From nobody Mon May 1 13:58:52 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E60D6129573; Mon, 1 May 2017 13:58:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 62oQKWlzZPYl; Mon, 1 May 2017 13:58:26 -0700 (PDT) Received: from gcc01-CY1-obe.outbound.protection.outlook.com (mail-cy1gcc01on0111.outbound.protection.outlook.com [23.103.200.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD68E12EA57; Mon, 1 May 2017 13:55:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=yydB+HZEndTBVwwALOuONx8e4e/nLVLAndrg5rCdK+4=; b=Gtkf2ijAfPaws1aoptH85dkl0Mpdw3m7CappxtqUM/tLT254XYIXE2fiKi3gmLjYqXd1xo3oaF6sLaJY51sBAuA+C9FmLFNV/Z8OU2fbhoviyBcSAPCnGCemz7YcitXZ/qONZWGsLsW6yEBWHVMXTTo1F19ckfeMtssHPd5Zx/E= Received: from MWHPR09MB1440.namprd09.prod.outlook.com (10.173.50.14) by MWHPR09MB1440.namprd09.prod.outlook.com (10.173.50.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1061.12; Mon, 1 May 2017 20:55:40 +0000 Received: from MWHPR09MB1440.namprd09.prod.outlook.com ([10.173.50.14]) by MWHPR09MB1440.namprd09.prod.outlook.com ([10.173.50.14]) with mapi id 15.01.1061.021; Mon, 1 May 2017 20:55:29 +0000 From: "Waltermire, David A. (Fed)" To: "saag@ietf.org" , "opsawg@ietf.org" , "netconf@ietf.org" , "netmod@ietf.org" , "sacm@ietf.org" , "mile@ietf.org" , "i2nsf@ietf.org" Thread-Topic: PANIC Bar BoF Tonight @ 6:30pm CDT Thread-Index: AdKoyz/2/d9baDSGTnuHD2EJjZ7MgwZ8FaBw Date: Mon, 1 May 2017 20:55:28 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=nist.gov; x-originating-ip: [129.6.224.58] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR09MB1440; 7:ZGPQ0SBjCk2HAocykw0x4gGRcHCR65Zmi+EDiD5V7Q5bAJjXI5dmBfc6+ZyAd+BvEQK9k4c9DhtNyw8r/7sJY9ZoIqkaqb/fVAs5AYrHxn9mOEwmmLau9tUkwKzQFvf1eTzVJxakPBRyLie59ZaA71LcavJTgrbT3jRtMAxOOEvYBrz599/AG6ppbC4FQ7pfcT5MEPpbH6uqFBu6iUNiDpiK1oo9CYtWVMCkjyxopxLIRXijrl6j+hkIgtVqcDZODAuxDMq/qpTpdNh5yDsTPqu5YBsxZ3ukRDJr2muKFrngo2kfAbFt7hxflnzeI5X2cPzxzCoWOfrGjjqrPFxIbQ== x-ms-office365-filtering-correlation-id: 52c6bf8e-73df-44d0-0bc4-08d490d4665f x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423075)(201703031133081); SRVR:MWHPR09MB1440; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(211171220733660)(148717330147763); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040450)(601004)(2401047)(5005006)(8121501046)(93006095)(93001095)(3002001)(10201501046)(6055026)(6041248)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(20161123558100)(20161123562025)(20161123560025)(20161123555025)(6072148); SRVR:MWHPR09MB1440; BCL:0; PCL:0; RULEID:; SRVR:MWHPR09MB1440; x-forefront-prvs: 02945962BD x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(39840400002)(39410400002)(39860400002)(39450400003)(39850400002)(39400400002)(377454003)(13464003)(50944005)(77096006)(25786009)(6436002)(53546009)(122556002)(305945005)(99286003)(54356999)(189998001)(229853002)(5660300001)(74316002)(6506006)(99936001)(7736002)(50986999)(450100002)(33656002)(2906002)(3280700002)(9686003)(55016002)(6116002)(102836003)(478600001)(3846002)(7696004)(6306002)(3660700001)(53936002)(5890100001)(2501003)(66066001)(86362001)(2201001)(2900100001)(6246003)(8936002)(81166006)(38730400002)(8676002); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR09MB1440; H:MWHPR09MB1440.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/mixed; boundary="_002_MWHPR09MB14408EF0A9F034AEB6A1EC80F0140MWHPR09MB1440namp_" MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 01 May 2017 20:55:28.8321 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR09MB1440 Archived-At: Subject: Re: [OPSAWG] PANIC Bar BoF Tonight @ 6:30pm CDT X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 May 2017 20:58:30 -0000 --_002_MWHPR09MB14408EF0A9F034AEB6A1EC80F0140MWHPR09MB1440namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable The Posture Assessment Through Network Information Collection (PANIC) group= held an informal bar BoF at IETF 98 to discuss available protocols and dat= a models for assessing the posture of network equipment devices. A descript= ion of PANIC is below, and a slide deck is attached describing the group's = goals and requirements. We had a productive discussion about the group's sc= ope, and agreed to continue the conversation on a non-working group mailing= list.=20 The PANIC mailing list is now available for subscribers at this link: https= ://www.ietf.org/mailman/listinfo/panic. If you are interested in the effort, please join the mailing list. A scopin= g draft will be posted to the list in the next week. We look forward to you= r feedback on it. Regards, Dave PANIC Description: The IETF SACM work group has been working to standardize the collection of = endpoint configuration and other posture information from enterprise endpoi= nts. Collecting this information is critical to support automation of commo= n network security tasks, including asset, software, vulnerability, and con= figuration management. Thus far, our efforts have focused primarily on stan= dards to collect information in support of asset, software and vulnerabilit= y management use cases for classical endpoint devices (e.g., servers, lapto= ps, etc), and has worked with other IETF members to determine what data wou= ld need to be to be collected, and how that data would be securely communic= ated across the network. Through such exchanges an organization can know wh= at client endpoints are connected to their network, and if they are vulnera= ble to attack. Given the proliferation of attacks against network infrastructure devices, = it is clear that the next step in our enterprise security automation effort= must be to enable standardized reporting of similar information from netwo= rk infrastructure devices. With the growing number of Yang models and incre= ased adoption of NETCONF, RESTCONF, and related protocol work, we believe t= he time is right to work out how these standards can be used to measure the= health of network devices. This information will, as in our efforts in SAC= M for client devices, support asset, software, vulnerability, and configura= tion management use cases. We hope to use existing management protocols to = report this information from network infrastructure devices, supporting mul= tiple use cases using the same set of management protocols. Such a mechanis= m will help network defenders protect against known attacks, and provide th= e necessary knowledge to detect and mitigate future attacks. > -----Original Message----- > From: Waltermire, David A. (Fed) > Sent: Wednesday, March 29, 2017 4:42 PM > To: 'saag@ietf.org' ; 'opsawg@ietf.org' ; > 'netconf@ietf.org' ; 'netmod@ietf.org' > > Subject: PANIC Bar BoF Tonight @ 6:30pm CDT >=20 >=20 > Just a quick reminder... the Posture Assessment through Network > Information Collection (PANIC) bar BoF is tonight right after the IETF 98 > Technical and Administrative Plenary at 6:30pm CDT in Vevey 4 at the > Swissotel Conference Center. We are hoping to start a discussion about ho= w > to leverage the existing IETF network management protocols to best addres= s > security automation for network infrastructure devices. We would like you= r > ideas on how to best pursue this work, and your insights into network > infrastructure security problems that will impact our networks in the fut= ure. > We are holding a side meeting at IETF 98 on Wednesday, March 29th at > 6:30pm CDT to start a discussion about how to move forward on this topic. >=20 > Given the late hour, we will have some light snacks. We hope to see you > there. >=20 > Regards, > David Waltermire --_002_MWHPR09MB14408EF0A9F034AEB6A1EC80F0140MWHPR09MB1440namp_ Content-Type: application/pdf; name="PANIC-slides.pdf" Content-Description: PANIC-slides.pdf Content-Disposition: attachment; filename="PANIC-slides.pdf"; size=311384; creation-date="Mon, 01 May 2017 20:45:38 GMT"; modification-date="Mon, 01 May 2017 20:55:28 GMT" Content-Transfer-Encoding: base64 JVBERi0xLjUNCiW1tbW1DQoxIDAgb2JqDQo8PC9UeXBlL0NhdGFsb2cvUGFnZXMgMiAwIFIvTGFu Zyhlbi1VUykgL1N0cnVjdFRyZWVSb290IDE2NiAwIFIvTWFya0luZm88PC9NYXJrZWQgdHJ1ZT4+ Pj4NCmVuZG9iag0KMiAwIG9iag0KPDwvVHlwZS9QYWdlcy9Db3VudCA4L0tpZHNbIDMgMCBSIDkg MCBSIDM1IDAgUiA4NiAwIFIgOTMgMCBSIDE1OSAwIFIgMTYxIDAgUiAxNjMgMCBSXSA+Pg0KZW5k b2JqDQozIDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0V4dEdT dGF0ZTw8L0dTNSA1IDAgUi9HUzggOCAwIFI+Pi9Gb250PDwvRjEgNiAwIFI+Pi9Qcm9jU2V0Wy9Q REYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA3MjAgNTQwXSAv Q29udGVudHMgNCAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0Rldmlj ZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDA+Pg0KZW5kb2JqDQo0IDAgb2JqDQo8PC9GaWx0 ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDMyMj4+DQpzdHJlYW0NCnicrdBba8IwFAfw90C+w3lMhMWT W2NBBFsvOFAcK+xh7EFGrTJtWVvZ11/aiShzyMCnXM4J/18OdJfQ73fn8WwEOBhANIrhkxIEFIgo lUIHTiFYg1CmlLx0IKekO322kFWUSMhOzRhI1Paie92h5IkSGM9jgLMkeZbUPpXoVAh4JSpKfNxE gjECDSTrJtMHggSllcAAVBgK6yv7BpK1tl5rQ5hS8sqW3Gk2XMxiiFYl8DdIHikZJ9dh6h4wo1CY 3i/Y0RMVkxsI/X9EM4pLhHRGBA4UotA/BmG1ax3t5jgbGbKi4lKx+lByaVgK3LJhxQ2r0qpZ9mnO Q1ZDvfF1x4pDtrk1RHMXvzXC+iWQIvzTv0i9tv7ywKL8AC6RzRrtmivjb/Yr3mP1lmtW5MAfpGZx sdv5Y/peb4v8yi++AUKHoQ8NCmVuZHN0cmVhbQ0KZW5kb2JqDQo1IDAgb2JqDQo8PC9UeXBlL0V4 dEdTdGF0ZS9CTS9Ob3JtYWwvY2EgMT4+DQplbmRvYmoNCjYgMCBvYmoNCjw8L1R5cGUvRm9udC9T dWJ0eXBlL1RydWVUeXBlL05hbWUvRjEvQmFzZUZvbnQvQUJDREVFK0NhbGlicmkvRW5jb2Rpbmcv V2luQW5zaUVuY29kaW5nL0ZvbnREZXNjcmlwdG9yIDcgMCBSL0ZpcnN0Q2hhciAzMi9MYXN0Q2hh ciAxMjIvV2lkdGhzIDUxMyAwIFI+Pg0KZW5kb2JqDQo3IDAgb2JqDQo8PC9UeXBlL0ZvbnREZXNj cmlwdG9yL0ZvbnROYW1lL0FCQ0RFRStDYWxpYnJpL0ZsYWdzIDMyL0l0YWxpY0FuZ2xlIDAvQXNj ZW50IDc1MC9EZXNjZW50IC0yNTAvQ2FwSGVpZ2h0IDc1MC9BdmdXaWR0aCA1MjEvTWF4V2lkdGgg MTc0My9Gb250V2VpZ2h0IDQwMC9YSGVpZ2h0IDI1MC9TdGVtViA1Mi9Gb250QkJveFsgLTUwMyAt MjUwIDEyNDAgNzUwXSAvRm9udEZpbGUyIDUxMSAwIFI+Pg0KZW5kb2JqDQo4IDAgb2JqDQo8PC9U eXBlL0V4dEdTdGF0ZS9CTS9Ob3JtYWwvQ0EgMT4+DQplbmRvYmoNCjkgMCBvYmoNCjw8L1R5cGUv UGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRXh0R1N0YXRlPDwvR1M1IDUgMCBSL0dTOCA4 IDAgUj4+L0ZvbnQ8PC9GMSA2IDAgUj4+L1hPYmplY3Q8PC9JbWFnZTExIDExIDAgUi9JbWFnZTEz IDEzIDAgUi9JbWFnZTE3IDE3IDAgUi9JbWFnZTE5IDE5IDAgUi9JbWFnZTIzIDIzIDAgUi9JbWFn ZTI1IDI1IDAgUi9JbWFnZTI5IDI5IDAgUi9JbWFnZTMxIDMxIDAgUj4+L1BhdHRlcm48PC9QMTYg MTYgMCBSL1AyMiAyMiAwIFIvUDI4IDI4IDAgUi9QMzQgMzQgMCBSPj4vUHJvY1NldFsvUERGL1Rl eHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNzIwIDU0MF0gL0NvbnRl bnRzIDEwIDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdC Pj4vVGFicy9TL1N0cnVjdFBhcmVudHMgMT4+DQplbmRvYmoNCjEwIDAgb2JqDQo8PC9GaWx0ZXIv RmxhdGVEZWNvZGUvTGVuZ3RoIDcwMz4+DQpzdHJlYW0NCnicrZRPb9pAEMXvlvwd5riO1GVn9r8U 5RCSpmmVKlVQe6h6oIkhSIlpgSjqt+8sBmxCMFKUC7DLzpvn+fkt9K7h+Lh31b88A3VyAqdnffib ZwqUVEohkfLgSYE1CmZlnv04girPehc3FsbzPEMYbw4rh0rbrdOjozz7lmdwftUHaHXCVqdlKSpP EdQrrU4H3O4jgo4yOhiMUk9uCAjOyxgJjOV/EAaPych46S0svSm4yLOfYnA/qcZzGFZwXhVBLApE Uc7+zCbzEr6W5d0cFrw9hS8FBlFNn4tfMPicZ+eD163TS+sqBMTVuILmn7vPgC5I7Za2o5UGyFvp DGhSEh3csvPe5eNwXHLx2RS4K4t/WA1GR021OhmD5jX16KSt1b2SGiOQQ2kC60cZQltfN/q96+Fi Uc4quJ3z47GN+S1rkY9cZtKouUqn0VpIbR945djGZsVm1id5db+ftX4Daz5IZgs2BS3JQvIQTQN7 xfh7QVo8PRRGVCV/zApCMfw9eSismCz+HSBqdohaZ003Uc0WG6KWAKNJSElje95+h6cKRh3QJhWk C2ueRjNPaxNPMkp6auvHfTyJap4YuUxbGRJOhiuVa1EzZjnNZsNyXX28m6l9H6beS2R/HmWgHab9 aVU4MZoUWoyfmCiJYeHFYsLb3TzdDk9NnrovNBNpK6GIOuFEg2kyzcSplaCVuAmcse74W5IUtgLK bzMjRovpqyVv9wINK6D8TqFx0i8DitGngG6QMb8U0c3aKb0+3Q3UvwXoFkyteG6cg0DSxR2YN9PR 4rmIYjgrkER5gGBo3Kxjo8M6kvuuQc7sdiQ1JYQ8+6DaoaS4G0qn6eAVvnlB1qH0IXXhfUttfY37 GGpTM2Qd62UNEH2KZMPIKUqRbG0EU5/uBhjfAaCSXBG1tNz5JcBPiRyKu+fEbz/F/xL5tAINCmVu ZHN0cmVhbQ0KZW5kb2JqDQoxMSAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2Uv V2lkdGggMjM0L0hlaWdodCAxMzMvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVu dCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDEyIDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVu Z3RoIDExMz4+DQpzdHJlYW0NCnic7cEBDQAAAMKg909tDwcUAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA/wZsxQABDQplbmRzdHJlYW0NCmVuZG9iag0KMTIgMCBvYmoNCjw8L1R5cGUv WE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDIzNC9IZWlnaHQgMTMzL0NvbG9yU3BhY2UvRGV2 aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFs c2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxNTU2Pj4NCnN0cmVhbQ0KeJzt3YlWGjEYBeDO yOCKShXXWlpRQUXrhrZuFaSoIAKy+v4v0iQzCi3/jLMkmSTtfQLvqaf9zuS/px8+/M//BI6m6ZoW 9g/BIZoeiUYNXf2qmh6disdjoyOqV0VFZ5bXU6uzY4pXRUWnV3dyp3ufZ0fV/gXWo7HV3YvS3fX+ 2ozSVXUjtrxz8VBvVK73Ps1E1a2qGVNLmfP7RqfTLF9lV6ejetg/EaNokcmFre93jU6v131+uNhZ jhlqVtUiE4nN01K903t5QVXvzzNLU4aKv7/ayPh8KlckRVHVTuPu+9bCZES9qtrI2Nz68W2tTYri qvXS6WZiQrmqqGj8y1HhqWUVJVWLudT8uGKC0PTR2eRBvtoviqq2a7fH63NqYQkVnVnb//nY6r4M pNd6Khx9iatUFRvw0951pflHUVy1mj9IquRCZMCV3ctys9v7s+lLt/X4UyUX6sYUNuDzUFFUtYld OK2IC5EBFzM/7htAUSSIZvlydyWmhAsRjSwDDhclWMIunFLAhYMGhKs27n9kFuV34asB2zZF31wo O5YQjT5+HTAgXFUBF2o6MuDhoAHBqm3pXYgN+PngptrqOhW1XPj1o7xYejXg3zQCqiIXHiIXyvrP KjHg1ZABoXRb1ZsDab8X6gYxIEQjoGpTXhciAy5twwaEq1auiAvD/rk9RzMmF9M2BoSCsCSnC4kB z+wMaFP14WJbOhdqkfHExukvWwPCVYkLJ6VyITLgXOqk6EgjoKp8LnRjQLhq/dfpRmJcmqpIDPHk YaHqbECwartWPEnNyeJCYsBv7xvQpqo8LsRvwWv71y4MCFZtVaVxIX4LzmIDev7dJcEu/CaFC/ET qWsDglVNFwr/EQ0/kW6fuzYgkB52ofiPq68G9CKG4aqmC4XGkmnAUqCipgvPt4V+XMWfxzZy3gwI Vu0gF6YFdqE/A9pULZ2J60JiwKPbp+BF+y4UUhCmAfM+DAhWFdeFlgEf/RgQrvokpguxAaEn0gBV W9X8YTIuHJZMAwJPpP7TbT0K6ELzTC6AAcGqTfGO7qwzObpFyeOqYC7UItiAXj6Pua36XBbq6I48 kQY2oE1VkY7uaBkQrGq5UAgskTM5Kga0qVo6E+NxFRsQn8mxKWq6MLchwOMqXQOCVbELwz+6w0+k NA0IV8VHdyG7kL4BwaoCuJCBAaGYLgzzcdWaSlCmEVQ1ZBeyMSCUkF2IpxJp2zM52lVDHGO8dyZH vWpYLmRpQLAqflxNhzDG+HsqwaNqKEd3w1MJLlX5uxCaSnCoyn+MYZ7JsTUgWJX3GMNuKsGjKt8x BpnLQlMJ9sEu5Hd05zCV4FCV4xiDTCW4GBCKOcZY5XF05zyV4FGVkwv5GtCmKg8Xvj+V4FCVx9Ed /jzG14BwVeYuJFMJzga0qcp2jGFOJfK+zuQoVyUuZPYRDZ7LhlSVqQs9TCXYp8vQhdZcNiQxDIXd SBcb0MNUgn3eXEi5KD6Ts5vLhhNGI92wDQiFyRjDz1SCfRiMMeidydENdRf6nUqwj3V0R6uqNZfl /HnMXcyjO0ouDDKVYB+KYwxzKuFmLhtO6I0xAk4l2IfWGMPTXDac0Blj6IGnEuxDZYxBYyrBPhTG GN7nsuHkbYzhtyqikYAGhBJwjCGqAaFgF/oeY1gGZHYmRzcBxhjsz+ToxvcYg/ZUgn18jjGsMzlh DQjF39Gd8AaE4meMQc7kxDYgFORCj0d3/M7k6MazC82phOgGhEJc6P5xlc5cNpx4elzlfSZHNx7G GGynEuzjeqTLeirBPi6P7mQzIBRrjOFcVT4DQsEuPHJ2IZ+pBPu870JOUwn2ec+F3KYS7OM8xpDV gFAcxxg8pxLs43B0Z81lJaXRcGxdKLcBoeCPaIAL+U8l2Acc6b5OJVQqCrqQTCUkNyCUoTFG/4lU tab4cXXw6E4jL4cPjXZXuXSeK+aLY/+v3ZNCuVZvKJd6rVI8Sy9OmH+o+LPR1vHlTUHJ5K9ymZWY +a+qNjIxt7a5k83uKZhsdiedTFh+QH8hTc7OLywqmoVE//+r1HQjOqZwRo3+PzOarnT+if9XdiC/ AUYh5FENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMyAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5 cGUvSW1hZ2UvV2lkdGggMjc0L0hlaWdodCA5OC9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRzUGVy Q29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvU01hc2sgMTQgMCBSL0ZpbHRlci9GbGF0ZURl Y29kZS9MZW5ndGggMTAxPj4NCnN0cmVhbQ0KeJztwTEBAAAAwqD1T20Hb6AAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAB+Azq7AAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNCAwIG9iag0KPDwvVHlwZS9YT2Jq ZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMjc0L0hlaWdodCA5OC9Db2xvclNwYWNlL0RldmljZUdy YXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL0Zp bHRlci9GbGF0ZURlY29kZS9MZW5ndGggMzY1Nz4+DQpzdHJlYW0NCnic7Vp5f9rIsh3tCxJCrGIR u0AsAhsQQgItLDZxPJnfvd//y7zqFmDsOLmeMbnvvRmdv5Km3cvprqpT1frttwQJEiRIkCBBggQJ EiRIkCBBggQJEiRIkCBBggQJ/r4gCOK/P+qvmfQmIEiKpshbL+8/jEoQv2LSnyzn+wP44ZEQJCtK KY667eoIihMlkX07KkGQJOaBZAQpxdPEVdMvBBwP8+YACJJm6PfnJRi5WC1n+NtSQnKKVi2lWfLN yhiOZ2EhBJ3KV8pZgSJwE/eDtd0I6NBlWWSvJiFoXpJ/cA9Iodi1zKrM3HJNBC2V+1avJL6ekmSl bF4VGZLksq3RQFdYEjUV1BSDqftFvoVgpKKul+SX8yEoIVvVtbcndvotVZt6dkdlb8oIo7Tm3n1d pl/dVFoqtXvNvEBRgjZ07F6eoxjU1Cog6n6NQ/sNXdhsy5penw/Jqc3xxCgK7zIiNxaR189z7/z4 l0GwqrGKlm3l1c0j2ExzuhjXZIYSK1PfGxZ5CjdZepohfo1DQyC5fM/xF+3M+dThGpTHrjsui9Q7 a6fk5nK3MW/NSLbn7Vadt4yo7fvlBLZPp6p3wWZU4ikON9WhI3Zo2q0d2mk1hrv3R6XzlYAr3Laj zUvDq94xI4P/CiNMutofdUsiTaWq9yFmhJErvWFXS9EEKRRu79DO8zYW+938YsQkXxisd66RBWd7 5bvif79i5NQEF/itj8MxkrxqxF1R66nt3IF4xUiGIYmrVorPlMoF8HAvjFC8UiwX0hwJTkYHh9bN gt2c8Nvr2f46KLE8CQ+IASJeB1zRaAsMMRRFX+IcSCTkx64YIeImiN0sx7HXARGCN8vx/EsjdoIU 9Iw7EpcOTOwaz4yoPB7r1IpinpyWYMsXRkgSwiBqIsF+OrCQkSZx0J0CtXAxHzTbp+IzuNaedwjG WmwlBJNpL3f+uCQynChLPH1enIRD9AsjaHGSwPNiWs3nVFlgLtuHHzL5QiGvyjxeWewEBQFa86rE UhQryJkcdMgqsWvEjOxdo5BW1PylFSYV0orMv2YEN9E0ly4P/eNu1i6paZHnUzJawOnsuJQsfcbl EjSYze5iNrHRrLoqx6VLtbKKXRcKyJVaUWJI+sIINJUrxVy+3Oj2+916UY4lDWxfytc6PdPsd2p5 CTVCgC9UK8VCpd3rt0syLyhFvd0zB6bRLKsCzIoYWe/XQ70KY5lGq5IVUSvFqxUd6bYXRiguU9Y1 heeVSn95eP7i35kdvZhRNb2WT+H1I1tDXT7j6EhBGwcHLzYbbDRhNNNlViwa1qCWZvAhKvWh1cnz 1IURilX0wdjsGqN723GdWb+KBQwB8rNiTBZLx3Hsaa8CKyNIPt8Zj/v98WLlTNsFJaf3p3Mb9VhY rTxSooiRh2g+Gt3BWCvbaheAEogmtYEFKoB68SO0VDGtniZLhe48ev7Xt0ffmQ0bWqU7Qasj8R1X 9OH3au/PXRJQA+4hsLDZYKPZboZFgZFq2HUhnlCIXrpWRbxiBDVtXNt2Vq7nR9FqWJbgkEhWqQ1t 13Vse7VeL4fVNEOCnLDWm5XjbXxvZmj5mjl3nKW9dDfhZtbOggECI5svj8EKxnLXQeTPu0AUyapd 25vWpCtG2EwbpFwjIxd79u73f/9xDL3FuFXWR6v1VMeXHES16cBSU58yG1mfbXeLRhrtCBnN1gFR ylxpMZIvDjfhTJfoCyM0NPmPh8izp2NrvtnvHPD7KASUh87auTMNYzTfBI4Jh0VJ+nx/PEQbZ2b1 64W8PphOR32jN5z7O39SlSjMyNfnh8C5t0aTZbAPZw2FBc77XrRoyFfRFx0eSDk1peoj9/Hb12hh 9VtaTjO9rdvLwVJhM/VZsBlr76mpD4MUSiP/4KERkdFMg/C+dt67eWIEekD8ecVIaRx9fYoWZr1c aU02h3ACmo7kcl3bd8fNUjZX7s6DcN5UWFqq24+/fwnm/UalqMpKqdGqa/lsTuvMot0StCFm5Pn3 B3fcqmhVYxYeNsOSQPN5c7NbNl8xcgrTvKDqVvhlbxtVGFHKQjAI0PzgxbLGauv1c58STGA23dU+ tNCOkNFE60HhymPEjIyD7eJ7Rh6cvqaIqWxzDpcMfDMtVSe+f9/MSbyQ1kx3h4ZigJHj88HultIp gWN5OZOB+MDxUskEf2oin4TuyNNmXFNTAriIJXb0LJ8f/IgRluZBWB5Cq5oWOIaVqtNwZzfB50EK NPbhYqU/pdwISqrdY7NhKL5griO7DVqJ+gAjx8CqyCxFi3CF9k5bYVnkhXyrpkqiKKOtRdOyyAIj D182g1IKpAMZyxKGYVgxDwfhj4p4oxsIpY0MR0EyV7aCgwvBDgz4B4woDMmkW87eB38H4oVE9rVb 91EqmK7PI9/6nNGc3MQemQ0DbAfBtAp+6QOMhHjhJLqqED3xJvL9zUN4166UiiWtPnAPu3lNAkYW h/2ioTCn+AycCCk5na0MPDhmTUAbXR/w9kC9YX0E5ioIP2HkvLwCh8M7CIhtOK2kGPhjd7sysp/M MlCAcfbgCFJ8BnIaz4RA9hFGgp3dQA4e/r7r7iF+8wJcnKeDdzcaDgZDyw4f93MdMwKXpXIKiCCh 5Gypqjc6g8X2uJ2UBRoz6hm4xgDbay33wagofoSROMFCAsLfgkviU2XLD2dv6gp/gRGs3MEQM1LR BPfeRLnlhxiBJgoz2nF3Xi/LQ0awe37aehBcQXCso50PcRAzElin1BGUaLbaHVjTu5kTHL/uwKxo vFEX8po4dcLdtT/BCPaE4LOKUqYxD3+Qpf4pkMh9gJMrZfVp4E/QacZT+uha/piR7ZkRpbPCjKTK 0/3Xo7+c3SPMFvNJO4c862IbjEuxgqKEfMtaLJeL+eI1I+fcl8Ld/xwjkPfdR+F9PVvsQ3S+QUEL FbHsXThtVLrL0MUaBNWG7J0/LKB9QHz+MCPbYzTrNRt1QKNRB0HO0NeMkJzauvfW9mTQ6w0X0XF7 ZmT/ckcgq/BHpQ8xUogdBvKEIKN61cbED+5A1H2aEZCVk3DnmB1rDRIChS6Cwncd74NA+XG0+wAj InK3nqll5BiSyNEkdcUIqkdZm3A5qJfyharpHqJJzMiVH1HaDtrrBzwrHBj3kp9u/alhLkPPxKf4 SeD4tQ/mk2W4seLqGVKa2zCWPSim7fYfYEQomCho5QWGPgHZ3zUjTLppb4OJnhF5EQmrCyMP51gD 8WqN3fTPou/pCkPojuMXlapMgu3qfr6J7JZygzISWuhid/C98KSGUd2kguokIKdpFmmp44P9Hxnh OLXj7PxxGXJ+EB4UqA6QC68ZUSEsgSQVGUbIdVeXO7I57udNlWdoNl3Dckv5iUJDjEhwSCg8Mvj9 Jj7S7SYA7Vr5TJZ3AdiFFX05PjyCVk+fygJIdnmDsiIrmmHvnx8/wAikh3dBZBvFtMDzoDkUWXhj NShQH4JxJS2IIMSDix/ZPD35Vj2fljJlkLoB2urPGRGr99vtvJmVBPTyFZcCvxyPD7cqiyNdtH76 9u3ppXTEZkFSbpdmQ2+a8+D4++OL1Zg400Opjv6KEZbi8z0Hctd+XSsUSpV6vaKiFB7sD1/wk9Xs trZRKWqN0erwtD1bzdPzwZsY9VpzuNzitBEyvZe85lR5fmEEO/v92mpWCgo2NpAk0fMf3x4+q+DP QDnj/OHbH19AeZ7KizhH2Ufu7G5me8EeVDZsnz5nxBTy7igdjhmBbGgFnpFk5OrIDX3nbmSaQ+tu YpRESHb0WbgexozAZRxvdv5ibA4m9mb/GGtWMKWHx53v2vd3cy/aeqOKREPWeM59X14nLs8YoJO7 zm7nzcZGVWEJXNPwvv7r2xbC9m2q4qRQHKwfjuG0Jp1L0ChObqLIX7vOYrZce8jl4hesBQR8issZ tht7YUTnvTtHHo3kFH1krzfwN46zcmaodIMs0rWN2D2R6MnF8zcre7FY2O7GgchAMUpztvZs2/HW Gz8MVuP4/U7tLNxpLUVRQmm4XBgobVFaMxc/daEDG3tRuFlOWtm4DKDPH/94XveyN3pdg+usjxan 4eMWSsg1RvOlY9+Puq3uaARii4RUsDtGjwIko+gD3IQPvmiM+6hkBBJdKXfHs4Vt24vZpF/LcCRE jzZ6pGTiqCBkG8OZbc/vxn2jPxrUMyxJpzRjZHa6g7uF49h3/WoGVbZpuWqOuxBKwaSbQxMGIGmp 3BsbuEBGchl9OFvas6Gu4KqWoFnb54fFpxX8hRGYodxoVtF787mJFjJavWN0GuVcJqeV8yn8cFSI H44oXtUqeQlvk2TlYrWk4KyLZFNZrd7uGkanWSsq0BPVWSuayp/TGl4pwe+dRrWYK5S1LArvXLpY LmazJb3d7TZreZnDz5h8RqsUZJiUFnNlTRVQR6VUKeInWcQ9jNM5LxlE2ig4hjdQ8BdKKC6VTr8q YhO4aq5m0iLH8mIKVbsJ9OGCiBcM/VOnAjiutounCjpJc6KsqNlsJi3xDN4a+tjhMvBl1BTPCSL6 CIJATSmB41C7qsBfnUQGJ0q4xk8yfCrF4Wo0muhS4xZkJaOc3gvQHQn3q1s+SeN3jjefTaDvJliW xmUNCj8/QS+KOmf1FHV+bbq04v/gv2KxGME9iatf4+9j4HfmPOrp79Gb1qn9MtD1XC+Tnt9B0DjM 6bsOHBq20f0NFPwrAr5/C7u8l11+It7519tPF96+s33/6Pf9qK/a35nrvaFeuoOvMeKS3S3fX/8/ A5UTb6Xg/xYAVV+drN1R+SYK/u8AlFObd+NG5r3vgP6RQGKg2rjWDv94XJ7N/7cX8n8HBMX86APL fyqI98RDggQJEiRIkCBBggQJEiRIkCBBggQJEiRIkCBBggQJEiRIkOAfif8BRKNTMA0KZW5kc3Ry ZWFtDQplbmRvYmoNCjE1IDAgb2JqDQo8PC9GdW5jdGlvblR5cGUgMC9TaXplWyAyNTZdIC9EZWNv ZGVbIDAgMSAwIDEgMCAxXSAvUmFuZ2VbIDAgMSAwIDEgMCAxXSAvQml0c1BlclNhbXBsZSA4L0Rv bWFpblsgMCAxXSAvRW5jb2RlWyAwIDI1NV0gL09yZGVyIDEvRmlsdGVyL0ZsYXRlRGVjb2RlL0xl bmd0aCAzODY+Pg0Kc3RyZWFtDQp4nHXCBzuCYRgG0D9mhaxCilIUla1QIYlURhr29q+S0Ve2FLL3 5n68IS7OdfwZKX6Wx6Z+TlvKTJ5Osz5mY8Zn3hKfF0jMDOSwWTQ3m13OQz7NxxxakIsrKMijQsyn hQW4WiSgxShcFWHhWgkWUXExBiWioKQkWMqKuTIxJ5Vw0lJORkOyslC5NCRHWUghCyvKwxUoD1fK 15WKdWUFVVVuYJVyoxpVm2qs2tRU45ZWTWs027VaWlezXV+7gw11tLF+F5sadpsb91DXhBF9c0Sv i7TQ/Vb9flsLRg2tUUNb1EhjJkPMZIy1Gw86TB/bDzs7Ds3YedSF5iMLdsW70RK3Wo6t3cc9Vjzp xZ4TG/ae9qHt1I59Zw60nznt507HeT868WKgnw7iwOUQDuKVa4gOo+vK7bp2D1MPum/Q60n0eW59 XjriwzscHUkcG71nx3EMH3Bi/PskTjyyU5Nfn6Zx6seZaXxOPjuT/GWOnf19fg5f/7sw/+c3dpFd +PM7xsPMDA0KZW5kc3RyZWFtDQplbmRvYmoNCjE2IDAgb2JqDQo8PC9QYXR0ZXJuVHlwZSAyL1No YWRpbmc8PC9Db2xvclNwYWNlL0RldmljZVJHQi9TaGFkaW5nVHlwZSAyL0Nvb3Jkc1sgMzYwIDMy NC45NiAzNjAgNDE0XSAvRXh0ZW5kWyB0cnVlIHRydWVdIC9GdW5jdGlvbiAxNSAwIFI+Pj4+DQpl bmRvYmoNCjE3IDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCA0NTkv SGVpZ2h0IDEzMy9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJw b2xhdGUgZmFsc2UvU01hc2sgMTggMCBSL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMjAwPj4N CnN0cmVhbQ0KeJztwQENAAAAwqD3T20PBxQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC3BsuDAAENCmVuZHN0cmVhbQ0KZW5kb2Jq DQoxOCAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggNDU5L0hlaWdo dCAxMzMvQ29sb3JTcGFjZS9EZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25l bnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDE0NDU+Pg0K c3RyZWFtDQp4nO3diVLaUACF4d5AEAWsuKDWBauIqNi61t2KtYqyCBJJ+v4v0iTEdqaNgHCTu53/ EXJmMsk3hPvhA0KDR6SP9RUOKaJF9ZjM6dGIGmNqejw1kZ6Ut/TE+KiuKbClpidnltbW8xKXy2ZS Mfm31PTUXH7/9OJS4s4OCwsfpd+S6Mm5wsltpVZ/krV6vXp3vr0wHtNYX+xAI9HE7MbJfcNoy9xL 8+Fiez6ly7wliY5l8sd3jbZl/ZI4q/38cLY5l9TlvcWSyOh07uinvSTrix1wVrtZPt2YTUi7pb3k 1Orh7dOL7Eu6W94d5zNjUTm3JJH45Of9H3UFlnS2bPz8lpsZjci4JdFG0tm9Us1QYUl7y5en28O1 KRm3tJecWP56XTVM1hc5pKyX+o+Dz5Nx6bYkWuzj4s5VpaXKkvaWRq20l02PyEYFWmx8oXj52DLV uL26mUb1+uvyhGRbanpqfuv88VmlJe0tW9WrL0tyEZ7DdZtnD4ot+csyW5XLolSER/TE7MZpuSk9 DfybZT4/SkV4Htept6S7pUyERyKjM7lvCnCdX1IRnsN1a2pwnV8SEZ7LdQeKcJ1f0hCeYlznlySE pxzX+SUF4Tlct/TlqqoQ1/klA+F1uK6iFNf5JT7hOVy3faEa1/klOuEpynV+CU54ynKdXx3C+yQm 4SnMdX79ITzxtlSa6/wSlvAU5zq/7C3vBSQ85bnOL4/wxNoSXOdbh/CmRSI8cN0b2VuKRXjgujez jNrN3ko6LgoVgOvezjRqAhEeuK5bZqv6XRTCA9d1TSDCA9f1SBjCA9f1TBDCs5cE1/VKCMJzPmsG 1/VMAMLzuA5L9op7wiNaPL2ydwOu6x3nhOdxXQ1c10dcE16H676D6/qLZ8ID170vfglP01OfwHXv iVfC08B1741TwgPXDRCXhNfhunss+b44JDxw3YBxR3jguoHjjPDAdUPEFeGB64bKIbwjPggPXDdk LuGtckB44Lqhs4w6F4QHrhs+h/B2mRMeuI5GHuEx3RJcRyeH8HYWWRIeuI5Sr4THbEtwHbUcwjvf nGdFeOA6illms3xaYER44DqqMSQ8cB3lmBEeuI56jAjP5bpdcB3VmBCevSS4jn4sCE+LjS/uXKp0 aEg4hU94WgxcF0xhE56mJ+c3z8F1QRQu4TlcVzgtN7FkAIVKeOC6QAuR8MB1ARca4blcdwSuC7CQ CM/hulVwXbCFQnge19XBdYEWAuGB60IqcMID14WWQ3j7K+nAtgTXhZdp1Eq72aAID1wXZqYRHOGB 68LNbFWuXMKjviW4LuQssxUM4YHrQs8lvC3qhAeuY5BHeHRPFwbXMckhvBO6hAeuY5RLeOsUCc9e ElzHJsqEB65jGFXCA9cxjSLhEZfrrsB1rKJHeB7X4bNmZtEiPIfrtsB1TKNDeERPgutYR4XwXK47 AdcxjgLhOVy3Dq5j39CEB67jpiEJD1zHUUMRnst1++A6ThqC8Byuy+6WwHW8NDDhvXIdluSmAQkP XMdhgxEeuI7HBiE8cB2fvZ/wwHWc1iG8hf4JD1zHbR7h9Xs0CbiO4+wty2eFuf4ID1zHdR7hJfpg H3Ad51ntxl1fhAeu4z57y34ID1wnQB3Cm+rOPuA6IeqD8MB1gmT1JDxwnSiZRvW6G+FpegpcJ0jd CY/oybnCGbhOiLoSHokmwHXi1IXwOlx3B64TpTcJz+M6LClObxAeicSnwHWC5Ut44Doh8yG8P1yH JcXqP8L7ezIsphQryzJqLuG9vl4S9zzRh+aLiUSr/VxxfrnlvV46D6+5w5vHp0YTiVbjqXJ7vJEZ 69xiSTQxmz+4uL5BIla6PCrMpzpvlyQyNrW8vlUs7iDxKha389kZ70/z7aeexMR0ZhaJWWYmnRzx nmGJpsfiSNxG9L9vI0RDIkdYHCuMgus3sYWsCw0KZW5kc3RyZWFtDQplbmRvYmoNCjE5IDAgb2Jq DQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAyOTAvSGVpZ2h0IDk4L0NvbG9y U3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFz ayAyMCAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxMDU+Pg0Kc3RyZWFtDQp4nO3BMQEA AADCoPVPbQwfoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgY00bAAENCmVuZHN0cmVhbQ0KZW5k b2JqDQoyMCAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMjkwL0hl aWdodCA5OC9Db2xvclNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBv bmVudCA4L0ludGVycG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMzc4Mj4+ DQpzdHJlYW0NCnic7Vppm5pKFo7sICCgKO4b7gsqIrKIgvaSTDLPzP//M3MKtGNvuekxN3fmPryf uhHqvPVy6ixVfPqUIkWKFClSpEiRIkWKFClSpEiRIkWKFClSpEiRIkWKFH8xMgh/NYn/YWQwnCRJ Av87i4RcAMP+Oz/IYCTDi1JOYEkM4c+VKYMs/PY3AT5AUDRNUyT+8fllMEpQa61Ou1bgaYpmKOJP 1CiDETRDk3/yW3jLKifKBbWg5Hjmw9YxSqz0jbVlTlsFMZdXZY781fy/+zZG8oqq8BT2iy382DxO 8/lKSx8Mh712TRUZ/EMTzOBZbWTvAs9e9spqtdtvFdiPjfCHFsDDz76dwbliu98p8cRvdKIMwcrV 3ny9dV13axmDuvKxCWYouWsdDs5yOmhqZX1pTWvCL+UPbzDLc1QsUYbMNeaW0ZKo36dQBmfzrfk2 OByC3S4IfHvWlD7kwxhbmviRO2mVi4pc6pn2vC78ymWWwRlJqxaTMUGhpmEv2/LvUyiDMUp7uYtC f7MyFquN61mDIvsRhfBsbXk4LJtylmVYqT6c6EXuV66yDClUhzNdZZETZQhe60365V/6Dv7Ivtgw guN+M+nWq9VGd7ww+heF4gLgWQWQlIXo+tNVGKBlRbupliVxHBZsqawK1PXzWOZ7Nfl6rMsf52Lj 2WPJrxit6Ja7qPMEGgmjxWK5mKMv6eSnON4kEM6Vxt5xb/Y0ieeyglyqt2oyjX1KqkDI3TT9VAFk MhAxcQyu009XYQ0ounPcTTSeJjCMZAWRp2MXgrvR8wxNAchkegTxNBZE36QqSOIwuhfGRDddHkt+ xghg6Ed2V2bRFbDHizxDPI3yBkfiBcfbFKKkjhVGlq5mKRx8gGKh8mPB/lMFoOZz2WTKkGlZnmdp hpfyhbwENGPCueo0eAiXrWKOowiSFXNCfHsGh7HQ84W8osg5pB/B8MIl4mIUJ6CJZjIEA3GY5USl kAfLMLNsTlHhMUlAhUeG5JTWKnrYTWqF2CTBCJLIEskgBJ39Q443KoSz2nR38sdaNn5j8XunQHmY QVZJKoB+p6pwqEjKEFy+XFEVtdruDwfdWj5LYjgt1Ubbu68PntFvFgWGkyv1kghhFElXaqDnh4N+ X2+VJYZk5XKtJFBJxBVKtbIMWRNnZK2qqaVGb9irKxzD56ut3mAEBuoqD2+NVZoz//HryZ724kHo nFYvS8jLgSOqUtDN/U7lO8dKpZi/5nibCxFic308Wq3cU25IogIs97I+Mzf21tla8y7MCwNCcnM8 HXT7U3PjOBtDL/EkmS0NrOjrv76dfGvWyvOg17wHcQwtvsZoaW02tuP53nbZ13hGPP+IXjVb7M1G NZHESLE2nI37o6XtWKOqJGnd6coCu/ZmAQGZooTqeHv69q9/RK5l9GAp89pgPqxAPZRwnANH54oj HXPU+zPTvnC8aaFlKKXv3R3mZQ5/dh3K5OrY8nzXcdxd4FvDMhjCmOLQ9rdrC2x7QRhYfZUDwkP7 +PXf3+4D2+gUxIJueYsaj2OU1JxvPcey7N3x8SGyx2WBiyNuLYsjD8vWDNfSFQqnZH3tu7bj73x7 Wi+UusZma8NjXhBshiUk68S9/+e/v558ezUoC4zYXHlmOwd0nnNcD7S3Od5WvsKAk/39blign/ki 5NTyeBv4G2M8mq7cw2GDDMGKnO3vT4G7Nqbz9e54MFsSgxaB9/jtc2BOumWJV4duaDUFgshWpu7O nvf14Sp4/Bya3QLHFQbxj7FCQtMK3UGBxunCwLu7jwJnvZh0tbymz5ezUa83NJzwsO7IbFbtLIIv 3x685RhWIUtLHTt0ejKFnTla87c4Ok8cm7mbnAhjy0Z07+rS81EwOt/b7Herfq1U1JqTbQhi5Egc 3fzlIVj16+Vqdxmc/JHKUpzSNMLHyOyW8wLLqSM/2rQEkpK6VuBOG6pS6pjhnT8pCzSrDuMfE4Va m8gfxgqNgi9fjttpp6YVREGptVvVoqIUG1Mv8scl8FK1uz4+7uctrQC5AAbeRm4fnI9BHP1VD3Fs TUBPJMaZ4+7McX/yhip9SyTCuerqeL9ti8/aBHChmhEcLL0osAwnVaf+EcRgSA6sf47WelHk+IJu Hw9GhSNITgUngGwPqYdkQKEjUogBZ9ojF6CzxaEXOf0CQzCF5MeLQjDoRaFHf1qTeY6hKC4HeY+l aU5pr8PDopolKb4y29+5vUKWgcBN5rrOERSiyZjjWldjjjXg6F1x7CKOqm5HB6PM3aRQtrY63SWs rxSCTssO/QkUgRjKVu11FC6BK1eeh3fusAi1IclXjUO0bkAZB4HEOXqDAjS8GH0WgWJLUz8wquhn qZssC5x+V6HHaNWQUDmFYQRFUyRJUkyuvjhEJtSJOFMc7452J4dyf+ZJIfoFRyuK9XzJMTTrWfzd +f+cQsdXCmE0WixQo6HaGGrK8nwP6U6k0B+h2YQEhCLiZAfTFQmMlBLOcPOVQtrU34FCJI7UPthd iXxfoR1aC8mOQlwCMhwvyqWuGZ1QSIvZoOeQnz8pxLAJx7iFvXBsXnHMJBwjq8nfEqoxrrKI7l6u MgzCXRCuG4luybS3XYkG68HeqKJkBBeHPrxYlK7PnKnMd4VIeO/eft1G9U1p5B7WLbjxXYUgOnXO 8RRVkjm1XGt2+ob/cG+3kELfn7tSiEMczQZ/5qiOdm9x9KJNU7hJIVabh68iNc5VwD2XtcQ944rg 6PZkBlkP5vG6hosDDyjl3lGIVvpO5M2axUJZX+38OVB+V6GhH65hGrEtnBZLrcF0vlhZ3ukfjz9Q iK8ugGOV+yHHvhe9XCAfVYhRJ8GrbA/xe4mi5MW63HOvrbMX60fnXYVgbW1PR9cYDsYrd2fpeRo7 u128Wp4r5B0goMW2MDpXG602G8s0Nz9WiOVrK+BYeUehC0c3vFEh5Ar+/YuKEVZ1ZfHShxxdpl9a /4FCtNLbnk4Hd2PZrouKOSLztDCRQoTQsq8UMhOFIIlWJlDwrSaD/nDhPzz8SCF4i1c+lB+8zfFm hchcx747XXUdaDOBgDW+j8Dz4+iEMXGR0859QCGKLY68MHDAGyxzpmuoIUgWptNFKxrZ3R53rxSC Osw++Ea3ohagjoruzgohZZNY+X2VZcuQTM3GhWOcON7geLNCeLZqhPdo7yLOpZBK0GYCh/Kr01Po uBeEpLkPV3We+oBC2YqxC6zZKOlAkUDn1eoNYMFB14Yq6VcKoRSxCzc9lWdYsTo/nBKF8gPIFEks v8plSBNbl6kzR/D6tzjeqhCqnvvO3XHTK/I0iaOtBymvCHy+5xyDWUWg0KZYvrsJd1ONJX9aIZHm 66t9YA7azUatjEphPPEb+xigrTaChmonfAheKcRVFyHk6hwNLXx9GfsQtHjIFCqBcKgynuohRgGO u2mZTzjq9tscb1YoLp/3d6HVr+ZzgpArVNp6UxWkxuoQ2QMtl+WEQtPYHTawxImf9yGary0PEQTq XrfVqJUUAe0E4XzDjCKrq6LeYuw+fHlDocoijKxOnudEbeDc38cKQcG1hfdVzXEMlFfn6oumRMRx 0084thBHKOBecbxZIZiU0rXCu3A7H3Sazc5gZq6GZYEvDpzoYI1a1UpdN9yDNy1nCdQV7nYz7cl6 dMn2Sad0rpJQfqU4bRrcn3a2uTTms7Fey3MkhvaiglOw1Ov1ztSOPn++WmX18yorwdLxZ01Nq/fN w2cUqXGI6o11dLSHDS0v0PSlLyPY4tCJ9gnHHnB0J6859kCh2+qh5ACqbx1Ox727Wa83judZQ2gX herUPewd05gvLC9wDXT+gWboedOzdVnfHlChBwp1NoetLscK5QdQHjbjvsx/eDzu3O3WcZ2N0VU5 1J90rPAYbJYL0/b2p5MLMQn19k6wrCWROj5YCp3FZDI33fDhFBfEGId2+cLtYtwu8ox0toaRQm12 4bgBjvNG7jVHe79u3FRTI1YkX9KX7iGKwsN+H3jWpA4tEi3VJxs/8D3P873NrKmgrotRB5Y1UBks jpitlbNAqQRe8cJZtVAgBU4d05lXeejLxt4xdM2FYZi2v9+ZHQj7OFcabIIw8EEz07RdsyOj/aGu aU+TcgNelzbc7AJvC0lwbXsuqjQhCcrtVRDuvfWoIjDixRp25rhLOE6b8hscl3Y8xE0KfcLIbL4+ MKyt49jWaqpXJLCE07mKPjMtYLqa9arI+CdoQuuDQT3phIis1hvrRbSNyhb1cU/LJmVOuT/uFlha rC92wXrYqtXqrcHSj3Yz0AAjeU2fW7a9Noaddm/UKwvggvDIsJVPSlb4T+sZa2u9mg/13mjcKcBU wYLama83lqEXsxSXWAPhXnCU3uYYD3EjMgQjFKqtbq+nt+uaHB9VoD1gpdzo6HqnUc5f9uZZqViU kj07jBJVrZBszgoFTRXjLhej0VWeYvJ9O0CRns/yuWLXhASFujz0MqotGLNelKV8URVptG+aU0sK R1zaMr5Qbevddq2UzxdL+Wyc4glOqbS6nUZJBJ9D1oSkp77myL/NsVS4cRs2kQgjaU6UZFnK8Sx1 OaMhaE7IyXJO4GjicmhOs+z5TAHmwnDxVxDo2xiOOR9h4BTLMiTBlqa7eAuSJElGrM0v9WdyOCFL AktRNMvERQBOMSx9OZJAZnlkFe0RMTAUdjacFSVJRAclYI09f32RcES83+d4GeJ2jXCCpCgSHTBl Xlwjvh86Za6+Dso8fceTufqiJ/kbZyHnhpC1OZhmVmku93sUizPn3Q10eoa9ePyaCroDx64/RYq5 xOyeWfs5jr9CoGS01x/avXHpp4CaAD9yp81SXimUmpPt3hldHeT+wZhv3vHuY/8tx78WKGuvg/3W GPd7/bFh+w6k4t930v5/AGj3SoO167s2dK6b7daatpQPfpX0dwdk7VJngg4UN2tzMYVy4Rd/dPX/ D4zkZK3R7Q/6V+VCimtAEucEOV8oKFepOMU1vn9eS/yCb1T+prjhE+0UKVKkSJEiRYoUKVKkSJEi RYoUKVKkSJEiRYoUKVKkSJEiRYoUKX4G/wEcO3VzDQplbmRzdHJlYW0NCmVuZG9iag0KMjEgMCBv YmoNCjw8L0Z1bmN0aW9uVHlwZSAwL1NpemVbIDUxMl0gL0RlY29kZVsgMCAxIDAgMSAwIDFdIC9S YW5nZVsgMCAxIDAgMSAwIDFdIC9CaXRzUGVyU2FtcGxlIDgvRG9tYWluWyAwIDFdIC9FbmNvZGVb IDAgNTExXSAvT3JkZXIgMS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDY1NT4+DQpzdHJlYW0N CnicfdT5W0xRHAbw/88uISGEQnYiS4hsJVnKvpSZkLFkicpgGINmn2mapRlqQiSqiYqs7/d8z5x7 x9Mzz/P5cZZ7z3nfN/a3Jja+ixCFP+ldgA7lt955JQK/lHNKmP08qxciZ0JjmuDYafKDnWpXvp+E gHQiMEraRqulkWr/SJU0XOUbPi4cA+83dtTzFY4w91Alcw0ddiWIM1HhHIRD4BgsdwyU20mZvb+s tf8ge/XlgLD/5WfYBy/69oKtr9T2CfY8h97dYO0tsX6EXc/gw86n0LMDLD3Flvew/Qm82/aYbH30 dgszdxeZuzc/hPgmaIkXtnTBxuauDc2dpKlzfdObdQ/I2vuvYQ00xlY3xlbBvehKoeBuB6yAO5Hl cDuyjITzG0heQyjvVmgpCS65GVws5N5oh0XCwusBtsAUyDG1sfnXwD8P6v1zhex6X/ZV3xzJm3WF zJY8sy5LM6HOk1nnVmaA0Z1hdLHpzCBNMzjZVLgkTdE4JkOtNCnVxFo7qdFMSEt+jL9FX///B+lf +B9TnkE8lUEST4vHFs9v1Ii3c2fw+2qv78nkM+HzwUFph+bNwjGqI8Xx0iGL0+aTxxWYiLiRQA4u iG8KV5a8u1xcJd8pLpdvGddNlx7ORwA4CZwKTgiigsBwcjhFiBPnCgFDzBA2RA7B4wQiiggkxTJe yClFXM2kSMUYkUawEW+E3EKKEXvOP4qAOqAUVlKCmnBfUBwbKUWVuFPcLxQNdePeqRqiklTMASop qsqdpfImKrjLKLUquKo86o8R4DXgZeCVwFyo6cCMqEnhhaGpEZvD+6PmKEjERom90i8YDVrqyhGx fpEUyZHUjaeg29Xk2EaltPssZlwYf+f/ATrhPYENCmVuZHN0cmVhbQ0KZW5kb2JqDQoyMiAwIG9i ag0KPDwvUGF0dGVyblR5cGUgMi9TaGFkaW5nPDwvQ29sb3JTcGFjZS9EZXZpY2VSR0IvU2hhZGlu Z1R5cGUgMi9Db29yZHNbIDM2MCAxNDYuNjQgMzYwIDMyNC45Nl0gL0V4dGVuZFsgdHJ1ZSB0cnVl XSAvRnVuY3Rpb24gMjEgMCBSPj4+Pg0KZW5kb2JqDQoyMyAwIG9iag0KPDwvVHlwZS9YT2JqZWN0 L1N1YnR5cGUvSW1hZ2UvV2lkdGggNjg0L0hlaWdodCAxMzMvQ29sb3JTcGFjZS9EZXZpY2VSR0Iv Qml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDI0IDAgUi9GaWx0ZXIv RmxhdGVEZWNvZGUvTGVuZ3RoIDI4Nz4+DQpzdHJlYW0NCnic7cEBDQAAAMKg909tDwcUAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbwYqUAABDQplbmRzdHJlYW0NCmVuZG9iag0K MjQgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDY4NC9IZWlnaHQg MTMzL0NvbG9yU3BhY2UvRGV2aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50 IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxNDk4Pj4NCnN0 cmVhbQ0KeJzt3YlS2lwAhuEmGEQUFRes1q3uIloV0Yr7VhcQRbb0/m+kBLD/9FcQIcs5J+97CZlv MiEPc/LlCxE1SyPp83pDLqUFeowgSZxhBHQ/rFXTjb7IcHSEpC06PBgO+mCsmh6MxGYXV0jiluYm BnvVH6seHJxaS6ZPSOKOUvHpYeXHWr2rTsXTN5lc7okkLZfL3h5vzgwpPlbdGJhcT9/li2WSuNLL w0liejCoe70nB9OM/om1w7t82TR/k7yZlZeH442piMJj1XrCsZWD2+pUvb7Y1F3Vsd4frU8OGKqO tTrV8aX9m2emKn9mJX93uDbRb6j5yKoF+sYWU9dPJaaqQGY5f3uwEgv3qDhWLRAaWUheMVVFMsvP N/tL4yqOVdND0fmdy1yRqSqSWXq6Ti2O9QVUG6um9w7Pbp8/FiteX2Kyq+pYr5ILIyHFxqrpwaGZ rbNsgakqlFnMXe7MR0NqmYAeHPyWOMkwVbWqFB/Pt2fV0lbdiExtHD+8VHhYVatKIXu2pZS26sbA 1/X0PVNVr0ohc7KpkLZasrpak1WvryzZnWLaiqyqnFLaiqyqnULaWpPVPWRV3ZTRVktWvyevckxV 3RTR1oasPiKrKmdp657s2lqT1R/IquopoK3Iql8yi4+Sa+tfWeUJQPUsbf0hsbYiqz6qoa2SHnGB rPop09LWxDc5tRVZ9Vev2iohYCGrfsvS1vT6V/m0FVn1X2Y5f3e4Kp22Iqt+TEptRVb9mYTaasnq HLLqw6TTVmTVv5ml3FXyuzTaWpfVU2TVl8mlrciqr5NJW3UjMoms+jh5tFVDVn2eNNqKrJIk2lqX 1V9M1ddJoa1aoA9ZJRm0tTrVUWSVJNBWZJVea2irqIBVl9ULZJV+v2rrqJhjbchqFlklK4G1FVml fzOLjxc7cyJqK7JK/6tSzAqprcgqvalSyJ6Kp63IKr1NSG1FVum96to6KZK2Iqv0fn+1VZSnAGSV miWYtiKr1LzqWH8Jo63IKrVKIG3V9F5klVokjLYiq/RRgmirJavTm6d8vJJaJIa21mX1AVmlVomg rZasxo+QVfog77XVktW19B1TpQ/yXFu1HmSV2stjbUVWqf081VbriNWlFLJK7eWhtlqyuoCsUtt5 pq01Wd1FVqn9LG1NLbl+OCuySp/PE21FVqmTLG3ddVdbkVXqrIa2ughYyCp1mNvaiqxSx1UKmdPN abe0FVmlzjMrhQfXtBVZpW6ytPUo7oq2IqvUXdWx3qXXXNBWZJW67VVbHQYsLRBCVqnLXNFWS1bn dy+RVeoqF7QVWSV7qmnrgoPaiqySXTmsrcgq2Zez2oqsko05qa11WeWIVbIp57QVWSV7c0xb67J6 C1eRbTmkrVpPeHwZWSVbc0RbkVVyIge0FVklZ6pp6/K4fdqKrJJT2aytyCo5V0Nb7QEsZJWczCzl LnfnbdFWZJWczT5tRVbJ4ezSVmSVHM8ebUVWyfls0VZkldzIOpy1S21FVsmdutZWZJXcyiznb7vQ 1pqsJq+QVXKhrrS1OtUoskpu1YW2Iqvkbh1ra3WqQ8gquVmH2oqskvt1pq3IKnlQJ9qKrJInfV5b kVXypk9rq9bTH1v9iayS+31SWxuyCleRB31KW5FV8jJLW3+uxtrRVmSVvM0sP7enrcgqeV2b2oqs kveZpaer5EfaiqySCNW1NdpqrMgqidHH2oqskiDVtXWo6ViRVRKm1tqKrJI4tdRWS1ZXkFUSpBba WpPVfWSVRKmptlqyupi6ZqokTE20FVkl8XpXW19lFa4ikXpHW60jVue2kVUSrTfaanHVzNZZFgMg wTLN4uM/2qoZkamN4/t8qUIkWOWXzNnWzFDjNWvtz9V7lw9Pz3kiwXp+ylwfrE6E6zdW6+DKleTx +SWRgF2cpNamIvW3rFogPDqzHE8kNomEK5GIr86NN0Sg+tOqf3gsNkEkZLHxaKS38eNK041giEjY eo3/XlppOpHAaXZ+XZjI8f4AE5+D5A0KZW5kc3RyZWFtDQplbmRvYmoNCjI1IDAgb2JqDQo8PC9U eXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAyMTIvSGVpZ2h0IDk4L0NvbG9yU3BhY2Uv RGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFzayAyNiAw IFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA4Mz4+DQpzdHJlYW0NCnic7cExAQAAAMKg9U9t DQ+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAeDTzeAABDQplbmRzdHJlYW0NCmVuZG9iag0KMjYgMCBvYmoNCjw8L1R5cGUvWE9iamVj dC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDIxMi9IZWlnaHQgOTgvQ29sb3JTcGFjZS9EZXZpY2VHcmF5 L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0 ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDI4ODc+Pg0Kc3RyZWFtDQp4nO1ZZ5PiSBYcJOQdTgaEFSCE 8CCDkEGCprvH3ez9/z9zr0Sz3TM7vXsRXNzOXSg/lfzLMpnvlT58KFCgQIECBQoUKFCgQIECBQoU KFCgQIH/V5Ry/N1R/CdRwvAyQRA49j/ACroew7C/HIASTrFipSJyFP6rk4LeJyiKpsi/GIBSma02 e4bR0yTq1x6pElam+UpdluWa9KcDUMLZxmC+c52V2eSJX3lZlTCSb+iGaU2tcb9ZZcrvRopRVWMb JVHg2G2RxPHyL7usMFJsjleuHwSBv5v1avR7gZZwrrWIsshZTA1VoGhO+FWXVYkQWrYXJ2EQHMLQ s1v8ewNVIqSBmyXbka7WRYaRtLZWobD/brT/HjBGmfjpcb+eTWer3W7WFoh3OGFU3TycgokiMDRJ 8pq5sN7vgL8TpbLY3aaZP+2qitYejPoKdwvzB30v4bQyizN3UKHKOE5KvW3oGBUSbvjwnQ3/tH19 F/bDpdsXvv/e/ZzI2jg4xwtdYmiGl2pVnryuJ6TvJEXT1Iu+lzBC0FfpyR1UaaJM0PVxcDpYCoeu Ix/Gb4+9beMEUYZ27hU0Q9NgFqU3l3B0Gl5QejmDPkeW7xYejJKn8UM4adA4lrsU8cKgTHFSTVbk usRT8BmkjvLIPV8Cq1UTOb7aXiRP6bqvVAWGonlJYkksf46CNnftF4xkRRHaL+9SVbkmsi+XCEYQ OYaV6nJdpIEo3MPDgdyoCjRxJysMJlRyQZyw61QoXSmRXL3VH1v21DT0BowdRvDKcHP8+Clz7GFH 07r2/vLlKVxNjHZDrKjdrpqvQySi/d61DeqjdDsyT5Lg1P3xdGZb454qAQNk3o12p6loPdMatysU zGW+rg/GljUZdmThTkPHqIYVP6ZLXSRfXwSURG20dLw96LuzHDclqkxVe8vo6du3j+l+aw+Htnf6 8tvXh8jbWB1ZNZarscJAd+OsZu22JrSR+sjj1bxfZXh5MNtezWJrd6oQcYms9GZLe2Jv/MCZqCxB ic3RYut6ngeGrt+ZpZTI6nB/gRnVlF7HvESI+tSN4jDYB2Ece7YuUnRtsI6fv/326XRw5uPR3D9/ +efXxyTY2V2lOfHDTU+E1IKoGN4p2+VtUJ9N6I4afLU7d/e+5/mH+HhYIGGFnjT9ONwH8A3PbgqM pFtOEHiO6x9Cb9YW39Pef49TmYeV/3Tez3qy+MIKzFWb+knsr2zLXvvHNLA1nhabpnP6/OVhv5z0 dd1YhM9fPya7+QSWlDzeZ4FZpzCMlu3k86dogtpUzQxSb1jj6/35emmbY3PuHcELZBpDMz5+fDzF wW5l92Ve1Cwv3K+t0Wi6PST7qcreZebw6aGTPT5EO6srCzQScnTKTRNn0lFltWN5aeYOawyQmgSX x3DWVaqi2Oit0+fTbtSSqzxb6TtZstAYHGf19cO3f5yWqM1o8zjddkVGavb7bbVea+iWf0rXOodj tDpPP386+bOBrtYEvj504mDRV2s1zdhEiTOo3DdQOCuPnePlcgq3VqfOwVDhbHMRZ76pgrkyYnN6 OMdzDea81N1mSMtZiiBZeRJe4pkmMiRBcM1lku26AkGIfRfW3KOD2kJnm6IHSUasSDxDUYzUXh1P bl8kcOCUfX4Obb3CMzQlQM6VbI0GT9OCYvpZOIWxvIMTLB5ONlZBhlhtRqpA4tccaKELBMg7KSIm KOAy11ql2bbDA22MrI6Cc24BJbQ6JuEpGFUpCszu8dPnp7xdGfppYNaQqEEVA6B4bRaf98NKzgmG ed2RKHA3Uuq7WbzswIizQsNwsnTVYvF7OMGSYqptc3MAVplnaTxJ1yeH8wGiQXaJMyD2EIhEwPAt j+mmzSExJirDPboHudI1EYxmKsuqdng6P1wiW2FZZRqmoBZlZD4kzfJCpdFbHS+HcZVEnI43B8HI mnl4SDdDXVVUrWP557PT5e/MjqF65RvAKjw/nX1T5jh1Fp+8wVV8INEwwzz68pWTjroQaLxwKuWa oq/gSkeCyRXFQZgd121R1FdJvGjCageDFRtauzsYL4KHp9C8ckrO3kDKPQ0Jy/PlsJnZ06m9cOIL cBLuzfiRiwuNru2fYdn3KiLEfrp1FYo+OEdWnXqXE4pqGmbesNEwdpG32kapazTqA+cYTBoggJCB dM3ZYrVxgtOnjxE8lHM6OT0BzTCMURfZ54/ZwfdcFwT/eIpXoCP3UbqyuuraUzhRKiiv23X4/LUQ vbEHTo0/4ZTbUgYrHoTtsDYt7wgZVMsKjk5fIiBPbJpr13OdHXD6+MopQ92Wc9KWp09PibfdIGyd 3XLYuE8jfmdFgvykT+miWdOX6ek2/BBvrga1P+OE8+3NMdkMjeUBMvz+Ko5XhgHTcNniQN+ViRsd wMnMCcy9559xQt/dTfq9LqDX6+oN7i4tf60HkEmGj9lKrzVhsvtGPtlR1TQJz8GoQuLMj5yAac4p zxqjbD+fuaEzVED9j95s5iYHS6ZBRfu7JNmZutJQukvILf/AiVbs5CGcNivCFTxHl+8Zpjzpx/Mi CPRnfLhky1ZFsaKHqyh9yM0quZrKW05l0fDzGZl/HDKs0f6UeG4YrTrVuuGmsetERxf6BQehP5wO U3Aymlen8OIfOSEVOpxDS2aJ8gvwu6qoa9JPEzjUMpxqx5fYVoTa0D+nq+s+Cl01wKyQYXzPSeh7 pxjku5z3R1kAF3tIkzScqbzYXh9PSQJPwVLPK8nzflSjCaiN5z8Zp5c9gaUO1giGCH1M3FVDgf3U 9G5LlniOkxRIks7+sMoI7XV6DqatCs/yte4SZpUJA/KW0wec7+5O2bZX5WgS2S4DhvP8/PQQjGs0 Cyyenp+QS72kducDVPysIBvO+ekP6wnt3SzzvEVkaZrhBElkiDvmHqSwrclqYRkdvd2f7BKoeFtg uo2xn6UeJGOtznAZpNGyLZQhbkiBbpwwtrlKH8J5vymjigiVy+HHr18uMElJCnKM569fn1DGUMp3 Mc7HjdFU9dEKuL6M0yzObtIKC3mE8kurqymKqnd7eo25w55QWj73w8Ddrje7IMniTb9K4QTfmgXp 8bBbLddumISbAcopQJ/mUfyStqB86HA+HbbzUVNAhYXQcy5fv5xWLa5MCN0dtM/bNlgc1C3dTXKK tnN7sd1DXgl5E3BS7PC4vdlF+aUO2Mzt6Wy5XpraPXs3MPfkEaT3SQxI4v1yUIcuwkipbbtREoeH MAr95aCB+g2c1fJ8W2XyIh1S1GWYpZG36FXIfPLNostDgJQFZ1Q7ulyQ6mEgPUxjtIuScO+BRXmH cNvPhcN0g3mTvU4xKEGhfjpEUK/5eygcTY27J40oEbxqQBW63++hojXbNbQPCxNG1IZzVHe6u9tJ 0KdK1571a1epw6Dwne08d2PpKIkqkVJ37ji2jgbt2n4p7WAUFGOxc10olcZQwZtNvowRUmc6M+ov zprX1cZs43j5ByftO/cNMYKtah1jbJqjfqshUPhtP6KqdY3RaNh7PQl60mzW2eu0KOF0ResZw36z ku8wwGGz181/Dlzbv/8oKBFoP2I4Mjpao640FXQaZ6paq/G67YaReRQjczzqt5V8z+IOQAQkI0jV Wg39grmJKNhWfrZaEVnqVtOXyjQHsv/ShfAcK1SgMroxpjhRYEm89H37w+0PT7UisDTFcCzcD+uP 4rg36vYaRRVKLfLuLetSvpVHksR3e/qoQiB+OAk3fn/09v8aOiy/7uyV3zyYG3v+KnjBbbsQWm8j v0VBXjOA+1H66R/Nn5z8w+HbG97bjf3uVb+f/mPgpZ+HUaBAgQIFChQoUKBAgQIFChQoUKBAgQIF ChQoUKBAgQIFCvyd+BeLQKfCDQplbmRzdHJlYW0NCmVuZG9iag0KMjcgMCBvYmoNCjw8L0Z1bmN0 aW9uVHlwZSAwL1NpemVbIDUxMl0gL0RlY29kZVsgMCAxIDAgMSAwIDFdIC9SYW5nZVsgMCAxIDAg MSAwIDFdIC9CaXRzUGVyU2FtcGxlIDgvRG9tYWluWyAwIDFdIC9FbmNvZGVbIDAgNTExXSAvT3Jk ZXIgMS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDY5MT4+DQpzdHJlYW0NCnichdR1V9NhGMbx F2ogGCh2YIKMGj26xugY67EgN8ZolFYBCbvjPfi9f89ztqE7eM7nT+O3576ua9n/ezmdJfjw6yRe sSh+/mvBo/w4xi3mxXfNJebEN80pZsVX4RBx8SU+LGa0zzN2EcPQJ2Uag/gYxQA+IIJ+vJ9Cn5js faf1vJ1Qut+MG8a6jkTn0WjnobAdhm0H4Q7sh2DdD1pfB9tFoG0PI63Y9aNlx9+84xOvvE146Wk0 NLxwo37bhbptZ92Ws3bLUbvpsGwOWzaGa7Bur163V60PVa0NVa4NVq4OVqwOoPx5P8qe9cG80ovS ld6S5R4UL3WjaLELhQudMC3YTPO2gvmOgrmOp3PWfMxa82bb8+LtT+JteDzTikexFjyMNT+YFvej TciNNuZGGu9FGnB3CvV3JlF323Brola5OW7BjTHUXMdo9TWt6mpY5IQrc0LiSqgCl4NKeTYC5ZcC ZcrFEZhxQZSe9ydl+UuyfFqmr1h4xTlRpGTAo531FKY6AzdMqU4nuFBw6iTqzyT/Ssq/U6gd+x/5 gOTHZOgvVF+rvzxTfkjiR/EDU3+vegGz8SDCeB8eSp4rO5h4QB6TJ1VvyyOr1048PofgHOouHIgz qXtxOHVBdU11WU7MoTk3R+f0BEAlgUgQDOJBSIgKgSE2hIcISZDyJVREi4ARM8JG5Age8SOERJFA EkvCKRE1rxBXQkt0CTAxJsxEmmATb0JO1Ak8sZfwWzYoAnWgFFSDglATykJlKI5qEFWiUNSKclEx KVrr7ojYUx1UfaSY1JOShsUBtaW8qsXUWfVadZyyq9ZT/8QUqGVgIiJCRiOqyZhMC5mXxNTE7Hp/ ZIiMRVLrJDPl0KulF8ypNy05cS69e8kZdOtt/HswjRVNO7CLXr3A/1lpn4x52pHHH1z4+oANCmVu ZHN0cmVhbQ0KZW5kb2JqDQoyOCAwIG9iag0KPDwvUGF0dGVyblR5cGUgMi9TaGFkaW5nPDwvQ29s b3JTcGFjZS9EZXZpY2VSR0IvU2hhZGluZ1R5cGUgMi9Db29yZHNbIDM2MCA1Ny43MiAzNjAgMjM1 LjhdIC9FeHRlbmRbIHRydWUgdHJ1ZV0gL0Z1bmN0aW9uIDI3IDAgUj4+Pj4NCmVuZG9iag0KMjkg MCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDkwOS9IZWlnaHQgMTMz L0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxz ZS9TTWFzayAzMCAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAzNzQ+Pg0Kc3RyZWFtDQp4 nO3BAQ0AAADCoPdPbQ8HFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcGiQ4AAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjMwIDAg b2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCA5MDkvSGVpZ2h0IDEzMy9D b2xvclNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBvbmVudCA4L0lu dGVycG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTgxOT4+DQpzdHJlYW0N Cnic7d2JUtpcHIbxnkgQBVSqQt2tC+JaxbrvS60VRREk6f3fyMdJ0H5Tl7IkITl5fpfAzDsD5Jn8 P30CEF4C8LdOT8QrQovoUcC/9EhXOOaoRWLJgdRnwK9SA8keXQvBHDU9MTQxO58FfGt2Mp2Mqr/G 2hYz8/m9wyPAt/Y3c6N9Ua3TY3GZ0OOZhZ3Lwl3xHvCnYrHwY39pNKn4GkWkN53duXqoVAH/qpSu DxZHErrKa6xtcXhu+8dD1TR/A35lmtXS9V4uE9fV/dkounqGZrcu75+YIvyttsafO9l0b0TVNYqu 2OeZzQu2CP8zqw8/tueGVV2j0GKp6Y3zYoUtwv/Mp/vLrdmhHiWf/gute2By/fSuYnT6YwYaUFvj xebM55iCa6xtsX9i7eS2zBYRDGaleJ6fTqm3RqFF+8ZXjwpsEYFhVO7O1qcGulVLcbRocnT58ObR 4AcjAsOo3J6sTfQrtkZNT4wsHfxiiwgUo1w4Xh3vUypTFXoik9u7LrFFBIpplG8Ol5UK40Qkns7u /ixV2SKCxTQefx0sKRTGyQhu3orgOv3RAk0yDSuMSygSxhHBIcBkGLebTceVSHGI4BBoZvXhante iTCutsXUdJ4IDoFVW6MaYZyM4KbWz4jgEFx2GDcY9BTnOYJjiwgwJcI4O4I7JoJDsJkKhHH1CK7M w34Em1G5PQ12GKfpSSI4KCHoYZzQE19y+0RwUIAdxo0FNYwjgoNC6mFcMpBhnB3BXRHBQQ0yjNvP fQliGFeP4NgiVBHYME50xQaJ4KCUgIZxRHBQUCDDuJcIji1CJQEM4+wI7pQIDqoxnwIWxhHBQVky jNsIUBinRZNjRHBQkwzjvgUmjCOCg8rsMK4/EGEcERyUJsO4o5WxIBw2lhHcAhEc1BWYMM6K4HaI 4KCw2hqDEMbJCG5ui7cyQmlWGLfg8zCOCA6hIMO4HX+Hcc8RHFuE4uRh4605H4dxVgS3QQSHEPB5 GGdFcN+I4BAKdhjn08PGQov2E8EhNOwwLuXLFEeL9o2tHBHBISysMG7Sj5kqERzCxq9hXD2CY4sI D5+GcURwCCFfhnFEcAglH4ZxRHAIKRnG7S1k/BPGWRHcd04TI4Rqa/RTGCdPExPBIaR8FcYJrTtF BIfQMp/uL7/7I4yTQeokERzCyzdhHBEcQs8vYRwRHOCPMI4IDvBHGEcEB/z2RRgnIvHMwh4RHELP NB5vDjsZxolIbzq7c8UWAZmpdjCMI4IDXpjV0nXHwrjaFonggGdWGJdNdyKMkxHc1/wFERxg61gY RwQH/KUexnm9RiI44BXzqXiR/+pxGEcEB7yhHsbFvHz4TwQHvMX7MM6K4A5vCG+Avxjl2+O1Ce/C ODuCI0gFXjGNcsHDMM6O4K4Jb4DXrDBu2aMwjggO+IAVxi16EsaJrp7huW0iOOAdz2Gc62uUEdws ERzwPo/COCuC2ySCAz4gw7jtuWF3UxyhxYjggH+xwrhZV8M4IjigITKM23QzjJMR3MTa8S0RHPAP bodxdgRXIIID/sndME5GcMtEcEBDjPLtiVthnIzgFonggMa4GMYJnQgOaIIdxo06H8YRwQFNegnj nF0jERzQNFfCOCI4oAXysLHDYRwRHNCSehjn3BplBDe9cU4EBzTLDuMce39jPYK7I4IDmuZoGGdH cCdEcEArzMrd+ca0M2EcERzQDqNy51AYp+nJUSI4oHX1MK7tNWpEcEB7rDBudbzdMI4IDmjbcxjX 1hrtCI7TxEBbZBh3sDjSThhX2yIRHNA+0yhd7+XaCOPkaWIiOMABbYZxRHCAY9oK44jgAAfJMG6r tTDOiuDWieAAh9TWeLE500IYV9siERzgJLNSbCmM06J946tHnCYGnCPDuPWmwzgtSgQHOK2VME7T EyOLB0RwgLNewriG1ygjuNzedYktAo5qOowjggNcYoVxSw2HcURwgGvqYVxjh42tCG6LCA5whQzj drPpeAMpjozgZjYv2CLgDiuMm28gjKttMTWdPy8SwQEuaTCMkxHc1PoZERzgnobCuOcIji0CLpJh XH469dEahRXBHRPBAe4yKndn61MfhXH1CI63MgIuMyofh3EyglsiggM8YJQLx++HcUJPEMEB3jCN 8s3h8tjbYZyIxNPZXSI4wBP1MO6tw8YygpsnggO8IsO4/dyX12EcERzgsXfCONEVGySCAzxlVh+u XoVxRHBAB9TW+HcY9xLBsUXAS3YYN/gnxflzDpUxAl4y5SnV/P/eGCesE4y/Sk8GAG9VHwsyxak/ bpR/pM59P7+5fygB8NbDfeFyZyHda39RFZF4Jrt5eHoOwHtnR1u5kaT9tFF09Q5Ozi+trKwC8NrK ynJ2arh+LE5o0fjAUDoDoBPSw6lEd/3/VKHp0RiATunW/zzbEBqAzhGtXjQG4Ib/AH8ZTmcNCmVu ZHN0cmVhbQ0KZW5kb2JqDQozMSAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2Uv V2lkdGggMjI2L0hlaWdodCA5OC9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50 IDgvSW50ZXJwb2xhdGUgZmFsc2UvU01hc2sgMzIgMCBSL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5n dGggODc+Pg0Kc3RyZWFtDQp4nO3BMQEAAADCoPVPbQ0PoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4MQObAAENCmVuZHN0cmVh bQ0KZW5kb2JqDQozMiAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGgg MjI2L0hlaWdodCA5OC9Db2xvclNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1Bl ckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGgg MjkwMT4+DQpzdHJlYW0NCnic7VlXe6PIEjUiI0CRoJwlFDGIIIIQIMlxZv7/z7nVSJ7xrmfurld3 vzsPnKd20yr6UN11qsp3dzly5MiRI0eOHDly5MiRI0eOHDly5MiRI8f/FhiG/b+38K8CK+A4Xvg9 Of7p22P/yBcYTnM8S/6OFLECQRA/NgauIIjP+wIrMGW1KfHk78cQvj0v8DT+trMCyQoC+OKzZgih NVuNJeazP/z3UaDLjU6jTF93hpG81G5Lxc/6AqMqI8vX20X8d3MiRvBNbaM1eeKyswJdHa7Xwyr9 SV8U6NrMj62e8PsxJMtDK7SG5avTCqy69Lylyn6aYV0LU6f/GzKkKhMv9SYV6rIznGveHw56k8M/ ZwYYzsPj78mwOvWP/rT6nWHLSBKjdWUIwlEAvJOPTEuy6evkZQnOSG8M36vNT8d/w+jdhyU3MQxO wc8ZgnKQFM0wNPUmJxiGE6DrOEnTdKZ92GVM05y8yBgSMEFe1ea98qBxNv/OKP5GGZ7h2TRNZmcg s/r+vf8OQxBKuliq1iWpXhGuWg5awvMsy5VqUlUAicFwCo2lWrnSXO6BoUhRnChy1IU9xX1XnkyF YL4AmYF4MSpejWIEU+Q5Fk3XRAaMwov5ci17L3NzDvFrhliBLFab/clM02bjrizQ6PsTXK3RVCS1 P9XGzRKFE2y5MZhq2mTQHd0fEEOGlzodWUCBC6MEBcZZFnBVIR4+QKXRG8/myKgiIh3GcLaaGe1N tEm7wuA4xddaQ7A6G3UkgbqR4pXhrEZnF6hA8G0zvTAkivJwZdqO67qOobVK8KoCVektVtp0abq7 7URiKbbWX1me5znm5t47nt1+ia30VvpE5pB/OWVq3MMycGKBqY/Wy16FLdb7C+Ni1Jx3QIcxjCp1 5mB0YbiepTV4ihbV8XrrOK5j6dNmib6N4oVhOJd5mkJgyj0rTRHDAl3pb+yda9uOv492iwZIZoGR NTf0XC/cB7am8Fx1YARxFPqe74fH50dgyNUmTmD2SySGkaW+lcRmT4QxIXR03x7X+Up3ZQM72/H2 kbduwzMIw1MbjO6CfegsWyIrNjX4avBi1/ftRUu8LRPMGD7E9325VkWoN2feOTURQ6Y+XN+v55Px bO3GiTuBLADUcn14PCf7nbmZ92p8uaPvk729Wa5NL3n++rzri2xl5Ca+VofFIJH7l+cQzkehQFUn 7sEZVflqf3m/WUwn05V9SD0N0jz4bIv9GYx6lr4YyoKoak7gGfPxWDO8vasp3E0KhBiGTw+Brk0n CLOlnTyfMoZUudnvt2Rg3V54abRWWRxnG3r6+pzY835LqQq8rPlpZIxbanO4Dh4zhrTY3SaHDQgq zjX047ev6Sb7obIM421XZEtqr99WatV6a+amsdHm4VPKq/jlJXWXw7ZaE/nacBv6m4FSrSoDPdhv B+WbnJgxfPnyEPm7DF6YPn85m210D1mxUuJZmmbLXSNOth0+Y3h8ffS0RqnIMozYgXl7JPEsX+1s Di9PwJDi1HWUWHA0SaFrnb99e7C6AknwHeOwX6scxYjlsoCMltobCE0DkcQZZZW8PgWLVoUHo3xj FUTbUZ2HoTR24mAu35TOZwxfvz6n0f6C+Pz69cIQlICmSAAjtjZZnCQyHz7Fm5ZAgX5Bsu2m+6Va JHGCqQzs04PbF0iUoKaQQjB0Zbw7v7w+eOMKTZdHTuxNIZ6B0FHIKs0rIKDeuJwxjJ9So1OikVER Lm+kdys8x/G1wTaO71ufTLB+5sPnZLc17hEMO3x4PSGGqLAiKIbjhbLcN5LTblgigeEmOXnjKgqB 6J4F6W5cgSALcbOxiU+IISn27WS/UoucPPfT4+kULmSOk7QgtrKYU7gYLdU76+jkQ7qIGB7OwazO ID2CLNI/x+a4pciy2pk56dHq8rdcxCzSPB7tWa/dQugMN/vHI7qHsBeSLdXVdncw3fjnR290YRin cOxQJVKAnUWp3bv+AeEiy2kgs9UPsdktgefDvQehVm+LMN7vN41MZRmxpra6/fHSPT4G0wvDCM5r CV03lN9Gzw+BsVrM54v1dn8+3liwZAzP0apZhlPBcUWhPnKO6UXxKUHuTZcb3bD848uzf2V4SEyo Au9QGYL+QNcT/UFL8wtDGIFr3bFUH2xDVzeCgz2s1wbWwZ+hAEvy9c5kudaN7S5+fg4h1cgYpojH XfalVvHrSxqAoIBq+od0r7dv9+EJHRHINwGU0DGvekiJzRlos21t7T8wjK9ZawGcFX+n+722KJCl oZOEy3Zz5vjGVLMjT2s2Zt7BBi8BQWWsZ0atPzBM0Fm8uxyM5OUpckwDwbS2m1H95khzydoyKxhe bJuXrI0oqnMn9MzVbDp7f0rfMWzocfpnH+IYzreNGG7ScO3tFt3eJgz14RAOrN4qQjCWJlbgb9fa dLrKTukHhvLy8JhsZ4NeF9DrdZu1TzccfsHwj3lpkaAqQ/sQgthJdaVvxOePDJH8pzaE2Ms9XEYX huhKhqm3WlqBPVbUmRc5y4V98OcSg5Ni14ii7bQt16X2an/6yBCdBQhOzYooZOA5hrip9/NLhiTa Z7KbygLLCo1VdPrIkJYguHiTKoqlJN/SExRLIUJRlbGbHhzLD41upQo3MLStMHaGZapAV6deGiwa IssUJShMPzDMKvJjoMkcRVyB31Yl/pohp27AQ8MKQ9JCa/MTHyIm3jFaNXgSJ7n6xD0/XhjifMdM TnEUBytVEFp6lEZReoD0BUUhJIKTGkNSRRmc9ZEhIfZADzctkUJ1KNSM5I014q8ZojN4dCd1nhPl sXP6eA8hm+6aSepMZJEX5aERo5wGBfYCC1t+en48QfRkWaj9H54eH/ZLSE3QbQ2PviYLHF/vm+nH ewgbaKz3iTtTSxzDsEWhJH6+tfmB4c+6GHBKpXlw3OuDhtqeGNHTd4bRG0NgIsOSgwVa2pvq/un1 KfMhsjnxn799OYPGUZDN7B6/fn30sswAnnjHgzFqKK3RJny4MpSX+zfVuSugtuQhsue9hiwrzW6v VWVvzLwht0pQYvK9E6VHkd7kCKrc3x4S31iC7nrx+eRmOY26gqB47VNhEDf0fXrYmSCZrh+fj3YP SRdyrnX++uWIDiZkpObxy5eT2YHMABVR91ESmKvFynCj0wnxBoaLIDLbF4aoqtScKNrBmjno5mba eOt0/kOGUMSZflbP3V38oixcd6FAOcDJUyvc+64D6uX4vg5bxBlpZjvw9HJuCkx1cO8fUH3omLrp +ZtW1hFGRoLT0ZtltZGk+acTnEwmK4RrIzPYBztk1PZ8A16M07WJ5a4ab80vUmhoWz8MPKiSd645 VYu3McSL6mQ5Ud961VD39ubzXiXLPpTR2rQsU19Mxtp8JLOooupoGnp6/TFb7ULFblvGctTtz+bD izijqn1hmnNUvIKj23PTXLSzQhYjOGmwBKPb++V0PJuPlSJRIMXWbD6ovTWhIZdShov7rQWrzPW0 Xf5sd/pPAHuSirohV8YEV1GUCpulpVy10RuOBl21XpWUOg/3CGfL8JR7+6gYzpTkdn807KrVUllS ruKMppV2WyldEvTv48w+W1a7Q/hFA4zKddSGQUaU6g+j8OKy0u4PR6NhryWVmBtbsCgV5t51tDCC ZlmauGyU5oRSuSRwNM2w2RqYenv69muWF7MlJJWtuTKn2GKRpdDe3o+vj8BoWeSYH0YpZPSHp9AE WK1UymKRIW/uMWe91/fd2awVex3iBJRyBF743p599/Tt12gN6opi756gafxq9f347tJy/QujV6tQ RxL4/6Qr/N+A/fX/S7G/sebzv8Cwz9vNkSNHjhw5cuTIkSNHjhw5cuTIkSNHjhw5cuTIkSNHjhw5 cuT41/EfjSLEjA0KZW5kc3RyZWFtDQplbmRvYmoNCjMzIDAgb2JqDQo8PC9GdW5jdGlvblR5cGUg MC9TaXplWyA1MTJdIC9EZWNvZGVbIDAgMSAwIDEgMCAxXSAvUmFuZ2VbIDAgMSAwIDEgMCAxXSAv Qml0c1BlclNhbXBsZSA4L0RvbWFpblsgMCAxXSAvRW5jb2RlWyAwIDUxMV0gL09yZGVyIDEvRmls dGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA2MjY+Pg0Kc3RyZWFtDQp4nHXUeVuMURgG8M9FEpKEhLIV EonIliJSUSSRbH0WhKQkQxlRaaZZm715Z0pIdvfzPGfOrK7r9+cs73vOfd890b89mdzXItqfjO5p RpK75HdcWLmT5Bfcnk3VDSH4Cbe0IOkiP8TNQNwN/3fRKXywdF14lzqUb9fAQ9phZhGuCvfiFfdX aAMXaXV9aXWSy+yS4zO0gJ002xeabQtN7OL0J2gEK8xfsM6ft5AGy1zD1Nw5dvZjFOphMlo3Gamb iJxhtRNG7bhxetw49QHCcPJ9+ASZPT5GauBd6BiYQ0fNoWpzsPpt8Ag7PBqAqtHAoRE/VI74D74h B177oAJMvv0mL5SbvPtekb3DHtgz7CmDlzOlbPcQ2TXk3vlC2THo3j7oghIYcBUT57YB59bnypZ+ BxT1Ozazwmdg38Q29pENrKDPVvCUrGf58MS2jkxDHjwma1kusa7pVVYnWNVrzYFHwrIyWTY8tKxI lqVMLYcHqZalSf8MvphF6HdSfhx/l532GDmEn5AfOPH59UvhBXNj7yvvnsdHwehw8mNnJeeGA5ST lFOVEy4k6uSL+CJAXw2uqZjQxZXwJQIuVF8uLlpuXG4fMSjjSEg2JCflHBtAhCo4TiDpquSwQRXH DySNiCXCiYgiqIgrQlszpjKMMCPSCLYkHFFH4BF7hF9agDqgFKhGPdcEpDWoD0okbUKtGgkVTRon 7UMNUUZpZQuXFKSz0l8UWRrdxgUHlF1aLwvQ7lGbgHHoILQVGA1Zj06iVkWPTOLy6DnqCqqN0pPV rdCgpa+crF/iHuqRTFpOI3Va9eT+b5Pjox2b8YwjD/8A6xVZ4w0KZW5kc3RyZWFtDQplbmRvYmoN CjM0IDAgb2JqDQo8PC9QYXR0ZXJuVHlwZSAyL1NoYWRpbmc8PC9Db2xvclNwYWNlL0RldmljZVJH Qi9TaGFkaW5nVHlwZSAyL0Nvb3Jkc1sgMzYwIC0zMS41NiAzNjAgMTQ2Ljc2XSAvRXh0ZW5kWyB0 cnVlIHRydWVdIC9GdW5jdGlvbiAzMyAwIFI+Pj4+DQplbmRvYmoNCjM1IDAgb2JqDQo8PC9UeXBl L1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0V4dEdTdGF0ZTw8L0dTNSA1IDAgUi9HUzgg OCAwIFI+Pi9Gb250PDwvRjIgMzcgMCBSL0YxIDYgMCBSPj4vWE9iamVjdDw8L0ltYWdlNDIgNDIg MCBSL0ltYWdlNDYgNDYgMCBSL0ltYWdlNDggNDggMCBSL0ltYWdlNTAgNTAgMCBSL0ltYWdlNTIg NTIgMCBSL0ltYWdlNTQgNTQgMCBSL0ltYWdlNTYgNTYgMCBSL0ltYWdlNTggNTggMCBSL0ltYWdl NjAgNjAgMCBSL0ltYWdlNjIgNjIgMCBSL0ltYWdlNjQgNjQgMCBSL0ltYWdlNjYgNjYgMCBSL0lt YWdlNjggNjggMCBSL0ltYWdlNzAgNzAgMCBSL0ltYWdlNzIgNzIgMCBSL0ltYWdlNzQgNzQgMCBS L0ltYWdlNzYgNzYgMCBSL0ltYWdlNzggNzggMCBSL0ltYWdlODAgODAgMCBSL0ltYWdlODIgODIg MCBSL0ltYWdlODQgODQgMCBSPj4vUGF0dGVybjw8L1A0NSA0NSAwIFI+Pi9Qcm9jU2V0Wy9QREYv VGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA3MjAgNTQwXSAvQ29u dGVudHMgMzYgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VS R0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyAyPj4NCmVuZG9iag0KMzYgMCBvYmoNCjw8L0ZpbHRl ci9GbGF0ZURlY29kZS9MZW5ndGggMjc4OD4+DQpzdHJlYW0NCnicxVpLbxzHEb4T4H/o464Bjrqq 34BAwBJlQwEUOBFhH4IcGGpFMVkuHZKy4X+fr6pnZmd2lrt8yTlIZPX0o15fVXU1zaufzOvXrz68 fX9i7PGxeXPy1vz38MAa21hridkmk9ia4K25WRwe/PKdWR0evPrxYzAXt4cHZC76yTaSdWE0+/N3 hwd/Ozww7z68NWZwEg1O0qVkExdjtxz15hTH/cDGlaZEc/pZzsSBhgxZatgZn11TyJxeCSMXyltW 3qz58fDgH6/Blz8u9NpSOrFE3+MsPiYP+m06PuLyGky/OY4yoQgrzlrvLb0JluIPGMOCcHL8T3P6 l8ODd6fb5eHHykNb5HEUGxsn8lQxZkfz3Sy4F2GBczPVaMvBb3Oi2WL16Xp+xLMbMz/ys3ereZrd 6fjNrzeXtwuzh0v/NC6zH7HJmRtm413YxudfF8LU7/Myu775z5zs7HYPU2HNlIvQATfZXOnvlG2D s5c42pfGT+g6dzlYh9+/dLIx+ZBVKuzWCbisv1Z4ZUckI8P5939pl3/pNERsG5+rTsCOFX4azoZS aGI25zj11furs4uFZ3NybSA6JHz109nd3eJmZc5voQMfzO35aigrkRNBPYlvDDBsm8Tmd/kp9mp8 8fg/OWf+DqXDJv82uzb5uEXt8fG+QHnkB6FAzmzYhwaBZ9MP3q0+/To/crPry7mfreYBjrrbD9Ka ISqpwc6eqCEW87UDDkdFNXjKovtNul2w3NyhdYudzqCxdrkRe5fdqpHhcxIDW9VVE0oxVHxD8EEP y/ih5ePa8t9IpoHpdkjH3pNfO3Rr6nu/TCROroleJY6hSRExwDr1ePgYj3w9txJb8Mg4gnNUfzU3 Fxsii7NG2S9w7+m7Z2xz4/xsN2ZKDQfjEHahCXFjTatU3fj7W4m3t4s7eLGZx9mHsxXEvFqs6sBu ly7PZy6kpoC5SE2YMvfxevn17hJcXa/2cEKD6gLhrGHDKYq3tARpLBOvgyvnKZ3UJdcrH4KoPohO 6P2Iahlgi9jCA/8Kdo2ol5Pj6LEZ4+j+lDHZayRosZ2gPZByU8CLjRJBBoJyD6RocxvsbeNaJI3E 3YqknTO2IYkeXRaKtzaIIBse65sIA3o4bpl47NtrqVk+X158vZkzz87gu60D78MSPaHK2wQTA+IO P2Lj0oS1MbJbaIUHQGtQ+3kw5HKWLHDVUl1dEi3S5YSsc5ejlSOfdAxwPMYn64Idn3aDL0llx0Gi ukNgjMN0hgjUg+/lJY3eJfcYSeuCHZ/2o8/DI1AwOdJUO5A09uhLQXFHUnA5y4q+tbg9sKCoHnr3 f96KuydU5RuO7ZGfHZIEOIwTv/55zmn2dblaAHF2dvavyyX8+3LuZnd/7MVceD5rTkKEcfiRprw9 GXNxjDkuWSzbeiI7LU5635vQdfZytPaRqOvKwy2o2/rpwahj1groftS9tKz/R9wxLrxplN7X5WOw Uj66Iv9H3C863LUC3gu8e75vRV56kYznc2yilBNgOm+p0T7jNkxpdnYzpzjbe0en51e0LebYZ6kd Xwxzg2pWUigsQ9E1oZZfdQDuVZ3P2yS1xibdLlhu7vDNy0n4G7hBSM40cLc4rCa/jUgPu59tNBwG 97OtXyYCB63shmUlLmZIsMU1icpQ4nVZWaIcEbIUl5wqwEYyby8rd83YBjK2L3AJglCos3DOxJtP vwBWfrY4gzPfmZNF7YiF2eL8gXUlv1DZC58D5qT1Mq16ATKw90Cc8aDQ9b4GM9ixDfntAHdeGFmv 5tOBumS5ucco9D/cL4/ud8zJXnvSnCtypSOpj4ZpLg7T3LcV+0+452U3SnfgBdUPgcdRuovrMpO1 oxeBQ5ScmKvpbiT19oy3c8pWPD6hVb2ZX4LmFxLgTxH5ZiG96S9n0pf+7fL6Bj6vjZPrlXQC7+Z5 dn0j0FxdSHtwLzyfXx0Hq50dgqq2pMOH91B4UA231rfFxThspE2Zih5KKhUBpC7qkrbOUJ7RyBnW tY8jicxWdk6e+taZxZ0sIacnbR8Gq4U1+6Y4bQ8Gkrzj4GQ4T/uFKPYISwBB17qnTIL/Oof0QLqN dNLrbS2126D+lH1h3FQHcqMNdvhyMEJFaXVHRTEoXR2bHM15nSxXRxSxrhjZKykB4YSgSoU61da1 Qd6RWgFSUYlse7ITFQmz1nUDXAeCbMhyqnMss4RySmDGebtb0AHnjFDtyhLNWAvnqpnP2yweJxZn W/NmHwqmFucSxFRiceEXymxN3n5Ymzx19YcHfjNE91EQdVW5B9uObK8LErM625cfDP+BfB7+tbZu lKzvtPUzMC4WpdIZV+ggDZDWtqJhDFBUa6ZKeSWKV6K0Cq0HWj1DP0OFViVTHylKcei0L7YhW4/h xlbm8bnjAwPEna8KI04HitPtxFpIpvBB9cikUtmWkyQyy4AXrqPqDlTwZqSCHZadlP6WfHT7DOvF e8Sw8FGfQ29YIBt2GxiWe8MWLcVxReDOrtLXVHo5oPUBYTlY0A18qfJCfZyLAHltV84wW+70qTPs AMVQnQz4ClpWAvFAMStHAgMdZFNUWkGV5dYoT3x1KtUHP186s0o5nfWtdDkY8I3r7Virodx7mOyX xXf6o/AjrxkpDa+Dh9IaaFoJivjZWAU77JqnMZqcpd2GbWOxxmiPA0pnWCmsR+8bqatSvNf+DjCR e8CiJJTHhNgDNspAaQckVUvSJFmxxivgzfBzHkZjWdTpF4qUziUJGLtoLDdnFrwoClk/y7ufIFQJ Rx1i5UbMtqq7/tpG7aSEpT5WJmU+dXglVjZ87074TXrKyfd8BR1wLUKLypG4Wo6Uch1cSTShFZ/I HCpR0bpWwA6zlolZCf/8brMWEuWIVcWdISo5DXDEEuAGRu3KMO0MYxow2CVZdW9534uhy0CSTkps kSftGk3qQE9vVSfLCV7ucreLFCBY1GmviFVJ8kENf9K6S3qOHBcVxkIJeKM0QLSQrRgELfdO0K7a XDlE4Kz+6Otc2wKWxdS6FXUC6G6h5wUBHsyWPsdGSVLCfVD/l9+TXmwFDFEpLNXNvfKJgSBx2CvG BfrC11AJ91vW2SlgM7k9KTbLw2INxFBhSn0gdpLfBpbtaipxVCvXYu6QVhMsowgJvscraO5u85JB 5HXbt+VJl1+xCGnaD+EqyY77vFYvrOwGeU0G2qQJ/9PPXYLV95LcJ9ioA20yLrKVq8rVBCuU84ME K/xHGuRYEcD1oSNm7QJZGvLiNURpsCWlrKsIjipZyH2OZR2gilN96te4P1LDDtMObtbstOEvONTe SiUpdpc10j+g2KR1+nK8+pu3ipzXGAE887BXlIe9oheW5k98f/TCybBR5NqLdOPCsFGU140ieXO8 2JBye29o14xtd1H3pDe9ae8FPiyySs7avN69X51L1+XTYiUvHvpnU9oAxYVPeqB1cM/fdj3/xix9 d72boY6avoI8/Arq/JbyJqa0O1pKr4Vq3ap3JhhH6gBUyWn8up79riuoBFcUZh6BJ9Uy1GmaIVww 279QEeyAzu31gqXXk4yXaxx1MRSLJPdJt7zUXbjBJZpSkdAmu3grtQWl2KUkHCnZMQUJs0JFVgox Vigv2+HkWsvIn6QoDRvIVrK101sFCMls8qnGULASSA/KHftSayZ9gdEBnOiU11qzyUBRmkttSGJ6 LFpeyeJQqcoIBqSSjFqyqthZl9qW6pUwDqH/AxKuLuwNCmVuZHN0cmVhbQ0KZW5kb2JqDQozNyAw IG9iag0KPDwvVHlwZS9Gb250L1N1YnR5cGUvVHlwZTAvQmFzZUZvbnQvQUJDREVFK0NhbGlicmkv RW5jb2RpbmcvSWRlbnRpdHktSC9EZXNjZW5kYW50Rm9udHMgMzggMCBSL1RvVW5pY29kZSA1MTAg MCBSPj4NCmVuZG9iag0KMzggMCBvYmoNClsgMzkgMCBSXSANCmVuZG9iag0KMzkgMCBvYmoNCjw8 L0Jhc2VGb250L0FCQ0RFRStDYWxpYnJpL1N1YnR5cGUvQ0lERm9udFR5cGUyL1R5cGUvRm9udC9D SURUb0dJRE1hcC9JZGVudGl0eS9EVyAxMDAwL0NJRFN5c3RlbUluZm8gNDAgMCBSL0ZvbnREZXNj cmlwdG9yIDQxIDAgUi9XIDUxMiAwIFI+Pg0KZW5kb2JqDQo0MCAwIG9iag0KPDwvT3JkZXJpbmco SWRlbnRpdHkpIC9SZWdpc3RyeShBZG9iZSkgL1N1cHBsZW1lbnQgMD4+DQplbmRvYmoNCjQxIDAg b2JqDQo8PC9UeXBlL0ZvbnREZXNjcmlwdG9yL0ZvbnROYW1lL0FCQ0RFRStDYWxpYnJpL0ZsYWdz IDMyL0l0YWxpY0FuZ2xlIDAvQXNjZW50IDc1MC9EZXNjZW50IC0yNTAvQ2FwSGVpZ2h0IDc1MC9B dmdXaWR0aCA1MjEvTWF4V2lkdGggMTc0My9Gb250V2VpZ2h0IDQwMC9YSGVpZ2h0IDI1MC9TdGVt ViA1Mi9Gb250QkJveFsgLTUwMyAtMjUwIDEyNDAgNzUwXSAvRm9udEZpbGUyIDUxMSAwIFI+Pg0K ZW5kb2JqDQo0MiAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMTY4 L0hlaWdodCAyMDgvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVy cG9sYXRlIGZhbHNlL1NNYXNrIDQzIDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDEyND4+ DQpzdHJlYW0NCnic7cExAQAAAMKg9U9tCU+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAADgb5mPAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQo0MyAwIG9iag0KPDwvVHlw ZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMTY4L0hlaWdodCAyMDgvQ29sb3JTcGFjZS9E ZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBm YWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDQ4MT4+DQpzdHJlYW0NCnic7d3bThMBGEXh zgwzU0ScFhsMahCltYRDvEESS1WiRhOgyKkjvv+L2KFE4/26+Jus7wlW9gvsVmuBJKH9rUyzvAgr X0rnpUlWrlTdsKrHZXYfmpbVxlZ/EFT/9fNOu1k0yVY2dg5H46BG73dfrOZNZ15tHX49PZ/EdPbt aLtb3Hd2+6PT62kd0vTmfDx8WqazzqI7GE+md0HVF592ev8667vfMdU/P9sJspNlJ8tOlp0sO1l2 suxk2cmyk2Uny06WnSw7WXay7GTZybKTZSfLTpadLDtZdrLsZNnJspNlJ8tOlp0sO1l2suxk2cmy k2Uny06WnSw7WXay7GTZybKTZSfLTpadLDtZdrLsZNnJspNlJ8tOlp0sO1l2suxk2cmyk2Uny06W nSw7WXay7GTZybKTZSfLTpadLDtZdrLsZNnJspNlJ8tOlp0sO1l2suxk2cmyk2Uny06WnSw7WXay 7GTZybKTZSfLTpadLDtZC9o5Ddr53696//jspv4V0+3k43DemXfeHH2fXF6FdHnx48NgrUhmnUur Lw9GJ1+COjl+t/kkbzqz9trm2739g5D294avesvZrHM26HLVW38W1Hqv86iZswnNirIdVllk6byz lSRpYMlD5WL4A94tx8UNCmVuZHN0cmVhbQ0KZW5kb2JqDQo0NCAwIG9iag0KPDwvRnVuY3Rpb25U eXBlIDAvU2l6ZVsgNTEyXSAvRGVjb2RlWyAwIDEgMCAxIDAgMV0gL1JhbmdlWyAwIDEgMCAxIDAg MV0gL0JpdHNQZXJTYW1wbGUgOC9Eb21haW5bIDAgMV0gL0VuY29kZVsgMCA1MTFdIC9PcmRlciAx L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNjczPj4NCnN0cmVhbQ0KeJyF1PlbjGEUxvE/TUgk ZIks2SJ7hCh7yzTtMzXVtIyUCmUnlKXwByBSk5jSMhUlSyGyfZ/nvPM2dV3luj4/zvK+59z3cT3+ 65pGySPxZ2bF4qHpN4r8NZp+FfprMDiVceXBeMEU93/mT5Z374dwiLsYyzXVj+XUf1fqFLvyzXbH 9DX7tiHrFkYzRe1oRu2IcnMkXfmSdsOQev0zrLj2KUVc/WjRkq9gOAmXhxNx6UOCdurikFIzdLJm 8ASqB49Xv8exC3h39Lxy5NwA4lE1EFfVH1fZf7iy7xAq+mIrvLFnvQdR7j1Q3ov9Zb0xZT0xZ3r2 obR7b2l3NE537YGra7frLXaVoHNncecOFHVs17YVdkQVeqKcnq1Oz5aCN4hE/uvN2qY8tG90tG/Q 1ue+QgRy2tZpa+1ta+xuxeZebXOH21rDs1tXaSuzWhCGzJYVysvlGcoykd68VAtFWvMS5cXiVGWR FmLFcyzUglNE0wJhaZrvE2R5FpSszPMTiCTxdK42x5SozJ7kCQKQoMyakXwmQH9Fm/gd+WXzj+R/ AxX9JJOfUJ6ZhzdfhJeStwtW1PvKu4cYjMnIlBgXQ2N0ob5JMlKZrcyZgTN2hh+mFwHZCwtiTSyL lcnuWKJsk7VG6BVDNs7qCQAxkDwQjEgdEhAYYkN4iJBkiVARLQJGzAibpI74EUKiGK1jSTiJKEEl roRW0kuMCTORJtjEm5ATdQJP7Al/vC4CpBcUhJpIXygO9aFEVEk6Jf2iaNSN0lG9ZMXoI8WUhlJV q64tzCJTaqpNwaXpVF66n6VMnAVOhHkuOB32OuOSyFXhvJinxqEYV8g8SlOOFedrykHjxBm3rmHi APpfxSLFdzD9rmixwXdm9dX973GWGz7dhcc/2wH4iA0KZW5kc3RyZWFtDQplbmRvYmoNCjQ1IDAg b2JqDQo8PC9QYXR0ZXJuVHlwZSAyL1NoYWRpbmc8PC9Db2xvclNwYWNlL0RldmljZVJHQi9TaGFk aW5nVHlwZSAyL0Nvb3Jkc1sgOTIuNyAzOC44OCA5Mi43IDMyMi44XSAvRXh0ZW5kWyB0cnVlIHRy dWVdIC9GdW5jdGlvbiA0NCAwIFI+Pj4+DQplbmRvYmoNCjQ2IDAgb2JqDQo8PC9UeXBlL1hPYmpl Y3QvU3VidHlwZS9JbWFnZS9XaWR0aCAyNjEvSGVpZ2h0IDEwMS9Db2xvclNwYWNlL0RldmljZVJH Qi9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvU01hc2sgNDcgMCBSL0ZpbHRl ci9GbGF0ZURlY29kZS9MZW5ndGggMTAwPj4NCnN0cmVhbQ0KeJztwTEBAAAAwqD1T20ND6AAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAA4MIANPoAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjQ3IDAgb2JqDQo8PC9U eXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAyNjEvSGVpZ2h0IDEwMS9Db2xvclNwYWNl L0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRl IGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNDE2Pj4NCnN0cmVhbQ0KeJzt3WtOEwEY heHOdKZTTGEoNCWoQcDWalrinwKhgBI1xgAtXujI2f9GkFMuMSzhe98lPAs4p1ajRUncHgnSLG/E LM/SBUNSL1plO2Zlq1m3QlqUm9u9fsR6Oy/bVkiy1uaH8eQkYpP94avl/A4hL7fHX8+nEbv4dvi2 3TDCam9y/nteBezP5elgvUj/ITTa/ZPp/CZi1ezT+84TQnWjgFVXn0EAQSA4EASCA0EgOBAEggNB IDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0Eg OBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4 EASCA0EgOBAEggNBzxDmERH+22jtHV9cV38Ddj09HSwQ8nL34Pvs56+AzX4c9de825wtv96bnH2J 2Nnxx60VL3jXm2tb74ajvXiNhoM3nSUv2ifZUtnpdjcC1u2svsgfvg3yohmzolG/P3ioJUkataer j/DdAsxoUtkNCmVuZHN0cmVhbQ0KZW5kb2JqDQo0OCAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1 YnR5cGUvSW1hZ2UvV2lkdGggMjQyL0hlaWdodCA5Mi9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRz UGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvU01hc2sgNDkgMCBSL0ZpbHRlci9GbGF0 ZURlY29kZS9MZW5ndGggODc+Pg0Kc3RyZWFtDQp4nO3BAQ0AAADCoPdPbQ8HFAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8GwT3 AAENCmVuZHN0cmVhbQ0KZW5kb2JqDQo0OSAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUv SW1hZ2UvV2lkdGggMjQyL0hlaWdodCA5Mi9Db2xvclNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAg MCAwXSAvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURl Y29kZS9MZW5ndGggMzczND4+DQpzdHJlYW0NCnic7VrnduQ4j+0qlXLOVA5UpEIlh+6esO//VgtK ZbfdZ2ePa863PZ6zuj9sqkRCuCIBAoS+fNmwYcOGDRs2bNiwYcOGDRs2bHjBbrff73d/Z+D+7cD3 V58ZO4YTBI75mK47wJuBoiiwK8vdnhVE8aNi/kN4q80doxhBdz1D/Iiuu/2BZV86wkDDQ47K7enV nlMd5OnCr6S8Z35oc88wzoibNjX5/Qf6spKqvJDacXrSDRVSWLjesQqqSBNp7K9jvGNFVRUO9z5w x0ioe3gkobIMBWNkwBp3i3Ezq12+NHe7g+yEyLhR3gtu+/j9WjnCnl441eXbtbL4Pe3NMFTGsur2 i3nf5LzcWB/0o9ubPuuA/cvAL28VeCdxx4hWGJh3r6odq6fzt++X0uR2dNXyoiTyB1CbfWntGGiK Is8yjGBlbR3dlu5eQuNv//V9itQDvAs1Gr//+bV1BebACZK02DcI4TheoMbOUA3pDYm6jN0qXl6u 9nsYAX2gBa+EXQfwLH3o0vfL0pkqsOjyKpHhjaRtYkM8fGB1vgFMDj49PV9bDyx5zymm67mGxLG8 anm+a4gscxA0C340VUHQIvJwaaN1lhkpmL7/+dulhHnd82Z5/v7Hc+eJvKQ7PvJtTTgwvKIbpuP5 jiYwe5Bj+wg5OqjIUPEoCBDcYTnZcDwPfmcZVtQM0/Z8z9S05fkS0GQElSpgqfzhwKuGaS0SRV4J uodrH1viXQt7x8hBO8+n8xCrLHgfP8M4D0xJ1FGOcRYYAieZYVbiMkOm7uLrH79daqSyK+Px+dvz tUPS4SD5zfnp22PryZIZ5FVTl6Eh8KqX5HlZNzgyBVbQUYahDSqu7aYnXeFrkuYlBcZF7Ci8aEUw oGqaMk2olMyR2INoBqAAVUYUND+9SbRUKz///vu1DXXunknecUbak7qdJpgqVnLLrquLyFY18EN9 XYSmJFlJ3TZN21Wxi6qHP/+4NsEL4+Hh4XIZU53j9YQczzD/nqK6KW66YWwCTbYyMg09Gac20gTJ jsu6HcYuMSQtqLqOzNdLH5sGKpu2afsud1Q9bOeJkOl0ngiMm0lmiaIRV4sCdWSoTjnOIHGa2th2 y8sffz500X2M96KLSZ2k3dwimVejbmyzwNFVKyVTAy1N1sNmaIsM90MV+tn89WlILPG2qsnlOB7n ypVkFw/DcDo3nqJYKEpy+godzavP16Eqm2nCjiQZfhRn9XSsfd0pCKnK7nwlse2VpMdZ2U19YtnZ /HBscHt6fjq2uB6PLdL0oCZUATJWyAq6K5UIy7LynWT8+jxmtnTPqqYepxtKFNRHmCoRZmpqYkeD ic3HqY5s2iqmqU7CrD+SxA3a85zfDIcyPg0NmfvIMKOWNM10bDxZVE3bDfB0apHht5dThdy4hfep CIphu6gYLySyg2bqkiAHRqETg+Q8SprjEftucQLL9KL+EV6sF9QzvF6XqpJEqwIRuR4x8pLu2AUm vNATvEr2nkgPPA4QwmHUnC+1q2hhO/UFMhVJj/upy31DVkDrSw+veDgNqePhiUTquucC4/7YFdU4 lgiVpM3LARhLgmJ6KGlOVxJZqDmSWFeccupDVZANF8XV8XFK3LA79mmYk6lCXn58mOus6E6nGnnl fCxt1S7P58pRzWwccy+gCpSrAvAuTn0EEvEE79kupjHR7iIMWvvg7wiuxqfnMdIUO+sGMFgbrLHo hw5HthkOT09zCwY4NaHplmMXSMwPxg01iL4sO4KjtJ/pqrajrKyHh6cxtvx6anxZMPKRgHDqgCpy fZ5TN+wvsGqbgWSuh69fL7BAwOILz104CHo2zZkuqPEwFn5Mnh5XBdrIjdqpdqVVomFl8Fe5az/e sVp6/Pp0Gsbzt98uhSkpTlKTsU1MRfOyZhjaxE/Gp4exLsFbx5ZmF8BY/sF4rgOEp+M4wiL1om5u fN1KmrauyXVlPNauyOugWWxaMXjAur88AWPY5R6P40AwMhx8eT53mDpj37ApE4VXk3FMVV6JyFig eHh8UcAxg3bEjrBKNGANDPF9jPe8jc+P56HrxsvzAzhaUbXDagTFVUlz4nqa6zgll1OTIB+2aRmM Gp70ZlWD/7ATmM/HU+2DV5kb8C0NGEZWHR+GhXF1Y5w4qBoJzvD8AIxj8vh0mUgVmYqZH69DHvie Z8MyyF4ZJzfGftS9KGDCFtKM2Ba4V8Z0o7jDU9MIsz2OOA6CpJovQwwiTS8jJ1gx0PLz4dglcT1P VeBYpgEhiJFPU2G/ei5g7Op++/j792Nm6agFxk4Cg9K4nK6UcTUsjNOBOp3+RPK4GK9T6iXD4+Np bAtkyHpMTn3qWZapy6KRDSvjYbgxzl0fvyogKX4zlJQxSIx0Ixln7N7jucBTx91QuJosa+CTphK5 fhCXw9xFtuMHCR6mOvBS6sOiAHmGJGjJeOpedyfUjqUNk3T5/dsQqIoHM+rb8XAeq2LxXKaHCXZE TktIF7tRd57qojk+jMB4fHw8j30NC1n3q3GokhDiL1UyUtKFMqfEhMQKJwcdSS0r7sZVAVNR/IoU Fr9IDDUtJOcBgpSP705gxnGNkcIxDKcGdY8jcDpVO/S5Z9P4qAM7tnQ370hXV2XiKrzsN/SFL+sa tvKySQ1RQd31VEKkYOdN7hh+Nc2kJfOy7WZ1ZgqcEtYVMj0aPEDYcQQHBJZwnQcy9GDIZlQT0lQQ 6sGERzX2JU5GdY1kTvIwRPGqc1MgdTXFyevE4FmQiH1Fdqt5bu+JQCDF82Kk8zTm540wi32UlFWF U0/XXWjVOLZht3ESXMMDoQ2xVVS15Rpl7jk9iD2F440YF57MchqKIWbUA9yC/hWOTUX3I1/lDqId hZai+UXT1FVVJa6TwkKowXHPQ25rZlDUdY0zpIuyE4UmfxCsKLKEA+gU2RL/qoCjQPAbeQq7SDQF XoNnVfdEmTRGB+ukSxSammVoOsT3CFwUL6gQ9fvuEt1LuotgTVl0LQjQvh0f0CGGwsNvmm0q3H4V BimIg2CkY+siJ6i6yjOQVes6vC3F8qn/cUwdXDL4xCCp5xkiCJE+K6ApBiQVOk00lgHs/iDqusy9 UYBnQaJCJdJ+LEOf5Zv3xFyQwHG3UwRo8jy35HMiB8kN+yOzo1meLEtL/kfbkEPuXkcvv/G3rBKE 3UZCvrdIoeIhB+XgYkkQ4YbAi+BkpyYBxtOYW/wBboB8kSaOLO15G/Dy74cCzHuJ9KRJkuizP8yY 5tovJ0W3TJtm6fsl737N3tf2a/LOvJ7f3UbTkbvXy9vIVcibDrvXGwynRe3YVyVuSQ0+YX+Tv/bZ 3w4mdu8ecFNg9/6Ry41/wWkimMOSj4FJF5BT3s45/mmt/k+xg5QX8qg4ogcCv/b085/CjuElVdM1 5Vcf9/5zAPs7sCx72P+d8+Z/KRYv9P+H7oZ/NV521L+4+StV+U/jTenh3a8sDbb+YsS/Ilz4K9DC oiRLPxclIeI1DOmn4tPqo2hM+OEa5ucDBPuGt9YU3nLYMaKTxJbwbpIh4F72IVYyLfWus+VPhN1B drO6bescssG3jA9q1DYvJ2G33xhBUSET2vM6CqwPVW0/IfaCnZOJdA2ODJpev9b7WC2lp210Sm+l Qki9dT90ZO7wyvhdvfFtEfHzYndQwv44lEkUuLBOX4t/kLjq2TwmKseyazkR/nMqqtrcUSDndlyd Z269b/XGtVYocHelfL8eMJXZfG4DU1NlnlYNaSHSszWR4/V8nlJdUjSauB9EVVMUB58eptzTZM1x NJ458KrlQm+a0h9EzaS1QteUuU9NeWF86QJ9mVfIhMK8uh3LGJSxqbuhp3IMb6DAsaPh2x/PQ+Ya ThhZEicaQY6rqkzotJtRnhe4rjJP+YVfF9wPWNXRcJlKn84TI5hJ03ddT7rc1SxgnNlOWmWWwEo+ riIvobX0MfesoMSBJptxvfYuXFVF7TyTfpiG0v3cPo3W2efzVNOaL68u1ce0aCeSOm4BjB0f04Nq Ton6PnVR8/DtXCHTjNo+sUzo3RVpTnvbZjI/nTtcDUcS/8pPSO7HjlV8PJ7AeSFddcoBeBlOSuY6 8Etg7CJacJI4etKeWlY2gc1rkhaTIXe9coS/5tIbufnxcUw9VE5TYXKfmfGXPae4aTuf5zpcql++ wsteM/dJgBfGzdwujMcxNfSITLR0ciuqrKVVya1mkvj5fK5dVY866PGRr43+OcAWIxqoHC/HKs6H CVs8w1vlPGThz4wTXQu6sTB5ljIuUULmyhEOnFlMQ4ryac51QfKbcf1m6POCHmLwioePl6HE41xS xmYJprnMsePXc4dkXs+mnxkH6cKY4Yx8YQyLQONEl5bkPjXjJXLgBD0ZLiPG47F2JQ7W6dTFaGHs wZKNNNnCR9icwSFPtPx0K472c+PLnEiL3rGf0yIiMK4+OeMd/W5JVzUnG88kyzqwX0uzkm7EtMo/ pZZDXZFnR/11BsY+mO7quWjJv57BSWvguEfwXNk4rIyHT86YVZwoieOsnSeM/GKYmizOYNdJLDsH DoaZwH5T5s3pcU402amgm2+YcUcyx8nI1GZxWg8d3Z1oEZGFvY7gT23HO1ZFZdt1ZBzrwNB9TIa+ 7UibOeB2IXdSVa+a5qEfjucuUAQDbLfPPDus6kjXvHLtDfGKqgW0iMjyJi1CfmZfvWMkJ6mAclMg XRBUL6OffOHEkXmJ5scir8EbaZdCIg293Lyp6Y4dRY609m6ht7t8sRZZ4MZUWoT81BHInpVNP4wj ZNHiIiebXhCipRLJLWcgDK/aKECuY9MLVrZ839EkZSkVrr0Dd7mzFhGhOy1CfmbG9JNVSVEVafk8 lH6/KisyLTDczrmWqp98qzCu37dCQsgutcgfvd9UD1nu73wp/UtBj+kOLyd17z4wfqkOroXEl1Ih s35AvB543SqYX34uIn52vKsp/A8Fhv+FwlaO2LBhw4YNGzZs2LBhw4YNGzZs2LBhw4ZX/DfMM8+m DQplbmRzdHJlYW0NCmVuZG9iag0KNTAgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0lt YWdlL1dpZHRoIDI2MS9IZWlnaHQgMTAxL0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21w b25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFzayA1MSAwIFIvRmlsdGVyL0ZsYXRlRGVjb2Rl L0xlbmd0aCAxMDA+Pg0Kc3RyZWFtDQp4nO3BMQEAAADCoPVPbQ0PoAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AADgwgA0+gABDQplbmRzdHJlYW0NCmVuZG9iag0KNTEgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9T dWJ0eXBlL0ltYWdlL1dpZHRoIDI2MS9IZWlnaHQgMTAxL0NvbG9yU3BhY2UvRGV2aWNlR3JheS9N YXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVy L0ZsYXRlRGVjb2RlL0xlbmd0aCA0MTY+Pg0Kc3RyZWFtDQp4nO3da04TARiF4c50plNMYSg0JahB wNZqWuKfAqGAEjXGAC1e6MjZ/0aQUy4xLOF73yU8CzinVqNFSdweCdIsb8Qsz9IFQ1IvWmU7ZmWr WbdCWpSb271+xHo7L9tWSLLW5ofx5CRik/3hq+X8DiEvt8dfz6cRu/h2+LbdMMJqb3L+e14F7M/l 6WC9SP8hNNr9k+n8JmLV7NP7zhNCdaOAVVefQQBBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIID QSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNB IDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0HP EOYREf7baO0dX1xXfwN2PT0dLBDycvfg++znr4DNfhz117zbnC2/3pucfYnY2fHHrRUveNeba1vv hqO9eI2GgzedJS/aJ9lS2el2NwLW7ay+yB++DfKiGbOiUb8/eKglSRq1p6uP8N0CzGhS2Q0KZW5k c3RyZWFtDQplbmRvYmoNCjUyIDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9X aWR0aCAyNjUvSGVpZ2h0IDkyL0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQg OC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFzayA1MyAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0 aCA5ND4+DQpzdHJlYW0NCnic7cExAQAAAMKg9U9tDB+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICnAR3DAAENCmVu ZHN0cmVhbQ0KZW5kb2JqDQo1MyAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2Uv V2lkdGggMjY1L0hlaWdodCA5Mi9Db2xvclNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAv Qml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9M ZW5ndGggNDY2OD4+DQpzdHJlYW0NCnic7Vtpl9s2srVEcd/3fSe4ASS1dLfjnLHP+/+/agqkWm4n caY9yYt83lN9aIsklsIlqlBVl/7w4SEPechDHvKQhzzkIQ95yEMe8pCH/N+THci9dfgJZLdnDsz+ r4Dx08O4gzWC7P9Uzx3DS4ossCsY/+0sfz7FnQX040RJlkWe/RM9dwfR9EPfVCSRP+x/bIJtF+1Z Abr+vEjs9pxsuEEY+pbCfXeFu71gpQ0qQse2dZH5keXs9gf2ALuIEXVLF36o6z8pgIPm503bdSj3 FPZ7au5YNe5IX4R+GLnfb/bHE8iqzDN7VvVCR/5ptwTgEDYjHvu+a2Kdgze3B1Pe3MCOXlCBfwW7 mkgd2rYfUiBe3crqPF8br3Lrsd8eUwAiT+UP3BWI66Nbp639nWEAFyh5DcEoT5I0DTSOYVhelESB ZehSWY7nRVHgDgyrhMOJFI6mWa4pHcCtCBII+BXmwNLGO2h82K9dBOjB0mG2x5JbdbWvCbxiOYYI 4BzoIxh0v3ai7f/cPf0zQHBGTiYUmqqqG7rIsaJme75nayLLwG/DhCvXkHjRqk4fz01gaLAaieUk 3fHDMPAMWZQ1VWD2jKBqMs+Jmmm7rq0rqukGgWepgmhk09MCPRWVAnE48Irp+jCozDEHQTVMy/Wh HXdnJPai1y5jovOHA8dzsEA7LhuEqsSWYfFxUVRNC85D08Phly+/kMy1g9jTRMVJK9SNI0os3QkD nWfA00SOIhlRWTd1HjheUqEWFYGh++3L509z5ZtWELsKL+hBXiNU57BJBD3Mi6JGbRVq33fU/4Ts GCXGx9YVmdVYD6KdtUPfD2OfO4oWdTMZBzLj0rOi8dOXTyT3wbFmtu7k3dCT09NceXZcV67Iik6J UlPz0XKc+iry46Jpe4yb0Am7j19+XerA9os6MRUjbnqQcawDTQWznMZ+nCbky3c9T3YHLZuXyuRW JXasnnS4LdKyn/rUsvL5aWkrRJYhsf3m8guYhh3UQ+07tFnVwJavXCcbulDmJL/FlWsm5OUy0kPW ixIYZiaF51WnXy5dbBlBM5SuGTS4r7IcEdo8Gi+noa6HheQGd1cgWL1YlkLfzsO94NSkT23DzfHU +F55vAyJGzYzyW0rJachNjS/wSj0C4yrMOmOU27ZOR5ihZPDfqo9K52e58JRJUW3HC9Gy9L4djKe cGrIatDiOvDyETaYYcXd3Mdugi9T4Xs5nhuHv6dtfAsEIwX91LgSrwTd3MV+BZvFVowMT4Wtw0KR K8uwmVEUVNNUR0k7j7Fh5WRcgRjmxqNwdb7MsQL43DDvz+fWN4N2av11z5AmDBvSRyp1vhMYWoqP XaBpQTe1nnBfILR8Pl5NgzqMcSoMjhGcZh5SWC5JNUGJBlLaetCR2hYllwLhV8sZN/VAGl81X4EY VyDwXJk8nLZuUlTt/PzU+4aPCKJehAIRJ4CKJx5YLSNTGaTjBIOKTkPg5l2BYJSEnF6dJasmeCo3 ICYAorwusV+BaL8CEdTHl/OEcZcakpERnKq8GuMFgEhGkuvcQQRv2qF2eqJAeACEdwOCvnyReQUC MDYFwa5J698ViA97sIYTSQ2BZSFE0hN4rY7Iy347gWl8B4g2DpvTy9NCusKVBS0lU2HKZj6f0CsQ EI/38DTvTucOgGimLriaRhSjmZqGYJYTBtMYSGHyPwUQvFUtR/DpmmZYlh338wChgZ2NpPbdYgMi 6HFBgcDVKxAROj2f57FJbVmgW6ENnai7XFoKBM50jtPzaWnTBC0AhO7WM85M6ixJE/hgb6WrmyGF 2olhaApEhe9sGnB+KmG3zH2ZpXkWe0FFpjZP8hZ3sWllYx/BmwzaMbcgQhhLSxCdemyiCJ1fLjPu qthS1KBbJlSi+eWCPDPux1QDIDJyHKuqP51aT7WKaQGozQCNEHYk/TSUSdqMY+GYYTfmBi9Y5djc GQjYEgaYLQROY98kjhXUI+67fugyS9FjVPsSK7oVSgzFKVBKdc4hXAzR6elIRuokTNXKR+iO5xM9 W4IGRQrLykE7k77DCxiVrEX9Avma40PIZal23uOhg3is8lXVq1CscbyRosK+66lB3aVghGXbDz3K XFWiKTlCDbxqiYdwOzL5A6+HsaOIOg2QWU71k9AN2+PS1zUA2MJqnBx1bdM0ha/JVhTbIsPwED+2 qK6bMtB40UzbtgxMK4w9VZDtBCJsVGeQkcLUsSOxcMbEkPDdO+1iIC30wij0TJk7cLLpBYHvaOKB 4WRdFw8Qd2u6wkNkAH9hiaqhG/CKIXyMCnwaI0WQDC/wXccxVQGSMV2GTJIRdJpzuY6lQRYjQgNX l2U6woEVIV8Lgi3pokNze9BAV+9fstmteTEt1UFivD9wkCNLWxoOOfKaK3McCwk2/UsTZ16gbmEs oqgY5y6Q2LWLKPCQc0N32gXQpWm6KAg8HYiWAiHThuG2K5rBi7Td66AwE3t3HFYo9luR5etvWjah adhWPdnKL683GdGpMOQaFRqHwuL31xrMVqS51XRu97Yx16e3EW6z3W799BXuP5AdqwZV26KmqTP3 5629/e/Lbs+pTpgkceSb4BDurc4dBWxaVDRdUyXqVu6tzT0FPN6BZVeu596q3F1u1euHPOQhf7e8 Bh1//PDvmuLrHCuZdNfK6JsQ6u3tLa78Xo+/QWU43nhR4K5BK41p/2ka+htHugbVWwj/TZuDqBu/ 5Z03F7wugP/rQfeOVWzfvTLPNL10PVP6J5GAjATyjtsFzcAgqTO+1WHPGWHiSt8s95U5hzzN0v5y GrZjRLcau9RcC+R73sy6nuYEf23UH1HgIKqadI05AQczabqurWJDeLvd92uhQ3vLrG/MOcfsOe3v YM53rJYtv7zgWIWRdgc1xi8fSSgxf0RDbzv4zYMPX3nuq3f5LW99vXnV/JZYfR2RLj2KbWmzhB2n J/1Ehq7J7Cuhdm21lr4MSsDfJuCuzDmv+Tfm/PcavB8Io3r68vlSr5khb9WXz59PqXK4Et3cleje aOtVtQNlpOH3qh94lJXnXrntjQz/ylsLNJsWtnt0I3PrLZpJH64NWIbhtKQbcltaPeFecNE8oSyJ fAM2+9e5GClcK5bsK5sOI8src64KgmK5V+b8ptlNg3eH9TvOrJ8/f34ZQ5nZMXI4vHz+fM5UbqOh KZm9Ed2W67lwsWfoJzOUn4bfe3bjualFU2oc2kAHylvTDo7nWppqwD+mDG+SdqS3VOHAcNI2oqOJ vOy1Ty+EIrFb6+TDCWe2rikiS2swoMQ6JruWxy1J2dh0XtEUxcpX5lyX3zLnnqODyjcNTOW9zDkF 4vLrp+cZ9h1Daf+nT7+eMk1U3aRsUJ06MieacV6UNWogj2Y5xUkoh525CsfJTlKhHuM2MSXFiouq LtO1qBYVtAOqsiSrECo8haUbOCvrKg9NWLyT5DkdPrFVI13+9eVlSAzqlygQZ5KZEg+7iFm5cJq/ e6qoUCAc3Yk2Nt0LXTvsNubceMOcQ+vUvWpQ0KkD9Z3MOQXi9Hw5L5RfkrxmOl5elkyXjbBo2oEM uSWpYTdP44AnXNgiTLdS12PhyLKTt/0wXZ6XyjWcDHVd13elp6o+mmc8kuU442HAM64cSdDCGpxg 16PEVMx0mOAJmfrMcfLjl//5OG7emprG6dhGdF8xnB5tXPhQB7oW9aRy7QRVlP5xijr1435jzi0v rxNDNuJmWFtXVIOWqjxOpPGk950nAER1PE/TMiaaCJ6K4PkyZ7qke1GS1XjpQs3M5+djVyOy9KEq am6UpNU4D7Fhxt2IqnZ5Plaek1LOu0B4zB0zIc/noWmn54+noUEYxjY0r8ZDXdTj1IamW5+eJug5 zW1oR+OnX4+Vq9CDY8fqKT7NXeaqAif7DR5uXHgMQHhugfuVTUdD4fv1W+bc2JjzoiW09L9qUNfj gjP9fR9xUSCWpe/IVDk6HKQ9Gk9zpgmSbjl+OpxIalrF8WlMPUp0Z/r6wKPcduGAWmMRQqMpdwNw ck2aVHhuAyebn6ciiNDl41KFYT1BWzvDy1AkeX8ktPH53MVe3C1jDKicnzp/s2U4zK18gO3UxKZq ZiOhn4xcuXAKhFfNG43U4dK1NuZcWplznzLnlUdbT13krhr4fkHm2n5fLECBmOeGfuSQeEk7Nnl7 nDKNp+XjqMCXpbDsYl5qRzFSTApDFDXbD/PxfKw9v55IGSagZ+Ik+OnUlwWajqB0Rk6tr5nZfO5D 3UiGqfb95vREmqKG9135AVqmzFSscoKFwIZbKjCM7Tw+gEdqMLyazAuaaYg1QbSqmayEXwUzzvgt sfhb5nxtPeE8yCfQQKXMOXLfx4GsQJAyqcmEimbssrgBJXVJ89Oi6paXU2nbxUSyK9FtyZqXrtT1 uYG9uZyGqh5x49sQjDxPHeoJaQJnpblFNR7n2pGUoAM9o+4J7AR1eB4zF5bYh4qgZYSkhpFNc3Hb vxBXqG7WH099lnVz50uHrxQw7AgAIrkCYWneV+YcXQnja+swJ6CBILrvZ843IHI/GcCzEVIHfjVP maH7VdeiFQjHLsj4Ortj+CWlrjcgmtPzidBDwzLT5eNlbCo4NyK4GEluCKujNwV543O7p5e5hedw BpheTWCJnJquQKQAhHEFgkYtnGSm+DI31TC3vvgtEKBrQtn0caJANG+ASPv5K3Me5pjk+g8RxisQ OLXpop4vcIQ75TzltlOMGOUlvhw3IK77EdxVPpK2KIbzqQkCymouuMscVYvJZa5j34NTX9FXmpun HQpTuO5cdDr3WeB5HgQXLtXvFQg9JUtl8Vd+YA21FL87H1HZ/4YLr1yXKmfIZj7Nla1R5vzVNGJq oaHCCdTe8iCjQMDFjwKRgKUuv/7rpQ90q4C5HLBiUifZcFnANHJ8JbrBdwUNOMUk6ykQUXt5ucxD HVuK4rcLLnzLNHVF1GJKc/MrM74BUQdeMS1t7JimoUmSU+MNCIxTXU/wsfWVLbJkJU1XVTPqTlOV NjcufHWW4B/tjCwogAjifKot1W3mEZylEqxI13C8O5oZtdRZpivRLlgVfj8QRkHAJ6nB+OlfEGjL EFPhzPHRsnQl/QKssFaiW1mJ7pK6q6WvatgqdUDt/jLjtgxNzS4wQVkY+BDZaSvNDUDQ9ECA4GSs XCvqpqGK6eeUimyvhDanJCMc2ir96AKiEjg+aeIRJEmcNWSGUyVdufCswQAB5cIL24iGI7hcND+f Kguc7byg0DRW5tyB2KQvaGt6fG5EO/8DzDkkXUnX+LJolssTjlRBjTsIaGAXLKQf5hOEAEaMmivR ndp2NsKDfjqR3AMg1m9hRhSDNvU4dk1dxLai+g2KVG5LGHnRLlBmqVbW4R7VVebrsrkS2qwcIBQq kl1Nc0cjS/otOsRlEBQR0qeW5uQ9/dwZAipfo1w4pdlLspABLxB+6rDzhgWXvuWXMIHmFJQ5pwEV tN6I9h9hziGvc9PYhPDFK5vUFCBqSxNbVtyiBW+JUO4qEFTHG9GduJoK0eT6oAicCAxkbJp+mhpP 0+nX6qgpY1OSzDixRVAjTByJ5bUg8VRBspK6bVdiW1S9JNC4g2AliSXyalB1TbwCseeNqOqGoavj NRJPG5isWT83pfUIRVC8suvX6T2I/a2sbQuINEI6gfLaGoJ8cdXgwCrrRO9LNvacYugSZJuy6VA+ m5UNCHA52YJsyqdZC8/LtAElug2FB5e+PbB0Mx6PuIzjihz7AHSEHhtNzkm6ATt97bClYBux7QZR FDiawPKKoUHuxEoGTeo41fF9a6XBaCEKQtokhFagCnS5Dslsgx1AryCizLlJRxZNypxL8nUC49aa 3TRgtonemXXtWX4lmw88vybd6yVcSYpMaWvIlN8Q3Qxlw2X6QAAjGo9jAUDgeT3BoYeiSJBnU5qb /UpfMzdiW1YUWaRJNYxIp9ro8D0rUEp9OzYYTlRUVRa2bJsTZeXKvG+DUb1keWXO6cj8G+Z8/7b1 4ZWO57h3l65uPPZr0eTKVG8Vl1fW+sON6H59cJA8NBEIDdpxyGlkCA8ODPOG5v6WvqY9D4frf1a4 lk9eKzq3Ss+HdZTDrSL0ey58u/MfmfNvNPiL8t0hrovg9LgBd9HQ/HyrMP4nPut9fNe3xdzf9/iT Me7Cp9E6K7XnJPZN6f83zw1GqWq6vvLc91bmrkKNnqVVxAfPvXvw3A95yEMe8pCHPOQhD3nIQx7y kIc85CEPech/I/8Gt1pZsw0KZW5kc3RyZWFtDQplbmRvYmoNCjU0IDAgb2JqDQo8PC9UeXBlL1hP YmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAyNjEvSGVpZ2h0IDEwMi9Db2xvclNwYWNlL0Rldmlj ZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvU01hc2sgNTUgMCBSL0Zp bHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTAwPj4NCnN0cmVhbQ0KeJztwTEBAAAAwqD1T20ND6AA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAPgyOAkAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjU1IDAgb2JqDQo8 PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAyNjEvSGVpZ2h0IDEwMi9Db2xvclNw YWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9s YXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNDIwPj4NCnN0cmVhbQ0KeJzt3e8u HAEYhfGdmZ2Z9a+zqxuibVDdRYp+QmJtVUpIsCh2OPd/IziotLfwPs8l/PJ+Pm+jQS8lcftLkDbz ImZ5M31hSLJyqurErJouMyukZbWw3OtHrPf1U7v1fAtJNrWwvj0YRmyw8/3zTP6MkFfL20dnF6OA nR/vfusURmj3Bmc34zpe49uL4drHMn1CKDr94Wj8ELH68mC9+45QPyhg9dUvEEAQCA4EgeBAEAgO BIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4E geBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB 4EAQCA4EgeBAEAgOBIHgQBAI7j+EcUSEf4Zqe/vnt/V9wO5GP18ni/NqZfdkdP0nXteXp3v9WY9X N2e+bA0Of0fscP/H4gfPmGet2cXVjc2teG1urC11JzzrnzQnqu7cfMTmuu3J/O3BQ1G2YlYW2euX i0aSpFF7/3cSvkceZao6DQplbmRzdHJlYW0NCmVuZG9iag0KNTYgMCBvYmoNCjw8L1R5cGUvWE9i amVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI2NS9IZWlnaHQgOTIvQ29sb3JTcGFjZS9EZXZpY2VS R0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDU3IDAgUi9GaWx0 ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDk0Pj4NCnN0cmVhbQ0KeJztwTEBAAAAwqD1T20MH6AAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAgKcBHcMAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjU3IDAgb2JqDQo8PC9UeXBlL1hP YmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAyNjUvSGVpZ2h0IDkyL0NvbG9yU3BhY2UvRGV2aWNl R3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2Uv RmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA0Njc5Pj4NCnN0cmVhbQ0KeJztW+di3EaS1gTk2Mg5 NzIwiaSkteW993+qqwJmSMrrvaO8tsS1p36QALo64ENVdYWeDx/udKc73elOd7rTne50pzvd6U53 utNfhTab39HnTY/+q2iz3e623/gSm6+6bADJzfII6Q9e3h9M8La3Jb66XG8Znmd337T+zZ7juf2t C0Cw224ZfLTFy/cMxXbPcszyspvtnuOY15+TkYihsNtvGG2z4zVDE67gASoCz7KiDo9YThAA1Hcr GJu9oBGVw5XDe+tEfvXeW96IE1v8FpHYsKqf+Cq7dAFUVEOXRRIknioqhiGzux3D7L4F2e9GG1a7 rnyzE604MoWX996JLq1DZf8NQGw5I6szg1vkarMXLd/VVbuoU0M1fJ8IrKAoAvMeVQRX3lYOvD5A EjeVK63LRBHeSUHbJyo8AOOBtH7nxYQuxuT5OT5CE7DZ8lY5VLbILOZxL5q+o6su7QtLNTyPiCLx A1Nktjdj9H40ZcPq2djHKgPvYFcjdRV+0eQdwzKMHPZjqrEMy3K8IIKKb1FwGLxGY4JM0ADXDCuI ogg9dzhI44M+wM0WDIZlKIpXD6WlaJalSVpQN4khcizL4CzbPcN8mzH+02izV6J+Kk1uu5fDdiwd XVN4fAVFlQQFgdAFSSPEclyH4Kfcg97DtaHw+z2nENN2bF2WddvzXQtMomDTw1iEnmfrIsMImkUQ iHEFQtec6nTpE7jQVQE2EkZUYbb3gcRWcOq59USG1dOhT20n8DRux6puYKlaBEAYqhVlWVHVNLUl Zi+QICvLMvN1gVe9rKQ0D2w7zGldl5EhSk59Po9NXVeJJfGyHbq6hkDYqhlGjhUNn366NLHnRwHh 94xk+Y7Cvg8gNizJpzHROAGEug7ssCxsgRGsnMYGASAy04jaeey6YR4yQxBIVMFrth0NdcUuptPc V5HrJ2XdDmMT6YrbPn48Dd0w9ZmlkKhMbd1HIIhfVZETj59/BiCChNJQ5XiSlDHh3scuAroRgm5Y khq2Q25bSdf4Eiu69VDYBgJhWcXhYaZ5NR4aX9V82td5WvZj5Rl++/A4laFt2F4YZ/U0l7YGQDxN FTDMbWjYeVd5BIFwjLjrE9urH57G1LaiBsyGpHi0TfV3IhGgGzad20A3076NiJEOXSizkt9OsPgF CLs8nZvQ9uk8xPBq40TjIO0OfWyH/cOpcjVJUsFW+CAerU+85gLPDKcYx9z1yqH2jQUIMxmGxDCz +UgdRXGqqQ11I+naSGHeCRDLvjFmrl8NlaOQdOwXILq5egZinjIi6ylwOX5zPnUgEcNpTJ2oO/Wh wjGcTGwvpseHITS8+tCHqqCG3UQDH7TtGYhxTHQ9HmAsjtOSAXCCKan7TQ7bn0mbnRx0c5PmbZ8S Ub8B0b8AUUz4ukqEa4/6p8e5oc0wgZCE7UxtYceIRpjm1QBSHxkunRpXBN1q5joMvwYi1hfzq7F7 0WumNsvbAZ2vH43AjdCBmKe2g/1f4bVkHGJ463A4vAAxtmA20KnIvWh4fBxpUZRFZBG/GUuT33F6 XDeU9pfXQHi/DQQMkunsjjOKaep60I9vclz/XAKXMp0u59NcWgKrxiPIrkTS+UR/Awg3aM+nOvZc xyaKivuiwe3Bsk5tnlTzwxC9Vo3K/5VqxJoKhrkwuB0D8nU+nw/UEd6NQIBugCI8fn6a0YmUQRSo b/n15YxAdAMAkQ+Nh0DAje2U80wDyzB0RZRxazE4Rgr6Q5eGxXRGG9GcD6VruAValJuxHFZjCUD4 3aHxwKyITvPwj0/HnLyXPQMJAgT68I+PvS/td+BeHcYqp9PjubJJ2HSJaaUdmDQwG3ADrkULXz/0 PYfIslN1YPkYsKzHocrrw7kLiFufL2OVlf3UBAS3T5e4wAZbcdeFKmB3nApHAReiuHz5aY7k96MZ GH+r0Xg5wMfdblk96acBtPcAm53mFmWgk7DMLPCx7Lz0VdlM276lZRHbClyXkcbueAs+f9d0I2iA ZmbjYRr6YWwTQ0aHytIsYCOaV5auLBjZOAOeAqfEh58+de9JMzAjwxtJlbvwdTY7wUzAmy6LPLEV Ufd8Q5ZN31XBvmkexNGcZEVFVZV5aEqC6viWuN8ysptR6FJkviaqblJUtFn8bQ5daFVENkUivq/z rOTkdRUZAgjY+PFcvBtvaqXNXtDNNSeDl7br2gbRJY4VFFVkOVGV1zhMEZgdBlKuh5rBMbysSux2 s2VljMMsg0Doysm6YTkQdGnAzIqKzLPIBmOpEGftWMlwXUNmGdHrwaTI78WJuNJmx3Lcfk1E7Fhe FHiOYzHNyDDwd4mVMehesgzYLi5x+Nq8WXJ8AvaB2Hq7huZLTH4Nsxe25S90X1h5ZrdH56Wy+Pek GUiYWtk8X+7WbMtr+vCcRMH2NQvz4TkDueZqbn22a6J2s3b59ShLZnzLKGHTRup7ca9/GG32spsm lvDONOP702ZJXkl/e4G4ZvqZ92YhfgBdy18/ehnvgd5N/vpOd/pR9FtKsHgb/043/hilWad4qUf/ HxN+D0KruP+XQvgGS+T/pvT3ew4j/OYwDL/Unde7HScI3PcNdb8q44FHLkiyLP5qDRtGJF8VnG8d N7/rMMJvEURAludoa/1osxcJxDji90RiiUmeBRJiOMcPA0cXvlrDljOi2Po6bwsIYOgCa9aJwv2n MrHZiU41tLGOOVGIr82s679rghReHaLU/U0gBTOumqYuAv2rNexEt/pVoR2EV1ZEdrtlIWw3/+Pc 9oZRkyNmmzD1Azfx9Onj4Im7NVTa3qKnaxH7w7W4vbtVurdrQLXdvFS9X3W4lcWvb/mqKv48IvjO xPeNKxIbVk+6aWgxO4EyurmGY68L7bd4DgEIbJndc1cgNpvn4O3VDG8GgtXLx//55VIQTBTwFn38 55dDJO2XGvYtNmZZPL+ylr3BakHDUunGFgyxl7sthNvIs1+r3thhKXtj9fs59sZHOOJaL8cRd6wa NU1M1kMQWFg9TFUc+DYeRlli8KVOvpfCfsAc6S3CZxlWdssmdxSelw0LVHu7rAzHvK3gNvUbgSDl 4y9fnlosnOzlcPj4y8/HSGZ5xXA819YxtSJqhJiOi/XqLcij4ay1axBKSbdd31+SKoygLTwSu9vz ik4M23UMTSXwj+AZih1WdeCRyu/hcq2XW5rASW5zeehjQ8SAaif6/amPDFWR+P127YLzsuuJA12Q FJlba++KbOaHh7lwNUlBILDWbjiua8HKXq0ADOzbkEAgHv7x+XGMVWbHkWx++vx5jhRBdZOS0hIM FCeaL9VtllUcaKirBK9lvG77rvI1UTbDrKyKBBOtmp9ih7pM4rSs68yRmT2veUlRlVlARB7GWEas IlMlyeHnLw9tuNgEBOI8xEQEwdnued1LcREw5nriwFBNz1mzgKFjBe3HL5+m3NENP7QkTtD9rEJu +7qCrKxp7r21QohAnJ8ezofKEhjRpfPp4XGKVMkIC9r0Y5cakhZ189T341rd1oMcG/rMlGQ7a7p+ Oj9MqanZCW2apm1BWBWXTtPQT8fTPHTQbywskdeCEtv7OiaKmQ3z0Hbj1CaWlR6//POpixYgtrxT nw4UwAKl4fSQti106Qp3OXGQmcY1L+wUNPGi/tMvn0EkTC8vQ00iEe3aFrmvK+i7YRor541mFIAo jud5OrSBIuhxN42Hyxipou6GUVINh8bXjPz4eKgLOh5aXxE1BxrK4QDfkMRtT4v6AEBYVtL0NMvo 0KUmCYeHU1vV89PHU1fR4dCHuupWfVtm1TDVvoEp/KEq6mmmnhn2Hz/PmbXkGtBYDqe5SR2V52SP Dm0epxRQt4x4KbSn7VopaIfC9arLpzP1CfFrnNQH7iJJa+QmEa6gKPvDEL8xq4VAHI5dO425pTnl 0NXDaYwUXtJN20360xgbVnm6tJHtV/MYa4KomZYbt6cps5xi6LMg6Y5DbPn1PJZRVAxz7Vnx9DCm blBfPs6Z55fTlNlWOh6aNEw7LAb7zflYeXbYAEQEi+fUXo9iwfZpZf3hONKQKEY6DJmtG2EzNYG9 APFcO+rn0jaT8dSHmqggLI6TrdxROzeBlUwXmMfNx6l4Y0kIgZhnWrRTE7px01d5cxgACBHMYFhM j0esbh/mzJDhW6G5EjXLDXMAvIRPMo95EOM6rXh8ONZZSqdjG9jJeKSOStL53HqajkeNPB+FoEzL 4TznbgAIRJpsFNMQ6SSdJtgPrvvxXjQiOh6PbeL4dAIR5AQT2BIXZn9VTRzm0tL9dqK2yMp+O5Ze QKcGua1yRm5cgaIG7VRZb3OKFiCmIipBnTLaN0lEAQhVBNOWl+3p47m4VbflsBtzQ9ZcaGiOHy8V AHE8dWXVw/cATf/0MNa0HccKJGKYcoL2bS5NUfaasQqi7unjsaXNMLex7ddT7YqcigVkXcci57Or tNnzqgNyc2qTtJ1rR9gxGp4v8NLXQETDXJiat9SUGRGB8KNmwko71mUXblgBLzr1+NbM9wIEyHHc H+dhGgoPPjN8Js0vm7qC9z0X9nV2UEywesQrsOHwhEDQ8+NpHHqQY7D9ny59mRdlDkq71PJ52Qfk CC+5sJow7p+e5hqr4rFNPDrColklxoK3Dn+TGxCLbyIayXiZq6JfgQC8XgHRhzIHHQ+luZy1sq5A BDF8fJu/AYHSi6eb6AgP3w4E6LhLz0+Plz427XI96DIMVYIacAVCZHE+VMV+oGnWX04ViPvl6TIP dWLKajQ+zGXoOo6lyeuhBg6Ry+CzIBBB2FzObeI5jm0oirOs7wWIKdNX1VhcLZZTvPZ8oEUH1lnm BNCgHoR9MZZ4fEuXSH44AhBuPVFnMZ0gEWEzNx5wmyVwO0m/AlF9IxCRbmTHn35+rF3NXHDx6nko wqS/HHO0UK2HJxgACM+naBST9nyqYO7L43lqy5DIigemJXMNQjRZUMELTAAIrx1uQHhuMR/q0CJE V0UZopsViGHAsyDDgTqLsQS3WdI0VSVhexqLBKbKbI0EoEhoLIfUBFGZQfUCQLU0VYfOfaSLSgAL Az2dhtTSCJjW2rfiZQUAxPB2IPRs7EJV8YfPP53xpAPcRqZLD1OdldPDAT5D1teeyIhe3edoIOcm L8fLsfTC9uHpPPV15hPVyoaxTnwPvEURbFQfqwBE3ac6KGrVF44RtlOP5ynB2ZPtskeZlqMebKbi w06ybp8QARp+HIUJHec6cJJu7nLYxHvcEEOINYgWtIexzOj8eCoMGb4Z+hwkaPrMNmHrb7MouW7g uAIWLCdO9DYgGPD1K1cCATxeOk/mNbj18KTY1DftdOwjAmZ8OUFoFzQ2TQyKsGFI3bC9PByGfjES ulf2fV0VWWjIilvRQGGxQ6iCsGY0NhQDHA2siicubBcpTQkH0FLqKaJVTnODDhVG1HZKm7YbhjpC cLuha5quXVykkgaqZOYjOmnzCXdyUMEDWDXTL2lEFHvhbvs2t1duiBPIMtHbgNiJdhySpexcwmoY vDXAaUzBjy6rKrFkxQ59jQO/1g9hCitZGzLPijrwfYqynabSUTQ3rWhVpj4eoA5CU2A4HVxfkeFU 8IdhPzaWqjgeDwD/PXQVZscbYYgFf69sqnABYsfrQVGvYTgW0mNw0BcXmxNwTJGTnaxuaFVV6O4L Zgr+u0vMILJlXgZuity2vHILe1ZZJnqbj71lZV0T9ztWJqbKQzSItywrEQfP+1hE4iBEwvO/e0HV ZI4V9bXB0Eg8HLvUDwtwlVyJl6GHt0RIrKhpoPNLBzxujf32t6q4qfAMr2gKxE4QzWkQIbGK5blk CbrwRxC2F/iuubTjjY8BHotFdQ3iOSyOwySWRWBkRoQpbU2UNH25u3EzKzdGiMtEbww2IHrF2Bl/ hbIE3cvtGgALPA/RD4a0S+yLJ8Nhd7s28GrUAxBBCN4kbIZ7DIIlEQNfjNtxROywvfbDyJgXJWk9 fM4sT2580CBeE5KYqUOu5Qz7UkiX1pD/xrsG5vzyixl4UTz6DrE+u9z9C/dmnehNOLwUtjcvPyXY 3FIi14L1c0pmc8t+AC1nwkZwDeq+TXD7W396cOW5DvX1v2tV/GXEW0Zn91zFeuZ6ufl6eS/rekn1 bF9N8DLyy9R/KsFWp4dVU9MKg/Vrmfr/nfSvWKzCAjVEolEUOLr4ty5Tb/Ckj6qpivhWe/RXJSzF MMsxn783Dh+ej/r86GXc6U53utOd7nSnO93pTne6053udKc73elO/230v4cRSZwNCmVuZHN0cmVh bQ0KZW5kb2JqDQo1OCAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGgg MjY1L0hlaWdodCA5Mi9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvSW50 ZXJwb2xhdGUgZmFsc2UvU01hc2sgNTkgMCBSL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggOTQ+ Pg0Kc3RyZWFtDQp4nO3BMQEAAADCoPVPbQwfoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACApwEdwwABDQplbmRzdHJl YW0NCmVuZG9iag0KNTkgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRo IDI2NS9IZWlnaHQgOTIvQ29sb3JTcGFjZS9EZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQ ZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3Ro IDQyMjc+Pg0Kc3RyZWFtDQp4nO1bZ5fjNrJdiWLOOUcQDACDUndPO/7/f/UKVIeZ2X1n28de+7St +iJRLAKFS6BQVRf617/ucpe73OUud7nLXe5yl7vc5S53ucvfWHa73V9twp8qu/884N2eO3D7fwwU OzZeNuDvRrzb85KqKSL3D0FiG6+uazL/3bvfC5obxb4p/TtGf0fZcaLuRWkWe7rwDRK7gxpUHS48 TRT4f8Cs2AtG3PTDgEtfPXw93L1oV3Tqcs8wDF362yMB7z3C0zT2uAp1frc5DG4Pa2HHKWG/0iq0 7SCJrG19sBWye3Gs2+duf9PervdMbj9uX/7qof022QlWOS19mSahoxxgXIKkKLLIczBTivlMctfy qx4npiwIbIXsOH772B94/sDxosy0D3uATxBFSZZ4jjsIkixLwiebQ3vRbdelCUxdUwSOExTLD6PQ NWRR8fHlaanCoCCXE45twzA1kQOPYhnSARQNXZF1J4iiwFYF7iCbjucHji5JquUFgWeC8/2rB/db hAFxXFGgS/CiOUEPCoQ73KSObqb0+adLX+T4/OPz0sRBlIaGKJpxmdqSoHpx6Ng37TLQRMnOmhaj wjetMK8RqjNXOXymOQFLo1rOtPR1mNW8GjTDOAyE9oXvZhMA0W1A/LCiJC5xE2ha2C1DYihOjsrQ T2vck4nWnqpHw+k0D1UUJE3fd93QFa70mWKxHadG3XqiKHEUUXYqQtqiaMjcp17UXR+nIvCL6fEK l345DrnjFOuXC/LMqB2qwAmSrEB0HVPTzNenK6niIEZkRGXd0z5lzvfzyF4wk24+rmMVGGbcT11s WwGap8r36+WIfV0P8HEubc1IhwlFUXv96WmI/WIYC1g+jhfmw2mpHLs8Pi6lZzo5WUmVZu00Vbbw mbzEbi8aYT2upxlFQUnBfEk0MjKjwC3oXFmS5DQzSTVR9tt5KIvh+vw0VRkiXWxophem9XQ9NZ5T LufOV2WrXK9LW1b9MjeO+JmAgMUhqE6Kl/Pc5O1Mc50/KFE/49DNyVSagmjX0xArPDiTaeowPV2v a4cGinzDZH5xOD3BWnGKealMUbSa89OZ4G6cxsL6VDOCpZi8ZMT9+TzU3TK9AtG+A1FNY6weeC0l x3ma52k5znQmpWuFTd/hfn08MyCmqdABLQDiNKC6aYpA/VzbBgeRkqC4zXoea7zM29JIx6nxnWwD AmbCTDKARw668/WyDng4Xi6nMbXdkky4rCHMuAEBGPJmuV5oFYcBhBTip9o1DpJhmTDJ0bLivKLL 5iwbSgrbyggtbkDMtasI4CzOPzwf2xytT8+XLjB9tMxtVgzn4wYErKrDAabNOhaBY9vG54qoIJIO szzL63EhRRC389QWeTPQNtSNZBhzg+eNfDqNuaNIRr7+8LwUQUaffjjVjuY289o3iF7WxrUzMmba gZM8NBGUx3Hoap/KRcDumbY9i6GGytOtFFM6DOOIU1NSA9TG2uYx1rmNDEkJ+su5Cy0fna4k0SXY UGfQnlaS22bctpHC7Xk9bseha1EVm59q09jxWlBiiAVR7qmiZMY17rq2ii2JF604cWRuL1oZ7ptI h/A6bdvUVPQI4cKWeMnJ2w6jFpW+BhtPYkMouRfNqEIt/BYan2pG7PaC5oRxHG1ZEqRUWxoFjo7b H2TDVPj9jpNMPwpMGea94XkGIKS7niUfQAFuhIHv2ZooKKbJkosdJ2qsiRAUP1f+udvzoqKqCsub d+xiS6z5rSIhCJBgs31FuuXa8AXU9qB0077l7JLEsvYDU35pT1Zu7f3VY/ttspViuNe65Gup5bX2 8qqxVV9YzWW3u9Vgdq+PvpZj3grhWxMv5Zq73OUud7nLXe5yl98nb4HHf775x3Xx2tTGMf2Vccwt OPveBhZsSt9TzG/39n/EwQPGZL+TShDnyxAK/6lIfHOyYou5VfV7G3a8YtvfJ+W3UHQbwB9w8GDP a14YmLf0ZndQ7JARd38iEjuOf2fKd1sWFscBZGTf0slOlnvKN8NlnCFkL2Cz5Ri/u5S145QAkT63 WOa/20tuNZLqz6wdw9B1/XXUO052shYy+iaxvrGBU8K2S/WvwWFJqq4Ie1YXir3f/e52vFGsz48k VgFtuMjnL080UriNpX7PnN7Z6Rf6+qv8intPp94yqXdi+93nvDfy9X1OsuPYeUFiJ5j5MNGha3OH zdF3LTUZSGFsGe1rB4IRxL4mHEQzTBgQ35n8bs7HgBAs9PDrL+fGFvYwITz88OvPa6beWOrNd+xY eiyIN0fymmWzVHq7A0k0pNEsseb4jcFmk5XjtwcgFecF6fYbm8i3n15aZBeM+BaMrO9z+3bYZi8H eJnaIo0DE5b97RHW10FNCS1NgWfL6ManC1qI+jrQJUl3fXbmgFl2036zQGKZ/0eBsNHDLz8/DiHM goOW0qdffjpmmiDpjh+GrNTC8Ypp2a4feNZWd9FsuOFbCg+TkhHfcRz5oMbLxqbDaG1Jt2x4PHAM w/IC31ZZbYY9GPiOLh3gK2sxCDxDFtWwv1xJ7iiM3OOUmJzgwtA16fDal2cpAiMCptKSVV0TuT0n 6aDhVst1aUJTNVzPlA4H8WYyWLZZYDlb18IHkWBAXH94fphyg+dEu1oen5+XTJeNoGjaFoGDEhU3 q6oa4bbwFF7Q/fzGWauCoPkF6gZC2thUNDetGtQUgc6qdSU80HVNkRUNZlQ3f5DMqGgQqhJbkfQg ryrWSubodrH+9PN1SDefwIA409xWtjqNZMUlK9lBm7LOgHAMNwoMgRPNKA28ZHj6+ctcB5YTp54q ylZctZhZ9mJBhfDL0ZWPAnF+vJ7X1pN5JcTL6fowZ4Zqp03bjXQoHNXMxmUmIyNkHFm2krrtBjpW rqr5VT+S+XKdS9f0C9x3/TA0ga6HeJ4JmdbjTAZ4jjaeIpkJAic4kC63dbeiyzSSaR5yzyuPP//6 OGYbEHsp6E4rBrAEjhOtFA9DP5CxCQ0zI1PlOimqwE45aHARZeTLL88wJdyoRqmp2hkeGQ0/bha0 80TANop8+WM7KwDRHM/LvA6JLlv5OE/rZcoMxQpTxlIvfWQ69fFh7Ro8rX2sK2bAbpAV3qGdw7hQ f7wupecVPcFV1VFSunZKr6eh7ZaHx+PQ4o3qNsKWDE3V0rmLnbA7XyfcdPOCIzclT89L5anszYHH Kuhp6cvAkEQtwnRoihJTUnlODkAAagMOFUGNB9qEUXv5csaxbcfdCJ3Gm3bVTbTy7Ixej0MDZlKY 6R8GYj2OwzzVnhkgOnb0NGW6pFquHxbkNOWOh06XIfPjdqG5Kaumu9HXc+UxEqdKivFEcy/uFoqy rKFLF3n5fJnKMOkuj3MVxYwXhyFQdrqoJKe5DOKBHaDx0x4gsn10OmNf3ZwlbJ9eRdbjhFNbd0pK 2cRP+7lP/A0Iv6Z9pArgMBbku8V0IqwizmAJguqmnQ1Ln3gFsyAI62mGXeDDQCwLboa5T8O8J23d rzTTRYWx1M38cITe0bpUjgbvirmr7UYNrxzBK5lpneT90qd+Pl2PXVXh+TgkfjEdcWDYxXKGCWUx XjyK8flCUYnoeanDpD/S3NKcZqaZZZfzDPvBzadBdORkeDquQxHEeIZpKsouqBUh9A6mNNMQMyDo gjwrHmbsK4IWs8MGCZ5hwoqyhxamzSxg/NLceh8LijYg5iaD19ZWmPRFhgEIQzHDYmOpzw30zohL UUvHqXa0jb7uj0+XFoA4ngbUEopCWOlfrlOHh2lqYUbQubaZf1uQq2hRP7VJNj4+HQfc02XM/bib +1ARDcbxWdZGeb7GQ4w/DMrxdBqKcli6QOZ4s5ymKiq/BiKjS+Oa0DByJV5hQMRZD6jIB8Es500b LJCUoJtaT/o4EDCPc3JcmFuLIlgBmWVGqIdhHQEIH3ofoXdYmFPj2dELfX1powifH04TpV1q2+wU DEF1g+rEsTfqV2JvCqxRQ7Amzcnj49I1sG/kvh3hCYwW9BwgsKyckeCvoSWLMRSnmC5L25AbEIDX V0Cwcxbw4IoAiG5C3gsQSQ4v35e4FyDY7DVF2ccT/PhxIGCNh/j8+HAhuevD1ModWIy0LdkK2IAY YkVg/TVhUBGKy4pcTm0UgxM4L7QrPM3IpuuCkpCdhdPMDQiRIVfBa2FAJCk7M1BEAYsk9GCz7x2I ubJuSwPCNRa86VF/XnEzrkOsiZJTTwQm++Ys63kqLNWu1iMAEXYzDjbXCTMihRUaadtCIkVQkBsQ 7W8EIrOc6vjjTw9daLobLlG30iYtxsuxZh5qiACICICAtb5MKMv786mN0+HycJ4HlNoamM5Oljq2 bWqykTIOXFSjgb4CEYXNsnapZ9uWoWhBS29AUFgaZkZXHGzOEsJm1TANw07BGTcFdFX5pp10U8ec JS1dmCpLG3pJfzkj14AolGSWoifsDTGHVXqmDa61i718swCAoB8HwqqmMTX0mD7/eK5sQHsimRvh dcYVmi4rvIaKdJHCK1FHauhvWbqqoZcjitLh+nRZSFdFtuFVdMJFHEEwqoCPIrkBQHSktGChtqQJ mO8f65RxgZrmI8LmtJYRkpl6PJ5gwGz7ZDlXkmdpgaelS4JiXMY6K1oylh5gQwrbTIaVogovj6eG UenLyrbPpCeV78LWP1RZgSnbS1NmgQCek3X0MSB4iPXbUJWd5ngZI00y4TKyXPA2pO+nlWQ2uPHG hyjGb3DuegVZKLtByxCAeDzPlI5talsRGscONVXqaBDO4EQX2AOpAZO1wrmjOxBo9G1TF6GpuSUu bRGgxTjSFQ/NS88CKpZR+yVEZSOd+oyBO05gxDjULERCODFUt6YLHckC27opwxKEeRu6McKg7VcE tAcy1P5NG/IEe+voY0Bwip9vxz+DGoE1PLt0IGgscdciBGG1rvtpDCmQaMYpdOEVtxtV5GXkfCJt O8zzdhiqbBmDHduKYiepKzMqPIWgXDQgHtYl2BZZzF7nPsTvYQqhLyc5aerI4BFQ36YbEJCKpk23 peE2pCFe3nbdLWiWWZuKqAVV12PoqIQQX3bLrqtC200yX5Mg3n/R1m7asIXoW0cfi7H3gmaZyoET NNs1JMgG2aUgqHYQhb7v2aoIKZKxEdfsALGgsBuB7zmmndMTrdMMQcgZgiE2Y7AhGxMYrQ1rfnsA QmWJPXeApMwLYWW4ugQZncm4cp7R3zwn6F4UOrfI8iBbfpzEIWjB/a1IE7EmOfhuQj4HdoXQiefZ 0DLPbPFNVTUtyMZ5yABv2vxNe2PmWUcfTDYge2V5MqS84pZ0b5dwJb+y1CylvRHXAkuFXm9IRkaP 7DwkRJM4kA83BptR3jdamx0yF1gBgXs9ir6l7CxNfjuVftNjN14KkqAsb8T6C5cusSZZYv2q+24X 64CVCiA13/rZb49+o/1y/P1DOLzw0xsiL0WTG129/4qlfivJvP+tAEYL28E8QWjQkYEdA3xjsHe7 96a+/XihzN9bfK3ovFV63ko9rz2+FXJf23y366Vsu/+qu3/T3v3v/+sAW52VthBcQTb9Vk38r51+ LOz/vbb9ucKOwQRJlqVJYCmf6sj0Hy1sPesQ/+j/nH/x/T/C/uPIs3/h3E+2fHPe5y53uctd7nKX u9zlLne5y13ucpe73OUud7nLR+X/AMkCC+4NCmVuZHN0cmVhbQ0KZW5kb2JqDQo2MCAwIG9iag0K PDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMjYxL0hlaWdodCAxMDEvQ29sb3JT cGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNr IDYxIDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDEwMD4+DQpzdHJlYW0NCnic7cExAQAA AMKg9U9tDQ+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODCADT6AAENCmVuZHN0cmVhbQ0KZW5kb2JqDQo2 MSAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMjYxL0hlaWdodCAx MDEvQ29sb3JTcGFjZS9EZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQg OC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDQxNj4+DQpzdHJl YW0NCnic7d1rThMBGIXhznSmU0xhKDQlqEHA1mpa4p8CoYASNcYALV7oyNn/RpBTLjEs4XvfJTwL OKdWo0VJ3B4J0ixvxCzP0gVDUi9aZTtmZatZt0JalJvbvX7Eejsv21ZIstbmh/HkJGKT/eGr5fwO IS+3x1/PpxG7+Hb4tt0wwmpvcv57XgXsz+XpYL1I/yE02v2T6fwmYtXs0/vOE0J1o4BVV59BAEEg OBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4 EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQ BIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQc8Q5hER/tto7R1fXFd/A3Y9PR0sEPJy9+D77OevgM1+ HPXXvNucLb/em5x9idjZ8cetFS9415trW++Go714jYaDN50lL9on2VLZ6XY3AtbtrL7IH74N8qIZ s6JRvz94qCVJGrWnq4/w3QLMaFLZDQplbmRzdHJlYW0NCmVuZG9iag0KNjIgMCBvYmoNCjw8L1R5 cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDIxNy9IZWlnaHQgOTIvQ29sb3JTcGFjZS9E ZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDYzIDAg Ui9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDgxPj4NCnN0cmVhbQ0KeJztwYEAAAAAw6D5Ux/h AlUBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAfAPp9AABDQplbmRzdHJlYW0NCmVuZG9iag0KNjMgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9T dWJ0eXBlL0ltYWdlL1dpZHRoIDIxNy9IZWlnaHQgOTIvQ29sb3JTcGFjZS9EZXZpY2VHcmF5L01h dHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0ZXIv RmxhdGVEZWNvZGUvTGVuZ3RoIDMzNjY+Pg0Kc3RyZWFtDQp4nO1aaZPbuBG1xPsE7/sA75uUNOOx vclu5f//qjRIzeWNUyN7JzuV4vsiiASa/Qiw0c3HT5927NixY8eOHTt27NixY8fHweEKaByPR/j9 BVO/7MovGnhh6ki9AMvzzPEnjV8t/cKtIRZ+9up/skVzoiTLiiLLkigIqmHIzJtNb/P8yhIY4Rjq TxZedvyBIcIL7iv758E/gwMlaI4fxnEchb5jGF6amPzxzYMZhn68wwda0L0w9D3bUIXvZ530pH5s 9mroyMi6LrNvvfx/941RXFz30+k0dRUOfdw1vvTGe3agOFkR2SuHI6cn7dA3dZlFlsy+YnageEUB tj80xCuqyBwpTvN8nf9LFiMQc9J6vPv27TIAsbCcx1hlqe0xWWMJeWQOW+vp4PYgHVnVDexHDkfB bS+XqWv7vs1dhbB4Gn7kNd83RTK7jza3q4Mp+EPB6dCSGJpfiVHr5ain6z2auY0Yxat2kM9fv4zY t023WGZsSALPghOwQDiOhzZ1hKAirA24CsMJoiiwNMXIbtFkjrw9FZQUDHdzmSR5M42lI9KHI30d RbFqUDeJCZNyBJvCZh5o0WBK4FhODesOWzLHq5atclsnkYyEy1EMy65e0LfN5IFiBdWt7y6lrYiS kZ/Odeg6tiYyFM2rumnZpspzIjJtx9LIcmFl3XFdW5d4wciW+xlmhyOXpORwPDe+jqyomUesczQr aZbjmEjkJae63A8puA4XM2wHRrPgPkdMOQZCbnX3MGFbkZBlqRzF8KoBJywkMBQjqLpOhpCL3zZn cAE9X+YUsTSnZZeHpSmrMoWJ4LUwK8oicRCyI5wXWQzrjpXtOF87IOR3X37/OmJLpDZiw1JaAivo ybA0riSoTpwVRRbZSI+n335/6GJDVswQLOWJq3IMjzxcVkXqe+n8jz++DImlWWFkipxohHCizGO4 EwK0cVasHr09XF+pMQjPU6LQRwZld799nvphGnJLkt16OU9t5ts+rgFtg21Z0PysrLuhz10r7L/9 8W3ObFh2G7E517kjJdjVMsQa8rK6qZu+xZ6Tzv8kntu6nVZwrOsKTxFRUPVdUxdJlC3//Ne3MbWN oKwCJJtJ07VtN7QwiSho56nvwKPMenO4fkUsViho5Pe/3bV5OSx9pKFwergfssDxsq4vMa6HNtYl eCSjJO+XPrbd8u7rpfLR41IkxFiIKVo2z5nj5X1X4ryb+9SLuodvS+7qVtL2dZbV45jbuleOPbAK fTfqvvx2Ll1Nj/shNY24HZssyZqpS0wLLw/nJi/7pQsV+sYA8oIYLMUxcbximrCpx/PDksFCCttl yMOoGKbCliVkWG7cnmdsmfF47kLEbcHjkdiBVtNpKcMUyOMwaZa58Nx8udSuqrrVPJVxVEznNnLT fixcTUWqauWnu85XRZSMc+545dSnsCyTfqp8Nz9/HmK4S9OUajeuxZfE8OlSWjKK+im3jXi6NK4s oGT+vNQwY9NSObKomm6Ah/tzbml+O5W2sG17z8QYNZ2XKilP91OZ5t15KV0rGadMF5UAxrUZrufL kIblNMSIYxiIivEIjyfPKskEdyFq58qVOIg4cxf7xen86JHB/gIxCPeIl7xmLBwjBk8NnkX4/O1+ qKt2HHJY9E6Ei+b0cFdYyKvHwuS2lf9MbF2KZdrcfbn0FWz+A7aMuB9TjVei+evnqanaaarjCPz2 JRoiOi1H6+PJKDEQC5JhLgyO4oxiHtKgePIoN7gb4+JLYiSKsKJbE2IReINYVsXnr5euyPIC+7oG iUpdNcvDpTD/E7Fr8BhxXN89nJo8LwoIoFp0JbZ8uetLOJhHjr8So1ZiZKjxSCxd/wCxfOqToHjy 6FeJxd8Rg8vN91MeuA7sZIqRdEOVZv3deSU2Vc6LpbiFey3u5yb0itOlT30YZSqiGpKVJCrheDcX sE/CToYcmJAIoj6sReU6dF2KftLPlQNB3ymnNvKKJ49+hlgKmdRKbG2wolMPK7EhQQwt+t2pTx1D 15EsWxBXyihpL6fcJLGgi56Dx3huA10zw2qEh9+MYTeLbRilipzsd0vtIeQ1y4BdOKYpsoGBhQuh Q5HUoD+1a/CYYMMPmrmPTWRCcCw9J3/y6CeIqck4RDL12GAFp+whHodtH6sMxZn5OJSx77kWUqx8 XpqsGO6WzFCsYp6fwv2aUlVpktV9n9my4pJoHsEoU+YltzmNuWs4uB+qBI7ZmoxIsC3iMHBgy2vO QFIzkgH2exsPU5NGaT00kWHiJ4+ym4nRSthUPuQPpFH7EsObuIoN5BVVIMO2LXtl39VFngaGosfd PLbteIKIJqK4hxnYNuij4NSn8wg7a1uTvIVDYdW3FYzyEGRfeJzbxDa9vO3qMseRKUsmhsDS1kVo KOD+0qW2GdUN7J9uMYxd03ZNainohUfarVGREqw4MqBcuDZoVvVCR5X0IDThCTpya+5TgouaKJlJ VVdlWWJb4kQzrev0SozVoqqFqiVPfUNiSMoeZNBvTZ9Y2cmbKjZV5CZFWRY40EVOspKyacrUVQXF yeC0pdlxbEm84qYVRKg8MuESLzySb9ygYS1KGuSYh0/HrQFOqUjmWREh8HCtuwzHI+tHZFlRg6Zj W1ARUoyou561JcFwV5ANnRxLV/i1NuAVk4yyEE9D6my6riHznKSTTiQLhvxWsz3fNRWOYWXDhYYo a5rEQvasO3BiTYLZFx5xt1ZqUIqwUBWsDe5asLBQ8dLsVitspQop+mnIyVlStQg8B1XyVndci3mo E3hRFJ8KjKdRa/XBcKLIrzY3Swy5CgyQyNHNEAyEOunRLJy4Dnz26OYKlNRyh5cN+N2qy8NzRXh9 TXOtM7dT14Lw8f48lqBPVq8vdz49vqfZSkiK2irZrcNLQ4dns899nj26ldcb2f9lo97JwR07duzY 8e44/KJK87fjuqd+n9tAQsH9QKXZpKn/hW+/gmsWJHwniRwYEZK8715oXiU3yIn+KgXl/XCgSaLr ezbiX7l65I0otoRXxyDjIwoKGaIr3MdmBgm8ERV1U2We+lLsOVCiXzevX/tBSSARKebIqo5vibcW HP9brErR2JPaUONWVeGqplByNIwJIhn7VSA5bIRkluZUdyX2UjQ5HF6JLn87KNFr5rWat2HGrmoK R2oRJR5nrJEXM0QDosgLGglKy8xReKjKbI2nnrWXrQYhEgrP3aigvBPIxIynJtBVRYZSkogllmOb UA6u782wLsqqzFFHIuPJsolnIsUgSTXWUpOTtbX3KuMomqabtq1/JxD+XcRgYqZLG6BtlgTNT6HM zyNL5tVkmjMT2b6rshSHYPEZfvvl968TdjTDDyyJ5ZGX5EWRx7bM8TAyTbOixK+f1b+NGCX5/WUu PFKyU5weVV3btD3RRDRCzLbiEls8I9hZETlh//WPbzBlppcVAZK0sGzX3rA8Fbeapq7txqF036oL vyuOnJnP56kmuhWn+PXQ5gluyEtEI53m3HbyoXZFVvKbLnWuUoyu+3WXmppfkd5pPfTY0qPx/tzm RTuP6a1vnt4FB1pyi/G0DIWvKVY2DtjRrbib68AmxIDL1PoiK4fdKgatUoyo+s2QOQ4ehtzRjaiZ msBOpvsJuy4e5tK68V3h++DIyHbazOelDu2gnhpf4UW7nPvEw4SYt76NB2L9mBpolWKApt+OuedX UxsovGDm05B66XSuXUX1mql2blXz3gWQHwmal4+XUx2nPdxunmY1PI3Yz7YZeyamq6tiwTMiECv8 iHAQaBYRPclPhynXyT0Z4eDHIEbRnGzn891U5GQd8RQhBnOAr8T6QOaUeCDE3O+IVbZAkXfoK7Ex RRxvFmPtfgRi28bKo5B895D3c+1KLFlcXexiEhWJfhIjUcczbGqKS6QYEkoIsbCeW19meQOezNRL CDGWN/OPQexw5CQVKaoRD5cRJ5CEJKaqh81Y+SR4ZJa16iem31wWIEYESQgeSgDPmOsVsGAtVfPr EYJHTGQcQmz4GMRo0QyiKExrorGQmNbiKCn7NoEQCHNg6FG/DHlazp+XVJNga5hLT9eDpse2Gfek d1z2a7gnMg6Zvr78CM/YgZHdrG7bfhzrUL9qIk1HNmiVZPcInr5xHtp+PvWhKiCg2WcwgUUV6aqd 9Vvv3FUVr6wCheG0uMJv/yTtHYlB1RKX4FuTB5rAKy6uGvKZhk0+M4F6TIRDWdNUZVkkRNkkUgx2 dSuIbJmXyRceTV2mkBcLehhZAs3ITgQ51QfYoI9EXQmj0DOhcqRYSXf9wHfI10lrBc1SrGxAGepY JpTTqxTj20iSkSZzNCvqDum9yiwiIvU2yYtV/iOkVEQGEWVFFslXqKsmIsmSQAqR6zsPcl4SBX4V SLY/5HMHlpyi2LU3t55ZD61B9iPw+rRpJjR9/bz1tZhylUmol1LMJpm8VFCoV73fT0H5Cbz6CPY/ fBB7eN3304//7tixY8eOHTt27NixY8eOHTt27Njx/4V/A+TkmBENCmVuZHN0cmVhbQ0KZW5kb2Jq DQo2NCAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMjYxL0hlaWdo dCAxMDIvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRl IGZhbHNlL1NNYXNrIDY1IDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDEwMD4+DQpzdHJl YW0NCnic7cExAQAAAMKg9U9tDQ+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4MjgJAAENCmVuZHN0cmVh bQ0KZW5kb2JqDQo2NSAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGgg MjYxL0hlaWdodCAxMDIvQ29sb3JTcGFjZS9EZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQ ZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3Ro IDQyMD4+DQpzdHJlYW0NCnic7d3vLhwBGIXxnZmdmfWvs6sbom1Q3UWKfkJibVVKSLAodjj3fyM4 qLS38D7PJfzyfj5vo0EvJXH7S5A28yJmeTN9YUiycqrqxKyaLjMrpGW1sNzrR6z39VO79XwLSTa1 sL49GEZssPP980z+jJBXy9tHZxejgJ0f737rFEZo9wZnN+M6XuPbi+HaxzJ9Qig6/eFo/BCx+vJg vfuOUD8oYPXVLxBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgO BIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4E geBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCO4/hHFEhH+Ganv757f1fcDu Rj9fJ4vzamX3ZHT9J17Xl6d7/VmPVzdnvmwNDn9H7HD/x+IHz5hnrdnF1Y3NrXhtbqwtdSc86580 J6ru3HzE5rrtyfztwUNRtmJWFtnrl4tGkqRRe/93Er5HHmWqOg0KZW5kc3RyZWFtDQplbmRvYmoN CjY2IDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAyNTUvSGVpZ2h0 IDkyL0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBm YWxzZS9TTWFzayA2NyAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA5MT4+DQpzdHJlYW0N Cnic7cEBDQAAAMKg909tDwcUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMCPARL7AAENCmVuZHN0cmVhbQ0KZW5kb2JqDQo2 NyAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMjU1L0hlaWdodCA5 Mi9Db2xvclNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBvbmVudCA4 L0ludGVycG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMzkzMD4+DQpzdHJl YW0NCnic7Vtnd9y4Ds2MRr13Ub1RjSpT7CRO9pX//6seKNmOnU2c+Lw9u3HO3C8eSSDIywICBP3u 3RVXXHHFFVdcccUVV1xxxRVXXPFut/unW/C34Ns0d3tmv/9hB/zlXfQTCnd/XaU7YEmx/1rljuEE gf0Bf1r4ZZHdHvCoe3v6vxRu4/IXdcBuzwqSosiSwDHPNe451TJl9gfcOEH8uuBzCYYTpYdepJWJ L8rvGB4EgNwLA7w78CJofKldP40dqzgoilDgGtIzlTtGctPEEl6sZsfKpqVw35fZMYLhBY66iUCP OoGnC9/nf9/nDMOy3xMClbqliy/1+U9jx4huOZC+berUlQ5PVO4OatTgQHpxaPe84QfmC120Y/W4 JThQ6CzaHZQAkybSvjuloDkWCgyBE1VVPHzbIq0D5qovT8ufBJCMx8uJ9MM05DDUO7o6GWrydqyW Dn2kcvf2b7MR+3VebiuPvhFW+szu/uv2fr9/XO973sE3d+faoV20F5z6cnepLX7/tMBuK7DqZkQz 8A1RslBowQDv3j1TTAUZhlOcwFXY/ZdSj81j9q8zCkAyW25ImVbjsUcys9vDwpKoIWBYPRvHzFIk kT+A0j1LP4g8yxw4jqWEGZbjRc12NB5aARZkLQaCB46HFb6t973o9x//dTdF6mEHgx+Nn/7zsXMF KMBBARCiBUAPlJDAKOwZXnNsTTLitk1Mkf2mYkE2HVNi4YmHJq0V7aidlmRZEn9orL+ir+fLqfZt 1BynRGMZTjZd3wdDwPF6Ni84DgLPkjlol2J59LciipqhCbSlqqGpugP0GVbUHT/wXV1iGVYybMfz 7NUkAP3hwx93pxJGfM+b5enzvz90nnjgJMOFAo4mHECzYVlQ3APrc6D0dd1vzpc+NiWOWxUHzxTr muUYEvS8aVnQVlr//kDlUIh8aol+nv9K/1i5ho+XKdU4XvPSqq6r1FVFIz/ezl3TNrmncJziplXT 4DwwTT9GOs9wWhAHjhfHtsTLdlzipqkSR+ElO60xrhObWieg3918eH/uAulwkPz2/OHutvUkXgVt uMFlZEmC4qVlSZ9SR+YlKwpdJ5k+fT7VgS4pzlPFSVXjKvXdIPI02Qzzoqiatgp1nhWtqMTtMLSZ 8xqjSOmfLl0cpMOJxKqg+mUL6Lvc1azifHczDeM8lo4k6KgA/SOpQz9tal/mJK9sMpRgHOqqk7VD 3/UEiql6PJxPE7RD2ui3p/PpNKY6z+vJcDzfXFpPUb2iG7puIG1qqVZGlnHox3nILElFVRV66fzp j3ONTN1dFYNtpoqj/nQc2xyhvE5t3cfzTG3W1CAVVksDYsvNqfHl19EvLh9PHR7OlyFUZTsf+jor 2rFPbae83J27siZLH2mi5oZxWpEjycO8HzJD0pN+gN+EZLaddNCsNG/HIXWc/PTh0mc+mISN/jKR aa5dWXarcRxP0EIdqhnqLCn7qY0srz7dTHWBx6UNNCPpu9hF3e17Elu6lXSkydOim6A9dn6EaZT5 Dqr70jOj4ebcl2W3TAX0RU26shwu58Z75egXN5/fL9Pp/S2JDT3s5iGPYjzNle+Vp5shdoNqnjIw xjqsz6Q7LXWYdFPt6UCmS4J8mksvqCfgbTjpMGHkl6fbMbVkntlMXzMNGJofmyZsgW07LU1goXZq QtPwinEsfdScTw1yEJ6hBTAVhth0yuOxchTFq6EOe1VcB9CeW5JYquZjUvtWTC5T7nnpMOPAjvsJ R2E1LxUYmZ9mv43+3YW05HRZKt/NFxiILG/B6EF1y1LaipGQqbQkCWxLVIy3lwaheuwTL2rHOnAz 6CiU9DP2ZF728NwnqAJb6oiH1QKt9Nu8ImOFUDXACJGlQW5KxtwSeTXs5yaKmmVMDdmEjSa1rGwc YsPMpinTBQVBR7tgWmCiwwItwUrZIie5eMS+FQ3HNlBVv5m7CBQuTRxWI8n01zgE69q/GVIU1/Np SCN8+XAecNODF+C5xTQmGq+Ew1w5qu6nRdWdPt42gZsOYw0LYchsKwX6YUZm6HWGt6qZZKicxvTB s6H0Rxwn7TxUVU/qOAXCyMtHKnKAlTG3SYSnDim8GhPYZ22gH+lGOo6JyivRMJcmKLarCfp1U8wI br3S7yfoDNGp5z720vEy4aod21D5trf0ffrQp46mo/Y0V2lz+XDqKjDEmW/aObRE4WTUzzDXgrJt cLt8uG08EzUzaYepRZrxQL/c6MMiQOVIYoV594V+HfjldJqnuU+9uKP0i5UIbAXN3MYRHhtf4oDr mNtrpbqR0P6hPfKEfrAqPuwf6HdjYQqCXc9D4qXT7WUiYHpt4dX7/lyYkuJhWNZJfbyQHPm+Z2uK mT3ShxWdDyPO8uHmgl3NKWew5jAnZD1dJz+sP9jNYPJPMEcLWuwp/cqz4gG2vxNd9ZS+m41TQSd/ 1E04DOs/0deTccoNUY2GBW+Tf2oif1P8hH5u8ht9P5tub5axKwP1hQDkO/RP2DdB22nKEawhGCLL snRFMjLSr/Q7oI/qeYKp213OGEjH4/uP76dEF7RknKnxmu9N31gFXg7F5Ef6Hialo3n49o/Pp9zS g3YCSxX1cxtR00dI7gUVgc4D+j3dRGilmh6TBfuaFrTLsJq+npSeuymmrjM1fVFLcgPow4wDCzzf XuYBZ576Gq+HOr3pchmrNANj3yDLr2FnT0IUOOB5Jn2LYH/3G1IFQTXNbVGRy6myRNlrbz+977Yh I5njZLAS8iQHyx5bVkqLPdCHoepzSzay46c7glSYZKSCXaMcYS4lZUcwMt2ir12RlVHbp1tpVQ26 45h7pleO87qjQqBk3ive83ZJNz6E+xToWwVU6q/0SQdxm/Iq0wd++HA+kr4nUIMh62E99E1d5aEp a6gqoVmiU+DEseN2gm2LwDAbPG9k880MU4+V/BrcHs2DqHHo+qFNbWUrdj8F97yVVrEuyF5znGG+ i1aGYVPUUE0I+EkDjk3FjKvUElgIPSuk61DakyW7hN5OHAvkRqq4Sa17xcyeM5IqsXQ3r0IVXPMY l7A055sTJdHnr/L6YHjsrO3AqlUZBJqsoAd5jWuwfDoNu4LVufVDV1WsuIL3ZZm6MtgsN8c5BMgM b0BoJgngw9bgEZexBb64SYvtH2aX6iFHZjkN5RmU5FQPlPGCFuTgy9Y5MkRedhDMWYbXA2TJMq1U 4BS/bOrIhP0mw83mHHP3iiHgdSHglXQfWeKBlZ0QOV45LX2Zg4c2xK8KhXesZEIoA+GKqfDMQ2QD cYTIcpKm0tBGUDWZX2MP33UsA+KfPRRyTBmCq4OoaRCN0AhmK3WA8EdVHw80dqBQkyF+hPiInqfQ R6gHglZzDaBU/gCF1bVqqAdiHFopvFNs3zNlnqdyaAuNWJG2ByI/TlahQYICNe/hQdN0r5rGMgyS dhlft/G/2yJciBS5wxrt07h2Pfra7w/sQ2B7eIxQeW6NfiHa3OTXj7vtq7TFr89OakCA3eJlbi0J 8uyq4D58Xn8/1AOS9w+0GfQrVCQ+Kj5sircf+wfF0BTJAfp1HKbtNMTfP0z59vjv90/PCR4f3z0c uG1/1/OE9RTj4UhjO77bPTlt2D/KP1G/PT5X9u7LqcpXn558vz9a+bPi3VNJWjNvQNDR1SXuwCa+ eD71O2LHSE4KATOu68x/3cb/W4AaMD+K4/CVpx2/C8CUSKqmqdLrzrp+G4ABAHt4+GGG5LfFo9G8 4oq/Ed+adLvdC7nM32iSUr/k8KesLHXbvmeFaYnfxUTRDK6sKCL/3NeiO7H5de7z3n2kaV7+93DN gKbhoQh5xvOM5F6w4sR57n8+uP8HybC034L/5m62bVMi/dkBMyP5dUMTe09lafAHoR1E0MiRXnMi +atiz5vZMA1tU8Xml/Qwjd7ksBtSjd1/iWYo7ciDCJcH+jbQ3z1IPwj86ObHLwcYZAixqzhELk3q rNGySIPlw3oKpvPsY8zMcopf9ZWvCoJiOfSKw2MyeYuD1/Qt/6acVkaJyKmLTE2VhQPN+Vqe7zuG xLH03DYzJPnxJENV7GJ5f6wDXdYo/cOBVx6SycxB0EzTcj3vbYUsQH88D5Eh8SyMuGCgvMKYpocF ldK3NAd52nqOFXlO2H/496e59AwLRY7Mi0aQrdKwIARjTddiXATaGwpYGSnozkuN6AgyvBHjrmu7 oS89TY/pqb0VVbkjsqJX4jSIh7v/fl4q3w6KKtJl81Ha12iqah76YRpr/w0dV4Dpy8fT3MB487yK MGmLJGvGIXesBOg7TtZjX6KpAlL6Ab58umlDywybPrMNkO5AGhNSuFY83p77quqXMX3dWd0/Cnr9 qyDHhdShodo5GXLXsOJubkN3pQ8f20Cm2YC5cu10uoyJIWuoJYXn5cAbFkLUrinK+YamazMyVfZr UrT/MHas7CTNdFza2EV4agOFF+1qJqmfrvTLsUOUPpkrxwj7pfVlXkHdWAYg3YUqL1rlRLIgm06N p6pBM2H35bt0vxR29FaNnw+nY5OkNBstMJyeT2MePKNPU5W2TvN7rshKQL9CcTvRqwisnk5TgWjS zxREtx7h5VuiD7u3bOfTZSrLYaqdr+gXYx8qvJaMS2XrQTsDuUf680pfS0dKn4zgJQh2NTb+26G/ uiucoIX9ea6Lfr6f/NNwP/mdfCSJLlsFvZgA9BewBOvkr1DUzDSrL1oFTH4/pfS5N0YfHFlF1zXN iocTyRMMRBzdjGBaIycBr8+2UrBlvhN1N+fK1rxmIYkhaSGsfT+oYI64OmwD02ooSUrpl+QNTX4I 3uwwiaMUjxNGXtpPXR6nmMC+Zkbg85t62C2kyvHy/lxail0tS0M3vhZ2Rjvp576I03qAByqdaBxv FUP9lujLXt607ZYe1ty8J/12K05V/QqHmmwXZCY9mU8wuBK4Qkew+Q6qcGyozoN04W3SCssZCab3 M/5pXj+JHSOYUQX8cYF0gVechN5OrBIX1rQZRrbEK7R7cF3VmStzop01Te6bdhi5ivBFWt2kxQOr uBF4vW/H7WFFw13vkqoQ2bCiTvO89Go8veaqyxy9I+vBG8c2FY6huRh6P1XWdfr0KM1t0mv+V1df uO7+y2H9bwVZ3lK1u/s8Lw1h94c1o3sf1Ao8FQB69OIyC7sFFf+zNM0Df/ce/y+JLwnhd1/lee/T t1sm98vDmrd9uMj+9K76/au3dwr85hp8xRVXXHHFFVdcccUVV1xxxRVXXHHFFVdcccUbxf8AYJvl Pg0KZW5kc3RyZWFtDQplbmRvYmoNCjY4IDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9J bWFnZS9XaWR0aCA5MC9IZWlnaHQgMTAwL0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21w b25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFzayA2OSAwIFIvRmlsdGVyL0ZsYXRlRGVjb2Rl L0xlbmd0aCA0OT4+DQpzdHJlYW0NCnic7cEBDQAAAMKg909tDjegAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAA+DGl4AAENCmVuZHN0cmVhbQ0KZW5kb2JqDQo2OSAwIG9iag0KPDwvVHlwZS9YT2Jq ZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggOTAvSGVpZ2h0IDEwMC9Db2xvclNwYWNlL0RldmljZUdy YXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL0Zp bHRlci9GbGF0ZURlY29kZS9MZW5ndGggNzA4Pj4NCnN0cmVhbQ0KeJztmetymkAYht1dFgUV8YDn AwYPGDWiEkVF3GQc48SOPaRNmzb3fx1daXMH3/5Iy3cB7zC7z748sLFYNDGEMUYigjGRZUoERGOq 6jktAR+NaapoWnVdxsDBSEqWetNZr6gQ4GCiFnu3W882ErDPjIhSsNxdMDOBVwORRK49C3aLrqGA 7iDCcb3lbNnSLiUlUDSwnGnc+Gx1XUlR0LXANF0brdl6VEvDBiOaqgxWzL9pZIB3j4PcX7Kt08rG QVuDg2x0bzlv7Rzswea85a15sHM7BWDeSCLbngZs0Suq0LzpTQ6yZ5fBQdbq4w1bD6vAvHGQq8M1 24zrGjhv5YHH/EkTuoYkXpwLtp2a4CArhQ4HeX6VBwc5d8VBvhVQnFnzUpx9eJD/FOegnKLQINdG F5Chi5ODXLlecZAbAkC2PV6cTT0O/D5VDQ4yL84sNG+hAexcKw9enG8GoEYGEBrAZlTTwA2gLNYA 4IvzPRqAKcwAJn5kADHRBrBkgRgD4J9Oc0uMATCBBiCoOD0hBjAWaAC8OOFBLoUG0BJmAODF+WYA 8MUpxgBifw3AE2AAmjgDGEYGEAYT5b0ZwKU4hRrA4H82AIQJwQjDGwAisqLIEg3/AUAaACctYxgZ NWlwA9hBGgCiWr3XrRWK1iz8BwBXnDhh2O7cNrtTaAMgyZoT+LPxfMtWgwqgASApbS72e3/D7oGN E1G96z+ejocDczvFJOARwfHC9d2np8/nY+B0qzpgw2GlPDl8ffn+dGLLSY+fa8ANrLunH6+/ns8P dxunnQVb6MsGrs4vrz+/fTzer2+aGbBnRjRj+efn5y8f9r47NAtw5wTRbGd1PD0wz+m3yroigbGB ZN10vKVjm5V8WpEBX1FcAkqm1arkNVWWQO/5EImndD3NYwn09SEiVKbwsWE0wkjIZWc00UQTzT85 vwGkf32NDQplbmRzdHJlYW0NCmVuZG9iag0KNzAgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0 eXBlL0ltYWdlL1dpZHRoIDQxMC9IZWlnaHQgNzUvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1Bl ckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDcxIDAgUi9GaWx0ZXIvRmxhdGVE ZWNvZGUvTGVuZ3RoIDExMj4+DQpzdHJlYW0NCnic7cExAQAAAMKg9U9tDQ+gAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAD4MmhpAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQo3MSAwIG9iag0K PDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggNDEwL0hlaWdodCA3NS9Db2xvclNw YWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9s YXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTMwNj4+DQpzdHJlYW0NCnic7Zxp c9pmFIUjgUAIBMIyO2IHYwhgViODASV206Z1p06Xcab+/7+jEhLaIY5HwrQ9z9fMZDxz5+G95+iV 3r0DAIB/JQRBkCQZkCGJt/5bwJbtSOSBBKkQHYlGo0wogNG8KTtJ5ImEI0yUTST5dK4gFDOJMPnW f9v/FH0iVJhmorE4d5bK5oVKrdnu9oejq1YuFoQ0R8UkCa1Kci5LUqo2Ljq9q/F0Li6Wq/VK7Atx CpM5CuafLVkSNs7xJkkmM3kit+uNzHq1XMxHF3DGd6ySxFRJijtJZqokG2mzWd0ubuaz8VWv226U s/I5g8n4g6skBaFSb12+H4wm1xZJxOvJaPD+slWvCIVsmudY7GY+YFmAVUkyOaFca2qS3CxuVxtZ EmUiqiSdi0a1VMylz5MJNsZE6BAVRJ7xEBdJ0tlCSZNEO9u3ktzKkswmw363rUqS4rk4G2XosDKS gPyfEBiLJ1hT4nYBzuQVSZSzfSeJpEoiGpIUrJKoE8FIvMA9JZaqsiS9q9H02nS2b08SRZJmrSLk s6kzLh6DJN6jSWJLiWV9Ab5ZGieJOJ/KklyaJIkykTAk8RanJC4pcfu7dbuUz3ZNkrKQz+iSUOpI MBGPcJztapVSVyXZLsB2SVr1rSQ8JPGFb6VEbQGWdinRLol2tkMSz3hZStTXramWEktKSkzaF2CM xAtcJMnkimW7JBu7JLmMZQGGJJ7hkCRpTomTa+Nst1QpkMQ/3FJizpwSl1ZJ3KsUTMQ77JKYUqKp SjEkGep9o0uVgpF4gUtKzDhSogRJjsfelKhUKbaUqFcp9V2Vgr7RB6w/WzG3lGhegG19I1Ki97wo JUpalSLO3PpGVCmecjAlDm0L8A2qlCNgl4TbpkSTJEu9SlmiSjkG35cSbVVKAguwD9hTov7AXV2A 7ZJMUKX4zZ6UWNmXElGl+I6REs0P3CtWSSTjJFEX4HJRkYRDSvSBgw/c5ZSoLMAukqBK8Y8917Lr xo3T7UQkVCnHwjUlFlyeJe76RqNKwdUtX9ibEo0qZfezZZEEVYpv7KtSmo4qZaXfbzT6RlQp3vPS lKidJKhS/Md+LZszp8SxaQG2942mKgWSeIlbSjRfy7YuwLsqxSQJFmCvcb+WbUmJa10Sa5WCvtEX DqdE5Ww/0DciJfrBwZd3rSlRr1KaVbVvRJXiB4df3nWmRFQpfrPv5V17SrRUKU1UKT7yfSnRqFLw FtzrIUhlFdr7r9++lu08SSxVCiR5HQRJ0QxNOUdzICXuHriv3SRxVimQ5DUQATqeyp6zlP5lmsNV ivEs0XSS7FIi+kbvICmGL7U79VQkQBx8eVe9ceqUxFSloG/0DoIMxdKNoTjv5tlQ8NCzRGUie/tG LMBeQwTCiXx7tvm46AlJlrWlRNPZbukbcXXLd8hg5KzUW376fL/o10uC88appD65QpVyZEgqmqqN pIcvv/24mo2GI7sktrfgOFzdOhJEkEk1p/ePT1///PXTh81aO0kcHxSCJMeGDCUr47vHr8/PT19+ vpdWakrso0p5c0iab8x+eHz6+/npUf45G3TQN54IZCghdMW7h9//+uPh47xbyfIo5U8DOfxz+eZA /PDTL5/vxG4hQaNKORGIQCiazNW6k6UkLZSPoOL7dKcCQQZCTCJdag0m406BxedpTwh5NhTN8vlK VeAj+NbmaUGQwTAT5+IMhc+gnxqKOBQVwGBOEQIrMgAAAAAAAAAA8N/hH/rSuQYNCmVuZHN0cmVh bQ0KZW5kb2JqDQo3MiAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGgg NDEwL0hlaWdodCAzNS9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvSW50 ZXJwb2xhdGUgZmFsc2UvU01hc2sgNzMgMCBSL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNjQ+ Pg0Kc3RyZWFtDQp4nO3BAQ0AAADCoPdPbQ8HFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAPBuoKgABDQplbmRzdHJlYW0NCmVuZG9iag0KNzMgMCBvYmoNCjw8L1R5cGUv WE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDQxMC9IZWlnaHQgMzUvQ29sb3JTcGFjZS9EZXZp Y2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxz ZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDM4OD4+DQpzdHJlYW0NCnic7djdTsJAEAVgdrd/ FChQrIBYBAoEFEiKFJqgSCMhgEoCGhTl/Z/DRi+8aLldGnO+J9jkZGZnJhYDAAAAAAD4bwillJz6 ERBAqCjJEkM0EePnomh6TlMQTaQQyuSUUa5bpbRET/0Y+EOYlMiZrf6wXz9T8NVEht/I4pliwx57 02HTUEUGvIVPXsRvZOfV3ni2WniDRiGTSgJfiYQSNnkRpmQv26PHl+3myXNurEoZ+DLNC0OTg1VD pbTZvVu+fux36/nEdQa3wJndaxSSQjAZJWcN59v94fC+Wc286QNwNrl3u6YmBpORsxXbW+++Pv2a eRi77gg4c+xWMRWsGSKoRs2erDZv29XU6TStGnBWLRcyYRs+FVXdbA+95fNiYteLeloDzlKqHHp6 +dn/Kx3Xm02dhqFKAnDG2JH1nlBBSResnjseNA2/rIC30Fh+s2Gimi3Vr9tXWdzNIoYyKann87oa nBHgtPyWJsVVRUDJRA+h9NhPBAAAAAAAAHDcNxsipWoNCmVuZHN0cmVhbQ0KZW5kb2JqDQo3NCAw IG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggNDMwL0hlaWdodCAxMDQv Q29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNl L1NNYXNrIDc1IDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDE1Mj4+DQpzdHJlYW0NCnic 7cEBAQAAAIIg/69uSEABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7wYMLgABDQplbmRzdHJlYW0NCmVuZG9iag0K NzUgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDQzMC9IZWlnaHQg MTA0L0NvbG9yU3BhY2UvRGV2aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50 IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxMjg4Pj4NCnN0 cmVhbQ0KeJztnfly2mYUR6MVmc0swWYxu8GAAYMBmVWQ2Kmn2caTNu6kad//NaoN6QOETf+pLp3f eQKNzlwhuGc+3rwBAAAAAAAAAAAA+D/AcTzP+X0R4BB0U6IkyyJ8kcdQJZ9EYolYWOb9vhjwIhwv 6KoS6UK1Vj4PixguwnC8pITj6WK9Oxyr3WIMw0UYTghEU/l6V9XuP9zPeyXdFoaLLLwczV4NFr98 fnr6/DC5zscUSdBfDWGMJIKSvBw9fP3+48f3L/fjdjkdj4QUWRKhjCJ8IFFVH3/78++//nh6XN71 mpfF3HkyFgmdQBk9OCmcac0/Pf/8+fz068M7bTYe9TuNy1IubSoLQBkpeDmSbc0+/v787dO9ttCW q9XSUXaRfgtltNB1pRuTx69fPkz73W5/OJ4tDGULU1kTyojBS6Gz2uj943u1UchdFKuNtqlMM6ds ot7ayuJRKKMALwZT1dvFUq2fR8ORWPI8V6xetXv2lK30KTOU1Up5KKMAJ54kS51hr5pURFGSlaCu 7CxbqF5dG8rmzpR1m7XyWpkMZX7BCUosWylnohJv7E0EwVR2ulY2uJsaylbafK0sk4pHw0Eo8wdO kMPxeCQgWHeeVZbQlVXq1zfD8dSZsgGU+QrHi7IsCew9d5WFHWXslA26LVNZQlemQNl/C+d5tznd massoytrbSurV+wpM5QJUOY7rrJoIpXJl01lk7nxXVqbT+8GN626OWWnhjIJyghgKhNZZd2BOrGn zFJWKWTPXGVw5jfmh5mlLG4oq9nKlvrrh6Gsdw1lxLCVBRxlze6tOpm5U2YpS55GoIwIG8rS+ZKl zHkwDnvXV1UoI4WlTAqchKLxt2lnyoxfrLTFbOwoi0EZFTaVXZQum53bkfVgXM4NZe1G1dpxBrGW pgGjLMYoc6as7yhDSUAEV1nEUtbo9EfuwoxVhpKABpvKctvKUBLQg1WWtJWt19IoCUhiK5NNZcaO 015LoyQgy1qZsqVMM5W5JUEMa2kqMAuznZLAeDCiJCDHhrKtkmCBkoAiKAmOjm1l5loaJQFlDi0J 4igJqLCpzLskYOMPrKX9x7MkmLo7TpQE5EBJcHTsKwnWylASkMOjJBi4JcEYJQE9vOMPdspQEhBj rcxYS6e2SoI5SgKKbMUfpZqxlh5bJcFipySAMgJ4lQQqSgLK7JQETZQExHk1/kBJQI2XSgIm/sBa mg6vlwSIP4jxSkkwQklAjp2SoGGWBHOUBGT5VyUBlFHgkJJAnzKspenwQkmwck/+QElACI+SoOfu OFESEGRXGUoC6rDHSLAlwWqrJIiiJKACUxIYC7OKZ0mQwVqaEExJkPAqCW5QElBjX0lgHdYyHqIk IAdKgqODLQmYMwk0lARk8SoJ1I2S4AolAS28jpFASUAalARHx56SQENJQBavksDjGAmspemAkuDo QElwdDjKPEsCVxnW0mTYUxIsUBKQxaskGKIkoIxnSXCHkoAwXiXBECUBZQ44RgIlATFeLAkm1loa JQEpmGMkDisJODjzGZQER8fOWrrlWRIksJYmA0qCo+PQkgDKyLCnJFiwJUEBJQEl9pQEmvMfItsl AYT5zeElQTAgwhcFDjiToFrMJEMS7/eVAptXSoJhp5IKChguSuwvCbRxOxcRYYscniWBOmhmwrBF lK2SoFAu5+IKXjMow+44TyMKRos+tjL9GxdkHQkch23KEfIPISbKPw0KZW5kc3RyZWFtDQplbmRv YmoNCjc2IDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAxMjgvSGVp Z2h0IDExNS9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xh dGUgZmFsc2UvU01hc2sgNzcgMCBSL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNjY+Pg0Kc3Ry ZWFtDQp4nO3BgQAAAADDoPlTX+EAVQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAACvAayAAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQo3NyAwIG9iag0KPDwvVHlwZS9YT2Jq ZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMTI4L0hlaWdodCAxMTUvQ29sb3JTcGFjZS9EZXZpY2VH cmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9G aWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDc0OT4+DQpzdHJlYW0NCnic7dqJcqJAEAZgmQFEEFQU 7zPG2xg1gBdyRGuTNZXabK2p7Kby/s+xKMS8wTRVmX6B+Wuajx5xYjFatGjRokWLVozxC3B1hFmW xQgBpUBcQlZkSRR4DmNEPAODE2ql2ayV8moqKQocJhyAYZPlobE0Z+Neu17WFIFwAIaVa/Pd09Pj 3lkbt71qJo7Iro+lyvzh+Pft+HLY22a/KBHeACTkx7vjx8f78fmHYw5KEku4AVz62np5//j35+CY 42Y2QfoBwFJNP7y+vb48bqftgsyR7X/QgPtfv58PD67eLZJf329Ae/X4c+96O3ve1iSWcICTgJm3 3+iG5W3vrvMS6R1AgtZf2Xq/O1m5dtACoo8gwyn1iT6qF2vDheuY/ZLCkw2AhWyj08jJqVLfdNzl sJKKE0XIsGI6lxF5Xi50ddtd3dQzZMcAwrzAswhxktaeb93NpKkmiL4GGYROLUesmGtNN641vcqJ pB2ec7AJtTFZu9s5gMNzACyka6PQIWEGYYB4qjJYOL7DMmmHQQDEy6We4TscVQk7/AzAJQsdEIdh XRze+scBwseRIAArZltTy7VmUA5x6BBiHgYBouHQBXZoUofUIXXoO1wM4B2mQR2ugR161KEN7tAA duhSh7AOZxb0PNycHGpQDDL1m5PDDqxDx+iBOVQi4NCAcxg7O7wDdxicS0UIh0zg0KMOI+IQZByF DlejWhqIQTQceptpC9bhdtYGdejZeqeQBHVo9krQDisKzLEwPJfCOtRtjzqMikMIBpd5CO8Q6HMl Lxeh52Hen4feetJQSd8iCANI2pXv0Do7BPn7Tsw2b32H8+/rMJ6ujpaA8xDxSvm7O5Sow6g47EI6 XJ2vs8A6JH+d5RIgdDgGdrg5OQT5XPnlEOo6C3UYIYcKD9GCi8NhWeYgrngHDreO2ckKABsQOpwu jV4+gSHWP18rq/cHTZXw5eqvAFhIaQUV5MdxGIATRAHiHfgZACEMwD+C9R/Zx6b3DQplbmRzdHJl YW0NCmVuZG9iag0KNzggMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRo IDExMi9IZWlnaHQgMzUvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0lu dGVycG9sYXRlIGZhbHNlL1NNYXNrIDc5IDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDM0 Pj4NCnN0cmVhbQ0KeJztwTEBAAAAwqD1T20ND6AAAAAAAAAAAAAAAHg0LfAAAQ0KZW5kc3RyZWFt DQplbmRvYmoNCjc5IDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAx MTIvSGVpZ2h0IDM1L0NvbG9yU3BhY2UvRGV2aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVy Q29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA2 NjQ+Pg0Kc3RyZWFtDQp4nO2WaVPaUBSGJRs3KwmBkIVgIotCEFBCDFuEorbW2uqMU5mp//939CRg RWiZtpPwifM58MzzznvuvQcH+9nPfvZzkILZHQzDCZLEsV3RCIoRRIEmdwAENRLxsm7ZpkzjSUcK NIrJKKXjtus2DJ5MmJfCKVbSjpq90fTDqGUKJJYoMIUjyah2BrPbL5+v+o6RQSSB4xiWVFUxSjSb g5uvT9+f7me+Y6nZDM8ydJpaYGPnYkiueDeP85cfzw8fA6/dqJUt01DzsigAF61wY+JRonU+e5i/ vMwf766nwXDge92zlnNStQ9NvZCTMjzH0Cg23RTB5Mrd2cPz/On+ZhKMg8vJZHIZjIZ9v9ftnNZB t2RoiiwJMcWMEYxsdS7vHr99GrvtVvvM9frD0TjEAn4Eum6ke2SZuprPigIXxgwn0f/GDA0Vi07/ +vZqcGobulGyK8eN00635wN3qTsGXQ90G8cVu1TUlDBm9n9jhg3k1ZobTIfNosiynCBm8wXdPDyq njgt0PUHo3EwmUwXMV+45+1mfdEqZbNVf8NNYSSbs1ue19A4yIkgqTRiWF4QZUU1Sla5Vm+2z3sX C93pWsxhq6KY/0UXI5BoVGqWjOD4hK/hNxEX0QzHZ6RcQSse2pu6Y2hz7zXmqFXvlncLFDLlsnmJ Xb0e3rChLsQs51XDXOq6r7q/Yo50y1Gr5LBVNEVsuWvCCwmlf/fFim6ahphBV9GKr60C3SHoToG7 iDnSheU1ChKz9XIL/3Vb7BEXtoAMY160StVNa9mqNV2/d+ZYsVxu67qCJCuasakb+I7OEfEdvmut Wluii37frWtsApf3+1a9LVG1XJRQco+TzSWSBBRjnH/mLrEwiT+FVrE7fcyuzE+9SHA/DQplbmRz dHJlYW0NCmVuZG9iag0KODAgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dp ZHRoIDI2MS9IZWlnaHQgMTAxL0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQg OC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFzayA4MSAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0 