed
by hyc＠OpenLDAP.org 27 Oct '11

27 Oct '11

Full_Name: Howard Chu Version: 2.4 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (76.94.188.8) Submitted by: hyc entry_header() rejects "entries" that have zero attributes. As it turns out, overlays like pcache and translucent can create such entries in their normal operation. With back-bdb/hdb, such entries will work OK while slapd is running, because they're in the entry cache. But after a restart, such entries can't be read back from the DB because they're considered invalid by entry_header(). Already fixed in master, entry_header() now allows zero length entries.

1 0

(ITS#7072) caseIgnoreMatch equals regular capital I with dotted capital I
by Frank.Meisschaert＠UGent.be 27 Oct '11

27 Oct '11

Full_Name: Frank Meisschaert Version: 2.4.26 OS: linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (157.193.44.200) When I try to add the names "İsmail" (original, with dotted capital I) and "Ismail" (transcribed, regular capital I) to an entry using ldapmodify: dn: ... changetype: modify replace: givenName givenName: Ismail givenName:: xLBzbWFpbA== - I get the error: ldap_modify: Type or value exists (20) additional info: givenName: value #0 provided more than once The lowercase version of dotted and regular capital I is regular i which explains this error. However according to unicode case folding the dotted capital I should be mapped to 0069 0307 (i, combining dot above) which would make Ismail and İsmail different when compared case-insensitively as I would expect.

1 0

Re: (ITS#7054) Please drop support to FreeBSD 1.x
by d＠delphij.net 24 Oct '11

24 Oct '11

Just a headsup -- libtool 2.4.2 should have the required changes to support FreeBSD 10.x. Cheers, -- Xin LI <delphij(a)delphij.net> https://www.delphij.net/ FreeBSD - The Power to Serve! Live free or die

1 0

Re: (ITS#7064) moznss SEC_ERROR_BAD_SIGNATURE with a certificate trusted by OpenSSL
by massimo.gravino＠pd.infn.it 24 Oct '11

24 Oct '11

On Mon, 24 Oct 2011, jvcelak(a)redhat.com wrote: > I believe this is a bug in Mozilla NSS and not in OpenLDAP. I have > successfully reproduced on Fedora. > > If you are interested in some details from my investigation, check: > https://bugzilla.redhat.com/show_bug.cgi?id=748394 > > -- > Jan V?el?k > Base Operating Systems Brno > Red Hat Inc. Thank you very much, I'll follow the discussion about this bug at bugzilla.redhat.com Best regards, Massimo Gravino System Administrator National Institute of Nuclear Physics - Padova (Italy)

1 0

Re: (ITS#7064) moznss SEC_ERROR_BAD_SIGNATURE with a certificate trusted by OpenSSL
by jvcelak＠redhat.com 24 Oct '11

24 Oct '11

I believe this is a bug in Mozilla NSS and not in OpenLDAP. I have successfully reproduced on Fedora. If you are interested in some details from my investigation, check: https://bugzilla.redhat.com/show_bug.cgi?id=748394 -- Jan Vèelák Base Operating Systems Brno Red Hat Inc.

1 0

Re: (ITS#7067) openldap not properly starting
by masarati＠aero.polimi.it 24 Oct '11

24 Oct '11

On 10/24/2011 07:18 AM, sanjiv.singh(a)impetus.co.in wrote: > --_000_23A2685ED8B30D46A90227113A1ECE0758F47662Mail3impetuscoi_ > Content-Type: text/plain; charset="us-ascii" > Content-Transfer-Encoding: quoted-printable > > How can I redirect to openldap-technical mailing list ? > Not getting any link for this . Subscribe to openldap-technical <http://www.openldap.org/lists/mm/listinfo/openldap-technical>; post your message to <mailto:openldap-technical@openldap.org> -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

Re: (ITS#7067) openldap not properly starting
by sanjiv.singh＠impetus.co.in 23 Oct '11

23 Oct '11

--_000_23A2685ED8B30D46A90227113A1ECE0758F47662Mail3impetuscoi_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable How can I redirect to openldap-technical mailing list ? Not getting any link for this . Regards, Sanjiv Singh ________________________________ New Impetus webcast on-demand 'Big Data Technologies for Social Media Analy= tics' available at http://bit.ly/nFdet0. Visit http://www.impetus.com to know more. Follow us on www.twitter.com/imp= etuscalling NOTE: This message may contain information that is confidential, proprietar= y, privileged or otherwise protected by law. The message is intended solely= for the named addressee. If received in error, please destroy and notify t= he sender. Any use of this email is prohibited when received in error. Impe= tus does not represent, warrant and/or guarantee, that the integrity of thi= s communication has been maintained nor that the communication is free of e= rrors, virus, interception or interference. --_000_23A2685ED8B30D46A90227113A1ECE0758F47662Mail3impetuscoi_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <style>  </style> </head> <body lang=3D"EN-US" link=3D"blue" vlink=3D"purple"> <div class=3D"WordSection1"> <pre>How can I redirect to openldap-technical mailing list ?</pre> Not getting any  link for this .   Regards, Sanjiv Singh     </div> <hr> New Impetus webcast on-demand ‘Big Data Technologies for Social Media= Analytics’ available at http://bit.ly/nFdet0. Visit http://www.impetus.com to know more. Follow us on www.twitter.com/imp= etuscalling NOTE: This message may contain information that is confidential, proprietar= y, privileged or otherwise protected by law. The message is intended solely= for the named addressee. If received in error, please destroy and notify t= he sender. Any use of this email is prohibited when received in error. Impetus does not represent, warrant = and/or guarantee, that the integrity of this communication has been maintai= ned nor that the communication is free of errors, virus, interception or in= terference. </body> </html> --_000_23A2685ED8B30D46A90227113A1ECE0758F47662Mail3impetuscoi_--

1 0

Re: (ITS#7065) changeType: modify "replace/delete" trick causes segmentation fault in cn=config
by h.b.furuseth＠usit.uio.no 23 Oct '11

23 Oct '11

Reproduced in master by trying to change olcSaslHost: config_modify_internal() does this with a == NULL: 5827 a->a_flags |= SLAP_ATTR_IXADD; jeffreyc(a)ucsc.edu writes: > To guarantee the removal of an attribute when I don't know if the attribute > exists already or not I often employ the following LDIF: > > ============== > dn: cn=config > changeType: modify > replace: attrToDelete > attrToDelete: dummy > - > delete: attrToDelete > ============== You can use this instead: dn: cn=config changeType: modify replace: attrToDelete - -- Hallvard

1 0

Re: (ITS#6763) slapd does not clear sr_entry/ctrls on sizelimit/busy
by h.b.furuseth＠usit.uio.no 23 Oct '11

23 Oct '11

I wrote: > slap_send_search_entry() does not always free/release the entry and > call slap_cleanup_play() on error. > > slap_send_search_reference() calls slap_cleanup_play(), but does not > always free/release the entry. > > I expect both functions always should do both, but don't know enough > myself to be sure. > > Resolution needed for ITS#6758 (SlapReply) - who should be responsible > for clearing out the entry? Nobody else were picking this up, and it was making back-monitor hang in ITS#7053. So I've made result.c always clean up. The code is still inconsistent: slap_send_search_entry() may flush the entry either before or after slap_cleanup_play(), while slap_send_search_reference() always flushes first. If anyone feels that should be regularized, feel free. I'm leaving it alone for now. -- Hallvard

1 0

Re: (ITS#7053) back-monitor blocks
by h.b.furuseth＠usit.uio.no 23 Oct '11

23 Oct '11

Fixed in master, dup of ITS#6763. Thank you for the simple test case. The '-z 10' identified the problem. slap_send_search_entry() did not call rs_flush_entry() when sizeLimitExceeded. I have not traced exactly what happened, but I expect this means some back-monitor entry kept its locks. -- Hallvard

1 0

Re: (ITS#7053) back-monitor blocks
by michael＠stroeder.com 22 Oct '11

22 Oct '11

This is still an issue also in HEAD.

1 0

Re: (ITS#7053) back-monitor blocks
by michael＠stroeder.com 22 Oct '11

22 Oct '11

But just for the records... Finally I managed to reproduce this with OpenLDAP's ldapsearch command-line tool. The bound entity needs read access to cn=monitor. Try this more than one time: ldapsearch -x -H ldapi://%2Ftmp%2Fopenldap-socket -b "cn=monitor" -z 10 -s one "(objectClass=*)" cn objectclass Do this as many times as you have threads configured and slapd becomes completely unresponsive and has to be stopped by kill -9. This was tested on my local install under openSUSE 11.4 but also on an installation running on HP-UX (64 bit build). Both running 2.4.26. Ciao, Michael.

1 0

Re: (ITS#7070) test058-syncrepl-asymmetric failed for hdb
by quanah＠zimbra.com 21 Oct '11

21 Oct '11

--On Friday, October 21, 2011 6:34 PM +0000 michael(a)stroeder.com wrote: > hyc(a)symas.com wrote: >> There's no evidence of an OpenLDAP bug here. All we can see from the >> testrun/slapd.1.log is that it took 15 seconds for slap_sasl_init to >> complete, which was long enough for the initial startup check to time >> out. You need to check your system to see why SASL took so long to >> initialize, most likely a DNS failure or some other transient issue. > > Hmm, this was with a local build of cyrus-sasl 2.1.25 which seg faulted on > GSSAPI in another test. I will retry with cyrus-sasl package shipped with > openSUSE 11.4. There was a patch posted to the cyrus-sasl list the other day for issues with the gssapi plugin in 2.1.25. It's working fine for me once it is fixed up. quanah@zre-ldap001:~/p4/main/ThirdParty/cyrus-sasl/patches$ cat gssapi.patch --- cyrus-sasl-2.1.25/plugins/gssapi.c.orig 2011-10-07 14:47:07.461866240 -0700 +++ cyrus-sasl-2.1.25/plugins/gssapi.c 2011-10-07 14:47:45.891872589 -0700 @@ -370,7 +370,7 @@ } if (output_token->value && output) { - unsigned char * p = (unsigned char *) text->encode_buf; + unsigned char * p; ret = _plug_buf_alloc(text->utils, &(text->encode_buf), @@ -384,6 +384,8 @@ return ret; } + p = (unsigned char *) text->encode_buf; + p[0] = (output_token->length>>24) & 0xFF; p[1] = (output_token->length>>16) & 0xFF; p[2] = (output_token->length>>8) & 0xFF; --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7070) test058-syncrepl-asymmetric failed for hdb
by michael＠stroeder.com 21 Oct '11

21 Oct '11

hyc(a)symas.com wrote: > There's no evidence of an OpenLDAP bug here. All we can see from the > testrun/slapd.1.log is that it took 15 seconds for slap_sasl_init to complete, > which was long enough for the initial startup check to time out. You need to > check your system to see why SASL took so long to initialize, most likely a > DNS failure or some other transient issue. Hmm, this was with a local build of cyrus-sasl 2.1.25 which seg faulted on GSSAPI in another test. I will retry with cyrus-sasl package shipped with openSUSE 11.4. Ciao, Michael.

1 0

Re: (ITS#7069) test061-syncreplication-initiation failed for hdb
by hyc＠symas.com 21 Oct '11

21 Oct '11

michael(a)stroeder.com wrote: > Full_Name: Michael Ströder > Version: HEAD (from git) > OS: openSUSE 11.4 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (84.163.45.214) > > >>>>>> test061-syncreplication-initiation failed for hdb > (exit 255) > make[2]: *** [hdb-mod] Error 255 > make[2]: Leaving directory `/usr/src/michael/openldap/tests' > make[1]: *** [test] Error 2 > make[1]: Leaving directory `/usr/src/michael/openldap/tests' > make: *** [test] Error 2 Not enough info in your testrun directory, what was the output from the script up this point? From reading the slapd.?.log files, it also looks like something in your environment is slowing down the SASL init here, enough to make the script timeout. On all of my tests here the timestamp for slap_sasl_init is always identical to the preceding timestamp, i.e., slap_sasl_init should never even take as long as 1 second. Fix your environment before submitting any more bug reports. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7070) test058-syncrepl-asymmetric failed for hdb
by hyc＠symas.com 21 Oct '11

21 Oct '11

michael(a)stroeder.com wrote: > Full_Name: Michael Ströder > Version: HEAD (from git master) > OS: openSUSE 11.4 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (84.163.51.243) > > >>>>>> Starting test058-syncrepl-asymmetric for hdb... > running defines.sh > Initializing master configurations... > Initializing search configurations... > Starting central master slapd on TCP/IP port 9011... > Using ldapsearch to check that central master slapd is running... > Waiting 1 seconds for slapd to start... > Waiting 2 seconds for slapd to start... > Waiting 3 seconds for slapd to start... > Waiting 4 seconds for slapd to start... > Waiting 5 seconds for slapd to start... > ldapsearch failed (255)! >>>>>> test058-syncrepl-asymmetric failed for hdb > (exit 255) > make[2]: *** [hdb-mod] Error 255 > make[2]: Leaving directory `/usr/src/michael/openldap/tests' > make[1]: *** [test] Error 2 > make[1]: Leaving directory `/usr/src/michael/openldap/tests' > make: *** [test] Error 2 There's no evidence of an OpenLDAP bug here. All we can see from the testrun/slapd.1.log is that it took 15 seconds for slap_sasl_init to complete, which was long enough for the initial startup check to time out. You need to check your system to see why SASL took so long to initialize, most likely a DNS failure or some other transient issue. Closing this ITS. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7070) test058-syncrepl-asymmetric failed for hdb
by michael＠stroeder.com 21 Oct '11

21 Oct '11

See testrun/ here: http://www.stroeder.com/temp/openldap-its7070-testrun.tar.gz

1 0

(ITS#7070) test058-syncrepl-asymmetric failed for hdb
by michael＠stroeder.com 21 Oct '11

21 Oct '11

Full_Name: Michael Ströder Version: HEAD (from git master) OS: openSUSE 11.4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.163.51.243) >>>>> Starting test058-syncrepl-asymmetric for hdb... running defines.sh Initializing master configurations... Initializing search configurations... Starting central master slapd on TCP/IP port 9011... Using ldapsearch to check that central master slapd is running... Waiting 1 seconds for slapd to start... Waiting 2 seconds for slapd to start... Waiting 3 seconds for slapd to start... Waiting 4 seconds for slapd to start... Waiting 5 seconds for slapd to start... ldapsearch failed (255)! >>>>> test058-syncrepl-asymmetric failed for hdb (exit 255) make[2]: *** [hdb-mod] Error 255 make[2]: Leaving directory `/usr/src/michael/openldap/tests' make[1]: *** [test] Error 2 make[1]: Leaving directory `/usr/src/michael/openldap/tests' make: *** [test] Error 2

1 0

Re: (ITS#7067) openldap not properly starting
by Pierangelo Masarati 21 Oct '11

21 Oct '11

Current release is OpenLDAP 2.4.26. In any case, there is no clear indication in your report of a software bug. Please direct your message to the openldap-technical mailing list. p.

1 0

(ITS#7069)
by michael＠stroeder.com 21 Oct '11

21 Oct '11

See testrun/ here: http://www.stroeder.com/temp/openldap-its7069-testrun.tar.gz

1 0

(ITS#7069) test061-syncreplication-initiation failed for hdb
by michael＠stroeder.com 21 Oct '11

21 Oct '11

Full_Name: Michael Ströder Version: HEAD (from git) OS: openSUSE 11.4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.163.45.214) >>>>> test061-syncreplication-initiation failed for hdb (exit 255) make[2]: *** [hdb-mod] Error 255 make[2]: Leaving directory `/usr/src/michael/openldap/tests' make[1]: *** [test] Error 2 make[1]: Leaving directory `/usr/src/michael/openldap/tests' make: *** [test] Error 2

1 0

Re: (ITS#7042) [PATCH] allow unsetting of tls_* options for syncrepl
by pm＠datasphere.ch 20 Oct '11

20 Oct '11

--=-H9Xw5XBDhIDPupeYRJLz Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, I am the author of the patch at: ftp://ftp.openldap.org/incoming/jvcelak-20110912-syncrepl-allow-unsetting-o= f-tls-options.patch and I want to argue in favor of it: 1) In a configuration using a simple bind to authenticate a client, you have no choice but using ldaps to protect password sniffing: this requires a SERVER certificate only. 2) Since primary and replicated servers can have their role reversed (i.e.: after failure and/or recovery of the former primary server), the configurations should be kept as symmetric as possible (except for syncrepl) in order to speed-up switch: SSL in both servers should thus have the same configuration. 3) syncrepl then forces SSL to use a client certificate rather than a simple bind for authentication: this implies "normal" clients will also need a certificate... we are then in a situation lying very far from using ldaps for encryption only :-( 4) Using separate server and client certificates within a server, although safer, does not resolve my problem. For the above reason, I would really like to see my patch included in openldap code, or at least an equivalent solution. Because "third-party patch submissions cannot be accepted per our IPR policies. The original author is required to submit their own patches.", do you need me to re-submit it ? Thanks in advance for your reply. Regards, Patrick Monnerat DATASPHERE S.A. 16, chemin des Aulx CH-1228 Plan-les-Ouates (GE) --=-H9Xw5XBDhIDPupeYRJLz Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIH/DCCA9Mw ggK7oAMCAQICARQwDQYJKoZIhvcNAQEFBQAwgaIxCzAJBgNVBAYTAkNIMQ8wDQYDVQQIEwZHZW5l dmExGDAWBgNVBAcTD1BsYW4tbGVzLU91YXRlczEYMBYGA1UEChMPREFUQVNQSEVSRSBTLkEuMSQw IgYDVQQDExtEQVRBU1BIRVJFIG1haWwgc2VjdXJpdHkgQ0ExKDAmBgkqhkiG9w0BCQEWGWJ1cmVh dXRpcXVlQGRhdGFzcGhlcmUuY2gwHhcNMTEwODIzMTM1MzAwWhcNMTIxMjMxMjM1OTAwWjCBvDEL MAkGA1UEBhMCQ0gxDzANBgNVBAgTBkdlbmV2YTEYMBYGA1UEBxMPUGxhbi1sZXMtT3VhdGVzMRcw FQYDVQQKEw5EQVRBU1BIRVJFIFMuQTEZMBcGA1UEAxMQUGF0cmljayBNb25uZXJhdDEtMCsGCSqG SIb3DQEJARYecGF0cmljay5tb25uZXJhdEBkYXRhc3BoZXJlLmNoMR8wHQYJKoZIhvcNAQkBFhBw bUBkYXRhc3BoZXJlLmNoMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzpT/ufabbhCa1JFvX ZWLCDP8tPBxTilXjEFKAnNirdOc8Sj667iey7ypcgkA2QUZu+gHDSVD3iNRro2rQPdTzjnLCml5P Up+AOB48X5jUwVbxihmAvtM21KQGZZwcmGdlj6AgY/Vxci48CRn+DzW6lY+VYCtf7HWhNHih4G1Y IwIDAQABo3wwejAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBR79vf/tmNLu8XwC0nU02j0WQLCzjAL BgNVHQ8EBAMCA7gwKwYDVR0lBCQwIgYIKwYBBQUHAwQGCisGAQQBgjcCARUGCisGAQQBgjcCARYw EQYJYIZIAYb4QgEBBAQDAgSwMA0GCSqGSIb3DQEBBQUAA4IBAQA8gckFW7PMcfcFhZoVkI1ePP2f XQ1UM4tChxfuPmKYXb2VbM2bYn33MiKnswlzsH/gDvQawYFKvRCehE5JiPUa42kGd8jXNzU8sRnm uMHpjengOO3aLKZLAZRXS1dGjD9q3CQa/KDT31+ODWG7vztY8ZMBv008lb/eJvKt9ssm0cPTeKA9 /YenJzklzyY/MlNnW+zRce+3Ms4171wnrjKcA4J+Zyr0Ow1eEYzoIVEphT1WmybDPr0EJoueDUvH 9uz5cxRpxlIFY4jgTqhUQid/7uHrkaKU/OrADsOy2sGr4YpcvRpHseZZIA3Z8ovOHQ9J4WGviz9w Z6gcTLtQu6baMIIEITCCAwmgAwIBAgIBEzANBgkqhkiG9w0BAQUFADCBsDELMAkGA1UEBhMCQ0gx DzANBgNVBAgTBkdlbmV2YTEYMBYGA1UEBxMPUGxhbi1sZXMtT3VhdGVzMRgwFgYDVQQKEw9EQVRB U1BIRVJFIFMuQS4xMjAwBgNVBAMTKURBVEFTUEhFUkUgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhv cml0eSAyMSgwJgYJKoZIhvcNAQkBFhlidXJlYXV0aXF1ZUBkYXRhc3BoZXJlLmNoMB4XDTExMDgy MzEzNTEwMFoXDTMwMTIzMTIzNTkwMFowgaIxCzAJBgNVBAYTAkNIMQ8wDQYDVQQIEwZHZW5ldmEx GDAWBgNVBAcTD1BsYW4tbGVzLU91YXRlczEYMBYGA1UEChMPREFUQVNQSEVSRSBTLkEuMSQwIgYD VQQDExtEQVRBU1BIRVJFIG1haWwgc2VjdXJpdHkgQ0ExKDAmBgkqhkiG9w0BCQEWGWJ1cmVhdXRp cXVlQGRhdGFzcGhlcmUuY2gwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDTbQAxPu9L skt5ddMLzbS+bLQlW+gtcecHp9zL+x44dSXc663y6s+/XWxDbLZ0s+w6vp5CMB6pXxR5s8KfMDSC 22s7nq0t/BpQ1WfLkszG2JRs8BXIyrsDrFqYBBxcxiyyjzyQYVJg7qtPveUw9aQs53QCnZfXwG9s H2crPnAzoOzx5jptWvA5aHLMKqaZbGztUANABqZfZEwwGS/YG3nHxOKnl+UvmueJWiMs+plendlA 5+UBrUAk46/1IFNyjMqaBR8bug7IovHB9sn/k999eHVeBiu1qeTo0tcDEMvSBTh5JqIkl5lH7TU+ wgVCBA2/Eo1ccrvFkgTmztocbMczAgMBAAGjUjBQMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYE FFxbVp/ZdU5YlwvAFPbbFg+jGWehMAsGA1UdDwQEAwIBBjARBglghkgBhvhCAQEEBAMCAAcwDQYJ KoZIhvcNAQEFBQADggEBAH6oFynXqL8Tk6sA032VbJyibS8woHni0/ayhrcBdEORc/wvfmhEA2kK 9Yy4xEaprsxT0fFyBJ4YGYyXX4SkQdr0pRCDO/niL2woQmar5vq4v9xa2FgrWOh7jKcXuh/SMpGq WZzQQTvYY0+X7SXX1+Ioje7rqzEDWNmzpp+mtPr/ENVmIxwTGEtXbDDLJN48sTmBDnKrca2UJrfU EFDDHon9CBBg53u+JodQiJfSbraqwje1QrGCvOHkyBr3ulBmssePVQzPphON39pPgbJCoE7sd/WK UX02QIorkbdaA8K/S38Ggc1xN9kNDE5tuClAYJSZUHeDnROgz1QncevRdKMxggGuMIIBqgIBATCB qDCBojELMAkGA1UEBhMCQ0gxDzANBgNVBAgTBkdlbmV2YTEYMBYGA1UEBxMPUGxhbi1sZXMtT3Vh dGVzMRgwFgYDVQQKEw9EQVRBU1BIRVJFIFMuQS4xJDAiBgNVBAMTG0RBVEFTUEhFUkUgbWFpbCBz ZWN1cml0eSBDQTEoMCYGCSqGSIb3DQEJARYZYnVyZWF1dGlxdWVAZGF0YXNwaGVyZS5jaAIBFDAJ BgUrDgMCGgUAoF0wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTEx MDIwMTYxMjEwWjAjBgkqhkiG9w0BCQQxFgQU/0S6iq+obCv1FnngaSJRbdoGRygwDQYJKoZIhvcN AQEBBQAEgYBXOHzJGvDyRJTXk7jxmGjef5QY39Ziyodp0BIYwRukyAgQ273nzPxBga96lZog7obN 2qsnWxGi9RtGEyua27OacgUPOb9+vjX5/xb3DGol81GnBqOusj8ZrdNTa7i7lKmA+o7cFD3hM6o0 PLi3EqA3rsEgu65uGpWuuyS8rzeRFAAAAAAAAA== --=-H9Xw5XBDhIDPupeYRJLz--

1 0

Re: (ITS#7068) openldap connection issue
by sanjiv.singh＠impetus.co.in 20 Oct '11

20 Oct '11

--_000_23A2685ED8B30D46A90227113A1ECE0758F3EAA3Mail3impetuscoi_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable hi all, adding more details for debugging..... when i fire ldapadd utility with following ldif , it repeatedly throughing = following logs.... new.ldif ------------------------------------------------------ dn: cn=3DProcessor,dc=3Dmydomain,dc=3Dcom description: some description roleType: My Admin uniqueMember: uid=3Dmyadmin,dc=3Dmydomain,dc=3Dcom tenantId: Global cn: Processor objectClass: groupOfUniqueNames objectClass: top ------------------------------------------------------ /usr/local/bin/ldapadd -d 65535 -h 10.122.215.40 -p 6070 -x -w ***** -D "cn= =3DManager,dc=3Dmydomain,dc=3Dcom" -f new.ldif ------------------------------------------------------ ** ld 0x4185ad0 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x4185ad0 request count 1 (abandoned 0) ** ld 0x4185ad0 Response Queue: Empty ld 0x4185ad0 response count 0 ldap_chkResponseList ld 0x4185ad0 msgid 2 all 1 ldap_chkResponseList returns ld 0x4185ad0 NULL ldap_int_select ldap_result ld 0x4185ad0 msgid 2 wait4msg ld 0x4185ad0 msgid 2 (timeout 100000 usec) wait4msg continue ld 0x4185ad0 msgid 2 all 1 ** ld 0x4185ad0 Connections: * host: 10.122.215.40 port: 6070 (default) refcnt: 2 status: Connected last used: Thu Oct 20 08:42:30 2011 -------------------------------------------------------- Regards, Sanjiv Singh Software Engineer (iLabs) Impetus Infotech (India) Pvt. Ltd. D-40, Sector-59, Noida - 201307, UP | (M) +91-9990-447-339 | www.impetus.c= om<http://www.impetus.com/> ________________________________ New Impetus webcast on-demand 'Big Data Technologies for Social Media Analy= tics' available at http://bit.ly/nFdet0. Visit http://www.impetus.com to know more. Follow us on www.twitter.com/imp= etuscalling NOTE: This message may contain information that is confidential, proprietar= y, privileged or otherwise protected by law. The message is intended solely= for the named addressee. If received in error, please destroy and notify t= he sender. Any use of this email is prohibited when received in error. Impe= tus does not represent, warrant and/or guarantee, that the integrity of thi= s communication has been maintained nor that the communication is free of e= rrors, virus, interception or interference. --_000_23A2685ED8B30D46A90227113A1ECE0758F3EAA3Mail3impetuscoi_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <style>  </style> </head> <body lang=3D"EN-US" link=3D"blue" vlink=3D"purple"> <div class=3D"WordSection1"> hi all, adding more details for debugging.....   when i fire ldapadd utility with following ldif , it= repeatedly throughing following logs....   new.ldif ----------------------------------------------------= -- dn: cn=3DProcessor,dc=3Dmydomain,dc=3Dcom description: some description roleType: My Admin uniqueMember: uid=3Dmyadmin,dc=3Dmydomain,dc=3Dcom</= p> tenantId: Global cn: Processor objectClass: groupOfUniqueNames objectClass: top ----------------------------------------------------= --   /usr/local/bin/ldapadd -d 65535 -h 10.122.215.40 -p = 6070 -x -w ***** -D "cn=3DManager,dc=3Dmydomain,dc=3Dcom" -f new.= ldif ----------------------------------------------------= -- ** ld 0x4185ad0 Outstanding Requests: * msgid 2,  origid 2, status InProgress    outstanding referrals 0, parent count 0=   ld 0x4185ad0 request count 1 (abandoned 0)</p= > ** ld 0x4185ad0 Response Queue:    Empty   ld 0x4185ad0 response count 0 ldap_chkResponseList ld 0x4185ad0 msgid 2 all 1 ldap_chkResponseList returns ld 0x4185ad0 NULL ldap_int_select ldap_result ld 0x4185ad0 msgid 2 wait4msg ld 0x4185ad0 msgid 2 (timeout 100000 usec)<= /p> wait4msg continue ld 0x4185ad0 msgid 2 all 1 ** ld 0x4185ad0 Connections: * host: 10.122.215.40  port: 6070  (defaul= t)   refcnt: 2  status: Connected   last used: Thu Oct 20 08:42:30 2011 ----------------------------------------------------= ----   Regards, Sanjiv Singh Software Engineer (iLabs)</s= pan> Impetus Infotech (India) = Pvt. Ltd. D-40, Sector-59, Noida - 201= 307, UP |  (M) +91-9990-447-339 | <a href=3D"http://www.impetus.com/" title=3D"http://www.impetus.com">www.impetus.com</a>&nb= sp;     </div> <hr> New Impetus webcast on-demand ‘Big Data Technologies for Social Media= Analytics’ available at http://bit.ly/nFdet0. Visit http://www.impetus.com to know more. Follow us on www.twitter.com/imp= etuscalling NOTE: This message may contain information that is confidential, proprietar= y, privileged or otherwise protected by law. The message is intended solely= for the named addressee. If received in error, please destroy and notify t= he sender. Any use of this email is prohibited when received in error. Impetus does not represent, warrant = and/or guarantee, that the integrity of this communication has been maintai= ned nor that the communication is free of errors, virus, interception or in= terference. </body> </html> --_000_23A2685ED8B30D46A90227113A1ECE0758F3EAA3Mail3impetuscoi_--

1 0

(ITS#7068) openldap connection issue
by sanjiv.is.on＠gmail.com 20 Oct '11

20 Oct '11

Full_Name: Sanjiv Singh Version: 2.4.20 OS: centOS 5.5 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (115.113.49.98) Hi all, I am facing openldap issue, facing problem during operation with openldap utilities. slapadd,ldapsearch and slapcat etc. I have installed & configure openldap 2.4.20 from source. enable debugging level -1(max debug level). here is my LDIF that i want to add to my ldap server. mydata.ldif ------------------------------------------------------ dn: cn=My Operator,dc=mydomain ,dc=com description: My Operator for managing job types roleType: Common tenantId: Global cn: My Operator objectClass: groupOfUniqueNames objectClass: top structuralObjectClass: groupOfUniqueNames entryUUID: 93385d1f-c9ec-4a1e-93fe-93f6cc58f759 creatorsName: cn=Manager,dc=mydomain,dc=com createTimestamp: 20110506070135Z entryCSN: 20110506070135.425379Z#000000#000#000000 modifiersName: cn=Manager,dc=mydomain,dc=com modifyTimestamp: 20110506070135Z ------------------------------------------------------- when I tried to fire slapadd ldap utility. following utility hand for infinite time. i had set max debug level( -d -1) for finding root cause. $ /usr/local/sbin/slapadd -v -d -1 -c -l mydata.ldif -f /usr/local/etc/openldap/slapd.conf -------------------------------------------------------- slapadd startup: initiated. backend_startup_one: starting "dc=mydomain,dc=com" bdb_db_open: "dc=mydomain,dc=com" bdb_db_open: database "dc=mydomain,dc=com": unclean shutdown detected; attempting recovery. bdb_db_open: database "dc=mydomain,dc=com": dbenv_open(/var/lib/ldap). bdb_monitor_db_open: monitoring disabled; configure monitor database to enable => str2entry: "dn: cn=SMGOperator,dc=mydomain,dc=com description: SMG Operator for managing job types roleType: Common tenantId: Global cn: SMGOperator objectClass: groupOfUniqueNames objectClass: top structuralObjectClass: groupOfUniqueNames entryUUID: 93385d1f-c9ec-4a1e-93fe-93f6cc58f759 creatorsName: cn=Manager,dc=mydomain,dc=com createTimestamp: 20110506070135Z entryCSN: 20110506070135.425379Z#000000#000#000000 modifiersName: cn=Manager,dc=mydomain,dc=com modifyTimestamp: 20110506070135Z " >>> dnPrettyNormal: <cn=SMGOperator,dc=mydomain,dc=com> <<< dnPrettyNormal: <cn=SMGOperator,dc=mydomain,dc=com>, <cn=smgoperator,dc=mydomain,dc=com> >>> dnPretty: <cn=Manager,dc=mydomain,dc=com> <<< dnPretty: <cn=Manager,dc=mydomain,dc=com> >>> dnNormalize: <cn=Manager,dc=mydomain,dc=com> <<< dnNormalize: <cn=manager,dc=mydomain,dc=com> >>> dnPretty: <cn=Manager,dc=mydomain,dc=com> <<< dnPretty: <cn=Manager,dc=mydomain,dc=com> >>> dnNormalize: <cn=Manager,dc=mydomain,dc=com> <<< dnNormalize: <cn=manager,dc=mydomain,dc=com> <= str2entry(cn=My Operator,dc=mydomain,dc=com) -> 0xb5e5be8 oc_check_required entry (cn=My Operator,dc=mydomain,dc=com), objectClass "groupOfUniqueNames" oc_check_allowed type "description" oc_check_allowed type "roleType" oc_check_allowed type "tenantId" oc_check_allowed type "cn" oc_check_allowed type "objectClass" oc_check_allowed type "structuralObjectClass" oc_check_allowed type "entryUUID" oc_check_allowed type "creatorsName" oc_check_allowed type "createTimestamp" oc_check_allowed type "entryCSN" oc_check_allowed type "modifiersName" oc_check_allowed type "modifyTimestamp" => bdb_tool_entry_put( -1, "cn=My Operator,dc=mydomain,dc=com" ) => bdb_dn2id("dc=mydomain,dc=com") <= bdb_dn2id: got id=0x1 => bdb_dn2id("cn=myoperator,dc=mydomain,dc=com") ------------------------------------------------------------ and even after enabling -q option , it completes but ldap server would not be able to start. (-q : enable quick [fewer integrity checks mode] Does fewer consistency checks on the input data, and no consistency checks when writing the database. Improves the load time but if any errors or interruptions occur the resulting database will be unusable.) $ /usr/local/sbin/slapadd -v -d -1 -q -c -l mydata.ldif -f /usr/local/etc/openldap/slapd.conf ------------------------------------------------------------- slapadd startup: initiated. backend_startup_one: starting "dc=dmbsso,dc=com" bdb_db_open: "dc=dmbsso,dc=com" bdb_db_open: database "dc=dmbsso,dc=com": unclean shutdown detected; attempting recovery. bdb_db_open: database "dc=dmbsso,dc=com": dbenv_open(/var/lib/ldap). bdb(dc=dmbsso,dc=com): recovery requires transaction support bdb_db_open: database "dc=dmbsso,dc=com" cannot be recovered, err 22. Restore from backup! ====> bdb_cache_release_all backend_startup_one (type=bdb, suffix="dc=dmbsso,dc=com"): bi_db_open failed! (22) slap_startup failed. -------------------------------------------------------------- even I am face with ldap utility slapcat, after firing it hanged up for infinite. It seems , there are some problem with ldif file, but this ldif file works well on other hosts (having same schema and molules and ldap configuration). We are facing this issue intermittently on some hosts, works well on some hosts(all are CentOS 5.5). is there some wrong in my understanding? Am I missing some thing in my configuration ? Is anyboby able to find root cause ? Eagerly waiting for your response. I can provide more like ldap log , ldap configuration (if that can help in debugging the issue) We are passing through very critical time. Regards, Sanjiv Singh Software Engineer (iLabs) Impetus Infotech (India) Pvt. Ltd. D-40, Sector-59, Noida - 201307, UP | (M) +91-9990-447-339 | www.impetus.com

1 0

(ITS#7067) openldap not properly starting
by sanjiv.is.on＠gmail.com 20 Oct '11

20 Oct '11

Full_Name: Sanjiv Singh Version: 2.4.20 OS: centOS 5.5 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (115.113.49.98) Hi all, I am facing openldap issue, facing problem during operation with openldap utilities. slapadd,ldapsearch and slapcat etc. I have installed & configure openldap 2.4.20 from source. enable debugginf level -1(max debug level). here is my LDIF that i want to add to my ldap server. mydata.ldif ------------------------------------------------------ dn: cn=My Operator,dc=mydomain ,dc=com description: My Operator for managing job types roleType: Common tenantId: Global cn: My Operator objectClass: groupOfUniqueNames objectClass: top structuralObjectClass: groupOfUniqueNames entryUUID: 93385d1f-c9ec-4a1e-93fe-93f6cc58f759 creatorsName: cn=Manager,dc=mydomain,dc=com createTimestamp: 20110506070135Z entryCSN: 20110506070135.425379Z#000000#000#000000 modifiersName: cn=Manager,dc=mydomain,dc=com modifyTimestamp: 20110506070135Z ------------------------------------------------------- when I tried to fire slapadd ldap utility. following utility hand for infinite time. i had set max debug level( -d -1) for finding root cause. $ /usr/local/sbin/slapadd -v -d -1 -c -l mydata.ldif -f /usr/local/etc/openldap/slapd.conf -------------------------------------------------------- slapadd startup: initiated. backend_startup_one: starting "dc=mydomain,dc=com" bdb_db_open: "dc=mydomain,dc=com" bdb_db_open: database "dc=mydomain,dc=com": unclean shutdown detected; attempting recovery. bdb_db_open: database "dc=mydomain,dc=com": dbenv_open(/var/lib/ldap). bdb_monitor_db_open: monitoring disabled; configure monitor database to enable => str2entry: "dn: cn=SMGOperator,dc=mydomain,dc=com description: SMG Operator for managing job types roleType: Common tenantId: Global cn: SMGOperator objectClass: groupOfUniqueNames objectClass: top structuralObjectClass: groupOfUniqueNames entryUUID: 93385d1f-c9ec-4a1e-93fe-93f6cc58f759 creatorsName: cn=Manager,dc=mydomain,dc=com createTimestamp: 20110506070135Z entryCSN: 20110506070135.425379Z#000000#000#000000 modifiersName: cn=Manager,dc=mydomain,dc=com modifyTimestamp: 20110506070135Z " >>> dnPrettyNormal: <cn=SMGOperator,dc=mydomain,dc=com> <<< dnPrettyNormal: <cn=SMGOperator,dc=mydomain,dc=com>, <cn=smgoperator,dc=mydomain,dc=com> >>> dnPretty: <cn=Manager,dc=mydomain,dc=com> <<< dnPretty: <cn=Manager,dc=mydomain,dc=com> >>> dnNormalize: <cn=Manager,dc=mydomain,dc=com> <<< dnNormalize: <cn=manager,dc=mydomain,dc=com> >>> dnPretty: <cn=Manager,dc=mydomain,dc=com> <<< dnPretty: <cn=Manager,dc=mydomain,dc=com> >>> dnNormalize: <cn=Manager,dc=mydomain,dc=com> <<< dnNormalize: <cn=manager,dc=mydomain,dc=com> <= str2entry(cn=My Operator,dc=mydomain,dc=com) -> 0xb5e5be8 oc_check_required entry (cn=My Operator,dc=mydomain,dc=com), objectClass "groupOfUniqueNames" oc_check_allowed type "description" oc_check_allowed type "roleType" oc_check_allowed type "tenantId" oc_check_allowed type "cn" oc_check_allowed type "objectClass" oc_check_allowed type "structuralObjectClass" oc_check_allowed type "entryUUID" oc_check_allowed type "creatorsName" oc_check_allowed type "createTimestamp" oc_check_allowed type "entryCSN" oc_check_allowed type "modifiersName" oc_check_allowed type "modifyTimestamp" => bdb_tool_entry_put( -1, "cn=My Operator,dc=mydomain,dc=com" ) => bdb_dn2id("dc=mydomain,dc=com") <= bdb_dn2id: got id=0x1 => bdb_dn2id("cn=myoperator,dc=mydomain,dc=com") ------------------------------------------------------------ and even after enabling -q option , it completes but ldap server would not be able to start. (-q : enable quick [fewer integrity checks mode] Does fewer consistency checks on the input data, and no consistency checks when writing the database. Improves the load time but if any errors or interruptions occur the resulting database will be unusable.) $ /usr/local/sbin/slapadd -v -d -1 -q -c -l mydata.ldif -f /usr/local/etc/openldap/slapd.conf ------------------------------------------------------------- slapadd startup: initiated. backend_startup_one: starting "dc=dmbsso,dc=com" bdb_db_open: "dc=dmbsso,dc=com" bdb_db_open: database "dc=dmbsso,dc=com": unclean shutdown detected; attempting recovery. bdb_db_open: database "dc=dmbsso,dc=com": dbenv_open(/var/lib/ldap). bdb(dc=dmbsso,dc=com): recovery requires transaction support bdb_db_open: database "dc=dmbsso,dc=com" cannot be recovered, err 22. Restore from backup! ====> bdb_cache_release_all backend_startup_one (type=bdb, suffix="dc=dmbsso,dc=com"): bi_db_open failed! (22) slap_startup failed. -------------------------------------------------------------- even I am face with ldap utility slapcat, after firing it hanged up for infinite. It seems , there are some problem with ldif file, but this ldif file works well on other hosts (having same schema and molules and ldap configuration). We are facing this issue intermittently on some hosts, works well on some hosts(all are CentOS 5.5). is there some wrong in my understanding? Am I missing some thing in my configuration ? Is anyboby able to find root cause ? Eagerly waiting for your response. I can provide more like ldap log , ldap configuration (if that can help in debugging the issue) We are passing through very critical time. Regards, Sanjiv Singh Software Engineer (iLabs) Impetus Infotech (India) Pvt. Ltd. D-40, Sector-59, Noida - 201307, UP | (M) +91-9990-447-339 | www.impetus.com

1 0

Re: (ITS#6987) cn=config renumbers indexes on startup without modrdn-ing them
by ondrej.kuznik＠acision.com 19 Oct '11

19 Oct '11

On 07/07/2011 03:26 PM, ondrej.kuznik(a)acision.com wrote: > ftp://ftp.openldap.org/incoming/ondrej-kuznik-20110707.c > has an example of such overlay. To try it, initialize the overlay and > add these entries: > > dn: olcTestAttrOne=zero,$OVERLAY_DN > objectclass: olcTestOne > > dn: olcTestAttrTwo=one,$OVERLAY_DN > objectclass: olcTestTwo > > dn: olcTestAttrOne=two,$OVERLAY_DN > objectclass: olcTestOne > > dn: olcTestAttrTwo=three,$OVERLAY_DN > objectclass: olcTestTwo > > After a restart compare the output of slapcat -n0 with the output of > ldapsearch -b cn=config, you should see at least one different entry. > You might also try to modify the entries before and after the restart. > For those that do not match you get "no such object" as the dn is no > longer in the ldif database. The issue is in bconfig.c:4726, the code treats all siblings as part of one ordering (contrary to what http://highlandsun.com/hyc/drafts/draft-chu-ldap-xordered-xx.html implies since cn=config seems to treat everything as X-ORDERED 'SIBLINGS'), while back-ldif orders them accordingly. Also its caller (config_ldif_resp) does not expect any reordering to be necessary, after all it should be (and is) reading a valid cn=config db, so the entry renaming then never gets propagated to back-ldif causing this desync. -- Ondrej Kuznik This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

1 0

(ITS#7066) ACL added to back-config only active after restart
by rhafer＠suse.de 18 Oct '11

18 Oct '11

Full_Name: Ralf Haferkamp Version: RE24, master OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (89.166.171.158) The first ACL added to "olcDatabase={0}config,cn=config" does only get active after slapd is restarted. This is because slapd upon startup creates a hardcoded deny-everything ACL when no ACL is defined explicitly for the database. ACLs added after slapd is started will be appended to that hardcoded ACL (but never evaluated as the hardcoded one already matches everything). I am working on a fix, reworking the way how the hardcoded default ACL for olcDatabase={0}config,cn=config is applied.

1 0

(ITS#7065) changeType: modify "replace/delete" trick causes segmentation fault in cn=config
by jeffreyc＠ucsc.edu 17 Oct '11

17 Oct '11

Full_Name: Jeffrey Crawford Version: 2.4.26 OS: FreeBSD 8.2 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (169.233.224.28) To guarantee the removal of an attribute when I don't know if the attribute exists already or not I often employ the following LDIF: ============== dn: cn=config changeType: modify replace: attrToDelete attrToDelete: dummy - delete: attrToDelete ============== Howver every time I run the above against cn=config it causes a segmentation fault. It does not cause any problems with a hdb backends. I like to set up ldifs that i can run generically without having to know if content is there or not so I do use this. I can work around it by just separating the above out into two "dn" instructions. but if for example one wanted to remove Indexes, that intermediate update might cause some process to start then abruptly stop or not stop. The above failure is consistant, so hopefully easy to find.

1 0

(ITS#7064) moznss SEC_ERROR_BAD_SIGNATURE with a certificate trusted by OpenSSL
by massimo.gravino＠pd.infn.it 17 Oct '11

17 Oct '11

Full_Name: Massimo Gravino Version: 2.4.23-15 OS: Scientific Linux 6.1 URL: Submission from: (NULL) (192.84.143.111) We have an openldap server that uses LDAP over TLS/SSL and serves hundreds of clients. The CA used to sign the server certificate was created in 2005 with OpenSSL 0.9.7a. The CA self signed certificate and the server certificate have been used until now without any problem. In the server configuration (/etc/openldap/slapd.conf) we use TLSCertificateFile and TLSCertificateKeyFile to specify the path to the pem files of the certificate and private key of the server, and TLSCACertificateFile for the path to the pem file of the self signed certificate of the CA. In the client configuration (/etc/openldap/ldap.conf) we only define TLS_CACERT to specify the path to the pem file of the CA certificate. Now we are not able to use the the CA certificate on new Scientific Linux 6.1 clients with openldap 2.4.23-15: the problem appears with the standard openldap-2.4.23-15.el6 package that is compiled using MozNSS. If we recompile it using OpenSSL, the problem disappears (to recompile I simply edit the .spec file and omit -DHAVE_MOZNSS from the CFLAGS definition, change the --with-tls=no option to --with-tls=openssl and rebuild with rpmbuild -ba). This is the error obtained from the client with the original package when using ldapsearch: ldapsearch -x -d1 .... TLS: loaded CA certificate file /etc/openldap/cacerts/cacert.pem. TLS: certificate [CN=my.server.name,OU=Sezione di Padova,O=INFN,L=Padova,ST=Italia,C=IT] is not valid - error -8182:Unknown code ___f 10. TLS: error: connect - force handshake failure: errno 21 - moznss error -8182 TLS: can't connect: TLS error -8182:Unknown code ___f 10. ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) The problem appears to be related to our particular CA, that uses a DSA key. I've never been able to reproduce the problem creating new CA with an rsa key; however if possible I'd not change the the CA that signes my server certificate, because in this case I should change the CA certificate on a lot of clients. Nor I would manually recompile every new version of openldap packages. So I collected all the steps necessary to reproduce this problem on Scientific linux 6.1 server and client, with openldap 2.4.23-15 and openssl 1.0.0-10, hoping that the problem will be considered a bug in MozNSS. Certification Authority creation -------------------------------- mkdir CA cd CA/ mkdir certs crl newcerts private touch index.txt echo "01" > serial edit /etc/pki/tls/openssl.cnf and change the dir definition in [ CA_default ] to point to the CA/ directory openssl dsaparam -out dsaparam.pem 2048 openssl req -new -x509 -keyout private/cakey.pem -out cacert.pem -newkey dsa:dsaparam.pem -days 5000 Server certificate creation and signing --------------------------------------- openssl req -new -keyout key.pem -out req.pem -newkey rsa:2048 -nodes openssl ca -policy policy_anything -out cert.pem -in req.pem Now copy cert.pem and key.pem on the server, and cacert.pem on the server and the client (may be the same machine) and change appropriately the values of TLSCertificateFile, TLSCertificateKeyFile and TLSCACertificateFile in the server configuration, and TLS_CACERT in the client configuration. Start the server with /usr/sbin/slapd -h ldaps:/// -u ldap -d 1 Then on the client use: ldapsearch -x -d1 On the server side you should see something like this: TLS: loaded CA certificate file /etc/openldap/cacerts/cacert.pem. TLS: certificate [E=admin(a)my.domain,CN=server.fqdn,OU=Sezione di Padova,O=INFN,L=Padova ,ST=Italia,C=IT] is valid TLS: error: accept - force handshake failure: errno 21 - moznss error -12271 TLS: can't accept: TLS error -12271:Unknown code ___P 17. connection_read(11): TLS accept failure error=-1 id=1000, closing connection_close: conn=1000 sd=11 And on the client side: TLS: loaded CA certificate file /etc/openldap/cacerts/cacert.pem. TLS: certificate [E=admin(a)my.domain,CN=server.fqdn,OU=Sezione di Padova,O=INFN,L=Padova,ST=Italia,C=IT] is not valid - error -8182:Unknown code ___f 10. TLS: error: connect - force handshake failure: errno 21 - moznss error -8182 TLS: can't connect: TLS error -8182:Unknown code ___f 10. ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Note that server says: certificate is valid but SSL peer cannot verify it (moznss error -12271: SSL_ERROR_BAD_CERT_ALERT) On the other side the client says: certificate is not valid because has an invalid signature (moznss error -8182: SEC_ERROR_BAD_SIGNATURE) As I said above, the problem disappears recompiling openldap with OpenSSL instead of MozNSS.

1 0

Re: (ITS#6900) dnattr acl statement: users can produce dangling entries
by daniel＠pluta.biz 14 Oct '11

14 Oct '11

Hi Howard, as we've discussed during LDAPCon2011's get-together the following idea is currently not supported in slapd. For demonstration purposes I've introduced a <dnattrstyle> that only supports one style-descriptor called ".strict". It restricts "dnattr=..." ACL statements the way that self is not allowed to remove her own DN from dnattr. I've tested the patch with the following simple sample ACLs: to dn.base="ou=groups,dc=foo,dc=bar" attrs=children by users write to dn.onelevel="ou=groups,dc=foo,dc=bar" attrs=entry,@groupOfNames by dnattr.strict=owner write by users read According these two ACLs a group's owner is allowed to write the whole object (not only add, but also delete, aka in sum "write"). Nevertheless, because of the ".strict" the owner is not able to delete his own DN from the owner attribute. You can find an updated version of my patch here: ftp://ftp.openldap.org/incoming/Daniel-Pluta-111014.patch As it is still intended for demonstration purposes, the patch is highly probable suboptimal regarding its implementation, in particular regarding the chosen place within slapd's code. Instead of the <dnattrstyle> probably a new "<access>" called e.g. "writeToSelfButSelfNoDelete" or similar should be introduced instead. Unfortunately, I don't know how to code this correctly without changing/breaking the whole acl-engine and introducing various "funny" side-effects. Best regards Daniel P.S. Furthermore, and although I've no related scenario in mind, it perhaps could make sense to generalize this kind of behaviour also into direction to "writeToSelfButSelfNoAdd" etc. I'm not sure whether this would make sense, too.

1 0

(ITS#7063) OpenLDAP don't provide some schema file in ldif format
by raphael.ouazana＠linagora.com 12 Oct '11

12 Oct '11

Full_Name: Raphael Ouazana Version: 2.4.26 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (213.41.232.151) Hi, Some schema files are missing from schema/ directory: collective.ldif corba.ldif duaconf.ldif java.ldif misc.ldif pmi.ldif ppolicy.ldif Regards, Raphaël Ouazana.

1 0

(ITS#7062) writes from lost connections not increasing contextCSN
by ebackes＠symas.com 11 Oct '11

11 Oct '11

Full_Name: Emily Backes Version: 2.4.26 OS: any URL: Submission from: (NULL) (75.244.124.114) If a client connects and writes, e.g. ADDs entries, then disconnects before seeing the result, the writes are stored in the database but do not increment contextCSN. This can be seen without replicas being involved, but obviously still needs syncprov. $ ldapadd -x -D dc=example,dc=com -w secret -H ldap://localhost:1389/ -f people.ldif adding new entry "cn=1,ou=people,dc=example,dc=com" adding new entry "cn=2,ou=people,dc=example,dc=com" ... adding new entry "cn=22,ou=people,dc=example,dc=com" ^C $ ldapsearch -x -D dc=example,dc=com -w secret -H ldap://localhost:1389/ -b dc=example,dc=com -LLL '(cn=22)' entryCSN dn: cn=22,ou=people,dc=example,dc=com entryCSN: 20111011235653.469937Z#000000#001#000000 $ ldapsearch -x -D dc=example,dc=com -w secret -H ldap://localhost:1389/ -b dc=example,dc=com -LLL -s base contextCSN dn: dc=example,dc=com contextCSN: 20111011235653.380889Z#000000#001#000000 stats+sync log: conn=1000 op=21 ADD dn="cn=21,ou=people,dc=example,dc=com" slap_queue_csn: queing 0x105e00100 20111011235653.380889Z#000000#001#000000 conn=1000 op=21 RESULT tag=105 err=0 text= slap_graduate_commit_csn: removing 0x10178e0a0 20111011235653.380889Z#000000#001#000000 conn=1000 op=22 ADD dn="cn=22,ou=people,dc=example,dc=com" slap_queue_csn: queing 0x105e00100 20111011235653.469937Z#000000#001#000000 slap_graduate_commit_csn: removing 0x10178e520 20111011235653.469937Z#000000#001#000000 conn=1000 fd=10 closed (connection lost) The change isn't sent out to connected refreshAndPersist replicas either, and forcing them to reconnect doesn't help, as their contextCSNs still match across the board. This can cause persistent desynchronization of servers.

1 0

Re: (ITS#6924) www.openldap.org and git.openldap.org serve different repositories
by ondra＠mistotebe.net 11 Oct '11

11 Oct '11

Note that openldap.git is not the only repository serving different history, e.g.: ---------------- 8< ---------------- $ git clone http://www.openldap.org/software/repo/openldap-jldap.git openldap-jldap.http $ cd openldap-jldap.http $ git log -1 commit 07fc2a4b6f20dfb3a171ee0fa4b66082358b8b53 Author: Nachiappan Palaniappan <npalani(a)openldap.org> Date: Mon Jul 6 08:43:38 2009 +0000 Updated version to 4.6. ---------------- 8< ---------------- Compare it to: ---------------- 8< ---------------- $ git clone git://git.openldap.org/openldap-jldap.git openldap-jldap.git $ cd openldap-jldap.git $ git log -1 commit bae9f556e97ad5bb0f76fe897c9b298a6021e244 Date: Mon Jul 6 08:43:38 2009 +0000 Updated version to 4.6. ---------------- 8< ---------------- Cheers, Ondrej Kuznik

1 0

(ITS#7061) Only return requested attrs in sssvlv response
by ctcard＠hotmail.com 11 Oct '11

11 Oct '11

Full_Name: Chris Card Version: 2.4.26 + patch OS: Centos 5.4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (91.194.158.133) There was a fix put into master on 18 Jul 2011 with subject "Only return requested attrs in sssvlv response" SHA: 8eecc9a017584ea0b56b25f0e4750e3b16929de6. I have patched openldap 2.4.26 with all the fixes to sssvlv.c, but there is still an issue with the attributes returned in an sssvlv response. On the first sssvlv request only the requested attributes are returned, but on subsequent sssvlv requests using the vlv context returned by the first requests, all the attributes are returned.

1 0

(ITS#7060) Bad compare results with back-sock (and I suspect back-shell)
by maurice＠perry.ch 09 Oct '11

09 Oct '11

Full_Name: Maurice Perry Version: 2.4.26 OS: Linux (debian) URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (160.53.250.126) The result code returned for the COMPARE operation with back-sock. The problem is due to a bug (two actually) in function str2result in servers/slapd/result.c: while ( isspace( (unsigned char) next[ 0 ] ) ) next++; if ( next[ 0 ] != '\0' ) { Debug( LDAP_DEBUG_ANY, "str2result (%s) extra cruft after value\n", s, 0, 0 ); rc = -1; continue; } /* FIXME: what if it's larger that max int? */ *code = (int)retcode; The code is not set properly if the code is not the last line of the result. I corrected the issue as follows: while ( isspace( (unsigned char) next[ 0 ] ) && next[ 0 ] != '\n' ) next++; if ( next[ 0 ] != '\0' && next[ 0 ] != '\n' ) { Debug( LDAP_DEBUG_ANY, "str2result (%s) extra cruft after value\n", s, 0, 0 ); rc = -1; continue; } /* FIXME: what if it's larger that max int? */ *code = (int)retcode;

1 0

(ITS#7059) UTF8StringNormalize will overrun a zero-length value
by hyc＠OpenLDAP.org 06 Oct '11

06 Oct '11

Full_Name: Howard Chu Version: 2.4.x OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (76.94.188.8) Submitted by: hyc According to the commit history this bug has been present since 2003-04-07 (commit 67d6b23d). A patch is in git master, but I'm continuing to investigate and will update it further.

1 0

Re: (ITS#6979) test062 portability
by richton＠nbcs.rutgers.edu 04 Oct '11

04 Oct '11

On Fri, 30 Sep 2011, Hallvard B Furuseth wrote: > I'm curious, what is this about - an observed bug, or not? There is > no function call here, 'wait' is checking a subprocess's exit status. > That's standard, and so is checking the return (not exit) status from > a function as far as I know, but I'm not surprised if some shells have > quirks. At the time I actually saw this on Solaris /bin/sh. I'll hopefully pull down a fresh copy and re-examine in a few days (I'm a bit backlogged at the moment trying to cram things in before I head to LDAPCon).

1 0

(ITS#7055) pwcheck Module for slapo-ppolicy
by lukas.graesslin＠collax.com 01 Oct '11

01 Oct '11

Full_Name: Lukas Grässlin Version: Latest Git OS: Arch Linux URL: http://dl.dropbox.com/u/32193848/src/0001-Added-pwcheck-module-for-the-slap… Submission from: (NULL) (88.67.244.45) Hi there, I wrote a new pwcheck module for the slapo-ppolicy overlay which is able to handle multiple different policies. My problem was: I have multiple password policies which are applied to different users. The policies differ in strength etc. The problem was that with the only pwcheck modul you can find on the net (https://ltb-project.org/svn/openldap-ppolicy-check-password/trunk/) you just define one 'policy-thing' which will be checked if check-password.so is run. I wanted to have something were you also can define multiple policies which also can differ, so I wrote my own module which reads two config files: $CONFDIR/ppolicies: There are the policies defined. Example: [Default] min_len = 8 min_digit = 1 min_lower = 1 min_special = 1 min_upper = 1 $CONFDIR/users: These file holds the relation between users and policies: uid=lukas,ou=People,dc=example,dc=com : Default Well, it would have been nicer if that policy definition & co would also be stored in ldap, but the config-file-way was the faster one as it had to be finished quick. Whatever, maybe some of you could need this or improve it.

1 0

RE: (ITS#7051) ldap_pvt_tls_get_peer_dn fails under gnutls
by Giampaolo＠Tomassoni.biz 30 Sep '11

30 Sep '11

> > This is the needed patch: > > This patch should not work either, you still need a skip_tag before the > get_int. > > > - tag = ber_skip_tag( ber,&len ); /* Context + > Constructed > > (version) */ > > + tag = ber_peek_tag( ber,&len ); /* Context + > Constructed I confirm this patch worked for me, at least it did on an amd64 I'm working on. It worked both with openssl-generated v1 (no version tag present) and v3 certificates (version tag present). I don't know if this is an cpu-architecture -dependent issue (I don't think so), nor I know how the ber_* library works, but FWICU the Context + Constructed stuff is handled as a tag prefix by the ber_get_int(), which then discards it when found and fetches the encapsulated value. Instead, ber_peek_tag() is probably more simple-minded in that it peeks the first word at the buffer pointer, which is the Context + Constructed prefix, not really the tag. I can of course be wrong, but with this patch I got i==2 from v3 certificates, which is the correct value. Giampaolo

1 0

Re: (ITS#6979) test062 portability
by h.b.furuseth＠usit.uio.no 30 Sep '11

30 Sep '11

Aaron Richton writes: > It looks like checking the function exit isn't portable; maybe some > kind of bash-ism. It looks like the code was on the path to > communicating the retval via $RCOUT file already? I'm curious, what is this about - an observed bug, or not? There is no function call here, 'wait' is checking a subprocess's exit status. That's standard, and so is checking the return (not exit) status from a function as far as I know, but I'm not surprised if some shells have quirks. I noticed because I saw the patch entering master. Which is fine by me, except the patch may be a bit incomplete. Since $SEARCHRC is now the output from `cat`, it may be best to quote it here: > if test $SEARCHRC != 52 ; then -- Hallvard

1 0

Re: (ITS#7006) openldap does not accept wildcard certificates with mozilla/nss
by hyc＠symas.com 30 Sep '11

30 Sep '11

hash_oldap(a)cycdolphin.net wrote: > Full_Name: Philippe Kueck > Version: 2.4.23 / 2.4.26 > OS: RHEL 6.1 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (82.98.65.86) > > > When compiled against Mozilla/NSS OpenLDAP does not accept wildcard > certificates. > > This is probably because in tls_m.c the certificate CN (*.domain.example) is > matched against the hostname (foo.domain.example), not against the domain > (.domain.example). > > I suggest the following patch: Thanks for the report, fixed in master. > > --%snip%-- > diff -Nru openldap-2.4.26-orig/libraries/libldap/tls_m.c > openldap-2.4.26/libraries/libldap/tls_m.c > --- openldap-2.4.26-orig/libraries/libldap/tls_m.c 2011-06-30 17:13:36.000000000 > +0200 > +++ openldap-2.4.26/libraries/libldap/tls_m.c 2011-08-01 16:29:42.000000000 > +0200 > @@ -2590,7 +2590,7 @@ > if ( av->len == nlen&& !strncasecmp( name, (char *)av->data, nlen )) { > ret = LDAP_SUCCESS; > } else if ( av->data[0] == '*'&& av->data[1] == '.'&& > - domain&& dlen == av->len - 1&& !strncasecmp( name, > + domain&& dlen == av->len - 1&& !strncasecmp( domain, > (char *)(av->data+1), dlen )) { > ret = LDAP_SUCCESS; > } else { > --%snip%-- > > > Kind regards, > > Philippe Kueck > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7011) signal 6 got in ldap_abandon
by hyc＠symas.com 30 Sep '11

30 Sep '11

ogermain(a)tibco.com wrote: > Full_Name: Olivier GERMAIN > Version: 2.4.24 > OS: Solaris 5.10 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (212.157.248.2) > > > Dear All, > > One of our customer got a signal 6 during the execution of the ldap_abandon. > This signal occurred whereas some maintenance was doing on a firewall which is > not located on the same network. It seems that the ldap_abandon thrown this > assert because it was a situation like a can't happen. I don't have much > information on the action performed on the firewall which led to this sigabort. > > > Please find the logs I have : > 2011-07-19 04:08:52.876909|ENG|FATAL|84|engine.cpp(109)| > /appl/kabira/MIPSPLUS-1.5.1-110510-SOL64/kis/distrib/kabira/lib/libsyssrv.so:sw_debugSignalHandler+0x18 > 2011-07-19 04:08:52.877541|ENG|FATAL|84|engine.cpp(109)| > /lib/sparcv9/libc.so.1:<static-func>+0x5b0 > 2011-07-19 04:08:52.878082|ENG|FATAL|84|engine.cpp(109)| > /lib/sparcv9/libc.so.1:<static-func>+0x628 > 2011-07-19 04:08:52.878658|ENG|FATAL|84|engine.cpp(109)| > /lib/sparcv9/libc.so.1:_lwp_kill+0x8 [ Signal 6 (SIGABRT) ] > 2011-07-19 04:08:52.879196|ENG|FATAL|84|engine.cpp(109)| > /lib/sparcv9/libc.so.1:abort+0xd0 > 2011-07-19 04:08:52.879733|ENG|FATAL|84|engine.cpp(109)| > /lib/sparcv9/libc.so.1:_assert+0x74 > 2011-07-19 04:08:52.880325|ENG|FATAL|84|engine.cpp(109)| > /appl/kabira/MIPSPLUS-1.5.1-110510-SOL64/kis/3rdparty/sol/openldap/2.4.24_64/lib/libldap-2.4.so.2.6.0:<static-func>+0x4ec > 2011-07-19 04:08:52.880776|ENG|FATAL|84|engine.cpp(109)| > /appl/kabira/MIPSPLUS-1.5.1-110510-SOL64/kis/3rdparty/sol/openldap/2.4.24_64/lib/libldap-2.4.so.2.6.0:ldap_abandon+0xac > > I am in the process of a reproduction of this signal 6 but I would like to share > the following idea. > > Do you think there is a possibility to enhance the openldap library to avoid > this assert? Is it possible that instead of having an assert, we have a > exception or a status code which tell us something went wrong of obviously that > we can handle in our source code. An assert means there is a bug, either in your code or ours. Since this part of the library has been around for several years with no issues, that generally means it's a bug in your code. The way to handle this is to fix your code. Trapping or ignoring the conditions that are asserted is just a bad idea. > > My best regards > Olivier GERMAIN > TIBCO Support team > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7040) Out of sync consumer replicas after standby master takes over (MMR)
by Howard Chu 30 Sep '11

30 Sep '11

Thanks for the report. Now fixed in master.

1 0

Re: (ITS#7037) slapd crashes with syncrepl when replica cleared out DB
by hyc＠symas.com 30 Sep '11

30 Sep '11

ml+openldap(a)esmtp.org wrote: > Full_Name: Claus Assmann > Version: 2.4.26 > OS: Red Hat Enterprise Linux Server release 5.5 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (63.211.143.38) > > > While trying to determine how syncrepl behaves in various error > conditions, I encountered a crash of slapd. A MASTER is set up to > use push replication to a REPLICA as follows: > > database ldap > hidden on > suffix "" > rootdn "cn=slapd-ldap" > uri ldap://REPLICA/ > lastmod on > restrict all > sync_use_subentry true > > acl-bind bindmethod=simple > binddn="cn=Monitor" > credentials=password > > syncrepl rid=001 > provider=ldapi://%2Fvar%2Frun%2Fldapi > binddn="cn=Manager" > bindmethod=simple > credentials=passwd > searchbase="" > type=refreshAndPersist > retry="5 5 60 +" > > Reproduce: > On REPLICA: stop slapd, clear out directory for DB, start > slapd. > On MASTER: > add an entry master which has to be "synced" to REPLICA; > run ldapsearch to lookup up that entry on MASTER > slapd dumps core, backtrace: Thanks for the report. There were two bugs here: 1) the syncrepl_add_glue_ancestors was not constructing a valid DN for the empty-suffix case. 2) it shouldn't have tried to add glue entries in this case anyway, since the underlying DB was pulled out from under it. Both fixed now in master, please test. > #0 0x00002b7e51344265 in raise () from /lib64/libc.so.6 > #1 0x00002b7e51345d10 in abort () from /lib64/libc.so.6 > #2 0x00002b7e5133d6e6 in __assert_fail () from /lib64/libc.so.6 > #3 0x0000000000549546 in ldap_add_ext (ld=0xbba1bc0, dn=0x0, attrs=0xbeb7ed0, > sctrls=0x0, cctrls=0x0, msgidp=0x435224c4) at add.c:126 > #4 0x00000000004dbe6d in ldap_back_add (op=0x43523150, rs=0x43522770) > at add.c:102 > #5 0x0000000000481152 in overlay_op_walk (op=0x43523150, rs=0x43522770, > which=op_add, oi=0xb9eb6c0, on=0x0) at backover.c:671 > #6 0x00000000004816a7 in over_op_func (op=0x43523150, rs=0x43522770, > which=op_add) at backover.c:723 > #7 0x0000000000473706 in syncrepl_add_glue_ancestors (op=0x43523150, > e=0x2b7e56628fb8) at syncrepl.c:3149 > #8 0x000000000047384e in syncrepl_add_glue (op=0x43523150, e=0x2b7e56628fb8) > at syncrepl.c:3193 > #9 0x0000000000474795 in syncrepl_entry (si=0xb9eb1c0, op=0x43523150, > entry=0x0, modlist=0x43523ca0, syncstate=<value optimized out>, > syncUUID=<value optimized out>, syncCSN=0xbeb86e0) at syncrepl.c:2448 > #10 0x000000000047c39b in do_syncrep2 (ctx=<value optimized out>, > arg=<value optimized out>) at syncrepl.c:982 > #11 do_syncrepl (ctx=<value optimized out>, arg=<value optimized out>) > at syncrepl.c:1489 > #12 0x000000000041eee3 in connection_read_thread (ctx=0x43523da0, > argv=<value optimized out>) at connection.c:1276 > #13 0x00000000005412dc in ldap_int_thread_pool_wrapper (xpool=0xb8fa1c0) > at tpool.c:685 > #14 0x00002b7e510ff73d in start_thread () from /lib64/libpthread.so.0 > #15 0x00002b7e513e84bd in clone () from /lib64/libc.so.6 > > Note: this also happens with 2.4.23. On a VM instance, it causes > a different error (see mail on list: "killed after 120 seconds") > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7051) ldap_pvt_tls_get_peer_dn fails under gnutls
by hyc＠symas.com 30 Sep '11

30 Sep '11

giampaolo(a)tomassoni.biz wrote: > Full_Name: Giampaolo Tomassoni > Version: 2.4.24 > OS: Linux 2.6.39-gentoo-r3 > URL: > Submission from: (NULL) (79.23.61.128) > > > A triky mistake (is it a typo?) in libraries/libldap/tls_g.c:tlsg_x509_cert_dn > prevents a gnutls-enabled server to correctly obtain the "subject" ASN.1 tree > from the client's certificate. Thanks for the report, now fixed in master, please test. > > This is the needed patch: This patch should not work either, you still need a skip_tag before the get_int. > --- libraries/libldap/tls_g.c.wrong 2011-09-25 14:58:30.000000000 +0200 > +++ libraries/libldap/tls_g.c 2011-09-25 14:35:06.000000000 +0200 > @@ -530,7 +530,7 @@ > ber_init2( ber, cert, LBER_USE_DER ); > tag = ber_skip_tag( ber,&len ); /* Sequence */ > tag = ber_skip_tag( ber,&len ); /* Sequence */ > - tag = ber_skip_tag( ber,&len ); /* Context + Constructed > (version) */ > + tag = ber_peek_tag( ber,&len ); /* Context + Constructed > (version) */ > if ( tag == 0xa0 ) /* Version is optional */ > tag = ber_get_int( ber,&i ); /* Int: Version */ > tag = ber_skip_tag( ber,&len ); /* Int: Serial (can be longer > than ber_int_t) */ > > > Basically, the optional version field in the certificate wasn't peeked, but > rather skipped. This resulted in walking in the certificate tree in the wrong > way, thereby impairing a correct result from > libraries/libldap/tls2.c:ldap_pvt_tls_get_peer_dn. > > I'm not using sasl, so I can't be sure about this, but I guess this problem > could impair client authentication via certificate using the sasl external > method. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7052) Spurious CSNs being recorded on syncrepl consumers.
by hyc＠symas.com 30 Sep '11

30 Sep '11

cmikk(a)qwest.net wrote: > Full_Name: Chris Mikkelson > Version: 2.4.26 > OS: FreeBSD > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (204.147.85.37) > > > When the provider sends a search response with state 'delete' with no / null > cookie, the syncrepl consumer queues an locally-generated CSN and updates its > context CSN with that. This appears to happen only with cookie-less deletion, > not with cookie-less modification. I have not observed a cookie-less addition, > so I do not know if it occurs there, too. Thanks for the report. The bug only affected Deletes, not add or modify. Fixed in master. > Example logs from a pure consumer (no server-id, replicating from a provider > with server id 002): > > Sep 26 13:05:42 mpls-auth-02 slapd[57295]: do_syncrep2: rid=100 cookie= > Sep 26 13:05:42 mpls-auth-02 slapd[57295]: syncrepl_entry: rid=100 > LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_DELETE) > Sep 26 13:05:42 mpls-auth-02 slapd[57295]: syncrepl_entry: rid=100 be_search > (0) > Sep 26 13:05:42 mpls-auth-02 slapd[57295]: syncrepl_entry: rid=100 > uid=<snip>,ou=improv,dc=qwest,dc=net > Sep 26 13:05:42 mpls-auth-02 slapd[57295]: slap_queue_csn: queing 0x7ffffe3fa560 > 20110926130542.130924Z#000000#000#000000 > Sep 26 13:05:42 mpls-auth-02 slapd[57295]: slap_graduate_commit_csn: removing > 0x8f58a8a90 20110926130542.130924Z#000000#000#000000 > > This is problematic at our site because the provider cookie contains a SID 0 CSN > from before we migrated to multimaster, and the SID 0 CSN recorded at the > consumer renders the consumer state newer than the provider, breaking > replication. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7054) Please drop support to FreeBSD 1.x
by d＠delphij.net 28 Sep '11

28 Sep '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi, Kurt, On 09/28/11 18:26, Kurt Zeilenga wrote: > Given the project doesn't specifically attempt to support FreeBSD > 1.x, your request as summarized in the subject line is a bit odd. > > I suggest this be considered more of a request to enable future > support of the FreeBSD 10.x. > > Do the current release of libtool and autotools includes the > enabling features needed? > > If so, then this can simply be treated as a request to update these > tools (which are generally incorporated without any functional > change). > > If not, well, then we should just wait for thsoe enabling changes > to be released by the upstream tool provider first I think we will have to wait for upstream release then, the changes are already in their source tree. I'll patch OpenLDAP in the FreeBSD ports to make it work at this moment. > Regards, Kurt > > On Sep 28, 2011, at 2:38 PM, delphij(a)FreeBSD.org wrote: > >> Full_Name: Xin Li Version: git trunk OS: FreeBSD/amd64 10.1 URL: >> http://pastebin.com/G8gpJs0r Submission from: (NULL) >> (206.40.55.65) >> >> >> Code duplicated from GNU libtool and autotools uses 'freebsd1*' >> rather than 'freebsd1.*' to test if the system is FreeBSD 1.x. >> This logic would match FreeBSD 10.0, causing problem when >> building shared libraries. >> >> I'd like to propose that FreeBSD 1.x support be dropped since >> it's obsolete in 1994 (17 years ago). >> >> The patch is just for reference, it also drops FreeBSD 2.x and >> FreeBSD 3.x support but it's not complete. >> >> A libtool patched with git revision >> e94c6d6e0359d92f08f491f57e0ef3371e978952 would also be required >> to build OpenLDAP properly. >> > - -- Xin LI <delphij(a)delphij.net> https://www.delphij.net/ FreeBSD - The Power to Serve! Live free or die -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.18 (FreeBSD) iQEcBAEBCAAGBQJOg87cAAoJEATO+BI/yjfBfwIIAIjdABO2EUPVNpGLRrOqt20I Yl5reH+OsBBwRTgjdDflZJcRA68fb5nsdsrRBheJA6oT0EJKWpPoW+uLjg84zx6s TvGAifKMDJv6+v/PHpTkv2wO7nYIKXiS6D9415cJk3xMdEcDdRSXi+ppA+6IXGzV fRL4rej0hoHNvgbXvowOL8F24rnnb6+r9fYYH773rwomL/+rYqZ1+iDbM4zs82d4 TSxOtjmfoEqUCyYJii3jo5CGs1LQ+Ndk16s7uwTArevba89GPVrNL3s/FxBLrEX+ Q8mBHaCkmsX1JuN7ZkYTJz7UvMJJO25IHDfEpjkM5aCqZvuy9nq7kflXxvuOASo= =Wmav -----END PGP SIGNATURE-----

1 0

Re: (ITS#7054) Please drop support to FreeBSD 1.x
by hyc＠symas.com 28 Sep '11

28 Sep '11

delphij(a)FreeBSD.org wrote: > Full_Name: Xin Li > Version: git trunk > OS: FreeBSD/amd64 10.1 > URL: http://pastebin.com/G8gpJs0r > Submission from: (NULL) (206.40.55.65) > > > Code duplicated from GNU libtool and autotools uses 'freebsd1*' rather than > 'freebsd1.*' to test if the system is FreeBSD 1.x. This logic would match > FreeBSD 10.0, causing problem when building shared libraries. > > I'd like to propose that FreeBSD 1.x support be dropped since it's obsolete in > 1994 (17 years ago). Probably a good idea. Thanks for the patch, but it's basically unusable. Never submit patches to generated files. Only patch the source files. configure is generated from configure.in by autoconf. aclocal.m4 is also generated by autoconf; the section you patched appears to come from the libtool sources. > The patch is just for reference, it also drops FreeBSD 2.x and FreeBSD 3.x > support but it's not complete. > > A libtool patched with git revision e94c6d6e0359d92f08f491f57e0ef3371e978952 > would also be required to build OpenLDAP properly. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7054) Please drop support to FreeBSD 1.x
by Kurt＠OpenLDAP.org 28 Sep '11

28 Sep '11

Given the project doesn't specifically attempt to support FreeBSD 1.x, your request as summarized in the subject line is a bit odd. I suggest this be considered more of a request to enable future support of the FreeBSD 10.x. Do the current release of libtool and autotools includes the enabling features needed? If so, then this can simply be treated as a request to update these tools (which are generally incorporated without any functional change). If not, well, then we should just wait for thsoe enabling changes to be released by the upstream tool provider first Regards, Kurt On Sep 28, 2011, at 2:38 PM, delphij(a)FreeBSD.org wrote: > Full_Name: Xin Li > Version: git trunk > OS: FreeBSD/amd64 10.1 > URL: http://pastebin.com/G8gpJs0r > Submission from: (NULL) (206.40.55.65) > > > Code duplicated from GNU libtool and autotools uses 'freebsd1*' rather than > 'freebsd1.*' to test if the system is FreeBSD 1.x. This logic would match > FreeBSD 10.0, causing problem when building shared libraries. > > I'd like to propose that FreeBSD 1.x support be dropped since it's obsolete in > 1994 (17 years ago). > > The patch is just for reference, it also drops FreeBSD 2.x and FreeBSD 3.x > support but it's not complete. > > A libtool patched with git revision e94c6d6e0359d92f08f491f57e0ef3371e978952 > would also be required to build OpenLDAP properly. >

1 0

(ITS#7054) Please drop support to FreeBSD 1.x
by delphij＠FreeBSD.org 28 Sep '11

28 Sep '11

Full_Name: Xin Li Version: git trunk OS: FreeBSD/amd64 10.1 URL: http://pastebin.com/G8gpJs0r Submission from: (NULL) (206.40.55.65) Code duplicated from GNU libtool and autotools uses 'freebsd1*' rather than 'freebsd1.*' to test if the system is FreeBSD 1.x. This logic would match FreeBSD 10.0, causing problem when building shared libraries. I'd like to propose that FreeBSD 1.x support be dropped since it's obsolete in 1994 (17 years ago). The patch is just for reference, it also drops FreeBSD 2.x and FreeBSD 3.x support but it's not complete. A libtool patched with git revision e94c6d6e0359d92f08f491f57e0ef3371e978952 would also be required to build OpenLDAP properly.