aCAxMDA+Pg0Kc3RyZWFtDQp4nO3BMQEAAADCoPVPbQ0PoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgwgA0 +gABDQplbmRzdHJlYW0NCmVuZG9iag0KODEgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBl L0ltYWdlL1dpZHRoIDI2MS9IZWlnaHQgMTAxL0NvbG9yU3BhY2UvRGV2aWNlR3JheS9NYXR0ZVsg MCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVyL0ZsYXRl RGVjb2RlL0xlbmd0aCA0MTY+Pg0Kc3RyZWFtDQp4nO3da04TARiF4c50plNMYSg0JahBwNZqWuKf AqGAEjXGAC1e6MjZ/0aQUy4xLOF73yU8CzinVqNFSdweCdIsb8Qsz9IFQ1IvWmU7ZmWrWbdCWpSb 271+xHo7L9tWSLLW5ofx5CRik/3hq+X8DiEvt8dfz6cRu/h2+LbdMMJqb3L+e14F7M/l6WC9SP8h NNr9k+n8JmLV7NP7zhNCdaOAVVefQQBBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASC A0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIID QSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0HPEOYREf7b aO0dX1xXfwN2PT0dLBDycvfg++znr4DNfhz117zbnC2/3pucfYnY2fHHrRUveNeba1vvhqO9eI2G gzedJS/aJ9lS2el2NwLW7ay+yB++DfKiGbOiUb8/eKglSRq1p6uP8N0CzGhS2Q0KZW5kc3RyZWFt DQplbmRvYmoNCjgyIDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAy NzAvSGVpZ2h0IDkyL0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRl cnBvbGF0ZSBmYWxzZS9TTWFzayA4MyAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA5NT4+ DQpzdHJlYW0NCnic7cEBDQAAAMKg909tDwcUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADApwEjJwABDQplbmRzdHJl YW0NCmVuZG9iag0KODMgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRo IDI3MC9IZWlnaHQgOTIvQ29sb3JTcGFjZS9EZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQ ZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3Ro IDM5NTg+Pg0Kc3RyZWFtDQp4nO1b54LbuLW2RLH33hvYQZCUNG29Jfe+/1PlgNRoZhx7k3Gczc5G 3w+PSBwUfgAOToE/fbrhhhtuuOGGG2644YYbbrjhhhtu+N/D7tXP3X63+7bkXwHwiftvf+Juz1wZ 2DEsxzH/Mh3Q7quW6dOfn8rdHj7xsP9W6YEX+Uvpbs8rhib8Dh07iusDw4m07u7SiyAK76DyB+DN aP5F7DnF0MXD16vtGEG3dHH7iN1B8ZJA477ZA6wd9rC/LiTB8HxbYfdbL6rjuxr/O6vwR2O3P7Ds O+nfMZKbxib/9cWxYxU39FR2t7bOGWlT2MI31xHDK6rEXT54x+lphytfpkRDO0E91IHyDdb/A4Dh SqrCv4+OHaslXe1LDF1W+5e9vf7e75/ZoGUH0Ua48cT9a8mXatC95keucqFjL3jdw+dzZVGi94JT n59OpQGFoImYTZ88131uab9nXv9mLk9vZF56u471uZG3Le5Y2Ql9/X107DijIEOksAdQH/y2t3d0 m/OiKPAsJ5muKR329FnS/Ia0vsjsGU4AlQDLEL7sudqBYWW/6kpP2bTDXgrJL///M4lgPewOakw+ //pQWzxzgLoSVIYB07pbS3T0zKWAzsvaHQBGA7Pw0ts6SBgYx7K003UjQDPrq8OlRVoA0oxoF10d /q6e+wobJprHWOVFzTAt13MNCcbG8Or6WxFl0zEl9gDPnh8WeOl8CSjSbde1NZFl2JdqvGiVy/2M PHVdHYwUTr/87ZdTaXL7PW+h4+df7htbgLqO53uWyjOwsXTDtN31YX8QNBsKbBj+nhGguyAMA0cV WF42HM+1NAH4lrS1gmNomgl/dOGwoxUt+krmmIOgQotUWhEEPRnvT01ovIeOjY1Ek604L4qqqTNX Zg+CERZ1jRJXN/zYU3lBh+emHc93QyALqpsUCBWxLfOi+VzN0/RwePrtJ1I4ErOxQZ5+/umu80Tm IAfd6eHpXDuSZIZUvAx1gdf8NM/LukGRIbCCEeQV9Bmb9Dd01+FxQL4q6V6KqqqILYmX7JhWaJsi SfKqqRJLPLCSFeWoQjAAYCDI8hzVdREYqlvf//bzsfYV9t1s6HrUzQQP44QLWxSNpMFD15SR42VV ail61IwjJqenRxyqml+2Xdv2beYo2rVa6Vkx/vy3z3PpPrMx3j/cncdU43gjw8vxfKwdRYUGm34c m0CTnRLq9QMhbagKspOipsOkjXVJj5sBj8eHe5xYZog6APQGw0j6aRzwdFxI32My9YkuiFba0PK+ CjTVrQgZoIQ0oeU3D7A0m0B9PxuGmc8PS4fqcekjXQ8a0qM0iX0nqAbkGX5NxgY18+PTGBluiXFT lN3YJZZ1rTYkjl/f/XSGz+QvOwWfj9MyV44kexWQOcNPWbHDOC2AwsLWgw7IqlE3T8iWZDOIk7wF IVcH8aGuxntgw/ERHuqi6kkXm0653E1N1Z+e7uFPN82Npxpxi9uygNkqXTPCd6e+qnpo3nOL5aeH ITHF9+8UwyqO9zj1gnomuePk4wgcaLqm+w1Mo5viqYmAGZCJnXhYRpSkzTQhz0XXaoVjpeSE44sa p2wcSTfOfWSYSYfbZpwqWxJV03Hjej42vhkOd0sVeNkwt74sKobthtV06kM76qc2iar52IbQ9TwU cQb8lZ5Xnc5d7Gfj432f+Em3DLHpVdNUpwmi0+gk491U+F4+zrVvRf1pys1vmVL/hI15qRzFSGHM QViTPlLhROFlryFNFCAyZoakRcNxiP1ieVjo2pjnOvDQ8lwNOUbYT417mQtgY1gG1BBSBiHCXVEO pLJFqh/DrDvd9aEV9kcgT/WaeQgVQTHdMG2P92PiJKCt07AcCfI9oHuqczQc58r3q2UqLM1tTkdk qzaaxsyN6XIo82Y64cRN8LELNC1opzYwvHrqw/dZOFc28olkmqBEeG6iGFoD5QdnvujWsJOjesKx woluA1s1qM4/3eG2HQjoCre8VqtcI+jggy+G3MpGl+b93JeoxyhKe7LulDhH7fTwgCMr7IA8SbSq GceaYoU5cHf/SOCjxvPcoHbsU8dr7p5OQ9PiCeeeh2AcqmiWM0k1Qc8Iyf1senqYuqYjUxs6yQDr TxQdGHRggBKh9sD3sUFwonByOMxNnHQrG7sLG0nczDh6xcYTbM4SVXlg2sW1Wg1stG/ZAGLDal4I 1XduDFS5mpNRDUzuNzaAH0GgA0hNK2mgYLx7JCmw8XA/Y0w1ltvcPYJiglMl800XEZhtQc/JmCi8 mhJS+Nn8eAfKB06V2DLjnpSmINjVhQ2wB5h3kPGGjfiZDVgbfahSE4fulDYOaxivLqphv8B+BVU2 FqHvgW2gmC/VVjamxnu1U+bGd1KY7oelBi0BVMG50019WbTHuwHYoOQJPB1A5oYNwVXRLPfARkoe Hk5kqEJDsdByHvIAerM0xS6BDZnX105XNnIPVMVcx1AO1pEW9aQw+QsbTjX10XvO19dsjFc2wqCa SOnqqka1KJxWfkFg15puOd/hGPTaMmSuZRqaLBov1WoXhOfhlRZdGfK7x19/XnITNvNY+U5Oli5L qvk8gN5oR/TMhkdbzRM0wZHsZdPjw3FsC1+TQSMtXbL2JklWMXYBsJGNGxsjyd2gmQkKLNPUFTpd 48oGGttAt2EXF9Y7tSi1zGPdzDDQzkl068OE4gWjNI48J6zB84IZnUeUFfjufghNetxWCUyXrUrG SzXkaE5FNevzCbu+U8zy/OtnsFIUr8HIc7LxiFHRHc99aAYNLi2BhwHAsZTgE6mLdjnjxIPV/whr o05djR72GMVBABarZOa4BTa0FPeRzCkJxqlpZ2CjZGHgu7qsBi3ODV6wStz4qpmRY//OE3bz2jSw ryowukW36jLQ2micxr5FsesXTW5rdg46s+vJEWZbNaIG902F8tCQX1czZR1YHAtXotOx396JCj1H kSWITtFkthE0E+k7PE+Vp7tFkxo8BwOgxhKclEM3TDOcqjmsjYWMY194upW0a29ZoMtgFCJX5NS1 U04OmibUVA8NuK1QkTjAOGpiauyBr+0AN90y1e+zvjaPXpLtODL5A2+EqaeKqpeDgQfmtmEGia9R QxHs4aqqUQTWnxGWNdjQMD5Rdl6qKbzk5G2bOxsb3PoOhpbUpSezvBYkniYZUXVpCKgMYldhWToA sDMD1LZ1Rd0Bt5jOc1e34wxzr1rx1puniYobhzrPittYBSuOLZGn1m1dU9NdlowwdiQWHO840AUB yOvQu9jYoj0Sx8m6Lh7Aa9cNlT+A6+qFoW+roqgaqnBgRcOFreE41HlaXbgg8B1dZN9UA6/K9ANn 2yk7ZnvHCLptKix4Yho8soLm+LCqHfD5OFHTFfDXtgHwqr0VGLqLYIVkYHFR60IUNSiA3jRw4BRd g97YrVNW0nWJZTjZdKHcNWVubZHbU3eQjlPQvcB7l9e2Ou8cddm5zSfmqO8MXrQoyRK4zOBD02dw tyUJPGWeOvyrvy1L4leqQYF4ifdd3tE//CYCLe0ZFhqiLXE0MMBRX/55AFuBAL4ZmqYmjbJ2GkEL HGiBvDr3W1yWjo52+vJnHQ3PUuf/0uIqx3A0RPC+ANMaJd49x4ovYfFLtGV9vz5vMZr9y8MWi/lK tWtk+KXqK5Gt7haPeS2wuxYwnA6GWl+jqsdrtOxNb29avP5hngd7FXge5+9FwH8g/mOdgCZz8qZt QFmA33+x5f5Zb3/6YPx3YwfqB/zZJA4c9Z1xzb8iQP3Iqq5risD+gTH2Py1ouJVdsxE3Mih235Ma uuGGD4z/gbz+13A12L54++28/sdI238PNqucGvNvD0XqhWhfOtWbhqTZtb/oGQqulOkF1NF7k4en LnISGtybTDbN5VN3g1NMQ3pXbOqDYMcqXl6DS555b2JvNHxCYxKv2dgdBBX84j0jWmGgf+N2wEcG uO8uwgR3LQrpBY9r2nzHGTRetV0B+LTtEUYwg9Dccoahwe+vefVPn15n4f/Ln/RvgC4BPPdlEoeO QrPa7JYp3+85oxi7UOY2y5JeMGF5PW671JR40fAcmsK+Sj9n4QWaZP+4dOw4s5zn2jc0VeaZPSvS tLlrqjzLmwXpQ1VSNYnb71lJVWXVb+/ucWqriuECG8yL9CULb60XAP64iy8/GjTyviy1p9JJBYVq x0VVV0VoSqJZkj4yDD90JPYgWoFvO/ny62/3fWIbbhwaAvciLXI0C1+UNB5ovS8v9GfCjtWz6Tzm 9L4FcxCdvO37bsBtaqk0BxJbXlEnOs+pYVWGfnH87f8eh9Sx4wp5ivIiba5ZeJrzJ332xUH0gQAH qd8upxHBaqAh6x63RYYG0sYWzY/FTtSONFmgZ30buzF++jwXrmFlQxfBv1fpiGbh7+cWNWSmScP/ 9md9L/acFrfzce5zV1X9hnSJbXolIcjzgY1kS5DS1MnYRaZbnc6Nq0hmPuLUCV6kS8+vT3d94kXt MibKx90qe14PEF5OBNHcFEG2JKj04kEUVMCGmwxzTdNqVKXqZj5Nuc6vGUSaZHstXS9zYSnmmiP/ wHqU4RQ7buYzKWNESK5zB9Frpy4Jq21tzDVNQNNEqmZkhKQqy9HschYUb6UnnKiClowk1z6umUrD VYIetqdTX9TTlGksI3rNhY3YiXtgQxQtNAEbekpIdmEjp2y8lQbrRIkxUPRh2dhuO4pWMZ9xWU8z sgROofcz1p0S22EHalFVvHbBKxtTYVx2ip+P01vpD88GWNuqrqmai+ZjlxV4Bl2pOTkekU+1aGz5 zYwzx83IeYxU2AdgmyiSAWykLiybN9JdsLIxZh+XDVb14iROin4hhU8vPDRZnHcjnLBOgdvQsItp 7oqiO93jUFXD4TTmrm7luE8sryJvpQOJU6Iepx9Wi+44Pao6emtxrHzdiBoy9l0/gPWl0Ly6p2ph O024H5el9WSJ3mzoEsdJmjrQ9PALaVdkJb9uoj/wUvqPxerQN33ft4WvCqBNUdu1DaI3XmUa3xAE I667rqnrKjEEHkzSrk4cw0tiUxT/QZo/8Gac2B/WNN/tOdUOYK/4pswxDA8PURQ44Hoxa+yLPQia G4Q0Ba/DO151w8AGV87Q11vbX0gf9gdJN2T2o1rm6//GkRVVkdZ0PM23K4okbAl9jmOo1y7QRPqa m1+FZRG8/C3J/qX0loX/yDFCmg8/HGiUeH16zpq/yZdfsvzXh5dc+5fSa/r945JB8TY79o+psjcv vgytf/Bvv+GGG2644YYbbrjhhhtuuOGGG2644YYbbrjhhg+NvwOh0PmGDQplbmRzdHJlYW0NCmVu ZG9iag0KODQgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDE3MC9I ZWlnaHQgMjEzL0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBv bGF0ZSBmYWxzZS9TTWFzayA4NSAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxMjg+Pg0K c3RyZWFtDQp4nO3BMQEAAADCoPVP7WkJoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAALgBqGUAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjg1IDAgb2JqDQo8PC9U eXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAxNzAvSGVpZ2h0IDIxMy9Db2xvclNwYWNl L0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRl IGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTIyMj4+DQpzdHJlYW0NCnic7ZzrbttG EEZFUpQoWff7xZQlW9ZdsqKbJYsSqcBxAiRx2zQp4AZ9/9focsmkv1r0xwqeD5jzBIPlkDNnuLuR CMMwDMMwDKMO7bUD+H9oumEYOkKwumklk3GTfrBaNFms1UrZZIx6rHos1xpOh516PmWZBuVY9Xix tz15u3nPLmcSlGPVY8WB+/m3z0/OctiuZiy6oWqxfN/78vLy7fnpsBraubj+2hH9G5qZ7R6/fP/r z2/PH07bYf2C7KJq0XTn4ZeX7y+/f3p0t+NmKko10oiRam0+fv3j66/vndXkupwku6YRI9lcPD0/ f/r4bjdpV9Im2TyN6Ina7PTh3dvHR2dq5wi/++KDWh45b53NzvM2t+UE4UjFZ6q72S9H4417fHOV i9F9+uLlvxzPBy17uPX20ybpRLUKdrtRyDfHD95uWLug+5nSoolMLm1ZWfvOEalaIpyqmmHGTMOI 5zvL43HRydMtqBFN0zVNMxLl243nzOwM4VSVaNGL2nDnPYzqhFM1QDfTlzPHu+9RLqkBov9vvzm6 y+uCRdxUNMMqdtfuYd7KEi4AEs1IVgeiAEwaaZP2ooq+Ot2Y7L3toAqQqtnW/OCuu0XKXZWPJmrr 9VL0Km3KvYpEpGq5dy8KwCXlXkUiCkB9RL1XCdDNjD1zqLfVEj2eby+OxyXpXkUiCkDpduM6d3aG /FsV9Cr7cT1FvQCIXqU5FQWgXwEoALkr0ausbugXANGr3Kyoy6pEFIBKn7ysSjQzVR/vMQpALCNk 1RWySj1V/QIgZbUNUABYVtUjehWWVdUEsuqxrCrF71VYVhUjUrVwvWJZVYsvq+QH6wG+rN7ByGoH RVYTQla9A8uqSqSsOiyrSmFZPQdCVhswsppt3R08GFl1if9Zlfiy2sOR1RHLqmJYVs+AlNUdjKxO UWQ1d4Ujqzcwslrpo8hqimVVOcFg3WVZVcmPwbqQVfqpyrKqHCmraxhZHeDI6kTI6qBKvwBIWXXX ELJakLKK8WdVDtZBZPUBTFYBepVcexHK6mvH8t+wrJ6Dn7KK0auwrComHKw7UxBZRRmsC1k9AMkq yJ/VMpas7jFk9RJHVts4stplWVVMeGQJRVbnBw9CVoMjSyyrKgmPLIHIqg0jq3kcWS3dgshq9IJl VTnhYB1DVossq6phWT0HwS4wkD+rSLI6wpHVGcuqWsLBOoisVllWVRPKKsA2YA1JVpNYsnpiWVVK cGQJRlY3KLIqB+uTBsyRJRhZ9dYYvQrWkSUHolfBk1XKl0EGhEeWsGSVfKqGR5YgZDXYBYYkqwWE AuDL6hyiAMjBOkABCAfrO4gjS0JWRa8CMViX92ss2oSv1w/4534NhAJQH/uyCtCrmLJXQZHVpZRV +qmaYFlVDsvqGQiOLKEM1v1dYCCyine/BkYBgPmzKnoVGFl9YFlViy+rC5ZVtbCsngN5ZAlGVm9g ZFUO1iFk1R+ss6yq5UevwrKqEJbVc8CyegbAZHWCI6tzFFn1d4GxrColkNUTxjbgDMw24PhPWaX+ /MP7NfxUJb6owTbg432vRH1R/V6lMd6s+5UE9Uj9rTXN3uCK/DfV3wYcy5SrhST171TED9W0klaU /JJG/FB1g/iFtcD8DcwFEbgNCmVuZHN0cmVhbQ0KZW5kb2JqDQo4NiAwIG9iag0KPDwvVHlwZS9Q YWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9FeHRHU3RhdGU8PC9HUzUgNSAwIFIvR1M4IDgg MCBSPj4vRm9udDw8L0YxIDYgMCBSL0YzIDg4IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdl Qi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDcyMCA1NDBdIC9Db250ZW50cyA4NyAw IFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMv Uy9TdHJ1Y3RQYXJlbnRzIDM+Pg0KZW5kb2JqDQo4NyAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVj b2RlL0xlbmd0aCAxMDY4Pj4NCnN0cmVhbQ0KeJytV9uO2zYQfTfgf5hHMoi1JEXdgMUW2EuD3NA0 cdGHog+qRdtCZUkrybvZfn1nqN3EWUurSPCLTImUeHxm5pwhnH2C8/Ozj1dvr0FcXMDl9RXczmcC hCOEkEqJAAIlwNMCKjOf/fkK8vns7M0XDzb1fCZh822x8KVwvR9Wr1/NZ7/PZ3Dz8QrgYCd5sJN9 VYpARSA6trpc4na/StDaERqWa9oTNwQJytVOpEF7oeNFsNwRkI3FFlpsAt7MZ3+xz1wGzNzu04pL l5mdyXnEmpr/Dct389nNshuhGovQBSWdyP8BoXYdBW6kHU9+x9fCOhciDC5exuCOZ+kYQyB6MbCb r2VR84VmBvgiZCsiqOALl2WZWTVceswkOBOxsqBVNQ9Zs0caJb6Q5sBdVu/5QrGS5j1WNVCsgUa7 OKdvPQC9lqRrLgVbc+UzU9EQQ4DXBmd9tq/pCwTAbQHELaKhAOkJARLPUyiIHKU0uEiScDtCdCkH QuRNCNERCimkE4Q9KCh/kbdkv3oMlMdKUyGjISuqHdcszlfEnZ1Z4T1GVGoiF4drutqHWYbTGNQ0 3xDfUNL1celTSHFFmnOfHX6cS8WatMgHouGfrlyw0OWkcglOVy6dGNgy3ZnswRbE81JB5uxdbvPY Dtc2+ZFQj1Jftg+rXcyDnyE0PGV6y8jxJ6V3dMr07kTB3pM85wXm2j0QqekOCdsZTrrRZh9dTMZb OUEi77cGaUYBWW2J0jjfoFh4zD4qVrYYMKNDzV4DKn2cJ/SECiGu/4U2t201FJjq9wNhkOIUDHg6 cITfx8BiCMMEt+zA4LmO7I3Cvnwi6XZv1aQm9ac8rWEI3mirbOH53VkihKOP8cU15MZgDiQmGcIz 2jZ7tUgF2tHRFC2So+2pV4y6QbAPVCJ36MhoqVgU8YaGWCAo6IYc42taW5NFwYemXZJTZOtW+a0Y NVBWth7orvkmaQfiNuTCcrQBvqBTysOZLukf1Ck52n9eEKpuGOwT9S9x1aRkqbZIsrjCsXUE0qlt UVsPjbPKWnacPFirTclIy8zQD3U+8lHSqLUK2D/49AGaLb6K7+RJSa5RpLZ/aobYH215/amusL+e luqjrao/1TtBsD+IVzRd23/aFtFmchLbJKYsT9L/uHItpT7b2dRNTFZTYOSh+7Y8Y9fZlkjZNj51 3Tr1Bp5l/7MuuNfLByVyio8iRaHu4EgoJwqOODr8kya2hJEdPjUilif8q/vaDB18RjveCxUtg9DR /pSKVicxvceK7obBrg3G8y6lvtnA2+shYqYcCXuJ8fRUYqacCnuJ6YTBvhTr5p40CgWO/AQ+FPGQ 7apTHsikK6bSc8oTWTcMdoXdu2brdLO37vmzZyQ15ZB03Cg9UST8qRRNOSj1NmzdONhvzdae67Hz UKz+pYOa/wE++tI6DQplbmRzdHJlYW0NCmVuZG9iag0KODggMCBvYmoNCjw8L1R5cGUvRm9udC9T dWJ0eXBlL1R5cGUwL0Jhc2VGb250L0FyaWFsTVQvRW5jb2RpbmcvSWRlbnRpdHktSC9EZXNjZW5k YW50Rm9udHMgODkgMCBSL1RvVW5pY29kZSA1MTQgMCBSPj4NCmVuZG9iag0KODkgMCBvYmoNClsg OTAgMCBSXSANCmVuZG9iag0KOTAgMCBvYmoNCjw8L0Jhc2VGb250L0FyaWFsTVQvU3VidHlwZS9D SURGb250VHlwZTIvVHlwZS9Gb250L0NJRFRvR0lETWFwL0lkZW50aXR5L0RXIDEwMDAvQ0lEU3lz dGVtSW5mbyA5MSAwIFIvRm9udERlc2NyaXB0b3IgOTIgMCBSL1cgNTE2IDAgUj4+DQplbmRvYmoN CjkxIDAgb2JqDQo8PC9PcmRlcmluZyhJZGVudGl0eSkgL1JlZ2lzdHJ5KEFkb2JlKSAvU3VwcGxl bWVudCAwPj4NCmVuZG9iag0KOTIgMCBvYmoNCjw8L1R5cGUvRm9udERlc2NyaXB0b3IvRm9udE5h bWUvQXJpYWxNVC9GbGFncyAzMi9JdGFsaWNBbmdsZSAwL0FzY2VudCA5MDUvRGVzY2VudCAtMjEw L0NhcEhlaWdodCA3MjgvQXZnV2lkdGggNDQxL01heFdpZHRoIDI2NjUvRm9udFdlaWdodCA0MDAv WEhlaWdodCAyNTAvTGVhZGluZyAzMy9TdGVtViA0NC9Gb250QkJveFsgLTY2NSAtMjEwIDIwMDAg NzI4XSAvRm9udEZpbGUyIDUxNSAwIFI+Pg0KZW5kb2JqDQo5MyAwIG9iag0KPDwvVHlwZS9QYWdl L1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9FeHRHU3RhdGU8PC9HUzUgNSAwIFIvR1M4IDggMCBS Pj4vRm9udDw8L0YxIDYgMCBSPj4vWE9iamVjdDw8L0ltYWdlOTUgOTUgMCBSL0ltYWdlOTcgOTcg MCBSL0ltYWdlMTAxIDEwMSAwIFIvSW1hZ2UxMDMgMTAzIDAgUi9JbWFnZTEwNyAxMDcgMCBSL0lt YWdlMTA5IDEwOSAwIFIvSW1hZ2UxMTEgMTExIDAgUi9JbWFnZTExMyAxMTMgMCBSL0ltYWdlMTE5 IDExOSAwIFIvSW1hZ2UxMjEgMTIxIDAgUi9JbWFnZTEyMyAxMjMgMCBSL0ltYWdlMTI1IDEyNSAw IFIvSW1hZ2UxMjcgMTI3IDAgUi9JbWFnZTEyOSAxMjkgMCBSL0ltYWdlMTMxIDEzMSAwIFIvSW1h Z2UxMzMgMTMzIDAgUi9JbWFnZTEzNSAxMzUgMCBSL0ltYWdlMTM3IDEzNyAwIFIvSW1hZ2UxMzkg MTM5IDAgUi9JbWFnZTE0MSAxNDEgMCBSL0ltYWdlMTQzIDE0MyAwIFIvSW1hZ2UxNDUgMTQ1IDAg Ui9JbWFnZTE0NyAxNDcgMCBSL0ltYWdlMTQ5IDE0OSAwIFIvSW1hZ2UxNTEgMTUxIDAgUi9JbWFn ZTE1MyAxNTMgMCBSL0ltYWdlMTU1IDE1NSAwIFIvSW1hZ2UxNTcgMTU3IDAgUj4+L1BhdHRlcm48 PC9QMTAwIDEwMCAwIFIvUDEwNiAxMDYgMCBSL1AxMTYgMTE2IDAgUi9QMTE4IDExOCAwIFI+Pi9Q cm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA3 MjAgNTQwXSAvQ29udGVudHMgOTQgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5j eS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyA0Pj4NCmVuZG9iag0KOTQgMCBv YmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMzM1OT4+DQpzdHJlYW0NCnic5Vtbbx23 EX4XoP/Ax3MCaM3b8AIEAeJLgxQw4NZG81D0QVVkycWR1Mhygvz7zIXcXe7u2WNZsp2iL5LI5WVu 33CGHKknr9S33z55+ezH50p/9516+vyZ+uX4SCvdaa2NtTqqaLUCr9Xt+fHRT9+o6+OjJz+8BnXx /vjIqIt+sA5GO2hGv/3m+Ohvx0fqxctnSo12MqOdeKrR0WalF7Z6+ga3+4tR3nfaqzdvaU/cUBll ve2iVx5SB1m9uSJCLpi2xLRp9cPx0T8336un53dbEzb4w2zOb9UWNj9tnd+cbk3e/L79l3rz1+Oj F2+WKbUDpS4oZ22X1BX/bZLuklc7JMjnzs/aMnY3mod/X1aGrUG6mVVcrXK9kz9F9MkZQz3j8fu/ lOmXVWzG6s4nkRSSo4meziZlInQhqTPc9cmPV6cX5xnU8xuFrP+vcZjRIIRBNA0T0EKAOLYWGRzz Fwf+nrw6vbs7v71WZ+9Rx0Zr9f7sesyqMY749KbLYWzAuotW/Ua/yUo7nz3+jM6pv6OJoSn+R60t 8nrBrtz9EWBSY/6QUZHIL7IdE5s/g9GI1b+4/vm/2xO3uXm39ZtrNPm7A4buB4KsjR3YwRRKe1C/ Q960n3f0RtCsUIxi1RTYz+wmfmdXZ00NO4zt2lrXLdi10WZQ/Gfh6OS+dn6y39Bna41ZThGJErUH VHYQ14dgxuFdy7Pbb+xBjL1lnWyVWjOLPzhuyajhwUZtIXTe8y+YG/WrrfWbm/fkx+8+3JJPP1cH zDo8nKSAEkBZO9/lOUmvz2+3J2HzKyIM/1qnJQ60FH1rMD6OTWFOVXZd0EKL9ejgAJUQ2O6D63Ju tF9dne4czugAdY5uCk3n9qL47KBsTF3wAgLoAGrHbtQREGG70YzSRoO0Jnfo/GyyHe5WkRRxTOyC 5UXKiOg6E2uHp1URORlNNnXJ8WcN3OId0bq8OqPBqbO0JTp3y5+941aQwdlwKzsejPRqxwxApZ/b geKCnaxGMxILpHTQgtgBQgttlkxnbU8LtmIlhShFVg2NFS6w5UC1Yjhj0bxd0Hh6sPWZEDpH8s1d jEOQU2IbwYA4+ttDHj7Pzc8HCwfNz8fcmJ+LbH7oEXDG2PxyMb9qE/grBjISA0aOZu7YjTqADtbd aErtuKRBuBFK3hlSwNVgj7bqt45Ap4xSLR28DOoFZYeRoeUGWiI1eEvbhUAqo44Y+Pgwnj9LI8pY 5M0ix2ikZ0JvzsyAWHnfAV0qHJUpmQysdARuR6GE9nJoiL4nBVvJVlIsM+porPCALR9VK4T9lmb0 I5ga4chSnGhnlvbLh+2JJRd3AgdjZjMK7x14Oj+sC8UWHPrR4GqHIwh63jQMLRKzIWZLhwmxSLXv QBgmVdZi8WFLtiotmo0xAeqvfs6GjpY6tbZ4ZRosHWXv3dBRSJO1KtkNV2fjcEDEfo9woOhp/6dZ OKCJHdJZIn+dUWyeD2dAS7ZjRJpRCPT/o4j1SLNPLWbtqZwjxZWj/MIZdl/kkdtI0+yPukyJulqB Xo06bAehyo+Pp4EpaQ3yq5+rgGRqI65BfiNVtfJudTFTVavJVsuNERRfJOHiAufpAOdFna0VTtU5 0XZrCXs4r4JphTaTaSvyVh1T8x8YnZjn1efc9fNJ6nIKs6svajctp7vlZMLYTznRMGxsb4kcnpyZ 8phA4ec0fH/2cus2z58eOtBG2TpYQ87WYxBu2I+WDkcxJccGUVvyw7OOMmU3XeOe2WRNjReyycVP swQa08kgjg1D8ohnPaBjEwW70Pi1PPi1r8229d74ZbaXP83YRneOac4oiQbLjtxhutCcmtb0aRRK VNFpG/jSh9Oolm9KjwMtiEvX7PnAkEVb949i6ziQ0nOPn8zM1L9//57yhHO6C1LbtHl5en16scX0 4er8GkFwdyiTNg/P7gFzK5SCy4Hi31kqfbP7cPcOKbq5PkRKmOHRoXqdHRumjnJTU+1y2pYJu+kK 97rC7E1vv1F+PBQBE4oCRSQR5TS2STeD4iNzXMADLqDPv0f4KhNWPs2YzroyXYFoAh0HTjsyizHX 0CMxglOUxdNWKJ4GisxnDzPsmSFxccQiEOPDjRx3QBV6oGRuauP/2Nq4+bC7xkTK6s3pv9/ttn7z juD3+0H8PfwyAZyWS0xHSemUNnYI5A3ukCZV0AgfgcY8R6M2dDk/2KZ1QLHEYIyzjjJlN13jC9+1 7jsdKVm3rXHGOSQ/E9tfEZR88dAej7kHJWg6Hl2mn8HBGJSF0bXzcc+QJVjah99uQMysANTq0jXu zdu737bGb05vtwYOXyvbT3jBXAajBUMx8mOB0doZGOm+DMYxGyazdIM3GOGso0zZTdf4oi+Yew5H A0D38SOLdGaGxEfn+esj0UCgu9Ex365HYqCnUH6RpBvGJlItjK6dj3uGLCLxER4uMStEck2m68ZZ QnZDj5Vv3118kBMSw8Fi+Ach+Ukx9BIkDWYE81TxkxEJM0TS7XETuiVoIrVJswzfTef/GdBIJuPN ATQ+Kr8FPd5mA/dBokxY+TRn2bXpoiUYJsMPImOGhyjVcmFAiLRPjGEMQ+ZxDYSLAxYh+PA3TXQ9 LFcMBCmFnFj60/Ptid9cntI766/vbm7RyhXi8OXNNRUT3GHueHNLedr1BSWUB3H5SSH1PLeV3NFo /rWQOyJpH4vINENkHEdtxtJFyMgeJ+04jtfinyZEjR261PaAmIeoj8Co0OasSeEeDkfG7/8y4xIY BGMAOn73RtNwuUmO3RCR5kBPKZBIoDY2EakwtxaQLo9YhGB+OARBk0/zuUsLEHxzeUvR6PkpAU49 P99GKl/DwPSs3JAcQp17hIhZEGdTZxco/PjbGmdmD882BZ3HFyVzokzm6ItJofdSzFoTmb2F2DXa 92at6gGspmoB3IMKCuia21u+J4/8fE3X3J5vQWw0UkXAfh4n2M7XI8d5T++29AhvoyyCWRFP0SBr ZL6Nj1yWQx2oXWlTbRw28MjgCogoLcMElNtw0CznyPUc1OI8xfPVOS4MUg8hY5F6kLFyIBL1PNkQ m9yB0WIpirC1wwvxSCy1UM/Uops4D/Q+QK0Esj50RgokeLCX3TLR30ph/1O0s3N9u5DdeqEB6dvW V82kzX5916iXUIv5MqrCQ9VskAxPfBVrllStSe7FkyEdzmWq9Ki6DTIrkvQb3Zpetfg9ULldVS1V ZGAHiLoyN7KolqoCcEMoquVkng0liea5Qa+JpGdRXBTJo0GWMhlXqY8y12TpQCQaKW+xtYONI9J9 OrV85lbihpbaHlMUy28tUitDPOfIDZRmK4EVvboFHIPJh/QKdCc9KiAZKRaayNHDSLNUihMiMXxV hMNy1bnKhswUhWVcf0Yl1oMdNJu4bCgEqqdoNeur/EjAQIUWRdU2c0f0DD0uNwKazuqSbzpV1HpB ZjEDnuqIWbYZboRcdcsS1lRaUVELgtpUtyanEFKpVKr7BYqEeHknAnGymRbGsjwU0uzAHazPzMLB FuK0lcKKdv1Mu94lu14HTqB1gtqsuUixKNekRDY5Vm4cKddQ+ocw7XHLugv14ZFwG0bCYNwCTvGl Uq3glgqyAt9PDdrFSVW77NTIJByMfDK2vUg0C6w1igxkpk89aiNLO8tIMld6vRQzcKII18PWMPES OlXYBkZTsTJezVY6CKiWKUf1Ucs5brG2IhcbBqau4JYq1gJFNQxVOkkCJRmqFcGKamHtAF5zyPUA DozhqlvjKA4b6zb3utXEk8F4NFTdsmx07BXLohE18lGLcZfJBRflrCUJA2tvn15F4rHxx1SlyC7W y5bicNn2OZQsoCWPGXx111QvGATCVF2WuBVSPWvJodJ9vu9Ra8Qt1ZOVCzF1OU747JUOAq1nqREn jEqQytZMQ86EUfIvINX5dLhabjmrWiGsaDbMNZstfMRRWxIIi0eh6TXrOIoZKRbMSLExUiWMN1Up VKRGhtFj1oTqsotuEREUYMiIyyJRkcGwzFS3jHyg+r2qbFFKKmcmcMtacdDAdbCx94LSNlG8YGDY ZXGCTj5V1WrD+4TeITvxQfVs9YwtJHXoAKGdD1vPq0OSMMp10oBQnQIZBsWtRImVi95EtYKtDFZU G2dJahHpkL95qOTWt/ZpR5mym65xz5T1c9UcePS00BwTMH/o/FxsU94Z78O2TFj5NL/L5X9amtzl EihsG9PCcIVEt7cXU1bXstY9Qxb/6eSTnhDnVzFUuIpcIHd4ck0Twx+vz+gW5udaVXDi711q4B4h vZbk1ZO5PSB39XrNwa7lrr2DjZwC1piXKzXHml+t2We3izDB4EqH3u8mjiSdb/xuLqlo9bsYgPU3 NuxzImcOKUz8ruv9rqQmtu/I3Kaji9xu4GhbF7cbuQXQ+90oJf3F70rw63wffUYusq6eV0LhEBrP m8m9Vs+bmdiho/yLgRHHm+v/G/TZb6TouXre1CdBtuZHFPE1Qmgd7x/8vwfiDQplbmRzdHJlYW0N CmVuZG9iag0KOTUgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDE2 OC9IZWlnaHQgMjA4L0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRl cnBvbGF0ZSBmYWxzZS9TTWFzayA5NiAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxMjQ+ Pg0Kc3RyZWFtDQp4nO3BMQEAAADCoPVPbQlPoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAA4G+ZjwABDQplbmRzdHJlYW0NCmVuZG9iag0KOTYgMCBvYmoNCjw8L1R5 cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDE2OC9IZWlnaHQgMjA4L0NvbG9yU3BhY2Uv RGV2aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUg ZmFsc2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA0ODE+Pg0Kc3RyZWFtDQp4nO3d204TARhF 4c4MM1NEnBYbDGoQpbWEQ7xBEktVokYToMipI77/i9ihROP9uvibrO8JVvYL7FZrgSSh/a1Ms7wI K19K56VJVq5U3bCqx2V2H5qW1cZWfxBU//XzTrtZNMlWNnYOR+OgRu93X6zmTWdebR1+PT2fxHT2 7Wi7W9x3dvuj0+tpHdL05nw8fFqms86iOxhPpndB1Refdnr/Ouu73zHVPz/bCbKTZSfLTpadLDtZ drLsZNnJspNlJ8tOlp0sO1l2suxk2cmyk2Uny06WnSw7WXay7GTZybKTZSfLTpadLDtZdrLsZNnJ spNlJ8tOlp0sO1l2suxk2cmyk2Uny06WnSw7WXay7GTZybKTZSfLTpadLDtZdrLsZNnJspNlJ8tO lp0sO1l2suxk2cmyk2Uny06WnSw7WXay7GTZybKTZSfLTpadLDtZdrLsZNnJspNlJ8tOlp0sO1l2 suxk2cmyk2Uny06WnSw7WQvaOQ3a+d+vev/47Kb+FdPt5ONw3pl33hx9n1xehXR58ePDYK1IZp1L qy8PRidfgjo5frf5JG86s/ba5tu9/YOQ9veGr3rL2axzNuhy1Vt/FtR6r/OombMJzYqyHVZZZOm8 s5UkaWDJQ+Vi+APeLcfFDQplbmRzdHJlYW0NCmVuZG9iag0KOTcgMCBvYmoNCjw8L1R5cGUvWE9i amVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDEzMS9IZWlnaHQgNjIvQ29sb3JTcGFjZS9EZXZpY2VS R0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDk4IDAgUi9GaWx0 ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDQ2Pj4NCnN0cmVhbQ0KeJztwTEBAAAAwqD1T20LL6AAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAOBtXy4AAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjk4IDAgb2JqDQo8 PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAxMzEvSGVpZ2h0IDYyL0NvbG9yU3Bh Y2UvRGV2aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xh dGUgZmFsc2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxMzY2Pj4NCnN0cmVhbQ0KeJztl1d7 qzgQho8B0bsRxaaDAIsWO07OZtv//1k7YDunOVmyz+aO7yZRRoNeSaOZyZcvq1atWrVq1apV/00b 0DtG5h3r/7M+w85imLsLbVieR/dNF/uGecNzsRgkyipIlnj2zpc2rKSbKs+87c8J4s+em3eP9Zcl kLIN9vv9zt9q/J3dMLwZhFi+R3dDNCxd+MG+YTjELT6ZDSM52YE2dVVEW+nXhWAFnJNQR28iIM0N HIX7zr5heEVT7u3njU2oe3oaaU3y0JYAfb7aa/zB7yxSg5omJn+zXD98G8ByMwL6Zt8wSMMBvnum dxE4Pe6PNN35rq0KHMfzvCBKl8vdsEiUFCuiXWoJCF0swnTCgMaLEkzjGAYpNrYkxF3tPMdyMs7q 3NOEN2/vp3M0kn7Isa7K4M3LumnZ2HVMCTEMJ+mO64dkGHJLmi2Oiy0V8BheNh3XmwYcki2YLkg3 uyKIVtKfx9LXhUXnMCP0qa2IAmI5aRsmaVaQMnZkhGQ7LEjVDOdjYWvWPk3TvCxT3xA4QXOjvCRF 4hmiqHs7rCnWPklT8IQ/6V71/NcL7OuHCHkXYXioAttQRcTrYTN0h0PX08SWJDtuurYdzi/n0jGD ehhoc+haEuiS7ufNoWkoLQNDdZIitAyw9/TQ9m3h2UHz9e/fx8JdjJAen0eShp4piVb2cB6rnHRj HejGru5pWTSnCcGKhufTIc/rvi+w6eawepKQtis8yyub1LHj4enYFGU70thx8+Nvj/XOFBcFAyBk p5envoGzVyU7Pz42oRuQsYu3OOu63Mfh4XwqHDt5eB5S1wmb8RB68aEjgWUH1UAjvKva3N0m41OX uH7e9zm2Q3pso4UE8ymcvgJ/srNlQBiH1FatuOszLyB9s9MVKx3GCWF8rD1V2eZDl4VF18amKJrJ BBnWXQEIw5Fgzdg3femaftVXnrzoGi4I46mJXNuQIZSznoaaAKmiL4Kw7okr8xoMckAYHgpb4Kf3 UyZVf9ipCM3zdleEfkgNUfaqDhA80hEsvp3Uf0a4vggecYKVdYdA4ZWg6QCh6QmWePUVIbcEHrLI hDDANI5Td4dp3owQd12s8RKGxb2PI4CzISKOZQUr7ZpA5uUZYV8Pta9KRtwNE8J4Ini6qr7LIzK0 kS4IRkTbzH9FiDRexOWE4JLpIpaFwi01OZoMiU+00rbxLwi555d9mziWR44PUywcn/t4a+/qoYn8 rOsL1zDcom0gHOt2RmgvCG3pGriEODWXZsdLgk6mBK2rdkorX0ayX9EUOzEd6iTKu/MDnEJ6+uOJ ZimBAHQnEJqHYdZQeJQ+ofAIIkpDFYlOQQusQ9COJDCWMUxlqr2UqQgbdkRyLKG5OFo6bLI71E3/ 0Ma2lT7++XJsaQevUVempEXrumkgNWk4JbFt7ggBeMFKSGIrRkjHNluaHV+LdRljXcdhAOcnTC2C KmpeVlWkKMvE1c3k+PIE6bHOYXM8pO6yAhfI1qJo+KGrq9twb4ss0rzQ00V5m9R1ujA7QjCo15bF 0SVRNXWo2NzcKHG8anuB7zqOpUFQjmeIwzBwoADCBAMHu8CD4spyom5qoqCYpowYVtBgMJUuP3CN pbnp1rgpEtRZqLgsFP5Lu8ggQVYUSYQKxmtRN5aeqSni3BmwvKRArydMg2kyy0KZn7oN+AKCSsqB p7wwHL/80L7emuXrz9ky9yGQAhoKCRGxzGszM9leJ0/9yi+eH2lq3243r+0TI+E08+BuN9/7/Ms3 PwCwQBtew9gQFua7TxFcuPyBu/0cBuaDd/spEJ/9X92qVatWrVq1atWqb/oH2XmccQ0KZW5kc3Ry ZWFtDQplbmRvYmoNCjk5IDAgb2JqDQo8PC9GdW5jdGlvblR5cGUgMC9TaXplWyA1MTJdIC9EZWNv ZGVbIDAgMSAwIDEgMCAxXSAvUmFuZ2VbIDAgMSAwIDEgMCAxXSAvQml0c1BlclNhbXBsZSA4L0Rv bWFpblsgMCAxXSAvRW5jb2RlWyAwIDUxMV0gL09yZGVyIDEvRmlsdGVyL0ZsYXRlRGVjb2RlL0xl bmd0aCA2NzM+Pg0Kc3RyZWFtDQp4nIXU+VuMYRTG8T9NSCRkiSzZInuEKHvLNO0zNdW0jJQKZSeU pfAHIFKTmNIyFSVLIbJ9n+e88zZ1XeW6Pj/O8r7n3PdxPf7rmkbJI/FnZsXioek3ivw1mn4V+msw OJVx5cF4wRT3f+ZPlnfvh3CIuxjLNdWP5dR/V+oUu/LNdsf0Nfu2IesWRjNF7WhG7YhycyRd+ZJ2 w5B6/TOsuPYpRVz9aNGSr2A4CZeHE3HpQ4J26uKQUjN0smbwBKoHj1e/x7ELeHf0vHLk3ADiUTUQ V9UfV9l/uLLvECr6Yiu8sWe9B1HuPVDei/1lvTFlPTFnevahtHtvaXc0Tnftgatrt+stdpWgc2dx 5w4UdWzXthV2RBV6opyerU7PloI3iET+683apjy0b3S0b9DW575CBHLa1mlr7W1r7G7F5l5tc4fb WsOzW1dpK7NaEIbMlhXKy+UZyjKR3rxUC0Va8xLlxeJUZZEWYsVzLNSCU0TTAmFpmu8TZHkWlKzM 8xOIJPF0rjbHlKjMnuQJApCgzJqRfCZAf0Wb+B35ZfOP5H8DFf0kk59QnpmHN1+El5K3C1bU+8q7 hxiMyciUGBdDY3ShvkkyUpmtzJmBM3aGH6YXAdkLC2JNLIuVye5YomyTtUboFUM2zuoJADGQPBCM SB0SEBhiQ3iIkGSJUBEtAkbMCJukjvgRQqIYrWNJOIkoQSWuhFbSS4wJM5Em2MSbkBN1Ak/sCX+8 LgKkFxSEmkhfKA71oURUSTol/aJo1I3SUb1kxegjxZSGUlWrri3MIlNqqk3BpelUXrqfpUycBU6E eS44HfY645LIVeG8mKfGoRhXyDxKU44V52vKQePEGbeuYeIA+l/FIsV3MP2uaLHBd2b11f3vcZYb Pt2Fxz/bAfiIDQplbmRzdHJlYW0NCmVuZG9iag0KMTAwIDAgb2JqDQo8PC9QYXR0ZXJuVHlwZSAy L1NoYWRpbmc8PC9Db2xvclNwYWNlL0RldmljZVJHQi9TaGFkaW5nVHlwZSAyL0Nvb3Jkc1sgOTIu NyAzOC44OCA5Mi43IDMyMi44XSAvRXh0ZW5kWyB0cnVlIHRydWVdIC9GdW5jdGlvbiA5OSAwIFI+ Pj4+DQplbmRvYmoNCjEwMSAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lk dGggMTY4L0hlaWdodCAyMDgvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4 L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDEwMiAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0 aCAxMjQ+Pg0Kc3RyZWFtDQp4nO3BMQEAAADCoPVPbQlPoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAA4G+ZjwABDQplbmRzdHJlYW0NCmVuZG9iag0KMTAyIDAgb2Jq DQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAxNjgvSGVpZ2h0IDIwOC9Db2xv clNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBvbmVudCA4L0ludGVy cG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNDgwPj4NCnN0cmVhbQ0KeJzt 3dFO0wAcRvG1pe0QsRsuGNAA6iZEIN4giWMoUSMJsIHCCr7/i7gC0Xh/Lv5Lzu8JTr4X+FqtOZKE 9rcyzfIirHwhfShNsnKp6oZVPS2z+9C0rNa2+oOg+q/XO+1m0SRbWts5GI6CGn58/3I5bzrzauvg 29nFOKbz74dvu8V9Z6c/PPs1rUOaXl+Mtp+X6ayz6A5G4+ldUPXk807vX2d99zum+vKLnSA7WXay 7GTZybKTZSfLTpadLDtZdrLsZNnJspNlJ8tOlp0sO1l2suxk2cmyk2Uny06WnSw7WXay7GTZybKT ZSfLTpadLDtZdrLsZNnJspNlJ8tOlp0sO1l2suxk2cmyk2Uny06WnSw7WXay7GTZybKTZSfLTpad LDtZdrLsZNnJspNlJ8tOlp0sO1l2suxk2cmyk2Uny06WnSw7WXay7GTZybKTZSfLTpadLDtZdrLs ZNnJspNlJ8tOlp0sO1l2suxk2cmykzWnndOgnf/9qvePzq/r25huxsePP/V59ebwx/jqZ0hXk9NP g5UimXUuLL/aH558Derk6MPGs7zpzNorG+929/ZD2tvd3uwtZrPO2aCLVW/1RVCrvc6TZs4mNCvK dlhlkaUPna0kSQNLHivnwx9RF8fCDQplbmRzdHJlYW0NCmVuZG9iag0KMTAzIDAgb2JqDQo8PC9U eXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAxMjMvSGVpZ2h0IDkyL0NvbG9yU3BhY2Uv RGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFzayAxMDQg MCBSL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNTY+Pg0Kc3RyZWFtDQp4nO3BMQEAAADCoPVP bQ0PoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEcDhJwAAQ0KZW5kc3RyZWFtDQpl bmRvYmoNCjEwNCAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMTIz L0hlaWdodCA5Mi9Db2xvclNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNv bXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMjAx NT4+DQpzdHJlYW0NCnic7Zhpc9s4EobD+wJvErzvA7wpxbIzydbu//9Z26DsrKcmrinZmexMld4v pkiYLxokuvvhp0933XXXXXfdddc/VQzzf/JlOSr2l/szrCCrCGmqLHBvejPMXzEvRtDcKEni0DMU /o37M5wg8OzPNmc4xaumeRpJk7rqj70ZTka6Kvxsb4ZHyfxwXpd1nUpX5hiGpbquLxxz8IOTzCDy NPB+XnjmRc9jXw5utBaMYn9YmqpbT1OqCxwvyYoii/StY49jSZT0sCWlh0SeF4TrBfqXE0RJkulQ ToCBsnjjM2EEs9xPbeBG3WmvHUVGth9gz1JFjhM128e+rRt+c7qsJTYUVdcVgWVFzUCyKCPLdj3X UCRFd3zfszTxJm9qvW2FpdnFeuqwaYdF07ZNjnVJ0nHeNFWK/Wz++u8vc+GbThjaMicgP8aGagR5 VTdFaBluVNR1nWFDZN9pvXehn7YDaBqb0DT8apxIk4dBvn77z29LiZ2obkIkSHbWFp7p18u+jk3i B3lH+p6QOkDCDWEfC36GBQ/bbW3itJuHOi/6Za4DLxvWoUoCxwn7y9dzG9p2QsbMEGWvmbvQDoeH y9qmQZCTqa/KdppKR7ohbLCuPj+uDfznSrIY9lmNbSch25iF5byRzLcQXZEziWCJ03HOTUnxu5VE Tjxd6HyssNvWNkuqaSOByt1mffn2uE7T1GdB1C5DYsiKU29rFeXDNlWRjRQjmdbGVUSUTEtxWG/U ejhPiaHo0fRwHqqiXU5jpL2dEX9s/a+nlbRF5Fhhv/ZY4QUjX9Y6CMpxHtvURUY8LJUtCS/WuKfW Edk6TOezfnlcSUeWtYOob7P+/LTVCYboUHBYc4d16Vo476ZlyF07+Z91aclqQPaBWi+NK8PJ7ctl buu6qRPrxmddns4d1hVJ4OlKDhGSZLtal9zSDDdpl72PvGRYGw8CjMe1djVY//MYO1G/1I4kqNF8 2eFtw9i33qwCb1lva2HS9MVKTrXMpWfaUb8OiYkMiHuCJOcnwz7EhoJCspHEw/V+maj1DNYw335f 69C1bQtJN6w3TaT5Mqc6nS4j6BDeUKZ5O8OLbtl+CO/tPiRO0O1rE5gGhh3YlfV8uYyRE3ZT5Uic aOXT2hdxGPimfJM1ryekj47Xg2FlpxjmkRwpxTJxVrdknirPcIp5H2k2y4Ztmcb1vLfY8ssus0SW U3ENqaeFvOe9UfresIaimaWOzF7nobpZ05O+LQJYXjetu64tsC4jv+y73EPIzbqBdG1bxxaywhRD +mIFHRdt37dV4ii3RP2JFTTLUp8TIMMrph/FEbY1kReRE0RR4CARCokTBK4uiaqF4ZTvuSYUDQMe Lq1jUGZwlBwjb8nhtEGSoNx9XwRR0ZCmSFAAr52Tehzykqoe5REuQy8lS8exKFyfEy8pCEbKt3YT tM4zr3/RFpGeoYc8bRc/XVvHoylgr5evXcNLJ0mv8vxPaCxftYA/6gZ/fP+/pnG86667PqbnbPHr d+eRDdVrBv3VzlAsoDJA3RBuKgEfFysaYdn1PeDmbYXvwwLeDKAzGUlX0BL86YqOL1TJsq/pkybr V2j5wpnvnS8j2uWykTJNQkfl2QMdZUmgyPvMk5J0VMhnyGR5UZYPtIQTonjw5ju9WdmD7qvyTUMH xGQFxXQ8zzEUgRMUw3aAJ23L0qHpY0VVB8iUkOX5no0kHroI03Zo6/BOb1b2u9NWeXBXiElEXlpW VZG4mqTYSQkUWaRpFpoSJ2hehE1kUcis8tBSJISzqq7L0BDfaS0C6pyH1KFx8Bp0YhQde+jGADz2 fSFN2ZAm0ETZyQGAvaQhBNCyTSzdKed9m9rEvK05+i7oS+PhtA8lxAG3L8YJWl4yk9Rxiv3Lw1gm ST1NuQWA1Q/VwaMwmRF40wn6h6e9zzztFr79XdiSBX3uvpLc1Wmgc51m3Qrchevz0wowDXy7tBi6 4mks02bZhyItYFiB4+HxMiS2etsXhddhc7IVNfPpPJfYL/fHvSsrsu1dFNT7ufNVSfXqZcy8sJ37 LCWfH+amaKbTWgXJ8LCVtvyBJMhwku5l5PR5LtL+4evD3PfjOlcBrlbAIoEVjGxaGoh0qqN0fHza h47M65DhmJymGN3S+v/BGjawYiXj51NfDpffzkNzfCexvRKwCHEMpwKFTkCyQ+rDGj+uHUXLzLfD fh/CW4j+B8aiIKpeczqTqj9f5jLCGLsmsotlSsCalYA+z/u+tYEV9OczyUJAS0fXA2DtQHl/3md4 WTd0ZAbtvndZtZxGiMe2DE2xinkE64PN5kdg+MJGTrVuXezBAF1FuPuYNSuZQZLElCunHMfdOjdp GGBXVwEjh1iD9WQVTB6/fZljJBsHjwJaYhshv106/CFrO20JEOYyVb5hJ9009k1dRDYyk649Ps4w olVsT+fWlQXKoxPpmjoPTOSWpPLkD1hDzaz6YRi63EeSYsUVFNC2jCxV89LEpp8p4EXz66GNkMDy qgc82nf0w55qhNm7kygVbGvDj9I0xrYqcHSfhbD+2FJFSbPMKzUzguZgTxcpByqWHyVJ5BmyKBuW cRPR/9FbVJCuI+X6XVaQNV3XKWSygvjCobSFusLk69GcKL27YD57U6z8zpX0h3Cg42sOZV71C68H fBz0fgeLzJ+h458OuOuuu+6666677rrrrr+V/gsVxuCADQplbmRzdHJlYW0NCmVuZG9iag0KMTA1 IDAgb2JqDQo8PC9GdW5jdGlvblR5cGUgMC9TaXplWyA1MTJdIC9EZWNvZGVbIDAgMSAwIDEgMCAx XSAvUmFuZ2VbIDAgMSAwIDEgMCAxXSAvQml0c1BlclNhbXBsZSA4L0RvbWFpblsgMCAxXSAvRW5j b2RlWyAwIDUxMV0gL09yZGVyIDEvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA2NzM+Pg0Kc3Ry ZWFtDQp4nIXU+VuMYRTG8T9NSCRkiSzZInuEKHvLNO0zNdW0jJQKZSeUpfAHIFKTmNIyFSVLIbJ9 n+e88zZ1XeW6Pj/O8r7n3PdxPf7rmkbJI/FnZsXioek3ivw1mn4V+mswOJVx5cF4wRT3f+ZPlnfv h3CIuxjLNdWP5dR/V+oUu/LNdsf0Nfu2IesWRjNF7WhG7YhycyRd+ZJ2w5B6/TOsuPYpRVz9aNGS r2A4CZeHE3HpQ4J26uKQUjN0smbwBKoHj1e/x7ELeHf0vHLk3ADiUTUQV9UfV9l/uLLvECr6Yiu8 sWe9B1HuPVDei/1lvTFlPTFnevahtHtvaXc0Tnftgatrt+stdpWgc2dx5w4UdWzXthV2RBV6opye rU7PloI3iET+683apjy0b3S0b9DW575CBHLa1mlr7W1r7G7F5l5tc4fbWsOzW1dpK7NaEIbMlhXK y+UZyjKR3rxUC0Va8xLlxeJUZZEWYsVzLNSCU0TTAmFpmu8TZHkWlKzM8xOIJPF0rjbHlKjMnuQJ ApCgzJqRfCZAf0Wb+B35ZfOP5H8DFf0kk59QnpmHN1+El5K3C1bU+8q7hxiMyciUGBdDY3Shvkky UpmtzJmBM3aGH6YXAdkLC2JNLIuVye5YomyTtUboFUM2zuoJADGQPBCMSB0SEBhiQ3iIkGSJUBEt AkbMCJukjvgRQqIYrWNJOIkoQSWuhFbSS4wJM5Em2MSbkBN1Ak/sCX+8LgKkFxSEmkhfKA71oURU STol/aJo1I3SUb1kxegjxZSGUlWrri3MIlNqqk3BpelUXrqfpUycBU6EeS44HfY645LIVeG8mKfG oRhXyDxKU44V52vKQePEGbeuYeIA+l/FIsV3MP2uaLHBd2b11f3vcZYbPt2Fxz/bAfiIDQplbmRz dHJlYW0NCmVuZG9iag0KMTA2IDAgb2JqDQo8PC9QYXR0ZXJuVHlwZSAyL1NoYWRpbmc8PC9Db2xv clNwYWNlL0RldmljZVJHQi9TaGFkaW5nVHlwZSAyL0Nvb3Jkc1sgMjg0LjI4IDM4Ljg4IDI4NC4y OCAzMjIuOF0gL0V4dGVuZFsgdHJ1ZSB0cnVlXSAvRnVuY3Rpb24gMTA1IDAgUj4+Pj4NCmVuZG9i ag0KMTA3IDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAxMzEvSGVp Z2h0IDM1L0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0 ZSBmYWxzZS9TTWFzayAxMDggMCBSL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMzY+Pg0Kc3Ry ZWFtDQp4nO3BMQEAAADCoPVPbQlPoAAAAAAAAAAAAAAAAAA4GzW7AAENCmVuZHN0cmVhbQ0KZW5k b2JqDQoxMDggMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDEzMS9I ZWlnaHQgMzUvQ29sb3JTcGFjZS9EZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21w b25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDM1ND4+ DQpzdHJlYW0NCnic7dbrUoJAGIBhdxcWXAQVFA8NNgo4mjqeUJk8oWkmTU5qVpb3fx059RPs38Y0 w3MF7+y3p0gkFAqF/h6AEIJgCxDLYRYFGAEQLymyFGWDWwmIpbxuFFSRZwKKAJBX9Ha/U9EUAV+c BoCIIpakzZ4zG3XK+QTxnwaALE+EGDViImt0nQd3OWyWMhLntxCQjSk5TStQc63XLMfd7p4W9o2W 5L0NAEVTpXq7S4/VsyfLzeH4vnfHDS2OoTdByFX7o8mUHme2WD+/nU7H/WpgKLxPAlHNVm9Aj20P p/ebw8fn62beKSY5T8L53IqqVizRo5fr1mS9fdm507aeFhjvfgQIE1GiJy5n9dZ49bie96uafD6W F64Fhh5M0obl3Dl2o6iKHPIr+K6gCPEp07q1m0YuEdQ7AXGyUKmZV/Iv9zNlgCFyJiPHLs+APshw JIqDeiZ/nPd70N+mUCj0v3wBs4WCJQ0KZW5kc3RyZWFtDQplbmRvYmoNCjEwOSAwIG9iag0KPDwv VHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMTMwL0hlaWdodCAzNS9Db2xvclNwYWNl L0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvU01hc2sgMTEw IDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDM1Pj4NCnN0cmVhbQ0KeJztwQEBAAAAgiD/ r25IQAEAAAAAAAAAAAAAAAC8GDVSAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMTAgMCBvYmoNCjw8 L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDEzMC9IZWlnaHQgMzUvQ29sb3JTcGFj ZS9EZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0 ZSBmYWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDM1Nj4+DQpzdHJlYW0NCnic7dXZboJA FAbgMsOwKaDgrrgBRk2tRRFp3SDVttTUVLtqfP/nqKaXjunVyA3fC8yfmf+cubqKRCKR/1AAACrM 8yFiWARDi0ABxEuKKnEhRaAAzYrpsqEXJARCCQCZmKo1e46lq1wIVTg+QKJgWmPfG5hpAUFy8E2n ICtmat3RInj2+kYuIcaJifEMpmYU5JKl1nD+ulkvPbutV8qkaFoxI2OaDhhZ64yD95/t52oxcQd2 n5jeTSMvotMEnGo4j5vtfv/9Fsx9b0bMdHLXrSaYk1kDbLJq+auv3e5wB7OR6w6JcXqtknR6BxQt pOvW9GX9sQ6m9nVDrxNTq+STPKaKAAmK1nL8YPk0udVziiwRI8ZYGrfwwHEcqx3Xe5jZekpANDnw zLo7riQ5Z3Td+76ZOowLOdjj/zJARlCKZrtZxnT1Qg5PEVeyWUWgQ/yeaYbn8U25XAZwrimRSCRC xi9IVYFXDQplbmRzdHJlYW0NCmVuZG9iag0KMTExIDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3Vi dHlwZS9JbWFnZS9XaWR0aCAxMTIvSGVpZ2h0IDExOS9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRz UGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvU01hc2sgMTEyIDAgUi9GaWx0ZXIvRmxh dGVEZWNvZGUvTGVuZ3RoIDYxPj4NCnN0cmVhbQ0KeJztwQEBAAAAgiD/r25IQAEAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwK8BnDAAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjEx MiAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMTEyL0hlaWdodCAx MTkvQ29sb3JTcGFjZS9EZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQg OC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDEzNjI+Pg0Kc3Ry ZWFtDQp4nO3baVeyWhgG4BxAVBCcNWfJIYc8r+YETjlE4oATav//j5y9Qc3St6xknfNh318KaO3L R1urPtzPzc3/Oboz0cLQgxj2MRoxDMcxzGg83ILPf22rDjgfw00EYbZYSZJSYqMZu52hbeoVSVot ZjNhgq8Ayj9hoaQ4ZgtJ2RiHy+31B4LhSBQmFmfvEok7Nh5TLiPhUMDv9bgcDE2RFjNwjYr6jakM RiBZKdrh8t6GIvG7ZDqbLxQfy9VaHYbj+EaD5zjlolatPBb/yWfvk3fxaDjgczsYygpUgH49KbQw QNnsLl8wwiYz+T+P1TrfbD/1BsKLOBqN1UxAdt+OR+KLMOg9tZs8Vy0XHzJJNhr0ue02gGKGz+ZU MMJKO33BaOL+oVTlmp3e81AcT6bSbL5YrlayvD6JLK9Wy8V8Jk0n49FQ6HWaXLVUyCSiQa+TJgnc +BdSpwMYybgDsVS+VG10+oI4nkrzhYpsNpvtJwGPVXo5n03H4ku/06iW8ql40GunzDiY8kTTG3AL 7Q6ymWKt1RPEiTRfriCjnvd6QfYycJdzaSIKvVa9lEuEvIzVZPwg6gy41e6PZYr1zrM4ValLnXMu UMGo05HwxJey7K2DNBmOQZ3RzPjZh2p7MJIWK4X6ifRBheZsLDzVC4mA3YK9jajHrK5ortYdTlXs t9axKS8lsccV4h4S34M6jPQmSp3hbAmwa1kHE0w5E7vllI/C9bvPzuJJVvqT5fp6k70Tt5uV9FxP +0ijMqDe5GDLA0m+/mxv5Hom1JIuQq+O53/oSrJ2mgr2/4QoOKDOaItWhktNOQCuxDrL4NDDGJYb azseHHDSTDkUD7cnGhPtvWkr7TLp/yMPvJ/a/r5s5RNPQ3D70ZvIl/8d+AEGcvL5bbUR9+eupfax t96+Pbs2BU886+1/5KrW7rTz3vFPK19+JR2/9k+996/vspHP/Vtz9PgL7wR9N+370w6Pz0uXe+pp rxd42y8/+ou942k/m++LfN/7XZCHPOQhD3nIQx7ykIc85CEPechDHvKQhzzkIQ95yEMe8pCHPOQh D3l/8/b9CYy54zXv97yup62UU/XoWE1cad23kcd8wq70iQxksDiYa/uGbjcLoRy1YbCApifcaV5c aAluN8tRK+uzKKVFHUYF8s3hXLPC23aznovtQpjeFfr0JjqU4waThQb1QUVbToXGQ8RO7AqLOgDe pkotYXLdeuSr0h2UF9OXTvk+yBCHCqhOj5PuSKbcOtQ/r2StZVgAbVdyMQ913DjV6Y2EzRNJF7nO 80iar+Sft1t3FLRWC2ksdPlSJuZjzNj7Rq1Oj5lt7iCbLdbb/eEYVmrlfXv3exDs0sLesDQeDjrc Yy4R8tAW3HCmMQzryZ5gPF0oc63uM0BnivrWGj6tuBzfVzrKQFrAhrLQa3GVP5m7kNdOEpjhbCUa dpQJknb5w2wqX6xwzae+MByNp9Lsffd6c8iHDrY0nYxEof/U5CrFfJqN3LoZ0vzXAvbNvl5uIWmn NxBhk9mHYrnGNdvdPuyWq61y2P2ezZXMYMdbbZorHfNup8nXKqVCNsVGAl4nQ1mIzwvmOxKYOGGh aIfbFwhH2eR9TunO1zmebzQazVanu0un1QQ3eJ6rww59IZdJsrFw0O9x0LBBjxm/xA4mmBOicDuA trs86m6AshaQTKYzuVweJJfLpJNJZVFgtyPgcjA20momcOyisv4pul9+gLsPu7UHu8Pp9ni8IB6P 2+kANxjGRlFwB4JQVhF+uAHxpur2ux3KWgeOm0zELiYTvN4velxjxeODrEZ/iHZLLFfLv573e3kN CmVuZHN0cmVhbQ0KZW5kb2JqDQoxMTMgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0lt YWdlL1dpZHRoIDEwMy9IZWlnaHQgNjIvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBv bmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDExNCAwIFIvRmlsdGVyL0ZsYXRlRGVjb2Rl L0xlbmd0aCA0MT4+DQpzdHJlYW0NCnic7cExAQAAAMKg9U9tCF+gAAAAAAAAAAAAAAAAAAAAAAAA 4DVK1gABDQplbmRzdHJlYW0NCmVuZG9iag0KMTE0IDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3Vi dHlwZS9JbWFnZS9XaWR0aCAxMDMvSGVpZ2h0IDYyL0NvbG9yU3BhY2UvRGV2aWNlR3JheS9NYXR0 ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVyL0Zs YXRlRGVjb2RlL0xlbmd0aCAxMDA4Pj4NCnN0cmVhbQ0KeJztVmlzozgQDWBOY3GY+7YBARKXTTyJ U8ns/v9ftRIebzKpnSmyn3areF/slkQ/Hd39+uFhxYoVK1as+E+D+WQy/7zsty4YliNgGQKWgHkf JwbzQH7mefbm/L6c/RoXwwmSst0qEs+xG1GWxQ17G2d5SaaDnCBv1a0ii+Q/Mw8rqrqlU1/gYXlF s73Ad/c7SVAM1zUVnplZRGB71k7kJc0JwsBz9poicAwrqJYfhr5rAWmzmId8ZcdFVVVl5mnqPm3Q wVboNhkehBAVriprIcSohuUxcTWJ2yhOjnBTwTwy5aXnYTaqc2wwauq6TCwjwE/XIdMFcjec7FSX 65jqqlWM5x41CKMy1CURxO00YoS7JtEFdhkLJ1kH3FZZHCVJYO2T8e3Pp9oluySHSYbXPy75HrjV eYRpcoBtX4WaYhzGCR2zshsqsnAZDQ8i1MHQBDvN0IGRjK/fX/oE8CwrWcX0+v1SWJpXjyg2NTMo +750tP1xGHLHCusTDtVlt8aK+7zHiSHxG14UJRD315enU2FJHK8GzfT8MuWUhux7S2aDesTx3s6H LjN1D45ttJRGoT488uY0SXg16i6X6dQEqiAZGR6nb6d8r3lVD22Z40RzPodbjGPhOQk6IX+7jIbb hngsLXF+SYZTw3YauqHNDFl1y7btzuONprQlltns4naEvldOl7bI0XmqPWURDXEcdWNuCrfFlOaE K9xDTzOTGsF6GI7vNPOeqsAvH69T256fLs3C0xCa+GcaPNRH2OHU9QsEs6LrP9NASvN8QnU3PXap Liw9TfvTpeEBxhnqqyxvmkN4aD/S0EsbCs8ryHUlYVoNI3TkRYnDKT461R9CAPeFH8BhIO8CQye5 00BbIiFgHPous5186A8WMCJEInrZrbGSDccu/TugCU3u2Fl/+fbYH20zxjPNHNCCCPxqaEKDBnSi Kzu3OnULI5oR9LQb68gEYE5P6tfSA/z8du1iXY9+0MzpaXh52+U2oOl5tDUzak44WBoDiktyuz7E 8VxsYtRm5s4qLm+k5KggbIhJi80A0ygtUVv6gBabM8qiFHZ9QZ5sAQst0CAo264ltbNMbNMvq1iT QdQ+9qkubd2iinXVpqWzqeqmzgPtXjrrBuMyAPyyEk1VxcsgcUGFYLcPY3sryGZSZLbCSwYxZyFA qCqLQ+wA8V0ICvKByC5VAiI4huuHAZU1UdF0VeA2sm4ZCs9uqPlD1nzPMYmssXdZIzJnqOJy/WSo MlMRnkVaEHmi8ZwgEqlmbuZHkWbeRVqhav6VbuDeUtxaDtpIzL+3mV+2HBz7JZKFW/lk/psOasWK FStWrFix4v+HvwBMFX3bDQplbmRzdHJlYW0NCmVuZG9iag0KMTE1IDAgb2JqDQo8PC9GdW5jdGlv blR5cGUgMC9TaXplWyA1MTJdIC9EZWNvZGVbIDAgMSAwIDEgMCAxXSAvUmFuZ2VbIDAgMSAwIDEg MCAxXSAvQml0c1BlclNhbXBsZSA4L0RvbWFpblsgMCAxXSAvRW5jb2RlWyAwIDUxMV0gL09yZGVy IDEvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA2NzM+Pg0Kc3RyZWFtDQp4nIXU+VuMYRTG8T9N SCRkiSzZInuEKHvLNO0zNdW0jJQKZSeUpfAHIFKTmNIyFSVLIbJ9n+e88zZ1XeW6Pj/O8r7n3Pdx Pf7rmkbJI/FnZsXioek3ivw1mn4V+mswOJVx5cF4wRT3f+ZPlnfvh3CIuxjLNdWP5dR/V+oUu/LN dsf0Nfu2IesWRjNF7WhG7YhycyRd+ZJ2w5B6/TOsuPYpRVz9aNGSr2A4CZeHE3HpQ4J26uKQUjN0 smbwBKoHj1e/x7ELeHf0vHLk3ADiUTUQV9UfV9l/uLLvECr6Yiu8sWe9B1HuPVDei/1lvTFlPTFn evahtHtvaXc0Tnftgatrt+stdpWgc2dx5w4UdWzXthV2RBV6opyerU7PloI3iET+683apjy0b3S0 b9DW575CBHLa1mlr7W1r7G7F5l5tc4fbWsOzW1dpK7NaEIbMlhXKy+UZyjKR3rxUC0Va8xLlxeJU ZZEWYsVzLNSCU0TTAmFpmu8TZHkWlKzM8xOIJPF0rjbHlKjMnuQJApCgzJqRfCZAf0Wb+B35ZfOP 5H8DFf0kk59QnpmHN1+El5K3C1bU+8q7hxiMyciUGBdDY3ShvkkyUpmtzJmBM3aGH6YXAdkLC2JN LIuVye5YomyTtUboFUM2zuoJADGQPBCMSB0SEBhiQ3iIkGSJUBEtAkbMCJukjvgRQqIYrWNJOIko QSWuhFbSS4wJM5Em2MSbkBN1Ak/sCX+8LgKkFxSEmkhfKA71oURUSTol/aJo1I3SUb1kxegjxZSG UlWrri3MIlNqqk3BpelUXrqfpUycBU6EeS44HfY645LIVeG8mKfGoRhXyDxKU44V52vKQePEGbeu YeIA+l/FIsV3MP2uaLHBd2b11f3vcZYbPt2Fxz/bAfiIDQplbmRzdHJlYW0NCmVuZG9iag0KMTE2 IDAgb2JqDQo8PC9QYXR0ZXJuVHlwZSAyL1NoYWRpbmc8PC9Db2xvclNwYWNlL0RldmljZVJHQi9T aGFkaW5nVHlwZSAyL0Nvb3Jkc1sgMzU0Ljg0IDc5LjggMzU0Ljg0IDIzNi43Nl0gL0V4dGVuZFsg dHJ1ZSB0cnVlXSAvRnVuY3Rpb24gMTE1IDAgUj4+Pj4NCmVuZG9iag0KMTE3IDAgb2JqDQo8PC9G dW5jdGlvblR5cGUgMC9TaXplWyAyNTZdIC9EZWNvZGVbIDAgMSAwIDEgMCAxXSAvUmFuZ2VbIDAg MSAwIDEgMCAxXSAvQml0c1BlclNhbXBsZSA4L0RvbWFpblsgMCAxXSAvRW5jb2RlWyAwIDI1NV0g L09yZGVyIDEvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAyNDI+Pg0Kc3RyZWFtDQp4nI3CZVMC URQG4P8/g92BhS0mLN2IgQp2fRPFAFERMTDf47l79y6o4zOPxXFiqVmndsoZuf6PWqah+ik2yi5j k/EMm92mLdyD2Va1N9tmPG9Hn9ih7/RfyF0YwMtufU+QX2EvhqiV5qzhXJ++P4J5HODR/CC9xqEY tdGCLV4Y1o8s3vBRTNCxxC2OL4kTy3d8kq8Up/hq0U7vpzEpziRLdK00+31u/UGexw0sL/BU2SE+ OjEtauknbZO65K1nt9KzzV+8fIf6xArdrfhNXwN7pkF5H99CNcMH6nce4Yc//oiqj6rHfv1Jj8X4 P34B5nZgUw0KZW5kc3RyZWFtDQplbmRvYmoNCjExOCAwIG9iag0KPDwvUGF0dGVyblR5cGUgMi9T aGFkaW5nPDwvQ29sb3JTcGFjZS9EZXZpY2VSR0IvU2hhZGluZ1R5cGUgMi9Db29yZHNbIDM1NC44 NCAxNTguMjggMzU0Ljg0IDIzNi43Nl0gL0V4dGVuZFsgdHJ1ZSB0cnVlXSAvRnVuY3Rpb24gMTE3 IDAgUj4+Pj4NCmVuZG9iag0KMTE5IDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFn ZS9XaWR0aCAyNjEvSGVpZ2h0IDEwMi9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRzUGVyQ29tcG9u ZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvU01hc2sgMTIwIDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUv TGVuZ3RoIDEwMD4+DQpzdHJlYW0NCnic7cExAQAAAMKg9U9tDQ+gAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAD4MjgJAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMjAgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9T dWJ0eXBlL0ltYWdlL1dpZHRoIDI2MS9IZWlnaHQgMTAyL0NvbG9yU3BhY2UvRGV2aWNlR3JheS9N YXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVy L0ZsYXRlRGVjb2RlL0xlbmd0aCA0MjA+Pg0Kc3RyZWFtDQp4nO3d7y4cARiF8Z2ZnZn1r7OrG6Jt UN1Fin5CYm1VSkiwKHY4938jOKi0t/A+zyX88n4+b6NBLyVx+0uQNvMiZnkzfWFIsnKq6sSsmi4z K6RltbDc60es9/VTu/V8C0k2tbC+PRhGbLDz/fNM/oyQV8vbR2cXo4CdH+9+6xRGaPcGZzfjOl7j 24vh2scyfUIoOv3haPwQsfryYL37jlA/KGD11S8QQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB 4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHg QBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBA EAjuP4RxRIR/hmp7++e39X3A7kY/XyeL82pl92R0/Sde15ene/1Zj1c3Z75sDQ5/R+xw/8fiB8+Y Z63ZxdWNza14bW6sLXUnPOufNCeq7tx8xOa67cn87cFDUbZiVhbZ65eLRpKkUXv/dxK+Rx5lqjoN CmVuZHN0cmVhbQ0KZW5kb2JqDQoxMjEgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0lt YWdlL1dpZHRoIDI0Mi9IZWlnaHQgOTIvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBv bmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDEyMiAwIFIvRmlsdGVyL0ZsYXRlRGVjb2Rl L0xlbmd0aCA4Nz4+DQpzdHJlYW0NCnic7cEBDQAAAMKg909tDwcUAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPwbBPcAAQ0KZW5k c3RyZWFtDQplbmRvYmoNCjEyMiAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2Uv V2lkdGggMjQyL0hlaWdodCA5Mi9Db2xvclNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAv Qml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9M ZW5ndGggMzY5ND4+DQpzdHJlYW0NCnic7Vpnd+W4Dd1X1HvvlVQjJb1mj6ek/P9/FVB6tmcn2cRO cmY95+h+sCk9EsIVQRAg9NtvGzZs2LBhw4YNGzZs2LBhw4YNz9jtAbv/eeB/LeanY3fgRYk/vE3X HeC7gZIscivL3Z4TpTeL+T/he23eMeogmp5vSm/Rdbc/ctxzRzYwCF2N37OrPa+5oW+IP5Py/vCq zXuGCWbWdrkl7P9jV5hHWVOfSe14I+tpE6ocXO84NWxom+jcz2O84yRNE4/vfeDuoIT9wyNN1GUo LMYDrMYdGMzaYveeb+6OshuH5p3yXvS6x6837Ip7duHi25cbtoU96304MBmL1e2X5X2X8/zDKvOl G2s/32cDlqftX/zCiwK/k7g7SHYcWe+2qh1nFKcv3661xe+Y1QqSLAkcPIFbWkcQfW9yh4No510T 3013L0fjt79/nRLtCO9CS6dvf//ce+LxCKtbXtY32ATPC7C8RTC+HfMX7AeetfdMprJc7fdHnvWB FrwSjg1gT+Ohw9IXJoVbby26vEg8gHF2bWq+d5bZ5Fw+Pd26AFbynlctz/dMmedEzfYDaHGHo6hD 07d1SdTj4XZpo5XyQY6mr3+FdwXzuhfs+vrtb597XxZk0wvDwNHF40FQDdN2/cDVxcP+KBluEAau IR33B0GzgyiOQviFExST9YGnHjhJt2BA6NuGcX8+vBBRd5gCYMFHQTWtVaIkqGF3u3bJ21zQ6xQf 1aibT+cLTTUOvE9QIFTGliybUYlREZkiL1lxidhd23Cry7cvc+0vSxcYj09fnm59KB+PsDRuT18f O19V7KTCbVPHpihoflaWddOixBI5kYlsW5TaEr+0u4H2VaDLup/VCNe5p4qSnZRV3XQdKnImJXdl 7rgogFEZmfDOg7ysUNOgxNasfP769YyCu+98K2PeLAhp22mCqeJkrx6GpkoczYgwgRbjbqW4a9t+ aDLPr4Hx6ZUxfbhdr2NuCIKZ08v18db5mu7nuO3p2Ea6YhdkIv0wTl2ii4qToaYjY5+Zsh7hYSDz 7UZSywzrtms7MlS+ZsTdNBIyXa4nSsg4kcKWJDNt+o4pkJiaW48zHZjE1HGK07dvF/xOxnvJw7TJ 8n7uQkXQkn7qisg1VLugSwtmIGpIWxWIjE3s5+OnWxe/WDW5nsZ5xp6i+Hgcx/Ol9VXVDpOs7OAV urrfXK4EVfA+kQtmEyRp0UxzE4CxEILr/gKM3aAmAyrqfiY5kJgf5qbuzk9Pp65uKGilG6BAtyiA Qyvqb3eJOLAT8ulxSK13WTV4nKSndRjhecxNycjgGSnQlO1ynNvEWVtTk8XFcCKZF7Xnqbi7R8b4 TNth6lPLSnvatdOp9RVJs1wvRtO5C82gvZxQ6CUdaK6Kqul4YTleSOKE7dRlcTWeu9hLQXKZZO3p hAO/Ol37xE+Gx08080ErmtnuokCyKpAMt1MdeGk/95Hl4fOpssEtvGeKwePMM4qT5nxpPFWP4U3X kaXIZkbmoQxNRfXb62WAV0zPNHd9NA33fYwxHk59heiIogiRvqopMJZF1fKjvD0/kMQO2xNJDNWp pyHWRAVcWopPD1Pmxt2JFHFJJhz65elhxkXVn89N5IM2la3Z9eWKXVio41j6UfeqgJ/0pyHWVRdN JDGdcqLZ+yKA3UEOh4cbQYg+Po2JrjpFTwecOqrmVWQcUOJYMXl8nLumo1MbW7CM+kg+/PbMeG6z rJtIjQaCkhwumVUnRd2MD5/G1A6aqQ1k0SxHAsKtqKgwvT2dcjfur6cOtZQUno9un6/gSchEK9+r GAdRL6a5MEQtpWMVpC8KdAmYy9R40irRtAv4q77PU3N6fvr8dKbj5fPXa2XJqps1zLdYqu4XLR27 LMjop8exqWtUp7buVMBYObzM8dxEQT2dp3HuM3j/cxsYdtZ0TUNvK+MR9BMM0Cy17IT9QK5Pc+7F w8PjiVKCQtNFt6dLj+ABRWA5jIkqaNk45pqgJmSswpQ+PtwVcK2oG5EjrhJNqxhp+j7Ge8HB18cL 7fvx+vQAW4ukOTGGFRxosu6mzMukOduCszDwPUuV7WoisI29MsaBk5KHT4/nJrAjYBzaUTv2VQ7G SxfG+M44c0M8kjpH4JpyLyEPj5eJ4MRSLbDqsYyCwHfADIoXxtmdcQD2cL4roOlhyxjzd8Zg9bnx Hk/NjLo/jziNogzPV5qCSMsvyBksRjOsoKSnPksa8Maxa9umBtZUTFPlyIuvWBl7ht88/OXrqbCN sAPGbgaD8rSebowxptiVBD2ni9MBD5VW423KfTZvJ9pVkakYKTkPuW/blqFIZkFXxpSujGnpBehF AVkNWlrbwBgkJoaZjTPyFO7tOSoYdTrA6tEVRQefNNahF0RpTec+cd0gyhCdwJnk4I3LJAp9Uxb1 jJ6HzF72g70cdmPtqGZx/vqZRJrqw4yyKT9T2D5ON5JYPiLIFXk9G/oU1u55aqpmvo2Zn9FHsOq+ KQITnjxSnC3xl2zmA6waXk2HIVV5JepIbttpP64KWKrq46GyhUVirOsxudDCld8eZjLGDQpU/nDg tajp64Q5HYgFSt8JC9T0pMts3S060jWozjxVUIJmhreg87slk6jbzJSUoLuAg5Ukp2wL1wjwNA3d MLNt18kxJGWcGmFYsF5FJ9IN09zGXgaxywQxyAD3rRiikXaJqRQ9xsiXeSXEOJR52Uc4NlRQYFgV 0KCNM4NfJEJ458H0d8k77BpSPD8NDYHF/IIR5UkQZBXGKPcNw8tqjMFZyYLiptBEEInJnGDEuK3D ZUfY80aYeiov6FFVgG3xepBCzGhEddtghOrEAstJID47LjmOovll07IfUs/NYavBJUQdtHQ0Mywx jCgCXVKcODKFo2jFsSUeBTOKmQLOqkDqKJIexPCoRSKLYkPUoXcxhoDe0ARmopDe65apQ84QQvyu CCyRWKJ+DqJ7lgEwmwJbEHQ3uB8fsCHGck+zTFhMBxGEQV6gOUHoe65tQPisGapwgKza0CWeVxfh rm3qDkR0TRIkeJohGFueFbLkgONZzyMbYICzOEq6IX+vgMAxifx+lQiZigbaWO+wapaH8fdTBJYT 8jykbbIs8ZDccK+Z3ZrlPWdrIsshdy+jl5xQ4NesEoSBNtBbEkUBsr9VPOSg/JIUCky4KAiSVdCx yaIUQtPSEo5r5nhPHJekEf4tEp//3RVYJe6fJbKTpiWjfTPhJdd+PilimfY9md8veff32fv97tp+ Ob+7j34Wsv5fet9z9t39IGr9tyb+AE6LWtrjGnWkiWCve3nsb78f8Prv5fTgB4nLsz7+aSIsBytF bdNgDNuT8Ato/D9jd5AMP0rThB0I/NzTzz8L7NxX1XVNEd8RPfzagPV35DjusP9vzpt/Ubx4tQ0b PhT+lVku2/ofWeuvbcZs8z/+0/7PwqA/csC/SLjwR4CYXFJV9cdqIiQnlqX+cPT0HHLBy/jJxcf/ IyCWt/w4ibwfqol70ckyR/xdpAsBN8fCY042rfedLX8g7I6KVzRd11Thkiu/3D8oUds+n4Q93xNV jVVTBCOI7PeVTD4O9qJdkpF0LUpYYPxafTyoKSGpyqb0OeBnTGNX4Y/PjH9fb1wvPvr6BmLRcCJ1 Gkce2OlaKVyqg8f1iIpnARV7AfCf10Lcla4KObfj6pCNs95LLXH3UisUWVb4Z7P6d9gd9Xw6t5EJ oTFk/MelEOmz8wNuOYY0ZFVnRwFHSdMV1UXnh6n0dUVfGLPeHuvN6paSblm253uWwn9oygvjSx8Z S5a+FP9wg9lJmKizo2bL8GJf4w+CGUaundAvf32ihWc6cWLLvGRFJVp7C6KVlKxWiAv/Rwf/sQBW HZPrhAJ2KgTZbtYOfT/QofI0k50hO26OC1vk5ADhxM/Gr3/7PJa+HdWIFRxZ764nfeWpWtjNE+nJ RGvvY/s02ITq+TI1GSxPQU862lV51U8kd2xgXLgBotiTeDUZhtwL24cvFxxaVtINuW0lLetddiP0 trL58dzViJxI+jM/IXk/dkc1QOP5RFFoaF49DoVrujmZm9ArgLEXLgUnnrmx3LaL6dJFuqyn7MDd r0dSgoVnwwS9y9MDzbygGqfK4j8yY4hAVC/v5svcJl7ST02gCIrfzkPqr4zbuVsYg4mbRjJMrHSy FlWSbmpDVZA9DL2Dcj5jl9U0occbvjb6EwFbjGSG9Xg9NVlJZ2QLB1aYpXlQMqv+jnFm6FE/Vuyg HhjXYTbM2BUPvFlNNA/LaSoMQfbbcf1m6OOCHWIIqlfPV1qjca4ZY6uGhbwyDpq5DxXBKKYfGUcZ uTMuF8aspMZLHivJfWjGS+TAi0ZKr2Nd07lh3/h4eOoXq84dH08k0RUHnafcAIc8YVfi78VRVnNV BMlFE7PqO2P8wRnv2HdLhqa7Ob0MBaznIXMMO+tHHLjFCM7KraapDtyUPJyAcdDNfWIwzwV7FDg1 cNKGnXTj4ufoyph+cMbgt5IsTYtugk3ZL8nUFWnR0j6zrYyQzDRT2G9Q1Z4f50xXXHya2e6U9qSA rRp6l2ne0J7tTiwK50R3KUJ+aMYa+ySpH0aKQ0P3a0IHFlMU4Hajpok01UPTTAd6OveRKpo5PZHS d2LcJGwzIyP0HrrS01jvUOEEq2iKt3wZ+qdhd5CdDLeQLZahzj5UK5q2bVDmwvq0k8SWhOWNNAih jIVebtm2uWe5SeLKouoXeO2trr3BjWlBEmgfOgLZc4rlR3Hk20vxGS7CKPSWSiQrC3IHXrUDVkh0 2HeOnAwXri7D2lf4Ay+vvddfWO/9a43zw2L5ZFVRlPVT1aVqqKyVyHtZ8J4/ikvVcfkdEkLw79xS OPyx93c1zo+L13rg68Xu/r3y62fL++8vno85/1Xv3a9RnfgVdNywYcOGDRs2bNiwYcOGDRs2bNiw YcOGD49/AOcSzQYNCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMjMgMCBvYmoNCjw8L1R5cGUvWE9iamVj dC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI2MS9IZWlnaHQgMTAxL0NvbG9yU3BhY2UvRGV2aWNlUkdC L0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFzayAxMjQgMCBSL0ZpbHRl ci9GbGF0ZURlY29kZS9MZW5ndGggMTAwPj4NCnN0cmVhbQ0KeJztwTEBAAAAwqD1T20ND6AAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAA4MIANPoAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjEyNCAwIG9iag0KPDwv VHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMjYxL0hlaWdodCAxMDEvQ29sb3JTcGFj ZS9EZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0 ZSBmYWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDQxNj4+DQpzdHJlYW0NCnic7d1rThMB GIXhznSmU0xhKDQlqEHA1mpa4p8CoYASNcYALV7oyNn/RpBTLjEs4XvfJTwLOKdWo0VJ3B4J0ixv xCzP0gVDUi9aZTtmZatZt0JalJvbvX7Eejsv21ZIstbmh/HkJGKT/eGr5fwOIS+3x1/PpxG7+Hb4 tt0wwmpvcv57XgXsz+XpYL1I/yE02v2T6fwmYtXs0/vOE0J1o4BVV59BAEEgOBAEggNBIDgQBIID QSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNB IDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0Eg OBAEggNBIDgQBIIDQc8Q5hER/tto7R1fXFd/A3Y9PR0sEPJy9+D77OevgM1+HPXXvNucLb/em5x9 idjZ8cetFS9415trW++Go714jYaDN50lL9on2VLZ6XY3AtbtrL7IH74N8qIZs6JRvz94qCVJGrWn q4/w3QLMaFLZDQplbmRzdHJlYW0NCmVuZG9iag0KMTI1IDAgb2JqDQo8PC9UeXBlL1hPYmplY3Qv U3VidHlwZS9JbWFnZS9XaWR0aCAyNjUvSGVpZ2h0IDkyL0NvbG9yU3BhY2UvRGV2aWNlUkdCL0Jp dHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFzayAxMjYgMCBSL0ZpbHRlci9G bGF0ZURlY29kZS9MZW5ndGggOTQ+Pg0Kc3RyZWFtDQp4nO3BMQEAAADCoPVPbQwfoAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAACApwEdwwABDQplbmRzdHJlYW0NCmVuZG9iag0KMTI2IDAgb2JqDQo8PC9UeXBlL1hPYmpl Y3QvU3VidHlwZS9JbWFnZS9XaWR0aCAyNjUvSGVpZ2h0IDkyL0NvbG9yU3BhY2UvRGV2aWNlR3Jh eS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmls dGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA0NzE2Pj4NCnN0cmVhbQ0KeJztW+d65DaynW42MwkSzDln MHRQ8Ngzfv/H2gLZkkbj9b3S2jPWt9v1Q00SqXiIKlThQJ8+3eQmN7nJTW5yk5vc5CY3uclNbnKT m/xXyW633+9372zzuslu99zL7p09/WwBNZ9U/OZyu2V5gX0fEjuGE/jDU5PdnmH2+wMvcPADlx8Z CtCc55hVw/2B47997x0r6Vjh9u/qjUdYE7f+VlQEjhM1jASWXjI7Kn+r/n+X7BgBgZpU891B0vRv 33vP4yi2JOYdmu9YxY19betkt+dVQ1ck3Y9dJCoYqxzDsOzhQ06MHYu8JND5PUAiGmFkiS/vzUhu 1YTq4T1AcHrS5JawvuuOkUzf1ZGdN4mhYs83RE5QVOmd1vZzhGre1Z4Mk5ZFYV15yqYmncKMHHRD guDB6u+e/Md6vd5cn2/lDP3d80Yx1K7EMvThCgTW3HooLESBkCXdCyyZfe7s41jKjtUSQlKNhXcw C9J46mbJMIVZVgkHKOJYluN4QVwLNg8qitSZ7KhT4QWBhwqCKIkCyzC8UY5dqMsS9Y+MoFkmQl5D SktFlq0rml+3maXwHMcytK8Dy77H8n6g7Bh427myBIaRvXasXF1D4mHP8Ioqi2o4jKkuSkjHhu1Y Op3UUIJtxzZU4QCXGjZtG6uKZjquY4JLFMxyHovQc22ofQAgDArEWFoKsixdc8rT3ZQ5WNNhFMBU QqrwQZDYC3Y9977CcloyDKlj+57OM5xqexbSIgACq0aYZnlZV4lF3033kqIsM18XedVJ8rIqQtvy 06KqixBLklWdLmNT09oyL1uBhzUKhI0MP3TsiHz++kjywI8CQ2QO1HTQu5alHyfgJNIRvjsvmiVp QysoSzBxwUjKyMAUCEMP2mnsOzIOqSEKWlg2TdP1daQrRkaWeagTz4uLuh1IC8/s5u7xTPphHDJL 1cMSPr9PgdDdooq9ZPz191+mIkrqOkS8oMdVYvAfBAhGCfqpsmXVa0npmHHfhQon2mWXWQYAkZlG Ot8tTVGRpQs05FVDW2QVmWoPu83lfq5jx7S8MErraa4czW7uH5c6K4e5jwwr7RvfWIHAYdunrt/c fT5VvhOB27Blxa367KMAAbZhVRP4NyMZ+hjjmJBY5SSnJoW9AWFmy6WPbK+ax9S0snFukjAbTmNi +93l3Pi6IqvgKrx8PPUBdmr6zHSKcSpdtyBdaFIgHCPqSWZZ6XxqfQ3Z5dhHMFjXx+Cn/2kINlnX jTF3vZLUrqrF40iBcDflNyDmpTAVPSZTAZ/0fBmKtBzP4POC9jTGGs/ysm55UbXcTZHhVMuY6BIK +rkJPbqEPAGxmlk4TKUp8lo8jIUHQzZ05f6nIdgEwgW/m9s060huSOjfATGNMRLAgsbSC/v7h6Wr 23HuYttv5taTDqsDzavh8jjHAMTU+QpMqWbuIv87ILAWdGOOeRb6n7oMhizMj2IZq22U89R1MFmR oAIQCeJhKZ1egBgHcBsA11j60XB/P9UFrBuxjb16rG2R4VBQtXU9nB+egJA58U+A8CkQHMPjfJqH foIhP4plbLYxXc6npXEkTonIlBuyFhHwfH8AovCC9nxqY8+hkYTq1GNlCwcAchzKtJzuJgrEQmJN VGGWNcH3poGR34FpCAcWQpTz5Xxs3HelMj9WIBL2hvvPj8eCzlkfbNu3vGo51VR5kppmSlYgPADC cYpprgMLY12VFKciAAQred0yZFE2XigQ9flUe4aTkbEAZ7kBQcqtL4y8dm59xLMwY+5+/XwqPsya QQWC6+ruy+cpUlmGhlcjrH7j5VTBkge5hgHLSRfInOQ1EBoYYQfGDZGjgxXFLofSAiDc7jhVeT1f xgjb1RmW1Kzopw6Wz2xoA8ODXGPrC8KMeoHVROUFnF++flnid6V0P1p2rBpPD5cGzH3PaXE/jcMw LbBWal5Zh7oe1jTGEu0CgijVTLuhrYo8dpBipHWKeUYwi3Ee2n5eWk8D13pexoGMPQ2oorpwdTur Y0PzqjpAop6QpU9NiVej5bfPgyt+oAkBuY9gZi2EeiwkW6IZ121TlWXqIhkHoaUoVhhg/sBrfmjT qDkuq6rMI0sRkRu6KrtnFTdvoElVxoaM3KxumralIbYgW6GPFd0LKWpBaEqcZGdNHZsiTLDh4VJi 7gNNiHVLBjs24iEB3x1E3fE8xzIx5KGSpsk8L2sa5GEHEWkKx7CiZrlQwVB5VlA1lWd2e04xXEiz bEjLOEE1LJtWgKSL4RQNSTxtuPXFMqxsuK6pcOAkIAiJPpRlfKJI8GuW/WndXhMlSKl5nmUgzYZ0 mYEs/ABJNwM3648gyZBmQzGUbNk0y69tBKjHQJYu0DtIw6EAmjK04doX9LKHkWjbgwQLNKy9H8ky qOy+2XfZdlzX7Zbd89+tYNuNgXJm3Xi5Ptk2ab9ps27UbhvXz9V2153h6xbOQfHrNtY+lmW8X/7y thIs2U6a2B8oiPiHhO52W4bycaLKf0xWr/Qhd3F/toBb2X+Ujdt/Vj7M/vVNbvKh5DvC+QcN8TLG f8Ls/73aXIOt73S4xql/0uJvUXn/Ei5vfLTI/9yA/hWNB1E2ROQS6PAqmIaU5jXh/NRwt77As/5/ RQ2a1tiacE0cBM12DOlnIkHZwufXoGS76fo0BXulw57T/ei7wJISgGtOQ48R8H8Zib1g5V0b43Xn Z8/juO1+KnUAr66oIvs0IQU9KJq2KUIsfDvd9+vuxqv9SkhiJVWCVI1THd+S/+q3o1zm9PgwBMqB 5tRqSB4eRx+gf+GwP+1esdvfFKzmuVn09cTP6wZXWvwlO3thxZ9udnte93yYg1uexqKwIaSjuxP0 8z/XYuh+V6pz+93LAJxi+7bKHTi0AbH7txq8GYgDSs9fv1xKmAWUpC8vv/9+jpUDs3LYwpobMyu7 fT3AAunxU8GaYkMGvVr0mk+LwpaAPzVgWfpLn33aGgpPrPhagWbunBrUbWJshyBW8miskzBwdTDW l7EYye9IhnmWmtHGvXOSnbeFqwqCYti6SI8cvWhGNeCE69BvA4LVsvOXL/c9JU4Y2e8fvn49JyrH K9hybEuTWIYVka4b1nqzZzhZt65M956VNMvxfN/BEseKdIfF1GGyHgRV17Fl2xipmmlfWXFoCNeY suKcrFG+3DaRyEt2fb4jKT0EQS3A645DbGpIEa9jOXQsjqV74rkhSaoqMJR7R4pipNPdUnm6AgPr 4uGpNlV504AS7zL3RiQoEKdfHu+mVOMYTk+n+8+/nhIkqnaUFWURWzIn4jDNsqIqE1tmOcVaCxJb 4eh1XrUDaSIsK0aQ5nRrEj6R7q8NqiIO47yqUkdhIXt04qwoUh+LvGxFlC+vitBQ9Wj69et9H68+ YS95/XlMsCTQ/RkeuUkBtRIHiQoFwkSG52o8Q43BNvz24evnuXCx4YW2wgvaVhs04KkGaQoaZK76 RvIcgEiXu/NprmyRlZxqPt09LIkm60Fe1R3pU0NGQTtPQ0/GITNFQfOzqm7JkFuybKVt30+Xh2Pp 6FZSt03TdYWLVLeeaIN5mYauIyMpbElAHnWCbVdHWMHJMI899NgllpnMX35/JAmm69ZesJvTsQng QzLwun7ZdW039KWnrZSXhf0yBz0FKytjN+wef/91KX3TycpIl7Wg2mo/a9ANIymdN+5hUCCm40jm PkSiFnVwdZkTTdKcMIpLsnS+htPl/tiWK7utisiGgmJY+kjHUUuasjk+nArHituhyfNmJLmNo/H+ 3Ff1dP9w6qp6WIZIV50CXigrO1L72K5OdzO0nObGN/3u4fNSOGuQsOO0hJyWLnWQwMlOSfoySWtA 0jHCbixsM+lbX+Ykt+4z1y1Pv1za0NC9qs8t+Eu6IslWDQzQ4NSX5TCT5I2k8QrE3DYE8EY2KFsP pzlBgqQZlhN3pynBRna8G2LHK6f1OAwtiNrjnFl2RkgeJP15Sin3PVVxVE7HLrCT+W7KPL8+P8y5 5xfTBK8QA3ZZlLQzgcrN+dyGTtguJMJWvpwbV1ltGWICKxuW41iHWIV5M5Yw8cN27iI7okBYGelD hZO8dn3b4URiLKv0qJFrpwOhZhJ1cxc6qwaum5GpfCNZSoEYxzJrxzZyomao0uY4JYgXken4Gbks G7tdWooWDVNhiCIyHD8dLmAOTjGNhR+1cx9Z4XB36vKsmc9DZCfjqXERTqYzTCg9Guba98rjZazS ol8oRV4vU4oVI5/BH+CYTDnmN5+2O0hGVI+nY59Q5IdIE0Qjn8bMjfsViGc2MTc1r5kaV14J6Mpf aVMkiGYxj6mXTqCBitYNX+HtQJAszAmoWQ1tElbLBKaBnCgtmuXhlK/s9srzduvRJpsWzPfnynWK 5dQXZT9WrhnPj/dTW3fTVPsWPRCARTUY5tKSFK+b2zBs7x5Pfd0ME33FlQEXUDIBHjolOZ/n7+4g ICftT6cugdlDuXMWxeNU+H8AwkDOyimzIgUiDAEVh9ZOxin303EusCBa1dg4b9v53oBInLADzwZT w3OLeUp0zc2bumopEBYldSPlyvxjN2ua6gpEebo/jQQWDQMDEHekKmA9CeGGnikTVkePBdmFF4oA iIe5KUASBzvV2LoSp8bTnBmvgFhjDMlIyGWu8n6GWgdWpbg+A0EilVfCYQWi+gaIiAIhMhSIEYAg 0CcvmOXYvJEcW4EYYsMpj/f3F5KYVj5P9KDLQKo0J5fjBgQ9HUTH8+BrkTrN+vOpcr3q/HCZSZNa KgoJrOmhS1d9ZT1TpvH0u2VYkCgQoV+fzl2ysuJItal+z0CEw7Np0PQBQi3Fbc/HJu/mPqCsJ7x9 upmGuR7fkvQEPrih2tXUPplGENYwy661Ey+hQHCC8S4gEgJeXY/nz7/dd55mZACE5VbzWERJd6Y+ YmO3xc0UqVOM4vZ0rDy/OT+cp64MDUV12+NUeAbWNUVE4QDOmtoSuQLRBC49QhRSVhxJslWSZyCw FvRzfXWW9PwgUlU9aE9zGUOQmdtI92qwfnCWJLeMmMyVZ3j16QhAWOBEYl0CZwlfyC3Awi2k+/XY BHZMNQAgCvJmIA4oHroAKW7/+BsE2rJOLcUEIOaGctxzemW3WdGphtIDDza3WTGclxKAuAAQfZ35 GJngoJvE91xLk1HYDTF1KjQ9ECSnGWvXCJqpp+cpHUORzXyoHJGerYDvCxguJLMVlp5qFrAXRWFc jUsXwaI1w0ITlcMAS7LfDpmh+d0yricrjjmWcTaBG8Y6Zc8dM6K0Oyz5w5BZeNWA4411oDcCoQR1 5cqCni0XEqqCGrZNoBtJP5G2m2gIoIdQQWIFM6sT24o7KGjHhaQOzAjwEcMw1HQxBw3aqshCS1Up ka1yW8LIi1bewqcyINDoaghJXU3GcZ2ZAoTNTRsiyYDJAukvBFR09UzqrhtoqGUgK+vHoW27rvQQ xCH0gCLgPZNumI7r4ZKgm0nhmW5R09pgtH3b9mtIt2rA8vo60NuAYEQzgpyXleysiumvFUemrIBC 4C0hPLYVCKRDTONaL3KQasbVWpB5pg8G0ldVR48JIs1NaUEeGrK0HlYHNfwIgnIeebEHgYkRldBl mTiqqDqRh7iDYNDD/OARihbiTQoEpKJBCdFqW0aGBJF4UkE0WqUuomE7dMYrTkafVGVqyzDzk6bN PGz4EQT2shVvteEasgLQ4MAq60BvSzb2rKyvqZWMTUpiw60uc5yEHZjnjoUVnqcVDntGQDolvPW1 wDY0PaAHX8KwGI90MVSw6weQfyk8J2m6DJkPJGsKhMpruwMrarYXBJ6FBJZXdAS5EyvRoRhIWTzP 3CJLyq0HUeTbCHIzFm62LrlrZwdONui2jWVuz2BIR5dlKOIPrHStDV2yqwY0OdPRW48sbwz0SjvT f0ihTDVNqg+8KMuU5H7NbkPmx10LBHrsqU+DsCALLHMsy4uKoqys92HdX9w/0+E8zZ0hZZcVRaas N+2R2c6o03p0c07k9k/cuqKqsrBl2zAWtOAPz52BXpK8ce+0Z3pDj7hTkn3/be3Ddeh1oDfhsO2X bEvXE3m9brNsFPYf2O3nrZj9QbSrkdRF0QyQmtHdDIY5XFnv565e/zCHA3Ptcfcy5HW79ul/Gpi1 1lM581T01MsLj/50s3su+qb2Kw3+ovxpF1vBnkNB2TR1XYMj2XbK/r//pvjT8lePX2/m/rHFd5W/ G+D/Gv/HCCWo7SBO4tA11l2V/1mhJqxquo5k/mP+29VPE2r0q6P634aBym73cf8f8SY3uclNbnKT m9zkJje5yU1ucpOb3OQmN/nA8i8RzkiADQplbmRzdHJlYW0NCmVuZG9iag0KMTI3IDAgb2JqDQo8 PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAyNjEvSGVpZ2h0IDEwMi9Db2xvclNw YWNlL0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvU01hc2sg MTI4IDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDEwMD4+DQpzdHJlYW0NCnic7cExAQAA AMKg9U9tDQ+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4MjgJAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQox MjggMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI2MS9IZWlnaHQg MTAyL0NvbG9yU3BhY2UvRGV2aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50 IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA0MjA+Pg0Kc3Ry ZWFtDQp4nO3d7y4cARiF8Z2ZnZn1r7OrG6JtUN1Fin5CYm1VSkiwKHY4938jOKi0t/A+zyX88n4+ b6NBLyVx+0uQNvMiZnkzfWFIsnKq6sSsmi4zK6RltbDc60es9/VTu/V8C0k2tbC+PRhGbLDz/fNM /oyQV8vbR2cXo4CdH+9+6xRGaPcGZzfjOl7j24vh2scyfUIoOv3haPwQsfryYL37jlA/KGD11S8Q QBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBA EAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQ CA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAjuP4RxRIR/hmp7++e39X3A7kY/XyeL82pl92R0 /Sde15ene/1Zj1c3Z75sDQ5/R+xw/8fiB8+YZ63ZxdWNza14bW6sLXUnPOufNCeq7tx8xOa67cn8 7cFDUbZiVhbZ65eLRpKkUXv/dxK+Rx5lqjoNCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMjkgMCBvYmoN Cjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI2NS9IZWlnaHQgOTIvQ29sb3JT cGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNr IDEzMCAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA5ND4+DQpzdHJlYW0NCnic7cExAQAA AMKg9U9tDB+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAICnAR3DAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMzAgMCBv YmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI2NS9IZWlnaHQgOTIvQ29s b3JTcGFjZS9EZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRl cnBvbGF0ZSBmYWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDQyMzI+Pg0Kc3RyZWFtDQp4 nO1baXekttKehmbfN7GvYkdAb7bHSSb//2fdEt322G9uzus5yUmuk64vNFAI6UFVqqdK/eXLXe5y l7vc5S53uctd7nKXu9zlLnf5B8sO5O/uw18pvzPeHcPu98y/B4ltvHv2NyNmOFHRFGH/L0FiB+OV NU2VePb9iHec4oQRMkSYFP8CLHYMrzpBnISeLrybEztW9oq2zZEm8hz7z0dix2tB2XZdUyCVewcE b2bj3GWeoeua+I9HAr47wtPUt00Z6PwO3CbDsgzYwo6VULuSyrcsFAWmyDJXj7q7OdbtSJWp9nbO UNkuMi8XP5HsOD2dli6PwsBWOBgCL8qyJHIsw+kJOU2Za3lF10SGxPPUQsCjXA8sx+1ZTpBAW6BO BH4LoiTyLLvnRUkW+U+23Ox4q1wWjAxNlXkYvWy4fuC7uiTIbn1+WqsApeP52EaWrhuauGcF1dQl gEDWNVnSbBQEyFJ5di/qluMhR5dExXSR75ky96mQACCq9dD4m0dkONVLq6ZtqsTRjGh6/vbQ52l9 +vl5xREK4sAQBT3IElviZTv0bQtlGLQLXxNEMypxXefINP20wnWVee9dzv+6UNMgJ1IgXeLYveyV /dD3wwQ+0ok3ILK0Of3804rjIGuwr6lePY+JIZsJzn0vLptuIBNGquo362HuyxBFVde13dCXnvSZ PCx1ls16JHXsKIJo5ePU5FnVky7xgvbh61IgLyOPly523bQfc9tK5q+XxjN83JfIRlGSVeM6paYR k8fzWIQoxNNYF2U3j6nxyaaEFjbzYR1L39CDbu5i2/RKQirkleupC3QNNYc5txQ97Egd+hUYyhR7 STdktm7Yrp92h7VyrXR+WArXsJLxMJVx2ixr7QjM3z26HxAIqDRU9MtxqUOUT3NlS4IW9XMTuBlZ sSNJdjWPscpLLiZDnrbn569LmVRjFxkKeNa4mM6nGtkpOba+IhnZ+rA2edmB4/HEzwQEDbFlK6yX 04xTvMy5we0hgpjbEIBYKksQrJL0obLnjWwibT0eL5dDV/dTjXQDpSXu1sdLC0BMVJk3itPzeWrb YZ4K+1PNCEq5OFHzm+OpLxsAQr8BEbjXsQlmQYZI2e+VsF/naV4IzB4C43RNVEJE2i0PZwAiGUlu 8BSIr6ceVxX4Uu1z+QgWIiVesovlNJb1vLyYRv3ykQGIeUo0bi96zfFyPoxNf7hcTmNi2dlI2qLo T6fmBQhOy5bLXEU+gpBC+FyrhqibBkzyalnbNB+XzVkW05g7VgIeg872HOBxZV4wy+Pz12OT4fXr Tw99YLjVvDRp2h6PGxBTBlalhOAsc9+xLQMiqr97dD8gO1730yxJy2GZchRgQto8LfupCXQ96klh wkdOpuOY2bKgJfPz81r4yfT08xk7ql3Ma19V4+lQe1bcD6nOsaJTEdJkELG7Gv+ZQssdb8R13/cj GUvwfmEzTTSiamJTUhBuk81jNOvSRrooe+3p3Iemh48XkuiiFnUL6bsJILQhsKhDdQ+xaVAPQ1vj IjTFTwXEXvXyBmLBGmJiQTSComnbmo6CE8wwceU9w+tR3eFQFwT4USeWrAW4zR2RE62kbhuMqV9U rDCyIZQEbT/HTQ3X9M+1aDC8avthGGwsiYUTSqNsTWCZvaQbCkxvVtC9AJnAtATdcQ2JEzTHswAh VjS8wEeuY2kCD8oyrBI0z2NBEz4ofq4cH4QRgqQowJtZmkrYX4k1t2UkgHgzu2sub+PaQLVBjWHo Yb8pbJxdEICv7fkr8b42oci/yfz978uWXWFvecmXrMot1/JyvCZaaM5lt7vmYF5usC/pmNdE+NbE 58vM3OUud7nLXe5yl79d/mth/SXw+O9P/DnvZd68493J3yE0wtqzv6mrQ7Ap/k6guQVrf0KXIfqV XoNZCHklGgr/8WY/Lu8mAMTgoqKqsvC+yrXbyybQEeY3D+7oAATxT0jg0Mo95UNbSztWMpFvK38l 14GhA894PRF1L4wj35LfJekYwYxT9L5fQEk4WincS4b1x1NZO0Zyq7HPrA1tRrTzfiydvzB3DEPX NOmWiYITK8Zt1+LYelc9Z6RrZuPNJSCpdA8KS1PoIXD9PwoEqybz16cp1qCl3V6LydPXOZLZW0H6 pWrNMK++422lendjWy886rWs/fLA7vtzX273b+Xwl8I3fOswdOSrJew4Pe7I1Lc4degcfeVvrBx0 Y27yzPc6OgUgQpqwfwHi/3T57as/AsRez0/fvp2xLTDQKae+/PrrKVVvVWrKmGmKmhcESbqWrJk3 5etr4ft6RhPZLzrwAC/AmcBxvHi9duPWtEhOmfr1Pi1881rUdplzrfcyolsvpE6jEBkwI0CPknQg 56wc9lNhQYP0eWpNHC97VYd9XRRU2wXTZq78f6uhv+nBR6HYcUZx+uWXxyFU2B3Nmz5++3bKNF7Y 0is01cJykm5ZDvKRpWx5F2srXys8w3Cy6QVbRkbieUkHHQ+u07K2admejxxDt+BgqzQ3Aw/SS7q4 Z3nFsCxa7zZkQfaa02XKXYVaByMF/XFKHV1TATFWoI9sbXJK2JPSlmVNE1kGbuiqaufzZa0DU9Vs 1xD3+5u2+bYH9oeznhSI49PTZYZ5x/ImtP380zHTJY1WqZst+SbZcVFWddvkSOV51aXF7vr620tx 249jHZuy6sQF3tJromhGRVHitsV5msOh9DV+L+h+VtV1GduyAM8VBbRYp65uJvNP3x6HxKK7jgCI 4URolpfOAsEIctoJaFNSKRCOboe+IbC8jkLPDrrHb89L5Vt2ENNugnbdNN97UOCmrQKd/5i/AyDy 5Xw8Lo0ncTKq58P5cc0MxYzKphvJWDiKHnXLPA7TMlWuLBphQW9MlaeoXgEozOcLrVi6WdN13TDg QNf8hj5A1uMy9QNZCEaKqAcY7vdDm9qalY0LGQYyD5nrZMsvvz5NqUXztAwtfBy62AYnyNJE5zD0 8AocGEYEQLhWiEvop+QWOPXj/unXn1YcOH6BE0s145t2Hej6tQfTPDe+/LH1hAIxH8i0DIkuGUkP v85LZsgGipOsJmsfGVa+XNa2qqd1jHVJ96Ikw/A7sayknzrcrg9r4blpN7Zl2RJSeXZCLsceN/PD Ixzq6TClpo5gbcIF7kkb2ag+nue6bMjShk7YPz6vladS04DepONx7QvfEAXFr6ehyvJmmipkxz20 7GRDFyq87DdDgXx8/HqmNZSgHkrPCuqpB23aAwQ9eDj1GA8ryT5YUN+AWLp2IpVreNDZZjwumS7K huP62XiaM8suDuch8QI8g/1I8la+7o9L4XkFTIw4G44kc/3NySV4PvSRl80Xkvthc3pcCj+o5gUj Nx2XPo+zbiEFCprTsQ29qF2nxHLL9dT66mbLsHza+bAe5jbZ5g3BvmlF7dwnXkKBcItpiFVeCbqp BLxH8CemogXthAOUj4CXCYCtQ4JosSxHtCKNP1hQp0AQgotu7hIfvirO23XOdLA414+r+eFQOE6x rJWjGslI69yS7vpRMV2OGKFqnnGcdksfu/EIk6As2uU0Jl5GDg3SzWymewLMeFyaMMCHM8F5Naxz BRDBlzJVu1xIZlnpNJfWbV8iREdWXJPjccxQQPeT6KJkFTMp/HTYgCC0qr55TscI2rn16fxoSR2G Nekj6LddLSQP8vnYIg0gmj9aUN+AmIq4nEhTNGOXxTUAAabhpyXuj0+nCoCYSaoLStAT7Ko6Sgvc HZ7OtY/wehpxPU7Yd9Ll6WHumh6sMnS3oUlaNC7YkdWgX7o47i5Px6FpR/ALdIh9qAp6BnPMMreS 58v8pfGVB5PsNOQwe7pA3nMaNFeFvwHC1lFDqGeTKBBxAqggac/pGZnLMCdLaYmSWxO4+ANAZCju aJma4MCvljkzDb/q2gbGe6pc5/p2CjxGlr+Vr9fHDYjjw4lMUxtbJgBxmeqqwlVsWykdmrg5ektU fBhQAkA8Li29nyELYdL6Mq+l81LY74DYYhMZJsl5rcth6fwrEKQMXoCYEk3Q4nGmQNRvgegoECwF ggAQE7QpiA590Q8AMaa2hw8PD+cptd1ymXPHLcapzsvpcihfgNjeR02RNHkxno+1H9Snx/MytRnM k3iCNT3xEfJMakS0G/S7FZYoUyDiiO4ZyAK4b+ua9w4IOqqbaWyhFsQwfnc6NGW3DLEmiBaMPr+a hgNmnJuKRWvKtubVcxfcTCOKm7mPrtpj5mcUCF60fwiIbBoTEz7p8y8PfaBbBQCx+T6cZMN5BR+R T69AgCkuc52k3fFQB2F7ejzNA45tVfPbw1wFjmWZqqzHtKxNbWm6AdFGfkHWNnFty9RlxcVTi25A WEY0rG1wDXwYXtYNXbei7jhXaT3D2A0zbEgHTqifYPlMpqUJXHjxEYBw8TJltHxIv5BfwUzwDAu0 28hLaQ8AiGr6sGns9XQEKFW/f/r5XNmKmYGlOKhelrbE5Lzktp2BgsJJqIYFPcDL2pXVdFqxH7Zn OiO6KrJ1p5jmLo8CGtnpUT+CU5GDFuiBKCPop29HLRmqmNYCVcUpxxpJvJrAdzM1vzuQEuIzhpJf K0yTJK0JTCKU9PNQJSkexwIiCOAathF0K6mLZrkcK0sBL7q2dPlsxgo5VLuEJX8cQDumPeAFa3vR B4FQo6b2FdGEuGoMVVGLuzYy7XSYp64nsBSZZtxgX+ZEp2gg/kl7uNGRdcoRBeI0T9MIi53pQ3+7 uioSV9N83EQaL3lVE4Mfd8qucDU7bWFtBhfhG4qVNoUjckrQdrEu2wVZgP4CtwAg3Lzp+n4iHcRd TtZPIwRhfeVrGqqaxFDsnIZi4wKhiQHeuF8JDajKhmrnVLsf+gpde6ByvLG96GNAsJKTAOflZA/i M1OAqC1NHEWFQLGtIWQG+1fdOLJoXBskSNecFELjrXzthGAgY13389L4uoEgwK1xAVGhbEWxI3GC EcauzMFzKUS9sh1DhF1XqadB/B5D6AsxQ5K6EHCjsquTDQigolHVdl1bxZYkyE4CAXqDM0R3o0Jj iqBQoOA1OPcUXgRA2wJC7DBBmqi46au2tPVgz6levG0P/4gwnGIawII5xbKB8dFTU+Z52USBjzzX UgRBMQyJFq51QxV5yfSuNwwzHtaxiOOKHGAxFBXLC4KNIfGyYQCH2tMHgF8CAdLEPSfqjg8KwLo4 QTUodwLORhkSrzq+b18jy606HoW+C9yM2UMwEwCl24ictDXGyUD5fM91tj3LEnTSMxRFN1Vhz0nw KCWAoA2/jStDND78rwC6RZwyV/DXAn/dMc5TUs1Tsi2KQKHZq8JW2Wa/3xDpzByLCEKQBdaA/Z7f KthAfG9l7VspHA4C5c5A0+VryZy2+MLGQQGIPbDnK1/equNU61ZLF7cmafeujQETk27V861lSd64 /tbcTfs2GP6aM/iB/4ls9ekNkVvS5JpmYd5UqV8L1y//K6A3WMmrydSUVTP2OV3+mJeS+O57U+8P r/dfauQ3vdd8ylut15M3b//ytl/fUz1vX/Bee/cX/HOI4fUQjBLsHhzJLVP2/770n1jn37bBhEkS h8j6XLvf/mzZMbykQvyjyf+af/H9joB/2nP0Xzj3nS1f3u73uctd7nKXu9zlLne5y13ucpe73OUu d7nLXe7yUfkPsskMJA0KZW5kc3RyZWFtDQplbmRvYmoNCjEzMSAwIG9iag0KPDwvVHlwZS9YT2Jq ZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMjYxL0hlaWdodCAxMDEvQ29sb3JTcGFjZS9EZXZpY2VS R0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDEzMiAwIFIvRmls dGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxMDA+Pg0Kc3RyZWFtDQp4nO3BMQEAAADCoPVPbQ0PoAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAADgwgA0+gABDQplbmRzdHJlYW0NCmVuZG9iag0KMTMyIDAgb2JqDQo8 PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAyNjEvSGVpZ2h0IDEwMS9Db2xvclNw YWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9s YXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNDE2Pj4NCnN0cmVhbQ0KeJzt3WtO EwEYheHOdKZTTGEoNCWoQcDWalrinwKhgBI1xgAtXujI2f9GkFMuMSzhe98lPAs4p1ajRUncHgnS LG/ELM/SBUNSL1plO2Zlq1m3QlqUm9u9fsR6Oy/bVkiy1uaH8eQkYpP94avl/A4hL7fHX8+nEbv4 dvi23TDCam9y/nteBezP5elgvUj/ITTa/ZPp/CZi1ezT+84TQnWjgFVXn0EAQSA4EASCA0EgOBAE ggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASC A0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIIDQSA4EASCA0EgOBAEggNBIDgQBIID QSA4EASCA0EgOBAEggNBzxDmERH+22jtHV9cV38Ddj09HSwQ8nL34Pvs56+AzX4c9de825wtv96b nH2J2Nnxx60VL3jXm2tb74ajvXiNhoM3nSUv2ifZUtnpdjcC1u2svsgfvg3yohmzolG/P3ioJUka taerj/DdAsxoUtkNCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMzMgMCBvYmoNCjw8L1R5cGUvWE9iamVj dC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI2NS9IZWlnaHQgOTIvQ29sb3JTcGFjZS9EZXZpY2VSR0Iv Qml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDEzNCAwIFIvRmlsdGVy L0ZsYXRlRGVjb2RlL0xlbmd0aCA5ND4+DQpzdHJlYW0NCnic7cExAQAAAMKg9U9tDB+gAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAICnAR3DAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMzQgMCBvYmoNCjw8L1R5cGUvWE9i amVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI2NS9IZWlnaHQgOTIvQ29sb3JTcGFjZS9EZXZpY2VH cmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9G aWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDQ3MTM+Pg0Kc3RyZWFtDQp4nO1b54LbtrK2RLGTYO+d BCtYJG1xnMR+/8c6A1LakhP7rpMcb26i+bFLEm3wERjMzEd9+HCTm9zkJje5yU1ucpOb3OQmN7nJ Tf55stvt3luFv4Ps9gzD7P8UGH93HHfbHPff1HPH8JIsCeyB+Xa9b47yB5v+GAH9OEGSZZFnv6Hn 7iDqbuAZqiTyh++bzo4KDHPgv7vpj5TdnpN0xw8Cz1S4ryOxF4wE10Xo2JYmMN8zHUCABYh3jKiZ 6Pua/kgBHFQ3xU3b1pmrsF9Tc8eqUTt2ReQHofP1ar8/gKQqPLNnVTdw5L/tkoAZ+tVAhq7r6ljn 4c3t99RcUH3pkt7v6c1uz5vlNOHQtv0ViM2srBV3u6fK1wb7rZu1eM8qTugh/sAhF5oerlVejfD+ tmPHSG41kjqL4zQNNJ5hWF4URYFl6FRZjuMFUeDgqRJ0p6lwNM1yDOmwmhUQsCsMLHyovGNY9rCn TdYWLMsJ4lYs2nmLAyTwiukYIoBzgCKocqDb5TICf3hvKHacnpGpDgxV1Q1N4lhBNV3PtZDIMqyI dMN0XFuXeNEsTh/Pta9rJtyynKTZXhAErqGIMlIFZs/wiirx0MQwbcfSFEW3oR9TFQQ9Ge9PdaAr KjQVD1DRcDzP0WWOOQiqphu263zTPP0Q2QtuswyxxsMr5HmOk8woxzUuY0vmRSPK8rzCVeog5Hc/ ffk0Zo7tRy4SFTsp624Y6tjS7MCHlcSqjm8rkh7kZVVlvu1GeVXj3NeRW99//nmpPMP0I0fhBc3P KlxXqYcEuE6zvMRQD3H7dwWCkcNhaRyRWTfrQbTSpu/afugyW0FBO419N4xD7prh8OnLpynz/Awn FrKzdhim8/1SunZUlY7ICmZaxQby6nmZujLywqyqO0JwYPnN45dfTnDh5VBD1kPcdW039JWPVKca x6HrR4I96V3Pk91BTaalNLhViR2L4pa0eZrDAZGYZjbfL02BydxFlofvfjpj3/arvvIsOEHaqp7v j6Vjp30byKzoVF1uG/H4eEeKwLbcME6Kbh5zx8mXnx662NR93BcO/CV9mWY1IaVjhMPdqSvLbiap zr0rECzK5jnXtvNwL9jV2Ke2bmfDhH23PN71seNXE8ksMxlPfaQjD5M6cHMyVlHSnqbMtDLSRwon ujXMzEzmh6VwkKyALXGjelkwLCYws5khq35DKs/JhrHydCNspi52YnI35Z6bDlNl8e+5N3asBkBk VyAkv5trV+Zlj6rpl/NSWoqekDE3taCbakeWXTzWoVdOM47iZh4i3czGgQLhNWPlAlzn1lM2mxtk 3fnceLqLpy5QeAlq4CDA0xAjQTTyacy9hBxbX1VhuNoR3hWIA0rnpdiW5Y6Ro2EuTZ7hrWrqk6Cc xgTxStiPuaX57VhZouQAEIFXLmeCq36sPWRsQEgXIMjaASvbUV4288N952lgCBpPYilUOIyaufWl A6smZCqDdSmIoo3HxhXfFQhGiceltoXVWLJqDPMwAAiTAuGX6xTloBsLAKJ5AgJWxPHhPBHSJoak pSNJVB5qTQBEPIy5xjFgOpu2bqYrEO0VCLqM4GYFYiz8pB8LQxAsCtW7AvFhL3rd8Xp8ilo8zNiR eMmtxzbyit8Hogn96vR4v4xt7igCSsYpN2QtIdQeABCZxrFKCNY0z9sTbBTNrp63RhjWcx+pvGDk I8k8ACI3+L8FELxZTHMdGog6T3AazH1ialbSkdJz8g0IvyN0azSkvKyIKMCnx7t5wIktC2oE529g +/XpVFMgSKpxHErHpUniegEgkF3OY2ZSYzlWPqA7lo6mBxRqO4KuKRAleW8gdgclaOapzZMkTUPX K8nUZnHWDE1kmOnQhTIn+c2QmeAhDIUpiHY14DCozx/vF9JWkamApVtGnOPp/owdI+qGBLEcLJPj AMfi6dy4KtjFYxuZhl8PpWtG7TSUSVINA5y2QTtkOi+YxYDf10bAkuC0qBknMvQdvGDDr8jYt13f pKaiRXVF97ZTQjim2HmdgM5GWuc+APFIbQQYCVM1s2Eeh2E+rSa1qkOFPch+M41dS5aptCQUdstY BbZX1FDdSrtxaNu+Kz1Vdcs6QhyvJ3VuveupQc2loAVFA84eTl0kIS+vm6YuYxMshRWFBn/gtQBc Y1GjDjLLqV7s20FzOg01bqelBffQTuu2weAne0g2wsiCwIrXo6qp4VkRIHDVk6YtfMMMYlcVZCup YIQqdcFS6EFkSyzEpxH42O8ddkEUZHpBSAMonuVkw/UDz9Yg6OJkTRMP4HcjDUogPlIgOOVVHTZ4 u4xlFBXkRCJVkHTX913bNlQBgjFNZveALrI933McEwkHmtvyHU2Wka7wB1bUHD/wHYMGXbRrjgZs 2t8gZbPm0GSaqoNYmF7T1CRHw3CIkddYmeNYhgbYa56J5QXFbxdSRFE+LHAcsAdOhIBc4CHmhhCb NgF0WQjTIdjmaYjOcGtEztJ+6J0AI2yj0a7320jvjsMKxXPy9nJN0yY0DNuyJ1v65fqQEeySjE1Z 1n1Pt/YlB7MlaZ4yLluXW5tLrue5h6fRnh79f2QKaFKrbKgJqL6V3fvnC01z2kEcR6FngEF4b3Xe UWBPiwrSkCq9f4rtfWW3puj/ONfzT5Kn7PVNbnKTv1quTsf/dojnMVYy6V0zo7/Ptu82v/IrLf4S lamjLFydVurT/mga+pUhhdP26lS/qnMQNV35DZ1xMcEwAeEvcLp3rGx6zoW0puGl45rSj0SC8n9P 06ARmOUFvqu/1mHP6UHsvKYz6LF82JhzA/F/Gom9YBddmxhrgnzPG0nb5eYPzJbD1BVVZK8LUtDD smmbMtKFl8t9vyY60EsXfWXOJY6hDH1g/2nmfMco0fTxcQgV6Gl3UCPy+HEMJOb3aOhtBb8o+LB7 CsF2H17UeeatLw8/XCtfAqtX1LnuB7AGt7iKRVFDCM132CLz3OeOWVNfOrd/ZtP3nOIEjspR5nwF Yve7GrwZiAPKzp9/vatgFVA+v7r78uWcKAcaQVMamtlfiW5hvdld+en1CylqUVaee+W2V2r7mbcW Vp4b/m/B9tpQ4Nmtj7UCxN0Mp4Z1m5rSaglheeJprFOITHTYrM9jMVKwZizZJzad5SSnaEtPFQTF dPQXzDlz0YADDd7u1u9YLT//+utD78vMjpGD/vHz53OqcrxCiWdbkzaiWzdthzLbe4aTdXslvdn9 npU02/Upzy1xrKhSaluXVt5a1w3bcQykapZD0yr7HW1oOTQhc6BZHEqdOxYSecmpz/cks9eIbC/6 3XFILA0p4mUsl47FsWt63JQk9cKmI0Uxs+l+wf4Tc36pTVXeNKBDv5k5p0Ccfvp4P2Uax3B6Nj18 +vmUIlF14rysysSWuY3oLjFOHZnjFHstSB1lvS5wO5AmNmTFDLOiLBKXkvvB1qBMoqTAmMbfDI/c JC/LLDBEXrbjLC8qXMWWqsfTz58f+sSgNmEv+f15TA2J5w4MNPHSssJlSin1lSdApu9pPEM3g2MG 7ePnT3P5zJxvtZMtrZdl2cqcq29kzimPt9yfTzN2RFZy8Xy6f1xSTdbDAtcd6TNTRmE7T0NPpiG3 REELcly3ZChsWbaztu+nu8dj5eprMrLputJDqldPtMG8TEPXkYmUjiQgnxrBtqtjQzHSYR77fpy6 1LbS+dcvH0lq0HNrLzjN6diENDUH0w2qKxeuaSEAYRtBVVA23c6rxIu6j19+XqrAcvMq1mXtypw/ adAN04jdNzLnFIjpOJK5j5CoxR1c3c2pJmluFCcVWbpAM7Ll4dhWNVn6UBWRAwXlsPSxbsQtaarm +HgqXTtph6YompEUjhGPD+ce19PD46nD0G5IdNUtYUJ51ZE6MBx8up+h5bQ0gRV0j5+W0l2dhB2n peS0dJmLBE52K9JXaVaPhGb2u7F0rJVN5ySv7nPPq04/3bXRxpzblDnvyjRfNTBBg1Nf4WEhqfa2 bNAKxNw2BPBGDihbD6c5RYJEGeqkO02pYebH+yFxg2oaM11cC+L2OOe2kxNShGl/njLHx/OEk7ia jl3opPP9tOXx58IPymmCKSSAXR6n7UygcnM+t5EbtQuJDbtYzo237WXwCex8WI5jHRkqrJuRfjIS tTPlwikQdr6y6ZLfrrMdTiR5wZwTuk3ibu4id9XA83LyZuacAjGOVd6ObezGzYCz5jiliBeR5QY5 uVtyy8rnpbIVLR6m0hRFRKnr4Q62g1tOYxnE7dzHdjTcn7oib+bzEDvpeGo8ZKTTGRaUHg9zHfjV 8W7EWdkvU+kF9TJlhmIWM+BsJGQqwI3ZzuODZMb1eDr2qetX0xBrgmgWKxfer0C8JhanxpO5C3Ne jV2EBNGiVJmfTaCBivz2zcz5CgTJo4KAmnho0wgvE2wN5MZZ2SyPpwKAmEaARva7EfBADi2YH87Y c8vl1JdVP2LPSuaPD1Nbd9NUBzYlrw1RDYe5siXF7+Y2itr7j6e+boaJTnHl/gWUToCHvlKg1/W7 OwjIzfrTqUth9axcOCVMy+C/gDCRW481WIyNMI4AFZfWTsepCLJxLg3he5jzDYjUjTqwbCPlG0t4 TbrmFU2NWwqEbcHo8ZXLN7y8afAFiOr0cBoJHBqmAUDcE1zCeRLBDUxNF1ZDbwiyBxOKAYjHuSlB UtdwMaW8OTWZ5tx8BcTqY0hmSu5mXPRPXPgLIEis8ko0rEDgF0DEFAiRoUCMAASBPr+LMF6BGBLT rY4PD3cktWxYr5kFO5XgrCB3xw2Iy9cd2Ie3Reos788n7Pn4/Hg3kyazVRQRONMjj576dBNRNeh7 yw1BokBEQX06d6nvuo65fg3VPAMRDU9bg4YP4GopXns+NkU3g3V+wYWDpYFtnOmSnsILN1UHT+11 a4RRDavsUjv1UwoEJ5jfBURKhljXk/nTLw+dr5k5AGF7eB7LOO3O1EZk5AmIIKBGMU7a0xH7QUNZ zW5jd9vjVPqmoWuKiCJKc/MrM74B0YRePs5NZBuGjiTZrsgTEIYW9nN9MZbgoiGkqnrYnuYqASez cJDu17D7wViSwqbflmDf9OvTEYCwwYgkukSZcwwrGXa4jShz3oROshLtgvl25hxc7GToQqR4/cdf wNGWdbpTLABibvJqvJszcyO6WdHFQ+WDBZvbvBzOSwVA3AEQfZ0HBrLAQDdp4Hu2JqOV5gYgaHgg SG4z1p4ZNlNfRr7nmopsrYQ2p8Tw3nTAcCG5o4BnCTGX4cdxlOBx6WI4tGY4aOJqGOBIDtph/SZp Gausmu6PhSEb+QRm2NBX5tyKu6nL4wtzvmrA8d/BnO8OSlhjTxb0fLmj5KQatU2om2k/kbabFrpY IqggsYKV16ljJx0UtONCMhdWBNiIYRhqepiDBi0u88hWVR/XocptASMv2kULr8oER6OrwSX1NNlY CW1wm5s2QpIJiwXCX/ohDpyead11Axm71ER23lMuvOvox4XuSrMD3jMBR+lIEg2scTeT0re8sqa1 YdP2G3OONg3Y72HOYWwrjgyBlZwcJ/S/ncSWrIBCK0OdOQo40pFB/Vo/dpFqJXgtyH0rgA3SY9xN M3aR5mW0oIhMWTKj2BZBjSB2ZJZHfuKDY2LGVb0R26Lqxj7iDoIZJ7YEFqFswd+kQEAoGlbgrbYV Zdhlm34A3+CMfm66dsYrbk6f4CoDd3/95ih/Ys7tZKsN1xAVgAYHVlkHeluwsWdlfQ2tZMOifDbc 6hBSSIYL69y1DYXnaYXDnhGQTilsfS1wTE0Pu2XIo6gcj/QwVIwrTc5Jmi7TD6uRroCrvLbbiO0w 9G0ksLyiI4idWIkOxUDI4vvW5llSMjyM48BBEJux9Fcfa5fcpbMDJ5s0bWNb2zMY0tWvzLl0qQ1d sqsGNDjT38ycX3ns/YHnN1qbp0H1SnpLK0PNvCa6uUuBoAawh7MwKslCv/9ieVFRFEnYaG72mb5m uAvNLciKIovcSpavQx04GpWvyTlxixIpGa6oqixs0TaMpcgvuXDQS5I3Np32TG+uzPn+Ze3DZejv Yc6feOxr0mRLs1x+WXBlrT88Ed2XVMz+IDp4JHVZNgOEZjSbwTCH7Ydcz129/sccDpcfK1zSJ9eM zsqpX94Ls9a6ljPXomsvl9Ff3Dwx5y9rv9LgT8pXu9gK9hwK6ecsdQ2GZMuU/V981lfLXz1+ncz9 7xa/qfybAb41/v9GYGEiJ0zSJPLMfznPDZtS1XQdyf96nhs2/Wqo/t0wUNndeO6b3OQmN7nJTW5y k5vc5CY3uclNbnKTm9zkj8h/AEGHVpwNCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMzUgMCBvYmoNCjw8 L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI1NS9IZWlnaHQgOTIvQ29sb3JTcGFj ZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDEz NiAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA5MT4+DQpzdHJlYW0NCnic7cEBDQAAAMKg 909tDwcUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAMCPARL7AAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMzYgMCBvYmoNCjw8 L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI1NS9IZWlnaHQgOTIvQ29sb3JTcGFj ZS9EZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0 ZSBmYWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDM5NTc+Pg0Kc3RyZWFtDQp4nO1bZ3Pj uLJdBeacCeZMkAQpUZI9YXfv/f//6jUo2TOa3fGMqrZqrvfxfLFINho4CA10N/zbbytWrFixYsWK FStWrFixYsWK/9/YbLbbzU9I/ePV/oTMP1jddgcApptv3zMsu9/+uPDbfUQ78YvE8vCW/I8VLjJv K3kAW4YXJUkUeGa3+eaDpGvi/m1uUJpnd2/IbHYsL3D7K6PNds8Jb8pTcZ4Bcpvv89vsOJ770bj8 JDaMZKEwQJ6tCXdUNzvBjkKDe7MaKG2YCvt9mc2O1xzXlK8iW0Y2XUflvs9/yyqmITG7HfPtaHyt UjU04a0+/3lsBTvvetzUZWzdDfVmrwR15YlvDu2W031kvtGUDaOGTVd6MlW92UtugWukMN+Thz43 ka/zrKAowncmHnS5jZzv63gEm70cDufj0A2kT00e5uiyVunsY9Skx6HCvKwzeH81ES8zEyR3/I3+ tdT25f3r7y1n1+ePp8rmt/TBLI7Pc2ly29cCi/zmtdIrfUE0EKjdbza//VXxjpUd5CrMnY7l29+a sLfpM2p6OA9FWpFjF8AYbelaFTggzWgpGRJDoosVlMKy5QWRZ/cwMVmG9tN2z7K8ajsasNkynLAU o33CchzPc1QGJpfXf/rv5zEE1ZudhPoPfzy3Dg9NZfilwKKZZVlQTuvZcZpjq5IetW1sCAyV+1Yx z8uGY0rMHiwztPVa0dIAUfwbE/YD+lp2OFaehZp5TFRmx4ia5TiWKrCslo6HOvQ8RxcZqFrSbfht yFC9KsPy3bKSqsiabcNa3vOK6XouFAMNgmaYtnNd7wv9//x+KsCIbFk9O3z8ndLfg5AFBUyF34Nm TTdMxwXrw+w41bZ1zW/Plz42JZa5V2xaoFhVTaDPCYquG7brmAoH3UblfIR8S+F+Yre+o38oLM2t DmOqcZziRFlRZJElC3p2vExt3VSpI7GsbEd5WZWpp+tu4KnsjqFz0HTC0BRZwQiyqq6KyJY5wYyK siyixSRQ+s+fP51bMCI7wa2PT8/nxhE40FZAgQwZ8NuJsywvF+vDimYYOk56+OPPC44MSTaDrKSK LemquCpi10GRr0m6n6QpKMmRxjFLA9p+wLnzg83qL/SPc+07EZ5JpPKymzVt0+I2tRUzP326jAMZ h9wSec3PqgYPfeG7cVW4QNlOy8QPyxKpkhk3HcZgQjNH0UJ8PBJQIF7p48vT+UQSjWXVqJuOp7l2 ZdnJ2qVAExmykfQT6bph7BJDVFBZhn4+//nf5y62NDu5KU5tWQ2uihHK6szR3ZKMfdePpPYVUY9q 0DA/nTGSH6Ofn57HqsDzuQ8Uycq6vsoKPHaxaRfnT+eurMmhC1VBdYIoLvqpT1HadYkuqGGLU5Tg LjGNsBnaPMnbsU9sOzt+OHeZp9JZSOmfjuNhKm1RtIth6MepdlUr7YY6S4qONIHpVvNlqguop/FU Pe5w7EbDh09T5upW3A4tyC3tsRbFqe8E9VD7ZthfTn1ZdocxtzSvGrqyIpcLfnuv+hv6ZxhjMj8/ DZGuBfjQ51HSQHs9tzg9DYmLqmlMwRhrpu1G9EOQYFK5qp0POPaSfsgcrxi6xNFtGMYaeSX0Z2rJ y+4O9NvjiPsJh7oeNH1T92PtGagZ28g03IIMuYea06kNnaA5QAvMdOgj0ynnU+0oilsR6FDDSYex 8t1ifiKJpap+M7XIiobLVPheOkyNb0XdWEdhBWZs2WMeov/x1GNyAmWukx1gIGD0j8caqjscS1vW 434sTEFQLQ+lGOYuQhXBETR3qHw77knuhS1wkjnJbaYuRuUMy1tcDP9C/9CX1UCgpXnXZhmGyWon w1hYAg/TeazDsDmOKayBbCSJaaakj3QjHcES8bKPYa5IvOw1E4784jBXtsiJUA0O7Kifsa8qXg1d 68TDoYmCgpBUZx+0/POlT8OknuYuCekm3TdND+vddXNoD5gDhAn0gurGWdGMlzMYirQnZZz3fWoZ UU8KlPQjbOY72NanIQ3KwyHTmOsYUPoTTpJ27PKs7cswakiN3IyAZmYvuDAL4rAeYcVySjSQ1LIy 0oeanhASq5wc9lNhcnvOKsc+RsW4bE68Uy/0u7G0BMEqRkqfnGAFt6QNlQeW/m3jKx1VR+08lUl7 +TDjEix35hs2tCSSWdFrSOkaXt7CLjBeTrVroHYamm5skaot9GECFpS+UcDiB/pj8tKIhX4bQssP ZBgxLKWa0l869kY/CmsCGwMLXEn2Qj+m/QP0QbGx9OtCnwyRvN/e6IeY5AbHGTlMRTchT5dpGLrM fug0vNCfMkOUnWo+1kk9X4YMea5rabIB8zC80oeFByPewNSd59pR7WKaj9BbtqSG19Gfagc2Laca YY6W0xgru6/oN8iGhfp0gQVleJS+k5IxN3hOQXTyBxVpvqGvxWTMdEEJugmmOyu6FXSTn9P27L6i n1H6GeliLx2fn+axK331DQfke6NfuZoR4HkqggwOf4ljGoYqCTpYoRf6iBrAKoqbGZafpEXk6ePz mGi8EtK1H9A1b6pmDMsETMZE7unXnu41T398nnNTdSuw2mCpoE90zcmGIfP8arjRH2Dy00o1LRoO tatQI4ejV8XZF/otAvrDlT5YYD+bnp+OpEndt/yvv6O/HHrB2NfjoQ0tvxqHMkK+Z8FeCmf+QGYE t+pLH8b0gPOiP82VJUgefv79Q+9LrBzgPrWBxtiksGFAS2B/onP0lb5bk8pRjGz+4zMJVdkp+9Kl e/ZQxVGGB7rxFX3tCgxVBaaPVqoqqJuHzDVAMWmSKL0qpp8koG/DdEEW7COpznF62tOJcfjwNBNc xbb0iC90dXnmAYPPA6dsWQ/rvmuqIkWGpIXU42N4K6sTx467iWBMjmSpMzs8z7DcGdGr6lBXvbIf uhb39LSkhW2DXjZfaGvepqYINvw8U0tlpnVqyhqqhx5DgSY2FDOpM4u/qdJppbJol+PUxrbpg2L8 qnjxQMFxStvC1b2ijlR6lqrLwMsPzxewLgNOrYcWP3j1OW16U+eBIbC8HhQ1eL+prwnS4u/vWNWP XFWxk7ptqrrOPZlhRHBcqRcL1i6MbIlX3BS+wrHVljjRjiPzZfPdQOnYUzhOC6vClxlW8SI4EPEa ymmBIjREKBzBkr2qkmVaKVgFv2yr0FQ0L63gGHpTvMQfNozixUiXDRTZ4n5P38LBYzqNTdXQE9qD pp+GO8IAju+L68Apth8EyNHA51miPeBNqLrCs6LuIrCJVw+DkS3XhmW22YuaLrF7VjJcFPgOdVqg GPhItyZsltLcDv5Y1AkC/csjp8ApAvm2Ci4PJ+sqv9suqjiOVsoszfBMGR7vFNPo04bqUAVOVHVQ uGVlHbwQsEx1HKYYThDaQ7OfBrtkWRKvzuftUabxqWusD6pjWfB/d6ywxMSuvie4l/yLswp/aRBL kiWBvX77KkQIpZcS1FmlBai3fBWCakR++QT17G6qqDdNK6XNoF/vFV9jj1AAathda6aaeMkpqWEO EtiQY/WxQMg11Ln7EjbY7fc03Lh5ifTC3+vDInWLPHz1g/69fV1+3geIl9K3t5vXx5cA6/2rL5Vu riHP12rvFN8a9Kp4x4GVJrjMK3BYHjrzvzRxc//0nTDTD0K6D1b7s/I/VLzZSw44qjW1TOixjf9f AWqLUBRFIbKVN+Ko/1ZQUyGrmqbKAvNArOffAzAADGD/j6U/3hteA9ArVvxqbB7MOLxTLAeU3V9S 4bfj4HdK/Ezm/F2ApmRFOAx/k7a9OgPM/QnkZpxovujNrPD7wWbPa7aPwCfh7whtqf/2je8Jp/pl Z9oLmvHvOJ3QlGRUwnkzR9rdYXNHvffgLuOw2bKiIrK7Lau4yH4kF/M/iw2rx5gMuK0igw7/Szp2 s5MC3IPztX1JBsOCp5lZR2H3nOohW9p/yev+9nWW91dTegRbwW0mUiVR4C553j1NDy+Z2iVyp7EM vaZAfVqGYUUnbwtP4XnZcgxYF1+kr04vy/E8u39PHQAshxlHJpy2+T04nrJhu66tiQxD47apLkiK fM2/qrJspuPlUPqapFqOLixhjps0zRDrumE5jiGx74g/0CenPtRFGuGgdx3SoqqK2JGXEHBqqpbv 0jiW5geuhdrnPz9NuauDd+bIHK95yVVaocGvlKZrq9R7LFT7a7ET/e40wYjCxrfj9LDGGHdDV7hL /iOzzLBMbZ4RnKJOvBB/+M9nGH7LL2oaVQ0qKt13sCAUrx6XdO1Quo+HK34ZtpyZj/NYx+Bns7Jf E1ykeTsOmW1S+rad4toTWQnhofD8cv54bgPTCNqhcAy/GnCZZiCdO2ZEns59VfXTkDwUq/u1WC4r keNhKJEum9kwFK5BQ+Jt4MSUvpMPrb9kMMYCOPbzEOuSGnQ0X5v10CUgjSccusn0NOW+nw1jab19 mex/CltGdpJ2mg9t5KB6xIHCi3YFY+glC/2CYCSxS67O1vxmbDyJk1E31QFNbIYqSJcTSf10nFtf VVE71s4jGepfjM2WEXS/IKe5jRMMbRf2rJ5NY+anX9OPgL6lujUBAUYE+k0Ut2PjgrSWjmOBUjLR JLpTEXj5jujTGLfs5NNlLIt+rBx+x2rZ+BX9LpA5JSYHSr/6mj6egOmOURNC6Q8k1TjeKknjvR/6 9BhPb7cF/flQ5bDmfYkVrPJ18ts5GWJNNGgSndIfm8UQAv0waieMZJYH2znA5Kf02XdGnx7jVVVR DDBqJI9rIGKpRtiOi+mDBxMmdelZCJ9PpaU41dhHmkjT1vSKyAj9o+r0nktIpRNKvxjeE/29aKIo DOJqBGPmJv2I0zCuhj6zjRD3iaGH/XEo0vrwfCpM2SymqfJ1PcSk9Jykn3AWxVXf042PeggsbKM0 2ft+6Ev0IlxL08ORoTp5T7q2pQcZVfWrOtRkpxwPQzcc6M02AY5Chz6DyVC1qaVR6Z5Kl1fpQGE4 PabJ3ndDn/q7Vdt1bRku9xPTum2bKnUVXqD5WpFX/ALjtq7rzJXoTcC2yWCvD2NPEZQXaU+9Sgt7 Rl6Sve/m2LNlRMML4wgtqVr6EISBC34LvRy7pH4VG4XIc+gdV3hn+sjVJVnTFW7PioYL0t71yxIb WnK3/Ps59NJtT1RURbqlezlRVmSR/vfCS+qX4SWayV0uHi/fRQ58X5r0pTnjb6Rvyd5fzeoBLAnh /e5L2nZ/+2eUa6R3SRi/JoY3t2ztl6d76ddk7zvCfXblr5mWuzfffF7zMitWrFixYsWKFStWrFix YsWKFStWrFix4hH8H7QX55kNCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMzcgMCBvYmoNCjw8L1R5cGUv WE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI2MS9IZWlnaHQgMTAyL0NvbG9yU3BhY2UvRGV2 aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFzayAxMzggMCBS L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTAwPj4NCnN0cmVhbQ0KeJztwTEBAAAAwqD1T20N D6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAPgyOAkAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjEzOCAwIG9i ag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMjYxL0hlaWdodCAxMDIvQ29s b3JTcGFjZS9EZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRl cnBvbGF0ZSBmYWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDQyMD4+DQpzdHJlYW0NCnic 7d3vLhwBGIXxnZmdmfWvs6sbom1Q3UWKfkJibVVKSLAodjj3fyM4qLS38D7PJfzyfj5vo0EvJXH7 S5A28yJmeTN9YUiycqrqxKyaLjMrpGW1sNzrR6z39VO79XwLSTa1sL49GEZssPP980z+jJBXy9tH ZxejgJ0f737rFEZo9wZnN+M6XuPbi+HaxzJ9Qig6/eFo/BCx+vJgvfuOUD8oYPXVLxBAEAgOBIHg QBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBA EAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQ CA4EgeBAEAgOBIHgQBAIDgSB4EAQCO4/hHFEhH+Ganv757f1fcDuRj9fJ4vzamX3ZHT9J17Xl6d7 /VmPVzdnvmwNDn9H7HD/x+IHz5hnrdnF1Y3NrXhtbqwtdSc86580J6ru3HzE5rrtyfztwUNRtmJW Ftnrl4tGkqRRe/93Er5HHmWqOg0KZW5kc3RyZWFtDQplbmRvYmoNCjEzOSAwIG9iag0KPDwvVHlw ZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMjE3L0hlaWdodCA5Mi9Db2xvclNwYWNlL0Rl dmljZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvU01hc2sgMTQwIDAg Ui9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDgxPj4NCnN0cmVhbQ0KeJztwYEAAAAAw6D5Ux/h AlUBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAfAPp9AABDQplbmRzdHJlYW0NCmVuZG9iag0KMTQwIDAgb2JqDQo8PC9UeXBlL1hPYmplY3Qv U3VidHlwZS9JbWFnZS9XaWR0aCAyMTcvSGVpZ2h0IDkyL0NvbG9yU3BhY2UvRGV2aWNlR3JheS9N YXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVy L0ZsYXRlRGVjb2RlL0xlbmd0aCAzMzA5Pj4NCnN0cmVhbQ0KeJztWmlz5DYOnZZa90Hd903doqRu tzPHJrv//2ctqJY99qSSGs8kG2+V8MWyBEJ4IggCfP3hwyGHHHLIIYcccsghhxxyyCHvR067wAXD MPD3Jyz9tCs/aeCFKYb9KmdeFDnmB43vln7i01ALP/r2b4U5C7KiqpqmqoosSbplKtx3m96m+aWl zYjAsb+z8ErzjwydWF6S+N8P/hE5sZLhhXGapkkcepYVZIklMt89mOPOT1/4dJatII6jwLN06dtZ p5p/Mhf7Y4ZXLUvjv/f1f+4bpwVFO86Xyzw0RRzmXePL3/nNTqyo6vITBkYw834aurYpE0flX6E4 nSWdav6RobOoafAxWNEMQ/O7v+ufO8dpftGS25cvD2OTR1E1DbHG0XVCH9JcQpfMiV59vbkvJEZA QeQoOzJG9vvrlfT9OPVVoFEUdBBLh4PHUWzLdHZfWHq6BkBGGNkydxaNIABg99ex97V62r1449qD dyI3qpbPn0gRupZXzSSzVFgn4AQECC+IkshvSUWCC3qT4QRJpgospwZ1lzvKfXZYJZoeSJWmVUdI 7cG0M/soluX1pBtyC+aMYeHe3fyHuylJ4AU9arvMkgVRdxydByUOlGQYeaJGeEGQYO2d3waNLljd b28PtatJslUsaxMHvgsphD2Lumm7nq1LooIcz3MMmWNZQbO8IPBMVZTtar1NuaNuMcaq8bQ2voHs pFtIYQpnXjFcGIVkUfHa2y9Task8LyPbA/MqzzKbKd+zEPLq621MbVVGjqPxLCfpthf4MJJjORmZ 4MXm0dtiFCJLMKt1yRHP8kZxeVy6pqlzT+VFIypxjXPPMLykxLhKXVUQNC/DTVvnPkJh//HXxz4x RbooAdg4F6bIS2Y6XTpflZCfVbiGUchM5n/9dmsjQ9GcpKA2fV3gJLBfNzgL/Yx8+fXWxhZy4tiS eMVO4EGDU0cVZCspyhJvHn1/ut6hcahY5kw7M3Dx8OWRDNM8lY6i+s16mfsy9KKq7dqu7wpXlY2w bLqRTJVvR8On18BIjiAFSF57IalphFXXtf3Yl4Gbzb/++7GNLMMrqKVhrANdNpJ2HDpAFufzl98o MDOqcaCpTt4NfT9MQ+FqKO6XeehH6tFb08odWKqxcFE+fHnoSjwuQ4xQTH65jUXohdU41nnRTn1q qsiLkgxP65g6fv3wcQGw/B6KG7DTiacBUHoBHnucV+MyZn48fPw8Z47hZP3YFGU3k8o1w4YMFWwz gRd1jx9J5uhmOgyJaSb91BZp2c9jZtvF+sva3j1Sz29MIC+AFdfHMXF9yCG5ZaTzL0vhQCANl6mM E0xm7KoKshw/G67wxM7IpfX31P4VGDW34riY1j6Ps+6yYN/H14fG0zS/XQhOknq+9klQTKTykA5i F8ulcSF402nKHB+TPrUNJ5/mJvCqy21InM0j9MZYfAVsWStbQfFAKsdMyRX8lowcPloDMwaJxQNg jh9X5PEKCvEwV5Z43/a+AVZnzfVxrmHGriv2HGrXlLSYPF7aAiw9jFnSzGMCSw1Sr55OsDwFXksJ yb2kn2tXFhT4CgC/evaoNPkfB5bPJNUFJegIdq10WipTEOjCu01t08PCcnXDT0vcXz/dsGNEPX3b PfKfgTFbKOK8f/x0HRrY/MfcsfJ5KQxRS9fPjwQszXOTpOB3IG8Z/T6U5yiwIsimGayygoUhFsPq 2aPKEt6YF18CI2Os8rLfEuxZyfY6HoB9fuhxVeEiMI2gguKiWz8+3IEB8tfAmDOMXqci7R4/rR0M wpmnGxkFJunp+uk21nCzjL3oNbDiGVj+GtizR381ME7P1se5iny6J+l2Pk4QluPtCsBCCBpH+hqK c2mJkKCzaWmjoL7cxjz0YaPSABFZK0vWE/K44BjuuSZsXss9FDleg6EQ01soFn46Llsoes3cJUH5 U8DyhdyBZdNmxmsnCMVknDLEnZVwvIy5b1smUjW3XmacZP3DpbJR0C19jAR2Tx6wQcOUumlH0xnA W7vUtWCULGgxbG0B7HwdzCW1ZGiqXc4z9g1d1xQ9Gtcu0GSaPHI36hbYrZGTDQQHXvHs0Q8A0zMy Jip7Ouvp0IcKJ3n1WLpm3A+pzrGiXZGpzqIwgBlz8bLCfjA9rKUFKNcFdiSBpkUoqcYHyBY57qex cFTVr8lYJWEY2KqoBP11rnzLK2G+qSUXqbBDrRPOktgz4Atd4LFhpuOYWk5Jlq5Ii27qE8vOxieP CvOtwM5q1DY03M9qWGNP5kQ7r1ML+bgOVdi2oSYchrbGRWRpsNUspOsm+KhINmBWAMTWDjCwL68X MvSgmrsKL6C4GfoGqowAiZJdzWufuVZQ9dRSGVuqAlE9T32LY1OzC7LAYztu6lDXfTyRsR9GKERV FD17lKC3ZkVWspOYVtWsZEWhIUDR6seupphhZMEKYuDfHN9dlBU7g4IKQ0pwFUF28rbJdmC8kTQ9 JBach7TcpSV7Udd1lXkaz6t+1dWJpSEoyGr4RKEhCYqT1h0UZ54mqlCR1Cls4LSkEuF1Tds2VWLD K6z42SPljRv0B4ZTEJJh1AlKTl06g1MaUgWojqEMpVU4r5pQ+EJVKnGcbEB96jo2rWM52fR8KFuZ 071ldUHJc0xVONNe5V4u+7YuQn2v2r5vQakJhbEP42k9zUnIDULf0qBeVi14rMkqooUvrzy/jn3p Ef/WY4OtNzgz+wV72hoWaMq2u6ftNvQX0PRDSQ59B+1aRIGHPmy7L+7NPPQJokwf7Q3G3uDs3Qe9 Fjebm6V7W7QNEL8aOnPbGzcl+mBvW548evtxCO3lTvvVU3f3dHK1Q9+7y6fucT/N2jrFF0rMy7Oc 0z7qbvGueXph6alnfWHo9FX56cFLj96K65BDDjnkkEO+S7aN8I+2mf+L/efl/vryLveHLM196/2f OPcTQo9X77XVK1dPnGqa3x777ZQbxfwXMSh/nzC0BA5pNyW+cpUR7TS1Xx/77VTM6SwbUOa+7zkD J52s6bqmDPSXZM+JVcK2DZWXYKG4VzWZZxge+aH9vQTOPySMYBUjtIAtTkxhYxV2MoZVkxFacDpB TwUrbeIiV+XPwg7siWZ5Vng7g/J3CZ0Y6OarNI5cmLGtFdnYFOaspdOUajzHcfcWg+OgtcRdCT2k qNk0cpmv2lsPsvE4whsZlL9JTuA/uXSRqWuqeGbOoma5PmVT7udmKZIUTRVY2hTqqmqX6+NS+UjR bQeJ57NAtf2NsYGRhmk5HiVd3gMyCmy+9hGiLDNzlsywwA1lU1RRB2CZoTuBq/EsDT6XMhb//kwK z7DC2FEEyaDaDc48TRBRmBdF1dSF/xcRsz8JbDuIWnCAIN2zopm2Q99RNsXVjAyAWVaCM0vkJLes Ey8Zv/znC0yZ5Zc4QqqZNEPf9+NQ0SP8Zp7HftwJwn8a15bVq+U6t5S3ErSonboyKzqyHSICMNst euxKnBJ2Q+4F9e3zQxOaZtgOuWNGzdRXWdGSqXDMZHq89BUeFnpu+Q6Anc6QEchlnXBoaE41jblr 2OkwN4GbAzDHq6bGk3k1HqbcsVJyHWIka2E3Vb5XTmPhGlbSL13kZvON5J5XTDO233hW+PcIw6lu 1i3XtY3duJtbXxVkt16GxC82YJi0PgU2ktxC4Uaa8JBJCQ6ihnShJkgOhlnyc3JpPE0Purlx/5of CfykQIaXjKAiD5c2LUb43CLLG+U8ZcHvgJl60BJQ4GQKLNqoIdBGxTzvtIMouTVpPel9AGPPgupW y41UGOLIEiht/QTMBmBdoFC263fAUkpf3IFtfArJkSDa9EO8B2DbxsqLKJluM67GpfEUHoJr3kPR cqt5TJBilctSmLrfznTFbaEYJt3SBapAj7rHzM82GodyAu8CGC3/ENJ0O5uuYw5rDdIhsuKObMlj ykw7J3PlO3F/uxSm5jWw+AxZoySaH9QzJBRk0pUZOimlcSiw6V2EIjQnTpzEcd7OMw58yGl9kWTN 2Gc2pUkSA8XDOuKiXT9eckOFPLHQdB91kA9p8ty0pyG3zbgfU50XrXKs3wcwzS/brh+mqQkNHZI7 GeC/rnA1PWyaQFOciszTMK3XMdYllI7rVPp2iJvE1N1i2LTpdq75uIlUTjDSprDfQVbcWBncQttS BEgUNG/jRLafmUgWpUkE1S/arqnrOndkXrLzts09045iKLpgn6ipduaCNv1llXTmVC+G/ucdbNAM ZVfCKKS0CXvnRGjTef9h0EaTqBalUhyH/mIJlP3A0WUFoY2YMVyqbezaCsfQJauL76Gk2kgRRVHu XMlOwTz/lOu8kyayKG79yPaPBK0MvxEzz4cKzJP2ndN5B7g+fHOW8w2Z8kyTvKJimKcDrOefA+7a 91vv6QTrHblyyCGHHHLIIYcccsghhxxyyCGHHHLIIe9J/gt3nZQSDQplbmRzdHJlYW0NCmVuZG9i ag0KMTQxIDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAyNzQvSGVp Z2h0IDIyMS9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xh dGUgZmFsc2UvU01hc2sgMTQyIDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDE5OT4+DQpz dHJlYW0NCnic7cGBAAAAAMOg+VPf4ARVAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8A8W8AAENCmVuZHN0cmVhbQ0KZW5kb2JqDQox NDIgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI3NC9IZWlnaHQg MjIxL0NvbG9yU3BhY2UvRGV2aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50 IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxNTE5Pj4NCnN0 cmVhbQ0KeJztnWlTGlkYRrubRQQEATdQcCcqoCiIyNatpsqkZmKmYlI1yeT//47pu/R2/TLfkhrO +QXWra6X5/Hcuq9lAcB/wnYcx/7Vf8RvhO2ksyuZFEcSYKeyxUq1lONINHY6t944Pt4tZ51f/af8 HjiZfO2gN7w53chxIpYYIdni9sn1bDHiRCR2aqXcOLtdePfdvVKGE7Gc9Gql1Rl77rjTXF9hstpO prB5eDX1FsN39RIHIkbI2s7pYO7Nro+3ilkSmp3Kre+ej1xvcnlQyzND/BGSr7Z69557d7G3TjhT I+SoP/Xmw/ZOKcuB+Lm9tNMezr1p/2izkGGEiBGyd3Hneve9VjWfZoTI3H458dzR+S4jROX2rePr mTcfnO6s8aMrcnup/m648KZXh4wQS/zo5irNztj1xp1WZZURIkbIxuHVxFvcnjXK5HaZ27dPbkRu P9kmt8sf3fKuqP7kdoVf/autrqr+lVyaD0RW/z7VP8DP7bHqz49uVP3ve/s1crus/rV9Uf3J7RJ/ hPi5XVT/QdvP7RyIzO1tkdup/hIxQpqi+o+7rSq5Par+fm7fLTNCVPU/8av/7OZkm+ofU3aTq8MN crtSdqL669zOgfi5fQNlF4GyM5DVH2UXgbJLgrIzUMpugLILQNkZqNxO9Q9A2Rmg7AwCZeei7BQo uyRa2c1QdhqR2xsou4hQ2d2h7AQoOwOUnQHKzkBUf5RdhBwhKLsIreyo/gFB9XdRdoqYsmug7GLV H2WnUMpuKHI7yk4QKrs7lJ0EZZdEKTtZ/VF2Aq3sFn5up/oLVPVH2QVEym6AshOg7AwiZddF2QlE bhfVf+FXf3I7yu4NcWW3UeBHVyu7O3XVjuqvlF1Y/cntCWVHbrfit3VRdhL5wE5XVP+LJrk9puzm wzbV34opu2kfZSfQym6BstNoZecuUHaSWPU/RdlZqvprZcdVOwHKziC4rYuyU6DsDMLq7+d2lJ2F snuDUnYTlJ1GVn+UXUT4wA7KThHd1kXZCVB2BrL6o+wiZG73q7/M7VR/lJ2Jzu1Tb4ayk6DsDGyU XZLEbV1yO8rOBGVnoHdioOw04U4MlJ0ifGAHZadA2RnoB3ZQdpqw+s9QdpLYbV2UnUApuxHKLgBl lwRlZ4CyMwhv66LsFPKBHb/6z1F2klj1R9kJUHYGWtm57ugcZWfFb+ui7CT6tu4MZacJqj/KThPs xEDZKdRODJRdiM7tc/mgPcoOZfcGlF2SaCcGyk6CsjNA2SXRym6CstNoZTdD2WlQdgYouyQoOwOU nYG+rYuyC5C5vYeyC0DZGUTVH2UnQdkZBA/soOwUKDuDcCcGyk4RKLsFyk4S3dZF2UlQdgYJZUdu R9mZhGvsUXaKcCcGyk4RrLFH2WlCZTdE2QlQdgaxnRjkdkH0wA7KThI8sIOyU6DsDGI7MVB2glj1 R9lZKLs3RMqOHdSSxAM75PbYAzsoO0n0wA7KToKyM0DZGaDskoTKboqyk4S3dVF2imAnBspOgbIz QNkZoOwM4jsxyO3x6n+DshMoZTdA2QXonRgLlJ0mfGAHZSeJbuui7CQyt4vqf4+ykwTKboGyU6Ds koQ7MVB2iuCBHRdlp0DZJUHZGUQ7MVB2EpRdgG3LjwFlp7FT6XTKsVVu76PsxEMyxeJqxkHZaezU arXeqBVW/Nwuqj/KzslW9i8u9mvlTb/6uyg7/xMp1Lvj0Vlz7xRlJ7Ez60ejh1n/vDfSuX2ZR4jA Wd3uus+Pk7spu+wkdnpt//b508f3T0/u7VkdZWc5K7Uz9/PXLy8fn8Z8IYJUYff6w7cff7/+8TA8 26twIv5cPZ6+fP/5z7dPT5Pr9k4xvewn4uQ2Ow9ffvz8/vXlw8PkslXOLPuJpAqNq6fPr69//fn8 OB919krLfiJ+PGt0Jw+P3mw87HdOm9XVZZ8jdiq/cXDeOW8fHzTrW9W13NKPEb/UFKubm7VKaa2Q z2Uzy/6FWPLfqis5/yjSqZTjLHedCbBtRxwFZwEAAAAAAADwv+VfKuNmPg0KZW5kc3RyZWFtDQpl bmRvYmoNCjE0MyAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMjcz L0hlaWdodCAxMjAvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVy cG9sYXRlIGZhbHNlL1NNYXNrIDE0NCAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxMTc+ Pg0Kc3RyZWFtDQp4nO3BAQEAAACCIP+vbkhAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAB8GX/3AAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNDQgMCBvYmoNCjw8L1R5cGUvWE9i amVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI3My9IZWlnaHQgMTIwL0NvbG9yU3BhY2UvRGV2aWNl R3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2Uv RmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxMDcwPj4NCnN0cmVhbQ0KeJztndtymlAUhgUUERSP eEg0iadQEhtjNCYqAk2P6cTmoufJ9P1fo2wQBE2nl7az/v8JtmsWn7D2N3snEgiC/DUcx/M8t+9V /DPheCElSekUv++F/BPxqpEtaNWSgoqwciRFOa81u4bRrmSEfS9nz/GaI1dqtI3Lm9n0rKEIlDHi cjSZVgrVo9OL64VlmxO9KhMuiNscYkYtH3TOrmZLxzanw/6BKlJliM/RYv1YH04XtmPNxufdw3JW JNogHkdVrdkbjGeWYy2uL06PagUlnST5IhJw9OTF5Y1p28vbkdFulHOZlECxHAFHW/2Xk4XbHPPJ y35Ly8ui2xwUy8E4mvM4ess4enP54qRezEpEm4M9KkqxFuNoRfWaY99r20MCjnbPGUftxXTNUcLN kQ046rgcPescgKNRjlYLcpo6R0cbjpYoc9Rtjpr7sQKOBhytHIYcHerH1DlarIccvfI5KtKsBuOo nNcYR+fsY8XnqEKXoymXo4224XLU9jnaKOXA0ZCjTY0wR4UoR02Po0WFcHPsclQlzFERHA0S46gD jnoc9YfnLkfn40EPHHU5GgzP9WPiQx+fo1PG0dnVOTiqNXtrjrLhOW2OSiFHHdMbnlPmaDLG0Qnj aJ4yRzNrjlrgaGQT0mQfK1fe0IcoR0OZozdgHLU3HCVZjo3MMbo1HSfYhKT6qMRkDm94HnKUYjkC mSN4H8UmZJSjwfCcZDWiMsccm5BxmcOBzAGZY5OIFAeZIyZzgKOQOWKBFBfNnzhKd+gDKS4MZI5Y dmQOcDRbqm9LcTT/ZH2Zw+coNiGDTciYFNeAFAeZg+VZKQ4yB6S4BGSOrUDmiGaXo5A5tqQ42h8r kDmCQOaIZZejkDm2pTjIHJDiEjubkEtP5iDL0S2ZAxyNyBy2TV2K25E5BpA5IidzkB+e73AUUlwg cwQcJdwc6xOOIHM8I8VB5gBH/UCKiyV+whE2ISFzbAIpLhbIHNHghKNYIMVF8yeZg2g1Ihydb044 ojz0wQlHQSDFxZ6BZ2QOYhx1GyL8rZA5Egk+Kclymh1Auy1z0OQon1LK9XpBEniccMTCJZVq91w/ UNPu+yhkjgQnyFp/Mht1Kmp+W+agKMVxglTuXjvOVG81fZnDpn3CES8WTsavP7yZDQdDSHEMqGrr 8m71+MExTcuXOShyNAyXzDYGzuO3r4/3b1/bxE/mSDCAZDTdXH1/+vll9W45OSM89PHDADJ5/+Xp 19PXh1dTo1VSSHJ0E17S9Pn95+8/f3x+uJsazbxIuhysIJXu2Hr7cfVpdf9mOeqU0lQv1FiHF3O1 tnExvlksLWsx7pUl4gXhBFHJl2uHR52+MRjo7JHZ95L2HG8QJMlZtVip1rW8RPTKlWjYlW+CkHTL kpGoXkHzTLyb8HAXHoIgCIIgCIIgyP+R31Y7LbwNCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNDUgMCBv YmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI3My9IZWlnaHQgMzUvQ29s b3JTcGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NN YXNrIDE0NiAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA1MT4+DQpzdHJlYW0NCnic7cGB AAAAAMOg+VOf4AZVAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANcAb/kAAQ0KZW5kc3RyZWFt DQplbmRvYmoNCjE0NiAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGgg MjczL0hlaWdodCAzNS9Db2xvclNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1Bl ckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGgg NjY3Pj4NCnN0cmVhbQ0KeJztl+tymkAUgAOIooi3iPFGRI1EY/CKEVADRDMmsU2TSce2Y9//ObqL 2i5K7HSSeOns94dddNizH7uHs0dHGAwGg8FgMPsGAdl1EPsDQVI0TVPYyAKS8rKhCMdgIzYE0BFN iWIq5CV3HcseQJC0P5Iqyu1GicdLBOjwMKFEXlavjW75JEBTpAvEKruO+uMAuyUYz1W71nhsdaRk mA34IYwPwev10rTHAbWKm8ZD1ElQTCR9rpgPT0/3hlIRMylIMpng4/FjmzhsxCLhEArHBRFYNgDw /+GAdZLeUKaq3z1/+/7101BXGvWajVytlFGkUrFgU4QU8mLuFEHIZmyLqdTh6yR9sYJy+/zj52z6 5e7GuAYYBrj0e7qu6bre60N6uqZ2Aaqq2ahXHaVto0DarQaUKNdqb9GZ3LZOYMtthURyTetxOptN H8fWoN8fQCHAyACKAB3TgpgmvAs6N8PRaDQcWov+/FfLXPx9cEA6WZahXYwQngBfaBqTl+nLxOo2 5MvfgcmwVW8uo55P4Go5p/kMteWU5wJ6b9LZ36pOQUjznFvVRdKBmHChDief742WJKCuQSOdEQT0 fYj5xYPnY5xJ5+jglerlis6WU2fXoVPdqc5W7SwRcKu6SMrHJQr13vDWVEoJDt2OYHOyLLphOc6x /MKRqL0yjxdLlE+c/JPOklPnxVZ1Gpqc5TxuOdYuVNNSU+93JN7vceTotYTuTFA0DbIWksMYZpPO 4JrOGKozzm9Tp6YplXTQVciiODst16pi1Lf5LLP2Edv0xdtvnVIxG331oGKX73wmE2dfUfY+rOnc 6POjdUY5ZsNswb5h2KCf3uPD7rvrBMe2jePBZ7iVKv8H6zr/XrXu96kLg8FgMBjMwfMLDgIhEA0K ZW5kc3RyZWFtDQplbmRvYmoNCjE0NyAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1h Z2UvV2lkdGggMjczL0hlaWdodCAxMjcvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBv bmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDE0OCAwIFIvRmlsdGVyL0ZsYXRlRGVjb2Rl L0xlbmd0aCAxMjQ+Pg0Kc3RyZWFtDQp4nO3BgQAAAADDoPlTX+EAVQEAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlwGWXAABDQplbmRzdHJlYW0NCmVuZG9iag0KMTQ4 IDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAyNzMvSGVpZ2h0IDEy Ny9Db2xvclNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBvbmVudCA4 L0ludGVycG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTExNz4+DQpzdHJl YW0NCnic7Z3pdqJYFEYFBBGnoGJi1DhPMU7RGKcIrnKlUpX6UemuoVd1vf9zFIMY4PLfXn2+/QR4 1uU7bC6eG4kAAAAAAAAAwP8KjuPOfQn/DcxC8DwvCNGoIPDnvpizY9ZCiIqSrCSSqXQyLlKvCMeL cjKt5gvF8k2tVtESUeK3DS8m8+VG53Y0nS0W81FNjdFeIpwg5+rjlf7h+ePLx4M+b+dl2gWJCHGt t375+u3H97++HDbjmioRLwgvqc3l5x///v717XU/75UyMYF2iHDRRHG4f/tlFuTLh+WwXkjHRYGn XBNeylRnz3//8/Pt9dlYTXvVywtFilIuCS9nm8tPb2+vh/1+v1vPBo3rXEomvEw4QSn0Ni+vh838 YfVk6NvFqFPRMopEtiRcNFkcbA9mpLa6o4eNbuxW037tSk3KIk/TbngpXRlttpN6QSvWb+9XO0Pf zIetcp5swPIxtTq871+n44lM4aYzXmwN42k5sQI2EaMYsObzqlquV7JyVBDlVO66OZitd4YVsE2i AWtWJKVmFHMxcHw0lri4rPYmyyfD2C7GnZtChmAf5gRRkpyXIRwviPF0vtQazu2Avb+tF7NJesuE 408/2Fkm6lWtP7UD9mHUrmhpwn04Yi8TSclolfZosdXNgLX7MM2AdbHuHDmVLTYGM6cP37VKdPuw g3nnSMpF4aY7ebT68OOkS1507IBN5UrNOztgIToRe5nYAdubOn2YuuhEnICNp7Vye+iIzn2/XrRE R6ApOhZ2wCazJ9F5cESH+DIxAxai48Xpw47o6Ia+ng+aJQSsT3QeLdFBH/aJzoyo6Hjwi46xhegE RWcH0YHohAHRYYDosEB0GCA6DCfR6UN0XJw+XKh0RhCdI67oNI47OhAdr+g8QnQcIDoMHtFZYkfH wQ7YdNiODtmavL9whOi4nERn7BEd9GEZouPD6cM+0SlAdBjRyRIXHS4oOu2yBtHxic60V7tCwHpE x+rDEB1mR6cL0YHoBAmIjtmHITp+0dlBdEJEZwjRCYgOXjhCdMKA6DBAdBggOiwQHQaIDovThy+r XXdHB6JzEp07iI6LR3SeIDo276Jj92GIDkQnDFd0Ou6ODkTnJDqD+fG/shCd4H9lITpH0cmXW0HR oVsTR3RUiI4H9xNyr+jgE/IQ0UEf9orOBKLDiM6gUcyiDzM7OujDruiYAXscCgTRgej4CYgOdnT8 omP9V5buUKB3MBSIgREdvHCE6LBAdBggOiwQHQaIDkvYjg5ExxGdoWf6KUTHOxQIooOhQCF4hwLR nn76DkSH4diHy9Snn3rg7BNRPNNPITo+0dEhOhYB0VlDdIJDgSA6EXcoUB6fkHvAUCAG744Ojnmw CRGd4zEP576y8xEqOgrpM+yC009ng7qWIF2RgOjom2kzR/3INq/orLeL3qUinPuKzs5JdHrDuwb5 Q/0cjqJTvNaSxDPkhB2wSiIuEn48C2LWRKD8uBoGqhHOH6UDMtgNCmVuZHN0cmVhbQ0KZW5kb2Jq DQoxNDkgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI3NC9IZWln aHQgMjMxL0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0 ZSBmYWxzZS9TTWFzayAxNTAgMCBSL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMjA2Pj4NCnN0 cmVhbQ0KeJztwQEBAAAAgiD/r25IQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC/BuXYAAENCmVuZHN0cmVhbQ0KZW5k b2JqDQoxNTAgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI3NC9I ZWlnaHQgMjMxL0NvbG9yU3BhY2UvRGV2aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29t cG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxNTY1 Pj4NCnN0cmVhbQ0KeJztnWtvE0cYRrNrr+NbjB0TE8fEcS4Y50qCXTtXeynQQpUiBIgWof7/v9G5 7e6Ytx/6LUh7zi+wRptHM3PyvLOyAgAAAAAAAJAzAs1D/4ifiCAsRFFULIRhyLoYwqjaaD5aq1XL Jb0uLEpQqKw/3dsfbG912s21WjnK/ZoExVr3aHpzNb04PTwY9Nr1UvjQP+mBCQq13sXr+w/3797E N9Oz/U6tmPePpFDZPHvz+du3r5/+fPfr9dl2I8r7ioSl9ij+9P2f718//LaYHfdYkaC4Npjd//39 25f7V9PjQbtSyPuKrITqz+bt57++fPwjngy7jdwnq/pISq3h7f3H+/e/v74+7bfKfCNBob49fvv+ zXz+6tUVS6IJy53ju9e34/PpPL45G7Srxbz/4QRRc3dyOz3cG17cxrcXakuS941rUKhuji5Odzqd wdl1PJ8MN9dKOV+SMGp0B/2Neq21fXwZL2aHvUer+Q6TICzVm81aqbja6I5UmFydqHzN92Y+CKNS qRjqlXnybHwX37zYfVyN8p2vQWiSI4xqG3vnN/Hdy4NOPe/5agmLlfWd0yuVr8/V9jXfYeIICuXm 06PLxWJ29LTJZk0TFEqN7vNfVL6e9tcr+c5Xh4rZeufgpcrXc/LVEUbVx7s2X5/U875ZswTFSquv 8/WXEflqUfn6qHc4W8SX5KtDbdZUvk7m8fXpjspXwiTNV3UYPt/bqJGvGpWv7d0XKl/Hz57k/jBs UWHS6p+ofJ2Otho5Pww7gsKqy9fjbfLVoPJ1bXOo85XLRofK11pn3142kq+WsFhtD85u4vmYy0aH zldz2Tg93Mr7ZaND5+vW4dTkKzLHYPN1jMzx0JeN5OsSNl+ROR76stHla+5ljkPla2MrlTksyYrN VydzyFeHlTkqX1/uI3MsVuaYfNX/i8SSOJmTyHLCRGNkzsjKnBYyR5PJcmROgsrXROaQr5ZA5auV Ochyh5Xls8UCmZNgZflE5ysyx+LJcmSOw8hyJ3OQ5YagmMoc8tXiyRzy1eLJnJ11DsOaTOaQrwmJ zEGWpxiZc6IvG5HlDpuvyBwPZLkEmSNA5gg8WY7MsTiZs4ivTshXCzJH4suc3DcfLSpf13fIV58l mUO+apZkTs6bjw5kjgSZIwhoPv5IKnNoPiZ4Mofmo2Wp+chh2IDMEdB8FCBzBKb5OKT56GHydZ/m o4+5bKT56JM0H5E5Kb7MIV8NyBwJMkeQyhyajwmZzBnRfLSkMgdZnmDy1Vw2kq8JRuZk+cpnYvMV mbMEzUeBztcuzUcff4xlG5ljyGQ5MseRNR+ROQ43xjJezI56HIYNvixH5hhMvjLGcgnGWAqy5iMy x6HztXfEGEsPmo+CdIwlzccUf4wl+WpIx1jqfOUwrEHmCPzmI5eNhiCTOeSrw2s+ctloofkooPko QJZLkOUCmo8CZI7Aaz4icyw0HyWpzOHNxwRvjCX5anHNxwXNxxTGWAp481FC81HAGEsBzUeB9+bj DrLcQPNRkspyZE4CzUcBzUcBYywFdowlzUcfmo8CK3NoPnogywXIHAkyR0DzUcAYS0HWfGSMpSOT OeRrgtd8ROZYaD4KUlmOzElYbj5y2biCzPkvrCxH5niEjLH8Edd8ROZkeDKH5qNlSeaQrwaajwJk jkDlq5E5vPmYko6xpPmYkI6xpPmYgswRpM1HZE6CJ8uRORZkjiB78xGZk5A0H5E5KZ7MYYylRefr Fs1HH5uv4zkyJwNZLqD5KKD5KHCynDGWGTQfJYnM0W8+InMMmcwZdhvkqyYbY6nylTDR0HwU8Oaj hOajgOajIG0+InMSGGMp8GQ5MsfBm4+CoJjKHPLVQvNRQPNRkMkc8jXBG2OJLLcwxlLAGEsBslyC zBEgcwQ0HwXeGEvy1YLMkWRvktF8dKh8Xaf5uIQbY0nzMWNJ5tB81CBzJMgcQUDz8UcYYynwZA7N RwtjLCVLMocl0fjNR7V/feif8zOQyBy1f+3WI7JkJW0+3s0nB+1VPhKNbT6eX06GG2VWxKIvG/vP R/0W30iC2qw1NjqtKnuSlKAQlSur3Kh5BGFY4LgH/49/AQNybnwNCmVuZHN0cmVhbQ0KZW5kb2Jq DQoxNTEgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI3NC9IZWln aHQgMzMzL0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0 ZSBmYWxzZS9TTWFzayAxNTIgMCBSL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMjg3Pj4NCnN0 cmVhbQ0KeJztwQEBAAAAgiD/r25IQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAA8Gi16AAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNTIgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9T dWJ0eXBlL0ltYWdlL1dpZHRoIDI3NC9IZWlnaHQgMzMzL0NvbG9yU3BhY2UvRGV2aWNlR3JheS9N YXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVy L0ZsYXRlRGVjb2RlL0xlbmd0aCAyMDM1Pj4NCnN0cmVhbQ0KeJzt3WlTG1cWgGG6tSALECAbYbCE wWyyBALCJtDWnW3GFSfxzKSSSlLz///GdPc9d6HPl/mGq3ifqnynusJBflv33KUlAAAAAABemCh6 7p/g6xLFlUol5ql4ca2x0mzUsofy3D/JVyKqNttvdzobK8s8FCOqtXofR8Oj7larWa/yTLJfmvrm 0X367fR6cLDTXm1U4+f+gZ5dVNs8nn7+95dP6Xh03H29UnvxjySqrR9Ov/z51x//+pQ+XBxuNSsv /RcnqqztP/z613///v3XT99NRr1W7aU/kaXKSu/2pz/+/vO3z9/Px+e9dZ5I3Ny5+vE/v//25Z+z 6+FBZ6XKE2l0ztKff/n804/T0UFnrf7iJ+tSVH/dn/3jh/S775PrD28YrPkfm43D8bezu7t5Ojl7 t8Zf36Wl6tre1eR20L+aJeP+dpM5slRpbp9efNzbPfxmntwevXnF701cX995/67d2jq6Wcy/Odhc fvH/uIkqy2sba6/qK53T+2R2sbfOn5uoUqvXKnFtdWfwmEzOdpmuS1EUR9l/9VZ3NM2m61s+pYm4 vrF/NU/ujreYrkZUabw+vFksrg/aDR5JIao0t06y6Xq5t8F0NaLqytuPD8nknM+uVlxbe3c+SR4+ Ml2tbLq+v5wldyfENJFN1/aH68Xi5vA109WIKq+2Tu6S+dV7pquQ6To977aYrkY+Xc+y6TrYWaW5 Gtk/hvcuZsn9aYfpakTx8ubB9Zzp6mXT9c3xbTZd9zeXGSWFbLpu98fJdNRr8QfHyKbr7nCSPA6z 6cojKcT1Vq+IJR1StMim6z4pOpTHkqNsupKinaja7JyOSdGBPEUPH1NStOem6zaxRMTLpOinSNFK VGl2SNFP5LFkQIoOZR/nu+dTUnSgSNFzUrTnUvQHYokgRSukaCVI0UxXI0/Rl7Pk/oQULUjRSj5d j/Ppur9BijZI0QopWsmma++CFB2ISNFlpGjFpegeKVrYFD0kRVukaIUUXUaKVnyKZrqKqLq6Q4p+ Iq61SNFPkaLLihR9k6dopqsozpzcJfNLUrRFilbsmZPBDtNVkKLL8ul6wJmTEClaIUUreYo+m6Sk aE/OnIxPSdGieNFXpGimq8jPnBQpep8ULfIU3SdFh/hWtEKKVvIXfaTokKToeZ6ima4FUrRiUnRK ivZI0Uqeoq9I0QH3oo8UbZGiFZOi0+l5l+kqXIpmulrZdCVFP0GKVkjRSj5d+w+k6AApWiFFl5Gi lScp+rl/mK9DVG0WL/oumK5WXFvdHU74VnSAFK24FM2ZE2FiSTK/5syJlafoU1J0KCo28XPPSSBP 0aNpSor2fIpmuhqkaEVS9IwU7bCJXzEpmukaIEWXsYlfCVI009WwZ05GXWKJMOuPSNEBUnQZKVqx m/hJ0Y5N0bzoc8z6I1J0gBStyPojUrQj648WpGiHTfyKO3NCLLHkUlhiicelsGWkaMWdOSFFW+5b 0UxXq0jRvOgLyfqje86cWKRoxW3iJ0VbdrqOWH9khSma35uCrD8acymsZTbxLxKmq1Ok6DsuhQ2w /kghRSt5ir6YpeP+Ni/6hN3ET4q22MSvkKIV1h8p8qLvoU8ssdjEX0aKViRFz7kU1sk+zhdnTkjR jll/RIoOkKLLSNGKXX/EpbAOKVqRMyePA1K0ZTfxk6KtKC7WH5GiPXvmhG9FOyZFp6RoT9YfTYa7 nDkRxaWwpOiAOXOy4FJYz60/IkVbbhM/KdoiRSsmRRNLAqToMll/RIr2/CZ+YokoNvGTokOkaEXW H5GiHfuij1jiFCn6nhQdIEUrpGhF1h/xrWhHNvGToj2//ogULYoU/UCKDrCJXzHrj9Jxn/VHghSt SIpekKIds/4oJUV7dhM/KdqxKZr1Rw6Xwpa5FH1AihbFJv4xKTpgN/GToh028Suk6DJStEKKVkjR iqw/ylM009UoUvQ8ZRO/I2dOSNEel8IqbrqSoi028Suk6DK7/ogU7cgmflK051J0jxQtSNGKpGg2 8XtuEz8pWhTrj0jRIZOi0zmXwjqRnDkhRTukaMVu4idFWz5FM10FKVpxm/hJ0RYpWnHrj0jRghSt kKIVUrRCilbM+qOUS2Edn6KZrsJu4i/WH/FIcrL+iBTt2U38pGinSNEzUnSAFF3mL4VtN5iuBbOJ P52Rop2YFF3G+iPFrj8iRVv2zMkN648st4mfFG3lsWRAig5lH+e7JkUzXQUpuqxI0Tek6EBwKSwp 2iBFK6RohRRdRopW2MSv+BTNdBV+Ez+xRPhN/HycNyKXojlzInyK5kWfIEUrbhM/KdoiRSs+RTNd DVK0QopW5FLY6XmX6SpkE//jgOlqmfVHLOjw8hSdTVdStOfOnOwzXUWw/ohHYthN/KRop0jRc1K0 Zzfxk6IdUrQim/hnvOhzSNEKKbrMbuInRTt2Ez8p2jGXwpKiA0WKnpCiA6RoxW7iJ0VbXAqrmBSd kqI9uRR2ypkTh/VHikvRnDkRMl1J0R4pWmETv2LXHw25FNaSTfxcCuvY9UekaIcUrch05VvRHila cZv4t3nRZ7hLYUnRFilasZv4SdGO28RPLLFk/RGxxGP9URkpWvGb+IklQi6FJUV7pGiFFF3mU3S7 we9Nwaboy70WkdEwsWQxPt3ifxKRp+jh3W2/86ry3D/K1yKur7876e+3SYxWFC+3trbb/P31orjW aDaq/C/iRXFcoRvh//M/rOjBhQ0KZW5kc3RyZWFtDQplbmRvYmoNCjE1MyAwIG9iag0KPDwvVHlw ZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMjYxL0hlaWdodCAxMDIvQ29sb3JTcGFjZS9E ZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDE1NCAw IFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxMDA+Pg0Kc3RyZWFtDQp4nO3BMQEAAADCoPVP bQ0PoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+DI4CQABDQplbmRzdHJlYW0NCmVuZG9iag0KMTU0IDAg b2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAyNjEvSGVpZ2h0IDEwMi9D b2xvclNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBvbmVudCA4L0lu dGVycG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNDIwPj4NCnN0cmVhbQ0K eJzt3e8uHAEYhfGdmZ2Z9a+zqxuibVDdRYp+QmJtVUpIsCh2OPd/IziotLfwPs8l/PJ+Pm+jQS8l cftLkDbzImZ5M31hSLJyqurErJouMyukZbWw3OtHrPf1U7v1fAtJNrWwvj0YRmyw8/3zTP6MkFfL 20dnF6OAnR/vfusURmj3Bmc34zpe49uL4drHMn1CKDr94Wj8ELH68mC9+45QPyhg9dUvEEAQCA4E geBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB 4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAIDgSB4EAQCA4EgeBAEAgOBIHg QBAIDgSB4EAQCA4EgeBAEAgOBIHgQBAI7j+EcUSEf4Zqe/vnt/V9wO5GP18ni/NqZfdkdP0nXteX p3v9WY9XN2e+bA0Of0fscP/H4gfPmGet2cXVjc2teG1urC11JzzrnzQnqu7cfMTmuu3J/O3BQ1G2 YlYW2euXi0aSpFF7/3cSvkceZao6DQplbmRzdHJlYW0NCmVuZG9iag0KMTU1IDAgb2JqDQo8PC9U eXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAyNzAvSGVpZ2h0IDkyL0NvbG9yU3BhY2Uv RGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFzayAxNTYg MCBSL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggOTU+Pg0Kc3RyZWFtDQp4nO3BAQ0AAADCoPdP bQ8HFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAwKcBIycAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjE1NiAwIG9iag0K PDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMjcwL0hlaWdodCA5Mi9Db2xvclNw YWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9s YXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMzk2Mj4+DQpzdHJlYW0NCnic7Vvn euNIrh1SYs45x2IuBgXbHWZ29r7/U10UFazu6elvvKF33cvzQxZFFAkeAiigUP7llw0bNmzYsGHD hg0bNmzYsGHDhv85UBT1+p2maeo7sj8BKOp7j0jRu93tNLVjeW5P/+UL04Q86oujf0bRHwGKZrg/ f0Rqzwk8czlL7TjV1MX9d6ijHiwJuBNEGEtd78ILArv7oXQ8avMXQTOyoYvMt4dROx4IEC4EUIzs pZHO/alxUDuG2b8aEq+5vq2wqzjNKrbvavwPpIOi9wzzxvtRO8FOYpP/thFTe9EOXGXliqJZPesq V/hTO9pxsipzVwUoRo1bXAfrYGov+zVuIvVPWP93gGZERX4j/dReidomkHYUtXr21bfJwQ4OGNHy HXggON7tBRtNnS+uohBNVsnXYcCW6kWuyl6uQHN2/fz5XNs8sEfzdnX+dK5MjiYXJqGIulgyfQ8u Dyd+WW9wF6Pph9/pVbGrfo+6Xq9404a8yNDX30YHtVfTEccKs2dYjhMEgSO2ToKJIAo8ywi6bYgM vWN4UdaCdhkCcUdDNIWQwIIkOMdt2I6RPNQjT7lEB1rwhs//9+sUK3vQTI7Gz3//2Dn8fg/RRIR4 ApzSDMtyEE54lhAMFxUl8fKdRBlJEskRTe8vqgAh9H4dIAoc3BX+EFnin5efLtpcrsjsdryRtnX4 NuekGC2bp0TlBFU3LMdzTRle7o5TTNd3TUUQVzb2vGp7QVROJxxIDAs/up6jSyzYy30YLxj5/LyU rrJaB2Hj0++/nhDYA80ZxfHX3z92rsiJuuP7nq3ye3AsTTfhSrbG7+m9oNl+4DuasKfh9pYXhKEP YgwnG44HMiKzY0XNMG0PFNM0oh/EOyBLUC0XFFC4/Z5XdMMEbSyV55SgPx+b4E10ABv5PKWaaIR5 XqCmzuHl7nk9KOq6Sl1ddyNP5QU9Kpu2m55exlDmFScpUIVSV+F4/TbM11SvefntA04tYXdl4+Xz xzO41n4ves3pw6fn1pUlMyrqpkGRIXCKm+R5WTcoNgQGbplXcCI2L9/rdsBd4Sqi5qUlqsrEljnR TooS1W2L0rSo2zq1RYYRzSgHbXJfF3gtyIoC1XUZGYqZHz5/mktXfkOsurGh+M089R2eRuSIghbV w9A2ZWQ7CcpsRY/accTj6dPnOVIVN2/apu27wlEehvmm37787ZGN7vx0Po2pxnFaMhxOT+fWVVQ3 rZoOj22kSWY2TEPXj1MXa4JkJ2g9EeuiGlT9gJencx+bRoBauNvQ5aBG3C/TMMzH4zz0wzgPmSGI ZgraNF1fh7riVtOMyRWbyHTAHD8t/xAbuhZPT0tToGEZYl31qrEvkzh0La/sK8/wqmlsimr68GmO DTvrhyrPm7FPTSO5D0tttzx+PFXe3VO642Ga58qRJAfhcTwcG1eWTT9K8naekaO59fE0oKKZJpAR DS9Ksnqca1dziqGvUH96GmLbR3hAWdlNfWI55eFpblB7/PAyN2U9Lq2v6jBztUVe47HyzHB4OvVl 0c5T6Voxfjm34Zvi6I0NPZ3PQ+x4xTjmjp0OY+lqqgqvEuEmdJJhbkLbQ8eXKbHDdsFFFKNxqjw7 uw8rbDMZTzhSuVsUbQ9TO8x9bBgRaNxOS+NKgmLYToimY+sbXnNckO9E7dz6Mi/rluPn43GITL8Z 2yQspkNLbn0Y8ihplhl5XnU8tZEbDy8vQ+yG9YwTy63muU6iAh9Bjxifp9x1kn5u4PL1YcoM/jvZ 4nfYmA7IltWoA5v30djHKsdAvLQRGLVPODJEJRhOY+Jl89NSZ3kzL03gZPNtWOnoYbe0nnh5F4SN ZSgrPKLAL4euKDGwIfKy6QZJc3zC5KGXIdJkq5z6UOElw/HjankifHdzl4Y5npDvlYfnucqK7rBU oNcy5aZiV6dTZStGBlp5ETGHIqsgwCcuUNf6igwO0wW6DdeN3uInj2yMU6Zxkt+OVRjWl7yC3vEW sBEHaIJJmBWc5oBTvzx9POOm7kZcunY23YYhRw/auXH4S3ZG2IBnStt5QGU3oDiFFwaeYkUZ2DiE 49j06qnxRF7PxyFSZQMiYDWcP8wpsHFaGtTgPnXc6unTaWgaiDC566FpiBTBKJYl03glxmPhpxO4 TQvaTGC9cT8hS+DNcuxC3SrGDvKBN5DxykYyjonCQvAHNqJm/oqN+crGcmHj1KGyhDBumOl9GLDh Axu3XHVlA8yqnA4TxMnUjbu58TQLYl5dD+cLG2PtCJyWjUNsmDFMElV/eplTJ+yfnhaM+9LTner8 4Qh3QyjzDAeeMpCBPtBY4eQI/DkANp7HGrQpI8sAEy0MDubzOxvS27Kvb7EBHjkQT2G51VNieKQp 08FTejBHL5+fpjL0PNfWJO2RDc1vIa5J+7unzE1gx8PTy/Oh9s0A2IDPZuzyFBwCr2xUVzYS2yeB O0XTE7ABY56PY49CXTaLwxPOA4/kEPLl+TiicXJho/Dj4XxoYt9zHV1Www48GtjIgQ3NBJuLlbd6 Csm+gA2MyWO5DSbOOkHM0lVN1Vw0NpGbgs8HpgM8jIkT9Ych8yzT0GRBex1W2jBJgO1cg/jKRu3p bvP82+dDbmrEcHw7wUuXQhp3JmxUuLIFTk3xQK66DFmUj+cpdRP8DLbRQA4jaTE+9Klrwt0k0cwx sA30TVc2cO769TJXgW0augKvq8W5TtjAXaBBXJlKyEj+8hLEPTPXtLjvYxmcoRpK14y7BaM0jjzb KwfyXpt5rLOiPz/jCOwV4zoNA8gURTUersP6wlKsEiJrqHGXfMMlr17RM5j2cQChDQ49Kx4OGCbV 5TxEhosGZPOsmvRdDLHiMFZFvZxHCIbj8/OCuzrzdA0me4ySMPAsVTKyHgINt2oss1LQDallJf3U 5lEAmakM2U+fARs6yPnKhUhTeMsMu5fDpvYhjaoqX2R4M6sSQ7EhL8IdJIaOm9aQ9hhJN41dh5el hgTKR33fQvYXGtLjMMia4AXj0ll9heasvMlMQfLa41KagkAObWJrU9/2MCuSGFKlBsfIQYV8wvE0 wImljZxkfDpPfT/0yNeNqO67pkJZoMt6VBW2wCpEYxEMElWhpth5N7Q1KmJbUZyiilSWVUEOshyY fKc6UNk3sLETrDgyRdEMQ4PfQRkaOjIPiWHVNq+ZuWjGVVND5CwinedVL0M16OdrkAlGr8M4wUzr JnPWBSGo6P0YMjFODcvcheJG9WIPjMmHlB8hiHmGpLoRZIp7wQwD4NXLoRaAFDtxnGw8YpSjfsaZ qRgBJN5QB3iqIENVqnF7wYoiyCM4PYgskZPtpITzeWRKguaHNikEiBzPqQFqyuBNqwg0I2kaSffh c62XNJnbM4Lm+IFnKrwgawq/HnueY5kmqbZY2XBJ5aUJkJA8DIMaTocaTOVILkrteEVTuB0pAA2J pddDUoOZUGI5tqkJLL8OouHWqsCuJzzHtnTNzsepjvyonucS5ktSQK51HsNKRBn6qiuUa6SUA92g kPMcuAkjKBrcir7I7TgoNV39LZ7yy1om7+nL51oTr6UxlNfiWhjD8e52zHEcKaLXGluCgvobw4S1 Jr9Y3WUozXB3EajPL0sFPFyIvglcFSAnyBmBhL86CZJ6xJkBr4Zb1wDW4v5hAMz/13sT3daSnlyR /HKTY3j4+S256HWVmLotaV7/XpZb1t/p+/HXCzPfGPa6BrOOuQ69rguRw9sy0m3sfTB1WdSBD1aB GrGvStQOlQ+55P1u93VXiv6Grg9XfDjxDlamvwtwMTOBKFVVVR5o3Dt/mn8aFAk/YRyHvq1wP3aV /b8REAlEGQpo6dZ/+N8GWZJmmP2OfnM/5OfEPcJu2PAT4lvG/d2+/s/rDCQH2v8h2/leX/+x//9z YU3XZVn6ug9Ps4rxh77+LXFleZ79KemA4s/wwiiw1S8SJmovOcnXfX3Syyd9REY2DPktizHvBRQj u1ndtqRV91hBk059g77s65PqVhEYqGp13//OBoh3C4rm7WIY+7YuA42lqXvbnGL1bGguff1boQUs BIFFmrsXNqiHJvu9y/6e4yvZ99DPfR5BbQG2D66w1u3MbsfqZI1SYtd9LhA2GYZh1bBpU0vkeNUm u13ou/SlWGe5S9v+P/1Q/zDIWvO01L6uKCK3u7bNPZss4pD160ARZUWE52YERZEUtz494cxWRI2w sWPu0syOETXDsMgGgDet7v53YV15PzY+PD5DFrPMqKjquowtWTRJb0PT3MCW9jveCHzbSqbPf3vp E0uzo9AQ2FdpiRPtOM9LqOev64nvEuApMT6NhUve706w0qbvuh53ma2SHkhkOBmKNZaRfVSGbjr/ 9vsHnNpmWCFfkR+kSRd+noZ+nHFuvtv4StGCg+bjWJH3y2lxh5s8XfvqNumPRaZf9bnBXZoFTtC9 kK0EmpH0fWyYyas06cI/L2v7nTQN361xMIpfTYdlKD1NcauxSyzdyfFU+T5hwwoaXJo8SxpJsWEV y7HxlLU1lZIm24N0dTwTvqp5TNR36yok53Szbj7OVeAkw1Q5Iif77dzFAbqwMSKLZ9eWq6YneCrA UpSENNmT/lG6WubclPUUj5n2AzcQ/osBmaVoBGg6zSgupznX2R1vV3Ofhg9srC3XSNXiAZ6VZVY2 /GycHqQr0oXn5Kgf4cd3zAZkDeAjy2ko6vnGxtQldzYqR+D1YsKxqkYPbAT5+JU0ZCdS0L1nNta9 iaygp+MJl9W0IFvgZK+Zmmj1FNOvJ7LNxKkP48rGRKLIxTZSPH8pHYis+K7ZWBtrmqLa+Xjo0qxf utjU7GzApeeRnSWGgyacOU6CnyZgI+yXxocomo5j5kbd/IV0S1qsPmm2v1s2GNmJkjjO2wnnHkwj U5PBAW4i086HJtDMDObMsmiPz1OkyF57GEtXN5JhSEyn+EraFxnRb4ZMf69RFErVgGwoHfCAPFXz K4y7tuubFKaHuC5dWfHqaRo6vBxaXxbMHLhJHTOq60BVv5Z2BEZwyvqHbkr/l4Js6k6qpm2rzFU4 TvXyumnqMjJFTrKjgPT1ga2mQgglBs/KbtnWia07cWQK/NfSGrfjtCCy32/2RbOS4QZh4BoSu7s3 8VWoS1lJU4X9jlPIjmjbsnTI3VnZ8jwTSjl93S/9B+m1/S6x7zUzvywESpe+/bWJ/7C1fl3oWpv+ 3NqvpxmONN33zKXX/rX0ugWffdd9ttdO+uvBtVH+RZP/0q+//I/FrXv/B+n73w0bNmzYsGHDhg0b NmzYsGHDhg0bNmzYsGHDhh+M/we2E/nkDQplbmRzdHJlYW0NCmVuZG9iag0KMTU3IDAgb2JqDQo8 PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAyNzQvSGVpZ2h0IDMzMC9Db2xvclNw YWNlL0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvU01hc2sg MTU4IDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDI4Nj4+DQpzdHJlYW0NCnic7cExAQAA AMKg9U9tCy+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICHASPYAAENCmVuZHN0 cmVhbQ0KZW5kb2JqDQoxNTggMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dp ZHRoIDI3NC9IZWlnaHQgMzMwL0NvbG9yU3BhY2UvRGV2aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9C aXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xl bmd0aCAxODE4Pj4NCnN0cmVhbQ0KeJzt3GtTGmcAhmF2YfFEQI14NiIR4yEqKioK4qaH1DTTHCZt pmnz/39H9z3t4tMv/dLRGe/rFzA78nKH8D6lEoD/JIriKHroF/GYxOWkmpR5JLk4mZ6dq0/ySII4 mVlstddmq/FDv5JHIqpML3ZOTnaaU+WHfimPQ1SeWtjuDfu7zUn+RowonpjbOhuNzlq8a5y42njR vUkvd5rTnKxGnDxbOxykV/srtQoPpGRO1Znlvat0eLheT3jPlMypOt3cuUhvupscIlZUnnz+snd7 e9aeJ8+seGK2dTJKLzpZivBASuZjpr5+NEz7u8sznKpGnNRWDq7TwevVZ5yqhon33X46PN5ocKoa Nt7P09Fpa24i5j3j4/10lPa2n/MxY5l4P87i/dUi8W6ZeH/t4j3hgZSI93/x8T46Id4dE+/tLN57 xLsXV2c3TbzzlYjn4/1qj3h3TLzvm3hfI94tE++v+unN8Qvi3TKn6nbvdnS6RbxbJt5bp6Pb8+0F vhKxsnjfOB6m/SzeOVWNLN5Xs3i/NvHOIVJy8b6bxfvRep1T1YjKU8T7uOxjZr59lsX7S74ScUy8 d4n3QpzU1w+J90Jk4v2KeM9F5SzeL4n3nP//TOI98PGenneIdyfE++4S8W6ZeD/I4v2AeHdsvPez eN8g3i0T7x0T763ZCR5IiXj/NxvvN8R7zsb7gHjPRRUX74fEu2PifSeL9+4LvhKxQryfbc1PEu+G ifcT4r0QV+sb9seIS5yqVh7v/BjRyeJ9iXgfU8T7HPFumHjfOhsR77ks3t1NIn6M6ISbRMS753+M SLwHxLsYj3cOEcPHOzeJAuJd2Hi/TgfEu0e8C3OTqHNOvOeimHi/j3gXzACIPN65SeQwAyCYAVDM AIg83vlKxAkzAMS7F1Wml5gBGBPinRkAz88AEO85ZgAEMwCCGQBBvAviXRUzAMS7FWYAiHcvnwEg 3h0/A0C8B27D65Z4D/J4Z8PL8/HODEDg450ZgCDEOzMAHjMAIr9J1OZUdbhJJJgBEMwACGYAhNvw SpkBCPIZADa8vHwGgHh3woYXMwBePgNAvDvMAAhmABTxLoh3EeKdm0ReiPcu8e4UN4mIdytiBkAU N4mId4sNL8FNIkG8C+Jd+XjnJlHADIBgBkAwAyDY8FLEu2AGQPgZADa8AuJdsOEl3IYX8V5gBkAQ 74J4F8S7YMNLseEliHcRJzU2vMaFGQDi3bu34cV7xt8kYsNrjLlJRLyPYcNLMAMgmAEQzAAoNryE nwFgwytgw0swAyDcDAAbXjk2vBQbXoINL0G8C+JdmHhvE+9j2PASxLtgw0vYeL/M4p2bRE6+4cVN IifEOzMAgY33oY13TlUjzACw4eUxAyDY8BJseCl7k2jEDECOGQDBhpdgw0uEHyMS7x4bXipseBHv HjMAgngXzAAIZgAUG17Cxjs3iQpRhQ2ve4qbRMS7xYaXYgZAsOEl8nhfJd4tZgAEMwDCzQDwY8QC MwCCGQDBDIBgBkDkN4mYAfCYARDMAAg2vATxLu7NADz0i3kMoph4v494F8S7IN4FN4lE/s07N4k8 ZgAE8S78DADxHrDhJdjwEswAKGYABDMAIo93ZgAc4l2w4aWId8EMgAgbXswAeGx4CTa8RB7v28S7 MzYDwAMxiHfBhpcg3oW9SUS8j2HDSzADIJgBEH4GgA2vwHwlss0MQMHPALDhlfMzAGx4BWx4CWYA RH6TiHh3mAFQzAAIZgAE8S7Y8BJseImIGQDBDIDIbxIR7w43iQQbXsLFOz9GLBDvgngXbHgJNrxE seE1T7xbxLvgJpFgBkAQ74INL8GGl2IGQDADIJgBEGx4ibF451S12PASxLuIk5qJ9wHx7jEDINjw EvYmEfE+xtwkIt7HhHjfX6nxMWMwAyC4SSTY8FLMAIh8BoB4d8IMAPHuFTMAxLvFDIBgw0ux4SWY ARDMAAjiXZh4ZwZgHDMAgg0vYeJ9nw2vgo33Sza8ci7eb4n3gA0vxYaX8DMAxHsQZgCI94z5izA/ RszifUS8Z++Wcrkc5zMAxHt2fEzNTFUrE9wk8qJkZmG5WZ9psOHlxZML7b3OSnPtgBkApzyzftQ/ 6Wzt99nwsqKk0b5IB93jfjo6YwYgE1Xnd4ZvfxzevHljfiXy5A8R87+7zYP0/fu7u7ejbuv5dOXJ v2lK8dTy8c+fv3z+cDfsdtbmnnyLmIN1rffr129/fnn/5up0b63Ov2jKtc3+h2/f//768e6HQbdF wUeVenvw6a/v337/7e3txd7qsyf/NxIls52bj1//+PQuvTzqrDb49I2qc53rX979dNPb31qZr1U5 WOPqbOv4onfU2Wg2pquVJ/8XYnfNFje3XizN1SaTMs+jZL4nqtYajdpUlccRROVKkmTvFp5HLjIe +kUAAAAAAID/0T9ab7s6DQplbmRzdHJlYW0NCmVuZG9iag0KMTU5IDAgb2JqDQo8PC9UeXBlL1Bh Z2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0V4dEdTdGF0ZTw8L0dTNSA1IDAgUi9HUzggOCAw IFI+Pi9Gb250PDwvRjEgNiAwIFIvRjMgODggMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VC L0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNzIwIDU0MF0gL0NvbnRlbnRzIDE2MCAw IFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMv Uy9TdHJ1Y3RQYXJlbnRzIDU+Pg0KZW5kb2JqDQoxNjAgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURl Y29kZS9MZW5ndGggNjA0Pj4NCnN0cmVhbQ0KeJytlVtvm0AQhd+R+A/zuBspeHdhuUiWpdpOrVSN 1IulPlR92OC1i2IDBZy0/76z68hNG1wE4gWkATRnPs7ZgckHmE4nd4vbJbDZDObLBfxwHQbMY4xx IVgEkWAgAwaVdp0vV5C7zmT1WcKudh0Ou/PLLOTMl3+9vb1ynY+uAzd3C4AXnfiLTvZTziKRAGtp NV9ju7ccgsBjAay3pic2BA4iDr0EAhl7MoH1wejYWWmxlcZg5TpfyVznmkqyzWhAmpp+g/U717lZ t+sSfXX54It/dQW+J8CPmYcwzrJOaqaMxdHs/xr8/mxea4jYRQ3kTZoeK8pjomhIGsoF0YBwHjP9 BFgptkCvBWm+a8h180RjUlQPHdyC8bj5gSeiIdzkeNxaNZBPhpneHFO9MYBAIRrE98xQpQ/IzSeP NCE6xRJDblDkWAwszI22kFPdwTIcjaWIY48PYhmNxrJdA3mv6xrqwnDcoscMv8ogs060PAtL86By tcNSF7R4PGgB1pMh0JLxoLVqIKvKhlXhcXaKbWVoYZETfawtOgyvpjwgP7PalJss3yFH+YfjQecm 9dDBk7Nhw4Rt0zDfC19Pk9KIqFLdZ3t7NGe6pj5BsQmpj2VZVI0pW/k4z+G4x6dNVuJ1j5Nex8RM nCIKVeuuY5333jcX7cFl5Ml4iD147+Vy0R/tIsjyfKArGx6VpiZgGLXs3sBE0MjwlzWEyjd4j87u Of0H87iLZe/95Lc54wSTc2/QjuS9F85le7aKILeH0u7I4tEmbQNZjn59jh3lkhSluaOFLTjZDu43 Rc7x2w0KZW5kc3RyZWFtDQplbmRvYmoNCjE2MSAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAy IDAgUi9SZXNvdXJjZXM8PC9FeHRHU3RhdGU8PC9HUzUgNSAwIFIvR1M4IDggMCBSPj4vRm9udDw8 L0YxIDYgMCBSL0YzIDg4IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1h Z2VJXSA+Pi9NZWRpYUJveFsgMCAwIDcyMCA1NDBdIC9Db250ZW50cyAxNjIgMCBSL0dyb3VwPDwv VHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFy ZW50cyA2Pj4NCmVuZG9iag0KMTYyIDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3Ro IDc1MT4+DQpzdHJlYW0NCnicrVZJb5tAFL4j8R/ecSZSxrOwSlGiZmnaSpFa1VIOVQ/EDBgVQ8ti 6v76vsGRG8ekJMgnwzDWfNt7b2D2Gc7OZndXH6+Bn5/D5fUV/LItDpxxzoWU3AdfcnAdDpW2rfsT KGxrdvvVhbS2LQHpbjP3BFfu3u7kxLa+2Bbc3F0BPDlJPDmp/6vgvgyBDxx1Ocfj3gtQIQs9mCfm TDwQBHgBU64EJ1AsFDBfGSBpjy3osXG4ta1v5EPZUUUgLukp/nRUcKIhWiwzTV2ypkLgK25ollkN CZWClBXQU0kK873paIALP4B+h/kn27qZDxOS0wgFzh4j4TvMD8FR7h6jRyJZgViSykCMaiokaap2 0bTVlkKsqUfWGXXIQtcXI3DVW+EqUJLxfbSOYhJU4DARPsd6xnngn/8fgzNBsgMMPn8RA7lfRqhG A5oKRX5ntdGpyYoUapOBxigYFXFUmYe4Rs+3C2ByEuNqSCKUNGnqfmVBffzaP3a4rMcS4R6PnhMy Tx3QyzWyW9OQaMQakCjFuCKqYMus3NLY/phsY8Qv8MUn7yqjB+5EbZb6MT34klKBDH+ajdCgdBh+ 3O9gHeh4jKw3jaw3xFa4DHvOc7ZPSD1oSEzO8xyh6ngs6/7Rsi59yYKDunxN1oOjhWEYwy7rHdpW tnkMpuf1tvb2NcblcpfjMs/1ojGrzuOqLqKHfDTT4fFoqIBJ94DGus0LE0kM4kOWZ6YtbxBfSFZR gQF3iF7pAquvGTNd8KO5LkLsxsEU18WUMTes1zCIMdtxnCkzzhYoWWl0S7K03XW2JiuLMcfFlMH2 AgVPMEceUHizsxNnlzdkrQiZmGbtxOk11PGGUeC9Bb3soF4aY01TNnXQYfWivy5Z4qQyBYsNep1V TRvlpiX+oRKVjPutcT8fslfcBsSbZ9WLxeJ7LDzw+FWCThwhA3oOYtiVCs77YFsiG3MNKNtqtjF3 vBbLpP13MyhXpg95pAaspH6UDsr4F+dLXbwNCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNjMgMCBvYmoN Cjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRXh0R1N0YXRlPDwvR1M1IDUg MCBSL0dTOCA4IDAgUj4+L0ZvbnQ8PC9GMSA2IDAgUi9GMyA4OCAwIFI+Pi9Qcm9jU2V0Wy9QREYv VGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA3MjAgNTQwXSAvQ29u dGVudHMgMTY0IDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNl UkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgNz4+DQplbmRvYmoNCjE2NCAwIG9iag0KPDwvRmls dGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAyNjc+Pg0Kc3RyZWFtDQp4nJWQTUvDQBRF9wPzH+5yptDk zWdSCBGa1qLQohjoQtyZpJsabQr6851EKFWj0N17vPs4h4v4DlkWr4ubBSjPMV8UeOOMQBERKa0p QaIJzhIOFWfbCV44i1cPDk3HmUJzCpNXZNy3dD3h7J4zLNcFcEZSZ6ThVVGiZ6AR1LwMuGsFayOy KOueGYBQ0N5HXsO6NHIzlPtepBnc0sGNsOLsUWwqqbz4OMqpFuik0uIolRLVq7Sik08obzlbluOe +lJPA6N/eloTaZiUolDOyfJLLiNKk/x/B3N5V78dEvrTQWx3Vd/NYWgFMhXPLeTUiHfp+92KJgwt 6hBwot0Pt10VNhLV1UiBnwJHdwINCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNjUgMCBvYmoNCjw8L1Rp dGxlKFNlY3VyaXR5IEF1dG9tYXRpb24gZm9yIE5ldHdvcmsgSW5mcmFzdHJ1Y3R1cmUgRGV2aWNl cykgL0F1dGhvcihKZXNzaWNhIEZpdHpnZXJhbGQtTWNLYXkpIC9DcmVhdGlvbkRhdGUoRDoyMDE3 MDUwMTE2NDUzOC0wNCcwMCcpIC9Nb2REYXRlKEQ6MjAxNzA1MDExNjQ1MzgtMDQnMDAnKSAvUHJv ZHVjZXIo/v8ATQBpAGMAcgBvAHMAbwBmAHQArgAgAFAAbwB3AGUAcgBQAG8AaQBuAHQArgAgADIA MAAxADYpIC9DcmVhdG9yKP7/AE0AaQBjAHIAbwBzAG8AZgB0AK4AIABQAG8AdwBlAHIAUABvAGkA bgB0AK4AIAAyADAAMQA2KSA+Pg0KZW5kb2JqDQoxNzIgMCBvYmoNCjw8L1R5cGUvT2JqU3RtL04g MzQzL0ZpcnN0IDMyNzQvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA2MDMwPj4NCnN0cmVhbQ0K