1 0

Re: (ITS#7053) back-monitor blocks
by michael＠stroeder.com 28 Sep '11

28 Sep '11

This is a multi-part message in MIME format. --------------090005000205090404090605 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Find attached server log. --------------090005000205090404090605 Content-Type: application/x-bzip2; name="server.log.bz2" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="server.log.bz2" QlpoOTFBWSZTWTwLPKkE2Zr/gH/9IEl///////////////9iVF71Rvl9nr3gAAAAAAAAAPoA AAAAAAAAAAAAAAAAAAAuxoAjIDIAaKAAAAAACgAAAAAAAAAAUOzybVjrNtY1pZswszazbdsp KQFFVKOjLZNkAtW1o2tQthLaaIrRQ0pUkklCEszIQhtpJAKUAIdAC3BUNHkGjlQCjw6DKvvD 69SFMsa++b1ALuGFoAbY0m3vA9AFKooFRBUSi5SksABnu522pACFdxwHEiUJCwNoFBO4AzgF AAsC9wADugsgAqtAD1mwrbHS7OQpqTcyUTinYaOu6hSqKCqwdGN2ckO7hwOs6sNo1HXKQ65S KoIs6ZTpSbrh1VNZsBAuqLsUoa61p1Xcw6Yhoo7rHFIU60Bq67ihiXTACzdFzrlErXAODNg2 Z13a7AGTk65BcNEqTiDSLlJTRSi7cAACOmCDQCtal05KEumg1ha1oqpNZCoLtlcFQadjFzAY QoooABAqBtsE1JRlRbUK21RIrtgXBpgZQAVQUtYqCxgNSNFYKSgDrRIOIUqqNVQhAGSKQDRd jVA7aFrUUxuRV2l0BuzoDoQoDj3U4nLvd3cAAbve5r20B7Hruzl0Zmlpd3dDNg13YPQ9DvY0 udK46OlaPVsOgaY9JGPeWVD6NHVU+Pp6vAGHTu3W2c4+3d5z4pSim90KvdmLr0TZXtbVbY2V ZRzmFcjaMUaDaa8xgDk87OemqQAkBee8Tnku3eADd1e972Vt64AAAAAAAAAAAAAAAAAAAAAA AAAAAAAGw0Y9EKTx67u46go5WsS1VCTb2vADHnr3Zx1y6u6pXQO56AY2a3nBQKkIcbQVt7wA 7na1LNqloKewkoCB7N6dmqrsNDbNAKDQAMWkePAD3dlqlaBegAA6Y93dRJsx3ZS5hpStAM1g 1qtt3OXnAFroqpKA90IoqEgE4ykSigooMQXeADaklUoToemmjCI0ueAHsOr2DoLUhzPd3EgY 88AE9UB0EDvAPTqYnrwAZoDQx5UJL1p7bqkQNy9gAtA0Dw94BktsL75vn2XyqHc3buW7hkul M2yo41AzbeWT2B7sRU0tomYB443abXS1j06HsYrrV0728PTZBNrXTqBDYO7KaPcQ9a4nACAG l5tJ47bWyoZVtbKESu9vc4AID12wpjDd48FPFVHngAgODr3Z3Zw5Yd2bY2tlmY8c5HTDIY94 AIBnV7pG6yc00lb1JT3vAJjVZj2DBE94eDQAQHu9myVrsi647azWzmYqptl3vet5dnWYxw7n NLW2rYxLe8AEABu8rLVio1LQsnjzeiC8ZtZ2YilwhWS1tDvPdJVeEbRmm9ab1uHorKjt6rvW NYqqrSimQZa2zw97z1UZtgARsagpW200bSbb3ueqC9YU6cDhWUgpTJoaRe8PBLW2ariQok8s qqZOoig0UcJGtCkyjWxbG2b3u9S9K1oGxiJvcN2StngqkQAGSCAQaACAEAJppU8yU3pJvJT1 No9U8UeUbUxqeICqmmgEClBEampP0KZlP1J6j9TEnson6Keo9IANAAAAAAIp7KaJRpkGgGgA AyAAAAAAAAAAAAqakpEJCaTT1MTRk0U/VTwp6Dyk9E3lJ+og0Pap6m0hoaGgABiAKSkSCATE AIIaaEyZG0ip+1QmybUm01B7VDMofqmaNAAAKiQiEEEAgU9MhMmgIp+IZUHqYTQDTBGg0eoZ DQD5y/cwKzLKtCmZJ/MQziFGGshv/OyDcmSbQiMxEzJZa1VsrHXHGpmFFYv/7//L/7D/9//P 9v6Hv/4/9H38P/x+34Q9bfLb+nrkT9/v/pezFf5E/1v5eOP5dP8af6nfVcHHPDj/Jx0/xY7f yejyeOt7xVCPnv9xrNtqbbbVbRmrMWVjF/o+Eqfw/bz9j3ote57yxbbff7rena8vS742uurE QViCKws49OfzJ0rZvHjctiYskdawYsmVGTMieYZVus8P/x4j1+3h36/ej+Gkj9bHU/fD996Z SkSlEpenwPH21T8nc9+Q6x1Q9kS7eiFzl3ydsSoj680NkwWYQVnyCrjIjSD3eJJWECCpIKxk G71mr/HWI1fbWSMz/t9f8575jLGJPmP1hj+Xu3d8a/tnXf/qz383NvzieiTnr8EH7LHjwtfh U37Rt+02pjox6ZW/j3Kz/Tf6bPqE3cw/VJ/t3PJPr8y5rUe5P7OfH/dx6+fH0km4pVB/V/s1 OMi0VQj7Up8XKiCBY+yLz6P/bvR6eo+1/xf8icSsYsfX/Bi82Dm//qUE2D/2/xey1q2f+jc6 JNcHD/Q+Sj9TpsxZauUxV8E/BaJrX/r8XJa8OnRoyXNH49HIfZV/ey8sniaJuT/6Pl4vewuf +afxOg1f4v/Cx6HWjN/czsSeDiD2LE3Vw/yk8HqEnkvc4xXtngm+Er3+K5gMl1yTt8rGbo1U WknJMmxuVw80mLMX4rFBNNutZ9jF3wwfJc/NmMIubPcySaLnJ9Umah8h4OmbFak1Pvc17q5q MFrJieb/F/6rFq5NmqqseC13rkXr3k/3LnDJc8XxTf3v5qLn/NqxMHVc0UUXuF7vWLkljsWu 55PY9K56l6xm3Sav9j/e/3rFE2ax1eLo71jVzfB63azWvi8WDVYve5eo738Ha+r4M3sYuT/J ixau9qySYt3uXvgtP/N6XrfqWqPqm/3NU3c9TxXtl7tcmKrhso/yc2D1MVzyfB5rWSTZ/J8E 3ik/3Ob2sHV/sfB3sX6Pe0O5k0e8/3LHa1eLVa71zyaP6lz1PFN0aOw0c1zV9XD+bsPNwvSf V3vvf82D7WDNg82B+p+53PS5N0knyZvU7n1UdjBVk+CxY9K5g8nm9j4vSvYpsHoWtVySS98G a52vWxetuzaOrFHJmuXvxTYuFj3uxi70mbo8maqrBJYk4frdXc9j5vQfizXpOx9XwdXe2WNm 7dc8Vzvf3vi7Xgk5PN1f8VHR7Hsc3e5v7nmsSdHmxUfuelN1YL2D3rlj0ps1Hue5R7VqS9em 972PF3qL3DhNk5tHuc0lrFcXtWr1r3N8U3oauTm8my1swSdzN0WKJpLkXrXwdq16F7tSdirN 0YsWLtaHyXt2zV6EnakWPW3fF71Xgq3XujwcPBcxVbsmLJi4drBewcOGq1avav1LGL/i6PSv fB8HC53t2LmyVZPBwyfe+iq5g+J0dHpMHyebd2OxidWbk3bt017oozebxdjB3KMli9JwxTcL 3mwMHydX2LWLokk73Y9a19Gq9o5vg/BVu2as2T6Po2dz5qvS5NHkzeKx3NmCr6OxwwaJPm+D 3urQubvm6Jv7HN6FVHNkuYpptn2Oq1yfR61ruUXvc1fRawXPkqqsN2bBY/k+15MHrd7wYsWD sdFq0momm/F5PQ8n3Mlr0PS83wWL32psFjR0fsfauSavBgtex6WLBikuet73R+jF1dHVRuzW uHV1dVi91TYLHVzc3Nck1dWC11cMWDFJc6urydjZcyXObkxWujNNw7iTsWODNem1aJtTk8W7 FgvbKMGa5J+DxWr30SbPk3exe0eCa1w3aN2jkktXr1i5mm0WP1uxeteh2Or6OTB5vg7XJ5OH /u5vsfR0dHzdjZ4LXe7Wp9GL1Ox/uel2PW+T0NnueL7nkokudzm8navWvamsSWLE3yeCjRmu drF6VrN7Ulq9esXPJNyWPa6r1r2va8HtdrB63c7XJ7XD2ub2vQ7na2dj5MGS1yc3N4rF73ps Fjvepw5rkmr3sFr5PFiwYpLne5vNw9i1qbtkcmSxm+5+DFokteb1M2L2Ll7q2dGbo7Hc6Pc9 TBcmxXsXg3fFg/WvdjVydp3oyaprV73JLHRMwXLHYuJvQtWOwtc372qx2L0yxs1bJM3ek3Yv Syfi+CTRyWpGbVasf1pKNHsYPWuXtXpZKN3JkWuxJe7lqq1E0nNuzWrUmzho4YOq90WL1yjq 5ujN5PBi1dxu3d6aOTNzTfJ7WbN+xo6LXc6vB1druRJFGT+CxY5nCTyLU1q9ck5M3a8FrZ4L WT/M7Hxc3R/J61FhVq2av2PJ4sGBNN0dq5wveTmq7FjZetXv+LN7Xi+bZNi5MSabBgmsXvuT UXo972vg+K9mqwfmxd7q3VVVYrmBo7HwTfF0dHYq6tmq1Vi7WY7nJ4mDRco5NVE2ZmmuTexJ Nu+S9YzSZsVr2rk1WKb2LDFu7VHa9LqwYE03go1UfJ2NH3KslHisXsHpfRq9CSjZm0KLnzth KVUKv6EO3+VZ/jaZSYepKvHyZJrF7VJM5ptWLyWvFqf1smDJwsYKOGrteSa4vSXsmzxWvWq2 aLWT0OG7Rc2TYub4sHgvZtXuWM3qPQ7Vpa5tljsLX2Oa5g7U30YpJsWSbkk6Or+jmvcmaxqm 1djJu5KNjR3pGLuZvBm5MWSjtc2L+jRwxdjq/c/W6prW50TfV0f1NX2KNGTZ+1k/WtXLnN3J PuYM3m97welk3e1kqsbpOxe/c+L7lj7HR3PtUXMzZso5ub+x+Ddi+1i73ucnm/m6sn5vxelz fe/ck7HtUZur+x5MXpfyeh1ZvY9DN5ObtetzOx5Js16TtZMk3yVWsHrel5JP4MnDtfo4Zs3u e1w9qi9k8XitWtlHxSex6Wj0MHyUeD5OTF5ObZkovdH83C5Ykm+jzXvFovXujxcnqPk9L1sX ze91WKurqo4TXLklXe8mbBNzdi9g7EnV2PmyYJNl7ye57FzZkmze15Mm78newWsmSw0c3eve hzfYxYuxJkyZMmT6r1zR+Do8Vr3PQteTR1ZJKpPc8XavaJPF4vN/Y5Oxg7GL2PB4MHgse9Yf qSbsXY96xzYr2TVi5PxTTc3a7HauXPN+D4OjyZPc/oksZO1g9bk9C1JzbMnDsYOiTJg3eL5v wXqvo4XOH4vyYP0XvSzauT970quHiycJMnc816x6Xc6LnDuZPNJizXs2DZg0VfmzUeL6vQo8 nJRcwbskni+5s3UftYPgxfg+Lwdzm/a+T6uGhR2KtVixzbNzZ9GLJm/F6nwfV7Xk6ppsGL5N lHofi3USYMWb6vizXvYkmweT802ThceL3PJcvSdXxYpO9gwXsGSbd2vkkuWpNF7V+arNw71G bJ2M3c7n1YPgoyehgsYux8X4vUyXt2D2NVy5q1arGC5eSWL3pfNo0bsntYvkm1e5quatUzq7 FrV1XFzF+b5N3DR+TNR+18mrd/Ume5oYLHYydjN6Hsd7teLRo0ZO9N3MmD9jh8l5azVc165a 0TWPJs2fRquf0YL1j4MVpyfgmq8E2Ddqkqmm3VfwdFFz/m72DtfFq2YJvq+98VWL71zZ8GbJ RMsaPU9rzdX4sHc7k2rZ974PBcq1TKOqa19Ey15rXmtavFq7lr8E1r2vY9z1NHgmksWMnJNN a7U3a1TXLj2JNlzVecnqXPU9TwaPuYpvBNNR4rUj8Xwe1ewe1JNyeD4KO5a8mDq8E3m8nsfJ i2djm8Ga11TaNF7d5sHpXnNJY/emm735PotWvQq4VWrnsTTeDtTWO13Or9H1fFgYtWr5rlzR c/asdjwTXLna9y18E3ybPkxXuqabq+qaxRM9a55LFV6a1m/J9G77l57GDxfBa5JPe+pNs4TO Hi8W60vatFix4Jl73rXRaom/msTYJrnkyWLFqZkyWsFqOT7knmuUTXMiq5Y+TqsfBY9C5a5M lXe6pvg+Dq/W0aN3kmf0fc0WPckqzdH63udx4r3ixPuVTWqJm7yZO1e6uqb6v1Pk9zsavcm7 3Yetmvfsd6xs/a5rXC5NN1fNkue5M7nxe1kvavY9LFa6JnD4LVjdNNo9qTVq7XYwfByZLHJM 5MWSx4pujzMXmvXP5PvWLn4ppvtdyxY7kzuetNatTLXtWurtTTYurBa6pnV3psHvTP2ME1ya bucnc3e96lz72DF2JJs3oUfY4et8GD6JMniq3ZMX6L2C5I+99HD4LV76PY97ksbvS/ewYuxu ydGb80nrYMXkmexzfN+TowXt27dzebm6sGLqvYOHD7WzJkyfBiseTd+55Pi3ZsHxSXGr2PW+ qj6s1HNq8Wj0tnNNR2KsnNc/W+T5LFzvYOTV5M3CT+jteTuXsGKR7mL7kma5yTXvQzdr1sFz RkxSVe973qehcxTZNVr+CS1c+CRu+L8l69cvWPQvdX3rGzF/0ZMWKT8G6q5ydrucmzwdz2vU yNliqb4pJrXV4uxc9Thw9r1LVx5urd/JiVYpuH4ubxc3i6PSxZsHoVZJvW5pv5rmbB83JNY9 y5yfYyWOF6Tq9i5/B5tVj3sX6Oj4ObFi8mTxZM0lH2Oj7WLFYvYJMD9aS5Jo/co6MXtUd72O 18XDwSYr1Xg8EnwfBgzfJgyeC10LFr/4WOGrudrBgfRe/Jo/BRewSaMVj3uxo6uS53u9c5rG bq8U31UUfck2Veb0O16Wz7nV6nzYKOaThkydVFr3P639jvXu9g+ar+pzeDyfJgydzkyfk5PY 7Wq9RmWrH8Gy12vk81q9szdjVc9r1P2NVrxYvq6sV65w+Lk3VSc3mm9DvfqfiwebwbvUteh4 uHi+DB+ix3uix7lj4u9edyib1v1JsH6nrWOrwfVm+x6mTA9LVN4Jv2rFrqXsHgeD9r+b2M3Y yf1vN5KNF7V6nvdHJ6H5ubFuc17hJ9rF6V7Z4vkkwcJPa8GLzeK1i2fmvan0dX1bt1ztSfe4 auHa7lH5Pa+L5Pcyfg/W7XzZve9bkiqq9+15u15veYslyb1vJ2tTZ7H5vQzZHsYvQ9z0pMlr 9Hzfi+DNo+xycNkjxYMGDBgvfRw/io5vwZvixaJOST5Jub0u90dz97vfk+Lo+49T6rXJwkwa tH1XNF6TZ83a6O9J6H3PuYvQzXvU+jFmzbMGbNNe8WbwScLl7m+i5Ji2SbNmzJszTWvqzet2 KM2TEydrVqzZs2bNmzM2a9Nm2e98GzFyTeT0M1VU1VVWZRVmetJm+b9bsZs2btMmJ72b0ua1 9yTzZs0aOxJYsR9j7HyWPkqVdyx7Hi3XpObkyXPmwfY7XYycMWjNu8XgueJJ1fR7X9TJ8Hc6 MmTm9bh9zq831fm1ZNEnV8XvYvJ1el6mL1Pse5yPU9KbZ0TWuTscnmm7FzF+Tm5va0dxyatE 1Gb1P0btX630avezep7nrel1fF5sHN3Oir9H2tH2ux7XyZtHJyTXOGiajse1e9r2va7lGibF g3SPq9Tvc2SjmxYuaT7Hk9rdYtfY7U3uUfY9jVe+r1MXC99z4vvcmrB9j0vvfR4NFVVVWbye 9ydrhw9b1rXzeCbuSTaNUmruXLlr4r276uH6PJ5vueLN8GzRe8Xi9i57Ung8Hg8GrZ5va2fF q6v0ex9j2NHk8HtSdH4uxi2et7GjF7n72zJ9z7WyPW/J0SaPNkm9z1vvZJpJPN5vN5ub8F71 JtVr6vq/U+DV+byeL4vF3Pk7XzULna9L9GryYuxJJ0fa+aw+LV7Vjmkm5Jsj8nYyWsUnuWvx d612Or0Po8WC9s9rvfi8X8H6ntdVzd4tHa6pv1KuT4MH9iTxWsEeTJ+1m9Dtd65gueh5JvB6 nJ61GD9HvSPwaL32vNeyfcve18ntd70LnofammwcPgvdXpfexWrF5usbvUsSUebZ8HNkbLXc 0bNGSaZsmtYP6OZezZOjB9GajyeTJ83VRsk9Dm+bBa2es7lj80lz0PQootXOSbF9Hvepe2dy aT0sEne3ea1g/Y9TyZN3YzYP0SXqsFyx+TmtfBw0bsknVgtex4ur2PaqzZPJ9ijySfY2e173 DEkq9Dom6LGbq6rThu1cPBs5PQ8n9Gzd9Xk5rXxSVLE1Vj+Ka52rVjqUUfJ6WarJg7Hmk0dU mrV3lVz1qu5N+p4LkntfJe3bPczbsXRqsdzAkyZLCbJg3fguYKvFJ4rW7M8G7dJJJoo73pfB ezVe9ctPFcm8Hi9bRRJJe/YovbsmC98WrBJ2OFibB2Lk1qjBswdHaq2fYuVWqNUmbZJmoYv1 pMHCRibvB2JuT1vxcMnDhmxSOEknJ+axa8lrycLna7HY4TetN6nYwfxTfcsJt3Yxea5NI6tk 3oeDosRR+16HJa5Nk2Sha9rJe+1g6u5Yxfm1ebB+STZk/qZObVa7GDwdqa9ydr2O96V7NmyX LWyT97+DF0dqr7XmxXsXsatXydiTm/JY72C11e91bvY9abk5vW4c44SiEEDFi7lpJcyTep6n DqtcLk3edz9r2LH7km7Jwmmmm8GDwaLUnDVJuzWrkfV5MG7sTMGD5LGi92JuTIksaGySaRNJ g2clixzTOax4OEn5rF7DiDiGn+FZKx/9GEroVQ9QQ/UqhpMdKrT8GGNJXGP3K/c2xSp+apN7 Ukz9Gbo7lp8XzWO99zBVs/i5JPFg/Bm7nJi2ZrmKS9FiSTNNc838Xm0avBe8X/w2asFE3oTW N1z2L03mkq+r2tij2r02KxLKXhKV1WEv1bWU/khZ/gbf6CX+p6uwvLmibsWPsWMWTmuL0nky ZvNeSLkWkj9a1+1aeS1ck9To9LJ/ctVPakycnY0Zs03kk1YnmvbvJNN6nYxMUi5JkdU3RY7D Vm7lzwYOxm0XvQ6L170psEmiTFIkko9LvWLlXxdrhatSTe42TSfudxaWPgxWMmb4pPU5r2rV cxR8E1qw80jk9Ca1RYm2Wl6SSxosWKLnpfB9WLNYsYtXobJsVzxaP4MH26JII8//FH3yhiet H0N3ySSSeL0vekXvmvYLFixgWEi5NVa+CS1aQQf8slp/kbSQ2/xMJWYePFnZw8VQqw4qqhp2 lVKrBpZlSWV1VmGi6WG2XS7CDaF2XjiXGGFlWHa7s8PKV2bR0hiT2U6ahxJ/6Jp2ExuDb017 G2QmMVs9Pg93G1R7KPUMlP5/VPVmHb5V84rVVdDpDtc2wgyuq6cXdpeLqU6P3q6U/q7On3yq DwoX7em3zDtlC6H4ohTp/ub/70RmZ4w/U4/RSx2lch2w/HDS6UNGlm2FP1PVGTLphD8Qq7Xd FnbjTSWXaqmHS6qjDTJZYwpVTamBDTtpTTCyEtLIdIUuS6Q/ZtxDZ+NtukqrtNWq5qzXL17I xLDxj27vtXfb/5dLIhrL4nk8ipKFj3Tmf63Fu1zO8YuW1iXKxlyc047CsWWqofloXkmVRZCz ++hKzDDC6VlzKXrCUIQ/RhKGBCyVX8WRCyWEP51lWVyzipKFOMtMrKQyqShpZplUwu/k2P9b 5SjtTbS6CqUtqUs/vIfCFLvEKqvnjKzbLtU8fIJScYIaQldtdL5Bp4w6YSo7CqxCjoqyuo8d LpPW3ZDZUhUwlCpR6bUsptplhU4pKEulHrKX4Uv0osWH0PH55njyz56MsHXjTZhTDlna/bZU ptdVpCUuMMMLtNIQ9Us6SSTp9T5Nq7aSlcSJ7IVXTHuhcqshYdqcXQVYcfNO0qQaWbQps2pl VthSzKVVVUrqsGVl1TKChJTsy4uuUulTXiFElXHhlldtTw+HhxJDRtR09IlKT4bekUwwu7Lo ZaZYVQqhllDLAp3JRc02ltZtpSmGqUywqwyeOMMLJTWjxLLOmUiEOLtqYZZWNsOG0KtoQlhU spZCFLOKLLsvGnG2EIZIZyqhZh6LJXKizB26SsksSs02qwLtKZXWUpTjBd4VccWbaXUZUUlJ RxVtQQKSQG3iW1NsvDKVllktO1lm0ujTaEIKXcdKNtLqbZWJdIbU6LOiplVchTClSqVVLoZY VbMvUtsIVWLPFUNrmwqoypKyy7pCpxD54udoVQ28S7eOkLnTj16wwYYQphVx4pTp64oWdELJ YYcQl022WdIEJWWdrrHilLNoMpSs2YUwyq8YbJQltKllksGGEoGBoy2yeOiHjxlSh05KzDp0 Qy7LIaXWFF1KeMLNsqrroUU00lpTDx2oYPG0odOMJdOMPELO0lSCCqXbClSHjRtZpLSFTazL i7C7K7CriHiGFLOkCiCjxVto2pCmkJSslCrCCyUMruPWXi5SVIFzRphZ06cYUudu3rJpxo42 w0qsuuevXbijhDtVpVlJLbbb1k807MquENuMG21zjC7LSHikKUsupVhLBDZBV2wldxp0y2hS rtxttCVKUltCwq4uk7WdrPGVkpYdtrNsLIZZZerOJLruJetulUPG221UO1jUsssrquMssvD5 Zp226ZVadNrrqujayrCGUnaG11WmSFV21l11KqtJVXVMsqcSsssS7aabZVXWYcfKWOlUKcNp MnTSVKcUwp02ZdONHxLbKzTK6NNKcNMIXdujJJZKxxKzbl2VElJVOIXbXVVbWXWXeO220qQl hVtZLAWO0tPEOIQdqQaZWYUsqeGHSFkIbVWQpwg7Q42lAwcWcdvHSWSDZhxVpldSXjLaSy7o l4lgw0qyQsyg0hZlpVh2hLiXbbAdsGSzxVl2hVV40pKqEMMpXNOyrTx402Q7adPFnF3GWUsu mWWlBZY6SuZaSycVaaWQy2s4qpZCWlS7iztg8eKVbdpWSbduO0rT09MU91bVVcV4bPZxUONI dJdNLJYYeLuLmXRhDjizKzxVlZtDjSzCWVkPHrDpdp27SaeLLLMjwdKoWQZUKYYLqXZSu2Wa UlSDtdpiqGChh6us2s0hddxdC7TKzKlLLMNLXZUMqkqvEMMKdGirCo2qyl2sZIcZGi5csq0o plBY4hhDaF1lmilNtoWadJS7aS2hhtIw2w4lpl4ll64ucQul6k6erOIUqhKqztxRk08Sy0VW SEqoVSp4hp6sphtlS6ElVULrMNLkHjKTtCVztlhdpIghKjtRVhtZZZVlxdZVpohdSqrDDS6k MmV1Ulll3zpZZhBh49YcOimEOOll0KtqqoQSPSmEtKIaXVoq8SpdYbdOIduINtNsMOl1mlSz KyskLrIdIPV3G1XSktJSlY7LuJdIZbcVdsNHGHHakquiykmiq7xLQyw043dCW0NHjbSqG2XE speOKrOJXVaS0p84wQ9bJF1MJeumClyGV3EKqocOm2EKrsIYQlxgeMmSG2WDS6VUIOlSpK6B h4cYNJYXetGXjSWW0NGFlPFTCrdV0KoXWJNpaUuYZWQgQhZKyDxdZcy7ZWLskJdLpMrLksvF 0rqmjjLiVWFUqdoWQ8ZuspDTjxtdtLK5DLK6rayErOKqvFnFPtqtNsoOklnayy7b1DJdphgs lVVxV2eMtMLkNIMoeqLLrKU4upDBKnbTKpYaXLJMqadpWZWIWSWYLKZZaYZaaaNIZcZerKoN vCGEu1VXSx07aOi5CVy7ip20ldx46djjbtVVC6FnGOlh0ghd4ph44kcVKs0gpVtCGnbRhDCr CFWmTtx4w46Q2qguhpDptVKrCGRDppZ48YSwy0lxVKDjaniHSrxlxZxpldhtKFl1XFnr0eLl irKrqziyy7CrayGULLJeKWXcVMtOlzjhw0syqlVZVLh2pLjTiVVXqEsJLKrulToXQ6Uss9YV OMssLJWOnRVZxhZpejCHTammGEJSuwhKxZVphKkqumG0PHFmTKFVRdTpdTQ8Wdu1m1lmFXr1 dtCzD127XcWcWVIQhhdZlV6QsNMkuLNrqqlm2nbLjjK7DqDDpVTirSWl2V0IKl2FFUNNLJSx t44kss6Qq4ulpKxDil0vUMM19hk228bLKWZd4dpS040usqu9VYSlLxV2YUyllTLJt6sslZ0q phC7SrtTtVDxpxs4w0wqpKW1LNLNKtuJVfNtull1mV1XSG0MMIdOkqUq7ZbQ27cYplVDi6qG FVkLqQq9baXQu7QbQ4zp2u0qqhU2lDtLo2pc02hV20Qsyhtwhpxcq0hd06Uw424Shxhk04hC HEJcYNNMssqumFlVVWlmCzKyVnzCkqRRt08VYWQhdlhKG2yyXTaWFjJVdSEnippalmELO3ir ttpVl2s27Sqq0u4s27ZWWcSwk2pdlw4hLCrDTKEqtEMoMLMumypJSqyHbjp2qdMLOlnbbjR2 yh0OIIceOKrMG1WUpSpZ2qw0gyhtCWS6pfiUum2G1iqFlPHbaHarjpBk7bbXeOnTt4ylDTxC zhdl0bZVUZUouq0p4q6eLIeuPGF3aUMoPWkqoerrLrMKmmnbRVgy22s9XQ0uhZhVdLKzDTTC qGlV2bU08tSq6eHpGyY027TptR2qqSu0Z00u6VUaayqVdNKWWWUl2lhKC7ayFlUIZVKnEqpw u0lZVDJ0pghdUlVhLiyUrsrNquLpdNtMpPCHqy7MO0KqkpXUq+DPk/h+rcqkp+hlfqSMWCrK kI+iNPw+7I16XDiIjPu3fdxpxJI8JFA4+HFWPKzFdswfgp91POZySaJIkSRImkkkkhNPwBEB ICKBXjAOkYwDw1NmgFKBWGAeEUDI0YBwJDo6cV0BwdTOnQZYylik8mziDRJiZJJG+PrxdBmD weHTpWIyMJgZ0RwPEDyB8R8EbcICqAxEjt9Xl0mKpjE7fR7NHsxjtjHasKdK+rZppMdMeyvu 06aDw8orExWFPCp4aaY0YqlX7JQsqVILsvxtZloqMIdO1TpXSptTinTRiNqYrHoxKVEJoJNz 44cyfachMkkiTRNCEmk+P03H2n8UrpQ6ePFm1zD9kGUrqQlVRDCWk0o7aYNMezGke7GGlSuz E2n6JtGyMOTiESSJvw2wcKxWmI6VKaQqm2kxD9EKWfKmzjxxY9Q40lxLSWlnrC6ULru1Wiji 6oshVDTaV1kKqnaDx4q6NMsqSspTZVVTwIFSESSabnCSInGOfpw/ZKqVJdISSgylU8QlDSyq EO0HEnowKranpXwqeD3dNJ0pVcVXSppSRUshdC5hUsuqpCUpSg6eKpQlKUkNKrJVQhTiGEqv dWjow4rp7sbSu3pgxSqKflxzTRpESZITQkk0iJIkiImkzxzki6ppCVMrvEuLpSOIQhLtKUoV UqtPZppGysU9krwrSV4Y4em3Gn1fZUlKSolBSKpPoxwP0TOabPtnk0mkmiSSJJJJIibSTSSR okaSTRCIiQiETQmSaSSZNJI4EkmklKVJVBWPLtj3VivhjHkqs+VPnj0+WS2qhd+JOKKYYMod NKrqNIXVVLELILEodF0LofQfzIhEyZERESaJIkRESaaJCSITVSqqVXwfKKpVQxp2+Xb8Xw8s Mu2Xrtd69Pws8dlXFFNukNPxDjieFae7Tp93EfdTtVVUopVV/Q/oBOPEyaJERpJJIkTTREie B5AfxIHaxDpo/QWEP0SwCzLaplKqCvuxh4Vxx92n1YmKU2lNOkmMc/DZubbciRPI4iRN8Y48 nkh0pYsl5CxXZh2xwVOOmmnFNiKiYhSdhSJkyaJEhJHOQ0YiaI3kfZG8+xzPIkSRKqNNO30S bbVVKpVcSqisMybYn5ck5+HDg0bQQfkR2NNpD6RIkSRJKU7U0rpp4ImokdFNq4sdq0qUUnkG KD4EjSTw8MeFfZ+nx55Z9T8tIkkySch8JNqqqrZKcRthKrD0mIUShso2u9MiHieQYTinZ2xp HNEaE00kTTJEk8kiJMTH2nM020kaaRGnIcSaHG2mzc8mxzCYhpExNkkkiSJkRokSTQ2mzRHx zbjIiMmImkaRuIOaaTfhzM4ZEIjm2jbmkhR5bY8HgGOKiqrwYnklPyIIm+Ek0iIkiPiSaIkJ PJ+5NvpiNJ9PhyE2mmiJJpE5Py3G5p6YUopRiptU0rTTHgPKh8eR+nNyTTcEHI+ic0UpVUJR FfVm0lGnbDFHQPP08fCTNMyMgk0kj6GPu09lSaIpKqsMT0qkSkPRVeT2KSeXHFVUxjsxjRST zjHM3EySSQk0iK9KbFFaeHw4cKrasV0VSnYNMaVNqUJUD5JKEw0wteFVVSSoO0lfKp20enkE rNIKqqqNuKrEKenGQXWXdKwnhXpp6TsHu4HRUdkorYMeVeyV7qaVpXasV5V0CV4WPa6A8qD0 SFBp5SnFJ2IfuNCTH6TRB+mkyaIkkmaaJMkmiPtP3kMU7UppjSSKkn1VUqqr7tJohpVchKDx lVSXbsG1nqGEKZQk+232jTbcfEhNEIhEkk/eiZNNIjk35fsc38EsVepVQlekpoQldLCq6xYb QcbBxKkuKvCEJdDwsohCkBAlUemPTTauK4pVNilVSTTb9k3I/YE/gaRERETQiSTSaIiSafva RUpSqqVHCuOnpNE8vSTCThTjwx6KqtKUqhUnkscej3Uk0k8ilVKKO1eHg9krSSr2dkqCkfL4 bYiVE0Dp09NA29H0Y91fRUxU+h4Y+pU7PJMI9ldK6rCVClKrtpMSMKVJUlFOynbthpK7Ph7A pQfKeDAfJ0Tp6YmPTHyFR9FSfU/Dbmkz8JohxJpIkSal0MNqjTKTK6l13irgMFTKkIn6RNIk jTREIiSQIcVJQhDTKiG2VLBZxVxKp9EpxPLae7Zj3B9mj4U+BSUqJJppCNpJNCRH4RUlFY7a bVsSiPCqrwqbe54+MJU8YIQo7BDTjhLpBlDSDbT2aTap4B9EQ0aUpXlh4VXTBt7MHFaezHlV 8PKFVJjhsKriV4cTopKqlJ0NjpFbk/g0/inxP4J4QmTJJCQQhKDjCpsl4/GGGBdCEIQhG/B+ wOPokn0m4iaIkkqKio6Uqu1O3ykYnkriuifxTJ9M4RJNBHxzG422K6eHDo+idOjy8MeFT3Yx J2koxW0vsCmnwr6INJD4aYqqVFVUVKinyr1NGMShSvc9020+SvcrFw9gY8oqFSq4TD+ZB+Ei JziTk80PwiSQ8IekIQLrqtAspSodoMtLkfQpK27K0D0gwk9FKVPYr07dA6bPDyTCpTykVJOA 6KDFA2oJogUG208qp46NJso+qp6VKqq4+jGKlU4hKGUKZJVLPlSUNqlWkMILobSymmEIUhCG UNvipxY4lhDKlVXhIxJ6Uwqq+kfRjxJqezRWSbIJEI/J9ub9Oc0+OSBtDjBVRBC5BpDK7SVk NKWVfwBzcSaT+L6R9PJpIkiP50TTSD8J+UyYm0km/gdsfV6DKFabY9adtKlUVVSaSSTSJImk kTQSSSJJEkhHxOZJNJH7088nxxxDjIOIkkqleVezTHRjBR8vhh5FFJSfLjEmO2OFh4K+FKww 2qKUelPYU9lVpiqpVU6Uxp+Dz4iaSRIokk+znNJVVTHuDy09KY9MPDtjaiqugvZ6glRAhxDx JUlD55TsSo8FPKlFiejtGHslJVTR209vTo6VVKG1+UqUrSvd7MTHz38gzb0ek8NMaY+5hip6 YVK44YhhVdCl0DpdhKz546YXQ22khCqmzTE7KYxiYlSVxhxWnSMQxXkqujHTpidPBjCmlcVi tFYrpXZW1dK06YekqKSoquldK0pxpxoqsVhWKTpW/BN9J8T+ZJOTfbnOIQkqeiu1fBt7mldD GK+6p91cTpj4fLBVk2io8NDD4SVNKqpPdJxCPw5zyckcjk3Oc/gnlMY8tMNuNKriq8mHsp6V PSsHlhjGJStnQw2mMTasPByfHOTcyac5JJ5OT8EPitFjFNqaKVUelbJR5ezH0BH+IkSR/FP5 kOIi28m80kkSfvI4iT95N/BPJ/QQ8AxpXKxXatFKqvDPgr3UmlPJ1ppHaVUlFVHw0Y7V4JtN 9OfoEP5miMmkiEh+zjlMSaLEnI5Nyfs/mdNIabTEqugV6V5KYpimJXhT4VRTSjppilNK9nSt K8j7cfSJH2hERE+znkSSSf0ISSOZGk/S30T7UfZR0VPsrhXpt00jTy6VpjGJ0swpMKaeDbT6 K0p2inSiSJJoiSRJpIn0038VeW5MPT3ezptGIpxKK7YKrG0xVezjHGMTFfRWkqPSpPkH1Hlp 2pVUrYK4+GKxifLYPqcNlU7PoY6VjtjFVRiow+jm8L8p5J+H28QiSEiJEREk0RoiRCSJNppJ ImiSRCb8J40zkfzH088zxPpOSRIkpW1JgpPdpjp7mJ6FVVdPTSeXsDtpxVUtVKqxXhh6Uezf HJCSJNP0RJNH2jkVVU8SWINoKl10lUMoSuslSDTtCWkEIFmlVNocBBTpd0aVVYxiMY0r2Ura YxjtTRijFcV8jTE0piqr0NKwxKyIn04ic0cm3xJoORI+3jkj4TfOHJJJ5M5vnG2iqVpiq2Vp pGJor2UqVFKHHGOMMVZSuMNtKU0YYmK0UlqlSp06aHkFGlfZYxT5ivsp9CqpT7MVXyqvq5L8 Ekm/DmciSJoiJEiJNo/ZG5pznEc5xJJJuckzhyTnIT96fgm/DSQ/gJtDnHJNJpJNUqsNGDjG HgVNqcPq0mj0VNMYSmKxNPLZ9U2qVJSk8FPdZ6SuilU6VNKVVVPZTHhMbV4e7DSox8g+wezy cT6vsyeyD52YSgQshZCEMCHirCV34hwkyIfEkiH4JE/B5zlKr7+4Ps7cOJsFdKqqqqqfhOJp OTckm4k45JvtHHNxyeTm8c/cm8TJJIrSk0abNJVJSyKSo6Vp9Ex0p4FVVUxSle1doqeCu3Dm nNxzR9Eb6R8TknOSz4fZySeOSRCaPyfRx4Qqu2mOmNNNRWypsp5T5VE3p5VjD6tNKPq9kwcV VStsMfRjSqV6fVjhSuGKqfDphafCqpRRPCpNFHTTG1cFSqmyvlVVJtXFPTZiqfUqeEUqulSk pt9DGyp5SptU0rCWE8vL5BjRFVKqqr5YimO2nw1GJ5dsVpg8u2namG2m2IbVU0nx+w5kE2TJ k+k5IlTEqelRpUqqrGzHap5aMTtTwp2o6VNFVTweBhO1KlaTfgn4fhOQjyaRx5HEjTp00ez0 x2VTkx2smEp2qdsPmPLY0SiimJVVOKdSo2rCqo9yPoUmPhY2qT06MUsqKNPl7JpMK+hSaU9i h0lUpjtjSSj3VPhcK0NsTtjHaujGnlJt7A+jG1cVHyqlbSuIfKpOmlU9K8q2Dpo0nlTQqVFU VsHl00xVV7MVTDp0xHum3g07WTR8nlD2VJ6acV7oxKlVVbBh6TjQHbZMBOxRI0jc+JEkSREf vTckiJPA455xyaT97430mbkDkD4gbyByA5AnOBuQPM0B444MSIZil0wHvYDpKqXTgHwQByBx Nt4kgTaBNA8gcbMgOQN6BaAeZAkDeQObQICbAkzcgcYczmbiaMQEgSMiaSRyBw2OcDyAOIHj IE3OA9zgeCBG0CzbIDI2JmkkQ84DjHk3GRkaHOM5o0RkTJJtttAZCZpNIBbIGUQnX/I/u1bi 6v3fI6O9x3/t8u/9l+/7f6P4z+f+T2xj+etf2+/PG+NcurZ23GpC7lw2qeCqqpV6/oaNLvxt tcsss2k2uw2l/xJVYf2NLLP62nHHjA7UyVQsqf7ELoWXbSlKqyWkulVyyVi6Hyz/bdv86qqq V1kIWWbWfohLi7jxVl6l20qw6S8bSksqVLoXeMsMpVVY27f83pH6K921LOPkviemztT2aVWl UVKqdFP2MsrYNMCIL0PFzCDy40rN7NqVcezhivTbpeFY7xO1k2cfgYmnatrsrXGcnLbLe3pt 0rGjosY22VJqVJMVVeWJ5YxjNdNGk2XYyHgWaTRhVcWOV0vZaebovgziarwxsM2tyvJTWk0q aGiqlmIqtKmOnkzg8PKqfKmKZjPk8qYnZO+MeWGI08p8O0uR3Pj/qnl7rfiWfc9k/qnyp3Pq zRomxOiSix8liOFFx0WokmsWOjNa3arlyx0QvRRIujJHJksUXJuqSZaoo2mnT7vLb8lThpiV X9zTD0r0aVX2Y+zy2cUqnp8DIr5YG2itKVo20VWIpjSnEch8uKqqlPsjh0LGRsx+Tw+50p+T jjo90dLGSNw9Gh27ckldKfaakNzwnSffd1fKvtvo6HvL4M9zHzZv5Tyn2DtlOKfd7tkyKbFk mo8saXDFODUiyTH/awY2pjUk+z6+yqr0w8NHc7cUqVPuNPT8DwpjSnQx4eypVT+CG0mEvpYQ ZINtpUq2ggXXLUWVUNjGycKn8Rcf89KUP3SxhjinBtpTZt+nFVPCP2SqfCjLqitFTtBlk4g9 Ttdd+3pT8QdPSp00rSsVXTDD81FStqramJimxSYpOm5JXT2caMh7Hb9J7tJs6Sx5dqpUrTFZ G9TqfpG3FMuzBiwvhxt2+HU1jxJ4UridHhjFaMMnHRPBVUpTixxtVVxZhZp06Ywqp0zNVouk ldu1RRtUe7y5LMLtkbcdH7K/KJ28Oq6SvL2dya2ZvTZZmbiNPg5J5tlwRTtxohhDtJNFVl9o pG3EG1UFXTnZ5V7KxUqmS5hkTC1PwK4wz3Rxx2j15kmx5OHcsMPSlFHRWPTWsaY/f+m3+4n5 P0GKVKlUxJHEiR/3H+xzxMk30MTSMSNJvJwmx8RtnI2kNkhpbSbJDS2MkS3zT6bmSaObk4y4 efScw54uKjTXLSdOuFXVuWblynRnPadWbz3t5na3azeWD2nLeVN7Wa3ntPfEemeQ3J80eTNp JNINJJkiRomJCTN5Yore1tztdmee9vN5EsHa2eQ8jj2tdt5Nk7iYqqm22SJtW1P+E/m9Mafy bYn+9tMdKSK6iR8JL/RmkYxgaFaVMltpzSlkktsls8HLSudpZWM71gZUyFhmTMlTxqbb3N5J drctNpMed7T2m83OyZaN6JCOkSCEXF3eCZFNmzXIr3uBu2R4YvKvAVBOL7y6NK2/rrFr31id 41jeGK5xve83rvc2tZFZiucXxqbanNYmrdsTO8xm0VX1uJzfOM2tvVoxhresb1XOdYm3jrPO q16Z5WN4yN8maf5W9fKPG9I651NbTetrV7i95ned41lWL1snWu41Gf6aTzdY5vF68+pn2IR6 BnI5T9dkRHgiTRmm9Re8W6SOTB2P3nrB2cQ9Q9f7jS6LTF61ePL/1LYtauKppreNP6vxZvbO P388R3Vpvtnf+v28uNuJimm2X6pWSsg2lTBphJp/tKkKrvFTbw4+Hbt+UibUTpG7Zua+/4fP 3+/dW8u7qy+Ly/Nzq/jkfhczJl8W+emrcfpl/Pfdfu5+3nOTVli0eWjULQp1HkYz+3VqRERa K/kV5/H639fXd7fZ9Y1NP6IVoj+91yceU7fu27Q04owh+NjDaz+l+rhsqpVZl88bZZbZU6Za aWZUyptZZc+Qfo/oZU6YaQKtqaafJdu1nu2x08Gm35uHyrj9FdPhivhMYlKoJVQlLxBJKpVS UNLMrl0Mlnb+KqzSGEP5mV3rZZkuuhLK7aGqRkXrTF2JFjV61gWu5NcURDdIbpI2dibdzWnN JazZs1zByYuaa1zXofqy/Vd2ulBD50/ZDZCEquOOLrscNq6e79zT7OPdSvqx4e7H6K4r0qdK /BT4en+hXbSto+z8Xg09nuns2xs/4KNqn6vwenhWx7OmPyY9NqbdNFiRcuaOrdk7ofyxDl6u z2eX6XkREdglCIgT7GI/vRftZLvDsYni+pO5Su0aAxJjUr6l6eh+lXjM07ppZO45nNhj/WfP rcstRHmdp82p/f9J5d9Hk1oo2T/S3N1pScKkMREf5nWjw7jkqbTnrP4XzW9taW/f/nTe9efz Vl1fhqy8L3uXsrl1FSvaVIhDtNKTGNKpUkjEaMSI/UPr06So+gp04qqqqpdp6lD4qf5H4KtN U+bVp8RR+MpabbKKaQ1SjMKOoXbQwq9fPwaepTVTbSizSHHzlHq10ouw4u9YY88ShOHyrbST T1sYPyGKMKXRRRP3zh+KqvxqzpWGkPSWUMPHQvC9ilkLXuNupbbNK5oouiirCpLCpDpSH48d DtLxpg0u7Q8Ss+cVPXrqnrbTCEPunj0WX76QhKFVT2UjRSumEdKkaVKpNKY9VxOMmYeGV7zM yrplmSmh8TOQkNJtJtImmJNtpCQ0h5M4jTTaQkGk0mSGiZIJNJtpETSbfpwHv2vpnic4ClYy VgGNtsJpZ8jjJw2gaVomjIDU0wYyqjGRUD14/p+2XWunb7kzx6n0rlnphxwaSrVA6mGkWQxV UlqNmwMNq5G5zy2yTQE8557brLYI4zHTV0nRYDS6dHzdO22ViwmD+X+s25/kP++ySSSJpIma c/f/A/jpPjfRIkkkkJ9G20OWOY5yTSSSRJITJpokkTSRNGhJCSSaSSaRJiaSEmkiRJJJJJEa RNI0aZJESJJJJo1tyHMkJJEkSE2REhCSTRomJJJpkTaSIkkkaJtoSUTETGCRcWJP8WAPL3e7 DRbLzsn8FzhxKwuMbGxHaOzbtonoopim21FChuTzbjj4m2PkSOm5Nqam362x32+0nzfafUz6 RbaaRTUt4TbWmmiqK7kVN0JaGlFGhnShvjpuPNo9GooOfaOIj0ag/pvp8dnyFL88oPo7McnM ItI8573M5JscUGSoKxgHho0mgPYj9mD3eJPMpngjszMrLR24F30JcalJpbNLNtKW2SZJJLMS SHR3MRqk5JOiTvdTBRQ7Vi1Jiqqwyw/kFzJ+ONLNNISquhhdhUSO37qVXXZYWXQSqVS0dJQq uypBSrp2hLxtlhpVU/GFFkrrtroWVUohltZlVUuYcWVZXXQVG2lVlkmkqSWWXWWadMJcQubI VWQbUuKm3irJhR2hpBYwq4kwmJiduNq08pNGK6aeXHHGjHsldZUqpCypLDaylyrpLCUFm13F 2XGTTLbCULLu3GG13ELNKrqQ0qaXZQu0g4hCVXEFWW0NIaXcQuu4qkwwldYVXVbYaU7SVOLo XZSplpKzDTRSrJdhdKkpXQlK5hlZdBLCqSEKsJQwhKErMJSlVhKnEsqQ44uylD+SDjayXTCx KyzDa50hh00ldtdxJVd08Oy7JhCHRpVtLa65dpDCil2BO1aVXhR4cTTyrhjGPDSsaXXbXMG1 FKIOnxUUhClNmXZCCr04u9Qk6VcQ9VVXLuirKWmHR4aJj048NJ0lEqSiqVKO3ZUyQqhLtgl0 sptxSFKVYQaaeWNIqVOnGJVO1TyUaKpxjS5oshZSlDTipLCqELILoNCHyypxYa2s26cPELIQ 0YOiXGUvVh8hcsqYOKSoqg2lLayFMHFMYxWm027bNsYxsrjStpMIWXVMGCFVVlVkNkqqLOJV U+Qyuuhd002lZd0lDL1dZlZhSTDLCmWF0mDa6nqm111IKvFkpQhhZLaFNlm0KlkuLMKqSwsV YVKobUsssqwkquhZVKEsJSS0uqNklKtLMrNrrHilVUEOLNum3auNsSvLFY6Vtt9ngor3HptZ lYSptVZhDaVmlSrCFWG0MKsOzbGmzHbg2VxGKhtSqqtOjDRWk0lYm2Hs00qlTjGGNsVTTGim NMPCnbFVVTECqELu0mHFIQqw20kq9WYUlTtl2ZcQh0y7SsggQZQLNKrodLKrMG0Hqx2WaU6L MLIPUqXNoVOIXeKZSw6SllTSrJCmlVTKnrC6SFlXikpGEKWUQ0w2+WUus6cVtVaVptW3ptMV VNpXFTDtlVdBdd04hwlSGGGFSrpDxZ27Y9MOJT3VtXGzFPKsY+CeynuabOO3uns9PCRxVejA 7YmJxK2qbfCu2h09zpoKPhXFaSTo7QaQu6UwYKNoLmVXypCpVUy8aaZWSwldo0sypggkuwhC mXGDY6baYVpKdtO2JU+HltxNrqslkIQq4hxdVBdKGySqy6qFLJcZSyy0hlpTCDapCpVCFVWS nyHCCVmUIJZLroIJaJHlitGiNCo8mMHpg922EG3E3xPibkZ8ZvpEmSaPjnIb4hxAJk2Jsmkz SVxMcSYxNFVWmgxicUmKTnE+nA8TRCc4OTZ5DiSSOeeeZ5Oec884Jo0ppTFNK04wYpI2qNqh EmSSTRkkiSQ85zyHk05xtyOTyOTzxwSSlTSphRpjFK26MV0rTGGPTY0bVt9G2NGJ0qqKqq0x 5JJJJxNImRJNz6eSSp0SNOzKjD1t0WMuNqtrO1SmFiyEJQ4VSlVtlVCymW0NMl2FKh8qbFWn S7CEsIQuQwsVWJSyhhBdddxZcspdRTtKpVSGnTBY6ZVMJVXQuq4qQlCG0KdqrNqrNrOnayzt cSQygqhhCqFGlVNoJQQU7dJYWZJXSlD1CllIcbVKeMlV0tKtJeLMMO20EpJQhKqyEMKu120q oQulJKGWUpVVcSVQwqwkggVQ0ysbYYYWQ0lKyzKUpVQgquqhLiErLEELKrISqslV2swywuVX SqwhY6QsSogh0yhVdp4yq8Qqqhl2rGJTadsdNK2w8NKpjDTpo0xXwRUaKbeXbwxDSpBtCijj EXGEVkVlHGVXE2NCEmEaEcnxk/c/Aq+VUoVUwspLKFSljx68S2yyylKzxYupZCjo2qGSXiS6 6qiqFJVOlcVNKSqjj0xDSmnTTSSJPtM5+5xjk2SSbkOaBhDTSqqVRYgEoMIUlAcIn1beWFU0 +WMfDw07IHhSVVFFxSXRtoy0wYWdJXXbLoVXQwxWKpisKaUbNNvdxp9Xy07dnhjoxXhpioql UjSpXgp29ePF3rtxZCGHSzpDaSzTSFzTTLal12kNJZaXaaXVQhdKEsrNLpaMpWbQs2lppUuu ldKppKGFNqsGEIQwlpZZlhohouq0yslZlJpZttCWWCq6yphVlVhhDLba7ba5lthZKF0JbSsy hZVhlC6rSrCErNrNpYIYQ2qq2lZtLK7CSWmWF212iyzBLK6Gy5CEtNKoaZYSyu2ughBDLKEN sNIMstoWJZLtqrtttsNNpZYYceWk44bacV4eiSNqjEKeGMaYdI0044ny7eWKro2xitMTGn1e zt7J7K48vTabJ7IqKqlNGjE7GyYlVKlKroptKmldNEqpTpKTSwqYVVU7VNNqslzCElKaYwx7 pJt028MHypWMaaY6dOnTwXR7WLEuKcVMwxkkJkI05kiTQgmJshBNpoiZNDRkkTRE0abafpw4 0kibTeKUp6h66YbcXPUrsKaYceOnTs0g8Qq0qpB6qw02w8O0O0IYWIUpKqjtxUSuoh6qNPCH R4s0h8hd0hdKnThVKFmm0IQuhD5ZJLDDiXS5VYqqpCWFSHiFh4ysq4sqsqg6XVSwuhl4qlLL pCFlMNIWSlCTSqnSFUEnGlXizKkNlXurFQx4bT6KjtU9OjslaKjDy9NptD0ripKqSjtiYiqp KpKKqqYg9Po6cKV7K9jp8ELlLkFS6o4uqKrKruyXayHHbpZCFHzjLS6ps0q6Q0ulUhClUquz Gj5bHauJOjG2nbZtOK7UrSe7SYm2JPKk0VFPq+Xs9Pl0Y9KmlOxptVNsYqaTEHuQpUptllxC V1mmEoXVWIXSevlm11WUFEMLJUq06YdIWMqYZVJaY0wmKr5ONONq06YqvoxicYu/EvECzKrx KFRh0pCHph0uysslSGCpBA4h6+SkhTJDCr8YdPm1nTDaxtCqz8LNoSsXJSwSWFkEtskJOIYL l3axZCVLqmk8Kx0+WJ0qNqnsptTb3dvB22cT5bMdKnFVxiTbRhj3eWmz0qqhDaHSTx2bS6Sp KEJQhVVBVSGFHSDpgu4uh0/GC6lKdsNpKUS6WdrNoUYQopTC7tJR22uyVXSww9WVWaQw9Wae MpSpxQh2ypZ0Ymnp00qq2pjFVXGnHpiaTohn70NyZjkbOTJNJtm8TcjcZNnOcNNE2jR5zcTb QjREyIiQkTTIiI0m2kmhNNNNiISJpsJkITbn4fg+HIn0+nH6cckjkfEEWOQusqo26VUuhCGG EulmkNqqsrqmldqmlIxU4o0qtsJtUrwqpZBRIug6SWJbShpUdLKiy6rCFLIeoduKjCy6SHiF SzCoaQpd0KnaBpowgkog0qwhLp2qdssoUqSYQ0ssq0up4gpghlAhCqlVkm1UNJWbQ6XeLsro ZaWfi66UKoIWJXeMpesKqeoKuOnTaTimKVXhp4GkqlUfKkLIJKqkKrLrrrrtF1z1BK7aktsn ZZQVIUQMLvWFktLlVNO1RdBClnTjirs7YcKtKrqnG1kpQph27Q0sqq0hK7CkGEnyqqUKQ26d ul3aGFWUIOMLqSQ4hSdNsY/fUPr/2fXSFpah7srH4qCimqmKZULpj7PDH76OVL+uGVJ5SY9r yHo6XjK2R4QhmUzDSZoiabEmyJom2QjImNIiEgkkSbSG0RtiJtsIk000yEZJsmRE2TaESREI miSCIyNEmaNCJkkjZGkTTQhGiaTEhESCIEmIRkQiNpNkRIJCJkmNEbaafHPTPiOg+EtIZRLS 1I4Y0OPyVp9G0H5KPsrau1VX1U7dq+zpsdOmNOliyyEsFz8XYQbQZYYShA0aVKoZbSZSklhJ VhllKr9V2FLMNEpVZXSqFEU0Swwq420hdhhU/FnTTLSraEmEpQWQswsslZht2hhCENsDDiyU LqqqkFTtVC6yUKoIS4lZCqpZhZKxlKVmSTC791lNMumHFlTbZhL0s7VXXYdqYSy2slVgSsSl dCqTLDiuzTt2w6VhhVYx04rY8OGkwhQVO0skPWSW3ThVthxLBdLpLSl1UIXceMOmTK7KzpVZ pdDCFVUpJYVWSuuLrv4IafLtGCpVpJCqEMMNLMLkoIfO2l1l2EOmy6F1nj4DLazBlkdJPnTS 5hTjDSzLLKF2UrqobLrKsLKYQuQhhhZYsQWVSXQqyhCzDC7CxKzC7iinxLLpDLJCW1UO2FWE NsONPVmUIQlCFkG0oVVZQuwss+XS8WeFlXqWmFVKoUhCnanF2UsKsqXdqqoWaQqSuwp8qdLr l1EKkKsO1WFl0uJbXXUuJWWeyD4dNKn0fR/j6TtSVQqpKqFRsyZG2jJJIxEzJGSERIMkZIJE mJGkEhIJMkkJGkSSSJERmk2xNNJk0aaSJGTTRIjbSJok2kaISEjRMiKqSVVTzSWi/ZiT6vT0 8vseH1V0m0YLGzdc7FXJkzaJlqxqscmRiqk1bJdO3qqUpbZVbSH6oLIfLqvEqmm3GELJWaeI WU6dqvkFkNJVS8YS7dPkrvXHrxx2l2wl00wl2+etukGHalPxCiEKPmG3jDppl60hx+O3GWS7 8YbQ9VVdJaabfjSHaz4Mu3Dplp6q48cXZbVQ0h8ys0eIYZacSswku4uk/Fyz8WdLqsPHFkPG nEPGnzw0yy4s9aQ48bXXOnS71tDxxKzCrD1+OMtO3T1dJV48cMsPWlnjpxxhZ4/BSlXSHrp2 6ZJXVdMpfjjTCqp422/HzDo9du2VmCzjTxg+euMMsvlniXjx20ld4u6Q6ShhhtBVZ6q07eu3 H4uswplppptD0o/G1X4w9YQw+YKMsKqdJNJtpJDQmmmmT9mnPsrzQaJ9VST4UMUQ9Plt1sRv tDaRJpEhokhIkzSNIyTaRhE0kSaSNtJhJJkmJNiTNJJJpBJiRIkNJJIk2+0bk20kmJJNpSFS o20+qvc2m2OOqLVqWh+VRcSCyppIIVdrFVVWm6SWu0y7UllhD1KoXbo24kHbtwOjD2Ux9m0n FMeXDt6DHby0xDZsRWHlJjbyPBGjySaVEGEVWm2A6MCvch0xor0mzb4YiTDwE+zHTaSO20id omkNKjtXFdnTbjgnQYx02rGKmlY2ppjo2k44kYYdsbdOI7Sdux09mDZs27bMVEbbHZJUMVKk 0qUbYrTTQ7adGmMbNNNOMbVjZpVYY0mKbVsxWmkVVYmIV0JRGOCTDSStFOlYw2aUSVDoRSJ0 dNKVUXYSkLrJaKQlTJcXQohISmmNKkjtKkbK4rYVpXaFLkpQpKzaqjCVkpSqoywy8aMu3aRV dFYUrTHbjG1VMYY255N55xyOebknJ5znkyKVSqYpNK2Y8PGkmmnEOzhoxxtgPLiSYG23DpTQ naThEwrgPTSbUnTpjtXSpptwNonY2qKcAwxqQpih4bSTSTshUQ27dSo28PDo8PDyeU2eHkbT hDHHCFR2hpHTHEaIUOOKm0bRGE002kjTZFNqMYwNkaBjCYkTCMVxtxp0YxiYlSq204rTDkYj ENJSUYwgoMbbYjpGmMJJtx26COiV0qsyYzMWMym1HFRxUVo200rbGDTHGnPHJNyZzRMm4k+n PPPp4eTTnOfbH2R9JyNtNNsRO126kRkqxxx28M6dPCSySMVpilFdMTStKmlNNMNKaaYmIpjG I7dtppjCV4aaUoTiKlGyVUY4wTakK8MeGnFdFTFUYyJU2ghUDCeqWdMHFTK8PB4dKhhZlRW0 EKSFJtttpMY6OnGk4ibPtJE03OcJNxvtG32wnHh5O3aVHkBlPDK7YrpStNuK0m0kqKSlSGle W3DjadOSSuOOmMdtNNOzaVXQdOO2hJwNsJp4dMR20x24pQxxZUpdpZVVtlphdCVyqzTaVVKX OmlY0h0wnBSVUVKYxqSEqFJRxiYqttI28MO3biuOlLrpYUlhCUMLtlUFJSuuWAg+PJuRIfSH I/DnJPzBxRW2EmxoaabQqNLxUTahsaUYRNq8NmNKx28u3DidhlVl5M4iyq9DJmRlnHScJ0ss 5M6SlZCeHhx07dlYxTamMbNGlMcNONuKNNMcUxWlSPCnFbaViQYduO20kNpSNK40rCq6eWHl 08miOldoqBTHhgrZVVVbQ024DjSnp04UHgoyRkO1psxw0Y2pxWKVphMVipVNKpWMdKjG2JSt NMQxUTUjYTbc5yEeeTxOcSfSaYeVHTjbSHl0eFKV4TaYpD8zOTN5k0kTcmk2kDkiSaJE5Nua bzz8p8SNDHbwxG22miq22xKdpiiFdMElbceHh0nThVY7aSO1BKYFcYVWqpwsxmZh07MoXQuh kuVQLLpShK5IQkLkLqskly6GGGEkrWXQsqwxSuKwjDSNq4xiSmMbaNjSGKkTCKoKrZ5dvTaQ +JFQo2GTxRtVRklZKqylSWyHSqUCEtqs4UXMMpPVTS6mVElIFXCdk4bafDQaSUdV6QpVY4dw px5h27dO2XHCBtZKFkkKqtMMNoO2CqHFVm20ttOkrLllV0OKbQ7ZZdsstK4SwswyshamkIEG 3TemnbZ2qGhUKYVJhTpjtWk0YTFSUYxFVxjtVk0SbfE5JCaYkYjSPw8+Dzc3iJOTPsmfgmjy TUzn2hNkHJvpGkzkNPBiiTAx024jpKO2kldtpNok02m0H4TJIicMg5kkmnxx9BnmPJPp8SCc 44XYMduJDMqwmcROL2e52cVG+2KYrtHGptXaeHTXV22w7HandNKsSq9lNKVXSpo7ZNJUeqJZ Ce6qabaVSidMezyxIHkRx00R9VQYSqUhJtE+nBzfg5xJMkPtPPdgx7IrjapxVEqBxD0VJJkB O3TppEPJCyKqMU9lbYxhKT3PUTRNNjEqmMMYbenEtIaWVXVQVJVShLKqq6FlVXbDG1Ypp00a TilVxx0nGMaew8CeQrjhRljMsWKZUkiOb9kbORHkYSPw4Lih0yOnFXTpQ4LFxkTjNI+I5oJG T7bm05NHAkzcZCbmjjOc3NIIhyciJuRySHk5EIJ5xxzfSfSeLY5MzhMZRYjOHDisxJMpYCJt MRNMk0yYkbkZHI/e/Zz4z4jSSEJmTbnE9vFU4spWZ7mSPe6OKJ5piQ0nkB9mzfBJtNGSxpVT KGBkmWZjFkzJNs0CCTSSTIkiTSQ/SchnJtxNtIm8c/ZNm800TJE8cbkn4cRcaDDEUypZmVPc sBHn8HjyHwmRNEDJmiQkbPtNthxsjJkISEmiI5tzzMhERPpp9MJH0N+8jeTZJkiQSaRIk0id gnG2TicqozFWKMjgmViMRzSRJJtEMmgnNg0pcTMLti9GXTDNVl5O3RdE2kN5PtHk+zzhjzHE jw07I+GO3pTp2jdWpakV26D3RXlD2beFNInROlTSpNOnsrHRxxj2VsxhtKV8OhxxjDoYYTA4 h4TYmm0kV9HgfLR6eU20OilMY91Ntnw0xVTHlhtSFLDTKyRZKphCymErrLO0tKSSldPdTpjF NCUmiKiqNMMfDSNhsjYUOKStmNKrEYaVFUaTmkbElDhOKFQPTbHhpppp7NmiIkSJNIQREkmk kfTbNzSQkMmiEyZON8CxV4hBIcJC7jAyQyFFQ80kwPc7Iea6YzipcZVHNJMI2jImQm0iTaTI RzQcfk8mm/SPHm2KoqlV7m02SfDYwI4hjD3U0pXu0mlSeTjQxpKipI4VohEkiSObc+JJ8ZIk E/Ts85zTTZvHMJGTyqGNJpwrSVptTGhKorywcPSucItSY8E0RiYhxNI6SzbwwmFE2pVYrFV2 r2U0O0lYoqpE7NHTy4cd+TDSuMVO0qkMKrIaQqhBdlgswl22y9Sy7epnbzWF24GMqsyziORz mxvpCJiSJpCRvNpB5McjZPOSbCNuSJ4kmmc0THEk0JJxtyN3JxDCIzM5MMqRGmmKYGk0xxJk wQodnhHTo2fRj3dKw20wx0xVUlJUIwdNKKbUmmpiVI2xJpSlR5aZolpHGBxG2PZTbZiY9mI0 rw2wkmkSjCvZilY9mNtIkdTRMRKjSDw6PTTjtXlpgyshhVVVxdVhddZCDSVUKXWYeHljyrjw x5NlYSJPDEwSIrYTM0CaaZxNyJJORuSRIZ+n4bk0EbyIcGZHqWYxWEcDlJMCJEjnHOIm24j9 H2bHx2cJVhhDBOLzZerw4u3ooqpKUpUnhxt0+XTVRaWkVHgklV6Y7dO2lYYnCnhx4bcUkcQ6 emyNjyrhUpRMUqpWmMVSmmJWKrypjpWJx022fCfY4NNJBHnBvDQMTppxVmBllSOFXCsyZEmi JokEjZI0TSZEOTbkSImkyRPPpvPPycOT4kTQ3Gmkm5J0pjGKY4naibMNNJIqkqIiTNHhOE59 H4bPNCVJVSUo2xui0TicCcYraeETSMdqk+FRNKVSTjbwmnTGIkxEVs7JOOkb6cYp5YnG2MVU bQQlKEtKqaZVNLqqsLJQudukw7EnBJO2Ekx0xjpUjBMLoxDirpwKwylO2gnFS4zp0xcYZirj JS4IxSjaqpio7TTFkNSYle7HaXbJOPJwlPBjGFLKro9hntWeqjtZMysZjLMrGV6VVYk8KYN1 JNsesx4YSu2jTZUx7vCdNpiq93E0K48GGnsxtph4dqxj0w7TjCqqKqUVJVMHFeSunDwqtHEa UmOkeTZyaTSSNyOc8m828lPT09FPLZ+Cp3UWpNO2k93s93GzdjpLiqUsIQhKraqENrIIUqg0 6ZVWWJO0JaZaKSLKMUpJBZO2OG1VkCqnRjGKp7IcdPBBCGBiAdNqU2sp0lVLRlpZSl0oXZYV XSVVLIQuSy4upZdUdvKTSvBpG22jApW2MEMSaVWtMRI0kx7GKSqmjwxjTTTR5c4i1I+XhPZH bw9NsaY2itqdKrlhKVLl1naqqxCGlkrJQlpiuNtNKUxtgdumKrpXFVpVVDDCVlVyXTCy6zBZ VlCp2q2ccVxpVY6VpxTbFVhxxtpVK2Y4qmHG2jbjTFYrgKnRMBaD2Jr3rEjSpIsmMXU1fYzI oOPDjQPSkif/B402mzVfdUZUOk+ytIOPdGIr2Vh7OMYu7VVVfKriHjIhh2spdZVhtSrCpKVK kEqaIShgqGg2oMrLtMlVNKC6rbD9V3BZc/FIWQeJYY8pDZ6U0MeXGMYkaTwkxBxCc3720HxE mOZwPIIPBtI2ghMkeNhMssyYe5RdsEOMrLGYRERNNNNpCSJtkmxAiTaTSJNEk0RKRRVe5NJ0 Gldp4GlSqSsSFJhFaPJJjtHwdK04qUinjaPtjGjY/LMkiSRFKKqbeyjaeXh7vhWysaYwrTy6 TG1bYxxppOnRjTiYxTiuNqU8YaVVaScQ4hC5RgypBhklJphXpOxhxhpUp2xNppMaV6VjpjEp VU0wxOGIrbbT0SxMKIgoyZbUphVVD8cTfajpTR40SsdCRWnHB5SinQrieSnl7sY8mKh6JiI9 qh4eD2V8qjyg7aQ2SuQHipCySFlTpNVLkKqqlEFIbJVXLqm1qGUnjth0+Mw/ekjaJEbQmkG0 MLKYmMZjzce1SwwVMRtNG2iJP3PiTbxwR6e75dpt0+VdKh9x9EaVEnEe4VRXEitttttKr3Yq sVSpVKVWimmMNODb6DiVU0bFeYhpYZKxKxZKUl90dH0dODtTLTthdlgKvkKQ4qabFSBKWBVS q9mMGND2VNG1GHu09JZ9Qsg6VWKppTiEqpSqkqpDa7XpiabYm1FVKnTSdVE6ez2enp4O1Vny lVOmnpK6llTbxSqyCrDjJ0dukjGNu0babezt4RUmFSVhVT2eHHlOMRUpVKqHhj6Plpn7IkNJ sRnwTcYHGikqIpCqqvYnwRh+DZ7hVYMOIKrNIWZO3iqzphpJZC7TbbBTBZSGGmB4WVQcMsKq JIVc837OcaIZNNESCIyVSolUqVEqUfB9XTip9GOHTpxSu2MVKqqU0dHSvSTp4R7OKqdFTDCp 5JpU0leB8HbY+tExONlJXD4SV7lVoaKKqoVXlpjbyVtTjGK7MVT4MYlUeHh4JHY8JWkbdHhh 27dMRFTR62g0qSleFSJhMGx5mPy2/ZzSSEiQ0aaRoiSRkjaSIkEgEk0iIRpoiJGSJJMkkkJo kSGSN9B8TN5JJpImmkyQSZCIkkSTET6DkaaaFVGG2GOISKh4DZSMZXqoXEnF5HvexZxmTtcO lYoqp0YxJPZVPLET00ibKirLtTsRdGZjMMYMyopJSbUx7GNNnhpiqjiUuNFMOULUMeW1Tsrt Sttu8bE4w9m2K8cdJ4TtjHEmySYoUxFiZTMUxZmdJ2jp4e02lpSlWjapDKVmmyUsLEKsOLvL jHFVjaulbYqsVt4aMaY4rFK22quNsacY8iduMcY28K8k4x4UZMTyow+1PapItD0xGHxUJfFX aGGlSGS5lQXQoh06SQYEqfL00pXSSpuktSe75eU6VtUaSekwabTiMdVFq0ipdSHi4k2ZUylZ DbKmUFLrKLGzp0+zbtNsenR0TjklR2Y2wjG08OPToVVU+rDHSdjhU+qppSqcKxTZJ4PcOJ2n sqOjQwfQ00ptO0GlFVPCYoV2x2jpPceqnqyWWGYM6OKpSTtXRFbeEY2qbYqlVCpnASbbTbST aaSYnnnklY8tMKaaY0pWlYYlYpsTyLyRxdpJhkYrMnm+Dwveyenuw00mFSnTEo0aPCoqiTSa JvOOHHgn5fshPN9jaYr2VMotJPY08q0Cu1ezhhNGk02lOK20Q9PohxVG3gswupCUqpdIGELo QsqwQklZPJtDQqOmdu3bZtjiPCpFVBCiVmAywaJVKYQhZgVUXF1RUYYiQomCu3upOiqm2J0H bJjsGVnbsg6JkxEkkm/Lb8G3kJppMSbTzQ425sHJJJpBMQqoVlVFad1qGkwMPY8OPKYbK2MT SaTTpx5Uw9J0rw9JtiaVUYY0mmyq6bTBxVG0pWiq84jDFFNOijROGJhxSFyQdsnRSyBSFXaE skOOJWdNvKNPhMYk7SSeGJ2OlHaVXRjFVWJwdNOlVT0MJFJUdPo59MYfESIjQiTSEmJEmyRI wkBAkjJIhIJMSZpI/gcfR4OkjjokVSpSvZ5NvJiT02V2TbaqlVKrExhs7VK040w2TjbGlNNG JttibNNmm1Uxsw0MJjDRjE0+FNq0cYrSVKQkqsuuuuhKSS5ZKqlkErJONBiVDTHhIdMdNumm 2NNujZo4pppp0T3O0pXHbibQ4qVK4GHHh7j4SaTaaSVp02xMTF2S7SrbpUklSlQsWKoEHSR7 KDt7PBiO2mE0wjB5Ywr2e7Dip4YY4oxUVhB6aJMaMQV7PZ5ONvCVCh7MEqpXwWO1KerKTMlT jGVmTMyaIibZMyNESTJDFlx6riwMyVYmM8B2e5UNMRTTpMNuIkJiJPZxp5aezTaq0qezGG1b TStMMNDhXatqcemMVp26O22lY22VthtVUqpUhKWlKQusuaSXUlSkLPGElhDDRVJ0yYIU8Q9W VJVdMLCypVslKq5klS4yWVUlhVddVpsqttNqiqxVUxxh2p4IwQKoUEHSV3biF11i7LZZKxLj KzDwykwuhQ4qpDRRDLBRU6bFFT0pSpphXaTHacHlhjto0UqaUrHp7ttjDw4ipwr07PCnbFYm MTClSm0pVcezpxUrppjSHy0aUrpUxTsdhBhcqkqhJVUhBtSEqpaS4k6CfhvCSdtvLZpVVXya Y228KxpGGzjacnhjG3RKqFRVKb8JzRnJybcmk4jHNCYxo2bT7nhHopI0naEqVDpFmTTSqVKq qqIMtkINPFzBBZiYU27dkxXHhUmh4eE6Y6TbTTs8kps2xI+Xs6VHZxXTp4SbYNPTyY0j2Npq N16q091JPIaVI9nTbSQSkVKbPoezHhRsY7cVVaboWlqR9Hs8q93pitFPKsU2UwxStvoxopVF G0dCtIUaTpx0jbbFeKkHhJWkfGziPymeRORwPEIcaYbKolSpWz07UNNNFSk248j9P2TbZwQZ Nkk0mUZZnasssz0MycZPRQ4gkfs2ciTPM5PJ8fzJxCD5pVksqZeKIWUlpdLKyqpVwbcYqsaU qeEfDBGyilRTyqe5op5O208JVcPSnakezalVxWdWWpVaaUeai1Jt4HbDpVxcqhTaFzixJxUo uhdCxk+jHG2PKnSaR22xttjStIqppOmmipWO2MaMUqaVE6Tw00bJsw4jSE26StpieU00+VJt Q9lCqeVNK9lSVSq26Hhw4+Eabb4RHB5OPMfsmk2IjYckiRJIibSE0SZmg0OZzTNo/AR7tJOH CpKk26SuI7HhSUqINEnuip7npt6Q27SsTtU8uzpThDnMPoiTbnk0JGzxYZxRkYqZMlZlZlZE Rk2+MnMDRjfofsiSOc2RHOPpzzkkjiac+hsxWjDapjS6Rh06UdGGDpQ2ViErTG3uOJhU9Ery 8unasVUxVY20qqqvDy6ccbGE+SY49Me7tXT2ccSbkqx5OHhXlTFTScOjw48tjIlNo7YwUKnS UqYcVK20R29FYraPDHw4mGKOGoWHxUk8NvhSmxj3U8Nnurg9pxGO3saM0wqKipIodKnSGzE6 KcqJ5VxSqxSqkbPZJo4IJUg2PZjp7JHPgyTSRMhERJtEXtPRxHDCulZewxxhWV2dlxeW7IZc VRiYWZWZM9h7uKx5Ke6mNsTTjZwqphxtt+NpU9FSrA2lx0qklVKR0hKtsccKmxSsOyU8uJw4 7dkxDVKVKfFFpHudPh7PR7Ino49nTHRjpxjFG1cY009NMSdHaUWaLqMDRo0eM9umV1FKUVUo aDII/cBzIn7g5CTbbk0iRJmibIcITcZx5p4T2rp5JOGQ4ZKyceaq40RP3Ick5v3Mgc3BIZVF VSqx6eyY08IlY9PhTEpp6SV7YpjHwxC1J4T0R8K92mJz9EzjeTbSEhiTD6ZpTCpoV2xxSsMV MHQ02jupJsVWk4NI3UWoeHsOlExSqidNGjQImySezjFcQwUaISST6Ym/Zo/on5lG36fhM/Sc nObjSSOb9njOQ8JzRsrZWMDEjilUjSTFVN48g28EcTSRNkhzZcZccZ0XgpLih4yLwyGIEmEg fHE4x/bAPPn2qvZaAiFKfNtPXrKxZl2hNEqqYZywuyMqqWeKqvlkqrrtNFm1hDDLpAS2g4ww XQQwhKUIWQulYkpZwVUwwwqkshZ8llhC5UqkqukVWVEOKlULNENZWdNEoQmmV1zK6mjiWXEK ZbQ4g0qcWVKJQqp+jro6UWadKQy02oyhpTI4UMLHZddLphpSSWUpVpxxlXh8u/Lh4VU+TFVV aUwrFO3u2xpjbTimEarSOibaGia0cU2knhhVelI7K0GFcaY7abbdtkx8mJG1SKbbKopJhSth XlVSSvYb7PsNG2MYre25Ocx5onn7I8i8iJOHkcnJ+5n6Tb4mSbSZH5TmlSny4wOh02gSphAu lYuqQ+ceybSpW2k7T04qtOmmJTSdMcOlQwUTCMOIqdB0TG2zDEYmKKUeGMaeDHl0wcOm1Vji RSo6KKw6SY4ppsnYxK8tscYbdtGu3gKqRTkyQmkyIk0kmSbJYzkz8IUpsp00XQaSp0u8JWG0 KIQ7UqwpCyzSyqo+GV4GwyQKQYeZDHu4nHE29mHFexXaY0aRxWgYeGkcdJs22eldmPLG1JpV mV0dsep7zyU8E8jKsvNYyVhJDCG0qtmGkqip0jtUkjS7VZloxzfhDxBbSIRFnTtslVdtVd0q hC6SoSh7KmzbtpNJTbGOFI00aV0rSjbDCDCxdlSvZ2y6bVaJQUpCtJSxYjKMiyyw1PJ6HbGK himNsVRj2Y0qVtiRipSorDCqqeDTT2SoYdEqjwkxXT09ivToqtJjtimlTTRjTtjSVKlVWzpx 0myuFVjHGmlaVtUxoYxo04240VhjHRooxTR0rjbTiuNNmOHSVWIxKcSaUrE6Y2PKjYrHgbVs 0aMdorb092GnwKxpjEaVTb2OlDjaYmJUiaDFMNolChhUpmCj1d8h6wss6XS0l04wquwSsguk uq/ZS7C6kKimDDC5HBh2odpx5e3lxSeyVKqKqEqhSoVUJXo6K9YPHqNk4kn0k/CaTbnZxn2+ PhI0nHzbb4YfCRCIiaQJSpRSp09nZO2kadtgOlFKgpKFU7dGlYT0r2VNO3aulXkrt4HGM6lW SylZGZQpXSPCTTsHamNkxYmLBBVBCxV+yKBZ6ZabQfeY/SGWXirIWQsQ8QLll21nhC7aqjTK rFNNK2rGmKxt3Pq0eDbhpO3bR4KwrpNMTwrtOKx9U8MK0rpjbDhtxpjRpONsV4YeHMRJ0qRV U29OiNDpU008u0Tap7mjHTy9OyimK8M6OGSPKoqK6TaIZaQPELEpWJQqq2slHc1pMUfvY8/D 480SJtEyaGmjSG0RCbEmxISbSZNEm00iRMmjaIkNJtNNkmZppkkjSSMlTGldtJOKE4VKqSjw TEOkbbxNISMk0T6TaRjk22k03M5uEJJGxIiaIJJNE2flG45OaeTadsUivJTApiqptKkdJs6N tGJhtxVMVgYmCqlXjfZNpNNBJmmQiZJtKpKojRDTaHbGEbU2pVaSTETaTfHxxNIkkyJETwk4 nNpP2Zx4fb4dMVt7tseVMSVKMVMTAqqxJtOKKpVae4rsx7J4dsNKeTVHRk7XsO14dlXmZBgy pYWeHHkZ0oYxMnRmU8i8Ho082plHHh0mZMyMeRpZMVXptk6eUmJg8vDappUpsqsVpJKMSShR pGMTwnlXTwOK09pKrjE2VFUr2aDFe7t9nbGPcdDYelNxVlSaO3u9HsfZj4UfDbCnZ0hppVGm MVim/SfhDzkc+03NEk/DNCbTT5e6sMKrSpWPCsV00K6RwkxK2mz3T7KTqD5WKWR7qmKiPy0k iaTk24mTQZbaHxpjnNkc3D43G8QJCWZxI+0zPJkk/I+Dmm06KlVpMY1ttGqkbbelVsnakDxD pd2QlcqSgYZVU9VVaYdNPFTDSzK5CGECqHMvEsLrJQxpTyoxVeWnjbSVk6YnqaR2mOKMDDIy hd1ZRLSoq6U/NxERubSr+Qwu4w0llYuglZCnRCmGELIQlPlXFVjhTRVVps0Y0ptTDTbg6OmM VTtidNJVe7Rjiu0CUKKmUMNMJYXQVYYUhhVtLjT58NonbjHSVObTo0iOnRWIqYqqmk2Tjx6T zzw5UxZGeDwfBpscjPojTfGRzJG5w/KTy1PClVVOmE2nltamFSNPYjTElUU7VrR0yNTHaRwq QaRVTpo7VXby9mNvYrGFYcTHGfGfaJ9I/DybzScROSTmmI7eTtHBOm2ImKCpNJtRjwdsmEpo cKnyVKqKppK6RuEc/QPJEEz8NPjcjztKezR0aE6beiYx0KqRiiptKorTtOzVYqVjBSk7UMNP JMeztOMOjB4VGPSmFUpJJCRJJn2EbkPyzzzVmNe1HsYu2RdKyxng4ZXDyJiVMRo9kjbppPDT 597bbVREVUHbpd0VU0llYuQ0qo+fKuKrqtNoaWYWYOzKz8wQqq2u/HbtddLCpCVktIdodOkN JWWdoQs2w0qdIOnarj8eEkGUYcKqrDtLbja6mVVkNsLnbK6W11kLIZQ+poWWaYNsoQ7ccJU0 lUlSGkrHar1dxKqGaUcTtVVCFiFi5ZLRDDDDCrKqsLspXSpxtsswwswuwqqhYhZD104zldk0 2wss0suhghdKkFVPUpaOLsIWYVYZdpYYVYSNqqqKWLrC66lzppku420UuXKmUO2CqzgptJgs XJFyHa5UdsKVQUYoS6VVWcQ8S7U26aNkOKmsoNiEocQ0QdoS4qcNsKSVQubaWQppCCkpUVLe JXcQZKdEOJWWQspKjpB2xgz9nNrq6XXxpvrPXazow4hUqpDSCqqqUMLG0qqQpYqpUyhVKrLp 6ywwwqxXljFK000wxTTRXEVNK0xtWytqlKnTHZtjpR7sVjppTTSUYqtNNqxTFHbTBsrfE3xO EnOb4TzTOSfbTiqnQnSqaGDStGilMV7K0aNseW2E2qY4pTtXgcK7ezSUoVOFUEJLJaaWWXKs IdlVlEOLqtsModum3amktNMqrnarpZ2pCCTiELtrOlLssobSq7QWYMLpZLEqrJdrqiXHbFUr oUsqLqIQyWSw2upZZVhK6yULMKIXY0xTjFaccenHHTFOhhxVSptivdJNmEUrasYqlYYVJg3p Ixj2Rh0nEdqTtUjyicVNE00qIikbR4HTyV5YlKrh4OMYcTCuzGg4UKpKqaaIiRJkmJpnG35b fvbhGitNIlKKpKpVTQ0bdJ2aRW027KrGjiilVhjSMYhW1eh6OleWiTaaacSPBUGx27XwwKrT QxKVSdEppVNFcPdXpRXg00jadMDFDphwqkqqqKcKbMPT2ONnu02rTFYxjepHh5bNpKewdo7P JUbQcGngaLFWHanhtMVW+IcmibQjE2Q0ifGVpJKpU4lTDbp6djpppxse7iSSyEsEkqSs9SXQ posgu6WYpory2xwmzEVPTQYmkrpichJp7Zz7bJEjxzPD45qpK7TyRx9FYro8sYnp2xKo03M0 cknmjjmc4H5Qc0yOJONnEcJJM/e/DjxJNsEwmFfCmlJjGJGDFKunRcVw4FkxYwx8XEOlho8v etMkaUKsSeXk0cDyrRHyrbtjbZpitPKphpTGOz5acLOkOKUsWaVXabZVaVVdoUYcbVZcKUu7 dIdpWMKEjtRoqUgSOxt0x5aYGnTFVMcTRU4Y4KVxPJ0bTEV0aeklTSvZ5YcYbQuldZdZR2hp Kl6UllhpdCzJCaaMVRomMFK0mTCO0rT3UNqkih5SvDE8ppSVhp4dpNkr3HTtKYUwTETSpGyp QrZIwpK2lSmB5e6vLRjbGmzSpcwgqqdJSgygsqQqqWU6aJSulCEIKoIIOmG0ErMMDaUxSeE0 jDTidOk7cbaMKxI0miJM/Z+k59p8ecTklVRiopSscadGzGMRtK0lKVxjCnhWO1YlbVK2caVV CplCFUpVQ0gwkqQuuylZdOOmzZsrpjcceFV4OHCqx2VjiU7PDaqxXGG0aVOklaVjjRU7OKnF eUUYmExKqoqpWJ5SUo8pVK8Jp6KopWNtk2PLRiu2waStBioVa9NnjkzkbyTThuJ9hnG4w4mk rEYVsYqSqFO3o9nbttddVxBxxVg0xVVZZDKziqUllKoGkJYWqXV2ldswptdlJJKq6plKplDi jCGiFlMofMtNNIQlVtDbLDSG0spWWU6YKsKQggbV00iMTSKqqOnswxUqiaTk5oiciSTOPMmc +N+mns0hhtKZ276Y6G2HNJKrt0wlIuKsqKqZQQyLLpCqV8jRiaJjHRUMSqqUwk0U91cjyc5w jmRzNCE3n7kaaVFVVDRisG3wJtUqqnmolez5eWmmnuxWmivTZjbDFY+Epg9mOjSNpTkjbYqp VU8JOaJtpEm0kicfubcnJMcTEjDClFbdp4VNPl0NGkfs8fsh4nIJn5c+ibSSLI8ExJUGFYw9 NoVwxxoweZGc0zkkiM3xNNIk0icxxzNIZCbTRvNpMOhtNMRQqVKNMEph5YY4MKj7YQeDpsnl j2aYjZjHFUrqjxdSzayUMP0XSspCCGlVTiYnTp0Y4TE2MSpVJ5YxFZzm3NJCEPwefp46fEwk m4/LbkaSTkJ4ZIhClSunGNQtRto2qPCkjhx4bceytK0YVi7pPLpjExMSuk6TE06VFVUxUrGJ itqm00YtSlHljElNG2O3EGlaUJITbJiSZG+j9kjnMkn5cdorsjbyRTBCkU8K4saJtyG8Hm6b b+LfhN9EROSRpJydIk0jaQkzTfh4cRHjSbTJtpkjIiST43CTGTJsEzTk0RxDORJtuNNtzmTT jKYkyHsVNOmFVWY4bR0ps6eDNVjVM8GU46cOEcTJk2IQ0RJi2+nnnknJ8Gm1VGjy04sTTCUr ErGDDFbcJipSNKxHhpitqxBSghPg5CcJ5zcmeNuZOSaEw0opDtj04+HuxXhxsou4lVKrp+ME vFmXayZXcWVOOJIQ0q40ZWSbVVWQpxC7L6VW3TSkrOJSpZKzbbDXGGDjaEFRhDSCSHSF0Nrr pYcSus6YbJISusyuQ4qbXbVS0ghg2VLGBU4xHs7eFdNkcQ8MNK9JSdOJtohthd0lhTJZU0pD iqip2sVFHlVbPc07K9xU8tuNqmPdxkk40mI7GM2nw+rZMY4jbTtFTEquIxsm3SyQ0slNvLSo 6NJj3YxW1dmnEqcbY8ulKTtodOMSsaYKqVO3FRicTauMYSaSojTRnHk5N5vMm8SNElTSKdox XSTBj2fCV7jp0YxWkKjZo4bbaUpSsSeVVjwHoxY9FlxJ0MpmGY6erp48c8/cn0TCTEiTb7SR JpNj4xN4RIJMiNyZEk0+iOZ9n0m28jRElU20aSaPliVVeWIe7RGyVFTZPZxHFdqSqRVEnBNM VRpU0pWNKqK92nubeh7NMSPkJNIkaTz9yaHm5tE+JQ27XKsl1KtsLFVmiqUKu1WIKVQsqw4l ZgcaJJQLsIyhVDFTy0aYVieFY2rZTE2mk06HStnFONpshikqdDt2aeDGNIp4cSVUY9NvDwle UpT0xisKmn0MYbHaYxt5dPZ07FdmMMTsVWKK0iUaUxOJmDbwxEmg4SUenHspppKcFVNpitJ9 FVNKx6VKjTDFGPdXgeUEkm25Gzk205ONpEyEc3NI2mmmiQk5xzciTfSeeTjckhyJIghGSTQ0 yRGcjkkeE0mmAoqlcQxSVWz5eWMT5YjSuMMzbDzUGho9k6SbT4eziY0dvhtttStGzwxGMY0j bgqlVG2K9JSqrYw07aMRzjmeQiJNvJxwjxptsxisbezGldMaem1baNpsrG1aYRWOm0laK0k4 pjGE7VTSmGNo4kYV7tJJopUqTsxxPycj7c5uROZ4nE5OTzmmlKaTGCsSadsMaVjSaMSVSpo9 jtXgxEbGJwqRiSoVhK1Uh2E9Ow0p7HlXEI2jTTbImJo888D8s/CRJVGMYlTGOk6VMSHG2E2p 8KkmlGx2oaaJRsqDT3cfDGiuI0pSvlU0qmm3hhxxtWOFYm1MYw92Kww2cNq28qnE0w4rpjDR xxjTasYxp4VOFaSsjpoJK9FCq6KrTpiHSdiq8PLGjaU+ZxtpKdsnTwyq4rivTwVjT0m2hpMd PZVTY2w8sMRStGmmG1JtSO1TRp2rjs42eVMTip0pGOxTBKomE8GBWlRiSYijaTtxNmyUwpgr y6GiNNnFeSpjy0PZ9ldJ6bdkqiNLEqLIXDXbHurwcKYMTgV6IJSkqgkyQaE2ImEyEIyJJJIk 2kk0kjGhMkJo0mkJCTIjNI0jJEjSMIaSbSRMxJppsiJNpMxJCaRNIkQkEm5+5Pw5+nG0be5j ppj0rpWlHh0xKrph8Hk/DzwSaTJM3OI4NCUryxVYpWNOmNNnTjDSlNMTBp27TSKldtuBpg2d Ojy0xQ4Y7NIk0iklUPSpipSvcVUqtsYYPLSaE8NpVKqThUVKrB7IxtE8vYnRok7Q8qdJNJKp 5eWJtjEmyk7eHs2ZSqYdKkIchJWoXS4pgpUhZnE/THI/ZMcyPtM445JjBXs4awaK0MVNG3pP hNHGNrJXgEO2DKpKXZDtDpCyDZVKEIVNpQksQ7VXUs0u9UvS7bTjKlw00UZKkCVmF13GFmSG UuEIKum11S6qzpDCUtlLNHFNLjAXJOMFUIpLiRVUinTBhttOlClFWSLJsYdMVNGkw0NDGK6d Kx0jZva8TaFKr7GfmDbjJEkxIkafo2NPYqYsTHhgVUV5bTZt0zEDkiaTaTSRETPonEyJpCTy EtNzmcRJMSppJxtswryx0jpRNlKpXaViRWkldtExXbamlKqumjyflxOOfE5uQjnm32ciSaYw YwU2hRVaKpPDy7PorhtWFVt2+GDZt7PA6Ymk2T2cUpwmJ6bUwMbSVPd7vlNKmkKodMqNrA0k bbSkqpCFUO3FliqC6ErLsoLJUpC5cbSKrtsYqU6UeTbHEpUquOzSaVKpBCzNErIQWZWW0uqu wQSqqaJU0xFMUmMOK07YbUrT2ONmittsVVdMaVPBiPBXTisKopwY8saNGGYk2YrQbD8VSsUu SVKNLKS4vUQuqIc5tJuaTTeSSRxvOeTc9mJipTbbG0m1UpopUqphIOTJJCIIjjzxObGmlYpx VVjSq0eG1abaOmNK04VpWlbYVjbasStKm2mKOMbcNpMV0pVTSodMYqVMSmKYbU9k0nFKhUqS GlYx9POJAkPp45zTnMRuaaVTowr0Gho4VVUqYVOxBUw22s0lZ0hS6ErqQbSXXbfhvw+kkSZ+ UyTm5ySQlI8O1O1OVNKHHuwwqaY3pibm5P059p5pDSYj6OJEVMTGmNI8qnhK0oqaSeWNJU3j nM5DnJ8HNyeIJo+JOZxnPOJxxo3mbeJ4mObmkNJIhPh5PtPE/CVWzp00SmmITCYbSdtobKwx NnRMVSimJKdJjhFVIeQRJCOGQ84zeRnkD5u4PJuI2TJpZomfIzkNoObk7mEfCT5nxzmGI21J NI00lDZSo0qq0bJ8cQ4eeNpJJMnw2m3g6K4ysvBPRgXBmYDJSqkUmnuhXEp7PDBpxgVTw3PH NI9vynCTy4iSQ5Npk3LZxPjiZxuTZyObTkbRYtozx5N5N4cebQ488Wk0Z44kJ55tzQ8ziEjz bcmzTISJzhzmXMSRNNGiSb8vj8vppNqnG0px06UaSpiMB8ukezx4h69U4wUwgfYVdoZaYXQ9 VLKqtMpQUQghpDKXGxlY2qp8s6UpZxlVYlhx06XCyyVVMMLMLEsLMKuLEki66rbaptDKqEOm V2l2mW0IWWSwllKHTS4yguo/On8H7OD8pJIkiMkyTarbDhQhZpSqmnZVTKCDJhUYS4pC7a7s KsjLJUysgqdMtIfPZhTw2dOzTSVStMK+W2MaMSoxT4abGnGHpjTpt0qPdPCPh8vQ0aJppKpU emMoVWlTJUrLMHgrWSYm2J6YeGO2K0xGJpTdqwYqoqpVMHHsewcJUOhxRXHZoJpJt8nkrErE SbxJ48iZOc5ySE4iSbPyd+DEhNNESfSMVNPBDSUppFT5NtE8tKmEj8vNzyJNIJEhI0RI0mJJ z43wOHw+M0ZkjSMSbSJH0mmhyCcc3ORzSbcm5HCOTNzTcjRNxNJyHJpuSc5kc4nCIk5zmcjJ zmJzHBOcSG4mcmk4c5yOTJzccjkbic5xI4nJJJEYknCcbjnBENJycmkbiHONJOE5ObSYkyST HMkTHI5JpxKxJjSvLpXhWJW3QViRt8TPJpOHNJok0TEn8B6UYqSlenl042xXFSqrGExNpHD4 8fBD4iZj7STbTQQ5ONIkkPIPIhNE8JNzk5w0mSSGibJnnJpJyTec2SHJyRzmkI5kfRvpGbmT jiFaAqoqp5OkkaJUmkMdMZz48xyRJHg3JI0kkRvyb8vpE5pPjc20mSZJhKlEmK7aNGErHw9m zh6YYS0uUSlLCXakKSpZYupSrC6rJ2Nm21ibUnhXDjSmJo2sg2mj8E5sjn5PwmmmieI5CciW 28Dj8tt9MjOJIkzEZDJuH5Z9IkkaTxp2xitvCsVtMTSKpJVu04Pyjzjc23ISSSbeb7SJ+5ht VGkxisJjby8MSVhpomjpjEmiqrEmFRVKVFHu42wdtMNqeymKxVVFeDt2OkdNPlOvTjaeWj3a R2sakjFU4VUr3V5HlDZVTp5Up6ryTt6YnD4PjT7Y5ETaTmcRJMLQpTLx24hLTxVxCyCqFnSF koQqQhCniBCDKyrS6EGiXqVyEvsrKbSpZpSww4cLLtuMDCGlzTRXhMdpjp74jppjClTCvY92 m0MUSmzFaNNq0r3TD0k1MMej0m1bRijG0xGnhxXp0r6umHSqp8DDbojDp20mFSTSMRpRhXZ2 k0UYTRg0aAqK22Jph6po2exUYxjitPI02NptRNMFaTSSk0lPhgo4PjzZpIQmgfbm5pOYns6R SYYiSh4cTdTaobcYJH0znPI/ZJJzSOTn7MkcjT7ZI540kSbSZ5NJVVhKY2zJPwVE+GnzhNNH GPDSTFSVVTwFTqomPDt8Kxoqpg0rGlYYxVPDTDwx9Wjiq1tCTCFiyCxhKykrKnSGUqkEdvdp t0TTy2m3TEqnTpiSuNtOiptp4afZKRpUVKpthxTSmKpiJinTp4bV09PLY4VWNpWTS5ZCkJVV U0pKkoG21m1w26MHhVYlPDo9nHIpKpIqlT7TcQ5HiInk24iJycTSJE44cQ8kTcJvInJzcRkj ec4STxJOSZxzScc0NJtIcm3kzybkeIJo59Hknk87ObTDGYYwjZGJoqtKmKUxCOZN45kbifbi Jvj4JNk5oOcTSSCc3HJybipSpVGIpNtqxijBs48E2pRNHEYcUiVRoqtGKDm+xkkmSCW2JGIf lx7JWK2enbTR7MV6WTFNJHb2cNDY49nGE526UonpSqVQSpKmZgihw8HhRKrDoabYKqJU9nk8 JVRpiSrFTwPJ6UqlKiaSngldDEhoor2YmFOzaUekbdJ6VXTEnQ2rSYVoRiUUVOIzTtXk0qIo eklTjp2r0p02200piqpNHhNDpuSFWUwjEmMdJpMadPDZ2xYxXTLtxx0rpOFmRYVJ2qoYqVFb NnZNsYNJVYzxOJIjnMiOZJjk2qYkpjEmKk6dFSq7VJtqXDDHTTTSq9mzaaSoex5TBpNkweCe yptKkUsqorDHpU8qFPjePORkkhpJJPjbjniSJJpv3OSM3k0iJt4kMJpNtKV06JKwOKSqVXRu qV0wxTGjwaNpVFcYqo2aTCsY0aTipporExWkxgWSthiYbNEaMRU0TiRilQV26TpO0pitbRpp 4V848OnTohV+jL1DS7bJZLCyza7R2lVVTKq6VVSrbvbTKqrLJVYubXQs0QpguhLiS67SrCEq m2VTaqENsWFVj2YdO2O3oxMOnRpXaqrGNvZJx4U5J5VUxpNCuivCaaV24OivZ04k2pTDGHsj Gng6RoYkqvDpqMqldr71qvZjGlWQspldSSBpVDiSErIJQsWSdNsTpKwU9mNFaV7qwpTbpjpt 0xo8jtMTiu3TTFYxtoxUJHSFUiqSVUpWSYBgQQVXDswem0xW0xPZp7NnsY28MWQLoUq6IUyu wllYq4ushKXFR0rpUpW2PKnGmNlNMMbTGGmkqSVVVQpxtgusQhpVZ0pZt0mxVfCY6cV4VwVt hjztjJOFKkqHFdtJiJoqtPSEmCtMOnlt7JGz3ejGDynarJTtgnhM36fGH20+Py045JJEkSq9 DEHZpK25xtxhRiaYjHw85PHOcaaZyZIyRsOSTwaY7eypiV7ViV04pVONCbPhuJojcRIOcc5v 0bk0aSns6UqYamhMSUxs9NPLthW3G3HEdJ0rpKeGhK6OlNqMViVjGMcdpt4FSpKMTwFTDt2n w7VTHloOKKraTpxG0aTQ4/DTjiPt+TSSSNJtNEyTSSDnOcmiRNJz9zm5Mk3kJxISNJx5B5ye Z5HHxxjmmi50cYrGOlaenbE2298aK7Y2rTBwp2jSns6bbdJxo00qsVjDyww0qpUqjblJxo1U psi4uJxUm1Qp2qqeW3hXbiicYwpGMSKjwPO2JJpQrZXCdKYxWw2cGitBMDqdNnSmyzQ8jamJ iU+FYpxtik0rUw0x9U0abVIrGPCsVPljTSdFafCRoqqKujFbMHvR9VDTpl6hSUIQQYaX7IWY XQhsyqqWeoIWaVSywuhBJXDCqyxdWNKx00w093G22lJuV0Vt2bY7baVTbbbs2rTSq4yVPKu1 GkpUusyphlVhYshtZLJlKRC5GVKrITtZVCVRddU00wldBdUqhVtKxFLm3zJZBVCEOOFkoVhH kqqeFUpw2x2nl2PDieGFFmjDayW1MqYFlKNqoZNKYaWSXUcQwQNIRSmqKoLk3G4JXSU2xgqs acY00pVONMbVxXGMYxiqm2mJ7KVNNkrTZtppoYxxhhsnE0rTSp0xtpjy9Mdu2OClYrHbTFdq xjaaVppppNvDtocOlYVSYmJTpoMdsaaMeVJMeGOhw8GGpEnLIqlSppRUmPIVXTaivRtPZGh2 qRVVWk2laQ1TGPDSYYxzkeQeaORI/KSTnjfHxDRW1eE4pKbV2qTHTnbjGDDbjDfZ0OGnasdC leyKMdvZpVcTtWNtnDErCSthtMUc3H4czhNkiQ+x8cSQ6cTiniinRiWVkjKMKVJUlSyK2duN uGPhjja16ezZs2yunsw0xhtUqqng20dp00Vx0xptw2qpUryMR0xhWmFRyPI8mHHnMkkx28ON JWkwqu0TSmHurSmiqmMOCOTONx+GTTPInGn4D0qVVKeyitDBpU9HR7KYYONFUrSTFUry9GI2 2JXlJW0YPtxtOOFVMY8KmKVTE8sG3uqbVileGmiaVpophUxMRWOk20qtNNpND2VI00042m2J sMFSUVK93ZxTtjTCpVSIMLKpINpVXXSUqpdcupVo2559H2nOfbcTJokTQgqDCMEVE6cSMVOl Eww8hPOcmkSMkzkOSTcnJybOQkSaJIk8OOJDmc3OIkxETzzeHkEmkyQ0RE5nJPHlpxSUbU4x pxjtPYVDFOlaUlTTBZkaVSpxSwhBhUpBKSVUTEqFOmjh0Kwrc0iqlTjtMSZEbzhyefTnxtJF eDEeXlkYUmmNK0mlDZSP3jnH0iSbc5tEfSETaJCWZ2c2+jnNsiIiTCDm7Tk55pjzPY0hJJSo VRUrw6SmjCtzwbUr2cY+ZofNpG44kiEj9H0N+iM+ISNJpNuIecj7+FDDpdVVTboystCF1UPF ksIKnH4lhhZKjirCVFUPENKQllxCxCxxKzKyjNxZlYUgy2yuoyshPTyk8Fd9nk+rhMaejCe6 vJjJfaMztVxgzySsryLOAywrTKWZMsRkxPaVx29VZPdFQ0qRVbJhKk44jRU6dkqo2YbV6VG2 inRMdpNCYnQ09HFKlNqVglUrQ+Y90OmRl2950oOFgwx0U4yylKVMRTT29FnphVSlNqfFV5mY vc4zJwu2VMp4e4zGc3BHNTR8fEmcR5M5v3uOziulNK28uE22Tip0mFYjRNnHJz7bOJ+9JEIn 0Z55xzjaI/cj4beaZIJJKUlB8pj5duKrtxt35O3SdlRhVBhDayUqtFSl1lG0PkrKIO3GK9ng 8G2NqlVTSY8NNq7SqilRUppxKiaHko9qibbdJiqqnur3HaqZx0fLs2qRpWInZ2pGypKXo4qV xJsqg7MVtMUYlJtWmjEVSqnhXlWyqjGOmkqqxjjTSVttpWlbU2rStJXQe7bGK2TSkdCbTaMm HMmIgmknMsuGpMyswYxmM88q9T2yqrj09m21aVjHpjGmFfQrFaVMSq48tGnl2VjpKbO1NDRh JKSqmViEmllllW0JUlVZdDpVNOkqK2xjoxjjZoaK4pxTpOOKaKVK42xpVVVVpjjSqYrFMcVi MNOmjabYMdNsakj7E44adJorjyk2J20UrGJjhWiRhhNpidptGK9DFSmjpxG3k7R0wFdmkpRi yWiqMGFJ6TtSaOJswndSP4H4OfbTRvMzkSI0bJoqlKRVSg9DavSvds008qnFRpVVtKcViDO1 YDjRxKrapiq2pW2nG21cY2UwxjhQVKB4o9+PZoh5nQbFCTPibchPt59PiTSScnIk0gfIcRiR E2iJMTnHIeTbkiJNJJ5ziTpyOnE5DkbcIkcgyUpTG6kmmhrRo0rFYwxxuc4444cc44+PJJyc icHyYufE8w98bh0zXOSBCZ02cdPCPAmmehuTCIETCaMTQIgRJA6Zu23cDm/ccb0ZeHDO44Eg R0P4J4E5OYSBJhIE0CTDMDHHAcWUnQfZPvNQmWhmJsa11Xx/L/t/oPxeFnHwf4u1F0xisyMa mZGfrZeHR+jlEpRYkJEGT2Jm8dybYomjuSRw+9N0YsTuncrtUJan/OWE/kqO30Sf3q9NoVyb PW18WzJDNJEO9RYsEeSQTSREpSafxfwfgxtI4UNtNvDtxH0VVeVemjHhphp9mJ6VpK42w2ok k5GOQtNq2l8XWpTcs5bJYiJbLnZLaLM6JEtuTluWEmk7Qk3O/LbT2cjD3n2flNFakmP5ymSv 7FE/SU/GSo28BgR5/f9/vbbbbbbbn4a19/w/De/JV/W1CzJ7FZKy0stWaag9ti/01qr5s+H9 PA+ZlX8mfPP6cl00wWsqI81Z/dZ2++0fvUiOpR2mmeT7n2n3slixcSelJ+iUeSxN82CduEXN EIurd+Ui7tHlK18QrRzRinbGN2p/mVaeTLv01y15TWr+i9UXSumbRxrlg0qYzCKxc1Pd/CcR PRSv6P3v8z+j+T/a/oyexNayYHsYpJNEXptDwZMFya4k1XpWcYXJdKsKlmnG1mEsoVQyWNtr GG20qbaXaYaKssMsG2mSzZK6zZchlhltdCGmjSGirCVW12UtsNsG2lm00sw0isMJjDNIvSKX cRqibUvTHJVow0Kl0UtactoYxFZou02mu7YMMHKqs8pNM0mqmOTymSKtUjdF1m2Vr2tO77M1 VpmdtOSQiLSzS69UoUiFmGVaw2qyibxY3TmGbUzhunMK5pLlNObWKkRxxZCrTK66V2koSybV rBdVCy6zaULLNJccbXQbYYQks4hxLCzS665hhZZZZhdxVtxZxlhhdVdcucQjduLLqVbZaViu abply2q71mtMr1pzk00zRHNUml1sbhO7U4mVV240yws2wrrKEIK1gqVsxNdqo5lXS1sUmkMt JVY1ROkWm+tzhe1IvraKRyzBPD3TtQ0fMqD4VJa/6H8P9H9GxxVmbnD/WzR+bi/ZfpcT9WOr PVk99+6dReHxP1N8f6LlpQ3P7X/hd/q974N/tx172K0EpIPbEkYpEe96HD4I4ScnRckaV+5p jGjSpjSfyf3m09H5ShN+fr/m9b/nz27dMfuV2pVVxTFbUxp8MaaTkTn6c8kk0/43Pjzmmn7E /0tJhVbYMVOn9jTSlfm7fDbZ2qqGa9YxLU08U0h/gTe2dWnW+r3Zve+Mxt/kQh/JHM/zOb+T 445P7nNxJpPj/iecarW+abdCpNayfmn6JEcURVMjZyBI2/EDkbSNvMkkyQkTRIkiRJNIiRpk 0kRJP+ZORETSSJImiaI0iNIiRJCRNNNIkSJkyTSJIkJIQmk0iRITzG7+r2cWbTTJFfJuIzWu y/bfG/W6Pa/J6v3uOyvBpT9WCY492XTE/sn8Wk+i+783w0kT8qk9Sv+L81Sfq/VO2k/c/i8v DtU/wU+r6TETFJPzOKhhj+9Sqj9X1YdI4qrJQjwelY3czxWLUjvehisiT8JzSPkwmXfYmmpx pk4lPZXF4/J+OAxQUoj/I5uBIEQIgTQIYD3HFxDJmZR5s4mSPe+JW1WtGFTaoKoPdT+MoNvy lf3NPMp8yn+tPB8tJjs1NL/pm8kbJQtc4zuWHuWPiwTkTtBo1ep7lqV9lxdLaxeiB/3+180M nzaJz3MGLq5TaOUUL1jvlfunT6v8ZjbVn7OzTbw/Y2CigqRAkCTBJhECQKlRFUTwr/Y4f9jP 3NO3HlpifijzJgLJQUoKrb7PrNA0lR/ikKcUHH7v7tEqkj9H1PrNsS/ZiOiaachelBZHrixV +T0RYsPOIboe17Enem+az52pNnk/m1cITdVxukR7Y2FgJECaAkCf8TgcQJ/zo4EjEQPrJsTR tH5flFV+TExXHCH96v7X/QxDxI7RO1KiE0mmiIJMiZISSSwsSQPED/p3m3jTSVPPxMT0VAqo h/e7eH7n9XbT+KuPwYSu7I/FjK9gyllmIPebIicB7R7JrzAxVYPCjVfom1ngxP8H7OEyfnt0 9k8MUr+ae8/3Pk9n8C+XDH6qaaPQhJB9ihNalosej1vZ09dn4WSn7PS5xu7KpUTSRsfoej62 +/9b8Hhq835P1/O51K4XHqxx0T+ImEmCICIEQP50DFQUojTtXgtNE/2EV3Pl7XayLkD4sW71 vr1dGBBOTc8YnEDNIR9WzE+zaYg/gPrPs8134zpH+DafNkzR/nT2V24nhUnwVJqrUMlTSi1O ixP3f73qbJGz83H6Npo0qOUfDpH7zkxodlJ21qajpts+6j3/yPft8/4/++/0OD0VvmN8fP/L /+sMQxVVVVVVVVVVVRE00lWt+wfYSMMUr/OXp9vt93glkiHnEdCUJkyR0kmpVSPzfgbY/Rpi z95/0zfO4nZVOTDubmMbdrx/NX+DoIfeKAqgR7qkI6T+kxhPaofEqeDGzyqP73tLjHGRFRXf +Z748vM7cdNp/9WIkfp+E+knaLJkzJbs/r+UTJCNSHUsfDRx0/c8b6ICQJASAkwPSSqqfp/b p1ttOMA+aR61cBxnq1UfE/xvceSfu873qPm8PPPhbprpU0z5x+LRJI7M3e0i1OO9NzSCT2Jj 6pq6mzb9qYVr+n7q03JKLJVKRuSf4EnST6m0P5JX+LpiQ2/vmzR5npcEdK9GJZ2WTo2GSK2x ajB9X4NNDhSH5fvScaeDH+Cp4V5m5vhB9ZYn6q0r1P8X3e7Z6fwdJpHw2+Jk0+VFnjDpJUum YsTQLtw92iqEUIpzSTjw4fL2VW34m0eJSeWxJx6MV/BghxKiytqp+/ts8MxM+R0mNP0UTRUq lVP1mImNK+rDB+e31PaZHqfi9n0bSSOffrTzj835rbbbbbbbVVW1tVSVURVVUlpslkJzr+Lt IdT+KTEPzp4jfbuGH9XCej97bF01o1NB0rSUpVHTJMe7jJOGZGtpifM29kf1v8ej6nJJKYQ/ 3f7mPxnqfZpe8H752mP+up5qdulNGZPklC1JR97vWtLybrCQZGRHmzfk0XoHjB2fV+bpdnbo yaHTU6q8fK/ne79Fz5OlnpMep/A9iJ+79ZP21Ik9PhiRlkJ4fY/A/tfDJX+StZk/mnb8XiYn 0QnlUj7v+LDalWCv7K48u2P9jHy+XuP1XncvTNoknJNw0X29y1q9aaes7bPdRLReXb1Hk+EY X+1hytLJOJ+ynbGPl+T8XG44bmT06m2szJtte3G2pXe3328T7MxwZLlr71y2WVXCWgtN0zqR DokSeaYHOTm3lsSY0mz+SHPOxznGnOJMbzxzyOW225ZnRkONUzUxqZZWYZqnxDeRt5oNpNtJ pYSEhyDk2JbGkSbSGZLBmKMypmJWVe+rPsZT8oH9n+FVWq1KVVVJUqVS22JH9u+Phvo/B+Di zRZVMmInp8NMVSqnyxhjG3zqam0rF5qOKV8WEZKsSfM/5TRoncxJiPzenltPq2en6PV9332/ djqbRN6to9S1a9KRZemmm6Lk04jscdM45I2lZLJJ9Zpik/JiNu2E2lH6Nz1maiddZB0WSkqS vPGixUj9WPxXuf9mvbHhzN/xnhxxhimYLPD3H7W3a/J04i/uyT6YvQ8M5J5v7H+d/zbf20nT /Mo9ivh8sf0U23jpZOe7/Be34dFmjBp+q+c8TaSKWdq/Nl0epT7mbXhpkveZTh7XhwdIsser 9FPsjR/WSH9mIPd+6efJt74YvlZipF/FtouSC5KcoTSIr6/V6vV+P1j74kIkI8Pl6X2aKppk r+D9Xyv22r9Iw/R92JnrnbaalTEqT3dN069T2OlK/CVPDppoypP8a6dJiyRT15n7tsl/dOEx IqzFqVokewdErrtIYQw7PWUJtPxsrb/UrfqVVf0dMfubPDTWjFPDY7SWWPST+RY+IeGDLFFS FJLU5S6JHkxi0uZpl6EE0R80R5+Xwej0ej1xF0vTL4vGT2SJ9VEfA/NX3Y/g0f5K46b424rG ONdWfZw24bnRQdxNoxT0n9lp/Qm4n83E/dMP2r/Qqiy+pn7OnU4r9rhyY8xwn0VE/vSYx4VI 9ifabT+E2P0en774/O0pyy8PCGYq1Ved24Kf8Guo9Hu0dCNJVk/OeTbUk2kPiJr6P8WPxVbq dD6zn6T8j7p2epDbt2qq2+D/sU6WZh/bPrK/4yz/qfMfswvo/BffPjSNJpmEzGemvTDb4n+1 tpqVtR+JRs0NyrP0YPq+7t+h1IR+zprwOk/SZ26cOLNtXpP2xueYRt8qnumKlYmnI7YkshAu 7ibHMdc1lgixN8X8uuVn7rv+nu+K1dXVtqLUX+DGyZl/k/zf3fjzxXbvWma1mLVl1mY0rI1U //nE+v+uCqSZHs9j5va8PDUeWWmjNf4sXGWybGhn3f8ep0N063nU6vvvIcKi//syGYlmlGas apTNGaqyzMkaTYkSGaTYEtMwMyWZGaqrNWYWaqzRjIY0qYyVmKZoEhJskJCTNJtiWJYEs0mS NomCRkhWZLNSzFZqVmSsyWaDMWZTNSzVmRGaqzKVjSxqZpZkZlRmTjuY//Doxf/XH7R/sj/T HxHv+54Q/RT/MxiqpWP8zDaqxivLE2qbV9VaU/Z06dGzFY22rbbH6scVVTiv+ap/FD/MgWZf 0rLKSs4l/vqsKuPB/zEDKjFgmzbm7837VypRcWmoqk0SRa0WPSsMWL+xwjBVk0w0cM1jdHSM F8tb45pXRLCLP7kRin6UxT9DH7IXf3PVnBY9VZQ7Vx5bE0xfOR7e0ya+zFfik9mNMezy8vhj pj/k+W3u7eHasbekaK9n5lWJD8WP2ez09NqlUEPkpfoqqVWeLJf7z4ulD2Kx7K+r/a024qsV 4TTSq/zvT3bPd+7LSVmn86FUoNIYQ/rXZSeKoZfwdNLsMKtMNrtNJVJYVVaKqtqqoShVD/S4 /Z/Jg/nWaSbSuh2pFuRdma0tjmq1mV5i2V5qvdVJhZeyLFSrSipjEUFLIBBFlMhjZQQjPDgz lZWUq5XGWGUuF5nadd2whhhmvVn+iSrDi7CWX5+Pml2nq71Z0wq4w+WYLvxdVhowS2slJdIq 0/k2suy40uhpVdBthh0q7dq6aY0nbOnTjjb6sT2emH5KYr9WWT8U7X1dSq9utRC0T3abfvim Ke4v+Xnldxuqn86yyqN2vXo3fta60Ssfn6vjDx/01kukNvX9Lt/Owqh2suuwwRS1PH82rrPW kVrLCJd3Na71ybvXrE2T32d11sNlyTCqME000oFaYWSw/Fi6VkqoYVxbCa3/ItFmU02rBgxW 3daWXTnjglywvSdRa5Mk2Dqkm2qy/2LH8mX9Djp0020XUhdVZw8Spc/JewWiSqbwXsUlXIuc MTVakmYLlMuLF111F1iqX7LP6Fh+iWFMtP3UpsxF+fiuI5u36/4ctU6WaWQ+Sf60P5LeilP+ VMiNktsEpbSYSxkpBIEtLaUm2JM0gk2k2SImaWbNJm0sLMTNWaTNUrMKMxVkSSMSNJhJjaQ0 sYlLbSyW39r/wP+w8/+Z/1P7nkP73/kf53/mbfzV0/iw/mqaUr/c/6GGkqpt+T2aH9r6fyf7 3OfH/rv7nxvJ/S5zlmkZLJWP0V00x4aYn+SptUfwUMU/8r/imfFJ9Ug7HrbQiI/qf1ubxSf/ ZzYv+rM/F/R/FYXMWTk9T+TzfJ9GTl/RJNHyaJOFh96p+9/FaO5I9b3MFg/7P2PksR2JNWSY 73/RNGj6vowYJLWy8/1v9DzfatLnpTf9kn+h2po1f9WDktQ9Dy/wWv7GS8wWv9jxTWo/i+Ca TufN7HxPgvf9H+d7Wjyfxepi/B+TRo/Nm3eta70R3puHJesXB/e+18X2rn2v60z5ve/6PF/t fxf/d+x/U9TNN/J/k/i0XH3kkR1H+n+1uqvXkn9TVN97ze9eh/mfavXv7Hof1PF/N2OcehKH 9yXRLsSmk80ppZ/pT+S/6y/6F/JJfzrlL+1b+p4ch/rf+8/4nn4T/zJ9/4k5JCTSaSUW/1Lc pJSz/anLSyT/lTlP9rjlJ/sXKUt/4Fyb+5JSNLbZswr/Y/l+P/0//Tx/vf8v+1XorK/3UXd5 PY8w/32YH5Z9yhSlYmtqU1KaRSlKWZ23rb/hbP6H6czf+Qf+rmKE7eLZiepFelT44nE9bRJ9 /D4kh/fEETp/pk1pa//D6JIy/z/j/3xOUiJdP9f3+7kI3kYyzf74z/hbH+O2/jYVh/Tfxv6Y /4ffUfxq/8rdYb6O9f/1+NV8GMz8GK4z7f/nwU/RNomSwyaGlj63/Qz/pFp/UmkO+Mj2Rz2l EpFafJe9EMYnPUt9V28REDD/t/t349ovZiR8zKTJimZTGSImaTNpMJM2SEhJskiJJMaIbSbf 9D/49/SSVB/R9JK+6+D/pr/y3/sv997Tt2aO9pju8d53e3USuFh8/q+I/xH60XP5Cn+T/xyw m+2abue54f4BOscR9V3bLuf4Pma3oj/yX2YRJJE5YtXamSm0fKIetDRkk1TZrM2tyT/l/6f7 3Nl4qRulEnqnETWPVP0nqn0ldDjksfDRYtcllhJJJAAAAkpBII9QAHl4AADkSJInQZmgTrWs zMzjbpzOZmf7NpJ38SRHzJEf6GxLK0mrRaJotE0W/f7z/wv/E/3P/kTf3LEhNJH9//D9f6f4 RzjtRiP7Q/NH/BNqQ+p4Kceyviri+5fIe5L5Kf5WoHqyZhmTMT/r+5f2O70l/1X++f2eXj/q fu7/dP1e96fdGnj+v9ZJJPCH9neeN4P7N6jppk9v+1k/iL/kr5WCqVVf6GJGP9L+9/nfCvo6 YpCyGn+lxVZ/qYcQ0qqguhKWC6y6F1lkrIf1oVQhkyVMLGF1WXSFSrK66yqqUpJVZMsLNMOJ KoVjyxjwmKY8vJp5Vp5YjFbcYaQqhSEMsNsLCWVWVlJJUyuqqqqhCCVl1jSFLrlW0LpKsEpd tttqVx5adJ2rpKqYxiaYxjCVLpVQSqWaaQuXYXZMtIKkKpZQyhSrC7CFjKzCSVSELJNK7U2a UrCqVjbSuKx0xW0l1UktIYWVLoVWVJQslCFV1mUsIXVQwlJKqEJYXQlDD/CuuuXQyyuZaQu2 ZSyyuYQ420w2VXltVYximyqdNtqeFdtvLDC7SF1ViGViW0KoQuhTCF1lUrtJZYZVVSldtZDL CyyP/Z/6abS/t/z+51+H/I4ntunCDMqMwZYVmYkxEyQ5ztsHx/kn/Zv6nP9z6H8P6MT8VOKx +ymPCmHsYpVUkSSJImn7f9T/8Phtt/BkZkm0hpGSMk0mkyTS1YD9rPwz8tJJJ+Rv7mQzfbIb aTaSQ0iTaeXn/3++Nptw0h+qvrOu2pUoYqv/6dNI7fz+0qzh78PpJnnnD/0Jv/S/ef/9Pp/J /vf1/jNjyKx6Ummn/mfp9dJPT7uw7KjbLE1qY83qSehe7PNc/7mSxYmmuXHCTJIv/Ixe5n9b +hxebPzaeh04/R/H8/wdpxlPj+btoOjHhtuYbf9Lt0xyScf6FPs0491/gfvdHCqT0qcVGj0/ R7tv7X/8Kkvf9WIulEyxjL96c3cudPi/4H9owXMH3NJQJpLWLdc6uH+9c9bNezMk255v+Vjq 8TzSiPWzGL+1amlHrelkjY8mLZgaJGDVnB7LDTbiVx7MaeFYUqsdNNK45xpzg5OT4m3JvJzz hyaVNKlVNKk0puHubY6VjtpUO1MKqShdVL5gyXaVQyyldKEMVo0rtjatFYYxtSmCqnStG2Kp ptxxtVaaVhw0xDjhtpxxoxNNqjpptttp/uYmNKrF0JSyqkwqWQlSySRlZD/GxebksumjBdVZ hqlV6JlZCsuUlhrxJ5pER9JzkiRw5vs8TxppWjTRiowlNMNPDbTSmGzDHg0xjRU022rtpNKl aYwxznEiSc5zk5OTSPiezzptjyrtVDFkVka240xtvWzCdGriumNV264HQl2xmGZIaJIic9vj g+2zkOTZ1a4CeGZipYVhTNyVapE0UClSbWQ4rGNrjPc27Wt807UHXb73bPtM9o5bEjJUjEsx OYmJzpmpsnFTQ43DaPWLnns934Nn4aJNJpNvJG3bja3TZCaVCDpKQUJSlZTJ047u7pxq6Y55 I5cuJbPNk7zztwmWVpN9u4+ix12syxYlTaxpoxpkwjQqY0uRL6nbE9m47aZK3PGjSSPCyVQi rIq1U2g07YJp104xpuZNTTeVyXkzkOMrPJeUknGlM0ZbNLbJCW2iRMSzEiWzzfsJJISTSaxu 19H3cIPBlMyjMWYs8Ce7K2bmhEzRbSzS2SZkiZlmqzKzUZqWakxqZSceOLHTuaybZJORE6Ul UVSqjJZEVJpSTqq46W61NbahEdMijEaivDxyozp4M6zo8HjZJNpZClkDilccWm2c24Yq09SD W3TjNRmTTXZrbUY7XjW64nFdJOnHFrubCOkWSRVSdvZtpCyyqqHCFKjSzSY3ddBdKxCIsWut 0lhHaqpdlCkIU2ylQXWdPNvjjkmqc8bbkkyTZIaRtIaTPvJyeTk+Pm2+J1Vx5lbnS7520ydO mNazHS8Go6sdOnGttXT0cVGuStuTJm0kjtZEnJuVNsuDbMFqSdMmmpWZJ4o5YmpkZJDZua1K 4xkvMlYyXPZmm2DafSJJCRImkjPPhz8Pp4Nx7Oa6MnsqJ4KiqqiqVVZmD2uFPawjMurxFxS1 OnVAmUtQmF6vW6duXOu3r1deFVYq4csmmRp5mdODjk7jUyaYclhppmaxxW2sjcr2Um1G1RMV