eJytXc+T2zaW7vNW7WlOe0PltFu1W00QPwhUTU0qjpOJK7HHFXs3h9Qe6BbbrYpa7FCUnd4/fmbe BwISKREgLO3BFiQSDw/v50c8EM2rghWMV4qpkj4044LTp2RlIehTsLLCZcuEkIybgkmB74Zut/RZ MWUV49oyrei7KVkliIbRrDKGPhUzlugZyayifobuKTgRsjRYoelOXOWSbrV0uSzQl764QS3dJyRd txU1LLFj6bIkVjnGVAK/0D+F65Yoa22IbUyjLKiBedClssDACr0wDLf0CziwuAeXZckwcMndJUWN qnLTL0uMbuiL4ETVcFbKAr3oPol7ON2jSB4lTanUJY3OqbsmXkpOBCt0pZ6l0aBK3a3EpYoJCKEk LkVR0XUaWHAFOoYJR74sqQEtlIokXxKdUjMSBn6R1CD5laVgQinczJnQJS5Rd01CIn6ZqEBQEB0j aHTiUlgiVpLahHXdKyYLhclJJjn9XAr6hRuakzBMlhAm6VIKhYZiUqI7CV1KiE6SKShNdCT9ojFd SXTc6CRQWRk0OJNGgaBl0tLkSkkEneRJEKqgHiVxqbgAHdgUhCTJqEh21CCjFBIyLpmSEC1pUdEY 1NBMKU10lGRKC/wimKqgRsWpUREdmpsyrjtRtmQXJQlLWU2XqKcuYCT0RRdk3aQ9pjnNu9SSGjAb XTENYhCEFjASslctS/yiqGFwsyC7xwThABryKehmTeZeEgfakD+UZK/aQgWkzqog5ZfkVVUB+yF3 qjgoEweVMxk4UOkucVZJXsCIqAE/hE+RFKihWKUhDeKg0hV6VeRuMFgamASPX2gIS4otyb8qS15S ktBNQXMq6YvhsFUyAgO7KMkrTenuqZgRkA9pkSRHQ5ApG0nfBNm90YPlUoN6CBKoqcAYuZVxWrbw drILMnNmC5KEIG+yGFSQx1nMlOydWfiWIFVZQeoW9MUKkg2+WIl7aNpWYSzyL6tIAHA/W7lelhoa /BhmjUAvomOIeXIgZq3GzeTmRQE75y7ckLYEUeMFbEQg+hQCTkT+Qy0LT0M0kuCTVMgLBT8qcZ/G JEjj1CJ9ihKUK7I2eCQvDNESCIeFISULBMTCKlylOEXDEWXEKPqxgBNTy/FCcuXc+TNCKsd0BYIu FyRNQTZIAZH0LMgdOVccfl+gRWYhaGwQARWMUQ0BAy34W4UeBv6BQE7xTg7hm2IccUWi5RSOiAp5 IbXI+gS5GFghTskXeQlJCERjCgF0H1k/J7em+xC8yRkMQg9a4IX8lJO7UA+SK9GFNBQoV5CkwlVD 9AVCLxkbzUhhDEtmK5BsyDoQwQxSDsIcGR61yHIFuSeFBEgSSUVAoxTg0HJXFfICJKSRIZylkCNS i2YtNJKFxlXMnMIhKINKRd+FxmgGtoHkI8hc6T5QtjAqpBaJuCAgP3I/Gpcsk1qQBmmHTFihB3Eq YV2CjJNa5GTC4DeJ+ZIPc4m0IEjCXGpHz6LlqFQuhyEug7KBJRr8ZmDoSH7SKrSIA4qQaCHZkf4R ydGC3pAtFeKiy4sK3iSQL5XjBdlVSYMWcaWUo0IcKApx9Bsoa6IqkDQV7BlpjSvjkoRBRi2QJSqX W0EZKb5ANEd21WSpSB1oaSQRoqcRmiXyqoZVS4AHLQv04GiRdCW5PpkucgvJlVoWfV3aJqtBrCNq NEvJ0aOqXFailkHKgddS1KHEAk/WFnkEfk5BAUmLOKjILxiSBJwCPQBfkFQkokAFL3FgooIuEMUJ 7BAtJDVqkUYlPL5C1pSIDJUhPjzYqXAfqFiSuIQnGyRwCa81ThqIDAa4AVGTYBD4c4AJ0UPCkw20 Jx04kqQLichgkDvgX+S0JSgDQmnIBb5KQYXucxAE4VUiMhCawlWMYclCJLyWIiyNAW+05LfUAswB BJDwcwsflxJYCbKT8Gkr0Rc+bZHCpXLYiuYv4Ze2ollL+LmtLH4DFUMeJh2IsrAXYIKigH6VQ1hk NVIBNHLQA14pHAcU5SjauxaAE2xKIm0XkuxKavSAp0gApEIDbtA4BMvcb8BllLwITKAHQJTL/QVy jHS4icI8c8mRwz8kABOCGLU40BksAjAG7s0GxIaRMDYhNUfFQTVQMYBfFXQJ6EEKxriAbcYAxWAM QFiJlE6T00A2aJHHQpoEwjA3RNwSeR3eRwgN9mIA0WBxDjIQ8qkAhgDtoF+AIcIauA8oD/BZWofl yMMksnLpOACwosRK/FkH58ALYBylTeAuB1JhYcj+AqBDAhoK2Ly0QHDQgAIKEpCTIt0RewBUgLQC CE4BDlOIJLQFIEXhkBAU0CgFN8A1ULEcPcABGQcgHJAgoBvgh4uYmB+1EDe1A4OwLvAnh6jgUCAs vXJYz/mBcIAacgc0hK2V0K/Ck8GAAIXzQfxWcdgG8B2ArQTYdlHqz3++feueRAr28+2723dP9fb2 /fNTc/uu7/Z3/Xeb5vH27Ucm3PUfWfGXv/zrvwx9iNVEn2/u+n29ed/80f/722/evPqWvag79h/s 9sdfGf9fdiB5AbkX7fcDnXKejvB0fuBnVDA46Ziuu4c2+pwlcZAGxvvQ/jFPR0b7k0oyJdPu+n3X sG92u2a3e2y2Pesfunb/8cGLSlxH/03Tf26739ir7X3bPdb9ut2yb9vNprlDcxhCzg9R+SHezk/e DkI0xZVCNPH+OkySuJ3vXHhNCv9ZRYlRKEjbtz23b6Mypfz+Yb39uGP1ln237ZvuqVvvGvamaVY7 1rfsx237eWL39oS1YPc/lLOzNCM7Pe3KM0Q8TGO+f9KORlIpj31sUpIjqfzPfrNtuvrDerPunyfW fMKFLZKmRtF6kf/U/AeG5/sHI/9+/ZHccF583tJtESVjRaYY5aiPzhTjt+32HtzVR49V81yotBir Zf6TYkyYYYYYrfRijFujzbVGfeiD1ao8Mb5r7/vPddcMEqzmGMCKV0KCWCJbZD0hQc/r5RIcDNFz OT+BXEM0oz65hvhD3a2OErTzDCRtEOuGi6wnJXiVDWL9cpBgIiIGe3q5rj929eN8SDDeln3eGbQf 5jBLdzmZmdJnVO8oJiGrJUcR6iybYUE1T89//8fN+5v2ZnVT3zyzf7vZ3bCb1zf7m81Nf7Oe4jc1 ZSt7hP+awrdLyXxqtqu2G+fcKWa6lK4HTbspPDqlFgxlPmtjjdvZBPc2x5X/HKNOFdFrygd4mUEg 7gQqMp0k/h8J57vt6qldb/tBODpCLfAxHwbK4loZ2DiBcgnpHZyjGnXKffYAUO/Z63pbf2wcXB/k YCK85JJ91272x/xuI9REWqrewsqEhZUZgNFzfbGFoQgzMCISjFS5WuKjGCaKTHlOQFN46oyErWyi I61P9cUjkay0SYUJPshJJDz6IKeUwkSOP6UU5vNXmXArsQQtjgoTo1654GLysBAUFgm92UTjCotE QZGGL6LyCjMZckoqLCcJJBQmfFIRKsHI4orOQWEjPC1zk2TA00FX1TwX2fTiuorEVsmTupI+/8pE MDuIKKUreV2+RcF3YITH6cjkSsNEV3bUK3cV6P1D19Q9e9n0w7qP11lZRLjJpTtVVBmJrzK5koSK tpOPSgSxg3ySikp4ZZaitFdUFaejssFFWY56Za9sNg/1pzVh2tftdt233Xr7MegqAmqzSZ/oKhJa VRpiKA8xVCJ+qRyIoa6EGMpDDJWAGFl0Lu8agb45XSOxMqdrJBjmdI2gyoyuIhIodDYmEHzUKzd9 v9rerVdICGdwW0QAVzbpqTeIiHPpNBzQHg7oRODROXBAXwkHtIcDOgEHctQ8HxSW1y6w9coxwD2i 5V4yPABL/3sZAJRPzsL3kyGu+PuUv0/5/srfp30u1f4+7cOA9vR0AsBWSZhPHYZ19umiSXZN6ufm 9/26cza6myySDFRHFA/Vqfl1g2qkw7O+YQopYxqXpc4I5D7l//0f7KvJIs0ZpWBOP33YzAeqIs5G uhgzXmz446ndNexuqFg1K/bk62XrLdvtn57armftPXust89stb6/bzrEiD261LtmN1kOis/gRbt6 np9DmRBlQDU/vZpXgzdZwxNyyC0wkTr+NFmNOqMkl9ShE2wkn8UnRr7a3zXsqelcNXF7B9XsnAq8 igBYjjo61BwnZYs473FFmAT3Iq0I42PLeD01rsx5EgmXsrmrB0eX0pGJ2AUd2oQp2dznrPfrx2bz fNAXPQyQ9s5UVS2xGFWVFZf7jPXh3Sb8LrtudvQZE6GkluSdsJh0rWrEBqq/bP342KzWdQ/Jf35o tuzuod5+bHasvbvbd//J6u2K1bvf2D1pJRSL7ZUD+0V2XlxJZ//Eft83O9jG7mQl7WKa9Y5tm2bV rKbrZ3ENxc1tCLPYZzt8cv+ZMiG5YIb+QdAmos5CxLDxLC6KXExxjBh8PoeJQ9EsYsKiSPGR60k/ NZ+ajgA4a/5Y71yI77t6u3PZ96lr+5aCyW66ZBdnNKZJUWTF51mNeZGGKc2zwL8gUP9pukx4NpuF SC14PFKL7DLU27rr13f7Td1R1OgfAITqTdfUq2eKJ08bhzUJEn3ARdLNpC7D53PMiPOoHng8gIvD Q0RED9x7Ic8CTvOqtAnRfQFe+mq6LnlGagEwCZ4ypVzA9N+ks11P0b3uVuv/I2U9tqtms6M43w1K ++Opa3Y7uNQR446SMZsugV7MB8ZrCBEj13cN4WNPdz7HjIQTtxLjNR1X16LX+pKon8Y8K2V+1Tp4 bTmf8cSh9hVTeZmw/OxK3svm05pw8auX00XRODNREZeJ2F0WadH6Epwo48hVpEtw86KdT9Si1Eui jadSUeY+lB5KDj+19Wq6LBpnKCpeEX9AXRZv5cWbCFbiAsuNZE+xZLkiYbki13JnNpqVkQQolq1X XGG9wluvSFivuMB6I0lRLFmvSFhvusw24uNvFPC73deelUhaEst2K6+wW1/A9ExflJ/9Up73sGAK gfMISZ0i6VdiwpN8eMoMOD2Ax4A+QnoKs71mqSyeeDIWPSu/COl3H5dVXAJCLm4/Pt9fL9JVwfGm FPai6fumY7/Uz9OdxuKEjfRWYyHH++tO+2bUdTzLEQJLWz4OMjiWzoTKRe3TfUkiwkJyQ4ZQPIP7 1PTHNcyo/FIL8N7CpY3TUcm8MhajHHXKNaXwQsJ0o/EpC7nU3jUdPTpOVr3OaMm0SnyYUVWGRJKq SVlmhmqUD0LjyuUFdKr5njrXzLsGj92Tda0zcaSNXKeMPMfH9XVGbiMSyIUpv++b7nm6tnVGK1nF FjrHFJISSNhAugQ5dk/OR71yUcS3r1++mC6anTGQ3HspqoT2DrwnJ5+ITTmO5KumYlw1PaVTZafL 0WYzkV2si2ziDItXZ9xctseCR6JnlbZO/3qaqBK5uMqx0uq6SIX3uwdGRIKR7Jw+2mQmTG60m90V GAmh2UQXd5qdTTIdUI1HwONqYVROKYWZK9GDx9Ge34iUFt8QOSjMjnrl76uY7AosIwE6m15UV2UE 4Zrklg1hfPAxieBzEFFSVzlIOaEr/5aHMIlcZJZ2cB4B8wgxZ1cC5/ZIlxHgnE00rrBIcD28Tjiv MP+KjbCJYGYytnEKm/DOHIX52qSwCfhkk7h4ojA16pVbNUvsDoyA62zSJ7qKhFib3MkpfC0Oh2Is iyipq4R3ZunKPzTY+EODTL84ONGVGfXKhQKxLbfz6Def7snGtfn4Kg/ltllFyaEq6E4gWZZPQlGe 7YsVJYcqbeD3coXHljsyukZQdE7X2CJDzoP+FQ+iV0DveVXzbEwgqlGv/4dtnPOAK5/0iTdEnIsn MYH0mxUlj0edo4hS3sCvwwTSr2t6fq/wqtmuyyuaQnrELz04kR4t+d3Wwm/H9CsM7myp4dMnae3j rl8Z9ag3IKqQqEMSCDHGnXA0fBr/6ROJLydLv61Uch8u/LuVkseBriyXtntydX7kg8wu871ots39 +mSvpyc5Ipfe7CnHJb7zzhlL2HJc4DuncPF2z3NSC/s95bicdtZbJJPt+Mkc+6HqvmGf1s1nVKtR Jd8O7+NOVnYTDMYqJ3L8nt15/3Sx2ssyTCU2zy/f2iNjpBa29kiRsp3sV+SGLZ0rVvd9ffcb+0Sh gQAm4RUIfuVq2ZOl4ASfcblXV8jdv+omx/Wlcya+3NB1jNSSocuUoafrPJM9Vbsd24Wn5b7FHmZK jpPdlwneorKW19i4344vZcrG5ZfbuImRWrJxmbJxmWvjfwUUb7ph5wuCymEf2+MpIrHXjnVXPw3L VetmF7aou5H2m379tGlON6eHJeyEbOK69mlz/OLbF+vc53opU/6VXYUbbbyK5cRDDS6mdJWyvnT1 a7wPp+5rVt/dYXuVXz/ELlvYwORIIh7LeEc+owoYv332xYJXHtyolMdmV9rO94qe01rY8iZV0gRy 91u8enzq2k9uHxs5Xft0cgQUjyU8tbjpTKprDN2/uyhVMhsldyp4kBGSXgjIwVmDzYS5XIXrElwu I3npd2l4ABrmFZP80jojH2qGU6icfvlvfG5Q+5mtWva5IXd8WDefKN09rIc9kB7ZTY8F9KNdMNJ6 e9/VO3cJNewBvhy23MSoh4gSwej+5To5rhqeETmIMKVTLRIUsiuAR08XMVJLEGZcAzzrna69jRj5 5aHuj6k0bHPduTC76ur7fkeJbgu9T5HuxQNuwj50gktkULCir9k3gE8PDf3/sX7aUZOYwrsF0x0M lw9KY31o2P16s2lWX0+hY1zu0Qjma2rS7xmS4xrdOb2FiKZ9tKl4Sp1f8L7MV1P4eUZq4YUZOd5P dd47dy3a2dXndr9ZwXacLkkJfn80ms22/rBppifvXD7cp0mN8YgIv54iwrgw4sr2+jEpd1tS8qC/ MJ8IEfMFe02/OgGeZ7QWNptKkwpjJvfpYEbLyAh3iYN7Lh/sTKs8lg2Os4+q1b9QKMclwC9Wqz/t TZpUAEgfz5lGf2e0qiW12gQn2W85ItnvHoJaHygXbLCY0+EG9wbENCnzWFI4shvVg02FvUX5e+Rm U76ZPtdzXv6xhHOooMbkb1OWkK4snroVlhSe2313i//Y3X7Xt49NN7xzd5B8LIsdGY1L/hrL9xVd aVN4SqdxuPbaq4Irerjry/tyXOy9EKslUlkG/vYHFXhwGeYTk/jSJhquz3cHq+yTT9/QfwTPmqeT xWo9XTHHeeYpIKyKiVBFZA4JoaqCxymo7NcRzxerz0gtABVVVClG8oEKYOfwaPOxZfdd+8jw09cn 8DzKXczBVGFT/KVfX/WCDPOIETksL83TUFfrWsYpZDiQP1LVG2Xgd47cqPf7rml+btv+9ud207yu n9z5+RjobY2DIXDZHaTvfOnXcEJ5OPQ1nJESXh4IxbbwxB4iRxAAmDnQhZP92DwfDtb9ntjYtn1z +wb/fbddHb8Eqbm5/9DUq6Yb2ugT2q+2m/W2efdQY3L44ZstUXCoyH/v+vV9TQ337Rd6iv7Qtr/d vmzv9sA57pfdQ9P0YLK/fV3fde3o+7cP9P/o+8t1vWk/jn54t1mvmtG9wzjhVNyh+ujn+mb/uPuV Fe4vEzh5ur9M4CTp/jKBk6X7ywROeu4vEzilur9MgJZ2f5kArcr9ZQInXVAfH/I+Obb//AR6d/Ph EF1/0+Hwbv/74RTqyn+GM5X9QTKHE4KrI9Hj6TZ+UvNHuh5PvfHmcjwHc3Iw5/G4xen5j6NT/SbH DI5OkPPj+yXb44FlkxPURodjTU7ruuBUnXCs0OSco+MpO044h7dgwjEbnpjXhD94JBzhEQ6xCOdE hEMWll7kD2+yh9fEwyvW4XXl8L7u6Yup4aXO8DZleBMxvP4XXp0L76uFd72Or1lhksfCuB8kvKfh zys6vhwweVvhWDD3kj0WzP1gYS90CDiHLbeTPcDHnZ3TraajXYSTbY2jzWqT3XOjjVGTnVqjfTiT jUEXFObDDobJlopjoR7CPK5N+sG8Jnx5NhQ2Q9kwFNxCaSsUhU7LH6FuEFblw3L2cdXYDX4AZpNV vbAkFlugCUsbp8/04WH49KEwPE2Fh5SA7o/Q2TFzSHKl/6z850Fc/wR1pvscDQplbmRzdHJlYW0N CmVuZG9iag0KNTEwIDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDI5MT4+DQpz dHJlYW0NCnicXdFLi8MgEADgu7/CY/dQYl4NhRBoUwo57IPN7g8wOkmFjRFjD/n3q2PpwgoJfMwD nUna7tJp5WjyYRfRg6Oj0tLCutytADrApDRJGZVKuIfwL2ZuSOKL+211MHd6XEhd0+TTB1dnN7o7 yWWAF5K8WwlW6Ynuvtveu78b8wMzaEcZaRoqYfSNXrl54zPQBMv2nfRx5ba9r/nL+NoM0AydxsuI RcJquADL9QSkZv40tL760xDQ8l88zWPZMIobt5ie+3TGMtYEFQWquKAOUWURlLIMdUhR6SkqxspL 1BF1uEa1qOoRu6KODFXlUbFLFbucy6gS1VZR2DMvz16Zr8BnPe4fHhj28JyeuFvrB4fLwomFWSkN z32axYSq8P0Cl9aQUg0KZW5kc3RyZWFtDQplbmRvYmoNCjUxMSAwIG9iag0KPDwvRmlsdGVyL0Zs YXRlRGVjb2RlL0xlbmd0aCA5MTMwOC9MZW5ndGgxIDE5MjA0MD4+DQpzdHJlYW0NCnic7HwHeJRV 2vY57zuZmUzJzCQzKTNJZpIhCSGBAKGEIhlIoZeUgSQQSEhoKtKrgNg1iA0sWLEXLJMBJIgFFXtX LKtrW13X3RVX17IrmOS7z/u8BwKy/vp9//Xvt9efk9xz3+c55T3nOeV9ZonLOGPMgw8Dm1JaNXb0 HRfvncWUlyOMBVaXjSqtfvPWit2MHUSl+HfLRk0o+UPd1h8Ze3kKY8bI6NKy8j899Z3KlOf3M6Z+ NXrK5KoFzcPOYezzdxm/wTa6KjxKVXN/ZMo5nzFW/t7kqoL+P/7+nW8Y4++iw4amhY2L71+/bxtj OY+g/XdNK5cHItcfeIOxmo8Zi0mdu3jewh9+mGhjLA/jifXOa1y2mKWyIJ4fQnvnvNPXzD1XzVvO WP1PjBWNmj+nsfnb+HYP+p+B8kHzYbDfb3wP+a3I95i/cPnqt8YlDWVMKWIs67zT5iw9Y2ze1HLG dqHcOuH0RU2N86vW9GTsavSfXr2wcfXijEE97kD7NrQPnNG4cI7v/iUbGXsc47OPWLxo2fJOH7sA 4wmI8sVL5yz+x5Gm5xkb8BIe52bCtzGPLlmT/PktsxzDv2cpZibSvr+ue0nwG47V244cbt8U+6Xp IWRjmcIooZ2RdTB+wLL9yOHD22O/1HrqktRtwuLIZQ0sRjMozMkK2BzGXFfiuVoVQx6/HKXmmG0x hegynVh9jV2gMDNTHDGKohhUxfAxUzpD7L5Oei5jE6sCAYb5B1JoDKablOwA4zdrne6JiRMzRe9x x0bDX8X2uUWsy29Lhjp2n6GUNZ607Et233Ez/uL4/L9K6v3svhgbm/6z/n461l4x/Lq+jmvfk9qo 9Sdva3wHz+118rKYCazpNz0r81g/hpoT/HA/G32yNurnzHHcMzPZvb/6eS0s05TOTvktY+xO3Ukk 9S0247e2MQxg29TZrO5X1m047nlHWP2vaacsYVm/dVz/L5N6gA38NfWEr6Tmb7Pz/9vPu+24frad rI6xmW3r+ryfjaXo163Z0fp6X2INlReO71fNYBW/pg/lAZbxW575P0kY59ZfW1e9kWXGtP18DdVV LFe9mWX+zJ7Lav+n4+tO3ak7dafu9J+TlOu5RWp19y+/v3kn6/Vb7L8lqUknfoekpCxjZf/Tvv9v J3Ug2/TvHkN36k7dqTt1p+7UnbpTd+pO3ak7dafu1J26U3fqTt2pO3Wn7vRvTKqOVPpf93k8clBK BzOwH5j4S60AlEh2lsl6swJWzMayKWwaW8DWsu3s/oAzkNLZqdcIsHytxkg2nlWyRnZalxq883vt gaeoXf7yq7NJefrT2Z+O0v9tIRU9iJTO+rAiNgp9dBmpOk69Rg2rSzEeF4tnyaidzXK0Jw5nI1gp K8NTp7E6NpM1s/lsGVvOFe7gTu7l6bwnn8LreD0/nS/iK/hKvp5fzDfxS/jl/Dq+m+/nT/Bn+LP8 JWbkX2pP++Zn/9rBmaL/fZ3CfjnxY+M9icPFDJh6+i93oU5k7CTzZMfNlHWd60mG8bPZw/Z/mv// 7qSe1Pizv9X7len/yx0eGt08a2b9jOl1tTXh6qrKiimTJ02cMH7c2DGjy8tKS0aNDBWPOGX4sKFD igYPGljQp3d+z+ysHsFMf7Lb5XTYrZZYs8kYY1AVzvLLguUNgUh2Q8SQHRwzprfIBxthaOxiaIgE YCo/vk4k0KBVCxxfM4Sac0+oGaKaoaM1uTMwnA3vnR8oCwYiL5cGA228rqIGenNpsDYQOaTpiZo2 ZGsZOzIZGWgRKEueXxqI8IZAWaR85fyWsoZS9NdqtZQES+ZYeuezVosV0goV6Rlc3Mp7juCaUHqW DW1VmNkuHhtRs8oamyNTKmrKSn0ZGbWajZVofUWMJRGT1ldggRgz2xRozd/fckmbk81uyLM1B5sb Z9RE1EY0alHLWloujLjyIrnB0kju2s+SMeU5kfxgaVkkL4jOxlcefQCPxGQ5g4GW7xkGHzz05fGW Rt1izHJ+z4QUUzzqJpRLzTA2jBDzy8gQY9nUFmKzkYlsrKihfIDN9kVZqCCvNqI0iJL9ssQTFiUb ZcnR5g3BDLFUZQ3678r5yZGNswO98+F97TcLvygPRNTshtlN8wU3zmkJlpaS36prIqFSiFCjPtey 1r4FqN/YgEksEG6oqIkUBBdH3MFRVAGGgFiDBVU1WhO9WcRdEmENTXqrSEFZqRhXoKyloZQGKPoK VtTsZYWdH7cOCPh2FrIBrFaMI5JYgkXJLmupaZ4b8Tf4mrE/5wZqfBmRUC3cVxusmVMrVinojOR+ jMdlaE/UWmFuJ9SWlcXMTVnmQI3iU2vFasEQKMdHcNRwFDixXFpWrOio4YEa7mOyGp6i1xDquH6Q UbNKxogiVTQtGePLqM2g9AtD8uljismKmLv05YTh6JjoOf9yaFRbDCg3UDantMsAj+s0Rh+g3tvJ x6kIX+gPRguzWM4xskjNwsmFTUE3mkmsYnIgwqYEaoJzgrVB7KHQlBoxN+FrbX3HVwXHV9TVaKut 75Lq43JUXkS5CMtAscwoJdiD5Xk+uaxafrSWP5odc0LxWFkcaDEHx1e1iM6DeocsgBOESRuzxzZu KoofgKNZjtstWN4YxGuivKWxrXPj7JbWUKhlcVnD/KGij+DY5pZgVc1wnzbWypr1vrXiUfFsPB9f Pap3Pu6eUa1BflFFa4hfVFVXs9eJt9ZF1TVRhSslDaNqW3ugrGYvXiwhzaoIqzCKTEBkRE+VyJi1 +r69IcY2aqUGzaDlm9o402xmaeOsqU0hm1PaFNgMZAtpNpGwSMnz4WJct2WBZrE862rntzTUisPF ErGU+OURHhzBIkpwRCtXjLaIJThnVMQaHCXsxcJeTHajsJuwMXgih3PEndTSEMQ9hQ1Vw3yctqIq ugy0dXZW12S87DtUm4GtNgOoq4nE5uHuj8kah3qjBRpgHh3Z2NQoxsHCNaKtKWtsUy22rewQVcZG YtFDrN4DapRrbcR2RKMmrA0WUGu/EZnIxtpIbZ54aM2CWm07OyNsTHAolp36jMkWDyqobYkP9tfO Jo6CJetCQbEYG6uqIYsPWTyslpxksmHkTUEUNTUE4G0Da6rCVqe71OIjyxxciYbsORosPr2QiWmp WVa7JRLbBx3iV2hrH3EkY7JMtbU0eC13oV4Bz3ZGrBhRdhdX6g3gHRSNFWPB74UYqqj6hOimoo1V BlfjZhGD1noyoThizxrbiMuf2lthCRbJxmZxR1j1Pg6Q1SRmboPf1azqts67gmsyuqTe+UHxchAb k/n2YmOz2pYTDZHpeb3zzSda7Zq5pcVsP3kD8pfZfpSFMVCGtwZj0Vg10Kactys2mY+DOFeKc6Q4 W4qNUpwlxQYp1kuxToozpVgrxRopVkuxSoqVUqyQYrkUy6RYIsViKRZJcYYUC6U4XYrTpDhVigVS zJdinhRzpZgjRbMUTVLMlqJRigYpZkkxU4p6KWZIMV2KOilqpaiRYpoUU6UIS1EtRZUUlVJUSDFF islSTJJiohQTpBgvxTgpxkoxRorRUpRLUSZFqRQlUoySYqQUISmKpRghxSlSDJdimBRDpRgiRZEU g6UYJMVAKQZIUShFfyn6SdFXigIp+kjRW4p8KfKk6CVFrhQ9pciRIluKLCl6SBGUIlOKDCkCUvil SJciTYpUKXxSeKVIkSJZiiQpEqXwSOGWIkGKeClcUjilcEgRJ4VdCpsUViksUsRKYZbCJIVRihgp DFKoUihScCmYLninFB1StEvxkxRHpDgsxY9S/FOKf0jxgxTfS/GdFN9K8XcpvpHiayn+JsVXUhyS 4ksp/irFX6T4sxRfSPEnKT6X4o9SfCbFp1L8QYpPpPhYio+k+FCKD6T4vRTvS/GeFL+T4l0p3pHi bSnekuKgFG9K8YYUr0vxmhSvSvGKFC9L8ZIUL0rxghTPS/GcFM9K8YwUT0txQIqnpHhSiiek2C/F 41I8JsWjUjwixT4pHpZirxRtUuyR4iEpdkuxS4qdUkSlaJUiIsWDUjwgxf1S3CfFDinuleIeKe6W 4i4p7pTiDilul+I2KW6V4hYptktxsxQ3SXGjFDdIcb0U10mxTYprpbhGiquluEqKrVJskeJKKa6Q 4nIpLpPiUik2S3GJFJukaJHiYikukuJCKS6Q4nwpZNjDZdjDZdjDZdjDZdjDZdjDZdjDZdjDZdjD ZdjDZdjDZdjDZdjDZdjDZdjDZdjDZdjDZdjDl0oh4x8u4x8u4x8u4x8u4x8u4x8u4x8u4x8u4x8u 4x8u4x8u4x8u4x8u4x8u4x8u4x8u4x8u4x8u4x8u4x8u4x8u4x8u4x8u4x8u4x8u4x8u4x8u4x8u 4x8u4x8u4x8u4x8uwx4uwx4uwx4uox0uox0uox0uox0uox0uox0uox0uox0uox1eslMIRM3R9BF+ xMzRdA/oHMqdHU0fCtpIubOINkTTbaD1lFtHdCbRWqI10bSRoNXRtBLQKqKVRCuobDnllhEtJeOS aNoo0GKiRURnUJWFRKcTnRZNLQOdSrSAaD7RPKK50dRS0BzKNRM1Ec0maiRqIJpFNJPa1VNuBtF0 ojqiWqIaomlEU4nCRNVEVUSVRBVEU4gmE00imkg0gWg80biobyxoLNGYqG8caDRRedQ3HlQW9U0A lRKVEI2ispHULkRUTO1GEJ1CNJxqDiMaSs2HEBURDSYaRDSQOhtAVEi99CfqR9SXOisg6kPtehPl E+UR9SLKJepJlENdZxNlUZ89iIJEmdR1BlGA2vmJ0onSiFKJfETeqHcSKIUoOeqdDEoiSiSjh8hN xgSieCIXlTmJHGSMI7IT2ajMSmQhiqUyM5GJyBhNmQKKiaZUgAxEKhkVynEiphHvJOrQqvB2yv1E dIToMJX9SLl/Ev2D6Aei76PJ1aDvoslVoG8p93eib4i+prK/Ue4rokNEX1LZX4n+QsY/E31B9Cei z6nKHyn3GeU+pdwfiD4h+pjKPiL6kIwfEP2e6H2i96jK7yj3LtE70aRpoLejSVNBbxEdJOObRG8Q vU70GlV5legVMr5M9BLRi0QvUJXniZ4j47NEzxA9TXSA6Cmq+STlniDaT/Q4lT1G9CgZHyHaR/Qw 0V6iNqq5h3IPEe0m2kW0M5pYDIpGE6eDWokiRA8SPUB0P9F9RDuI7o0m4r7m91AvdxPdRWV3Et1B dDvRbUS3Et1CtJ3oZursJurlRqIbqOx6ouuIthFdSw2uodzVRFcRbaWyLdTLlURXUNnlRJcRXUq0 megSqrmJci1EFxNdRHQh0QVRTyPo/KhnNug8onOjnrmgc4jOjnrCoI1RDy5jflbUMwi0gWg9NV9H 7c4kWhv1NIPWUPPVRKuIVhKtIFpOtIy6XkrNlxAtjnqaQIuoszOo5kKi04lOIzqVaAG1m080j0Y2 l5rPIWqmmk1Es4kaiRqIZhHNpEnX08hmEE2nSddR17X0oBqiaTTcqfSgMPVSTVRFVElUEXWHQFOi bvGEyVG32N6Tou5zQROj7t6gCVRlPNG4qBtxAR9LuTFEo8lYHnVvAJVF3ReCSqPus0AlUfdG0Kho fDloJFGIqJhoRDQe73d+CuWGR121oGFEQ6MusTWGEBVFXaNBg6OuGtCgqKsONJDKBhAVRl35oP5U s1/UJSbWN+oSZ7OAqA81701PyCfKo856EeVSZz2JcoiyibKiLuGlHkRB6jOT+sygzgLUi58ondql EaUS+Yi8RClRZz0oOeqcCUqKOmeBEok8RG6iBKJ4auCiBk4yOojiiOxENqpppZoWMsYSmYlMREaq GUM1DWRUiRQiTsRCnY7ZfoEOR5O/3dHs/wn6CHAY+BG2f8L2D+AH4HvgO9i/Bf6Osm+Q/xr4G/AV cAj2L4G/ouwvyP8Z+AL4E/B53Dz/H+Pm+z8DPgX+AHwC28fgj4APgQ+Q/z34feA94HfAu/bT/O/Y +/nfBr9lP91/0J7tfxN4A/p1e57/NeBV4BWUvwzbS/aF/hehX4B+Hvo5+6n+Z+0L/M/Y5/ufts/z H0Dbp9Dfk8ATQKhzPz4fBx4DHrUt8T9iW+rfZ1vmf9i23L8XaAP2wP4QsBtlu1C2E7Yo0ApEgAet a/wPWNf677eu899nXe/fYd3gvxe4B7gbuAu4E7jD2tt/O/g24Fa0uQW83Xqa/2bom6BvBG6Avh59 XYe+tqGva2G7BrgauArYCmwBrkS7K9Df5ZZJ/sssk/2XWub5N1vu8F9iuct/vprlP08t8p/Li/zn hDeGz96xMXxWeH14w471Yet6bl3vWz9+/Znrd6x/f30o3mhZF14bPnPH2vCa8Krw6h2rwg8rF7C5 yvmh4eGVO1aEDSvcK5avUL9bwXes4KUreN8VXGErnCsCK1Tb8vDS8LIdS8Ns6ZSlG5dGlhqGRZZ+ vFRhS7mlrXP/zqW+9HJwaN1Su7N8SXhRePGOReEz5i4Mn4oBLiiaF56/Y154blFzeM6O5nBT0exw Y1FDeFZRfXjmjvrwjKK68PQddeHaoprwNNSfWlQdDu+oDlcVVYQrd1SEJxdNCk+CfWLR+PCEHePD 44rGhMfuGBMeXVQeLsPkWaozNZCqOsUAJqViJMzHR/X1hXwf+772GZgv4tvvU+MdXr9XyXWk8JLJ KXxRylkpl6WojuRXk5VQcm5+uSPp1aSPkv6WZEgIJeX2KWeJzsRAouoRc0ucWF2ucXEpcb+B2lwn Jgazyx0e7vD4PUqZ38OZ62PX1y7V87jzVaficHCHo9OhhByo7ojzxyniozNODcX1G1zusPvtivjo tKuJITssoscc25TqcofVb1XCxdbJViVkLS4pD1l79y1nKg9wzrgTpJpRdxf3+MvVR7n4o5oYxvnl rDpvfJuZVY6PmKdMj/CLIllV4jNUURcxXhRh4brpNa2cX1rbypWS6ohb/IOtlj9/82aWNmp8JK2q Jqpu3542qnZ8ZKPQoZCmO4VmqFKbN3PZimV5ectn4mPmsuV52i9yfIXI5Qmj+F22HHnxs0LLs7xf TFQNNGsZ0nJpXP7Lrf63J/7vHsB/fmpl4g8NRnYq57Fm5VzgHOBsYCNwFrABWA+sA84E1gJrgNXA KmAlsAJYDiwDlgCLgUXAGcBC4HTgNOBUYAEwH5gHzAXmAM1AEzAbaAQagFnATKAemAFMB+qAWqAG mAZMBcJANVAFVAIVwBRgMjAJmAhMAMYD44CxwBhgNFAOlAGlQAkwChgJhIBiYARwCjAcGAYMBYYA RcBgYBAwEBgAFAL9gX5AX6AA6AP0BvKBPKAXkAv0BHKAbCAL6AEEgUwgAwgAfiAdSANSAR/gBVKA ZCAJSAQ8gBtIAOIBF+AEHEAcYAdsgBWwALGAGTABRiAGMIzsxKcKKAAHGGvmsPEOoB34CTgCHAZ+ BP4J/AP4Afge+A74Fvg78A3wNfA34CvgEPAl8FfgL8CfgS+APwGfA38EPgM+Bf4AfAJ8DHwEfAh8 APweeB94D/gd8C7wDvA28BZwEHgTeAN4HXgNeBV4BXgZeAl4EXgBeB54DngWeAZ4GjgAPAU8CTwB 7AceBx4DHgUeAfYBDwN7gTZgD/AQsBvYBewEokArEAEeBB4A7gfuA3YA9wL3AHcDdwF3AncAtwO3 AbcCtwDbgZuBm4AbgRuA64HrgG3AtcA1wNXAVcBWYAtwJXAFcDlwGXApsBm4BNgEtAAXAxcBFwIX AOez5pEbOc4/x/nnOP8c55/j/HOcf47zz3H+Oc4/x/nnOP8c55/j/HOcf47zz3H+Oc4/x/nnSwHc ARx3AMcdwHEHcNwBHHcAxx3AcQdw3AEcdwDHHcBxB3DcARx3AMcdwHEHcNwBHHcAxx3AcQdw3AEc dwDHHcBxB3DcARx3AMcdwHEHcNwBHHcAxx3AcQdwnH+O889x/jnOPsfZ5zj7HGef4+xznH2Os89x 9jnOPsfZ/3ffw//hqfbfPYD/8JQ8ayZjppsY69hy3F+OT2GnsmVsI34uYJvZFvY4e5/NZudCbWPb 2Z3sHhZhT7Dn2Tv/zb9MP2nqWBOzkNnUPczIEhjrPNx5qONOoC0mrotlC3IJhsAxS6ez86sTbF91 bOl0drQZ45lFa2tX3oD1W97eeRjvV+Q7B4m8ciG0Q2vxjemmjgc77jrBBxWsjk1nM1g9a2CNmL/4 m/QF8Mxp7HS2kJ2h5c5A2Tx8zkVuFmrhLtH0sVqL2GJgKVvOVrCV+FkMvUzPibIlWn4FW4Wf1WwN W8vOZOvYev1zlWZZh5K1Wn41sIGdhZU5m52jKclkOZedx87Hql3ILmIX/2Lu4qOqhW1il2CdL2WX /Uu9+bjc5fi5gl2J/bCVXcWuZtdiX1zPbjjBeo1mv47dxG7GnhFlV8Fys6ZE6SPsGbabPcAeZA9p vmyC18gj0i9zNR8uhg/WYYbndhkx+W/VUW9twNzF3Fr0ma6G/ZwuLVbqfhQ1z0VN6oXWQfSy/gRP XI45kD42I8pdpc3/mLWrV37JKv1xQxfPXK/lhDrR+q/01exGnMBb8Cm8KtSt0KRu1nRX+01H627X 8rex29kdWIu7NCWZLHdC38Xuxtm+l+1g9+HnmO6qiB9g92srF2GtLMp2sl1YyYfYHtam2X+p7GT2 nbo9etSylz3M9mGHPMb246Z5Ej/S8ihsj+vWA5qN8k+yp5AXtSj3DHsWN9QL7EX2EnuVPY3cK9rn c8i9xt5gb7J3uB3qdfZnfLaz12I+Y3FsJL5wPww/38Bm4icGt9Iy9Q3cIiozsSFsIpvEpj/C7Hjd J7KhfPduT2mpubfpMbzKFRZAMGDGl/WSkMOg2Pd4vcXBPQONm1XX2Dbee1exaTPC3OL2D9tfKWj/ 8FD8kIJDvOCDTz78xPnNK64hBYWfHPykX1/uynBpcMcpJpPbGMzsowzMyR5UWNh/hDJwQHYwM07R bAMGDR6hFvZPV1S3tIxQRJ6rb/xUp05uNyobgsVTC2PSvQ633RijpCbH9x6e5ayanjW8T5pJNRnV GLOp5+BRmeNPL8t8z+RK8ySmxZvN8WmJnjSXqf39mLjDf4+JO1JiOP3IVtU4bEZxD/Vai1kxGI1t 6ckpvYZljJ3qSHAarAlOV6LZFO+y9Syd0X6BJ1X0kerxUF/tE+GWYOdhw4YYN8tk2ezGvaxH5xe7 bE4+Idimi+y2zq93WSGsUlggQl6hspzi06592rTPUE+eJYrzrXxij2B21nc2qy05My1osfNEg43Z nDblweDjwVeDatAWtMWnVcaHY8KsuLg4fsiQgoL6elfSEBekq9B5qL+rEB7Pq6dXIcvLy0pMNGou z1Ez1Dg1mJmdPWgwJz8nmYJqhmGFmTuz/P6shFjDovbPT1UtCcHUtCwHN/OowZ6Skx7o5Y0znMk/ 4k+ekuiLM6gmWywf1vF8rD3WEBPnSzRErXFmVTU7rJvbzxT/tdd9jBk4dlc6y2NF7LmQ15/s5BP9 Tof4sOMj2YaPAOYq/p041NPrCaHcE0K5x2PNF5XzReV8UTlfVM4XlfMfxndC1rl/NzTLLoSnd6Im +OudDp3tGv+w06bxFzutghVnyL7dut+qWL053/XrZ+qh/S/TFQPauLXVVM2KDxVr+3YIL6j/RHNa /4N5JGDOyxtCGk51xxmCGZnZA10DBhVmwHsesZ/TVT6gjxIMusRmTjgmDdxfNLlpydiOB5Jyc5N4 9vKtTf0T80b2GjijrGdHu7eoblz0QEnloJRJWaNPq3jl8LCakmy+7JR5lSN6efw5hnNy/PnVayf2 qR5dFG8ZWHmGwgsmDEztqA8Om9z+wdCa4f6OotTBlYyzxs6vDbaYdJzi2TtT2bA83St5ulfAXwqv gL8SXsnTvZL3GL5jx7FkXsAyWDbPjyZUGfbxXmwg68v7tMZOxZE+eEiAF9D0nW8f6Nc3yx1n7HIs jR79mIoD7HGnK2LeYlsZbEqM2R2adebYDS9eNrHq6tfPKjq1rtxnjlENZqs5rv/kJZOnbm4ePLDp 8ukTl1UMcJgsRnWPMzk+zp2b46u+/Zsbb/npwRmeQC9fXII33p2aEJtTkFN2wRPrznz0rJHZBdlG VzpOoNhll2GXxTM/WxVKK87gCWLnJIidk+DGnBPiMeGEZMw2YZ/YOcxLvvHqvvHqO8ar7xiv7hvv Pnzvj4VvbNG4Cl8bz26NoV0ifXFQ7oh6caMdtyVMXTbAZVPv+PrOjq+05c+6+4sbK3YPWHTvBQ+2 rrt36RDluruP3FFJCz3tti+2Ldh93rifXCM2PiH+O1TMTF2HmeWzla3eHH1Fc/RR5+ijztFHnaOP OqdNcYViYxMCCQEM3tvGzSH7xmy+P5u/ls2zs40p4h9p7BU5oFbj0V1fv2QpplWgXSNOffdr66z8 bKcHM1wnSHWdwWI3t28RM1Tmmu3mmBh8dBh51IyrwRALPUnhZrvFMDreF2+m2Zrjfe54n8vccWqs MzUh3us0dfQzu3zavDsPq9WYdw6b0WpK0OedoM87QZ93gj7vBH3eCZj3bnsaS08zYWo7ExJSjG28 587MihRxQepvpIIDriFHZ8d/Nhn5tpHTVasxMVMHvGfC4DUdMrsD3uRMtxlTLdesBxJSMYsxJqfP k+Bzxbb/0WQ3xcTgw/CAmGWamNH0zq8Mq2MCrJjdGkpLTXUkix2aLHZosrjbki02oTCLZLF6dvZ4 Dg/khHIactQchz5/hz5/h36SHfpJdujzd4i/EC8YwAckt3HLrszMIQUj9nEL3vEWnhsdUuVu4/mt BVPFeuM0u8gd+j13sL7+wNGLTvfLcad50GCX2AXitGvecokb8Nj5NxhWG8w2k61o5rl1p927srhs 7T1zhp85sOOgy2WIxTviemtivCV+6IzZzf2u/vK2qfX3HLp83DlzyrwWw8yEtARzdp/sSS2PLVq3 /7zStDS+JrMH3Gg2O1PjOxK82WmZybb6+77eet3hSKM3mOvNpP1hmIJ3bgFr21Xcjwdtuotsuots +hax6VvEprvIJpybmtTDKrxvFd63Cu9bhfet4n6windEEgt58GIJJYgPp4tPYCGUsyTxzycoEPwQ ypJ6VeIFkh9y7Lfx12zcdvzbGAfqUDHHW+OgcKu+5Y4drPqso1ut666jW9MDm5SGKWZ3RrI34Da3 74RKETvP7M5MTslwm5WJ2l6E8sL72HI2szKi/UmpDe9J1X5YMUqtny9eA/952JQ9xUmTkx5MUpnu Qqa7kOkuZLoLme5C9jDuREvn/j3whMVZqU0X0zx6EWb9bDK8Ro471pORlNJ1tMdGKE/9PzGqQjY7 5OonDkNfsSYFQmVY9PFZ9PFZ9PFZ9PFZ9PFZxBLbPDmVGRanr9J5LDoqlpc2vI9PGmd2dg4/ifv1 oMjjNpo4T0xU/2lyZ/qC+Ymmjh4nrgF/wehMyvB6Awkme3xHFX/FZUoVF6DRaVEubF9z9Co4thZP KMWxNpMhBga7N6m9s/06b4J+14/H7L1szF7mocl69Ml69Ml69Ml69Ml6xH/rwGIdlZ42nqdf5rzg ZbkYXW7voxtLXGrjcSPHth9Iyj06iddECDfe7UuIxd38gBzqkVtiXan6yhjzcB8PZ/eFnA0jFo9Q 7H37JhUUWPokJ3vbfuXLVCxMeo9+NptFnD6LOH0Wcfos4vRZxEpbxN5CXBdKERutx6AKa3KSvSC5 Xx+jv2eFPywPV3E8gtxCTFRGZ4h0nUeVa8gpBYWFIvbtsheDXMS7iHx58Lg7Xgt9eaFYb80/xjyz 25+SlJFgVjoKVasnze1Jd1uVjtEcJy0lGYuc75sf6NsjOZaviuEXWL3+7JSFDl+C7diWnndkq8li Ug0IZfDlYttR+529eti8PX0/TVPvTO+VYo1NSPPoN9mGGBc7hZ2/M8fhcOvO1Nihs13jr4Uz3boz 3Zoz0y19+vQXzuyf7BAfqNjfaRMKVfqLKk6WXlRp6ePIMaSI96DYIZr7hPN+5ruCQn3LkKdwNoKJ iZ6T+CtdTSrM7rKrDBvsHq99sDcnGPR0zA+MTFUUxZzgT072x5vzvZVpOf40Fx+aNqh/v2SOMCDB n5IYiDePduPblDWtf47y8ZD1w8ZcPe6nb4+elnt7ZlqScv3tzw1oaqgvmLxjsvIYvmsgkrCZxP9/ R1PnIcMXMRksARHCupDXLXzgFhvKLcI9twj33MnkpsJQbID1ZRvxbSRdd266vlPT9Rdpuv4iTded m74PIbGFpeC16agKipMVM/X4sK++yzeB476ealFflxjY8MW4LR9uvfKtTaXjtn649bKDm8t250y/ dvHia2flZtdds3TJdTN7Klff+FPrrGl3/rB92+EHZ02949t7znh006TqS/bNW7p/08Tqyx4RES5u xmdx/lJZLlvd2sOoT8SoT8SoHzmjfuSM+kSMYgskudKEe9KEe9KcNjufkCa+Q6WJP9plrizECjuN Rhumad3pqbB1CZVogziPj5aCJ4ZIhi6BrvpsaNX9q7fEJmSkiFull5d7ek1csHBC7u5h0+rzb75+ 0rzyHuqWxhvOGN7R5+i5wFKbkopnrJk2+dQBce0/9hzdxGjGBitmPIiVsitC6c4+rsFmjHqwmMVg bRaDxawGi1UejFXekyu+OeYWu4QroFy6a1y6a1y6a/6LvS8Pj6u48q26t/dudd/uVu9S920tvai1 S5asxVLLlrXLlm28Chla6rYtrI1eZAw4EJsw8diZiDySPBy+N0leXpbJCwlgYxuySC+ONSQ24wwB EgiECSGAEycPJmEZsO47Vfd2q23Lid98+W+kwr9bXV236pxTp06dU3Wba5REYyQP8+aVc+AdPzEV xuGwbRVI4IR3g00yMtQnJqHgNZFggzRLaCBdzl4jEqvNzUoBoc1steJan9/nS4cCWkVukdvpzdXK 9lnKWm5qSqSFBaGBuarN2ZtY5y9cfXMDX1sWyE3qVQuX2wccrTUPfL19ZLUHjIwK5gBM8arara2F l3+RESI4mnI2Z+WWyTVtu9c35upDzeuqFl4rymc/0TdqUyoW+rxNA2BtOoVL7AjMm270xmnUJrx5 3MDhvjZJRG2S6NokW9MmiartFFMaDlWHzbm4rzpsxP1F1UXVOped3OsiBtzFcQTgFhcZDteTTBWx 4o+7qNcw+7hDuuaK1ycMxKXSlT+F/agenFNfWGvk63F9WKvDfUbyJImG5OqN9UZrM3jyJ9pc8uAm 6ykclOYhDMElI4lTQqEh7hJHVHXRxzKJX1w1QWXpCSpuNJUrrhO4KtiRNfu+NNQ2ubXJpgWXVqWv Gbi9Z+XQmqLqjaMTezbWNI0+cFNoa3+zWSFjWIVWqa1oH2qsG6h1Vm+6beK2TTV47+A/QHjPF9iL PdZ8k7IgUOiuH6ipX9dUVdNy0+3rN9yzpczg8Ji1RrvZBPFsXmF+fuXq4rp1zdU1qzbdDmNkgLn+ Amh+AYqdtIdJbGAkUjtOfLEbnvhkITUKsyeI5itMJAzKl+Z2NThrb1Ph/CjEnQllgqBFdzRtzqir 8AIN3h5Mez2Qk4I79j4a2tHY58P/kVHEYZUxz2wWt8eI5/BPYKn3g1cTQg+F828twzyZtTyZxTxR HZ6s/TzRGvJrzbAx2/MGTUNWiWGrxLBVYtgqMWyVGLY+yXDEKyX+OXmkK6yGJjS+jdxG16LeUHdc suChRRUZwtc6gJL5zlri9q+991Rq73c+1i6Gf2ZV6aZUd29qQ4iKxmtW41emT9+7umX/E/vYwrQ4 Pnpnx/3by0q3HdzK2rI93QKwbntAKkVoIpxfRAxboAg7ydXnxAEb9uXgUgcutWPHKWmS0gwxe/Z0 CcmETaTIYXfYfcWejXa5SfTHTQ2tRhMWJwLhEA0N4aGhodBQqJi6QTKyuNfVZTk/1VarQsmclOkd /nyr127UKdmF7SpsChTkeU1qGU5gPMqqwHR5inJYlZts82HwYLUq2WN0IxBC+w9/IGsl5WQjkPC4 CnzGV4HHZrT7cV8zrj4lvB9eQyZ2MaigimQCFbiYoyXFuMBOMsECbOdJpqwKl1XisiJcVojrN5Zs LKzUstnhFXgwrTBy8Ec2OKVUnPHx2HTuajavZFh+SMblBd2eUJ5etvA28x+s3hnkvaV5BnbhnxTY 6OM9RWYlgwsxzmXVucXuPG+umsVBBuezCnNhvruQw3Kf3kj8EqOe/elHFem87Js2J5GKXvvhGVmj 1gBWW2XQfnhW1qSBvFzvtJE17mawxq3sjyHeCaPvhHnDas/qitWsVm2r1YFq15L5UUumRi1Hxrv2 FH4vrEd+vwFhHSIzCDVKlrpR8hIbpdnQmNaRxlOMKpxrtP0I1XK1TNNsLUa1uLa2vK3kFHaFDRcK cEGBLP9iec+qX+r6ZagivRdEtweGbt85lHZ5zoR2DjVI+0LVsADuBN+a7CWDF7hCsbgTWLNC8n+k EhmdO0rRuFrJNgLbyuW5nB590wMbOhMbylqSXx+921q1rmFVpLtKpwIXT+lavWVXbeSTN/m+8qn2 6GrP9oG2yVV2nQ58FN2O1o7ijl1tfVM9xR21Aytc+YX5Ks5hcOQ7C/PNpZs/dtMZW1lrsGPT6naQ 7kMg3efkt6MS4lufgMmv8dZJVqNOsiJ1krzIZyqvulP4/bDLEiIOZIgnu6VE/iFis0Ic3URlNGE1 smjqVnhl8spTWP6Er8fVwfU1QPZReT+1MiBCW0PGv16UWcbO+C3XGhxROdPuo9JotVKH6rmakZmh UHdHh19lclnAYVYozbzdAd5zoLerKzB8ZGvgEUvtljDfEl7rb797Tcu2egd+I/XUfR1GX2NwAmyO TAY2R76Seg4Al18Prizk1h36TmrtwegqU8nq6oWHNm1tHrkLZuwOkBjPPo1WoMOP5tEVW9wPeFXa B3jzOAnLltiG/MOV24/CRXFbktGGcyr0WO94wxPW5HR5ik5h5ri5h/1dFVnP1DldVaWnsOJRdT/Z Yw5dopDZkjqT2YC8aqNZIS7XiuxtZpZn5EpHc++2isjnYivabn9oe2hD+wq7WsGYcgz+5s2N++7x hoeaG7a0hnQkOPuy0WHMcRTnm8J3PZ76xA/ubOKcBXa92W7ye7wB78lHth7aFioKFarM+WSe3gpy eVg+jnyoAR0Je1qbsNbVQGZnA1m9Goj300C0o4EoS8NT+AOEUIUotQpJWBWSsCqkGVshCauCKJTG 7O3QNvhdMn0JeRze3gNTXfa4vl/eRxZsqk6tV+04U33KhLfZUxDcz4xWsT5fdjBSzz6sNOblkkOs zocGR45uDVQPP3DL+kNhZa6H6JT6q2sOtLeCBoFGtXlXhTv8jrQC7evf0n/o0eHkU/d1rl3DaNNx 2uW1oDvDd4fbD8ZAl9ZUEWkNgbQeAqsWQrXokXBJRV1r3WQdayazycyT7Vuzt5T4iqVEWuLBDrVv oAsfnGgPfSXEkCOLE2S21cok5ZNJOkY/a+lVNHAyIj+vt3T+XtmMjJmV4QsyLJPlVfzS12O/eKt+ Ss/o1RfzqIINZe9zi5Py5ZCobPR0h05QRaE3S60sVyofY/HXUYEq2Yf8jsuPuTumNoSj3RU6pVbB MqxSW7fl9vDk1+KNzbd/ceS2z95a9lV2/75VN7cUQDjs9/besaXc4rQo9Q5Tjtmg0zrs5pY7T92Z PP3xte2JL2wzH3ywvC9WT1bOYuE/mPvld8DKGX3MypEJSCeeS7JarrS1cknmzCUpk4v88K+ypPiU cCFsIvuWxZpLdZ1O36XKLr6P66JRTTWJYkNnat4W51jNmat2ey3Svld2VFMo7fzWpHd7mfth7Vco Le6gq7iW1z+t0qrlJsPTKjBNdt6suofjiKm5p7BrvKdwdZEOfAKD2aaXq7Vqe82GxmGl0Wku4j/6 HXEfyDEQa+GLzE6jcmjn320J5hh0Zhc5O1yx8N/Yw+w/oxa0Dt2CLoQtprJOMss6VcByJ8+ZcV9n TSt4FUQErdL8guurT5CvWpXrIRvOMZhw33qXzFDJ1iiVRHs4Kq/ZcA5kymqULpeypkxGZByuJULe RrrYxnNw27aS4rAWrsWGSiW7sudF3aY3LZZbV7JvNXeV8Kt/sbJn8Bf8eun4pFXcUH9eNP2hmvNE uDZwwIgLZoRC7nwI/gulgUgdZGy1ikuBz68Ae2a1SZFjWufqYXmtraMozmwILnGtL7OckmNGn9+v Z6VP7GGz4eOFedVD966rH3GZbG11v1sztbG8du9Xbx9/aLiU81bxVRXVxZ6i2ps/3hfs9GDOaFxY iA1VdlbYYoNVXRW2TbdseIsP2tX3TffGWlxsstBTtLVi3R2bSvOtpnJ3YTmjYbyrtje1TG2uKg5v r/W2rKxxOPpKV93qKx5a3X/nTWVqlXfh7Zt38yu7A9t3eeq7Lu9sbGVUjrJgwNK2Jr+yhej3QxDh fBFW5mq0/3hrLS5ZPMCRFDvrZEc66YFl2eYWt+nphj3dq6dmQ0u+04g79O4SBwT0ipNlPUUdjj5q PmkgjyukDWpxMW64cpuaribKJXaBRdfRwn5RZRLXXHt5d2XL3e3wkW4FppfizpnuHXf1eR1pfWYM /Tvbi7ZtvnwkXZK9/vZ2r9p1OEIs5SeE/8Ab5BXIgrzo6MnWwvWFk4WsVfLlrohwzPT66lWRkBj5 PMXcjvKQ5XobxJJILSCmJzQecrJOfgJ33MF1U/k8fykkWUNpZVl6D99Mll2ijKCFuOVqAZhLmxpD 5F9GBOx9SpFhJa5sLAk2wL/0yN8NI1+LPhvWtdbhYBWuCptwPzgEFyiZVZLBryJOhI5eqcGveorx Q0Ssk7i5/vkOKIPTWlaGCKOiUlgLtPJAd16HMa0QpgZQCHAvwJ+lVrD61TTfGcZv6FDgbpW5wOkq tBsUC/ddLRF8k8rkKLA7CizqHMPCk3giR0s3b1hljhq/s5BzrWJ89K94WpOjZmEZUevs3MKTC8VG iyQz3AIys6AwPauZpGc1S5/NpEcbkf9FkIbroBxL47v02cw1Y+m4ljSJCvkFWNUH0MWwy0ROZOh5 uo/Gb34avE1txB3XnsmKe0pZZ7cXMzPa7baS3Vd3tXgCQM8C6DEAndgaWM1ODpBdgIGWa4+4xWav OQp/Cr8PZoXDisd6e8DdVIRz2npaOspWdpf1ObLGP3szt0Ha2TM2pE+xiH2gP/z5S0bielbDIgWc krLIL4jGw6zKLW0vb0isJYukzWtWWkvXlDckM7ZEYcqzWfM5Zd+nu1dub6/kyjb0dhZtne72LFqV woarrMq1Jex9sBSzrFqr2rd5vbOiLVDVXmIGc9OXtrowgtXowbBBHEECkgG+epSuc8JOwiO3luPS dpgeoWadnuL3T0qmmBjisKasp8RR1J0WPVknM7Y4vbMsSfsGDLLlrxnkjBA/3/9XDPIVggIB3Urs MYl/XgEJkVOFr4fzWoM4YMJBI9mN8emwT4V9SlxC4/8lThJeXfIkgbin7goN1mQdUfBXHlE8yWjI bulJA+qfgmFykF+9GnoKIVaSAkoSE0kiq8gcPAyl//7aCQT7SmPiW/HJ/zVR15D43wm41j/iarlt ffdou9fVetv6rtvaefz6xOn7e1d/7Hgcrj1wvbv74HBD7S0H+3sORhpqdx4k0fTCg+xzIBsSTd9L omlv3RInsKL1WTyKJcu2RQykaUhN94zFmHrJSLqbW3/dSHqpQHoJHbl+IP2ZnYH2tnBRlrLkWlwm ZbCvf0PZ8N+TQLqGBtId/vY717Rsr3fit6a/e6iTK6gtXGhJ20LZW6AzLAvas7+kJWjpu+/bqbUf jzabg2uqFo5t2tYcvZtGjCCthyVp3R92gbg82hCZMCGNLr2pQI1ciESLJahGVJusJ9guSk+wpZ9s Sz/BBtGipbhbuyrkkXHlJFp09qwk0SLXL19/vWjxCpmtMIp7Y2l9sa24frSoJtPMk6sM9nR1+4mI qkceuCXQsbazhDwEmZtnVF4TMS4cT0sKnw82FBrSUaOxuCk4nhbdwp/FsFHcgoCwkVon5mt0L2zk +NQK7DNISrX4cIukXAZJ6wxEuUxZW8VEy5ATdK44rA71+AwWvtvShyRzTxf8UMb7yw55ljI0VIkU zNcYhVqlsuUXWRyVKxoLrzYzxW2NDfk53qJ8nYzF7LDVbVSr1arc8r76y9+51tAcqmv3G1iVRqPW 02ecNgiXmGeA4270TFhX0dvau773nt5v98qzjmPelY5hqFK0kQ0Z81XHNPR4Bv8y7BHPZOhpDFEx 6UiGBIXE5riexO/Sg3UNcYt0YeoqwUcftNeq+7aO0ZW/XK/5nXHAeKtxysiKRy8vkXOXHuub4mTM HLpIRy5DZBM968hl0Xv8/z1yYZ6p2XlwXeXWtZVWjYwcqYRat6wsaa92+cMDmzeE/cGNd20s6moM WpQseEcahbqgrruiJBy0BMIbN28K+7F+7RiMt82RW+QxOzmli3eZCuuKfbUBT0GoZUvzikh3qc5k 4XQGK2d0cEqrw2ourMzzrwjwBSXNN5Gx8Ap/ZMZl30KN6ObjQWQsLJNkXiaNRZk0FmXShCyTtLKM KKHOllN2qbArP+eSrasK5uKjStFsnydqVyPt15w/I25myZYOqa8MvK3pDQhmXMXxwXJbRzSc/zGD iZy7HEg7am+Q3VKT4Y36TltRXq5KrpbLBvMLOL1aUdybWMfoxZj6+fSx+fNi1L2gGbpFrVHL9XbC 94NkZ4v9LvgEnwl7wBPQ+okG+YkG+clphJ8aKT9HXS78wRPiTPNIUvFIUoHr+3Rukszj9GFeabJ6 JB2FkOODsNpc1u3Xyh3d4JjJF7e3sh/NyajUkttbVx3P1NUvbnQ9rDTlW2z5RkX/5+jSr8wVtyJs FV2VLXetVeZ6YOaa1BmPYN/mdc27Dw8zBenZeflP629ZU7xtM5NKl0jnNOxdIJ9S9NppVCjAakYc XQ89vSj2YLeYcWOrxKdFuuYuur/0asqcOgv/N1xPjqzBqzBiP4cDclwQgIJVBbioAHtJttWLi7yY p6U8LuKx34CnvdhLtnXURkuXl4dZ6yWnP2pQRS/ZUyOfyEh4Sfs68rhUoNurdXZrRQNID75C5Bnw Ieo5hMT/yJmQ9HQ4OT8J0afyMw/KZC0RZlu9WXoc/y7MsMzCeVmOM+B2Bxx62cIzMjl5pMOWX2hW yxZk7IeMxux12dxGJfuPMrVGp/zoG+RYSKbSa9itOpOahaCQAVBfdup0zG/VOhXLqLRE2isgxrgP pL0WvXIadYJ5WgWsrSTbPcGVuJ5ci8uxz4t9PPZ5sM+NffnYn4cDMhxkcWMTbmrETWW4mbxjwoL7 OSlgJtewBtSV46EFziAVk2tYRxYSUmxo66b1iDBbufXcJHcPJ+PCJmsXV9Nd3N04U4pLyXelxGpy ZmvX7tJ9pcxaKLX1qYmQnyOSHDrT2noeJCnKe/HwTTx+E/9EQSsycmb9yqzTqiVEnpWV3yeTL7zH 5tgCbk+JQ8d+j2G+zeY4g26PHz4tfCCXQXRhyyswqdhfMMw8ozaB2ntMKuYFBj/PqM1epz2fDIsy 17A4KMyn1OrLicUhMuQq1VoYIYhULzvVahihHDC85ME1e/oTo9KQ8QrC7OiF8apA959GVSAYI9nR JnajnFiMpnJsB318gpxg2bFNsg3WdJEVq4m2lpC4ldzTjPDKQlynxVqehBdkVLTaqspgd6HWmN9t zIQQ4tlmReZckyivqL+hYmtu+gcOi79vWDwDNJvTB3+YXaMy+z3uQotW9vMXZFpLQV5+sRGrsX3h PRU2+/n8wlyN7PwFmcboceUXmxj1wgelerNODtG5EscWvgAXVq4z6/FJ/DW9OUfGKjTKhUfxegV5 8kuba1jYSawHeIF3g3yK0MbTyAW8riAz34WDLmynwbMd+/R1esavxk6yJDc6sWMlEZwDe7odGnO3 ple2HvVKQSs57wyJk5ZMXi8rslpvJs8w+moz55xmulVozVUyNXcoqqqdvJFR3K3m2IUfqLgit7sg Vy3HmH1fYSzg84qMioUTnFGuy9XjBplJw95ssevlrMqQc7mced6slcM6YQJOtoNT+wJ7EoVQ02nE ASdWcu7so8/hVMD3tep2NaMuNkLQ8rijy+CnwQsQTrabq8FXOD9EnrnMPI5I9zbxFQ8U0wdmMMky LyhUetXl5y0uoo/4Uwv3cGbyvCIj0xp1SlK2kMJfVeWoFR1ml1GZ5y3QW60OjrnNW2yCzwq91cjr 7TYnd/lzSg48LQZrhHfxL+U7kQUFkf6EvNjVz3WAUF9+Juv5LdaX2em66gdH31OSH/zkmZRGrLIU 5rkKLSq92hHweIIwH+xBjyfgUONU2utln9SZdHKFzqj7sMEbcmm1rpDXW+bQah1ldMfvXXYrUFKL upAvrC8q8qhzH5fLK9XtjWSNxI9WdhDX4WXyiym6oyxSmPmpFKVS8qeuOWe9OhJkt1bv+Fi/stBv cZtUCqw25ZmsbTc3OPlwZHXj1nBQo4TFUJHbsCFSu/dYtHLhDHDj5oEb4I53A3fsr7Z98tY6+dsG A5n+GNZXszLYfnN1wy1rfQ63XWHMt9odZo/TtGrP0Y+aruYWo5KFV3ACvYpcSPOY1paHuJ+dFx+d UipFi1dvzkg5odDbjIflOWaH2WjTYNkntPYip6PIpv20p7a8zPGMUqOiRgib73XxnELB8cQClbAp nJDfAT2ooYdO1Ho+LbAb70Du89RUlNmfUeqomVNj8z1O3qRQmGgPeOENViP/PuiO6lFOjipgRGxS 29J+oPLrspzcfIvDa5IpmCFZjtltAfdMJn87x6CSKXPMOYq7cgxqaDk3B9pbi48z5cwqZED640ip vSRD5FE76TzAK26x0llQbjIu7DTBH/4y6Locf+B3e3w+t8LoBD06wu5ijslTaY12+To5YL71fHW2 Rqc3BK4qsVqYQwrOZjLZDQqbJtdrs3tz1Xjh764oq/Sx92cCuX9J5xaqrizjOPpL4i+JCVdcN73O DGelfxETrB3XpuOywUz6kCR5x3XTj+Q/Upiz0qxyMCs9u3RS9dH0npjUTy8mTaWUnloqacu0319O 10u68eulHEXOZ65N+qCUfnxtMvT/bRPXuET6PknG+r+YfkqSKTcr/dl8f3bKvd7fN3O/aWm3fE9M 1kNLJOE/k2yfXirZOxzuTHrEac6k+HJaTv9F00mSXOVXpVuy0sxfTaey0kt/q5TnXU7LaTktp+W0 nJbTclpOy2k5LafltJyW03JaTstpOS2n5bSc/msmRE7ekbYLYfwrBUIqeSOSIZPwNqCfYq/wFmBU uBVwj/AqYEL4GmBS+A6S4WPCOcBZ4UXAeeEFJGP7he8CbkYGwEHhMcA4tGNEMuH3gFHhAmBCeAMw KbyJjDhAyqEdgrMUz5L60Brk2c3Cb5AJKPkDYC/FKNIgE5S/BziItiM7tPxrwCjQaYeW3wRMCu8g O9R5GnAQsSgP6lwENMG3edAawV7gJQ/thF7yMCO8AshBX3nYCa3lYbfwEmBAmAU8QPNHaPkxci/Q eQFwjt41T/LA4+vIB718CtAEdPoozT5Ksw96eQ35oJenAUkvPujl94BuaNMH7ZOSI7RkRngZ+YDy WkBCuY8dE36A/MDdu4AJikng3Q80vAY4B3z5QWLvAM5Da83Q+2OAfhidZuj9HwF3Ag3NMHavASaB 5mbKbzNQ8nNAp/ArQMJvM/D7BmAKJNOMpykeoOWHaf4IrXmU5mdImyCNFwFP0JJZ4QuAc8KXAOeF b6JmkMkrqAXouQjoF34K2Cs8CxgVbgPcI/wMMCGMAyaFv0ct0PtbgKTNFmjtMcA54RTgvPAoagGN MgIOQv1ekPNbgFGQZy/VpV5o4SLqBTn8CfAcSKkXZHgBcBDp0FaoPwoYBbltpTLcChL4GSAnPAfo BDq3ggReAAyQ+sA1yR+h5TPA3VZ8jJbPE4SWGcBBVAk4JjwIGBd+iHbQcd8BnF4C7IXR3AGSfx0w SvMJGOUdQCfUgb5+CXhAeB5wVvgt4BzIdgdw+iu0E6h9GzAKY7oT7iKYJCVQ8y3AOeGPgPPA9U6Q BnwLvb8Hs0IGMzQKNDwP6Bd+BNgrnAXcCfxGIeWhKHBN3knBCeTNEk6BvNPCLZC3SgwI5H0WKYG8 NWOa4gFafpjmj9CaR2l+RiBvvDhB87MCeefHnEDeCHJWIO8BmRfIG0DOCXEUBSmVAxIpRUFKnwWM Q+97gM5n0R46rxOQ/yIgkVsCaH4DsBcklgCa/wSYQGqUAJr/AZATHgJ0Ct8AdAvHAAeEhwFTwjOA 0xQPACUJoJnkj9CaR2l+BmhLAM0kPw/zKwEUPoISQAOMClC4AnBM+BxgHHQ4CVT9T0Cit0mgimAv RSLJJNBzGpAD/UwCPacA3cIJwAHhx4Ap4QzgNEVCTxLoIfkjtOZRmp8RTgKeoPlZ0LEkUPUTlAR6 AoCDSA8YF76OGZgRfwI8JlwChJqAc8I7gGdpybzwIjZAnT8CzgjvAh4T3gOcpfk5imeFFwDnaf6c 8BvMAf1/BDwA6IZ7/wB4TPgzILnLTe9yw13/Bjgv/DvgOeH3OAB3/RyQE54FdAo/AXQL5wED9NsB 4QzgAeE5wCP02xnhdcBZlAM4hxSA80gDSFsDTg8CDqJxwLjwNB6A9l8E5IDfAWj/EqAbKBzAA8gM eAC4HoCWSfkxoG0ArIENcBBtAhxD3XgHldUOKqsdVFY7qKx2UFntoLIagvpWPAZ9vQzICRcAncI/ A7qF7wMeEJ4CPEJLZuCuMWjtXcATwm/xGND5OE7RXlK0lxTtJUV7SdFeUrSXaVpnmtaZpnWmaZ1p Wmea1jkA5e8BzgnvA54F2R6A8j8DngO5HQD5vIQP05E9TEf2MB3Zw3SMDtMxOkxH9jAd2cN0ZI+A rDT4KHD3PCAn/BrQCeVHgbvXAQdo/oDwK8AjNA9rDeAsSPgojJEWkIzRUeh9AHAQDQLGYWRngJJL gMeEtwBnQf4zlIYZoOEi4DxQOwM0/AEfg97fAOQoOqH+Mej9IuABGPdj0C8pOSa8ho9B+52AcWEO z8JdvwYkd82SlRHQTTEAVM1SymehhUuAR2j5DEhjFmyyBnAW6QDnKM5TPAfjNQtcRAAHycoEvfwU z0EvbwFy0MIc9PIHQDfFAOjnHPRC8qSXOeiF5GcoHgPPZo72Mge9qADnaf4cjM4cldUc7WUOenkO n4VeXgLkhH8FdAo/A3QLPwY8AHp+FlomJTOgIWehZQXgCaDnLLRQAxgX/g+ehxb+DZADLuahhTcB 3SCZeaBTAzhAyw/Q8iMUia7OU2nMUzrnKZ3zdDTnKZ3zQOcE4CBZTaGXZ/E54gMAcjTvBGrPQS8E AzCy56CXPwIeoN8eoeUzMI7ngFry7SxI5hzxPQDnSR5azmP7AQthZsqI3wbr112ACSEFmBRuYzfD uD/HboY1i9g42cL7gCbhu4B+4XHAXopRZGAHgba9gJwwBugUJgHdFAcEsNd4CKkAU8KzgNMUD9Ca h2n+CK15lOZnhEOAJ2h+VngdcI7iWeGngPNAzyDI5w12EOTTCHZEJpxmiX14iSX2gaCb4oDwMkvs A8EZ4RdsnFhOwFmKZ4UXAYm/ilAZU4DI/1GD/EUpstTD1tNPJM8gPSuT8iwqYk1SXpZVRw5+a52U V2SVK9E0u07Kq1AJfCPm1Yhnz0h5DfPFTH0t2sL+RsrrUImsUcrnMP9dlq6jR2OKj0gMQP+qlXuk PEZK5TEpzyCl6qKUZ5FJ9baUl2XVkSOdmpXyiqxyJWpSG6S8ClmUk1JejTh1j5TX4IFMfS0KqXdI eR2yqD8h5XNwnzpdR4/qNL8FSrBMLclZzItyFvOinMW8KGcxL8uqI8pZzCuyykU5i3lRzmJelLOY F+Us5kU5i3lRzmJelLOYF+X8DcSjavCJqsDr4FE/fVNNHE2CrzOJdoGPwaM19A0/4nt+IlAyCrkJ VA7ftKExSDzaCGW7wZNKwl3kUwyuMag9DRiFmmvgvjGoMwxlo1BjlNaLwL9xaCtK607ApwSUTdDv xPtHgQIe/kWg3ii0sB8+7YNcEvri6XuFhiE/BnV5SnMK7o7S9xbtpq1MSq0moca41CepwQOPk7TP GH0/EeGlm/K6C0oi9L05ccoFT68RyiXpV+RjBL4ppS2P05Ix2mIEZCSWp3sZh3bGqMSmJConoGSc 9iq2SfhMZlFAepyivKTfqyRKW6Sd9DQJEuDpG4V2UymM0ncIkXczJeknwnEyMx6izMReeEr7hMTX JJXtMK25SHE2R0Rqd9D7RK73wudyqg/Zo+mnrY3TFvZTOaSkkc+WNxkxkf8YpZ/wL45LnGoDuYo9 krHmoY2pDDcijbulOgn4dKfUehK4EEdoOjNKEaojESgdv4KvtDaPACUR2v+I1H851djddKzIN9fO gcZruN4iac6opGMroJV6VPsXND1J+4xSTSS97M2MQVo2S8293ZJeT2VqE80VR3wC6seo7vRBjREU oDINQp0oba+T3jtJ209CmgI+KiDto6mczqkr+yuXWq+A/H6qgbsp1VPQwn4oJRLbRTkmmnplq+ny XfRtYnGqL+n2tlMeRC3ZT0c3QSlMUj1O0Hkn3s1THsgciNERHKV9xOgYDtN709JaizYD323SvfGs b8T5E6UyWZwT+6S3cO25Tr/iZ1J3BEYwRWUYzehYlH4/RTVkf5ZeTVFOJyTNEtuKUSQz5Wq+yffi jAzAXWSkiDYMZ3paiqqJa1q+cRkttp62irxk15KU7pEr7Mu1vKetydV0NWVJgHAi8iJa2fQ6Ec9Y 7Ci1WRPUdkWuy6ko58gVMhVn/KSEIldiPkU1L0XvjNL5T7iJZdohNcforPlLI/S3mheLc6KCUkPm gGj5y+lYTaE7vsFXV1at4PtHR+KTicldSX7NZHxqMh5Jjk5OlPNtY2P8xtHde5IJfmMsEYtPx6Ll ayJjo8PxUX40wUf48cloLD7BJyITCR6+H93F74qMj47t5/eNJvfwidRwcizGxydTE9HRid0JfhKq JmPjcOdElB+ZjE/E4olyvjvJ74pFkql4LMHHY5ExfjQJfYwkSvnEeAQoGIlMQZ7cMp4aS45OQZMT qfFYHGomYknaQIKfik8C3YRsaH1sbHIfvwcI50fHpyIjSX50gk8SPoAyuIUfG52AviZ38cOju2nD YkfJ2B1JuHl0b6ycl9j0J/jxyMR+fiQFzIt0J/dA/7F9fDwCvMRHgW24MTLOp6ZIN9DibihJjN4J 1ZOTwNA0YSnC74vEx8W+iJhH9kTiQFgsXr4xtjs1FolnRqAx3fUWEA6ww68or6+9QujJeCQaG4/E 9xIOCDWLo7cbZD1FikcmgfGJ0ViivC81Eogkgnw0xnfGJyeTe5LJqcaKin379pWPp+8rh+oVyf1T k7vjkak9+ytGkrsmJ5IJqSrJ74pA93tJve2TKRDJfj6ViEHnQBD5mo/ACMTi46PJZCzKD++nZK3d 3NcG38bpBxifaEociX17Rkf2ZN0L19GJkbFUFG4FiUVHE1Nj0AGR1VR8FCqMQK3YRLKcT/c9OQED GRgN8rHxYXLTYlMT6cpLUkSrE1WEYUkk46Mjor5keidqkm6riRIQGIVeQGXJnIgTxY5O7psYm4xk dwo0R0RKYeCBXZAxyaSSU6kkiH16dCRG6uyJjU1dxdCNjAUdiYpobFcElL88kpi6IxM3IcGO7l/q rZ7g37Pgg2uQGSkFARnAxxejDQSxMUK/F88y/sKfjP28ToehDpN7o/Vzckh9StgN1TcYaP3f32h9 jiP1ZT+/0fpGI6kvP3Oj9c1mqA9XRKIvGa1Pos8VFI0oB5mQE9nBr8wDf8oHK7wfrQOvehBs6x7U DHa1BR1E7ejT4AE8jHohftmKnkA70A/RTnQBrO/LUOsi2Nz3UBLLMIMd2ICLMIersBM3YzfuxgF8 Ex7AEbwDT+AhfBcew5/Ek/izOIW/jKfxt/ABfAofxj/ER/AFfBS/jGfwm/gY/nd8Agt4ltHgOcaC zzI+PM9U4XNMC9vDdLP9zBZ2MzPCDjJ72TEmwcaZQ+znmcMwrg9cySvz2f8kr18BXh8FXr8PvP4E eP058Po61HoHeBWAVx3w6gVe/x9x5wIfRXX2/zO7m9nZWwjhlgBKAojchAgolGtAUAgYIoqlWHUF BAKIAQEDchmSiAGpRkVEaxWoIlWL1Cj11nYhaYxyETDElFAMkaDSCCllQ6p5mf/3nN0kG6C3//u+ n3cP392ZOZd5fs95zmUTGHqjdTBax6D1drTeg9Z5aF2K1sc42oDWrWjdidYP5c/60HoIrcfR+he0 1mov2DTtXVs0WuPR2hWtN6A1Ga23onUKWmeidRFal6M1B60b0PoC2rY21xo1MEJrO7Reg9b+aB2J 1olovRutc9G6FK2PofVZtP4SrR+gtRitpWg9iVb5P6ALMVuLFg9pHdHaH60paL0TrfejdQFaTbSu R+vP0fo6Wt9H68doLUVrFVrrtBU2h7bWFqM9buukrbf10fJsg9F6M1rvQKsfrfPQugqtj6P1BbRu Q+u7aC1E6360lqL1G7SeQeuF5lqNPhFa49HaHa0D0XozWifL35ehVe4PstD6FFo3o/UttBaj9Qu0 1qDVEvegcYZ2FVoprQ1B6x1ofQCtS9G6Fq3PovVVtP4GrbvRehCtFWg9g9aL2mL6bYktEa3XofVH aB2L1h+jdTpaH0TrCrSuReuzaN2O1nfQWoDWz9D6JVrPorXOPs+u2RfaW9mfs8czd3RurtWTFqG1 A1p7oXWI/A0mWu9C61y0rkHrFrT+Bq270XoIrdVivOYUP9Y6i6laP7SOUv+3+GxtmvxdCVo3oTVf /r4ArYfQehytZ9Far6XZfNpU21Xa3fTbPNsw7UFbKlrvResitK5G6xNofQmtO9D6IVqL0foFWk+i 9a9akV3XPra30vbZu9hT7En2W+0j7ZPtk+x3kebZZ6D1YbSuQOua5lqjSyO0XoXWPmgdj9bZaF2K 1nVofQ2thWg9gtZTaL0gxmit0Xo9WlPRei9al6v/NX629hJaP0RrGVqDWgubXYthPmlv66JdzTjr brsJrZPROhOtmWhdh9YX0boDrX9E6+doPYHWc9p6u13Ls7fUXrB30t6199UC9mHabvsdaJ2L1qVo 3YjWV9C6C63FKD2M1mNoPYfWOqZdm1yvDCd/YmK6dx+9PCvLiNIMZ0VeXk1ubm6NPNEzck1euRmG rhlGTW4OL3Ic5NSYJn/MZiemKjZotGm+mDN6kDqhQr2sZWia4TDDL9V0bt7mwOa8vFzZQFQ4o8Yw NMNdUPAqr+efVw0UFr7yyoYN69erk8wc9cpUDSgrw6051UlermpN9+eZyQkxeX4jShh6XULo1WBO qAEpOytr9Oju3WNiDI8wPDkJOQkpySnJt5ESzARTj9J0Z42RmZur7ubEuFx5D92h6VEZ0tgMdd2Q RSikymfk1plmpuEQhiMpuSZZviik65l5eX4zI+RTWtpZLKuEXCLCLpF2m6b0yea8Zs7SDU137/pk LS91j1Dl8O14STN0Z8g45QzdGbLIMHS7pjsqQq1gtp5hBpJiKpwO4XSErEtSzcjSm2brUUKPys1N S0tI0F1Cd+WaueZkJq/OpFAeOWm5RlOx5GR5g6gKDsyKCJtFSE1FTIw/OVkk221Cs1OET0N+eqKE K8owYmISZBOmqdmFw1FBOBtRmzdv/icBSQc6ZXCZZji4/kcD0nnlgHRphme3udvcStpAkm5pHphO zXANGp3Fi1s0xuL/VGB6/0lguqI0l9OMjEw9FJkqw2gMTZnhz6uRGQ7hIjSvFJsNjV0hOF0OzUVw hqPTpWmuRs/9t8JTDqWdgUvCU42e5CvHp/5P4lNvik/9CvEZabUIKfLnXR6hrn8aoS4ZoS6XcLkM 0Vq0VvceKf+DeukkXXMZUmcd/VjncnI2dJS63aih8sxVlyNjJIs86ek6MxSiTWd1qhVZUtZ7Iisr XE9Wuijfmjte3S8nFLS5ObIVvSGrzuXWXN4Ary3JW5KfVmk9yWVoLvfuLVueWrv20Uez1dnQUavl i1vJ5pTpjY2rs1zGmDJRLgUZhpGb4XIKl/NiTPjVaKKKf+Ub2cBI/CK9I71kCJdHc/lkIK8Lh/L1 pgxlZ5TmpF3CdNNst665DSq+V8hdC9+TWaHVJzdDZTkcjkXryVq/yKlrTrkS1JvmcrdDuKMa4zmZ kk7nchl1JgUym7WJDOW/cEyb7ijNLeM97EG3prmbnGs6XZrTmy/2qfEeSuq+4aYabMgJ3SV8vfA9 2a48DZuK0U6H5gwHuSmP5Qj1x8RUyJEY1WB4kmpPNYc+6RUZwYSw0y2cntHJo5N7mjK1ZBsSyiYz LS3XHVGUSFXt18TImK1xazZ3wywmwmpxtZGUkCASEuTizyBLNh02ZMsDny48usPRLOo1R1SFw6G5 9Txebr7pEvZNgb+KLlaOdGpul4oVGeD1boPT4SNDdx45XJ6667NUlK0mV3ZJfUO01yuzGoPfVIVV 3SdXrw7XlfUsVfuSLlJN5TTM2jny1NmYWe/2aG5fwB/wM2I3P5XwFKG3LkGGoGpUDoLQKHC7NLdn eFhKw2skWznVvJQVGhGNKhkSOTlZYX/KvpRjwu0UbqNxTMQ0Gh4aW8p1l48KQ0gjo3MSGqb4iJER ii/HcuLBo2seGcWRQ8MZHhoqz3HlseFxCI8cG42Dw0neShmxJkvr8ubNXjo6PFGaR3kzPDw8muaJ 8P3/0viQyjLVNFPzvz0+PJrN0zA+pGolWA6QK4wQz78aIR41Qjxu4XF7+ZYgUyIp2VxlUizZTPY4 NU84etQg8RicX31fsrp78n1Xy3N33ZrQMMlaU6c6p95sHCdN5/Wh7nFpHk8n4TeTBcaLJ0PtmH6z k1BZTR1lRXTapZ2orMpqXEOy5F2ahhB39WmeFoG4QNzm7pu7543NGytX4keNR40sQ90lYG4m5ZFy zRxSFml1yLaOYnqzMTWS844i7Aa1CjYaIM9Dg0oZQNggJYmozsn0OIUnYljFXKItcrgq50tX88dM VO6X3eAlKRlZGD0mJpS6Sz2bY5JjksPfKhhnBJbXqXldoREhV7PC95rtOFWujdfgm2XuzYPDe0s5 1siNEt6oQU2DTfa40TTaspZf0nhWVmg2a3SRV9e8RsSAy/Fqmjeys0zDoxnR7weKEnIiktp9NjTZ bCvqacpR406dN9gu/5dWuSEND7zQVpU5hdmMyYy5TU9OrgsJGaRaDd0A0exPjSvuTxvGX2gvLUcc A9ATWZxhozLrDI6SzTqvZvM27lmkJ5QPMnKZFa4wCL3qINopvE6brWEYhkdhlBqFXqcchV6P8Hqi RbTooNL15vWmP7CKlUAuBl5D87rri4qKCuuLCgoKiuq9Li50EhmmXwQikp8rnYTXrXm9F0UB2/9A xGu3WWBeFKpDL8rzenX1YtOFi6FyqnonMyM51PbH4er+QEagk6kym9q0Im8Q8NrwTLML0u6Con37 ymrKyvYVFRXImxkRBS56ozVvTEXHio41Qw/2LptXNq94wr59hes/Xl/gLfCqm1UEagIHA2WkfaQi 0p5AQWB3wOvRvL5OYkHYRQ3JH1gQwAUhhylfhSyRDqsXRaJApSIhj0Nnu03lgqEzA4GKzI7Rur4v 02sIr8uKa3pdIrvpdZ85QqiuC91bJtl1oU6U3eltoXlb7tZ36wVrpq+fvn7mvpn7biwbMGVoZlxS XJLahS4v0vWVRUUHlvgMzeeWjR47VSBfp46FtuMz1Z1mDlX5dl5DZqn8WUPkXhjDi4roumlDfbrm 04f6/f46f/jllfmriJui5YGV1Fh56S0KCnw2zecIBIRolORzaj6XPCii22rK9u0rCpeJeLm8mqvF sYqvk4qaJbU3b2w6tFOfqY5nDvVG5J06FgoOl7tRCrLUfr2souEWci+fWSj7xLs+U65zepOyQart 8H3wg9y/y6+704VMN5I6klzR/JGBND1u1qYZmwbsHFoT54/zsx10GQUzZw6NGzpzZoH3ynXjSElC GVHvjYtLonPrfTabLyK+RdhXmet1XfcOSkpKEklJUXbNFoWFAZMjX+iopVNEO+V/B0hDcRRLklcD mkOL0mui6DRjn3yp3yq4xVbbFGGfvnThPNF61sL754rB8+5bNF9MIEe7fdKoBMwSlqV+tqcLHxuy 0JkmuIdoo66HrtjYqLUQbUn2cWlpY0XXSRNvTRBJd0wan8C6Eyojfw8UI9qpMzt3aNnYOpswlqH4 8BmrhGgl2osO0zMeyhCvqPfX1ftO9b5LvX+k3vfMvX/hfFGs3g+o9xL1flS9V6j3U+q9Wv6aUpyT 75qu3tur9z7qfZR6v1O9z3lg7gNztZXqfY16f0K9b1TvL6n3bep9R+Nvc/7Vu/Zvvht4ki/S8m/j ya+E+OX/7pqNfvD9x5/R4mr194Xk33DJEk+LreJtsUccFpXinGYTLqXUCKutFvLv6tmp15pBoMmf tWqDQ5+5a0Kfv6iLqEO8ndna7Fzz1jc/j+7W/LxlbPPzVi80P7/mYvPz7pfk92zf/HwAw9QWeX4+ Il8X2i1Dm59PWMenm5juLtLk32+kThauSrKliVW2V2xfiM32X9h/IUocixxbxJGoz/Vcze6+3X2f 9r77Mbaixd4Y7xjbTd67vC/Zlvpm+ObYfudb5VtvK4y2RRu2w9EXoi/Y/iQ0s1b6Ri/17bpiOkg6 6jsZkU6H08ErpPPRnRtTd9Jg0mjSHJU2XZp8B6O3Rr8TszGcNkek12WS+50rJHfLtMa0ruWGxlQb SrEdr5D6kAa0fiEivRJKKueS1Prt1sWN6UCbCtIpmdo6rpRi+7SNbdu93bqItEGlPVdMB9t935Di Wse1b0yjwynliilNpTvDn82TGX6X5YpUKmlModrH42rie8bPiH8pfrtMl7Yev+NKKdR6/HvxleF0 vinJu8R/r+5lSq6a0GVwY5rQZVJjmhFOc0hmlznyP9PomnxNn2tGd5nDe59r9nQrvrZUpfPdp5Iy enQj9e5R2aMOKntc7Fnc6yWZelT2+qjX6V6nezt6R/du3fsDUkmf4aS0PlP7vhhOv7/e7N+t/zcD nr5xAGn4wLiBUwdmDno7nD4aVDSoZHBP0qDBa4YcG6arlDdsj0r1w28c/mY47RpWz/mbw2vUWc0I 2wjb8DdH9E5+IvmjkX3GTCEdv2X2sLxQaT5rQqXGDZflxk1I6ZySlDI8Zfv4biqljZ+jUub4NeNf 5D1z/KekignLJpgTjt+aQdqY6qdUWuqB1APjP+X9mDwiVaZWp34/0VRp28R9Kh2fWA3HJ9amOSbW kl+dNjXtWFrlbYtIT09KoNy2ibWhnEnLJtZOOjnpzOS0O4umTLk79u6Od3eb5Zg1dVbZrO8bPmf3 Jr09P2Z+54zMjKyMQEZlRnVG7QLHgn4LRi+YuSBjwbIFuQs2Lnhzwa4FhQsOL8xY+PTC7QvPPSQe in1o7EPTHvroodJFAxZNW/Ti4jsX5y7+/eLzS/QlvZfcvOTNJaceHv3w95kdM2/O9GcuzHwxc0dm 2dLOS3+6dNfSsqXfL/Mua7ts0LJRy2Ys27as7JGej4x+5J5HNj3y+iPHHqldnrx82fKPVugrklcs XLFzRdGK+pXtV85euW1l9arBqzJX7TDT/sFctevS+aj5bGMuaUpyHlHfrsMpNIP8g7GXcumIaz5O QpF+xVmnYeaJSM3nDrOoKcnZwSxpSqF5Qc6hMa/HFbXbwDx8dHgNs6aag9Un823LNObXTdFbYzb6 DjbOmZRtWdtlhqzr2xW9qWnuDHmJ2Xm0mn9DpTpHb23wnrwq52JV9qjMV+XDHqTdXb6TzORbqXFU tXYQ6zbyeVSlptXh9CWrwuiIdaBpJdgq7b5s9n/9stnfHZ7z16n5Xs3yqh1qR4/meFPDTEh/bA/3 F3NTaP4JzW/hfmROZAaUvTajcXZs6FHmuLgUs1LWaOrjLpPMSrOS1mSp8+SlxVd2mXR5TDAPlkTM qFeYZyPn1cvn1PDMXaSiKTSLTmiYP+W8zhXualbHb+fKpLi0GwekHmjrCK1j6pM1q933bSqIqtiG 1adhVYnt2NbRtAKFolKubaq0Q5ag7p62sTJHXpGl5PXYjr6DDZEa1z62IytgrKwvj0NXm9bRyJVU 2qJWzfC6GbFyxtLCpevkhmar48Hwyti6wXryvw/dXd5/fFqbirjR2NPM+9Jr0sf0VMSIbfBxaCRK b4YipcsM/J0ie1N6Ii6t9Quqv7fLvokY1YPjd6C1YYUtCbVqVseZZnUoyTvIzy6TZK/Io1CkyU+z +po+XfuFCK1wXfupVSkiyRUutLqp9fH/M6k1NSJdXkKttBEpvOI2pstryJX2P0tqLf63U+OK/Q/S pZ6SqXEd/wdJrez/dlK7jX8zXeodtUeJSJf7T+1dIpKM+1BP/2fp8pb/tXX/Xgr5We5dorcO01M6 D6v3HZW7HpXy1BVd7nTUWV5KZ7kHCueR2EENkrum0FU598sjmdTuaIraWck9VM3wGrU/YnfE0Z5h eWp3YjbuYmTaNtFMPTbRlDsYdbYtvM8JHW9jF1Qpr8gdjayXGk5qx7NI7Y0oq3K3yff4HZTeJndT zBbdUo+pfVdmOKWpK93krkudpaUek/NSOI/Ezi2JvZrcocl6a9QRSe3TMtR+jrJqp9a4XxufNsKm PFIvfXHbopAnhulKDxaHLB3/qWpb3mmNaku123wkXt6jkXFwbWnoTOjyGRzy2RvyyRv2KcIrn7ph /70YKOS/HD+onk8hj6rVv7zX1PMzbPIJGfYp1kG+ob9h1YtCq17zi1bafWKSNk3Ea9NFojZDtNTm qudwDKDkCPU0Ck09e8JBWS9lW1LWS1m3aq+KUmeES7tHdCS/C/mTyb+K/C60dQ1tJconRahnQ3jk Ux7kcx3sy7FjhfVb7B1s/8p6zn5SJNmrRD/716KX/VvrkP0033Zl6wdpvVI+XcSy2adc/EE+fUE9 eyFTtBApIgYGix5iCMywDon7YSbIJ0Qsss6LxbAEHoZMWCq8Ypl1WDwCy2EFrIRs6ufAo7AGHoNc WAvr4HFYD++LUeIDqOP4IliihyZAgzQxRLsNJsHtcAeki4lakeiE4nT7nWKo/S5h2O+FeSLXvkpc bV8tEuzZ4mrHy9Zhx2bYAodFD8fnUAJHoBS+gDL4ExyFcjgGfxY9omKsQ1EV1uGovwhvVDXH30GN dViPEil6Dz77ix76jXzOsw7pD8B8eBAWW1/rSwDf6PhGxzf6MsA3+ltiiL4TfgsXxBBnT9HJ2Qvu FT2cfpgGC2AhLAUTVgM+cubBU/AybBGjnG/w+R2cgRr4K5yDC4APjekwA+6HxaKTS4ghrtaik4rd U8S1Wx19q5550YaozSdq84m2bkTbSKIti2i7nWibRrSNI9qS5VMq5LMo7HdaT9h/bC0jgm6Qz6OQ T6Ow/97aZv+KOKsSdvspYvBbcZeKs5OUOsY2s2FU3CP6RrQ/lvaX0P4Y2h8onyJB2xto+7fU6i+f JCGfI0F7H9HenSKaVs7SyllaiaGVa2llPq30pZW+tNKLVuTTXI7L5z/Q0gxa6Sef/6CUfsLRWyKO Nv5AG3+gje7avdYHtNOXdu6lnQG0czvtjNDSrc9oq6+2yXqPmh/SnoP2lmDZTNpshWXZtPa4vdI6 j3Wf2r9htH4rrrOfDo/YlrTak1bTaXUgrY6h1a602J3WPpf/alw93ee3xK8nPMP8FzOJnFmeF9lW tciBR2ENPAa5sBbWgXy6zXr41KoTe2Ef7IcD8BkchENwGD6HEjgCZfBnyxLH4UuogBNQCV9Ze8VJ qIJzVrn4G+P8PAShFi5AHbPb38n/Hn6AevgvuIgtllWtCdDUrPiVfSoR9lPrrP0ePv3WWcdhq9rx OZTAESiFL6AM/gRHoRyOwZ/hG6vO8S2chr9ANXwHZ+As1MBf4Rz8Dc4DtjgugmXtjYq19jqTrTrn GEiB8ZBqfe28g8/JMJX8u+AeuNeqdvphGswlbwGfC2ERxw9DJizlfDmfJp+rYQ3HjwH94HySzzw+ n4JnON4Az8JGeI72X+b6Vo5f4fgNjt/i+EOgj5z0kZM+ctJHznLLch4D+shJHznpI2cFdU5AJdBH zm+tcudp+AtaquE766DzDJwlr4a2/wrn4Dzn9J2zls8LnNNHxnSYAffTXzbxhGitVi67eILYnUwM y9UrirNfc5bC2TiivND+meglNK7WitFEZjmRWU5klhOZ5URmOZFZTmSWE5nlRGY5kVlO6a+JtDoi rY5IqyPS6oi0OiKtjiiqJmJqiZhaIqaWiKnlfgHuV26/W0TZ74NpRNB06yuippyoKSdqyomacqKm nKgpJ2rKiZpyoqacqCknasqJmnJ6spaerKUna+nFcnqxnJ6rpdfK6bVyequWnqqlp8rplXJ6oxyv 1+H1Orxeh9fr8HodXq3Gq9V4tBaP1uLRWrxYjhdr8WI5XizHi+VqxB4VTnw5kpFssPb+jrX3XftB 1tpDrEKsNsq/p1F4CIUnlH+XcxbHWUf8m0ULX4gprJOJrJOJrJOJrJOJrJOJrJOJrJOJrJOJrJOJ rJOJ3OlG1squrJVdGbMljNkSxmwJY/YEYzbImA0yZoOM2SBjNsh6GsuYrWLMVjFmqxizVYxZ+luM Z90cwDg9wTj9knF6gnH6pX2a6GafLp+UJXJYRzuxjnZiHe3A2pnI2pnI2pnI2pnI2pnI2pnI2pnI 2pnI2pnI2pnI2pnI2pnIWKxiLFYxFqsYiyWMvSBjroQxV8KYq2KNS2SNS2R9S2R9S2RdS2SsVLG2 JbK2dWWsVLG+JRL/JcR/CfFfQvyXEP8niP8TxH+Q+A+y/sWy/sUS/1XEfAkxHyTmq1gDE1n/Eln/ Eln/EmW8W+fw9Tn2Z09Yj9IDY5nPTzCfL6YnxtITr5K7nmgfYz/MTqrEumg/Iqap3iun9FFKlbFi PmGt5GwadQ9T93OuJlP3Cep+TN0U6pZQ7ydCD4+jH1PyCCVLKJmi9lcyZl5TLd1P/gjyD5BfSv4Q WlpL7k5aGkVLn9JSkir/J7VPPK7ea4VbayE6aVNhHjwAD0IGLICFsAjWsdK3lE8Nkk8IovVM+XQg tTfaLNrZPxQ32HfT/5WiC6v27ewSY1m527NL7GL/hpnhWyw4zbW/iBtYzxdau6nRlj1lZ7mmU3+e GMcKNlU+PUSMs9+jdl/jRDSWdcCyDljWAcs6YFkHLOuAZR2wrAOWdcCyDtRsTc351GxNzfmqpo+a Pmr6qOmjpo+aPmr6qOmjpo+aPmrKp7ldT81u1Lxe1fRS00tNLzW91PRS00tNLzW91PRS0xuuOSBc cwBK7hI9OeqpfJyv9ggX5POC5DM04DaYBLfDHcLN3s3N3s3N3s3N3s3tkr+ndchn/sgn14R3GoWq j06IEq27Van1gJ7QC3rDddAH+kISXA/9oD8MgBvgRhgIg+BHMBiGwFAYBsNhBCTDSBgFN8FoGAM3 wy0wFsZBCoyHCXArpMJEeAF+Di/CS/AybIYtsBV+Ca/Aq7ANXoPt8Ct4Hd6AN+HXsAPegp3wG3gb 8uEdeJfdWoDP3dZRbQ8UQCH8EYq4/rF1RCuGT+BT2AvyqUP74QB8xg5iKt9W7rEOOv7ITqIIPoZi +AQ+hb2wD/ZbRxwH4DPrSFRLqzKqNbSBttAO4iDeqtSfhOcBH+gvWaf0bdZZ/TXYDr+C1+Edrhfw yW5T/yPHB60j+ueUL+O41qp0XgVXQydIgETrrLMzdIGucA10s444r4Xu1lFnDyAWnMSCk3539uO8 P3lDrFPOoXxOss4aNqvSsIMDokAHJxjgAjd4wAs+iIYWEAPoNWKhFaDbQLeBbgPdBroNdBvtoQN0 BOw3sN/AfgP7jUToDF2gK1wD3bCpn3XK6A8/so4Yg2EI15LhZrgF7qXcND5nkjeLcrMhHebAYvJW wEpYBSY8yfVfUv41ym+3jhq/4vx1OMe1oFXp0gCtrlbWERc6XG2sU64EYugR9WQrvKPhHQ3vaHhH wzsa3tGooeEdDe9oeEY9/6olxEIraA1toC20gziIB/mELPl8rE6QAInQGbpAV7gGusG18llrfMvu AT2hF/SG66AP9IUkuB76QX8YADfAjTAQBsGPYDAMgaEwDIbDCEiGkTAKboLRMAZuhltgLIyDFBgP E4T8P4g9WipMBPlsr9tgEtwOd8Bk7L4TfgxT4Ccgn8u1ElaBCashC7IhBx6FNfAY5IJ8Tph8SthT 8DQ8AxvgWdgIz4F8YtbP4UV4CV6GzbAFtsIv4RV4FbYBK6C2HX4Fr8Mb8Cb8GnYAc63GXKv9Bt6G fHhHPqNMPi8M9kABFMIf5XO6oBg+gU9hL1w6i0y27mOWnsI60EI+ZYx1oAWzv3y25iEHM56DGc/B jOdgxnMw4zmY8RzMeA5mPAcznoMZz8GM52DGc+zgO8pbsBN+A29DPrwD78J71neO9+ED+BA+gt/B 7+EPEIDdsAcKoBD2C6/jAHwmvFEthTuqtfBEtYG20A7iIF549PXWd/rPrGr9SY43crzJ+lp/njWJ PlCz2Wby0KK/Sh4269isY7POLK2/ZZ3Ud8Lb5OWDnOV2Uf63XHuf/A/gQ84/AuzUsVPNfh9z/il5 e/ncx7X9cAA+g4PCq3/Ovflup/PdTi/l2hfWBTVTHsU2vs/pX1OX7yx6NcfsrnV21/pZ4DuLzncW ne8s+t/gPAShFm0XrJPOaOs7ZwuIgZYQZ11wxkN76AAd4Srhdl4NnSABugmv81roDj3geq7147M/ sMo6WV1Ds67wGjbhMezggCjQQf69XQNc4AYPeMEH0dACYqAlxEIraC3cRhtoC+0gDuKhPXSAjoCd BnYa2Glgp5EInaELdIVr4FrrO6MX39F6w3XQh3N2Csb1HDfMxAM4vhEGwiD4EToGwwSObwW+5xoT qZdmFRq3wST4iXXBuBc7Z1Lu0lma77sG33eNh2EFNqyEVWBSfi33ZvyrWXsjn5to93l4AX4Or9He dmiYxd/gGn1oBKn7g3XBJayTLk3+2wur2oU/XW4+W3K9lfCqmZ0VytWOa3EQD8zHro7y55JypIf3 VSvk0wDVHm1P4/X5XF+qfo4i91tnRJRtrPVT+61WAbtTt/zZFnnfid62JOu0bQAMhBEw1jpkG2ft tY2HW9mVT7aOs7s4xu7imHuKtdc9FR6zTrtzYS2sg8dhPfwM+C7nfhLy4Cl4Gp6BDfAsbITnYBM8 Dy/Az+FF+AW8BC/DZtgCW+GX8Ip12tvLOi3sWFprm8J34oV8hx6C/UHsD9oGW1XYH7TdxOda64Rt Hd9d7hLXMX9dR8m97tutKvcdcCf8FKZbJ9xzYB7MhwxYBI9ZQbQF0RZEWxBtQbQF0RZEWxBtQbQF 0RZEWxBtQbQF0RZEWxBtQbQF0RZEWxBtQbQF0RZEWxBtQbQF0RZEWxBtQbQFPSnWCc94mAC3QipM hDS4zTqB9iB9OND6gh7aZ1P9aBWrnxx2Qvt2dG+33WXtsM2AB2CtFcAH8mmUR9G+He3b0b4d7dvR HkB7AO0BtAfQHkB7wJ1p7XAvhUdgNTxq7cCuAHYFsCuAXQHsCmBXALsC2BUQI+mBdHogHdu+ogfS se8CEXSeCDqPnV9iSRmWlNknXzxvn3IxyOrio2f6srr46J2+4e/4hUTXeaLrPNaVYV0Z1pVhXRnW lWFdGT2TTs+k0zPp9Ew6PZNOz6TTM+n0TDo9k07PpNMz6fRMOj2TTs+k0zPp9Ew6PZNOz6TTM+n0 TDo9k07PpNMz6fRMOj2TTs+k0zPp9Ew6PZNOz6TjgTI8UIYHyvBAGR4owwNleKAMD5TRM+niJrzg xwt++uITvOCnPz6xjRVXoT4V9anhn7c+Hv4+3RMvtJXP4cQLbfFC//BPiX9CX31CX31CX31CX32C N1LxRireSMUbqXgjFW+k4g0/3vDjDT/e8OMNP97w4w0/3vDjDT/e8OMNP97w4w0/3vDjDT/e8OMN P97w4w0/3vDjDT/e8OMNP97w4w0/3vDjDT/e8OMNP97w441UvJGKN1LxRireSMUbqXgjFW+k4g2/ cBIL51HsRfFTKF6C4lgUrkThwyIeHxXin0J8U4pvSuWzOfFBLLnPoL8Q/YXoL0R/IfpL0V+K/lL0 l6K/FP2l2FGKHaXYUYodpdhRih2l2FGKHaWMlXTrtUvmu/PiOtttzHFTIJ15bg5z3FyYB7SNxRWN c90K5oxV1l7PI9Zpz3JYASthFZiwGrIgG3LgUVgDzI0e5kYPc6OHudHD3OhhbvQwN3qYGz3MjR7m Rg/zood50cO86GFe9DAvepgXPcyLHubFaBe4wcOcJ2f208r2IGO8ijFexRivwm/ye3o3cg8zdqsY u1WM3SrGbhVjtwrbg9gexPYgtgexPYjtQWwPYnsQ24PYHsT2ILYHsT2I7UFsD2J7ENuD2B7E9iC2 B7E9iO1BbA9iexDbg9gexPYgtgexPYjtQWwPYnsQ2+WcNcX6E97eh4d3N85ZUtGXoh+K8smvJP8C vVFPb9TTG/WU/ZKyBmU9jBQ3SvswUtyo7RP+GVARPVRPD9WjMh+V+ajMR2U+KvNRmY/KfFTmozIf lfmozEdlPirzUZmPynxU5qMyH5X5qMxHZT4q81GZj8p8VOajMh+V+ajMR2U+KvNRmY/KfFTmozJf 3ICSbPqmmL4ptqWLjvRPMQqmMwL+zgioRUkOStqFfzLTTv5kBiXPyZ9m0XfF9F0xfVdM3xXTd8Wo ykZVNqqyUZWNqmxUZaMqG1XZqMpGVTaqslGVjapsVGWjKhtV2ajKRlU2qrJRlY2qbFRloyobVdmo ykZVNqqyUZWNqmxUZaMqG1XZqMpmHE9R43gQKj4L/87pZqx+BqvfFh707kfvfrTuR1cbNLUh51n0 7EfPfvTsR89+9OwXum0x/brE+rvtYeuULYe4+Jl1xvas/Ek7V7+35Vi1QuP976IHJWptmUTEUsix jtjWCMP2GLXXW9/YNsrnnFo/2J63fvCwv/Wwv/VcBVdDJ0iAROgMMyhzP8yEWTAb0mEOzIV58ADM hwchAxbAQngIFsFiWAIPQyYshWXWD0rP91j6lW2F9TVaTto2WGdtfNMTU20LifaHYDFXM1G5FFZZ B20mrIYsyBFtbGust2xPUi7PqrA9BU/DM7DJeh9973ts1j6PHRwQBTo4wQAXuMEDXvBBNLSAGGgJ sdAKWkMbaAvtIA7ioT10sM7gwzP48Aw+PIMPz+DDM/jwDD484xlsHfQMgaEwDIbDCEiGkTAKboLR MAZuhltgLIyDGei4H2bCLJgN6TAH5sI8eADmw4OQAQtgITwEi2Ax/D/i7j0+7rrO9/gvM8mknUy4 U8QbchFFVxEFXcH7siyuK94RdcXdFcRWqlQo0NYCVRSVSwG5FKUCUmoB22JjgUIbbsWWQErSTprp JG1C05Bk+ss0SZPJtEC/5znZ6sE95zzO+eec88fr8ZuZzMzv+32/P7dvKO2luAyXYxZmh1VRtcjZ RsVNVHwpcVsYFktXhxFxMh59ngtlLpQ5sJcDlQh7Sccp6Tgl7yhRuUzlsg5T0mFKOkxJhynpMCUd pkT9MvXL1C9Tv0z9MvXL1C9Tv0z9MvXL1C9Tv0z9MvXL1C9Tv0z9MvXL1C9Tv0z9MvXL1C9Tv0z9 MvX3Un8v9fdSfy/191J/L/X3Un+vLlfS5Uq6XEmXK+lyJV2upMuVdLkSdcvULVO3TN0ydcvULVO3 TN0ydcvULVO3TN0ydcvULVO3TN0ydcvULVO3TN0ydcvULVO3LOcuFd2VXJxL0ytE99XRAdTuofZ2 au+KLqJxI40bRXq/d66ndQ+texKzPZ8bBnxqROTHIj8W+bHIj/nwGh8a+dDIh+HEDWGdDGiXAe0y oF0GtMulF9SGP/OojUdtPGrkUSOPGnnUyKNGHjXyqJFHjTxq5FEjjxp51MijRh418qiRR408auRR I48aedTIo0YeNfKokUeNPGrkUSOPGnnUyKNGHjXyqJFHPTzq4VEPj3p41MOjHh718KhHhsQyJJYh sQyJZUgsQ2IZEsuQWIbEMiSWIbEMiWVILENiGRLLkJjHjTxu5HEjjxt53MjjRh438riRx208buNx G4/beNzG4zYet/G4jcdtPG7jcRuP23jcxuM2HrfxuI3HbTxu43Ebj9t43MbjNh63RVM52MvBXg7u 5vfTXNzFuTzndnKuyLki54qcK/I/w/8V3Iu5Fyeu9dr1nJ4flnKwn4P9HOznYD8HBzk4LE7WcLGL i11cjLkYczHmYszFmIsxF3u52MvFXi72crGXi71c7OViLxd7udjLxV4u9nKxl4u9XOzlYi8Xe7nY y8VeLvZysZeLvVzs5WIvF3u5VORSkUtFLhW5VORSkUtFLhW5VORSkUtFLhW5VORSkUtFLhW5FHMp 5lLMpZhLMZdiLsVcirnUxaUuLnVxqYtLXVzq4lIXl7q41MWlLi51camLS11c6uJSF5e6uNTFpS4u dXGpi0tdXOriUlf0Pi6VuFSayMb/dGGUC8NcGOZAiQOVc9MwdYepO0zdYeoOU3eYuiXqlqhbom6J uiXqlqhbom6JuiXqlqhbom6JuiXqlqhbom6JuiXqlqhbom6JuiXqlqhbom6JuiXqDFNnmDrD1Bmm zjB1hqkzTJ3h6F0qw6sqw6uyP9bP04lr7eI6u5hYvce3YYF+f4e+/SZT3ZvxFrwVR+FtOBrH4Dzv OR/fwQX4LkyQtB6n9Titx2k9TutxWo/TepzW47Qep/U4rcdpPU7rcVqP03qc1uO0Ho++S+t+Wvdb cWzFsSwoyIKCLCjIgsKE/n/JALr/D5Fvgk9UfrPxv472fn7086OfH/386OdHPz/6+dHPj35+9POj nx/9/OjnRz8/+vnRz49+fvTzo58f/fzo50c/P/r50c+PfgrGFIwpGFMwpmBMwZiCMQVj2VCQDQXZ UJANBdlQkA0F2VCQDQXZUJANBdlQkA0F2VCQDQXZUJANhf+DbChwqMChAocKHCpwqMChAocKHCpw qMChAocKHCpwqMChAocKHCpwqMChAocKHCpwqMChwkSPH5r4r5Af5FXMq1i1iVWbXtrHtK9oHNM4 pnFM45jGMY1jGsc0jmkc0zimcUzjmMYxjWMaxzSOaRzTOKZxTOOYxjGNYxrHNI5pXNljbI+xPcb2 GNtjbI+xPcb2GNtjbI+xPcb2GNtjbI+xPcb2GNdVYmEmLsVlEG/2GNtjHB2kFo/9bc6ItGsnMr2k ppb+dzlidr/UjOpkKtsysi0l216SaYfLtHR01l8rykzdeC6ucC6/2r1+EYZE9pB3l+XmkO486lPv pXCJwqOvm5qGRPeQ6B4S3UOie0h0D/0/qjZDom9I9A2JviHRNyT6hkTfkOgb+r86FVVOK2VKrfvr uWU0Su5/rcylV6Kv0LaJtk38G+TfIG0rJ5s8J2ro20ffvon6N9/zW5wRbjUpLfDaHaGPrn107aNr H1376NpH1z66NtG1ia5NdG2iaxNdm+jaRNcmujbRtYmuTXRtomsTXZvo2kTXJro20bWJrk10baJr E12b6NpE1ya6NompQTE1KKYGxdSgmBoUU4NialBMDdK9j+59dO+jex/d++jeR/c+uvfRvY/ufXTv o3sf3fvo3kf3Prr30b2P7n1076N7H9376N5H9z6699VV9jkTl+IyXI5ZmB36JjTesz8TytGhiZXR lMRTJs6nxeUz4arEurAksducMRbmJ/aElqTKmXyP0+uJYXny5ND71z+tfHZ0UPKrUWb/nynsz3SE DRxb5HuX4WkZ8EzIJtaK9Gexzj3Xuz4fOhIbnHSz7tbmuhn90eTEgEwdM+OWTELj2BuGk1HoTtZi Eo50+j8x9CRPCruT78cHcEooJU8L2zP/FuLM+aE58z2oEZkfuF4UOjIzoCZk5rjOdb0CZujMT6Bj Zq6HrMzM9/NfeU3ty9zu+QLc6TsWhT2Z+33/cjwUdmf+iBVea/B8las9ZVq81oqNaPc8hw6PO9Ht fYOhO7Mb46G7/rBQrD8cU+B0WO90WH+c16eF5nozfb111V8TRuuvD7vrb8UduDcUo3/er2qeT2Wq tlN1kKqDVH2VqjuomqNqO1V3U7Wdqu3ULFFzhJojlByh5AglR6i4h4pjVByj4hgFBymYp2A7Bdsp mKdgOwVzFMxRME/B3H9RME/BQQoOUnCQgjkK5imYp+AgBQcp2E69QeoNUm+MemOUG6TYGMXGKDZG qTFKjVFqkFIjlBqh1AilRig1QqkRSo1QaoRSI5Rq369UnlKDlBqj1Bilxig1Eh2TeCDMSawMD1Gq UQy+QqHFVNmZ2BYuEGczEwPhLtF9dmLUpL0nfEyc/TmZDGuTqXBDMhO+L9rbkoeFo5NHRd9Jvj1c IvKPSb43fIpq94r+M8Tcb5IfC1ckPxm+sf9PZ3UlvxruTp4TpiWnhjWVP79kV4+pSU/pEs9gXdjq ji/zY5s79rrDgG8d8o3bfeMuuXSaXPqoE+EDHHsqtPpUJV9emMiR/uitPr3RJ5/zyR3W1mttdb4h O5EPJ4esTz4VnvOpl33qYZ841Cdecr+uifx1qp7I4aPk6Xs8PzFs86luq1wbvUVk7Z745FqR9SzW i5jnfXqDqMqaIttcN4cdomOH6NghMnaIjJdExkui4iVRsVtU7BYVu0VEWUSURURZRLwkEsoioSwS dnBuB+d2c61S+fujA6wnZeWL3O8B933UXldhfdhL10569mYuDyXfP+L7R3z/SOYOz38bSr5nJKr2 qVEr/6FPbK/EvUn4AbVkpb08E1q82pFoVUcqGm4LBbq1+t5239seneOu8737KjnVMxEtj4a57j7X J4cpsZcSe31DDyUCJUb359UoJUYTubDMNzaIpJZELHrSOCycn5zCjSPwBhwbLk4eh7eHncl38vkE vId7dE9+3M8/OfFnl0+ympPkXg91R6k7Kvd6KDxK4UDhIPd6qDCX0oES8ykxnxLz5V8PtfdSey+1 91I7yL8e+ddD9b1U30utuZQfpdjczFKVaBkeDxdn1rq+gGZswBbksdXPulxf8h3bw8X1UfhzfU1Y Vp9CLY72/HhMU6HmhflysIebe+tvC9vrb8cC/BoLw7KoTkSOiMbtnP6A6vOa6vOa6vMa1z8k01+T 6a/J9Ndk9WvRm/lR8bJE+yHaD/lUSo0aVqOG1ahhex+191F7H7XvIfsesu8hex2y1yH1ZVh9GVZb htWWYbVlWHwPqy3D1jpqnUNqxbBaMaxWDFel3XGeCLiN+09y/2bu35xYw9FGPBXWJdbqis9iXbhX FLyS2Oj1rNjKhZmJLWF1Io8OdGIrtoVrEl2u29HjO3e49qIP/dE80dKQKHi8E7HIG3QtYle4ODGE YY9HsDtMVZtaVO6cyp2TwWerURsSr/jZq3gtrEnscw26cBUSqNSvatFW43FKnUqHq5J1HmfC9Il6 dqDrQTgYh+CwcJpoPVO0nilaz9Rbf5Z8Y7gs+SY/ezOOir6WPNr1GByr5h2Ht4d/TR7v+TvwTs9P wLs8/ju8J/yDGvnvKstSrs3j2jyuzRPtn1Uvr09+0Hs+hL8PP05+2PVUnBauTH7E9aP4WPimrDgz +QmPPxl+KDPO3v8nZpfKkMuSX4/ekDwXU8OL6usfMlNDS2YaLgqvyJJXZMjNMuQVUTJPlMwTJfMy 8/z8x/g5foFf4rpoSuZ63ID53n+r127D7Z4vwB2+5zee/9b1rjA9cw/uxaLws8x94TLd7MrMA54/ iD9gaThDVp2hw10pAueJwHnmg5/pcldm/hR+nFmJh71vldce977VHq9Bo9fXer7O6+t9b5PXnscL XmvGBrT4rlZsxCbvb/feHLb4WR6qt+ieJ2vPyGwLq2XuGbrolbL3TNl7RqbHa2IwIwYzL0McZvox EJ7MiMOMOMzEEIOZXRjCsAowgpLH5bAmswd7PX4NYi4j5lSFq+rFXb24q0+GNfXVrjVhpioxU5WY WT/J88mqRxpisD4TnqyvxwEeH4iDvH4wDsGhXj8s5HT6nE6fqz/C973Be47EG/EmvBlv8d6j/Pxt ONr9j/GaCqsaXVV/ZWiR4fPqr4mm1PO6ntf1vK6/Ftfhej/7VbhM5s9Tqc5Qqc5Qqc5QBeapVmfU /8b3LLTuu3znvb5/kef3YTF+Hy6OjlYlfqhK/HGiMz890c+fVQn6ZPx8mf1Nmb1S1i6Xtc/puWMy 9gkZ2yMrW2VjkyxcIws3ybp/lFnnyqTlMuZ6GfOsjOmTJbfKkk2yoFH03yf6Pyf6nxT9lf9T4YMi /sXoP9Sr+63kDzrWxsRyXWqlmvCo11bhaX3uGT9bGzarnpt1rifVrEGda6UeOGi1A7rXSt1rpfq1 yMqfVacGrHyDWrTWqnPqzXb1ZruV96nXWSvfpWZn1eyserLW6peqBUvVgqVW+YpVfrEy8+heGzP/ rtKeH1bqYCt1sI062Eq5OSg3B3WwjfLzfvk5KD/vl5/3y8/7dbCNmat97qe4FteFzar6ZlV9s9wc 1M026mYbVfjNKvxmuXm/brZSbt4vl5aK+6XifKmYHtBPsvpJVtwO6ClZsTogTteKy0XicpG4XCQW B8TadrG2XaxtF1sDYmtAXG0XV9vF1Vq9KCum1upwK8XU/TrcRp1js/hYJD4GxMd2E+QacdCIp0xo 68KjlN6hO7SKhU+p5p2qead4eJ6q3VRtoWqLmHhE5d5G2fUqdSdl11N2vdjYKTZeVo03qcabVONN YuTvxMi4KptXZfNiZYs46VVZm1XWZpW1Wcy0qaZbVNGcyrlJRWxVEVupvoPqO6i9QwVsVQFbVcBW FbBVBWyl7A5Vr1XVa1XpWlW0nCqWV8XyqlhOFWtWxZpVsJwKtkUF26JabVGt8qpTXnXKq0551alZ dWpWnZpVpy2qUl5Vyu+vSs2qUV41yqlGm7izXmXpVFk6ubSeQ+tVl22qyzYVZJtq0aladKoMnSpD p8rQyakWTrVwqkVV2KYCdHKqhVMtMr+TU+tlfquMb5XxrTK+Vca3yvhWGd8s25tle16252V7XrY3 y/a8bO/kYoss75TlnbK8U5Z3OhP3m44rc/XJ4dXoFFlWOWd9T0YtkFELZNTTfL5K1uzh62K+NvC1 QbYU+NrD12U8XcbTZTKiLAvKvLiKF1fJgDI/rhLxZVG+QJQvEOULeHGVKC+L8rIoXyDKF4jmPfRa RqdlonkPrZbRqodWPaJ6D716RPIe+jTQp4E+DfTpEc17RPMeGjXQqIE+y0RvWfQuELl77LnBHp8J 14vYcTtY49luax8LD4jNbdEb7Wy3Z712NmBnA3Y2ZFfN6kDBzprtrNnqdltds9U1W91uq2u2qt1W tNuKBqxowIoGrGa31ey2mgGrGbCaZquonGUHoqPcacydtrhTrzv1ulM/DStn1BZ3G3W3Fndrcbcx d2txtxZ3G3O3FlqM0GLEXcdoMeLOY+7c68697txLixF3H3P3MXfvdfded29x98r5sNcZYZt6uTu8 aNcvuvOoO3aqZatU3HYVt3I+eGSi4qa8a3T/Gaqw//9hOjF5TvT+CeW6/aTTT7onnlXOdq9M6Fiz /1MjnsW+f7PvHzYN58y0MYX32meaEhFqzKQp1OJoz4/HwjDkO7ZNONPq3R26SGWNo9HxvuNZP3mU fiO+6zHvePkv5/uJfhOpL7WYhHR4zK6+YDffpuMIHbfRcRsdK+frbfQbsYbHrOFZa3jWGp6l5d+e u9+EN7/u/H209x8nF493Xej9d3mtcuausudidIT1DVvTsDXttKad+3+Ds8vqB6xrl3Xtso5d1rHL Gna597B7D7v3sPvudN+d7rvT/Xa630732uU+w+6xMzrOtz9u93+28/Wvq7JZOi91p9JEVU1P/EmR n+73covdT638iZ6/VB87Xu+uj7vr4+76+P+08lQqzdHeV6kyx7tWKsZC7/2vFWPyRBfdbQ7Y42yd 4utXwkX7/3THi+78tYk/Mfp+697mnY9wrdm5YLP1P0Gl5a+rIJXOkKPUQl5X+u7L1FpIrYX284Rv vda3LeNis9ltMwUXUnAhJ5upuFBG5GREjqPN9veErMjZ4zZ73GaP27jabAbbbAbbbN7a/F8qR47L zVxu/mvlONp3HBcW2vsT9r2Ny80T1eNNVO+gesfEbyPGVJE94RmrHqR8hxUPWnHldziD1O6gdodV DlrhIJU7qNxB5Q4qd1C5g8odFO5wp0EKd1C3g7od1O2gboesGlN19+p+okeEjYUnooQuuNektCdK mkbWeTbsWV90tGdFZ5iy+aRoPinqlOM65bhOOb7/d4QFM8uQOb6s4xV0uoJON67TjZvXy7pdwYxe NlcUzeRl3W1cdxvX3cbN3WVzd1lnG9fZxs0dRZ2tYPYo6jTjOs247jIeTdbL91jJnXp3Uc+uzHUv u2uRg/dy8N6JqjJZtx9NHqaSvCfEdjDgXXHylOhAFcaZJzrJfXJRte/Z4Xsqv3MtV3Zgx5mJ3yAU Ku+nxGHy6ZRQ9nrlt7Le4XPbo8M9q+x+1O5H7X50YudfNyucG9pet/NROx+d2HWLays2ogOdsDs7 G7WzUTsbjd7mbhvoO0bfdvq2v/5k7t6xu/TSdswdet2h96+n8RUTv/Hrpe0YbdtpO/Y3J/R2z3MT vwWcOKnTtt3de2nb/vrTelRl52PRccl6jw4Ld5mWiqalommpaE0PW9PD1BozMQ2YmCq/XRuk006T UZEDr3LgQQ486Bx5iHNk5U9HVqaeAVPPgHU9bLoZMN0MmG4GTDcDppkB08yA9TxskhkwxRSt6WET xYCJYsBEMWCaGIhqreaP7rzbHcvuuNvd9rjb8+72fHSsn75Etz5r3GKNW7yztP932P/doVNMdqeJ 60/SYVHoo+FeGu79q0srvNbg+SrXx01a61xf71q75zn8xb2t3tPt/dvDlr9xcQrVuqnWTbVuSnVT qtu6u/b/TqqbIt0U6aZGNzW6qdFNjW5qdFOjmxLdlOimQjcVuqnQTYXu6I32udUet9rjVnvcZY9Z e9xkj5vscZNJtRJ1m+xnk6myYKos2MtWk2UlAjfZyyZ72WSSLNjHJvvYZB9b7WGrPWyyh032sGni /6I8Nvmt6NhoQXReuCM6H9/BxeHuaHa4KZqDH2EurkBPWBDtQC9GvGdPuDHai1fwKl4LN1a9M7RU nYB34d34O7wH78WJeB9OwvvxAZyMU/BBfAh/jw/jVJyGj+Cj+Bg+jk/gk/gU/gGn4x9xBv4JZ+LT +Gd8Bv+Cz+IsfA5ToyOqngxPVD0VHql6Gs9gLZ7FurCmaj2eQxOeD2uq7wo3Vd+Ne9Ds+Qa8CHut 3ocQbqw5KNxRc0hYUGPKrjFl15iya47AG3AkusNNNbH3DGIo3JQ6AR/EheGO1HR8Hz/AzHB36lLQ PTU/tKRawpqUE0/t8WFN7TvwzvBI7Ql4Pz7g+Ufw9bCg9hs4N9xYezsWodvzl7AdPKsdCHfXFrDL z0Y9L4UbJyVCy6QkqlGDFEyKk0yKkyYjjTpkUI8DcCAOwsE4BIfiw2HNpFPxLY+/43qV6+9dl4RH Jo2Flsm+a/Kh5uNvRoeEDdGhUP2iwzEFR+AdeCdOwLvwbnwG/4LP4ix8Dp/HF/BFfAln42s4L9wp cu8UuXeK3CuiS8LCaCYuxWW4HLPDEtG8RDQvEc1LRPOS6l+GDdXX4jpcjxswHzfiJtyMX+EW3Irb cJfP3Y17whKu31nTHjbUdGIrutDt9Zdd+xD7+SCGvPZa2JBKoRaTkcYbcCTejuNBhxQdRMeS1Mmu H3Q9zfWf8E2ci2/h33BhuFPk3Cly7hQ5d4qcK0TOFSn7TdmvCFoy6QcVbaKbQkt0M36FW3ArbsNi /B5LcD8eQBOexwtoxga8iBa0YiM2IYs25NATVqgJK9SEFWrCc9FujGIMJYxjT1iuTixXJ5arE8vV ieXV/aGlegAF7EQMp5PqInZhCMMYgRNL9Sgqn9uHEJbLtxW1akGt3K+V67VyvVae154Vnqv9sutX 8HXv+QbODctrv+f5JZiJy3A5foSf4RrIt1oa1dKolka1NJJPy2t/57rIdbnr46BDLR1q6VBLB7m2 Qq6tkGsr5NoKufacXHuudidi7PLZUa/TQ94tr3pvVB0dHNUgVflHQyr/cAEmo/K3d9chM/FvdB4c HYBToynRaTgvzBHjc8T4HDE+U4xPE+PTxPg0MT5NjE+LZvmG2WG6OJ8uzqeL8+nifHr0k+jA6Gr8 FD/DNfg5foFf4lpch1XRW6PH0BNmc3Q2R2dz9BaOLuHoEo4u4egSji6JKn+D9J4wl6tzuTqXq3O5 Orfq16Gt6je4E7/FXbgb9+B3uBeLcB8W4/dYgvvxAB7EH7AUy7AcD+GPWIEG/Cm0Jd4XHZg4KZqS ONn14zgzzEl8Olyc+Ay+4PnUMC8xLVyY+B4uDBea2T6T/Ea4xNz2meS3XC8JTcmZoTXZEtUkW6PD kptMvW1O5ZujdLInLEnuMIv0Ru9MvuzaV/m7gVx3RodUXxIdXD0Tl+IyXI5ZmI05+BHm4gpcibvC dPViunoxvXpjdGD1JmTRhs1oRw5bkEcHOrEV9BTtc0X7XLVmTs3BoU3Uz1ZjptfsjNLqyxz1ZY76 Mr3mlejgVBJiK3UIDsWxOCFMT73L9SR8IJqipkxPfcjjC8Mc9WOO+jFH/ZijfsxUP2aqH9PUj2kp sZSaDbGUuiO0pX498X/Qt9W+BW/FUXgbTsJZYYlMmy3TZsu0ubUzogNrf4irMA834Xav3+V6T/RW 2TS39kGPu73/JWyHmJM5t8icW2TOEpmzpHYwmlxbxC7vH/Vz8SeD5taORwdOOiy0TTocU3AE3oAj 8Ua8CW+GtU6y1knWOslaJx2NY3AsjsPb8W3fdR7Ox1zPr8CVoW1yVWhLnxMuTn8dc8OF6Sshb9Ly Ji1v0vImLW/S8iZ9PW7AfNwI+03fjF/hFtyK23A7FuAO/Bq/wZ1YiN+CPum7cQ9+h3uxKDqwbg5+ hLm4AleCtnW0rfsx5Hed/K6T33Xyu84666yzzjrrrLPOOuuss84666yzzjrrrLPOGuussc4a66yx zhrrrLHOGuusMfPu6MADJiONusq/Mp18Uab0qEaVR5W/e+SIxGWqWWbiXxdIoRaTMBnpyj+AM/HP 4FT+BvtM5R/SMAHkTQB5E0DeBJA3AeRNAHkTQN4EkDcB5E0AeRNAXuU7VOU71CRQMAkUTAIFk0DB JFAwCRRMAgWTQMEkUDAJFEwCBVXyAlXyAlXygui7oRhNxTR8DxdiOr6PH+AizMAPcXGYqqJepKJe pKJepKJepKJepJqerpqerpqerpqerpqerpqmVdO0appWTdOqaVo1TaumadU0rZqmVdO0vtup73bq u536bqe+26nvduq7nVHl9x1LcD8ewKroSJX3SP23qP8W9d+i/lvUf4v6b1H/Leq/Rf23qP8W9d+i /lvUf4uq9QzVeoZqPSPqc5btxwAK2IkYgyhiF4YwjJFwu8q+WGVfrLIvVtkXq+yLVfVZqvosVX2W qj5LVZ9lps+Z6XNm+pyZPmemz5npc2b6nJk+Z6bPmelzZvqcmT5nps+Z6XNm+pyZPmemz5npc2b6 nJk+Z6bPmelzZvqcmT5nps+Z6XNm+pyZPmemz5npc2b6nJk+Z6bPmelzZvqcmT5nps+Z6XNm+pyZ Plf1+WhK1RfwRXwJX8avQ1YnyupEWZ0oqxNldaKsTpTVibI6UVYnyupEWZ0oqxNldaKsTpTVibI6 UVYnyupEWZ0oqxNldaKsTpTVibI6UVYnyjpLNDhLrHaWWO0ssdpZYrWzxGpniQZniQZniQZniQZn iYaqF6J0VTM24MUorYtldLGMLpZJnFr5f1Rd/8H1zHClbnaWbnbWRDf7RogT52Gq7va6rpaYHmKd 7aM62zSd7aM62zRn8fnJi8PS5OPh6WRjdEDyKd3vRef5Vuf0TdERulxBl0sm253v/7PT1eh0x038 HZMFr+/UeS6JMrpcRpfL6HIZXS6jy2V0uYwul9HlMrpcRpfL6HIZk3TBJF0wSRdM0gWTdMEkXTBJ F0zSBZN0wSRdMEkXTNIFk3Sh+vZQrF6AO/Br/AZ3YiF+i7vC6Trn6Trn6c5dDc5dDc5dDbpoWhdN 66JpXTSti6Z10bQumtZF07poWhdN66JpXTRtziyaM4vmzKI5s2jOLJozi+bMojmzaM4smjOL5syi ObNozixWj4W4uoRxlLEHe/EKXoWc0Jln6cyzdOYLdOaszjzD+S/n/Jdz/ss5/+Wc/3LOfzmnhLxT Qt4poeCUkNfBT6/ZEYpOCnknhbxOfoFOfkGNNdVYk45+uo6ecWrI1+zzPIRiKkIVEkhGGZ0+40SR d6LIO1HknSjyOn9G5884WeSdLPKpN3vvW3Cs197u+fFQa50y8iaD000GmdT7/FwMmg4OderImxBO NyFknDzyTh55J4+8k0feySPv5JE3OVxgcrjA5HCByeGClDqaUkdT6mjqYlyCmWGqaWKqaeIi08RF pojTnWdzJomsSSKb+u3E38g0JfUQ/jTxtzJNST3r2hIaTBnZFC+de3Op8WiKiSNr4siaOLImjqyz cIOzcIOz8Gpn4dUmkKzz8Grn4Yba06K0M3GDc0HRuaDoXFB0Lig6F3SaUhY7FxSdC4qmlRmmlRm1 /xri2m/i3DDL+aBYe6HHcqr2+/gBLsIM3/lD2JezQ6ezQ9HZoejsUDThpE04aWeIojNEsfaX3n/t xN8qWDT1pJ0nis4TReeJovNE0RQ0yxSUNgUd6VxRNAnNMgmlnS2KzhZFZ4uis0XR2aLobFE0Ic0w Ic0wIc0wIc2o3eG7e/Ey1Ppatd7UdLup6XZT02JT02LT0izT0gzT0mLT0izTUtpZP+esn3PWzznr 55z1c876OWf9nLN+zlk/56yfc9bPOevnnPVzzvo5Z/2cs37OWT/nrJ8zdWVNXVlTV9bUlTV1ZU1d WVNX1tSVNXVlTV1ZU1fW1JU1dWVNXVlTV9bUlTV1ZU1d2Unvt6YP4MOhYdKp+Jbv/rbn5+F8fMdr F7h+F1MxDT8IBRNa1oSWNaFlJ13lM/O9/nvvXRJWT7rf4wcwFnKTo2iKCS472d4mHxoaJh8epdNf Cj3pL+NsnBPOMtmdlf5Xjy8PcXoW5uAvk948j3+Ka6KMiS9j4suY+DImvoyJL2Piy5j4Mia+jIkv Y+LLmPgyJr6MiS9j4suY+DImvoyJL2Piy5j4Mia+jIkvY+LLmPgyJr6MiS9j4suY+DImvoyJL/P/ ceLL/M3Ed3h0Q/hI1bnRZ6v+LfpS1b9Hl1f9R/SPVd+OPlJ1XvTVxJnROYmp0dnJr4RPJc8Jn0w+ FhYnG8Nnk9vDc2bDw5IqXPLlcFOyP6xLDkRvShact3aGUnRUdMO+Z6IHw8Zobdjo2z+2/2+D/aBv f7dvf7dv/0TV1FDSW3vdxWnOqewr4VR3+ai7zEyuDo8n16BxX5x8MqzU49qTT4dnk8+EG9z9ancu J3tDn7uf6u7z3T3p7r9192eiSckNYVGyxZqc5JMbw7eTm8KqZNanNocOXXGrOfXB8Gdr+7N3fk3v 3ODdt3v3nOTGffu8+x7v/rQ+utInLvOJX0/83Y4nWu1c3fwtuvenE5/VyaeGqYnvR8nEA+bkZ8J/ JNaFBYlt0SmJMR35sOjA5InhvuTqKKNLn2gHf3Sndc6jyeRGZ8228Cddusa377OjrE49Z3+nTu4/ kybtrC85YFcFr+8Mg1VfjarDqqgGKdRiEiYjjTpkUI8DcGB4PDoIp4aO6DT8JDwUXY2f4me4Bj/H L/BLXIvrcAMNV4XW6LHQWpUIHVVJVKMGKdRiEiYjjTrU4yAcjENwKA7D4ZiCI/AGHIm34ii8DUfj GByL4/B2HI934PNha9UX8EV8CV/GXFyBK3EV5uHH+Amuxk/xM1yDn+PGsKXqJtyMX+EW3IrbcHvY knhfeChxMj6OL4RHE78I+cQvQ16Uf4UrsTh7VYw9xIlYjH1OjL2aLO3rT47LiHKoTe7ZN57cu68j +UpIJV/d15d8LXw8uc/rIRxZXbOvvzoVPlVdG2qrJ+0br568r6M6HVLVdfv6qjPh49X1Xj/A+y4J q6pn4lJchssxC7MxBz/CXFyBK/G70FF9LxbhPizG77EE9+MBPIg/YCmWYTkewh+xAg34E1bi0bC1 ehUew+NYjTVoxBN4Ek/haTyDtdgYHqrehCzasBntyGEL8uhAJ7aGh2peCatSSYjfVE14PHWI66E4 Fu/CSfhA6Eh9yPW6sDV1GxZ4bp+p+zy2n5T9pOwnZT+p5V57CCvQgEewyuuP4XGshrWnrD3V5PHz eMHjZmzAi9iM9rAllfezPuzEMEawG6MYw3jY+t+o+w74Kort/zMze3f23rs3hBBCCL2jPhX4ISoW 1Gd5Cog+xUJXUZ4KFgRUpFieiohUBRSkCOpTfMizgAICFlQsINKDoSRAAoQNJdSEzP87czcxIYEU ePr+ez9nd3bq2dkz3zlndvdcGQOqBIoFVQYlqg2yOigJVANUE9RSbZQXgh5Vc2Rf0NOgZ0BjQFNB 09VKOQvHw2qO00SlOOeojc55ODbD8UZQB4TvVBuce5DeE3Qv6CXET0T866A3QJNAs0A5akOQVEqw Mo4YX0GMq2ASqKbaGLpHJYceAPUGPQR6BNQPhPEewngPYbyHMN5DGO8hjPfQK6CRoFGg0SDwGxoL Ggd6FfQaaDxoAmgi6HXQG6BJoMmgN0FTQLjG0DTQdNBboBmgmWpO+AaVHG4LagdqD7oR1AF0E+hm 0FPqs/Ag0GDQENBQ0NOgZ0DPgp4D/RP0POgF0IugYaCXQMNBL4NGgF4BjQSNAo0GjQWNA70Keg00 HjQBNBH0uvrMPUfNiQmqz2JCoLD6jCzMFXOA/LvEGjoPuJxLr9FANYmeAg0CDQYNAR1VybCfk2E/ J8N+Tob9nAz72YP97MF+9mA/e7CfPdjPHuxnD/azB/vZg/3swX72YD97sJ892M8e7GcP9rMH+9mD /ezBfvZgP3uwnz3Yzx7sZw/2swf72YP97MF+9mA/e7CfPdjPHuxnD/azB/vZg/3swX72YD97sJ89 2M8e7GcP9rOnvXCxb8HndyoTNmsmbNZM2KyZsFkzYYdOhB06EXbnKtidq2B3ruIzVYZ5PzL61tFW flhtxWy2HrPYJLGC6mC+3IIZbARsuEmw4SbBhpsEGy4TNlwmbDhtPyXDfkqG/ZQMm8mDzeTBZvJg M3mwmTzYTB5spEmwgybBTpkEm2QSbIhJsCE82AiZsA082AGZsAMy5dkqWZ5j/HFmQvfXunwy9Oxk 6NbJ0IWToQMnQ//1oP960H896L8e9F8P+q8H/deD/utB//Wg/3rQfz3ovx70Xw/6rwf914P+60H/ 9aD/etBXM6GvZkJf9aCjZjr9UffTCL+rvaYpD/qmB30zMxiP8XSHmggdcyJ0ylXQKVe5g1WGOwQ0 VGVE4tXWSFVQAqgOqC7oGcTPUFuJY1b5APM69Dgxny4WC6irWEwtxRJKRP/OE19Bk/qamojldCP6 +kbY9QFoDJfDto8Tq6kF+n0zNIfa0HNSEZtGZ0NfuBH6QmORQdei3q/8texz0NKXahbyjzNtzkHa A9AqFlAM4pbhbIX2S1ncly67n9qU7E8X/DTH6LgUrbbDfHg9eIjGNMdseRixV2G2XIDZcpfxUbxb /xslYmvi7HKzplgNeRuBB/1fBDvoXOQ4D2crqA2uMB5ptXGt2uvbHepn0Y9ag/+vrMugr3HEfI+z H5EbcxN0wiycpeCsN0Vwdgxn31MTsqgNBUA2SIIcUBAUAoVBLigCikGLHamq6AQdrxuoN65pAfTA JdAzv1QrrX7UxuoPGgB6HPQE6EnQQNBToEGgwaAhoKHUBrZ8G9jsbWCzt4GN3gY2ehvY5G1gf7eB 7d0G9nYb8/8XEWi32WgpBVexQyzGndT/ZvKlmgvtdjeuvR/6ZD74+gK5cLW49gjFsV+oAVtJzdAz 3dAPfxWdkKszdRbdjI+5zqK3+lJ7JRIDVKoYT63EBLoQ7Xi4042gycy2LqYWVmtqht7qTLVRojba aYm72Y/qoqU9un3TUsT/X5PvRBeU7or8PXC8C8d+kLBf1AboyJnQj48a+VlLDkoJsvU/oSB3AnIm IGcQOT3kyKIESgOKQoei7dCb+qIlfU8HqFXQuzNx1ysBcVea+lbjDq5BKdSpNeJAnMqFDZ8LGz4X NnIubORc2Mi5sJFzYfvmos2OKkN/8YQaz8ZIkaa2NSqbqhVpswswqweoD66tHzTxFWofuMvCdXiQ uKpo+yBKLUW7YbR7pNR2w2g3Vf83C2qLQ7sB1HgQNWaixmzUGERt+/yryMU464hY7S+wCzT5HqC+ SOlH1VEyCI5tlDyEkrkoGQEvebrXUDIHoyKNrqNtoO2go5DsY6AcUC7oONChIyyXO1Qz0QVo0ZW6 ix443oVjH9g+fcHPADVDDIJcjKeLIA+Xosd/QYutzb35Vb1pWlut1mLMxcPKOebLSAsLdVt5IEVN AnF0newE6gzqRk3kBNBM0BacbwWlgsCnzEJcNo6HwJv2/5gFzo7imo+Cs7Nx3UfB2dm47iRct0YM B9cbwrWmi3UUa6RuIUp8hRLbUCIJJbahRBJKXITcseB5h5G8X1UO+D6CkttMqdXmfwk6ob3OkORu OHbHsT9QMZXqA/GygDEhIGN1IGNl4N1C8486+v4lI5dATBbuQ0eE7jBjQ3vDSxCPQaoex3y3A3xn oMWdyjPytgXltqFcCLU7qJkjJZmqU0+1j+4F3Qd6DHe/I+5nJ/DVDdQfkqlzp0FKdqCn08HTTtiX u1DLbsyTl1G1QKzaF8gE7VH77N6gPqCHQA+D+oMGoN4Y/z+B1qPmZNScLB7DVfUH5qfiPqZBirZh BJmrBQ5noI92qp+MLV4N/OWAvxzwl+NfvV5T3oRaNqEWjlrOBo+xqOUwaslDLdrTvIMatur/IwJ/ OeAvB/zlgL8c8JcD/nLAXw6dSz2pHd0Lug80kK6mp0CDQINBQ+hqtFgJLf4FmBVAD98MzAqgl28G Zr2Lnv4IPf0F5PQ7yOn1kNN24n01Btf0I2aIxlFuMG9pbjKgTVxMrSGjra3L1HprKl1tTQNNp6sD sdQusAXHTBz3gPbS1fZZoFag3tTO7gN6CPQwSPPngKtDvtxwX264uVe6B3eqdLMaMRt8v+PnSvBz JYBvDzlbmBWInWoVJKN33tewBffA9tsCW28PbLstVtO87ZC13nkeYrMQk2U1VZej1t55m8Qh9HMO SucCG46r5VZAHYZdeMQKq2zkXI6c15qyXyJ1JWJWIiZkynriGNrLQa8cV2tgY+ZZQbJRNg+51sCW zEPONsCl3nk70EoerNRscJYpjuKYg1ZzIZnRkrloNQ/WaTY4zrQcHEPgIoz4aE25uIKDkLresGsP E0MtWaglD7Uo1JBh2raJoXQWSuehtELJDJ+Hs3Q/5Y0GD6ko3QClN6L0IXEMI1Zznws5Pg6Jy4Oe oNRx8JKK2hqgto2o7ZAVVKvNVYVxn12KhaW8CzUfB0//1rOo4qjxCPhIEXnEUeoI2k6xIgg3VfV0 jrwVyJGO9nRPJSNHOurUvZSMOvaid0+4X7j7/n1C6VLuj8lr7gvylnI/cI2neR+Ap+Xsf6DMGe53 XONJ+tuklNjPFGPFU9CqCv4SKWQlobYaKFMTOkMthGsjrQ7S6iOtIc4bIa0x0ppgPrCsBLRQA6l1 cWyEe+Ja8TiDDWFVQ/tJaKEGWtJ11UZ8HcTXQ3xDxDdCPOrBXdC5dcs1/By6JV1XHPjiSN1uJSCm GiiRaoO/OOTcjjprgz8O/jhKbbfqIr0eqD7iGyJPI8Q1RriJ/ldy1JICXvUVcqs6eE2igF+LLp0C /vUVcqsB0hoiLVqa43rjQVUhewngORH1JuFaauDu10RbtfR1Ib0O0usivT7SGyKuEdIbI70Jrg9X gXtTFfUmILYaKFGtBQ956J1UqybuZS1cc23kqYM8dZFeD1QfeRogT0PkaYw8TTCz6fvkmn5NpHjw oXvsCPiIBx9h8OGavq2P84amB4+Ah3jwENZ3hYS59iS/n6Pc694T5rqjJbJ8rjlVqqhMYNR66L8T 5AKj/XyKlFc2UKoZyZPJB1IbUZUzJSOo7S+46grKCUo3pcqnKyuo5WJ9RWdGXnAnfjD3sUIyY+aG SHnlxqB6U3EobyeQtAcQpyZQrb04lpcFVLtG5ObtAvr0BKrVBaq1tgJ5O4GoPYBGNYFq7a1gXhZQ 7RornLcLyNQTqFYXqNbais87hB45Fz1yFnrkLCsR59XVX9AjMeCqOXqlMXqlkVUb8XWQry7y1APV x3kD5GuIfI2QrzHyNYHUBGG5ubC52gj9vz5fUxVou/HQdBtCq7gIusJSaHuVzH8LzWfd6BLWg65l d9HL7G4c74Hl3lFNFrfBFrldzYfmMdn8U91Zp8i11OTS/4G0zsTmn80pOOOw5BexJWqOCel/t0tF qBKs5HOJqDVs0rPpSvyaUVu6hZrTbXQ7Yu+ELncp/YNG0A00kt6nh2k+LcLZEvzG0A+0lsbSevym Ugqsk2mUjhrfYzVYDfqV1Wbn0irWjrWnNNaB3UrbWSfWhXaz7qw7eewu1pOyWG/2EB1g/dlEOsTe wC+JTcavBpuCX032Hnuf1WJL2ApWhzfjLdj5vCW/kLXgrXlr1opfztuwC/lf+dXsYn4tv5Zdwv/G 27JLeXvenl3Bb+a3sCv5bfwOdjXvzDuz63h33p39jffk97LreS/ei7Xl9/OHWDvelw9gf+dP8BfZ 7fwl/grrxUfx8aw3n8hfZ/34TP4fNoB/zJeyf/Lv+Fo2ga/naexdvpPvZh/zLL6XzeX7+WH2GT/K c9girgSxLwUXgn0tpIiwpaKSiGM/iXgRz34RCSKJrRT1RH22VjQUjdh60UScxZLFX8S5LEWcL85n m0Vz0YJtES1FK5YqWotL2HZxmbicpYsrxBVsp7hKXMV2iavF1Wy3aC86sExxq7iDZYlO4h6WLXqL PixP9BWPcxKDxCBuiyFiCJdivJjAHTFbzOYh8Yn4hIfFPDGPu+Jz8TWPiOViHU8UqWI3ry8OCcX/ YgWsGN7Kirea8iusy6zLeEern/Uiv80abn3KH7A+sxbx8dbP1gr+pvWrtZ1PszIsxT8JhAIh/lPA Dbj850BsII4vD6wKbOArA78FtvD1gbRAGk8J7Ajs4JsCGYGdfHNgd2Av3xrYH9jP0wMHA4d5RuBo 4CjfHcgJ5PDMwHE7wPfY0o7hh+xYO5bn2XF2Va7sRLu2EHY9+/9EyL7AvkDUsi+0rxO17Q52R3G+ 3dV+VrSy/2m/ILrYL9kvi+72KHuUuNseY48V99iv2a+Je+0J9mRxnz3NniZ62zPsGaKP/bb9tnjI nmV/LB6259oLxRP2YvsrMdT+1v5OPGcvs9eI5+119nox1k62k8Wr9iZ7s3jNTrd3iQn2PjtXTJIk uXhXSllXvC8by5biG3mxvEysklfIK8R6+Vd5ndggb5A3ik3yZnmzSJO3ylvFNnmbvE1sl51kd7FD 3iN7ikx5v7xfePJB+YTIkgPlEHFcPi2fsbh8Qb5oWXK4fNmy5Sg50XLkG/INK05OlpOtKnKKnGrF y5lyppUgZ8kFVjX5tVxmNZUr5VrrfLlR7rcukNnymNVe5kpl3eo0dhpbdzhNnbOtO53znPOtLk5L p6XVzbnYaW11dy51LrPucq5wrrDucf7m3GD1dNo57axezo1OB+sfzi1OR+sB507nTquPc4/Ty3rI edh51HrMGegMtAY4g53B1uPO086z1hPOi85L1lPOy84Ia4gzyhllPe2MdcZazzjjnUnWs867zr+s Yc4sZ5Y13JntzLZedvY7B6wRzkHnoDXSOeIcsUYFAXzW6KAVtKyxQRkMWeOCbrCaNSFYPVjdmhGs EaxtzQzWDda1/hW6JdTJei/UI9TD+k+oZ6in9VHoH6H7rY9DD4YetD4N9Qk9ZM0NPRJ6xPosNCA0 wPo8NDA00JofGhQaai0IvRj6wFocWhL63toeWhP6zfJCm0LbrUOho+EkKy/cIDw6UDc8Njw9MDI8 N7woMCW8Irw/8K4r3cTAj+457jWBFPcO9x+BI+6D7iN20O3r9rMruQPcJ+w4d6A70K7qDnKftxPc Ye5Iu6472h1tN3HHuq/aTd3x7jT7HPct9y27lTvT/cC+0P3Q/cS+wp3nLrCvdb9wv7DbuovdxXY7 90v3e7u9+5P7q93RXe2utru4a931dlc32d1s93C3unvt+9wD7hF7gHvMzbUHuXkRsodGeITbz0as iG0/F3EiEfuFSGwkwR4RSYwk2uMiSZGa9quR2pGG9oRI40hje0pkaGSoPTXyTOR5e1pkWOQV++3I mMg4e1bktch4e3bk9cjr9pzIpMgk+z+RNyPT7Y8iMyLv2vNieEyMvTAmLqaavSymRkwte0XM4Zhj 9q/EQ9DfidyrKt9ETakunaFNzVdpagc1UxkIbywxR56apD7EL0sNx9lNqjPKLEUow0/PULuw3+qf HSpWXqfuUtn4/Z4mS2jnAOjVUvl9CvRFkZhNaCFBt3LSDZYX8m1QOQi7mMm7UATnaUV5zL+aEtr8 SW1RnvoZNaTiatNL47EMm4Nax/u1b1OZaqna7p/tL9b6blCK2qxWqSPqBgqi786meoXS80prTB3E vctGDb9zjv6HxhJNfVu9TS6o4B6eUHoPaLtKRh2bcBqAntWYLkeojkn9Ri1XayE/kB3Y7SW3/756 S03BcRiojTpP9Vf9ECrUj/lXj1BmsdJ56luVDgn6Vv0IPnAfdO8VLVWQ96dSuoJgpxLFmNBIP8ZD 3T/ny2ZhqfBjsnHl+9H3G9UB6PuVENUSd6GgdbXb3KHd+bmLlc9UOzHGvPwe1yuj5vhb4Tyl8e3n Sy5y9miRs+/LVge25ia/L2lqHe6fo9aV0vLhQmO7OV1USu4P1L/0iFbflpmnouV3aOnQMlssZU0Z SuPK1AsmNPfE8azuLkN5yIj6xODWJn3fyrup9wyavod+Lb45ZaohS803qFlGuSihhv1ll6oSSvsI q36tUOk5Zr9OI8cZ3/6vDO3viM5lKgdydKDcLbinTG0C+rtpJX/G2xr9+el1SihzFn518DurCJfv +McV0d8pyjcvsbzfu5CSg0CngydjGPi5R+0Dgm0xY0pL9RETP84k11ZL1CK1Ws/oJymfWyj8MlUH /t9OHfQI8eNSMDcsKI7FBWVyCoVHY+apRNdTD4Rn+3Fp6L2VJ59V89s3Ev06ygeBPn19JNfxH6kP Sah5Jy1/ohQGoD31Qvwrfvr36jv0/w/+WXH8PlYoPBylq1N70ppQGz/uC/U5avj3SdvfVnJ8Hu6Y xkd1s7pR9VQd/NxTi5V/Fij2tvq3+kWtLhTNqSs9RyMQGkmj9Dcz9AEkdzbNg3a4gBZRC7Oq0Iq+ prV0IW2g7dSW0hmjO1gP1oMeg0X/d+qnbXkaoK14epw/wPvQk7DH19NgvpGn0RCewTPoRb6L76Zh 2jan4fwQP0wjeA7PoZHaNqdR2janMbDNwzRO1BF1aKLoIrrS66KHuIsmWXOtuaStWkVTAnGBOPrJ /tT+lH62v7AX0XJ7o/0b/WIrW9Gv2qajVdqmo/XyJnkzpWibjjbDprudtmibjlK1TUcZ2qajXdqm o93apqOj2qajPNh0LzOCNTeG2XKcnMiC2qZjlbRNx2K1TccqyxlyJquibTpWVdt0rDFsuv3sXFhz inVwhBNgnR3HCbFujuvEsLucyk4V1tOp6lRjvZwkpyZ7wKnt1GV9nAZOI/aIc7nThj0Gq+1e1h/W 2TD2BKyzl9lAbX+xp7RNxAZpm4gNDj8VHs2e0ZYOm+DGuolsgfuB+wH7xk1z97Kl2tZgq7StwTZo W4P9pm0NtlnbGmyLtjVYmrY12E5ta7C92tZg+7StwbK1rcFytB3BcrUdwY5rO4LzmGBMmMuYqjHV eCjmSMwxrp8prDMSw4zEcEjMeFgUE+gNyPQkmomYt/GT9A69j1lqFuTJNvJkQ54WYtR9AakKGakK QaqWIf4HWk1hWoMfh5SthVa9gX6DdpVCqRhjaZC5epRO+zDi9+NXnw7QYWpAR/BrSEfpODWiPEhk ZSORtYxECiORrpFIFxLZm2J5H8ila+QyDnKZQgl8E99EVfhmvpWq8VSeSok8DfJa08hrDSOviUZe qxp5TTLyWoUrrqiKgPpP8ZBajj02qgrZlQjj5lN1EYQcxxs5rgE57kKNRVdIcxNIcw+E74JMNzEy XQsynULM2mRtJ27tsNLJtjIsj8JWlpVNta2D1iGqZB22cqmOdRzS38hIfz0j/bWM9Ncy0l/LSH8t SP9fKV5eLa+msLxGXkOWvBbjIYDxcANi2sq2iGkn25GU7WV7cuSNGCcNME5uQtmbMVqCZrSE9QoI ReTtGDMxGDOdqZ7sIrtSJdlNdqNGsjtGUWUziiqbUcQwih5Eqd7yEeR5VPZFzGPyMeKyn+yPVgbI Aaj5cYy0MEbaUyg1SA5C/GA5GPmHYOxFzNhjej0FeYbJl9DucPkyUkfJUYgZLUej1Bg5BnnGyfGI mSAngJOJciJiMD4ppMcn6pkip6DUVDkV8TPkDNQzU85EzllyFmI+kLNR9kP5IfphjvwEPfOp/Bx8 zpfz0ScL5AJw9bVcCm6/lctQ50oJyZRrJGRSrpPJqG2j3Ex15RaZhj7ZJjPQ1k65i+rL3TITPblH etRQZskstLhX7gfP2TIbOQ/Kg0g9JA8h/rA8DE6OyKOo/5g8hppzZA5qzpW5VEUel8fRep7MQ1kl lf5/VSdAtTSaYA80wR5ogj3QBHugCfZAE+yBJtgDTbAHmhADmryI/TBnGHGNKWRpTCGmMYVcYMog 7AeHhlKsRhYSQJa15IbXhddTJLwhvJ9iNcqQ0ChD1YEyaVTF3eZuo3h3u7udIu4OdwcluOluOlIz 3AxKdHe6O6mmu8vdg7Dnesif5WYhz153L/IccA8gnO0epCT3kHsIeQ67R5DnmHsMqTluLoXdPFdR YkSb1lU0fmFvRSzsAxGb4oBiDlWLBCMhqhoJR8LI6UYiVBO4VgUx8ZEEStLoRglAtyTsa0RqIk/t SB2Kj9SN1EU99SL1EW4QaYD8DSMNEQb2IR7Yh5g3I1PQytTINJSaHpmOmmdEZqLOtyPvUlWNhiQ0 GlKsRkOKBWL9x0fD0fgJg4YBoOFEhCcBB4XBQRso+AHCs+kz7D8nSBvQcAnCXwEDBS0FDgrg4Bog 5lrgqzDr947BQWFwsKrBwQSDgyGDg9UMDiYaHKxucDDJ4KDLKrFKFGGdWCfse7M+2D/M+mLfj/XD fjgbThGg5M3EDUoGgZI9sdcoGTYoGTQoGWMwMZ5n8kyqbHAwzuBgFX6cH6dKBgFjhSUsigP2OQiH RIgqi06iE9UUnc2bbBr7ahnsqyO6iW6I727ebtM4WMvgYB1xt7iHahTgYDoJIGA2OcC+XAoZ1Esy qJegV20xPq+UV2L0XiWvImEwzpHXAeMsYFxbhDW6CYNutkG3RNlBdkCMRjchb5G3YH+r7IicGuMs g24JBt1CBt2SgG49yJV3y7uxv0feg/z3ynux7yV7Ya+RzjFIF/KRrp/sh5j+QDrbYJwjn5RPouxA ORD585FuKMJRjHtWPoewRjrHIJ0wSBeSI+QIlHpFjkSMRj3HoJ7ro95YORbxGvscg31JBvWEQT1L vgnUEz7qTZPTEJ4upwPR3pJvIb/GQWFwMKkQDgqDgw5wcD7CUexbKL9E+Gv5C/Ya+xxgXzLCGvWq GtRLMKgXMqhXzaBeokG96gb1kgzqufKAPIBSGvsSDPYlGuxL8rEvFxgnDMa5DnMYiShahZ4IPUnB 0FOhp7AfHBpM4dBQYFM49EzoGcQ8H3qegganeHhs+HXiBnHi3T3Amlh3n7uf4gy+xBpkiQeyHEb4 iHuUKgFT8jDONaZUjoiIoEpAE0kxBkfiDI7EA0HiENYIUiVSLVINeTR2xEdqRWohvo6PHfVQg8aO OIMdsQY7KhvsiAN2vIk6p0amotSMyAzknwnUiDOowYm32KtXXi/c8ddWdAPdcTI9//+PTWWonZr8 sy0l2V16nces9ZW37m16hctY3kvM+cb8Ns3+F9/6zNT2p7FFk1WqSi+6olN6u/krdOqR8nN4ZjfV FpanPp7U9i5WIgOW9ncVX5cpqCfzxDO1z+z9eNiK2ejZVOWBClb2Clmi8YVKJyPXetLrHtUQ8lcY 863rP2gLFXBTuF2X7jRxu0taXVC7iq/Nqf1qq9qAlGJPISq65a+SFz3T48eX6kLrBeBdFIQzT3aX 1ebiq5pnaiv5CU6ppWaq6eaYa1bDv9ek14fUewgt8/PkS5YewQfVivz4crWzzcho6u/nehVMpRTK 8YpZD9Jr5ZtNaBu4KYxQfv+W9f6aVevU0vOVf4OkFapXHVK5oGN6rUsdL5LvVM+l/se2P3jMl2FT k0+j8E0l1JdKTSGDtU+j1lNvTclgq8ZTg6klbsCGMj9DPP254oT6inBVeOyVsfxHapGa4z8fiFdT 1SITm6Zn98Kzd4X0h/XAxi1Gf0g3uolBMz0nqS04zvJzeeZ52w+gpfilF125NkhWnfLXZr/BXLBM rQRNRuwNapX60cSvjmoR5on2neXntBjnO4ucmTlU/adQzANqhuqjXtKr/KpvQewliPtMj7viTx1J P3Mt/ix0l1qCa0k+cyM1Xx70PAYEy9cLl5H/fLYwD8Dlgmcj+hlLKTX/fKZ4rOiGXoqY4xj9vLlY aj/1TZG80WMKZrc0LSEVaG+Nlnqjb5l+0iHMb1v8XsNe3a+Wm/t9mEQJc1iEmhWr08M42OM/XRJA jvynToejqac/v/3+HLro88p8LUXrXmbe3oafV0z33Gx0zxJGO0bzGcaukrYT8GxVsfTcE2P8+EdL jqfyPEcv96buK2eB6DsWw9Tz5phlEOBjTQj9S82Nhkxavn5mnnfiTn1eAe4+Up8BMT/1z75R75N+ P2ieDoOAnECxb4AS+VpwFtD3Rx8nos/PYorV+Z36VC3264zXZ358EXRQqvzcmnIYpWpDwVm+7bJV h/LtyqgmbhBtmZaP6Dsi/vjZbxC5q7rJnC0m/TTvEdDjCI1WEzHXPe7XUujdFvTAAjWwAtzepQar t1QfhL7CqH5L9TL48Apmo7fQz4vVZPUPzK1Z+hmgubL5araaFm3ZnzWS1Fcn1Jmu1sKqjI7cCwpC vt6pjkap7BpzkbqzzXgveCuo6Cxl5ukCy9dovlvMew+F37g4r+gbK3/UVvQprnmDaU/pnJgrKvb+ 1R+xFbVkda9Chg+Uhp/m7pwxS7c8W2H9A6NBW1nrcDzJk+6CnLtOn1/1phqk/qkmmPAKyPt0/aaM Pw9F9cWD6hPQotNrx9TULPomy2nVkaZ2YCY08yPu6Q7IYYHOHb3rai90jr0laYDlbqsCOneh0j9G 7yp40Tj4s3+22R8/Ptd/znguaVP3qXvVQjWXuDkbrAYArXtENQI1Tx3B2Qj1qLpYNQCOtlSPq/tP o62o/lj3tPj1MSlq0xa8bzi9aOqZ3NTMM1CHlt61UVSHflvs7pv0VPXr77Pwn7uBm40Yc2bNEzKs LcUCSyWq6SL1O9BJ3lX9ozfwO7LwyIV+Nf/P5OfkG0ZbP607Rd90VY9BO1qN0RdNW2z2G9XnqrN6 CaFR6rdoXAXb+u70+S1ni9mF3/P6390KdNz9p/92ZUnvup/JLaodQv/ejlnvDKxYlPaO8inLllGi 1IdmbX93xVsqtFU/I7WUaYMudNqaqxpzJjgppQ0f6aDdnva6/Bm6S6W1kgbN9r88Us7cBq0n+4z1 TNxp8HEmxvsf+DyiItIIvSc1WtL/siN/XWS5ec6w/JSFH/Lzzil/u3/0VpFvIIrVcdKnIacoY1br 9UpR1BKOrugUPAsOnco+Nmu71akP2eVv15SvwFdeKt3MHb9/S5a/JldW2y5M15W/1T91S6howfI/ eSL9VoN+Ll1g2asFZr8H+Fzq04j/tQ16/8GTfzNRKN+R/z4vZdvKhpAVndVL/Faq1LbMGwS/fzto nlgUSFaoxEL5efVaVU3qjDH3J2xFdfcoasB6KgVnzZOYP2G9T+07g3VtJX9FucQvjs4yXznpJ+gr SkgtrW79HdXW/JL5IbPCv9WPyW/zEtPWCXwVOnvx9zrzedHfaxXjSn+V1Vw/pamI1a4mq3fU/ILv wPyQ1gj8Nc0VBXw0L8bvO+Vvr0j5CrwppH41TyV+KDg37wBB37TL/KSvDF/vnaTtEr9NLqXMDrNq pWdygwXm7BuMvSgyhE6lX5oZpRJdXrbvNUsoX5H3H1bp7y0NHYqem72/an5qdPCvpWbR940gX/vU SkOTqRp00p3+06Qt0TFtZO2B8nNaynVEn7AVstZVD/W4eldNMX4DCt7pUW3VR+Ws+Zs/RmPWPJ68 HZVX0lPl6BPFE+L2lf4Up6KbeUfGR2a1H/rEfuhH61Xy70ikMhGnnxlfpG4z5x9DAtaqrmqpPleL 1avqW71ibtLGFak7JT++XBx1UH3UM+oG/8yEIIG9TPgdNUP1hRxMhrY2HzOvzjFXfao+8WdtvTqf QM3MM+cnVG8TF30fcQr06jf1/dBeEgreAiqyFqSO5n/NXy5+X1fvwVZ7wz9bbtqebHB+uekD/fR1 jspWX5oM0a/2/TcMfCm+oPyt/lnbf+Vr7OKtbM1HrOhz5z9rq8hzKtzpPVRo1aHAQ0JZ5p4qpN/f ucWEa1JL2J51Tdnt0Dq2m9mkBv2fWoMRqn8papO6GOOlF7kqOq/7dipGZ9Smquaff+Q/qeBU8MW0 if/gFNdh3q1QAzHP+SuQ6krVHdRW3UdVVHQOzvehMRh0jbpEdVT+lw3qe/WbeVtCj9hdmJO2+vbr OdTUzJznmFynXt0oma/pagb27xWcz9e2XJE3K271A53p73QRtTB+YhqZlMLXHsr7VYXzDpuZcqF6 UH2s5zA1RD2nQ6h1eJFmo++APVgBfnurh3H9D5sTB6HeBjefMzP1StzL9Lzol/TzjFeQ/M30rHrM r6MMNl6Jbe8sPU+xMpnmjQCtJxhpMtL8Dc4tk+yeUt/RpSrRpeCe06pS/Nh18v3YPUvXM86qUk/j ne4J451umPFON5x1Yl1pNLuf3U+vGr90r7H+bDhNZCPYBJqtvdPRfO2djhZo73S0UHunoy/Yl2wF LebNeHNazlvyVvSL9k5Hq3gb3oZWa+90tIZfz9vSOt6XP0bJ/An+JP3GR/NxtInP5DMplb/LZ1Ma n8vn0W7+Of+c9vCFfBF5/Bu+lPbxZXwZHeA/8+WUzX/hK+kQX8VX0RG+lq+lo8IVETomYkUc5WoP c6SMhzkyHuYCoqFoyKTxMOcYr3Jh0Uq0YhHjVS7GeJWLNV7l4ow/uSqik+jM4kU30Z0l6G/lWKL2 +saStNc3dp41z1rEOmmvb+xu7emN3as9vbH7ArGByqxXID5Qnd2v/b2xhwO/BbayAdrfGxuk/b2x wdrfGxui/b2xp7W/N/ZC4GAgh72ofbyxkdrHG5ugfbyxqdrHG5umfbyxmdrHG5ulfbyxRdrHG1us fbyxX+yu9gtsnfbuxpn27sYt7d2NB7R3Ny61dzfu2NPsGTxG+3XjcdqvG6+i/brxmtqvG2+g/brx JvYyez0/S3t04xdrj268tZ1u7+aXao9u/Ert0Y231x7d+E3aoxt/QHt040/q7+P4EIc7nA91bEfy p52wE+bPOpWcWP6cE+/E8+edRKc6f8Gp5dTiw5x6Tn3+kva4xl/WHtf4CO1xjY9ymjvN+Rjtd42P 1X7X+Djtd42/5lzhXMknaL9r/HXtd41P1n7X+Jva7xqfqv2u8bec+5xefIb2u8bfdvo5/fi/tPc1 /p72vsbf197X+CznJeclPtsZ4YzgHzqjnNF8jva+xj/S3tf4x9r7Gv9ce1/jC5yPnUV8obPEWcW/ d9Y66/hvzgZnI9/kpDjpfKuz0znAM7VXNn5Ye2XjRxwVZPyo9srGc7VXNn5ce2UTLFg9WFtEtD82 USVYP9hUxAfPCZ4nagRbBFuIOsELgv+PsvOBiuq69/1m/pw5A4c/IjGIhBBCkCAhiAQpAkFCCCGW UEOM1xpmGIaZAYZhGGaGYWY485fRWmuttYRar7XWei2xxlprrfV5vdZan/F5udZa6zXEer3WWq/P eq211tr33b8h1natt9Z7svZ39tpnn33OHIbf/nxZi68vKXO1C7WLlM9oa7T1ygJtg7ZBWaxt1DYp X9A2a99Qlmo/rX1TWaZ9R7tc+ZLWpnUoFybmJuYrq3m6m3IxT3dTvs7T2pTNPK1Naedpbcphntam DPG0NuXnktqSOpXv87/aU/6Ip7UpfyxppFTlKZ7Tpvy59FnJorzFc9qUD3lOm0rFc9pUGp7Tpkrk OW2qJJ7TpnqC57SpsnlOm+opntOmyuU5bap50nbpfVUxz2lTlfOcNlUVz2lTvcxz2lR1PKdNtZjn tKle5zltqlae06b6DM9pU7VJv5Iuq1bwlDXVSp6ypnqXp6ypDDxlTWXhKWuqXp6ypupLUaSIKluK lJKicqWkp2SoPDxZTeVL+UPKH1RyKktNUAWYIuEyql4KHF8qS2MJbAa+lCwd+7CKZWLvVmNXfw7j BfjSsLnYBUVWjCqpRT1cxCTUQ/7/PNTS/4DBK2YKVcxUVMxlOOsdfM1A3XwXK7azTlbHjKihi1FD HSCHQXzVMyfzsCfYML5mMS+TceUAKmwmKqzEZickJ6SwLPoL4TkJaai5L6DmzsVIYUIhK014PqEI 4/MS5qFfjFo8m2rxfNTiN6GtqMivUl7o7IR3UZfLqC6XUV1egLrsx/hIwipWnrA6YTXW/Bwq9RxU 6i+yioT1CV9hCxPGULXnU9WeT1V7PlXtUlTtb6M/gdpditr9E+wHxxOOs0UJP034kFUnnEI1r6Fq rkA1L4e+hJouUE1Po5quoJqeRjU9g2r6K1TTX6SaXkk1PRs1/dvsacWEYoI9pXhf8R32jGI3qnwe Vfk8qvK5qPKHoP8DtT6Han0+1fqnUOv/F/Q0Kn4uKv4k9N9Q93Oo7udQ3X8WdV9izymTUf0LqPoX UvWfi+qfyYqUs5Wz2TxlljKLNfCdAH3sBOx57ARzoYXK53EW9gNWzPcDnFWlrIIuUi7C0RplDbRW WYs52Bug2Bswwv/W+jX6W+sm+vvq1+jvq5vob6obsU8EWK0qqFrFErBbrGepqi+pxtinVO+pxtlM 1VdVW1iV6uuqb7AnVdtU32GzVbtV32dZ2FF+wMp4migr5/sKq+b7CpP4vgJNU6exxeoZ6hlsPt9d WBl2l7NMqf65+ucsV31OfY6lqn+h/gVTqc+rf8nU2HUuYuQj9UcYmVJPMY36Y/XHTFRfUl9iT6h/ pf4VS+J7EkvmexJmXlNfYzPUv1H/hqVjZ/otS1DfUP8XrnhT/b/ZTPUt9S32JN+rcMXfq3/PMtV3 1XdZjfoP6j/g3u6p7+F+/qj+I/r31ffR/5P6T6xW/Wf1n7HyQ0HBZgpKQcVqBbWgZgnY4TQMm4Ug smRBKySyVCFJSGJKQRIklikkC8msRkgRUjAHuyD/X92FmTg3Q3gC52YKszE/S5jD0oVs4SmsnCPk MJ6A+gw0T8jDCs8Kz2J+vpCP+c8JhZj/vPA8e1IoEoowPk+Yx1RCsVDMUoQXhBKs/6LwIs4tFUqx 2nxhPuaUCWU4d4GwgEl8x8W1FgoLMV4pVGHmImERVqgW6phaWCy8ipmNQiPTCK8Jr+Ge3xQ+g/e1 VHgb678r6HH1DsGAq3QKJqxjFnpZnWAV+tliwS44cUWX4Gb1wpCA6iEMC142S/AJPtytX5DxXgJC EOuEhBBWCAthrBARIixJiApRXGVUGMWcmBDDVUAAbA4nAFYKAvgSKxc2CBvYAs4BbDY44D0cHRfG WZbwVQF1QPia8DVWLWwWNuNpbxW2Qr8hbGNlPAMW88EKWOF94X3oLgGfUmG3sBvnfiDsYa8K3xW+ i5X3Ct/D0f3Cfpz7A+EHGD8gHMTMHwmHMPOfhSM4+i/CUVYBwjiO8Z8KP2Ul4Iz/ifknhZMY+VD4 EDNPCf+KmZPCJO7n34QzmPMz4We4w7PCz3HP54Rz7AXhF8Iv2ELhvHAe54JRcNaUMIWVPxY+xlm/ Fn6N1a4J1zH/t8JvMf93wu8x565wF0/jD8IfcG/3hAdsNucYtgAck4x+imYGK9eka2ayOZoMzZOs QpOpyWYLNU9pctl8UM5cVq0p1DzPXtcUaeaxRZpiTTFGXtC8yGo0pZpSrDBfMx8zyzRlmLNAswBH yzXwjmCjT7GXNFWaKlxrkWYR5ldrqnG0RlODa/FMgQTOTKyMMxMUzAQFM0HBTFAwExTMBAUzQcFM LIszE5vDmQkKZmIvcGZCH8zEqjkzsdk8q5aViIvFxTgL5IQRkBPmgJygICdWwcmJLQQ5wQmIZtHM asBP/SxVtIsDmAOKwrmgKIyDojAzKAaxTkgMoR8WwxgHUeF+QFSY/0Xxi6xcXC+ux1ngKrYAXDWG kfdEfOrEcfFr6P+T+E+41k5xJ3udkxZGQFoskZMWFKQFBWlBQVrQ34i/Yy+Lt8XbuMp/i/+NdUBd rJRTF/p/Ef/C/+8tLWOvahO0CWw2JzA2BwSmgYpakb2kxT9Wqk3UJqIvaVOgqVrsv9o0bRqr0M7Q pmNkpnYmq9ZmaDPYAu0T2idYjXaW9kmMz9bOZuXaLG0We0E7RzsH/WxtNq7ylPYpHM3R5mAEbIc+ 2A53AraDgu2gYDso2A4KtoOC7aBgOyjYDgq2g4LtoGA7lsjZjr0MtnuLpSW2JbYxIfHtxLfRX5a4 DP13Et9Bf3niCpbByQ8jqxK3M0XitxJ3oQ/+Qx/8hzngP8z5Y1ICUyQpkrLYK5wCWWU8u4FTIFNw CoSCAqGflT7LnpJWSitZrvSu9C6bIbVL7expSSfp2LOSXtKzPKlD6mBKySB1oW+STJhvlsyYY5Es mNMr9aJvlfpYvmSTbJjTL9kxxyE5cHRQcrIckOUQxj2SB+PgS6hf8kNHJJllSwEpyJ6RQlIYMyNS BDOj0iiuuFr6PEbWSuuwMhgUV9kgbYB+WdqIOWPSe7jncWkc63xV2oT+16SvYf5maTP6/yj9I9bc Im3B0a9LX2dzpa3SVvY8J1dWCHLdzuZJ35K+xRqkHdK30Z+QJjDnfel9HP1A+gC6R/ouK5b2Sntx 9HvSPhz9gXSAFUk/lA5i5EfSjzAC3oWCd6H/Ih1lz0k/lo5hzk+k46xA+qn0U8w8IZ3AVU5J/4qR SekM1gQNY/1z0jnoL6TzmHNB+nccvShdxDofSVPofyx9zMpByb/Capely2wuZ2WWA1YOs+zkSHKU 5SWPJuMpgZtXs+LkzyXjWSWvTV7Lnk7+QvIXMPKl5A1sXvKXk7/MGjhPYwQ8zYo5T7MMztNMwXka Cp6GgqdZBudpVgayqyOebiSeVhBJx7n5E2LmfJxCfJzC/gFfKUTGTUTGzUTG6UTGS4iMZxEZP0lk nElkPPux/B415feIlN+jpvweNeX3JFJ+j5rye9SU35NM+T1qyu9RU36PmvJ7Uim/R035PamU36Om /J7XKb/nDcrvmUn5PZ+m/J4Wyu95k/J7Wim/JwukngRuTk5IJkafzV5KyErIAkNzUq8Eqb/JqojF 30p4O+EfMM5ZfFGCKcEEwnYluKDuBC+42Q8iXwgiX81qwOKfQ//zCZ/HfE7kC0Hk77E6sPhmthgU vg/6/YTvs/qE/Qn/jKOcwt8hCn+FKLyBKPxVUHgpUxKFKx/jbyX4+xXi79fB328QhfOEIRUlDM2g hKEZlDD0BCUMzSBG/wwx+qcUn1OsYbU82Z+1TZM65/J5ig8UH7DnFQfA5c8SkT9HRD5X8aHiQ/A3 Z/FnFGcUZzD+c/D3M5Ra9JTil4qPQOQfKz6G8gSjYkp1K1JcUfwnRn6t+DWUZ7vlULJRvuK/FDfR 5/lGBYrfKW6jz1OOChV/UjxAn2cdPa14qPgLy6HEozxlglKBPs89KlCqlWr0efpRHqUf5SuTlEkY SQX9lxD3lxH3lxP3L1XOUWZjnNN/ifJZ0P+LygLQfwnRf6mySFmEfrGyGDpfuYAtgBNYiH6lspK9 oPwU/EAJ+YH5ymr4gRLly8qXsT73AyXkBN4mJ7CMnMDb5ASWkQdoBP2PsRRw/xaWTsSfScQ/h4i/ UrUfxL8IxH+M1ah+ojrF6on7Gx7LZFJTJlMqZTLNpEymVnICzeQEFlM+0xvkB6rgB37GBPIAGvUv 4QEE8gAa8gApRP8aov9M9RX1FVD+VfWvMcK5XyDif5KIv5mIP52IP5OIf7b6jvoOlDN9IzG9hpg+ nZi+kZheIQhgeg3RvIZofjZReyPxuoZIPZ1IfTbReSNxuYa4PJO4vBEsDt8rlIDIBWLxdGLxxmkK LxfKMb9CqMB8zuKNROFx5tYQZ2uIrZuIrZuJrdOJrZcQW88itn6S2DqT2Ho20fNsYa2wFkz5BeEL oElOz1VEzNXCmDCGcU7MLxExLxa2CFvAkZyVK4RtYOVqYuU5xMo1wg5hAhz/Pih5DlHyW8THNcI+ YR/O4pRcQZT8Fij5AM79IVh5DrFyJbFyjfBj4RhW+InwE8znrFxBlDyHKLmSKLmGKLlBOANKriZK XkyUXEGUXEOUXEeU/CpR8kvCR8JHOMr5OE7GLwk3hFsY4XxcSXxcRXz8lvBQeAhC5WRcTWRcAzJ+ En3OxHXExIs1z2ieY/VExg1Exu8QGb9CHLyYOPgd4uAG4uA5moWahVBOwK8SATdoXta8jDV5olgq ZYmpKUsslVLEUilFTE0pYomUItZCKWJqShFTa5ZqluLqPEtMTVliqZQi9galiM2kFLFWShHLohSx LEoRU1OKmJpSxNSUIpZKKWIzH0sRS6UUsURKEUulFLEsShFTU4pYKqWIqR9LEVNTilgqpYipKUVs JqWIZVGKmJpSxFIpRSzrsRQxNaWIpVKKWCuliKkpP0z9WH6YmvLDkik/LJXyw9SUH9b6WH6YmvLD Uik/TE35YamUH6am/DA15YelUn6YmvLDXqf8sDcoP2wm5Yd9mvLDWig/7E3KD2ul/LAsyg9TU37Y G5Qf1kL5Ya2P5YepKT8si/LD1PAwM1kVHMtzbDH5k3pxrjgX3qBQLATrzxPnsUqxWHwBfqNELMF4 qVg67VsqxDJxAXuV3EuFWCFWQrmHaRAXiYuwDvcw9WKj+Bq0SXwDqy0RP405LWILe0l8E06mRmwV l8IhvCO+g6Pcz9SJOlGH+zGIBpwVT2LkDqcBDqcH1+IOJ0UcEB1YZ1AcxFku0cVeEYfEIYyMiAG8 C+5zqsjbzKHkxgpyONXiOnEdlPucV8nnVItfEVElyOdUkMOpEb8ufh0j3xS/iatzt9NAbucd8dvi BM7inqdG/I74Hcz5QNwD/R6cT5I4Jf4H9D/heZLI87xGnqdevCPewcrc81SJfxL/hHfHPU8SeZ63 yPMsJs9TTW6ngtxOFbmdCm0yHE41HM4MVkcOp4EczivkcF6Fw5kFF/SkNhMzZ8PhVJK3mUN+ph5+ Zi6uUgQ/kwQ/Uw6t0FZBa+BhksjDJMHDvAnl7iWJ3EsSuZfX4F7aph0L9yrL4UNWkGNZmbgSI52J naw2sSexB2pNtEJtiTaoPdEOdSY6oTyLbgZl0c2gLLonKIvuCcqim0FZdDPI+SjJ23wmaU5SHvtU UnPSZ1htkjHJy9ooqU5FbkcFhzMPLoJ7mHnkYZ6XuuBhnpG6pR6QOvctz5BjmQfH0o++XRqAc3BL boxwr/Ks5JN8GBmRAnAp3J88R/5kHvmT5+FP1mDk83Apz5NLmSt9Ufoi5nN/Mk/6ijSGo+/Bn8yF P/kqVuP+5DnyJ3Fn8iw5kxLpG9I3oN+UvgnlzqScnMlS6dtwJvPhTHZh/DvSblZKzmQ+OZMF5EzK 4Uy+h5F90vfZC9J+aT9m/lD6Ica5P3lROgR/UiIdlg7j6DE4k1LyJOXkSZZKJ6UPcfSUdBrj3Jks kH4m/QwzuScpl34pXcD4v8OTLIAn+QirTcGZ5JAzKZUuSZdwXe5PysifvCj9hwTGo3TAYsojLZKu SzcwwpMC86Sb0i30eV5gAeUF5lFeYDHlBeZRXuDTlEeaI/1Z+jOUZwcWS3+RQICUIJgPMAcBUo7g 05RNmkNpgk9RNmkOZQoWUKZgMWWTFiWnJKdinOcLFiTPTJ6JEZ4yWEgpg08nZyZn4SjPGiymrMEC yhospKzB/OS85Dwc5YmDBZQ4mEeJg/nJPck97BlyYs/BiYXIieHzkLwqeRUc2mq4r+fIfS0g37UU vusr6I8lj7NScl8Lkjclb0KfJxcWUHLhU5RcWEzJhYWUXFhAyYUqljDndnYQ8Csp17CPGdOvQNOj mdCsaA40z6PXBPsEXmW0KNoatPVoY2ib0bah7UTbjbYP7SDaEbTjaKfQzqCdR5tiiuBJakx/hZoi OIl2Dv3raLfQ7qI9YKxDgSaipaBloGWh5cbvoaPg//JaHF+ro2y68XMq0WrpGOtoQGuO3y+dsy3+ Hjta0ZahrYyPT78qghepJdj3oO1H//KjsXi7hnZzun8O7c50/368hdh0E9AktHS0TLSc+NxQPs1n HQY0S/w5ddgePfP43CKaxzqcaF60IFps+j2sjV8vVDr9XjegjaNtmT6+ffp4xXSrxhi+jx38/RxC O/rovcTf8360Q2hH0U6gnUY7i3YB7RLa1enXG4+9fjL/Ntq96dcL0+fde+z4Q8YMKrREtDS0WWjZ f33l3z9DHlrh//OrIlT/1+8Vf2+Gkunv9f9vy/rbRp/vNfHr0OcqKz6Prvt4K0er+uvrozXi6ypC TRivQ2uc/vzhmGHJX18NS9GWq2a0X+prHpnUR/sZqUAqQdf0p0PX92dCx/pzoJv786Hb+otGJvlZ gZX6nf2lAUP71b7WkXPtN/qWjVzU7+6vIK1+1N/XXz9ykR8NWNpv960cuaw/2N80cjnen9Z7fYaR a/oj/S2kbdDj1D9O/VP9K6Bn+vXQ8/0m6FS/deQaPytgg1rQf9hnG7mpv9LvgF7v90Bv9csjN/l4 wKlT9TlH7ujv9kehD/rXBLy6xD7vyP0ORf960jHSzVCxowGa0r8NmtG/E5rVvxua279v5D4/KxDs KOg/KG/WpfUFZTzZ/iMy083qi8kC10BMl923VpY6yvqPQyv7T8kSHwmsjY9Pa17fBjldV9g3Lmd2 1PafeaQN/eflTD4e2DCtJX1b5JyO5v4p0ivQVuov678OXdl/C2rovwu19D94pDa7IjDe4bSLgS26 8r7tcn6H154i59NqRdMjQXvGJ8pHAtt1VX0TcmlHzJ5FmvtJn48HJnR1fXvkio619gK5gvcDe3R1 9mL0G/v2y9UdG+xlpJWP+uP2WugWewN0u70ZOmFvhe6xL6P+SrmanxvYr1vSd0iu1y3tOyo3dey3 Gx7pIbshcKjjqN0iN+mW952QW3TtfafpHmykzkf9E3Yv7sTYd1Zu6zhtDz7Ss/aY3Kbr6bsgr+g+ MhwkjZGuhR4f3gA9NTwOPTO8BXp+eDt0anhCXsHPGvV2XxneMxrU2fsuyXqdu++qbOq+Prwfemv4 ECnv3x0+Kpv40dGYzt93Qxa6HwyfkIUeRd+N0bVx1YX7bsvWHnH4NOlZaAr1U6ifMXwBmjV8CZo7 fBVaMHxDtvKzRjdA76G/uu+h7OgpHr4NLRu+B60cxggfHx3XrbOpZE9PrZdrgzdxdItuoy1Rlnua vWlce2LUnwVt9WZDl3nzoCu9hVCDtwRq8ZbLMj9rdHuPzVs1OqHbpLssR3uc3jo5qttqS5PXcA3l 63bYZsnre7zeRmjQu0Rez0dG98THp3WXLVse0+215cmbe2LepY90rXc5fnYwPrp/Wg/YCuVtPRu8 7aTGR/1xbw90i9cO3e51Qye8fugebxi637t69FDPIe+6gEF32FYi7+w56t04epRW2z09csK7CXqa Kx8ZPaE7ZiuX9/Wc9W4l3fFJn4+PntadtFXJB3sueHfJB3l/9GzPJe/e0Qu6SVudfKTnKp481Hvg Uf+G9zD0tvcY9J73JPShd1I+0qvynoMmei/KR/i5o5d052yN8nHdRdsS+VRvmvfy3+ks7zX5lO6y bal8RnfNtlw+35vtvUl651E/z3tfPq+7aWuXp3oLfeyRlvgEeUp3x2aUr3RcsK8l3QC9RP2r9nHo DfsW6G37dug9+wT0oX2PfIWfFThqUNn3B07o7tt65Ot6ZrPLtwyJ9kPQNNJZpNn2o/ItfjRwWi/Y 3PJdvWA/wZX3DXn204EUvWTzyw8MhfazpBf+rl9ivwQtt1+FVtlvQOvst+UH/KzAWX26LRxQ6DNt qwOiodF+D7rE/hC6dEAFXT6QGBD1ObZ1gRRDO6lxIC1wQZ9v2xjIMPQMzCLNJs0LZOjzBwrRtw+U QN0D5VD/QBUfx/xLhvBAHUZWDzQGruqLbJsCWYZ1A0ugGweWBrL0pbat8hmugRuGTQPLA7f1FbYd mL91oB0rVAwYuWLkUnx8WqttuwK5+nrbXtzbjoEe6C7SvQN2PBk+fs9wYMCN3ZP6+ibbgUCB4fCA nzT8SI8NrIaeHFgHnRzYCD03sAl6cWAr9PLAjsBDw7WBXUEV1jkcKNbnDOyF1tuOQVtsJ3GfNwcO QO9wpZFL+jbbZKDMcH/g8N8qHw/Ctg4cCxR0CgMng2n6FbZzgcpOaWAyUMn7wVn6FQMY0ettF+l9 xfXyJ/3O9IFr0MyBm9CcgTvQ/IH70CIHg5Y6BLx3fu49vcl2OVCrt9quBRo6KxzS32m1Iz3QoHfY bgaa9R7bnUBrZ719A1dH5iNtcuQEWvWy7X5gWWeLIx/aRrrCUQTVO0qD2ZxJgnmdJkcF+ARsECzs tDqqR651Ohz1UI+jKb6DB0v4Phgs75QdLXJOZ9TRJufwnShY1bnGsYLvSg49FHtNsK5zvcMkV3SO OazYX/DzEmzs3OxwyFf45za4pHObwyM/6NzpkKG7HdH4Zyy4lH9/g8s79znWBAr0TY71UDyHYHvn QccYfyaOzdD4Oz3i2AY97tgZaKUd52pvuU/C7sMr/43eKl+6bO2t82VCG3050/X5Nq9yo/d6l/jy 5W26A74iKK8zD3uX+kp5zfFVQFFJYqre5b5qVI92X718nj75lzpPOXYHjZ1nHPuCPZ3nHQeD9s4p x5Ggu/OK4/jIxc7rjlMjlztvOc4E/ZhzHnPuOqaC4c4HjivB1UaF43pwnVF03ApuNKY47o7c1C1x PJDrjRmDiuAmY9agGNyqWz6YIrcYcwczgjt0hYNZwV26ksFcOcdYMFgQOGEsHiwO7jWWDZYFD8R5 w1g5WBk8bKwdrB2Z5EQRPGZsGGwInjQ2Dzbz78Jg6yc7u7F1cBnpSugy3NukceWgIXjOaBi0BC8a LYO24GWjbdAZvGZ0DnqDN43ewWDwTpxpOxSDMVBcnKOIUozBwbVgV+JGY2xwA3Tt4Dgojn827ncY BqHGDYPbQ8w4PjgREoxbBveEJON2PlOnGtw/csc4MXgolB4nN/3mwaMjk8Y9gyfwM06Matw/eHrk WkfW4NmR+8ZDgxdwdcvgJTyHo4NXoScGb8j5xtODt8FgE4P3cD9nBx9CLzhVwXX6u85ErH/JmRbK NF51zgpO8icQyjHecGbHP9uhfONtZx7WuecslCuMD50loaIulbM8VBonzK5EZ1WooivNWReq5j8X ofquWc5GUDpYPdQU165s55I4gYdaHtM20hV0FT2pqSvPuXTkWlehc/nIza4SZ/vIHU7UIWtXudM4 3XeQevjPV0iefpLg4VCUdA2/q9D6ripnT2h9vE861lXntMvpXY1ON3gYVBza3LXE6Y8zcGjbY7oT pOqU87uWOsPQ5Vw5tYZ2x7Wr3bk6TqqhfV1G5zq5tKvHuRGKcYzYnZvi1Bqs+6uGDvKf+tAR0uNx 7XI7t4JFQaShU11+5w6QJ7g0dKYr7Nwlt3Stdu6F2p0HwJynnYfBlvz7cj6uXeucx0JThjznSfx0 88qc0rXROYndM895Dv1NzouhK/oc52W+Izivha53bXXeDNzu2uG8E7rVtct5P3S3a6+LhR50HXAJ YcV0bafqrV/hksJi12FXOqqxx5UZTolXwq5jrpxwRtdJV344q2tyoDGc23XOVRQuiDOAocdVir2A dpmui7xux/forsuuinBx1zVXdbis6ybfbbvuuOqx66FqhSsNk66mcGXXffvZcK1ho6slkGVirrZw 1vS+vMO1IpBiElx6zhIuk3zFJLmsfE93OeQHpnSXJ5BhynTJuO5FV5TvXy7UQFOOaz3G811jgYzO UtfmT3YKU5FrW7jBVOraiXsDS4TSTRWu3cFJ/u7CzaZq1754pQ2cNdW7DmKdJtcR7ALYc8Otphbb 3vAyvk+FV5raXMfDBtMK16mwxaR3nQnb+HMLO2kdr8nkOh8OmqyuKXgc1PBwLE47XIPtcf2Eamzu 8Fqu8ZHwBtJxfg/hLaTbTQ7XlYDC5HFdD4gmmdMIJ5NguynquhXvY7+D4izsBeEJXnXDE6Y1rrtx rgjvmVa8i+BS03rXA+wX1Kf3NWEacysCuabNbhFEAa4I7zdtc6fEKQJ39UjD44Yd7oxAsWmnOwu6 250b3/GxDjR8yLTPXRDf5cNHTQfdxYEy0xF3GRTjGDnurozv8uETj+lpvk+Fz5KOk14wnXLXYu/G Dh6+ZDrjbsBOjX08fNV03t0caDZNuVuhV9zLsIu1uFcGltEzv0F6e/rJXHcbApWmW25LoMF0120L tJoeuJ3yFbPC7Q3f6zX6mmKJvT2+lmhLr93XBnX7Vsjre/0+vWzqDftMstC72meNpWGOA0fX+Tyx Wb0bfTKObvJFY9m9W31rYnm9O3zr4Ya2+sbkNb27fJtjhbqNvm2y3LvXtzNW0nvAtztW3nvYty9W hR3zoLyt95jvSGR170nf8Vhd76TvVKwx7g50J31n5IO953znY0t6L3r3xpb2XvZNxZb3XvNdgY+7 5rv+iMNv+m7F2nvv+O6if9/3ILLXyvyKmNEq+MVYj1Xyp8Ts1nR/RsxtzfRnxfzWHH9uLBx3oD3N /gJ4rrjTIU9hzfcXx1bHXZ61CCMOa6m/DJ4Le31sXc92f2VsXW+hvza20Vrhb4htslb7m2M9PcV8 pm6dv1X2WOv9y2Jb4z6r+4h/5Sd+Nu4xrU3kK5t7rnLH5zc8uvqE3wIlr2Rt8dvgmOIe5yE85hFr m+9WqLqn1u/E+iv83tgOq94fhM/CE4jtspr8sWlW2WC1+tfK26wO/wb5vNXjH4/ttcr+LbEDcT9o jfq3xw5b1/gnYsc458ROWtf798BTw1nHJknPWcf8+7FrwEFjv4DGLnINkKeOXeZXiV2Lq3Wz/xDe 0TZ4Lod1p/+o7OH+N3bTutt/Yrp/h/Q+56VVbPpJwr2uEqYVd7VKsu7zn14lxfuk6daD/rPymPWI /wLcKzzsqkzrcf+luGNdlfOY5vec8F/FEzvlvwE9w5V7zODyuFrP+2/HfeWqIuuU/568z3rF/xCK cYxcH1HFPeaq0se0glPcqmrS+rhab40kwjnCP65qst4dSYNPhItc1WJ9MDJLPtOnGMmGiiN58vm+ lJHCWDv/vqxqI12hWzdSErvZlzFSLh/syxqpkk/15Y7UYWbBSKO8wiy6g+GH5B1oP6LaBc9iTnHH IipzhnttJFEvuDeE0s1Z7nG+d7i3RNLMuVzR3x6ZZS5wT0SyoXseabF7fyTPXOY+FCk0V+IsMe7p zLXuo5ESc4P7RKTc3Ow+Hakyt7rPRurMWbx+kt4zL3NfCN3i1TLSSLrEEHZfCmSYV7qvRpaaDe4b keX6CvftwCWzxX0v0m62uR9GjKQ9vE5G7NPeChpxm51Dqog/7rPM3qHESNgcHEqLrDbHhmZF1pnX DmVHNpo3DOVBx4cKI5t4zYxsJd1h3jJUEtkFLQ8ozNuHqiJ7zRNDdZG98T3FvGeoMXLAvH9oSeSw +dDQ0sgx89Gh5ZGT5hND7aFqqqKi+fSQUTaZzw71RCbNF4bskXPmS0PuyEW9dcgfaDBfHQoHas03 hlbL++I7FNfIZb2M3RD9oXVhb5zcutKGNkaumW8PbYrc1LOhrZE75ntDOyL3zQ+HdoUfmouH9kby LKqhA5ESS+LQ4SizpA0diwqWWUMno5Ile2hSXm/Jc49H0x9fzVI4dC6aaSkZuhjNsZQPXY7mW6qG rkWLLHVDN6OllsahO9EKy5Kh+9Fqy1IPi9ZblnuEaJOl3SNFWyxGTzq0x5MZTZ9WuydHvmJxe/Kj bRa/pygStoQ9pdEVltWeiqjess5THTVZNnrqo1bLJk9T1GHZ6mmJevj3Nypbdug90ahll6ctusaS 7UHNt+z16KPr4987ywGPKTpmOeyxBtdZjnkc0c2Wkx4PdNIjR7dZzuHUnZaLnjXhDH2TBw7Lctkz Br3m2Rzdbbnp2RbdZ7nj2Qm9P1QVPdjNPLtDU92CZ58sdEueg9Ej3emeI9Hj3Zme47K1O8dzKnqq O99zJnqmu8hzPnq+u9Q2GarurvBMRaq6qz1XolOYeR0z6z23olfiV+lu8tyNXu9u8TwITna3DSui t/SCpVC+271iWIze1VcPpwRyu/XDGdEH3abhrFFFt3U4d1Tsdlj8o6K+bRi7c7dnuHgULDdcFljW LQ9XjmZ0R4drR7O61ww3jOZ2rx9uHi0wlw23hm5xHS2Ou/7useFlo2Xdm4dXjlZyehmt5ZQy2sB/ izLaHP+Jo99grJ3+TcXf/nQcnv5dAf1mYLS1e9uwIVLI9/fRZdyDj67kn8ZRQ/y3Q1Qf7v0f9r4G OorrSvNVdXWrwaItZBlkWSiyjGVZljHIhGgURSZECNF/kolMGKzgjrq6uru6utX/YIZgYGSOQhgi GIwJwZhlWEYjYw1hCcEKYMJgTBStggnGDMsyCmYwwVqFBUUmhMhz763qphFyIGdmz9lzknPPd+vp 1atb7+f+1aOq8bbFN4J8ysS8HS95Xj7pLnwp8PJJbfeG9lW8ewLBVzzuqy9FXwmoT/3ezpcWvxLF tV42h/FsPHeF+7+Mcb/lBhnP3eB+zwTuM55jBl7PG9go/j4+nd3HZ/Bj2Rj+QX4cu5/P4R9mY/kC /lH2AF/EP8Ee5F/nX2fjdTW62SxbX62fxXL0YX2E5ep/qv8pyzMBsS+Y8k02lm+qMzUwu+lF0yvs BdNa0ztshemYqY/90NRvGmSnoDfPMYH+9wMTu5+NYmNZPbuPzWWNrJaJ7Lusgf0dW8OaWSv7JVvJ PmC/Yl3sI240+5BL58awz7j7uQc5jsNvnIz43iQ3npvPublczsut5Iq5Fm49V8Nt5F7nnud+xP2C e0H3lu4tLi5EhRi3UFgmrOBeElqE73JLhLXCWm6Z8JrwfW658IbwD1yz0CHs4r4j7BXe5lYL7wjv cK3Cu8J73Fr6HnO9cEL4JfeacE7o5b4vXBR+zW0WfiP8htsq/Fb4lPtv+BYdt13/gP4B7h/1v9QP cW0GvWEid9LwuOFxbsDwhGES91vDlwzl3O/xCw/uM8PXDFW8YKg22HiDodbQwJsM3zKIfK5BMoT5 fEPMsJR/yvAdwxr+S4ZWw2b+K4Y3DDt4M345wc8xdBh+zn/d0GPo4UOG44bTfNhw1nCW/xtDr6GX X2L42HCZ/za+j8UvN1wzDPArDYOGIb4ljaWN4demZaY9yL+RNj7tUf4f0grTvsjvSvtqmsIfSouk reP70l5Ne1WXnvZa2mbdmLQ30zp0D+D/q6obn/bjtH263LTOtJ/q8vB9IF1h2gdpp3VT086kXdSV pf067VPdTGOhcbeu3nht1CO6X5l+b/q9gN/LKawFeDrLw6+NZ+zSYASUsEKlsea64qmqmX2qarIS UKLK4ppeZZmyskqpa1X2KvuVw1WdyjGlRzmpnFF6lYvW0dYCZbU1rqybaZ7pUTYqW5TtSruyy1ow swq0SgAdv0I6/lvGcZ9xnzEeNDqD6eDcBHoTlfFv8m8yjn+LfwvO7eJ/yHT8Af4A09ObqAb+F/wv mJG+BBvF/5I/yUbTO6jp9PbpGP5X/K+Yid47vZ//Df8bsA58szRTx+m45P8arNcZ2Dj6cixbN043 jj2ky9Zlsxx6U/RhXZGuiE2gr8LydBW6CpZP34A9opuu+yoroK9iJtI7G49B/9O5TJo55Mx3hC3x HfF1+Y77TvnO+s77Lvn6fQO+GwrzDSgGJV3JVLIJecpEpdjXr0xWpikVygylRrEr9cp8xaFIiqKE lUXKUqVZWaW0KhuUzco2QpvSoexROpVDylGlWzmhnE4l/1zlnHJBuaxcSdKgctPP+40pZPJn+XP8 +VBbeBs1+AuhbYm/1F+m3EyQv9Jf5TcDR6rzNypX/B5oG/A3+qP+xf5l/pX+1SCz0L/Ov9G/xb8d xs+NUjSvgd+sj6U5yQbSsVwggRWyx5melQClsaeBjKwcaBSrABrNKoHuY1VsJr1dbgGvg99d3s/+ ms1nGWwBUCb4HZE9wDxAWSzCovTF5WL61vJleqP8b1kO+KO17GH2GtAE9gOgPPbf2Q72BfYm0COs A6iAvQ30KPsJ0ER2AOgx9i/sCPSvC6iI/jfsJ9hp9q+smP1voBL2EdBT7GOgSewquwZ9v85+x6aw IaBnOJ5LY1O50eD7yun98S+D78tgFfT+eCWXxz3CnuUe5R5lX6PvPavAG9bRF53zWTX3Tc7BZnGN XCOz0LvkVvq608YpnMLsXBPXxGq5GBdnddy3uRVsDvjOlWweeM/vsL/mvsutZi9wrVwr+yZ93bkA POk+9iLXyXUyJ3eI+ykTuaPce0zifsb9jHm4n3PdzEv66wMvUMQUY7GxmDXR23lB4xRjKQvRG3kR Y7mxnEWNlcZKFqMvieL0/t1Co8P4LfaS0Wl0sr+Btb3IBkn3p+EvS8h7AJ2AQ4CjgG4NJzScBpxj 35A75UPyUblbPiGfls/JF+TL8hV5EPhNH+8zApl8Wb4cX76v0FfiK/WV+Sp9VT6zr84319fga/R5 fAFf1LfYt8y30rfat8630bfFtx2o3bfLt9e333fYd8zX4zvpO+Pr9V309fmu+q77hpQWRVBGKxnK OCVXKVCKlEnKVKVcmQ5UrViVOco8oAWKqMhKUIkrS5QVQGuU9com/B9E9Y16LwTBb5oW0O8rzPwv 028b0P2k5Rmk5WNJyx8gLc8iLX+QtHwcaXk2aXkOafnDpOW5pOV5pOVfIC3PJy0vIC1/lLR8Imn5 Y6TlhaTlj5OWP8G6gYpJ158kXS8hXZ9Euv406fpk0vUppOvPkK5/EXSdZ9NIv79E+v1X3AQuD/Qe NbuCNPsrpNmV9H3Es6TN00mbv0raPIO0+Wugzd8GG3iZexlsAL+SmEXaXEPabOb+nvt7sAfUaSt9 H2EjbbaTNtdx3aDHc7gerod93fi88XlWb5xvnM+eN3qNXvxeO2NZxipYp3SY+/sYF1oAelcKKANU Aqq0OjOgDjAX0IB1wlh5amia78QfB7U5HT4pl4cq5OmhGb5ztwPr5OpQje8C4HL4DEK2huy+K38c 2EaeE6qX54Xm+wZvAf+WF4Qcvpshh8KHe2UxJCnGPw5qYwpflOWQomSFFDkYChPioUVKDiA/HKBy YbhPKQlflZeElsorQs1K6S3Q32Xh63JLaJVSeRdUhYcUc0SQ14RaCetDG+RNoc1KnQos49iUubdA Y90a2qY0hLbhkbAj1KY03h3YTt4Z6pB3h/Yontsh7wt1JuSmQj4YOqQEbkE+Ejp6LwguiG+Su0Ld 8vHQiRFxKnQaERTjWxHy2dC5e8L50AX5UujyHegPXUEE5cgaeSA0eC8IBuM75BuhmwgfC/MEQ9iI CMbjO/HYFIi1+xzhRl962OTLDGcNR3BJfLcvO5xzNwRXxPeRjLxwPmFiuNBXHC65DZPDpXdgWrjs NlSEK+8ZM8JVvpqw+Q7Yw3W++vDcOzA/3HAbcNz3ACUaGe2Twh6fEg6MCDinLI5kKMsi46hdOBy9 JywKL/YtDS+7AyhvJWB1JNfXHF55L1DWRQp8q8Krk2gNr0sCz28EbIkUUXl7ZJLSHpnq2xDeSP0d BmVXpJzKm8Nb7gZlb2S6sj9SfZuMbeHtt6Et3H4H8NrDEauvI7xLORaZQ8eeyLyR+vO52BPe6+sM 778Dh8KHfUfDx+5Ad7gnFcrJyIKEb0/1xQlfmfRxZyJi0gf1RuRUP5LUk9R1TaxLYo4uRoLJue2L xFP7RL6kBXwK2H5wjeoDgutV+yW72hTOobgB+h7cCtgRP5jQ5+BOOMJ98LxyNbJEuR5ZoQxFWvxC ZA3GF//oyHqsx7H5MyKb/OMiW9G/+nMjO9BP+gsiO/1Fkd0YA/yTIvvQt9OYQd/9UyMHE/7ZXx45 4p8e6cJx+6sjx3Eu/NbIKfSdKJMwJ3LWPy9y3r8gcskvRvr9cmTAH4zc8MejDOeXYhDOJcyhfwnE SS2e+VdA/NHm2d8CctZEDSiDzq2Ppvs3RTMx7iRjbcoaJWUitJiSiAXYJ4yN/q3RbOrbjmheYp2p Pfp+WHuKyxDzaGw7oxOxzr8bYni5CozXOL+3warGZYxXFI/hPolYjEcC6A+NbViMpXsB/PtCSxEY YxNxNQH/wVArIhkjMWZqsTE1Vt4WI7U4mYD/CMRBWGOKfRAP/V2hTgTpLca5gyqSPgvgPx4tpuOp 6GT/2eg0qgf/4T8frfBfis7w90dr/ANRO9WjDWMsQbsFO0J78t+I1gdYdD76ooAh6iC7SNiB5hdJ t0AO+rlAOvgmzUZovcBv4fUJH3iHbQ2zq6R/SfQfZKDfDGRGJVzzQHZUSV6P7cHeAnnRcGBidBH2 O1AcXRqYHG0mH47jgTEEpkVXBSqirXTd3fyP1q/ADM2PJ2x8ZUobrc801mH+ODke9MMJfN69Psef Bmq0oz28C8eUxHA/meor0T8mfGSqT4S2JAfb4DmYg0B9xBrcHT8S3BfvQmBug+tNec3B+HGqA58V OBEzBY/ETyXyl2BX/GygOXqI/BjkHcHj8fOUU4BPC3RELweWRjsTOUHwVPwS+TSM/5g3oK87G+/H GB08Hx8IXorfCByK3gz2L2TBgYWG4I2F6SG2MDNkWJgdSl+YRzmZ5i/pWszNtLyJcp5EjoKyNBl4 LpS5cCL6S+xXMrdL5GEDt3wwIZHDaLkHysJ8LJS9sBjznVDewsmJ66k9jIf+hvkiO4GxhSYunEZ1 mDcmoOWJt2F4LqjlfrdBm9fheV0SmIslMDyvS+RoI+RmoWIVd83NMPdKzb8w50rkXSk5FvaVrsU2 2pzcYVtgf4H50Q132JUjujmRYwWk6LaAEm1DX5RoFwhHO1CvA4uie0ifEn4A26DNgf7RcVX0aKA1 2k3lDdETgc3R04hUewtsi55DHxFoi14g/dwTvXJHHgMIdEYHCaCPCLJD9FtHYzwdu2PGhA2iTQRO x7IC52I5SftDH3Qhlk++5nKsMHAlVhIYjJVi7EkAx4vPWGR/MObAzVhZEx+rJNngP5qMsSoap9a+ yRQzN2XF6ppyYnOb8mMN6IuaCmONTSUxT1NpLNBUFoti/KMYiP4JcoKmytjipqrYMvTHTebYSnpm gVjYVBdb3TQ3tq6pIbYR56upMbalyRPbjs8JTdHYLpynpsWxvdi+aVlsf9PK2OGm1bFjmAOi/0/4 5qZ1sZ6mjbGTBJCHcQZ1u2lL7AzOe9P2WG9Te+wi6lnTrlgf+TBYx6a9sat0bn/sOsk4HBtCX950 LC409cRHN52MZzSdiY9r6o3nNl2MFzT1xYuarsYn4fw2XY9PJT+G4x+Kl+MxKMSnoz4ER8ergxlx a3BcfE4wNz4vqT+Qg2P+ESyILwgWxcXgpLhM9ZrPDU6NB4Pl8TitH9hJcHp8SbA6viJojbckdTXx HJCIUVAOzomvwTbBefH1WMd4xplWmloZ+8u/oPwZ/QtKH7t6698BxEGmuHJc+a5CV4mr1FXmqqwX XFUus6sO+FxXgziokisf4Wp0ecSbKrkCrqhrsWuZa6VrtWuda6Nri2u7q921q36Na69rf/1B12HX MVePy6TROsJJ1xlXlka9rouuPtdV13XXkCRIo6UMaZyUKxVIRdIkaapULk2Xql18gqCFVZojzZMW uIwqSaIkS0FoF6ceYo+wJZ7D+8EdcJ9/TDvo9uz/kn1QG9hGLdBY2gfNpH3QB2gf9EHaBx3HPExm 45kClEO7oQ/TbugE2g39Au2G5tNu6CO0G/oo7YZOpN3Qx2g39HHaDS2i3dAnaDe0mHZDn6Td0BKw uW42ifUATaHd0FLaDX2GdkO/SLuh09jH7NfsS+wToHLaE/0y7Yl+hfZEn6U90em0J/pV2hP9GpfH 5bEq2hOdSXui1bQnOov2RGtoT3Q27YmaaU/UQnuiVu7b3MvMzi3nlrPnaE90Du2Jfp32RJ+n3dC5 YOk/Zt/g3ubeZvNpT/QF2hP9Ju2JviisEr7LHPRLg43CPuFtJoJdH2WScEn4NfOA/Q7CXHJsEVt6 S1edMGLnKedZ53nnJWc/0IDzBky8QUwXM8VsMY9IEhUxLC4SlwI1i6vEVnGDuFncJraJHUQTxWJx sjhNrCCaQbxGtAOvF+eLDiTUG/5J0JunNL3JpPujxvCwRo+D9qCuCDD/paA9qCsG0pU00JSZoEO4 Zz4KtGM+6BDqx32kH+m0Tz4GxuUDTUJtyABdWAv6hHqQCVqwA/QJNSCL/RDoQdKAcaQB42H9j4De 4n74Q7Dm/woahqv+MK16Lu2BT4CVv8zyaI3zuQxY40dodQtoXR+lFZ3Ivcg52GO0oo/DigZZEReH FS2mXe4nudWwiiW0ik/RKk6iPe2nuR9z+9hkxhmnGStS1qNYGOssHk7iYnGZc7JzWoLEQmeFRjOG k7jSWeO0qySudtY768V1UDOMxI3iFud8IAeQhCRup6PiDCdIbHcuupPEXSRhkXOpRs0qiXudq5yr xP3AW+8k8bBzg3NzkrZhW43aNOoYTt4O7x7nHmdngqQrzkMaHR1O3k5nd+Je3kPOE0DboGYYuaY6 B52ngfB+55A8RaIJjhfoCiJX/53SnUc91SThaGJmnZdV8h51XnFe8bYBH7yTvN0wvptJsot8kowq jTBTx8Qe0SRmJemkmEN05tZMJEjsFfPFwgTRil8US4ZRH+CqWEpUBnRdqx9yCcArkyOyO5e6RotV d5IrQzS7xol14lwkV67YoJKrQAxATaPY6CoSG1PkJMk1yXlZ9CQpIEYTpM6+8xysCOi3q5x0t8Y1 3VWNOuay4ky45qB+uOZBaQGNtsQlumTqkUxjVSWhppygVer2nvaeI224QLN/mWa6zxUE25kM8zfN WeGKO9tcS2CWTa4V0L8W1xrQZYdrPej7ItcmkXdtBV1ubWxx7RDL4L5rQE+aoe1O127XPudN10HX EVcX9Bj1v9V1nEbpgBU75mx2nYIWdtdZ13mQhVZLI6KWqq3g6jY7612XoP/9MOYBqF8F7aaB1a1y 3YDSZNcCiTkrJIOULmVK2VKeNJFsuV4lqViajPYqTZMqgGZINWCtimqxkl2qp7vBnaT5zmbJgTYp gWRoqUhhaZG0VGp2bpBWafaHFtgmtUoK6JqJ9C0Hzm4QzWKZtFnMkbZJbVKH2CDtgfWF1XKtkTql Q9JRmLkSsQr6tEHskbqlE9D6NNA5sVTqJA3EUdJaYTsg0BicJekC4LJYBTbcKg1CfVS66ealc26j G+7tznLnuPPdhe4SmGvZXYr67i5zV7qr3GZ3Heo4zCytuXuuqwi0rczdICnuRiCPOyBWIsG5qLvU vRhGYBbnwpllYoN7Jeop8Eb3avc690b3Fmmie7vzsrtd9Lh3gT4GcGzuve79cM9G0NAojs97xbnH O+gRwTMc8t6E9TkH46kCfWmVedkIXqBNNoGnOCptcPfJWc5sZ2djl7tOzpHz0a5BZ2C25EK5RC6V 2uQyuRI0FD3HIHgznJ02b6e3U23hbPUcl6tAFvo70mBqqXoZ0GCQdUI2OzfIdc4Oea7zqMhDu07o zxW5AUp73A1yo/OQq9xd6imXPXJAjpIX1DyZvNhLntVd5j3hPSEvk1eCn7ug+jp5tbyO7gZ3kjc6 L8tb0JsBvyJvkbfL7fIuzzgZPLq7QfVc5LuM3svyfnm12CAfxp64D8M6oe40uI+5e1B/VHKtgX4f dZ9En+Q+A2vcK9bB6lwEvSoBf1Di7oO53u6+Kla6r7uHnHaP4AG/47zgyfCMa+xq7PLkwgpuB725 4lzkKfAUeSZ5pnrKPdPFRukczrtzj1jmqfZYnVc8czzzpAueBWA9q8DByGIA7n8O4uNFz3SwYBP4 rEY4E/TEPUvEHM8KT4tnjWe9c6lo9GzybPXscJ7w7PTs9uwTTZ6DINXkOeLpcp4Gyec8x6FPJujL Kc9Zz3nPJU+/ZwD62A2yjc4r0PKGl3kNzlXedPA2mWBLdtCbbLimBHSlzJsH+tvnnejs8BS5+9x9 rjXuXuc56YS32DvZOxHmgfdO81Z4Z0jd3hqv3Vvvne91eCVvjWiGoyINesPeRdB6qWeNu8fb7F0l Rr2t3g3ezd5tnjXeNpdI2dRTf3nC/DN6wvSwIL3VMA7/NxlHG+O+xbMsx3agdqBdQHuB9jv2zwdy HHYcfvH0i6cdx4B6HD1UdxLoDBDW9QJdBILr5vXP63f0AV114DMsb7KbauEeGfREw+iJhqdnGR3l vAI9y+jpKcZAOW8aPcUY6SlmFD253EdPLumU85oo572fct4MemYZS08rDzAuQ8wI0JjovUPHVMY5 rHAsh+McYWzNDkf1vcBshuNOwO7PwT4V5gYVNQfvEUcAXSPguApzFI6n7g3mZXA8q+G8hksqZp9T j+aNgC1Q7gcM3AlzOxxv3B3mvYD9IJdpMADSbweNbRhmZw5D9p+APMDEEVA8glzE5GGYdm+ww7zP rgDM+BzUqLCfUjHbfo+oB8wfAQ4Vdli32dK9wQ5rO1vRENawSIX9knq09cLxBGApoPlO2EEHZq+6 O+wDmoxWDRsAm4dh2whoG4aOPwF7AJ0j4BDg6AjoHoYT9wbzRTiedpB9jAg4Z+4DXNXaXbhHXAZc GQGnNZlDcBy8N1gEON68BTN/C8k2GdpxHCAXzhlv3SsVlgLt/qa7w1IEmHT79easYcgZAXjtVDjm w7FcO04fuT+fB3MhoGQElALKRkDl7bBUp/jvVH+b8JeaH7NYHUn/YpnjuN1/JPQkdV21+U7O0byU uV1we5+SPiXVByRsWLMtjBkJna/NHqbTg+p5iwiQAUHVR2B8sSxR63FMlhWAFtW/OnC9wE9a1gM2 qTHAslXz7zdUfbfAnCT8swVimmW3Ol7LPm0eQCb6S5RJQLmwnhbwixaYOwv0wYJyL2nzq80nXktx MhHDzqfMM8ixMlUGnrNCvLCma/0avk7D1igZUxLr1KLGRmum2jdrdsr1N9Sx0N+7tdgHf1vztLqd Kdg3AobH5eMj4FRKfE2JsUn0p2BYfE3Gy/9MnMxz3B4Lix23YmBKvEv6LIB1hnaEuGW1azYG/sMK MckKMcgK8ccqafVgwxg/yG6rVXuyQpyxhlVfZF2k2YVmBwm/iLqFctDPkX9K2EiL6rfw+qQPHG5b w+wq4V+SttWi9b9ZW/NVt66n9mBvVohN1g1qv60Qk6wYg85pPgnHADHI2qFddzcfNNyPj9Qm0ecR /HHynPEWPtfX3c2f5t+OO/xkqq8sTfGRKf6Q2uZrbcrUOUAfXQv6U1usAnMbXG/MaWona3WgK7Yq KKMf0/KXWsiNrIOaH4M1rUXdalb9mQ3nHudLywlqazRfhvF/g+bnUP8gRteCvFqQZ4P+1oLe1IK8 WtCzWpQJOla7VPOfCX/ZoeVmibwpfMuPkixNBvWxWfWX1K/hfniYD07mMAk/jONEWXgOdKq2NeX6 Vdp4pqnzRTkXjK12g1ZXkYKaETA8F3SMAG1eh+d1SSxNwfC8LpGj/Wdysz2O2/OvQ45beVdqjuXQ ru1MmZPhtgX2Z+123GFX1hOOZI5lRbs+p/qipL+6oOq19bKmT4l6bDOo6R8ewa/YNLuzgY3ZTCpS 7c2WpfoIW46qn7bCEfIYgK1EQ6kK8oMov0w7Vt6yQbQJG8Q6W12K/UE721zV3mwQo22NAI8aexIg f9SuzhOO2RYARDXZMA7bYm2cWnsbPNPZVgJWA9Y5yBfZNgLgGc62HdCuxj8E+UnICWy7AHtVf2zb r+opxkLbYcAxQI82XycBZ9TnBNtFdZ5sfWp7G8QO23XAkJoDov9P+GY7xAD7aBUoj+IM6LY9Q513 O+Sg9lxVz+wF6jziOtqLtHOTNBlTVV9uhxzRDvmhHX0P5GN2yMPskFfZIZ+yi+r82mXNj8H47UHt GFf1wQ65kB1yIDvECPuaW/qDvhvzATvkQnbIhexbtXrN59ohH7DvVOWjndhhjuyQA9gPpuhq4jkg EaOgbD+itrF3qXX4NsaYw2Pe/cvbGH9Oe2VCsXAE/0WV72L/zFhaPqAQUAIoBZQBKlOOVQAzoA4w F9AAaAR4AAFAFLAYsAywErAasA6wEbAFsB3QrmEXYC9gP+Aw4BigB3AScAbQC7io3bPvc45XAdc1 YPshxoyCWm8cDcjQ+tanHWEMxnGAXECBWp88FgEmqX01Tr01ZmM5YDqgGmBV5RjnqPczzgMsAIha vQwIAuKqXOMSwApAC2ANYD1gE2ArYAdgp3bcnXJMtN8HOKgdt2rXHUw5fwTQBTgOOAU4Czh/64jz Y7wE6P8Tjom5GFDn8U8FrUEq6lSgfFqvXq3tpWG4of6384lj4vqE3FEGQLq23lA/KvPWcVQ2II/9 s6XGYrfUW+ZbHBaJoFjClkWWpZZmyypLq2WDZbNlm6XN0mHZY+m0HLIctXRbTgCdtpyzXLBctlyx DFpuWnmr0WqyZllzCPnWQvq7BKjUWgaotFZZzdY661xLq7XB0mZttHqsAULUuti6zLrSutq6zrrR usW63dpu3QV/77Xutx62HrP2WE9az1h7rRetfdar1uvWIZtgG23LsI2z5doKbEW2SbaptnLbdFu1 zYrnoX6ObZ5tgU20ybagLW5bYltBaLGtsa0fEZtsW207LIptp0a7gUYq7wM6aDti64LycY1O2c4S zgNdAuq3Ddhu2JndQEi3Z0JMeGjEX1xg2i8uGOkXF0bTLy6k0y8umOgXFzLoFxcy6RcXsugXF8bR Ly6Mp99aeMiUb5rCHjY9Y6piT5mcJg971qSYQmymKWp6iVlMS00vs+dMzaZX2NdNa00/Yc+bDpgO smWmY6ZP2Ar69YUd/x/3jOMyuSC9r9KJ/5t8QakG8CwFlRqqNJhTygiwmoK5WhnbNWjlRg0eDeB1 C8DrFoDXLQCvW7BSa7taa49161L+3qgdt2jYnnLPdu3vXexJcxfQcfMp81nzeaBLxM+b+4EGzDcs zGKwpKtk7rJkWrIteZaJUFsM9XmWyZZp5vOWCssMsEmySvMA2KXd4oC1up9+aYPRb2zw9BsbOlOp qZQJppmmaqY3zTbZWBr93ka66UVTI6yD1+RjE0xhU4Tlmxabvs0KTCtMf8sKTftN+1mR6R3TO+wJ U5+pjxX/P5bODb0gfA34fNAObug+Ko+m8hQqT6HyM0IN8Kn6KNU3Uv1rVF4NvFT/QyrXUFm9dgqV 6+jap4FPovqpQoDk4LWlJL9BeAa5/gV890m/GMpZwgzk+hjw3dTmDbzvH6j8hwPUhxVU76PyM1R+ hspT1d5qfDHxELUBmX/4lfAk8F5tRE/S2ReoVzRS4a9oXF7quQfLutNUNtJZRlf9E9X46VoL1dxP 5Wfp2oUk7X7qybPE9dRmGrWRgE+m8mQqlwrlVC9TeRpJoHriz9DZUjr7JeHLyPU+6kk5tcTyM7qr 1Eadh9UkbT9Jw7V4WmijepWXEZ9DbUSSuZdkwmzwz+Ed+af0DuCv6MG6+TiVnyV+Wh8GvhTbcDzx V6k99ZNnyHUStXxV7wS+g2SOxRruQyxz1+jsWmo/k9p/j8pZJO0a8V5qf0P4OdTzwrvA5wgn8S5Y 5n5DNZLwIfAKbMMGkXNm4r8jfgC5TkctZ5Oc57E99xFJaKPyW3R2FrX/jNoXU/ki8cPEf0TtPxGa oKVV/y9Qvo56yxv070B5COu5Rn0X8PMCaAKfg23YJ/rlwH+LnLuo1QDXlZKcHOK5dK2L+Fri44XP 6Oy3oPwL5PxZKu8nfpz4q0IDrpHhE+J7ibcTbyHejzwtG+41VV1BavmKAX9DpZHKzxIfo/F24i3E 8drx1PIInd1FNaepZinVbFXXHcvA9xJvJ95CvJ84tp9NLZfQVUzl+u+jVlD5Ver5Dip3Et+h1bQT byHeT7wKxnJI30Ja5EFOd/+Q+DW6dq3G9xJvJ95CHCWspdn4HrbRbST+PerzNeK9JKcX+8x9ou8G PkD8E/3rxIPEXyROmqDvAwnjab2uU8te4pc1vpx04DDqBtUMkYQhkjBEEoZIK87T2fNUc16r6QSu o7E8oj9COtNNPEj8ReLvIydN6FV1DMugaSjtfSp/Ajk99gFq+HKNw1j491BL+VyqyaWaXLLuXJQM /F3inaSZO2GMi1X9JMmtxNdq16JdREjnx+P/xA33ep14kPiLxN8l3kccZZ6la8/SbBwnacep/CqV 39A4zl4X9fO5NJQ2RuWqplF5h8r1P6GVDdI64tlrVP7E8BWcYZVjrxjVwDMt8hyqP04re5xqdpON FBLPJy80hfzbK4Yi4C9T/cfkiwaovA4jCPfv5NPGqP4QW3Kj9W7gD5A3ayY+nmajg9qUkC18QOXn iLdpPhDiC0fy+TTkhvdx9Q3fxdnQky8VHDgnhn1YNpRgWXeJdLuN9KSUtLebrtqn343XCh3UKzwr q/7cgJ7zSeRgmyfJpk6SHaF1PEbltXT237UxRqg/El37JrV/k+aZPIz+Es4PcvDVyNX1esoA8ZGP U/sxVD5C7Zdq3qOd/EALRgeyQYnqXyU+lvhjdJcPiX+WVoOrmbaT7otnZ+Iqg+ViOUvjKPOLmk/e AuVs0sn3qSaf+BnDw7i+5G/fIH3+BvntPehF9SdIJ49jS30R6Z4Ra2DtUIez0J9z3aoVw7MyRARa lxM4w+AHOknHOskqVf4u2Usn8XcpgqCvzsFrYT7foauWkwUtJz3Eu8SwV7rZeFY3W/UqAuQq3ASy 8Rl01T7Dp+QfsH0Z9hY0GWsuoqWDhn+AkYV6Xqr5n+XUEu+ynfha4ocNj2PZ8HdkubUYZchyz9LZ /RpXLRTL9YYn6Wwf1fRR/3GGpxneR19HvX0doyH3Pykm5lBv/0D1P6Q5n0DlfBrLecyU+DoB5fcI JuCXMHvkH0IO67WcvAqu2iYa4xa0Nd0UioNPINflC1DD/4wk/4BaXiPJ/0blf6PyLJLfjTMPHCWb qc8B5GwXlS8T/4Z+NMO8AuV/mVaqmCT0qPEX8yjIE75F3g81fBVlL5cFmUaB+vYond1EPX+f7nWA pOXgSIVf4mzoaU6ET2l94xjfdeNQmu4DLAtfpnI1jbefRvEp+YpPyRJzqJ/k7fn92EPdVBr7KK23 2JMCKpcIkLty79GofyxANshNp74do2tJ2/lyQUEbp6vqMQfm63X/B/h6YSZIrqR13COIqJ/8D6B8 kqR9rHGU9gbJ+SLJLBUE4B8hB62bwDArgxnQpdE8/CNdFSbeSjpwScDZ6yAJRcRfIzl2Ksdo7K/T PM+gMcp01cfEzxL34oxBloWjWIFZK5RHoVZQDPKTtEbqZz3JMeg3oAfQtBFH9xPqzw3DROT6a8Q/ IH6A6guIm9EnqDkntuQnEy/Xf0hxBMvVahZKct4n/h7JeY/kvEdy/he1l6i9hDV8kGoqqMauZq1Y ZoPYE+AfED9A9QVUxvZj1MyW7nJA5ZRHzSY5s/Fa/nkqP6+WUQ7wA1RfQHwC1eSS/lC+QTI/ImkD xNuIv0V8p4ARcBbJnEUyZ5HMWSRzFsmcRbM0CyXrirGlrphm4DBJOEzlH1H5RzgKmNUt1H/k/0Md L5ahb1tIzha66hpJwJoy6uenGu8iy8I+zNE/TdaKq7NcwGzzkPZ0gHd5VzhFNktPB9iSqZn8Bcrt H6KngBriPyNpD5H8QeKniO+ka+cRr6Zr91H9x8S7BdBSQwGOy9COXJCxjdCjfxssne5lCOsxTjXQ XAVpBn5H7U04q4Z2susp1Nv3SU8+It6qPad8SKtzlHTyQ1q1D2lmSD/RymAGCnGl9OOBb6ZnIp5a 5lHL96ncTHevUPWN1uKfsOY/2Dv3OJ+q9fGvvdben5lhrKQhxqUh9+sYk5DcGncJUZKUaxIS45qD pDBJlEpCkkpCNxW5JDGkQhJROU456qiGkByZz/zW8977vF6Z3/f1PZ3vOX+eV6/e+9nPetaz13rW s9bea38+82EMI2XQt8f+W/grXA5zeZJfHjvGVURTIOPixlfkYxEZa+S1YeaIxmVCB0awAyPu9tFq mvnM7Ss7B0WFMbdvzd8tMzF/d+BG2TzDk9JOiYnfWO47/kCRzevwcfTL5XnMf5ZVEXv3bCzPRVdQ tyPPRXdj+b7sN/3tskob9o+mh+yX/eKUvkmtF4QJZdGXwsMFuBL7O8iTSTIW5i2JrTmM3BY2EPpp MkZ+JXJjBvbvkVEHhcEybBqQFaliaWYysj8hD6G0BqWlyZYsPIR71ZWwHddqzlPBs9wB20jEzLfc QWawNm7lrpErzydmCU+ks7kHLeX5cCKaB3mqycPPJrgPfg4P4uco3AXHcm86yH12rTB4H3kSXMfq epZ70HR5fvNr8RR3MJLfhivgDJgnpbLzCo4T//ZYJsPGsVscwx0ZO0SzLuIKOAOKh9exHEett0Tj KJouogn6kBW9edYdCzvCETwZjuT5sw17Up5g/arkz3quhaWZIWupj8ZRevE9nqtEfBuugDOg8xbU kD1p7D1yZntQytUqirclsD9kf+qn0PfxyG9HfBuugDMolX6Nl1j5G0VOKB97GvYU/9TyI0p82COY lRIH05ynvokRF8ER8HZILsmTW6wI434blm1kbQyqBNudfCJ43/Fp9PsjjoC3w22wnuQbpbloctHM lGdd86rMUO9PPEtXgNfCsTxbprEPasyza22eimeTUWPJ2NnyHKjb4PlN5PHsXtfQtq/Rfy1+/I60 /7Bo/LIRF8ER8HYo86uatMq/QvawsZfCnJcZoY/irShcwhPCFOZRCs8P95L/Cyk9GHERHAFvh9uw cfH0K8pVgvflvaKj2Kyj1jrkFCJwligdClYwFypIaUh2rMdkx+p/L5pgo7TEfxv5BLJPnvjYTwx+ YBRCyu51t+xeXTQkK3b5U2ibZKxCXkfL11EarqLNYNEgxVHJeAVlYl2dvFT0QUUy+Ws4PlpLZeXZ wFo6F5sc7F9mxv3EPCrKitqIFXgB8npZgV1euVrBZsYlF5/sXs1jeB6Gt1rIb8v+1+1wpXQElhuE iRslwxMVu62n8Mw7k4Rwtf+I3c0MZuhxZtBbzI6rILtjswoPL+FN+Q+6Whvw8460zec9lc+O2I2F 3EMHshceJbLzkAf3Ma/z4D5max7cR2vfdPIjXHEtUbogzwDmGVan7dCnbetlj+w/D7OFhjcnZmfs IbnfMYvnIr+F/bPUfYSZPkM0scGyGsTuRv8+9kdgD7gkdlaY0EvudNi8IJmTUBa5FGyAtwvYz6PN ReTu4JeQ91R+vSCV/BFZS9uCH2X0/RLMnYnhfpN8WBnskDwRvf9ttKeWN5Yr2OM0Zl63lXtEQjvG 7nNG6hqRY0WCYq70HPesdbIjdtkra0KWlCa0486yRGaTW6/ehdtYl96Fcg/twHukWugPoz+M/gT6 o+gPou+Nt6+5SrjzmsidcR9cJ9cNjkiPYryPNW+w417KPW6+2OsPZH/tVrnbifCvtFnWpcay144V Y9bnMbs3CV0kP2adqUdLhLsoLcpzUVF58nHrYT5zYRErhpROgjOi1UNqHWDdeE/23c5mAfoFtJ/1 KjbZyW/T5tZ+WcfnhH4a8X+Nnn7J6IzB5ubIUjQV2Ad9KH30L5U9suGtsgl3bV+wa9vBmnwfcSjH uNdhX/Y02VI6cGtRLJFav/KE8Krsx4MhvttZ+LNZY4dTdzh1ZyEvl2vpq7liP8blWXb9A+jRdHa4 +5gRPppHZFfu16Kdt2J/kivSqmAa8kTZm5t7kEObYXhoCG+T5yX33Cizcp1/udwXaOF35Hm4m25J JrSl7/XMBtevXuInlg0nCP0l/ipWTpkR14kcjAvG0SqJZ3dsws87NrKaBVJqRsldLPDwU5z4r6OF L8i+2xxCPiG7dVMfua3s1s0r9OUSaUnADPJv9ss4zWLaP8WccJxsXCb4x+VTntjzPBP2ld266520 p6zs2U0OPkdFlBgWgzfLPj1YB2+RfYT5TfoeK0UEOrAH/4Zad8g+3ZRE3kTpGdrzN1r4Bvqf+Swj TSITq87Vm8Hb6e9Q2DB6tpS7ahlqfSw7d/2Z7NzNdOJThveHR2hhX9iB0ZnJOHaUUXPZ66hXoSlH Oxewi5kLm4cyO5S5zLW57HTmyq7KlbqdSFCNJ+rNWD4A3woeZD0U2cKOIfHQEQ8d8dAWyzz2erVE 49dCcwDNAt+NuEddXRk+xH75RvbLN7ILa8z+7mnZK7lMcPZ6MJYHuWIpnj/r4K2O1PWzkO8PieZ+ 8ea4EX0lWJ47u4tM8Cm9G+K7XaFZiM/G+A971wzeJ3tP1356gc9a+KxFT/PoaZ7Eyr9ZPMeygr3w AckiPLwWkvj0Q25HHJrHOhEr4Q3s3w/J/t31opO8+/I/5bqdmEFf4uE03jrJ3Upa5VYe4TN+Fcc+ /lSnH8eKyn7Z7a+ldCYsh6aZP83JI3xpWx00rLd+ecbiJ/iz0OwUBruEfh14v9QN6nKVkvhsD5vA ZXibEcYKDydgdSI8Hg6TFS9hu0QgsTPxPMe+727e0g8TOSHGXa+vlAbViPBOLLOQB4qcsF28JXaW J5Mgzn6wMf0Kc6MRo5zFuCxETsFDU2xekfcD5g6Jv5/KKLxGblSUu5g5Jr0zq5CLI0/C5jCsQ61K MIXRLCV1g6Uy4sEy9A2wfIlRnimy/glN41hDOE/yDcsyMpouTx5kDRTuwedK5Cq0OYUY3id6Z3mO 1p5jhvJJfcHLylOm4EPkVfJZNswoeAm5Bpwhn5JHpS/DpdhPQA5ZGs5FH9Zdjbwabyvh12i+Rv4C G6fXXQvkjWgd+CAcA5vDL+AkoaeF6gyaDKiEZhDyE/BFeGkky6cGB6h7Gs1c2JpajyKnUHoEnkfD VXQ3NCeQQ/9NufpZeJDSv8ONeDPYtIc90H8bydKG5WhWoWmLXECtmsjH4Bb4FvwBy07I55BjyHFY Gn4TrylPhrQHe/WLaEwYmXIwVTQevfZuhrvRf4W8Ae7BJoxe13hL5yEzHAuRdXO4GC4JRwE5Ayr4 BHwxLk+nm8P4i8Z7FZ6m9BM8zw97h3x5GHls4thUDPuC5gitOob8adSXlvQr0dWdQN2JolHEx5uM ZUa8M71YQMsX0NoFtE04F81p+AOaikIVyuVgKjzKFavCNFgffse1wgx8DPmvMDXeyrE78mWM7LQw J0WvVyPXjsvu+3PkJujJCp0gjJFpsbFCfx0e8iUCsWEiBzsZ6xfDyBQ8I582Yv9wmBt4e4w2/IrN 34lVV5mVbk6VJv+Fc8JRzj8lM46ejomoYZrj5bA5nETpJLxNEo2Lp+jboM+AKmKa3BeQn4golp2J 9oEo8mmMwmIocmvRm0cpPUOtq2hhmOFn6BHx9w6FI0JPnw3zGXkANmuI0t5w9ZBY+fuIWDh/U5DL EZkt2G+Jt5C3Ushj8DMaeZHQMItNezLwHHGbSymj6ZVH/4PE0LtAm2NEL5UeJRKluNDlVShLH4mV 9zAM87BvxDTqLsaP2O/G515KX4bEU52k18fhIvhJwWWO+fSxCJrXkcsjpzFqXZB30fLvKS0jslsx ljtNC0pHwQWULiYCZLupjxzO9FSJmK6BPpwRH8Jn8DwQDwPxvD+KksjhyvYx83ors/U7RoFVxfOJ /DX4CVfCXfBvBQ0kksg7wzUQyxwsrwzXQK7yKXpmnz+FubMd+deCtq6d4X1kKavN5xIr/xrkNujz 8PMrMiuhToK1YKVwzmKzHb4TrU5XOXKn8HZgsyac0ZAVQM8jSs2w2QfDdYO81dwXXFTdnsIw972X 4EgYrhXV4VNwNPps5FZwCBk4Hv3L0b1A8nlqJEsEwntHb+xZQ3S/8J7CaMaIf2k4F+6GGyDrufc6 41WAvB6ep+6ecLyQiaR3AnkQ7EyUziIXo3QjcnvYI35WWoj+W3zOgavgymj+hteSzN9O5p9lRvSA bdFvQW6E/f14477jbePqcXKDO6PHSm7KYLmRbEH2zrIa70deib4ncriuMvqxFWRUcfgAKwzPJ7EK eAtXpB609q2ChfIZEx4K4g/TX0cvF55nHe7GSrIK9sHyPOtwMn0J71Mp0bqaRm7LytAUTVOi15RV 5Sz6YsRhY0RZew2W7SOKh+WUroqYxn1nKDFMo52yLqVR+jF8i7pdeMd4hnf45XjTWC72prNMjr5d I99OacR3cvJ5t1xDvuXo7RbqFXz+u429J2+ovL/68s2czezI+LRFZ8WKykznE5xdIuv3kU/5X7BX 5TMveT5XvXRVGRd5I2Fq+nfJ1f3n5RlDZJ3n/yzZKDSn/BeVvF9yluoroTeYWu2EwQreacRgXX+i zE08LPfdc6/pjYcLUhrrTq1uMJPvJ5yDiX6qjLi5TyJmtoqNyHqK/IWLHio0I8xhvDlLtUPoVQpr odkr9H8Uul4Il5pHpBf4yZK3Cjo39ENpT2EwFQ/n4GGYA98w8j6nplBvMLK7T5N9vT6HpkTQi3bK t8iSRaP2iqy+Ejp7kXeIfdAUP2nUSjfy/b2qZr6MvllK21bKO21qvQGboKku9sEmah2NWiKlPdEs NhNktUHfLKJ8j8iPvC2VKNG2t0X2jtAeoz1hcEZ+9QZZay0abxOl8g3kBt43fGNWvtXWRec41pG3 LnqDflRWXT1dWq5fkHktsn5IP+Q4Scun21rsvbmwm9Dcjc0Tmu866jmO9cxMx9eRa5uX8ONk7zSW 1NWtqfso8mV4Oy1Z6v2Zq5/Xl8lc1pIVPXVp2llc8l/zKb+OOU1LfYnMZV1N5rLYe51hV6H6RWgM HtrhrYcuI2um3o1Pkc/qb+WugbwSy054iFP3CuRj8H1PIryGNhz3rnSWdT15w+nWRae54MmnzPne GbkX6HRZV/UUPrWXX5b9wTsi7RF6LXUp0ei1cufy/ir3XFgO1hU6b47qW+Q5sIR3GMvDMtORv/Im yN0En7u9ZY7zvC/lfiQtUd/h4Rdpib6glHwL3T8pjKUg/wW5GN9OL4p8NfpX0Tg//nMx59PvBbPg j0LzPVwlDJLRXxBqHz6Cpjo2twljB7CsCTtRWgm5H3JPLI+hQe/nCBMqIFej9D14Bg1XMR8hD0Se ArugmQrHCT1aq5tR+iHyEdoTw2YuXEHpNuTXkX+CN8Bb0NMjk0/d0NvH8AF4F/wcy0xk+mV+44r3 Im+lPfvhcTTP420AtRphuRN9ReTVyIuIyVrksfBZWINazyW4u0+sbDg6Ivs/woJwjEQOktFcQG4R jhGax8KREtncBvvBEXjrE44XtRLCUUMmJrET4ahhvwoeo7SSMKECmvdoWz0sZ8EhYXy4+nW0cHMY E9G4e6LIYcSIs78UNuWKRNv7mVIiqTfggawL5sFc7JfAvfB6SK/9MNMW0c5J2FfBAzEPLG0gf3RV ci8J+6PYvILcHMswx1pBK0x8ReomlqSdBpu2eHgHpqAvS6+rE5md2D9BKXPE30etylyL2Jp54bwj hgeoS2z9HFgNP29ik45/4qlbUncNemZZEObqYK4VzsQKYe7h5xNkLPVMav2AzeMwzBCiZ0aGmcx1 KxKr1ULvZzTPcK0wD6+C18Cu1N2D3AAPGfA7+Hf0D3Gt/sg34od+BVw9aIjlbPzMRybymvXBXwbH wB7YhFf8DIYZsp7SuyHjYspwxXsgkU9A45/mihPQh2sac9APZzczN7gETQnIymDICoM3Ha5UrCr6 JPbU9bPhy3A5+nBtRDa70WxHPszVySvD3NGnqEXWBeFsCnu0EZsi2C9EE477JvTdYCqkzYY1MzYD n2GryAr/S8ic8skNj5bHJlPrPuzPIzMT/YnwC/SMqSH+QW/0rFE+q5ZPPmhWdX8QfBf7M+TMFPIn XK9WQNaigHlkHkATrpx51A3HlHE3jFSMXDK3QuaamQPJ3oRdwkSyIuD+FZDtMaKdQN9jlPrYG9Yo 0xjeIFdXSvYg/nNx+bSoF8yCPwrN93CVMEhGf0GoffgImurY3CaMHcCyJuxEaSXkfsg9sTyGBr2f I0yogFyN0vfgGTRcxXyEPBB5CuyCZiocJ/RorW5G6YfIR2hPDJu5cAWl25BfR/4J3gBvQU+PTD51 Q28fwwfgXfBzLDOR6Zf5jSvei7yV9uyHx9E8j7cB1GqE5U70FZFXIy8iJmuRx8JnYQ3qlqVuATYt kB+jdARyH/QJkL7ETsB6lM6CQ+B11NrMdcvRwrDl9NdfCptSl157P1NKj/QG6jL6wTyYi/0SuBde D8MWhiMe9msSrIIH+h5YfDKOuio5kIT9UWxeQW6OZTjWrSC1EilNLEk7DTZt8fAOTKH0CWQy09+H TWU8ExlD+82blKbjh8jolujXoCd7gzAHBuMtzPAwVz9Bj42eieYHSh+HjI4mDmYkfAZv4TheBa+B XSndg9yAWhnwO/h39A/hsz/yjfih5QFXCRpiORs/85GJlWZm+cvgGNgDm/CKn8FwTNdTejckkqYM V7wHEr0ENP5prjgBfbgakL1+OC/I+eASNCUgc8owjgZvOpzjzEd9Envq+tnwZbgcfbiqIJvdaLYj H+bqZIIhw/UpapEnQZjzYY82YlME+4VowpHdhL4bTIW02bDaxGbgM2wV4+5/CZkFPqPv0fLYZGrd h/15ZOaOPxF+gZ4xNcQ/6I2e2e2TCZqV0B8E38WGrPbDlSQPORwpRtMQ/xgZYm6F5LyZA8m9hF3k P2MdsJ4H5GqMGCbQoxilPvaG9cE0Fqov9UElb0V2udLK4XsMM9tp2rHvHiRvG8xS3iS0p3Sx/G2s SZPvp5n5vEvRotF/Qz9b9PIFCyV/bSGa3sJgr9Cvi/4MdUdQ+r0wNhJ5EGyHt7zQkuv2jN5mVFby jkL2hovRPBi98ajL39bJW5QOvD85z/uQFN6NrES/TOrqPWgGUfokssZDHhwDl9P3ZKGeQgS6yxsS nctbi0zkTPOO1BUbVcD7isui9yeO6i9iE2Tgpxu1snhD0kQ03mX+QqcvFb0bWck7kJW8D3GMP1Yg 76m6FOyStRe5p+xt9R6RvdbIvSjNQt6I/AWWE5ETkZtQ+gG1jqMpEXpD801cdvq1sSlBrXTYj9L9 ISlNRT5P6dN4qIz+BfQNkWtSGkO+E3l62AaRvYNhGygdJ3K8W8FZlwlV0byhyjgeQl4ssrmEvXyB 0DSDp9CcR56P5Z+FwV6h76HXcCWliULvDHIeTMdeYTMb1oTTKB1DG+Yh90NezhV/wGYC8g5Kh+Kn CP63wGVRy6UlQ9CsRbMB5kB6atpRatFMia/nX2EXz5vi8iYwDc/DozaI/isZI9NMqL6i7mo4B2+8 8dBH0XQXG79qXL6r1pzSlvGXHOOqk9MXx6a+aPTJsM14XiptiJVHs1Fkbw76bvHXJT/F3t9K6X4p dX2X0UnGczf0pfH5KO0vW3DetXMqrf2Fth2SWsEI+nIM/RKybpLU8hpyrQnIlfCTHr/AJwgXJJ4w R+iepoRH0JTD5hhyCaG5jlZlMmq5XGscngfRwiPCmE9sq4cZUtBDsk5sdAnRyO/vuBWSWeYXl77E SmN/TOSgDTbJaHqFeUi0y3GVZCJTQiLmPUSve8bl3exQWrgcuUj8ZsmxuLztvAx25uq5RKM1cj+x 9M5QKx35LJa5eJiDPAv9fqLxMfqqaE5TOhfNIbzNRdMcyxNCt+IwXmEe0v5O9OUvtOEImRBm8jzp tdsFHCZKjDucwkidwT6Oh7pcqwml6eTPEfSNhG59l3FpH9kIj5IDe/G8J4x/FA1peRZ9OUKsSqEv BntiOTS67gXmxQVy7xSZEFpK3CqI7HL7FJksNn3gHDQ3Y5nKtVKx3EWtXGwWwLWUdo7mb4brS4w2 r6GPn6AvB9+jPYNDS/o7POy1WLos4q01GRWLorqUrCYaEhlvMJ6fZB3YRPS2RNcSPxmMVKlwpaJW HrW2YBkn29OxXENmpogcq6QuIdPWM+LS/oXhjI7miHjrzRhVhnfQwh+jFa8M9xq5ysfRnJ3vSl8L 