B5KqqqTGsT2V5VqV6cbmnhK8m/CMRIiP2fsSSR5viB2yunHCodsiMlilYmZGnY+Sl+XaTta1 znVufTe3rWUOqzfEx7Rn0s7QWmry0J2vt4edzfFhzzhu1kkTRKmmpk0qaamSMXTWl1VW4WZF h7OkY292jR5eceVYp4jJ5eG2HXON+VeEinpiVjIh2olVCTNLMkchJiW23LNpRCrEqmLAxUT0 1DSu1vpptJtNz0yRtrcs1G1yVMUbY8iTSpGLkmMbYyZNNPU8NTe3o6A8uM4qZqkHoxhZKtqR kZJIqpNTh1K4rivBriuNpk03Zxzi6JOzSHIxtppXXE6VtTUba1w+H+m8bbGPSunhpkgsmKaJ tx4sMaL1Om5XKxvyjpNSkkbRZElfljaf3q+qpUVxhiqpPcxMU/8yNyfE0jkEm5w4aTIw2Y+e HDPuao7sGduF21eWzmbk3ByOOTk2Sbkk5NP/i/wqux402yZCZG0zmTDikYlQr9e7LjlkkcaY jFb6OOU5znEQkk3Ocz+7Oan/JEWQVjuf2RyfgenqvR/m90m963/H+1+zpCXu8Yj7oWIyzlKU nDZcj0e3Du2vn4d1+0O3uhA/Zpk9yxC2PqixhJHl9h/Y7dOlV+TGNulfs4rGiqqqlKf1cbV0 qq7cbadsabaYkf1Uk6hsLhJpUknbXcHj4QkyTJEm+kw5NyTORvo8eeOETckmTnMcmcJibnMS cjaSTHnOHk8mzybybSbyEiTDkSbbznDybkJJNpByNE3EaTSQkkmZJznMOfhx5NJvI5M3wRJy beQ5MyOc4m3k8jyH7pxN8Q3OcOTSSbUH3vtPku2Myx5Fw8JF+rt73RV2gxYZUYjIvBiGMku1 DdiY3JsjScnDnOaRoRiRsTaaaaJpE5KVQgggggVQpVCklvNattXM43qd46xbvmNZmt9XWiho yhKozR3SIof8dodtuST+Ysfm8vlqI/875+YePo4MkJ9FO2IiSJDicHDhxMnORoznJNEbacOT ZOY3MZkTjMvDUZCVaYi6dOBOKyKqzJ6sjtk82du00LEkD2Jr2KbBo9LJs2Rs1ZtFGLQ94j3M SK1CjMmYyyYYmTCzLGFGSMFfB8V55DYiGSY0aAxJpkoYlmIrNJXjOF8eOCan6ZMzbRMGk3IO bSIxTCDjJEfBizDz7cYsWSZMwHTKCtVhHbJPM0baTJESTyHIc5nG3Jtyc5JucOacxJsk0cky JNBzacm3IIDHNM0mTJs200RIjk5yNubE3OOY4zhuZySbNJIkkY4zaaaZEEjk3GnJtISbHCbn Dm3ITmnOHJMTE5zbZTZExJJEQROOcmkyRkxJtk0kTJm5jgr1ZMslXRlWZMwzKzImGFGOmOBJ cVxHFQkRiDOSTNIRM7MRJNpo2JpNpEQE2ZJtOc5JJKScccTQm5IRuTRk03NDm4cybiEkSScS NIkyQeTm0wR3MYkZxppEZDEEYkjSaTbabSZhGYnbDjtOFDnG4i6qugUIH6sPX6v1bZacQYcZ YYaSqhCFV8UzNF72fouu9ZpeaZ1SJU0Tek3p009nu8PZwallio0kqOrJqEq3LMjJGSTqk+y9 2r02rJeaO6aS2PziINcVcO4YHgtM1V8D/t/4sByWs0fBuohatJJJJEkhmwf+6Ts7lHYtWGiT r+797/rGzBMc25sOmMH41p0/Ip/4HpJ/6HPycGPLHh+J/en7LhH8X8GP1VK0w/ZWkaO2MVxq cC6YdMo9rHGp044pZlRmq8OjxV2cXTMzMcYvIm3+VNPIz8XJp5ISPwmjENyb7T/Ig5NjxExn +g1VXHzPKqPNepjzeSnX472eF3ReMXkh3ernl5MZmMzLNJWVPDGSxLJZIyRjsctm9mEoRCZA v/0+b2rm72Pm9zueCjBu8XvbuTyXlCPlExqjuUZs1mqs0RVVSSpD7VEJ7tNPq40+r5fL2etO nHbLSqqyro/EsvXT8WerPxdLD5ttd00y6SwlD5lVtV6uww8aQYQ8dNIQw8bYaabXcZdpeNrO NvGWUstIJZdvWm1XTt4ll4h2uwfJfNvnrjCHSHzLth6u6ZQyVMvXHR02ht4q9bQ8eMIfNIYe KvGWXTK7aXT1lhL5p20u4q9evnTKrb122s7aesuJYNqmFnaG0sPXza7LSpLD5tp8y7evWkpZ Q9bYeKu23T1VLiHCr5dsuqlxpx026XePWHz5dld6XWZfHTt6cfiEKUKIp6KSmjry+PUlPAvC MLi0o4jOBoMlG6ijZsyYw3VWLIRuqmbqJiqT6PqiJ20YE6VG7ESYpVTT09l7NiuKN26xcomj Zs3WQiiSKpIqqjwVDyoHhDhM97Eqr8thGlZtpIkkTSSHzNs5NhBB80qs0q+bep+eKvEO0Px6 rSmn44fJi+RVvDkKdc5UEaz+xjuUXpt2TBYhs3UUWxsVVcLYiqURwqQkgpn8pWilIgUu+Zev mXzD8R0+dvllHqKaQPkKfIfj8G1EUUEtMMp6TYLDZVOKt04iKJFFU6KqrCoG10vpUoaIPx8l 0weNN0+Q6RT1B+IUetfBl8XycvWPkRp8FxL36p2rjzcYNm6rZuvhu2aqrUVShRuqsqRZII9l nqgxKsaPKo0cPqqO3l7NPlVusqzJqJRq2TjdIokVVBfIiMYnJTp48Y9Vbu4/Fn48WcaZeLqq qpfPmUru3bbtlVVdDTpZd+NvsMPG1nSR8y8drPKw28QlKrt82w008cVevUPHi7b5l20w29dO lUKuMuNLPUvHHSXbb1Ltx4q26dttPXir5wulxKUOl3y714y6Q4q+ZdtMmnqXEpS7IesrIesv nS7BUl47ccWKvnqyzi7DjTtd0lh6q8epacYWbfO3T5Jx6s9epdvW3r5txtZdxt0uuuhddKq6 y67pZDS7x2s+dquna7TDpdl8ldTRlpldZU+KoeqvWmW3HSrxdZZ46Zeuku2V2HSzDba6GV3q zD5hpsZQ+dMrqoSw9ZXZWdHzCzbp4shVhCr1lxwglV89Syy+fPXrp48cbXepevDTt8+VcfPE ssviHS5dL1d4lVh8slCEvUNMnjt0sqwy0wu7bZaYXccZWdqcfOni7xV8y4qq4wcdtqrofOMM rnHjR89dpdunjptdc9bbWVVcQ9dJcfHS7aFXrptpdxpLtV6lp4246LNJJXcVaU6eqbVcVWWQ 49ePktvUtNobXbYZSw+VePGkpWS6ZS7duOnz58evXzj5dl4yy2yl02+WYZVWZQwu47VcVZVQ +evHy7w9ZeOnHbp68ZXdNOkKumHbayzLbaHazTpl60uS8XS24q47VafJesKtvErvXFULoQul xZDbxD1dLb5646YdEsPlXbT5V84+eKrNKsPnjLx6+Qq7ervnSz1LS6HziWFV3FkMKVVYQ4ll 66acQdNsKsnb1p828fJaWUwls7cS47fNiGW3y6XSFXHb1xh6+fLO3qqqztCzx46bZcYaS6Yf NmFkunHrZht80uq0yylhld0y7dOLPHGEstJS+OPWGm2Hx27VdquMMu0KsLNPXEqrMPV3bSyy xldx4+fMJWVbaXfLMvDx4l022ww6dMLrKvFXT5tV09dNtu3a71B2y9WfNHrhYyw+YfGnbtd6 slx8u8S22s9cdrPErvl2SrCXTtl8+VZabZYeu3z5hdtddlZl29duPkIVWYbdMOzI4y6VS+Vb bNmDaEJWeOmV2Vl3zTtd42qlpWF2l3HGWHazR4rhxVKWXrbtZ6y8eOlkONtoOnSW3zDxxKzR ZxZd68esNOPnbbiXS6FXqUqsulWHqrt2LMNrOPlXSrC671Vx448YdrPl2HiqyVXr5h2y8YXZ O2VlXTtD1lDLJtd8qlV49VZevGXFlkstOm3bZtDxZVpLpxpt08bQ7dMPXHqFmnjTbDpdZ2hD Cza7CrTpdw0ht49S26ccQ2wql88du3EvSV0Ol20EPnT520l6u2WS09dunqrZdhx08S7XeO2D 5lp48adJesOmWHiFUoYVcVdNssOPkNsPmHztphp8hl6l0lZJ06VWWWdtNkMO2GW3T47eqtpe su23Tp60cYcesulUruOKrKunzTT1dV26evXjbLaHTppLLTxhtx07bdoWZS+VZeKoS7fNpcfO kpZZeLvHHaHaF12llkNNtKtLrPkrIaQ8Qlh29cO0PXEOMpXVdsOnj5pLDhxx6y8dLLOMrOm3 rCrtZ4uldZl6yq8bcNunj18t000q6fNLOJYQ4k+aVQ0whVthxsglV28Qq9IetvHjDbizazpY uss6ceOPmlXayrSW13y758ltKG2SUvmDx2h6w9berLPGUOmXSXrD5Zt2y+bduPnbLjb5ttUl Yw7Sus09S+NMqmlkpVfNLqnzLxxVxKqUsLrLMroWS4l800yh0sslLxDjphhDLpZgqq0ylCrp 6qhV89dtsvUtPHbb1Z62qu9dqsPHSzx04wu4+VWZetPWmHbDTt2qdrtO3yGUNspdvWjjTSXG HzC/rp50lV2424u9LONLPUsu3z546XetvmHz1hlV040lxk0uucZcVeNodOlnSzLDi7TLbTxt xtc7dspQ+Ql6w4uwsdKu0rvEMsJcdONEofLobeIZYYeMLOnjpp2wuq0+XWMuMPUMvEMvum3r arsw8Ql28fNO13HqrJ2saS8cYfPWGHrxl0yhZphh2wus0qlDtVD1U8OyXHrxLpLSrKz1lVth 42+Sqww2hLpxKFllnqqVV22EtPVUvXjazCyXjxlL0u2cXduNINu/V3TDLb1t47elniEtKvko Sl426+du1kulWHTp22Q6Qy7LLMOLu2ErMoZabQqq7S04lDp0Qy7VXccYZXZVPmCHbTbpZL5l 6sqs7bQ7XZS29aVaWVequl1nq67pxlVpZV2s4ll8+dsuDt2wlZVVDiXrptZhLZc6dOIXWS7M pbZQshCzSyT1pthVdVL1hx6u2sh49bO2XjpVY29ZYSyuyq46ceNMvVllnGnqzjLthtZo9adI cfHz5V2w+epePGVmHxt0l22226dvm1lXr1Ylx8l8lp6y8XYfOmT1ph4hxl4lxd4qqSs6baZZ Q+Ss+VdrPDDKrLKHarpC71hd4404uwy0206eNNELNPW3iVnrJ847YQyh8h0hlD588XZWQys+ VPDxo429ePkO223GFmW3TjpZhV44dLuO3rTiWllMJbO3EuOnjaz1hDKrirTshCHq7TLtCXxX R46etvXHbp8009dtPlWm3bDo0l4etsrGFnbCXqEu2nyHizLFPXbjCz1VJ60w42ws6fJPHDLt Z07cbetvHTtLTttZo8adnHSyG3jp229cZYdoZaaOPEIbcYXfIVesvWFmFSXb1Vp4h2yhl0+W cWOmXT5t4hDtdZV8+fOyEru10vFWXTthllpZlp14yu02g2s+Q29adMspabeKsPnHj16lpt8s +XVSw9WYeLu3T5ZD542hDphCXFlWXzTbhY9VSuy9XYevFXSrazKVHzToQ+eMtOIePnqXqFnS zxdLiXy6zbCrpd8+Ss8XcaU26Q4ld6wultDx2+aQhDir50abZO1ONPna7xLxlt24u4+cevkr PHTbtVpV1DbSXrxCo8S8Qq0hll6VaS+XestvF3qviGHTpxdhpDjxC67D522dNNPUvGXztlx6 7bacQ6ZPm2FmWXfzCzTiGna7T54qultt440ylj5h222s29eIevXrx47XbWaaQ0+cdlXSzttt pZ69ZXZdvGHaHr14wbcYQ8PkNPHbt0uw227eqmzTSXbC7xI8KtvF0uNuLPErumHrD1dp24hZ VVp2y0qcWeum3r048fKWfLMPHHbjpCEt6XerJePmG3jCqGV1WG2VXG2WWVXjtVdLbtp27eoZ PHrLSrj5DtlDTB09dvHy7tZ22u9WLtuNtO2Xj129S87cXZLJXXfMsvHyWGF0Lru1l3bt40qs u24+eIq4l2hhd22wuq+cWPlXjbpZtLZMMuO3y7tJKWG3Tbpl07YXWVVdPGUvHarshLLbtl0+ ZYcSlx6hCHzLLDSqrttdLTiXrdnFnyzT10+VeKuKvVWHaHizbTiHF2GkrMFUO3Tt67WVdPlU mkKvXiDjBYql49YbQ8VeNLNqu1jbol96s2yu+etvG23F3a7SqWHENNIdPMPlVXrDb1lCzS6H iVW0sumXjpLaVlWUtoVeu1nFXTxCFXHzara67KyrLthCW3HTxCriz5VVtd87evnEvnTjCCrT LTj08adj1dBVLSXvbarxhp6lCrCFXa7jSq75dlDpLpd6uh07YaabaVYabVVdLuNuLPHGl12H baXjKEPTDj5LtlpxLt6y+Q6fPnbxtxpx2q7OKodPGHTC8LNNLOHiz1t8046XeKvXqEtnhDbx Dx8l07ZdNNMLPR87dMEsvkIWbfMsoXfOO2Hz18+aVWbafLPXT1p2wfMPFnqXR68eiXbaq67t Crp8yq+NHr1plZ9FVXr12y8XbPXbt2dO2Eu1V3a7SEOzj5860l2w+VXdtvEvlmW0PUNMMvmG WUrMeddLPEpabWbdPHHrUO3xh44ydNu2ztLx07dvGHb1l62wqZfLvG3bazt2+YdLsOMrJSwh 2u+Ku3EvXHzx4+ZYYdquz52uw+dqny6zTLCqqrbRxZh0WbSq6bQysylDo2+ph8yypx2s29dv WEnz1DTtVt09YJWltDTp0llLjppZVD16w2+dNPFSq749Q6ePnEPT1CELvDbtZlKrL5hh87dP W2mHiyDS7KXbxxDj1CztCXbpx86XdJXduml0vCy6bPlWFnHG23EsrNHqXqzDD5Zp404qsw+X ZQhk9NM9umm2l2UNIVVaLqvnjLxhpdZlhLxxttVx4wy9XZfOPna6zth68ePUvl1XG3q7ptt4 wyq22hsusyl29XSw6Qw06YbbetNLIWevUsOLIXZbeIacQw+VZZS6etumEIaPHrSzLDDx4900 lxxV4y24lD50u9cVdO1UOLqoS4ssXKvXEvnSrLTi6zSrDxVLhD1Vt4q0ss7WZZZQ6eLmll21 XRV0y09bXevHELtvl3TpDDxxpD5Jpll0q7duztYu4ww47WWS09dPnT1t2+ZdLOnyrbpVNNvF ll0PHrpZxhVZ602uS7eMtOll10PHTp4y9Vl2w8SNMuunziGmlmGFll3HzjSq7p002ws6evVl WHHr5p67c0u9Qqw8WSywlLpdhVDbTLLt8y2y6YaZWZYbYZWZLoaYdZZcWQ6aS04y0VceuOPm FTTt0y27dNvmGnrSiz4dvZuz8ofYfun7ztNSJKfVT7vu+Xs2cmirZVRwwckoOSTNzTFYQEos aNFWa1uvUSRGqUNG7dstbpQqkqqhERqvWtWrBRqoqqxNWicQokKKJqpFREJF6SrFqsRRIatU 43SZtE2yrV8/H4wflKKKQu44ysZadPHa7aHjxRYbpFUlVQE0bpMVFyrZc1SJNmaiqq9uomqq RETiXhIiNWEc9Fi8kkuf98NG469sr0HV2LHsTTSSRJIMkh4YrHhRppiSqKowrSvhtiq0p4VJ pxW2jSpJWmIaaMSYow0wwqqk0x+jQ0rSsbYeP0882njkmnJzSfHOSHmGJ7Km1NKVsxMP/Yw2 ptjGNsVSaVKqMU091Yfq+VPuKh8JpMN33nMbUrEmFGFFUYnM6OZzjjkJDcfw0540jnEkZAc+ N5PMePOORxMzkMnOchuccmTbT7ePPM88ck82nJtzcTDibYmKY+G2hthSjGKmGMYJJJpNzj45 5tJk59PHkSPjhucm85ySR55x55JzFRitK2NsSbV1jTQwqm3GjTbTGNKxMYlGGJjDGTGK2zjO lnj0cJ0u2cqI2QXDUsE4xmTyRiOLMrDKsNKsaUsy483SdMx5kt7fTzi2P5q3jNq2tblb3nlt 51qnIxFUFWVUFig9jV6DeHTpGdL6scNZXrcq41OXNosJM0J85wkbxGjKjESKdsMMVEqpjDB7 NPT+KTSXSVLO2mn7NNP51W22nTpBFKUhVeqZGTI82VVy1SJdNEJ7DIsyRmVVWVaEOOnGZGR0 lmVZlZZSpkaKNkSTTEyCG/DbMjGIWKI7OhTjLJhmm+ObNzRJ++3CbOs4aTSZkgszNIyTJEt8 WNtuI2aJIhMRNoyYM8Rs5oRGJGizCC2kNITpzaTBNpmzyqlXQMonRoirJmWTMkk02T6c45+T jm3IkaTOeZ4bTObSZJmiITaH0kmbH5fhISabPIEoCqR8T83T6GYxpXp2qYaUVk1WkXczJ9mP aclY2rTjqcljaa5jtO3Pt+WP0gSCT+ZYOWySeHQwjajakr3YTFVUiiduVxUyzN0yh7e6ev1Z 4n/y/+Xs/+D3OD09FWKr7R6fq/k9zwdMMYYxVSuTcnJn4eeechJpM5HIiZxORzRJs5xwkHJN zknJI0jkzkiEnPp0f7mMRWGP86ttkwVX8HI8qTSTiqTtip4ezDFemMSipFUqbTTIiWEYhBPp J2JxnDXD7Lk40pdGpnGcpXHE3bJctpbbEsdrciTHGEzo4p01VnTkccTw1cYj6a225JbEhtpo SGhIzOLjOVVVxVlBmpGNSZFhkpNkP7+dtO6u2JbEskaRpYEJkRNtJJJpow+OzjYRDN5w7EQz HBpmqsZuTH+/wcR1LMjGUryZAuMZiVlWVVYWVmZlVWDLNBIScs/vTySSxLaWJEsJPLfpBuTb ylv8yZx+X7anjckxKoq/m9m2nuqclCVatVUzCs08JxYrTIwWqEkWpFzyeDNY70mjN1d7d5Lz hJGDxet6H4PwfghUPuP5qP+qkaSU9Q9PxfZjdV0bqppL265ik6M2Lk5smjJYXJsmqzT9Tj93 TKGHHpV4u8eOmnTxV028Sl09WdPXrTK7jSz16ufu9YbSkq8QhhpZ602q+duHHxDx69XS6evn b1LtlZtDN3rxh0u4l6ld2h8Q2yqw7ZaYQsllBxdp807evm2HrbxCz1dhttY+abaeqsoe8QMu 2EvT56hhlhhVd4+WQlx82+WbdvFkuGFm3zx8ho6ZdrrMtMunjp4s07XdkNrvW3zDp40ltd08 ZVdLuOny75V6yXZSlL54lhx8lxekI+eNO23p5fLTwr6iaH2ST17edXiJ1ZIakjoaoxpV7ps2 r02x7Ps8vl9n2dJ8vl9Gn2ez7Ps+qT7QKqRSyxZCIpJYaTRrJNJpkZosaawkJSzJaTNZv5VH NSsh+9lmfyYdPHn3dx2xiasmf7tBz3GbcTaTSCTZIJJJEiJJIkbOTRq6ObhR1XNnRRYfk/Jj 8n5O2n2Ef1UhH3UVYSVUhk0xprM0tskxJkkjSSbJaJtLZLMizRxM0Mp9p9zjlLMlmqs2ZZrc X4ONTT3kZli61R5K+fx50rtwnGjnP8knVLjUjMmZJJEJJRIzdjo6LHJ2NHVa6pI3cnV0cOx2 +58qXIa2YrMNR9KfMpy2IqFkZIxrSwrb4fD3PD7vs0eH2Y+z4fR9X3cdvs+76zVPCn2CVUkJ KGiZMjLVZqZlqOg4zSJJkaZz5zZzRI0NZMaQzVM6VHGUhwxMWwSaTaW20pM0QaWyabNe4YsW DRYqk4atlFrBumq4cLFQfZKsJPxn0YStPbr25v60TJKrqWpEE0iJSkxcOS9etVZpuSrRyVcl 65931aPu+o5ZyWI+8+6YtSVJX0fd7vo8NW7RVsLm6ixwq5OSsLERKIRjwnxZS21Egs9aZFii 1o1ZN1WrhyYNnCixyavu+7Z9X421VST7pLIpPB2+qns5O2mrRVVc1Vclhm5Js2rk3cnJdVxB CJGWYrMrQ9lWL1dOcZmvoelUTiCxe5LWrZVcqwbtU3CjkscOTkrECijZgbNGKxu1atlFzdmo qqqiCrVavXqMmzRNco2UVUVVYlURHJJctbM2bdu3ZuG6iw3TcOFrhUiE1zVe1bsF7du3WNG7 dqquUVVBNctZMWbRRq0UYt0lFGqxVVVER0j3SubV2mwZIxTTn+NxJPp5z45IknOOOc5WGMbd P0YqtNNMaY6dNvwenhtWjatNNNMMTTpjbTFSqrts0/7ni6SHH7rP3UdukpZgqsqXQ9pUqhpE 0rGzCTFSFKppjE2wwx8uNtqjGMVW2IxLMUVUO2NND8XGKU2rGNuKbDabaaQqpVaaUrArDbDS m202lbNtNtqbVjHThorTappTSm3po22ldKadK2ippivDGm21NI4xiqlUbbY2ratjbSmmJ26r SRpGzArimhJFGNKk4SNp9vOaJxHm8k3HnNnIPENziM4OJEY8m8I3k4iTE2m0ORxRZOZ96zOt 46ThquYjloxS81tBCqqiXq2pA7RSiKrMmJOHs9PBWNFabJtxZhjGyqKeFKqUlIxub8PBtvBM 5xySDIcmkkmMTFIqUQfdtp93w40xjR6ql44qlpKqUkKlnbiXEUcUpSqE40VFiz1GV9GdWYyV GJlKq9jLGlB5ul5FTFvykNCNCRNBGckiBHOcZDN5Nm28x+XEnIPjcyHPNN5jwkjyeSY40I5v MjfSSbbiQjRMSaZB5JJkTbHHJMyYrph2CyZV7mTPDdOCZJ9EeeePEh6N2eSNIJzaRIZ8NzyE meNj5GyM/g4OtjHmn0hzk5JpyTkjnNxyaTk5ztuSIbkSNIciyRkbhem8TNm8m0RkaaJITDVF jKrLLMWWKZMjizk4yaRrNpxomibEmuCTw6JdMQy1MMwsO2UXbFZhVlYZlZiy7cG2SE3HGExm 845OTOM+3NyMPwn2geRzjkmchyT7OM8jTzeeY8yRJkbwiYQIm85JCRIw5VGLGYYxZMrUrIMZ lYMpXZjikspkzti4qxdrMsXSHThRorMgzFmQzVQx6Hh6Pv0+TM8vDHHlxo1LJLPqyPSmnptj niWTwXrc8Fk8qTswx7K8sNG3nI59vD2kJ/b7fF+3x7v83wHlVbYjFR7MUlKqkzh5p4jxJtJj znOQ5isP2suaH7uypxpTMrwXdm04423iJJGiaTZJmSCebbSbSNpEmSETJNIEtmkSF/XDb7kt /2eda1VqytVaq1VlVWrKrOunXSq1atVYSGkzEqU7h4ZnkH3OnYlS+fOIqVstj7fy34eQ+J9u /+edsZJkmSpVRVkiqlX6vDy0+Xb9H734vd/B0/V9r0fi/J97yfKvglLDGMMfpYfyj0QmXYpV ZuTNuvaF69wubrWBRcscJOl34hxlhL9nT9XTDDRDa7wqq06erJWcbaMsJZYZcS6adIaNuLuK uO2kOl3bbtKW3qFnTLJ2l+z5p67bVJZcSS28dEPXF3zs+bQqyuwyyhh8lxtVl046eoVdOIce nzSWkMtNpePHq7j0l26dHSHjtxZVx627eNIeLm7nivS6EkpOPXEvXi7TSzCq7Tj5LT1LLDx2 7eOLslkvluOPXb1cdrKtIos+ZdvF13rxhl2y6Qu8Q4054h27aePlzLxlld86eWNse7b2bfDj bp9SfxeUR+bUspmK46dVScaUsWjNFZqMaFmUzAzVJml0OPV09j3vRVqq5MFyqTdu5OThychw JCUGSSb7zGLJ6K9gqxKT6fgdN73owV8yUQmklZJe1ScOTBRszc0nNyVcnJqo5vk+ns3K/0Pr bLjVEw+Na+Sxa+ocYTJwEohgmkkvGDFRVq0SaujhRu+byfR9j5vD6Pq+dfUzFTLUrHwVr6WD qYqHx+XU6RFWT0/010+b4PYzXua1RyaKrXJzcMnJw5q8pIdUkki1LB6Ym5qSyP0THy4/B0+r 029lfR+D7PwfR9n4Pwfg+r2o+z6IoxiFWqIqqzBZhmK5VcZj7bMszVc7pRCaQJKuTdwvSc2j k4WuFXDhzc30fI/s/+vCvpWafI+rh0UT4+fX11O0QhBKEIkWXrIsXNmaro4c3NN0c27m6Pk+ T6vR8r+eix3GZVMz28nmzMfe1mfVLF4GFX1ZKKxZu3EkmLJw6KrXJ0ZrFHRu4VdHN0XVxiJI iepFVUkGtff53ICTJFfZ6eH0fZ6eGrhUq2cOFqrhWGkkLEogmP8oiCSETbJocWH64I0RzWIZ uSTBVNyc2jJyclHJRzc3NUQozat2zFm3WqJM2jVRRVVVER70QRKIiDJa2VUbNGyrEq3cN3Dh wqiEQi1moqxXt2bZVq3bqJqPqx9Uk/+5JCpCJEjt9ny6dPl8Pq+jbZu3VUXOHCqIjlILlXCr hk2ZKrFWrZRRVwqiI4LorHiaxQQ7SOvJgmktbk02/nJk85yYkRNIkdqw0xilYqpXGlVxX2fZ 9mOKxh7KpNk2VtVVs0pSpSlStGiqU0w2++nInHFcQw2K2wbYbbNtStGNME0xpTHm+I5N5OZf DiPPJkkjyePNzm8STc0Txx08k5zDZppWjZRppNBpo0VMVim2mKYrFbUpjTGjTabYxFebjzTk 8nJOLcm7bzic5imkaaaTbTCmlNsVpimlVjGMVh+DRttW2lTFYwYwo0UxWGONsabYrTRiNNGi mmKmMRiqm2mG6m22MVjGKYw00222aNtK22xWzGmmNtsU02laVpKqtFZCaI02jSMKRiJFVFT0 2YqaKqcxxTDjb4jmk2TTnG45tCPOTzhIRMjOOcxNNk5Dk2TTkPD9rcRp8cSZx8Obkmx3OJJj zjjw5pM5zciSOeTsmyISWI0iEcmOccTOZzaEnbls1z+levdcvzOc6NKftZiK/vMzN22sUTRL CaGyphdiqmViNKb+cJo92JVe7DFYr4NJiqKqoUkwY2hyfE20jSYiNI2kEwmYo7UqdCdu3YZw h05w85GkcTbkNI8iISG5xwiM4nGkIZvoqqhx4/dZdlpJ4hVp80sUwgosqSuMpMyZqSRxjmJm pVpeGMyjg6dDMi4dLOCQTRttIITJpk2mTRZRoPcwrj2s4cZduJ4WHw4Tmc3HJJknMEZzanCx lmK6YWOHFIuKZJMkOMyBzgNw0TbS4cRicRxTLJJipgwhpoMTRWIkUkaYxitGjBnkk3nHBuSS Qkcm0EhxuCabGmg8nh4c223mSZIjOecPjxzzk5xoTOOZzNyBzDTbDiHFOMxmUVkYsMoqzI+O OJohpDnOZI3Jtp44RNJCTQkbk2ybzd5G4mRMibY02hybSbJDExNmezec4TJuSSqRShwaYiKP dhtSqaZcZXhiXR0uFxdOnV3kuzMzJJOjiabINtGI8SSSFmm0JJDk0QJtRsqtFaaNGmErSq00 SNNJEyRISEkmiZJvHiaZ5Gm3czmiEm8sYnOZtMg2yjSIk520cdsk2OSDjk2TbItjza25yHI8 m8m5w8Z5shzcYkbPN55nkZEkzmYc8izm5tuNNHJkmyRLYliTI3BZkkIyTY0rBitGmjQwwaNG mmGKVSc0hIJoPGeZ5NGJ5xnImkSOaRxxubaNxGiZIkCExLCREkTWySRpJCZnjece2mhE4eTb zHiZiZo4mZmJmEmYr3sThaKwiSRItMkJJUiaRJbRpCRvhNyaIRCRkyZCQSZEkZEibItRhMTC hJtEREkxERNwTNpk5NIc2m3JpGaZp9OHkN4cpNpGEmiNpNomiImmW2ylE51sc0j6eOMniONN ojiZONuJLJJbEjJEQkyyaJUi0Y0ISb4h55pm0EIHIOCJrZnNycnNkcm0qdtTp9n1MVtXkx5e 7b0rqLJY6eluH4N9zqZt7qxOPd3PXHmceZne3spuWYflM9moz/9EyPUdtpMpJ8fKK9pGjw32 bkxyaTJNJI00EjpnxydrC6YVmGYsyO1dN3BJstNg8iQiE0TmOc7j2zy2T3NkM5EhNOFONFwZ YJlhU41FLC1KmV06uNHnPc7PDxSV4e/rqgS1PD+pX8zj5KvGeicWlLJIQkwZububNWLFydU3 VVw7HYqrB4kiZJJEnRJ7szhJozZKGTZuoyYoscma5w0SVauHJzbMGTdovbsWy9Y0WNmiHazx dZ6449dquHZVZ4Sss4Q8ZdPnzLiW3r568fGnzw4407adsOIafOOmHjKKeLsNmW3TK7pV04hZ 2hTp04y28dMIWaYQq9YZS8cZbWaePmnEOmGVmV0vF1XrjL5ttLj1ZKrbjtx64wq7VZeMO3bx 2xZt2qs4ldk6WdrNLunzTTx88ShdxDthx0lx46dNoQ6dunqXqrSHHj5Vhhpp09XdqqvXr16+ dKruIyy9dLO3yGXS7tDjD5ZJxurLi6w+fr+tFKAfFkSJIkyVZTT6vs+zp8vo8n2ez6Po+T5P sfY+XjK+dnFZ82V934vtdIoLuWzjV0Ucm6jq4UbsHJ1c3N1dVUR0SOkokpMlhA+/eJEkSfjF ns932fRp7Pq+j8H1fR8Ph+D7Pu/B9R9lkjtisiJI9aTJEQiAlEJNFzVwqq1aKt2zduqxcOHy vNCxqVp9lno+HIlfDnfUlSSSiMTFcyVYM2zhs3buHDhwqjRKJRJIsTt9jlKTvhyVKGLHtfF4 UcNmyjZw4Xtm6qrhW2QtREjoSdEg5rpoiF0iBCwSYuTVyanJuzbOTh8nwfN830fJeqjU8Wh6 PsOKZNRERIklESJkosbLGDZg1XKN1FWzhRw+z6vekn2KSSlkJIslnl9Hh8Pq+jwotUcOG7dR VwrERGiThJECG65wo4YKM2rZY3UUVVcKoI1UaN2rVRmo3aLmrZuoqrAWMGrdVmzYsmrdVsqq qzVgQWt2K1o3aNGbde1btlFFVUQaKN2LMvatGjRVuo3UVVILFrVu3bqMmS9Vuo3VUVVREXxh EOeXIsSRJJXTGKqvqqdK/BVU2rjGNFTEJMkRCSSTTnOR/JMVVT5Y7adNMNKfVTTyx08vurFS MdjwSjCuknGOKjGI21NymmiU4mjjbSKbTEYOKrbRg42xi1pX4tMaSlYmNKaTFbfirTQ2aK00 4aNKqpVbVNO2ONjGLJxXbbjbg4xOnTR0xNMGGhtVdGGKVTSm2NsNsNqqdITBxTROLNMbROGm 1U2pVK42pow26VtxTjjHTTStMccK220xVU6bbaTZWMVKrbjTisZh06Y0xppxtildJ0mONtum 40xtps6ViuiuOm1ViumNtlbbbYlVVVtjTXStuJw2xMalRVeVaK44w4xtXTDDjZwYqcK2rt0Y mlTpOmSVWMZHHHTTStNOlWSHGyONsNOMaTTHRshiUMVJFUaUZh0OMO1JmkeGUvJweSo24VTG TFK22JpoqsXEraYmmkYu2ybabUrRjGIbYmlb4zuMmSaZpHwm3MkIzznIRJvNORuI5NtZ5NOf EzySQ+HNzxzbmts5UpSF0AlSFIQtnF78i+s11zOb71O/31xe2rozj0qvRlPJvJyPBnVKOmpU dDSq9MbU0UmODE2KRpT4kmJJGkNNG45JPw5w0pjDjhjTBKqSsYjSpVNpG3I3kTk+nOQhESRM iJMjjjmSJomTaRyck25G5DIk25h8GnG1YxpjFKpRoqlaVxtW0SVjSm2MbMbaY00mlNKciaDk +NA8JnHnDnnmknjbk8m5NtuTbSSYclZ06dFOOnFGZXTK4yOmSsYkxUQ4ptUI220xhWhI0qIQ xQdSoDZRtSYUN8TNpAc0OI3kxE248m4PhvHkJJNIT6TnHOE0OTORNznJEZJpCEH6v1dLumGm W2EIVbIISoXOKVmUhdMO0wzBxwcUkRMcQEthiT03EEhPy4224mbNokmJkBnbO8bDt4dMlZ26 UukRcbyRpERHjTzydpY+Obsw8gkk7nJ3M7CTzmOVdqjhhRYcMyYyGMyqjSY0rGIwaTTTZubN pU2JsjaYVpJNijaVpguNsGmxo3D2ZHxxuSRvJpGcj9ybx8T4aRs5oOeSTJCJkRJjjcOaRIiT xwOYhHkkdHiNybngnbHDLjpwo6MRdLMukfEnO5uc3xueZJJiY8ORLG+IdI+M5zQ8cQnnMcMU xdHSZGLoSsjh0ymSbcjYdsTJPhEzkkkRE5NppGObybJA6YBzpLrIZcycJF4OK6SQ5M2eJEmS S2fE5Nxho000yVWMY0xGKqVSGleHnNHOc3nHJMj6RxEiEiRJCSYmyaSIkSRznMSzG+Jts5kx xyc2b48ceTxE05ucSJJEhJpNIkSbSc28mIcm002jIk0yAiTIOHERySaznGhweDxtyaaETEN5 DO5CHBcYZYTKnYuDhFxZV2yWMswWVZXTKzOMdq0UhTbDFI2YTEkVtU02u06DMmLMqzKTMSxm aPNtEbcziSSIjRGTaaTabaQSBIzY+OI1IkSEmTJImQSNzyTTzyZzySaJEN8BNoQ+ExBJzk5x OZJMTg0aSpUbU2cMYlVtjEHCc2gmzSbyJEm3weUnGgzRMWMsK4c7F0XJpbZJyc0PieabN4mg yTKjFFk6Z26UHbMdHEEQiSE05kzkX0nlVXThhpTBUScGihhCsrisumF5M4yl0yXadHGZEsJP H0IzfBJNExsQ07WZfm1UNrqkql0FW2UpfoxNMR1zeS71jPUzD2WeNdq623U9YbyeXrUje3lY 7bkdpJKraohlK7XBIOMSmEyiMrUzLMVxYuNRmpxocZMyq2V53nXqtN1KLEyQxZEr7vTwezw9 3w/F9H1fLhRV0VVjkkklAozbKLI0YskkWJMkl7hqwZNW7Jw1aOGa9VqtbrWRs1ZsmHHG1mnj 140s6ev0WQ+O3bxhoVZcfO0NOmUoceO3iVnr1p4swuXZXcbSs7dvUvnz52qsu7S0dvG0sNst rspZdnSW3anDbxtxV6u7baWYOLFWnzDL5p4u7YZae+pdO0svXp48ccerNvlVmkvVyrDS74wy +dJeumXTTSVkMl2nirtDp8Sltxl00s2y9ZeOOMrvV1lOnirtl6YVp87ZfNr1cceqvl3zC66U m3zj5tDxNgkyJM0Wt2zdi2bMVSOTmSTEQh771I0RJJClayY+r4fL3fZ9233fd8Po1cOSjk5K g4WpBJCYN2tsWIgiMvv8JTpWpXROMiWLD4PV83DJVRq2bKOThybOThxAhGsiCEQ4iEl6xu2b qN1Gbdw3VcOHC1WAhjdxYQiEEixIlJRYxaLGLVRRo4VbLHD4vsfY+x8oZlfYvtcoo61VQOkl FzNq5NGarVRRc5KN1XDk5OEiCSVMn8zV6mL7vk8guqh5711Ij6pJSSuTkvm2XsG7hVoooqsc lG7o6OisT4IrNKUzZhmyMKxozBmo1fYZXzMEmM9Xse1nyaMmTk0UbKKuThyVIaokIlpNERHA lGq5uqqUYtVVVHCrhw4XKxDXGJxJDGyuX2OSU1opJrPTXwdva9r3MW65ooo0cKqKuFYHIkiL 4gkkIiSSESI1at2qjZsxUaKKKqOHDdURCrVuo3bsFVWjZaq3bqKqwgCJrWzBVRNs3ZtlGrdR VVUiEERco0ar1GbZRqvatVG6qqoiIQNVyq1k3bptGzRRRVVVVUiEC9muXsl61VRmo3bKt1FV URHpjGOcSjONGAtYP9SxYSSf1I/CeMkz7JOOb6Q5NNOw7KrorEqV8K0qRhTCKHJCJok4SHdi c54czhMSaeSI4f0PjHPE0R5OOcjmTE+J5G8M58J4+POchJohJHjnOc+JNNMMWfdww2rGGNqY rCkcVgrTGGNMTTFYxptts22xK0SsTappjTUiqmNMRimmGHnnHPjjiGkc+PPIkmhRppVYirDF I2xs0PwVtU4sYpWMVUYxtxtFVG1TasVNqmMY0s7YxpFTFNqNUlK3I5ObZ9HE45Jzbk3HNBpj A7YjYkqicSbUpUitJsRNkyPM5pIibEceRnEfRNDQH9E3NGkTZNktkyTIfSZ0j47M5NEyEYSE saQ7c5mpUNCpSuJ0udZrvnnf478+evPLyTv3uB9FaaYTSjHt+Dp8K91k8J98nwqTZ+9zIzck ObkSNtG2jnJtOQm2P4I2k25BpGcjORiRs3ISRNubZhIx5o5Mk25xxpxznOaQ5zjSJNyNyOc5 yac5JiRkcTnOOObcmJpvJvI8xuY5uNJmTTHJuY5iTaYJNjS2iCI1RSqhKoKpKqqfJ8q+7j2c dnT8Xbt5YbeXZKklKkI7eZIRe3FTtlRdHmXTPDBwcVxBcSyzL34U4LpxIzixGHCzJmVliqaL pWI6IbPGTbYfSaQkThHAk2SZJiRpGyREyThmUjKOlKs4mccGYjkzc2aZokyI5yIm03NGnnHm kkjyMTTm85I6UZRTBOlHTKZkmaVdsV0bJpisg8UrCNQTJZksyKzGsjMia2I3o5DS22YjQhEa bITucaZNtNomiTNGVZhMpirBlViZDNttEhEk00GiZBGxG02EIWRNpCmkyRpsIYk0m2kMiJBj KzKjKOmF4ZXGU6YdJnaDbibRzhhaJ4miaTSJEc23JtabJbNJsljE0ZniHOcchI5xyRpDJ5zk iETSOJwhCRptzObjYRhNlZgsMmaKqyZMWRhNpCQkSES2m2mRtoaJMIjEtiZNgSSSbfxTcsSb PcbkmJPMhcZWMrMlZkZlUxdMcjkImkcybcm24ho2x5MhS3MiZCJpREmjQiSSRNi0hLYiNGhJ EzJEyYttj4STYkNkNC43HESNpVUqqqSOkRtp9X5dfZxXFVY8TUyWHqWY9nTGlKV5d56m2WvT c8TX3cT2qSTpZisUivC1o41W0VUJiSaCbn/6OPNNDUtZsbyCQi2NJIaLZsls2lgkzS2dttyM kkSYk2SMk0tmkCQaRLZkpBy2ctmltIyxjnjUjRJJClVx4Ys1krE+HpXy+FHCjBq4buxRydHR 1iOI5JBJCSUnDE9NvUIdJfO34/H449cbWbYPxlxdLa7TtVt0q7Vfq0s0w/VV09VSs7SulKra z9Wnirj18s4wuyysq+dtpXYfMrunym3rthxlhZ4lZD189XW0syu9cbdPXb56+fLrLNrrrMto bessO2ksNNLOMPXr502q8XafMvmFXqXqktroabeLuKvXy7x8wZWPlirLDshLLjTx8+YdLmWh h60u+bPVWmUMu0MNPHEvXy60NqmlniVlVnjT5lnxLtNNuLGGVnzt047XcKoVcYXWS7cSuqhK 7C7t28QhtVY4+Xw+j6k+0+jERkpEFFmnu8vTtw0ZJNWjZVuoq4VM0JJCJJEiEhVlJ9lgR6yY iRBYV9Hw+jt6cKqOHCrhRRwucKxAI3kIiIIcIth2yhYucMFqirhwtUbOSqirk5KxDNIjy+7J JCedZEkiRpK+z09Ph8Pq9MfZ9Xu+r6vq+r6vs+qGVJVkRHdhEg4iSrJko0bs3DRu3bt3Cpwq ixIxIlCHVqqQsIiIOULVqFjBRyVbt2yir5fd9n1dPs+76vrI7UdECqqyCkSgJJJE5ERySVUY MG6irVRw2bqvo+z7PD6yPpYj70I+4skhDK2+r6vqqybL3Juqqoq5OTkqF8EkkkjnNEREa8Tt kEQRzSUWOS9izcNG7dwcKqPs+76ySbPzkjFJKsV2eHHy+Xu931fRRuoo4cOFSC5uoxVVbMmb Zoq3bslFVSDNutbKtVGTRRusat1FFVSCxco1bN2ajNoo3bKKqslUCbBYzZNm7dk0VYt1W6qq ohRk0btG7FqatXs+Hy+r6Pq+qSe8RKpOln4vs70r2Z9JdNvwYr6K2rFNFVhifZWNMVjHE59O eR45xznEkh9I8jZpt20wqq2xVYYThhoaOO2MPu6dpEx00xto2O0oinyoYdOmJg48NNNqbVNN NJhpTCo0xw220xK0rSVpislYrMywzjKdMOjK9XzcRHa8JHFUY6TGGMBomMfXvx66ur41zrrr O+uu/bfNNeJKp8sY7Kk7ceVfdPridP0kTSTEPtyIm5m5NESKmKgV7vq093GK0+Xp5cPoqdtM PB9FV0x6eoJEj2RVaYJEPJijiuxhMspGBHSsj3VIxCbVjbyxoVRppKqqSsI0rnS8DiptVcVi jRhujTaVWJI2rRhjEYYxMYYJE2m5ubthziEkmkmZzMeTnOZCbSOTbONxHMcgY5tkgyTSNJk3 xPI85zZG0bkzkchVUqqS4pMUoOgfL5Y+u3lx0rjyxt3MZLLOTJvJjatLN1qWcms73Kpp1OzZ rifXw226nHSVVFK0km0SQiJCNJtJM+03JpEkiETTSbfHnOQxyJZJmz7TbNnI2hMKWJyzTt1Z OmVOWoJybRAmsmjSbSS20tkjSNIk0mSEos07TE7mqzXVxyPRrTjlqnbFnMcbF900XQyu6xdc 5t17dVVyc2SrhycnNyc1qpDVNRmqvbqM0lzZRs2Yt1WzRs6XS/EtMu2m1SVnizj1txBLSr1l dL1Vhlxp0wYadvHh8p4u9cadOruKtLpbZdvjxtd08MsIcQ9acYZcaceuLKvUKvVmHGnTDS7x p88VKrMrpWesvEvnHE6fPnjptl6ss+XWXQh29dMKnr5l2ylttt6wdu2mm13iUPF0u2nb0+af MO3Hrpdd67beGkodPnEsK/KvnZLt4s9aeNoMKtOlR2yqS49aabSqw7S6S27S2ss4rlV6k9fP GWl1XrjpZpVp0rtX0enb4eVe6fUn4KSQPhSRISMFrJs0ZtmqjVsoq3YuHCsRAikoiIhEGDFq wbNm6jNsqqooq0VVUSiIQRA5ISbNFrdwo1btmjVsooq4XKoCG291kREREIjdoowZMlFWTVVR i3VUfJ8g81ZX42Uqr298pKovpZ4fNVoq5NXCjdqwVclHDkrEOiSJyRGaEYS9fZwoV826vk8A umLMCkTJbE0JozRZpbZJIkhfNo2XtGqjZu4atHDkq5MFVUOEiF6UIIiCaaaibNRRu4VbqKqt 1FUnCsNYUTgEVwnBAQ4STVcMWSqTZw4bKOHDhVwqVJIRmJCEQgcJNWxu4bsFVHCjdRu4VcKx ERghElQkqyJ7qxSkgfDTT4dvh2930VbtlG65VVUAo1UXr1W7Ja0atVW7dRVVCBEIkyXqMl6j Zm3bt27dRVurCEIIkzXqNW7Zso3UZqt26qqqIhEA3XKsmrJk1bKtVVW6iqSsCBCGajduubKN 2rdcq1bN1FVURGM6YxPKdWJKr7/R9Ed9fdT0qYrwVpz7bzaNJJPpCfHD4h6ZUbY2NJpWkqMV 7qxSk2rFTznMc5xx8c8kJCb+Cbk+OczTnORznCR+U4iTzjGmnow02qSUmMSTFbaT6q+ry8Oy dpw2VMYGGElKhRSsYwlDtiYxiaNPLrGOte2t/Hj23v3sOlafRT4fV00j0sjrBT2KFVmLGHqy HvZU4x0ypg6XAsh04Q6MzKMykzK2aQyTGaGec3NOTHHOY5s3NxgcQcfwJMh0oqhQsgfq8YdM P0fq0u0syQ4sss7Vt08NMcYsdK8NNNK9xUjwVEOl7UzMjMyYsjDLpGjiTCSHMRGzPrzP3ozf EkybEJIjzm2DjSfG5pOENpNBCDTxNMp3irpk663GZS6XbBxl3lHbpxZl2yxnDJMV0rLjEkHJ yzIk2mOZDm5JNOQ88NzzEgicSI4gzcY5piTkMac3OO2HDmybNJIflvGhObxomOYiRm3M34IZ zfSc47ZxNxMiG4RkZ9ifzv6EfY0ryrwrj0ZObnnIyzJ6anw49mnh4bNVPZ5Ye2GKKqpSlVUq lSk6NP9M7ab88+qWdnH7PZ7PEbiEiFyTdkq2cmqjhybOjmxclXRwqjmkj5oSG7hVk4WNWhVq xbL3JgkxOS5oufiz9F0LMIadLtvFnTj9GHiUuMtIeMJPHrayX6rlnqHTjKYccQw8XYbaetPX yqC7azaXS7L5608ZdNOkOj5xtVxDarppZVsw49S28VPnzLbLppxllx00lptLTaXZ49dstNLv GXbxZ4YS41t6esvnGXjKzb5xlBtDTp0+ceNHpxtlk7dunr5L1800w0ww8dIbeuKrMIbceO3i i7TizjpD1naqTDi66rxx09PWVnjo+WYdLsLtMstpXXLPXrTx6yswy6eJOkQyu/Cln7KnXK0F Hi9KVacYatVFFW7NRsqsbquFSIgJYziIAiOGMQRNaycMHCijNw3buFW6xVwqYzHqrFxi7WoV fDAgvsdAmzUZNFGjda1ZNXDhVw4cKxEc0kkg6WKqPXRVIfNurM8PV7nyZ82rVwo1VUVcOSqC sQklEBJKIJQIEpQhEIRLhNiuWqsmjdq1VaqKqKuFiqIRvKBERvJqwWs2jRVi3ZtVG6xVRVWB ukkSEM5Ighwk1ZNlHCrVko3Nm6iirhVBWJQRDCREIRwk4WNGLdwyVUUbNk27hVwrERGyUCIl ZhZERCEOFpNgtVbKNWzVu3UUTVcKPs+qPsssrSqFUV1FJ6YeodJNZagI0cLmS9u3bsmairZi qq4VRBFVq1ovaNGjVs2XtW7dRVWEGTBm2Ubtm7Ng3btmyiqqqEIzbL2yrFuxaNm7dsqtUVVR BiuXNlFGyrNVq1UVUaqqgq1XtV7RsozaNlW6qirRVEnn7vNkfZ0n3OKxX0bMfV9E8J8kqq7e KmjtxpipVe7RtoqtqmNsY6dtJpVOMdNMcVjGK0rpxxNqm1MSqmJNKxW3GJxT4cG28VHFPhps rSsdqjtJUKlSY2iYVUpUpPDabKcDaUp2gpVBRDCCFaEpb1GcedauztZjNWUOfCS2+/pyPwR+ HnNIkyTb6fDjcnEc5xHxPEnk0mm4IOMQz4ebbnxHNzSEk2kxJpNG4Hm5DyOTzM3wEjSaNpjQ kJkRoyNpsgmkhMQJkhMQkjRkYjIJJJM0abaYRkhJGMmSyoOHRhWdqnGUm5zc8eQOac45pzmH CCY5N8c5JsmhkyBI3733bfDw+zHSfLFcfKvq9J00kxSR7olGm3EIJ+tZs/e85E2PpPo8OHEm zCpO1VVUVDRJNo0wNCjBUJpIyTCmNtA6h0wsZ4pnTEtzkUuUduKdrOjUO2EdsKu2ZZmTMjuL JOhwo5VO3kjt8HyTHbbZVeU2aNz6s3s5JkV5Y4enpzfU8TWrPDyqd176C3lSb20e1HVUxZ3Z TLVpJNyXt1WarRs1UaquHDkxfZ9T7FWVaTw29n1YSvZ4e76tuNvc9XdmHqzCzbKWEvW2Wn4u 24ht+js4uq49WZeKsPG1mksqlWlMrrPHTxtdt+jt6ws29ersvm1WGEu3iEIceOnzxLpVttD5 ttxt0ullpJZdVddh62+cfNt9uPV0rrNJaYXYepeqsPnSrt2wqs4swhCyzKF12m3izD162YXd mHi6Hj166evHqF3bp82ld6h4lp22204q06VaQ7SYbNJWdkNu3TbLpp8u7bVS7ePj1txpdxdL hd0+dpMfIMuOlXGnj14w04yu8YX6bccQ+ZWfjyCn6IpQoxytoiIIhKI4TbMVy9kyamqiqqir dRwrERGHCaE5Z7zBFkljVe2UcOGTZw0UcPo932fZ9X75XvVmTJE9nrIfdmmn3emn2fdu4VUc m7k4cLlHJVERw2ndJFgRJIkmubtGijJRmo3cN1FW7hUF0kcJLVzBVqwUUZqsmqijhw4VRGsg lHCad0xcuZOGyajRoyVaN1HDhwrERF6EjGURHCc17JVVszbqqKt2rdw4XOFUG8EiOEhjrNev YNVjZo3ZNm6rVVVVwrERGliZwktbM26rZiyaLnDZVVwq4fih0QUyUpWqmXa7jt49aWbeOnz1 6oqqiDJusZNl7Zu1aqqqNVVFVUIWtGTZs2asmbRqzUbKKKqogvTbL27Vqqqoo1bNW6iqpBuz atmLVq2bt2irZiooqqIatWzBsvUWNGrZo2bN31fV9Uk28LLfm2ip0+j6+H2VjD5aR7vKvJ5J jyxW1MYpspVTWMTDQwqmm0nW2mmJhuRMNMaU+kk5EERETcn7k+mTyJJziQkefHPhY5PiPjNs ONsKU2xhhRtZiuK2xgJ8OaJ5OT6fTiSIn05OMcKYqUpVKrjgxtxjDiMNqlVjTDFaY0xopXHC JsbTTQpSVinGJG22DExSu232duyNOlVUlVDsSmG1ZG4bTccZyZoyflGeRvI3JnCSbbmg0SIa WYbzxnt1mrrv3757eMtx5vVKxpJij2VE4qRPTj7OHHTofZREhj3MbFPJzw5xyfhDnkjk854I uGUzFOIsdEztx0yO2EmfESbJJ8OSSB4+HxpgqUmyJoqtKVphphA2jkDw+OOEiRJEQSSaI8+H g+JjkDk0mkFPXjL1lVxLxY2q42sSSsYNum1UV1APSZJHtoiGlO0I9x9OP0mOCbZIbI0SNpWM p5uKZDFZDETJRuByTZBpkPHJJIkzhairI4zCdsibKSebnNnwkhJN2423IhBJImRCJpEgRG7b g7ZWR5OHmyg8LKyMFWVjDKxZSyGMJMjw8LhDmKlxkzK6cXKGYk4hNY0gmjOckO2G5DecObbe DmTkxwmOTYkNI0wkkaRJESw2zk5pk24JxkgkiZm25ISJGJkiMmSB6zbFDkkaRpMEECUqqBVI qpEDI4+HFdu2KqrNJWWaTf1nClU1pghKNoVXcVM5zXFIpZzaVaUso9WWWLKVeoSTTDkjSQmk WRJtMXfnUTcs+Hp8Pl7vl8N3DdVwqsVcOFUFpckuZJsGDBqtTQ+QWYYdNsNLu1Xi78ZQ/D8b etvx6q2+cYeobZXVbfKuJbfLrvHG1nyXxLt09cadrvUPHEOIeJbfPXzLpd84qsy+VXYZdLKt sMPHSFnaDjbTj5sltt68VZy8fNPW3qzDjTt28enTD5C7DxdVp84h4yll2uuqqyuyu+erPXqX qHrDbDTD5t6lpZhl240uqw0q6fNrvHbtKr10qu0yq+evmV2lWLsPGnSy7LxKUspaePnbNUvn HjCrtxC7SHyyFnFXHHrp4WaXWcOmVWXTaVUMO3rCFSxZ+EaW0sI3btV7Ngozatk2rVVuqqrE RFxLEpElWEqitOny6eH0fLy+X1eyrBsooqrERGUjhJs1YsGSjVk3bKKKOGSrhVERSRaoq1VU ZMmjZo3VbtlFVYgWzmiLGyjFRi2bNWaqqrdVVmqiI3SZTxsRszVVZKqKNTZRs2UVVVRF0kki aSI5okmsas2zhu4VaNW7FVRw4VREUSNWLVgybKNm7NRVsqqq0VUpEGqEIoIKWc1KULrMttvH 46fjts3aKqqKqoiNVrJMTTicPKLRotUUaFGrRm4auHDhVwqgbt16rNVVs2bqqt17dVVUgwYM lGrdi0UUbNm6bdRVVEGTBeoooybt2zBq1bKKqqiGzRRg1ZNGbZRq1bN1GKqqIjrEljVq4WMW rFk4UbKt1HDhVER+iIOSI/RyZPNfAfNw6PsZweV8x+2yk1qCDBlsKbMZpWM0oUvlopJcaUsY WY2fT/BP5/r1Vd/FP8Xtp/rccK8cNjS9GrNGas2Tc1NOSQlk5yXJKRKEZbJ9TPH3fZH6r9ZZ jJ6+83P67dN+U5NlRYdrEe7jC8mCaKdOskX8WTJ+CTwnykT2j4pPL7P9fntZ9Pg9pXw3OP1e ienddOtJ4+ElxpZP0z6z586l/5+WpNfZ+U/x0+7k9k+XzJJrU9ieeNK/ZTk1Z+9p9H0mPuq+ J1XbH0XKWfgru7XaaWlPeamSyp8ZP/X8zc7WeyvWJml8vok44bnie86009/b8tG/1eXh+U8z qZPF+JFUloqxS2YxX/ZPuj3/dH3vX9P3vT53H0L9WP+CS/4ZJf7aFdEV5F8k7ir93Dovs4Z6 kbRX8Ps5EcTGMlQ/KLDOZM4a6fCs50H9nnkjv+CJH/m9j2Fd8R1BpfFdfq9vimeK8bie0rI1 Q/zR7nm7T5s9tvxt+yPfE+IQkSSSStEZLGnhsupKum21tVNSaw1ZquuHTdB1x01XUtLdcq81 8o/p0qaYHklPsYp/5QyE9Zav58p/9tS8Gl9Gg8NSPaox5jpy+ypMB7urlfLV4s3pkTnljKTN lHLVGVyfRiWy/jmef3fu/f+7zxeuM+Heu3Mr0ZjLVZ1tIlK0F14Txn+qmlPcxUZdpGXLFIpE RkkxMkUhutKVS6r/UcruL0fonXLfY5l+tZza/1s/W+3v9ozb+Per6x3P7z7+955CyI/Wd8rf f6ZmItitb1NQ+xWfg5H4OceuNczmlpz/xoifvSBX7OjtMGBwuXkQjxIhH2O4vf9y9F0ln2v9 Q+9/i/yf7UnJ/tf/lcciST2nise5ikWFhg9xM/zp5xx5PJJPIc8n9j+1zz45/9LGKxjTpK+X l6fudMVT3Y95j/j/9jRi2/7X/2/CST8ydjypXZ7KVUppWHI3/iD9NniMk/i/iSSSJsrzodsV mkzMZeXUU6YDGoM0YyM1mWafevEldNMkaJI0iJiTaaSfATyYJdNKmYzM0WYlI2kMkwSZpDaW zE0ozSmbNmg+Suh6I7ZntWZTNgfBimauEdL3vdGodsPRPtnVpnhTHvS1V6NZq+aFWVYU9qTj RZhZhfv+Sjkk+PviLfFw9TvJLDNdjEd61ekmXL1hg8OGlxlpjTZtp1YYvTh10WJVVpUzUu3W 2qs6W421Mu9dOrqPA/e08L1f8VnuMnhF4HtX6VONXmn6n6vwkkkPpxOcSTflHkkbGkY/vVpi YeFZJHCxgdpm5PeFpDcP5sFjV6ULE3lCOz30FzxkeTNESPWA6Y6PS+o9rDP3jDkmWvJqMx/d XL6OvtcZ0y4+KHTb/BWeOcexck9Ri+aj2PWuPowTeDNMqSQbJHClKVX4P3vL/J2/e6JDwqqi KrMiZIGkZI2iZtJszRZqrMqzIZkfa49ZJmjMisyMxTNSs1UzEZrf7LsOMX8PxJ0zPc/g/mqO Or/3Pn8Ver3M/msV/7y+5erSXq0rNVm/tUPxNP1EcfsrwV/FjFNsYrSmNttP3OONOF3TEtzT SdKYSnUU8n43xewxYebV5q7qerNTUaxHZpTZ+Kv0fmfk7X5vi6of0PLwuGeinlXTtG1ibezB RX8VVStvZ0sfo6r2CRCNDsSMyUM0hYlHbRc0bO2NMObccmI2ps+WJYU6Og1WLDjolfDbUwxP l91k+DipFJpo9nR2JM3J5JJORNMmZrTsehNiseTmwcH+Kn0aY9JPCMUqoV8Gidfmpr0+SUdK SrCL9n/tPu1CfKkqmqMRP4sizIphqRmKzUZamafmH2HowdHuae+jWOResdkmvOHhC1a/rjd3 GMWjdItSijNk8vDwkdLJ7STJ6nun4P8S1tdJiny/knVyMwxj+H4PxMH5lnzZeR1VwVxozJmU syVmkZYX7X/vdMdNnF06040VVVxrSSqTSMaX607Z/bR3Xor5H7V0w8nS6YzjJPRikr98wbKf g9iX8k2/xfsfkx/Vw0/JVbf+ArtsxKxhXbsr2bcMbVWONsY00rTbTFNKY20xipPJpG+0+JpG kNP0kaTbsZ9h9uDJGlsSYSJGbSltmJMkkyTbSJgsxLNVmIzKzGalXY+LY3kNNESTJNohMSxj wqdPHRx24XHi4P1eKieDJZmYZmeHpU0eS5I+1d0v4tKT9hZW0oyxOx5H9bE6cHuLjUvQsPew tR0xGYr3JdKV0xZkzKWalMyzFTNBmizQMwe96F+L5sOKn9yfd+7j8D8VR0qO1ZLFsjprbDrT EaJvHFfm/e+SvYmlPsnlLHFc/pD4Dlmls0mGS2JBZapMsmaOk7U/ov4f0/hfJ6T93vC/8I+r 97b6NKx9WNNKxj+xjFbVj+1pdZVC6y679l11koSWZSsgsyuuylSxxBlSBkQshSBUsky00x4U 4pibaUrZ0mSeyuPLt4eWMeb0fzh6Me2ejTK813qPu+54T+59JfVj62M+9fRf1Be1nk8qpOiz LMqVQ48tLFPQf6ZE6/1Ps/zv5Mf1kh6fq9OJO0n3k7Se8PKT9E/k/9L/1K/Z4V0rD1vWse48 UTNHkuYJEi1JokTEkdWVL+6fNnH1HTwPq0nGT3NjVmr0lPYvejwfxXte9X8D+14cY8Sy4vBe kU+9Lt6ON9IdMzZofxj21Ptln2MtTSJ4LMxnozP6Rcd37XHuT9jl+C1+T0WPhMHJOmCzEM0M rFWMSzT4fR9Xmzjw4Tznkc5xJonI45uTzxpijI0aVmqqtLmsaTRSz9oPyi6WnclcNQY0M1Rl mapZgdr814T8mf0P7FxXm4MYn4PDszK4erJr8mdFXk08VXGPR7KLZTzmG/MhxkWSfvP8WvSz /B4cMkNNP8E+iyKnTGNE34P1bfLjT5V+r+0/xUfwYwryqsMVDtWNNNSK9jM0ZpmlmV+D9HpM s6yu3kRVPsv7JNJZH7tPsdT2HuTtX31EJ0yswzDM7Lj+h2e0OK6apmOg4xWGoeR2VHRkMmyW ySWZLD97Z/8H84PiCYzLMqu17BxU/Uuqi7MTGZhZiGZZ+Pxhxn/831ri+g7azxn+V/Ukn4Tk kn+N5JEkqtRYyNSYrTp/kKpZX6dKn6h4XCeGOJ+lcPFO2VjVxrhyT+pyCpWBYPIdI4ppxKnR VVtTEpOTqT/B7nb+L6vJ2wwpp/qPhWn+L+btj6NnuqTT/wqYqtPTEpX5OMmSfuakfC/mOXhV GYmbNSzUGZKzKWZGaUZkJNJtpJMJok20m0sxIxIzS2aRmk2/uxG/8c/inBOOWJDtQ+74fJ9m K+EfLT6NNDGOK/Fx4bf65rI1qZjX7nk8q8OlYxxobVNtqxhjbbTasNNP0cY2K9K46Y4rhtpo xXN4fdZGJthxxh0rbTCqbVNKRo2yRN1TaacbKlVWCphxiaaMVSsVhimE4rG2GJXao20Y28hq NJFstaSndWuqOu2NtNNuLLrpXWSWYS2wqlcwyyk0yvi0YnCMtRicVrE1qXxaZS20wyhdllCG UrrNrTjd9Ita86LV1FpteIpeK1hY/gQ/i9nwh3R7mB4qcNPVfF1+S/pU7RxVn4PNk1OHi9K9 7Pgxyfk6YtnudlaZ+xxSeRidV/937k7fFl8mfV+Sqx9Gn+l/3Nqiv2YrGMSpjGKxNyc/xJ4n /I5zSJ+X2mJsto6Z6uMfsVx/g7cqkfg0sykyZlbZkm200JGiYSCQlsJEiTSZIwkwVZ/Y+yWz 3Gn9mRcetIExSqimWf4elVwX7lZ/L7L3jqfFQWZUUFEjuRPwfsr9z+D8n7mNvTp0xTpddCw2 sqhZ/SulZi9l11llUr0pLQ02qWckbZR0/zbaaO9anY02pi0bl05zwO++/GSacNmHDUmnhUzc z/BppDLVE7MzmYXSUSihZ/TSNv990cOHHzq879tb2A7Sjtea/N/a4ZnyQShxpK7tT/kLrLLG F11Vn+NVZCqpp4Yc0xusZWKx0laOkd10jUjo8K7jSTSjIvcvdndjUitSOjEdFlcY46Nut766 731J2wMU9m2Ek33mbuehe9D+t6z4xuI1TdxKUPfqiGr1Inv/X7IfQ9KJZP4Ke8H+z6tOh+LT FYrFYx6afdr8N71D+CduzaoVDFO7jzj4Pqer7WGeFlZkzTkryj+bHTtjTT++p+ih/5K44lKq lK7YmPKdp4gxUqp5mLgqvh/NjTEx/ApstW3e2rprKcnp8pPFaVieX9z/Wn8SvSunl06fs8sS aUVFlaZMLbJoZJjy23EDiNtyfYc+p4Xgx7f/nP490+S1fp75XGJepTjVWZH8f6XIvgrfF8n9 D6OOK0fq/2p7GM/S83wP8mOMzQxO2Oj870Sen6wdfjiYlivMX5TH7Kvw34kqppMns/zpUqVi mH+yYkn+E/J/yUqTw7+WI/we8R2iTbTw1Pqn5HhtJxH4J9UbVeV8L0fcT9TUU8lZKZlM6f1s 9qpNKkxjSumGs0+G28x+DZ/uOK+iR63sel7HNuwRJJE3m6slqSSSRJksScU02qQeyyFKkKp9 h4Bjj2MOGlXhpMY9XS6dq+1PfGIwGlkeX9H+d6LEcaaVRShj8e1xXhmqGas0ZhmKWa2kkyWJ bNpbaQlktKDMs1W17UcZmrw40cvbMwe+xe6ieGlZle6U1LJ7g+LFNgijvSTOIeicR1DJ2M2a x+tpatbLib3SuuwwwpgvTCqVmGKza+PKZIjtR7C9vvV+F0o8MrsaTjKzLOS4mFT5WPhjtiqw rDNmZLjRrWfA2p+5On0lbWQfxbVViRSu2MVJhjGPP8GvI/g/62H1aU9Kr81enbHsr8Huqu2M bV/nYfodPZjD2Y8Gkk396N9p/zIfCT7f7Hn/Of4nPon8nPDww2+CmKezD98qRpRKsifyVGpX /BUKpVf2J4npO50mp8vKuRZcJ4ZGZ0j5svvWXbD1PMyleRIyTSbZE22SxmlIzSJZksNC0ttz bk0kpmPve6xmGZnTlf3XavYLuPYpnsl4Tg/Be3lFP51YftDMX0Xuun/H3K/7ydE4H7XtunJ+ xfa0vwHb5VVmqvo4dLGIZqwypiXwmLNUrLNlTotS4yVmmk1EmaTYiM/QTYzcYsZqB/a/ymhy OG4maL80rT/Q/DJNmoPYdKnRPvP3T/r8Gy1WYduDk86PDyedjLlK8KGP7KHqHJOKlX+kh+ry 8FcVRTFqpVqcuqQ/weR+B/2xJ/g+38H4fvKr+xX9X9XbRqPZcxgxZHl/nV6f6D0lD8QNJpJc uYLFSBw24h4KKaKSxHlLIVKT4aHwor000jSoxpgxpjThrUiU7banDjNbe51fa1y+uvJXmv97 +LtyaXky6K56/f/zPs/J6OPCfD+j+r+xJtTT+1iqYxWMUzh5Oz+LtjRe9x4ui6aONV/oap+0 sn9Z/aHHsFK8yMKeq4xmPRePaLpPxWI8MMxMyzJmMwzFZiej4nrFO2TMk+TGOOFM0s0Tp2YO nspexPeqnTJyqHGqsWAzUrz8v2UduMSp9mCsYmWS5Gl2iyyTH/W6f/I+XafyMMYmJWRkZFVt PJ/Yrb0xj9HExG2gqtg4pT83ZLIsVb27knbSafVdOoO0kZ/tfd/zVSlt+7+Z/+X+6wlKqpUg +VZSyhZA7XbOP4PY/Fw/k6fJ7H9/pVJxGgZonqVOGqniK4xmKzGavVTH/Y5UnRiZlmCxjpOG TinGe8vJPIvini/XpHU1JOhkce5J0xZoM0vgpy0z5Jv5kw/wI82ewOTEWT+w/knGn3kkqk/R /zfpj/k5GzNJO36RHVfqjzaq5f4P8W36P0fI9TGYsz9E1cZWaivUZDMzKxjicOw+1/VhiTHZ TUiyMJSswbUdp7y9pdtPkq4xfispK4lhT/O8nTGKfRpHu8lcaL7b+2P5/iexh+LCTSJIk5/c k44H5WNvE40nU6slXTUmZRyZYal1Sw5NBmLpuXHtdp4UV0xKsVhT59un9l/+/R/7f+j+/o// iw/yvv/T8n+8/H9SyH5ROSLIh+SIg9XpPg9ntZr7zKyUfBaiCZHaP96RPh8SQ9En3jJEevD1 Ounn2ybeiHc7Pjc0SeltSbnj/yWeWvKSwjxSFvskPMdfRHskT2s9tdvewj7n9V+P5yXQeabP cTVeLni3TOrJa9qx+a0yfF2LlqTAzTclqaa1qmsWvW8GzVuyXH9yrRm5PqsaLWaTJ2OSjNJR NNVixTZprkjuYIoWJtHe2Oxa0ZurEsarVjJeWpJUgfxQyhKEEIWMMKui71d07fxWNGJm6pmk fqEfk+0kIlCJgvf4FqI3odKYH/ir8GJK/3jY6eCQK2/c/8Cq172Ca5If4JNlySaS1YtWmK1q 7PIWY8DKrovc6rpmMLCNRGV04a99fjaX5Pk4jPs5Gv7Lly06Lj4NfzHT9Wo/45/RZecymfyf e4bnJzdjm6urh2Ox5P4u9VBsxZKqrVqixRNukmuVYpsFzNsoxZKtVUirRJKr8Xesu0OMMpcQ 0q8PG3Tx4ssw2+ZShLtpD47fNsIdpaepWfNodJevmnGEPTD58wycesMtuniEtLPEvmEuPXTD DxLxpZVZhL12lwwwysysus6WdKvG13rw8YfMnrjT1D18l2s7Q9cS9cZQqw7drttMvHyr5hDx 0wy08aZaZdO6cbaVYcWVaS2uzTp426ZfPmHrLC58q9YQuywhLnHrTSrjB40u8bbWbdPnyGHx pV6wwkyldtxxVpJ8eNoQOOn4Rwk7EmTkzbuThuqo2buHJycnJcqRCSxetXtWzdkq3bNm6qqi ohmuZNVzdRi3aNWrZi3UVVQKLWyrBsooq1aqKN2SqqpBioubsFFGTZRsxUUbqKqkE1qxVs3Y slGibRqqoqqqiCTdRVVRqzaqNVrVs3UVVEJNmDRqqq2bL1GjVs3UVVBivSbLWzNkyZtGrdVR RVVER/m7HRDBEd4dYsiIsDlHhGJ43wi+CFiHN1UVdrm7HVydqrq7Ha5u1eqiI7HNJ5JliCjm owaKquG7m5qOGT7H0fR8kfYZ/s4E4vqzBmZqf7rj3oshFqTvWmB/IkzSXrSM3Yo2dXR1cOjs atnR2u1o7VRHrh4zeUjqaEoQkhJk0yZx8HV9p72qyv6hmbF4aOKkqyKsipEnOdkNBzs7/L3f 5G/7yLWH0/3hpP7393+G/7D+AkShIXpJxBN2ubud7sbsHoeTvXOrweh9H6v1fJHtifZth710 Ppg7Z2vzUTLT7VqCxEoiIkYN3Nyc1XJw5Kubhs6LnN0VREcQjYTRY0btG7dVmyVat1HHyfY+ x8lX8X6EuP0f9PGGZP4W8F1fweLLLNZjyeRTtg/wq/sTpi632MiaUq/sqR1B/F/f7J6sWf+2 P/Db+30fR9Cv9zGzRWlY/mr/Y4mklk+HJxGQ+r9FZtudSu5jJlhxTaJ041K27cgfg+p2k/nB 3MptM30mSlickdqdGvQXmTu6dMbtzqrU4sSqSeGRp6NyJp/gpVVfTaJibfSCmkS2tuT8fszY n6LQX/Q5K/uKMdfvDiNLHyLVnb/Yk93hP72e9/pf4J5vk4cl73/HvtTMmYxCTaFp+HOtsOW2 3JErRpNIkiiwjndslitmaGtqY1aq0Za8Gp+dl0SbWb+Qf2P8z/anI/Lib9yzJNN8xm+1Xm8p 2dM81fe/57/0F96j/F6Wl+2y966RpHq0majP5ftT9iJ/GpV6LKjak/xXBfh1PzehZ5n2vrPg X8wds6lHkyl0+D9P+z/L9JeHpfjHIWJ/X3ZKqrU9lPc/mnux+yvur0/4MbVOn/Bpw/M/qdE8 yJ79NEV2qe6maTjLNcZTqhXSYhjA8pGkj0m1K/97t7P0VDapGfCT4KqknbKpl9xo/c1zjjnb 5speK/StZr+Z/wb/lfvQ8T+Sf6nP7Xn9aSfDmPCo7fiw8K8sfxVinhH0fpMf+B1thySSRItk q0q0qLTkTi1vNLvUh2wFgwqzJJViDCD+Xy8J0rFeyxh2pkkxRqzRfdZLjD/OqbaTqaCdKlU7 NVxjpZk0eY09/pha+NHkobss8RDSoff7oaVH2bT4Y92PseJtVVVVjDGKmmGOMbNq24xos3KM drGLOCaSphzTc2tdcak0tVZepZ8Ntq0rbMyu1Ys2yazzdc12rxDzM1Vl4WkzJmrueKeR1amu LxYsaVi8NHYeVceJO2TMPe2u3VH7c1k/Yon5ozjuFDqI06fmx/8fbNbf8Wk/wCrWLBtUvpt6 ibZJ+E9PzR9VSnHNq/zsePGUXdVo8leTQfvauP9z+dx5ppX/JVVX/ff9L+TZjDHbSdu2lV4f V6GTBi/c/VHem/aj9xb+x+9O4xfuMGC1Jc+yQ/uQ0aTg2hRRLD+5VZ0qsup/hf3JS/ufLp/B 8mOFez6PopJODHCYpM+Dc28jxpyZINGSSaG6IiJIhRImZ+ZL2Idqcd6OTBVk1VaNWSrm4cl7 hyc1UFtqS9oqxUYpljdRVxx628ZdvW3FXy5CWVXjK7pZLTTjT8VcYaQ427ZbSl207esMLO2k Onbiz16+YILu3FWmHbtJ46cXZdO0vVWHGkKu3iqz5tLtt8w08dvXSVWHirxLttx8us7doWet IXYZcZceJPGXrtx0l49bZeOnDDxV48eumHxLpt44qlcfNnFlizphLbRVx2qwwh29dNLseoSh V82lCzpdhdd4+cWdNPW3zC7j1Z4+cWccdLMPldvVXzxl0u9bXWfLNOiGEodPGXTC6XTb48dt uPWHbpx68filHTa7jBe1bNWrdRsqoq0VRB65LFrFwxYKJNFFVGzdwq4VQcSDRYxbrGrNVVRV RRVRVwqgZNGLVgxatG6jZRu3UVWqwG7RuoqvatWqrZuowVVVVhBgwXLWbZixUVVarm6qiqpB om1YNV7NqybtlFVFWiqqBYuVbt2DBRq3VVbKMVFVUQXNG7Zu3VYsmzVu2VSfJ8nyVfN+ZHGT NHxZScMRkoEJoNSw1ZMmy9k3bKKKKOTk5NX87+dj+nTP91/hcuuy3+DE3/DOY5/ZKX7V/zet XTEd8ra4q0fR83ufJn2Po+rk7nV2O12N3c7lYiC9m1bs2jdRJu3VUbqKKqoiKwki1YuWt2qr ZRVs1bKqqsVUQ6yHcjwSc0kJpIshF7Zm5t1GThVw3cOHNyWuaoj3ISRoQSRzQRbzRV0wpmqz CzVRmJlGUSSiEkkR0ERHqWGTd0cmbo4bubq3WOHV1dXVVER/0d6IbomHjHpuicRN5eZ610/j kf6m00pE0JSYTfCzsyYsklsltprZJDnZnHI45DiJokiyy2Z+2Hk/WT81j+dnoeG9OkumpMXk eBcZ8u0jpNE9+oTiZUzMws0vQf0M1TppjtNHuaezFmpxpfz7ryHLWZKPmov+DzVHbzbSJQkj 2f4s1kRBy9z8t0kauar2tFi1NckXWWfxfu/dKUpXMO1mUMsqsssrpNKxRVGnGI06KwnDs/B2 20xTwppVHFUpp/0O3SdOmKxXQ2Ulf9KsO1ezRVenbH9Q/mlJ9X/pc3kjTSEyJGSaTSGkRH9a c0n95zc85yRCTzjkhEP8HNzJpvicnIkf3vjnwJMSEyZbW+nMbfWybDyESLCJt/qfsSZ+5X5R qdH9PB/fXq7qeZ/VThjH9rbJPdW+0k4TMSNNpNmm3Occm5M5E0HJkn4T/1n+RpxyebOnxY4u 3ocVPNmTKZFhZVLKwmZEzJUxMrEmLMUsWTCYUspsqySTJtLGyrRyDcjOSUcZVVWTk9GYWV0c 45OmiQnmnJkTEQJGkBMqYlYskwysZExIg0CJIhAibQN4mHoeSyEyE1kLEZNEk0xJodMP0h5N okEG8ciiRJ4RWP98ff4eKJYodHyela1dXY5Obo5rFHY6ursVQUWrV6awsWMU02kuPVkLPll0 uLLNvxpVVl8/FXqF3Rx46afMvEPGTD1dh40shY04q6dsIYfiV2HzSW3Sz1pKTbTt67WcaXdq unbD1Zt4+bZXZevkrOOJePD5dp48YaeJfPHzjD5lpddhthxcyslCzp8y28dpeMuMvFm0JKqq vXEOO2kLJUWXS9XQswy+a6WMtttJcaeLttnjx8gwyqu+Q6aYQhLw29dstvXHHTLtdY08Xdpa YaVbQ7fOJWWLsujDDiyyz0h606S6LvHb5LjS74u4l6+fihVZp27bbtGzVo3bN1WiqqINE1qj dgqxaNlW7dRRgqqDduuUas2rNu1bt27dRNVVA0ar26jFqyatmqxsqqoqqQZsFGajJRm2atFW yqjZVUgmvYN1ijZuo0Vaqt1VFVRDZo3ZtmyijRmqo2btlVVUDJc1aqN2bVuo3bN1ElFVTKSU gd6SjZsooqqyZtWrduoq+x5Pkq+z6fJUn6D7ng/htzodNQzEsyTNSYyTNRMxGaizJZozIzVM 1FmSstQGaqy5fi6TxYV2xTMmY9gZeLUTpojMMw8NInJubJnI5y5sbkNJsSGZWZS/FpNND9Ds 7eHRnR0iqVSYxipVKiq/N8PL833fk/Bw7HY7FjudztdHcqg4RESP5okJHrImcnJ/D7/4+F+F 5maZLMVZTjSzlZiZrn71HVPxmV0XFxWjxxxP73etWo8EmbSBI8WzvY0smlXWINJSGtZMzEmi ojWtryaldszKsyV7pw5OlZqZZxjlxuW41LkGVOL8n0fk+j7n4PB3u53u9u73czeDwVBa3WN2 rdi0ZNWiiqirFVUiPsC6EnusLLPmOsStObmo4cnJw5tXRw4cnJN0dFURHa7I9aUeqJwiUTiS 1PWbhVi5s3NVw5OSrh0dFijoqg4iGf0JuQSOKzOFJJHZk/khEkkZf5a04qfyzP6kiVhq6NHV yc2zdV1dXVk5uijqqiI7A9ke4z7mHTK/RqHgyUwxFYsB0uw5VXTVmoMmQ+vcpZ3LKeK/g8nm gz9qyvx6epeQ7akeU1Dji7u37GdsWYT83k6qhHl+6E0s9jQrwaVpUpYratOOeCbm3NniZ2zc iWyZZqZlRybpWarpr9a9OmE97i8719/XJZl/m/onSPewP2OkcZ/BcYv/on/ifgY/9I2NttsW sYxjFmjVKx5pRznt71qezySSW7HI5a1rj9zt1PK7dGG0banhcWrLV1OJmd5ZXVjWrtw5a1a1 2XVdJw9DtdWNa1rs1y1ZnGmtMWsxjMaGlTIwrExk1Vqnmis8shzFpvbTezVuRqxWGDFi1atf g491Se0xk91+7Q4y4eCunSrMyv7NT2mT9J0/7er4j/Xs/6XPI3E2b2VlZWSUUUVlZWSyTaWa 30dsyjiv+Vpe1kcNH1Yz8k99HTKVZVQ9f7llV9H8j4dFVHpZu2dvDSn/sxt6rDpZ+77B4DxE NrJD6ttOl+EXj+0/zb/Zo42/R/19ZIeJJvwRzJm5bk25NtJmymyVVmDsahkNWLRP7W+8sKds u37txS+JnpVeRxlHk0lmLMvmXQ6YPbR9zL2sydnJ60qsyrSmP7opt+6r+24/dJxD1CyEJWS2 /xIVXSuq/sf9xK6EPC5/mWWQld/BKW1S7bTarpYyfj5ZlZC7pZVtt47bfV7P9h/rV893E/1K p3ScUUr/WmNmlVMR/pY0pVbVtpiVjGJSJo5NzTJtHPJx5okSb/Wm43k224fHnk8nE2nbJEUq VDVIn+xTQraeUfZ6Yx8NNE1KVPox+CYpgxRptwaZNUZExFlRxN6m11OH05I9vZ+yn1n1cH7a j/VyXp9h8kzDKrC+b/Bx6M/1NGPT/B2rTFfLp4em35MkfkrDFQjTE6E0aUqpCIo0GJWDzkJm g5xptPERkNwjPGnO23CJ5pIkEZpm2ebmsjJNJI0aLJEwmzJNIITNJNJtMGYmWSswbJK0jEmq pfE6cXeJ2tKsxVWZizSRNNDCREmTaTYhITGiTTbdvNOb4kTPiSRBxzZwjImm1ktMiaQmjSSZ j2nxM3bRNvdPvO2Kqyo+WH9cYaSfwZinDIVV/JkjijakXT835un6ONs40qK4xOmP1xxpf5PD xBeQeZ5Y/2E/3iTB72DNjCRFHa4d7ubu53MHc8nc8Hi6PveT8UPHrpcubZXVWXXfjxD8XZWd O3r5tt80qwuwu/Gmnjp446bceodu2Hjp8w048eO0FV3rb1t8+cdMniqXjTjaV3T1tlxtpt09 XaXbWfJQ8WXYZePWHri7TTD5L5Z6ht2ls00hLjjaz18u7XeNtrkDpd08WerunTb1tlCTazpx 49cQq4s9eKtsO2EdO13HTSz5lw4QhV6WcXbeuJeOkj106fJdPXx0w8Sul68VSlZKXjp8sqww hKztl8slx4ug+WXOPHGUKumkKvlWXr1p4q4q9Q8eNmK5Jg3UTVDiEmTdVRo3TauGijhw3cOH CoM27Bu0Zqtm7Ns1UWqKqqoHSTdo3UcN2rZmq3UScKOHCoLVF6jVNezUVZtG6qiiqpBczWrm zZq2bt1G69RuqqqiI70kbMmzJk0Ys2ijdsqoq4aqoE2TZsoqwaKqNmzZVgqqqgWpqNWrFiyb M1jVsqooqqIYrmK1o1UaqqqKKN2iiqqIjurLqkj3hGiaWwP2T+P4zQTz133crWs1biRP3qaV W5MJ/SbHpTSRNKk47YEckiSQfTifTE39aP9SuYdEjtOk7P2dzjFJVSpbSWh9lj4zcTm3Jtyr Z+x5blpqxxjPFkZrcV6rGtC837E0iISuI5tnDh0druWu52vB4OHY8HDwVIj6jPnQ/xM44cYa s1FH6v9F2P79fxjOcru6ZMx+bj/vzPa+j5Pk4+9976vxd7vdjq7Xc7neqg/o5RFkj6Qlajth JEemJOrJVwq5OjVR1cnNzdTq6qoPyREIcomR80JRHJgzclGqrhs2c1GbhycnNVBxvLbh/Wlp zyMkbORm6Zyziqq4uRjP8p/e0/o/FWn+RVeD+rt2c2cj5oczzs0sebltDnEolKUTShNKUTcK OrRsqo3dXDsZO12urtdqqDlzTR5OE3VcEz4JEkjwPXOHySsk4n/s3v8x/mJJ/T8Th5JopskH ltt0lsibmtnbcPtfScs5r9HxKv/F04LJ1KZ5L2uLzZLjXGpcZTzaT2c5Nb3lGaY0sSIk0eDo 6u94t3k73c8U3g7noeT0KoiOzSDjL9XE+lU/pfrDp+/839LE6aRmU8qe87uVMr0jw/ao9jjV h6Y/VYiP8yP88OtiSWxfOfhn83+jDp7nuLKOPOaW4fvGP9n2qjwfzUllV9kwpebFv3uHtdHK /qWhxEhLZ/OsdpWyj+eO3nbcR6OiWU0sy1P4P4m8jjOSPe577+Zfay+j7XKTw0mZLMqZBH7k P21+TERv1VUxqqrkfHIgmkZImi8lllEvrKES0/z4/L8R61z7OyeD/lNJo0fo6f7FjaF2iXbx 0/6D/iaWYbZYGCT6v5r2TB/cWNm61m8lr9zQtYt03N/iPxll2quuWXSqqy/dtx+yyq7jjs7X Qu8S6Qshl2/k0q4/1P9aXTxVx27Ytmzcsf6E3Ro8lDhgaps3Rck5PFc5qrUlGirk1bN1zNVg vf6k0TZsl7JamzVYXeMHiqz1p+zCGVWnb8VfMKstGDFksOGK9Vu2TZmLRgowbv7U3i/vVM2z J6X9q5utbt03a8kmTuOijFik9KxNze6uPzaeUdH1VMemMNqY8OMPh/V/In9af6WTMo49cujo 4+mXDpmTJyObNucc4g0m2IjJG95nGkGmz/tPjzEm8kQ24mSZzmnBJpHNpHJnJkxNOcnOcnJz jEjZxP9iMcR55483mm43I4iSSQk0ObnJJNJbZJOE5JnKRyTSJkhM5xuRxOOc4TJnOc/43HFl dMD/J0lScdEWVjDIYsYzVExh8T3vie+fs9/xdMVs0cVpWNtNpXycaOKYHJgwZk43IyGUbKVU sKk7lfyfnkjgyZONKnhTwrFnhRiqlNJJn4RzJnj/LtphxIs+hjoUWV0qI10MVUlaUxIdjy2d 9GeW88/RRzPEtrKNOS+mk6U6nFdJCX8NujlVrWmPLDru1WbMWZXg9Z6/47f5P5PqfYccPsZ4 aHTqvmelfN8GU9ytJ1Xg9WVRNNDSbZEkaI2xMSTEmSZkkiREN7CMchIkZIyTPtM9v3P2SX7K v4JeIWdrNv50FkKtqdMrB0DvpwvtZxik61SrjBSxmRqRJ8TVJVOMisdXEJMyKRmpImtKUzKh tQFsIzJTYoZxE14C4yVRlcsWsa4zKU04sSGb/uIHhtPIIk43JO42KGGnLZHNJMiZNEyH1A3E mSZEmmpiSREyTSSMkk2JibLNBEiRpETbdG2zHTC2LpMKcyLZRWyhcc4ptRVbFW9rgU5hdunB cYV2shXZiuMWYTmg1NsDm2iJMkySTCQiZpNpBpGjdkwjMQ7H0jwdIjpY8LI7HZGLFOSpmYxJ Fy7Azlm2nhNJtpwpp28MTss/eeJ4Divux5fq/cvU8Hy+R0tx229O5prqdRZ7Q9m1dPhGlnsX MnhXp2+Z1Pf2mMl/csxPK+mjU9k0r5eTZqK7dTPMTJ4jubeVj5hUitJZ3ej5l/JLipKr1ajF q0U+QoqXVbbaSus+WSsh2qVWZYfJbQwYI3FUEIplqd2hXK9tdclhlikpmGmlZohmlqVyy0lx CkNtJU2pVfB/lpNWKUdwmkqV5xVn+sVplZ5fjphi6K0WdXa8U3i8XRuq8ng8nk8noeL6qoNG 7BVqollhV29aQ4aLvny6zKz584ldxxVhpdhDT5D8WetrPUrFVXyXiyWnbbxh4s8caO2nyzxh xt6h06fPDtdhh26benb1dpZ0hdtpgq6SwqZdOMvXy6yVPmEvG23EsuKsuPF22Vmnzx6w7WeP UsPnSWGm2mWkru3r1VpxV68WeKsqsKnrbxdh08dtlnTxgl86fOOLPVWGGF1SG2l23T5DDxd0 +YeKu3zt2lKUMPnHiDxUq7fO3jDizbxhtVt4246Qq9euLMrOFyyHiElUumyr5l+FP4oaWatG CqrhY2aN2zdRw4VBa2ZMly9o2bN27du3UWqqwgmqzVUVaNWTdVVRVRuqqCq9eouaslVGbVJR VRVVUF61gxZtGDFRq0bqKKKqKgxXrF7ZkyaKt2Ddu2UUVVQN2ixi2VYqNWrduqqqqwVBYyYL mbRRsozaNVVVFV6oNmjNa0bJsmjZRRs3VUVfJV4+yq/KlG2L634xOXww2/NMfp+vP5X9l141 rXNa5jfN+Eie4nusTTyaVknIcaREc51K3Jvx42/enN+xPBp+deQ/Rle2Tw1V7l0zMsYZmIXS 0GWsxJ2HoHxdqteVUorpUx4NuOK1C2NDyb8bePtNoiQkk0iLbZ8NYOI0SI3HZySW5zWr7p5Q qfD4DtZE3NIbUVQsiibUTKRs6eZHhqCpOleE4lqrj6WIifEc0nzY8jmjFjY9091V1MGKqpJx hkK8nhPbMqvBged5p6MzS2rbisiyWSjpCpOKK1CN9TOj0p93wYObxeLueDxSd7xcO14PQ8lH c9CojkhyTa5DjRObVj97VOmFjoPtnGfbPuk6b+rasTONzIyl5Tpq9j+0LCbq6Obmq7FXc7nV i6Ox2u13KoiOOb4u49CaOxMkm83xYu5R2qKt3R1cnc5ujsdztbO5VB3hJ1hJD0e9BJI7EO4i 1hPq8j8VVvyh+UcZmP2py482WRnJlYpjlshZtpSMmpY0lmKdfqGYo7pdtUrb3TCnRRzjXR5f 0YP8ytOHFbbXwY/xU7VFU5OYae7cx27NT+E6/5PsydTRjJZOnXens12n8UbdP5PZ+b3fyfye Hc8Xkm9L0vS9L1PUqg7uXUjkm6wLkohNEHH5Xldo6MXccb8GLjWZDOqO0aUpUWVJpYdhsccm DJhfVgx+CPQr0bJ/eSY5L9kfkmjIySf6UkXolCSQnE3e1d7m5ObxdrseDteDwXPB4u5VByc0 E0kCYmk5iaSYVDCfz0hP7VP1VFG2Kfg9n2enCx2NnDq6uTq6Ox2OxVBwQkShJzXFri6fRxwj icbipx+bjDPtX4XRxQVtUWBkRxYj/PPD008v9DbScJ97LHTGSWeI8zy8Ohikqww7SZIRE1tE RCRJanndppWtomyT9fr3jfFjsmcazL/RfmvJfszzam0l6XvZdQ/rP6XrP3p7WKr9XKf6ua/f eWtYs2T2PJfQbdnhFHb/JiMsLLNJPy/J0f2v8nR+jFY/zuPsrTE0rFaYr83lt/uiJbJX1SfW clfEbenQ7jcIoeVknwHJOmzVekf867eTjqVcZ4ZzDGP1RIsxtssO1g+BpXYxROgvgeXnS5X+ DE5HlPst4i/pk7XTJ+r6PD7vdXTiuONuI9T8JqzwyrMimMuYfI6ejZ1MyrtXGXKcajouMNyD 5GbMr1HzZbtuVVxtkjZLErZ+1n4x/t/e8W1of+NJj/HGLEf8QM+79TIwv/H6JPUnf0Q4YPxP D97M+b5O10zuX9+dydVeTVMZU82DNMyXk82Ysq6ZTCyJyfzTaWH/Hk4h6eVf8H7P3P0fLj9z tJ+t4rnobnJ5Nn0XpL2jNmSc26LlrJJ2w4w0bf33T0s422pksug/iilLwXotTaRJv8iP8RyO b487ZI+C6zpjqjjLLU4Mp1cdOp8Doflke0fjbsd24OIh9LtlYqgmk1piqpmKpVXQualfDdEp uwbOmJd5OvEw7NsTbGKxtjTSzU8MhxWnGOKxXlRjty60nS5beri+apg2WbSWQltBWbTbLeKM UpC6KRGnHpvjUnJ0M7UepMeY809DVY8CrFXobU9OinDiaJVuMKy4ZmOMKrpIxZNLJxiKk8HC 23htp/BbPtJOJEjbknJMJ/j93sRxZHujUT4SMfV7w6Un3cYZquL5dl4pP+i+yL3P6ivcT2GV 7RyRpTNRmGV2+b1cfF6N56ru6lX1vZ9NvtG3ZbcnZ/jfgWhbK00sUx/J/kSISZNMhJJJbfax ws5w5miyVGj5epD6GIpTpRk8RpYirAqxP2P1dK+yvu7Y/3vSvor6tunlNqadGO35Tem22ivU 0MbHQxopd2gshEaOKaUwZKiSadKZNlxBCmmCCtKUNEP6l2kNmjKzDK6XElkrqvGHG12iaXRT C6FmWqSqGUNJMttJISqygZWVUaaYoTXmc5z2q+5hXgzhm3mp00/G/Kriv6EJY2mQ+Jmkzluf 4u9kkSNWzyHHjPLS2k8Pt/Z/AcV7o+05Im1knkN9ifg/tn1f51fk3SPKyfFmnxqfZ45Nkmde dRuTSzqSeg74a1JvKr/vr5vkx7mHxunVXtaP/G+NJpdw9e8fPc9kSfCQnwPKj7Psf4SG1yfK dsKo2yZJJj1gxTYeFeVXbVy466qcOoZhxVdB00ftdm37w8PwbR/qWOmKJD/BH0zMulYTj+Oe HOOpf5xezL5Tji7VM7P3J+h/wMfdWPZj7NOk0p0/ommHwJ/7AP+0RkskCIxJMJmTLKv5GSYZ RxlmL/mQ4kyaI3pty2Nk0k1Ts+DDMv+bw/xY8373Tp5qL0f5P8n4uzFP+h5Vp0rowTjhg07Y JpRuQb402jSJETpjhNJNJGlkkhJpJoixE0Wi0m02plhIiwWMzCMxS5qU4YoyLEuIyhJ04cAw wlLoYE4yqcZliwyzFWUSMmTIkiIgyJsxEETZC2CGmwJMJlSuYqmOOURg1A+vwpPskLD6Kgqj 6H/JJpVT/g/i8P+L5fdsqk4dWrk5v1ujoqgyRg2ZsWCSjdekw7WdIXePW1X4y42uuswu6dLu NtOnbTCHbpkus4k429fj8etulWUtrMLMMvGXj1204w7Qw4y0wcdNqtlkmDiG3yUPnzxt4+Zf LuNunHbSrt69cdNsOm0sPXT1020sWfGTDizbxp6u0s7bQ2+XYaYZXbVQ9XZcVevnTLSyr124 s7dvniq6WW1XiVnarKHayxVUfO3z1h88WXdPmlUO10PFVm3aHzbjSVXHFll3j1Z0s9aemnzx Y4w7Q4wy8fEJfPVmzLKEsNpdvln4pSqzDTLTj56+dPW6irZVVAzVWNlGijdko3btm65VVVAx WrWbZgqzbtm6rZu1UVVBasbNF7dVsybNVWyjJRVVAmzbrmDdVio2bKKN1FWqoMGLVs0bNmLN o1WKNlFVVUC81bsGLVu3aNWqjduqqqDRmqySVZNGjJRqq2VUVVBavbslGahi3aNFG7dVVVER o6Q9k0JdqcC1/JHiE0kE4E0oRJ/mJOiird1VUcnDmburo6ux2KkHkkj9ETmP5xlAm/YldJck havbs1XRwo6Obo4cnJe6OiqIj1JM3CqrFw2UaKtXDdVVw0VDhKBe1WmrJwqqo3UbqOFXCsBY SXrF7Ro2btkmqjdu2UUVVQLWCSQd8TRBpSrJFSol/RK+rt9Hp7Ph9VfL5ez4fJ9j7HzfN8iv xRnzVZlTlxs/V6vqf3IjnDk3IS2G+JtJiWkJM5sIOTbJbYkzTJmKdKq9/6dn5NeZjiZXmP6K jmx+EWFmPiObEtI0P7FW2n/h/u9iaUORX8GPxf2NNGnurH83R2/c24lcK/sYY0wxRTt2ZFT8 Oclg/BtcZbEW2WRZMsmTR6rtni6qTvM8C66tm1bM8mRNLaPpDxkTTkcJmDqR00sZVmJ63ouI n/61JxOvVRWujqeGSJGk0+FeVVwj7yuNMkzQ0sVdExwsLP6W5JM1OlSKqomlYedfaBSkjaTH 4unR9S7q9P/H5Lpl8GbK9bp15o4amk8T3PT7IanaOzUkR0pEUsSKyZqLJgeb40yTqk+M/i4j 0X0HtXTPCXGXIpxWFc/5/a6K7WlOK4xefy/KHHbP5OjGdunE/7qckkj6fHN5OTkxJn/Jw6ZM 1GGqzB2tO6cZCxBtpoDtMsiRTk5ZhyyRpbaRnI0TE4f1t5Dq7E5I4pojnRxxpdsesdzENtuE +GMWHc/b/D8Z/ycpY8yenow9HGr/NhdHhycpOGmWV4My4y4TK2vBxWU6Ys0zOVJxpX/31OGW f8t5Hima6bi+QeJ4PDLMvturwaK9Th4ZmjjVx/toZD/k8MfZxpNQmKhUf96P+uPwadPvmdp/ 1luk9fHj8v0khEcTi2UbORLbaUsz9Y5NtD8IdS625KlW6ib9gYWScqL7wkfSdk7lkTY6UKp+ iP5P0j+iv+z+5f7X8nus2hKVllmEknyEsEIaSYYf2MJZXOIfwQht/tsOkqlUP7VziWX+0wq6 f2MpetoVacdn6NLsIZaVfsq/g7WOrwZvc/ik3Xt2ySix+TqsYLXYxYJLXJcbsE3VNcmvfwdF q9JJJ1VWs1V7Nem/gnav3p/1T1CWfknTp8ZUYpMQxYcq7c1Zqvi6ejweUjNUzVS6exUxX4tM fvYjSn0cVKjpSZNG3TEpxUkqnh0s9FQ2WJrZOFV0xkJxRJVFUJqaMaZHWpjTC6u6OmGaO18D KdNKzDNPsHGnla9iPZLpcvSvVHSv/E+idWWtWf3vs6cfq49v1afWaNHE6UfoqycTTLHseyce TVmJh81oZez+7vz+xHoe9MXFXowzKZopVQmlT8j6Go2tYyRXFfCsU/FZpOTPskkmZ9rGiCWM lks8kT45xpGQhCbaKs3k61ZWHLN7Jp9tsOH5vQHhks1MwzLNDvxdp0rti/aT6p+T9g1J4Gqs xZY+ZJPzdv4uidqjFKqSdswTFCQk20mk2yR3t8Pbc54popmLKMUbabFVLYXtxif2v931j77w T4S9L9w/N7bi+asxrOc5ttlxoWajo/Cro0fXodGK5OOkex/sj+o71yU0pRm6dzZY6H8mi0mu LFhYxj8lelHht2n70nZ0pqZJSpxkY+FccY3GlRhWUppNJYxGp5fZme2u7Q9r/kYuzxUvRlOS car99cfsvCvLXP9HY+D6Epp9a945J2yf03939jO182Xdqnw+T6mOOPuZx+9n0a040dJY1qSf 97k/75pwya/xSft+rWH4HknceGGOK0KT0sYQ2SaWVUirDSYownRNWSGIu09vtNxIcLKXmhxl mr8T6Nfr6H9/kxtazQ+9ngSpOz+dYvUSsT/AijoVf3W2XDJllwxYn5qMr85X4d/KfRR91NXh yVdGMxpbUymGoyzDiS2xJpBLcTNOd2hCaI+kHJR5ZtzRIktNuTaWlgkk2EmSxiTSNLZI0jb0 Z5MlUe9/avDLhDjMxmHoo40nm/pf2vYytMw6UdPldujNGasxnkw5V2r6V/F9bE8V28MfB+r8 Hh+B7E0M0cD39vNmpNVxeGTMfljlp+HE/KDyzb62WZKrNDGW6OmLNHyrwL0Y7Gp5nMbn57n1 fzeXs/tceyq7BnSww/rImDSenonupg3JpZs/pD3j2KiuKcsyh9ax/E7anI85WPgvHvfAwyvN hyMsf1vMVO2C+Jxl/gixZXkkeSqnbGMYkw4uS6mS7TdznGruR5zk5703mtnlwVNKfZjFbVit SaWTSExYmj8l6M/HirwyzQZizH7XTC6WYkSyc+480cbY4POPiTUd75Jf3C8P0Z/p/Y468QuM JmzKpmoM0Vrl8h6sMx00uUywzZ5vJk4I7frcT42fusqO2qrTtcV7mdR6s9GnMOqO+OYviOnq feWv7U1pmtfcwLSSOFiZ4El6S66odJWSpCGlWDTTSDDKH95VTTSyqV0JUp8qqpDS5VDCSTTL xp0orROIXR05ODjck2xUpO2Z91XF48R26udWrzato9TTw2z1bMjKZU0WQcjU+ks7Xw6enZ6e DIfZFEfNmPd5eHScPTRgKpO6rvHhpGx0PDLhRg8OStdMThTgxdyeLwO2XdOGrhwqYR7p1IYk NdvD6nhWHhPhUn42csdPbV7ur1qvO9+LNXTDgmmYqxExZIxUirlWHX9fTuU/dMe6dMXBxquV 7FXwFXbSZpQzCRhIzS2JEmzSzSDSYSxpBiazaRIJMk2SZLbZpGSGSGlttpYyJkRJtIyRIzUV mVZlLMlZkmYWZMymMVP16ebJ6vui/yedvbdvi7v5ME/tyiyT+JGpOHl61Pzlnw/Zj9VP2Y0+ 7b8lPsqOKiU9KRVnbY3ISbSaRks3NNufy9NNzHg0nFkx3tyaeJw2uljSm1K9K7ZhZpajQ1Ve J0GnIqsSdT8HaHFkZBtEeek9j93Sz3R4WDuWXLzeriui6wONSY0Lgnkx06VfdalxjrL8n2X5 uMtdMeicQz/rv3vgkw/K2ZFkv7XeMyvD806Y4J59T7StpIz4n1k5H9bPvZ8DOej7FqL1L7Gi 8NRixNISMWfVXFfZdJrk+TbaUqqkvTJokmnA7JvyclHYyUcP853MnHgmmkR7ZJqx/NmT3cof 7/ZP3vwJ9EHIjtsyfu+j6GaHbJ9XdnH18Snhr7RbRpTCVYpPaD0Rj/oe8k6VNNJpUjqSI/tk ht+j+kl8nb6e72idLOoeXmybrE0kkyaJrhRim+5cuM3RN8GzJLi7Knq66rba9IUVGU4VaYpe k0uqklNel9hsR7h+SqIPNG2aNUb2CaRlEPQnBtX0VSmP6qd/SfVoVjGOX/kZSdMk0+d6jp0s tWtNeVjPM/TudbwsxM1ZvRKn8Hbsbe126dOF8+FrX/Q45Sdv5vFF+H8P3T7CfSyT5MkzIerU s1WbljjVliTHW3OcTW0JhVDRJrW2y4x9tfwZXi+jL7GPDpxOM41K8mSZpVmQzK4rTjjiO1q1 q46dTpxpM1TNXTUmj2c3bTaRIsals7Nu9p8lxX9R8b6vRPzZbfpYjyasy4GkkfDT2BXsm5E0 9k4WFYjDkMYr7KxpZL/tj80/T96Oo4pKsOp2Sz2SZk7acofYHXiWYzGaJ9nH/UlVKh4fq+7t iyMlVb9ck/Kpd+G2P1uvJ7D52Hhjk6Hc/lqnjS/GyuzpZNMMPveT77HwfMuTGnGPsTIcJ5LL itfq/tfayc4cXLLk7FhmtDzRBigm86uI7dGsntiSM0mU0baTT/vv0Y0/8rhiq0xRjD3YmP8L +gquQlJVL/xrqrIWJfuVSlKVTTGNMYaYV/k422pxVcOJt4fil/vLOkMrMqQgkgqyslpddtUl wrHywdOMJjZgopSjZ+UwO3ozlWO3B4U7NVmxq6diTkz4x8R9JuWcyH0mmU1Fqd8kdsnHvUuJ 5K6nbPFP6TjTaskqx5KrGlMS6PdVTbRqap3OGbUj/ErFNyjpcVyKjG2MmgxOsmNs/u8m5JpT pxivhh+9b7W6et8QSK20J9Jt0y0s8rEzGZdDTPwRr8UkNJ4ax1Tas97h4WZmLLqkvFy57u05 Kt8KF4p64nlZO1UnTUVdeO+c3Ml6PDORxqhx0zStDiumk4sU92osvGLc7QU6VVWnTBha0eEo 1krWWWXThxcbnldH4TUhO202Vt+5+D8XROzpVWWUjtpy8cXFdNcTjJGfDI7tD82h+9SanpkY qXnGj1ZFkaY4sPhPUuNUnmzNJxquXGLNT7DjT7RP4f/vn639R7u1J+E9T7LNrqI1GnXTkVXz DKunmXhnzejpyjlXmtDyMkiN922z+tP1pvw7O2feKpHK7XKqeTNB2aUa0XhrjjnOlTwyO2Wa qw1L4vi4eHqrI2Rn0tyKf9TnaTZvEYkHK8ip4+V2LwxmaNX3uMzZjtbPIYro1WZXBcaPT1q4 Pn+1U9FdqMg8mUsYe55QzCRNonlu2uTtnxNjyG+axXwqTI4wtirpisyLah/7NJ4sOzSTsxLM 6U1F7I3Jp0+6sMfKSuoWbjtVVGKwsZbUlprhtUmR0quciy6GIo9cryY8JFxiu3lB0yWZT4Hg XrF/yR5xU8mozIXhOMnw4/Y9LuqdMZkljVTGLNKsMDeH+uV6q9z9pjh2rTw45kOMOFpfovdJ wsjt3PB3suzJ5OTRH6R5J9PceTyOHtbon07RPax53Gc851zzGcw4s+FGp4aFmJmjaHSwdSFk j8w2sGzcdulJVRxRmXSLtyTpo7rNTui6NDyG5bZpNJiTG/qS1yOhz/Xp2444pN3SJU2ptZkX bMSylMOnOOOZuSpq0rj7XpcPzY7Y0yvc8Li3y2zleTx+K6WS9knb/F/k/6dFr5ve7X4ntZH5 rVrhi+RcwftXKvkkWLX7HzSWojFJ70iM2RJasatE0PSsTKvqqouZOHCbNedybJY9yjRMsXv4 JIk/JMtJDdVM/ktdTZNNJwmmWLEk2jZt/B/pVUqgeOnqy7bCmXSr9kO11zpp8OR8WX03Tw+n N5paRCxZZkpixxGpyf63NJP/lsiOO2Ge8047zjwpp+5H4TT6+pP1I/B9UlO36Pc0mJP9rt2v +3DkyX2MLNzs+TrpNf6mVsyVbKf1iMSbKXMzERj9Xps9zp/I954KmlkdLjGryY5OuXCmlnsz 80/Ek/k6CgyPwRxUPYxffbPcqdMjMWaq+z8j8X5M41NYvDI/J27ass0YO2uNdLpkeK475W2M MLHvVXWFhPgyxGJZ+yxc6Teb+Z/OmtJJMmmeRxzmk01u/J/nfE0sf7pjP6yYlVB9DwwxRVMT qVJYXdHSLsmTMYwszNSzMjEh+kcQ00kc1jc5zSNnJs/2kZyMltvJyHEHLEsJYltpBLImTnG3 LSNpNFksicWxyZLbaI3NM5Gls4jkSchNM3Jmlsk5cmcm5OTcTls5zmcm3I5EmJzjk2SSEm3L kcTY5NznYSGiyTlpG5NJomyQScm5ZpNJyNIchIEkttLNJpCTaTbkzk3I3JpMOQ5YJMcWjjTM mart++86cXqpx2x8nq+w6fN5qeTLtfzMtNNatq831tReieSymYM+tzRrazjLl+1fV0xxWKmK +zTtonHTH3UduMVUKxt+ViW22kJJbNuOXGcrbWItpMfabemWIkyW1pJSR4uTSELKf963+hl0 yvFr29bcp5MoZqlmnbMWrLJLOWG7Ib2lrZQ8q4YscZOTjQZrw9lHoLtg/b/jcVOmVMxmXvXG JyveeSzDMsynbhcVoyOOQfYvgfjPeY0bCyGVpGsXhmZHFZZmqNM93mecUaLw06XThJItmW2h Zbb8PMfEJRPUvE8MMZaNPFcXKmVjW2IzbU8GOMrF8Ee+/Cv6H9Kea25/vR+jb+tJ9Lbkzk5B P6kyi/arO6qe1Po5r9/P84/jNTk69CxZJTUlk/kV4PZ/e+r2PwNK4ccGkP60fH/bT1iTSY/K 3f8m3tbHcuLWp0Q6tfayJ75YTwyOVojCjSoyPETy9j2tpUpOlMZxk4yya2Zg1R1SPaPJ3OFX hqRi1FmomYHQcH+kgkkJNTf3LpJpZWq3U9rOrWZ738LOmrtTjT4HGfNn7EqcLkLV15y+A438 A/c4E6aS7r1qwy6YzDia/Y5cdMcDG3/ap+L3f2PvG9oqP7XTolRZ21Wf0W5fG+mPLbfSORyJ Ytzm5WpGJUb/tdsYntJPypJkPaU7UmShU/mPhZdbfkt8RPKGlTf+j/Sm231Yx/nRvzvsbtf8 aoVtVSP+RbWmS2/+ValZW/vf2f8ez9ghJbS1WN7T1ZJ+NXH6n5Pub5q+wr9qx/M9nsjy/RSv 6Sp6iPxUam4a2jFKqPL/iU0JvISZxFtWXO/DfNlhKCPz+9Yf1vBuWFXpWGqRevc1jBi+r+1/ Y/sdrqf2n+ZhdtTbxpVLp62S8Qldp7FTthh8ujaqbaJqTNGbiDiwbKqpNw004uLxXuPpIdu4 xd6MdKvItA4uqrrUqcslJVT+Pu2f2LMlf5Zh0j0Y8v9TUGl8i+yXTH5/N9h7Hh1UrNV8E/sf QZ5/8FvwsW1J2sTeaRK0nhRpSTTGS2X5aG1h/hWWRh9mRqj7Zw90bVI+ifoNKmAmKI4x1ZlR VQy1VZ9U/H+7UPt+cyH5PKV+hhP+PtO4Tke6xxEbUOpIsLpiFBitMY/aHlwrF0OS0TtlmIzL NBEJv5Ww/mrftuEtnaOja3yPif7DM1duGcuqTjCs0rMK0fL66T4lkdqVX3WRV80sayJbFVpW W/bOyf2VtqKtt3k+E/JioVZHuJkTn4tvwSyYQ94j8xppX7ePw7bWDyp3YLFSMO2NTeJgYmDt mv3q8r8/6/p4bMHu4vfeipxhmZY1PCodV5Yxj7MYpVP3Kj+jj9GnH+tiqwqtsdtNNNq/VUf6 VcVxD+CDSDtC6CC6Db90peqqrlUMe7Sf0eXHTbpKrRVVUxjFYxThUx/c9GPCuldPT7OnHFWE tks1ttOTmfpMkOWxyZIcnI5Ettyw5baEzlm3jRxYJbHmSpZRykCW2PTkdpvQjyyduz3PLPNp itNTct21ohJpbbJbIljPIScjSVs8s9ejaNXRpzRdOnzTp3nTOA7tLgpma6NfrulgyyYL0ysn eS6l7UyGI7XbRmqzV0l9Dp0TtlZV77phjTN4dpPua2k+Lj2NPE0j//Vm3xvjj4s5DjCzVcJm mFXyHk4eavDT2SHoNzphSMRxSq06fNDxE2eHZhVRVE7UrBqVqVLI04cT3ddVeUg7vKkdsVmq vYhiyTISYlQ+j6P3feeyun3OlV9GnHg9K/Jtj07aeXb4Ty7mTMfFtI6UStLNKmNJZaHdc4Qx ge0+J04s+9WtE/Z/rO0O2p4L1OntvtOdUzRZqM+T3PqnLefCuUnbHuD4L7KZf2NUeGM0PacL 5vm9anZ+DWox4Zn2clOH/eZfT0cj9yw/saxPoez2SMkPqHscnE+6vzmIsmdOHvpxlr1x7i8q q4xTMs1MxXBegfBK7rw1vmcfhchbUxcUuMCrI/F/BI0qZ22/B+L7G2h26qcC82irkrI44vCd VzUw6Y7vKXsdPDMp3YsZxTNW0n0cdVUirbbOJs37z/uoppav0/1rB9LZoiQ/D/n21vOif9e+ a5Rx3TwcKdumLw5cWWassuNPZOhjpqPYduMEumJViGSGLDBY3CwPy449zGOWfTqVcwulxwzK y+bNxfJl+bl+WzxeJqN5L9Xo4xmZjLWepPgXUeTTtP3i/5jGLHHVjL31Lw0jNK+FTK/Gs+TL 5J4cZhnjp7Z3WUrSzz+l2Dcm0mbxF24zGMa7WSXbM0p1KnGVmpOqXdcP7vIjw/LP9T9PJXTT JZn6+36c4iRXWWt2mnxx2nltq2vjlvZyaJu1uyLfHPiHnJzrdpxO5yiHkd8sXTUHIcaHK7cK 6ZmnA46kPxIJpFT2r33yZWPhISWJrHuW7pLVz+p+jCSrbbCyr07cWQ9fqZcZdMlSGGmH8X7I LqsOKv5110sssiEKfILoMrLtGXz1V/FDS6UpbQZQ/HiVlmlVlm3iqVn9Ttwg/wKWZS0h+itq VTVTiVpTTto0lPSmK/KcGpxU9ljkrpFJLnH8jtpxWnFbfi2leWOnpkxOjypsbRgppTHsaU0O pJ4RibUVTy8jSkxinGFSeUYsJxaeyMJGFTNNIJNcrmKM0/4FStGj+DxYWPxAl8rRRtSoskew MHF6CTCz3xXwu90dmiq+CjxuP9PW5IfgmzBVPZj9jdNkuQ4WGyS1JabpnJJYhRascPLjTVmL uzvwrG1fR000qqPLGG1W0nrTu60ahlJArRVEcS8foWNs0261Ns1S7Q0r6UKRLXbLafTsutlb dZO66626GczWc5ze1KySlilnJZZRj3ZNTbBsWNRZc/BZVVVVVV8ifX3+MYeqpfOl1CUIpKpV DjjqIWFUqmztjDpgxJQpqR7ypOz7WVZX8KMBihFFtTuEq/Z3i8XxNcXvZFrzicWY66Xm9Zzn OuyHsoqz2T4B4SxI0qV21DmlmbHHOPVdL8L5UuH1+I6+L3LK8PX5/j+n5fRjLijydV9bTxpc sj9FkOOzkrsk4nlEzRZiUR7PhVVT0rGMYKqV/pfdWmKWRQaTijEWXZufwcabblOUO+i6R2xM 2aXhg1MJcZLGFMakxYHzryunHfvDpezV/WavpdqXH9n14vDXjXGe72nqtXh3K8NL+zS/0EZS +VGPMvgsliyIpHeJg7fh9pI2ravSFKZL9JZun4fiX4TyHky86j73R2VjJmU1+Z9zw/R2/A5R w0vsHGeQuXyvJPrNVcvSrtqnotGMZnGuMYxZ8q6/bzOh+75kYUqkUqSr+TFn4YtjFrD9f7Y+ wnJPzVPpPh8qfxQ7YHRXpOruizQzZs99Xo4dr8+l0ardl8/d8A6WMzGZmrZJbb4hzLYIZNyd ZNb/FubosmmSFDybO2cttpbZyRxuq1xn39i5YdfT0dSjpqfp5m3uxjpX4tGMY7aeGMaYrw1G laWGKYMklRRrU1VWSz2WaPEw+Xhc0zDz1zO3iyOLlqauomTD7NCHhUdEx6fHvot+ZYz2Zc/3 NTzT0z7209qV20dNWpcarijjSPfHf6vrA0sE4YtD5WR/CnvLJbwvE9U7ZdQnDKXpJPN15XoZ hilTrGD9X/qYcUbVUU7aUZTRNKZpJpTTGWy1zoT+snGzhH5ROc08c5cTZyrKZzzhy2aLN7W/ qMlpCWbQ/Za9n+x5paspJz+CfkcY/Np4cYaV9mMcaOipx0xppifoV27Y2rbSY/m/gyWWXVZZ XWcYYQh/fXSswhl0WKpipjth2piq6eHhjbb6O35u12HjTSVnqqrSzp4uuhVU2gldVtC6V2Vn rLxxVZtCqULLNKruIbYQQy26SVQ0t6TSqFl1WWGElnRkSeiwrk8DZpTjbwqvDHR0ljBtGSbb U0jtNKdE6VFaUx2TJXi8Gpf8yQrvmWysYmO3eprHiKTS7VnVMrOL06Qy4LoK04LtqUs7mx32 9dbmG54NFnibk2sab2k1PENRZ278zpt1PGKrtXFeFeGc6jG1KcVOFasxjV31zEaUyVaXVR6l mksK5fDCvTt4V9D0Sel956nrqT29pE7d1F+JOxNG5/E5UttqkyNJO5Rv5n6NVZqxLaSWkqiz RJqvOXMo7J0mQ8TcWCT3VFYhsT/2KeEk8htPYdKnsHgTypSk2wwpWLMTY0wkqycnpw05nDxE eHNIi7nE5O3aV5YsmSqwztNocbkGzia8wnA6SonW3hJuTw4xajkeHRYsqyeHhNsdsY7GlirD 2CjFTqP99lTj4vY2svDM5WacSnH8oerOEvAzR0XHsHFOGmaFml3ptPOr9fy/Z29GvLTknFyy Ncoanql5rKh6JgliZVZpJlKqQqVIT4hHr8ZrtlmO32Y6Vx4dPq2xVfVs/Vt7K429NHdpRSZ4 Y4NFr0udMM5dOozVaJ45znOdORxZVcXbLlOMrNS5dLjSy4rplnZmr0i8teLt9zp1dNaUn7ez ywe25cY4sc3InJcPVJoOmrD2MY1LMfc/Fkfxi1furlL/DB0sk06YnV1UZpkde6fvn1ncvh2x T5vfWdEYOUn1oy6d32PnfcTsr0byPTC7a+taHh82b82J6McqOOMeGOFdP3p8/uXmzMeSi9Hu Sw7almVmGB9li5E081xOPRiqbSp+5jJNsHVXTh0xyOztpx06Z2/6btTlfUyrh/rfkvQ7Jo83 h6rtrMsynKjFSZ+v7aTapKpx7KfixMfuTy+XbbjSsOKaaYw0qckkp1JiaaVUtJokbPtMkJbY kSzSbcG5ZkhpJGlsQ328dEjlSzud802kOlk+rboVSmHHE2JLSW0fEdlFssWNI1g5DzJy5M5b yNuTkSyjctt1vHNzHkzJMT10O6TJ2yV21XC4zjLrm1TZWqqh5/Otit+zJG+Pjz6aT/bB6hJ0 e2PYnZY9vDwenTqfMKT5NKcMfRwnGXo4R2ZJmR5Po8z0PhV4ap0BhlLmH/wZOMqZqn4sH0mr w943h51M1Hxvj4nlT9n2VMaVNP7GGKbRR4Kib+xnI/w9t9os2s2fh9uRJkmkajzR04rMzMvN mapjK5QcWUvYdnJJ04pxeJMeM2Dtji7U6ZDMqWWp6XvXSp86TSvivKs4jpJR4/6TG6SPE0mg mkUn5c0jonHHNJyEuJqdJXpx9pwnhjqMsuNVa8lmlM0s0s1Gar2paFBZySxNHSQmmSrHzz3I 9P73y/0Pd/FMuXpv8GDJFi162jBVe/2sWrFgkmk2VbS0h/lbZShx+JfLPH+6sw26Mtv870Pq 6i9jV+zX6H77lLvIn9/0jpo+qf+pNJnkOlJNtf1/4h/iJJLDM8Gpk/xh+23Q7YO2XFqEiTTJ FLaZDXccSzaM3LGaI2SOEJtZ9KF0yfR98nyk+4PYjNC6afbF5pY/5FUnr1Okk/J0/ofVMI/q v5Py/93/2t4k6L/846q56Xo9VNtefwK8m+KO1HS1e9X3nzfuXB9rDyYsy6idcuEY0w1/R+An UH/XJEfxP5KcUquTKejh+1MuyZlZlZpbVHTVWLNpbG7aJG5GljsW5HGOMjxKnGVmXRONO72O pf4fxyfz/dJEfk1BX7mH9usLFl/XEff1h4JL4pmf4uNZM/hxNfIu3hqTMGYzJM0fasrwL4fc 80vI4jMO6uqusji84dNH3L7HpHVH8GeD4vxetXqZbsZjtg5TN6cUdaNNsZj24P9XRwzPrUel LjK/w+5/OnRmPYDX8FcX53Sp1Yfkwm/zvthJstRNUWtaWtkH6U1Q00/wfqr+5X9p2kSOTx3J O4jR0xU/1tMfV5McVG5ojy0Gh/mUaUnTp2rSpFKZI+aS5PDa1Hhmd6pxos0OOlq1U6a9a9/T tnbLi6z1LxZy8X08qk+bz/ja1nkuyMU/E++yOmrMhmvRzF98T10kjpCqjHv7v+8rsqnGmk0d K22wcf9bpybWFRuYgy1p0syWxZjDNsbGptiYptZ3qGJ/RyQ/dbbj6XVXHG2ddS8PPF21R6Ua jUsDIuNUezjZinTplGqPJvb/WHGOSW2bSVka0bycI5xQk9aTV+CxatEnCbvdVqNV654mzFfy FezSUx27abiWRppwe6xORNDc6JpDizJU6TDTjbzGM3OYZZLKncs76mHGGJqThMSyxjJrUlVq JqYrjTGmmMKpxTDGHKJUpCWvw7PPw/D31yfSHkaZ4crhr8G9Lq83U8aDpLKX+aNuQ43KO1To /hIbSGK6MWRUzDHDWXUxBi2EmjCNyHY3E+JXhq6PK8I6tfve3P+61fG+TSPVqcY9h9h7jUyS 8NctYcZXGmaRH2PeFQdyepEf6r9k2/2UeFSPzVXGVmlmKMyzUS/4L8/rj+Tx/Yt3/l34Ut9H zP/o+pON8WK1bJNlTqVNz/8v9SLYNz4c/Vf8P/OejzjvVz/x3rbLumUVkxOMaaMVPgaY4xtt dhYYWX2f8ajdH/u/0XP/NRw/7KjSn//F3JFOFCQPAs8qQA== --------------090005000205090404090605--