57J4c6vlk7Qqg1rhuiqep/GWOE8NIK8GyD29oKuTbyLrjmPDOmDCeTSLup31R2T+ekZT+rg5XBux nIy+O5GfJ3Tr0nrWCllVwhFZDhMpTaPXrejvYTgbXsBzFuPVAlaCHSIbWeUmReMoK9vjsma6fFjP bHqJrLjAJ7kXyNUL5PMFxkLkc8RtSnQXK4NGer2AnjYN72KsOXmMzgZhAlmUwF3GfI/lAMg9Tp2U PHTPwF+zBp5iDZQVpjvtbEKWppPDe8hq1iJnuRRLsX8V/VAs2yF3RL+Mlu9HXom+TXwfHMHsOyXP 5HKV+PyCbxivbjJbGdPr6Vel8L4W/4DP60tKa2n5VPqShmW3OM881C2nKjifqdHIOjl/lXhWit95 U778nU70plGoiqAvInqlRBO/Vb5lHe8l34SP8/cg8SLI9ZHrIzeQ72nHM+W79E4/Av0K5Nvl+2Py zXwnb0POQ/5RZPkrHlf3XfmVG/SZ8m1A5+cVfpvlF37fZoNQ/o5AKfk793iK/DVHPEX+HiT+Rmyo /MpNwv3yKzci528UOT419qj8yk3CSfEfOypMOIH8pfhP+B75N+TQpitsgGVfOEB+90baln8kbHPs KeyXIoe1jtPmM+groy8uTGhB7+rCE/R3GqVrYAL6q7FsxbV+RL8TnxlomhCZUHOe0luxz+GKO4nS eTiZq7fEshZ1xTIdOR05I7YD/TnkWvgJ9VVpyU3INZBvwc8BYWICMr/kk5hI6a1oZuJtnfwGDh6u xkN95PrIDeTv5Z39p8ilYElqtabNGbS5H6O8iJ7+Qilti72I5na4DZ6h9HLHegmvIr+Gz03Is7B5 Ez6Ofg3yXuTT0kL5FQ7XWsnDBnwub/ILkImbfJIer5//N2lPPmMhn7w7zSkpzd8okQw18ckwDVIL D/Xzt2JJ3Xx6nb8I+Sg+P0Dej5xHKRmVfxDNd/iRb+AoVcSbkXhcmf7jRw5VKXeOHHi3mjS0b/Zw 9YZyO78bu7VKU25nUVCgSqpkFVPl1JWqhKqrrlKNVQvVQd2sbnM+uqr71P2qv7pL3aNGq+mRfTGV oMqryuoyVU81dF5aqo6qp+rjrtpNTVRT3coxRI1QY9QM/o3BsI5ViW7NqKJSVLq6Wl2jWrnV+RZ1 u9LqRvUn9YAaqO5W96qxaqYqpUz7Ll3aqQ7dbrg+TfXr3q1jmpqPl8v5zdAr3Npc1Xmsr5qq61Rb db3qpe5QRtVU3dUkNU0NUkPVSDVO5VAnSaWpakrudNeqLNVZ1VIPoy+tirs4VFSpqrrz20A1Us1U a9VO3aBuVX1du2urHmqyelDdqYapUWq8mhW14FJVVFVSZVUN5yFTNVdtVHvVRfVW/VSg6qib1BT1 kBqshqtsNUF+y7R/xqj+5ibYBw6Cw+EYOKl/36HZ5iE4By6Ay+BquLZ/31EDzRa4A+6C++AheKR/ /2EjzDF4RuhrWBxWgLVhkwFD77rTbwM7wW4Dht8zzO8J+8ABcAgcAcfAiYNG9u3vT4Wz4JNwCVwB 18BNznFffwfcBffBQ0OHjx7mH4HH4I/wFDwH48LAH3pP/6FBEVgcloYVXOHIoDKsCdNhQ9gUtoLt 7hE/nWF32AveAQfBoXDkPSMHDA/GwUlw2gjR58A58Em4EC6Fy+HqUW6MgjXwXbgF7oC74P5Rdw0f FHwFv4Hfwzx4Bp4fNaz/iJiCRWAKrACrw4xRo9Lrx5rCLNgJdoe94QDHjNhQmA0nwmlwFpzn2CC2 EC6DK+EauAFudcyMfQz3wi/gYXgUHh81ut+o2El4Fl4QJmiYCO2o0SNGJaTAVJgGq8LaMCPbRTKh EWwGs2AH2AXeBOVpXLu1J+VfOBo3z8uqcv8nyeOHQ/93Bm7FCNwqmqAS/2NnPmeh7LlVrzCL/UEa t84V5TeX/x3Jc6v3/8wSf5iaEdHOq5zxtkfuD/KU+Id56R9m+f+Pxf8w02ip4ej9jtKD3+vsP6Vx d6pSqvS/KF2OpN39qdK/dLxSVf6XjlVU1X/h6Lk76T/nP4+J5+7g/5yX/CHWd08b2e6uP08tU2vU VrVPHVVnPN9L8Sp7mV6W190b4GV707x53jJvjbfV2+cd9c5oX1fQnfQEnaMX6BX6Xb1TH9LH9XlT xKSamqaJ6WB6mSFmgskxC8wKNwflWolhzprOhc77FTqfVeh89u/O/ULlMTfNv1AJ3u/Oi2RefJ68 9OL69uzF/lN6XXxeUl3sv2RKofOqhezbFTrvXei8UH9KHrr4vFT1QuddCp2Pu7j95ZZcXF5+w8Xn VWoXOq/7u3M3/6qkFyqfyrl260OJsIfVuoTH6mHPfZdzpdxaVTXS7omOh6Lj0eh48n+yrpkZHZtF x3bRsfvFraiZc3EvazW8+Lxu/GL7ej0vPq9faBQyMgqdZxY631PofG+h8x8LneddfN6gxO+yzAkN UwqdN7zYvmGjQueFyzsUOu9U6LzzxaPYuIOjdZHp7z2hBnkLWW37uf+Um6nzlBcUDy7lXlFCxZLb 29zkdnar3Wy3OE3M+8n7ydmd9E4qzzvlnVLa+8X7RRnb0rZUvr3OXufum5IP2rQ2Ml5al9AlnUb+ gshKe0wxV7OuOy/ldiMj1UKVq46o816Ka0Oia1VKclelk9sld3Nsn3yjo/SuuFuT09xuId3teZra 75XRxV2b/sYx17qdli7pzn/gmGv3K+3OvnDMtYccd7i+Soamqkr2iGvrZlf6F4659ht33OLOv+WY +zvLo5HlXyPLY5Hld5HlP9rbkfZ2or3X095/lHSm5AZKuvy+xO6khR/Twl208B8leyjZS8k+SrRK 0O4/N82KavnmdnFd3EW1pIuqSW6T3NZFfbPdrGKuTVtcpIySO75neMPk/q/u6k91vZrqTi/xLlGT vVSvvJrCv2c5zevl9VYPekO9YWoG/4Zljnevl60e9nK8HPWoN997Ws3xfvZ+Vo95Z72z6nHvN+83 NU9SQz2hYzqmntTJOlk9pS/Vl6r5upQupZ7WZXVZtUBfqa9Uz+gauoZaqNN1F7VIZ+vRapMeq8eq zW71n6De13/Sk9QWPU1PU1v1dD1dbdPz9DyVq5/ST6ntepk+oHaYYi5rLphMk6nippXJUgWmvWnv abPILPKMn+0/5/lB/6C/lxEMDAZ6DYI7gzu9zOCu4C7vqmBUMMprGIwORntXB2ODsV6j4LPYDK9x kRuL9PVOFJle1PPiycWTW+vxybcmL9avFhtQbIg+XWxysVn6vNU20STairaiucReaa80xW0VW8Vc aqvZaqaErWFrmMtsLVvLpNg6to4paevZeqaUrW/rm8ttps00pW1D29CUsY1sI5Nqm9gmpqxtapua craZbWbK2xa2halgW9lW5gqbZbNMmm1n25mKto/tYyrJPylsrrSD7CBT2Q62g00VO8wOM1XtPfYe U83ea+811e1oO9rUsGPtWFPTjrfjTS072U42te399n5Txz5oHzR17Qw7w9SzOTbHpNtH7COmvn3U Pmoy7GP2MdPAzrPzTKZ90j5prrLz7XzT0C6wC8zVdqFdaBrZxXaxaWyX2CWmiV1ql5pr7DK7zDS1 L9oXzbV2uV1umtkVdoVpblfalaaFXW1Xm5b2dfu6aWXftG+a6+xb9i2TZd+x75jWdp1dZ9rY9Xa9 aWs32U2mnX3fvm/a2w/sB6aD3Wa3mY52u91uOtkP7YfmevuR/ch0tp/YT8wNdrfdbbrYT+2npqv9 zH5mutnP7efmRnvAHjDd7UF70PSwX9ovzU32z/bP5mb7k/3J9LQn7Ulziz1lT5le9ow9Y261Z+2v prdL3r6sX4qVy/POe+fdKlbgFbjVI9BuH8A8C5hnMeZZgk7VqSpRV9KVVJKurqurIqadW92KBv2C fio5GBAMUMWCQcEgZYPBwWB1STAyGKmKB9lBtro0GBOMUSVsmk1Tl9lKtpKb45VtZVXSVrVVVSlb 3VZXl9uatqYqbWvb2qqMrWvrqlSbbtP5nfoGqpy9yl6lytur7dWqgm1sG6sr7DX2GpVmr7XXqoq2 uW3uVitZf69k/a1s29q2qoq9zd6mqtr+tr+qZgfagaq6vdPeqWrYoXaoqmmH2+Gqlh1hR6jaNttm qzp2jB2j6tpxdpyqZyfZSSrdTrFTVH07zU5TGXa6na4a2Jl2psq0s+wsdZWdbWerhnaunauuto/b x1Uj+4R9QjW2T9mnVBP7tH1aXWOfsc+49XqRXaSutc/aZ1Uz+5x9TjW3z9vnVQv7gn1BtbQv2ZdU K/uyfVldZ1+xr6gsu8quUq3ta/Y11ca+Yd9Qbe0au0a1s2/bt1V7u9auVR3su/Zd1dFutBtVJ9a/ 61n/Oru1c6u6wa2duaqL3eFWz652p1ttu9mP3Wp7o93lVtvudo9bZXvYvW6Vvcnuc6vszXa/u2f0 tF+4e8Yt9pC7Z/Syh+1hdSu/Ed/bnrAn1G32Z/uz6mNP29PqdvuL/YX3XuH+ylOZrLU1XG4F3m3e bU490BuoPP8d/x2lY/mxfGUSmyU2c+vwfyb73Br43+z7b/ZF2ZdK9tWUpy3vrtiX/82x/+bYfyjH vGCIe54v7lXSmaaN31OVU01UK9VBdVO93H5hiHt+n+CeLHPUY2qBWqpWqDfUu2qL2qn2qkPqG3Vc nXJP9sqLeclJ45RJGpWUnTSe4+ikCRzHJN3HcWzSn9wx20mTOGYnTeY4OmkKxzFJ93Mcm/SAO452 dtM4Zic9yHF00kMcxyRN5zg2aaY7jnF2ORyzkx7mODppFscxSY9wHJv0qDuOdXZzOGYnzeU4Oukx jmOSHuc4Nmmi0q50quPopBmOY5JmO479NyLyBD0flfRkFJmnosjMjyLzdBSZBVFknokisjCKyKIo Is9GEVkSReS5KCJLo4g8H0XkhSgiL0YReSmKyPIoIi9HEXklisjKKCKrooisjiLyahSRea7/o5IW E5FlRGTFvxmR16OIvBFF5M0oImuiiLwVReSdKCJro1xZF0Xm3Sgy66PIbIgiszGKzKYoIu9FEXk/ isiWKCIfRBHZGkVkWxSR7VFEdkQR+TCKyM4oIh9FEXmNiLxNpmwmIrn/ZkQ+iSKyK4rI7igie6KI fBpF5LMoIvuiiHweRWR/FJEDUUQORhE5FEXkyyhXvooi83UUmcNRZP4cRebI/2PvO6CqSLp1K3Sf OnT3aaJIEEXELHIQQcwREwoiRowkBQUxYBzDiGFkzFlRFAPmnDArRoxjTpgwK+aESvDtLo6Ozjj3 n/vfN/966627alFVHU53711V3/ft6qbb5JlMk0fumjxyz+SR+yaPPDB55KHJIye5R85xj1zhPeXO /9Ajj00eeWLySJbJI09NHnlm8sgLk0demjzyyuSR1yaPvDF55J3JI+9NHsk2eeSDySMfTR7JMXkk 1+SRPJNH8k195XOBZyRU4BkJF3hGIgWekajJM4+4R55zj7zlHvmk9RTtO43adfPZtHaoLD5HFtJm NIB2o91pD9qT9qP96UA6mA6j42gC/ZWOpxPoRIiC79C79B69Tx/Qh/QRfUyf0Cz6lD6jz+kL+pK+ oq/pG/qWvjN4a99RwmfwGTjBAu2/c6kf9UOE+lN/RGk4jUACjaRRSEf70r5IT+NoHDKjA+gAUAKD 6CAk06F0KFLocDoKGeg8Og9Z0530FLIxeBm8+CyDA5KEokIxwVkoLrgIJQRXoaRQSiitWQZX9I7P rhfolSKmuYny2jb4TcHcNabRX/coY9qjgjY3RaNhCxJsBO0NYGWEMkj+5ncF57URCgm2QmHBTrAX HLR338G+v5+XIFdkLlgJ1oIo6AQm6AUzQRJkQREMgiqYCxaCNt8lgG0j4CK13xChplALKUJdoS5S YZs3sqPL6Aq6hq6nh+hheoQepen0GD1OT9CT9NSPPK7NltEUmgJHXK79XzNdTVeDv9dRwFHw3EE4 3x2a9fXoKbDXati6k+6iu+keupfuo/tpGj1AD/6ojfnRl9FlcPQVdIX2RCZdA0dfTwGd4QpPwdE1 O7SjV0Q2PzzqD+zgPrtj8pn2u7/Zu/jvtN4AvxN7kS1oFBqNxqCx6Bc0DiXAuB6PJvCvi05GU9BU GOXT0Qw0E81Cs9EcNBfG/Dw0HyWhBWghSkaLAAGWoKUoBS1Dy9EKtBLwYDVag9aidWg92oA2Ajps RlvQVrQNpaLtaAdgxS60G+1Be9E+tB+lAXIcRIfQYXQEHUXp6BjgyAl0Ep1Cp9Fv6Aw6C6hyHl1A F9EldBldQVcBYzLQdXQD3US30G2UCYhzF91D99ED9BA9Qo8Bf7LQU/QMPUcv0Ev0CtDoDXqL3qH3 KBt9QB/RJ5SDclEeykefoRtjEkhakiDSirQmbUhb0o60J8GkA+lIOpHOpAvpSkJIKAkj4SSCdCPd SSSJIj1ITxJNYkgvEkt6kz4kmVwhV8k1kkGukxvkJrlFbpNMcofcJffIffKAPCSPyGPyhGSRp1Qi z8hzKpMX5CV5RV6TN+QteUfek2zygXwkn0gOySV5JJ98BgjSnranVKAi1VFG9dSMBtKWNIi2oh1p J9qVhtAY2oeOpmPoWPoLnU7n0vl0A91IN9MtdDvdQU/T3+gZepaeo+fpBXqRXqKX6RV6lV6jGfQ6 vUFv0lv0Ns0Uqgs1tO+2CheEi8Il4bJwRbgqXBMyhOvCDeGmcEu4LWQKd4S7wj3hvvBAeCg8Eh4L T4Qs4anwTHguvBBeCq+E18Ib4a3wTngvZAsfhI/CJyFHyBXyhHzhs2gQrVhdVo/VZw2YL2vIGrHG rAlryvxYM9ac+bMA1oIFspYsiLVirVkb1pa1Y+1ZMOvAOrJOrDPrwrqyEBbKwiBFQOoOKYr1YD1Z NIthvVgs6836sL6sH4tj/dkANpANYoPZEEhD2TA2nI1gP7ORLJ6NYqPZGDaW/cLGsQT2KxvPJrCJ bBKbzKawqWwam85msJlsFpvN5rC5LJHNY/NZElvAFrJktogtZkvYUraarWFr2Tq2nm1gG9kmtplt YVvZNu3br2wH28l2sd1sD9vL9rH9LI0dYAfZIXaYHWFHWTo7xo6zE+wkO8VOs9/YGXaWnWPn2QV2 kV1il9kVdpVdYxnsOrvBbrJb7DbLZHfYXXaP3WcP2EP2iD1mT1gWe8qesefsBXvJXrHX7AP7yD6x HJbL8lg++6xHesxS2DK2nK1gK9kq9oa9Ze/Ye5YtDZIGS0Okn6Sh0jBpuDRC+lkaKcVLo6TR0hhp rPyTPFQeJg+XR8g/yyPleHmUPFoeK/8ij5MT5F/l8fIEeaI8SZ4sT5ET5XnyfDlJXiAvlJPlRfJi eYm8VE6Rl8nL5RXySnmVvFpeK6+T18sb5I3yJnmzvEXeKu+T98tp8gH5oHxIPiwfkY/LJ+RT8mn5 N/mMfFY+J5+XL8gX5UvyFTlTvivflx/Kj+Us+YX8Sn4jv5Xfye/lbPmD/FH+JOfIuXK+/FlBClaI QhVBERWdcle5p9xXHigPlUfKY+WJkqU8VZ4pz5UXykvllfJaeaO8Vd4p75Vs5YPyUfmk5Ci5Sp6S r3w2IAM2EAM1CAbRoDMwg95gZpAMskExGAyqwdxgYbA0WBmsDTaGQgZbQ2GDncHe4GBwNBQxOBmK GooZnA3FDS6GEgZXQ0lDKcM8w3xDkmGBYaEh2bDIsNiwxLDUkGJYZlhuWMHvPvO5fT7HPoIsJICg fOZ8EW0K/H6RNgd+v0yDaQd0lXamXVAGZ9MbtDftjW4C441Et+g0Og3dpXPoHHSPM/t9zlsPOG89 5Lz1iPPWY7qNpqInnCGeClWFahjxGXgiSqKEjaKFaIE9+Bx7JV2m7gF+xIysMn7O59vfSL9I8wiR UqR9pLB0TPpAKvFZ91A+374M2P41MkN2yAU43x8UUCIwwF5AZziFPAYR9RivreE17R6NBbJFReSj sHxZTof8qnwM8gz55Nd9L0MtDelBT9ihoqAAyhXcPZKvauvlDMhPyDcgPyXfgvw3+Zn2S7WQdkTV VjuiWlg7Ij9WHj/ql3s0ZrB0WJUgP6rK320x51ss+BbL77bY8S32fIsD30KQGbSaEdrOh2hfS6pO qiNCGpKGiJImpAkSSAAJQKI0XZqOdFKqlIqY9FJ6Cccj4gpy9h/i2O8Z9v9vfv3PMKzGoX+XN/9J zrRi4awbi2Q/AQNpzOkLnNmMs1kgMNMkzpPtgCM1dizgxoi/yYpD/wUf/pkN5wIP/s6A37LL/2ts +JXtgBfnAH9/y4p1QX1o2qNAeWi6owUoj48m3ZEDqqM9KI4FXHMsBMXxCXptG+ipXbR++YU7Scz3 vKlYKJaKlWKt2CiFFFulsGKn2CsOiqNSRHFSiirFFGeluOKilFBclZJKKaW0UkYpq5T7IduO+THf qmaqpMp/i3XX/Jl3VXPVQrX8E/seldPlY5yDT/6QhS8DD1+VM+Qb8q0vfKzaqoU5Jz/7S1bO+zMv q3aqverwb7Hzd9ys5P0H2NkfE1wIQlkHXAbZ4Ba4FSrB77mXwZ1xBCqPu+PuyBNH4ShUGffEMcgL x+IhyAcPxTNRA5yIk1BnvBX/hkJJXxKHhpEBZBj6mYwgI9E4Mor8gsaTBDIRTSGTyTQ0k989n0tm EUB7HuMvoAq1QgupDbVBy6gtLYeW0wrUHe2mHrQB2s8Z/wJn/Is8erskLBZ+Q09ES9ES24nvxffY XvwgfsAO4ifxE3bUgbtwEV2CbiJ20k3WTccuupm6Obi0LlGXhMvrFupWYXfdGt0WXF23TXcEN9Cl 687g1rpLuku4s+6qLgN30d3Q3cKhoA3ycITuM2iDeObNquPtrCarjffqy+rL4TR9Bb07Pqj30Hvg o3pvvTdO11fVV8XHtPtn+Li+jr4OPqGvp6+HT+ob6hviU/om+ib4tL6Zvhn+Td9K3wqf0bfVt8Vn 9cH6YHxO30Ufhs/ro/RR+IoZhP34qhQqheFrUoQUia9LPaQ4fFsaIA3AWcCz8/BT4Nl9+B3w7Aec LxO5A2FyJ3kICVEWKnfICMNEQyI5WPB8C0Sj6/gdl064m2nNtm/WYFQN6UzaoxRomsqwPQWSlq8D VZDCS21pj2lpDyzdgKQ9ZVMel4deUxFXBLrzwT5wzEa4EZCLH/ZDAp6D5/CnbNJRiOggOopFRCex qFhMdBaLiy5iCdFVLCmWEkuLZcSyYjmxvFhBdBMriu6iUfQQK4me+Dy+gC/iS/gyvoKv4ms4A1/H N/BNfAvfxpn4Dr6L7+H7+AF+iB/hx/gJzsJPBSoI9D3Nph/oR/qJ5tBcmkfz6ef/yToBTBEIn2kQ +H8rWPK5HztIFBWBJIDnSoOlFZD2XJo7JD14tRroxBqQJFQLkowaIF+kID9IKmoLyRy1R8GgDztD skLhkKxRJCQb1A/FoUJoMBqCCqMRkOxhdBLkgM2xBXKEMeqAnHBRXBQV5U/HFIPx2gI5w3gNRsX5 XV0XPlJL4GgcjVz58zIlcX88AJXCw/AwGNMJOAGVxePxBFQOT8FTUAUYwYnIDUbwVlQR78dpyB0f wUeRBz6JTyJPPt9UmY88b66pm/JZp8581qnr17mwQ6a5MDfwlBPxIB6gGL2Jt/a/YaQBKMampCko xpakJSjGtqQtEkH3RCAdKJ6eoBjHSb8ivTRBmoJkaZm0HFlIK6U1yEq6JF1GttJV6Tqyk25Jd0FL D5WHo+LAHqORq8YMqCwwwyJUXsNx5A44fgl5AHrfQF6A4LeQN2D4XVQFcPw+8oHY6iGqClj+GFUD PM9C1QHTn0Ebac9/VScdv9py3GRLRbCl6He2VCVVYV/NIkpaQCwjcItEbpEO9F0wYtwuPai3PsiM 2yVxuwzcLitul420TtoAFm2StiFHbqMzt9FFeig9RqWkLOkF2KVZWpFb6sEt9eaW+gD/pUB8sByi jNrcal9udSPgpffID1gpDyITzaImpIfp7qv2X47h3CJ3zUbcko979HUN4nOZBEfiOl/XEdwKV4Al m6/7wQj4gS9qkBrgC80jAm9jkftFx/3CuF/03C9moHs7IYl7R+atrnAfGaT2UnukQmQ+HJlD9DUN 2n6GNA8VgRhsG3KVtkv7kDdEYi9QLemV9AFFgIb4BcWAWpiChoA6WIPigfu3opnA9VdREm/77bzt dwCDZ6KdvAfs4j1gN+8Be3gP2Mt7wD7eA/YDs79AacDur9ABYPg8dBD4XIdOg8axQ5dA1xRHN0HL lEMPQJXI6DmoC0v0CjjeASIAQEKIkPogpEWQqJ42y4ACtee2UJD8k+KLTsNvnPBc/pQj/b1FUCj3 q5H3uhbftIjx9xZBrVCtr+sIqsPvntt83Y8gKs2XlsKZ90vp0Ns+ylr/hbU8zi64nuL8SoymsxM4 i8O/g6zwy0IchxDHIcxxiHIcEjgOiRyHdByHGMchPcchM45DEschmeOQwnFI5ThkznHIguOQFcch a45DNhyHCnEcKsxxSPu/4gNggUIa053giX91H4ZgCVvBVbrgcrgSrobr4aa4JVxdKO6Be+MBoF3i 8Tg8Cc+AsybjZXgN3oS34734ED6Oz4BvroMfHuHn+C3+BOCvIwqxInakKHEl5cC73rgcWF8GfOHG y2BgP63shKvysjOuxssuuDovu+IavAzBNXkZimvxMgzX5mU4jDytjMB1edkNN+BlFG7Iy2hgVK2M xQG8TBQLa6WwTbTjZapor5Vqjl7WStFar2ilbqnewMs9epWXe/XmvMzTW/AyX2/Jy896K60E9WLN y9rmmJ+nBy4LSGAOPE9gqQLkwcD2mnYAPAAroQ+CjR6Qd8WVIA/BnpCHYtARYJsX5OHYG/IIXAXy brie9uwHrg95T+wLeTToBQJWNYa8N24CeR/cFPK+uBnkibg55POxP+TzRBtEwN5CkKeK2sxHjh4a BiyFXg12CpDv0YPeABt12tNMegZ5vl4P+We9GSJgG6gffW1UFkZVR+DbaODZoWg0moBmoPloKVqD tqDdwGMn0QV0HSL/pzC2TffzoCfZQV93hb5kxN64BvSmxtgfEDIY7O4GVqwCbyWCh1bzshNew8vO eC0vu+B1vOyK1/MyFG/gZRjeyMsQvImX4XgzLyPwFl520ztpJdhYVCvBymK83KN35uVefXFe5uld eJmvL8HLz3pXrQSLS/KyNl7A228hb7lk3nKLeMst5i23hLfZUt5mKbwVl/GWW85bbgVvuZVae+ht uMcLcY/bco8X5h634x635x534B535B4vwj2OkWCO+FPdlGMF4iMdm2v/oqG9ydefP1NfBlUCLjbN RGFb3tcK8z5ip51bOwq2/1qL1HqShr2AJ7N4X+G5docMWwBCIVwIYhrMkYhwfNE4zQ4l4Na4LW6P 2+E2OFJqB+wTXDAvTPqT4WQcmUkT6Uq6Sc1V89R89TPga5K0QFooJUuLpMXSEmkpYG2adEA6KB2S DktHpKNSupqtEpWqgiqqOpWpeumj9EnKkXKlPClf+iwD7MlT5WnydHmGPFOeJc+W58hz5W1yqrxd 3iHvlHfJu+U98l75mnxdvinflu/I9+QH8iP5ifxUfi6/lF8rTNErZoqkyIqiGBRVMVfKKxUUN6Wi 4q4YFQ+lkuKpVFa8FG+liuKjVFWqKdWVGkpNpZZSW6mj1FXqKfWVBoqvqqgGVVWtVGvVRv2gflQ/ qY5qEVW7B1mKR32IR3oiKAc/4LQeJBpYOw4iOoUMg4jOwJ9+Vnn8Zs6jMgs+92pJN9KNyEq3XrcB WetSdamokC5blw26DWIVVFiLVUDf3JTuo7JaxAJqZhxwdzWI2bei+hBtX0XNIOLOQM05d/tz7g7g 3N2Cc3cg5+6WnLuDOHe34tzdmnN3G87dbTl3t5PzgbXbKxbA1KGcqYdxpv5ZLQRMPQrs3ImC/06L /nst+I+005cWkrg3EfemGfejFfejI/ejK7fcjVvuzS0P5Ja34hqlbUHkJ/Iv/UG9KdLmdeuhot/2 /z/24r/ujwV9B45gyXsK4j2F8hbW8fZUeXua8/a04O1pydvTirenNW9PG96ehXh72vL2LMzb0463 pz1vTwdot8LI0XT1sqh+c/Uq6E3TiNXGPO+niPdTzPsp4f2Umn6riObf/NYOVMlXFPgy0jly8FHA e7LIezLjPVlfEMXiV/g9zjGpAUtiSxxJCVKWNhHDxAixuxgl9hP7iwPV4moJtaRaWi2rllfdVHfV Q62seqs+ajW1hlpLraPWUxuojdXOarjaTY1UY9RYtY/aXx2oDlZHqCPVMeo49Vd1ojpZnabOUGep c9REdb66QE1WF6tL1WXqCnWVukZdp25UN6tb1VR1h7pL3aumqQfVw+pR9Zh6Qj2l/qaeVc+rF9XL 6lU1Q72lPlNfqq/Vt+r7/32q/H+fufy/9MwlQRag+buJ1moOcH7tv/VMOYxE3EN3/ZsngPXaszKm p2r+y2dkvj5HA8cgNUnnrzF7wRo/QKAvMS/Bb1E2aHQv4gN71Id1ASSQtCHtSUcSDljVG1BvmHZP 60dJu4/1bYKjfJ98/py0u17fJu0e2Q9T/T+khtodtO9SwJ+Tdjft2wS2/EUCPvgugc3fp/Y/SsAf 3yXw0vepM0+/L4f/IXWH1OMvUu8fJTn/+wSs9X2y/0Ny+T6Z7Cu4Xn6E/52b+Iu5CYxuAn/WAK5v DCq7FX8Pype3n2hvQvkVTUGzIPpZjFagdRD/7ET70RGIgM6hK+A/I7/X+9/Nff6tPODfyX84/1Ew O6JAMUuLe1BdLRYArrPl0YN2jwPjshBHE2D7mVCfhWdDfQ7Wvt69ACIvgrfiF9obYPEriFde829g vMPvoZ6NP3LOzIF6Ls6H+meifYGEEAH6nEh0UGdEe2uqTCD+Jgb+PQ8LAjE2sSI2UC9EbKFeWPs+ B/CqI9SLkOJQdyEQuRFX7csfwLFloV6OlIN6eVIe6hVIBaR90cQN6hWJ9iWeeWQe1OeT+VBPIklQ X0Ab8be4NkGUNhWttffEiWCv6CD6am82FBshKjYWQ7T3dItRUO+hfRUYuHog1Adpb4wSx4hjoD5W 3I+0LxynQf2AHpBZTyCKJPpSZj0RNos2A6VnFmNYibBhlQGiXsNqQxrUDxgOQ/0IKFWsFgWdQUFN fuYRHqCyOTEvU/A/zrxlCAo1/Wfu7xoEcw2CuQbB3/wHKeYaBHMNgrkGwVyDYP5/H5hrEMw1COYa BHMNgrkGwVyDYK5BCq6QcCWCuRLBXIlgrkQwVyKYKxHMlQjmSgRzJYK5EsFciWCuRDBXIpgrEcyV COZKBHMlgrkSwVyJYK5EMFcimCsRzJUI5koEcyWCuRLBXIlgrkQwVyKYKxHMlQjmSgRzJYK5EsFc iWCuRDBXIpgrEcyVCOZKBHMlgrkSwVyJYK5EMFcimCsRzJUI5koEcyWCuRLBXIlgrkQwVyKYKxHM lQjmSgRzJYK5EsFciWCuRDBXIpgrEcyVCOZKBHMlgrkSwVyJYK5EMFcimCsRzJUI5koEcyWCuRLB XIlgrkQwVyKYK5Ev7wf5+rYQZ+3tejZ8LXLuaIx3bqczKze28dhsA2YkOd65CazyJRh7yEYznVhe pcRBRMYQnVRehwUcX4VgITnIGGis8M2aIouL/lyE386pgQJQKOqHYgFEI1Ac/Gm3d2oZi39zMMFm wIE3x1qenzBLvTYjOrTH7Nllhz+LTo53LGaMFw4a4+nqZEowIdaecIkDDpwOfax2GlOLX/AAo+Hr 1WIRrmsgv0zaWtBZk9ZBHtZGS21Bby21DekXGdWre1xsLw8Lo6qtZNasZUR4TGyvcI+ixiLaGsm6 UPOosL6x/WK7xTnXj+3bO7ZvSFwU/KK4sZi2nVrb/b69VVRMhFtQXEhMb+cW9esaixY2eHgZvY2V PapUNlb2CYZFb2PVr4vGkZv/kSszGGVtu2wtNA9o0dKjtLFkwWLRXvWjekdG9HVuEOTr7BvkX61K 3YZ13Xwre9R38/WoXMmjpLFEgUVFfmhRUETfAVFhEcZ47PKth7WPTsUDSsF6icRjjNa4F8prahdU I0b1KxXrOKx1pbjQjbFJY261+Ri4qefNaNzBJjOqodPlG8vDn3X3XWLT2TrOMb9rWNSSTv4r5rBD UXMbZyzrc/bXo2OKD9piXX7qyfNpHTY0Mz9cZYDfus2j8mfK7aYH3E9Or7FYSH+a2HJWVsKRhWnJ 75cHtJEORY3P7Hpn4c533Zz86oe7u6S+3PJi6KjDlhYtjiz6pd+prntyx85yfCvUCqy9+/TGYn3z tpzwtUStR60buaJ7xyjzmglv9s0KqW23vez8uIeHg9q1kfPiNw8a0ifIflyy6Nhx4NKk66eECfbp 2QE7r17u4Rp5KsRh1CmztlF1Vq290s7VLv34+NmDP1x65p7lRSiMoyXx2Aw8IhqdwKVOKshxm1mt xU6RpzvO7/HZQwhc3drx869Vgngfcioh2Bltf7YpUfnD1ZYNe0vP6uQMyNlcfsNBr83mxlbaDsWE 5kY/Y5PkRsm+Y+tHxsX1rubuHtY3umLMl3aqGBYb4967Z5S21r1339jw/mFx/dy/NqPWirwRoVdW hF2M7XR6GJiiyDAWmhmbGht/WTaSsTVMJxg4cOCPThDR9784cpzRWrvekoJilL4ckur/MCCp1kvq 9di7b8HoEKeo861u+xS6U2JusVoOvnvNf92eVLhl0vBdbVu+jmj2du2s6xHGxEVZJXMcn4Z372Ib FtfLPq720FPv79dqWbh85/Sj9jsblFjYKebzkecVPDcoib2mTy59vb0aWdNQbfkeweXXm7uLW4/I q3vwzaEjtZ+lbm+0x9AkcVSd4D39Fh7Mzi3TbFB7ZZLfJmmS9+NnnfLbHze30c10vzHvfFrMph0T bjklrDuzy2lKWuyVkaH33r9sfdI/yWlkzKFTt+u1kN/q3pSe0XTI0Tr+2XP878xYd+qET9TMpTfj P1Rs29Il8frMgDj9wSWuk4aEbgu/rnMa33i6+8CRiwdnJTV5kLTBYd2xof1S5gGMPQUYu/A7jGGp wuB1lwf/tEx7JTos/RHGBv8jYFHCWLxg0Dt8uz08wjkoqnsvOOqfgKxSZa9vgUxbNI4c9Z8AMtPu 9C92/5fANC031ntXJt1R5lLDs4tDdqY0zAmzrVXxY6NzR58+Ozp3Y6nA/nuunTTX2VgujbZfsL9L 81YJ95q3uDLx1KKQlIHWiUWWPzPEZS9vM/hRmeygcxuHhN1+N2N26tOrjT5E13xTctzm3dJhYfmk oWMaDygS0nCV/aEhoePTDnitymkXezhMnt7EONLxp1sjhgZsaRTTZVCR9duyZ1m3fLHjbPOq9/vd bOxfw2bVbEPVk+MDMzuerf5yUvcnxq4rmwcn1d+TUWLnfvPLfhZJ85u/DFw8etW9+ctrXlryQrJr vOLTRv+UOarfvpc2b1D6hsaXOuT7XE6wdBN31icBLmhWybXDvHqNjlztbOdTJr/IYouNKV+AqSt4 pOOPBir9Bq0S8iWPJ6VOPYg5OnXqjhkTFtuFAGkFapstBcCLpQ2NDf7YPp5GD21RtC7n6eFV1au8 sbKxSlVPL6Obh3e3ELfKYd5Gt1Dv0G5uVcMrhXqEhRu9qvpU/g4AT1g+On5ui207fKxKRU9b2x3N EqVixjYFABhgBAhMBggc6/vfAkDoy9CToRN3Mfq4eXq4VTJ6GDkEBn8Dgf5GAMFvILDW34PAvzh2 3I/wbtmKoKm3quP8kE664KxuL5Ur2VdHn0eBqsXZpWcLl3k4wdOn/JX6R+j4/lme096uvNM9j2Sk OPnX9+3k2OTu7QDbl8MnvxxneTx+7dKcZSu7vJvdNf2nQ/uGzot6Viw+7dWpSYP8Qt9dNhS5HGR1 aVbLF1577Ccl15m+SEpxs51/oGGcPivj7ZWUJt6trCxb080/2eY0ys+JzN3v2/FObavBnotfxB++ WceePS90WJrXXqy78szsBSMX0A65Te86VBTXtGjkPuHT4CtFnT+IOWV72tl86iukyssTw59adgrw bTKxrINbzpltZkFdKs+4bXtox5N+Xo/avsjMsj1od1S3ufpvIaPvbGuQMGPJWGO8OBfwbmQB3lkM Xmu7qGlyytpm/dq9ZdYVI/4Idl04hkhm00olTH9dIRzb21Jwv4e9sfB3K82+to6Hm7F8ATq4/o4O LWNjASKguaK6RYWFxEU41+0fFxnbNypusAZp0FpexqqVPD2qVqoEkFbJtFjJx8Mz+J+/gHjyZ7Qi GloRQCsIid90+vRz9wvBy1cqFaY4n/HS1+g/+lQqS5ifcO3m6YNdP02NDF4wo09ZuwFDD9xOLzlg htruk1DZ+8Gt9dk/73zcTi4//X6SeHegy9TsyuE1XKY6dc40m7LbJj+3fzv7zMGpbNqSdePa668s ZMdpu9zIsjGVLp9bccIvN1NuXCngQdb2tQH3OsZaz5ibMfNi/4wVDqkzpm4Z2OFdY2Vyj8HDbHoL w2LWT3l3rfeVRqn75rlHPxRTMy27rhk81Wbo4UvL7mUOv3hw+P1p52qgrd7xNwdnxrzZ2uvDQs9j J1oO6zfHO2P8op6LZ86et+TmgealPutmdS+pS3+45t5zK8+ZHnPTvfT+lY8PDrq4dW9YpfZ1vPen +AvNa2Z0YJ732u17UTso/Eq99l5t88x9h7oKzRdc8omznO0y5XRkg7hpsRf9YjeMvXvUu17ymdy0 /cEfl4TsMDbqM0uy3TB1f72ZLyxGlOlxt1yxjfdO0doD+whHnXObmDv5jlt6+cTwcWsnuT31zTgU KBwrl/t07IJEy9kdbp4OGvfgTmrempkHytTJeCFMuTXSs+rVTb4pJX7RpbRO8Nilc+uq1rUbVqzi 1tknLLMKXXRNmfGikE1Cnl+/T5U65J71RB/bh/ZmlZ5UXF3H7afjN4p3dzTOnWy7qsSKumc39LKc 533oZp24+ZntItK6Fh3SwSd98i6h1NALtnXub+sZvWpsHtp3Os0kIwONARxkncwFAUbOEaO5tmCt fcNXNFIovoFsdU181zptSs++X9I6t1ymFDSz/b2lRgudmSkEK4S1I6A/gROsO2zZnFbreqNTS8uB kzft8k7fJO7bkrriinNSR2u6rYjLJ52117b0sAuJjWJLtT3X+pWwsVSXSytbRCbvPre918mDj9fc sj81aE37uDXdKnsfcqwV7dPMUzVaGZaUyg8MQp/XB/uPNpgXuxcjVvQf4zcx2jO21bnw1ftarB82 pGpylWdh1DzXWnfa1vtCq+ozHQNDq91vXviCWHVaYukVHVbtebpr713nhK59ottsTrE+E6OWGD6T Pous+fpK2Paezbc9Mm7NPD7DL3vxqk5zjZtqLj8QGF3GGbuWLu+HUpMse/beu8kifrcyL/LMxOqu v6yaW6ZvkmeX9lP2vLs5fUG10ODKVe+Ma+20Q7chLaGn2+Wog/ZW3qPPHEu+9tk9atCm+0OuZV1W 9mfvCSu8vaq1z2LvDj+9HtOmh1N4aJrPnVX7ArstnvHOan43F4uer1ON09xel31Zs7pN/cjFr+aX rXLitI9zyZih3d8Md7VypfqRjZ7+n+rMPBzKtQ3gYxmyJBlbShlkH97XcnCY7LumsTQSJSL7Nlkr xYSIQZbszIxERfYoyaH6MsgeImSyZAlJ2cI3dDo55/Sdc74/vqvr+2/u55n3mbmeuZ/f/O7nzs1K /sjb01r9Ytbv+uxaSz8mM4mguZx8bLgHFOy0sRw75CEImdQKvXew/+WHHRinX+xd+S9M30sg2Vl4 SPeOH4t9AhqIDAyKK1z5CHh7WXGqOtdEcgRNSees917Kwh03ZZas05J8CURkN7CvRuLHiGG+chfd svrPwuztnHNlghqvu2cvUUuIeKQHnBNORr5+vHbVNdNwrZ2Ymarlr1bcR4XzQyqcb3yBM7OtnAjf VikN/ggsgwCgJAfKyoLKcltY/jWU3Qx/pAT/nV6WYi2t9wD2tfxppwQENFP9zNwO7e32bG56P+m6 nszN/nroZ5/LfJUyBNnpjcF6TZTQCyykX8GCObLxroDBwpxTwWEjfG5NoJF3uh5j39rBoUzfiNbb Z7Uv9YT0f6iZ/+kG2VrnVVEh8rWYUzJfXi72LOY9T+LImkIiltDtZ7PfX+dymBJ321kr6ANHU3xu qbNM3x6W9XgfcYqfjPkAJ2C51IG3W2si2+iC6PuisBF1oBUrzi4m+EwRhSTIIuOeE5UYwqxRGJyY BFS20qjnyOnxDoTdex3keMEOyCddYla7VbSI2dtztw3ndVsVVZWyyv2tc3my8E27YzGqdQVMNnSd X/XyJHVHjv8Vp76redsgFw5wbIcWdGthQOjbGO3mKmvtIKpT5GrScMoplXzQ86bqw14EsOe3N3HS 0rPuZ4aYQXwhdhAtiMbvRPO7pER/EU0DQA/QIWgRNMLV/rlo/jaNpab2ph9uKab5NsXUB6jGvE0x lf6bKnvzwGh9WfXPcknlt6XyoUsiukVTnuolshUuU2wyHvkGi1M2vu+MVRA9WoUs600TCDBHqPkC OiUYfqIAKWP8gJSPyXjjVV1VvhRYYYBdPDSpcalxmJXHuSk3QwCxwoJ+gnmOeGPY8dBrPH8niS4X 87rqqpHFfJJmxvsPszNvwg/Iq1Zh0ubMhMIkbuD2JVASGfnnKailaGLjW1juNVTD3o5YbJKEt3s6 39K+ObNux2bBDWv+56ToGtHSwNMYbZLJ8+WJnGOYgXRaHW0Zm4W+u104WY/PN5JgI1PO47dIUo8a JNnZHGJS+z+SVjhEmByUEt+fO2BY3T6MedsWcJ3XmqzAbTOQwG8Qg3hUKK+9b4adiw9yYkDBCt6S 8oxpJowt+og7GwyFvCCun4Ft/+DWWDftlWMRbxGUiCfs1ac7vtia48jsk/vTO4QMT8MYVpFjwbNE 1RG3bFqKl+N22M92dYB90H7Bs0W3q5NnIvAJfXnnqtTQgatZBcyrMFH1wpHl4VuXdKsZT+k5nFJH FWtOo96V+QX2Msszue8LBg9Q2MwHRomro3rshfYpG2hu6Qu1UPg5SpKGqPPjhNgkMr43HX53p3XG HOluuNNlVhdEtZ8rhP964Tz3+U/cl4XvR7S65OuBMmmv3ngjeyAX7fTaWyLIVbwrbFh8XQ6yiFbd ZcM5/TqFPZ+9XBG9o/sxEsAxMFL5PfuV39xO8lv83vdDtFqRWvhRia0gByh/0erNUA7YDH/cXezf 0Tub6FYy1K8fL3HBVXrPcA3lzdNUEyF0YcsAL0p410x7XrtxoQ8gsHuK8YV5EpdB4l7N+Lsp1oBI H8T17fma6UjGXYts9Clzkc0HmuSEr2TOLzjuk/p8fjyCf3IclUOsEzJrxK/otDK1nSxqK9akJy3f dEtw7BF7pWtWHN42KqYrLVoQfuSoKesIndSqS1wc4HHlgyWQuXKxO7nsLTz54lIH7MOOSjN303Kd uGx9iKHemd2i4mfyk0c6GUIMScuhebv1OJlw2aHvjgas06Txo3eEQdgB3XeVg0K61U8Q5tlF+wM0 QP/m9CGVywlEW9oK/p0lnxfTS2laBI3MN5ahj+sFWL7S+w51R/L+it7fvaX8Hb3/rJwhKV/gGxIH hOC/j1/i6Ru2//P0xP257vx/of4/ulel7jV78tXH1nTaPw1MlBf697cEmhymKZH28bZyZ4XdaXl0 PrZKuouDFO1uV2VB24QSgKFTB86pUyyqi46l7RvmpwkvqA6Yj2qbVqGZoTyKZYY24PUpc2ZcA0fu xI+M411eBNeNJc4zyITRTVyTEBb0Wv30eSQgVXrnIiPF6yEvKjPGlRmbVEVUznBEPDVhm7SzVuNO iRJQozDyyS43g4Z+IFISy9Iw6YXcCGOGDdUz28bM9VTxTKGiLj1VkDyZUzv1MIhF83yXGRY+AzRW BzhYW9HwMHOydfRxpnxUvX/mWBlCZnw5LLzZBPM20yvRrUDZuOtTYO1t3nN24rOkdHF5Bn8+OzJy v/sB3BzLM6nqVq2y0eXpoIo3N/J9FKpQT72FOET8WFRNo72P62pxPiwrKz7s2JCtuREcCA/O4gLO vNXkOMnXkCUIb9OakJyoXtBvlurqlQ02FpHQF7Y5PomZvTmYmtn4s2dNiKgPw+4ZP3htOq5O1Pxe iQsykuhnW+5BhN2sva03x+G5dlXWrXR9yKQhWoh8piaT/wqHPS0SUWQZWzUCH60objxdHmAO7dKQ RhckFucG3CkjXPflexl/BeYrKCObv8ODYBV9sJYwG9oI757af4ScNmPwepHGwTOSJajBuWHMYzIv uQUU32B7amXde3gvsXdFJktN+ii3KxmWswbi6KlHmD6PloYGoB63H+fL37/T/tbhI4Q82dS1X/OX iQ5k3d4+pH6BbxELyAZsn+XalMGvD9KDVChJQ6cb1Xa+QUCLpGOxryPZTHgX7wL22x5hBTGAOUEi WAxyGOIMOQ3BQjy3OpBnID4QAYg5JBDiRY0cqeO21FdOkECiSLDwfzysPoFeno5YWy+nQJk//KnQ 42ggkryqtitBF+oVik7br14Z61dzG4Mho3zEcl7cj9XSa7V59ovbjbMbfe0LKtohUlwqXm1OfqpL o3sZ/ZN7lNssxAmvTgXTdfwri9PmmmlzUrCqn/qDjDA0UKkg0X3Smn+Yg1xBszYx01+S5e6/otXv Y+cZoAnyhT0lCLImyE3Cb+8cyosJ733uWVFor3ZyY7DPskBxMt8roUqlnNTCp5HGc4K8Qe+qtlC3 nLBYdEY04jjZeDcjHC2WDmaO6pny9MO7eODOR6MM8CYdWH9zOgWLI7e99pZE3GIS4j+6M7KmFNqq x6i0GpgvbsholJgPRQsbOWDlzb1z44oyX32oZ1oiTsYQcbRiAI5W+NtvxADiaLmoQ7u3sjLmh1nA 99vF23LyBMC7PSVZvrW9aagf/tsMFNy11RFRBkFQSV5Znio2f8zIj3vqw+AOzxA+dQ27BEnSJBZF 8cw/8HozV06xqd+5ZN3EFxoaJSJ1mseFQgk6hiuMoJHzm5e0QFj6NlebxOSomlVVMLxjLlE1oVRE 5VTO70pftanMUl0OyTh60VzgrusilF1t15KJbRyn5bX7ifOH87lPtSdfz35J4KqvT7mX/ulnSaV1 CSM0OqnMsvNFWNCM6Tr9TagYv1Sk7+Ity5yblh7cTG5tnLOG42lK3aBV/Y7DR3N7fKomjSNwUCNB pk4GM+FgZ31tbrN82shb/ceTySMPaGsnPad7LV4OBre4Vd6+JWfShhHIscJZuoZrJWp1LapoaK5J BTnfTwTyDuqnUIhSh1hEG4kwPc9QWnyobd9BrhElek2DqGt4wr8BS/OA7A0KZW5kc3RyZWFtDQpl bmRvYmoNCjUxMiAwIG9iag0KWyAwWyA1MDddICAzWyAyMjYgNTc5XSAgMTdbIDU0NCA1MzNdICAy NFsgNjE1XSAgMjhbIDQ4OF0gIDM4WyA0NTkgNjMxXSAgNDRbIDYyM10gIDQ3WyAyNTJdICA2MFsg NTIwXSAgNjJbIDQyMF0gIDY4WyA4NTUgNjQ2XSAgNzVbIDY2Ml0gIDg3WyA1MTddICA5MFsgNTQz XSAgOTRbIDQ1OV0gIDEwMFsgNDg3XSAgMTA0WyA2NDJdICAxMTVbIDU2NyA4OTBdICAyNThbIDQ3 OV0gIDI3MVsgNTI1IDQyM10gIDI4MlsgNTI1XSAgMjg2WyA0OThdICAyOTZbIDMwNV0gIDMzNlsg NDcxXSAgMzQ2WyA1MjVdICAzNDlbIDIzMF0gIDM2NFsgNDU1XSAgMzY3WyAyMzBdICAzNzNbIDc5 OSA1MjVdICAzODFbIDUyN10gIDM5M1sgNTI1XSAgMzk1WyA1MjUgMzQ5XSAgNDAwWyAzOTFdICA0 MTBbIDMzNV0gIDQzN1sgNTI1XSAgNDQ4WyA0NTIgNzE1XSAgNDU0WyA0MzMgNDUzXSAgNDYwWyAz OTVdICA4NDVbIDQ2M10gIDg1M1sgMjUwXSAgODU5WyAyNTBdICA4NzZbIDM4Nl0gIDg4MlsgMzA2 XSBdIA0KZW5kb2JqDQo1MTMgMCBvYmoNClsgMjI2IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAyNTAg MzA2IDAgMzg2IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDQ2MyAwIDU3OSA1NDQgNTMz IDYxNSA0ODggNDU5IDYzMSA2MjMgMjUyIDAgNTIwIDQyMCA4NTUgNjQ2IDY2MiA1MTcgMCA1NDMg NDU5IDQ4NyA2NDIgNTY3IDg5MCAwIDAgMCAwIDAgMCAwIDAgMCA0NzkgNTI1IDQyMyA1MjUgNDk4 IDMwNSA0NzEgNTI1IDIzMCAwIDQ1NSAyMzAgNzk5IDUyNSA1MjcgNTI1IDUyNSAzNDkgMzkxIDMz NSA1MjUgNDUyIDcxNSA0MzMgNDUzIDM5NV0gDQplbmRvYmoNCjUxNCAwIG9iag0KPDwvRmlsdGVy L0ZsYXRlRGVjb2RlL0xlbmd0aCAyMzQ+Pg0Kc3RyZWFtDQp4nF2QTWrEMAyF9z6FltPF4MRdtItg aKcUsugPTXsAx1ZSQ2MbxVnk9pU9wxQqsOGh94knyVP/1AefQb5TtANmmHxwhGvcyCKMOPsg2gac t/mi6m8Xk4RkeNjXjEsfpii6DuQHN9dMOxweXBzxRsg3ckg+zHD4Og2shy2lH1wwZGiE1uBw4kEv Jr2aBUFW7Ng77vu8H5n5c3zuCUFV3Z7D2OhwTcYimTCj6BouDd0zlxYY3L++OlPjZL8NFff9HbtV o5Qu6rGtqr2t7MVVppRlrxHtRsTp6kVqrBLIB7weLcVUqPJ+AYpQcd8NCmVuZHN0cmVhbQ0KZW5k b2JqDQo1MTUgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNDExMTkvTGVuZ3Ro MSAxNzcxNDg+Pg0Kc3RyZWFtDQp4nOydCWAURdr3n6runnsmMyF3hkwnQ6JkgEAOCCEmkxMwIoEE zCiBBIgEFDkCiidxFdF4oC6yqLvisSqeTBJkh6ALK66ryKUiHqsSAe9F0PXkSH9P9QyRvCZLRpbk c6lfUf+uu5+urq6pSjINEACIRBFhbmHZ6JHTHtY8AfReGSDm/ZGFRcW3HLl9NJDtNwPQF0eWji27 euJTq4C8fh7A0zEjyybkf5hfNQ7otbUAsSvPLSsvnp08U4P1sVGIO6+8bFT/MAvWTfwMwFw9tiwl 1Zp6LWaSHzG/qrTgvPJjV+cUYPulGB86sXBMRends74DSMP2bcunza6e+8TQcw8CWYL1yYvTLl8g P2R/+0sg974PoCm/eO6M2Vuv9NwHZOnTGL9sRnXdXIgCPbbnxvasMy698uKUb97eCuTBwQC6L2qn z170xdHXtwMUtgLJ09XWVE//1NNfi21fw85fiwmhaeZ0jK/FeL/a2QsW5UdTzKMVAM47L50zrboy c0opkCfs2D/Pz65eNDd0vsmM5d/B8vJl1bNrJo75OhvIZowbRs2dU7dASYYVaI/M8ufOr5mbuHvM RiB3YH3jX4H1vZQ5Pvb3KbdPCcn+TherY/0GD+87K5kd31i+OObwmmMzrKAzYVSvlmfgUZvTdj4U WOHwmsNXWaE9J4B4CUsxV0IcUDWBghVSYCLmPI3nZQjCzeROkEAn3SelYQOx/qPwOlxMQ3USNWpE yhBbIVnZBIsKVAuQ8jEFMrghXk6Q3mwbR9K0OaTJDURRFGw9SdrArhRETcAkOhyOH730bZgMvxE0 T8LK09W2WAfFv6YefRKW/Ldt6Q3oNpjd2zZ0B7FOOdrbNnA4HA6Hw+H0FGS10tLbNnQXKfa3YyuH w+H0JgSUFh16K/B5k8PhcDgcDofD4XA4HA7nfwdzpZYQeErT/RoLO092dogF0V7QNYJvm8Nph5y8 yK8oyjkJhPDe5HA4HA6Hc+YggEAYkiAQiuugKOlfxk3wo04BHeiUNtCDXjkGBjCgGsGIagITqhnM qBZVQ8CCaoUQVBvqUQgFG2ofCEUNgz6o4ahHIALCUCMhHDUK9TBEQySGYyAaw7EQg2pXtS/EosaB XfkJHKrK0Bc1HhyoCSCjOlF/hH4Qj5oICahJqD/AWeBEPRv6ofaHJNRkVV1wlvI9DICzUQeqOgiS UVPAhToYBqIOQf0OUmEQahqkoKbDYOVbyFB1KAxBHQZpqJmQrvwbhquaBRmoI1TNhqGo58Aw1BzI RM2F4co34IYs1DwYgZoP2agFqF9DIZyDWgQ5qMWQqxyCkeBGHQV5qKMhH/VcVUugAPU8KEQdA8XK QThf1bEwErUURqGOg9HKVzBe1TI4F7UcSpQDMAHGoE5U9QI4H7UCxir/Ag+Uol6IegAugnEYngRl qJVQjjpZ1SkwQfkSqmAiajVcgDoV9QuYBh7U6XAhag1chHoxTFI+hxmq1kIl6kyYrHwGs6AKw5eo eilUo86GqZh+GUxDnaPqXJiufArzoAZ1PsxArVN1AdQqn+DWfibq5TAL9QrUj2ERXIJ6JcxGvQou Q71a1WtgDuq1MBf1Opin7IfFqtZDHer1sAD1d7BQ2Qc3wOWoN6q6BK5Q9sJNsAh1KVyJejNchXoL XK18BA1wDeqtcC2m3Ib6EdwO16HeAYtRl8H1qHeitsJd8DvUu+EG1N/DjcoeWK7qPbAEdQUsRf0D 3Iy5K1H3wL1wC+p90KB8CPfDrah/hNtQ/6TqA3AH6ipYhvog3In6EOoH8DDchfoI3I36Z/g96qOw XHkfHoN7lH/C47ACdTX8AfUJVZ+ElahPwb2oT8P9qM+o+iz8EXUN/AnVCw+gNqK+B02wCrUZHkRd Cw8r78Jz8IjyDqxT9S/wZ1QfPIq6Hh5DbVF1A6xGfR6eUN6GF+BJ1L+quhGeQt0ET6P+DZ5BfRGe Rd0Ma5Td8BJ4Uf8Ojcpb8LKq/4Am1FegWdkFr8Ja1C3wHOprsA51K/wFdRv4ULfDetQdqu6EFtTX 4XnUN+AF5U14E/UN2AV/RX0LNqLuhk3K6/C2qu/Ai6jvwmbU9+Al1H+q+j78HfUDeBn1Q/iHshP2 qNoKryo74CPYgroXXkPdp+p+2Ir6MWxD/QS2o34KO5Xt8Jmqn8PrqF/AG8o2+BLeRP2XqgdgF+pX sFvZCgfhbdRDqn4N76B+A++i/hveQ/1W1e/gfeU1+B4+QP0BPkT9EXUL/AR7UA9DK+oR+Aj1qKrH YJ/yKrTBflQFPkblc/rpn9O//o3P6V92e07/vIs5/fNfzOmfdTGnf/qLOf2Tbszp+9vn9Pkd5vR9 Xczp+9Q5fd8v5vS96py+94Q5fa86p+9V5/S9J8zpH/1iTm9V5/RWdU5v/Q3O6e/20py+i8/pfE7/ zc3pv/V1+m93Tu9qnc7ndD6ndz6nv/I/MKcDzrhgrjJG6EAAKnb/Rzm6zpM7/k46iPaCrsF/+805 BWj3i2pPnxVnHMQY0dsmcDgcDofD4fQEpig9++V3EPshfefJHdeip3N/xVe9nFMgiP1VFz9K4PwK qCmqt03gcDgcDofD6QnMMQbc2ghS92sYO08+1f1V9y3g+yvOKSB0vyjfX/33oOaY3jaBw+FwOBwO pycIiTPiZkg69f1Vx7VoEO0FXYOvejmnQBD7K8Pps+KMg4bE9bYJHA6Hw+FwOD2BVTax/VUQ32ky d57c8c8Gg99fdd+CLv5AkcPpDnx/1StQq9zbJnA4HA6Hw+H0BLYEM26G/uv7q9P5vzvw/RXnFAji T1e7+FUt51dAbQm9bQKHw+FwOBxOT9AnyYL7K00Q32kK6Ty541o0+P1V9y3gq17OKRDE/sp0+qw4 46B9knrbBA6Hw+FwOJyeIDzZipuhYPZXts6TO+56gn8HRfdr8FUv5xQIYn/Vxa9qOb8CITy5t03g cDgcDofD6QmiBofi1kYXxN/c9ek82dIhFvw7KLpfg696OadAEF8N7OJXtZxfgRA1uLdN4HA4HA6H w+kJYoeGsf86Pohv8kd2ntxxLRr8d6S6X4OvejmnQBB/utrFr2o5vwIhdmhvm8DhcDgcDofTE/TN isD9lf7U91fWDrHg37zW/RrWk5bgcLokiP1VF7+q5fwKxL5ZvW0Ch8PhcDgcTk8gu6NAD8Yg3hkR 23lyx5/1B/8Oiu7XCA26bQ6nnSC+Ghh2+qw44xBld2+bwOFwOBwOh9MTxOdHs/1VEO+M6GJ/1XHX E/z+qvsW8P0V5xQIYn8VfvqsOOMQ4/N72wQOh8PhcDicniDxXDsYwBjEOyMcnSd3XIsG/46/7lvA V72cUyCIV69EnT4rzjikxHN72wQOh8PhcDicniC5XMbNkCWId0Y4O0/u+LUsS+eF/gPdt6CLL4Bx ON0hiFevdPGrWs6vQEou720TOBwOh8PhcHqCQZOcYAaLtfs1EjtPjukQC/4df923IObkRTicrgji 1St9T58VZxyaQZN62wQOh8PhcDicniB1ehJYwBrEd5r6d55s7xAL/s3W3bfAfvIiHE5XBLG/kk+b EWcemtTpvW0Ch8PhcDgcTk8w9NL+EAK2IN5EPbDz5LgOseDfQdF9C+JOXoTD6YogXr2ScPqsOOPQ Dr20t03gcDgcDofD6QmyFgwAK/QJ4p0RKZ0nyx1iwf/PQd1/F7Z80hIcTpcE8eqVLv4UlvMr0GYt 6G0TOBwOh8PhcHqCgptScTMUEcSb0oZ1ntxxLRoRtCHdf2sFX/VyToEgXr3iOn1WnHHoCm7qbRM4 HA6Hw+FweoKSFZkQDpFBvCntnM6TkzvEooM2pPtvrUg+eREOpyus3S86+HTZcAaiL1nR2yZwOBwO h8Ph9ARlj+VAJEQH8aa0os6TB3WIBf8Oiu5bMOjkRTicrgji1SsZp8+KMw5D2WO9bQKHw+FwOBxO TzDJVwQxEBPf/RolnSendYh18Z8Q/wfkbpdMO3kRDqcrgvhq4IjTZ8UZh2mSr7dN4HA4HA6Hw+kJ pr9SAnaw9+t+jbLOkzM7xILYrwXo4r8tPumZOJygCOJVLu7TZsSZh3n6K71tAofD4XA4HE4PIQS8 HYgavxRjGCLzQYRSYF9Ysar5CTAGpsN8jVvuIycoCrBdVIcUZZ/fHfW2PtBaE2itA0QD7cmEUgD6 fwugF6Xu2z648+SRHWITut/ecZZ2v2hjsG3/13vVXTChPM+dm3NO9ois4ZnDMtLTUocMThk0cIAr uf/ZZyUl9nMmxMuOuL722JjoqMiI8LA+oTZriMVsMhr0Oq1GEgVKYECRs7hK9iZVecUk56hRA1nc WY0J1SckVHllTCruWMYrV6nF5I4l3Vjy4v9T0u0v6W4vSaxyNmQPHCAXOWXvtkKn7CMXjqvA8O2F To/sPaCGx6jhO9WwGcPx8VhBLoqqLZS9pEou8hZfXttQVFWIzTUaDQXOghrDwAHQaDBi0Ighb6Rz biOJzCFqgEYWZTVS0JnRKG+Ms7DIG+0sZBZ4hcSi6une0nEVRYWx8fGegQO8pGCac6oXnPneEJda BArU03g1BV6tehp5JrsauFVuHLCp4TafFaZWuUzTndOrJ1V4hWoPO4fNhect9EZetT/q5yg2HlpQ sfTE3FihoShqpsyiDQ1LZe+D4ypOzI1n6vFgG1iXJhZXNRTjqW/DTiwpk/FsdImnwkuW4ClldiXs qvzXV+MsYilVs2Sv3pnvrG2YVYW3JqbBC+OvjG+KiXGvV1ohpkhuKK9wxntzY52e6kJ7Yxg0jL+y OdotR3fMGTig0Wrzd2yjJSQQMJlPDNS056khtTgLlYxv71nCLHKOxgHhlafJaEmFE68pk0lNJjRM y8RiiIdgLe90vCMzvfqCqgZrFktn9b1SotUpN3wHOAKcB/7VMaU6kKJJtH4HLMjGSftQw/zjYa/L 5U1OZkNEW4D3FG3MUeMZAwdc7qNO51yrjAfsPijFvq32ZKVg98fHsxt8q88NUzHirR9X4Y/LMDW2 CdwpLo+XVrGcTcdzwiewnPrjOe3Vq5w4kteqj3S4V5fU/i/EGtGnqDbLSyL+Q3aNP7+kzFky7sIK uaihKtC3JeUdYv78zPa8QMjbp6BCiKWBEI0V1FwclJPaC7NIhckrJuI/jTqop/u0OhyVagqRi73W qlF+9Rji47tZyaccYrXUw8/VAmZ6s1wd4yM6xDuYZ2oQ0GAxiZaUX9jQYOiQh0PNf8LRgQOOeCiv iJcLvDABn8xE/OdTNmUy74n1urHLClgBHH/+pEC0Q8HYQNiDsNE5cEAxTnQNDcVOubihqqHap9RP dcpWZ8N6+iJ9sWFuUdXxgeNTWm6N9Rbf5sG+qiVZ+FBQyG90kpvHNbrJzWUXVqy3Asg3l1c0UUIL qvI9jf0wr2K9jJO7mkpZKktkEZlFoITgRTZRnVo+dr0boF7NFdUENT7NR0BN0x1PIzDNR/1p1uNp FNNEf5pbTWOwOaagvOLE0aM+kp6BAOuhXDi7OSnKsfN5oT+0oqdC/yZXX8d64Syhb9MIh9snOJtD w1ND8gYKMp4zRVUZdQ76Neg3ohdhihCH6VbUxejr0a9BvxH9TvS4VkBluTL6OehXoW9lOUJfwd4k O6x5ZwnRWDcaryFEiISD6BX0AjhQU9CPRT8F/TL0q9Br1HIsZQ76xeg3oj+k5riFyKa709D2yKZb 1UPzrEtT1Wi1PzqpUo02X+DxH8eM8x8LR/uLZfmLDUn3Jw/K9x/PGuA/hiam1rOjwZy6KS9CiMCL jEDD56IS+hKEEAIOeFAIBy96KmgCKW4htLlfUuqqjYIIRKACwcWBQ9kkkCazLTXPQBV6EELBQb+i B/w59ECzxZa6Ku9cuhfWoN+IXqB70X1EP4LFtJX1OWou+lXoN6Lfgf4geg1tRbcH3Yf0QwihH0AK +lz0U9CvQr8R/UH0WvoBqpW+z+YnVVk4Fz2l76Na6T/xsv6JGkLfw9B79D007c2mYcNT16sBV0og 4EgMBCJjA4HQiFQffaPpp/44opLwTuOI2iAkQA6kCQlNiUMcPiGqKXumw0f3Ncsux4N5g+ku8KJn C8pdeOZdIKMvRV+Ffi56DYZ2Y2g31KO/E/2D6L3ocZShWtHLdAv6reh3w2D0bvSl6HV0ZxOexkd3 NCXlO/Ii6Hb6D4jEHt9GX1GPW+nL6vE1+nf1+Coe4/C4hb7cFOeAPCPmA9ax4tGKxxTMl+jfmvuF OpQ8G92IfedATUGfi34s+inol6HX0I00oWm6IxQb2QBbdIAlm+Bz9fgYPKwD9yyHO6kAB6DMJCnr HAyhrJJXJVF30op7Mcok6Y67McQk6cbbMMQk6arrMcQk6dLLMcQkafosDDFJunAKhpgkjS3HEIqP PvCXfmc5ho29hMh5IfQK7KUrsJeuwF66AkR6BXPwk8hsu78pORl77D63q3+yo76F1D9P6seT+odJ fQ2pv47UX0/qs0n9ZFLvIvV2Uh9H6t2kfgPJxK6oJ+61HaLD3VGkfgupf4bU15H6JFKfSOr7kXqZ DHP7aHzT6DT1UKQemvPYQ4fHc3Jw9gmh8dij8Tjm43FO2Ii6A72ixtxYSE7wF46OY8eE5uRcf3xQ VuqcvFF0M1bcjLdhM+xBL+IN2ozDaDM2shkbCEHNRT8F/Sb0B9Er6DVYOgENX6ZqCGoK+lz0U9Av Rn8QvUY15yB6CnMCJq5RDUsJGD2WxehmdAno4mm8u6/VbnVZRwnL7CQkjoyNU+LoMIhgrxIMtels PmJe94P5xx/MoM/T0zvoMuiLN+LOwHFZ0099HT6ysilpgyMvnPwB4kQcdWQ4JJFEPGZCnRrPALuO HdPBTp/CY2qTfSJWC2lKGuBoIRZWa53jJ/t+x+d2H8XgZ/YNjrdln0iaHG9hylPrHLvstzheTfHp MOX5JB/BQ4usFl1vz3Q8s0Utej1m3NfkuI4d1jmutY90XGJXM2r8GZPrMOYOcYxPutAxCtsrtE91 uOuwzXWOXPtkR7a/VAars84xGE1w+YPJaGx/u3pSZ5za4IRhPlLrHqBdoa3QjtUO1aZqB2jjtQ5t X22sNkwXqrPqLDqTzqDT6TQ6UUd1oAvzKa1uF9uJhmms7KARmYpq2EqZsk0rm/SIjsK54O0jlNCS snxS4t00DUqmyt7vy5w+YsDViuTMJ97QEigpz/dmukp8WmW8d5irxKstvaiikZA7PJjqpTfjp3R5 hY8oLGlJLNsXrAdCbEtuj2XHs5fc7vFAVMTluVG5oTm24cWFnUhVQF0/E9Uh3Ne7oqSswvtkX483 lQWUvp4S7+/ZxmE9+YYcKipcT75mB0/FeiGHfFM0nqULOYUeT4mPTFTLgUy+xnI4Yr5Wy+nwg5mV A1kX5y93n79cItbHcv3YAcvp9ZColkvU69VyImHlGuv6FRU29uunlomUoU4tUxcpn1hmSyKWSUxU y0TUwxa1zJaIelbGm6MWsduxSJxdLUJiwK4WsZMYtcjEn4ukBIrc0l7kFvVMAvm5jN1fxtx6vIy5 Fcu4uktNvstFmkd4pk1im64qZ1EN+irvrZfXRnnrp8py4zRPYDeWVDV1Wi07Vtd4Pc6aQu80Z6Hc OGJSJ9mTWPYIZ2EjTCoqr2ic5K4pbBrhHlHkrC70NI8sTR/W4Vy3tJ8rvbSTxkpZY+nsXCOHdZI9 jGWPZOcaxs41jJ1rpHukei5Qx3hpRaMO8j24xlePzdRowPFaFRvvyY+wzs1RB++I+KjrYltwtbIa jLjlMeH22YyeZQ3MG5jHsvCZYlkWtrMOZEVdNyI+toWsDmRZMdnmzAfXgoV1CyGqaGah/18dgkkL FrIO96urriswrwg3yYV1CwBKvMllJd5cXM02arWYWsUuyZt1PM1oLMK1vT9xECZmsURBaC/I0rJZ ml4fKPjL+78wcCxgT0E93dBM3HFkAdR5BG9cSTnFqaA8sIVpwbUU+3io8+AF1hEXqTveRsBslwv8 cWDXfNwvWBgIBfpiQeDor4lV6o53STuss1ztPbYAGwSpBaLRx0iPQ7SYBFEAyqfoP2PHtpnKZyyf HekXONH5Ah5gNTxDZsIzsBFeJIew1hrcCKwFtgQqhD/CNbAcluLH2oWYcguMRydh+nISrayFFHgI P9gegm1Y9gK4DloggkQpn8NiWCK8ibWWgBkSIA9KYQ7cTs5TFsIk2CPeAMPgPLgM5pJ6pUK5Q7lb +TM8CuuFV5RjYIQYmIZum/KV9I7yPgzEGvfAvbCH3K1/Dtx4lnos+SeYD/cJlSJRZiiH0YJ4uAJt EGEMbCObqAtbr4FPSRS5RijAVh5RvMpLWMoOlVAL90ELySAjabw0SRmjbIMIPMcibPVeaIJ16Hzw ArxHTNIh5c/KIYiGATAar2ctbCebhLZj17flYo9J2Ev9YTjmzIG/wj9gJ3GSv9E5kklKldzSVcou CIMhMAGtfRxrfkJ+oNehWyy8LBYr+WDBfrmL9Tb8HT4iMSSFjCUTaX86hz4gzAcdnnEIuukwE/t7 Jbb+IQ6jddREdwiPiE+JRzR921oVC96RJLgf/gR/I2a8UpnUkd+R3WQfLaBT6P10r7BcfEJ8Q1uN Vz0ZZsPt8BT8QEJJJhlHLiK15BqylNxF7iXbyE7yGc2j5fQSelCoFeYJL4j56MrEOvEG6SbpVs1n bRVtL7W93vaDkqrcBONwPFyP1t8DD+CVrYcd8C66PbCXSMRILOhkEk8mkKvRXUduJw+T1eQJshbP spPsJZ/jR9J35AjFT1qqobG4+GFLICedjyvM5fSPdAe6nfRf9CchUkgQXEKGkC14hDlo1VLhTnTP CR+JMeIOUcF+TpVWSKuk1dJT0ovSIY1J+zv8jN969JFjycc+bIO2m9tWtDW1rVU+gnC8h/jpgRuu bLS+Gt0svN8rcMStgTeJCfsuhiSTHHIe9swUMovMI4uwJ28k95FHVdufJc9jL71NDqLNZmpXbR5E M2g+HYtuMq2h83AxdjddS3fTw4JWMAohQriQLIwUKoUaYYFwpbBC8ApbhQ+EvcL3wlF0imgQHWKC mCS6xJHiFHGh+ID4qfipNEl6TfpYY9DM1tyk8Wm+xlVNjrZUO05bqV2mXafdpavC0bkZnoO/nPgz YtIqXC8UCc/BHTRNjMYtzHYcz1NgujCG4kilq8nN9FqylvaTFmlG0BHkfDgkJmFfv0xX0e/pCGEM KSFlMIsO8bemCROfxEO2uBkOiM/jtW3HlhdpTOQ6elBjgiZcIw3Hc/5dGCy6hNfgPWEP0YoPwT9F A4kkB+jjQimOghfEHKkC4oU/wrPCPHItPEeLAAxHdLfhOD6fPInzQjlJJT8KCi6Dz8dRNEzYBzfA JfQdOIDP8c3wBzJdnAF3QBq5Bj6Fx/Cp6C9dpknWhJNX6UyxgfYha4GKT+DVDSf9iCCFwY2kUrhP c5C+Cwthh2iAD4Wn0fod9FlhjHhIGk9q8Qm4Fm6Cecr1cKVUIb5BZoBAJkKi2Iqz2zVCqhiPx8U4 q0zCOW0dPt0tOA/kCWMwJQpHznk4LibgDHEfupU4T4g4gmbiM34BzmLbYa2mnPpghmQhOOsAiK+1 jYcLlcfgXmUGXKbcDQNxPliqXIMtroaPYRmsJkvaroa5uJV8F5/t86RiukMqVgbSBvouLaMrOt5f 7O1EEgVfoHsWIznSBmgQ34YyyFVuU97C0X02zrD3wlRcsO7Hq/wKzzBK2ARpbefTRqVYmIvXuwfG KY8rDmKAWuVSGAvPw6NaCaq1LrzHXvIGXu/VUEPHKwuEmraZ2A/LsBfc2FsLcf65BVfD6oQnsd8l aQHibfG2RBRcOcNRWdh01C3BEZDFTex3Pl60dhl+ykigh2sbNewHTU0UJB9d4zbqsjUGfZaYrcki JGX/sf2Qe+yT3NhGu5qbhLkUNAbja4I+S8oUsyETywnZlMqEkNcMBuP18Q+txJXv+dZvK7PHWA9Y 92MT+61fQW7uGOuxT3Dl2yzhwoRYs63ZHs+QwX0EW5pNEDLSwj8dtif9kR3kUkFPito2HP2hbfm2 bczWyUIzvUK11QgL1+NH5I/NCYnpkk/50Z2Q1D/dqDFgJ+HeSZI0xq/0Op0gUNDqsg0h+no91eNK wR1uDknXf0gEMZsSt9mWTqJN8x6PYia6ssccy7Yec1VmH8uG3Gxm1LFsFGILHT6c+SGDicvVh5kn pKl6Z+q2gR8M2TZYaCaRhw61fe5Xth1ZiU9lCNpppfsbKevR9aBTvncbTSY6QWcx2+gE6lO+WssC aPxX7rNZyBTKsqUQk6AHQnV6owV0emowaqxWOsFoNZtRfcrhdayU0Qo+5ZO1LAcDP64NCVEDR9ey UpCCi4ttqmBXb9pk3blzky00crjLpV6CC2L9t9nt0MpGo2aCRlVBVVFVSVWdT/nG7WQhalJLaEwm DFuY6k1MDapqmQVms1rhR7eDhZIkYpINoekhqkgmAYjFCDodoQZ24aw1NaA2soFOhFDsq4luM6gn AvVEcLxZIOxavk35Fk3Pzc7NzvZfTKX/ak5Yn8W6FwMN0YXRWJ14uekm0yvYlabRptEhQn8x0TzA UiFcJF5uXmRZatYZqaQbbh5qGUtLhEKtWzfGnG8xrKT3Ciu0K3Srhce1mlAaYrEMlmiYJFGdyWwe LOkwqDONDxlP3IRSnU5vMBrNZovFyu5TVWh9KA1toavBTIY0SbLOR4a4DSa9QXabFhuJsQUv0kKM mEN9xOjWhxCQQ+ZaidVHJ/5FlqqkeknAx2p1s22EJ8oVjY8MPjRROCIPxERbD2A4pj2yvxKicnOz 1SF63MVYDxxYKg1yLb32paWDothhyGBcKBtxoRyHC+UXwKQcwTG4G6iyOzMz04MbZBPmnY1568Gs /NhoMbBUdbFsVnatix9uGRA/3OzD4LDhltRhavC5gZg6cLi/yz3z51XCvEpS6fGk4dQSETl0GIm3 OW24rLKtxDn+osER0Rn46SxtaJu4pq1CajnyzV2jSu8Xjh4uFl87kiG2HpHxiS5WPhP24JNig75k gvvPBiqaE83p5kKzlBGWYb+AlhvGh5XZZ9DpUo1+WliVfZNjl/RWnw+iP+7zcdjByC+jP+7b6lAc EQ6HKyY7IjumJGau406HdhDtZx4UkUUzzCW0yFwcNtp+gWGieYb5Y82nEYfJtxYrCRcsRmsIxNqN WhsYwu2CMSqNQKItJNFq3WkjVpvbVmWrt4kOt9FIJzjc7LmyhbLnzeZTvnXb2ANn01gsqFFqHntW jGzw2ixWq4bF/aPbxp6JfDaMbQtC+23U7tDu0Spa0aHN1Y7VCto41rw2ij3T2jjWkFZ9ArQmVkMb oz5e0XHppf4pSqVy3pgDx37eU1TOw2FhPZaNk/MBfDrQ29h0hbe/krA7FJ+hcSYkJWWkhw5NS42I xCmWhEWkpQ7NSE9yJmiEzJqXFr+1cNauG6pWpDQfk59eePmjq69e9NBND9x25JFVRGgYl0cth4tp 6NYtf3v5va0vsdltCU7FL4s5eM9edY9I6UOsInGK6WIBLkAvFheIGr1Np9fpzX1sejMIOmK0a7RE Awb92XfqiC5B7kP60ARbIgE2H1vThqYfYj/AkWEntOLnE3voj09rbhvrYBBZ74CG9ZQ6x7H+BXYX IkJC2icLnTpTnB868qUol/X7nzvHlX1sv7Xy2/nYPbm5B2w4lQ8frk7pYH11qUV9TCrnk8o0W1r4 UOygSC3rFa0m3Lbk4ZyZuRdNzsnPHzE5LE5MemjeqKzHzxqZWzX/2C7WC7PJTlqL6ykjONbjwqTM bdFrtsowGAf1QtMFjzMrKg9AygH8XEtnPR8exu7D7HtqZ95zz8zae+j2mcuXz8QwtqUcJVvEOfQi /LSOc4eQDKAxEvslTbTYfBW78fsrrZ9AyhhsSsiIDxfFOrLlrrtYvRZcZ6wmb2K9qBeA0oP4ufEl 3pxDjRJJsbIBgVNkfEY8Wd0WSr4iic8G6kixJ68jxR5eJVX/XIdAV3U+/vk80NZCin+uo+tGHR38 0KI7oY61G3WscLDF6q/DCA+4S3B/dhoc7rOCcMKg/+Aae8C9fRrcv7njjjvuesOJ5tPizuKOu/8P XZ54kbiQO+6444477rjjjjvuuOOOO+644467/wUHAFn0r+D/xjfALFUF9Q/aDWqMhSlY4As4/s3w ybA1EBZPKCNBFEkOhDVgIfmBsBamtpfRwWD1v5NnYT00kNJA2EyfJO+1f5M5Q7wxECYgiesDYQpa 8adAWIAU8YtAWDyhjAQmKToQ1oBWSgyEtTCkvYwOosRbA2E9FEkDAmEzmSDNY990FwU8l0nzshqW MGzV7FbDGjX9EzWsVdO/UcM6FtZSNawP9OH/4+1rwKO6qrXXOWfOycCcBJoiUMrPNMY0UEghUEoj H1KMiBhSmsYxc5ovzX8mISSTyZmfzAyTmZiLyA0tRsSKiMiNkeYiYm7EiJFSpAhYKyUt0oJYKPIn UtpSSiky9937zIRpbf2+x+8+X+d5937PPmutvfZaa+9zxoRocCOGBjdiaHAjhgY3JcgYMTS4EUOD GzE0uBFDgxsxNLgRQ8aHJ/hv4b6lcq4mjKcwnpTG+UjmW1I253eCpybN53xUgvyn+HoNPjph/C6u W8D53Xwuw+aEBJlJCTydy5dyPoXzBs6ncR5k3JzgvzlhLjVhXI2v5RmyUjYiMoNmgRWSg6rQL6FG agB0aiEnH/k8rlzgrC3DeC2XyMKdh6keHysVYKwG+jo186sq9FWQ9qCthOTD4LXQZbK1XKYM0Lm9 SsgsR++iZRhrpOp/yZePSuZ8aE7mUQ25wdk8OWTj3jXHtK30ACzMoNlgmbBUSxW424j7zBudJn+s fDY+t+dYAp//0dvCIZbL/fVCugGeWOkRWK7mM7G707iPjajUWm4/n99xYIR53ExTMbaUr9fF79Ty +D2G1g35yph3VqzhIZoDv+zQdOOaxbUFvZvng0XcEYt/NfdV52ONaCv5uJPP18Lzw+xaMeLiPjHJ iphOVey6jFty8tmXQ0rn95hWObehx7JYH1tnw5AXhkbcD1eCrJNHvhIeV/A5jHh4ud8sIh+/BuOa yVZgNjePSCWv0I9GgmnUc5YJ+cnoWfWVx/z+eNsN/w9rv229cij3Lr4/4rmM1/DHrSA++z/69dmE HLGVGGvR+Xzx3cHsG2utxIiXr7yR77h/VgllH8p6Fc9OY6w1VmVwN66cvLVybz1D1WzYYZL1kPhn NZT1jDV7+oxZ1kJHlXVJY0Oj3uKssn6+0eVsdJXptY0NWdaH6+utBbU1Dr3ZWlDVXOXyVFVmPeyq Lau31jZby6y6q6yyanmZa5m1sfqTrcQHcwzNgqoad32ZK8dW5WrGbesDWTNmWzOX1Fa4Gpsbq/XJ t8ezs7nGksIhs4WsyXWVeWsbaqyPVFfXVlRZp1kLGstrG6z5tRWOxvqy5qnWpWW6q7aitsz6WJm7 oRLmrDMempNtb3Rbl5e1WN3NVVbdAf+rGxt0q95oraxtdtbjRllDpdXpqsVgBe5UoS9rtjqrXMtr db2q0lreArUqaz3mbGAmcIPZcPFRp6ux0l2hW+GH1wFHEmZAX9tQUe+uROyscScaG+pbrJm1k61V y8thO0G64Z/OzsUr2epdVc1slSzCtydg6kO2PstXlFmLWfSq5SwdrlrMWtnobahvLKv8cBDKjKVX uaxYUSOmQuvWnW7dWlnlYWGGjKOq3vnhCGXhrGzke5Cdwg2odnaKtgjJqLA6XF/gJ3L8/mOoOWPX sN1RKW2Qfib9WnoW+KW0S9qWYKuMn1rx61PcdtWH5qr6kDVuzzTRNMP0ZdMXTf8L7UOQLsOuYPvN eCo4hB3CD/HKxk4B9uRw8dOb2TDeHyl6L33S/6+yROxN6Q4SolHjLwotEZ9NEx8yZRDNf03ehWur Udzx/6L4jz4XvfVwQV7B9OmxP2/J3tZUdFeE67CGN0ixgwRxjfhdksQN4gbw74nfA98obgT/vrgJ /AfiFfC3xOvg70vwQEqV8E4k3SktBP+i9GXwPCkE3iq1kiiFpavg70o3wf8u3QKPsn91YCJTM95V dJMO7ja1gPtNfvCA6ZvgnaZvga8zrQP/tunb4OvlbBLkmfIskuQH5AfB58ifBZ+r5JKgfEHBvEqe sgQ8X3kMvJD9orFiU74KXqQUgduVx8GLFR3crbjBPYoX3Kf8G4nKSuXr4KuUb4CvTuoiIelHST8i Kak76efgO80Pk2heYMZblXmFGaszt5o3gn/ffBn8TfNV8HeHYZZh9mFekob5LHhjtQy3JJNkSbFk gk+2zASfZfkx+FbLT8F3WJ4D32vZB/685XfgL1h+T6LlRcsF8IuWv2H8suUd8KuWa+DvWd4Dv25B 5C3vW26Af4DkSaqg/gZvcfvU34IfUN8Gf0e9SqL6bvJIEpLvSL6LpORxyRr7h7axnIt0D4+8EXMj 2rE4Y40FWFGhGXEzF5mxIrNmLgEvM1egrTY70XrMLWj9iAaLQwRtm7kNI18zfw283bwS/Ovmb4Cv Nv87+FrEikXp7VhMRETjPvCplvuxlumW6Xy9fwW/ZLnE1/I82v0q3k/V32JdbBWj0Y5JHoO1jE0e C34XW1dsPcNpvTBAcpmrrJysFS2ueppX46paRvmOqnIXldSX6Q3Y/cNJ+EpBrpVGYWdFEQMTWWIM 33V4bIjvJvZ9JznhWsB3hpShawE7D5byChdZaXRMQsS3hxExLuHuSLpjWZWrgRy8beCtzls/ezhR mLereLuWt+t528PbF3l7evmy5cvoGm9vsVZQeJvC29G8nUg09O3uo60Y+8fU8V5gf40Bvsvs2xz8 HY7Vq/wbJLylVLoTcfkUVjSGxvJ/rXU3jacJ7E8t8P/3m4/T+7gx9s3N9KF+BOx/Uj8Zb8TFOA/r ceoFqZ06aB1tpC7aRn00QPvwve5lOkFn6BJdpZuCSVCFcUKmMFvIFfKEQqFYcAmdwgZhi9Aj9Aq7 hL3CIeEILJtJEFZidoGE1OnwEf0EBzxFbyWjv+eMsRfS2o1+9i2jf/Cw0T+UZfQ5Rl0IX7xm9ItO Gv2X9hr9o1YysX+2/mgPKezPuj0RJAUFJJSdMeav2MS8IaGS/b23JPSbjPHKfqOvyjL6mtFczlSb Vbug1lZbF7s6VnupjupGGVd1R+su1t1almpcLQsvW7ds67IBQ78+ZPTL64y+IZdLmRsnNmY3Lmos adQbVzdubtzJR5OdG507nPucx5yXmqhpVFNm09ympU2VTb6mDsNbF/vbEKwvMay5qo2+eb7R631G 775oyHlLYn01rzbB+yQJI5w8QrV0QlCQt2xhvlAiOIU24QVRFGeJLjEorhbXAZvELrFXPCBexNZJ kazAYskpeaQD0hE8I8aZikwu0yrTFtM2OVveLB2QDylWpU5xKt3KCSklSUkaBQ18khYkFSWVJFUm 9SSdMeeYt5n3mw+bbwwbPyx72Pxh1cPWDbs2fNbwXkuepcHSYVlv2WzpsZxRU9Vc1aauU48mU/Lw 5OnJC5KdyRuSu5J7k19OvpZiTslO0VM6U/pTDqUcSzk9wjQibcTUEYtR7enRp+jB6HGaGz0uvBV9 Sngf+CD6lCgAw6LHxeHACNwXaFTUgf0hcXkHPQTkRPug5yA77mtAMbAT1xKNiE6gOwBmPQk6fQk6 Dq5TjLGduGvC3eM04tZ1ugNIxx0T9+chIMfwCzuay8DeSGgwuxOAidy+g7JxLxd8IbAIyIPlAvRf QW9DX4Reg14xkAwruTErubDSByt93EousAjjebBWgJ5pM03mpwqtp6B1HFpPQes4tI5Dqw9afdBi GsehcRwaLAqXcSLEVzUS87CVTYDmxGggYa7cmKe59BiuC9EXQcYOiPQlFkn6DI/kU3zWnZTHThpI 3gGIQ+MC/RyyEo+xjcf/OMnitGipOBvIAx6NDoiF0QHshxHRSdCZhDekLuQ5F3nORZ5zxXHRreK9 VEQyRo9j9DhGWeZ3I/O7ScLo80NXJiE7+oY4PvqqmB49KHZE36DhQlb0DeF+YAYwE3dHAmMAK5AG ZAD3QXKYMDX6ijAN1uToK6guB6w6YNUhjsZ8iClssr8GhLloFGTXQHYNrC+E5YWwvBCe98AbB3x0 wEcH7KwRk6ObxFTwO6N94lj049DfjX4CYI0uxMrKxcnRhSTC7kuY7SWc8KyKUan/V/4oTJpJxqS+ EZeiERh9DvpPwcdziMA5+HkOfp6D5HOIwjlE4Zx4FzAJsAIZwGTgvui5f7A7NPtQHl75UB6UWE3d QD3dSIwCicjJJuRiE90T2yk8z6i5Sai5SZjjOLw8Di8nCdOBGcBMXgcDH4nmcUTzODyfJEJfHBXN RyTyEdU6HtUJ6CfiXLDi3qejSxGdp8TPYOxeGhAzITcZ41Oi+Xjexj0dibjD21j1P/UJOf2oFx/O 6Wjwj89rC88rq79eRL8XFnthsRf+9yLqr0KqFxHvhVQvIt6LdwL49T9eV6mw5MX8fbDmRSZ6YNEL H7zQPg7ve6B9HP5sgoXjsMAqqwcWvPDNCwte+OZF9npQ+dhXlPwP1fRxlZT2kWpiWqegdQpap6DF sngK0qcgfQrSLyFjf4DGKWicQpb+AK1TPHYHoXUQWgehdRBaBzHXQWgehOZBaB6ExkGcAvF9z/a8 5RP14joZhh5mOYj3lhFRBRWp0DNRL/UAvdFBnFw7o6W89eKtbSciPo9yxYejF8Qv0DRxUXRQ/BL4 l9GzU2xJtFvMx0n2KPhXMabRGLEe/XLINIB7aRqliDkYYRYWcc0L0OyC5kvQvCA+gnuP4hpnISxc EO1AFbAcvnwKmgPiPEjM5xYGxC9wKwOwMgArXlgZ4PM/Aj8MK2tgYUAsgVw1UA/OfGkEmsBbohfw 1vkx68ZMXszkxSyDmGWNuBD+LUL/ZVhlFjXwYqAEMk8A5eBVQDVQAzgwVod+OXo3eg/gA1pgXxGX IBb5fKW7xDLE04Hr5YiNyOdbBq+GxyI0aEQI95cg3oUAi+kTqCcHj8oFMseiEI/lIKJwgcfyUXDE D0+axGgbc+9i/w4fV4/zmcfQsJjGBcM+wHxaZtxFrC4gd2PIwnMXzwCbdwn6RxATY65BxGOQ5wsR xnv9iFsrcLKswMkyiJNlENFdMxTZ+ZC6Hd2EtfJqGIxVQxe3qvEclmLd3Vh3t+jFWAueliOG/OEV Cam4pTzwJbwS1sSerbt4PbHVlSKKWBG+acTfgJ6JdsO37ljmWY0NiPMhaVgdhMUuXleGL13IfDd8 WYOsd4uVQBXGqrlvpWItepb5ZTz7axCJbrEZcAMewAe0RNdQBqJzBdG5MhQdw4sueHEhFqWuWIQG eJXn8z1hxPlxgNXf/4aMERmvWIr7ZdyrLrECvBJ9Fcar0dcArCZr0dcBy8Ab0TsBF9AM+ABWn+ZY VAf4zHmwuGQow7tgcYCSuF/xnWf4tStWkYOo4kV877N61uKVzU4QtnPwrQ0nSkIdDcSivAu5G4xV AcvfzFhdlcbOgS5UH88Laj+e7UegZVTdALI6hvnG9znb12osk92xWu1K2CNrYrZZVXXFsncB36zK +BlhnFdNWMkIZPslLvMERkqBMl7fTJ7vU7ZesYHX+wA/UXTAyz0YpJHQxg4D2Plz2wI70V7ifrKI LRua07DUBOt67GwaHj+bYGkw5sdgzMIgtJkPg1xShM4g36PDYjMOJvg7kHDyDTI/sdbHE/a2jgxZ hvSeGPLytof8BI+dmpgJ5xPyCxvT+FlRxmKfcGbUx2wzf0Q+yqIp8RmYZXbimBN8NNYTj3xjLPpM 4qXY3V0fvctXbeJZdyScUMPje5rHntUFjzvOWCNisdVAciQkZ0JyJvVAX4udhbc1xnANI0vnsGcM TRYDb6zCkoYiluh93LdhQ9mPx/N2tuOxHMQKPnIXUXoidrWcR68eO6CJ70qeGxbteP5jT9fGIX/i EY17Hr/LZhKH1ps09MS7ffKU4uQp5U/8Yfybwv/pW4JID/D/7YloFD4CpRP76fBkfCS6Hx8TzcRH htQDeCd+EJ8keohy8P1mLj7D6Uv4WOgr+KhkJw3f+YrxGUE/x3eokbQPn1ThPmEa3SncL9xPo/F9 fiaNEd4S3qK7hHeF92ic8L7wPk0QPhA+oIki+4Mlk0RZlOkeMUkcTmmiKiZThjhCHEGZ4hhxDE0W 7xLvoini3eJ4uk+cJN6Dyk0X02m6mCFm0AxxsjiZssX7xPtoppglZtEscZYI38Uc8WF6UMwVF9Ln xEXiIlogLhaX0ufFx/AsXizaxCLKEzXU/yNipVhNXxUdyIom1olOelxsFpvx9ukRfVQhrhRXUrW4 SlxFNWKH2EEOEpRKpYf9JJxO0iwi50ZgCwmuE+i3AtvBT6PvA3YBe2LYD7wQwxGiJgf6Y8BJ4Ax0 zqO/CFwBrgE3ISMCZiAFGAWMA6xABjAVOpfRZwNz+D3BdZXfF1w30M8DcoHFwFLARkIz0t5UDJQT ubuBbUAvCe5+9LuBfUKZc4srx2VqDjn3uAqqS1yVzosuJ8dNl6fJ7NoMvq2puFnlfXmz2nTJFQRW Obe65ju3A32u+TXTXfObXmwudCquhc5droVDMsdcRRibj7H5hv2atU1drpKmHleJc7+rgN9/Af1J 9LfnDSbwEucV9ECTCL0UyF4Dbro243pzk9XVzf1i/THXNsyxG9eHh/prrqMcN10nOC66TgPnmzJc J5qmAnNcp4Hz0D/dtLRZ4ch13Yjz+NqrS5onMjT5m6dwrGyejbgVNHW4NrA1NO2An1vg385mahpo nstiEY9B06VmDShla4/FGPKwz2B13YjHLw7EK4/FMB43buvl2/acR7D+Mwlx2+Mq4nnbDx+O1awf Gv/o/YQ4IiZOBuS3JCHWbYm5/wQZT9MorDvF9SSwDnwdywf4Bj4exzgjPyxPieA5Mxt5g0+9sb4/ lr9++Lrvo/lrykaeWL7mIUfzYrli2NHczmFFzJeiZ8B48+pmhSEms5YjcZzldzEwFfWyJVbXyDFs G/VtM3qMn8B4arzuee/g/Q1cj0X/JPrU+HhTA+ojjNpgSOT6bY4aSkf9TOfoQDyPueqaOhG7pwF+ XbO+aRNq6nauVvH9Usxy0LwgDl4TcbDaeC3GXwfOJtZefB9i37F7l5qrce1BXw+4mt52XW663uxr uhXrjTz0Iv6H+Lpu75PLwFVW94jnIsQtn93n2OiaxfckqwMxluMDyMle7INY79zTHOL1z2uS74N4 zRZhPtanMR+NcfTxsyGxZmM1yOoROXKymuM1Fdv7+nVmA7iCPX7FdV6/hf1+DLhmXLtNWMfS29dG fbjTOBJqJb4uXgtmI+/82syuYT9+LTanMiCns92ZWDs/E5pDTR3uLLYW9yz4h33qzkF/kq2LnR+u NA4x4fyC73i6WPhPTon/zNTMf1o6jP9MM4X/NHMk/znmKP4TzLv5zy7v4T+1/DT/iWEG/3lfFqz8 RnxTxPNEmiRNIlG6R7qHJOleaTKZpPuk+yhJmiZNg/X7pftpmDRDmkHDpZnSTLJID0izSZUi0r9R ivR16d/pTmmN9BSNlb4pfZPulr4lfZvGS9+RvkOTpO9K3yWr9D3pe3SP9H3pB5Qm/VD6D/qM9CPp x5QpPSM9Q/dJ/yn9J02VfiL9hKZJP5V+SvzvYdD90n9J/0XTpZ9LP6cZ0i+kX1C29EvplzRT+pX0 K5ol/Vr6NT0gPSs9S7Ol56Tn6EHpeel5miMdlF6ih6RB6RVaIP1RepW+IB2XjtMi6U/SKfqS9Ib0 BuVLf5H+Qo9I56RztFS6IP2NHpXelN4hm5wpT6XH5blyLpXKC+WFVCsvkhdTnZwn59FyOV/OpwZ5 qbyUGuUCuYCccqFcSE2yTbaRSy6Si6hZ1mSNdLlYLia3XCKXkEculUvJK5fL5eSTK+VKapGrZQf5 5Tq5nlbIDbKTwrJL1ulrskf20UrZLwfpG3JIDlGHHJbDtEZuk9voSbldbqen5JXySlorr5JX0Tfl 1fJq6pQ75A76lvyk/CStk9fKa+nbcqfcSevldfI6+o68Xl5PT8v40HflDfIG2iBvlDfS9+RN8iba KG+WN9P35S3yFtokd8ld9AO5W+6mzfJWeSv9UO6Re2iLvE3eRv8hb5e3U5e8Q95BP5J75V7qlvvk PvqxvFP+FW2Vfy0/S9vl5+Tf0M/k5+XfUp98UP4d/UL+vfwH2iW/JL9Ev5YH5UHaLb8iv0LPyn+U /0h75FflV+k5+bh8nPbKf5L/RL+R/yz/mfbJp+RT9Lz8hvwG7Zf/Iv+Ffiufk8/RAfmCfIEOyn+V /0qH5L/Jf6PfyW/Kb9IL8lvyW/R7+R35HXpRfld+l/4gvye/R4fl9+X36SX5A/kDOiL/XY7SoCIo Eh1VZCWJXlWGKRY6oSQryfRnZYQygl5X7lDuoFPKncqddFr5lPIpekMZo4yhM8pdyt30F2WCkkbn lXQlnS4rGUoGvalkKpl0RZmiTKG3lKnKVHpbyVKy6B1lujKdrirZymx6V5mjzKEbSo7yWfpAmad8 nv6uFCvFgqSUKCWCSSlVSgVZKVfKBQVvjTVCklKr1AoWZZlSL6iKS2kWUizDLMOEkZafWfqFO1S8 /gp3qSbVJIxTFVUR7lbNqlkYrw5XhwsTVPwnTFRT1BRhkjpSHSlY1VQ1VbhHHaWOEtLU0epo4dPq WHWskK6OU8cJn1HHq+OFDHWiahXuVdPUdGGKmqFmCNPUTDVTyFKnqFOE+9Wp6lRhupqlZgkz1Onq XCFbnafOFz6nLlCXCgvUArVAeFQtVAuFAtWm2oTH1CK1SChUNVUTvqIWq8WCTS1RS4SvqqVqqVCk lqvlgl2tVCsFTa1WHcLjap1aJ5So9Wq98ITaoDYIpSSIc8TQ7ffnKryPVpWTUIP36Cq8E1c1gG9B rwN+IBzDSqAjhk6i6kz0TwObgC7o4N27qgfYAewEBoC9wAHgReBl4DXgdeAscAk629G/DVzn94Sa Pn5fqMF7e9UtzGEChgMjgdEYx3t89XggjaiuGqgHXCTU+dCHgHa6m+bQQlqKb0bst3d81EYdtJ42 47tqH+2mA3SETtBZukI3BJOQIowV0oRZwkL2+8TazsfTtIHHM7W9j+Pk1lZrJ7WN2hmwsPa61qmd BfNoh7Q27TBYvfaC5tOOgJVrOzWH9iJYkdavlWiHwPK1LVqhthUsV+vSFmv4tqLlaE9qC7V1YNO1 tdpcbT1YhrZJm6p1go3Xglqa9iRYqlatjdXqwcywm6I1gI3WCjSTVgSmaoX2G5oGJmrz7Fe0XBLt 17X59rPaQrDL2hT7CW062Bltqv2Ilg22F3cPaOPB+rW59t3aRDLZT2qLIbEUEjb7MdgwoV2M0aUY tdkvasWQXm0/aV9rx/odO+yv21c6dv6PPRNl/vtGxH/TyPidnmH892nG8N+GuYsEZKUN34xV5Gsq UTnqqBx1VI46KkcdlaOOylFH5a/HgFoqvxQDaqliFXp4WY76qUD9VKB+KlA/FaMB1E4FaqcCtVuR BaD+K3KA+cBCIA8oAIoSxkuASqAOcAIeIAi0EdXgO2UNvk/W4PtkDb5H1pyhqfZMexYwC8ipSbEv tOfZR9vH29Psh+yV9vn2OnuBvcjutHvsJfYg2jb7KnyetK+zb7Bvxki3fRs+vfZ+8N32fTWLa5bW 2Bhjv0WG+GOF4lXxXRLF95ALE8+FwnORxHOhIhcPISOfHcrIHcjIozRWeQx5Gc/zMkHRFI0mIS/b yGrZjux8xvKB5e90ryWKHE35/ziTQPNJ57nOIvM/zxPOC3ORXuQvChetLOoo6ix6upr9dopZfEd8 B+SaeI0EOUfOIVEpUApIQu3ZyaQ8jgqULT+x/IQUyy3LLUr6l3SE1Mt3st/3V4XdhDPHAV8dKcAo YByJYdSawwpkAKhZR3bseg4wD8iNXS+OYWlMxgYUD0Fw6CRGTCTiXBQjw3lPjnLwkeD7E7ALY6OB 8QbYGEpUjKQZ+hyZMWTF5GcBWGlkPrBwSP62Tzj7HQ0Azn2Hn9tgPnOd2LzkwHPAsZLLiZG82FjH vwA8PxxPJwDPEEcXj4dYHibxiZVDIEePMVbO5t7BfeP+8eudnwjj/gDrxT/ZVnv3tG7WF7n9rd22 9S39rdv0fHdKa69e2LK7tV/Pb9mHuxpGduulaPfp1S2HWg/p9bqv9TAf6dddLYdbj+q+lqOtJ/TS lhOQYfKnobu79bweAr/MrV3VCzHLeX0R+A1InoZkYcv5MNm2+jaFFb3dnRJW+Uiqvrrlcmu3vrbl anisvr7lMNqNbgfaLW5/eKJtf8uNcLq+1XM5PEXf6KfwdH07ZCbqfd7q8Gx9F9q5+h4+st93KbxA f8GvhBfpR/wqRo6hHWvb70+F1kb/2HC+ftI/MTzbdsafHi7Uz/inhDWMp0Lyon96uFS/At1q8FTw i/7Z4XrbMf/csEu/5l8QJrSL4D/iFvbpN/35rf1u0V/Yus9t9mutp8FLscb1/u1sFQntdn8f52jd S/kIW91GjO/Cuv6hddv8e8Kau9i/H+ut9r8Q3oL2SOsh2zX/sfBEd7n/JOx8Qqvv8Z8Jb+Utk0Sr b+Htduimu1P81eGQrvnr4a3DfzG83d2A8T7dFxxetts9yu8Kk3uc34fW7A9Bxu+/Fn7BHfbfDB9x 65DcZWsPiK3nl5X62yFj5REwtDL8+eH22MhU/+rwanc22rXuOf61aOf514fXu3O5zcR2sX8jorfY v4W3jK/0vY162+7dEz6m79K3hk+6OwLmsOruDKSES91PY5Y+rGhX+Ayvt16+rj3IxdZwquGhnu+/ gqpj4/vdmwKjWk/YrgXGhS+6swNWxHB1y+7wFdsxxP+auyuQEb5pOxKYiuj1MO7ewbjtSMvuiKjf DGSjPlnujrl3BuZEzO4B/+xIinsvPO91H0Cdd/O90+9+MTAvMso9EMjF3ZcDi1v7kakzEdH9WmAp dF8P2MIL3GcDxVhRn20146jVY/p+dyf4YsRzH+R3hccuW8+4+1KgHP68HXBgT20PNCCnNwMifLMF 9Mg49yjOr/tfiFgR+fxIhu1mwB8+477V0h+Z6jEFwpFsz3BkoRt8ZWSOZySz6Rkd6AinG1zfE+hE JTDdeZ7xgaeha/A0xm3rA5taez2Zga6yw56sQE/reVYPkQzPLLYiTw4sbINX5eDzAzuG+MLATpwM LFbpWBE4ag/ck8e4p4DzIqzohKcEdnI9lbDD8xLJ1bXAQGSxpy7QgXEn99YT2Bue6AkGBuDt9sAB 8LaW8eHVnlWBF1sPuecEXm495Fnlf4Hz1zjH7vA86e4s240zoT2y1LMu8HrE5tkQOBsp9myG/XJ9 u60v4vB04ySZyE6wSAqXbGCzRHT9SOBSJBf7+jxOrSP+6ZFctxmenPbM4rnIjfG3w2M929wpkXJP r9dXloZdgGq33fRvj/h1F6sHxPx6WPP0x+L8NjzfbXC2B43483060bOPzWvb40/Fqg8FboWPeA4H TVj7UchsRk7fLlvltvlGhRd4Dq2oDyueEytc4WpwH+chzm+PHw0GkSndP71sla4FR6JyjgVHo3JK g9uwomOBnnC694h3T1u391jL1bZty0rZU8B7ckV7W6/ncrC7rZ+dsW273dZgd2u/98yK1cgj57Zr 7Oz1Xlyxtm2f98qK9eEF3mve9rZDiF6o7TA7+duO4nRV2064c8FPQ3djeI/3ZsvptvMYn9122dOP k/8qxregBrYFBtqu+sQVW8MbPUcR7c0+M8ZjHP7PDm9cVhoSUdVH/H2Rs96LITPm3RhKQeXnhkbh xChn55hnZGgc1rWHcdv64HjsYszFzs9gGqrxBCpnt+c0nk297s5gZutRz+lgFqr6fHAWIn85mBNu 91wNzm/d5rkRXIgo5QdzIhmIWx5qcnuwAKfKIkims6dGJGxbHSziIyWReZCsjKz0UrAOlXw66Ix0 eJWgJ9LJTqrI017VV956yJsaDIZVT0mwjT2hPJnwvNOrRDZ5xwZXQbI0MBC+6Z3op0gXZnwSmfIF 17We9qYHN+BJtz64GXtqUbANVbEt2B3p0dvZUxXPoPRwqXcKzi7VO919FpVs0jdGdqCST+AU2qqX RnYyHhnA7HmIxtqW85G93tnB3sgBd3lwW+RFRKM/8jLszI68hpOzP/I6TgychPoe5qc3FLK2j8N6 qd3q6whltGf4OkNT26f6ng5lt2f7NoXmtM/xdYXmtc/z9ei+thzfjlBue65vZ2hx+2LfQGhp+1Lb /uDlcLpvb8jWbvMd8F9sL8a+3oQ3BDyvsZaiUDH4FrbffSnIXb/vxVD51zRd826PLGb1E7mO/Doi i1l+wfeGGtrL9T0hHefD/pC/3eF7ORSGV6/Bqwbf6/BK950NjYqfIbbtoZXhm+yJ0O6H7rhwO05U PG0xVwfqqhN8D+oKnNVVeA9kOsPtRv14jnLOn4/ei3habfGsCqWEV8e5f0/bPk8/qz1PSehpdhow rm8HT4edTa1XfZdCXe1ht5VxfWuoKzzbkxfqidcndIe47gp1tq/0mDw32jv0Ld49EYfv7RUT2zt9 GYEd7U/7rod2oAa244QZ5buFN58+71Y8B9NZ7to3sdy1d7HdYawictZzuaX/a2vZzuXRM3bHyXB6 iym0EzVzEyvd6J0Y6Imc1TcG+yOXvHORi0v6IrxBpXsXoBLexvkzOyJ68TYYuY69E2Q1H9zN232Q yQ8eitzyLggeajMxebSFaIe7VwYPl42EfA6ycyx4lLXYfWO9mp/aRtquBE+03mC1hHE+F2vbRut9 +kWcHqXe0FBbrS9qG2+0+i53Z1saKv90pMtbHzzflsnbLN7O4vvFwf13GJWGGQkzuoJXW094fcEb 7HxmlekNraC2+d52PR9tyJteNl4/uUJpW8jbNNaGZ3tXf9UcsaEyZ7OVIj5+/eIKtS0PnhS2FXjX 6qXlc73/Td63QEWVXYmeeynqw8+yIEgjkqJEmtA0TXhQASTIom6M3KoixAdVBTG0TYghxBDaIL8H SPMxPp/xEUNIxzg9jO0Y02OMj0d8hDGGth2GsFiG0LbPR4xB2/BYxriIwzAuYuDtve+9xa1qbDuZ may31qyz9j679t1nn3322Wefcy9V3D5Y0bCmWk0vLTWcaOjp8NTdbeh5aQk8eb091q1vjQJ/gjde aW4obo0FDfOt8e17GnbASm+uPw12NuN8tS8i7iivO/Ff3uioxDzcUdnQAzKu+nKcWbCzDCyZgt6r pVMZaEuS7altONmaCiOF02lHfcMZVx/0DvyXDjUUtlo7WlyLLS2vCA1drjOvuPZXwC4Z33CuNaej Y39Ya37HoYbB1h0dRxu0ramvHGsYbi0E7420Fnf0Ai7rOF5X1robskRf654DC5AhO9rvNoy2dHT0 0x6x5JpoWuhkjWFwel+CLDEJ6zpif3PH6cbopslOLex0zZ0heALvNH0J7wj668vhaj+e5zujkO6M JTp+fwXSuGN2JrkWQaYa+a9E1I0AXYmZrTO17kbTUidDGvhE77+M9yCNZjzt7xdaWjqtsHZYR2W9 Efpa2D+N9uAa6cxpOAM25DcmIL8x2cvfQfxCoouR7qiuP9o0/pIF7xc6tu83g/xcYxrIlNU/gD1r AccC+xTQnbuJhgyMGuoGG+93TDZmAr2nMdd1uHMv8fcgv3Mf0Y0ks71RaDnU2dYotp5rP9cotA4S PQy02DrS2dVY1DoKOAH26AXaT0dgl2npPFw3BXvuTaJziL5EdA/R1fsjWidgT5+F3HhKTddfBx8m NLowkuv7wea+xl2t2s4TRO8g+iTIT0GOrdhf1XnGdbh1qjO+sQroc8jvHGysadB2nnkPPUzyI41h rTdg3tNcU52jEP83Oifq9rgmOqdU9A2ibyHdYQGbszvvQpSmdkQSXYw05mSF7ryH5xM4Q1paQ16Z hn2tBc4Ada0hnfP143gnCGeYW+17XIONr3Uuwjq61fkYzgM3UX5/O8yRL03nhP3t7ScgTi7hmWd/ O+1ol7r4Rn5/e5ce6c4JosNciw1aONWktd7timhsbr3XvqexvXUesuKt1sVXZhsPtj5ut3bXd7d0 dzS1HDC25zfVHzB258HK6oBohIwEMYN3kfOYsdvLGiZgNYkSbgpqu9j1RpOx7XLX+abI5n1dF5pi 2sa6LjZZ2q52XZbukZsSmwu7xvBOs+sq3kV2XWtKabsGpwLpDpfubeW7WtUdq3yvSnepTelt0773 qtLdaFN220zXdFNe22zXTNP2tvtds02Otodd95t2tj3qetjkaXsErUhPU3nbcntUU+UBTdcj7Ldr mfpNxX67NfLdNN47p+K9c3cQWtJtJEtSVy3pjpRGIWVIvFPujsF75O4YaVx45w6a6f4a8xK2hTgf xR2k24I7SHcicrpTcA12RzZV76/qTpe1nSA7aw8EdWc3dRyI7GiRnk5ITwyaDjWMdG+vK4ZzzlDT 0QMx3Q75WQTd9Tf1HrB072w6fiCx2yM/cyC/yU8V6P69aeDA9u5q+amF9HxAoqXnFdCqc0dT/4GU jktNpw+kd55sqj6Q3V3edPZAXncl/kcL+tUhU/3qkKdfHWr0+XoPC6RfGsbQLw3j6JeG8fp6fQt7 QX9A/9+YlX5FaKNfERYFfyQ4lRUH3wu+z3bRLx9fpN85fg76SGPx7OOMMYF9lkWzCvYKS6d3KBWz HvYNVsL62d8wNzsNpZSdZedZGfsxG2YvslH2DnuJzbDfsJfZ/2X3WQNbZCusleO5JPY17jB3hJ3n +rh32P/kfsXdZf+kqdZ8mf1Bc0rzPbaiuah5kwvQTGje5gyaOc1vufWaxcAA7kOB8YFbuM3aw9qL 3BbtiPZNzqN9S/sWV6Yd0/6C+4z2f+u03Od1Bt0G7lu6TbpY7pQuTneAO204YDjIBxr+q+EYH2r4 tuE4v8HwV4az/EbDDw3j/HOGtw3T/CcNvzIs8p8y/CEogv8i/qWJ7wwOC17HdwWbgjfwB4N/HTzH HwmpDXmN7wv551Ce/4fQjaEb+bdDN4Vu5q+FJoUm8b8MfT70eXqzdDGrpielsfh7LVsfwAmAkwBn WLTthO2k7YztnG3QNmwbAWrUNmGbst2w3bLdtd2zzUO9aHss8IJeCBMihGjBLCTgb/9obpneprcx Xi/qRfqNpIlP5pMZ4zP5TMbx2Xw24/lt/DYWwOfzNqah73NpeSfvZDq+hC9het7NlzED/yL/Igvl K/jPsTD6PpeR/zL/Zbae38/vB50NfDMLp+9zbQB/x7Mo7S+0v8Dn/ewGu0UjM+EvIm2VrMJWaau2 1drqbS22Dtsh21Fbr+24rd922nbWNmAbsl2yXbGN2yZt1203bXdsc1A/sC3YlgQmaIUQwSRECbFC vJAkpApWIUfIF3YAzyQUCsVCmbBb2CPsFfYJjQIc5m1Lq4VksMwLi1RM3vJYLoeFHqHvE7xwAoAJ J4UzcO0cUIPCsDAi3BNGhQn4NCXcEG4Jd/H3dbq/BW9G+sQ5/j+FdFYLUZvNmiDm8ynO7RDf55kT IvzHrBDi+x32KXqLWRH56NO6zbotbKfuWd2zrET3nO455tI9r0thbl2qLpWV6qw6KyvTZeuy2Wd0 Oboctkv3Sd0O9lndZ3S72Iu6cl05rBeOnYCVhF624OvJIGaY7RzAIMAwwAjLsc3YZm33bQ9tj2zL gsb2SAgSjEKkECNYbA+FRCFFSBeyhTxhu+AAvBPAI5QLlUK1UAulXmgROoRDwlGhF/BxoV84Dbyz wBsQhoQW27TtqnDJdhXKGNDXAF+1nbddsF20XcbfIupf1u+nX5sG+XirCUo6+zmUDPYuFCus+t+w j7E5KJm6Il0Ry9KV6EpYtq5SV8m2Mi5kIZT+Yw5LwvevFYcBRDDONQ91NIAZ6EWAxwFpxXrXXYIw 1z0CpCNc88XRrkX6bHY9Lk5w88RPduuL09xhxMfryFPklHYKnemO8OpGPrZFQF0KjboVOtcdTYDX scZ+lGsKCG4zXVfaIY39Ya2ACP2J8niw7yKoXWAj1v761rJJbZsantTWH3Csu9wJ5Jcqd7J37Ipd aAteR/8ofhXXgAroUw3YTgEciwKKbegzbIc6a6BPxTdK3+o5RB3yGPOC3Gk+fiySa7yuyCs1Xqtz Z3p9q+jGulm2Ael2dy7VB92C1+9KrfSNn3E+lVqxEf2FY8IxHHGL72mvjE2pj7mLil91u4pfc+/y sVM9Fn9bRT8/KHW0yjYcj+I//1ioUNHqmNXLY1D8hzxFxyl3hU8fSh32hPEr4w3zG7/yGeMHaaUd 9OXSSjz/2ivzhruq+Ly7pviR+3zxsvvCE/2yVt38Aa8/Te5P6adC9q/i52i/+Xq/unn1sytEGveT aq9f/HztMkl+elrtnXdxjVo9DnXsY33BXefNGxfdzcWX3e1EK7WSk5X1OeY+6L121X2E+sW4V/L1 Nfex4mn3q16f6Vdjg+oZ92veMaL8rPtU8X2Qeeh+w7vO5TYlGvfFkiD3ZdKjxCTUJUb3GOooiXRf 9carUsu5riTRPVMS475GPkzyDLlSPZdcVs8VV45nHPO6K98zSbwdnuuuQs9NkiuGnIj50n+OwYeu KNDvz4f1X9Lv2UlxX7bah3fOd3vu4Bi8vn5a7FX4rW3/mPLPV/55SfYR2uTa45lTcohrr+eBa59n wdXoWfL6SunTPx8rcbPW/uTHL7G4p8nPCCnu2ZJ09331PlWS7X5Ykud+VLLdveyjS9lnAUocHk3J Tk8Q0R6PkfZcBRQ95Z5Iqis9MSXVHktJrSeRxv8EKKn3pCAocVfS4kmnusOTrd5LSw558kqOerar 956SXo+D6uOgA/xI86ve2xOkOCg57fHgeGmMZz3lJQOeSmo35KlW+6vkkqe25IqnvmTc01Iy6eko ue45VHLTc7Tkjqe3ZM5zvOSBp79kwXO6ZMlz9j25cK29T9lT1Hn4SbV/fPnrU/i4j1Wo4m2tvN+8 hn4lJyrnA2WdKGter4ollMNYjJX359zV2hUvzbdSe+Fp43xCrvWJZXWtrJswv3Xkv/+pcimNR1V7 932/nORTP8neIj9/+vXn3Sv991X/ukaV79S1MidKvk6W/P2Vuq80K+vN1VbKcB24ukq1rsOlIS7m GSDoKTUheM/hij5FN9rXVxrlXcPYj/p8rKw/5Wwst6f8DfuE60RprHfdIx/WHa4/tT7XydL4Nc/e sl7XmdIkn3Xol6OUXOQ6V5rqcybCa5gTB0utxfrSnOKw0nzXcOkOopNLC4sTSouLc0vLXCOlu+kz XC8WSvfQdbjmmihtJD7IUC3rINpcupdkRkv34V28/uv6/85Y8EfpP1f9Lvh3DP9ra8Jf9vlKYABb oecoL9JzlJe0I9q3uF56gvIqPUE5SU9QpugJym16gvKu4UBQBJ9Pz0Vu0HOR/0PPRX5Jz0Vu03OR 3+JzkYBofC4SkIjPRQI+gs9FAlLxuUjAR+GO9hR7Y/XpgZVnO6y5VsEqWousLusua7K1wlplrbHW AW4Gmre2Ww9aj1iPWV+16q1p1tfgyinrG9YwKucBLljNgC9CuWwds161XrOGpXdYp60z1lnrfWsE lIfWR9blj2ms0VTM1gToBUsaacRP0QSZIJtmxReKcvpS/P6k371tM8xIKzsAd7XnoGTRfW42+wWb gjvZa1A+zv2MG2e5mknN2ywPn1dBS455WLlqvGZmkS1Ig/6kkafJY1dG3qwa8xEYMY73PIzzDSgX QKrCepFsxCd/G+gXiQyiJwF4iVB4uJfG/8+bDEXDUtgLLJB9lKXB/XUGy2QGsElgoWw7lDC2A8o6 JkIxMgeU9ayQfQos/TTbySIg5jwskv7jZjSrh7KRtUGJYe1QNrEJKLEw9rfZh7kwLozF0bdD21bH WnA1IK3gas58wbWC6YKZ3KMFswX3M8a3jRTcL3hY8KhgueCaqCl4KAaJxgyPaMy5K0aKMbnVogV4 ibkOa3zOvZzHYoqYntEvZiO2aq0s1yHmidsz+nOrc0atTHQUzOa2vFAp7iy4WnBV9BTMkFYj6PcW sRb0UNlWnPM4Y1ysRy1KsTKpZMyJ5dCyJddhj0JdQB8Sj75QmVsN9AzBjFgpVkN7DYznGvZCpbfg IdhnRLvBiultfbnV0Oqo2FEwK6aA9HGxv+BargMhYw70PBRPi2cLpq3xBdPigDhUMJNzDzV4YdnK CEBeDALNQeIl0n5FHM/w5IyKRhg1AvQmw6R4HfUqvZBGBcAGBPEm1PdBK4DYK9ZjQU+Id8S5bSNi 9lawUUwHuQfiAli4ZGeKNjHIrsX+ffoGsIfYTWIkeB9GC1YCpQByqCVIkV1/CszYT/jY7wP2Exnj Gf32k/Yz9nP2Qe94VbAWH3n24VXLfUYBfPsIzrIEaAP24bX/Ws49MdEem9sCOB6isoW0Thdcsydl zNlT7dbcWntOwaw9377DXpgxXnCf4pTZiwuW7WUgtdu+J7dX7LDvpTlcsu+zN6In7W32LoiddIhc mEP7YXsPRIfH3ifmOWud9c4WZ4fzkPOos9d53NmfkefME1sKZp2naTahB+dZ5wCC/bDztJgttcBr zqEXyil2vN6UPCf25kzhjK/OqaiB2OqFdTcHsICx5bzkvEK6x52TubU58xm1FKvHxVpsgb7JuWeN z8iD4nG84Tiv0FTyHBcgdlKgvghwGcbPMnqxbDu37ZxjzHHVcc0x7ZixxjtmwT95jvuOh45H20a3 jTqWxQ7xTkb/x2scfK7Dqdma6AxyGh1VzkhnDPVQa413WmB1XnImQqxDH86Uj/O5efZ9tJ6gZ2e6 M9veA74r+3hNzoQzz7nd6RCXnDsLlp0enCVnuZiOI8mZhxkctU/Yp+w3RA+MClag/RbAXfsNO4xM PL61w+uv4/Z5+6L9MY4+92jOY8XvBfcdvFSL6Q69I8wR4YjGVaTwtvaD7iWHGcGRkNrmSHakFTyy ar1Aa9ve5ciEPvNX84J3XjSQ2xBo3TtyAQSHmNqGseMocrgohmSaougGJLBdjgr7PkeVPd9R46hz NDvaHQeV6IaM6gDZI9LKdByD7NqCgLMp5Q4H73jV8ZrjVM5owSxE/8OM3hcnMds6r8M8XHfedFY6 q513xO2YD8HGhzD3yfb83ONiImTnxzAmJuZl9EvZGOfHOSced1pw5sU86D3R+cC54FwSUwpZobYw pNAk5r1Qbj9cGFUYWxgvegqTClMLrYU5hfmFOzLyCgsLiwvLCpMKHub2wmwZMedCzobsVLi7cA/6 BO0ubJQyJUYwzOpo4d7CfbQXfv4/0AmqitXSM3P8v/MspZ5xABEp+6A0QmmDshtKF5TDKRMpPVD6 oCRBOQHlMJSTUM5AQd45KINQhqEUQxmBMpoyiv/dUv+ifjf9F89PsE+CXwtgYQcwJ5wOtOw/g/eC wc+fZeGMC5kLeUgW0d+6sgYZl5MD9TDU+QFpWeeyHhMMyoD0MMCI/HkUYELmTwHckPkjMm/Er51C 35JrhT8lw4SKHlXRd2WYkOsbqmsK3JOvj6p0Dcq1AurxKLVio7++tWxS26aGJ7X1BxzrvNznomrs il0j8vVbfvb6g3//IyoYVIFi21253YTcp+KbKRVfmcMR1Rgf+/lRqadU8koN17J5lW/V1xQboM7W y3WYyoZBv74H5flUarXto1KdHbFG++EsnzFmRwOYARJ87fQZi7+t/n7wr/379J8LNahjVhmD4r+7 qzqyk9+nr7XG72+Df31LNQ9K/wrPv5ZlstMAMgHaAQ6+j1/+f6kV/yr1k+brKbV33E+p/X2s+Olp tc/68q+n1rBf0Z+b5V072QKAKNOiSk4Vy9lFKhmXpJ/iXs7X2bsAKlQ+U8cGzn9Vls86zK4BqANo VvldiZUjAMeyvGvRuyZflW15Lcs31wxneXNd9nmAUxK99ShAL8BxgP4syutbT8u8swADct+YExfX mENlDP586GtrojQ2dR/K9a1D0hh8cuDTYs0/375fvlorL41KNm29tMrfegVgHGBS5asn5SFlrGvt T3787DdkPyNcALiY5bNPZV8GGAO46qfr7ipkXwOYlukZaW68oOiZlev7AA8BHsnjfwJkL0ugxN1W jVwHZfnspVuNAJFZPnl6a4xcW2Q/JqrGrgD4amuKNF4c49Z0gGy5XZ6vv7ZuB3AA7ATwAJQDVAJU A9QC1AO0AHR8gPhQ7ynvl5c/aLwptbK2nrT3PKlW50b1WvevlTl/Un3jCfC0/p+We9fyn//6WWv/ f1qtykVr1n/K/Kj1PmHPXLP/teopVf8qv7uVecI1cF1aB1tvAtwBOCTDnATe86rSXtGNsfwga3UN j2b5no+V9aecjeX2mL9xn9i6sGoDrb1Iaf2p9W1dylr77C3rzWFZvuvQL0cpuShHm+V7JpqS1nFO yOr4ckyquJDlcqL84kT2d078qi+986ZeAygTm/UYv/dEb1lg/3HuNbke/C/8LIQLwxebJI0AjAJM AEwB3AC4BXAX4J78eR5gEeCx9Pk5Xga9JPNcGECECqJVMmaABIBkgDS5fSZArswX/gwQAYpU4ALY JdtRAVAl9UVQ8z5Qx/KSGpPakrqSDif1PNOc1PdMHZakHlU5oVDPHEs6mXTmmSPy9ZMA554pShpM Gnw2HjHWMjUsfQLJkySHbUeSziSNJo2CxISq4DsYTO/9pi+9WURD7xT5EL07JJLeHfIMvTUkht4X som+42um7/g+T+8I+Si9HSSd3guSQe8FsdIbQTLpjSBZ9C6QbX/x/jjOxEnfmh1mzzH2LMTSs4t+ 8FiGfKlOhLhJhNhKDFMBxFUixFWiWQZehgS5Tl7VRbIw94mZEhA/fxXwmmXsqfDcsz3P9vmVE+/h vD9/jYJvHKRvcjN6c4z0zphA+iZ3EH2TO5TeGRNF74mJoTfEbKJ3w5jpHTAWevtLAr3xJZHe8vIR er9L0r+bXo6dY4OrfwPa1MucW6Y3DWHZMrPJs2V2y/0tD7fcp8+PsCZY3jSUoEkIkqWGEozIx5IQ ibwECxSjVLZMY1E0JsSARq8+wsuSJkXPJg9pCAKZ09gO+VLPm4bwySGPPtby/fxPIK2/yf8Di+X/ kZ9lm7UN2gZmw+zJhOAfB4+wT9Aba6IATPK7YOK87TXQ/hS0P80Ps0D+IuiKpjYxIBFJWPbHxhTG IeBbnxDj24xYJstVSUQxU9RU1NTGWEuNpW5j7Mb4jUkbC6FEbUyNurXRCpCzMX/jDtLxKn4Dl/8e /z3o+wf8D4DzQ/6HjOcH+AEWwP+I/xFY9vdgTSCMaYzpaTRBYNlPWHDwT8E+I6y4Q9wYPbvbydZD JLcz9mGXBJaDq7QaLEfW5gNwlofMaXFYhsx3LZfMqZYrWD9TaRmI01vGP5xomURa+RydZLmOMpad lpvIs3gsd5BvvmWZI5kwy01LueUB1iiLYKm0LFAbkLVUW5YstZuZAtQ2dXM+Auok8GzWAhR7AWxT AGyD/jfHyzYuWI5uTpLozVZL9uYc6O8K9dVLekJku4Zkmx6o7LlOuqs3l1mOb06NTtoca+nfvMNy enOhMv5nHGBH/eYQS8tmE42rA8ar0Ic2R9E84jvBGL1BizOUGT7LeMOLht1Ma6g0VDK9YY/hC8xg +KLhiyzY8BXDV1iIYZ/hqyzUUG9oYOs+cAxz3Fl6J1kIq4dzC4uDbBh3QYaLAJdlgKwWdxXgGsC0 BJv2QD0r1WqIu79Kx06vAnzmLJFEO82Z5szYyajI2Ji4gQ1AbSjaUBS7AOXSpgigljYUmelznCMq 8sN7YmM2XIBSFDdkFswVcYfgynjsOMqA1FJU5IYL0OJCVExUZFRk3KW4o8Cdi4o0C7F3zK4NVbGT 5l1eIJ3mIwixA7FLCGZhQ6ZZiJv0QuZqkWyMfSDZaC6Cds1x/UjHDcWdNifEOeBqjGQf2ibblQm9 i6BZRItAu2wP6EZ7FswHwc4rYMU42h07KY0f5Kries0V5iroDdrGzoEmoOOOw6c6M75XJYT/Og85 mv82/21m4L/Df4cFGUoNpRAB5YZyiIDPGT4HEVBtqGFhhpcNL7NweutZRPBC8ALbELwYvMii6L1m z/xJOc4DUARQQ1nOQr8xKaPvMuTImY/en8ua6RsHHNuukktje/DtPF45DrLRdyGiechH1D/1Fku9 4Tt39RTpjCJdQ5GupUjXUaQbKNKDKNKDIdLrWShpwjEwGkMgjWEL2dMn232W+t5MvA6ymmMjKt5V 2W613DBZzbFamYf/Petf43v0etQTR60lTYw0caSJJ00BpElPOvBtzIHvtYF6CSb9YU/0BU/v/EJv SPMQT2NslH1R6+XxbJc8i2q5PbIvdsi8P2eWnjbvT7K7jw2p7JZ4w+yUKvYkXo08i2reMXkWFd6/ 1Rx+kFn418zyWr7g2AU2QaeCaPzv4xE7veCMEKFERxRFuCJ2Aa6AT7uIV0VYokW4KkbUQKmIqKPP SItyaYciRhyUQVRp1EMRCRR9iia1nhqq8Uoz9V8lfcaxGF4yvARjrjVAlBn2GzACPvDexAZoBuW/ bIaXA5xmzvCTUPIJn/HWJ73lTPg5Lz0IBbBpwHTUVItFJTliGiBQPkuazlG9quGcV5Okpz48ROKY PABXTJWmK+HD4cOITVcwyg2fN1T9uSM0PQBYYE7TvGnR9DicD9eHh4VHAMY6OtwcnkB0cngaYD48 MzwXeOZwIVwEuijcRaUCJKPDq6BkygXb6L0aa8LrCEeHN4MMatPLmtplPRWmRbiGHD21RhDoyi4a YYWh7k/YP3g4/1+n7CqtwwT8//lcGpfJLsPnV324iVwKZeEOH24sF0+5fK8PN4KLZu3w2eXDDeKM 9DvLPB8u47SsGD4nqbg8W6RzdoSXtzq2p69wE3+Sfx0k/pY/DZnt+/z34WR9lj8LLc/z58E3Q/wQ 04Fv3mR6/gp4yMD/nJ+E/DPFv81C+Xf4d9g6/gZ/gxn5aX6aredn+BnQ+S7/LuSc4eBhyDk/gVP5 h+BU/lOIDTzbf4Pw1wl/5z30N1T0MRXdq6K/JdMwds7MwXg55T2lzxIviouFT/M+PCOHvd/04em5 MPg05sNDD3Mw0yoee8SW4VO/D28evM7BXqTmzbEHtBupeTNsFj5V+vCk35kW+fAmKbZyfHhjPnuB xBtho6q5fpbu0XBeGeVkjnIyZuO9tOP5eNVQ/R6vHlPxv0l0hYouV3n+6yrPf2OVlmW+pWr7LZVO if6Sz6xJNI7FQt/qxPtIaTSJq9Jgv3QPingAcBALhNNekJfrk29ClhkL1TBnKAvVhoYAmEKjQmMB Yx0Pn5NCU6FEhVoB54TmA38HFBPwC0OLQQLLXrmOp3bqEgtyJmirDd0HOhqhRpkQ+WoOQFtoGV2T WiOUUUkN3Q14d+ge1bnhg97PhHHFNMJ9MG5mCgIwqgDuP0zgN5MFACLElCLzUa7fD07L9VmZHgBI B8gGyJM+G/uYM6hr/cz6IsCz6++vf7j+EZT765dNmqAuLKag9ctYG3esnzEZ18+ajKZIkxGkH2Ix BZksJgvJGaUitVI0mhJRI2DSZ0pBXahpVY8pHfRq1s8Ei0DHBCcH7Q06YYoB3BW099/sxPNBd7M7 lC1C6LvELDgVwAqQI9cI+QA75LpQvoZyxTKUgT/bghNgHIeD04Izg3ODBShicFHQ4aA2LECLVAsg lQYlIdgVvIs+Q4G6CGTx+i6pyK1WNdao9aEuWZOiJzM4ASQTUFdQY1BPUE9wRXAV1G1BPX/m/cmf FbnrYG0aIT8bITKNEKFGiFwjRK4RItcIkWuEyDWmy3IOADgNGj0AcEoyQt40VgPUytfqASBqjXky wOe0NubUja9LCOsDnLwuE0oulMx1M+tE3TiWdUXrBKpz1yWsc4GMa92udS76jKVmXdW6Krrukorc yldjJkiRPtRFmlb1ZMInESAX6Ar9Pt2A7s66CsDjuoG/eOTi+3iXVCcAvN/RLtf+8a5SnrJjoDxH s4c5eGwlU8nJAV3aHqBntTi3s7rDhD3I111knKYt8CZk5gda3MWWAq4xLvCmFu6SNdHIN6QEzDFO F6NxAOeO9iDESHkgw7YruMPNIgYJyP+cSLvA7HIt0ogDupAT0PXHaZRBrGlDDn+RJJcQQx+ANZ8n /gPEur3LJ4HfuAK7ecBOxFzySjWeFLT3EOvOEI4jTjHhHsJo/00tfvdyXluKWDdJkt24Q2lnAPdp 8U4uTacn/l6SQdxPmAXi/SnDqyBfShx6jhA4SBxsyzR3iA4j/k2Sf40waZD7uk4Yvb1ErZZwRGwJ RwH0Nby6nEs4nTDd/S7DvK2Eo+blX5F+g+an1OMF8MwPdALg1wn3amGm+TcJPyA8jfyAjUgHjBBn kuifE04iznOatwALhAskjHxumehJxNw9ot8kXE84W5IhPSGkZxvyV37P/x445kAYneaoBs7Lgcka 2NU1v0Na81PiNyAO/IzmDaCXkeaaEQcU0tXvEscZ+PdwbDORJEf4y6ThMun0EA4lTjPp+RuSCSIc jlgnkrZ3CUv6TwacxLET/usAiPaAdwIH0DPI4XcGjgN9V7MZ8P9CDpeswXPoC4gDrEQnoLzWJGv4 O8BvIZ8/oNkE9GcDwB7unzUZQP+EWn0TceBXid5D+ATh/4FYW056HiPWzlCPNcjXaIl/jyR3Eh1F fZmJ7iLJrZpEshBXyu8RB0wh1hCHf5no9oAb+BZ0kiwnmXHCZxGzjZwLo4iwgbCeg5W48oD/Ef1n llRcsxzeB90M2IiW430ON8OjH5YRB2yEdcnxqUjzrxHdHbAD44HoB4R/jRz+dcKTyOE2Ef8RYsgq +AumJaQD9hBOoquTmmgcr6QHaf4M0V8gPE2S40S/TthD+DkOsiVfSPY8RzibrNUQje8UgxFpziMm +rbEQRugd5TZRthD/Hlqu0CcXyNemdekgVcdgTWAz+PaD/gSzch+snYP0d8k+iRikKmhmAdJzVXE /OvUKok40Xg1YI5k6mTOIEXyIHqJJEOI04k48KtEZ5L8McIu0jBCdDVe1W0gmWOEP0IavknalilT rZBtIYjZbdL5FtncLMUV+fkLmv8EtI5iLDzwRZD5GLXKksZIeAfilTt4wudfozwfufJ7yt6Y/81I c5vo6ut4lfcQ/Q7RA4QPk/xemY/yC8RJJSwQNi3vUu7u4CruKVMkn0AaEqjVPcINJLNM+BOEpXvH twjj2xpgHeETRZjpLwI+SnoeLF/AsZPMTdpTapEOpF5AHiW7MD/DvTTMO6wE2t0Qaz5M9H7CzSRZ pfkuSH4GdwHOxWchze8EL/2Ibyf8I8J3yRu3Ad+luArlIQvxHK2mnYRfpaiza36L+73mXeD8FWoO MJN+D9FziLkF4lwkThfhnYg10cRPIM4Fwj8n/CXEgYkk822iI4g+T3Qj6bxMHAfJv0q4FjFb0uBT zTHCX0PMRRHdjxisQvo24UvEiSFtPWSJXtaAHNLMpxKdTHiC8BDxewnvJdxO/HJqy+TekSY72U3C bxCel2UQ9xE+QrgG8cpuoisJ56CegHTSTPPFnaK+Jmmk18gP2yVtK7SDQ4zjeebH6I2V8zguwg8Q Ax8zySBiOIcg5wJdvUhYIH4P4RnEGgfJ7CRsJhxCeI7kXyeZO6RzjFotEI4i3EIyh0m+lmQeayBX c2maXwD9T4HVRC8DNgcaMfIxfrhApLmIwFjAwYEhSGvwHHlbi89SbgTimeSeNoS8JwJ+HncctlHz AmDa79g2og24u638hmRMmnaSTyCM/H9BDLSDcAThTDrnpBL+EJ2IXiJsIXwFWg1hbAON7+TYQHuo JzAAPYZnSHabzlr9hG9LJzG0mU8IpAwQOIYYT3d8Ap5XuXJtMuEFxMS5jJLcZeJfJv4CcRaIs0Cc y4GViPGsyy0gBhskmR6SHyO+pG2M9PSQDPbuIZlkST/J9BDdQ5p7kMOWaCxjhJfopL0kWYv+4bfR WLZp/gUxtgKMGpKprx5JP9lzinCxTOPVYpSE3YRyLNnzOtn2Oo4I6GTK+TQW7AvODLVEn0B7IIdB /LBP4+zTX17uMfwlLGNWwmitgf0d4f2Yx1Z+CG2/T3k1HLIpaFim3YFwD3GWEHPJEo3neTjNXsCr SHPJEpZO7NQqme4Feuj03oPnXsCYaROQz3tIZoF0lpNMOd6zBNITssAI1AO4mnJpGbYiyQXq5TLR xwlfph6PE14gneVk4TxdbZAwtWqgq7+kvn5J9t8myduSTjyBc+WSneSfJYkjX8Uz/Bi1GkM+XM0l OpdGGoLr/Y9nkCP1TnqSccbZPLVi9AxsO2G28jPAEStTgGOJE0Gc2JU/wPl/BDnQHvEFxDw9Z+P1 ZBU99YQxIieV6GRp96Sr9LyS7yU8Ke3UdLVFGpG0txL9Q8TgcVjLKzbE0BfS0YhBG/ZbT/hlwjWI IV/9DGcELYd5CSKadn+0nK8kmSHCPTIt2YwZ4wjhWcJThPsJ36Yeq4i+yeguA3dM9jWO7lt1FZRt yIeUCZmUVehbPc8jZ+UBciAz4GqK0uG3VqbI8wxXDWQnykjaKPJ8NM0ORTVlhh6cO34brllYmz2Y q6X7ZfmuVlop6KsT5D1B9mEfnleJDiW8jfBd8vY9og9LJxDCHpSH8wZe/ZQ8m31MftbNnSIOfYuH K5HkQQf0hZhbINyDmC0R/X3Cl0kmgfAZ4iQTHUp4G+G7xL9H9EXChwk/QBywk67+I+EWwp+iXuZJ Jps4IuFThP+a8DJd/X/sfXdUFcm2fp2uU30O0JhARETEjCLYICgYUYKiiA5gZkyggqIoYByvAcOY xzTqOMowjoFRzDnnccw555zFNGOGV/VVz7nee+fed+8f7/3Wb623Zs3Xu3ft3rVr1967q7qb41lg CjhxsDwOMx4nIsQUBboF6BYiNvioZeSL+5oPvFrKiEAx3jWI1Y9YdzWCtrXAEOMJ8yzku5CsDf4R 4AHgD3KFCcniuLM3AjoAGwODsE4YBVoFYgVFygCLGKsXcRduCsn1Aj81K0DNLBgHnAfsCfQFrgeK VSsz+BlAUXVJ/lPQ+4DDhDasdcmnt2jldP55xu/mny6Lu3N+nurA8alAHuFLgYcRtx6g5dOA34HD YaGUEd9EJBs07KGvQG9B/D8BvRf8h6CPAX8EikpFsPsjZtgvPFDwROgnzujlBWhi7gzEWMx8jPm3 LHxGPt2x1BaWi3s35+AZiBoCzANuB6YBxeqOCHluFdYP7D34vYFDgaHAkbj/ZgN387tAa2sAxwMC zbcFqsECFaCZANPBXyrQMlmgCfIKOFbIWEpb8bwF8o/R2gqYK5CCz26ChgbzWXAOQvMV0A1AM2BR cEJAD4F8BjAffWlAT7S+hGQb0HZAqbkD5NFKHcD5gFZfcO6C8xD0MtCOkC8MHARUgHkYRRawDzgz gCnQFguE5ebuQDlqZ+BhcCYBOwO9gHHAeCDGaO4FS6RtdTC6jUC0WqX9a9GaCnoX+nUH3RQIy+kt aAsCZ7hAe8yRHebLmggEn86D/inQ4w1+BPjDcO1i6DkHHAsO/M8wF8pzXOuK1kXQEInWddAAPgsA nQ26LfAeUAcfEVLQQcQhRx6HynDgUERmF/GMyLRELSziU0Q+OyDQfFugGixQAZrxbNCcDv5SgZbJ Ak2QV8DhET4HET4HsT1HRKzUIGhLaalZ0ObHUpuglVaQyRVIIc+wiqbQbz4LzkH0ewV0A9AMWBSc ENBDIJ8BzIeFGtATrS8h2Qa0HVBq7gB5tFIHcD6g1Recu+A8BL0MtCPkCwMHARUgqoeSBewDzgxg CrTFAmG5uTtQjtoZeBicScDOQC9gHDAeiDGae8ESaVsdjG4jEK1Waf9atKaC3oV+3UE3BcJyiipn DgJnuJxNzNoV4FnMERFokrO5VKA90A4zbk0E4lo6DxqmoC9v8ImUBx0BmWHoazH6PQccCw7mi2Hu FDzHtriidRG0RaJ1HTSAzwJA41k3awu8B9TBR1wVdBB74YJWBTzOC6JwV12W35zjbWA/gdRdoAmo EGAw+K2AvwgkkDeBY4YMnQK+lO+P1qrA1sAR4D8HDQ1KT+AdXNsH9A+gFaAVnGzQ9UDXBg4HZyxw KnAw0AyUOpcDwTeNAf0JrSXAeQnOa9BnQUObYgHWBZqAAyHTAlgLnEhgTWirAiwDTg2gHK89sBs4 EUAd6Az0BXoCAyE5Gzgf2i4DMWozg8xFtG4EfQOthUAvAn6N1heg5XztFMjkvGCOzP7ABpA8Bg0H gMXBLw8+rlJOA3sBQ4FbgNshMwhXTQInBnQF0JfQKvlzQZ8QKx8eV/GIK4G5wGAg1kVE8l8J5FEU j3gTnDmgf4OMV8Hv4rkr1o0bEKtvsXrE1zhmFYgVO8V3P2wpOOOwSrwHDnbBNB50H7QuBrpB2y/A bXiT1R1XLcofInYW4PTF3vYGNNQHBgiOBXs0Uzmg3Be0hWQh9CK/MDkl7LdgT8fk+t9V7tewLw4T yOoKNKvAVeC/xXuidfJ5bH4TsWIXqIwRVtHj8rkl+koChsh+oeECWh/I/SB8GCeQ5mIsZyC5QuyJ qNwzBsAPqAA840TrbVi+DrPwDBa2Bwd8FfZzn/BW9qtAcxRwntgFKxPQ40LoD0C/CyCvoXcNOgdI DeIpLr8J7cLOehdGLbAYcBtwBHAAUDf4Z+BngTPByQE9An5LAT7Dkwe8W6T44stsPNnOH41d/wL0 uwCzI679xbC8L3aLUsMZsTsAxgnknpS9CM4RQ/4MqtkZ6JRR3ReSC0AvwIgE3wqf3BCS5npy/wIN icD5wF9lNBrxvwCxEY9ZljPYF2OHzxFL6zAvgzDjRUBPhIZ9cncJ+drymQw0uGLUaYjAJHg+DVdF yGiRUWHkiB2nx4qrVDxnYJNEq3oOmrsKPeYn0H8JPU6GVZME2iH2rC8FWvBcQt1kaBiCGeFowa5Z 7ShoRsDPgd8OSZ3oK0vumvGc55FA82gZP7BwF8YSIr78ZvIZSKrpCueXhswcjMUVdDzm9D1GegWc BeDMQl93wImBD4cBewLdgFFo3QDJHLwvOAfNZmiAT9hRRP4IWc1gGzKdlodV/fAWdQLwJ7xX9QR9 Fm9ay4H+AByA1higBZwcYD+1NMeyeD9bFpxKoItBw1RwwgSSx8CbUgb0FWjrLt/tAnW8+V0IdIKG 1+BfB8403juLNcZZvGX2FMicoXOmsXITMtuM9ViYeAqB9W05A8OEt7HG8DT0CIzEu/sk9GiGNh22 jUa/KUCr4JijwN8AC6uBnwPNr6U3oLk+sCoQ6zSlBFrnAmvhqgngh7A8cccBf4d4sqRgLUSw/lHa gh+IHquglzRwUuC9AtAjIHkJ6ChGocg34xRjOSnnF99UeEMPVrm0OuS3wVe/gI5GaxPQ7qCxXuUz JXS+Av2V9Co0V4Y9rpKWb+Rh+Sn0eAdYDCNdA5mhoJ9BwzP0e0l+FQDOQ8ivAX1djku+32cFwk4j 6iYKe8RunQYLmo6G5mqQfAuZGaDboq+fpJ9V8SVRCFqHoDUac3cErY7QcEPS4L/D04nHoDvKmBc0 7QW0gL9HImbhOejLoGcB78mYZ5nCfkGzpcBpMp7Fcz/6ADLu8O029J4FjrPxLcRQZA1HE3ZbXCdo 4yuLBBGNRkwKyQHw2xi0xqKXFeCcAGK3ooQB+yH+HyN3sIei8XKuMYqRuHYk6DzQeZLGtRQ9PoQl r4FTsS9AtFtgv9pUoAXxyX6FPcsFWlej9Vvw6wKxY6J9pU+gB5ZY4A01Cd7GHsE0VFYS9F4JlnSV mqFhEuyfJOuDOgj+GYQ4mYjqJOgYNYhr+A4ywUxU7DHizRSvOc/EPk7IkNuC5vOOrwuAEUA8rVJ8 0XoFsXETPtkk9Cg/GPVNvCd6pQ4U+o1K6IEKJvhzmPjC5zf0dQs1ZBVwGMY1EPYfgn8KgY96ywjQ B5zZkFkAnxwXaHYTyN6Dcw0cB2AQOKWA/WWUslecfgrOA+ALSEaJJ2M8DkNgzyD0G4JaGoLeOVpw d2CD0PsDyEQJ5DKCdoNvJwC3CXleKwbhWoGJQB+BdAFy9gHwOMO9hsnsRjwDtwk0V4DMNdAOAtWF DNEi0LIREVICY28FG45Bf38m7YRVTGaZ6D0CrRug8x3od/AnqqJZgR+Wg38Io3CX8hjvRyZzdhC+ ahAWnoCeGaDbwqulBJqDYG1rtJ7BVdnyvibvF4a1IZj9QaAFvzH6+iirpdRveFL0OAp0bej8iFl7 Chlv0aPlG+i5gn4zEDnnoHMU+tqB3q8BkXfmecAqmM1akD8C2ktGkaQhc1XqAU6HJDzGMkEj2rlX nTH7glMTHOSgugJ0OnQmgrYH7kVrO1zVGj6vAbyFcc1HvriDUwV4FdgYdSAEtAl0IWhGDio9gJ+g YZfUIzMLtCeu+h30HFwVIe8FAi1joA113pIi7ZFVGpLTwHkCGtWYe1u04o5gwV2J7YDmBawy4rky 7laxmK/KiN7KiPbKyLvp4jkVesRdUo0DHQ7aFX0dg+U7gU+gPxvW/iJpqQe4C331gGQQMm4CMMWI /xDMjsjr4UKDfXtB200XtDUAqKBfrCLsfJFN+KaOYSVm+QkaWiJW3UAvNeqDQJMR+Rzt0yGP7/rM 3YzYFqgyGWMhyA5BNwO/MXrxF7SK6q12hYcTEO2/ijcO9Co7wzENPkk31+e0gzlHRLh5ApfEatN0 QNA8IyaI52zAeIGmjpiRuuIqc7rwEo/YIPF8zyz2AmmCYzorejGjnpvl/QXV/lO08T5lJMfCoAsb b1LwbroAbzoKRgFTgC3x7Ogx6EnirYSQL/i94Aw408XdXOhR+gmkLqAnALeBEwz6rEBTOeARcNqi NQboCc5M0BroZ8ABwBzwj4P+CfgdUAdWAoZBs53kfLoo7m4Y3SDQN6GhO1obCA7fxQj5jsB88K+D viFaFWnDWUGba4A+gdZqQFdofg++FW+oK4P2Qi/xoFMg+RraaksLoS0KMhvAwdjJFSkJjiPkJ0Dn DXy7a5E2y7ELjhID3Ib32vegYS9a18hZEO/BTR2BU8HpYfhEaPOE5nD5Vh3XNoO2Z8AG0LkS9Fmg o/Qz5MuBMwJ6RuPa89IDcjbRugY7MifIDwX/Lfi7Meq+0ttSD1opMBqcSEnLWTA8JvRcFtFoOimQ z7ig30HeHa3tIB8Hq5qglyagpZe8IdMU1j6WI8IYZ4Hvh16KFVQQiNbaRo+C7w3NmwSyaQLNH0Qr pyuI+gCOm7RExrz4GkGpBAyU8Q9ax1cKpaGtNL5buCmQuqDVG7RnwTThc+xtKfhZwBzpGYngjADW lq1Ad+BM4BpIHoYH6su4lfYAnwG7Aq9DspiMHHBSYNt54GP59AZ62siohswvwBO49hLG1RTYEZiH Md6FzEZo/gb8G8AkmdGgExAnNSE5QGoDUvj/HXxyXNoJ7IGr8kFbQaehr3OY2XviKmuAoC3IUzUO GIK5ayVaLahRamV8Cf8E8+iBcQ2BVbGIikRIomqpUr8Z/OfS8k8DkFkC90ibZabjeRHFU6lJ0DkJ WZwl4oTXwwqI2wqoZhVE5ZEVBhiMWjQGemqjPqBGkdvgRBjZJ2TsZB0TSLvL+gZ+PvAy8CR0huVX 5UhA+0JyEKz9QeYUfPgKTy+DgXjDrszBeH+To8a3JZ3Nd7g9A8zRgka078Z+pDOeTu/G2z1vQoxv BOxJlmkpYV3SunQlngmD01JIXI+0br1Ix6RuXdNIz5QuGX3IIKG3VUyYJ/Hgd44C8W/8ETviQIoS J+IozjjPSsRfrWmkMClGnEkhfi6+NBUtxEaZxF9jGLRCVEKF3qi4Jp7it1jQbjbaGClCiick9O5L RgDHAicBZwGzgDmJKck9yJruyX26kE3AHcl9kjPIPuCh5PTUFHICeI4LdiFXgLdSUhNSyAPgs97d EpPJa+D7NN5sIkA8CydmG1JQ4uGUsE79G85fKRPBM2v57YuBDp+h9TN0/AwtQKnH/jPUDCxKKpBq JIDUJWEkisSReJJIUkgGGYpfCJhJ5pGFRBWfJZBx0mZTMXlU5fdrJqv4TWfxC9sVjONMIv7y02Qf TfAXMPbrYK/J/phxvCKPRTzk0WkNv44fS0TIo2uS1OO6i/fF9bueMM7vGKMQ3xPhCyL8qonCrW4u vmSw1MbZ//LvUbGeIqJM5ZQAGmFuS9xJbdKINCUxpD3pSnqSNDKEZHLPTSVzSDbJIavIBrKD/EKO kXPkGrlDnpDX5CO/dWiWDYRaci3LLRtxXGHZhONKy2YcV1m28ONyTm3FcbllG44rLNtxXGnZgeMq y06i8OMufraCS+/GcbllD44rLHtxXGnZh+Mqy34uvcLyCz9byaUP4Ljc8iuOKywHcVxpOYTjKsth Lr3ScoSfreLSR3FcbjmG4wrLcRxXWk7guMpykkuv+juPiF8mH0RG/FseOYWR51pOG545Y3jmrOGZ c4ZnzvN+ci0XDP9cNPxyyfDLZcMvVwyPXDU8cs3wyHXDIzcMj9yER24ZHrlteOSO4ZG7hkfuGR65 D488MDzy0PDII8Mjjw2PPDE88vS/8cgskkUWkxX/1CPPDI/kGR55bnjkheGRl4ZHXsEjrw2P/GZE zO+GZ94YnnlreOYdIua94Z8Phn8+Gn75ZPgl3/BIgfQILzTwiNUkPWJVpEesVHjEapYesTLpEasq PWK1SI9YrdIjVrv/wCP7yBFyhlzhHnlEXpL3JsVkb7WXHrE6SI9YNekRq6P0iLWQ9Ii1sPCItYj0 iLWo9Ii1mPSI1Ul6xOosPWItLjxidZEesZaQHrG6yoixlpSesbpJz1hLiYixukv/WEsb/vEw/FPG 8EtFMVKrp+GXsoZfyhl+KW/4pYL0y3/skSc2j1QyPFLZ8IiX4ZEqhkeqGh7xhkeqGR7xMTzia3ik uuER3fCIHzzib3ikhuGRAMMjgYZHahoeqQWPBBkeCTY8UtvwSB0jYuoanqmHiKlveKaB4ZkQwzMN pWfEb2sKu3EHms7vBBrpIz4e43cDd1KJ6NxfYSSatNVO80ofav3CPF07Y1AztLOgYjjvnEHN0M5z KhxyFwxqhnYRlJC7ZFAz8PsqFYgvCeLzEUVak868qmeQYWScdtnW0xVbT1dtPV2z9XTd1tMNW083 bT3d+qMn7TGnGltDOe+JQc3QnoIK57xnBvWvLLpts+iOzaK7Novu2Sy6b7Pogc2ihzaLHtksyrNZ 9Nxm0QubRS9tFvHcN/mafPkCxk1x4+vB8kp53Iv5ys0xAKuADCJ+LUr9m9niqx/amCjKG1BNbFSk jWpqo5qBYvgNPFe+VqyAK1/iqle44jWkf4Pk7yJalJf8ChEtM0nJf/QVmcvXNSvIJnKK589bnjma ycXkaapqCjDVNzUxie+dzQ57uK7vQO21Ufv+oJSjnJoD6piNOm6jTtiok6DEqlRTTglauc1xFtpO 26TO2KizoCj3XiHirJzDFcKSyYqw4lvInP9MxkURNs1S9hPKJWcpF2yaLtqoSzbqso26YqOu2qhr Nuq6jboBysLXza7Ek8+eL6lJ6ip8baDM5/0dRK/zlQNcar7CVwpKFj8/BG6W8ivnZik3bbpuGb6w KFOUqTxespXFXDJHySX2ygplBSmsrFJWkyLKWmUdKaZsULbwFT/FytiZR434FRex7iti/KLij7xh mbKM61zH5amyXdnO14o88pSZ+Etx8Xt5Ig75XUf8G+l85cvrrDJXmUtKK/OUecSD69hJyuAvvxvg L79D8Mt3VP1aHauI3QKl6J7aU3vxHIpq0Mcl6EO1NBWRb1LLqGWFhaZ4sow+omWoF/WmvtSf1qSZ dDQdQ8fRCXQK/YbOpN/S72gWXUAX05/pMrqcrqSr6Xq6mW6nu+l+eogeoyfpWXqRXqU36V2u6wl9 Sp/Tl8yLVWP1WAPWkIWyMBbBIllTFs1iWGvWnnVkXVkP1oulsnQ2kH3FhrERLJONZmPZODaBTWJT 2FQ2nc1ks9gcNpfNY1ksmy1kOSyXrWLr2Ea2hW1lO9ledoAdZsfZSXaGXWCX2XV2mz1gT9hz9pq9 ZR9YgUpVi+qgFlaLqk5qCdVN9eDj9lTLquXUCmol1UutqlZTfVVdraEGqkFqHbWB2lANVePVzmo3 Nd1hjcM6hw2aoqmavVZIK6a5aG5aGa28Vknz0qpq1TQ/LVAL1upqIVq4Fqk111pqcVpbLV7rrCVq 4lcrllArFUuOMrQMn4fKtDJRuJe9+Tz4UB9eH/yoH2E0kAYSlY6kI4mFjqKjiJV7fwyxo1/Tr4k9 HU/HEwc6mU4mGp+Nb4gjncFnsBCflW9JYT4z35EidD6dT4rSH+mPpBhdRBcRJz5TPxNnPlvLSHE+ Y8uJC5+1laQEn7nVxJXP3npSks/gZuLGZ3E7KcVncjdx57O5n5SmB+lB4kGP0qOkDJ/Zk8STz+5Z UpbP8EVSjs/yVVKez/RNXs3u0rukIn1IH5JK9DF9TCrzmX9KvGgezSNV6Av6glTlUeBFvHkkVCPV WF1Wl/iw+qw+8WUhLIRUZ41YI6Lz6AgjfjxCIog/a8KakBo8UpqSAB4t0SSQR0wMqcmjpjWpxSOn PQni0dORBPMI6kpqs+6sO6nDevIdTV3Wh/Uh9VgaSyP12QA2gDRgQ9gQEsKjaxhpyCNsBGnEoyyT hPJIG03CeLSNJeE84saRCB51E0hjHnmTSBMefVNIJI/AqaQpj8LppBmPxJkkikfjLNKcR+QcEs2j ci5pwSNzHmnJozOLfMEjNJvE8ChdSGJ5pOaQOB6tuaQVj9hVpDWP2nWkDdvANpC2InpJOx6/O0kH HsN7STyP4wPkSx7Lh0lHHs/HSSce0ydJZ3aanSZd2Hl2nnTl8X2ZJPAYv04SeZzfJt3YfXafdGeP 2WPSg+WxPJLEXrFXJJm9YW9ITx7/H0gvVsAKSArPA0p681ywkD48HxxIKs+JwqQvz4uipB/PDSeS xvOjBElXS6olSYZaWi1N+vNcKUcG8EypQIbwbKlEvuIZ40WG8qypSv6iir9oG8azx5cM5xmkkxGq v+pPRqoBagDJ5NkUREaptdXaZLRaX61PxqghaggZqzZSG5GveYbFk3E8yzqT8WqimkgmqGlqGpno sNphNZnksNZhLZnssN5hPZnCs08h3/AMVMlUnoX2ZBrPxEJkOs/GYmQGz0gXMpNnpRv5VvPQPMgs rZxWjszmGVqJzOFZ6kW+45lalczl2VqNfK/pmk7maQFaAJmvBWlBJItnb13yA8/gEJKthWlh5Eet idaELNCitCjyE8/olmQhz+o4sohndluymGd3PFnCM7wzyeFZnkh+1lJ4ri/l2f6EpNOytArVaQB9 RSfSaXQ2/Z7+QH+iS+haupFupTtRMY/QE/QMvUAv0xv0Nr3P6+UTVoW+YlWYN53IolhLFsfasnjW mSWyJJbC+rIMNogNZQvYYraUrWBreCxtZt5sB9vDfmGH2DF6hh/PsUvsKrvJ7rJH7Bl7yX5n71m+ qqiqaq860vssSi1Oy6ml1BS1JovjVEe1q9qD3XTYpJk1q6ZpRTRnzVVz1zy1CpqvVkOrpdXRGmih WmOtmdZCi9Faa+21jlpXrbvWh481DTWNoKaZUM0UVDOKamZG1WKoVyoqlQWVyopKZYdKZY9K5YCK pKEiOaIiFUJFKoyKVAQVqSgqUjFUJCdUJGdUpOKoSC6oSCVQkVxRkUqiIrmhIpVCLXJHLSqNWuSB WlQGdcYTdaYs6kw51JnyqDMVUGcqos5UQp2pjDrjhTpTBXWmKuqMN+pMNdQZH1QAX1SA6qgAOiqA HyqAPypADVSAAFSAQFSAWqgAQagAwagAtVEB6qAC1EUFqIcKUB8VoAEqQAgqQENUgEaoAKGoAGGo AOGoABGoAI1RAZqgAkSiAjRFBWiGChCFCtAcFSAaFaAFKkBLnvtlyBfI5RhkcSyyOA6Z2wqZ2xqZ 2waZ2xbZ2g7Z2h7Z2gHZGo9s/RLZ2hHZ2gnZ2hnZ2gXZ2hW5mYDcTERudkNudkdu9kBuJiE3k5Gb PZGbvZCbKcjN3sjNPsjNVORmX+RmP+Rm2me5WZ3W+Je5eZgep6fpeZ6b15GbPIaM3Kz6b+fmJlaV bWe72X52kB2lp/nxLLto5OZD9pS9YL+xd+yTalKZamfLzbI8N3shN8siN7vz3Nz4p7npr9XUamv1 tUZahNZUi/6/3Py/3Pz/ODdNJvEvUruTjiSb30XXkR3kV+xu75HneE6CfTOpyvdRfP9Gf+OxnEnf cBxN33EcRz9wnKKOIwqrpw7i2EAdwrGhOpRj6J9o+B0a3kLDe2j4CA3joWEwNHwFDX+BBr7/U4cJ CVDDbdQIGzXSRmXaqFE2arSNGgMKO2rtlaC1139weLW5QQj7xPKJwusC3yfy2qASldcHe2Lled0d f/faFE+QKpEAaCnicIRnM7+SPvqD4nEhdvtH+dkrvnu7CrlCdDjPfd4mj/QRdohiR0GwNzDxK6+L PSHeUVix473Pd6O54hmIki13juSsQ2GHQv/w5kLYJN5NlSPVuHdDjOcFh7GXPWLb998Rv34I6q6N uvcHpQ4U0v9yb4w3Nngjp+FNE3eV8pyWMvcwJ5mTjTd3JilFiJv4e15ncInbTj3TbatqV3Vsk7Fv HE0WJTvTLZezchSTyc9Bt1OZdyGquDGid1HtvVWT2ZRZSzGZs2P1L/Rqn3HcF3iMcCd18V8L0pWk k1SSQrqRDP5/ffGfXvYzZWbnou8/Rm9eN7vf4srDjnrEluwxqkR6rezM4pl6pnmvnkmXZVPFpChO NbiJE6PUfppntet1YPBE3dFmrYlxuwbCTNrKrDoprWL9nPSi4sTqZN+mS3pScp8eGal9/IrohQTT 4mSJ6ZbYO7VPop+H7i449k7FmycnpKWmp3bP8AxNTeubmtYlI5lfUVYvI9qpk+tf2+OSe3fzic3o 0ruvZ8vQhrpHCUe/QD9dr+UX5Beg+7fnp7V0P9upPnLt/4hljrqDaHdwMjdv0TLGr7JeUZ569AlN 7pvULc0zLDbcMzw2unYt/6Awn9CAwAifiODwRn4V9fJyRO5/OqLYbmkDkhO66Zmmcp972MQIzTQV Jpxvr2SaTGT5hAGRLu/vntve8q7HcD3YM1XTWv2l+tbGHqWD39t11r0ObbgYmffp+bmAH9q2fxW2 4VhQkR8uzC/f8UPPJVnv4y817D/C3eNiJ2vzC6O+39h0+PnDrdrvqH6r/Y0f5sz1W93m2Jvc1zty Cs3LdbycH3Py3jV2Zejl9wf1dn7hExN6NTg35f43J6PvZj3ZnjLFbldow9KD+j8a1d1/z/53Jaes v7K82Va9Re+MsHcThjrvsx/Qw+OrYgPs6/Zc//WKrIrtqrF5jkWL7Zh/pnnUo/eO7cIPPKj28fXd 3f49djd2/ZrOOvJ+XvMlDZxHl9GL3Puy9laPW4t6hDU89v2u/NdXXIrMGBJ0Mmvm+Oa5bYJ3JwQ3 UMSPDP+UabLjHmF6ae7S0oXMLmbn8X57l4XS1R9Xr2y5qd71L6tV2bp5FWKodHmzq+4ywrl8wNuL MRF97Z+GfBjwYa33qr2BawvrcUKgjLm53kyPzG6cHT42NCkjo2/t6tUT0lJ8e/8xT74Jqb2r9+2V LLjV+6alJvZPyEivbptGMYuYRB6VvlxEb6taeWIyZjGZzFF6U73JH+e6Mrau0cHAgQP/rINuaf9C c4buJOytaNZ0+z9UUuvfJSQVUTJpon/Tnu86LneKOvBooeOpGVPddh4uWXD6/n7H6XPnlurg2Sbn ddTArae+a1Qlzzmpd4Al4csGdcLjLs2IvDZr6ttvOi98sKnZzvGXX+5bnqc6/JablTdg8cKkDo5r jp8vubzntepnyt+ZdsTp+ta6m2ruafwzbTz++lKvLf5pTZ/PmRqlvdtdb0t6CacngYvfJnk8qHB1 wnftfN4VZMTMqZ0dkPL22/GFjtd8/GiAmtDpREbjqqXL5ejhX28ollj8qOPUpx36zZ6x0anMsT73 x58YNuWdJXJcVh+H1hHFkn6vtd3e+8H60JRJ9+o83OM7LTQ8fUe3Jp0TDw1e8824Ox0bvNy9z+fT yebHKmQFeg4dd31aNV7GnvAyduavZcxkX23wivODv1osbhr87O/L2OD/kWJRXi8rk97t8/bEbp6x yT36cK1/LWR6TT3Ar1aAf0CgKGQ19WDbqT5y1P9GITPE6T8R/28L0/SPqTW33qSbvc5FnFzQZcui iA8JLvV93zU+deDJ0wPfra70Rf/tl44UVp2LLkwpmbWrU/O48Xeat7ww+eiPXRYNdJrrvuSpY8ab Ja0HP/B6E3tq9ZCEG7/NnL3xycXGb1Pqvao4bu02+/3mJVOGjmkywL1LxNKS+4Z0nbh7T+DSD21T 9yc4zIjUR5b66vrwoS3WNe7daZD7yg1vZjnF5G0+2Tz4bvq1JtF1nZfOdgw+MvGLm/En6zyf0uOR 3vnn5u3nh26/XH7LrsLnmxWZP6/58y8WjF56Z96Seud+yrN3bZLzfnX0ojmFmu187vyK/LqqybkO +UHnxxf1YVtClRblyKyKy/8S2Gd00jJP1yCvfPcFRVYv+qMwdeYeif+zRKWfV6t8e79HlY7e631g 2rTNMyctcO1SK0D/QjQXNfN6sTBCD/v7+amh+4lT5lS1hl9gcKC3HqDXCq4RqPv41ezexScgoabu 07Vm1+4+wYn+Xf0SEvXA4KCAvymAh4s+OHRqnUtb08FavjVcXDZHzbUvo7eWBbCFzktgNi+BY8P/ owLIY5lHMg/iTnqQTw0/H39+A0YJbP9ZCYzWeRH8rATW//dK4D/RnfFn9W5xTuy063VM+V2+VNs/ 7v5cu/Dm4ujT5ItCRU4uPFnC6/6kGkHeF0J/oRP7P64x/fXPt3p8Ui4vKh0dGv5lqcjbN1q4PB/2 zfNxRQ9lLl/4YfHPnX6b3fnXr/btHPp98tMymbtfHJ0yqFnX3847up+PLXZuVkxe4PaSU7JDZvxo v8jHZd6eiAzr48uvLyyKrBlXrGgruvYrlw+N8z8kfdwVHn+rQbHBNRbkZe6/FlLS8qz4fvvv27GG P5+YnTUyi3b42PS2my/Lbdm4+qT3gy94eL5lH6r0cnV+n2be6LBkbuKTol+2CI+cXMXN58OJDXax nQJm3nDZt/lReuCDNnk3H7vsdT2grq1zvMvoWxvCxs/8aayeybbxerdQ1jv7LjUquWG15vf3Za4T qoe93fRK42e8rJZoKulCueP9Suol/oZpZ5sXPx/dW9aFCn+tCzGpqbw48IlK7p6c0CWjm2fD/hlJ qWnJGYNRzHQ9qIafv79fcA2xKvM3Tv3F6f/LOvvfVbA1ae3iS+qJO0vP7ezp2ei7AbEp9UudSz1y +MWjXvmzXYrcuF47Y5TbxurZ/k8Kru1pFF3+bBq5HNjGfvyhFZ6Rr58n5TZvNnnR9sHN+n3f2HLp U8Xr8/uPO740PWz4+ZGXX21/WXPhwfjwKyuX17vhlTTbbcmitPTWL0rMvPMpcGZa9rkBnTwGho8a E+RyIr0D29IjZvKiNcnVL5V0yJ+eUeXWgOpxV531dm9PTe766fDBThF+LTdXdroToh9Pq1LEq9yB WtH1sv3rTT36Y5A6Jj66daZXVea/sdn5Fgn3T/l0fRFe736ulfwe8WPWyQ6TKsU+GLK06cuI47Xq BmWtGxi/qETW5MNFv2ldd3euXSd6+o8K1pF7pL1eWFQGJ5OpwMx0yg+fVa8/rSSiWJUubDbzCByr F1PtjK1JcZOZQTFf/tp4itDy6aRf9OlKE769OadznRy/1MV1t13w0UvahJwVs+ZhT2JJf76dCSUN /6aWFcrN7BzSuvLsuxWdPla9aR/7bbs7C/WWspZF6o318OzQ7IZjG/z7tczWnMZDW5QgVLG4z6pY E50X5c+qWNB/spATCRMqtf5j/VJMpF1w/eGVIlY+Tg1Z7b++5+NC1fvkRL553Kn/06g6PudDlzvk H37o4/dT+SNDW84ZUfbL3HrVo7YsyGk973bfrZvWvR28PjLtTf1HDYcfuqmVSD68aJ6nz3uHlvta H/W53fTUtv+qzszDoXzXOP7O2I2mYZBk7IdssyH5RQrZm0YmKkshxr6lYSzFFG227JFlRkrZmTI1 5CiOJdnTOmgiawhZK7+pczo5v9NZ/jlX1/nvve/neq73vZ7ne3/eewkYLdpE4yq0HWJcsrSbSzO8 9mF+ZvptrIyWHsM2a9ZGIUb1OkUqhZ3Kh5hj45bjqG1j8MIruJZtPYlBaaqBvtmSy1KzNv3Edvl1 B8QTWlydchXZ1daYZv1kZbzgsC0rG7zPGHVs4WVZHwXr9+l6Gnx40nP0Fk39QYsaDOqWcPXVR9qq iJKA287UD2EyFszuN7ZjXaHpEg6t2uLHWCkI8wSNB6VaxlLTMDFJwJGlbS/XkdksMB0DjTvgC4Xj 9CNUzK4Fdc/7tDVMBRTYJdtFpsbnbzPjOrrUWUAUDC7c8V4DtaXlXZCOyIJ/pR6RsnKwKl5T3E0a eokFGzix4N9h0te7ZZzcyE3vXVMflLmUWyK4BlfeUzq88ubWGRMm33FTt+N7cBWGU7j31STyc0Et AV+pKIwMG0pgjVDXRkxhpScy1/HiyIh6HrkwdtpeZc9HKYlprfHPs+XKNjlcm6WVxXqcFfLSYJK8 AUR66Zx4+KL4WcV7Fzq9ikwxqKzXbwP1nwGnXUy7Oy60MiRWoUHxDQX65eA9Xuue2elsWBGMroPn 73+kj6bw8nH4PfOd3+IeWt/4LfUr+I3W4eQWHGJra6J1v/Ib883URH81f125/5/onUf1qRx8ZZas GuGN3Pqmjv226aq1Ar60gyWBU9w83X2z26o0GC0rPMn3lJAmZp66zTC5LNMBrfQS8B4Lr5u6yLd5 CcqdOXuxXeaxpuL5nLkFopT6p/DRC4iJUVwBtUHBpi1+dV+nQJdTeVeFITdt5YZPCvHZ9tcmNhWx XSPbTZDKJbEHDh0UGuZSX/NKSkL7nZ8/gs5ZPd2fUT0ml3F6uQc+z19j43uQvi8pzwywMHUXVlZx L8oY7uWNtqCtnLspbCoqQMk79/5Q6BdQFgLPHwPA0CbvawYUTJiNGoS8cunQvZiQ9uzBXWdTqM7g O4hNlZ+WsqtAHfKWhPUVnkcPZSHf6V3MOZGb/47ePy2E/4HesI305ngAdHTmX+EbnYSOjv85fqmu 153/5/KkwMil4lSL/MJSq5OHF/jgSLf/G+r/V6U756xhGZceOXAZ72CN00tDXnWQrfeDKpHBgfa+ QvDijgfhiQxknwgtzteFYQd+jJOF46+ywvaw7Zjlh7Ok3iBAsSXM0LnLXVO7QNPsB4mCPC3xZuxZ GzHWgeLk4dF4r6dRDe9S53hRMVzjV1QV5QPWFj8Nh15FblriYwfUSuByErwFg9IYVN1rRI0ma+iE i4OBeOZlWQM2nyR2pR1jQcLoqwVBWiYC9NdjBOGDDwWdE2afMbZM4i6fadJWcyqon6yNhBiG99kE yU2j25ihbg72oC2CotCel6KZH/XuuR+u1kCNrsTEtlvbjuUEpPqU6Fr1LZLrb0uEuajM0LJVtHhD JF1a9aV9ZSizkGZ1ZqdR9cjKVOSdt9eLgrUZuKZABRElEkTvYFzgURMj0drq6or9xJY8w/UoslxU rhjafcxQxEmyJVderstoXG2cuWDWrt73HBtlpaRqpnjs6ITtzI2Bqzltv/nXRSsH8wpPk+TqsykN yoS7lV76F6kkZ7ofFX6j/rbprIj/50tYn6ovg9YtcQqt7nU5iPMiJ8D6GuVHEhnDciN3Ktpc6aEE nr69SHxJakVhaHF1fvopyRfJ5+Gn5FHYIn6/fPu4P9Xnz5xrk+uflD7QmjVtPrQEcvO/CIls8Wx5 5zdxM6MDo7IObbJ3eL5/G/X5KirXAHlI3LsVXvAZQ+HmhDD3TTAIhOaE26/Ll3/eNvnRRM6Pbvya rv1NvwJcGKGNHWrOB/ywIBgoeuOq2Ndk8PtGbgwHSnwJGPUmPZhBxdy5rqHJmQ9VW588RZ/YsEUI Y4sm5KtGbQf2A56AKxAE+H9rcrsDwYAsQADIQADHInL8zpwnD4BMVYpS/JfBSiAH+BODnAM8yKg/ /FS4KSDgvHO531piDSpiBrE72JC5+aMevEtJi7F/pSE6+8rEX6I6t5rzo++E0M0tUHhd+6FlLogH 6waPkGXUDjzqdnc9yfX04+TXvdmERquKCte8Use46aptu1qbey3N89fwvenRgoPW5TucwMj7AKS3 WCVd5p7SIY/jHWq1Pel2gQbx9zEBHWpxzdJ/xoC9US9HpIf20XaGFdGzpiDXxAdSy4CKA90tjXoX JksMgrUdP9+ydtUzIl5HyG8ef1KfKLjWfPqhZeRBLKGpDu0hS6l0yBIz9ZJ1yYdoJ2YgHdtrj0JN T/aQLCnlwiVBpzTNlCGU7g/9uk5qFYtKegU+siGfawZs8VQKeDuaAlb8cUe8GApYjOMS/qbKhF+W Bfx8IrFBk45oiY2ShPyYrIA4L//7Cg9m87fpARajhcVq7sTqHP0nRS5WiRoGcT1VzhjY6xkDRFRq jw79cfbxVStUk1zli/PPMtWsiJOCpAX+zjdm/fgQTYgsi/4l7fgp3fXlEePWl3r+jJ3Mc6sJdJrr HoJN98KzhEYTtTbGgImiwLJSlMpAzW32IEAUDZwirtBx3Ebim1jqGT5+QkeY92PCdV4cd8Tn1Eo8 /Wj8uWlBDVlMLkxJvmA5iNXY8uLM4xrS7jTbHprn3VMRInnb6/QVQfeWeuWHeGaSDOjJXjYgIXzY AtZVtu63DNJyX/0JeSPCbl3L3OmypfiTs3e7HHZ2nTwbmYbcl9ddO4QgvlNg6ZwZHMuYz3Oy6NmR NZLk/woMzkEq9BF9hagkZazKIqOtv74SJlP5wRbVPKb97tgn4Hc86Lf4DQplbmRzdHJlYW0NCmVu ZG9iag0KNTE2IDAgb2JqDQpbIDBbIDc1MF0gIDEzNVsgMzUwXSAgMTc3WyA1NTZdIF0gDQplbmRv YmoNCjUxNyAwIG9iag0KPDwvVHlwZS9YUmVmL1NpemUgNTE3L1dbIDEgNCAyXSAvUm9vdCAxIDAg Ui9JbmZvIDE2NSAwIFIvSURbPDYyMjJBQTlDQjNGMzEzNDA5RkI4QTVEQUE5QUM3MEE4Pjw2MjIy QUE5Q0IzRjMxMzQwOUZCOEE1REFBOUFDNzBBOD5dIC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3Ro IDEyMjA+Pg0Kc3RyZWFtDQp4nC3We3xPdRzH8d/n/MaE5FLmssgy1sxGKbnbFpPbogtCLrvE3Cli YS6bS6OZ3OaWS6NQLskt5LJM9yblEiLKaBbKPeu39+v4w/Nx9rudcz7fc17H4/H9Kyoy3/8VPJ5i JkC+sKvCOx42C7+eokQHSBH+bUTpWFFmsqjYS1RiKyhD1D4ugoeJOrdF/XgRPlu0rCoieUtUKRHN LrWfITosEd3Wip5BsEP0Zq8T8kQinxvlFaObw1ExNkZMHQP3RGo12CXSSsANMb2RmHlCzI6CkyLD RGaimMs5W3lMrLovsuPEmkliJ+dlF8ewhwHsjRB5zcSRHuL8CnHhkLgYJvJbiJsh4lZncWebuKtj tzI6E1b2nCifJCosFgHjRBWotl8EBopal0RQgaizXNTVXlvoKRGm82nhA0TENNGKb4n0E201cItZ LTry1R2zYLvo1BU0Tes8R3TZK/qEir78Qlw50IwsKUAMmSiGar3YMJ0sG1EkRmplWfIyMdEfskVK upi8RUxZKFL3iTRI14htVo7ITBbzzov5U8TCFnBaZJUUS4aLpVqmtn632HBBbNQlY5sGiYNLRQ6/ kKu522FdQHaC107y2ul64gwfv8bEri8oxvFq0o7fHeGv68gppQXtVNYZdAK2ihr6WaemxuHUXiSC dcU5IVdEaLiI0FScBjpap3GuaLJORCWI6FmizU0RU0V06y56NBX9qov+DUW8LnsnoVAMZM+SWotB vkNxfDed9dYROkFn4XkA3LfE+j4w+Ky75fEDLxg4UAr8oQSUhMehNN/5AlsPQlkoA0FQEcpBBSgP D0EAVILK8Ag8DIFQBapDNagKteBReAxqQg3oC7XZ+S5shcITEAx1oC6EQD0Ih/oQBo0gAp6CJ6EB NISm8DQ0gWfhGWgMraEZtIKW0BxaQFuIhDbwHERBNLBQPDHQAdpDO3geugJLyuOeLHfg7gKLhRfh JXgZXoFu0B1egx7QG3rBq9AT+kA29GNi7i7FQxz0hw9gNQyEREiAAfA6DIOhMAiSYAgMhjdgBAyH UTASxsPbMBrehGQYA2/BWBgHk2EiTIBJkALTYRpMhSmQBqkwG2bCDJgF70A6rIK5kAHvQibMgYUw D96DBTAflkIWLIIlsBhWwnJYBivgffgH1jBwd2V9BB/CWvgE1sHHsAHWw1bYCJ/CFtgEm+Ez2AHb YRvshN3wOeyC/bAH9sEXsBdy4QAcgi/hIOTAd3AYvoVv4Cv4Gn6C7+EI5MEP8COcgKNwHI7Bz/AL /AYn4Qychl/hFPwBZ+ECnIdz8Dv8CRchHy7BZfgLrkEBXIW/4QoUwnWWhnvz/5ct995zC27CDV6j D+a24z+4A7fhHtzlnW4Gi+A+fySR5saUNhoVNSpqJNIIphFFI8JGU41EmptPSmkk0qihUUqjlEYp jUQaNTRKaZTSKKXRB6ONxl3Y6J/RP6OiRiKNkhgJMYpnVNTIp1FDI+VG+83NJ+Ez2miU0kikEVMj rUYGjW4a3TRqaATTSKQRPiOmRkWNKBrBNMJndNPoppFII61G1Yx8GiEy+mfU0CilET6jeEb/jHwa +TRKaW19k5/Ko1hau2K8l7uIAj08e6/ouc5beKAYvwzfk/j/D6wcVQ0KZW5kc3RyZWFtDQplbmRv YmoNCnhyZWYNCjAgNTE4DQowMDAwMDAwMTY2IDY1NTM1IGYNCjAwMDAwMDAwMTcgMDAwMDAgbg0K MDAwMDAwMDEyNiAwMDAwMCBuDQowMDAwMDAwMjMzIDAwMDAwIG4NCjAwMDAwMDA0OTcgMDAwMDAg bg0KMDAwMDAwMDg5MyAwMDAwMCBuDQowMDAwMDAwOTQ2IDAwMDAwIG4NCjAwMDAwMDExMTUgMDAw MDAgbg0KMDAwMDAwMTM1NSAwMDAwMCBuDQowMDAwMDAxNDA4IDAwMDAwIG4NCjAwMDAwMDE4NjEg MDAwMDAgbg0KMDAwMDAwMjYzOSAwMDAwMCBuDQowMDAwMDAyOTQ2IDAwMDAwIG4NCjAwMDAwMDQ3 MDAgMDAwMDAgbg0KMDAwMDAwNDk5NCAwMDAwMCBuDQowMDAwMDA4ODQ4IDAwMDAwIG4NCjAwMDAw MDk0MzMgMDAwMDAgbg0KMDAwMDAwOTU4MyAwMDAwMCBuDQowMDAwMDA5OTc3IDAwMDAwIG4NCjAw MDAwMTE2MjAgMDAwMDAgbg0KMDAwMDAxMTkxOCAwMDAwMCBuDQowMDAwMDE1ODk3IDAwMDAwIG4N CjAwMDAwMTY3NTEgMDAwMDAgbg0KMDAwMDAxNjkwNCAwMDAwMCBuDQowMDAwMDE3Mzg1IDAwMDAw IG4NCjAwMDAwMTkwODEgMDAwMDAgbg0KMDAwMDAxOTM1NiAwMDAwMCBuDQowMDAwMDIyNDQwIDAw MDAwIG4NCjAwMDAwMjMzMzAgMDAwMDAgbg0KMDAwMDAyMzQ4MSAwMDAwMCBuDQowMDAwMDI0MDQ5 IDAwMDAwIG4NCjAwMDAwMjYwNjYgMDAwMDAgbg0KMDAwMDAyNjM0NSAwMDAwMCBuDQowMDAwMDI5 NDQzIDAwMDAwIG4NCjAwMDAwMzAyNjggMDAwMDAgbg0KMDAwMDAzMDQyMSAwMDAwMCBuDQowMDAw MDMxMDQ3IDAwMDAwIG4NCjAwMDAwMzM5MTEgMDAwMDAgbg0KMDAwMDAzNDA0NCAwMDAwMCBuDQow MDAwMDM0MDc0IDAwMDAwIG4NCjAwMDAwMzQyMzUgMDAwMDAgbg0KMDAwMDAzNDMwOSAwMDAwMCBu DQowMDAwMDM0NTUwIDAwMDAwIG4NCjAwMDAwMzQ4NjggMDAwMDAgbg0KMDAwMDAzNTU0NiAwMDAw MCBuDQowMDAwMDM2NDE4IDAwMDAwIG4NCjAwMDAwMzY1NzEgMDAwMDAgbg0KMDAwMDAzNjg2NSAw MDAwMCBuDQowMDAwMDM3NDc4IDAwMDAwIG4NCjAwMDAwMzc3NTcgMDAwMDAgbg0KMDAwMDA0MTY4 OCAwMDAwMCBuDQowMDAwMDQxOTgyIDAwMDAwIG4NCjAwMDAwNDI1OTUgMDAwMDAgbg0KMDAwMDA0 Mjg4MSAwMDAwMCBuDQowMDAwMDQ3NzQ2IDAwMDAwIG4NCjAwMDAwNDgwNDAgMDAwMDAgbg0KMDAw MDA0ODY1NyAwMDAwMCBuDQowMDAwMDQ4OTQzIDAwMDAwIG4NCjAwMDAwNTM4MTkgMDAwMDAgbg0K MDAwMDA1NDEwNSAwMDAwMCBuDQowMDAwMDU4NTI5IDAwMDAwIG4NCjAwMDAwNTg4MjMgMDAwMDAg bg0KMDAwMDA1OTQzNiAwMDAwMCBuDQowMDAwMDU5NzA5IDAwMDAwIG4NCjAwMDAwNjMyNzIgMDAw MDAgbg0KMDAwMDA2MzU2NiAwMDAwMCBuDQowMDAwMDY0MTgzIDAwMDAwIG4NCjAwMDAwNjQ0NjYg MDAwMDAgbg0KMDAwMDA2ODU5MyAwMDAwMCBuDQowMDAwMDY4ODM0IDAwMDAwIG4NCjAwMDAwNjk3 MzggMDAwMDAgbg0KMDAwMDA3MDA0MyAwMDAwMCBuDQowMDAwMDcxNTQ2IDAwMDAwIG4NCjAwMDAw NzE4MDIgMDAwMDAgbg0KMDAwMDA3MjM4NiAwMDAwMCBuDQowMDAwMDcyNzMyIDAwMDAwIG4NCjAw MDAwNzQyMTggMDAwMDAgbg0KMDAwMDA3NDQ3NyAwMDAwMCBuDQowMDAwMDc1NDIzIDAwMDAwIG4N CjAwMDAwNzU2NDkgMDAwMDAgbg0KMDAwMDA3NjUwOSAwMDAwMCBuDQowMDAwMDc2ODAzIDAwMDAw IG4NCjAwMDAwNzc0MTYgMDAwMDAgbg0KMDAwMDA3NzcwMyAwMDAwMCBuDQowMDAwMDgxODU4IDAw MDAwIG4NCjAwMDAwODIxODAgMDAwMDAgbg0KMDAwMDA4MzYwMCAwMDAwMCBuDQowMDAwMDgzODc2 IDAwMDAwIG4NCjAwMDAwODUwMjAgMDAwMDAgbg0KMDAwMDA4NTE0NiAwMDAwMCBuDQowMDAwMDg1 MTc2IDAwMDAwIG4NCjAwMDAwODUzMzAgMDAwMDAgbg0KMDAwMDA4NTQwNCAwMDAwMCBuDQowMDAw MDg1NjQ5IDAwMDAwIG4NCjAwMDAwODY0NjMgMDAwMDAgbg0KMDAwMDA4OTg5OCAwMDAwMCBuDQow MDAwMDkwMjE2IDAwMDAwIG4NCjAwMDAwOTA4OTQgMDAwMDAgbg0KMDAwMDA5MTEzMiAwMDAwMCBu DQowMDAwMDkyNjk1IDAwMDAwIG4NCjAwMDAwOTM1NjcgMDAwMDAgbg0KMDAwMDA5MzcyMSAwMDAw MCBuDQowMDAwMDk0MDQxIDAwMDAwIG4NCjAwMDAwOTQ3MTkgMDAwMDAgbg0KMDAwMDA5NDk2OSAw MDAwMCBuDQowMDAwMDk3MTgyIDAwMDAwIG4NCjAwMDAwOTgwNTUgMDAwMDAgbg0KMDAwMDA5ODIx NCAwMDAwMCBuDQowMDAwMDk4NDQ0IDAwMDAwIG4NCjAwMDAwOTg5OTUgMDAwMDAgbg0KMDAwMDA5 OTIyNCAwMDAwMCBuDQowMDAwMDk5Nzc3IDAwMDAwIG4NCjAwMDAxMDAwMzMgMDAwMDAgbg0KMDAw MDEwMTU5NCAwMDAwMCBuDQowMDAwMTAxODI5IDAwMDAwIG4NCjAwMDAxMDMwMzUgMDAwMDAgbg0K MDAwMDEwMzkwOCAwMDAwMCBuDQowMDAwMTA0MDY3IDAwMDAwIG4NCjAwMDAxMDQ1MDkgMDAwMDAg bg0KMDAwMDEwNDY3MCAwMDAwMCBuDQowMDAwMTA0OTY2IDAwMDAwIG4NCjAwMDAxMDU1ODQgMDAw MDAgbg0KMDAwMDEwNTg2NSAwMDAwMCBuDQowMDAwMTA5NzU3IDAwMDAwIG4NCjAwMDAxMTAwNTMg MDAwMDAgbg0KMDAwMDExMDY2NyAwMDAwMCBuDQowMDAwMTEwOTU1IDAwMDAwIG4NCjAwMDAxMTU4 NjkgMDAwMDAgbg0KMDAwMDExNjE2NSAwMDAwMCBuDQowMDAwMTE2NzgzIDAwMDAwIG4NCjAwMDAx MTcwNzEgMDAwMDAgbg0KMDAwMDEyMTUwMSAwMDAwMCBuDQowMDAwMTIxNzk3IDAwMDAwIG4NCjAw MDAxMjI0MTEgMDAwMDAgbg0KMDAwMDEyMjY5OSAwMDAwMCBuDQowMDAwMTI3NjEwIDAwMDAwIG4N CjAwMDAxMjc4OTUgMDAwMDAgbg0KMDAwMDEzMjA1MCAwMDAwMCBuDQowMDAwMTMyMzQ2IDAwMDAw IG4NCjAwMDAxMzI5NjQgMDAwMDAgbg0KMDAwMDEzMzIzOSAwMDAwMCBuDQowMDAwMTM2NzQ2IDAw MDAwIG4NCjAwMDAxMzcxNDEgMDAwMDAgbg0KMDAwMDEzODg1OSAwMDAwMCBuDQowMDAwMTM5MTcy IDAwMDAwIG4NCjAwMDAxNDA0NDEgMDAwMDAgbg0KMDAwMDE0MDY4NiAwMDAwMCBuDQowMDAwMTQx NTUwIDAwMDAwIG4NCjAwMDAxNDE4NzAgMDAwMDAgbg0KMDAwMDE0MzE4NiAwMDAwMCBuDQowMDAw MTQzNTg4IDAwMDAwIG4NCjAwMDAxNDUzNTIgMDAwMDAgbg0KMDAwMDE0NTgzNSAwMDAwMCBuDQow MDAwMTQ4MDY5IDAwMDAwIG4NCjAwMDAxNDgzNjUgMDAwMDAgbg0KMDAwMDE0ODk4MyAwMDAwMCBu DQowMDAwMTQ5MjcyIDAwMDAwIG4NCjAwMDAxNTM0MzIgMDAwMDAgbg0KMDAwMDE1MzkxNCAwMDAw MCBuDQowMDAwMTU1OTMxIDAwMDAwIG4NCjAwMDAxNTYyMDkgMDAwMDAgbg0KMDAwMDE1Njg4OSAw MDAwMCBuDQowMDAwMTU3MTY3IDAwMDAwIG4NCjAwMDAxNTc5OTQgMDAwMDAgbg0KMDAwMDE1ODI3 MiAwMDAwMCBuDQowMDAwMTU4NjE1IDAwMDAwIG4NCjAwMDAwMDAxNjcgNjU1MzUgZg0KMDAwMDAw MDE2OCA2NTUzNSBmDQowMDAwMDAwMTY5IDY1NTM1IGYNCjAwMDAwMDAxNzAgNjU1MzUgZg0KMDAw MDAwMDE3MSA2NTUzNSBmDQowMDAwMDAwMTcyIDY1NTM1IGYNCjAwMDAwMDAxNzMgNjU1MzUgZg0K MDAwMDAwMDE3NCA2NTUzNSBmDQowMDAwMDAwMTc1IDY1NTM1IGYNCjAwMDAwMDAxNzYgNjU1MzUg Zg0KMDAwMDAwMDE3NyA2NTUzNSBmDQowMDAwMDAwMTc4IDY1NTM1IGYNCjAwMDAwMDAxNzkgNjU1 MzUgZg0KMDAwMDAwMDE4MCA2NTUzNSBmDQowMDAwMDAwMTgxIDY1NTM1IGYNCjAwMDAwMDAxODIg NjU1MzUgZg0KMDAwMDAwMDE4MyA2NTUzNSBmDQowMDAwMDAwMTg0IDY1NTM1IGYNCjAwMDAwMDAx ODUgNjU1MzUgZg0KMDAwMDAwMDE4NiA2NTUzNSBmDQowMDAwMDAwMTg3IDY1NTM1IGYNCjAwMDAw MDAxODggNjU1MzUgZg0KMDAwMDAwMDE4OSA2NTUzNSBmDQowMDAwMDAwMTkwIDY1NTM1IGYNCjAw MDAwMDAxOTEgNjU1MzUgZg0KMDAwMDAwMDE5MiA2NTUzNSBmDQowMDAwMDAwMTkzIDY1NTM1IGYN CjAwMDAwMDAxOTQgNjU1MzUgZg0KMDAwMDAwMDE5NSA2NTUzNSBmDQowMDAwMDAwMTk2IDY1NTM1 IGYNCjAwMDAwMDAxOTcgNjU1MzUgZg0KMDAwMDAwMDE5OCA2NTUzNSBmDQowMDAwMDAwMTk5IDY1 NTM1IGYNCjAwMDAwMDAyMDAgNjU1MzUgZg0KMDAwMDAwMDIwMSA2NTUzNSBmDQowMDAwMDAwMjAy IDY1NTM1IGYNCjAwMDAwMDAyMDMgNjU1MzUgZg0KMDAwMDAwMDIwNCA2NTUzNSBmDQowMDAwMDAw MjA1IDY1NTM1IGYNCjAwMDAwMDAyMDYgNjU1MzUgZg0KMDAwMDAwMDIwNyA2NTUzNSBmDQowMDAw MDAwMjA4IDY1NTM1IGYNCjAwMDAwMDAyMDkgNjU1MzUgZg0KMDAwMDAwMDIxMCA2NTUzNSBmDQow MDAwMDAwMjExIDY1NTM1IGYNCjAwMDAwMDAyMTIgNjU1MzUgZg0KMDAwMDAwMDIxMyA2NTUzNSBm DQowMDAwMDAwMjE0IDY1NTM1IGYNCjAwMDAwMDAyMTUgNjU1MzUgZg0KMDAwMDAwMDIxNiA2NTUz NSBmDQowMDAwMDAwMjE3IDY1NTM1IGYNCjAwMDAwMDAyMTggNjU1MzUgZg0KMDAwMDAwMDIxOSA2 NTUzNSBmDQowMDAwMDAwMjIwIDY1NTM1IGYNCjAwMDAwMDAyMjEgNjU1MzUgZg0KMDAwMDAwMDIy MiA2NTUzNSBmDQowMDAwMDAwMjIzIDY1NTM1IGYNCjAwMDAwMDAyMjQgNjU1MzUgZg0KMDAwMDAw MDIyNSA2NTUzNSBmDQowMDAwMDAwMjI2IDY1NTM1IGYNCjAwMDAwMDAyMjcgNjU1MzUgZg0KMDAw MDAwMDIyOCA2NTUzNSBmDQowMDAwMDAwMjI5IDY1NTM1IGYNCjAwMDAwMDAyMzAgNjU1MzUgZg0K MDAwMDAwMDIzMSA2NTUzNSBmDQowMDAwMDAwMjMyIDY1NTM1IGYNCjAwMDAwMDAyMzMgNjU1MzUg Zg0KMDAwMDAwMDIzNCA2NTUzNSBmDQowMDAwMDAwMjM1IDY1NTM1IGYNCjAwMDAwMDAyMzYgNjU1 MzUgZg0KMDAwMDAwMDIzNyA2NTUzNSBmDQowMDAwMDAwMjM4IDY1NTM1IGYNCjAwMDAwMDAyMzkg NjU1MzUgZg0KMDAwMDAwMDI0MCA2NTUzNSBmDQowMDAwMDAwMjQxIDY1NTM1IGYNCjAwMDAwMDAy NDIgNjU1MzUgZg0KMDAwMDAwMDI0MyA2NTUzNSBmDQowMDAwMDAwMjQ0IDY1NTM1IGYNCjAwMDAw MDAyNDUgNjU1MzUgZg0KMDAwMDAwMDI0NiA2NTUzNSBmDQowMDAwMDAwMjQ3IDY1NTM1IGYNCjAw MDAwMDAyNDggNjU1MzUgZg0KMDAwMDAwMDI0OSA2NTUzNSBmDQowMDAwMDAwMjUwIDY1NTM1IGYN CjAwMDAwMDAyNTEgNjU1MzUgZg0KMDAwMDAwMDI1MiA2NTUzNSBmDQowMDAwMDAwMjUzIDY1NTM1 IGYNCjAwMDAwMDAyNTQgNjU1MzUgZg0KMDAwMDAwMDI1NSA2NTUzNSBmDQowMDAwMDAwMjU2IDY1 NTM1IGYNCjAwMDAwMDAyNTcgNjU1MzUgZg0KMDAwMDAwMDI1OCA2NTUzNSBmDQowMDAwMDAwMjU5 IDY1NTM1IGYNCjAwMDAwMDAyNjAgNjU1MzUgZg0KMDAwMDAwMDI2MSA2NTUzNSBmDQowMDAwMDAw MjYyIDY1NTM1IGYNCjAwMDAwMDAyNjMgNjU1MzUgZg0KMDAwMDAwMDI2NCA2NTUzNSBmDQowMDAw MDAwMjY1IDY1NTM1IGYNCjAwMDAwMDAyNjYgNjU1MzUgZg0KMDAwMDAwMDI2NyA2NTUzNSBmDQow MDAwMDAwMjY4IDY1NTM1IGYNCjAwMDAwMDAyNjkgNjU1MzUgZg0KMDAwMDAwMDI3MCA2NTUzNSBm DQowMDAwMDAwMjcxIDY1NTM1IGYNCjAwMDAwMDAyNzIgNjU1MzUgZg0KMDAwMDAwMDI3MyA2NTUz NSBmDQowMDAwMDAwMjc0IDY1NTM1IGYNCjAwMDAwMDAyNzUgNjU1MzUgZg0KMDAwMDAwMDI3NiA2 NTUzNSBmDQowMDAwMDAwMjc3IDY1NTM1IGYNCjAwMDAwMDAyNzggNjU1MzUgZg0KMDAwMDAwMDI3 OSA2NTUzNSBmDQowMDAwMDAwMjgwIDY1NTM1IGYNCjAwMDAwMDAyODEgNjU1MzUgZg0KMDAwMDAw MDI4MiA2NTUzNSBmDQowMDAwMDAwMjgzIDY1NTM1IGYNCjAwMDAwMDAyODQgNjU1MzUgZg0KMDAw MDAwMDI4NSA2NTUzNSBmDQowMDAwMDAwMjg2IDY1NTM1IGYNCjAwMDAwMDAyODcgNjU1MzUgZg0K MDAwMDAwMDI4OCA2NTUzNSBmDQowMDAwMDAwMjg5IDY1NTM1IGYNCjAwMDAwMDAyOTAgNjU1MzUg Zg0KMDAwMDAwMDI5MSA2NTUzNSBmDQowMDAwMDAwMjkyIDY1NTM1IGYNCjAwMDAwMDAyOTMgNjU1 MzUgZg0KMDAwMDAwMDI5NCA2NTUzNSBmDQowMDAwMDAwMjk1IDY1NTM1IGYNCjAwMDAwMDAyOTYg NjU1MzUgZg0KMDAwMDAwMDI5NyA2NTUzNSBmDQowMDAwMDAwMjk4IDY1NTM1IGYNCjAwMDAwMDAy OTkgNjU1MzUgZg0KMDAwMDAwMDMwMCA2NTUzNSBmDQowMDAwMDAwMzAxIDY1NTM1IGYNCjAwMDAw MDAzMDIgNjU1MzUgZg0KMDAwMDAwMDMwMyA2NTUzNSBmDQowMDAwMDAwMzA0IDY1NTM1IGYNCjAw MDAwMDAzMDUgNjU1MzUgZg0KMDAwMDAwMDMwNiA2NTUzNSBmDQowMDAwMDAwMzA3IDY1NTM1IGYN CjAwMDAwMDAzMDggNjU1MzUgZg0KMDAwMDAwMDMwOSA2NTUzNSBmDQowMDAwMDAwMzEwIDY1NTM1 IGYNCjAwMDAwMDAzMTEgNjU1MzUgZg0KMDAwMDAwMDMxMiA2NTUzNSBmDQowMDAwMDAwMzEzIDY1 NTM1IGYNCjAwMDAwMDAzMTQgNjU1MzUgZg0KMDAwMDAwMDMxNSA2NTUzNSBmDQowMDAwMDAwMzE2 IDY1NTM1IGYNCjAwMDAwMDAzMTcgNjU1MzUgZg0KMDAwMDAwMDMxOCA2NTUzNSBmDQowMDAwMDAw MzE5IDY1NTM1IGYNCjAwMDAwMDAzMjAgNjU1MzUgZg0KMDAwMDAwMDMyMSA2NTUzNSBmDQowMDAw MDAwMzIyIDY1NTM1IGYNCjAwMDAwMDAzMjMgNjU1MzUgZg0KMDAwMDAwMDMyNCA2NTUzNSBmDQow MDAwMDAwMzI1IDY1NTM1IGYNCjAwMDAwMDAzMjYgNjU1MzUgZg0KMDAwMDAwMDMyNyA2NTUzNSBm DQowMDAwMDAwMzI4IDY1NTM1IGYNCjAwMDAwMDAzMjkgNjU1MzUgZg0KMDAwMDAwMDMzMCA2NTUz NSBmDQowMDAwMDAwMzMxIDY1NTM1IGYNCjAwMDAwMDAzMzIgNjU1MzUgZg0KMDAwMDAwMDMzMyA2 NTUzNSBmDQowMDAwMDAwMzM0IDY1NTM1IGYNCjAwMDAwMDAzMzUgNjU1MzUgZg0KMDAwMDAwMDMz NiA2NTUzNSBmDQowMDAwMDAwMzM3IDY1NTM1IGYNCjAwMDAwMDAzMzggNjU1MzUgZg0KMDAwMDAw MDMzOSA2NTUzNSBmDQowMDAwMDAwMzQwIDY1NTM1IGYNCjAwMDAwMDAzNDEgNjU1MzUgZg0KMDAw MDAwMDM0MiA2NTUzNSBmDQowMDAwMDAwMzQzIDY1NTM1IGYNCjAwMDAwMDAzNDQgNjU1MzUgZg0K MDAwMDAwMDM0NSA2NTUzNSBmDQowMDAwMDAwMzQ2IDY1NTM1IGYNCjAwMDAwMDAzNDcgNjU1MzUg Zg0KMDAwMDAwMDM0OCA2NTUzNSBmDQowMDAwMDAwMzQ5IDY1NTM1IGYNCjAwMDAwMDAzNTAgNjU1 MzUgZg0KMDAwMDAwMDM1MSA2NTUzNSBmDQowMDAwMDAwMzUyIDY1NTM1IGYNCjAwMDAwMDAzNTMg NjU1MzUgZg0KMDAwMDAwMDM1NCA2NTUzNSBmDQowMDAwMDAwMzU1IDY1NTM1IGYNCjAwMDAwMDAz NTYgNjU1MzUgZg0KMDAwMDAwMDM1NyA2NTUzNSBmDQowMDAwMDAwMzU4IDY1NTM1IGYNCjAwMDAw MDAzNTkgNjU1MzUgZg0KMDAwMDAwMDM2MCA2NTUzNSBmDQowMDAwMDAwMzYxIDY1NTM1IGYNCjAw MDAwMDAzNjIgNjU1MzUgZg0KMDAwMDAwMDM2MyA2NTUzNSBmDQowMDAwMDAwMzY0IDY1NTM1IGYN CjAwMDAwMDAzNjUgNjU1MzUgZg0KMDAwMDAwMDM2NiA2NTUzNSBmDQowMDAwMDAwMzY3IDY1NTM1 IGYNCjAwMDAwMDAzNjggNjU1MzUgZg0KMDAwMDAwMDM2OSA2NTUzNSBmDQowMDAwMDAwMzcwIDY1 NTM1IGYNCjAwMDAwMDAzNzEgNjU1MzUgZg0KMDAwMDAwMDM3MiA2NTUzNSBmDQowMDAwMDAwMzcz IDY1NTM1IGYNCjAwMDAwMDAzNzQgNjU1MzUgZg0KMDAwMDAwMDM3NSA2NTUzNSBmDQowMDAwMDAw Mzc2IDY1NTM1IGYNCjAwMDAwMDAzNzcgNjU1MzUgZg0KMDAwMDAwMDM3OCA2NTUzNSBmDQowMDAw MDAwMzc5IDY1NTM1IGYNCjAwMDAwMDAzODAgNjU1MzUgZg0KMDAwMDAwMDM4MSA2NTUzNSBmDQow MDAwMDAwMzgyIDY1NTM1IGYNCjAwMDAwMDAzODMgNjU1MzUgZg0KMDAwMDAwMDM4NCA2NTUzNSBm DQowMDAwMDAwMzg1IDY1NTM1IGYNCjAwMDAwMDAzODYgNjU1MzUgZg0KMDAwMDAwMDM4NyA2NTUz NSBmDQowMDAwMDAwMzg4IDY1NTM1IGYNCjAwMDAwMDAzODkgNjU1MzUgZg0KMDAwMDAwMDM5MCA2 NTUzNSBmDQowMDAwMDAwMzkxIDY1NTM1IGYNCjAwMDAwMDAzOTIgNjU1MzUgZg0KMDAwMDAwMDM5 MyA2NTUzNSBmDQowMDAwMDAwMzk0IDY1NTM1IGYNCjAwMDAwMDAzOTUgNjU1MzUgZg0KMDAwMDAw MDM5NiA2NTUzNSBmDQowMDAwMDAwMzk3IDY1NTM1IGYNCjAwMDAwMDAzOTggNjU1MzUgZg0KMDAw MDAwMDM5OSA2NTUzNSBmDQowMDAwMDAwNDAwIDY1NTM1IGYNCjAwMDAwMDA0MDEgNjU1MzUgZg0K MDAwMDAwMDQwMiA2NTUzNSBmDQowMDAwMDAwNDAzIDY1NTM1IGYNCjAwMDAwMDA0MDQgNjU1MzUg Zg0KMDAwMDAwMDQwNSA2NTUzNSBmDQowMDAwMDAwNDA2IDY1NTM1IGYNCjAwMDAwMDA0MDcgNjU1 MzUgZg0KMDAwMDAwMDQwOCA2NTUzNSBmDQowMDAwMDAwNDA5IDY1NTM1IGYNCjAwMDAwMDA0MTAg NjU1MzUgZg0KMDAwMDAwMDQxMSA2NTUzNSBmDQowMDAwMDAwNDEyIDY1NTM1IGYNCjAwMDAwMDA0 MTMgNjU1MzUgZg0KMDAwMDAwMDQxNCA2NTUzNSBmDQowMDAwMDAwNDE1IDY1NTM1IGYNCjAwMDAw MDA0MTYgNjU1MzUgZg0KMDAwMDAwMDQxNyA2NTUzNSBmDQowMDAwMDAwNDE4IDY1NTM1IGYNCjAw MDAwMDA0MTkgNjU1MzUgZg0KMDAwMDAwMDQyMCA2NTUzNSBmDQowMDAwMDAwNDIxIDY1NTM1IGYN CjAwMDAwMDA0MjIgNjU1MzUgZg0KMDAwMDAwMDQyMyA2NTUzNSBmDQowMDAwMDAwNDI0IDY1NTM1 IGYNCjAwMDAwMDA0MjUgNjU1MzUgZg0KMDAwMDAwMDQyNiA2NTUzNSBmDQowMDAwMDAwNDI3IDY1 NTM1IGYNCjAwMDAwMDA0MjggNjU1MzUgZg0KMDAwMDAwMDQyOSA2NTUzNSBmDQowMDAwMDAwNDMw IDY1NTM1IGYNCjAwMDAwMDA0MzEgNjU1MzUgZg0KMDAwMDAwMDQzMiA2NTUzNSBmDQowMDAwMDAw NDMzIDY1NTM1IGYNCjAwMDAwMDA0MzQgNjU1MzUgZg0KMDAwMDAwMDQzNSA2NTUzNSBmDQowMDAw MDAwNDM2IDY1NTM1IGYNCjAwMDAwMDA0MzcgNjU1MzUgZg0KMDAwMDAwMDQzOCA2NTUzNSBmDQow MDAwMDAwNDM5IDY1NTM1IGYNCjAwMDAwMDA0NDAgNjU1MzUgZg0KMDAwMDAwMDQ0MSA2NTUzNSBm DQowMDAwMDAwNDQyIDY1NTM1IGYNCjAwMDAwMDA0NDMgNjU1MzUgZg0KMDAwMDAwMDQ0NCA2NTUz NSBmDQowMDAwMDAwNDQ1IDY1NTM1IGYNCjAwMDAwMDA0NDYgNjU1MzUgZg0KMDAwMDAwMDQ0NyA2 NTUzNSBmDQowMDAwMDAwNDQ4IDY1NTM1IGYNCjAwMDAwMDA0NDkgNjU1MzUgZg0KMDAwMDAwMDQ1 MCA2NTUzNSBmDQowMDAwMDAwNDUxIDY1NTM1IGYNCjAwMDAwMDA0NTIgNjU1MzUgZg0KMDAwMDAw MDQ1MyA2NTUzNSBmDQowMDAwMDAwNDU0IDY1NTM1IGYNCjAwMDAwMDA0NTUgNjU1MzUgZg0KMDAw MDAwMDQ1NiA2NTUzNSBmDQowMDAwMDAwNDU3IDY1NTM1IGYNCjAwMDAwMDA0NTggNjU1MzUgZg0K MDAwMDAwMDQ1OSA2NTUzNSBmDQowMDAwMDAwNDYwIDY1NTM1IGYNCjAwMDAwMDA0NjEgNjU1MzUg Zg0KMDAwMDAwMDQ2MiA2NTUzNSBmDQowMDAwMDAwNDYzIDY1NTM1IGYNCjAwMDAwMDA0NjQgNjU1 MzUgZg0KMDAwMDAwMDQ2NSA2NTUzNSBmDQowMDAwMDAwNDY2IDY1NTM1IGYNCjAwMDAwMDA0Njcg NjU1MzUgZg0KMDAwMDAwMDQ2OCA2NTUzNSBmDQowMDAwMDAwNDY5IDY1NTM1IGYNCjAwMDAwMDA0 NzAgNjU1MzUgZg0KMDAwMDAwMDQ3MSA2NTUzNSBmDQowMDAwMDAwNDcyIDY1NTM1IGYNCjAwMDAw MDA0NzMgNjU1MzUgZg0KMDAwMDAwMDQ3NCA2NTUzNSBmDQowMDAwMDAwNDc1IDY1NTM1IGYNCjAw MDAwMDA0NzYgNjU1MzUgZg0KMDAwMDAwMDQ3NyA2NTUzNSBmDQowMDAwMDAwNDc4IDY1NTM1IGYN CjAwMDAwMDA0NzkgNjU1MzUgZg0KMDAwMDAwMDQ4MCA2NTUzNSBmDQowMDAwMDAwNDgxIDY1NTM1 IGYNCjAwMDAwMDA0ODIgNjU1MzUgZg0KMDAwMDAwMDQ4MyA2NTUzNSBmDQowMDAwMDAwNDg0IDY1 NTM1IGYNCjAwMDAwMDA0ODUgNjU1MzUgZg0KMDAwMDAwMDQ4NiA2NTUzNSBmDQowMDAwMDAwNDg3 IDY1NTM1IGYNCjAwMDAwMDA0ODggNjU1MzUgZg0KMDAwMDAwMDQ4OSA2NTUzNSBmDQowMDAwMDAw NDkwIDY1NTM1IGYNCjAwMDAwMDA0OTEgNjU1MzUgZg0KMDAwMDAwMDQ5MiA2NTUzNSBmDQowMDAw MDAwNDkzIDY1NTM1IGYNCjAwMDAwMDA0OTQgNjU1MzUgZg0KMDAwMDAwMDQ5NSA2NTUzNSBmDQow MDAwMDAwNDk2IDY1NTM1IGYNCjAwMDAwMDA0OTcgNjU1MzUgZg0KMDAwMDAwMDQ5OCA2NTUzNSBm DQowMDAwMDAwNDk5IDY1NTM1IGYNCjAwMDAwMDA1MDAgNjU1MzUgZg0KMDAwMDAwMDUwMSA2NTUz NSBmDQowMDAwMDAwNTAyIDY1NTM1IGYNCjAwMDAwMDA1MDMgNjU1MzUgZg0KMDAwMDAwMDUwNCA2 NTUzNSBmDQowMDAwMDAwNTA1IDY1NTM1IGYNCjAwMDAwMDA1MDYgNjU1MzUgZg0KMDAwMDAwMDUw NyA2NTUzNSBmDQowMDAwMDAwNTA4IDY1NTM1IGYNCjAwMDAwMDA1MDkgNjU1MzUgZg0KMDAwMDAw MDAwMCA2NTUzNSBmDQowMDAwMTY1MDgxIDAwMDAwIG4NCjAwMDAxNjU0NDggMDAwMDAgbg0KMDAw MDI1Njg0OSAwMDAwMCBuDQowMDAwMjU3MzY5IDAwMDAwIG4NCjAwMDAyNTc2NzcgMDAwMDAgbg0K MDAwMDI1Nzk4NyAwMDAwMCBuDQowMDAwMjk5MTk5IDAwMDAwIG4NCjAwMDAyOTkyNTQgMDAwMDAg bg0KdHJhaWxlcg0KPDwvU2l6ZSA1MTgvUm9vdCAxIDAgUi9JbmZvIDE2NSAwIFIvSURbPDYyMjJB QTlDQjNGMzEzNDA5RkI4QTVEQUE5QUM3MEE4Pjw2MjIyQUE5Q0IzRjMxMzQwOUZCOEE1REFBOUFD NzBBOD5dID4+DQpzdGFydHhyZWYNCjMwMDY3OQ0KJSVFT0YNCnhyZWYNCjAgMA0KdHJhaWxlcg0K PDwvU2l6ZSA1MTgvUm9vdCAxIDAgUi9JbmZvIDE2NSAwIFIvSURbPDYyMjJBQTlDQjNGMzEzNDA5 RkI4QTVEQUE5QUM3MEE4Pjw2MjIyQUE5Q0IzRjMxMzQwOUZCOEE1REFBOUFDNzBBOD5dIC9QcmV2 IDMwMDY3OS9YUmVmU3RtIDI5OTI1ND4+DQpzdGFydHhyZWYNCjMxMTIwMA0KJSVFT0Y= --_002_MWHPR09MB14408EF0A9F034AEB6A1EC80F0140MWHPR09MB1440namp_-- From nobody Mon May 1 14:26:34 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 77FA9127F0E; Mon, 1 May 2017 14:26:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J19XSMny4XgO; Mon, 1 May 2017 14:26:00 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3CE301270A3; Mon, 1 May 2017 14:23:29 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml704-cah.china.huawei.com) ([172.18.7.190]) by lhrrg02-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id DFU98605; Mon, 01 May 2017 21:23:26 +0000 (GMT) Received: from SJCEML701-CHM.china.huawei.com (10.208.112.40) by lhreml704-cah.china.huawei.com (10.201.108.45) with Microsoft SMTP Server (TLS) id 14.3.301.0; Mon, 1 May 2017 22:23:25 +0100 Received: from SJCEML702-CHM.china.huawei.com ([169.254.4.233]) by SJCEML701-CHM.china.huawei.com ([169.254.3.8]) with mapi id 14.03.0235.001; Mon, 1 May 2017 14:23:23 -0700 From: Linda Dunbar To: "Waltermire, David A. (Fed)" , "saag@ietf.org" , "opsawg@ietf.org" , "netconf@ietf.org" , "netmod@ietf.org" , "sacm@ietf.org" , "mile@ietf.org" , "i2nsf@ietf.org" Thread-Topic: PANIC Bar BoF Tonight @ 6:30pm CDT Thread-Index: AdKoyz/2/d9baDSGTnuHD2EJjZ7MgwZ8FaBwAADmGxA= Date: Mon, 1 May 2017 21:23:22 +0000 Message-ID: <4A95BA014132FF49AE685FAB4B9F17F65927A234@SJCEML702-CHM.china.huawei.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.192.11.111] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020206.5907A74F.00BE, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=169.254.4.233, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 477666db19fed32cdca8d3f611fed601 Archived-At: Subject: Re: [OPSAWG] PANIC Bar BoF Tonight @ 6:30pm CDT X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 May 2017 21:26:03 -0000 David,=20 Will PANIC initiative cover the "security posture" for "workload" moved to = 3rd party cloud DC?=20 Just finished attending ONUG (Open Network User Group - an enterprise centr= ic forum) Spring meeting. Many enterprise users are saying that they are m= oving their workload to multiple Cloud DC (AWS, Azure, Salesforce, IBM, etc= ) to achieve data portability, app sharing, and built-in redundancy. =20 One of the biggest issue is how to make security risk visible, so that they= can better manage the security risks.=20 Possible to have mechanism to properly identify the security posture of "En= dpoint in 3rd party DC"? Is it part of PANIC scope?=20 Linda -----Original Message----- From: mile [mailto:mile-bounces@ietf.org] On Behalf Of Waltermire, David A.= (Fed) Sent: Monday, May 01, 2017 3:55 PM To: saag@ietf.org; opsawg@ietf.org; netconf@ietf.org; netmod@ietf.org; sacm= @ietf.org; mile@ietf.org; i2nsf@ietf.org Subject: Re: [mile] PANIC Bar BoF Tonight @ 6:30pm CDT The Posture Assessment Through Network Information Collection (PANIC) group= held an informal bar BoF at IETF 98 to discuss available protocols and dat= a models for assessing the posture of network equipment devices. A descript= ion of PANIC is below, and a slide deck is attached describing the group's = goals and requirements. We had a productive discussion about the group's sc= ope, and agreed to continue the conversation on a non-working group mailing= list.=20 The PANIC mailing list is now available for subscribers at this link: https= ://www.ietf.org/mailman/listinfo/panic. If you are interested in the effort, please join the mailing list. A scopin= g draft will be posted to the list in the next week. We look forward to you= r feedback on it. Regards, Dave PANIC Description: The IETF SACM work group has been working to standardize the collection of = endpoint configuration and other posture information from enterprise endpoi= nts. Collecting this information is critical to support automation of commo= n network security tasks, including asset, software, vulnerability, and con= figuration management. Thus far, our efforts have focused primarily on stan= dards to collect information in support of asset, software and vulnerabilit= y management use cases for classical endpoint devices (e.g., servers, lapto= ps, etc), and has worked with other IETF members to determine what data wou= ld need to be to be collected, and how that data would be securely communic= ated across the network. Through such exchanges an organization can know wh= at client endpoints are connected to their network, and if they are vulnera= ble to attack. Given the proliferation of attacks against network infrastructure devices, = it is clear that the next step in our enterprise security automation effort= must be to enable standardized reporting of similar information from netwo= rk infrastructure devices. With the growing number of Yang models and incre= ased adoption of NETCONF, RESTCONF, and related protocol work, we believe t= he time is right to work out how these standards can be used to measure the= health of network devices. This information will, as in our efforts in SAC= M for client devices, support asset, software, vulnerability, and configura= tion management use cases. We hope to use existing management protocols to = report this information from network infrastructure devices, supporting mul= tiple use cases using the same set of management protocols. Such a mechanis= m will help network defenders protect against known attacks, and provide th= e necessary knowledge to detect and mitigate future attacks. > -----Original Message----- > From: Waltermire, David A. (Fed) > Sent: Wednesday, March 29, 2017 4:42 PM > To: 'saag@ietf.org' ; 'opsawg@ietf.org'=20 > ; 'netconf@ietf.org' ; 'netmod@ietf.or= g' > > Subject: PANIC Bar BoF Tonight @ 6:30pm CDT >=20 >=20 > Just a quick reminder... the Posture Assessment through Network=20 > Information Collection (PANIC) bar BoF is tonight right after the IETF=20 > 98 Technical and Administrative Plenary at 6:30pm CDT in Vevey 4 at=20 > the Swissotel Conference Center. We are hoping to start a discussion=20 > about how to leverage the existing IETF network management protocols=20 > to best address security automation for network infrastructure=20 > devices. We would like your ideas on how to best pursue this work, and=20 > your insights into network infrastructure security problems that will imp= act our networks in the future. > We are holding a side meeting at IETF 98 on Wednesday, March 29th at=20 > 6:30pm CDT to start a discussion about how to move forward on this topic. >=20 > Given the late hour, we will have some light snacks. We hope to see=20 > you there. >=20 > Regards, > David Waltermire From nobody Tue May 2 01:47:36 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0AE4D120454; Tue, 2 May 2017 01:47:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.502 X-Spam-Level: X-Spam-Status: No, score=-14.502 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NFnFbw-_6Q2N; Tue, 2 May 2017 01:47:32 -0700 (PDT) Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 40F2113012B; Tue, 2 May 2017 01:42:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=19516; q=dns/txt; s=iport; t=1493714543; x=1494924143; h=subject:to:references:cc:from:message-id:date: mime-version:in-reply-to; bh=t+1aP5UjK8dwihsSBc6tFZawXIMb9KW7qE0H24okSjE=; b=SDj8bi9MzpzicFsJJhSB10KigwCjb5n08+28VgIs5xzlnaKYu3Ef46Vh YvqFIFgiCaZPMOPah+nmvm6YqGsklX0KQRK7qpQCs44HTyvELHcoTzsxx wSIMa9/ZWBHwBBEYP2/T5W/zNwDA3tgsMiZWfb3CXS1Bh/vCpus36Y3N0 k=; X-Files: signature.asc : 481 X-IronPort-AV: E=Sophos;i="5.37,404,1488844800"; d="asc'?scan'208,217";a="654397594" Received: from aer-iport-nat.cisco.com (HELO aer-core-4.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 02 May 2017 08:42:21 +0000 Received: from [10.61.67.64] (ams3-vpn-dhcp832.cisco.com [10.61.67.64]) by aer-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id v428gK3W021775; Tue, 2 May 2017 08:42:20 GMT To: "Max Pritikin (pritikin)" References: <031d87aa-1839-d7af-0723-dd9a2aa7ad0a@cisco.com> <43DF7C00-FC3B-4327-9EE4-13ED6520E580@cisco.com> Cc: "ibagdona@gmail.com" , Zhoutianran , "opsawg@ietf.org" , Anima WG From: Eliot Lear Message-ID: <9298f306-400b-2c38-bed2-637183f35ea1@cisco.com> Date: Tue, 2 May 2017 10:42:20 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: <43DF7C00-FC3B-4327-9EE4-13ED6520E580@cisco.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="D9xHssxQfdkMVHo2VU1eVlv6pAQankivD" Archived-At: Subject: Re: [OPSAWG] [Anima] dealing with multiple manufacturer services with a single certificate extension X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 May 2017 08:47:35 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --D9xHssxQfdkMVHo2VU1eVlv6pAQankivD Content-Type: multipart/mixed; boundary="fpRS2doxiGt0jnIifCVBe65tNHuikOKkU"; protected-headers="v1" From: Eliot Lear To: "Max Pritikin (pritikin)" Cc: "ibagdona@gmail.com" , Zhoutianran , "opsawg@ietf.org" , Anima WG Message-ID: <9298f306-400b-2c38-bed2-637183f35ea1@cisco.com> Subject: Re: [Anima] dealing with multiple manufacturer services with a single certificate extension References: <031d87aa-1839-d7af-0723-dd9a2aa7ad0a@cisco.com> <43DF7C00-FC3B-4327-9EE4-13ED6520E580@cisco.com> In-Reply-To: <43DF7C00-FC3B-4327-9EE4-13ED6520E580@cisco.com> --fpRS2doxiGt0jnIifCVBe65tNHuikOKkU Content-Type: multipart/alternative; boundary="------------3325ACEF3C399300E1D0234B" This is a multi-part message in MIME format. --------------3325ACEF3C399300E1D0234B Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Max, On 4/24/17 5:52 PM, Max Pritikin (pritikin) wrote: > > I=E2=80=99ve been agitating for a combined form. My thanks to Eliot for= > continuing the conversation. Below I provide some details from the > current BRSKI draft to flesh out the conversation and then present an > argument for my position. > >> On Apr 23, 2017, at 5:23 AM, Eliot Lear > > wrote: >> >> Hi everyone, >> >> Just a quick update on this document. I am preparing for the next >> version of the draft. There is one major change contemplated that is >> not yet addressed. >> >> I received feedback from the IETF Chicago meeting regarding how best >> to structure URLs in manufacturer certificates. There are currently >> two planned, one for MUD and one for ANIMA/BRSKI. The question is >> whether these should be combined.=20 >> >> I had said in Chicago that I would ask various manufacturers about >> whether additional complexity on the backend is worth saving the >> bytes in the certificate. There was, as you might imagine, a mixed >> response. A number of manufacturers answered, =E2=80=9CNo, and in fac= t we >> want to do our own certificate extensions=E2=80=9D. Others simply ans= wered >> =E2=80=9CNo, the code requirements for ANIMA will probably make the ce= rt >> extension a relatively minimal matter=E2=80=9D. And some manufacturer= s, >> said, =E2=80=9Cyes, every byte counts.=E2=80=9D I am proceeding in a = way that >> accommodates the 3rd group for now, but I seek discussion. >> >> If we combine the URLs the way it would work is that there would be a >> service endpoint along the lines of the following: >> >> * https://example.com/.well-known/mfg/modelname >> > Given that the .well-known concept is already well defined the > approach taken in the BRSKI draft (s2.3) is to include only the > =E2=80=9Cmanufacturer=E2=80=9D authority: > https://example.com > > From here the relying party can use the .well-known constructs to > access any variety of manufacturer services which I expect to include=20 > https://example.com/.well-known/brksi > https://example.com/.well-known/mud > etc > > This minimizes the information stored within the certificate itself. A > single extension indicating the =E2=80=9Cmanufacturer services authorit= y=E2=80=9D. > Building a full URL to these services is done using the .well-known > method. One challenge here is that we need model information present, and you may need it as well to route to the correct BRSKI service (presuming there is more than one for manufacturer example.com). And so we would need to add at least the model back, or otherwise reflect the model in the authority section. I'm not a big fan of requiring that because it requires unnecessary interactions with DNS administration. >> At that point, we would need to deference, introducing some >> additional complexity somewhere in the system. We should be mindful >> of the following issue: >> >> 1. Versioning should be supported OUTSIDE of the referenced >> service. The more that is done, the more freedom the referenced >> service has the ability to change. >> 2. Versioning of services should not be done in lock step. That is, >> if we keep the versioning information in the URL, that means that >> when the MUD version is bumped, so too would the ANIMA version.=20 >> It is possible to keep a registry that would indicate URL >> versioning and then map to all the different versions of whatever >> is referenced, but that seems ridiculously complex. >> 3. The resolution mechanism to services should be independent of how >> the URL is gotten by the various {MUD/ANIMA/...} controllers.=20 >> And thus, if a MUD controller receives the URL via LLDP or DHCP, >> the same processing should occur as if it was received via a >> certificate. This simplifies code paths, and will hence reduce >> risk of bugs. It will also follow the principle of least >> astonishment. >> >> It seems to me the simplest way to handle this sort of thing is to >> create a table that MUD/ANIMA controllers simply download when they >> see the URL. It might look something like this: >> >> { >> "mfg-services" : [=20 >> "mud", "v1", "https://mud.example.com/Frobmaster3000.json", >> "anima", "v1", "https://masa.example.com/masa-service" >> ] >> } > Using a .well-known to query a host about which possible interfaces > are available has precedent. For an alternative example also see, > https://tools.ietf.org/html/rfc6415 > "The client obtains the host-meta document for a given host by sending > an HTTP [RFC2616 ] or an HTTPS [= RFC2818 ] GET request to the host fo= r > the "/.well-known/host-meta=E2=80=9D path [=E2=80=A6]=E2=80=9D > > > I see this as an optional redirection that MUD or BRSKI or future > protocols might define but don=E2=80=99t see it as a necessary part of = the > manufacturing certificate extension definition. I=E2=80=99d think we co= uld > stop at an extension to provide the root authority to form .well-known > URLs. Simpler, smaller, and just as flexible. But more complex, requiring a query as opposed to a straight retrieval, thus requiring additional work on the back end. > =20 > > As a side note using this approach imposes a difficulty on MUD: the > model and serial number information need to be carried elsewhere and > normatively defined - MUD can no longer depend on a distinct URL for > each class of device. So while I see this as an improvement for IETF > as a whole it is problematic for MUD itself and I appreciate the > willingness of the MUD authors to discuss it. At the moment, more manufacturers are coming back to me to say that we should just leave these as separate and distinct mechanisms. I think that's the simplest approach. Eliot --------------3325ACEF3C399300E1D0234B Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Hi Max,


On 4/24/17 5:52 PM, Max Pritikin (pritikin) wrote:

I=E2=80=99ve been agitating for a combined form. My= thanks to Eliot for continuing the conversation. Below I provide some details from the current BRSKI draft to flesh out the conversation and then present an argument for my position.

On Apr 23, 2017, at 5:23 AM, Eliot Lear <lear@cisco.com> wrote:

Hi every= one,

Just a quick update on this document.=C2=A0 I am preparing = for the next version of the draft.=C2=A0 There is one major cha= nge contemplated that is not yet addressed.

I received feedback from the IETF Chicago meeting regarding how best to structure URLs in manufacturer certificates.=C2=A0 There are currently two planned, one for MUD and one for ANIMA/BRSKI.=C2=A0 The question is whether these should be combined.=C2=A0

I had said in Chicago that I would ask variou= s manufacturers about whether additional complexity on the backend is worth saving the bytes in the certificate.=C2=A0= There was, as you might imagine, a mixed response.=C2=A0 = A number of manufacturers answered, =E2=80=9CNo, and in fac= t we want to do our own certificate extensions=E2=80=9D.=C2=A0= Others simply answered =E2=80=9CNo, the code requirements for AN= IMA will probably make the cert extension a relatively minimal matter=E2=80=9D.=C2=A0 And some manufacturers, sa= id, =E2=80=9Cyes, every byte counts.=E2=80=9D=C2=A0 I am proceeding in a wa= y that accommodates the 3rd group for now, but I seek discussion.

If we combine the URLs the way it would work is that there would be a service endpoint along the lines of the following:

Given that the .well-known concept is already well defined the approach taken in the BRSKI draft (s2.3) is to include only the =E2=80=9Cmanufacturer=E2=80=9D authority:

From here the relying party can use the .well-known constructs to access any variety of manufacturer services which I expect to include=C2=A0
etc

This minimizes the information stored within the certificate itself. A single extension indicating the =E2=80=9Cmanufacturer services authority=E2=80=9D. Building a f= ull URL to these services is done using the .well-known method.

One challenge here is that we need model information present, and you may need it as well to route to the correct BRSKI service (presuming there is more than one for manufacturer example.com).=C2=A0= And so we would need to add at least the model back, or otherwise reflect the model in the authority section.=C2=A0 I'm not a big fan o= f requiring that because it requires unnecessary interactions with DNS administration.

At that point, we would need to deference, introducing some additional complexity somewhere in the system.=C2=A0 W= e should be mindful of the following issue:
  1. Versioning should be supported OUTSIDE of the referenced service.=C2=A0 The more that is done, th= e more freedom the referenced service has the ability to change.
  2. Versioning of services should not be done in lock step.=C2=A0 That is, if we keep the versioning information in the URL, that means that when the MUD version is bumped, so too would the ANIMA version.=C2=A0= It is possible to keep a registry that would indicate URL versioning and then map to all the different versions of whatever is referenced, but that seems ridiculously complex.
  3. The resolution mechanism to services shoul= d be independent of how the URL is gotten by the various {MUD/ANIMA/...} controllers.=C2=A0 And thus, if a MUD controller receives the URL via LLDP or DHCP, the same processing should occur as if it was received via a certificate.=C2=A0 This simplifies code paths, and will= hence reduce risk of bugs.=C2=A0 It will also follow th= e principle of least astonishment.

It seems to me the simplest way to handle thi= s sort of thing is to create a table that MUD/ANIMA controllers simply download when they see the URL.=C2=A0 = It might look something like this:

{
   "mfg-services" : [=20
     "mud", "v1", "https://mud.ex=
ample.com/Frobmaster3000.json",
     "anima", "v1", "https://masa.examp=
le.com/masa-service"
   ]
}
Using a .well-known to query a host about which possible interfaces are available has precedent. For an alternative example also see,
"The client obtains the host-meta document for a given host by sending
  	an HTTP [RFC2616] or an HTTPS [RFC2818] GET request to the host for
   	the "=
/.well-known/host-meta=E2=80=9D path [=E2=80=A6]=E2=80=9D


I see this as an optional redirection that MUD or BRSKI or future protocols might define but don=E2=80=99t see it as a nec= essary part of the manufacturing certificate extension definition. I=E2=80=99d think we could stop at an extension to provide the = root authority to form .well-known URLs. Simpler, smaller, and just as flexible.

But more complex, requiring a query as opposed to a straight retrieval, thus requiring additional work on the back end.

=C2=A0

As a side note using this approach imposes a difficulty on MUD: the model and serial number information need to be carried elsewhere and normatively defined - MUD can no longer depend on a distinct URL for each class of device. So while I see this as an improvement for IETF as a whole it is problematic for MUD itself and I appreciate the willingness of the MUD authors to discuss it.

At the moment, more manufacturers are coming back to me to say that we should just leave these as separate and distinct mechanisms.=C2=A0= I think that's the simplest approach.

Eliot
--------------3325ACEF3C399300E1D0234B-- --fpRS2doxiGt0jnIifCVBe65tNHuikOKkU-- --D9xHssxQfdkMVHo2VU1eVlv6pAQankivD Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2 iQEcBAEBCAAGBQJZCEZsAAoJEIe2a0bZ0nozxSYH/RwyczWZw/ICrtYbjNLUXzYg kbCRBiRNQy2RR1X0YbMCvizmV1AujwIgnPY5tCQdjzkJJ4RFneK/vtL5B7XzudTr EglRR+h0WdtYV/yOwEhkW8mLPr6ikBTyhgGfAEL09rpwqgMy/3rnvbqaD53eBoCO fYhYpZwEbBj3K8oaHGp8EjTbhawVCjfL3ZjQ7/WDVkW82XfEb3AZI5yacldm0/WY ylUNeNaEaMsaHbtvzP36OrAw2iKY4eRCqa7mJGgGrry4jhCfSNuQgjR984wPW6AW M2ABE3xwxYw8fEmGMcyhru7E95wmOCzyhTBC4HxOfmG3ccJPTPZSDIVGiQMajWA= =ztbf -----END PGP SIGNATURE----- --D9xHssxQfdkMVHo2VU1eVlv6pAQankivD-- From nobody Wed May 3 19:46:14 2017 Return-Path: X-Original-To: opsawg@ietf.org Delivered-To: opsawg@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E068B12960D; Wed, 3 May 2017 19:46:05 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: opsawg@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.50.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <149386596579.4881.15914732299692111269@ietfa.amsl.com> Date: Wed, 03 May 2017 19:46:05 -0700 Archived-At: Subject: [OPSAWG] I-D Action: draft-ietf-opsawg-capwap-alt-tunnel-09.txt X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 May 2017 02:46:06 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operations and Management Area Working Group of the IETF. Title : Alternate Tunnel Encapsulation for Data Frames in CAPWAP Authors : Rong Zhang Rajesh S. Pazhyannur Sri Gundavelli Zhen Cao Hui Deng Zongpeng Du Filename : draft-ietf-opsawg-capwap-alt-tunnel-09.txt Pages : 26 Date : 2017-05-03 Abstract: Control and Provisioning of Wireless Access Points (CAPWAP) defines a specification to encapsulate a station's data frames between the Wireless Transmission Point (WTP) and Access Controller (AC). Specifically, the station's IEEE 802.11 data frames can be either locally bridged or tunneled to the AC. When tunneled, a CAPWAP data channel is used for tunneling. In many deployments encapsulating data frames to an entity other than the AC (for example to an Access Router (AR)) is desirable. Furthermore, it may also be desirable to use different tunnel encapsulation modes between the WTP and the Access Router. This document defines extension to CAPWAP protocol for supporting this capability and refers to it as alternate tunnel encapsulation. The alternate tunnel encapsulation allows 1) the WTP to tunnel non-management data frames to an endpoint different from the AC and 2) the WTP to tunnel using one of many known encapsulation types such as IP-IP, IP-GRE, CAPWAP. The WTP may advertise support for alternate tunnel encapsulation during the discovery and join process and AC may select one of the supported alternate tunnel encapsulation types while configuring the WTP. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsawg-capwap-alt-tunnel/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-opsawg-capwap-alt-tunnel-09 https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-capwap-alt-tunnel-09 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsawg-capwap-alt-tunnel-09 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue May 9 10:41:50 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2145612EAB0 for ; Tue, 9 May 2017 10:41:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.002 X-Spam-Level: X-Spam-Status: No, score=-0.002 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DUy3RWH1D7XC for ; Tue, 9 May 2017 10:41:46 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 2CC95129536 for ; Tue, 9 May 2017 10:41:46 -0700 (PDT) Received: from [192.168.20.197] (CPEf4cc552207f0-CM00fc8dce0fa0.cpe.net.cable.rogers.com [99.230.129.191]) by mail.networkradius.com (Postfix) with ESMTPSA id 49CF76DC for ; Tue, 9 May 2017 17:41:45 +0000 (UTC) From: Alan DeKok Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Message-Id: Date: Tue, 9 May 2017 13:41:43 -0400 To: IETF OOPSAWG Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) Archived-At: Subject: [OPSAWG] Serious concerns with draft-ietf-opsawg-tacacs-06 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 May 2017 17:41:48 -0000 I've taken a look at the latest draft, and have some serious concerns. Specifically, large chunks of the Security Considerations sections = appear to have been lifted from my post to the list: https://mailarchive.ietf.org/arch/msg/opsawg/tU2wBFIV4MkpKChWn6EvrqeZtXU There are minor edits, but multiple sentences are copied word for = word. Sentences which don't occur in the -05 draft, but do appear in my = review, and subsequently are copied to the -06 draft with minor edits. Multiple paragraphs are copied with only minor edits. The total = amounts to about a page of text. While I appreciate that the document is improving, blatant copying of = my text without attribution is entirely inappropriate. What are the chairs recommendations? Alan DeKok. From nobody Tue May 9 11:07:06 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2F2D912EAD1 for ; Tue, 9 May 2017 11:07:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.291 X-Spam-Level: X-Spam-Status: No, score=0.291 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r3wf4wWDG5c9 for ; Tue, 9 May 2017 11:07:05 -0700 (PDT) Received: from sobco.sobco.com (unknown [136.248.127.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A04412EAC4 for ; Tue, 9 May 2017 11:07:05 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by sobco.sobco.com (Postfix) with ESMTP id ADC0C40C4126; Tue, 9 May 2017 14:07:03 -0400 (EDT) X-Virus-Scanned: amavisd-new at sobco.com Received: from sobco.sobco.com ([127.0.0.1]) by localhost (sobco.sobco.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JWaFdeMYUuMm; Tue, 9 May 2017 14:07:02 -0400 (EDT) Received: from golem.sobco.com (golem.sobco.com [136.248.127.162]) by sobco.sobco.com (Postfix) with ESMTPSA id 9C2C940C4111; Tue, 9 May 2017 14:07:02 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: "Scott O. Bradner" In-Reply-To: Date: Tue, 9 May 2017 14:07:02 -0400 Cc: IETF OOPSAWG Content-Transfer-Encoding: quoted-printable Message-Id: References: To: Alan DeKok X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [OPSAWG] Serious concerns with draft-ietf-opsawg-tacacs-06 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 May 2017 18:07:06 -0000 > On May 9, 2017, at 1:41 PM, Alan DeKok = wrote: >=20 > I've taken a look at the latest draft, and have some serious = concerns. >=20 > Specifically, large chunks of the Security Considerations sections = appear to have been lifted from my post to the list: >=20 > = https://mailarchive.ietf.org/arch/msg/opsawg/tU2wBFIV4MkpKChWn6EvrqeZtXU >=20 > There are minor edits, but multiple sentences are copied word for = word. Sentences which don't occur in the -05 draft, but do appear in my = review, and subsequently are copied to the -06 draft with minor edits. >=20 > Multiple paragraphs are copied with only minor edits. The total = amounts to about a page of text. >=20 > While I appreciate that the document is improving, blatant copying of = my text without attribution is entirely inappropriate. using the text that was contributed is legit but not acknowledging the = source in the acknowledgements section violates IETF requirement to = acknowledge all significant contributions Scott >=20 > What are the chairs recommendations? >=20 > Alan DeKok. >=20 >=20 > _______________________________________________ > OPSAWG mailing list > OPSAWG@ietf.org > https://www.ietf.org/mailman/listinfo/opsawg From nobody Tue May 9 11:41:24 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2DBC12EAD4 for ; Tue, 9 May 2017 11:41:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=kumari-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lEbb_gDJXLPw for ; Tue, 9 May 2017 11:41:21 -0700 (PDT) Received: from mail-ua0-x22f.google.com (mail-ua0-x22f.google.com [IPv6:2607:f8b0:400c:c08::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2123212009C for ; Tue, 9 May 2017 11:41:20 -0700 (PDT) Received: by mail-ua0-x22f.google.com with SMTP id j17so10299159uag.3 for ; Tue, 09 May 2017 11:41:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kumari-net.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YDVrzf0qVNQHop7eca1kjm0gF+UaCgw/ok72U9aqu0o=; b=wia9ZltEqYM44lsW7ezNAJbmwzkHqxg1nBClaCvXMuz/cOg0nofBtu5gBG2GvpUviG Lqf+qV4H8hci3H2jzfEQ8zna8Vua0iBUfmdEMlnj+rWDwS/KU+POjMma39got1cTvHg8 VZCw4uiPZWlai+JmPUpkWLmhd1taEoCVp2LWfzeVteQSgrjlL+GEpAybhww5sX8xe6ox 3ZosjyHN3NxOMQ2bS40FK5oflj4aiz/3c2z+Uxw4KFFt59/ib3d8BJuGj2UHVRubXE8b 4uVV98OeAGe+NzRYrnNxvaFqx0zMGzt8fIMkcJK469jKj5dWRPcfjzjyrQ/PFMwRZa0w CY3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YDVrzf0qVNQHop7eca1kjm0gF+UaCgw/ok72U9aqu0o=; b=ssCK4rz9HXuxsfmw2GYbZyZiJxZYgwqY+pssvXRQM/SLGR6WQo3AB3ismObw885Wfi mqPiix0VhWgNxlBCfUQ1xyywBuP0CxgFuxumrG/accPJA9J93W5LFi/Yb+Ha5m0/Rpv6 Ok85P8Akqd2WPePQKpZmVHLp8L4SG9PVQziX/j4a3gglyNSI/xofOObngWtmMYCgneUI QFvfmIdcepwWzEagovbw+bR7XlQ1ynqxbz3HvGMeS5I1afLOxApPJeTakhTSACkFLs3x fKeU4+mC5042N1qRkQBiDUSNKhAdoc7q3soOzbhqjsoDDWqlcmXKhe1HwSoMmSKIliDA 9WrQ== X-Gm-Message-State: AODbwcBve2DcAUp++uD0H8nl2AwIfslTF74Z4SQT+m+XMFRcG+X1/HJZ fqvsDsPbZdjJeSyt/dgHMu3zQ3yFzlpL X-Received: by 10.159.37.150 with SMTP id 22mr717844uaf.72.1494355280006; Tue, 09 May 2017 11:41:20 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Warren Kumari Date: Tue, 09 May 2017 18:41:09 +0000 Message-ID: To: Alan DeKok , "Scott O. Bradner" Cc: IETF OOPSAWG Content-Type: multipart/alternative; boundary=001a113c8236a228ae054f1bb3dc Archived-At: Subject: Re: [OPSAWG] Serious concerns with draft-ietf-opsawg-tacacs-06 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 May 2017 18:41:23 -0000 --001a113c8236a228ae054f1bb3dc Content-Type: text/plain; charset=UTF-8 On Tue, May 9, 2017 at 8:07 PM Scott O. Bradner wrote: > > > On May 9, 2017, at 1:41 PM, Alan DeKok > wrote: > > > > I've taken a look at the latest draft, and have some serious concerns. > > > > Specifically, large chunks of the Security Considerations sections > appear to have been lifted from my post to the list: > > > > https://mailarchive.ietf.org/arch/msg/opsawg/tU2wBFIV4MkpKChWn6EvrqeZtXU > > > > There are minor edits, but multiple sentences are copied word for > word. Sentences which don't occur in the -05 draft, but do appear in my > review, and subsequently are copied to the -06 draft with minor edits. > > > > Multiple paragraphs are copied with only minor edits. The total > amounts to about a page of text. > > > > While I appreciate that the document is improving, blatant copying of > my text without attribution is entirely inappropriate. > > using the text that was contributed is legit but not acknowledging the > source in the acknowledgements section violates IETF requirement to > acknowledge all significant contributions > Yes. This document was resurrected from a really old document (1998) which did not have an Acknowledgement section. The authors have already said "Certainly, that was an oversight on our part" and that they would add an acknowledgement section and acknowledge Alan's contribution. W [ Monkey typed on a small screen, apologies for typos ] > Scott > > > > > > What are the chairs recommendations? > > > > Alan DeKok. > > > > > > _______________________________________________ > > OPSAWG mailing list > > OPSAWG@ietf.org > > https://www.ietf.org/mailman/listinfo/opsawg > > _______________________________________________ > OPSAWG mailing list > OPSAWG@ietf.org > https://www.ietf.org/mailman/listinfo/opsawg > --001a113c8236a228ae054f1bb3dc Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On Tue, May 9, 2017 at 8:07 = PM Scott O. Bradner <= sob@sobco.com> wrote:

> On May 9, 2017, at 1:41 PM, Alan DeKok <aland@deployingradius.com> wrote= :
>
>=C2=A0 I've taken a look at the latest draft, and have some serious= concerns.
>
>=C2=A0 Specifically, large chunks of the Security Considerations sectio= ns appear to have been lifted from my post to the list:
>
> https://mailarchive.iet= f.org/arch/msg/opsawg/tU2wBFIV4MkpKChWn6EvrqeZtXU
>
>=C2=A0 There are minor edits, but multiple sentences are copied word fo= r word.=C2=A0 Sentences which don't occur in the -05 draft, but do appe= ar in my review, and subsequently are copied to the -06 draft with minor ed= its.
>
>=C2=A0 Multiple paragraphs are copied with only minor edits.=C2=A0 The = total amounts to about a page of text.
>
>=C2=A0 While I appreciate that the document is improving, blatant copyi= ng of my text without attribution is entirely inappropriate.

using the text that was contributed is legit but not acknowledging the sour= ce in the acknowledgements section violates IETF requirement to acknowledge= all significant contributions


Yes.=C2=A0
This document w= as resurrected from a really old document (1998) which did not have an Ackn= owledgement section. The authors have already said "Certainly, that wa= s an oversight on our part" and that they would add an acknowledgement= section and acknowledge Alan's contribution.

W

[ = Monkey typed on a small screen, apologies for typos ]

<= blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px= #ccc solid;padding-left:1ex">
Scott


>
>=C2=A0 What are the chairs recommendations?
>
>=C2=A0 Alan DeKok.
>
>
> _______________________________________________
> OPSAWG mailing list
> OPSAWG@ietf.org
> https://www.ietf.org/mailman/listinfo/opsawg
_______________________________________________
OPSAWG mailing list
OPSAWG@ietf.org https://www.ietf.org/mailman/listinfo/opsawg
--001a113c8236a228ae054f1bb3dc-- From nobody Tue May 9 11:43:37 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6C7B124D6C; Tue, 9 May 2017 11:43:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6-weDVGzUGo0; Tue, 9 May 2017 11:43:34 -0700 (PDT) Received: from mail-wr0-x243.google.com (mail-wr0-x243.google.com [IPv6:2a00:1450:400c:c0c::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BBCA2129534; Tue, 9 May 2017 11:43:33 -0700 (PDT) Received: by mail-wr0-x243.google.com with SMTP id w50so2364842wrc.0; Tue, 09 May 2017 11:43:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to:content-transfer-encoding; bh=VZK4a3fH3aSZM3MbfXMclNxdg5QqP3W+DfhWhax1E08=; b=mJvBv0JLzf5oAJyUrwm+RyvfA6sC/+iCvWg9cwwM7jAjN6IXBp1m/EEy5Ui1unb0jn xszBOKWHmuD2Iqj8tBm7lOGHUcNqWhEO7/YgsqwUFueK8daLtI7yQHV8EnUMHcxg2XX/ 6dM1KocAGwdP/k7/JZrIUwXPYFPGOMr1Rm9MOErDBgSw4+xgT09xrnJIq2ZyQpTURnkj JnIIxmKN2Pz47ybhBwrmHTV/TVTZimXQCKOKcXkdH4av5mr0QBFiP1M7ZUydLjtYzOvo 9eZWbqAoQ9svTiIsg2lsMeAOZGvw462XVjbMTPGXROM0YcHGshEmAFFyZeefpjCrcKm4 yVOQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=VZK4a3fH3aSZM3MbfXMclNxdg5QqP3W+DfhWhax1E08=; b=JSs/L7ZqRoobWYrT/KRu+LSdITK3R4Y+9sPe9oBDNrrageN0zPTYbbqRLbw39kLxq9 Ml+ecLrdZsd27OfuIe/4/JnT7lG+iSIBfOkgQKqL3lRrmcGlCyYx602lDF51sFSoldvO YwlgEaE0jPqE8Vee/BsK9VJollcM9lg7bZx+i6NZnshGtvg7lkf1FTLICPmaukc6o1pH I6CQU0d69KiwhyWNsuxNzQY5MgriAUdyq/QlbBLI6KKEya6BZH9hKYFSjWaoQuu6BAzG unGhHCw/QuzTliU1N14Jv6E47KDxSQuEMaX1DMMevNVw8xiDm6EDgWR7yWgdL1K21CVF Tv7w== X-Gm-Message-State: AODbwcB28INCFIGRtZRIwUevnvmnW8H2Fe+sibVAZFMpaYjqsTiau3Ag MCFpDI19FYtTZk2J4hM= X-Received: by 10.223.139.199 with SMTP id w7mr1105911wra.92.1494355411971; Tue, 09 May 2017 11:43:31 -0700 (PDT) Received: from [10.0.18.52] ([213.16.86.179]) by smtp.gmail.com with ESMTPSA id 72sm1814084wmx.23.2017.05.09.11.43.30 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 09 May 2017 11:43:31 -0700 (PDT) To: Alan DeKok References: Cc: IETF OOPSAWG , "opsawg-chairs@ietf.org" From: Ignas Bagdonas Message-ID: Date: Tue, 9 May 2017 19:43:30 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [OPSAWG] Serious concerns with draft-ietf-opsawg-tacacs-06 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 May 2017 18:43:36 -0000 Hi Alan, Based on the information received from authors while tracking the progress of the draft, they intend to publish a revised version covering the comments received during the previous WGLC timeframe. WG chairs are not for waving a stick at the WG in trying to tell what a document needs to do to progress. While the WG document is formally owned by the WG, it is for the authors to do the actual text editing work and track and credit the changes in the text. Please initiate a discussion with authors, ideally on the list, on how your comments were or were not resolved. Quite many of past instances of such discussions were happening before, and they eventually have moved the document forward. Continuing with that discussion would be the right approach to take. Please also discuss the aspects of lack of credit for the text that you have proposed. Contributed changes need to be credited, on what level - that is for the document authors and editors to agree and decide. Looking further, there will be a new WG last call coming out after the revised version is posted. Usual WG LC discussion and commenting procedures will be followed. Thank you again for reviewing and improving the document. Ignas On 09/05/2017 18:41, Alan DeKok wrote: > I've taken a look at the latest draft, and have some serious concerns. > > Specifically, large chunks of the Security Considerations sections appear to have been lifted from my post to the list: > > https://mailarchive.ietf.org/arch/msg/opsawg/tU2wBFIV4MkpKChWn6EvrqeZtXU > > There are minor edits, but multiple sentences are copied word for word. Sentences which don't occur in the -05 draft, but do appear in my review, and subsequently are copied to the -06 draft with minor edits. > > Multiple paragraphs are copied with only minor edits. The total amounts to about a page of text. > > While I appreciate that the document is improving, blatant copying of my text without attribution is entirely inappropriate. > > What are the chairs recommendations? > > Alan DeKok. > > > _______________________________________________ > OPSAWG mailing list > OPSAWG@ietf.org > https://www.ietf.org/mailman/listinfo/opsawg From nobody Tue May 9 12:10:20 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 941FE12953F for ; Tue, 9 May 2017 12:10:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.002 X-Spam-Level: X-Spam-Status: No, score=-0.002 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pXdcujVw_qCF for ; Tue, 9 May 2017 12:10:16 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 93FD21274D0 for ; Tue, 9 May 2017 12:10:16 -0700 (PDT) Received: from [192.168.20.197] (CPEf4cc552207f0-CM00fc8dce0fa0.cpe.net.cable.rogers.com [99.230.129.191]) by mail.networkradius.com (Postfix) with ESMTPSA id CBFAE5A8; Tue, 9 May 2017 19:10:12 +0000 (UTC) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Alan DeKok In-Reply-To: Date: Tue, 9 May 2017 15:10:10 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <93551F76-868D-4CB8-9161-65B21A2C1E85@deployingradius.com> References: To: Ignas Bagdonas , IETF OOPSAWG X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [OPSAWG] Serious concerns with draft-ietf-opsawg-tacacs-06 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 May 2017 19:10:19 -0000 On May 9, 2017, at 2:43 PM, Ignas Bagdonas = wrote:, >=20 >=20 > Based on the information received from authors while tracking the = progress of the draft, they intend to publish a revised version covering = the comments received during the previous WGLC timeframe. I made no statements about my comments and their inclusion in the = draft. But since you brought it up, I think the document is still nowhere = near ready for publication. Many comments have been addressed, but many = have not been addressed. I question the utility of having a WGLC when the draft *still* doesn't = adequately describe the protocol. > WG chairs are not for waving a stick at the WG in trying to tell what = a document needs to do to progress. The draft must document the protocol. > While the WG document is formally owned by the WG, it is for the = authors to do the actual text editing work and track and credit the = changes in the text. I find it surprising that text was copied without attribution. This = just shouldn't happen. > Please initiate a discussion with authors, ideally on the list, on how = your comments were or were not resolved. As the list archive shows, I've done that. It also shows little in = the way of responses. The last response to my review was "Many thanks Alan for the thorough = review. We=B9ll collate all your comments and respond shortly." That was six months ago, and there has been no further response. Given the extensive nature of my reviews, I would suggest it's not = *my* responsibility to double-check each rev of the document to see if = my comments are addressed. What I've seen in other WGs is that the authors respond to comments = with clarifications, suggested replacement text, etc. That pretty much = hasn't happened here. > Quite many of past instances of such discussions were happening = before, and they eventually have moved the document forward. Continuing = with that discussion would be the right approach to take. That's what I'm asking for. That's not what's happening. Instead, new revs of the draft come out, with minimal interaction with = the WG. > Looking further, there will be a new WG last call coming out after the = revised version is posted. Usual WG LC discussion and commenting = procedures will be followed. I would suggest that it's too early to have a WGLC, as the authors = simply haven't responded to reviews of the draft. i.e. I have no idea what state the draft is in. After doing multiple = detailed reviews that largely get ignored, I'm not inclined to do more. = It's up to the authors to demonstrate that the comments have been = addressed. Alan DeKok. From nobody Tue May 9 15:37:42 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A789129C73; Tue, 9 May 2017 15:37:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sjyjzQA0CHsF; Tue, 9 May 2017 15:37:38 -0700 (PDT) Received: from mail-wr0-x229.google.com (mail-wr0-x229.google.com [IPv6:2a00:1450:400c:c0c::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F8DB126BFD; Tue, 9 May 2017 15:37:38 -0700 (PDT) Received: by mail-wr0-x229.google.com with SMTP id l50so19043680wrc.3; Tue, 09 May 2017 15:37:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to:content-transfer-encoding; bh=nvnkS6DFNl6dybL7VzTkSsDPrEQ8BgCHmxUMvtpmVYs=; b=NADstwmE9a7FeipOq4lPLACMScn/5qIM8jpVsKMA/fElNbzwCZqphXz6ZVkwepyQ0Z /4PFJ0BpA3MEELbx24PdLTvUZWw7NBqopjeSPwPMYX24zMwMv2eDy26VccpFoMqBWMzk yjP7MAiXdOsC+/x8k1IsWC+c4ND/OiHCzPyiSGVPRgfhKJQp6VZRi41vmvKGtZzsjSUY Y+v7OtUzDn/i7VybSydrC9OrqpV7JYFmAUJatGDiFprogtlr/e2QRB/1pE9AqmpAyGR8 qoQrNby44plNnVL9VnQzeUlVEITJLw2uGwiOxi2FEFP/Ov9FlJGriRlE9v5eB4bm03YX 6sZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=nvnkS6DFNl6dybL7VzTkSsDPrEQ8BgCHmxUMvtpmVYs=; b=kRgaMc+WJlK799Y7GBoSyydhlPWcqXkTyxleqiGvfP84X493lxJ24oxDMIA3yz/UZn ceZKgfDX3Lpi0tntgRiRw96M8h4+RYbj37EcODeK1gtO7x0EGdqksO9PFaNQhwEqItwY tuDweQP9pCbgkomTRXF7+oupCjMItnxSbEry68NsyCknEzXOsy77h7V31Oiu5mL0gvxh zORThseIy0q3jac+9mkVE/PaQiyHspTmKPFq/qSVAim3keynyrHVs26z/bVrKMCt4P6p mb/Bf3JSbqNFxdIxE38T+qy8dGOQ/UyIuqLWYx2JTKmGTkVfXwO2fiVqaCeFC85F4+p2 2jew== X-Gm-Message-State: AODbwcAz5ya6wI2bQUrR2J/vuceJT+b71Tim8/oCvSkxrmkf6yjovd5m /1yJnl577atTHw== X-Received: by 10.223.160.219 with SMTP id n27mr1556941wrn.201.1494369456731; Tue, 09 May 2017 15:37:36 -0700 (PDT) Received: from [10.0.18.52] ([213.16.86.179]) by smtp.gmail.com with ESMTPSA id x64sm1194379wrb.10.2017.05.09.15.37.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 09 May 2017 15:37:35 -0700 (PDT) To: Alan DeKok References: <93551F76-868D-4CB8-9161-65B21A2C1E85@deployingradius.com> Cc: IETF OOPSAWG , "opsawg-chairs@ietf.org" From: Ignas Bagdonas Message-ID: <0fe32a2c-633b-5c85-64ed-5fb40b3e4e69@gmail.com> Date: Tue, 9 May 2017 23:37:34 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: <93551F76-868D-4CB8-9161-65B21A2C1E85@deployingradius.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [OPSAWG] Serious concerns with draft-ietf-opsawg-tacacs-06 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 May 2017 22:37:40 -0000 On 09/05/2017 20:10, Alan DeKok wrote: > On May 9, 2017, at 2:43 PM, Ignas Bagdonas wrote:, >> >> Based on the information received from authors while tracking the progress of the draft, they intend to publish a revised version covering the comments received during the previous WGLC timeframe. > I made no statements about my comments and their inclusion in the draft. > > But since you brought it up, I think the document is still nowhere near ready for publication. Many comments have been addressed, but many have not been addressed. > > I question the utility of having a WGLC when the draft *still* doesn't adequately describe the protocol. WGLC is for bringing the attention for finalizing the outstanding issues. If there are too many issues or they are too deep - that is fine, it is always possible to go back and do another WGLC later if needed. The version that will go into WGLC is still not published therefore at this time it is just a speculation whether that particular version will or will not describe the protocol adequately. We need to wait for the authors to do their part and then it will be visible. >> WG chairs are not for waving a stick at the WG in trying to tell what a document needs to do to progress. > The draft must document the protocol. > >> While the WG document is formally owned by the WG, it is for the authors to do the actual text editing work and track and credit the changes in the text. > I find it surprising that text was copied without attribution. This just shouldn't happen. That is correct. Authors are aware of this and it is under their decision and responsibility to resolve this. >> Please initiate a discussion with authors, ideally on the list, on how your comments were or were not resolved. > As the list archive shows, I've done that. It also shows little in the way of responses. > > The last response to my review was "Many thanks Alan for the thorough review. We¹ll collate all your comments and respond shortly." > > That was six months ago, and there has been no further response. > > Given the extensive nature of my reviews, I would suggest it's not *my* responsibility to double-check each rev of the document to see if my comments are addressed. > > What I've seen in other WGs is that the authors respond to comments with clarifications, suggested replacement text, etc. That pretty much hasn't happened here. I agree with the facts and indeed the communication could have been better, and I understand the negative sentiments from your side. However it does not seem to be practical to try to escalate this in the rush at the timescale of days given that it already took half a year. Authors are aware of this discussion, it is their turn now to produce the new revision (which by the word of authors should be coming within a few weeks), and then if the new revision still does not address your concerns we would need to revisit this discussion again. Your reviews are definitely appreciated and valuable, it is the following up with them still has room for improvement. >> Quite many of past instances of such discussions were happening before, and they eventually have moved the document forward. Continuing with that discussion would be the right approach to take. > That's what I'm asking for. That's not what's happening. > > Instead, new revs of the draft come out, with minimal interaction with the WG. > >> Looking further, there will be a new WG last call coming out after the revised version is posted. Usual WG LC discussion and commenting procedures will be followed. > I would suggest that it's too early to have a WGLC, as the authors simply haven't responded to reviews of the draft. > > i.e. I have no idea what state the draft is in. After doing multiple detailed reviews that largely get ignored, I'm not inclined to do more. It's up to the authors to demonstrate that the comments have been addressed. Authors have the next step to do at this time. Let's wait for the new revision first. Ignas > Alan DeKok. > > From nobody Tue May 9 18:26:53 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7749212EBA6 for ; Tue, 9 May 2017 18:26:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.799 X-Spam-Level: X-Spam-Status: No, score=0.799 tagged_above=-999 required=5 tests=[BAYES_50=0.8, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d_MBS4kep92i for ; Tue, 9 May 2017 18:26:50 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id C7AFF127A90 for ; Tue, 9 May 2017 18:26:50 -0700 (PDT) Received: from [192.168.120.42] (23-233-24-114.cpe.pppoe.ca [23.233.24.114]) by mail.networkradius.com (Postfix) with ESMTPSA id D2C172DF; Wed, 10 May 2017 01:26:49 +0000 (UTC) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Alan DeKok In-Reply-To: <0fe32a2c-633b-5c85-64ed-5fb40b3e4e69@gmail.com> Date: Tue, 9 May 2017 21:26:48 -0400 Cc: IETF OOPSAWG Content-Transfer-Encoding: quoted-printable Message-Id: <03E3A465-1336-40DF-994F-686ADAC0653F@deployingradius.com> References: <93551F76-868D-4CB8-9161-65B21A2C1E85@deployingradius.com> <0fe32a2c-633b-5c85-64ed-5fb40b3e4e69@gmail.com> To: Ignas Bagdonas X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [OPSAWG] Serious concerns with draft-ietf-opsawg-tacacs-06 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 May 2017 01:26:52 -0000 On May 9, 2017, at 6:37 PM, Ignas Bagdonas = wrote: > WGLC is for bringing the attention for finalizing the outstanding = issues. If there are too many issues or they are too deep - that is = fine, it is always possible to go back and do another WGLC later if = needed. I've already brought attention to issues. =46rom my cursory reading = of the draft, many haven't been addressed. WGLC is also a signal that a draft is close to being ready for = publication. I don't think we're anywhere near a WGLC for this draft. > I agree with the facts and indeed the communication could have been = better, and I understand the negative sentiments from your side. However = it does not seem to be practical to try to escalate this in the rush at = the timescale of days given that it already took half a year. Using text without attribute is the problem. Insinuating that I'm = trying to "rush" an escalation is just not appropriate. Especially = because the "timescale of days" is something I never mentioned. > Authors are aware of this discussion, it is their turn now to produce = the new revision (which by the word of authors should be coming within a = few weeks), If only there was a public mailing list where people could discuss = these issues... >> i.e. I have no idea what state the draft is in. After doing = multiple detailed reviews that largely get ignored, I'm not inclined to = do more. It's up to the authors to demonstrate that the comments have = been addressed. >=20 > Authors have the next step to do at this time. Let's wait for the new = revision first. It's also possible to respond publicly to my review. Alan DeKok. From nobody Wed May 10 01:39:07 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFE30127599 for ; Wed, 10 May 2017 01:39:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.08 X-Spam-Level: X-Spam-Status: No, score=0.08 tagged_above=-999 required=5 tests=[BAYES_50=0.8, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FK9znFBpA9xw for ; Wed, 10 May 2017 01:39:04 -0700 (PDT) Received: from lb2-smtp-cloud2.xs4all.net (lb2-smtp-cloud2.xs4all.net [194.109.24.25]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2FEE5120227 for ; Wed, 10 May 2017 01:39:03 -0700 (PDT) Received: from Macintosh-4.fritz.box ([IPv6:2001:981:602b:1:21fd:930:f7c6:c82d]) by smtp-cloud2.xs4all.net with ESMTP id JYf01v00C356Gxu01Yf16D; Wed, 10 May 2017 10:39:01 +0200 To: Alan DeKok , Ignas Bagdonas References: <93551F76-868D-4CB8-9161-65B21A2C1E85@deployingradius.com> <0fe32a2c-633b-5c85-64ed-5fb40b3e4e69@gmail.com> <03E3A465-1336-40DF-994F-686ADAC0653F@deployingradius.com> Cc: IETF OOPSAWG From: "Bert Wijnen (IETF)" Message-ID: <8cc037f4-3b37-021d-b9bf-388f5a3aa722@bwijnen.net> Date: Wed, 10 May 2017 10:39:01 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: <03E3A465-1336-40DF-994F-686ADAC0653F@deployingradius.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [OPSAWG] Serious concerns with draft-ietf-opsawg-tacacs-06 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 May 2017 08:39:06 -0000 Let me express my support for Alan's statement below. If a WG participant makes comments and posts them to the list, then it is most appropriate that the authors (anyone in fact) respond and discuss them on the list with suggestions for how to fix or improve the text. Public discussion is preferred, but not mandatory (sometimes private discussion between authors and the person(s) who see issues/concern can help resolve things too). But then when the private discussion comes to resolution/agreement, then it seems best to me to then also post that to the mailing list. my 2 cents, Bert Bert On 10/05/2017 03:26, Alan DeKok wrote: >>> i.e. I have no idea what state the draft is in. After doing multiple detailed reviews that largely get ignored, I'm not inclined to do more. It's up to the authors to demonstrate that the comments have been addressed. >> Authors have the next step to do at this time. Let's wait for the new revision first. > It's also possible to respond publicly to my review. > > Alan DeKok. From nobody Fri May 12 11:44:16 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6BEDB129437; Fri, 12 May 2017 11:44:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -12.624 X-Spam-Level: X-Spam-Status: No, score=-12.624 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9W_q2RZZY0Sw; Fri, 12 May 2017 11:44:07 -0700 (PDT) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3418D127B5A; Fri, 12 May 2017 11:40:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2666; q=dns/txt; s=iport; t=1494614409; x=1495824009; h=from:to:cc:subject:date:message-id:content-id: content-transfer-encoding:mime-version; bh=schljBFveQMVOGhN/osNMRDZTElbnu7f0ve6/bA83Vc=; b=RbMbBJu8s+WZAnhherj96Mn+9cAJVMW4Asjg01qmSpc/+SRTHx0XjP0h BO+3aUQ/5gb2A9okvGuKirk6Y/oOtkwvNBV+/sS40gqWCFamLQAU5sfxT w5e04GrT8rCHfnMMzwxBpEkEQRcpxEuqxdsnjvl+3TEnMK9nW6v9opmzw A=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DJAACNABZZ/5JdJa1SChoBAQEBAgEBA?= =?us-ascii?q?QEIAQEBAYNVgXWNfKdSgg+GJIUbPxgBAgEBAQEBAQFrHQuGGBIBgQAnBA6KKLE?= =?us-ascii?q?yik8BAQEBAQUBAQEBJJAMBwsBhg4FkGWGCocbAYpQiEqCBIU7iiyIf4tDAR84f?= =?us-ascii?q?wtwFUaGdYczgSGBDQEBAQ?= X-IronPort-AV: E=Sophos;i="5.38,330,1491264000"; d="scan'208";a="244659521" Received: from rcdn-core-10.cisco.com ([173.37.93.146]) by rcdn-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 12 May 2017 18:40:08 +0000 Received: from XCH-ALN-015.cisco.com (xch-aln-015.cisco.com [173.36.7.25]) by rcdn-core-10.cisco.com (8.14.5/8.14.5) with ESMTP id v4CIe82B003099 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 12 May 2017 18:40:08 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-ALN-015.cisco.com (173.36.7.25) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Fri, 12 May 2017 13:40:07 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1210.000; Fri, 12 May 2017 13:40:07 -0500 From: "Douglas Gash (dcmgash)" To: "opsawg@ietf.org" CC: "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" , "ops-ads@ietf.org" Thread-Topic: draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIg== Date: Fri, 12 May 2017 18:40:07 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.0.161029 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.1.6] Content-Type: text/plain; charset="iso-8859-1" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 May 2017 18:44:08 -0000 Dear Working Group, We wanted to respond to recent posts regarding the TACACS+ informational draft, and update on status and intent: 1) Regarding the use of uncredited text from Alan DeKok: It is certainly the case that Alan has spent time actively engaged in the process of critiquing this document to improve it, and provided numerous proposed textual suggestions,. We would be very happy to acknowledge Alan=B9s contribution to the document by adding wording that is agreeable t= o Alan, in the next draft. In fact not having this acknowledgement for Alan=B9s contribution so far was an oversight, for which we apologise to Alan. However at this time we do not have plans to change the list of authors. Alan: if you feel that we have exploited your suggestions too fully, such that an acknowledgement in the document would be unsatisfactory recompense, then we are happy to consider removing all text that you identify, that you feel is derived too closely from your work. 2) Definition of Done We note that there is still comments along the lines that the document is not ready, in that the protocol is still not adequately described. We would like to make sure that the next version does adequately describe the protocol.=20 Rather than to chase a cycle of comment/response, we=B9d like to see if we can determine what the =B3Definition of Done=B2 checklist and metrics would be, by which we can measure that the content is be acceptable for the WG for such a protocol as TACACS+. For example, as a start point for this, I think we can define: 1. The packet formats: defining fields and their constraints 2. Identification of fields whose values have meaning for protocol flow. This will include error and fail fields. The way that these fields influence the flow must be documented. 3. Identification of the fields which have a common meaning, but are not intended to direct protocol flow. 4. Identification of fields whose values have meaning in terms of the deployment, which would simply be listed. If there are other aspects of the protocol, whose absence would mean that the protocol is not fully described, we would welcome input to help us. 3) Next Steps: We have two next steps: 3.1) We will produce a new revision correcting the issues such as the email address of Lol Grant and the above mentioned acknowledgement of Alan, and incorporate lessons from 2) above. 3.2) We will provide a summary of the changes between the original draft spec from 1998 and the new draft. If this status/plan is not in order, please let us know. Many thanks! Best Regards. The authors. From nobody Fri May 12 12:52:01 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82D7812EBF1; Fri, 12 May 2017 12:51:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jCvfREHpS5Dj; Fri, 12 May 2017 12:51:57 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 39AF612EC13; Fri, 12 May 2017 12:47:21 -0700 (PDT) Received: from [192.168.20.231] (CPEf4cc552207f0-CM00fc8dce0fa0.cpe.net.cable.rogers.com [99.230.129.191]) by mail.networkradius.com (Postfix) with ESMTPSA id E30FD5A8; Fri, 12 May 2017 19:47:19 +0000 (UTC) Content-Type: text/plain; charset=iso-8859-1 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Alan DeKok In-Reply-To: Date: Fri, 12 May 2017 15:47:18 -0400 Cc: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" , "ops-ads@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> References: To: "Douglas Gash (dcmgash)" X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 May 2017 19:52:00 -0000 On May 12, 2017, at 2:40 PM, Douglas Gash (dcmgash) = wrote: > 1) Regarding the use of uncredited text from Alan DeKok: >=20 > It is certainly the case that Alan has spent time actively engaged in = the > process of critiquing this document to improve it, and provided = numerous > proposed textual suggestions,. We would be very happy to acknowledge > Alan=B9s contribution to the document by adding wording that is = agreeable to > Alan, in the next draft. In fact not having this acknowledgement for > Alan=B9s contribution so far was an oversight, for which we apologise = to > Alan. Thank you. > However at this time we do not have plans to change the list of = authors. I will note that document authors serve at the discretion of the WG / = chairs / AD. > Alan: if you feel that we have exploited your suggestions too fully, = such > that an acknowledgement in the document would be unsatisfactory > recompense, then we are happy to consider removing all text that you > identify, that you feel is derived too closely from your work. It would generally seem to be better to acknowledge people who have = contributed substantially to the draft, instead of removing and = re-writing their text. The point of the draft is to have a documented protocol, not to = artificially limit the set of authors. > 2) Definition of Done >=20 > We note that there is still comments along the lines that the document = is > not ready, in that the protocol is still not adequately described. We > would like to make sure that the next version does adequately describe = the > protocol.=20 >=20 > Rather than to chase a cycle of comment/response, we=B9d like to see = if we > can determine what the =B3Definition of Done=B2 checklist and metrics = would > be, by which we can measure that the content is be acceptable for the = WG > for such a protocol as TACACS+. As I've suggested and others have agreed, what people want is a = response to reviews. > For example, as a start point for this, I think we can define: Since drafts proceed to RFC via WG consensus, I would suggest that not = responding to reviews is a de facto admission that the draft does not = have WG consensus. > 1. The packet formats: defining fields and their constraints > 2. Identification of fields whose values have meaning for protocol = flow. > This will include error and fail fields. The way that these fields > influence the flow must be documented. > 3. Identification of the fields which have a common meaning, but are = not > intended to direct protocol flow. > 4. Identification of fields whose values have meaning in terms of the > deployment, which would simply be listed. All of these topics and more are addressed in my reviews. > If there are other aspects of the protocol, whose absence would mean = that > the protocol is not fully described, we would welcome input to help = us. I've given you input, which has largely been ignored. > 3) Next Steps: >=20 > We have two next steps: >=20 > 3.1) We will produce a new revision correcting the issues such as the > email address of Lol Grant and the above mentioned acknowledgement of > Alan, and incorporate lessons from 2) above. > 3.2) We will provide a summary of the changes between the original = draft > spec from 1998 and the new draft. i.e. you won't bother to respond to reviews, you want the WG to read = the draft again to see if the comments have been addressed. Again, drafts get published based on WG consensus. Ignoring WG = consensus is just bad practice, and unproductive. At this point, I'm done. I oppose any and all publication of this = draft until such time as the authors can demonstrate that they've = addressed concerns raised here. I will continue to respond to Q&A about my reviews, but I see no = benefit in reviewing new versions of the draft. Alan DeKok. From nobody Fri May 12 23:21:40 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3A50129BA1; Fri, 12 May 2017 23:21:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.523 X-Spam-Level: X-Spam-Status: No, score=-14.523 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WEDu79QWnr9j; Fri, 12 May 2017 23:21:37 -0700 (PDT) Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0FD2C129AD8; Fri, 12 May 2017 23:19:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5872; q=dns/txt; s=iport; t=1494656354; x=1495865954; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=ZJZcFgwi4Ac6EWqUYun4khCriCZZORWpxcmq1GC1krU=; b=hNjxq2kB1DM0eO8EirQQGUSRk7QXfYfc6+3sYWKrNDCWTd6EhzNU3bk5 AgCYC5eKDjr3ojnTxUfrVwLE53wYZ3XbFT6fQOceEst5QWXU1hwpjVrv/ OPTfw52TauUsPjhFbKlTku0k2CYp/mTHF8MaB94Golr5rThJ3ZbX5HvId Q=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0D6AAAgpBZZ/5FdJa1RChkBAQEBAQEBA?= =?us-ascii?q?QEBAQcBAQEBAYNVgW4Hg2SKGKdUgg+GJAIahH8/GAECAQEBAQEBAWsohRkGNEU?= =?us-ascii?q?QAgEIHCgCAjAlAgQOBYojkHudWAaCKIpJAQEBAQEBAQEBAQEBAQEBAQEBIIEFi?= =?us-ascii?q?lOENAcFBgEcF4J1gmYFlm+HGwGTGoIEiSGGRpRCAR84fwtwFUaGdXaGMA4XgQq?= =?us-ascii?q?BDQEBAQ?= X-IronPort-AV: E=Sophos;i="5.38,333,1491264000"; d="scan'208";a="425871687" Received: from rcdn-core-9.cisco.com ([173.37.93.145]) by alln-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 13 May 2017 06:19:12 +0000 Received: from XCH-ALN-012.cisco.com (xch-aln-012.cisco.com [173.36.7.22]) by rcdn-core-9.cisco.com (8.14.5/8.14.5) with ESMTP id v4D6JCOi017172 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Sat, 13 May 2017 06:19:12 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-ALN-012.cisco.com (173.36.7.22) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Sat, 13 May 2017 01:19:12 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1210.000; Sat, 13 May 2017 01:19:12 -0500 From: "Douglas Gash (dcmgash)" To: Alan DeKok CC: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" , "ops-ads@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHxblMAgADBTAA= Date: Sat, 13 May 2017 06:19:12 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> In-Reply-To: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.0.161029 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.1.6] Content-Type: text/plain; charset="euc-kr" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 May 2017 06:21:39 -0000 SGkgQWxhbiwNCg0KU28gb3VyIHJlc3BvbnNlIHRvIHlvdXIgcmV2aWV3cyBoYXMgYmVlbiB0byBp bmNvcnBvcmF0ZSwgd2hlcmUgZmVhc2libGUsDQphbmQgd2hlcmUgd2UgY2FuIGFwcGx5IHRoZW4s IHRvIHRoZSBkb2MuDQoNCldvdWxkIHlvdSBoYXZlIGEgcHJlZmVycmVkIG1ldGhvZCB0aGF0IHdl IHJlc3BvbmRlZD8NCg0KVGhhbmtzLg0KDQoNCk9uIDEyLzA1LzIwMTcgMjA6NDcsICJBbGFuIERl S29rIiA8YWxhbmRAZGVwbG95aW5ncmFkaXVzLmNvbT4gd3JvdGU6DQoNCj5PbiBNYXkgMTIsIDIw MTcsIGF0IDI6NDAgUE0sIERvdWdsYXMgR2FzaCAoZGNtZ2FzaCkgPGRjbWdhc2hAY2lzY28uY29t Pg0KPndyb3RlOg0KPj4gMSkgUmVnYXJkaW5nIHRoZSB1c2Ugb2YgdW5jcmVkaXRlZCB0ZXh0IGZy b20gQWxhbiBEZUtvazoNCj4+IA0KPj4gSXQgaXMgY2VydGFpbmx5IHRoZSBjYXNlIHRoYXQgQWxh biBoYXMgc3BlbnQgdGltZSBhY3RpdmVseSBlbmdhZ2VkIGluDQo+PnRoZQ0KPj4gcHJvY2VzcyBv ZiBjcml0aXF1aW5nIHRoaXMgZG9jdW1lbnQgdG8gaW1wcm92ZSBpdCwgYW5kIHByb3ZpZGVkIG51 bWVyb3VzDQo+PiBwcm9wb3NlZCB0ZXh0dWFsIHN1Z2dlc3Rpb25zLC4gV2Ugd291bGQgYmUgdmVy eSBoYXBweSB0byBhY2tub3dsZWRnZQ0KPj4gQWxhbqn2cyBjb250cmlidXRpb24gdG8gdGhlIGRv Y3VtZW50IGJ5IGFkZGluZyB3b3JkaW5nIHRoYXQgaXMgYWdyZWVhYmxlDQo+PnRvDQo+PiBBbGFu LCBpbiB0aGUgbmV4dCBkcmFmdC4gSW4gZmFjdCBub3QgaGF2aW5nIHRoaXMgYWNrbm93bGVkZ2Vt ZW50IGZvcg0KPj4gQWxhbqn2cyBjb250cmlidXRpb24gc28gZmFyIHdhcyBhbiBvdmVyc2lnaHQs IGZvciB3aGljaCB3ZSBhcG9sb2dpc2UgdG8NCj4+IEFsYW4uDQo+DQo+ICBUaGFuayB5b3UuDQo+ DQo+PiBIb3dldmVyIGF0IHRoaXMgdGltZSB3ZSBkbyBub3QgaGF2ZSBwbGFucyB0byBjaGFuZ2Ug dGhlIGxpc3Qgb2YgYXV0aG9ycy4NCj4NCj4gIEkgd2lsbCBub3RlIHRoYXQgZG9jdW1lbnQgYXV0 aG9ycyBzZXJ2ZSBhdCB0aGUgZGlzY3JldGlvbiBvZiB0aGUgV0cgLw0KPmNoYWlycyAvIEFELg0K Pg0KPj4gQWxhbjogaWYgeW91IGZlZWwgdGhhdCB3ZSBoYXZlIGV4cGxvaXRlZCB5b3VyIHN1Z2dl c3Rpb25zIHRvbyBmdWxseSwNCj4+c3VjaA0KPj4gdGhhdCBhbiBhY2tub3dsZWRnZW1lbnQgaW4g dGhlIGRvY3VtZW50IHdvdWxkIGJlIHVuc2F0aXNmYWN0b3J5DQo+PiByZWNvbXBlbnNlLCB0aGVu IHdlIGFyZSBoYXBweSB0byBjb25zaWRlciByZW1vdmluZyBhbGwgdGV4dCB0aGF0IHlvdQ0KPj4g aWRlbnRpZnksIHRoYXQgeW91IGZlZWwgaXMgZGVyaXZlZCB0b28gY2xvc2VseSBmcm9tIHlvdXIg d29yay4NCj4NCj4gIEl0IHdvdWxkIGdlbmVyYWxseSBzZWVtIHRvIGJlIGJldHRlciB0byBhY2tu b3dsZWRnZSBwZW9wbGUgd2hvIGhhdmUNCj5jb250cmlidXRlZCBzdWJzdGFudGlhbGx5IHRvIHRo ZSBkcmFmdCwgaW5zdGVhZCBvZiByZW1vdmluZyBhbmQNCj5yZS13cml0aW5nIHRoZWlyIHRleHQu DQo+DQo+ICBUaGUgcG9pbnQgb2YgdGhlIGRyYWZ0IGlzIHRvIGhhdmUgYSBkb2N1bWVudGVkIHBy b3RvY29sLCBub3QgdG8NCj5hcnRpZmljaWFsbHkgbGltaXQgdGhlIHNldCBvZiBhdXRob3JzLg0K Pg0KPj4gMikgRGVmaW5pdGlvbiBvZiBEb25lDQo+PiANCj4+IFdlIG5vdGUgdGhhdCB0aGVyZSBp cyBzdGlsbCBjb21tZW50cyBhbG9uZyB0aGUgbGluZXMgdGhhdCB0aGUgZG9jdW1lbnQNCj4+aXMN Cj4+IG5vdCByZWFkeSwgaW4gdGhhdCB0aGUgcHJvdG9jb2wgaXMgc3RpbGwgbm90IGFkZXF1YXRl bHkgZGVzY3JpYmVkLiBXZQ0KPj4gd291bGQgbGlrZSB0byBtYWtlIHN1cmUgdGhhdCB0aGUgbmV4 dCB2ZXJzaW9uIGRvZXMgYWRlcXVhdGVseSBkZXNjcmliZQ0KPj50aGUNCj4+IHByb3RvY29sLiAN Cj4+IA0KPj4gUmF0aGVyIHRoYW4gdG8gY2hhc2UgYSBjeWNsZSBvZiBjb21tZW50L3Jlc3BvbnNl LCB3Zan2ZCBsaWtlIHRvIHNlZSBpZiB3ZQ0KPj4gY2FuIGRldGVybWluZSB3aGF0IHRoZSCp+ERl ZmluaXRpb24gb2YgRG9uZan3IGNoZWNrbGlzdCBhbmQgbWV0cmljcyB3b3VsZA0KPj4gYmUsIGJ5 IHdoaWNoIHdlIGNhbiBtZWFzdXJlIHRoYXQgdGhlIGNvbnRlbnQgaXMgYmUgYWNjZXB0YWJsZSBm b3IgdGhlIFdHDQo+PiBmb3Igc3VjaCBhIHByb3RvY29sIGFzIFRBQ0FDUysuDQo+DQo+ICBBcyBJ J3ZlIHN1Z2dlc3RlZCBhbmQgb3RoZXJzIGhhdmUgYWdyZWVkLCB3aGF0IHBlb3BsZSB3YW50IGlz IGENCj5yZXNwb25zZSB0byByZXZpZXdzLg0KPg0KPj4gRm9yIGV4YW1wbGUsIGFzIGEgc3RhcnQg cG9pbnQgZm9yIHRoaXMsIEkgdGhpbmsgd2UgY2FuIGRlZmluZToNCj4NCj4gIFNpbmNlIGRyYWZ0 cyBwcm9jZWVkIHRvIFJGQyB2aWEgV0cgY29uc2Vuc3VzLCBJIHdvdWxkIHN1Z2dlc3QgdGhhdCBu b3QNCj5yZXNwb25kaW5nIHRvIHJldmlld3MgaXMgYSBkZSBmYWN0byBhZG1pc3Npb24gdGhhdCB0 aGUgZHJhZnQgZG9lcyBub3QNCj5oYXZlIFdHIGNvbnNlbnN1cy4NCj4NCj4+IDEuIFRoZSBwYWNr ZXQgZm9ybWF0czogZGVmaW5pbmcgZmllbGRzIGFuZCB0aGVpciBjb25zdHJhaW50cw0KPj4gMi4g SWRlbnRpZmljYXRpb24gb2YgZmllbGRzIHdob3NlIHZhbHVlcyBoYXZlIG1lYW5pbmcgZm9yIHBy b3RvY29sIGZsb3cuDQo+PiBUaGlzIHdpbGwgaW5jbHVkZSBlcnJvciBhbmQgZmFpbCBmaWVsZHMu IFRoZSB3YXkgdGhhdCB0aGVzZSBmaWVsZHMNCj4+IGluZmx1ZW5jZSB0aGUgZmxvdyBtdXN0IGJl IGRvY3VtZW50ZWQuDQo+PiAzLiBJZGVudGlmaWNhdGlvbiBvZiB0aGUgZmllbGRzIHdoaWNoIGhh dmUgYSBjb21tb24gbWVhbmluZywgYnV0IGFyZSBub3QNCj4+IGludGVuZGVkIHRvIGRpcmVjdCBw cm90b2NvbCBmbG93Lg0KPj4gNC4gSWRlbnRpZmljYXRpb24gb2YgZmllbGRzIHdob3NlIHZhbHVl cyBoYXZlIG1lYW5pbmcgaW4gdGVybXMgb2YgdGhlDQo+PiBkZXBsb3ltZW50LCB3aGljaCB3b3Vs ZCBzaW1wbHkgYmUgbGlzdGVkLg0KPg0KPiAgQWxsIG9mIHRoZXNlIHRvcGljcyBhbmQgbW9yZSBh cmUgYWRkcmVzc2VkIGluIG15IHJldmlld3MuDQo+DQo+PiBJZiB0aGVyZSBhcmUgb3RoZXIgYXNw ZWN0cyBvZiB0aGUgcHJvdG9jb2wsIHdob3NlIGFic2VuY2Ugd291bGQgbWVhbg0KPj50aGF0DQo+ PiB0aGUgcHJvdG9jb2wgaXMgbm90IGZ1bGx5IGRlc2NyaWJlZCwgd2Ugd291bGQgd2VsY29tZSBp bnB1dCB0byBoZWxwIHVzLg0KPg0KPiAgSSd2ZSBnaXZlbiB5b3UgaW5wdXQsIHdoaWNoIGhhcyBs YXJnZWx5IGJlZW4gaWdub3JlZC4NCj4NCj4+IDMpIE5leHQgU3RlcHM6DQo+PiANCj4+IFdlIGhh dmUgdHdvIG5leHQgc3RlcHM6DQo+PiANCj4+IDMuMSkgV2Ugd2lsbCBwcm9kdWNlIGEgbmV3IHJl dmlzaW9uIGNvcnJlY3RpbmcgdGhlIGlzc3VlcyBzdWNoIGFzIHRoZQ0KPj4gZW1haWwgYWRkcmVz cyBvZiBMb2wgR3JhbnQgYW5kIHRoZSBhYm92ZSBtZW50aW9uZWQgYWNrbm93bGVkZ2VtZW50IG9m DQo+PiBBbGFuLCBhbmQgaW5jb3Jwb3JhdGUgbGVzc29ucyBmcm9tIDIpIGFib3ZlLg0KPj4gMy4y KSBXZSB3aWxsIHByb3ZpZGUgYSBzdW1tYXJ5IG9mIHRoZSBjaGFuZ2VzIGJldHdlZW4gdGhlIG9y aWdpbmFsIGRyYWZ0DQo+PiBzcGVjIGZyb20gMTk5OCBhbmQgdGhlIG5ldyBkcmFmdC4NCj4NCj4g IGkuZS4geW91IHdvbid0IGJvdGhlciB0byByZXNwb25kIHRvIHJldmlld3MsIHlvdSB3YW50IHRo ZSBXRyB0byByZWFkDQo+dGhlIGRyYWZ0IGFnYWluIHRvIHNlZSBpZiB0aGUgY29tbWVudHMgaGF2 ZSBiZWVuIGFkZHJlc3NlZC4NCj4NCj4gIEFnYWluLCBkcmFmdHMgZ2V0IHB1Ymxpc2hlZCBiYXNl ZCBvbiBXRyBjb25zZW5zdXMuICBJZ25vcmluZyBXRw0KPmNvbnNlbnN1cyBpcyBqdXN0IGJhZCBw cmFjdGljZSwgYW5kIHVucHJvZHVjdGl2ZS4NCj4NCj4NCj4gIEF0IHRoaXMgcG9pbnQsIEknbSBk b25lLiAgSSBvcHBvc2UgYW55IGFuZCBhbGwgcHVibGljYXRpb24gb2YgdGhpcw0KPmRyYWZ0IHVu dGlsIHN1Y2ggdGltZSBhcyB0aGUgYXV0aG9ycyBjYW4gZGVtb25zdHJhdGUgdGhhdCB0aGV5J3Zl DQo+YWRkcmVzc2VkIGNvbmNlcm5zIHJhaXNlZCBoZXJlLg0KPg0KPiAgSSB3aWxsIGNvbnRpbnVl IHRvIHJlc3BvbmQgdG8gUSZBIGFib3V0IG15IHJldmlld3MsIGJ1dCBJIHNlZSBubw0KPmJlbmVm aXQgaW4gcmV2aWV3aW5nIG5ldyB2ZXJzaW9ucyBvZiB0aGUgZHJhZnQuDQo+DQo+DQo+ICBBbGFu IERlS29rLg0KPg0KDQo= From nobody Sat May 13 05:01:00 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CE8D129492; Sat, 13 May 2017 05:00:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.002 X-Spam-Level: X-Spam-Status: No, score=-0.002 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lKJxIwaRXVr2; Sat, 13 May 2017 05:00:57 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 408131294D8; Sat, 13 May 2017 04:59:14 -0700 (PDT) Received: from [192.168.120.42] (23-233-24-114.cpe.pppoe.ca [23.233.24.114]) by mail.networkradius.com (Postfix) with ESMTPSA id 452D66DC; Sat, 13 May 2017 11:59:13 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Alan DeKok In-Reply-To: Date: Sat, 13 May 2017 07:59:11 -0400 Cc: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" , "ops-ads@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> To: "Douglas Gash (dcmgash)" X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 May 2017 12:00:59 -0000 On May 13, 2017, at 2:19 AM, Douglas Gash (dcmgash) = wrote: >=20 > So our response to your reviews has been to incorporate, where = feasible, > and where we can apply then, to the doc. >=20 > Would you have a preferred method that we responded? I told you my preferred method. Others have agreed that it's the = preferred method. If you're reading messages on this list, that question has already = been answered. You've been given detailed reviews of the draft. Instead of = responding to the reviews, you've issued a new revision. Then, you want = the reviewers to verify that the new draft addresses their concerns. That's not the right approach.. The approach in the IETF is to have authors move towards WG consensus. = i.e. to prove to to the WG that the draft is ready for publication. If you're not going to work towards WG consensus, I suggest the chairs = replace you with authors who will. Alan DeKok. From nobody Sat May 13 10:24:16 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FFBB12AF84 for ; Sat, 13 May 2017 10:24:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.012 X-Spam-Level: X-Spam-Status: No, score=-0.012 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=direcpathcorp.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pdOkf2CI9UVz for ; Sat, 13 May 2017 10:24:11 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0050.outbound.protection.outlook.com [104.47.41.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C1B3D127342 for ; Sat, 13 May 2017 10:21:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=direcpathcorp.onmicrosoft.com; s=selector1-direcpath-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=HIZTSBShrplTl31QzEjYtbvzQy7zHkrQCwIcnMzgl5Q=; b=JXuIXKKFQwj1euSC0mK5VD5/qnPTOBqLU2HhfLVRhCj707sGdaK/HjSJgUguHMxKr+bxUGIxoa973CXk/4p4h2Mjk/oljQPTfC5wfrzuNWNdolFlDgsIFsD5rccgRNVGJHPnIj+r3/jePHSbpYQR945g98+7rJUyOPkrGojdZJw= Authentication-Results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=direcpath.com; Received: from [IPv6:2607:f1e8:f0f0:5:a055:bc88:8ab:56d7] (2607:f1e8:f0f0:5:a055:bc88:8ab:56d7) by DM2PR0101MB0893.prod.exchangelabs.com (2a01:111:e400:3c04::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1084.16; Sat, 13 May 2017 17:21:40 +0000 To: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> From: Robert Drake Message-ID: <733ad85f-203e-e252-046f-402af2f230c8@direcpath.com> Date: Sat, 13 May 2017 13:21:43 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.1.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US X-Originating-IP: [2607:f1e8:f0f0:5:a055:bc88:8ab:56d7] X-ClientProxiedBy: BN3PR03CA0099.namprd03.prod.outlook.com (2603:10b6:400:4::17) To DM2PR0101MB0893.prod.exchangelabs.com (2a01:111:e400:3c04::17) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 0a0ecd41-9259-42b1-0a57-08d49a248516 X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(201703131423075)(201703031133081); SRVR:DM2PR0101MB0893; X-Microsoft-Exchange-Diagnostics: 1; DM2PR0101MB0893; 3:IUqvjmtCY/fCvALKykaQmk/QI2WFAr/YYVKBIFn255ISWWwU8nB1MR77mRKjlO+fotiNkgbILv8dWKhXMP1UJvf7ZmiQUkHS9KXfRXNrlXpMWSgyt2B4WZPcbmXkao9PlfjF2gNMyLaOcCAVf+Kk80QeCDkNcQ6/6cCu2IXTZ8emqY7AJdp8d01df3KWKMUABw4ed50xsEj5u+NYxQRCEDespquTsTl+2AGyTGdwH0NuyDvgj9uc97/gHMumcZyPh2tOq/b+zZI2TPnFEdgzrqbWtmmc3InAsoOKekONBk3ULAM5WNcKv9xlknkpJ5sAkeroUhLarSb19JgUp9EnhA==; 25:HvPTIGuCRVFYpKq0AStZp6PHFsHQ4DeicIoKfVabBVASm70azTCjwTsaNnLv0Mg0LAm+PcoEJ5eJzWAt7XC+gtWtwvb3WtANV6TFcpGASa9ghhAgK4fWj7Gwm9/5QNThOuQjsl4uoeICsKMG0jcgRIehPOGGRPCGR6kvT5YspYo5ybrLuOBSzWNMo5HdZgFu/DsuJ+XcVNEbygDnHLZuA2Vumsq7EzQKqW3WgNiBKhgj15DwN949vLV8H4Fjv2gNBA7KDshPKmkFCxdzL5xTfin/vdpy3VtcUMAFilaygF/RUafVC4x5I1b+FgGslgWr/YXUsJyezaRmKH2o0DayZhbxLyy+1ASgj6Sqgf+sdIfjCcbP/w4H99/MuSUI6ikn9DzlusDSnjg+XitJId4ht5xaGB/M2jSU6NxYLeygi9OhyohRjhOQnhHqI34wyfTHyhqa1JG6ds+b16hvo53OPcayiwy7IwVNUArOy78B9+U= X-Microsoft-Exchange-Diagnostics: 1; DM2PR0101MB0893; 31:eJ9xkvk+kNhRBxVU16zFq6roPfBhdh47oBqdYAQzcrwmbYHwAsD7eKScpW8ADPWS+dcLKFNsxJDkox8pdk/bFxNpBYKj2iLjpduYAlsWx86gT9Gu/Qde5pCUzjjaMwGKTtwv2wXpovohv32nWMzhkI0vbk6BTHEDZxUpCxXPSdJikGqmtMwR4TVY9y2zJmY/W3Su7XYP5UXjFnEbIMsVizQYXgplyKjnfee7J6EiQBmVUr/Y/98sfP1LGy1THE7EsZeKRuGGuFu2WDWKDFUZ9A== X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(788757137089)(100405760836317); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040450)(2401047)(8121501046)(5005006)(10201501046)(3002001)(93006095)(93001095)(6041248)(20161123555025)(20161123560025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(20161123562025)(6072148); SRVR:DM2PR0101MB0893; BCL:0; PCL:0; RULEID:; SRVR:DM2PR0101MB0893; X-Microsoft-Exchange-Diagnostics: 1; DM2PR0101MB0893; 4:j7mDE3+0eYFkgJ2iALqxUzraUusDvturJSgS3F2cfEKd1KNLepp+rVBe+fBTeEKj/za2zqYQwUWZ9EaGIjqqTDf25BXo4p8XSyjBFRXipo72aQDrJddacWJc6kPfX0GfHVSLyMY9FppQiET6zkVoOl2aRAKLYM9a6LzuKGjHyyjgAsNo2gMlvUv8feVZePV/R8RTpnDKO2ypu4l/+hWVKbwr6SJUmvtuZyA15O60v0XwSjf2m3GgFcCbAj1ed4pEHbuxXdVFLcEM3o6Unq7IgOC33xIAOypClSdt68l6R9pDnhu9w8Ut+GPthKOtJ8U/9VrMFaQGS4neHnnRquRH/JkFsuz6Ib0NuBxjO7gkS5N5OaOntpgjEWXcyPgUx4RijqPudI0Z3FgywIPWEHDwY2y9a4bgLPd8z2srpB65QUeeCL5Mip2u9GQD0xme7oNR1iSvVcZ+0kCbWMk0wNRQff63vIb89IFadI6iUIR/EaExoVoPQWKodvjyPuuxqAf5fHY0/OydVZRl7uE4WFUZXp1uUEwN87L3RjmDnaGhD7UEy1efxHjO8rk6mLcEXYtEWVWzT3alaFxH9juf3RQ8jvvbe+kXA2MCAocenK1RqVUJKQGIicHuK4Hh5HBAqeYwLhqtb6kqn57wCqEJoSdGSCazfuyr5fefXcVehNt4F6hrQgG5qYByHLj9GPHncjR9+1WOf9nq6sCOqkI+bFDkj28jcm2/NLjVzLqV48dPohjdYeevpPk4sq3NapXtcO+tUVPoc+rfKI/aocGgOX2h2/xKVgTOa82xZFkW57MOBFbsSfMlezC++wy+/CAbUzSs9Z8TNbaA1FSKY+DRex8AjQ== X-Forefront-PRVS: 0306EE2ED4 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(4630300001)(6009001)(39400400002)(39410400002)(39450400003)(39830400002)(24454002)(377454003)(53546009)(42186005)(25786009)(36756003)(31686004)(33646002)(6116002)(86362001)(305945005)(2351001)(31696002)(81166006)(230700001)(8676002)(7736002)(189998001)(6486002)(4001350100001)(50466002)(64126003)(23676002)(65806001)(478600001)(47776003)(230783001)(38730400002)(93886004)(110136004)(2906002)(6246003)(76176999)(50986999)(53936002)(54356999)(6916009)(229853002)(83506001)(5660300001)(2950100002)(65826007); DIR:OUT; SFP:1101; SCL:1; SRVR:DM2PR0101MB0893; H:[IPv6:2607:f1e8:f0f0:5:a055:bc88:8ab:56d7]; FPR:; SPF:None; MLV:sfv; LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtETTJQUjAxMDFNQjA4OTM7MjM6MU5KVndkRnVWSTZVa2piYmJTejhZTHBB?= =?utf-8?B?RUFrUjNWdkVGK2EwWUN0TEtNOWExUWNFaDBJOEFFT29WaXMzTlNqbXZWa1A3?= =?utf-8?B?ZHJEN3JaSVZtUFpPWlE1blREK0dMeGFZOWNJS3pKZmVkcmF3Z3VaZnk1emlE?= =?utf-8?B?TEtIT2hGV1RuSzFEeWQ2Wk9GdVB0N2VrQ2hNeVovWW5tbFJDdVJ3ZFF0RDNZ?= =?utf-8?B?aEdIWFEvY011dmNlQjAycklGZEMyWGdhUDltRU41cFVaRG1jNUdyRXo0cDRt?= =?utf-8?B?a211UFE4d0dYYXFBa1FDb1l6a3ZvT1RWaG10UStZZVZnTmMwaFNnZTNZYUFJ?= =?utf-8?B?TFdsNUQwM0J4VTE2QmEzMnUzeDZ2a1JWMENUQktLK3FwSnRIcFRUVzlzSit6?= =?utf-8?B?RGxrVVV2ZXhiaDF0WWpPc1pKbS8xdG14ekFob0I1ekEvbEFCL0tBSWdSTGtH?= =?utf-8?B?VVY5MUNXMXJteDVTTm9mL242UmZXaGVOR3pjUEwyL3VKaUY4ZUNoSm5jU1Jt?= =?utf-8?B?OTlkb1FhWUtONlNWN1ZXWEJNTk9WMm4zbVBaZXR3cnB2QnRVSlUxWWw3OERS?= =?utf-8?B?MUJnQndIRktPUDlGRjN3bG5Ra1pWcXE0L2NRbFZhVUx2bURKSVJvbWVXOWxX?= =?utf-8?B?UktNUjdFNmpCZk5mNXU3bW9uVWQ4LzJ2cnBId2ExemprWnMyTitPcy9XZjh5?= =?utf-8?B?SDk1SjJnTDNkZUgxMldNVGg4dlpjYmVuMmtwTUJPdGZ3VDlhRTFyUmJjdE0w?= =?utf-8?B?bHZXNGJZSXppVUsyT2lzRlJuNXFjWHRrcXBYTytFVlFJSGpKZVdiZEdDcENi?= =?utf-8?B?N0k4cFhsRGQ0ZXlpa0JlNWxrT2ZlcEExNGZpeDVucHAwUm01WjJENW9HL3pH?= =?utf-8?B?QkR6ZGl3R014OFNNRnkrNGR4Tkh0bVpXZUQvTVBxS3h5WHpvNEllMXN1bXNX?= =?utf-8?B?bDFUT0c1ZG9Ua0VHeUppRFl2Zjk1K2xTOHZEN3NyVWFEL1M4Q0xNY21UWFIy?= =?utf-8?B?TWZpWUZhSDNUNGN4OEVtb29jeFZ1Q1l0alJBY3Rwd3diRjN2SGlaeG4walVy?= =?utf-8?B?RGtjWmh5b2FTdlNGa2JINEpQdW1qUWVNQ3R0THpGZHN5QitISnkzZTVDWVZ2?= =?utf-8?B?ZUQ3UnZNNit0c0RudDZqQWNDZXJqQndIWUM3TEdjWEFWNThWYTBjTTRBb3l3?= =?utf-8?B?Y0xuTnVYU0ZzKzIyR2tKKy90eDZLL0pCYlNnTVZHY2NXVHpieGdiWURmSXgv?= =?utf-8?B?cDVBV3BOdmd1NnRTQ0NnTXBIdGpkdC9jL1hGRjdTTVhLeTMrbFlTak1GYlF0?= =?utf-8?B?RTN3ekdJVTdsRVgxMjJXZDhjZGxCaFU3cW5VbHQvWU5FWHNycVVsc01wYkJP?= =?utf-8?B?ZjBEK3ZkL0dzbU9UR1ZhNUdLMFUxQ3QzRHl2VTNuUytKUXBIcTk4Ymx1ZklE?= =?utf-8?B?RmYyYWN0azVBK0wyU1B1ZEVUbTc0MHM4Qm41NmhQQW53ZVZFTjNCTmY1K2VE?= =?utf-8?B?djlWaVh4dHpjTkp3MmFiRHpGeWQ2U2JjbWx4MG41NmlXRGRyZlg1NFNSaEJr?= =?utf-8?B?a3d2Rnc1U0JGREI4S3FxOENCNjQyZDNnSGZaQkxtQ1cvRldNOGhGUndrbGxQ?= =?utf-8?Q?5z/y8/Dy1KAAjqz/eLu8fw?= X-Microsoft-Exchange-Diagnostics: 1; DM2PR0101MB0893; 6:fZxr9pDECkewPQ/8ONW2RQqs8d4cDF3DZLxRqB32snPVFufujtB/IrhIFetFkrt5K1pCQk6pZTOMBelOAZ3F6jp2CJw2tmsOhCKyz5SGzRkOyw5c8EYJ+cyMZbnVQPcEbsrjG6IVxeQIAabw/0Hnn78gw5CU83cF87WgoX1P5X6Bs3OcCtbJsEMdP+SXKp4XnpaZKpdKj70ug+Pp5OtjL7PaIprtqiIKV54iU1EbDslljNJP33mdJPEsK9HN2JWYXOWlSDHAAAPXV6vysWXHpCFVkIrHjMIspwwMo+ScAiLl8LeN/Lt/oyYTLhNn53MjPr3FRxqwRwD8SoeJEF9b7+YFOAfP7ybvlXHochyYDNRfJTeOTg25F1KqhAua/uDKeHU0UcHEtRGMKsME+Nb8Vn0VV3f5XQgfZFYDA1qwvDaato8BysTy9XjhDXRifqUqSrFN86v6TuROnW6lS/M97s2tmgDDRZJDMj4OIeSGo1oGonUZOqwRjPkJztDzDJEZJeSN5jbfC9D4eytbDp83kw==; 5:k0EMbOl83mEV44UI37GHNKJ/vR6VshUKpDDxbn2S0LwuRNqaPELZ5g3p1jzT3sGEZvBXeSYhwTmQOJi+Q1RrHZsWq+F+mU40O/YPAWOdZwFWX+clDnW43Z+LwXRh0a2OSdaD8GeD1OaD7788qTo0Yg==; 24:ZGZXqG42iWrGAydew+aLF5WH34o0Lv/OwgcCY0W1UHMGnXEinfip5qSPpIvzL5lFDTTKdBnxq4W+Mtaeb7TJdtD9wV2ABcG9q2qm63EhKFQ= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; DM2PR0101MB0893; 7:ZQN9szlabyZ/7kdfQYg06Sx1f165ovXZoY0uzIYU3MAOExqTChlP+ZQTE+k7KNfh3I3Eb6TFG6bVkQZxwBgxfD94pjC/a8ifduX3LU/vSATkoWx5Y0P7ZYtWvNsCkMTHUtABLQl68DwMOQwbqb9h5YYnKwxKgual4QLey4bjU2eWPnaGlx3Bh+TmG9AVCqf6KxaMv0hjd4s2+Js0qudWUmiLk3jOmsbTE4mRCeyljB9xtP4IUJSg7UQnwmjUb1QHTwD8PfwAr5UR5igAJajmXKYxP9a2Zz2KuIbv+xAXWmb2CKL/U9W/Tx8x2D3H+OWn2FrX0BnLYAva8/ceImN9dQ== X-OriginatorOrg: direcpath.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 May 2017 17:21:40.6865 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR0101MB0893 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 May 2017 17:24:15 -0000 On 5/13/2017 7:59 AM, Alan DeKok wrote: > If you're not going to work towards WG consensus, I suggest the chairs replace you with authors who will. That seems unnecessarily rude. This draft is still about documenting the existing tacacs+ protocol right? Why? You've been discussing this thing for a year and can't reach a consensus about an existing protocol. I doubt very strongly that a completed document will be useful to anyone. Nobody needs this to implement the existing protocol. My personal belief is that extending the protocol isn't a good idea anymore. Instead just rewrite it to use HTTPS/TLS transport with JSON/XML encoding. That should cut out about half of the documentation in the draft. The new protocol doesn't have to run on the same port. It could use 443 or whatever the user declares in the connection URI. Vendors could leave their existing tacacs+ client in the code until people don't need it anymore. Servers could be adapted to support both protocols. The most important thing to me is that something gets created. This should be moving from a thought experiment to a reference implementation so that people can comment on the details. From nobody Sat May 13 12:07:57 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E44F612EAFA; Sat, 13 May 2017 12:07:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.523 X-Spam-Level: X-Spam-Status: No, score=-14.523 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TAleiGGGtm4h; Sat, 13 May 2017 12:07:54 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0DF38129C59; Sat, 13 May 2017 12:03:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1239; q=dns/txt; s=iport; t=1494702229; x=1495911829; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=JsWsmmH9Ts2wraAR1eazJJbssrthHA0E6jamtg2h96w=; b=V+6jjZ80SdQmDfih0CJ7nXMNgI/n/haoX2/pjOJR9Ml+h2RZoJCZW+4s aCh6ru08zrgSbdJFeCcQxLay6LlaB+TLwu5X/X+sNxypVBjgY7QqQQoQF qSQaL3ok/VUPY5fYtn0XzljmfKF0b9hVtx9eS23UdzLNeqefprlRKyn+s o=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CXAABRWBdZ/5tdJa1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBg1WBbgeNfKdRgg+GJAKFGT8YAQIBAQEBAQEBayiFGQZ5EAIBCEY?= =?us-ascii?q?yJQIEDgWKI7AuikQBAQEBAQEBAQEBAQEBAQEBAQEBAQEdi1iKVQEEkGWNJQGTG?= =?us-ascii?q?pFrlEIBHziBCnAVRoZ2dogIgQ0BAQE?= X-IronPort-AV: E=Sophos;i="5.38,336,1491264000"; d="scan'208";a="27006370" Received: from rcdn-core-4.cisco.com ([173.37.93.155]) by rcdn-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 13 May 2017 19:03:26 +0000 Received: from xch-rcd-011.cisco.com (xch-rcd-011.cisco.com [173.37.102.21]) by rcdn-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id v4DJ3PF7021175 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Sat, 13 May 2017 19:03:26 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-RCD-011.cisco.com (173.37.102.21) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Sat, 13 May 2017 14:03:25 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1210.000; Sat, 13 May 2017 14:03:25 -0500 From: "Douglas Gash (dcmgash)" To: Alan DeKok CC: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" , "ops-ads@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHxblMAgADBTACAAE4+gIAAh0UA Date: Sat, 13 May 2017 19:03:25 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.0.161029 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.1.6] Content-Type: text/plain; charset="iso-8859-1" Content-ID: <2C039534BC03AA44A0DF5A1EB246DAE0@emea.cisco.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 May 2017 19:07:56 -0000 Hi Alan, So rather than directly updating the doc, we=B9re looking for an individual response to each item. That is doable, we=B9ll start putting that together. On 13/05/2017 12:59, "Alan DeKok" wrote: >On May 13, 2017, at 2:19 AM, Douglas Gash (dcmgash) >wrote: >>=20 >> So our response to your reviews has been to incorporate, where feasible, >> and where we can apply then, to the doc. >>=20 >> Would you have a preferred method that we responded? > > I told you my preferred method. Others have agreed that it's the >preferred method. > > If you're reading messages on this list, that question has already been >answered. > > You've been given detailed reviews of the draft. Instead of responding >to the reviews, you've issued a new revision. Then, you want the >reviewers to verify that the new draft addresses their concerns. > > That's not the right approach.. > > The approach in the IETF is to have authors move towards WG consensus. >i.e. to prove to to the WG that the draft is ready for publication. > > If you're not going to work towards WG consensus, I suggest the chairs >replace you with authors who will. > > Alan DeKok. > From nobody Sat May 13 12:23:16 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60B0612EAC2 for ; Sat, 13 May 2017 12:23:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.523 X-Spam-Level: X-Spam-Status: No, score=-14.523 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BxEaTc3sW89n for ; Sat, 13 May 2017 12:23:13 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4CED912EAFA for ; Sat, 13 May 2017 12:19:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2722; q=dns/txt; s=iport; t=1494703172; x=1495912772; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=H5xoUG9CTna0c+7+mDiRAtZPU4h427FPJQnwYC5h9k0=; b=HyMfIAbWiC/4uVouXaCyRduVOTxhirsQb+JtbCvjH1WaxzaaxxmrhSnK FnpnP034VjjFMmHRcccVtHYyo27H9NQo8pH0R2Ck56VBDXA3+uU06r+9t QmgXF6qaq1B5ACsfzh3XndK9LaNSaSycz5F0qPi16KFGMeMepgDEMgW+E Y=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CYAAC3WxdZ/5xdJa1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgyorYoEMB418kVyVdYIPIQuFLkoChRk/GAECAQEBAQEBAWsdC4U?= =?us-ascii?q?YAQEBAQMBAWwLEAIBCBEDAQIBLicLHQgCBA4FiiMOsBmKRAEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBARgFi1iEY4VyBYlEhyGGCocbAZMakWuUQgEfOIEKcBVGhnZ2iAi?= =?us-ascii?q?BDQEBAQ?= X-IronPort-AV: E=Sophos;i="5.38,336,1491264000"; d="scan'208";a="27009332" Received: from rcdn-core-5.cisco.com ([173.37.93.156]) by rcdn-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 13 May 2017 19:19:31 +0000 Received: from XCH-ALN-015.cisco.com (xch-aln-015.cisco.com [173.36.7.25]) by rcdn-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id v4DJJVvF026774 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Sat, 13 May 2017 19:19:31 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-ALN-015.cisco.com (173.36.7.25) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Sat, 13 May 2017 14:19:30 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1210.000; Sat, 13 May 2017 14:19:30 -0500 From: "Douglas Gash (dcmgash)" To: "rdrake@direcpath.com" CC: "opsawg@ietf.org" Thread-Topic: OPSAWG Digest, Vol 120, Issue 6 Thread-Index: AQHSzBs3RHEKR/N50ESYOLWiWdQY76HzCAcA Date: Sat, 13 May 2017 19:19:30 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.0.161029 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.1.6] Content-Type: text/plain; charset="iso-8859-1" Content-ID: <0CA2111D7EE64540A08185EB08CBEE6D@emea.cisco.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] OPSAWG Digest, Vol 120, Issue 6 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 May 2017 19:23:15 -0000 I like this idea! As it happens, the original motivation was simply to secure T+ and clean up the text of the original draft spec. We were less radical that moving to JSON (that=B9s a nice idea ;-)) we originally intended to support the ol= d protocol for backwards compatibility and add TLS for the much-needed security. However the consensus was reached in the WG instead for a two phased approach to document the plain protocol first and to follow up with a document which detailed securing the protocol. Rather than admitting simply that the protocol was insecure and how to fix it, we have taken a little longer than originally intended to complete the first phase. I suspect our efforts may get overtaken soon by de facto securing of T+ anyway... >------------------------------ > >Message: 4 >Date: Sat, 13 May 2017 13:21:43 -0400 >From: Robert Drake >To: >Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, > Status and Plans >Message-ID: <733ad85f-203e-e252-046f-402af2f230c8@direcpath.com> >Content-Type: text/plain; charset=3D"utf-8"; format=3Dflowed > > >On 5/13/2017 7:59 AM, Alan DeKok wrote: >> If you're not going to work towards WG consensus, I suggest the >>chairs replace you with authors who will. >That seems unnecessarily rude. > > >This draft is still about documenting the existing tacacs+ protocol >right? Why? > >You've been discussing this thing for a year and can't reach a consensus >about an existing protocol. I doubt very strongly that a completed >document will be useful to anyone. Nobody needs this to implement the >existing protocol. > >My personal belief is that extending the protocol isn't a good idea >anymore. Instead just rewrite it to use HTTPS/TLS transport with >JSON/XML encoding. That should cut out about half of the documentation >in the draft. The new protocol doesn't have to run on the same port. >It could use 443 or whatever the user declares in the connection URI. >Vendors could leave their existing tacacs+ client in the code until >people don't need it anymore. Servers could be adapted to support both >protocols. > >The most important thing to me is that something gets created. This >should be moving from a thought experiment to a reference implementation >so that people can comment on the details. > > > >------------------------------ > >Subject: Digest Footer > >_______________________________________________ >OPSAWG mailing list >OPSAWG@ietf.org >https://www.ietf.org/mailman/listinfo/opsawg > > >------------------------------ > >End of OPSAWG Digest, Vol 120, Issue 6 >************************************** From nobody Sun May 14 05:12:58 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 012641286B1; Sun, 14 May 2017 05:12:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.523 X-Spam-Level: X-Spam-Status: No, score=-14.523 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GdCS6j6MPMY5; Sun, 14 May 2017 05:12:49 -0700 (PDT) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D3AD012949F; Sun, 14 May 2017 05:11:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=45138; q=dns/txt; s=iport; t=1494763866; x=1495973466; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=0PHsKR3qzmzqhFVKMXbOQjVGpBlM1q+S6OrlolaqUzc=; b=DK/KoR0KIQrttBZwDbujUH1eJaH87hJQB648mko0IZgi7/qK75xDV8GU fuo6NwUfaYbSIKzTASrJEco0guZ+1onWG5nYewnpkxABkBCG5PtAQ8S3e b5ZXhoDuKD7Ojde8ONB1j0fbJBx0ovW0Vylf4uFpHDzMq7du0Ade7V40T o=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DWAABhSBhZ/5xdJa1WBhkBAQEBAQEBA?= =?us-ascii?q?QEBAQcBAQEBAYNVgRRhjXynUoIPgm6DNgJEhFU/GAECAQEBAQEBAWsohRkGGgE?= =?us-ascii?q?fHxMKAxACAQgtAQEBBhAyJQIECgSKKLARikEBAQEBAQEBAwEBAQEBAQEBIIg9g?= =?us-ascii?q?g+BDIRNAgYVMQcJAQWFJAWJOgOGZYFZhHSHGwGKUIMbhS+CBIU7g2aGRoh/i0M?= =?us-ascii?q?BHziBCnAVRoRyAgMBG2MBfgGHNAEBBAkXgQqBDQEBAQ?= X-IronPort-AV: E=Sophos;i="5.38,340,1491264000"; d="scan'208";a="248779896" Received: from rcdn-core-5.cisco.com ([173.37.93.156]) by rcdn-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 14 May 2017 12:11:04 +0000 Received: from XCH-ALN-015.cisco.com (xch-aln-015.cisco.com [173.36.7.25]) by rcdn-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id v4ECB55N010954 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Sun, 14 May 2017 12:11:05 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-ALN-015.cisco.com (173.36.7.25) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Sun, 14 May 2017 07:11:04 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1210.000; Sun, 14 May 2017 07:11:04 -0500 From: "Douglas Gash (dcmgash)" To: Alan DeKok CC: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" , "ops-ads@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHxblMAgADBTACAAE4+gIAAh0UAgAEfG4A= Date: Sun, 14 May 2017 12:11:03 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.0.161029 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.1.6] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 May 2017 12:12:53 -0000 Dear Alan, Below is a simple textual concatenation and minor (hopefully lossless) edit of comments you kindly sent for the October revision (version 5), We will work through this list, and reply with an item-by item response, (In place of previous mode of updating the doc to make v6) and then hopefully move towards a consensus for the content for version 7. Thanks, Regards, Doug. ... Some comments. Mostly little nits and clarifications. The major points for me are related to security. The "Security Considerations" section is almost empty, and will certainly not pass a review from the security area. They will in all likelihood block publication until substantive comments have been added. ------ 3.3. Single Connect Mode The packet header (see below) contains a flag to allow sessions to be multiplexed on a connection. * it would be good to name the flag here. If the server sets this flag in the first reply packet in response to the first packet from a client, this indicates its willingness to support single-connection over the current connection. The server may set this flag even if the client does not set it, but the client is under no obligation to honor it. * what happens if the client does not honour the flag? The flag is only relevant for the first two packets on a connection, to allow the client and server to establish single connection mode. The flag MUST be ignored after these two packets since the single- connect status of a connection, once established, must not be changed. The connection must instead be closed and a new connection opened, if required. Why would it be required to change the mode? It would be good to explain the use-cases, and why (or not) they make sense. TAC_PLUS_UNENCRYPTED_FLAG :=3D 0x01 If this flag is set, then body encryption is not used. If this flag is cleared, the packet is encrypted. Unencrypted packets are intended for testing, and are not recommended for normal use. * it would be good to have a pointer to the security considerations, with a discussion of the implications. * Also, it's odd that a completely insecure mode is just "not recommended for normal use". I would suggest more panic-inducing phrasing. e.g. ."Unencrypted packets offer a complete compromise of all security related to the protocol and MUST NOT be used outside of a testing environment" TAC_PLUS_SINGLE_CONNECT_FLAG :=3D 0x04 This flag is ussequernt, ed to allow a client and server to agree whether multiple sessions may be multiplexed onto a single connection. * I find the "agree" phrasing odd. I've mentioned before that the tone of the document is often philosophical. Perhaps saying instead "this flag signals whether the client and server are capable of performing session multiplexing" * i.e. the flag is a signal, not a capability for the systems to agree. session_id The Id for this TACACS+ session. The session id is to be selected randomly. This field does not change for the duration of the TACACS+ session. (If this value is not a cryptographically strong random number, it will compromise the protocol's security, see RFC 1750 * it would be good to update the paragraph to be more prescriptive. i.e. The Id for this TACACS+ session. The session id MUST be taken fro a cryptographically strong random number generation. If not, the protocol's security will be compromised. See RFC 1750 for further information ... length The total length of the packet body (not including the header). This value is in network byte order. Packets are never padded beyond this length. * Why is the text on "padding" there? The TACACS+ packets are sent over TCP, not UDP. So any "padding" would be outside of the scope of the current packet, and be seen by the other end as a subsequent, but invalid, TACACS+ packet. 3.5 ... - Unused fixed length fields SHOULD have values of zero. * what happens when they don't? I suggest adding text saying that the fields are ignored. - There will be no padding in any of the fields or at the end of a packet. * I wonder again what "padding" means here. 3.6. Encryption The body of packets may be encrypted. ... * Which is not a standard encryption method. Security people will complain here. I suggest (as before) using the term "obfuscated". With a note that for historical reasons, the flags / fields / etc. refer to TACACS+ "encryption". ... This document does not discuss the management and storage of those keys. ... * there should be some discussion in the Security Considerations section about this. Otherwise, this subject will be brought up in the security review. ... It is an implementation detail of the server and client, as to whether they will maintain only one key, or a different key for each client or server with which they communicate. For security reasons, the latter options MUST be available, but it is a site dependent decision as to whether the use of separate keys is appropriate. * those sentences seem to disagree with each other. It's an "implementation detail", but it MUST be supported. I suggest requiring the capability of per-server and per-client keys. ... The session id is used in network byte order. * nit: if the session ID is a 32-bit opaque token, it's not in any byte order. Maybe just "as taken from the packet header" ? When a server detects that the secret(s) it has configured for the device mismatch, it MUST return ERROR. The handling of the TCP connection by the server is implementation independent. * I repeat my objection here. There is just no reason for the TCP connection to remain open after the connection has been determined to be fraudulent. This subject also came up in the RADIUS over TCP drafts. The consensus there was the same: if it's not a real / known / good client, there is every reason to close the connection, and zero reasons to keep it open. After a packet body is decrypted, the lengths of the component values in the packet are summed. If the sum is not identical to the cleartext datalength value from the header, the packet MUST be discarded, and an error signalled. The underlying TCP connection MAY also be closed, if it is not being used for other sessions in single- connect mode. * This last sentence is confusing. Are there different secrets for different packets in one TCP stream? If so, nothing in the document says so. If not, then there is every reason to believe that the secret is mismatched. And, the *next* packet will decrypt incorrectly. Which means (again) you might as well just close the TCP connection. If an error must be declared but the type of the incoming packet cannot be determined, a packet with the identical cleartext header but with a sequence number incremented by one and the length set to zero MUST be returned to indicate an error. * this mix of clear-text and encrypted signalling opens up the protocol to an attacker. Since this "NAK'" is not protected, an attacker can forge the NAK at any time, and force the connection to be closed. * this attack (along with all others) should be noted in the Security Considerations section. ... Packet fields are as follows: action This describes the authentication action to be performed. Legal values are: * what happens if a client/server receives values outside of the legal range? I suggest sending ERROR, and closing the TCP connection. * similar comments apply for other fields with "legal values". While it's good to define what happens when things go as planned, it's also good to define what happens when things *don't* go according to plan. * review of 4.2 and subsequent sections will follow in a later message. Summary: the spec is still fairly descriptive / philosophical instead of prescriptive. Many optional parts of the protocol are described, "A and B are allowed", but there is often no description of what to *do* when either A or B is present. I've suggested descriptive text, or places where descriptive text can be added. The larger worry here is what happens if the descriptive text conflicts with existing implementations? This is a topic which should be discussed in the "Security Considerations" section. i.e. the spec documents the existing protocol, with recommendations for security and inter-operability. As the protocol has historically been poorly specified, implementations are likely to follow the broad requirements of this specification. They are also likely to not follow many of the newly-clarified behaviours / requirements. The hope is that this specification can guide implementors towards a common understanding of the protocol. Also, vague requirements and open options in a protocol spec are ripe for implementation bugs and security issues. That worry drives many of my comments. ----- 4.2 ... server_msg, server_msg_len c A message to be displayed to the user. This field is optional. If it exists, it is intended to be presented to the user. US-ASCII charset MUST be used. The server_msg_len MUST indicate the length of the server_msg field, in bytes. * The last sentence is atypical of RFC 2119 language. Then language is typically about system behaviour or inter-field comparisons. I'm not sure what it means that a field MUST indicate a length. * i.e. the "server_msg_len" field is *defined* to encode the length of the "server_msg" field. No "MUST" is necessary. * similar comments apply to many of the other "foo_len" fields, elsewhere in the document rem_addr, rem_addr_len An US-ASCII string this is a "best effort" description of the remote location from which the user has connected to the client. * perhaps instead of "best effort", just re-use language from the "port" description. The contents of this field are the clients description of the remote location... 4.4 ... When the REPLY status equals TAC_PLUS_AUTHEN_STATUS_GETDATA, TAC_PLUS_AUTHEN_STATUS_GETUSER or TAC_PLUS_AUTHEN_STATUS_GETPASS, then authentication continues and the SHOULD provide server_msg * editorial: the WHAT should provide... ... quest for more information to flexibly support future requirements. If the TAC_PLUS_REPLY_FLAG_NOECHO flag is set in the REPLY, then the user response must not be echoed as it is entered. * the implicit assumption here is that there is a person who is entering text on a terminal. It would be good to have a bit more explanation of this expected use-case. NOTE: Only those requests which have changed from their minor_version 0 implementation (i.e. CHAP, MS-CHAP and PAP authentications) will use the new minor_version number of 1. All other requests (i.e. all authorisation and accounting and ASCII authentication) MUST continue to use the same minor_version number of 0. * that's an odd phrasing of the requirement. Perhaps something more prescriptive would be useful. e.g.: NOTE: Authentication requests which use ASCII login or chpass MUST use minor version 0. Authentication requests using PAP, CHAP, or MS-CHAP MUST use minor version 1. All authorization and accounting packets MUST use minor version 0. 4.4.2... This section describes common authentication flows. If the options are implemented, they MUST follow the description. If the server does not implement an option, it will respond with TAC_PLUS_AUTHEN_STATUS_ERROR. * It's not typically required to say that implementations MUST follow the spec. * also, perspective terminology is better than descriptive. Not "will do", but "MUST do". * I suggest re-phrasing: This section describes common authentication flows. If the server does not implement an option, it MUST respond with TAC_PLUS_AUTHEN_STATUS_ERROR. This is a standard ASCII authentication. The START packet may contain the username, but need not do so. * what happens when the username is / is-not included? i.e. what do implementations *do*? * if this is a valid protocol flow, then it should be described. e.g. "Any username in the START packet is ignored", or "any username in the START packet MUST match the username in subsequent packets" ... The data fields in both the START and CONTINUE packets are not used for ASCII logins. * what happens if there is data in the fields? Is it ignored? * RFC 2119 language is recommended here. "any data (if present) MUST be ignored", or "the data field MUST NOT be present" * I have no idea how to make these requirements compatible with existing implementations. Sorry... CHAP: The length of the challenge value can be determined from the length of the data field minus the length of the id (always 1 octet) and the length of the response field (always 16 octets). * it would be good to recommend a minimum length for challenge. 1 octet is clearly insufficient, but is (silently) allowed by the spec. I suggest at least 8 octets/ * also, the challenge MUST be derived from a cryptographically strong pseudo-random number generator, and MUST change on every CHAP request. Otherwise, the spec allows (also silently) a fixes challenge. To perform the authentication, the server will run MD5 over the id, the user's secret and the challenge, as defined in the PPP Authentication RFC 1334 and then compare that value with the response. * again "server WILL run". As opposed to "calculates..." MSCHAPv1 / MSCHAPv2: The length of the challenge value can be determined from the length of the data field minus the length of the id (always 1 octet) and the length of the response field (always 49 octets). * RFC 2433 says that the challenge is 8 octets. RFC 2759 says that the challenge is 16 octets. It would be good to re-iterate that here. * i.e. smaller challenges are insecure, and should be forbidden ... To perform the authentication, the server will use a the algorithm specified RFC2759 * editorial: "specified IN RFC ..." ... ASCII change password request * I suspect that the security area review will recommend that this be removed. Even RADIUS had "change password" removed at the behest of the security people. 4.4.3. Aborting an Authentication Session The client may prematurely terminate a session by setting the TAC_PLUS_CONTINUE_FLAG_ABORT flag in the CONTINUE message. If this flag is set, the data portion of the message may contain an ASCII message explaining the reason for the abort. * again, what happens if the field is / is-not present? * what does the server do with this message? Should it be logged somewhere? ... The session is terminated and no REPLY message is sent. * what happens to the TCP connection? Does it remain open? It may be good to say "The session is terminated, and the session Id is no longer valid. However, other sessions on the same TCP connection may continue..." The host is specified as either a fully qualified domain name, or an ASCII numeric IPV4 address specified as octets separated by dots ('.'), or IPV6 address test representation defined in RFC 4291. * editorial ".. text .. "representation, not "test" If a key is supplied, the client MAY use the key in order to authenticate to that host. The client may use a preconfigured key for the host if it has one. * so the server is pushing keys to clients? The security implications of this should be discussed * what happens if the client gets pushed a key, and then also has a pre-configured key? Which one takes precedence? Why? Continuing with 4.4.3 While the order of hosts in this packet indicates a preference, but the client is not obliged to use that ordering. * the use of "obliged" is unusual here. Perhaps "the order used by the client is implementation specific, and does not have to follow the order sent by the server" If the status equals TAC_PLUS_AUTHEN_STATUS_RESTART, then the authentication sequence is restarted with a new START packet from the client. ... * nit: it may be good to say that the next session does not have to use the current TCP connection * "restart" may also be ambiguous. Does the session ID change for the next session? It may be good to say instead "If the status equals TAC_PLUS_AUTHEN_STATUS_RESTART, then the client re-authenticates with a new session, beginning with a new START packet" ... This REPLY packet indicates that the current authen_type value (as specified in the START packet) is not acceptable for this session, but that others may be. * Which others "may" be acceptable? And why "acceptable for this session"? is the client free to re-try the same authentication type in a different session? i.e. what does the client *do*? * perhaps say "the REPLY indicates a negative acknowledgement that the current authen_type is not accepted by the server. The client SHOULD start a new session with a different authen_type" If a client chooses not to accept the TAC_PLUS_AUTHEN_STATUS_RESTART packet, then it is TREATED as if the status was TAC_PLUS_AUTHEN_STATUS_FAIL. * why uppercase "TREATED" ? * why "chooses not to accept" ? again, prescriptive is better than philosophical * Perhaps "If the client does not start a new session after receiving a TAC_PLUS_AUTHEN_STATUS_RESTART, it MUST behave as if it received a TAC_PLUS_AUTHEN_STATUS_FAIL." 5. Authorization ... The authorization REQUEST message contains a fixed set of fields that indicate how the user was authenticated or processed * nit: remove "or processed" * from a security point of view, it's unusual for a client to indicate to a server how a user was authenticated. This allows the client to claim authentication when none existed. ... This field matches the port field in the authentication section (Section 4) above * what is meant by "matches"? Perhaps "The definition of this field is the same as in Section 4". Or does the field in the authorization session have to contain the same data as the similar field from the authentication session? * similar comments apply for other uses of "matches" It is not legal for an attribute name to contain either of the separators. It is legal for attribute values to contain the separators. * what are the legal characters for an attribute name? The previous paragraph says US-ASCII. So is "($#@!" a legal attribute name? * a reference to Section 7 would be useful here. Optional arguments are ones that may be disregarded by either client or server. Mandatory arguments require that the receiving side understands the attribute and will act on it. If the client receives a mandatory argument that it cannot oblige or does not understand, it MUST consider the authorization to have failed. * "oblige" is an unusual word to use here. Perhaps "If the client receives a mandatory argument it cannot implement, it MUST consider the authorization to have failed" 5.2 The Authorization RESPONSE Packet Body ... server_msg, server_msg_len This is an US-ASCII string that may be presented to the user. The decision to present this message is client specific. * nit: perhaps "This field is a message from the server to the client. The client MAY display it to the user" * saying "decision is client specific" is a long way of saying "the client MAY do it", but doesn't always have to ... The attribute-value pair that describes the authorization to be performed. (see below), * That's not clear to me. Perhaps "if present, the list of additional authorizations permitted the user" If the status equals TAC_PLUS_AUTHOR_STATUS_FAIL, then the appropriate action is to deny the user action. * again, a bit more philosophical than prescriptive. Perhaps "If the status equals TAC_PLUS_AUTHOR_STATUS_FAIL, then the requested action MUST be denied" If the status equals TAC_PLUS_AUTHOR_STATUS_PASS_ADD, then the arguments specified in the request are authorized and the arguments in the response are to be used IN ADDITION to those arguments. * uppercase "IN ADDITION" is unusual. Perhaps: If the status equals TAC_PLUS_AUTHOR_STATUS_PASS_ADD, then the arguments specified in the request are authorized and the client MUST also enforce the authorization attribute-value pairs (if any) in the response. * similar comments apply here: If the status equals TAC_PLUS_AUTHOR_STATUS_PASS_REPL then the arguments in the request are to be completely replaced by the arguments in the response. * perhaps If the status equals TAC_PLUS_AUTHOR_STATUS_PASS_REPL then the client MUST use the authorization attribute-value pairs (if any) in the response, instead of any authorization attribute-value pairs from the request. ... If the intended action is to approve the authorization with no modifications, then the status is set to TAC_PLUS_AUTHOR_STATUS_PASS_ADD and the arg_cnt is set to 0. * should be prescriptive. Perhaps: Servers can signal to client that the authorization is approved with no modifications by setting the status to TAC_PLUS_AUTHOR_STATUS_PASS_ADD and the arg_cnt is set to 0. ... A status of TAC_PLUS_AUTHOR_STATUS_ERROR indicates an error occurred on the server. * what does the client do then? Perhaps "the client MAY show an error to the user (how???), and MUST treat the response as TAC_PLUS_AUTHOR_STATUS_FAIL" * Also, the last sentence of the subsequent paragraph also talks about ERROR, and seems misplaced. 6.1. The Account REQUEST Packet Body TACACS+ accounting is very similar to authorization. The packet format is also similar. * nit: that seems redundant. All of the packets use a common format. ... There is a fixed portion and an extensible portion. The extensible portion uses all the same attribute-value pairs that authorization uses, and adds several more. * except that the authorization section didn't list any attribute-value pairs. So it's hard to say that those (non-existent) pairs are re-used here All other fields are defined in the authorization and authentication sections above and have the same semantics. * Can an accounting packet indicate an authen_type and authen_service? If so, what does that mean? 6.2. The Accounting REPLY Packet Body The response to an accounting message is used to indicate that the accounting function on the server has completed. * what does that mean? Do servers always implement "functions"? As background, RFC 2866 (RADIUS accounting) says: ... Upon receipt of an Accounting-Request, the server MUST transmit an Accounting-Response reply if it successfully records the accounting packet, and MUST NOT transmit any reply if it fails to record the accounting packet. ... * perhaps similar text could be used here. ... The server will reply with success only when the record has been committed to the required level of security, * what is a "required level of security"? Is that indicated in the packet? Elsewhere? * my recommendation is just to delete that... ... relieving the burden on the client from ensuring any better form of accounting is required. * I find that statement awkward. Perhaps re-using / re-phrasing text from RFC 2866 would be good here. 6.2. The Accounting REPLY Packet Body * there's more duplication definition of fields here. It may be useful to just say "server_msg has the same meaning and behaviour as defined in Section 4.2" ... The server MUST terminate the session after sending a REPLY. * this is the only reference to a session being terminated in the document. What does it mean? Perhaps that the next REQUEST packet has to have a different session ID? If so, it would be good to say that in the REQUEST section. The TAC_PLUS_ACCT_FLAG_START flag indicates that this is a start accounting message. Start messages will only be sent once when a task is started. The TAC_PLUS_ACCT_FLAG_STOP indicates that this is a stop record and that the task has terminated. The TAC_PLUS_ACCT_FLAG_WATCHDOG flag means that this is an update record. Update records are sent at the client's discretion when the task is still running. * what's a "task" ? This is the first reference in the document to a "task". Perhaps more explanation here as to the expected use-case The START and STOP flags are mutually exclusive. When the WATCHDOG flag is set along with the START flag, it indicates that the update record is a duplicate of the original START record. * why would an update duplicate the original START record? This seems redundant. ... If the START flag is not set, then this indicates a minimal record indicating only that task is still running. * nit: perhaps delete "a minimal record indicating only". * Some more questions... * does the client retry an accounting packet if it doesn't get a response from the server? * how often do the updates get sent? Saying "implementation defined" is OK, but some recommendations would be good. i.e. not more than 100x per second, and not less than 1 day apart (as extreme examples) * I have similar questions about the TCP connection. What happens if a client can't connect to a server? How often should it retry? Should it treat "unable to connect" as "authentication / authorization fail"? Should the user be forbidden *all* access if the client cannot connect to the server? Should the user be given minimal access in order to be able to diagnose server connection problems? 7. Attribute-Value Pairs It is recommended that hosts be specified as a numeric address so as to avoid any ambiguities. * Is this IPv6 safe? I suspect not... but it should be stated Absolute times are specified in seconds since the epoch, 12:00am Jan 1 1970. The timezone MUST be UTC unless a timezone attribute is specified. * nit: perhaps "a decimal number representing seconds since..." except what about time zones? * how is a time zone specified? what format is the time? Examples would help here. * nit: the section defines numbers, booleans, hosts, and time. But no "text" type. RADIUS is just in the process of fixing this (20+ years later...), which is why I noticed * adding a data type to each attribute definition would be useful * also, it would be good to say which attributes are mandatory, and which are optional Attributes may be submitted with no value, in which case they consist of the name and the mandatory or optional separator. * this sounds like the separator is optional. Perhaps "... consist of the name and separator only" 7.1. Authorization Attributes ... a protocol that is a subset of a service. An example would be any PPP NCP. * nit: expand acronyms on first use. What's a "PPP NCP" ? cmd a shell (exec) command. This indicates the command name for a shell command that is to be run. This attribute MUST be specified if service equals "shell". If no value is present then the shell itself is being referred to. * perhaps a bit more explanation of the use-case here. What is a "shell" in reference to an administrative management protocol? routing A boolean. ... * note that "routing" is defined to be a boolean, but the other attributes don't have data types defined. I *think* "cmd" is a textual attribute, but it's not defined that way timeout an absolute timer for the connection (in minutes). A value of zero indicates no timeout. * probably "numeric" data type? autocmd an auto-command to run. Used only when service=3Dshell and cmd=3DNULL * it's confusing to have an explicit NULL in "cmd". Perhaps quotes would clarify it here. e.g. n auto-command to run. Used only when the packet contains attribute-values of "service=3Dshell" and "cmd=3D" noescape Boolean. ... * nit: consistent terminology. "Boolean" ? or "A boolean ..." ?? callback-dialstring Indicates that callback is to be done. Value is NULL, or a dialstring. A NULL value indicates that the service MAY choose to get the dialstring through other means. * nit: explicit NULL is confusing. Perhaps "value is a dial string, or when omitted, indicates that the server may choose to get the value via other means" * nit: what's a "dialstring" ? * what's a callback? How does that work? 7.2. Accounting Attributes ... The following new attributes are defined for TACACS+ accounting only. When these attribute-value pairs are included in the argument list, they will precede any attribute-value pairs that are defined in the authorization section (Section 5) above. * "will" precede? Perhaps "MUST precede" task_id Start and stop records for the same event MUST have matching task_id attribute values. The client must not reuse a specific task_id in a start record until it has sent a stop record for that task_id. * how big is the task_id? Since values can be omitted, is it OK to have a zero-length task_id? or 1 octet? * are there recommendations for the content of task_id? e.g. incrementing numbers, strings, etc. * is task_id mandatory to occur in accounting packets? start_time The time the action started (). * nit: what are the brackets for? stop_time The time the action stopped (in seconds since the epoch.) * which attributes are allowed in which packets? I presume it's not recommended to have a START which contains "stop_time" elapsed_time The elapsed time in seconds for the action. Useful when the device does not keep real time. * I'd recommend removing that last sentence. it also indicates that the device may not have accurate time, notwithstanding the definition of "absolute times" at the start of Section 7. bytes_in The number of input bytes transferred by this action * input to where? This was poorly specified in RADIUS, and some implementations got it wrong... * this number might be large. Should implementations allow 16 bit numbers? 32-bit? 64-bit? What are the expected / recommended limits? * i.e. implementations MUST be able to parse numbers up to 2^32, and SHOULD be able to parse numbers up to 2^64 status The numeric status value associated with the action. This is a signed four (4) byte word in network byte order. 0 is defined as success. Negative numbers indicate errors. Positive numbers indicate non-error failures. The exact status values may be defined by the client. * This is the first (and only) time that a field is defined as non-ASCII. That's very off. * nit: values "may" be defined by the client? Perhaps just saying "values are implementation specific" would be better ... Privilege Levels are ordered values from 0 to 15 with each level representing a privilege level that is a superset of the next lower value. * nit: perhaps this could be "each level is defined to be a superset of the next lower value", instead of "representing". If a client uses a different privilege level scheme, then it must map the privilege level to scheme above. * editorial :"... to A scheme..." * and how is mapping done? It might be better to just omit that sentence. Privilege Levels are applied in two ways in the TACACS+ protocol: * nit: perhaps "used" instead of "applied" - As an argument in authorization EXEC phase (when service=3Dshell and cmd=3DNULL), where it is primarily used to set the initial privilege level for the EXEC session. * how does that work? And what does it mean to set an initial privilege level? - In the packet headers for Authentication, Authorization and Accounting. The privilege level in the header is primarily significant in the Authentication phase for enable authentication where a different privilege level is required. * again, how does that work? Additional text would be useful. e.g. In typical use-cases, an administrator can perform a series of commands at a low privilege level. When additional privileges are required, the administrator can authenticate at the desired level, perform a series of commands, and the drop privilege level to the lower one. This methodology minimizes possible errors by using high privilege levels only when necessary, and using low privilege levels for most commands. * expanding on the use-case and work flow would be of great benefit. The use of Privilege levels to determine session-based access to commands and resources is not mandatory for clients, but it is in common use so SHOULD be supported by servers. * and clients, presumably? Perhaps instead, say: It is RECOMMENDED that clients and servers use Privilege levels to signal and control session-based access. It is RECOMMENDED that clients permit users to change their Privilege levels, so as to ensure that commands are executed with the minimum Privilege level required. 9. TACACS+ Security Considerations * there is a lot which can be said here. My proposal here is a=20 substantial amount of text. I'll include it in another message My $0.02 on the contents of the Security Considerations section. I'm=20 sure I've missed things. Please also comment if the suggestions here are wrong or unworkable. ---- 9. Security Considerations The protocol described in this document has been in widespread use since specified in "The Draft" (1998). However it does not meet modern security standards, and faces vulnerabilities with privacy and authenticity. This section describes issues with the TACACS+ specification, then the protocol, deployments, followed by recommendations for implementations. Because of the security issues with TACACS+, the authors intend to follow up this document with an enhanced specification of the protocol employing modern security mechanisms. 9.1 Security of The Draft Specification TACACS+ was originally specified in "The Draft" (1998). However, this draft is incomplete, and leaves key points unspecified. As a result, software authors have had to make implementation choices about what should, or should not, be done in certain situations. These implementation choices are somewhat constrained by ad hoc interoperability tests. That is, all TACACS+ clients and servers interoperate, so there is a rough consensus on how the protocol works. While the authors have made every effort to maintain compatibility, there is no guarantee, however, that this specification matches the behavior of current or historical implementations. We believe that any incompatibilites are due to modern security requirements. We therefore suggest that implementors should read this document, and verify that their implementations follow the security practices recommended here. 9.2 Security of The Protocol The major security issue with the TACACS+ protocol is the ad hoc "encryption" defined in Section 3.6. This "encryption" is more properly called "obfuscation", and has had no security analysis. That is, the security or insecurity of the protocol is entirely unknown. Attacks on cryptographic hashes are well known and are getting better with time, as discussed in [RFC4270]. The security of the TACACS+ protocol is dependent on MD5 [RFC1321], which has security issues as discussed in [RFC6151]. It is not known if the issues described in [RFC6151] apply to TACACS+. <> The choice of encrypting the body but not the packet header is unusual. The lack of security on the packet header means that an attacker can modify the header without detection. For example, a "session_id" can be replaced by an alternate one, which could allow an unprivileged administrator to "steal" the authorization from a session for a privileged administrator. An attacker could also update the "flags" field to indicate that one or the other end of a connection requires TAC_PLUS_UNENCRYPTED_FLAG, which could remove what little security is available. What little security that exists is dependent on implementations limiting access to known clients, and on the strenght of the secret key. Attacks who can guess the key or break the obfuscastion method can gain unrestricted and undetected access to all TACACS+ traffic. This access permits the attacker to execute any command on any system, leaving the attacker in complete control of the network. The negative side effects of such a successful attack cannot be overstated. 9.2.1 Security of Authentication Sessions There are a number of security issues with authentication sessions. As the sessions enable the exchange of clear-text passwords, an attacker capable of observing the unencrypted traffic or breakign the encrypted traffic, can gain complete network access. Similarly, MSCHAPv1 and MS-CHAPv2 offer little additional security, while ARAP is insecure and MUST NOT be used. As of the publication of this document, there has been no similar attacks on the CHAP protocol. Section 4.4.3 permits the redirection of a session to another server via the TAC_PLUS_AUTHEN_STATUS_FOLLOW mechanism. As part of this process, the secret key for a new server can be sent to the client. This public exchange of secret keys means that once one session is broken, it may be possible to leverage that attack to attacking connections to other servers. Section 9.4, below, has recommendations for securing this portion of the protocol. 9.2.2 Security of Authorization Sessions The primary issue with authorization sessions is that unauthenticated authorization is allowed. Almost as bad, authorization is permitted where authentication was done by a third party, such as with TAC_PLUS_AUTHEN_METH_KRB5. This third party authentication is based entirely on the client claiming that the user has been authenticated, and the server trusting that request. This practice is entirely insecure. There is also no way to cryptographically tie an authorization session to a particular authentication session. That is, when the client indicates "authen_method" in the packet header, the authentication and authorization sessions are tied together implicitly by the contents of the other fields, such as "use", "port", "rem_addr", etc. <> The specification allows for the exchange of attribute-value pairs. While a few such attributes are defined here, the protocol is extensible, and vendors can define their own attributes. There is no registry for such attributes, and in the absence of a published specification, no way for a client or server to know the meaning of a new attribute. As a result, vendors SHOULD NOT define new attribute-value pairs, unless such pairs are used only to communicate between client and server implementations both written by the same vendor. The "cmd" and "cmd-arg" attributes define shell commands and arguments, but does not specify what these are. The specific commands, therefore, are undefined. 9.2.3 Security of Accounting Sessions The security considerations for accounting sessions are largely the same as for authorization sessions. This section describes additional issues specific to accounting sessions. There is no way in TACACS+ to signal that accounting is required. There is no way for a server to signal a client how often accounting is required. The accounting packets are received solely at the clients discretion. Adding such functionality would assist with auditing of user actions. The "task_id" field is defined only for accounting packets, and not for authentication or authorization packets. As such, it is difficult to correlate accounting data with a previous authentication or authorization request. <> 9.4 Security of Deployments Due to the above concerns with the protocol, it is critical that it be deployed in a secure manner. Systems using TACACS+ MUST be configured so that TACACS+ traffic is secured. Any user or service who is not interacting with the TACACS+ protocol MUST NOT be able to observe TACACS+ traffic, even when TACACS+ "encryption" is used. When used inside of enterprises, TACACS+ traffic MUST be sent over management networks. When used on the wider internet, TACACS+ traffic MUST be secured via a modern security protocol such as TLS or IPSec. As this specification describes the historic protocol, recommendations on TLS and IPSec parameters are outside of the scope of this document. 9.4 Recommendations for Implementations The following recommendations are for clients and servers which implement the TACACS+ protocol. These recommendations describe end user interaction or user interface design. While not part of the protocol itself, good designs can prevent insecure configurations. Clients and servers MUST default to rejecting all connections which have the TAC_PLUS_UNENCRYPTED_FLAG set. Clients and servers MAY permit such connections when a debugging or test flag is set. Clients and servers MUST NOT run with this flag set in normal environments. Similarly, the default for both clients and servers MUST be to require a secret key when configuring a new server or client. The secret key MUST NOT be empty, and SHOULD be at least eight (8) characters in length. Clients and servers SHOULD permit the user of keys unique to each server or client which they are connecting to. They SHOULD warn the administrator if a secret key is re-used. Documentation for implementations SHOULD recommend the use of strong secret keys. Servers should maintain list of known clients, and reject connections which originate from other systems. Servers SHOULD NOT permit the configuration of wildcard clients. e.g. clients which map to a network range. Where a client or server detects that the secret key is incorrect, it SHOULD terminate the underlying TCP connection, and log a message to the system administrator. There is no good reason to keep a connection open when the systems are unable to communicate in a meaningful fashion. Implementions MUST default to using TAC_PLUS_AUTHEN_TYPE_CHAP for authentication. We recognize, however, that this authentication method is incompatible with many password storage systems. As a result, other authentication methods are still in the protocol, and can be used so long as administrators recognize the security issues with their use. Clients MUST default to treating TAC_PLUS_AUTHEN_STATUS_FOLLOW as if TAC_PLUS_AUTHEN_STATUS_FAIL had been received instead. Clients SHOULD allow administrators to explicitly enable the TAC_PLUS_AUTHEN_STATUS_FOLLOW functionality. When the functionality is enabled, clients SHOULD permit administrators to specify ranges of addresses, and/or sets of hosts, along with corresponding secret keys, for which redirection will be permitted. Clients SHOULD ignore redirects to hosts which are outside of the pre-configured range or list. Clients SHOULD ignore any key provided via TAC_PLUS_AUTHEN_STATUS_FOLLOW, and SHOULD instead use a preconfigured key for that host. For authorization, servers SHOULD default to requiring TAC_PLUS_AUTHEN_METH_TACACSPLUS. Servers SHOULD track authentication sessions via methods "to be described" in Section 5.1. Where a server receives an unknown attribute-value pair, it SHOULD reply with TAC_PLUS_AUTHOR_STATUS_FAIL. Where a server receives an unrecognized values in authorization attributes such as "cmd", "cmd-arg", "acl", etc., the server SHOULD reply with TAC_PLUS_AUTHOR_STATUS_FAIL. When a client receives an unknown authorization attribute, it SHOULD behave as if it had received TAC_PLUS_AUTHOR_STATUS_FAIL. > From nobody Sun May 14 07:07:36 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 88219126FB3; Sun, 14 May 2017 07:07:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TDELhBmnxb2T; Sun, 14 May 2017 07:07:34 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id A768F1242F7; Sun, 14 May 2017 07:06:57 -0700 (PDT) Received: from [192.168.120.42] (23-233-24-114.cpe.pppoe.ca [23.233.24.114]) by mail.networkradius.com (Postfix) with ESMTPSA id 3DE6F66E; Sun, 14 May 2017 14:06:56 +0000 (UTC) Content-Type: text/plain; charset=iso-8859-1 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Alan DeKok In-Reply-To: Date: Sun, 14 May 2017 10:06:54 -0400 Cc: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" , "ops-ads@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <139688FE-6C2D-40D0-89BC-AB7065793320@deployingradius.com> References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> To: "Douglas Gash (dcmgash)" X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 May 2017 14:07:35 -0000 > On May 13, 2017, at 3:03 PM, Douglas Gash (dcmgash) = wrote: >=20 >=20 > So rather than directly updating the doc, we=B9re looking for an = individual > response to each item. That is doable, we=B9ll start putting that = together. The point is to explain *why* the review was accepted or rejected. = i.e. to have a discussion around the topic. =46rom your earlier comment: >> So our response to your reviews has been to incorporate, where = feasible, >> and where we can apply then, to the doc. Which items were incorporated? Which items were *not* incorporated? Why were they not incorporated? There is no need to respond to each item individually. Grouping = things together is fine. But when there are questions, they should be answered. When comments = are rejected, there should be an explanation. My larger issue with the review process so far is that the existing = implementors haven't reviewed the document. So we have no idea whether = or not it describes the protocol they've implemented, or the choices = they've made. Alan DeKok. From nobody Sun May 14 07:41:52 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D26F128B51; Sun, 14 May 2017 07:41:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8wAv5VROtfuq; Sun, 14 May 2017 07:41:48 -0700 (PDT) Received: from llmx2.ll.mit.edu (LLMX2.LL.MIT.EDU [129.55.12.48]) by ietfa.amsl.com (Postfix) with ESMTP id 83C75128BA2; Sun, 14 May 2017 07:40:22 -0700 (PDT) Received: from LLE2K10-HUB02.mitll.ad.local (LLE2K10-HUB02.mitll.ad.local) by llmx2.ll.mit.edu (unknown) with ESMTP id v4EEeImR044772; Sun, 14 May 2017 10:40:18 -0400 From: "Blumenthal, Uri - 0553 - MITLL" To: Alan DeKok CC: "Douglas Gash (dcmgash)" , "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" , "ops-ads@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHxXY8AgACwjQCAAF7+gIAAdoeAgAE/fQCAAAlTgA== Date: Sun, 14 May 2017 14:40:17 +0000 Message-ID: <89732F74-E383-4519-82C3-9E6EE349F58C@ll.mit.edu> References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <139688FE-6C2D-40D0-89BC-AB7065793320@deployingradius.com> In-Reply-To: <139688FE-6C2D-40D0-89BC-AB7065793320@deployingradius.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: Content-Type: multipart/signed; boundary="Apple-Mail-B2E6698A-AFF3-4B30-B126-1ED057D5BA85"; protocol="application/pkcs7-signature"; micalg=sha1 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-05-14_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1703280000 definitions=main-1705140190 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 May 2017 14:41:50 -0000 --Apple-Mail-B2E6698A-AFF3-4B30-B126-1ED057D5BA85 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: base64 VGhlICJub3JtYWwiIGV4cGVjdGVkIGFjY2VwdGVkIGN1c3RvbWFyeSB3YXkgb2YgcmVzcG9uZGlu ZyB0byBjb21tZW50cyBpcyByZXBseWluZyB0byB0aGUgbGlzdCB3aXRoIHNvbWV0aGluZyBsaWtl OiANCg0KVG8gYWRkcmVzcyB0aGUgY29tbWVudCA8eD4sIHRoZSBuZXcgZG9jdW1lbnQgKHBhZ2Uj LCBzZWN0aW9uLCBwYXJhZ3JhcGgpIHNheXMgImJsYWgtYmxhaC1ibGFoIi4NCg0KT3IgDQoNCldl IGRlY2lkZWQgbm90IHRvIG1ha2UgY2hhbmdlcyByZXF1ZXN0ZWQgYnkgY29tbWVudCA8eD4gYmVj YXVzZSBvZiBibGFoLWJsYWgtYmxhaC4gDQoNCg0KDQpSZWdhcmRzLA0KVXJpDQoNClNlbnQgZnJv bSBteSBpUGhvbmUNCg0KPiBPbiBNYXkgMTQsIDIwMTcsIGF0IDEwOjA4LCBBbGFuIERlS29rIDxh bGFuZEBkZXBsb3lpbmdyYWRpdXMuY29tPiB3cm90ZToNCj4gDQo+IA0KPj4gT24gTWF5IDEzLCAy MDE3LCBhdCAzOjAzIFBNLCBEb3VnbGFzIEdhc2ggKGRjbWdhc2gpIDxkY21nYXNoQGNpc2NvLmNv bT4gd3JvdGU6DQo+PiANCj4+IA0KPj4gU28gcmF0aGVyIHRoYW4gZGlyZWN0bHkgdXBkYXRpbmcg dGhlIGRvYywgd2XCuXJlIGxvb2tpbmcgZm9yIGFuIGluZGl2aWR1YWwNCj4+IHJlc3BvbnNlIHRv IGVhY2ggaXRlbS4gVGhhdCBpcyBkb2FibGUsIHdlwrlsbCBzdGFydCBwdXR0aW5nIHRoYXQgdG9n ZXRoZXIuDQo+IA0KPiAgVGhlIHBvaW50IGlzIHRvIGV4cGxhaW4gKndoeSogdGhlIHJldmlldyB3 YXMgYWNjZXB0ZWQgb3IgcmVqZWN0ZWQuICBpLmUuIHRvIGhhdmUgYSBkaXNjdXNzaW9uIGFyb3Vu ZCB0aGUgdG9waWMuDQo+IA0KPiAgRnJvbSB5b3VyIGVhcmxpZXIgY29tbWVudDoNCj4gDQo+Pj4g U28gb3VyIHJlc3BvbnNlIHRvIHlvdXIgcmV2aWV3cyBoYXMgYmVlbiB0byBpbmNvcnBvcmF0ZSwg d2hlcmUgZmVhc2libGUsDQo+Pj4gYW5kIHdoZXJlIHdlIGNhbiBhcHBseSB0aGVuLCB0byB0aGUg ZG9jLg0KPiANCj4gIFdoaWNoIGl0ZW1zIHdlcmUgaW5jb3Jwb3JhdGVkPw0KPiANCj4gIFdoaWNo IGl0ZW1zIHdlcmUgKm5vdCogaW5jb3Jwb3JhdGVkPyAgV2h5IHdlcmUgdGhleSBub3QgaW5jb3Jw b3JhdGVkPw0KPiANCj4gIFRoZXJlIGlzIG5vIG5lZWQgdG8gcmVzcG9uZCB0byBlYWNoIGl0ZW0g aW5kaXZpZHVhbGx5LiAgR3JvdXBpbmcgdGhpbmdzIHRvZ2V0aGVyIGlzIGZpbmUuDQo+IA0KPiAg QnV0IHdoZW4gdGhlcmUgYXJlIHF1ZXN0aW9ucywgdGhleSBzaG91bGQgYmUgYW5zd2VyZWQuICBX aGVuIGNvbW1lbnRzIGFyZSByZWplY3RlZCwgdGhlcmUgc2hvdWxkIGJlIGFuIGV4cGxhbmF0aW9u Lg0KPiANCj4gIE15IGxhcmdlciBpc3N1ZSB3aXRoIHRoZSByZXZpZXcgcHJvY2VzcyBzbyBmYXIg aXMgdGhhdCB0aGUgZXhpc3RpbmcgaW1wbGVtZW50b3JzIGhhdmVuJ3QgcmV2aWV3ZWQgdGhlIGRv Y3VtZW50LiAgU28gd2UgaGF2ZSBubyBpZGVhIHdoZXRoZXIgb3Igbm90IGl0IGRlc2NyaWJlcyB0 aGUgcHJvdG9jb2wgdGhleSd2ZSBpbXBsZW1lbnRlZCwgb3IgdGhlIGNob2ljZXMgdGhleSd2ZSBt YWRlLg0KPiANCj4gIEFsYW4gRGVLb2suDQo+IA0KPiBfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXw0KPiBPUFNBV0cgbWFpbGluZyBsaXN0DQo+IE9QU0FXR0Bp ZXRmLm9yZw0KPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL29wc2F3Zw0K --Apple-Mail-B2E6698A-AFF3-4B30-B126-1ED057D5BA85 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIINeDCCA4Mw ggJroAMCAQICAQEwDQYJKoZIhvcNAQEFBQAwVDELMAkGA1UEBhMCVVMxHzAdBgNVBAoTFk1JVCBM aW5jb2xuIExhYm9yYXRvcnkxDDAKBgNVBAsTA1BLSTEWMBQGA1UEAxMNTUlUTEwgUm9vdCBDQTAe Fw0wODA5MjMxMjAwMDBaFw0yOTEyMzEyMzU5NTlaMFQxCzAJBgNVBAYTAlVTMR8wHQYDVQQKExZN SVQgTGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxFjAUBgNVBAMTDU1JVExMIFJvb3Qg Q0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDFTikXWLImsvmtir9cEAqD3eQJMBMb sHDQ0YWkQnUDdeyvpQgir3/VUkE6ALAOqtWwArWVHDL+WSsfM+ShuIyvXDONDbxJH/2yDmQByasy oFhtzfTaq3AIYpnF012ECHadQ4I7XQAylSwI12mKQ9j26RPyWwD56iszhDWtz8vQnoAdGm05Tsi4 MF1mP6101vuC/4YqSevrCP2baxUZrChobsACqGxa9BQz+riH8fkWliXCdUASHYDOGqIb1vCXq4kk jMn/y5RaV02RXDPUjl9H+8JrGItchbihTJ0G5EpMb56QSjEca4PvfLHkm2xJyJLwdAvagQzy2/5U AL5qVuqDAgMBAAGjYDBeMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFGeqes/0Cqa5crWKoNKd 8hDDQ+0pMB8GA1UdIwQYMBaAFGeqes/0Cqa5crWKoNKd8hDDQ+0pMAsGA1UdDwQEAwIBhjANBgkq hkiG9w0BAQUFAAOCAQEAPhttBWDQeHjYSlhfj8k+Q1Lc5QARZH9iDNlRjVAaL2tBnil9yNTX9Nqg 1Pxjth/RE75702Ib34EOFAf+RCJk5Cj2u/01RvzEO0oJgJp3vMRC1Wxixa68rZcvD8mLWbZ4G+g4 HhFL/ksBZ83Cztb4Na3ZrLN5MLKstKvHtlWAGPM06bRM8iRt+ml3CDG6jsVkvy2z4zbj3YCXzt3d Vqx69RLWmmtEES6kKGY9O3WGO1qORA6lPgFADM/WVURitbOW/47+Vs/2K6MqlhZx9ipDcUZ/ftgK +4N656zjGb6eqbKto2w14jwaHdcMjCp/MecuHLhjzRXKo38mPx1/dIr0ADCCBLwwggOkoAMCAQIC ASkwDQYJKoZIhvcNAQEFBQAwVDELMAkGA1UEBhMCVVMxHzAdBgNVBAoTFk1JVCBMaW5jb2xuIExh Ym9yYXRvcnkxDDAKBgNVBAsTA1BLSTEWMBQGA1UEAxMNTUlUTEwgUm9vdCBDQTAeFw0xMzEyMTcw MDAwMDBaFw0yMDEyMzEyMzU5NTlaMFExCzAJBgNVBAYTAlVTMR8wHQYDVQQKExZNSVQgTGluY29s biBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxEzARBgNVBAMTCk1JVExMIENBLTMwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaMFJ1bXy25bW03EbqHwHSSpyQVlAAC2gcKS9SlQRfqMW8 F3yZAjncbIthG4CjgdYml7v+LMVc59IkOzpQzmi+8I59eDZsmANiUEL0kNwsEUifSemk671G+mNZ KLG0LnpyvAnlSzlA923G0p16TksleXagrDfDyWKFSLF49vFZp3WbtkwopqC+b3NPJs/oW6YpHF5g mNKkHb5wBiOgYYRtJUfLHy7MebrECgEwfFrxvL7IPPwnOTqw/2KKWA/eJdIagICaHIHO+VBDlA01 Y/4Saj2PP+6QqFhUH9XB3G2iq48CqfiJ8MAhoz121vTlzLWBcAVI/dn+JSTHIFllQ5F/AgMBAAGj ggGaMIIBljASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBTXYGYOe0mNdUwN/c9G3sjHEofK vzAfBgNVHSMEGDAWgBRnqnrP9AqmuXK1iqDSnfIQw0PtKTAOBgNVHQ8BAf8EBAMCAYYwZgYIKwYB BQUHAQEEWjBYMC0GCCsGAQUFBzAChiFodHRwOi8vY3JsLmxsLm1pdC5lZHUvZ2V0dG8/TExSQ0Ew JwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLmxsLm1pdC5lZHUvb2NzcDAzBgNVHR8ELDAqMCigJqAk hiJodHRwOi8vY3JsLmxsLm1pdC5lZHUvZ2V0Y3JsP0xMUkNBMIGSBgNVHSAEgYowgYcwDQYLKoZI hvcSAgEDAQYwDQYLKoZIhvcSAgEDAQgwDQYLKoZIhvcSAgEDAQcwDQYLKoZIhvcSAgEDAQkwDQYL KoZIhvcSAgEDAQowDQYLKoZIhvcSAgEDAQswDQYLKoZIhvcSAgEDAQ4wDQYLKoZIhvcSAgEDAQ8w DQYLKoZIhvcSAgEDARAwDQYJKoZIhvcNAQEFBQADggEBACx/0cGfvapTtROCTFquMBzuLKeFwMSB bB7Ngq139IsZJDQOG3MhX8tMLGpQuM534f4dOowlcHz6cefOHKpDjdGycZk4VPlF/M+H3h1v9kne qXbjgPCUkjvJcEDYORlwQSA5YL1sdysSXNTo2eKBqFJbmh1UmuGYf9eFABwxLvsTkfrbLLErVY8+ BwGKkZWe7XFIdtOId7sOp9ZDa1UwtR/bddiEi5r3iQmxB3iNKHvU1UPR7sXiycCipAwj3wzMNh4s 6SOXMpGzvuv9oyw8ArHqcxo69EvsLLQ+OnnWLaoWRsaZfyh+eHaR6uNNO9En+DbavUxXxFHU+S2M yw06w98wggUtMIIEFaADAgECAgoadMQgAAAAAK0DMA0GCSqGSIb3DQEBCwUAMFExCzAJBgNVBAYT AlVTMR8wHQYDVQQKExZNSVQgTGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxEzARBgNV BAMTCk1JVExMIENBLTMwHhcNMTcwMzAxMTgyNTA2WhcNMjAxMjMxMjM1OTU5WjBsMQswCQYDVQQG EwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEPMA0GA1UECxMGUGVvcGxlMSsw KQYDVQQDEyJCbHVtZW50aGFsLlVyaS41MDAxMDU4NCAoTW9iaWxpdHkpMIIBIjANBgkqhkiG9w0B AQEFAAOCAQ8AMIIBCgKCAQEAg+8bBB+jySfGyqx/fL9a596qTeq9fGfYXI2yJEZqLzJazzV1u6oL ToMnJQ6phCIkQGplPsM+9PpzIcw5nN8GahHPU6FXXT3BSr6/bny4hftGu05y/n/DWWlPkos6PhSN AB8WG3L+6a3mHcp9yYumPkdtM20+08oiU9S6OhFr6BoFFoeFjKEcFhvvovm9GcRzQ3g1cXHore5p 6umBCLGxZi0cGhBI/7ZyJmJUUo50bAPKdpURqYSsgU7p6GxCgpIcZBUlTxCSliPO/0TqiBMZ857M F4OcehpG7LuxufD0p+g02uX7Z0aIfYnGHlkm3Y7NgvF6lW2WxCPklqKakb2fuwIDAQABo4IB6jCC AeYwHQYDVR0OBBYEFPbiFDP71vJBmRLhxtKU/CWESr+tMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSME GDAWgBTXYGYOe0mNdUwN/c9G3sjHEofKvzAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3JsLmxs Lm1pdC5lZHUvZ2V0Y3JsL0xMQ0EzMGYGCCsGAQUFBwEBBFowWDAtBggrBgEFBQcwAoYhaHR0cDov L2NybC5sbC5taXQuZWR1L2dldHRvL0xMQ0EzMCcGCCsGAQUFBzABhhtodHRwOi8vb2NzcC5sbC5t aXQuZWR1L29jc3AwPQYJKwYBBAGCNxUHBDAwLgYmKwYBBAGCNxUIg4PlHYfsp2aGrYcVg+rwRYW2 oR8dhYHgQIbXxk0CAWQCAQkwLAYDVR0lAQH/BCIwIAYIKwYBBQUHAwQGCisGAQQBgjcKAwwGCCsG AQUFBwMCMBgGA1UdIAQRMA8wDQYLKoZIhvcSAgEDAQgwQQYDVR0RBDowOIEOdXJpQGxsLm1pdC5l ZHWgJgYKKwYBBAGCNxQCA6AYDBZVUjIwOTgwQG1pdGxsLmFkLmxvY2FsMC0GCSsGAQQBgjcUAgQg Hh4ATABMAE0AbwBiAGkAbABlAFMAaQBnAEEAdQB0AGgwDQYJKoZIhvcNAQELBQADggEBADbiZo1D kfqhBA4LYklB+i49k6dh7L+nDEg3WdeZ/CRZAon9G3hPsUWd5YIsufRpoYUVJABcVos87kXZmkF1 RjH8vLNFOEV8ZVcNxbWC5DiA6dTswIEhXMSHFuyp3tERvu2z6+f9FC4jvZttYyLyirBJC4KwP/AO Lm42Gn4lLeNrY4Ex8nq2Ah3xjB+QqvpxD2k1aaoR0fWaDxv2ZrdaFR43x2MTkiee+wR1diZ7GA7G /HyJg9MUukKq23qm6Ys0VJQcJsKU1Q2/TLL99FRRa18ourBvFwJzcllLhTcqnvbawWt6cYEvGIJ9 Dszxz7LQECXI0KrPpM7x32SulMJjt1YxggLJMIICxQIBATBfMFExCzAJBgNVBAYTAlVTMR8wHQYD VQQKExZNSVQgTGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxEzARBgNVBAMTCk1JVExM IENBLTMCChp0xCAAAAAArQMwCQYFKw4DAhoFAKCCAT8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEH ATAcBgkqhkiG9w0BCQUxDxcNMTcwNTE0MTQ0MDE3WjAjBgkqhkiG9w0BCQQxFgQUhJWW0DS0/gAU RlUvIGDpWe4BiGwwbgYJKwYBBAGCNxAEMWEwXzBRMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlU IExpbmNvbG4gTGFib3JhdG9yeTEMMAoGA1UECxMDUEtJMRMwEQYDVQQDEwpNSVRMTCBDQS0zAgoa dMQgAAAAAK0DMHAGCyqGSIb3DQEJEAILMWGgXzBRMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlU IExpbmNvbG4gTGFib3JhdG9yeTEMMAoGA1UECxMDUEtJMRMwEQYDVQQDEwpNSVRMTCBDQS0zAgoa dMQgAAAAAK0DMA0GCSqGSIb3DQEBAQUABIIBADqkRufS5drSJ+w/j7byBoGSPArdNxjGoC1oCCLn 3WLgz7gok2qnzjpUh+w3/ebSUBH3Xfbd3UaPw8sUsUDKiw5AZG68DyeEKR8s0i0dPh/sd2OiVPTL 6qzl5++WWaad9uo+SVj930Znc2DvZZ7nSr5hC7UbItzCbP20LTIpZ/JAEfH6231IpIERb4pwcUac vRdppFyAVEIqvS/DNU/0AXEutkC5DlSnSrBrQUkMgVFI0pk/nFb2ri7sfwvBnhqwX78l0gx9DUv3 MOry643ozG0yeTD3euFnl6RN9xkDjEJuRCm/c9HjvADknGydLwS8ErvDb2lxKSTsBS37ShIbXu4A AAAAAAA= --Apple-Mail-B2E6698A-AFF3-4B30-B126-1ED057D5BA85-- From nobody Sun May 14 08:01:29 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C461712949B; Sun, 14 May 2017 08:01:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.522 X-Spam-Level: X-Spam-Status: No, score=-14.522 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mysHKwRWaCuO; Sun, 14 May 2017 08:01:25 -0700 (PDT) Received: from alln-iport-7.cisco.com (alln-iport-7.cisco.com [173.37.142.94]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0C34C1294E0; Sun, 14 May 2017 07:59:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3400; q=dns/txt; s=iport; t=1494773990; x=1495983590; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=Q0GTkB4BJfhwkTuedH3k8Ys/u8G05xcellCZJPObBPk=; b=RxXg+ak2nYmUeCzUOtOgWtaj5l+/cI1I5AZUbNYluwNmZZqXYltbiSEU jK8fGa6V6guzeSqditMNG/5V6UBUf66imjqKclLtRHY/EgyyDRHUZQNDe tuwBYZarPwCPPHGhrzLygTUdEHmZ0gTPipFl7cfSNR24Ma7HPHPgUDAbU U=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DNAADBcBhZ/5hdJa1SChkBAQEBAQEBA?= =?us-ascii?q?QEBAQcBAQEBAYNVgW4Hg2SKGJFdlXWCD4YkAhqEfz8YAQIBAQEBAQEBayiFGQE?= =?us-ascii?q?EATRFEAIBCBwoAgIwJQIEDgWKGwiQEp1YBoIoikEBAQEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEdgQWKU4Q7KBeCdYJmBYlViCaEdIcbAYpQiEqRa5RCAR84gQpwFYc8dod?= =?us-ascii?q?ugQ0BAQE?= X-IronPort-AV: E=Sophos;i="5.38,340,1491264000"; d="scan'208";a="426303127" Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by alln-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 14 May 2017 14:59:45 +0000 Received: from XCH-RCD-014.cisco.com (xch-rcd-014.cisco.com [173.37.102.24]) by rcdn-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id v4EExjnK018007 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Sun, 14 May 2017 14:59:45 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-RCD-014.cisco.com (173.37.102.24) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Sun, 14 May 2017 09:59:44 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1210.000; Sun, 14 May 2017 09:59:44 -0500 From: "Douglas Gash (dcmgash)" To: Alan DeKok CC: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" , "ops-ads@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHxblMAgADBTACAAE4+gIAAh0UAgAEuvwCAAB98gA== Date: Sun, 14 May 2017 14:59:44 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <139688FE-6C2D-40D0-89BC-AB7065793320@deployingradius.com> In-Reply-To: <139688FE-6C2D-40D0-89BC-AB7065793320@deployingradius.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.0.161029 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.1.6] Content-Type: text/plain; charset="euc-kr" Content-ID: <859B410087E30A4982771DBE63280429@emea.cisco.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 May 2017 15:01:27 -0000 SnVzdCB0byBjbGFyaWZ5OiBiZWNhdXNlIHRoZSBsYXN0IGJhdGNoIG9mIGNvbW1lbnRzIHdlcmUg b24gdjUsIHdlIHdpbGwNCmFjdHVhbGx5IHRha2UgdGhhdCBhcyB0aGUgZGF0dW0gZm9yIG5leHQg dmVyc2lvbi4NCg0KQWx0aG91Z2ggdGhlIGN1cnJlbnQgdXBsb2FkICh2NikgY2FuIGJlIGZvbGRl ZCBpbnRvIHRoaXMgcHJvY2Vzcywgd2hhdCB3ZQ0KY2FuIGFjdHVhbGx5IGRvIG5vdyBpcyBpcyBy ZXNwb25kIHRvIGFsbCBjb21tZW50cyBpbiBjb250ZXh0IG9mIHY1IGFuZCwNCndpdGggZW5zdWlu ZyBkaXNjdXNzaW9uIG9mIHRob3NlIHBvaW50cywgY2FuIGhvcGVmdWxseSBnZXQgdXMgdG8gYQ0K YWdyZWVhYmxlIHZlcnNpb24gb2YgdGhlIGRvY3VtZW50IGZvciB2Ny4NCg0KT24gMTQvMDUvMjAx NyAxNTowNiwgIkFsYW4gRGVLb2siIDxhbGFuZEBkZXBsb3lpbmdyYWRpdXMuY29tPiB3cm90ZToN Cg0KPg0KPj4gT24gTWF5IDEzLCAyMDE3LCBhdCAzOjAzIFBNLCBEb3VnbGFzIEdhc2ggKGRjbWdh c2gpIDxkY21nYXNoQGNpc2NvLmNvbT4NCj4+d3JvdGU6DQo+PiANCj4+IA0KPj4gU28gcmF0aGVy IHRoYW4gZGlyZWN0bHkgdXBkYXRpbmcgdGhlIGRvYywgd2Wp9nJlIGxvb2tpbmcgZm9yIGFuDQo+ PmluZGl2aWR1YWwNCj4+IHJlc3BvbnNlIHRvIGVhY2ggaXRlbS4gVGhhdCBpcyBkb2FibGUsIHdl qfZsbCBzdGFydCBwdXR0aW5nIHRoYXQNCj4+dG9nZXRoZXIuDQo+DQo+ICBUaGUgcG9pbnQgaXMg dG8gZXhwbGFpbiAqd2h5KiB0aGUgcmV2aWV3IHdhcyBhY2NlcHRlZCBvciByZWplY3RlZC4NCj5p LmUuIHRvIGhhdmUgYSBkaXNjdXNzaW9uIGFyb3VuZCB0aGUgdG9waWMuDQoNCkFncmVlZC4gVGhh dCBzaG91bGQgY29tZSBvdXQgb2YgdGhpcyBwcm9jZXNzLg0KDQo+DQo+ICBGcm9tIHlvdXIgZWFy bGllciBjb21tZW50Og0KPg0KPj4+IFNvIG91ciByZXNwb25zZSB0byB5b3VyIHJldmlld3MgaGFz IGJlZW4gdG8gaW5jb3Jwb3JhdGUsIHdoZXJlDQo+Pj5mZWFzaWJsZSwNCj4+PiBhbmQgd2hlcmUg d2UgY2FuIGFwcGx5IHRoZW4sIHRvIHRoZSBkb2MuDQo+DQo+ICBXaGljaCBpdGVtcyB3ZXJlIGlu Y29ycG9yYXRlZD8NCj4NCj4gIFdoaWNoIGl0ZW1zIHdlcmUgKm5vdCogaW5jb3Jwb3JhdGVkPyAg V2h5IHdlcmUgdGhleSBub3QgaW5jb3Jwb3JhdGVkPw0KPg0KPiAgVGhlcmUgaXMgbm8gbmVlZCB0 byByZXNwb25kIHRvIGVhY2ggaXRlbSBpbmRpdmlkdWFsbHkuICBHcm91cGluZyB0aGluZ3MNCj50 b2dldGhlciBpcyBmaW5lLg0KU3VyZSwgd2UgY2FuIGdyb3VwIHRoZW0sIHdlIGhhdmUgdGhlbSBp biB0aGUgb3JkZXIgeW91IHBvc3RlZCB0aGVtIG1haW5seQ0KdG8gdHJ5IHRvIG1ha2Ugc3VyZSB3 ZSBkb26hr3QgbWlzcyBhbnksDQoNCg0KPg0KPiAgQnV0IHdoZW4gdGhlcmUgYXJlIHF1ZXN0aW9u cywgdGhleSBzaG91bGQgYmUgYW5zd2VyZWQuICBXaGVuIGNvbW1lbnRzDQo+YXJlIHJlamVjdGVk LCB0aGVyZSBzaG91bGQgYmUgYW4gZXhwbGFuYXRpb24uDQoNCg0KU28gdG8gcmVjYXAsIHRoaXMg cHJvY2VzcyB3aWxsIHRha2UgdjUgYW5kIHlvdXIgY29tbWVudHMgdG8gdjUsIHRoZW4NCmhvcGVm dWxseSB3ZSBzaG91bGQgaGF2ZSBhIHRyYW5zcGFyZW50IHByb2Nlc3MgZ2V0dGluZyB0byBhIHY3 IHdoaWNoIHdlDQpjYW4gYWdyZWUgb24uIFdlIGNhbiBsZXZlcmFnZSB2NiB3aGVyZSBpdCBhbGln bnMgd2l0aCB0aGlzIHByb2Nlc3MuDQoNCj4NCj4gIE15IGxhcmdlciBpc3N1ZSB3aXRoIHRoZSBy ZXZpZXcgcHJvY2VzcyBzbyBmYXIgaXMgdGhhdCB0aGUgZXhpc3RpbmcNCj5pbXBsZW1lbnRvcnMg aGF2ZW4ndCByZXZpZXdlZCB0aGUgZG9jdW1lbnQuICBTbyB3ZSBoYXZlIG5vIGlkZWEgd2hldGhl cg0KPm9yIG5vdCBpdCBkZXNjcmliZXMgdGhlIHByb3RvY29sIHRoZXkndmUgaW1wbGVtZW50ZWQs IG9yIHRoZSBjaG9pY2VzDQo+dGhleSd2ZSBtYWRlLg0KDQpTbyBsZXShr3Mgd29yayB0aHJvdWdo IHRoZSBkb2N1bWVudCBhbmQgaWRlbnRpZnkgd2hhdCB0aGUgY29yZSBzaG91bGQgYmUuDQpJbiB0 aGUgZW5kIHdlIHNob3VsZCBoYXZlIGEgcHJvdG9jb2wgd2hpY2ggY2xhcmlmaWVzIHRoZSBzeW50 YXggb2YNCmludGVyb3BlcmF0aW9uIHdoaWxzdCBsZWF2aW5nIHRoZSBmbGV4aWJpbGl0eSBhcyBu ZWVkZWQgZm9yIHRoZSB2YXJ5aW5nDQpkZXBsb3ltZW50IGltcGxlbWVudGF0aW9ucy4gSW1wbGVt ZW50b3JzIGhhdmUgbWFkZSB2ZXJ5IHVzZWZ1bCBjb21tZW50cw0KYW5kIGRpc2N1c3Npb25zIGFs cmVhZHkgaW4gdGhlIFdHLCBhbmQgaG9wZWZ1bGx5IHdpbGwgY29udHJpYnV0ZSB0byB0aGUNCmRp c2N1c3Npb25zIHdoaWNoIHdpbGwgYmUgcmFpc2VkIGJ5IHRoZSByZXNwb25zZSB0byB5b3VyIGNv bW1lbnRzIGFuZCB0aGUNCmVuc3VpbmcgbW92ZSB0byBjbG9zdXJlLg0KDQpSZWdhcmRzLA0KDQpE b3VnLg0KDQo+DQo+ICBBbGFuIERlS29rLg0KPg0KDQo= From nobody Sun May 14 08:04:39 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D09DA128961; Sun, 14 May 2017 08:04:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.522 X-Spam-Level: X-Spam-Status: No, score=-14.522 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zjX6_lUuO3XD; Sun, 14 May 2017 08:04:36 -0700 (PDT) Received: from alln-iport-4.cisco.com (alln-iport-4.cisco.com [173.37.142.91]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C98361279EB; Sun, 14 May 2017 08:03:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2792; q=dns/txt; s=iport; t=1494774204; x=1495983804; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=G2LbpXZn98NFKDKCvzeiZFNimpxkyhJL5lGVy8wHVEM=; b=M2JjHY3uXGFUMVFV1vjZ4uII8MQ2G67Qa4RpIzupFk/nfdlJA1mXzGRc KsfL1cd55rY9KCXJPOdHH+Rnugc4TFllqZ7ZXAXiL7wny8qfdfdG9AV2r X4XmNpPOqSb69nbXOgWaptG1YAjotAiOUSyvjBZ3zb9T46MfqqnS77Au3 I=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DNAACFcBhZ/49dJa1cDgsBAQEBAQEBA?= =?us-ascii?q?QEBAQcBAQEBAYNVYoEMB4NkihiRXZV1gg8hC4UuSgIahH8/GAECAQEBAQEBAWs?= =?us-ascii?q?ohRkBAQEDAQEyOgsQAgEIGAQoAgIlCyUCBAENBYojDpADnVgGgiiKQQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBARgFgQWKU4RjF4J1gmYFiVWIJowPAZMakWuUQgEfOIE?= =?us-ascii?q?KcBVGhjk9dodugQ0BAQE?= X-IronPort-AV: E=Sophos;i="5.38,340,1491264000"; d="scan'208";a="424149134" Received: from rcdn-core-7.cisco.com ([173.37.93.143]) by alln-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 14 May 2017 15:03:23 +0000 Received: from XCH-RCD-013.cisco.com (xch-rcd-013.cisco.com [173.37.102.23]) by rcdn-core-7.cisco.com (8.14.5/8.14.5) with ESMTP id v4EF3NC8022203 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Sun, 14 May 2017 15:03:23 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-RCD-013.cisco.com (173.37.102.23) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Sun, 14 May 2017 10:03:23 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1210.000; Sun, 14 May 2017 10:03:23 -0500 From: "Douglas Gash (dcmgash)" To: "Blumenthal, Uri - 0553 - MITLL" , Alan DeKok CC: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" , "ops-ads@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHxblMAgADBTACAAE4+gIAAh0UAgAEuvwCAAAlUgIAAFzOA Date: Sun, 14 May 2017 15:03:23 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <139688FE-6C2D-40D0-89BC-AB7065793320@deployingradius.com> <89732F74-E383-4519-82C3-9E6EE349F58C@ll.mit.edu> In-Reply-To: <89732F74-E383-4519-82C3-9E6EE349F58C@ll.mit.edu> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.0.161029 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.1.6] Content-Type: text/plain; charset="euc-kr" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 May 2017 15:04:38 -0000 QWdyZWVkLCB3ZaGvcmUgd29ya2luZyBvbiBwcm92aWRpbmcgdGhhdCBmb3IgZWFjaCBvZiBBbGFu oa9zIGNvbW1lbnRzIG1hZGUNCmZvciB2NSwgYW5kIGFmdGVyIHN1aXRhYmxlIGRpc2N1c3Npb24g YW5kIGFncmVlbWVudCwgY2FuIGdldCB0byBuZXh0DQp2ZXJzaW9uLg0KDQpPbiAxNC8wNS8yMDE3 IDE1OjQwLCAiQmx1bWVudGhhbCwgVXJpIC0gMDU1MyAtIE1JVExMIiA8dXJpQGxsLm1pdC5lZHU+ DQp3cm90ZToNCg0KPlRoZSAibm9ybWFsIiBleHBlY3RlZCBhY2NlcHRlZCBjdXN0b21hcnkgd2F5 IG9mIHJlc3BvbmRpbmcgdG8gY29tbWVudHMgaXMNCj5yZXBseWluZyB0byB0aGUgbGlzdCB3aXRo IHNvbWV0aGluZyBsaWtlOg0KPg0KPlRvIGFkZHJlc3MgdGhlIGNvbW1lbnQgPHg+LCB0aGUgbmV3 IGRvY3VtZW50IChwYWdlIywgc2VjdGlvbiwgcGFyYWdyYXBoKQ0KPnNheXMgImJsYWgtYmxhaC1i bGFoIi4NCj4NCj5PciANCj4NCj5XZSBkZWNpZGVkIG5vdCB0byBtYWtlIGNoYW5nZXMgcmVxdWVz dGVkIGJ5IGNvbW1lbnQgPHg+IGJlY2F1c2Ugb2YNCj5ibGFoLWJsYWgtYmxhaC4gDQo+DQo+DQo+ DQo+UmVnYXJkcywNCj5VcmkNCj4NCj5TZW50IGZyb20gbXkgaVBob25lDQo+DQo+PiBPbiBNYXkg MTQsIDIwMTcsIGF0IDEwOjA4LCBBbGFuIERlS29rIDxhbGFuZEBkZXBsb3lpbmdyYWRpdXMuY29t PiB3cm90ZToNCj4+IA0KPj4gDQo+Pj4gT24gTWF5IDEzLCAyMDE3LCBhdCAzOjAzIFBNLCBEb3Vn bGFzIEdhc2ggKGRjbWdhc2gpDQo+Pj48ZGNtZ2FzaEBjaXNjby5jb20+IHdyb3RlOg0KPj4+IA0K Pj4+IA0KPj4+IFNvIHJhdGhlciB0aGFuIGRpcmVjdGx5IHVwZGF0aW5nIHRoZSBkb2MsIHdlqfZy ZSBsb29raW5nIGZvciBhbg0KPj4+aW5kaXZpZHVhbA0KPj4+IHJlc3BvbnNlIHRvIGVhY2ggaXRl bS4gVGhhdCBpcyBkb2FibGUsIHdlqfZsbCBzdGFydCBwdXR0aW5nIHRoYXQNCj4+PnRvZ2V0aGVy Lg0KPj4gDQo+PiAgVGhlIHBvaW50IGlzIHRvIGV4cGxhaW4gKndoeSogdGhlIHJldmlldyB3YXMg YWNjZXB0ZWQgb3IgcmVqZWN0ZWQuDQo+PmkuZS4gdG8gaGF2ZSBhIGRpc2N1c3Npb24gYXJvdW5k IHRoZSB0b3BpYy4NCj4+IA0KPj4gIEZyb20geW91ciBlYXJsaWVyIGNvbW1lbnQ6DQo+PiANCj4+ Pj4gU28gb3VyIHJlc3BvbnNlIHRvIHlvdXIgcmV2aWV3cyBoYXMgYmVlbiB0byBpbmNvcnBvcmF0 ZSwgd2hlcmUNCj4+Pj5mZWFzaWJsZSwNCj4+Pj4gYW5kIHdoZXJlIHdlIGNhbiBhcHBseSB0aGVu LCB0byB0aGUgZG9jLg0KPj4gDQo+PiAgV2hpY2ggaXRlbXMgd2VyZSBpbmNvcnBvcmF0ZWQ/DQo+ PiANCj4+ICBXaGljaCBpdGVtcyB3ZXJlICpub3QqIGluY29ycG9yYXRlZD8gIFdoeSB3ZXJlIHRo ZXkgbm90IGluY29ycG9yYXRlZD8NCj4+IA0KPj4gIFRoZXJlIGlzIG5vIG5lZWQgdG8gcmVzcG9u ZCB0byBlYWNoIGl0ZW0gaW5kaXZpZHVhbGx5LiAgR3JvdXBpbmcNCj4+dGhpbmdzIHRvZ2V0aGVy IGlzIGZpbmUuDQo+PiANCj4+ICBCdXQgd2hlbiB0aGVyZSBhcmUgcXVlc3Rpb25zLCB0aGV5IHNo b3VsZCBiZSBhbnN3ZXJlZC4gIFdoZW4gY29tbWVudHMNCj4+YXJlIHJlamVjdGVkLCB0aGVyZSBz aG91bGQgYmUgYW4gZXhwbGFuYXRpb24uDQo+PiANCj4+ICBNeSBsYXJnZXIgaXNzdWUgd2l0aCB0 aGUgcmV2aWV3IHByb2Nlc3Mgc28gZmFyIGlzIHRoYXQgdGhlIGV4aXN0aW5nDQo+PmltcGxlbWVu dG9ycyBoYXZlbid0IHJldmlld2VkIHRoZSBkb2N1bWVudC4gIFNvIHdlIGhhdmUgbm8gaWRlYSB3 aGV0aGVyDQo+Pm9yIG5vdCBpdCBkZXNjcmliZXMgdGhlIHByb3RvY29sIHRoZXkndmUgaW1wbGVt ZW50ZWQsIG9yIHRoZSBjaG9pY2VzDQo+PnRoZXkndmUgbWFkZS4NCj4+IA0KPj4gIEFsYW4gRGVL b2suDQo+PiANCj4+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fDQo+PiBPUFNBV0cgbWFpbGluZyBsaXN0DQo+PiBPUFNBV0dAaWV0Zi5vcmcNCj4+IGh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vb3BzYXdnDQoNCg== From nobody Mon May 15 00:21:30 2017 Return-Path: X-Original-To: opsawg@ietf.org Delivered-To: opsawg@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id F38FB12E91F; Mon, 15 May 2017 00:21:27 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: opsawg@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.50.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <149483288794.2788.670438340656870157@ietfa.amsl.com> Date: Mon, 15 May 2017 00:21:27 -0700 Archived-At: Subject: [OPSAWG] I-D Action: draft-ietf-opsawg-mud-06.txt X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 May 2017 07:21:28 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operations and Management Area Working Group of the IETF. Title : Manufacturer Usage Description Specification Authors : Eliot Lear Ralph Droms Dan Romascanu Filename : draft-ietf-opsawg-mud-06.txt Pages : 42 Date : 2017-05-15 Abstract: This memo specifies a component-based architecture for manufacturer usage descriptions (MUD). This includes two YANG modules, IPv4 and IPv6 DHCP options, an LLDP TLV, a URL suffix specification, an X.509 certificate extension and a means to sign and verify the descriptions. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-opsawg-mud-06 https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-mud-06 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsawg-mud-06 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon May 15 00:28:26 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F267C127137 for ; Mon, 15 May 2017 00:28:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.523 X-Spam-Level: X-Spam-Status: No, score=-14.523 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0EreV7StAnAQ for ; Mon, 15 May 2017 00:28:22 -0700 (PDT) Received: from aer-iport-2.cisco.com (aer-iport-2.cisco.com [173.38.203.52]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8B849126D85 for ; Mon, 15 May 2017 00:24:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3141; q=dns/txt; s=iport; t=1494833048; x=1496042648; h=subject:to:references:from:message-id:date:mime-version: in-reply-to; bh=+PnlOGAtbNTiMGwOs60PO+x1STj332LNRt3/c9XXQBA=; b=bz13OuNUoMv7iSBo0py0+ZjmoN2tOM+rsWqarQ4cTe1ETIPcRSCXR0gW Wvp8Y0ASQw5Wd0KmMK5kEBV6rSck3FP9QvTKVhwHwk7zy2UcwU43kiWHi uVLaMciiQauBovqk6qg0cvm9aOCqXpALbMCCRHttuNOrNr1O7UJjzA5fW c=; X-Files: signature.asc : 481 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DyAAAhVxlZ/xbLJq1cGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBhDeBDINrihhzkEkhlXWCDwclhXgChV0YAQIBAQEBAQEBax0LhRk?= =?us-ascii?q?BAgMjVBILEgYqAgJJDgYNBgIBAYofDq0VgiaKRgEBAQEBAQEDAQEBAQEBEw+IP?= =?us-ascii?q?SsLgmWDIYRUgmABBIlOhlSNaIQNghR7i3+CBFWEZoNDhmmUQx84gQovIAgZFRy?= =?us-ascii?q?HIj42AYheAQEB?= X-IronPort-AV: E=Sophos;i="5.38,343,1491264000"; d="asc'?scan'208";a="651860813" Received: from aer-iport-nat.cisco.com (HELO aer-core-3.cisco.com) ([173.38.203.22]) by aer-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 15 May 2017 07:24:06 +0000 Received: from [10.61.211.153] ([10.61.211.153]) by aer-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id v4F7O6P2030878 for ; Mon, 15 May 2017 07:24:06 GMT To: "opsawg@ietf.org" References: <149483288812.2788.3665741300108188700.idtracker@ietfa.amsl.com> From: Eliot Lear Message-ID: <8d019add-aa2e-a42e-8279-e3a6dc7ea3f8@cisco.com> Date: Mon, 15 May 2017 09:24:06 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: <149483288812.2788.3665741300108188700.idtracker@ietfa.amsl.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="vxLQA72tBsHhBINepRtvRlUONUPwAfJ5V" Archived-At: Subject: Re: [OPSAWG] New Version Notification for draft-ietf-opsawg-mud-06.txt X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 May 2017 07:28:24 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --vxLQA72tBsHhBINepRtvRlUONUPwAfJ5V Content-Type: multipart/mixed; boundary="CBahpiLsmvbiUlja7Ucd2iABJs0ldBdTG"; protected-headers="v1" From: Eliot Lear To: "opsawg@ietf.org" Message-ID: <8d019add-aa2e-a42e-8279-e3a6dc7ea3f8@cisco.com> Subject: Re: New Version Notification for draft-ietf-opsawg-mud-06.txt References: <149483288812.2788.3665741300108188700.idtracker@ietfa.amsl.com> In-Reply-To: <149483288812.2788.3665741300108188700.idtracker@ietfa.amsl.com> --CBahpiLsmvbiUlja7Ucd2iABJs0ldBdTG Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi everyone, This version is intended to address comments made by various people during the previous WGLC. Several people have expressed an interest in providing further review. As such I do not propose that we forward this work along to the AD just yet. Eliot On 5/15/17 9:21 AM, internet-drafts@ietf.org wrote: > A new version of I-D, draft-ietf-opsawg-mud-06.txt > has been successfully submitted by Eliot Lear and posted to the > IETF repository. > > Name: draft-ietf-opsawg-mud > Revision: 06 > Title: Manufacturer Usage Description Specification > Document date: 2017-05-15 > Group: opsawg > Pages: 42 > URL: https://www.ietf.org/internet-drafts/draft-ietf-opsawg-= mud-06.txt > Status: https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/= > Htmlized: https://tools.ietf.org/html/draft-ietf-opsawg-mud-06 > Htmlized: https://datatracker.ietf.org/doc/html/draft-ietf-opsawg= -mud-06 > Diff: https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-opsawg-m= ud-06 > > Abstract: > This memo specifies a component-based architecture for manufacturer > usage descriptions (MUD). This includes two YANG modules, IPv4 and > IPv6 DHCP options, an LLDP TLV, a URL suffix specification, an X.509= > certificate extension and a means to sign and verify the > descriptions. > > = =20 > > > Please note that it may take a couple of minutes from the time of submi= ssion > until the htmlized version and diff are available at tools.ietf.org. > > The IETF Secretariat > > --CBahpiLsmvbiUlja7Ucd2iABJs0ldBdTG-- --vxLQA72tBsHhBINepRtvRlUONUPwAfJ5V Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2 iQEcBAEBCAAGBQJZGVeWAAoJEIe2a0bZ0nozfRYH/3aCi6A9GDiAKEWFY7nKTE5a 5TevZI6QY7R8KW2I1piAMgxJFctb/dA+So2RwuZFunoSCQSR4raU/lGpqCDVa4Ym XM8cvU0MV61GZA5PNvO6E1xPW7tPKt25cPDtrtB1tjNnjl5oQHXI54BncwXPqxsF m0QngeuuNIM0/KC85CGxCtyrdGxCNxmsRc7LuFiwqWQOQLRIGVSkr5+RdYjI53EB usnMHASwkK71UhdtXj4tGYc7TMuGKpIHqcmpiM8wPfqrOnACIe2jLU+lNouHSXac ZKLbm3mjmrKPOWofyPoV1O6yKslPGA8IbR0UZ9T5HWT8bmzlcTjo18qydp9P8mc= =HQiN -----END PGP SIGNATURE----- --vxLQA72tBsHhBINepRtvRlUONUPwAfJ5V-- From nobody Mon May 15 03:01:25 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C49DD12717E for ; Mon, 15 May 2017 03:01:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.222 X-Spam-Level: X-Spam-Status: No, score=-4.222 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kKRkbRrw_j1d for ; Mon, 15 May 2017 03:01:20 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E1EA41294FD for ; Mon, 15 May 2017 02:56:40 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml702-cah.china.huawei.com) ([172.18.7.190]) by lhrrg02-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id DGQ33326; Mon, 15 May 2017 09:56:39 +0000 (GMT) Received: from NKGEML412-HUB.china.huawei.com (10.98.56.73) by lhreml702-cah.china.huawei.com (10.201.108.43) with Microsoft SMTP Server (TLS) id 14.3.301.0; Mon, 15 May 2017 10:56:37 +0100 Received: from NKGEML514-MBX.china.huawei.com ([fe80::40a8:f0d:c0f3:2ca5]) by nkgeml412-hub.china.huawei.com ([10.98.56.73]) with mapi id 14.03.0235.001; Mon, 15 May 2017 17:56:30 +0800 From: Duzongpeng To: "opsawg@ietf.org" Thread-Topic: LC request//RE: [OPSAWG] I-D Action: draft-ietf-opsawg-capwap-alt-tunnel-09.txt Thread-Index: AQHSxIC10NjYo3J0mUK+cEaJNpt6yqH1OFNQ Date: Mon, 15 May 2017 09:56:29 +0000 Message-ID: References: <149386596579.4881.15914732299692111269@ietfa.amsl.com> In-Reply-To: <149386596579.4881.15914732299692111269@ietfa.amsl.com> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.111.149.226] Content-Type: multipart/mixed; boundary="_006_BAFEC9523F57BC48A51C20226A5589575FECA9DEnkgeml514mbxchi_" MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A0B0203.59197B57.00D4, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: ce71689747be73e42bc17b5d8f6c8e00 Archived-At: Subject: [OPSAWG] LC request//RE: I-D Action: draft-ietf-opsawg-capwap-alt-tunnel-09.txt X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 May 2017 10:01:25 -0000 --_006_BAFEC9523F57BC48A51C20226A5589575FECA9DEnkgeml514mbxchi_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi All, I am happy to join the I-D draft-ietf-opsawg-capwap-alt-tunnel, and help to= improve the document based on the comments received and recorded in this p= age (https://datatracker.ietf.org/doc/draft-ietf-opsawg-capwap-alt-tunnel). I revised the document and responded to all the existing comments as listed= in the attachments. Also thanks Joe Touch's comments, which I have solved = in the document. The major change include: 1. At the security aspect, we suggest using the IPSec to protect the data t= unnel between WTP and AR. 2. Add a new sub-element, "minimum IPv6 MTU", according to the suggestion f= rom Joe Touch. 3. Make it clear that "IEEE 802.11 WTP Alternate Tunnel Failure Indication"= is carried in "CAPWAP Station Configuration Request message". 4. Make it clear that we define seven sub-elements (each with its correspon= ding type number). Three of them are specific for CAPWAP, one is specific f= or GRE, and others are common ones. Make it clear that they can only be use= d as sub-elements of "Alternate Tunnel Encapsulations Type message element"= and "IEEE 802.11 WTP Alternate Tunnel Failure Indication message element". 5. Change the structure of the draft. Firstly, introduce the three new "mes= sage element"; secondly, introduce the three tunnel types; finnaly, introdu= ce the seven sub-elements involved. 6. Give more explanations to the GRE tunnel type. Now I believe this document is ready to send to IESG. So I request for a WG= LC. And I will also help to reply any comments/questions during the followi= ng procedure. Regards, Zongpeng -----Original Message----- From: OPSAWG [mailto:opsawg-bounces@ietf.org] On Behalf Of internet-drafts@= ietf.org Sent: Thursday, May 04, 2017 10:46 AM To: i-d-announce@ietf.org Cc: opsawg@ietf.org Subject: [OPSAWG] I-D Action: draft-ietf-opsawg-capwap-alt-tunnel-09.txt A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Operations and Management Area Working Gro= up of the IETF. Title : Alternate Tunnel Encapsulation for Data Frames in= CAPWAP Authors : Rong Zhang Rajesh S. Pazhyannur Sri Gundavelli Zhen Cao Hui Deng Zongpeng Du Filename : draft-ietf-opsawg-capwap-alt-tunnel-09.txt Pages : 26 Date : 2017-05-03 Abstract: Control and Provisioning of Wireless Access Points (CAPWAP) defines a specification to encapsulate a station's data frames between the Wireless Transmission Point (WTP) and Access Controller (AC). Specifically, the station's IEEE 802.11 data frames can be either locally bridged or tunneled to the AC. When tunneled, a CAPWAP data channel is used for tunneling. In many deployments encapsulating data frames to an entity other than the AC (for example to an Access Router (AR)) is desirable. Furthermore, it may also be desirable to use different tunnel encapsulation modes between the WTP and the Access Router. This document defines extension to CAPWAP protocol for supporting this capability and refers to it as alternate tunnel encapsulation. The alternate tunnel encapsulation allows 1) the WTP to tunnel non-management data frames to an endpoint different from the AC and 2) the WTP to tunnel using one of many known encapsulation types such as IP-IP, IP-GRE, CAPWAP. The WTP may advertise support for alternate tunnel encapsulation during the discovery and join process and AC may select one of the supported alternate tunnel encapsulation types while configuring the WTP. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsawg-capwap-alt-tunnel/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-opsawg-capwap-alt-tunnel-09 https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-capwap-alt-tunnel-0= 9 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-opsawg-capwap-alt-tunnel-09 Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ OPSAWG mailing list OPSAWG@ietf.org https://www.ietf.org/mailman/listinfo/opsawg --_006_BAFEC9523F57BC48A51C20226A5589575FECA9DEnkgeml514mbxchi_ Content-Type: text/plain; name="reply to Kathleen Moriarty's comments.txt" Content-Description: reply to Kathleen Moriarty's comments.txt Content-Disposition: attachment; filename="reply to Kathleen Moriarty's comments.txt"; size=2602; creation-date="Mon, 15 May 2017 09:50:59 GMT"; modification-date="Mon, 15 May 2017 09:50:59 GMT" Content-Transfer-Encoding: base64 DQpJJ20gc3VycHJpc2VkIHRvIHNlZSBzZWN1cml0eSBpcyBvcHRpb25hbCBhbmQgYW4gYXNzZXJ0 aW9uIHRoYXQgUkZDcyBwdWJsaXNoZWQgaW4gMjAwOSBjb3ZlcnMgZXZlcnl0aGluZy4gIFRocmVh dHMgaGF2ZSBldm9sdmVkIHNpbmNlIHRoZW4uIA0KSW4gbG9va2luZyBhdCBSRkM1NDE1LCBTZWN0 aW9uIDEyLjEsIEkgc2VlOg0KDQogICBXaXRoaW4gQ0FQV0FQLCBEVExTIGlzIHVzZWQgdG8gc2Vj dXJlIHRoZSBsaW5rIGJldHdlZW4gdGhlIFdUUCBhbmQNCiAgIEFDLiAgSW4gYWRkaXRpb24gdG8g c2VjdXJpbmcgY29udHJvbCBtZXNzYWdlcywgaXQncyBhbHNvIGEgbGluayBpbg0KICAgdGhpcyBj aGFpbiBvZiB0cnVzdCBmb3IgZXN0YWJsaXNoaW5nIGxpbmsgbGF5ZXIga2V5cy4gIENvbnNlcXVl bnRseSwNCiAgIG11Y2ggcmVzdHMgb24gdGhlIHNlY3VyaXR5IG9mIERUTFMuDQogDQogICAgSW4g c29tZSBDQVBXQVAgZGVwbG95bWVudCBzY2VuYXJpb3MsIHRoZXJlIGFyZSB0d28gY2hhbm5lbHMg YmV0d2Vlbg0KICAgdGhlIFdUUCBhbmQgQUM6IHRoZSBjb250cm9sIGNoYW5uZWwsIGNhcnJ5aW5n IENBUFdBUCBDb250cm9sDQogICBtZXNzYWdlcywgYW5kIHRoZSBkYXRhIGNoYW5uZWwsIG92ZXIg d2hpY2ggY2xpZW50IGRhdGEgcGFja2V0cyBhcmUNCiAgIHR1bm5lbGVkIGJldHdlZW4gdGhlIEFD IGFuZCBXVFAuICBUeXBpY2FsbHksIHRoZSBjb250cm9sIGNoYW5uZWwgaXMNCiAgIHNlY3VyZWQg YnkgRFRMUywgd2hpbGUgdGhlIGRhdGEgY2hhbm5lbCBpcyBub3QuDQoNCiAgIFRoZSB1c2Ugb2Yg cGFyYWxsZWwgcHJvdGVjdGVkIGFuZCB1bnByb3RlY3RlZCBjaGFubmVscyBkZXNlcnZlcw0KICAg c3BlY2lhbCBjb25zaWRlcmF0aW9uLCBidXQgZG9lcyBub3QgY3JlYXRlIGEgdGhyZWF0LiAgVGhl cmUgYXJlIHR3bw0KICAgcG90ZW50aWFsIGNvbmNlcm5zOiBhdHRlbXB0aW5nIHRvIGNvbnZlcnQg cHJvdGVjdGVkIGRhdGEgaW50bw0KICAgdW5wcm90ZWN0ZWQgZGF0YSBhbmQgYXR0ZW1wdGluZyB0 byBjb252ZXJ0IHVuLXByb3RlY3RlZCBkYXRhIGludG8NCiAgIHByb3RlY3RlZCBkYXRhLiAgVGhl c2UgY29uY2VybnMgYXJlIGFkZHJlc3NlZCBiZWxvdy4NCg0KV291bGRuJ3QgaW50ZXJjZXB0aW9u IGFuZCB0YW1wZXJpbmcgb2YgdGhhdCB0cmFmZmljIHBvc2UgYSB0aHJlYXQ/ICBIb3cgYWJvdXQg Z2FpbmluZyBhY2Nlc3MgdG8gdGhlIGNvbnRyb2wgY2hhbm5lbD8NCg0KW2R1em9uZ3BlbmddDQpJ biBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBzZWN0aW9uIG9mIFJGQyA1NDE1LCB0aGUgdGhyZWF0 cyBoYXZlIGJlZW4gYW5hbHl6ZWQgaW5jbHVkaW5nIGludGVyY2VwdGlvbiBhbmQgdGFtcGVyaW5n Lg0KVGhlIGNvbnRyb2wgY2hhbm5lbCBpcyBtYW5kYXRvcnkgZm9yIGVuY3J5cHRpb24uIEluIENB UFdBUCwgbWF0dXJlIHNlY3VyaXR5IG1lY2hhbmlzbSAoRFRMUykgaGFzIGJlZW4gdXNlZCB0byBw cm90ZWN0IHRoZSBjb250cm9sIGNoYW5uZWwuDQpbL2R1em9uZ3BlbmddDQoNCldoaWxlIEkgZG9u J3QgdGhpbmsgdGhpcyBpcyB0aGUgcmlnaHQgZHJhZnQgdG8gbWFrZSBjaGFuZ2VzIGZvciBSRkM1 NDE1LCBJIGRvbid0IHRoaW5rIGl0J3MgYWRlcXVhdGUgdG8gc2F5IHRoZSBjb250cm9sIGNoYW5u ZWwgaXMgb3B0aW9uYWwgZm9yIGVuY3J5cHRpb24uICBJIGNvdWxkIHNlZSBob3cgdGhlIGRhdGEg bWlnaHQgYmUgaGFuZGxlZCBlbHNld2hlcmUuICBUaGUgZGVzY3JpcHRpb24gZGlzY3Vzc2VzIHRo aXMgYXMgdGFsa2luZyB0byBodW5kcmVkcyBvZiB0aG91c2FuZHMgb2YgYWNjZXNzIHBvaW50cywg aXNuJ3QgdGhhdCBhY2Nlc3MgYSB0aHJlYXQ/ICANCg0KW2R1em9uZ3BlbmddDQpJbiBSRkMgNTQx NSwgaXQgaXMgc2FpZCB0aGF0DQpDQVBXQVAgQ29udHJvbCBtZXNzYWdlcywgYW5kIG9wdGlvbmFs bHkgQ0FQV0FQIERhdGENCiAgIG1lc3NhZ2VzLCBhcmUgc2VjdXJlZCB1c2luZyBEYXRhZ3JhbSBU cmFuc3BvcnQgTGF5ZXIgU2VjdXJpdHkgKERUTFMpDQogICBbUkZDNDM0N10uIA0KU28gSU1PLCB0 aGUgY29udHJvbCBjaGFubmVsIGlzIG1hbmRhdG9yeSBmb3IgZW5jcnlwdGlvbi4NClsvZHV6b25n cGVuZ10NCg0KVGhpcyBkcmFmdCBhbGxvd3MgZm9yIGFkZGl0aW9uYWwgZW5jYXBzdWxhdGlvbiBt ZXRob2RzLCB3ZSBjb3VsZCByZXF1aXJlIGVuY3J5cHRpb24gZm9yIHRoZXNlIG5ldyBlbmNhcHN1 bGF0aW9uIG1ldGhvZHMuDQoNCltkdXpvbmdwZW5nXQ0KSW4gdGhlIGRlcGxveW1lbnQsIGZvciBz ZWN1cml0eSBjb25zaWRlcmF0aW9uLCB3ZSBjYW4gZGVwbG95IElQU2VjIGJldHdlZW4gV1RQIGFu ZCBBUiB0byBwcm90ZWN0IHRoZSBkYXRhIGNoYW5uZWwuDQpbL2R1em9uZ3BlbmddDQoNClRoaXMg c2hvdWxkIHByb2JhYmx5IGJlIGEgZGlzY3Vzcywgc28gSSB3b3VsZCBhcHByZWNpYXRlIHNvbWUg ZGlzY3Vzc2lvbiBvbiB0aGlzIHRvIHNlZSBpZiB3ZSBoYXZlIG9wdGlvbiBoZXJlIG9yIGlmIHNv bWV0aGluZyB3aWxsIGNoYW5nZSBpbiB0aGUgcmVmZXJlbmNlZCBSRkNzIHNvb24uDQoNCltkdXpv bmdwZW5nXQ0KQWdyZWUuIA0KWy9kdXpvbmdwZW5nXQ0KDQoNCg== --_006_BAFEC9523F57BC48A51C20226A5589575FECA9DEnkgeml514mbxchi_ Content-Type: text/plain; name="reply to Alexey Melnikov's comments.txt" Content-Description: reply to Alexey Melnikov's comments.txt Content-Disposition: attachment; filename="reply to Alexey Melnikov's comments.txt"; size=381; creation-date="Mon, 15 May 2017 09:51:02 GMT"; modification-date="Mon, 15 May 2017 09:51:02 GMT" Content-Transfer-Encoding: base64 KzEgdG8gS2F0bGVlbidzIGNvbW1lbnQgYWJvdXQgb3B0aW9uYWwgZGF0YSBjaGFubmVsIHByb3Rl Y3Rpb24uDQoNCltkdXpvbmdwZW5nXSBBdCB0aGUgc2VjdXJpdHkgYXNwZWN0LCB3ZSBzdWdnZXN0 IHVzaW5nIHRoZSBJUFNlYyB0byBwcm90ZWN0IHRoZSBkYXRhIHR1bm5lbCBiZXR3ZWVuIFdUUCBh bmQgQVIuIFsvZHV6b25ncGVuZ10NCg0KSW4gMy4zLiBJRUVFIDgwMi4xMSBXVFAgQWx0ZXJuYXRl IFR1bm5lbCBGYWlsdXJlIEluZGljYXRpb24NCg0KTGVuZ3RoID09IDQsIGJ1dCBzaG91bGQgaXQg YmUgPjQgZHVlIHRvIElQdjQvSVB2NiBhZGRyZXNzIGF0IHRoZSBlbmQ/DQoNCltkdXpvbmdwZW5n XSBDaGFuZ2UgdG8gPjQsIFRoYW5rcy4gWy9kdXpvbmdwZW5nXQ0K --_006_BAFEC9523F57BC48A51C20226A5589575FECA9DEnkgeml514mbxchi_ Content-Type: text/plain; name="reply to Gen-ART reviewer Paul Kyzivat's comments.txt" Content-Description: reply to Gen-ART reviewer Paul Kyzivat's comments.txt Content-Disposition: attachment; filename="reply to Gen-ART reviewer Paul Kyzivat's comments.txt"; size=10556; creation-date="Mon, 15 May 2017 09:51:05 GMT"; modification-date="Mon, 15 May 2017 09:51:05 GMT" Content-Transfer-Encoding: base64 SSBhbSB0aGUgYXNzaWduZWQgR2VuLUFSVCByZXZpZXdlciBmb3IgdGhpcyBkcmFmdC4gVGhlIEdl bmVyYWwgQXJlYSBSZXZpZXcgVGVhbSAoR2VuLUFSVCkgcmV2aWV3cyBhbGwgSUVURiBkb2N1bWVu dHMgYmVpbmcgcHJvY2Vzc2VkIGJ5IHRoZSBJRVNHIGZvciB0aGUgSUVURiBDaGFpci4gUGxlYXNl IHRyZWF0IHRoZXNlIGNvbW1lbnRzIGp1c3QgbGlrZSBhbnkgb3RoZXIgbGFzdCBjYWxsIGNvbW1l bnRzLiBGb3IgbW9yZSBpbmZvcm1hdGlvbiwgcGxlYXNlIHNlZSB0aGUgRkFRIGF0IDxodHRwOi8v d2lraS50b29scy5pZXRmLm9yZy9hcmVhL2dlbi90cmFjL3dpa2kvR2VuQXJ0ZmFxPi4NCiANCkRv Y3VtZW50OiBkcmFmdC1pZXRmLW9wc2F3Zy1jYXB3YXAtYWx0LXR1bm5lbC0wOA0KUmV2aWV3ZXI6 IFBhdWwgS3l6aXZhdA0KUmV2aWV3IERhdGU6IDIwMTYtMDktMzANCklFVEYgTEMgRW5kIERhdGU6 IDIwMTYtMDktMzANCklFU0cgVGVsZWNoYXQgZGF0ZTogTm90IHlldA0KIA0KU3VtbWFyeToNCiAN ClRoaXMgZHJhZnQgaXMgb24gdGhlIHJpZ2h0IHRyYWNrIGJ1dCBoYXMgb3BlbiBpc3N1ZXMsIGRl c2NyaWJlZCBpbiB0aGUgcmV2aWV3Lg0KIA0KR2VuZXJhbCBJbXByZXNzaW9uOiBJIHdhcyBhYmxl IHRvIGdlbmVyYWxseSB1bmRlcnN0YW5kIHdoYXQgdGhpcyBkb2N1bWVudCBpcyB0cnlpbmcgdG8g ZG8sIGFuZCB0aGUgZGV0YWlscyBnZW5lcmFsbHkgc2VlbSB0byBiZSB0aGVyZS4gDQpCdXQgSSB3 YXMgdW5hYmxlIHRvIHB1dCBhbGwgdGhlIHBpZWNlcyB0b2dldGhlciB0byBtYWtlIHRoZSBlbnRp cmUgdGhpbmcgd29yay4gSSB0aGluayB0aGlzIGlzIGR1ZSB0byBwcm9ibGVtcyB3aXRoIHRoZSBv cmdhbml6YXRpb24gb2YgdGhlIGRvY3VtZW50IGFuZCBwb3NzaWJseSBzb21lIG1pc3NpbmcgcGll Y2VzIG9mIGluZm9ybWF0aW9uLiBJIGZlZWwgdGhpcyBkb2N1bWVudCBuZWVkcyBzb21lIHJlb3Jn YW5pemF0aW9uIGlmIGl0IGlzIHRvIGJlIHVuZGVyc3Rvb2QgYnkgc29tZWJvZHkgbmV3IHRvIGl0 Lg0KIA0KSXNzdWVzOg0KIA0KTWFqb3I6IDUNCk1pbm9yOiA5DQpOaXRzOiAgMA0KIA0KKE5PVEU6 IEkgaGFkIGEgbG90IG9mIHRyb3VibGUgY2xhc3NpZnlpbmcgdGhlIGxldmVsIG9mIHRoZSBpc3N1 ZXMuIEkgZmluYWxseSBkZWNpZGVkIHRvIGNsYXNzaWZ5IHRoZSBNYWpvciBpZiB0aGVyZSBpcyBp bnN1ZmZpY2llbnQgaW5mb3JtYXRpb24gdG8gZG8gYW4gaW1wbGVtZW50YXRpb24uIEJ1dCB0YWtl IHRoZXNlIGNsYXNzaWZpY2F0aW9ucyB3aXRoIGEgZ3JhaW4gb2Ygc2FsdC4pDQogDQooMSkgTUlO T1I6IE5vcm1hdGl2ZSBsYW5ndWFnZToNCiANClRoaXMgZG9jdW1lbnQgY2xlYXJseSBpbnRlbmRz IHRvIHVzZSBub3JtYXRpdmUgbGFuZ3VhZ2UgLSB0aGVyZSBhcmUgbnVtZXJvdXMgb2NjdXJyZW5j ZXMgb2YgIk1VU1QiLiBIb3dldmVyIEkgYWxzbyBmaW5kIGEgbnVtYmVyIG9mIHVzZXMgb2YgInNo YWxsIiAobmV2ZXIgdXBwZXIgY2FzZSkgdGhhdCBhcHBlYXIgdG8gbWUgdG8gYmUgaW50ZW5kZWQg YXMgbm9ybWF0aXZlIHN0YXRlbWVudHMuDQoNCltkdXpvbmdwZW5nXSBDaGFuZ2UgdG8gTVVTVCwg YW5kIFNIQUxMIFsvZHV6b25ncGVuZ10NCg0KKDIpIE1JTk9SOiBGaWd1cmUgNDoNCiANClRoaXMg ZmlndXJlIHNob3dzIHRoZSBXVFAgaGF2aW5nIHR3byBkaXN0aW5jdCBBbHRlcm5hdGUgVHVubmVs cyBmb3IgU1NJRDEuIFRoaXMgc2VlbXMgdG8gaW1wbHkgdGhhdCBkYXRhIHRyYWZmaWMgdG8vZnJv bSBTU0lEMSBiZSBjbGFzc2lmaWVkIGFuZCByb3V0ZWQgdG8gb25lIG9yIHRoZSBvdGhlciBvZiB0 aGVzZSB0d28gdHVubmVscy4gQnV0IEkgY291bGQgZmluZCBubyBkaXNjdXNzaW9uIG9mIGFueSBs b2dpYyBmb3IgZG9pbmcgdGhpcy4NCiANCltkdXpvbmdwZW5nXSBBZGQgYSBzZW50ZW5jZToNCkFD IGNhbiBub3RpZnkgbXVsdGlwbGUgQVIgYWRkcmVzc2VzIGZvciBsb2FkICANCiAgICBiYWxhbmNp bmcgb3IgcmVkdW5kYW5jeS4gWy9kdXpvbmdwZW5nXQ0KDQooMykgTUFKT1I6IFNlY3Rpb24gMyAo UHJvdG9jb2wgQ29uc2lkZXJhdGlvbnMpOg0KIA0KVGhpcyBzZWN0aW9uIGhhcyBzb21lIG9yZ2Fu aXphdGlvbmFsIHByb2JsZW1zIHRoYXQgbWFrZSB0aGUgZG9jdW1lbnQgZGlmZmljdWx0IHRvLiBU aGlzIGlzIGhpbnRlZCBhdCBieSB0aGUgdmVyeSB2YWd1ZSB0aXRsZS4NCiANCkl0IGRlZmluZXMg dGhyZWUgbmV3IENBUFdBUCBtZXNzYWdlIEVsZW1lbnRzLCB0byBiZSBpbmNsdWRlZCBpbiBjZXJ0 YWluIENBUFdBUCBtZXNzYWdlczoNCiANCi0gU3VwcG9ydGVkIEFsdGVybmF0ZSBUdW5uZWwgRW5j YXBzdWxhdGlvbnM6IGlzIGludGVuZGVkIGZvciBpbmNsdXNpb24gaW4gYSBDQVBXQVAgSm9pbiBS ZXF1ZXN0IGZyb20gYSBXVFAgdG8gYW4gQUMuDQogDQotIEFsdGVybmF0ZSBUdW5uZWwgRW5jYXBz dWxhdGlvbnM6IGlzIGludGVuZGVkIGZvciBpbmNsdXNpb24gaW4gYW4gSUVFRQ0KODAyLjExIFdM QU4gQ29uZmlndXJhdGlvbiBSZXF1ZXN0IG1lc3NhZ2UgZnJvbSBhbiBBQyB0byBhIFdUUC4NCiAN Ci0gSUVFRSA4MDIuMTEgV1RQIEFsdGVybmF0ZSBUdW5uZWwgRmFpbHVyZSBJbmRpY2F0aW9uOiBp cyBpbnRlbmRlZCBmb3IgaW5jbHVzaW9uIGluIGEgQ0FQV0FQIG1lc3NhZ2VzIGZyb20gYSBXVFAg dG8gYW4gQUMuIFRoZSBtZXNzYWdlIHR5cGUocykgdGhhdCBzaG91bGQgY2FycnkgdGhpcyB3ZXJl IHVuY2xlYXIgdG8gbWUsIHRob3VnaCBwcm9iYWJseSBldmlkZW50IHRvIHNvbWVvbmUgZmFtaWxp YXIgd2l0aCBDQVBXQVAuDQoNCiBbZHV6b25ncGVuZ10gQWRkIGEgc2VudGVuY2U6DQpJdCBNQVkg YmUgY2FycmllZCBpbiB0aGUgQ0FQV0FQIFN0YXRpb24gQ29uZmlndXJhdGlvbiBSZXF1ZXN0IG1l c3NhZ2Ugd2hpY2ggaXMgZGVmaW5lZCBpbiBbUkZDNTQxNV0uIFsvZHV6b25ncGVuZ10NCg0KQW4g ZXh0ZW5zaWJsZSBzZXQgb2YgQWx0ZXJuYXRlIFR1bm5lbCBFbmNhcHN1bGF0aW9uIHR5cGVzIGlz IGRlZmluZWQuIA0KVGhlc2UgYXJlIHJlZmVyZW5jZWQgYnkgYm90aCBTdXBwb3J0ZWQgQWx0ZXJu YXRlIFR1bm5lbCBFbmNhcHN1bGF0aW9ucyBhbmQgQWx0ZXJuYXRlIFR1bm5lbCBFbmNhcHN1bGF0 aW9ucy4NCiANCkVhY2ggb2YgdGhlc2UgcmVxdWlyZXMgc3BlY2lmaWNhdGlvbiBvZiBhbiBJbmZv cm1hdGlvbiBFbGVtZW50IHVzZWQgdG8gY29uZmlndXJlIGl0LiBUaGUgZG9jdW1lbnQgZGVmaW5l cyBvbmx5IHRocmVlIG9mIHRoZSB0aGVzZS4gKFRoZSBkZWZpbml0aW9uIG9mIHRoZSBvdGhlcnMg aXMgZGVmZXJyZWQgdG8gZnV0dXJlIGRvY3VtZW50cy4pIFRoZSBkZWZpbml0aW9ucyBvZiB0aGVz ZSBhcmUgYWxzbyBkaXJlY3Qgc3Vic2VjdGlvbnMgb2Ygc2VjdGlvbiAzLCB0aG91Z2ggdGhleSBh cmUgYSB2ZXJ5IGRpZmZlcmVudCBzb3J0IG9mIHRoaW5nIHRoYW4gdGhlIGVhcmxpZXIgc3Vic2Vj dGlvbnMuDQoNCiAgW2R1em9uZ3BlbmddIFRoZSBzdHJ1Y3R1cmUgaXMgY2hhbmdlZCBhY2NvcmRp bmcgdG8geW91ciBzdWdnZXN0aW9uLiBbL2R1em9uZ3BlbmddDQoNCk9mIHRoZXNlIHRocmVlLCB0 d28gYXJlIHF1aXRlIHNpbXBsZSBhbmQgdW5kZXJzdGFuZGFibGUuIFRoZSB0aGlyZCAoR1JFKSBh cHBlYXJzIHRvIGJlIHZlcnkgY29tcGxleCwgd2l0aCBuZXN0ZWQgc3ViLWVsZW1lbnRzLiBJIHdh cyB1bmFibGUgdG8gZnVsbHkgZGVjaXBoZXIgdGhpcy4gKE1vcmUgYmVsb3cuKQ0KDQogW2R1em9u Z3BlbmddIEV4cGxhbmF0aW9ucyBhcmUgYWRkZWQgYWNjb3JkaW5nIHRvIHlvdXIgc3VnZ2VzdGlv bi4gWy9kdXpvbmdwZW5nXQ0KDQooNCkgTUlOT1I6IFNlY3Rpb24gMy4yIChBbHRlcm5hdGUgVHVu bmVsIEVuY2Fwc3VsYXRpb25zIFR5cGUpOg0KIA0KU2VjdGlvbiAzLjEgc2hvd3MgdGhlIFR1bm5l bC1UeXBlIGJlaW5nIGNhcnJpZWQgaW4gYW4gOC1iaXQgZmllbGQsIHdoaWxlIHNlY3Rpb24gMy4y IHVzZXMgYSAxNi1iaXQgZmllbGQuIFRoZSBhY3R1YWwgdmFsdWVzIGFyZSBkZWZpbmVkIGluIHNl Y3Rpb24gMy4yIGFuZCBpbmNsdWRlIG9ubHkgdmFsdWVzIDAtNiwgd2l0aCBvdGhlciB2YWx1ZXMg cmVzZXJ2ZWQgZm9yIGZ1dHVyZSB1c2UuIFRoZSBJQU5BIENvbnNpZGVyYXRpb25zIHNlY3Rpb24g ZGVmaW5lcyB0aGlzIGFzIGEgMTYtYml0IHZhbHVlLg0KIA0KSXQgbWlnaHQgYmUgd2lzZSB0byBy ZXN0cmljdCB0aGlzIHRvIDgtYml0cyBpbiB0aGUgSUFOQSBjb25zaWRlcmF0aW9ucywgYW5kIGlu IHNlY3Rpb24gMy4yIHJlc2VydmUgdGhlIGZpcnN0IDggYml0cyBvZiB0aGUgdHlwZSBmaWVsZCwg YXMgaW46DQoNCiAgW2R1em9uZ3BlbmddIENoYW5nZSB0byAxNmJpdHMuIFsvZHV6b25ncGVuZ10N Cg0KICAgICAgICAwICAgICAgICAgICAgICAgICAgIDEgICAgICAgICAgICAgICAgICAgMiAgICAg ICAgICAgICAgICAgICAzDQogICAgICAgIDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxIDIgMyA0IDUg NiA3IDggOSAwIDEgMiAzIDQgNSA2IDcgOCA5IDAgMQ0KICAgICAgICArLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKw0KICAgICAg ICB8ICAgICAgIDAgICAgIHwgIFR1bm5lbC1UeXBlICB8ICBJbmZvIEVsZW1lbnQgTGVuZ3RoICAg ICAgICAgICAgfA0KICAgICAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKw0KICAgICAgICB8ICAgSW5mbyBFbGVtZW50DQog ICAgICAgICstKy0rLSstKy0rLSstKy0rLSsNCiANCldoaWxlIHRoaXMgc2VjdGlvbiBkZWZpbmVz IGEgbmV3IHJlZ2lzdHJ5IG9mIHR1bm5lbCB0eXBlcywgYW5kIGZvcm1hdHMgZm9yIGRlc2NyaXB0 aXZlIGluZm9ybWF0aW9uIGVsZW1lbnQgYWJvdXQgZWFjaCwgdGhlcmUgc2VlbSB0byBiZSBubyBy dWxlcyBmb3IgZGVmaW5pbmcgbmV3IHZhbHVlcy4NCg0KIFtkdXpvbmdwZW5nXSBPdGhlciB0dW5u ZWwgdHlwZXMgY2FuIGJlIGhhbmRsZWQgbGlrZXdpc2UuDQpBbHNvLCBpbiB0aGUgSUFOQSBwYXJ0 LCB0aGVyZSBhcmUgc29tZSBleHBsYW5hdGlvbnM6DQpGdXR1cmUgYWxsb2NhdGlvbnMgb2YgdmFs dWVzIGluIHRoaXMgbmFtZSBzcGFjZSBhcmUgdG8gYmUgYXNzaWduZWQgYnkgSUFOQSB1c2luZyB0 aGUgIlNwZWNpZmljYXRpb24gUmVxdWlyZWQiIHBvbGljeS4gSUFOQSBuZWVkcyB0byBjcmVhdGUg YSByZWdpc3RyeSBjYWxsZWQgQ0FQV0FQIEFsdGVybmF0ZSBUdW5uZWwtVHlwZXMuLiBbL2R1em9u Z3BlbmddDQoNCkFsc28sIEkgaGFkIHRyb3VibGUgZmlndXJpbmcgb3V0IHdoaWNoIHBvcnRpb25z IG9mIHRoaXMgZG9jdW1lbnQgYXJlIGRlZmluaW5nIEluZm9ybWF0aW9uIEVsZW1lbnRzIGZvciB1 c2UgaW4gdGhpcyBtZXNzYWdlLCBhbmQgd2hpY2ggYXJlIGRlZmluaW5nIHNvbWV0aGluZyBlbHNl LiBJdCB3b3VsZCBoZWxwIGlmIHRoZSBkZXNjcmlwdGlvbiBvZiBlYWNoIHR1bm5lbCB0eXBlIGlu IHRoZSBsaXN0IGluIHRoaXMgc2VjdGlvbiBoYWQgYSBjcm9zcyByZWZlcmVuY2UgdG8gdGhlIHNl Y3Rpb24gdGhhdCBkZWZpbmVzIHRoZSBJbmZvcm1hdGlvbiBFbGVtZW50IGZvciB0aGF0IHR5cGUu IChCdXQgYSBtb3JlIG1ham9yIHJlb3JnYW5pemF0aW9uIHdvdWxkIGJlIGJldHRlci4pDQogDQpb ZHV6b25ncGVuZ10gU2V2ZW4gc3ViLWVsZW1lbnRzIGFyZSBkZWZpbmVkLCBpbiB3aGljaCB0aHJl ZSBhcmUgc3BlY2lmaWMgZm9yIENBUFdBUCwgb25lIGlzIHNwZWNpZmljIGZvciBHUkUsIGFuZCBv dGhlcnMgYXJlIGNvbW1vbiBvbmVzLiBbL2R1em9uZ3BlbmddDQoNCig1KSBNQUpPUjogU2VjdGlv biAzLjQgKENBUFdBUCBiYXNlZCBBbHRlcm5hdGUgVHVubmVsKToNCiANCkZvciB0aGUgQ0FQV0FQ IFRyYW5zcG9ydCBQcm90b2NvbCBFbGVtZW50IHRoZSBkZXNjcmlwdGlvbiBtZW50aW9ucyB0d28g cG9zc2libGUgdmFsdWVzIChVRFAgYW5kIFVEUC1MaXRlKSwgYnV0IGZhaWxzIHRvIHN0YXRlIHdo YXQgZW5jb2RpbmcgaXMgdXNlZCB0byBkZXNpZ25hdGUgdGhlbS4NCg0KIFtkdXpvbmdwZW5nXSAx IGZvciBVRFAtbGl0ZSwgYW5kIDIgZm9yIFVEUCwgYXMgZGVmaW5lZCBpbiBSRkM1NDE1LiBbL2R1 em9uZ3BlbmddDQoNCig2KSBNQUpPUjogU2VjdGlvbiAzLjYgKEdSRSBiYXNlZCBBbHRlcm5hdGUg VHVubmVsKToNCiANCkJhc2VkIG9uIHNlY3Rpb24gMy4yLCBJIHdhcyBleHBlY3RpbmcgdGhlIGRl ZmluaXRpb24gb2YgKm9uZSogaW5mb3JtYXRpb24gZWxlbWVudCBmb3JtYXQgZm9yIEdSRSB0dW5u ZWxzLiBCdXQgdGhpcyBzZWN0aW9uIHNheXMgIlRoZSBpbmZvcm1hdGlvbiBlbGVtZW50KnMqIG5l ZWRlZCBmb3Igc3VwcG9ydGluZyB0aGlzIG1vZGUgYXJlIGRlZmluZWQgaW4gU2VjdGlvbiAzLjcg YW5kIFNlY3Rpb24gMy43LjYuIiBhbmQgcHJvY2VlZHMgdG8gZGVmaW5lIG1vcmUgdGhhbiBvbmUu IA0KQW5kIHJlZmVyZW5jaW5nIGJvdGggMy43IGFuZCAzLjcuNiBzZWVtcyBhdCBsZWFzdCBvZGQu IEkgc3VzcGVjdCB0aGUgcmVmZXJlbmNlIHRvIDMuNy42IGlzIGEgbWlzdGFrZSBiZWNhdXNlIHRo ZXJlIHNlZW1zIG5vdGhpbmcgc3BlY2lhbCBhYm91dCBpdC4NCiANCltkdXpvbmdwZW5nXSBJdCBo YXMgYmVlbiBjaGFuZ2VkLiBbL2R1em9uZ3BlbmddDQoNCig3KSBNQUpPUjogU2VjdGlvbiAzLjcg KEFsdGVybmF0ZSBUdW5uZWwgSW5mb3JtYXRpb24gRWxlbWVudHMpOg0KIA0KSXQgYXBwZWFycyB0 aGF0IHNlY3Rpb25zIDMuNy5uIGRlZmluZSBzdWItZWxlbWVudHMgb2YgYW4gb3ZlcmFsbCBHUkUg SW5mb3JtYXRpb24gRWxlbWVudCwgYnV0IEkgZmluZCBubyBkZWZpbml0aW9uIG9mIHRoYXQgb3Zl cmFsbCBlbGVtZW50Lg0KIA0KW2R1em9uZ3BlbmddIEl0IGhhcyBiZWVuIGNoYW5nZWQuIFsvZHV6 b25ncGVuZ10NCg0KKDgpIE1JTk9SOiBTZWN0aW9uIDMuNy4xIChBY2Nlc3MgUm91dGVyIEluZm9y bWF0aW9uIEVsZW1lbnRzKToNCiANClRoaXMgc2F5czogIlRoZSBBUiBpbmZvcm1hdGlvbiBtYXkg YmUgSVB2NCBhZGRyZXNzLCBJUHY2IGFkZHJlc3MsIG9yIEFSIGRvbWFpbiBuYW1lLiIgVGhlbiBp dCBoYXMgc3Vic2VjdGlvbnMgZGVmaW5pbmcgSVB2NCBhbmQgSVB2NiBhZGRyZXNzZXMuIA0KQnV0 IEkgY2FuIGZpbmQgbm90aGluZyB0aGF0IHNheXMgaG93IHRvIHNwZWNpZnkgYSBkb21haW4gbmFt ZS4NCiANCltkdXpvbmdwZW5nXSBJdCBoYXMgYmVlbiBjaGFuZ2VkLiBUaGFua3MuIFsvZHV6b25n cGVuZ10NCg0KKDkpIE1BSk9SOiBTZWN0aW9uIDMuNy4xLjEgKEFSIElQdjQgTGlzdCBFbGVtZW50 KToNCiANClRoaXMgc2VjdGlvbiBzZWVtcyB0byBjYWxsIGZvciBhIGNvbnN0YW50IHZhbHVlIGRl c2lnbmF0aW5nICJBUiBJUHY0IEVsZW1lbnQgVHlwZSIgYnV0IEkgZmluZCBubyBzcGVjaWZpY2F0 aW9uIG9mIHdoYXQgdGhhdCB2YWx1ZSBtaWdodCBiZS4NCiANCltkdXpvbmdwZW5nXSBJdCBoYXMg YmVlbiBhZGRlZC4gVGhhbmtzLiBbL2R1em9uZ3BlbmddDQoNCigxMCkgTUFKT1I6IFNlY3Rpb24g My43LjEuMiAoQVIgSVB2NiBMaXN0IEVsZW1lbnQpOg0KIA0KVGhpcyBzZWN0aW9uIHNlZW1zIHRv IGNhbGwgZm9yIGEgY29uc3RhbnQgdmFsdWUgZGVzaWduYXRpbmcgIkFSIElQdjYgRWxlbWVudCBU eXBlIiBidXQgSSBmaW5kIG5vIHNwZWNpZmljYXRpb24gb2Ygd2hhdCB0aGF0IHZhbHVlIG1pZ2h0 IGJlLg0KIA0KW2R1em9uZ3BlbmddIEl0IGhhcyBiZWVuIGFkZGVkLiBUaGFua3MuIFsvZHV6b25n cGVuZ10NCg0KKDExKSBNQUpPUjogU2VjdGlvbiAzLjcuMiAoSUVFRSA4MDIuMTEgV0xBTiBDb25m aWd1cmF0aW9uIFJlc3BvbnNlKToNCiANCkkgdGhvdWdodCB0aGlzIHNlY3Rpb24gc2hvdWxkIGJl IGRlZmluaW5nIHBhcnQgb2YgdGhlIEluZm9ybWF0aW9uIEVsZW1lbnQgZm9yIHRoZSBBbHRlcm5h dGUgVHVubmVsIEVuY2Fwc3VsYXRpb24gVHlwZSBtZXNzYWdlIGVsZW1lbnQgZnJvbSB0aGUgQUMg dG8gdGhlIFdUUC4gWWV0IHRoaXMgc2VjdGlvbiBzYXlzIHRoYXQgaXQgaXMgaW50ZW5kZWQgdG8g YmUgc2VudCBmcm9tIHRoZSBXVFAgdGhlIHRoZSBBQy4gVGhpcyBsZWZ0IG1lIHNjcmF0Y2hpbmcg bXkgaGVhZCBhcyB0byB3aGF0IGl0IGlzIGFuZCB3aGVyZSBpdCBnb2VzLg0KIA0KW2R1em9uZ3Bl bmddIEl0J3MgcGxhY2UgaGFzIGJlZW4gY2hhbmdlZCBpbnRvIHRoZSBpbnRyb2R1Y3Rpb24uIFRo YW5rcy4gWy9kdXpvbmdwZW5nXQ0KDQooMTIpIE1BSk9SOiBTZWN0aW9uIDMuNy4zIChUdW5uZWwg RFRMUyBQb2xpY3kgRWxlbWVudCk6DQogDQpJIGRvbid0IHVuZGVyc3RhbmQgd2hlcmUgdGhpcyBl bGVtZW50IGlzIGludGVuZGVkIHRvIGJlIGluc2VydGVkLg0KDQpbZHV6b25ncGVuZ10gSXQgaXMg b25lIG9mIHRoZSBzdWItZWxlbWVudHMgd2hlbiB0aGUgQ0FQV0FQIGFsdGVybmF0aXZlIHR1bm5l bCB0eXBlIGlzIHVzZWQuIFsvZHV6b25ncGVuZ10NCiANClRoZSB0aXRsZSBvZiB0aGlzIHNlY3Rp b24gaXMgIlR1bm5lbCBEVExTIFBvbGljeSBFbGVtZW50IiwgYnV0IGluIGZpZ3VyZQ0KMTMgdGhl IHR5cGUgZmllbGQgaXMgY2FsbGVkICJUdW5uZWwgRFRMUyBFbGVtZW50IFR5cGUiLiBXaHkgYXJl IHRoZXNlIGRpZmZlcmVudD8gQWxzbywgSSBmaW5kIG5vIGRlZmluZWQgbnVtZXJpYyB2YWx1ZSBm b3IgdGhpcyBmaWVsZC4NCiANCltkdXpvbmdwZW5nXSBJdCBoYXMgYmVlbiBjaGFuZ2VkLiBUaGFu a3MuIFsvZHV6b25ncGVuZ10NCg0KKDEzKSBNQUpPUjogU2VjdGlvbiAzLjcuNCAoSUVFRSA4MDIu MTEgVGFnZ2luZyBNb2RlIFBvbGljeSBFbGVtZW50KToNCiANClRoaXMgcmVmZXJlbmNlcyB0aGUg ODAyLjExIFRhZ2dpbmcgTW9kZSBQb2xpY3kgaW4gUkZDNTQxNi4gQnV0IEkgd2FzIHVuYWJsZSB0 byBkZWNpcGhlciBob3cgdGhhdCByZWxhdGVzIHRvIHRoZSBBbHRlcm5hdGUgVHVubmVsIEVuY2Fw c3VsYXRpb24gVHlwZSBtZXNzYWdlLg0KIA0KW2R1em9uZ3BlbmddIEl0IGlzIG9uZSBvZiB0aGUg c3ViLWVsZW1lbnRzIHdoZW4gdGhlIENBUFdBUCBhbHRlcm5hdGl2ZSB0dW5uZWwgdHlwZSBpcyB1 c2VkLiBbL2R1em9uZ3BlbmddDQoNCigxNCkgTUlOT1I6IFNlY3Rpb24gNCAoSUFOQSBDb25zaWRl cmF0aW9ucyk6DQogDQpUaGlzIGFza3MgSUFOQSB0byBjcmVhdGUgYSBuZXcgcmVnaXN0cnkgb2Yg QWx0ZXJuYXRlIHR1bm5lbCB0eXBlcy4gVGhlIG9ubHkgdmFsdWVzIGluIHRoZSByZWdpc3RyeSBm b3IgZWFjaCB0eXBlIGFyZSB0aGUgbnVtZXJpYyB2YWx1ZSwgYSBodW1hbiBmcmllbmRseSBuYW1l LCBhbmQgYSByZWZlcmVuY2UuIFRoZSByZWZlcmVuY2VzIGFyZSB0byB0aGUgZGVmaW5pdGlvbnMg b2YgdGhlIHVuZGVybHlpbmcgdHVubmVsIHByb3RvY29scy4NCiANCkkgdW5kZXJzdGFuZCwgdGhp cyBpc24ndCBzdWZmaWNpZW50IGluZm9ybWF0aW9uIHRvIHVzZSB0aGVzZSB2YWx1ZXMuIEl0IGlz IGFsc28gbmVjZXNzYXJ5IHRvIGtub3cgdGhlIGZvcm1hdCBvZiB0aGUgYXNzb2NpYXRlZCBJbmZv cm1hdGlvbiBFbGVtZW50IGZvciBlYWNoIHR5cGUuIEZvciAqc29tZSogb2YgdGhlIHR5cGVzIHRo YXQgaW5mb3JtYXRpb24gaXMgcHJlc2VudCBpbiB0aGlzIGRvY3VtZW50LiBGb3Igb3RoZXJzIHRo YXQgaW5mb3JtYXRpb24gaXMgbGVmdCBmb3IgZnV0dXJlIGRlZmluaXRpb24sIHByZXN1bWFibHkg aW4gc29tZSBuZXcgZG9jdW1lbnQuDQoNCiBbZHV6b25ncGVuZ10gVGhyZWUgb2YgdGhlbSBjYW4g YmUgZm91bmQgaW4gdGhpcyBkb2N1bWVudC4gSW4gdGhlIG5ldyBTZWN0aW9uIDQsIENBUFdBUCwg UE1JUCwgYW5kIEdSRaGvcyBhc3NvY2lhdGVkIEluZm9ybWF0aW9uIEVsZW1lbnQgYXJlIGludHJv ZHVjZWQuDQpBcyBzYWlkIGluIHRoZSBkb2N1bWVudCwgb3RoZXIgdHVubmVsIHR5cGVzIHdpbGwg bm90IGJlIGRpc2N1c3NlZCBpbiB0aGlzIGRvY3VtZW50LCBhbmQgcGVyaGFwcyB3aWxsIGJlIGRl ZmluZWQgaW4gc29tZSBuZXcgZG9jdW1lbnQuWy9kdXpvbmdwZW5nXQ0KDQpUaGUgcmVnaXN0cnkg bmVlZHMgdG8gaGF2ZSBhIHJlZmVyZW5jZSB0byBhIGRvY3VtZW50IHNwZWNpZnlpbmcgdGhlIGZv cm1hdCBvZiB0aGUgSW5mb3JtYXRpb24gRWxlbWVudCBmb3IgdGhlIHR5cGUuDQogDQpBbHNvLCBp dCB3b3VsZCBiZSB2ZXJ5IGhlbHBmdWwgaWYgdGhlcmUgd2FzIGEgdGVtcGxhdGUgZm9yIGhvdyB0 byBzcGVjaWZ5IHRoZSBJbmZvcm1hdGlvbiBFbGVtZW50IGZvciBhIHR5cGUsIGFuZCBmb3IgdGhp cyBkb2N1bWVudCB0byBmb2xsb3cgdGhhdCBmb3JtYXQgZm9yIHRoZSBvbmVzIGl0IGRlZmluZXMu DQoNCiAgW2R1em9uZ3BlbmddDQpUaGlzIGRvY3VtZW50IGhhcyBwcm92aWRlIHRocmVlIGV4YW1w bGVzLCBhbmQgb3RoZXIgdHVubmVsIHR5cGVzIGNhbiBiZSBkZWZpbmVkIGxpa2V3aXNlIHdoaWxl IGNvbnNpZGVyaW5nIHRoZSBwcm90b2NvbCBzcGVjaWZpYyBjaGFyYWN0ZXJpc3RpY3MuDQpbL2R1 em9uZ3BlbmddDQo= --_006_BAFEC9523F57BC48A51C20226A5589575FECA9DEnkgeml514mbxchi_ Content-Type: text/plain; name="=?iso-8859-1?Q?reply_to_Mirja_K=FChlewind's_comments.txt?=" Content-Description: =?iso-8859-1?Q?reply_to_Mirja_K=FChlewind's_comments.txt?= Content-Disposition: attachment; filename="=?iso-8859-1?Q?reply_to_Mirja_K=FChlewind's_comments.txt?="; size=188; creation-date="Mon, 15 May 2017 09:51:17 GMT"; modification-date="Mon, 15 May 2017 09:51:17 GMT" Content-Transfer-Encoding: base64 DQpOaXQ6DQoNCnMvVGhpcyBzcGVjaWZpY2F0aW9uIGRlZmluZXMgdGhlIHZhbHVlcyBmcm9tIHpl cm8gKDApIHRvIGZpdmUgKDUpL1RoaXMgc3BlY2lmaWNhdGlvbiBkZWZpbmVzIHRoZSB2YWx1ZXMg ZnJvbSB6ZXJvICgwKSB0byBzaXggKDYpLw0KDQpbZHV6b25ncGVuZ10gQ2hhbmdlZC4gVGhhbmtz LiBbL2R1em9uZ3BlbmddDQo= --_006_BAFEC9523F57BC48A51C20226A5589575FECA9DEnkgeml514mbxchi_ Content-Type: text/plain; name="reply to SECDIR last call reviewer Catherine Meadows's comments.txt" Content-Description: reply to SECDIR last call reviewer Catherine Meadows's comments.txt Content-Disposition: attachment; filename="reply to SECDIR last call reviewer Catherine Meadows's comments.txt"; size=3353; creation-date="Mon, 15 May 2017 09:56:29 GMT"; modification-date="Mon, 15 May 2017 09:56:29 GMT" Content-Transfer-Encoding: base64 SSBoYXZlIHJldmlld2VkIHRoaXMgZG9jdW1lbnQgYXMgcGFydCBvZiB0aGUgc2VjdXJpdHkgZGly ZWN0b3JhdGUncyBvbmdvaW5nIGVmZm9ydCB0byByZXZpZXcgYWxsIElFVEYgZG9jdW1lbnRzIGJl aW5nIHByb2Nlc3NlZCBieSB0aGUgSUVTRy4gIFRoZXNlIGNvbW1lbnRzIHdlcmUgd3JpdHRlbiBw cmltYXJpbHkgZm9yIHRoZSBiZW5lZml0IG9mIHRoZSBzZWN1cml0eSBhcmVhIGRpcmVjdG9ycy4g IERvY3VtZW50IGVkaXRvcnMgYW5kIFdHIGNoYWlycyBzaG91bGQgdHJlYXQgdGhlc2UgY29tbWVu dHMganVzdCBsaWtlIGFueSBvdGhlciBsYXN0IGNhbGwgY29tbWVudHMuDQogDQpUaGlzIGRyYWZ0 IGRlc2NyaWJlcyBhbiBleHRlbnNpb24gdG8gdGhlIENvbnRyb2wgYW5kIFByb3Zpc2lvbmluZyBv ZiBXaXJlbGVzcyBBY2Nlc3MgUG9pbnRzIChDQVBXQVApIHByb3RvY29sIHRoYXQgZW5jYXBzdWxh dGVzIGEgc3RhdGlvbqGvcyBkYXRhIGZyYW1lcyBiZXR3ZWVuIHRoZSBXaXJlbGVzcyBUcmFuc2l0 aW9uIFBvaW50IChBVFApIGFuZCBBY2Nlc3MgQ29udHJvbGxlciAoQUMpLiAgSW4gc29tZSBjYXNl cywgaXQgbWF5IGJlIGRlc2lyYWJsZSB0byBlbmNhcHN1bGF0ZSBkYXRhIGZyYW1lcyB0byBhbiBl bnRpdHkgb3RoZXIgdGhhbiB0aGUgQUMgKGUuZy4gdG8gYW4gQWNjZXNzIFJvdXRlcikgb3IgdG8g dXNlIGRpZmZlcmVudCBlbmNhcHN1bGF0aW9uIG1vZGVscy4gIEluIHBhcnRpY3VsYXIsIHRoaXMg d291bGQgYWxsb3cgdGhlIFdUUCB0byB0dW5uZWwgbm9uLW1hbmFnZW1lbnQgZGF0YSBmcmFtZXMg dG8gYW4gZW5kcG9pbnQgZGlmZmVyZW50IHRoYW4gdGhlIEFDIGFuZCB0byB0dW5uZWwgdXNpbmcg ZGlmZmVyZW50IGtub3duIGVuY2Fwc3VsYXRpb24gdHlwZXMsIHN1Y2ggYXMgSVAtSVAsIElQLUdS RSwgb3IgQ0FQV0FQLiAgQSBwYXJ0aWN1bGFyIGFkdmFudGFnZSBvZiB0aGlzIGFwcHJvYWNoIHRo YXQgIGVuY2Fwc3VsYXRpbmcgb25seSB0aGUgY29udHJvbCBwbGFuZSB0byB0aGUgQUMsIGFuZCB0 aHVzIHNlcGFyYXRpbmcgbWFuYWdlbWVudCBvZiB0aGUgY29udHJvbCBwbGFuZSBmcm9tIHRoZSBt YW5hZ2VtZW50IG9mIHRoZSBkYXRhIHBsYW5lLCBtYWtlcyBzY2FsaW5nIGVhc2llciBhbmQgbW9y ZSBlZmZpY2llbnQuDQogDQpBcyBmYXIgYXMgSSBjYW4gdGVsbCwgdGhlcmUgZG8gbm90IHNlZW0g dG8gYmUgYW55IHNlcmlvdXMgc2VjdXJpdHkgaXNzdWVzIHdpdGggaW1wbGVtZW50aW5nIHRoaXMg YXBwcm9hY2gsIGVzcGVjaWFsbHkgc2luY2UsIGFzIGlzIG5vdGVkIGluIFJGQyBbUkZDNTQxNV0s IHRoZSBkYXRhIHBsYW5lIGlzIGFscmVhZHkgaGFuZGxlZCBkaWZmZXJlbnRseSBmcm9tIHRoZSBj b250cm9sIHBsYW5lLCB0aGUgY29udHJvbCBwbGFuZSB1c3VhbGx5IGJlaW5nIHByb3RlY3RlZCBi eSBEVExTIHdoaWxlIHRoZSBkYXRhIHBsYW4gaXMgbm90LiBIb3dldmVyLCBJIHRoaW5rIHRoZSBT ZWN1cml0eSBDb25zaWRlcmF0aW9ucyBTZWN0aW9uIG5lZWRzIHRvIG1ha2UgYSBiZXR0ZXIgY2Fz ZSBmb3IgdGhpcy4NCiANClRoZSB0ZXh0IG9mIHRoZSBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBz ZWN0aW9uIGlzIGFzIGZvbGxvd3M6DQogDQpUaGlzIGRvY3VtZW50IGludHJvZHVjZXMgdGhyZWUg bmV3IENBUFdBUCBXVFAgbWVzc2FnZSBlbGVtZW50cy4NCiAgIFRoZXNlIGVsZW1lbnRzIGFyZSB0 cmFuc3BvcnRlZCB3aXRoaW4gQ0FQV0FQIENvbnRyb2wgbWVzc2FnZXMgYXMgdGhlDQogICBleGlz dGluZyBtZXNzYWdlIGVsZW1lbnRzLiAgVGhlcmVmb3JlLCB0aGlzIGRvY3VtZW50IGRvZXMgbm90 DQogICBpbnRyb2R1Y2UgYW55IG5ldyBzZWN1cml0eSByaXNrcyBjb21wYXJlZCB0byBbUkZDNTQx NV0gYW5kIFtSRkM1NDE2XS4NCiAgIEluIENBUFdBUCwgc2VjdXJpdHkgZm9yIENBUFdBUCBEYXRh IENoYW5uZWwgaXMgb3B0aW9uYWwgYW5kIHNlY3VyaXR5DQogICBwb2xpY3kgaXMgZGV0ZXJtaW5l ZCBieSBBQy4gIFNpbWlsYXJseSwgdGhlIEFDIGRldGVybWluZXMgdGhlDQogICBzZWN1cml0eSBm b3IgdGhlIEFsdGVybmF0ZSBUdW5uZWwgYmV0d2VlbiBXVFAgYW5kIEFsdGVybmF0ZSBUdW5uZWwN CiAgIEVuY2Fwc3VsYXRpb24gR2F0ZXdheS4gIFRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBk ZXNjcmliZWQgaW4NCiAgIFtSRkM1NDE1XSBhbmQgW1JGQzU0MTZdIGFwcGx5IGhlcmUgYXMgd2Vs bC4NCiANCkkgZmluZCBpdCBoYXJkIHRvIGFncmVlIHdpdGggdGhlIGZpcnN0IHRocmVlIHNlbnRl bmNlcy4gVGhlIGRvY3VtZW50IGRvZXMgbW9yZSB0aGFuIHNpbXBseSBpbnRyb2R1Y2UgdGhyZWUg bmV3IG1lc3NhZ2UgZWxlbWVudHMuICBJdCBhbHNvIHByb3ZpZGVzIGNvbnNpZGVyYWJseSBtb3Jl IGZyZWVkb20gaW4gZW5jYXBzdWxhdGluZyBkYXRhIGZyYW1lcy4gIFNvIGl0IGFwcGVhcnMgdG8g bWUgdGhhdCB3aGF0IHRoZSBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBzZWN0aW9uIHNob3VsZCBj b25jZW50cmF0ZSBvbiBpcyB0aGUgcG90ZW50aWFsIHJpc2sgaW4gcHJvdmlkaW5nIHRoaXMgZ3Jl YXRlciBmcmVlZG9tLiANCg0KW2R1em9uZ3BlbmddDQogQWRkIHNvbWUgZGVzY3JpcHRpb25zOg0K SW4gdGhlIGRhdGEgcGxhbmUsIGlmIHRoZSBlbmNhcHN1bGF0aW9uIHR5cGUgc2VsZWN0ZWQgaXRz ZWxmIGlzIG5vdCBzZWN1cmVkLCBpdCBpcyBzdWdnZXN0ZWQgdG8gcHJvdGVjdCB0aGUgdHVubmVs IGJ5IHVzaW5nIGtub3duIHNlY3VyZSBtZXRob2RzLCBzdWNoIGFzIElQU2VjLiBbL2R1em9uZ3Bl bmddDQoNCkl0oa9zIGFsc28gbm90IGNsZWFyIHRvIG1lIHdoYXQgdGhlIHB1cnBvc2Ugb2YgdGhl IHJlbWFpbmluZyBwYXJ0IG9mIHRoZSBzZWN0aW9uLCBhYm91dCB0aGUgQUMgZGV0ZXJtaW5pbmcg dGhlIHBvbGljeS4gIEFyZSB5b3Ugc2F5aW5nIHRoYXQsIGJlY2F1c2UgdGhlIEFDIGRldGVybWlu ZXMgdGhlIHBvbGljeSBpbiBib3RoIENBUFdBUCBhbmQgdGhlIENBUFdBUCBleHRlbnNpb24sIHRo ZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBmb3IgdGhlIGZpcnN0IGNhc2UgYWxzbyBhcHBseSB0 byB0aGUgc2Vjb25kIGNhc2U/ICBTb21lIG1vcmUgZGlzY3Vzc2lvbiBvZiB3aHkgdGhpcyBpcyB0 cnVlLCB3aXRoIHJlZmVyZW5jZXMgdG8gdGhlIHJlbGV2YW50IHJpc2tzIGRpc2N1c3NlZCBpbiBb UkZDNTQxNV0gYW5kIFtSRkM1NDE2XSwgd291bGQgYmUgdXNlZnVsLiAgDQoNCltkdXpvbmdwZW5n XQlEZWxldGUgdGhlIHNlY29uZCBwYXJ0LiBJIGFsc28gZmluZCBpdCBpcyBoYXJkIHRvIHVuZGVy c3RhbmQgdGhlIHB1cnBvc2Ugb2YgdGhhdCBwYXJ0LiBbL2R1em9uZ3BlbmddDQo= --_006_BAFEC9523F57BC48A51C20226A5589575FECA9DEnkgeml514mbxchi_-- From nobody Mon May 15 09:04:58 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C2B312009C; Mon, 15 May 2017 09:04:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.101 X-Spam-Level: X-Spam-Status: No, score=-0.101 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z2VfiWVCEZOW; Mon, 15 May 2017 09:04:56 -0700 (PDT) Received: from mail-wm0-x242.google.com (mail-wm0-x242.google.com [IPv6:2a00:1450:400c:c09::242]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C586E12960D; Mon, 15 May 2017 09:00:42 -0700 (PDT) Received: by mail-wm0-x242.google.com with SMTP id y10so29568311wmh.0; Mon, 15 May 2017 09:00:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to:content-transfer-encoding; bh=BIvkChuRtGfbCwrnkWGOZQt/QrJgh4rBfodcD3PI5UU=; b=QE8RAevm1DqSkdJjiew4v2bEITYMul/0Rkxnt56Ku21sdtvmGiKW0P5Vn7ROyiSXNS DP14Efm/54lr3cXZ/2eaWHTDpa7t4T2rprdaPa4croYy17PXO03TmLqZ/bzzIWcY955n BbfiIsE0iBVFxp1MtKDG8wF+gPR7W84lMuUzqTX+HoYqmuXJ8XxM1sUBTvzniSD5ra+X +ocfdENAQB3W0U0H636uggG0MSQ0YUCcKSpQ2BSLelHFht0YX6kFwe2CUCTGcccgAGDX ti2L5oe6t9+/3L5qIkhqNzuMWIEH6BiGJIVXUAUC5nnXkQ373iALPo2DV4qwa6NRsS/W HzYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=BIvkChuRtGfbCwrnkWGOZQt/QrJgh4rBfodcD3PI5UU=; b=txm65SsJj8+VD9m6urRLBoEtSXQn+MAgB8myB0V/5Lm88b0sADKK5Xkx1sIV9/AxR+ yY2AIHscLguFTqkY8PcF+5rLvVz7wF8oD8vyIGMfQyBDFFFnQnKNnjoNWHHaf75HXBkR AuszJclh6IOvwcguNmkf4sPzB3wpmZZuuLK/pQh5noyOoKR+Yzr+tLA7PUD7xca239lb /UPTCJy7fIQaQxnPj6RIRS8ZDn3Wq+2GCTv+GZZLht/CGEwb+vAqfNgL8Z6dOOpvg1rL NtVKjF74APE960DytJKcg/uPRWIhdYJJJly0gGxE0hwEidq5e9bJp6uvE1oUEqppBsae 9AHg== X-Gm-Message-State: AODbwcDxk1nLumF8J8KFSfssR4xRIhmHUSuQQdFaLmQKD8fj5lb7rTQs TcPN7zLc2zQbtQ== X-Received: by 10.223.168.97 with SMTP id l88mr4709407wrc.54.1494864041282; Mon, 15 May 2017 09:00:41 -0700 (PDT) Received: from [192.168.191.250] ([80.69.10.100]) by smtp.gmail.com with ESMTPSA id 4sm16276176wry.31.2017.05.15.09.00.37 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 15 May 2017 09:00:39 -0700 (PDT) To: Alan DeKok References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> Cc: "Douglas Gash (dcmgash)" , "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" , "ops-ads@ietf.org" From: Ignas Bagdonas Message-ID: Date: Mon, 15 May 2017 17:00:36 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 May 2017 16:04:57 -0000 Hi Alan, On 13/05/2017 12:59, Alan DeKok wrote: > The approach in the IETF is to have authors move towards WG consensus. > i.e. to prove to to the WG that the draft is ready for publication. > If you're not going to work towards WG consensus, I suggest the chairs replace you with authors who will. > WG chairs can appoint or change authors if needed under the process described in RFC7221 and its referenced documents. The individual draft has been accepted as a WG one a while ago with no changes in author list. If current document authors would like to make any changes to author/co-author/editor list WG chairs will certainly approve those changes. Otherwise unless there is clear evidence that current authors cannot make progress with the document, WG chairs do not have intentions of changing the author list. This decision may be revisited if evidence of author/co-author/editor duties not being performed to the expected level surfaces, but at this time there is no such evidence. The process of progressing the document is slow, slower than it could have been, but it is not stalled. Thank you. Ignas From nobody Mon May 15 10:07:40 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FC7B129B5F; Mon, 15 May 2017 10:07:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=btconnect.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gO8tCCN4jpCw; Mon, 15 May 2017 10:07:35 -0700 (PDT) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-ve1eur01on0091.outbound.protection.outlook.com [104.47.1.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F3EE1201F2; Mon, 15 May 2017 10:04:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=btconnect.onmicrosoft.com; s=selector1-btconnect-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=yNP6XhQQo2XAs28b8BPz/63OtwUSO+F/AKZsrgRzBVQ=; b=Rgj0ar5bD60q6x4vJxUtUbjHmq6oWUh4qWQmJu4KH/jpkLDlmUJk7EE8fCnQnjE+VhUoV3w460BxKJ0kiCJiHFxm+MGorJ5YSsLqAEx45RcTlOgOJ9dsNJPjhCbCu2TjgrozSwKZCCZIoHzmEcn8pSW9N5g9WE8ZcfT8IXxA5CA= Authentication-Results: deployingradius.com; dkim=none (message not signed) header.d=none;deployingradius.com; dmarc=none action=none header.from=btconnect.com; Received: from pc6 (86.169.157.161) by DB6PR0701MB2997.eurprd07.prod.outlook.com (2603:10a6:4:73::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1101.8; Mon, 15 May 2017 17:04:22 +0000 Message-ID: <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> From: t.petch To: Alan DeKok , Ignas Bagdonas CC: "Douglas Gash (dcmgash)" , , , , References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> Date: Mon, 15 May 2017 18:00:37 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Originating-IP: [86.169.157.161] X-ClientProxiedBy: AM4PR0202CA0001.eurprd02.prod.outlook.com (2603:10a6:200:89::11) To DB6PR0701MB2997.eurprd07.prod.outlook.com (2603:10a6:4:73::7) X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DB6PR0701MB2997: X-MS-Office365-Filtering-Correlation-Id: 15cc4174-df0b-49f4-b5af-08d49bb46f56 X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(201703131423075)(201703031133081); SRVR:DB6PR0701MB2997; X-Microsoft-Exchange-Diagnostics: 1; DB6PR0701MB2997; 3:0vyXe8pONg8efSDcvjIZkOXWkiP1eqpDQFTMxwqAthw/dKkhCeOvUIC2t4AyA1JhX/rRra3QK9x2j+RqIewsn1EJvHJ5JgHtZBPCLDYB6qyYLSX5MJh9KwfvFjd+43SBQ4l/rlNkswELP8l8w0yczRv8iRFpXEhL92oQwTcFKGMGjCbY7mmtTNo9ogmlUikp/iPkxodiBWEIpidzdZ7ftnw7/LPFf4WNDh/r129/gs4isyDKRNjUujTony3imD0LLrtp+Z5x2EERYOMeje+DzJbk8z18h6mvw9CcKJXkVtEQtAtgqPQET4wR+USXC82Ied0LTUvV5e9z/+ZefFeRsA==; 25:pwHG84GyhL1x0SIHUkcuOoJFPGp1q3x9ggSslz58EZx30bXXDJCHEP9JpFudaOr6XfOZ0KB/GirhR2ICyzeToldSoCvKAd52wYjjXztjS6XvfISsn8VvVUcz6+Gq0CKm8mOiOBCjG1whnslqeIrnRW8LDtQeL4ARqlE2DRXRWcgviLo/ppNF4+U00OfOk8CxRgJEJe5tn6CGdekeTRu3SBdrigXn6gbQr/0QdhvC8ZUc1D1+6+pPCKvYOvOy+DWLXrbYbUtQ5enXvuYKkPVYINO7+6wfSAVVv/0+DL4QHf/vD4wrYD1S+Z+TLuWDexMu4SQBlL4g/WHmHSPnZUE9TuHeRVwZXnuuN1veUapHTozZPMs1deWXs4kH6Oc38TJ8y0y7BXjhpnsKAlgHg+kAYd5olfHUFT7S4GHn+4hJIJBsz8ad3prB02gz6u6dhdTq12Jxodw6/k4A+R4sDubzD4kDZlf8ZMCliDEo//c+XCM= X-Microsoft-Exchange-Diagnostics: 1; DB6PR0701MB2997; 31:t4MWsAJepOl/qIi2mkgcyBJgo2tOzki5AKId2nDTzBguTqi1obxWbcYYF5X+O6SV5AGJFUkQ0MwayH8Y80dGTFBYBWZARwTtmFqByeIlzn8OZjC4NuZ0QCc/EoRf/Q1J13qMm34U1xSRcIi2q6/ILjL81C5tey4BABzif8k/aE9N36405pWgqjheDsz3RVpuTdwMJLPgKQNyYTscT+3oC4QduHD0Rt1ZnO3cbb90bgNFj00vNgnluffQ7xH0PgzzOm3Lkr5dLe84qQjOiutmQw==; 20:fcChDatXJBkKV6gC+LXl+wp/khfteD8diQOJFUcn5r8vk1TQcVxhlNn/PxqdGhxiUg8b79r+sBjIydNEz9R2A6t2x1xyVpicTQWV7KVoP+EfOgVItZuKBA3Med5Z+p6d8OeVPaYFhGjVJPFOc/Qtm/i962Z6ln0f76Mtif4OdSo= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(788757137089)(100405760836317); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040450)(601004)(2401047)(8121501046)(5005006)(93006095)(93001095)(3002001)(10201501046)(6041248)(20161123560025)(20161123564025)(20161123562025)(20161123558100)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148); SRVR:DB6PR0701MB2997; BCL:0; PCL:0; RULEID:; SRVR:DB6PR0701MB2997; X-Microsoft-Exchange-Diagnostics: 1; DB6PR0701MB2997; 4:cDZ2UV5YqshVZSUErAIB8BBS9d/3vz4whD2ONL21TmCDTgOcTzoAnJb3w931ZwTJV6uWZ/6MX9JWezBqlqTa3PJk3ucKvwViw4nhUOgCrakVxz7il+IN9a07eEDJwvp3NzAg+upaAWu1AV476fpK+r6lGkoKo70ey7vjFGwwmaMAyVcOJJ7vTmiiEC5FU7isxYGvjKj9qcKHIaW/27SFL7SM22XZnLePEUkWDyV7Ee9XjCqsO6RMl8JDV9/8+Se27TAzl+NygKWYbpfuaXx7XoKfJ4LDjfmETBeFxnCXGBSGnH63ixRid1ZDcC/jt+iRnPUtyRvrsQZ9freqcIYTfRhRWOFzuMdJkE5h1AI9ZgqtniGP/XMHD1jz52hLL9pFAPofKpJvXYIpjCH/0fK86zzEBXuKwXYB6mDHtrrOeLzFSii5W7uH/EdCbKIDYjJUby7VJeExEyhoZx3bG/Au6X4vd1B8eLSq5dLdFnUwG2huhtc74pUqi2lNeVJF2lGmqdCDiRAwZ63CH0yk1p8zgWH3n0P+OsbPTBOflBP5mS2y44MuiPqklEJWGMlJykha9l4zgWM0BaIX70TeQuaWBEwBMdhB6aksnOUtaZA3ai2vI6kfDB4pITEC0vyuromclmlkWRTxisO+AZCIWD2Aeko3lPx7eDO7UX6twrlL1THyGwKjM9Vb0dzJfO5eDcuS1a6SukHKdEq4LQIJ2kZmvwb6GLqdYA5F81ku+rg5GVAonlILvzIabY0qpUenuUm0IIdw6IR4KYTeAxcyfTd+nhgiMfqF8JPo5+G8YccpmeJSWqqWu7A0ciW+2PDTUpxQzL2CjsGp/QQGIlkxUpibXIZwxmr8alJXLKOc+2HRGwQ= X-Forefront-PRVS: 0308EE423E X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(4630300001)(6009001)(39450400003)(39840400002)(39400400002)(39850400002)(39410400002)(39860400002)(377454003)(24454002)(13464003)(86362001)(50986999)(81686999)(8676002)(81816999)(1456003)(76176999)(33646002)(23756003)(229853002)(44736005)(2906002)(4720700003)(6246003)(9686003)(42186005)(81166006)(6496005)(6306002)(38730400002)(54906002)(53936002)(6666003)(61296003)(6486002)(189998001)(478600001)(47776003)(62236002)(44716002)(50226002)(50466002)(14496001)(5660300001)(116806002)(66066001)(7736002)(230783001)(1556002)(84392002)(3846002)(6116002)(53546009)(25786009)(93886004)(230700001)(4326008)(305945005)(74416001)(7726001); DIR:OUT; SFP:1102; SCL:1; SRVR:DB6PR0701MB2997; H:pc6; FPR:; SPF:None; MLV:nov; PTR:InfoNoRecords; LANG:en; X-Microsoft-Exchange-Diagnostics: =?iso-8859-1?Q?1; DB6PR0701MB2997; 23:jnNGohTMrvq/mQYBc4tnY0sCBMVpuqfnu/4/U?= =?iso-8859-1?Q?fO4PbFEfMGdDW5lKzICC8q7+MH1TybVeGXjNOiHWcRRkIuzrqmO0xAhCbG?= =?iso-8859-1?Q?VYRJsx6gjcUq8xevjiBd13sB8vquXU8sVp06+IE2zs4T7I5QVnVyWx0jm/?= =?iso-8859-1?Q?CHiaF6eFtKU1iFdPZRO9N2HKIGf7zJ+NKj2wvYmLOO3TJVezkgBmHVsyJx?= =?iso-8859-1?Q?NSGfDrgPVpGPkFIJIPQ99B+Nm4YHbJDJ9su8F+XUVCl3eLOFw6KI1ThN0Y?= =?iso-8859-1?Q?A4OZd+FH8HKQAmS8TgBAL9v+VyQbJEYayvmWXUg0SGLiLAHpDvT2lrz5nM?= =?iso-8859-1?Q?1lcddh2T/ce36S5HyTUhgibq4UIs/g4EuqAmcE9nvzjB0wLZcQWWIe3XdK?= =?iso-8859-1?Q?54fqu6Mc6B2oe4EUuXAJYMaYYJjSKaQypJGIvPaFZUApdpy0eHSHkCHGJ2?= =?iso-8859-1?Q?CprC+2cEhwwqnx3ibkjABTv01tQOA/uZ5Ns+7meEALrYTD2QfsPdv83yaW?= =?iso-8859-1?Q?MJNlP822n6x3CeGRY+YV13Iu/vQ6LkmwGlKvNhZ80Iezg6fhjWclNs8TgL?= =?iso-8859-1?Q?FyzwECPLcOAu4OvHHqUr8WLLpxzNMQkGM0KJVDHsMeAb2v3ipJXQfHOmbF?= =?iso-8859-1?Q?1TDon35VlAFbkIr5H84VAgsp6afPSYOJwynNsuGvNP6vlWJyrkpvmdy6fu?= =?iso-8859-1?Q?tRvMlhM6TuKdZUjdfKv1wsXmIHdbLeYh6E/VeIF8Tm2LIAgMotk+D+lajN?= =?iso-8859-1?Q?rDZ0bqLpSJ9DPYQ+fu1swDdAFq9BuaWFhGPbvwZPB0MS0gnmOHLT02X2Ul?= =?iso-8859-1?Q?9LzOKCMR2gHPhHwKhFv8reGFGl+V3JPhWRC+LAuZZblQsFITHe+JZIrQ9K?= =?iso-8859-1?Q?XDL0ovHw7hW/XFuiz4Qkkd9fTDqvufwr19uDCy8fVQhP0fznlhSY3NgIWu?= =?iso-8859-1?Q?gNiGmel2WqwxJP7iJRP8PdpU2ZWUkRhLQc+pMdWKSa0yQeg3XuW4dKI9/q?= =?iso-8859-1?Q?IieIS2G2slFcPgm/WdK7oMiBTynoAR18yEYt39ny11Q9B/CoK1yQPvQBHL?= =?iso-8859-1?Q?ZEmI3Qs/dCR/icLx/bAk5ZYwPg21qGx0WY8LGJXduWP6UevKP+qS4/aUGh?= =?iso-8859-1?Q?kW/equnt7psG3gANc4FZWvvnt/izQHWutiGRXmSeFaLISx1/tNV3rzQ8gz?= =?iso-8859-1?Q?GkMZCk9jPYb9Pc65GQJSU9J0ALQmI+n7RpVkbR1/blW/DSJqDmZhhJm9Dc?= =?iso-8859-1?Q?mQ+0lTsiibg90sRhmgVUkvTwCQyw/OZU/SsFU9xxEC/qjmEdvB1znl4uKx?= =?iso-8859-1?Q?r3itarCfdZfGMq3W5fQ0Mxbu9TG/HCZER9j6JF3ogIuVVfv6tqQIYNrJTd?= =?iso-8859-1?Q?Z37rAkeZ4fVzpi3npdMqeX2CbRHZfMoKL7ZeGEvCwxipOmB0qvN/2Lolft?= =?iso-8859-1?Q?22OT8o8itVACYUTyAb4+wv+8G9qL5DyWkc1cPIyLZ6UD1gWj/kSneXCEhs?= =?iso-8859-1?Q?OtZI1BS7cnUN+Ao/eChpOIwyRamOnRgT6Ba7hK28Qq2?= X-Microsoft-Exchange-Diagnostics: 1; DB6PR0701MB2997; 6:1ud7FBqY/SIIHmcsiMaHF7YUTYigVSGpWFrFW/G8FJuGKKYxY4n2kV/30CnusPjYlPWH78y9OA49mwQwIdhCGnIGLM75OlSJXJHlAQCkoEOvCELv4Xl6K688gLVe1Hul1JvPt64nwT8+fKujtzM8kMx7kdoKlfnuJZFWeoMKUEIAaayoo2C89g4QyDCtoXbTqT2h2afutTAgxgI9oCd4HDEm42rs/m9C1oRFtXkHiJHbWgz/BnJjGAX0a3wRfhcWLvcKmR50q68H4/kG3D9aJ3u5oWikNzy7QRxy8Eol7yQMvKV6JGocL+NCYmbYioHk9xBnwYTMDNqnui5WBGV5g14uQaMXs39SYDAB3KEdFjvmLnvhoVL4NffPfvJD4311biCOqudfySCduS8uPhDLHU9Z8PK4lOb9Jg7PE8vXnYsKxpIJFTjdsk8eJC8u4BKP75N2VSkndRcw0ppBNCziKKNfF0SRSO7b6sK/DQUHft2HlREdQ6oQ+pydydnISVA6H53whlr4SmVhRIySk4looA==; 5:RstbSgekHCz/fPpfGSXFuiT1SnyKKBDjXYgMVEkfNUrjqKK4RHcNg9vI1anS32rvE0cQjMVwtob0RaqLdIeeiNO2sc5qx1FZfiPQ7FWyoxPF8XFqFxv/rsJp8NgZHDk+qUaUKMp9Es+Sc/eLEizP5Q==; 24:U+JV1xrdqGI4JTBFNsIJUXZk7PJvD+VO5UBvpHvTc35QDPLz6eN3nt+gghZYBlomy+gL59ENBSuIfIetu2AepRQ+upRetSOIkg9hu3Z10/k= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; DB6PR0701MB2997; 7:5p/9CdvZKil2kq/M5Vm172SsZHe84GkbYpN5xgMSJo09Pw4q2o5U6W4ca3cNa3spzS8q5GiBzNqCy2MQvwroQwnOdztnCmmHbdu5e19H4LrDGNEaPgxKniYep77/5XGgik7P1XSx8g0289ZfKPmjHXpkuswrsbZzSx8a73WjzXEIf41EulFNUOr9pezbcUXXO2wq5v2LXB/mfGsSoVF9F4tL8FMNZ1+uOB9yAnTIkJeOKyx0aULMNRzHvnOmgpKbTV8g7iU6pvi6uTkofIHq8be7aSXSygSyKa1rrjREA/HrPfHpFxiR8vOifHX6XHpy9+BikLwcqDclQ/n3eU+T1w== X-OriginatorOrg: btconnect.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 May 2017 17:04:22.4239 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0701MB2997 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 May 2017 17:07:39 -0000 ----- Original Message ----- From: "Ignas Bagdonas" To: "Alan DeKok" Sent: Monday, May 15, 2017 5:00 PM > Hi Alan, > > On 13/05/2017 12:59, Alan DeKok wrote: > > The approach in the IETF is to have authors move towards WG consensus. > > i.e. to prove to to the WG that the draft is ready for publication. > > If you're not going to work towards WG consensus, I suggest the chairs replace you with authors who will. > > WG chairs can appoint or change authors if needed under the process > described in RFC7221 and its referenced documents. The individual draft > has been accepted as a WG one a while ago with no changes in author > list. If current document authors would like to make any changes to > author/co-author/editor list WG chairs will certainly approve those > changes. Otherwise unless there is clear evidence that current authors > cannot make progress with the document, WG chairs do not have intentions > of changing the author list. This decision may be revisited if evidence > of author/co-author/editor duties not being performed to the expected > level surfaces, but at this time there is no such evidence. The process > of progressing the document is slow, slower than it could have been, but > it is not stalled. Ignas I echo part of what Alan says, that for a WG document, the editors should reflect the consensus of the WG. The problem I see is the lack of consensus, not with people disagreeing, but with an absence of people agreeing. Alan made a number of comments in October last year, Alexander made some in November but I did not see much follow up from anyone else to either set of comments. Trouble is, do the editors incorporate comments that one person has made and noone else has agreed or disagreed with? There is no good answer. In other WGs, I have seen ping-pong, one person comments, comments incorporated, someone else then disagrees, disagreements incorporated into a new revision, first person comes back, changes incorporated into a newer revision and so on, circling around a lack of consensus. Changing editors, unless it is to someone remote from the subject, is unlikely to change things.. I did look at Alan's comments, agreed with some, disagreed with others, ditto Alexander's, but was disinclined to do more with noone else chipping in, especially as several more did chip in in the initial stages of should we adopt this, and what status should it be. How you stir people into life is a challenge for WG chairs. Tom Petch > Thank you. > > Ignas > > > > _______________________________________________ > OPSAWG mailing list > OPSAWG@ietf.org > https://www.ietf.org/mailman/listinfo/opsawg From nobody Mon May 15 11:12:44 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8FF3A127077; Mon, 15 May 2017 11:12:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.523 X-Spam-Level: X-Spam-Status: No, score=-14.523 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KInbq7EDVtDa; Mon, 15 May 2017 11:12:40 -0700 (PDT) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 602DF1293FD; Mon, 15 May 2017 11:10:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3527; q=dns/txt; s=iport; t=1494871802; x=1496081402; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=AOcWuVQLkl7RC7AzYNJO6yxTvfHMVohzFpQJLGeRv4s=; b=HCtLEm3OsOfBjGy11Pd2CkfOhsl7JeBIsZfWr6bECnxaQhcVRKT4SwJN N0Dd66EhUl05G0TOTkV4kNwTsMyGfvjNj6zJj4hOYDBv2iSv4Z4ge6w9Y lEC4/Fiqy7kMiLzlX6Zoq7leUmRIRYnW9Sig35hoNxNEP8RKELxiQZMn9 Y=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CYAABt7hlZ/4kNJK1cGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBg1VigQwHjXyRX4gmjU+CDyELhS5KAoU0PxgBAgEBAQEBAQFrKIU?= =?us-ascii?q?YAQEBAQMBAWwGBQwEAgEIFQECLiEGCyUCBAENBRmJcgMVDq8KhzENgzgBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQEYBYtYglSBcgEBG4VyBZBlhgqGYDsBjkeEU5Friy2?= =?us-ascii?q?JFQEfOIEKcBVGhHccgWN2hjGBIYENAQEB?= X-IronPort-AV: E=Sophos;i="5.38,346,1491264000"; d="scan'208";a="248651427" Received: from alln-core-4.cisco.com ([173.36.13.137]) by rcdn-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 15 May 2017 18:10:01 +0000 Received: from XCH-RCD-014.cisco.com (xch-rcd-014.cisco.com [173.37.102.24]) by alln-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id v4FIA02k020488 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 15 May 2017 18:10:01 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-RCD-014.cisco.com (173.37.102.24) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 15 May 2017 13:10:00 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1210.000; Mon, 15 May 2017 13:10:00 -0500 From: "Douglas Gash (dcmgash)" To: "t.petch" , Alan DeKok , Ignas Bagdonas CC: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" , "ops-ads@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHxblMAgADBTACAA2Ki4oAAEfVNgAB2p4A= Date: Mon, 15 May 2017 18:10:00 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> In-Reply-To: <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.0.161029 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.1.6] Content-Type: text/plain; charset="iso-8859-1" Content-ID: <6BD655D6FDC6B44380542641A953DFC7@emea.cisco.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 May 2017 18:12:42 -0000 The lack of interactivity was more our fault than any one else's, we took Alan=B9s comments and incorporated them into the version we uploaded in Feb= . What we should have done was collate Alan=B9s comments to promote discussion. We=B9re attempting to rectify than that now: 1) We put Alan=B9s comments on v5 put on a single mail list a few days ago 2) We are going to give an initial response ASAP (will take a few days) 3) More discussions will ensure, and other comments on the doc may be generated 4) We will hopefully steer towards a consensus that will feed into v7. Regards, Doug. On 15/05/2017 18:00, "t.petch" wrote: >----- Original Message ----- >From: "Ignas Bagdonas" >To: "Alan DeKok" >Sent: Monday, May 15, 2017 5:00 PM > >> Hi Alan, >> >> On 13/05/2017 12:59, Alan DeKok wrote: >> > The approach in the IETF is to have authors move towards WG >consensus. >> > i.e. to prove to to the WG that the draft is ready for publication. >> > If you're not going to work towards WG consensus, I suggest the >chairs replace you with authors who will. >> >> WG chairs can appoint or change authors if needed under the process >> described in RFC7221 and its referenced documents. The individual >draft >> has been accepted as a WG one a while ago with no changes in author >> list. If current document authors would like to make any changes to >> author/co-author/editor list WG chairs will certainly approve those >> changes. Otherwise unless there is clear evidence that current authors >> cannot make progress with the document, WG chairs do not have >intentions >> of changing the author list. This decision may be revisited if >evidence >> of author/co-author/editor duties not being performed to the expected >> level surfaces, but at this time there is no such evidence. The >process >> of progressing the document is slow, slower than it could have been, >but >> it is not stalled. > >Ignas > >I echo part of what Alan says, that for a WG document, the editors >should reflect the consensus of the WG. The problem I see is the lack >of consensus, not with people disagreeing, but with an absence of people >agreeing. > >Alan made a number of comments in October last year, Alexander made some >in November but I did not see much follow up from anyone else to either >set of comments. > >Trouble is, do the editors incorporate comments that one person has made >and noone else has agreed or disagreed with? There is no good answer. > >In other WGs, I have seen ping-pong, one person comments, comments >incorporated, someone else then disagrees, disagreements incorporated >into a new revision, first person comes back, changes incorporated into >a newer revision and so on, circling around a lack of consensus. >Changing editors, unless it is to someone remote from the subject, is >unlikely to change things.. > >I did look at Alan's comments, agreed with some, disagreed with others, >ditto Alexander's, but was disinclined to do more with noone else >chipping in, especially as several more did chip in in the initial >stages of should we adopt this, and what status should it be. > >How you stir people into life is a challenge for WG chairs. > >Tom Petch > >> Thank you. >> >> Ignas >> >> >> >> _______________________________________________ >> OPSAWG mailing list >> OPSAWG@ietf.org >> https://www.ietf.org/mailman/listinfo/opsawg > From nobody Mon May 15 18:21:41 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7753812706D; Mon, 15 May 2017 18:21:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4HgON3uo0wOx; Mon, 15 May 2017 18:21:37 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 28CE712704A; Mon, 15 May 2017 18:18:50 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml703-cah.china.huawei.com) ([172.18.7.190]) by lhrrg02-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id DGR43371; Tue, 16 May 2017 01:18:48 +0000 (GMT) Received: from NKGEML414-HUB.china.huawei.com (10.98.56.75) by lhreml703-cah.china.huawei.com (10.201.108.44) with Microsoft SMTP Server (TLS) id 14.3.301.0; Tue, 16 May 2017 02:18:48 +0100 Received: from NKGEML515-MBX.china.huawei.com ([fe80::a54a:89d2:c471:ff]) by nkgeml414-hub.china.huawei.com ([10.98.56.75]) with mapi id 14.03.0235.001; Tue, 16 May 2017 09:18:40 +0800 From: Tianran Zhou To: "t.petch" , Alan DeKok , Ignas Bagdonas CC: "Douglas Gash (dcmgash)" , "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" , "ops-ads@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHwlGUAgACwjQCAAF79gIADaB0AgACY5seAAIYPYA== Date: Tue, 16 May 2017 01:18:40 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> In-Reply-To: <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.111.156.116] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020206.591A5378.0151, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 6044e24cf37685d5e22354ed573d0de6 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 May 2017 01:21:39 -0000 Thanks Tom for pointing this out. We appreciate any review comment. That really helps to improve the document= . I think it's back on the right track now. Hopefully, the authors can respon= d to more interactions.=20 Regards, Tianran > -----Original Message----- > From: t.petch [mailto:ietfc@btconnect.com] > Sent: Tuesday, May 16, 2017 1:01 AM > To: Alan DeKok; Ignas Bagdonas > Cc: Douglas Gash (dcmgash); opsawg@ietf.org; > draft-ietf-opsawg-tacacs@ietf.org; opsawg-chairs@ietf.org; > ops-ads@ietf.org > Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status > and Plans >=20 > ----- Original Message ----- > From: "Ignas Bagdonas" > To: "Alan DeKok" > Sent: Monday, May 15, 2017 5:00 PM >=20 > > Hi Alan, > > > > On 13/05/2017 12:59, Alan DeKok wrote: > > > The approach in the IETF is to have authors move towards WG > consensus. > > > i.e. to prove to to the WG that the draft is ready for publication. > > > If you're not going to work towards WG consensus, I suggest the > chairs replace you with authors who will. > > > > WG chairs can appoint or change authors if needed under the process > > described in RFC7221 and its referenced documents. The individual > draft > > has been accepted as a WG one a while ago with no changes in author > > list. If current document authors would like to make any changes to > > author/co-author/editor list WG chairs will certainly approve those > > changes. Otherwise unless there is clear evidence that current authors > > cannot make progress with the document, WG chairs do not have > intentions > > of changing the author list. This decision may be revisited if > evidence > > of author/co-author/editor duties not being performed to the expected > > level surfaces, but at this time there is no such evidence. The > process > > of progressing the document is slow, slower than it could have been, > but > > it is not stalled. >=20 > Ignas >=20 > I echo part of what Alan says, that for a WG document, the editors should > reflect the consensus of the WG. The problem I see is the lack of consen= sus, > not with people disagreeing, but with an absence of people agreeing. >=20 > Alan made a number of comments in October last year, Alexander made some > in November but I did not see much follow up from anyone else to either > set of comments. >=20 > Trouble is, do the editors incorporate comments that one person has made > and noone else has agreed or disagreed with? There is no good answer. >=20 > In other WGs, I have seen ping-pong, one person comments, comments > incorporated, someone else then disagrees, disagreements incorporated int= o > a new revision, first person comes back, changes incorporated into a newe= r > revision and so on, circling around a lack of consensus. > Changing editors, unless it is to someone remote from the subject, is unl= ikely > to change things.. >=20 > I did look at Alan's comments, agreed with some, disagreed with others, > ditto Alexander's, but was disinclined to do more with noone else chippin= g > in, especially as several more did chip in in the initial stages of shoul= d > we adopt this, and what status should it be. >=20 > How you stir people into life is a challenge for WG chairs. >=20 > Tom Petch >=20 > > Thank you. > > > > Ignas > > > > > > > > _______________________________________________ > > OPSAWG mailing list > > OPSAWG@ietf.org > > https://www.ietf.org/mailman/listinfo/opsawg From nobody Mon May 15 23:14:56 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9EC1129AB7 for ; Mon, 15 May 2017 23:14:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZnzSx22mpTst for ; Mon, 15 May 2017 23:14:52 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 88BD5129B1A for ; Mon, 15 May 2017 23:12:11 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml701-cah.china.huawei.com) ([172.18.7.190]) by lhrrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id DMZ93578; Tue, 16 May 2017 06:12:09 +0000 (GMT) Received: from NKGEML412-HUB.china.huawei.com (10.98.56.73) by lhreml701-cah.china.huawei.com (10.201.108.42) with Microsoft SMTP Server (TLS) id 14.3.301.0; Tue, 16 May 2017 07:12:08 +0100 Received: from NKGEML515-MBX.china.huawei.com ([fe80::a54a:89d2:c471:ff]) by nkgeml412-hub.china.huawei.com ([10.98.56.73]) with mapi id 14.03.0235.001; Tue, 16 May 2017 14:11:58 +0800 From: Tianran Zhou To: Duzongpeng , "opsawg@ietf.org" Thread-Topic: [OPSAWG] LC request//RE: I-D Action: draft-ietf-opsawg-capwap-alt-tunnel-09.txt Thread-Index: AQHSzWJEkZrfb0tOTkuzRBKqF+sFKqH2eTDQ Date: Tue, 16 May 2017 06:11:58 +0000 Message-ID: References: <149386596579.4881.15914732299692111269@ietfa.amsl.com> In-Reply-To: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.111.156.116] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020201.591A9839.010C, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 35b30b49bcfa5a528832b0be509f1d82 Archived-At: Subject: Re: [OPSAWG] LC request//RE: I-D Action: draft-ietf-opsawg-capwap-alt-tunnel-09.txt X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 May 2017 06:14:55 -0000 Hi Zongpeng, Thank you very much for picking this work up. The new version has a signifi= cant improvement on addressing existing comments. One more question that many people may be interested. Whether this I-D has = been implemented or has plan to be implemented and deployed? Best, Tianran > -----Original Message----- > From: OPSAWG [mailto:opsawg-bounces@ietf.org] On Behalf Of Duzongpeng > Sent: Monday, May 15, 2017 5:56 PM > To: opsawg@ietf.org > Subject: [OPSAWG] LC request//RE: I-D Action: > draft-ietf-opsawg-capwap-alt-tunnel-09.txt >=20 > Hi All, >=20 > I am happy to join the I-D draft-ietf-opsawg-capwap-alt-tunnel, and help > to improve the document based on the comments received and recorded in th= is > page > (https://datatracker.ietf.org/doc/draft-ietf-opsawg-capwap-alt-tunnel) > . >=20 > I revised the document and responded to all the existing comments as list= ed > in the attachments. Also thanks Joe Touch's comments, which I have solved > in the document. The major change include: > 1. At the security aspect, we suggest using the IPSec to protect the data > tunnel between WTP and AR. > 2. Add a new sub-element, "minimum IPv6 MTU", according to the suggestion > from Joe Touch. > 3. Make it clear that "IEEE 802.11 WTP Alternate Tunnel Failure Indicatio= n" > is carried in "CAPWAP Station Configuration Request message". > 4. Make it clear that we define seven sub-elements (each with its > corresponding type number). Three of them are specific for CAPWAP, one is > specific for GRE, and others are common ones. Make it clear that they can > only be used as sub-elements of "Alternate Tunnel Encapsulations Type mes= sage > element" and "IEEE 802.11 WTP Alternate Tunnel Failure Indication message > element". > 5. Change the structure of the draft. Firstly, introduce the three new > "message element"; secondly, introduce the three tunnel types; finnaly, > introduce the seven sub-elements involved. > 6. Give more explanations to the GRE tunnel type. >=20 > Now I believe this document is ready to send to IESG. So I request for a > WGLC. And I will also help to reply any comments/questions during the > following procedure. >=20 > Regards, > Zongpeng >=20 > -----Original Message----- > From: OPSAWG [mailto:opsawg-bounces@ietf.org] On Behalf Of > internet-drafts@ietf.org > Sent: Thursday, May 04, 2017 10:46 AM > To: i-d-announce@ietf.org > Cc: opsawg@ietf.org > Subject: [OPSAWG] I-D Action: draft-ietf-opsawg-capwap-alt-tunnel-09.txt >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Operations and Management Area Working > Group of the IETF. >=20 > Title : Alternate Tunnel Encapsulation for Data Frames = in > CAPWAP > Authors : Rong Zhang > Rajesh S. Pazhyannur > Sri Gundavelli > Zhen Cao > Hui Deng > Zongpeng Du > Filename : draft-ietf-opsawg-capwap-alt-tunnel-09.txt > Pages : 26 > Date : 2017-05-03 >=20 > Abstract: > Control and Provisioning of Wireless Access Points (CAPWAP) defines a > specification to encapsulate a station's data frames between the > Wireless Transmission Point (WTP) and Access Controller (AC). > Specifically, the station's IEEE 802.11 data frames can be either > locally bridged or tunneled to the AC. When tunneled, a CAPWAP data > channel is used for tunneling. In many deployments encapsulating > data frames to an entity other than the AC (for example to an Access > Router (AR)) is desirable. Furthermore, it may also be desirable to > use different tunnel encapsulation modes between the WTP and the > Access Router. This document defines extension to CAPWAP protocol > for supporting this capability and refers to it as alternate tunnel > encapsulation. The alternate tunnel encapsulation allows 1) the WTP > to tunnel non-management data frames to an endpoint different from > the AC and 2) the WTP to tunnel using one of many known encapsulation > types such as IP-IP, IP-GRE, CAPWAP. The WTP may advertise support > for alternate tunnel encapsulation during the discovery and join > process and AC may select one of the supported alternate tunnel > encapsulation types while configuring the WTP. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-opsawg-capwap-alt-tunnel/ >=20 > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-opsawg-capwap-alt-tunnel-09 > https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-capwap-alt-tun > nel-09 >=20 > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-opsawg-capwap-alt-tunnel- > 09 >=20 >=20 > Please note that it may take a couple of minutes from the time of submiss= ion > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > OPSAWG mailing list > OPSAWG@ietf.org > https://www.ietf.org/mailman/listinfo/opsawg From nobody Tue May 16 05:40:18 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51BF312AF77; Tue, 16 May 2017 05:40:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.501 X-Spam-Level: X-Spam-Status: No, score=-0.501 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m1M-1e0G-ySK; Tue, 16 May 2017 05:40:14 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 8A08C12EB35; Tue, 16 May 2017 05:36:32 -0700 (PDT) Received: from [192.168.120.42] (23-233-24-114.cpe.pppoe.ca [23.233.24.114]) by mail.networkradius.com (Postfix) with ESMTPSA id 61606106; Tue, 16 May 2017 12:36:31 +0000 (UTC) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Alan DeKok In-Reply-To: Date: Tue, 16 May 2017 08:36:30 -0400 Cc: "Douglas Gash (dcmgash)" , "opsawg@ietf.org" , "ops-ads@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> To: Ignas Bagdonas X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 May 2017 12:40:16 -0000 On May 15, 2017, at 12:00 PM, Ignas Bagdonas wrote: > WG chairs can appoint or change authors if needed under the process = described in RFC7221 and its referenced documents. Referencing the rules is nice. Addressing my comments would be nicer. > ... Otherwise unless there is clear evidence that current authors = cannot make progress with the document, My issue isn't "progress". My issue is addressing reviews raised on = the list. > WG chairs do not have intentions of changing the author list. This = decision may be revisited if evidence of author/co-author/editor duties = not being performed to the expected level surfaces, but at this time = there is no such evidence. I don't see how reviews (which were ignored) can be construed as "no = evidence" that the authors were ignoring reviews. Which was my point. If document authors issue new revs irrespective = of what the WG suggests, the chairs should replace the authors with ones = who work towards WG consensus. The alternative is to accept a draft as a WG document, and then to = allow the authors to do pretty much whatever they want, and then to = rubber-stamp the final document as an RFC. > The process of progressing the document is slow, slower than it could = have been, but it is not stalled. I never claimed it was stalled. I claimed that the authors had = ignored reviews. I just don't understand what point you were trying to make here. The = only subjects you addressed were ones I hadn't raised. Alan DeKok. From nobody Tue May 16 05:49:46 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA25D129B57 for ; Tue, 16 May 2017 05:49:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n1DPOvvUZefH for ; Tue, 16 May 2017 05:49:43 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id C9512129B30 for ; Tue, 16 May 2017 05:46:45 -0700 (PDT) Received: from [192.168.120.42] (23-233-24-114.cpe.pppoe.ca [23.233.24.114]) by mail.networkradius.com (Postfix) with ESMTPSA id D42FB106; Tue, 16 May 2017 12:46:44 +0000 (UTC) Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) Content-Type: text/plain; charset=iso-8859-1 From: Alan DeKok X-Priority: 3 In-Reply-To: <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> Date: Tue, 16 May 2017 08:46:43 -0400 Cc: IETF OOPSAWG Content-Transfer-Encoding: quoted-printable Message-Id: <9AD48A9B-81F1-4EDD-816C-F4C72B1B5246@deployingradius.com> References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> To: "t.petch" X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 May 2017 12:49:45 -0000 > On May 15, 2017, at 1:00 PM, t.petch wrote: > I echo part of what Alan says, that for a WG document, the editors > should reflect the consensus of the WG. The problem I see is the lack > of consensus, not with people disagreeing, but with an absence of = people > agreeing. The only agreement I see was at one of the early WGLCs. There was = wide-spread support for publication of the draft, when it was just not = ready. i.e. if it had been approved by the WG and gone to Security Area or = Transport Area review, it would have been bounced back with comments = much like the ones I've made. > Alan made a number of comments in October last year, Alexander made = some > in November but I did not see much follow up from anyone else to = either > set of comments. >=20 > Trouble is, do the editors incorporate comments that one person has = made > and noone else has agreed or disagreed with? There is no good answer. People argue on the list... > In other WGs, I have seen ping-pong, one person comments, comments > incorporated, someone else then disagrees, disagreements incorporated > into a new revision, first person comes back, changes incorporated = into > a newer revision and so on, circling around a lack of consensus. Chairs / ADs should make a final decision in such a situation. Or, = the document should be dropped as having insufficient consensus. > Changing editors, unless it is to someone remote from the subject, is > unlikely to change things.. The problem I see is that most people supporting the document are just = too close to it. There has been wide-spread support for publication = when it just wasn't ready. Plus, (speaking as an implementor) I had no idea what to do when = reading early versions of the draft. And other implementors aren't speaking up and saying what they've = done, or how to address issues in the document. It really does look like the majority of supporters want a TACACS RFC, = but they have no opinion about what the content should be. For me, that = raises questions about why we need a TACACS RFC. > I did look at Alan's comments, agreed with some, disagreed with = others, > ditto Alexander's, but was disinclined to do more with noone else > chipping in, especially as several more did chip in in the initial > stages of should we adopt this, and what status should it be. Part of the problem is that it's hard to have an ongoing conversation = around my reviews. The comments are so numerous that discussing each = one publicly would require hundreds of messages. Which for me is a sign that the draft is just nowhere near ready for = publication. Alan DeKok. From nobody Tue May 16 06:19:15 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 39420129BB3; Tue, 16 May 2017 06:19:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dEqBH9EzRJG8; Tue, 16 May 2017 06:19:12 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 0C2F512EB7A; Tue, 16 May 2017 06:15:21 -0700 (PDT) Received: from [192.168.120.42] (23-233-24-114.cpe.pppoe.ca [23.233.24.114]) by mail.networkradius.com (Postfix) with ESMTPSA id 7BBF8B02; Tue, 16 May 2017 13:15:15 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Alan DeKok In-Reply-To: Date: Tue, 16 May 2017 09:15:14 -0400 Cc: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <8B14C6BC-C32F-4599-BE94-66EECB758BAA@deployingradius.com> References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> To: "Douglas Gash (dcmgash)" X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 May 2017 13:19:13 -0000 On May 14, 2017, at 8:11 AM, Douglas Gash (dcmgash) = wrote: > We will work through this list, and reply with an item-by item = response, > (In place of previous mode of updating the doc to make v6) and then > hopefully move towards a consensus for the content for version 7. Thanks. Alan DeKok. From nobody Tue May 16 08:39:52 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 214FB12EB37; Tue, 16 May 2017 08:39:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.101 X-Spam-Level: X-Spam-Status: No, score=-0.101 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7d95bQJeKyLz; Tue, 16 May 2017 08:39:47 -0700 (PDT) Received: from mail-wr0-x236.google.com (mail-wr0-x236.google.com [IPv6:2a00:1450:400c:c0c::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4885E12EB60; Tue, 16 May 2017 08:35:51 -0700 (PDT) Received: by mail-wr0-x236.google.com with SMTP id l50so79292256wrc.3; Tue, 16 May 2017 08:35:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to:content-transfer-encoding; bh=CH9uc6rnN0St8ZXhM82Rh90Pri/BPuvtkCOW1aNrISY=; b=hY73rzKBUExfBMwBGptlE+F8gDhva/m66Whkfdj6IVxvOjmF4ak1fPV5uiaZOJTaSb 1ej1JPhLniwXHArVLv2V6uPnKTffvAFXnRnlL7Bk6BZrmhpVgbMlKdVmhJqp1cnON0r0 wgbKkmlwmzcCoePCsn4SL4w18jI9Tmao68mnBE8O6YZ6swkxWDvnvCkAEcchrlM3b5z7 Ol3VYv6sz9hLE3Ia35/3oziw9gq1Im1pE/cneouXiG1LWcy9vbLiTv4BTnstEa26Cn6t j1XBISjkXa4NEznlzHATcENLpur8TERE3DGwwzW0vDH3d8YVhWMQED7b7leuvRAiOowd J6jA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=CH9uc6rnN0St8ZXhM82Rh90Pri/BPuvtkCOW1aNrISY=; b=tZOgCqAF202ElOedCA5KxEurO3rmYepMxgGu1liYbCHnLdg25pHaaMlUMSqHRny4tb vRwP7ntMWmVYPSCvtyKt3OIdo5y+L43swGHN91v421nGxczRPizHfCdGucMk/JjkZ617 kFpGvvsAduQ2Ak2+q8zD1ntPrN2DDVJ6LK+ONPBpNkOPUqAHOjLO1AChwxRsDiiKQgzl 1Snx+ukhwU88iWgLbMjhgvC43CcBbukpvnS2kYJQsrcmHabypsLBylZqAZ4vQmB311XK hWkosT+iNtYqtZ+GXNMbGVs3W8X7IZ3Zgdm9GAliOopIfkKfwnZfnsOqEkYosMjRdmEB gSjw== X-Gm-Message-State: AODbwcDstBbxVzYeKnJxCRxEJn3oU4+llNVpGA1KuuHbiw0IUtE84yoh yJG3aIdOHsex8A== X-Received: by 10.223.179.198 with SMTP id x6mr10200531wrd.167.1494948949858; Tue, 16 May 2017 08:35:49 -0700 (PDT) Received: from [192.168.191.16] ([80.69.10.100]) by smtp.gmail.com with ESMTPSA id i19sm16374259wmf.0.2017.05.16.08.35.47 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 16 May 2017 08:35:48 -0700 (PDT) To: Alan DeKok References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> Cc: "Douglas Gash (dcmgash)" , "opsawg@ietf.org" , "ops-ads@ietf.org" From: Ignas Bagdonas Message-ID: Date: Tue, 16 May 2017 16:35:46 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 May 2017 15:39:49 -0000 Alan, On 16/05/2017 13:36, Alan DeKok wrote: > I don't see how reviews (which were ignored) can be construed as "no evidence" that the authors were ignoring reviews. > > Which was my point. If document authors issue new revs irrespective of what the WG suggests, the chairs should replace the authors with ones who work towards WG consensus. No-one has seen the -07 revision yet, therefore it seems to be too early to make judgement whether comments and suggestions were or were not addressed. Authors have promised to address the raised comments discussing them on the list and responding to previous reviews. I certainly agree with you that comments were not addressed. That is history now and reiterating this topic will do nothing to change what has already happened. Progress will happen if comments get addressed. Authors do have a token on this now. > The alternative is to accept a draft as a WG document, and then to allow the authors to do pretty much whatever they want, and then to rubber-stamp the final document as an RFC. That is not how the IETF works. I fail to see what else could be commented here. > > I just don't understand what point you were trying to make here. The only subjects you addressed were ones I hadn't raised. > The point of my mail was on the changes to the list of authors. To summarize - changes to author list are not happening at this time. Important part to emphasize is "at this time". Ignas From nobody Tue May 16 09:26:52 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC2E7129AD5; Tue, 16 May 2017 09:26:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4f4-hLKIjtye; Tue, 16 May 2017 09:26:49 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 2F6C8129AC9; Tue, 16 May 2017 09:22:59 -0700 (PDT) Received: from [192.168.20.121] (CPEf4cc552207f0-CM00fc8dce0fa0.cpe.net.cable.rogers.com [99.230.129.191]) by mail.networkradius.com (Postfix) with ESMTPSA id 8C6EDB7E; Tue, 16 May 2017 16:22:57 +0000 (UTC) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Alan DeKok In-Reply-To: Date: Tue, 16 May 2017 12:22:56 -0400 Cc: "Douglas Gash (dcmgash)" , "opsawg@ietf.org" , "ops-ads@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> To: Ignas Bagdonas X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 May 2017 16:26:51 -0000 On May 16, 2017, at 11:35 AM, Ignas Bagdonas = wrote: >=20 >> I don't see how reviews (which were ignored) can be construed as = "no evidence" that the authors were ignoring reviews. >>=20 >> Which was my point. If document authors issue new revs = irrespective of what the WG suggests, the chairs should replace the = authors with ones who work towards WG consensus. >=20 > No-one has seen the -07 revision yet, therefore it seems to be too = early to make judgement whether comments and suggestions were or were = not addressed. Authors have promised to address the raised comments = discussing them on the list and responding to previous reviews. My comments (again) were that there was a history of ignoring the = reviews. At the time I made that comment, it was true. I find it = troubling to see a response saying there's "no evidence" of such a = problem. >> The alternative is to accept a draft as a WG document, and then to = allow the authors to do pretty much whatever they want, and then to = rubber-stamp the final document as an RFC. >=20 > That is not how the IETF works. I fail to see what else could be = commented here. I'm saying until I complained, that *was* largely the process being = used in this WG. Alan DeKok. From nobody Tue May 16 09:31:27 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 62561129B22; Tue, 16 May 2017 09:31:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.299 X-Spam-Level: X-Spam-Status: No, score=-2.299 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9Yr6dIegEQVz; Tue, 16 May 2017 09:31:24 -0700 (PDT) Received: from llmx2.ll.mit.edu (LLMX2.LL.MIT.EDU [129.55.12.48]) by ietfa.amsl.com (Postfix) with ESMTP id 7638C12E042; Tue, 16 May 2017 09:27:30 -0700 (PDT) Received: from LLE2K10-HUB02.mitll.ad.local (LLE2K10-HUB02.mitll.ad.local) by llmx2.ll.mit.edu (unknown) with ESMTP id v4GGRN7f017435; Tue, 16 May 2017 12:27:23 -0400 From: "Blumenthal, Uri - 0553 - MITLL" To: Ignas Bagdonas CC: "Douglas Gash (dcmgash)" , Alan DeKok , "opsawg@ietf.org" , "ops-ads@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHxXY8AgACwjQCAAF7+gIADaB0AgAFZTgCAADIWAP//y10A Date: Tue, 16 May 2017 16:27:22 +0000 Message-ID: <1729A536-582D-4013-B288-80A9C2487747@ll.mit.edu> References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.21.0.170409 x-originating-ip: [172.25.177.148] Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha256; boundary="B_3577782442_1410017677" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-05-16_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1703280000 definitions=main-1705160130 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 May 2017 16:31:26 -0000 --B_3577782442_1410017677 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable On 5/16/17, 11:35 AM, "OPSAWG on behalf of Ignas Bagdonas" wrote: No-one has seen the -07 revision yet, therefore it seems to be too earl= y=20 to make judgement whether comments and suggestions were or were not=20 addressed.=20 I don=E2=80=99t think you got the point. Which was: Upon receiving the review (especially if it was posted to the mailing list)= the authors are supposed to reply to that mailing list with something like: =E2=80=9CIn response to the comment we are changing the text in the document = to say =E2=80=9D.=20 If it is done at the time (or after the time) when the edits are applied, t= hen adding =E2=80=9Cpage #, section #, paragraph=E2=80=9D to the above. Or =E2=80=9CWe decided not to make a change requested by the comment because = of =E2=80=9D It should not be a matter of =E2=80=9Cjudgment=E2=80=9D =E2=80=93 the authors have to explici= tly provide that info. Then the WG can discuss and/or decide if the proposed= changes adequately address the comments. What is so difficult about this? =20 Authors have promised to address the raised comments=20 discussing them on the list and responding to previous reviews. I=E2=80=99m waiting for emails like this to stop appearing, and emails addressing= the above to start appearing. --B_3577782442_1410017677 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIUVwYJKoZIhvcNAQcCoIIUSDCCFEQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0B BwGgghImMIIE6jCCA9KgAwIBAgIKMztKZQAAAABumTANBgkqhkiG9w0BAQsFADBRMQswCQYD VQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEMMAoGA1UECxMDUEtJ MRMwEQYDVQQDEwpNSVRMTCBDQS0zMB4XDTE2MDExNDE3MzMzN1oXDTE5MDExMzE3MzMzN1ow YTELMAkGA1UEBhMCVVMxHzAdBgNVBAoTFk1JVCBMaW5jb2xuIExhYm9yYXRvcnkxDzANBgNV BAsTBlBlb3BsZTEgMB4GA1UEAxMXQmx1bWVudGhhbC5VcmkuNTAwMTA1ODQwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDqifs8K0OoodbmOo5G/j2+p2ibbOsEoJ9GJjK8K1Iw 6iig59a3EuNB6NR4tAR3INwjjUwMCa4o8ysnk1hN32B3HPrK5Z8++Y/xcX5iP1L6fc51YQ5C /EGvrSbjuPLvt19SNfVdwcuoc842Sgk9N/HemdwmvcqJkwzWDsuxKikI2clT1N5LTAaPMkhr HVuYOHBE0mCXjHjFnYuHsEXyVvUZLxziDgduV9WKbC90Z1NZMXB6ZeQTACUWgMfpFrE12LKb fvOmxepCBfCPbGB3ZyG+FaUdtQoCEAbGTnY7nCedQFn7pV1hppCt4jjLVlOpgYc3dPmyiXsL nhDQZ5ptmks/AgMBAAGjggGyMIIBrjAdBgNVHQ4EFgQUiXqPublGfd0sWKNk/BObT6Oorzgw DgYDVR0PAQH/BAQDAgbAMB8GA1UdIwQYMBaAFNdgZg57SY11TA39z0beyMcSh8q/MDMGA1Ud HwQsMCowKKAmoCSGImh0dHA6Ly9jcmwubGwubWl0LmVkdS9nZXRjcmwvTExDQTMwZgYIKwYB BQUHAQEEWjBYMC0GCCsGAQUFBzAChiFodHRwOi8vY3JsLmxsLm1pdC5lZHUvZ2V0dG8vTExD QTMwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLmxsLm1pdC5lZHUvb2NzcDA9BgkrBgEEAYI3 FQcEMDAuBiYrBgEEAYI3FQiDg+Udh+ynZoathxWD6vBFhbahHx2Fy94yh/+KcwIBZAIBBjAi BgNVHSUBAf8EGDAWBggrBgEFBQcDBAYKKwYBBAGCNwoDDDAYBgNVHSAEETAPMA0GCyqGSIb3 EgIBAwEIMBkGA1UdEQQSMBCBDnVyaUBsbC5taXQuZWR1MCcGCSsGAQQBgjcUAgQaHhgATABM AFUAcwBlAHIAUwBpAGcALQBTAFcwDQYJKoZIhvcNAQELBQADggEBAK7HM6o1IolvkCJrlsjj N1+0Z2JG8anwkHkVKAg/K9qUD0LE9zbnK3kZRGZsljJUDG+hMWmTWCkx0TTzbg/BeVrypVPD 7rn1Tagi9QBV2eJhdBZRHWOcsteRldUukKbMw74hkNGH9o/p/FFZYMA0kHnA7XfECilF9Yl6 uKDv1lbjuWdgcKD1FdEj7rL/IdX0wKJVUKjwLG1RQZel1nuwyRjVtXWz8IUMJXRsYHf6uSzy YoNBeZuWyMx/J5c0ACKXXs1O721GPJ5U5gcEaQ/b8lwQGcOgPk28RPwgiBF3f5TgrTa7QxGf ozmNsTj1OV1vU0vjqKrg7USi9q0xTdGUIyowggS8MIIDpKADAgECAgEpMA0GCSqGSIb3DQEB BQUAMFQxCzAJBgNVBAYTAlVTMR8wHQYDVQQKExZNSVQgTGluY29sbiBMYWJvcmF0b3J5MQww CgYDVQQLEwNQS0kxFjAUBgNVBAMTDU1JVExMIFJvb3QgQ0EwHhcNMTMxMjE3MDAwMDAwWhcN MjAxMjMxMjM1OTU5WjBRMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFi b3JhdG9yeTEMMAoGA1UECxMDUEtJMRMwEQYDVQQDEwpNSVRMTCBDQS0zMIIBIjANBgkqhkiG 9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2jBSdW18tuW1tNxG6h8B0kqckFZQAAtoHCkvUpUEX6jF vBd8mQI53GyLYRuAo4HWJpe7/izFXOfSJDs6UM5ovvCOfXg2bJgDYlBC9JDcLBFIn0nppOu9 RvpjWSixtC56crwJ5Us5QPdtxtKdek5LJXl2oKw3w8lihUixePbxWad1m7ZMKKagvm9zTybP 6FumKRxeYJjSpB2+cAYjoGGEbSVHyx8uzHm6xAoBMHxa8by+yDz8Jzk6sP9iilgP3iXSGoCA mhyBzvlQQ5QNNWP+Emo9jz/ukKhYVB/VwdxtoquPAqn4ifDAIaM9dtb05cy1gXAFSP3Z/iUk xyBZZUORfwIDAQABo4IBmjCCAZYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU12Bm DntJjXVMDf3PRt7IxxKHyr8wHwYDVR0jBBgwFoAUZ6p6z/QKprlytYqg0p3yEMND7SkwDgYD VR0PAQH/BAQDAgGGMGYGCCsGAQUFBwEBBFowWDAtBggrBgEFBQcwAoYhaHR0cDovL2NybC5s bC5taXQuZWR1L2dldHRvP0xMUkNBMCcGCCsGAQUFBzABhhtodHRwOi8vb2NzcC5sbC5taXQu ZWR1L29jc3AwMwYDVR0fBCwwKjAooCagJIYiaHR0cDovL2NybC5sbC5taXQuZWR1L2dldGNy bD9MTFJDQTCBkgYDVR0gBIGKMIGHMA0GCyqGSIb3EgIBAwEGMA0GCyqGSIb3EgIBAwEIMA0G CyqGSIb3EgIBAwEHMA0GCyqGSIb3EgIBAwEJMA0GCyqGSIb3EgIBAwEKMA0GCyqGSIb3EgIB AwELMA0GCyqGSIb3EgIBAwEOMA0GCyqGSIb3EgIBAwEPMA0GCyqGSIb3EgIBAwEQMA0GCSqG SIb3DQEBBQUAA4IBAQAsf9HBn72qU7UTgkxarjAc7iynhcDEgWwezYKtd/SLGSQ0DhtzIV/L TCxqULjOd+H+HTqMJXB8+nHnzhyqQ43RsnGZOFT5RfzPh94db/ZJ3ql244DwlJI7yXBA2DkZ cEEgOWC9bHcrElzU6NnigahSW5odVJrhmH/XhQAcMS77E5H62yyxK1WPPgcBipGVnu1xSHbT iHe7DqfWQ2tVMLUf23XYhIua94kJsQd4jSh71NVD0e7F4snAoqQMI98MzDYeLOkjlzKRs77r /aMsPAKx6nMaOvRL7Cy0Pjp51i2qFkbGmX8ofnh2kerjTTvRJ/g22r1MV8RR1PktjMsNOsPf MIIDgzCCAmugAwIBAgIBATANBgkqhkiG9w0BAQUFADBUMQswCQYDVQQGEwJVUzEfMB0GA1UE ChMWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEMMAoGA1UECxMDUEtJMRYwFAYDVQQDEw1NSVRM TCBSb290IENBMB4XDTA4MDkyMzEyMDAwMFoXDTI5MTIzMTIzNTk1OVowVDELMAkGA1UEBhMC VVMxHzAdBgNVBAoTFk1JVCBMaW5jb2xuIExhYm9yYXRvcnkxDDAKBgNVBAsTA1BLSTEWMBQG A1UEAxMNTUlUTEwgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMVO KRdYsiay+a2Kv1wQCoPd5AkwExuwcNDRhaRCdQN17K+lCCKvf9VSQToAsA6q1bACtZUcMv5Z Kx8z5KG4jK9cM40NvEkf/bIOZAHJqzKgWG3N9NqrcAhimcXTXYQIdp1DgjtdADKVLAjXaYpD 2PbpE/JbAPnqKzOENa3Py9CegB0abTlOyLgwXWY/rXTW+4L/hipJ6+sI/ZtrFRmsKGhuwAKo bFr0FDP6uIfx+RaWJcJ1QBIdgM4aohvW8JeriSSMyf/LlFpXTZFcM9SOX0f7wmsYi1yFuKFM nQbkSkxvnpBKMRxrg+98seSbbEnIkvB0C9qBDPLb/lQAvmpW6oMCAwEAAaNgMF4wDwYDVR0T AQH/BAUwAwEB/zAdBgNVHQ4EFgQUZ6p6z/QKprlytYqg0p3yEMND7SkwHwYDVR0jBBgwFoAU Z6p6z/QKprlytYqg0p3yEMND7SkwCwYDVR0PBAQDAgGGMA0GCSqGSIb3DQEBBQUAA4IBAQA+ G20FYNB4eNhKWF+PyT5DUtzlABFkf2IM2VGNUBova0GeKX3I1Nf02qDU/GO2H9ETvnvTYhvf gQ4UB/5EImTkKPa7/TVG/MQ7SgmAmne8xELVbGLFrrytly8PyYtZtngb6DgeEUv+SwFnzcLO 1vg1rdmss3kwsqy0q8e2VYAY8zTptEzyJG36aXcIMbqOxWS/LbPjNuPdgJfO3d1WrHr1Etaa a0QRLqQoZj07dYY7Wo5EDqU+AUAMz9ZVRGK1s5b/jv5Wz/YroyqWFnH2KkNxRn9+2Ar7g3rn rOMZvp6psq2jbDXiPBod1wyMKn8x5y4cuGPNFcqjfyY/HX90ivQAMIIE7TCCA9WgAwIBAgIK MziUjwAAAABuljANBgkqhkiG9w0BAQsFADBRMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlU IExpbmNvbG4gTGFib3JhdG9yeTEMMAoGA1UECxMDUEtJMRMwEQYDVQQDEwpNSVRMTCBDQS0z MB4XDTE2MDExNDE3MzAzOVoXDTE5MDExMzE3MzAzOVowYTELMAkGA1UEBhMCVVMxHzAdBgNV BAoTFk1JVCBMaW5jb2xuIExhYm9yYXRvcnkxDzANBgNVBAsTBlBlb3BsZTEgMB4GA1UEAxMX Qmx1bWVudGhhbC5VcmkuNTAwMTA1ODQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDjFDaGib07mHBdNaVMNpj9+4iJa+K9AcTN3y+iU1ygtvHG4coteDBf77ZN1uwdt+lodW0C 8XyG43suSfpNp/owLOUElFagAnPqHAvAUIwsl5AjzncpJP+78Ui4u34aMNsddP+QZu9HI2Qg +P6eMD25jkjybT9dQMxXZpO2oTBznlWjYIItdZhK1DWZqIR0at7n2YjCSQsZNX0lJ4JwrtjH YFrYPnnZC0f1B2M7V54IS863CEyfu5XotoZx8YuHwYpKSFq80SEh6cMDLdTe1ZAjWxsnbyKC 64rreStyI2PVN9uBWd+OleGoIAjVogpMKKi0pSRHcCuwDwGekpQVubK9AgMBAAGjggG1MIIB sTAdBgNVHQ4EFgQU8U/FiJmibLZl2+KcNbVWE2PZipswDgYDVR0PAQH/BAQDAgUgMB8GA1Ud IwQYMBaAFNdgZg57SY11TA39z0beyMcSh8q/MDMGA1UdHwQsMCowKKAmoCSGImh0dHA6Ly9j cmwubGwubWl0LmVkdS9nZXRjcmwvTExDQTMwZgYIKwYBBQUHAQEEWjBYMC0GCCsGAQUFBzAC hiFodHRwOi8vY3JsLmxsLm1pdC5lZHUvZ2V0dG8vTExDQTMwJwYIKwYBBQUHMAGGG2h0dHA6 Ly9vY3NwLmxsLm1pdC5lZHUvb2NzcDA9BgkrBgEEAYI3FQcEMDAuBiYrBgEEAYI3FQiDg+Ud h+ynZoathxWD6vBFhbahHx2F69Bwg+vtIAIBZAIBBTAlBgNVHSUEHjAcBgRVHSUABggrBgEF BQcDBAYKKwYBBAGCNwoDBDAYBgNVHSAEETAPMA0GCyqGSIb3EgIBAwEIMBkGA1UdEQQSMBCB DnVyaUBsbC5taXQuZWR1MCcGCSsGAQQBgjcUAgQaHhgATABMAFUAcwBlAHIARQBuAGMALQBT AFcwDQYJKoZIhvcNAQELBQADggEBABbuvs9m0gS5U8JJuVc+qttV2BWQ0jDepXpYfP/xN8rV ScRPHe2SMUaFH5OMRhheGJkdogWVNnMrjHxQfpfc0z8yotlD3xwXENWUY5MoQmpEGB2ksFqg Md121bqzR3WY84Lcosfow0MoplXs8mvO7TnozwM+PtGZs0mpp2PzBkvWdNbs2r/7wXJP6/pL d5zPvywRNhTgoVe1aN4ivIkU8svkKMggv5ZaOsonaW8JS6dUYmvvk0QvDJRIQNRR0zpQpOKp +4V/XhMZRhxQJ3DjVTjh9Q/pHKm7ARFhFr3QAJ6ocCjyzLF5issa1Vshx7ElBIk0cXhep6mL MLqGNX3azAkxggH1MIIB8QIBATBfMFExCzAJBgNVBAYTAlVTMR8wHQYDVQQKExZNSVQgTGlu Y29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxEzARBgNVBAMTCk1JVExMIENBLTMCCjM7 SmUAAAAAbpkwDQYJYIZIAWUDBAIBBQCgaTAvBgkqhkiG9w0BCQQxIgQgSxfm88nHawGGe+Lb wSt1eR3Lcp2cmm9sTX+UvAVjcgIwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG 9w0BCQUxDxcNMTcwNTE2MTYyNzIyWjANBgkqhkiG9w0BAQEFAASCAQBovX7i8/EkgwIZd4lr 4PvhnYGt2sCG2o5uIFq9iGe+99e6Y5fqTDcC0DQqRGwaB/0MRD3IqLIVQBC3qHjE+cSWq0bM cFUp2wj9J0yXluWI/MNtvrSIYUB1mM9Bpcin004+jlen4TdEplMBE8v3Orx6GAIidyQza6yX CWOUJ7kFhUWyJp9D03ueVhURK6SFBWbT8u0Eth9ZnVhDaMl1bW8gCCkA9zNTsfRU7HASUZK0 KvfRP7qW6lmQIdR+NQC3XcbSZwtB3KuGVpSTqFEOidteQrs3z2PMqvPqdxXqAsGqxtDFyqdS r13BHjl0ELVJuJqXg85S8vvjT3jHYp8rfYm1 --B_3577782442_1410017677-- From nobody Tue May 16 12:26:49 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C4A112EC0F; Tue, 16 May 2017 12:26:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.811 X-Spam-Level: X-Spam-Status: No, score=-1.811 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=btconnect.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Znfu_NU9yrxB; Tue, 16 May 2017 12:26:45 -0700 (PDT) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-ve1eur01on0091.outbound.protection.outlook.com [104.47.1.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 78B6112EBD1; Tue, 16 May 2017 12:21:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=btconnect.onmicrosoft.com; s=selector1-btconnect-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=smFDMy6AwxxJRKmDxpt1WrNCgzcgd2UDQPK4FLXs/Mk=; b=Z4ectxMceKHVWsYBf3ERPhQQhxjOCkxgp+ez1SiNBBDRDIcOf2LHeKgyphGZGWx/EAr0kusqmva0ad/99PMaNw0mqQOFPzXig1lB/Jns63bxaH/LZ4JUGdzaeItd8MJxJOW7izsI2QrvyrVowO0/78B0DMtMzACfjF/FOfpK+CQ= Authentication-Results: cisco.com; dkim=none (message not signed) header.d=none;cisco.com; dmarc=none action=none header.from=btconnect.com; Received: from pc6 (86.169.157.161) by HE1PR0701MB3002.eurprd07.prod.outlook.com (2603:10a6:3:4d::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1101.8; Tue, 16 May 2017 19:21:51 +0000 Message-ID: <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> From: t.petch To: "Douglas Gash (dcmgash)" , Alan DeKok , Ignas Bagdonas CC: , , References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> Date: Tue, 16 May 2017 20:18:44 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Originating-IP: [86.169.157.161] X-ClientProxiedBy: AM5PR04CA0004.eurprd04.prod.outlook.com (2603:10a6:206:1::17) To HE1PR0701MB3002.eurprd07.prod.outlook.com (2603:10a6:3:4d::8) X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: HE1PR0701MB3002: X-MS-Office365-Filtering-Correlation-Id: 3e257a08-f363-41ab-573e-08d49c90cecc X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(201703131423075)(201703031133081); SRVR:HE1PR0701MB3002; X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3002; 3:82oA7a6DdZvL1TMLsQzrtRcNiBGmPdf7F4GT2hRq455Ilc/y5WTGR8Ub2ZUpiWnlXzbN2eBgsfFBGKWQGjHZLwpMQJVkYDXQmccp82lfk4FXGyxJtXwaNsUZVcieTiQTxv1uK/gfNjkobP17QP5x3mhpKp8X6VLkYLn7ds4xBqp7TYcp3GY8Fy+3TcjybODoIQgbRNXJsV337tMtZXnhxldwOmhjGRrtx08zkbnPim+3rsX1ThbNVeu8F5jQNS0R+3Wg9NxJx0ISTAXw6l+ROXYMBC9LVQxEkO/Y46TA6s++pXJAhLpBNNqSi2bQzke3ztN7MBQgDw7Iy99L2dJY/A==; 25:Mps97/cKMHJq39HtGRpgtDzpsnH+kuqXrNrU+aqTbD9ULcNvPoLnDMdcAH3jtXGXgmDBVJ0z+JnF5hpqUuIoUs7tU/60GCNwlugCSYZwVPaUV4fLh0FWgb7kY/HtMz2mJRwbHBNakhui1uuL5yMDyzgbay/e0pOmrlif4HghLjl1rWuDRzWSDIqACGu9j5fuRBxuq76BQh/FxZM4AiWymPq6bIrVCqnntE/L+YbsrmQ8ms8kme2pko9UvEIloF7SuAFYQyLMtQNkxylKRB25uhVrr5TlbdiYKKmVNcpz6LKPS4m+CpyOt4cFnESobmBaT26rGY1hRdA9QgREtxeWZlBMjByp3fQk5phulHYlwajl4U3AbPcEqMgClP2CwLpOos5I4Y4K5yc65yHeOx8w46AEG5VxvquVE9dNFCkjVpNlariJizfuqnP3m71ilMnT4jfkR9SBMLtzvwkFM/LXrmKsA/GUnZgXR/SF3g6dQ/E= X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3002; 31:xCq943CinRcqf5OaHot7ELISsYmm915Tm97OaCLNeN+QmtjgEbAIrZDQZEC/WlGdypju0QCHOax4gzVy82KZwChUWZvRyOumAt4Cyf/3E0Bn3GoaXe5CWn0bijDmSRUjHxcVveGbq/kNukYN75PSRSlLJsVWTjjgosiu5NZl98/UktSH/pociCA32fF0PYbbj1VHqTAZa5wpvtRlGsnBsNyXctvRcaqjVrxTa3nXhVtINrkIsFWsn+/lHcB+rdAZzkXhemec6NCq3IMIMmZL6Q==; 20:UXakzKLs5HGU+XOGLjTGoJ7ABfcbvRaBjQTipHj2amt1QnlKtnAA3oY2dkb//AvFJzrAlcrlXw7L2XIEkQquVPC5XLX6v9WqUl0SW+OLwnT+AHwQO92TZlxlk1uywIanbk+t1lDX/+TmUzgPo70qMsgkkzoIwMh8sEMI0W2h4tQ= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(178726229863574)(788757137089)(100405760836317)(95692535739014); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(100000700036)(100105000095)(100000701036)(100105300095)(100000702036)(100105100095)(6040450)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(100000703036)(100105400095)(93006095)(93001095)(6041248)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123562025)(20161123564025)(20161123555025)(20161123560025)(20161123558100)(6072148)(100000704036)(100105200095)(100000705036)(100105500095); SRVR:HE1PR0701MB3002; BCL:0; PCL:0; RULEID:(100000800036)(100110000095)(100000801036)(100110300095)(100000802036)(100110100095)(100000803036)(100110400095)(100000804036)(100110200095)(100000805036)(100110500095); SRVR:HE1PR0701MB3002; X-Microsoft-Exchange-Diagnostics: =?iso-8859-1?Q?1; HE1PR0701MB3002; 4:WyFuDc3m/Bfs5aUJJYhXL9Zf4V0Edd2DJvHGli?= =?iso-8859-1?Q?0DRfKP4h3OxhBCUZ586WnwgQZe+rl7eljuYUtYjLT4A9z1CVlIz1oDIoZ5?= =?iso-8859-1?Q?PiIQRpi/NSPdL8feLQbOZkfx+77MdW3Lp9U8FQ+tggSz8ECbfwaOMeQCW5?= =?iso-8859-1?Q?kTik5V/iG+usalYhAdieI2KQspEhyoWF2MS8coEItu4is3naIUjrDioqqS?= =?iso-8859-1?Q?b+sNaYA38s6s3U3vB9MmxEk2CM3xlkxDXoPMX6fTYPDFP0raFFuORRS9CE?= =?iso-8859-1?Q?wTE7J5AK9zmNSAk8C/7CFs9woGMQR4L2k7gWP0QjcnW1K6pTSkYR02dgKo?= =?iso-8859-1?Q?J57KgNBdcjlFZGSSzv7Nufmyh1VjKX3ijYBI/Sq66Ga2N2ZXISt5Gmt82R?= =?iso-8859-1?Q?JyzrgK9rYqiW8kgJ3JS4cFI9xEFAYS4zECmGUCpJ44owhac7Ow5fX/9NgB?= =?iso-8859-1?Q?qvVzuMyhOQHWjYNFiLhl/gqc9bpgASfoIvEgBvckjFcUN+k/F8kHIUbcN+?= =?iso-8859-1?Q?HAEXWyu8jq1FIVvO9oCdNAJfdelVeeSsZI14Gb8OrAn6Tv9wrgasy/lGEI?= =?iso-8859-1?Q?ySBuRnGNh8XCUdE9sG0x4iMUxwhBVogxQ15xcznEcs6ARvea4a03xXij77?= =?iso-8859-1?Q?h/pxvsV39byaVP5WOiT+QAKmSD2jF02GPluPZcKUL5Os34jKVH0CvzetC2?= =?iso-8859-1?Q?YWmLGWMsMTNPO3PPIm0ZEisRhkY5y+JC8WFQcnH2jlilDq07pyIMz29VGD?= =?iso-8859-1?Q?+eIRZun9MmYbXL/H4jNzXbOwyXT973Up6q5R16QxwHWzn8h9WqkB7J4sf9?= =?iso-8859-1?Q?GCs/m50qoZvnFBIr2tB8kgIlhivvn7lg7Cd6DKgDZeeHIeU0iVREjnfXUv?= =?iso-8859-1?Q?YoLKEtmGFEfah5NyUhNb2zQ0ySqbdGccTl81877rLafDhV+r7zeF9z9pIo?= =?iso-8859-1?Q?Gcm9bicGj71thUe6Mr1L8Gr7jdTaDJpC+4DD/4S4KCWxo6ZUxOQZwWtlW4?= =?iso-8859-1?Q?qCPPBheQOb4MlJjM51q26/No6EQc5MJ5bCmXf8nrAFHXDx04GlZD/gUX+0?= =?iso-8859-1?Q?OJIzheXpT+YKQ7nMebKUpO/cU9oEoQsaUwAKhIma+EHV61/48naF0JcRHu?= =?iso-8859-1?Q?MkC19XtI0P4Fworo4g/YzIdpQh24w91TPVe9lMBDWltP2/znwPobctb1sq?= =?iso-8859-1?Q?7Qq3JrkUAGX1hevVleEMk+BTHZLruuedpLrIrioQNrbDfHMcTKnJsOZ5+2?= =?iso-8859-1?Q?RWckWaNGEb5BE9VGR1aoHCEWo4Cb16TM8YGLihUVuhC0CLhZz0+jxuozip?= =?iso-8859-1?Q?BH4cDT8ypq45BjVprVpfxYR6/a4bmX8WLydLsmiKDIJslQ=3D=3D?= X-Forefront-PRVS: 03094A4065 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(4630300001)(6009001)(39450400003)(39860400002)(39840400002)(39850400002)(39400400002)(39410400002)(13464003)(24454002)(61484003)(377454003)(44736005)(6486002)(33646002)(61296003)(189998001)(66066001)(86362001)(53546009)(42186005)(23756003)(2870700001)(25786009)(9686003)(53936002)(84392002)(54906002)(6306002)(966005)(478600001)(3846002)(2906002)(6116002)(5660300001)(6246003)(229853002)(4326008)(81686999)(1556002)(305945005)(81816999)(76176999)(50986999)(44716002)(50466002)(62236002)(47776003)(50226002)(6496005)(81166006)(6666003)(4720700003)(230783001)(1456003)(93886004)(8676002)(38730400002)(7736002); DIR:OUT; SFP:1102; SCL:1; SRVR:HE1PR0701MB3002; H:pc6; FPR:; SPF:None; MLV:sfv; LANG:en; X-Microsoft-Exchange-Diagnostics: =?iso-8859-1?Q?1; HE1PR0701MB3002; 23:7yRmElZv+KZKHnlfPAJlG3l86bn/yxRIVNB7C?= =?iso-8859-1?Q?cJ4Z1F73UUGSANcpkHTUSuwFhka6ij5hAapT992draKaemdNiF1X5E/1PF?= =?iso-8859-1?Q?/ZqlEYccPiU2RgqZW80NlsSO8gcs3ejOU/+2237CdITHhJYGYmo6aF9WJe?= =?iso-8859-1?Q?hCV7PYWk2zZxyREKYmcB0QvBmz6W4acvD7iUMXdjfnapJyPozQxNUn2wrQ?= =?iso-8859-1?Q?k7Og0GJFC2auMaucudVy73wlFH8YXg6ZMLQG3BPSogWzV0Ape0bQTeUN9E?= =?iso-8859-1?Q?QgdS4fI7OyH/olCvYKRcabRbhY8PYVxv3Vncq0s/8g+GhejGRo/jaaQV/m?= =?iso-8859-1?Q?/dsxMx3/fnpaFgQWMj8XXbRmYGe/FKXUtdYw+3i4GVfocNdHhQaSsCKoSg?= =?iso-8859-1?Q?svMCEa8xx8Cf2YRF4nbvXqZFy6bdQk9nDONprFZdCAeF3AwAUhv1YUK48K?= =?iso-8859-1?Q?us/IFiUO0ceD2MQMGRy5MUpBDYstVeEEMLIty+JoY8yW9jJMqRu1cshwwk?= =?iso-8859-1?Q?d399JqiDBl2sL3h8Pgc80m1dwnWDHIlQ4jLBfomZIowcUhOK0WCJyRmwjf?= =?iso-8859-1?Q?YGCNp1zAk7EHyrz5W3m1KqkMBtY92WpgxbbrKcJB8UHJ+WYxO0Uua06aAz?= =?iso-8859-1?Q?emQq2tTpsQsrvw3A97Nn4xHvHZ/NAHYv58YSvadgjCFMPpBq3J4URrGwqL?= =?iso-8859-1?Q?FSASuU+Zmwig7/nX2Eywem2kBZARz5wyfrkBTJkvIE1v7rVIfpgqcHFH81?= =?iso-8859-1?Q?HEi/N9Y5P9X6fIpF1C+3x7f+OOoAp0egpkILi5uNI8XkD5GihNGdvx84t4?= =?iso-8859-1?Q?BhGYdZ6UXmJkyvi3FPGePOHifXJRy/OgzZG92+X34ZCuAuBH0k3dNYw9mE?= =?iso-8859-1?Q?Tfi72HG9qz6YfY9D16u97s6UBTralPRuRXBphfXcLvaXNsM1pLDrpMrw4U?= =?iso-8859-1?Q?iMVM8vmsAyFr8ThOPHUCn+NEyAtkrcdwIROm5jbQhGsI2dHtivqVuP4M5T?= =?iso-8859-1?Q?rtl1xombToQSq6iCPe9uO2S6g4iVPGOFkeNt89BdOniLRg5/fWezYUgGqk?= =?iso-8859-1?Q?T6XNy8L6/Pbjt46w+lz0Bn08B0iyQShpI4aOBjDm5VL8ME+rUngtzVfTuE?= =?iso-8859-1?Q?g9PdnlTqawYyJ9jZEShGRiarHCPk+JukQIF5cO0fwYOL5eAQnlDGCngACL?= =?iso-8859-1?Q?RuLRvluJ37+vE9j25xYpee4/3KPiltkc5NokqqbhzM1eiBmIda9b/IC/cc?= =?iso-8859-1?Q?jeC1EFQwgxCwhWUSI5eNjhc9/00nqNsuGwPB/Zw0o5253e7n2U6BuPBt7e?= =?iso-8859-1?Q?926bGAGerCrf1HsIe+3WxyZUe+OXcW0+WNogTMqheOSPL5vhEfuJjDung9?= =?iso-8859-1?Q?qxe5htZjVAcjmEJFmL9uttbD8FjXBpzYnXSWU1URQDVIuUMCCTCodS3x+Z?= =?iso-8859-1?Q?5klCOXqBYTqWuxRUSt9gpuZEe8Np+bYLI9hM2EgvGWp3Ki9bTl+7dpUVOs?= =?iso-8859-1?B?UT09?= X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3002; 6:Q46I9l0UIalkjoN9Re1nrHaXbHpHTLj+cgainRLbnBhnQRwBXgsPYeCkbn06jbFhdIi/E3p0PnOfh+oU5QbxZ5GzC3MowAHGdReIAGSQtNkXiMAdZC/YvvxuRDgZqNSaHIH5NYllSLsWc9EiimeQqIcu2Ftsc3LHqD6RRWpD8H336TG9Hiv3Kdrz9pYN1NA3BQlmkUwDl88IcY0aLCON1WPtA16Z1rq+B69TeNpLDFwqSrReNzztd0mgRykzc1iomcHCx1lK3JsW8o7wM0gGsEUzBxLuA+YqNfWeuEAM8cgyLZ/4G4ZB99Mstw3n9yyz3pJRDrImdPwHquanvcL+/+0LK2TdfviG2ao9lwV62qdsijNZeKnppbjAQERa2zieib0B+O5H0EUc/0TFrL3ALnWbhRVebqVcCVYHM4s8gjpqQ8xs6ZIfP1Eq/jGUBqjJ5CBdTqfr89/QNqD1Xcy02gb3AbSOc82guun3IWCVTeUD7YVB2PAYkcK41q3ZcXjla090CUMrlDttQ8zck9J5iw== X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3002; 5:eU67WhnWKfOj7OGN3xzQ1z/vZJnEfFlkSk4NwBWRmBShZR+W78GUtZEWmGgbFzeMiwSo7GaWlMYEu/+wRQYqhS/1NpoTD/u7SfsTSLGzOXyAENxim71CWOAn0WGsBww+InaArETvAX4rF+3f8smC4+Ba4zMJj8bt94Isl9VG9nu1EAHJl4XX6l9Isckskg19a4WNCFjXEI5kJM8Rizi536ArfCSEmFbuTUxT38Ykz4IecAbm4MmYRDT9+fqUwwiLo7DTEXzhDBNwXF5FBqpzlcvgRSqnQBIepNMPwqu5VJRi677OWGKalDcG8Ay1sbIbr/6W5mSoKCq97QXt+gi0eBdbK9/041hKJpu0VFQUlIyf1ifoMujHqa7t/2NpOK/obyhHgPkNYkSU1t73/ueLiURFOxhSRInR//NnSRKWaOlqU6o/WbiFNUJGNIeNY3gRAgYeMLoprMa5nct6VtDkp+51+vXZTxSsjdjZocV2YdzjKjjlO5MH2E1nDhoWb+C4; 24:7ISP897739NMv5fdoVUYebzO3HTDR/3imM4yi8g4YOkK5EXr4B4SQK82qvzjbGyWmMB9EACs35wrBqJJqwNzlZVMJgQXJsRXjUIrcrXctCg= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3002; 7:alw/xlIIRxQA2hbeIc14jWvp5B32mJDjylmkBCREEQItYIJnSWun+szM0xQOrD8mBugHlMUGQrgSbVL1h2mn235oxiHwh4qihdjrdlPUKff76LvskhZKe2izyXrvusfmww0Zh9BH/PI5qLZkTaukXJaUPwRkhilBHKOQd8noE/pYi3u4fpuD2c+p1d9V+ckmtqOIf4IwDu0fg+FFKSqjX1G4WFu12r+Kh+oO4jv+E2vQlDGs/FhycQwkScs4FLYQnXuR0CfiTfqcocE96/gB4aWugJ9mGwF7r5TkYzApNb7OeADl1ib1M76pIycMzgaZ+Qmu2QEegCYVNedA67yZ4g== X-OriginatorOrg: btconnect.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 May 2017 19:21:51.8108 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB3002 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 May 2017 19:26:48 -0000 Doug When I look at the I-D -06, I am struck by two 'procedural' flaws, at the beginning and the end of the I-D, where I am so used to a document shepherd saying 'yes, that has been done' that I cannot recall when last I saw an I-D, even at an early stage of the WG process, which had not got these points right. Mmm; it ought not to matter, but when I see them, well it makes me back off a little. Have a look and see if you see what I see - if not, I will let you know. And my Reply All to Ignas gets an SMTP bounce "5.1.0 - Unknown address error 550-'5.1.1 ... User unknown'" Probably part of the expansion of draft-ietf-opsawg-tacacs@ietf.org Mmmm2 Tom Petch ----- Original Message ----- From: "Douglas Gash (dcmgash)" To: "t.petch" ; "Alan DeKok" ; "Ignas Bagdonas" Cc: ; ; ; Sent: Monday, May 15, 2017 7:10 PM The lack of interactivity was more our fault than any one else's, we took Alan¹s comments and incorporated them into the version we uploaded in Feb. What we should have done was collate Alan¹s comments to promote discussion. We¹re attempting to rectify than that now: 1) We put Alan¹s comments on v5 put on a single mail list a few days ago 2) We are going to give an initial response ASAP (will take a few days) 3) More discussions will ensure, and other comments on the doc may be generated 4) We will hopefully steer towards a consensus that will feed into v7. Regards, Doug. On 15/05/2017 18:00, "t.petch" wrote: >----- Original Message ----- >From: "Ignas Bagdonas" >To: "Alan DeKok" >Sent: Monday, May 15, 2017 5:00 PM > >> Hi Alan, >> >> On 13/05/2017 12:59, Alan DeKok wrote: >> > The approach in the IETF is to have authors move towards WG >consensus. >> > i.e. to prove to to the WG that the draft is ready for publication. >> > If you're not going to work towards WG consensus, I suggest the >chairs replace you with authors who will. >> >> WG chairs can appoint or change authors if needed under the process >> described in RFC7221 and its referenced documents. The individual >draft >> has been accepted as a WG one a while ago with no changes in author >> list. If current document authors would like to make any changes to >> author/co-author/editor list WG chairs will certainly approve those >> changes. Otherwise unless there is clear evidence that current authors >> cannot make progress with the document, WG chairs do not have >intentions >> of changing the author list. This decision may be revisited if >evidence >> of author/co-author/editor duties not being performed to the expected >> level surfaces, but at this time there is no such evidence. The >process >> of progressing the document is slow, slower than it could have been, >but >> it is not stalled. > >Ignas > >I echo part of what Alan says, that for a WG document, the editors >should reflect the consensus of the WG. The problem I see is the lack >of consensus, not with people disagreeing, but with an absence of people >agreeing. > >Alan made a number of comments in October last year, Alexander made some >in November but I did not see much follow up from anyone else to either >set of comments. > >Trouble is, do the editors incorporate comments that one person has made >and noone else has agreed or disagreed with? There is no good answer. > >In other WGs, I have seen ping-pong, one person comments, comments >incorporated, someone else then disagrees, disagreements incorporated >into a new revision, first person comes back, changes incorporated into >a newer revision and so on, circling around a lack of consensus. >Changing editors, unless it is to someone remote from the subject, is >unlikely to change things.. > >I did look at Alan's comments, agreed with some, disagreed with others, >ditto Alexander's, but was disinclined to do more with noone else >chipping in, especially as several more did chip in in the initial >stages of should we adopt this, and what status should it be. > >How you stir people into life is a challenge for WG chairs. > >Tom Petch > >> Thank you. >> >> Ignas >> >> >> >> _______________________________________________ >> OPSAWG mailing list >> OPSAWG@ietf.org >> https://www.ietf.org/mailman/listinfo/opsawg > From nobody Tue May 16 12:32:35 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE93912EC16; Tue, 16 May 2017 12:32:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.522 X-Spam-Level: X-Spam-Status: No, score=-14.522 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8BtBH4gcbb4E; Tue, 16 May 2017 12:32:32 -0700 (PDT) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C8C2012EC3C; Tue, 16 May 2017 12:27:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=6672; q=dns/txt; s=iport; t=1494962871; x=1496172471; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=8JzVIo5faAwqJUdWtqA5GZVMRsVa1mtzvRAjJsl68xU=; b=bafrVLqGTCULRcUWdchgrZKcS1HW28RNVdaz/b9dnjhWjkWg3EwN+2ml ZDAqmaCogqAbYdh8uT4hEOGGdkfsKh+bqTT1afI0CC97umaq8AKDkhdum FmLUS+gWB6+jMOJQudAQIkM+12n+wyTMFGfqAHsUbQx2IgWVC2nN5WDt3 8=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DoAADPURtZ/4oNJK1cGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBg1VigQwHg2WKGJFliCaNT4IPIQuFLkoCGoU1PxgBAgEBAQEBAQF?= =?us-ascii?q?rKIUYAQEBAQMBATI6BgUMBAIBCBUBAgQoAgIfBgslAgQBDQUZiXIDFQ6OY51YB?= =?us-ascii?q?oIohzQNgz8BAQEBAQEBAQEBAQEBAQEBAQEBAQEYBYEFilOCVIFyAQEbF4J1gmY?= =?us-ascii?q?FnU87AY5HhFORa4stiRUBHziBCnAVRoR3HIFjdoYVgSGBDQEBAQ?= X-IronPort-AV: E=Sophos;i="5.38,350,1491264000"; d="scan'208";a="249174764" Received: from alln-core-5.cisco.com ([173.36.13.138]) by rcdn-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 16 May 2017 19:27:50 +0000 Received: from XCH-ALN-011.cisco.com (xch-aln-011.cisco.com [173.36.7.21]) by alln-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id v4GJRoKh011125 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 16 May 2017 19:27:50 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-ALN-011.cisco.com (173.36.7.21) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 16 May 2017 14:27:49 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1210.000; Tue, 16 May 2017 14:27:49 -0500 From: "Douglas Gash (dcmgash)" To: "t.petch" , Alan DeKok , Ignas Bagdonas CC: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHxblMAgADBTACAA2Ki4oAAEfVNgAB2p4CAAUHjJIAAZjOA Date: Tue, 16 May 2017 19:27:49 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> In-Reply-To: <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.0.161029 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.1.6] Content-Type: text/plain; charset="euc-kr" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 May 2017 19:32:35 -0000 SGkgVG9tLA0KDQpJoa9kIGJlIGdyYXRlZnVsIGlmIHlvdSBjb3VsZCBsZXQgbWUga25vdyA7LSkN Cg0KT24gMTYvMDUvMjAxNyAyMDoxOCwgInQucGV0Y2giIDxpZXRmY0BidGNvbm5lY3QuY29tPiB3 cm90ZToNCg0KPkRvdWcNCj4NCj5XaGVuIEkgbG9vayBhdCB0aGUgSS1EIC0wNiwgSSBhbSBzdHJ1 Y2sgYnkgdHdvICdwcm9jZWR1cmFsJyBmbGF3cywgYXQNCj50aGUgYmVnaW5uaW5nIGFuZCB0aGUg ZW5kIG9mIHRoZSBJLUQsIHdoZXJlIEkgYW0gc28gdXNlZCB0byBhIGRvY3VtZW50DQo+c2hlcGhl cmQgc2F5aW5nICd5ZXMsIHRoYXQgaGFzIGJlZW4gZG9uZScgdGhhdCBJIGNhbm5vdCByZWNhbGwg d2hlbiBsYXN0DQo+SSBzYXcgYW4gSS1ELCBldmVuIGF0IGFuIGVhcmx5IHN0YWdlIG9mIHRoZSBX RyBwcm9jZXNzLCB3aGljaCBoYWQgbm90DQo+Z290IHRoZXNlIHBvaW50cyByaWdodC4gIE1tbTsg aXQgb3VnaHQgbm90IHRvIG1hdHRlciwgYnV0IHdoZW4gSSBzZWUNCj50aGVtLCB3ZWxsIGl0IG1h a2VzIG1lIGJhY2sgb2ZmIGEgbGl0dGxlLg0KPg0KPkhhdmUgYSBsb29rIGFuZCBzZWUgaWYgeW91 IHNlZSB3aGF0IEkgc2VlIC0gaWYgbm90LCBJIHdpbGwgbGV0IHlvdSBrbm93Lg0KPg0KPkFuZCBt eSBSZXBseSBBbGwgdG8gSWduYXMgZ2V0cyBhbiBTTVRQIGJvdW5jZQ0KPiI1LjEuMCAtIFVua25v d24gYWRkcmVzcyBlcnJvciA1NTAtJzUuMS4xIDxsb2xAY2lzY28uY29tPi4uLiBVc2VyDQo+dW5r bm93biciDQo+DQo+UHJvYmFibHkgcGFydCBvZiB0aGUgZXhwYW5zaW9uIG9mDQo+ZHJhZnQtaWV0 Zi1vcHNhd2ctdGFjYWNzQGlldGYub3JnIDxkcmFmdC1pZXRmLW9wc2F3Zy10YWNhY3NAaWV0Zi5v cmc+DQo+DQo+TW1tbTINCj4NCj5Ub20gUGV0Y2gNCj4NCj4tLS0tLSBPcmlnaW5hbCBNZXNzYWdl IC0tLS0tDQo+RnJvbTogIkRvdWdsYXMgR2FzaCAoZGNtZ2FzaCkiIDxkY21nYXNoQGNpc2NvLmNv bT4NCj5UbzogInQucGV0Y2giIDxpZXRmY0BidGNvbm5lY3QuY29tPjsgIkFsYW4gRGVLb2siDQo+ PGFsYW5kQGRlcGxveWluZ3JhZGl1cy5jb20+OyAiSWduYXMgQmFnZG9uYXMiIDxpYmFnZG9uYUBn bWFpbC5jb20+DQo+Q2M6IDxvcHNhd2dAaWV0Zi5vcmc+OyA8ZHJhZnQtaWV0Zi1vcHNhd2ctdGFj YWNzQGlldGYub3JnPjsNCj48b3BzYXdnLWNoYWlyc0BpZXRmLm9yZz47IDxvcHMtYWRzQGlldGYu b3JnPg0KPlNlbnQ6IE1vbmRheSwgTWF5IDE1LCAyMDE3IDc6MTAgUE0NCj4NCj5UaGUgbGFjayBv ZiBpbnRlcmFjdGl2aXR5IHdhcyBtb3JlIG91ciBmYXVsdCB0aGFuIGFueSBvbmUgZWxzZSdzLCB3 ZQ0KPnRvb2sNCj5BbGFuqfZzIGNvbW1lbnRzIGFuZCBpbmNvcnBvcmF0ZWQgdGhlbSBpbnRvIHRo ZSB2ZXJzaW9uIHdlIHVwbG9hZGVkIGluDQo+RmViLg0KPg0KPldoYXQgd2Ugc2hvdWxkIGhhdmUg ZG9uZSB3YXMgY29sbGF0ZSBBbGFuqfZzIGNvbW1lbnRzIHRvIHByb21vdGUNCj5kaXNjdXNzaW9u LiBXZan2cmUgYXR0ZW1wdGluZyB0byByZWN0aWZ5IHRoYW4gdGhhdCBub3c6DQo+DQo+MSkgV2Ug cHV0IEFsYW6p9nMgY29tbWVudHMgb24gdjUgcHV0IG9uIGEgc2luZ2xlIG1haWwgbGlzdCBhIGZl dyBkYXlzIGFnbw0KPjIpIFdlIGFyZSBnb2luZyB0byBnaXZlIGFuIGluaXRpYWwgcmVzcG9uc2Ug QVNBUCAod2lsbCB0YWtlIGEgZmV3IGRheXMpDQo+MykgTW9yZSBkaXNjdXNzaW9ucyB3aWxsIGVu c3VyZSwgYW5kIG90aGVyIGNvbW1lbnRzIG9uIHRoZSBkb2MgbWF5IGJlDQo+Z2VuZXJhdGVkDQo+ NCkgV2Ugd2lsbCBob3BlZnVsbHkgc3RlZXIgdG93YXJkcyBhIGNvbnNlbnN1cyB0aGF0IHdpbGwg ZmVlZCBpbnRvIHY3Lg0KPg0KPlJlZ2FyZHMsDQo+DQo+RG91Zy4NCj4NCj5PbiAxNS8wNS8yMDE3 IDE4OjAwLCAidC5wZXRjaCIgPGlldGZjQGJ0Y29ubmVjdC5jb20+IHdyb3RlOg0KPg0KPj4tLS0t LSBPcmlnaW5hbCBNZXNzYWdlIC0tLS0tDQo+PkZyb206ICJJZ25hcyBCYWdkb25hcyIgPGliYWdk b25hQGdtYWlsLmNvbT4NCj4+VG86ICJBbGFuIERlS29rIiA8YWxhbmRAZGVwbG95aW5ncmFkaXVz LmNvbT4NCj4+U2VudDogTW9uZGF5LCBNYXkgMTUsIDIwMTcgNTowMCBQTQ0KPj4NCj4+PiBIaSBB bGFuLA0KPj4+DQo+Pj4gT24gMTMvMDUvMjAxNyAxMjo1OSwgQWxhbiBEZUtvayB3cm90ZToNCj4+ PiA+IFRoZSBhcHByb2FjaCBpbiB0aGUgSUVURiBpcyB0byBoYXZlIGF1dGhvcnMgbW92ZSB0b3dh cmRzIFdHDQo+PmNvbnNlbnN1cy4NCj4+PiA+IGkuZS4gdG8gcHJvdmUgdG8gdG8gdGhlIFdHIHRo YXQgdGhlIGRyYWZ0IGlzIHJlYWR5IGZvciBwdWJsaWNhdGlvbi4NCj4+PiA+ICAgIElmIHlvdSdy ZSBub3QgZ29pbmcgdG8gd29yayB0b3dhcmRzIFdHIGNvbnNlbnN1cywgSSBzdWdnZXN0IHRoZQ0K Pj5jaGFpcnMgcmVwbGFjZSB5b3Ugd2l0aCBhdXRob3JzIHdobyB3aWxsLg0KPj4+DQo+Pj4gV0cg Y2hhaXJzIGNhbiBhcHBvaW50IG9yIGNoYW5nZSBhdXRob3JzIGlmIG5lZWRlZCB1bmRlciB0aGUg cHJvY2Vzcw0KPj4+IGRlc2NyaWJlZCBpbiBSRkM3MjIxIGFuZCBpdHMgcmVmZXJlbmNlZCBkb2N1 bWVudHMuIFRoZSBpbmRpdmlkdWFsDQo+PmRyYWZ0DQo+Pj4gaGFzIGJlZW4gYWNjZXB0ZWQgYXMg YSBXRyBvbmUgYSB3aGlsZSBhZ28gd2l0aCBubyBjaGFuZ2VzIGluIGF1dGhvcg0KPj4+IGxpc3Qu IElmIGN1cnJlbnQgZG9jdW1lbnQgYXV0aG9ycyB3b3VsZCBsaWtlIHRvIG1ha2UgYW55IGNoYW5n ZXMgdG8NCj4+PiBhdXRob3IvY28tYXV0aG9yL2VkaXRvciBsaXN0IFdHIGNoYWlycyB3aWxsIGNl cnRhaW5seSBhcHByb3ZlIHRob3NlDQo+Pj4gY2hhbmdlcy4gT3RoZXJ3aXNlIHVubGVzcyB0aGVy ZSBpcyBjbGVhciBldmlkZW5jZSB0aGF0IGN1cnJlbnQNCj5hdXRob3JzDQo+Pj4gY2Fubm90IG1h a2UgcHJvZ3Jlc3Mgd2l0aCB0aGUgZG9jdW1lbnQsIFdHIGNoYWlycyBkbyBub3QgaGF2ZQ0KPj5p bnRlbnRpb25zDQo+Pj4gb2YgY2hhbmdpbmcgdGhlIGF1dGhvciBsaXN0LiBUaGlzIGRlY2lzaW9u IG1heSBiZSByZXZpc2l0ZWQgaWYNCj4+ZXZpZGVuY2UNCj4+PiBvZiBhdXRob3IvY28tYXV0aG9y L2VkaXRvciBkdXRpZXMgbm90IGJlaW5nIHBlcmZvcm1lZCB0byB0aGUgZXhwZWN0ZWQNCj4+PiBs ZXZlbCBzdXJmYWNlcywgYnV0IGF0IHRoaXMgdGltZSB0aGVyZSBpcyBubyBzdWNoIGV2aWRlbmNl LiBUaGUNCj4+cHJvY2Vzcw0KPj4+IG9mIHByb2dyZXNzaW5nIHRoZSBkb2N1bWVudCBpcyBzbG93 LCBzbG93ZXIgdGhhbiBpdCBjb3VsZCBoYXZlIGJlZW4sDQo+PmJ1dA0KPj4+IGl0IGlzIG5vdCBz dGFsbGVkLg0KPj4NCj4+SWduYXMNCj4+DQo+PkkgZWNobyBwYXJ0IG9mIHdoYXQgQWxhbiBzYXlz LCB0aGF0IGZvciBhIFdHIGRvY3VtZW50LCB0aGUgZWRpdG9ycw0KPj5zaG91bGQgcmVmbGVjdCB0 aGUgY29uc2Vuc3VzIG9mIHRoZSBXRy4gIFRoZSBwcm9ibGVtIEkgc2VlIGlzIHRoZSBsYWNrDQo+ Pm9mIGNvbnNlbnN1cywgbm90IHdpdGggcGVvcGxlIGRpc2FncmVlaW5nLCBidXQgd2l0aCBhbiBh YnNlbmNlIG9mDQo+cGVvcGxlDQo+PmFncmVlaW5nLg0KPj4NCj4+QWxhbiBtYWRlIGEgbnVtYmVy IG9mIGNvbW1lbnRzIGluIE9jdG9iZXIgbGFzdCB5ZWFyLCBBbGV4YW5kZXIgbWFkZQ0KPnNvbWUN Cj4+aW4gIE5vdmVtYmVyIGJ1dCBJIGRpZCBub3Qgc2VlIG11Y2ggZm9sbG93IHVwIGZyb20gYW55 b25lIGVsc2UgdG8NCj5laXRoZXINCj4+c2V0IG9mIGNvbW1lbnRzLg0KPj4NCj4+VHJvdWJsZSBp cywgZG8gdGhlIGVkaXRvcnMgaW5jb3Jwb3JhdGUgY29tbWVudHMgdGhhdCBvbmUgcGVyc29uIGhh cw0KPm1hZGUNCj4+YW5kIG5vb25lIGVsc2UgaGFzIGFncmVlZCBvciBkaXNhZ3JlZWQgd2l0aD8g IFRoZXJlIGlzIG5vIGdvb2QgYW5zd2VyLg0KPj4NCj4+SW4gb3RoZXIgV0dzLCBJIGhhdmUgc2Vl biBwaW5nLXBvbmcsIG9uZSBwZXJzb24gY29tbWVudHMsIGNvbW1lbnRzDQo+PmluY29ycG9yYXRl ZCwgc29tZW9uZSBlbHNlIHRoZW4gZGlzYWdyZWVzLCBkaXNhZ3JlZW1lbnRzIGluY29ycG9yYXRl ZA0KPj5pbnRvIGEgbmV3IHJldmlzaW9uLCBmaXJzdCBwZXJzb24gY29tZXMgYmFjaywgY2hhbmdl cyBpbmNvcnBvcmF0ZWQgaW50bw0KPj5hIG5ld2VyIHJldmlzaW9uIGFuZCBzbyBvbiwgY2lyY2xp bmcgYXJvdW5kIGEgbGFjayBvZiBjb25zZW5zdXMuDQo+PkNoYW5naW5nIGVkaXRvcnMsIHVubGVz cyBpdCBpcyB0byBzb21lb25lIHJlbW90ZSBmcm9tIHRoZSBzdWJqZWN0LCBpcw0KPj51bmxpa2Vs eSB0byBjaGFuZ2UgdGhpbmdzLi4NCj4+DQo+PkkgZGlkIGxvb2sgYXQgQWxhbidzIGNvbW1lbnRz LCBhZ3JlZWQgd2l0aCBzb21lLCBkaXNhZ3JlZWQgd2l0aCBvdGhlcnMsDQo+PmRpdHRvIEFsZXhh bmRlcidzLCBidXQgd2FzIGRpc2luY2xpbmVkIHRvIGRvIG1vcmUgd2l0aCBub29uZSBlbHNlDQo+ PmNoaXBwaW5nIGluLCBlc3BlY2lhbGx5IGFzIHNldmVyYWwgbW9yZSBkaWQgY2hpcCBpbiBpbiB0 aGUgaW5pdGlhbA0KPj5zdGFnZXMgb2Ygc2hvdWxkIHdlIGFkb3B0IHRoaXMsIGFuZCB3aGF0IHN0 YXR1cyBzaG91bGQgaXQgYmUuDQo+Pg0KPj5Ib3cgeW91IHN0aXIgcGVvcGxlIGludG8gbGlmZSBp cyBhIGNoYWxsZW5nZSBmb3IgV0cgY2hhaXJzLg0KPj4NCj4+VG9tIFBldGNoDQo+Pg0KPj4+IFRo YW5rIHlvdS4NCj4+Pg0KPj4+IElnbmFzDQo+Pj4NCj4+Pg0KPj4+DQo+Pj4gX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+PiBPUFNBV0cgbWFpbGluZyBs aXN0DQo+Pj4gT1BTQVdHQGlldGYub3JnDQo+Pj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby9vcHNhd2cNCj4+DQo+DQoNCg== From nobody Tue May 16 12:49:27 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4648712878D; Tue, 16 May 2017 12:49:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j1d2rd9W3IA9; Tue, 16 May 2017 12:49:24 -0700 (PDT) Received: from llmx2.ll.mit.edu (LLMX2.LL.MIT.EDU [129.55.12.48]) by ietfa.amsl.com (Postfix) with ESMTP id 4372712EBE5; Tue, 16 May 2017 12:45:20 -0700 (PDT) Received: from LLE2K10-HUB02.mitll.ad.local (LLE2K10-HUB02.mitll.ad.local) by llmx2.ll.mit.edu (unknown) with ESMTP id v4GJjDbq002058; Tue, 16 May 2017 15:45:14 -0400 From: "Blumenthal, Uri - 0553 - MITLL" To: "Douglas Gash (dcmgash)" , "t.petch" , Alan DeKok , Ignas Bagdonas CC: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHxXY8AgACwjQCAAF7+gIADaB0A///Pz/+AAFRYAIABZPtIgABDGID//8HNAA== Date: Tue, 16 May 2017 19:45:13 +0000 Message-ID: <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.21.0.170409 x-originating-ip: [172.25.177.148] Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha256; boundary="B_3577794312_472391796" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-05-16_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1703280000 definitions=main-1705160157 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 May 2017 19:49:26 -0000 --B_3577794312_472391796 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable On 5/16/17, 3:27 PM, "OPSAWG on behalf of Douglas Gash (dcmgash)" wrote: >The lack of interactivity was more our fault than any one else's, we >took Alan=C2=B9s comments and incorporated them into the version we upload= ed in >Feb. > >What we should have done was collate Alan=C2=B9s comments to promote >discussion. We=C2=B9re attempting to rectify than that now: > >1) We put Alan=C2=B9s comments on v5 put on a single mail list a few days = ago Doug, IMHO it is less critical to put collated Alan=E2=80=99s comments on the lis= t. We=E2=80=99ve all already seen Alan=E2=80=99s comments, so collating them into a sing= le mail would be of a marginal usefulness. What the public needs is *your answers to each of those comments* being put= on the list. As I said before: =E2=80=9Cforeach (comment): comment -> change in t= he draft text=E2=80=9D or =E2=80=9Ccomment -> reasons not to address=E2=80=9D.=20 >2) We are going to give an initial response ASAP (will take a few days= ) That would be fine, IMHO.=20 My concern (and displeasure) is that in the past few days we=E2=80=99ve seen plen= ty of emails on this subject, but nothing along the lines of the above =E2=80=93 w= hich IMHO is the only thing that would actually matter (everything else is j= ust waste of bandwidth). >3) More discussions will ensure, and other comments on the doc may be >generated >4) We will hopefully steer towards a consensus that will feed into v7. Yes and yes. =20 --B_3577794312_472391796 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIUVwYJKoZIhvcNAQcCoIIUSDCCFEQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0B BwGgghImMIIE6jCCA9KgAwIBAgIKMztKZQAAAABumTANBgkqhkiG9w0BAQsFADBRMQswCQYD VQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEMMAoGA1UECxMDUEtJ MRMwEQYDVQQDEwpNSVRMTCBDQS0zMB4XDTE2MDExNDE3MzMzN1oXDTE5MDExMzE3MzMzN1ow YTELMAkGA1UEBhMCVVMxHzAdBgNVBAoTFk1JVCBMaW5jb2xuIExhYm9yYXRvcnkxDzANBgNV BAsTBlBlb3BsZTEgMB4GA1UEAxMXQmx1bWVudGhhbC5VcmkuNTAwMTA1ODQwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDqifs8K0OoodbmOo5G/j2+p2ibbOsEoJ9GJjK8K1Iw 6iig59a3EuNB6NR4tAR3INwjjUwMCa4o8ysnk1hN32B3HPrK5Z8++Y/xcX5iP1L6fc51YQ5C /EGvrSbjuPLvt19SNfVdwcuoc842Sgk9N/HemdwmvcqJkwzWDsuxKikI2clT1N5LTAaPMkhr HVuYOHBE0mCXjHjFnYuHsEXyVvUZLxziDgduV9WKbC90Z1NZMXB6ZeQTACUWgMfpFrE12LKb fvOmxepCBfCPbGB3ZyG+FaUdtQoCEAbGTnY7nCedQFn7pV1hppCt4jjLVlOpgYc3dPmyiXsL nhDQZ5ptmks/AgMBAAGjggGyMIIBrjAdBgNVHQ4EFgQUiXqPublGfd0sWKNk/BObT6Oorzgw DgYDVR0PAQH/BAQDAgbAMB8GA1UdIwQYMBaAFNdgZg57SY11TA39z0beyMcSh8q/MDMGA1Ud HwQsMCowKKAmoCSGImh0dHA6Ly9jcmwubGwubWl0LmVkdS9nZXRjcmwvTExDQTMwZgYIKwYB BQUHAQEEWjBYMC0GCCsGAQUFBzAChiFodHRwOi8vY3JsLmxsLm1pdC5lZHUvZ2V0dG8vTExD QTMwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLmxsLm1pdC5lZHUvb2NzcDA9BgkrBgEEAYI3 FQcEMDAuBiYrBgEEAYI3FQiDg+Udh+ynZoathxWD6vBFhbahHx2Fy94yh/+KcwIBZAIBBjAi BgNVHSUBAf8EGDAWBggrBgEFBQcDBAYKKwYBBAGCNwoDDDAYBgNVHSAEETAPMA0GCyqGSIb3 EgIBAwEIMBkGA1UdEQQSMBCBDnVyaUBsbC5taXQuZWR1MCcGCSsGAQQBgjcUAgQaHhgATABM AFUAcwBlAHIAUwBpAGcALQBTAFcwDQYJKoZIhvcNAQELBQADggEBAK7HM6o1IolvkCJrlsjj N1+0Z2JG8anwkHkVKAg/K9qUD0LE9zbnK3kZRGZsljJUDG+hMWmTWCkx0TTzbg/BeVrypVPD 7rn1Tagi9QBV2eJhdBZRHWOcsteRldUukKbMw74hkNGH9o/p/FFZYMA0kHnA7XfECilF9Yl6 uKDv1lbjuWdgcKD1FdEj7rL/IdX0wKJVUKjwLG1RQZel1nuwyRjVtXWz8IUMJXRsYHf6uSzy YoNBeZuWyMx/J5c0ACKXXs1O721GPJ5U5gcEaQ/b8lwQGcOgPk28RPwgiBF3f5TgrTa7QxGf ozmNsTj1OV1vU0vjqKrg7USi9q0xTdGUIyowggS8MIIDpKADAgECAgEpMA0GCSqGSIb3DQEB BQUAMFQxCzAJBgNVBAYTAlVTMR8wHQYDVQQKExZNSVQgTGluY29sbiBMYWJvcmF0b3J5MQww CgYDVQQLEwNQS0kxFjAUBgNVBAMTDU1JVExMIFJvb3QgQ0EwHhcNMTMxMjE3MDAwMDAwWhcN MjAxMjMxMjM1OTU5WjBRMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFi b3JhdG9yeTEMMAoGA1UECxMDUEtJMRMwEQYDVQQDEwpNSVRMTCBDQS0zMIIBIjANBgkqhkiG 9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2jBSdW18tuW1tNxG6h8B0kqckFZQAAtoHCkvUpUEX6jF vBd8mQI53GyLYRuAo4HWJpe7/izFXOfSJDs6UM5ovvCOfXg2bJgDYlBC9JDcLBFIn0nppOu9 RvpjWSixtC56crwJ5Us5QPdtxtKdek5LJXl2oKw3w8lihUixePbxWad1m7ZMKKagvm9zTybP 6FumKRxeYJjSpB2+cAYjoGGEbSVHyx8uzHm6xAoBMHxa8by+yDz8Jzk6sP9iilgP3iXSGoCA mhyBzvlQQ5QNNWP+Emo9jz/ukKhYVB/VwdxtoquPAqn4ifDAIaM9dtb05cy1gXAFSP3Z/iUk xyBZZUORfwIDAQABo4IBmjCCAZYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU12Bm DntJjXVMDf3PRt7IxxKHyr8wHwYDVR0jBBgwFoAUZ6p6z/QKprlytYqg0p3yEMND7SkwDgYD VR0PAQH/BAQDAgGGMGYGCCsGAQUFBwEBBFowWDAtBggrBgEFBQcwAoYhaHR0cDovL2NybC5s bC5taXQuZWR1L2dldHRvP0xMUkNBMCcGCCsGAQUFBzABhhtodHRwOi8vb2NzcC5sbC5taXQu ZWR1L29jc3AwMwYDVR0fBCwwKjAooCagJIYiaHR0cDovL2NybC5sbC5taXQuZWR1L2dldGNy bD9MTFJDQTCBkgYDVR0gBIGKMIGHMA0GCyqGSIb3EgIBAwEGMA0GCyqGSIb3EgIBAwEIMA0G CyqGSIb3EgIBAwEHMA0GCyqGSIb3EgIBAwEJMA0GCyqGSIb3EgIBAwEKMA0GCyqGSIb3EgIB AwELMA0GCyqGSIb3EgIBAwEOMA0GCyqGSIb3EgIBAwEPMA0GCyqGSIb3EgIBAwEQMA0GCSqG SIb3DQEBBQUAA4IBAQAsf9HBn72qU7UTgkxarjAc7iynhcDEgWwezYKtd/SLGSQ0DhtzIV/L TCxqULjOd+H+HTqMJXB8+nHnzhyqQ43RsnGZOFT5RfzPh94db/ZJ3ql244DwlJI7yXBA2DkZ cEEgOWC9bHcrElzU6NnigahSW5odVJrhmH/XhQAcMS77E5H62yyxK1WPPgcBipGVnu1xSHbT iHe7DqfWQ2tVMLUf23XYhIua94kJsQd4jSh71NVD0e7F4snAoqQMI98MzDYeLOkjlzKRs77r /aMsPAKx6nMaOvRL7Cy0Pjp51i2qFkbGmX8ofnh2kerjTTvRJ/g22r1MV8RR1PktjMsNOsPf MIIDgzCCAmugAwIBAgIBATANBgkqhkiG9w0BAQUFADBUMQswCQYDVQQGEwJVUzEfMB0GA1UE ChMWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEMMAoGA1UECxMDUEtJMRYwFAYDVQQDEw1NSVRM TCBSb290IENBMB4XDTA4MDkyMzEyMDAwMFoXDTI5MTIzMTIzNTk1OVowVDELMAkGA1UEBhMC VVMxHzAdBgNVBAoTFk1JVCBMaW5jb2xuIExhYm9yYXRvcnkxDDAKBgNVBAsTA1BLSTEWMBQG A1UEAxMNTUlUTEwgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMVO KRdYsiay+a2Kv1wQCoPd5AkwExuwcNDRhaRCdQN17K+lCCKvf9VSQToAsA6q1bACtZUcMv5Z Kx8z5KG4jK9cM40NvEkf/bIOZAHJqzKgWG3N9NqrcAhimcXTXYQIdp1DgjtdADKVLAjXaYpD 2PbpE/JbAPnqKzOENa3Py9CegB0abTlOyLgwXWY/rXTW+4L/hipJ6+sI/ZtrFRmsKGhuwAKo bFr0FDP6uIfx+RaWJcJ1QBIdgM4aohvW8JeriSSMyf/LlFpXTZFcM9SOX0f7wmsYi1yFuKFM nQbkSkxvnpBKMRxrg+98seSbbEnIkvB0C9qBDPLb/lQAvmpW6oMCAwEAAaNgMF4wDwYDVR0T AQH/BAUwAwEB/zAdBgNVHQ4EFgQUZ6p6z/QKprlytYqg0p3yEMND7SkwHwYDVR0jBBgwFoAU Z6p6z/QKprlytYqg0p3yEMND7SkwCwYDVR0PBAQDAgGGMA0GCSqGSIb3DQEBBQUAA4IBAQA+ G20FYNB4eNhKWF+PyT5DUtzlABFkf2IM2VGNUBova0GeKX3I1Nf02qDU/GO2H9ETvnvTYhvf gQ4UB/5EImTkKPa7/TVG/MQ7SgmAmne8xELVbGLFrrytly8PyYtZtngb6DgeEUv+SwFnzcLO 1vg1rdmss3kwsqy0q8e2VYAY8zTptEzyJG36aXcIMbqOxWS/LbPjNuPdgJfO3d1WrHr1Etaa a0QRLqQoZj07dYY7Wo5EDqU+AUAMz9ZVRGK1s5b/jv5Wz/YroyqWFnH2KkNxRn9+2Ar7g3rn rOMZvp6psq2jbDXiPBod1wyMKn8x5y4cuGPNFcqjfyY/HX90ivQAMIIE7TCCA9WgAwIBAgIK MziUjwAAAABuljANBgkqhkiG9w0BAQsFADBRMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlU IExpbmNvbG4gTGFib3JhdG9yeTEMMAoGA1UECxMDUEtJMRMwEQYDVQQDEwpNSVRMTCBDQS0z MB4XDTE2MDExNDE3MzAzOVoXDTE5MDExMzE3MzAzOVowYTELMAkGA1UEBhMCVVMxHzAdBgNV BAoTFk1JVCBMaW5jb2xuIExhYm9yYXRvcnkxDzANBgNVBAsTBlBlb3BsZTEgMB4GA1UEAxMX Qmx1bWVudGhhbC5VcmkuNTAwMTA1ODQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDjFDaGib07mHBdNaVMNpj9+4iJa+K9AcTN3y+iU1ygtvHG4coteDBf77ZN1uwdt+lodW0C 8XyG43suSfpNp/owLOUElFagAnPqHAvAUIwsl5AjzncpJP+78Ui4u34aMNsddP+QZu9HI2Qg +P6eMD25jkjybT9dQMxXZpO2oTBznlWjYIItdZhK1DWZqIR0at7n2YjCSQsZNX0lJ4JwrtjH YFrYPnnZC0f1B2M7V54IS863CEyfu5XotoZx8YuHwYpKSFq80SEh6cMDLdTe1ZAjWxsnbyKC 64rreStyI2PVN9uBWd+OleGoIAjVogpMKKi0pSRHcCuwDwGekpQVubK9AgMBAAGjggG1MIIB sTAdBgNVHQ4EFgQU8U/FiJmibLZl2+KcNbVWE2PZipswDgYDVR0PAQH/BAQDAgUgMB8GA1Ud IwQYMBaAFNdgZg57SY11TA39z0beyMcSh8q/MDMGA1UdHwQsMCowKKAmoCSGImh0dHA6Ly9j cmwubGwubWl0LmVkdS9nZXRjcmwvTExDQTMwZgYIKwYBBQUHAQEEWjBYMC0GCCsGAQUFBzAC hiFodHRwOi8vY3JsLmxsLm1pdC5lZHUvZ2V0dG8vTExDQTMwJwYIKwYBBQUHMAGGG2h0dHA6 Ly9vY3NwLmxsLm1pdC5lZHUvb2NzcDA9BgkrBgEEAYI3FQcEMDAuBiYrBgEEAYI3FQiDg+Ud h+ynZoathxWD6vBFhbahHx2F69Bwg+vtIAIBZAIBBTAlBgNVHSUEHjAcBgRVHSUABggrBgEF BQcDBAYKKwYBBAGCNwoDBDAYBgNVHSAEETAPMA0GCyqGSIb3EgIBAwEIMBkGA1UdEQQSMBCB DnVyaUBsbC5taXQuZWR1MCcGCSsGAQQBgjcUAgQaHhgATABMAFUAcwBlAHIARQBuAGMALQBT AFcwDQYJKoZIhvcNAQELBQADggEBABbuvs9m0gS5U8JJuVc+qttV2BWQ0jDepXpYfP/xN8rV ScRPHe2SMUaFH5OMRhheGJkdogWVNnMrjHxQfpfc0z8yotlD3xwXENWUY5MoQmpEGB2ksFqg Md121bqzR3WY84Lcosfow0MoplXs8mvO7TnozwM+PtGZs0mpp2PzBkvWdNbs2r/7wXJP6/pL d5zPvywRNhTgoVe1aN4ivIkU8svkKMggv5ZaOsonaW8JS6dUYmvvk0QvDJRIQNRR0zpQpOKp +4V/XhMZRhxQJ3DjVTjh9Q/pHKm7ARFhFr3QAJ6ocCjyzLF5issa1Vshx7ElBIk0cXhep6mL MLqGNX3azAkxggH1MIIB8QIBATBfMFExCzAJBgNVBAYTAlVTMR8wHQYDVQQKExZNSVQgTGlu Y29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxEzARBgNVBAMTCk1JVExMIENBLTMCCjM7 SmUAAAAAbpkwDQYJYIZIAWUDBAIBBQCgaTAvBgkqhkiG9w0BCQQxIgQg/+VVd3ltgi6FYdDS qOsATbJer3dg9SmrhPqYH/L5RO8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG 9w0BCQUxDxcNMTcwNTE2MTk0NTEyWjANBgkqhkiG9w0BAQEFAASCAQAPeb4R/udle++FBInt p5aMvD7/LwLpqIolQ/rzOc5NCDxyqABspdP39nO+tmNS/W1tmpuhectgrtYymRVTX94n41Oz CeDw9d8G8sSeQjxiak39iSD4yua7Zf36VZDYy4313TIejNpfWlTSTDS2gD67bXnuRiIVJOmZ DFLiGpr/XkakLD7Y6pSwWLZCaMx1qp4Jj3k+X0rBfYfVW+1v5UxJ0gI85aMObr0uIu6Fqaiq AVPCXLw+4NgMCRPSViXR6DO8VK793qdwwfH+IzvH4FjtorGrLWWSgAwda5UBZ6RvmtuEiF0q chbG6iC5rzjr5IoUNUeWaWUiOwwEelybKSPg --B_3577794312_472391796-- From nobody Tue May 16 13:00:55 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 68447124D37 for ; Tue, 16 May 2017 13:00:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_50=0.8, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LFxdWZjgsacI for ; Tue, 16 May 2017 13:00:53 -0700 (PDT) Received: from mail-pf0-f169.google.com (mail-pf0-f169.google.com [209.85.192.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E1FEB129601 for ; Tue, 16 May 2017 12:56:23 -0700 (PDT) Received: by mail-pf0-f169.google.com with SMTP id m17so85517933pfg.3 for ; Tue, 16 May 2017 12:56:23 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=UzY7ss09vB2jP3tdGcxIOjhqB1w9GWsHOkiZ4iEYTZU=; b=mUcbDXMVtcE4hix3aXKTWMQwu1IXPu8md9lSyz567mV+lnfTnXkLBR/6T+oB65PmCD ODpGfXqS3bStKZ0QUP2FIl/iv4IDKYJ44lhcm44BnGMEhCwEX/7mrOjfdOGg6XH/OmQg Ec4bB4SfyR0zmBrqLXSWHQPP+ZjoNSWgRlm+6TEQ748NBv1yd6gNj1IbrPeMlKz39HFu TPpKssk9StRCgtMrBSQvMRg+VSwFGDVvYR+Ro0PdQeAdP03L0cl94cioZTHYC/rl2Deu ZpYXeh3nIYPcUnwrFTdoUhzhgo0Gd5y+j6SarVbzMqfvp3j44p02/hLEB49Ifcbeb75u Qj5w== X-Gm-Message-State: AODbwcCQIFho9A/TYLOxRvx+OKKIPK7utRO3dZpP9zAJMmoJe6n5VKC3 uVmGtQAt+CqVQgt7MIJUgw== X-Received: by 10.98.160.130 with SMTP id p2mr14496605pfl.184.1494964583065; Tue, 16 May 2017 12:56:23 -0700 (PDT) Received: from [192.168.1.113] (c-24-130-218-233.hsd1.ca.comcast.net. [24.130.218.233]) by smtp.gmail.com with ESMTPSA id s18sm236306pfi.16.2017.05.16.12.56.22 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 16 May 2017 12:56:22 -0700 (PDT) To: opsawg@ietf.org References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> From: Randy Presuhn Message-ID: Date: Tue, 16 May 2017 12:56:24 -0700 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 May 2017 20:00:54 -0000 Hi - Uri is said to have said: ... > My concern (and displeasure) is that in the past few days > we’ve seen plenty of emails on this subject, but nothing > along the lines of the above – which IMHO is the only thing > that would actually matter (everything else is just waste > of bandwidth). ... YES, YES, YES, YES, YES!!!!!! Randy From nobody Tue May 16 13:11:19 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7BC531289B0; Tue, 16 May 2017 13:11:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -13.365 X-Spam-Level: X-Spam-Status: No, score=-13.365 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTML_TAG_BALANCE_BODY=1.157, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DNfTTSsMLPUA; Tue, 16 May 2017 13:11:09 -0700 (PDT) Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 05F6D1289B5; Tue, 16 May 2017 13:06:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=596386; q=dns/txt; s=iport; t=1494965189; x=1496174789; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=KM/+NkWMItjUUvloOdRUQvW84DD7U/x+9Pzf+bGA6WA=; b=V1T7whg4KpKkaQsh9Fjm8eWKDsinfjCe+IdSUN6XDFZ6ug1JfDCFdcc2 oEeZW0Jx0Ymmmq+LPNzqeWJkIUZuXMF/esVxsoR4k6CfmItPNtKqb/4Jq QLnCwn8cM7clRjzHczpH7Fhpdt8uQjFJcy2U62qbvTtVxWp1Cktw3Kh0z A=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0CgBABhWhtZ/5BdJa3LCAQCAQIB X-IronPort-AV: E=Sophos;i="5.38,350,1491264000"; d="scan'208,217";a="426735613" Received: from rcdn-core-8.cisco.com ([173.37.93.144]) by alln-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 16 May 2017 20:06:28 +0000 Received: from XCH-RCD-013.cisco.com (xch-rcd-013.cisco.com [173.37.102.23]) by rcdn-core-8.cisco.com (8.14.5/8.14.5) with ESMTP id v4GK6RNM023904 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 16 May 2017 20:06:27 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-RCD-013.cisco.com (173.37.102.23) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 16 May 2017 15:06:26 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1210.000; Tue, 16 May 2017 15:06:26 -0500 From: "Douglas Gash (dcmgash)" To: Alan DeKok , "opsawg@ietf.org" CC: "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHxblMAgADBTACAA2Ki4oAAEfVNgAB2p4CAAUHjJIAAZjOA///0HoCAABakgA== Date: Tue, 16 May 2017 20:06:26 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> In-Reply-To: <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.0.161029 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.1.6] Content-Type: multipart/alternative; boundary="_000_D54116DA23412Adcmgashciscocom_" MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 May 2017 20:11:18 -0000 --_000_D54116DA23412Adcmgashciscocom_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hi, First batch of responses. This is in HTML encoding with intent to make resp= onses easier to see due to their colour coding. If this does not work, plea= se LMK, I will send a different format. Many items are marked with just [Agree], if it seems there is a trivial way= to adjust according to the comment. The final batch of initial responses will be sent in a few days. All may pr= efer to wait for final batch. The security section will be dealt with on a separate thread. Regards, Doug. ------ 3.3. Single Connect Mode The packet header (see below) contains a flag to allow sessions to be multiplexed on a connection. * it would be good to name the flag here: [Agreed. New Version: "Single Connection Mode is intended to improve performance by allowing a client to multiplex multiple session on a single TCP connection. The packet header contains the TAC_PLUS_SINGLE_CONNECT_FLAG used by the client and server to negotiate the use of Single Connect Mode."] If the server sets this flag in the first reply packet in response to the first packet from a client, this indicates its willingness to support single-connection over the current connection. The server may set this flag even if the client does not set it, but the client is under no obligation to honor it. * what happens if the client does not honour the flag? [It will close the connection after the session completes. Update: "The server may set this flag even if the client does not set it, but the client may ignore the flag and close the connection after the session completes."] The flag is only relevant for the first two packets on a connection, to allow the client and server to establish single connection mode. The flag MUST be ignored after these two packets since the single- connect status of a connection, once established, must not be changed. The connection must instead be closed and a new connection opened, if required. Why would it be required to change the mode? It would be good to explain the use-cases, and why (or not) they make sense. [We mandate it must not happen. To be honest, I=92m not aware of any use ca= se for wanting to change] TAC_PLUS_UNENCRYPTED_FLAG :=3D 0x01 If this flag is set, then body encryption is not used. If this flag is cleared, the packet is encrypted. Unencrypted packets are intended for testing, and are not recommended for normal use. * it would be good to have a pointer to the security considerations, with a discussion of the implications. [Agreed] * Also, it's odd that a completely insecure mode is just "not recommended for normal use". I would suggest more panic-inducing phrasing. e.g. ."Unencrypted packets offer a complete compromise of all security related to the protocol and MUST NOT be used outside of a testing environment" [Partial Agree: Will change to MUST NOT, but do not want to give impression= that MD5 is secure.] TAC_PLUS_SINGLE_CONNECT_FLAG :=3D 0x04 This flag is ussequernt, ed to allow a client and server to agree whether multiple sessions may be multiplexed onto a single connection. * I find the "agree" phrasing odd. I've mentioned before that the tone of the document is often philosophical. Perhaps saying instead "this flag signals whether the client and server are capable of performing session multiplexing" [Agree. Changed to "This flag is used to allow a client and server to negot= iate Single Connection Mode."] * i.e. the flag is a signal, not a capability for the systems to agree. [Agree] session_id The Id for this TACACS+ session. The session id is to be selected randomly. This field does not change for the duration of the TACACS+ session. (If this value is not a cryptographically strong random number, it will compromise the protocol's security, see RFC 1750 * it would be good to update the paragraph to be more prescriptive. i.e. [Agree, changed text to: "The Id for this TACACS+ session. This field does= not change for the duration of the TACACS+ session. This number MUST be generated by a cryptographically strong random number generation method. Failure to do so will compromise security of the session. For more details refer to RFC 1750 [RFC1750]"] The Id for this TACACS+ session. The session id MUST be taken fro a cryptographically strong random number generation. If not, the protocol's security will be compromised. See RFC 1750 for further information ... length The total length of the packet body (not including the header). This value is in network byte order. Packets are never padded beyond this length. * Why is the text on "padding" there? The TACACS+ packets are sent over TCP, not UDP. So any "padding" would be outside of the scope of the current packet, and be seen by the other end as a subsequent, but invalid, TACACS+ packet. [Agree: Removed part about padding] 3.5 ... - Unused fixed length fields SHOULD have values of zero. * what happens when they don't? I suggest adding text saying that the fields are ignored. [Agree, changed text to: "To signal that any variable length data fields ar= e unused, their length value is set to zero." As to what happens when fields are unus= ed, this will depend upon the fields] - There will be no padding in any of the fields or at the end of a packet. * I wonder again what "padding" means here. [Agree, removed] 3.6. Encryption The body of packets may be encrypted. ... * Which is not a standard encryption method. Security people will complain here. I suggest (as before) using the term "obfuscated". With a note that for historical reasons, the flags / fields / etc. refer to TACACS+ "encryption". [Agreed, changed generally to obfuscation, apart from where field names are= directly referenced] ... This document does not discuss the management and storage of those keys. ... * there should be some discussion in the Security Considerations section about this. Otherwise, this subject will be brought up in the security review. [Will be happy to stand corrected, but that strikes me as both outside the = documentation of the protocol, and likely to lock in practices that will be= come out-of-date.] ... It is an implementation detail of the server and client, as to whether they will maintain only one key, or a different key for each client or server with which they communicate. For security reasons, the latter options MUST be available, but it is a site dependent decision as to whether the use of separate keys is appropriate. * those sentences seem to disagree with each other. It's an "implementation detail", but it MUST be supported. I suggest requiring the capability of per-server and per-client keys. [Agree, the requirements must be supported by implementations, however we l= eave it for the implementor as to whether this is used] ... The session id is used in network byte order. * nit: if the session ID is a 32-bit opaque token, it's not in any byte order. Maybe just "as taken from the packet header" ? [Agree] When a server detects that the secret(s) it has configured for the device mismatch, it MUST return ERROR. The handling of the TCP connection by the server is implementation independent. * I repeat my objection here. There is just no reason for the TCP connection to remain open after the connection has been determined to be fraudulent. This subject also came up in the RADIUS over TCP drafts. The consensus there was the same: if it's not a real / known / good client, there is every reason to close the connection, and zero reasons to keep it open. [see next] After a packet body is decrypted, the lengths of the component values in the packet are summed. If the sum is not identical to the cleartext datalength value from the header, the packet MUST be discarded, and an error signalled. The underlying TCP connection MAY also be closed, if it is not being used for other sessions in single- connect mode. * This last sentence is confusing. Are there different secrets for different packets in one TCP stream? If so, nothing in the document says so. If not, then there is every reason to believe that the secret is mismatched. And, the *next* packet will decrypt incorrectly. Which means (again) you might as well just close the TCP connection. [though we would not want to restrict to a single secret on server for a cl= ient, we can restrict the clint that it should us just a single secret on a= client at a time for a connection to a server. This would mean that we cou= ld not have single connect, multi session interaction from a client with mu= ltiple secrets so then we could close the connection] If an error must be declared but the type of the incoming packet cannot be determined, a packet with the identical cleartext header but with a sequence number incremented by one and the length set to zero MUST be returned to indicate an error. * this mix of clear-text and encrypted signalling opens up the protocol to an attacker. Since this "NAK'" is not protected, an attacker can forge the NAK at any time, and force the connection to be closed. [Agree, this is probably one of the ideas that is supported by the old spec= that we can drop/ The more that we can clean it out, the better. Will add = to the list of deprecated features.] * this attack (along with all others) should be noted in the Security Considerations section. ... Packet fields are as follows: action This describes the authentication action to be performed. Legal values are: * what happens if a client/server receives values outside of the legal range? I suggest sending ERROR, and closing the TCP connection. [Agreed, though we have a section "Treatment of Enumerated Protocol Values"= , so that we don't need to repeat it for each item] * similar comments apply for other fields with "legal values". While it's good to define what happens when things go as planned, it's also good to define what happens when things *don't* go according to plan. [Agreed, the section "Treatment of Enumerated Protocol Values" should mop t= his all up.] * review of 4.2 and subsequent sections will follow in a later message. Summary: the spec is still fairly descriptive / philosophical instead of prescriptive. Many optional parts of the protocol are described, "A and B are allowed", but there is often no description of what to *do* when either A or B is present. I've suggested descriptive text, or places where descriptive text can be added. [Agreed, in general, I believe we can document the positive cases, and to s= tipulate in one place what occurs if values are not present in case of serv= er, or client] The larger worry here is what happens if the descriptive text conflicts with existing implementations? This is a topic which should be discussed in the "Security Considerations" section. i.e. the spec documents the existing protocol, with recommendations for security and inter-operability. As the protocol has historically been poorly specified, implementations are likely to follow the broad requirements of this specification. They are also likely to not follow many of the newly-clarified behaviours / requirements. The hope is that this specification can guide implementors towards a common understanding of the protocol. Also, vague requirements and open options in a protocol spec are ripe for implementation bugs and security issues. That worry drives many of my comments. ----- 4.2 ... server_msg, server_msg_len c A message to be displayed to the user. This field is optional. If it exists, it is intended to be presented to the user. US-ASCII charset MUST be used. The server_msg_len MUST indicate the length of the server_msg field, in bytes. * The last sentence is atypical of RFC 2119 language. Then language is typically about system behaviour or inter-field comparisons. I'm not sure what it means that a field MUST indicate a length. * i.e. the "server_msg_len" field is *defined* to encode the length of the "server_msg" field. No "MUST" is necessary. [Agree, will remove MUST]. * similar comments apply to many of the other "foo_len" fields, elsewhere in the document [Will apply universally] rem_addr, rem_addr_len An US-ASCII string this is a "best effort" description of the remote location from which the user has connected to the client. * perhaps instead of "best effort", just re-use language from the "port" description. The contents of this field are the clients description of the remote location... [Agree: best effort removed. Proposed New Text: " An US-ASCII string indi= cating the remote location from which the user has connected to the client. It is intended to hold a network address if the user is connected via a network, a caller ID is the user is connected via ISDN or a POTS, or any other remote location information that is available. This field is optional (since the information may not be available). The rem_addr_len indicates the length of the user field, in bytes."] 4.4 ... When the REPLY status equals TAC_PLUS_AUTHEN_STATUS_GETDATA, TAC_PLUS_AUTHEN_STATUS_GETUSER or TAC_PLUS_AUTHEN_STATUS_GETPASS, then authentication continues and the SHOULD provide server_msg * editorial: the WHAT should provide... [Agreed. Answer is of course: "server"] ... quest for more information to flexibly support future requirements. If the TAC_PLUS_REPLY_FLAG_NOECHO flag is set in the REPLY, then the user response must not be echoed as it is entered. * the implicit assumption here is that there is a person who is entering text on a terminal. It would be good to have a bit more explanation of this expected use-case. [Agreed. T+ is used in many and varied use case, "echoed" is too restrictiv= e, and should be replaced by something like "disclosed in a user interface"= ] NOTE: Only those requests which have changed from their minor_version 0 implementation (i.e. CHAP, MS-CHAP and PAP authentications) will use the new minor_version number of 1. All other requests (i.e. all authorisation and accounting and ASCII authentication) MUST continue to use the same minor_version number of 0. * that's an odd phrasing of the requirement. Perhaps something more prescriptive would be useful. e.g.: NOTE: Authentication requests which use ASCII login or chpass MUST use minor version 0. Authentication requests using PAP, CHAP, or MS-CHAP MUST use minor version 1. All authorization and accounting packets MUST use minor version 0. [Agreed: will revamp this section]. 4.4.2... This section describes common authentication flows. If the options are implemented, they MUST follow the description. If the server does not implement an option, it will respond with TAC_PLUS_AUTHEN_STATUS_ERROR. * It's not typically required to say that implementations MUST follow the spec. [Agreed] * also, perspective terminology is better than descriptive. Not "will do", but "MUST do". [Agreed] * I suggest re-phrasing: This section describes common authentication flows. If the server does not implement an option, it MUST respond with TAC_PLUS_AUTHEN_STATUS_ERROR. This is a standard ASCII authentication. The START packet may contain the username, but need not do so. * what happens when the username is / is-not included? i.e. what do implementations *do*? [Agreed to expand. the server can of course, finish the session at any time= , as detailed in the "session termination" section. But let's assume that w= e want the server to carry on the process, then it will retrieve the userna= me as described in the following proposed text: "The START packet MAY contain the username. If the user does not include the username then the server MAY obtain it from the client with a CONTINUE TAC_PLUS_AUTHEN_STATUS_GETUSER. When the server has the username, it will obtain the password using a continue with TAC_PLUS_AUTHEN_STATUS_GETPASS. ASCII login uses the user_msg field for both the username and password. The data fields in both the START and CONTINUE packets are not used for ASCII logins, any content MUST be ignored. The session is composed of a single START followed by zero or more pairs of REPLYs and CONTINUEs, followed by a final REPLY indicating PASS, FAIL or ERROR."] * if this is a valid protocol flow, then it should be described. e.g. "Any username in the START packet is ignored", or "any username in the START packet MUST match the username in subsequent packets" [Normally, the username is in just one packet] ... The data fields in both the START and CONTINUE packets are not used for ASCII logins. * what happens if there is data in the fields? Is it ignored? [Agreed From perspective of protocol, yes] * RFC 2119 language is recommended here. "any data (if present) MUST be ignored", or "the data field MUST NOT be present" * I have no idea how to make these requirements compatible with existing implementations. Sorry... [I'm not sure though, that it is relevant to the protocol specification.] CHAP: The length of the challenge value can be determined from the length of the data field minus the length of the id (always 1 octet) and the length of the response field (always 16 octets). * it would be good to recommend a minimum length for challenge. 1 octet is clearly insufficient, but is (silently) allowed by the spec. I suggest at least 8 octets/ [See next response] * also, the challenge MUST be derived from a cryptographically strong pseudo-random number generator, and MUST change on every CHAP request. Otherwise, the spec allows (also silently) a fixes challenge. [This is interesting because, of course, the challenge is not generated for= T+ but for a different interaction. the result of that other interaction i= s passed along to T+. These recommendations are good, but can we actually p= olice this data?] To perform the authentication, the server will run MD5 over the id, the user's secret and the challenge, as defined in the PPP Authentication RFC 1334 and then compare that value with the response. * again "server WILL run". As opposed to "calculates..." [Agreed] MSCHAPv1 / MSCHAPv2: The length of the challenge value can be determined from the length of the data field minus the length of the id (always 1 octet) and the length of the response field (always 49 octets). * RFC 2433 says that the challenge is 8 octets. RFC 2759 says that the challenge is 16 octets. It would be good to re-iterate that here. * i.e. smaller challenges are insecure, and should be forbidden [again, as T+ interaction is not involved with the generation of the challe= nges, is this something we can actually meaningfully enforce?] ... To perform the authentication, the server will use a the algorithm specified RFC2759 * editorial: "specified IN RFC ..." [agreed] ... ASCII change password request * I suspect that the security area review will recommend that this be removed. Even RADIUS had "change password" removed at the behest of the security people. [Noted. I take it this not a request yet to remove though?] 4.4.3. Aborting an Authentication Session The client may prematurely terminate a session by setting the TAC_PLUS_CONTINUE_FLAG_ABORT flag in the CONTINUE message. If this flag is set, the data portion of the message may contain an ASCII message explaining the reason for the abort. * again, what happens if the field is / is-not present? [Agree, We will have a lack of information regarding the reason for the abo= rt. this seems an obvious impact, but we can add] * what does the server do with this message? Should it be logged somewhere? [I would say, this is out of scope of the protocol, and a matter for implem= entation] ... The session is terminated and no REPLY message is sent. * what happens to the TCP connection? Does it remain open? It may be good to say "The session is terminated, and the session Id is no longer valid. However, other sessions on the same TCP connection may continue..." [Agreed] The host is specified as either a fully qualified domain name, or an ASCII numeric IPV4 address specified as octets separated by dots ('.'), or IPV6 address test representation defined in RFC 4291. * editorial ".. text .. "representation, not "test" [Agreed] If a key is supplied, the client MAY use the key in order to authenticate to that host. The client may use a preconfigured key for the host if it has one. * so the server is pushing keys to clients? The security implications of this should be discussed [SIDE Note: I think this part of the original draft spec is really worth cu= lling. I certainly specify it should not be implemented in our server. I ha= d intended to propose that is done in the next version when we add TLS, how= ever, am considering proposing to do this sooner unless anyone objects.] * what happens if the client gets pushed a key, and then also has a pre-configured key? Which one takes precedence? Why? [... this is the reason why i want to cull this section Lets drill into these only if we decide this section is worth keeping.] Continuing with 4.4.3 While the order of hosts in this packet indicates a preference, but the client is not obliged to use that ordering. * the use of "obliged" is unusual here. Perhaps "the order used by the client is implementation specific, and does not have to follow the order sent by the server" If the status equals TAC_PLUS_AUTHEN_STATUS_RESTART, then the authentication sequence is restarted with a new START packet from the client. ... * nit: it may be good to say that the next session does not have to use the current TCP connection * "restart" may also be ambiguous. Does the session ID change for the next session? It may be good to say instead "If the status equals TAC_PLUS_AUTHEN_STATUS_RESTART, then the client re-authenticates with a new session, beginning with a new START packet" ... This REPLY packet indicates that the current authen_type value (as specified in the START packet) is not acceptable for this session, but that others may be. * Which others "may" be acceptable? And why "acceptable for this session"? is the client free to re-try the same authentication type in a different session? i.e. what does the client *do*? * perhaps say "the REPLY indicates a negative acknowledgement that the current authen_type is not accepted by the server. The client SHOULD start a new session with a different authen_type" If a client chooses not to accept the TAC_PLUS_AUTHEN_STATUS_RESTART packet, then it is TREATED as if the status was TAC_PLUS_AUTHEN_STATUS_FAIL. * why uppercase "TREATED" ? * why "chooses not to accept" ? again, prescriptive is better than philosophical * Perhaps "If the client does not start a new session after receiving a TAC_PLUS_AUTHEN_STATUS_RESTART, it MUST behave as if it received a TAC_PLUS_AUTHEN_STATUS_FAIL." [.... end of the section that should probably be culled] 5. Authorization ... The authorization REQUEST message contains a fixed set of fields that indicate how the user was authenticated or processed * nit: remove "or processed" [Agreed] * from a security point of view, it's unusual for a client to indicate to a server how a user was authenticated. This allows the client to claim authentication when none existed. [Areed, and server can accord appropriate confidence in this information wi= th that proviso] ... This field matches the port field in the authentication section (Section 4) above * what is meant by "matches"? Perhaps "The definition of this field is the same as in Section 4". Or does the field in the authorization session have to contain the same data as the similar field from the authentication session? [Agreed, the first meaning] * similar comments apply for other uses of "matches" It is not legal for an attribute name to contain either of the separators. It is legal for attribute values to contain the separators. * what are the legal characters for an attribute name? The previous paragraph says US-ASCII. So is "($#@!" a legal attribute name? [Agreed. Yes, that is a valid name, because it does not include =3D or *. t= he text is explicit though, do you think it needs further clarification?] * a reference to Section 7 would be useful here. [Agreed] Optional arguments are ones that may be disregarded by either client or server. Mandatory arguments require that the receiving side understands the attribute and will act on it. If the client receives a mandatory argument that it cannot oblige or does not understand, it MUST consider the authorization to have failed. * "oblige" is an unusual word to use here. Perhaps "If the client receives a mandatory argument it cannot implement, it MUST consider the authorization to have failed" [Agreed, we will replace "obliged" and clean up] 5.2 The Authorization RESPONSE Packet Body ... server_msg, server_msg_len This is an US-ASCII string that may be presented to the user. The decision to present this message is client specific. * nit: perhaps "This field is a message from the server to the client. The client MAY display it to the user" * saying "decision is client specific" is a long way of saying "the client MAY do it", but doesn't always have to [it was shorter :) but less consistent. Agreed] ... The attribute-value pair that describes the authorization to be performed. (see below), * That's not clear to me. Perhaps "if present, the list of additional authorizations permitted the user" [will clarify] If the status equals TAC_PLUS_AUTHOR_STATUS_FAIL, then the appropriate action is to deny the user action. * again, a bit more philosophical than prescriptive. Perhaps "If the status equals TAC_PLUS_AUTHOR_STATUS_FAIL, then the requested action MUST be denied" [Agreed] If the status equals TAC_PLUS_AUTHOR_STATUS_PASS_ADD, then the arguments specified in the request are authorized and the arguments in the response are to be used IN ADDITION to those arguments. * uppercase "IN ADDITION" is unusual. Perhaps: If the status equals TAC_PLUS_AUTHOR_STATUS_PASS_ADD, then the arguments specified in the request are authorized and the client MUST also enforce the authorization attribute-value pairs (if any) in the response. * similar comments apply here: If the status equals TAC_PLUS_AUTHOR_STATUS_PASS_REPL then the arguments in the request are to be completely replaced by the arguments in the response. * perhaps If the status equals TAC_PLUS_AUTHOR_STATUS_PASS_REPL then the client MUST use the authorization attribute-value pairs (if any) in the response, instead of any authorization attribute-value pairs from the request. ... If the intended action is to approve the authorization with no modifications, then the status is set to TAC_PLUS_AUTHOR_STATUS_PASS_ADD and the arg_cnt is set to 0. * should be prescriptive. Perhaps: Servers can signal to client that the authorization is approved with no modifications by setting the status to TAC_PLUS_AUTHOR_STATUS_PASS_ADD and the arg_cnt is set to 0. ... A status of TAC_PLUS_AUTHOR_STATUS_ERROR indicates an error occurred on the server. * what does the client do then? Perhaps "the client MAY show an error to the user (how???), and MUST treat the response as TAC_PLUS_AUTHOR_STATUS_FAIL" * Also, the last sentence of the subsequent paragraph also talks about ERROR, and seems misplaced. 6.1. The Account REQUEST Packet Body TACACS+ accounting is very similar to authorization. The packet format is also similar. * nit: that seems redundant. All of the packets use a common format. [The header is more consistent than the body rather than the body, is that = what you mean?] ... There is a fixed portion and an extensible portion. The extensible portion uses all the same attribute-value pairs that authorization uses, and adds several more. * except that the authorization section didn't list any attribute-value pairs. So it's hard to say that those (non-existent) pairs are re-used here [All the attributes are in section 7. 1 for author, 7.2 for accounting] All other fields are defined in the authorization and authentication sections above and have the same semantics. * Can an accounting packet indicate an authen_type and authen_service? If so, what does that mean? [yes, indicating circumstances (if known) on the device] 6.2. The Accounting REPLY Packet Body The response to an accounting message is used to indicate that the accounting function on the server has completed. * what does that mean? Do servers always implement "functions"? As background, RFC 2866 (RADIUS accounting) says: ... Upon receipt of an Accounting-Request, the server MUST transmit an Accounting-Response reply if it successfully records the accounting packet, and MUST NOT transmit any reply if it fails to record the accounting packet. ... * perhaps similar text could be used here. [agreed. Text is: " The purpose of accounting is to record the action that= has occurred on the client. The server MUST reply with success only when the accounting request has been recorded. If the server did not record the accounting request then it MUST reply with ERROR."] ... The server will reply with success only when the record has been committed to the required level of security, * what is a "required level of security"? Is that indicated in the packet? Elsewhere? * my recommendation is just to delete that... ... relieving the burden on the client from ensuring any better form of accounting is required. * I find that statement awkward. Perhaps re-using / re-phrasing text from RFC 2866 would be good here. [Removed this text, relying on the text in the previous response] 6.2. The Accounting REPLY Packet Body * there's more duplication definition of fields here. It may be useful to just say "server_msg has the same meaning and behaviour as defined in Section 4.2" ... The server MUST terminate the session after sending a REPLY. * this is the only reference to a session being terminated in the document. What does it mean? Perhaps that the next REQUEST packet has to have a different session ID? If so, it would be good to say that in the REQUEST section. [Propose add a whole section, earlier in the doc, on session completion: "3= .4 Session Completion The REPLY packets defined for the packets types in the sections below (Authentication, Authorization and Accounting) contain a status field. The complete set of options for this field depend upon the packet type, but all three REPLY packet types define values representing PASS, ERROR and FAIL, which indicate the last packet of a regular session (one which is not aborted). The server responds with a PASS or a FAIL to indicate that the processing of the request completed and the client can apply the result (PASS or FAIL) to control the execution of the action which prompted the request to be sent to the server. The server responds with an ERROR to indicate that the processing of the request did not complete. The client can not apply the result and it MUST behave as if the server could not be connected to. For example, the client try alternative methods, if they are available, such as sending the request to a backup server, or using local configuration to determine whether the action which prompted the request should be executed. Refer to the section (Section 4.4.3) on Aborting Authentication Sessions for details on handling additional status options . When the session is complete, then the TCP connection should be handled as follows, according to whether Single Connect Mode was negotiated: If Single Connection Mode was not negotiated, then the connection should be closed If Single Connection Mode was enabled, then the connection SHOULD be left open (see section (Section 3.3) ), but may still be closed after a timeout period to preserve deployment resources If Single Connection Mode was enabled, but an ERROR occurred due to connection issues (such as an incorrect secret, see section (Section 3.7) ), then any further new sessions MUST NOT be accepted on the connection. If there are any sessions that have already been established then they MAY be completed. Once all active sessions are completed then the connection MUST be closed."] The TAC_PLUS_ACCT_FLAG_START flag indicates that this is a start accounting message. Start messages will only be sent once when a task is started. The TAC_PLUS_ACCT_FLAG_STOP indicates that this is a stop record and that the task has terminated. The TAC_PLUS_ACCT_FLAG_WATCHDOG flag means that this is an update record. Update records are sent at the client's discretion when the task is still running. * what's a "task" ? This is the first reference in the document to a "task". Perhaps more explanation here as to the expected use-case [Added text: "TACACS+ accounting is intended to record various types of eve= nts on clients, for example: login sessions, command entry, and others as r= equired by the client implementation. These events are collectively referr= ed to in `The Draft' [TheDraft] as "tasks"."] The START and STOP flags are mutually exclusive. When the WATCHDOG flag is set along with the START flag, it indicates that the update record is a duplicate of the original START record. * why would an update duplicate the original START record? This seems redundant. [Well, here we are constrained by a clear definition form original draft.] ... If the START flag is not set, then this indicates a minimal record indicating only that task is still running. * nit: perhaps delete "a minimal record indicating only". [Agreed] * Some more questions... * does the client retry an accounting packet if it doesn't get a response from the server? [client will get PASS or FAIL. do you mean, if the client gets a force disc= onnect for the TCP connection?] * how often do the updates get sent? Saying "implementation defined" is OK, but some recommendations would be good. i.e. not more than 100x per second, and not less than 1 day apart (as extreme examples) [so lets stick with implementation defined, the range of T+ devices we see = is so diverse and use cases are such that I would not like to constrain.] * I have similar questions about the TCP connection. What happens if a client can't connect to a server? How often should it retry? Should it treat "unable to connect" as "authentication / authorization fail"? Should the user be forbidden *all* access if the client cannot connect to the server? Should the user be given minimal access in order to be able to diagnose server connection problems? [I would say that the normal approach is to treat a failure to connect as a= n ERROR condition, so that any support failover or equivalent to method-lis= t can be followed. Frequently a device will have a local option at the end = of a method list, and this local method would contain the options for worst= case access, but I would say that this behaviour is out-of-scope of the pr= otocol description.] 7. Attribute-Value Pairs It is recommended that hosts be specified as a numeric address so as to avoid any ambiguities. * Is this IPv6 safe? I suspect not... but it should be stated [Agreed. Proposed new Text: =93It is recommended that hosts be specified as= a IP address so as to avoid any ambiguities. ASCII numeric IPV4 address a= re specified as octets separated by dots ('.'), IPV6 address text represent= ation in RFC 4291.=94] Absolute times are specified in seconds since the epoch, 12:00am Jan 1 1970. The timezone MUST be UTC unless a timezone attribute is specified. * nit: perhaps "a decimal number representing seconds since..." except what about time zones? [Agreed. Proposed new Text: =93Absolute times are specified in seconds sinc= e the epoch, 12:00am Jan 1 1970. The timezone MUST be UTC unless a timezon= e attribute is specified.=94] * how is a time zone specified? what format is the time? Examples would help here. [Agreed. Will ] * nit: the section defines numbers, booleans, hosts, and time. But no "text" type. RADIUS is just in the process of fixing this (20+ years later...), which is why I noticed [There is some description of text encoding as a whole (see below), but can= add something specific for attributes =933.6. Text Encoding All text fiel= ds in TACACS+ MUST be US-ASCII, excepting special consideration given to us= er field and data fields used for passwords.] * adding a data type to each attribute definition would be useful [Agreed] * also, it would be good to say which attributes are mandatory, and which are optional [Agreed. The list of mandatory attributes is very small, and there are some= dependencies] Attributes may be submitted with no value, in which case they consist of the name and the mandatory or optional separator. * this sounds like the separator is optional. Perhaps "... consist of the name and separator only" [Agreed, will clean to remove this dependency] 7.1. Authorization Attributes ... a protocol that is a subset of a service. An example would be any PPP NCP. * nit: expand acronyms on first use. What's a "PPP NCP" ? [Agreed, will expand] cmd a shell (exec) command. This indicates the command name for a shell command that is to be run. This attribute MUST be specified if service equals "shell". If no value is present then the shell itself is being referred to. * perhaps a bit more explanation of the use-case here. What is a "shell" in reference to an administrative management protocol? [Agreed, will add. In fact, now that T+ is not used for Network access and = only for Device Management, this could do with rather more description. Pro= posed text: =93 a shell (exec) command. This indicates the command name of the command that is to be run. The "cmd" attribute MUST be specified if service equals "shell". Authorization of shell commands is a common use-case for the TACACS+ protocol. Command Authorization generally takes one of two forms: session-based and command-based. For session-based shell authorization, the "cmd" argument will have an empty value. The client determines which commands are allowed in a session according to the arguments present in the authorization. In command-based authorization, the client requests that the server determine whether a command is allowed by making an authorization request for each command. The "cmd" argument will have the command name as its value. cmd-arg an argument to a shell (exec) command. This indicates an argument for the shell command that is to be run. Multiple cmd-arg attributes may be specified, and they are order dependent.=94 routing A boolean. ... * note that "routing" is defined to be a boolean, but the other attributes don't have data types defined. I *think* "cmd" is a textual attribute, but it's not defined that way [Agreed, along with the similar comment above] timeout an absolute timer for the connection (in minutes). A value of zero indicates no timeout. * probably "numeric" data type? [Definately] autocmd an auto-command to run. Used only when service=3Dshell and cmd=3DNULL * it's confusing to have an explicit NULL in "cmd". Perhaps quotes would clarify it here. e.g. n auto-command to run. Used only when the packet contains attribute-values of "service=3Dshell" and "cmd=3D" [Agreed. The text in comment for command should help. Proposed new Text: =93 an auto-command to run. Applicable only to session-based shell authorization.=94] noescape Boolean. ... * nit: consistent terminology. "Boolean" ? or "A boolean ..." ?? [Agreed. Or even: consistent indefinite article employment.] callback-dialstring Indicates that callback is to be done. Value is NULL, or a dialstring. A NULL value indicates that the service MAY choose to get the dialstring through other means. * nit: explicit NULL is confusing. Perhaps "value is a dial string, or when omitted, indicates that the server may choose to get the value via other means" [Agreed. Proposed Text: =93Indicates that callback is to be done. Value is= a dialstring, or empty. Empty value indicates that the service MAY choose= to get the dialstring through other means.=94] * nit: what's a "dialstring" ? * what's a callback? How does that work? [These two are rather legacy, and really related to an old form of Network = Access, so propose we can exclude] 7.2. Accounting Attributes ... The following new attributes are defined for TACACS+ accounting only. When these attribute-value pairs are included in the argument list, they will precede any attribute-value pairs that are defined in the authorization section (Section 5) above. * "will" precede? Perhaps "MUST precede" [Agreed] task_id Start and stop records for the same event MUST have matching task_id attribute values. The client must not reuse a specific task_id in a start record until it has sent a stop record for that task_id. * how big is the task_id? Since values can be omitted, is it OK to have a zero-length task_id? or 1 octet? * are there recommendations for the content of task_id? e.g. incrementing numbers, strings, etc. * is task_id mandatory to occur in accounting packets? [task_id is best practice, and I think we can promote it to mandatory, howe= ver this would be a change to spec. It is a text value (that can clearly en= code a number), but it is widely enough used that I think restricting its v= alidity would be difficult.] start_time The time the action started (). * nit: what are the brackets for? [Will update as for stop_time] stop_time The time the action stopped (in seconds since the epoch.) * which attributes are allowed in which packets? I presume it's not recommended to have a START which contains "stop_time" [other than task_id, there are no accepted standards for this mapping] elapsed_time The elapsed time in seconds for the action. Useful when the device does not keep real time. * I'd recommend removing that last sentence. it also indicates that the device may not have accurate time, notwithstanding the definition of "absolute times" at the start of Section 7. [Agreed] bytes_in The number of input bytes transferred by this action * input to where? This was poorly specified in RADIUS, and some implementations got it wrong... [Proposed text: The number of input bytes transferred by this action to the= port] * this number might be large. Should implementations allow 16 bit numbers? 32-bit? 64-bit? What are the expected / recommended limits? * i.e. implementations MUST be able to parse numbers up to 2^32, and SHOULD be able to parse numbers up to 2^64 status The numeric status value associated with the action. This is a signed four (4) byte word in network byte order. 0 is defined as success. Negative numbers indicate errors. Positive numbers indicate non-error failures. The exact status values may be defined by the client. * This is the first (and only) time that a field is defined as non-ASCII. That's very off. [I agree, however, we can change this in the follow up doc] * nit: values "may" be defined by the client? Perhaps just saying "values are implementation specific" would be better [Will update] ... Privilege Levels are ordered values from 0 to 15 with each level representing a privilege level that is a superset of the next lower value. * nit: perhaps this could be "each level is defined to be a superset of the next lower value", instead of "representing". [or even more simply: each level is a superset of the next lower value] If a client uses a different privilege level scheme, then it must map the privilege level to scheme above. * editorial :"... to A scheme..." * and how is mapping done? It might be better to just omit that sentence. Privilege Levels are applied in two ways in the TACACS+ protocol: * nit: perhaps "used" instead of "applied" - As an argument in authorization EXEC phase (when service=3Dshell and cmd=3DNULL), where it is primarily used to set the initial privilege level for the EXEC session. * how does that work? And what does it mean to set an initial privilege level? - In the packet headers for Authentication, Authorization and Accounting. The privilege level in the header is primarily significant in the Authentication phase for enable authentication where a different privilege level is required. * again, how does that work? Additional text would be useful. e.g. In typical use-cases, an administrator can perform a series of commands at a low privilege level. When additional privileges are required, the administrator can authenticate at the desired level, perform a series of commands, and the drop privilege level to the lower one. This methodology minimizes possible errors by using high privilege levels only when necessary, and using low privilege levels for most commands. * expanding on the use-case and work flow would be of great benefit. [Agreed, please see text below] The use of Privilege levels to determine session-based access to commands and resources is not mandatory for clients, but it is in common use so SHOULD be supported by servers. * and clients, presumably? Perhaps instead, say: It is RECOMMENDED that clients and servers use Privilege levels to signal and control session-based access. It is RECOMMENDED that clients permit users to change their Privilege levels, so as to ensure that commands are executed with the minimum Privilege level required. [Proposed new section: =93 The TACACS+ Protocol supports flexible authoriz= ation schemes through the extensible attributes. One scheme is built in to the protocol and has been extensively used for Session-based shell authorization: Privilege Levels. Privilege Levels are ordered values from 0 to 15 with each level is a superset of the next lower value. Configuration and implementation of the client will map actions (such as the permission to execute of specific commands) to different privilege levels. Pre-defined values ar= e: TAC_PLUS_PRIV_LVL_MAX :=3D 0x0f TAC_PLUS_PRIV_LVL_ROOT :=3D 0x0f TAC_PLUS_PRIV_LVL_USER :=3D 0x01 TAC_PLUS_PRIV_LVL_MIN :=3D 0x00 A Privilege level can be assigned to a shell (EXEC) session when it starts starts (for example, TAC_PLUS_PRIV_LVL_USER). The client will permit the actions associated with this level to be executed. This privilege level is returned by the server in a session-based shell authorization (when "service" equals "shell" and "cmd" is empty). When a user required to perform actions that are mapped to a higher privilege level, then an ENABLE type reuthentication can be initiated by the client, in a way similar to su in unix. The client will insert the required privilege level into the authentication header for enable authentication request. The use of Privilege levels to determine session-based access to commands and resources is not mandatory for clients. Although the privilege level scheme is widely supported, its lack of flexibility in requiring a single monotonic hierarchy of permissions means that other session-based command authorization schemes have evolved, and so it is no longer mandatory for clients to use it. However, it is still common enough that it SHOULD be supported by servers.=94] --_000_D54116DA23412Adcmgashciscocom_ Content-Type: text/html; charset="Windows-1252" Content-ID: Content-Transfer-Encoding: quoted-printable
Hi,

First batch of responses. This is in HTML encoding with intent to make= responses easier to see due to their colour coding. If this does not work,= please LMK, I will send a different format.

Many items are marked with just [Agree], if it seems there is a trivia= l way to adjust according to the comment.

The final batch of initial responses will be sent in a few days. All m= ay prefer to wait for final batch.

The security section will be dealt with on a separate thread.

Regards, Doug.

------

 

3.3.  Single Connect Mode

 

 

   The packet header (see below) contain= s a flag to allow sessions to be

   multiplexed on a connection.

 

* it would be good to name the flag here:

[Agreed. New Version:

"Single Connection Mode is inte= nded to improve performance by allowing

   a client to multiplex m= ultiple session on a single TCP connection.

 

   The packet header conta= ins the TAC_PLUS_SINGLE_CONNECT_FLAG used by

   the client and server t= o negotiate the use of Single Connect Mode."]<= /p>

 

   If the server sets this flag in the f= irst reply packet in response to

   the first packet from a client, this = indicates its willingness to

   support single-connection over the cu= rrent connection.  The server

   may set this flag even if the client = does not set it, but the client

   is under no obligation to honor it.

 

* what happens if the client does not honour the f= lag?

[It will close the connection after = the session completes. Update:

   "The server may se= t this flag even if the client does not

   set it, but the client = may ignore the flag and close the connection

   after the session compl= etes."]

 

   The flag is only relevant for the fir= st two packets on a connection,

   to allow the client and server to est= ablish single connection mode.

   The flag MUST be ignored after these = two packets since the single-

   connect status of a connection, once = established, must not be

   changed.  The connection must in= stead be closed and a new connection

   opened, if required.

 

  Why would it be required to change the mode= ?  It would be good to

explain the use-cases, and why (or not) they make = sense.

[We mandate it must not happen. To b= e honest, I=92m not aware of any use case for wanting to change]

 

   TAC_PLUS_UNENCRYPTED_FLAG :=3D 0x01

 

   If this flag is set, then body encryp= tion is not used.  If this flag

   is cleared, the packet is encrypted.&= nbsp; Unencrypted packets are

   intended for testing, and are not rec= ommended for normal use.

 

* it would be good to have a pointer to the securi= ty considerations, with

a discussion of the implications.

[Agreed]

 

*  Also, it's odd that a completely insecure = mode is just "not recommended

for normal use".  I would suggest more p= anic-inducing phrasing.  e.g.

."Unencrypted packets offer a complete compro= mise of all security related

to the protocol and MUST NOT be used outside of a = testing environment"

[Partial Agree: Will change to MUST = NOT, but do not want to give impression that MD5 is secure.]

 

   TAC_PLUS_SINGLE_CONNECT_FLAG :=3D 0x0= 4

 

   This flag is ussequernt, ed to allow = a client and server to agree

whether

   multiple sessions may be multiplexed = onto a single connection.

 

* I find the "agree" phrasing odd. = I've mentioned before that the tone of

the document is often philosophical.  Perhaps= saying instead "this flag

signals whether the client and server are capable = of performing session

multiplexing"

[Agree. Changed to "This flag i= s used to allow a client and server to negotiate Single

   Connection Mode."]=

 

* i.e. the flag is a signal, not a capability for = the systems to agree.

[Agree]

 

   session_id

 

   The Id for this TACACS+ session.&= nbsp; The session id is to be selected

   randomly.  This field does not c= hange for the duration of the TACACS+

   session.  (If this value is not = a cryptographically strong random

   number, it will compromise the protoc= ol's security, see  RFC 1750

 

* it would be good to update the paragraph to be m= ore prescriptive.  i.e.

[Agree, changed text to: "The I= d for this TACACS+ session.  This field does not change for the

   duration of the TACACS&= #43; session.  This number MUST be generated by a

   cryptographically stron= g random number generation method.  Failure to

   do so will compromise s= ecurity of the session.  For more details

   refer to RFC 1750 [RFC1= 750]"]

 

   The Id for this TACACS+ session.&= nbsp; The session id MUST be taken

   fro a cryptographically strong random= number generation.  If not,

   the protocol's security will be compr= omised.  See  RFC 1750

   for further information

 

...

 

   length

 

   The total length of the packet body (= not including the header).  This

   value is in network byte order. = Packets are never padded beyond this

   length.

 

* Why is the text on "padding" there?&nb= sp; The TACACS+ packets are sent over

TCP, not UDP.  So any "padding" wou= ld be outside of the scope of the

current packet, and be seen by the other end as a = subsequent, but invalid,

TACACS+ packet.

[Agree: Removed part about padding]<= /span>

 

3.5 ...

 

      - Unused fixed leng= th fields SHOULD have values of zero.

 

* what happens when they don't?  I suggest ad= ding text saying that the

fields are ignored.

[Agree, changed text to: "To si= gnal that any variable length data fields are unused, their

      lengt= h value is set to zero." As to what happens when fields are unused, th= is will depend upon the fields]

 

     - There will be no paddin= g in any of the fields or at the end of a

      packet.<= /span>

 

* I wonder again what "padding" means he= re.

[Agree, removed]

 

3.6.  Encryption

 

 

   The body of packets may be encrypted.=    ...

 

* Which is not a standard encryption method. = Security people will

complain here.  I suggest (as before) using t= he term "obfuscated".  With a

note that for historical reasons, the flags / fiel= ds / etc. refer to

TACACS+ "encryption".

[Agreed, changed generally to obfusc= ation, apart from where field names are directly referenced]

 

...  This document does not discuss the manag= ement and storage of

   those keys.  ...

 

* there should be some discussion in the Security = Considerations section

about this.  Otherwise, this subject will be = brought up in the security

review.

[Will be happy to stand corrected, b= ut that strikes me as both outside the documentation of the protocol, and l= ikely to lock in practices that will become out-of-date.]

 

  ...  It is an implementation detail of= the server and client,

   as to whether they will maintain only= one key, or a different key for

   each client or server with which they= communicate.  For security

   reasons, the latter options MUST be a= vailable, but it is a site

   dependent decision as to whether the = use of separate keys is

   appropriate.

 

* those sentences seem to disagree with each other= .  It's an

"implementation detail", but it MUST be = supported.  I suggest requiring

the capability of per-server and per-client keys.<= o:p>

[Agree, the requirements must be sup= ported by implementations, however we leave it for the implementor as to wh= ether this is used]

 

  ...   The session id is used in n= etwork byte order.

 

* nit: if the session ID is a 32-bit opaque token,= it's not in any byte

order.  Maybe just "as taken from the pa= cket header" ?

[Agree]

 

   When a server detects that the secret= (s) it has configured for the

   device mismatch, it MUST return ERROR= .  The handling of the TCP

   connection by the server is implement= ation independent.

 

* I repeat my objection here.  There is just = no reason for the TCP

connection to remain open after the connection has= been determined to be

fraudulent.  This subject also came up in the= RADIUS over TCP drafts.  The

consensus there was the same: if it's not a real /= known / good client,

there is every reason to close the connection, and= zero reasons to keep it

open.

[see next]

 

   After a packet body is decrypted, the= lengths of the component values

   in the packet are summed.  If th= e sum is not identical to the

   cleartext datalength value from the h= eader, the packet MUST be

   discarded, and an error signalled.&nb= sp; The underlying TCP connection MAY

   also be closed, if it is not being us= ed for other sessions in single-

   connect mode.

 

* This last sentence is confusing.  Are there= different secrets for

different packets in one TCP stream?  If so, = nothing in the document says

so.  If not, then there is every reason to be= lieve that the secret is

mismatched. And, the *next* packet will decrypt in= correctly.  Which means

(again) you might as well just close the TCP conne= ction.

[though we would not want to restric= t to a single secret on server for a client, we can restrict the clint that= it should us just a single secret on a client at a time for a connection to a server= . This would mean that we could not have single connect, multi session inte= raction from a client with multiple secrets so then we could close the conn= ection]<= /p>

 

   If an error must be declared but the = type of the incoming packet

   cannot be determined, a packet with t= he identical cleartext header

   but with a sequence number incremente= d by one and the length set to

   zero MUST be returned to indicate an = error.

 

* this mix of clear-text and encrypted signalling = opens up the protocol to

an attacker.  Since this "NAK'" is = not protected, an attacker can forge

the NAK at any time, and force the connection to b= e closed.

[Agree, this is probably one of the = ideas that is supported by the old spec that we can drop/ The more that we = can clean it out, the better. Will add to the list of deprecated features.]

 

* this attack (along with all others) should be no= ted in the Security

Considerations section.

 

 

...

   Packet fields are as follows:

 

   action

 

   This describes the authentication act= ion to be performed.  Legal

   values are:

 

* what happens if a client/server receives values = outside of the legal

range?  I suggest sending ERROR, and closing = the TCP connection.

[Agreed, though we have a section &q= uot;Treatment of Enumerated Protocol Values", so that we don't need to= repeat it for each item]

 

* similar comments apply for other fields with &qu= ot;legal values".  While it's

good to define what happens when things go as plan= ned, it's also good to

define what happens when things *don't* go accordi= ng to plan.

[Agreed, the section "Treatment= of Enumerated Protocol Values" should mop this all up.]

 

* review of 4.2 and subsequent sections will follo= w in a later message.

 

  Summary: the spec is still fairly descripti= ve / philosophical instead of

prescriptive.  Many optional parts of the pro= tocol are described, "A and B

are allowed", but there is often no descripti= on of what to *do* when

either A or B is present.  I've suggested des= criptive text, or places

where descriptive text can be added.

[Agreed, in general, I believe we ca= n document the positive cases, and to stipulate in one place what occurs if= values are not present in case of server, or client]

 

The larger worry here is what happens if the descr= iptive text conflicts

with existing implementations?  This is a top= ic which should be discussed

in the "Security Considerations" section= .

 

  i.e. the spec documents the existing protoc= ol, with recommendations for

security and inter-operability.  As the proto= col has historically been

poorly specified, implementations are likely to fo= llow the broad

requirements of this specification.  They are= also likely to not follow

many of the newly-clarified behaviours / requireme= nts.  The hope is that

this specification can guide implementors towards = a common understanding

of the protocol.

 

  Also, vague requirements and open options i= n a protocol spec are ripe

for implementation bugs and security issues. = That worry drives many of my

comments.

 

 

-----

 

4.2 ...

 

server_msg, server_msg_len

 

   c A message to be displayed to the us= er.  This field is optional.  If

   it exists, it is intended to be prese= nted to the user.  US-ASCII

   charset MUST be used.  The serve= r_msg_len MUST indicate the length of

   the server_msg field, in bytes.<= /o:p>

 

* The last sentence is atypical of RFC 2119 langua= ge.  Then language is

typically about system behaviour or inter-field co= mparisons.  I'm not sure

what it means that a field MUST indicate a length.=

 

* i.e. the "server_msg_len" field is *de= fined* to encode the length of the

"server_msg" field.  No "MUST&= quot; is necessary.

[Agree, will remove MUST].

 

* similar comments apply to many of the other &quo= t;foo_len" fields, elsewhere

in the document

[Will apply universally]

 

rem_addr, rem_addr_len

 

   An US-ASCII string this is a "be= st effort" description of the remote

   location from which the user has conn= ected to the client.

 

* perhaps instead of "best effort", just= re-use language from the "port"

description.  The contents of this field are = the clients description of

the remote location...

[Agree: best effort removed. Propose= d New Text: "   An US-ASCII string indicating the remote loc= ation from which the user

   has connected to the cl= ient.  It is intended to hold a network

   address if the user is = connected via a network, a caller ID is the

   user is connected via I= SDN or a POTS, or any other remote location

   information that is ava= ilable.  This field is optional (since the

   information may not be = available).  The rem_addr_len indicates the

   length of the user fiel= d, in bytes."]

 

4.4 ...

 

 

   When the REPLY status equals TAC_PLUS= _AUTHEN_STATUS_GETDATA,

   TAC_PLUS_AUTHEN_STATUS_GETUSER or TAC= _PLUS_AUTHEN_STATUS_GETPASS,

   then authentication continues and the= SHOULD provide server_msg

 

* editorial: the WHAT should provide...=

[Agreed. Answer is of course: "= server"]

 

   ... quest for more information to fle= xibly support future

   requirements.  If the TAC_PLUS_R= EPLY_FLAG_NOECHO flag is set in the

   REPLY, then the user response must no= t be echoed as it is entered.

 

* the implicit assumption here is that there is a = person who is entering

text on a terminal.  It would be good to have= a bit more explanation of

this expected use-case.

[Agreed. T+ is used in many and = varied use case, "echoed" is too restrictive, and should be repla= ced by something like "disclosed in a user interface"]

 

  NOTE: Only those requests which have change= d from their minor_version

   0 implementation (i.e.  CHAP, MS= -CHAP and PAP authentications) will

   use the new minor_version number of 1= .  All other requests (i.e.  all

   authorisation and accounting and ASCI= I authentication) MUST continue

   to use the same minor_version number = of 0.

 

* that's an odd phrasing of the requirement. = Perhaps something more

prescriptive would be useful.  e.g.:

 

  NOTE: Authentication requests which use ASC= II login or chpass MUST use

minor version 0.  Authentication requests usi= ng PAP, CHAP, or MS-CHAP MUST

  use minor version 1.  All authorizatio= n and accounting packets MUST use

minor version 0.

[Agreed: will revamp this section].<= o:p>

 

4.4.2...

 

   This section describes common authent= ication flows.  If the options

   are implemented, they MUST follow the= description.  If the server

   does not implement an option, it will= respond with

   TAC_PLUS_AUTHEN_STATUS_ERROR.

 

* It's not typically required to say that implemen= tations MUST follow the

spec.

[Agreed]

 

* also, perspective terminology is better than des= criptive. Not "will do",

but "MUST do".

[Agreed]

 

*  I suggest re-phrasing:

 

  This section describes common authenticatio= n flows.  If the server

   does not implement an option, it MUST= respond with

   TAC_PLUS_AUTHEN_STATUS_ERROR.

 

   This is a standard ASCII authenticati= on.  The START packet may

   contain the username, but need not do= so.

 

* what happens when the username is / is-not inclu= ded?  i.e. what do

implementations *do*?

[Agreed to expand. the server can of= course, finish the session at any time, as detailed in the "session t= ermination" section. But let's assume that we want the server to carry on the process, then it = will retrieve the username as described in the following proposed text: &qu= ot;The START packet MAY

   contain the username.&n= bsp; If the user does not include the username then

   the server MAY obtain i= t from the client with a CONTINUE

   TAC_PLUS_AUTHEN_STATUS_= GETUSER.  When the server has the username, it

   will obtain the passwor= d using a continue with

   TAC_PLUS_AUTHEN_STATUS_= GETPASS.  ASCII login uses the user_msg field

   for both the username a= nd password.  The data fields in both the

   START and CONTINUE pack= ets are not used for ASCII logins, any content

   MUST be ignored.  = The session is composed of a single START followed

   by zero or more pairs o= f REPLYs and CONTINUEs, followed by a final

   REPLY indicating PASS, = FAIL or ERROR."]

 

* if this is a valid protocol flow, then it should= be described.  e.g.

"Any username in the START packet is ignored&= quot;, or "any username in the

START packet MUST match the username in subsequent= packets"

[Normally, the username is in just o= ne packet]<= /p>

 

   ... The data fields in both

   the START and CONTINUE packets are no= t used for ASCII logins.

 

* what happens if there is data in the fields?&nbs= p; Is it ignored?

[Agreed From perspective of protocol= , yes]<= /p>

 

* RFC 2119 language is recommended here.  &qu= ot;any data (if present) MUST be

ignored", or "the data field MUST NOT be= present"

 

* I have no idea how to make these requirements co= mpatible with existing

implementations.  Sorry...<= /p>

[I'm not sure though, that it is rel= evant to the protocol specification.]

 

  CHAP:

 

   The length of the challenge value can= be determined from the length

   of the data field minus the length of= the id (always 1 octet) and the

   length of the response field (always = 16 octets).

 

* it would be good to recommend a minimum length f= or challenge.  1 octet

is clearly insufficient, but is (silently) allowed= by the spec.  I suggest

at least 8 octets/

[See next response]

 

* also, the challenge MUST be derived from a crypt= ographically strong

pseudo-random number generator, and MUST change on= every CHAP request.

Otherwise, the spec allows (also silently) a fixes= challenge.

[This is interesting because, of cou= rse, the challenge is not generated for T+ but for a different interact= ion. the result of that other interaction is passed along to T+. These recommendations= are good, but can we actually police this data?]

 

   To perform the authentication, the se= rver will run MD5 over the id,

   the user's secret and the challenge, = as defined in the PPP

   Authentication RFC 1334 and then comp= are that value

   with the response.<= /p>

 

* again "server WILL run".  As oppo= sed to "calculates..."

[Agreed]

 

MSCHAPv1 / MSCHAPv2:

 

   The length of the challenge value can= be determined from the length

   of the data field minus the length of= the id (always 1 octet) and the

   length of the response field (always = 49 octets).

 

*  RFC 2433 says that the challenge is 8 octe= ts.  RFC 2759 says that the

challenge is 16 octets.  It would be good to = re-iterate that here.

 

* i.e. smaller challenges are insecure, and should= be forbidden

[again, as T+ interaction is not= involved with the generation of the challenges, is this something we can a= ctually meaningfully enforce?]

 

   ... To perform the authentication, th= e server will use a the algorithm

   specified  RFC2759

 

* editorial: "specified IN RFC ..."=

[agreed]

 

... ASCII change password request

 

* I suspect that the security area review will rec= ommend that this be

removed.  Even RADIUS had "change passwo= rd" removed at the behest of the

security people.

[Noted. I take it this not a request= yet to remove though?]

 

4.4.3.  Aborting an Authentication Session

 

 

   The client may prematurely terminate = a session by setting the

   TAC_PLUS_CONTINUE_FLAG_ABORT flag in = the CONTINUE message.  If this

   flag is set, the data portion of the = message may contain an ASCII

   message explaining the reason for the= abort.

 

* again, what happens if the field is / is-not pre= sent?

[Agree, We will have a lack of infor= mation regarding the reason for the abort. this seems an obvious impact, bu= t we can add]

 

* what does the server do with this message? = Should it be logged

somewhere?

[I would say, this is out of scope o= f the protocol, and a matter for implementation]

 

... The session is

   terminated and no REPLY message is se= nt.

 

* what happens to the TCP connection?  Does i= t remain open?  It may be

good to say "The session is terminated, and t= he session Id is no longer

valid.  However, other sessions on the same T= CP connection may continue..."

[Agreed]

 

   The host is specified as either a ful= ly qualified domain name, or an

   ASCII numeric IPV4 address specified = as octets separated by dots

   ('.'), or IPV6 address test represent= ation defined in  RFC 4291.

 

* editorial ".. text .. "representation,= not "test"

[Agreed]

 

   If a key is supplied, the client MAY = use the key in order to

   authenticate to that host.  The = client may use a preconfigured key

   for the host if it has one.

 

* so the server is pushing keys to clients?  = The security implications of

this should be discussed

[SIDE Note: I think this part of the= original draft spec is really worth culling. I certainly specify it should= not be implemented in our server. I had intended to propose that is done in the next version = when we add TLS, however, am considering proposing to do this sooner unless= anyone objects.]

 

* what happens if the client gets pushed a key, an= d then also has a

pre-configured key?  Which one takes preceden= ce?  Why?

[... this is the reason why i want to cull this se= ction

 

Lets drill into these only if we decide this secti= on is worth keeping.]

 

  Continuing with 4.4.3

 

     While the order of hosts = in this packet indicates a preference, but

     the client is not obliged= to use that ordering.

 

* the use of "obliged" is unusual here.&= nbsp; Perhaps "the order used by the

client is implementation specific, and does not ha= ve to follow the order

sent by the server"

 

   If the status equals TAC_PLUS_AUTHEN_= STATUS_RESTART, then the

   authentication sequence is restarted = with a new START packet from the

   client. ...

 

* nit: it may be good to say that the next session= does not have to use

the current TCP connection

 

* "restart" may also be ambiguous. = Does the session ID change for the

next session?  It may be good to say instead = "If the status equals

TAC_PLUS_AUTHEN_STATUS_RESTART, then the client re= -authenticates with a

new session, beginning with a new START packet&quo= t;

 

...   This REPLY packet indicates that t= he current authen_type

   value (as specified in the START pack= et) is not acceptable for this

   session, but that others may be.=

 

* Which others "may" be acceptable? = ; And why "acceptable for this

session"?   is the client free to r= e-try the same authentication type in a

different session?  i.e. what does the client= *do*?

 

* perhaps say "the REPLY indicates a negative= acknowledgement that the

current authen_type is not accepted by the server.=   The client SHOULD

start a new session with a different authen_type&q= uot;

 

   If a client chooses not to accept the= TAC_PLUS_AUTHEN_STATUS_RESTART

   packet, then it is TREATED as if the = status was

   TAC_PLUS_AUTHEN_STATUS_FAIL.

 

* why uppercase "TREATED" ?

 

* why "chooses not to accept" ?  ag= ain, prescriptive is better than

philosophical

 

* Perhaps "If the client does not start a new= session after receiving a

TAC_PLUS_AUTHEN_STATUS_RESTART, it MUST behave as = if it received a

TAC_PLUS_AUTHEN_STATUS_FAIL."

[.... end of the section that should= probably be culled]

 

5.  Authorization

...

 

   The authorization REQUEST message con= tains a fixed set of fields that

   indicate how the user was authenticat= ed or processed

 

* nit: remove "or processed"<= /span>

[Agreed]

 

* from a security point of view, it's unusual for = a client to indicate to

a server how a user was authenticated.  This = allows the client to claim

authentication when none existed.

[Areed, and server can accord approp= riate confidence in this information with that proviso]

 

...

     This field matches the po= rt field in the authentication section

    (Section 4) above

 

* what is meant by "matches"?  Perh= aps "The definition of this field is

the same as in Section 4".  Or does the = field in the authorization session

have to contain the same data as the similar field= from the authentication

session?

[Agreed, the first meaning]

 

* similar comments apply for other uses of "m= atches"

 

   It is not legal for an attribute name= to contain either of the

   separators.  It is legal for att= ribute values to contain the

   separators.

 

* what are the legal characters for an attribute n= ame?  The previous

paragraph says US-ASCII.  So is "($#@!&q= uot; a legal attribute name?

[Agreed. Yes, that is a valid name, = because it does not include =3D or *. the text is explicit though, do you t= hink it needs further clarification?]

 

* a reference to Section 7 would be useful here.

[Agreed]

 

   Optional arguments are ones that may = be disregarded by either client

   or server.  Mandatory arguments = require that the receiving side

   understands the attribute and will ac= t on it.  If the client receives

   a mandatory argument that it cannot o= blige or does not understand, it

   MUST consider the authorization to ha= ve failed.

 

* "oblige" is an unusual word to use her= e.   Perhaps "If the client

receives a mandatory argument it cannot implement,= it MUST consider the

authorization to have failed"

[Agreed, we will replace "oblig= ed" and clean up]

 

5.2 The Authorization RESPONSE Packet Body

...

   server_msg, server_msg_len=

 

   This is an US-ASCII string that may b= e presented to the user.  The

   decision to present this message is c= lient specific.

 

* nit: perhaps "This field is a message from = the server to the client.

The client MAY display it to the user"

 

* saying "decision is client specific" i= s a long way of saying "the client

MAY do it", but doesn't always have to

[it was shorter J but less consistent. Agreed]

 

...

 

   The attribute-value pair that describ= es the authorization to be

   performed.  (see below),

 

* That's not clear to me.  Perhaps "if p= resent, the list of additional

authorizations permitted the user"=

[will clarify]

 

    If the status equals TAC_PLUS_A= UTHOR_STATUS_FAIL, then the

   appropriate action is to deny the use= r action.

 

* again, a bit more philosophical than prescriptiv= e.  Perhaps "If the

status equals TAC_PLUS_AUTHOR_STATUS_FAIL, then th= e requested action MUST

be denied"

[Agreed]

 

   If the status equals TAC_PLUS_AUTHOR_= STATUS_PASS_ADD, then the

   arguments specified in the request ar= e authorized and the arguments

   in the response are to be used IN ADD= ITION to those arguments.

 

* uppercase "IN ADDITION" is unusual.&nb= sp; Perhaps:

 

   If the status equals TAC_PLUS_AUTHOR_= STATUS_PASS_ADD, then the

   arguments specified in the request ar= e authorized and the client MUST

   also enforce the authorization attrib= ute-value pairs (if any) in the

response.

 

* similar comments apply here:

 

   If the status equals TAC_PLUS_AUTHOR_= STATUS_PASS_REPL then the

   arguments in the request are to be co= mpletely replaced by the

   arguments in the response.=

 

* perhaps

 

   If the status equals TAC_PLUS_AUTHOR_= STATUS_PASS_REPL then the

   client MUST use the authorization att= ribute-value pairs (if any) in the

response,

   instead of any authorization attribut= e-value pairs from the request.

 

...

 

    If the intended action is to ap= prove the authorization with no

   modifications, then the status is set= to

   TAC_PLUS_AUTHOR_STATUS_PASS_ADD and t= he arg_cnt is set to 0.

 

* should be prescriptive.  Perhaps:

 

   Servers can signal to client that the= authorization is approved with no

    modifications by setting the st= atus to

   TAC_PLUS_AUTHOR_STATUS_PASS_ADD and t= he arg_cnt is set to 0.

 

...

 

   A status of TAC_PLUS_AUTHOR_STATUS_ER= ROR indicates an error occurred

   on the server.

 

* what does the client do then?  Perhaps &quo= t;the client MAY show an error to

the user (how???), and MUST treat the response as<= o:p>

TAC_PLUS_AUTHOR_STATUS_FAIL"

 

* Also, the last sentence of the subsequent paragr= aph also talks about

ERROR, and seems misplaced.

 

6.1.  The Account REQUEST Packet Body

 

   TACACS+ accounting is very simila= r to authorization.  The packet

   format is also similar.

 

* nit: that seems redundant.  All of the pack= ets use a common format.

[The header is more consistent than = the body rather than the body, is that what you mean?]

 

  ...   There is a fixed portion an= d an extensible

   portion.  The extensible portion= uses all the same attribute-value

   pairs that authorization uses, and ad= ds several more.

 

* except that the authorization section didn't lis= t any attribute-value

pairs.  So it's hard to say that those (non-e= xistent) pairs are re-used

here

[All the attributes are in section 7= . 1 for author, 7.2 for accounting]

 

   All other fields are defined in the a= uthorization and authentication

   sections above and have the same sema= ntics.

 

* Can an accounting packet indicate an authen_type= and authen_service?  If

so, what does that mean?

[yes, indicating circumstances (if k= nown) on the device]

 

6.2.  The Accounting REPLY Packet Body

 

   The response to an accounting message= is used to indicate that the

   accounting function on the server has= completed.

 

* what does that mean?  Do servers always imp= lement "functions"?  As

background, RFC 2866 (RADIUS accounting) says:

 

...

     Upon receipt of an Accoun= ting-Request, the server MUST transmit an

      Accounting-Response= reply if it successfully records the

      accounting packet, = and MUST NOT transmit any reply if it fails to

      record the accounti= ng packet.

...

 

* perhaps similar text could be used= here.

[agreed. Text is: "  The purpose of accounting is to record the action that has occurred

&= nbsp;  on the client.  The server MUST reply with success only wh= en the

&= nbsp;  accounting request has been recorded.  If the server did n= ot record

&= nbsp;  the accounting request then it MUST reply with ERROR."= ;]

 

   ... The server will=

   reply with success only when the reco= rd has been committed to the

   required level of security,

 

* what is a "required level of security"= ?  Is that indicated in the

packet?  Elsewhere?

 

 

* my recommendation is just to delete that...=

 

   ... relieving the burden on the clien= t from

   ensuring any better form of accountin= g is required.

 

* I find that statement awkward.  Perhaps re-= using / re-phrasing text from

RFC 2866 would be good here.

[Removed this text, relying on the t= ext in the previous response]

 

6.2.  The Accounting REPLY Packet Body

 

* there's more duplication definition of fields he= re.  It may be useful to

just say "server_msg has the same meaning and= behaviour as defined in

Section 4.2"

 

  ...    The server MUST = terminate the session after sending a REPLY.

 

* this is the only reference to a session being te= rminated in the

document.  What does it mean?  Perhaps t= hat the next REQUEST packet has to

have a different session ID?  If so, it would= be good to say that in the

REQUEST section.

[Propose add a whole section, earlie= r in the doc, on session completion: "3.4 Session Completion

 

   The REPLY packets defin= ed for the packets types in the sections below

   (Authentication, Author= ization and Accounting) contain a status

   field.  The comple= te set of options for this field depend upon the

 

   packet type, but all th= ree REPLY packet types define values

   representing PASS, ERRO= R and FAIL, which indicate the last packet of

   a regular session (one = which is not aborted).

 

   The server responds wit= h a PASS or a FAIL to indicate that the

   processing of the reque= st completed and the client can apply the

   result (PASS or FAIL) t= o control the execution of the action which

   prompted the request to= be sent to the server.

 

   The server responds wit= h an ERROR to indicate that the processing of

   the request did not com= plete.  The client can not apply the result

   and it MUST behave as i= f the server could not be connected to.  For

   example, the client try= alternative methods, if they are available,

   such as sending the req= uest to a backup server, or using local

   configuration to determ= ine whether the action which prompted the

   request should be execu= ted.

 

   Refer to the section (S= ection 4.4.3) on Aborting Authentication

   Sessions for details on= handling additional status options .

 

   When the session is com= plete, then the TCP connection should be

   handled as follows, acc= ording to whether Single Connect Mode was

   negotiated:<= /span>

 

   If Single Connection Mo= de was not negotiated, then the connection

   should be closed

 

   If Single Connection Mo= de was enabled, then the connection SHOULD be

   left open (see section = (Section 3.3) ), but may still be closed after

   a timeout period to pre= serve deployment resources

 

   If Single Connection Mo= de was enabled, but an ERROR occurred due to

   connection issues (such= as an incorrect secret, see section

   (Section 3.7) ), then a= ny further new sessions MUST NOT be accepted

   on the connection. = ; If there are any sessions that have already been

   established then they M= AY be completed.  Once all active sessions are

   completed then the conn= ection MUST be closed."]

 

   The TAC_PLUS_ACCT_FLAG_START flag ind= icates that this is a start

   accounting message.  Start messa= ges will only be sent once when a

   task is started.  The TAC_PLUS_A= CCT_FLAG_STOP indicates that this is

   a stop record and that the task has t= erminated.  The

   TAC_PLUS_ACCT_FLAG_WATCHDOG flag mean= s that this is an update record.

   Update records are sent at the client= 's discretion when the task is

   still running.

 

* what's a "task" ?  This is the fi= rst reference in the document to a

"task".  Perhaps more explanation h= ere as to the expected use-case

[Added text: "TACACS+ accounting is intended to record various types of events on clients, for e= xample: login sessions, command entry, and others as required by the client= implementation.  These events are collectively referred to in `The Dr= aft' [TheDraft] as "tasks"."]

 

   The START and STOP flags are mutually= exclusive.  When the WATCHDOG

   flag is set along with the START flag= , it indicates that the update

   record is a duplicate of the original= START record.

 

* why would an update duplicate the original START= record?  This seems

redundant.

[Well, here we are constrained by a = clear definition form original draft.]

 

  ... If the START

   flag is not set, then this indicates = a minimal record indicating only

   that task is still running.

 

* nit: perhaps delete "a minimal record indic= ating only".

[Agreed]

 

* Some more questions...

 

* does the client retry an accounting packet if it= doesn't get a response

from the server?

[client will get PASS or FAIL. do yo= u mean, if the client gets a force disconnect for the TCP connection?]

 

* how often do the updates get sent?  Saying = "implementation defined" is

OK, but some recommendations would be good.  = i.e. not more than 100x per

second, and not less than 1 day apart (as extreme = examples)

[so lets stick with implementation d= efined, the range of T+ devices we see is so diverse and use cases are = such that I would not like to constrain.]

 

* I have similar questions about the TCP connectio= n.  What happens if a

client can't connect to a server?  How often = should it retry?  Should it

treat "unable to connect" as "authe= ntication / authorization fail"?

Should the user be forbidden *all* access if the c= lient cannot connect to

the server?   Should the user be given m= inimal access in order to be able

to diagnose server connection problems?=

[I would say that the normal approac= h is to treat a failure to connect as an ERROR condition, so that any suppo= rt failover or equivalent to method-list can be followed. Frequently a device will hav= e a local option at the end of a method list, and this local method would c= ontain the options for worst case access, but I would say that this behavio= ur is out-of-scope of the protocol description.]

 

7.  Attribute-Value Pairs

 

   It is recommended that hosts be speci= fied as a numeric address so as

   to avoid any ambiguities.<= /span>

 

* Is this IPv6 safe?  I suspect not... but it= should be stated

[Agreed. Proposed new Text: =93It is rec= ommended that hosts be specified as a IP address so as to avoid any ambigui= ties.  ASCII numeric IPV4 address are specified as octets separated by dots ('.'), IPV6= address text representation in RFC 4291.=94]

 

   Absolute times are specified in secon= ds since the epoch, 12:00am Jan

   1 1970.  The timezone MUST be UT= C unless a timezone attribute is

   specified.

 

* nit: perhaps "a decimal number representing= seconds since..." except

what about time zones?

[Agreed. Proposed new Text: =93Absolute = times are specified in seconds since the epoch, 12:00am Jan 1 1970.  T= he timezone MUST be UTC unless a timezone attribute is specified.=94]

 

* how is a time zone specified?  what format = is the time?  Examples would

help here.

[Agreed. Will ]

 

* nit: the section defines numbers, booleans, host= s, and time.  But no

"text" type.  RADIUS is just in the= process of fixing this (20+ years

later...), which is why I noticed

[There is some description of text encod= ing as a whole (see below), but can add something specific for attributes = =933.6.  Text Encoding All text fields in TACACS+ MUST be US-ASCII, excepting specia= l consideration given to user field and data fields used for passwords.]

 

* adding a data type to each attribute definition = would be useful

[Agreed]

 

* also, it would be good to say which attributes a= re mandatory, and which

are optional

[Agreed. The list of mandatory attribute= s is very small, and there are some dependencies]

 

   Attributes may be submitted with no v= alue, in which case they consist

   of the name and the mandatory or opti= onal separator.

 

* this sounds like the separator is optional. = ; Perhaps "... consist of the

name and separator only"

[Agreed, will clean to remove this depen= dency]

 

7.1.  Authorization Attributes

 

   ...

   a protocol that is a subset of a serv= ice.  An example would be any

   PPP NCP.

 

* nit: expand acronyms on first use.  What's = a "PPP NCP" ?

[Agreed, will expand]<= /p>

 

   cmd

 

   a shell (exec) command.  This in= dicates the command name for a shell

   command that is to be run.  This= attribute MUST be specified if

   service equals "shell".&nbs= p; If no value is present then the shell itself

   is being referred to.

 

* perhaps a bit more explanation of the use-case h= ere. What is a "shell"

in reference to an administrative management proto= col?

[Agreed, will add. In fact, now that T&#= 43; is not used for Network access and only for Device Management, this cou= ld do with rather more description. Proposed text:

=93  a shell (exec) command.  = This indicates the command name of the

   command that is to be run.&= nbsp; The "cmd" attribute MUST be specified if<= /p>

   service equals "shell&= quot;.

 

   Authorization of shell comm= ands is a common use-case for the TACACS+

   protocol.  Command Aut= horization generally takes one of two forms:

   session-based and command-b= ased.

 

   For session-based shell aut= horization, the "cmd" argument will have

   an empty value.  The c= lient determines which commands are allowed in

   a session according to the = arguments present in the authorization.

 

   In command-based authorizat= ion, the client requests that the server

   determine whether a command= is allowed by making an authorization

   request for each command.&n= bsp; The "cmd" argument will have the command

   name as its value.

 

   cmd-arg

 

   an argument to a shell (exe= c) command.  This indicates an argument

   for the shell command that = is to be run.  Multiple cmd-arg attributes

   may be specified, and they = are order dependent.=94

 

   routing

 

   A boolean. ...

 

* note that "routing" is defined to be a= boolean, but the other attributes

don't have data types defined.  I *think* &qu= ot;cmd" is a textual attribute,

but it's not defined that way

[Agreed, along with the similar comment = above]

 

   timeout

 

   an absolute timer for the connection = (in minutes).  A value of zero

   indicates no timeout.

 

* probably "numeric" data type?

[Definately]

 

   autocmd

 

   an auto-command to run.  Used on= ly when service=3Dshell and cmd=3DNULL

 

* it's confusing to have an explicit NULL in "= ;cmd".  Perhaps quotes would

clarify it here.  e.g.

 

  n auto-command to run.  Used only when= the packet contains

attribute-values of "service=3Dshell" an= d "cmd=3D"

[Agreed. The text in comment for command= should help. Proposed new Text:

=93   an auto-command to run.&= nbsp; Applicable only to session-based shell

   authorization.=94]

 

   noescape

 

   Boolean.  ...<= /p>

 

* nit: consistent terminology.  "Boolean= " ? or "A boolean ..." ??

[Agreed. Or even: consistent indefinite = article employment.]

 

   callback-dialstring=

 

   Indicates that callback is to be done= .  Value is NULL, or a

   dialstring.  A NULL value indica= tes that the service MAY choose to

   get the dialstring through other mean= s.

 

* nit: explicit NULL is confusing.  Perhaps &= quot;value is a dial string, or

when omitted, indicates that the server may choose= to get the value via

other means"

[Agreed. Proposed Text: =93Indicates tha= t callback is to be done.  Value is a dialstring, or empty.  Empt= y value indicates that the service MAY choose to get the dialstring through other means.=94]=

 

* nit: what's a "dialstring" ?

 

* what's a callback?  How does that work?

[These two are rather legacy, and really= related to an old form of Network Access, so propose we can exclude]<= /o:p>

 

7.2.  Accounting Attributes=

 

...

 

   The following new attributes are defi= ned for TACACS+ accounting only.

   When these attribute-value pairs are = included in the argument list,

   they will precede any attribute-value= pairs that are defined in the

   authorization section (Section 5) abo= ve.

 

* "will" precede?  Perhaps "MU= ST precede"

[Agreed]

 

   task_id

 

   Start and stop records for the same e= vent MUST have matching task_id

   attribute values.  The client mu= st not reuse a specific task_id in a

   start record until it has sent a stop= record for that task_id.

 

* how big is the task_id?  Since values can b= e omitted, is it OK to have a

zero-length task_id?  or 1 octet?<= /span>

 

* are there recommendations for the content of tas= k_id? e.g. incrementing

numbers, strings, etc.

 

* is task_id mandatory to occur in accounting pack= ets?

[task_id is best practice, and I think w= e can promote it to mandatory, however this would be a change to spec. It i= s a text value (that can clearly encode a number), but it is widely enough used tha= t I think restricting its validity would be difficult.]

 

   start_time

 

   The time the action started ().<= /o:p>

 

* nit: what are the brackets for?

[Will update as for stop_time]

 

   stop_time

 

   The time the action stopped (in secon= ds since the epoch.)

 

* which attributes are allowed in which packets?&n= bsp; I presume it's not

recommended to have a START which contains "s= top_time"

[other than task_id, there are no accept= ed standards for this mapping]

 

   elapsed_time

 

   The elapsed time in seconds for the a= ction.  Useful when the device

   does not keep real time.

 

* I'd recommend removing that last sentence. = it also indicates that the

device may not have accurate time, notwithstanding= the definition of

"absolute times" at the start of Section= 7.

[Agreed]

 

   bytes_in

 

   The number of input bytes transferred= by this action

 

* input to where?  This was poorly specified = in RADIUS, and some

implementations got it wrong...<= /p>

[Proposed text: The number of input byte= s transferred by this action to the port]

 

* this number might be large.  Should impleme= ntations allow 16 bit

numbers? 32-bit?  64-bit?  What are the = expected / recommended limits?

 

* i.e. implementations MUST be able to parse numbe= rs up to 2^32, and

SHOULD be able to parse numbers up to 2^64

 

 

   status

 

   The numeric status value associated w= ith the action.  This is a

   signed four (4) byte word in network = byte order. 0 is defined as

   success.  Negative numbers indic= ate errors.  Positive numbers

   indicate non-error failures.  Th= e exact status values may be defined

   by the client.

 

* This is the first (and only) time that a field i= s defined as non-ASCII.

That's very off.

[I agree, however, we can change this in= the follow up doc]

 

* nit: values "may" be defined by the cl= ient?  Perhaps just saying "values

are implementation specific" would be better<= o:p>

[Will update]

 

   ...  Privilege Levels are ordere= d values from 0 to 15

   with each level representing a privil= ege level that is a superset of

   the next lower value.

 

* nit: perhaps this could be "each level is d= efined to be a superset of

the next lower value", instead of "repre= senting".

[or even more simply: each level is a su= perset of the next lower value]

 

   If a client uses a different privileg= e level scheme, then it must map

   the privilege level to scheme above.<= o:p>

 

* editorial :"... to A scheme..."

 

* and how is mapping done?  It might be bette= r to just omit that sentence.

 

   Privilege Levels are applied in two w= ays in the TACACS+ protocol:

 

* nit: perhaps "used" instead of "a= pplied"

 

      - As an argument in= authorization EXEC phase (when service=3Dshell

      and cmd=3DNULL), wh= ere it is primarily used to set the initial

      privilege level for= the EXEC session.

 

* how does that work?  And what does it mean = to set an initial privilege

level?

 

      - In the packet hea= ders for Authentication, Authorization and

      Accounting.  T= he privilege level in the header is primarily

      significant in the = Authentication phase for enable authentication

      where a different p= rivilege level is required.

 

* again, how does that work?  Additional text= would be useful.  e.g.

 

In typical use-cases, an administrator can perform= a series of commands at

a low privilege level.  When additional privi= leges are required, the

administrator can authenticate at the desired leve= l, perform a series of

commands, and the drop privilege level to the lowe= r one.  This methodology

minimizes possible errors by using high privilege = levels only when

necessary, and using low privilege levels for most= commands.

 

* expanding on the use-case and work flow would be= of great benefit.

[Agreed, please see text below]

 

   The use of Privilege levels to determ= ine session-based access to

   commands and resources is not mandato= ry for clients, but it is in

   common use so SHOULD be supported by = servers.

 

* and clients, presumably?  Perhaps instead, = say:

 

It is RECOMMENDED that clients and servers use Pri= vilege levels to signal

and control session-based access.  It is RECO= MMENDED that clients permit

users to change their Privilege levels, so as to e= nsure that commands are

executed with the minimum Privilege level required= .

[Proposed new section: =93  The TAC= ACS+ Protocol supports flexible authorization schemes through

   the extensible attributes.<= o:p>

 

   One scheme is built in to t= he protocol and has been extensively used

   for Session-based shell aut= horization: Privilege Levels.  Privilege

   Levels are ordered values f= rom 0 to 15 with each level is a

   superset of the next lower = value.  Configuration and implementation

   of the client will map acti= ons (such as the permission to execute of

   specific commands) to diffe= rent privilege levels.  Pre-defined values are:

 

      TAC_PLUS_= PRIV_LVL_MAX :=3D 0x0f

 

      TAC_PLUS_= PRIV_LVL_ROOT :=3D 0x0f

 

      TAC_PLUS_= PRIV_LVL_USER :=3D 0x01

 

      TAC_PLUS_= PRIV_LVL_MIN :=3D 0x00

 

   A Privilege level can be as= signed to a shell (EXEC) session when it

   starts starts (for example,= TAC_PLUS_PRIV_LVL_USER).  The client will

   permit the actions associat= ed with this level to be executed.  This

   privilege level is returned= by the server in a session-based shell

   authorization (when "s= ervice" equals "shell" and "cmd" is empty).

   When a user required to per= form actions that are mapped to a higher

   privilege level, then an EN= ABLE type reuthentication can be initiated

   by the client, in a way sim= ilar to su in unix.  The client will

   insert the required privile= ge level into the authentication header

   for enable authentication r= equest.

 

   The use of Privilege levels= to determine session-based access to

   commands and resources is n= ot mandatory for clients.  Although the

   privilege level scheme is w= idely supported, its lack of flexibility

   in requiring a single monot= onic hierarchy of permissions means that

   other session-based command= authorization schemes have evolved, and

   so it is no longer mandator= y for clients to use it.  However, it is

   still common enough that it= SHOULD be supported by servers.=94]

 

 


--_000_D54116DA23412Adcmgashciscocom_-- From nobody Tue May 16 19:27:59 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B509129BE6; Tue, 16 May 2017 19:27:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.222 X-Spam-Level: X-Spam-Status: No, score=-4.222 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PjPs9lCGkHIb; Tue, 16 May 2017 19:27:57 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D8731286D6; Tue, 16 May 2017 19:24:16 -0700 (PDT) Received: from 172.18.7.190 (EHLO LHREML710-CAH.china.huawei.com) ([172.18.7.190]) by lhrrg02-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id DGT32289; Wed, 17 May 2017 02:24:14 +0000 (GMT) Received: from NKGEML411-HUB.china.huawei.com (10.98.56.70) by LHREML710-CAH.china.huawei.com (10.201.108.33) with Microsoft SMTP Server (TLS) id 14.3.301.0; Wed, 17 May 2017 03:24:13 +0100 Received: from NKGEML515-MBX.china.huawei.com ([fe80::a54a:89d2:c471:ff]) by nkgeml411-hub.china.huawei.com ([10.98.56.70]) with mapi id 14.03.0235.001; Wed, 17 May 2017 10:24:07 +0800 From: Tianran Zhou To: Alan DeKok , Ignas Bagdonas CC: "Douglas Gash (dcmgash)" , "opsawg@ietf.org" , "ops-ads@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHwlGUAgACwjQCAAF79gIADaB0AgAFZTwCAADIWAIAADS4AgAEp2vA= Date: Wed, 17 May 2017 02:24:06 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> In-Reply-To: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.111.156.116] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020201.591BB44F.0087, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 6044e24cf37685d5e22354ed573d0de6 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 May 2017 02:27:58 -0000 > -----Original Message----- > From: OPSAWG [mailto:opsawg-bounces@ietf.org] On Behalf Of Alan DeKok > Sent: Wednesday, May 17, 2017 12:23 AM > To: Ignas Bagdonas > Cc: Douglas Gash (dcmgash); opsawg@ietf.org; ops-ads@ietf.org > Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status > and Plans >=20 > On May 16, 2017, at 11:35 AM, Ignas Bagdonas wr= ote: > > > >> I don't see how reviews (which were ignored) can be construed as "n= o > evidence" that the authors were ignoring reviews. > >> > >> Which was my point. If document authors issue new revs irrespective > of what the WG suggests, the chairs should replace the authors with ones > who work towards WG consensus. > > > > No-one has seen the -07 revision yet, therefore it seems to be too earl= y > to make judgement whether comments and suggestions were or were not addre= ssed. > Authors have promised to address the raised comments discussing them on > the list and responding to previous reviews. >=20 > My comments (again) were that there was a history of ignoring the revie= ws. > At the time I made that comment, it was true. I find it troubling to see > a response saying there's "no evidence" of such a problem. =20 Hi Alan, Your reviews are appreciated. Via diff, I saw many of your comments are ref= lected in the 06 version.=20 But the authors should have discussed your comments in the mailing list and= gotten consensus on the revision. Now, they are back on the right track. See Doug's latest post. Let's back to the I-D discussion. ;-) Regards, Tianran > >> The alternative is to accept a draft as a WG document, and then to a= llow > the authors to do pretty much whatever they want, and then to rubber-stam= p > the final document as an RFC. > > > > That is not how the IETF works. I fail to see what else could be commen= ted > here. >=20 > I'm saying until I complained, that *was* largely the process being use= d > in this WG. >=20 > Alan DeKok. >=20 > _______________________________________________ > OPSAWG mailing list > OPSAWG@ietf.org > https://www.ietf.org/mailman/listinfo/opsawg From nobody Wed May 17 02:02:27 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 89A47128B88 for ; Wed, 17 May 2017 02:02:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.222 X-Spam-Level: X-Spam-Status: No, score=-4.222 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rZagwhKc0itT for ; Wed, 17 May 2017 02:02:23 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6D064129409 for ; Wed, 17 May 2017 01:57:56 -0700 (PDT) Received: from 172.18.7.190 (EHLO LHREML710-CAH.china.huawei.com) ([172.18.7.190]) by lhrrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id DNF01788; Wed, 17 May 2017 08:57:51 +0000 (GMT) Received: from NKGEML411-HUB.china.huawei.com (10.98.56.70) by LHREML710-CAH.china.huawei.com (10.201.108.33) with Microsoft SMTP Server (TLS) id 14.3.301.0; Wed, 17 May 2017 09:57:50 +0100 Received: from NKGEML514-MBX.china.huawei.com ([fe80::40a8:f0d:c0f3:2ca5]) by nkgeml411-hub.china.huawei.com ([10.98.56.70]) with mapi id 14.03.0235.001; Wed, 17 May 2017 16:57:39 +0800 From: Duzongpeng To: Tianran Zhou , "opsawg@ietf.org" Thread-Topic: [OPSAWG] LC request//RE: I-D Action: draft-ietf-opsawg-capwap-alt-tunnel-09.txt Thread-Index: AQHSzgtX+GS7jkaG6kuolOMD4c+33aH4OmCg Date: Wed, 17 May 2017 08:57:39 +0000 Message-ID: References: <149386596579.4881.15914732299692111269@ietfa.amsl.com> In-Reply-To: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.111.149.226] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020206.591C1090.007F, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 35b30b49bcfa5a528832b0be509f1d82 Archived-At: Subject: Re: [OPSAWG] LC request//RE: I-D Action: draft-ietf-opsawg-capwap-alt-tunnel-09.txt X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 May 2017 09:02:26 -0000 Hi Tianran, Thanks for your question. This draft describes the scenario that, on the date plane, the WTP is conne= cted to an AR instead of AC by using some kind of tunnel mechanisms. And th= is I-D describes several tunnel options. It will benefit the interworking o= f WTP and AC when this alt-tunnel network infrastructure is used. As far as I know, Huawei, Cisco and ALU partially implemented the proposed = solution(please correct me if my information is wrong ;-)). I.e., each of t= he vendors supports one or more tunnel types, while the full set is not nec= essary. Best Regards Zongpeng Du -----Original Message----- From: Tianran Zhou=20 Sent: Tuesday, May 16, 2017 2:12 PM To: Duzongpeng; opsawg@ietf.org Subject: RE: [OPSAWG] LC request//RE: I-D Action: draft-ietf-opsawg-capwap-= alt-tunnel-09.txt Hi Zongpeng, Thank you very much for picking this work up. The new version has a signifi= cant improvement on addressing existing comments. One more question that many people may be interested. Whether this I-D has = been implemented or has plan to be implemented and deployed? Best, Tianran > -----Original Message----- > From: OPSAWG [mailto:opsawg-bounces@ietf.org] On Behalf Of Duzongpeng > Sent: Monday, May 15, 2017 5:56 PM > To: opsawg@ietf.org > Subject: [OPSAWG] LC request//RE: I-D Action: > draft-ietf-opsawg-capwap-alt-tunnel-09.txt >=20 > Hi All, >=20 > I am happy to join the I-D draft-ietf-opsawg-capwap-alt-tunnel, and=20 > help to improve the document based on the comments received and=20 > recorded in this page > (https://datatracker.ietf.org/doc/draft-ietf-opsawg-capwap-alt-tunnel) > . >=20 > I revised the document and responded to all the existing comments as=20 > listed in the attachments. Also thanks Joe Touch's comments, which I=20 > have solved in the document. The major change include: > 1. At the security aspect, we suggest using the IPSec to protect the=20 > data tunnel between WTP and AR. > 2. Add a new sub-element, "minimum IPv6 MTU", according to the=20 > suggestion from Joe Touch. > 3. Make it clear that "IEEE 802.11 WTP Alternate Tunnel Failure Indicatio= n" > is carried in "CAPWAP Station Configuration Request message". > 4. Make it clear that we define seven sub-elements (each with its=20 > corresponding type number). Three of them are specific for CAPWAP, one=20 > is specific for GRE, and others are common ones. Make it clear that=20 > they can only be used as sub-elements of "Alternate Tunnel=20 > Encapsulations Type message element" and "IEEE 802.11 WTP Alternate=20 > Tunnel Failure Indication message element". > 5. Change the structure of the draft. Firstly, introduce the three new=20 > "message element"; secondly, introduce the three tunnel types;=20 > finnaly, introduce the seven sub-elements involved. > 6. Give more explanations to the GRE tunnel type. >=20 > Now I believe this document is ready to send to IESG. So I request for=20 > a WGLC. And I will also help to reply any comments/questions during=20 > the following procedure. >=20 > Regards, > Zongpeng >=20 > -----Original Message----- > From: OPSAWG [mailto:opsawg-bounces@ietf.org] On Behalf Of=20 > internet-drafts@ietf.org > Sent: Thursday, May 04, 2017 10:46 AM > To: i-d-announce@ietf.org > Cc: opsawg@ietf.org > Subject: [OPSAWG] I-D Action:=20 > draft-ietf-opsawg-capwap-alt-tunnel-09.txt >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts=20 > directories. > This draft is a work item of the Operations and Management Area=20 > Working Group of the IETF. >=20 > Title : Alternate Tunnel Encapsulation for Data Frames = in > CAPWAP > Authors : Rong Zhang > Rajesh S. Pazhyannur > Sri Gundavelli > Zhen Cao > Hui Deng > Zongpeng Du > Filename : draft-ietf-opsawg-capwap-alt-tunnel-09.txt > Pages : 26 > Date : 2017-05-03 >=20 > Abstract: > Control and Provisioning of Wireless Access Points (CAPWAP) defines a > specification to encapsulate a station's data frames between the > Wireless Transmission Point (WTP) and Access Controller (AC). > Specifically, the station's IEEE 802.11 data frames can be either > locally bridged or tunneled to the AC. When tunneled, a CAPWAP data > channel is used for tunneling. In many deployments encapsulating > data frames to an entity other than the AC (for example to an Access > Router (AR)) is desirable. Furthermore, it may also be desirable to > use different tunnel encapsulation modes between the WTP and the > Access Router. This document defines extension to CAPWAP protocol > for supporting this capability and refers to it as alternate tunnel > encapsulation. The alternate tunnel encapsulation allows 1) the WTP > to tunnel non-management data frames to an endpoint different from > the AC and 2) the WTP to tunnel using one of many known encapsulation > types such as IP-IP, IP-GRE, CAPWAP. The WTP may advertise support > for alternate tunnel encapsulation during the discovery and join > process and AC may select one of the supported alternate tunnel > encapsulation types while configuring the WTP. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-opsawg-capwap-alt-tunnel/ >=20 > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-opsawg-capwap-alt-tunnel-09 > https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-capwap-alt-tun > nel-09 >=20 > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-opsawg-capwap-alt-tunnel- > 09 >=20 >=20 > Please note that it may take a couple of minutes from the time of=20 > submission until the htmlized version and diff are available at tools.iet= f.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > OPSAWG mailing list > OPSAWG@ietf.org > https://www.ietf.org/mailman/listinfo/opsawg From nobody Wed May 17 08:00:20 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E3EB12EB3D; Wed, 17 May 2017 08:00:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eKZ63YZ8O2j2; Wed, 17 May 2017 08:00:15 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 4116012EB34; Wed, 17 May 2017 07:54:19 -0700 (PDT) Received: from [192.168.20.121] (CPEf4cc552207f0-CM00fc8dce0fa0.cpe.net.cable.rogers.com [99.230.129.191]) by mail.networkradius.com (Postfix) with ESMTPSA id 7B3521969; Wed, 17 May 2017 14:54:17 +0000 (UTC) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Alan DeKok In-Reply-To: Date: Wed, 17 May 2017 10:54:16 -0400 Cc: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <6B9DFA23-41BD-4896-B80C-EC0EAB51D5FD@deployingradius.com> References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> To: "Douglas Gash (dcmgash)" X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 May 2017 15:00:19 -0000 On May 16, 2017, at 4:06 PM, Douglas Gash (dcmgash) = wrote: > Many items are marked with just [Agree], if it seems there is a = trivial way to adjust according to the comment. Thanks. I'll comment on things I have comments on, and remove = everything else. > 3.5 ... > =20 > - Unused fixed length fields SHOULD have values of zero. > =20 > * what happens when they don't? I suggest adding text saying that the > fields are ignored. > [Agree, changed text to: "To signal that any variable length data = fields are unused, their > length value is set to zero." As to what happens when fields are = unused, this will depend upon the fields] I meant what happens when an unused field has a non-zero length? If the field is unused, the spec should say the field is ignored, and = treated as if it did not exist. > ... This document does not discuss the management and storage of > those keys. ... > =20 > * there should be some discussion in the Security Considerations = section > about this. Otherwise, this subject will be brought up in the = security > review. > [Will be happy to stand corrected, but that strikes me as both outside = the documentation of the protocol, and likely to lock in practices that = will become out-of-date.] The draft should also document recommended practices for how to use = the protocol, such as how keys should be managed / generated / stored. i.e. "As the security of the obfuscation method is unknown, keys = SHOULD be produced via a CSPRNG, keys SHOULD be different for every = client/server pair", etc. The original RADIUS RFC used a secret key, but didn't forbid a key of = zero length. I ran into at least one vendor who didn't allow for the = entry of secret keys, and always set it to a zero-length string. The = next rev of the RFC forbade that... > ... It is an implementation detail of the server and client, > as to whether they will maintain only one key, or a different key = for > each client or server with which they communicate. For security > reasons, the latter options MUST be available, but it is a site > dependent decision as to whether the use of separate keys is > appropriate. > =20 > * those sentences seem to disagree with each other. It's an > "implementation detail", but it MUST be supported. I suggest = requiring > the capability of per-server and per-client keys. > [Agree, the requirements must be supported by implementations, however = we leave it for the implementor as to whether this is used] The wording is awkward. Perhaps "client implementations MUST support = per-server keys, and server implementations MUST support per-client = keys". The sentence on "site dependent decision" can probably be removed. Or = maybe replaced with a suggestion that "using the same key for multiple = hosts is NOT RECOMMENDED" > * This last sentence is confusing. Are there different secrets for > different packets in one TCP stream? If so, nothing in the document = says > so. If not, then there is every reason to believe that the secret is > mismatched. And, the *next* packet will decrypt incorrectly. Which = means > (again) you might as well just close the TCP connection. > [though we would not want to restrict to a single secret on server for = a client, we can restrict the clint that it should us just a single = secret on a client at a time for a connection to a server. This would = mean that we could not have single connect, multi session interaction = from a client with multiple secrets so then we could close the = connection] I'm not sure what that means... It should say that the same key is used for the lifetime of a TCP = connection. Though the keys can be changed in between TCP connections. And, if there's a key mismatch, all bets are off, and the TCP = connection is closed. > This is a standard ASCII authentication. The START packet may > contain the username, but need not do so. > =20 > * what happens when the username is / is-not included? i.e. what do > implementations *do*? > [Agreed to expand. the server can of course, finish the session at any = time, as detailed in the "session termination" section. But let's assume = that we want the server to carry on the process, then it will retrieve = the username as described in the following proposed text: "The START = packet MAY > contain the username. If the user does not include the username = then > the server MAY obtain it from the client with a CONTINUE > TAC_PLUS_AUTHEN_STATUS_GETUSER. When the server has the username, = it > will obtain the password using a continue with > TAC_PLUS_AUTHEN_STATUS_GETPASS. ASCII login uses the user_msg = field > for both the username and password. The data fields in both the > START and CONTINUE packets are not used for ASCII logins, any = content > MUST be ignored. The session is composed of a single START = followed > by zero or more pairs of REPLYs and CONTINUEs, followed by a final > REPLY indicating PASS, FAIL or ERROR."] OK. And if there's still no username? > * if this is a valid protocol flow, then it should be described. e.g. > "Any username in the START packet is ignored", or "any username in the > START packet MUST match the username in subsequent packets" > [Normally, the username is in just one packet] > =20 > ... The data fields in both > the START and CONTINUE packets are not used for ASCII logins. > =20 > * what happens if there is data in the fields? Is it ignored? > [Agreed =46rom perspective of protocol, yes] The draft needs to say so. > * also, the challenge MUST be derived from a cryptographically strong > pseudo-random number generator, and MUST change on every CHAP request. > Otherwise, the spec allows (also silently) a fixes challenge. > [This is interesting because, of course, the challenge is not = generated for T+ but for a different interaction. the result of that = other interaction is passed along to T+. These recommendations are good, = but can we actually police this data?] That reply make implementation-specific assumptions. There are = TACACS+ implementations which don't get the challenge from a = third-party. The draft needs to state security requirements on CHAP and the = challenges. If an implementation chooses to ignore them, then the = implementation is insecure and wrong. But the protocol needs to be specified securely in the draft. > MSCHAPv1 / MSCHAPv2: > =20 > The length of the challenge value can be determined from the length > of the data field minus the length of the id (always 1 octet) and = the > length of the response field (always 49 octets). > =20 > * RFC 2433 says that the challenge is 8 octets. RFC 2759 says that = the > challenge is 16 octets. It would be good to re-iterate that here. > =20 > * i.e. smaller challenges are insecure, and should be forbidden > [again, as T+ interaction is not involved with the generation of the = challenges, is this something we can actually meaningfully enforce?] The same comments as for CHAP apply here. And no, we can't "enforce" = it, but we can demand it. Which is what the protocol specification is = about. > ... To perform the authentication, the server will use a the = algorithm > specified RFC2759 > =20 > * editorial: "specified IN RFC ..." > [agreed] > =20 > ... ASCII change password request > =20 > * I suspect that the security area review will recommend that this be > removed. Even RADIUS had "change password" removed at the behest of = the > security people. > [Noted. I take it this not a request yet to remove though?] I predict that the Security Area review will raise questions about it. If the functionality isn't really used in current practice, it would = be best to have the draft note that the functionality exists. But that = all specification of the functionality is removed from the document, and = implementations SHOULD NOT support it. e.g. "flag FOO was historical, but has been removed for security = reasons. That is all." > * what does the server do with this message? Should it be logged > somewhere? > [I would say, this is out of scope of the protocol, and a matter for = implementation] It's a useful suggestion to implementors. "This message is typically logged, which helps administrators = determine reasons for failure" > =20 > If a key is supplied, the client MAY use the key in order to > authenticate to that host. The client may use a preconfigured key > for the host if it has one. > =20 > * so the server is pushing keys to clients? The security implications = of > this should be discussed > [SIDE Note: I think this part of the original draft spec is really = worth culling. I certainly specify it should not be implemented in our = server. I had intended to propose that is done in the next version when = we add TLS, however, am considering proposing to do this sooner unless = anyone objects.] I would suggest removing it, but noting it exists, as with the = password change above. > * from a security point of view, it's unusual for a client to indicate = to > a server how a user was authenticated. This allows the client to = claim > authentication when none existed. > [Areed, and server can accord appropriate confidence in this = information with that proviso] That should be noted here, and in the Security Considerations section. > ... > This field matches the port field in the authentication section > (Section 4) above > =20 > * what is meant by "matches"? Perhaps "The definition of this field = is > the same as in Section 4". Or does the field in the authorization = session > have to contain the same data as the similar field from the = authentication > session? > [Agreed, the first meaning] The draft should be updated to clarify this. > * what are the legal characters for an attribute name? The previous > paragraph says US-ASCII. So is "($#@!" a legal attribute name? > [Agreed. Yes, that is a valid name, because it does not include =3D or = *. the text is explicit though, do you think it needs further = clarification?] It wouldn't hurt to re-iterate it. =20 > 6.1. The Account REQUEST Packet Body > =20 > TACACS+ accounting is very similar to authorization. The packet > format is also similar. > =20 > * nit: that seems redundant. All of the packets use a common format. > [The header is more consistent than the body rather than the body, is = that what you mean?] I mean it would be clearer to say "both leverage a common header, with = type-specific packets using a standard layout". > * Can an accounting packet indicate an authen_type and authen_service? = If > so, what does that mean? > [yes, indicating circumstances (if known) on the device] That should be clarified. =20 > * what's a "task" ? This is the first reference in the document to a > "task". Perhaps more explanation here as to the expected use-case > [Added text: "TACACS+ accounting is intended to record various types = of events on clients, for example: login sessions, command entry, and = others as required by the client implementation. These events are = collectively referred to in `The Draft' [TheDraft] as "tasks"."] That's still a little unclear to me, but OK. > The START and STOP flags are mutually exclusive. When the WATCHDOG > flag is set along with the START flag, it indicates that the update > record is a duplicate of the original START record. > =20 > * why would an update duplicate the original START record? This seems > redundant. > [Well, here we are constrained by a clear definition form original = draft.] What does it mean, tho? This document should say. i.e. portions of = the protocol should not be left as "we have no idea what this means". If implementors don't use / support this functionality, then the = description of it can be removed from the draft. If it is used, = implementors can speak up, and help describe what this functionality = does. =20 > * Some more questions... > =20 > * does the client retry an accounting packet if it doesn't get a = response > from the server? > [client will get PASS or FAIL. do you mean, if the client gets a force = disconnect for the TCP connection?] I mean, what happens if the client sends a packet, the TCP connection = stays open, and there's no response packet? Does the client retry? If so, when? If not, what happens? I guess similar comments should apply for accounting and = authorization... As we're not trying to extend the protocol, it may be good enough to = note that responses may not be received, and it's up to implementations = to decide what to do. > * how often do the updates get sent? Saying "implementation defined" = is > OK, but some recommendations would be good. i.e. not more than 100x = per > second, and not less than 1 day apart (as extreme examples) > [so lets stick with implementation defined, the range of T+ devices we = see is so diverse and use cases are such that I would not like to = constrain.] It would be good to have recommendations. e.g. "updates more than = once per second are NOT RECOMMEND, updates more than an hour apart are = NOT RECOMMENDED". The goal is to guide implementors to choosing values which won't cause = problems for everyone else. > * I have similar questions about the TCP connection. What happens if = a > client can't connect to a server? How often should it retry? Should = it > treat "unable to connect" as "authentication / authorization fail"? > Should the user be forbidden *all* access if the client cannot connect = to > the server? Should the user be given minimal access in order to be = able > to diagnose server connection problems? > [I would say that the normal approach is to treat a failure to connect = as an ERROR condition, so that any support failover or equivalent to = method-list can be followed. Frequently a device will have a local = option at the end of a method list, and this local method would contain = the options for worst case access, but I would say that this behaviour = is out-of-scope of the protocol description.] The draft still needs to suggest what happens when a client can't talk = to a server. Saying "treat it like an ERROR" condition" is OK. Also = "implementations may fail-over to implementation-defined backup = methods". It's bad to have the draft be silent on the topic. > * nit: what's a "dialstring" ? > =20 > * what's a callback? How does that work? > [These two are rather legacy, and really related to an old form of = Network Access, so propose we can exclude] Sounds good. > * how big is the task_id? Since values can be omitted, is it OK to = have a > zero-length task_id? or 1 octet? > =20 > * are there recommendations for the content of task_id? e.g. = incrementing > numbers, strings, etc. > =20 > * is task_id mandatory to occur in accounting packets? > [task_id is best practice, and I think we can promote it to mandatory, = however this would be a change to spec. It is a text value (that can = clearly encode a number), but it is widely enough used that I think = restricting its validity would be difficult.] It's fine to say that task_id SHOULD be in all packets. > =20 > * which attributes are allowed in which packets? I presume it's not > recommended to have a START which contains "stop_time" > [other than task_id, there are no accepted standards for this mapping] The draft should say so, then. =20 > bytes_in > =20 > The number of input bytes transferred by this action > =20 > * input to where? This was poorly specified in RADIUS, and some > implementations got it wrong... > [Proposed text: The number of input bytes transferred by this action = to the port] from the users system to the port... Pedanticism helps here. :( We weren't pedantic in RADIUS, and = multiple implementors screwed it up. Alan DeKok. From nobody Thu May 18 01:16:39 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA379129B41 for ; Thu, 18 May 2017 01:16:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, WEIRD_QUOTING=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bkKCkI0Tf3R8 for ; Thu, 18 May 2017 01:16:33 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3840F12DFE0 for ; Thu, 18 May 2017 01:11:35 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml709-cah.china.huawei.com) ([172.18.7.190]) by lhrrg02-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id DGV70885; Thu, 18 May 2017 08:11:33 +0000 (GMT) Received: from NKGEML414-HUB.china.huawei.com (10.98.56.75) by lhreml709-cah.china.huawei.com (10.201.108.32) with Microsoft SMTP Server (TLS) id 14.3.301.0; Thu, 18 May 2017 09:11:33 +0100 Received: from NKGEML515-MBX.china.huawei.com ([fe80::a54a:89d2:c471:ff]) by nkgeml414-hub.china.huawei.com ([10.98.56.75]) with mapi id 14.03.0235.001; Thu, 18 May 2017 16:11:23 +0800 From: Tianran Zhou To: "mohamed.boucadair@orange.com" , "Senthil Sivakumar (ssenthil)" , "opsawg@ietf.org" CC: Ian Farrer Thread-Topic: Comments on draft-sivakumar-yang-nat-05 Thread-Index: AQHSz65WDa6f8GzP8EyBfKDVTdvvQQ== Date: Thu, 18 May 2017 08:11:22 +0000 Message-ID: References: <72F12146-27EC-4CA1-9D42-BD367A325801@cisco.com> <787AE7BB302AE849A7480A190F8B933009E53A1B@OPEXCLILMA3.corporate.adroot.infra.ftgroup> In-Reply-To: <787AE7BB302AE849A7480A190F8B933009E53A1B@OPEXCLILMA3.corporate.adroot.infra.ftgroup> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.111.156.116] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020202.591D5735.0142, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 1633424ec6b7313d3166c7041285ea5a Archived-At: Subject: Re: [OPSAWG] Comments on draft-sivakumar-yang-nat-05 X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2017 08:16:38 -0000 SGkgTWVkIGFuZCBTZW50aGlsLA0KDQpJIGhhZCBhIGxvb2sgYXQgdGhpcyBkcmFmdCwgYW5kIGZv dW5kIHNvbWUgaXNzdWVzIHRoYXQgSSdkIGxpa2UgdG8gZGlzY3Vzcy4NCg0KUmVnYXJkcywNClRp YW5yYW4NCg0KDQoxLiBZb3UgdXNlIHRoZSB1aW50MzIgdHlwZSBpZCBhcyBrZXkgZm9yIG1hbnkg bGlzdCBvYmplY3RzLiBGb3IgZXhhbXBsZTogICANCiAgIHwgICstLXJ3IG5hdC1pbnN0YW5jZXMN CiAgIHwgICAgICstLXJ3IG5hdC1pbnN0YW5jZSogW2lkXQ0KICAgfCAgICAgICAgKy0tcncgaWQg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1aW50MzINCiAgIHwgICAgICAgICstLXJ3 IGVuYWJsZT8gICAgICAgICAgICAgICAgICAgICAgICAgICAgYm9vbGVhbg0KDQogICBJcyB0aGlz IGRlc2lnbiBmcm9tIHlvdXIgaW1wbGVtZW50YXRpb24/IEkgdGhpbmsgYSBzdHJpbmcgdHlwZSAi bmFtZSIgaXMgbW9yZSBlYXN5IHRvIHVzZS4gDQogICBGb3IgZXhhbXBsZSwgd2hlbiB3ZSBjcmVh dGUgYSBuYXQgaW5zdGFuY2UsIHdlIG1heSB0eXBlIGEgY29tbWFuZCBsaW5lIGxpa2U6IG5hdC1p bnN0YW5jZSBuYXQtbmFtZQ0KICAgVGhpcyBBQ0wgbW9kdWxlIG1pZ2h0IGJlIGFub3RoZXIgZXhh bXBsZS4gIA0KICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1u ZXRtb2QtYWNsLW1vZGVsLz9pbmNsdWRlX3RleHQ9MQ0KDQoyLiBJdCBzZWVtcyB5b3VyIElQIGFk ZHJlc3MgcG9vbCBvbmx5IHN1cHBvcnQgcHJlZml4IGRlc2NyaXB0aW9uLiBTb21lIG1vcmUgSVAg cG9vbCBkZXNjcmlwdGlvbnMgbWF5IGJlIHVzZWZ1bC4gRm9yIGV4YW1wbGUsIGRlc2NyaWJlIGEg SVAgYWRkcmVzcyBzZWN0aW9uIHVzaW5nIHRoZSBzdGFydCBJUCBhbmQgdGhlIGxlbmd0aCBvciBl bmQgSVAuIA0KICAgfCAgICAgICAgKy0tcncgZXh0ZXJuYWwtaXAtYWRkcmVzcy1wb29sKiBbcG9v bC1pZF0NCiAgIHwgICAgICAgIHwgICstLXJ3IHBvb2wtaWQgICAgICAgICAgICAgdWludDMyDQog ICB8ICAgICAgICB8ICArLS1ydyBleHRlcm5hbC1pcC1wb29sPyAgIGluZXQ6aXB2NC1wcmVmaXgN CiAgIA0KMy4gRGlkIHlvdSBjb25zaWRlciB0aGUgTkFUIHNlcnZlciBvciBkZXN0X2FkZHJlc3Mg TkFUIFNjZW5hcmlvPw0KDQo0LiBJcyB0aGlzICJwb3J0LXF1b3RhIiBzdGFuZHMgZm9yIHRoZSBu dW1iZXIgb2YgcG9ydHMgdGhhdCBjYW4gYmUgdXNlZCBieSBhIG5hdCBpbnN0YW5jZT8gQnV0IEkg ZGlkIG5vdCBmaW5kIHNvbWV0aGluZyB0byBpbmRpY2F0ZSB0aGUgcG9ydCByYW5nZS4gT3IgY291 bGQgeW91IHBsZWFzZSBzaG93IG1lPw0KDQo1LiBZb3VyIHBvcnQgY29uZmlndXJhdGlvbiBpcyBh c3NvY2lhdGVkIHdpdGggdGhlIHdob2xlIElQIGFkZHJlc3MgcG9vbCBsaXN0LiBNYXliZSBpdCdz IG1vcmUgZmxleGlibGUgaWYgd2UgY2FuIGFzc2lnbiBlYWNoIGlwIHBvb2wgd2l0aCBhIHBvcnQg cmFuZ2UuIA0KDQo2LiBIZXJlIHlvdSBjYW4gc2V0IGNvbm5lY3Rpb24tbGltaXQgYnkgc3Vic2Ny aWJlciwgdnJmLC4uLiBIb3cgYWJvdXQgYWxzbyBieSB0aGUgc2Vzc2lvbiB0eXBlLCBlLmcuIFVE UCwgVENQLCAuLi4NCiAgIHwgICAgICAgICstLXJ3IGNvbm5lY3Rpb24tbGltaXQNCiAgIHwgICAg ICAgIHwgICstLXJ3IGxpbWl0LXBlci1zdWJzY3JpYmVyPyAgIHVpbnQzMg0KICAgfCAgICAgICAg fCAgKy0tcncgbGltaXQtcGVyLXZyZj8gICAgICAgICAgdWludDMyDQogICB8ICAgICAgICB8ICAr LS1ydyBsaW1pdC1wZXItc3VibmV0PyAgICAgICBpbmV0OmlwdjQtcHJlZml4DQogICB8ICAgICAg ICB8ICArLS1ydyBsaW1pdC1wZXItaW5zdGFuY2UgICAgICB1aW50MzIgDQoNCjcuIEkgYW0gbm90 IGNsZWFyIG9uIGhvdyB0byB1c2UgdGhpcyBtYXBwaW5nIHRhYmxlLiBNeSB1bmRlcnN0YW5kaW5n IGlzIHRoaXMgaXMgdXNlZCBmb3Igc3RhdGljIG1hcHBpbmcgb25seS4NCiAgIHwgICAgICAgICst LXJ3IG1hcHBpbmctdGFibGUNCiAgIHwgICAgICAgICAgICstLXJ3IG1hcHBpbmctZW50cnkqIFtp bmRleF0NCiAgIHwgICAgICAgICAgICAgICstLXJ3IGluZGV4ICAgICAgICAgICAgICAgICAgIHVp bnQzMg0KICAgfCAgICAgICAgICAgICAgKy0tcncgdHlwZT8gICAgICAgICAgICAgICAgICAgZW51 bWVyYXRpb24NCiAgIHwgICAgICAgICAgICAgICstLXJ3IGludGVybmFsLXNyYy1hZGRyZXNzICAg IGluZXQ6aXAtYWRkcmVzcyAgIA0KDQo4LiBJbiBhbGwsIEkgdGhpbmsgaXQncyBiZXR0ZXIgdG8g ZGVzY3JpYmUgaG93IHRoaXMgbW9kdWxlIGlzIHN0cnVjdHVyZWQgYW5kIGFsc28gZ2l2ZSBzb21l IGV4YW1wbGVzIG9uIGhvdyB0byB1c2UgdGhpcyBtb2R1bGUuDQoNCg0KPiAtLS0tLU9yaWdpbmFs IE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBtb2hhbWVkLmJvdWNhZGFpckBvcmFuZ2UuY29tIFttYWls dG86bW9oYW1lZC5ib3VjYWRhaXJAb3JhbmdlLmNvbV0NCj4gU2VudDogV2VkbmVzZGF5LCBBcHJp bCAyNiwgMjAxNyA0OjE4IFBNDQo+IFRvOiBUaWFucmFuIFpob3U7IFNlbnRoaWwgU2l2YWt1bWFy IChzc2VudGhpbCk7IG9wc2F3Z0BpZXRmLm9yZw0KPiBDYzogSWFuIEZhcnJlcg0KPiBTdWJqZWN0 OiBSRTogW1NvZnR3aXJlc10gQ29tbWVudHMgb24gZHJhZnQtc2l2YWt1bWFyLXlhbmctbmF0LTA1 DQo+IA0KPiBIaSBUaWFucmFuLA0KPiANCj4gWWVzLCB3ZSB3b3VsZCBsaWtlIHRvIGhhdmUgYSBj b25zZW5zdXMgb24gdGhlIE5BVCBZQU5HIGRhdGEgbW9kZWwgYW5kIHByb2NlZWQNCj4gd2l0aCBp dHMgcHVibGljYXRpb24gaW4gb3BzYXdnLg0KPiANCj4gQ2hlZXJzLA0KPiBNZWQNCj4gDQo+ID4g LS0tLS1NZXNzYWdlIGQnb3JpZ2luZS0tLS0tDQo+ID4gRGXCoDogT1BTQVdHIFttYWlsdG86b3Bz YXdnLWJvdW5jZXNAaWV0Zi5vcmddIERlIGxhIHBhcnQgZGUgVGlhbnJhbg0KPiA+IFpob3UgRW52 b3nDqcKgOiBtZXJjcmVkaSAyNiBhdnJpbCAyMDE3IDA5OjQ2IMOAwqA6IFNlbnRoaWwgU2l2YWt1 bWFyDQo+ID4gKHNzZW50aGlsKTsgb3BzYXdnQGlldGYub3JnIE9iamV0wqA6IFJlOiBbT1BTQVdH XSBbU29mdHdpcmVzXSBDb21tZW50cw0KPiA+IG9uIGRyYWZ0LXNpdmFrdW1hci15YW5nLW5hdC0w NQ0KPiA+DQo+ID4gSSBhbSBsb29raW5nIGF0IHRoZSBZQU5HIHRyZWUuIFRoZSBvdmVyYWxsIHN0 cnVjdHVyZSBvZiB0aGlzIG1vZHVsZSBpcw0KPiA+IGNsZWFyIGFuZCBzaW1wbGUuDQo+ID4gSW4g YWRkaXRpb24gdG8gdGhlIHRleHQgaW1wcm92ZW1lbnQsIHdoYXQgZG8geW91IHdhbnQgdG8gZGlz Y3VzcyBhbmQNCj4gPiBnZXQgY29uc2Vuc3VzIHdydCB0aGUgWUFORyBkYXRhIG1vZGVsPw0KPiA+ DQo+ID4gUmVnYXJkcywNCj4gPiBUaWFucmFuDQo+ID4NCj4gPiA+IC0tLS0tT3JpZ2luYWwgTWVz c2FnZS0tLS0tDQo+ID4gPiBGcm9tOiBPUFNBV0cgW21haWx0bzpvcHNhd2ctYm91bmNlc0BpZXRm Lm9yZ10gT24gQmVoYWxmIE9mIFNlbnRoaWwNCj4gPiA+IFNpdmFrdW1hciAoc3NlbnRoaWwpDQo+ ID4gPiBTZW50OiBNb25kYXksIEFwcmlsIDI0LCAyMDE3IDk6NDQgUE0NCj4gPiA+IFRvOiBvcHNh d2dAaWV0Zi5vcmcNCj4gPiA+IFN1YmplY3Q6IFtPUFNBV0ddIEZXOiBbU29mdHdpcmVzXSBDb21t ZW50cyBvbg0KPiA+ID4gZHJhZnQtc2l2YWt1bWFyLXlhbmctbmF0LQ0KPiA+IDA1DQo+ID4gPg0K PiA+ID4gUGxlYXNlIGZpbmQgYmVsb3cgdGhlIGNvbW1lbnRzIG9uIHRoZSBkcmFmdCBmcm9tIERh biBXaW5nLCB3aG8NCj4gPiA+IGNoYWlyZWQNCj4gPiBCZWhhdmUNCj4gPiA+IFdHIGluIHRoZSBw YXN0IGFuZCBteSByZXNwb25zZSB0byBoaXMgY29tbWVudHMgT24gdGhlDQo+ID4gPiBkcmFmdC1z aXZha3VtYXItDQo+ID4geWFuZy1uYXQuDQo+ID4gPiBPcHNhd2cgY2hhaXJzIGhhZCBhc2tlZCB1 cyB0byBzZWVrIHJldmlld3MgZnJvbSBOQVQgZXhwZXJ0cy4NCj4gPiA+DQo+ID4gPiBUaGFua3MN Cj4gPiA+IFNlbnRoaWwNCj4gPiA+DQo+ID4gPiBPbiA0LzIxLzE3LCAxMDo0MiBBTSwgIlNlbnRo aWwgU2l2YWt1bWFyIChzc2VudGhpbCkiDQo+ID4gPHNzZW50aGlsQGNpc2NvLmNvbT4NCj4gPiA+ IHdyb3RlOg0KPiA+ID4NCj4gPiA+DQo+ID4gPiAgICAgU29ycnksIGl0IHRvb2sgYSB3aGlsZSB0 byBnZXQgYmFjayB0byB0aGlzLiBUaGFua3MgZm9yIHlvdXINCj4gPiBjb21tZW50cy4NCj4gPiA+ IFBsZWFzZSBzZWUgYmVsb3cgZm9yIHRoZSByZXNwb25zZXMuDQo+ID4gPg0KPiA+ID4gICAgIFRo YW5rcw0KPiA+ID4gICAgIFNlbnRoaWwNCj4gPiA+DQo+ID4gPiAgICAgT24gMi84LzE3LCAxOjE1 IFBNLCAiU29mdHdpcmVzIG9uIGJlaGFsZiBvZiBTZW50aGlsIFNpdmFrdW1hcg0KPiA+IChzc2Vu dGhpbCkiDQo+ID4gPiA8c29mdHdpcmVzLWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIHNz ZW50aGlsQGNpc2NvLmNvbT4gd3JvdGU6DQo+ID4gPg0KPiA+ID4gICAgICAgICBJIGhhZCByZWFj aGVkIG91dCB0byBEYW4gV2luZyBhbmQgc29tZSBvdGhlcnMsIGFzIHN1Z2dlc3RlZA0KPiA+ID4g YnkNCj4gPiBJYW4NCj4gPiA+IHRvIGdldCByZXZpZXdzIG9uIHRoZQ0KPiA+ID4gICAgICAgICBo dHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtc2l2YWt1bWFyLXlhbmctbmF0LTA1Lg0K PiA+ID4NCj4gPiA+ICAgICAgICAgSSBhbSBqdXN0IHBvc3RpbmcgdGhlIHJlc3BvbnNlIGZyb20g RGFuIGhlcmUsIEkgd2lsbCBhZGRyZXNzDQo+ID4gPiBoaXMgY29tbWVudHMgaW4gYSBzZXBhcmF0 ZSBlbWFpbCBhbmQgY29weSB0aGUgYWxpYXMuDQo+ID4gPg0KPiA+ID4gICAgICAgICBUaGFua3MN Cj4gPiA+ICAgICAgICAgU2VudGhpbA0KPiA+ID4NCj4gPiA+ICAgICAgICAgVXNlIGR3aW5nLWll dGZAZnVnZ2xlcy5jb20gYXMgbXkgZW1haWwgYWRkcmVzcywgdG8gZWFzZQ0KPiA+ID4gc29ydGlu Zw0KPiA+IHRoZQ0KPiA+ID4gZW1haWwgaWYgc29tZW9uZSBoYXBwZW5zIHRvIGZvbGxvdyB1cC4N Cj4gPiA+DQo+ID4gPiAgICAgICAgID4+IHdhcyBnb2luZyB0byBhc2sgeW91IGZvciBhIGZhdm9y IHRvIHJldmlldyBhIEktRCBmb3IgbWUuDQo+ID4gPiBUaGUgcmVjb21tZW5kYXRpb24gZnJvbSBP UFMgV0cgd2FzIHRvIGdldA0KPiA+ID4gICAgICAgICAgICAgPj4gU29tZSBleHBlcnQgcmV2aWV3 cyBmcm9tIEJlaGF2ZSBtZW1iZXJzLCBmaW5kaW5nIGFueQ0KPiA+IGJlaGF2ZQ0KPiA+ID4gbWVt YmVycyB3aWxsaW5nIHRvIGRvIGEgcmV2aWV3IGlzIGhhcmQgdGhlc2UgZGF5cy4NCj4gPiA+ICAg ICAgICAgICAgID4+DQo+ID4gPiAgICAgICAgICAgICA+PiBodHRwczovL3Rvb2xzLmlldGYub3Jn L2h0bWwvZHJhZnQtc2l2YWt1bWFyLXlhbmctbmF0LTA1DQo+ID4gPiAgICAgICAgICAgICA+DQo+ ID4gPiAgICAgICAgICAgICA+ICAgIE15IGNvbW1lbnRzIC0tIGRvIHlvdSB3YW50IHRoZW0gcHVi bGljIHNvbWV3aGVyZT8NCj4gPiA+ICAgICAgICAgICAgID4NCj4gPiA+ICAgICAgICAgICAgID4g ICAgMS4gV2h5IG5vdCBhbHNvIGNvdmVyIE5BVDY2IGFuZCBOUFR2Nj8gIEl0IHNlZW1zIHRoZQ0K PiA+IGRlc2lnbg0KPiA+ID4gYWxsb3dzIHRob3NlLCBidXQgdGhlIHRleHQgZG9lc24ndCBtZW50 aW9uIHRoYXQgdGhleSBjYW4gYWxzbyBiZQ0KPiA+IGV4cHJlc3NlZA0KPiA+ID4gaW4gdGhpcyBt b2RlbC4NCj4gPiA+DQo+ID4gPiAgICAgTlBUdjYgaXMgZGVmaW5pdGVseSBhIHBvc3NpYmlsaXR5 LCBJIGFtIG5vdCBzdXJlIGlmIHRoYXQgaXMNCj4gPiBzb21ldGhpbmcNCj4gPiA+IHRoYXQgbmVl ZHMgdG8gYmUgaW4gdGhpcyB5YW5nIG1vZGVsIHRob3VnaC4gTkFUNjYgaXMgYSBjYW4gb2Ygd29y bXMNCj4gPiA+IGFuZCBJIHdvdWxkIGxpa2UgdG8gc3RheSBhd2F5IGZyb20gdGhhdC4NCj4gPiA+ ICAgICBJZiBOQVQ2NiBiZWNvbWVzIGEgcmVhbGl0eSwgd2UgY291bGQgZGVmaW5lIGEgeWFuZyBt b2RlbCBmb3IgaXQNCj4gPiB0aGVuLg0KPiA+ID4gICAgICAgICAgICAgPg0KPiA+ID4gICAgICAg ICAgICAgPiAgICAyLiAiICAgQSBOQVQgZnVuY3Rpb24gY2FuIGVpdGhlciBhc3NpZ24gaW5kaXZp ZHVhbCBwb3J0DQo+ID4gPiBudW1iZXJzIG9yIHBvcnQNCj4gPiA+ICAgICAgICAgICAgID4gICAg ICAgc2V0cy4gIEJvdGggZmVhdHVyZXMgYXJlIHN1cHBvcnRlZCBpbiB0aGUgWUFORyBkYXRhDQo+ ID4gbW9kZWwuIg0KPiA+ID4gLT4gIGNhbiB5b3UgcHJvdmlkZSBjaXRhdGlvbiBvciBkZWZpbml0 aW9uIG9mICJwb3J0IHNldCI/DQo+ID4gPiAgICAgT2ssIEkgd2lsbCBhZGQgdGhlIGRlZmluaXRp b24gb2YgcG9ydCBzZXRzLg0KPiA+ID4NCj4gPiA+ICAgICAgICAgICAgID4NCj4gPiA+ICAgICAg ICAgICAgID4gICAgMy4gIiAgIFRvIGFjY29tbW9kYXRlIGRlcGxveW1lbnRzIHdoZXJlIFtSRkM2 MzAyXSBpcw0KPiA+IG5vdA0KPiA+ID4gZW5hYmxlZCwgdGhlIE5BVA0KPiA+ID4gICAgICAgICAg ICAgPiAgICAgICBmdW5jdGlvbiBjYW4gYmUgY29uZmlndXJlZCB0byBsb2cgdGhlIGRlc3RpbmF0 aW9uDQo+ID4gcG9ydA0KPiA+ID4gbnVtYmVyLiIgLT4gIHRoYXQgbG9nZ2luZyBpcyBub3QgYSAi TkFUIGZ1bmN0aW9uIiAod2hlcmVhcyB0aGUNCj4gPiA+IHByZXZpb3VzIHBhcmFncmFwaCBkb2Vz IGRlc2NyaWJlIGEgTkFUIGZ1bmN0aW9uKS4gIExvZ2dpbmcgaXMgYQ0KPiA+ID4gZnVuY3Rpb24g b2YgWUFORywgcmlnaHQ/ICBQZXJoYXBzIGluc3RlYWQgaG93IGFib3V0IHRleHQgbGlrZSAiLi4u DQo+ID4gPiB0aGlzIGRlZmluZWQgWWFuZyBtb2RlbCBjYW4gYmUgY29uZmlndXJlZCB0byAuLi4i DQo+ID4gPg0KPiA+ID4gICAgIFdlbGwsIHNlbWFudGljYWxseSwgdGhlIE5BVCBtdXN0IHByb3Zp ZGUgdGhlIGRlc3RpbmF0aW9uIHBvcnQgdG8NCj4gPiA+IGJlDQo+ID4gYWJsZQ0KPiA+ID4gdG8g bG9nIHRoZSBkZXN0aW5hdGlvbiBwb3J0LiBkcmFmdC1pZXRmLWlwZml4LW5hdC1sb2dnaW5nIHBy b3ZpZGVzDQo+ID4gPiB0aGUgdGVtcGxhdGVzIHRvIGxvZyB0aGUgZGVzdGluYXRpb24gcG9ydHMs IHRoZSBsb2dnaW5nIG9mIHRoZQ0KPiA+ID4gZGVzdGluYXRpb24NCj4gPiBwb3J0DQo+ID4gPiAg ICAgY2FuIGJlIGVuYWJsZWQgYnkgdGhlIFlhbmcgbW9kZWwuIFRoZSBpbnRlbnRpb24gb2YgdGhl IHRleHQgaGVyZQ0KPiA+ID4gaXMNCj4gPiB0bw0KPiA+ID4gZW5hYmxlIE5BVCBsb2dnaW5nIG9m IGRlc3RpbmF0aW9uIHBvcnRzIHRocm91Z2ggdGhlIFlhbmcgbW9kZWwuDQo+ID4gPg0KPiA+ID4g ICAgICAgICAgICAgPg0KPiA+ID4gICAgICAgICAgICAgPiAgICA0LiAgICAiVGhpcyBkYXRhIG1v ZGVsIGFzc3VtZXMgdGhhdCBwb29scyBvZiBJUHY0DQo+ID4gYWRkcmVzc2VzDQo+ID4gPiBjYW4g YmUNCj4gPiA+ICAgICAgICAgICAgID4gICAgICAgcHJvdmlzaW9uZWQgdG8gTkFUIGZ1bmN0aW9u LiAgVGhlc2UgcG9vbHMgbWF5IGJlDQo+ID4gPiBjb250aWd1b3VzIG9yIG5vbi0NCj4gPiA+ICAg ICAgICAgICAgID4gICAgICAgY29udGlndW91cy4iDQo+ID4gPiAgICAgICAgICAgICA+DQo+ID4g PiAgICAgICAgICAgICA+ICAgIEZpcnN0IHNlbnRlbmNlIGRvZXMgbm90IHJlYWQgd2VsbCwgd291 bGQgYmUgaW1wcm92ZWQNCj4gPiB3aXRoDQo+ID4gPiAiLi4uIGNhbiBiZSBwcm92aXNpb25lZCB0 byAqdGhlKiBOQVQgZnVuY3Rpb24iLiAgQWxzbywgcGxlYXNlDQo+ID4gPiBwcm92aWRlIGRlc2Ny aXB0aW9uIG9yIGNpdGF0aW9uIHRvIHdoYXQgaXMgbWVhbnQgYnkgInBvb2wiLg0KPiA+ID4gICAg IEkgYWdyZWUsIEkgcmVwaHJhc2UgdGhlIGZpcnN0IHNlbnRlbmNlIGFzIGZvbGxvd3M6DQo+ID4g PiAgICAg4oCcVGhpcyBkYXRhIG1vZGVsIGFzc3VtZXMgdGhhdCBhIGJsb2NrIG9mIElQdjQgZ2xv YmFsIGFkZHJlc3Nlcw0KPiA+ID4gY2FuDQo+ID4gYmUNCj4gPiA+IHByb3Zpc2lvbmVkIHRvIHRo ZSBOQVQgZnVuY3Rpb24u4oCdDQo+ID4gPg0KPiA+ID4gICAgICAgICAgICAgPg0KPiA+ID4gICAg ICAgICAgICAgPiAgICA1LiAiQSBOQVQgZGV2aWNlIGNhbiBlbmFibGVkIG11bHRpcGxlIE5BVCBp bnN0YW5jZXM7Ig0KPiA+ID4gICAgICAgICAgICAgPg0KPiA+ID4gICAgICAgICAgICAgPiAgICBk b2VzIG5vdCByZWFkIHdlbGwuDQo+ID4gPg0KPiA+ID4gICAgIFllcywgYWdyZWVkLiBXaWxsIHJl cGhyYXNlIGFzOg0KPiA+ID4gICAgIOKAnEEgc2luZ2xlIE5BVCBkZXZpY2UgY2FuIGhhdmUgbXVs dGlwbGUgTkFUIGluc3RhbmNlczsiDQo+ID4gPiAgICAgICAgICAgICA+DQo+ID4gPiAgICAgICAg ICAgICA+ICAgIDYuICIgICBvICBFeGNsdWRlL2luY2x1ZGUgcG9ydHMgKGUuZy47IHN5c3RlbSBw b3J0KQ0KPiA+IGZyb20gdGhlDQo+ID4gPiBwb3J0IGFzc2lnbm1lbnQNCj4gPiA+ICAgICAgICAg ICAgID4gICAgICAgICAgcG9vbC4iDQo+ID4gPiAgICAgICAgICAgICA+DQo+ID4gPiAgICAgICAg ICAgICA+ICAgIE5pdDogVGhhdCBzaG91bGQgYmUgInN5c3RlbSBwb3J0UyIgKHBsdXJhbCkuDQo+ ID4gPg0KPiA+ID4gICAgIE9rLg0KPiA+ID4gICAgICAgICAgICAgPg0KPiA+ID4gICAgICAgICAg ICAgPiAgICBTZXJpb3VzOiAgdGhhdCBpcyBhIHNpZ25pZmljYW50IGRlZmljaWVuY3kuDQo+ID4g PiAgICAgVGhlIHJlYXNvbiBJIHRoaW5rIGl0IHdhcyBleGNsdWRlZCB3YXMgdGhhdCwgaXQgY29t ZXMgd2l0aA0KPiA+IHNpZ25pZmljYW50DQo+ID4gPiBjb21wbGV4aXR5IGFuZCBtb3N0IG9mIHRo ZQ0KPiA+ID4gICAgIE5BVCBpbXBsZW1lbnRhdGlvbnMgZG9u4oCZdCBoYXZlIGV4cGxpY2l0IGNv bmZpZ3VyYXRpb24gdG8gYWxsb3cNCj4gPiA+IHRoaXMgYmVoYXZpb3IuIFdlIHdpbGwgZGlzY3Vz cyB0aGlzIGFtb25nIHRoZSBhdXRob3JzIGFuZA0KPiA+ID4gICAgIFNlZSB3aGF0IGlzIHRoZSBi ZXN0IHdheSB0byBhZGRyZXNzIHRoaXMuDQo+ID4gPiAgICAgICAgICAgICA+DQo+ID4gPiAgICAg ICAgICAgICA+ICAgIDcuICJEZXRlcm1pbmlzdGljIE5BVCBhc3NpZ25tZW50IHNjaGVtZSIgLT4g cHJvdmlkZQ0KPiA+ID4gZGVzY3JpcHRpb24gb3IgY2l0YXRpb24gYWJvdXQgd2hhdCB0aGF0IG1l YW5zLg0KPiA+ID4gICAgICAgICAgICAgPg0KPiA+ID4gICAgIE9rLg0KPiA+ID4gICAgICAgICAg ICAgPiAgICA4LiAibW9kdWxlOiBpZXRmLW5hdA0KPiA+ID4gICAgICAgICAgICAgPiAgICAgICAr LS1ydyBuYXQtY29uZmlnDQo+ID4gPiAgICAgICAgICAgICA+ICAgICAgIHwgICstLXJ3IG5hdC1p bnN0YW5jZXMNCj4gPiA+ICAgICAgICAgICAgID4gICAgICAgfCAgICAgKy0tcncgbmF0LWluc3Rh bmNlKiBbaWRdDQo+ID4gPiAgICAgICAgICAgICA+ICAgICAgIHwgICAgICAgICstLXJ3IGlkDQo+ ID4gdWludDMyDQo+ID4gPiAgICAgICAgICAgICA+ICAgICAgIHwgICAgICAgICstLXJ3IGVuYWJs ZT8NCj4gPiBib29sZWFuDQo+ID4gPiAgICAgICAgICAgICA+ICAgICAgIHwgICAgICAgICstLXJ3 IGV4dGVybmFsLWlwLWFkZHJlc3MtcG9vbCogW3Bvb2wtaWRdDQo+ID4gPiAgICAgICAgICAgICA+ ICAgICAgIHwgICAgICAgIHwgICstLXJ3IHBvb2wtaWQgICAgICAgICAgICAgdWludDMyDQo+ID4g PiAgICAgICAgICAgICA+ICAgICAgIHwgICAgICAgIHwgICstLXJ3IGV4dGVybmFsLWlwLXBvb2w/ ICAgaW5ldDppcHY0LQ0KPiA+IHByZWZpeCINCj4gPiA+ICAgICAgICAgICAgID4NCj4gPiA+ICAg ICAgICAgICAgID4gICAgSG93IGlzIElQdjYgZXhwcmVzc2VkIGZvciBOQVQ2ND8NCj4gPiA+DQo+ ID4gPiAgICAgVGhlIGFkZHJlc3MgcG9vbCBpcyBhbHdheXMgYSBJUHY0IGdsb2JhbCBhZGRyZXNz IHBvb2wgd2hldGhlciBpcw0KPiA+IE5BVDY0DQo+ID4gPiBvciBOQVQ0NC4NCj4gPiA+ICAgICBU aGlzIGlzIHRoZSBhZGRyZXNzIGJsb2NrIGZyb20gd2hpY2ggdGhlIHNvdXJjZSBpcyB0cmFuc2xh dGVkIHRvLg0KPiA+IFRoaXMNCj4gPiA+IGNvbmZpZ3VyYXRpb24gYXBwbGllcw0KPiA+ID4gICAg IFRvIGJvdGggTkFUNjQgYW5kIE5BVDQ0IGFuZCBoZW5jZSBubyBkaXN0aW5jdGlvbiBpcyByZXF1 aXJlZC4NCj4gPiA+ICAgICAgICAgICAgID4NCj4gPiA+ICAgICAgICAgICAgID4NCj4gPiA+ICAg ICAgICAgICAgID4gICAgOS4gICIgICB8ICAgICAgICArLS1ydyBzdWJzY3JpYmVyLW1hc2stdjY/ DQo+ID4gPiB1aW50OA0KPiA+ID4gICAgICAgICAgICAgPiAgICAgICB8ICAgICAgICArLS1ydyBz dWJzY3JpYmVyLW1hc2stdjQqIFtzdWItbWFzay1pZF0NCj4gPiA+ICAgICAgICAgICAgID4gICAg ICAgfCAgICAgICAgfCAgKy0tcncgc3ViLW1hc2staWQgICAgdWludDMyDQo+ID4gPiAgICAgICAg ICAgICA+ICAgICAgIHwgICAgICAgIHwgICstLXJ3IHN1Yi1tYXNrICAgICAgIGluZXQ6aXB2NC1w cmVmaXgiDQo+ID4gPiAgICAgICAgICAgICA+DQo+ID4gPiAgICAgICAgICAgICA+ICAgIFdoeSBh cmUgSVB2NiBtYXNrcyBleHByZXNzZWQgZGlmZmVyZW50bHkgdGhhbiBJUHY0DQo+ID4gbWFzaz8N Cj4gPiA+DQo+ID4gPiAgICAgVGhlIHN1YnNjcmliZXItbWFzay12NiBpcyBkZXNjcmliZWQgaW4g dGhlIGxhdGVyIHBhcnQgb2YgdGhlDQo+ID4gZG9jdW1lbnQNCj4gPiA+IGFuZCBpdCB3YXMgdGhv dWdodCBvZiBoYXZpbmcgYSBzaW5nbGUgbWFzayB2YWx1ZSB0aGF0IGNhbiBiZSB1c2VkDQo+ID4g PiAgICAgdG8gYXBwbHkgdG8gZGV0ZXJtaW5lIGlmIHRoZSBwYWNrZXQgbmVlZCB0byBiZSB0cmFu c2xhdGVkIG9yDQo+ID4gPiBub3QuIFdlIHRob3VnaHQgaXQgd291bGQgc2ltcGxpZnkgdGhlIGNv bmZpZ3VyYXRpb24uIEJ1dCB0aGlua2luZw0KPiA+ID4gYWJvdXQgaXQNCj4gPiBhZ2FpbiwNCj4g PiA+ICAgICBJIHRoaW5rIHNvbWUgb2YgdGhlIGltcGxlbWVudGF0aW9ucyBvZiBOQVQ2NCBkb27i gJl0IHVuZGVyc3RhbmQgYW4NCj4gPiBpbnRlZ2VyDQo+ID4gPiBhcyBhIG1hc2sgYnV0IHRoZXkg bmVlZCB0aGUgd2hvbGUgaXB2Ni1wcmVmaXguIEkgYW0gZ29pbmcgdG8gZGlzY3Vzcw0KPiA+ID4g ICAgIFRoaXMgd2l0aCB0aGUgYXV0aG9ycyBhbmQgY2hhbmdlIHRoaXMgdG8gaXB2Ni1wcmVmaXgu IEF0IHRoZQ0KPiA+ID4gbGVhc3QsDQo+ID4gd2UNCj4gPiA+IHdpbGwgaGF2ZSBlaXRoZXIgYSBw cmVmaXggb3IgYW4gaW50ZWdlciB0byByZXByZXNlbnQgdGhlIG1hc2sgbGVuZ3RoLg0KPiA+ID4g ICAgICAgICAgICAgPg0KPiA+ID4gICAgICAgICAgICAgPiAgICBJcyAic3Vic2NyaWJlciIgdGhl IHNhbWUgYXMgImludGVybmFsIj8gIEkgbWVhbiwgdGhpcw0KPiA+IHdob2xlDQo+ID4gPiBZYW5n IG1vZGVsIHNlZW1zIHRvIHVzZSAic3Vic2NyaWJlciIgYW5kICJleHRlcm5hbCIsIHJhdGhlciB0 aGFuDQo+ID4gImludGVybmFsIg0KPiA+ID4gYW5kICJleHRlcm5hbCIuICBXaGF0IGlmIHRoZSAi aW50ZXJuYWwiIHNpZGUgaXNuJ3QNCj4gPiA+ICIiInN1YnNjcmliZXJzIiIiLA0KPiA+IHN1Y2gN Cj4gPiA+IGFzIGEgTkFUIGluIGZyb250IG9mIGEgZGF0YWNlbnRlciwgbGlrZSBhIE5BVDY0IGlu IGZyb250IG9mIGFuDQo+ID4gPiBJUHY2LW9ubHkgZGF0YWNlbnRlciwgb3IgYSBOQVQ0NCBpbiBm cm9udCBvZiBhbiBJUHY0LW9ubHkNCj4gPiA+IGRhdGFjZW50ZXI7IGluIHRoYXQgY2FzZSB0aGUg InN1YnNjcmliZXIiIGlzIG5vdyBjb25mdXNpbmdseSB0aGUgc2VydmVyLg0KPiA+ID4NCj4gPiA+ ICAgICBTdWJzY3JpYmVyIGRvZXMgaW1wbHkgaW50ZXJuYWwuIEkgd2lsbCBhZGQgc29tZSB0ZXh0 IGFyb3VuZCB0aGlzDQo+ID4gPiB0bw0KPiA+IGNsYXJpZnkNCj4gPiA+IHdoYXQgc3Vic2NyaWJl cnMgbWVhbiBoZXJlLiBJZiBhbGwgdGhlIGF1dGhvcnMgYWdyZWUsIEkgd2lsbCBjaGFuZ2UNCj4g PiA+IGl0DQo+ID4gdG8NCj4gPiA+IGludGVybmFsIGFuZCBleHRlcm5hbCwgcmF0aGVyIHRoYW4g c3Vic2NyaWJlciBhbmQgZXh0ZXJuYWwuDQo+ID4gPiAgICAgICAgICAgICA+DQo+ID4gPiAgICAg ICAgICAgICA+DQo+ID4gPiAgICAgICAgICAgICA+ICAgIDEwLiAgICAgfCAgICAgICAgKy0tcncg cG9ydC1yYW5kb21pemF0aW9uLWVuYWJsZT8NCj4gPiA+IGJvb2xlYW4NCj4gPiA+ICAgICAgICAg ICAgID4gICAgICAgfCAgICAgICAgKy0tcncgcG9ydC1wcmVzZXJ2YXRpb24tZW5hYmxlPw0KPiA+ IGJvb2xlYW4NCj4gPiA+ICAgICAgICAgICAgID4NCj4gPiA+ICAgICAgICAgICAgID4gICAgYm90 aCBvZiB0aG9zZSBjb3VsZCBiZSBzZXQgdG8gVFJVRSwgY3JlYXRpbmcNCj4gPiBvcHBvcnR1bml0 eSBmb3INCj4gPiA+IGNvbmZpZ3VyYXRpb24gYW5kIGltcGxlbWVudGF0aW9uIGNvbmZsaWN0LCBj cmVhdGluZyBpbnRlcm9wZXJhYmlsaXR5DQo+ID4gPiBwcm9ibGVtcy4gIENhbiB5b3UgaW5zdGVh ZCBkZWZpbmUgYSB0cmluYXJ5IHZhbHVlLCBvciBkb2VzIFlhbmcgbGlrZQ0KPiA+ID4gdG8NCj4g PiBoYXZlDQo+ID4gPiBib29sZWFucyBzbyBtdWNoLCBldmVuIHdoZW4gdGhleSBjYW4gY2F1c2Ug aW50ZXJvcCBwcm9ibGVtcz8NCj4gPiA+DQo+ID4gPiAgICAgSSB3aWxsIGRpc2N1c3MgdGhpcyB3 aXRoIHRoZSBhdXRob3JzIGFuZCBhZGRyZXNzIHRoaXMuIEkgZG9u4oCZdA0KPiA+ID4ga25vdw0K PiA+IGlmDQo+ID4gPiB3ZSBjYW4gcmVwcmVzZW50IHRoaXMgbW9yZSBlZmZpY2llbnRseS4NCj4g PiA+ICAgICAgICAgICAgID4NCj4gPiA+ICAgICAgICAgICAgID4gICAgMTEuICAgIHwgICAgICAg ICstLXJ3IHVkcC10aW1lb3V0cz8NCj4gPiB1aW50MzINCj4gPiA+ICAgICAgICAgICAgID4NCj4g PiA+ICAgICAgICAgICAgID4gICAgSGF2ZSB5b3UgY29uc2lkZXJlZCBwZXItcG9ydCB0aW1lb3V0 cz8gIFNvbWUgTkFUcyBhcmUNCj4gPiA+IGNvbmZpZ3VyYWJsZSB3aXRoIHNob3J0IHRpbWVvdXRz IGZvciBjZXJ0YWluIHBvcnRzLCBzdWNoIGFzIDEwDQo+ID4gPiBzZWNvbmRzDQo+ID4gb24NCj4g PiA+IHBvcnQgNTMgKEROUykgYW5kIE5UUCAoMTIzKSBhbmQgbG9uZ2VyIHRpbWVvdXRzIG9uIG90 aGVyIHBvcnRzLg0KPiA+ID4gVGhpcw0KPiA+IFlhbmcNCj4gPiA+IG1vZGVsIGRvZXNuJ3QgYWxs b3cgdGhhdC4gIFNlZW1zIGEgcG9ydCBsaXN0IG1pZ2h0IGJlIGJldHRlciB0bw0KPiA+ID4gaGFu ZGxlDQo+ID4gc3VjaA0KPiA+ID4gY29uZmlndXJhdGlvbnMuDQo+ID4gPg0KPiA+ID4gICAgIEdv b2QgcG9pbnQuIEkgd2lsbCBhZGQgdGhlIHBlci1wb3J0IHRpbWVvdXRzIHdpdGggYSBsaXN0Lg0K PiA+ID4gICAgICAgICAgICAgPg0KPiA+ID4gICAgICAgICAgICAgPiAgICAxMi4gSSBub3RpY2Vk IHRoZXJlIGlzbid0IGFueSByZWZlcmVuY2UgaW4gdGhlIHRleHQgdG8NCj4gPiBSRkM3ODU3LA0K PiA+ID4gd2hpY2ggdXBkYXRlcyBhbmQgY2xhcmlmaWVzIGEgbG90IG9mIHRoaW5ncy4gIElzIHRo ZSBZYW5nIG1vZGVsDQo+ID4gY29tcGxpYW50DQo+ID4gPiB3aXRoIHRoZSBjaGFuZ2VzIGNhdXNl ZCBieSBSRkM3ODU3PyAgVGhlIHRleHQgc2hvdWxkIGNlcnRhaW5seSBjaXRlDQo+ID4gPiBpdA0K PiA+IHdoZXJlDQo+ID4gPiBpdCBtYWtlcyBzZW5zZSwgYnV0IG1vcmUgaW1wb3J0YW50bHkgaWYg YWRkaXRpb25hbCBzZXR0aW5ncyBhcmUNCj4gPiA+IHJlcXVpcmVkIGJ5IFJGQzc4NTcsIHRoZXkg bmVlZCB0byBiZSBwYXJ0IG9mIHRoZSB5YW5nIG1vZGVsLg0KPiA+ID4gICAgICAgICAgICAgPg0K PiA+ID4NCj4gPiA+ICAgICBJIGJlbGlldmUgaXQgaXMgY29tcGxpYW50LCBJIHdpbGwgdGFsayB0 byBNZWQgYW5kIG1ha2Ugc3VyZSB3ZQ0KPiA+ID4gYXJlDQo+ID4gY292ZXJlZA0KPiA+ID4gaGVy ZS4NCj4gPiA+DQo+ID4gPiAgICAgICAgICAgICA+ICAgIDEzLiAgICB8ICAgICAgICArLS1ydyBs b2dnaW5nLWluZm8NCj4gPiA+ICAgICAgICAgICAgID4gICAgICAgfCAgICAgICAgfCAgKy0tcncg ZGVzdGluYXRpb24tYWRkcmVzcyAgICBpbmV0OmlwdjQtDQo+ID4gcHJlZml4DQo+ID4gPiAgICAg ICAgICAgICA+ICAgICAgIHwgICAgICAgIHwgICstLXJ3IGRlc3RpbmF0aW9uLXBvcnQgICAgICAg aW5ldDpwb3J0LQ0KPiA+IG51bWJlcg0KPiA+ID4gICAgICAgICAgICAgPg0KPiA+ID4gICAgICAg ICAgICAgPiAgICB0aGlzIGRvZXNuJ3QgaW5kaWNhdGUgVURQIG9yIFRDUCwgYW5kIGRvZXNuJ3Qg c2VlbSBhYmxlDQo+ID4gdG8NCj4gPiA+IGxvZyBJQ01QIG9yIG90aGVyIHByb3RvY29scyB0aGF0 IGxhY2sgcG9ydHMsIHdoaWNoIE5BVHMgbWlnaHQgTkFUDQo+ID4gPiAoZS5nLiwgSVBzZWMgRVNQ IHByb3RvY29sIDUwKS4gIFNob3VsZCBiZSBoaWdobGlnaHRlZCBpbiBzZWN1cml0eQ0KPiA+IGNv bnNpZGVyYXRpb25zLg0KPiA+ID4gICAgIE9rLg0KPiA+ID4gICAgICAgICAgICAgPg0KPiA+ID4g ICAgICAgICAgICAgPiAgICAxNC4gICAgfCAgICAgICAgKy0tcncgY29ubmVjdGlvbi1saW1pdA0K PiA+ID4gICAgICAgICAgICAgPiAgICAgICB8ICAgICAgICB8ICArLS1ydyBsaW1pdC1wZXItc3Vi c2NyaWJlcj8gICB1aW50MzINCj4gPiA+ICAgICAgICAgICAgID4gICAgICAgfCAgICAgICAgfCAg Ky0tcncgbGltaXQtcGVyLXZyZj8gICAgICAgICAgdWludDMyDQo+ID4gPiAgICAgICAgICAgICA+ ICAgICAgIHwgICAgICAgIHwgICstLXJ3IGxpbWl0LXBlci1zdWJuZXQ/DQo+ID4gPiBpbmV0Omlw djQtcHJlZml4DQo+ID4gPiAgICAgICAgICAgICA+DQo+ID4gPiAgICAgICAgICAgICA+ICAgIENh biBvbmx5IGxpc3Qgb25lIHN1Ym5ldD8NCj4gPiA+ICAgICAgICAgICAgID4NCj4gPiA+ICAgICBZ ZXMsIGl0IGlzIGEgcGVyLXN1Ym5ldCBiYXNpcyBhbmQgb3B0aW9uYWwuDQo+ID4gPg0KPiA+ID4g ICAgICAgICAgICAgPiAgICBUaGlzIGRvZXNuJ3QgYWxsb3cgZGlmZmVyZW50IGxpbWl0cyBwZXIg VlJGIChlLmcuLCBWUkYNCj4gPiAxIGlzDQo+ID4gPiBsaW1pdGVkIHRvIDEwMCBtYXBwaW5ncywg VlJGIDIgaXMgbGltaXRlZCB0byA1NTU1IG1hcHBpbmdzKS4gIFNlZW1zDQo+ID4gPiByZXN0cmlj dGl2ZS4NCj4gPiA+ICAgICAgICAgICAgID4NCj4gPiA+ICAgICBPaywgd2Ugd2lsbCBkaXNjdXNz IHRoaXMgYWdhaW4gYW5kIGRlY2lkZSBpZiB0aGVzZSBzaG91bGQgYmUgYW4NCj4gPiBhcnJheQ0K PiA+ID4gb2YgbGltaXRzLg0KPiA+ID4NCj4gPiA+ICAgICAgICAgICAgID4gICAgMTUuICAgIHwg ICAgICAgICstLXJ3IGZ0cC1hbGctZW5hYmxlPw0KPiA+ID4gYm9vbGVhbg0KPiA+ID4gICAgICAg ICAgICAgPiAgICAgICB8ICAgICAgICArLS1ydyBkbnMtYWxnLWVuYWJsZT8NCj4gPiBib29sZWFu DQo+ID4gPiAgICAgICAgICAgICA+ICAgICAgIHwgICAgICAgICstLXJ3IHRmdHAtYWxnLWVuYWJs ZT8NCj4gPiBib29sZWFuDQo+ID4gPiAgICAgICAgICAgICA+ICAgICAgIHwgICAgICAgICstLXJ3 IG1zcnBjLWFsZy1lbmFibGU/DQo+ID4gYm9vbGVhbg0KPiA+ID4gICAgICAgICAgICAgPiAgICAg ICB8ICAgICAgICArLS1ydyBuZXRiaW9zLWFsZy1lbmFibGU/DQo+ID4gYm9vbGVhbg0KPiA+ID4g ICAgICAgICAgICAgPiAgICAgICB8ICAgICAgICArLS1ydyByY21kLWFsZy1lbmFibGU/DQo+ID4g Ym9vbGVhbg0KPiA+ID4gICAgICAgICAgICAgPiAgICAgICB8ICAgICAgICArLS1ydyBsZGFwLWFs Zy1lbmFibGU/DQo+ID4gYm9vbGVhbg0KPiA+ID4gICAgICAgICAgICAgPiAgICAgICB8ICAgICAg ICArLS1ydyBzaXAtYWxnLWVuYWJsZT8NCj4gPiBib29sZWFuDQo+ID4gPiAgICAgICAgICAgICA+ ICAgICAgIHwgICAgICAgICstLXJ3IHJ0c3AtYWxnLWVuYWJsZT8NCj4gPiBib29sZWFuDQo+ID4g PiAgICAgICAgICAgICA+ICAgICAgIHwgICAgICAgICstLXJ3IGgzMjMtYWxnLWVuYWJsZT8NCj4g PiBib29sZWFuDQo+ID4gPiAgICAgICAgICAgICA+ICAgICAgIHwgICAgICAgICstLXJ3IGFsbC1h bGdzLWVuYWJsZT8NCj4gPiBib29sZWFuDQo+ID4gPiAgICAgICAgICAgICA+DQo+ID4gPiAgICAg ICAgICAgICA+ICAgIE9NRy4gIEFMR3MsIHJlYWxseT8gIERvIHRob3NlIG5lZWQgdG8gYmUgcGVy LXN1YnNjcmliZXINCj4gPiBvcg0KPiA+ID4gcGVyLVZSRiBvciBwZXItc3VibmV0PyAgSG93IGFy ZSBuZXcgQUxHcyBhZGRlZCB0byBZYW5nLCBsaWtlIGlmIEkNCj4gPiA+IHdhbnQNCj4gPiBhbg0K PiA+ID4gQUxHIGZvciwgdW0sIEkgZHVubm8sIFdlYlJUQyBvciBzc2guDQo+ID4gPiAgICAgICAg ICAgICA+DQo+ID4gPiAgICAgVGhlIHlhbmcgbW9kZWxzIGFyZSBleHRlbnNpYmxlLCB5b3UgY2Fu IGF1Z21lbnQgbW9yZSBub2RlcyBvcg0KPiA+IGZpZWxkcy4NCj4gPiA+IEJ1dCB5b3UgY291bGQg bWFrZSB0aGUgYWJvdmUgYXJndW1lbnQgZm9yIGFueXRoaW5nIHRoYXQgY2hhbmdlcy4NCj4gPiBI b25lc3RseSwNCj4gPiA+IEkgaGF2ZW7igJl0IHNlZW4gYSBuZWVkIGZvciBhIG5ldyBBTEcNCj4g PiA+ICAgICBJbiBxdWl0ZSBhIGZldyB5ZWFycy4NCj4gPiA+DQo+ID4gPiAgICAgICAgICAgICA+ ICAgIDE2LiAgSW4gbWFwcGluZy10YWJsZSwgSSBzZWU6ICAgICJydyBsaWZldGltZQ0KPiA+ID4g dWludDMyIi4gIFdvdWxkIHRoaXMgdHJhY2sgdGhlIGxpZmV0aW1lIHdoaWxlIHRoZSBUQ1AgY29u bmVjdGlvbiBpcw0KPiA+IGJlY29taW5nDQo+ID4gPiBmdWxseS1mb3JtZWQgYW5kIGhpdHMgdGhl IHZhcmlvdXMgWWFuZy1kZWZpbmVkICd0aW1lb3V0JyB2YWx1ZXMNCj4gPiA+ICh0Y3AtaWRsZS10 aW1lb3V0LCB0Y3AtdHJhbnMtb3Blbi10aW1lb3V0LCBhbmQgc28gb24pPyIuICBJIHN1cHBvc2UN Cj4gPiA+IGl0DQo+ID4gZG9lcy4NCj4gPiA+IFRleHQgc2hvdWxkIHNheSBzby4NCj4gPiA+ICAg ICAgICAgICAgID4NCj4gPiA+ICAgICAgICAgICAgID4gICAgMTcuICAgICAgICAgICAgIHwgICst LXJvIG5hdDQ0LXN1cHBvcnQ/DQo+ID4gPiBib29sZWFuDQo+ID4gPiAgICAgICAgICAgICA+ICAg ICAgICAgICAgICAgIHwgICstLXJvIG5hdDY0LXN1cHBvcnQ/DQo+ID4gPiBib29sZWFuDQo+ID4g PiAgICAgICAgICAgICA+DQo+ID4gPiAgICAgICAgICAgICA+DQo+ID4gPiAgICAgICAgICAgICA+ ICAgIE5BVDQ2PyAgTkFUNjY/ICBOUFR2Nj8gIFhMQVQ2ND8gIENMQVQ/DQo+ID4gPiAgICAgV2Vs bCwgSSB3aWxsIGFkZCBOUFR2NiB0byBpdCwgSSBkb27igJl0IHdhbnQgdG8gc3VwcG9ydCBub24t aWV0Zg0KPiA+IGZsYXZvcnMNCj4gPiA+IGxpa2UgNDYgYW5kIDY2Lg0KPiA+ID4gICAgICAgICAg ICAgPg0KPiA+ID4gICAgICAgICAgICAgPiAgICAxOC4gIHN0ZWFsdGgtbW9kZS1zdXBwb3J0IG5l ZWRzIGJldHRlciBkZXNjcmlwdGlvbiB0aGFuDQo+ID4gPiAiSW5kaWNhdGVzIHdoZXRoZXIgdG8g cmVzcG9uZCBmb3IgdW5zb2xpY2l0ZWQgdHJhZmZpYy4iLCBhbmQgbmVlZHMNCj4gPiA+IHRvDQo+ ID4gYWxpZ24NCj4gPiA+IHdpdGggSUVURiBob3N0IHJlcXVpcmVtZW50cyBhbmQgSUVURiByb3V0 ZXIgcmVxdWlyZW1lbnRzIFJGQ3MuDQo+ID4gPiAgICAgICAgICAgICA+DQo+ID4gPiAgICAgT2ss IEkgd2lsbCBpbXByb3ZlIHRoZSBkZXNjcmlwdGlvbiBhbmQgYWRkIHJlZmVyZW5jZXMuDQo+ID4g PiAgICAgICAgICAgICA+DQo+ID4gPiAgICAgICAgICAgICA+ICAgIC1kDQo+ID4gPiAgICAgICAg ICAgICA+DQo+ID4gPiAgICAgICAgICAgICA+DQo+ID4gPiAgICAgICAgICAgICA+DQo+ID4gPiAg ICAgICAgICAgICA+DQo+ID4gPiAgICAgICAgICAgICA+DQo+ID4gPg0KPiA+ID4gICAgICBUaGFu a3MNCj4gPiA+ICAgICBTZW50aGlsDQo+ID4gPg0KPiA+ID4gICAgICAgICBfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiA+ID4gICAgICAgICBTb2Z0d2ly ZXMgbWFpbGluZyBsaXN0DQo+ID4gPiAgICAgICAgIFNvZnR3aXJlc0BpZXRmLm9yZw0KPiA+ID4g ICAgICAgICBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NvZnR3aXJlcw0K PiA+ID4NCj4gPiA+DQo+ID4gPg0KPiA+ID4NCj4gPiA+IF9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fDQo+ID4gPiBPUFNBV0cgbWFpbGluZyBsaXN0DQo+ID4g PiBPUFNBV0dAaWV0Zi5vcmcNCj4gPiA+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlz dGluZm8vb3BzYXdnDQo+ID4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18NCj4gPiBPUFNBV0cgbWFpbGluZyBsaXN0DQo+ID4gT1BTQVdHQGlldGYub3JnDQo+ ID4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9vcHNhd2cNCg== From nobody Thu May 18 10:05:57 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 580C6129470; Thu, 18 May 2017 10:05:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.921 X-Spam-Level: X-Spam-Status: No, score=-1.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=btconnect.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2sMiR6WgeKwn; Thu, 18 May 2017 10:05:52 -0700 (PDT) Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-eopbgr10137.outbound.protection.outlook.com [40.107.1.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B4DF212EAA1; Thu, 18 May 2017 10:00:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=btconnect.onmicrosoft.com; s=selector1-btconnect-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=JXNVLUCUF8ngTBADikmWGLzzlpctjeiuEEoTz+lx4sc=; b=FWO064LDd/JLxnZayIHdGYrwIATnuJR0KbnHKadBLsmlDLbjC/xhgCIrBUaui8MCiZ9OEX4GHl/xeEUE1fjEL0SESboe5RQGWst75IKe/PV+c2wXktBTR80tN2d+u22wSYCMsnX5jM3Msp7D/XOX0xm93ChhyQvWa+2bzQipwNA= Authentication-Results: huawei.com; dkim=none (message not signed) header.d=none;huawei.com; dmarc=none action=none header.from=btconnect.com; Received: from pc6 (86.169.157.161) by HE1PR0701MB3001.eurprd07.prod.outlook.com (2603:10a6:3:4d::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1101.8; Thu, 18 May 2017 17:00:01 +0000 Message-ID: <00c501d2cff7$ca31d1a0$4001a8c0@gateway.2wire.net> From: t.petch To: Tianran Zhou , Ignas Bagdonas CC: , , References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> Date: Thu, 18 May 2017 17:57:01 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Originating-IP: [86.169.157.161] X-ClientProxiedBy: AM5PR0201CA0004.eurprd02.prod.outlook.com (2603:10a6:203:3d::14) To HE1PR0701MB3001.eurprd07.prod.outlook.com (2603:10a6:3:4d::7) X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: HE1PR0701MB3001: X-MS-Office365-Filtering-Correlation-Id: 21b2a2ef-de9a-4811-267d-08d49e0f530d X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(201703131423075)(201703031133081); SRVR:HE1PR0701MB3001; X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3001; 3:/7BFWKgzHg+fGalHTIKK2Uyrsh1+kNCvzQW7xXjibK5MlX9x8fdsYj6jgS5dq/A2EhlAO6S1RHFOIe9XanM0kl3+MpSfswKWa1PYDbica90e+R8yLzydhGEZQ5NDHMjS12cQa8mYDWpj1ySQWiQqFzQcDRiC7p9dnW3cwKYnqUmv3HjWq0KvOeVSwxFldHrvrEv7KzFA+ani8RqK60Wkf0eAxZx5IXQk1tfJ6Zj2awDbLXl25uSEl92U1LPnwMuiAPKeARFAJr9EU6WWwTS6idymnqFIYG7GZtU77QTbD5c1AO5r1Rbo25bzTFHf3Bs/w6xfCUaVkdopaokI1807gw==; 25:2UIlnuojKFlojeFETneTFnyvUuvMCIN5UB1uwhbLRCqEdKGx+vbS8da+7FwLY/Ms4zM4ZLCp+rgJ7cWWqJInVzmtFi1cAzIlTAM80TZbEujpRlh5KUlYp/Ps0B/Is9u67dB3IgUabzi7rqiNVjx88igQblURhKH4+RIkuSiRTHroStpSra9OFJGI2vZOqZhAGN80owkQ/gigIItqJbijeDU3TSyThAQI8jjBdshk35odMJjannE3PsoaEuNOVFAtRvNrnCXEmU7bGXagSdIq8W4+Q9E3tpN4o1rr5AtL3z+ErJs4kISx0jShyWfJnqQy2xEPtupTrN6kibTv8HTJFpL/or3z4Ignot8PSVgDYZrc1q7ZKIkTzS30VWkdfcTwD0V8Y6foRi6zNg90MGjHTzgtXe8VNDYR7yVwFK84pttXhIY4+Tlvto2uqH6oX4vf+lY1Zpi5EB+/y25APptPBABbOj2Tr2RSt5oRHOQBsU8= X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3001; 31:YYcgssHsjirfJxX42z3AZ/YQb3rxjhtQ/KmduDjVc2GDe0kPAyCop6OfKbXvViBPbnd9xHB66uUVtezqjIQfqqE59TY0ViDvkj14PY4bDyRyb0h8gYDOrESa8MNR0QVSMuIQOnheoWL8MSae2zn4m85Y3nvB29jQRj8Q5XOBmmlnEQfWTe/V89BDcEvTJimRWqbkwDW2U9d9USoLJct6mrZMqyIY3X0KauV3zdEXnLCshSt2OmUQ408aq2jCEwwZCmJ6M+dX82IbTDe/yAHKYg==; 20:NlMAkEgTH++366HmDMiS4dqtF7Uvp0a2Hj7LyRog+c9YBK99I2hlx7atCFQ8z3ZKJQ7ZTh2drKlDYel0PrSpfUsJ185RHF9ke0b+UEeRVklirvfil0nHYCcMu/cIWjQyNkz3IS+y8/IgJE433t7yjLPmp8Qzz/dSFSGeruBr02s= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(178726229863574)(192374486261705)(50582790962513)(788757137089)(100405760836317)(95692535739014); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(100000700036)(100105000095)(100000701036)(100105300095)(100000702036)(100105100095)(6040450)(601004)(2401047)(8121501046)(5005006)(100000703036)(100105400095)(93006095)(93001095)(3002001)(10201501046)(6041248)(20161123555025)(20161123558100)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(20161123562025)(6072148)(100000704036)(100105200095)(100000705036)(100105500095); SRVR:HE1PR0701MB3001; BCL:0; PCL:0; RULEID:(100000800036)(100110000095)(100000801036)(100110300095)(100000802036)(100110100095)(100000803036)(100110400095)(100000804036)(100110200095)(100000805036)(100110500095); SRVR:HE1PR0701MB3001; X-Microsoft-Exchange-Diagnostics: =?iso-8859-1?Q?1; HE1PR0701MB3001; 4:tQpJrl+DwGxAv7rqUGwgIpxigF0XYhBJWOsneO?= =?iso-8859-1?Q?kGumoQdYaQRDafpT1moMCpoX+E2RiPfBRE2enz++jwhs38gqSl0PsAyeSI?= =?iso-8859-1?Q?ZlYMqmCt85UJk3su1Koh8/6OBygwWgIoxy8XyjjZUj5dbtwq+xvKrBNIoh?= =?iso-8859-1?Q?XOmVPgidXSMIPvNhPQw8NCHVUDUi+VtCNYvsYPTsnFptgi4Bn17zdgQCrq?= =?iso-8859-1?Q?ZaedYmCt1SE5ra/XBNr3GRVK8S72LReD8/Ti4f0HMJS8zIwKiqSGNHJpCW?= =?iso-8859-1?Q?8hrxoTRW99f0QZwEXYzJn1UwWCFN2PHS/pkC0kMLReSF3VLCnvD8qW2qbH?= =?iso-8859-1?Q?qpLGatJthpDvlWxYbEoqeCzbkDcNP54ezgRGhotloJ7wExH4UuSgYY4q5p?= =?iso-8859-1?Q?rQr0SfKrMsFMd3l93LSRZZirGEP9DcB8Bxm1h1I+PedCJbeqF+NCcNJMPQ?= =?iso-8859-1?Q?bSVLJBClwKRWhlXKRtkkF9vvapbkz7anwg2NQjtpG1JdoeCtpo+tneNnb5?= =?iso-8859-1?Q?y/jcdsTDls2g5Sg+cMM2dVhlOfUQYjEyQ6z6e3WriCx3Ff6Pivg8oqwHN9?= =?iso-8859-1?Q?FG5I5yq+9kHP1ItXeO5HN4Wq8okKTE5yAgmkMflZaa5pkFq0fq62yhvjJ3?= =?iso-8859-1?Q?weH7FCtBYE9NE4yspwCP/RzIsWSP592R4jAt4MQnYSAdw6i1NY3fucXJo/?= =?iso-8859-1?Q?XfrUQe7vMaIq3/PjGCuEbYiIQOrniPbHLUoAQ7IXor0M6ykRVLE/QpnJfM?= =?iso-8859-1?Q?UjbCUMng+UJMs9EH9X5rtWwov3XH2iTQk8f19xIh/EiTVFPYuFWDz+6jjR?= =?iso-8859-1?Q?hB0EwdDQLXl8v4ht77R8BiDRGxd00bOyYrE2ttAkB974tNHU5NJ9KhIOJP?= =?iso-8859-1?Q?iVCk/+9Y35OY2OJCpZNF1kp/CCIowXQ0TrIvRbkDkn4Z3czBto3ly6OVhe?= =?iso-8859-1?Q?7Recu4o4xFE0NFsftovAU1/Br2dbhGb72wAmz0b8nPDFYjvAVXlOPpbMHi?= =?iso-8859-1?Q?EoNuF6x2ihfGlfdp/5Bz0C4V5FQg+W0WNO/hsqkqbyI0ls+W1LUi7IQ0PF?= =?iso-8859-1?Q?+DGJLOSePip8MztfOYUtywwZ7oXOw+QY6vh3AR2FGUEex4jnu2I8RI0LYi?= =?iso-8859-1?Q?qiV+cfmdyvr7ZNTU4hIABftZe+aUOnmtX8D6eqxeNgEI+5ue/MteqMbQ/Z?= =?iso-8859-1?Q?tugPAvi8IMKxXTMPm5E79JMBECfDbO23roe6f5zMYxlZWquVy8hZKumaK4?= =?iso-8859-1?Q?rtAmjPt8njT1K0C0/dpmtDXGobfj7wRcdSwfM2RnJtWCqOrWoerBnuFeqN?= =?iso-8859-1?Q?G9I+UdX3pnpjutKLsb1/LB81vKWdI7sjpHACVZLjv5NUumUez3Arn1092K?= =?iso-8859-1?Q?dW/pTx261G464DwJy8gNxB5sg8Q9GUbFgN6Rbp/Sy5eiEtfG6MDg=3D=3D?= X-Forefront-PRVS: 0311124FA9 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(4630300001)(979002)(6009001)(39400400002)(39850400002)(39410400002)(39860400002)(39840400002)(39450400003)(24454002)(377454003)(13464003)(1456003)(50226002)(2906002)(84392002)(81166006)(6246003)(53936002)(38730400002)(6496005)(4720700003)(8676002)(6486002)(6306002)(9686003)(5660300001)(23756003)(25786009)(47776003)(229853002)(53546009)(62236002)(44716002)(86362001)(44736005)(54906002)(3846002)(81686999)(66066001)(33646002)(42186005)(7736002)(14496001)(189998001)(4326008)(81816999)(230783001)(76176999)(50986999)(61296003)(230700001)(50466002)(6116002)(478600001)(305945005)(1556002)(966005)(93886004)(116806002)(74416001)(7726001)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1102; SCL:1; SRVR:HE1PR0701MB3001; H:pc6; FPR:; SPF:None; MLV:ovr; PTR:InfoNoRecords; LANG:en; X-Microsoft-Exchange-Diagnostics: =?iso-8859-1?Q?1; HE1PR0701MB3001; 23:ya5cjRDGNKzxTzSrmFQLGxYa/Zg/IjtDKK7o6?= =?iso-8859-1?Q?Zv6GGFr9I9xDH833SeCKudbaZW5BiMO66U2RYTYgCkRU1DyqW4z41/w+8W?= =?iso-8859-1?Q?xQ8dhMvDNzehFJaL6V5trdVPUFySfPHUSz8XOKke3y2ibzRMgg5JyI+tPU?= =?iso-8859-1?Q?8cz3Z2ySNMB7hHI4Bl48Ys0KTwEeG55prxKdVcvM/jbc/Crb6WN7kf9t32?= =?iso-8859-1?Q?TESoLL8aeOrisWLR01Wgzg9Lm0C4saTgonpPXbuqgRDYC9hmDgL/ooxjdE?= =?iso-8859-1?Q?3g5kR0bd+XgaTOY9IWeoUZnD8vnC28G7lU6xywJNw1Y0rAfETY8gbZSIM2?= =?iso-8859-1?Q?9uX/VkuqlSKZzoJ6zC3qg3DUrchhDacfnhSTkTuGqbHNFN6pmL+U6Dx+xX?= =?iso-8859-1?Q?IMNJ5H8fV3YBQ2fqPOgH8aGPAhj+249srqm59XCkz2YsIlmYTS4IbPrkAM?= =?iso-8859-1?Q?51vSjgVFzgkiieCAuNHJteyzcw6Aez0gW5mSXv7Hbuv+LQKeq6V+/rDsFl?= =?iso-8859-1?Q?oSIWvtqzbthOMFo1LWIQWXSywKlR8nIUofVXY8uoNfoaoqOaGXD5kYevWp?= =?iso-8859-1?Q?tmSoZqR/BmHUC/fEk4Xi4k1bVrkLhcf82mgjASgoHL+ALsdWhEhGP85rRT?= =?iso-8859-1?Q?WSkXdyXyjFrkimsukH2rgSxCsySoEaG8lUV4GCZGKJfRzGapf/nodu14yN?= =?iso-8859-1?Q?d3rZVX9wyGk2t8UKVl1xcF2aBS686lzeezkzGffAmU+HqTvME2HNCRbV+V?= =?iso-8859-1?Q?LhXcsIOfOtGgR3ZxcRarlMj/ajTTMGdTWdpdlXKdhwyWzSB/vfNynFSHn/?= =?iso-8859-1?Q?sfz/xmLyMDXuU+wLnVTfIs03IRdhHSf0g8EOo+PvdCwmpYbZPk+Hq5oW1a?= =?iso-8859-1?Q?+UL4vDOI6tAhcXIzcBETznp3WbCIjPb6F7jJbKrF70xwBMXyyb97P3Qv7e?= =?iso-8859-1?Q?BT2ENJGwHWELXUp2dJRwB7LFRC6rp8WHn4ImcoC4WAt+l0GLwczJfB1f28?= =?iso-8859-1?Q?eoZxFS4UhIE1g1H4sXJ1zfuEduy4ZXpc7pCo0pZrjbNnmsmLQi0IM0puQN?= =?iso-8859-1?Q?p7iiOIaC0PEVm/ASW53fpup31GkPEcgKannRaxxTO2DcLe1gHbHsGgklPE?= =?iso-8859-1?Q?xo6d9bISAeNQ2pUWImfGF/undQ220Tk2SILSbBHflM3OLxq6YlcRDo8xi4?= =?iso-8859-1?Q?172+nT9IewHtW1qJivTQq8GKzvNwpIxHw6t/Hq+8aCJAUBDbrMqyluYIBK?= =?iso-8859-1?Q?QP1r7jXJbLf4CFkosKr92Y921V2GqkQyDB6KlQsWYqEs/SRAqKUex2wkVm?= =?iso-8859-1?Q?qtV5bP+gTzIuRrgkn48Ji6tRg10x+WsrwZtKa2HGZ5dhm6NBBS6tr5kWJY?= =?iso-8859-1?Q?9BK631lZoB/MHDOTL/TFIQO/+vZ62M8674pMsX8nPsQ2C0qef/ChJNEO97?= =?iso-8859-1?Q?FOa00teU6lGG/yqbzvGSnAbelvTNzU6CmoS7z4Hl+LC7350l+1P7lKgRKV?= =?iso-8859-1?Q?EfhQjuKew0dg7KdZGMghW6F/K7ANAp+r4KA4CvQVJ73Z6XEp81ofRnTHcj?= =?iso-8859-1?Q?y+tZhd5a1GAj/Py8I2F7FLp+GKU8NXsvA2iDm3UvxVxy9pOEnjt8RIg65P?= =?iso-8859-1?Q?65ocTczjcwnfQ=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3001; 6:va6K8RcXl5vPKZiNvSke4O0RQ8U3oCf38zxAw5sRziQW0i0WlvTkk+0qb3gxNKFheLC9OJhM2tgt7fWDPfrKQwfDLDFCKG9bvxKV41sHoAu/mO1mpC2l2USd96QtGQrA5ztv/CGAy9i1Oh+1aYchkXy4WpCRFm+lIP4mFJknmunx032Rmvu2jhWidAGWVPabHofAQaAGZeGbKaSSSEIN4dTTfjlt88Sa3oIBZaLWveZmVQoeK/2Jke7b7LhkDwFGjSVuNNdP2SpARK6RaVgFI7GJCE2iYlmXAkGIe/YtTfTVkOvCeu9tQoJicYuqVWIaY45UVvY0RcAIxYrk4FFujLjbB5QGRQ/VzmxZ1meGbzPoLqAS3hwIXs+A9D41Uf9k1lP58IT2yvQwuns2vl++486ZKcwZaDmkbWOQPcR2g1kcB5JsZDoNKEJa2RzG15miNXUCLDwntaOO2ZEjqr8bXgKDR7k5Ll+UFk5uLfcPNnTgJcUD3cWLzLMzhVptMP4D7bJAN5//UpC+vNKd4BFx6g== X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3001; 5:FhZJV0wJLmd+kz7QofwiQJRau5j9F6KzNc69SAbXUtL5N29oBXVGCHP1rvX4PuoYbfvnFtSVRnl4wHrJ2EnGuSl58W6tcH3ut+cv6IKz6QvgVRsbMsPA92CwdKS3ZZNFESsHQXAj3b9y5Ff88FEOcS/4UskkvK7dtOKwo/AiTdr5YKgAM2lMViC7XmytdvBrDWl3+2JU0K03HdhBR85IkmpWGwbv9vb1VeC2gvCM7SyeA6kVl9fO++AjXn2M5zMHkggEnON1q6qUaAn8k+i+EIiGOFC0EFlT2NRlnoiVfct5pHG1xGyNatriSs9EKrJHumNsTM0snBBQwIE4Ty5+RAUHwJYA7ulumC+FPDBnjPYwY/CYEQqlkojgBNv10YSIcNFiw1IK8Mzpo9sxrYU+cfp/P6X8YeOLpa4T+qRFc6oywNvUfm67Hx+iJ531XUCH5I4U0V9tr4T/5yHU4JVc1LuOxIj/OIHjvAAT5mbmp3dk/LRV3O7diVFiC372HHr1; 24:ZeIGFFgqC/kS06DA4n2QJE2ialYUy6H6aWXqNnl6RWy+kDSF+Ps5FxkN9bszaHs7bmjB17NF32V4Eg/gf37cM5xh7BsJeb+UZ92304UnOEE= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3001; 7:Aq7QcHxnKbQ13e2IUtcnxN3S1Tpn7Veg3hxfYBTHhbYNTxgWyTwcxv+QnXK3hGeC7gjx+vMPWVJs84vgk1zpTi+yJYevz2Ccb6uKo1nX8Eae7v0PkZBMi2c6O8Gdw00kKWKkdH+JxXQEgjn5PFTdqdLG8AFg4iVfKHlhQUP2wm3sG7usMWqpn3VPVIxN0yny1q3dsEt5zCx9TlGI/VQEIyQG925rJPqItymNnUKSySRKI8WaYLkT79ow3y8GN+rwT/vU5Z1m2HJSBDHlJ/QWN4XknRerHVKj94iFc9hrJ0o0LtXz/Ms/iBLO8/JNUkCZjO4iR7IC439oxjbm6pTBYA== X-OriginatorOrg: btconnect.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 May 2017 17:00:01.5276 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB3001 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2017 17:05:55 -0000 WG Chairs A slight change of thought. This I-D, as Alan has commented and Doug acknowledges, has several places where the description of security is more 1997 than 2017. If we turn such parts into a clear, concise specification, we may then find that we have wasted our time since the Security Directorate then says that no way can that appear in an RFC, even an Informational one. Would it be worth seeking guidance now on what is or is not likely to be acceptable to a Security Directorate review? Not a line by line analysis but rather higher level guidance as to whether such things as MD4, ASCII login, RFC2433 as Best Practice and so on can appear. Tom Petch ----- Original Message ----- From: "Tianran Zhou" To: "t.petch" ; "Alan DeKok" ; "Ignas Bagdonas" Cc: "Douglas Gash (dcmgash)" ; ; ; ; Sent: Tuesday, May 16, 2017 2:18 AM Thanks Tom for pointing this out. We appreciate any review comment. That really helps to improve the document. I think it's back on the right track now. Hopefully, the authors can respond to more interactions. Regards, Tianran > -----Original Message----- > From: t.petch [mailto:ietfc@btconnect.com] > Sent: Tuesday, May 16, 2017 1:01 AM > To: Alan DeKok; Ignas Bagdonas > Cc: Douglas Gash (dcmgash); opsawg@ietf.org; > draft-ietf-opsawg-tacacs@ietf.org; opsawg-chairs@ietf.org; > ops-ads@ietf.org > Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status > and Plans > > ----- Original Message ----- > From: "Ignas Bagdonas" > To: "Alan DeKok" > Sent: Monday, May 15, 2017 5:00 PM > > > Hi Alan, > > > > On 13/05/2017 12:59, Alan DeKok wrote: > > > The approach in the IETF is to have authors move towards WG > consensus. > > > i.e. to prove to to the WG that the draft is ready for publication. > > > If you're not going to work towards WG consensus, I suggest the > chairs replace you with authors who will. > > > > WG chairs can appoint or change authors if needed under the process > > described in RFC7221 and its referenced documents. The individual > draft > > has been accepted as a WG one a while ago with no changes in author > > list. If current document authors would like to make any changes to > > author/co-author/editor list WG chairs will certainly approve those > > changes. Otherwise unless there is clear evidence that current authors > > cannot make progress with the document, WG chairs do not have > intentions > > of changing the author list. This decision may be revisited if > evidence > > of author/co-author/editor duties not being performed to the expected > > level surfaces, but at this time there is no such evidence. The > process > > of progressing the document is slow, slower than it could have been, > but > > it is not stalled. > > Ignas > > I echo part of what Alan says, that for a WG document, the editors should > reflect the consensus of the WG. The problem I see is the lack of consensus, > not with people disagreeing, but with an absence of people agreeing. > > Alan made a number of comments in October last year, Alexander made some > in November but I did not see much follow up from anyone else to either > set of comments. > > Trouble is, do the editors incorporate comments that one person has made > and noone else has agreed or disagreed with? There is no good answer. > > In other WGs, I have seen ping-pong, one person comments, comments > incorporated, someone else then disagrees, disagreements incorporated into > a new revision, first person comes back, changes incorporated into a newer > revision and so on, circling around a lack of consensus. > Changing editors, unless it is to someone remote from the subject, is unlikely > to change things.. > > I did look at Alan's comments, agreed with some, disagreed with others, > ditto Alexander's, but was disinclined to do more with noone else chipping > in, especially as several more did chip in in the initial stages of should > we adopt this, and what status should it be. > > How you stir people into life is a challenge for WG chairs. > > Tom Petch > > > Thank you. > > > > Ignas > > > > > > > > _______________________________________________ > > OPSAWG mailing list > > OPSAWG@ietf.org > > https://www.ietf.org/mailman/listinfo/opsawg From nobody Thu May 18 10:45:26 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2ABB129C6B; Thu, 18 May 2017 10:45:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.522 X-Spam-Level: X-Spam-Status: No, score=-14.522 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lMLtr1y0vIA9; Thu, 18 May 2017 10:45:23 -0700 (PDT) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A16012E053; Thu, 18 May 2017 10:39:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5217; q=dns/txt; s=iport; t=1495129177; x=1496338777; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=bMzZ0HY6DrCVVuVrvKFAfkMArTANSdeEQN4SWONl2lk=; b=iRP7ZoR1F3IHjM8gT5JrqV/b8kbSu8vsBeAZCYieB1xQufH2otBPt/cP HTnZI763oKAl2uHRgCskJjUHHa2+F2x9R4Zf9NAuItw6ZcPZPthCy7r9E O3uM2bYzUlBDMtxRUlTr1TX8N6ZvNFQb8RzuzyW7GUNMLZ4745gvwBoNP 8=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CaAAA82x1Z/40NJK1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBg1VigQwHjX6RbYgnjU+CDyELhS5KAoVvPxgBAgEBAQEBAQFrKIU?= =?us-ascii?q?YAQEBAQMBATg0BgUMBAIBCBEEAQEBFgEHCQchBgsUCQgCBAENBRmJcgMVDrFMh?= =?us-ascii?q?zANg1oBAQEBAQEBAQEBAQEBAQEBAQEBAQEYBYtYglSCVwGFKQWdWDsBilCDG1y?= =?us-ascii?q?EU5Fuiy+JFgEfOIEKcBVGhHccgWN2hXcNF4EKgQ0BAQE?= X-IronPort-AV: E=Sophos;i="5.38,359,1491264000"; d="scan'208";a="245222489" Received: from alln-core-8.cisco.com ([173.36.13.141]) by rcdn-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 18 May 2017 17:39:36 +0000 Received: from XCH-ALN-014.cisco.com (xch-aln-014.cisco.com [173.36.7.24]) by alln-core-8.cisco.com (8.14.5/8.14.5) with ESMTP id v4IHdaSo019434 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 18 May 2017 17:39:36 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-ALN-014.cisco.com (173.36.7.24) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 18 May 2017 12:39:36 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1210.000; Thu, 18 May 2017 12:39:36 -0500 From: "Douglas Gash (dcmgash)" To: "t.petch" , Tianran Zhou , Ignas Bagdonas CC: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHxblMAgADBTACAA2Ki4oAAEfVNgADdsACAA9mG+oAAbfAA Date: Thu, 18 May 2017 17:39:36 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <00c501d2cff7$ca31d1a0$4001a8c0@gateway.2wire.net> In-Reply-To: <00c501d2cff7$ca31d1a0$4001a8c0@gateway.2wire.net> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.0.161029 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.1.6] Content-Type: text/plain; charset="us-ascii" Content-ID: <17BCB48E6127984CA6EB3281DCA14AFB@emea.cisco.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2017 17:45:25 -0000 In such a query, it might be worth mentioning that the doc was originally intended to include TLS support added in order to address significant elements of the security issues. The current plan is a two-phased approach whereby the original protocol would be documented for information first, and then it would be followed up by a document describing how to increase the security using TLS. On 18/05/2017 17:57, "t.petch" wrote: >WG Chairs > >A slight change of thought. > >This I-D, as Alan has commented and Doug acknowledges, has several >places where the description of security is more 1997 than 2017. If we >turn such parts into a clear, concise specification, we may then find >that we have wasted our time since the Security Directorate then says >that no >way can that appear in an RFC, even an Informational one. > >Would it be worth seeking guidance now on what is or is not likely to be >acceptable to a Security Directorate review? Not a line by line >analysis but rather >higher level guidance as to whether such things as MD4, ASCII login, >RFC2433 as Best Practice and so on can appear. > >Tom Petch > >----- Original Message ----- >From: "Tianran Zhou" >To: "t.petch" ; "Alan DeKok" >; "Ignas Bagdonas" >Cc: "Douglas Gash (dcmgash)" ; ; >; ; > >Sent: Tuesday, May 16, 2017 2:18 AM > >Thanks Tom for pointing this out. >We appreciate any review comment. That really helps to improve the >document. >I think it's back on the right track now. Hopefully, the authors can >respond to more interactions. > > >Regards, >Tianran >> -----Original Message----- >> From: t.petch [mailto:ietfc@btconnect.com] >> Sent: Tuesday, May 16, 2017 1:01 AM >> To: Alan DeKok; Ignas Bagdonas >> Cc: Douglas Gash (dcmgash); opsawg@ietf.org; >> draft-ietf-opsawg-tacacs@ietf.org; opsawg-chairs@ietf.org; >> ops-ads@ietf.org >> Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, >Status >> and Plans >> >> ----- Original Message ----- >> From: "Ignas Bagdonas" >> To: "Alan DeKok" >> Sent: Monday, May 15, 2017 5:00 PM >> >> > Hi Alan, >> > >> > On 13/05/2017 12:59, Alan DeKok wrote: >> > > The approach in the IETF is to have authors move towards WG >> consensus. >> > > i.e. to prove to to the WG that the draft is ready for >publication. >> > > If you're not going to work towards WG consensus, I suggest the >> chairs replace you with authors who will. >> > >> > WG chairs can appoint or change authors if needed under the process >> > described in RFC7221 and its referenced documents. The individual >> draft >> > has been accepted as a WG one a while ago with no changes in author >> > list. If current document authors would like to make any changes to >> > author/co-author/editor list WG chairs will certainly approve those >> > changes. Otherwise unless there is clear evidence that current >authors >> > cannot make progress with the document, WG chairs do not have >> intentions >> > of changing the author list. This decision may be revisited if >> evidence >> > of author/co-author/editor duties not being performed to the >expected >> > level surfaces, but at this time there is no such evidence. The >> process >> > of progressing the document is slow, slower than it could have been, >> but >> > it is not stalled. >> >> Ignas >> >> I echo part of what Alan says, that for a WG document, the editors >should >> reflect the consensus of the WG. The problem I see is the lack of >consensus, >> not with people disagreeing, but with an absence of people agreeing. >> >> Alan made a number of comments in October last year, Alexander made >some >> in November but I did not see much follow up from anyone else to >either >> set of comments. >> >> Trouble is, do the editors incorporate comments that one person has >made >> and noone else has agreed or disagreed with? There is no good answer. >> >> In other WGs, I have seen ping-pong, one person comments, comments >> incorporated, someone else then disagrees, disagreements incorporated >into >> a new revision, first person comes back, changes incorporated into a >newer >> revision and so on, circling around a lack of consensus. >> Changing editors, unless it is to someone remote from the subject, is >unlikely >> to change things.. >> >> I did look at Alan's comments, agreed with some, disagreed with >others, >> ditto Alexander's, but was disinclined to do more with noone else >chipping >> in, especially as several more did chip in in the initial stages of >should >> we adopt this, and what status should it be. >> >> How you stir people into life is a challenge for WG chairs. >> >> Tom Petch >> >> > Thank you. >> > >> > Ignas >> > >> > >> > >> > _______________________________________________ >> > OPSAWG mailing list >> > OPSAWG@ietf.org >> > https://www.ietf.org/mailman/listinfo/opsawg > From nobody Thu May 18 10:46:19 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1CC6F12EAF7; Thu, 18 May 2017 10:46:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.001 X-Spam-Level: X-Spam-Status: No, score=-0.001 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IRe0y8G-LCaK; Thu, 18 May 2017 10:46:15 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 90BAC128896; Thu, 18 May 2017 10:40:29 -0700 (PDT) Received: from [192.168.120.42] (23-233-24-114.cpe.pppoe.ca [23.233.24.114]) by mail.networkradius.com (Postfix) with ESMTPSA id 060F81205; Thu, 18 May 2017 17:40:27 +0000 (UTC) Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) Content-Type: text/plain; charset=us-ascii From: Alan DeKok X-Priority: 3 In-Reply-To: <00c501d2cff7$ca31d1a0$4001a8c0@gateway.2wire.net> Date: Thu, 18 May 2017 13:40:26 -0400 Cc: Tianran Zhou , Ignas Bagdonas , IETF OOPSAWG , draft-ietf-opsawg-tacacs@ietf.org, opsawg-chairs@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <00c501d2cff7$ca31d1a0$4001a8c0@gateway.2wire.net> To: "t.petch" X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2017 17:46:18 -0000 On May 18, 2017, at 12:57 PM, t.petch wrote: of = thought. >=20 >=20 > This I-D, as Alan has commented and Doug acknowledges, has several > places where the description of security is more 1997 than 2017. If = we > turn such parts into a clear, concise specification, we may then find > that we have wasted our time since the Security Directorate then says > that no > way can that appear in an RFC, even an Informational one. They've approved RADIUS RFCs... by holding their nose. > Would it be worth seeking guidance now on what is or is not likely to = be > acceptable to a Security Directorate review? Not a line by line > analysis but rather > higher level guidance as to whether such things as MD4, ASCII login, > RFC2433 as Best Practice and so on can appear. I've been on the Security Directorate for a while now. While I don't = claim to speak for everyone, I think the current approach in the draft = will be fine. They may ask for some sections to be removed (i.e. servers pushing = keys to clients). But everything else is pretty much fine. The idea is that having a documented protocol, with warnings and = caveats, is much better than an undocumented one. Alan DeKok. From nobody Thu May 18 21:11:52 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB940129B7F; Thu, 18 May 2017 21:11:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.222 X-Spam-Level: X-Spam-Status: No, score=-4.222 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EI2b5dxlsnVf; Thu, 18 May 2017 21:11:48 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ED86D129B82; Thu, 18 May 2017 21:06:28 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml705-cah.china.huawei.com) ([172.18.7.190]) by lhrrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id DNI54666; Fri, 19 May 2017 04:06:27 +0000 (GMT) Received: from NKGEML413-HUB.china.huawei.com (10.98.56.74) by lhreml705-cah.china.huawei.com (10.201.108.46) with Microsoft SMTP Server (TLS) id 14.3.301.0; Fri, 19 May 2017 05:06:26 +0100 Received: from NKGEML515-MBX.china.huawei.com ([fe80::a54a:89d2:c471:ff]) by NKGEML413-HUB.china.huawei.com ([10.98.56.74]) with mapi id 14.03.0235.001; Fri, 19 May 2017 12:06:13 +0800 From: Tianran Zhou To: "t.petch" , Ignas Bagdonas CC: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHwlGUAgACwjQCAAF79gIADaB0AgACY5seAAIYPYIAELuD4gAC5Z0A= Date: Fri, 19 May 2017 04:06:12 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <00c501d2cff7$ca31d1a0$4001a8c0@gateway.2wire.net> In-Reply-To: <00c501d2cff7$ca31d1a0$4001a8c0@gateway.2wire.net> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.111.156.116] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020205.591E6F43.00CC, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 1cc4deecea39d26d01528db6f007fe95 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 May 2017 04:11:51 -0000 Hi Tom, There was a conclusion based on the WG consensus: https://mailarchive.ietf.org/arch/msg/opsawg/lR3TFRfaR8OldmPFjuVhRTQZHEE As the first step, we "Produce an informational document which documents the TACACS+ protocol as = it stands today (as best as we can)." My suggestion is that we do not cost too much time on the basic TACACS+. On one hand, Alan as from the SECDIR gave this I-D many useful suggestions.= On the other hand, we are going to ask for SECDIR early review once the ex= isting comments are solved.=20 Regards, Tianran > -----Original Message----- > From: t.petch [mailto:ietfc@btconnect.com] > Sent: Friday, May 19, 2017 12:57 AM > To: Tianran Zhou; Ignas Bagdonas > Cc: opsawg@ietf.org; draft-ietf-opsawg-tacacs@ietf.org; > opsawg-chairs@ietf.org > Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status > and Plans >=20 > WG Chairs >=20 > A slight change of thought. >=20 > This I-D, as Alan has commented and Doug acknowledges, has several places > where the description of security is more 1997 than 2017. If we turn suc= h > parts into a clear, concise specification, we may then find that we have > wasted our time since the Security Directorate then says that no way can > that appear in an RFC, even an Informational one. >=20 > Would it be worth seeking guidance now on what is or is not likely to be > acceptable to a Security Directorate review? Not a line by line analysis > but rather higher level guidance as to whether such things as MD4, ASCII > login, > RFC2433 as Best Practice and so on can appear. >=20 > Tom Petch >=20 > ----- Original Message ----- > From: "Tianran Zhou" > To: "t.petch" ; "Alan DeKok" > ; "Ignas Bagdonas" > Cc: "Douglas Gash (dcmgash)" ; ; > ; ; > > Sent: Tuesday, May 16, 2017 2:18 AM >=20 > Thanks Tom for pointing this out. > We appreciate any review comment. That really helps to improve the docume= nt. > I think it's back on the right track now. Hopefully, the authors can resp= ond > to more interactions. >=20 >=20 > Regards, > Tianran > > -----Original Message----- > > From: t.petch [mailto:ietfc@btconnect.com] > > Sent: Tuesday, May 16, 2017 1:01 AM > > To: Alan DeKok; Ignas Bagdonas > > Cc: Douglas Gash (dcmgash); opsawg@ietf.org; > > draft-ietf-opsawg-tacacs@ietf.org; opsawg-chairs@ietf.org; > > ops-ads@ietf.org > > Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, > Status > > and Plans > > > > ----- Original Message ----- > > From: "Ignas Bagdonas" > > To: "Alan DeKok" > > Sent: Monday, May 15, 2017 5:00 PM > > > > > Hi Alan, > > > > > > On 13/05/2017 12:59, Alan DeKok wrote: > > > > The approach in the IETF is to have authors move towards WG > > consensus. > > > > i.e. to prove to to the WG that the draft is ready for > publication. > > > > If you're not going to work towards WG consensus, I suggest the > > chairs replace you with authors who will. > > > > > > WG chairs can appoint or change authors if needed under the process > > > described in RFC7221 and its referenced documents. The individual > > draft > > > has been accepted as a WG one a while ago with no changes in author > > > list. If current document authors would like to make any changes to > > > author/co-author/editor list WG chairs will certainly approve those > > > changes. Otherwise unless there is clear evidence that current > authors > > > cannot make progress with the document, WG chairs do not have > > intentions > > > of changing the author list. This decision may be revisited if > > evidence > > > of author/co-author/editor duties not being performed to the > expected > > > level surfaces, but at this time there is no such evidence. The > > process > > > of progressing the document is slow, slower than it could have been, > > but > > > it is not stalled. > > > > Ignas > > > > I echo part of what Alan says, that for a WG document, the editors > should > > reflect the consensus of the WG. The problem I see is the lack of > consensus, > > not with people disagreeing, but with an absence of people agreeing. > > > > Alan made a number of comments in October last year, Alexander made > some > > in November but I did not see much follow up from anyone else to > either > > set of comments. > > > > Trouble is, do the editors incorporate comments that one person has > made > > and noone else has agreed or disagreed with? There is no good answer. > > > > In other WGs, I have seen ping-pong, one person comments, comments > > incorporated, someone else then disagrees, disagreements incorporated > into > > a new revision, first person comes back, changes incorporated into a > newer > > revision and so on, circling around a lack of consensus. > > Changing editors, unless it is to someone remote from the subject, is > unlikely > > to change things.. > > > > I did look at Alan's comments, agreed with some, disagreed with > others, > > ditto Alexander's, but was disinclined to do more with noone else > chipping > > in, especially as several more did chip in in the initial stages of > should > > we adopt this, and what status should it be. > > > > How you stir people into life is a challenge for WG chairs. > > > > Tom Petch > > > > > Thank you. > > > > > > Ignas > > > > > > > > > > > > _______________________________________________ > > > OPSAWG mailing list > > > OPSAWG@ietf.org > > > https://www.ietf.org/mailman/listinfo/opsawg From nobody Thu May 18 21:17:42 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D01412EB7A; Thu, 18 May 2017 21:17:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.222 X-Spam-Level: X-Spam-Status: No, score=-4.222 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6XW-VXNrgVmA; Thu, 18 May 2017 21:17:40 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6373D129C36; Thu, 18 May 2017 21:12:13 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml707-cah.china.huawei.com) ([172.18.7.190]) by lhrrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id DNI55208; Fri, 19 May 2017 04:12:11 +0000 (GMT) Received: from NKGEML411-HUB.china.huawei.com (10.98.56.70) by lhreml707-cah.china.huawei.com (10.201.108.48) with Microsoft SMTP Server (TLS) id 14.3.301.0; Fri, 19 May 2017 05:12:10 +0100 Received: from NKGEML515-MBX.china.huawei.com ([fe80::a54a:89d2:c471:ff]) by nkgeml411-hub.china.huawei.com ([10.98.56.70]) with mapi id 14.03.0235.001; Fri, 19 May 2017 12:12:06 +0800 From: Tianran Zhou To: Alan DeKok , "t.petch" CC: Ignas Bagdonas , IETF OOPSAWG , "draft-ietf-opsawg-tacacs@ietf.org" , "opsawg-chairs@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHwlGUAgACwjQCAAF79gIADaB0AgACY5seAAIYPYIAELuD4//+FDwCAATVpUA== Date: Fri, 19 May 2017 04:12:05 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <00c501d2cff7$ca31d1a0$4001a8c0@gateway.2wire.net> In-Reply-To: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.111.156.116] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020202.591E709B.0132, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 1cc4deecea39d26d01528db6f007fe95 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 May 2017 04:17:41 -0000 > -----Original Message----- > From: Alan DeKok [mailto:aland@deployingradius.com] > Sent: Friday, May 19, 2017 1:40 AM > To: t.petch > Cc: Tianran Zhou; Ignas Bagdonas; IETF OOPSAWG; > draft-ietf-opsawg-tacacs@ietf.org; opsawg-chairs@ietf.org > Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status > and Plans >=20 > On May 18, 2017, at 12:57 PM, t.petch wrote: of > thought. > > > > > > This I-D, as Alan has commented and Doug acknowledges, has several > > places where the description of security is more 1997 than 2017. If > > we turn such parts into a clear, concise specification, we may then > > find that we have wasted our time since the Security Directorate then > > says that no way can that appear in an RFC, even an Informational one. >=20 > They've approved RADIUS RFCs... by holding their nose. >=20 > > Would it be worth seeking guidance now on what is or is not likely to > > be acceptable to a Security Directorate review? Not a line by line > > analysis but rather higher level guidance as to whether such things as > > MD4, ASCII login, > > RFC2433 as Best Practice and so on can appear. >=20 > I've been on the Security Directorate for a while now. While I don't c= laim > to speak for everyone, I think the current approach in the draft will be > fine. >=20 > They may ask for some sections to be removed (i.e. servers pushing keys > to clients). But everything else is pretty much fine. >=20 Good to know this information. Thanks. > The idea is that having a documented protocol, with warnings and caveat= s, > is much better than an undocumented one. > Yes. It's what we got from the previous WG consensus. Tianran > Alan DeKok. From nobody Fri May 19 03:49:51 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4C3F12EC42; Fri, 19 May 2017 03:49:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.702 X-Spam-Level: X-Spam-Status: No, score=-4.702 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-2.8, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=btconnect.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qO8aijVMySDC; Fri, 19 May 2017 03:49:47 -0700 (PDT) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-ve1eur01on0101.outbound.protection.outlook.com [104.47.1.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A85E1129C55; Fri, 19 May 2017 03:44:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=btconnect.onmicrosoft.com; s=selector1-btconnect-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=jwKir5LXNpyf5iAfe5algulXn5VM6Vzwcz9zzRmVvmI=; b=jNs1EWRCsGCgn2dgohW/Am2yqizXES9/7vn0v6v7fpCX5LDoUH9lFp++/t3JZUPN+GU2HUiAXIdXqbKDJfZb1GAr6507J2VR/Cl2E+S0i+us5EXt6IyPhaenmtHCcHGDGYqS90T/B76bi+uaWScHSTjF/NQGNHVKlR5uFJQEXCc= Authentication-Results: deployingradius.com; dkim=none (message not signed) header.d=none;deployingradius.com; dmarc=none action=none header.from=btconnect.com; Received: from pc6 (86.169.157.161) by HE1PR0701MB3002.eurprd07.prod.outlook.com (2603:10a6:3:4d::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1101.8; Fri, 19 May 2017 10:44:05 +0000 Message-ID: <017e01d2d08c$6fef0560$4001a8c0@gateway.2wire.net> From: t.petch To: Alan DeKok CC: Tianran Zhou , Ignas Bagdonas , IETF OOPSAWG , , References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <00c501d2cff7$ca31d1a0$4001a8c0@gateway.2wire.net> Date: Fri, 19 May 2017 10:51:55 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Originating-IP: [86.169.157.161] X-ClientProxiedBy: DB6PR07CA0090.eurprd07.prod.outlook.com (2603:10a6:6:2b::28) To HE1PR0701MB3002.eurprd07.prod.outlook.com (2603:10a6:3:4d::8) X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: HE1PR0701MB3002: X-MS-Office365-Filtering-Correlation-Id: 612aa585-4568-4825-de8f-08d49ea3f906 X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(201703131423075)(201703031133081); SRVR:HE1PR0701MB3002; X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3002; 3:3wMeCCndm6mzJ2MBc7jMSIXulmpwytpuIJUV0Bzv68Sjjvjk4nWoM2JCx919SWBjtcJd27CpJ2TYQ9eCTxw6heFtZFM6CM9LBUZ3RhZdJ9vgRodjsqR0E4qeFGZLFvPFxb6L8IjAqVoRqNWPsU5+lO6oCm3fsIE0AY9XKBy6GCas2Jh7xnbY3yTWADPQEPBd7BTQtCZNQHttB5IzRGVgVNfIgPpc1z6BpIAhb8ch3NNNw6XzpS8yfDfqWaNPRzRuRYmzuwGrvOeGTK1Jh04amWaeApiAfmImz3uQt4+JDJCbL5aAtCAHjPAuTpD1JiSLeNq0mft6eBIeMkUnwa1tag==; 25:aTLqIBO5fb4wtXJrVIE/wUc50OHjofqoYLjH8xpFGkwELB3U+/pxxZav6WvNFxpVmn4BLdKIDik+6/HWOS2Ux32SxBZrOrGxTDC0UHMgqvn6dlCJZlNOwPD41Y7NLacE0F035Csni9OUeL0zB7ybUACoQ+u0nnh+Z+K3YWqMP7v/VLkpa6GO7VS0zyZRRDewy1aNThuoqdtiq+vyOl/jtv3s66cE9jVbJHPQr+ExVSOkBaY1KUbc4tf/a6uDKa8qNpJHbJxCDNRJeHMgbdZy5xa3e5SyXQUegP25G2yj/a+usZuzbU+SsUqUZl7HiDaGyiV9EzJ6pTv5S6e4+EKJGvF8R1h69pBVYCt7FH0feXV/EBvwj8otW4dClO4vIncdnk2oJUtLgtsAmCjNLN/S7GtHvI9WH0F1QmBSQMa2wzhVzOYN2RW+7WZYotvLl4dCD4ZOQZWcaAcjvjzK1mYHMLpgRHa7J2RQTpTVnGV7q0I= X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3002; 31:1FcuHX/3BmO9+P5TQSHt72RZdXDLDpEA1JWMoIsCTgKctdnEhcKw03ECMgaY/QL9kSQ38F9+XuMaROCqZYN6D1TzwxBEP800CWL0vgM2jQ7AJ5VH/zG0dJwmWKw9ByBlJm9W/tie/EnWGPOADSFQzc8gZ7Npp+s5JmrLienhIYvxPzq24bZnNdWtWyEF3CdWo+WmAduNltCu3KNiDjQjnr1CGxWIN3VATaQ6pRAf3JOksLS9HWNjqhMNyvWkrXgE; 20:0hWOJh4LMmZ2It0RAz/z8btxsq2A4b+ehpuO9u6GhBiGaa8/5oRPy42XORVAWibUje1fw3UHvVrtEsjm4PwwVHY7KhPXTHcTCzl9PQ4ka6R0Hm4vzhm/Z51hfd2nrswyKKH4nRPfKOQq3PC4XJhUxNyol0jt4n1dIV6gWgOazEM= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(178726229863574)(192374486261705); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(100000700036)(100105000095)(100000701036)(100105300095)(100000702036)(100105100095)(6040450)(601004)(2401047)(8121501046)(5005006)(93006095)(93001095)(3002001)(100000703036)(100105400095)(10201501046)(6041248)(20161123558100)(20161123555025)(20161123562025)(20161123560025)(20161123564025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148)(100000704036)(100105200095)(100000705036)(100105500095); SRVR:HE1PR0701MB3002; BCL:0; PCL:0; RULEID:(100000800036)(100110000095)(100000801036)(100110300095)(100000802036)(100110100095)(100000803036)(100110400095)(100000804036)(100110200095)(100000805036)(100110500095); SRVR:HE1PR0701MB3002; X-Microsoft-Exchange-Diagnostics: =?iso-8859-1?Q?1; HE1PR0701MB3002; 4:OV7a3lMvKOioT62j/r4I9ViuyMnjKb3fA+7er9?= =?iso-8859-1?Q?TKBXbgf7rsD4v41CDyIWvT4l8T1MLE+Kg8uPpN6UA2/IPRUzWs0ped6fWQ?= =?iso-8859-1?Q?hfvAeHoIxi2vzyhx5zeHBAw8iLVh4+1LUcl1BiycLO8e60xxnSD2CcrpCm?= =?iso-8859-1?Q?lrcRpPOF5iqewBwan1tZMxS9vUptD15AYh0GlyzS/sHyZEB6I9mLL1PJQM?= =?iso-8859-1?Q?YRZwVmLxbk8DBTYZOpZ30BGOa0Ufey8sI2XDzkPWR/9TGfvc4mZqUjeghS?= =?iso-8859-1?Q?24pYhAlcsjyuRc85j+oznv18YF/kXGkU+C+q/FY8feIPiL4vdpmgGpWn9R?= =?iso-8859-1?Q?R09w0YdfZvlQxA5Zg53OuK9Fvhn7Zx69q9fRA9mg6/n4JMg+tC9o6zLYPv?= =?iso-8859-1?Q?q/NotX2g0fJXkgXiLEPPhiatACk3P18msXaXj/h+AjGqi5RJUTvmKpQZoZ?= =?iso-8859-1?Q?c0aM8WWohfyzXZ2fBRo3vA7WjLvmFIrBE+Vg87gWFXF3GmkVgTKaeW0l4K?= =?iso-8859-1?Q?YRKIoBbQCKv44A5S5FAix9Z1mBj5apQuNGj7vEuzJXR61d9PbFixz4C8/+?= =?iso-8859-1?Q?MxncOLz+pFAPH9PsxeAjui/UwXdUyFouAGtZamPwCJaM//Ib6gOkIANQgC?= =?iso-8859-1?Q?uKJ4nd3+Ft+panPUuOqeO9Hv5REjfI+NVtE5TJlpQTCi3VieDDcVjbiLtm?= =?iso-8859-1?Q?eQ7ckomjygF8xgtktZXAx7VHEcFkLuR2a6mhI/KmWal48+GbzIbEYFC2nw?= =?iso-8859-1?Q?h0GfDLRSn3WWuA+BcOt62zXCJ1GwjIVqXonaGxjfAgN/DfS5YdHWviG0bE?= =?iso-8859-1?Q?Ft9gEm5FB2eZqQPm5nXs9N35t1JL5LtZHwKwGb8Lf8nLGocSGgGMMX5xiw?= =?iso-8859-1?Q?0JRDkVcgwH1xl5hXNnfWiogIGlOUXeUVijVTgN7iUzJX3VvD8KSz0XqITC?= =?iso-8859-1?Q?LNv1fLs304BWkuGK2fxN0/ZRWd0RYYcYmCh7sX8B0GZNOV0LjxrnHQ2M46?= =?iso-8859-1?Q?lTsO5c6ORW+ptiVuna7IMgmDYtKOsSiunzo5pigSlzhrKCiDFNE3RaOEoO?= =?iso-8859-1?Q?27GcC75Hi77Ftg9Aa5KhyZK2gabw//HGfsQ2arnSlTnKP1p0LhPt4IVxG0?= =?iso-8859-1?Q?2YMYmVsFTJfVKaEBmnYxxWL0FA6b5HFf8f4L+iVYKa+ZS0YyVe8NKQQGhf?= =?iso-8859-1?Q?VYhYKIZpYn7CqWyTZab+yg5soZPllq0eCyfAkgJYFJ1pL9ElFI5k7/JTB+?= =?iso-8859-1?Q?mk/TAGP9NwVEi+fzQZO0fqNXYq/uYRLRY4bljEUA=3D=3D?= X-Forefront-PRVS: 031257FE13 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(4630300001)(6009001)(39450400003)(39860400002)(39840400002)(39850400002)(39400400002)(39410400002)(377454003)(13464003)(24454002)(14496001)(33646002)(44716002)(42186005)(229853002)(61296003)(93886004)(4720700003)(6666003)(3846002)(6916009)(230700001)(4326008)(66066001)(478600001)(5660300001)(86362001)(23756003)(81686999)(50986999)(81816999)(189998001)(9686003)(76176999)(6496005)(305945005)(230783001)(50466002)(110136004)(53936002)(6246003)(7736002)(38730400002)(2906002)(44736005)(50226002)(54906002)(84392002)(25786009)(8676002)(6486002)(81166006); DIR:OUT; SFP:1102; SCL:1; SRVR:HE1PR0701MB3002; H:pc6; FPR:; SPF:None; MLV:sfv; LANG:en; X-Microsoft-Exchange-Diagnostics: =?iso-8859-1?Q?1; HE1PR0701MB3002; 23:Ia2JryXvCeAT0Sz+/TnCB2nG2vfN5IT0UnbtP?= =?iso-8859-1?Q?XV3LX/eYh8mcoS8hoLQ1piMO7RiVPi1XgFnIojgzBaby2wRFOCskStMyyZ?= =?iso-8859-1?Q?oc9XdNh4vq4SyNQVRCGaS05L+NJaT0fUD+L8pInnJB79E6Kx+Gbkg7WjRa?= =?iso-8859-1?Q?mG7xSL5QMmVliWqlEfw7oWD1JbFmiF+fHJ6kTu5K9mkIci9KYNhv6Ah88r?= =?iso-8859-1?Q?DUzHIGuJnk2zwd+3ZlVFRux1fEdNUjOt5HLJRt4VMFAoGMzP3rWHqznnWG?= =?iso-8859-1?Q?RXeMSwC0F2WxHEGFT/bVetvLMMqFUoY+UA8LFf9LKswJmXfN1vXeF/9w44?= =?iso-8859-1?Q?nmh9a/qjRWvuV13rukq3mWOmrOWVXL/ZozCbxhM8ZFO/Qn+GxsvfPMWwyw?= =?iso-8859-1?Q?2JSBjzHUagkPFYgSxb6I/Cx0L68D79j2p6Vnwsm6Z4bS/5qfobOZjaOtXc?= =?iso-8859-1?Q?55nrJSzUw6kV0FaQHJi2+6fnk8c39NGmd4D+7GvequknV2OK8q5sp4gs7+?= =?iso-8859-1?Q?1B/vUlaaE4H7y288q7WpMy94RZY+jTYRJ/Y4td2JOve5Rhuy9WNIlEpMYa?= =?iso-8859-1?Q?+dX9TYeGATKibZXBXs65ECDSAy85WtYIP0FWHEcQGGalQS+gdw8iD63Cn+?= =?iso-8859-1?Q?AEiPDChKoT0bPDV/lG+9umSvJlmmsTapypVEKWyRWgDVf5pifL5BBDhGLw?= =?iso-8859-1?Q?8UJjY4EGFwXG/chwWhCgeEpNWPt4QYvZrXgR+68OsMQ8mk0hO0lIi7E73e?= =?iso-8859-1?Q?KBZN8oOtXk4GX/lZDak1kj9EIZfwsNchLttgaj0MuLexw8h3R6BkyNnj1W?= =?iso-8859-1?Q?RbK263IIqZ3oHZtQIDotut+AnCTt7uQcPO8R13GmxDP1pSgePnXAdofUAZ?= =?iso-8859-1?Q?2xwBZc33EH+1ehf0Z+O79BDo7bC12RcWPWTZWyYRljULppuH0DIeyuDq0j?= =?iso-8859-1?Q?Nw+y7/gw0hymQ5vUl6oqh87I9kQuCHbNFHbHVko/bYdMpPPUs/1FPZrK1o?= =?iso-8859-1?Q?xFKb+jI0HYplGyjYoV+anWuso4fqYMFbV2OicHaFDvqZfGH/WORQVO3qf3?= =?iso-8859-1?Q?XyXnCjKeV9pai+HnllNRegKqdU2r5yI0njEd5SJ8XEBs8T+xC1FMdOnBxj?= =?iso-8859-1?Q?33Hv+7zuKUbZsdWj9+xM62+t7rAJQErCihEVce1CZcRWfXHRwAJ7zVE9vQ?= =?iso-8859-1?Q?UmS3mw+uF09kf6MNBQD6TzeQNcqSjjQCEhqblHmIlqmPyl9I2ll/XFpTGe?= =?iso-8859-1?Q?fmnHL9uxBrA7MXahmf2FamIkzIZXBumxx+PVGbfgbIkG/li9FOBWTfyO1s?= =?iso-8859-1?Q?zhfM42KazeYwcCBY3g35ZTtrZQfL9h+obnYA8lDet6LjOpQ=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3002; 6:DT0wSqK/mwNumTWoPXo+xYbX/mmPF3oQLEbruDHZsI4DCZ8XHMkxnF+uOllwcHoOVhXnerPquAw7OgvaKahqWBrXHjJuBXoY0Nb/QPNgOXEl+G/zVsQFE8JGZD/UT+MheDzLHkmEQL1E3Jh48lM5/u1UjF2bGhkcpxr4E+iFyLs0MNupXdkhkByZ2cAXqlnxxvFkSX4GoR3mKjradSlxlW3IDlYE2sWaofPAoSrqOKPlrNTaKTbRPblY+ERBV7jaA1M5rfVMSs6HYNk7GUOwVzkzJzSTO/GJ4rqnhqYBihendtyn34X18tMXEPBqKesBI+j/+kzPz0ZClh0NV8A6zlQIbj72B91y0KFJJ3CpHTzPLqywtq632z6zPXGOt9tUhi/quhWIYjcQXoILDHXEhcZO9h8/59JGGY9LgafrKLNUUt9Y89R1ILTYQ6zrRNX04L9zsbZHwSqgZXnnQJGg2AEeZSO4DVxw18w/A2f4rUKQy77Qp+au31efC0LOteRCOnW5Rpqzd2EQue9QxTpM4w== X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3002; 5:C9PieBB865/1XAddXFQBTgdjN6remh/YujFi1W1M5W8rxDFGZKcEWtnMp3L2Equhuk42BZVzlIp1Ej1gzkwvI/NoIWqVp574WcXUijlqfjfuQ9ytLL/QViXseGsQaKqioyO0e8sIPeUWRdwPfY49TDngD//XdE5DU411gjcKnZN4c1B9lb65hU2Yru3o+MtwgQulAxpNpk6Co/5rbtr6QJ6twWAcXUlrvwk4qLy37hgWM9E8wbxcLe39LG4abRSrwSoJ8aF5UsPNvlRZGEsoBijBAndoehYDIn3r99uShA6V2wk30razX94oU49IA3NDC4MHMbg8V3ktKht+HVylaSaJwkAUZATsPnT9mqEFQFqYVYhCGE76uMiNfIoWaAoJkA+lZ6axjnRPequMpJiMtod54y14hU6nKQbSKgwgUK3jwsRUFd1PSy4jwTedHGqJ9b1Pm0t22GVnjJKciah87zufbM1Ym6L4KJpF8pVGy+imQT24gfpXbLaR6EczEipB; 24:dLKDRJ33aJ2LzzEp/FahBvlu8f9CaGz8cZA8xNx9S2F6CfcKKDxgONar/CnuaRB0XR7s7UNSqhI+Xdtvwk6jIsO5i4VTrPs4SsPBV71uyhE= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3002; 7:gSGNDgS5GkYaV0exE/c9wrLfE2NZbeCTJllOLT6a9ztBYRexZX5eO/ieaPr2E4s8lg3jBmKqFzCxSdzNph06R4T12n/xfq3nSr5trIxJi5AjMP9DtgDkC/IeZCW7IoXqaHGeBAa/8nNp1jY8s/S87SlCVqLZbjcBj/niEA3Pm9X7CRbzhOabuKtX5mPqLaEb732i1oaUItDYIcv8ZKQvrywvYF97ZyedFLXYZU21PyfGEYn1hHL97PTWhS0KIxIaU+Ishago3NUjy8DeaC2q2fxKfwGf1g65L9LX4vmOBuaW5RCj7FNOSAIzvhFCGSfFZgdb+nmbzXLyCBPbWca6tg== X-OriginatorOrg: btconnect.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 May 2017 10:44:05.1919 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB3002 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 May 2017 10:49:50 -0000 ----- Original Message ----- From: "Alan DeKok" Sent: Thursday, May 18, 2017 6:40 PM On May 18, 2017, at 12:57 PM, t.petch wrote: of thought. > > This I-D, as Alan has commented and Doug acknowledges, has several > places where the description of security is more 1997 than 2017. If we > turn such parts into a clear, concise specification, we may then find > that we have wasted our time since the Security Directorate then says > that no > way can that appear in an RFC, even an Informational one. They've approved RADIUS RFCs... by holding their nose. > Would it be worth seeking guidance now on what is or is not likely to be > acceptable to a Security Directorate review? Not a line by line > analysis but rather > higher level guidance as to whether such things as MD4, ASCII login, > RFC2433 as Best Practice and so on can appear. I've been on the Security Directorate for a while now. While I don't claim to speak for everyone, I think the current approach in the draft will be fine. Ah, I did not know that. Scrub my suggestion (while I hold my nose:-) Tom Petch p.s. I notice that one of the addressees is now OOPS A WG; mmm, yes. They may ask for some sections to be removed (i.e. servers pushing keys to clients). But everything else is pretty much fine. The idea is that having a documented protocol, with warnings and caveats, is much better than an undocumented one. Alan DeKok. From nobody Fri May 19 03:49:59 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF03712EC42; Fri, 19 May 2017 03:49:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.592 X-Spam-Level: X-Spam-Status: No, score=-4.592 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-2.8, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=btconnect.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cz8o8Qoh625y; Fri, 19 May 2017 03:49:49 -0700 (PDT) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-ve1eur01on0101.outbound.protection.outlook.com [104.47.1.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7877812EC4E; Fri, 19 May 2017 03:44:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=btconnect.onmicrosoft.com; s=selector1-btconnect-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=B/n/Clrz8qQtJWdOx5EvH58G1GU69f/8Sqtr2CQDyl4=; b=eSdYuYgnOvikZ79rVdC08DpFeULc4cVxRE1YiDmaotFLi0VtgmBWd1rhNUaa4vkNnwL+n+rBczLFhhyk1WxGXGGlfzCFG/ZNhYY1Q9BVMJSMcwXhY6D8olozB2n88v1P2SAmRcnVNWYOd/XCU1tPe1OiVGFOdaJBkT6fupybUMA= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=ietfc@btconnect.com; Received: from pc6 (86.169.157.161) by HE1PR0701MB3002.eurprd07.prod.outlook.com (2603:10a6:3:4d::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1101.8; Fri, 19 May 2017 10:44:06 +0000 Message-ID: <017f01d2d08c$7096de20$4001a8c0@gateway.2wire.net> From: t.petch To: Alan DeKok , "Douglas Gash (dcmgash)" CC: , References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> <6B9DFA23-41BD-4896-B80C-EC0EAB51D5FD@deployingradius.com> Date: Fri, 19 May 2017 11:38:01 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Originating-IP: [86.169.157.161] X-ClientProxiedBy: DB6PR07CA0090.eurprd07.prod.outlook.com (2603:10a6:6:2b::28) To HE1PR0701MB3002.eurprd07.prod.outlook.com (2603:10a6:3:4d::8) X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: HE1PR0701MB3002: X-MS-Office365-Filtering-Correlation-Id: 03030917-7083-4159-8947-08d49ea3f9b0 X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(201703131423075)(201703031133081); SRVR:HE1PR0701MB3002; X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3002; 3:FNM0fgDTQ/SZM6dA1P5Fg7V2a1Yl8VkySRv0DwrKxx/1uGivQ1/KWlJhAF/gCEP7QTszWycfgz850c+dP4FCjUosF3LvZ5SWqdNcv4zPo12Vaqubo0NE7UhOpa2WzXC4wwW2fYfv4ryYSPitk5j+XFIK1M+13OoL2KW2G1a1HhSe+PG8bzRKcnrwUejBWFkupPOgR2BWfYKprihb+gEbzS0y5ubTInqlyODkymhqTulDLcWUtmscjA9fBeZ2ex/c2QWdwgq+U1acQ1RzO+YSu2bcKhJv/TxjMrbm9wSraiFpPQazH1TDsCNznpmfWeP/BfOuBFKPpghpCAJRNZGWig==; 25:R70qaaVQ++fHPP6SH6kGwWXzpZ+hrBPuR/Zjp0SpE/x4akzfRY4dTgvNwL76PKR4eXY65Vt4PKJN4bj4lhZuAxTSCkINJ/yp2PcQEa/DcFxHOmgKYf/XCi6mBqtiBDDqx0kqVkr2HA5pb3KynkC8eSMiAZQnj8oJuPvN0/C6FgOS+f6mvobRL1ZeRYUbTJspq4Y0jl3tEcNstRljaD0XQPru+BbIJirGrIkCPQ96+BbjIbRfniqvaqr2IaMJ+PxUY8yCYSSW24mBI08594iLnynS5GTn8JITOsmx78qkhIGvMlpmf6Q2qzNXi6SC10XTjol/UNXaUx5h1JXFe0PeqT/tFI4rpVe7E0xt1ffuRBPzaRnF2JZRzKfeBX0zPa14+Cwo3u+nYuNDSqkG0OXd9OvfhDosAmde5xeUSoUQTmMu8r1/GBgy/oEmABs2NglbnwQbPEBfRfb0+k53k6xAORXFGadz5Fbtst+hQvtyrkw= X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3002; 31:P1dQ5d5g4wZ5CsOrbpPHIvSxnlK1W1fse3c7cBJDbAq7XdzS4upTAcj4Eutg7H3cOpXguFuabKp4Ffo5rMlDVKCsaTHvKfZdQ/zihgvb0bVnoc3DvBxfKAMn4l6uTm0J0pCQPZDbgw8Z2nfmGGN7xfKa0pOescFgexe8FpeQrJb+R8d0rbgWFM5qHMMcIX3LY8XDwcRw6wHlVCvnLXZo4U1CO/3FRGr11Kbypv5pYiW0vivfvMVepIGOyu3Ew4fzi7JQFyFb2rPn/RynhvFwTg==; 20:tyZV+mUzX4LkA+j/k9CLMCoGW4j4oDJsxpcM1X+vmRn9o3blpAnid+XxXmypR4sHDyu9XepZ0gFpTwEZRqZubMSFvuFxo04reoKWku4RMpuLsgXC4N/cI5QEyRak90CStJKS8lC10REXJgrS6lSaV+WJwSXZh2FcfJIXZ+9LmdU= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(100405760836317)(95692535739014); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(100000700036)(100105000095)(100000701036)(100105300095)(100000702036)(100105100095)(6040450)(601004)(2401047)(8121501046)(5005006)(93006095)(93001095)(3002001)(100000703036)(100105400095)(10201501046)(6041248)(20161123558100)(20161123555025)(20161123562025)(20161123560025)(20161123564025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148)(100000704036)(100105200095)(100000705036)(100105500095); SRVR:HE1PR0701MB3002; BCL:0; PCL:0; RULEID:(100000800036)(100110000095)(100000801036)(100110300095)(100000802036)(100110100095)(100000803036)(100110400095)(100000804036)(100110200095)(100000805036)(100110500095); SRVR:HE1PR0701MB3002; X-Microsoft-Exchange-Diagnostics: =?iso-8859-1?Q?1; HE1PR0701MB3002; 4:Jeu8ccJ09wZWB/OL4MSVsnwGg/LkP4/ntAqZOH?= =?iso-8859-1?Q?7iFSoecXHUlJic8Ha7C6mYH6xb8ix8AArWhdA51hF8eCTVAVvbPnMbqsG7?= =?iso-8859-1?Q?6kvU96jOuH+Uw+Iy3CmjtXl6V8p1ZrQLb0028Mr0kzAMtFOiZISRgzlUZe?= =?iso-8859-1?Q?xWJ81ZC4gB+ERo4zq6zzM0w6cL+sbG6nXejTmD0Oz1YZHbBY0q2GuwB3wj?= =?iso-8859-1?Q?FIfWh2HGuvgM+snC4KsALIBseA+p235iB8wjVFnciBVgrDynt12FvOuHqQ?= =?iso-8859-1?Q?1MOI9X97MWpxyTZD0UgCUZKpZkWJ8pGXqHJEqlxwY5qDThx48SIy+YY2Y4?= =?iso-8859-1?Q?HiAJuvCcdCHzwWdgX8af0JAarPHN2EfnSdga/B11Z4jElvK0/4Kr3FWFIK?= =?iso-8859-1?Q?fmhqDtfWXdH5y1Nn9XqdnXfYBXZ66vZPuoWoTver0edTEx1QNmIYw+TOCf?= =?iso-8859-1?Q?0QrT5OUqteOOes2W9iU6xdtcWZGay9Z4l0kWGcPJD0lJanSftcQA6q+k2j?= =?iso-8859-1?Q?EDt/mGmqgWk9eHFzp9bI1qVoAB2KiWDEHx/1F7bJ7hdK8oDel2ubigvFGU?= =?iso-8859-1?Q?/w6hLHr2fpMVCjMBZsWA58vga+utPq5Mhk/2xCF9EdK5+pODMNBt8VFLFq?= =?iso-8859-1?Q?s9WOhqJFMgBTz/FQ5eD7kp5hYBVDkr1iOxwId6EuqEAWpFqCBHpmIGwhV3?= =?iso-8859-1?Q?KEOvj0k9QdjrrqqTLhtna1N0vTTak1JHF6dvVo9WAcYiigU8S6CrxDux0i?= =?iso-8859-1?Q?39VakZZtQoqaFiaECDRcQqy8Q1T+fFIj7tQOGNyZaA3hXlriNevdRXpnUA?= =?iso-8859-1?Q?X70Ma4ofhw2Xg2gkUMti9Fs20zWcCa+TVFDtsuu8PQy1F91t60zNpAnp8y?= =?iso-8859-1?Q?iE+FdV2i2xcqKxqqK81SomZvBpdsxqaOdcYyn7b5rP82ofwmsii2/5d6Fi?= =?iso-8859-1?Q?birJKvoGr869Ua4PvymsyyIjotEqZGjRrUU2KL7fb2optwUGa0d613ProC?= =?iso-8859-1?Q?9yE2F75T/cmIQk2GyR1iqBmR2C0DovWe/Lel2VHNkgaGzkzq+CVAvpOeeD?= =?iso-8859-1?Q?ySNQ6EPXz4AjUhBKH0M+Xg8TPU3X5ELynZspE2qncQN8km/+Azcm9/qPC8?= =?iso-8859-1?Q?HZS7FieSqGv5qHn4w+aI3Lw3E7gTUZEZAH1fPy8K8ZE6Og1GvH8nvOU5Ds?= =?iso-8859-1?Q?h3M6obj3HtU4JHydx/af1H45ME2wtYs2LvRRUY7t0vYcu7Pu9k5IyBEM58?= =?iso-8859-1?Q?/4j55CuGTNfCV2HN4wAO0EAabfRjOcy21hQ6/zOA=3D=3D?= X-Forefront-PRVS: 031257FE13 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(4630300001)(979002)(6009001)(39450400003)(39860400002)(39840400002)(39850400002)(39400400002)(39410400002)(51444003)(377454003)(189002)(13464003)(199003)(14496001)(33646002)(47776003)(44716002)(42186005)(62236002)(229853002)(61296003)(93886004)(6116002)(4720700003)(116806002)(6666003)(3846002)(1456003)(4326008)(66066001)(478600001)(575784001)(5660300001)(86362001)(23756003)(81686999)(50986999)(2870700001)(81816999)(189998001)(9686003)(76176999)(6496005)(305945005)(230783001)(50466002)(53936002)(6246003)(7736002)(38730400002)(2906002)(1556002)(44736005)(50226002)(54906002)(84392002)(25786009)(8676002)(6486002)(81166006)(74416001)(7726001)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1102; SCL:1; SRVR:HE1PR0701MB3002; H:pc6; FPR:; SPF:None; MLV:ovr; PTR:InfoNoRecords; MX:1; A:0; LANG:en; Received-SPF: None (protection.outlook.com: btconnect.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?iso-8859-1?Q?1; HE1PR0701MB3002; 23:DpNat+zMDdlGMKWBVAA5v8/Sf6qDH90TBrK1U?= =?iso-8859-1?Q?D6/WZGTr/BHYKldbvEgdQCaJDzmMwHXlTGv+mCauJTvLjvPd09JQrL1+BJ?= =?iso-8859-1?Q?ME0Ey/OJPH0xf/wFTArnQdPc9x7JHHPwQa53LuwsmrE7DSVWrlM/RUUKIr?= =?iso-8859-1?Q?nGKGZ7lMnq8fsMPtMsBsq2AGQ6dPW9tDRG+CMnoo0/mzzxsD3w5RMvLm34?= =?iso-8859-1?Q?dKKIhWRsNGebzgD9NX6C/aqP/Wksh53f8z7CcgjfI46xGSNuy3zCjXHk99?= =?iso-8859-1?Q?01F6LakBYMRFYXNw7zVA0xclcTlu3BJKP4dpwKx/0JfOUCsqJDbsFwR05R?= =?iso-8859-1?Q?d6F03AQg1y/p4z73eWRGjjuQxWTdlulh6BGxZy35ELlqQzG3J7OgqwlWas?= =?iso-8859-1?Q?pBYgf/MG56i+ovmmZ3j9qIiQr3dFL2qkiryx0s/5XKDr75on3aply6nsZN?= =?iso-8859-1?Q?EeM5Sav1gMJiwOLY/xqmHJIBGdOwLHOEBM8Bt6sHq97tkBhgcA5Jv80sOc?= =?iso-8859-1?Q?O+cDCUV4K3STeUQMLY0L43o3/vX6RXjinD8aurUR75ejHVqA7GoRv1mDvm?= =?iso-8859-1?Q?DxVX9nYiFhkn6gIiaLEnXvIb9eXEtnvFpcbiPCyhIpxyoYTk97YPWEXktc?= =?iso-8859-1?Q?S5e/XvyJyp8MuFhwi2SGPwliTSyhbCrJFOgXvUHWhmLKlRA6tV/Sbd/9Rm?= =?iso-8859-1?Q?2S1W8U4ekYiBLnjey73HP4i8MHiJnKhyqkmlEpQFALyai/Fm25B/ZG3O7R?= =?iso-8859-1?Q?UzZqa46RMRqvBEMaZOc+zDrvV2+lbfZMfu5ZXX3VvwuKAFOuckk1+OHG4f?= =?iso-8859-1?Q?CBbLkz9wRc/0MU/QTWcI2rdwiutJQOm2wENvsGMzqaw90LFdg64j1PsJvs?= =?iso-8859-1?Q?Rv1YnqJIvsMzX2/5DxINQvCd1LWG1a50wh85hFnqMxPKHv33d9ziYvKFJ9?= =?iso-8859-1?Q?jGu4YW+NamXF7f+ANAD2RUKCHEUlGfDbjWkTAeZEWKQjVmUJReK9ABhCH6?= =?iso-8859-1?Q?9eXPaCIjeRt2pUrerxPvn40/lIT89Q+kTtPfAWOVQ4QgZE8sIcjxrrgef1?= =?iso-8859-1?Q?kebptXWW3kYN6vj6QbmsuC9ejOPBumwVQ4jkoSUk+VL6GvRK3MLDHo4Z2s?= =?iso-8859-1?Q?U2/8KFbl8jDi69cFVue6okhqqSeuaaZDMoEaNCpKzqSW2BB1k+4V+D9T5B?= =?iso-8859-1?Q?hufxdWSXz4qgYVZj5ao4kNhDlMGSHhMj4rVs7TWUBW36UoMUzad6aTM5B+?= =?iso-8859-1?Q?PPSLwYDPfFfWdEEc4iXbh3ip0dgsnvUC7HAsqpDSFVgFshCr9N4ijL8oc6?= =?iso-8859-1?Q?S8BSAcvy2wffNE5SlCVkhonUNDJN1dMvC2XQpsTWyvnmVUuOeSkUJ9Gaeg?= =?iso-8859-1?Q?VcuxZzTDoqCx+bBwcqEbmDBp0el6ntJhUSKxzwdr7TvRjHQS6JnbxUFcXM?= =?iso-8859-1?Q?5D/tjgQ5cPrOzXAKnA4awJP55xmPqgKI/k0l2SfN0ThBzhnWW2/fLtcbtb?= =?iso-8859-1?Q?OxHEb+Fw/qD3+TijlRi1DSMMFQPFzdk+ej1deE+eRSyQnY0VYptEX9U7rU?= =?iso-8859-1?Q?KMmCYK70dtdHwAoCTkMiv0dCbWk232dliLFdiT8sfr/UzbC4QbeYkCzIeM?= =?iso-8859-1?Q?ExyzE9v4eQ8yIS2ONyc7nGJ54rcAvVm2OU=3D?= X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3002; 6:ggcgPldU8rmiwmUnGOgVyPS4cnH3/SKA8z9TyGMhga6SU9UhDbo+2b7b6dCglgiXageHtD8rrBbhhVdoJzWq6TCHCUo7DY7pOLAg1Vp71zRmpfiqKEgTRUkcTFGfSUlXjt818Ogmqa++DvSzpSd7aI+9CFXciYgqO2G4XSjGS/U5pnx8LbHleCdmaSxOlR+bcakq+wWk+qpq6jKj5TAJ/uQdCH9FfDk/PlMmo4a+WTD06aqcE1jqgTpMiauFOaeNPXUeRcLejXhYXikgt0S/acL4CBdA9bpWohxiY4xi3LJFVJRCN3FlDOxBA/jS1JnLwPS9FhuBC5aatl9I33fhDRROQgpd+U5cmptXPqiAT2ykicTTBUqb4VoxYrK/MqB2mepuar04gzIB2HQ4eCP8eboBEVsXqHacmtJ4+1nfAcKP40BmPKlRsnZHCO7hmeqpurzEciFdPChmfn8qREDxvE67uqY34/0F4s6DPbsia3yZHVZTn45kWDse7St8k2I0KryteK/WH7VVkRJLAk3njw== X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3002; 5:5ZpbLmaRV1jyA5ADMxcnre0KwX2G3E9+SjeCzBIRXPSFKsdq37mK2PBdWtzGggGytGTKH0t7Z6mDkl7PrYv+w5li+s9yj4P5QO9n9IWKm9YOYHYId2LzHdHxaZzezO6U6imdhpd903e7GO4W8Aj76xiMslY0Qn8v1NZ+bdbgA6BQYaeda1/zRk5B3M9MQ481iq/FLQ92FETQbfC6PUdO/mYx5doCNZ1NkLqnTy7I73E5Yu/oxmgbMEI1aiJszt0WT9oQbLdD9MpDolTx6/9LGmxiw48hM2zaRwpbXjDbzkwwYREHN8hsfsiRFGlWYd/kqvhUxA8yc+vr/pSL2RrKftuCpN0bm64GrdMptbBL+pexVfuvt2mUVya9MpE+4v2hsZcNns1pcq/9DMFk5q+BsYzeyFMro+1pCaZIcyTNrFwyR8kQHRlvG1aORnnT3uLgk/2amkRGgBo7pPp70D6gDaYqHvA3gCR4+bTvVGCGpeNc2iSBGG9mmCk1u3UmFIVv; 24:IvcfMVxT4XUUZvivatByYpd3hoqgCeWKan8CGRr5RX9iu3HTWxqBRh224FtAoh4sjxPsfXh2ktfKcF6/jUDhzKs6TCyowBVwcRPKEpgFCaE= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; HE1PR0701MB3002; 7:io41OyTy7Cvf+Y+iqldyeXN+0R/OCy0OPyxh7d61tBpzMSeYKBhvHZUv/uv5RhOWmJus347IXlr4oFQKyLU1JZ0JzCCYPo72QBMhdx5c9zhawS+MATxgD3mEaH9Tibsf0Plv5YWJYzrS8tWYR2AZbV7pyztRJXfNVIbZbb08ufpk8sFRH2biJKLBIwmdeLz7evKXmxJc2CUFOgF6w2U1CkLPQpsZco8AFTtwJdry29xKuqvtNBYum94cxMBAPlaXcVtlIiaURU6Pp5V4IVAaRBHKlNv+cp+8OgBvC4cF2acc9Ya4s+dcEriU+TmJ/PyHAZBtDLC1UtvP+s82XGZmxQ== X-OriginatorOrg: btconnect.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 May 2017 10:44:06.5200 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB3002 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 ASCII X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 May 2017 10:49:52 -0000 Another fresh topic, so a slight change in the Subject: I think that the use of the term ASCII needs more thought. a) There is mix of US-ASCII and ASCII with seemingly no difference in semantic. I would like this to be US-ASCII .. b) except that there is usage of 'ASCII login' which looks like a Term of Art, at least within TACACS so I suggest keeping ASCII solely for the login. c) there is no reference for US-ASCII. There is no good reference for US-ASCII but I usually see RFC20 being usedalthough some prefer ANSI X3.4, 1986. d) in some places, I think that the term ASCII is being used too loosely. ASCII is a character set and an encoding. If you simply say US-ASCII, then you are including DC3 and FF, for example, which are unlikely to be valid. Some use US-ASCII to mean printable ASCII, some to mean alphameric plus a few others such as hyphen-minus and period. This needs defining. I don't know how many different character sets you have - I was surprised that '&£#' (or some such) is a valid identifier in places where an equal sign is not - so this needs more work. e) this leads into data types, which Alan raised. Boolean is used as a data type. (I have seen it as a character string of 'true'/'false' of '0'/'1' with zero meaning either true or false or vice versa or as a binary integer of some number of bits or ....) As Alan implied, section 7 and others are full of data types but on the one hand, what type it is is usually omitted and on the other hand, the data types are not defined. You need to define datatypes; from the current I-D, I do not know how many there would be; probably not many. Look for example at TLS (RFC5246) or YANG (RFC6020) which nail down the datatypes, semantic and encoding, before they define data structures. This is what I think that you should do, on a smaller scale. Since YANG is being so widely deployed, you would get brownie points IMO for being in line with YANG whereever possible I see a need for boolean, character string/text, IPv4 address, IPv6 address, time interval, integer (positive ?negative). I would like a section on datatypes at the front, section 1 or 2. f) in a similar vein, you use what I take to be hexadecimal representation but are inconsistent with it. I see OX0D 0x0D 0x1 0x01 This should be consistent and is also worth defining, as a representation. g) and then there is i18n, which gets an implicit mention with UTF8 but harks back to d). How much of UTF8 is allowed and where; it encompasses over 65k characters these day:-( This amounts to a lot of potential detailed change, but I would like to see consensus on the approach first before edits are proposed or made. Tom Petch ----- Original Message ----- From: "Alan DeKok" To: "Douglas Gash (dcmgash)" Cc: ; Sent: Wednesday, May 17, 2017 3:54 PM Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans From nobody Fri May 19 10:11:52 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 10898128DF3; Fri, 19 May 2017 10:11:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hMX1NN9oMKev; Fri, 19 May 2017 10:11:49 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id DF68E126CC4; Fri, 19 May 2017 10:11:48 -0700 (PDT) Received: from [192.168.20.121] (CPEf4cc552207f0-CM00fc8dce0fa0.cpe.net.cable.rogers.com [99.230.129.191]) by mail.networkradius.com (Postfix) with ESMTPSA id 61A6DBB5; Fri, 19 May 2017 17:11:47 +0000 (UTC) Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) Content-Type: text/plain; charset=iso-8859-1 From: Alan DeKok X-Priority: 3 In-Reply-To: <017f01d2d08c$7096de20$4001a8c0@gateway.2wire.net> Date: Fri, 19 May 2017 13:11:45 -0400 Cc: IETF OOPSAWG , draft-ietf-opsawg-tacacs@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <61BFF2A7-680E-433F-8D7E-E0F0B95A2DC6@deployingradius.com> References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> <6B9DFA23-41BD-4896-B80C-EC0EAB51D5FD@deployingradius.com> <017f01d2d08c$7096de20$4001a8c0@gateway.2wire.net> To: "t.petch" X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 ASCII X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 May 2017 17:11:51 -0000 On May 19, 2017, at 6:38 AM, t.petch wrote: >=20 > Another fresh topic, so a slight change in the Subject: >=20 > I think that the use of the term ASCII needs more thought. Speaking only as an opinionated WG member... yes. > d) in some places, I think that the term ASCII is being used too > loosely. ASCII is a character set and an encoding. If you simply say > US-ASCII, then you are including DC3 and FF, for example, which are > unlikely to be valid. Some use US-ASCII to mean printable ASCII, some > to mean alphameric plus a few others such as hyphen-minus and period. > This needs defining. I don't know how many different character sets = you > have - I was surprised that '&=A3#' (or some such) is a valid = identifier > in places where an equal sign is not - so this needs more work. I agree. > e) this leads into data types, which Alan raised. Boolean is used as = a > data type. (I have seen it as a character string of 'true'/'false' of > '0'/'1' with zero meaning either true or false or vice versa or as a > binary integer of some number of bits or ....) As Alan implied, = section > 7 and others are full of data types but on the one hand, what type it = is > is usually omitted and on the other hand, the data types are not > defined. The main issue with data types is that TACACS+ is a protocol based on = printable strings. So "data types" really means "printed versions of = data types", which is a lot more problematic than "32-bit integer". > You need to define datatypes; from the current I-D, I do not know how > many there would be; probably not many. Look for example at TLS > (RFC5246) or YANG (RFC6020) which nail down the datatypes, semantic = and > encoding, before they define data structures. This is what I think = that > you should do, on a smaller scale. Since YANG is being so widely > deployed, you would get brownie points IMO for being in line with YANG > wherever possible That's good, tho there are inconsistencies. e.g. Yang "string" = doesn't exactly map to TACACS+ "US-ASCII thing". Yang "boolean" is = "true/false", while TACACS+ has used "yes/no". We added data types to RADIUS, because it had (roughly) data types = from day one, 32-bit integers, and all of the implementors had already = agreed on meanings / encodings for them. So RFC8044 was just a = codification of existing practices, and not any change to = implementations. Then there's the additional issue of trying to define data types for a = protocol that's entirely string based, and has 18 years of = implementation practice. i.e. before defining data types, it would be good to know what = implementors have done, and then define types that match that. However, implementors are largely silent about all possible TACACS+ = issues. Which makes me think that the draft should name the data types, = but be a bit vague about what they contain. > I see a need for boolean, character string/text, IPv4 address, IPv6 > address, time interval, integer (positive ?negative). I would like a > section on datatypes at the front, section 1 or 2. I'd agree, subject to the caveats raised above. i.e. "boolean is = boolean, typically yes/no, but maybe also true/false, we really don't = know..." > f) in a similar vein, you use what I take to be hexadecimal > representation but are inconsistent with it. I see > OX0D 0x0D 0x1 0x01 > This should be consistent and is also worth defining, as a > representation. I agree, subject to the same caveats. It would also be nice to know = what implementations do... > g) and then there is i18n, which gets an implicit mention with UTF8 = but > harks back to d). How much of UTF8 is allowed and where; it = encompasses > over 65k characters these day:-( IMHO, the draft should just mention 18n, and run away screaming. :( As in, "we know about it, we don't know how to fix it, we don't know = what implementations do, the fields are defined to be US-ASCII, if they = contain anything else, that's bad." > This amounts to a lot of potential detailed change, but I would like = to > see consensus on the approach first before edits are proposed or made. I think this is the right approach. Alan DeKok. From nobody Fri May 19 10:51:54 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0624A129ACC; Fri, 19 May 2017 10:51:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.523 X-Spam-Level: X-Spam-Status: No, score=-14.523 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AWpJ-ASmUSCs; Fri, 19 May 2017 10:51:51 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9AEEE129AA0; Fri, 19 May 2017 10:51:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5056; q=dns/txt; s=iport; t=1495216311; x=1496425911; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=WKuiHjS8QAxsz+7VONn9ezhm/4MZHe92FnvJfa6/EFk=; b=QDR8FXwBsqG7Vg+9fE6r1iaVS8wNMwsbXK4Wi6DNsz9XBd7ERCMsDRbP gCXoMNHEGH9Odl+hJPGpNpfXUyWYip/7nMUjLTg0i3FF52V1nwnmVVC/M IHZVBHFdKyd3JVqkPSSEXB/URXm8dsLQJm56oqbujzpiXVCXpg+Z+QSwq s=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CYAADkLx9Z/5pdJa1TCRkBAQEBAQEBA?= =?us-ascii?q?QEBAQcBAQEBAYNVgW4HjX+RcJV2gg+GJAKFez8YAQIBAQEBAQEBayiFGAEBAQE?= =?us-ascii?q?CAXkQAgEIFwEuMh0IAgQBDQWKHAizIYsXAQEBAQEBAQEBAQEBAQEBAQEBAQEBH?= =?us-ascii?q?Yg9gxuEPIYZBZAoQ40qAZMbkW6URQEfOIEKcBWHPHaID4ENAQEB?= X-IronPort-AV: E=Sophos;i="5.38,365,1491264000"; d="scan'208";a="29562398" Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by rcdn-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 May 2017 17:51:50 +0000 Received: from XCH-ALN-013.cisco.com (xch-aln-013.cisco.com [173.36.7.23]) by rcdn-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id v4JHpoeb019208 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 19 May 2017 17:51:50 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-ALN-013.cisco.com (173.36.7.23) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Fri, 19 May 2017 12:51:49 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1210.000; Fri, 19 May 2017 12:51:49 -0500 From: "Douglas Gash (dcmgash)" To: Alan DeKok , "t.petch" CC: IETF OOPSAWG , "draft-ietf-opsawg-tacacs@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 ASCII Thread-Index: AQHS0IzaXjAQTdEMlkK3vjl1WRHGuKH8OLOAgAAb7QA= Date: Fri, 19 May 2017 17:51:49 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> <6B9DFA23-41BD-4896-B80C-EC0EAB51D5FD@deployingradius.com> <017f01d2d08c$7096de20$4001a8c0@gateway.2wire.net> <61BFF2A7-680E-433F-8D7E-E0F0B95A2DC6@deployingradius.com> In-Reply-To: <61BFF2A7-680E-433F-8D7E-E0F0B95A2DC6@deployingradius.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.0.161029 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.1.6] Content-Type: text/plain; charset="iso-8859-1" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 ASCII X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 May 2017 17:51:53 -0000 On 19/05/2017 18:11, "Alan DeKok" wrote: >On May 19, 2017, at 6:38 AM, t.petch wrote: >>=20 >> Another fresh topic, so a slight change in the Subject: >>=20 >> I think that the use of the term ASCII needs more thought. > > Speaking only as an opinionated WG member... yes. > >> d) in some places, I think that the term ASCII is being used too >> loosely. ASCII is a character set and an encoding. If you simply say >> US-ASCII, then you are including DC3 and FF, for example, which are >> unlikely to be valid. Some use US-ASCII to mean printable ASCII, some >> to mean alphameric plus a few others such as hyphen-minus and period. >> This needs defining. I don't know how many different character sets you >> have - I was surprised that '&=A3#' (or some such) is a valid identifier >> in places where an equal sign is not - so this needs more work. > > I agree. Will align the ASCII references for sure, and tie down. I propose to restrict to printable. Though, to add to complexity: it is common practice, for example, to include newline in banners. > >> e) this leads into data types, which Alan raised. Boolean is used as a >> data type. (I have seen it as a character string of 'true'/'false' of >> '0'/'1' with zero meaning either true or false or vice versa or as a >> binary integer of some number of bits or ....) As Alan implied, section >> 7 and others are full of data types but on the one hand, what type it is >> is usually omitted and on the other hand, the data types are not >> defined. > > The main issue with data types is that TACACS+ is a protocol based on >printable strings. So "data types" really means "printed versions of >data types", which is a lot more problematic than "32-bit integer". I agree. Will put a section in regarding at a types, specifically for attributes (As Alan pointed out). > >> You need to define datatypes; from the current I-D, I do not know how >> many there would be; probably not many. Look for example at TLS >> (RFC5246) or YANG (RFC6020) which nail down the datatypes, semantic and >> encoding, before they define data structures. This is what I think that >> you should do, on a smaller scale. Since YANG is being so widely >> deployed, you would get brownie points IMO for being in line with YANG >> wherever possible > > That's good, tho there are inconsistencies. e.g. Yang "string" doesn't >exactly map to TACACS+ "US-ASCII thing". Yang "boolean" is "true/false", >while TACACS+ has used "yes/no". > > We added data types to RADIUS, because it had (roughly) data types from >day one, 32-bit integers, and all of the implementors had already agreed >on meanings / encodings for them. So RFC8044 was just a codification of >existing practices, and not any change to implementations. > > Then there's the additional issue of trying to define data types for a >protocol that's entirely string based, and has 18 years of implementation >practice. > > i.e. before defining data types, it would be good to know what >implementors have done, and then define types that match that. > > However, implementors are largely silent about all possible TACACS+ >issues. Which makes me think that the draft should name the data types, >but be a bit vague about what they contain. Agreed, but try to be explicit about the vagueness. > >> I see a need for boolean, character string/text, IPv4 address, IPv6 >> address, time interval, integer (positive ?negative). I would like a >> section on datatypes at the front, section 1 or 2. > > I'd agree, subject to the caveats raised above. i.e. "boolean is >boolean, typically yes/no, but maybe also true/false, we really don't >know..." > >> f) in a similar vein, you use what I take to be hexadecimal >> representation but are inconsistent with it. I see >> OX0D 0x0D 0x1 0x01 >> This should be consistent and is also worth defining, as a >> representation. > > I agree, subject to the same caveats. It would also be nice to know >what implementations do... > >> g) and then there is i18n, which gets an implicit mention with UTF8 but >> harks back to d). How much of UTF8 is allowed and where; it encompasses >> over 65k characters these day:-( Well, the approach we had in mind is printable US-ASCII for all fields, apart form username and passwords, which are the hard points in interfacing to identity provides which support. For these fields, to allow UTF-8 on top of the byte streams. > > IMHO, the draft should just mention 18n, and run away screaming. :( > > As in, "we know about it, we don't know how to fix it, we don't know >what implementations do, the fields are defined to be US-ASCII, if they >contain anything else, that's bad." > >> This amounts to a lot of potential detailed change, but I would like to >> see consensus on the approach first before edits are proposed or made. > > I think this is the right approach. > > Alan DeKok. > From nobody Fri May 19 11:07:05 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50605129ADF; Fri, 19 May 2017 11:07:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.503 X-Spam-Level: X-Spam-Status: No, score=-14.503 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s6BMm6-QPW_D; Fri, 19 May 2017 11:07:02 -0700 (PDT) Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 75BEF129AD7; Fri, 19 May 2017 11:07:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=7786; q=dns/txt; s=iport; t=1495217221; x=1496426821; h=subject:to:cc:references:from:message-id:date: mime-version:in-reply-to; bh=FLrXf0rfKdxxuCuF9erD2HdcGnYkqcTqRz889ui+bJ8=; b=kbzbISYidRDyAI6LaRuSeQD4Zi6oqcuTKe/G1fB3Uvt+GR6lUikFzh2W KGkTL5gCV0GVOCbiMF5vSW3jtqlUO5VDyl9YIbwbz8CN0nGg/mfdReSW2 GZgFnHUzrut0XGfuGNEwZLaEW9WwaUuEBoxySnm7MeDmUKFuMezFQ1mfU M=; X-Files: signature.asc : 481 X-IronPort-AV: E=Sophos;i="5.38,365,1491264000"; d="asc'?scan'208";a="654809896" Received: from aer-iport-nat.cisco.com (HELO aer-core-1.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 May 2017 18:06:59 +0000 Received: from [10.61.86.141] (ams3-vpn-dhcp5774.cisco.com [10.61.86.141]) by aer-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id v4JI6xOE016706; Fri, 19 May 2017 18:06:59 GMT To: "Douglas Gash (dcmgash)" , Alan DeKok , "t.petch" Cc: IETF OOPSAWG , "draft-ietf-opsawg-tacacs@ietf.org" References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> <6B9DFA23-41BD-4896-B80C-EC0EAB51D5FD@deployingradius.com> <017f01d2d08c$7096de20$4001a8c0@gateway.2wire.net> <61BFF2A7-680E-433F-8D7E-E0F0B95A2DC6@deployingradius.com> From: Eliot Lear Message-ID: <5210a082-6c5d-c7fc-b55d-abe11689c090@cisco.com> Date: Fri, 19 May 2017 20:06:58 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.1.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="WVANWNthiddotbAWlmD3m5t6jM58xdmE1" Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 ASCII X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 May 2017 18:07:04 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --WVANWNthiddotbAWlmD3m5t6jM58xdmE1 Content-Type: multipart/mixed; boundary="k8Hb2paCB2OWc6JQuf7OG7ke1eP9wo7wl"; protected-headers="v1" From: Eliot Lear To: "Douglas Gash (dcmgash)" , Alan DeKok , "t.petch" Cc: IETF OOPSAWG , "draft-ietf-opsawg-tacacs@ietf.org" Message-ID: <5210a082-6c5d-c7fc-b55d-abe11689c090@cisco.com> Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 ASCII References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> <6B9DFA23-41BD-4896-B80C-EC0EAB51D5FD@deployingradius.com> <017f01d2d08c$7096de20$4001a8c0@gateway.2wire.net> <61BFF2A7-680E-433F-8D7E-E0F0B95A2DC6@deployingradius.com> In-Reply-To: --k8Hb2paCB2OWc6JQuf7OG7ke1eP9wo7wl Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US Isn't this handled by RFC 20? On 5/19/17 7:51 PM, Douglas Gash (dcmgash) wrote: > > On 19/05/2017 18:11, "Alan DeKok" wrote: > >> On May 19, 2017, at 6:38 AM, t.petch wrote: >>> Another fresh topic, so a slight change in the Subject: >>> >>> I think that the use of the term ASCII needs more thought. >> Speaking only as an opinionated WG member... yes. >> >>> d) in some places, I think that the term ASCII is being used too >>> loosely. ASCII is a character set and an encoding. If you simply sa= y >>> US-ASCII, then you are including DC3 and FF, for example, which are >>> unlikely to be valid. Some use US-ASCII to mean printable ASCII, som= e >>> to mean alphameric plus a few others such as hyphen-minus and period.= >>> This needs defining. I don't know how many different character sets = you >>> have - I was surprised that '&=C2=A3#' (or some such) is a valid iden= tifier >>> in places where an equal sign is not - so this needs more work. >> I agree. > Will align the ASCII references for sure, and tie down. I propose to > restrict to printable. Though, to add to complexity: it is common > practice, for example, to include newline in banners. > >>> e) this leads into data types, which Alan raised. Boolean is used as= a >>> data type. (I have seen it as a character string of 'true'/'false' of= >>> '0'/'1' with zero meaning either true or false or vice versa or as a >>> binary integer of some number of bits or ....) As Alan implied, sect= ion >>> 7 and others are full of data types but on the one hand, what type it= is >>> is usually omitted and on the other hand, the data types are not >>> defined. >> The main issue with data types is that TACACS+ is a protocol based on= >> printable strings. So "data types" really means "printed versions of >> data types", which is a lot more problematic than "32-bit integer". > I agree. Will put a section in regarding at a types, specifically for > attributes (As Alan pointed out). > >>> You need to define datatypes; from the current I-D, I do not know how= >>> many there would be; probably not many. Look for example at TLS >>> (RFC5246) or YANG (RFC6020) which nail down the datatypes, semantic a= nd >>> encoding, before they define data structures. This is what I think t= hat >>> you should do, on a smaller scale. Since YANG is being so widely >>> deployed, you would get brownie points IMO for being in line with YAN= G >>> wherever possible >> That's good, tho there are inconsistencies. e.g. Yang "string" doesn= 't >> exactly map to TACACS+ "US-ASCII thing". Yang "boolean" is "true/fals= e", >> while TACACS+ has used "yes/no". >> >> We added data types to RADIUS, because it had (roughly) data types fr= om >> day one, 32-bit integers, and all of the implementors had already agre= ed >> on meanings / encodings for them. So RFC8044 was just a codification = of >> existing practices, and not any change to implementations. >> >> Then there's the additional issue of trying to define data types for = a >> protocol that's entirely string based, and has 18 years of implementat= ion >> practice. >> >> i.e. before defining data types, it would be good to know what >> implementors have done, and then define types that match that. >> >> However, implementors are largely silent about all possible TACACS+ >> issues. Which makes me think that the draft should name the data type= s, >> but be a bit vague about what they contain. > Agreed, but try to be explicit about the vagueness. > > >>> I see a need for boolean, character string/text, IPv4 address, IPv6 >>> address, time interval, integer (positive ?negative). I would like a= >>> section on datatypes at the front, section 1 or 2. >> I'd agree, subject to the caveats raised above. i.e. "boolean is >> boolean, typically yes/no, but maybe also true/false, we really don't >> know..." >> >>> f) in a similar vein, you use what I take to be hexadecimal >>> representation but are inconsistent with it. I see >>> OX0D 0x0D 0x1 0x01 >>> This should be consistent and is also worth defining, as a >>> representation. >> I agree, subject to the same caveats. It would also be nice to know >> what implementations do... >> >>> g) and then there is i18n, which gets an implicit mention with UTF8 b= ut >>> harks back to d). How much of UTF8 is allowed and where; it encompas= ses >>> over 65k characters these day:-( > > Well, the approach we had in mind is printable US-ASCII for all fields,= > apart form username and passwords, which are the hard points in > interfacing to identity provides which support. For these fields, to al= low > UTF-8 on top of the byte streams. > > >> IMHO, the draft should just mention 18n, and run away screaming. :( >> >> As in, "we know about it, we don't know how to fix it, we don't know >> what implementations do, the fields are defined to be US-ASCII, if the= y >> contain anything else, that's bad." >> >>> This amounts to a lot of potential detailed change, but I would like = to >>> see consensus on the approach first before edits are proposed or made= =2E >> I think this is the right approach. >> >> Alan DeKok. >> > _______________________________________________ > OPSAWG mailing list > OPSAWG@ietf.org > https://www.ietf.org/mailman/listinfo/opsawg > --k8Hb2paCB2OWc6JQuf7OG7ke1eP9wo7wl-- --WVANWNthiddotbAWlmD3m5t6jM58xdmE1 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2 iQEcBAEBCAAGBQJZHzRCAAoJEIe2a0bZ0noziNsH/12S3dHs2vA0guOPwLvWdd1Z tCxTgTIUdMDlQvS7BG0zKohwqD+c/Q/ZknrtKS+9VI4CqLouA0SwsLYT2hmRzsAK D82qRHRBgUNZPy6e0cVvyC6X6QGZDn5ROUsOda3X3pT78ude0At0z4NYHDuuFjjr cS/lwWCEkC8eXFLmcLnU3sXfPuxi3qgIVEqfDqa3vjqXhmnb3VGw+PWD8I0+M8yX lEROGfSrrWOEOeRArHiYUxxFkxcGTeWqfmR25i34Zut7gF+VmuhSJ+QpzR5FE9ht bk8Ux5TxyuLbpdFV4+71vf1AJLKCcfYhyU53919DfXmiyLvYpbOjdKCYtT/oGUw= =Zdr9 -----END PGP SIGNATURE----- --WVANWNthiddotbAWlmD3m5t6jM58xdmE1-- From nobody Sat May 20 05:24:54 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 325FC12946B; Sat, 20 May 2017 05:24:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.522 X-Spam-Level: X-Spam-Status: No, score=-14.522 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EcI6IkMibr5d; Sat, 20 May 2017 05:24:50 -0700 (PDT) Received: from alln-iport-5.cisco.com (alln-iport-5.cisco.com [173.37.142.92]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4E6501292FC; Sat, 20 May 2017 05:24:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=19616; q=dns/txt; s=iport; t=1495283090; x=1496492690; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=iXBrlZB0lkzHRAjbRlNfNEMtULQu+7D0jucCfQBXa0o=; b=ab9y05PtyNF0NkBkv6Xl2Fm1FUtJkHRha6AGyEVi0VfdfInXJmyO2cDN XDVNfj0OjL1sR4isf3C+56fCbiDSM3cXjs0/gqLXy7Hk9igvQtUDz67YE 7Ef5156kYidNKNy9vza2Oeqvmsknn+pymYtKk19kd+f9I7lNPGJC5KX5h g=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CYAACJNCBZ/4wNJK1WBhkBAQEBAQEBA?= =?us-ascii?q?QEBAQcBAQEBAYNVgW4HjgCRcZV2gg+GJAKFfj8YAQIBAQEBAQEBayiFGQEEAUc?= =?us-ascii?q?yBQsCAQgtAQEBFjIlAgQKBAWIHgGBfQizf4M/h1gBAQEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEgiD2DG4QpFw0CBg4/CQEFhSQFkChDhXQWhyEBilGDHIUxggWKQYUqiQGLRgE?= =?us-ascii?q?fOIEKcRVGhHICAxyBYgF2hl0BDReBCoENAQEB?= X-IronPort-AV: E=Sophos;i="5.38,368,1491264000"; d="scan'208";a="427399284" Received: from alln-core-7.cisco.com ([173.36.13.140]) by alln-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 20 May 2017 12:24:48 +0000 Received: from XCH-RCD-012.cisco.com (xch-rcd-012.cisco.com [173.37.102.22]) by alln-core-7.cisco.com (8.14.5/8.14.5) with ESMTP id v4KCOm2O007407 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Sat, 20 May 2017 12:24:48 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-RCD-012.cisco.com (173.37.102.22) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Sat, 20 May 2017 07:24:47 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1210.000; Sat, 20 May 2017 07:24:47 -0500 From: "Douglas Gash (dcmgash)" To: Alan DeKok CC: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHxblMAgADBTACAA2Ki4oAAEfVNgAB2p4CAAUHjJIAAZjOA///0HoCAABakgIABKmYAgASd+oA= Date: Sat, 20 May 2017 12:24:47 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> <6B9DFA23-41BD-4896-B80C-EC0EAB51D5FD@deployingradius.com> In-Reply-To: <6B9DFA23-41BD-4896-B80C-EC0EAB51D5FD@deployingradius.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.0.161029 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.1.6] Content-Type: text/plain; charset="iso-8859-1" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 May 2017 12:24:53 -0000 As always, thanks for the comments! Regards, Doug Inline... On 17/05/2017 15:54, "Alan DeKok" wrote: >On May 16, 2017, at 4:06 PM, Douglas Gash (dcmgash) >wrote: >> Many items are marked with just [Agree], if it seems there is a trivial >>way to adjust according to the comment. > > Thanks. I'll comment on things I have comments on, and remove >everything else. > >> 3.5 ... >> =20 >> - Unused fixed length fields SHOULD have values of zero. >> =20 >> * what happens when they don't? I suggest adding text saying that the >> fields are ignored. >> [Agree, changed text to: "To signal that any variable length data >>fields are unused, their >> length value is set to zero." As to what happens when fields are >>unused, this will depend upon the fields] > > I meant what happens when an unused field has a non-zero length? > > If the field is unused, the spec should say the field is ignored, and >treated as if it did not exist. Agreed, though I=B9m not sure how an unused field would not be ignored, almost by definition,. The only circumstance I can think of where a field has data but is unused may not be ignored is for logging, are you thinking we should preclude such? > >> ... This document does not discuss the management and storage of >> those keys. ... >> =20 >> * there should be some discussion in the Security Considerations section >> about this. Otherwise, this subject will be brought up in the security >> review. >> [Will be happy to stand corrected, but that strikes me as both outside >>the documentation of the protocol, and likely to lock in practices that >>will become out-of-date.] > > The draft should also document recommended practices for how to use the >protocol, such as how keys should be managed / generated / stored. > > i.e. "As the security of the obfuscation method is unknown, keys >SHOULD be produced via a CSPRNG, keys SHOULD be different for every >client/server pair", etc. > > The original RADIUS RFC used a secret key, but didn't forbid a key of >zero length. I ran into at least one vendor who didn't allow for the >entry of secret keys, and always set it to a zero-length string. The >next rev of the RFC forbade that... So I think the specification of secrets for obfuscated option is, as you say, critical, and will provide some guidance such as non-empty. Also will make sure we include that servers MUST support capability of secret per client-server tuple (see next comment). But I=B9m not so sure what we should say about storage. > >> ... It is an implementation detail of the server and client, >> as to whether they will maintain only one key, or a different key for >> each client or server with which they communicate. For security >> reasons, the latter options MUST be available, but it is a site >> dependent decision as to whether the use of separate keys is >> appropriate. >> =20 >> * those sentences seem to disagree with each other. It's an >> "implementation detail", but it MUST be supported. I suggest requiring >> the capability of per-server and per-client keys. >> [Agree, the requirements must be supported by implementations, however >>we leave it for the implementor as to whether this is used] > > The wording is awkward. Perhaps "client implementations MUST support >per-server keys, and server implementations MUST support per-client keys". Sure, that sounds like a good suggestion. > > The sentence on "site dependent decision" can probably be removed. Or >maybe replaced with a suggestion that "using the same key for multiple >hosts is NOT RECOMMENDED" Agreed. > >> * This last sentence is confusing. Are there different secrets for >> different packets in one TCP stream? If so, nothing in the document >>says >> so. If not, then there is every reason to believe that the secret is >> mismatched. And, the *next* packet will decrypt incorrectly. Which >>means >> (again) you might as well just close the TCP connection. >> [though we would not want to restrict to a single secret on server for >>a client, we can restrict the clint that it should us just a single >>secret on a client at a time for a connection to a server. This would >>mean that we could not have single connect, multi session interaction >>from a client with multiple secrets so then we could close the >>connection] > > I'm not sure what that means... > > It should say that the same key is used for the lifetime of a TCP >connection. Though the keys can be changed in between TCP connections. > > And, if there's a key mismatch, all bets are off, and the TCP >connection is closed. Agreed.=20 > >> This is a standard ASCII authentication. The START packet may >> contain the username, but need not do so. >> =20 >> * what happens when the username is / is-not included? i.e. what do >> implementations *do*? >> [Agreed to expand. the server can of course, finish the session at any >>time, as detailed in the "session termination" section. But let's assume >>that we want the server to carry on the process, then it will retrieve >>the username as described in the following proposed text: "The START >>packet MAY >> contain the username. If the user does not include the username then >> the server MAY obtain it from the client with a CONTINUE >> TAC_PLUS_AUTHEN_STATUS_GETUSER. When the server has the username, it >> will obtain the password using a continue with >> TAC_PLUS_AUTHEN_STATUS_GETPASS. ASCII login uses the user_msg field >> for both the username and password. The data fields in both the >> START and CONTINUE packets are not used for ASCII logins, any content >> MUST be ignored. The session is composed of a single START followed >> by zero or more pairs of REPLYs and CONTINUEs, followed by a final >> REPLY indicating PASS, FAIL or ERROR."] > > OK. And if there's still no username? Do you mean, if client replies to the request to TAC_PLUS_AUTHEN_STATUS_GETUSER with an empty username. I would simply repeat the request in case it was a user error. We can document this. The protocol has a built-in limit of the number of interactions due to the seq_no, but implementations can limit interactions. We can add this detail. > >> * if this is a valid protocol flow, then it should be described. e.g. >> "Any username in the START packet is ignored", or "any username in the >> START packet MUST match the username in subsequent packets" >> [Normally, the username is in just one packet] >> =20 >> ... The data fields in both >> the START and CONTINUE packets are not used for ASCII logins. >> =20 >> * what happens if there is data in the fields? Is it ignored? >> [Agreed From perspective of protocol, yes] > > The draft needs to say so. Agreed. > >> * also, the challenge MUST be derived from a cryptographically strong >> pseudo-random number generator, and MUST change on every CHAP request. >> Otherwise, the spec allows (also silently) a fixes challenge. >> [This is interesting because, of course, the challenge is not generated >>for T+ but for a different interaction. the result of that other >>interaction is passed along to T+. These recommendations are good, but >>can we actually police this data?] > > That reply make implementation-specific assumptions. There are TACACS+ >implementations which don't get the challenge from a third-party. Just to clarify my comment: it is not an aspect of the processing of the T+ protocol that chooses the challenge. The protocol will get the challenge and response as pre-packaged unit. So I think we can demand that challenges be generated according to the spec for CHAP. But reaching into that spec to add our own criteria would, I think, be a mixing of concerns. > The draft needs to state security requirements on CHAP and the >challenges. If an implementation chooses to ignore them, then the >implementation is insecure and wrong. > > But the protocol needs to be specified securely in the draft. > >> MSCHAPv1 / MSCHAPv2: >> =20 >> The length of the challenge value can be determined from the length >> of the data field minus the length of the id (always 1 octet) and the >> length of the response field (always 49 octets). >> =20 >> * RFC 2433 says that the challenge is 8 octets. RFC 2759 says that the >> challenge is 16 octets. It would be good to re-iterate that here. >> =20 >> * i.e. smaller challenges are insecure, and should be forbidden >> [again, as T+ interaction is not involved with the generation of the >>challenges, is this something we can actually meaningfully enforce?] > > The same comments as for CHAP apply here. And no, we can't "enforce" >it, but we can demand it. Which is what the protocol specification is >about. Sure, we will update the doc for MS-CHAP in whatever way we find best for CHAP. > >> ... To perform the authentication, the server will use a the >>algorithm >> specified RFC2759 >> =20 >> * editorial: "specified IN RFC ..." >> [agreed] >> =20 >> ... ASCII change password request >> =20 >> * I suspect that the security area review will recommend that this be >> removed. Even RADIUS had "change password" removed at the behest of the >> security people. >> [Noted. I take it this not a request yet to remove though?] > > I predict that the Security Area review will raise questions about it. > > If the functionality isn't really used in current practice, it would be >best to have the draft note that the functionality exists. But that all >specification of the functionality is removed from the document, and >implementations SHOULD NOT support it. > > e.g. "flag FOO was historical, but has been removed for security >reasons. That is all." Ok, I see what you mean. We can add the SHOULD not clause here. Interesting though, as this is a significant use case for T+. Will be insteresting to see what the main objects were for why it was removed from RADIUS. > >> * what does the server do with this message? Should it be logged >> somewhere? >> [I would say, this is out of scope of the protocol, and a matter for >>implementation] > > It's a useful suggestion to implementors. > > "This message is typically logged, which helps administrators determine >reasons for failure" Sounds sensible, will add. >> =20 >> If a key is supplied, the client MAY use the key in order to >> authenticate to that host. The client may use a preconfigured key >> for the host if it has one. >> =20 >> * so the server is pushing keys to clients? The security implications >>of >> this should be discussed >> [SIDE Note: I think this part of the original draft spec is really >>worth culling. I certainly specify it should not be implemented in our >>server. I had intended to propose that is done in the next version when >>we add TLS, however, am considering proposing to do this sooner unless >>anyone objects.] > > I would suggest removing it, but noting it exists, as with the password >change above. Agreed. > >> * from a security point of view, it's unusual for a client to indicate >>to >> a server how a user was authenticated. This allows the client to claim >> authentication when none existed. >> [Areed, and server can accord appropriate confidence in this >>information with that proviso] > > That should be noted here, and in the Security Considerations section. > >> ... >> This field matches the port field in the authentication section >> (Section 4) above >> =20 >> * what is meant by "matches"? Perhaps "The definition of this field is >> the same as in Section 4". Or does the field in the authorization >>session >> have to contain the same data as the similar field from the >>authentication >> session? >> [Agreed, the first meaning] > > The draft should be updated to clarify this. Will do. > >> * what are the legal characters for an attribute name? The previous >> paragraph says US-ASCII. So is "($#@!" a legal attribute name? >> [Agreed. Yes, that is a valid name, because it does not include =3D or *= . >>the text is explicit though, do you think it needs further >>clarification?] > > It wouldn't hurt to re-iterate it. >=20 >> 6.1. The Account REQUEST Packet Body >> =20 >> TACACS+ accounting is very similar to authorization. The packet >> format is also similar. >> =20 >> * nit: that seems redundant. All of the packets use a common format. >> [The header is more consistent than the body rather than the body, is >>that what you mean?] > > I mean it would be clearer to say "both leverage a common header, with >type-specific packets using a standard layout". Sure. The original in the draft is weak. Will update. > >> * Can an accounting packet indicate an authen_type and authen_service? >>If >> so, what does that mean? >> [yes, indicating circumstances (if known) on the device] > > That should be clarified. >=20 >> * what's a "task" ? This is the first reference in the document to a >> "task". Perhaps more explanation here as to the expected use-case >> [Added text: "TACACS+ accounting is intended to record various types of >>events on clients, for example: login sessions, command entry, and >>others as required by the client implementation. These events are >>collectively referred to in `The Draft' [TheDraft] as "tasks"."] > > That's still a little unclear to me, but OK. We can clarify, but the task concept as I see it was always pretty insubstantial, so I don=B9t want to elevate it into something it wasn=B9t. When it comes down to it, it is really just a way to link accounting records for a specific session. Will move the test to clarify. > >> The START and STOP flags are mutually exclusive. When the WATCHDOG >> flag is set along with the START flag, it indicates that the update >> record is a duplicate of the original START record. >> =20 >> * why would an update duplicate the original START record? This seems >> redundant. >> [Well, here we are constrained by a clear definition form original >>draft.] > > What does it mean, tho? This document should say. i.e. portions of >the protocol should not be left as "we have no idea what this means". I think it is more a case of: it is redundant, but it was specified, so we cannot choose to change it to make it more efficient. > > If implementors don't use / support this functionality, then the >description of it can be removed from the draft. If it is used, >implementors can speak up, and help describe what this functionality does. >=20 >> * Some more questions... >> =20 >> * does the client retry an accounting packet if it doesn't get a >>response >> from the server? >> [client will get PASS or FAIL. do you mean, if the client gets a force >>disconnect for the TCP connection?] > > I mean, what happens if the client sends a packet, the TCP connection >stays open, and there's no response packet? > > Does the client retry? If so, when? If not, what happens? > > I guess similar comments should apply for accounting and >authorization... > > As we're not trying to extend the protocol, it may be good enough to >note that responses may not be received, and it's up to implementations >to decide what to do. Good point. As it is TCP, we can recommend: If not on an active single connect session then close the connection and create a new. Then in either (single/non single) resend the request. > >> * how often do the updates get sent? Saying "implementation defined" is >> OK, but some recommendations would be good. i.e. not more than 100x per >> second, and not less than 1 day apart (as extreme examples) >> [so lets stick with implementation defined, the range of T+ devices we >>see is so diverse and use cases are such that I would not like to >>constrain.] > > It would be good to have recommendations. e.g. "updates more than once >per second are NOT RECOMMEND, updates more than an hour apart are NOT >RECOMMENDED". > > The goal is to guide implementors to choosing values which won't cause >problems for everyone else. Sure, will recommend minimum of 5 seconds, but I=B9m not sure we can specif= y an upper limit as it is not mandatory. > >> * I have similar questions about the TCP connection. What happens if a >> client can't connect to a server? How often should it retry? Should it >> treat "unable to connect" as "authentication / authorization fail"? >> Should the user be forbidden *all* access if the client cannot connect >>to >> the server? Should the user be given minimal access in order to be >>able >> to diagnose server connection problems? >> [I would say that the normal approach is to treat a failure to connect >>as an ERROR condition, so that any support failover or equivalent to >>method-list can be followed. Frequently a device will have a local >>option at the end of a method list, and this local method would contain >>the options for worst case access, but I would say that this behaviour >>is out-of-scope of the protocol description.] > > The draft still needs to suggest what happens when a client can't talk >to a server. Saying "treat it like an ERROR" condition" is OK. Also >"implementations may fail-over to implementation-defined backup methods". > > It's bad to have the draft be silent on the topic. Sure, will add. > >> * nit: what's a "dialstring" ? >> =20 >> * what's a callback? How does that work? >> [These two are rather legacy, and really related to an old form of >>Network Access, so propose we can exclude] > > Sounds good. > >> * how big is the task_id? Since values can be omitted, is it OK to >>have a >> zero-length task_id? or 1 octet? >> =20 >> * are there recommendations for the content of task_id? e.g. >>incrementing >> numbers, strings, etc. >> =20 >> * is task_id mandatory to occur in accounting packets? >> [task_id is best practice, and I think we can promote it to mandatory, >>however this would be a change to spec. It is a text value (that can >>clearly encode a number), but it is widely enough used that I think >>restricting its validity would be difficult.] > > It's fine to say that task_id SHOULD be in all packets. >> =20 >> * which attributes are allowed in which packets? I presume it's not >> recommended to have a START which contains "stop_time" >> [other than task_id, there are no accepted standards for this mapping] > > The draft should say so, then. >=20 >> bytes_in >> =20 >> The number of input bytes transferred by this action >> =20 >> * input to where? This was poorly specified in RADIUS, and some >> implementations got it wrong... >> [Proposed text: The number of input bytes transferred by this action to >>the port] > > from the users system to the port... Well, can we always assume =B3users system=B2?. Often there can be somethi= ng between the user and the device (robots, scripts etc) (but I guess they may all be part of an overall system). I guess it would be more general to focus on the direction of the device port. > > Pedanticism helps here. Agreed! > :( We weren't pedantic in RADIUS, and multiple implementors screwed it >up. > > Alan DeKok. > From nobody Sun May 21 13:37:22 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A9B0129494 for ; Sun, 21 May 2017 13:37:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.912 X-Spam-Level: X-Spam-Status: No, score=-2.912 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=-1, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=btconnect.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 09rJg6ZC-X5f for ; Sun, 21 May 2017 13:37:18 -0700 (PDT) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40121.outbound.protection.outlook.com [40.107.4.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7F69129489 for ; Sun, 21 May 2017 13:37:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=btconnect.onmicrosoft.com; s=selector1-btconnect-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=/4zsxomXuRJOTPwz3ixa7MP21nEQR4cKgIKfa4KgRv8=; b=VAp0iuskXaoeXHU1B6liFRXd4IrSRCkbVHO6NZAdS1UTn0cPfD/HvYz5QVFwEF4Ud+8KJjYJdhV7hxCZJluI+hhbLag/ymxyjgn1yvszhBkdEuQbCKMFbQG+8rkSQWsb8WC/3rWAATbvbeXSXN4R4BpoQwYa52qEkmPnVTREYUw= Authentication-Results: cisco.com; dkim=none (message not signed) header.d=none;cisco.com; dmarc=none action=none header.from=btconnect.com; Received: from pc6 (86.169.157.161) by VI1PR0701MB3007.eurprd07.prod.outlook.com (2603:10a6:800:87::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1124.5; Sun, 21 May 2017 20:37:14 +0000 Message-ID: <00cd01d2d271$9fce4ac0$4001a8c0@gateway.2wire.net> From: t.petch To: "Douglas Gash (dcmgash)" , Alan DeKok , Eliot Lear CC: IETF OOPSAWG References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> <6B9DFA23-41BD-4896-B80C-EC0EAB51D5FD@deployingradius.com> <017f01d2d08c$7096de20$4001a8c0@gateway.2wire.net> <61BFF2A7-680E-433F-8D7E-E0F0B95A2DC6@deployingradius.com> <5210a082-6c5d-c7fc-b55d-abe11689c090@cisco.com> Date: Sun, 21 May 2017 21:34:09 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Originating-IP: [86.169.157.161] X-ClientProxiedBy: AM5PR0201CA0002.eurprd02.prod.outlook.com (2603:10a6:203:3d::12) To VI1PR0701MB3007.eurprd07.prod.outlook.com (2603:10a6:800:87::21) X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI1PR0701MB3007: X-MS-Office365-Filtering-Correlation-Id: efdda06c-1153-4451-cc0c-08d4a0892abb X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(201703131423075)(201703031133081); SRVR:VI1PR0701MB3007; X-Microsoft-Exchange-Diagnostics: 1; VI1PR0701MB3007; 3:HSI5pWg78oLR5J/ScBCCdZJxZKz5KtTPwz/UqQUjzIayXPN9KAd6PP5jRoqu5drFjzyV6piQlYqWi2z6Nr56tu4M1xBjSPDJpyzcua6cgqVKgbUUH0QArSOEajCUGkUJksgaW9bUd/ClKfis/f3ewQjLUBO4JPLxN8D+xKkeknfTZNdprTIVNrXHgmE5WFbezxN9H2eRcEt99r1fuZkAuhP/nRFn9Lrvx792wgcKyZD0sMLdcLIskuTykoo7zmGqOhn35Thgz5aEpVPicxjMvmr88aWyPzHmVaEerNuaWHS+5E7evHN1dOsIkRv80QuRaB+RvIMV+PpPL/MVSKDYHw==; 25:opKDuMoWs4dxCvGO+fY+Zl/Knu31mlwMzFQT9fYviMLZGtQ0MmkzE1WQL9+1Tek8rdTyKGsiPEX68vHPdd+9vHhBAyfVXEBbR2uNDevHpYEJ5NfZqwvofqCOTv2va95HI+BoHhC8bsqHEN+A0md3ZEfGKCixq7S0bITndD/xstckfkXQOXY8wgIgfea6sHMW0AdyBECAk2cwHE6swgA/ynRi5X+tY62Kk2a1Yo5bT5bhwmTdRIGgwbiMIteckLndxDmMbViTHResi6Zd3dbN3G1671vtBv29q6xbHjjkJDk0i4WEG9IM8h7MQw9nEiGGIFfE6Ob/e2ZEZP7uiMz669GBW3Nvav7DbOqNaioAXrShprce4Pro4oc5DMLB07AffP4XhGx4M56REW+Ty73tvhFnMitepR0lTI3MG+/GmIMU3u6vVrrmPRmlAE6fMiqRo7/7xukxt4ukA68g59zLyecYGUS5In8p8nTEU++Hr7U= X-Microsoft-Exchange-Diagnostics: 1; VI1PR0701MB3007; 31:p3v0jw/1Vr7kqdlOS7vqJ05HtwGJPtqgIPVp22b6px8JbC6kOoGyjQw9mVGRhVW9F5NZwttWVwqaANqFHJYsfIvKpYu7J0s8khLT9D9awBv1PS7cWPSy463eKtgmY6YwBOjNvwZkk68C/rZf1oJi5H8knPz4uuxMsRDccDsa3FpgisyMkC+27x2mOg4byZbx9tyM8skKoETsS2LeUEwWrmSGTUMU2FvM/6Gwyi7bztKvchXqoOJ3vcL+HBnroztbPMMbpa4/4skt3Qk0iWhkVw==; 20:Ia7PvZFLYmUu2nn/fM222HFh/iTW8d/fRX0+TEoeybsZxW7ZsKztVdygjRahvijWYW0+FeqOhEnxMGBEHQ/WFeTUTnKVbU7I0DmHtQrDu7xKf0aBJRucmYSfPOQ28mU1GdgXOZTmh2nr7uZQgoyacrJv5vxIAnEEYpNkdqXW/NA= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(178726229863574)(100405760836317); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(100000700036)(100105000095)(100000701036)(100105300095)(100000702036)(100105100095)(6040450)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(100000703036)(100105400095)(93006095)(93001095)(6041248)(20161123555025)(20161123564025)(20161123560025)(20161123558100)(20161123562025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148)(100000704036)(100105200095)(100000705036)(100105500095); SRVR:VI1PR0701MB3007; BCL:0; PCL:0; RULEID:(100000800036)(100110000095)(100000801036)(100110300095)(100000802036)(100110100095)(100000803036)(100110400095)(100000804036)(100110200095)(100000805036)(100110500095); SRVR:VI1PR0701MB3007; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtWSTFQUjA3MDFNQjMwMDc7NDpmS3o5ZllubzYzcVlxTk0yMktpTHBxZWdt?= =?utf-8?B?N2FidjRsMEpkWXBxSjE1bG9McGNLOVkrTE1DUUJlclpnY21aRURSWm96Y1NK?= =?utf-8?B?d3pIUXUwTGVVa2lVWWNIa24xV2dBSUh1T2MyQWV3R0g0b3hKdEd4b3lGV2dy?= =?utf-8?B?V2w0RTRpOHF3Z2VpWFNtUEhWVTNIdGprU3c4ZUZtQzBweUQybm9TU1FDTTYx?= =?utf-8?B?d3IzYUNFSVJYQTAxVTZieGE3OWxmcFVTMVRFbmRWM0trK3prMHYyRHd2U0U4?= =?utf-8?B?TUZhVGZtb2dhL2Q0Sm5pYlA1b1hWYzJSczgxV3M0ZFZNZDlLZFJVN09SOG5N?= =?utf-8?B?cDJXWXIrdGV4d0lLeFpiL1djM2RFT2YrS2c4anRYOTlMMWxuc0pIeDF6cXFV?= =?utf-8?B?a1JxaXJ2cWEwNDE1c3dpdWNPY3hpQmNSWGQyR3FYOUZkekdkV2JHbUJTWTVX?= =?utf-8?B?YmJOZWlQNVBwTjFmMHpodE0zTW0zMWFBQXhMYnNjeGwrZ2ZNS0RBaXMxYUw4?= =?utf-8?B?eG1IYzNuZ09tV1ZFZFFkQUMvZFcwTnBBREQzcjc1d0tMTy94blZ0cS9qUlNC?= =?utf-8?B?c1U1SWlsVXVSSXozWU80b3dHcDVkb05iWm54aGw2V1NLUVNVVmprd2hNdTNy?= =?utf-8?B?R09vVHVwaFVMUzFDWXBQK1ZZUFRVb3h6RkcreCtqRWdJdTZaUzdsUnNFejJp?= =?utf-8?B?bmpTK3U4UCtua0RDSkhtNm1rdFF0NFo1eEVyTCtjRmZFVXdzTXJZM3kvSk00?= =?utf-8?B?TElKU0NrWDBVTnVOVXJpQnlmc0dLamZqR3k1Q1lrK0tVYWVaRXdaSmEwWkdh?= =?utf-8?B?U2VtREZ6QzlRMG1XZkIvb2hucm9OQm14WTZmS2wxNnF3ZU9MMWZZWmtaS0Ft?= =?utf-8?B?NW9kK2JHUy9xVTUwSWU5SEpYUE5oYlF6V1g3QlJzakoycnhKa2lEWnZnYVhF?= =?utf-8?B?RkU3VkNyeFhVeUcwL0I5NS9LY2M2ZXhobEZsOUg4bFFZbi9icFF1SUFuaEhI?= =?utf-8?B?eHExTHd5d2hnU1Zlcmkza01zaTMzWlkvbk9HQUdaMUYzblZLVGU1Z3ZpTmtz?= =?utf-8?B?Nm9LcHNua2ZrRDQ0cGtwVWdoVTN6aDZIK0FiQ29sQ2JaR2owUzA3Z2pDUUtS?= =?utf-8?B?NG5hSElXdEQ0OHBURExLUDV1dW12ang3cFVObzlwYmhUazJXR1libkVSZEpB?= =?utf-8?B?VVFUZTZTWUpHYit6ZDRXVFBSMmRKNm9PTWVnZGxtbGpzRDBBbkhDRHBma3NN?= =?utf-8?B?K2pMa2lzeTFoN1JXNHNmTjhQMnNlOEFPRHBjcmRaLzQ0UHJDUks2Sm9OQWxQ?= =?utf-8?B?aUM2QmgwemorUnZMZ2FTaVJDY0VjK2xoeDREaUFHa3d5TnBqVWhMWWJGTEti?= =?utf-8?B?amI2TStJQlpKekhDT1gxWXg0YWZ0dlJnY3NsUUVDTmxGK09ZeE9xcFMwckNN?= =?utf-8?B?VCtvS0lOM1Nkem1GRzJURlNlM0xxeVZpTnJWOWRVOVFrcm9QdW13RWx2YmFE?= =?utf-8?B?STRnRVBzS0pqS1dIYTgzN1plc1E3UW92aGxYYzkyQzhjeHVwcklzT0xEb0w4?= =?utf-8?B?cXY0US9veDU2Q2VxcTBqc1lQaVgyT1QwK1ltdWt1N2hOZElRQVJoV1U1V1Fl?= =?utf-8?B?N1hmVFJjeDd5T0xJV3VGYi81dHRWV1hkNEZxbzhWQjZpR2FtTmplMXJSQT09?= X-Forefront-PRVS: 03142412E2 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(4630300001)(6009001)(39850400002)(39860400002)(39840400002)(39400400002)(39410400002)(39450400003)(13464003)(377454003)(24454002)(51444003)(6486002)(25786009)(23676002)(93886004)(575784001)(53546009)(4326008)(6116002)(53936002)(50986999)(76176999)(551544002)(81816999)(3846002)(38730400002)(86362001)(4720700003)(6666003)(42186005)(61296003)(44736005)(6246003)(6306002)(9686003)(305945005)(2906002)(66066001)(7736002)(81686999)(50466002)(966005)(189998001)(62236002)(44716002)(478600001)(2870700001)(47776003)(230783001)(50226002)(5660300001)(116806002)(8676002)(5820100001)(229853002)(33646002)(81166006); DIR:OUT; SFP:1102; SCL:1; SRVR:VI1PR0701MB3007; H:pc6; FPR:; SPF:None; MLV:sfv; LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtWSTFQUjA3MDFNQjMwMDc7MjM6Wkd1R3lTdEFUVlowU2RkRnFIU0ZZM3RI?= =?utf-8?B?SE5xY3hXS3NSNFEzSCs2a0RxQTl3UFM5SENmVW4zeVNwTzlIa3FnOHhYRXR6?= =?utf-8?B?TVkvUGIybGc1YWo3YXZYejlJYTQvUU12cEFBUjBkS05tYnJweG9qdlM4cDk4?= =?utf-8?B?eFBxYzE4YzFtUWtSaW5zd1R3NVd4bHdlWEFEeFFWNVFUaTRpVTYrT0k3WS9Z?= =?utf-8?B?K0RNVE5NdGpNa1FyQ0k2SUNPM2p5NHZEczl2WSt0bjdhdjlnbEFUQkFraFBQ?= =?utf-8?B?OUtwbkg0SndxdnFMM042RE5GbGRmRjJjODJneDFhYkV2dElUSjg3RmRYcCtU?= =?utf-8?B?dVRpMzBvZ09nWkhsU2xXWnFCZHYrNTlBY0tKeUh3UkM5Vk1FWlBGVTQ2Vkhz?= =?utf-8?B?WmRSV3ZVVWR6dWp1TEF2MWdKSExaZVhLU2FsbjVGOXFldlpPNzVmK1ZoSXRM?= =?utf-8?B?ZkJUL1RyeHBEdXNXc3h4NmVwTGxrdVNjOEVQM1kvbmY5d0s2djV1SFZjaS9R?= =?utf-8?B?TnRrOFpoNlVWc0FYR1pQSVpOWm02dE1uY3dPWGg4bVpyTVpWT3Q5TzFpc00y?= =?utf-8?B?WnQ1T2c1U09Odjg0dkE5eUNsL0FtNjFTWkNvT1ZjYUg1RGxHSTVwTVN2d3JK?= =?utf-8?B?Ti9UNDdEaVlmbjU5SnUrRHB0ZkRHd0VQRXpicGQyMm1sQjFHZVlrdDF2azdZ?= =?utf-8?B?UkNIb2dZS2NaSk1UVHFmblgwcmo1VVRZekRiRkYvRWFIQ2t0elVyRjJ3Y09i?= =?utf-8?B?eVMyYzV2ZUtYTVJVWHlhcVV2aEFNUDRsdEN1b1o4M2Jsc1hsMDdkMWZsT0pW?= =?utf-8?B?N2lQNmtQQkN5YnlzTllsaGJTV0pPeGEwT0lTd29lVG1mS2o2N0N4ZHRBSHpl?= =?utf-8?B?aTdiaUVGRnk3R3lxQTNkMVBnK2lSZ2k2M3VyaHdjWTBPRkIrOVpaWXpCM09M?= =?utf-8?B?NGZ1bXlEbGd6L08rUzJHak9LbzVzQ2xTNGtEQ1ZvRFhNSEYvYms0aWFuUlFs?= =?utf-8?B?OEd6Wm41T1l0NHhKK3FPVmJoT2JqS1R3RVN0U1V4RkszYlZuM1F0a1c5a3Ny?= =?utf-8?B?cXYvNlRJMzNwOCtsbzJLRmc3djNPSWtObFFLVEh2angwY3pxeThSNlBOZ1Q3?= =?utf-8?B?SGt4c2dmWHdjN3N4TGFlazB0eEpHc2hXK0w4d2k0SVF3QWhHc3VvZUQ1VUJ1?= =?utf-8?B?NmJDdFp2NEpqOEJvazByOGE0QXR2cWtIWEJ4cGRrZWFuQndtTVozeDZERDY3?= =?utf-8?B?MGVwNXlLVW9RUnNjdkttNmVmNEpRcmYrTjJiR28rSUY3UDg2UlNyRk9PNTZD?= =?utf-8?B?WUhZcFVEU1N1Qng1a3AxaW5KdjlsWTByd0FIK0N2OEJ2UHpSV3E0NjBCVTho?= =?utf-8?B?b0FFanZpK1ZBY2o3L0tTM0dRN1pveFVWcGNUOFBvSUNyZnJ0bzM1OG9teW1Q?= =?utf-8?B?OHlqRkxidmc1djZhLy9rV3hUUjFsNFBnRlhYZ0kwYWM0RW9GbzZ5UVZLaGV4?= =?utf-8?B?YWRraWRmYW5pN3AzNENpMi9YYS9POE1xTytLSDN6Q1FBbjRRczlncTJNYnI0?= =?utf-8?B?Y0ZQWC9YZWVGZ212MC9xU2VPRzZhcHdXRDcwRC9GcG5QZEtBdm5VT1ZLbTRl?= =?utf-8?B?SFFHWHhZZ1Y2MU0wZCtER3REY3FCODFUV3J4WXFlNjFSd2VBOG9PUWptMHFK?= =?utf-8?B?NmF3THcvdG83d1ZxVlI0U2xITldJY2FjbXJ1M2lHdDVDSVp3UHBtR1dIRnRC?= =?utf-8?B?OURoazJWYlo2MUtwQ3hSQmhtdkNNblF2VkpKeFhLWHdEOC9GYktES2V0UVB4?= =?utf-8?B?VzdsdDFLUEUyTzh6VWx0aGxRQzlUTlA0c1QyRmNTR0RzM2lBd21ra1dySmRT?= =?utf-8?B?cEpYY0pwOStOa1JycFpHT2xacHJvSXB0dEhITG1QN3N0dkpBYUVxY3l4QTJw?= =?utf-8?B?V1pVR2hLMzBHSEE9PQ==?= X-Microsoft-Exchange-Diagnostics: 1; VI1PR0701MB3007; 6:hWpQERTMxczebgDhN3rZjEUoa6oLPzoEyWW8XjJ/cfI1r4XBKNGzsmaMzw762Q9NaFng/QkgosT1n5U84a+ABT5QmTYgQVcSdpnrZbPc4HNKhq8RzBFAN3v0cn8lhpYjSqAjOIys/hu89XS+f8z9OTmFC3jyX9CfTck1kokHsRp9Ayq7P+AUwv/8V9y4KJnhb49w6xZzRVV1KOYsBYgh2tb74C49Jk8j0Hr3jP9MF5NaLFp8MqhLKZyWA5FSuD+JqgtoT40RMwV3Zp6RIeFlcUNNwlIIGGSC7EeEKW59YQFsexh9PFR2gpqXpYaxcnXyyOlb5YhVn6V80wOETOp7TiV/EDo5qUYeKUwPDneZ1A7HAOGM543kVJDET3t7s81Xy+ua6BloXVF5n0Syx4HKMfzrmEFTOFF7BsCT80/ZEK+S6aB5ax06HQgeS2TouNKes/lh2053V0We7a3AqjwINoBU+OIzxNeRC3Y0cZHPABHFWOlSUgPGD8eRfAPbjUT9DJyycnEAxDNDpcYHhU3PXg== X-Microsoft-Exchange-Diagnostics: 1; VI1PR0701MB3007; 5:zu5O2G/TS/BGzdKeg+QsmyFZiPzYeHrNP4SjehHLvtpcf+IzqAMsWZfs/VxQVBKavqg1hZXgKPjtVpxus6CKBKV7OX74uboWiq1OeAgcgfFEOP9YmAuX6b4xN7+t5G1ofBQcMeEN9Je+x9mzUy3rrSLyikA5zFcUmOktOolqdR64cz0GvLEfjsEi+wjyINelaBH+NhIUw09S1+8YllqYRgCFV/sHi37KWF9E47xwNBwcMDIQTRwD2545ntT2U9eMDc2SnDXPIkACPJVkK6WnPmc4HLIk9YcjGlfImfizswLzpIPGh17swVSJJNea3Espu9D+n9nA3hnHBA4BQIqlVNF0Oj02+6DEofS7FwV9Jy/AhSPlpQ57TQDBwiVxDNEFlNn475Lwp3Ma9M8shvbQQ6nLc5IOzWlo9pI/YXxsD5yL/DW0hnxjdJKwi2bNsLWeKw0+6Uw+szh2j9gxdb+zNMAUx1VWruWrwXtX6as7Z93hz9NZd0dTT9pvBHoKbt7s; 24:eR2OwNcwSJre6zql6KYFt3aeomteSmkvVaaJ6RRCajr714tNz2CXVWcxCyJKeB7u4/9Rv3y5B6F2y1XXwI2xhoIRrgTu/BZGEj30iCj2G1A= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; VI1PR0701MB3007; 7:YsN00V5H1qeVv6dO/L8/PDKnTdd4G4KeTbltHSwW03rv6okofCHn5CXgVYh04Fk+Kv6FCEm7vhbGbqffE2+ec8oHzqwZwvw3Zwn0qurKZsNp31Z46EdPAibI3K30I23BmG0pDfWjcPxy6XYnsW/rorhPDpHGIwnk3F08wIcHg9rAa9fPfpsx6yG569HrJFqkw+KpUBgcDO0NIjrBvl09oOY68BApTlQ50TCyWt8tw4InCzp3RrL4Pwk6K6S795dgxK385XeaS2KJsn71xFysoYbrNh4uYgd3ew5h9P1GkStVoFS8iQ2YI3TFZHavmkD/v5bGVwo6lBbu0cJlTeC5MA== X-OriginatorOrg: btconnect.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 May 2017 20:37:14.8771 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0701MB3007 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 ASCII X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 May 2017 20:37:21 -0000 ----- Original Message ----- Sent: Friday, May 19, 2017 7:06 PM Isn't this handled by RFC 20? Eliot RFC20, AFACT, does not define Boolean, or Numeric or Printable (albeit something which the current I-D does not currently use) while its definition of 'text' (which the I-D does use) is based on starting with STX so IMHO, no. RFC20 is just a list of 128 characters with a numeric code. Every other protocol specification I can think of places restrictions thereon; DC3 in a username, anyone? RFC4234 is to me a good example of an RFC that starts with RFC20 (or the equivalent thereof) and produces something more usable. Tom Petch On 5/19/17 7:51 PM, Douglas Gash (dcmgash) wrote: > > On 19/05/2017 18:11, "Alan DeKok" wrote: > >> On May 19, 2017, at 6:38 AM, t.petch wrote: >>> Another fresh topic, so a slight change in the Subject: >>> >>> I think that the use of the term ASCII needs more thought. >> Speaking only as an opinionated WG member... yes. >> >>> d) in some places, I think that the term ASCII is being used too >>> loosely. ASCII is a character set and an encoding. If you simply say >>> US-ASCII, then you are including DC3 and FF, for example, which are >>> unlikely to be valid. Some use US-ASCII to mean printable ASCII, some >>> to mean alphameric plus a few others such as hyphen-minus and period. >>> This needs defining. I don't know how many different character sets you >>> have - I was surprised that '&£#' (or some such) is a valid identifier >>> in places where an equal sign is not - so this needs more work. >> I agree. > Will align the ASCII references for sure, and tie down. I propose to > restrict to printable. Though, to add to complexity: it is common > practice, for example, to include newline in banners. > >>> e) this leads into data types, which Alan raised. Boolean is used as a >>> data type. (I have seen it as a character string of 'true'/'false' of >>> '0'/'1' with zero meaning either true or false or vice versa or as a >>> binary integer of some number of bits or ....) As Alan implied, section >>> 7 and others are full of data types but on the one hand, what type it is >>> is usually omitted and on the other hand, the data types are not >>> defined. >> The main issue with data types is that TACACS+ is a protocol based on >> printable strings. So "data types" really means "printed versions of >> data types", which is a lot more problematic than "32-bit integer". > I agree. Will put a section in regarding at a types, specifically for > attributes (As Alan pointed out). > >>> You need to define datatypes; from the current I-D, I do not know how >>> many there would be; probably not many. Look for example at TLS >>> (RFC5246) or YANG (RFC6020) which nail down the datatypes, semantic and >>> encoding, before they define data structures. This is what I think that >>> you should do, on a smaller scale. Since YANG is being so widely >>> deployed, you would get brownie points IMO for being in line with YANG >>> wherever possible >> That's good, tho there are inconsistencies. e.g. Yang "string" doesn't >> exactly map to TACACS+ "US-ASCII thing". Yang "boolean" is "true/false", >> while TACACS+ has used "yes/no". >> >> We added data types to RADIUS, because it had (roughly) data types from >> day one, 32-bit integers, and all of the implementors had already agreed >> on meanings / encodings for them. So RFC8044 was just a codification of >> existing practices, and not any change to implementations. >> >> Then there's the additional issue of trying to define data types for a >> protocol that's entirely string based, and has 18 years of implementation >> practice. >> >> i.e. before defining data types, it would be good to know what >> implementors have done, and then define types that match that. >> >> However, implementors are largely silent about all possible TACACS+ >> issues. Which makes me think that the draft should name the data types, >> but be a bit vague about what they contain. > Agreed, but try to be explicit about the vagueness. > > >>> I see a need for boolean, character string/text, IPv4 address, IPv6 >>> address, time interval, integer (positive ?negative). I would like a >>> section on datatypes at the front, section 1 or 2. >> I'd agree, subject to the caveats raised above. i.e. "boolean is >> boolean, typically yes/no, but maybe also true/false, we really don't >> know..." >> >>> f) in a similar vein, you use what I take to be hexadecimal >>> representation but are inconsistent with it. I see >>> OX0D 0x0D 0x1 0x01 >>> This should be consistent and is also worth defining, as a >>> representation. >> I agree, subject to the same caveats. It would also be nice to know >> what implementations do... >> >>> g) and then there is i18n, which gets an implicit mention with UTF8 but >>> harks back to d). How much of UTF8 is allowed and where; it encompasses >>> over 65k characters these day:-( > > Well, the approach we had in mind is printable US-ASCII for all fields, > apart form username and passwords, which are the hard points in > interfacing to identity provides which support. For these fields, to allow > UTF-8 on top of the byte streams. > > >> IMHO, the draft should just mention 18n, and run away screaming. :( >> >> As in, "we know about it, we don't know how to fix it, we don't know >> what implementations do, the fields are defined to be US-ASCII, if they >> contain anything else, that's bad." >> >>> This amounts to a lot of potential detailed change, but I would like to >>> see consensus on the approach first before edits are proposed or made. >> I think this is the right approach. >> >> Alan DeKok. >> > _______________________________________________ > OPSAWG mailing list > OPSAWG@ietf.org > https://www.ietf.org/mailman/listinfo/opsawg > From nobody Sun May 21 23:50:10 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8521A1286B1; Sun, 21 May 2017 23:49:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.586 X-Spam-Level: * X-Spam-Status: No, score=1.586 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FORGED_HOTMAIL_RCVD2=0.874, FREEMAIL_FROM=0.001, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=hotmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IaFe-jw6KY3D; Sun, 21 May 2017 23:49:56 -0700 (PDT) Received: from APC01-HK2-obe.outbound.protection.outlook.com (mail-oln040092255086.outbound.protection.outlook.com [40.92.255.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5C11612706D; Sun, 21 May 2017 23:49:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=tUrPdiCPMbbY1xMaklXLDntPCcMtM7mG63WZpOg9gA0=; b=KLE+34ho3+YpXlpaEqJUwzIog0XWU6C3BduMFwxUL0Jwsk2X2awqCvFxED4IHnY52WdJBh43RCVFpJnZlzTQn3S4BaDknZhunf0YllYUsY7xCtGQWK/44OG8aNvhx1znzrg3LRLkbLgEksDZRjZOOwo8ByPrlWSpdXP0OWyXWhOGmnjG2Ddy80ozmy73Lgh6KUwPJuzLXii6Nuh1spxqzXjpQR8SJ243IAYiz+dh/G+Zbm9SwPylBbn4UrMbuPoHGjZOZGSJ+GtGw6ewBXeBBeb1zLMzoo1ovvklKU5OWg7Z9E6fZAwYpd9jqDjSBwfnass4/uGzhsbhuS/Q385jVA== Received: from PU1APC01FT018.eop-APC01.prod.protection.outlook.com (10.152.252.55) by PU1APC01HT135.eop-APC01.prod.protection.outlook.com (10.152.252.197) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1075.5; Mon, 22 May 2017 06:49:52 +0000 Received: from HK2PR0601MB1361.apcprd06.prod.outlook.com (10.152.252.59) by PU1APC01FT018.mail.protection.outlook.com (10.152.253.189) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1075.5 via Frontend Transport; Mon, 22 May 2017 06:49:51 +0000 Received: from HK2PR0601MB1361.apcprd06.prod.outlook.com ([fe80::2115:a445:9d1f:b88b]) by HK2PR0601MB1361.apcprd06.prod.outlook.com ([fe80::2115:a445:9d1f:b88b%14]) with mapi id 15.01.1101.019; Mon, 22 May 2017 06:49:51 +0000 From: li zhenqiang To: opsawg , idr , "ipfix@ietf.org" Thread-Topic: discussion about exporting BGP community information in IPFIX Thread-Index: AQHS0sec79+PG+QhZkiBAviflUwRGQ== Date: Mon, 22 May 2017 06:49:51 +0000 Message-ID: Accept-Language: zh-CN, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=hotmail.com; x-incomingtopheadermarker: OriginalChecksum:8047A2B209D0B41D3929C5AD5A78B02155A16A3143AA106D15A6D33A1732F3CE; UpperCasedChecksum:ACEA18884C07D3750BC5AF0C97E0D7AA38D04CEA0A983E399109AA3D7DDCE0D1; SizeAsReceived:8022; Count:40 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; PU1APC01HT135; 5:Paud577amoEGtc0kWIic3JwYoaPvA/AUVsMUO6QuKAC9GD7EnblYSVpdWFRzOroHsKuhriPhq2kuDDKWh8DDKTF2VmLPqs0IlWz8WpZRxRcc/NvAi4K7/yxj77orKPKDAVv3eEkzWk0fFP9+7FNMrg==; 24:AqyULVUqDjRl+AX5hfCW+Lo0+3c6CD2Q9oQ/PFiE+CEylMyBxWQmfT5u5SBsPuyfLJ3E7qASFcuYQBclVL+gtU/aWydUbC1CBEwAi5M6tyo=; 7:3/J3P5RMKJlI8TbXwHNTlf7Nsw0dLA6YAQ6Joh4RYqS5vIKwfFIkR8Jdj6T+zLTdlJrRQU4phScTNMLX1TQc1syTXL1lEWVO3TnI6yL/JCyq92ulu1p3+06x8eL9LK1iC+AUfyNmm89I6m/CFgoBFjsglNZ0pymu7ZzhEAIGagJatx5uJVjuH+8bz97EMnF34v5BAI7hMXra9+hUl3kj2HuFO1l38OeJxMgBfqCvkYjNLFvjku/O8aJ2mNQBDX95QZOIVjfUsTSykQsIk4j/HYM2xN9ecqGQr72nPVryqE2s3bD7QfLN8LVzWuGJZis9 x-incomingheadercount: 40 x-eopattributedmessage: 0 x-forefront-antispam-report: EFV:NLI; SFV:NSPM; SFS:(7070007)(98901004); DIR:OUT; SFP:1901; SCL:1; SRVR:PU1APC01HT135; H:HK2PR0601MB1361.apcprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; x-ms-office365-filtering-correlation-id: db830bac-71df-40c2-3d58-08d4a0debcc3 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(201702061074)(5061506573)(5061507331)(1603103135)(2017031320274)(2017031324274)(2017031323274)(2017031322274)(1601125374)(1603101448)(1701031045); SRVR:PU1APC01HT135; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(444000031); SRVR:PU1APC01HT135; BCL:0; PCL:0; RULEID:; SRVR:PU1APC01HT135; x-forefront-prvs: 03152A99FF spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_HK2PR0601MB13617E5EA5828A10E5B3D1A6FCF80HK2PR0601MB1361_" MIME-Version: 1.0 X-OriginatorOrg: hotmail.com X-MS-Exchange-CrossTenant-originalarrivaltime: 22 May 2017 06:49:51.8992 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Internet X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-Transport-CrossTenantHeadersStamped: PU1APC01HT135 Archived-At: Subject: [OPSAWG] discussion about exporting BGP community information in IPFIX X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 May 2017 06:49:57 -0000 --_000_HK2PR0601MB13617E5EA5828A10E5B3D1A6FCF80HK2PR0601MB1361_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hello experts from OPSAWG, IDR and IPFIX, This mail is to follow up the discussion in the mail lists and face to face= meetings. Since traffic aggregation in BGP community granularity is useful for severa= l applications such as backbone network traffic engineering, https://datatr= acker.ietf.org/doc/draft-ietf-opsawg-ipfix-bgp-community/ introduces new in= formation elements(IEs) in IPFIX to export the BGP community information of= a specific traffic flow. At present, this draft only defines the IEs for s= tandard community specified in RFC1997. To solve the following two signific= ant questions raised in the previous meetings and mails, I solicit more com= ments and solution alternatives. Question 1: Does one IPFIX message have enough space to fit all the commun= ities related to a specific flow? BGP community, including standard, extended, large and community container,= is a path attribute of BGP distributed in an update message. Since the ma= ximum length of one BGP message is 4096 bytes as per RFC4271 and 64K bytes= for one IPFIX message as per RFC7011, the answer for this question SHOULD = be yes. Howerer, some experts say the specification for BGP message lenth i= n RFC4271 is out of date. Its length is not limited to 4096 bytes. But I d= o not know the new specification. Solution alternatives for this question a= re also welcomed. Question 2: Do we need to cover other kinds of BGP communities, such as ext= ended, large and community container? Based on previous discussion, large community defined in RFC8092 will be co= vered in the next version, since it has the same application purpose as sta= ndard community. Till now, we do not reach consensus about extended communi= ty defined in RFC4360 and community container defined in https://datatracke= r.ietf.org/doc/draft-ietf-idr-wide-bgp-communities/. We usually do not use = the statistical information based on extended community or community contai= ner to do traffic engineering tasks. If you think it is useful to export th= ese two kinds of BGP community informaiton in IPFIX, please show your opini= ons and application use cases. Thank you all very much and best regards, ________________________________ li_zhenqiang@hotmail.com --_000_HK2PR0601MB13617E5EA5828A10E5B3D1A6FCF80HK2PR0601MB1361_ Content-Type: text/html; charset="us-ascii" Content-ID: <402CE4E4BB0F8647ACB5BF2E574ABEDD@apcprd06.prod.outlook.com> Content-Transfer-Encoding: quoted-printable
Hello experts from OPSAWG, IDR and IPFIX,

This mail is to follow up the discussion in the mail lists and face to= face meetings.

Since traffic aggregation in BGP community = ;granularity is useful for several applications&nb= sp;such as backbone network traffic engineering,&n= bsp;https://datatracker.ietf.org/doc/draft-ietf-op= sawg-ipfix-bgp-community/ introduces = ;new information elements(IEs) in IPFIX to export the&= nbsp;BGP community information of a specific = traffic flow. At present, this draft only defines the IEs for standard= community specified in RFC1997. To solve the following two significant que= stions raised in the previous meetings and mails, I solicit more comments and solution alternatives.

Question 1: Does one IPFIX message&n= bsp; have enough space to fit all the&nb= sp;communities related to a specific flow? 
BGP community, including standard, extended, la= rge and community container, is a path  = attribute of BGP distributed in an update&nbs= p;message. Since the maximum length of one BGP message is 40= 96  bytes as per RFC4271 and 64K bytes for=  one IPFIX message as per RFC7011, the answer= for this question SHOULD be yes. Howerer, some experts say the specificati= on for BGP message lenth in RFC4271  is out of date. Its len= gth is not limited to 4096 bytes. But I do not know the new specification. Solution alternatives for this question are al= so welcomed.

Question 2: Do we ne= ed to cover other kinds of BGP communiti= es, such as extended, large and community container?
Based on previous discussion, large community defined in= RFC8092 will be covered in the next version, since it has the same applica= tion purpose as standard community. Till now, we do not reach consensus about extended community defined in RF= C4360 and community container defined in <= a href=3D"https://datatracker.ietf.org/doc/draft-ietf-idr-wide-bgp-communit= ies/" style=3D"font-size: 10.5pt; line-height: 1.5; background-color: windo= w;">https://datatracker.ietf.org/doc/draft-ietf-idr-wide-bgp-communities/. We usually do not use the statistical information based on extended commun= ity or community container to do traffic engineering tasks. If you think it= is useful to export these two kinds of BGP community informaiton in IPFIX,= please show your opinions and application use cases. 

Thank you all very much and best regards,

li_zhenqiang@hotmail.com
--_000_HK2PR0601MB13617E5EA5828A10E5B3D1A6FCF80HK2PR0601MB1361_-- From nobody Mon May 22 19:23:50 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB363128E19; Mon, 22 May 2017 19:23:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.502 X-Spam-Level: X-Spam-Status: No, score=-0.502 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id acRCwYImc-5g; Mon, 22 May 2017 19:23:44 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1AA2812951C; Mon, 22 May 2017 19:23:40 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 9BEEEE007; Mon, 22 May 2017 22:50:41 -0400 (EDT) Received: from obiwan.sandelman.ca (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 47099636E0; Mon, 22 May 2017 22:23:39 -0400 (EDT) From: Michael Richardson To: Anima WG , Eliot Lear cc: ibagdona@gmail.com, Zhoutianran , "opsawg\@ietf.org" In-Reply-To: <031d87aa-1839-d7af-0723-dd9a2aa7ad0a@cisco.com> References: <031d87aa-1839-d7af-0723-dd9a2aa7ad0a@cisco.com> X-Mailer: MH-E 8.6; nmh 1.6+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [OPSAWG] [Anima] dealing with multiple manufacturer services with a single certificate extension X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 May 2017 02:23:47 -0000 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable I've read through the thread. It took more brain-power that I've had available of recent. Let me ask some clarification questions about the original proposal. I generally agree with Max that the /.well-known/ part can be omitted. I also prefer passive (static file) initial interactions so that the initial contact point can be most easily maintained over a period of decades. I was surprised when some proprietary uses like this would point = at the www.example.com, rather than something more divorced from marketing, like a "bootstrap.example.com". So I rather like the mfg-services reply which is essentially a redirect which can be updated over the years. > https://example.com/.well-known/mfg/modelname > > which would return something like: > >{ > "mfg-services" : [ > "mud", "v1", "https://mud.example.com/Frobmaster3000.json", > "anima", "v1", "https://masa.example.com/masa-service" > ] >} correct? In this case, the modelname is there to distinguish phones From=20printers from home-routers, which might well be very separate divisions. > At the moment, more manufacturers are coming back to me to say that we > should just leave these as separate and distinct mechanisms. I think that= 's > the simplest approach. Distinct mechanisms, but common certificates? Or distinct certificates? > It seems to me the simplest way to handle this sort of thing is to create= a > table that MUD/ANIMA controllers simply download when they see the URL. It > might look something like this: When you say ANIMA controller, I think you mean the JRC? =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAlkjnSoACgkQgItw+93Q 3WVdmggAurbCds8uJ6tiRZsJPDQSdEgtI3W7TYiX4togTkWe1mwHFDRmBUF0x4zX FigvareLRRpaOv6M33grxrCwkNdwGxw0le8zpTc8YP51LNk4OHMrAptOQe7SvfEZ djaJHB5CYfHJqJgKL9rdP6Jo4ceCxNlXTgnI70E84QxB/eOS4lgjl1/GMDPuhYMG kWHlcRjFNosCXl2fYT9WXQqixvURcAXvDyc8RYspqj4XunUpWJ+D361lPjCt0vOh 0ZKo7zdD0rV22CqvYtKXDe7v1qJYPiZ3QCiqYOFwtBOyDdQl48f96gCdyezIchSx livFGnqAtlHOEZOHRcL9eD/Ypcpsxg== =QU1S -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue May 23 07:03:38 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FCFD128C83; Tue, 23 May 2017 07:03:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.002 X-Spam-Level: X-Spam-Status: No, score=-0.002 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6bs8vdVjzUyY; Tue, 23 May 2017 07:03:34 -0700 (PDT) Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 3F8941292F4; Tue, 23 May 2017 07:03:34 -0700 (PDT) Received: from [192.168.20.47] (CPEf4cc552207f0-CM00fc8dce0fa0.cpe.net.cable.rogers.com [99.230.129.191]) by mail.networkradius.com (Postfix) with ESMTPSA id B2D5C2C5; Tue, 23 May 2017 14:03:32 +0000 (UTC) Content-Type: text/plain; charset=iso-8859-1 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Alan DeKok In-Reply-To: Date: Tue, 23 May 2017 10:03:30 -0400 Cc: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <460D8E65-E5B1-4E32-9E5D-8965F2FB4F01@deployingradius.com> References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> <6B9DFA23-41BD-4896-B80C-EC0EAB51D5FD@deployingradius.com> To: "Douglas Gash (dcmgash)" X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 May 2017 14:03:37 -0000 On May 20, 2017, at 8:24 AM, Douglas Gash (dcmgash) = wrote: >> If the field is unused, the spec should say the field is ignored, and >> treated as if it did not exist. >=20 > Agreed, though I=B9m not sure how an unused field would not be = ignored, > almost by definition,. The only circumstance I can think of where a = field > has data but is unused may not be ignored is for logging, are you = thinking > we should preclude such? No. Nut the draft needs to say what to do. If the protocol has provisions for something to happen, then the draft = needs to say what implementations should do when that thing happens. In this case, it should state that unused fields are ignored, and = treated as if they were not present. >> The original RADIUS RFC used a secret key, but didn't forbid a key of >> zero length. I ran into at least one vendor who didn't allow for the >> entry of secret keys, and always set it to a zero-length string. The >> next rev of the RFC forbade that... >=20 > So I think the specification of secrets for obfuscated option is, as = you > say, critical, and will provide some guidance such as non-empty. Also = will > make sure we include that servers MUST support capability of secret = per > client-server tuple (see next comment). And it should suggest a minimum secret length. > But I=B9m not so sure what we should say about storage. "secret keys need to be kept secret".=20 >> OK. And if there's still no username? >=20 > Do you mean, if client replies to the request to > TAC_PLUS_AUTHEN_STATUS_GETUSER with an empty username. I would simply > repeat the request in case it was a user error. We can document this. = The > protocol has a built-in limit of the number of interactions due to the > seq_no, but implementations can limit interactions. >=20 > We can add this detail. Thanks. My $0.02 is that the username SHOULD be in the first packet. = If not, it MUST be in the second packet. If not, the session is broken, = and the server returns ERROR. i.e. relying on the 256 packet limit for authentication is probably = too lax. ... RE: CHAP challenges and length >> That reply make implementation-specific assumptions. There are = TACACS+ >> implementations which don't get the challenge from a third-party. >=20 > Just to clarify my comment: it is not an aspect of the processing of = the > T+ protocol that chooses the challenge. The protocol will get the > challenge and response as pre-packaged unit. If the protocol transports data without looking at it, it's fine to = treat that data as an opaque blob. If the protocol looks at the data, = the draft should have requirements on the data format. For an example, see: https://tools.ietf.org/html/rfc2865#section-5.40 The CHAP-Challenge attribute in RADIUS is defined to have at least 5 = octets of challenge data. > So I think we can demand that challenges be generated according to the > spec for CHAP. But reaching into that spec to add our own criteria = would, > I think, be a mixing of concerns. Nope. The TACACS+ server which authenticates the user should be = secure by design. This means rejecting zero-length challenges, and = challenges which "too short". I would suggest that the challenges are a minimum of 8 octets in = length. ... RE: password changes. > Ok, I see what you mean. We can add the SHOULD not clause here. >=20 > Interesting though, as this is a significant use case for T+. Will be > insteresting to see what the main objects were for why it was removed = from > RADIUS. It was insecure, and no one liked it. The other reasons have been = largely lost to time. >>> The START and STOP flags are mutually exclusive. When the = WATCHDOG >>> flag is set along with the START flag, it indicates that the = update >>> record is a duplicate of the original START record. >>>=20 >>> * why would an update duplicate the original START record? This = seems >>> redundant. >>> [Well, here we are constrained by a clear definition form original >>> draft.] >>=20 >> What does it mean, tho? This document should say. i.e. portions of >> the protocol should not be left as "we have no idea what this means". >=20 > I think it is more a case of: it is redundant, but it was specified, = so we > cannot choose to change it to make it more efficient. It's not about being "more efficient". It's about specifying what = this means. I have no idea what it means to duplicate a START record. Is the data = in the second START the same? Is it different? What is done in either = case? Again, you need to document the protocol. I'm not sure this point is = getting across. If you don't know what a portion of the protocol means, = then either find out and document it, or document that "this exists, but = we have no idea what it is, what it does, and we don't recommend that = people use it". Leaving portions of the protocol entirely undefined and = implementation-defined is bad. In RADIUS, I've authored or co-authored about 4 RFCs fixing things = which were missed or undefined, and which cause interoperability issues. = And I'm still finding things which are broken in the specs. Two in the = last month, in fact... If TACACS is to be a standard, it should be clear what portions are = well defined, and what portions are "I dunno...". That gives guidance = for future drafts as to what works, and what needs fixing. >>> * how often do the updates get sent? Saying "implementation = defined" is >>> OK, but some recommendations would be good. i.e. not more than 100x = per >>> second, and not less than 1 day apart (as extreme examples) >>> [so lets stick with implementation defined, the range of T+ devices = we >>> see is so diverse and use cases are such that I would not like to >>> constrain.] >>=20 >> It would be good to have recommendations. e.g. "updates more than = once >> per second are NOT RECOMMEND, updates more than an hour apart are NOT >> RECOMMENDED". >>=20 >> The goal is to guide implementors to choosing values which won't = cause >> problems for everyone else. >=20 > Sure, will recommend minimum of 5 seconds, but I=B9m not sure we can = specify > an upper limit as it is not mandatory. It's always good to recommend best practices, even if the behaviour = isn't mandatory. Alan DeKok. From nobody Wed May 24 07:45:44 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDFAD127873 for ; Wed, 24 May 2017 07:45:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.101 X-Spam-Level: X-Spam-Status: No, score=0.101 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=kumari-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YprGs_Zx2eiS for ; Wed, 24 May 2017 07:45:41 -0700 (PDT) Received: from mail-vk0-x236.google.com (mail-vk0-x236.google.com [IPv6:2607:f8b0:400c:c05::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 99CF4129B35 for ; Wed, 24 May 2017 07:45:41 -0700 (PDT) Received: by mail-vk0-x236.google.com with SMTP id h16so76445099vkd.2 for ; Wed, 24 May 2017 07:45:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kumari-net.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=rjadXLnri/CABE+EAq/OjDciWr4PXoJ9PjRXCmp0vOI=; b=q1Ih8fsxX4sULvsdv7Bu/BGBtIRtnD70vahUlgJ/r65ObM2XfK93zSAWW75TETXTqk 8zBdTEQhIkRhyn5Asx089/OQW4lzLHWJV9TL0Tc0KKUyMaGPES8Eb7J7yjNOPSGIM07R ZxmtxrJjLFCMfbos4g+1TItYeRXvBm94ZUA7vg4wJ3hjUHWsuHxZVRg15MEd/pGRQVVi JnMAUQZ8E7cOu6Ld4Og0NcGjnayz4YRZL6IH5ojCoif/R3HPaj3Q5nsIOFaxJRluy/21 kIMBe5eNS5PNFpn+TYPPbmX7im/u4+Kzl6EmP/LzBlkqtg8Iz6XpaH1+P+UQC9ITvK9p XNSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=rjadXLnri/CABE+EAq/OjDciWr4PXoJ9PjRXCmp0vOI=; b=LoHGPn1mANZpse85BpuxlTzAiqc605Lty456lR40N+8CcMw1o98sqLvB9wtw+jn3JS NRl1uIA8CE9ox396Bgfmz2mA83zU9iLUDiLXXisbiGxfkqKZ5VByj+lP+BcW7dhROf39 krWum40G8FEnT8CuUugtbz5rkf/QSxLSdZYHIJXCFsCyvoqrRuX+3qVd0lsk1VRBTcS2 iZH1PyXIuZ9/hhqSpWkahzaiH9HA4ZkDXpVQnIq5aCXeLDwCwuZgE33/sWNiwqs3EAfL A/SqskCfK3Ml+qs68HZnASYRCWqWDlJ9qzwKAibFuAvCb65rBKrhjlJ9a5nPNLvx5M2l pEqg== X-Gm-Message-State: AODbwcDxQepyi+nuTy1qQIxumZFy+2R5a+4neonJwx3b8nNpUos67bbJ TEAUCgE/7utAmoH+7KzVmIJOh7Xjh3hg X-Received: by 10.31.57.4 with SMTP id g4mr15306717vka.51.1495637140617; Wed, 24 May 2017 07:45:40 -0700 (PDT) MIME-Version: 1.0 Received: by 10.176.71.83 with HTTP; Wed, 24 May 2017 07:45:00 -0700 (PDT) From: Warren Kumari Date: Wed, 24 May 2017 10:45:00 -0400 Message-ID: To: "opsawg@ietf.org" , Joe Clarke Content-Type: multipart/alternative; boundary="001a1144a8127ad8ed0550462892" Archived-At: Subject: [OPSAWG] Adding Joe Clarke as a chair. X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 May 2017 14:45:43 -0000 --001a1144a8127ad8ed0550462892 Content-Type: text/plain; charset="UTF-8" Hi all, Benoit and I have been discussing this for a while, and we'd like to announce that we are adding Joe Clarke as an OpsAWG chair. Joe has both operations and management experience, and will be a good addition to help chair the OPsAWG WG. W -- I don't think the execution is relevant when it was obviously a bad idea in the first place. This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants. ---maf --001a1144a8127ad8ed0550462892 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,

Benoit and I have been discussing this for a while= , and we'd like to announce that we are adding Joe Clarke as an OpsAWG = chair.=C2=A0

Joe has both operations and management experience, and wi= ll be a good addition to help chair the OPsAWG WG.

W

--
I don't think the execution is relevant when it was obviously a bad id= ea in the first place.
This is like putting rabid weasels in your pants,= and later expressing regret at having chosen those particular rabid weasel= s and that pair of pants.
=C2=A0 =C2=A0---maf
--001a1144a8127ad8ed0550462892-- From nobody Wed May 24 08:09:07 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 431BD126DFF for ; Wed, 24 May 2017 08:09:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -11.803 X-Spam-Level: X-Spam-Status: No, score=-11.803 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L8cYa2T62l-k for ; Wed, 24 May 2017 08:09:05 -0700 (PDT) Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CFE9B124B0A for ; Wed, 24 May 2017 08:09:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=676; q=dns/txt; s=iport; t=1495638545; x=1496848145; h=subject:to:references:from:message-id:date:mime-version: in-reply-to:content-transfer-encoding; bh=rGAkeCA2/kUuJcASwMHS/g+tgmhsZMrfq8lkW/eUOvI=; b=C6PZZ8hDPkBWKwWigaJaHjUqoHCKYMzuBO81K6vswWfyyYW8+Yxph6GQ FyF7jgCS3LsqA3Y7pjMIzgzeqMMt4i8C3+8nDjCW+m78G9BOx5p029w60 4pa5izwHRBWu8QOW/TK7b6q6yW3Bu12/wcT8c/FrpB1PAqQN/nMBuglIz A=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0A5AgD3oCVZ/xbLJq1dGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBiTKLC5BmmAaGJAKDMBUBAgEBAQEBAQFrKIUYAQEBAQIBIw8BVgsYAgI?= =?us-ascii?q?mAgJXBgEMCAEBihoIrHmCJos9AQEBAQEBAQMBAQEBAQEigQuFVIIJgnGHdoJgA?= =?us-ascii?q?QSeI5MogW6JHYZslE41IoEKTyIVh1gkiVkBAQE?= X-IronPort-AV: E=Sophos;i="5.38,386,1491264000"; d="scan'208";a="654907911" Received: from aer-iport-nat.cisco.com (HELO aer-core-3.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 24 May 2017 15:09:00 +0000 Received: from [10.150.54.239] (dhcp-10-150-54-239.cisco.com [10.150.54.239]) by aer-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id v4OF90VE031020; Wed, 24 May 2017 15:09:00 GMT To: Warren Kumari , "opsawg@ietf.org" References: From: Joe Clarke Organization: Cisco Message-ID: Date: Wed, 24 May 2017 11:08:59 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.1.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [OPSAWG] Adding Joe Clarke as a chair. X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 May 2017 15:09:06 -0000 On 5/24/17 10:45, Warren Kumari wrote: > Hi all, > > Benoit and I have been discussing this for a while, and we'd like to > announce that we are adding Joe Clarke as an OpsAWG chair. > > Joe has both operations and management experience, and will be a good > addition to help chair the OPsAWG WG. Thanks, Warren and Benoit. I'm excited to take on the new role. Joe > > W > > -- > I don't think the execution is relevant when it was obviously a bad idea > in the first place. > This is like putting rabid weasels in your pants, and later expressing > regret at having chosen those particular rabid weasels and that pair of > pants. > ---maf From nobody Wed May 24 08:38:44 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13FDE129B20 for ; Wed, 24 May 2017 08:38:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.521 X-Spam-Level: X-Spam-Status: No, score=-14.521 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xwp-Du7ksreD for ; Wed, 24 May 2017 08:38:42 -0700 (PDT) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E8A0128CFF for ; Wed, 24 May 2017 08:38:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3576; q=dns/txt; s=iport; t=1495640322; x=1496849922; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=CUXXkRDmVN6j1HDQEauuEmyUv+UdqiEAb0q0JILXSYE=; b=nJ7lrDr4DsjaaSOPJVCmssI819HbAbQ2jH9xLq1j4CSXiakGfapy6xXz mG3vmWeM5JCSjd+rePgQadLBjVQLl7ohcVBZbOmJIstr1GiD7Nhvnvmgw dYNzBTfG946L943KPLvV1roVgs3TYSlwZyoDYp4z2CrzuE8u6wWEh6g8T A=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B9AgAPqCVZ/4kNJK1cGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBg1VigQwHnziQYIU4gg8hAQqFLkoCgm5AFwECAQEBAQEBAWsohRk?= =?us-ascii?q?CAQMBAWwLEAIBCAQ7BycLFBECBA4FGooMDq8eiz8BAQEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEYBYZfggkLgmaIJYIxBZ4jAZMnkXeUTQEhATWBCnEVRhIBhmN2iBaBDQE?= =?us-ascii?q?BAQ?= X-IronPort-AV: E=Sophos;i="5.38,386,1491264000"; d="scan'208,217";a="247186019" Received: from alln-core-4.cisco.com ([173.36.13.137]) by rcdn-iport-9.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 24 May 2017 15:38:41 +0000 Received: from XCH-RTP-015.cisco.com (xch-rtp-015.cisco.com [64.101.220.155]) by alln-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id v4OFcfcu030404 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 24 May 2017 15:38:41 GMT Received: from xch-rtp-020.cisco.com (64.101.220.160) by XCH-RTP-015.cisco.com (64.101.220.155) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Wed, 24 May 2017 11:38:40 -0400 Received: from xch-rtp-020.cisco.com ([64.101.220.160]) by XCH-RTP-020.cisco.com ([64.101.220.160]) with mapi id 15.00.1210.000; Wed, 24 May 2017 11:38:40 -0400 From: "Carlos Pignataro (cpignata)" To: Warren Kumari CC: "opsawg@ietf.org" , "Joe Clarke (jclarke)" Thread-Topic: [OPSAWG] Adding Joe Clarke as a chair. Thread-Index: AQHS1Jxw3kXEL/jDOECQmczdkm/Ao6ID4XaA Date: Wed, 24 May 2017 15:38:40 +0000 Message-ID: <147EB8A0-5986-4DE6-A5FD-ACF42D7BBF65@cisco.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.82.104] Content-Type: multipart/alternative; boundary="_000_147EB8A059864DE6A5FDACF42D7BBF65ciscocom_" MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] Adding Joe Clarke as a chair. X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 May 2017 15:38:44 -0000 --_000_147EB8A059864DE6A5FDACF42D7BBF65ciscocom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Congratulations Joe, this is excellent news for OPsAWG! On May 24, 2017, at 7:45 AM, Warren Kumari > wrote: Hi all, Benoit and I have been discussing this for a while, and we'd like to announ= ce that we are adding Joe Clarke as an OpsAWG chair. Joe has both operations and management experience, and will be a good addit= ion to help chair the OPsAWG WG. W -- I don't think the execution is relevant when it was obviously a bad idea in= the first place. This is like putting rabid weasels in your pants, and later expressing regr= et at having chosen those particular rabid weasels and that pair of pants. ---maf _______________________________________________ OPSAWG mailing list OPSAWG@ietf.org https://www.ietf.org/mailman/listinfo/opsawg --_000_147EB8A059864DE6A5FDACF42D7BBF65ciscocom_ Content-Type: text/html; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable Congratulations Joe, this is excellent news for OPsAWG!

On May 24, 2017, at 7:45 AM, Warren Kumari <warren@kumari.net> wrote:

Hi al= l,

Benoi= t and I have been discussing this for a while, and we'd like to announce th= at we are adding Joe Clarke as an OpsAWG chair. 

Joe h= as both operations and management experience, and will be a good addition t= o help chair the OPsAWG WG.

W

--
I don't t= hink the execution is relevant when it was obviously a bad idea in the firs= t place.
This is like putting rabid weasels in your pants, and later expressing regr= et at having chosen those particular rabid weasels and that pair of pants.<= br class=3D"">    ---maf
_______________________________________________
OPSAWG mailing list
OPSAWG@ietf.org
https:/= /www.ietf.org/mailman/listinfo/opsawg

--_000_147EB8A059864DE6A5FDACF42D7BBF65ciscocom_-- From nobody Wed May 24 18:16:57 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F069129BAB for ; Wed, 24 May 2017 18:16:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.222 X-Spam-Level: X-Spam-Status: No, score=-4.222 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bqFSQ1KRZXNr for ; Wed, 24 May 2017 18:16:50 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5DDFB129409 for ; Wed, 24 May 2017 18:16:49 -0700 (PDT) Received: from 172.18.7.190 (EHLO LHREML711-CAH.china.huawei.com) ([172.18.7.190]) by lhrrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id DNS73706; Thu, 25 May 2017 01:16:47 +0000 (GMT) Received: from NKGEML411-HUB.china.huawei.com (10.98.56.70) by LHREML711-CAH.china.huawei.com (10.201.108.34) with Microsoft SMTP Server (TLS) id 14.3.301.0; Thu, 25 May 2017 02:16:46 +0100 Received: from NKGEML515-MBX.china.huawei.com ([fe80::a54a:89d2:c471:ff]) by nkgeml411-hub.china.huawei.com ([10.98.56.70]) with mapi id 14.03.0235.001; Thu, 25 May 2017 09:16:43 +0800 From: Tianran Zhou To: Joe Clarke , Warren Kumari , "opsawg@ietf.org" Thread-Topic: [OPSAWG] Adding Joe Clarke as a chair. Thread-Index: AQHS1Jx6Fy3P+6f6bUeLeJvHlfRD8qIDEAGAgAEvrHA= Date: Thu, 25 May 2017 01:16:42 +0000 Message-ID: References: In-Reply-To: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.111.156.116] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020202.5926307F.01A0, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 68c8e9edf11cd85c1be0dd914b3d4fd7 Archived-At: Subject: Re: [OPSAWG] Adding Joe Clarke as a chair. X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 May 2017 01:16:51 -0000 Hi Joe, Congratulations and welcome aboard! Cheers, Tianran > -----Original Message----- > From: OPSAWG [mailto:opsawg-bounces@ietf.org] On Behalf Of Joe Clarke > Sent: Wednesday, May 24, 2017 11:09 PM > To: Warren Kumari; opsawg@ietf.org > Subject: Re: [OPSAWG] Adding Joe Clarke as a chair. >=20 > On 5/24/17 10:45, Warren Kumari wrote: > > Hi all, > > > > Benoit and I have been discussing this for a while, and we'd like to > > announce that we are adding Joe Clarke as an OpsAWG chair. > > > > Joe has both operations and management experience, and will be a good > > addition to help chair the OPsAWG WG. >=20 > Thanks, Warren and Benoit. I'm excited to take on the new role. >=20 > Joe >=20 > > > > W > > > > -- > > I don't think the execution is relevant when it was obviously a bad > > idea in the first place. > > This is like putting rabid weasels in your pants, and later expressing > > regret at having chosen those particular rabid weasels and that pair > > of pants. > > ---maf >=20 > _______________________________________________ > OPSAWG mailing list > OPSAWG@ietf.org > https://www.ietf.org/mailman/listinfo/opsawg From nobody Fri May 26 09:21:02 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB4A6129468 for ; Fri, 26 May 2017 09:21:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.022 X-Spam-Level: X-Spam-Status: No, score=-0.022 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=btconnect.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uUyoKBfXq42B for ; Fri, 26 May 2017 09:20:59 -0700 (PDT) Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-eopbgr20118.outbound.protection.outlook.com [40.107.2.118]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D124E128B44 for ; Fri, 26 May 2017 09:20:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=btconnect.onmicrosoft.com; s=selector1-btconnect-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=CrhqAjnjNFOdP3duSRh8WXt5YQ3/AK795fGv5qEAUh4=; b=gKb2BBTMX3AmKRHBGoWY7V3wwLvZYJvQAJfZdPnBfF1NDR97zOS2VghwQLq1UwYFPP1ENYjb4yNF9mGoQWYyEBgeiBZhWEf6Fg6JlEbe7QbhtZF7R/1R7dTi6e6JKtOpOLjyUmmw/Itjx772T4R2hm+uaFZecgap4DL3LBD6xq0= Authentication-Results: deployingradius.com; dkim=none (message not signed) header.d=none;deployingradius.com; dmarc=none action=none header.from=btconnect.com; Received: from pc6 (86.169.157.161) by VI1PR0701MB3008.eurprd07.prod.outlook.com (2603:10a6:800:87::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1124.5; Fri, 26 May 2017 16:20:56 +0000 Message-ID: <028501d2d63b$a19e8220$4001a8c0@gateway.2wire.net> From: t.petch To: Alan DeKok , "Douglas Gash (dcmgash)" CC: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> <6B9DFA23-41BD-4896-B80C-EC0EAB51D5FD@deployingradius.com> Date: Fri, 26 May 2017 16:45:35 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Originating-IP: [86.169.157.161] X-ClientProxiedBy: DB6PR07CA0010.eurprd07.prod.outlook.com (2603:10a6:6:2d::20) To VI1PR0701MB3008.eurprd07.prod.outlook.com (2603:10a6:800:87::22) X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI1PR0701MB3008: X-MS-Office365-Filtering-Correlation-Id: 90f64858-092d-47d1-b5a4-08d4a4533067 X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(201703131423075)(201703031133081); SRVR:VI1PR0701MB3008; X-Microsoft-Exchange-Diagnostics: 1; VI1PR0701MB3008; 3:yfObrezLnrDxfx9a/vMWMdW34/qdcvYWJC7F41oFz0Pc2I1dnwRUhiM5XTeaDz2LndFxMEEUO5g6yQI9swlsT5OSF4gOPlfbl0qU7rAh/jfP9sG+t+UDTb31c0qolc8IUZZDD6kRBlkG2va5TKc+191pBKgQ6eROg+hhxj5EIwVmQ8LkdTvKfBJKnSDCq9eDqJDZZd1G/HEwFg5sotDV/PNmcEjRudzwcuNTm7VXCAPkXmmPgXC6w5h7r53csZI0J8/5naA6/9ZFNU9JZJLaE+vFYtUOqPI8+3qeYDtIkE8NM7MQ63ZE5PF1iNjK3+IbykwB1MlF2Xg/cX4zWGrJwA==; 25:YpyCi5gtEV/HLLpVyEbn+X6qcTrJjY97KaX/kcxHtKzAUeXaUtOtLcnoeS+721ilBW5cIYLwZe38oyW4i8wkLLkAGzq3NRII8BAG3Tc9zieVnjrJmf6RTIxpQNMxTKywoGuuczi9aGRnjg5KvXOiZaY81TBNIe69VA7oVkpus7+/MOssGAjc+uZbdi0XjOxl8AcoYNC5vzxFNAHLik3Sp5fDHfG4gOxy5/IOm7W2ZC+s0tCYcAGCH6D5EUlV2gdpqAwjgmcqMAjNSx2SyS91BriCxA7W/gPKuwSUWUaSAeeM5LYoVzr4/pIFNePkft0vL05WmhyWJtPUOpzWbUUGwKTNWMxyZ2tLItiYUMD3mEMfZiUgzicNH7GNpc8jsedIlBb35G5X6S7/smJXaOLjCoNfK2vuI8eAO0dJON8HGH4GhEed49U5RnfLaK9DzayfhJd6UN9qhsWesyCaf0JclbbGRcwbrJJe5JD3X16lOnM= X-Microsoft-Exchange-Diagnostics: 1; VI1PR0701MB3008; 31:4OSV8pr9tpgvCG7W1GLvwDo3HK7GWwWZ+7TAOnZpqgnihHgzfZiEykvGDjeCjk5rhf+Q4RPSu68MRWRqyrMTayIRmn1tbx1fQ4C4othJDh0x8sTEghx+03DKWPYJsh5ij/geMFCBF1dL2Rq7K4AyG6Ej8PxdBgv5QUHvR08HdYcNeiB0PPDdvZ67APBrVNbeJ8y1ft95t2nG/i/BoS5R2odBbSBLyGUN9mW2JqzVvQE4wb11RnJ0YFSSp/HDe/zx9qipC46qd3fKLPbFBKKNfA==; 20:dSBM9+7j5789ob9SgXp8PCZnBWhSHfY2eJUJaR6yoqJys6mtR3FN54NkEnVD/FhJHqHtdjvfuaUKPBlr+4kPVOcKFWl/1BmtV8p8Lr7E/7ruDtleLObTN58fyi+XEyx9YNlVVJroh7+X2JIvURGmPR3YKX4/5rUs5FgvqqLS+Y0= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705)(95692535739014); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040450)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(93006095)(93001095)(6041248)(20161123555025)(20161123564025)(20161123562025)(20161123558100)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148); SRVR:VI1PR0701MB3008; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0701MB3008; X-Microsoft-Exchange-Diagnostics: 1; VI1PR0701MB3008; 4:hSkspZ8kKuQk0Nzw5s1g1hxfQ/U4iWGbWMgEMS9Lr9Tw1bvdqzNHIqBKxNN+Ls8zDxTWhi6WOT8iGD9yKS/Mz1hLKF3TGRfSk443vlKc7IGMR65ZTj0m/3oh57k2ik3q3qhTxg6OHP8N6jkFyipQZPMQGMHQswHg62MrHy4E5UJEMnSGoVdnYE8GrYyT8SdI18wTEbl7Ou2nuSNZBZaWA3iqcCneo65KtBK0KyNal5IZ+9hP0dYKYrodBszxhv/J021qEA3bicaMJVkyfMCv6oVqXixZ7BBzpRV5rrtnMr0SfxwSQpu7vChYq25iJHNWywYA4qEcbbpefDlQA74zo5iJZBuUmrmAZHsGk6niot5YxG+S2xUOKa6K7l05s/DH8n7ZzUq6xM8AYjZozbDDLAIqzI/IeVN1kmTp1shlh9hccES6CnZk8UPkoFMc+kAY9y+/oSd/n+pb5CGGnIDRrjWzwmqUMjZXl8IAEneSbzSog8/R4qqrNx5+H4vhsq16HlGzAWHxbiz9kbUMAS3+NRWfU9cHkNI3S2yU+1xVnpGt4PW2mTIVv6clHQdg89yeze3vFLdQV3Kl6bQconQKz5ug2eBfM+SR76ZKrZ6vDc2TQCYxLsi64Mrbb8AoQUtpXeaTi+wEMRinPoi40e4Kj1JjYrUbl6O0+8bROkHLOLqnMDgUKArjJELjK39WjJU0YMOVNs9mlD6k8RNpyHnfeXun3PsQa3OTil5KX5faJRuvc0hmWiN3o5HkskYRM0i7VNuKAixWIQf5BSDugXUmndROfzMF5v2gvcpCxQZXQc01DVmQQV+jROsolSA+lmSiq/s3XcIY4kcQkrjb7GIWdjJahLJ4X5+lazn0A3TkAAPL0vEMk9BjeQynj843Zw/S X-Forefront-PRVS: 031996B7EF X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(4630300001)(6009001)(39450400003)(39850400002)(39400400002)(39860400002)(39410400002)(39840400002)(377454003)(13464003)(14496001)(50466002)(478600001)(50986999)(84392002)(42186005)(1556002)(1456003)(230700001)(230783001)(116806002)(93886004)(23756003)(62236002)(76176999)(66066001)(189998001)(44716002)(47776003)(81686999)(61296003)(33646002)(81816999)(7736002)(9686003)(2906002)(4326008)(8676002)(6486002)(50226002)(86362001)(4720700003)(6116002)(229853002)(6666003)(44736005)(3846002)(5660300001)(6496005)(38730400002)(81166006)(6246003)(53936002)(305945005)(25786009)(74416001)(7726001); DIR:OUT; SFP:1102; SCL:1; SRVR:VI1PR0701MB3008; H:pc6; FPR:; SPF:None; MLV:nov; PTR:InfoNoRecords; LANG:en; X-Microsoft-Exchange-Diagnostics: =?iso-8859-1?Q?1; VI1PR0701MB3008; 23:XPUPqNPwk/c2ouSM9inG/t/DQ2N+8I9Lq7cWi?= =?iso-8859-1?Q?2qLqHbRKy4qlcsrJCdmsfRijMaaOgfFcjRqnRwg6XmpPge48dVxf/EkAZ1?= =?iso-8859-1?Q?3gI3R9kJW8v5gKVD5mdsGLzlvzeUcwVAvPyovfGjT4KRX/VA9g0Ig2L449?= =?iso-8859-1?Q?FFhzaKFccgKvPBvuO4DubZwXrTQbG3UDa04D9Y9evzLyeVagMsutghNCxQ?= =?iso-8859-1?Q?TL7Lu4GkzJymJP67QJF360pLOzfnlro2gvBIa+52B4TeWniLfgsTKSzaKq?= =?iso-8859-1?Q?FarTgvoKpk6TLudxdXzR3FRxBf7jg+acOQAV1pJeSLtl3hlNQVQfi/jMQe?= =?iso-8859-1?Q?svMTKmnktgHIR8LGwfAikhC10AMpY/w1mGpATaMT6KvgzTd+ui8RqS2+vl?= =?iso-8859-1?Q?6DJ/T7lqpScKDTGkq4NcfK2vCVVet8SNSqOzbdATlQJ4vlpc+RVf9vSH99?= =?iso-8859-1?Q?vCCYuNoM7pC6oDClE/ansAnmyLSMnKB5007H7GRcpDyZbQOELQjKrtaOOL?= =?iso-8859-1?Q?K/WEWPxeWKBgykaNfWcleMmYvORJIfekwwQCXKpHMvx0dpAY/M61aj/1iE?= =?iso-8859-1?Q?2fXcLC3qRZGfUQjCbif5EMYsrf/T2tsKf85KbWu/2LWx7f+YZSNUwD5+r7?= =?iso-8859-1?Q?B7hRHrTtNxlZwmcbgi6jdYU+peu5Jb+7Rf55e8VVNw3eUwsgZIqMcFh/zg?= =?iso-8859-1?Q?jN08eEcn3oO44W7OIkdk/VslF+4GHNuKQTAtRTf6s+BXXwKDA57wJLQ3LR?= =?iso-8859-1?Q?CA/KC8w+f01UipQGKhAhYJ/9sfiQuWYCar3vR0TYr0AGa/+w2HOZr/AMNx?= =?iso-8859-1?Q?ap8N5dTtv0rjSKPDjnNHIjBPe4t/zntVn/Co2PhBHX79qLpWaL2Y3NGpNo?= =?iso-8859-1?Q?58LOg8Is9l9Q1jjkoD6k5tSGMMlAdxj4sTVDBtB1Olf8IFvWjnZCRGaqDJ?= =?iso-8859-1?Q?RFpDk8WTEVAI0zgpcDHMgRIoQxWHNhDZNQ2R98g/w2D4OoB69TCIw9zDrG?= =?iso-8859-1?Q?m9d6A/UfPAr0Snra/mpcJevcDU7WiMJuPFA2LpYXACXpo/eQCuf37WmMqo?= =?iso-8859-1?Q?4nG5AEa3I7BvzH489BoYOMLVVnyJ2Jf2BCbl2rB/1Em9HWb0YjPvyaGKZ0?= =?iso-8859-1?Q?uVoWWL85+vyNkDjHcbazarHI4RzaVkSWbfXGvOMjHvUPSxohwq+RUzu/eg?= =?iso-8859-1?Q?J3La+MCfPncMQnoWVDxJlHNbMrMNL9BlNb/HO+PYnpmyUJTyEEeJVj2IQ6?= =?iso-8859-1?Q?krmEZtcLv9T4UqaBmCNml/9L4gzL/qIjkPZT7GSuJcg9efw5I1kbOF/34K?= =?iso-8859-1?Q?Srv64/szG3cWcQuBwYGXFgWyFDJUq0OtnFO/YA1YxWTP5MgY5SYFZKGcxj?= =?iso-8859-1?Q?UiyQOhL0YIyTVDvJFitWxxAlJ15sHDiDU8gZ+gh/Z51nFIcfIJ3j/3Zq/m?= =?iso-8859-1?Q?vRuWuNFJdn04Xm6w=3D?= X-Microsoft-Exchange-Diagnostics: 1; VI1PR0701MB3008; 6:R8iOcb0adqn3ARGEY7th71lWmBBodCJM5nz0tPGnQjYDbw5xy8n4NOxHaRkfX2pEzHUoM02gVuhBFOmus1hO18RxosVePs3urhC5E7Z+5mGEpiYfCK76rtQUiW9Ou0rd7SnVPUFOdJyx/PAPzS3VsVRlkl9tfH/3mf49JxnQUY1aaNmlA8Hll7N03x9+pwvNF6iOU0JyWfoniOw7Re7F9furjjDrnU4Z7lQeoq/SGZbtJDQ7/7UvqjLKHPZ0Ex5pjbyK0mlIForm9dm42Nvh27in6zicLmbJd8CGkwhCs+YAjO/C/V626ZVbh+XV3K/GIqt1VJDU/nNoKlyrQ5FaHC9gMEiYstbupQ4TBpQcf82hH+78Ljiof7jF5GI4BN7+YQyEGW1y15QUIW8Ms58LT0xsUvjZtypOoCjAZER8vKDXDo9ANOOx+SzKqacvP0DPKg+aUyqq6L1p5QMFSAFF2N3KiW3Cv3UVfp8Nu4NeagOVtUTYTkjQuxIBcQ4VPTdZSnHUP7edczWXf3FKebtcsA==; 5:QxnKmHopTIaId/hBPAEVGsxbAqK7OYdAk3f1Pk9A5vRFtV7aFLjWS5b/8/Yr9sGq5wg/0GbZ56X4EZS9HAT2bF7BENCUsKnnNCj+UKREnxaDYGU1IG3cjT9JnTK0r/N1ungg1hCtq0E3XCOOq3RbCF5704ledK+0kVISMFtcyQc=; 24:o2VF4gcBChvvXv0OGkmCtfzxuDV3NtNUhRivktu5T0F8LBQX9/ynu/g8r+RZ3kcAjbPEnJO5Xe2k4R+0nvQAtop4qtcGjQP3U/KzmQfG7uo= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; VI1PR0701MB3008; 7:tmij9cfjeNioB8yhLCqcK86PFFJWY5b6+1mDvS/RrvCDbDoUg7FTtW1Wgf9N3kuGo58+EoHw9Glv5Ju076VtmcWPhmzUpUOC4iJGKdfc8cne4pOhe6H7A0Q6he9rK7uhYNh5gkQu4NMe+IegbT0R2dBif8ylPko3q3cM6Ur//JY12tv8jEBMY1FjGFyjTS0IZpmjTgLKX0IfACvEILhi7YEBfruU0Y63qW1xSH99Yw2B088ly5LEalOfMaBjW36RSSN0SBwK/EHX4kuNvKdVWx9jADEsiJcLTwoIysgseH7v7+w+IHNBTQC4p1ZJ29BXrDekG7Sr31DsbUtQ9WpA5A== X-OriginatorOrg: btconnect.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 May 2017 16:20:56.2738 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0701MB3008 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans - types X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 May 2017 16:21:01 -0000 Doug I mentioned my wish for the I-D to have a definition of the types used and promptly noticed something along those lines in another I-D, which I append below. It comes from an Informational Model and so does not specify encoding, which this I-D would need, but I like the terms used and the descriptions as far as they go. This I-D would only need a subset. Tom Petch ========================================= int A type representing signed or unsigned integer numbers. This information model does not define a precision nor does it make a distinction between signed and unsigned number ranges. This type is also used to represent enumerations. boolean A type representing a boolean value. string A type representing a human-readable string consisting of a (possibly restricted) subset of Unicode and ISO/IEC 10646 [ISO.10646] characters. datetime A type representing a date and time using the Gregorian calendar. The datetime format MUST conform to RFC 3339 [RFC3339]. uuid A type representing Universally Unique IDentifier (UUID( as defined in RFC 4122 [RFC4122]. The UUID values are expected to be unique within an installation of a large- scale measurement system. uri A type representing a Uniform Resource Identifier as defined in STD 66 [RFC3986]. ip-address A type representing an IP address. This type supports both IPv4 and IPv6 addresses. counter A non-negative integer that monotonically increases. Counters may have discontinuities and they are not expected to persist across restarts. credentials An opaque type representing credentials needed by a cryptographic mechanism to secure communication. Data models must expand this opaque type as needed and required by the security protocols utilized. data An opaque type representing data obtained from measurements. Names of objects are generally assumed to be unique within an implementation. ----- Original Message ----- From: "Alan DeKok" To: "Douglas Gash (dcmgash)" Cc: ; Sent: Wednesday, May 17, 2017 3:54 PM Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans From nobody Fri May 26 09:49:43 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 21C691293D6 for ; Fri, 26 May 2017 09:49:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.522 X-Spam-Level: X-Spam-Status: No, score=-14.522 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cpfG17ONsDBb for ; Fri, 26 May 2017 09:49:41 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DCA20126B7F for ; Fri, 26 May 2017 09:49:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3015; q=dns/txt; s=iport; t=1495817380; x=1497026980; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=obh84AtS9/EhrDMdiy4WRwK3juitodGt+nJIyTEBrzY=; b=Aicw5fLllEyHaEa510eEGMqi2EO4DFYKfQTiJCrKY+oe005b7aEtRnQ+ lV2HtlPxMxzmRbExTfkWViwQ3PPBsw53KFEx6cDpd3eXoB9nPCYHrskW3 suLin2JGUYzwq9s0LCyH9RhRvbwu7xGPkHOPYpLVn4/ns1Li7rEaCPVYH c=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CYAAAPXChZ/49dJa1cGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBg1WBbweOAJFllXmCD4YkAoMKPxgBAgEBAQEBAQFrKIUYAQEBAQM?= =?us-ascii?q?6PwwEAgEIEQQBAR8QMh0IAgQBDQWKKq1ci1UBAQEBAQEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEdiD2DHIRmhXIBBJZ5hyoBkyeRd5RNAR84gQp0FYVJHBmBSnaHfIENAQEB?= X-IronPort-AV: E=Sophos;i="5.38,398,1491264000"; d="scan'208";a="248448972" Received: from rcdn-core-7.cisco.com ([173.37.93.143]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 May 2017 16:49:40 +0000 Received: from XCH-ALN-014.cisco.com (xch-aln-014.cisco.com [173.36.7.24]) by rcdn-core-7.cisco.com (8.14.5/8.14.5) with ESMTP id v4QGneMp012548 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 26 May 2017 16:49:40 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-ALN-014.cisco.com (173.36.7.24) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Fri, 26 May 2017 11:49:39 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1210.000; Fri, 26 May 2017 11:49:39 -0500 From: "Douglas Gash (dcmgash)" To: "t.petch" , Alan DeKok CC: "opsawg@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans - types Thread-Index: AQHS1jwQyyHeDgO5b065hIBuBHDfuaIHODUA Date: Fri, 26 May 2017 16:49:39 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> <6B9DFA23-41BD-4896-B80C-EC0EAB51D5FD@deployingradius.com> <028501d2d63b$a19e8220$4001a8c0@gateway.2wire.net> In-Reply-To: <028501d2d63b$a19e8220$4001a8c0@gateway.2wire.net> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.1.161129 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.1.6] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans - types X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 May 2017 16:49:42 -0000 Looks like a nice model for emulating, will add along these lines. This is essentially for embedding at the start of the attributes section. Cheers! Regards, Doug. On 26/05/2017 16:45, "t.petch" wrote: >Doug > >I mentioned my wish for the I-D to have a definition of the types used >and promptly noticed something along those lines in another I-D, which I >append below. It comes from an Informational Model and so does not >specify encoding, which this I-D would need, but I like the terms used >and the descriptions as far as they go. This I-D would only need a >subset. > >Tom Petch > >=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > int A type representing signed or unsigned integer numbers. > This information model does not define a precision nor > does it make a distinction between signed and unsigned > number ranges. This type is also used to represent > enumerations. > > boolean A type representing a boolean value. > > string A type representing a human-readable string consisting of > a (possibly restricted) subset of Unicode and ISO/IEC > 10646 [ISO.10646] characters. > > datetime A type representing a date and time using the Gregorian > calendar. The datetime format MUST conform to RFC 3339 > [RFC3339]. > > uuid A type representing Universally Unique IDentifier (UUID( > as defined in RFC 4122 [RFC4122]. The UUID values are > expected to be unique within an installation of a large- > scale measurement system. > > uri A type representing a Uniform Resource Identifier as > defined in STD 66 [RFC3986]. > > ip-address A type representing an IP address. This type supports > both IPv4 and IPv6 addresses. > > counter A non-negative integer that monotonically increases. > Counters may have discontinuities and they are not > expected to persist across restarts. > > credentials An opaque type representing credentials needed by a > cryptographic mechanism to secure communication. Data > > models must expand this opaque type as needed and > required by the security protocols utilized. > > data An opaque type representing data obtained from > measurements. > > Names of objects are generally assumed to be unique within an > implementation. > > >----- Original Message ----- >From: "Alan DeKok" >To: "Douglas Gash (dcmgash)" >Cc: ; >Sent: Wednesday, May 17, 2017 3:54 PM >Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status >and Plans > > From nobody Fri May 26 10:05:06 2017 Return-Path: X-Original-To: opsawg@ietfa.amsl.com Delivered-To: opsawg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9EE0D129406; Fri, 26 May 2017 10:05:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.522 X-Spam-Level: X-Spam-Status: No, score=-14.522 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XTmTlUBfNorp; Fri, 26 May 2017 10:05:02 -0700 (PDT) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F0CD126B7F; Fri, 26 May 2017 10:05:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=10462; q=dns/txt; s=iport; t=1495818302; x=1497027902; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=IJ42bQsF7/gPeQR4R3tltiTuVyd52jIpcRwm24xDXxM=; b=bv1Kbaveo7GPNhRoiln29xhfuRHwIEn5keNtLFzjQylZKRVSF7LFc5sZ rnUTjHa2TbAyWH2OeN1C5IaOxzaXsFJatuVqB4spFKA/8ebrtdVJAZYoM Pz9vyrGhrmZACMarLHDboGdyfwwh+qgh6RaMBh8db53/R00Md+lgk//Xb 4=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AIAQCgXyhZ/4oNJK1cGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBg1VigQ0Hg2iKGJFlcpUHgg8shXgCGoJwPxgBAgEBAQEBAQFrKIU?= =?us-ascii?q?ZAQQBNEUQAgEIHBQUAgIwJQIEDgWKIggQjT+dWAaCKItVAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBGAWBBYc4gmg0hEMNAhQXN4I+gmYFniMBhx+MCIIGhTyKNYkBi0w?= =?us-ascii?q?BHziBCnQVhUkcgWN2AYZMgS+BDQEBAQ?= X-IronPort-AV: E=Sophos;i="5.38,398,1491264000"; d="scan'208";a="239905466" Received: from alln-core-5.cisco.com ([173.36.13.138]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 26 May 2017 17:05:01 +0000 Received: from XCH-RCD-014.cisco.com (xch-rcd-014.cisco.com [173.37.102.24]) by alln-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id v4QH51IE010086 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 26 May 2017 17:05:01 GMT Received: from xch-aln-014.cisco.com (173.36.7.24) by XCH-RCD-014.cisco.com (173.37.102.24) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Fri, 26 May 2017 12:05:00 -0500 Received: from xch-aln-014.cisco.com ([173.36.7.24]) by XCH-ALN-014.cisco.com ([173.36.7.24]) with mapi id 15.00.1210.000; Fri, 26 May 2017 12:05:00 -0500 From: "Douglas Gash (dcmgash)" To: Alan DeKok CC: "opsawg@ietf.org" , "draft-ietf-opsawg-tacacs@ietf.org" Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHxblMAgADBTACAA2Ki4oAAEfVNgAB2p4CAAUHjJIAAZjOA///0HoCAABakgIABKmYAgASd+oCABMHUAIAE+m8A Date: Fri, 26 May 2017 17:05:00 +0000 Message-ID: References: <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <010d01d2ce79$477ceda0$4001a8c0@gateway.2wire.net> <632EB4D0-15C0-4BF7-9187-9AFCD7EDE306@ll.mit.edu> <6B9DFA23-41BD-4896-B80C-EC0EAB51D5FD@deployingradius.com> <460D8E65-E5B1-4E32-9E5D-8965F2FB4F01@deployingradius.com> In-Reply-To: <460D8E65-E5B1-4E32-9E5D-8965F2FB4F01@deployingradius.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.1.161129 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.1.6] Content-Type: text/plain; charset="euc-kr" Content-ID: <17CD968C4CD4E44EA01CC7EBBBB7B167@emea.cisco.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans X-BeenThere: opsawg@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: OPSA Working Group Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 May 2017 17:05:04 -0000 SGkgQWxhbiwNCg0KVGhhbmtzIGFnYWluIGZvciByZXNwb25zZXMsIHBsZWFzZSBzZWUgaW5saW5l Og0KDQpKdXN0IGZvciBhY2NvdW50aW5nOiBJIGRvIG93ZSB5b3UgYW4gaW5pdGlhbCByZXNwb25z ZSB0byBvbmUgYmF0Y2ggb2YgeW91cg0KY29tbWVudHMgdGhhdCBJIG1pc3NlZCBmaXJzdCBpdGVt LCBhbmQgd2UgaGF2ZSB0aGUgc2VjdXJpdHkgc2VjdGlvbiBhcyBhDQp3aG9sZS4gQmVsb3cgdGhv dWdoLCBhcmUgdGhlIHJlc3BvbnNlcyB0byB0aGUgY29tbWVudHMgZm9ybSBUdWVzZGF5LA0KdGhh bmtzIQ0KDQpPbiAyMy8wNS8yMDE3IDE1OjAzLCAiQWxhbiBEZUtvayIgPGFsYW5kQGRlcGxveWlu Z3JhZGl1cy5jb20+IHdyb3RlOg0KDQo+T24gTWF5IDIwLCAyMDE3LCBhdCA4OjI0IEFNLCBEb3Vn bGFzIEdhc2ggKGRjbWdhc2gpIDxkY21nYXNoQGNpc2NvLmNvbT4NCj53cm90ZToNCj4+PiBJZiB0 aGUgZmllbGQgaXMgdW51c2VkLCB0aGUgc3BlYyBzaG91bGQgc2F5IHRoZSBmaWVsZCBpcyBpZ25v cmVkLCBhbmQNCj4+PiB0cmVhdGVkIGFzIGlmIGl0IGRpZCBub3QgZXhpc3QuDQo+PiANCj4+IEFn cmVlZCwgdGhvdWdoIEmp9m0gbm90IHN1cmUgaG93IGFuIHVudXNlZCBmaWVsZCB3b3VsZCBub3Qg YmUgaWdub3JlZCwNCj4+IGFsbW9zdCBieSBkZWZpbml0aW9uLC4gVGhlIG9ubHkgY2lyY3Vtc3Rh bmNlIEkgY2FuIHRoaW5rIG9mIHdoZXJlIGENCj4+ZmllbGQNCj4+IGhhcyBkYXRhIGJ1dCBpcyB1 bnVzZWQgbWF5IG5vdCBiZSBpZ25vcmVkIGlzIGZvciBsb2dnaW5nLCBhcmUgeW91DQo+PnRoaW5r aW5nDQo+PiB3ZSBzaG91bGQgcHJlY2x1ZGUgc3VjaD8NCj4NCj4gIE5vLiAgTnV0IHRoZSBkcmFm dCBuZWVkcyB0byBzYXkgd2hhdCB0byBkby4NCj4NCj4gIElmIHRoZSBwcm90b2NvbCBoYXMgcHJv dmlzaW9ucyBmb3Igc29tZXRoaW5nIHRvIGhhcHBlbiwgdGhlbiB0aGUgZHJhZnQNCj5uZWVkcyB0 byBzYXkgd2hhdCBpbXBsZW1lbnRhdGlvbnMgc2hvdWxkIGRvIHdoZW4gdGhhdCB0aGluZyBoYXBw ZW5zLg0KPg0KPiAgSW4gdGhpcyBjYXNlLCBpdCBzaG91bGQgc3RhdGUgdGhhdCB1bnVzZWQgZmll bGRzIGFyZSBpZ25vcmVkLCBhbmQNCj50cmVhdGVkIGFzIGlmIHRoZXkgd2VyZSBub3QgcHJlc2Vu dC4NCg0KQWdyZWVkLCB3aWxsIGNsYXJpZnkgdGhhdCwgd2l0aGluIHRoZSBjb250ZXh0IG9mIHRo ZSBwcm90b2NvbCBmbG93LiBUaGVzZQ0KbWF5IHN0aWxsIGJlIGxvZ2dlZC4NCg0KDQo+DQo+Pj4g VGhlIG9yaWdpbmFsIFJBRElVUyBSRkMgdXNlZCBhIHNlY3JldCBrZXksIGJ1dCBkaWRuJ3QgZm9y YmlkIGEga2V5IG9mDQo+Pj4gemVybyBsZW5ndGguICBJIHJhbiBpbnRvIGF0IGxlYXN0IG9uZSB2 ZW5kb3Igd2hvIGRpZG4ndCBhbGxvdyBmb3IgdGhlDQo+Pj4gZW50cnkgb2Ygc2VjcmV0IGtleXMs IGFuZCBhbHdheXMgc2V0IGl0IHRvIGEgemVyby1sZW5ndGggc3RyaW5nLiAgVGhlDQo+Pj4gbmV4 dCByZXYgb2YgdGhlIFJGQyBmb3JiYWRlIHRoYXQuLi4NCj4+IA0KPj4gU28gSSB0aGluayB0aGUg c3BlY2lmaWNhdGlvbiBvZiBzZWNyZXRzIGZvciBvYmZ1c2NhdGVkIG9wdGlvbiBpcywgYXMgeW91 DQo+PiBzYXksIGNyaXRpY2FsLCBhbmQgd2lsbCBwcm92aWRlIHNvbWUgZ3VpZGFuY2Ugc3VjaCBh cyBub24tZW1wdHkuIEFsc28NCj4+d2lsbA0KPj4gbWFrZSBzdXJlIHdlIGluY2x1ZGUgdGhhdCBz ZXJ2ZXJzIE1VU1Qgc3VwcG9ydCBjYXBhYmlsaXR5IG9mIHNlY3JldCBwZXINCj4+IGNsaWVudC1z ZXJ2ZXIgdHVwbGUgKHNlZSBuZXh0IGNvbW1lbnQpLg0KPg0KPiAgQW5kIGl0IHNob3VsZCBzdWdn ZXN0IGEgbWluaW11bSBzZWNyZXQgbGVuZ3RoLg0KPg0KPj4gQnV0IEmp9m0gbm90IHNvIHN1cmUg d2hhdCB3ZSBzaG91bGQgc2F5IGFib3V0IHN0b3JhZ2UuDQo+DQo+ICAic2VjcmV0IGtleXMgbmVl ZCB0byBiZSBrZXB0IHNlY3JldCIuDQoNClN1cmUsIEmhr2QgaG9wZSB0aGlzIHdvdWxkIGJlIGFu IGF4aW9tIDstKSBidXQgbm90IGhhcm0gaW4gZW1waGFzaXNpbmcuDQoNCg0KPiANCj4NCj4+PiBP Sy4gQW5kIGlmIHRoZXJlJ3Mgc3RpbGwgbm8gdXNlcm5hbWU/DQo+PiANCj4+IERvIHlvdSBtZWFu LCBpZiBjbGllbnQgcmVwbGllcyB0byB0aGUgcmVxdWVzdCB0bw0KPj4gVEFDX1BMVVNfQVVUSEVO X1NUQVRVU19HRVRVU0VSIHdpdGggYW4gZW1wdHkgdXNlcm5hbWUuIEkgd291bGQgc2ltcGx5DQo+ PiByZXBlYXQgdGhlIHJlcXVlc3QgaW4gY2FzZSBpdCB3YXMgYSB1c2VyIGVycm9yLiBXZSBjYW4g ZG9jdW1lbnQgdGhpcy4NCj4+VGhlDQo+PiBwcm90b2NvbCBoYXMgYSBidWlsdC1pbiBsaW1pdCBv ZiB0aGUgbnVtYmVyIG9mIGludGVyYWN0aW9ucyBkdWUgdG8gdGhlDQo+PiBzZXFfbm8sIGJ1dCBp bXBsZW1lbnRhdGlvbnMgY2FuIGxpbWl0IGludGVyYWN0aW9ucy4NCj4+IA0KPj4gV2UgY2FuIGFk ZCB0aGlzIGRldGFpbC4NCj4NCj4gIFRoYW5rcy4gIE15ICQwLjAyIGlzIHRoYXQgdGhlIHVzZXJu YW1lIFNIT1VMRCBiZSBpbiB0aGUgZmlyc3QgcGFja2V0Lg0KPklmIG5vdCwgaXQgTVVTVCBiZSBp biB0aGUgc2Vjb25kIHBhY2tldC4gIElmIG5vdCwgdGhlIHNlc3Npb24gaXMgYnJva2VuLA0KPmFu ZCB0aGUgc2VydmVyIHJldHVybnMgRVJST1IuDQo+DQo+ICBpLmUuIHJlbHlpbmcgb24gdGhlIDI1 NiBwYWNrZXQgbGltaXQgZm9yIGF1dGhlbnRpY2F0aW9uIGlzIHByb2JhYmx5IHRvbw0KPmxheC4N Cg0KU3VyZSwgbWFrZXMgc2Vuc2UuDQoNCg0KPg0KPi4uLiAgUkU6IENIQVAgY2hhbGxlbmdlcyBh bmQgbGVuZ3RoDQo+Pj4gVGhhdCByZXBseSBtYWtlIGltcGxlbWVudGF0aW9uLXNwZWNpZmljIGFz c3VtcHRpb25zLiAgVGhlcmUgYXJlIFRBQ0FDUysNCj4+PiBpbXBsZW1lbnRhdGlvbnMgd2hpY2gg ZG9uJ3QgZ2V0IHRoZSBjaGFsbGVuZ2UgZnJvbSBhIHRoaXJkLXBhcnR5Lg0KPj4gDQo+PiBKdXN0 IHRvIGNsYXJpZnkgbXkgY29tbWVudDogaXQgaXMgbm90IGFuIGFzcGVjdCBvZiB0aGUgcHJvY2Vz c2luZyBvZiB0aGUNCj4+IFQrIHByb3RvY29sIHRoYXQgY2hvb3NlcyB0aGUgY2hhbGxlbmdlLiBU aGUgcHJvdG9jb2wgd2lsbCBnZXQgdGhlDQo+PiBjaGFsbGVuZ2UgYW5kIHJlc3BvbnNlIGFzIHBy ZS1wYWNrYWdlZCB1bml0Lg0KPg0KPiAgIElmIHRoZSBwcm90b2NvbCB0cmFuc3BvcnRzIGRhdGEg d2l0aG91dCBsb29raW5nIGF0IGl0LCBpdCdzIGZpbmUgdG8NCj50cmVhdCB0aGF0IGRhdGEgYXMg YW4gb3BhcXVlIGJsb2IuICBJZiB0aGUgcHJvdG9jb2wgbG9va3MgYXQgdGhlIGRhdGEsDQo+dGhl IGRyYWZ0IHNob3VsZCBoYXZlIHJlcXVpcmVtZW50cyBvbiB0aGUgZGF0YSBmb3JtYXQuDQo+DQo+ ICAgRm9yIGFuIGV4YW1wbGUsIHNlZToNCj4NCj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwv cmZjMjg2NSNzZWN0aW9uLTUuNDANCj4NCj4gIFRoZSBDSEFQLUNoYWxsZW5nZSBhdHRyaWJ1dGUg aW4gUkFESVVTIGlzIGRlZmluZWQgdG8gaGF2ZSBhdCBsZWFzdCA1DQo+b2N0ZXRzIG9mIGNoYWxs ZW5nZSBkYXRhLg0KDQoNCg0KV2UgY2FuIGZvbGxvdyBhIHNpbWlsYXIgcGF0aCB3aXRoIFQrLiBJ IFdpbGwgYWRkLiAoY292ZXJzIGJlbG93IGNvbW1lbnQNCnRvbykuDQoNCg0KDQo+DQo+PiBTbyBJ IHRoaW5rIHdlIGNhbiBkZW1hbmQgdGhhdCBjaGFsbGVuZ2VzIGJlIGdlbmVyYXRlZCBhY2NvcmRp bmcgdG8gdGhlDQo+PiBzcGVjIGZvciBDSEFQLiBCdXQgcmVhY2hpbmcgaW50byB0aGF0IHNwZWMg dG8gYWRkIG91ciBvd24gY3JpdGVyaWENCj4+d291bGQsDQo+PiBJIHRoaW5rLCBiZSBhIG1peGlu ZyBvZiBjb25jZXJucy4NCj4NCj4gIE5vcGUuICBUaGUgVEFDQUNTKyBzZXJ2ZXIgd2hpY2ggYXV0 aGVudGljYXRlcyB0aGUgdXNlciBzaG91bGQgYmUgc2VjdXJlDQo+YnkgZGVzaWduLiAgVGhpcyBt ZWFucyByZWplY3RpbmcgemVyby1sZW5ndGggY2hhbGxlbmdlcywgYW5kIGNoYWxsZW5nZXMNCj53 aGljaCAidG9vIHNob3J0Ii4NCj4NCj4gIEkgd291bGQgc3VnZ2VzdCB0aGF0IHRoZSBjaGFsbGVu Z2VzIGFyZSBhIG1pbmltdW0gb2YgOCBvY3RldHMgaW4gbGVuZ3RoLg0KPg0KPi4uLiBSRTogcGFz c3dvcmQgY2hhbmdlcy4NCj4+IE9rLCBJIHNlZSB3aGF0IHlvdSBtZWFuLiBXZSBjYW4gYWRkIHRo ZSBTSE9VTEQgbm90IGNsYXVzZSBoZXJlLg0KPj4gDQo+PiBJbnRlcmVzdGluZyB0aG91Z2gsIGFz IHRoaXMgaXMgYSBzaWduaWZpY2FudCB1c2UgY2FzZSBmb3IgVCsuIFdpbGwgYmUNCj4+IGluc3Rl cmVzdGluZyB0byBzZWUgd2hhdCB0aGUgbWFpbiBvYmplY3RzIHdlcmUgZm9yIHdoeSBpdCB3YXMg cmVtb3ZlZA0KPj5mcm9tDQo+PiBSQURJVVMuDQo+DQo+ICBJdCB3YXMgaW5zZWN1cmUsIGFuZCBu byBvbmUgbGlrZWQgaXQuICBUaGUgb3RoZXIgcmVhc29ucyBoYXZlIGJlZW4NCj5sYXJnZWx5IGxv c3QgdG8gdGltZS4NCj4NCj4+Pj4gICBUaGUgU1RBUlQgYW5kIFNUT1AgZmxhZ3MgYXJlIG11dHVh bGx5IGV4Y2x1c2l2ZS4gIFdoZW4gdGhlIFdBVENIRE9HDQo+Pj4+ICAgZmxhZyBpcyBzZXQgYWxv bmcgd2l0aCB0aGUgU1RBUlQgZmxhZywgaXQgaW5kaWNhdGVzIHRoYXQgdGhlIHVwZGF0ZQ0KPj4+ PiAgIHJlY29yZCBpcyBhIGR1cGxpY2F0ZSBvZiB0aGUgb3JpZ2luYWwgU1RBUlQgcmVjb3JkLg0K Pj4+PiANCj4+Pj4gKiB3aHkgd291bGQgYW4gdXBkYXRlIGR1cGxpY2F0ZSB0aGUgb3JpZ2luYWwg U1RBUlQgcmVjb3JkPyAgVGhpcyBzZWVtcw0KPj4+PiByZWR1bmRhbnQuDQo+Pj4+IFtXZWxsLCBo ZXJlIHdlIGFyZSBjb25zdHJhaW5lZCBieSBhIGNsZWFyIGRlZmluaXRpb24gZm9ybSBvcmlnaW5h bA0KPj4+PiBkcmFmdC5dDQo+Pj4gDQo+Pj4gV2hhdCBkb2VzIGl0IG1lYW4sIHRobz8gIFRoaXMg ZG9jdW1lbnQgc2hvdWxkIHNheS4gIGkuZS4gcG9ydGlvbnMgb2YNCj4+PiB0aGUgcHJvdG9jb2wg c2hvdWxkIG5vdCBiZSBsZWZ0IGFzICJ3ZSBoYXZlIG5vIGlkZWEgd2hhdCB0aGlzIG1lYW5zIi4N Cj4+IA0KPj4gSSB0aGluayBpdCBpcyBtb3JlIGEgY2FzZSBvZjogaXQgaXMgcmVkdW5kYW50LCBi dXQgaXQgd2FzIHNwZWNpZmllZCwgc28NCj4+d2UNCj4+IGNhbm5vdCBjaG9vc2UgdG8gY2hhbmdl IGl0IHRvIG1ha2UgaXQgbW9yZSBlZmZpY2llbnQuDQo+DQo+ICBJdCdzIG5vdCBhYm91dCBiZWlu ZyAibW9yZSBlZmZpY2llbnQiLiAgSXQncyBhYm91dCBzcGVjaWZ5aW5nIHdoYXQgdGhpcw0KPm1l YW5zLg0KPg0KPiAgSSBoYXZlIG5vIGlkZWEgd2hhdCBpdCBtZWFucyB0byBkdXBsaWNhdGUgYSBT VEFSVCByZWNvcmQuICBJcyB0aGUgZGF0YQ0KPmluIHRoZSBzZWNvbmQgU1RBUlQgdGhlIHNhbWU/ ICBJcyBpdCBkaWZmZXJlbnQ/ICBXaGF0IGlzIGRvbmUgaW4gZWl0aGVyDQo+Y2FzZT8NCj4NCj4g IEFnYWluLCB5b3UgbmVlZCB0byBkb2N1bWVudCB0aGUgcHJvdG9jb2wuICBJJ20gbm90IHN1cmUg dGhpcyBwb2ludCBpcw0KPmdldHRpbmcgYWNyb3NzLiAgSWYgeW91IGRvbid0IGtub3cgd2hhdCBh IHBvcnRpb24gb2YgdGhlIHByb3RvY29sIG1lYW5zLA0KPnRoZW4gZWl0aGVyIGZpbmQgb3V0IGFu ZCBkb2N1bWVudCBpdCwgb3IgZG9jdW1lbnQgdGhhdCAidGhpcyBleGlzdHMsIGJ1dA0KPndlIGhh dmUgbm8gaWRlYSB3aGF0IGl0IGlzLCB3aGF0IGl0IGRvZXMsIGFuZCB3ZSBkb24ndCByZWNvbW1l bmQgdGhhdA0KPnBlb3BsZSB1c2UgaXQiLg0KPg0KPiAgTGVhdmluZyBwb3J0aW9ucyBvZiB0aGUg cHJvdG9jb2wgZW50aXJlbHkgdW5kZWZpbmVkIGFuZA0KPmltcGxlbWVudGF0aW9uLWRlZmluZWQg aXMgYmFkLg0KPg0KPiAgSW4gUkFESVVTLCBJJ3ZlIGF1dGhvcmVkIG9yIGNvLWF1dGhvcmVkIGFi b3V0IDQgUkZDcyBmaXhpbmcgdGhpbmdzDQo+d2hpY2ggd2VyZSBtaXNzZWQgb3IgdW5kZWZpbmVk LCBhbmQgd2hpY2ggY2F1c2UgaW50ZXJvcGVyYWJpbGl0eSBpc3N1ZXMuDQo+QW5kIEknbSBzdGls bCBmaW5kaW5nIHRoaW5ncyB3aGljaCBhcmUgYnJva2VuIGluIHRoZSBzcGVjcy4gIFR3byBpbiB0 aGUNCj5sYXN0IG1vbnRoLCBpbiBmYWN0Li4uDQo+DQo+ICBJZiBUQUNBQ1MgaXMgdG8gYmUgYSBz dGFuZGFyZCwgaXQgc2hvdWxkIGJlIGNsZWFyIHdoYXQgcG9ydGlvbnMgYXJlDQo+d2VsbCBkZWZp bmVkLCBhbmQgd2hhdCBwb3J0aW9ucyBhcmUgIkkgZHVubm8uLi4iLiAgVGhhdCBnaXZlcyBndWlk YW5jZQ0KPmZvciBmdXR1cmUgZHJhZnRzIGFzIHRvIHdoYXQgd29ya3MsIGFuZCB3aGF0IG5lZWRz IGZpeGluZy4NCg0KSSB0aGluayB0aGVuIEkgY29tbWl0dGVkIGEgbWlzdW5kZXJzdGFuZGluZyBo ZXJlLiBJIHRob3VnaHQgeW91IHdlcmUNCnN1Z2dlc3RpbmcgdG8gZHJvcCB0aGUgcmVkdW5kYW50 IGFjY291bnRpbmcgcmVxdWVzdCwgbm93IEkgcmVhbGlzdCB5b3VyDQpjb21tZW50IGlzIHRvIGV4 cGxhaW4gd2h5IGl0IGlzIHVzZWQuIFN1cmUsIGNhbiBjbGFyaWZ5IHRoaXMuDQoNCg0KDQo+DQo+ Pj4+ICogaG93IG9mdGVuIGRvIHRoZSB1cGRhdGVzIGdldCBzZW50PyAgU2F5aW5nICJpbXBsZW1l bnRhdGlvbiBkZWZpbmVkIg0KPj4+PmlzDQo+Pj4+IE9LLCBidXQgc29tZSByZWNvbW1lbmRhdGlv bnMgd291bGQgYmUgZ29vZC4gIGkuZS4gbm90IG1vcmUgdGhhbiAxMDB4DQo+Pj4+cGVyDQo+Pj4+ IHNlY29uZCwgYW5kIG5vdCBsZXNzIHRoYW4gMSBkYXkgYXBhcnQgKGFzIGV4dHJlbWUgZXhhbXBs ZXMpDQo+Pj4+IFtzbyBsZXRzIHN0aWNrIHdpdGggaW1wbGVtZW50YXRpb24gZGVmaW5lZCwgdGhl IHJhbmdlIG9mIFQrIGRldmljZXMgd2UNCj4+Pj4gc2VlIGlzIHNvIGRpdmVyc2UgYW5kIHVzZSBj YXNlcyBhcmUgc3VjaCB0aGF0IEkgd291bGQgbm90IGxpa2UgdG8NCj4+Pj4gY29uc3RyYWluLl0N Cj4+PiANCj4+PiBJdCB3b3VsZCBiZSBnb29kIHRvIGhhdmUgcmVjb21tZW5kYXRpb25zLiAgZS5n LiAidXBkYXRlcyBtb3JlIHRoYW4gb25jZQ0KPj4+IHBlciBzZWNvbmQgYXJlIE5PVCBSRUNPTU1F TkQsIHVwZGF0ZXMgbW9yZSB0aGFuIGFuIGhvdXIgYXBhcnQgYXJlIE5PVA0KPj4+IFJFQ09NTUVO REVEIi4NCj4+PiANCj4+PiBUaGUgZ29hbCBpcyB0byBndWlkZSBpbXBsZW1lbnRvcnMgdG8gY2hv b3NpbmcgdmFsdWVzIHdoaWNoIHdvbid0IGNhdXNlDQo+Pj4gcHJvYmxlbXMgZm9yIGV2ZXJ5b25l IGVsc2UuDQo+PiANCj4+IFN1cmUsIHdpbGwgcmVjb21tZW5kIG1pbmltdW0gb2YgNSBzZWNvbmRz LCBidXQgSan2bSBub3Qgc3VyZSB3ZSBjYW4NCj4+c3BlY2lmeQ0KPj4gYW4gdXBwZXIgbGltaXQg YXMgaXQgaXMgbm90IG1hbmRhdG9yeS4NCj4NCj4gICBJdCdzIGFsd2F5cyBnb29kIHRvIHJlY29t bWVuZCBiZXN0IHByYWN0aWNlcywgZXZlbiBpZiB0aGUgYmVoYXZpb3VyDQo+aXNuJ3QgbWFuZGF0 b3J5Lg0KDQoNCkkgd2FzIHRoaW5raW5nIHJhdGhlciBhYm91dCB0aGUgc2NlbmFyaW8gdGhhdCBp dCBtYXkgbm90IHJlY3VyIGF0IGFsbC4uLg0KSG93ZXZlciwgd2UgY2FuIHNheTogZm9yIHJlY3Vy cmluZyBhY2NvdW50aW5nLCB0aGlzIGlzIHRoZSByYW5nZSAoNQ0Kc2Vjb25kcyB0byAxIGhvdXIp LCBvciB1cGRhdGVzIGFyZSBub3Qgc2VudCBhdCBhbGwuDQoNCj4NCj4gIEFsYW4gRGVLb2suDQo+ DQoNCg==