1 0

Re: (ITS#7053) back-monitor blocks
by michael＠stroeder.com 28 Sep '11

28 Sep '11

This is a multi-part message in MIME format. --------------090304090507010204010001 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Find attached client log: Mixed web2ldap access log, python-ldap trace and OpenLDAP client lib debug messages --------------090304090507010204010001 Content-Type: application/x-bzip2; name="client.log.bz2" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="client.log.bz2" QlpoOTFBWSZTWdQvv6YATxD/gEQQf4Bf9///v///+r////pgcN4+pJrEBVCgFACSgBEIpBIA ARBSIKhFFFCgkoqIESQtgAAGRCSKgoqpCAAAAAAiAIIFCEQolSERVKAAEgIBQKVQUJBVCkCE VESgqgSEgAEghKCoKiVVCVKkASEUgAFVQiEElEBEBSAVEpUQlKlKUFREpJAEkCgBUIkoKiAA KQqEVSlEAoqCIRQASQqCJIBIRAJEAAoqqRQSQ0U0U/1Ueo2k0aGT9U2k0YhkaMAJkYQMmATE GIY5k00MgAYjIMgBpggYgGjTQAZA0AHMmmhkADEZBkANMEDEA0aaADIGgA5k00MgAYjIMgBp ggYgGjTQAZA0ABSlCBNNAQ0BNMhMTCaZTIwQCT9TKeappmiepiejUCokQhAgCAmQNTU9BkmT STbQFDxDUGajRhojcwr4+uV7Em9J6/9P+vsooPoof6pNKqf5JOQ/2mSMVYfIk3wtyqf929lY z6H+qYyysymZTTcI7B2DsMJ3SNINIP///y/7/fdWP1NuG8MsGZjMcX1PrdH5/s+3g+7KerK6 dfJr1tGfpt1bZafB7sxqxNgs/5mA0knyTCyWfSofgDOZD50G5Pp82/ojTVW2lq23MUwmKdmn laednC6+3XTdS259xdj1Eyb4hzuPU/qSa2u1LdNzY0uvdjnENvaTzjh0yuTJJHnO1+/Jb5+H /9akdecxHuRiOidtnFVZVVjJMttqrKqjBgyIPCIGRAwQYW8WpSlOLWtAgRAiIynDvB0zW0t+ vyzVypF1Xn59vPbe978/Pz85H4SPtIKu0GFSk7YJGVFjBlzSYDShlSPIvck1SeCTZJ2JNq2F uT8GPc9LRP4vJPWep/0PJo9VH3OX3j8Gk/9B+Z04VydnA0mxh2dmkYrwcGE/2inLw4Sq0qYr Rock7mkYpHZXYVg4FVgqOhWio0ju0jk0T/3YMRwoqqrCYwYMFYFOHYxsf9HY7o9BTkacqdmk cHm4d0dPNo/4Ozyeav0PI//g6dPUeB02ruMJVRomDQxNE5pyTZNU7U2LuLmOyNOCVHJpwo24 KTyHsaaI6NGJuTi/8tyn/kvBoP+7tJ1vBo/zNkwe8nvQeaqjljsOCerRMQ/4NoxiPe4cju6a HR0bHZw0PgPcOzhHTpFFV0Kr0YOTkf+SNE5RowjuTs5VpR6O7/iPor/9DsjlHmTVubJjkn+C Y3uadhaDo9DiOtyejl6jw7PA2jZH0FbRSNIo0qHvbRR4cqjbydPIeTgnA6Rticvo2VWjEmKx jaPJjgcpijgdiUjgaOCacHChgcjhJoqujyR8UYabVylcmOnc2YxtI2PsVXmMcDu6FeRs7Ozu djDbonh2YYUjCfAV5Dkd3ZHQ4dI7J3FHKqmGPzfmlWf9hDFBjA/rYaUY9+Ef2NWionqelbtV qGkYjCsRKmJy5Y6VFVVVSYqSSsVp1GhtpUxVVNqwqbrFMlYpKqG1bUrGJMYYqkxjE00rGmMK qDSmStitqbbYlVVYxpowpXDGNKYjaslVUKqSSTSiq06xjTEmMYk3UVSYoycjBlNm1VsaNqql KKVVVVKqq0wYpVOVcNME2rFVQn/i/WVP+bGBimJUrGJ+bTTSYVipgsaNFomGN08RdLKvq7TU 8X1vU3JOCTRo+/7vQ2L4vz/h+Gmmn4fhT8Kdjtdx8jRzdZjafVXDT9T5H5KOyuyo0p+xW3LT Ryctv0NuW22OWGk7tve/BEdDls1A/EbPubjm6Nw8nk9J9zZ0ehcHR7X6nJtXkpVPD+pj0e9+ p6uU82h7PufenDDltypphXxeHsoxXk975tPg/uYcKFf5nuVKp7mMfi9E4U/BXDh7ldHuYnvU 6H6nTRwqdlcPciYx9ypVcFT7lJitKqViqUxRhUmMYVVVipPNU0o0r+pWJUaVO6tKVphVIxjF U7MGHzU0Riu7scKrHqpyp2aVhitKrpyaaY0ezauXs4T0fR3eTblt2ditvCnvD5KPmx3aJPV7 Meyv7oJ7ntAcT8n1/PPrOz3vYk+aplDFOVwWknUXylOLksqGKxVPBJvTZ4fUKupqSDOSmVhO rEarVJjW3GE7SEqxKn6+n/ipFFVUkVSoVSSqJKqCKoqklUSqiSqiqVUlVFKlUlVKpVVUqiql VJVVQVUpIHPsrgZXN+FxWiTKOTe8NTXK4gT8nuXwi9tO3qSemtMIz6UnnW0dVTLJznXpLWtb oZVeMrXNit2LbG2FRZJStWE1ZbBaIYiiRUxTzru7y3i6nrfgxVeL/+TZamPJhPpep4OjqObz Puehq1f3NyT0JPBucX+btJ+5X7H3vN5vD73L2UnZXZU/epVNK7qd3TE2rbTs0j9qh4U8OnDh sKqSlKqVSqiVUCqKUUqFKNtMRGlSKqSVUpXhy28NnKlVPZ73xMJ+SvxbfN8TbpE+lhBjFR76 Gr3vtOjvdTn1zy6PodjRj1JOt97HBxaOL9h9NVcX2P8HNq+5yY/se44ebacvZjl5tv2tMP5O jlw7scP5v7223KmK7FVP3vGNEqpKqVU/sUMStvN9Xk81fsafB+5+1+tjbH7373BXByY024fv UaOTZ0dODDDsOx2dODly/e6d2nTTDlXdp04U6aditOzTh2djsx00rTs007O7gppp02qY6bcp TZTund3cuzbbpp3Vyx07q7O7Tu4NHJ3UdjZty4dO7s7tuzs7OXcxp3d3Ds0admzbTbu4ad3T p05dndpp2adHd3Y7uzl2cO7p2bd2lbcu7uwrpyY7OXZ2OnZy7u7u27Ozs7Nuzsrph06cu7lw 5d1bdO7bhwxy04ctuGO53dndpy4dO7pwx0cHTl05d3dpyx2dOWOThju7tO7To7tOzTTburp3 bYxjauzFY7Ozk6bTlyqmGNMcnZ3V0204aVXJw5NGmOnTs021Y2cDi5NnB+hb2I9na5JPF2Px fM+dkwYfO2GPxL3Pe9Dk0dST6Ha+d86xzb3xbLH6nwf5t6Tc+D8Em91pOt1Oj0Pe9j5E+9+S p8VDFKlUqmKKrCiVKVVMUxVV/FUxSqqvJTDamPzcsfk2xXBp+bbk2cPN8Xp+T7/i+pUr+tT9 7H3vwYCtscEqcpCf0kR0okYrwrElKVUVCpFMUxWMSwxWMWFjBGKwqKFKlJVCVUqVVKlUqlSV VP6VRiKKVUVSSpV2OiT5He9zOLo73vexqxvPcy3sdjD5XN3P8Njo4Mel/Qdzuavex3tw9jFe 57nB7m99b+Tsd7EnpS+pb162B2twT8zKX0qiLK/vYqGpS2yrZYs/arCpFaFj6ojhip/F+bD9 ZT+ZWyn7X63DT95tP7NcP8n5HClPD9zH0V5vD+L85H8SWRZFkVH6/2Pzn5Na1p90+5+bN88s nLWtabnLlzy5cta1py5cvo/uPe+b4veYn0bY0VPmavM2P/Hk+tq/M8jyY6PzHstzg+12ODo5 vrdPZ73m7Hq/U/F+Dscp5vZ83+L+9y8O7HNr3Pq0Nb85ng3uY2drQuhjGL4vUda1L0sT9L0v Q1TqB/2TDDBD7WhR1vB634NHpel+lyPBzXmcHnMegbk3BveA3tR7Hg87uXE4HIvOYbjxdDk1 Gy5vpMYp2Y/td34kjzfc7uyI6RFRFe95v2Pc+j3nDux9HxfJXCtsf2JG3o831d3h07nxex2e 5s8HTEfg7vJonopVE6MK/ncHmMdpXu3J6W5o846Fb2o7mE/F6kwmlEcnmn8nseHL4E6G3Tau m0+TphHd+Zw+ruTl732sdOTg4adibefD6NOHAcTTy0/gahy/Dp2Nq7K82MYxjc/FfFtvd7t7 2rznvO93FclonmPD7n4Hc6NqNKjT+tEVg09yfNW3Kfc83yOnL8H4vo8P8rh3fY7H3NuWPUab SnKq9DaPVtyfI9jbgjzcOk/Rsarc0HB1LQr0ubRNnkOji4uLwfoSdNn2nzHIofLfHHwzTdze 2NGbzW9zWpTN5re2NGdBg25QdIKQdb646zTdze803c3vNN3N7Y0ZvNb3NalM3mt7Y0ZvNb2x ozeakbkbkZI0kWRqRqTXWmE4EN9Verrdjc/+qP56MmTJYssx3n0eyaRHUr73YYqThjCeanud vQnBt7ivD9j72nTl4fzfz/t/S222222223+f8/3/283+Oa1bxvjr9bw9D3vRj5FT+ljZ/MP1 PxZEYwwTGRiJjEwMwyJmTImZMIMyRkBZHb+h2J96J9zyDc63qdb6nF6XBjiaNXwdC4O18x9b 7HUvoP0HNzR9Lwuo6m5qxq7mGjxWjxOb5m9o9m3yf1u3DzeHS69Hk9kP4OGOXJ8ivgo6berg 2xjHDhpo2rav6XwadPRjs5cWj+DZvcWxjud7V2qp3PFoWKwlowYT96gaKJGKIqkYohKoSSeT h7Oj0eqtPwTEx3fBidxTCvJpD+hEezBPRpEYOVKrs+x8iTZo4r0nnMbHBWMFzckmgu7b2VoP R3YJ3bTAe7HD/B9Xk2008XAbHDnehpf+n9m8eLuScDcXrSdPS5uKOt73k/AvlScHqFybjZJ1 V90i1Sb3R6nW5vJodjyaF1OTH7X2rY6vWx7HJ5NEPDkNPi20k2pHCjE/w7OHq+1jw+Ph4JtM VU7vA48nCuG0j8nTHzRHwfYiNEeHDE9GPCsV5vN8DXL1dKmOyvycP7eXYxodKfqdnY2+jR9W z2U7uXCKoxp4T5OmHxcuEjyeQ/cNOFRHm9nm+SfMqpyrzVy49WOTbHkeLg7DmOxuO5932sY7 PO4u0derQ8Ujk9Fff9/Pn92v39dzfzOpqJ3p87sbNU87Q+LGjUeZ9L2vOeg4/h35p5vlT5n9 0r2vB7EnzvBsfA/wPzfF8n0fJiTRNMYx5P5K8OnI+qjbZ+T1NfdK+Cn2J+bHc+nJwrpwY9Tm xhetj7W/4C7DpVP6MKZjKY+D8XpYvxT9j3v4lT+Kr+LR/xav/DGxsY0atTFKpVSbYqmyTaiY 2qkJKiVWMQw2qqVVVVVVVVVSqqlKpVVVVVVVVVVVVVVVVTCVUbVJErAuxOJKLBiYnoY8WFJD 931UoIWkpUhl02oTBM8cRIjSGTASXXNrik8/U3UBhsbIDgoBt/e5Nq5aebh6uXuOXs8mn73k 8ndNOmkd3did22OVV3fFX/yctNuGMcPm0rwx4V3cHKtNMPtB00/vSSfVjyd1V4V3ejydPN6P Y9m3D4Pq6TuryctGleSvJWNMeFaK0ad2K5OmmJt8XT1Yxpo4aVt0cNMOH9bZpt2YnStNmMdi vtcGnZwrGmHDljbHDauFcK0rattPcxwrTbHDTSY6f4tNOHo6dPNyfa0jb+TzdnKn6PDHSuGG DpXhj/Qerzcm3TH1V2fF3d3LzdnLhpp7PM4e89CYcvJ05YxtStqctOHdy05bTu6cK+L5uU0r bux3bT6vDDw9nDzeb7XLSm3LR5Mezpy8nh2McsaY83D7DTg5PB0ctKjbhWjTbB3Y/N9HLpw2 83Lb6tPq+r2d3L6mH+h3Y+LDuezl0w0rlwTG009nDhjTG3hW1bVXorhjpptjor7HvbdFeivm jsrp2fFjadnA4cqqo4Y7sY02qMd30af71cOnd2StvR6HJpRwVHdy+xp5Npw/2PZy05fR000r p7MPDSsVtGH2MXNjV1vU/vbO0wuTe5Ojk5sfi7HncXFxb12tHgx1uw/reTRwYfkvpLkew+d+ Y+V+5j/Y/xbabaVp7z4O/vlK0mGPwfm29ynxc/Y0mK6bY6bb0lO1VjFadOHDZXLDl9GiP9zl +Mxmtq3Hdw/R/c8SH3rHLpfUPzjBzo983DR/Blre+0mkxtgaTStPM6O1ra3s/xT8H+T3tWrV /kmzVsx2Hd5PSni7WFowxWGLB5PVUxqU6K5JgxgwxDFYVjJMf5NEImJUxgxEaPc9zO6/h/bv 8ta1r9ifV2ftI7vZo9SqNsy2XWTLbLmfk7P2Pyejnw7dM4tzjJ3Jf7sPBhJ6RakyU1YZUysa 01Yq1DC0ZmP81lJYRZEmpW2mCbpiqqTRKxhJiTFI2q3EilVBDBbGmQkmiKSpG9aDSlUqpVKr uxqxTGG6MUeXLQp/iqosEOHBjCRgliqsULMmDIsqf6a1owyWWWUzLMssGZTMloylgvJkrS1l phTiFgXC/6cR8oxjZW5PYNINFvSckn8lWA/zI9tiPL0fW8/0fx3nBw4evz7qp1/CzLMzFO1R ODFfpexe1/WPc3KqL5HJvaOB/8uFwWPq+wr6SfCoP9xfX4s+lNayq3OcgV0fk7KPnnzjpvec XSMsSf4tqT4JMlU88L+kX7daTZVWVViS94V5j4EosiH3MF4HnY+TWdO02tMuk7HUutODSMk4 GCbYhVZD6fX9fV1J+Sc5cm1wN5wvi+LlTlThw4OHDh1utiJPBjAd+/jMzcDawOLLZbakapup s62UW5y48efPTTTnxbM3TfdHGutTcy+GmbK0bmI79td++Wdn7X3vD/k/cTp3eryevn5+70In HX/InfO7eZmta13d+/eR75HHHHHofi+Y7nj5ipjeZbqPknyDwZy0d7vd7Rzb2I35xquNVrtt 8+bvNpbdn6S4eW7hnyRHrdenyZHl/q/sX7qfr/wD86/1aP5Jbgv3BonnX+SdSXk/UpLb0H20 v3P4GkbPU4P9tHH0/s9nCfb+5+DlNueP0T9r+h+0x+j+hy53jlmuMWLG3L9HLpppVVVVSqqq qqriYxtsxoNMYkYxhFYxJWMDGMIxjEiqb65xmOTGjHCtuTT+Do25VTbhjbD9bh0rhw7NKsmK 6bYlpwVRFMabaaaY0aJMQrTBNEkk000kxjDpISFEmmmAiqG2GmNMVWMMVJisbMExUSqSSmm2 NGmMVVVMVGKSqSsYrGmmnCIJMG2mJMVXCRBWJVSilUcKxTaKjFKpUqpUmmGGMYgxjEVjppNt sVy7OmzYkmwYrgxpVbYbVpJSTlGiCGCVWlVthCH4O5BDo5cOFcsUqcCqQqpJVIVptjgrhtWI IjCtJWjasJEykTRjTSmzB3ramEmmnBwacq0aMbVsmNtmzlyJJqcNnBhw7OXDu6cKqqrpt2aa SFbctIcKFY2pCTaVDSptpJ2VwcGzTlW23DThpwjScK4cODTTbZt2Ek4GmmCqnJUThpiJWzGl EnSmitNtGmMdMYdm3Zw5NK4ctHTsxiSQrgjEgpVTEkRJwYxwpWMYxVVg0aY05aY0mMcJpMaY kxwaaJpWKaOmOVOzgxWmOTsdiNMUBJRwUquzGKrFYrG000qqqRtQxUiqSqVTBjGDhpiGMYYo kFYwYxgqsKxjGKrGJWMaVNK4NmKctttnCp06JJMUlKElVCUnDuGGOzBjStNGMYlVFKldGmml U7OWm3Y5JESVJGnKbVtU0YYxTljbSsJMQ0mDZpimmNq8NtCnSnBJhMRwNtu7To4YquFYSSen 7z4WKWVhgPNp/kI/6/W/tetwe11vM672/qfmfS+zzPHT6/x+7wqHg8/8/heju/9dTdrK0GWI YZRMspfeD5Tzr3jub3oPkGMzMioNOHJyxs/U4OH6imKrZpw4bdPyfRw6cOnd3aabTRtw04dh iC2rZasklipJZTTl4N7VbbbbbbbbbatWqpbbbbLS1atW222qqqq21bJIjzJgxBYqSWU058nn y4VEf5wVOLEOVWiKUUiqqBYkqSHkqpflkRy4cLTyJKDakjzVGFEkpw2TBiqpSxJwVI80OVRi JySVDcxGMSxgXEVZXPaVwrfb2HBlakyqwqYKsK2laStTU2FWi2WtYxTWqZWr3ynR2bMNxIbx VocDVYYVWLgX8t5brqfNnEx36OlSDscmpocUmxP1MldXCmQlRG8JHY5VTsrzacySTiT16cK5 cjHowYVpTCuzbbTZU4VtW3D0ezp4dk6csMHThiq7PA43t5VHaejlkrdkJTRiYf6GSee5grrO epPeorbIjuEqpTphikIpQlSVVSBVSRVCVhghowYmrBOCxJGBgqlwXrVVGJCNqYNColVESFFQ CorEDhSRJCqkFUJVQqu1I/07x8q7tSeRGhJMMkxIyT/UxHh5Ii1iMVHfWJXGJJJH0vlaA/0Y TRhJL4qbvJl/oUcy9CpvVDrEwWJlCLCEYi1YHeyqedy2aq9PdGjbwxJbMSS1Sb3FcmoqxXdH VKZrYUbaSPthE9XqhNh04Y+xWNOmOzapKqKqqY7sfa+b5uXLlU7FdNu5UjFeInP36f9HCcNK xYfA8mTqxtUc9FPUuoVbGOJVWgletgNySMDoUxGALGwavaKsSbnfjgSHWeh57fliTKh5HU6m F5tCEaFulNFNDuYW51MVV7JtNk0NsEkxUPE+J3aR5F5srZVWoN5bKc1iuLTRGRYQ6ljCjvW4 mr29Emhf2NzqX/biXKm8a7nBbbkO1hbhcD7gf+wP9v7Js2PD5p5QbeZ4KKx9WJo+j5mJpVVw +ru5dPk9zs07OWnY06YxpNMeCf9plaLHqZL1MG82VRhjGOiAxVSqlVUYhikVEKiVUjFhjDCk rRoWhcytpTYVZK8jqTcPJi37vSt5jZTeKsdGHZ4JgcqTCThgjr6D7dv0gfJwPDZ8GOzu2020 2aPJttitppXsaMFVXxY5cOXs27OHSq5bbU0w5d0NNsh71GEaKiIkpSFVInFiOQmO4xOLC6hV iEYxYwu5Va3WariooxamLXrZNE630JLmkfI7oTtcXBjk3O7uV1m9iSKpwwxyw8mmFG1YlPcw 9nLbzY28K2quGNumNoR/+FRPAfa/pcK12sevnMPk5PV3tYUghUQYYStGIOZjD4rQXRVYPzpI lHNHkrmT20jRtG0khjmorC0aHaU7kl1Iu/ocFwY5GK0YsViscFK7Md2NNPVWKquFY5cOXk4c K5Vy0xpOycLNqe1OHD2fk5WzGFJXJMcQYxQjBriYVFVjGDulYSVNejD//PsY8q5egOlSCH47 Kndj28Jjr93mkSdKPbpXYpoHL3+Zs7rA+1jHRhjl5sMdmNNG0ppw0283h6NnSp3dhiqqKlRV VSqVSpSqlf0N6d3lD0p8eIzUsxOB0zsEmKOMa7jHYk3jkkK4JExMbV6fThERNDgjsPNPUx6v Ht6CeTzVO7DwVkiMVid1PJpNphXdWNMY24acvR5tOXTlppXQ7kjTTO9iPWJSbRtXTHnR30x3 xKx5PvfeVoJuV5e5jlK71iZEdevKIid52VGk49vRI9ng6V1I9xjbb2Yw0mK4Sm1eFY24aez0 cPNXLsxyV4geEqPNMcbbiPdEsjfLyYjhoSSpoMVEjTQkmnXmnZx2m3i9+SNa5Szdp2eblgwx hx+T1UMmYZhjLMZjMU9qrEmVDavuL4p8GJlt5jH6acNCT9WWflpey/ZJy04cMf/lzJPBL7Hd EfUfFXyVjHxafFjk02UeJiU5dkRpJ7oQdOmiPTuYd1RjH9jTHdNtMVpyaafFj7fd06f3eqq0 7NorzUfM+lWlsWktWrVpbFpaWyI9H2uyI4dHYxisYp96tPmx4U9XecHSle5yw0mFP87TFU+i MYdiuvi0aKaU0bOTi5NTZs2aub+l9P9X6xHlKfTni8bSyoYU/Q+XRzbNS+YGVMs/8A8/vF7/ SDX2cIh6iJuL41X8KrKriuef8uPd5Ok9+L9UQwv8end9f7/D4PsfS+bVqx/9KnvD1L+48hvF /XDgS2JP6AD/kr9wVavoUC/4Bom9TnExlVc1VhWh1ob0/vbmLZHWlqU+lKDkKfHtTvY+Vb2i 8nxLYx2j2vnMNqTCVpWzRjhTh0xtW3Dlw0Y1P0rkci+Cjcuo9RXAfuW9P7Uxji4NUtGpY/Ar Ut5o4rmthdC8k6qef9oelexRaG5wTrfMxjGMY0O1jVqnvWi7xjc8Esf3F7BKvkUJq/vai7Ev 7e3tb373yQ63qchf7DgfNyJP6iv4vcfeV9NedxcWjQw6zRo1eds2R5oqpOkwn6nb/mjlXmGn RL4RyljFS/aWq96XymyPcriujRMMND9rk7m51N7V5mhLySdr5H8ORq1GyTQ6T7HoSqqvVK2/ aNNNNCqxU3G9g787LMt46nYu4m4t82e1PJJX+NR/kZ9mG8D7CB4f9Hq7qc/wJGCVesuD8yW9 sdZMYdbvc3ieo1elwcXmdbVNWOjk5OTk4uKnmVxdT5XQ+3zPrWpe9cHRWMHpPcXgxswUvHVo sathe9L3lsx96tx/oXyF4FvWDHIsetornzHmeg1dTVPBwDCqpo+ZSJ/9SJiYFaYjFKVUbSIm v1fgH+2pok+35fw+0/99ADenNL7k4lNH4uoe5VdqW4SruPl6qHoe4vqNHk7jyJuYsYmqvSXa XRjgrvUJomqXwcnNvY+LkXwT3J0TE1TE1TEYT0R+xUfvRg/EcIrueDs7Ozux0rbGNnd2bd3d +5DuToj3vU9lPawx2n0ktn2NykvpxeDrY5LRj9CNX4ewtzQOi+HgriPrLyPWp96x63W5C87G MLHpQ9i+KXqT5T7GGji+pXibDzlyVXnK5MfoQ+etv5U7y7FJar9CWrnzT1tHoMcz0hxAOfV5 h5iKjsFY7MY0wxoqJ9iT5EmyIar1rck3K+4rzpwPQ0aNlD6FXdHh+5jE7JOzu5SfPGlfckr9 xPVNqxyLvSfEk8zwvIOsX67DnEehTR1sY3OwPqUloXzodyq/NuXQA9iToHtBaqxDAq9Dor/m 9K0PBWgeSd7eWJo8i0aNWr6k8zHk9ZNMJOxPvTTuJtIiphgbJSVXAtxaJuTGMLVsvR9DrO14 B1Cmr3GjZVVPKsH/Fr5zbclqkfi7nRMaYrT0eFTD/ajg0kHwUpsVhJ/AqJtWJjEYmGKrEqKS VUlVNHBMRhtOGjGDTR8FDbTTDlyYxtW2nBXJ9FctOWMVpjBw5baY2dmnJWlYrs6K6dlbcsYY xhw00wadn4v73zSf3ojZLmdHwDQvUpqx8yb1bGzgui9adhjGqXW7+hTSjLGCaaj7Gz7WyvsS wj1h+91qqpxPcx66cGCVs4KYl6wz0uSaP5JQYk1eR4j0j5H1Rtij7XLaaTkaRRpW23zHLh0x 0Pi5McNuWY2wrHZppXdy7OGNunc05bdnDNg+rp3cvmxjHsk5OvyX7KNZNj1D62HFOpPsLomh MRU/aVyrlUcGyYbRWjyZI7pto3Nze4HFucFkXF8rgljwX6ftS3PUl7XMvWDmXUHczZ6HB7Wr HY4PSbFlhn56q8Ct5Wy3ro/tOJ4pc0t43Aw/E0oxVUpKorpJypOSp6qeZVVp+BtppW2zRw7q iPIlV+idye2MfBjChSismImRUMWJGMfW1L9RscGMOZi8FVrRHMuzre0u1cH6yx5nUjuS/E8z gJ3fgSdPMp8ng5Jhjuj8kVX9TBPl+DxP9y4OjqHNWje7DEn2+dcy+KeJ3l+zi734JB1C+g6m zHRqdqL2qLgRh7iT3NE+oV4PmDevlTEtE1QTixxFsWOLGF4sLkqrZ1lMeJfA/qxwHaW8+D+Z wanE8DcbjcbbbbbcOHg9X2k8E+4nzYBtEVLCnkSaE3LsGOg0aNHQvSdri4A/Uk6cBVYrGHwe qRPoox/aYsYTqXJsfkmr2MeRLRTzsN7A4CVfgC6n7iwxfW5E2Vjklxclbk9i1qS19SPedTZy U4PSu551buYjsfzJLVKn24RORYlB6C8hXiatVofWrqLcrtelwSfM4lsbi0OCtzgYcFTzYN6l h9Sttxe1W9qk5OyVVVKVSq/JPxncslWJNE/rd3L979zbG95veVttpttikb3re8/yyL84rkof knzHE1XgMaNjZs2bNXYdrom8tGx/FbI/Ql8C+h7WPg1RjEn5wxr8UoOucS3r5ktED0uCS9Ca JoSdgN6fe4J1EmsA7uFPgnvUisaU+SGI0jzJ9hMYx+rldJKHQPvKrgfRFK4SVcXpca3lwUfv /3AO+ovrJPipLAYl9DiwtyeSTzk4ETHoJO8nBhil5JfiI7jtbNGMelDQ+8/J6C3PQjzJi/O+ 11iluS870l4FifgnrTGjRoxkPkdqTmruSg/Y1T+WEuZiY/e+PtQ8n0rkQ7kPWtGBTEwjDCsY mNE70oPjzJH8hYUwY/UDInXj/mD/D/Heq7kv4LEsZFf3tRkGjS0ssSaa5mSbP1Ojt+f0+wif j8p8D7gTasr4237rNbVtS0PxFwT6sTfbkxMTcQ+ayIfhW9WhLf5JOMkaynCyIfWtLRim7rtS 1sp+y02TqluVzLXC31TqTek0K0lonK2OjGNNa3xMhB+9H5vROVJ5NMSVU4fgxMU0ctGSSebR OSbbHn5sOCf5nh3Psdk31HNJoRzB97oatXi5Nc5Vyc1+KWJYx0bw9RXYMYYGPqPtRs/ETq/J xPUmWMhXE+et0tb0BoehqqZo/jL7nhUaPSzUtnmPQMMMbkn+D7EaMeFoHUwngTvdQ5PbCdqP BOX0eaNtJivgxw2x/NjGKjbTFNuSOVkKtElRNpHIcEmmjSsSURiT2NESaQ+1oqldPeQ4UUqK jmdIcgPgTjh8ScFvT+9NEmjRj0vtLkuZjnSGOBc3WPyWMKWGMWLFYMMYjFWFVBSii2SgopWi l6GNSxXaW9V0e1i9CbPJbmrH5i2JPMk/qf/Y4OnwT4MNUe1B7B8xUl2m9dnZHnO5esvcrk1J WHNiTgWVbO/RWDxMYm57j2GirzD4mIxicwo2T6Ve0L2HeiO8u9hXsHsqDYT5qqLwe9Fj1Y/1 HzYrEwvglVayPPdx5kwnnY0MHhjBU7JgTZUMJUcJTg+CaVJj6Im1V0ST1RMP9ajwKr7SJR5M aUquW2k0qlcK4VpW21NsMFbGMeTHHCKhyklJGjhHJpUVtppUYVJKhiK0Dmv6SJ3J4sYYNNy2 DkhbG5Sn5CTEMVknq9x5tOX62GyI0ixbknscnzMn9DzkvBhUc3XV0zPzH8FRqsQw5UW6QPpt yNx/6LxPHDjaf4aOo4SvvVisYmCyyqsFW0qpVVSlKVVFFloKSqqVJUSpXZPvWVfNJhy5NImy 8FNtUofcVo5phb2FYxwQSaAxG3/B7zRPQxjk0qNOlasD4HmleT+tJeo/x4HBVdS5O1KSMMae TYieCbYkkGkKSlQVvWK0I3r7U+ZjExjV4iYlhEK2joVFJUilRVKUkFKpSQpiRJ2NGNoqUVKs CpJSH/XE+VfJj5nCuH5q9CqpEpVI/niT9fgPMUVVP9WpJ3MedFTkcF16NE1ENFS04uxHRVaG N0vRE+oZSYbNResk7W4R5kdzuSu5MJphjJEYSSkxTvXN1De5OQaqPzf2f2+AX9eDBhiqVQqr En+ZIUhUfgiOhpTsT1IpJiqk0qHaMikxhUjHnN7t61Nyn4MMYi8NgtFVehj27vXTWmtJiq7T DFSvMnUTsBtNv5d28+DzqcSXiWNGEtGSVaLBMSxYMhet4lpAa+ojVE7htI7JOkUnLGNIilUf RHKlKbFSaFODZRiMKpNmNMY2cIivxIgbDFFWIqyKolWJVJINSVxjSqpIqj+xMGI4Y4aYsmOW PyUm1kbTs07McpOGzbD9HDFcxkktk4WPrzCJ/DJNJE55Jgjk7phP8jwTEhiicEcIpW0nyPkq qVwQ5ODTR5ioqqqDoSpKqR5iqpW3QsahxMMYJwq6JisFXwGMMYxEpvLtRyfoar1upHrVWPeO U9JMIiyhSlKVj3o+YpJiMKxVMVhVY9G/Xgn5Ijyd1V+DpNGlFfJPCf60SVSVVKklRsm1O4j4 pDZs2kj2xHtoGKxjkVOCsQ8XRXJE1Bc68WgYXcPs6r4F1LnVOmx01LRhWGOA7VeDmMDc3JjQ 76X/EF+fuby3uGjFJVKqKqKqKVFVFVCsYYWiTkWKuLrdruireODG5JvVod5XBbGpuYxuo2B8 9ROKFfaMGMfsRU8KhtFJ9yulRsYxtyqKio6R/JioxSMFJy7CjSKYwiVwMRUVCcoVsTDHYYNJ Sqk2x+5ocNupj2bV2bcnKlcJSg57JOSafm/tcGPex08nLpTzOnoOXBI4dHdXDTg2214m+TTb s0SMOn+c5dg/ueTp4ejl3PROHqbbd3h05dS2WrYtlq1akcOu2m1eSdnKuvR0qqm2MSuz1dNv J4Vj2rE747EO7w81OFerw4aO7HZXcx1JDDpt4cOvZh5sba48LhjGEVXoYVwxitPJWFeDs09m 1Mbaeb1eTSqK5Y4Vy00xh0xyxjl3YhyqVyaeru07uCzl5uznyvDbhjhg1k0cHA23bm5qfakl 3JNi6bdih6ond2FChSqVFI8KcJ7K5roo3jmGKQ6FwLc7S4qxwRGmzomE0mHBUQpJUSUxjGOZ xLDmq0aJ0pWMi4DZXYOnSUrE2ikrCMSNJp5CeQpKqV2PCcBHTkiq6RSVVHBKiYkxxMRhMJwq v4q/zyWESi/qVJGE5HmnJI5SkqqFQ3Q/I/Mwxh+atpW4tx+RdGHmLuV/wYTd0C4y6JO5Nn88 Xbhq1aIxgVrWJJhVqwq1UtXWW8qcIj39dIjT9FnhX/FEfVhPJSrXhj7Gn1fF8XDlzWJyp4eJ xxsnKXzlcE2iOiNA83DQmhtUkYkpwiqg6JjQbTEjweQdCen5CMS711tFyJfuY6lGDQsMLKuW Bb0wxgc0XpWiTRgaphjKi85xdENi2S0B7Ve5j5cbG5xXe6JOCr945DFhYYxjEyMGUMYjDEfo dDgxFuWiveblxKn7E/Y/2q+T8lVUo+Byack4VFVuEH9JDwpK5eivD3uBw+QPiSxsORiuJXBi MeBWP2le0cVW5WxfO+LCuTtY9StwcU3PkdaTwaNzRisKMU4YmJJpCiYRUT0UxO07zEq6ldax fzE8srFoYYz+ti0GQY7WJhzHVKuZfMkxjsOavQrcsKmpe0DY8PYG0lbCTzHuFI+AfFRhCioY wxHzMH6Io09kpwo00wMJSKVGOWNtmFV7MbfNMbdlNtMNbdnTbWHDh6cG1HZWK6Y7NOkqqrsr Cu7BpTu2nZpto7OzG3LhgqVpTSu47GpVqttSSbadkkzodJHJMK4J3NHCNoxhVYrkajeVqm4t TiWtwloT0ksLFwU6K5hyR3KYu9/SXYo/g5h7yc3Mr7TmSsTyxmFq3vAxdSrDFK/B2SlVKVUq kcfyI+oqKSkKVCwaNB6p7SqqUpLJOhJ9jH732tOlOmDg0T/qGjQ4JpXyMPU6OHLDTT5HDs4K 2w7OVV2aftVOXd2dnJ4abd3Ll0d2OG23B5MbbcHTp2cuHTbRy6YadOWiq07O7bhy6cOiOHLB x9vAnlCCk8wPI0k9hTIWEmFHcmBYx6lmVKpVQrCTDxJCtOoRNEroHKTER4nJJI9/vSPz14cN uNPZppub01G5N5dFXCYZLdpEN6fzuwut3F2GE/Y+dLVq4JOou1J84d65G5aKu2TC1VwO1opo jBWiPZ2lj2U1MTFcLFWlhaRDU+DGpfuF4rk0LzE+tCw97HsYrvK/Er9hzDrZfrbxWk1MPE1K fy1p1K6mxBzc1dQrFsoNwrBR3Kq4W9jGO9V/vsataW9alqlvaJHd8QbcpLPRVWfVx0kdFKSq krCYmqTLKjCjQmDJgyFkGQiVBipVVUVI8AqoYkh6uDCTRj+ttA2YT6LlSRcJhOydylKisJyV VKSU3dSr95kQ2LmDmwmGUsmVWLEMWSYZDLIZYEwsJCyOyOz2R51aTbw6ROUcvBXA8SQ2XnTe Dkk8mycDidosENTFTkVuU60wsYp8qswilVFWlFVAxSMKkVKDGKrAwL+fVpbl9DRGrgteQv6O K+tROksUScCVSq6ZJKSOmAn9xwbRVKfoTQezhsolOyiphEYfokpDsfpU8eZ56TFVWsa/WdYx gzMMZkqcFXW8UnEuDyrRJqkcHBY1Tc4dBOj1v6tBODilvi+LqRj0NWBkGqt5PE63W3oV9DGP kWGiMOBG8rVspXyMbJ3YypSTGgaP4lIn6I4V/YHfSY7JMJ+YxT4QkkYwVUPeJU1LDZ+9aKdD tJhzOI3loSO57NjGPZWJUiSlSsYOBRRUhSlUVUqqqYqSUp+DgtVqb0LtbCvYNSvgg6xdz9D+ gSFfFzoxjTRjIwYomMXRVVjfatD2P1vUvQ3VXB5ns7jGMxropaSsMMLzqd4vNgaFbzzP0GMd p6Uf1jHApU+JiYm8KowptrDRWhaOtoxHgX6XpRO0HsXJuliztdq6h2qva+04DRinsOZYdC/W aoj0YaV9fc4gnwPU+Tuk2dmNK0TRYwWiVoWDcTBqe12NRVzVPMdzG88j4K/Pd5eDkHEtX1w3 hbaOCUpSlSKrwiPZ4fN7htI7ExiYTBiMMUrGKsMrDFYwYsB4MaJlUrGFjBX0F1IOKp+lOwxi 4h52JqjGMK+V8FeZeZqjKW5dw9BYweJq44XFU8ldaNieLxFWywrxU4NxRjkxpyJp+DMSnugj RtJwOBo9i8E5plsY0YT4SxNarrPOPeRUpT9jYiPRJyk5Sq4YopiKrDFKYxRhSUmDHqSiTD4n KqgfgSNyvtLVFKkxD2ehex3UiaNHRTimLrLQ0YxWnkSaVW562zi2EbG9uNC4MWym5eD842DG x9aelTim4cDvTQ7FVbhtpjlSdnDE81TlW1NqYppU3qeSnht3csdlV4YnZ04aIqyRrW7u6rdS 2YalhLCxTejCWqtzZNBSUOE4SYJo5mJNvJI8ivxx/Dw27Jwk9FVQkqlKagnP4ejov5nQNUar HUp2FSTiSDZqn2OKTLaquV81p+3FqvsTQDECdB4R8UTCSFLJ9z7GNMYVT6Pg025cNK4XK0o2 eylYqxJidOVb25aFvb1PerVNVbDuSb996GovkVi6OB4RDVJcgcGDYtSeZgvS/esUjaocXWaM LV5FhW11nRWi5myTqdQrSiNWON1LVs1NVbJjIfzn7y84xHzZ6nOU/RUMbmJjHmd6us8nYO8r YroE7WO1R4qK0LFYnFXBVozXiGtIfaLUTR71zc7ieps5Ny4N6fnGj5HRyWbMbN+NWre+Buq9 Jzrgu88HYXBXIOB+5VtVbycvMkj1U0lU+7G1V+zGyaV2IUxX0d2RPeTf4E0MSmLVJo6OscjE TGKrGMMVYxjKjGMMLuVqJOmI5mGMMLCVRLLJLMyTEKSVSowTlp4SsHdXwdnuVEUlSHg7xJO6 aSOxtSq6khwTDFJ6aSMZ5kdE0oVE8zltzCPN/NOlSocD3ep7tMeuJilV0GExQV6PMngHcmiS on++QV5v3D4sYxSsYdnTqdP5Qn8ol5wbyE6JjmjwpesIMPJScFQ+5tCU0isYNJJsUbUo4Bki MG1ZAYtTB82NKqVR7yqwUrD9iYYnZsxpT8CsU2qVW1GlaaJkVrOlSWK7v2sOHDFVJOVSYqpS qpUlVVVWCqpnLCiUqFSqm3gDGqn4MQhqwag4KJOQYkxJKSuSuGOSTRwikqk+xEUcJK5eh8Gn MfR3RpyolUqFA5HzVIfRRjswY76GrGMXrLFous4gN6XYvBwR0cPNTEmJp6o2p6kpJy2Tk9Ul S3liXexxYMMVhaGuqrxXENWJGMVY1LcSYLTRJoU3xNWQGLrAaJObEPEthuKYq6OCaO0u1zoj iqrYOZYMVJSkRioHrUiyQoMUgdSmFEkwKkjun/FifcrHJFVVJVOENGmlVRkg5ERjaBqGr9Yx CdcuwkOjV+on7DROC3pMaMYoec6JpSmGEmBo8KjEYrzSSSpI0zFVpU1rGNMSYrSqfVEYJiey TBIxKWyLepoHnK1NzCtiNw0FqkqtEk4AVEfRgqkYRUHBWmMKslVJVVZBTFYk4JHo/D5Pw01p rg2tRZ92GxSq5PtJPBPp8k26Tkr+oYcNIwVKrFR7hjhtiT/rrbw4dNnSmNPuafV98TumpPwL 5j4I6AeP9f39qrz//A1DGG82WIpRSuyI7pKQKj/BMYxJNPkPEm5uLS/SVhdhN7invRPnX6jF Md+K70sekxhahol0E4knawvoanYTtLDGFs62jZJ9hfZjGY/FMTzUVDEnSOlKqKqKqKpKqKqK qKpKUlVJVRVRVJVJVJVSqSqSqiqqpVRVSqSqSqVSVUVSqiqiqVUVSVSVSqiqSqilKlKpKqKU lUlUlUlUlUqkpUVUVSVUVUVSVSlRVRSlUlUlVFKiqSqiqiqiqlVFVFVFVFUlUlUlUlUqlUlV FVFVFVFVFKVSVUVSVSVSVUVUVSqVUVUVUVUVUVUVUVUVUVUVRVRVRVJVJVJVKqKpK/e4RsdB 1NJ712R/YnwRVSqni8aHWVeLGMYjHugXZkbhiQ+SyTWGI0VFUpSqiqVUKlVYHwKkiaVKlVRN KYwYxWGFhYq3q9dHEuDEaSY5FhJiTsS0G5U6isFhXQ8TzorrVMWMbNxXM0q0SZWRmJjEm9qi capNmwwtjExEttklVKUSqVEVJU7k+S/JX8z71wJ6GrEaGMYXnCcfGeBuErEipNnvUStn6022 w23s0Ko3tXmoScEsSVMSYVJ0h+tSUpRVSkoPJCNvzIgodz7lSVSUqKqqlfexVlUrDMsxmMwW o9z4p1qdH6ixJi3DzlPeWB7WIXA2GKYmPW0NDCuL2PEaIv2Jj5WPcxqylWHJJtRVQpVUk/M+ Kp2UiqSnsTweZyTmTUXu2T42LLHomlky/z9aSScFUpKKqpVUroP6fm+2PZ1l9Ul7Fg+TtScl 3vkY4k2Tvai3cV8osTGGMaL5GxXqfb7j9idhfYamIj7kQ0lVoxto2rTiRGln6rKGxiSp2LsY xjUY3GJO+rRWjcv0I9Co5ehfAx/afgDaYSw5u481CqisO0SfwJ5hJwcKJR8O5oti2cyd5cGA 2I4UYrHBorUr7lb3fapaVSb3FJiKwXJhWMFjvH3jF0JWi6jcq3Mos7mJiqryJTFVXZPVExGn qDqDck9SeyoySiYi7MY0sMYpKjE9ZB0+P/UkmnnJvxb4RhjpJGpIidiqoiigxFQMJVKqkGKi qYVKiqeuIYsWKqqKVYqWS1I0xhGKxSSqkqlUkxUwkUVEoWQxZDJB3B9hhGiVGrmEmJJhXsNF WpXejQroxYwbiYo0KmFSFSUNpOg6Jp2YlJMQxInQeNETZOVYqKSlYY2RJp0QnZIVCPDg76Yz CCYmBN5xdIl7qGjF0PfDvNuRV2OyvRVIqQ8B94P4E9yYxhMklE4p2ve4q1Sc35laNzBWpTra VNWLe3hzV1pOB0LshcFLuLHe5liYw1LUW8sc2G/IX1JOuKtS/ojIP2wbpFzliLg87zJjCxgn rF3o8UKxTFYvMNDFUmxJhSpKYwqKUVVVVRVVVRB/J6Iqvm/i8wP6kfLuxh/uSY0itExSlVKV H1J/LzbjA2FYpi0WhXqlok6nk7BNKpivEeLRd+HsaPY3NzFY3rgmJjHKp3DVNU9QaND6dF0F XRWS/IyXuXaWh3GmNGMHhVgltVM1aeTEgykJokkxJdpTgh6paxAwk24YqKYxJVR862bYopTF YVVitsYorEwlVRkGosGJalaK2PsBxPmSb31k5Y8xt+xSaU4FRKxtUaR9iP2DQrBhK+Qwn3o7 owT4EdxsTsQ2eBhhSnTho2rER7kx5IiuX3MYcv2tJ8G1U5V8VR7JibYiNJVcNkxpp4aY83q0 1OTFSvCnTeO6fU01Itsj3PDQ0cKwrSp00eSp4bYrbD+1owV0x2e5jyVjGOyuVRWhXdWjb3mH h0x6p7jHc9HLpt3aYRiu7GNKYpMUjBGldnTu4fyT1Vhpwjgajm29N7tz4qiMRG/ZEcpJ1UHh PcJyYKasRjFbDxPW71XKUnidDLjUYW/f8xvPWbMoY2aVHy6D9lV/p5A9UeZP6nvJjSIoqIrF ZJpX4tMaYU+xiQ4RSINkR704WVb3RJ+xhdbn9KdyaMTOcr0W9b2LrbVTBoRq3qHYW4e3oaFW 8N7RaRvljzJasWjmj2Fq9MqDmrdxx6CrwPcV2D1qbi3uZ0Toq1fIk7lSqKqqqvRXSM8yJiea MTe5+dRvJ1W7KY4qWNz6lo4krUSJO6KkFVKr6MTFVUoqkpUlQikmJZEYFVJW300IakTaI2FH CSoo22TTYr0aJj0YkTaI4O7hpEaRHoxpRVSyJJWm0MMUVNJJTDUi4tkG8uDzkmxxYpOW53rk hoDFTq2dwOfqFblxFyYsaHFX7TcKvXuHrquDRh8ugvy4ynvatybtG7U5aUyTekk3oYqrJySS P60wTSpVVVVKlSpUqVVJUqKlYx5Esdxi5n3U2l6iy045aUxNb1jFiGoT0Nw8yaJsmiuSaFwj 4JHCK5JjsxsaVDhtiuGG4kOZYJ1EnX1Xs25abfJjs7MdTszpolSdzb0bcuHhEVEclJ2yaVZ5 btWy1bbbatlq1ZFkWRZHdTau7hNq0rsmIjHDTydnTXKIpyY6YaaUqpThWnTYwqpVaVhpXkqG jhVeHLGnY06du1wcVVYp2Eq2eER0adHOSSTriB2gmSLW2SbJOKb62MUrhuWw4Gi2biqxGqnU VyLU9pdRb1wFJSklTQqJt2FNo0ipjDEUwdmlKxWMcmyYiaNnDshwTkpHRMTFR0cOlVVVOU0d HKHglJp3SpVFVVVVVQWZFj8a4UuZMt1imWYk0ThWsQ6nWsLCNzx/AuTGqmidZiUa8E0Wwapo kxhTQrVvqoO5CLD0RRUUizDEYYYMKjFJhQmEpIxJUxE0k8Ij0etHCn3Kxaiq4J3mgaFSRR0w jug0D4A9Pef46GFFU+mPpoMUK8J5u58miUMB70m3q9XxSTgdJFExW2YHq+9UcqqjGJ8WgYqe 7zfFJ3I7BPVG2E06J0j4kxiKjvGlNGjT/QwO0hh+D0HA2LE4OJW9V78F28zfVYYY8iqxSuI9 krDwB1MVNkR6yT3Sm1FVRUUWSqgokwZgxQwoZSYoqklVUwrJmYJJ4VDFVUCpFaSJvV3MbybG 5jcfWXNJuWN9c1dX3te5fp0q0MO581ak3tkjsXQrqsWSh6WC7TU7UXp7+UU9SsXyCxDYksYm B4LDqRYCaEw1lirVfNsIb3NMMYuTx4SnUSbjyeboon6WGKxhYxiYxYWcarFiwNkmIXe7qHAF 1LE1o82rQxgnz+ah6WVX5w/xJ/uwxgsejwegsYYZK/BOxjRNTGLCrBlLKTAphhhYsnWR7g7l 4sHgXUPJJhokxDdSGSR1pPUV+tMY5rcLxD5/j7q+fF6FuTQ/pD0MY5i6K0VOZfzPweZiX7VG hg9Cl50mKDFff8omryYYtRU/ykhVRCqqrYFRUqrbinwRMaE1fR8vi9ImI/4PO0MYwwfAKfeY WMOY6x4sKmGBr8VXnK0aFZNynmXS3rck2VhLc7piSKTCWB86QeSoqqoVjDDGPJV3PR7XCK2Y nxqtFJYo+Sv1kj7FSqVVKqKJjj+KIxJufNuLcBycGBzO+IfQmj5wwmE9iopwE8wrhNpwSTDz WEca6Vq1LVo0j64Teet2ODMzNX1zg0kYDzPQS5FsbStC5mhWivIwVWn8G21bKMVtWJRwR7Pw SIGMVldcIjpJUlQpJUQ/zCLgKTFaJUhJhKpKTqodxGiepTGiY3juW4tkYxK2VtqYqqVRwpw+ THKtUqcIwqmMYbVizaqrEVSkpwxGKbYpyxNKpU4Vwxy2kKu3Db7j7iacptyUnJ9iTQnCNDGS sUyMYkShpJymkm09kTDRq2LZ+DknuPFjDFjEMYd32pzAxjFMYZzI6nxK4LuNBedRPN3iT/e/ 7H0Yn8mjGP+TEaUVQ2ptxIif633OR/sUK6YVTEwr/B2baOLDH/OJf5ixn/+LuSKcKEhqF9/T AA== --------------090304090507010204010001--

1 0

Re: (ITS#7053) back-monitor blocks
by michael＠stroeder.com 28 Sep '11

28 Sep '11

This is a multi-part message in MIME format. --------------070806090607090407080503 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit I can sometimes reproduce this with ldapsearch. But for whatever reason it's immediately reproducible with web2ldap browsing cn=Monitor. The configuration is quite small (see slapd.conf attached). $ strace -p $(cat run/slapd.pid) Process 6275 attached - interrupt to quit futex(0x7f6f246209d0, FUTEX_WAIT, 6276, NULL Here's what gdb outputs attached to the blocking process. (gdb) info threads 4 Thread 0x7f6f24620700 (LWP 6276) 0x00007f6f28b41cb3 in epoll_wait () from /lib64/libc.so.6 3 Thread 0x7f6f23e1f700 (LWP 6277) 0x00007f6f29a5f38c in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 2 Thread 0x7f6f2361e700 (LWP 6285) 0x00007f6f29a61ea4 in __lll_lock_wait () from /lib64/libpthread.so.0 * 1 Thread 0x7f6f2aed9740 (LWP 6275) 0x00007f6f29a5bcb5 in pthread_join () from /lib64/libpthread.so.0 (gdb) thread apply all bt Thread 4 (Thread 0x7f6f24620700 (LWP 6276)): #0 0x00007f6f28b41cb3 in epoll_wait () from /lib64/libc.so.6 #1 0x0000000000437751 in slapd_daemon_task (ptr=0x0) at daemon.c:2528 #2 0x00007f6f29a5aa3f in start_thread () from /lib64/libpthread.so.0 #3 0x00007f6f28b4167d in clone () from /lib64/libc.so.6 #4 0x0000000000000000 in ?? () Thread 3 (Thread 0x7f6f23e1f700 (LWP 6277)): #0 0x00007f6f29a5f38c in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 #1 0x00007f6f2aa94f23 in ldap_pvt_thread_cond_wait (cond=0x7cc7c0, mutex=0x7cc798) at thr_posix.c:277 #2 0x00007f6f2aa93999 in ldap_int_thread_pool_wrapper (xpool=0x7cc790) at tpool.c:672 #3 0x00007f6f29a5aa3f in start_thread () from /lib64/libpthread.so.0 #4 0x00007f6f28b4167d in clone () from /lib64/libc.so.6 #5 0x0000000000000000 in ?? () Thread 2 (Thread 0x7f6f2361e700 (LWP 6285)): #0 0x00007f6f29a61ea4 in __lll_lock_wait () from /lib64/libpthread.so.0 #1 0x00007f6f29a5d294 in _L_lock_999 () from /lib64/libpthread.so.0 #2 0x00007f6f29a5d0aa in pthread_mutex_lock () from /lib64/libpthread.so.0 #3 0x00007f6f2aa94f76 in ldap_pvt_thread_mutex_lock (mutex=0x96dcf0) at thr_posix.c:296 #4 0x00007f6f260492bf in monitor_cache_lock (e=0x88e7c8) at cache.c:117 #5 0x00007f6f2604824b in monitor_send_children (op=0x97d320, rs=0x7f6f2361da30, e_nonvolatile=0x88e728, e_ch=0x88f3a8, sub=1) at search.c:102 #6 0x00007f6f260483db in monitor_send_children (op=0x97d320, rs=0x7f6f2361da30, e_nonvolatile=0x88e1d8, e_ch=0x0, sub=1) at search.c:139 #7 0x00007f6f260488eb in monitor_back_search (op=0x97d320, rs=0x7f6f2361da30) at search.c:255 #8 0x000000000043f7fa in fe_op_search (op=0x97d320, rs=0x7f6f2361da30) at search.c:402 #9 0x000000000043f03e in do_search (op=0x97d320, rs=0x7f6f2361da30) at search.c:247 #10 0x000000000043b927 in connection_operation (ctx=0x7f6f2361db60, arg_v=0x97d320) at connection.c:1138 #11 0x000000000043bec5 in connection_read_thread (ctx=0x7f6f2361db60, argv=0xd) at connection.c:1274 #12 0x00007f6f2aa93a40 in ldap_int_thread_pool_wrapper (xpool=0x7cc790) at tpool.c:685 #13 0x00007f6f29a5aa3f in start_thread () from /lib64/libpthread.so.0 #14 0x00007f6f28b4167d in clone () from /lib64/libc.so.6 #15 0x0000000000000000 in ?? () Thread 1 (Thread 0x7f6f2aed9740 (LWP 6275)): #0 0x00007f6f29a5bcb5 in pthread_join () from /lib64/libpthread.so.0 #1 0x00007f6f2aa94e64 in ldap_pvt_thread_join (thread=140115328501504, thread_return=0x0) at thr_posix.c:197 #2 0x00000000004388b9 in slapd_daemon () at daemon.c:2922 #3 0x0000000000416c60 in main (argc=11, argv=0x7fff0ce78fd8) at main.c:983 (gdb) --------------070806090607090407080503 Content-Type: text/plain; name="slapd.conf" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="slapd.conf" # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # # Schemata aus der OpenLDAP-Distribution include /opt/openldap-RE24/etc/openldap/schema/core.schema include /opt/openldap-RE24/etc/openldap/schema/cosine.schema include /opt/openldap-RE24/etc/openldap/schema/inetorgperson.schema # Define global ACLs to disable default read access. pidfile /home/michael/temp/openldap-testbed-its7053/run/slapd.pid argsfile /home/michael/temp/openldap-testbed-its7053/run/slapd.args modulepath /opt/openldap-RE24/libexec/openldap ################################################################## # Load dynamic backend modules: ################################################################## moduleload back_hdb.la moduleload back_monitor.la ################################################################## # slapd global parameters ################################################################## #loglevel conns filter stats threads 6 sasl-secprops minssf=0 #sasl-realm STROEDER.COM ################################################################## # Rewrite SASL identity to DIT identity ################################################################## # EXTERNAL over Unix Domain socket authz-regexp "gidnumber=([0-9]+)\\+uidnumber=([0-9]+),cn=peercred,cn=external,cn=auth" "ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=$2)(gidNumber=$1))" # All mechs based on userID most times with password authz-regexp "uid=([a-zA-Z0-9]+),cn=(digest-md5|cram-md5|ntlm|plain|login|gssapi),cn=auth" "ldap:///ou=schulung,dc=stroeder,dc=local??sub?(uid=$1)" ################################################################## # Global access control ################################################################## # Root DSE: allow anyone to read it access to dn.base="" by * read # Subschema (sub)entry DSE: allow anyone to read it access to dn.base="cn=Subschema" by * read ####################################################################### # Datenbank fuer Namensraum ou=schulung,dc=stroeder,dc=local ####################################################################### database hdb suffix "ou=schulung,dc=stroeder,dc=local" directory /home/michael/temp/openldap-testbed-its7053/data1/bv rootdn "uid=diradm,ou=schulung,dc=stroeder,dc=local" rootpw {SSHA}t2umh2Mbf7NVLBWhJ9DeHXrwmYPt3rSs lastmod on # Index-Konfiguration index objectClass eq checkpoint 200 5 # Entries to cache in memory cachesize 1000 # Search results to cache in memory idlcachesize 100 sizelimit -1 # DB_CONFIG parameters dbconfig set_cachesize 0 20000000 1 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 262144 dbconfig set_lg_max 10485760 dbconfig set_tas_spins 0 ################################################################################## # Berechtigungen im Namensraum ou=schulung,dc=stroeder,dc=local ################################################################################## access to attrs=userPassword by group="cn=Admins,ou=Groups,ou=schulung,dc=stroeder,dc=local" =wx by group="cn=Replicas,ou=Groups,ou=schulung,dc=stroeder,dc=local" read by self =wx by * =x access to dn.subtree="ou=schulung,dc=stroeder,dc=local" by group="cn=Admins,ou=Groups,ou=schulung,dc=stroeder,dc=local" write by group="cn=Replicas,ou=Groups,ou=schulung,dc=stroeder,dc=local" read by * None ####################################################################### # Monitor-Datenbank ####################################################################### database monitor access to dn.subtree="cn=Monitor" by * read --------------070806090607090407080503--

1 0

Re: (ITS#7047) slapd crash on bad indexed translucent
by hugo.monteiro＠fct.unl.pt 28 Sep '11

28 Sep '11

On 09/21/2011 09:38 PM, Pierangelo Masarati wrote: > Can you reproduce with latest release/master? Can you provide a minimal > configuration+data that allows to reproduce the issue? > > p. > Hello Pierangelo, We are in the middle of several migration processes and i don't have the time to dig further into this issue right now, particularly in regard to trying latest/master. I can however serve you with some extra data. our LDAP infrastructure is like this: 1 master (provider) ----- 2 slaves (consumer) ----- 2 proxys But the problem is happening in another server, which as a translucent overlay and several other very small local databases. that server configuration file is --- snip --- include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/rfc2307bis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/unl.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/qmail.schema include /etc/ldap/schema/sudo.schema include /etc/ldap/schema/RADIUS-LDAPv3.schema include /etc/ldap/schema/dyngroup.schema include /etc/ldap/schema/hdb.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 256 idletimeout 600 threads 8 modulepath /usr/lib/ldap moduleload back_hdb moduleload memberof moduleload dynlist moduleload back_ldap moduleload translucent TLSCertificateFile /etc/ssl/certs/ldap.fct.unl.pt-2010-01-12.crt TLSCertificateKeyFile /etc/ssl/certs/ldap.fct.unl.pt-2010-01-12.key TLSCACertificateFile /etc/ssl/certs/ca-bundle.crt backend ldap sizelimit 100 timelimit unlimited include /etc/ldap/cdstaff.conf database hdb suffix "dc=unl,dc=pt" rootdn cn=cdstaff,dc=unl,dc=pt directory "/var/lib/ldap/dc=unl,dc=pt" lastmod on include /etc/ldap/acls.conf access to attrs=userPassword,sambaLMPassword,sambaNTPassword by dn.regex="cn=cpdunl,dc=unl,dc=pt" write by dn.regex="cn=readercpdunl,dc=unl,dc=pt" read by dn.regex="cn=cdstaff,dc=unl,dc=pt" write by self read by anonymous auth by * none access to * by dn.regex="cn=cpdunl,dc=unl,dc=pt" write by dn.regex="cn=cdstaff,dc=unl,dc=pt" write by * read index entryCSN eq index entryUUID eq index objectClass eq index uniqueIdentifier eq index displayName eq index uidNumber eq index gidNumber eq index title eq index uid eq,pres,sub,subinitial,subany,subfinal index member eq,pres index memberOf eq,pres index cn eq,sub,subinitial index sambaSID eq,pres,sub index sambaPrimaryGroupSID eq,pres index sambaSIDList eq,pres index sambaGroupType eq index memberUid eq index uniqueMember eq index sambaDomainName eq,pres index qmailUID eq index qmailGID eq index accountStatus eq index modifytimestamp eq index mailForwardingAddress eq index mail pres,eq,approx,sub index mailAlternateAddress pres,eq,approx,sub index mailHost pres,eq index radiusGroupName eq index sudoUser eq index krb5PrincipalName eq overlay translucent uri "ldap://ldap1.fct.unl.pt ldap://ldap2.fct.unl.pt" acl-bind binddn="cn=readercpdunl,dc=unl,dc=pt" credentials="h2qev49%71" translucent_strict translucent_local sambaAcctFlags,sambaAlgorithmicRidBase,sambaBadPasswordCount,sambaBadPasswordTime,sambaDomainName,sambaGroupType,sambaHomeDrive,sambaHomePath,sambaKickoffTime,sambaLogoffTime,sambaLogonHours,sambaLogonScript,sambaLogonTime,sambaMungedDial,sambaNextGroupRid,sambaNextRid,sambaNextUserRid,sambaPasswordHistory,sambaPrimaryGroupSID,sambaProfilePath,sambaPwdCanChange,sambaPwdLastSet,sambaPwdMustChange,sambaSID,sambaSIDList,sambaUserWorkstations --- snip --- That /etc/ldap/cdstaff.conf file contains the definitions of several local databases, which use no other overlays or special configuration. Its content is --- snip --- database hdb suffix "sambaDomainName=STAFF,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/sambaDomainName=STAFF,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,sambaDomainName,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="sambaDomainName=STAFF,dc=fct,dc=unl,dc=pt" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "ou=machines,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/ou=machines,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="ou=machines,dc=fct,dc=unl,dc=pt" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Administrator,ou=agentes,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Administrator,ou=agentes,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="cn=Administrator,ou=agentes,dc=fct,dc=unl,dc=pt" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Domain Admins,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Domain Admins,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="cn=Domain Admins,ou=grupos,dc=fct,dc=unl,dc=pt" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Domain Users,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Domain Users,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Domain Guests,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Domain Guests,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Domain Computers,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Domain Computers,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="cn=Domain Computers,ou=grupos,dc=fct,dc=unl,dc=pt" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Administrators,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Administrators,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="cn=Domain Guests,ou=grupos,dc=fct,dc=unl,dc=pt" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Users,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Users,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Guests,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Guests,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Account Operators,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Account Operators,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Print Operators,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Print Operators,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Backup Operators,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Backup Operators,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Replicators,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Replicators,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate --- snip --- Some entry examples follow On the central LDAP infrastructure: hm@DIVINF-PC15:~$ ldapsearch -b "ou=agentes,dc=fct,dc=unl,dc=pt" -x -h ldap.fct.unl.pt "uid=hmmm" -LL version: 1 dn: uniqueIdentifier=15093,ou=agentes,dc=fct,dc=unl,dc=pt mailQuotaSize: 10737418240 radiusGroupName: Adm deliveryMode: noreply mailReplyText:: TWVuc2FnZW0gZGUgYXV0by1yZXBseSBwYXJhIHRlc3RlLg0K uid: hmmm gidNumber: 1000 homeDirectory: /home/agentes/15093 loginShell: /bin/customshell givenName: Hugo sn: Monteiro gecos: Hugo Miguel Marques Monteiro cn: Hugo Monteiro displayName: Hugo Monteiro uidNumber: 15093 objectClass: top objectClass: uidObject objectClass: agenteUNL objectClass: shadowAccount objectClass: inetOrgPerson objectClass: posixAccount objectClass: sambaSamAccount objectClass: krb5Principal objectClass: krb5KDCEntry objectClass: qmailUser objectClass: radiusprofile uniqueIdentifier: 15093 title: Trabalhador FCT title: Aluno LEI-FCT accountStatus: active mailHost: mailstrg2.ci.fct.unl.pt qmailGID: 1000 qmailUID: 15093 mail: hmmm(a)fct.unl.pt mailAlternateAddress: hmmm(a)students.fct.unl.pt mailAlternateAddress: hugo.monteiro(a)fct.unl.pt mailForwardingAddress: fctunl-teste(a)fct.unl.pt krb5KDCFlags: 126 krb5PrincipalName: hmmm(a)FCT.UNL.PT sambaSID: S-1-5-21-588362536-2687990616-3095848848-30186 sambaPrimaryGroupSID: S-1-5-21-588362536-2687990616-3095848848-513 sambaHomeDrive: H: sambaLogonScript: logon.bat sambaAcctFlags: [UX ] sambaPwdLastSet: 1317217397 krb5KeyVersionNumber: 11 that same entry after translucent hm@DIVINF-PC15:~$ ldapsearch -b "ou=agentes,dc=fct,dc=unl,dc=pt" -x -h cdstaff.fct.unl.pt "uid=hmmm" -LL version: 1 dn: uniqueIdentifier=15093,ou=agentes,dc=fct,dc=unl,dc=pt mailQuotaSize: 10737418240 radiusGroupName: Adm deliveryMode: noreply mailReplyText:: TWVuc2FnZW0gZGUgYXV0by1yZXBseSBwYXJhIHRlc3RlLg0K uid: hmmm gidNumber: 1000 homeDirectory: /home/agentes/15093 loginShell: /bin/customshell givenName: Hugo sn: Monteiro gecos: Hugo Miguel Marques Monteiro cn: Hugo Monteiro displayName: Hugo Monteiro uidNumber: 15093 objectClass: top objectClass: uidObject objectClass: agenteUNL objectClass: shadowAccount objectClass: inetOrgPerson objectClass: posixAccount objectClass: sambaSamAccount objectClass: qmailUser objectClass: radiusprofile objectClass: krb5Principal objectClass: krb5KDCEntry uniqueIdentifier: 15093 title: Trabalhador FCT title: Aluno LEI-FCT accountStatus: active mailHost: mailstrg2.ci.fct.unl.pt qmailGID: 1000 qmailUID: 15093 mail: hmmm(a)fct.unl.pt mailAlternateAddress: hmmm(a)students.fct.unl.pt mailAlternateAddress: hugo.monteiro(a)fct.unl.pt mailForwardingAddress: fctunl-teste(a)fct.unl.pt krb5KDCFlags: 126 krb5PrincipalName: hmmm(a)FCT.UNL.PT sambaSID: S-1-5-21-1327543176-3185848629-1254536839-31186 sambaPrimaryGroupSID: S-1-5-21-1327543176-3185848629-1254536839-513 sambaHomeDrive: H: sambaLogonScript: logon.bat sambaAcctFlags: [UX ] sambaPwdLastSet: 1317217397 krb5KeyVersionNumber: 11 and finaly just the local part to the problematic server dn: uniqueIdentifier=15093,ou=agentes,dc=fct,dc=unl,dc=pt uidNumber: 15093 sambaSID: S-1-5-21-1327543176-3185848629-1254536839-31186 sambaHomeDrive: H: sambaLogonScript: logon.bat sambaAcctFlags: [UX ] sambaPrimaryGroupSID: S-1-5-21-1327543176-3185848629-1254536839-513 We noticed that the crash would also happen if the query was like (&(uid=*)(objectClass=sambaSamAccount)), BUT is does not happen every time. Happens mostly when there is more usage, but nothing like high loads or anything. We've had problems every morning, around 9am, when everyone would login to their workstation. I then gave the VM more resources and since 2 days ago there has been no problem (so far). I would love to be able to help a bit more, perhaps with a core file, but i'm really lacking time atm. I will try to provide a core in a couple of days or so. Let me know if there is any special way to collect the information you need. Best regards, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

1 0

(ITS#7053) back-monitor blocks
by michael＠stroeder.com 28 Sep '11

28 Sep '11

Full_Name: Michael Ströder Version: 2.4.26 OS: openSUSE Linux URL: Submission from: (NULL) (192.166.104.102) When doing LDAP searches on cn=Monitor the search thread blocks and the only way to stop slapd is kill -9 then. One can completely block slapd with this. More information will follow (want to grab the ITS# first).

1 0

(ITS#7052) Spurious CSNs being recorded on syncrepl consumers.
by cmikk＠qwest.net 26 Sep '11

26 Sep '11

Full_Name: Chris Mikkelson Version: 2.4.26 OS: FreeBSD URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (204.147.85.37) When the provider sends a search response with state 'delete' with no / null cookie, the syncrepl consumer queues an locally-generated CSN and updates its context CSN with that. This appears to happen only with cookie-less deletion, not with cookie-less modification. I have not observed a cookie-less addition, so I do not know if it occurs there, too. Example logs from a pure consumer (no server-id, replicating from a provider with server id 002): Sep 26 13:05:42 mpls-auth-02 slapd[57295]: do_syncrep2: rid=100 cookie= Sep 26 13:05:42 mpls-auth-02 slapd[57295]: syncrepl_entry: rid=100 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_DELETE) Sep 26 13:05:42 mpls-auth-02 slapd[57295]: syncrepl_entry: rid=100 be_search (0) Sep 26 13:05:42 mpls-auth-02 slapd[57295]: syncrepl_entry: rid=100 uid=<snip>,ou=improv,dc=qwest,dc=net Sep 26 13:05:42 mpls-auth-02 slapd[57295]: slap_queue_csn: queing 0x7ffffe3fa560 20110926130542.130924Z#000000#000#000000 Sep 26 13:05:42 mpls-auth-02 slapd[57295]: slap_graduate_commit_csn: removing 0x8f58a8a90 20110926130542.130924Z#000000#000#000000 This is problematic at our site because the provider cookie contains a SID 0 CSN from before we migrated to multimaster, and the SID 0 CSN recorded at the consumer renders the consumer state newer than the provider, breaking replication.

1 0

(ITS#7051) ldap_pvt_tls_get_peer_dn fails under gnutls
by giampaolo＠tomassoni.biz 25 Sep '11

25 Sep '11

Full_Name: Giampaolo Tomassoni Version: 2.4.24 OS: Linux 2.6.39-gentoo-r3 URL: Submission from: (NULL) (79.23.61.128) A triky mistake (is it a typo?) in libraries/libldap/tls_g.c:tlsg_x509_cert_dn prevents a gnutls-enabled server to correctly obtain the "subject" ASN.1 tree from the client's certificate. This is the needed patch: --- libraries/libldap/tls_g.c.wrong 2011-09-25 14:58:30.000000000 +0200 +++ libraries/libldap/tls_g.c 2011-09-25 14:35:06.000000000 +0200 @@ -530,7 +530,7 @@ ber_init2( ber, cert, LBER_USE_DER ); tag = ber_skip_tag( ber, &len ); /* Sequence */ tag = ber_skip_tag( ber, &len ); /* Sequence */ - tag = ber_skip_tag( ber, &len ); /* Context + Constructed (version) */ + tag = ber_peek_tag( ber, &len ); /* Context + Constructed (version) */ if ( tag == 0xa0 ) /* Version is optional */ tag = ber_get_int( ber, &i ); /* Int: Version */ tag = ber_skip_tag( ber, &len ); /* Int: Serial (can be longer than ber_int_t) */ Basically, the optional version field in the certificate wasn't peeked, but rather skipped. This resulted in walking in the certificate tree in the wrong way, thereby impairing a correct result from libraries/libldap/tls2.c:ldap_pvt_tls_get_peer_dn. I'm not using sasl, so I can't be sure about this, but I guess this problem could impair client authentication via certificate using the sasl external method.

1 0

(ITS#7050) meta stop at the first unreachable candidate
by victor.gattegno＠gmail.com 23 Sep '11

23 Sep '11

Full_Name: victor gattegno Version: 2.4.26 OS: CentOS 5.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (88.181.196.138) Hello, With OpenLDAP 2.4.26, as soon as a candidate directory is unreachable, other directories are not requested by the proxy ; that problem doesn't occur in 2.4.23. It is described in: http://www.openldap.org/lists/openldap-technical/201108/msg00221.html and there is a complete example in: http://www.openldap.org/lists/openldap-technical/201109/msg00044.html I modified openldap-2.4.26/servers/slapd/back-meta/search.c (lines 192 to 198) as follow, and then the problem is solved. I replaced in OpenLDAP 2.4.26 search.c, (from line 192): switch ( rc ) { case LDAP_SUCCESS: break; case LDAP_UNAVAILABLE: goto down; default: goto other; } by (like it was in 2.4.23): if ( rc != LDAP_SUCCESS ) { goto down; } Here is the diff : 192,195c192 < switch ( rc ) { < case LDAP_SUCCESS: < break; < case LDAP_UNAVAILABLE: --- > if ( rc != LDAP_SUCCESS ) { 197,198d193 < default: < goto other; Rgds.

1 0

(ITS#7049) DEL/LDAP_SYNC_DELETE race touching entryCSN
by ebackes＠symas.com 22 Sep '11

22 Sep '11

Full_Name: Emily Backes Version: 2.4.26 OS: any URL: Submission from: (NULL) (76.88.107.46) Similar to the recent overlay fixes to prevent updating entryCSN/contextCSN on local changes, delete operations can cause inappropriate CSN setting on remote servers. Given a multi-master setup (normal syncrepl tested), so that each server has a serverID set, with no overlays loaded other than syncprov, set up two or more threads of delete operations; three or more seems to most reliably reproduce the problem on the systems I've tested. As the deletes are happening, the server1 side should of course show it's entryCSN updating: dn: dc=example,dc=com contextCSN: 20110923044343.412634Z#000000#001#000000 This should of course be mirrored on the server2 side with contextCSN exactly matching the set of CSN's from the server1 side. Instead, after enough concurrent deletes to hit the race: dn: dc=example,dc=com contextCSN: 20110923044343.412634Z#000000#001#000000 contextCSN: 20110923044349.314803Z#000000#002#000000 This happens even though server2 has never received any local write operations (or indeed any connection other than the syncrepl search from server1 and my searches to retrieve contextCSN). Again, no overlays are loaded. This breaks syncrepl's assumptions and can result in other replication problems as a result of CSN desync. Working on tracing out exactly where it goes awry...

1 0

Re: (ITS#7047) slapd crash on bad indexed translucent
by Pierangelo Masarati 21 Sep '11

21 Sep '11

Can you reproduce with latest release/master? Can you provide a minimal configuration+data that allows to reproduce the issue? p.

1 0

Re: (ITS#7048) Non root binding causes assert
by Pierangelo Masarati 21 Sep '11

21 Sep '11

> Full_Name: Aitor Carrera Please check with latest release (or master code); please upload patches according to <http://www.openldap.org/devel/contributing.html>. p.

1 0

Re: (ITS#7048) Non root binding causes assert
by aitor.carrera＠edosoftfactory.com 21 Sep '11

21 Sep '11

--20cf307abe69d114a404ad78b34e Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable With this pacth it is solved, we added a precompiler macro to contribute th= e patch because we are not sure about security issues related this problem. META_BACK_REFCNT_MUST_BE_ZERO_FOR_INVALIDATING_EXPIRED_CONNECTION =3D> It m= ust be defined for solving this issue diff -Naur openldap-2.4.21.orig/servers/slapd/back-meta/conn.c openldap-2.4.21/servers/slapd/back-meta/conn.c --- openldap-2.4.21.orig/servers/slapd/back-meta/conn.c 2011-07-26 13:40:40.989376998 +0200 +++ openldap-2.4.21/servers/slapd/back-meta/conn.c 2011-07-26 13:51:40.537383269 +0200 @@ -1156,6 +1156,9 @@ mc =3D NULL; } else { +#ifdef META_BACK_REFCNT_MUST_BE_ZERO_FOR_INVALIDATING_EXPIRED_CONNECTION + if ( mc->mc_refcnt =3D=3D 0) +#endif if ( ( mi->mi_conn_ttl !=3D 0 && op->o_time > mc->mc_create_time + mi->mi_conn_ttl ) || ( mi->mi_idle_timeout !=3D 0 && op->o_time > mc->mc_time + mi->mi_idle_timeout ) ) { Regards -------------------------------------------------------- Aitor Carrera Hern=E1ndez - Edosoft Factory Telf. +34 828021575 Fax. +34 828066081 Antonio Mar=EDa Manrique 3, Planta 2 - Oficina 6. 35011 Las Palmas de Gran Canaria -------------------------------------------------------- --20cf307abe69d114a404ad78b34e Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable <div>With this pacth it is solved, we added a precompiler macro to contribu= te the patch because we are not sure about security issues related this pro= blem.</div><div> </div><div>META_BACK_REFCNT_MUST_BE_ZERO_FOR_INVALIDATI= NG_EXPIRED_CONNECTION =3D> It must be defined for solving this issue</di= v> <div> </div><div> </div><div><pre style= =3D"word-wrap: break-word; white-space: pre-wrap; ">diff -Naur openldap-2.4= .21.orig/servers/slapd/back-meta/conn.c openldap-2.4.21/servers/slapd/back-= meta/conn.c --- openldap-2.4.21.orig/servers/slapd/back-meta/conn.c 2011-07-26 13:40:40= .989376998 +0200 +++ openldap-2.4.21/servers/slapd/back-meta/conn.c 2011-07-26 13:51:40.5373= 83269 +0200 @@ -1156,6 +1156,9 @@ mc =3D NULL; =20 } else { +#ifdef META_BACK_REFCNT_MUST_BE_ZERO_FOR_INVALIDATING_EXPIRED_CONNECTION + if ( mc->mc_refcnt =3D=3D 0) +#endif if ( ( mi->mi_conn_ttl !=3D 0 && op->o_time > mc->= mc_create_time + mi->mi_conn_ttl ) || ( mi->mi_idle_timeout !=3D 0 && op->o_time > mc-&= gt;mc_time + mi->mi_idle_timeout ) ) {</pre><pre style=3D"word-wrap: break-word; white-space: pre-wrap; "><= br></pre><pre style=3D"word-wrap: break-word; white-space: pre-wrap; ">Rega= rds</pre></div><div> </div>--------------------------------------= ------------------ Aitor Carrera Hern=E1ndez - Edosoft Factory Telf. +34 828021575 Fax. = +34 828066081 Antonio Mar=EDa Manrique 3, Planta 2 - Oficina 6. 35011= Las Palmas de Gran Canaria --------------------------------------------= ------------ --20cf307abe69d114a404ad78b34e--

1 0

(ITS#7048) Non root binding causes assert
by aitor.carrera＠edosoftfactory.com 21 Sep '11

21 Sep '11

Full_Name: Aitor Carrera Version: 2.4.21 OS: SLES10 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (95.126.219.248) When we use a non root user to bind, with multiple threads and some concurrent proxies 1 .- In meta_back_bind_op_result method, in back-meta bind.c file the assert "assert( LDAP_BACK_CONN_BINDING( msc ) );" is evaluated to false. 2.- Next, calls meta_back_cancel (bind.c) and then ldap_abandon_ext and other assert is evaluated to false: slapd: sasl.c:74: ldap_sasl_bind: Assertion `ld != ((void *)0)' failed. That crash the slapd.

1 0

Re: (ITS#7027) [PATCH] Implement priority/weigh for DNS SRV records
by james.leddy＠redhat.com 20 Sep '11

20 Sep '11

> In addition, random seed has to be initialized, otherwise the behavior > is predictable. I didn't think it too big of a deal, since it doesn't have to be cryptographically random. I can submit a patch to call srandom() first. > On the other side, I do not think that calling srand() > in libldap is a good idea. The client application should do that. Or > is there any other option? The function ldap_domain2hostlist returns a list of strings, there isn't any weight/prio information for the client to act on. Furthermore the weight prio section was commented out, I figured the library was the right place to do it. The algo specified in rfc2782 is detailed, and specifies a random number should be generated., I didn't want to implement it because it results in sorting once by prio, once by weight instead of one sort that does both. -- James M. Leddy Technical Account Manager Red Hat Inc.

1 0

(ITS#7047) slapd crash on bad indexed translucent
by hugo.monteiro＠fct.unl.pt 20 Sep '11

20 Sep '11

Full_Name: Hugo Monteiro Version: 2.4.23 OS: Debian Squeeze 64bits URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (193.136.124.150) Performing a substring query on a locally stored attribute of a translucent database, with only equality index will result on slapd crash. We have a translucent database set up to handle samba attributes and we observed that some client operations would crash slapd (like when performing user enumeration, while changind folder ACLs). The last logged query was "(&(objectClass=sambaGroupMapping)(sambaGroupType=4)(sambaSID=<OUR_DOMAINSID_HERE>*))" As per samba documentation we only had equality index on sambaSID attribute. We have then reconfigured that attribute to use eq,sub,pres indexes, ran slapindex on the database and slapd stopped crashing with that query.

1 0

Re: (ITS#7027) [PATCH] Implement priority/weight for DNS SRV records
by jvcelak＠redhat.com 20 Sep '11

20 Sep '11

On Wednesday 24 August 2011 21:28:03, James Leddy wrote: > on incoming ftp There is a typo in the patch: + hostent_head[hostent_count].priority=priority; -+ hostent_head[hostent_count].weight=priority; ++ hostent_head[hostent_count].weight=weight; + hostent_head[hostent_count].port=port; + strncpy(hostent_head[hostent_count].hostname, host,255); + hostent_count=hostent_count+1; In addition, random seed has to be initialized, otherwise the behavior is predictable. On the other side, I do not think that calling srand() in libldap is a good idea. The client application should do that. Or is there any other option? Jan

1 0

(ITS#7046) OpenLDAP logs nothing at info priority, excessive at debug priority
by nick.urbanik＠optusnet.com.au 19 Sep '11

19 Sep '11

Full_Name: Nick Urbanik Version: 2.3.43-12 and 2.4.23-15 OS: CentOS 5 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (203.10.68.69) To my great surprise, OpenLDAP logs nothing at info priority, but excessive amounts at debug priority, even when the loglevel is set to stats. Here are examples of the size of log files holding *nothing* but OpenLDAP stats logging in a production server: # ls -lSr | tail -n4 -rw------- 1 root root 7160148590 Jul 28 10:48 ldap -rw------- 1 root root 24102619198 Jul 26 04:02 ldap.3 -rw------- 1 root root 25034865261 Jul 27 04:02 ldap.2 -rw------- 1 root root 25504838803 Jul 28 04:02 ldap.1 $ bc -ql scale = 6 25504838803 / 2^30 23.753232 In other words, we were getting nearly 24 gigabytes of logging *each* *day*. I raised this in the openldap-technical mailing list: http://www.openldap.org/lists/openldap-technical/201107/msg00205.html but found that this is by design: http://www.openldap.org/lists/openldap-technical/201109/msg00223.html OpenLDAP should log at info priority at least the following: * when it is starting up * when it is shutting down cleanly * any errors, indicating issues that the sys admin should pay attention to * (perhaps): one line for each connection.

1 0

Re: (ITS#7044) objectIdentifier not usable for reference in objectClass' MUST or MAY clause
by c.klein＠tarent.de 19 Sep '11

19 Sep '11

Thanks for the information. Any chance this will ever be implemented? I for my part would rather use the objectIdentifiers than the canonical attribute names.

1 0

Re: (ITS#7045) "ldapsearch -Z" should continue using TLS one cert mis-match
by Jason_Haar＠trimble.com 18 Sep '11

18 Sep '11

This is a multi-part message in MIME format. --------------020600000809090503050207 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Riight - I see what you mean now. I mis-read the debugging messages as meaning it had reconnected without TLS. Retesting with a sniffer shows otherwise. So "-Z" works as I had hoped - excellent Thanks! Jason On 19/09/11 15:22, Kurt Zeilenga wrote: > > On Sep 18, 2011, at 5:41 PM, Jason_Haar(a)trimble.com wrote: > > > Full_Name: Jason Haar > > Version: 2.4.21 > > OS: Fedora > > URL: ftp://ftp.openldap.org/incoming/ > > Submission from: (NULL) (222.154.246.214) > > > > > > As you know, LDAP passwords are sent in cleartext unless TLS or SASL > are used. > > Depending on TLS cipher suites and SASL mechnanism choice, of course. > > And you shouldn't be using a cleartext mechanism unless you've first > authenticated the server. > > > > > However, "ldapsearch -Z" will fall-back onto cleartext if any form > of TLS error > > occurs, even the non-fatal "TLS: hostname does not match CN in peer > certificate" > > error. > > Actually, ldapsearch(1) does not fall back into cleartext in this > case. The OpenLDAP library, and most servers, wisely don't support > stop TLS. > > What ldapsearch(1) does is, if told to check certs (the default) and > they are bad, is to terminate the session and exit. > > > > i.e. TLS is attempted, the hostname doesn't match, so ldapsearch > tries again not > > using TLS! > > No it doesn't. > > > > > This seems wasteful to me. It is still *more secure* to continue the > encrypted > > TLS session than to fallback onto cleartext. > > No, it's not. If you continued to use TLS, there is no server > authentication. Use of cleartext mechanism to an unauthenticated > server is quite insecure. > > Now it might seem that if one said use simple bind w/ password and -Z, > that it would be reasonable to assume the user didn't care about > server authentication (or data integrity/confidential). But -Z is > designed less for use with simple bind w/ password but with SASL > mechanisms. > > Now, if you really want to do that, just tell ldapsearch(1) not to do > cert checks. > > > > Web browsers are a good example of > > this: if you connect to a self-signed https site, you can choose to > continue - > > as untrusted https is still secured against other attackers. > > And some browsers are stupid enough to do basic authentication without > first authenticating the server. > > > > If a user wants to guarantee the trustworthiness of their ldapsearch > session, > > they can use "-ZZ" to achieve that - but I can't see any reason to > stop people > > using "-Z" if they want to? > > Nothing stops those who don't want cert checks from disabling them. > > > (I'm using ldapsearch to dump Active Directory LDAP data via the DNS > round-robin > > entry for the domain name: as such the LDAP host *never* matches the > hostname > > DNS round-robin gives back - and I don't care - I just don't want > the network > > group sniffing my password ;-) > > Then you likely should be doing -ZZ (because you care about > eavesdropping) while disabling the cert checks (because you seem to > not care that you might be sending your password to a man-in-the-middle). > > -- Kurt > -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +1 408 481 8171 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 --------------020600000809090503050207 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> Riight - I see what you mean now. I mis-read the debugging messages as meaning it had reconnected without TLS. Retesting with a sniffer shows otherwise. So "-Z" works as I had hoped - excellent Thanks! Jason On 19/09/11 15:22, Kurt Zeilenga wrote: <blockquote cite="mid:F5AC234D-558A-4BFE-A053-EDB0B082FC41@openldap.org" type="cite"> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="Generator" content="MS Exchange Server version 6.5.7654.12"> <title>Re: (ITS#7045) "ldapsearch -Z" should continue using TLS one cert mis-match</title>  On Sep 18, 2011, at 5:41 PM, <a class="moz-txt-link-abbreviated" href="mailto:Jason_Haar@trimble.com">Jason_Haar(a)trimble.com</a> wrote: > Full_Name: Jason Haar > Version: 2.4.21 > OS: Fedora > URL: <a moz-do-not-send="true" href="ftp://ftp.openldap.org/incoming/">ftp://ftp.openldap.org/incoming/</a> > Submission from: (NULL) (222.154.246.214) > > > As you know, LDAP passwords are sent in cleartext unless TLS or SASL are used. Depending on TLS cipher suites and SASL mechnanism choice, of course. And you shouldn't be using a cleartext mechanism unless you've first authenticated the server. > > However, "ldapsearch -Z" will fall-back onto cleartext if any form of TLS error > occurs, even the non-fatal "TLS: hostname does not match CN in peer certificate" > error. Actually, ldapsearch(1) does not fall back into cleartext in this case.  The OpenLDAP library, and most servers, wisely don't support stop TLS. What ldapsearch(1) does is, if told to check certs (the default) and they are bad, is to terminate the session and exit. > > i.e. TLS is attempted, the hostname doesn't match, so ldapsearch tries again not > using TLS! No it doesn't. > > This seems wasteful to me. It is still *more secure* to continue the encrypted > TLS session than to fallback onto cleartext. No, it's not.  If you continued to use TLS, there is no server authentication.  Use of cleartext mechanism to an unauthenticated server is quite insecure. Now it might seem that if one said use simple bind w/ password and -Z, that it would be reasonable to assume the user didn't care about server authentication (or data integrity/confidential).   But -Z is designed less for use with simple bind w/ password but with SASL mechanisms. Now, if you really want to do that, just tell ldapsearch(1) not to do cert checks. > Web browsers are a good example of > this: if you connect to a self-signed https site, you can choose to continue - > as untrusted https is still secured against other attackers. And some browsers are stupid enough to do basic authentication without first authenticating the server. > > If a user wants to guarantee the trustworthiness of their ldapsearch session, > they can use "-ZZ" to achieve that - but I can't see any reason to stop people > using "-Z" if they want to? Nothing stops those who don't want cert checks from disabling them. > (I'm using ldapsearch to dump Active Directory LDAP data via the DNS round-robin > entry for the domain name: as such the LDAP host *never* matches the hostname > DNS round-robin gives back - and I don't care - I just don't want the network > group sniffing my password ;-) Then you likely should be doing -ZZ (because you care about eavesdropping) while disabling the cert checks (because you seem to not care that you might be sending your password to a man-in-the-middle). -- Kurt </blockquote> <pre class="moz-signature" cols="72">-- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +1 408 481 8171 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 </pre> </body> </html> --------------020600000809090503050207--

1 0

Re: (ITS#7045) "ldapsearch -Z" should continue using TLS one cert mis-match
by kurt＠OpenLDAP.org 18 Sep '11

18 Sep '11

On Sep 18, 2011, at 5:41 PM, Jason_Haar(a)trimble.com wrote: > Full_Name: Jason Haar > Version: 2.4.21 > OS: Fedora > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (222.154.246.214) > > > As you know, LDAP passwords are sent in cleartext unless TLS or SASL are used. Depending on TLS cipher suites and SASL mechnanism choice, of course. And you shouldn't be using a cleartext mechanism unless you've first authenticated the server. > > However, "ldapsearch -Z" will fall-back onto cleartext if any form of TLS error > occurs, even the non-fatal "TLS: hostname does not match CN in peer certificate" > error. Actually, ldapsearch(1) does not fall back into cleartext in this case. The OpenLDAP library, and most servers, wisely don't support stop TLS. What ldapsearch(1) does is, if told to check certs (the default) and they are bad, is to terminate the session and exit. > > i.e. TLS is attempted, the hostname doesn't match, so ldapsearch tries again not > using TLS! No it doesn't. > > This seems wasteful to me. It is still *more secure* to continue the encrypted > TLS session than to fallback onto cleartext. No, it's not. If you continued to use TLS, there is no server authentication. Use of cleartext mechanism to an unauthenticated server is quite insecure. Now it might seem that if one said use simple bind w/ password and -Z, that it would be reasonable to assume the user didn't care about server authentication (or data integrity/confidential). But -Z is designed less for use with simple bind w/ password but with SASL mechanisms. Now, if you really want to do that, just tell ldapsearch(1) not to do cert checks. > Web browsers are a good example of > this: if you connect to a self-signed https site, you can choose to continue - > as untrusted https is still secured against other attackers. And some browsers are stupid enough to do basic authentication without first authenticating the server. > > If a user wants to guarantee the trustworthiness of their ldapsearch session, > they can use "-ZZ" to achieve that - but I can't see any reason to stop people > using "-Z" if they want to? Nothing stops those who don't want cert checks from disabling them. > (I'm using ldapsearch to dump Active Directory LDAP data via the DNS round-robin > entry for the domain name: as such the LDAP host *never* matches the hostname > DNS round-robin gives back - and I don't care - I just don't want the network > group sniffing my password ;-) Then you likely should be doing -ZZ (because you care about eavesdropping) while disabling the cert checks (because you seem to not care that you might be sending your password to a man-in-the-middle). -- Kurt

1 0

(ITS#7045) "ldapsearch -Z" should continue using TLS one cert mis-match
by Jason_Haar＠trimble.com 18 Sep '11

18 Sep '11

Full_Name: Jason Haar Version: 2.4.21 OS: Fedora URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (222.154.246.214) As you know, LDAP passwords are sent in cleartext unless TLS or SASL are used. However, "ldapsearch -Z" will fall-back onto cleartext if any form of TLS error occurs, even the non-fatal "TLS: hostname does not match CN in peer certificate" error. i.e. TLS is attempted, the hostname doesn't match, so ldapsearch tries again not using TLS! This seems wasteful to me. It is still *more secure* to continue the encrypted TLS session than to fallback onto cleartext. Web browsers are a good example of this: if you connect to a self-signed https site, you can choose to continue - as untrusted https is still secured against other attackers. If a user wants to guarantee the trustworthiness of their ldapsearch session, they can use "-ZZ" to achieve that - but I can't see any reason to stop people using "-Z" if they want to? (I'm using ldapsearch to dump Active Directory LDAP data via the DNS round-robin entry for the domain name: as such the LDAP host *never* matches the hostname DNS round-robin gives back - and I don't care - I just don't want the network group sniffing my password ;-)

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs